From 72459fbea9fd124e7d716812198ebc55dcb14866 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 7 Feb 2022 15:21:09 -0800
Subject: [PATCH 01/43] Add http proxy to web clients

---
 api/client/webclient/webclient.go | 1 +
 lib/client/https_client.go        | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index b82e16f7ac9fe..d877609c04240 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -46,6 +46,7 @@ func newWebClient(insecure bool, pool *x509.CertPool) *http.Client {
 				RootCAs:            pool,
 				InsecureSkipVerify: insecure,
 			},
+			Proxy: http.ProxyFromEnvironment,
 		},
 	}
 }
diff --git a/lib/client/https_client.go b/lib/client/https_client.go
index 4d1c94807dcec..8a95b3cf47497 100644
--- a/lib/client/https_client.go
+++ b/lib/client/https_client.go
@@ -41,6 +41,7 @@ func NewInsecureWebClient() *http.Client {
 	return &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: tlsConfig,
+			Proxy:           http.ProxyFromEnvironment,
 		},
 	}
 }
@@ -54,6 +55,7 @@ func newClientWithPool(pool *x509.CertPool) *http.Client {
 	return &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: tlsConfig,
+			Proxy:           http.ProxyFromEnvironment,
 		},
 	}
 }

From 05fa8b509e151ce67fe0bd70748a23d0ad627270 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 8 Feb 2022 12:45:15 -0800
Subject: [PATCH 02/43] Add tests

---
 api/client/webclient/webclient_test.go | 10 ++++++
 lib/client/https_client_test.go        | 42 ++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 lib/client/https_client_test.go

diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index 556d6cab96478..d3c9ba34fee70 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -22,6 +22,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -289,3 +290,12 @@ func TestExtract(t *testing.T) {
 		})
 	}
 }
+
+func TestNewWebClientRespectHTTPProxy(t *testing.T) {
+	os.Setenv("HTTPS_PROXY", "localhost:9999")
+	defer os.Unsetenv("HTTPS_PROXY")
+	client := newWebClient(false, nil)
+	_, err := client.Get("https://example.com")
+	// Client should try to proxy through nonexistent server at localhost.
+	require.Error(t, err)
+}
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
new file mode 100644
index 0000000000000..96bf5d1036117
--- /dev/null
+++ b/lib/client/https_client_test.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
+	os.Setenv("HTTPS_PROXY", "localhost:9999")
+	defer os.Unsetenv("HTTPS_PROXY")
+	client := NewInsecureWebClient()
+	_, err := client.Get("https://example.com")
+	// Client should try to proxy through nonexistent server at localhost.
+	require.Error(t, err)
+}
+
+func TestNewClientWithPoolHTTPProxy(t *testing.T) {
+	os.Setenv("HTTPS_PROXY", "localhost:9999")
+	defer os.Unsetenv("HTTPS_PROXY")
+	client := newClientWithPool(nil)
+	_, err := client.Get("https://example.com")
+	// Client should try to proxy through nonexistent server at localhost.
+	require.Error(t, err)
+}

From 37cd7861908e5391ca10933327ccf25a60bc71f0 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 8 Feb 2022 16:24:13 -0800
Subject: [PATCH 03/43] Reduce arg ambiguity

---
 api/client/webclient/webclient_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index d3c9ba34fee70..5075fda39a292 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -294,7 +294,7 @@ func TestExtract(t *testing.T) {
 func TestNewWebClientRespectHTTPProxy(t *testing.T) {
 	os.Setenv("HTTPS_PROXY", "localhost:9999")
 	defer os.Unsetenv("HTTPS_PROXY")
-	client := newWebClient(false, nil)
+	client := newWebClient(false /* insecure */, nil /* pool */)
 	_, err := client.Get("https://example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err)

From e2df5954be28ca435fd3a5b03c7f9c5e87660db4 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 8 Feb 2022 16:41:08 -0800
Subject: [PATCH 04/43] Make error assertions more specific

---
 api/client/webclient/webclient_test.go | 2 ++
 lib/client/https_client_test.go        | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index 5075fda39a292..ae3b78232687f 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -298,4 +298,6 @@ func TestNewWebClientRespectHTTPProxy(t *testing.T) {
 	_, err := client.Get("https://example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err)
+	require.Contains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "connection refused")
 }
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
index 96bf5d1036117..e8ba11315392d 100644
--- a/lib/client/https_client_test.go
+++ b/lib/client/https_client_test.go
@@ -30,6 +30,8 @@ func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
 	_, err := client.Get("https://example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err)
+	require.Contains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "connection refused")
 }
 
 func TestNewClientWithPoolHTTPProxy(t *testing.T) {
@@ -39,4 +41,6 @@ func TestNewClientWithPoolHTTPProxy(t *testing.T) {
 	_, err := client.Get("https://example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err)
+	require.Contains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "connection refused")
 }

From 8281dfc6731dddb5a2f6a0a751cc01d71d0d042b Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 9 Feb 2022 12:13:53 -0800
Subject: [PATCH 05/43] Fix linting

---
 api/client/webclient/webclient_test.go | 11 +++++++----
 lib/client/https_client_test.go        | 21 ++++++++++++++-------
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index ae3b78232687f..f5b36f08596ea 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -22,7 +22,6 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -292,10 +291,14 @@ func TestExtract(t *testing.T) {
 }
 
 func TestNewWebClientRespectHTTPProxy(t *testing.T) {
-	os.Setenv("HTTPS_PROXY", "localhost:9999")
-	defer os.Unsetenv("HTTPS_PROXY")
+	t.Setenv("HTTPS_PROXY", "localhost:9999")
 	client := newWebClient(false /* insecure */, nil /* pool */)
-	_, err := client.Get("https://example.com")
+	resp, err := client.Get("https://example.com")
+	defer func() {
+		if resp != nil {
+			resp.Body.Close()
+		}
+	}()
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "proxyconnect")
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
index e8ba11315392d..446695287c9c4 100644
--- a/lib/client/https_client_test.go
+++ b/lib/client/https_client_test.go
@@ -17,17 +17,20 @@ limitations under the License.
 package client
 
 import (
-	"os"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 )
 
 func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
-	os.Setenv("HTTPS_PROXY", "localhost:9999")
-	defer os.Unsetenv("HTTPS_PROXY")
+	t.Setenv("HTTPS_PROXY", "localhost:9999")
 	client := NewInsecureWebClient()
-	_, err := client.Get("https://example.com")
+	resp, err := client.Get("https://example.com")
+	defer func() {
+		if resp != nil {
+			resp.Body.Close()
+		}
+	}()
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "proxyconnect")
@@ -35,10 +38,14 @@ func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
 }
 
 func TestNewClientWithPoolHTTPProxy(t *testing.T) {
-	os.Setenv("HTTPS_PROXY", "localhost:9999")
-	defer os.Unsetenv("HTTPS_PROXY")
+	t.Setenv("HTTPS_PROXY", "localhost:9999")
 	client := newClientWithPool(nil)
-	_, err := client.Get("https://example.com")
+	resp, err := client.Get("https://example.com")
+	defer func() {
+		if resp != nil {
+			resp.Body.Close()
+		}
+	}()
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "proxyconnect")

From 700abc27d0e6047980e9d96e90c81a3aa88e6747 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 9 Feb 2022 12:41:49 -0800
Subject: [PATCH 06/43] Add messages to assertions

---
 api/client/webclient/webclient_test.go | 2 +-
 lib/client/https_client_test.go        | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index f5b36f08596ea..75fe4bcb8f584 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -300,7 +300,7 @@ func TestNewWebClientRespectHTTPProxy(t *testing.T) {
 		}
 	}()
 	// Client should try to proxy through nonexistent server at localhost.
-	require.Error(t, err)
+	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
 	require.Contains(t, err.Error(), "connection refused")
 }
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
index 446695287c9c4..3fac6f0440d3b 100644
--- a/lib/client/https_client_test.go
+++ b/lib/client/https_client_test.go
@@ -32,7 +32,7 @@ func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
 		}
 	}()
 	// Client should try to proxy through nonexistent server at localhost.
-	require.Error(t, err)
+	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
 	require.Contains(t, err.Error(), "connection refused")
 }
@@ -47,7 +47,7 @@ func TestNewClientWithPoolHTTPProxy(t *testing.T) {
 		}
 	}()
 	// Client should try to proxy through nonexistent server at localhost.
-	require.Error(t, err)
+	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
 	require.Contains(t, err.Error(), "connection refused")
 }

From d41122a6f20e90c306f6d4ce2b83d573174f3f8d Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 9 Feb 2022 13:22:01 -0800
Subject: [PATCH 07/43] Change fake proxy address in tests

---
 api/client/webclient/webclient_test.go | 4 ++--
 lib/client/https_client_test.go        | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index 75fe4bcb8f584..d7148542d7988 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -291,7 +291,7 @@ func TestExtract(t *testing.T) {
 }
 
 func TestNewWebClientRespectHTTPProxy(t *testing.T) {
-	t.Setenv("HTTPS_PROXY", "localhost:9999")
+	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
 	client := newWebClient(false /* insecure */, nil /* pool */)
 	resp, err := client.Get("https://example.com")
 	defer func() {
@@ -302,5 +302,5 @@ func TestNewWebClientRespectHTTPProxy(t *testing.T) {
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "connection refused")
+	require.Contains(t, err.Error(), "no such host")
 }
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
index 3fac6f0440d3b..2bb93cb88396f 100644
--- a/lib/client/https_client_test.go
+++ b/lib/client/https_client_test.go
@@ -23,7 +23,7 @@ import (
 )
 
 func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
-	t.Setenv("HTTPS_PROXY", "localhost:9999")
+	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
 	client := NewInsecureWebClient()
 	resp, err := client.Get("https://example.com")
 	defer func() {
@@ -34,11 +34,11 @@ func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "connection refused")
+	require.Contains(t, err.Error(), "no such host")
 }
 
 func TestNewClientWithPoolHTTPProxy(t *testing.T) {
-	t.Setenv("HTTPS_PROXY", "localhost:9999")
+	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
 	client := newClientWithPool(nil)
 	resp, err := client.Get("https://example.com")
 	defer func() {
@@ -49,5 +49,5 @@ func TestNewClientWithPoolHTTPProxy(t *testing.T) {
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "connection refused")
+	require.Contains(t, err.Error(), "no such host")
 }

From d225e71efce9f310eeb5962e9794682f1e20a5f7 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Thu, 10 Feb 2022 15:07:01 -0800
Subject: [PATCH 08/43] Add http proxy support for ssh

---
 lib/client/api.go        | 40 +++++++--------------
 lib/utils/proxy/proxy.go | 78 ++++++++++++++++++++++++++--------------
 2 files changed, 64 insertions(+), 54 deletions(-)

diff --git a/lib/client/api.go b/lib/client/api.go
index dadf89ae0e3c7..6a5a6a9db97f4 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -68,6 +68,7 @@ import (
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/agentconn"
+	"github.com/gravitational/teleport/lib/utils/proxy"
 
 	"github.com/gravitational/trace"
 
@@ -2198,37 +2199,20 @@ func (tc *TeleportClient) connectToProxy(ctx context.Context) (*ProxyClient, err
 	}, nil
 }
 
-func makeProxySSHClientWithTLSWrapper(tc *TeleportClient, sshConfig *ssh.ClientConfig) (*ssh.Client, error) {
-	cfg := tc.Config
-	clientTLSConf, err := tc.loadTLSConfig()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	clientTLSConf.NextProtos = []string{string(alpncommon.ProtocolProxySSH)}
-	clientTLSConf.InsecureSkipVerify = cfg.InsecureSkipVerify
-
-	tlsConn, err := tls.Dial("tcp", cfg.WebProxyAddr, clientTLSConf)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed to dial tls %v", cfg.WebProxyAddr)
-	}
-	c, chans, reqs, err := ssh.NewClientConn(tlsConn, cfg.WebProxyAddr, sshConfig)
-	if err != nil {
-		// tlsConn is closed inside ssh.NewClientConn function
-		return nil, trace.Wrap(err, "failed to authenticate with proxy %v", cfg.WebProxyAddr)
-	}
-	return ssh.NewClient(c, chans, reqs), nil
-}
-
 func makeProxySSHClient(tc *TeleportClient, sshConfig *ssh.ClientConfig) (*ssh.Client, error) {
+	var opts []proxy.DialerOptionFunc
 	if tc.Config.TLSRoutingEnabled {
-		return makeProxySSHClientWithTLSWrapper(tc, sshConfig)
-	}
-	client, err := ssh.Dial("tcp", tc.Config.SSHProxyAddr, sshConfig)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed to authenticate with proxy %v", tc.Config.SSHProxyAddr)
+		tlsConfig, err := tc.loadTLSConfig()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		tlsConfig.NextProtos = []string{string(alpncommon.ProtocolProxySSH)}
+		tlsConfig.InsecureSkipVerify = tc.Config.InsecureSkipVerify
+		opts = append(opts, proxy.WithALPNDialer(), proxy.WithTLSConfig(tlsConfig))
 	}
-	return client, nil
+	dialer := proxy.DialerFromEnvironment(tc.Config.WebProxyAddr, opts...)
+	client, err := dialer.Dial("tcp", tc.Config.SSHProxyAddr, sshConfig)
+	return client, trace.Wrap(err, "failed to authenticate with proxy %v", tc.Config.SSHProxyAddr)
 }
 
 func (tc *TeleportClient) rootClusterName() (string, error) {
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index 9ef5d2ac57fee..6aba7c404287f 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -57,7 +57,7 @@ func dialWithDeadline(network string, addr string, config *ssh.ClientConfig) (*s
 // dialALPNWithDeadline allows connecting to Teleport in single-port mode. SSH protocol is wrapped into
 // TLS connection where TLS ALPN protocol is set to ProtocolReverseTunnel allowing ALPN Proxy to route the
 // incoming connection to ReverseTunnel proxy service.
-func dialALPNWithDeadline(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
+func dialALPNWithDeadline(network string, addr string, config *ssh.ClientConfig, tlsConfig *tls.Config) (*ssh.Client, error) {
 	dialer := &net.Dialer{
 		Timeout: config.Timeout,
 	}
@@ -65,11 +65,15 @@ func dialALPNWithDeadline(network string, addr string, config *ssh.ClientConfig)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	tlsConn, err := tls.DialWithDialer(dialer, network, addr, &tls.Config{
-		NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
-		InsecureSkipVerify: lib.IsInsecureDevMode(),
-		ServerName:         address.Host(),
-	})
+	conf := tlsConfig.Clone()
+	if conf == nil {
+		conf = &tls.Config{
+			NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
+			InsecureSkipVerify: lib.IsInsecureDevMode(),
+		}
+	}
+	conf.ServerName = address.Host()
+	tlsConn, err := tls.DialWithDialer(dialer, network, addr, conf)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -86,13 +90,14 @@ type Dialer interface {
 }
 
 type directDial struct {
-	useTLS bool
+	useTLS    bool
+	tlsConfig *tls.Config
 }
 
 // Dial calls ssh.Dial directly.
 func (d directDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	if d.useTLS {
-		client, err := dialALPNWithDeadline(network, addr, config)
+		client, err := dialALPNWithDeadline(network, addr, config, d.tlsConfig)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -112,11 +117,15 @@ func (d directDial) DialTimeout(network, address string, timeout time.Duration)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		tlsConn, err := tls.Dial("tcp", address, &tls.Config{
-			NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
-			InsecureSkipVerify: lib.IsInsecureDevMode(),
-			ServerName:         addr.Host(),
-		})
+		conf := d.tlsConfig.Clone()
+		if conf == nil {
+			conf = &tls.Config{
+				NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
+				InsecureSkipVerify: lib.IsInsecureDevMode(),
+			}
+		}
+		conf.ServerName = addr.Host()
+		tlsConn, err := tls.Dial("tcp", address, conf)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -132,6 +141,7 @@ func (d directDial) DialTimeout(network, address string, timeout time.Duration)
 type proxyDial struct {
 	proxyHost string
 	useTLS    bool
+	tlsConfig *tls.Config
 }
 
 // DialTimeout acts like Dial but takes a timeout.
@@ -152,11 +162,15 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		conn = tls.Client(conn, &tls.Config{
-			NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
-			InsecureSkipVerify: lib.IsInsecureDevMode(),
-			ServerName:         address.Host(),
-		})
+		conf := d.tlsConfig.Clone()
+		if conf == nil {
+			conf = &tls.Config{
+				NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
+				InsecureSkipVerify: lib.IsInsecureDevMode(),
+			}
+		}
+		conf.ServerName = address.Host()
+		conn = tls.Client(conn, conf)
 	}
 	return conn, nil
 }
@@ -177,11 +191,15 @@ func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		pconn = tls.Client(pconn, &tls.Config{
-			NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
-			InsecureSkipVerify: lib.IsInsecureDevMode(),
-			ServerName:         address.Host(),
-		})
+		conf := d.tlsConfig.Clone()
+		if conf == nil {
+			conf = &tls.Config{
+				NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
+				InsecureSkipVerify: lib.IsInsecureDevMode(),
+			}
+		}
+		conf.ServerName = address.Host()
+		pconn = tls.Client(pconn, conf)
 	}
 
 	// Do the same as ssh.Dial but pass in proxy connection.
@@ -196,7 +214,8 @@ func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (
 }
 
 type dialerOptions struct {
-	dialTLS bool
+	dialTLS   bool
+	tlsConfig *tls.Config
 }
 
 // DialerOptionFunc allows setting options as functional arguments to DialerFromEnvironment
@@ -209,6 +228,13 @@ func WithALPNDialer() DialerOptionFunc {
 	}
 }
 
+// WithTLSConfig creates a dialer that uses a specific tls config.
+func WithTLSConfig(tlsConfig *tls.Config) DialerOptionFunc {
+	return func(options *dialerOptions) {
+		options.tlsConfig = tlsConfig
+	}
+}
+
 // DialerFromEnvironment returns a Dial function. If the https_proxy or http_proxy
 // environment variable are set, it returns a function that will dial through
 // said proxy server. If neither variable is set, it will connect to the SSH
@@ -226,10 +252,10 @@ func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 	// otherwise return a proxy dialer.
 	if proxyAddr == "" {
 		log.Debugf("No proxy set in environment, returning direct dialer.")
-		return directDial{useTLS: options.dialTLS}
+		return directDial{useTLS: options.dialTLS, tlsConfig: options.tlsConfig}
 	}
 	log.Debugf("Found proxy %q in environment, returning proxy dialer.", proxyAddr)
-	return proxyDial{proxyHost: proxyAddr, useTLS: options.dialTLS}
+	return proxyDial{proxyHost: proxyAddr, useTLS: options.dialTLS, tlsConfig: options.tlsConfig}
 }
 
 type DirectDialerOptFunc func(dial *directDial)

From 810d958b90744e2101f77af63e6252f75301add0 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 15 Feb 2022 13:40:30 -0800
Subject: [PATCH 09/43] Move proxy utils to api

---
 {lib => api}/utils/proxy/noproxy.go    |   0
 api/utils/proxy/proxy.go               | 144 +++++++++++++++++++++++++
 {lib => api}/utils/proxy/proxy_test.go |   2 +-
 lib/utils/proxy/proxy.go               | 125 +--------------------
 4 files changed, 149 insertions(+), 122 deletions(-)
 rename {lib => api}/utils/proxy/noproxy.go (100%)
 create mode 100644 api/utils/proxy/proxy.go
 rename {lib => api}/utils/proxy/proxy_test.go (98%)

diff --git a/lib/utils/proxy/noproxy.go b/api/utils/proxy/noproxy.go
similarity index 100%
rename from lib/utils/proxy/noproxy.go
rename to api/utils/proxy/noproxy.go
diff --git a/api/utils/proxy/proxy.go b/api/utils/proxy/proxy.go
new file mode 100644
index 0000000000000..631be761fd70a
--- /dev/null
+++ b/api/utils/proxy/proxy.go
@@ -0,0 +1,144 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bufio"
+	"context"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/trace"
+	"github.com/siddontang/go/log"
+)
+
+func DialProxy(ctx context.Context, proxyAddr string, addr string) (net.Conn, error) {
+	var d net.Dialer
+	conn, err := d.DialContext(ctx, "tcp", proxyAddr)
+	if err != nil {
+		log.Warnf("Unable to dial to proxy: %v: %v.", proxyAddr, err)
+		return nil, trace.ConvertSystemError(err)
+	}
+
+	connectReq := &http.Request{
+		Method: http.MethodConnect,
+		URL:    &url.URL{Opaque: addr},
+		Host:   addr,
+		Header: make(http.Header),
+	}
+	err = connectReq.Write(conn)
+	if err != nil {
+		log.Warnf("Unable to write to proxy: %v.", err)
+		return nil, trace.Wrap(err)
+	}
+
+	// Read in the response. http.ReadResponse will read in the status line, mime
+	// headers, and potentially part of the response body. the body itself will
+	// not be read, but kept around so it can be read later.
+	br := bufio.NewReader(conn)
+	// Per the above comment, we're only using ReadResponse to check the status
+	// and then hand off the underlying connection to the caller.
+	// resp.Body.Close() would drain conn and close it, we don't need to do it
+	// here. Disabling bodyclose linter for this edge case.
+	//nolint:bodyclose
+	resp, err := http.ReadResponse(br, connectReq)
+	if err != nil {
+		conn.Close()
+		log.Warnf("Unable to read response: %v.", err)
+		return nil, trace.Wrap(err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		conn.Close()
+		return nil, trace.BadParameter("unable to proxy connection: %v", resp.Status)
+	}
+
+	// Return a bufferedConn that wraps a net.Conn and a *bufio.Reader. this
+	// needs to be done because http.ReadResponse will buffer part of the
+	// response body in the *bufio.Reader that was passed in. reads must first
+	// come from anything buffered, then from the underlying connection otherwise
+	// data will be lost.
+	return &bufferedConn{
+		Conn:   conn,
+		reader: br,
+	}, nil
+}
+
+func GetProxyAddress(addr string) string {
+	envs := []string{
+		teleport.HTTPSProxy,
+		strings.ToLower(teleport.HTTPSProxy),
+		teleport.HTTPProxy,
+		strings.ToLower(teleport.HTTPProxy),
+	}
+
+	for _, v := range envs {
+		envAddr := os.Getenv(v)
+		if envAddr == "" {
+			continue
+		}
+		proxyAddr, err := parse(envAddr)
+		if err != nil {
+			log.Debugf("Unable to parse environment variable %q: %q.", v, envAddr)
+			continue
+		}
+		log.Debugf("Successfully parsed environment variable %q: %q to %q.", v, envAddr, proxyAddr)
+		if !useProxy(addr) {
+			log.Debugf("Matched NO_PROXY override for %q: %q, going to ignore proxy variable.", v, envAddr)
+			return ""
+		}
+		return proxyAddr
+	}
+
+	log.Debugf("No valid environment variables found.")
+	return ""
+}
+
+// bufferedConn is used when part of the data on a connection has already been
+// read by a *bufio.Reader. Reads will first try and read from the
+// *bufio.Reader and when everything has been read, reads will go to the
+// underlying connection.
+type bufferedConn struct {
+	net.Conn
+	reader *bufio.Reader
+}
+
+// Read first reads from the *bufio.Reader any data that has already been
+// buffered. Once all buffered data has been read, reads go to the net.Conn.
+func (bc *bufferedConn) Read(b []byte) (n int, err error) {
+	if bc.reader.Buffered() > 0 {
+		return bc.reader.Read(b)
+	}
+	return bc.Conn.Read(b)
+}
+
+// parse will extract the host:port of the proxy to dial to. If the
+// value is not prefixed by "http", then it will prepend "http" and try.
+func parse(addr string) (string, error) {
+	proxyurl, err := url.Parse(addr)
+	if err != nil || !strings.HasPrefix(proxyurl.Scheme, "http") {
+		proxyurl, err = url.Parse("http://" + addr)
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+	}
+
+	return proxyurl.Host, nil
+}
diff --git a/lib/utils/proxy/proxy_test.go b/api/utils/proxy/proxy_test.go
similarity index 98%
rename from lib/utils/proxy/proxy_test.go
rename to api/utils/proxy/proxy_test.go
index a5c986acd89c5..1067c31d91ef4 100644
--- a/lib/utils/proxy/proxy_test.go
+++ b/api/utils/proxy/proxy_test.go
@@ -96,7 +96,7 @@ func TestGetProxyAddress(t *testing.T) {
 			for _, env := range tt.env {
 				t.Setenv(env.name, env.val)
 			}
-			p := getProxyAddress(tt.targetAddr)
+			p := GetProxyAddress(tt.targetAddr)
 			require.Equal(t, tt.proxyAddr, p)
 		})
 	}
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index 6aba7c404287f..bc6f56560f5f6 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -16,19 +16,15 @@ limitations under the License.
 package proxy
 
 import (
-	"bufio"
 	"context"
 	"crypto/tls"
 	"net"
-	"net/http"
-	"net/url"
-	"os"
-	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	apiproxy "github.com/gravitational/teleport/api/utils/proxy"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib"
 	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
@@ -153,7 +149,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 		defer cancel()
 		ctx = timeoutCtx
 	}
-	conn, err := dialProxy(ctx, d.proxyHost, address)
+	conn, err := apiproxy.DialProxy(ctx, d.proxyHost, address)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -179,7 +175,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 // SSH connection.
 func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	// Build a proxy connection first.
-	pconn, err := dialProxy(context.Background(), d.proxyHost, addr)
+	pconn, err := apiproxy.DialProxy(context.Background(), d.proxyHost, addr)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -241,7 +237,7 @@ func WithTLSConfig(tlsConfig *tls.Config) DialerOptionFunc {
 // server directly.
 func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 	// Try and get proxy addr from the environment.
-	proxyAddr := getProxyAddress(addr)
+	proxyAddr := apiproxy.GetProxyAddress(addr)
 
 	var options dialerOptions
 	for _, opt := range opts {
@@ -259,116 +255,3 @@ func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 }
 
 type DirectDialerOptFunc func(dial *directDial)
-
-func dialProxy(ctx context.Context, proxyAddr string, addr string) (net.Conn, error) {
-	var d net.Dialer
-	conn, err := d.DialContext(ctx, "tcp", proxyAddr)
-	if err != nil {
-		log.Warnf("Unable to dial to proxy: %v: %v.", proxyAddr, err)
-		return nil, trace.ConvertSystemError(err)
-	}
-
-	connectReq := &http.Request{
-		Method: http.MethodConnect,
-		URL:    &url.URL{Opaque: addr},
-		Host:   addr,
-		Header: make(http.Header),
-	}
-	err = connectReq.Write(conn)
-	if err != nil {
-		log.Warnf("Unable to write to proxy: %v.", err)
-		return nil, trace.Wrap(err)
-	}
-
-	// Read in the response. http.ReadResponse will read in the status line, mime
-	// headers, and potentially part of the response body. the body itself will
-	// not be read, but kept around so it can be read later.
-	br := bufio.NewReader(conn)
-	// Per the above comment, we're only using ReadResponse to check the status
-	// and then hand off the underlying connection to the caller.
-	// resp.Body.Close() would drain conn and close it, we don't need to do it
-	// here. Disabling bodyclose linter for this edge case.
-	//nolint:bodyclose
-	resp, err := http.ReadResponse(br, connectReq)
-	if err != nil {
-		conn.Close()
-		log.Warnf("Unable to read response: %v.", err)
-		return nil, trace.Wrap(err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		conn.Close()
-		return nil, trace.BadParameter("unable to proxy connection: %v", resp.Status)
-	}
-
-	// Return a bufferedConn that wraps a net.Conn and a *bufio.Reader. this
-	// needs to be done because http.ReadResponse will buffer part of the
-	// response body in the *bufio.Reader that was passed in. reads must first
-	// come from anything buffered, then from the underlying connection otherwise
-	// data will be lost.
-	return &bufferedConn{
-		Conn:   conn,
-		reader: br,
-	}, nil
-}
-
-func getProxyAddress(addr string) string {
-	envs := []string{
-		teleport.HTTPSProxy,
-		strings.ToLower(teleport.HTTPSProxy),
-		teleport.HTTPProxy,
-		strings.ToLower(teleport.HTTPProxy),
-	}
-
-	for _, v := range envs {
-		envAddr := os.Getenv(v)
-		if envAddr == "" {
-			continue
-		}
-		proxyAddr, err := parse(envAddr)
-		if err != nil {
-			log.Debugf("Unable to parse environment variable %q: %q.", v, envAddr)
-			continue
-		}
-		log.Debugf("Successfully parsed environment variable %q: %q to %q.", v, envAddr, proxyAddr)
-		if !useProxy(addr) {
-			log.Debugf("Matched NO_PROXY override for %q: %q, going to ignore proxy variable.", v, envAddr)
-			return ""
-		}
-		return proxyAddr
-	}
-
-	log.Debugf("No valid environment variables found.")
-	return ""
-}
-
-// bufferedConn is used when part of the data on a connection has already been
-// read by a *bufio.Reader. Reads will first try and read from the
-// *bufio.Reader and when everything has been read, reads will go to the
-// underlying connection.
-type bufferedConn struct {
-	net.Conn
-	reader *bufio.Reader
-}
-
-// Read first reads from the *bufio.Reader any data that has already been
-// buffered. Once all buffered data has been read, reads go to the net.Conn.
-func (bc *bufferedConn) Read(b []byte) (n int, err error) {
-	if bc.reader.Buffered() > 0 {
-		return bc.reader.Read(b)
-	}
-	return bc.Conn.Read(b)
-}
-
-// parse will extract the host:port of the proxy to dial to. If the
-// value is not prefixed by "http", then it will prepend "http" and try.
-func parse(addr string) (string, error) {
-	proxyurl, err := url.Parse(addr)
-	if err != nil || !strings.HasPrefix(proxyurl.Scheme, "http") {
-		proxyurl, err = url.Parse("http://" + addr)
-		if err != nil {
-			return "", trace.Wrap(err)
-		}
-	}
-
-	return proxyurl.Host, nil
-}

From dd5e2328f80846af49c2ab4870780477cf67fc3c Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 15 Feb 2022 14:59:55 -0800
Subject: [PATCH 10/43] Add proxy-aware context dialer

---
 api/client/client.go                      |  2 +-
 api/client/contextdialer.go               | 11 +++++++++++
 api/{utils/proxy => client}/noproxy.go    |  2 +-
 api/{utils/proxy => client}/proxy.go      | 10 ++++++----
 api/{utils/proxy => client}/proxy_test.go |  2 +-
 lib/auth/clt.go                           |  2 +-
 lib/utils/proxy/proxy.go                  |  8 ++++----
 7 files changed, 25 insertions(+), 12 deletions(-)
 rename api/{utils/proxy => client}/noproxy.go (99%)
 rename api/{utils/proxy => client}/proxy.go (94%)
 rename api/{utils/proxy => client}/proxy_test.go (99%)

diff --git a/api/client/client.go b/api/client/client.go
index c2ec9efe65bcc..84dc97e666815 100644
--- a/api/client/client.go
+++ b/api/client/client.go
@@ -283,7 +283,7 @@ type connectParams struct {
 
 // authConnect connects to the Teleport Auth Server directly.
 func authConnect(ctx context.Context, params connectParams) (*Client, error) {
-	dialer := NewDirectDialer(params.cfg.KeepAlivePeriod, params.cfg.DialTimeout)
+	dialer := NewDialer(params.cfg.KeepAlivePeriod, params.cfg.DialTimeout)
 	clt := newClient(params.cfg, dialer, params.tlsConfig)
 	if err := clt.dialGRPC(ctx, params.addr); err != nil {
 		return nil, trace.Wrap(err, "failed to connect to addr %v as an auth server", params.addr)
diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 2c2d08e29e894..62da334808e5a 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -52,6 +52,17 @@ func NewDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	}
 }
 
+// NewDialer makes a new dialer that connects to an Auth server either directly or via an HTTP proxy/
+func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
+	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
+	return ContextDialerFunc(func(ctx context.Context, network, addr string) (net.Conn, error) {
+		if proxyAddr := GetProxyAddress(addr); proxyAddr != "" {
+			return DialProxy(ctx, proxyAddr, addr, dialer)
+		}
+		return dialer.DialContext(ctx, network, addr)
+	})
+}
+
 // NewProxyDialer makes a dialer to connect to an Auth server through the SSH reverse tunnel on the proxy.
 // The dialer will ping the web client to discover the tunnel proxy address on each dial.
 func NewProxyDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration, discoveryAddr string, insecure bool) ContextDialer {
diff --git a/api/utils/proxy/noproxy.go b/api/client/noproxy.go
similarity index 99%
rename from api/utils/proxy/noproxy.go
rename to api/client/noproxy.go
index d9dcdb5f3d8a9..159ad56b8d382 100644
--- a/api/utils/proxy/noproxy.go
+++ b/api/client/noproxy.go
@@ -7,7 +7,7 @@
 // This is the low-level Transport implementation of RoundTripper.
 // The high-level interface is in client.go.
 
-package proxy
+package client
 
 import (
 	"os"
diff --git a/api/utils/proxy/proxy.go b/api/client/proxy.go
similarity index 94%
rename from api/utils/proxy/proxy.go
rename to api/client/proxy.go
index 631be761fd70a..3fc54104ec5a6 100644
--- a/api/utils/proxy/proxy.go
+++ b/api/client/proxy.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package proxy
+package client
 
 import (
 	"bufio"
@@ -30,9 +30,11 @@ import (
 	"github.com/siddontang/go/log"
 )
 
-func DialProxy(ctx context.Context, proxyAddr string, addr string) (net.Conn, error) {
-	var d net.Dialer
-	conn, err := d.DialContext(ctx, "tcp", proxyAddr)
+func DialProxy(ctx context.Context, proxyAddr, addr string, dialer ContextDialer) (net.Conn, error) {
+	if dialer == nil {
+		dialer = &net.Dialer{}
+	}
+	conn, err := dialer.DialContext(ctx, "tcp", proxyAddr)
 	if err != nil {
 		log.Warnf("Unable to dial to proxy: %v: %v.", proxyAddr, err)
 		return nil, trace.ConvertSystemError(err)
diff --git a/api/utils/proxy/proxy_test.go b/api/client/proxy_test.go
similarity index 99%
rename from api/utils/proxy/proxy_test.go
rename to api/client/proxy_test.go
index 1067c31d91ef4..d1d781f137fdd 100644
--- a/api/utils/proxy/proxy_test.go
+++ b/api/client/proxy_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package proxy
+package client
 
 import (
 	"fmt"
diff --git a/lib/auth/clt.go b/lib/auth/clt.go
index 49a5f23b83845..e74f3654f7db5 100644
--- a/lib/auth/clt.go
+++ b/lib/auth/clt.go
@@ -128,7 +128,7 @@ func NewHTTPClient(cfg client.Config, tls *tls.Config, params ...roundtrip.Clien
 		if len(cfg.Addrs) == 0 {
 			return nil, trace.BadParameter("no addresses to dial")
 		}
-		contextDialer := client.NewDirectDialer(cfg.KeepAlivePeriod, cfg.DialTimeout)
+		contextDialer := client.NewDialer(cfg.KeepAlivePeriod, cfg.DialTimeout)
 		dialer = client.ContextDialerFunc(func(ctx context.Context, network, _ string) (conn net.Conn, err error) {
 			for _, addr := range cfg.Addrs {
 				conn, err = contextDialer.DialContext(ctx, network, addr)
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index bc6f56560f5f6..683e625144e58 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -24,7 +24,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
-	apiproxy "github.com/gravitational/teleport/api/utils/proxy"
+	apiclient "github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib"
 	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
@@ -149,7 +149,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 		defer cancel()
 		ctx = timeoutCtx
 	}
-	conn, err := apiproxy.DialProxy(ctx, d.proxyHost, address)
+	conn, err := apiclient.DialProxy(ctx, d.proxyHost, address, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -175,7 +175,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 // SSH connection.
 func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	// Build a proxy connection first.
-	pconn, err := apiproxy.DialProxy(context.Background(), d.proxyHost, addr)
+	pconn, err := apiclient.DialProxy(context.Background(), d.proxyHost, addr, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -237,7 +237,7 @@ func WithTLSConfig(tlsConfig *tls.Config) DialerOptionFunc {
 // server directly.
 func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 	// Try and get proxy addr from the environment.
-	proxyAddr := apiproxy.GetProxyAddress(addr)
+	proxyAddr := apiclient.GetProxyAddress(addr)
 
 	var options dialerOptions
 	for _, opt := range opts {

From 7981450ce8a5e835be190a121eb06b3611e9802a Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 16 Feb 2022 15:31:26 -0800
Subject: [PATCH 11/43] Fix incorrect address in makeProxySSHClient

---
 api/client/contextdialer.go | 3 ++-
 lib/client/api.go           | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 62da334808e5a..0797ec1a7a64e 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -52,7 +52,8 @@ func NewDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	}
 }
 
-// NewDialer makes a new dialer that connects to an Auth server either directly or via an HTTP proxy/
+// NewDialer makes a new dialer that connects to an Auth server either directly or via an HTTP proxy, depending
+// on the environment.
 func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (net.Conn, error) {
diff --git a/lib/client/api.go b/lib/client/api.go
index 6a5a6a9db97f4..09e80be1ce0a4 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -2201,6 +2201,7 @@ func (tc *TeleportClient) connectToProxy(ctx context.Context) (*ProxyClient, err
 
 func makeProxySSHClient(tc *TeleportClient, sshConfig *ssh.ClientConfig) (*ssh.Client, error) {
 	var opts []proxy.DialerOptionFunc
+	addr := tc.Config.SSHProxyAddr
 	if tc.Config.TLSRoutingEnabled {
 		tlsConfig, err := tc.loadTLSConfig()
 		if err != nil {
@@ -2208,10 +2209,11 @@ func makeProxySSHClient(tc *TeleportClient, sshConfig *ssh.ClientConfig) (*ssh.C
 		}
 		tlsConfig.NextProtos = []string{string(alpncommon.ProtocolProxySSH)}
 		tlsConfig.InsecureSkipVerify = tc.Config.InsecureSkipVerify
+		addr = tc.Config.WebProxyAddr
 		opts = append(opts, proxy.WithALPNDialer(), proxy.WithTLSConfig(tlsConfig))
 	}
-	dialer := proxy.DialerFromEnvironment(tc.Config.WebProxyAddr, opts...)
-	client, err := dialer.Dial("tcp", tc.Config.SSHProxyAddr, sshConfig)
+	dialer := proxy.DialerFromEnvironment(addr, opts...)
+	client, err := dialer.Dial("tcp", addr, sshConfig)
 	return client, trace.Wrap(err, "failed to authenticate with proxy %v", tc.Config.SSHProxyAddr)
 }
 

From ad44ccf0b5d3a095e095e5e40cdcc2866f5e69e3 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 1 Mar 2022 14:48:01 -0800
Subject: [PATCH 12/43] Add docs

---
 api/client/proxy.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/api/client/proxy.go b/api/client/proxy.go
index 3fc54104ec5a6..d7ee2d9431800 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -30,6 +30,7 @@ import (
 	"github.com/siddontang/go/log"
 )
 
+// DialProxy creates a connection to a server via an HTTP Proxy.
 func DialProxy(ctx context.Context, proxyAddr, addr string, dialer ContextDialer) (net.Conn, error) {
 	if dialer == nil {
 		dialer = &net.Dialer{}
@@ -83,6 +84,7 @@ func DialProxy(ctx context.Context, proxyAddr, addr string, dialer ContextDialer
 	}, nil
 }
 
+// GetProxyAddress gets the HTTP proxy address to use for a given address, if any.
 func GetProxyAddress(addr string) string {
 	envs := []string{
 		teleport.HTTPSProxy,

From de6c7155e6d80d9774f03b86c47e6841f9081a53 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 1 Mar 2022 15:11:03 -0800
Subject: [PATCH 13/43] Add NO_PROXY tests

---
 api/client/webclient/webclient_test.go | 10 ++++++++++
 lib/client/https_client_test.go        | 21 +++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index d7148542d7988..fd9d81fab02d8 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -304,3 +304,13 @@ func TestNewWebClientRespectHTTPProxy(t *testing.T) {
 	require.Contains(t, err.Error(), "proxyconnect")
 	require.Contains(t, err.Error(), "no such host")
 }
+
+func TestNewWebClientNoProxy(t *testing.T) {
+	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
+	t.Setenv("NO_PROXY", "example.com")
+	client := newWebClient(false /* insecure */, nil /* pool */)
+	resp, err := client.Get("https://example.com")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+}
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
index 2bb93cb88396f..b0cced4188890 100644
--- a/lib/client/https_client_test.go
+++ b/lib/client/https_client_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package client
 
 import (
+	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -37,6 +38,16 @@ func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
 	require.Contains(t, err.Error(), "no such host")
 }
 
+func TestNewInsecureWebClientNoProxy(t *testing.T) {
+	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
+	t.Setenv("NO_PROXY", "example.com")
+	client := NewInsecureWebClient()
+	resp, err := client.Get("https://example.com")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+}
+
 func TestNewClientWithPoolHTTPProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
 	client := newClientWithPool(nil)
@@ -51,3 +62,13 @@ func TestNewClientWithPoolHTTPProxy(t *testing.T) {
 	require.Contains(t, err.Error(), "proxyconnect")
 	require.Contains(t, err.Error(), "no such host")
 }
+
+func TestNewClientWithPoolNoProxy(t *testing.T) {
+	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
+	t.Setenv("NO_PROXY", "example.com")
+	client := newClientWithPool(nil)
+	resp, err := client.Get("https://example.com")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+}

From df6c5e2875da4913b622290bdc0b478a0872ca37 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 1 Mar 2022 16:00:36 -0800
Subject: [PATCH 14/43] Simplify bodyclose workaround

---
 api/client/webclient/webclient_test.go |  7 ++-----
 lib/client/https_client_test.go        | 14 ++++----------
 2 files changed, 6 insertions(+), 15 deletions(-)

diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index fd9d81fab02d8..963b6b5f2156c 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -293,12 +293,9 @@ func TestExtract(t *testing.T) {
 func TestNewWebClientRespectHTTPProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
 	client := newWebClient(false /* insecure */, nil /* pool */)
+	// resp should be nil, so there will be no body to close.
+	//nolint:bodyclose
 	resp, err := client.Get("https://example.com")
-	defer func() {
-		if resp != nil {
-			resp.Body.Close()
-		}
-	}()
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
index b0cced4188890..ea5fac1a89a4d 100644
--- a/lib/client/https_client_test.go
+++ b/lib/client/https_client_test.go
@@ -26,12 +26,9 @@ import (
 func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
 	client := NewInsecureWebClient()
+	// resp should be nil, so there will be no body to close.
+	//nolint:bodyclose
 	resp, err := client.Get("https://example.com")
-	defer func() {
-		if resp != nil {
-			resp.Body.Close()
-		}
-	}()
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
@@ -51,12 +48,9 @@ func TestNewInsecureWebClientNoProxy(t *testing.T) {
 func TestNewClientWithPoolHTTPProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
 	client := newClientWithPool(nil)
+	// resp should be nil, so there will be no body to close.
+	//nolint:bodyclose
 	resp, err := client.Get("https://example.com")
-	defer func() {
-		if resp != nil {
-			resp.Body.Close()
-		}
-	}()
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")

From bde8fb2c7e7728c9b83a8a65432d26f23b9e1ff9 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 2 Mar 2022 16:08:50 -0800
Subject: [PATCH 15/43] Stop caching env vars

---
 api/client/webclient/webclient.go | 5 ++++-
 lib/client/https_client.go        | 9 +++++++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index 1b684c0969218..53a496587f5b8 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -33,6 +33,7 @@ import (
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/utils"
+	"golang.org/x/net/http/httpproxy"
 
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
@@ -46,7 +47,9 @@ func newWebClient(insecure bool, pool *x509.CertPool) *http.Client {
 				RootCAs:            pool,
 				InsecureSkipVerify: insecure,
 			},
-			Proxy: http.ProxyFromEnvironment,
+			Proxy: func(req *http.Request) (*url.URL, error) {
+				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
+			},
 		},
 	}
 }
diff --git a/lib/client/https_client.go b/lib/client/https_client.go
index 8a95b3cf47497..c9f01aead2cb0 100644
--- a/lib/client/https_client.go
+++ b/lib/client/https_client.go
@@ -27,6 +27,7 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/utils"
+	"golang.org/x/net/http/httpproxy"
 
 	"github.com/gravitational/roundtrip"
 	"github.com/gravitational/trace"
@@ -41,7 +42,9 @@ func NewInsecureWebClient() *http.Client {
 	return &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: tlsConfig,
-			Proxy:           http.ProxyFromEnvironment,
+			Proxy: func(req *http.Request) (*url.URL, error) {
+				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
+			},
 		},
 	}
 }
@@ -55,7 +58,9 @@ func newClientWithPool(pool *x509.CertPool) *http.Client {
 	return &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: tlsConfig,
-			Proxy:           http.ProxyFromEnvironment,
+			Proxy: func(req *http.Request) (*url.URL, error) {
+				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
+			},
 		},
 	}
 }

From bbc3af7b1b653b22fe558e04cbf2efb59acf29a7 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Thu, 3 Mar 2022 14:05:05 -0800
Subject: [PATCH 16/43] Split makeProxySSHClient

---
 lib/client/api.go        | 32 +++++++++++++++++++-------------
 lib/utils/proxy/proxy.go |  3 +--
 2 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/lib/client/api.go b/lib/client/api.go
index 285fac1476940..3ddf07a1f48cc 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -2234,21 +2234,27 @@ func (tc *TeleportClient) connectToProxy(ctx context.Context) (*ProxyClient, err
 }
 
 func makeProxySSHClient(tc *TeleportClient, sshConfig *ssh.ClientConfig) (*ssh.Client, error) {
-	var opts []proxy.DialerOptionFunc
-	addr := tc.Config.SSHProxyAddr
 	if tc.Config.TLSRoutingEnabled {
-		tlsConfig, err := tc.loadTLSConfig()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		tlsConfig.NextProtos = []string{string(alpncommon.ProtocolProxySSH)}
-		tlsConfig.InsecureSkipVerify = tc.Config.InsecureSkipVerify
-		addr = tc.Config.WebProxyAddr
-		opts = append(opts, proxy.WithALPNDialer(), proxy.WithTLSConfig(tlsConfig))
+		return makeProxySSHClientWithTLSWrapper(tc, sshConfig)
 	}
-	dialer := proxy.DialerFromEnvironment(addr, opts...)
-	client, err := dialer.Dial("tcp", addr, sshConfig)
-	return client, trace.Wrap(err, "failed to authenticate with proxy %v", tc.Config.SSHProxyAddr)
+	return makeProxySSHClientDirect(tc, sshConfig)
+}
+
+func makeProxySSHClientDirect(tc *TeleportClient, sshConfig *ssh.ClientConfig) (*ssh.Client, error) {
+	dialer := proxy.DialerFromEnvironment(tc.Config.SSHProxyAddr)
+	return dialer.Dial("tcp", tc.Config.SSHProxyAddr, sshConfig)
+}
+
+func makeProxySSHClientWithTLSWrapper(tc *TeleportClient, sshConfig *ssh.ClientConfig) (*ssh.Client, error) {
+	tlsConfig, err := tc.loadTLSConfig()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	tlsConfig.NextProtos = []string{string(alpncommon.ProtocolProxySSH)}
+	tlsConfig.InsecureSkipVerify = tc.Config.InsecureSkipVerify
+
+	dialer := proxy.DialerFromEnvironment(tc.Config.WebProxyAddr, proxy.WithALPNDialer(), proxy.WithTLSConfig(tlsConfig))
+	return dialer.Dial("tcp", tc.Config.WebProxyAddr, sshConfig)
 }
 
 func (tc *TeleportClient) rootClusterName() (string, error) {
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index 1075034e85805..c9f60900c62ed 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -26,7 +26,6 @@ import (
 	"github.com/gravitational/teleport"
 	apiclient "github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib"
 	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/utils"
 
@@ -200,7 +199,7 @@ func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (
 		if conf == nil {
 			conf = &tls.Config{
 				NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
-				InsecureSkipVerify: lib.IsInsecureDevMode(),
+				InsecureSkipVerify: d.insecure,
 			}
 		}
 		conf.ServerName = address.Host()

From 79e3f3f8b9709c89dcbe99322c12b3076d764085 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Thu, 10 Mar 2022 14:46:38 -0800
Subject: [PATCH 17/43] Remove leftover teleport imports from api

---
 api/client/noproxy.go      |  4 ++--
 api/client/proxy.go        | 10 +++++-----
 api/client/proxy_test.go   |  7 -------
 api/constants/constants.go | 12 ++++++++++++
 api/go.mod                 |  1 +
 api/go.sum                 |  2 ++
 constants.go               | 12 ------------
 7 files changed, 22 insertions(+), 26 deletions(-)

diff --git a/api/client/noproxy.go b/api/client/noproxy.go
index 159ad56b8d382..a6115d20c6a5a 100644
--- a/api/client/noproxy.go
+++ b/api/client/noproxy.go
@@ -13,7 +13,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/constants"
 )
 
 // useProxy reports whether requests to addr should use a proxy,
@@ -24,7 +24,7 @@ func useProxy(addr string) bool {
 		return true
 	}
 	var noProxy string
-	for _, env := range []string{teleport.NoProxy, strings.ToLower(teleport.NoProxy)} {
+	for _, env := range []string{constants.NoProxy, strings.ToLower(constants.NoProxy)} {
 		noProxy = os.Getenv(env)
 		if noProxy != "" {
 			break
diff --git a/api/client/proxy.go b/api/client/proxy.go
index d7ee2d9431800..b42c45fe56cf3 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -25,7 +25,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/trace"
 	"github.com/siddontang/go/log"
 )
@@ -87,10 +87,10 @@ func DialProxy(ctx context.Context, proxyAddr, addr string, dialer ContextDialer
 // GetProxyAddress gets the HTTP proxy address to use for a given address, if any.
 func GetProxyAddress(addr string) string {
 	envs := []string{
-		teleport.HTTPSProxy,
-		strings.ToLower(teleport.HTTPSProxy),
-		teleport.HTTPProxy,
-		strings.ToLower(teleport.HTTPProxy),
+		constants.HTTPSProxy,
+		strings.ToLower(constants.HTTPSProxy),
+		constants.HTTPProxy,
+		strings.ToLower(constants.HTTPProxy),
 	}
 
 	for _, v := range envs {
diff --git a/api/client/proxy_test.go b/api/client/proxy_test.go
index d1d781f137fdd..29cffc12e1b4f 100644
--- a/api/client/proxy_test.go
+++ b/api/client/proxy_test.go
@@ -18,18 +18,11 @@ package client
 
 import (
 	"fmt"
-	"os"
 	"testing"
 
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/stretchr/testify/require"
 )
 
-func TestMain(m *testing.M) {
-	utils.InitLoggerForTests()
-	os.Exit(m.Run())
-}
-
 func TestGetProxyAddress(t *testing.T) {
 	type env struct {
 		name string
diff --git a/api/constants/constants.go b/api/constants/constants.go
index fbb1214b8493a..0e54e83e62b6c 100644
--- a/api/constants/constants.go
+++ b/api/constants/constants.go
@@ -189,3 +189,15 @@ const (
 	// KubeTeleportProxyALPNPrefix is a SNI Kubernetes prefix used for distinguishing the Kubernetes HTTP traffic.
 	KubeTeleportProxyALPNPrefix = "kube-teleport-proxy-alpn."
 )
+
+const (
+	// HTTPSProxy is an environment variable pointing to a HTTPS proxy.
+	HTTPSProxy = "HTTPS_PROXY"
+
+	// HTTPProxy is an environment variable pointing to a HTTP proxy.
+	HTTPProxy = "HTTP_PROXY"
+
+	// NoProxy is an environment variable matching the cases
+	// when HTTPS_PROXY or HTTP_PROXY is ignored
+	NoProxy = "NO_PROXY"
+)
diff --git a/api/go.mod b/api/go.mod
index 3a7210c771f25..a81a73769382d 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -8,6 +8,7 @@ require (
 	github.com/google/go-cmp v0.5.4
 	github.com/gravitational/trace v1.1.17
 	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
+	github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726
 	github.com/sirupsen/logrus v1.8.1
 	github.com/stretchr/testify v1.7.0
 	golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8
diff --git a/api/go.sum b/api/go.sum
index 72c1f18217730..69ab03da359fa 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -61,6 +61,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 h1:xT+JlYxNGqyT+XcU8iUrN18JYed2TvG9yN5ULG2jATM=
+github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726/go.mod h1:3yhqj7WBBfRhbBlzyOC3gUxftwsU0u8gqevxwIHQpMw=
 github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
diff --git a/constants.go b/constants.go
index 246cdc8809a78..13bf738f230b4 100644
--- a/constants.go
+++ b/constants.go
@@ -61,18 +61,6 @@ const (
 	HTTPNextProtoTLS = "http/1.1"
 )
 
-const (
-	// HTTPSProxy is an environment variable pointing to a HTTPS proxy.
-	HTTPSProxy = "HTTPS_PROXY"
-
-	// HTTPProxy is an environment variable pointing to a HTTP proxy.
-	HTTPProxy = "HTTP_PROXY"
-
-	// NoProxy is an environment variable matching the cases
-	// when HTTPS_PROXY or HTTP_PROXY is ignored
-	NoProxy = "NO_PROXY"
-)
-
 const (
 	// TOTPValidityPeriod is the number of seconds a TOTP token is valid.
 	TOTPValidityPeriod uint = 30

From fcf43eea14cce4e6d25b20935f09fe0dbc7b6a74 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Fri, 11 Mar 2022 14:27:52 -0800
Subject: [PATCH 18/43] Make dialALPNWithDeadline a member of directDial

---
 lib/utils/proxy/proxy.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index c9f60900c62ed..f128fc223ebc5 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -52,7 +52,7 @@ func dialWithDeadline(network string, addr string, config *ssh.ClientConfig) (*s
 // dialALPNWithDeadline allows connecting to Teleport in single-port mode. SSH protocol is wrapped into
 // TLS connection where TLS ALPN protocol is set to ProtocolReverseTunnel allowing ALPN Proxy to route the
 // incoming connection to ReverseTunnel proxy service.
-func dialALPNWithDeadline(network string, addr string, config *ssh.ClientConfig, insecure bool, tlsConfig *tls.Config) (*ssh.Client, error) {
+func (d directDial) dialALPNWithDeadline(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	dialer := &net.Dialer{
 		Timeout: config.Timeout,
 	}
@@ -60,14 +60,14 @@ func dialALPNWithDeadline(network string, addr string, config *ssh.ClientConfig,
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	conf := tlsConfig.Clone()
+	conf := d.tlsConfig.Clone()
 	if conf == nil {
 		conf = &tls.Config{
 			NextProtos: []string{string(alpncommon.ProtocolReverseTunnel)},
 		}
 	}
 	conf.ServerName = address.Host()
-	conf.InsecureSkipVerify = insecure
+	conf.InsecureSkipVerify = d.insecure
 	tlsConn, err := tls.DialWithDialer(dialer, network, addr, conf)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -96,7 +96,7 @@ type directDial struct {
 // Dial calls ssh.Dial directly.
 func (d directDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	if d.tlsRoutingEnabled {
-		client, err := dialALPNWithDeadline(network, addr, config, d.insecure, d.tlsConfig)
+		client, err := d.dialALPNWithDeadline(network, addr, config)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}

From e24d3d0451be0671dd4fadfef8e47a2df87f6121 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Fri, 11 Mar 2022 14:30:59 -0800
Subject: [PATCH 19/43] Add DialProxyWithDialer for custom dialers

---
 api/client/contextdialer.go |  2 +-
 api/client/proxy.go         | 10 ++++++----
 lib/utils/proxy/proxy.go    |  4 ++--
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 0797ec1a7a64e..5c3725c5a1631 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -58,7 +58,7 @@ func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (net.Conn, error) {
 		if proxyAddr := GetProxyAddress(addr); proxyAddr != "" {
-			return DialProxy(ctx, proxyAddr, addr, dialer)
+			return DialProxyWithDialer(ctx, proxyAddr, addr, dialer)
 		}
 		return dialer.DialContext(ctx, network, addr)
 	})
diff --git a/api/client/proxy.go b/api/client/proxy.go
index b42c45fe56cf3..42d448c8e9040 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -31,10 +31,12 @@ import (
 )
 
 // DialProxy creates a connection to a server via an HTTP Proxy.
-func DialProxy(ctx context.Context, proxyAddr, addr string, dialer ContextDialer) (net.Conn, error) {
-	if dialer == nil {
-		dialer = &net.Dialer{}
-	}
+func DialProxy(ctx context.Context, proxyAddr, addr string) (net.Conn, error) {
+	return DialProxyWithDialer(ctx, proxyAddr, addr, &net.Dialer{})
+}
+
+// DialProxyWithDialer creates a connection to a server via an HTTP Proxy using a specified dialer.
+func DialProxyWithDialer(ctx context.Context, proxyAddr, addr string, dialer ContextDialer) (net.Conn, error) {
 	conn, err := dialer.DialContext(ctx, "tcp", proxyAddr)
 	if err != nil {
 		log.Warnf("Unable to dial to proxy: %v: %v.", proxyAddr, err)
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index f128fc223ebc5..19fe1972a996c 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -157,7 +157,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 		defer cancel()
 		ctx = timeoutCtx
 	}
-	conn, err := apiclient.DialProxy(ctx, d.proxyHost, address, nil)
+	conn, err := apiclient.DialProxy(ctx, d.proxyHost, address)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -183,7 +183,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 // SSH connection.
 func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	// Build a proxy connection first.
-	pconn, err := apiclient.DialProxy(context.Background(), d.proxyHost, addr, nil)
+	pconn, err := apiclient.DialProxy(context.Background(), d.proxyHost, addr)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}

From 749d8896c736ae3d8d5482b4ba1c514ea35e6946 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 14 Mar 2022 10:32:35 -0700
Subject: [PATCH 20/43] Make tlsConfig mandatory

---
 lib/client/api.go              |  4 +-
 lib/reversetunnel/agent.go     |  6 ++-
 lib/reversetunnel/transport.go |  6 ++-
 lib/utils/proxy/proxy.go       | 72 +++++++++++-----------------------
 4 files changed, 34 insertions(+), 54 deletions(-)

diff --git a/lib/client/api.go b/lib/client/api.go
index 3ddf07a1f48cc..4c19cd4a3609e 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -2251,9 +2251,7 @@ func makeProxySSHClientWithTLSWrapper(tc *TeleportClient, sshConfig *ssh.ClientC
 		return nil, trace.Wrap(err)
 	}
 	tlsConfig.NextProtos = []string{string(alpncommon.ProtocolProxySSH)}
-	tlsConfig.InsecureSkipVerify = tc.Config.InsecureSkipVerify
-
-	dialer := proxy.DialerFromEnvironment(tc.Config.WebProxyAddr, proxy.WithALPNDialer(), proxy.WithTLSConfig(tlsConfig))
+	dialer := proxy.DialerFromEnvironment(tc.Config.WebProxyAddr, proxy.WithALPNDialer(tlsConfig))
 	return dialer.Dial("tcp", tc.Config.WebProxyAddr, sshConfig)
 }
 
diff --git a/lib/reversetunnel/agent.go b/lib/reversetunnel/agent.go
index 22bebc91c6d54..8f040c6974b3a 100644
--- a/lib/reversetunnel/agent.go
+++ b/lib/reversetunnel/agent.go
@@ -22,6 +22,7 @@ package reversetunnel
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"sync"
 	"time"
@@ -35,6 +36,7 @@ import (
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/reversetunnel/track"
+	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/proxy"
@@ -283,7 +285,9 @@ func (a *Agent) connect() (conn *ssh.Client, err error) {
 	}
 
 	if a.reverseTunnelDetails != nil && a.reverseTunnelDetails.TLSRoutingEnabled {
-		opts = append(opts, proxy.WithALPNDialer())
+		opts = append(opts, proxy.WithALPNDialer(&tls.Config{
+			NextProtos: []string{string(alpncommon.ProtocolReverseTunnel)},
+		}))
 	}
 
 	for _, authMethod := range a.authMethods {
diff --git a/lib/reversetunnel/transport.go b/lib/reversetunnel/transport.go
index 73b593690ba49..65237ca5514e4 100644
--- a/lib/reversetunnel/transport.go
+++ b/lib/reversetunnel/transport.go
@@ -18,6 +18,7 @@ package reversetunnel
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -34,6 +35,7 @@ import (
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/events"
+	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/utils/proxy"
 
@@ -97,7 +99,9 @@ func (t *TunnelAuthDialer) DialContext(ctx context.Context, _, _ string) (net.Co
 		// address thus the ping call will always fail.
 		t.Log.Debugf("Failed to ping web proxy %q addr: %v", addr.Addr, err)
 	} else if resp.Proxy.TLSRoutingEnabled {
-		opts = append(opts, proxy.WithALPNDialer())
+		opts = append(opts, proxy.WithALPNDialer(&tls.Config{
+			NextProtos: []string{string(alpncommon.ProtocolReverseTunnel)},
+		}))
 	}
 
 	dialer := proxy.DialerFromEnvironment(addr.Addr, opts...)
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index 19fe1972a996c..078d0d062e147 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -26,7 +26,6 @@ import (
 	"github.com/gravitational/teleport"
 	apiclient "github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/utils/sshutils"
-	alpncommon "github.com/gravitational/teleport/lib/srv/alpnproxy/common"
 	"github.com/gravitational/teleport/lib/utils"
 
 	"golang.org/x/crypto/ssh"
@@ -61,11 +60,6 @@ func (d directDial) dialALPNWithDeadline(network string, addr string, config *ss
 		return nil, trace.Wrap(err)
 	}
 	conf := d.tlsConfig.Clone()
-	if conf == nil {
-		conf = &tls.Config{
-			NextProtos: []string{string(alpncommon.ProtocolReverseTunnel)},
-		}
-	}
 	conf.ServerName = address.Host()
 	conf.InsecureSkipVerify = d.insecure
 	tlsConn, err := tls.DialWithDialer(dialer, network, addr, conf)
@@ -85,17 +79,20 @@ type Dialer interface {
 }
 
 type directDial struct {
-	// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
-	tlsRoutingEnabled bool
 	// insecure is whether to skip certificate validation.
 	insecure bool
 	// tlsConfig is the TLS config to use.
 	tlsConfig *tls.Config
 }
 
+// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
+func (d directDial) tlsRoutingEnabled() bool {
+	return d.tlsConfig != nil
+}
+
 // Dial calls ssh.Dial directly.
 func (d directDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	if d.tlsRoutingEnabled {
+	if d.tlsRoutingEnabled() {
 		client, err := d.dialALPNWithDeadline(network, addr, config)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -111,17 +108,12 @@ func (d directDial) Dial(network string, addr string, config *ssh.ClientConfig)
 
 // DialTimeout acts like Dial but takes a timeout.
 func (d directDial) DialTimeout(network, address string, timeout time.Duration) (net.Conn, error) {
-	if d.tlsRoutingEnabled {
+	if d.tlsRoutingEnabled() {
 		addr, err := utils.ParseAddr(address)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		conf := d.tlsConfig.Clone()
-		if conf == nil {
-			conf = &tls.Config{
-				NextProtos: []string{string(alpncommon.ProtocolReverseTunnel)},
-			}
-		}
 		conf.ServerName = addr.Host()
 		conf.InsecureSkipVerify = d.insecure
 		tlsConn, err := tls.Dial("tcp", address, conf)
@@ -140,14 +132,17 @@ func (d directDial) DialTimeout(network, address string, timeout time.Duration)
 type proxyDial struct {
 	// proxyHost is the HTTPS proxy address.
 	proxyHost string
-	// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
-	tlsRoutingEnabled bool
 	// insecure is whether to skip certificate validation.
 	insecure bool
 	// tlsConfig is the TLS config to use.
 	tlsConfig *tls.Config
 }
 
+// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
+func (d proxyDial) tlsRoutingEnabled() bool {
+	return d.tlsConfig != nil
+}
+
 // DialTimeout acts like Dial but takes a timeout.
 func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (net.Conn, error) {
 	// Build a proxy connection first.
@@ -161,17 +156,12 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if d.tlsRoutingEnabled {
+	if d.tlsRoutingEnabled() {
 		address, err := utils.ParseAddr(address)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		conf := d.tlsConfig.Clone()
-		if conf == nil {
-			conf = &tls.Config{
-				NextProtos: []string{string(alpncommon.ProtocolReverseTunnel)},
-			}
-		}
 		conf.ServerName = address.Host()
 		conf.InsecureSkipVerify = d.insecure
 		conn = tls.Client(conn, conf)
@@ -190,19 +180,14 @@ func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (
 	if config.Timeout > 0 {
 		pconn.SetReadDeadline(time.Now().Add(config.Timeout))
 	}
-	if d.tlsRoutingEnabled {
+	if d.tlsRoutingEnabled() {
 		address, err := utils.ParseAddr(addr)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		conf := d.tlsConfig.Clone()
-		if conf == nil {
-			conf = &tls.Config{
-				NextProtos:         []string{string(alpncommon.ProtocolReverseTunnel)},
-				InsecureSkipVerify: d.insecure,
-			}
-		}
 		conf.ServerName = address.Host()
+		conf.InsecureSkipVerify = d.insecure
 		pconn = tls.Client(pconn, conf)
 	}
 
@@ -218,11 +203,9 @@ func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (
 }
 
 type dialerOptions struct {
-	// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
-	tlsRoutingEnabled bool
 	// insecureSkipTLSVerify is whether to skip certificate validation.
 	insecureSkipTLSVerify bool
-	// tlsConfig is the TLS config to use.
+	// tlsConfig is the TLS config to use for TLS routing.
 	tlsConfig *tls.Config
 }
 
@@ -230,9 +213,9 @@ type dialerOptions struct {
 type DialerOptionFunc func(options *dialerOptions)
 
 // WithALPNDialer creates a dialer that allows to Teleport running in single-port mode.
-func WithALPNDialer() DialerOptionFunc {
+func WithALPNDialer(tlsConfig *tls.Config) DialerOptionFunc {
 	return func(options *dialerOptions) {
-		options.tlsRoutingEnabled = true
+		options.tlsConfig = tlsConfig
 	}
 }
 
@@ -243,13 +226,6 @@ func WithInsecureSkipTLSVerify(insecure bool) DialerOptionFunc {
 	}
 }
 
-// WithTLSConfig creates a dialer that uses a specific tls config.
-func WithTLSConfig(tlsConfig *tls.Config) DialerOptionFunc {
-	return func(options *dialerOptions) {
-		options.tlsConfig = tlsConfig
-	}
-}
-
 // DialerFromEnvironment returns a Dial function. If the https_proxy or http_proxy
 // environment variable are set, it returns a function that will dial through
 // said proxy server. If neither variable is set, it will connect to the SSH
@@ -268,17 +244,15 @@ func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 	if proxyAddr == "" {
 		log.Debugf("No proxy set in environment, returning direct dialer.")
 		return directDial{
-			tlsRoutingEnabled: options.tlsRoutingEnabled,
-			insecure:          options.insecureSkipTLSVerify,
-			tlsConfig:         options.tlsConfig,
+			insecure:  options.insecureSkipTLSVerify,
+			tlsConfig: options.tlsConfig,
 		}
 	}
 	log.Debugf("Found proxy %q in environment, returning proxy dialer.", proxyAddr)
 	return proxyDial{
-		proxyHost:         proxyAddr,
-		tlsRoutingEnabled: options.tlsRoutingEnabled,
-		insecure:          options.insecureSkipTLSVerify,
-		tlsConfig:         options.tlsConfig,
+		proxyHost: proxyAddr,
+		insecure:  options.insecureSkipTLSVerify,
+		tlsConfig: options.tlsConfig,
 	}
 }
 

From 4e2a20aa79f58de4cfce0d500d8ccd044e192be4 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 14 Mar 2022 12:02:42 -0700
Subject: [PATCH 21/43] Bring back tlsRoutingEnabled flag

---
 lib/utils/proxy/proxy.go | 37 ++++++++++++++++++-------------------
 1 file changed, 18 insertions(+), 19 deletions(-)

diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index 078d0d062e147..12961ca9beee8 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -81,18 +81,15 @@ type Dialer interface {
 type directDial struct {
 	// insecure is whether to skip certificate validation.
 	insecure bool
+	// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
+	tlsRoutingEnabled bool
 	// tlsConfig is the TLS config to use.
 	tlsConfig *tls.Config
 }
 
-// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
-func (d directDial) tlsRoutingEnabled() bool {
-	return d.tlsConfig != nil
-}
-
 // Dial calls ssh.Dial directly.
 func (d directDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	if d.tlsRoutingEnabled() {
+	if d.tlsRoutingEnabled {
 		client, err := d.dialALPNWithDeadline(network, addr, config)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -108,7 +105,7 @@ func (d directDial) Dial(network string, addr string, config *ssh.ClientConfig)
 
 // DialTimeout acts like Dial but takes a timeout.
 func (d directDial) DialTimeout(network, address string, timeout time.Duration) (net.Conn, error) {
-	if d.tlsRoutingEnabled() {
+	if d.tlsRoutingEnabled {
 		addr, err := utils.ParseAddr(address)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -134,15 +131,12 @@ type proxyDial struct {
 	proxyHost string
 	// insecure is whether to skip certificate validation.
 	insecure bool
+	// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
+	tlsRoutingEnabled bool
 	// tlsConfig is the TLS config to use.
 	tlsConfig *tls.Config
 }
 
-// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
-func (d proxyDial) tlsRoutingEnabled() bool {
-	return d.tlsConfig != nil
-}
-
 // DialTimeout acts like Dial but takes a timeout.
 func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (net.Conn, error) {
 	// Build a proxy connection first.
@@ -156,7 +150,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if d.tlsRoutingEnabled() {
+	if d.tlsRoutingEnabled {
 		address, err := utils.ParseAddr(address)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -180,7 +174,7 @@ func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (
 	if config.Timeout > 0 {
 		pconn.SetReadDeadline(time.Now().Add(config.Timeout))
 	}
-	if d.tlsRoutingEnabled() {
+	if d.tlsRoutingEnabled {
 		address, err := utils.ParseAddr(addr)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -205,6 +199,8 @@ func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (
 type dialerOptions struct {
 	// insecureSkipTLSVerify is whether to skip certificate validation.
 	insecureSkipTLSVerify bool
+	// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
+	tlsRoutingEnabled bool
 	// tlsConfig is the TLS config to use for TLS routing.
 	tlsConfig *tls.Config
 }
@@ -215,6 +211,7 @@ type DialerOptionFunc func(options *dialerOptions)
 // WithALPNDialer creates a dialer that allows to Teleport running in single-port mode.
 func WithALPNDialer(tlsConfig *tls.Config) DialerOptionFunc {
 	return func(options *dialerOptions) {
+		options.tlsRoutingEnabled = true
 		options.tlsConfig = tlsConfig
 	}
 }
@@ -244,15 +241,17 @@ func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 	if proxyAddr == "" {
 		log.Debugf("No proxy set in environment, returning direct dialer.")
 		return directDial{
-			insecure:  options.insecureSkipTLSVerify,
-			tlsConfig: options.tlsConfig,
+			insecure:          options.insecureSkipTLSVerify,
+			tlsRoutingEnabled: options.tlsRoutingEnabled,
+			tlsConfig:         options.tlsConfig,
 		}
 	}
 	log.Debugf("Found proxy %q in environment, returning proxy dialer.", proxyAddr)
 	return proxyDial{
-		proxyHost: proxyAddr,
-		insecure:  options.insecureSkipTLSVerify,
-		tlsConfig: options.tlsConfig,
+		proxyHost:         proxyAddr,
+		insecure:          options.insecureSkipTLSVerify,
+		tlsRoutingEnabled: options.tlsRoutingEnabled,
+		tlsConfig:         options.tlsConfig,
 	}
 }
 

From cad2d6cd66ad692b7804c050fd3dfdd44932580f Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 15 Mar 2022 11:24:29 -0700
Subject: [PATCH 22/43] Move tls config configuration to its own function

---
 lib/utils/proxy/proxy.go | 50 ++++++++++++++++++++++++++++++----------
 1 file changed, 38 insertions(+), 12 deletions(-)

diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index 12961ca9beee8..90c8226cced13 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -59,9 +59,10 @@ func (d directDial) dialALPNWithDeadline(network string, addr string, config *ss
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	conf := d.tlsConfig.Clone()
-	conf.ServerName = address.Host()
-	conf.InsecureSkipVerify = d.insecure
+	conf, err := d.getTLSConfig(address)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	tlsConn, err := tls.DialWithDialer(dialer, network, addr, conf)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -87,6 +88,17 @@ type directDial struct {
 	tlsConfig *tls.Config
 }
 
+// getTLSConfig configures the dialers TLS config for a specified address.
+func (d directDial) getTLSConfig(addr *utils.NetAddr) (*tls.Config, error) {
+	if d.tlsConfig == nil {
+		return nil, trace.BadParameter("TLS config was nil")
+	}
+	tlsConfig := d.tlsConfig.Clone()
+	tlsConfig.ServerName = addr.Host()
+	tlsConfig.InsecureSkipVerify = d.insecure
+	return tlsConfig, nil
+}
+
 // Dial calls ssh.Dial directly.
 func (d directDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	if d.tlsRoutingEnabled {
@@ -110,9 +122,10 @@ func (d directDial) DialTimeout(network, address string, timeout time.Duration)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		conf := d.tlsConfig.Clone()
-		conf.ServerName = addr.Host()
-		conf.InsecureSkipVerify = d.insecure
+		conf, err := d.getTLSConfig(addr)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 		tlsConn, err := tls.Dial("tcp", address, conf)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -137,6 +150,17 @@ type proxyDial struct {
 	tlsConfig *tls.Config
 }
 
+// getTLSConfig configures the dialers TLS config for a specified address.
+func (d proxyDial) getTLSConfig(addr *utils.NetAddr) (*tls.Config, error) {
+	if d.tlsConfig == nil {
+		return nil, trace.BadParameter("TLS config was nil")
+	}
+	tlsConfig := d.tlsConfig.Clone()
+	tlsConfig.ServerName = addr.Host()
+	tlsConfig.InsecureSkipVerify = d.insecure
+	return tlsConfig, nil
+}
+
 // DialTimeout acts like Dial but takes a timeout.
 func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (net.Conn, error) {
 	// Build a proxy connection first.
@@ -155,9 +179,10 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		conf := d.tlsConfig.Clone()
-		conf.ServerName = address.Host()
-		conf.InsecureSkipVerify = d.insecure
+		conf, err := d.getTLSConfig(address)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 		conn = tls.Client(conn, conf)
 	}
 	return conn, nil
@@ -179,9 +204,10 @@ func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		conf := d.tlsConfig.Clone()
-		conf.ServerName = address.Host()
-		conf.InsecureSkipVerify = d.insecure
+		conf, err := d.getTLSConfig(address)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 		pconn = tls.Client(pconn, conf)
 	}
 

From 2117a9bb2c93bb4528dde67f5c7b7c4153ea197d Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 16 Mar 2022 12:07:25 -0700
Subject: [PATCH 23/43] Update NO_PROXY matching

---
 api/client/noproxy.go    | 74 ----------------------------------------
 api/client/proxy.go      | 42 ++++++++---------------
 api/client/proxy_test.go | 18 ++++++++++
 3 files changed, 33 insertions(+), 101 deletions(-)
 delete mode 100644 api/client/noproxy.go

diff --git a/api/client/noproxy.go b/api/client/noproxy.go
deleted file mode 100644
index a6115d20c6a5a..0000000000000
--- a/api/client/noproxy.go
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// HTTP client implementation. See RFC 2616.
-//
-// This is the low-level Transport implementation of RoundTripper.
-// The high-level interface is in client.go.
-
-package client
-
-import (
-	"os"
-	"strings"
-
-	"github.com/gravitational/teleport/api/constants"
-)
-
-// useProxy reports whether requests to addr should use a proxy,
-// according to the NO_PROXY or no_proxy environment variable.
-// addr is always a canonicalAddr with a host and port.
-func useProxy(addr string) bool {
-	if len(addr) == 0 {
-		return true
-	}
-	var noProxy string
-	for _, env := range []string{constants.NoProxy, strings.ToLower(constants.NoProxy)} {
-		noProxy = os.Getenv(env)
-		if noProxy != "" {
-			break
-		}
-	}
-
-	if noProxy == "" {
-		return true
-	}
-	if noProxy == "*" {
-		return false
-	}
-
-	addr = strings.ToLower(strings.TrimSpace(addr))
-	if hasPort(addr) {
-		addr = addr[:strings.LastIndex(addr, ":")]
-	}
-	for _, p := range strings.Split(noProxy, ",") {
-		p = strings.ToLower(strings.TrimSpace(p))
-		if len(p) == 0 {
-			continue
-		}
-		if hasPort(p) {
-			p = p[:strings.LastIndex(p, ":")]
-		}
-		if addr == p {
-			return false
-		}
-		if len(p) == 0 {
-			// There is no host part, likely the entry is malformed; ignore.
-			continue
-		}
-		if p[0] == '.' && (strings.HasSuffix(addr, p) || addr == p[1:]) {
-			// no_proxy ".foo.com" matches "bar.foo.com" or "foo.com"
-			return false
-		}
-		if p[0] != '.' && strings.HasSuffix(addr, p) && addr[len(addr)-len(p)-1] == '.' {
-			// no_proxy "foo.com" matches "bar.foo.com"
-			return false
-		}
-	}
-	return true
-}
-
-// Given a string of the form "host", "host:port", or "[ipv6::address]:port",
-// return true if the string includes a port.
-func hasPort(s string) bool { return strings.LastIndex(s, ":") > strings.LastIndex(s, "]") }
diff --git a/api/client/proxy.go b/api/client/proxy.go
index 42d448c8e9040..e4af72c5946b0 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -22,12 +22,11 @@ import (
 	"net"
 	"net/http"
 	"net/url"
-	"os"
 	"strings"
 
-	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/trace"
 	"github.com/siddontang/go/log"
+	"golang.org/x/net/http/httpproxy"
 )
 
 // DialProxy creates a connection to a server via an HTTP Proxy.
@@ -88,32 +87,21 @@ func DialProxyWithDialer(ctx context.Context, proxyAddr, addr string, dialer Con
 
 // GetProxyAddress gets the HTTP proxy address to use for a given address, if any.
 func GetProxyAddress(addr string) string {
-	envs := []string{
-		constants.HTTPSProxy,
-		strings.ToLower(constants.HTTPSProxy),
-		constants.HTTPProxy,
-		strings.ToLower(constants.HTTPProxy),
+	addrURL, err := parse(addr)
+	if err != nil {
+		return ""
 	}
-
-	for _, v := range envs {
-		envAddr := os.Getenv(v)
-		if envAddr == "" {
-			continue
-		}
-		proxyAddr, err := parse(envAddr)
-		if err != nil {
-			log.Debugf("Unable to parse environment variable %q: %q.", v, envAddr)
-			continue
-		}
-		log.Debugf("Successfully parsed environment variable %q: %q to %q.", v, envAddr, proxyAddr)
-		if !useProxy(addr) {
-			log.Debugf("Matched NO_PROXY override for %q: %q, going to ignore proxy variable.", v, envAddr)
-			return ""
+	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
+	for _, scheme := range []string{"https", "http"} {
+		addrURL.Scheme = scheme
+		proxyURL, err := proxyFunc(addrURL)
+		if err == nil && proxyURL != nil {
+			// Trim scheme and leading slashes.
+			proxyURL.Scheme = ""
+			return proxyURL.String()[2:]
 		}
-		return proxyAddr
 	}
 
-	log.Debugf("No valid environment variables found.")
 	return ""
 }
 
@@ -137,14 +125,14 @@ func (bc *bufferedConn) Read(b []byte) (n int, err error) {
 
 // parse will extract the host:port of the proxy to dial to. If the
 // value is not prefixed by "http", then it will prepend "http" and try.
-func parse(addr string) (string, error) {
+func parse(addr string) (*url.URL, error) {
 	proxyurl, err := url.Parse(addr)
 	if err != nil || !strings.HasPrefix(proxyurl.Scheme, "http") {
 		proxyurl, err = url.Parse("http://" + addr)
 		if err != nil {
-			return "", trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
 	}
 
-	return proxyurl.Host, nil
+	return proxyurl, nil
 }
diff --git a/api/client/proxy_test.go b/api/client/proxy_test.go
index 29cffc12e1b4f..b6127a9ec0d80 100644
--- a/api/client/proxy_test.go
+++ b/api/client/proxy_test.go
@@ -82,6 +82,24 @@ func TestGetProxyAddress(t *testing.T) {
 			proxyAddr:  "",
 			targetAddr: "bla.example.com:1234",
 		},
+		{
+			info: "valid, no_proxy blocks matching port",
+			env: []env{
+				{name: "https_proxy", val: "proxy:9999"},
+				{name: "no_proxy", val: "example.com:1234"},
+			},
+			proxyAddr:  "",
+			targetAddr: "example.com:1234",
+		},
+		{
+			info: "valid, no_proxy matches host but not port",
+			env: []env{
+				{name: "https_proxy", val: "proxy:9999"},
+				{name: "no_proxy", val: "example.com:1234"},
+			},
+			proxyAddr:  "proxy:9999",
+			targetAddr: "example.com:5678",
+		},
 	}
 
 	for i, tt := range tests {

From 5d69d456ac62ac699cdc31e7b2fc930429e6da16 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Thu, 17 Mar 2022 12:33:07 -0700
Subject: [PATCH 24/43] Change GetProxyAddress return type

---
 api/client/contextdialer.go |  2 +-
 api/client/proxy.go         | 18 ++++++++----------
 api/client/proxy_test.go    |  6 +++++-
 lib/utils/proxy/proxy.go    | 13 +++++++------
 4 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 5c3725c5a1631..7ec88318a72dd 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -57,7 +57,7 @@ func NewDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (net.Conn, error) {
-		if proxyAddr := GetProxyAddress(addr); proxyAddr != "" {
+		if proxyAddr := GetProxyAddress(addr); proxyAddr != nil {
 			return DialProxyWithDialer(ctx, proxyAddr, addr, dialer)
 		}
 		return dialer.DialContext(ctx, network, addr)
diff --git a/api/client/proxy.go b/api/client/proxy.go
index e4af72c5946b0..0444987f58476 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -30,15 +30,15 @@ import (
 )
 
 // DialProxy creates a connection to a server via an HTTP Proxy.
-func DialProxy(ctx context.Context, proxyAddr, addr string) (net.Conn, error) {
+func DialProxy(ctx context.Context, proxyAddr *url.URL, addr string) (net.Conn, error) {
 	return DialProxyWithDialer(ctx, proxyAddr, addr, &net.Dialer{})
 }
 
 // DialProxyWithDialer creates a connection to a server via an HTTP Proxy using a specified dialer.
-func DialProxyWithDialer(ctx context.Context, proxyAddr, addr string, dialer ContextDialer) (net.Conn, error) {
-	conn, err := dialer.DialContext(ctx, "tcp", proxyAddr)
+func DialProxyWithDialer(ctx context.Context, proxyAddr *url.URL, addr string, dialer ContextDialer) (net.Conn, error) {
+	conn, err := dialer.DialContext(ctx, "tcp", proxyAddr.Host)
 	if err != nil {
-		log.Warnf("Unable to dial to proxy: %v: %v.", proxyAddr, err)
+		log.Warnf("Unable to dial to proxy: %v: %v.", proxyAddr.Host, err)
 		return nil, trace.ConvertSystemError(err)
 	}
 
@@ -86,23 +86,21 @@ func DialProxyWithDialer(ctx context.Context, proxyAddr, addr string, dialer Con
 }
 
 // GetProxyAddress gets the HTTP proxy address to use for a given address, if any.
-func GetProxyAddress(addr string) string {
+func GetProxyAddress(addr string) *url.URL {
 	addrURL, err := parse(addr)
 	if err != nil {
-		return ""
+		return nil
 	}
 	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
 	for _, scheme := range []string{"https", "http"} {
 		addrURL.Scheme = scheme
 		proxyURL, err := proxyFunc(addrURL)
 		if err == nil && proxyURL != nil {
-			// Trim scheme and leading slashes.
-			proxyURL.Scheme = ""
-			return proxyURL.String()[2:]
+			return proxyURL
 		}
 	}
 
-	return ""
+	return nil
 }
 
 // bufferedConn is used when part of the data on a connection has already been
diff --git a/api/client/proxy_test.go b/api/client/proxy_test.go
index b6127a9ec0d80..9651102de1b2b 100644
--- a/api/client/proxy_test.go
+++ b/api/client/proxy_test.go
@@ -108,7 +108,11 @@ func TestGetProxyAddress(t *testing.T) {
 				t.Setenv(env.name, env.val)
 			}
 			p := GetProxyAddress(tt.targetAddr)
-			require.Equal(t, tt.proxyAddr, p)
+			if tt.proxyAddr == "" {
+				require.Nil(t, p)
+			} else {
+				require.Equal(t, tt.proxyAddr, p.Host)
+			}
 		})
 	}
 }
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index 90c8226cced13..ff8a49ed0eb47 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -19,6 +19,7 @@ import (
 	"context"
 	"crypto/tls"
 	"net"
+	"net/url"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -140,8 +141,8 @@ func (d directDial) DialTimeout(network, address string, timeout time.Duration)
 }
 
 type proxyDial struct {
-	// proxyHost is the HTTPS proxy address.
-	proxyHost string
+	// proxyAddr is the HTTPS proxy address.
+	proxyAddr *url.URL
 	// insecure is whether to skip certificate validation.
 	insecure bool
 	// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
@@ -170,7 +171,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 		defer cancel()
 		ctx = timeoutCtx
 	}
-	conn, err := apiclient.DialProxy(ctx, d.proxyHost, address)
+	conn, err := apiclient.DialProxy(ctx, d.proxyAddr, address)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -192,7 +193,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 // SSH connection.
 func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	// Build a proxy connection first.
-	pconn, err := apiclient.DialProxy(context.Background(), d.proxyHost, addr)
+	pconn, err := apiclient.DialProxy(context.Background(), d.proxyAddr, addr)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -264,7 +265,7 @@ func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 
 	// If no proxy settings are in environment return regular ssh dialer,
 	// otherwise return a proxy dialer.
-	if proxyAddr == "" {
+	if proxyAddr == nil {
 		log.Debugf("No proxy set in environment, returning direct dialer.")
 		return directDial{
 			insecure:          options.insecureSkipTLSVerify,
@@ -274,7 +275,7 @@ func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 	}
 	log.Debugf("Found proxy %q in environment, returning proxy dialer.", proxyAddr)
 	return proxyDial{
-		proxyHost:         proxyAddr,
+		proxyAddr:         proxyAddr,
 		insecure:          options.insecureSkipTLSVerify,
 		tlsRoutingEnabled: options.tlsRoutingEnabled,
 		tlsConfig:         options.tlsConfig,

From b3f1d1349362989879626f01fb10d5c584e3228b Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 21 Mar 2022 16:27:23 -0700
Subject: [PATCH 25/43] Add ProxyAwareRoundTripper

---
 api/client/contextdialer.go          |  3 +-
 api/client/proxy.go                  | 34 --------------
 api/client/proxy/proxy.go            | 69 ++++++++++++++++++++++++++++
 api/client/{ => proxy}/proxy_test.go | 25 +++++++++-
 api/client/webclient/webclient.go    |  5 +-
 lib/client/https_client.go           |  9 ++--
 lib/utils/proxy/proxy.go             |  3 +-
 7 files changed, 105 insertions(+), 43 deletions(-)
 create mode 100644 api/client/proxy/proxy.go
 rename api/client/{ => proxy}/proxy_test.go (82%)

diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 7ec88318a72dd..a8396165aa173 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -22,6 +22,7 @@ import (
 	"net"
 	"time"
 
+	"github.com/gravitational/teleport/api/client/proxy"
 	"github.com/gravitational/teleport/api/client/webclient"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/utils/sshutils"
@@ -57,7 +58,7 @@ func NewDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (net.Conn, error) {
-		if proxyAddr := GetProxyAddress(addr); proxyAddr != nil {
+		if proxyAddr := proxy.GetProxyAddress(addr); proxyAddr != nil {
 			return DialProxyWithDialer(ctx, proxyAddr, addr, dialer)
 		}
 		return dialer.DialContext(ctx, network, addr)
diff --git a/api/client/proxy.go b/api/client/proxy.go
index 0444987f58476..9e933034f5986 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -22,11 +22,9 @@ import (
 	"net"
 	"net/http"
 	"net/url"
-	"strings"
 
 	"github.com/gravitational/trace"
 	"github.com/siddontang/go/log"
-	"golang.org/x/net/http/httpproxy"
 )
 
 // DialProxy creates a connection to a server via an HTTP Proxy.
@@ -85,24 +83,6 @@ func DialProxyWithDialer(ctx context.Context, proxyAddr *url.URL, addr string, d
 	}, nil
 }
 
-// GetProxyAddress gets the HTTP proxy address to use for a given address, if any.
-func GetProxyAddress(addr string) *url.URL {
-	addrURL, err := parse(addr)
-	if err != nil {
-		return nil
-	}
-	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
-	for _, scheme := range []string{"https", "http"} {
-		addrURL.Scheme = scheme
-		proxyURL, err := proxyFunc(addrURL)
-		if err == nil && proxyURL != nil {
-			return proxyURL
-		}
-	}
-
-	return nil
-}
-
 // bufferedConn is used when part of the data on a connection has already been
 // read by a *bufio.Reader. Reads will first try and read from the
 // *bufio.Reader and when everything has been read, reads will go to the
@@ -120,17 +100,3 @@ func (bc *bufferedConn) Read(b []byte) (n int, err error) {
 	}
 	return bc.Conn.Read(b)
 }
-
-// parse will extract the host:port of the proxy to dial to. If the
-// value is not prefixed by "http", then it will prepend "http" and try.
-func parse(addr string) (*url.URL, error) {
-	proxyurl, err := url.Parse(addr)
-	if err != nil || !strings.HasPrefix(proxyurl.Scheme, "http") {
-		proxyurl, err = url.Parse("http://" + addr)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	return proxyurl, nil
-}
diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
new file mode 100644
index 0000000000000..7477d6b897b21
--- /dev/null
+++ b/api/client/proxy/proxy.go
@@ -0,0 +1,69 @@
+package proxy
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/net/http/httpproxy"
+)
+
+// GetProxyAddress gets the HTTP proxy address to use for a given address, if any.
+func GetProxyAddress(addr string) *url.URL {
+	addrURL, err := parse(addr)
+	if err != nil {
+		return nil
+	}
+	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
+	for _, scheme := range []string{"https", "http"} {
+		addrURL.Scheme = scheme
+		proxyURL, err := proxyFunc(addrURL)
+		if err == nil && proxyURL != nil {
+			return proxyURL
+		}
+	}
+
+	return nil
+}
+
+// parse will extract the host:port of the proxy to dial to. If the
+// value is not prefixed by "http", then it will prepend "http" and try.
+func parse(addr string) (*url.URL, error) {
+	proxyurl, err := url.Parse(addr)
+	if err != nil || !strings.HasPrefix(proxyurl.Scheme, "http") {
+		proxyurl, err = url.Parse("http://" + addr)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	return proxyurl, nil
+}
+
+// ProxyAwareRoundTripper is a wrapper for http.Transport that can modify roundtrips as needed.
+type ProxyAwareRoundTripper struct {
+	http.Transport
+}
+
+func (rt *ProxyAwareRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	tlsConfig := rt.Transport.TLSClientConfig
+	if tlsConfig == nil {
+		return rt.Transport.RoundTrip(req)
+	}
+	httpProxy := httpproxy.FromEnvironment().HTTPProxy
+	if httpProxy == "" {
+		return rt.Transport.RoundTrip(req)
+	}
+	httpProxyURL, err := parse(httpProxy)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Use plain HTTP if proxying via http://localhost in insecure mode.
+	if tlsConfig.InsecureSkipVerify &&
+		httpProxyURL.Scheme == "http" &&
+		httpProxyURL.Hostname() == "localhost" {
+		req.URL.Scheme = "http"
+	}
+	return rt.Transport.RoundTrip(req)
+}
diff --git a/api/client/proxy_test.go b/api/client/proxy/proxy_test.go
similarity index 82%
rename from api/client/proxy_test.go
rename to api/client/proxy/proxy_test.go
index 9651102de1b2b..33e2239a4fd52 100644
--- a/api/client/proxy_test.go
+++ b/api/client/proxy/proxy_test.go
@@ -14,13 +14,18 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package client
+package proxy
 
 import (
+	"crypto/tls"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"golang.org/x/net/http/httpproxy"
 )
 
 func TestGetProxyAddress(t *testing.T) {
@@ -116,3 +121,21 @@ func TestGetProxyAddress(t *testing.T) {
 		})
 	}
 }
+
+func TestProxyAwareRoundTripper(t *testing.T) {
+	t.Setenv("HTTP_PROXY", "http://localhost:8888")
+	rt := ProxyAwareRoundTripper{
+		Transport: http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: true,
+			},
+			Proxy: func(req *http.Request) (*url.URL, error) {
+				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
+			},
+		},
+	}
+	req := httptest.NewRequest(http.MethodGet, "https://localhost:9999", nil)
+	// Don't care about response, only if the scheme changed.
+	rt.RoundTrip(req)
+	require.Equal(t, "http", req.URL.Scheme)
+}
diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index 53a496587f5b8..e0f5e1b0d8f77 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -30,6 +30,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/gravitational/teleport/api/client/proxy"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/utils"
@@ -42,7 +43,7 @@ import (
 // newWebClient creates a new client to the HTTPS web proxy.
 func newWebClient(insecure bool, pool *x509.CertPool) *http.Client {
 	return &http.Client{
-		Transport: &http.Transport{
+		Transport: &proxy.ProxyAwareRoundTripper{Transport: http.Transport{
 			TLSClientConfig: &tls.Config{
 				RootCAs:            pool,
 				InsecureSkipVerify: insecure,
@@ -50,7 +51,7 @@ func newWebClient(insecure bool, pool *x509.CertPool) *http.Client {
 			Proxy: func(req *http.Request) (*url.URL, error) {
 				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
 			},
-		},
+		}},
 	}
 }
 
diff --git a/lib/client/https_client.go b/lib/client/https_client.go
index c9f01aead2cb0..a1e2bfae73032 100644
--- a/lib/client/https_client.go
+++ b/lib/client/https_client.go
@@ -24,6 +24,7 @@ import (
 	"net/url"
 
 	"github.com/gravitational/teleport"
+	apiproxy "github.com/gravitational/teleport/api/client/proxy"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/utils"
@@ -40,12 +41,12 @@ func NewInsecureWebClient() *http.Client {
 	tlsConfig.InsecureSkipVerify = true
 
 	return &http.Client{
-		Transport: &http.Transport{
+		Transport: &apiproxy.ProxyAwareRoundTripper{Transport: http.Transport{
 			TLSClientConfig: tlsConfig,
 			Proxy: func(req *http.Request) (*url.URL, error) {
 				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
 			},
-		},
+		}},
 	}
 }
 
@@ -56,12 +57,12 @@ func newClientWithPool(pool *x509.CertPool) *http.Client {
 	tlsConfig.RootCAs = pool
 
 	return &http.Client{
-		Transport: &http.Transport{
+		Transport: &apiproxy.ProxyAwareRoundTripper{Transport: http.Transport{
 			TLSClientConfig: tlsConfig,
 			Proxy: func(req *http.Request) (*url.URL, error) {
 				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
 			},
-		},
+		}},
 	}
 }
 
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index ff8a49ed0eb47..d157ffe0fd931 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -26,6 +26,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	apiclient "github.com/gravitational/teleport/api/client"
+	apiproxy "github.com/gravitational/teleport/api/client/proxy"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/utils"
 
@@ -256,7 +257,7 @@ func WithInsecureSkipTLSVerify(insecure bool) DialerOptionFunc {
 // server directly.
 func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 	// Try and get proxy addr from the environment.
-	proxyAddr := apiclient.GetProxyAddress(addr)
+	proxyAddr := apiproxy.GetProxyAddress(addr)
 
 	var options dialerOptions
 	for _, opt := range opts {

From 2a6b7b23f9f741d97653d20112634701190d05ad Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 22 Mar 2022 10:09:12 -0700
Subject: [PATCH 26/43] Remove siddontang logger from proxy.go

---
 api/client/proxy.go | 2 +-
 api/go.mod          | 1 -
 api/go.sum          | 2 --
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/api/client/proxy.go b/api/client/proxy.go
index 0444987f58476..ad82e27503b35 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -25,7 +25,7 @@ import (
 	"strings"
 
 	"github.com/gravitational/trace"
-	"github.com/siddontang/go/log"
+	log "github.com/sirupsen/logrus"
 	"golang.org/x/net/http/httpproxy"
 )
 
diff --git a/api/go.mod b/api/go.mod
index a81a73769382d..3a7210c771f25 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -8,7 +8,6 @@ require (
 	github.com/google/go-cmp v0.5.4
 	github.com/gravitational/trace v1.1.17
 	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
-	github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726
 	github.com/sirupsen/logrus v1.8.1
 	github.com/stretchr/testify v1.7.0
 	golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8
diff --git a/api/go.sum b/api/go.sum
index 69ab03da359fa..72c1f18217730 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -61,8 +61,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 h1:xT+JlYxNGqyT+XcU8iUrN18JYed2TvG9yN5ULG2jATM=
-github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726/go.mod h1:3yhqj7WBBfRhbBlzyOC3gUxftwsU0u8gqevxwIHQpMw=
 github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

From bdddc69e0c49d708e5c635271decde24dc6245b5 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 22 Mar 2022 10:09:12 -0700
Subject: [PATCH 27/43] Remove siddontang logger from proxy.go

---
 api/client/proxy.go | 2 +-
 api/go.mod          | 1 -
 api/go.sum          | 2 --
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/api/client/proxy.go b/api/client/proxy.go
index 9e933034f5986..e128bb1b275a0 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -24,7 +24,7 @@ import (
 	"net/url"
 
 	"github.com/gravitational/trace"
-	"github.com/siddontang/go/log"
+	log "github.com/sirupsen/logrus"
 )
 
 // DialProxy creates a connection to a server via an HTTP Proxy.
diff --git a/api/go.mod b/api/go.mod
index a81a73769382d..3a7210c771f25 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -8,7 +8,6 @@ require (
 	github.com/google/go-cmp v0.5.4
 	github.com/gravitational/trace v1.1.17
 	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
-	github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726
 	github.com/sirupsen/logrus v1.8.1
 	github.com/stretchr/testify v1.7.0
 	golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8
diff --git a/api/go.sum b/api/go.sum
index 69ab03da359fa..72c1f18217730 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -61,8 +61,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726 h1:xT+JlYxNGqyT+XcU8iUrN18JYed2TvG9yN5ULG2jATM=
-github.com/siddontang/go v0.0.0-20180604090527-bdc77568d726/go.mod h1:3yhqj7WBBfRhbBlzyOC3gUxftwsU0u8gqevxwIHQpMw=
 github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

From a23bf820939893108512446cb3185ffd9c246574 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 23 Mar 2022 13:48:24 -0700
Subject: [PATCH 28/43] Merge master

---
 .cloudbuild/ci/integration-tests.yaml         |   23 +-
 .cloudbuild/ci/unit-tests.yaml                |   24 +-
 .../scripts/cmd/integration-tests/args.go     |    4 +
 .../scripts/cmd/integration-tests/main.go     |   30 +-
 .cloudbuild/scripts/cmd/unit-tests/main.go    |   32 +-
 .cloudbuild/scripts/go.mod                    |   15 +-
 .cloudbuild/scripts/go.sum                    |   27 +-
 .../internal/artifacts/artifacts_test.go      |    3 +-
 .cloudbuild/scripts/internal/etcd/start.go    |  199 +-
 .cloudbuild/scripts/internal/git/configure.go |  145 +
 .cloudbuild/scripts/internal/git/deploykey.go |   34 +
 .../scripts/internal/git/knownhosts.go        |   33 +
 .cloudbuild/scripts/internal/git/unshallow.go |   25 +
 .cloudbuild/scripts/internal/github/meta.go   |   58 +
 .cloudbuild/scripts/internal/secrets/fetch.go |   41 +
 .drone.yml                                    |   46 +-
 .github/ISSUE_TEMPLATE/testplan.md            |   20 +-
 .../workflows/robot/internal/bot/assign.go    |  123 +-
 .../robot/internal/bot/assign_test.go         |  146 +
 .github/workflows/robot/internal/bot/bot.go   |   12 +-
 .../workflows/robot/internal/bot/bot_test.go  |   19 +-
 .github/workflows/robot/internal/bot/check.go |    2 +-
 .github/workflows/robot/internal/bot/label.go |    2 +-
 .../robot/internal/bot/label_test.go          |    4 +-
 .github/workflows/robot/internal/env/env.go   |   24 +-
 .../workflows/robot/internal/env/env_test.go  |    2 +-
 .../workflows/robot/internal/env/structs.go   |   24 +-
 .../workflows/robot/internal/github/github.go |  130 +-
 .../workflows/robot/internal/review/review.go |   39 +-
 .../robot/internal/review/review_test.go      |  304 +-
 .golangci.yml                                 |    8 +
 Cargo.lock                                    |   12 +-
 Makefile                                      |   15 +-
 README.md                                     |    2 +-
 api/client/client.go                          |  121 +-
 api/client/client_test.go                     |   37 +-
 api/client/contextdialer.go                   |   14 +-
 api/client/credentials.go                     |    4 +-
 api/client/credentials_test.go                |   40 +-
 api/client/proto/authservice.pb.go            | 1983 +++++++++----
 api/client/proto/authservice.proto            |   44 +-
 api/client/proto/types.go                     |    2 +-
 api/client/proxy.go                           |    4 +-
 api/client/proxy/proxy.go                     |   16 +
 api/client/webclient/webclient.go             |  103 +-
 api/client/webclient/webclient_test.go        |   32 +-
 api/go.mod                                    |    2 +-
 api/go.sum                                    |   24 +-
 api/identityfile/identityfile.go              |    5 +-
 api/profile/profile.go                        |   36 +-
 api/types/app_test.go                         |    4 -
 api/types/appserver.go                        |    9 +-
 api/types/constants.go                        |    6 +-
 api/types/database.go                         |   10 -
 api/types/databaseserver.go                   |    9 +-
 api/types/databaseserver_test.go              |    4 -
 api/types/desktop.go                          |   97 +
 api/types/desktop_test.go                     |   88 +
 api/types/events/events.pb.go                 | 1365 ++++++---
 api/types/events/events.proto                 |   19 +
 api/types/events/oneof.go                     |   24 +-
 api/types/events/unknown.go                   |   25 +
 api/types/kubernetes.go                       |   98 +
 api/types/kubernetes_test.go                  |   84 +
 api/types/resource.go                         |   47 +-
 api/types/resource_test.go                    |   50 +
 api/types/role.go                             |   21 +-
 api/types/server_test.go                      |    4 -
 api/types/types.pb.go                         | 1501 +++++-----
 api/types/types.proto                         |    5 +
 assets/aws/Makefile                           |    2 +-
 assets/backport/main.go                       |    3 +-
 assets/loadtest/k8s/Makefile                  |    9 +-
 assets/loadtest/k8s/auth-etcd.yaml            |    3 +
 assets/loadtest/k8s/auth-firestore.yaml       |    3 +
 assets/loadtest/k8s/prometheus.yaml           |  291 ++
 assets/loadtest/k8s/proxy.yaml                |    4 +-
 assets/loadtest/k8s/secrets/Makefile          |   20 +-
 build.assets/Dockerfile                       |    5 +
 build.assets/Makefile                         |   10 +
 build.assets/build-package.sh                 |    6 +-
 .../gomod/update-api-import-path/main.go      |   15 +-
 build.assets/install                          |    2 +-
 build.assets/tooling/cmd/check/main.go        |    6 +
 build.assets/tooling/cmd/check/main_test.go   |    9 +
 constants.go                                  |    4 +
 docker/teleport-ent-quickstart.yml            |    4 +-
 docker/teleport-lab.yml                       |    8 +-
 docker/teleport-quickstart.yml                |    4 +-
 docs/config.json                              |   99 +-
 .../guides/redis/redisinsight-add-config.png  |  Bin 0 -> 228417 bytes
 .../guides/redis/redisinsight-connected.png   |  Bin 0 -> 181286 bytes
 .../guides/redis/redisinsight-startup.png     |  Bin 0 -> 453447 bytes
 .../guides/redis/redisinsight-tls-config.png  |  Bin 0 -> 326444 bytes
 .../pages/access-controls/getting-started.mdx |    2 +-
 .../access-controls/guides/dual-authz.mdx     |   97 +-
 .../access-controls/guides/impersonation.mdx  |   32 +-
 .../guides/per-session-mfa.mdx                |   48 +-
 docs/pages/access-controls/guides/u2f.mdx     |    2 +-
 .../pages/access-controls/guides/webauthn.mdx |    2 +-
 docs/pages/access-controls/reference.mdx      |   20 +-
 docs/pages/api/getting-started.mdx            |   14 +-
 docs/pages/application-access/controls.mdx    |    2 +-
 .../application-access/getting-started.mdx    |   83 +-
 .../application-access/guides/api-access.mdx  |    1 +
 .../application-access/guides/aws-console.mdx |   38 +-
 .../guides/connecting-apps.mdx                |   38 +-
 docs/pages/cloud/faq.mdx                      |    4 +-
 .../pages/database-access/getting-started.mdx |   33 +-
 .../guides/cockroachdb-self-hosted.mdx        |    4 +-
 .../database-access/guides/gui-clients.mdx    |   31 +
 .../database-access/guides/mongodb-atlas.mdx  |    6 +-
 .../guides/mysql-self-hosted.mdx              |   53 +-
 .../guides/postgres-redshift.mdx              |  177 +-
 .../guides/postgres-self-hosted.mdx           |   50 +-
 docs/pages/database-access/guides/rds.mdx     |  293 +-
 docs/pages/database-access/guides/redis.mdx   |  375 +++
 docs/pages/database-access/reference/aws.mdx  |  219 +-
 docs/pages/database-access/reference/cli.mdx  |   47 +
 docs/pages/desktop-access/getting-started.mdx |   12 +-
 docs/pages/desktop-access/reference.mdx       |   19 +
 .../desktop-access/reference/clipboard.mdx    |   46 +
 .../desktop-access/reference/sessions.mdx     |   86 +
 docs/pages/enterprise/hsm.mdx                 |    2 +-
 docs/pages/enterprise/sso/adfs.mdx            |   83 +-
 docs/pages/enterprise/sso/azuread.mdx         |   30 +-
 docs/pages/enterprise/sso/gitlab.mdx          |   12 +-
 .../pages/enterprise/sso/google-workspace.mdx |    2 +
 docs/pages/enterprise/sso/oidc.mdx            |   12 +-
 docs/pages/enterprise/sso/okta.mdx            |   12 +-
 docs/pages/enterprise/sso/one-login.mdx       |   12 +-
 .../workflow/ssh-approval-jira-cloud.mdx      |  115 +-
 .../workflow/ssh-approval-jira-server.mdx     |  127 +-
 .../workflow/ssh-approval-mattermost.mdx      |   93 +-
 .../workflow/ssh-approval-pagerduty.mdx       |  101 +-
 .../workflow/ssh-approval-slack.mdx           |  157 +-
 docs/pages/faq.mdx                            |    2 +-
 docs/pages/getting-started/docker-compose.mdx |    6 +-
 docs/pages/getting-started/linux-server.mdx   |   49 +-
 docs/pages/includes/acme.mdx                  |   29 +
 .../database-access/aws-bootstrap.mdx         |   47 +
 .../database-access/database-config.yaml      |    2 +-
 .../database-access/guides-next-steps.mdx     |    1 +
 .../pages/includes/database-access/guides.mdx |    3 +
 .../database-access/start-auth-proxy.mdx      |   42 +-
 docs/pages/includes/dns-app-access.mdx        |    4 +
 docs/pages/includes/dns.mdx                   |   59 +
 .../enterprise/oidcauthentication.mdx         |   34 +
 .../enterprise/samlauthentication.mdx         |   33 +
 docs/pages/includes/helm.mdx                  |    2 +-
 .../includes/kubernetes-access/helm-k8s.mdx   |    2 +-
 .../includes/plugins/identity-export.mdx      |   29 +
 docs/pages/includes/plugins/rbac.mdx          |   60 +
 docs/pages/includes/tctl.mdx                  |   29 +-
 docs/pages/index.mdx                          |    4 +-
 docs/pages/installation.mdx                   |   13 +
 docs/pages/kubernetes-access/controls.mdx     |    2 +-
 .../getting-started/agent.mdx                 |  132 +-
 .../getting-started/cluster.mdx               |   54 +-
 docs/pages/kubernetes-access/guides.mdx       |    3 -
 .../kubernetes-access/guides/federation.mdx   |   49 +-
 .../kubernetes-access/guides/migration.mdx    |  392 ---
 .../guides/multiple-clusters.mdx              |  136 +-
 .../guides/standalone-teleport.mdx            |  114 +-
 .../kubernetes-access/helm/guides/aws.mdx     |   36 +-
 .../kubernetes-access/helm/guides/custom.mdx  |   20 +-
 .../helm/guides/digitalocean.mdx              |    2 +
 .../kubernetes-access/helm/guides/gcp.mdx     |   35 +-
 .../helm/guides/migration.mdx                 |   22 +-
 .../helm/includes/helm-install.mdx            |   48 -
 .../helm/includes/helm-repo-add.mdx           |   11 +
 .../teleport-cluster-cloud-warning.mdx        |   10 +
 .../includes/teleport-cluster-install.mdx     |   12 +
 .../includes/teleport-cluster-prereqs.mdx     |    6 +
 .../kubernetes-access/helm/reference.mdx      | 2575 +----------------
 .../helm/reference/teleport-cluster.mdx       | 1348 +++++++++
 .../helm/reference/teleport-kube-agent.mdx    | 1334 +++++++++
 docs/pages/kubernetes-access/introduction.mdx |    9 +-
 docs/pages/machine-id/getting-started.mdx     |  236 ++
 docs/pages/machine-id/guides.mdx              |   11 +
 docs/pages/machine-id/guides/ansible.mdx      |  122 +
 docs/pages/machine-id/introduction.mdx        |   56 +
 docs/pages/machine-id/reference.mdx           |    8 +
 docs/pages/machine-id/reference/cli.mdx       |   90 +
 .../machine-id/reference/configuration.mdx    |   99 +
 docs/pages/server-access/getting-started.mdx  |  145 +-
 docs/pages/server-access/guides/ansible.mdx   |  126 -
 docs/pages/server-access/guides/vscode.mdx    |   59 +-
 docs/pages/setup/admin/adding-nodes.mdx       |  322 ++-
 docs/pages/setup/admin/daemon.mdx             |    2 +-
 docs/pages/setup/admin/github-sso.mdx         |  162 +-
 docs/pages/setup/admin/troubleshooting.mdx    |   24 +-
 docs/pages/setup/admin/trustedclusters.mdx    |    2 +-
 .../pages/setup/deployments/aws-terraform.mdx |    2 +-
 docs/pages/setup/guides/fluentd.mdx           |  238 +-
 docs/pages/setup/guides/joining-nodes-aws.mdx |   24 +-
 .../pages/setup/guides/terraform-provider.mdx |  229 +-
 docs/pages/setup/operations/ca-rotation.mdx   |  259 +-
 docs/pages/setup/reference/authentication.mdx |   33 +-
 docs/pages/setup/reference/cli.mdx            |   75 +-
 docs/pages/setup/reference/license.mdx        |   25 +-
 docs/pages/setup/reference/metrics.mdx        |   87 +-
 .../setup/reference/predicate-language.mdx    |   71 +
 docs/postrelease.md                           |    7 +-
 dronegen/mac_pkg.go                           |    5 +-
 dronegen/main.go                              |    5 +-
 e                                             |    2 +-
 examples/aws/cloudformation/ent.yaml          |   30 +-
 examples/aws/cloudformation/oss.yaml          |   30 +-
 examples/aws/terraform/AMIS.md                |  102 +-
 .../terraform/ha-autoscale-cluster/README.md  |    2 +-
 .../aws/terraform/starter-cluster/README.md   |    2 +-
 .../aws/terraform/starter-cluster/vars.tf     |    2 +-
 examples/chart/CONTRIBUTING.md                |   51 +
 .../teleport-auto-trustedcluster/README.md    |    5 +
 .../.lint/{service.yml => service.yaml}       |    0
 .../.lint/standalone-customsize.yaml          |    2 +-
 .../.lint/standalone-existingpvc.yaml         |    2 +-
 .../chart/teleport-cluster/.lint/volumes.yaml |    2 +-
 .../teleport-cluster/.lint/webauthn.yaml      |    8 +
 examples/chart/teleport-cluster/README.md     |    4 +
 .../teleport-cluster/templates/config.yaml    |   24 +-
 .../chart/teleport-cluster/tests/README.md    |   18 +
 .../__snapshot__/certificate_test.yaml.snap   |   16 +
 .../__snapshot__/clusterrole_test.yaml.snap   |   27 +
 .../clusterrolebinding_test.yaml.snap         |   14 +
 .../tests/__snapshot__/config_test.yaml.snap  | 1098 +++++++
 .../__snapshot__/deployment_test.yaml.snap    | 1585 ++++++++++
 .../tests/__snapshot__/pdb_test.yaml.snap     |   14 +
 .../tests/__snapshot__/psp_test.yaml.snap     |   34 +
 .../tests/__snapshot__/pvc_test.yaml.snap     |   30 +
 .../tests/__snapshot__/service_test.yaml.snap |  143 +
 .../serviceaccount_test.yaml.snap             |   10 +
 .../tests/certificate_test.yaml               |   29 +
 .../tests/clusterrole_test.yaml               |   11 +
 .../tests/clusterrolebinding_test.yaml        |   11 +
 .../teleport-cluster/tests/config_test.yaml   |  330 +++
 .../tests/deployment_test.yaml                |  533 ++++
 .../teleport-cluster/tests/pdb_test.yaml      |   13 +
 .../teleport-cluster/tests/psp_test.yaml      |   21 +
 .../teleport-cluster/tests/pvc_test.yaml      |   65 +
 .../teleport-cluster/tests/service_test.yaml  |   66 +
 .../tests/serviceaccount_test.yaml            |   15 +
 .../chart/teleport-cluster/values.schema.json |   30 +
 examples/chart/teleport-cluster/values.yaml   |    3 +
 examples/chart/teleport-daemonset/README.md   |    5 +
 .../.lint/existing-data-volume.yaml           |    5 +
 .../teleport-kube-agent/.lint/extra-args.yaml |    5 +
 .../teleport-kube-agent/.lint/extra-env.yaml  |    7 +
 .../.lint/image-pull-policy-stateful.yaml     |    7 +
 .../.lint/image-pull-policy.yaml              |    5 +
 .../.lint/service-account-name.yaml           |    5 +
 .../teleport-kube-agent/.lint/volumes.yaml    |    2 +-
 examples/chart/teleport-kube-agent/README.md  |    4 +
 .../teleport-kube-agent/templates/config.yaml |    6 +
 .../templates/deployment.yaml                 |   27 +-
 .../templates/statefulset.yaml                |   27 +-
 .../chart/teleport-kube-agent/tests/README.md |   18 +
 .../__snapshot__/clusterrole_test.yaml.snap   |   27 +
 .../clusterrolebinding_test.yaml.snap         |   14 +
 .../tests/__snapshot__/config_test.yaml.snap  |  658 +++++
 .../__snapshot__/deployment_test.yaml.snap    | 1346 +++++++++
 .../tests/__snapshot__/pdb_test.yaml.snap     |   14 +
 .../tests/__snapshot__/psp_test.yaml.snap     |   34 +
 .../tests/__snapshot__/secret_test.yaml.snap  |   22 +
 .../serviceaccount_test.yaml.snap             |   10 +
 .../__snapshot__/statefulset_test.yaml.snap   | 1454 ++++++++++
 .../tests/clusterrole_test.yaml               |   11 +
 .../tests/clusterrolebinding_test.yaml        |   11 +
 .../tests/config_test.yaml                    |  209 ++
 .../tests/deployment_test.yaml                |  349 +++
 .../teleport-kube-agent/tests/pdb_test.yaml   |   13 +
 .../teleport-kube-agent/tests/psp_test.yaml   |   21 +
 .../tests/secret_test.yaml                    |   30 +
 .../tests/serviceaccount_test.yaml            |   15 +
 .../tests/statefulset_test.yaml               |  369 +++
 .../teleport-kube-agent/values.schema.json    |   10 +
 .../chart/teleport-kube-agent/values.yaml     |    9 +
 examples/chart/teleport/.helmignore           |    1 +
 examples/chart/teleport/README.md             |    5 +
 .../plugins/teleport-jira-cloud.toml          |   20 +
 ...ra.toml => teleport-jira-self-hosted.toml} |    0
 .../plugins/teleport-mattermost-cloud.toml    |   21 +
 ...ost.toml => teleport-mattermost-self.toml} |    0
 .../plugins/teleport-pagerduty-cloud.toml     |   26 +
 ...duty.toml => teleport-pagerduty-self.toml} |    0
 .../terraform/terraform-user-role-cloud.tf    |   79 +
 ....tf => terraform-user-role-self-hosted.tf} |    4 +-
 go.mod                                        |    9 +-
 go.sum                                        |   32 +-
 integration/app_integration_test.go           |  154 +-
 integration/db_integration_test.go            |  173 +-
 integration/helpers.go                        |   19 +-
 integration/hsm/hsm_test.go                   |   20 +-
 integration/integration_test.go               |  130 +-
 integration/kube_integration_test.go          |   25 +-
 integration/proxy_helpers_test.go             |    6 +-
 integration/proxy_test.go                     |    4 +-
 lib/asciitable/table.go                       |   62 +-
 lib/asciitable/table_test.go                  |   52 +
 lib/auth/access.go                            |    2 +-
 lib/auth/access_test.go                       |    2 +-
 lib/auth/accountrecovery.go                   |    3 +-
 lib/auth/accountrecovery_test.go              |    2 +-
 lib/auth/api.go                               |   38 +-
 lib/auth/apiserver.go                         |   16 +-
 lib/auth/auth.go                              |  205 +-
 lib/auth/auth_login_test.go                   |  392 ++-
 lib/auth/auth_test.go                         |   38 +
 lib/auth/auth_with_roles.go                   |  127 +-
 lib/auth/auth_with_roles_test.go              |  330 ++-
 lib/auth/bot.go                               |   10 +-
 lib/auth/clt.go                               |  187 +-
 lib/auth/clt_test.go                          |   91 +
 lib/auth/db.go                                |    6 +-
 lib/auth/desktop.go                           |    2 +-
 lib/auth/github.go                            |    2 +-
 lib/auth/grpcserver.go                        |   35 +-
 lib/auth/grpcserver_test.go                   |  151 +-
 lib/auth/helpers.go                           |    8 +-
 lib/auth/httpfallback.go                      |   55 +-
 lib/auth/init.go                              |   22 +-
 lib/auth/init_test.go                         |    9 +-
 lib/auth/join.go                              |    7 +-
 lib/auth/join_test.go                         |   15 +-
 lib/auth/kube.go                              |    8 +-
 lib/auth/methods.go                           |  124 +-
 lib/auth/middleware.go                        |   21 +-
 lib/auth/mocku2f/mocku2f.go                   |   10 +-
 lib/auth/oidc.go                              |    8 +-
 lib/auth/password.go                          |    2 +-
 lib/auth/permissions.go                       |   10 +-
 lib/auth/permissions_test.go                  |    4 +-
 lib/auth/register.go                          |   37 -
 lib/auth/rotate.go                            |   15 +-
 lib/auth/saml.go                              |    8 +-
 lib/auth/session_access.go                    |   66 +-
 lib/auth/session_access_test.go               |   44 +-
 lib/auth/sessions.go                          |    4 +-
 lib/auth/state_unix.go                        |    1 +
 lib/auth/tls_test.go                          |  130 +-
 lib/auth/trustedcluster.go                    |   53 +-
 lib/auth/trustedcluster_test.go               |  126 +
 lib/auth/usertoken.go                         |    5 +-
 lib/auth/webauthn/login.go                    |   12 +
 lib/auth/webauthn/register.go                 |   13 +
 lib/auth/webauthn/register_test.go            |   84 +
 lib/auth/webauthncli/api.go                   |   64 +
 lib/auth/webauthncli/export_fido2_test.go     |   23 +
 lib/auth/webauthncli/fido2.go                 |  776 +++++
 lib/auth/webauthncli/fido2_common.go          |   75 +
 lib/auth/webauthncli/fido2_other.go           |   48 +
 lib/auth/webauthncli/fido2_test.go            | 1438 +++++++++
 .../webauthncli/{login.go => u2f_login.go}    |   11 +-
 .../{login_test.go => u2f_login_test.go}      |    8 +-
 .../{register.go => u2f_register.go}          |   11 +-
 ...{register_test.go => u2f_register_test.go} |   18 +-
 lib/backend/backend.go                        |   12 +-
 lib/backend/backend_test.go                   |   19 +
 lib/backend/dynamo/dynamodbbk.go              |   16 +-
 lib/backend/dynamo/dynamodbbk_test.go         |    7 +-
 lib/backend/etcdbk/etcd.go                    |   11 +-
 lib/backend/firestore/firestorebk.go          |    1 -
 lib/backend/lite/lite.go                      |  164 +-
 lib/backend/lite/litemem_test.go              |   56 -
 lib/backend/memory/memory.go                  |    1 -
 lib/backend/report.go                         |    3 -
 lib/backend/sanitize.go                       |   19 +-
 lib/backend/sanitize_test.go                  |  101 +-
 lib/backend/test/suite.go                     |   76 +-
 lib/backend/wrap.go                           |    3 -
 lib/benchmark/benchmark.go                    |    5 +-
 lib/bpf/bpf_test.go                           |    7 +-
 lib/cache/cache.go                            |   32 +-
 lib/cache/cache_test.go                       |   27 +-
 lib/cache/collections.go                      |   10 +-
 lib/cgroup/cgroup.go                          |   22 +-
 lib/cgroup/cgroup_test.go                     |    5 +-
 lib/client/api.go                             |  568 ++--
 lib/client/api_login_test.go                  |   45 +-
 lib/client/api_test.go                        |   62 +-
 lib/client/client.go                          |   94 +-
 lib/client/client_test.go                     |    5 +-
 lib/client/{export_test.go => export.go}      |    0
 lib/client/https_client_test.go               |   31 +-
 lib/client/identityfile/identity.go           |   15 +-
 lib/client/identityfile/identity_test.go      |    8 +-
 lib/client/keyagent_test.go                   |    3 +-
 lib/client/keystore.go                        |   45 +-
 lib/client/keystore_test.go                   |   16 +-
 lib/client/mfa.go                             |   31 +-
 lib/client/weblogin.go                        |   22 +-
 lib/client/weblogin_test.go                   |    4 +-
 lib/config/configuration.go                   |   36 +-
 lib/config/configuration_test.go              |   12 +-
 lib/config/fileconf.go                        |   13 +-
 lib/datalog/access_test.go                    |    2 +-
 lib/defaults/defaults.go                      |   11 +
 lib/events/api.go                             |    3 +
 lib/events/auditlog_test.go                   |    9 +-
 lib/events/codes.go                           |    5 +
 lib/events/complete.go                        |  195 +-
 lib/events/complete_test.go                   |  145 +
 lib/events/dynamic.go                         |   16 +-
 lib/events/emitter_test.go                    |    3 +-
 lib/events/events_test.go                     |    3 +-
 lib/events/fields.go                          |    3 +-
 lib/events/filesessions/fileasync.go          |    7 +-
 .../filesessions/fileasync_chaos_test.go      |    5 +-
 lib/events/filesessions/fileasync_test.go     |   17 +-
 lib/events/filesessions/filestream.go         |   50 +-
 lib/events/filesessions/fileuploader_test.go  |    5 +-
 lib/events/gcssessions/gcsstream.go           |    7 +-
 lib/events/gcssessions/gcsstream_test.go      |   34 +
 lib/events/playback.go                        |    3 +-
 lib/events/s3sessions/s3stream.go             |   17 +
 lib/events/sessionlog.go                      |    7 +-
 lib/events/stream.go                          |   14 +-
 lib/events/test/streamsuite.go                |    5 +-
 lib/events/test/suite.go                      |    8 +-
 lib/kube/kubeconfig/kubeconfig_test.go        |    3 +-
 lib/kube/proxy/auth_test.go                   |    3 +-
 lib/kube/proxy/forwarder_test.go              |    4 +-
 lib/kube/proxy/roundtrip.go                   |    3 +-
 lib/kube/proxy/sess.go                        |  105 +-
 lib/kube/utils/utils.go                       |   29 +-
 lib/kube/utils/utils_test.go                  |   30 +
 lib/multiplexer/multiplexer_test.go           |    7 +-
 lib/restrictedsession/restricted_test.go      |    3 +-
 lib/reversetunnel/agent.go                    |    6 +-
 lib/reversetunnel/agent_test.go               |    2 +-
 lib/reversetunnel/api.go                      |   15 +
 lib/reversetunnel/conn.go                     |   10 -
 lib/reversetunnel/fake.go                     |   41 +-
 lib/reversetunnel/localsite.go                |   64 +-
 lib/reversetunnel/localsite_test.go           |  101 +
 lib/reversetunnel/remotesite.go               |    6 +-
 lib/reversetunnel/resolver.go                 |    4 +-
 lib/reversetunnel/srv.go                      |    2 +-
 lib/reversetunnel/srv_test.go                 |    3 +-
 lib/reversetunnel/transport.go                |   16 +-
 lib/service/connect.go                        |    4 +-
 lib/service/desktop.go                        |    1 +
 lib/service/service.go                        |  102 +-
 lib/service/service_test.go                   |   31 +-
 lib/service/state.go                          |    4 +-
 lib/services/access_request_test.go           |    2 +-
 lib/services/database.go                      |  133 +-
 lib/services/database_test.go                 |   51 +-
 lib/services/desktop.go                       |    1 +
 lib/services/local/desktops.go                |   67 +
 lib/services/local/desktops_test.go           |  213 ++
 lib/services/local/perf_test.go               |    6 +-
 lib/services/local/presence.go                |   89 +-
 lib/services/local/presence_test.go           |  117 +-
 lib/services/local/session.go                 |   31 +-
 lib/services/local/trust.go                   |   12 +-
 lib/services/local/users.go                   |    2 +
 lib/services/local/users_test.go              |   34 +-
 lib/services/matchers.go                      |    2 +-
 lib/services/matchers_test.go                 |   26 +
 lib/services/reconciler.go                    |   18 +-
 lib/services/reconciler_test.go               |    8 +-
 lib/services/resource.go                      |   83 +-
 lib/services/role.go                          |   24 +-
 lib/services/role_test.go                     |   16 +-
 lib/services/suite/suite.go                   |   17 +-
 lib/services/trust.go                         |   10 +-
 lib/services/watcher.go                       |   58 +-
 lib/srv/alpnproxy/auth/auth_proxy.go          |   23 +-
 lib/srv/alpnproxy/auth/auth_proxy_test.go     |   76 +
 lib/srv/alpnproxy/common/protocols.go         |   17 +-
 lib/srv/alpnproxy/proxy.go                    |   14 +-
 lib/srv/alpnproxy/proxy_test.go               |   59 +
 lib/srv/app/aws/endpoints.go                  |  160 +
 lib/srv/app/aws/endpoints_test.go             |  359 +++
 lib/srv/app/aws/handler.go                    |   14 -
 lib/srv/app/server.go                         |    4 +-
 lib/srv/app/server_test.go                    |    2 +-
 lib/srv/app/watcher.go                        |   60 +-
 lib/srv/authhandlers.go                       |    3 +-
 lib/srv/ctx.go                                |   22 +-
 lib/srv/db/access_test.go                     |   83 +-
 lib/srv/db/audit_test.go                      |    8 +-
 lib/srv/db/ca.go                              |    9 +-
 lib/srv/db/ca_test.go                         |   20 +-
 lib/srv/db/cloud/watchers/rds.go              |   25 +-
 lib/srv/db/cloud/watchers/redshift.go         |    7 +
 lib/srv/db/cloud/watchers/watcher_test.go     |  101 +-
 lib/srv/db/common/errors.go                   |   56 +
 lib/srv/db/common/test.go                     |    2 +-
 lib/srv/db/ha_test.go                         |    2 +-
 lib/srv/db/mongodb/connect.go                 |   23 +-
 lib/srv/db/mongodb/engine.go                  |    9 +-
 lib/srv/db/mongodb/test.go                    |   11 +-
 lib/srv/db/mysql/engine.go                    |   14 +-
 lib/srv/db/mysql/test.go                      |   25 +
 lib/srv/db/postgres/engine.go                 |   14 +-
 lib/srv/db/proxy_test.go                      |    4 +-
 lib/srv/db/proxyserver.go                     |   76 +-
 lib/srv/db/proxyserver_test.go                |    8 +-
 lib/srv/db/redis/client.go                    |  293 ++
 lib/srv/db/redis/cmds.go                      |   53 +-
 lib/srv/db/redis/engine.go                    |   86 +-
 lib/srv/db/redis/protocol/resp2.go            |   54 +-
 lib/srv/db/redis/protocol/resp2_test.go       |  106 +
 lib/srv/db/server.go                          |    4 +-
 lib/srv/db/watcher.go                         |    7 +-
 lib/srv/desktop/audit.go                      |   21 +-
 lib/srv/desktop/audit_test.go                 |    3 +
 lib/srv/desktop/discovery.go                  |   20 +-
 lib/srv/desktop/discovery_test.go             |   10 +-
 lib/srv/desktop/rdp/rdpclient/client.go       |   30 +-
 lib/srv/desktop/rdp/rdpclient/librdprs.h      |   15 +-
 lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs  |  233 +-
 lib/srv/desktop/rdp/rdpclient/src/lib.rs      |   22 +-
 lib/srv/desktop/rdp/rdpclient/src/vchan.rs    |   20 +-
 lib/srv/desktop/windows_server.go             |   21 +-
 lib/srv/desktop/windows_server_test.go        |   14 +-
 lib/srv/reexec.go                             |   19 +-
 lib/srv/regular/sshserver.go                  |    3 +-
 lib/srv/regular/sshserver_test.go             |    9 +-
 lib/srv/sess.go                               |  202 +-
 lib/srv/sess_test.go                          |  246 ++
 lib/srv/termmanager.go                        |   76 +-
 lib/srv/termmanager_test.go                   |   50 +
 lib/sshutils/scp/scp_test.go                  |   15 +-
 lib/sshutils/x11/display.go                   |   24 +-
 lib/sshutils/x11/display_test.go              |  187 +-
 lib/tlsca/ca.go                               |   12 +-
 lib/utils/certs_test.go                       |    4 +-
 lib/utils/chconn_test.go                      |    4 +-
 lib/utils/cli.go                              |   74 +-
 lib/utils/cli_test.go                         |    4 +-
 lib/utils/conn.go                             |    3 +-
 lib/utils/environment_test.go                 |    3 +-
 lib/utils/jsontools_test.go                   |    5 +-
 lib/utils/kernel.go                           |    3 +-
 lib/utils/prompt/confirmation.go              |   13 +-
 lib/utils/prompt/sync_reader.go               |   55 +
 lib/utils/prompt/sync_reader_test.go          |   66 +
 lib/utils/syslog.go                           |    4 +-
 lib/utils/timeout_test.go                     |    4 +-
 lib/utils/token.go                            |    4 +-
 lib/utils/utils.go                            |    7 +-
 lib/utils/utils_test.go                       |    8 +-
 lib/web/apiserver.go                          |   96 +-
 lib/web/apiserver_login_test.go               |  139 +-
 lib/web/apiserver_test.go                     |  115 +-
 lib/web/app/transport.go                      |   13 +-
 lib/web/desktop/playback.go                   |   24 +
 lib/web/desktop/playback_test.go              |    2 +-
 lib/web/gziphandler.go                        |    4 +-
 lib/web/join_tokens.go                        |   41 +-
 lib/web/join_tokens_test.go                   |    5 +-
 lib/web/mfa.go                                |   20 +-
 lib/web/resources_test.go                     |    4 +-
 lib/web/sessions.go                           |   11 +-
 lib/web/static_test.go                        |   11 +-
 lib/web/ui/perf_test.go                       |    8 +-
 lib/web/ui/usercontext.go                     |    3 -
 lib/web/ui/usercontext_test.go                |    3 +-
 rfd/0039-sni-alpn-teleport-proxy-routing.md   |    2 +-
 rfd/0043-kubeaccess-multiparty.md             |  185 +-
 rfd/0046-database-access-config.md            |  411 ++-
 rfd/0056-sql-backend.md                       |  137 +
 rfd/0060-gRPC-backend.md                      |  200 ++
 tool/tbot/botfs/botfs.go                      |  156 +
 tool/tbot/botfs/fs_linux.go                   |  450 +++
 tool/tbot/botfs/fs_other.go                   |  113 +
 tool/tbot/config/config.go                    |  101 +-
 tool/tbot/config/config_destination.go        |   18 +-
 tool/tbot/config/config_test.go               |   56 +-
 tool/tbot/config/configtemplate.go            |    5 -
 tool/tbot/config/configtemplate_ssh.go        |  121 +-
 tool/tbot/config/destination.go               |   26 +-
 tool/tbot/config/destination_directory.go     |  136 +-
 tool/tbot/config/destination_memory.go        |   13 +-
 tool/tbot/destination/destination.go          |   25 +-
 tool/tbot/identity/artifact.go                |  144 +
 tool/tbot/identity/identity.go                |  254 +-
 tool/tbot/identity/kinds.go                   |   86 +
 tool/tbot/init.go                             |  557 ++++
 tool/tbot/init_test.go                        |  271 ++
 tool/tbot/main.go                             |  534 +++-
 tool/tctl/common/app_command.go               |   62 +-
 tool/tctl/common/auth_command.go              |   89 +-
 tool/tctl/common/auth_command_test.go         |   91 +-
 tool/tctl/common/bots_command.go              |   38 +-
 tool/tctl/common/collection.go                |  211 +-
 tool/tctl/common/db_command.go                |   62 +-
 tool/tctl/common/desktop_command.go           |   97 +
 tool/tctl/common/kube_command.go              |   84 +
 tool/tctl/common/node_command.go              |   93 +-
 tool/tctl/common/resource_command.go          |   26 +-
 tool/tctl/common/resource_command_test.go     |    8 +-
 tool/tctl/common/status_command.go            |   14 +-
 tool/tctl/common/tctl.go                      |    8 +
 tool/tctl/common/token_command.go             |   28 +-
 tool/tctl/common/usage.go                     |   10 +-
 tool/tctl/main.go                             |    3 +
 tool/teleport/common/teleport.go              |    4 +-
 tool/teleport/common/teleport_test.go         |   40 +-
 tool/tsh/app.go                               |   14 +-
 tool/tsh/aws.go                               |    3 +-
 tool/tsh/db.go                                |   12 +-
 tool/tsh/db_test.go                           |    3 +-
 tool/tsh/dbcmd.go                             |    2 +-
 tool/tsh/kube.go                              |   67 +-
 tool/tsh/mfa.go                               |   89 +-
 tool/tsh/proxy_test.go                        |    7 +-
 tool/tsh/resolve_default_addr.go              |    3 +-
 tool/tsh/tsh.go                               |  173 +-
 tool/tsh/tsh_helper_test.go                   |    4 +-
 tool/tsh/tsh_test.go                          |  145 +-
 tool/tsh/tshconfig.go                         |   59 +
 webassets                                     |    2 +-
 617 files changed, 37048 insertions(+), 11203 deletions(-)
 create mode 100644 .cloudbuild/scripts/internal/git/configure.go
 create mode 100644 .cloudbuild/scripts/internal/git/deploykey.go
 create mode 100644 .cloudbuild/scripts/internal/git/knownhosts.go
 create mode 100644 .cloudbuild/scripts/internal/git/unshallow.go
 create mode 100644 .cloudbuild/scripts/internal/github/meta.go
 create mode 100644 .cloudbuild/scripts/internal/secrets/fetch.go
 create mode 100644 .github/workflows/robot/internal/bot/assign_test.go
 create mode 100644 api/types/desktop_test.go
 create mode 100644 api/types/events/unknown.go
 create mode 100644 api/types/kubernetes_test.go
 create mode 100644 assets/loadtest/k8s/prometheus.yaml
 create mode 100644 docs/img/database-access/guides/redis/redisinsight-add-config.png
 create mode 100644 docs/img/database-access/guides/redis/redisinsight-connected.png
 create mode 100644 docs/img/database-access/guides/redis/redisinsight-startup.png
 create mode 100644 docs/img/database-access/guides/redis/redisinsight-tls-config.png
 create mode 100644 docs/pages/database-access/guides/redis.mdx
 create mode 100644 docs/pages/desktop-access/reference.mdx
 create mode 100644 docs/pages/desktop-access/reference/clipboard.mdx
 create mode 100644 docs/pages/desktop-access/reference/sessions.mdx
 create mode 100644 docs/pages/includes/acme.mdx
 create mode 100644 docs/pages/includes/database-access/aws-bootstrap.mdx
 create mode 100644 docs/pages/includes/dns-app-access.mdx
 create mode 100644 docs/pages/includes/dns.mdx
 create mode 100644 docs/pages/includes/enterprise/oidcauthentication.mdx
 create mode 100644 docs/pages/includes/enterprise/samlauthentication.mdx
 create mode 100644 docs/pages/includes/plugins/identity-export.mdx
 create mode 100644 docs/pages/includes/plugins/rbac.mdx
 delete mode 100644 docs/pages/kubernetes-access/guides/migration.mdx
 delete mode 100644 docs/pages/kubernetes-access/helm/includes/helm-install.mdx
 create mode 100644 docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx
 create mode 100644 docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx
 create mode 100644 docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx
 create mode 100644 docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
 create mode 100644 docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx
 create mode 100644 docs/pages/kubernetes-access/helm/reference/teleport-kube-agent.mdx
 create mode 100644 docs/pages/machine-id/getting-started.mdx
 create mode 100644 docs/pages/machine-id/guides.mdx
 create mode 100644 docs/pages/machine-id/guides/ansible.mdx
 create mode 100644 docs/pages/machine-id/introduction.mdx
 create mode 100644 docs/pages/machine-id/reference.mdx
 create mode 100644 docs/pages/machine-id/reference/cli.mdx
 create mode 100644 docs/pages/machine-id/reference/configuration.mdx
 delete mode 100644 docs/pages/server-access/guides/ansible.mdx
 create mode 100644 docs/pages/setup/reference/predicate-language.mdx
 create mode 100644 examples/chart/CONTRIBUTING.md
 rename examples/chart/teleport-cluster/.lint/{service.yml => service.yaml} (100%)
 create mode 100644 examples/chart/teleport-cluster/.lint/webauthn.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/README.md
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/certificate_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/clusterrole_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/clusterrolebinding_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/config_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/pdb_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/psp_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/pvc_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/service_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/serviceaccount_test.yaml.snap
 create mode 100644 examples/chart/teleport-cluster/tests/certificate_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/clusterrole_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/clusterrolebinding_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/config_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/deployment_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/pdb_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/psp_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/pvc_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/service_test.yaml
 create mode 100644 examples/chart/teleport-cluster/tests/serviceaccount_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/.lint/existing-data-volume.yaml
 create mode 100644 examples/chart/teleport-kube-agent/.lint/extra-args.yaml
 create mode 100644 examples/chart/teleport-kube-agent/.lint/extra-env.yaml
 create mode 100644 examples/chart/teleport-kube-agent/.lint/image-pull-policy-stateful.yaml
 create mode 100644 examples/chart/teleport-kube-agent/.lint/image-pull-policy.yaml
 create mode 100644 examples/chart/teleport-kube-agent/.lint/service-account-name.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/README.md
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrole_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrolebinding_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/pdb_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/psp_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/secret_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/serviceaccount_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
 create mode 100644 examples/chart/teleport-kube-agent/tests/clusterrole_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/clusterrolebinding_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/config_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/deployment_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/pdb_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/psp_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/secret_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/serviceaccount_test.yaml
 create mode 100644 examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
 create mode 100644 examples/resources/plugins/teleport-jira-cloud.toml
 rename examples/resources/plugins/{teleport-jira.toml => teleport-jira-self-hosted.toml} (100%)
 create mode 100644 examples/resources/plugins/teleport-mattermost-cloud.toml
 rename examples/resources/plugins/{teleport-mattermost.toml => teleport-mattermost-self.toml} (100%)
 create mode 100644 examples/resources/plugins/teleport-pagerduty-cloud.toml
 rename examples/resources/plugins/{teleport-pagerduty.toml => teleport-pagerduty-self.toml} (100%)
 create mode 100644 examples/resources/terraform/terraform-user-role-cloud.tf
 rename examples/resources/terraform/{terraform-user-role.tf => terraform-user-role-self-hosted.tf} (93%)
 create mode 100644 lib/auth/webauthncli/api.go
 create mode 100644 lib/auth/webauthncli/export_fido2_test.go
 create mode 100644 lib/auth/webauthncli/fido2.go
 create mode 100644 lib/auth/webauthncli/fido2_common.go
 create mode 100644 lib/auth/webauthncli/fido2_other.go
 create mode 100644 lib/auth/webauthncli/fido2_test.go
 rename lib/auth/webauthncli/{login.go => u2f_login.go} (91%)
 rename lib/auth/webauthncli/{login_test.go => u2f_login_test.go} (98%)
 rename lib/auth/webauthncli/{register.go => u2f_register.go} (94%)
 rename lib/auth/webauthncli/{register_test.go => u2f_register_test.go} (92%)
 delete mode 100644 lib/backend/lite/litemem_test.go
 rename lib/client/{export_test.go => export.go} (100%)
 create mode 100644 lib/events/complete_test.go
 create mode 100644 lib/reversetunnel/localsite_test.go
 create mode 100644 lib/services/local/desktops_test.go
 create mode 100644 lib/srv/alpnproxy/auth/auth_proxy_test.go
 create mode 100644 lib/srv/app/aws/endpoints.go
 create mode 100644 lib/srv/app/aws/endpoints_test.go
 create mode 100644 lib/srv/db/redis/client.go
 create mode 100644 lib/srv/db/redis/protocol/resp2_test.go
 create mode 100644 lib/srv/termmanager_test.go
 create mode 100644 lib/utils/prompt/sync_reader.go
 create mode 100644 lib/utils/prompt/sync_reader_test.go
 create mode 100644 rfd/0056-sql-backend.md
 create mode 100644 rfd/0060-gRPC-backend.md
 create mode 100644 tool/tbot/botfs/botfs.go
 create mode 100644 tool/tbot/botfs/fs_linux.go
 create mode 100644 tool/tbot/botfs/fs_other.go
 create mode 100644 tool/tbot/identity/artifact.go
 create mode 100644 tool/tbot/identity/kinds.go
 create mode 100644 tool/tbot/init.go
 create mode 100644 tool/tbot/init_test.go
 create mode 100644 tool/tctl/common/desktop_command.go
 create mode 100644 tool/tctl/common/kube_command.go
 create mode 100644 tool/tsh/tshconfig.go

diff --git a/.cloudbuild/ci/integration-tests.yaml b/.cloudbuild/ci/integration-tests.yaml
index 8a64ecf50b964..61deb3012cf17 100644
--- a/.cloudbuild/ci/integration-tests.yaml
+++ b/.cloudbuild/ci/integration-tests.yaml
@@ -1,14 +1,14 @@
 timeout: 25m
 options:
   machineType: E2_HIGHCPU_32
+  
+  # This build needs to run in environments where the _GITHUB_DEPLOY_KEY_SRC
+  # substitution is defined, but also environments where it isn't. The
+  # ALLOW_LOOSE option disables GCBs strict checking of substitution usage,
+  # so that the build will still run if _GITHUB_DEPLOY_KEY_SRC is not defined.
+  substitution_option: ALLOW_LOOSE
 
 steps:
-  # GCB does a shallow checkout for a build, but if we want to check our changes
-  # against other branches we'll need to fetch the repo history.
-  - name: gcr.io/cloud-builders/git
-    id: fetch-history
-    args: ['fetch', '--unshallow']
-
   # Run the integration tests. Actual content of this job depends on the changes 
   # detected in the PR
   - name: quay.io/gravitational/teleport-buildbox:teleport10
@@ -18,9 +18,10 @@ steps:
     args: 
       - -c
       - |
-        go run ./cmd/integration-tests \
-          -target $_BASE_BRANCH        \
-          -bucket test-logs            \
-          -build $BUILD_ID             \
+        go run ./cmd/integration-tests          \
+          -target "$_BASE_BRANCH"               \
+          -bucket test-logs                     \
+          -build $BUILD_ID                      \
+          -key-secret "$_GITHUB_DEPLOY_KEY_SRC" \
           -a "test-logs/*.json"          
-    timeout: 20m
+    timeout: 25m
diff --git a/.cloudbuild/ci/unit-tests.yaml b/.cloudbuild/ci/unit-tests.yaml
index c673e9485150c..ae9935c10088f 100644
--- a/.cloudbuild/ci/unit-tests.yaml
+++ b/.cloudbuild/ci/unit-tests.yaml
@@ -3,14 +3,13 @@ timeout: 25m
 options:
   machineType: 'E2_HIGHCPU_32'
   
+  # This build needs to run in environments where the _GITHUB_DEPLOY_KEY_SRC  
+  # substitution is defined, but also environments where it isn't. The
+  # ALLOW_LOOSE option disables GCBs strict checking of substitution usage,
+  # so that the build will still run if _GITHUB_DEPLOY_KEY_SRC is not defined.
+  substitution_option: ALLOW_LOOSE
+  
 steps:
-  # GCB does a shallow checkout for a build, but if we want to check our changes
-  # against other branches we'll need to fetch the repo history. This takes less 
-  # than 30s at the time of writing, so it is probably not worth tweaking.
-  - name: gcr.io/cloud-builders/git
-    id: fetch-history
-    args: ['fetch', '--unshallow']
-
   # Run the unit tests. Actual content of this job depends on the changes 
   # detected in the PR
   - name: quay.io/gravitational/teleport-buildbox:teleport10
@@ -20,9 +19,10 @@ steps:
     args: 
       - -c
       - |
-        go run ./cmd/unit-tests \
-          -target $_BASE_BRANCH \
-          -bucket test-logs     \
-          -build $BUILD_ID      \
+        go run ./cmd/unit-tests                 \
+          -target $_BASE_BRANCH                 \
+          -bucket test-logs                     \
+          -build $BUILD_ID                      \
+          -key-secret "$_GITHUB_DEPLOY_KEY_SRC" \
           -a "test-logs/*.json"
-    timeout: 20m
+    timeout: 25m
diff --git a/.cloudbuild/scripts/cmd/integration-tests/args.go b/.cloudbuild/scripts/cmd/integration-tests/args.go
index aa29b10c71f91..2c98fab9c9077 100644
--- a/.cloudbuild/scripts/cmd/integration-tests/args.go
+++ b/.cloudbuild/scripts/cmd/integration-tests/args.go
@@ -33,6 +33,8 @@ type commandlineArgs struct {
 	buildID                string
 	artifactSearchPatterns customflag.StringArray
 	bucket                 string
+	githubKeySrc           string
+	skipUnshallow          bool
 }
 
 // validate ensures the suplied arguments are valid & internally consistent.
@@ -85,6 +87,8 @@ func parseCommandLine() (*commandlineArgs, error) {
 	flag.StringVar(&args.buildID, "build", "", "The build ID")
 	flag.StringVar(&args.bucket, "bucket", "", "The artifact storage bucket.")
 	flag.Var(&args.artifactSearchPatterns, "a", "Path to artifacts. May be shell-globbed, and have multiple entries.")
+	flag.StringVar(&args.githubKeySrc, "key-secret", "", "Location of github deploy token, as a Google Cloud Secret")
+	flag.BoolVar(&args.skipUnshallow, "skip-unshallow", false, "Skip unshallowing the repository.")
 
 	flag.Parse()
 
diff --git a/.cloudbuild/scripts/cmd/integration-tests/main.go b/.cloudbuild/scripts/cmd/integration-tests/main.go
index f6de022e00fcc..3f64c8fee7a58 100644
--- a/.cloudbuild/scripts/cmd/integration-tests/main.go
+++ b/.cloudbuild/scripts/cmd/integration-tests/main.go
@@ -29,6 +29,8 @@ import (
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/artifacts"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/changes"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/etcd"
+	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/git"
+	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/secrets"
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 )
@@ -55,6 +57,26 @@ func innerMain() error {
 		return trace.Wrap(err)
 	}
 
+	// If a github deploy key location was supplied...
+	var deployKey []byte
+	if args.githubKeySrc != "" {
+		// fetch the deployment key from the GCB secret manager
+		log.Infof("Fetching deploy key from %s", args.githubKeySrc)
+		deployKey, err = secrets.Fetch(context.Background(), args.githubKeySrc)
+		if err != nil {
+			return trace.Wrap(err, "failed fetching deploy key")
+		}
+	}
+
+	if !args.skipUnshallow {
+		unshallowCtx, unshallowCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		defer unshallowCancel()
+		err = git.UnshallowRepository(unshallowCtx, args.workspace, deployKey)
+		if err != nil {
+			return trace.Wrap(err, "unshallow failed")
+		}
+	}
+
 	moduleCacheDir := filepath.Join(os.TempDir(), gomodcacheDir)
 	gomodcache := fmt.Sprintf("GOMODCACHE=%s", moduleCacheDir)
 
@@ -70,9 +92,6 @@ func innerMain() error {
 		return nil
 	}
 
-	cancelCtx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
 	// From this point on, whatever happens we want to upload any artifacts
 	// produced by the build
 	defer func() {
@@ -114,10 +133,13 @@ func innerMain() error {
 	// diagnostic warnings that would pollute the build log and just confuse
 	// people when they are trying to work out why their build failed.
 	log.Printf("Starting etcd...")
-	err = etcd.Start(cancelCtx, args.workspace, nonrootUID, nonrootGID, gomodcache)
+	timeoutCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	etcdSvc, err := etcd.Start(timeoutCtx, args.workspace)
 	if err != nil {
 		return trace.Wrap(err, "failed starting etcd")
 	}
+	defer etcdSvc.Stop()
 
 	log.Printf("Running nonroot integration tests...")
 	err = runNonrootIntegrationTests(args.workspace, nonrootUID, nonrootGID, gomodcache)
diff --git a/.cloudbuild/scripts/cmd/unit-tests/main.go b/.cloudbuild/scripts/cmd/unit-tests/main.go
index 8b374c726d772..3f8e52ef551ad 100644
--- a/.cloudbuild/scripts/cmd/unit-tests/main.go
+++ b/.cloudbuild/scripts/cmd/unit-tests/main.go
@@ -29,6 +29,8 @@ import (
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/changes"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/customflag"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/etcd"
+	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/git"
+	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/secrets"
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 )
@@ -48,6 +50,8 @@ type commandlineArgs struct {
 	buildID                string
 	artifactSearchPatterns customflag.StringArray
 	bucket                 string
+	githubKeySrc           string
+	skipUnshallow          bool
 }
 
 // NOTE: changing the interface to this build script may require follow-up
@@ -61,6 +65,8 @@ func parseCommandLine() (commandlineArgs, error) {
 	flag.StringVar(&args.buildID, "build", "", "The build ID")
 	flag.StringVar(&args.bucket, "bucket", "", "The artifact storage bucket.")
 	flag.Var(&args.artifactSearchPatterns, "a", "Path to artifacts. May be globbed, and have multiple entries.")
+	flag.StringVar(&args.githubKeySrc, "key-secret", "", "Location of github deploy token, as a Google Cloud Secret")
+	flag.BoolVar(&args.skipUnshallow, "skip-unshallow", false, "Skip unshallowing the repository.")
 
 	flag.Parse()
 
@@ -108,6 +114,26 @@ func run() error {
 		return trace.Wrap(err)
 	}
 
+	// If a github deploy key location was supplied...
+	var deployKey []byte
+	if args.githubKeySrc != "" {
+		// fetch the deployment key from the GCB secret manager
+		log.Infof("Fetching deploy key from %s", args.githubKeySrc)
+		deployKey, err = secrets.Fetch(context.Background(), args.githubKeySrc)
+		if err != nil {
+			return trace.Wrap(err, "failed fetching deploy key")
+		}
+	}
+
+	if !args.skipUnshallow {
+		unshallowCtx, unshallowCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		defer unshallowCancel()
+		err = git.UnshallowRepository(unshallowCtx, args.workspace, deployKey)
+		if err != nil {
+			return trace.Wrap(err, "unshallow failed")
+		}
+	}
+
 	log.Println("Analysing code changes")
 	ch, err := changes.Analyze(args.workspace, args.targetBranch, args.commitSHA)
 	if err != nil {
@@ -121,11 +147,13 @@ func run() error {
 	}
 
 	log.Printf("Starting etcd...")
-	cancelCtx, cancel := context.WithCancel(context.Background())
+	timeoutCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
-	if err := etcd.Start(cancelCtx, args.workspace, 0, 0); err != nil {
+	etcdSvc, err := etcd.Start(timeoutCtx, args.workspace)
+	if err != nil {
 		return trace.Wrap(err, "failed starting etcd")
 	}
+	defer etcdSvc.Stop()
 
 	// From this point on, whatever happens we want to upload any artifacts
 	// produced by the build
diff --git a/.cloudbuild/scripts/go.mod b/.cloudbuild/scripts/go.mod
index 300c5bb2c445a..49cf54361d31c 100644
--- a/.cloudbuild/scripts/go.mod
+++ b/.cloudbuild/scripts/go.mod
@@ -3,11 +3,15 @@ module github.com/gravitational/teleport/.cloudbuild/scripts
 go 1.17
 
 require (
+	cloud.google.com/go/secretmanager v1.2.0
 	cloud.google.com/go/storage v1.19.0
 	github.com/go-git/go-git/v5 v5.4.2
 	github.com/gravitational/trace v1.1.15
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/sirupsen/logrus v1.8.1
+	github.com/stretchr/testify v1.7.0
+	golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b
+	google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c
 )
 
 require (
@@ -33,21 +37,18 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/sergi/go-diff v1.1.0 // indirect
-	github.com/stretchr/objx v0.1.1 // indirect
-	github.com/stretchr/testify v1.7.0 // indirect
+	github.com/stretchr/objx v0.2.0 // indirect
 	github.com/xanzy/ssh-agent v0.3.0 // indirect
 	go.opencensus.io v0.23.0 // indirect
-	golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b // indirect
 	golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420 // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
-	golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e // indirect
+	golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 // indirect
 	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 // indirect
 	golang.org/x/text v0.3.6 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/api v0.65.0 // indirect
+	google.golang.org/api v0.67.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220118154757-00ab72f36ad5 // indirect
-	google.golang.org/grpc v1.40.1 // indirect
+	google.golang.org/grpc v1.44.0 // indirect
 	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
diff --git a/.cloudbuild/scripts/go.sum b/.cloudbuild/scripts/go.sum
index a9f64ef4f6699..d2b25fdba3cd4 100644
--- a/.cloudbuild/scripts/go.sum
+++ b/.cloudbuild/scripts/go.sum
@@ -39,12 +39,15 @@ cloud.google.com/go/compute v0.1.0 h1:rSUBvAyVwNJ5uQCKNJFMwPtTvJkfN38b6Pvb9zZoqJ
 cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c=
 cloud.google.com/go/iam v0.1.1 h1:4CapQyNFjiksks1/x7jsvsygFPhihslYk5GptIrlX68=
 cloud.google.com/go/iam v0.1.1/go.mod h1:CKqrcnI/suGpybEHxZ7BMehL0oA4LpdyJdUlTl9jVMw=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/secretmanager v1.2.0 h1:VR6MzO4wjTj5jQKTPpsZhCF2PqqdAAZmN54BwJbQPhs=
+cloud.google.com/go/secretmanager v1.2.0/go.mod h1:HNMYTaLrMrAN37vi2mM2vvFgjgaoCE1qvtccCIJwFRc=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
@@ -70,6 +73,7 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -77,7 +81,11 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -91,6 +99,7 @@ github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5y
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
+github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -235,9 +244,11 @@ github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1 h1:2vfRuCMp5sSVIDSqO8oNnWJq7mPa6KVP3iPIwFBuy8A=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -420,8 +431,9 @@ golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e h1:fLOSk5Q00efkSvAm+4xcoXD+RRmLmmulPn5I3Y9F2EM=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 h1:XDXtA5hveEEV8JB2l7nhMTp3t3cHp9ZpwcdjqyEWLlo=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -524,8 +536,9 @@ google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdr
 google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
 google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
 google.golang.org/api v0.64.0/go.mod h1:931CdxA8Rm4t6zqTFGSsgwbAEZ2+GMYurbndwSimebM=
-google.golang.org/api v0.65.0 h1:MTW9c+LIBAbwoS1Gb+YV7NjFBt2f7GtAS5hIzh2NjgQ=
 google.golang.org/api v0.65.0/go.mod h1:ArYhxgGadlWmqO1IqVujw6Cs8IdD33bTmzKo2Sh+cbg=
+google.golang.org/api v0.67.0 h1:lYaaLa+x3VVUhtosaK9xihwQ9H9KRa557REHwwZ2orM=
+google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -597,8 +610,11 @@ google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211223182754-3ac035c7e7cb/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220111164026-67b88f271998/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220118154757-00ab72f36ad5 h1:zzNejm+EgrbLfDZ6lu9Uud2IVvHySPl8vQzf04laR5Q=
 google.golang.org/genproto v0.0.0-20220118154757-00ab72f36ad5/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c h1:TU4rFa5APdKTq0s6B7WTsH6Xmx0Knj86s6Biz56mErE=
+google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -624,8 +640,9 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.40.1 h1:pnP7OclFFFgFi4VHQDQDaoXUVauOFyktqTsqqgzFKbc=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.44.0 h1:weqSxi/TMs1SqFRMHCtBgXRs8k3X39QIDEZ0pRcttUg=
+google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
diff --git a/.cloudbuild/scripts/internal/artifacts/artifacts_test.go b/.cloudbuild/scripts/internal/artifacts/artifacts_test.go
index eba6ca9b64c83..e5336608d7f11 100644
--- a/.cloudbuild/scripts/internal/artifacts/artifacts_test.go
+++ b/.cloudbuild/scripts/internal/artifacts/artifacts_test.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"errors"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -35,7 +34,7 @@ func write(t *testing.T, data []byte, path ...string) string {
 	t.Helper()
 	filePath := filepath.Join(path...)
 	require.NoError(t, os.MkdirAll(filepath.Dir(filePath), 0777))
-	require.NoError(t, ioutil.WriteFile(filePath, data, 0644))
+	require.NoError(t, os.WriteFile(filePath, data, 0644))
 	return filePath
 }
 
diff --git a/.cloudbuild/scripts/internal/etcd/start.go b/.cloudbuild/scripts/internal/etcd/start.go
index 932d368881c0c..fe4993228e047 100644
--- a/.cloudbuild/scripts/internal/etcd/start.go
+++ b/.cloudbuild/scripts/internal/etcd/start.go
@@ -17,59 +17,208 @@ limitations under the License.
 package etcd
 
 import (
+	"bytes"
 	"context"
-	"net"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"io"
+	"net/http"
 	"os"
 	"os/exec"
-	"syscall"
+	"path"
 	"time"
 
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 )
 
-// Start starts the etcd server using the Makefile `run-etcd` task and waits for it to start.
-func Start(ctx context.Context, workspace string, uid, gid int, env ...string) error {
-	cmd := exec.CommandContext(ctx, "make", "run-etcd")
-	cmd.Dir = workspace
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
+const (
+	metricsURL = "https://127.0.0.1:3379"
+)
+
+type Instance struct {
+	process *exec.Cmd
+	dataDir string
+	kill    context.CancelFunc
+	stdout  bytes.Buffer
+	stderr  bytes.Buffer
+}
+
+func (etcd *Instance) Stop() {
+	log.Printf("Killing etcd process")
+	etcd.kill()
+
+	log.Printf("Waiting for etcd process to exit...")
+	switch err := etcd.process.Wait().(type) {
+	case nil:
+		break
+
+	case *exec.ExitError:
+		// we expect a return code of -1 because we've just killed the process
+		// above. If we get something else then etcd failed earlier for some
+		// reason and we should print diagnostic output
+		if err.ExitCode() != -1 {
+			log.Printf("Etcd exited with unexpected status %d", err.ExitCode())
+			log.Printf("stderr:\n%s", etcd.stderr.String())
+		}
+
+	default:
+		log.Printf("Failed: %s", err)
+	}
+
+	log.Printf("Removing data dir")
+	if err := os.RemoveAll(etcd.dataDir); err != nil {
+		log.Printf("Failed removing data dir: %s", err)
+	}
+}
+
+// Start starts the etcd server using the keys extpected by the
+// integration and unit tests
+func Start(ctx context.Context, workspace string, env ...string) (*Instance, error) {
+	etcdBinary, err := exec.LookPath("etcd")
+	if err != nil {
+		return nil, trace.Wrap(err, "can't find etcd binary")
+	}
+
+	dataDir, err := os.MkdirTemp(os.TempDir(), "teleport-etcd-*")
+	if err != nil {
+		return nil, trace.Wrap(err, "can't create temp dir")
+	}
+
+	certsDir := path.Join(workspace, "examples", "etcd", "certs")
+
+	etcdInstance := &Instance{}
+	var processCtx context.Context
+	processCtx, etcdInstance.kill = context.WithCancel(context.Background())
+
+	etcdInstance.process = exec.CommandContext(processCtx, etcdBinary,
+		"--name", "teleportstorage",
+		"--data-dir", dataDir,
+		"--initial-cluster-state", "new",
+		"--cert-file", path.Join(certsDir, "server-cert.pem"),
+		"--key-file", path.Join(certsDir, "server-key.pem"),
+		"--trusted-ca-file", path.Join(certsDir, "ca-cert.pem"),
+		"--advertise-client-urls=https://127.0.0.1:2379",
+		"--listen-client-urls=https://127.0.0.1:2379",
+		"--listen-metrics-urls", metricsURL,
+		"--client-cert-auth",
+	)
+	etcdInstance.process.Dir = workspace
+	etcdInstance.process.Stdout = &etcdInstance.stdout
+	etcdInstance.process.Stderr = &etcdInstance.stderr
 
 	if len(env) > 0 {
-		cmd.Env = append(os.Environ(), env...)
+		etcdInstance.process.Env = append(os.Environ(), env...)
+	}
+
+	log.Printf("Launching etcd (%s)", etcdInstance.process.Path)
+	if err = etcdInstance.process.Start(); err != nil {
+		return nil, trace.Wrap(err, "failed starting etcd")
 	}
 
-	// make etcd run under the supplied account
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		Credential: &syscall.Credential{
-			Uid: uint32(uid),
-			Gid: uint32(gid),
-		},
+	timeoutCtx, cancelTimeout := context.WithTimeout(ctx, 5*time.Second)
+	defer cancelTimeout()
+
+	if err := waitForEtcdToStart(timeoutCtx, certsDir); err != nil {
+		log.Printf("Etcd failed to come up. Tidying up.")
+		etcdInstance.Stop()
+		return nil, trace.Wrap(err, "failed while waiting for etcd to start")
 	}
 
-	log.Printf("Launching etcd with %v in %q", cmd.Args, cmd.Dir)
-	go cmd.Run()
+	return etcdInstance, nil
+}
 
-	log.Printf("Waiting for etcd to start...")
+// waitForEtcdToStart polls an etcd server (as started with Start()) until either
+// a) the etcd service reports itself as healthy, or
+// b) the supplied context expires
+func waitForEtcdToStart(ctx context.Context, certDir string) error {
+	log.Printf("Waiting for etcd to come up...")
 
 	ticker := time.NewTicker(100 * time.Millisecond)
 	defer ticker.Stop()
 
-	timeoutCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
-	defer cancel()
+	client, err := newHTTPSTransport(certDir)
+	if err != nil {
+		return trace.Wrap(err, "failed to create https client")
+	}
 
 	for {
 		select {
 		case <-ticker.C:
-			d := net.Dialer{Timeout: 100 * time.Millisecond}
-			_, err := d.Dial("tcp", "127.0.0.1:2379")
-			if err == nil {
-				log.Printf("Etcd is up")
+			healthy, err := pollForHealth(ctx, client, metricsURL+"/health")
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			if healthy {
+				log.Printf("Etcd reporting healthy")
 				return nil
 			}
 
-		case <-timeoutCtx.Done():
+		case <-ctx.Done():
 			return trace.Errorf("timed out waiting for etcd to start")
 		}
 	}
 }
+
+// newHTTPSTransport creates an HTTP client configured to use TLS with an etcd server
+// as started with Start()
+func newHTTPSTransport(certDir string) (*http.Client, error) {
+	caCertPath := path.Join(certDir, "ca-cert.pem")
+	caCert, err := os.ReadFile(caCertPath)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed reading CA cert from %s", caCertPath)
+	}
+
+	clientCert, err := tls.LoadX509KeyPair(
+		path.Join(certDir, "client-cert.pem"), path.Join(certDir, "client-key.pem"))
+	if err != nil {
+		return nil, trace.Wrap(err, "failed reading client cert")
+	}
+
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.TLSClientConfig.RootCAs = x509.NewCertPool()
+	if !transport.TLSClientConfig.RootCAs.AppendCertsFromPEM(caCert) {
+		return nil, trace.Errorf("Failed adding CA cert")
+	}
+	transport.TLSClientConfig.Certificates = []tls.Certificate{clientCert}
+
+	return &http.Client{Transport: transport}, nil
+}
+
+// pollForHealth polls the etcd metrecs endpoint for status information, returning
+// true if the service reports itself as healthy
+func pollForHealth(ctx context.Context, client *http.Client, url string) (bool, error) {
+	type health struct {
+		Health string `json:"health"`
+		Reason string `json:"reason"`
+	}
+
+	timeoutCtx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
+	defer cancel()
+
+	request, err := http.NewRequestWithContext(timeoutCtx, http.MethodGet, url, nil)
+	if err != nil {
+		return false, trace.Wrap(err, "Failed constructing poll request")
+	}
+
+	// A request failure is considered "not healthy" rather than an error, as
+	// the etcd server may just not be up yet.
+	response, err := client.Do(request)
+	if err != nil {
+		return false, nil
+	}
+	defer response.Body.Close()
+
+	body, err := io.ReadAll(response.Body)
+	if err != nil {
+		return false, trace.Wrap(err, "failed reading poll response body")
+	}
+
+	status := health{}
+	if err = json.Unmarshal(body, &status); err != nil {
+		return false, trace.Wrap(err, "failed parsing poll response")
+	}
+
+	return status.Health == "true", nil
+}
diff --git a/.cloudbuild/scripts/internal/git/configure.go b/.cloudbuild/scripts/internal/git/configure.go
new file mode 100644
index 0000000000000..63d2fdb54e9b2
--- /dev/null
+++ b/.cloudbuild/scripts/internal/git/configure.go
@@ -0,0 +1,145 @@
+package git
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+
+	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/github"
+	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+)
+
+// Config represents a git repository that has been configured to use a
+// deployment key, and acts as a handle to the resources so that we can
+// clean them up when we're done.
+type Config struct {
+	identity   string
+	knownHosts string
+	repoDir    string
+}
+
+// Configure alters the configuration of the git repository in `repoDir`
+// so that we can access it from build. If `deployKey` is non-nil the repo
+// will be configured to use that. If no deploy key is supplied, the repository
+// config is untouched.
+func Configure(ctx context.Context, repoDir string, deployKey []byte) (cfg *Config, err error) {
+	var identity string
+	var hostsFile string
+
+	// The deploy key we're using is too sensitive to just hope that every
+	// exit path will clean it up on failure, so let's just register a
+	// cleanup function now just in case.
+	defer func() {
+		if err != nil {
+			cleanup(identity, hostsFile)
+		}
+	}()
+
+	// If we have been supplied with deployment key, then we need to use that
+	// to access the repository. This implies that need to use ssh to read from
+	// the remote, so we will have to deal with known_hosts, etc.
+	if deployKey != nil {
+		githubHostKeys, err := getGithubHostKeys(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed configuring known hosts")
+		}
+
+		// configure SSH known_hosts for github.com
+		hostsFile, err = configureKnownHosts("github.com", githubHostKeys)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed configuring known hosts")
+		}
+
+		// GCB clones via https, and our deploy key won't work with that, so
+		// force git to access the remote over ssh with a rewrite rule
+		log.Info("Adding remote url rewrite rule")
+		err = git(ctx, repoDir, "config", `url.git@github.com:.insteadOf`, "https://github.com/")
+		if err != nil {
+			return nil, trace.Wrap(err, "failed configuring url rewrite rule")
+		}
+
+		// set up the identity for the deploy key
+		identity, err = writeKey(deployKey)
+		if err != nil {
+			return nil, trace.Wrap(err, "failed configuring SSH identity")
+		}
+
+		// finally, force git to
+		//   a) use our custom SSH setup when accessing the remote, and
+		//   b) fail if the github host tries to present a host key other than
+		//      one we got from the metadata service
+		log.Infof("Configuring git ssh command")
+		err = git(ctx, repoDir, "config", "core.sshCommand",
+			fmt.Sprintf("ssh -i %s -o StrictHostKeyChecking=yes -o UserKnownHostsFile=%s", identity, hostsFile))
+		if err != nil {
+			return nil, trace.Wrap(err, "failed configuring git to use deploy key")
+		}
+	}
+
+	return &Config{identity: identity, repoDir: repoDir, knownHosts: hostsFile}, nil
+}
+
+// Do runs `git args...` in the configured repository
+func (cfg *Config) Do(ctx context.Context, args ...string) error {
+	return git(ctx, cfg.repoDir, args...)
+}
+
+// Close cleans up the repository, including deleting the deployment key (if any)
+func (cfg *Config) Close() error {
+	cleanup(cfg.identity, cfg.knownHosts)
+	return nil
+}
+
+func run(ctx context.Context, workingDir string, env []string, cmd string, args ...string) error {
+	p := exec.CommandContext(ctx, cmd, args...)
+	if len(env) != 0 {
+		p.Env = append(os.Environ(), env...)
+	}
+	p.Dir = workingDir
+
+	cmdLogger := log.WithField("cmd", cmd)
+	p.Stdout = cmdLogger.WriterLevel(log.InfoLevel)
+	p.Stderr = cmdLogger.WriterLevel(log.ErrorLevel)
+	return p.Run()
+}
+
+func git(ctx context.Context, repoDir string, args ...string) error {
+	return run(ctx, repoDir, nil, "/usr/bin/git", args...)
+}
+
+func cleanup(deployKey, knownHosts string) {
+	if knownHosts != "" {
+		log.Infof("Removing known_hosts file %s", knownHosts)
+		if err := os.Remove(knownHosts); err != nil {
+			log.WithError(err).Error("Failed cleaning up known_hosts key")
+		}
+	}
+
+	if deployKey != "" {
+		log.Infof("Removing deploy key file %s", deployKey)
+		if err := os.Remove(deployKey); err != nil {
+			log.WithError(err).Error("Failed cleaning up deploy key")
+		}
+	}
+}
+
+// getGithubHostKeys fetches the github host keys from the github metadata
+// service. The metadata is fetched over HTTPS, and so we have built-on
+// protection against MitM attacks while fetching the expected host keys.
+func getGithubHostKeys(ctx context.Context) ([]ssh.PublicKey, error) {
+	metadata, err := github.GetMetadata(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed fetching github metadata")
+	}
+
+	// extract the host keys
+	githubHostKeys, err := metadata.HostKeys()
+	if err != nil {
+		return nil, trace.Wrap(err, "failed fetching github hostKeys")
+	}
+
+	return githubHostKeys, nil
+}
diff --git a/.cloudbuild/scripts/internal/git/deploykey.go b/.cloudbuild/scripts/internal/git/deploykey.go
new file mode 100644
index 0000000000000..fc57eb2798ef7
--- /dev/null
+++ b/.cloudbuild/scripts/internal/git/deploykey.go
@@ -0,0 +1,34 @@
+package git
+
+import (
+	"os"
+
+	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
+)
+
+func writeKey(deployKey []byte) (string, error) {
+	// Note that tempfiles are automatically created with 0600, so no-one else
+	// should be able to read this.
+	keyFile, err := os.CreateTemp("", "*")
+	if err != nil {
+		return "", trace.Wrap(err, "failed creating keyfile")
+	}
+	defer keyFile.Close()
+
+	log.Infof("Writing deploy key to %s", keyFile.Name())
+	_, err = keyFile.Write(deployKey)
+	if err != nil {
+		return "", trace.Wrap(err, "failed writing deploy key")
+	}
+
+	// ensure there is a trailing newline in the key, as older versions of the
+	// `ssh` client will barf on a key that doesn't have one, but will happily
+	// allow multiples
+	_, err = keyFile.WriteString("\n")
+	if err != nil {
+		return "", trace.Wrap(err, "failed formatting key")
+	}
+
+	return keyFile.Name(), nil
+}
diff --git a/.cloudbuild/scripts/internal/git/knownhosts.go b/.cloudbuild/scripts/internal/git/knownhosts.go
new file mode 100644
index 0000000000000..66096bb07f2d7
--- /dev/null
+++ b/.cloudbuild/scripts/internal/git/knownhosts.go
@@ -0,0 +1,33 @@
+package git
+
+import (
+	"os"
+
+	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/knownhosts"
+)
+
+func configureKnownHosts(hostname string, keys []ssh.PublicKey) (string, error) {
+	knownHostsFile, err := os.CreateTemp("", "*")
+	if err != nil {
+		return "", trace.Wrap(err, "failed creating known hosts file")
+	}
+	defer knownHostsFile.Close()
+
+	log.Infof("Writing known_hosts file to %s", knownHostsFile.Name())
+
+	addrs := []string{hostname}
+	for _, k := range keys {
+		log.Infof("processing key %s...", k.Type())
+		_, err := knownHostsFile.WriteString(knownhosts.Line(addrs, k) + "\n")
+		if err != nil {
+			knownHostsFile.Close()
+			os.Remove(knownHostsFile.Name())
+			return "", trace.Wrap(err, "failed writing known hosts")
+		}
+	}
+
+	return knownHostsFile.Name(), nil
+}
diff --git a/.cloudbuild/scripts/internal/git/unshallow.go b/.cloudbuild/scripts/internal/git/unshallow.go
new file mode 100644
index 0000000000000..af3387359840f
--- /dev/null
+++ b/.cloudbuild/scripts/internal/git/unshallow.go
@@ -0,0 +1,25 @@
+package git
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
+)
+
+func UnshallowRepository(ctx context.Context, workspace string, deployKey []byte) error {
+	log.Info("Configuring git")
+	gitCfg, err := Configure(ctx, workspace, deployKey)
+	if err != nil {
+		return trace.Wrap(err, "failed configuring git")
+	}
+	defer gitCfg.Close()
+
+	log.Info("Unshallowing repository")
+	err = gitCfg.Do(ctx, "fetch", "--unshallow")
+	if err != nil {
+		return trace.Wrap(err, "unshallow failed")
+	}
+
+	return nil
+}
diff --git a/.cloudbuild/scripts/internal/github/meta.go b/.cloudbuild/scripts/internal/github/meta.go
new file mode 100644
index 0000000000000..a8096a013dae2
--- /dev/null
+++ b/.cloudbuild/scripts/internal/github/meta.go
@@ -0,0 +1,58 @@
+package github
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/gravitational/trace"
+	"golang.org/x/crypto/ssh"
+)
+
+const (
+	metadataURL = "https://api.github.com/meta"
+)
+
+// Metadata contains information about the github networking environment,
+// enclosing host keys for git/ssh access
+type Metadata struct {
+	SSHKeyFingerPrints map[string]string `json:"ssh_key_fingerprints"`
+	SSHKeys            []string          `json:"ssh_keys"`
+}
+
+func GetMetadata(ctx context.Context) (*Metadata, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, metadataURL, nil)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed creating metadata request")
+	}
+
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed issuing metadata request")
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode != http.StatusOK {
+		return nil, trace.Errorf("Metadata request failed %d", response.StatusCode)
+	}
+
+	var meta Metadata
+	err = json.NewDecoder(response.Body).Decode(&meta)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed parsing metadata")
+	}
+
+	return &meta, nil
+}
+
+func (meta *Metadata) HostKeys() ([]ssh.PublicKey, error) {
+	keys := make([]ssh.PublicKey, 0, len(meta.SSHKeys))
+	for _, text := range meta.SSHKeys {
+		key, _, _, _, err := ssh.ParseAuthorizedKey([]byte(text))
+		if err != nil {
+			return nil, trace.Wrap(err, "failed parsing host key")
+		}
+		keys = append(keys, key)
+	}
+	return keys, nil
+}
diff --git a/.cloudbuild/scripts/internal/secrets/fetch.go b/.cloudbuild/scripts/internal/secrets/fetch.go
new file mode 100644
index 0000000000000..38cbc1889d280
--- /dev/null
+++ b/.cloudbuild/scripts/internal/secrets/fetch.go
@@ -0,0 +1,41 @@
+package secrets
+
+import (
+	"context"
+
+	secretmanager "cloud.google.com/go/secretmanager/apiv1"
+	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
+	secretmanagerpb "google.golang.org/genproto/googleapis/cloud/secretmanager/v1"
+)
+
+// Fetch goes and grabs a single secret from the Google Cloud secret manager
+func Fetch(ctx context.Context, resourceName string) ([]byte, error) {
+	c, err := secretmanager.NewClient(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err, "failed creating SecretManager client")
+	}
+	defer c.Close()
+
+	log.Debugf("Fetching secret %s", resourceName)
+	secret, err := c.AccessSecretVersion(ctx, &secretmanagerpb.AccessSecretVersionRequest{
+		Name: resourceName,
+	})
+
+	if err != nil {
+		return nil, trace.Wrap(err, "failed fetching secret token")
+	}
+
+	return secret.Payload.Data, nil
+}
+
+// FetchString fetches a single secret from the Google Cloud secret manager and returns
+// it as a string.
+func FetchString(ctx context.Context, resourceName string) (string, error) {
+	data, err := Fetch(ctx, resourceName)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	return string(data), nil
+}
diff --git a/.drone.yml b/.drone.yml
index 631e422378c4a..73fd7d9337bf7 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,4 +1,32 @@
 ---
+kind: pipeline
+type: kubernetes
+name: update-docs-webhook
+
+trigger:
+  event:
+    include:
+      - push
+    exclude:
+      - pull_request
+  branch:
+    include:
+      - master
+      - branch/*
+  repo:
+    include:
+      - gravitational/teleport
+
+clone:
+  disable: true
+
+steps:
+  - name: Trigger docs deployment
+    image: plugins/webhook
+    settings:
+      urls:
+        from_secret: DOCS_DEPLOY_HOOK
+---
 ################################################
 # Generated using dronegen, do not edit by hand!
 # Use 'make dronegen' to update.
@@ -787,19 +815,19 @@ steps:
       # increment these variables when a new major/minor version is released to bump the automatic builds
       # this only needs to be done on the master branch, as that's the branch that the Drone cron is configured for
       # build major version images which are just teleport:x
-      CURRENT_VERSION_ROOT: v8
-      PREVIOUS_VERSION_ONE_ROOT: v7
-      PREVIOUS_VERSION_TWO_ROOT: v6
+      CURRENT_VERSION_ROOT: v9
+      PREVIOUS_VERSION_ONE_ROOT: v8
+      PREVIOUS_VERSION_TWO_ROOT: v7
     commands:
       - apk --update --no-cache add curl go
       - mkdir -p /go/build && cd /go/build
-      # CURRENT_VERSION (8)
+      # CURRENT_VERSION (9)
       - (cd /go/build.assets/tooling && go run ./cmd/query-latest $CURRENT_VERSION_ROOT > /go/build/CURRENT_VERSION_TAG.txt)
       - echo "$(cat /go/build/CURRENT_VERSION_TAG.txt | cut -d. -f1 | tr -d '^v')" > /go/build/CURRENT_VERSION_TAG_GENERIC.txt
-      # PREVIOUS_VERSION_ONE (7)
+      # PREVIOUS_VERSION_ONE (8)
       - (cd /go/build.assets/tooling && go run ./cmd/query-latest $PREVIOUS_VERSION_ONE_ROOT > /go/build/PREVIOUS_VERSION_ONE_TAG.txt)
       - echo "$(cat /go/build/PREVIOUS_VERSION_ONE_TAG.txt | cut -d. -f1 | tr -d '^v')" > /go/build/PREVIOUS_VERSION_ONE_TAG_GENERIC.txt
-      # PREVIOUS_VERSION_TWO (6)
+      # PREVIOUS_VERSION_TWO (7)
       - (cd /go/build.assets/tooling && go run ./cmd/query-latest $PREVIOUS_VERSION_TWO_ROOT > /go/build/PREVIOUS_VERSION_TWO_TAG.txt)
       - echo "$(cat /go/build/PREVIOUS_VERSION_TWO_TAG.txt | cut -d. -f1 | tr -d '^v')" > /go/build/PREVIOUS_VERSION_TWO_TAG_GENERIC.txt
       # list versions
@@ -3124,9 +3152,9 @@ steps:
     ARCH: amd64
     BUILDBOX_PASSWORD:
       from_secret: BUILDBOX_PASSWORD
-    ENT_TARBALL_PATH: /tmp/build-darwin-amd64-pkg/go/artifacts
+    ENT_TARBALL_PATH: /tmp/build-darwin-amd64-pkg-tsh/go/artifacts
     OS: darwin
-    OSS_TARBALL_PATH: /tmp/build-darwin-amd64-pkg/go/artifacts
+    OSS_TARBALL_PATH: /tmp/build-darwin-amd64-pkg-tsh/go/artifacts
     WORKSPACE_DIR: /tmp/build-darwin-amd64-pkg-tsh
 - name: Copy Mac pkg artifacts
   commands:
@@ -5056,6 +5084,6 @@ volumes:
       name: drone-s3-debrepo-pvc
 ---
 kind: signature
-hmac: 91c43e2655c4225898f8ba6fc034a0b5ee3de067d2f58979a474fcba342db799
+hmac: 8d0b79ebd4a3a0432402abf3b2773f45f8d787c0114d921dcdb5c909f2c338db
 
 ...
diff --git a/.github/ISSUE_TEMPLATE/testplan.md b/.github/ISSUE_TEMPLATE/testplan.md
index e394322075ce1..633930f8ecc65 100644
--- a/.github/ISSUE_TEMPLATE/testplan.md
+++ b/.github/ISSUE_TEMPLATE/testplan.md
@@ -139,6 +139,11 @@ With every user combination, try to login and signup with invalid second factor,
   - [ ] ssh -L \<regular-node\>
   - [ ] ssh -L \<node-remote-cluster\>
 
+- [ ] Verify proxy jump functionality
+  Log into leaf cluster via root, shut down the root proxy and verify proxy jump works.
+  - [ ] tsh ssh -J \<leaf-proxy\>
+  - [ ] ssh -J \<leaf-proxy\>
+
 - [ ] Interact with a cluster using the Web UI
   - [ ] Connect to a Teleport node
   - [ ] Connect to a OpenSSH node
@@ -276,6 +281,15 @@ tsh --proxy=proxy.example.com --user=<username> --insecure ssh --cluster=foo.com
 - [ ] Test receiving a message via Teleport Slackbot
 - [ ] Test receiving a new Jira Ticket via Teleport Jira
 
+### AWS Node Joining
+[Docs](https://goteleport.com/docs/setup/guides/joining-nodes-aws/)
+- [ ] On EC2 instance with `ec2:DescribeInstances` permissions for local account:
+  `TELEPORT_TEST_EC2=1 go test ./integration -run TestEC2NodeJoin`
+- [ ] On EC2 instance with any attached role:
+  `TELEPORT_TEST_EC2=1 go test ./integration -run TestIAMNodeJoin`
+- [ ] EC2 Join method in IoT mode with node and auth in different AWS accounts
+- [ ] IAM Join method in IoT mode with node and auth in different AWS accounts
+
 ## WEB UI
 
 ## Main
@@ -938,6 +952,10 @@ and non interactive tsh bench loads.
   - [ ] Verify async recording (`mode: node` or `mode: proxy`)
   - [ ] Sessions show up in session recordings UI with desktop icon
   - [ ] Sessions can be played back, including play/pause functionality
+  - [ ] A session that ends with a TDP error message can be played back, ends by displaying the error message,
+        and the progress bar progresses to the end.
+  - [ ] Attempting to play back a session that doesn't exist (i.e. by entering a non-existing session id in the url) shows
+        a relevant error message.
   - [ ] RBAC for sessions: ensure users can only see their own recordings when
     using the RBAC rule from our
     [docs](../../docs/pages/access-controls/reference.mdx#rbac-for-sessions)
@@ -961,4 +979,4 @@ and non interactive tsh bench loads.
   - [ ] Debian 9
 - Verify tsh runs on:
   - [ ] Windows 10
-  - [ ] MacOS
\ No newline at end of file
+  - [ ] MacOS
diff --git a/.github/workflows/robot/internal/bot/assign.go b/.github/workflows/robot/internal/bot/assign.go
index e7743d822b569..35fe61ac3a243 100644
--- a/.github/workflows/robot/internal/bot/assign.go
+++ b/.github/workflows/robot/internal/bot/assign.go
@@ -19,6 +19,9 @@ package bot
 import (
 	"context"
 	"log"
+	"regexp"
+	"strconv"
+	"strings"
 
 	"github.com/gravitational/trace"
 )
@@ -50,10 +53,128 @@ func (b *Bot) Assign(ctx context.Context) error {
 }
 
 func (b *Bot) getReviewers(ctx context.Context) ([]string, error) {
+	// If a backport PR was found, assign original reviewers. Otherwise fall
+	// through to normal assignment logic.
+	if isBackport(b.c.Environment.UnsafeBase) {
+		reviewers, err := b.backportReviewers(ctx)
+		if err == nil {
+			return reviewers, nil
+		}
+		log.Printf("Assign: Found backport PR, but failed to find original reviewers: %v. Falling through to normal assignment logic.", err)
+	}
+
 	docs, code, err := b.parseChanges(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-
 	return b.c.Review.Get(b.c.Environment.Author, docs, code), nil
 }
+
+func (b *Bot) backportReviewers(ctx context.Context) ([]string, error) {
+	// Search inside the PR to find a reference to the original PR.
+	original, err := b.findOriginal(ctx,
+		b.c.Environment.Organization,
+		b.c.Environment.Repository,
+		b.c.Environment.Number)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var originalReviewers []string
+
+	// Append list of reviewers that have yet to submit a review.
+	reviewers, err := b.c.GitHub.ListReviewers(ctx,
+		b.c.Environment.Organization,
+		b.c.Environment.Repository,
+		original)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	originalReviewers = append(originalReviewers, reviewers...)
+
+	// Append list of reviews that have submitted a review.
+	reviews, err := b.c.GitHub.ListReviews(ctx,
+		b.c.Environment.Organization,
+		b.c.Environment.Repository,
+		original)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	for _, review := range reviews {
+		originalReviewers = append(originalReviewers, review.Author)
+	}
+
+	return dedup(b.c.Environment.Author, originalReviewers), nil
+}
+
+func (b *Bot) findOriginal(ctx context.Context, organization string, repository string, number int) (int, error) {
+	pull, err := b.c.GitHub.GetPullRequest(ctx,
+		organization,
+		repository,
+		number)
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+
+	var original string
+
+	// Search inside the title and body for the original PR number.
+	title := pattern.FindStringSubmatch(pull.UnsafeTitle)
+	body := pattern.FindStringSubmatch(pull.UnsafeBody)
+	switch {
+	case len(title) == 0 && len(body) == 0:
+		return 0, trace.NotFound("no PR referenced in title or body")
+	case len(title) == 0 && len(body) == 2:
+		original = body[1]
+	case len(title) == 2 && len(body) == 0:
+		original = title[1]
+	case len(title) == 2 && len(body) == 2:
+		if title[1] != body[1] {
+			return 0, trace.NotFound("different PRs referenced in title and body")
+		}
+		original = title[1]
+	default:
+		return 0, trace.NotFound("failed to find reference to PR")
+	}
+
+	n, err := strconv.Atoi(original)
+	if err != nil {
+		return 0, trace.Wrap(err)
+	}
+
+	// Verify the number found is a Pull Request and not an Issue.
+	_, err = b.c.GitHub.GetPullRequest(ctx,
+		organization,
+		repository,
+		n)
+	if err != nil {
+		return 0, trace.NotFound("found Issue %v, not Pull Request", original)
+	}
+
+	log.Printf("Assign: Found original PR #%v.", original)
+	return n, nil
+}
+
+func dedup(author string, reviewers []string) []string {
+	m := map[string]bool{}
+
+	for _, reviewer := range reviewers {
+		if reviewer == author {
+			continue
+		}
+		m[reviewer] = true
+	}
+
+	var filtered []string
+	for k := range m {
+		filtered = append(filtered, k)
+	}
+
+	return filtered
+}
+
+func isBackport(unsafeBase string) bool {
+	return strings.HasPrefix(unsafeBase, "branch/v")
+}
+
+var pattern = regexp.MustCompile(`(?:https:\/\/github\.com\/gravitational\/teleport\/pull\/|#)([0-9]+)`)
diff --git a/.github/workflows/robot/internal/bot/assign_test.go b/.github/workflows/robot/internal/bot/assign_test.go
new file mode 100644
index 0000000000000..b065a6023de36
--- /dev/null
+++ b/.github/workflows/robot/internal/bot/assign_test.go
@@ -0,0 +1,146 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package bot
+
+import (
+	"context"
+	"testing"
+
+	"github.com/gravitational/teleport/.github/workflows/robot/internal/env"
+	"github.com/gravitational/teleport/.github/workflows/robot/internal/github"
+	"github.com/gravitational/teleport/.github/workflows/robot/internal/review"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestBackportReviewers checks if backport reviewers are correctly assigned.
+func TestBackportReviewers(t *testing.T) {
+	r, err := review.New(&review.Config{
+		CodeReviewers:     map[string]review.Reviewer{},
+		CodeReviewersOmit: map[string]bool{},
+		DocsReviewers:     map[string]review.Reviewer{},
+		DocsReviewersOmit: map[string]bool{},
+		Admins:            []string{},
+	})
+	require.NoError(t, err)
+
+	tests := []struct {
+		desc      string
+		pull      github.PullRequest
+		reviewers []string
+		reviews   []github.Review
+		err       bool
+		expected  []string
+	}{
+		{
+			desc: "backport-original-pr-number-approved",
+			pull: github.PullRequest{
+				Author:      "baz",
+				Repository:  "bar",
+				UnsafeHead:  "baz/fix",
+				UnsafeTitle: "Backport #0 to branch/v8",
+				UnsafeBody:  "",
+				Fork:        false,
+			},
+			reviewers: []string{"3"},
+			reviews: []github.Review{
+				{Author: "4", State: "APPROVED"},
+			},
+			err:      false,
+			expected: []string{"3", "4"},
+		},
+		{
+			desc: "backport-original-url-approved",
+			pull: github.PullRequest{
+				Author:      "baz",
+				Repository:  "bar",
+				UnsafeHead:  "baz/fix",
+				UnsafeTitle: "Fixed an issue",
+				UnsafeBody:  "https://github.com/gravitational/teleport/pull/0",
+				Fork:        false,
+			},
+			reviewers: []string{"3"},
+			reviews: []github.Review{
+				{Author: "4", State: "APPROVED"},
+			},
+			err:      false,
+			expected: []string{"3", "4"},
+		},
+		{
+			desc: "backport-multiple-reviews",
+			pull: github.PullRequest{
+				Author:      "baz",
+				Repository:  "bar",
+				UnsafeHead:  "baz/fix",
+				UnsafeTitle: "Fixed feature",
+				UnsafeBody:  "",
+				Fork:        false,
+			},
+			reviewers: []string{"3"},
+			reviews: []github.Review{
+				{Author: "4", State: "COMMENTED"},
+				{Author: "4", State: "CHANGES_REQUESTED"},
+				{Author: "4", State: "APPROVED"},
+				{Author: "9", State: "APPROVED"},
+			},
+			err:      true,
+			expected: []string{},
+		},
+		{
+			desc: "backport-original-not-found",
+			pull: github.PullRequest{
+				Author:      "baz",
+				Repository:  "bar",
+				UnsafeHead:  "baz/fix",
+				UnsafeTitle: "Fixed feature",
+				UnsafeBody:  "",
+				Fork:        false,
+			},
+			reviewers: []string{"3"},
+			reviews: []github.Review{
+				{Author: "4", State: "APPROVED"},
+			},
+			err:      true,
+			expected: []string{},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			b := &Bot{
+				c: &Config{
+					Environment: &env.Environment{
+						Organization: "foo",
+						Author:       "9",
+						Repository:   "bar",
+						Number:       0,
+						UnsafeBase:   "branch/v8",
+						UnsafeHead:   "fix",
+					},
+					Review: r,
+					GitHub: &fakeGithub{
+						pull:      test.pull,
+						reviewers: test.reviewers,
+						reviews:   test.reviews,
+					},
+				},
+			}
+			reviewers, err := b.backportReviewers(context.Background())
+			require.Equal(t, err != nil, test.err)
+			require.ElementsMatch(t, reviewers, test.expected)
+		})
+	}
+}
diff --git a/.github/workflows/robot/internal/bot/bot.go b/.github/workflows/robot/internal/bot/bot.go
index e892be1fc1ae6..5a979acdb60e7 100644
--- a/.github/workflows/robot/internal/bot/bot.go
+++ b/.github/workflows/robot/internal/bot/bot.go
@@ -29,16 +29,22 @@ import (
 
 // Client implements the GitHub API.
 type Client interface {
-	// RequestReviewers is used to assign reviewers to a PR.
+	// RequestReviewers is used to assign reviewers to a Pull Request.
 	RequestReviewers(ctx context.Context, organization string, repository string, number int, reviewers []string) error
 
 	// ListReviews is used to list all submitted reviews for a PR.
-	ListReviews(ctx context.Context, organization string, repository string, number int) (map[string]*github.Review, error)
+	ListReviews(ctx context.Context, organization string, repository string, number int) ([]github.Review, error)
+
+	// ListReviewers returns a list of reviewers that have yet to submit a review.
+	ListReviewers(ctx context.Context, organization string, repository string, number int) ([]string, error)
+
+	// GetPullRequest returns a specific Pull Request.
+	GetPullRequest(ctx context.Context, organization string, repository string, number int) (github.PullRequest, error)
 
 	// ListPullRequests returns a list of Pull Requests.
 	ListPullRequests(ctx context.Context, organization string, repository string, state string) ([]github.PullRequest, error)
 
-	// ListFiles is used to list all the files within a PR.
+	// ListFiles is used to list all the files within a Pull Request.
 	ListFiles(ctx context.Context, organization string, repository string, number int) ([]string, error)
 
 	// AddLabels will add labels to an Issue or Pull Request.
diff --git a/.github/workflows/robot/internal/bot/bot_test.go b/.github/workflows/robot/internal/bot/bot_test.go
index 72ac663acf7b5..5ff4744385c9a 100644
--- a/.github/workflows/robot/internal/bot/bot_test.go
+++ b/.github/workflows/robot/internal/bot/bot_test.go
@@ -78,7 +78,7 @@ func TestParseChanges(t *testing.T) {
 						Number:       0,
 					},
 					GitHub: &fakeGithub{
-						test.files,
+						files: test.files,
 					},
 				},
 			}
@@ -91,15 +91,26 @@ func TestParseChanges(t *testing.T) {
 }
 
 type fakeGithub struct {
-	files []string
+	files     []string
+	pull      github.PullRequest
+	reviewers []string
+	reviews   []github.Review
 }
 
 func (f *fakeGithub) RequestReviewers(ctx context.Context, organization string, repository string, number int, reviewers []string) error {
 	return nil
 }
 
-func (f *fakeGithub) ListReviews(ctx context.Context, organization string, repository string, number int) (map[string]*github.Review, error) {
-	return nil, nil
+func (f *fakeGithub) ListReviews(ctx context.Context, organization string, repository string, number int) ([]github.Review, error) {
+	return f.reviews, nil
+}
+
+func (f *fakeGithub) ListReviewers(ctx context.Context, organization string, repository string, number int) ([]string, error) {
+	return f.reviewers, nil
+}
+
+func (f *fakeGithub) GetPullRequest(ctx context.Context, organization string, repository string, number int) (github.PullRequest, error) {
+	return f.pull, nil
 }
 
 func (f *fakeGithub) ListPullRequests(ctx context.Context, organization string, repository string, state string) ([]github.PullRequest, error) {
diff --git a/.github/workflows/robot/internal/bot/check.go b/.github/workflows/robot/internal/bot/check.go
index d62c4d1e3a925..34fc5daf4341e 100644
--- a/.github/workflows/robot/internal/bot/check.go
+++ b/.github/workflows/robot/internal/bot/check.go
@@ -40,7 +40,7 @@ func (b *Bot) Check(ctx context.Context) error {
 		err := b.dismiss(ctx,
 			b.c.Environment.Organization,
 			b.c.Environment.Repository,
-			b.c.Environment.UnsafeBranch)
+			b.c.Environment.UnsafeHead)
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/.github/workflows/robot/internal/bot/label.go b/.github/workflows/robot/internal/bot/label.go
index 843fe6fa37ee8..5bb5154a6b67a 100644
--- a/.github/workflows/robot/internal/bot/label.go
+++ b/.github/workflows/robot/internal/bot/label.go
@@ -51,7 +51,7 @@ func (b *Bot) labels(ctx context.Context) ([]string, error) {
 	var labels []string
 
 	// The branch name is unsafe, but here we are simply adding a label.
-	if strings.HasPrefix(b.c.Environment.UnsafeBranch, "branch/") {
+	if strings.HasPrefix(b.c.Environment.UnsafeHead, "branch/") {
 		log.Println("Label: Found backport branch.")
 		labels = append(labels, "backport")
 	}
diff --git a/.github/workflows/robot/internal/bot/label_test.go b/.github/workflows/robot/internal/bot/label_test.go
index c68ff90c6d80f..3e1b1f71c343b 100644
--- a/.github/workflows/robot/internal/bot/label_test.go
+++ b/.github/workflows/robot/internal/bot/label_test.go
@@ -84,10 +84,10 @@ func TestLabel(t *testing.T) {
 						Organization: "foo",
 						Repository:   "bar",
 						Number:       0,
-						UnsafeBranch: test.branch,
+						UnsafeHead:   test.branch,
 					},
 					GitHub: &fakeGithub{
-						test.files,
+						files: test.files,
 					},
 				},
 			}
diff --git a/.github/workflows/robot/internal/env/env.go b/.github/workflows/robot/internal/env/env.go
index ebf989a2fffd7..73fb61b844ec3 100644
--- a/.github/workflows/robot/internal/env/env.go
+++ b/.github/workflows/robot/internal/env/env.go
@@ -38,13 +38,26 @@ type Environment struct {
 	// Author is the author of the PR.
 	Author string
 
-	// UnsafeBranch is the name of the branch the workflow is running in.
+	// UnsafeHead is the name of the branch the workflow is running in.
 	//
-	// UnsafeBranch can be attacker controlled and should not be used in any
-	// security sensitive context. See the following link for more details:
+	// UnsafeHead can be attacker controlled and should not be used in any
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
 	//
 	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
-	UnsafeBranch string
+	UnsafeHead string
+
+	// UnsafeBase is the name of the base branch the user is trying to merge the
+	// PR into. For example: "master" or "branch/v8".
+	//
+	// UnsafeBase can be attacker controlled and should not be used in any
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
+	//
+	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
+	UnsafeBase string
 }
 
 // New returns a new execution environment for the workflow.
@@ -72,7 +85,8 @@ func New() (*Environment, error) {
 		Repository:   event.Repository.Name,
 		Number:       event.PullRequest.Number,
 		Author:       event.PullRequest.User.Login,
-		UnsafeBranch: event.PullRequest.UnsafeHead.UnsafeRef,
+		UnsafeHead:   event.PullRequest.UnsafeHead.UnsafeRef,
+		UnsafeBase:   event.PullRequest.UnsafeBase.UnsafeRef,
 	}, nil
 }
 
diff --git a/.github/workflows/robot/internal/env/env_test.go b/.github/workflows/robot/internal/env/env_test.go
index 205b7a3026447..5ec2972db0120 100644
--- a/.github/workflows/robot/internal/env/env_test.go
+++ b/.github/workflows/robot/internal/env/env_test.go
@@ -95,7 +95,7 @@ func TestEnvironment(t *testing.T) {
 				require.Equal(t, environment.Repository, test.repository)
 				require.Equal(t, environment.Number, test.number)
 				require.Equal(t, environment.Author, test.author)
-				require.Equal(t, environment.UnsafeBranch, test.unsafeBranch)
+				require.Equal(t, environment.UnsafeHead, test.unsafeBranch)
 			}
 		})
 	}
diff --git a/.github/workflows/robot/internal/env/structs.go b/.github/workflows/robot/internal/env/structs.go
index ac82d282c8d41..d34de2e46f27f 100644
--- a/.github/workflows/robot/internal/env/structs.go
+++ b/.github/workflows/robot/internal/env/structs.go
@@ -39,25 +39,39 @@ type PullRequest struct {
 	Number int  `json:"number"`
 
 	// UnsafeHead can be attacker controlled and should not be used in any
-	// security sensitive context. See the following link for more details:
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
 	//
 	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
-	UnsafeHead Head `json:"head"`
+	UnsafeHead Branch `json:"head"`
+
+	// UnsafeHead can be attacker controlled and should not be used in any
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
+	//
+	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
+	UnsafeBase Branch `json:"base"`
 }
 
 type User struct {
 	Login string `json:"login"`
 }
 
-type Head struct {
+type Branch struct {
 	// UnsafeSHA can be attacker controlled and should not be used in any
-	// security sensitive context. See the following link for more details:
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
 	//
 	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
 	UnsafeSHA string `json:"sha"`
 
 	// UnsafeRef can be attacker controlled and should not be used in any
-	// security sensitive context. See the following link for more details:
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
 	//
 	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
 	UnsafeRef string `json:"ref"`
diff --git a/.github/workflows/robot/internal/github/github.go b/.github/workflows/robot/internal/github/github.go
index a52861b3e1972..e25d7dbf6ff29 100644
--- a/.github/workflows/robot/internal/github/github.go
+++ b/.github/workflows/robot/internal/github/github.go
@@ -22,6 +22,7 @@ import (
 	"net/http"
 	"net/url"
 	"path"
+	"sort"
 	"strconv"
 	"time"
 
@@ -45,6 +46,7 @@ func New(ctx context.Context, token string) (*Client, error) {
 	}, nil
 }
 
+// RequestReviewers is used to assign reviewers to a Pull Requests.
 func (c *Client) RequestReviewers(ctx context.Context, organization string, repository string, number int, reviewers []string) error {
 	_, _, err := c.client.PullRequests.RequestReviewers(ctx,
 		organization,
@@ -63,14 +65,15 @@ func (c *Client) RequestReviewers(ctx context.Context, organization string, repo
 type Review struct {
 	// Author is the GitHub login of the user that created the PR.
 	Author string
-	// State is the state of the PR, for example APPROVED or CHANGES_REQUESTED.
+	// State is the state of the PR, for example APPROVED, COMMENTED,
+	// CHANGES_REQUESTED, or DISMISSED.
 	State string
 	// SubmittedAt is the time the PR was created.
 	SubmittedAt time.Time
 }
 
-func (c *Client) ListReviews(ctx context.Context, organization string, repository string, number int) (map[string]*Review, error) {
-	reviews := map[string]*Review{}
+func (c *Client) ListReviews(ctx context.Context, organization string, repository string, number int) ([]Review, error) {
+	var reviews []Review
 
 	opt := &go_github.ListOptions{
 		Page:    0,
@@ -87,20 +90,11 @@ func (c *Client) ListReviews(ctx context.Context, organization string, repositor
 		}
 
 		for _, r := range page {
-			// Always pick up the last submitted review from each reviewer.
-			review, ok := reviews[r.GetUser().GetLogin()]
-			if ok {
-				if r.GetSubmittedAt().After(review.SubmittedAt) {
-					review.State = r.GetState()
-					review.SubmittedAt = r.GetSubmittedAt()
-				}
-			}
-
-			reviews[r.GetUser().GetLogin()] = &Review{
+			reviews = append(reviews, Review{
 				Author:      r.GetUser().GetLogin(),
 				State:       r.GetState(),
 				SubmittedAt: r.GetSubmittedAt(),
-			}
+			})
 		}
 
 		if resp.NextPage == 0 {
@@ -109,6 +103,11 @@ func (c *Client) ListReviews(ctx context.Context, organization string, repositor
 		opt.Page = resp.NextPage
 	}
 
+	// Sort oldest review first.
+	sort.SliceStable(reviews, func(i, j int) bool {
+		return reviews[i].SubmittedAt.Before(reviews[j].SubmittedAt)
+	})
+
 	return reviews, nil
 }
 
@@ -118,13 +117,95 @@ type PullRequest struct {
 	Author string
 	// Repository is the name of the repository.
 	Repository string
-	// UnsafeHead is the name of the branch this PR is created from. It is marked
-	// unsafe as it can be attacker controlled.
+	// Number is the Pull Request number.
+	Number int
+	// State is the state of the submitted review.
+	State string
+	// UnsafeHead is the name head of the branch.
+	//
+	// UnsafeHead can be attacker controlled and should not be used in any
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
+	//
+	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
 	UnsafeHead string
+	// UnsafeTitle is the title of the Pull Request.
+	//
+	// UnsafeTitle can be attacker controlled and should not be used in any
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
+	//
+	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
+	UnsafeTitle string
+	// UnsafeBody is the body of the Pull Request.
+	//
+	// UnsafeBody can be attacker controlled and should not be used in any
+	// security sensitive context. For example, don't use it when crafting a URL
+	// to send a request to or an access decision. See the following link for
+	// more details:
+	//
+	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
+	UnsafeBody string
 	// Fork determines if the pull request is from a fork.
 	Fork bool
 }
 
+// ListReviewers returns a list of reviewers that have yet to submit a review.
+func (c *Client) ListReviewers(ctx context.Context, organization string, repository string, number int) ([]string, error) {
+	var reviewers []string
+
+	opt := &go_github.ListOptions{
+		Page:    0,
+		PerPage: perPage,
+	}
+	for {
+		page, resp, err := c.client.PullRequests.ListReviewers(ctx,
+			organization,
+			repository,
+			number,
+			opt)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		for _, r := range page.Users {
+			reviewers = append(reviewers, r.GetLogin())
+		}
+
+		if resp.NextPage == 0 {
+			break
+		}
+		opt.Page = resp.NextPage
+	}
+
+	return reviewers, nil
+}
+
+// GetPullRequest returns a specific Pull Request.
+func (c *Client) GetPullRequest(ctx context.Context, organization string, repository string, number int) (PullRequest, error) {
+	pull, _, err := c.client.PullRequests.Get(ctx,
+		organization,
+		repository,
+		number)
+	if err != nil {
+		return PullRequest{}, trace.Wrap(err)
+	}
+
+	return PullRequest{
+		Author:      pull.GetUser().GetLogin(),
+		Repository:  repository,
+		Number:      pull.GetNumber(),
+		State:       pull.GetState(),
+		UnsafeHead:  pull.GetHead().GetRef(),
+		UnsafeTitle: pull.GetTitle(),
+		UnsafeBody:  pull.GetBody(),
+		Fork:        pull.GetHead().GetRepo().GetFork(),
+	}, nil
+}
+
+// ListPullRequests returns a list of Pull Requests.
 func (c *Client) ListPullRequests(ctx context.Context, organization string, repository string, state string) ([]PullRequest, error) {
 	var pulls []PullRequest
 
@@ -144,12 +225,16 @@ func (c *Client) ListPullRequests(ctx context.Context, organization string, repo
 			return nil, trace.Wrap(err)
 		}
 
-		for _, pr := range page {
+		for _, pull := range page {
 			pulls = append(pulls, PullRequest{
-				Author:     pr.GetUser().GetLogin(),
-				Repository: repository,
-				UnsafeHead: pr.GetHead().GetRef(),
-				Fork:       pr.GetHead().GetRepo().GetFork(),
+				Author:      pull.GetUser().GetLogin(),
+				Repository:  repository,
+				Number:      pull.GetNumber(),
+				State:       pull.GetState(),
+				UnsafeHead:  pull.GetHead().GetRef(),
+				UnsafeTitle: pull.GetTitle(),
+				UnsafeBody:  pull.GetBody(),
+				Fork:        pull.GetHead().GetRepo().GetFork(),
 			})
 		}
 		if resp.NextPage == 0 {
@@ -161,6 +246,7 @@ func (c *Client) ListPullRequests(ctx context.Context, organization string, repo
 	return pulls, nil
 }
 
+// ListFiles is used to list all the files within a Pull Request.
 func (c *Client) ListFiles(ctx context.Context, organization string, repository string, number int) ([]string, error) {
 	var files []string
 
@@ -215,6 +301,7 @@ type Workflow struct {
 	Path string
 }
 
+// ListWorkflows lists all workflows within a repository.
 func (c *Client) ListWorkflows(ctx context.Context, organization string, repository string) ([]Workflow, error) {
 	var workflows []Workflow
 
@@ -260,6 +347,7 @@ type Run struct {
 	CreatedAt time.Time
 }
 
+// ListWorkflowRuns is used to list all workflow runs for an ID.
 func (c *Client) ListWorkflowRuns(ctx context.Context, organization string, repository string, branch string, workflowID int64) ([]Run, error) {
 	var runs []Run
 
diff --git a/.github/workflows/robot/internal/review/review.go b/.github/workflows/robot/internal/review/review.go
index 2bf803c7ed531..0d1072c2c5d08 100644
--- a/.github/workflows/robot/internal/review/review.go
+++ b/.github/workflows/robot/internal/review/review.go
@@ -195,7 +195,7 @@ func (r *Assignments) getCodeReviewerSets(author string) ([]string, []string) {
 }
 
 // CheckExternal requires two admins have approved.
-func (r *Assignments) CheckExternal(author string, reviews map[string]*github.Review) error {
+func (r *Assignments) CheckExternal(author string, reviews []github.Review) error {
 	log.Printf("Check: Found external author %v.", author)
 
 	reviewers := r.getAdminReviewers(author)
@@ -209,7 +209,7 @@ func (r *Assignments) CheckExternal(author string, reviews map[string]*github.Re
 // CheckInternal will verify if required reviewers have approved. Checks if
 // docs and if each set of code reviews have approved. Admin approvals bypass
 // all checks.
-func (r *Assignments) CheckInternal(author string, reviews map[string]*github.Review, docs bool, code bool) error {
+func (r *Assignments) CheckInternal(author string, reviews []github.Review, docs bool, code bool) error {
 	log.Printf("Check: Found internal author %v.", author)
 
 	// Skip checks if admins have approved.
@@ -247,7 +247,7 @@ func (r *Assignments) CheckInternal(author string, reviews map[string]*github.Re
 	return nil
 }
 
-func (r *Assignments) checkDocsReviews(author string, reviews map[string]*github.Review) error {
+func (r *Assignments) checkDocsReviews(author string, reviews []github.Review) error {
 	reviewers := r.getDocsReviewers(author)
 
 	if check(reviewers, reviews) {
@@ -257,7 +257,7 @@ func (r *Assignments) checkDocsReviews(author string, reviews map[string]*github
 	return trace.BadParameter("requires at least one approval from %v", reviewers)
 }
 
-func (r *Assignments) checkCodeReviews(author string, reviews map[string]*github.Review) error {
+func (r *Assignments) checkCodeReviews(author string, reviews []github.Review) error {
 	// External code reviews should never hit this path, if they do, fail and
 	// return an error.
 	v, ok := r.c.CodeReviewers[author]
@@ -314,23 +314,42 @@ func getReviewerSets(author string, team string, reviewers map[string]Reviewer,
 	return setA, setB
 }
 
-func check(reviewers []string, reviews map[string]*github.Review) bool {
+func check(reviewers []string, reviews []github.Review) bool {
 	return checkN(reviewers, reviews) > 0
 }
 
-func checkN(reviewers []string, reviews map[string]*github.Review) int {
+func checkN(reviewers []string, reviews []github.Review) int {
+	r := reviewsByAuthor(reviews)
+
 	var n int
 	for _, reviewer := range reviewers {
-		if review, ok := reviews[reviewer]; ok {
-			if review.State == approved && review.Author == reviewer {
-				n++
-			}
+		if state, ok := r[reviewer]; ok && state == approved {
+			n++
 		}
 	}
 	return n
 }
 
+func reviewsByAuthor(reviews []github.Review) map[string]string {
+	m := map[string]string{}
+
+	for _, review := range reviews {
+		// Always pick up the last submitted review from each reviewer.
+		if state, ok := m[review.Author]; ok {
+			// If the reviewer left comments after approval, skip this review.
+			if review.State == commented && state == approved {
+				continue
+			}
+		}
+		m[review.Author] = review.State
+	}
+
+	return m
+}
+
 const (
+	// commented is a code review where the reviewer has left comments only.
+	commented = "COMMENTED"
 	// approved is a code review where the reviewer has approved changes.
 	approved = "APPROVED"
 	// changesRequested is a code review where the reviewer has requested changes.
diff --git a/.github/workflows/robot/internal/review/review_test.go b/.github/workflows/robot/internal/review/review_test.go
index d8df894053445..3412e1d374f7a 100644
--- a/.github/workflows/robot/internal/review/review_test.go
+++ b/.github/workflows/robot/internal/review/review_test.go
@@ -37,16 +37,16 @@ func TestIsInternal(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
-						"3": Reviewer{Team: "Core", Owner: false},
-						"4": Reviewer{Team: "Core", Owner: false},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
+						"3": {Team: "Core", Owner: false},
+						"4": {Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"5": Reviewer{Team: "Core", Owner: true},
-						"6": Reviewer{Team: "Core", Owner: true},
+						"5": {Team: "Core", Owner: true},
+						"6": {Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -65,16 +65,16 @@ func TestIsInternal(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
-						"3": Reviewer{Team: "Core", Owner: false},
-						"4": Reviewer{Team: "Core", Owner: false},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
+						"3": {Team: "Core", Owner: false},
+						"4": {Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"5": Reviewer{Team: "Core", Owner: true},
-						"6": Reviewer{Team: "Core", Owner: true},
+						"5": {Team: "Core", Owner: true},
+						"6": {Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -93,16 +93,16 @@ func TestIsInternal(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
-						"3": Reviewer{Team: "Core", Owner: false},
-						"4": Reviewer{Team: "Core", Owner: false},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
+						"3": {Team: "Core", Owner: false},
+						"4": {Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"5": Reviewer{Team: "Core", Owner: true},
-						"6": Reviewer{Team: "Core", Owner: true},
+						"5": {Team: "Core", Owner: true},
+						"6": {Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -139,10 +139,10 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
-						"3": Reviewer{Team: "Core", Owner: false},
-						"4": Reviewer{Team: "Core", Owner: false},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
+						"3": {Team: "Core", Owner: false},
+						"4": {Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Admins.
@@ -162,11 +162,11 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
-						"3": Reviewer{Team: "Core", Owner: false},
-						"4": Reviewer{Team: "Core", Owner: false},
-						"5": Reviewer{Team: "Core", Owner: false},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
+						"3": {Team: "Core", Owner: false},
+						"4": {Team: "Core", Owner: false},
+						"5": {Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{
 						"3": true,
@@ -188,11 +188,11 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
-						"3": Reviewer{Team: "Core", Owner: false},
-						"4": Reviewer{Team: "Core", Owner: false},
-						"5": Reviewer{Team: "Internal"},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
+						"3": {Team: "Core", Owner: false},
+						"4": {Team: "Core", Owner: false},
+						"5": {Team: "Internal"},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Admins.
@@ -212,15 +212,15 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
-						"3": Reviewer{Team: "Core", Owner: true},
-						"4": Reviewer{Team: "Core", Owner: false},
-						"5": Reviewer{Team: "Core", Owner: false},
-						"6": Reviewer{Team: "Core", Owner: false},
-						"7": Reviewer{Team: "Internal", Owner: false},
-						"8": Reviewer{Team: "Cloud", Owner: false},
-						"9": Reviewer{Team: "Cloud", Owner: false},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
+						"3": {Team: "Core", Owner: true},
+						"4": {Team: "Core", Owner: false},
+						"5": {Team: "Core", Owner: false},
+						"6": {Team: "Core", Owner: false},
+						"7": {Team: "Internal", Owner: false},
+						"8": {Team: "Cloud", Owner: false},
+						"9": {Team: "Cloud", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{
 						"6": true,
@@ -245,13 +245,13 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
-						"3": Reviewer{Team: "Core", Owner: true},
-						"4": Reviewer{Team: "Core", Owner: false},
-						"5": Reviewer{Team: "Core", Owner: false},
-						"6": Reviewer{Team: "Core", Owner: false},
-						"7": Reviewer{Team: "Internal", Owner: false},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
+						"3": {Team: "Core", Owner: true},
+						"4": {Team: "Core", Owner: false},
+						"5": {Team: "Core", Owner: false},
+						"6": {Team: "Core", Owner: false},
+						"7": {Team: "Internal", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{
 						"6": true,
@@ -294,8 +294,8 @@ func TestGetDocsReviewers(t *testing.T) {
 				c: &Config{
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -314,8 +314,8 @@ func TestGetDocsReviewers(t *testing.T) {
 				c: &Config{
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{
 						"2": true,
@@ -336,8 +336,8 @@ func TestGetDocsReviewers(t *testing.T) {
 				c: &Config{
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"1": Reviewer{Team: "Core", Owner: true},
-						"2": Reviewer{Team: "Core", Owner: true},
+						"1": {Team: "Core", Owner: true},
+						"2": {Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -365,12 +365,12 @@ func TestCheckExternal(t *testing.T) {
 		c: &Config{
 			// Code.
 			CodeReviewers: map[string]Reviewer{
-				"1": Reviewer{Team: "Core", Owner: true},
-				"2": Reviewer{Team: "Core", Owner: true},
-				"3": Reviewer{Team: "Core", Owner: true},
-				"4": Reviewer{Team: "Core", Owner: false},
-				"5": Reviewer{Team: "Core", Owner: false},
-				"6": Reviewer{Team: "Core", Owner: false},
+				"1": {Team: "Core", Owner: true},
+				"2": {Team: "Core", Owner: true},
+				"3": {Team: "Core", Owner: true},
+				"4": {Team: "Core", Owner: false},
+				"5": {Team: "Core", Owner: false},
+				"6": {Team: "Core", Owner: false},
 			},
 			CodeReviewersOmit: map[string]bool{},
 			// Default.
@@ -383,72 +383,48 @@ func TestCheckExternal(t *testing.T) {
 	tests := []struct {
 		desc    string
 		author  string
-		reviews map[string]*github.Review
+		reviews []github.Review
 		result  bool
 	}{
 		{
 			desc:    "no-reviews-fail",
 			author:  "5",
-			reviews: map[string]*github.Review{},
+			reviews: []github.Review{},
 			result:  false,
 		},
 		{
 			desc:   "two-non-admin-reviews-fail",
 			author: "5",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{
-					Author: "3",
-					State:  approved,
-				},
-				"4": &github.Review{
-					Author: "4",
-					State:  approved,
-				},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "4", State: approved},
 			},
 			result: false,
 		},
 		{
 			desc:   "one-admin-reviews-fail",
 			author: "5",
-			reviews: map[string]*github.Review{
-				"1": &github.Review{
-					Author: "1",
-					State:  approved,
-				},
-				"4": &github.Review{
-					Author: "4",
-					State:  approved,
-				},
+			reviews: []github.Review{
+				{Author: "1", State: approved},
+				{Author: "4", State: approved},
 			},
 			result: false,
 		},
 		{
 			desc:   "two-admin-reviews-one-denied-success",
 			author: "5",
-			reviews: map[string]*github.Review{
-				"1": &github.Review{
-					Author: "1",
-					State:  changesRequested,
-				},
-				"2": &github.Review{
-					Author: "2",
-					State:  approved,
-				},
+			reviews: []github.Review{
+				{Author: "1", State: changesRequested},
+				{Author: "2", State: approved},
 			},
 			result: false,
 		},
 		{
 			desc:   "two-admin-reviews-success",
 			author: "5",
-			reviews: map[string]*github.Review{
-				"1": &github.Review{
-					Author: "1",
-					State:  approved,
-				},
-				"2": &github.Review{
-					Author: "2",
-					State:  approved,
-				},
+			reviews: []github.Review{
+				{Author: "1", State: approved},
+				{Author: "2", State: approved},
 			},
 			result: true,
 		},
@@ -471,21 +447,21 @@ func TestCheckInternal(t *testing.T) {
 		c: &Config{
 			// Code.
 			CodeReviewers: map[string]Reviewer{
-				"1":  Reviewer{Team: "Core", Owner: true},
-				"2":  Reviewer{Team: "Core", Owner: true},
-				"3":  Reviewer{Team: "Core", Owner: true},
-				"9":  Reviewer{Team: "Core", Owner: true},
-				"4":  Reviewer{Team: "Core", Owner: false},
-				"5":  Reviewer{Team: "Core", Owner: false},
-				"6":  Reviewer{Team: "Core", Owner: false},
-				"8":  Reviewer{Team: "Internal", Owner: false},
-				"10": Reviewer{Team: "Cloud", Owner: false},
-				"11": Reviewer{Team: "Cloud", Owner: false},
-				"12": Reviewer{Team: "Cloud", Owner: false},
+				"1":  {Team: "Core", Owner: true},
+				"2":  {Team: "Core", Owner: true},
+				"3":  {Team: "Core", Owner: true},
+				"9":  {Team: "Core", Owner: true},
+				"4":  {Team: "Core", Owner: false},
+				"5":  {Team: "Core", Owner: false},
+				"6":  {Team: "Core", Owner: false},
+				"8":  {Team: "Internal", Owner: false},
+				"10": {Team: "Cloud", Owner: false},
+				"11": {Team: "Cloud", Owner: false},
+				"12": {Team: "Cloud", Owner: false},
 			},
 			// Docs.
 			DocsReviewers: map[string]Reviewer{
-				"7": Reviewer{Team: "Core", Owner: true},
+				"7": {Team: "Core", Owner: true},
 			},
 			DocsReviewersOmit: map[string]bool{},
 			CodeReviewersOmit: map[string]bool{},
@@ -499,7 +475,7 @@ func TestCheckInternal(t *testing.T) {
 	tests := []struct {
 		desc    string
 		author  string
-		reviews map[string]*github.Review
+		reviews []github.Review
 		docs    bool
 		code    bool
 		result  bool
@@ -507,13 +483,13 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:    "no-reviews-fail",
 			author:  "4",
-			reviews: map[string]*github.Review{},
+			reviews: []github.Review{},
 			result:  false,
 		},
 		{
 			desc:    "docs-only-no-reviews-fail",
 			author:  "4",
-			reviews: map[string]*github.Review{},
+			reviews: []github.Review{},
 			docs:    true,
 			code:    false,
 			result:  false,
@@ -521,8 +497,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-only-non-docs-approval-fail",
 			author: "4",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
 			},
 			docs:   true,
 			code:   false,
@@ -531,8 +507,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-only-docs-approval-success",
 			author: "4",
-			reviews: map[string]*github.Review{
-				"7": &github.Review{Author: "7", State: approved},
+			reviews: []github.Review{
+				{Author: "7", State: approved},
 			},
 			docs:   true,
 			code:   false,
@@ -541,7 +517,7 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:    "code-only-no-reviews-fail",
 			author:  "4",
-			reviews: map[string]*github.Review{},
+			reviews: []github.Review{},
 			docs:    false,
 			code:    true,
 			result:  false,
@@ -549,8 +525,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-one-approval-fail",
 			author: "4",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -559,9 +535,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-two-approval-setb-fail",
 			author: "4",
-			reviews: map[string]*github.Review{
-				"5": &github.Review{Author: "5", State: approved},
-				"6": &github.Review{Author: "6", State: approved},
+			reviews: []github.Review{
+				{Author: "5", State: approved},
+				{Author: "6", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -570,9 +546,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-one-changes-fail",
 			author: "4",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
-				"4": &github.Review{Author: "4", State: changesRequested},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "4", State: changesRequested},
 			},
 			docs:   false,
 			code:   true,
@@ -581,9 +557,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-two-approvals-success",
 			author: "6",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
-				"4": &github.Review{Author: "4", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "4", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -592,8 +568,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-and-code-only-docs-approval-fail",
 			author: "6",
-			reviews: map[string]*github.Review{
-				"7": &github.Review{Author: "7", State: approved},
+			reviews: []github.Review{
+				{Author: "7", State: approved},
 			},
 			docs:   true,
 			code:   true,
@@ -602,9 +578,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-and-code-only-code-approval-fail",
 			author: "6",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
-				"4": &github.Review{Author: "4", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "4", State: approved},
 			},
 			docs:   true,
 			code:   true,
@@ -613,10 +589,10 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-and-code-docs-and-code-approval-success",
 			author: "6",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
-				"4": &github.Review{Author: "4", State: approved},
-				"7": &github.Review{Author: "7", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "4", State: approved},
+				{Author: "7", State: approved},
 			},
 			docs:   true,
 			code:   true,
@@ -625,8 +601,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-internal-on-approval-failure",
 			author: "8",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -635,9 +611,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-internal-code-approval-success",
 			author: "8",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
-				"4": &github.Review{Author: "4", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "4", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -646,9 +622,33 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-internal-two-code-owner-approval-success",
 			author: "4",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
-				"9": &github.Review{Author: "9", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "9", State: approved},
+			},
+			docs:   false,
+			code:   true,
+			result: true,
+		},
+		{
+			desc:   "code-only-changes-requested-after-approval-failure",
+			author: "4",
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "9", State: approved},
+				{Author: "9", State: changesRequested},
+			},
+			docs:   false,
+			code:   true,
+			result: false,
+		},
+		{
+			desc:   "code-only-comment-after-approval-success",
+			author: "4",
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "9", State: approved},
+				{Author: "9", State: commented},
 			},
 			docs:   false,
 			code:   true,
@@ -657,9 +657,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "cloud-with-self-approval-failure",
 			author: "10",
-			reviews: map[string]*github.Review{
-				"11": &github.Review{Author: "11", State: approved},
-				"12": &github.Review{Author: "12", State: approved},
+			reviews: []github.Review{
+				{Author: "11", State: approved},
+				{Author: "12", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -668,9 +668,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "cloud-with-core-approval-success",
 			author: "10",
-			reviews: map[string]*github.Review{
-				"3": &github.Review{Author: "3", State: approved},
-				"9": &github.Review{Author: "9", State: approved},
+			reviews: []github.Review{
+				{Author: "3", State: approved},
+				{Author: "9", State: approved},
 			},
 			docs:   false,
 			code:   true,
diff --git a/.golangci.yml b/.golangci.yml
index 3d28c3459114b..89ff401c285d6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -15,6 +15,7 @@ linters:
   enable:
     - bodyclose
     - deadcode
+    - depguard
     - goimports
     - gosimple
     - govet
@@ -28,6 +29,13 @@ linters:
     - unconvert
     - varcheck
 
+linters-settings:
+  depguard:
+    list-type: denylist
+    include-go-root: true # check against stdlib
+    packages-with-error-message:
+    - io/ioutil: 'use "io" or "os" packages instead'
+
 output:
   uniq-by-line: false
 
diff --git a/Cargo.lock b/Cargo.lock
index 0edacf469da90..e4035cdf0adc3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.53"
+version = "1.0.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94a45b455c14666b85fc40a019e8ab9eb75e3a124e05494f5397122bc9eb06e0"
+checksum = "159bb86af3a200e19a068f4224eae4c8bb2d0fa054c7e5d1cacd5cef95e684cd"
 
 [[package]]
 name = "arrayvec"
@@ -176,9 +176,9 @@ dependencies = [
 
 [[package]]
 name = "crepe"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a143ee68e4ec17aa70d0b95a1a5ef2c4e510b79cc3d956ea51bd2fe56d1856bd"
+checksum = "6d0c81f0055a7c877a9a69ec9d667a0b14c2b38394c712f54b9a400d035f49a9"
 dependencies = [
  "petgraph",
  "proc-macro-error",
@@ -1176,9 +1176,9 @@ checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.8.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+checksum = "7e8820f5d777f6224dc4be3632222971ac30164d4a258d595640799554ebfd99"
 
 [[package]]
 name = "unicode-xid"
diff --git a/Makefile b/Makefile
index 399933fdf75c0..f8d46f2c275ad 100644
--- a/Makefile
+++ b/Makefile
@@ -462,7 +462,7 @@ $(RENDER_TESTS): $(wildcard $(TOOLINGDIR)/cmd/render-tests/*.go)
 # Runs all Go/shell tests, called by CI/CD.
 #
 .PHONY: test
-test: test-sh test-ci test-api test-go test-rust
+test: test-helm test-sh test-ci test-api test-go test-rust
 
 # Runs bot Go tests.
 #
@@ -475,6 +475,19 @@ test-bot:
 $(TEST_LOG_DIR):
 	mkdir $(TEST_LOG_DIR)
 
+# Google Cloud Build uses a weird homedir and Helm can't pick up plugins by default there,
+# so override the plugin location via environment variable when running in CI.
+.PHONY: test-helm
+test-helm:
+	@if [ -d /builder/home ]; then export HELM_PLUGINS=/root/.local/share/helm/plugins; fi; \
+		helm unittest examples/chart/teleport-cluster && \
+		helm unittest examples/chart/teleport-kube-agent
+
+.PHONY: test-helm-update-snapshots
+test-helm-update-snapshots:
+	helm unittest -u examples/chart/teleport-cluster
+	helm unittest -u examples/chart/teleport-kube-agent
+
 #
 # Runs all Go tests except integration, called by CI/CD.
 # Chaos tests have high concurrency, run without race detector and have TestChaos prefix.
diff --git a/README.md b/README.md
index 99c7386576e91..adf743dfc2fd0 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@
 1. [Installing and Running](#installing-and-running)
 1. [Docker](#docker)
 1. [Building Teleport](#building-teleport)
-1. [Why did We Build Teleport?](#why-did-we-build-teleport)
+1. [Why Did We Build Teleport?](#why-did-we-build-teleport)
 1. [More Information](#more-information)
 1. [Support and Contributing](#support-and-contributing)
 1. [Is Teleport Secure and Production Ready?](#is-teleport-secure-and-production-ready)
diff --git a/api/client/client.go b/api/client/client.go
index b9fee45872518..e936e8887abc4 100644
--- a/api/client/client.go
+++ b/api/client/client.go
@@ -877,9 +877,14 @@ func (c *Client) UpsertKubeServiceV2(ctx context.Context, s types.Server) (*type
 // GetKubeServices returns the list of kubernetes services registered in the
 // cluster.
 func (c *Client) GetKubeServices(ctx context.Context) ([]types.Server, error) {
-	resources, err := c.GetResources(ctx, defaults.Namespace, types.KindKubeService)
+	resources, err := GetResourcesWithFilters(ctx, c, proto.ListResourcesRequest{
+		Namespace:    defaults.Namespace,
+		ResourceType: types.KindKubeService,
+	})
 	if err != nil {
-		// DELETE IN 10.0
+		// Underlying ListResources for kube service was not available, use fallback.
+		//
+		// DELETE IN 11.0.0
 		if trace.IsNotImplemented(err) {
 			return c.getKubeServicesFallback(ctx)
 		}
@@ -887,14 +892,9 @@ func (c *Client) GetKubeServices(ctx context.Context) ([]types.Server, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	servers := make([]types.Server, len(resources))
-	for i, resource := range resources {
-		srv, ok := resource.(types.Server)
-		if !ok {
-			return nil, trace.BadParameter("expected Server resource, got %T", resource)
-		}
-
-		servers[i] = srv
+	servers, err := types.ResourcesWithLabels(resources).AsServers()
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	return servers, nil
@@ -919,8 +919,14 @@ func (c *Client) getKubeServicesFallback(ctx context.Context) ([]types.Server, e
 
 // GetApplicationServers returns all registered application servers.
 func (c *Client) GetApplicationServers(ctx context.Context, namespace string) ([]types.AppServer, error) {
-	resources, err := c.GetResources(ctx, namespace, types.KindAppServer)
+	resources, err := GetResourcesWithFilters(ctx, c, proto.ListResourcesRequest{
+		Namespace:    namespace,
+		ResourceType: types.KindAppServer,
+	})
 	if err != nil {
+		// Underlying ListResources for app server was not available, use fallback.
+		//
+		// DELETE IN 11.0.0
 		if trace.IsNotImplemented(err) {
 			servers, err := c.getApplicationServersFallback(ctx, namespace)
 			if err != nil {
@@ -933,14 +939,9 @@ func (c *Client) GetApplicationServers(ctx context.Context, namespace string) ([
 		return nil, trace.Wrap(err)
 	}
 
-	servers := make([]types.AppServer, len(resources))
-	for i, resource := range resources {
-		appServer, ok := resource.(types.AppServer)
-		if !ok {
-			return nil, trace.BadParameter("expected AppServer resource, got %T", resource)
-		}
-
-		servers[i] = appServer
+	servers, err := types.ResourcesWithLabels(resources).AsAppServers()
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	// In addition, we need to fetch legacy application servers.
@@ -1178,8 +1179,14 @@ func (c *Client) DeleteAllKubeServices(ctx context.Context) error {
 
 // GetDatabaseServers returns all registered database proxy servers.
 func (c *Client) GetDatabaseServers(ctx context.Context, namespace string) ([]types.DatabaseServer, error) {
-	resources, err := c.GetResources(ctx, namespace, types.KindDatabaseServer)
+	resources, err := GetResourcesWithFilters(ctx, c, proto.ListResourcesRequest{
+		Namespace:    namespace,
+		ResourceType: types.KindDatabaseServer,
+	})
 	if err != nil {
+		// Underlying ListResources for db server was not available, use fallback.
+		//
+		// DELETE IN 11.0.0
 		if trace.IsNotImplemented(err) {
 			servers, err := c.getDatabaseServersFallback(ctx, namespace)
 			if err != nil {
@@ -1192,14 +1199,9 @@ func (c *Client) GetDatabaseServers(ctx context.Context, namespace string) ([]ty
 		return nil, trace.Wrap(err)
 	}
 
-	servers := make([]types.DatabaseServer, len(resources))
-	for i, resource := range resources {
-		databaseServer, ok := resource.(types.DatabaseServer)
-		if !ok {
-			return nil, trace.BadParameter("expected DatabaseServer resource, got %T", resource)
-		}
-
-		servers[i] = databaseServer
+	servers, err := types.ResourcesWithLabels(resources).AsDatabaseServers()
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	return servers, nil
@@ -1624,17 +1626,46 @@ func (c *Client) GetNode(ctx context.Context, namespace, name string) (types.Ser
 
 // GetNodes returns a complete list of nodes that the user has access to in the given namespace.
 func (c *Client) GetNodes(ctx context.Context, namespace string) ([]types.Server, error) {
-	return GetNodesWithLabels(ctx, c, namespace, nil)
+	resources, err := GetResourcesWithFilters(ctx, c, proto.ListResourcesRequest{
+		ResourceType: types.KindNode,
+		Namespace:    namespace,
+	})
+	if err != nil {
+		// Underlying ListResources for nodes was not available, use fallback.
+		//
+		// DELETE IN 11.0.0
+		if trace.IsNotImplemented(err) {
+			servers, err := GetNodesWithLabels(ctx, c, namespace, nil)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return servers, nil
+		}
+
+		return nil, trace.Wrap(err)
+	}
+
+	servers, err := types.ResourcesWithLabels(resources).AsServers()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return servers, nil
 }
 
 // NodeClient is an interface used by GetNodesWithLabels to abstract over implementations of
 // the ListNodes method.
+//
+// DELETE IN 11.0.0 with GetNodesWithLabels (used in both api/client/client.go and lib/auth/httpfallback.go)
+// replaced by ListResourcesClient
 type NodeClient interface {
 	ListNodes(ctx context.Context, req proto.ListNodesRequest) (nodes []types.Server, nextKey string, err error)
 }
 
 // GetNodesWithLabels is a helper for getting a list of nodes with optional label-based filtering.  In addition to
 // iterating pages, it also correctly handles downsizing pages when LimitExceeded errors are encountered.
+//
+// DELETE IN 11.0.0 replaced by GetResourcesWithFilters.
 func GetNodesWithLabels(ctx context.Context, clt NodeClient, namespace string, labels map[string]string) ([]types.Server, error) {
 	// Retrieve the complete list of nodes in chunks.
 	var (
@@ -2409,6 +2440,10 @@ func (c *Client) ListResources(ctx context.Context, req proto.ListResourcesReque
 			resources[i] = respResource.GetNode()
 		case types.KindKubeService:
 			resources[i] = respResource.GetKubeService()
+		case types.KindWindowsDesktop:
+			resources[i] = respResource.GetWindowsDesktop()
+		case types.KindKubernetesCluster:
+			resources[i] = respResource.GetKubeCluster()
 		default:
 			return nil, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
 		}
@@ -2421,9 +2456,16 @@ func (c *Client) ListResources(ctx context.Context, req proto.ListResourcesReque
 	}, nil
 }
 
-// GetResources retrieves all pages from ListResourcesPage and return all
-// resources.
-func (c *Client) GetResources(ctx context.Context, namespace, resourceType string) ([]types.ResourceWithLabels, error) {
+// ListResourcesClient is an interface used by GetResourcesWithFilters to abstract over implementations of
+// the ListResources method.
+type ListResourcesClient interface {
+	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
+}
+
+// GetResourcesWithFilters is a helper for getting a list of resources with optional filtering. In addition to
+// iterating pages, it also correctly handles downsizing pages when LimitExceeded errors are encountered.
+func GetResourcesWithFilters(ctx context.Context, clt ListResourcesClient, req proto.ListResourcesRequest) ([]types.ResourceWithLabels, error) {
+	// Retrieve the complete list of resources in chunks.
 	var (
 		resources []types.ResourceWithLabels
 		startKey  string
@@ -2431,15 +2473,20 @@ func (c *Client) GetResources(ctx context.Context, namespace, resourceType strin
 	)
 
 	for {
-		resp, err := c.ListResources(ctx, proto.ListResourcesRequest{
-			Namespace:    namespace,
-			ResourceType: resourceType,
-			StartKey:     startKey,
-			Limit:        chunkSize,
+		resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
+			Namespace:           req.Namespace,
+			ResourceType:        req.ResourceType,
+			StartKey:            startKey,
+			Limit:               chunkSize,
+			Labels:              req.Labels,
+			SearchKeywords:      req.SearchKeywords,
+			PredicateExpression: req.PredicateExpression,
 		})
 		if err != nil {
 			if trace.IsLimitExceeded(err) {
+				// Cut chunkSize in half if gRPC max message size is exceeded.
 				chunkSize = chunkSize / 2
+				// This is an extremely unlikely scenario, but better to cover it anyways.
 				if chunkSize == 0 {
 					return nil, trace.Wrap(trail.FromGRPC(err), "resource is too large to retrieve")
 				}
diff --git a/api/client/client_test.go b/api/client/client_test.go
index 5b67271ff7238..58855bd74688f 100644
--- a/api/client/client_test.go
+++ b/api/client/client_test.go
@@ -121,6 +121,13 @@ func (m *mockServer) ListResources(ctx context.Context, req *proto.ListResources
 			}
 
 			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_KubeService{KubeService: srv}}
+		case types.KindWindowsDesktop:
+			desktop, ok := resource.(*types.WindowsDesktopV3)
+			if !ok {
+				return nil, trace.Errorf("windows desktop has invalid type %T", resource)
+			}
+
+			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_WindowsDesktop{WindowsDesktop: desktop}}
 		}
 
 		resp.Resources = append(resp.Resources, protoResource)
@@ -226,6 +233,21 @@ func testResources(resourceType, namespace string) ([]types.ResourceWithLabels,
 				return nil, trace.Wrap(err)
 			}
 		}
+	case types.KindWindowsDesktop:
+		for i := 0; i < size; i++ {
+			var err error
+			name := fmt.Sprintf("windows-desktop-%d", i)
+			resources[i], err = types.NewWindowsDesktopV3(
+				name,
+				map[string]string{"label": string(make([]byte, labelSize))},
+				types.WindowsDesktopSpecV3{
+					Addr:   "_",
+					HostID: "_",
+				})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		}
 
 	default:
 		return nil, trace.Errorf("unsupported resource type %s", resourceType)
@@ -479,6 +501,10 @@ func TestListResources(t *testing.T) {
 			resourceType:   types.KindKubeService,
 			resourceStruct: &types.ServerV2{},
 		},
+		"WindowsDesktop": {
+			resourceType:   types.KindWindowsDesktop,
+			resourceStruct: &types.WindowsDesktopV3{},
+		},
 	}
 
 	// Create client
@@ -558,6 +584,9 @@ func TestGetResources(t *testing.T) {
 		"KubeService": {
 			resourceType: types.KindKubeService,
 		},
+		"WindowsDesktop": {
+			resourceType: types.KindWindowsDesktop,
+		},
 	}
 
 	for name, test := range testCases {
@@ -565,7 +594,7 @@ func TestGetResources(t *testing.T) {
 			expectedResources, err := testResources(test.resourceType, defaults.Namespace)
 			require.NoError(t, err)
 
-			// listing everything at once breaks the ListResource.
+			// Test listing everything at once errors with limit exceeded.
 			_, err = clt.ListResources(ctx, proto.ListResourcesRequest{
 				Namespace:    defaults.Namespace,
 				Limit:        int32(len(expectedResources)),
@@ -574,7 +603,11 @@ func TestGetResources(t *testing.T) {
 			require.Error(t, err)
 			require.IsType(t, &trace.LimitExceededError{}, err.(*trace.TraceErr).OrigError())
 
-			resources, err := clt.GetResources(ctx, defaults.Namespace, test.resourceType)
+			// Test getting all resources by chunks to handle limit exceeded.
+			resources, err := GetResourcesWithFilters(ctx, clt, proto.ListResourcesRequest{
+				Namespace:    defaults.Namespace,
+				ResourceType: test.resourceType,
+			})
 			require.NoError(t, err)
 			require.Len(t, resources, len(expectedResources))
 			require.Empty(t, cmp.Diff(expectedResources, resources))
diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index a8396165aa173..1710672b941d1 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -45,8 +45,8 @@ func (f ContextDialerFunc) DialContext(ctx context.Context, network, addr string
 	return f(ctx, network, addr)
 }
 
-// NewDirectDialer makes a new dialer to connect directly to an Auth server.
-func NewDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
+// newDirectDialer makes a new dialer to connect directly to an Auth server.
+func newDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	return &net.Dialer{
 		Timeout:   dialTimeout,
 		KeepAlive: keepAlivePeriod,
@@ -56,8 +56,8 @@ func NewDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 // NewDialer makes a new dialer that connects to an Auth server either directly or via an HTTP proxy, depending
 // on the environment.
 func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
-	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (net.Conn, error) {
+		dialer := newDirectDialer(keepAlivePeriod, dialTimeout)
 		if proxyAddr := proxy.GetProxyAddress(addr); proxyAddr != nil {
 			return DialProxyWithDialer(ctx, proxyAddr, addr, dialer)
 		}
@@ -70,7 +70,8 @@ func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 func NewProxyDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration, discoveryAddr string, insecure bool) ContextDialer {
 	dialer := newTunnelDialer(ssh, keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, _ string) (conn net.Conn, err error) {
-		tunnelAddr, err := webclient.GetTunnelAddr(ctx, discoveryAddr, insecure, nil)
+		tunnelAddr, err := webclient.GetTunnelAddr(
+			&webclient.Config{Context: ctx, ProxyAddr: discoveryAddr, Insecure: insecure})
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -85,7 +86,7 @@ func NewProxyDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Dura
 
 // newTunnelDialer makes a dialer to connect to an Auth server through the SSH reverse tunnel on the proxy.
 func newTunnelDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
-	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
+	dialer := newDirectDialer(keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (conn net.Conn, err error) {
 		conn, err = dialer.DialContext(ctx, network, addr)
 		if err != nil {
@@ -104,7 +105,8 @@ func newTunnelDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Dur
 // through the SSH reverse tunnel on the proxy.
 func newTLSRoutingTunnelDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration, discoveryAddr string, insecure bool) ContextDialer {
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (conn net.Conn, err error) {
-		tunnelAddr, err := webclient.GetTunnelAddr(ctx, discoveryAddr, insecure, nil)
+		tunnelAddr, err := webclient.GetTunnelAddr(
+			&webclient.Config{Context: ctx, ProxyAddr: discoveryAddr, Insecure: insecure})
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/api/client/credentials.go b/api/client/credentials.go
index 2b4e13312d03a..c2660c0e181c6 100644
--- a/api/client/credentials.go
+++ b/api/client/credentials.go
@@ -19,7 +19,7 @@ package client
 import (
 	"crypto/tls"
 	"crypto/x509"
-	"io/ioutil"
+	"os"
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/identityfile"
@@ -115,7 +115,7 @@ func (c *keypairCreds) TLSConfig() (*tls.Config, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	cas, err := ioutil.ReadFile(c.caFile)
+	cas, err := os.ReadFile(c.caFile)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
diff --git a/api/client/credentials_test.go b/api/client/credentials_test.go
index faa09c4245d6f..7985d9a4b4a5a 100644
--- a/api/client/credentials_test.go
+++ b/api/client/credentials_test.go
@@ -19,7 +19,6 @@ package client
 import (
 	"crypto/tls"
 	"crypto/x509"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -153,11 +152,11 @@ func TestLoadKeyPair(t *testing.T) {
 	// Write key pair and CAs files from bytes.
 	path := t.TempDir() + "username"
 	certPath, keyPath, caPath := path+".crt", path+".key", path+".cas"
-	err := ioutil.WriteFile(certPath, tlsCert, 0600)
+	err := os.WriteFile(certPath, tlsCert, 0600)
 	require.NoError(t, err)
-	err = ioutil.WriteFile(keyPath, keyPEM, 0600)
+	err = os.WriteFile(keyPath, keyPEM, 0600)
 	require.NoError(t, err)
-	err = ioutil.WriteFile(caPath, tlsCACert, 0600)
+	err = os.WriteFile(caPath, tlsCACert, 0600)
 	require.NoError(t, err)
 
 	// Load key pair from disk.
@@ -185,20 +184,7 @@ func TestLoadProfile(t *testing.T) {
 			SiteName:     "example.com",
 			Username:     "testUser",
 			Dir:          dir,
-		}, false)
-		testProfileContents(t, dir, profileName)
-	})
-
-	// DELETE IN 8.0.0
-	t.Run("old profile", func(t *testing.T) {
-		t.Parallel()
-		dir := t.TempDir()
-		writeProfile(t, &profile.Profile{
-			WebProxyAddr: profileName + ":3080",
-			SiteName:     "example.com",
-			Username:     "testUser",
-			Dir:          dir,
-		}, true)
+		})
 		testProfileContents(t, dir, profileName)
 	})
 
@@ -236,24 +222,18 @@ func testProfileContents(t *testing.T, dir, name string) {
 	require.NoError(t, err)
 }
 
-func writeProfile(t *testing.T, p *profile.Profile, oldSSHPath bool) {
+func writeProfile(t *testing.T, p *profile.Profile) {
 	// Save profile and keys to disk.
 	require.NoError(t, p.SaveToDir(p.Dir, true))
 	require.NoError(t, os.MkdirAll(p.KeyDir(), 0700))
 	require.NoError(t, os.MkdirAll(p.ProxyKeyDir(), 0700))
 	require.NoError(t, os.MkdirAll(p.TLSClusterCASDir(), 0700))
-	require.NoError(t, ioutil.WriteFile(p.UserKeyPath(), keyPEM, 0600))
-	require.NoError(t, ioutil.WriteFile(p.TLSCertPath(), tlsCert, 0600))
-	require.NoError(t, ioutil.WriteFile(p.TLSCAPathCluster(p.SiteName), tlsCACert, 0600))
-	require.NoError(t, ioutil.WriteFile(p.KnownHostsPath(), sshCACert, 0600))
-	// If oldSSHPath is specified, write the sshCert to the old ssh cert path.
-	// DELETE IN 8.0.0
-	if oldSSHPath {
-		require.NoError(t, ioutil.WriteFile(p.OldSSHCertPath(), sshCert, 0600))
-		return
-	}
+	require.NoError(t, os.WriteFile(p.UserKeyPath(), keyPEM, 0600))
+	require.NoError(t, os.WriteFile(p.TLSCertPath(), tlsCert, 0600))
+	require.NoError(t, os.WriteFile(p.TLSCAPathCluster(p.SiteName), tlsCACert, 0600))
+	require.NoError(t, os.WriteFile(p.KnownHostsPath(), sshCACert, 0600))
 	require.NoError(t, os.MkdirAll(p.SSHDir(), 0700))
-	require.NoError(t, ioutil.WriteFile(p.SSHCertPath(), sshCert, 0600))
+	require.NoError(t, os.WriteFile(p.SSHCertPath(), sshCert, 0600))
 }
 
 func getExpectedTLSConfig(t *testing.T) *tls.Config {
diff --git a/api/client/proto/authservice.pb.go b/api/client/proto/authservice.pb.go
index 5ae16cf258b81..abeac68187fcd 100644
--- a/api/client/proto/authservice.pb.go
+++ b/api/client/proto/authservice.pb.go
@@ -105,6 +105,39 @@ func (DeviceType) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptor_ce8bd90b12161215, []int{1}
 }
 
+type DeviceUsage int32
+
+const (
+	DeviceUsage_DEVICE_USAGE_UNSPECIFIED DeviceUsage = 0
+	// Device intended for MFA use, but not for passwordless.
+	// Allows both FIDO and FIDO2 devices.
+	// Resident keys not required.
+	DeviceUsage_DEVICE_USAGE_MFA DeviceUsage = 1
+	// Device intended for both MFA and passwordless.
+	// Requires a FIDO2 device and takes a resident key slot.
+	DeviceUsage_DEVICE_USAGE_PASSWORDLESS DeviceUsage = 2
+)
+
+var DeviceUsage_name = map[int32]string{
+	0: "DEVICE_USAGE_UNSPECIFIED",
+	1: "DEVICE_USAGE_MFA",
+	2: "DEVICE_USAGE_PASSWORDLESS",
+}
+
+var DeviceUsage_value = map[string]int32{
+	"DEVICE_USAGE_UNSPECIFIED":  0,
+	"DEVICE_USAGE_MFA":          1,
+	"DEVICE_USAGE_PASSWORDLESS": 2,
+}
+
+func (x DeviceUsage) String() string {
+	return proto.EnumName(DeviceUsage_name, int32(x))
+}
+
+func (DeviceUsage) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_ce8bd90b12161215, []int{2}
+}
+
 // Order specifies any ordering of some objects as returned in regards to some aspect
 // of said objects which may be trivially ordered such as a timestamp.
 type Order int32
@@ -129,7 +162,7 @@ func (x Order) String() string {
 }
 
 func (Order) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{2}
+	return fileDescriptor_ce8bd90b12161215, []int{3}
 }
 
 type UserCertsRequest_CertUsage int32
@@ -5694,11 +5727,14 @@ func (*AddMFADeviceResponse) XXX_OneofWrappers() []interface{} {
 
 // AddMFADeviceRequestInit describes the new MFA device.
 type AddMFADeviceRequestInit struct {
-	DeviceName           string     `protobuf:"bytes,1,opt,name=DeviceName,proto3" json:"DeviceName,omitempty"`
-	DeviceType           DeviceType `protobuf:"varint,3,opt,name=DeviceType,proto3,enum=proto.DeviceType" json:"DeviceType,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
-	XXX_unrecognized     []byte     `json:"-"`
-	XXX_sizecache        int32      `json:"-"`
+	DeviceName string     `protobuf:"bytes,1,opt,name=DeviceName,proto3" json:"DeviceName,omitempty"`
+	DeviceType DeviceType `protobuf:"varint,3,opt,name=DeviceType,proto3,enum=proto.DeviceType" json:"DeviceType,omitempty"`
+	// DeviceUsage is the requested usage for the device.
+	// Defaults to DEVICE_USAGE_MFA.
+	DeviceUsage          DeviceUsage `protobuf:"varint,4,opt,name=DeviceUsage,proto3,enum=proto.DeviceUsage" json:"device_usage,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
+	XXX_unrecognized     []byte      `json:"-"`
+	XXX_sizecache        int32       `json:"-"`
 }
 
 func (m *AddMFADeviceRequestInit) Reset()         { *m = AddMFADeviceRequestInit{} }
@@ -5748,6 +5784,13 @@ func (m *AddMFADeviceRequestInit) GetDeviceType() DeviceType {
 	return DeviceType_DEVICE_TYPE_UNSPECIFIED
 }
 
+func (m *AddMFADeviceRequestInit) GetDeviceUsage() DeviceUsage {
+	if m != nil {
+		return m.DeviceUsage
+	}
+	return DeviceUsage_DEVICE_USAGE_UNSPECIFIED
+}
+
 // AddMFADeviceResponseAck is a confirmation of successful device registration.
 type AddMFADeviceResponseAck struct {
 	Device               *types.MFADevice `protobuf:"bytes,1,opt,name=Device,proto3" json:"Device,omitempty"`
@@ -8761,16 +8804,97 @@ func (m *UserCredentials) GetPassword() []byte {
 	return nil
 }
 
+// ContextUser marks requests that rely in the currently authenticated user.
+type ContextUser struct {
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ContextUser) Reset()         { *m = ContextUser{} }
+func (m *ContextUser) String() string { return proto.CompactTextString(m) }
+func (*ContextUser) ProtoMessage()    {}
+func (*ContextUser) Descriptor() ([]byte, []int) {
+	return fileDescriptor_ce8bd90b12161215, []int{130}
+}
+func (m *ContextUser) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ContextUser) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ContextUser.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ContextUser) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ContextUser.Merge(m, src)
+}
+func (m *ContextUser) XXX_Size() int {
+	return m.Size()
+}
+func (m *ContextUser) XXX_DiscardUnknown() {
+	xxx_messageInfo_ContextUser.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ContextUser proto.InternalMessageInfo
+
+// Passwordless marks requests for passwordless challenges.
+type Passwordless struct {
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Passwordless) Reset()         { *m = Passwordless{} }
+func (m *Passwordless) String() string { return proto.CompactTextString(m) }
+func (*Passwordless) ProtoMessage()    {}
+func (*Passwordless) Descriptor() ([]byte, []int) {
+	return fileDescriptor_ce8bd90b12161215, []int{131}
+}
+func (m *Passwordless) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *Passwordless) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_Passwordless.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *Passwordless) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Passwordless.Merge(m, src)
+}
+func (m *Passwordless) XXX_Size() int {
+	return m.Size()
+}
+func (m *Passwordless) XXX_DiscardUnknown() {
+	xxx_messageInfo_Passwordless.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Passwordless proto.InternalMessageInfo
+
 // CreateAuthenticateChallengeRequest is a request for creating MFA authentication challenges for a
 // users mfa devices.
 type CreateAuthenticateChallengeRequest struct {
 	// Request defines how the request will be verified before creating challenges.
-	// This field can be empty, which implies the request is to create challenges for the
-	// user in context (logged in user).
+	// An empty Request is equivalent to context_user being set.
 	//
 	// Types that are valid to be assigned to Request:
 	//	*CreateAuthenticateChallengeRequest_UserCredentials
 	//	*CreateAuthenticateChallengeRequest_RecoveryStartTokenID
+	//	*CreateAuthenticateChallengeRequest_ContextUser
+	//	*CreateAuthenticateChallengeRequest_Passwordless
 	Request              isCreateAuthenticateChallengeRequest_Request `protobuf_oneof:"Request"`
 	XXX_NoUnkeyedLiteral struct{}                                     `json:"-"`
 	XXX_unrecognized     []byte                                       `json:"-"`
@@ -8781,7 +8905,7 @@ func (m *CreateAuthenticateChallengeRequest) Reset()         { *m = CreateAuthen
 func (m *CreateAuthenticateChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateAuthenticateChallengeRequest) ProtoMessage()    {}
 func (*CreateAuthenticateChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{130}
+	return fileDescriptor_ce8bd90b12161215, []int{132}
 }
 func (m *CreateAuthenticateChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8822,11 +8946,21 @@ type CreateAuthenticateChallengeRequest_UserCredentials struct {
 type CreateAuthenticateChallengeRequest_RecoveryStartTokenID struct {
 	RecoveryStartTokenID string `protobuf:"bytes,2,opt,name=RecoveryStartTokenID,proto3,oneof" json:"recovery_start_token_id,omitempty"`
 }
+type CreateAuthenticateChallengeRequest_ContextUser struct {
+	ContextUser *ContextUser `protobuf:"bytes,3,opt,name=ContextUser,proto3,oneof" json:"context_user,omitempty"`
+}
+type CreateAuthenticateChallengeRequest_Passwordless struct {
+	Passwordless *Passwordless `protobuf:"bytes,4,opt,name=Passwordless,proto3,oneof" json:"passwordless,omitempty"`
+}
 
 func (*CreateAuthenticateChallengeRequest_UserCredentials) isCreateAuthenticateChallengeRequest_Request() {
 }
 func (*CreateAuthenticateChallengeRequest_RecoveryStartTokenID) isCreateAuthenticateChallengeRequest_Request() {
 }
+func (*CreateAuthenticateChallengeRequest_ContextUser) isCreateAuthenticateChallengeRequest_Request() {
+}
+func (*CreateAuthenticateChallengeRequest_Passwordless) isCreateAuthenticateChallengeRequest_Request() {
+}
 
 func (m *CreateAuthenticateChallengeRequest) GetRequest() isCreateAuthenticateChallengeRequest_Request {
 	if m != nil {
@@ -8849,11 +8983,27 @@ func (m *CreateAuthenticateChallengeRequest) GetRecoveryStartTokenID() string {
 	return ""
 }
 
+func (m *CreateAuthenticateChallengeRequest) GetContextUser() *ContextUser {
+	if x, ok := m.GetRequest().(*CreateAuthenticateChallengeRequest_ContextUser); ok {
+		return x.ContextUser
+	}
+	return nil
+}
+
+func (m *CreateAuthenticateChallengeRequest) GetPasswordless() *Passwordless {
+	if x, ok := m.GetRequest().(*CreateAuthenticateChallengeRequest_Passwordless); ok {
+		return x.Passwordless
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*CreateAuthenticateChallengeRequest) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
 		(*CreateAuthenticateChallengeRequest_UserCredentials)(nil),
 		(*CreateAuthenticateChallengeRequest_RecoveryStartTokenID)(nil),
+		(*CreateAuthenticateChallengeRequest_ContextUser)(nil),
+		(*CreateAuthenticateChallengeRequest_Passwordless)(nil),
 	}
 }
 
@@ -8875,7 +9025,7 @@ func (m *CreatePrivilegeTokenRequest) Reset()         { *m = CreatePrivilegeToke
 func (m *CreatePrivilegeTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*CreatePrivilegeTokenRequest) ProtoMessage()    {}
 func (*CreatePrivilegeTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{131}
+	return fileDescriptor_ce8bd90b12161215, []int{133}
 }
 func (m *CreatePrivilegeTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8918,17 +9068,20 @@ type CreateRegisterChallengeRequest struct {
 	// All user token types are accepted except UserTokenTypeRecoveryStart.
 	TokenID string `protobuf:"bytes,1,opt,name=TokenID,proto3" json:"token_id"`
 	// DeviceType is the type of MFA device to make a register challenge for.
-	DeviceType           DeviceType `protobuf:"varint,2,opt,name=DeviceType,proto3,enum=proto.DeviceType" json:"device_type"`
-	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
-	XXX_unrecognized     []byte     `json:"-"`
-	XXX_sizecache        int32      `json:"-"`
+	DeviceType DeviceType `protobuf:"varint,2,opt,name=DeviceType,proto3,enum=proto.DeviceType" json:"device_type"`
+	// DeviceUsage is the requested usage for the device.
+	// Defaults to DEVICE_USAGE_MFA.
+	DeviceUsage          DeviceUsage `protobuf:"varint,3,opt,name=DeviceUsage,proto3,enum=proto.DeviceUsage" json:"device_usage,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
+	XXX_unrecognized     []byte      `json:"-"`
+	XXX_sizecache        int32       `json:"-"`
 }
 
 func (m *CreateRegisterChallengeRequest) Reset()         { *m = CreateRegisterChallengeRequest{} }
 func (m *CreateRegisterChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateRegisterChallengeRequest) ProtoMessage()    {}
 func (*CreateRegisterChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{132}
+	return fileDescriptor_ce8bd90b12161215, []int{134}
 }
 func (m *CreateRegisterChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8971,6 +9124,13 @@ func (m *CreateRegisterChallengeRequest) GetDeviceType() DeviceType {
 	return DeviceType_DEVICE_TYPE_UNSPECIFIED
 }
 
+func (m *CreateRegisterChallengeRequest) GetDeviceUsage() DeviceUsage {
+	if m != nil {
+		return m.DeviceUsage
+	}
+	return DeviceUsage_DEVICE_USAGE_UNSPECIFIED
+}
+
 // PaginatedResource represents one of the supported resources.
 type PaginatedResource struct {
 	// Resource is the resource itself.
@@ -8980,6 +9140,8 @@ type PaginatedResource struct {
 	//	*PaginatedResource_AppServer
 	//	*PaginatedResource_Node
 	//	*PaginatedResource_KubeService
+	//	*PaginatedResource_WindowsDesktop
+	//	*PaginatedResource_KubeCluster
 	Resource             isPaginatedResource_Resource `protobuf_oneof:"resource"`
 	XXX_NoUnkeyedLiteral struct{}                     `json:"-"`
 	XXX_unrecognized     []byte                       `json:"-"`
@@ -8990,7 +9152,7 @@ func (m *PaginatedResource) Reset()         { *m = PaginatedResource{} }
 func (m *PaginatedResource) String() string { return proto.CompactTextString(m) }
 func (*PaginatedResource) ProtoMessage()    {}
 func (*PaginatedResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{133}
+	return fileDescriptor_ce8bd90b12161215, []int{135}
 }
 func (m *PaginatedResource) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9037,11 +9199,19 @@ type PaginatedResource_Node struct {
 type PaginatedResource_KubeService struct {
 	KubeService *types.ServerV2 `protobuf:"bytes,4,opt,name=KubeService,proto3,oneof" json:"kube_service,omitempty"`
 }
+type PaginatedResource_WindowsDesktop struct {
+	WindowsDesktop *types.WindowsDesktopV3 `protobuf:"bytes,5,opt,name=WindowsDesktop,proto3,oneof" json:"windows_desktop,omitempty"`
+}
+type PaginatedResource_KubeCluster struct {
+	KubeCluster *types.KubernetesClusterV3 `protobuf:"bytes,6,opt,name=KubeCluster,proto3,oneof" json:"kube_cluster,omitempty"`
+}
 
 func (*PaginatedResource_DatabaseServer) isPaginatedResource_Resource() {}
 func (*PaginatedResource_AppServer) isPaginatedResource_Resource()      {}
 func (*PaginatedResource_Node) isPaginatedResource_Resource()           {}
 func (*PaginatedResource_KubeService) isPaginatedResource_Resource()    {}
+func (*PaginatedResource_WindowsDesktop) isPaginatedResource_Resource() {}
+func (*PaginatedResource_KubeCluster) isPaginatedResource_Resource()    {}
 
 func (m *PaginatedResource) GetResource() isPaginatedResource_Resource {
 	if m != nil {
@@ -9078,6 +9248,20 @@ func (m *PaginatedResource) GetKubeService() *types.ServerV2 {
 	return nil
 }
 
+func (m *PaginatedResource) GetWindowsDesktop() *types.WindowsDesktopV3 {
+	if x, ok := m.GetResource().(*PaginatedResource_WindowsDesktop); ok {
+		return x.WindowsDesktop
+	}
+	return nil
+}
+
+func (m *PaginatedResource) GetKubeCluster() *types.KubernetesClusterV3 {
+	if x, ok := m.GetResource().(*PaginatedResource_KubeCluster); ok {
+		return x.KubeCluster
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*PaginatedResource) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -9085,6 +9269,8 @@ func (*PaginatedResource) XXX_OneofWrappers() []interface{} {
 		(*PaginatedResource_AppServer)(nil),
 		(*PaginatedResource_Node)(nil),
 		(*PaginatedResource_KubeService)(nil),
+		(*PaginatedResource_WindowsDesktop)(nil),
+		(*PaginatedResource_KubeCluster)(nil),
 	}
 }
 
@@ -9111,17 +9297,19 @@ type ListResourcesRequest struct {
 	SortBy types.SortBy `protobuf:"bytes,8,opt,name=SortBy,proto3" json:"sort_by,omitempty"`
 	// NeedTotalCount indicates whether or not the caller also wants the total number of resources
 	// after filtering.
-	NeedTotalCount       bool     `protobuf:"varint,9,opt,name=NeedTotalCount,proto3" json:"need_total_count,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	NeedTotalCount bool `protobuf:"varint,9,opt,name=NeedTotalCount,proto3" json:"need_total_count,omitempty"`
+	// WindowsDesktopFilter specifies windows desktop specific filters.
+	WindowsDesktopFilter types.WindowsDesktopFilter `protobuf:"bytes,10,opt,name=WindowsDesktopFilter,proto3" json:"windows_desktop_filter,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                   `json:"-"`
+	XXX_unrecognized     []byte                     `json:"-"`
+	XXX_sizecache        int32                      `json:"-"`
 }
 
 func (m *ListResourcesRequest) Reset()         { *m = ListResourcesRequest{} }
 func (m *ListResourcesRequest) String() string { return proto.CompactTextString(m) }
 func (*ListResourcesRequest) ProtoMessage()    {}
 func (*ListResourcesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{134}
+	return fileDescriptor_ce8bd90b12161215, []int{136}
 }
 func (m *ListResourcesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9213,6 +9401,13 @@ func (m *ListResourcesRequest) GetNeedTotalCount() bool {
 	return false
 }
 
+func (m *ListResourcesRequest) GetWindowsDesktopFilter() types.WindowsDesktopFilter {
+	if m != nil {
+		return m.WindowsDesktopFilter
+	}
+	return types.WindowsDesktopFilter{}
+}
+
 // ListResourceResponse response of ListResources.
 type ListResourcesResponse struct {
 	// Resources is a list of resource.
@@ -9232,7 +9427,7 @@ func (m *ListResourcesResponse) Reset()         { *m = ListResourcesResponse{} }
 func (m *ListResourcesResponse) String() string { return proto.CompactTextString(m) }
 func (*ListResourcesResponse) ProtoMessage()    {}
 func (*ListResourcesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{135}
+	return fileDescriptor_ce8bd90b12161215, []int{137}
 }
 func (m *ListResourcesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9327,7 +9522,7 @@ func (m *CreateSessionTrackerRequest) Reset()         { *m = CreateSessionTracke
 func (m *CreateSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateSessionTrackerRequest) ProtoMessage()    {}
 func (*CreateSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{136}
+	return fileDescriptor_ce8bd90b12161215, []int{138}
 }
 func (m *CreateSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9467,7 +9662,7 @@ func (m *GetSessionTrackerRequest) Reset()         { *m = GetSessionTrackerReque
 func (m *GetSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSessionTrackerRequest) ProtoMessage()    {}
 func (*GetSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{137}
+	return fileDescriptor_ce8bd90b12161215, []int{139}
 }
 func (m *GetSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9516,7 +9711,7 @@ func (m *RemoveSessionTrackerRequest) Reset()         { *m = RemoveSessionTracke
 func (m *RemoveSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*RemoveSessionTrackerRequest) ProtoMessage()    {}
 func (*RemoveSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{138}
+	return fileDescriptor_ce8bd90b12161215, []int{140}
 }
 func (m *RemoveSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9564,7 +9759,7 @@ func (m *SessionTrackerUpdateState) Reset()         { *m = SessionTrackerUpdateS
 func (m *SessionTrackerUpdateState) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerUpdateState) ProtoMessage()    {}
 func (*SessionTrackerUpdateState) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{139}
+	return fileDescriptor_ce8bd90b12161215, []int{141}
 }
 func (m *SessionTrackerUpdateState) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9612,7 +9807,7 @@ func (m *SessionTrackerAddParticipant) Reset()         { *m = SessionTrackerAddP
 func (m *SessionTrackerAddParticipant) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerAddParticipant) ProtoMessage()    {}
 func (*SessionTrackerAddParticipant) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{140}
+	return fileDescriptor_ce8bd90b12161215, []int{142}
 }
 func (m *SessionTrackerAddParticipant) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9660,7 +9855,7 @@ func (m *SessionTrackerRemoveParticipant) Reset()         { *m = SessionTrackerR
 func (m *SessionTrackerRemoveParticipant) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerRemoveParticipant) ProtoMessage()    {}
 func (*SessionTrackerRemoveParticipant) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{141}
+	return fileDescriptor_ce8bd90b12161215, []int{143}
 }
 func (m *SessionTrackerRemoveParticipant) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9714,7 +9909,7 @@ func (m *UpdateSessionTrackerRequest) Reset()         { *m = UpdateSessionTracke
 func (m *UpdateSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*UpdateSessionTrackerRequest) ProtoMessage()    {}
 func (*UpdateSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{142}
+	return fileDescriptor_ce8bd90b12161215, []int{144}
 }
 func (m *UpdateSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9820,7 +10015,7 @@ func (m *PresenceMFAChallengeRequest) Reset()         { *m = PresenceMFAChalleng
 func (m *PresenceMFAChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*PresenceMFAChallengeRequest) ProtoMessage()    {}
 func (*PresenceMFAChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{143}
+	return fileDescriptor_ce8bd90b12161215, []int{145}
 }
 func (m *PresenceMFAChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9871,7 +10066,7 @@ func (m *PresenceMFAChallengeSend) Reset()         { *m = PresenceMFAChallengeSe
 func (m *PresenceMFAChallengeSend) String() string { return proto.CompactTextString(m) }
 func (*PresenceMFAChallengeSend) ProtoMessage()    {}
 func (*PresenceMFAChallengeSend) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{144}
+	return fileDescriptor_ce8bd90b12161215, []int{146}
 }
 func (m *PresenceMFAChallengeSend) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9948,6 +10143,7 @@ func (*PresenceMFAChallengeSend) XXX_OneofWrappers() []interface{} {
 func init() {
 	proto.RegisterEnum("proto.Operation", Operation_name, Operation_value)
 	proto.RegisterEnum("proto.DeviceType", DeviceType_name, DeviceType_value)
+	proto.RegisterEnum("proto.DeviceUsage", DeviceUsage_name, DeviceUsage_value)
 	proto.RegisterEnum("proto.Order", Order_name, Order_value)
 	proto.RegisterEnum("proto.UserCertsRequest_CertUsage", UserCertsRequest_CertUsage_name, UserCertsRequest_CertUsage_value)
 	proto.RegisterType((*Event)(nil), "proto.Event")
@@ -10082,6 +10278,8 @@ func init() {
 	proto.RegisterType((*GetAccountRecoveryTokenRequest)(nil), "proto.GetAccountRecoveryTokenRequest")
 	proto.RegisterType((*GetAccountRecoveryCodesRequest)(nil), "proto.GetAccountRecoveryCodesRequest")
 	proto.RegisterType((*UserCredentials)(nil), "proto.UserCredentials")
+	proto.RegisterType((*ContextUser)(nil), "proto.ContextUser")
+	proto.RegisterType((*Passwordless)(nil), "proto.Passwordless")
 	proto.RegisterType((*CreateAuthenticateChallengeRequest)(nil), "proto.CreateAuthenticateChallengeRequest")
 	proto.RegisterType((*CreatePrivilegeTokenRequest)(nil), "proto.CreatePrivilegeTokenRequest")
 	proto.RegisterType((*CreateRegisterChallengeRequest)(nil), "proto.CreateRegisterChallengeRequest")
@@ -10103,586 +10301,598 @@ func init() {
 func init() { proto.RegisterFile("authservice.proto", fileDescriptor_ce8bd90b12161215) }
 
 var fileDescriptor_ce8bd90b12161215 = []byte{
-	// 9254 bytes of a gzipped FileDescriptorProto
+	// 9444 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x7d, 0x5b, 0x6c, 0x1b, 0xc9,
-	0x96, 0x98, 0x49, 0xbd, 0xc8, 0xa3, 0x87, 0xa9, 0x92, 0x64, 0xd1, 0xb4, 0x2c, 0x7a, 0xda, 0x33,
-	0xbe, 0x9e, 0xd9, 0x59, 0xdb, 0x23, 0xcd, 0xfb, 0x79, 0x49, 0x4a, 0x96, 0x64, 0xcb, 0xb2, 0xa6,
-	0x29, 0xd3, 0x93, 0x7b, 0x67, 0xc3, 0x69, 0x91, 0x65, 0xa9, 0x23, 0x8a, 0xcd, 0xdb, 0xdd, 0xb4,
-	0xc7, 0x08, 0x12, 0xe4, 0xb5, 0x49, 0x10, 0x24, 0xc0, 0x06, 0xc8, 0x22, 0xc9, 0x57, 0x16, 0x9b,
-	0x00, 0x41, 0x12, 0xec, 0x4f, 0x10, 0xe4, 0x33, 0xbf, 0xb9, 0x09, 0x10, 0x24, 0x3f, 0x8b, 0x00,
-	0xfb, 0xc1, 0xdd, 0xdc, 0x4f, 0x7d, 0x05, 0x08, 0x12, 0x20, 0xf7, 0x2b, 0xa8, 0x67, 0x57, 0x75,
-	0x77, 0x91, 0x92, 0xed, 0xdc, 0xfd, 0xb1, 0xd5, 0xa7, 0xea, 0x9c, 0xaa, 0x3a, 0x75, 0xea, 0xd4,
-	0xa9, 0x53, 0xa7, 0x0e, 0x61, 0xde, 0xe9, 0x87, 0xc7, 0x01, 0xf6, 0x9f, 0xbb, 0x2d, 0x7c, 0xa7,
-	0xe7, 0x7b, 0xa1, 0x87, 0x26, 0xe8, 0x7f, 0xa5, 0xc5, 0x23, 0xef, 0xc8, 0xa3, 0x7f, 0xde, 0x25,
-	0x7f, 0xb1, 0xc2, 0xd2, 0xb5, 0x23, 0xcf, 0x3b, 0xea, 0xe0, 0xbb, 0xf4, 0xeb, 0xb0, 0xff, 0xec,
-	0x2e, 0x3e, 0xed, 0x85, 0x2f, 0x79, 0x61, 0x39, 0x5e, 0x18, 0xba, 0xa7, 0x38, 0x08, 0x9d, 0xd3,
+	0x96, 0x98, 0x49, 0xbd, 0xc8, 0xa3, 0x87, 0xe9, 0x92, 0x64, 0xd1, 0xb4, 0x2c, 0x7a, 0xda, 0x33,
+	0xbe, 0x9e, 0xd9, 0x59, 0xdb, 0x23, 0xcd, 0xfb, 0xb9, 0x24, 0x25, 0x4b, 0xb2, 0x65, 0x59, 0xd3,
+	0x94, 0xe8, 0xc9, 0xdc, 0xd9, 0x70, 0x5a, 0x64, 0x59, 0xea, 0x88, 0x62, 0xf3, 0x76, 0x37, 0xed,
+	0x31, 0x82, 0x04, 0x79, 0x6d, 0x12, 0x04, 0x08, 0xb0, 0x01, 0xb2, 0x48, 0x82, 0x7c, 0x64, 0xb1,
+	0xc9, 0x4f, 0x12, 0xec, 0x4f, 0x10, 0xe4, 0x33, 0x5f, 0x01, 0x72, 0x13, 0x20, 0x48, 0x7e, 0x16,
+	0x01, 0xf6, 0x83, 0x7b, 0x73, 0x3f, 0xf5, 0x1b, 0x24, 0x40, 0xee, 0x57, 0x50, 0xcf, 0xae, 0xea,
+	0xee, 0x22, 0x25, 0xdb, 0xd9, 0xfc, 0xd8, 0xea, 0x53, 0x75, 0x4e, 0x55, 0x9d, 0x3a, 0x75, 0xea,
+	0xd4, 0xa9, 0x53, 0x87, 0x70, 0xc5, 0xe9, 0x87, 0xc7, 0x01, 0xf6, 0x9f, 0xbb, 0x2d, 0x7c, 0xb7,
+	0xe7, 0x7b, 0xa1, 0x87, 0x26, 0xe8, 0x7f, 0xa5, 0x85, 0x23, 0xef, 0xc8, 0xa3, 0x7f, 0xde, 0x23,
+	0x7f, 0xb1, 0xc2, 0xd2, 0xf5, 0x23, 0xcf, 0x3b, 0xea, 0xe0, 0x7b, 0xf4, 0xeb, 0xb0, 0xff, 0xec,
+	0x1e, 0x3e, 0xed, 0x85, 0x2f, 0x79, 0x61, 0x39, 0x5e, 0x18, 0xba, 0xa7, 0x38, 0x08, 0x9d, 0xd3,
 	0x1e, 0xaf, 0x30, 0xdd, 0xc2, 0x7e, 0x18, 0xf0, 0x8f, 0x4f, 0x8e, 0xdc, 0xf0, 0xb8, 0x7f, 0x78,
-	0xa7, 0xe5, 0x9d, 0xde, 0x3d, 0xf2, 0x9d, 0xe7, 0x6e, 0xe8, 0x84, 0xae, 0xd7, 0x75, 0x3a, 0x77,
-	0x43, 0xdc, 0xc1, 0x3d, 0xcf, 0x0f, 0xef, 0x3a, 0x3d, 0xf7, 0x6e, 0xf8, 0xb2, 0x87, 0x03, 0xf6,
+	0xb7, 0xe5, 0x9d, 0xde, 0x3b, 0xf2, 0x9d, 0xe7, 0x6e, 0xe8, 0x84, 0xae, 0xd7, 0x75, 0x3a, 0xf7,
+	0x42, 0xdc, 0xc1, 0x3d, 0xcf, 0x0f, 0xef, 0x39, 0x3d, 0xf7, 0x5e, 0xf8, 0xb2, 0x87, 0x03, 0xf6,
 	0x2f, 0x47, 0xac, 0x5d, 0x04, 0xf1, 0x05, 0x3e, 0x24, 0x43, 0xec, 0xca, 0x3f, 0x5e, 0x89, 0x88,
 	0xef, 0xf4, 0x7a, 0xd8, 0x8f, 0xfe, 0xe0, 0x44, 0xbe, 0xb9, 0x08, 0x11, 0xfc, 0x1c, 0x77, 0x43,
-	0xf1, 0x1f, 0x23, 0x60, 0xfd, 0x9b, 0x45, 0x98, 0xd8, 0x24, 0x00, 0xf4, 0x29, 0x8c, 0x1f, 0xbc,
-	0xec, 0xe1, 0x62, 0xe6, 0x46, 0xe6, 0xf6, 0xdc, 0x5a, 0x81, 0x95, 0xdf, 0x79, 0xdc, 0xc3, 0x3e,
+	0xf1, 0x1f, 0x23, 0x60, 0xfd, 0xeb, 0x05, 0x98, 0xd8, 0x20, 0x00, 0xf4, 0x29, 0x8c, 0xef, 0xbf,
+	0xec, 0xe1, 0x62, 0xe6, 0x66, 0xe6, 0xce, 0xdc, 0x6a, 0x81, 0x95, 0xdf, 0x7d, 0xd2, 0xc3, 0x3e,
 	0x25, 0x59, 0x45, 0x67, 0x83, 0xf2, 0x1c, 0x21, 0xf4, 0xbe, 0x77, 0xea, 0x86, 0x94, 0xeb, 0x36,
-	0xc5, 0x40, 0x4f, 0x61, 0xce, 0xc6, 0x81, 0xd7, 0xf7, 0x5b, 0x78, 0x1b, 0x3b, 0x6d, 0xec, 0x17,
-	0xb3, 0x37, 0x32, 0xb7, 0xa7, 0xd7, 0x96, 0xee, 0x30, 0xa6, 0xe9, 0x85, 0xd5, 0x2b, 0x67, 0x83,
-	0x32, 0xf2, 0x39, 0x2c, 0x22, 0xb6, 0x7d, 0xc9, 0x8e, 0x91, 0x41, 0xdf, 0xc3, 0x6c, 0x0d, 0xfb,
-	0x61, 0xa5, 0x1f, 0x1e, 0x7b, 0xbe, 0x1b, 0xbe, 0x2c, 0x8e, 0x51, 0xba, 0x57, 0x38, 0x5d, 0xad,
-	0xac, 0xb1, 0x56, 0x5d, 0x39, 0x1b, 0x94, 0x8b, 0x64, 0x82, 0x9b, 0x8e, 0x80, 0x6a, 0xe4, 0x75,
-	0x62, 0xe8, 0x3b, 0x98, 0xa9, 0x13, 0x76, 0xb5, 0x0e, 0xbc, 0x13, 0xdc, 0x0d, 0x8a, 0xe3, 0x5a,
-	0xa7, 0xd5, 0xa2, 0xc6, 0x5a, 0xf5, 0xda, 0xd9, 0xa0, 0xbc, 0x1c, 0x50, 0x58, 0x33, 0xa4, 0x40,
-	0x8d, 0xb4, 0x46, 0x09, 0xfd, 0x00, 0x73, 0xfb, 0xbe, 0xf7, 0xdc, 0x0d, 0x5c, 0xaf, 0x4b, 0x41,
-	0xc5, 0x09, 0x4a, 0x7b, 0x99, 0xd3, 0xd6, 0x0b, 0x1b, 0x6b, 0xd5, 0xeb, 0x67, 0x83, 0xf2, 0xd5,
-	0x9e, 0x80, 0xb2, 0x06, 0x74, 0xce, 0xe8, 0x28, 0xe8, 0x00, 0xa6, 0x6b, 0x9d, 0x7e, 0x10, 0x62,
-	0x7f, 0xcf, 0x39, 0xc5, 0xc5, 0x49, 0x4a, 0x7e, 0x51, 0xf0, 0x25, 0x2a, 0x69, 0xac, 0x55, 0x4b,
-	0x67, 0x83, 0xf2, 0x95, 0x16, 0x03, 0x35, 0xbb, 0xce, 0xa9, 0xce, 0x72, 0x95, 0x0c, 0xfa, 0x04,
-	0xc6, 0x9f, 0x04, 0xd8, 0x2f, 0xe6, 0x28, 0xb9, 0x59, 0x4e, 0x8e, 0x80, 0x1a, 0x6b, 0x6c, 0xfe,
-	0xfb, 0x01, 0xf6, 0x35, 0x7c, 0x8a, 0x40, 0x10, 0x6d, 0xaf, 0x83, 0x8b, 0x79, 0x0d, 0x91, 0x80,
-	0x1a, 0x1f, 0x31, 0x44, 0xdf, 0xeb, 0xe8, 0x0d, 0x53, 0x04, 0xb4, 0x03, 0x79, 0xd2, 0x72, 0xd0,
-	0x73, 0x5a, 0xb8, 0x08, 0x14, 0xbb, 0xc0, 0xb1, 0x25, 0xbc, 0xba, 0x7c, 0x36, 0x28, 0x2f, 0x74,
-	0xc5, 0xa7, 0x46, 0x25, 0xc2, 0x46, 0xdf, 0xc0, 0x64, 0x1d, 0xfb, 0xcf, 0xb1, 0x5f, 0x9c, 0xa6,
-	0x74, 0x2e, 0x8b, 0x89, 0xa4, 0xc0, 0xc6, 0x5a, 0x75, 0xf1, 0x6c, 0x50, 0x2e, 0x04, 0xf4, 0x4b,
-	0xa3, 0xc1, 0xd1, 0x88, 0xb4, 0xd9, 0xf8, 0x39, 0xf6, 0x03, 0x7c, 0xd0, 0xef, 0x76, 0x71, 0xa7,
-	0x38, 0xa3, 0x49, 0x9b, 0x56, 0x26, 0xa4, 0xcd, 0x67, 0xc0, 0x66, 0x48, 0xa1, 0xba, 0xb4, 0x69,
-	0x08, 0xe8, 0x18, 0x0a, 0xec, 0xaf, 0x9a, 0xd7, 0xed, 0xe2, 0x16, 0x59, 0x52, 0xc5, 0x59, 0xda,
-	0xc0, 0x55, 0xde, 0x40, 0xbc, 0xb8, 0xb1, 0x56, 0x2d, 0x9f, 0x0d, 0xca, 0xd7, 0x18, 0xed, 0x66,
-	0x4b, 0x16, 0x68, 0xcd, 0x24, 0xa8, 0x92, 0x71, 0x54, 0x5a, 0x2d, 0x1c, 0x04, 0x36, 0xfe, 0x45,
-	0x1f, 0x07, 0x61, 0x71, 0x4e, 0x1b, 0x87, 0x56, 0xd6, 0x58, 0x67, 0xe3, 0x70, 0x28, 0xb0, 0xe9,
-	0x33, 0xa8, 0x3e, 0x0e, 0x0d, 0x01, 0xed, 0x03, 0x54, 0x7a, 0xbd, 0x3a, 0x0e, 0x88, 0x30, 0x16,
-	0x2f, 0x53, 0xd2, 0x0b, 0x9c, 0xf4, 0x53, 0x7c, 0xc8, 0x0b, 0x1a, 0x6b, 0xd5, 0xab, 0x67, 0x83,
-	0xf2, 0x92, 0xd3, 0xeb, 0x35, 0x03, 0x06, 0xd2, 0x88, 0x2a, 0x34, 0x18, 0xdf, 0x4f, 0xbd, 0x10,
-	0x73, 0x51, 0x2c, 0x16, 0x62, 0x7c, 0x57, 0xca, 0x44, 0x7f, 0x7d, 0x0a, 0x6c, 0x72, 0xb1, 0x8e,
-	0xf3, 0x5d, 0x41, 0x20, 0x6b, 0x71, 0xc3, 0x09, 0x9d, 0x43, 0x27, 0xc0, 0x5c, 0x3c, 0xe6, 0xb5,
-	0xb5, 0xa8, 0x17, 0x36, 0xd6, 0xd9, 0x5a, 0x6c, 0x73, 0x68, 0x33, 0x45, 0x5e, 0x62, 0xf4, 0x08,
-	0x47, 0xa2, 0x81, 0x17, 0xd1, 0x08, 0x8e, 0xbc, 0xc0, 0x87, 0xe9, 0x1c, 0x89, 0xaa, 0xa2, 0x6d,
-	0xc8, 0x3d, 0xc5, 0x87, 0x4c, 0x73, 0x2c, 0x50, 0x7a, 0xf3, 0x11, 0x3d, 0xa6, 0x33, 0xd6, 0xd9,
-	0xaa, 0x20, 0xd4, 0x92, 0xda, 0x42, 0x62, 0xa3, 0xdf, 0xcd, 0xc0, 0xb2, 0x58, 0xe1, 0x38, 0x7c,
-	0xe1, 0xf9, 0x27, 0x6e, 0xf7, 0xa8, 0xe6, 0x75, 0x9f, 0xb9, 0x47, 0xc5, 0x45, 0x4a, 0xf9, 0x46,
-	0x4c, 0x69, 0xc4, 0x6a, 0x35, 0xd6, 0xaa, 0x3f, 0x39, 0x1b, 0x94, 0x6f, 0x4a, 0x05, 0x22, 0xcb,
-	0x89, 0x40, 0x3e, 0x73, 0x8f, 0xb4, 0x86, 0x4d, 0x6d, 0xa1, 0xbf, 0x9e, 0x81, 0x2b, 0x7c, 0x74,
-	0x36, 0x6e, 0x79, 0x7e, 0x3b, 0xea, 0xc6, 0x12, 0xed, 0x46, 0x59, 0xae, 0xd6, 0xb4, 0x4a, 0x8d,
-	0xb5, 0xea, 0xad, 0xb3, 0x41, 0xd9, 0xe2, 0x8c, 0x6b, 0xfa, 0xa2, 0x38, 0xad, 0x13, 0x86, 0x86,
-	0x88, 0x24, 0x10, 0xe5, 0xbf, 0xef, 0xe3, 0x67, 0xd8, 0xc7, 0xdd, 0x16, 0x2e, 0x5e, 0xd1, 0x24,
-	0x41, 0x2f, 0x14, 0x5a, 0x99, 0x6c, 0x25, 0xcd, 0x9e, 0x04, 0xeb, 0x92, 0xa0, 0xa3, 0xa0, 0x5f,
-	0x00, 0xe2, 0x0c, 0xa8, 0xf4, 0xdb, 0x6e, 0xc8, 0x07, 0xb8, 0x4c, 0x5b, 0xb9, 0xa6, 0xf3, 0x59,
-	0xa9, 0xd0, 0x58, 0xab, 0x5a, 0x67, 0x83, 0xf2, 0xaa, 0x60, 0xb1, 0x43, 0x8a, 0xd2, 0x06, 0x96,
-	0x42, 0x9c, 0x68, 0xde, 0x5d, 0xaf, 0x75, 0x52, 0x2c, 0x6a, 0x9a, 0x97, 0x80, 0x84, 0xca, 0xee,
-	0x78, 0xad, 0x13, 0x5d, 0xf3, 0x92, 0x52, 0x14, 0xc2, 0x02, 0x9f, 0x25, 0x1b, 0x07, 0xa1, 0xef,
-	0x52, 0xdd, 0x11, 0x14, 0xaf, 0x52, 0x3a, 0x2b, 0x42, 0x07, 0x27, 0x6b, 0x34, 0x3e, 0x64, 0xbd,
-	0xe5, 0x82, 0xd0, 0xf4, 0x95, 0x32, 0xad, 0x99, 0x34, 0xf2, 0xe8, 0xaf, 0xc0, 0xd2, 0x53, 0xb7,
-	0xdb, 0xf6, 0x5e, 0x04, 0x1b, 0x38, 0x38, 0x09, 0xbd, 0x5e, 0x9d, 0x59, 0x7e, 0xc5, 0x12, 0x6d,
-	0x77, 0x55, 0x88, 0x79, 0x5a, 0x9d, 0xc6, 0x7a, 0xf5, 0x9d, 0xb3, 0x41, 0xf9, 0xad, 0x17, 0xac,
-	0xb0, 0xd9, 0x66, 0xa5, 0x4d, 0x6e, 0x3c, 0x6a, 0x8d, 0xa7, 0xb7, 0x42, 0x44, 0x40, 0x2f, 0x28,
-	0x5e, 0xd3, 0x44, 0x40, 0x2f, 0x14, 0xca, 0x20, 0xd6, 0xa0, 0x2e, 0x02, 0x3a, 0x0a, 0xda, 0x82,
-	0x9c, 0x50, 0x0f, 0xc5, 0x15, 0x6d, 0xe9, 0x0a, 0x70, 0x63, 0x9d, 0x59, 0x40, 0x42, 0xc5, 0xe8,
-	0x2b, 0x57, 0xd4, 0x42, 0xbb, 0x90, 0xa7, 0x3a, 0x92, 0xaa, 0xac, 0xeb, 0x94, 0x12, 0x12, 0x82,
-	0x2a, 0xe0, 0x8d, 0xf5, 0x6a, 0xf1, 0x6c, 0x50, 0x5e, 0x64, 0x5a, 0x36, 0xa1, 0xa8, 0x22, 0x02,
-	0x68, 0x1d, 0xc6, 0x2a, 0xbd, 0x5e, 0x71, 0x95, 0xd2, 0x99, 0x89, 0xe8, 0x34, 0xd6, 0xab, 0xf3,
-	0x67, 0x83, 0xf2, 0xac, 0xd3, 0xd3, 0x87, 0x45, 0x6a, 0x57, 0x01, 0x72, 0xc2, 0x20, 0x7b, 0x30,
-	0x9e, 0x9b, 0x2a, 0xe4, 0xac, 0x6d, 0x98, 0x78, 0xea, 0x84, 0xad, 0x63, 0xf4, 0x0d, 0x4c, 0x3c,
-	0x74, 0xbb, 0xed, 0xa0, 0x98, 0xb9, 0x31, 0x46, 0xf7, 0x6c, 0x66, 0x2d, 0xd2, 0x42, 0x52, 0x50,
-	0x5d, 0xfe, 0xe5, 0xa0, 0x7c, 0xe9, 0x6c, 0x50, 0xbe, 0x7c, 0x42, 0xaa, 0x29, 0x26, 0x23, 0xc3,
-	0xb3, 0xfe, 0x5d, 0x16, 0xf2, 0xb2, 0x36, 0x5a, 0x81, 0x71, 0xf2, 0x3f, 0xb5, 0x3d, 0xf3, 0xd5,
-	0xdc, 0xd9, 0xa0, 0x3c, 0x4e, 0xf0, 0x6c, 0x0a, 0x45, 0x6b, 0x30, 0xbd, 0xeb, 0x39, 0xed, 0x3a,
-	0x6e, 0xf9, 0x38, 0x0c, 0xa8, 0x71, 0x99, 0xab, 0x16, 0xce, 0x06, 0xe5, 0x99, 0x8e, 0xe7, 0xb4,
-	0x9b, 0x01, 0x83, 0xdb, 0x6a, 0x25, 0x42, 0x91, 0x5a, 0x46, 0x63, 0x11, 0x45, 0x62, 0x41, 0xd8,
-	0x14, 0x8a, 0x1e, 0xc0, 0xe4, 0x7d, 0xb7, 0x43, 0xf6, 0x9a, 0x71, 0xda, 0xff, 0x95, 0x78, 0xff,
-	0xef, 0xb0, 0xe2, 0xcd, 0x6e, 0xe8, 0xbf, 0x64, 0x86, 0xc3, 0x33, 0x0a, 0x50, 0x06, 0xc2, 0x29,
-	0xa0, 0x7b, 0x30, 0x55, 0xef, 0x1f, 0xd2, 0xee, 0x4f, 0xd0, 0xc6, 0xe8, 0xec, 0x06, 0xfd, 0xc3,
-	0x26, 0x19, 0x82, 0x82, 0x20, 0xaa, 0x95, 0x3e, 0x83, 0x69, 0x85, 0x3c, 0x2a, 0xc0, 0xd8, 0x09,
-	0x7e, 0xc9, 0xc6, 0x6e, 0x93, 0x3f, 0xd1, 0x22, 0x4c, 0x3c, 0x77, 0x3a, 0x7d, 0x4c, 0x87, 0x9a,
-	0xb7, 0xd9, 0xc7, 0xe7, 0xd9, 0x4f, 0x33, 0xd6, 0x7f, 0x1d, 0x87, 0xc2, 0xb6, 0x17, 0x84, 0xc4,
-	0x92, 0x95, 0x5b, 0xf2, 0x4d, 0x98, 0x24, 0xb0, 0x9d, 0x0d, 0xce, 0xbf, 0xe9, 0xb3, 0x41, 0x79,
-	0xea, 0xd8, 0x0b, 0xc2, 0xa6, 0xdb, 0xb6, 0x79, 0x11, 0x7a, 0x17, 0x72, 0x7b, 0x5e, 0x1b, 0x53,
-	0xa6, 0x50, 0xb2, 0xd5, 0xd9, 0xb3, 0x41, 0x39, 0xdf, 0xf5, 0xda, 0x98, 0x5a, 0x85, 0xb6, 0x2c,
-	0x46, 0x0d, 0x6e, 0xcd, 0x31, 0xde, 0x55, 0x09, 0xef, 0x88, 0xf9, 0xf6, 0xeb, 0x41, 0xf9, 0xe3,
-	0x0b, 0x1c, 0x37, 0xee, 0xd4, 0x5f, 0x06, 0x21, 0x3e, 0x25, 0x94, 0xb8, 0xb1, 0xf7, 0x14, 0x16,
-	0x2b, 0xed, 0xb6, 0xcb, 0x30, 0xf6, 0x7d, 0xb7, 0xdb, 0x72, 0x7b, 0x4e, 0x27, 0xa0, 0x73, 0x90,
-	0xaf, 0xde, 0x3c, 0x1b, 0x94, 0xcb, 0x8e, 0x2c, 0x6f, 0xf6, 0x64, 0x05, 0x85, 0x87, 0xa9, 0x04,
-	0xd0, 0x3a, 0xe4, 0x36, 0xf6, 0xea, 0xd4, 0x14, 0x2c, 0x4e, 0x50, 0x62, 0x74, 0x73, 0x6c, 0x77,
-	0x03, 0x3a, 0x34, 0x95, 0x80, 0xac, 0x88, 0x3e, 0x86, 0x99, 0xfd, 0xfe, 0x61, 0xc7, 0x6d, 0x1d,
-	0xec, 0xd6, 0x1f, 0xe2, 0x97, 0xd4, 0x86, 0x9e, 0x61, 0x2a, 0xb3, 0x47, 0xe1, 0xcd, 0xb0, 0x13,
-	0x34, 0x4f, 0xf0, 0x4b, 0x5b, 0xab, 0x17, 0xe1, 0xd5, 0xeb, 0xdb, 0x04, 0x6f, 0x2a, 0x81, 0x17,
-	0x04, 0xc7, 0x2a, 0x1e, 0xab, 0x87, 0xee, 0x02, 0x30, 0xcb, 0xa4, 0xd2, 0x6e, 0x33, 0x13, 0x3b,
-	0x5f, 0xbd, 0x7c, 0x36, 0x28, 0x4f, 0x73, 0x5b, 0xc6, 0x69, 0xb7, 0x7d, 0x5b, 0xa9, 0x82, 0x6a,
-	0x90, 0xb3, 0x3d, 0xc6, 0x60, 0x6e, 0x58, 0x5f, 0x96, 0x86, 0x35, 0x03, 0xf3, 0xa3, 0x14, 0xff,
-	0x52, 0x47, 0x29, 0x6a, 0xa0, 0x32, 0x4c, 0xed, 0x79, 0x35, 0xa7, 0x75, 0xcc, 0xcc, 0xeb, 0x5c,
-	0x75, 0xe2, 0x6c, 0x50, 0xce, 0xfc, 0xb6, 0x2d, 0xa0, 0xd6, 0xbf, 0xc8, 0x41, 0x81, 0xd8, 0xf0,
-	0x9a, 0x44, 0xbd, 0x0f, 0x79, 0xd6, 0xf7, 0x87, 0x5c, 0x30, 0x67, 0xaa, 0x73, 0x67, 0x83, 0x32,
-	0xf0, 0x01, 0x92, 0xc1, 0x45, 0x15, 0xd0, 0x6d, 0xc8, 0x11, 0x0a, 0xdd, 0x48, 0xb4, 0x66, 0xce,
-	0x06, 0xe5, 0x5c, 0x9f, 0xc3, 0x6c, 0x59, 0x8a, 0xea, 0x30, 0xb5, 0xf9, 0x63, 0xcf, 0xf5, 0x71,
-	0xc0, 0x8f, 0x72, 0xa5, 0x3b, 0xec, 0xc4, 0x7e, 0x47, 0x9c, 0xd8, 0xef, 0x1c, 0x88, 0x13, 0x7b,
-	0xf5, 0x3a, 0x57, 0x21, 0xf3, 0x98, 0xa1, 0x44, 0xe3, 0xfb, 0xbd, 0x3f, 0x2d, 0x67, 0x6c, 0x41,
-	0x09, 0xbd, 0x0f, 0x93, 0xf7, 0x3d, 0xff, 0xd4, 0x09, 0xe9, 0x09, 0x2e, 0xcf, 0x97, 0x2b, 0x85,
-	0x68, 0xcb, 0x95, 0x42, 0xd0, 0x7d, 0x98, 0xb3, 0xbd, 0x7e, 0x88, 0x0f, 0x3c, 0x61, 0x6e, 0xb2,
-	0x55, 0xbb, 0x7a, 0x36, 0x28, 0x97, 0x7c, 0x52, 0xd2, 0x0c, 0xbd, 0xa4, 0x61, 0x69, 0xc7, 0xb0,
-	0xd0, 0x26, 0xcc, 0x69, 0x86, 0x71, 0x50, 0x9c, 0xa4, 0x92, 0xc7, 0x8c, 0x06, 0xcd, 0x9c, 0x56,
-	0xe5, 0x2f, 0x86, 0x84, 0xf6, 0x60, 0xfe, 0x61, 0xff, 0x10, 0xfb, 0x5d, 0x1c, 0xe2, 0x40, 0xf4,
-	0x68, 0x8a, 0xf6, 0xe8, 0xc6, 0xd9, 0xa0, 0xbc, 0x72, 0x22, 0x0b, 0x53, 0xfa, 0x94, 0x44, 0x45,
-	0x18, 0x2e, 0xf3, 0x8e, 0xca, 0x6d, 0x28, 0xc7, 0xcd, 0x69, 0xa6, 0xe2, 0x62, 0xa5, 0xd5, 0x9b,
-	0x9c, 0xcb, 0xd7, 0xe4, 0xd8, 0x93, 0x1b, 0x93, 0x1d, 0xa7, 0x49, 0x56, 0x9c, 0xd4, 0x26, 0x79,
-	0xda, 0x5b, 0x76, 0x48, 0x13, 0xda, 0x44, 0x95, 0x45, 0xa9, 0x57, 0x76, 0x61, 0xe2, 0x49, 0xe0,
-	0x1c, 0x31, 0x49, 0x9c, 0x5b, 0x7b, 0x8b, 0xf7, 0x28, 0x2e, 0x7d, 0xf4, 0x5c, 0x4f, 0x2b, 0x56,
-	0x17, 0xc8, 0x0e, 0xd2, 0x27, 0x7f, 0xaa, 0x3b, 0x08, 0x2d, 0x43, 0xdf, 0x02, 0xf0, 0x5e, 0x91,
-	0x9d, 0x6d, 0x9a, 0xef, 0xb5, 0xda, 0x20, 0xc9, 0x26, 0xb6, 0xca, 0xc7, 0x77, 0x45, 0x8e, 0x4f,
-	0xdb, 0xeb, 0x6c, 0x85, 0x08, 0xfa, 0x06, 0x66, 0xa8, 0xba, 0x12, 0x33, 0x3a, 0x43, 0x67, 0x94,
-	0x1e, 0xfd, 0x89, 0x02, 0x4c, 0x9b, 0x4f, 0x0d, 0x01, 0xfd, 0x55, 0x58, 0xe2, 0xe4, 0x62, 0x66,
-	0xc6, 0x2c, 0x37, 0xab, 0xb4, 0xee, 0xe9, 0x75, 0xaa, 0xef, 0xf1, 0x9e, 0x5a, 0xb2, 0xa7, 0x46,
-	0xc3, 0xc3, 0x4e, 0x6f, 0xc6, 0xfa, 0x0e, 0xf2, 0x92, 0x79, 0x68, 0x0a, 0xc6, 0x2a, 0x9d, 0x4e,
-	0xe1, 0x12, 0xf9, 0xa3, 0x5e, 0xdf, 0x2e, 0x64, 0xd0, 0x1c, 0x40, 0x24, 0x31, 0x85, 0x2c, 0x9a,
-	0x89, 0x8c, 0x95, 0xc2, 0x18, 0xad, 0xdf, 0xeb, 0x15, 0xc6, 0x11, 0x8a, 0x5b, 0x49, 0x85, 0x09,
-	0xeb, 0xbf, 0x67, 0x12, 0x82, 0x45, 0xf6, 0x65, 0x6e, 0x58, 0x51, 0x39, 0x60, 0x9b, 0x0f, 0xdd,
-	0x97, 0xb9, 0x49, 0xc6, 0x36, 0x16, 0xb5, 0x12, 0xd1, 0x15, 0xfb, 0x84, 0x07, 0x2d, 0xaf, 0xa3,
-	0xea, 0x8a, 0x1e, 0x87, 0xd9, 0xb2, 0x14, 0xad, 0x29, 0x5a, 0x65, 0x2c, 0xda, 0x58, 0x85, 0x56,
-	0x51, 0x25, 0x4c, 0xea, 0x97, 0x35, 0xc5, 0xfa, 0x1a, 0x8f, 0x70, 0x52, 0x24, 0x5a, 0xd6, 0xb3,
-	0xfa, 0x86, 0x39, 0x43, 0x5f, 0x24, 0x8c, 0x45, 0x36, 0x42, 0x2a, 0x94, 0xb1, 0xa9, 0x49, 0xd8,
-	0x81, 0x65, 0x98, 0xd8, 0xf5, 0x8e, 0xdc, 0x2e, 0x1f, 0x64, 0xfe, 0x6c, 0x50, 0x9e, 0xe8, 0x10,
-	0x80, 0xcd, 0xe0, 0xd6, 0xff, 0xcd, 0xa8, 0xf2, 0x2b, 0xed, 0x95, 0x4c, 0xaa, 0xbd, 0xf2, 0x3e,
-	0xe4, 0xf9, 0xa1, 0x66, 0x67, 0x83, 0x53, 0xa4, 0xfa, 0x58, 0x9c, 0x87, 0xdc, 0xb6, 0x1d, 0x55,
-	0x20, 0x3b, 0x0d, 0x53, 0xce, 0x74, 0xa7, 0x19, 0x8b, 0x76, 0x1a, 0xae, 0xbe, 0xd9, 0x4e, 0x13,
-	0x55, 0x21, 0x13, 0xa9, 0x7a, 0x93, 0xc6, 0xa3, 0x89, 0x54, 0xfd, 0x46, 0xba, 0xaf, 0xe8, 0x73,
-	0x80, 0xca, 0xd3, 0x3a, 0x91, 0xfe, 0x8a, 0xbd, 0xc7, 0x75, 0x28, 0x75, 0x35, 0x39, 0x2f, 0x82,
-	0x26, 0x5d, 0x2d, 0x8e, 0xaf, 0x6e, 0x49, 0x4a, 0x6d, 0xab, 0x03, 0x73, 0x5b, 0x38, 0x24, 0xb3,
-	0x26, 0x36, 0x9c, 0xe1, 0xc3, 0xff, 0x12, 0xa6, 0x9f, 0xba, 0xe1, 0xb1, 0x6e, 0x00, 0xd2, 0xc6,
-	0x5e, 0xb8, 0xe1, 0xb1, 0x30, 0x00, 0x95, 0xc6, 0xd4, 0xea, 0xd6, 0x26, 0x5c, 0xe6, 0xad, 0xc9,
-	0xfd, 0x6d, 0x4d, 0x27, 0x98, 0x89, 0x2c, 0x4a, 0x95, 0xa0, 0x4e, 0x06, 0xc7, 0x15, 0x3e, 0xaa,
-	0x27, 0xb6, 0x00, 0x66, 0x0d, 0x9b, 0x3c, 0x2d, 0x54, 0x70, 0x62, 0x5b, 0x43, 0x7c, 0x43, 0xb0,
-	0x9e, 0xc0, 0xec, 0x7e, 0xa7, 0x7f, 0xe4, 0x76, 0x89, 0x80, 0xd6, 0xf1, 0x2f, 0xd0, 0x06, 0x40,
-	0x04, 0xe0, 0x2d, 0x08, 0xf7, 0x42, 0x54, 0xd0, 0x58, 0xe7, 0x53, 0x4c, 0x21, 0x54, 0x87, 0xdb,
-	0x0a, 0x9e, 0xf5, 0xf7, 0xc6, 0x00, 0xf1, 0x36, 0xea, 0xa1, 0x13, 0xe2, 0x3a, 0x0e, 0xc9, 0x76,
-	0x71, 0x05, 0xb2, 0xd2, 0x6c, 0x9c, 0x3c, 0x1b, 0x94, 0xb3, 0x6e, 0xdb, 0xce, 0xee, 0x6c, 0xa0,
-	0x0f, 0x61, 0x82, 0x56, 0xa3, 0xbc, 0x9e, 0x93, 0xed, 0xa9, 0x14, 0x98, 0x4c, 0x07, 0xe4, 0x4f,
-	0x9b, 0x55, 0x46, 0x1f, 0x41, 0x7e, 0x03, 0x77, 0xf0, 0x91, 0x13, 0x7a, 0x42, 0xee, 0x98, 0x21,
-	0x26, 0x80, 0xca, 0x14, 0x45, 0x35, 0xc9, 0x06, 0x6e, 0x63, 0x27, 0xf0, 0xba, 0xea, 0x06, 0xee,
-	0x53, 0x88, 0xba, 0x81, 0xb3, 0x3a, 0xe8, 0xf7, 0x33, 0x30, 0x5d, 0xe9, 0x76, 0xb9, 0x81, 0x13,
-	0x70, 0xd7, 0xea, 0xd2, 0x1d, 0xe9, 0x19, 0xdf, 0x75, 0x0e, 0x71, 0xa7, 0x41, 0x4c, 0xe6, 0xa0,
-	0xfa, 0x3d, 0xd1, 0xa9, 0x7f, 0x32, 0x28, 0x7f, 0xf1, 0x2a, 0xce, 0xf6, 0x3b, 0x07, 0xbe, 0xe3,
-	0x86, 0x01, 0xf5, 0x63, 0x45, 0x0d, 0xaa, 0x62, 0xa6, 0xf4, 0x03, 0xbd, 0x0b, 0x13, 0x44, 0xbe,
-	0x85, 0x1d, 0x40, 0x27, 0x9b, 0xac, 0x03, 0xed, 0xf0, 0x43, 0x6b, 0x58, 0x37, 0x21, 0xcf, 0x39,
-	0xb9, 0xb3, 0x61, 0x9a, 0x02, 0x6b, 0x03, 0xae, 0x53, 0x2b, 0x0e, 0x13, 0xc9, 0xa5, 0xde, 0x1c,
-	0x2e, 0x89, 0x91, 0xd9, 0x3f, 0x45, 0xc1, 0x12, 0x9b, 0x4e, 0x08, 0xf5, 0x06, 0xd9, 0xa2, 0xc4,
-	0xaa, 0xc1, 0xca, 0x16, 0x0e, 0x6d, 0x1c, 0xe0, 0x70, 0xdf, 0x09, 0x82, 0x17, 0x9e, 0xdf, 0xa6,
-	0x45, 0x17, 0x22, 0xf2, 0xb7, 0x32, 0x50, 0xae, 0xf9, 0x98, 0xcc, 0xb4, 0x91, 0xd0, 0xf0, 0x15,
-	0xbc, 0xc2, 0x2f, 0x17, 0xb2, 0x51, 0x29, 0xe1, 0x35, 0xbf, 0x40, 0x78, 0x07, 0xc6, 0x0e, 0x0e,
-	0x76, 0xa9, 0xc4, 0x8c, 0x51, 0xc6, 0x8d, 0x85, 0x61, 0xe7, 0xd7, 0x83, 0x72, 0x6e, 0xa3, 0xcf,
-	0x2e, 0x1f, 0x6c, 0x52, 0x6e, 0x3d, 0x83, 0x25, 0x1b, 0x77, 0xf1, 0x0b, 0xe7, 0xb0, 0x83, 0x35,
-	0x73, 0xb5, 0x0c, 0x13, 0xcc, 0x59, 0x96, 0x18, 0x02, 0x83, 0xeb, 0xf6, 0x6c, 0x76, 0x84, 0x3d,
-	0x6b, 0xfd, 0x41, 0x06, 0x0a, 0x6c, 0xb8, 0x55, 0x2f, 0x3c, 0xdf, 0xf8, 0xf8, 0x08, 0xb2, 0xc3,
-	0x47, 0x80, 0x6e, 0x45, 0xdc, 0x1e, 0x8b, 0x36, 0x3f, 0xda, 0x55, 0xa2, 0xc3, 0x45, 0x21, 0x19,
-	0x10, 0x93, 0x25, 0x76, 0x34, 0xa2, 0x03, 0xa2, 0xb2, 0x24, 0x24, 0xe8, 0x8f, 0xb2, 0x30, 0xaf,
-	0x74, 0x31, 0xe8, 0x79, 0xdd, 0x00, 0x93, 0x33, 0x1e, 0x11, 0x16, 0xa5, 0x9f, 0xf4, 0x8c, 0x47,
-	0xb6, 0xcc, 0x66, 0x64, 0x89, 0xd3, 0x0e, 0xbf, 0x4b, 0x0e, 0x17, 0x9d, 0xc4, 0x71, 0x90, 0x2a,
-	0x6e, 0x56, 0x55, 0x14, 0x9f, 0xbb, 0xd3, 0x77, 0x21, 0x47, 0xff, 0x24, 0x8c, 0x18, 0x37, 0x33,
-	0x42, 0x56, 0x42, 0x2e, 0xc0, 0x03, 0xcf, 0xed, 0x3e, 0xc2, 0xe1, 0xb1, 0x27, 0x0e, 0xcf, 0x3b,
-	0x44, 0x89, 0xfd, 0x25, 0xcf, 0xed, 0x36, 0x4f, 0x29, 0xf8, 0xa2, 0x87, 0xce, 0x88, 0xa0, 0xad,
-	0x10, 0xb7, 0xee, 0x41, 0x81, 0xe8, 0x9b, 0xf3, 0xcf, 0xa8, 0xb5, 0x08, 0x68, 0x0b, 0x87, 0x55,
-	0x4f, 0xdb, 0x38, 0xac, 0x59, 0x98, 0xde, 0x77, 0xbb, 0x47, 0xe2, 0xf3, 0xdf, 0x67, 0x61, 0x86,
-	0x7d, 0xf3, 0x19, 0x88, 0xed, 0xa4, 0x99, 0xf3, 0xec, 0xa4, 0x9f, 0xc2, 0x2c, 0x77, 0xe7, 0x60,
-	0x9f, 0xba, 0x90, 0xd9, 0x7c, 0xd0, 0x13, 0x25, 0xf3, 0xea, 0x34, 0x9f, 0xb3, 0x12, 0x5b, 0xaf,
-	0x88, 0x76, 0x61, 0x8e, 0x01, 0xee, 0x63, 0x27, 0xec, 0x47, 0xa7, 0xaa, 0xcb, 0xdc, 0xce, 0x14,
-	0x60, 0xa6, 0x8c, 0x38, 0xad, 0x67, 0x1c, 0x68, 0xc7, 0x70, 0xd1, 0x37, 0x70, 0x79, 0xdf, 0xf7,
-	0x7e, 0x7c, 0xa9, 0xd8, 0x0e, 0x4c, 0x1f, 0x2f, 0x91, 0x43, 0x58, 0x8f, 0x14, 0x35, 0x55, 0x0b,
-	0x22, 0x5e, 0x9b, 0xc8, 0xd4, 0x4e, 0x50, 0xf5, 0x7c, 0xb7, 0x7b, 0x44, 0x67, 0x33, 0xc7, 0x64,
-	0xca, 0x0d, 0x9a, 0x87, 0x14, 0x68, 0xcb, 0x62, 0xeb, 0x0f, 0xc7, 0x20, 0x27, 0x1b, 0xbe, 0xa3,
-	0x9a, 0xa5, 0x7c, 0x33, 0xa6, 0xcb, 0x33, 0x3a, 0xfc, 0xd8, 0x4a, 0x0d, 0x74, 0x95, 0x39, 0xb3,
-	0x98, 0x19, 0x30, 0x45, 0x64, 0xcc, 0xe9, 0xf5, 0xa8, 0xcb, 0x8a, 0x28, 0xd3, 0x8d, 0x2a, 0xe5,
-	0x42, 0x8e, 0x29, 0xd3, 0xf6, 0xa1, 0x9d, 0xdd, 0xa8, 0x92, 0xb9, 0x7e, 0xbc, 0xb3, 0x51, 0xa3,
-	0x03, 0xca, 0xb1, 0xb9, 0xf6, 0xdc, 0x76, 0xcb, 0xa6, 0x50, 0x52, 0x5a, 0xaf, 0x3c, 0xda, 0xe5,
-	0x9d, 0xa6, 0xa5, 0x81, 0x73, 0xda, 0xb1, 0x29, 0x94, 0xd8, 0x81, 0x6c, 0x8f, 0xae, 0x79, 0xdd,
-	0xd0, 0xf7, 0x3a, 0x01, 0x75, 0x15, 0xe4, 0xb4, 0xed, 0xbc, 0xc5, 0x8b, 0xec, 0x58, 0x55, 0xf4,
-	0x14, 0x96, 0x2b, 0xed, 0xe7, 0x4e, 0xb7, 0x85, 0xdb, 0xac, 0xe4, 0xa9, 0xe7, 0x9f, 0x3c, 0xeb,
-	0x78, 0x2f, 0x02, 0x7a, 0xca, 0xcb, 0xf1, 0xf3, 0x22, 0xaf, 0xd2, 0xe4, 0xe4, 0x5e, 0x88, 0x4a,
-	0xb6, 0x09, 0x9b, 0xa8, 0x88, 0x5a, 0xc7, 0xeb, 0xb7, 0xe9, 0xf1, 0x2e, 0xc7, 0x54, 0x44, 0x8b,
-	0x00, 0x6c, 0x06, 0x27, 0x5c, 0xda, 0xae, 0x3f, 0xa2, 0xa7, 0x33, 0xce, 0xa5, 0xe3, 0xe0, 0xd4,
-	0x26, 0x30, 0xf4, 0x0e, 0x4c, 0x09, 0x93, 0x96, 0x39, 0x05, 0xa8, 0xc7, 0x48, 0x98, 0xb2, 0xa2,
-	0xcc, 0xfa, 0x00, 0xe6, 0xd9, 0xa2, 0x39, 0xb7, 0xa5, 0x66, 0xed, 0x03, 0xd4, 0xf1, 0xa9, 0xd3,
-	0x3b, 0xf6, 0xc8, 0xc4, 0x56, 0xd5, 0x2f, 0x6e, 0xba, 0x20, 0xe9, 0xe8, 0xe7, 0x05, 0x8d, 0x75,
-	0x61, 0xcb, 0x8a, 0x9a, 0xb6, 0x82, 0x65, 0xfd, 0x97, 0x2c, 0x20, 0xea, 0xf0, 0xae, 0x87, 0x3e,
-	0x76, 0x4e, 0x45, 0x37, 0x3e, 0x83, 0x19, 0xa6, 0xff, 0x18, 0x98, 0x76, 0x87, 0xd8, 0x45, 0x4c,
-	0xf0, 0xd5, 0xa2, 0xed, 0x4b, 0xb6, 0x56, 0x95, 0xa0, 0xda, 0x38, 0xe8, 0x9f, 0x0a, 0xd4, 0xac,
-	0x86, 0xaa, 0x16, 0x11, 0x54, 0xf5, 0x1b, 0x7d, 0x03, 0x73, 0x35, 0xef, 0xb4, 0x47, 0x78, 0xc2,
-	0x91, 0xc7, 0xb8, 0xf5, 0xc1, 0xdb, 0xd5, 0x0a, 0xb7, 0x2f, 0xd9, 0xb1, 0xea, 0x68, 0x0f, 0x16,
-	0xee, 0x77, 0xfa, 0xc1, 0x71, 0xa5, 0xdb, 0xae, 0x75, 0xbc, 0x40, 0x50, 0x19, 0xe7, 0xce, 0x10,
-	0xbe, 0x6c, 0x93, 0x35, 0xb6, 0x2f, 0xd9, 0x69, 0x88, 0xe8, 0x1d, 0x7e, 0x7b, 0xcf, 0xad, 0xa0,
-	0xd9, 0x3b, 0xfc, 0x72, 0xff, 0x71, 0x17, 0x3f, 0x7e, 0xb6, 0x7d, 0xc9, 0x66, 0xa5, 0xd5, 0x3c,
-	0x4c, 0x09, 0x95, 0x75, 0x17, 0xe6, 0x15, 0x76, 0x12, 0xbb, 0xad, 0x1f, 0xa0, 0x12, 0xe4, 0x9e,
-	0xf4, 0x3a, 0x9e, 0xd3, 0x16, 0x66, 0x80, 0x2d, 0xbf, 0xad, 0xf7, 0x75, 0x4e, 0xa3, 0x15, 0xf5,
-	0x2c, 0xc2, 0x2a, 0x47, 0x00, 0x6b, 0x5b, 0x67, 0xee, 0xf0, 0xda, 0x5a, 0xbb, 0xd9, 0x58, 0xbb,
-	0x85, 0x38, 0xaf, 0xad, 0xa5, 0x54, 0xe6, 0x59, 0x0f, 0xa9, 0x89, 0x53, 0xe9, 0xf5, 0x3a, 0x6e,
-	0x8b, 0xee, 0x0c, 0x4c, 0xaf, 0x49, 0xeb, 0xe0, 0xb7, 0xd4, 0x3b, 0x66, 0x65, 0x5b, 0x94, 0x37,
-	0xca, 0xca, 0x2d, 0xb2, 0xf5, 0x33, 0xb8, 0x6e, 0x20, 0xc6, 0x35, 0xfc, 0x67, 0x30, 0xc5, 0x41,
-	0x31, 0x81, 0x56, 0xbd, 0xf2, 0x74, 0x3d, 0x05, 0x1c, 0x53, 0xd4, 0xb7, 0xbe, 0x83, 0xd5, 0x27,
-	0xbd, 0x00, 0xfb, 0x49, 0xf2, 0xa2, 0xab, 0x1f, 0xcb, 0x3b, 0xec, 0x8c, 0xd1, 0xe3, 0x0f, 0x67,
-	0x83, 0xf2, 0x24, 0xa3, 0x2d, 0xae, 0xae, 0xad, 0xdf, 0xcb, 0xc0, 0x2a, 0x5b, 0xaa, 0x46, 0xd2,
-	0x17, 0xe1, 0x82, 0xe2, 0x51, 0xce, 0x9a, 0x3d, 0xca, 0x43, 0x5d, 0xec, 0xd6, 0xb7, 0x60, 0xf1,
-	0x1e, 0x75, 0x3a, 0x6f, 0x68, 0x6e, 0xfe, 0x46, 0x06, 0x16, 0xd9, 0xe4, 0xbc, 0x06, 0x15, 0xf4,
-	0x15, 0xcc, 0xd5, 0x4f, 0xdc, 0x5e, 0xc3, 0xe9, 0xb8, 0x6d, 0xe6, 0x5c, 0x65, 0x1b, 0xc9, 0x12,
-	0xdd, 0x23, 0x4f, 0xdc, 0x5e, 0xf3, 0x79, 0x54, 0x94, 0xb1, 0x63, 0x95, 0xad, 0xc7, 0xb0, 0x14,
-	0xeb, 0x03, 0x17, 0x8c, 0x8f, 0xe3, 0x82, 0x91, 0x08, 0x40, 0x48, 0x97, 0x8a, 0x47, 0x70, 0x45,
-	0x4a, 0x85, 0x3e, 0x65, 0xeb, 0x31, 0x69, 0x48, 0x10, 0x4c, 0x13, 0x85, 0x16, 0x5c, 0x91, 0x92,
-	0xf0, 0x1a, 0x12, 0x20, 0x26, 0x37, 0x9b, 0x3a, 0xb9, 0x3b, 0x50, 0x52, 0x27, 0xf7, 0x75, 0x26,
-	0xf5, 0x3f, 0x67, 0x60, 0x79, 0x0b, 0x77, 0xb1, 0xef, 0xd0, 0x2e, 0x6b, 0x67, 0x0a, 0xd5, 0xb1,
-	0x9c, 0x19, 0xea, 0x58, 0x96, 0x06, 0x73, 0x36, 0xdd, 0x60, 0x26, 0xbb, 0xe1, 0x13, 0x7b, 0x87,
-	0xcb, 0x2a, 0xdd, 0x0d, 0xfb, 0xbe, 0x6b, 0x13, 0x18, 0xda, 0x89, 0x9c, 0xd2, 0xe3, 0x23, 0x9d,
-	0xd2, 0x0b, 0xdc, 0x49, 0x37, 0xc5, 0x9d, 0xd2, 0x9a, 0x2b, 0xda, 0xfa, 0x02, 0x8a, 0xc9, 0xb1,
-	0x70, 0xf9, 0x18, 0x75, 0x48, 0xb1, 0x36, 0x22, 0xe9, 0xe6, 0xf7, 0xd7, 0xd2, 0x19, 0x1f, 0x53,
-	0xa1, 0x43, 0x9c, 0x3f, 0x56, 0x3d, 0x92, 0x4f, 0x4e, 0x85, 0xb7, 0xff, 0x39, 0x91, 0x4f, 0x16,
-	0xa3, 0x90, 0x31, 0xc7, 0x28, 0x70, 0x19, 0x65, 0xa8, 0x02, 0xc1, 0x7a, 0x0a, 0x57, 0x34, 0xa2,
-	0x91, 0xd4, 0x7f, 0x05, 0x39, 0x01, 0x8b, 0xf9, 0x26, 0x34, 0xb2, 0x74, 0xde, 0x02, 0x81, 0x2c,
-	0x51, 0xac, 0x3f, 0xcb, 0xc0, 0x32, 0xdb, 0x5d, 0x92, 0xe3, 0x3e, 0xff, 0xec, 0xff, 0x46, 0x1c,
-	0x5e, 0xf7, 0x52, 0x1c, 0x5e, 0x14, 0x45, 0x75, 0x78, 0xa9, 0x6e, 0xae, 0x07, 0xe3, 0xb9, 0x6c,
-	0x61, 0xcc, 0x6a, 0x40, 0x31, 0x39, 0xc2, 0x37, 0x30, 0x27, 0x5b, 0xb0, 0xac, 0x2c, 0xf4, 0xd7,
-	0x96, 0x98, 0xa8, 0xc5, 0x37, 0x28, 0x31, 0x51, 0xc5, 0x37, 0x26, 0x31, 0x3b, 0xb0, 0xc0, 0x08,
-	0xeb, 0xab, 0x6b, 0x4d, 0x5d, 0x5d, 0xa9, 0xf1, 0x32, 0xc9, 0x05, 0xf7, 0x88, 0x2e, 0x38, 0x51,
-	0x25, 0xea, 0xe1, 0x47, 0x30, 0xc9, 0x43, 0x02, 0x59, 0xff, 0x52, 0x88, 0x51, 0xcd, 0xcb, 0xe2,
-	0x00, 0x6d, 0x5e, 0xd9, 0x2a, 0xd2, 0x21, 0x93, 0x73, 0x0a, 0x77, 0x78, 0xcb, 0x53, 0xe3, 0xb7,
-	0x44, 0xc5, 0xc5, 0x4a, 0x5e, 0x73, 0xd7, 0x78, 0x0c, 0x45, 0xb6, 0x6b, 0x28, 0x54, 0x5f, 0x6b,
-	0xdf, 0xf8, 0x14, 0x8a, 0x4c, 0x9c, 0x52, 0x08, 0x0e, 0xdf, 0x0c, 0x56, 0x61, 0x45, 0x6e, 0x06,
-	0x69, 0xa3, 0xff, 0x3b, 0x19, 0xb8, 0xba, 0x85, 0x43, 0x3d, 0x6a, 0xea, 0xcf, 0x65, 0xef, 0xfe,
-	0x1e, 0x4a, 0x69, 0x1d, 0xe1, 0x53, 0xf1, 0x75, 0x7c, 0x2a, 0x8c, 0x21, 0x62, 0xe9, 0x53, 0xf2,
-	0x33, 0xb8, 0xc6, 0xa6, 0x44, 0xaf, 0x2f, 0x06, 0xfa, 0x45, 0x6c, 0x56, 0x8c, 0xd4, 0xd3, 0x66,
-	0xe7, 0x1f, 0x64, 0xe0, 0x1a, 0x63, 0x72, 0x3a, 0xf1, 0xdf, 0xb4, 0x75, 0xb7, 0x07, 0x65, 0x39,
-	0xe7, 0x6f, 0x60, 0x62, 0xad, 0x16, 0x20, 0x41, 0xa6, 0x56, 0xb7, 0x05, 0x89, 0xab, 0x30, 0x56,
-	0xab, 0xdb, 0xfc, 0x02, 0x9a, 0x6e, 0xda, 0xad, 0xc0, 0xb7, 0x09, 0x2c, 0xae, 0xc1, 0xb3, 0xe7,
-	0xd0, 0xe0, 0xd6, 0xcf, 0x61, 0x41, 0x6b, 0x84, 0xcf, 0xfb, 0x0a, 0x8c, 0xd7, 0xb0, 0x1f, 0xf2,
-	0x66, 0xe8, 0x48, 0x5b, 0xd8, 0x0f, 0x6d, 0x0a, 0x45, 0xb7, 0x60, 0xaa, 0x56, 0xa1, 0xde, 0x46,
-	0x6a, 0x5b, 0xcc, 0x30, 0xc5, 0xd4, 0x72, 0x9a, 0x34, 0x92, 0xdc, 0x16, 0x85, 0xd6, 0x7f, 0xc8,
-	0x28, 0xd4, 0x09, 0xfa, 0xe8, 0x31, 0x7c, 0x40, 0x8e, 0xc7, 0x84, 0x67, 0xca, 0x10, 0xe6, 0xc9,
-	0xb6, 0xc5, 0x3d, 0x35, 0x6c, 0xe7, 0xb3, 0x95, 0x4a, 0xe7, 0xf4, 0x94, 0x8a, 0x9b, 0x39, 0x86,
-	0x24, 0xbc, 0x88, 0xf2, 0x66, 0x8e, 0x93, 0x0e, 0x6c, 0xb5, 0x92, 0xf5, 0x3d, 0x2c, 0xea, 0xfd,
-	0x7f, 0xa3, 0xec, 0x79, 0x9b, 0x5e, 0xf9, 0x28, 0x97, 0xa5, 0x08, 0xa9, 0x8e, 0x04, 0x2e, 0x56,
-	0x9f, 0x40, 0x81, 0xd7, 0x8a, 0x96, 0xe5, 0x4d, 0x61, 0xda, 0xb1, 0x45, 0xa9, 0x07, 0x17, 0x0b,
-	0x7f, 0xe8, 0x4f, 0x84, 0xab, 0x62, 0x54, 0x0b, 0xff, 0x38, 0x03, 0xc5, 0x47, 0xf7, 0x2b, 0x95,
-	0x7e, 0x78, 0x8c, 0xbb, 0x21, 0x39, 0x94, 0xe0, 0xda, 0xb1, 0xd3, 0xe9, 0xe0, 0xee, 0x11, 0x46,
-	0xb7, 0x61, 0xfc, 0xe0, 0xf1, 0xc1, 0x3e, 0xf7, 0x08, 0x2c, 0xf2, 0xe3, 0x38, 0x01, 0xc9, 0x3a,
-	0x36, 0xad, 0x81, 0x1e, 0xc2, 0xfc, 0x53, 0x1e, 0xce, 0x2f, 0x8b, 0xb8, 0x2f, 0xe0, 0xfa, 0x1d,
-	0x19, 0xe8, 0x5f, 0xf3, 0x71, 0x9b, 0xb4, 0xe2, 0x74, 0x2a, 0x01, 0x51, 0x0c, 0x64, 0x7e, 0x92,
-	0x78, 0x0f, 0xc6, 0x73, 0x99, 0x42, 0xd6, 0xfa, 0xfd, 0x0c, 0x2c, 0xc7, 0x7a, 0xa6, 0x38, 0x76,
-	0xd5, 0x8e, 0x2d, 0x28, 0x1d, 0x13, 0x55, 0xb6, 0x2f, 0xf1, 0x9e, 0xd5, 0x68, 0xec, 0x28, 0x6d,
-	0x81, 0x77, 0xe8, 0x9d, 0xe1, 0x1d, 0x8a, 0x08, 0x48, 0x44, 0x1e, 0xf9, 0x45, 0xe1, 0xd6, 0x65,
-	0x98, 0xd5, 0x38, 0x60, 0x59, 0x30, 0xa3, 0xb6, 0x4c, 0xd8, 0x5c, 0xf3, 0xda, 0x92, 0xcd, 0xe4,
-	0x6f, 0xeb, 0x1f, 0x66, 0x60, 0xf1, 0xd1, 0xfd, 0x8a, 0x8d, 0x8f, 0x5c, 0xb2, 0xfc, 0x22, 0x16,
-	0xaf, 0x69, 0x23, 0x59, 0xd1, 0x46, 0x12, 0xab, 0x2b, 0x87, 0xf4, 0x79, 0x62, 0x48, 0x2b, 0x69,
-	0x43, 0xa2, 0x56, 0x96, 0xeb, 0x75, 0xb5, 0x91, 0x28, 0x9e, 0x8f, 0x7f, 0x92, 0x81, 0x05, 0xa5,
-	0x4f, 0xb2, 0xff, 0x1f, 0x68, 0x5d, 0xba, 0x96, 0xd2, 0xa5, 0x04, 0x93, 0xab, 0x89, 0x1e, 0xbd,
-	0x3d, 0xac, 0x47, 0x23, 0x79, 0xfc, 0xc7, 0x19, 0x58, 0x4a, 0xe5, 0x01, 0xba, 0x42, 0x76, 0x8d,
-	0x96, 0x8f, 0x43, 0xce, 0x5e, 0xfe, 0x45, 0xe0, 0x3b, 0x41, 0xd0, 0xe7, 0x6f, 0x2d, 0xf2, 0x36,
-	0xff, 0x42, 0x6f, 0xc3, 0xec, 0x3e, 0xf6, 0x5d, 0xaf, 0x5d, 0xc7, 0x2d, 0xaf, 0xdb, 0x66, 0x1e,
-	0xe1, 0x59, 0x5b, 0x07, 0xa2, 0x15, 0xc8, 0x57, 0x3a, 0x47, 0x9e, 0xef, 0x86, 0xc7, 0xcc, 0xf9,
-	0x94, 0xb7, 0x23, 0x00, 0xa1, 0xbd, 0xe1, 0x1e, 0xb9, 0x21, 0xbb, 0x5b, 0x9b, 0xb5, 0xf9, 0x17,
-	0x2a, 0xc2, 0x54, 0xa5, 0xd5, 0xf2, 0xfa, 0xdd, 0x90, 0x7a, 0x40, 0xf3, 0xb6, 0xf8, 0x24, 0x18,
-	0xdf, 0xda, 0x54, 0x08, 0x68, 0x34, 0x94, 0xcd, 0xbf, 0xac, 0xf7, 0x60, 0x31, 0x8d, 0x8f, 0xa9,
-	0x22, 0xf3, 0xd7, 0xb2, 0xb0, 0x50, 0x69, 0xb7, 0x1f, 0xdd, 0xaf, 0x6c, 0x60, 0xd5, 0xf8, 0xf8,
-	0x10, 0xc6, 0x77, 0xba, 0x6e, 0xc8, 0x77, 0xcd, 0x55, 0x3e, 0x3d, 0x29, 0x35, 0x49, 0x2d, 0x32,
-	0x43, 0xe4, 0x7f, 0x64, 0xc3, 0xc2, 0xe6, 0x8f, 0x6e, 0x10, 0xba, 0xdd, 0x23, 0x3a, 0xe7, 0xac,
-	0x61, 0x3e, 0xc7, 0x82, 0x88, 0x61, 0xb9, 0x6d, 0x5f, 0xb2, 0xd3, 0x90, 0xd1, 0x01, 0x5c, 0xd9,
-	0xc3, 0x2f, 0x52, 0x44, 0x48, 0x06, 0x33, 0x49, 0xb2, 0x29, 0x92, 0x63, 0xc0, 0x55, 0x25, 0xf4,
-	0x6f, 0x67, 0x69, 0x84, 0x9c, 0x32, 0x30, 0xde, 0xf2, 0x13, 0x58, 0x54, 0x3a, 0x14, 0x69, 0x9c,
-	0x0c, 0x8f, 0x9d, 0x4e, 0x1d, 0x8e, 0xba, 0x90, 0x52, 0xd1, 0xd1, 0x53, 0x58, 0xd6, 0x3b, 0x15,
-	0x51, 0xd6, 0x17, 0x43, 0x5a, 0x95, 0xed, 0x4b, 0xb6, 0x09, 0x1b, 0xad, 0xc1, 0x58, 0xa5, 0x75,
-	0xc2, 0xd9, 0x92, 0x3e, 0x65, 0x6c, 0x64, 0x95, 0xd6, 0x09, 0x8d, 0x36, 0x6d, 0x9d, 0x68, 0xeb,
-	0xa1, 0x03, 0xcb, 0x86, 0x09, 0x46, 0xab, 0x00, 0x0c, 0xa8, 0xa8, 0x76, 0x05, 0x42, 0x36, 0x55,
-	0xf6, 0x45, 0xef, 0x1b, 0xc7, 0xe8, 0xf5, 0xb5, 0x08, 0x0b, 0x8a, 0x0a, 0x6c, 0xa5, 0x92, 0x55,
-	0x8b, 0xb7, 0x26, 0xfb, 0x86, 0x6e, 0xc3, 0x24, 0x03, 0x72, 0x56, 0x8b, 0xc7, 0x29, 0x51, 0x65,
-	0x5e, 0x6e, 0xfd, 0x41, 0x46, 0x38, 0x5e, 0x12, 0x12, 0xfc, 0x89, 0x26, 0xc1, 0x6f, 0xc9, 0xce,
-	0xa4, 0x55, 0xd6, 0x84, 0xb8, 0x0a, 0xd3, 0xaf, 0x22, 0xbc, 0x2a, 0x92, 0x2a, 0x5e, 0xff, 0x3c,
-	0x23, 0x8e, 0x8c, 0x49, 0x09, 0xdb, 0x84, 0x99, 0x57, 0x93, 0x2c, 0x0d, 0x0d, 0x7d, 0xc4, 0x26,
-	0x3e, 0x3b, 0x7c, 0xa4, 0x43, 0xe7, 0xfe, 0x4b, 0xe1, 0x5b, 0x7a, 0x95, 0xe9, 0xb7, 0x56, 0x52,
-	0xb0, 0x65, 0x73, 0x56, 0x3f, 0x51, 0x5a, 0x7f, 0xd9, 0x6d, 0x89, 0x79, 0xba, 0x15, 0xbf, 0x0b,
-	0x37, 0x5e, 0x74, 0xaa, 0x7d, 0xc8, 0x46, 0xee, 0x86, 0x36, 0x8e, 0xa2, 0x9e, 0xd4, 0x4e, 0x9d,
-	0x65, 0x74, 0x09, 0x7b, 0x95, 0x46, 0x6b, 0x30, 0xbb, 0x87, 0x5f, 0x24, 0xda, 0xa5, 0xd7, 0x47,
-	0x5d, 0xfc, 0xa2, 0xa9, 0xb4, 0xad, 0x04, 0x1c, 0xe8, 0x38, 0xe8, 0x10, 0xe6, 0xc4, 0x92, 0x3d,
-	0xaf, 0xe6, 0x62, 0x81, 0x91, 0xa4, 0x85, 0xd3, 0x67, 0x4e, 0xd3, 0xe7, 0x50, 0x35, 0xa2, 0x51,
-	0xa7, 0x68, 0xed, 0x43, 0x31, 0x39, 0x56, 0x2e, 0x65, 0x1f, 0x8e, 0x5a, 0x4e, 0xec, 0xf0, 0xd3,
-	0xd6, 0x97, 0xd6, 0x36, 0x3d, 0xa7, 0xcb, 0x3a, 0xf2, 0x84, 0x71, 0x2f, 0xce, 0x3a, 0x1a, 0xec,
-	0x25, 0x58, 0xa7, 0x46, 0x5e, 0x47, 0xd1, 0x10, 0x4b, 0x31, 0x4a, 0xbc, 0x63, 0xef, 0xc1, 0x14,
-	0x07, 0xc9, 0x88, 0xf6, 0xf8, 0x42, 0x17, 0x15, 0xac, 0x7f, 0x9a, 0x81, 0xab, 0x4f, 0x02, 0xec,
-	0xd7, 0xdd, 0xee, 0x51, 0x07, 0x3f, 0x09, 0xf4, 0x58, 0x84, 0xdf, 0xd6, 0x16, 0xfb, 0xb2, 0x21,
-	0xc6, 0xf1, 0xff, 0xd7, 0x12, 0xff, 0x67, 0x19, 0x28, 0xa5, 0xf5, 0xed, 0xcd, 0xae, 0xf2, 0x3b,
-	0xfc, 0x48, 0xc0, 0x7a, 0x5b, 0xe4, 0xe8, 0xb2, 0x4d, 0x31, 0x58, 0x32, 0x48, 0xf2, 0xbf, 0xb6,
-	0xbc, 0xff, 0x4f, 0x06, 0x16, 0x77, 0x02, 0xda, 0xfd, 0x5f, 0xf4, 0x5d, 0x1f, 0xb7, 0x05, 0xe3,
-	0xee, 0xa4, 0x45, 0xc2, 0xd2, 0x79, 0xdd, 0xbe, 0x94, 0x16, 0xe9, 0xfa, 0xa1, 0x12, 0xeb, 0x97,
-	0x1d, 0x16, 0xe2, 0xaa, 0x3d, 0xab, 0xb8, 0x05, 0xe3, 0x7b, 0xc4, 0xf2, 0x18, 0xe3, 0xf2, 0xc7,
-	0x30, 0x08, 0x88, 0x86, 0xe5, 0x91, 0x2e, 0x93, 0x0f, 0x74, 0x3f, 0x11, 0xfc, 0x37, 0x3e, 0x3a,
-	0x84, 0x33, 0xf9, 0x1e, 0xa4, 0x9a, 0x83, 0xc9, 0x03, 0xc7, 0x3f, 0xc2, 0xa1, 0xf5, 0x33, 0x28,
-	0xf1, 0x3b, 0x37, 0xe6, 0xca, 0xa2, 0x37, 0x73, 0x41, 0xe4, 0x62, 0x19, 0x76, 0x4f, 0xb6, 0x0a,
-	0x50, 0x0f, 0x1d, 0x3f, 0xdc, 0xe9, 0xb6, 0xf1, 0x8f, 0x74, 0xb4, 0x13, 0xb6, 0x02, 0xb1, 0x3e,
-	0x82, 0xbc, 0x1c, 0x02, 0x3d, 0xf6, 0x28, 0xc6, 0x15, 0x1d, 0xce, 0xa2, 0x16, 0x8e, 0x28, 0x62,
-	0x10, 0xd7, 0x61, 0x29, 0x36, 0x15, 0x5c, 0x4e, 0x4a, 0x64, 0xc2, 0x18, 0x8c, 0xdd, 0xc7, 0xdb,
-	0xf2, 0xdb, 0xaa, 0xc1, 0x7c, 0x62, 0xa6, 0x11, 0xa2, 0x21, 0xa6, 0xec, 0x8c, 0x48, 0x94, 0x7a,
-	0xbd, 0xbe, 0x4d, 0x60, 0x07, 0xbb, 0x75, 0x16, 0x6e, 0x43, 0x60, 0x07, 0xbb, 0xf5, 0xea, 0x24,
-	0x93, 0x1c, 0xeb, 0x5f, 0x67, 0xe9, 0x49, 0x2f, 0xc1, 0x83, 0x98, 0xc7, 0x40, 0xf5, 0x5a, 0x54,
-	0x21, 0x4f, 0x47, 0xbc, 0x21, 0xc2, 0xd2, 0x86, 0x3b, 0xea, 0x73, 0xbf, 0x1c, 0x94, 0x2f, 0x51,
-	0xef, 0x7c, 0x84, 0x86, 0xbe, 0x86, 0xa9, 0xcd, 0x6e, 0x9b, 0x52, 0x18, 0xbb, 0x00, 0x05, 0x81,
-	0x44, 0xe6, 0x81, 0x76, 0x99, 0x98, 0x0d, 0xfc, 0x58, 0x6d, 0x2b, 0x10, 0xca, 0x66, 0xf7, 0xd4,
-	0x65, 0xd7, 0xb1, 0x13, 0x36, 0xfb, 0x20, 0xdc, 0xa4, 0x5d, 0x10, 0xaf, 0x0c, 0xf2, 0xb6, 0xfc,
-	0x46, 0x16, 0x4c, 0x3c, 0xf6, 0xdb, 0x3c, 0xe6, 0x7b, 0x6e, 0x6d, 0x46, 0x3c, 0xbb, 0x26, 0x30,
-	0x9b, 0x15, 0x59, 0xff, 0x8b, 0x5e, 0x91, 0x84, 0xa9, 0x72, 0xa3, 0x71, 0x25, 0xf3, 0xda, 0x5c,
-	0xc9, 0xbe, 0x0a, 0x57, 0xe4, 0xa8, 0xc7, 0x4c, 0xa3, 0x1e, 0x37, 0x8d, 0x7a, 0xc2, 0x3c, 0xea,
-	0x2d, 0x98, 0x64, 0x43, 0x45, 0x37, 0x61, 0x62, 0x27, 0xc4, 0xa7, 0x91, 0x07, 0x40, 0xbd, 0xe4,
-	0xb6, 0x59, 0x19, 0x39, 0x9c, 0xec, 0x3a, 0x41, 0x28, 0x02, 0xbc, 0xf2, 0xb6, 0xf8, 0xb4, 0xfe,
-	0x24, 0x03, 0x85, 0x5d, 0x37, 0x08, 0xc9, 0x42, 0x38, 0xa7, 0xac, 0xc9, 0x11, 0x65, 0x4d, 0x23,
-	0x1a, 0x8b, 0x8d, 0xe8, 0x0b, 0x98, 0xa4, 0x71, 0x87, 0x01, 0x7f, 0x51, 0x74, 0x93, 0x0f, 0x29,
-	0xde, 0x30, 0x8b, 0x4e, 0x0c, 0xe8, 0xcb, 0x1f, 0x9b, 0xa3, 0x94, 0x3e, 0x83, 0x69, 0x05, 0x7c,
-	0xa1, 0x07, 0x41, 0xdf, 0xc1, 0xbc, 0xd2, 0x84, 0x74, 0x17, 0x8c, 0x70, 0x2a, 0x4b, 0xa7, 0x25,
-	0x61, 0xdb, 0x1e, 0xfe, 0x51, 0x65, 0x1b, 0xff, 0xb4, 0x7e, 0xa0, 0x61, 0xb3, 0xbb, 0x5e, 0xeb,
-	0x44, 0x71, 0xe9, 0x4d, 0x31, 0x65, 0x16, 0xf7, 0x8c, 0x93, 0x5a, 0xac, 0xc4, 0x16, 0x35, 0xd0,
-	0x0d, 0x98, 0xde, 0xe9, 0xde, 0xf7, 0xfc, 0x16, 0x7e, 0xdc, 0xed, 0x30, 0xea, 0x39, 0x5b, 0x05,
-	0x71, 0x6f, 0x0f, 0x6f, 0x21, 0xf2, 0xf6, 0x50, 0x40, 0xcc, 0xdb, 0xc3, 0x1e, 0x34, 0xda, 0xac,
-	0x8c, 0x3b, 0x93, 0xc8, 0xdf, 0xc3, 0x5c, 0x3d, 0xd2, 0x27, 0x34, 0xaa, 0xe2, 0x21, 0x5c, 0xb5,
-	0x71, 0xaf, 0xe3, 0x10, 0x5b, 0xf1, 0xd4, 0x63, 0xf5, 0xe5, 0x98, 0x6f, 0xa4, 0x44, 0x74, 0xe9,
-	0x17, 0x43, 0xb2, 0xcb, 0xd9, 0x21, 0x5d, 0x3e, 0x85, 0xb7, 0xb6, 0x70, 0x98, 0xfa, 0x2a, 0x31,
-	0x1a, 0xfc, 0x36, 0xe4, 0x78, 0xe4, 0xbc, 0x18, 0xff, 0xa8, 0x07, 0x91, 0xfc, 0x96, 0x84, 0xd3,
-	0x91, 0x7f, 0x59, 0xdf, 0x40, 0xd9, 0xd4, 0xdc, 0xf9, 0x02, 0x79, 0x5c, 0xb8, 0x61, 0x26, 0x20,
-	0xad, 0x89, 0x29, 0xde, 0xa0, 0x3c, 0x9c, 0x0f, 0xef, 0xad, 0xf4, 0x9b, 0x53, 0x7b, 0x8a, 0xff,
-	0x61, 0x55, 0x45, 0xa4, 0xc0, 0x6b, 0x74, 0xb7, 0x49, 0x3d, 0xfb, 0x3a, 0x81, 0x88, 0xaf, 0x15,
-	0xc8, 0x09, 0x58, 0xcc, 0xb5, 0x9f, 0x78, 0xf0, 0x49, 0x19, 0xda, 0x16, 0x04, 0x24, 0x9a, 0xf5,
-	0x83, 0xf0, 0xbf, 0xeb, 0x18, 0xe7, 0x8b, 0x0e, 0x3d, 0x8f, 0xc3, 0xdd, 0xf2, 0xe0, 0xaa, 0x4e,
-	0x5b, 0xf5, 0x22, 0x17, 0x14, 0x2f, 0x32, 0x73, 0x1e, 0x13, 0xb9, 0xb4, 0x77, 0x37, 0xbb, 0xed,
-	0x9e, 0xe7, 0x76, 0x43, 0xbe, 0x78, 0x55, 0x10, 0x5a, 0x55, 0x7d, 0xc5, 0x33, 0xc9, 0x70, 0xda,
-	0x7b, 0x50, 0x4a, 0x6b, 0x50, 0x71, 0xd1, 0x48, 0xb7, 0x2f, 0xb3, 0xe3, 0xac, 0x63, 0x58, 0xd4,
-	0x52, 0x68, 0x44, 0x39, 0x01, 0xa2, 0xd4, 0x21, 0xf9, 0xea, 0x97, 0xbf, 0x1e, 0x94, 0x3f, 0xbd,
-	0x48, 0xcc, 0xa6, 0xa0, 0x79, 0x20, 0x23, 0x82, 0xad, 0x65, 0x18, 0xab, 0xd9, 0xbb, 0x74, 0xd8,
-	0xf6, 0xae, 0x1c, 0xb6, 0xbd, 0x6b, 0xfd, 0x3a, 0x03, 0xe5, 0xda, 0xb1, 0xd3, 0x3d, 0xa2, 0xb6,
-	0x87, 0x62, 0xae, 0x2a, 0xd7, 0x9f, 0xe7, 0x3d, 0x52, 0xad, 0xc1, 0xf4, 0x1e, 0x7e, 0x21, 0xa2,
-	0x99, 0x79, 0x5c, 0x30, 0xf5, 0x92, 0x93, 0xe3, 0x4e, 0x8f, 0xc3, 0x6d, 0xb5, 0x12, 0xfa, 0xcb,
-	0xaf, 0xee, 0x03, 0x62, 0x0f, 0xe9, 0xa3, 0x93, 0x14, 0x2b, 0x4d, 0x3b, 0x52, 0x19, 0x9a, 0xb0,
-	0xfe, 0x6d, 0x06, 0x6e, 0x98, 0x07, 0xcf, 0x27, 0x6e, 0x43, 0x4b, 0x47, 0x30, 0xe4, 0xe2, 0x96,
-	0x1e, 0x59, 0x95, 0x74, 0x04, 0xf1, 0x14, 0x04, 0x36, 0x6e, 0x79, 0xcf, 0xb1, 0xff, 0x32, 0xe6,
-	0x0e, 0x17, 0xe0, 0x1a, 0xd9, 0x72, 0x44, 0x32, 0x17, 0x06, 0xd2, 0x5e, 0x20, 0x72, 0x98, 0xf5,
-	0x9f, 0x32, 0x70, 0x8d, 0x6e, 0x93, 0xdc, 0x59, 0x28, 0x0a, 0x2e, 0x7e, 0xcd, 0xff, 0x11, 0xcc,
-	0xa8, 0x8d, 0xf3, 0x09, 0xa3, 0xef, 0x97, 0x45, 0x0f, 0x9a, 0x2d, 0xaf, 0x8d, 0x6d, 0xad, 0x1a,
-	0xda, 0x81, 0x69, 0xfe, 0xad, 0xb8, 0x84, 0x96, 0x94, 0xe4, 0x26, 0x54, 0x1e, 0xd8, 0x83, 0x33,
-	0x3a, 0xfb, 0x9c, 0x58, 0x93, 0x46, 0xa8, 0xab, 0xb8, 0xd6, 0xaf, 0xb2, 0xb0, 0xd2, 0xc0, 0xbe,
-	0xfb, 0xec, 0xa5, 0x61, 0x30, 0x8f, 0x61, 0x51, 0x80, 0xe8, 0x98, 0x75, 0x39, 0x64, 0x2f, 0xc9,
-	0x44, 0x57, 0x03, 0x52, 0xa1, 0x29, 0xc5, 0x32, 0x15, 0xf1, 0x02, 0x6f, 0x2b, 0x3f, 0x84, 0x9c,
-	0x14, 0xe5, 0x31, 0xca, 0x19, 0x3a, 0x37, 0x42, 0x8c, 0xf5, 0x67, 0xe6, 0x52, 0x9e, 0xff, 0xa6,
-	0xf9, 0xd6, 0x81, 0x9f, 0x78, 0x46, 0x1c, 0x46, 0x99, 0x54, 0x13, 0x89, 0x76, 0x94, 0xd2, 0x14,
-	0xa9, 0xde, 0xbe, 0x64, 0x9b, 0x5a, 0xaa, 0x4e, 0x43, 0xbe, 0x42, 0xef, 0x44, 0xc8, 0x01, 0xe3,
-	0x7f, 0x67, 0x61, 0x55, 0x44, 0xfe, 0x19, 0xd8, 0xfc, 0x1d, 0x2c, 0x0b, 0x50, 0xa5, 0xd7, 0xf3,
-	0xbd, 0xe7, 0xb8, 0xad, 0x73, 0x9a, 0xbd, 0xe6, 0x14, 0x9c, 0x76, 0x78, 0x9d, 0x88, 0xd9, 0x26,
-	0xf4, 0x37, 0xe3, 0x66, 0xf9, 0x5a, 0x57, 0x2c, 0x6c, 0x36, 0xe8, 0x7b, 0x25, 0x55, 0xb1, 0xe8,
-	0x79, 0x78, 0x54, 0x25, 0xd3, 0x4e, 0xb8, 0x69, 0xc6, 0x5f, 0xd7, 0x4d, 0x43, 0x8e, 0xa6, 0x3a,
-	0xcd, 0xea, 0x1c, 0xcc, 0xec, 0xe1, 0x17, 0x11, 0xdf, 0x7f, 0x37, 0x03, 0xb3, 0xda, 0xe2, 0x46,
-	0xef, 0xc2, 0x04, 0xfd, 0x83, 0x6e, 0x9a, 0xfc, 0x49, 0x0b, 0x59, 0x60, 0xda, 0x93, 0x16, 0x56,
-	0x75, 0x07, 0xa6, 0x58, 0x94, 0x4b, 0xfb, 0x1c, 0x67, 0x08, 0x19, 0x44, 0xd5, 0x62, 0x28, 0xec,
-	0x38, 0xc1, 0xf1, 0xad, 0x87, 0xf0, 0x16, 0x0f, 0x98, 0xd1, 0x27, 0xbf, 0xa6, 0xda, 0xef, 0xe7,
-	0xd4, 0xf1, 0x96, 0x03, 0xab, 0x5b, 0x38, 0xae, 0x7a, 0xb4, 0x20, 0xb3, 0x6f, 0xe0, 0xb2, 0x06,
-	0x97, 0x14, 0x69, 0xd8, 0xbb, 0x94, 0x21, 0x49, 0x3a, 0x5e, 0xdb, 0xba, 0x91, 0xd6, 0x84, 0xda,
-	0x59, 0x0b, 0xc3, 0x65, 0x7a, 0x52, 0x96, 0x17, 0x43, 0xc1, 0x05, 0xb4, 0xde, 0x6d, 0x65, 0x5d,
-	0x33, 0x8d, 0xc7, 0x5e, 0x4c, 0x8a, 0xed, 0x49, 0x96, 0x5a, 0xff, 0x33, 0x03, 0x16, 0xe7, 0x5c,
-	0x9a, 0x1b, 0x47, 0x0c, 0xf8, 0x30, 0xd1, 0x1b, 0xbe, 0x4b, 0x5c, 0x51, 0x9d, 0x55, 0x51, 0x29,
-	0x13, 0x2d, 0xfa, 0x88, 0xa4, 0x15, 0x41, 0x35, 0xd1, 0x4a, 0x0c, 0xef, 0xe7, 0x06, 0x3d, 0xc8,
-	0x56, 0x13, 0x4d, 0xe3, 0x61, 0xd0, 0x83, 0x1a, 0xdd, 0x54, 0x22, 0xaa, 0xbf, 0xeb, 0x1f, 0x65,
-	0xe0, 0x1a, 0x1b, 0xf2, 0xbe, 0xef, 0x3e, 0x77, 0x3b, 0xf8, 0x08, 0x6b, 0x93, 0xdb, 0x4f, 0xbf,
-	0x06, 0xca, 0x9c, 0x4b, 0xb3, 0xd1, 0x8c, 0x04, 0x98, 0xa3, 0x9b, 0xdc, 0x9f, 0x69, 0xf4, 0xad,
-	0xbf, 0x9f, 0x81, 0x55, 0xf1, 0x60, 0x2a, 0x76, 0x37, 0x72, 0x51, 0x23, 0xa5, 0xaa, 0xdd, 0x67,
-	0x64, 0x0d, 0xf7, 0x19, 0x9a, 0xff, 0x39, 0x8c, 0x5f, 0x70, 0xfc, 0x61, 0x16, 0xe6, 0xf7, 0x9d,
-	0x23, 0xb7, 0x4b, 0xd6, 0x97, 0x48, 0xe9, 0x81, 0x2a, 0x89, 0xcc, 0x48, 0xc3, 0x03, 0x53, 0x52,
-	0x52, 0x1f, 0xad, 0xa9, 0x49, 0x4a, 0xb2, 0xa6, 0x90, 0x65, 0x3d, 0x15, 0xc9, 0x67, 0x9a, 0x07,
-	0x2e, 0x11, 0x9b, 0x44, 0x9f, 0xbd, 0x74, 0xbd, 0x76, 0x2c, 0x5b, 0x18, 0xf5, 0x62, 0x3d, 0x86,
-	0x69, 0x25, 0xc0, 0x88, 0x2b, 0xc5, 0x04, 0x05, 0xaa, 0x68, 0x4f, 0xfa, 0x87, 0x38, 0x35, 0x33,
-	0x8c, 0x4a, 0xa1, 0x0a, 0x90, 0x13, 0x89, 0xe8, 0xac, 0x7f, 0x39, 0x01, 0x8b, 0xe4, 0x28, 0x2d,
-	0xf8, 0x13, 0x44, 0x0a, 0x62, 0x46, 0xc0, 0x14, 0x2b, 0x97, 0xef, 0xe5, 0x0c, 0xde, 0x8c, 0xe5,
-	0xc5, 0xd3, 0x10, 0xd0, 0x47, 0xaa, 0xaf, 0x21, 0xab, 0xbc, 0x96, 0x4f, 0xa6, 0x34, 0x53, 0x9d,
-	0x10, 0xef, 0x6a, 0x6e, 0x15, 0xa6, 0x7d, 0x3b, 0x04, 0xa0, 0x6a, 0x5f, 0xe6, 0x99, 0x58, 0x8f,
-	0xfb, 0x5a, 0x58, 0x03, 0x6c, 0x65, 0x9d, 0x60, 0xcd, 0x30, 0x93, 0x2e, 0x8b, 0x27, 0xd2, 0x65,
-	0x31, 0x41, 0xcf, 0x44, 0x3f, 0x51, 0x5c, 0x16, 0x71, 0x26, 0xa8, 0x6e, 0x0b, 0xf6, 0x3e, 0xb3,
-	0x43, 0x01, 0xea, 0xfb, 0x4c, 0x56, 0x05, 0x1d, 0xc0, 0xc2, 0xbe, 0x8f, 0xdb, 0x74, 0x29, 0x6d,
-	0xfe, 0xd8, 0xf3, 0xb9, 0x21, 0x4a, 0x1d, 0x5f, 0x2c, 0x75, 0x50, 0x4f, 0x14, 0x37, 0xb1, 0x2c,
-	0x57, 0x57, 0x54, 0x0a, 0x3a, 0xda, 0x84, 0xb9, 0x3a, 0x76, 0xfc, 0xd6, 0xf1, 0x43, 0xfc, 0x92,
-	0x28, 0xbb, 0xa0, 0x38, 0x15, 0xa5, 0x5b, 0x08, 0x68, 0x09, 0x19, 0x28, 0x2d, 0x52, 0x2f, 0x27,
-	0x74, 0x24, 0xf4, 0x53, 0x98, 0xac, 0x7b, 0x7e, 0x58, 0x7d, 0x19, 0xcb, 0x71, 0xc7, 0x80, 0xd5,
-	0xab, 0x22, 0xe5, 0x44, 0xe0, 0xf9, 0x61, 0xf3, 0x50, 0xe5, 0x1b, 0xc7, 0x43, 0xf7, 0xc9, 0xde,
-	0x4c, 0xec, 0x85, 0xd0, 0xe9, 0xd4, 0xe8, 0x5d, 0x38, 0x7b, 0x61, 0xc3, 0xf7, 0x5f, 0x6a, 0x64,
-	0x84, 0x4e, 0xa7, 0x49, 0x77, 0x03, 0xfd, 0x9a, 0x44, 0xc5, 0x7a, 0x1d, 0x9f, 0xcf, 0x1f, 0x67,
-	0x60, 0x29, 0x36, 0x49, 0xdc, 0xf6, 0x7f, 0x0c, 0x79, 0x09, 0xe4, 0x27, 0x5d, 0xe1, 0x9d, 0x4f,
-	0xac, 0x7f, 0x26, 0x22, 0x42, 0x82, 0x55, 0xa6, 0x45, 0x34, 0xd0, 0xbd, 0x98, 0x7b, 0x88, 0xd9,
-	0x94, 0x5d, 0xfc, 0x63, 0x5c, 0xac, 0x44, 0x35, 0xf4, 0x19, 0x80, 0xc2, 0x1b, 0x26, 0xba, 0x34,
-	0xf1, 0x59, 0x3a, 0x5b, 0x94, 0xca, 0xd6, 0x9f, 0x4e, 0x0a, 0x65, 0xce, 0x4f, 0x21, 0x07, 0xbe,
-	0xd3, 0x3a, 0x89, 0x82, 0xdc, 0x3e, 0x4a, 0x46, 0x94, 0x9d, 0x67, 0x1d, 0xdd, 0xd2, 0xde, 0x9e,
-	0x9a, 0xd3, 0x58, 0x46, 0xcf, 0x90, 0xc7, 0xce, 0xf1, 0x0c, 0xf9, 0x2e, 0x4c, 0xed, 0x74, 0x9f,
-	0xbb, 0xc4, 0xe0, 0x61, 0xe1, 0x55, 0xd4, 0x5c, 0x70, 0x19, 0x48, 0x65, 0x0c, 0xaf, 0x85, 0x3e,
-	0x83, 0x1c, 0x39, 0xe9, 0xd3, 0x1d, 0x7f, 0x22, 0x32, 0x2a, 0x43, 0xea, 0x2e, 0x6b, 0x1e, 0xf3,
-	0x22, 0x75, 0xa5, 0x8a, 0xea, 0xe8, 0x63, 0x98, 0xaa, 0xb4, 0xdb, 0x64, 0x29, 0xf0, 0x65, 0x44,
-	0x73, 0xe0, 0x71, 0x4c, 0x87, 0x95, 0xa8, 0x4d, 0xf2, 0xca, 0xe8, 0x4b, 0xdd, 0x77, 0x35, 0x15,
-	0x3d, 0xd2, 0x4f, 0xcf, 0x07, 0xa9, 0xfb, 0xb5, 0xde, 0x15, 0x77, 0x06, 0xb9, 0x28, 0xed, 0x01,
-	0x4d, 0x61, 0xa0, 0xe9, 0x1f, 0x7a, 0xe5, 0xb0, 0x03, 0xf9, 0x9d, 0xae, 0x1b, 0xba, 0xf4, 0xe1,
-	0x77, 0x5e, 0xdb, 0x07, 0xf6, 0x1d, 0x3f, 0x74, 0x5b, 0x6e, 0xcf, 0xe9, 0x86, 0x6c, 0xb6, 0x5c,
-	0x51, 0x51, 0x9d, 0x2d, 0x89, 0xad, 0xa6, 0x88, 0x81, 0x37, 0x96, 0x22, 0x26, 0x35, 0xcb, 0xca,
-	0xf4, 0xab, 0x67, 0x59, 0x59, 0x67, 0x73, 0x49, 0x93, 0x65, 0xce, 0x44, 0x82, 0x48, 0x5d, 0x3a,
-	0x7a, 0x8a, 0x4c, 0x5b, 0x56, 0x44, 0x37, 0xe8, 0x43, 0xef, 0xd9, 0x28, 0x52, 0x51, 0xbb, 0xa3,
-	0xcc, 0xee, 0x6c, 0xa0, 0x26, 0xcc, 0x90, 0xda, 0xfb, 0x5e, 0xc7, 0x6d, 0xb9, 0x38, 0x28, 0xce,
-	0x69, 0x3e, 0x40, 0x7d, 0x51, 0xd0, 0x4a, 0x2f, 0xeb, 0x38, 0x64, 0x3b, 0x11, 0x6d, 0xba, 0xc7,
-	0x11, 0xd5, 0x9d, 0x48, 0x25, 0x68, 0xd9, 0x50, 0x8c, 0x2e, 0x12, 0x62, 0xab, 0xeb, 0xe3, 0x64,
-	0xd0, 0x38, 0x4d, 0x2e, 0x16, 0x05, 0x8d, 0xab, 0x13, 0x16, 0x85, 0x8f, 0x3f, 0x81, 0x6b, 0x36,
-	0x3e, 0xf5, 0x9e, 0xe3, 0x37, 0x4b, 0xf6, 0xe7, 0x70, 0x55, 0x27, 0xf8, 0xa4, 0xd7, 0xa6, 0x8f,
-	0xd0, 0xd8, 0x8d, 0x45, 0x6a, 0x7a, 0x02, 0x8e, 0xc0, 0xd2, 0x13, 0xb0, 0x37, 0xaf, 0xe4, 0x4f,
-	0x55, 0x5e, 0x69, 0x99, 0xe5, 0xc1, 0x8a, 0x4e, 0xbc, 0xd2, 0x6e, 0x2b, 0x82, 0x4a, 0x0c, 0x0d,
-	0xe5, 0x33, 0x66, 0xd9, 0xa8, 0x12, 0x4d, 0x35, 0x5b, 0x2f, 0x02, 0xa8, 0x6b, 0x49, 0xa9, 0x67,
-	0x61, 0x28, 0xc7, 0xd9, 0x43, 0x58, 0xa6, 0xb6, 0x59, 0x85, 0x59, 0xe5, 0x53, 0xda, 0xca, 0x74,
-	0xa9, 0x2b, 0x2d, 0xe8, 0x0c, 0xd3, 0x51, 0xac, 0x7f, 0x35, 0x06, 0xd7, 0x38, 0x9f, 0xde, 0xe4,
-	0x64, 0xa0, 0x1f, 0x60, 0x5a, 0x61, 0x3f, 0xe7, 0xc7, 0x0d, 0x71, 0xef, 0x6b, 0x9a, 0x26, 0xa6,
-	0x6a, 0xfa, 0x14, 0xd0, 0x8c, 0xcd, 0x04, 0xb1, 0xc4, 0xd4, 0x19, 0xed, 0xc0, 0x9c, 0x3e, 0x07,
-	0xdc, 0x3e, 0xbc, 0x99, 0xda, 0x88, 0x5e, 0x55, 0xbc, 0xa1, 0x6d, 0x37, 0x53, 0x67, 0x82, 0x26,
-	0x6a, 0xd4, 0xe7, 0xf7, 0x47, 0x98, 0x4f, 0x4c, 0x00, 0x37, 0x27, 0x6f, 0xa5, 0x36, 0x98, 0xa8,
-	0xcd, 0xf4, 0x86, 0x4f, 0xc1, 0xc6, 0x66, 0x93, 0x8d, 0x54, 0x73, 0x30, 0xc9, 0x86, 0x4d, 0xd6,
-	0xcd, 0xbe, 0x8f, 0x03, 0xdc, 0x6d, 0x61, 0xf5, 0x72, 0xfd, 0x75, 0xd7, 0xcd, 0x7f, 0xcc, 0x40,
-	0x31, 0x8d, 0x6e, 0x1d, 0x77, 0xdb, 0x68, 0x1f, 0x0a, 0xf1, 0x86, 0xb8, 0xd1, 0x6f, 0x09, 0x33,
-	0xc1, 0xdc, 0xa5, 0xed, 0x4b, 0x76, 0x02, 0x9b, 0x68, 0x56, 0x05, 0x76, 0xc1, 0x28, 0x86, 0x24,
-	0xaa, 0x72, 0xb6, 0x7b, 0xef, 0x3d, 0xc8, 0xcb, 0xec, 0xd3, 0x28, 0x07, 0xe3, 0x3b, 0x7b, 0x3b,
-	0x07, 0x2c, 0x9b, 0xd1, 0xfe, 0x93, 0x83, 0x42, 0x06, 0x01, 0x4c, 0x6e, 0x6c, 0xee, 0x6e, 0x1e,
-	0x6c, 0x16, 0xb2, 0xef, 0x35, 0xd5, 0x53, 0x12, 0xba, 0x06, 0xcb, 0x1b, 0x9b, 0x8d, 0x9d, 0xda,
-	0x66, 0xf3, 0xe0, 0x2f, 0xec, 0x6f, 0x36, 0x9f, 0xec, 0xd5, 0xf7, 0x37, 0x6b, 0x3b, 0xf7, 0x77,
-	0x36, 0x37, 0x0a, 0x97, 0xd0, 0x22, 0x14, 0xd4, 0xc2, 0x83, 0xc7, 0x07, 0xfb, 0x85, 0x0c, 0x2a,
-	0xc2, 0xa2, 0x0a, 0x7d, 0xba, 0x59, 0xad, 0x3c, 0x39, 0xd8, 0xde, 0x2b, 0x8c, 0x59, 0xe3, 0xb9,
-	0x6c, 0x21, 0xfb, 0xde, 0x2d, 0x7e, 0x63, 0x89, 0xe6, 0x00, 0x36, 0x36, 0xeb, 0xb5, 0xcd, 0xbd,
-	0x8d, 0x9d, 0xbd, 0xad, 0xc2, 0x25, 0x34, 0x0b, 0xf9, 0x8a, 0xfc, 0xcc, 0xac, 0xfd, 0xd1, 0x0f,
-	0x30, 0x4d, 0x46, 0x2b, 0x32, 0x4e, 0x36, 0x61, 0xf9, 0x91, 0xe3, 0x76, 0x43, 0xc7, 0xed, 0xf2,
-	0x39, 0x12, 0x1c, 0x46, 0xe5, 0x21, 0x2c, 0x27, 0xb3, 0x55, 0x1a, 0x15, 0x97, 0x71, 0x3b, 0x73,
-	0x2f, 0x83, 0xea, 0xb0, 0x98, 0x66, 0x33, 0x21, 0x4b, 0x7f, 0x0a, 0x9d, 0xa6, 0x0e, 0x4a, 0xcb,
-	0xa9, 0x3b, 0x4b, 0xe3, 0x03, 0xf4, 0x08, 0xe6, 0x13, 0xfb, 0x84, 0xec, 0xaf, 0x69, 0x07, 0x19,
-	0x46, 0xae, 0x48, 0x3d, 0x24, 0xa1, 0x1b, 0xdf, 0x25, 0x02, 0x74, 0x25, 0xb1, 0xbd, 0x6f, 0x12,
-	0x91, 0x36, 0x12, 0xbb, 0x97, 0x41, 0x36, 0x2c, 0xa6, 0xed, 0x38, 0x72, 0xc8, 0x43, 0xb6, 0xa3,
-	0x92, 0xa1, 0x39, 0x42, 0x33, 0x4d, 0x71, 0x4a, 0x9a, 0x43, 0xb4, 0xaa, 0x91, 0xe6, 0x97, 0xe4,
-	0xcc, 0xd2, 0x6d, 0x3f, 0xc4, 0xb8, 0x57, 0xe9, 0xb8, 0xcf, 0x71, 0x80, 0x44, 0x54, 0x91, 0x04,
-	0x99, 0x70, 0x6f, 0x67, 0xd0, 0x6f, 0xc1, 0x34, 0x4d, 0x47, 0xc9, 0x2f, 0xc1, 0x67, 0xd4, 0x14,
-	0x95, 0x25, 0xf1, 0x45, 0x0b, 0xef, 0x65, 0xd0, 0x57, 0x30, 0xb5, 0x85, 0xe9, 0x2d, 0x30, 0x7a,
-	0x2b, 0x96, 0x75, 0x7d, 0xa7, 0x2b, 0x4d, 0x61, 0xd1, 0xe1, 0xf8, 0x91, 0x19, 0xd5, 0x20, 0xc7,
-	0xd1, 0x03, 0x64, 0xc5, 0xf0, 0x83, 0x14, 0x02, 0x0b, 0x31, 0x02, 0xe4, 0x34, 0x82, 0x6a, 0x90,
-	0x97, 0x57, 0xd1, 0x68, 0xd9, 0x70, 0xff, 0x5d, 0x2a, 0x26, 0x0b, 0xb8, 0xd3, 0x64, 0xec, 0xef,
-	0x66, 0x33, 0xe8, 0x2e, 0x00, 0x7b, 0x44, 0x43, 0xc7, 0x12, 0xef, 0x68, 0x29, 0xc1, 0x40, 0xb4,
-	0x45, 0x56, 0x7e, 0x07, 0x87, 0xf8, 0xbc, 0x83, 0x37, 0xcd, 0xd6, 0x2e, 0xcc, 0xc9, 0x27, 0x2d,
-	0xe7, 0xe7, 0x84, 0x89, 0xda, 0xe7, 0x64, 0x05, 0xb1, 0x97, 0xa0, 0x32, 0xf6, 0x0b, 0x99, 0xa2,
-	0xc1, 0xe4, 0x74, 0xb2, 0x6a, 0x0a, 0xae, 0xcc, 0xf5, 0x29, 0x71, 0xe3, 0xd9, 0x3f, 0x63, 0xb8,
-	0x18, 0x4a, 0x6a, 0xbb, 0x7a, 0x1c, 0x18, 0xba, 0xa1, 0x74, 0x20, 0x35, 0x7c, 0xad, 0xf4, 0xd6,
-	0x90, 0x1a, 0x6c, 0x9e, 0xa8, 0xd6, 0x79, 0x00, 0xb3, 0x5a, 0xe4, 0x10, 0x12, 0x91, 0xc2, 0x69,
-	0xa1, 0x5d, 0xa5, 0x95, 0xf4, 0x42, 0x7e, 0x68, 0xbd, 0x4f, 0x95, 0x4d, 0x2c, 0xb7, 0x56, 0x29,
-	0x2d, 0x87, 0x16, 0xcb, 0x9a, 0x5a, 0x12, 0xd9, 0x16, 0x62, 0x28, 0x9b, 0xb0, 0x20, 0xfd, 0xc6,
-	0x4a, 0xc2, 0x72, 0x43, 0x36, 0x2e, 0xe3, 0xcc, 0x7d, 0x03, 0x0b, 0x5c, 0x0e, 0x34, 0x32, 0x05,
-	0xa9, 0x5c, 0x78, 0xe2, 0x26, 0x23, 0x81, 0x07, 0xb0, 0x54, 0x8f, 0x8d, 0x87, 0xd9, 0x38, 0x57,
-	0x75, 0x12, 0x4a, 0x1e, 0x2e, 0x23, 0xad, 0x87, 0x80, 0xea, 0xfd, 0xc3, 0x53, 0x57, 0x92, 0x7b,
-	0xee, 0xe2, 0x17, 0xe8, 0x7a, 0x6c, 0x48, 0x04, 0x48, 0xab, 0x51, 0xed, 0x54, 0x32, 0x8c, 0x18,
-	0x1d, 0xb0, 0xa7, 0xc1, 0x2c, 0x41, 0x89, 0xd3, 0x73, 0x0e, 0xdd, 0x8e, 0x1b, 0xba, 0x98, 0x88,
-	0x85, 0x8a, 0xa0, 0x16, 0x89, 0x19, 0xbc, 0x6a, 0xac, 0x81, 0xbe, 0x86, 0xd9, 0x2d, 0x1c, 0x46,
-	0xa9, 0xc6, 0xd0, 0x72, 0x22, 0x39, 0x19, 0x9f, 0x37, 0x71, 0x83, 0xa8, 0xe7, 0x37, 0xdb, 0x81,
-	0x02, 0x53, 0xae, 0x0a, 0x89, 0xeb, 0x09, 0x12, 0xbc, 0x8a, 0xe3, 0x3b, 0xa7, 0x81, 0x91, 0x5b,
-	0x77, 0x61, 0x7c, 0xdf, 0xed, 0x1e, 0x21, 0x24, 0x1a, 0x8a, 0x52, 0xf5, 0x94, 0x16, 0x34, 0x18,
-	0x17, 0xbd, 0x43, 0x28, 0xb3, 0x1c, 0x5b, 0xc9, 0xbc, 0x56, 0x22, 0x91, 0xf0, 0xdb, 0x32, 0xe0,
-	0x6f, 0x48, 0x2e, 0x2e, 0xc9, 0x9f, 0x78, 0x79, 0x63, 0x1d, 0xed, 0x53, 0xae, 0x27, 0x1b, 0x40,
-	0x37, 0xa3, 0xfd, 0xd4, 0x98, 0x56, 0xab, 0x84, 0xe2, 0x84, 0x1b, 0xeb, 0x48, 0xbe, 0x28, 0x4e,
-	0x21, 0x7a, 0x4b, 0xdb, 0xf6, 0x2f, 0x46, 0xf7, 0x6b, 0xc8, 0xcb, 0x9c, 0x52, 0x52, 0xdf, 0xc4,
-	0x13, 0x61, 0x49, 0x05, 0x9e, 0x4c, 0x3f, 0xf5, 0x25, 0x4b, 0xff, 0xa6, 0xe3, 0xc7, 0xd3, 0x2e,
-	0x19, 0x27, 0xef, 0x33, 0x98, 0x56, 0x12, 0x2e, 0xc9, 0xc5, 0x92, 0x4c, 0xc2, 0x54, 0xd2, 0x7f,
-	0x98, 0xe2, 0x1e, 0xd9, 0x34, 0xa6, 0x78, 0x86, 0x3f, 0xb4, 0x14, 0xa1, 0x29, 0x59, 0x6b, 0x62,
-	0x28, 0xe4, 0xfc, 0x2e, 0x52, 0x02, 0xa2, 0x2b, 0x3a, 0x86, 0xb9, 0x95, 0x75, 0x00, 0x36, 0x66,
-	0xda, 0x90, 0x5e, 0x6c, 0x1c, 0xd5, 0x3a, 0xd9, 0xcf, 0xda, 0x17, 0x44, 0xfa, 0x5a, 0xec, 0x69,
-	0x14, 0xa9, 0xa8, 0x71, 0x52, 0x1d, 0x95, 0x09, 0x7f, 0x07, 0x0a, 0x95, 0x16, 0xd5, 0xb2, 0x32,
-	0x91, 0x0e, 0x5a, 0x95, 0x2b, 0x58, 0x2f, 0x10, 0xb4, 0x96, 0xe2, 0x79, 0x79, 0x76, 0xb1, 0x43,
-	0x43, 0x92, 0x96, 0xe5, 0x5e, 0x1b, 0x2b, 0x4a, 0xc7, 0x30, 0x76, 0x6a, 0x13, 0x16, 0x6b, 0x4e,
-	0xb7, 0x85, 0x3b, 0xaf, 0x47, 0xe6, 0x73, 0xaa, 0x6e, 0x94, 0x24, 0x43, 0x57, 0xe2, 0xf8, 0x5c,
-	0xdb, 0xcc, 0xcb, 0x83, 0x9c, 0xac, 0x5a, 0x81, 0xcb, 0x8c, 0x89, 0x11, 0x5b, 0x4c, 0xd8, 0xa6,
-	0xe6, 0x3f, 0x81, 0xb9, 0x4d, 0xa2, 0x8e, 0xfb, 0x6d, 0x97, 0x45, 0xaf, 0x22, 0x3d, 0x1c, 0xd1,
-	0x88, 0xb8, 0x2d, 0x12, 0xb6, 0x29, 0xd9, 0x77, 0xa4, 0x90, 0x27, 0x13, 0x1c, 0x95, 0x16, 0x05,
-	0x59, 0x35, 0x51, 0x0f, 0xdd, 0x7b, 0x8f, 0x44, 0x86, 0x87, 0x58, 0x4e, 0x15, 0x55, 0xa1, 0x18,
-	0x33, 0xae, 0x94, 0xde, 0x1e, 0x5e, 0x49, 0xb5, 0xc5, 0x6c, 0x58, 0x36, 0xe4, 0xab, 0x41, 0xef,
-	0x48, 0xb3, 0x78, 0x58, 0x3e, 0x9b, 0x14, 0x73, 0xed, 0x3b, 0x25, 0x6b, 0x81, 0x81, 0xe6, 0xf0,
-	0x44, 0x36, 0x46, 0x06, 0xcb, 0x08, 0xad, 0xd4, 0x84, 0x33, 0xe8, 0x5d, 0x9d, 0xfa, 0x90, 0xa4,
-	0x34, 0xc6, 0x16, 0x1e, 0x53, 0xd1, 0x8b, 0xf2, 0x9d, 0x48, 0xa3, 0x27, 0x2d, 0x29, 0x8d, 0x34,
-	0x7a, 0x52, 0xb3, 0xc5, 0x30, 0x06, 0x6f, 0xc1, 0xe5, 0x58, 0xea, 0x17, 0x74, 0x3d, 0xce, 0xd8,
-	0x11, 0x0c, 0x65, 0x84, 0x1e, 0x09, 0xc1, 0x4e, 0x12, 0x4a, 0x4f, 0x06, 0x63, 0x1a, 0x23, 0x23,
-	0xf7, 0x44, 0x9a, 0x40, 0x6a, 0x7a, 0x17, 0xf4, 0x56, 0x0a, 0x0b, 0xcf, 0xc7, 0x3a, 0x46, 0xb6,
-	0x0e, 0x85, 0x78, 0x76, 0x14, 0xb4, 0x2a, 0xb9, 0x94, 0x9a, 0x02, 0xa6, 0x54, 0x36, 0x96, 0xf3,
-	0x4d, 0xe7, 0x41, 0x34, 0x29, 0xec, 0xa6, 0x28, 0x3e, 0x29, 0x6a, 0x66, 0x8c, 0xc4, 0xa4, 0xe8,
-	0x09, 0x2f, 0xb6, 0x68, 0x5c, 0xa9, 0x92, 0xe6, 0xc4, 0x78, 0x3a, 0xbd, 0x9e, 0x46, 0x27, 0xba,
-	0x87, 0xa9, 0x8b, 0x04, 0x92, 0x4a, 0xbf, 0x56, 0xb5, 0x7d, 0x33, 0xd9, 0xb5, 0xb2, 0xb1, 0x5c,
-	0x8e, 0xb4, 0x10, 0x4f, 0xf8, 0x21, 0x89, 0x1a, 0x32, 0x81, 0x18, 0x45, 0xf9, 0x3e, 0x2c, 0xea,
-	0xb3, 0x38, 0x62, 0xbc, 0x66, 0x5b, 0x77, 0x56, 0x4b, 0xf3, 0x81, 0xc4, 0xcf, 0x9c, 0xc4, 0x32,
-	0x8a, 0x24, 0xb8, 0x9f, 0x92, 0x6e, 0x84, 0x71, 0x5f, 0x49, 0x19, 0x72, 0x1e, 0xee, 0xa7, 0x65,
-	0x18, 0x91, 0x8c, 0x52, 0xfa, 0x25, 0xb6, 0xbf, 0x78, 0xc1, 0x45, 0x18, 0x75, 0x9e, 0xae, 0x99,
-	0xe8, 0x6c, 0x50, 0xeb, 0x46, 0xfe, 0x2e, 0xcf, 0x55, 0x8d, 0x4d, 0x9a, 0xc4, 0x97, 0xb4, 0xc1,
-	0xe9, 0xc2, 0x5e, 0x83, 0x19, 0x35, 0x63, 0x89, 0xb1, 0x17, 0xd7, 0x92, 0x34, 0x02, 0xe5, 0xbc,
-	0x35, 0x27, 0xb9, 0xc0, 0x7a, 0xb3, 0x12, 0x67, 0x8e, 0xd6, 0x21, 0xf3, 0x90, 0x90, 0xca, 0x9a,
-	0x11, 0x5d, 0x32, 0x9b, 0x05, 0x0b, 0xcc, 0x40, 0xd2, 0x7f, 0xb6, 0xc9, 0xf0, 0xeb, 0x4f, 0x46,
-	0x32, 0x4f, 0x68, 0xb4, 0xba, 0x9a, 0x7e, 0x04, 0x29, 0x52, 0x92, 0x92, 0x96, 0xa4, 0xb4, 0x6a,
-	0x2a, 0x56, 0x35, 0xf4, 0xb7, 0x30, 0x9f, 0x48, 0xb3, 0x22, 0x1d, 0x61, 0xa6, 0x04, 0x2c, 0xc3,
-	0xb5, 0xe0, 0x36, 0x19, 0x70, 0x0c, 0xb1, 0xb1, 0x36, 0x9a, 0x68, 0x72, 0x2f, 0xdd, 0x15, 0x01,
-	0xee, 0x69, 0x9d, 0x33, 0x25, 0x73, 0x31, 0x72, 0xf0, 0x00, 0x96, 0x52, 0xd3, 0xb8, 0x48, 0xb3,
-	0x62, 0x58, 0x92, 0x17, 0x23, 0xd5, 0xbf, 0x48, 0xd3, 0xa8, 0xc6, 0x52, 0x84, 0x48, 0x3f, 0x84,
-	0x31, 0x2d, 0x8c, 0xf4, 0x43, 0x98, 0xf3, 0xb5, 0x30, 0x6e, 0xee, 0xc2, 0x62, 0x5a, 0xd2, 0x15,
-	0xc5, 0x6f, 0x67, 0xcc, 0xc8, 0x92, 0xc2, 0x51, 0x5b, 0xac, 0x76, 0x03, 0xb5, 0x21, 0x29, 0x58,
-	0x8c, 0x1c, 0xf8, 0x99, 0x48, 0xac, 0x93, 0x4c, 0x95, 0x22, 0x4f, 0x6b, 0x23, 0x72, 0xa9, 0x0c,
-	0x31, 0x2a, 0x2f, 0xd7, 0xdd, 0xa3, 0xae, 0x92, 0xd5, 0x44, 0x9a, 0x94, 0xc9, 0x74, 0x2a, 0x52,
-	0xb3, 0xa4, 0x25, 0x41, 0x79, 0x0c, 0x8b, 0x62, 0x8b, 0x55, 0xb3, 0x80, 0xa0, 0x04, 0x4e, 0x14,
-	0x94, 0x2e, 0xb5, 0x4c, 0x6a, 0xda, 0x10, 0x76, 0x26, 0xa3, 0xbf, 0xfb, 0xa2, 0x9c, 0xc9, 0x94,
-	0xf4, 0x1c, 0x25, 0x3d, 0x93, 0x07, 0xfa, 0x82, 0x9e, 0xc9, 0x58, 0xb6, 0x36, 0xb3, 0x53, 0x58,
-	0xa3, 0x14, 0xe9, 0xb4, 0x75, 0xe1, 0x36, 0xa4, 0x0d, 0xea, 0x94, 0x47, 0x1f, 0xb3, 0x28, 0x92,
-	0x7e, 0xcc, 0x52, 0x3b, 0x6a, 0x76, 0xce, 0xcc, 0xa8, 0x2f, 0x5d, 0x25, 0xaf, 0x52, 0x9e, 0xae,
-	0x4b, 0x5e, 0xa5, 0x3d, 0x34, 0xa7, 0x56, 0xfd, 0x81, 0x30, 0xe1, 0x22, 0x7a, 0xd7, 0x87, 0xbe,
-	0x14, 0x2f, 0xad, 0x0e, 0x7f, 0x5e, 0xcd, 0x6f, 0x07, 0x0a, 0xf1, 0xc7, 0xb8, 0x28, 0xed, 0x3d,
-	0xbe, 0xf2, 0x22, 0x59, 0x1a, 0x22, 0xc6, 0x57, 0xbc, 0xfb, 0xc2, 0x3c, 0xd4, 0xe9, 0x1a, 0x9e,
-	0x7b, 0xab, 0xa4, 0x87, 0x9b, 0x11, 0xd1, 0xbb, 0x5c, 0xd5, 0x88, 0x4b, 0xbc, 0xfb, 0x55, 0xcd,
-	0x88, 0x94, 0xa7, 0xbc, 0xae, 0x08, 0x22, 0x49, 0xcf, 0xf1, 0xf2, 0xae, 0x6e, 0x66, 0x0d, 0x09,
-	0x94, 0x1c, 0x79, 0xff, 0x82, 0x7e, 0x47, 0x24, 0xaf, 0x4b, 0x66, 0x40, 0x78, 0x27, 0xe6, 0x87,
-	0x49, 0x8f, 0x02, 0x2c, 0x0d, 0x4b, 0xb0, 0x80, 0x1e, 0xd1, 0xf7, 0x51, 0x8f, 0x77, 0x36, 0x6a,
-	0xfc, 0xd7, 0x1d, 0x3d, 0x3f, 0xe1, 0xe0, 0x56, 0x7e, 0xa1, 0x20, 0x62, 0x32, 0xab, 0xa2, 0x21,
-	0x36, 0xd6, 0x51, 0x9d, 0xfa, 0x59, 0x35, 0x68, 0x8a, 0x8f, 0x3b, 0x85, 0x60, 0x29, 0x9d, 0x20,
-	0x75, 0xfa, 0x6f, 0x8a, 0xdd, 0x4c, 0xef, 0xa6, 0xa1, 0x0f, 0xc3, 0xac, 0x00, 0x26, 0x36, 0xe9,
-	0x64, 0x44, 0xef, 0x46, 0xc9, 0x11, 0xe3, 0x58, 0xbd, 0xf2, 0x68, 0xf7, 0x95, 0x38, 0xa6, 0x21,
-	0x36, 0xd6, 0x38, 0xc7, 0x34, 0xe8, 0xc5, 0x38, 0x16, 0x23, 0xa8, 0x73, 0x4c, 0xef, 0xa6, 0xa1,
-	0x0f, 0xa3, 0x39, 0x96, 0x4e, 0xe6, 0xbc, 0x1c, 0xfb, 0x96, 0xee, 0xcf, 0x5b, 0xf4, 0xb5, 0xce,
-	0x85, 0x78, 0x56, 0x14, 0x16, 0xac, 0x8e, 0xda, 0x58, 0x47, 0x4f, 0x69, 0x86, 0xbe, 0x18, 0xfc,
-	0x7c, 0x7c, 0x5b, 0x31, 0x11, 0xa5, 0x9c, 0xdb, 0x81, 0x25, 0xc6, 0xb9, 0x78, 0x77, 0x8d, 0x7d,
-	0x31, 0x0e, 0x7b, 0x4b, 0x18, 0x3b, 0x71, 0x52, 0x17, 0xe5, 0xdf, 0x06, 0x15, 0x91, 0x03, 0x9f,
-	0xd8, 0xa7, 0xed, 0xa4, 0xf1, 0xaa, 0x13, 0x11, 0x9e, 0x71, 0xbd, 0x7a, 0x63, 0x0d, 0xed, 0xd0,
-	0x59, 0xd0, 0xc1, 0xc3, 0xac, 0xfb, 0x74, 0x32, 0x94, 0x49, 0xdb, 0xc2, 0x20, 0x8a, 0xf5, 0xc9,
-	0xd4, 0xb6, 0xb9, 0x53, 0xf2, 0xe8, 0x73, 0xce, 0xd1, 0x99, 0x58, 0xc4, 0x36, 0x76, 0x76, 0xd2,
-	0x18, 0xc5, 0x99, 0xf8, 0x2f, 0x23, 0xa3, 0x9f, 0x42, 0x5e, 0x20, 0x8f, 0x66, 0x48, 0x1c, 0x9b,
-	0x32, 0xe4, 0x6b, 0x98, 0xe6, 0x0c, 0xa1, 0x3d, 0x30, 0xb5, 0x64, 0xec, 0xfe, 0x57, 0x30, 0xcd,
-	0xd9, 0x30, 0x74, 0x04, 0xe6, 0x6b, 0xc5, 0xa5, 0x2d, 0x1c, 0xa6, 0xfc, 0x72, 0xe7, 0xa8, 0xc1,
-	0xa4, 0xfd, 0x50, 0x28, 0x6a, 0xd0, 0x77, 0x8e, 0xa6, 0x5f, 0x59, 0x35, 0x91, 0x1c, 0xf9, 0x1b,
-	0xaf, 0x84, 0x6e, 0xdd, 0x4c, 0x77, 0x24, 0xbe, 0x71, 0xf4, 0x7b, 0xb0, 0x42, 0xef, 0x20, 0x2e,
-	0xda, 0x63, 0xf3, 0x21, 0xe5, 0x6a, 0x14, 0x7e, 0x10, 0xff, 0x81, 0x57, 0x13, 0xb1, 0x51, 0xbf,
-	0x2d, 0x4b, 0xa8, 0xd6, 0x8d, 0x54, 0x47, 0x61, 0x0f, 0xd9, 0x8c, 0xae, 0xd1, 0xb1, 0x5f, 0xb0,
-	0xb7, 0xc3, 0x35, 0x4d, 0xec, 0x17, 0x67, 0x47, 0x45, 0x4f, 0xc4, 0x7f, 0xd3, 0x96, 0x50, 0xa9,
-	0x27, 0xa8, 0x98, 0x6a, 0x0f, 0xdb, 0x7c, 0xe8, 0xd0, 0xce, 0xd9, 0x1b, 0xf3, 0xe5, 0x48, 0x5e,
-	0x26, 0x81, 0x40, 0x8a, 0x6d, 0xaf, 0xa5, 0x38, 0x28, 0xcd, 0xaa, 0xb1, 0x0e, 0x01, 0xaa, 0xb0,
-	0x3d, 0x5e, 0x4d, 0x86, 0xa0, 0x78, 0x11, 0x53, 0xb3, 0x24, 0xc4, 0x49, 0xb0, 0xb3, 0x09, 0xfd,
-	0x19, 0x5c, 0xe5, 0x6c, 0xa2, 0x3c, 0x13, 0x2f, 0xe9, 0x8f, 0xb8, 0xb9, 0x0a, 0xa3, 0x2f, 0xb9,
-	0xd5, 0xfb, 0x22, 0xf5, 0xa1, 0xb8, 0x7a, 0x36, 0xd1, 0x9f, 0xb4, 0xcb, 0xb3, 0x09, 0x6d, 0x50,
-	0xa7, 0x3c, 0xfa, 0x6c, 0x42, 0x91, 0xf4, 0xb3, 0x89, 0xda, 0x51, 0xf3, 0xc2, 0x43, 0xc9, 0x37,
-	0xed, 0xf2, 0xdc, 0x6d, 0x7c, 0xee, 0x3e, 0xe4, 0x4a, 0x69, 0x21, 0x25, 0x7b, 0x89, 0xb4, 0xf9,
-	0xcd, 0x99, 0x4d, 0x4a, 0xfa, 0xfd, 0xc8, 0xbd, 0x0c, 0xda, 0xa3, 0x79, 0x72, 0xd3, 0x7e, 0x1d,
-	0xd8, 0x24, 0x3f, 0x43, 0x7f, 0x8e, 0x98, 0xd0, 0xab, 0xa7, 0xd3, 0x1b, 0x8a, 0x37, 0xe4, 0x58,
-	0x77, 0x95, 0x47, 0x94, 0x5c, 0xa0, 0x8b, 0x66, 0x11, 0x9f, 0x62, 0x3e, 0x62, 0x33, 0x6a, 0x41,
-	0xfd, 0x39, 0x5e, 0xba, 0x65, 0xdd, 0x81, 0x49, 0x86, 0x64, 0xdc, 0x6d, 0xb4, 0x9f, 0xf0, 0x45,
-	0x1f, 0x88, 0x8b, 0x5b, 0x82, 0xa2, 0x15, 0x19, 0xfb, 0xf5, 0x01, 0xe4, 0x99, 0xdb, 0xed, 0xfc,
-	0x28, 0x5f, 0x88, 0xeb, 0xdd, 0x61, 0x1d, 0x33, 0x47, 0x55, 0xcc, 0xaa, 0x0e, 0xe7, 0x8b, 0x33,
-	0xf2, 0x2b, 0xea, 0xfa, 0x14, 0xae, 0x06, 0x33, 0xfe, 0x52, 0xe2, 0xe7, 0x96, 0x29, 0x4b, 0x3f,
-	0xa5, 0xfe, 0x57, 0x99, 0x06, 0xc8, 0xd4, 0xfd, 0xe4, 0x8f, 0x35, 0xa3, 0x2f, 0x60, 0x8e, 0x31,
-	0x57, 0x22, 0x27, 0x2b, 0x0d, 0xe1, 0xd9, 0x1c, 0x63, 0xf3, 0xab, 0x20, 0xff, 0x54, 0x38, 0x6a,
-	0x47, 0x76, 0xfb, 0x3c, 0x2e, 0xda, 0xd1, 0xac, 0x33, 0x51, 0xf9, 0x1d, 0xba, 0xe9, 0xa6, 0xe7,
-	0xae, 0x30, 0x12, 0xbb, 0xad, 0xb8, 0xa0, 0x87, 0x67, 0xbd, 0x38, 0xa1, 0xd1, 0x81, 0xe9, 0x3f,
-	0xd8, 0x7d, 0x6b, 0x04, 0x15, 0xc1, 0x80, 0x9f, 0x8c, 0xac, 0x27, 0xfd, 0x5c, 0x3c, 0x49, 0x73,
-	0x7a, 0x7b, 0x23, 0x32, 0x58, 0xa4, 0xb8, 0x0c, 0x0d, 0x89, 0x21, 0x04, 0x41, 0xfd, 0xda, 0x71,
-	0xe8, 0x18, 0xcc, 0x47, 0xb4, 0x28, 0xd7, 0xf2, 0x05, 0x27, 0xc1, 0x6c, 0x46, 0xa1, 0x64, 0xba,
-	0x0c, 0x79, 0x77, 0xa3, 0xc3, 0xf9, 0x85, 0xf8, 0x5b, 0x26, 0x0e, 0x07, 0xca, 0x05, 0x0e, 0x0f,
-	0x45, 0x8d, 0xfd, 0x16, 0xa6, 0x29, 0xd9, 0xc6, 0x90, 0xd3, 0x19, 0x0f, 0xc6, 0x7c, 0x23, 0x84,
-	0x92, 0xb3, 0x7d, 0x71, 0x42, 0xd2, 0x31, 0x1c, 0x23, 0x64, 0x0d, 0x99, 0xde, 0xd1, 0x4e, 0xaf,
-	0xa2, 0x61, 0x5e, 0x2f, 0x3e, 0xa1, 0x4e, 0x14, 0xf6, 0x97, 0xcc, 0xe9, 0x21, 0xb7, 0x7d, 0x63,
-	0x7e, 0x11, 0x39, 0xbb, 0x43, 0x12, 0x82, 0xd4, 0xa2, 0xdf, 0xb6, 0xd0, 0x92, 0x80, 0xd4, 0xec,
-	0x5d, 0xe9, 0xae, 0x4b, 0xcb, 0x0e, 0x52, 0x02, 0x51, 0x68, 0xef, 0x92, 0xb5, 0x6e, 0x4a, 0x60,
-	0x11, 0x85, 0x2e, 0x0d, 0x4f, 0xef, 0x21, 0xd7, 0xfa, 0xc8, 0x4c, 0x18, 0x7b, 0xb0, 0x98, 0x96,
-	0x78, 0x42, 0x4e, 0xda, 0x90, 0xac, 0x14, 0xa9, 0xf1, 0x51, 0xfb, 0xb0, 0x94, 0x9a, 0xfc, 0x41,
-	0xde, 0x90, 0x0c, 0x4b, 0x0d, 0x91, 0x4a, 0xf1, 0x3b, 0x58, 0x36, 0x64, 0x3a, 0x88, 0x1c, 0x88,
-	0x43, 0x33, 0x21, 0x18, 0x05, 0xe2, 0x7b, 0x28, 0x99, 0x1f, 0xd1, 0xa3, 0xdb, 0xba, 0x13, 0xd4,
-	0xfc, 0x74, 0xbd, 0x94, 0x9a, 0xf5, 0x03, 0x1d, 0xd0, 0x84, 0x64, 0x69, 0xaf, 0xea, 0x65, 0xbf,
-	0x87, 0xbf, 0xba, 0x37, 0xc4, 0xb5, 0x2d, 0x1b, 0x1e, 0xd2, 0x0f, 0xa1, 0x7a, 0x8e, 0xde, 0xee,
-	0x09, 0xbd, 0xa4, 0xbf, 0x11, 0x8f, 0x85, 0xc8, 0xa7, 0x3e, 0x20, 0x4f, 0xed, 0xe7, 0x03, 0x98,
-	0xd5, 0x9e, 0x5f, 0x4a, 0xf1, 0x4f, 0x7b, 0x39, 0x2b, 0xbd, 0xd5, 0xa9, 0x2f, 0x36, 0xab, 0x85,
-	0x5f, 0xfe, 0x8f, 0xd5, 0xcc, 0x2f, 0x7f, 0xb5, 0x9a, 0xf9, 0x6f, 0xbf, 0x5a, 0xcd, 0xfc, 0xd9,
-	0xaf, 0x56, 0x33, 0x87, 0x93, 0xb4, 0xfa, 0xfa, 0xff, 0x0b, 0x00, 0x00, 0xff, 0xff, 0x8e, 0xe9,
-	0x48, 0xe5, 0x19, 0x8d, 0x00, 0x00,
+	0xc5, 0x40, 0x4f, 0x61, 0xce, 0xc6, 0x81, 0xd7, 0xf7, 0x5b, 0x78, 0x0b, 0x3b, 0x6d, 0xec, 0x17,
+	0xb3, 0x37, 0x33, 0x77, 0xa6, 0x57, 0x17, 0xef, 0x32, 0xa6, 0xe9, 0x85, 0xd5, 0xab, 0x67, 0x83,
+	0x32, 0xf2, 0x39, 0x2c, 0x22, 0xb6, 0x75, 0xc9, 0x8e, 0x91, 0x41, 0x3f, 0xc0, 0x6c, 0x0d, 0xfb,
+	0x61, 0xa5, 0x1f, 0x1e, 0x7b, 0xbe, 0x1b, 0xbe, 0x2c, 0x8e, 0x51, 0xba, 0x57, 0x39, 0x5d, 0xad,
+	0xac, 0xb1, 0x5a, 0x5d, 0x3e, 0x1b, 0x94, 0x8b, 0x64, 0x82, 0x9b, 0x8e, 0x80, 0x6a, 0xe4, 0x75,
+	0x62, 0xe8, 0x3b, 0x98, 0xa9, 0x13, 0x76, 0xb5, 0xf6, 0xbd, 0x13, 0xdc, 0x0d, 0x8a, 0xe3, 0x5a,
+	0xa7, 0xd5, 0xa2, 0xc6, 0x6a, 0xf5, 0xfa, 0xd9, 0xa0, 0xbc, 0x14, 0x50, 0x58, 0x33, 0xa4, 0x40,
+	0x8d, 0xb4, 0x46, 0x09, 0xfd, 0x08, 0x73, 0x7b, 0xbe, 0xf7, 0xdc, 0x0d, 0x5c, 0xaf, 0x4b, 0x41,
+	0xc5, 0x09, 0x4a, 0x7b, 0x89, 0xd3, 0xd6, 0x0b, 0x1b, 0xab, 0xd5, 0x1b, 0x67, 0x83, 0xf2, 0xb5,
+	0x9e, 0x80, 0xb2, 0x06, 0x74, 0xce, 0xe8, 0x28, 0x68, 0x1f, 0xa6, 0x6b, 0x9d, 0x7e, 0x10, 0x62,
+	0x7f, 0xd7, 0x39, 0xc5, 0xc5, 0x49, 0x4a, 0x7e, 0x41, 0xf0, 0x25, 0x2a, 0x69, 0xac, 0x56, 0x4b,
+	0x67, 0x83, 0xf2, 0xd5, 0x16, 0x03, 0x35, 0xbb, 0xce, 0xa9, 0xce, 0x72, 0x95, 0x0c, 0xfa, 0x04,
+	0xc6, 0x0f, 0x02, 0xec, 0x17, 0x73, 0x94, 0xdc, 0x2c, 0x27, 0x47, 0x40, 0x8d, 0x55, 0x36, 0xff,
+	0xfd, 0x00, 0xfb, 0x1a, 0x3e, 0x45, 0x20, 0x88, 0xb6, 0xd7, 0xc1, 0xc5, 0xbc, 0x86, 0x48, 0x40,
+	0x8d, 0x8f, 0x18, 0xa2, 0xef, 0x75, 0xf4, 0x86, 0x29, 0x02, 0xda, 0x86, 0x3c, 0x69, 0x39, 0xe8,
+	0x39, 0x2d, 0x5c, 0x04, 0x8a, 0x5d, 0xe0, 0xd8, 0x12, 0x5e, 0x5d, 0x3a, 0x1b, 0x94, 0xe7, 0xbb,
+	0xe2, 0x53, 0xa3, 0x12, 0x61, 0xa3, 0x6f, 0x60, 0xb2, 0x8e, 0xfd, 0xe7, 0xd8, 0x2f, 0x4e, 0x53,
+	0x3a, 0x97, 0xc5, 0x44, 0x52, 0x60, 0x63, 0xb5, 0xba, 0x70, 0x36, 0x28, 0x17, 0x02, 0xfa, 0xa5,
+	0xd1, 0xe0, 0x68, 0x44, 0xda, 0x6c, 0xfc, 0x1c, 0xfb, 0x01, 0xde, 0xef, 0x77, 0xbb, 0xb8, 0x53,
+	0x9c, 0xd1, 0xa4, 0x4d, 0x2b, 0x13, 0xd2, 0xe6, 0x33, 0x60, 0x33, 0xa4, 0x50, 0x5d, 0xda, 0x34,
+	0x04, 0x74, 0x0c, 0x05, 0xf6, 0x57, 0xcd, 0xeb, 0x76, 0x71, 0x8b, 0x2c, 0xa9, 0xe2, 0x2c, 0x6d,
+	0xe0, 0x1a, 0x6f, 0x20, 0x5e, 0xdc, 0x58, 0xad, 0x96, 0xcf, 0x06, 0xe5, 0xeb, 0x8c, 0x76, 0xb3,
+	0x25, 0x0b, 0xb4, 0x66, 0x12, 0x54, 0xc9, 0x38, 0x2a, 0xad, 0x16, 0x0e, 0x02, 0x1b, 0xff, 0xa2,
+	0x8f, 0x83, 0xb0, 0x38, 0xa7, 0x8d, 0x43, 0x2b, 0x6b, 0xac, 0xb1, 0x71, 0x38, 0x14, 0xd8, 0xf4,
+	0x19, 0x54, 0x1f, 0x87, 0x86, 0x80, 0xf6, 0x00, 0x2a, 0xbd, 0x5e, 0x1d, 0x07, 0x44, 0x18, 0x8b,
+	0x97, 0x29, 0xe9, 0x79, 0x4e, 0xfa, 0x29, 0x3e, 0xe4, 0x05, 0x8d, 0xd5, 0xea, 0xb5, 0xb3, 0x41,
+	0x79, 0xd1, 0xe9, 0xf5, 0x9a, 0x01, 0x03, 0x69, 0x44, 0x15, 0x1a, 0x8c, 0xef, 0xa7, 0x5e, 0x88,
+	0xb9, 0x28, 0x16, 0x0b, 0x31, 0xbe, 0x2b, 0x65, 0xa2, 0xbf, 0x3e, 0x05, 0x36, 0xb9, 0x58, 0xc7,
+	0xf9, 0xae, 0x20, 0x90, 0xb5, 0xb8, 0xee, 0x84, 0xce, 0xa1, 0x13, 0x60, 0x2e, 0x1e, 0x57, 0xb4,
+	0xb5, 0xa8, 0x17, 0x36, 0xd6, 0xd8, 0x5a, 0x6c, 0x73, 0x68, 0x33, 0x45, 0x5e, 0x62, 0xf4, 0x08,
+	0x47, 0xa2, 0x81, 0x17, 0xd1, 0x08, 0x8e, 0xbc, 0xc0, 0x87, 0xe9, 0x1c, 0x89, 0xaa, 0xa2, 0x2d,
+	0xc8, 0x3d, 0xc5, 0x87, 0x4c, 0x73, 0xcc, 0x53, 0x7a, 0x57, 0x22, 0x7a, 0x4c, 0x67, 0xac, 0xb1,
+	0x55, 0x41, 0xa8, 0x25, 0xb5, 0x85, 0xc4, 0x46, 0xbf, 0x97, 0x81, 0x25, 0xb1, 0xc2, 0x71, 0xf8,
+	0xc2, 0xf3, 0x4f, 0xdc, 0xee, 0x51, 0xcd, 0xeb, 0x3e, 0x73, 0x8f, 0x8a, 0x0b, 0x94, 0xf2, 0xcd,
+	0x98, 0xd2, 0x88, 0xd5, 0x6a, 0xac, 0x56, 0x7f, 0x76, 0x36, 0x28, 0xdf, 0x92, 0x0a, 0x44, 0x96,
+	0x13, 0x81, 0x7c, 0xe6, 0x1e, 0x69, 0x0d, 0x9b, 0xda, 0x42, 0x7f, 0x3d, 0x03, 0x57, 0xf9, 0xe8,
+	0x6c, 0xdc, 0xf2, 0xfc, 0x76, 0xd4, 0x8d, 0x45, 0xda, 0x8d, 0xb2, 0x5c, 0xad, 0x69, 0x95, 0x1a,
+	0xab, 0xd5, 0xdb, 0x67, 0x83, 0xb2, 0xc5, 0x19, 0xd7, 0xf4, 0x45, 0x71, 0x5a, 0x27, 0x0c, 0x0d,
+	0x11, 0x49, 0x20, 0xca, 0x7f, 0xcf, 0xc7, 0xcf, 0xb0, 0x8f, 0xbb, 0x2d, 0x5c, 0xbc, 0xaa, 0x49,
+	0x82, 0x5e, 0x28, 0xb4, 0x32, 0xd9, 0x4a, 0x9a, 0x3d, 0x09, 0xd6, 0x25, 0x41, 0x47, 0x41, 0xbf,
+	0x00, 0xc4, 0x19, 0x50, 0xe9, 0xb7, 0xdd, 0x90, 0x0f, 0x70, 0x89, 0xb6, 0x72, 0x5d, 0xe7, 0xb3,
+	0x52, 0xa1, 0xb1, 0x5a, 0xb5, 0xce, 0x06, 0xe5, 0x15, 0xc1, 0x62, 0x87, 0x14, 0xa5, 0x0d, 0x2c,
+	0x85, 0x38, 0xd1, 0xbc, 0x3b, 0x5e, 0xeb, 0xa4, 0x58, 0xd4, 0x34, 0x2f, 0x01, 0x09, 0x95, 0xdd,
+	0xf1, 0x5a, 0x27, 0xba, 0xe6, 0x25, 0xa5, 0x28, 0x84, 0x79, 0x3e, 0x4b, 0x36, 0x0e, 0x42, 0xdf,
+	0xa5, 0xba, 0x23, 0x28, 0x5e, 0xa3, 0x74, 0x96, 0x85, 0x0e, 0x4e, 0xd6, 0x68, 0x7c, 0xc8, 0x7a,
+	0xcb, 0x05, 0xa1, 0xe9, 0x2b, 0x65, 0x5a, 0x33, 0x69, 0xe4, 0xd1, 0x5f, 0x81, 0xc5, 0xa7, 0x6e,
+	0xb7, 0xed, 0xbd, 0x08, 0xd6, 0x71, 0x70, 0x12, 0x7a, 0xbd, 0x3a, 0xb3, 0xfc, 0x8a, 0x25, 0xda,
+	0xee, 0x8a, 0x10, 0xf3, 0xb4, 0x3a, 0x8d, 0xb5, 0xea, 0x3b, 0x67, 0x83, 0xf2, 0x5b, 0x2f, 0x58,
+	0x61, 0xb3, 0xcd, 0x4a, 0x9b, 0xdc, 0x78, 0xd4, 0x1a, 0x4f, 0x6f, 0x85, 0x88, 0x80, 0x5e, 0x50,
+	0xbc, 0xae, 0x89, 0x80, 0x5e, 0x28, 0x94, 0x41, 0xac, 0x41, 0x5d, 0x04, 0x74, 0x14, 0xb4, 0x09,
+	0x39, 0xa1, 0x1e, 0x8a, 0xcb, 0xda, 0xd2, 0x15, 0xe0, 0xc6, 0x1a, 0xb3, 0x80, 0x84, 0x8a, 0xd1,
+	0x57, 0xae, 0xa8, 0x85, 0x76, 0x20, 0x4f, 0x75, 0x24, 0x55, 0x59, 0x37, 0x28, 0x25, 0x24, 0x04,
+	0x55, 0xc0, 0x1b, 0x6b, 0xd5, 0xe2, 0xd9, 0xa0, 0xbc, 0xc0, 0xb4, 0x6c, 0x42, 0x51, 0x45, 0x04,
+	0xd0, 0x1a, 0x8c, 0x55, 0x7a, 0xbd, 0xe2, 0x0a, 0xa5, 0x33, 0x13, 0xd1, 0x69, 0xac, 0x55, 0xaf,
+	0x9c, 0x0d, 0xca, 0xb3, 0x4e, 0x4f, 0x1f, 0x16, 0xa9, 0x5d, 0x05, 0xc8, 0x09, 0x83, 0xec, 0xe1,
+	0x78, 0x6e, 0xaa, 0x90, 0xb3, 0xb6, 0x60, 0xe2, 0xa9, 0x13, 0xb6, 0x8e, 0xd1, 0x37, 0x30, 0xf1,
+	0xc8, 0xed, 0xb6, 0x83, 0x62, 0xe6, 0xe6, 0x18, 0xdd, 0xb3, 0x99, 0xb5, 0x48, 0x0b, 0x49, 0x41,
+	0x75, 0xe9, 0x97, 0x83, 0xf2, 0xa5, 0xb3, 0x41, 0xf9, 0xf2, 0x09, 0xa9, 0xa6, 0x98, 0x8c, 0x0c,
+	0xcf, 0xfa, 0xb7, 0x59, 0xc8, 0xcb, 0xda, 0x68, 0x19, 0xc6, 0xc9, 0xff, 0xd4, 0xf6, 0xcc, 0x57,
+	0x73, 0x67, 0x83, 0xf2, 0x38, 0xc1, 0xb3, 0x29, 0x14, 0xad, 0xc2, 0xf4, 0x8e, 0xe7, 0xb4, 0xeb,
+	0xb8, 0xe5, 0xe3, 0x30, 0xa0, 0xc6, 0x65, 0xae, 0x5a, 0x38, 0x1b, 0x94, 0x67, 0x3a, 0x9e, 0xd3,
+	0x6e, 0x06, 0x0c, 0x6e, 0xab, 0x95, 0x08, 0x45, 0x6a, 0x19, 0x8d, 0x45, 0x14, 0x89, 0x05, 0x61,
+	0x53, 0x28, 0x7a, 0x08, 0x93, 0x0f, 0xdc, 0x0e, 0xd9, 0x6b, 0xc6, 0x69, 0xff, 0x97, 0xe3, 0xfd,
+	0xbf, 0xcb, 0x8a, 0x37, 0xba, 0xa1, 0xff, 0x92, 0x19, 0x0e, 0xcf, 0x28, 0x40, 0x19, 0x08, 0xa7,
+	0x80, 0xee, 0xc3, 0x54, 0xbd, 0x7f, 0x48, 0xbb, 0x3f, 0x41, 0x1b, 0xa3, 0xb3, 0x1b, 0xf4, 0x0f,
+	0x9b, 0x64, 0x08, 0x0a, 0x82, 0xa8, 0x56, 0xfa, 0x0c, 0xa6, 0x15, 0xf2, 0xa8, 0x00, 0x63, 0x27,
+	0xf8, 0x25, 0x1b, 0xbb, 0x4d, 0xfe, 0x44, 0x0b, 0x30, 0xf1, 0xdc, 0xe9, 0xf4, 0x31, 0x1d, 0x6a,
+	0xde, 0x66, 0x1f, 0x9f, 0x67, 0x3f, 0xcd, 0x58, 0xff, 0x75, 0x1c, 0x0a, 0x5b, 0x5e, 0x10, 0x12,
+	0x4b, 0x56, 0x6e, 0xc9, 0xb7, 0x60, 0x92, 0xc0, 0xb6, 0xd7, 0x39, 0xff, 0xa6, 0xcf, 0x06, 0xe5,
+	0xa9, 0x63, 0x2f, 0x08, 0x9b, 0x6e, 0xdb, 0xe6, 0x45, 0xe8, 0x5d, 0xc8, 0xed, 0x7a, 0x6d, 0x4c,
+	0x99, 0x42, 0xc9, 0x56, 0x67, 0xcf, 0x06, 0xe5, 0x7c, 0xd7, 0x6b, 0x63, 0x6a, 0x15, 0xda, 0xb2,
+	0x18, 0x35, 0xb8, 0x35, 0xc7, 0x78, 0x57, 0x25, 0xbc, 0x23, 0xe6, 0xdb, 0x6f, 0x06, 0xe5, 0x8f,
+	0x2f, 0x70, 0xdc, 0xb8, 0x5b, 0x7f, 0x19, 0x84, 0xf8, 0x94, 0x50, 0xe2, 0xc6, 0xde, 0x53, 0x58,
+	0xa8, 0xb4, 0xdb, 0x2e, 0xc3, 0xd8, 0xf3, 0xdd, 0x6e, 0xcb, 0xed, 0x39, 0x9d, 0x80, 0xce, 0x41,
+	0xbe, 0x7a, 0xeb, 0x6c, 0x50, 0x2e, 0x3b, 0xb2, 0xbc, 0xd9, 0x93, 0x15, 0x14, 0x1e, 0xa6, 0x12,
+	0x40, 0x6b, 0x90, 0x5b, 0xdf, 0xad, 0x53, 0x53, 0xb0, 0x38, 0x41, 0x89, 0xd1, 0xcd, 0xb1, 0xdd,
+	0x0d, 0xe8, 0xd0, 0x54, 0x02, 0xb2, 0x22, 0xfa, 0x18, 0x66, 0xf6, 0xfa, 0x87, 0x1d, 0xb7, 0xb5,
+	0xbf, 0x53, 0x7f, 0x84, 0x5f, 0x52, 0x1b, 0x7a, 0x86, 0xa9, 0xcc, 0x1e, 0x85, 0x37, 0xc3, 0x4e,
+	0xd0, 0x3c, 0xc1, 0x2f, 0x6d, 0xad, 0x5e, 0x84, 0x57, 0xaf, 0x6f, 0x11, 0xbc, 0xa9, 0x04, 0x5e,
+	0x10, 0x1c, 0xab, 0x78, 0xac, 0x1e, 0xba, 0x07, 0xc0, 0x2c, 0x93, 0x4a, 0xbb, 0xcd, 0x4c, 0xec,
+	0x7c, 0xf5, 0xf2, 0xd9, 0xa0, 0x3c, 0xcd, 0x6d, 0x19, 0xa7, 0xdd, 0xf6, 0x6d, 0xa5, 0x0a, 0xaa,
+	0x41, 0xce, 0xf6, 0x18, 0x83, 0xb9, 0x61, 0x7d, 0x59, 0x1a, 0xd6, 0x0c, 0xcc, 0x8f, 0x52, 0xfc,
+	0x4b, 0x1d, 0xa5, 0xa8, 0x81, 0xca, 0x30, 0xb5, 0xeb, 0xd5, 0x9c, 0xd6, 0x31, 0x33, 0xaf, 0x73,
+	0xd5, 0x89, 0xb3, 0x41, 0x39, 0xf3, 0xdb, 0xb6, 0x80, 0x5a, 0xff, 0x22, 0x07, 0x05, 0x62, 0xc3,
+	0x6b, 0x12, 0xf5, 0x3e, 0xe4, 0x59, 0xdf, 0x1f, 0x71, 0xc1, 0x9c, 0xa9, 0xce, 0x9d, 0x0d, 0xca,
+	0xc0, 0x07, 0x48, 0x06, 0x17, 0x55, 0x40, 0x77, 0x20, 0x47, 0x28, 0x74, 0x23, 0xd1, 0x9a, 0x39,
+	0x1b, 0x94, 0x73, 0x7d, 0x0e, 0xb3, 0x65, 0x29, 0xaa, 0xc3, 0xd4, 0xc6, 0x4f, 0x3d, 0xd7, 0xc7,
+	0x01, 0x3f, 0xca, 0x95, 0xee, 0xb2, 0x13, 0xfb, 0x5d, 0x71, 0x62, 0xbf, 0xbb, 0x2f, 0x4e, 0xec,
+	0xd5, 0x1b, 0x5c, 0x85, 0x5c, 0xc1, 0x0c, 0x25, 0x1a, 0xdf, 0xef, 0xff, 0x59, 0x39, 0x63, 0x0b,
+	0x4a, 0xe8, 0x7d, 0x98, 0x7c, 0xe0, 0xf9, 0xa7, 0x4e, 0x48, 0x4f, 0x70, 0x79, 0xbe, 0x5c, 0x29,
+	0x44, 0x5b, 0xae, 0x14, 0x82, 0x1e, 0xc0, 0x9c, 0xed, 0xf5, 0x43, 0xbc, 0xef, 0x09, 0x73, 0x93,
+	0xad, 0xda, 0x95, 0xb3, 0x41, 0xb9, 0xe4, 0x93, 0x92, 0x66, 0xe8, 0x25, 0x0d, 0x4b, 0x3b, 0x86,
+	0x85, 0x36, 0x60, 0x4e, 0x33, 0x8c, 0x83, 0xe2, 0x24, 0x95, 0x3c, 0x66, 0x34, 0x68, 0xe6, 0xb4,
+	0x2a, 0x7f, 0x31, 0x24, 0xb4, 0x0b, 0x57, 0x1e, 0xf5, 0x0f, 0xb1, 0xdf, 0xc5, 0x21, 0x0e, 0x44,
+	0x8f, 0xa6, 0x68, 0x8f, 0x6e, 0x9e, 0x0d, 0xca, 0xcb, 0x27, 0xb2, 0x30, 0xa5, 0x4f, 0x49, 0x54,
+	0x84, 0xe1, 0x32, 0xef, 0xa8, 0xdc, 0x86, 0x72, 0xdc, 0x9c, 0x66, 0x2a, 0x2e, 0x56, 0x5a, 0xbd,
+	0xc5, 0xb9, 0x7c, 0x5d, 0x8e, 0x3d, 0xb9, 0x31, 0xd9, 0x71, 0x9a, 0x64, 0xc5, 0x49, 0x6d, 0x92,
+	0xa7, 0xbd, 0x65, 0x87, 0x34, 0xa1, 0x4d, 0x54, 0x59, 0x94, 0x7a, 0x65, 0x07, 0x26, 0x0e, 0x02,
+	0xe7, 0x88, 0x49, 0xe2, 0xdc, 0xea, 0x5b, 0xbc, 0x47, 0x71, 0xe9, 0xa3, 0xe7, 0x7a, 0x5a, 0xb1,
+	0x3a, 0x4f, 0x76, 0x90, 0x3e, 0xf9, 0x53, 0xdd, 0x41, 0x68, 0x19, 0xfa, 0x16, 0x80, 0xf7, 0x8a,
+	0xec, 0x6c, 0xd3, 0x7c, 0xaf, 0xd5, 0x06, 0x49, 0x36, 0xb1, 0x15, 0x3e, 0xbe, 0xab, 0x72, 0x7c,
+	0xda, 0x5e, 0x67, 0x2b, 0x44, 0xd0, 0x37, 0x30, 0x43, 0xd5, 0x95, 0x98, 0xd1, 0x19, 0x3a, 0xa3,
+	0xf4, 0xe8, 0x4f, 0x14, 0x60, 0xda, 0x7c, 0x6a, 0x08, 0xe8, 0xaf, 0xc2, 0x22, 0x27, 0x17, 0x33,
+	0x33, 0x66, 0xb9, 0x59, 0xa5, 0x75, 0x4f, 0xaf, 0x53, 0x7d, 0x8f, 0xf7, 0xd4, 0x92, 0x3d, 0x35,
+	0x1a, 0x1e, 0x76, 0x7a, 0x33, 0xd6, 0x77, 0x90, 0x97, 0xcc, 0x43, 0x53, 0x30, 0x56, 0xe9, 0x74,
+	0x0a, 0x97, 0xc8, 0x1f, 0xf5, 0xfa, 0x56, 0x21, 0x83, 0xe6, 0x00, 0x22, 0x89, 0x29, 0x64, 0xd1,
+	0x4c, 0x64, 0xac, 0x14, 0xc6, 0x68, 0xfd, 0x5e, 0xaf, 0x30, 0x8e, 0x50, 0xdc, 0x4a, 0x2a, 0x4c,
+	0x58, 0xff, 0x3d, 0x93, 0x10, 0x2c, 0xb2, 0x2f, 0x73, 0xc3, 0x8a, 0xca, 0x01, 0xdb, 0x7c, 0xe8,
+	0xbe, 0xcc, 0x4d, 0x32, 0xb6, 0xb1, 0xa8, 0x95, 0x88, 0xae, 0xd8, 0x23, 0x3c, 0x68, 0x79, 0x1d,
+	0x55, 0x57, 0xf4, 0x38, 0xcc, 0x96, 0xa5, 0x68, 0x55, 0xd1, 0x2a, 0x63, 0xd1, 0xc6, 0x2a, 0xb4,
+	0x8a, 0x2a, 0x61, 0x52, 0xbf, 0xac, 0x2a, 0xd6, 0xd7, 0x78, 0x84, 0x93, 0x22, 0xd1, 0xb2, 0x9e,
+	0xd5, 0x37, 0xcc, 0x19, 0xfa, 0x22, 0x61, 0x2c, 0xb2, 0x11, 0x52, 0xa1, 0x8c, 0x4d, 0x4d, 0xc2,
+	0x0e, 0x2c, 0xc3, 0xc4, 0x8e, 0x77, 0xe4, 0x76, 0xf9, 0x20, 0xf3, 0x67, 0x83, 0xf2, 0x44, 0x87,
+	0x00, 0x6c, 0x06, 0xb7, 0xfe, 0x4f, 0x46, 0x95, 0x5f, 0x69, 0xaf, 0x64, 0x52, 0xed, 0x95, 0xf7,
+	0x21, 0xcf, 0x0f, 0x35, 0xdb, 0xeb, 0x9c, 0x22, 0xd5, 0xc7, 0xe2, 0x3c, 0xe4, 0xb6, 0xed, 0xa8,
+	0x02, 0xd9, 0x69, 0x98, 0x72, 0xa6, 0x3b, 0xcd, 0x58, 0xb4, 0xd3, 0x70, 0xf5, 0xcd, 0x76, 0x9a,
+	0xa8, 0x0a, 0x99, 0x48, 0xd5, 0x9b, 0x34, 0x1e, 0x4d, 0xa4, 0xea, 0x37, 0xd2, 0x7d, 0x45, 0x9f,
+	0x03, 0x54, 0x9e, 0xd6, 0x89, 0xf4, 0x57, 0xec, 0x5d, 0xae, 0x43, 0xa9, 0xab, 0xc9, 0x79, 0x11,
+	0x34, 0xe9, 0x6a, 0x71, 0x7c, 0x75, 0x4b, 0x52, 0x6a, 0x5b, 0x1d, 0x98, 0xdb, 0xc4, 0x21, 0x99,
+	0x35, 0xb1, 0xe1, 0x0c, 0x1f, 0xfe, 0x97, 0x30, 0xfd, 0xd4, 0x0d, 0x8f, 0x75, 0x03, 0x90, 0x36,
+	0xf6, 0xc2, 0x0d, 0x8f, 0x85, 0x01, 0xa8, 0x34, 0xa6, 0x56, 0xb7, 0x36, 0xe0, 0x32, 0x6f, 0x4d,
+	0xee, 0x6f, 0xab, 0x3a, 0xc1, 0x4c, 0x64, 0x51, 0xaa, 0x04, 0x75, 0x32, 0x38, 0xae, 0xf0, 0x51,
+	0x3d, 0xb1, 0x05, 0x30, 0x6b, 0xd8, 0xe4, 0x69, 0xa1, 0x82, 0x13, 0xdb, 0x1a, 0xe2, 0x1b, 0x82,
+	0x75, 0x00, 0xb3, 0x7b, 0x9d, 0xfe, 0x91, 0xdb, 0x25, 0x02, 0x5a, 0xc7, 0xbf, 0x40, 0xeb, 0x00,
+	0x11, 0x80, 0xb7, 0x20, 0xdc, 0x0b, 0x51, 0x41, 0x63, 0x8d, 0x4f, 0x31, 0x85, 0x50, 0x1d, 0x6e,
+	0x2b, 0x78, 0xd6, 0xdf, 0x1b, 0x03, 0xc4, 0xdb, 0xa8, 0x87, 0x4e, 0x88, 0xeb, 0x38, 0x24, 0xdb,
+	0xc5, 0x55, 0xc8, 0x4a, 0xb3, 0x71, 0xf2, 0x6c, 0x50, 0xce, 0xba, 0x6d, 0x3b, 0xbb, 0xbd, 0x8e,
+	0x3e, 0x84, 0x09, 0x5a, 0x8d, 0xf2, 0x7a, 0x4e, 0xb6, 0xa7, 0x52, 0x60, 0x32, 0x1d, 0x90, 0x3f,
+	0x6d, 0x56, 0x19, 0x7d, 0x04, 0xf9, 0x75, 0xdc, 0xc1, 0x47, 0x4e, 0xe8, 0x09, 0xb9, 0x63, 0x86,
+	0x98, 0x00, 0x2a, 0x53, 0x14, 0xd5, 0x24, 0x1b, 0xb8, 0x8d, 0x9d, 0xc0, 0xeb, 0xaa, 0x1b, 0xb8,
+	0x4f, 0x21, 0xea, 0x06, 0xce, 0xea, 0xa0, 0x3f, 0xc8, 0xc0, 0x74, 0xa5, 0xdb, 0xe5, 0x06, 0x4e,
+	0xc0, 0x5d, 0xab, 0x8b, 0x77, 0xa5, 0x67, 0x7c, 0xc7, 0x39, 0xc4, 0x9d, 0x06, 0x31, 0x99, 0x83,
+	0xea, 0x0f, 0x44, 0xa7, 0xfe, 0xe9, 0xa0, 0xfc, 0xc5, 0xab, 0x38, 0xdb, 0xef, 0xee, 0xfb, 0x8e,
+	0x1b, 0x06, 0xd4, 0x8f, 0x15, 0x35, 0xa8, 0x8a, 0x99, 0xd2, 0x0f, 0xf4, 0x2e, 0x4c, 0x10, 0xf9,
+	0x16, 0x76, 0x00, 0x9d, 0x6c, 0xb2, 0x0e, 0xb4, 0xc3, 0x0f, 0xad, 0x61, 0xdd, 0x82, 0x3c, 0xe7,
+	0xe4, 0xf6, 0xba, 0x69, 0x0a, 0xac, 0x75, 0xb8, 0x41, 0xad, 0x38, 0x4c, 0x24, 0x97, 0x7a, 0x73,
+	0xb8, 0x24, 0x46, 0x66, 0xff, 0x14, 0x05, 0x4b, 0x6c, 0x3a, 0x21, 0xd4, 0x1b, 0x64, 0x8b, 0x12,
+	0xab, 0x06, 0xcb, 0x9b, 0x38, 0xb4, 0x71, 0x80, 0xc3, 0x3d, 0x27, 0x08, 0x5e, 0x78, 0x7e, 0x9b,
+	0x16, 0x5d, 0x88, 0xc8, 0xdf, 0xca, 0x40, 0xb9, 0xe6, 0x63, 0x32, 0xd3, 0x46, 0x42, 0xc3, 0x57,
+	0xf0, 0x32, 0xbf, 0x5c, 0xc8, 0x46, 0xa5, 0x84, 0xd7, 0xfc, 0x02, 0xe1, 0x1d, 0x18, 0xdb, 0xdf,
+	0xdf, 0xa1, 0x12, 0x33, 0x46, 0x19, 0x37, 0x16, 0x86, 0x9d, 0xdf, 0x0c, 0xca, 0xb9, 0xf5, 0x3e,
+	0xbb, 0x7c, 0xb0, 0x49, 0xb9, 0xf5, 0x0c, 0x16, 0x6d, 0xdc, 0xc5, 0x2f, 0x9c, 0xc3, 0x0e, 0xd6,
+	0xcc, 0xd5, 0x32, 0x4c, 0x30, 0x67, 0x59, 0x62, 0x08, 0x0c, 0xae, 0xdb, 0xb3, 0xd9, 0x11, 0xf6,
+	0xac, 0xf5, 0x87, 0x19, 0x28, 0xb0, 0xe1, 0x56, 0xbd, 0xf0, 0x7c, 0xe3, 0xe3, 0x23, 0xc8, 0x0e,
+	0x1f, 0x01, 0xba, 0x1d, 0x71, 0x7b, 0x2c, 0xda, 0xfc, 0x68, 0x57, 0x89, 0x0e, 0x17, 0x85, 0x64,
+	0x40, 0x4c, 0x96, 0xd8, 0xd1, 0x88, 0x0e, 0x88, 0xca, 0x92, 0x90, 0xa0, 0x3f, 0xce, 0xc2, 0x15,
+	0xa5, 0x8b, 0x41, 0xcf, 0xeb, 0x06, 0x98, 0x9c, 0xf1, 0x88, 0xb0, 0x28, 0xfd, 0xa4, 0x67, 0x3c,
+	0xb2, 0x65, 0x36, 0x23, 0x4b, 0x9c, 0x76, 0xf8, 0x5d, 0x72, 0xb8, 0xe8, 0x24, 0x8e, 0x83, 0x54,
+	0x71, 0xb3, 0xaa, 0xa2, 0xf8, 0xdc, 0x9d, 0xbe, 0x07, 0x39, 0xfa, 0x27, 0x61, 0xc4, 0xb8, 0x99,
+	0x11, 0xb2, 0x12, 0x72, 0x01, 0x1e, 0x7a, 0x6e, 0xf7, 0x31, 0x0e, 0x8f, 0x3d, 0x71, 0x78, 0xde,
+	0x26, 0x4a, 0xec, 0x2f, 0x79, 0x6e, 0xb7, 0x79, 0x4a, 0xc1, 0x17, 0x3d, 0x74, 0x46, 0x04, 0x6d,
+	0x85, 0xb8, 0x75, 0x1f, 0x0a, 0x44, 0xdf, 0x9c, 0x7f, 0x46, 0xad, 0x05, 0x40, 0x9b, 0x38, 0xac,
+	0x7a, 0xda, 0xc6, 0x61, 0xcd, 0xc2, 0xf4, 0x9e, 0xdb, 0x3d, 0x12, 0x9f, 0xff, 0x2e, 0x0b, 0x33,
+	0xec, 0x9b, 0xcf, 0x40, 0x6c, 0x27, 0xcd, 0x9c, 0x67, 0x27, 0xfd, 0x14, 0x66, 0xb9, 0x3b, 0x07,
+	0xfb, 0xd4, 0x85, 0xcc, 0xe6, 0x83, 0x9e, 0x28, 0x99, 0x57, 0xa7, 0xf9, 0x9c, 0x95, 0xd8, 0x7a,
+	0x45, 0xb4, 0x03, 0x73, 0x0c, 0xf0, 0x00, 0x3b, 0x61, 0x3f, 0x3a, 0x55, 0x5d, 0xe6, 0x76, 0xa6,
+	0x00, 0x33, 0x65, 0xc4, 0x69, 0x3d, 0xe3, 0x40, 0x3b, 0x86, 0x8b, 0xbe, 0x81, 0xcb, 0x7b, 0xbe,
+	0xf7, 0xd3, 0x4b, 0xc5, 0x76, 0x60, 0xfa, 0x78, 0x91, 0x1c, 0xc2, 0x7a, 0xa4, 0xa8, 0xa9, 0x5a,
+	0x10, 0xf1, 0xda, 0x44, 0xa6, 0xb6, 0x83, 0xaa, 0xe7, 0xbb, 0xdd, 0x23, 0x3a, 0x9b, 0x39, 0x26,
+	0x53, 0x6e, 0xd0, 0x3c, 0xa4, 0x40, 0x5b, 0x16, 0x5b, 0x7f, 0x34, 0x06, 0x39, 0xd9, 0xf0, 0x5d,
+	0xd5, 0x2c, 0xe5, 0x9b, 0x31, 0x5d, 0x9e, 0xd1, 0xe1, 0xc7, 0x56, 0x6a, 0xa0, 0x6b, 0xcc, 0x99,
+	0xc5, 0xcc, 0x80, 0x29, 0x22, 0x63, 0x4e, 0xaf, 0x47, 0x5d, 0x56, 0x44, 0x99, 0xae, 0x57, 0x29,
+	0x17, 0x72, 0x4c, 0x99, 0xb6, 0x0f, 0xed, 0xec, 0x7a, 0x95, 0xcc, 0xf5, 0x93, 0xed, 0xf5, 0x1a,
+	0x1d, 0x50, 0x8e, 0xcd, 0xb5, 0xe7, 0xb6, 0x5b, 0x36, 0x85, 0x92, 0xd2, 0x7a, 0xe5, 0xf1, 0x0e,
+	0xef, 0x34, 0x2d, 0x0d, 0x9c, 0xd3, 0x8e, 0x4d, 0xa1, 0xc4, 0x0e, 0x64, 0x7b, 0x74, 0xcd, 0xeb,
+	0x86, 0xbe, 0xd7, 0x09, 0xa8, 0xab, 0x20, 0xa7, 0x6d, 0xe7, 0x2d, 0x5e, 0x64, 0xc7, 0xaa, 0xa2,
+	0xa7, 0xb0, 0x54, 0x69, 0x3f, 0x77, 0xba, 0x2d, 0xdc, 0x66, 0x25, 0x4f, 0x3d, 0xff, 0xe4, 0x59,
+	0xc7, 0x7b, 0x11, 0xd0, 0x53, 0x5e, 0x8e, 0x9f, 0x17, 0x79, 0x95, 0x26, 0x27, 0xf7, 0x42, 0x54,
+	0xb2, 0x4d, 0xd8, 0x44, 0x45, 0xd4, 0x3a, 0x5e, 0xbf, 0x4d, 0x8f, 0x77, 0x39, 0xa6, 0x22, 0x5a,
+	0x04, 0x60, 0x33, 0x38, 0xe1, 0xd2, 0x56, 0xfd, 0x31, 0x3d, 0x9d, 0x71, 0x2e, 0x1d, 0x07, 0xa7,
+	0x36, 0x81, 0xa1, 0x77, 0x60, 0x4a, 0x98, 0xb4, 0xcc, 0x29, 0x40, 0x3d, 0x46, 0xc2, 0x94, 0x15,
+	0x65, 0xd6, 0x07, 0x70, 0x85, 0x2d, 0x9a, 0x73, 0x5b, 0x6a, 0xd6, 0x1e, 0x40, 0x1d, 0x9f, 0x3a,
+	0xbd, 0x63, 0x8f, 0x4c, 0x6c, 0x55, 0xfd, 0xe2, 0xa6, 0x0b, 0x92, 0x8e, 0x7e, 0x5e, 0xd0, 0x58,
+	0x13, 0xb6, 0xac, 0xa8, 0x69, 0x2b, 0x58, 0xd6, 0x7f, 0xc9, 0x02, 0xa2, 0x0e, 0xef, 0x7a, 0xe8,
+	0x63, 0xe7, 0x54, 0x74, 0xe3, 0x33, 0x98, 0x61, 0xfa, 0x8f, 0x81, 0x69, 0x77, 0x88, 0x5d, 0xc4,
+	0x04, 0x5f, 0x2d, 0xda, 0xba, 0x64, 0x6b, 0x55, 0x09, 0xaa, 0x8d, 0x83, 0xfe, 0xa9, 0x40, 0xcd,
+	0x6a, 0xa8, 0x6a, 0x11, 0x41, 0x55, 0xbf, 0xd1, 0x37, 0x30, 0x57, 0xf3, 0x4e, 0x7b, 0x84, 0x27,
+	0x1c, 0x79, 0x8c, 0x5b, 0x1f, 0xbc, 0x5d, 0xad, 0x70, 0xeb, 0x92, 0x1d, 0xab, 0x8e, 0x76, 0x61,
+	0xfe, 0x41, 0xa7, 0x1f, 0x1c, 0x57, 0xba, 0xed, 0x5a, 0xc7, 0x0b, 0x04, 0x95, 0x71, 0xee, 0x0c,
+	0xe1, 0xcb, 0x36, 0x59, 0x63, 0xeb, 0x92, 0x9d, 0x86, 0x88, 0xde, 0xe1, 0xb7, 0xf7, 0xdc, 0x0a,
+	0x9a, 0xbd, 0xcb, 0x2f, 0xf7, 0x9f, 0x74, 0xf1, 0x93, 0x67, 0x5b, 0x97, 0x6c, 0x56, 0x5a, 0xcd,
+	0xc3, 0x94, 0x50, 0x59, 0xf7, 0xe0, 0x8a, 0xc2, 0x4e, 0x62, 0xb7, 0xf5, 0x03, 0x54, 0x82, 0xdc,
+	0x41, 0xaf, 0xe3, 0x39, 0x6d, 0x61, 0x06, 0xd8, 0xf2, 0xdb, 0x7a, 0x5f, 0xe7, 0x34, 0x5a, 0x56,
+	0xcf, 0x22, 0xac, 0x72, 0x04, 0xb0, 0xb6, 0x74, 0xe6, 0x0e, 0xaf, 0xad, 0xb5, 0x9b, 0x8d, 0xb5,
+	0x5b, 0x88, 0xf3, 0xda, 0x5a, 0x4c, 0x65, 0x9e, 0xf5, 0x88, 0x9a, 0x38, 0x95, 0x5e, 0xaf, 0xe3,
+	0xb6, 0xe8, 0xce, 0xc0, 0xf4, 0x9a, 0xb4, 0x0e, 0x7e, 0x4b, 0xbd, 0x63, 0x56, 0xb6, 0x45, 0x79,
+	0xa3, 0xac, 0xdc, 0x22, 0x5b, 0xdf, 0xc3, 0x0d, 0x03, 0x31, 0xae, 0xe1, 0x3f, 0x83, 0x29, 0x0e,
+	0x8a, 0x09, 0xb4, 0xea, 0x95, 0xa7, 0xeb, 0x29, 0xe0, 0x98, 0xa2, 0xbe, 0xf5, 0x1d, 0xac, 0x1c,
+	0xf4, 0x02, 0xec, 0x27, 0xc9, 0x8b, 0xae, 0x7e, 0x2c, 0xef, 0xb0, 0x33, 0x46, 0x8f, 0x3f, 0x9c,
+	0x0d, 0xca, 0x93, 0x8c, 0xb6, 0xb8, 0xba, 0xb6, 0x7e, 0x3f, 0x03, 0x2b, 0x6c, 0xa9, 0x1a, 0x49,
+	0x5f, 0x84, 0x0b, 0x8a, 0x47, 0x39, 0x6b, 0xf6, 0x28, 0x0f, 0x75, 0xb1, 0x5b, 0xdf, 0x82, 0xc5,
+	0x7b, 0xd4, 0xe9, 0xbc, 0xa1, 0xb9, 0xf9, 0x1b, 0x19, 0x58, 0x60, 0x93, 0xf3, 0x1a, 0x54, 0xd0,
+	0x57, 0x30, 0x57, 0x3f, 0x71, 0x7b, 0x0d, 0xa7, 0xe3, 0xb6, 0x99, 0x73, 0x95, 0x6d, 0x24, 0x8b,
+	0x74, 0x8f, 0x3c, 0x71, 0x7b, 0xcd, 0xe7, 0x51, 0x51, 0xc6, 0x8e, 0x55, 0xb6, 0x9e, 0xc0, 0x62,
+	0xac, 0x0f, 0x5c, 0x30, 0x3e, 0x8e, 0x0b, 0x46, 0x22, 0x00, 0x21, 0x5d, 0x2a, 0x1e, 0xc3, 0x55,
+	0x29, 0x15, 0xfa, 0x94, 0xad, 0xc5, 0xa4, 0x21, 0x41, 0x30, 0x4d, 0x14, 0x5a, 0x70, 0x55, 0x4a,
+	0xc2, 0x6b, 0x48, 0x80, 0x98, 0xdc, 0x6c, 0xea, 0xe4, 0x6e, 0x43, 0x49, 0x9d, 0xdc, 0xd7, 0x99,
+	0xd4, 0xff, 0x9c, 0x81, 0xa5, 0x4d, 0xdc, 0xc5, 0xbe, 0x43, 0xbb, 0xac, 0x9d, 0x29, 0x54, 0xc7,
+	0x72, 0x66, 0xa8, 0x63, 0x59, 0x1a, 0xcc, 0xd9, 0x74, 0x83, 0x99, 0xec, 0x86, 0x07, 0xf6, 0x36,
+	0x97, 0x55, 0xba, 0x1b, 0xf6, 0x7d, 0xd7, 0x26, 0x30, 0xb4, 0x1d, 0x39, 0xa5, 0xc7, 0x47, 0x3a,
+	0xa5, 0xe7, 0xb9, 0x93, 0x6e, 0x8a, 0x3b, 0xa5, 0x35, 0x57, 0xb4, 0xf5, 0x05, 0x14, 0x93, 0x63,
+	0xe1, 0xf2, 0x31, 0xea, 0x90, 0x62, 0xad, 0x47, 0xd2, 0xcd, 0xef, 0xaf, 0xa5, 0x33, 0x3e, 0xa6,
+	0x42, 0x87, 0x38, 0x7f, 0xac, 0x7a, 0x24, 0x9f, 0x9c, 0x0a, 0x6f, 0xff, 0x73, 0x22, 0x9f, 0x2c,
+	0x46, 0x21, 0x63, 0x8e, 0x51, 0xe0, 0x32, 0xca, 0x50, 0x05, 0x82, 0xf5, 0x14, 0xae, 0x6a, 0x44,
+	0x23, 0xa9, 0xff, 0x0a, 0x72, 0x02, 0x16, 0xf3, 0x4d, 0x68, 0x64, 0xe9, 0xbc, 0x05, 0x02, 0x59,
+	0xa2, 0x58, 0xbf, 0xca, 0xc0, 0x12, 0xdb, 0x5d, 0x92, 0xe3, 0x3e, 0xff, 0xec, 0xff, 0xb9, 0x38,
+	0xbc, 0xee, 0xa7, 0x38, 0xbc, 0x28, 0x8a, 0xea, 0xf0, 0x52, 0xdd, 0x5c, 0x0f, 0xc7, 0x73, 0xd9,
+	0xc2, 0x98, 0xd5, 0x80, 0x62, 0x72, 0x84, 0x6f, 0x60, 0x4e, 0x36, 0x61, 0x49, 0x59, 0xe8, 0xaf,
+	0x2d, 0x31, 0x51, 0x8b, 0x6f, 0x50, 0x62, 0xa2, 0x8a, 0x6f, 0x4c, 0x62, 0xb6, 0x61, 0x9e, 0x11,
+	0xd6, 0x57, 0xd7, 0xaa, 0xba, 0xba, 0x52, 0xe3, 0x65, 0x92, 0x0b, 0xee, 0x31, 0x5d, 0x70, 0xa2,
+	0x4a, 0xd4, 0xc3, 0x8f, 0x60, 0x92, 0x87, 0x04, 0xb2, 0xfe, 0xa5, 0x10, 0xa3, 0x9a, 0x97, 0xc5,
+	0x01, 0xda, 0xbc, 0xb2, 0x55, 0xa4, 0x43, 0x26, 0xe7, 0x14, 0xee, 0xf0, 0x96, 0xa7, 0xc6, 0x6f,
+	0x89, 0x8a, 0x8b, 0x95, 0xbc, 0xe6, 0xae, 0xf1, 0x04, 0x8a, 0x6c, 0xd7, 0x50, 0xa8, 0xbe, 0xd6,
+	0xbe, 0xf1, 0x29, 0x14, 0x99, 0x38, 0xa5, 0x10, 0x1c, 0xbe, 0x19, 0xac, 0xc0, 0xb2, 0xdc, 0x0c,
+	0xd2, 0x46, 0xff, 0x77, 0x32, 0x70, 0x6d, 0x13, 0x87, 0x7a, 0xd4, 0xd4, 0xff, 0x97, 0xbd, 0xfb,
+	0x07, 0x28, 0xa5, 0x75, 0x84, 0x4f, 0xc5, 0xd7, 0xf1, 0xa9, 0x30, 0x86, 0x88, 0xa5, 0x4f, 0xc9,
+	0xf7, 0x70, 0x9d, 0x4d, 0x89, 0x5e, 0x5f, 0x0c, 0xf4, 0x8b, 0xd8, 0xac, 0x18, 0xa9, 0xa7, 0xcd,
+	0xce, 0xdf, 0xcf, 0xc0, 0x75, 0xc6, 0xe4, 0x74, 0xe2, 0x7f, 0xde, 0xd6, 0xdd, 0x2e, 0x94, 0xe5,
+	0x9c, 0xbf, 0x81, 0x89, 0xb5, 0x5a, 0x80, 0x04, 0x99, 0x5a, 0xdd, 0x16, 0x24, 0xae, 0xc1, 0x58,
+	0xad, 0x6e, 0xf3, 0x0b, 0x68, 0xba, 0x69, 0xb7, 0x02, 0xdf, 0x26, 0xb0, 0xb8, 0x06, 0xcf, 0x9e,
+	0x43, 0x83, 0x5b, 0x3f, 0x87, 0x79, 0xad, 0x11, 0x3e, 0xef, 0xcb, 0x30, 0x5e, 0xc3, 0x7e, 0xc8,
+	0x9b, 0xa1, 0x23, 0x6d, 0x61, 0x3f, 0xb4, 0x29, 0x14, 0xdd, 0x86, 0xa9, 0x5a, 0x85, 0x7a, 0x1b,
+	0xa9, 0x6d, 0x31, 0xc3, 0x14, 0x53, 0xcb, 0x69, 0xd2, 0x48, 0x72, 0x5b, 0x14, 0x5a, 0xff, 0x3e,
+	0xa3, 0x50, 0x27, 0xe8, 0xa3, 0xc7, 0xf0, 0x01, 0x39, 0x1e, 0x13, 0x9e, 0x29, 0x43, 0xb8, 0x42,
+	0xb6, 0x2d, 0xee, 0xa9, 0x61, 0x3b, 0x9f, 0xad, 0x54, 0x3a, 0xa7, 0xa7, 0x54, 0xdc, 0xcc, 0x31,
+	0x24, 0xe1, 0x45, 0x94, 0x37, 0x73, 0x9c, 0x74, 0x60, 0xab, 0x95, 0xac, 0x1f, 0x60, 0x41, 0xef,
+	0xff, 0x1b, 0x65, 0xcf, 0xdb, 0xf4, 0xca, 0x47, 0xb9, 0x2c, 0x45, 0x48, 0x75, 0x24, 0x70, 0xb1,
+	0xfa, 0x04, 0x0a, 0xbc, 0x56, 0xb4, 0x2c, 0x6f, 0x09, 0xd3, 0x8e, 0x2d, 0x4a, 0x3d, 0xb8, 0x58,
+	0xf8, 0x43, 0x7f, 0x26, 0x5c, 0x15, 0xa3, 0x5a, 0xf8, 0x47, 0x19, 0x28, 0x3e, 0x7e, 0x50, 0xa9,
+	0xf4, 0xc3, 0x63, 0xdc, 0x0d, 0xc9, 0xa1, 0x04, 0xd7, 0x8e, 0x9d, 0x4e, 0x07, 0x77, 0x8f, 0x30,
+	0xba, 0x03, 0xe3, 0xfb, 0x4f, 0xf6, 0xf7, 0xb8, 0x47, 0x60, 0x81, 0x1f, 0xc7, 0x09, 0x48, 0xd6,
+	0xb1, 0x69, 0x0d, 0xf4, 0x08, 0xae, 0x3c, 0xe5, 0xe1, 0xfc, 0xb2, 0x88, 0xfb, 0x02, 0x6e, 0xdc,
+	0x95, 0x81, 0xfe, 0x35, 0x1f, 0xb7, 0x49, 0x2b, 0x4e, 0xa7, 0x12, 0x10, 0xc5, 0x40, 0xe6, 0x27,
+	0x89, 0xf7, 0x70, 0x3c, 0x97, 0x29, 0x64, 0xad, 0x3f, 0xc8, 0xc0, 0x52, 0xac, 0x67, 0x8a, 0x63,
+	0x57, 0xed, 0xd8, 0xbc, 0xd2, 0x31, 0x51, 0x65, 0xeb, 0x12, 0xef, 0x59, 0x8d, 0xc6, 0x8e, 0xd2,
+	0x16, 0x78, 0x87, 0xde, 0x19, 0xde, 0xa1, 0x88, 0x80, 0x44, 0xe4, 0x91, 0x5f, 0x14, 0x6e, 0x5d,
+	0x86, 0x59, 0x8d, 0x03, 0x96, 0x05, 0x33, 0x6a, 0xcb, 0x84, 0xcd, 0x35, 0xaf, 0x2d, 0xd9, 0x4c,
+	0xfe, 0xb6, 0xfe, 0x41, 0x06, 0x16, 0x1e, 0x3f, 0xa8, 0xd8, 0xf8, 0xc8, 0x25, 0xcb, 0x2f, 0x62,
+	0xf1, 0xaa, 0x36, 0x92, 0x65, 0x6d, 0x24, 0xb1, 0xba, 0x72, 0x48, 0x9f, 0x27, 0x86, 0xb4, 0x9c,
+	0x36, 0x24, 0x6a, 0x65, 0xb9, 0x5e, 0x57, 0x1b, 0x89, 0xe2, 0xf9, 0xf8, 0xc7, 0x19, 0x98, 0x57,
+	0xfa, 0x24, 0xfb, 0xff, 0x81, 0xd6, 0xa5, 0xeb, 0x29, 0x5d, 0x4a, 0x30, 0xb9, 0x9a, 0xe8, 0xd1,
+	0xdb, 0xc3, 0x7a, 0x34, 0x92, 0xc7, 0x7f, 0x92, 0x81, 0xc5, 0x54, 0x1e, 0xa0, 0xab, 0x64, 0xd7,
+	0x68, 0xf9, 0x38, 0xe4, 0xec, 0xe5, 0x5f, 0x04, 0xbe, 0x1d, 0x04, 0x7d, 0xfe, 0xd6, 0x22, 0x6f,
+	0xf3, 0x2f, 0xf4, 0x36, 0xcc, 0xee, 0x61, 0xdf, 0xf5, 0xda, 0x75, 0xdc, 0xf2, 0xba, 0x6d, 0xe6,
+	0x11, 0x9e, 0xb5, 0x75, 0x20, 0x5a, 0x86, 0x7c, 0xa5, 0x73, 0xe4, 0xf9, 0x6e, 0x78, 0xcc, 0x9c,
+	0x4f, 0x79, 0x3b, 0x02, 0x10, 0xda, 0xeb, 0xee, 0x91, 0x1b, 0xb2, 0xbb, 0xb5, 0x59, 0x9b, 0x7f,
+	0xa1, 0x22, 0x4c, 0x55, 0x5a, 0x2d, 0xaf, 0xdf, 0x0d, 0xa9, 0x07, 0x34, 0x6f, 0x8b, 0x4f, 0x82,
+	0xf1, 0xad, 0x4d, 0x85, 0x80, 0x46, 0x43, 0xd9, 0xfc, 0xcb, 0x7a, 0x0f, 0x16, 0xd2, 0xf8, 0x98,
+	0x2a, 0x32, 0x7f, 0x2d, 0x0b, 0xf3, 0x95, 0x76, 0xfb, 0xf1, 0x83, 0xca, 0x3a, 0x56, 0x8d, 0x8f,
+	0x0f, 0x61, 0x7c, 0xbb, 0xeb, 0x86, 0x7c, 0xd7, 0x5c, 0xe1, 0xd3, 0x93, 0x52, 0x93, 0xd4, 0x22,
+	0x33, 0x44, 0xfe, 0x47, 0x36, 0xcc, 0x6f, 0xfc, 0xe4, 0x06, 0xa1, 0xdb, 0x3d, 0xa2, 0x73, 0xce,
+	0x1a, 0xe6, 0x73, 0x2c, 0x88, 0x18, 0x96, 0xdb, 0xd6, 0x25, 0x3b, 0x0d, 0x19, 0xed, 0xc3, 0xd5,
+	0x5d, 0xfc, 0x22, 0x45, 0x84, 0x64, 0x30, 0x93, 0x24, 0x9b, 0x22, 0x39, 0x06, 0x5c, 0x55, 0x42,
+	0xff, 0x76, 0x96, 0x46, 0xc8, 0x29, 0x03, 0xe3, 0x2d, 0x1f, 0xc0, 0x82, 0xd2, 0xa1, 0x48, 0xe3,
+	0x64, 0x78, 0xec, 0x74, 0xea, 0x70, 0xd4, 0x85, 0x94, 0x8a, 0x8e, 0x9e, 0xc2, 0x92, 0xde, 0xa9,
+	0x88, 0xb2, 0xbe, 0x18, 0xd2, 0xaa, 0x6c, 0x5d, 0xb2, 0x4d, 0xd8, 0x68, 0x15, 0xc6, 0x2a, 0xad,
+	0x13, 0xce, 0x96, 0xf4, 0x29, 0x63, 0x23, 0xab, 0xb4, 0x4e, 0x68, 0xb4, 0x69, 0xeb, 0x44, 0x5b,
+	0x0f, 0xff, 0x21, 0x03, 0x4b, 0x86, 0x19, 0x46, 0x2b, 0x00, 0x0c, 0xa8, 0xe8, 0x76, 0x05, 0x42,
+	0x76, 0x55, 0xf6, 0x45, 0x2f, 0x1c, 0xc7, 0xe8, 0xfd, 0xb5, 0x88, 0x0b, 0x8a, 0x0a, 0x6c, 0xa5,
+	0x12, 0xda, 0x83, 0x69, 0xf6, 0xc5, 0xc2, 0x93, 0xc6, 0x29, 0x0e, 0xd2, 0x70, 0x58, 0x3c, 0x12,
+	0x8d, 0x39, 0x68, 0x53, 0x40, 0x33, 0x1e, 0x96, 0xa4, 0x92, 0xe0, 0x47, 0xbf, 0x5a, 0x7c, 0x14,
+	0x72, 0xd0, 0xe8, 0x0e, 0x4c, 0x32, 0x20, 0x9f, 0x43, 0xf1, 0xea, 0x25, 0xaa, 0xcc, 0xcb, 0xad,
+	0x3f, 0xcc, 0x08, 0x8f, 0x4e, 0x62, 0x69, 0x7c, 0xa2, 0x2d, 0x8d, 0xb7, 0x64, 0x87, 0xd3, 0x2a,
+	0x6b, 0xab, 0xa3, 0x0a, 0xd3, 0xaf, 0xb2, 0x2a, 0x54, 0x24, 0x55, 0x6e, 0xff, 0x79, 0x46, 0x9c,
+	0x45, 0x93, 0xa2, 0xbb, 0x01, 0x33, 0xaf, 0x26, 0xb2, 0x1a, 0x1a, 0xfa, 0x88, 0x49, 0x54, 0x76,
+	0xf8, 0x48, 0x87, 0x0a, 0xd5, 0x97, 0xc2, 0x69, 0xf5, 0x2a, 0x62, 0x65, 0x2d, 0xa7, 0x60, 0xcb,
+	0xe6, 0xac, 0x7e, 0xa2, 0xb4, 0xfe, 0xb2, 0xdb, 0x12, 0xf3, 0x74, 0x3b, 0x7e, 0xc9, 0x6e, 0xbc,
+	0x41, 0x55, 0xfb, 0x90, 0x8d, 0xfc, 0x18, 0x5c, 0xe4, 0xa8, 0x49, 0xab, 0x76, 0xea, 0x2c, 0xb6,
+	0x4e, 0x5e, 0xa5, 0xd1, 0x1a, 0xcc, 0xee, 0xe2, 0x17, 0x89, 0x76, 0xe9, 0xbd, 0x54, 0x17, 0xbf,
+	0x68, 0x2a, 0x6d, 0x2b, 0xd2, 0xae, 0xe3, 0xa0, 0x43, 0x98, 0x13, 0xba, 0xe0, 0xbc, 0x2a, 0x91,
+	0x45, 0x5c, 0x92, 0x16, 0x4e, 0x9f, 0x39, 0x4d, 0x9f, 0x43, 0xd5, 0x50, 0x49, 0x9d, 0xa2, 0xb5,
+	0x07, 0xc5, 0xe4, 0x58, 0xb9, 0x94, 0x7d, 0x38, 0x6a, 0x39, 0xb1, 0x53, 0x55, 0x5b, 0x5f, 0x5a,
+	0x5b, 0xd4, 0x01, 0x20, 0xeb, 0xc8, 0xa3, 0xcb, 0xfd, 0x38, 0xeb, 0x68, 0x14, 0x99, 0x60, 0x9d,
+	0x1a, 0xd2, 0x1d, 0x85, 0x59, 0x2c, 0xc6, 0x28, 0xf1, 0x8e, 0xbd, 0x07, 0x53, 0x1c, 0x24, 0x43,
+	0xe5, 0xe3, 0x0b, 0x5d, 0x54, 0xb0, 0xfe, 0x49, 0x06, 0xae, 0x1d, 0x04, 0xd8, 0xaf, 0xbb, 0xdd,
+	0xa3, 0x0e, 0x3e, 0x08, 0xf4, 0x20, 0x87, 0xdf, 0xd6, 0x16, 0xfb, 0x92, 0x21, 0x78, 0xf2, 0xff,
+	0xd5, 0x12, 0xff, 0x67, 0x19, 0x28, 0xa5, 0xf5, 0xed, 0xcd, 0xae, 0xf2, 0xbb, 0xfc, 0xac, 0xc1,
+	0x7a, 0x5b, 0xe4, 0xe8, 0xb2, 0x4d, 0x31, 0x58, 0x32, 0x48, 0xf2, 0xbf, 0xb6, 0xbc, 0xff, 0x77,
+	0x06, 0x16, 0xb6, 0x03, 0xda, 0xfd, 0x5f, 0xf4, 0x5d, 0x1f, 0xb7, 0x05, 0xe3, 0xee, 0xa6, 0x85,
+	0xd8, 0xd2, 0x79, 0xdd, 0xba, 0x94, 0x16, 0x42, 0xfb, 0xa1, 0x12, 0x44, 0x98, 0x1d, 0x16, 0x3b,
+	0xab, 0xbd, 0xd7, 0xb8, 0x0d, 0xe3, 0xbb, 0xc4, 0xa4, 0x19, 0xe3, 0xf2, 0xc7, 0x30, 0x08, 0x88,
+	0xc6, 0xfb, 0x91, 0x2e, 0x93, 0x0f, 0xf4, 0x20, 0x11, 0x55, 0x38, 0x3e, 0x3a, 0x36, 0x34, 0xf9,
+	0xd0, 0xa4, 0x9a, 0x83, 0xc9, 0x7d, 0xc7, 0x3f, 0xc2, 0xa1, 0xf5, 0x3d, 0x94, 0xf8, 0x65, 0x1e,
+	0xf3, 0x91, 0xd1, 0x2b, 0xbf, 0x20, 0xf2, 0xdd, 0x0c, 0xbb, 0x80, 0x5b, 0x01, 0xa8, 0x87, 0x8e,
+	0x1f, 0x6e, 0x77, 0xdb, 0xf8, 0x27, 0x3a, 0xda, 0x09, 0x5b, 0x81, 0x58, 0x1f, 0x41, 0x5e, 0x0e,
+	0x81, 0x9e, 0xa7, 0x14, 0xab, 0x8d, 0x0e, 0x67, 0x41, 0x8b, 0x73, 0x14, 0xc1, 0x8d, 0x6b, 0xb0,
+	0x18, 0x9b, 0x0a, 0x2e, 0x27, 0x25, 0x32, 0x61, 0x0c, 0xc6, 0x2e, 0xfa, 0x6d, 0xf9, 0x6d, 0xd5,
+	0xe0, 0x4a, 0x62, 0xa6, 0x11, 0xa2, 0xb1, 0xab, 0xec, 0xf0, 0x49, 0x94, 0x7a, 0xbd, 0xbe, 0x45,
+	0x60, 0xfb, 0x3b, 0x75, 0x16, 0xc7, 0x43, 0x60, 0xfb, 0x3b, 0xf5, 0xea, 0x24, 0x93, 0x1c, 0xeb,
+	0x5f, 0x65, 0xe9, 0x11, 0x32, 0xc1, 0x83, 0x98, 0x2b, 0x42, 0x75, 0x87, 0x54, 0x21, 0x4f, 0x47,
+	0xbc, 0x2e, 0xe2, 0xdd, 0x86, 0xdf, 0x00, 0xe4, 0x7e, 0x39, 0x28, 0x5f, 0xa2, 0x6e, 0xff, 0x08,
+	0x0d, 0x7d, 0x0d, 0x53, 0x1b, 0xdd, 0x36, 0xa5, 0x30, 0x76, 0x01, 0x0a, 0x02, 0x89, 0xcc, 0x03,
+	0xed, 0x32, 0x31, 0x47, 0xf8, 0x79, 0xdd, 0x56, 0x20, 0x94, 0xcd, 0xee, 0xa9, 0xcb, 0xee, 0x79,
+	0x27, 0x6c, 0xf6, 0x41, 0xb8, 0x49, 0xbb, 0x20, 0x9e, 0x2f, 0xe4, 0x6d, 0xf9, 0x8d, 0x2c, 0x98,
+	0x78, 0xe2, 0xb7, 0x79, 0x30, 0xf9, 0xdc, 0xea, 0x8c, 0x78, 0xcf, 0x4d, 0x60, 0x36, 0x2b, 0xb2,
+	0xfe, 0x27, 0xbd, 0x7b, 0x09, 0x53, 0xe5, 0x46, 0xe3, 0x4a, 0xe6, 0xb5, 0xb9, 0x92, 0x7d, 0x15,
+	0xae, 0xc8, 0x51, 0x8f, 0x99, 0x46, 0x3d, 0x6e, 0x1a, 0xf5, 0x84, 0x79, 0xd4, 0x9b, 0x30, 0xc9,
+	0x86, 0x8a, 0x6e, 0xc1, 0xc4, 0x76, 0x88, 0x4f, 0x23, 0xd7, 0x82, 0x7a, 0x7b, 0x6e, 0xb3, 0x32,
+	0x72, 0xea, 0xd9, 0x71, 0x82, 0x50, 0x44, 0x8e, 0xe5, 0x6d, 0xf1, 0x69, 0xfd, 0x69, 0x06, 0x0a,
+	0x3b, 0x6e, 0x10, 0x92, 0x85, 0x70, 0x4e, 0x59, 0x93, 0x23, 0xca, 0x9a, 0x46, 0x34, 0x16, 0x1b,
+	0xd1, 0x17, 0x30, 0x49, 0x03, 0x1a, 0x03, 0xfe, 0x54, 0xe9, 0x16, 0x1f, 0x52, 0xbc, 0x61, 0x16,
+	0xf6, 0x18, 0xd0, 0x27, 0x45, 0x36, 0x47, 0x29, 0x7d, 0x06, 0xd3, 0x0a, 0xf8, 0x42, 0x2f, 0x8d,
+	0xbe, 0x83, 0x2b, 0x4a, 0x13, 0xd2, 0x0f, 0x31, 0xc2, 0x5b, 0x2d, 0xbd, 0xa1, 0x84, 0x6d, 0xbb,
+	0xf8, 0x27, 0x95, 0x6d, 0xfc, 0xd3, 0xfa, 0x91, 0xc6, 0xe3, 0xee, 0x78, 0xad, 0x13, 0xc5, 0x57,
+	0x38, 0xc5, 0x94, 0x59, 0xdc, 0xe5, 0x4e, 0x6a, 0xb1, 0x12, 0x5b, 0xd4, 0x40, 0x37, 0x61, 0x7a,
+	0xbb, 0xfb, 0xc0, 0xf3, 0x5b, 0xf8, 0x49, 0xb7, 0xc3, 0xa8, 0xe7, 0x6c, 0x15, 0xc4, 0xdd, 0x48,
+	0xbc, 0x85, 0xc8, 0x8d, 0x44, 0x01, 0x31, 0x37, 0x12, 0x7b, 0x29, 0x69, 0xb3, 0x32, 0xee, 0xa5,
+	0x22, 0x7f, 0x0f, 0xf3, 0x21, 0x49, 0x67, 0xd3, 0xa8, 0x8a, 0x87, 0x70, 0xcd, 0xc6, 0xbd, 0x8e,
+	0x43, 0x6c, 0xc5, 0x53, 0x8f, 0xd5, 0x97, 0x63, 0xbe, 0x99, 0x12, 0x2a, 0xa6, 0xdf, 0x38, 0xc9,
+	0x2e, 0x67, 0x87, 0x74, 0xf9, 0x14, 0xde, 0xda, 0xc4, 0x61, 0xea, 0x73, 0xc7, 0x68, 0xf0, 0x5b,
+	0x90, 0xe3, 0x21, 0xf9, 0x62, 0xfc, 0xa3, 0x5e, 0x5a, 0xf2, 0xeb, 0x17, 0x4e, 0x47, 0xfe, 0x65,
+	0x7d, 0x03, 0x65, 0x53, 0x73, 0xe7, 0x8b, 0x10, 0x72, 0xe1, 0xa6, 0x99, 0x80, 0xb4, 0x26, 0xa6,
+	0x78, 0x83, 0xf2, 0xd4, 0x3f, 0xbc, 0xb7, 0xd2, 0x21, 0x4f, 0xed, 0x29, 0xfe, 0x87, 0x55, 0x15,
+	0x21, 0x08, 0xaf, 0xd1, 0xdd, 0x26, 0xbd, 0x32, 0xd0, 0x09, 0x44, 0x7c, 0xad, 0x40, 0x4e, 0xc0,
+	0x62, 0x77, 0x06, 0x89, 0x97, 0xa4, 0x94, 0xa1, 0x6d, 0x41, 0x40, 0xa2, 0x59, 0x3f, 0x0a, 0xc7,
+	0xbe, 0x8e, 0x71, 0xbe, 0xb0, 0xd3, 0xf3, 0x78, 0xf2, 0x2d, 0x0f, 0xae, 0xe9, 0xb4, 0x55, 0xf7,
+	0x74, 0x41, 0x71, 0x4f, 0x33, 0xaf, 0x34, 0x91, 0x4b, 0x7b, 0x67, 0xa3, 0xdb, 0xee, 0x79, 0x6e,
+	0x37, 0xe4, 0x8b, 0x57, 0x05, 0xa1, 0x15, 0xd5, 0x09, 0x3d, 0x93, 0x8c, 0xd3, 0xbd, 0x0f, 0xa5,
+	0xb4, 0x06, 0x15, 0xdf, 0x8f, 0xf4, 0x27, 0x33, 0x3b, 0xce, 0x3a, 0x86, 0x05, 0x2d, 0x37, 0x47,
+	0x94, 0x6c, 0x20, 0xca, 0x49, 0x92, 0xaf, 0x7e, 0xf9, 0x9b, 0x41, 0xf9, 0xd3, 0x8b, 0x04, 0x83,
+	0x0a, 0x9a, 0xfb, 0x32, 0xd4, 0xd8, 0x5a, 0x82, 0xb1, 0x9a, 0xbd, 0x43, 0x87, 0x6d, 0xef, 0xc8,
+	0x61, 0xdb, 0x3b, 0xd6, 0x6f, 0x32, 0x50, 0xae, 0x1d, 0x3b, 0xdd, 0x23, 0x6a, 0x7b, 0x28, 0xe6,
+	0xaa, 0x72, 0xaf, 0x7a, 0xde, 0x23, 0xd5, 0x2a, 0x4c, 0xef, 0xe2, 0x17, 0x22, 0x4c, 0x9a, 0x07,
+	0x1c, 0x53, 0xf7, 0x3b, 0x39, 0xee, 0xf4, 0x38, 0xdc, 0x56, 0x2b, 0xa1, 0xbf, 0xfc, 0xea, 0xce,
+	0x25, 0xf6, 0x42, 0x3f, 0x3a, 0x49, 0xb1, 0xd2, 0xb4, 0x23, 0x95, 0xa1, 0x09, 0xeb, 0xdf, 0x64,
+	0xe0, 0xa6, 0x79, 0xf0, 0x7c, 0xe2, 0xd6, 0xb5, 0x3c, 0x07, 0x43, 0x6e, 0x84, 0xe9, 0x91, 0x55,
+	0xc9, 0x73, 0x10, 0xcf, 0x6d, 0x60, 0xe3, 0x96, 0xf7, 0x1c, 0xfb, 0x2f, 0x63, 0x7e, 0x76, 0x01,
+	0xae, 0x91, 0x2d, 0x47, 0x64, 0x89, 0x61, 0x20, 0xed, 0x69, 0x23, 0x87, 0x59, 0xff, 0x29, 0x03,
+	0xd7, 0xe9, 0x36, 0xc9, 0xbd, 0x90, 0xa2, 0xe0, 0xe2, 0xf1, 0x03, 0x1f, 0xc1, 0x8c, 0xda, 0x38,
+	0x9f, 0x30, 0xfa, 0x30, 0x5a, 0xf4, 0xa0, 0xd9, 0xf2, 0xda, 0xd8, 0xd6, 0xaa, 0xa1, 0x6d, 0x98,
+	0xe6, 0xdf, 0x8a, 0xab, 0x69, 0x51, 0xc9, 0x9a, 0x42, 0xe5, 0x81, 0x79, 0x8e, 0xe8, 0xec, 0x73,
+	0x62, 0x4d, 0x1a, 0xfa, 0xae, 0xe2, 0x5a, 0xbf, 0xce, 0xc2, 0x72, 0x03, 0xfb, 0xee, 0xb3, 0x97,
+	0x86, 0xc1, 0x3c, 0x81, 0x05, 0x01, 0xa2, 0x63, 0xd6, 0xe5, 0x90, 0x3d, 0x51, 0x13, 0x5d, 0x0d,
+	0x48, 0x85, 0xa6, 0x14, 0xcb, 0x54, 0xc4, 0x0b, 0x3c, 0xda, 0xfc, 0x10, 0x72, 0x52, 0x94, 0xc7,
+	0x28, 0x67, 0xe8, 0xdc, 0x08, 0x31, 0xd6, 0xdf, 0xaf, 0x4b, 0x79, 0xfe, 0x9b, 0xe6, 0xeb, 0x0c,
+	0x7e, 0xe2, 0x19, 0x71, 0x18, 0x65, 0x52, 0x4d, 0x24, 0xda, 0x51, 0x4a, 0x53, 0xa4, 0x7a, 0xeb,
+	0x92, 0x6d, 0x6a, 0xa9, 0x3a, 0x0d, 0xf9, 0x0a, 0xbd, 0x6c, 0x21, 0x07, 0x8c, 0xff, 0x95, 0x85,
+	0x15, 0x11, 0x52, 0x68, 0x60, 0xf3, 0x77, 0xb0, 0x24, 0x40, 0x95, 0x5e, 0xcf, 0xf7, 0x9e, 0xe3,
+	0xb6, 0xce, 0x69, 0xf6, 0x4c, 0x54, 0x70, 0xda, 0xe1, 0x75, 0x22, 0x66, 0x9b, 0xd0, 0xdf, 0x8c,
+	0x9b, 0xe5, 0x6b, 0x5d, 0xb1, 0xb0, 0xd9, 0xa0, 0x4e, 0x49, 0x55, 0xb1, 0xe8, 0x09, 0x7e, 0x54,
+	0x25, 0xd3, 0x4e, 0xb8, 0x69, 0xc6, 0x5f, 0xd7, 0x4d, 0x43, 0x8e, 0xa6, 0x3a, 0xcd, 0xea, 0x1c,
+	0xcc, 0xec, 0xe2, 0x17, 0x11, 0xdf, 0x7f, 0x2f, 0x03, 0xb3, 0xda, 0xe2, 0x46, 0xef, 0xc2, 0x04,
+	0xfd, 0x83, 0x6e, 0x9a, 0xfc, 0xad, 0x0c, 0x59, 0x60, 0xda, 0x5b, 0x19, 0x56, 0x75, 0x1b, 0xa6,
+	0x58, 0xf8, 0x4c, 0xfb, 0x1c, 0x67, 0x08, 0x19, 0x9d, 0xd5, 0x62, 0x28, 0xec, 0x38, 0xc1, 0xf1,
+	0xad, 0x47, 0xf0, 0x16, 0x8f, 0xc4, 0xd1, 0x27, 0xbf, 0xa6, 0xda, 0xef, 0xe7, 0xd4, 0xf1, 0x96,
+	0x03, 0x2b, 0x9b, 0x38, 0xae, 0x7a, 0xb4, 0xe8, 0xb5, 0x6f, 0xe0, 0xb2, 0x06, 0x97, 0x14, 0x69,
+	0x3c, 0xbd, 0x94, 0x21, 0x49, 0x3a, 0x5e, 0xdb, 0xba, 0x99, 0xd6, 0x84, 0xda, 0x59, 0x0b, 0xc3,
+	0x65, 0x7a, 0x52, 0x96, 0x37, 0x4e, 0xc1, 0x05, 0xb4, 0xde, 0x1d, 0x65, 0x5d, 0x33, 0x8d, 0xc7,
+	0x9e, 0x62, 0x8a, 0xed, 0x49, 0x96, 0x5a, 0xb3, 0x30, 0x5d, 0xf3, 0xba, 0x21, 0xfe, 0x89, 0x3e,
+	0x86, 0xb0, 0xe6, 0x60, 0x46, 0x14, 0x75, 0x70, 0x10, 0x58, 0xff, 0x74, 0x0c, 0x2c, 0xce, 0xd8,
+	0x34, 0x2f, 0x8f, 0xe0, 0xc7, 0x61, 0xa2, 0xb3, 0x7c, 0x13, 0xb9, 0xaa, 0xfa, 0xb2, 0xa2, 0x52,
+	0x26, 0x79, 0xf4, 0xf1, 0x4a, 0x2b, 0x82, 0x6a, 0x92, 0x97, 0x18, 0xfd, 0xcf, 0x0d, 0x6a, 0x92,
+	0x2d, 0x36, 0x9a, 0x3e, 0xc4, 0xa0, 0x26, 0x35, 0xba, 0xe9, 0x2a, 0xd3, 0xd6, 0xd8, 0xc0, 0xf7,
+	0x65, 0x24, 0x43, 0xbf, 0x65, 0x09, 0x4f, 0xb9, 0xc5, 0x00, 0xcd, 0x44, 0xca, 0x2c, 0x95, 0x08,
+	0x3a, 0xd0, 0x79, 0xc9, 0xd7, 0xa3, 0xb8, 0xe1, 0x55, 0x8b, 0x18, 0xd5, 0x9e, 0x02, 0xd1, 0x33,
+	0x90, 0x69, 0x75, 0x15, 0xcf, 0xdd, 0x3f, 0xcc, 0xc0, 0x75, 0x36, 0x3b, 0x7b, 0xbe, 0xfb, 0xdc,
+	0xed, 0xe0, 0x23, 0xac, 0x89, 0x69, 0x3f, 0xfd, 0xa6, 0x2c, 0x73, 0x2e, 0x1d, 0x4d, 0x93, 0x36,
+	0x60, 0x8e, 0x6e, 0x72, 0xe4, 0xa6, 0xd1, 0xb7, 0x06, 0x19, 0x58, 0x11, 0x6f, 0xca, 0x62, 0xd7,
+	0x47, 0x17, 0x35, 0xb7, 0xaa, 0xda, 0x8d, 0x4f, 0xd6, 0x70, 0xe3, 0xa3, 0x79, 0xd2, 0xc3, 0x11,
+	0x57, 0x40, 0x63, 0xaf, 0x7d, 0x05, 0x64, 0xfd, 0x6a, 0x0c, 0xae, 0xec, 0x39, 0x47, 0x6e, 0x97,
+	0xe8, 0x1e, 0x91, 0x47, 0x05, 0x55, 0x12, 0xe9, 0xa8, 0x86, 0x47, 0x03, 0xa5, 0xe4, 0x9b, 0x5a,
+	0x55, 0x33, 0xc3, 0x64, 0x4d, 0x71, 0xe2, 0x7a, 0xfe, 0x97, 0xcf, 0x34, 0xef, 0x64, 0x22, 0x20,
+	0x8c, 0xbe, 0x35, 0xea, 0x7a, 0xed, 0x58, 0x8a, 0x36, 0xea, 0xe1, 0x7b, 0x02, 0xd3, 0x4a, 0x54,
+	0x17, 0x17, 0xd0, 0x04, 0x05, 0xca, 0x96, 0x93, 0xfe, 0x21, 0x4e, 0x4d, 0xc7, 0xa3, 0x52, 0x48,
+	0x49, 0xc2, 0x33, 0xf1, 0x86, 0x93, 0xf0, 0x7c, 0xcf, 0xba, 0x2c, 0x7c, 0xbd, 0x93, 0x7c, 0xdf,
+	0x60, 0xe4, 0x13, 0x0e, 0xdf, 0xc6, 0x9a, 0xd2, 0xfb, 0xb4, 0x8c, 0x62, 0x2a, 0xb1, 0x2a, 0x40,
+	0x4e, 0xe4, 0x2e, 0xb4, 0xfe, 0x68, 0x12, 0x16, 0x76, 0xdc, 0x20, 0x14, 0xb3, 0x1b, 0x44, 0xaa,
+	0x7f, 0x46, 0xc0, 0x94, 0xf3, 0x0b, 0xb7, 0xd2, 0x18, 0xbc, 0x19, 0x4b, 0xa5, 0xa8, 0x21, 0xa0,
+	0x8f, 0x54, 0x2f, 0x52, 0x56, 0x49, 0xb0, 0x90, 0xcc, 0x82, 0xa7, 0xba, 0x97, 0xde, 0xd5, 0x1c,
+	0x66, 0x6c, 0x5f, 0xed, 0x10, 0x80, 0xba, 0xaf, 0x32, 0x9f, 0xd3, 0x5a, 0xdc, 0x8b, 0xc6, 0x1a,
+	0x60, 0x4a, 0xf1, 0x04, 0x6b, 0x26, 0xb7, 0x74, 0x46, 0x1d, 0x48, 0x67, 0xd4, 0x04, 0x3d, 0xed,
+	0xfe, 0x4c, 0x71, 0x46, 0xc5, 0x99, 0xa0, 0x3a, 0xa4, 0xd8, 0x93, 0xde, 0x0e, 0x05, 0xa8, 0x4f,
+	0x7a, 0x59, 0x15, 0xb4, 0x0f, 0xf3, 0x7b, 0x3e, 0x6e, 0x53, 0xd5, 0xb2, 0xf1, 0x53, 0xcf, 0xe7,
+	0x47, 0x0c, 0xea, 0xd2, 0x64, 0xd9, 0xa6, 0x7a, 0xa2, 0xb8, 0x89, 0x65, 0xb9, 0xaa, 0x61, 0x52,
+	0xd0, 0xd1, 0x06, 0xcc, 0xd5, 0xb1, 0xe3, 0xb7, 0x8e, 0x1f, 0xe1, 0x97, 0x44, 0x31, 0x06, 0xc5,
+	0xa9, 0x28, 0x43, 0x47, 0x40, 0x4b, 0xc8, 0x40, 0x69, 0x91, 0x7a, 0xed, 0xa4, 0x23, 0xa1, 0xdf,
+	0x81, 0xc9, 0xba, 0xe7, 0x87, 0xd5, 0x97, 0xb1, 0xb4, 0x88, 0x0c, 0x58, 0xbd, 0x26, 0xb2, 0x94,
+	0x04, 0x9e, 0x1f, 0x36, 0x0f, 0x55, 0xbe, 0x71, 0x3c, 0xf4, 0x80, 0x58, 0x5d, 0xc4, 0x12, 0x0c,
+	0x9d, 0x4e, 0x8d, 0x86, 0x4f, 0xb0, 0x47, 0x59, 0xdc, 0xb2, 0xa2, 0xe6, 0x63, 0xe8, 0x74, 0x9a,
+	0x74, 0x9f, 0xd7, 0x2f, 0xc0, 0x54, 0x2c, 0xf4, 0x12, 0x16, 0x74, 0x41, 0xe7, 0x39, 0x8c, 0x40,
+	0x4b, 0x30, 0x96, 0x56, 0xa5, 0x7a, 0x87, 0xf7, 0xf2, 0x66, 0x3c, 0x79, 0x56, 0x22, 0xad, 0x51,
+	0x6a, 0x13, 0xaf, 0xe3, 0x48, 0xfc, 0x93, 0x0c, 0x2c, 0xc6, 0xe4, 0x83, 0x1f, 0x28, 0x9f, 0x40,
+	0x5e, 0x02, 0xb9, 0xfb, 0xa4, 0x28, 0x37, 0xbe, 0x98, 0xe2, 0x64, 0xd2, 0x29, 0x16, 0x8f, 0x3a,
+	0x5f, 0x11, 0x0d, 0x74, 0x3f, 0xe6, 0x73, 0x64, 0x07, 0x95, 0x2e, 0xd9, 0x85, 0x75, 0x89, 0x16,
+	0xd5, 0xd0, 0x67, 0x00, 0xca, 0xb4, 0xb0, 0x55, 0x43, 0xd3, 0xf4, 0xa5, 0xcf, 0x88, 0x52, 0xd9,
+	0xfa, 0xb3, 0x49, 0xb1, 0xaf, 0xf2, 0xa3, 0xed, 0xbe, 0xef, 0xb4, 0x4e, 0xa2, 0x90, 0xcc, 0x8f,
+	0x92, 0xf1, 0x8f, 0xe7, 0x59, 0xc2, 0xb7, 0xb5, 0x97, 0xd2, 0xe6, 0xa4, 0xab, 0xd1, 0xa3, 0xf9,
+	0xb1, 0x73, 0x3c, 0x9a, 0xbf, 0x07, 0x53, 0xdb, 0xdd, 0xe7, 0x2e, 0xb1, 0xa2, 0x59, 0x30, 0x20,
+	0xb5, 0x41, 0x5d, 0x06, 0x52, 0x19, 0xc3, 0x6b, 0xa1, 0xcf, 0x20, 0xb7, 0xe5, 0x05, 0x21, 0x35,
+	0x23, 0x27, 0xa2, 0x93, 0x4a, 0x48, 0x7d, 0xb0, 0xcd, 0x63, 0x5e, 0xa4, 0x2a, 0x09, 0x51, 0x1d,
+	0x7d, 0x0c, 0x53, 0x95, 0x76, 0x9b, 0xac, 0x42, 0xbe, 0x82, 0x69, 0xc6, 0x46, 0x8e, 0xe9, 0xb0,
+	0x12, 0xb5, 0x49, 0x5e, 0x19, 0x7d, 0xa9, 0x3b, 0x44, 0xa7, 0xa2, 0x94, 0x12, 0xe9, 0xd9, 0x4b,
+	0x75, 0x67, 0xe9, 0xbb, 0xe2, 0x22, 0x2a, 0x17, 0x25, 0xe9, 0xa0, 0x09, 0x37, 0x34, 0xd5, 0x47,
+	0xef, 0xb1, 0xb6, 0x21, 0xbf, 0xdd, 0x75, 0x43, 0x97, 0xa6, 0x29, 0xc8, 0x6b, 0x1b, 0xe8, 0x9e,
+	0xe3, 0x87, 0x6e, 0xcb, 0xed, 0x39, 0xdd, 0x90, 0xcd, 0x96, 0x2b, 0x2a, 0xaa, 0xb3, 0x25, 0xb1,
+	0xd5, 0x84, 0x46, 0xf0, 0xc6, 0x12, 0x1a, 0xa5, 0xe6, 0x04, 0x9a, 0x7e, 0xf5, 0x9c, 0x40, 0x6b,
+	0x6c, 0x2e, 0xa9, 0xd1, 0x3a, 0x13, 0x09, 0x22, 0xf5, 0x13, 0xea, 0xd6, 0xa9, 0x2d, 0x2b, 0xa2,
+	0x9b, 0x34, 0x2d, 0xc1, 0x6c, 0x14, 0x57, 0xab, 0x5d, 0x7c, 0x67, 0xb7, 0xd7, 0x51, 0x13, 0x66,
+	0x48, 0xed, 0x3d, 0xaf, 0xe3, 0xb6, 0x5c, 0x1c, 0x14, 0xe7, 0x34, 0xc7, 0xb2, 0xbe, 0x28, 0x68,
+	0xa5, 0x97, 0x75, 0x1c, 0xb2, 0x4d, 0x90, 0x36, 0xdd, 0xe3, 0x88, 0xea, 0x26, 0xa8, 0x12, 0xb4,
+	0x6c, 0x28, 0x46, 0xb7, 0x53, 0xb1, 0xd5, 0xf5, 0x71, 0xf2, 0x89, 0x03, 0x4d, 0x85, 0x17, 0x3d,
+	0x71, 0x50, 0x27, 0x2c, 0x7a, 0xec, 0x70, 0x00, 0xd7, 0x6d, 0x7c, 0xea, 0x3d, 0xc7, 0x6f, 0x96,
+	0xec, 0xcf, 0xe1, 0x9a, 0x4e, 0xf0, 0xa0, 0xd7, 0xa6, 0x4f, 0x26, 0xd9, 0x35, 0x58, 0x6a, 0x32,
+	0x0d, 0x8e, 0xc0, 0x92, 0x69, 0xb0, 0x17, 0xda, 0xe4, 0x4f, 0x55, 0x5e, 0x69, 0x99, 0xe5, 0xc1,
+	0xb2, 0x4e, 0xbc, 0xd2, 0x6e, 0x2b, 0x82, 0x4a, 0x2c, 0x34, 0xe5, 0x33, 0x66, 0x12, 0xaa, 0x12,
+	0x4d, 0x35, 0x5b, 0x2f, 0x02, 0xa8, 0x6b, 0x49, 0xa9, 0x67, 0x61, 0x28, 0xc7, 0xd9, 0x43, 0x58,
+	0xa6, 0xb6, 0x59, 0x85, 0x59, 0xe5, 0x53, 0x9e, 0xb0, 0xe8, 0x52, 0x57, 0x5a, 0xd0, 0x19, 0xa6,
+	0xa3, 0x58, 0xff, 0x72, 0x0c, 0xae, 0x73, 0x3e, 0xbd, 0xc9, 0xc9, 0x40, 0x3f, 0xc2, 0xb4, 0xc2,
+	0x7e, 0xce, 0x8f, 0x9b, 0x22, 0x98, 0xc0, 0x34, 0x4d, 0x4c, 0xd5, 0xf4, 0x29, 0xa0, 0x19, 0x9b,
+	0x09, 0x62, 0x04, 0xaa, 0x33, 0xda, 0x81, 0x39, 0x7d, 0x0e, 0xb8, 0x61, 0x7d, 0x2b, 0xb5, 0x11,
+	0xbd, 0xaa, 0x78, 0xf1, 0xdd, 0x6e, 0xa6, 0xce, 0x04, 0x4d, 0x2b, 0xaa, 0xcf, 0xef, 0x4f, 0x70,
+	0x25, 0x31, 0x01, 0xdc, 0x0e, 0xbf, 0x9d, 0xda, 0x60, 0xa2, 0x36, 0xd3, 0x1b, 0x3e, 0x05, 0x1b,
+	0x9b, 0x4d, 0x36, 0x52, 0xcd, 0xc1, 0x24, 0x1b, 0x36, 0x59, 0x37, 0x7b, 0x3e, 0x0e, 0x70, 0xb7,
+	0x85, 0xd5, 0x88, 0x8d, 0xd7, 0x5d, 0x37, 0xff, 0x31, 0x03, 0xc5, 0x34, 0xba, 0x75, 0xdc, 0x6d,
+	0xa3, 0x3d, 0x28, 0xc4, 0x1b, 0xe2, 0xa7, 0x25, 0x4b, 0x98, 0x09, 0xe6, 0x2e, 0x6d, 0x5d, 0xb2,
+	0x13, 0xd8, 0x44, 0xb3, 0x2a, 0xb0, 0x0b, 0x86, 0xc6, 0x24, 0x51, 0x95, 0x63, 0xf6, 0x7b, 0xef,
+	0x41, 0x5e, 0xe6, 0x4a, 0x47, 0x39, 0x18, 0xdf, 0xde, 0xdd, 0xde, 0x67, 0xb9, 0xb7, 0xf6, 0x0e,
+	0xf6, 0x0b, 0x19, 0x04, 0x30, 0xb9, 0xbe, 0xb1, 0xb3, 0xb1, 0xbf, 0x51, 0xc8, 0xbe, 0xd7, 0x54,
+	0x0f, 0xac, 0xe8, 0x3a, 0x2c, 0xad, 0x6f, 0x34, 0xb6, 0x6b, 0x1b, 0xcd, 0xfd, 0xbf, 0xb0, 0xb7,
+	0xd1, 0x3c, 0xd8, 0xad, 0xef, 0x6d, 0xd4, 0xb6, 0x1f, 0x6c, 0x6f, 0xac, 0x17, 0x2e, 0xa1, 0x05,
+	0x28, 0xa8, 0x85, 0xfb, 0x4f, 0xf6, 0xf7, 0x0a, 0x19, 0x54, 0x84, 0x05, 0x15, 0xfa, 0x74, 0xa3,
+	0x5a, 0x39, 0xd8, 0xdf, 0xda, 0x2d, 0x8c, 0x59, 0xe3, 0xb9, 0x6c, 0x21, 0xfb, 0xde, 0x8f, 0xda,
+	0x69, 0x16, 0x2d, 0x43, 0x91, 0x57, 0x3f, 0xa8, 0x57, 0x36, 0xcd, 0x4d, 0xb0, 0xd2, 0xc7, 0x0f,
+	0x2a, 0x85, 0x0c, 0xba, 0x01, 0xd7, 0x34, 0xe8, 0x5e, 0xa5, 0x5e, 0x7f, 0xfa, 0xc4, 0x5e, 0xdf,
+	0xd9, 0xa8, 0xd7, 0x0b, 0xd9, 0xf7, 0x6e, 0xf3, 0x8b, 0x76, 0x34, 0x07, 0xb0, 0xbe, 0x51, 0xaf,
+	0x6d, 0xec, 0xae, 0x6f, 0xef, 0x6e, 0x16, 0x2e, 0xa1, 0x59, 0xc8, 0x57, 0xe4, 0x67, 0x66, 0xf5,
+	0x8f, 0x7f, 0x84, 0x69, 0xc2, 0x4f, 0x71, 0xf8, 0x6b, 0xc2, 0xd2, 0x63, 0xc7, 0xed, 0x86, 0x8e,
+	0xdb, 0xe5, 0x52, 0x20, 0xe6, 0x10, 0x95, 0x87, 0x4c, 0x2a, 0x91, 0x87, 0xd2, 0xa8, 0x70, 0xa2,
+	0x3b, 0x99, 0xfb, 0x19, 0x54, 0x87, 0x85, 0x34, 0xab, 0x0c, 0x59, 0x7a, 0x6a, 0x80, 0x34, 0x85,
+	0x53, 0x5a, 0x4a, 0xdd, 0xbb, 0x1a, 0x1f, 0xa0, 0xc7, 0x70, 0x25, 0xb1, 0x13, 0xc9, 0xfe, 0x9a,
+	0xf6, 0xa8, 0x61, 0xe4, 0x8a, 0xd4, 0xb1, 0x17, 0xba, 0xf1, 0x7d, 0x28, 0x40, 0x57, 0x13, 0x06,
+	0xc4, 0x06, 0x59, 0x34, 0x46, 0x62, 0xf7, 0x33, 0xc8, 0x86, 0x85, 0xb4, 0x3d, 0x4d, 0x0e, 0x79,
+	0xc8, 0x86, 0x57, 0x32, 0x34, 0x47, 0x68, 0xa6, 0xa9, 0x66, 0x49, 0x73, 0x88, 0xde, 0x36, 0xd2,
+	0xfc, 0x92, 0x1c, 0xc8, 0xba, 0xed, 0x47, 0x18, 0xf7, 0x2a, 0x1d, 0xf7, 0x39, 0x0e, 0x90, 0x08,
+	0x86, 0x93, 0x20, 0x13, 0xee, 0x9d, 0x0c, 0xfa, 0x2d, 0x98, 0xa6, 0xe9, 0x59, 0x79, 0xec, 0xc6,
+	0x8c, 0x9a, 0xb2, 0xb5, 0x24, 0xbe, 0x68, 0xe1, 0xfd, 0x0c, 0xfa, 0x0a, 0xa6, 0x36, 0x31, 0x0d,
+	0x5e, 0x40, 0x6f, 0xc5, 0x7e, 0x85, 0x60, 0xbb, 0x2b, 0x8d, 0x6d, 0xd1, 0xe1, 0xb8, 0x37, 0x03,
+	0xd5, 0x20, 0xc7, 0xd1, 0x03, 0x64, 0xc5, 0xf0, 0x83, 0x14, 0x02, 0xf3, 0x31, 0x02, 0xe4, 0xbc,
+	0x83, 0x6a, 0x90, 0x97, 0x11, 0x14, 0x68, 0xc9, 0x10, 0xb6, 0x51, 0x2a, 0x26, 0x0b, 0xb8, 0x87,
+	0x6c, 0xec, 0xef, 0x66, 0x33, 0xe8, 0x1e, 0x00, 0x7b, 0x54, 0x46, 0xc7, 0x12, 0xef, 0x68, 0x29,
+	0xc1, 0x40, 0xb4, 0x49, 0x74, 0x4b, 0x07, 0x87, 0xf8, 0xbc, 0x83, 0x37, 0xcd, 0xd6, 0x0e, 0xcc,
+	0xc9, 0x27, 0x5e, 0xe7, 0xe7, 0x84, 0x89, 0xda, 0xe7, 0x64, 0x05, 0xb1, 0x97, 0xd1, 0x32, 0x64,
+	0x11, 0x99, 0x82, 0x18, 0xe5, 0x74, 0xb2, 0x6a, 0x0a, 0xae, 0xcc, 0x7d, 0x2b, 0x71, 0xe3, 0xd9,
+	0x70, 0x63, 0xb8, 0x18, 0x4a, 0x6a, 0xbb, 0x7a, 0xf8, 0x22, 0xba, 0xa9, 0x74, 0x20, 0x35, 0xea,
+	0xb2, 0xf4, 0xd6, 0x90, 0x1a, 0x6c, 0x9e, 0xa8, 0xd6, 0x79, 0x08, 0xb3, 0x5a, 0xc0, 0x1b, 0x12,
+	0x91, 0xf3, 0x69, 0x11, 0x89, 0xa5, 0xe5, 0xf4, 0x42, 0x7e, 0x2c, 0x7e, 0x40, 0x95, 0x4d, 0x2c,
+	0xd7, 0x5c, 0x29, 0x2d, 0xa7, 0x1c, 0x3f, 0x9c, 0x8b, 0xec, 0x23, 0x31, 0x94, 0x0d, 0x98, 0x97,
+	0xd7, 0x1d, 0x4a, 0x02, 0x7f, 0x43, 0x76, 0x3a, 0xe3, 0xcc, 0x7d, 0x03, 0xf3, 0x5c, 0x0e, 0x34,
+	0x32, 0x05, 0xa9, 0x5c, 0x78, 0x22, 0x33, 0x23, 0x81, 0x87, 0xb0, 0x58, 0x8f, 0x8d, 0x87, 0x59,
+	0x51, 0xd7, 0x74, 0x12, 0x4a, 0x5e, 0x3a, 0x23, 0xad, 0x47, 0x80, 0xea, 0xfd, 0xc3, 0x53, 0x57,
+	0x92, 0x7b, 0xee, 0xe2, 0x17, 0xe8, 0x46, 0x6c, 0x48, 0x04, 0x48, 0xab, 0x51, 0xed, 0x54, 0x32,
+	0x8c, 0x18, 0xed, 0xb3, 0xa7, 0xf2, 0x2c, 0x61, 0x8f, 0xd3, 0x73, 0x0e, 0xdd, 0x8e, 0x1b, 0xba,
+	0x98, 0x88, 0x85, 0x8a, 0xa0, 0x16, 0x89, 0x19, 0xbc, 0x66, 0xac, 0x81, 0xbe, 0x86, 0xd9, 0x4d,
+	0x1c, 0x46, 0xa9, 0xf7, 0xd0, 0x52, 0x22, 0x59, 0x1f, 0x9f, 0x37, 0x71, 0xf1, 0xad, 0xe7, 0xfb,
+	0xdb, 0x86, 0x02, 0x53, 0xae, 0x0a, 0x89, 0x1b, 0x09, 0x12, 0xbc, 0x8a, 0xe3, 0x3b, 0xa7, 0x81,
+	0x91, 0x5b, 0xf7, 0x60, 0x7c, 0xcf, 0xed, 0x1e, 0x21, 0xe1, 0xc7, 0x56, 0x52, 0x57, 0x95, 0xe6,
+	0x35, 0x18, 0x17, 0xbd, 0x43, 0x28, 0xb3, 0x9c, 0x73, 0xc9, 0x3c, 0x6f, 0x22, 0xb1, 0xf6, 0xdb,
+	0x32, 0x4e, 0x75, 0x48, 0x6e, 0x3a, 0xc9, 0x9f, 0x78, 0x79, 0x63, 0x0d, 0xed, 0x51, 0xae, 0x27,
+	0x1b, 0x40, 0xb7, 0xa2, 0xfd, 0xd4, 0x98, 0x66, 0xae, 0x84, 0xe2, 0x84, 0x1b, 0x6b, 0x48, 0xbe,
+	0xb0, 0x4f, 0x21, 0x7a, 0x5b, 0xdb, 0xf6, 0x2f, 0x46, 0xf7, 0x6b, 0xc8, 0xcb, 0x1c, 0x6b, 0x52,
+	0xdf, 0xc4, 0x13, 0xc3, 0x49, 0x05, 0x9e, 0x4c, 0xc7, 0xf6, 0x25, 0x4b, 0x87, 0xa8, 0xe3, 0xc7,
+	0xd3, 0x90, 0x19, 0x27, 0xef, 0x33, 0x98, 0x56, 0x12, 0x90, 0xc9, 0xc5, 0x92, 0x4c, 0x4a, 0x56,
+	0xd2, 0x7f, 0xa8, 0xe5, 0x3e, 0xd9, 0x34, 0xa6, 0x78, 0xc6, 0x4b, 0xb4, 0x18, 0xa1, 0x29, 0x59,
+	0x9c, 0x62, 0x28, 0x68, 0x8d, 0xee, 0x77, 0xac, 0xa1, 0xab, 0x3a, 0x86, 0xb9, 0x95, 0x35, 0x00,
+	0x36, 0x66, 0xda, 0x90, 0x5e, 0x6c, 0x1c, 0xd5, 0x1a, 0xd9, 0xcf, 0xda, 0x17, 0x44, 0xfa, 0x5a,
+	0xec, 0x69, 0x14, 0xa9, 0xa8, 0x71, 0x52, 0x1d, 0x95, 0x09, 0x7f, 0x1b, 0x0a, 0x95, 0x16, 0xd5,
+	0xb2, 0x32, 0xb1, 0x14, 0x5a, 0x91, 0x2b, 0x58, 0x2f, 0x10, 0xb4, 0x16, 0xe3, 0x79, 0xaa, 0x76,
+	0xb0, 0x43, 0x23, 0xe9, 0x96, 0xe4, 0x5e, 0x1b, 0x2b, 0x4a, 0xc7, 0x30, 0x76, 0x6a, 0x03, 0x16,
+	0x6a, 0x4e, 0xb7, 0x85, 0x3b, 0xaf, 0x47, 0xe6, 0x73, 0xaa, 0x6e, 0x94, 0xa4, 0x5b, 0x57, 0xe3,
+	0xf8, 0x5c, 0xdb, 0x5c, 0x91, 0x47, 0x45, 0x59, 0xb5, 0x02, 0x97, 0x19, 0x13, 0x23, 0xb6, 0x98,
+	0xb0, 0x4d, 0xcd, 0x7f, 0x02, 0x73, 0x1b, 0x44, 0x1d, 0xf7, 0xdb, 0x2e, 0x0b, 0xba, 0x46, 0x7a,
+	0x14, 0xad, 0x11, 0x71, 0x4b, 0x24, 0x30, 0x54, 0xb2, 0x51, 0x49, 0x21, 0x4f, 0x26, 0xfc, 0x2a,
+	0x2d, 0x08, 0xb2, 0x6a, 0xe2, 0x2a, 0xba, 0xf7, 0x1e, 0x89, 0x8c, 0x27, 0xb1, 0x1c, 0x43, 0xaa,
+	0x42, 0x31, 0x66, 0x20, 0x2a, 0xbd, 0x3d, 0xbc, 0x92, 0x6a, 0x8b, 0xd9, 0xb0, 0x64, 0xc8, 0xdf,
+	0x84, 0xde, 0x91, 0x66, 0xf1, 0xb0, 0xfc, 0x4e, 0x29, 0xe6, 0xda, 0x77, 0x4a, 0x16, 0x0f, 0x03,
+	0xcd, 0xe1, 0x89, 0x9d, 0x8c, 0x0c, 0x96, 0x81, 0x85, 0xa9, 0x09, 0x98, 0xd0, 0xbb, 0x3a, 0xf5,
+	0x21, 0x49, 0x9a, 0x8c, 0x2d, 0x3c, 0xa1, 0xa2, 0x17, 0xe5, 0xff, 0x91, 0x46, 0x4f, 0x5a, 0x92,
+	0x26, 0x69, 0xf4, 0xa4, 0x66, 0x4f, 0x62, 0x0c, 0xde, 0x84, 0xcb, 0xb1, 0x54, 0x48, 0xe8, 0x46,
+	0x9c, 0xb1, 0x23, 0x18, 0xca, 0x08, 0x3d, 0x16, 0x82, 0x9d, 0x24, 0x94, 0x9e, 0x1c, 0xc9, 0x34,
+	0x46, 0x46, 0xee, 0x40, 0x9a, 0x40, 0x6a, 0xba, 0x23, 0xf4, 0x56, 0x0a, 0x0b, 0xcf, 0xc7, 0x3a,
+	0x46, 0xb6, 0x0e, 0x85, 0x78, 0xb6, 0x20, 0xb4, 0x22, 0xb9, 0x94, 0x9a, 0x12, 0xa9, 0x54, 0x36,
+	0x96, 0xf3, 0x4d, 0xe7, 0x61, 0x34, 0x29, 0xec, 0x1a, 0x2c, 0x3e, 0x29, 0x6a, 0xa6, 0x98, 0xc4,
+	0xa4, 0xe8, 0x09, 0x60, 0x36, 0x69, 0x38, 0xb4, 0x92, 0xf6, 0xc7, 0x78, 0x3a, 0xbd, 0x91, 0x46,
+	0x27, 0xba, 0xe9, 0xa9, 0x8b, 0x84, 0xaa, 0x4a, 0xbf, 0x56, 0xb4, 0x7d, 0x33, 0xd9, 0xb5, 0xb2,
+	0xb1, 0x5c, 0x8e, 0xb4, 0x10, 0x4f, 0x80, 0x23, 0x89, 0x1a, 0x32, 0xe3, 0x18, 0x45, 0xf9, 0x01,
+	0x2c, 0xe8, 0xb3, 0x38, 0x62, 0xbc, 0x66, 0x5b, 0x77, 0x56, 0x4b, 0x7b, 0x83, 0xc4, 0xad, 0x5c,
+	0x2c, 0xc3, 0x4e, 0x82, 0xfb, 0x29, 0xe9, 0x77, 0x18, 0xf7, 0x95, 0x14, 0x3a, 0xe7, 0xe1, 0x7e,
+	0x5a, 0xc6, 0x1d, 0xc9, 0x28, 0xa5, 0x5f, 0x62, 0xfb, 0x8b, 0x17, 0x5c, 0x84, 0x51, 0xe7, 0xe9,
+	0x9a, 0x89, 0xce, 0x3a, 0xb5, 0x6e, 0xe4, 0xef, 0x54, 0x5d, 0xd3, 0xd8, 0xa4, 0x49, 0x7c, 0x49,
+	0x1b, 0x9c, 0x2e, 0xec, 0x35, 0x98, 0x51, 0x33, 0xf8, 0x18, 0x7b, 0x71, 0x3d, 0x49, 0x23, 0x50,
+	0xce, 0x5b, 0x73, 0x92, 0x0b, 0xac, 0x37, 0xcb, 0x71, 0xe6, 0x68, 0x1d, 0x32, 0x0f, 0x09, 0xa9,
+	0xac, 0x19, 0xd1, 0x25, 0xb3, 0x59, 0x30, 0xcf, 0x0c, 0x24, 0xfd, 0x67, 0xcc, 0x0c, 0xbf, 0x86,
+	0x66, 0x24, 0x73, 0x40, 0x1f, 0x59, 0xa8, 0xe9, 0x78, 0x90, 0x22, 0x25, 0x29, 0x69, 0x7a, 0x4a,
+	0x2b, 0xa6, 0x62, 0x55, 0x43, 0x7f, 0x0b, 0x57, 0x12, 0x69, 0x87, 0xa4, 0x23, 0xcc, 0x94, 0x90,
+	0x68, 0xb8, 0x16, 0xdc, 0x22, 0x03, 0x8e, 0x21, 0x36, 0x56, 0x47, 0x13, 0x4d, 0xee, 0xa5, 0x3b,
+	0xe2, 0x5d, 0x46, 0x5a, 0xe7, 0x4c, 0xc9, 0x8d, 0x8c, 0x1c, 0xdc, 0x87, 0xc5, 0xd4, 0xb4, 0x46,
+	0xd2, 0xac, 0x18, 0x96, 0xf4, 0xc8, 0x48, 0xf5, 0x2f, 0xd2, 0xb4, 0xc2, 0xb1, 0x94, 0x39, 0xd2,
+	0x0f, 0x61, 0x4c, 0x93, 0x24, 0xfd, 0x10, 0xe6, 0xfc, 0x45, 0x8c, 0x9b, 0x3b, 0xb0, 0x90, 0x96,
+	0x84, 0x48, 0xf1, 0xdb, 0x19, 0x33, 0x14, 0xa5, 0x70, 0xd4, 0x16, 0xab, 0xdd, 0x40, 0x6d, 0x48,
+	0x4a, 0x22, 0x23, 0x07, 0xbe, 0x17, 0x89, 0xa6, 0x92, 0xa9, 0x83, 0xe4, 0x69, 0x6d, 0x44, 0x6e,
+	0xa1, 0x21, 0x46, 0xe5, 0xe5, 0xba, 0x7b, 0xd4, 0x55, 0xb2, 0xfc, 0x48, 0x93, 0x32, 0x99, 0x5e,
+	0x48, 0x6a, 0x96, 0xb4, 0xa4, 0x40, 0x4f, 0x60, 0x41, 0x6c, 0xb1, 0x6a, 0x56, 0x1c, 0x94, 0xc0,
+	0x89, 0xde, 0x52, 0x48, 0x2d, 0x93, 0x9a, 0x46, 0x87, 0x9d, 0xc9, 0xe8, 0xef, 0x20, 0x29, 0x67,
+	0x32, 0x25, 0x5d, 0x4d, 0x49, 0xcf, 0x6c, 0x83, 0xbe, 0xa0, 0x67, 0x32, 0x96, 0xbd, 0xd0, 0xec,
+	0x14, 0xd6, 0x28, 0x45, 0x3a, 0x6d, 0x4d, 0xb8, 0x0d, 0x69, 0x83, 0x3a, 0xe5, 0xd1, 0xc7, 0x2c,
+	0x8a, 0xa4, 0x1f, 0xb3, 0xd4, 0x8e, 0x9a, 0x9d, 0x33, 0x33, 0xea, 0x03, 0x6d, 0xc9, 0xab, 0x94,
+	0x4c, 0x0e, 0x92, 0x57, 0x69, 0xf9, 0x11, 0xa8, 0x55, 0xbf, 0x2f, 0x4c, 0xb8, 0x88, 0xde, 0x8d,
+	0xa1, 0x09, 0x0e, 0x4a, 0x2b, 0xc3, 0xb3, 0x02, 0xf0, 0xdb, 0x81, 0x42, 0xfc, 0x0d, 0x39, 0x4a,
+	0xcb, 0x4f, 0xa1, 0x3c, 0xa4, 0x97, 0x86, 0x88, 0xf1, 0xf1, 0xf9, 0x9e, 0x30, 0x0f, 0x75, 0xba,
+	0x86, 0x2c, 0x05, 0x2a, 0xe9, 0xe1, 0x66, 0x44, 0xf4, 0x9c, 0x5c, 0x35, 0xe2, 0x12, 0xcf, 0xd5,
+	0x55, 0x33, 0x22, 0xe5, 0x05, 0xba, 0x2b, 0xc2, 0x54, 0xd2, 0x73, 0x1e, 0xbd, 0xab, 0x9b, 0x59,
+	0x43, 0x02, 0x78, 0x47, 0xde, 0xbf, 0xa0, 0xdf, 0x15, 0xc9, 0x1c, 0x93, 0x19, 0x41, 0xde, 0x89,
+	0xf9, 0x61, 0xd2, 0x43, 0x3e, 0x4b, 0xc3, 0x12, 0x8e, 0xa0, 0xc7, 0xf4, 0x59, 0xdf, 0x93, 0xed,
+	0xf5, 0x1a, 0xff, 0xb5, 0x53, 0xcf, 0x4f, 0x38, 0xb8, 0x95, 0x5f, 0xec, 0x88, 0x98, 0xcc, 0xaa,
+	0x68, 0x88, 0x8d, 0x35, 0x54, 0xa7, 0x7e, 0x56, 0x0d, 0x9a, 0xe2, 0xe3, 0x4e, 0x21, 0x58, 0x4a,
+	0x27, 0x48, 0x9d, 0xfe, 0x1b, 0x62, 0x37, 0xd3, 0xbb, 0x69, 0xe8, 0xc3, 0x30, 0x2b, 0x80, 0x89,
+	0x4d, 0x3a, 0x19, 0xd1, 0xbb, 0x51, 0x72, 0xc4, 0x38, 0x56, 0xaf, 0x3c, 0xde, 0x79, 0x25, 0x8e,
+	0x69, 0x88, 0x8d, 0x55, 0xce, 0x31, 0x0d, 0x7a, 0x31, 0x8e, 0xc5, 0x08, 0xea, 0x1c, 0xd3, 0xbb,
+	0x69, 0xe8, 0xc3, 0x68, 0x8e, 0xa5, 0x93, 0x39, 0x2f, 0xc7, 0xbe, 0xa5, 0xfb, 0xf3, 0x26, 0x7d,
+	0x64, 0x76, 0x21, 0x9e, 0x15, 0x85, 0x05, 0xab, 0xa3, 0x36, 0xd6, 0xd0, 0x53, 0x9a, 0xb1, 0x32,
+	0x06, 0x3f, 0x1f, 0xdf, 0x96, 0x4d, 0x44, 0x29, 0xe7, 0xb6, 0x61, 0x91, 0x71, 0x2e, 0xde, 0x5d,
+	0x63, 0x5f, 0x8c, 0xc3, 0xde, 0x14, 0xc6, 0x4e, 0x9c, 0xd4, 0x45, 0xf9, 0xb7, 0x4e, 0x45, 0x64,
+	0xdf, 0x27, 0xf6, 0x69, 0x3b, 0x69, 0xbc, 0xea, 0x44, 0x84, 0x67, 0x5c, 0xaf, 0xde, 0x58, 0x45,
+	0xdb, 0x74, 0x16, 0x74, 0xf0, 0x30, 0xeb, 0x3e, 0x9d, 0x0c, 0x65, 0xd2, 0x96, 0x30, 0x88, 0x62,
+	0x7d, 0x32, 0xb5, 0x6d, 0xee, 0x94, 0x3c, 0xfa, 0x9c, 0x73, 0x74, 0x26, 0x16, 0xb1, 0x8d, 0x9d,
+	0x9d, 0x34, 0x46, 0x71, 0x26, 0xfe, 0x4b, 0xe1, 0xe8, 0x77, 0x20, 0x2f, 0x90, 0x47, 0x33, 0x24,
+	0x8e, 0x4d, 0x19, 0xf2, 0x35, 0x4c, 0x73, 0x86, 0xd0, 0x1e, 0x98, 0x5a, 0x32, 0x76, 0xff, 0x2b,
+	0x98, 0xe6, 0x6c, 0x18, 0x3a, 0x02, 0xf3, 0xb5, 0xe2, 0xe2, 0x26, 0x0e, 0x53, 0x7e, 0xc9, 0x76,
+	0xd4, 0x60, 0xd2, 0x7e, 0x38, 0x17, 0x35, 0xe8, 0xf3, 0x5c, 0xd3, 0xaf, 0x0e, 0x9b, 0x48, 0x8e,
+	0xfc, 0xcd, 0x63, 0x42, 0xb7, 0x6e, 0xa6, 0x3b, 0x12, 0xdf, 0x38, 0xfa, 0x5d, 0x58, 0xa6, 0x77,
+	0x10, 0x17, 0xed, 0xb1, 0xf9, 0x90, 0x72, 0x2d, 0x0a, 0x3f, 0x88, 0xff, 0xe0, 0xb1, 0x89, 0xd8,
+	0xa8, 0xdf, 0x5a, 0x26, 0x54, 0xeb, 0x46, 0xaa, 0xa3, 0xb0, 0x87, 0x6c, 0x46, 0xd7, 0xe9, 0xd8,
+	0x2f, 0xd8, 0xdb, 0xe1, 0x9a, 0x26, 0xf6, 0x0b, 0xcc, 0xa3, 0xa2, 0x27, 0xe2, 0xbf, 0xf1, 0x4c,
+	0xa8, 0xd4, 0x13, 0x54, 0x4c, 0xb5, 0x87, 0x6d, 0x3e, 0x74, 0x68, 0xe7, 0xec, 0x8d, 0xf9, 0x72,
+	0x24, 0x2f, 0x73, 0x97, 0x20, 0xc5, 0xb6, 0xd7, 0x32, 0x73, 0x94, 0x66, 0xd5, 0x58, 0x87, 0x00,
+	0x55, 0xd8, 0x1e, 0xaf, 0xe6, 0xf0, 0x50, 0xbc, 0x88, 0xa9, 0xc9, 0x3d, 0xe2, 0x24, 0xd8, 0xd9,
+	0x84, 0xfe, 0x2c, 0xb4, 0x72, 0x36, 0x51, 0xb2, 0x1b, 0x94, 0xf4, 0xdc, 0x03, 0x5c, 0x85, 0xd1,
+	0x04, 0x04, 0xea, 0x7d, 0x91, 0x9a, 0xdf, 0x40, 0x3d, 0x9b, 0xe8, 0x99, 0x18, 0xe4, 0xd9, 0x84,
+	0x36, 0xa8, 0x53, 0x1e, 0x7d, 0x36, 0xa1, 0x48, 0xfa, 0xd9, 0x44, 0xed, 0xa8, 0x79, 0xe1, 0xa1,
+	0x64, 0x2a, 0x06, 0x79, 0xee, 0x36, 0x66, 0x69, 0x18, 0x72, 0xa5, 0x34, 0x9f, 0x92, 0x74, 0x47,
+	0xda, 0xfc, 0xe6, 0x84, 0x3c, 0x25, 0xfd, 0x7e, 0xe4, 0x7e, 0x06, 0xed, 0xd2, 0xbc, 0xd1, 0x69,
+	0xbf, 0x96, 0x6d, 0x92, 0x9f, 0xa1, 0x3f, 0xcf, 0x4d, 0xe8, 0xd5, 0xd3, 0xe9, 0x0d, 0xc5, 0x1b,
+	0x72, 0xac, 0xbb, 0xc6, 0x23, 0x4a, 0x2e, 0xd0, 0x45, 0xb3, 0x88, 0x4f, 0x31, 0x1f, 0xb1, 0x19,
+	0xb5, 0xa0, 0xfe, 0x3c, 0x35, 0xdd, 0xb2, 0xee, 0xc2, 0x24, 0x43, 0x32, 0xee, 0x36, 0xda, 0x4f,
+	0x5a, 0xa3, 0x0f, 0xc4, 0xc5, 0x2d, 0x41, 0xd1, 0x8a, 0x8c, 0xfd, 0xfa, 0x00, 0xf2, 0xcc, 0xed,
+	0x76, 0x7e, 0x94, 0x2f, 0xc4, 0xf5, 0xee, 0xb0, 0x8e, 0x99, 0xa3, 0x2a, 0x66, 0x55, 0x87, 0xf3,
+	0xc5, 0x19, 0xf9, 0x15, 0x75, 0x7d, 0x0a, 0x57, 0x83, 0x19, 0x7f, 0x31, 0xf1, 0xf3, 0xe3, 0x94,
+	0xa5, 0x9f, 0x52, 0xff, 0xab, 0xcc, 0x5e, 0x65, 0xea, 0x7e, 0xf2, 0xc7, 0xcb, 0xd1, 0x17, 0x30,
+	0xc7, 0x98, 0x2b, 0x91, 0x93, 0x95, 0x86, 0xf0, 0x6c, 0x8e, 0xb1, 0xf9, 0x55, 0x90, 0x7f, 0x47,
+	0x38, 0x6a, 0x47, 0x76, 0xfb, 0x3c, 0x2e, 0xda, 0xd1, 0xac, 0x33, 0x51, 0xf9, 0x5d, 0xba, 0xe9,
+	0xa6, 0xa7, 0x5c, 0x31, 0x12, 0xbb, 0xa3, 0xb8, 0xa0, 0x87, 0x27, 0x6b, 0x39, 0xa1, 0xd1, 0x81,
+	0xe9, 0x3f, 0x60, 0x7f, 0x7b, 0x04, 0x15, 0xc1, 0x80, 0x9f, 0x8d, 0xac, 0x27, 0xfd, 0x5c, 0x3c,
+	0x69, 0x79, 0x7a, 0x7b, 0x23, 0x12, 0xaf, 0xa4, 0xb8, 0x0c, 0x0d, 0xf9, 0x4c, 0x04, 0x41, 0xfd,
+	0xda, 0x71, 0xe8, 0x18, 0xcc, 0x47, 0xb4, 0x28, 0xf7, 0xf8, 0x05, 0x27, 0xc1, 0x6c, 0x46, 0xa1,
+	0x64, 0x96, 0x17, 0x34, 0xec, 0x45, 0x95, 0xea, 0x90, 0x35, 0x65, 0x87, 0xd9, 0x14, 0xa1, 0xa8,
+	0xb1, 0xe7, 0x89, 0xa6, 0x87, 0x8e, 0x43, 0x4e, 0x67, 0x3c, 0x18, 0xf3, 0x8d, 0x10, 0x4a, 0xce,
+	0xf6, 0xc5, 0x09, 0x49, 0xc7, 0x70, 0x8c, 0x90, 0x35, 0x64, 0x7a, 0x47, 0x3b, 0xbd, 0x8a, 0x86,
+	0x79, 0xbd, 0xf8, 0x84, 0x3a, 0x51, 0xd8, 0x5f, 0x32, 0x15, 0x8d, 0xdc, 0xf6, 0x8d, 0x69, 0x71,
+	0xe4, 0xec, 0x0e, 0xc9, 0x63, 0x53, 0x8b, 0x7e, 0xeb, 0x45, 0xcb, 0x5d, 0x53, 0xb3, 0x77, 0xa4,
+	0xbb, 0x2e, 0x2d, 0xa9, 0x4d, 0x09, 0x44, 0xa1, 0xbd, 0x43, 0xd6, 0xba, 0x29, 0xef, 0x4a, 0x14,
+	0xba, 0x34, 0x3c, 0x2b, 0x8d, 0x5c, 0xeb, 0x23, 0x13, 0xb8, 0xec, 0xc2, 0x42, 0x5a, 0xbe, 0x14,
+	0x39, 0x69, 0x43, 0x92, 0xa9, 0xa4, 0xc6, 0x47, 0xed, 0xc1, 0x62, 0x6a, 0xce, 0x12, 0x79, 0x43,
+	0x32, 0x2c, 0xa3, 0x49, 0x2a, 0xc5, 0xef, 0x60, 0xc9, 0x90, 0xa0, 0x23, 0x72, 0x20, 0x0e, 0x4d,
+	0xe0, 0x61, 0x14, 0x88, 0x1f, 0xa0, 0x64, 0xce, 0xfd, 0x80, 0xee, 0xe8, 0x4e, 0x50, 0x73, 0xc6,
+	0x85, 0x52, 0x6a, 0xb2, 0x1a, 0xb4, 0x4f, 0xf3, 0xe8, 0xa5, 0x25, 0x83, 0x90, 0xfd, 0x1e, 0x9e,
+	0x2c, 0xc2, 0x10, 0xd7, 0xb6, 0x64, 0xc8, 0xff, 0x30, 0x84, 0xea, 0x39, 0x7a, 0xbb, 0x2b, 0xf4,
+	0x92, 0x9e, 0x10, 0x20, 0x16, 0x22, 0x9f, 0x9a, 0x2d, 0x20, 0xb5, 0x9f, 0x0f, 0x61, 0x56, 0x7b,
+	0xe0, 0x29, 0xc5, 0x3f, 0xed, 0x59, 0xb0, 0xf4, 0x56, 0xa7, 0xbe, 0x09, 0xad, 0x16, 0x7e, 0xf9,
+	0x3f, 0x56, 0x32, 0xbf, 0xfc, 0xf5, 0x4a, 0xe6, 0xbf, 0xfd, 0x7a, 0x25, 0xf3, 0xab, 0x5f, 0xaf,
+	0x64, 0x0e, 0x27, 0x69, 0xf5, 0xb5, 0xff, 0x1b, 0x00, 0x00, 0xff, 0xff, 0xaa, 0x07, 0x03, 0xcc,
+	0x29, 0x90, 0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -22123,6 +22333,11 @@ func (m *AddMFADeviceRequestInit) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.DeviceUsage != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.DeviceUsage))
+		i--
+		dAtA[i] = 0x20
+	}
 	if m.DeviceType != 0 {
 		i = encodeVarintAuthservice(dAtA, i, uint64(m.DeviceType))
 		i--
@@ -24443,6 +24658,60 @@ func (m *UserCredentials) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *ContextUser) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ContextUser) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ContextUser) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Passwordless) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Passwordless) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Passwordless) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *CreateAuthenticateChallengeRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -24514,6 +24783,48 @@ func (m *CreateAuthenticateChallengeRequest_RecoveryStartTokenID) MarshalToSized
 	dAtA[i] = 0x12
 	return len(dAtA) - i, nil
 }
+func (m *CreateAuthenticateChallengeRequest_ContextUser) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CreateAuthenticateChallengeRequest_ContextUser) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.ContextUser != nil {
+		{
+			size, err := m.ContextUser.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *CreateAuthenticateChallengeRequest_Passwordless) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CreateAuthenticateChallengeRequest_Passwordless) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Passwordless != nil {
+		{
+			size, err := m.Passwordless.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	return len(dAtA) - i, nil
+}
 func (m *CreatePrivilegeTokenRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -24577,6 +24888,11 @@ func (m *CreateRegisterChallengeRequest) MarshalToSizedBuffer(dAtA []byte) (int,
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.DeviceUsage != 0 {
+		i = encodeVarintAuthservice(dAtA, i, uint64(m.DeviceUsage))
+		i--
+		dAtA[i] = 0x18
+	}
 	if m.DeviceType != 0 {
 		i = encodeVarintAuthservice(dAtA, i, uint64(m.DeviceType))
 		i--
@@ -24712,6 +25028,48 @@ func (m *PaginatedResource_KubeService) MarshalToSizedBuffer(dAtA []byte) (int,
 	}
 	return len(dAtA) - i, nil
 }
+func (m *PaginatedResource_WindowsDesktop) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PaginatedResource_WindowsDesktop) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.WindowsDesktop != nil {
+		{
+			size, err := m.WindowsDesktop.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *PaginatedResource_KubeCluster) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PaginatedResource_KubeCluster) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.KubeCluster != nil {
+		{
+			size, err := m.KubeCluster.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintAuthservice(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
+	return len(dAtA) - i, nil
+}
 func (m *ListResourcesRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -24736,6 +25094,16 @@ func (m *ListResourcesRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	{
+		size, err := m.WindowsDesktopFilter.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintAuthservice(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x52
 	if m.NeedTotalCount {
 		i--
 		if m.NeedTotalCount {
@@ -24932,12 +25300,12 @@ func (m *CreateSessionTrackerRequest) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i--
 		dAtA[i] = 0x5a
 	}
-	n96, err96 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err96 != nil {
-		return 0, err96
+	n101, err101 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err101 != nil {
+		return 0, err101
 	}
-	i -= n96
-	i = encodeVarintAuthservice(dAtA, i, uint64(n96))
+	i -= n101
+	i = encodeVarintAuthservice(dAtA, i, uint64(n101))
 	i--
 	dAtA[i] = 0x52
 	if m.Initiator != nil {
@@ -27615,6 +27983,9 @@ func (m *AddMFADeviceRequestInit) Size() (n int) {
 	if m.DeviceType != 0 {
 		n += 1 + sovAuthservice(uint64(m.DeviceType))
 	}
+	if m.DeviceUsage != 0 {
+		n += 1 + sovAuthservice(uint64(m.DeviceUsage))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -28719,6 +29090,30 @@ func (m *UserCredentials) Size() (n int) {
 	return n
 }
 
+func (m *ContextUser) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *Passwordless) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *CreateAuthenticateChallengeRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -28756,6 +29151,30 @@ func (m *CreateAuthenticateChallengeRequest_RecoveryStartTokenID) Size() (n int)
 	n += 1 + l + sovAuthservice(uint64(l))
 	return n
 }
+func (m *CreateAuthenticateChallengeRequest_ContextUser) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ContextUser != nil {
+		l = m.ContextUser.Size()
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	return n
+}
+func (m *CreateAuthenticateChallengeRequest_Passwordless) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Passwordless != nil {
+		l = m.Passwordless.Size()
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	return n
+}
 func (m *CreatePrivilegeTokenRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -28785,6 +29204,9 @@ func (m *CreateRegisterChallengeRequest) Size() (n int) {
 	if m.DeviceType != 0 {
 		n += 1 + sovAuthservice(uint64(m.DeviceType))
 	}
+	if m.DeviceUsage != 0 {
+		n += 1 + sovAuthservice(uint64(m.DeviceUsage))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -28854,6 +29276,30 @@ func (m *PaginatedResource_KubeService) Size() (n int) {
 	}
 	return n
 }
+func (m *PaginatedResource_WindowsDesktop) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.WindowsDesktop != nil {
+		l = m.WindowsDesktop.Size()
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	return n
+}
+func (m *PaginatedResource_KubeCluster) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.KubeCluster != nil {
+		l = m.KubeCluster.Size()
+		n += 1 + l + sovAuthservice(uint64(l))
+	}
+	return n
+}
 func (m *ListResourcesRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -28898,6 +29344,8 @@ func (m *ListResourcesRequest) Size() (n int) {
 	if m.NeedTotalCount {
 		n += 2
 	}
+	l = m.WindowsDesktopFilter.Size()
+	n += 1 + l + sovAuthservice(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -39958,6 +40406,25 @@ func (m *AddMFADeviceRequestInit) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceUsage", wireType)
+			}
+			m.DeviceUsage = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DeviceUsage |= DeviceUsage(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -45360,6 +45827,108 @@ func (m *UserCredentials) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *ContextUser) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ContextUser: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ContextUser: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Passwordless) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAuthservice
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Passwordless: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Passwordless: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAuthservice(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -45456,6 +46025,76 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.Request = &CreateAuthenticateChallengeRequest_RecoveryStartTokenID{string(dAtA[iNdEx:postIndex])}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ContextUser", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &ContextUser{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Request = &CreateAuthenticateChallengeRequest_ContextUser{v}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Passwordless", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Passwordless{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Request = &CreateAuthenticateChallengeRequest_Passwordless{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -45645,6 +46284,25 @@ func (m *CreateRegisterChallengeRequest) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceUsage", wireType)
+			}
+			m.DeviceUsage = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DeviceUsage |= DeviceUsage(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -45836,6 +46494,76 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 			}
 			m.Resource = &PaginatedResource_KubeService{v}
 			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktop", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &types.WindowsDesktopV3{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_WindowsDesktop{v}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubeCluster", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &types.KubernetesClusterV3{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &PaginatedResource_KubeCluster{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -46246,6 +46974,39 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.NeedTotalCount = bool(v != 0)
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopFilter", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthservice
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthservice
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.WindowsDesktopFilter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
diff --git a/api/client/proto/authservice.proto b/api/client/proto/authservice.proto
index e7631dfd1aa95..1b08662e5ab2c 100644
--- a/api/client/proto/authservice.proto
+++ b/api/client/proto/authservice.proto
@@ -818,6 +818,19 @@ enum DeviceType {
     DEVICE_TYPE_WEBAUTHN = 3;
 }
 
+enum DeviceUsage {
+    DEVICE_USAGE_UNSPECIFIED = 0;
+
+    // Device intended for MFA use, but not for passwordless.
+    // Allows both FIDO and FIDO2 devices.
+    // Resident keys not required.
+    DEVICE_USAGE_MFA = 1;
+
+    // Device intended for both MFA and passwordless.
+    // Requires a FIDO2 device and takes a resident key slot.
+    DEVICE_USAGE_PASSWORDLESS = 2;
+}
+
 // MFAAuthenticateChallenge is a challenge for all MFA devices registered for a
 // user.
 message MFAAuthenticateChallenge {
@@ -928,7 +941,11 @@ message AddMFADeviceResponse {
 // AddMFADeviceRequestInit describes the new MFA device.
 message AddMFADeviceRequestInit {
     string DeviceName = 1;
+    reserved 2; // LegacyDeviceType LegacyType
     DeviceType DeviceType = 3;
+    // DeviceUsage is the requested usage for the device.
+    // Defaults to DEVICE_USAGE_MFA.
+    DeviceUsage DeviceUsage = 4 [ (gogoproto.jsontag) = "device_usage,omitempty" ];
 }
 
 // AddMFADeviceResponseAck is a confirmation of successful device registration.
@@ -1374,12 +1391,17 @@ message UserCredentials {
     bytes Password = 2 [ (gogoproto.jsontag) = "password" ];
 }
 
+// ContextUser marks requests that rely in the currently authenticated user.
+message ContextUser {}
+
+// Passwordless marks requests for passwordless challenges.
+message Passwordless {}
+
 // CreateAuthenticateChallengeRequest is a request for creating MFA authentication challenges for a
 // users mfa devices.
 message CreateAuthenticateChallengeRequest {
     // Request defines how the request will be verified before creating challenges.
-    // This field can be empty, which implies the request is to create challenges for the
-    // user in context (logged in user).
+    // An empty Request is equivalent to context_user being set.
     oneof Request {
         // UserCredentials verifies request with username and password. Used with logins or
         // when the logged in user wants to change their password.
@@ -1389,6 +1411,12 @@ message CreateAuthenticateChallengeRequest {
         // VerifyAccountRecovery (step 2 of the recovery process after RPC StartAccountRecovery).
         string RecoveryStartTokenID = 2
             [ (gogoproto.jsontag) = "recovery_start_token_id,omitempty" ];
+        // ContextUser issues a challenge for the currently-authenticated user.
+        // Default option if no other is provided.
+        ContextUser ContextUser = 3 [ (gogoproto.jsontag) = "context_user,omitempty" ];
+        // Passwordless issues a passwordless challenge (authenticated user not
+        // required).
+        Passwordless Passwordless = 4 [ (gogoproto.jsontag) = "passwordless,omitempty" ];
     }
 }
 
@@ -1412,6 +1440,9 @@ message CreateRegisterChallengeRequest {
     string TokenID = 1 [ (gogoproto.jsontag) = "token_id" ];
     // DeviceType is the type of MFA device to make a register challenge for.
     DeviceType DeviceType = 2 [ (gogoproto.jsontag) = "device_type" ];
+    // DeviceUsage is the requested usage for the device.
+    // Defaults to DEVICE_USAGE_MFA.
+    DeviceUsage DeviceUsage = 3 [ (gogoproto.jsontag) = "device_usage,omitempty" ];
 }
 
 // PaginatedResource represents one of the supported resources.
@@ -1426,6 +1457,12 @@ message PaginatedResource {
         types.ServerV2 Node = 3 [ (gogoproto.jsontag) = "node,omitempty" ];
         // KubeService represents a KubernetesService resource.
         types.ServerV2 KubeService = 4 [ (gogoproto.jsontag) = "kube_service,omitempty" ];
+        // WindowsDesktop represents a WindowsDesktop resource.
+        types.WindowsDesktopV3 WindowsDesktop = 5
+            [ (gogoproto.jsontag) = "windows_desktop,omitempty" ];
+        // KubeCluster represents a KubeCluster resource.
+        types.KubernetesClusterV3 KubeCluster = 6
+            [ (gogoproto.jsontag) = "kube_cluster,omitempty" ];
     }
 }
 
@@ -1454,6 +1491,9 @@ message ListResourcesRequest {
     // NeedTotalCount indicates whether or not the caller also wants the total number of resources
     // after filtering.
     bool NeedTotalCount = 9 [ (gogoproto.jsontag) = "need_total_count,omitempty" ];
+    // WindowsDesktopFilter specifies windows desktop specific filters.
+    types.WindowsDesktopFilter WindowsDesktopFilter = 10
+        [ (gogoproto.nullable) = false, (gogoproto.jsontag) = "windows_desktop_filter,omitempty" ];
 }
 
 // ListResourceResponse response of ListResources.
diff --git a/api/client/proto/types.go b/api/client/proto/types.go
index ece8f561c6ba0..9e1b789474628 100644
--- a/api/client/proto/types.go
+++ b/api/client/proto/types.go
@@ -88,5 +88,5 @@ func (req *ListResourcesRequest) CheckAndSetDefaults() error {
 // RequiresFakePagination checks if we need to fallback to GetXXX calls
 // that retrieves entire resources upfront rather than working with subsets.
 func (req *ListResourcesRequest) RequiresFakePagination() bool {
-	return req.SortBy.Field != "" || req.NeedTotalCount
+	return req.SortBy.Field != "" || req.NeedTotalCount || req.ResourceType == types.KindKubernetesCluster
 }
diff --git a/api/client/proxy.go b/api/client/proxy.go
index e128bb1b275a0..7e4f80c59a09e 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -46,8 +46,8 @@ func DialProxyWithDialer(ctx context.Context, proxyAddr *url.URL, addr string, d
 		Host:   addr,
 		Header: make(http.Header),
 	}
-	err = connectReq.Write(conn)
-	if err != nil {
+
+	if err := connectReq.Write(conn); err != nil {
 		log.Warnf("Unable to write to proxy: %v.", err)
 		return nil, trace.Wrap(err)
 	}
diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index 7477d6b897b21..c896fb7ec0711 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -1,3 +1,19 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 package proxy
 
 import (
diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index e0f5e1b0d8f77..f65877cc161d9 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -40,19 +40,54 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+// Config specifies information when building requests with the
+// webclient.
+type Config struct {
+	// Context is a context for creating webclient requests.
+	Context context.Context
+	// ProxyAddr specifies the teleport proxy address for requests.
+	ProxyAddr string
+	// Insecure turns off TLS certificate verification when enabled.
+	Insecure bool
+	// Pool defines the set of root CAs to use when verifying server
+	// certificates.
+	Pool *x509.CertPool
+	// ConnectorName is the name of the ODIC or SAML connector.
+	ConnectorName string
+	// ExtraHeaders is a map of extra HTTP headers to be included in
+	// requests.
+	ExtraHeaders map[string]string
+}
+
+// CheckAndSetDefaults checks and sets defaults
+func (c *Config) CheckAndSetDefaults() error {
+	message := "webclient config: %s"
+	if c.Context == nil {
+		return trace.BadParameter(message, "missing parameter Context")
+	}
+	if c.ProxyAddr == "" && os.Getenv(defaults.TunnelPublicAddrEnvar) == "" {
+		return trace.BadParameter(message, "missing parameter ProxyAddr")
+	}
+
+	return nil
+}
+
 // newWebClient creates a new client to the HTTPS web proxy.
-func newWebClient(insecure bool, pool *x509.CertPool) *http.Client {
+func newWebClient(cfg *Config) (*http.Client, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return nil, trace.Wrap(err)
+	}
 	return &http.Client{
 		Transport: &proxy.ProxyAwareRoundTripper{Transport: http.Transport{
 			TLSClientConfig: &tls.Config{
-				RootCAs:            pool,
-				InsecureSkipVerify: insecure,
+				RootCAs:            cfg.Pool,
+				InsecureSkipVerify: cfg.Insecure,
 			},
 			Proxy: func(req *http.Request) (*url.URL, error) {
 				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
 			},
-		}},
-	}
+		},
+		}}, nil
 }
 
 // doWithFallback attempts to execute an HTTP request using https, and then
@@ -61,9 +96,13 @@ func newWebClient(insecure bool, pool *x509.CertPool) *http.Client {
 //  * The target host must resolve to the loopback address.
 // If these conditions are not met, then the plain-HTTP fallback is not allowed,
 // and a the HTTPS failure will be considered final.
-func doWithFallback(clt *http.Client, allowPlainHTTP bool, req *http.Request) (*http.Response, error) {
+func doWithFallback(clt *http.Client, allowPlainHTTP bool, extraHeaders map[string]string, req *http.Request) (*http.Response, error) {
 	// first try https and see how that goes
 	req.URL.Scheme = "https"
+	for k, v := range extraHeaders {
+		req.Header.Add(k, v)
+	}
+
 	log.Debugf("Attempting %s %s%s", req.Method, req.URL.Host, req.URL.Path)
 	resp, err := clt.Do(req)
 
@@ -93,18 +132,21 @@ func doWithFallback(clt *http.Client, allowPlainHTTP bool, req *http.Request) (*
 
 // Find fetches discovery data by connecting to the given web proxy address.
 // It is designed to fetch proxy public addresses without any inefficiencies.
-func Find(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertPool) (*PingResponse, error) {
-	clt := newWebClient(insecure, pool)
+func Find(cfg *Config) (*PingResponse, error) {
+	clt, err := newWebClient(cfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	defer clt.CloseIdleConnections()
 
-	endpoint := fmt.Sprintf("https://%s/webapi/find", proxyAddr)
+	endpoint := fmt.Sprintf("https://%s/webapi/find", cfg.ProxyAddr)
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	req, err := http.NewRequestWithContext(cfg.Context, http.MethodGet, endpoint, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := doWithFallback(clt, insecure, req)
+	resp, err := doWithFallback(clt, cfg.Insecure, cfg.ExtraHeaders, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -123,21 +165,24 @@ func Find(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertP
 // errors before being asked for passwords. The second is to return the form
 // of authentication that the server supports. This also leads to better user
 // experience: users only get prompted for the type of authentication the server supports.
-func Ping(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertPool, connectorName string) (*PingResponse, error) {
-	clt := newWebClient(insecure, pool)
+func Ping(cfg *Config) (*PingResponse, error) {
+	clt, err := newWebClient(cfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	defer clt.CloseIdleConnections()
 
-	endpoint := fmt.Sprintf("https://%s/webapi/ping", proxyAddr)
-	if connectorName != "" {
-		endpoint = fmt.Sprintf("%s/%s", endpoint, connectorName)
+	endpoint := fmt.Sprintf("https://%s/webapi/ping", cfg.ProxyAddr)
+	if cfg.ConnectorName != "" {
+		endpoint = fmt.Sprintf("%s/%s", endpoint, cfg.ConnectorName)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	req, err := http.NewRequestWithContext(cfg.Context, http.MethodGet, endpoint, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := doWithFallback(clt, insecure, req)
+	resp, err := doWithFallback(clt, cfg.Insecure, cfg.ExtraHeaders, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -152,32 +197,38 @@ func Ping(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertP
 }
 
 // GetTunnelAddr returns the tunnel address either set in an environment variable or retrieved from the web proxy.
-func GetTunnelAddr(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertPool) (string, error) {
+func GetTunnelAddr(cfg *Config) (string, error) {
+	if err := cfg.CheckAndSetDefaults(); err != nil {
+		return "", trace.Wrap(err)
+	}
 	// If TELEPORT_TUNNEL_PUBLIC_ADDR is set, nothing else has to be done, return it.
 	if tunnelAddr := os.Getenv(defaults.TunnelPublicAddrEnvar); tunnelAddr != "" {
 		return extractHostPort(tunnelAddr)
 	}
 
 	// Ping web proxy to retrieve tunnel proxy address.
-	pr, err := Find(ctx, proxyAddr, insecure, nil)
+	pr, err := Find(cfg)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
-	return tunnelAddr(proxyAddr, pr.Proxy)
+	return tunnelAddr(cfg.ProxyAddr, pr.Proxy)
 }
 
-func GetMOTD(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertPool) (*MotD, error) {
-	clt := newWebClient(insecure, pool)
+func GetMOTD(cfg *Config) (*MotD, error) {
+	clt, err := newWebClient(cfg)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 	defer clt.CloseIdleConnections()
 
-	endpoint := fmt.Sprintf("https://%s/webapi/motd", proxyAddr)
+	endpoint := fmt.Sprintf("https://%s/webapi/motd", cfg.ProxyAddr)
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	req, err := http.NewRequestWithContext(cfg.Context, http.MethodGet, endpoint, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := clt.Do(req)
+	resp, err := doWithFallback(clt, cfg.Insecure, cfg.ExtraHeaders, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index 963b6b5f2156c..b908a9777a718 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -52,14 +52,15 @@ func TestPlainHttpFallback(t *testing.T) {
 			desc:    "Ping",
 			handler: newPingHandler("/webapi/ping"),
 			actionUnderTest: func(addr string, insecure bool) error {
-				_, err := Ping(context.Background(), addr, insecure, nil /*pool*/, "")
+				_, err := Ping(
+					&Config{Context: context.Background(), ProxyAddr: addr, Insecure: insecure})
 				return err
 			},
 		}, {
 			desc:    "Find",
 			handler: newPingHandler("/webapi/find"),
 			actionUnderTest: func(addr string, insecure bool) error {
-				_, err := Find(context.Background(), addr, insecure, nil /*pool*/)
+				_, err := Find(&Config{Context: context.Background(), ProxyAddr: addr, Insecure: insecure})
 				return err
 			},
 		},
@@ -104,7 +105,7 @@ func TestPlainHttpFallback(t *testing.T) {
 
 func TestGetTunnelAddr(t *testing.T) {
 	t.Setenv(defaults.TunnelPublicAddrEnvar, "tunnel.example.com:4024")
-	tunnelAddr, err := GetTunnelAddr(context.Background(), "", true, nil)
+	tunnelAddr, err := GetTunnelAddr(&Config{Context: context.Background(), ProxyAddr: "", Insecure: false})
 	require.NoError(t, err)
 	require.Equal(t, "tunnel.example.com:4024", tunnelAddr)
 }
@@ -292,22 +293,33 @@ func TestExtract(t *testing.T) {
 
 func TestNewWebClientRespectHTTPProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
-	client := newWebClient(false /* insecure */, nil /* pool */)
+	client, err := newWebClient(&Config{
+		Context:   context.Background(),
+		ProxyAddr: "localhost:3080",
+	})
+	require.NoError(t, err)
 	// resp should be nil, so there will be no body to close.
 	//nolint:bodyclose
-	resp, err := client.Get("https://example.com")
+	resp, err := client.Get("https://fakedomain.example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "lookup fakeproxy.example.com")
 	require.Contains(t, err.Error(), "no such host")
 }
 
 func TestNewWebClientNoProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
-	t.Setenv("NO_PROXY", "example.com")
-	client := newWebClient(false /* insecure */, nil /* pool */)
-	resp, err := client.Get("https://example.com")
+	t.Setenv("NO_PROXY", "fakedomain.example.com")
+	client, err := newWebClient(&Config{
+		Context:   context.Background(),
+		ProxyAddr: "localhost:3080",
+	})
 	require.NoError(t, err)
-	defer resp.Body.Close()
-	require.Equal(t, http.StatusOK, resp.StatusCode)
+	//nolint:bodyclose
+	resp, err := client.Get("https://fakedomain.example.com")
+	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
+	require.NotContains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "lookup fakedomain.example.com")
+	require.Contains(t, err.Error(), "no such host")
 }
diff --git a/api/go.mod b/api/go.mod
index 3a7210c771f25..32f30b53bd167 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -3,7 +3,7 @@ module github.com/gravitational/teleport/api
 go 1.15
 
 require (
-	github.com/gogo/protobuf v1.3.1
+	github.com/gogo/protobuf v1.3.2
 	github.com/golang/protobuf v1.4.3
 	github.com/google/go-cmp v0.5.4
 	github.com/gravitational/trace v1.1.17
diff --git a/api/go.sum b/api/go.sum
index 72c1f18217730..e0d13feb2fd5c 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -21,8 +21,8 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
-github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -50,7 +50,7 @@ github.com/gravitational/trace v1.1.17/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jj
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
@@ -68,8 +68,11 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8 h1:kACShD3qhmr/3rLmg1yXyt+N4HcwutKyPRB93s54TIU=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
@@ -77,13 +80,18 @@ golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd h1:O7DYs+zxREGLKzKoMQrtrEacpb0ZVXA5rIwylE2Xchk=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -93,11 +101,14 @@ golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -108,15 +119,20 @@ golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9sn
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/api/identityfile/identityfile.go b/api/identityfile/identityfile.go
index 2f45f8cc6a749..9f19ce811a91d 100644
--- a/api/identityfile/identityfile.go
+++ b/api/identityfile/identityfile.go
@@ -24,7 +24,6 @@ import (
 	"crypto/x509"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"strings"
 
@@ -102,7 +101,7 @@ func Write(idFile *IdentityFile, path string) error {
 	if err := encodeIdentityFile(buf, idFile); err != nil {
 		return trace.Wrap(err)
 	}
-	if err := ioutil.WriteFile(path, buf.Bytes(), FilePermissions); err != nil {
+	if err := os.WriteFile(path, buf.Bytes(), FilePermissions); err != nil {
 		return trace.ConvertSystemError(err)
 	}
 	return nil
@@ -139,7 +138,7 @@ func ReadFile(path string) (*IdentityFile, error) {
 	// separate file with -cert.pub suffix.
 	if len(ident.Certs.SSH) == 0 {
 		certFn := keypaths.IdentitySSHCertPath(path)
-		if ident.Certs.SSH, err = ioutil.ReadFile(certFn); err != nil {
+		if ident.Certs.SSH, err = os.ReadFile(certFn); err != nil {
 			return nil, trace.Wrap(err, "could not find SSH cert in the identity file or %v", certFn)
 		}
 	}
diff --git a/api/profile/profile.go b/api/profile/profile.go
index ba63ce65d6517..7b9b701d63c8b 100644
--- a/api/profile/profile.go
+++ b/api/profile/profile.go
@@ -21,7 +21,6 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"io/fs"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/user"
@@ -118,7 +117,7 @@ func (p *Profile) TLSConfig() (*tls.Config, error) {
 		if info.IsDir() {
 			return nil
 		}
-		cert, err := ioutil.ReadFile(path)
+		cert, err := os.ReadFile(path)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
@@ -139,23 +138,17 @@ func (p *Profile) TLSConfig() (*tls.Config, error) {
 
 // SSHClientConfig returns the profile's associated SSHClientConfig.
 func (p *Profile) SSHClientConfig() (*ssh.ClientConfig, error) {
-	cert, err := ioutil.ReadFile(p.SSHCertPath())
+	cert, err := os.ReadFile(p.SSHCertPath())
 	if err != nil {
-		// Try reading SSHCert from old cert path, return original error otherwise
-		// DELETE IN 8.0.0
-		var err2 error
-		cert, err2 = ioutil.ReadFile(p.OldSSHCertPath())
-		if err2 != nil {
-			return nil, trace.Wrap(err)
-		}
+		return nil, trace.Wrap(err)
 	}
 
-	key, err := ioutil.ReadFile(p.UserKeyPath())
+	key, err := os.ReadFile(p.UserKeyPath())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	caCerts, err := ioutil.ReadFile(p.KnownHostsPath())
+	caCerts, err := os.ReadFile(p.KnownHostsPath())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -174,7 +167,7 @@ func SetCurrentProfileName(dir string, name string) error {
 	}
 
 	path := filepath.Join(dir, currentProfileFilename)
-	if err := ioutil.WriteFile(path, []byte(strings.TrimSpace(name)+"\n"), 0660); err != nil {
+	if err := os.WriteFile(path, []byte(strings.TrimSpace(name)+"\n"), 0660); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -186,7 +179,7 @@ func GetCurrentProfileName(dir string) (name string, err error) {
 		return "", trace.BadParameter("cannot get current profile: missing dir")
 	}
 
-	data, err := ioutil.ReadFile(filepath.Join(dir, currentProfileFilename))
+	data, err := os.ReadFile(filepath.Join(dir, currentProfileFilename))
 	if err != nil {
 		if os.IsNotExist(err) {
 			return "", trace.NotFound("current-profile is not set")
@@ -205,7 +198,7 @@ func ListProfileNames(dir string) ([]string, error) {
 	if dir == "" {
 		return nil, trace.BadParameter("cannot list profiles: missing dir")
 	}
-	files, err := ioutil.ReadDir(dir)
+	files, err := os.ReadDir(dir)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -215,7 +208,8 @@ func ListProfileNames(dir string) ([]string, error) {
 		if file.IsDir() {
 			continue
 		}
-		if file.Mode()&os.ModeSymlink != 0 {
+
+		if file.Type()&os.ModeSymlink != 0 {
 			continue
 		}
 		if !strings.HasSuffix(file.Name(), ".yaml") {
@@ -266,7 +260,7 @@ func FromDir(dir string, name string) (*Profile, error) {
 
 // profileFromFile loads the profile from a YAML file.
 func profileFromFile(filePath string) (*Profile, error) {
-	bytes, err := ioutil.ReadFile(filePath)
+	bytes, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
@@ -306,7 +300,7 @@ func (p *Profile) saveToFile(filepath string) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if err = ioutil.WriteFile(filepath, bytes, 0660); err != nil {
+	if err = os.WriteFile(filepath, bytes, 0660); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -352,12 +346,6 @@ func (p *Profile) SSHCertPath() string {
 	return keypaths.SSHCertPath(p.Dir, p.Name(), p.Username, p.SiteName)
 }
 
-// OldSSHCertPath returns the old (before v6.1) path to the profile's ssh certificate.
-// DELETE IN 8.0.0
-func (p *Profile) OldSSHCertPath() string {
-	return keypaths.OldSSHCertPath(p.Dir, p.Name(), p.Username)
-}
-
 // KnownHostsPath returns the path to the profile's ssh certificate authorities.
 func (p *Profile) KnownHostsPath() string {
 	return keypaths.KnownHostsPath(p.Dir)
diff --git a/api/types/app_test.go b/api/types/app_test.go
index 731edb7ffa1a2..9b5b12d23c806 100644
--- a/api/types/app_test.go
+++ b/api/types/app_test.go
@@ -141,8 +141,6 @@ func TestAppServerSorter(t *testing.T) {
 	for _, c := range cases {
 		c := c
 		t.Run(fmt.Sprintf("%s desc", c.name), func(t *testing.T) {
-			t.Parallel()
-
 			sortBy := SortBy{Field: c.fieldName, IsDesc: true}
 			servers := AppServers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
@@ -152,8 +150,6 @@ func TestAppServerSorter(t *testing.T) {
 		})
 
 		t.Run(fmt.Sprintf("%s asc", c.name), func(t *testing.T) {
-			t.Parallel()
-
 			sortBy := SortBy{Field: c.fieldName}
 			servers := AppServers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
diff --git a/api/types/appserver.go b/api/types/appserver.go
index 10fb2bdea62db..aa5a96b43d2d4 100644
--- a/api/types/appserver.go
+++ b/api/types/appserver.go
@@ -304,7 +304,14 @@ func (s AppServers) Len() int { return len(s) }
 
 // Less compares app servers by name and host ID.
 func (s AppServers) Less(i, j int) bool {
-	return s[i].GetName() < s[j].GetName() && s[i].GetHostID() < s[j].GetHostID()
+	switch {
+	case s[i].GetName() < s[j].GetName():
+		return true
+	case s[i].GetName() > s[j].GetName():
+		return false
+	default:
+		return s[i].GetHostID() < s[j].GetHostID()
+	}
 }
 
 // Swap swaps two app servers.
diff --git a/api/types/constants.go b/api/types/constants.go
index 54f00730c9906..52a4d64210e98 100644
--- a/api/types/constants.go
+++ b/api/types/constants.go
@@ -297,9 +297,13 @@ const (
 )
 
 const (
+	// TeleportNamespace is used as the namespace prefix for any
+	// labels defined by teleport
+	TeleportNamespace = "teleport.dev"
+
 	// OriginLabel is a resource metadata label name used to identify a source
 	// that the resource originates from.
-	OriginLabel = "teleport.dev/origin"
+	OriginLabel = TeleportNamespace + "/origin"
 
 	// OriginConfigFile is an origin value indicating that the resource was
 	// constructed as a default value.
diff --git a/api/types/database.go b/api/types/database.go
index 7e752b0412d40..39b94b4b96a6f 100644
--- a/api/types/database.go
+++ b/api/types/database.go
@@ -563,16 +563,6 @@ func DeduplicateDatabases(databases []Database) (result []Database) {
 // Databases is a list of database resources.
 type Databases []Database
 
-// Find returns database with the specified name or nil.
-func (d Databases) Find(name string) Database {
-	for _, database := range d {
-		if database.GetName() == name {
-			return database
-		}
-	}
-	return nil
-}
-
 // ToMap returns these databases as a map keyed by database name.
 func (d Databases) ToMap() map[string]Database {
 	m := make(map[string]Database)
diff --git a/api/types/databaseserver.go b/api/types/databaseserver.go
index 4a4e6cfb0e6a4..db2637513a3cc 100644
--- a/api/types/databaseserver.go
+++ b/api/types/databaseserver.go
@@ -291,7 +291,14 @@ func (s DatabaseServers) Len() int { return len(s) }
 
 // Less compares database servers by name and host ID.
 func (s DatabaseServers) Less(i, j int) bool {
-	return s[i].GetName() < s[j].GetName() && s[i].GetHostID() < s[j].GetHostID()
+	switch {
+	case s[i].GetName() < s[j].GetName():
+		return true
+	case s[i].GetName() > s[j].GetName():
+		return false
+	default:
+		return s[i].GetHostID() < s[j].GetHostID()
+	}
 }
 
 // Swap swaps two database servers.
diff --git a/api/types/databaseserver_test.go b/api/types/databaseserver_test.go
index babd27ac9a0d7..de45c5c788df8 100644
--- a/api/types/databaseserver_test.go
+++ b/api/types/databaseserver_test.go
@@ -154,8 +154,6 @@ func TestDatabaseServerSorter(t *testing.T) {
 	for _, c := range cases {
 		c := c
 		t.Run(fmt.Sprintf("%s desc", c.name), func(t *testing.T) {
-			t.Parallel()
-
 			sortBy := SortBy{Field: c.fieldName, IsDesc: true}
 			servers := DatabaseServers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
@@ -165,8 +163,6 @@ func TestDatabaseServerSorter(t *testing.T) {
 		})
 
 		t.Run(fmt.Sprintf("%s asc", c.name), func(t *testing.T) {
-			t.Parallel()
-
 			sortBy := SortBy{Field: c.fieldName}
 			servers := DatabaseServers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
diff --git a/api/types/desktop.go b/api/types/desktop.go
index 6d2199711401a..6fdda0b05fa75 100644
--- a/api/types/desktop.go
+++ b/api/types/desktop.go
@@ -17,6 +17,8 @@ limitations under the License.
 package types
 
 import (
+	"sort"
+
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/trace"
 )
@@ -29,6 +31,8 @@ type WindowsDesktopService interface {
 	GetAddr() string
 	// GetVersion returns the teleport binary version of this service.
 	GetTeleportVersion() string
+	// GetHostname returns the hostname of this service
+	GetHostname() string
 }
 
 var _ WindowsDesktopService = &WindowsDesktopServiceV3{}
@@ -95,6 +99,11 @@ func (s *WindowsDesktopServiceV3) GetAllLabels() map[string]string {
 	return s.Metadata.Labels
 }
 
+// GetHostname returns the windows hostname of this service.
+func (s *WindowsDesktopServiceV3) GetHostname() string {
+	return s.Spec.Hostname
+}
+
 // MatchSearch goes through select field values and tries to
 // match against the list of search values.
 func (s *WindowsDesktopServiceV3) MatchSearch(values []string) bool {
@@ -218,3 +227,91 @@ func (f *WindowsDesktopFilter) Match(req WindowsDesktop) bool {
 	}
 	return true
 }
+
+// WindowsDesktops represents a list of windows desktops.
+type WindowsDesktops []WindowsDesktop
+
+// Len returns the slice length.
+func (s WindowsDesktops) Len() int { return len(s) }
+
+// Less compares desktops by name and host ID.
+func (s WindowsDesktops) Less(i, j int) bool {
+	switch {
+	case s[i].GetName() < s[j].GetName():
+		return true
+	case s[i].GetName() > s[j].GetName():
+		return false
+	default:
+		return s[i].GetHostID() < s[j].GetHostID()
+	}
+}
+
+// Swap swaps two windows desktops.
+func (s WindowsDesktops) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
+
+// SortByCustom custom sorts by given sort criteria.
+func (s WindowsDesktops) SortByCustom(sortBy SortBy) error {
+	if sortBy.Field == "" {
+		return nil
+	}
+
+	isDesc := sortBy.IsDesc
+	switch sortBy.Field {
+	case ResourceMetadataName:
+		sort.SliceStable(s, func(i, j int) bool {
+			return stringCompare(s[i].GetName(), s[j].GetName(), isDesc)
+		})
+	case ResourceSpecAddr:
+		sort.SliceStable(s, func(i, j int) bool {
+			return stringCompare(s[i].GetAddr(), s[j].GetAddr(), isDesc)
+		})
+	default:
+		return trace.NotImplemented("sorting by field %q for resource %q is not supported", sortBy.Field, KindWindowsDesktop)
+	}
+
+	return nil
+}
+
+// AsResources returns windows desktops as type resources with labels.
+func (s WindowsDesktops) AsResources() []ResourceWithLabels {
+	resources := make([]ResourceWithLabels, 0, len(s))
+	for _, server := range s {
+		resources = append(resources, ResourceWithLabels(server))
+	}
+	return resources
+}
+
+// GetFieldVals returns list of select field values.
+func (s WindowsDesktops) GetFieldVals(field string) ([]string, error) {
+	vals := make([]string, 0, len(s))
+	switch field {
+	case ResourceMetadataName:
+		for _, server := range s {
+			vals = append(vals, server.GetName())
+		}
+	case ResourceSpecAddr:
+		for _, server := range s {
+			vals = append(vals, server.GetAddr())
+		}
+	default:
+		return nil, trace.NotImplemented("getting field %q for resource %q is not supported", field, KindWindowsDesktop)
+	}
+
+	return vals, nil
+}
+
+// ListWindowsDesktopsResponse is a response type to ListWindowsDesktops.
+type ListWindowsDesktopsResponse struct {
+	Desktops []WindowsDesktop
+	NextKey  string
+}
+
+// ListWindowsDesktopsRequest is a request type to ListWindowsDesktops.
+type ListWindowsDesktopsRequest struct {
+	WindowsDesktopFilter
+	Limit                         int
+	StartKey, PredicateExpression string
+	Labels                        map[string]string
+	SearchKeywords                []string
+	SortBy                        SortBy
+}
diff --git a/api/types/desktop_test.go b/api/types/desktop_test.go
new file mode 100644
index 0000000000000..f17c480bd0685
--- /dev/null
+++ b/api/types/desktop_test.go
@@ -0,0 +1,88 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWindowsDesktopsSorter(t *testing.T) {
+	t.Parallel()
+
+	testValsUnordered := []string{"d", "b", "a", "c"}
+
+	makeDesktops := func(testVals []string, testField string) []WindowsDesktop {
+		desktops := make([]WindowsDesktop, len(testVals))
+		for i := 0; i < len(testVals); i++ {
+			testVal := testVals[i]
+			var err error
+			desktops[i], err = NewWindowsDesktopV3(
+				getTestVal(testField == ResourceMetadataName, testVal),
+				nil,
+				WindowsDesktopSpecV3{
+					Addr: getTestVal(testField == ResourceSpecAddr, testVal),
+				})
+
+			require.NoError(t, err)
+		}
+		return desktops
+	}
+
+	cases := []struct {
+		name      string
+		fieldName string
+	}{
+		{
+			name:      "by name",
+			fieldName: ResourceMetadataName,
+		},
+		{
+			name:      "by addr",
+			fieldName: ResourceSpecAddr,
+		},
+	}
+
+	for _, c := range cases {
+		c := c
+		t.Run(fmt.Sprintf("%s desc", c.name), func(t *testing.T) {
+			sortBy := SortBy{Field: c.fieldName, IsDesc: true}
+			servers := WindowsDesktops(makeDesktops(testValsUnordered, c.fieldName))
+			require.NoError(t, servers.SortByCustom(sortBy))
+			targetVals, err := servers.GetFieldVals(c.fieldName)
+			require.NoError(t, err)
+			require.IsDecreasing(t, targetVals)
+		})
+
+		t.Run(fmt.Sprintf("%s asc", c.name), func(t *testing.T) {
+			sortBy := SortBy{Field: c.fieldName}
+			servers := WindowsDesktops(makeDesktops(testValsUnordered, c.fieldName))
+			require.NoError(t, servers.SortByCustom(sortBy))
+			targetVals, err := servers.GetFieldVals(c.fieldName)
+			require.NoError(t, err)
+			require.IsIncreasing(t, targetVals)
+		})
+	}
+
+	// Test error.
+	sortBy := SortBy{Field: "unsupported"}
+	desktops := makeDesktops(testValsUnordered, "does-not-matter")
+	require.True(t, trace.IsNotImplemented(WindowsDesktops(desktops).SortByCustom(sortBy)))
+}
diff --git a/api/types/events/events.pb.go b/api/types/events/events.pb.go
index 423a29e72972f..64cd82b30c814 100644
--- a/api/types/events/events.pb.go
+++ b/api/types/events/events.pb.go
@@ -3673,10 +3673,12 @@ type WindowsDesktopSessionStart struct {
 	// WindowsUser is the Windows username used to connect.
 	WindowsUser string `protobuf:"bytes,9,opt,name=WindowsUser,proto3" json:"windows_user"`
 	// DesktopLabels are the labels on the desktop resource.
-	DesktopLabels        map[string]string `protobuf:"bytes,10,rep,name=DesktopLabels,proto3" json:"desktop_labels" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
-	XXX_unrecognized     []byte            `json:"-"`
-	XXX_sizecache        int32             `json:"-"`
+	DesktopLabels map[string]string `protobuf:"bytes,10,rep,name=DesktopLabels,proto3" json:"desktop_labels" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// DesktopName is the name of the desktop resource.
+	DesktopName          string   `protobuf:"bytes,11,opt,name=DesktopName,proto3" json:"desktop_name"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *WindowsDesktopSessionStart) Reset()         { *m = WindowsDesktopSessionStart{} }
@@ -4376,6 +4378,54 @@ func (m *RenewableCertificateGenerationMismatch) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_RenewableCertificateGenerationMismatch proto.InternalMessageInfo
 
+// Unknown is a fallback event used when we don't recognize an event from the backend.
+type Unknown struct {
+	// Metadata is a common event metadata.
+	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
+	// UnknownType is the event type extracted from the unknown event.
+	UnknownType string `protobuf:"bytes,2,opt,name=UnknownType,proto3" json:"unknown_event"`
+	// UnknownCode is the event code extracted from the unknown event.
+	UnknownCode string `protobuf:"bytes,3,opt,name=UnknownCode,proto3" json:"unknown_code,omitempty"`
+	// Data is the serialized JSON data of the unknown event.
+	Data                 string   `protobuf:"bytes,4,opt,name=Data,proto3" json:"data"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Unknown) Reset()         { *m = Unknown{} }
+func (m *Unknown) String() string { return proto.CompactTextString(m) }
+func (*Unknown) ProtoMessage()    {}
+func (*Unknown) Descriptor() ([]byte, []int) {
+	return fileDescriptor_8f22242cb04491f9, []int{85}
+}
+func (m *Unknown) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *Unknown) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_Unknown.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *Unknown) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Unknown.Merge(m, src)
+}
+func (m *Unknown) XXX_Size() int {
+	return m.Size()
+}
+func (m *Unknown) XXX_DiscardUnknown() {
+	xxx_messageInfo_Unknown.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Unknown proto.InternalMessageInfo
+
 // OneOf is a union of one of audit events submitted to the auth service
 type OneOf struct {
 	// Event is one of the audit events
@@ -4460,6 +4510,7 @@ type OneOf struct {
 	//	*OneOf_MySQLStatementFetch
 	//	*OneOf_MySQLStatementBulkExecute
 	//	*OneOf_RenewableCertificateGenerationMismatch
+	//	*OneOf_Unknown
 	Event                isOneOf_Event `protobuf_oneof:"Event"`
 	XXX_NoUnkeyedLiteral struct{}      `json:"-"`
 	XXX_unrecognized     []byte        `json:"-"`
@@ -4470,7 +4521,7 @@ func (m *OneOf) Reset()         { *m = OneOf{} }
 func (m *OneOf) String() string { return proto.CompactTextString(m) }
 func (*OneOf) ProtoMessage()    {}
 func (*OneOf) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{85}
+	return fileDescriptor_8f22242cb04491f9, []int{86}
 }
 func (m *OneOf) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4742,6 +4793,9 @@ type OneOf_MySQLStatementBulkExecute struct {
 type OneOf_RenewableCertificateGenerationMismatch struct {
 	RenewableCertificateGenerationMismatch *RenewableCertificateGenerationMismatch `protobuf:"bytes,79,opt,name=RenewableCertificateGenerationMismatch,proto3,oneof" json:"RenewableCertificateGenerationMismatch,omitempty"`
 }
+type OneOf_Unknown struct {
+	Unknown *Unknown `protobuf:"bytes,80,opt,name=Unknown,proto3,oneof" json:"Unknown,omitempty"`
+}
 
 func (*OneOf_UserLogin) isOneOf_Event()                              {}
 func (*OneOf_UserCreate) isOneOf_Event()                             {}
@@ -4822,6 +4876,7 @@ func (*OneOf_MySQLStatementReset) isOneOf_Event()                    {}
 func (*OneOf_MySQLStatementFetch) isOneOf_Event()                    {}
 func (*OneOf_MySQLStatementBulkExecute) isOneOf_Event()              {}
 func (*OneOf_RenewableCertificateGenerationMismatch) isOneOf_Event() {}
+func (*OneOf_Unknown) isOneOf_Event()                                {}
 
 func (m *OneOf) GetEvent() isOneOf_Event {
 	if m != nil {
@@ -5383,6 +5438,13 @@ func (m *OneOf) GetRenewableCertificateGenerationMismatch() *RenewableCertificat
 	return nil
 }
 
+func (m *OneOf) GetUnknown() *Unknown {
+	if x, ok := m.GetEvent().(*OneOf_Unknown); ok {
+		return x.Unknown
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*OneOf) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -5465,6 +5527,7 @@ func (*OneOf) XXX_OneofWrappers() []interface{} {
 		(*OneOf_MySQLStatementFetch)(nil),
 		(*OneOf_MySQLStatementBulkExecute)(nil),
 		(*OneOf_RenewableCertificateGenerationMismatch)(nil),
+		(*OneOf_Unknown)(nil),
 	}
 }
 
@@ -5485,7 +5548,7 @@ func (m *StreamStatus) Reset()         { *m = StreamStatus{} }
 func (m *StreamStatus) String() string { return proto.CompactTextString(m) }
 func (*StreamStatus) ProtoMessage()    {}
 func (*StreamStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{86}
+	return fileDescriptor_8f22242cb04491f9, []int{87}
 }
 func (m *StreamStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5533,7 +5596,7 @@ func (m *SessionUpload) Reset()         { *m = SessionUpload{} }
 func (m *SessionUpload) String() string { return proto.CompactTextString(m) }
 func (*SessionUpload) ProtoMessage()    {}
 func (*SessionUpload) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{87}
+	return fileDescriptor_8f22242cb04491f9, []int{88}
 }
 func (m *SessionUpload) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5628,7 +5691,7 @@ func (m *Identity) Reset()         { *m = Identity{} }
 func (m *Identity) String() string { return proto.CompactTextString(m) }
 func (*Identity) ProtoMessage()    {}
 func (*Identity) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{88}
+	return fileDescriptor_8f22242cb04491f9, []int{89}
 }
 func (m *Identity) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5678,7 +5741,7 @@ func (m *RouteToApp) Reset()         { *m = RouteToApp{} }
 func (m *RouteToApp) String() string { return proto.CompactTextString(m) }
 func (*RouteToApp) ProtoMessage()    {}
 func (*RouteToApp) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{89}
+	return fileDescriptor_8f22242cb04491f9, []int{90}
 }
 func (m *RouteToApp) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5726,7 +5789,7 @@ func (m *RouteToDatabase) Reset()         { *m = RouteToDatabase{} }
 func (m *RouteToDatabase) String() string { return proto.CompactTextString(m) }
 func (*RouteToDatabase) ProtoMessage()    {}
 func (*RouteToDatabase) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{90}
+	return fileDescriptor_8f22242cb04491f9, []int{91}
 }
 func (m *RouteToDatabase) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5777,7 +5840,7 @@ func (m *MySQLStatementPrepare) Reset()         { *m = MySQLStatementPrepare{} }
 func (m *MySQLStatementPrepare) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementPrepare) ProtoMessage()    {}
 func (*MySQLStatementPrepare) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{91}
+	return fileDescriptor_8f22242cb04491f9, []int{92}
 }
 func (m *MySQLStatementPrepare) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5830,7 +5893,7 @@ func (m *MySQLStatementExecute) Reset()         { *m = MySQLStatementExecute{} }
 func (m *MySQLStatementExecute) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementExecute) ProtoMessage()    {}
 func (*MySQLStatementExecute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{92}
+	return fileDescriptor_8f22242cb04491f9, []int{93}
 }
 func (m *MySQLStatementExecute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5885,7 +5948,7 @@ func (m *MySQLStatementSendLongData) Reset()         { *m = MySQLStatementSendLo
 func (m *MySQLStatementSendLongData) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementSendLongData) ProtoMessage()    {}
 func (*MySQLStatementSendLongData) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{93}
+	return fileDescriptor_8f22242cb04491f9, []int{94}
 }
 func (m *MySQLStatementSendLongData) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5936,7 +5999,7 @@ func (m *MySQLStatementClose) Reset()         { *m = MySQLStatementClose{} }
 func (m *MySQLStatementClose) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementClose) ProtoMessage()    {}
 func (*MySQLStatementClose) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{94}
+	return fileDescriptor_8f22242cb04491f9, []int{95}
 }
 func (m *MySQLStatementClose) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5987,7 +6050,7 @@ func (m *MySQLStatementReset) Reset()         { *m = MySQLStatementReset{} }
 func (m *MySQLStatementReset) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementReset) ProtoMessage()    {}
 func (*MySQLStatementReset) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{95}
+	return fileDescriptor_8f22242cb04491f9, []int{96}
 }
 func (m *MySQLStatementReset) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6040,7 +6103,7 @@ func (m *MySQLStatementFetch) Reset()         { *m = MySQLStatementFetch{} }
 func (m *MySQLStatementFetch) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementFetch) ProtoMessage()    {}
 func (*MySQLStatementFetch) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{96}
+	return fileDescriptor_8f22242cb04491f9, []int{97}
 }
 func (m *MySQLStatementFetch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6093,7 +6156,7 @@ func (m *MySQLStatementBulkExecute) Reset()         { *m = MySQLStatementBulkExe
 func (m *MySQLStatementBulkExecute) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementBulkExecute) ProtoMessage()    {}
 func (*MySQLStatementBulkExecute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{97}
+	return fileDescriptor_8f22242cb04491f9, []int{98}
 }
 func (m *MySQLStatementBulkExecute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6215,6 +6278,7 @@ func init() {
 	proto.RegisterMapType((map[string]string)(nil), "events.WindowsDesktopSessionEnd.DesktopLabelsEntry")
 	proto.RegisterType((*CertificateCreate)(nil), "events.CertificateCreate")
 	proto.RegisterType((*RenewableCertificateGenerationMismatch)(nil), "events.RenewableCertificateGenerationMismatch")
+	proto.RegisterType((*Unknown)(nil), "events.Unknown")
 	proto.RegisterType((*OneOf)(nil), "events.OneOf")
 	proto.RegisterType((*StreamStatus)(nil), "events.StreamStatus")
 	proto.RegisterType((*SessionUpload)(nil), "events.SessionUpload")
@@ -6233,438 +6297,444 @@ func init() {
 func init() { proto.RegisterFile("events.proto", fileDescriptor_8f22242cb04491f9) }
 
 var fileDescriptor_8f22242cb04491f9 = []byte{
-	// 6886 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0x7d, 0x5f, 0x6c, 0x24, 0xc9,
-	0x59, 0xb8, 0x67, 0xc6, 0xf3, 0xc7, 0x35, 0xf6, 0xda, 0xae, 0xf5, 0xee, 0xf6, 0xed, 0xed, 0xdd,
-	0xdc, 0xf5, 0x25, 0x7b, 0xbb, 0xb9, 0x3d, 0x3b, 0xbb, 0xb7, 0x77, 0x9b, 0x5c, 0xee, 0x72, 0x3b,
-	0x1e, 0xdb, 0xe7, 0xc9, 0x79, 0x6d, 0x5f, 0xd9, 0x7b, 0x17, 0x29, 0xca, 0x8d, 0xda, 0xd3, 0xb5,
-	0x76, 0x67, 0x67, 0xa6, 0x3b, 0xdd, 0x3d, 0xf6, 0xfa, 0x9e, 0x7e, 0x3f, 0x40, 0x10, 0x45, 0x01,
-	0xa1, 0xf0, 0xc0, 0x03, 0x0f, 0xa0, 0x00, 0x12, 0x48, 0x11, 0x01, 0x84, 0x22, 0x24, 0x78, 0x81,
-	0x00, 0xba, 0x08, 0x25, 0x04, 0x82, 0x40, 0xe2, 0x61, 0x02, 0x41, 0xbc, 0x0c, 0x41, 0x8a, 0x04,
-	0x12, 0x81, 0x27, 0x54, 0x5f, 0x55, 0x77, 0x57, 0x75, 0xf7, 0x78, 0xd7, 0x6b, 0x1f, 0xc6, 0xbb,
-	0x7e, 0xb2, 0xe7, 0xfb, 0x57, 0xdd, 0x5f, 0xfd, 0xfb, 0xea, 0xab, 0xef, 0xfb, 0x1a, 0x8d, 0xd2,
-	0x6d, 0xda, 0xf1, 0xbd, 0x69, 0xc7, 0xb5, 0x7d, 0x1b, 0x17, 0xf8, 0xaf, 0xf3, 0x53, 0x9b, 0xf6,
-	0xa6, 0x0d, 0xa0, 0x19, 0xf6, 0x1f, 0xc7, 0x9e, 0xaf, 0x6c, 0xda, 0xf6, 0x66, 0x8b, 0xce, 0xc0,
-	0xaf, 0x8d, 0xee, 0x9d, 0x19, 0xdf, 0x6a, 0x53, 0xcf, 0x37, 0xda, 0x8e, 0x20, 0xb8, 0x10, 0x27,
-	0xf0, 0x7c, 0xb7, 0xdb, 0xf4, 0x05, 0xb6, 0xb6, 0x69, 0xf9, 0x5b, 0xdd, 0x8d, 0xe9, 0xa6, 0xdd,
-	0x9e, 0xd9, 0x74, 0x8d, 0x6d, 0xcb, 0x37, 0x7c, 0xcb, 0xee, 0x18, 0xad, 0x19, 0x9f, 0xb6, 0xa8,
-	0x63, 0xbb, 0xfe, 0x8c, 0xe1, 0x58, 0x33, 0xfe, 0xae, 0x43, 0xbd, 0x99, 0x1d, 0xd7, 0x70, 0x1c,
-	0xea, 0x46, 0xff, 0x70, 0x21, 0xfa, 0x57, 0xb3, 0xa8, 0x74, 0x8b, 0xfa, 0x86, 0x69, 0xf8, 0x06,
-	0xbe, 0x80, 0xf2, 0xf5, 0x8e, 0x49, 0xef, 0x69, 0x99, 0x67, 0x32, 0x97, 0x72, 0xb3, 0x85, 0x7e,
-	0xaf, 0x92, 0xa5, 0x16, 0xe1, 0x40, 0xfc, 0x14, 0x1a, 0x5e, 0xdf, 0x75, 0xa8, 0x96, 0x7d, 0x26,
-	0x73, 0x69, 0x64, 0x76, 0xa4, 0xdf, 0xab, 0xe4, 0xe1, 0xf5, 0x08, 0x80, 0xf1, 0xb3, 0x28, 0x5b,
-	0x9f, 0xd3, 0x72, 0x80, 0x9c, 0xec, 0xf7, 0x2a, 0x63, 0x5d, 0xcb, 0xbc, 0x62, 0xb7, 0x2d, 0x9f,
-	0xb6, 0x1d, 0x7f, 0x97, 0x64, 0xeb, 0x73, 0xf8, 0x22, 0x1a, 0xae, 0xd9, 0x26, 0xd5, 0x86, 0x81,
-	0x08, 0xf7, 0x7b, 0x95, 0x53, 0x4d, 0xdb, 0xa4, 0x12, 0x15, 0xe0, 0xf1, 0x4d, 0x34, 0xbc, 0x6e,
-	0xb5, 0xa9, 0x96, 0x7f, 0x26, 0x73, 0xa9, 0x7c, 0xed, 0xfc, 0x34, 0x57, 0xc3, 0x74, 0xa0, 0x86,
-	0xe9, 0xf5, 0x40, 0x4f, 0xb3, 0x13, 0x1f, 0xf4, 0x2a, 0x43, 0xfd, 0x5e, 0x65, 0x98, 0xa9, 0xee,
-	0x17, 0x7f, 0x50, 0xc9, 0x10, 0xe0, 0xc4, 0xaf, 0xa1, 0x72, 0xad, 0xd5, 0xf5, 0x7c, 0xea, 0x2e,
-	0x1b, 0x6d, 0xaa, 0x15, 0xa0, 0xc1, 0xf3, 0xfd, 0x5e, 0xe5, 0x6c, 0x93, 0x83, 0x1b, 0x1d, 0xa3,
-	0x2d, 0x37, 0x2c, 0x93, 0xeb, 0x5f, 0x40, 0xe3, 0x6b, 0xd4, 0xf3, 0x2c, 0xbb, 0x13, 0xaa, 0xe6,
-	0xa3, 0x68, 0x44, 0x80, 0xea, 0x73, 0xa0, 0x9e, 0x91, 0xd9, 0x62, 0xbf, 0x57, 0xc9, 0x79, 0x96,
-	0x49, 0x22, 0x0c, 0xfe, 0x38, 0x2a, 0xbe, 0x6b, 0xf9, 0x5b, 0xb7, 0x16, 0xaa, 0x42, 0x4d, 0x67,
-	0xfb, 0xbd, 0x0a, 0xde, 0xb1, 0xfc, 0xad, 0x46, 0xfb, 0x8e, 0x21, 0xb5, 0x17, 0x90, 0xe9, 0xbf,
-	0x91, 0x45, 0xa3, 0xb7, 0x3d, 0xea, 0x86, 0x2d, 0x5d, 0x44, 0xc3, 0xec, 0xb7, 0x68, 0x04, 0x94,
-	0xd4, 0xf5, 0xa8, 0x2b, 0x2b, 0x89, 0xe1, 0xf1, 0x65, 0x94, 0x5f, 0xb2, 0x37, 0xad, 0x8e, 0x68,
-	0xe8, 0x74, 0xbf, 0x57, 0x19, 0x6f, 0x31, 0x80, 0x44, 0xc9, 0x29, 0xf0, 0xa7, 0xd1, 0x68, 0xbd,
-	0xcd, 0x3a, 0xdd, 0xee, 0x18, 0xbe, 0xed, 0x8a, 0x4e, 0x02, 0x75, 0x58, 0x12, 0x5c, 0x62, 0x54,
-	0xe8, 0xf1, 0xab, 0x08, 0x55, 0xdf, 0x5d, 0x23, 0x76, 0x8b, 0x56, 0xc9, 0xb2, 0xe8, 0x3d, 0xe0,
-	0x36, 0x76, 0xbc, 0x86, 0x6b, 0xb7, 0x68, 0xc3, 0x70, 0xe5, 0x66, 0x25, 0x6a, 0x3c, 0x8f, 0x4e,
-	0x55, 0x9b, 0x4d, 0xea, 0x79, 0x84, 0x7e, 0xb1, 0x4b, 0x3d, 0xdf, 0xd3, 0xf2, 0xcf, 0xe4, 0x2e,
-	0x8d, 0xcc, 0x3e, 0xd5, 0xef, 0x55, 0x9e, 0x30, 0x00, 0xd3, 0x70, 0x05, 0x4a, 0x12, 0x11, 0x63,
-	0xd2, 0x7f, 0x37, 0x87, 0x4e, 0xad, 0x51, 0x77, 0x5b, 0x52, 0x54, 0x95, 0xf5, 0x12, 0x83, 0xb0,
-	0x3e, 0xf3, 0x1c, 0xa3, 0x49, 0x85, 0xce, 0xce, 0xf5, 0x7b, 0x95, 0xd3, 0x9d, 0x00, 0x28, 0x09,
-	0x8d, 0xd3, 0xe3, 0xcb, 0xa8, 0xc4, 0x41, 0xf5, 0x39, 0xa1, 0xc6, 0xb1, 0x7e, 0xaf, 0x32, 0xe2,
-	0x01, 0xac, 0x61, 0x99, 0x24, 0x44, 0xb3, 0xf7, 0xe0, 0xff, 0x2f, 0xda, 0x9e, 0xcf, 0x84, 0x0b,
-	0x2d, 0xc2, 0x7b, 0x08, 0x86, 0x2d, 0x81, 0x92, 0xdf, 0x43, 0x65, 0xc2, 0x9f, 0x44, 0x88, 0x43,
-	0xaa, 0xa6, 0xe9, 0x0a, 0x55, 0x3e, 0xd1, 0xef, 0x55, 0xce, 0x08, 0x11, 0x86, 0x69, 0xca, 0xfd,
-	0x20, 0x11, 0xe3, 0x36, 0x1a, 0xe5, 0xbf, 0x96, 0x8c, 0x0d, 0xda, 0xe2, 0x7a, 0x2c, 0x5f, 0xbb,
-	0x34, 0x2d, 0x56, 0x1c, 0x55, 0x3b, 0xd3, 0x32, 0xe9, 0x7c, 0xc7, 0x77, 0x77, 0x67, 0x2b, 0x62,
-	0xae, 0x9c, 0x13, 0x4d, 0xb5, 0x00, 0x27, 0x77, 0xba, 0xcc, 0x73, 0xfe, 0x0d, 0x34, 0x99, 0x90,
-	0x81, 0x27, 0x50, 0xee, 0x2e, 0xdd, 0xe5, 0x7a, 0x26, 0xec, 0x5f, 0x3c, 0x85, 0xf2, 0xdb, 0x46,
-	0xab, 0x2b, 0x96, 0x05, 0xc2, 0x7f, 0xbc, 0x9a, 0xfd, 0x44, 0x46, 0xff, 0xc3, 0x0c, 0xc2, 0x35,
-	0xbb, 0xd3, 0xa1, 0x4d, 0x5f, 0x9e, 0x49, 0xaf, 0xa0, 0x91, 0x25, 0xbb, 0x69, 0xb4, 0x40, 0x01,
-	0xbc, 0xc3, 0xb4, 0x7e, 0xaf, 0x32, 0xc5, 0xde, 0x7c, 0xba, 0xc5, 0x30, 0xd2, 0x23, 0x45, 0xa4,
-	0x4c, 0x73, 0x84, 0xb6, 0x6d, 0x9f, 0x02, 0x63, 0x36, 0xd2, 0x1c, 0x30, 0xba, 0x80, 0x92, 0x35,
-	0x17, 0x11, 0xe3, 0x19, 0x54, 0x5a, 0x65, 0x6b, 0x47, 0xd3, 0x6e, 0x89, 0x5e, 0x83, 0xd9, 0x02,
-	0xeb, 0x89, 0xc4, 0x12, 0x12, 0xe9, 0x3f, 0x95, 0x45, 0x4f, 0xbc, 0xd5, 0xdd, 0xa0, 0x6e, 0x87,
-	0xfa, 0xd4, 0x13, 0x4b, 0x43, 0xf8, 0x06, 0xcb, 0x68, 0x32, 0x81, 0x14, 0x6f, 0xf2, 0x4c, 0xbf,
-	0x57, 0xb9, 0x70, 0x37, 0x44, 0x36, 0xc4, 0x6a, 0x23, 0x35, 0x92, 0x64, 0xc5, 0x8b, 0x68, 0x3c,
-	0x02, 0xb2, 0xb9, 0xed, 0x69, 0x59, 0x98, 0x23, 0x4f, 0xf7, 0x7b, 0x95, 0xf3, 0x92, 0x34, 0xb6,
-	0x0e, 0xc8, 0x1d, 0x16, 0x67, 0xc3, 0x6f, 0xa1, 0x89, 0x08, 0xf4, 0xa6, 0x6b, 0x77, 0x1d, 0x4f,
-	0xcb, 0x81, 0xa8, 0x4a, 0xbf, 0x57, 0x79, 0x52, 0x12, 0xb5, 0x09, 0x48, 0x49, 0x56, 0x82, 0x51,
-	0xff, 0x97, 0x1c, 0x3a, 0x13, 0x01, 0x57, 0x6d, 0x33, 0x54, 0xc0, 0x8a, 0xac, 0x80, 0x55, 0xdb,
-	0x84, 0x35, 0x96, 0x2b, 0xe0, 0xd9, 0x7e, 0xaf, 0xf2, 0x94, 0xd4, 0x8e, 0x63, 0x9b, 0xf1, 0xa5,
-	0x36, 0xc9, 0x8b, 0xdf, 0x43, 0x67, 0x13, 0x40, 0x3e, 0xa3, 0x79, 0x3f, 0x5f, 0xec, 0xf7, 0x2a,
-	0x7a, 0x8a, 0xd4, 0xf8, 0x04, 0x1f, 0x20, 0x05, 0x1b, 0xe8, 0x9c, 0xa4, 0x76, 0xbb, 0xe3, 0x1b,
-	0x56, 0x47, 0x6c, 0x0d, 0x7c, 0x3c, 0x3c, 0xdf, 0xef, 0x55, 0x9e, 0x93, 0xfb, 0x2d, 0xa0, 0x89,
-	0x3f, 0xfc, 0x20, 0x39, 0xd8, 0x44, 0x5a, 0x0a, 0xaa, 0xde, 0x36, 0x36, 0x83, 0xfd, 0xee, 0x52,
-	0xbf, 0x57, 0xf9, 0x48, 0x6a, 0x1b, 0x16, 0xa3, 0x92, 0x1a, 0x19, 0x28, 0x09, 0x13, 0x84, 0x23,
-	0xdc, 0xb2, 0x6d, 0x52, 0x78, 0x87, 0x3c, 0xc8, 0xd7, 0xfb, 0xbd, 0xca, 0xd3, 0x92, 0xfc, 0x8e,
-	0x6d, 0xd2, 0xf8, 0xe3, 0xa7, 0x70, 0xeb, 0x3f, 0xc8, 0xb3, 0x85, 0x05, 0x76, 0xb0, 0x35, 0xdf,
-	0x70, 0x7d, 0xfc, 0x6a, 0x64, 0x12, 0x40, 0xaf, 0x96, 0xaf, 0x4d, 0x04, 0x8b, 0x4c, 0x00, 0x9f,
-	0x1d, 0x65, 0x8b, 0xc9, 0xf7, 0x7a, 0x95, 0x4c, 0xbf, 0x57, 0x19, 0x22, 0x25, 0x69, 0x76, 0xf3,
-	0xdd, 0x2b, 0x0b, 0x7c, 0x53, 0x01, 0x9f, 0xbc, 0xc3, 0xc5, 0x78, 0xf9, 0x6e, 0xf6, 0x06, 0x2a,
-	0x8a, 0x67, 0x80, 0x1e, 0x29, 0x5f, 0x3b, 0x17, 0xad, 0x6b, 0xca, 0x4e, 0x1c, 0xe3, 0x0e, 0xb8,
-	0xf0, 0x6b, 0xa8, 0xc0, 0x97, 0x2b, 0xd0, 0x76, 0xf9, 0xda, 0xd9, 0xf4, 0x75, 0x31, 0xc6, 0x2e,
-	0x78, 0xf0, 0x22, 0x42, 0xd1, 0x52, 0x15, 0xda, 0x1d, 0x42, 0x42, 0x72, 0x11, 0x8b, 0x49, 0x91,
-	0x78, 0xf1, 0x2b, 0x68, 0x74, 0x9d, 0xba, 0x6d, 0xab, 0x63, 0xb4, 0xd6, 0xac, 0xf7, 0x03, 0xd3,
-	0x03, 0xb6, 0x71, 0xcf, 0x7a, 0x5f, 0xee, 0x0b, 0x85, 0x0e, 0x7f, 0x3e, 0x6d, 0x51, 0x29, 0xc2,
-	0x83, 0x3c, 0x1b, 0x3c, 0xc8, 0xc0, 0x25, 0x29, 0xf6, 0x3c, 0x29, 0x6b, 0xcc, 0xdb, 0x68, 0x4c,
-	0x99, 0x1b, 0x5a, 0x09, 0x44, 0x3f, 0x95, 0x14, 0x2d, 0x4d, 0xf4, 0x98, 0x58, 0x55, 0x02, 0xdb,
-	0x11, 0xeb, 0x1d, 0xcb, 0xb7, 0x8c, 0x56, 0xcd, 0x6e, 0xb7, 0x8d, 0x8e, 0xa9, 0x8d, 0x44, 0x3b,
-	0xbb, 0xc5, 0x31, 0x8d, 0x26, 0x47, 0xc9, 0x3b, 0xa2, 0xca, 0xc4, 0xd6, 0x2c, 0xd1, 0x87, 0x84,
-	0x36, 0x6d, 0xd7, 0xb4, 0x3a, 0x9b, 0x1a, 0x02, 0xa5, 0xc1, 0x9a, 0xe5, 0x71, 0x5c, 0xc3, 0x0d,
-	0x90, 0xf2, 0x9a, 0x15, 0x67, 0xfc, 0xcc, 0x70, 0xa9, 0x3c, 0x31, 0x9a, 0x30, 0x1e, 0x7e, 0x3b,
-	0x87, 0xca, 0x82, 0xf4, 0x33, 0xb6, 0xd5, 0x39, 0x19, 0xe0, 0x07, 0x19, 0xe0, 0xa9, 0x03, 0xb5,
-	0x70, 0x58, 0x03, 0x55, 0xff, 0x4a, 0x36, 0x5c, 0x8d, 0x56, 0x5d, 0xab, 0x73, 0xb0, 0xd5, 0xe8,
-	0x22, 0x42, 0xb5, 0xad, 0x6e, 0xe7, 0x2e, 0x3f, 0xd5, 0x64, 0xa3, 0x53, 0x4d, 0xd3, 0x22, 0x12,
-	0x86, 0x1d, 0x6d, 0xe6, 0x98, 0x7c, 0xd6, 0x33, 0xa3, 0xb3, 0x23, 0x1f, 0x70, 0x49, 0x99, 0x17,
-	0x09, 0x80, 0x71, 0x05, 0xe5, 0x67, 0x77, 0x7d, 0xea, 0x81, 0xe6, 0x73, 0xfc, 0xe8, 0xb3, 0xc1,
-	0x00, 0x84, 0xc3, 0xf1, 0x75, 0x34, 0x39, 0x47, 0x5b, 0xc6, 0xee, 0x2d, 0xab, 0xd5, 0xb2, 0x3c,
-	0xda, 0xb4, 0x3b, 0xa6, 0x07, 0x4a, 0x16, 0xcd, 0xb5, 0x3d, 0x92, 0x24, 0xc0, 0x3a, 0x2a, 0xac,
-	0xdc, 0xb9, 0xe3, 0x51, 0x1f, 0xd4, 0x97, 0x9b, 0x45, 0xfd, 0x5e, 0xa5, 0x60, 0x03, 0x84, 0x08,
-	0x8c, 0xfe, 0x8d, 0x0c, 0x9a, 0x98, 0xa3, 0xde, 0x5d, 0xdf, 0x76, 0xc2, 0x51, 0x7e, 0x20, 0x95,
-	0x5c, 0x46, 0xc5, 0x5b, 0xd4, 0xf3, 0xd8, 0xb6, 0x94, 0x85, 0xb7, 0x1d, 0x17, 0x6f, 0x5b, 0x6c,
-	0x73, 0x30, 0x09, 0xf0, 0xe9, 0x6f, 0x95, 0xbb, 0xcf, 0x5b, 0xe9, 0x3f, 0xce, 0xa2, 0x73, 0xe2,
-	0x89, 0x6b, 0x2d, 0xcb, 0xd9, 0xb0, 0x0d, 0xd7, 0x24, 0xb4, 0x49, 0xad, 0x6d, 0x7a, 0x3c, 0x27,
-	0x9e, 0x3a, 0x75, 0x86, 0x0f, 0x30, 0x75, 0xae, 0xa1, 0xb2, 0xd0, 0x0c, 0xd8, 0xb0, 0x7c, 0xdb,
-	0x9e, 0xe8, 0xf7, 0x2a, 0xa3, 0x26, 0x07, 0x83, 0xf9, 0x4f, 0x64, 0x22, 0x36, 0x48, 0x96, 0x68,
-	0x67, 0xd3, 0xdf, 0x82, 0x41, 0x92, 0xe7, 0x83, 0xa4, 0x05, 0x10, 0x22, 0x30, 0xfa, 0xbf, 0x65,
-	0xd1, 0x54, 0x5c, 0xe5, 0x6b, 0xb4, 0x63, 0x9e, 0xe8, 0xfb, 0xc3, 0xd1, 0xf7, 0xdf, 0x64, 0xd1,
-	0x58, 0xb8, 0xf5, 0x7c, 0x81, 0x36, 0x8f, 0xc6, 0x64, 0x8a, 0x36, 0x84, 0xdc, 0x81, 0x37, 0x84,
-	0x83, 0x68, 0x59, 0x47, 0x05, 0x42, 0x0d, 0x4f, 0x6c, 0x2b, 0x23, 0x5c, 0x63, 0x2e, 0x40, 0x88,
-	0xc0, 0xe0, 0x67, 0x51, 0xf1, 0x96, 0x71, 0xcf, 0x6a, 0x77, 0xdb, 0x62, 0xad, 0x03, 0xe7, 0x49,
-	0xdb, 0xb8, 0x47, 0x02, 0xb8, 0xfe, 0xb7, 0x19, 0x76, 0xc2, 0x06, 0xa5, 0x0a, 0xe1, 0x07, 0xd2,
-	0x6a, 0xa4, 0x9d, 0xec, 0x81, 0xb5, 0x93, 0x7b, 0x78, 0xed, 0xe8, 0xdf, 0x18, 0x66, 0xea, 0x61,
-	0xa6, 0xdf, 0xe3, 0x3e, 0x1b, 0xa3, 0x1e, 0xc9, 0x3f, 0x44, 0x8f, 0x3c, 0x36, 0x76, 0xb5, 0xfe,
-	0x9f, 0x45, 0x84, 0x84, 0xf6, 0xe7, 0x4f, 0xd6, 0xf0, 0x83, 0x8d, 0x9a, 0x39, 0x34, 0x39, 0xdf,
-	0xd9, 0x32, 0x3a, 0x4d, 0x6a, 0x46, 0xa7, 0x0b, 0x36, 0x74, 0x4a, 0xdc, 0x33, 0x4b, 0x05, 0x32,
-	0x3a, 0x5e, 0x90, 0x24, 0x03, 0xbe, 0x8a, 0xca, 0xf5, 0x8e, 0x4f, 0x5d, 0xa3, 0xe9, 0x5b, 0xdb,
-	0x14, 0x46, 0x4f, 0x69, 0x76, 0xbc, 0xdf, 0xab, 0x94, 0xad, 0x08, 0x4c, 0x64, 0x1a, 0x7c, 0x1d,
-	0x8d, 0xae, 0x1a, 0xae, 0x6f, 0x35, 0x2d, 0xc7, 0xe8, 0xf8, 0x9e, 0x56, 0x82, 0xa3, 0x11, 0xec,
-	0x3d, 0x8e, 0x04, 0x27, 0x0a, 0x15, 0xfe, 0x3c, 0x1a, 0x81, 0x23, 0x38, 0x78, 0xbf, 0x47, 0xee,
-	0xeb, 0xfd, 0x7e, 0x2e, 0xf2, 0xe8, 0xf1, 0x43, 0x92, 0xc7, 0x98, 0xa3, 0xa9, 0x00, 0x0e, 0xf1,
-	0x48, 0x22, 0xfe, 0x2c, 0x2a, 0xce, 0x77, 0x4c, 0x10, 0x8e, 0xee, 0x2b, 0x5c, 0x17, 0xc2, 0xcf,
-	0x46, 0xc2, 0x6d, 0x27, 0x26, 0x3b, 0x10, 0x97, 0x3e, 0xcb, 0xca, 0x1f, 0xde, 0x2c, 0x1b, 0xfd,
-	0x10, 0x4e, 0xaf, 0x63, 0x87, 0x75, 0x7a, 0x3d, 0xf5, 0x90, 0xa7, 0x57, 0xfd, 0x7d, 0x54, 0x9e,
-	0x5d, 0x5d, 0x08, 0x67, 0xef, 0x13, 0x28, 0xb7, 0x2a, 0x6e, 0x1b, 0x86, 0xf9, 0x86, 0xe9, 0x58,
-	0x26, 0x61, 0x30, 0x7c, 0x19, 0x95, 0x6a, 0xe0, 0xc2, 0x13, 0x8e, 0xeb, 0x61, 0xee, 0xb8, 0x6e,
-	0x02, 0x0c, 0x1c, 0xd7, 0x01, 0x1a, 0x7f, 0x14, 0x15, 0x57, 0x5d, 0x7b, 0xd3, 0x35, 0xda, 0xc2,
-	0xd7, 0x55, 0x66, 0xc6, 0xbe, 0xc3, 0x41, 0x24, 0xc0, 0xe9, 0xbf, 0x94, 0x41, 0x85, 0x35, 0xdf,
-	0xf0, 0xbb, 0x1e, 0xe3, 0x58, 0xeb, 0xc2, 0x09, 0x1a, 0xda, 0x2e, 0x71, 0x0e, 0x8f, 0x83, 0x48,
-	0x80, 0xc3, 0x97, 0x51, 0x7e, 0xde, 0x75, 0x6d, 0x57, 0xbe, 0x80, 0xa0, 0x0c, 0x20, 0x5f, 0x40,
-	0x00, 0x05, 0xbe, 0x81, 0xca, 0x7c, 0xcd, 0xe1, 0x07, 0x0f, 0xfe, 0x1c, 0x67, 0xfa, 0xbd, 0xca,
-	0xa4, 0x38, 0x74, 0xc8, 0x37, 0x31, 0x12, 0xa5, 0xfe, 0xad, 0x9c, 0x64, 0x14, 0x70, 0x8d, 0x3f,
-	0x86, 0x87, 0xf7, 0x97, 0x50, 0x6e, 0x76, 0x75, 0x41, 0x2c, 0x80, 0xa7, 0x03, 0x56, 0x69, 0xa8,
-	0xc4, 0xf8, 0x18, 0x35, 0xbe, 0x80, 0x86, 0x57, 0xd9, 0xf0, 0x29, 0xc0, 0xf0, 0x28, 0xf5, 0x7b,
-	0x95, 0x61, 0x87, 0x8d, 0x1f, 0x80, 0x02, 0xd6, 0xf0, 0xb7, 0x60, 0x2d, 0x1b, 0x11, 0x58, 0xc3,
-	0xdf, 0x22, 0x00, 0x65, 0xd8, 0xaa, 0xbb, 0xb9, 0x2d, 0x56, 0x2d, 0xc0, 0x1a, 0xee, 0xe6, 0x36,
-	0x01, 0x28, 0x9e, 0x41, 0x88, 0x50, 0xbf, 0xeb, 0x76, 0xe0, 0x32, 0x6f, 0x04, 0xcc, 0x64, 0x58,
-	0x0d, 0x5d, 0x80, 0x36, 0x9a, 0xb6, 0x49, 0x89, 0x44, 0xa2, 0xff, 0x66, 0xe4, 0x7f, 0x99, 0xb3,
-	0xbc, 0xbb, 0x27, 0x5d, 0xb8, 0x8f, 0x2e, 0x34, 0xc4, 0x49, 0x24, 0xd9, 0x49, 0x15, 0x94, 0x5f,
-	0x68, 0x19, 0x9b, 0x1e, 0xf4, 0x61, 0x9e, 0x7b, 0x25, 0xee, 0x30, 0x00, 0xe1, 0xf0, 0x58, 0x3f,
-	0x95, 0xee, 0xdf, 0x4f, 0xbf, 0x9c, 0x0f, 0x67, 0xdb, 0x32, 0xf5, 0x77, 0x6c, 0xf7, 0xa4, 0xab,
-	0x1e, 0xb4, 0xab, 0x2e, 0xa2, 0xe2, 0x9a, 0xdb, 0x84, 0x63, 0x26, 0xef, 0xad, 0xd1, 0x7e, 0xaf,
-	0x52, 0xf2, 0xdc, 0x26, 0x3f, 0x62, 0x06, 0x48, 0x46, 0x37, 0xe7, 0xf9, 0x40, 0x57, 0x8c, 0xe8,
-	0x4c, 0xcf, 0x17, 0x74, 0x02, 0x29, 0xe8, 0x56, 0x6d, 0xd7, 0x17, 0x1d, 0x17, 0xd2, 0x39, 0xb6,
-	0xeb, 0x93, 0x00, 0x89, 0x5f, 0x40, 0x68, 0xbd, 0xb6, 0xfa, 0x0e, 0x75, 0x41, 0x5d, 0x7c, 0x2e,
-	0xc2, 0x72, 0xbd, 0xcd, 0x41, 0x44, 0x42, 0xe3, 0x75, 0x34, 0xb2, 0xe2, 0x50, 0x17, 0xc2, 0x04,
-	0xc0, 0x02, 0x38, 0x75, 0xed, 0xf9, 0x98, 0x6a, 0x45, 0xbf, 0x4f, 0x8b, 0xbf, 0x21, 0x39, 0xdf,
-	0x5f, 0xec, 0xe0, 0x27, 0x89, 0x04, 0xe1, 0x1b, 0xa8, 0x50, 0xe5, 0x76, 0x5e, 0x19, 0x44, 0x86,
-	0x2a, 0x9b, 0x67, 0x7f, 0x38, 0x8a, 0x1f, 0x0a, 0x0d, 0xf8, 0x9f, 0x08, 0x72, 0xfd, 0x32, 0x9a,
-	0x88, 0x37, 0x83, 0xcb, 0xa8, 0x58, 0x5b, 0x59, 0x5e, 0x9e, 0xaf, 0xad, 0x4f, 0x0c, 0xe1, 0x12,
-	0x1a, 0x5e, 0x9b, 0x5f, 0x9e, 0x9b, 0xc8, 0xe8, 0x5f, 0x97, 0x56, 0x10, 0x36, 0xb4, 0x4e, 0x3c,
-	0xb8, 0x07, 0x72, 0x8b, 0x4c, 0x80, 0xdb, 0x72, 0xdd, 0x35, 0x3a, 0x5e, 0xdb, 0xf2, 0x7d, 0x6a,
-	0x8a, 0x5d, 0x02, 0xdc, 0x7a, 0xfe, 0x3d, 0x92, 0xc0, 0xe3, 0x2b, 0x68, 0x0c, 0x60, 0xc2, 0x93,
-	0x67, 0xc2, 0xe8, 0x15, 0x0c, 0xee, 0x3d, 0xa2, 0x22, 0xf5, 0xbf, 0x8c, 0x9c, 0xb8, 0x4b, 0xd4,
-	0x38, 0xae, 0x8e, 0xbf, 0xff, 0x23, 0xfd, 0xa5, 0xff, 0x7a, 0x0e, 0x8d, 0xb0, 0x37, 0xe2, 0xc1,
-	0x1c, 0x47, 0xa1, 0xca, 0xeb, 0x81, 0x6d, 0x28, 0x34, 0x79, 0x2a, 0xd4, 0x04, 0x40, 0x13, 0x1a,
-	0xe0, 0x76, 0xe4, 0x15, 0x54, 0xb8, 0x45, 0xfd, 0x2d, 0xdb, 0x14, 0x17, 0xa0, 0x53, 0xfd, 0x5e,
-	0x65, 0xa2, 0x0d, 0x10, 0xc9, 0xde, 0x13, 0x34, 0xf8, 0x2e, 0xc2, 0x75, 0x93, 0x76, 0x7c, 0xcb,
-	0xdf, 0xad, 0xfa, 0xbe, 0x6b, 0x6d, 0x74, 0x7d, 0xea, 0x09, 0xbd, 0x9d, 0x4b, 0x9c, 0x53, 0xd6,
-	0x20, 0x12, 0x0a, 0xee, 0x3c, 0xa7, 0x8c, 0x90, 0x3c, 0x12, 0xfb, 0xdf, 0xbd, 0x4a, 0x81, 0xd3,
-	0x90, 0x14, 0xb1, 0xf8, 0x6d, 0x34, 0x72, 0x6b, 0xa1, 0x3a, 0x47, 0xb7, 0xad, 0x26, 0x15, 0x97,
-	0x17, 0x4f, 0x84, 0x5a, 0x0c, 0x10, 0xa1, 0x4a, 0x20, 0x3e, 0xa1, 0x7d, 0xc7, 0x68, 0x98, 0x00,
-	0x97, 0xe3, 0x13, 0x42, 0x62, 0xfd, 0x47, 0x19, 0x34, 0x41, 0xa8, 0x67, 0x77, 0xdd, 0x88, 0x13,
-	0x5f, 0x44, 0xc3, 0xd2, 0xe5, 0x38, 0x78, 0x2b, 0x62, 0x37, 0xb2, 0x80, 0xc7, 0x6b, 0xa8, 0x38,
-	0x7f, 0xcf, 0xb1, 0x5c, 0xea, 0x89, 0xbe, 0xd9, 0xeb, 0x64, 0xf6, 0x94, 0x38, 0x99, 0x4d, 0x52,
-	0xce, 0x92, 0x38, 0x94, 0x71, 0x30, 0x7e, 0x05, 0x8d, 0xdc, 0x76, 0x4c, 0xc3, 0xa7, 0xe6, 0xec,
-	0xae, 0xb0, 0xb9, 0xe1, 0x4d, 0xba, 0x1c, 0xd8, 0xd8, 0xd8, 0x95, 0xdf, 0x24, 0x24, 0xc5, 0xcf,
-	0xa1, 0xdc, 0xfa, 0xfa, 0x92, 0xe8, 0x34, 0x08, 0xe5, 0xf2, 0x7d, 0x39, 0x28, 0x83, 0x61, 0xf5,
-	0xaf, 0x66, 0x11, 0x62, 0x63, 0xa3, 0xe6, 0x52, 0xc3, 0x3f, 0x9a, 0x09, 0x3e, 0x8b, 0x4a, 0x81,
-	0xc2, 0xc5, 0xb8, 0xd4, 0x02, 0xde, 0x78, 0x47, 0xc4, 0xdb, 0x0e, 0xf0, 0xcc, 0x88, 0x22, 0x76,
-	0x0b, 0xae, 0x76, 0x72, 0x41, 0x54, 0x9b, 0xcb, 0x00, 0x84, 0xc3, 0xf1, 0x0b, 0x68, 0x44, 0x4c,
-	0x45, 0x3b, 0xf0, 0x20, 0xf3, 0xa3, 0x56, 0x00, 0x24, 0x11, 0x5e, 0xff, 0xb3, 0x0c, 0x57, 0xca,
-	0x1c, 0x6d, 0xd1, 0xe3, 0xab, 0x14, 0xfd, 0x4b, 0x19, 0x84, 0x99, 0xb0, 0x55, 0xc3, 0xf3, 0x76,
-	0x6c, 0xd7, 0xac, 0x6d, 0x19, 0x9d, 0xcd, 0x23, 0x79, 0x1d, 0xfd, 0xcb, 0x79, 0x74, 0x5a, 0xb9,
-	0xcd, 0x3d, 0xe6, 0xe3, 0xed, 0xb2, 0x3a, 0xde, 0xe0, 0xd0, 0x0c, 0xe3, 0x4d, 0x3e, 0x34, 0xf3,
-	0x91, 0xf7, 0x11, 0x34, 0x22, 0xde, 0xb9, 0x3e, 0x27, 0x46, 0x1e, 0x6c, 0xb7, 0x96, 0x49, 0x22,
-	0x04, 0x7e, 0x11, 0x8d, 0x8a, 0x1f, 0x6c, 0xd5, 0x0d, 0xfc, 0xa2, 0x30, 0x8e, 0x3d, 0x06, 0x20,
-	0x0a, 0x1a, 0xbf, 0x8c, 0x46, 0xd8, 0xe0, 0xdc, 0x84, 0x38, 0xc0, 0x62, 0x14, 0x2e, 0x67, 0x06,
-	0x40, 0x79, 0x49, 0x08, 0x29, 0xd9, 0x52, 0x2e, 0x7c, 0xfc, 0xa5, 0x68, 0x29, 0xe7, 0x3e, 0x7e,
-	0x79, 0x29, 0x17, 0xde, 0xfe, 0xf7, 0x50, 0xb9, 0xda, 0xe9, 0xd8, 0x3c, 0x1e, 0xd5, 0x13, 0x8e,
-	0xac, 0x81, 0x6b, 0xf8, 0x73, 0x10, 0xc4, 0x15, 0xd1, 0xa7, 0x2e, 0xe2, 0xb2, 0x40, 0x7c, 0x8d,
-	0x75, 0xc4, 0xb6, 0x45, 0x77, 0xa8, 0x2b, 0x42, 0x05, 0xc0, 0x99, 0xe7, 0x0a, 0x98, 0x1c, 0xd2,
-	0x15, 0xd0, 0xe1, 0x59, 0x34, 0xb6, 0xea, 0xda, 0x8e, 0xed, 0x51, 0x93, 0x2b, 0xaa, 0x0c, 0x8c,
-	0x17, 0xfa, 0xbd, 0x8a, 0xe6, 0x08, 0x44, 0x03, 0x34, 0x26, 0xb1, 0xab, 0x2c, 0xfa, 0x37, 0x32,
-	0xb1, 0xc1, 0x78, 0x84, 0xf3, 0x5c, 0x19, 0x1d, 0xb9, 0x01, 0xa3, 0x43, 0xff, 0xd5, 0x2c, 0x2a,
-	0xb3, 0x73, 0xc2, 0x82, 0xed, 0xee, 0x18, 0xee, 0xd1, 0x38, 0x4f, 0x0e, 0xed, 0x2e, 0x45, 0x32,
-	0x43, 0x86, 0xf7, 0x61, 0x86, 0x5c, 0x40, 0xc3, 0xd2, 0xf5, 0x1f, 0x77, 0x66, 0xb0, 0xb3, 0x16,
-	0x40, 0xf5, 0xff, 0x97, 0x45, 0xe8, 0xb3, 0x57, 0xaf, 0x3e, 0xc6, 0x0a, 0xd2, 0x7f, 0x25, 0x83,
-	0xc6, 0x85, 0x77, 0x4d, 0x8a, 0x77, 0x2e, 0x06, 0x7e, 0xd1, 0x4c, 0xe4, 0x35, 0x14, 0xfe, 0x50,
-	0x12, 0xe0, 0xd8, 0x4c, 0x9c, 0xbf, 0x67, 0xf9, 0xe0, 0x60, 0x90, 0x02, 0x9e, 0xa9, 0x80, 0xc9,
-	0x33, 0x31, 0xa0, 0xc3, 0x2f, 0x06, 0x7e, 0xc3, 0x5c, 0xb4, 0xfc, 0x30, 0x86, 0xf9, 0x54, 0xdf,
-	0xa1, 0xfe, 0xcd, 0x61, 0x34, 0x3c, 0x7f, 0x8f, 0x36, 0x8f, 0x79, 0xd7, 0x48, 0xa7, 0x91, 0xe1,
-	0x03, 0x9e, 0x46, 0x1e, 0xe6, 0x22, 0xe4, 0x8d, 0xa8, 0x3f, 0x0b, 0x6a, 0xf3, 0xb1, 0x9e, 0x8f,
-	0x37, 0x1f, 0xf4, 0xf4, 0xf1, 0xbb, 0x47, 0xfb, 0xf3, 0x1c, 0xca, 0xad, 0xd5, 0x56, 0x4f, 0xc6,
-	0xcd, 0x91, 0x8e, 0x9b, 0xbd, 0x1d, 0xcd, 0x7a, 0xe8, 0x3b, 0x2a, 0x45, 0xb1, 0x03, 0x31, 0x37,
-	0xd1, 0x57, 0xb2, 0x68, 0x64, 0xad, 0xbb, 0xe1, 0xed, 0x7a, 0x3e, 0x6d, 0x1f, 0xf3, 0xde, 0xbc,
-	0x20, 0xce, 0x83, 0xc3, 0x91, 0x36, 0xd8, 0x79, 0x50, 0x9c, 0x02, 0x9f, 0x0b, 0x56, 0x46, 0xe9,
-	0x9c, 0x11, 0xae, 0x8c, 0xc1, 0x7a, 0xf8, 0xfb, 0x59, 0x34, 0x51, 0x6b, 0x59, 0xb4, 0xe3, 0xcf,
-	0x59, 0x5e, 0xf3, 0x10, 0x22, 0x25, 0x8e, 0x5e, 0x2b, 0x07, 0x73, 0xb4, 0x3c, 0x40, 0xfc, 0x89,
-	0xfe, 0xff, 0xb3, 0xa8, 0x5c, 0xed, 0xfa, 0x5b, 0x55, 0x1f, 0x36, 0x97, 0xc7, 0x72, 0x9b, 0xff,
-	0x76, 0x06, 0x8d, 0xb3, 0x07, 0x59, 0xb7, 0xef, 0xd2, 0xce, 0x21, 0x1c, 0xa3, 0xe4, 0xe3, 0x50,
-	0xf6, 0x21, 0x8f, 0x43, 0x81, 0x2e, 0x73, 0xfb, 0x3c, 0x16, 0xb2, 0x83, 0x36, 0x3b, 0x25, 0x3d,
-	0x22, 0xaf, 0x71, 0x08, 0xe7, 0x88, 0xa3, 0x7c, 0x8d, 0xef, 0x66, 0xd0, 0xd4, 0xba, 0xcb, 0x36,
-	0x72, 0x53, 0xec, 0xe7, 0xc7, 0xbc, 0x5f, 0x92, 0x2f, 0x74, 0xcc, 0x7b, 0xe8, 0xfb, 0x19, 0xf4,
-	0x84, 0xfa, 0x42, 0x8f, 0xc2, 0x2a, 0xf0, 0x57, 0x19, 0x74, 0xe6, 0x4d, 0x48, 0x82, 0x0d, 0x5d,
-	0x70, 0x8f, 0xde, 0x1b, 0x1d, 0xf3, 0x91, 0xf7, 0x9d, 0x0c, 0x3a, 0xbd, 0x52, 0x9f, 0xab, 0x3d,
-	0x2a, 0x3d, 0x94, 0x78, 0x9f, 0x47, 0xa0, 0x7f, 0xd6, 0xaa, 0xb7, 0x96, 0x1e, 0xa5, 0xfe, 0x51,
-	0xde, 0xe7, 0x98, 0xf7, 0xcf, 0x4f, 0x17, 0x50, 0x99, 0x9d, 0x6b, 0x85, 0x4f, 0xef, 0xb1, 0xb6,
-	0xf4, 0xaf, 0xa1, 0xb2, 0x50, 0x03, 0x1c, 0x29, 0xa5, 0x78, 0x7e, 0x91, 0x41, 0xde, 0x80, 0xa3,
-	0xa5, 0x4c, 0xc4, 0x4e, 0x5c, 0xef, 0x50, 0x77, 0x43, 0x8e, 0xa1, 0xd9, 0xa6, 0xee, 0x06, 0x01,
-	0x28, 0x5e, 0x8a, 0xee, 0xec, 0xaa, 0xab, 0x75, 0x48, 0x7c, 0x15, 0x27, 0x55, 0xc8, 0xe4, 0x75,
-	0x05, 0xae, 0x61, 0x38, 0x16, 0x4f, 0x99, 0x95, 0xe3, 0xf7, 0xe2, 0x9c, 0x78, 0x19, 0x4d, 0x06,
-	0xb0, 0x28, 0x83, 0xb5, 0x94, 0x22, 0x2e, 0x2d, 0x77, 0x35, 0xc9, 0x8a, 0xdf, 0x40, 0xa3, 0x01,
-	0xf0, 0x2d, 0x0b, 0xf2, 0xeb, 0x98, 0xa8, 0x27, 0xfb, 0xbd, 0xca, 0xb9, 0x50, 0xd4, 0x5d, 0x4b,
-	0x89, 0x4f, 0x54, 0x18, 0x64, 0x01, 0x70, 0xec, 0x44, 0x29, 0x02, 0x62, 0xf7, 0x91, 0x0a, 0x03,
-	0x7e, 0x19, 0x04, 0x38, 0x76, 0xc7, 0xa3, 0xe0, 0xe3, 0x2b, 0x43, 0x80, 0x09, 0xdc, 0x09, 0xba,
-	0x02, 0xce, 0xc3, 0x88, 0x14, 0x32, 0xbc, 0x82, 0x50, 0xe4, 0x8b, 0x11, 0xc1, 0x9a, 0xfb, 0xf6,
-	0x12, 0x49, 0x22, 0xf4, 0xbf, 0x66, 0xe7, 0x37, 0xc7, 0x09, 0x47, 0xf2, 0x8b, 0xa8, 0x50, 0x75,
-	0x9c, 0xdb, 0xa4, 0x2e, 0xbc, 0x93, 0x10, 0x4b, 0x68, 0x38, 0x4e, 0xa3, 0xeb, 0x5a, 0xf2, 0x85,
-	0x04, 0x27, 0xc2, 0x35, 0x34, 0x56, 0x75, 0x9c, 0xd5, 0xee, 0x46, 0xcb, 0x6a, 0x4a, 0xe9, 0xe3,
-	0xbc, 0x06, 0x81, 0xe3, 0x34, 0x1c, 0xc0, 0xc4, 0x93, 0xef, 0x55, 0x1e, 0xfc, 0x1e, 0x1a, 0xa9,
-	0x3a, 0x8e, 0x48, 0xbe, 0xcf, 0x41, 0xf2, 0xbd, 0x1e, 0xbc, 0x93, 0xf4, 0x6c, 0xd3, 0x21, 0x11,
-	0x4f, 0xbb, 0xbf, 0x20, 0x6e, 0x6b, 0xa7, 0x58, 0x43, 0x89, 0x9c, 0xfb, 0x48, 0x24, 0xfe, 0x38,
-	0x2a, 0x56, 0x1d, 0x47, 0x72, 0x0f, 0x80, 0x2b, 0x95, 0x71, 0xc5, 0xba, 0x28, 0x20, 0x3b, 0xff,
-	0x1a, 0x3a, 0xa5, 0x36, 0xb6, 0xaf, 0xfc, 0xfc, 0x9f, 0x64, 0xe0, 0x85, 0x8e, 0xf9, 0x85, 0xda,
-	0x4b, 0x28, 0x57, 0x75, 0x1c, 0xb1, 0x9c, 0x9c, 0x4e, 0xe9, 0x8f, 0x78, 0xb4, 0x56, 0xd5, 0x71,
-	0x82, 0x57, 0xe7, 0x57, 0xde, 0x8f, 0xd7, 0xab, 0x7f, 0x8b, 0xbf, 0xfa, 0x31, 0xbf, 0xa1, 0xfe,
-	0x66, 0x0e, 0x8d, 0x57, 0x1d, 0xe7, 0x24, 0x6d, 0xfd, 0xb0, 0x62, 0xc2, 0xae, 0x22, 0x24, 0x2d,
-	0x8f, 0xc5, 0x30, 0xf4, 0xa3, 0x2c, 0x2d, 0x8d, 0x5a, 0x86, 0x48, 0x44, 0xc1, 0xf0, 0x2b, 0xed,
-	0x6b, 0xf8, 0xfd, 0x89, 0xd2, 0x71, 0x90, 0x82, 0x7b, 0xd2, 0x71, 0xf9, 0x03, 0x59, 0x54, 0xa7,
-	0x64, 0x65, 0x8a, 0x80, 0x6f, 0x71, 0x43, 0x1f, 0xa4, 0x1f, 0x34, 0x19, 0xaa, 0x61, 0x99, 0x24,
-	0x46, 0x1b, 0xf4, 0x61, 0x71, 0x5f, 0x7d, 0xf8, 0xb5, 0x2c, 0x9a, 0x8c, 0xfa, 0xf0, 0x30, 0x0c,
-	0xd3, 0x19, 0x84, 0xb8, 0x93, 0x32, 0xbc, 0x48, 0x1c, 0xe3, 0x91, 0xca, 0x1e, 0x40, 0x45, 0xa4,
-	0x72, 0x44, 0x12, 0xde, 0x2a, 0xe4, 0x52, 0x6f, 0x15, 0x2e, 0xa3, 0x12, 0x31, 0x76, 0xde, 0xee,
-	0x52, 0x77, 0x57, 0x6c, 0xa5, 0xe0, 0x4a, 0x77, 0x8d, 0x9d, 0xc6, 0x17, 0x19, 0x90, 0x84, 0x68,
-	0xac, 0x87, 0x31, 0x6a, 0x92, 0xf3, 0x98, 0xc7, 0xa8, 0x85, 0x91, 0x69, 0x42, 0x49, 0x85, 0x7d,
-	0x29, 0xe9, 0xfb, 0x05, 0x34, 0x31, 0x67, 0xf8, 0xc6, 0x86, 0xe1, 0x51, 0xe9, 0x20, 0x31, 0x1e,
-	0xc0, 0xd8, 0x40, 0xb0, 0xc2, 0x92, 0x45, 0x10, 0x97, 0x65, 0x6e, 0x34, 0x3c, 0x0e, 0x95, 0x6b,
-	0xbc, 0xc4, 0x18, 0xf0, 0xa7, 0x22, 0xb9, 0x61, 0x51, 0x1b, 0x6e, 0xce, 0x80, 0xc6, 0xcc, 0x8d,
-	0x86, 0x23, 0xc0, 0x24, 0x41, 0x88, 0xaf, 0xa0, 0x72, 0x00, 0x63, 0xc6, 0x53, 0x2e, 0x7a, 0x67,
-	0x73, 0x83, 0xd9, 0x4e, 0x44, 0x46, 0xe3, 0x4f, 0xa2, 0xd1, 0xe0, 0xa7, 0x64, 0x96, 0x80, 0xad,
-	0x65, 0x6e, 0x24, 0x0c, 0x47, 0x99, 0x54, 0x66, 0x85, 0xf9, 0x99, 0x57, 0x58, 0x63, 0x05, 0xad,
-	0x14, 0x52, 0xfc, 0x45, 0x74, 0x2a, 0xf8, 0x2d, 0x8c, 0xad, 0x02, 0x18, 0x5b, 0x57, 0x02, 0xcd,
-	0xc7, 0xd5, 0x3a, 0xad, 0x92, 0x73, 0xb3, 0xeb, 0x49, 0x61, 0x76, 0x9d, 0x36, 0x37, 0x92, 0x56,
-	0x57, 0xac, 0x01, 0x5c, 0x47, 0x93, 0x01, 0xa4, 0xfa, 0xee, 0x1a, 0xa1, 0x9b, 0x6c, 0x56, 0x16,
-	0x23, 0x63, 0xd9, 0xdc, 0x68, 0x40, 0xa9, 0x2b, 0x40, 0xc8, 0x36, 0x7b, 0x82, 0x0b, 0xb7, 0xd0,
-	0x05, 0x05, 0x68, 0x7a, 0x5b, 0xd6, 0x1d, 0x5f, 0x58, 0xba, 0xf5, 0x39, 0x71, 0x1c, 0x80, 0x5a,
-	0x30, 0xa1, 0x54, 0x4e, 0x13, 0x14, 0x0b, 0x6a, 0x28, 0x75, 0xd3, 0xf6, 0x94, 0x86, 0xd7, 0xd0,
-	0x54, 0x80, 0x7f, 0xb3, 0xb6, 0xba, 0xea, 0xda, 0x5f, 0xa0, 0x4d, 0xbf, 0x3e, 0x27, 0x4e, 0x0a,
-	0x90, 0x82, 0x64, 0x6e, 0x34, 0x36, 0x9b, 0x0e, 0x1b, 0x14, 0x0c, 0xa7, 0x0a, 0x4f, 0x65, 0xc6,
-	0xef, 0xa0, 0x33, 0x12, 0xbc, 0xde, 0xf1, 0x7c, 0xa3, 0xd3, 0xa4, 0xf5, 0x39, 0x71, 0x7c, 0x80,
-	0xa3, 0x8c, 0x90, 0x6a, 0x09, 0xa4, 0x2a, 0x36, 0x9d, 0xfd, 0x7c, 0x15, 0x9d, 0x4e, 0xe9, 0xa9,
-	0x7d, 0xd9, 0xac, 0x5f, 0xc9, 0x46, 0x83, 0xe3, 0x98, 0x1b, 0xae, 0xb3, 0xa8, 0x14, 0xbc, 0x89,
-	0xd8, 0x42, 0xb4, 0x41, 0x03, 0x3c, 0x2e, 0x23, 0xc0, 0x2b, 0xea, 0x38, 0xe6, 0xc6, 0xec, 0x61,
-	0xa8, 0xe3, 0x83, 0x4c, 0xa4, 0x8e, 0x63, 0x6e, 0xe0, 0x7e, 0x27, 0x17, 0xcd, 0xec, 0x13, 0x2b,
-	0xf7, 0xb0, 0x8c, 0xa5, 0xe8, 0xe2, 0xb4, 0xb0, 0x8f, 0x00, 0x32, 0x79, 0x68, 0x16, 0x1f, 0x72,
-	0x68, 0xfe, 0x5d, 0xb2, 0x3f, 0xb9, 0x01, 0x72, 0x2c, 0xfb, 0xf3, 0x10, 0x26, 0x2b, 0xbe, 0x86,
-	0xc6, 0x82, 0xff, 0xb9, 0xa5, 0x96, 0x97, 0xf2, 0xa1, 0x36, 0x84, 0xa1, 0xa6, 0x92, 0xe0, 0xcf,
-	0xa1, 0x73, 0x0a, 0x60, 0xd5, 0x70, 0x8d, 0x36, 0xf5, 0xa9, 0xcb, 0x6d, 0x04, 0x51, 0x7e, 0x2e,
-	0xe0, 0x6e, 0x38, 0x21, 0x5a, 0xae, 0xe0, 0x36, 0x40, 0x82, 0x34, 0x38, 0x8a, 0xfb, 0xb8, 0x55,
-	0xff, 0xe7, 0x2c, 0x1a, 0x5b, 0xb5, 0x3d, 0x7f, 0xd3, 0xa5, 0xde, 0xaa, 0xe1, 0x7a, 0xf4, 0xf1,
-	0xed, 0xd1, 0x4f, 0xa0, 0x31, 0x88, 0x93, 0x6d, 0xd3, 0x8e, 0x2f, 0xd5, 0xa5, 0xe3, 0x35, 0x1a,
-	0x02, 0x04, 0x98, 0x8d, 0x44, 0x25, 0xc4, 0x15, 0x94, 0xe7, 0x63, 0x40, 0x8a, 0x5e, 0xe6, 0x03,
-	0x80, 0xc3, 0xf5, 0xaf, 0xe5, 0xd0, 0x68, 0xa0, 0xe5, 0x59, 0xeb, 0xb8, 0x66, 0x01, 0x1f, 0xad,
-	0x92, 0x67, 0x10, 0x5a, 0xb5, 0x5d, 0xdf, 0x68, 0x49, 0x25, 0x71, 0xe1, 0xc8, 0xe0, 0x00, 0x94,
-	0xf3, 0x48, 0x24, 0x78, 0x1a, 0x21, 0x69, 0x82, 0x15, 0x61, 0x82, 0x9d, 0xea, 0xf7, 0x2a, 0x28,
-	0x9a, 0x57, 0x44, 0xa2, 0xd0, 0xff, 0x28, 0x8b, 0xc6, 0x83, 0x4e, 0x9a, 0xbf, 0x47, 0x9b, 0x5d,
-	0xff, 0x31, 0x9e, 0x0c, 0xaa, 0xb6, 0xf3, 0xf7, 0xd5, 0xb6, 0xfe, 0xef, 0xd2, 0x42, 0x52, 0x6b,
-	0xd9, 0x27, 0x0b, 0xc9, 0xff, 0xc6, 0x18, 0xd7, 0x7f, 0x26, 0x87, 0xa6, 0x02, 0xad, 0x2f, 0x74,
-	0x3b, 0x60, 0x26, 0xd4, 0x8c, 0x56, 0xeb, 0x71, 0xde, 0x97, 0xcb, 0x81, 0x22, 0x56, 0x44, 0xe2,
-	0xc9, 0x18, 0xbf, 0x64, 0xbb, 0x23, 0xc0, 0x0d, 0xdb, 0x32, 0x89, 0x4c, 0x84, 0xdf, 0x40, 0xa3,
-	0xc1, 0xcf, 0xaa, 0xbb, 0x19, 0x6c, 0xc6, 0x70, 0x74, 0x0e, 0x99, 0x0c, 0x77, 0x53, 0x29, 0x36,
-	0x2c, 0x33, 0xe8, 0xff, 0x9a, 0x47, 0xe7, 0xdf, 0xb5, 0x3a, 0xa6, 0xbd, 0xe3, 0x89, 0x62, 0x5c,
-	0xc7, 0xdf, 0xe8, 0x3d, 0xbc, 0x1a, 0x38, 0x91, 0x65, 0x92, 0xdf, 0x87, 0xd9, 0xfa, 0x36, 0x3a,
-	0x13, 0x57, 0xa9, 0x1b, 0xe6, 0x3b, 0x8a, 0xde, 0xd9, 0xe1, 0x04, 0x8d, 0xa0, 0x1e, 0x9a, 0xf0,
-	0x3f, 0x91, 0x74, 0xce, 0x78, 0x41, 0xb5, 0xe2, 0x83, 0x14, 0x54, 0xfb, 0x18, 0x2a, 0xcc, 0xd9,
-	0x6d, 0xc3, 0x0a, 0x42, 0x7c, 0x61, 0x16, 0x87, 0xed, 0x02, 0x86, 0x08, 0x0a, 0x26, 0x5f, 0x34,
-	0x0c, 0x5d, 0x36, 0x12, 0xc9, 0x0f, 0x18, 0xba, 0x1e, 0x75, 0x89, 0x4c, 0x84, 0x6d, 0x34, 0x26,
-	0x9a, 0x13, 0xde, 0x22, 0x04, 0xde, 0xa2, 0x97, 0x03, 0x1d, 0x0d, 0x1e, 0x56, 0xd3, 0x0a, 0x1f,
-	0x77, 0x1b, 0xc1, 0xd3, 0x05, 0x2f, 0xc3, 0xfd, 0x46, 0x44, 0x95, 0x7f, 0xfe, 0x26, 0xc2, 0x49,
-	0xc6, 0x7d, 0x79, 0x31, 0x7e, 0x3e, 0x8b, 0x70, 0xec, 0x30, 0x30, 0xff, 0x18, 0xdb, 0x34, 0xfa,
-	0xef, 0x64, 0xd0, 0x64, 0x22, 0xeb, 0x16, 0xbf, 0x84, 0x10, 0x87, 0x48, 0x19, 0xb4, 0x90, 0x2f,
-	0x17, 0x65, 0xe2, 0x8a, 0xf5, 0x3c, 0x22, 0xc3, 0x33, 0xa8, 0xc4, 0x7f, 0x85, 0x15, 0xdd, 0xe3,
-	0x2c, 0xdd, 0xae, 0x65, 0x92, 0x90, 0x28, 0x6a, 0x05, 0xbe, 0x6d, 0x90, 0x4b, 0x65, 0xf1, 0x77,
-	0x9d, 0xb0, 0x15, 0x46, 0xa6, 0x7f, 0x2b, 0x83, 0x46, 0xc3, 0x07, 0xae, 0x9a, 0x47, 0xd5, 0x75,
-	0x05, 0x91, 0xc0, 0x9c, 0xbb, 0x5f, 0x02, 0x73, 0x6c, 0x81, 0x10, 0x19, 0xcb, 0x7f, 0x91, 0x41,
-	0xe3, 0x21, 0xed, 0x11, 0xfa, 0x4b, 0x0e, 0xfc, 0x22, 0xbf, 0x90, 0x41, 0xda, 0xac, 0xd5, 0x6a,
-	0x59, 0x9d, 0xcd, 0x7a, 0xe7, 0x8e, 0xed, 0xb6, 0x21, 0x4f, 0xf0, 0xe8, 0x1c, 0x62, 0xfa, 0xcf,
-	0x65, 0xd0, 0xa4, 0x78, 0xa0, 0x9a, 0xe1, 0x9a, 0x47, 0xe7, 0xa9, 0x8c, 0x3f, 0xc9, 0xd1, 0xf5,
-	0x32, 0xc4, 0x3a, 0x2f, 0xd9, 0xcd, 0xbb, 0x8f, 0x40, 0xc8, 0x36, 0x7b, 0x8d, 0x63, 0x1e, 0x56,
-	0xf6, 0xe5, 0x0c, 0x9a, 0x22, 0xb4, 0x69, 0x6f, 0x53, 0x77, 0xb7, 0x66, 0x9b, 0xf4, 0x4d, 0xda,
-	0xa1, 0xee, 0x51, 0x0d, 0xd2, 0x3f, 0x86, 0xd2, 0x09, 0xd1, 0xc3, 0xdc, 0xf6, 0xa8, 0x79, 0x7c,
-	0xea, 0x5c, 0xe8, 0x7f, 0x50, 0x44, 0x5a, 0xaa, 0x95, 0x71, 0x6c, 0x37, 0xf5, 0x81, 0xa6, 0xe3,
-	0xf0, 0x61, 0x99, 0x8e, 0xf9, 0xfd, 0x99, 0x8e, 0x85, 0xfd, 0x9a, 0x8e, 0xc5, 0x07, 0x31, 0x1d,
-	0xdb, 0x71, 0xd3, 0xb1, 0x04, 0xa6, 0xe3, 0x4b, 0x7b, 0x9a, 0x8e, 0xf3, 0x1d, 0xf3, 0xe1, 0x0c,
-	0xc7, 0xe3, 0x5b, 0xdd, 0x31, 0xea, 0x3b, 0x30, 0xc5, 0xca, 0xc9, 0xbe, 0x03, 0x3b, 0x4c, 0x26,
-	0xc2, 0x97, 0xd8, 0xe2, 0xd6, 0xb4, 0x5d, 0x93, 0xf2, 0x6a, 0x8d, 0x25, 0xee, 0xd9, 0x75, 0x05,
-	0x8c, 0x84, 0xd8, 0x44, 0xa9, 0xcc, 0xb1, 0x07, 0x29, 0x95, 0x79, 0x08, 0x56, 0xf8, 0x77, 0x33,
-	0x68, 0xb2, 0x46, 0x5d, 0xdf, 0xba, 0x63, 0x35, 0x0d, 0xff, 0x30, 0xae, 0x13, 0xab, 0x68, 0x5c,
-	0x12, 0x28, 0x7d, 0x2c, 0x0b, 0x72, 0x9c, 0x9b, 0xd4, 0xf5, 0xc1, 0x94, 0x94, 0x6f, 0xf7, 0x63,
-	0xf4, 0xac, 0xf9, 0xa0, 0x5c, 0x8d, 0x98, 0xbb, 0x61, 0xf3, 0x01, 0x9c, 0x2b, 0xd2, 0x12, 0xbf,
-	0x48, 0x48, 0xaf, 0x7f, 0x3d, 0x83, 0x2e, 0x12, 0xda, 0xa1, 0x3b, 0xc6, 0x46, 0x8b, 0x4a, 0x82,
-	0xc5, 0xda, 0xce, 0xe6, 0xbd, 0xe5, 0xb5, 0x0d, 0xbf, 0xb9, 0x75, 0xa0, 0xb7, 0x5c, 0x50, 0x3f,
-	0x58, 0xb5, 0x8f, 0xd5, 0x49, 0xe1, 0xd3, 0x7f, 0xf4, 0x02, 0xca, 0xaf, 0x74, 0xe8, 0xca, 0x1d,
-	0x7c, 0x55, 0xaa, 0x6f, 0x24, 0x1e, 0x67, 0x52, 0x16, 0x07, 0x88, 0xc5, 0x21, 0x22, 0x55, 0x41,
-	0xba, 0x2e, 0x57, 0x9f, 0x11, 0x8f, 0x80, 0x65, 0x1e, 0x8e, 0x59, 0x1c, 0x22, 0x72, 0x95, 0x9a,
-	0xeb, 0x72, 0x79, 0x16, 0xa1, 0x5f, 0x85, 0x8b, 0x63, 0x02, 0x2e, 0xb1, 0xc7, 0x2f, 0xa5, 0x55,
-	0x43, 0x89, 0x1f, 0xe8, 0x93, 0x14, 0x8b, 0x43, 0x24, 0xbd, 0x8a, 0x8a, 0xf2, 0xb5, 0x15, 0x71,
-	0xa4, 0x9f, 0x8a, 0xad, 0xd0, 0x80, 0x5b, 0x1c, 0x22, 0xea, 0x97, 0x59, 0x6e, 0x28, 0xdf, 0xb1,
-	0x88, 0x47, 0xa4, 0x48, 0xa8, 0xc5, 0x21, 0x12, 0xfb, 0xe2, 0x85, 0xf2, 0x51, 0x05, 0x71, 0xc3,
-	0x11, 0x6f, 0x14, 0x70, 0x52, 0xa3, 0xfc, 0x03, 0x0c, 0xaf, 0xc7, 0x8a, 0x9d, 0x8b, 0x88, 0xaf,
-	0x33, 0x31, 0x66, 0x8e, 0x5c, 0x1c, 0x22, 0xb1, 0xd2, 0xe8, 0x97, 0x82, 0xfa, 0xd7, 0x62, 0xc9,
-	0x3b, 0x25, 0xd9, 0x38, 0xd6, 0xfb, 0x4c, 0x4b, 0x41, 0x7d, 0xec, 0xeb, 0x72, 0xdd, 0x63, 0xb1,
-	0x86, 0xe1, 0x58, 0x2b, 0xf3, 0x1d, 0x93, 0xf5, 0x8e, 0xb4, 0xc1, 0xde, 0x8c, 0x57, 0x08, 0x15,
-	0x75, 0x67, 0xcf, 0xc6, 0x38, 0x05, 0x76, 0x71, 0x88, 0xc4, 0x2b, 0x8a, 0xde, 0x50, 0xaa, 0x53,
-	0x8a, 0x70, 0xe5, 0xb8, 0x56, 0x19, 0x4a, 0xd2, 0x2a, 0xd4, 0xb1, 0xbc, 0x19, 0x2f, 0x97, 0xa8,
-	0x8d, 0xa5, 0x36, 0x2d, 0xb0, 0x52, 0xd3, 0x41, 0x79, 0xc5, 0x1b, 0x4a, 0x59, 0x3b, 0xa8, 0x1c,
-	0x9b, 0xd2, 0xb4, 0xe1, 0x1b, 0x72, 0xd3, 0xbc, 0x00, 0x9e, 0x52, 0x60, 0x4d, 0x1b, 0x4f, 0xed,
-	0x50, 0xc0, 0x49, 0x1d, 0xca, 0x8b, 0xb1, 0xdd, 0x50, 0x6a, 0x82, 0x68, 0x13, 0x6a, 0xa3, 0x12,
-	0x8a, 0x35, 0x2a, 0x57, 0x0f, 0xb9, 0x2e, 0x97, 0xca, 0xd0, 0x26, 0xd5, 0x0e, 0x8a, 0x30, 0xac,
-	0x83, 0xa4, 0x92, 0x1a, 0x15, 0x48, 0xc3, 0xd7, 0x30, 0x90, 0x97, 0xc3, 0x27, 0xac, 0xad, 0x2e,
-	0x0e, 0x11, 0x48, 0xd0, 0xd7, 0x79, 0x81, 0x07, 0xed, 0x34, 0x50, 0x8c, 0x86, 0xe5, 0x03, 0xef,
-	0xd1, 0xe6, 0xe2, 0x10, 0xe1, 0xc5, 0x1f, 0xae, 0x4a, 0x39, 0xe0, 0xda, 0x94, 0xba, 0x44, 0x84,
-	0x08, 0xb6, 0x44, 0x44, 0x99, 0xe2, 0x0b, 0xc9, 0x3c, 0x69, 0xed, 0x8c, 0x6a, 0x66, 0xc7, 0xf1,
-	0x8b, 0x43, 0x24, 0x99, 0x5b, 0x7d, 0x43, 0x49, 0x1d, 0xd6, 0xce, 0xc6, 0xc2, 0xc0, 0x22, 0x14,
-	0x53, 0x97, 0x9c, 0x64, 0xbc, 0x92, 0x5a, 0xba, 0x48, 0x3b, 0x07, 0x02, 0x9e, 0x0c, 0x05, 0x24,
-	0x49, 0x16, 0x87, 0x48, 0x6a, 0xd1, 0xa3, 0x5a, 0x22, 0x81, 0x57, 0xd3, 0x54, 0xfb, 0x2e, 0x86,
-	0x5e, 0x1c, 0x22, 0x89, 0x94, 0xdf, 0xeb, 0x72, 0xe6, 0xac, 0xf6, 0x84, 0xda, 0x89, 0x11, 0x86,
-	0x75, 0xa2, 0x94, 0x61, 0x7b, 0x5d, 0x4e, 0x54, 0xd5, 0xce, 0x27, 0xb9, 0xa2, 0x95, 0x53, 0x4a,
-	0x68, 0x25, 0xe9, 0x79, 0xa1, 0xda, 0x93, 0xc0, 0x7f, 0x21, 0xe0, 0x4f, 0xa3, 0x59, 0x1c, 0x22,
-	0xe9, 0x39, 0xa5, 0x24, 0x3d, 0x35, 0x53, 0xbb, 0xb0, 0x97, 0xcc, 0xf0, 0xe9, 0xd2, 0xd3, 0x3a,
-	0x8d, 0x3d, 0xb2, 0x23, 0xb5, 0xa7, 0xd4, 0xf4, 0x85, 0x81, 0x84, 0x8b, 0x43, 0x64, 0x8f, 0x1c,
-	0xcb, 0xdb, 0x03, 0x52, 0x15, 0xb5, 0xa7, 0xd5, 0x42, 0x17, 0xa9, 0x44, 0x8b, 0x43, 0x64, 0x40,
-	0xa2, 0xe3, 0xed, 0x01, 0xf9, 0x82, 0x5a, 0x65, 0x4f, 0xb1, 0xa1, 0x3e, 0x06, 0x64, 0x1b, 0xae,
-	0xa4, 0x26, 0xed, 0x69, 0xcf, 0xa8, 0x43, 0x37, 0x85, 0x84, 0x0d, 0xdd, 0xb4, 0x74, 0xbf, 0x95,
-	0xd4, 0xac, 0x39, 0xed, 0xd9, 0x3d, 0x04, 0x86, 0xcf, 0x98, 0x9a, 0x6f, 0xb7, 0x92, 0x9a, 0xb6,
-	0xa6, 0xe9, 0xaa, 0xc0, 0x14, 0x12, 0x26, 0x30, 0x2d, 0xe1, 0x6d, 0x25, 0x35, 0x6f, 0x4c, 0x7b,
-	0x6e, 0x0f, 0x81, 0xd1, 0x13, 0xa6, 0x65, 0x9c, 0xdd, 0x50, 0x12, 0xb7, 0xb4, 0x8f, 0xa8, 0xeb,
-	0x86, 0x84, 0x62, 0xeb, 0x86, 0x9c, 0xe2, 0x55, 0x4b, 0xc4, 0xb6, 0x6b, 0x1f, 0x55, 0xa7, 0x79,
-	0x0c, 0xcd, 0xa6, 0x79, 0x3c, 0x1a, 0xbe, 0x96, 0x88, 0xb3, 0xd6, 0x2e, 0x0e, 0x12, 0x02, 0x68,
-	0x55, 0x08, 0x8f, 0xcc, 0xae, 0xa7, 0x04, 0xfa, 0x6a, 0xcf, 0xab, 0x4e, 0xba, 0x04, 0xc1, 0xe2,
-	0x10, 0x49, 0x09, 0x0f, 0x26, 0xe9, 0xf1, 0x4c, 0xda, 0x25, 0x75, 0xda, 0xa6, 0xd1, 0xb0, 0x69,
-	0x9b, 0x1a, 0x0b, 0xb5, 0x94, 0xe6, 0x46, 0xd7, 0x2e, 0xab, 0x86, 0x59, 0x92, 0x82, 0x19, 0x66,
-	0x29, 0xee, 0x77, 0x92, 0x1e, 0xa1, 0xa3, 0x7d, 0x6c, 0xcf, 0x27, 0x04, 0x9a, 0x94, 0x27, 0xe4,
-	0x01, 0x2b, 0x91, 0xed, 0x74, 0xdb, 0x69, 0xd9, 0x86, 0xa9, 0xbd, 0x90, 0x6a, 0x3b, 0x71, 0xa4,
-	0x64, 0x3b, 0x71, 0x00, 0xdb, 0xe5, 0x65, 0x37, 0xb3, 0x76, 0x45, 0xdd, 0xe5, 0x65, 0x1c, 0xdb,
-	0xe5, 0x15, 0x97, 0x74, 0x2d, 0xe1, 0xdc, 0xd5, 0x5e, 0x54, 0x07, 0x40, 0x0c, 0xcd, 0x06, 0x40,
-	0xdc, 0x1d, 0xfc, 0xde, 0x60, 0xc7, 0xaa, 0x36, 0x0d, 0xd2, 0x9e, 0x09, 0x0b, 0x24, 0x0f, 0xa0,
-	0x5b, 0x1c, 0x22, 0x83, 0x9d, 0xb3, 0xf5, 0x14, 0x3f, 0xa9, 0x36, 0xa3, 0x0e, 0xb0, 0x04, 0x01,
-	0x1b, 0x60, 0x49, 0xef, 0x6a, 0x3d, 0xc5, 0xd1, 0xa9, 0x7d, 0x7c, 0xa0, 0xa8, 0xf0, 0x9d, 0x53,
-	0xdc, 0xa3, 0xd7, 0x65, 0x4f, 0xa5, 0x76, 0x55, 0xdd, 0xec, 0x22, 0x0c, 0xdb, 0xec, 0x24, 0x8f,
-	0xe6, 0x75, 0xd9, 0x31, 0xa8, 0x5d, 0x4b, 0x72, 0x45, 0x5b, 0xa4, 0xe4, 0x40, 0x24, 0xe9, 0x7e,
-	0x38, 0xed, 0x25, 0x75, 0xd4, 0xa5, 0xd1, 0xb0, 0x51, 0x97, 0xea, 0xc3, 0x5b, 0x48, 0xba, 0xd3,
-	0xb4, 0xeb, 0x71, 0x07, 0xa3, 0x8a, 0x67, 0x96, 0x4f, 0xc2, 0x05, 0x77, 0x33, 0x1e, 0x6c, 0xab,
-	0xbd, 0xac, 0xda, 0xb7, 0x2a, 0x96, 0xd9, 0xb7, 0xb1, 0xe0, 0xdc, 0x9b, 0xf1, 0xf8, 0x54, 0xed,
-	0x95, 0x74, 0x09, 0xe1, 0x58, 0x89, 0xc7, 0xb3, 0xde, 0x8c, 0x87, 0x74, 0x6a, 0x37, 0xd2, 0x25,
-	0x84, 0xda, 0x8d, 0x87, 0x80, 0x5e, 0x95, 0xd2, 0xdc, 0xb4, 0x4f, 0xa8, 0xa6, 0x63, 0x88, 0x60,
-	0xa6, 0x63, 0x94, 0x0c, 0x77, 0x55, 0x4a, 0x0f, 0xd3, 0x3e, 0x99, 0x60, 0x09, 0x1f, 0x56, 0x4a,
-	0x22, 0xbb, 0x2a, 0xa5, 0x55, 0x69, 0xaf, 0x26, 0x58, 0xc2, 0xa7, 0x93, 0x92, 0xaf, 0xcc, 0xbd,
-	0xee, 0xbc, 0xb5, 0x4f, 0x81, 0x0c, 0xfd, 0xfe, 0xd7, 0x98, 0x8b, 0x43, 0x64, 0xaf, 0xbb, 0xf3,
-	0xf7, 0x06, 0x3b, 0x27, 0xb5, 0xd7, 0xd4, 0x29, 0x3c, 0x88, 0x8e, 0x4d, 0xe1, 0x81, 0x0e, 0xce,
-	0xd7, 0x63, 0xf1, 0x6f, 0xda, 0xeb, 0xea, 0x12, 0xa7, 0x20, 0xd9, 0x12, 0x17, 0x8f, 0x96, 0x53,
-	0x02, 0xbb, 0xb4, 0x4f, 0xab, 0x4b, 0x9c, 0x8c, 0x63, 0x4b, 0x9c, 0x12, 0x04, 0x56, 0x4b, 0xc4,
-	0x1b, 0x69, 0x6f, 0xa8, 0x4b, 0x5c, 0x0c, 0xcd, 0x96, 0xb8, 0x78, 0x84, 0xd2, 0xeb, 0xb1, 0xb0,
-	0x1b, 0xed, 0x66, 0xfa, 0xf3, 0x03, 0x52, 0x7e, 0x7e, 0x1e, 0xa4, 0x43, 0xd2, 0xe3, 0x47, 0xb4,
-	0xaa, 0x3a, 0x7f, 0xd3, 0x68, 0xd8, 0xfc, 0x4d, 0x8d, 0x3d, 0x59, 0x49, 0x2d, 0x33, 0xa9, 0xcd,
-	0xee, 0x71, 0x70, 0x88, 0x4c, 0x91, 0xb4, 0x02, 0x95, 0x37, 0xe3, 0x9f, 0xd6, 0xd2, 0x6a, 0x03,
-	0xce, 0xc8, 0xc1, 0x31, 0x28, 0xfe, 0x29, 0xae, 0x7a, 0x8a, 0xaf, 0x4c, 0x9b, 0x53, 0x57, 0xd7,
-	0x04, 0x01, 0x5b, 0x5d, 0x93, 0x1e, 0xb6, 0x85, 0xe4, 0x17, 0x0d, 0xb5, 0xf9, 0xd8, 0xcd, 0x71,
-	0x0c, 0xcf, 0x56, 0xa7, 0xc4, 0x57, 0x10, 0x49, 0xfa, 0x47, 0xef, 0xb4, 0x85, 0xd8, 0x7e, 0x9d,
-	0x42, 0x03, 0xfb, 0x75, 0xda, 0x07, 0xf3, 0x3e, 0x37, 0xf0, 0xdb, 0x85, 0xda, 0x9b, 0x20, 0xb6,
-	0x32, 0x48, 0xac, 0x20, 0x5b, 0x1c, 0x22, 0x03, 0xbf, 0x7e, 0x78, 0x1b, 0x9d, 0xb9, 0xb5, 0xbb,
-	0xf6, 0xf6, 0x52, 0x18, 0xb2, 0xb4, 0xea, 0x52, 0xc7, 0x70, 0xa9, 0xb6, 0xa8, 0xda, 0xea, 0xa9,
-	0x44, 0xcc, 0x56, 0x4f, 0x45, 0x24, 0xc5, 0x06, 0x73, 0xa1, 0xbe, 0x97, 0xd8, 0x68, 0x46, 0xa4,
-	0x73, 0xb3, 0xd5, 0x49, 0x45, 0x30, 0x05, 0x2d, 0xd9, 0x9d, 0x4d, 0xf0, 0x54, 0x7c, 0x46, 0x5d,
-	0x9d, 0x06, 0x53, 0xb2, 0xd5, 0x69, 0x30, 0x96, 0x0d, 0x75, 0x15, 0xcb, 0xe7, 0xe0, 0x5b, 0xea,
-	0x50, 0x4f, 0x21, 0x61, 0x43, 0x3d, 0x05, 0x9c, 0x14, 0x48, 0xa8, 0x47, 0x7d, 0x6d, 0x69, 0x2f,
-	0x81, 0x40, 0x92, 0x14, 0x08, 0xe0, 0xa4, 0xc0, 0x05, 0xea, 0x37, 0xb7, 0xb4, 0x5b, 0x7b, 0x09,
-	0x04, 0x92, 0xa4, 0x40, 0x00, 0xb3, 0xc3, 0xa6, 0x0a, 0x9e, 0xed, 0xb6, 0xee, 0x06, 0x7d, 0xb6,
-	0xac, 0x1e, 0x36, 0x07, 0x12, 0xb2, 0xc3, 0xe6, 0x40, 0x24, 0xfe, 0xd2, 0x03, 0x7b, 0x82, 0xb5,
-	0x15, 0x68, 0x70, 0x3a, 0xb2, 0x0b, 0x1e, 0x84, 0x6b, 0x71, 0x88, 0x3c, 0xa0, 0xfc, 0xd9, 0x22,
-	0xca, 0xc3, 0x77, 0x20, 0xf4, 0x5f, 0xcb, 0xa0, 0xd1, 0x35, 0xdf, 0xa5, 0x46, 0x5b, 0xc4, 0x27,
-	0x9d, 0x47, 0x25, 0x6e, 0xe6, 0x8a, 0x6f, 0x1c, 0x8d, 0x90, 0xf0, 0x37, 0xbe, 0x88, 0x4e, 0x2d,
-	0x19, 0x9e, 0x0f, 0x9c, 0xd2, 0xc7, 0x5b, 0x49, 0x0c, 0x8a, 0x97, 0x38, 0x1d, 0xe7, 0x83, 0xab,
-	0x8f, 0xdc, 0x7d, 0xaf, 0x3e, 0x4a, 0x1f, 0xf4, 0x2a, 0x43, 0x70, 0xc1, 0x11, 0xe3, 0xd5, 0xfb,
-	0x19, 0x94, 0x30, 0xc0, 0x1f, 0xde, 0x4f, 0xbe, 0x82, 0xc6, 0x63, 0xd7, 0x6d, 0xc2, 0x4f, 0xfd,
-	0x80, 0xb7, 0x71, 0x71, 0x6e, 0xfc, 0x1c, 0xca, 0xdd, 0xae, 0xcf, 0xc9, 0x75, 0xd9, 0xbb, 0x4a,
-	0xda, 0x15, 0xc3, 0xe2, 0xe7, 0x43, 0x27, 0xea, 0x6d, 0xb2, 0x24, 0xae, 0xd9, 0xe0, 0xdb, 0x51,
-	0x5d, 0xb7, 0x45, 0x24, 0x94, 0xfe, 0xed, 0x72, 0x74, 0xd5, 0x80, 0x2f, 0x8a, 0x9b, 0x46, 0xa9,
-	0x4e, 0x7d, 0x2c, 0x47, 0x8f, 0xdf, 0x2c, 0x7e, 0x1a, 0x8d, 0xd6, 0xdb, 0x0e, 0x75, 0x3d, 0xbb,
-	0x03, 0x15, 0xa4, 0xf9, 0xf5, 0xc6, 0xf9, 0x7e, 0xaf, 0x72, 0xd6, 0x92, 0xe0, 0x72, 0x9c, 0x9f,
-	0x4c, 0x1f, 0x95, 0xbf, 0xce, 0xdd, 0xb7, 0xfc, 0xf5, 0x65, 0x94, 0xbf, 0xed, 0xf1, 0xaf, 0xa7,
-	0x87, 0xa4, 0xdd, 0xd8, 0xb7, 0xa2, 0x38, 0x05, 0xbe, 0x82, 0x0a, 0x70, 0x2b, 0xe0, 0x69, 0x79,
-	0xa0, 0x85, 0xdc, 0xd7, 0x16, 0x40, 0xe4, 0x62, 0x10, 0x9c, 0x26, 0xf5, 0x23, 0xf9, 0x85, 0x87,
-	0xfc, 0x48, 0x7e, 0xda, 0xb7, 0xfb, 0x8b, 0x0f, 0xf7, 0xed, 0xfe, 0x7a, 0xf4, 0x09, 0x80, 0xd2,
-	0x7d, 0xc7, 0xf0, 0x69, 0x71, 0x7d, 0x57, 0x14, 0x9f, 0x00, 0x50, 0x0b, 0xff, 0x2f, 0xa0, 0x53,
-	0xc4, 0xee, 0xfa, 0x74, 0xdd, 0x0e, 0x0a, 0xb5, 0xf2, 0x48, 0x3a, 0x78, 0x26, 0x97, 0x61, 0x1a,
-	0xbe, 0x1d, 0xa4, 0x1b, 0xca, 0x69, 0x91, 0x2a, 0x17, 0x5e, 0x4e, 0xab, 0xf9, 0x2a, 0x25, 0x01,
-	0xca, 0x1f, 0xb3, 0x4f, 0x08, 0x4b, 0x29, 0xf2, 0xfa, 0xb3, 0x19, 0x54, 0x58, 0x77, 0x0d, 0xcb,
-	0xf7, 0x84, 0x8f, 0xfe, 0xcc, 0xf4, 0x8e, 0x6b, 0x38, 0x6c, 0x7c, 0x4c, 0xc3, 0x2d, 0xde, 0x3b,
-	0x46, 0xab, 0x4b, 0xbd, 0xd9, 0x77, 0xd9, 0xdb, 0xfd, 0x43, 0xaf, 0xf2, 0xa9, 0x4d, 0x70, 0x4e,
-	0x4d, 0x37, 0xed, 0xf6, 0xcc, 0xa6, 0x6b, 0x6c, 0x5b, 0xbc, 0x00, 0xb8, 0xd1, 0x9a, 0xf1, 0x69,
-	0x8b, 0x3a, 0xb6, 0xeb, 0xcf, 0x18, 0x8e, 0x35, 0xe3, 0xef, 0x3a, 0xd4, 0x9b, 0x09, 0x25, 0xf1,
-	0x16, 0xd8, 0x10, 0xf0, 0xe1, 0x3f, 0x79, 0x08, 0x70, 0x1c, 0x5e, 0x46, 0x48, 0xbc, 0x6a, 0xd5,
-	0x71, 0x84, 0xc3, 0x5f, 0xf2, 0x66, 0x06, 0x18, 0x3e, 0xb0, 0x43, 0x85, 0x19, 0x8e, 0x5c, 0xfe,
-	0x45, 0x92, 0xc0, 0x46, 0xc1, 0xba, 0x78, 0xa2, 0x40, 0x4d, 0x63, 0x91, 0xc6, 0x83, 0x87, 0x4d,
-	0x51, 0x52, 0x9c, 0x0d, 0x6f, 0xa0, 0x71, 0x21, 0x37, 0x8c, 0xaa, 0x3b, 0xa5, 0x2e, 0x1a, 0x31,
-	0x34, 0x1f, 0xb4, 0xe1, 0x33, 0x9a, 0x02, 0x2c, 0xb7, 0x11, 0xe3, 0xc0, 0xb3, 0x51, 0xe6, 0x0d,
-	0xd4, 0x9a, 0xd1, 0xc6, 0x61, 0xc4, 0x42, 0x29, 0xf4, 0x80, 0x9f, 0x97, 0xa8, 0x91, 0x8b, 0xa1,
-	0x28, 0x2c, 0xb2, 0x0c, 0x3e, 0xea, 0x27, 0x52, 0x64, 0xc4, 0xc7, 0xbc, 0xca, 0x82, 0x6b, 0x68,
-	0x2c, 0xf4, 0x37, 0xdc, 0x66, 0x2b, 0xdb, 0x64, 0x54, 0x95, 0x25, 0x16, 0xb0, 0x27, 0x0b, 0x51,
-	0x78, 0xf0, 0x4b, 0xa8, 0xc4, 0x3d, 0xf6, 0x75, 0x7e, 0xc5, 0x10, 0x5c, 0xb6, 0x02, 0xac, 0x61,
-	0xc9, 0x3d, 0x16, 0x12, 0xe2, 0xd7, 0x51, 0xb9, 0xfa, 0xee, 0x1a, 0x5b, 0x67, 0xaa, 0x64, 0xd9,
-	0xd3, 0x4e, 0x47, 0xe1, 0xca, 0x90, 0x90, 0x6b, 0xb7, 0x68, 0xc3, 0x70, 0x95, 0xc5, 0x43, 0xa6,
-	0xc7, 0xf3, 0x28, 0xf6, 0x85, 0x79, 0x6d, 0x2a, 0xfa, 0x76, 0xa0, 0x01, 0x98, 0x86, 0xa8, 0x48,
-	0xa4, 0x64, 0x1d, 0xab, 0x4c, 0x6c, 0xd4, 0xcc, 0x59, 0x9e, 0xd1, 0x6a, 0xd9, 0x3b, 0x84, 0x5a,
-	0x9e, 0xd7, 0xa5, 0x70, 0x3f, 0x51, 0xe2, 0xa3, 0xc6, 0x14, 0xa8, 0x86, 0xcb, 0x71, 0x4a, 0x4e,
-	0xb8, 0xca, 0xa6, 0xff, 0x57, 0x46, 0x1e, 0xd0, 0x61, 0x95, 0xd9, 0x4c, 0x6a, 0x95, 0xd9, 0x2b,
-	0x68, 0x44, 0x6c, 0x03, 0x61, 0x8c, 0x24, 0x64, 0x75, 0x04, 0x91, 0x00, 0x96, 0x49, 0x22, 0x02,
-	0x88, 0xa8, 0x8f, 0x0a, 0x43, 0xe4, 0xa4, 0x88, 0xfa, 0xa8, 0x30, 0x84, 0x52, 0x16, 0xe2, 0x1a,
-	0x2a, 0x8b, 0xc1, 0x2c, 0xe5, 0x8c, 0xc3, 0x6d, 0x7e, 0x90, 0xdf, 0xcc, 0x83, 0x05, 0x24, 0x22,
-	0xfc, 0x2a, 0x42, 0x91, 0x7e, 0xc5, 0xa6, 0x05, 0x73, 0x4f, 0xee, 0x0e, 0x79, 0xee, 0x45, 0xd4,
-	0xfa, 0xdf, 0x67, 0x12, 0x53, 0x86, 0x3d, 0x83, 0x88, 0x3b, 0x91, 0xf4, 0x00, 0xcf, 0x20, 0xa2,
-	0x54, 0xc4, 0x33, 0x48, 0x44, 0xf8, 0x12, 0x2a, 0xc5, 0xf2, 0xe9, 0xe1, 0x9e, 0x3d, 0x4c, 0xa6,
-	0x0f, 0xb1, 0xf8, 0x1a, 0x2a, 0xb1, 0x01, 0xcc, 0x44, 0x08, 0x85, 0x40, 0xa5, 0x9e, 0xae, 0x80,
-	0xc9, 0x23, 0x2e, 0xa0, 0x63, 0x3c, 0x4a, 0x98, 0xac, 0xe0, 0x49, 0x99, 0xae, 0x51, 0x58, 0xec,
-	0xef, 0x65, 0x07, 0x1c, 0x18, 0x1e, 0xdf, 0xe4, 0x84, 0x30, 0x51, 0x2c, 0x3f, 0x20, 0x51, 0xec,
-	0x3f, 0xb2, 0x03, 0x4e, 0x43, 0x8f, 0x75, 0x42, 0x47, 0xa8, 0x0c, 0x35, 0xa1, 0x23, 0xca, 0xa5,
-	0xb1, 0x4c, 0x22, 0x13, 0xc5, 0x52, 0xbf, 0x0a, 0xf7, 0x4d, 0xfd, 0xfa, 0xad, 0xdc, 0x5e, 0xa7,
-	0xc5, 0x13, 0xdd, 0xef, 0x47, 0xf7, 0xd7, 0x50, 0x39, 0xd4, 0xac, 0x28, 0xe7, 0x32, 0x16, 0x86,
-	0x43, 0x71, 0x30, 0xf0, 0x48, 0x44, 0xf8, 0x32, 0x7f, 0x56, 0xf8, 0x32, 0x76, 0x11, 0x18, 0xa0,
-	0xe2, 0x09, 0x7b, 0xb6, 0x86, 0x67, 0xbd, 0x4f, 0x49, 0x88, 0xd6, 0xff, 0x34, 0x9b, 0x7a, 0xe4,
-	0x3e, 0xe9, 0xa3, 0x7d, 0xf4, 0x51, 0x8a, 0x12, 0xb9, 0xb3, 0xe0, 0x44, 0x89, 0xfb, 0x50, 0xe2,
-	0x8f, 0xb3, 0xa9, 0xae, 0x95, 0x13, 0x25, 0xee, 0x67, 0xb5, 0xb8, 0x82, 0x46, 0x88, 0xbd, 0xe3,
-	0xd5, 0xec, 0x6e, 0xc7, 0x17, 0x6b, 0x05, 0x2c, 0xd4, 0xae, 0xbd, 0xe3, 0x35, 0x9a, 0x0c, 0x4a,
-	0x22, 0x02, 0xfd, 0x27, 0xd9, 0x3d, 0x9c, 0x4f, 0x27, 0x8a, 0xff, 0x10, 0xb7, 0xc8, 0x8f, 0x3d,
-	0x8f, 0xca, 0xd2, 0x07, 0x51, 0xf1, 0x28, 0x2a, 0xad, 0xcc, 0xae, 0xcd, 0x93, 0x77, 0xe6, 0xe7,
-	0x26, 0x86, 0x30, 0x42, 0x85, 0xb9, 0xf9, 0xe5, 0xfa, 0xfc, 0xdc, 0x44, 0x66, 0x76, 0xe2, 0x83,
-	0x7f, 0x7a, 0x7a, 0xe8, 0x83, 0x1f, 0x3e, 0x9d, 0xf9, 0xde, 0x0f, 0x9f, 0xce, 0xfc, 0xe3, 0x0f,
-	0x9f, 0xce, 0x6c, 0x14, 0xc0, 0x08, 0x7d, 0xe9, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0xf0, 0x99,
-	0x5b, 0x81, 0x5d, 0x96, 0x00, 0x00,
+	// 6991 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0x7d, 0x5d, 0x6c, 0x24, 0xd9,
+	0x55, 0xb0, 0xbb, 0xdb, 0xfd, 0xe3, 0xdb, 0xfe, 0xbd, 0xe3, 0xd9, 0xa9, 0x99, 0x9d, 0x9d, 0x9e,
+	0xad, 0x49, 0x66, 0x67, 0xb2, 0xb3, 0x76, 0xc6, 0x33, 0xbb, 0x93, 0x6c, 0x76, 0xb3, 0xd3, 0x6e,
+	0xdb, 0xeb, 0xce, 0x7a, 0x6c, 0xef, 0xb5, 0x67, 0x37, 0x52, 0x94, 0x6d, 0x95, 0xbb, 0xee, 0xd8,
+	0x95, 0xe9, 0xae, 0xaa, 0x54, 0x55, 0xdb, 0xe3, 0x7d, 0xfa, 0x7e, 0x10, 0x44, 0x51, 0x40, 0x28,
+	0x3c, 0x20, 0xc4, 0x43, 0x50, 0x00, 0x09, 0xa4, 0x88, 0x00, 0x42, 0x11, 0x12, 0xbc, 0x40, 0x00,
+	0x6d, 0x84, 0x12, 0x02, 0x41, 0x41, 0xe2, 0xa1, 0x03, 0x41, 0xbc, 0xb4, 0x40, 0x8a, 0x04, 0x12,
+	0x81, 0x27, 0x74, 0xcf, 0xbd, 0x55, 0x75, 0xeb, 0xa7, 0x3d, 0xe3, 0xb1, 0x17, 0xe3, 0x19, 0x3f,
+	0xd9, 0x7d, 0xfe, 0x6e, 0xd5, 0xb9, 0x7f, 0xe7, 0x9e, 0x7b, 0xce, 0x29, 0x34, 0x4c, 0xb7, 0xa9,
+	0xe9, 0xb9, 0x53, 0xb6, 0x63, 0x79, 0x16, 0x2e, 0xf0, 0x5f, 0xe7, 0x26, 0x37, 0xad, 0x4d, 0x0b,
+	0x40, 0xd3, 0xec, 0x3f, 0x8e, 0x3d, 0x57, 0xd9, 0xb4, 0xac, 0xcd, 0x16, 0x9d, 0x86, 0x5f, 0x1b,
+	0x9d, 0x7b, 0xd3, 0x9e, 0xd1, 0xa6, 0xae, 0xa7, 0xb5, 0x6d, 0x41, 0x70, 0x3e, 0x4e, 0xe0, 0x7a,
+	0x4e, 0xa7, 0xe9, 0x09, 0x6c, 0x6d, 0xd3, 0xf0, 0xb6, 0x3a, 0x1b, 0x53, 0x4d, 0xab, 0x3d, 0xbd,
+	0xe9, 0x68, 0xdb, 0x86, 0xa7, 0x79, 0x86, 0x65, 0x6a, 0xad, 0x69, 0x8f, 0xb6, 0xa8, 0x6d, 0x39,
+	0xde, 0xb4, 0x66, 0x1b, 0xd3, 0xde, 0xae, 0x4d, 0xdd, 0xe9, 0x1d, 0x47, 0xb3, 0x6d, 0xea, 0x84,
+	0xff, 0x70, 0x21, 0xea, 0x57, 0xb3, 0xa8, 0x74, 0x87, 0x7a, 0x9a, 0xae, 0x79, 0x1a, 0x3e, 0x8f,
+	0xf2, 0x75, 0x53, 0xa7, 0x0f, 0x94, 0xcc, 0xc5, 0xcc, 0x95, 0xdc, 0x6c, 0xa1, 0xd7, 0xad, 0x64,
+	0xa9, 0x41, 0x38, 0x10, 0x3f, 0x87, 0x06, 0xd7, 0x77, 0x6d, 0xaa, 0x64, 0x2f, 0x66, 0xae, 0x0c,
+	0xcd, 0x0e, 0xf5, 0xba, 0x95, 0x3c, 0xbc, 0x1e, 0x01, 0x30, 0x7e, 0x1e, 0x65, 0xeb, 0x73, 0x4a,
+	0x0e, 0x90, 0x13, 0xbd, 0x6e, 0x65, 0xa4, 0x63, 0xe8, 0xd7, 0xac, 0xb6, 0xe1, 0xd1, 0xb6, 0xed,
+	0xed, 0x92, 0x6c, 0x7d, 0x0e, 0x5f, 0x46, 0x83, 0x35, 0x4b, 0xa7, 0xca, 0x20, 0x10, 0xe1, 0x5e,
+	0xb7, 0x32, 0xda, 0xb4, 0x74, 0x2a, 0x51, 0x01, 0x1e, 0xdf, 0x46, 0x83, 0xeb, 0x46, 0x9b, 0x2a,
+	0xf9, 0x8b, 0x99, 0x2b, 0xe5, 0x99, 0x73, 0x53, 0x5c, 0x0d, 0x53, 0xbe, 0x1a, 0xa6, 0xd6, 0x7d,
+	0x3d, 0xcd, 0x8e, 0x7f, 0xd0, 0xad, 0x0c, 0xf4, 0xba, 0x95, 0x41, 0xa6, 0xba, 0x5f, 0xfc, 0x51,
+	0x25, 0x43, 0x80, 0x13, 0xbf, 0x86, 0xca, 0xb5, 0x56, 0xc7, 0xf5, 0xa8, 0xb3, 0xac, 0xb5, 0xa9,
+	0x52, 0x80, 0x06, 0xcf, 0xf5, 0xba, 0x95, 0x67, 0x9a, 0x1c, 0xdc, 0x30, 0xb5, 0xb6, 0xdc, 0xb0,
+	0x4c, 0xae, 0x7e, 0x01, 0x8d, 0xad, 0x51, 0xd7, 0x35, 0x2c, 0x33, 0x50, 0xcd, 0x47, 0xd1, 0x90,
+	0x00, 0xd5, 0xe7, 0x40, 0x3d, 0x43, 0xb3, 0xc5, 0x5e, 0xb7, 0x92, 0x73, 0x0d, 0x9d, 0x84, 0x18,
+	0xfc, 0x71, 0x54, 0x7c, 0xd7, 0xf0, 0xb6, 0xee, 0x2c, 0x54, 0x85, 0x9a, 0x9e, 0xe9, 0x75, 0x2b,
+	0x78, 0xc7, 0xf0, 0xb6, 0x1a, 0xed, 0x7b, 0x9a, 0xd4, 0x9e, 0x4f, 0xa6, 0xfe, 0x46, 0x16, 0x0d,
+	0xdf, 0x75, 0xa9, 0x13, 0xb4, 0x74, 0x19, 0x0d, 0xb2, 0xdf, 0xa2, 0x11, 0x50, 0x52, 0xc7, 0xa5,
+	0x8e, 0xac, 0x24, 0x86, 0xc7, 0x57, 0x51, 0x7e, 0xc9, 0xda, 0x34, 0x4c, 0xd1, 0xd0, 0xa9, 0x5e,
+	0xb7, 0x32, 0xd6, 0x62, 0x00, 0x89, 0x92, 0x53, 0xe0, 0x4f, 0xa3, 0xe1, 0x7a, 0x9b, 0x75, 0xba,
+	0x65, 0x6a, 0x9e, 0xe5, 0x88, 0x4e, 0x02, 0x75, 0x18, 0x12, 0x5c, 0x62, 0x8c, 0xd0, 0xe3, 0x57,
+	0x11, 0xaa, 0xbe, 0xbb, 0x46, 0xac, 0x16, 0xad, 0x92, 0x65, 0xd1, 0x7b, 0xc0, 0xad, 0xed, 0xb8,
+	0x0d, 0xc7, 0x6a, 0xd1, 0x86, 0xe6, 0xc8, 0xcd, 0x4a, 0xd4, 0x78, 0x1e, 0x8d, 0x56, 0x9b, 0x4d,
+	0xea, 0xba, 0x84, 0x7e, 0xb1, 0x43, 0x5d, 0xcf, 0x55, 0xf2, 0x17, 0x73, 0x57, 0x86, 0x66, 0x9f,
+	0xeb, 0x75, 0x2b, 0x67, 0x35, 0xc0, 0x34, 0x1c, 0x81, 0x92, 0x44, 0xc4, 0x98, 0xd4, 0xdf, 0xcd,
+	0xa1, 0xd1, 0x35, 0xea, 0x6c, 0x4b, 0x8a, 0xaa, 0xb2, 0x5e, 0x62, 0x10, 0xd6, 0x67, 0xae, 0xad,
+	0x35, 0xa9, 0xd0, 0xd9, 0x99, 0x5e, 0xb7, 0x72, 0xca, 0xf4, 0x81, 0x92, 0xd0, 0x38, 0x3d, 0xbe,
+	0x8a, 0x4a, 0x1c, 0x54, 0x9f, 0x13, 0x6a, 0x1c, 0xe9, 0x75, 0x2b, 0x43, 0x2e, 0xc0, 0x1a, 0x86,
+	0x4e, 0x02, 0x34, 0x7b, 0x0f, 0xfe, 0xff, 0xa2, 0xe5, 0x7a, 0x4c, 0xb8, 0xd0, 0x22, 0xbc, 0x87,
+	0x60, 0xd8, 0x12, 0x28, 0xf9, 0x3d, 0xa2, 0x4c, 0xf8, 0x93, 0x08, 0x71, 0x48, 0x55, 0xd7, 0x1d,
+	0xa1, 0xca, 0xb3, 0xbd, 0x6e, 0xe5, 0xb4, 0x10, 0xa1, 0xe9, 0xba, 0xdc, 0x0f, 0x12, 0x31, 0x6e,
+	0xa3, 0x61, 0xfe, 0x6b, 0x49, 0xdb, 0xa0, 0x2d, 0xae, 0xc7, 0xf2, 0xcc, 0x95, 0x29, 0xb1, 0xe2,
+	0x44, 0xb5, 0x33, 0x25, 0x93, 0xce, 0x9b, 0x9e, 0xb3, 0x3b, 0x5b, 0x11, 0x73, 0xe5, 0x8c, 0x68,
+	0xaa, 0x05, 0x38, 0xb9, 0xd3, 0x65, 0x9e, 0x73, 0x6f, 0xa0, 0x89, 0x84, 0x0c, 0x3c, 0x8e, 0x72,
+	0xf7, 0xe9, 0x2e, 0xd7, 0x33, 0x61, 0xff, 0xe2, 0x49, 0x94, 0xdf, 0xd6, 0x5a, 0x1d, 0xb1, 0x2c,
+	0x10, 0xfe, 0xe3, 0xd5, 0xec, 0x27, 0x32, 0xea, 0x1f, 0x66, 0x10, 0xae, 0x59, 0xa6, 0x49, 0x9b,
+	0x9e, 0x3c, 0x93, 0x5e, 0x41, 0x43, 0x4b, 0x56, 0x53, 0x6b, 0x81, 0x02, 0x78, 0x87, 0x29, 0xbd,
+	0x6e, 0x65, 0x92, 0xbd, 0xf9, 0x54, 0x8b, 0x61, 0xa4, 0x47, 0x0a, 0x49, 0x99, 0xe6, 0x08, 0x6d,
+	0x5b, 0x1e, 0x05, 0xc6, 0x6c, 0xa8, 0x39, 0x60, 0x74, 0x00, 0x25, 0x6b, 0x2e, 0x24, 0xc6, 0xd3,
+	0xa8, 0xb4, 0xca, 0xd6, 0x8e, 0xa6, 0xd5, 0x12, 0xbd, 0x06, 0xb3, 0x05, 0xd6, 0x13, 0x89, 0x25,
+	0x20, 0x52, 0xff, 0x5f, 0x16, 0x9d, 0x7d, 0xab, 0xb3, 0x41, 0x1d, 0x93, 0x7a, 0xd4, 0x15, 0x4b,
+	0x43, 0xf0, 0x06, 0xcb, 0x68, 0x22, 0x81, 0x14, 0x6f, 0x72, 0xb1, 0xd7, 0xad, 0x9c, 0xbf, 0x1f,
+	0x20, 0x1b, 0x62, 0xb5, 0x91, 0x1a, 0x49, 0xb2, 0xe2, 0x45, 0x34, 0x16, 0x02, 0xd9, 0xdc, 0x76,
+	0x95, 0x2c, 0xcc, 0x91, 0x0b, 0xbd, 0x6e, 0xe5, 0x9c, 0x24, 0x8d, 0xad, 0x03, 0x72, 0x87, 0xc5,
+	0xd9, 0xf0, 0x5b, 0x68, 0x3c, 0x04, 0xbd, 0xe9, 0x58, 0x1d, 0xdb, 0x55, 0x72, 0x20, 0xaa, 0xd2,
+	0xeb, 0x56, 0x9e, 0x95, 0x44, 0x6d, 0x02, 0x52, 0x92, 0x95, 0x60, 0x54, 0xff, 0x39, 0x87, 0x4e,
+	0x87, 0xc0, 0x55, 0x4b, 0x0f, 0x14, 0xb0, 0x22, 0x2b, 0x60, 0xd5, 0xd2, 0x61, 0x8d, 0xe5, 0x0a,
+	0x78, 0xbe, 0xd7, 0xad, 0x3c, 0x27, 0xb5, 0x63, 0x5b, 0x7a, 0x7c, 0xa9, 0x4d, 0xf2, 0xe2, 0xf7,
+	0xd0, 0x33, 0x09, 0x20, 0x9f, 0xd1, 0xbc, 0x9f, 0x2f, 0xf7, 0xba, 0x15, 0x35, 0x45, 0x6a, 0x7c,
+	0x82, 0xf7, 0x91, 0x82, 0x35, 0x74, 0x46, 0x52, 0xbb, 0x65, 0x7a, 0x9a, 0x61, 0x8a, 0xad, 0x81,
+	0x8f, 0x87, 0x17, 0x7a, 0xdd, 0xca, 0x25, 0xb9, 0xdf, 0x7c, 0x9a, 0xf8, 0xc3, 0xf7, 0x93, 0x83,
+	0x75, 0xa4, 0xa4, 0xa0, 0xea, 0x6d, 0x6d, 0xd3, 0xdf, 0xef, 0xae, 0xf4, 0xba, 0x95, 0x8f, 0xa4,
+	0xb6, 0x61, 0x30, 0x2a, 0xa9, 0x91, 0xbe, 0x92, 0x30, 0x41, 0x38, 0xc4, 0x2d, 0x5b, 0x3a, 0x85,
+	0x77, 0xc8, 0x83, 0x7c, 0xb5, 0xd7, 0xad, 0x5c, 0x90, 0xe4, 0x9b, 0x96, 0x4e, 0xe3, 0x8f, 0x9f,
+	0xc2, 0xad, 0xfe, 0x28, 0xcf, 0x16, 0x16, 0xd8, 0xc1, 0xd6, 0x3c, 0xcd, 0xf1, 0xf0, 0xab, 0xa1,
+	0x49, 0x00, 0xbd, 0x5a, 0x9e, 0x19, 0xf7, 0x17, 0x19, 0x1f, 0x3e, 0x3b, 0xcc, 0x16, 0x93, 0xef,
+	0x77, 0x2b, 0x99, 0x5e, 0xb7, 0x32, 0x40, 0x4a, 0xd2, 0xec, 0xe6, 0xbb, 0x57, 0x16, 0xf8, 0x26,
+	0x7d, 0x3e, 0x79, 0x87, 0x8b, 0xf1, 0xf2, 0xdd, 0xec, 0x0d, 0x54, 0x14, 0xcf, 0x00, 0x3d, 0x52,
+	0x9e, 0x39, 0x13, 0xae, 0x6b, 0x91, 0x9d, 0x38, 0xc6, 0xed, 0x73, 0xe1, 0xd7, 0x50, 0x81, 0x2f,
+	0x57, 0xa0, 0xed, 0xf2, 0xcc, 0x33, 0xe9, 0xeb, 0x62, 0x8c, 0x5d, 0xf0, 0xe0, 0x45, 0x84, 0xc2,
+	0xa5, 0x2a, 0xb0, 0x3b, 0x84, 0x84, 0xe4, 0x22, 0x16, 0x93, 0x22, 0xf1, 0xe2, 0x57, 0xd0, 0xf0,
+	0x3a, 0x75, 0xda, 0x86, 0xa9, 0xb5, 0xd6, 0x8c, 0xf7, 0x7d, 0xd3, 0x03, 0xb6, 0x71, 0xd7, 0x78,
+	0x5f, 0xee, 0x8b, 0x08, 0x1d, 0xfe, 0x7c, 0xda, 0xa2, 0x52, 0x84, 0x07, 0x79, 0xde, 0x7f, 0x90,
+	0xbe, 0x4b, 0x52, 0xec, 0x79, 0x52, 0xd6, 0x98, 0xb7, 0xd1, 0x48, 0x64, 0x6e, 0x28, 0x25, 0x10,
+	0xfd, 0x5c, 0x52, 0xb4, 0x34, 0xd1, 0x63, 0x62, 0xa3, 0x12, 0xd8, 0x8e, 0x58, 0x37, 0x0d, 0xcf,
+	0xd0, 0x5a, 0x35, 0xab, 0xdd, 0xd6, 0x4c, 0x5d, 0x19, 0x0a, 0x77, 0x76, 0x83, 0x63, 0x1a, 0x4d,
+	0x8e, 0x92, 0x77, 0xc4, 0x28, 0x13, 0x5b, 0xb3, 0x44, 0x1f, 0x12, 0xda, 0xb4, 0x1c, 0xdd, 0x30,
+	0x37, 0x15, 0x04, 0x4a, 0x83, 0x35, 0xcb, 0xe5, 0xb8, 0x86, 0xe3, 0x23, 0xe5, 0x35, 0x2b, 0xce,
+	0xf8, 0x99, 0xc1, 0x52, 0x79, 0x7c, 0x38, 0x61, 0x3c, 0xfc, 0x76, 0x0e, 0x95, 0x05, 0xe9, 0x67,
+	0x2c, 0xc3, 0x3c, 0x19, 0xe0, 0x07, 0x19, 0xe0, 0xa9, 0x03, 0xb5, 0x70, 0x58, 0x03, 0x55, 0xfd,
+	0x4a, 0x36, 0x58, 0x8d, 0x56, 0x1d, 0xc3, 0x3c, 0xd8, 0x6a, 0x74, 0x19, 0xa1, 0xda, 0x56, 0xc7,
+	0xbc, 0xcf, 0x4f, 0x35, 0xd9, 0xf0, 0x54, 0xd3, 0x34, 0x88, 0x84, 0x61, 0x47, 0x9b, 0x39, 0x26,
+	0x9f, 0xf5, 0xcc, 0xf0, 0xec, 0xd0, 0x07, 0x5c, 0x52, 0xe6, 0x25, 0x02, 0x60, 0x5c, 0x41, 0xf9,
+	0xd9, 0x5d, 0x8f, 0xba, 0xa0, 0xf9, 0x1c, 0x3f, 0xfa, 0x6c, 0x30, 0x00, 0xe1, 0x70, 0x7c, 0x13,
+	0x4d, 0xcc, 0xd1, 0x96, 0xb6, 0x7b, 0xc7, 0x68, 0xb5, 0x0c, 0x97, 0x36, 0x2d, 0x53, 0x77, 0x41,
+	0xc9, 0xa2, 0xb9, 0xb6, 0x4b, 0x92, 0x04, 0x58, 0x45, 0x85, 0x95, 0x7b, 0xf7, 0x5c, 0xea, 0x81,
+	0xfa, 0x72, 0xb3, 0xa8, 0xd7, 0xad, 0x14, 0x2c, 0x80, 0x10, 0x81, 0x51, 0xbf, 0x99, 0x41, 0xe3,
+	0x73, 0xd4, 0xbd, 0xef, 0x59, 0x76, 0x30, 0xca, 0x0f, 0xa4, 0x92, 0xab, 0xa8, 0x78, 0x87, 0xba,
+	0x2e, 0xdb, 0x96, 0xb2, 0xf0, 0xb6, 0x63, 0xe2, 0x6d, 0x8b, 0x6d, 0x0e, 0x26, 0x3e, 0x3e, 0xfd,
+	0xad, 0x72, 0x0f, 0x79, 0x2b, 0xf5, 0x27, 0x59, 0x74, 0x46, 0x3c, 0x71, 0xad, 0x65, 0xd8, 0x1b,
+	0x96, 0xe6, 0xe8, 0x84, 0x36, 0xa9, 0xb1, 0x4d, 0x8f, 0xe7, 0xc4, 0x8b, 0x4e, 0x9d, 0xc1, 0x03,
+	0x4c, 0x9d, 0x19, 0x54, 0x16, 0x9a, 0x01, 0x1b, 0x96, 0x6f, 0xdb, 0xe3, 0xbd, 0x6e, 0x65, 0x58,
+	0xe7, 0x60, 0x30, 0xff, 0x89, 0x4c, 0xc4, 0x06, 0xc9, 0x12, 0x35, 0x37, 0xbd, 0x2d, 0x18, 0x24,
+	0x79, 0x3e, 0x48, 0x5a, 0x00, 0x21, 0x02, 0xa3, 0xfe, 0x6b, 0x16, 0x4d, 0xc6, 0x55, 0xbe, 0x46,
+	0x4d, 0xfd, 0x44, 0xdf, 0x1f, 0x8e, 0xbe, 0xff, 0x26, 0x8b, 0x46, 0x82, 0xad, 0xe7, 0x0b, 0xb4,
+	0x79, 0x34, 0x26, 0x53, 0xb8, 0x21, 0xe4, 0x0e, 0xbc, 0x21, 0x1c, 0x44, 0xcb, 0x2a, 0x2a, 0x10,
+	0xaa, 0xb9, 0x62, 0x5b, 0x19, 0xe2, 0x1a, 0x73, 0x00, 0x42, 0x04, 0x06, 0x3f, 0x8f, 0x8a, 0x77,
+	0xb4, 0x07, 0x46, 0xbb, 0xd3, 0x16, 0x6b, 0x1d, 0x38, 0x4f, 0xda, 0xda, 0x03, 0xe2, 0xc3, 0xd5,
+	0xbf, 0xcd, 0xb0, 0x13, 0x36, 0x28, 0x55, 0x08, 0x3f, 0x90, 0x56, 0x43, 0xed, 0x64, 0x0f, 0xac,
+	0x9d, 0xdc, 0xe3, 0x6b, 0x47, 0xfd, 0xe6, 0x20, 0x53, 0x0f, 0x33, 0xfd, 0x9e, 0xf6, 0xd9, 0x18,
+	0xf6, 0x48, 0xfe, 0x31, 0x7a, 0xe4, 0xa9, 0xb1, 0xab, 0xd5, 0xff, 0x28, 0x22, 0x24, 0xb4, 0x3f,
+	0x7f, 0xb2, 0x86, 0x1f, 0x6c, 0xd4, 0xcc, 0xa1, 0x89, 0x79, 0x73, 0x4b, 0x33, 0x9b, 0x54, 0x0f,
+	0x4f, 0x17, 0x6c, 0xe8, 0x94, 0xb8, 0x67, 0x96, 0x0a, 0x64, 0x78, 0xbc, 0x20, 0x49, 0x06, 0x7c,
+	0x1d, 0x95, 0xeb, 0xa6, 0x47, 0x1d, 0xad, 0xe9, 0x19, 0xdb, 0x14, 0x46, 0x4f, 0x69, 0x76, 0xac,
+	0xd7, 0xad, 0x94, 0x8d, 0x10, 0x4c, 0x64, 0x1a, 0x7c, 0x13, 0x0d, 0xaf, 0x6a, 0x8e, 0x67, 0x34,
+	0x0d, 0x5b, 0x33, 0x3d, 0x57, 0x29, 0xc1, 0xd1, 0x08, 0xf6, 0x1e, 0x5b, 0x82, 0x93, 0x08, 0x15,
+	0xfe, 0x3c, 0x1a, 0x82, 0x23, 0x38, 0x78, 0xbf, 0x87, 0x1e, 0xea, 0xfd, 0xbe, 0x14, 0x7a, 0xf4,
+	0xf8, 0x21, 0xc9, 0x65, 0xcc, 0xe1, 0x54, 0x00, 0x87, 0x78, 0x28, 0x11, 0x7f, 0x16, 0x15, 0xe7,
+	0x4d, 0x1d, 0x84, 0xa3, 0x87, 0x0a, 0x57, 0x85, 0xf0, 0x67, 0x42, 0xe1, 0x96, 0x1d, 0x93, 0xed,
+	0x8b, 0x4b, 0x9f, 0x65, 0xe5, 0x0f, 0x6f, 0x96, 0x0d, 0x7f, 0x08, 0xa7, 0xd7, 0x91, 0xc3, 0x3a,
+	0xbd, 0x8e, 0x3e, 0xe6, 0xe9, 0x55, 0x7d, 0x1f, 0x95, 0x67, 0x57, 0x17, 0x82, 0xd9, 0x7b, 0x16,
+	0xe5, 0x56, 0xc5, 0x6d, 0xc3, 0x20, 0xdf, 0x30, 0x6d, 0x43, 0x27, 0x0c, 0x86, 0xaf, 0xa2, 0x52,
+	0x0d, 0x5c, 0x78, 0xc2, 0x71, 0x3d, 0xc8, 0x1d, 0xd7, 0x4d, 0x80, 0x81, 0xe3, 0xda, 0x47, 0xe3,
+	0x8f, 0xa2, 0xe2, 0xaa, 0x63, 0x6d, 0x3a, 0x5a, 0x5b, 0xf8, 0xba, 0xca, 0xcc, 0xd8, 0xb7, 0x39,
+	0x88, 0xf8, 0x38, 0xf5, 0x97, 0x32, 0xa8, 0xb0, 0xe6, 0x69, 0x5e, 0xc7, 0x65, 0x1c, 0x6b, 0x1d,
+	0x38, 0x41, 0x43, 0xdb, 0x25, 0xce, 0xe1, 0x72, 0x10, 0xf1, 0x71, 0xf8, 0x2a, 0xca, 0xcf, 0x3b,
+	0x8e, 0xe5, 0xc8, 0x17, 0x10, 0x94, 0x01, 0xe4, 0x0b, 0x08, 0xa0, 0xc0, 0xb7, 0x50, 0x99, 0xaf,
+	0x39, 0xfc, 0xe0, 0xc1, 0x9f, 0xe3, 0x74, 0xaf, 0x5b, 0x99, 0x10, 0x87, 0x0e, 0xf9, 0x26, 0x46,
+	0xa2, 0x54, 0xbf, 0x9d, 0x93, 0x8c, 0x02, 0xae, 0xf1, 0xa7, 0xf0, 0xf0, 0x7e, 0x03, 0xe5, 0x66,
+	0x57, 0x17, 0xc4, 0x02, 0x78, 0xca, 0x67, 0x95, 0x86, 0x4a, 0x8c, 0x8f, 0x51, 0xe3, 0xf3, 0x68,
+	0x70, 0x95, 0x0d, 0x9f, 0x02, 0x0c, 0x8f, 0x52, 0xaf, 0x5b, 0x19, 0xb4, 0xd9, 0xf8, 0x01, 0x28,
+	0x60, 0x35, 0x6f, 0x0b, 0xd6, 0xb2, 0x21, 0x81, 0xd5, 0xbc, 0x2d, 0x02, 0x50, 0x86, 0xad, 0x3a,
+	0x9b, 0xdb, 0x62, 0xd5, 0x02, 0xac, 0xe6, 0x6c, 0x6e, 0x13, 0x80, 0xe2, 0x69, 0x84, 0x08, 0xf5,
+	0x3a, 0x8e, 0x09, 0x97, 0x79, 0x43, 0x60, 0x26, 0xc3, 0x6a, 0xe8, 0x00, 0xb4, 0xd1, 0xb4, 0x74,
+	0x4a, 0x24, 0x12, 0xf5, 0x37, 0x43, 0xff, 0xcb, 0x9c, 0xe1, 0xde, 0x3f, 0xe9, 0xc2, 0x7d, 0x74,
+	0xa1, 0x26, 0x4e, 0x22, 0xc9, 0x4e, 0xaa, 0xa0, 0xfc, 0x42, 0x4b, 0xdb, 0x74, 0xa1, 0x0f, 0xf3,
+	0xdc, 0x2b, 0x71, 0x8f, 0x01, 0x08, 0x87, 0xc7, 0xfa, 0xa9, 0xf4, 0xf0, 0x7e, 0xfa, 0xe5, 0x7c,
+	0x30, 0xdb, 0x96, 0xa9, 0xb7, 0x63, 0x39, 0x27, 0x5d, 0xf5, 0xa8, 0x5d, 0x75, 0x19, 0x15, 0xd7,
+	0x9c, 0x26, 0x1c, 0x33, 0x79, 0x6f, 0x0d, 0xf7, 0xba, 0x95, 0x92, 0xeb, 0x34, 0xf9, 0x11, 0xd3,
+	0x47, 0x32, 0xba, 0x39, 0xd7, 0x03, 0xba, 0x62, 0x48, 0xa7, 0xbb, 0x9e, 0xa0, 0x13, 0x48, 0x41,
+	0xb7, 0x6a, 0x39, 0x9e, 0xe8, 0xb8, 0x80, 0xce, 0xb6, 0x1c, 0x8f, 0xf8, 0x48, 0xfc, 0x22, 0x42,
+	0xeb, 0xb5, 0xd5, 0x77, 0xa8, 0x03, 0xea, 0xe2, 0x73, 0x11, 0x96, 0xeb, 0x6d, 0x0e, 0x22, 0x12,
+	0x1a, 0xaf, 0xa3, 0xa1, 0x15, 0x9b, 0x3a, 0x10, 0x26, 0x00, 0x16, 0xc0, 0xe8, 0xcc, 0x0b, 0x31,
+	0xd5, 0x8a, 0x7e, 0x9f, 0x12, 0x7f, 0x03, 0x72, 0xbe, 0xbf, 0x58, 0xfe, 0x4f, 0x12, 0x0a, 0xc2,
+	0xb7, 0x50, 0xa1, 0xca, 0xed, 0xbc, 0x32, 0x88, 0x0c, 0x54, 0x36, 0xcf, 0xfe, 0x70, 0x14, 0x3f,
+	0x14, 0x6a, 0xf0, 0x3f, 0x11, 0xe4, 0xea, 0x55, 0x34, 0x1e, 0x6f, 0x06, 0x97, 0x51, 0xb1, 0xb6,
+	0xb2, 0xbc, 0x3c, 0x5f, 0x5b, 0x1f, 0x1f, 0xc0, 0x25, 0x34, 0xb8, 0x36, 0xbf, 0x3c, 0x37, 0x9e,
+	0x51, 0xbf, 0x21, 0xad, 0x20, 0x6c, 0x68, 0x9d, 0x78, 0x70, 0x0f, 0xe4, 0x16, 0x19, 0x07, 0xb7,
+	0xe5, 0xba, 0xa3, 0x99, 0x6e, 0xdb, 0xf0, 0x3c, 0xaa, 0x8b, 0x5d, 0x02, 0xdc, 0x7a, 0xde, 0x03,
+	0x92, 0xc0, 0xe3, 0x6b, 0x68, 0x04, 0x60, 0xc2, 0x93, 0xa7, 0xc3, 0xe8, 0x15, 0x0c, 0xce, 0x03,
+	0x12, 0x45, 0xaa, 0x7f, 0x19, 0x3a, 0x71, 0x97, 0xa8, 0x76, 0x5c, 0x1d, 0x7f, 0xff, 0x4b, 0xfa,
+	0x4b, 0xfd, 0xf5, 0x1c, 0x1a, 0x62, 0x6f, 0xc4, 0x83, 0x39, 0x8e, 0x42, 0x95, 0x37, 0x7d, 0xdb,
+	0x50, 0x68, 0x72, 0x34, 0xd0, 0x04, 0x40, 0x13, 0x1a, 0xe0, 0x76, 0xe4, 0x35, 0x54, 0xb8, 0x43,
+	0xbd, 0x2d, 0x4b, 0x17, 0x17, 0xa0, 0x93, 0xbd, 0x6e, 0x65, 0xbc, 0x0d, 0x10, 0xc9, 0xde, 0x13,
+	0x34, 0xf8, 0x3e, 0xc2, 0x75, 0x9d, 0x9a, 0x9e, 0xe1, 0xed, 0x56, 0x3d, 0xcf, 0x31, 0x36, 0x3a,
+	0x1e, 0x75, 0x85, 0xde, 0xce, 0x24, 0xce, 0x29, 0x6b, 0x10, 0x09, 0x05, 0x77, 0x9e, 0x93, 0x5a,
+	0x40, 0x1e, 0x8a, 0xfd, 0xaf, 0x6e, 0xa5, 0xc0, 0x69, 0x48, 0x8a, 0x58, 0xfc, 0x36, 0x1a, 0xba,
+	0xb3, 0x50, 0x9d, 0xa3, 0xdb, 0x46, 0x93, 0x8a, 0xcb, 0x8b, 0xb3, 0x81, 0x16, 0x7d, 0x44, 0xa0,
+	0x12, 0x88, 0x4f, 0x68, 0xdf, 0xd3, 0x1a, 0x3a, 0xc0, 0xe5, 0xf8, 0x84, 0x80, 0x58, 0xfd, 0x97,
+	0x0c, 0x1a, 0x27, 0xd4, 0xb5, 0x3a, 0x4e, 0xc8, 0x89, 0x2f, 0xa3, 0x41, 0xe9, 0x72, 0x1c, 0xbc,
+	0x15, 0xb1, 0x1b, 0x59, 0xc0, 0xe3, 0x35, 0x54, 0x9c, 0x7f, 0x60, 0x1b, 0x0e, 0x75, 0x45, 0xdf,
+	0xec, 0x75, 0x32, 0x7b, 0x4e, 0x9c, 0xcc, 0x26, 0x28, 0x67, 0x49, 0x1c, 0xca, 0x38, 0x18, 0xbf,
+	0x82, 0x86, 0xee, 0xda, 0xba, 0xe6, 0x51, 0x7d, 0x76, 0x57, 0xd8, 0xdc, 0xf0, 0x26, 0x1d, 0x0e,
+	0x6c, 0x6c, 0xec, 0xca, 0x6f, 0x12, 0x90, 0xe2, 0x4b, 0x28, 0xb7, 0xbe, 0xbe, 0x24, 0x3a, 0x0d,
+	0x42, 0xb9, 0x3c, 0x4f, 0x0e, 0xca, 0x60, 0x58, 0xf5, 0xab, 0x59, 0x84, 0xd8, 0xd8, 0xa8, 0x39,
+	0x54, 0xf3, 0x8e, 0x66, 0x82, 0xcf, 0xa2, 0x92, 0xaf, 0x70, 0x31, 0x2e, 0x15, 0x9f, 0x37, 0xde,
+	0x11, 0xf1, 0xb6, 0x7d, 0x3c, 0x33, 0xa2, 0x88, 0xd5, 0x82, 0xab, 0x9d, 0x9c, 0x1f, 0xd5, 0xe6,
+	0x30, 0x00, 0xe1, 0x70, 0xfc, 0x22, 0x1a, 0x12, 0x53, 0xd1, 0xf2, 0x3d, 0xc8, 0xfc, 0xa8, 0xe5,
+	0x03, 0x49, 0x88, 0x57, 0xff, 0x2c, 0xc3, 0x95, 0x32, 0x47, 0x5b, 0xf4, 0xf8, 0x2a, 0x45, 0xfd,
+	0x52, 0x06, 0x61, 0x26, 0x6c, 0x55, 0x73, 0xdd, 0x1d, 0xcb, 0xd1, 0x6b, 0x5b, 0x9a, 0xb9, 0x79,
+	0x24, 0xaf, 0xa3, 0x7e, 0x39, 0x8f, 0x4e, 0x45, 0x6e, 0x73, 0x8f, 0xf9, 0x78, 0xbb, 0x1a, 0x1d,
+	0x6f, 0x70, 0x68, 0x86, 0xf1, 0x26, 0x1f, 0x9a, 0xf9, 0xc8, 0xfb, 0x08, 0x1a, 0x12, 0xef, 0x5c,
+	0x9f, 0x13, 0x23, 0x0f, 0xb6, 0x5b, 0x43, 0x27, 0x21, 0x02, 0xbf, 0x84, 0x86, 0xc5, 0x0f, 0xb6,
+	0xea, 0xfa, 0x7e, 0x51, 0x18, 0xc7, 0x2e, 0x03, 0x90, 0x08, 0x1a, 0xbf, 0x8c, 0x86, 0xd8, 0xe0,
+	0xdc, 0x84, 0x38, 0xc0, 0x62, 0x18, 0x2e, 0xa7, 0xfb, 0x40, 0x79, 0x49, 0x08, 0x28, 0xd9, 0x52,
+	0x2e, 0x7c, 0xfc, 0xa5, 0x70, 0x29, 0xe7, 0x3e, 0x7e, 0x79, 0x29, 0x17, 0xde, 0xfe, 0xf7, 0x50,
+	0xb9, 0x6a, 0x9a, 0x16, 0x8f, 0x47, 0x75, 0x85, 0x23, 0xab, 0xef, 0x1a, 0x7e, 0x09, 0x82, 0xb8,
+	0x42, 0xfa, 0xd4, 0x45, 0x5c, 0x16, 0x88, 0x67, 0x58, 0x47, 0x6c, 0x1b, 0x74, 0x87, 0x3a, 0x22,
+	0x54, 0x00, 0x9c, 0x79, 0x8e, 0x80, 0xc9, 0x21, 0x5d, 0x3e, 0x1d, 0x9e, 0x45, 0x23, 0xab, 0x8e,
+	0x65, 0x5b, 0x2e, 0xd5, 0xb9, 0xa2, 0xca, 0xc0, 0x78, 0xbe, 0xd7, 0xad, 0x28, 0xb6, 0x40, 0x34,
+	0x40, 0x63, 0x12, 0x7b, 0x94, 0x45, 0xfd, 0x66, 0x26, 0x36, 0x18, 0x8f, 0x70, 0x9e, 0x47, 0x46,
+	0x47, 0xae, 0xcf, 0xe8, 0x50, 0xbf, 0x96, 0x45, 0x65, 0x76, 0x4e, 0x58, 0xb0, 0x9c, 0x1d, 0xcd,
+	0x39, 0x1a, 0xe7, 0xc9, 0xa1, 0xdd, 0xa5, 0x48, 0x66, 0xc8, 0xe0, 0x3e, 0xcc, 0x90, 0xf3, 0x68,
+	0x50, 0xba, 0xfe, 0xe3, 0xce, 0x0c, 0x76, 0xd6, 0x02, 0xa8, 0xfa, 0x7f, 0xb2, 0x08, 0x7d, 0xf6,
+	0xfa, 0xf5, 0xa7, 0x58, 0x41, 0xea, 0xaf, 0x66, 0xd0, 0x98, 0xf0, 0xae, 0x49, 0xf1, 0xce, 0x45,
+	0xdf, 0x2f, 0x9a, 0x09, 0xbd, 0x86, 0xc2, 0x1f, 0x4a, 0x7c, 0x1c, 0x9b, 0x89, 0xf3, 0x0f, 0x0c,
+	0x0f, 0x1c, 0x0c, 0x52, 0xc0, 0x33, 0x15, 0x30, 0x79, 0x26, 0xfa, 0x74, 0xf8, 0x25, 0xdf, 0x6f,
+	0x98, 0x0b, 0x97, 0x1f, 0xc6, 0x30, 0x9f, 0xea, 0x3b, 0x54, 0xbf, 0x35, 0x88, 0x06, 0xe7, 0x1f,
+	0xd0, 0xe6, 0x31, 0xef, 0x1a, 0xe9, 0x34, 0x32, 0x78, 0xc0, 0xd3, 0xc8, 0xe3, 0x5c, 0x84, 0xbc,
+	0x11, 0xf6, 0x67, 0x21, 0xda, 0x7c, 0xac, 0xe7, 0xe3, 0xcd, 0xfb, 0x3d, 0x7d, 0xfc, 0xee, 0xd1,
+	0xfe, 0x3c, 0x87, 0x72, 0x6b, 0xb5, 0xd5, 0x93, 0x71, 0x73, 0xa4, 0xe3, 0x66, 0x6f, 0x47, 0xb3,
+	0x1a, 0xf8, 0x8e, 0x4a, 0x61, 0xec, 0x40, 0xcc, 0x4d, 0xf4, 0x95, 0x2c, 0x1a, 0x5a, 0xeb, 0x6c,
+	0xb8, 0xbb, 0xae, 0x47, 0xdb, 0xc7, 0xbc, 0x37, 0xcf, 0x8b, 0xf3, 0xe0, 0x60, 0xa8, 0x0d, 0x76,
+	0x1e, 0x14, 0xa7, 0xc0, 0x4b, 0xfe, 0xca, 0x28, 0x9d, 0x33, 0x82, 0x95, 0xd1, 0x5f, 0x0f, 0x7f,
+	0x3f, 0x8b, 0xc6, 0x6b, 0x2d, 0x83, 0x9a, 0xde, 0x9c, 0xe1, 0x36, 0x0f, 0x21, 0x52, 0xe2, 0xe8,
+	0xb5, 0x72, 0x30, 0x47, 0xcb, 0x23, 0xc4, 0x9f, 0xa8, 0xff, 0x37, 0x8b, 0xca, 0xd5, 0x8e, 0xb7,
+	0x55, 0xf5, 0x60, 0x73, 0x79, 0x2a, 0xb7, 0xf9, 0xef, 0x64, 0xd0, 0x18, 0x7b, 0x90, 0x75, 0xeb,
+	0x3e, 0x35, 0x0f, 0xe1, 0x18, 0x25, 0x1f, 0x87, 0xb2, 0x8f, 0x79, 0x1c, 0xf2, 0x75, 0x99, 0xdb,
+	0xe7, 0xb1, 0x90, 0x1d, 0xb4, 0xd9, 0x29, 0xe9, 0x09, 0x79, 0x8d, 0x43, 0x38, 0x47, 0x1c, 0xe5,
+	0x6b, 0x7c, 0x2f, 0x83, 0x26, 0xd7, 0x1d, 0xb6, 0x91, 0xeb, 0x62, 0x3f, 0x3f, 0xe6, 0xfd, 0x92,
+	0x7c, 0xa1, 0x63, 0xde, 0x43, 0x3f, 0xc8, 0xa0, 0xb3, 0xd1, 0x17, 0x7a, 0x12, 0x56, 0x81, 0xbf,
+	0xca, 0xa0, 0xd3, 0x6f, 0x42, 0x12, 0x6c, 0xe0, 0x82, 0x7b, 0xf2, 0xde, 0xe8, 0x98, 0x8f, 0xbc,
+	0xef, 0x66, 0xd0, 0xa9, 0x95, 0xfa, 0x5c, 0xed, 0x49, 0xe9, 0xa1, 0xc4, 0xfb, 0x3c, 0x01, 0xfd,
+	0xb3, 0x56, 0xbd, 0xb3, 0xf4, 0x24, 0xf5, 0x4f, 0xe4, 0x7d, 0x8e, 0x79, 0xff, 0xfc, 0xff, 0x02,
+	0x2a, 0xb3, 0x73, 0xad, 0xf0, 0xe9, 0x3d, 0xd5, 0x96, 0xfe, 0x0c, 0x2a, 0x0b, 0x35, 0xc0, 0x91,
+	0x52, 0x8a, 0xe7, 0x17, 0x19, 0xe4, 0x0d, 0x38, 0x5a, 0xca, 0x44, 0xec, 0xc4, 0xf5, 0x0e, 0x75,
+	0x36, 0xe4, 0x18, 0x9a, 0x6d, 0xea, 0x6c, 0x10, 0x80, 0xe2, 0xa5, 0xf0, 0xce, 0xae, 0xba, 0x5a,
+	0x87, 0xc4, 0x57, 0x71, 0x52, 0x85, 0x4c, 0x5e, 0x47, 0xe0, 0x1a, 0x9a, 0x6d, 0xf0, 0x94, 0x59,
+	0x39, 0x7e, 0x2f, 0xce, 0x89, 0x97, 0xd1, 0x84, 0x0f, 0x0b, 0x33, 0x58, 0x4b, 0x29, 0xe2, 0xd2,
+	0x72, 0x57, 0x93, 0xac, 0xf8, 0x0d, 0x34, 0xec, 0x03, 0xdf, 0x32, 0x20, 0xbf, 0x8e, 0x89, 0x7a,
+	0xb6, 0xd7, 0xad, 0x9c, 0x09, 0x44, 0xdd, 0x37, 0x22, 0xf1, 0x89, 0x11, 0x06, 0x59, 0x00, 0x1c,
+	0x3b, 0x51, 0x8a, 0x80, 0xd8, 0x7d, 0x64, 0x84, 0x01, 0xbf, 0x0c, 0x02, 0x6c, 0xcb, 0x74, 0x29,
+	0xf8, 0xf8, 0xca, 0x10, 0x60, 0x02, 0x77, 0x82, 0x8e, 0x80, 0xf3, 0x30, 0xa2, 0x08, 0x19, 0x5e,
+	0x41, 0x28, 0xf4, 0xc5, 0x88, 0x60, 0xcd, 0x7d, 0x7b, 0x89, 0x24, 0x11, 0xea, 0x5f, 0xb3, 0xf3,
+	0x9b, 0x6d, 0x07, 0x23, 0xf9, 0x25, 0x54, 0xa8, 0xda, 0xf6, 0x5d, 0x52, 0x17, 0xde, 0x49, 0x88,
+	0x25, 0xd4, 0x6c, 0xbb, 0xd1, 0x71, 0x0c, 0xf9, 0x42, 0x82, 0x13, 0xe1, 0x1a, 0x1a, 0xa9, 0xda,
+	0xf6, 0x6a, 0x67, 0xa3, 0x65, 0x34, 0xa5, 0xf4, 0x71, 0x5e, 0x83, 0xc0, 0xb6, 0x1b, 0x36, 0x60,
+	0xe2, 0xc9, 0xf7, 0x51, 0x1e, 0xfc, 0x1e, 0x1a, 0xaa, 0xda, 0xb6, 0x48, 0xbe, 0xcf, 0x41, 0xf2,
+	0xbd, 0xea, 0xbf, 0x93, 0xf4, 0x6c, 0x53, 0x01, 0x11, 0x4f, 0xbb, 0x3f, 0x2f, 0x6e, 0x6b, 0x27,
+	0x59, 0x43, 0x89, 0x9c, 0xfb, 0x50, 0x24, 0xfe, 0x38, 0x2a, 0x56, 0x6d, 0x5b, 0x72, 0x0f, 0x80,
+	0x2b, 0x95, 0x71, 0xc5, 0xba, 0xc8, 0x27, 0x3b, 0xf7, 0x1a, 0x1a, 0x8d, 0x36, 0xb6, 0xaf, 0xfc,
+	0xfc, 0x9f, 0x66, 0xe0, 0x85, 0x8e, 0xf9, 0x85, 0xda, 0x0d, 0x94, 0xab, 0xda, 0xb6, 0x58, 0x4e,
+	0x4e, 0xa5, 0xf4, 0x47, 0x3c, 0x5a, 0xab, 0x6a, 0xdb, 0xfe, 0xab, 0xf3, 0x2b, 0xef, 0xa7, 0xeb,
+	0xd5, 0xbf, 0xcd, 0x5f, 0xfd, 0x98, 0xdf, 0x50, 0x7f, 0x2b, 0x87, 0xc6, 0xaa, 0xb6, 0x7d, 0x92,
+	0xb6, 0x7e, 0x58, 0x31, 0x61, 0xd7, 0x11, 0x92, 0x96, 0xc7, 0x62, 0x10, 0xfa, 0x51, 0x96, 0x96,
+	0x46, 0x25, 0x43, 0x24, 0x22, 0x7f, 0xf8, 0x95, 0xf6, 0x35, 0xfc, 0xfe, 0x24, 0xd2, 0x71, 0x90,
+	0x82, 0x7b, 0xd2, 0x71, 0xf9, 0x03, 0x59, 0x54, 0xa3, 0xb2, 0x32, 0x45, 0xc0, 0xb7, 0xb8, 0xa1,
+	0xf7, 0xd3, 0x0f, 0x9a, 0x0c, 0xd5, 0x30, 0x74, 0x12, 0xa3, 0xf5, 0xfb, 0xb0, 0xb8, 0xaf, 0x3e,
+	0xfc, 0x7a, 0x16, 0x4d, 0x84, 0x7d, 0x78, 0x18, 0x86, 0xe9, 0x34, 0x42, 0xdc, 0x49, 0x19, 0x5c,
+	0x24, 0x8e, 0xf0, 0x48, 0x65, 0x17, 0xa0, 0x22, 0x52, 0x39, 0x24, 0x09, 0x6e, 0x15, 0x72, 0xa9,
+	0xb7, 0x0a, 0x57, 0x51, 0x89, 0x68, 0x3b, 0x6f, 0x77, 0xa8, 0xb3, 0x2b, 0xb6, 0x52, 0x70, 0xa5,
+	0x3b, 0xda, 0x4e, 0xe3, 0x8b, 0x0c, 0x48, 0x02, 0x34, 0x56, 0x83, 0x18, 0x35, 0xc9, 0x79, 0xcc,
+	0x63, 0xd4, 0x82, 0xc8, 0x34, 0xa1, 0xa4, 0xc2, 0xbe, 0x94, 0xf4, 0x83, 0x02, 0x1a, 0x9f, 0xd3,
+	0x3c, 0x6d, 0x43, 0x73, 0xa9, 0x74, 0x90, 0x18, 0xf3, 0x61, 0x6c, 0x20, 0x18, 0x41, 0xc9, 0x22,
+	0x88, 0xcb, 0xd2, 0x37, 0x1a, 0x2e, 0x87, 0xca, 0x35, 0x5e, 0x62, 0x0c, 0xf8, 0x53, 0xa1, 0xdc,
+	0xa0, 0xa8, 0x0d, 0x37, 0x67, 0x40, 0x63, 0xfa, 0x46, 0xc3, 0x16, 0x60, 0x92, 0x20, 0xc4, 0xd7,
+	0x50, 0xd9, 0x87, 0x31, 0xe3, 0x29, 0x17, 0xbe, 0xb3, 0xbe, 0xc1, 0x6c, 0x27, 0x22, 0xa3, 0xf1,
+	0x27, 0xd1, 0xb0, 0xff, 0x53, 0x32, 0x4b, 0xc0, 0xd6, 0xd2, 0x37, 0x12, 0x86, 0xa3, 0x4c, 0x2a,
+	0xb3, 0xc2, 0xfc, 0xcc, 0x47, 0x58, 0x63, 0x05, 0xad, 0x22, 0xa4, 0xf8, 0x8b, 0x68, 0xd4, 0xff,
+	0x2d, 0x8c, 0xad, 0x02, 0x18, 0x5b, 0xd7, 0x7c, 0xcd, 0xc7, 0xd5, 0x3a, 0x15, 0x25, 0xe7, 0x66,
+	0xd7, 0xb3, 0xc2, 0xec, 0x3a, 0xa5, 0x6f, 0x24, 0xad, 0xae, 0x58, 0x03, 0xb8, 0x8e, 0x26, 0x7c,
+	0x48, 0xf5, 0xdd, 0x35, 0x42, 0x37, 0xd9, 0xac, 0x2c, 0x86, 0xc6, 0xb2, 0xbe, 0xd1, 0x80, 0x52,
+	0x57, 0x80, 0x90, 0x6d, 0xf6, 0x04, 0x17, 0x6e, 0xa1, 0xf3, 0x11, 0xa0, 0xee, 0x6e, 0x19, 0xf7,
+	0x3c, 0x61, 0xe9, 0xd6, 0xe7, 0xc4, 0x71, 0x00, 0x6a, 0xc1, 0x04, 0x52, 0x39, 0x8d, 0x5f, 0x2c,
+	0xa8, 0x11, 0xa9, 0x9b, 0xb6, 0xa7, 0x34, 0xbc, 0x86, 0x26, 0x7d, 0xfc, 0x9b, 0xb5, 0xd5, 0x55,
+	0xc7, 0xfa, 0x02, 0x6d, 0x7a, 0xf5, 0x39, 0x71, 0x52, 0x80, 0x14, 0x24, 0x7d, 0xa3, 0xb1, 0xd9,
+	0xb4, 0xd9, 0xa0, 0x60, 0xb8, 0xa8, 0xf0, 0x54, 0x66, 0xfc, 0x0e, 0x3a, 0x2d, 0xc1, 0xeb, 0xa6,
+	0xeb, 0x69, 0x66, 0x93, 0xd6, 0xe7, 0xc4, 0xf1, 0x01, 0x8e, 0x32, 0x42, 0xaa, 0x21, 0x90, 0x51,
+	0xb1, 0xe9, 0xec, 0xe7, 0xaa, 0xe8, 0x54, 0x4a, 0x4f, 0xed, 0xcb, 0x66, 0xfd, 0x4a, 0x36, 0x1c,
+	0x1c, 0xc7, 0xdc, 0x70, 0x9d, 0x45, 0x25, 0xff, 0x4d, 0xc4, 0x16, 0xa2, 0xf4, 0x1b, 0xe0, 0x71,
+	0x19, 0x3e, 0x3e, 0xa2, 0x8e, 0x63, 0x6e, 0xcc, 0x1e, 0x86, 0x3a, 0x3e, 0xc8, 0x84, 0xea, 0x38,
+	0xe6, 0x06, 0xee, 0x77, 0x73, 0xe1, 0xcc, 0x3e, 0xb1, 0x72, 0x0f, 0xcb, 0x58, 0x0a, 0x2f, 0x4e,
+	0x0b, 0xfb, 0x08, 0x20, 0x93, 0x87, 0x66, 0xf1, 0x31, 0x87, 0xe6, 0x0f, 0x93, 0xfd, 0xc9, 0x0d,
+	0x90, 0x63, 0xd9, 0x9f, 0x87, 0x30, 0x59, 0xf1, 0x0c, 0x1a, 0xf1, 0xff, 0xe7, 0x96, 0x5a, 0x5e,
+	0xca, 0x87, 0xda, 0x10, 0x86, 0x5a, 0x94, 0x04, 0x7f, 0x0e, 0x9d, 0x89, 0x00, 0x56, 0x35, 0x47,
+	0x6b, 0x53, 0x8f, 0x3a, 0xdc, 0x46, 0x10, 0xe5, 0xe7, 0x7c, 0xee, 0x86, 0x1d, 0xa0, 0xe5, 0x0a,
+	0x6e, 0x7d, 0x24, 0x48, 0x83, 0xa3, 0xb8, 0x8f, 0x5b, 0xf5, 0x7f, 0xca, 0xa2, 0x91, 0x55, 0xcb,
+	0xf5, 0x36, 0x1d, 0xea, 0xae, 0x6a, 0x8e, 0x4b, 0x9f, 0xde, 0x1e, 0xfd, 0x04, 0x1a, 0x81, 0x38,
+	0xd9, 0x36, 0x35, 0x3d, 0xa9, 0x2e, 0x1d, 0xaf, 0xd1, 0xe0, 0x23, 0xc0, 0x6c, 0x24, 0x51, 0x42,
+	0x5c, 0x41, 0x79, 0x3e, 0x06, 0xa4, 0xe8, 0x65, 0x3e, 0x00, 0x38, 0x5c, 0xfd, 0x7a, 0x0e, 0x0d,
+	0xfb, 0x5a, 0x9e, 0x35, 0x8e, 0x6b, 0x16, 0xf0, 0xd1, 0x2a, 0x79, 0x1a, 0xa1, 0x55, 0xcb, 0xf1,
+	0xb4, 0x96, 0x54, 0x12, 0x17, 0x8e, 0x0c, 0x36, 0x40, 0x39, 0x8f, 0x44, 0x82, 0xa7, 0x10, 0x92,
+	0x26, 0x58, 0x11, 0x26, 0xd8, 0x68, 0xaf, 0x5b, 0x41, 0xe1, 0xbc, 0x22, 0x12, 0x85, 0xfa, 0x47,
+	0x59, 0x34, 0xe6, 0x77, 0xd2, 0xfc, 0x03, 0xda, 0xec, 0x78, 0x4f, 0xf1, 0x64, 0x88, 0x6a, 0x3b,
+	0xff, 0x50, 0x6d, 0xab, 0xff, 0x26, 0x2d, 0x24, 0xb5, 0x96, 0x75, 0xb2, 0x90, 0xfc, 0x4f, 0x8c,
+	0x71, 0xf5, 0x67, 0x72, 0x68, 0xd2, 0xd7, 0xfa, 0x42, 0xc7, 0x04, 0x33, 0xa1, 0xa6, 0xb5, 0x5a,
+	0x4f, 0xf3, 0xbe, 0x5c, 0xf6, 0x15, 0xb1, 0x22, 0x12, 0x4f, 0x46, 0xf8, 0x25, 0xdb, 0x3d, 0x01,
+	0x6e, 0x58, 0x86, 0x4e, 0x64, 0x22, 0xfc, 0x06, 0x1a, 0xf6, 0x7f, 0x56, 0x9d, 0x4d, 0x7f, 0x33,
+	0x86, 0xa3, 0x73, 0xc0, 0xa4, 0x39, 0x9b, 0x91, 0x62, 0xc3, 0x32, 0x83, 0xfa, 0xb5, 0x02, 0x3a,
+	0xf7, 0xae, 0x61, 0xea, 0xd6, 0x8e, 0x2b, 0x8a, 0x71, 0x1d, 0x7f, 0xa3, 0xf7, 0xf0, 0x6a, 0xe0,
+	0x84, 0x96, 0x49, 0x7e, 0x1f, 0x66, 0xeb, 0xdb, 0xe8, 0x74, 0x5c, 0xa5, 0x4e, 0x90, 0xef, 0x28,
+	0x7a, 0x67, 0x87, 0x13, 0x34, 0xfc, 0x7a, 0x68, 0xc2, 0xff, 0x44, 0xd2, 0x39, 0xe3, 0x05, 0xd5,
+	0x8a, 0x8f, 0x52, 0x50, 0xed, 0x63, 0xa8, 0x30, 0x67, 0xb5, 0x35, 0xc3, 0x0f, 0xf1, 0x85, 0x59,
+	0x1c, 0xb4, 0x0b, 0x18, 0x22, 0x28, 0x98, 0x7c, 0xd1, 0x30, 0x74, 0xd9, 0x50, 0x28, 0xdf, 0x67,
+	0xe8, 0xb8, 0xd4, 0x21, 0x32, 0x11, 0xb6, 0xd0, 0x88, 0x68, 0x4e, 0x78, 0x8b, 0x10, 0x78, 0x8b,
+	0x5e, 0xf6, 0x75, 0xd4, 0x7f, 0x58, 0x4d, 0x45, 0xf8, 0xb8, 0xdb, 0x08, 0x9e, 0xce, 0x7f, 0x19,
+	0xee, 0x37, 0x22, 0x51, 0xf9, 0x92, 0x12, 0x60, 0x91, 0x29, 0x27, 0x95, 0x00, 0xab, 0x8c, 0x4c,
+	0x74, 0xee, 0x36, 0xc2, 0xc9, 0xc6, 0xf6, 0xe5, 0xf9, 0xf8, 0xf9, 0x2c, 0xc2, 0xb1, 0x03, 0xc4,
+	0xfc, 0x53, 0x6c, 0x07, 0xa9, 0xbf, 0x93, 0x41, 0x13, 0x89, 0x4c, 0x5d, 0x7c, 0x03, 0x21, 0x0e,
+	0x91, 0xb2, 0x6e, 0x21, 0xc7, 0x2e, 0xcc, 0xde, 0x15, 0x7b, 0x40, 0x48, 0x86, 0xa7, 0x51, 0x89,
+	0xff, 0x0a, 0xaa, 0xc0, 0xc7, 0x59, 0x3a, 0x1d, 0x43, 0x27, 0x01, 0x51, 0xd8, 0x0a, 0x7c, 0x0f,
+	0x21, 0x97, 0xca, 0xe2, 0xed, 0xda, 0x41, 0x2b, 0x8c, 0x4c, 0xfd, 0x76, 0x06, 0x0d, 0x07, 0x0f,
+	0x5c, 0xd5, 0x8f, 0xaa, 0xeb, 0x0a, 0x22, 0xe9, 0x39, 0xf7, 0xb0, 0xa4, 0xe7, 0xd8, 0xa2, 0x22,
+	0xb2, 0x9c, 0xff, 0x22, 0x83, 0xc6, 0x02, 0xda, 0x23, 0xf4, 0xb1, 0x1c, 0xf8, 0x45, 0x7e, 0x21,
+	0x83, 0x94, 0x59, 0xa3, 0xd5, 0x32, 0xcc, 0xcd, 0xba, 0x79, 0xcf, 0x72, 0xda, 0x90, 0x5b, 0x78,
+	0x74, 0x4e, 0x34, 0xf5, 0xe7, 0x32, 0x68, 0x42, 0x3c, 0x50, 0x4d, 0x73, 0xf4, 0xa3, 0xf3, 0x6e,
+	0xc6, 0x9f, 0xe4, 0xe8, 0x7a, 0x19, 0xe2, 0xa3, 0x97, 0xac, 0xe6, 0xfd, 0x27, 0x20, 0xcc, 0x9b,
+	0xbd, 0xc6, 0x31, 0x0f, 0x45, 0xfb, 0x72, 0x06, 0x4d, 0x12, 0xda, 0xb4, 0xb6, 0xa9, 0xb3, 0x5b,
+	0xb3, 0x74, 0xfa, 0x26, 0x35, 0xa9, 0x73, 0x54, 0x83, 0xf4, 0x8f, 0xa1, 0xdc, 0x42, 0xf8, 0x30,
+	0x77, 0x5d, 0xaa, 0x1f, 0x9f, 0xda, 0x18, 0xea, 0x1f, 0x14, 0x91, 0x92, 0x6a, 0x99, 0x1c, 0xdb,
+	0x4d, 0xbd, 0xaf, 0xb9, 0x39, 0x78, 0x58, 0xe6, 0x66, 0x7e, 0x7f, 0xe6, 0x66, 0x61, 0xbf, 0xe6,
+	0x66, 0xf1, 0x51, 0xcc, 0xcd, 0x76, 0xdc, 0xdc, 0x2c, 0x81, 0xb9, 0x79, 0x63, 0x4f, 0x73, 0x73,
+	0xde, 0xd4, 0x1f, 0xd3, 0xd8, 0x3c, 0xb6, 0x15, 0x21, 0x1f, 0xc3, 0x4a, 0xc6, 0x57, 0xd8, 0xe2,
+	0xd6, 0xb4, 0x1c, 0x9d, 0xf2, 0x0a, 0x8f, 0x25, 0xee, 0x0d, 0x76, 0x04, 0x8c, 0x04, 0xd8, 0x44,
+	0x79, 0xcd, 0x91, 0x47, 0x29, 0xaf, 0x79, 0x08, 0x56, 0xf8, 0xf7, 0x32, 0x68, 0xa2, 0x46, 0x1d,
+	0xcf, 0xb8, 0x67, 0x34, 0x35, 0xef, 0x30, 0xae, 0x20, 0xab, 0x68, 0x4c, 0x12, 0x28, 0x7d, 0x60,
+	0x0b, 0xf2, 0xa2, 0x9b, 0xd4, 0xf1, 0xc0, 0x94, 0x94, 0x23, 0x02, 0x62, 0xf4, 0xac, 0x79, 0xbf,
+	0xc4, 0x8d, 0x98, 0xbb, 0x41, 0xf3, 0x3e, 0x9c, 0x2b, 0xd2, 0x10, 0xbf, 0x48, 0x40, 0xaf, 0x7e,
+	0x23, 0x83, 0x2e, 0x13, 0x6a, 0xd2, 0x1d, 0x6d, 0xa3, 0x45, 0x25, 0xc1, 0x62, 0x6d, 0x67, 0xf3,
+	0xde, 0x70, 0xdb, 0x9a, 0xd7, 0xdc, 0x3a, 0xd0, 0x5b, 0x2e, 0x44, 0x3f, 0x72, 0xb5, 0x8f, 0xd5,
+	0x29, 0xc2, 0xa7, 0xfe, 0x30, 0x83, 0x8a, 0x77, 0xcd, 0xfb, 0xa6, 0xb5, 0x73, 0xb0, 0x42, 0x48,
+	0x37, 0x50, 0x59, 0x88, 0x91, 0x34, 0xce, 0xbf, 0x5a, 0xc6, 0xc1, 0x0d, 0xfe, 0x69, 0x33, 0x99,
+	0x0a, 0xbf, 0x16, 0x30, 0x41, 0x98, 0x8a, 0xf4, 0x15, 0x2d, 0x9f, 0x29, 0xf6, 0x35, 0x33, 0x99,
+	0x1c, 0x9f, 0x17, 0xdf, 0x18, 0x90, 0x52, 0x3f, 0xd9, 0xa3, 0xf0, 0x4f, 0x0c, 0xa8, 0xbf, 0x72,
+	0x0d, 0xe5, 0x57, 0x4c, 0xba, 0x72, 0x0f, 0x5f, 0x97, 0x8a, 0x3d, 0x89, 0xf7, 0x9a, 0x90, 0xf5,
+	0x04, 0x88, 0xc5, 0x01, 0x22, 0x95, 0x84, 0xba, 0x29, 0x97, 0xe2, 0x11, 0xba, 0xc5, 0x32, 0x0f,
+	0xc7, 0x2c, 0x0e, 0x10, 0xb9, 0x64, 0xcf, 0x4d, 0xb9, 0x56, 0x8d, 0x18, 0x38, 0x11, 0x2e, 0x8e,
+	0xf1, 0xb9, 0x84, 0xf1, 0xb2, 0x94, 0x56, 0x1a, 0x26, 0xee, 0xdd, 0x48, 0x52, 0x2c, 0x0e, 0x90,
+	0xf4, 0x92, 0x32, 0x91, 0x4f, 0xcf, 0x08, 0xff, 0xc6, 0x64, 0x6c, 0xeb, 0x01, 0xdc, 0xe2, 0x00,
+	0x89, 0x7e, 0xa6, 0xe6, 0x56, 0xe4, 0xa3, 0x1e, 0xf1, 0xf0, 0x1c, 0x09, 0xb5, 0x38, 0x40, 0x62,
+	0x9f, 0xff, 0x88, 0x7c, 0x61, 0x42, 0x5c, 0xf7, 0xc4, 0x1b, 0x05, 0x9c, 0xd4, 0x28, 0xff, 0x1a,
+	0xc5, 0xeb, 0xb1, 0xca, 0xef, 0x22, 0xfc, 0xed, 0x74, 0x8c, 0x99, 0x23, 0x17, 0x07, 0x48, 0xac,
+	0x4e, 0xfc, 0x15, 0xbf, 0x18, 0xb8, 0x58, 0xcb, 0x47, 0x25, 0xe3, 0xcd, 0x78, 0x9f, 0x69, 0xc9,
+	0x2f, 0x16, 0x7e, 0x53, 0x2e, 0x02, 0x2d, 0x16, 0x67, 0x1c, 0x6b, 0x65, 0xde, 0xd4, 0x59, 0xef,
+	0x48, 0x96, 0xc3, 0xed, 0x78, 0xb9, 0x54, 0x51, 0x84, 0xf7, 0x99, 0x18, 0xa7, 0xc0, 0x2e, 0x0e,
+	0x90, 0x78, 0x79, 0xd5, 0x5b, 0x91, 0x52, 0x9d, 0x22, 0x76, 0x3b, 0xae, 0x55, 0x86, 0x92, 0xb4,
+	0x0a, 0x45, 0x3d, 0x6f, 0xc7, 0x6b, 0x47, 0x2a, 0x23, 0xa9, 0x4d, 0x0b, 0xac, 0xd4, 0xb4, 0x5f,
+	0x6b, 0xf2, 0x56, 0xa4, 0xc6, 0x1f, 0x94, 0xd1, 0x4d, 0x69, 0x5a, 0xf3, 0x34, 0xb9, 0x69, 0x5e,
+	0x0d, 0x30, 0x52, 0x6d, 0x4e, 0x19, 0x4b, 0xed, 0x50, 0xc0, 0x49, 0x1d, 0xca, 0x2b, 0xd3, 0xdd,
+	0x8a, 0x14, 0x48, 0x51, 0xc6, 0xa3, 0x8d, 0x4a, 0x28, 0xd6, 0xa8, 0x5c, 0x4a, 0xe5, 0xa6, 0x5c,
+	0x37, 0x44, 0x99, 0x88, 0x76, 0x50, 0x88, 0x61, 0x1d, 0x24, 0xd5, 0x17, 0xa9, 0x40, 0x4d, 0x02,
+	0x05, 0x03, 0x79, 0x39, 0x78, 0xc2, 0xda, 0xea, 0xe2, 0x00, 0x81, 0x6a, 0x05, 0x2a, 0xaf, 0x76,
+	0xa1, 0x9c, 0x02, 0x8a, 0xe1, 0xa0, 0x96, 0xe2, 0x03, 0xda, 0x5c, 0x1c, 0x20, 0xbc, 0x12, 0xc6,
+	0x75, 0x29, 0x21, 0x5e, 0x99, 0x8c, 0x2e, 0x11, 0x01, 0x82, 0x2d, 0x11, 0x61, 0xda, 0xfc, 0x42,
+	0x32, 0x69, 0x5c, 0x39, 0x1d, 0x3d, 0x3f, 0xc4, 0xf1, 0x8b, 0x03, 0x24, 0x99, 0x68, 0x7e, 0x2b,
+	0x92, 0x47, 0xad, 0x3c, 0x13, 0x8b, 0x89, 0x0b, 0x51, 0x4c, 0x5d, 0x72, 0xc6, 0xf5, 0x4a, 0x6a,
+	0x1d, 0x27, 0xe5, 0x0c, 0x08, 0x78, 0x36, 0x10, 0x90, 0x24, 0x59, 0x1c, 0x20, 0xa9, 0x15, 0xa0,
+	0x6a, 0x89, 0x6c, 0x66, 0x45, 0x89, 0x1a, 0xae, 0x31, 0xf4, 0xe2, 0x00, 0x49, 0xe4, 0x3f, 0xdf,
+	0x94, 0xd3, 0x88, 0x95, 0xb3, 0xd1, 0x4e, 0x0c, 0x31, 0xac, 0x13, 0xa5, 0x74, 0xe3, 0x9b, 0x72,
+	0xd6, 0xae, 0x72, 0x2e, 0xc9, 0x15, 0xae, 0x9c, 0x52, 0x76, 0x2f, 0x49, 0x4f, 0x92, 0x55, 0x9e,
+	0x05, 0xfe, 0xf3, 0x3e, 0x7f, 0x1a, 0xcd, 0xe2, 0x00, 0x49, 0x4f, 0xb0, 0x25, 0xe9, 0x79, 0xaa,
+	0xca, 0xf9, 0xbd, 0x64, 0x06, 0x4f, 0x97, 0x9e, 0xe3, 0xaa, 0xed, 0x91, 0x2a, 0xaa, 0x3c, 0x17,
+	0xcd, 0xe5, 0xe8, 0x4b, 0xb8, 0x38, 0x40, 0xf6, 0x48, 0x38, 0xbd, 0xdb, 0x27, 0x6f, 0x53, 0xb9,
+	0x10, 0xad, 0xfa, 0x91, 0x4a, 0xb4, 0x38, 0x40, 0xfa, 0x64, 0x7d, 0xde, 0xed, 0x93, 0x3c, 0xa9,
+	0x54, 0xf6, 0x14, 0x1b, 0xe8, 0xa3, 0x4f, 0xea, 0xe5, 0x4a, 0x6a, 0x06, 0xa3, 0x72, 0x31, 0x3a,
+	0x74, 0x53, 0x48, 0xd8, 0xd0, 0x4d, 0xcb, 0x7d, 0x5c, 0x49, 0x4d, 0x21, 0x54, 0x9e, 0xdf, 0x43,
+	0x60, 0xf0, 0x8c, 0xa9, 0xc9, 0x87, 0x2b, 0xa9, 0x39, 0x7c, 0x8a, 0x1a, 0x15, 0x98, 0x42, 0xc2,
+	0x04, 0xa6, 0x65, 0xff, 0xad, 0xa4, 0x26, 0xd1, 0x29, 0x97, 0xf6, 0x10, 0x18, 0x3e, 0x61, 0x5a,
+	0xfa, 0xdd, 0xad, 0x48, 0x16, 0x9b, 0xf2, 0x91, 0xe8, 0xba, 0x21, 0xa1, 0xd8, 0xba, 0x21, 0xe7,
+	0xbb, 0xd5, 0x12, 0x81, 0xfe, 0xca, 0x47, 0xa3, 0xd3, 0x3c, 0x86, 0x66, 0xd3, 0x3c, 0x9e, 0x1a,
+	0x50, 0x4b, 0x04, 0x9d, 0x2b, 0x97, 0xfb, 0x09, 0x01, 0x74, 0x54, 0x08, 0x0f, 0x53, 0xaf, 0xa7,
+	0x44, 0x3d, 0x2b, 0x2f, 0x44, 0xbd, 0x8f, 0x09, 0x82, 0xc5, 0x01, 0x92, 0x12, 0x2b, 0x4d, 0xd2,
+	0x83, 0xbb, 0x94, 0x2b, 0xd1, 0x69, 0x9b, 0x46, 0xc3, 0xa6, 0x6d, 0x6a, 0x60, 0xd8, 0x52, 0xda,
+	0xfd, 0x80, 0x72, 0x35, 0x6a, 0x98, 0x25, 0x29, 0x98, 0x61, 0x96, 0x72, 0xaf, 0x40, 0xd2, 0xc3,
+	0x95, 0x94, 0x8f, 0xed, 0xf9, 0x84, 0x40, 0x93, 0xf2, 0x84, 0x3c, 0x7a, 0x27, 0xb4, 0x9d, 0xee,
+	0xda, 0x2d, 0x4b, 0xd3, 0x95, 0x17, 0x53, 0x6d, 0x27, 0x8e, 0x94, 0x6c, 0x27, 0x0e, 0x60, 0xbb,
+	0xbc, 0xec, 0x3f, 0x57, 0xae, 0x45, 0x77, 0x79, 0x19, 0xc7, 0x76, 0xf9, 0x88, 0xaf, 0xbd, 0x96,
+	0xf0, 0x5a, 0x2b, 0x2f, 0x45, 0x07, 0x40, 0x0c, 0xcd, 0x06, 0x40, 0xdc, 0xcf, 0xfd, 0x5e, 0x7f,
+	0x8f, 0xb1, 0x32, 0x05, 0xd2, 0x2e, 0x06, 0xd5, 0xa2, 0xfb, 0xd0, 0x2d, 0x0e, 0x90, 0xfe, 0x5e,
+	0xe7, 0x7a, 0x8a, 0x03, 0x58, 0x99, 0x8e, 0x0e, 0xb0, 0x04, 0x01, 0x1b, 0x60, 0x49, 0xb7, 0x71,
+	0x3d, 0xc5, 0x83, 0xab, 0x7c, 0xbc, 0xaf, 0xa8, 0xe0, 0x9d, 0x53, 0xfc, 0xbe, 0x37, 0x65, 0x17,
+	0xac, 0x72, 0x3d, 0xba, 0xd9, 0x85, 0x18, 0xb6, 0xd9, 0x49, 0xae, 0xda, 0x9b, 0xb2, 0xc7, 0x53,
+	0x99, 0x49, 0x72, 0x85, 0x5b, 0xa4, 0xe4, 0x19, 0x25, 0xe9, 0x0e, 0x46, 0xe5, 0x46, 0x74, 0xd4,
+	0xa5, 0xd1, 0xb0, 0x51, 0x97, 0xea, 0x9c, 0x5c, 0x48, 0xfa, 0x09, 0x95, 0x9b, 0x71, 0xcf, 0x69,
+	0x14, 0xcf, 0x2c, 0x9f, 0x84, 0x6f, 0xf1, 0x76, 0x3c, 0xf2, 0x58, 0x79, 0x39, 0x6a, 0xdf, 0x46,
+	0xb1, 0xcc, 0xbe, 0x8d, 0x45, 0x2a, 0xdf, 0x8e, 0x07, 0xeb, 0x2a, 0xaf, 0xa4, 0x4b, 0x08, 0xc6,
+	0x4a, 0x3c, 0xb8, 0xf7, 0x76, 0x3c, 0xbe, 0x55, 0xb9, 0x95, 0x2e, 0x21, 0xd0, 0x6e, 0x3c, 0x1e,
+	0xf6, 0xba, 0x94, 0xf3, 0xa7, 0x7c, 0x22, 0x6a, 0x3a, 0x06, 0x08, 0x66, 0x3a, 0x86, 0x99, 0x81,
+	0xd7, 0xa5, 0x5c, 0x39, 0xe5, 0x93, 0x09, 0x96, 0xe0, 0x61, 0xa5, 0x8c, 0xba, 0xeb, 0x52, 0x8e,
+	0x99, 0xf2, 0x6a, 0x82, 0x25, 0x78, 0x3a, 0x29, 0x13, 0x4d, 0xdf, 0x2b, 0x00, 0x40, 0xf9, 0x14,
+	0xc8, 0x50, 0x1f, 0x7e, 0xa7, 0xbb, 0x38, 0x40, 0xf6, 0x0a, 0x24, 0x78, 0xaf, 0xbf, 0xd7, 0x55,
+	0x79, 0x2d, 0x3a, 0x85, 0xfb, 0xd1, 0xb1, 0x29, 0xdc, 0xd7, 0x73, 0xfb, 0x7a, 0x2c, 0x18, 0x50,
+	0x79, 0x3d, 0xba, 0xc4, 0x45, 0x90, 0x6c, 0x89, 0x8b, 0x87, 0x0e, 0x46, 0xa2, 0xdc, 0x94, 0x4f,
+	0x47, 0x97, 0x38, 0x19, 0xc7, 0x96, 0xb8, 0x48, 0x44, 0x5c, 0x2d, 0x11, 0x7c, 0xa5, 0xbc, 0x11,
+	0x5d, 0xe2, 0x62, 0x68, 0xb6, 0xc4, 0xc5, 0xc3, 0xb5, 0x5e, 0x8f, 0xc5, 0x20, 0x29, 0xb7, 0xd3,
+	0x9f, 0x1f, 0x90, 0xf2, 0xf3, 0xf3, 0x88, 0x25, 0x92, 0x1e, 0x4c, 0xa3, 0x54, 0xa3, 0xf3, 0x37,
+	0x8d, 0x86, 0xcd, 0xdf, 0xd4, 0x40, 0x9c, 0x95, 0xd4, 0x9a, 0x9b, 0xca, 0xec, 0x1e, 0x07, 0x87,
+	0xd0, 0x14, 0x49, 0xab, 0xd6, 0x79, 0x3b, 0xfe, 0x9d, 0x31, 0xa5, 0xd6, 0xe7, 0x8c, 0xec, 0x1f,
+	0x83, 0xe2, 0xdf, 0x25, 0xab, 0xa7, 0x38, 0x01, 0x95, 0xb9, 0xe8, 0xea, 0x9a, 0x20, 0x60, 0xab,
+	0x6b, 0xd2, 0x75, 0xb8, 0x90, 0xfc, 0xbc, 0xa3, 0x32, 0x1f, 0xbb, 0x12, 0x8f, 0xe1, 0xd9, 0xea,
+	0x94, 0xf8, 0x24, 0x24, 0x49, 0xff, 0x02, 0xa0, 0xb2, 0x10, 0xdb, 0xaf, 0x53, 0x68, 0x60, 0xbf,
+	0x4e, 0xfb, 0x7a, 0xe0, 0xe7, 0xfa, 0x7e, 0xc8, 0x51, 0x79, 0x13, 0xc4, 0x56, 0xfa, 0x89, 0x15,
+	0x64, 0x8b, 0x03, 0xa4, 0xef, 0xa7, 0x20, 0xef, 0xa2, 0xd3, 0x77, 0x76, 0xd7, 0xde, 0x5e, 0x0a,
+	0xe2, 0xb7, 0x56, 0x1d, 0x6a, 0x6b, 0x0e, 0x55, 0x16, 0xa3, 0xb6, 0x7a, 0x2a, 0x11, 0xb3, 0xd5,
+	0x53, 0x11, 0x49, 0xb1, 0xfe, 0x5c, 0xa8, 0xef, 0x25, 0x36, 0x9c, 0x11, 0xe9, 0xdc, 0x6c, 0x75,
+	0x8a, 0x22, 0x98, 0x82, 0x96, 0x2c, 0x73, 0x13, 0x3c, 0x15, 0x9f, 0x89, 0xae, 0x4e, 0xfd, 0x29,
+	0xd9, 0xea, 0xd4, 0x1f, 0xcb, 0x86, 0x7a, 0x14, 0xcb, 0xe7, 0xe0, 0x5b, 0xd1, 0xa1, 0x9e, 0x42,
+	0xc2, 0x86, 0x7a, 0x0a, 0x38, 0x29, 0x90, 0x50, 0x97, 0x7a, 0xca, 0xd2, 0x5e, 0x02, 0x81, 0x24,
+	0x29, 0x10, 0xc0, 0x49, 0x81, 0x0b, 0xd4, 0x6b, 0x6e, 0x29, 0x77, 0xf6, 0x12, 0x08, 0x24, 0x49,
+	0x81, 0x00, 0x66, 0x87, 0xcd, 0x28, 0x78, 0xb6, 0xd3, 0xba, 0xef, 0xf7, 0xd9, 0x72, 0xf4, 0xb0,
+	0xd9, 0x97, 0x90, 0x1d, 0x36, 0xfb, 0x22, 0xf1, 0x97, 0x1e, 0xd9, 0xc5, 0xad, 0xac, 0x40, 0x83,
+	0x53, 0xa1, 0x5d, 0xf0, 0x28, 0x5c, 0x8b, 0x03, 0xe4, 0x51, 0x5d, 0xe8, 0x2f, 0x06, 0xde, 0x6b,
+	0x65, 0x15, 0x9a, 0x1a, 0x0b, 0x7c, 0x15, 0x1c, 0xbc, 0x38, 0x40, 0x7c, 0x8a, 0xd9, 0x22, 0xca,
+	0xc3, 0x17, 0x34, 0xd4, 0x5f, 0xcb, 0xa0, 0xe1, 0x35, 0xcf, 0xa1, 0x5a, 0x5b, 0x44, 0x76, 0x9d,
+	0x43, 0x25, 0x6e, 0x13, 0x8b, 0xaf, 0x43, 0x0d, 0x91, 0xe0, 0x37, 0xbe, 0x8c, 0x46, 0x97, 0x34,
+	0xd7, 0x03, 0x4e, 0xe9, 0xb3, 0xb7, 0x24, 0x06, 0xc5, 0x4b, 0x9c, 0x8e, 0xf3, 0xc1, 0x05, 0x50,
+	0xee, 0xa1, 0x17, 0x40, 0xa5, 0x0f, 0xba, 0x95, 0x01, 0xb8, 0xe6, 0x89, 0xf1, 0xaa, 0xbd, 0x0c,
+	0x4a, 0x58, 0xeb, 0x8f, 0xef, 0x9d, 0x5f, 0x41, 0x63, 0xb1, 0x4b, 0x47, 0xe1, 0xd4, 0x7e, 0xc4,
+	0x3b, 0xc9, 0x38, 0x37, 0xbe, 0x84, 0x72, 0x77, 0xeb, 0x73, 0x72, 0x45, 0xfb, 0x4e, 0x24, 0x61,
+	0x8d, 0x61, 0xf1, 0x0b, 0x81, 0xc7, 0xf5, 0x2e, 0x59, 0x12, 0x97, 0x8d, 0xf0, 0xd5, 0xad, 0x8e,
+	0xd3, 0x22, 0x12, 0x4a, 0xfd, 0x4e, 0x39, 0xbc, 0x70, 0xc1, 0x97, 0xc5, 0x7d, 0xab, 0x54, 0xe1,
+	0x3f, 0x96, 0xdd, 0xc8, 0xef, 0x57, 0x3f, 0x8d, 0x86, 0xeb, 0x6d, 0x9b, 0x3a, 0xae, 0x65, 0x42,
+	0xed, 0xed, 0x6c, 0x78, 0x7b, 0x60, 0x48, 0x70, 0x39, 0x42, 0x52, 0xa6, 0x0f, 0x0b, 0x87, 0xe7,
+	0x1e, 0x5a, 0x38, 0xfc, 0x2a, 0xca, 0xdf, 0x75, 0xf9, 0x77, 0xe7, 0x03, 0xd2, 0x4e, 0xec, 0x2b,
+	0x5b, 0x9c, 0x02, 0x5f, 0x43, 0x05, 0xb8, 0x42, 0x70, 0x95, 0x3c, 0xd0, 0x42, 0xd6, 0x70, 0x0b,
+	0x20, 0x72, 0x19, 0x0d, 0x4e, 0x83, 0xdf, 0x42, 0xe3, 0x61, 0x4d, 0x0e, 0x28, 0x79, 0xe2, 0x87,
+	0x7a, 0x42, 0xa6, 0xa1, 0xf4, 0xed, 0x79, 0xa8, 0x95, 0x22, 0x8b, 0x48, 0x30, 0xe2, 0x45, 0x34,
+	0x16, 0xc2, 0x98, 0x8a, 0xfc, 0x10, 0xf3, 0x0b, 0xbd, 0x6e, 0xe5, 0x9c, 0x24, 0x8b, 0xa9, 0x53,
+	0x16, 0x15, 0x67, 0xc3, 0xf5, 0xf0, 0xe3, 0x09, 0xa5, 0x87, 0x8e, 0xe1, 0x53, 0xe2, 0x12, 0xb3,
+	0x28, 0x3e, 0x9e, 0x10, 0xfd, 0x64, 0xc2, 0x02, 0x1a, 0x25, 0x56, 0xc7, 0xa3, 0xeb, 0x96, 0x5f,
+	0xe2, 0x96, 0xc7, 0x20, 0xc2, 0x33, 0x39, 0x0c, 0xd3, 0xf0, 0x2c, 0x3f, 0x51, 0x53, 0x4e, 0x28,
+	0x8d, 0x72, 0xe1, 0xe5, 0xb4, 0x6a, 0xb9, 0x52, 0xfa, 0xa4, 0xf4, 0x7a, 0x49, 0x61, 0x29, 0xe5,
+	0x71, 0x7f, 0x36, 0x83, 0x0a, 0xeb, 0x8e, 0x66, 0x78, 0xae, 0x70, 0xe8, 0x9f, 0x9e, 0xda, 0x71,
+	0x34, 0x9b, 0x8d, 0x8f, 0x29, 0xb8, 0xcb, 0x7c, 0x47, 0x6b, 0x75, 0xa8, 0x3b, 0xfb, 0x2e, 0x7b,
+	0xbb, 0xbf, 0xef, 0x56, 0x3e, 0xb5, 0x09, 0x9e, 0xac, 0xa9, 0xa6, 0xd5, 0x9e, 0xde, 0x74, 0xb4,
+	0x6d, 0x83, 0x97, 0x4e, 0xd7, 0x5a, 0xd3, 0x1e, 0x6d, 0x51, 0xdb, 0x72, 0xbc, 0x69, 0xcd, 0x36,
+	0xa6, 0xbd, 0x5d, 0x9b, 0xba, 0xd3, 0x81, 0x24, 0xde, 0x02, 0x1b, 0x02, 0x1e, 0xfc, 0x27, 0x0f,
+	0x01, 0x8e, 0xc3, 0xcb, 0x08, 0x89, 0x57, 0xad, 0xda, 0xb6, 0xb8, 0x1d, 0x90, 0x5c, 0x9f, 0x3e,
+	0x86, 0x0f, 0xec, 0x40, 0x61, 0x9a, 0x2d, 0x17, 0xce, 0x91, 0x24, 0xb0, 0x51, 0xb0, 0x2e, 0x9e,
+	0xc8, 0x57, 0xd3, 0x48, 0xa8, 0x71, 0xff, 0x61, 0x53, 0x94, 0x14, 0x67, 0xc3, 0x1b, 0x68, 0x4c,
+	0xc8, 0x0d, 0x62, 0x0b, 0x47, 0xa3, 0x8b, 0x46, 0x0c, 0xcd, 0x07, 0x6d, 0xf0, 0x8c, 0xba, 0x00,
+	0xcb, 0x6d, 0xc4, 0x38, 0xf0, 0x6c, 0x98, 0xb3, 0x04, 0x55, 0x7a, 0x94, 0x31, 0x18, 0xb1, 0x50,
+	0x44, 0xde, 0xe7, 0xe7, 0xc5, 0x7d, 0xe4, 0x32, 0x32, 0x11, 0x16, 0x59, 0x06, 0x1f, 0xf5, 0xe3,
+	0x29, 0x32, 0xe2, 0x63, 0x3e, 0xca, 0x82, 0x6b, 0x68, 0x24, 0x70, 0x4e, 0xdc, 0x65, 0x2b, 0xdb,
+	0x44, 0x58, 0xcf, 0x26, 0x16, 0xb6, 0x28, 0x0b, 0x89, 0xf0, 0xe0, 0x1b, 0xa8, 0xc4, 0xdd, 0xfb,
+	0x75, 0x7e, 0x1f, 0xe1, 0x5f, 0x39, 0x03, 0xac, 0x61, 0xc8, 0x3d, 0x16, 0x10, 0xe2, 0xd7, 0x51,
+	0xb9, 0xfa, 0xee, 0x1a, 0x5b, 0x67, 0xaa, 0x64, 0xd9, 0x55, 0x4e, 0x85, 0x81, 0xde, 0x90, 0xca,
+	0x6c, 0xb5, 0x68, 0x43, 0x73, 0x22, 0x8b, 0x87, 0x4c, 0x8f, 0xe7, 0x51, 0xec, 0xdb, 0xfc, 0xca,
+	0x64, 0xf8, 0xd5, 0x45, 0x0d, 0x30, 0x0d, 0x51, 0xcb, 0x29, 0x92, 0xaf, 0x1d, 0x65, 0x62, 0xa3,
+	0x66, 0xce, 0x70, 0xb5, 0x56, 0xcb, 0xda, 0x21, 0xd4, 0x70, 0xdd, 0x0e, 0x85, 0xcb, 0x8c, 0x12,
+	0x1f, 0x35, 0xba, 0x40, 0x35, 0x1c, 0x8e, 0x8b, 0x64, 0xd3, 0x47, 0xd9, 0xd4, 0xff, 0xcc, 0xc8,
+	0x03, 0x3a, 0xa8, 0xcf, 0x9b, 0x49, 0xad, 0xcf, 0x7b, 0x0d, 0x0d, 0x89, 0x6d, 0x20, 0x88, 0x14,
+	0x85, 0x7c, 0x18, 0x3f, 0x1e, 0xc2, 0xd0, 0x49, 0x48, 0x00, 0xb9, 0x08, 0x61, 0x49, 0x8d, 0x9c,
+	0x94, 0x8b, 0x10, 0x96, 0xd4, 0x88, 0x14, 0xd4, 0x98, 0x41, 0x65, 0x31, 0x98, 0xa5, 0x6c, 0x7b,
+	0x88, 0x69, 0xf0, 0x33, 0xc3, 0x79, 0xc8, 0x84, 0x44, 0x84, 0x5f, 0x45, 0x28, 0xd4, 0xaf, 0xd8,
+	0xb4, 0x60, 0xee, 0xc9, 0xdd, 0x21, 0xcf, 0xbd, 0x90, 0x5a, 0xfd, 0xbb, 0x4c, 0x62, 0xca, 0xb0,
+	0x67, 0x10, 0xd1, 0x37, 0x92, 0x1e, 0xe0, 0x19, 0x44, 0xac, 0x8e, 0x78, 0x06, 0x89, 0x08, 0x5f,
+	0x41, 0xa5, 0x58, 0x25, 0x02, 0x88, 0x36, 0x08, 0xca, 0x10, 0x04, 0x58, 0x3c, 0x83, 0x4a, 0x6c,
+	0x00, 0x33, 0x11, 0x42, 0x21, 0x50, 0xe3, 0xa8, 0x23, 0x60, 0xf2, 0x88, 0xf3, 0xe9, 0x18, 0x4f,
+	0x24, 0x58, 0x58, 0xf0, 0xa4, 0x4c, 0xd7, 0x30, 0x38, 0xf8, 0xf7, 0xb2, 0x7d, 0x4e, 0x17, 0x4f,
+	0x6f, 0x5a, 0x47, 0x90, 0x62, 0x97, 0xef, 0x93, 0x62, 0xf7, 0xef, 0xd9, 0x3e, 0x47, 0xa7, 0xa7,
+	0x3a, 0x15, 0x26, 0x50, 0x46, 0x34, 0x15, 0x26, 0xcc, 0x42, 0x32, 0x74, 0x22, 0x13, 0xc5, 0x92,
+	0xe6, 0x0a, 0x0f, 0x4d, 0x9a, 0xfb, 0xad, 0xdc, 0x5e, 0x47, 0xcb, 0x13, 0xdd, 0xef, 0x47, 0xf7,
+	0x33, 0xa8, 0x1c, 0x68, 0x56, 0x14, 0xc2, 0x19, 0x09, 0x82, 0xc2, 0x38, 0x18, 0x78, 0x24, 0x22,
+	0x7c, 0x95, 0x3f, 0x2b, 0x7c, 0x53, 0xbc, 0x08, 0x0c, 0x50, 0x2b, 0x86, 0x3d, 0x5b, 0xc3, 0x35,
+	0xde, 0xa7, 0x24, 0x40, 0xab, 0x7f, 0x9a, 0x4d, 0x3d, 0x9f, 0x9f, 0xf4, 0xd1, 0x3e, 0xfa, 0x28,
+	0x45, 0x89, 0xdc, 0xb3, 0x70, 0xa2, 0xc4, 0x7d, 0x28, 0xf1, 0x27, 0xd9, 0x54, 0x3f, 0xcc, 0x89,
+	0x12, 0xf7, 0xb3, 0x5a, 0x5c, 0x43, 0x43, 0xc4, 0xda, 0x71, 0x6b, 0x56, 0xc7, 0xf4, 0xc4, 0x5a,
+	0x01, 0x0b, 0xb5, 0x63, 0xed, 0xb8, 0x8d, 0x26, 0x83, 0x92, 0x90, 0x40, 0xfd, 0x69, 0x76, 0x0f,
+	0x4f, 0xd5, 0x89, 0xe2, 0x3f, 0xc4, 0x2d, 0xf2, 0x63, 0x2f, 0xa0, 0xb2, 0xf4, 0x29, 0x59, 0x3c,
+	0x8c, 0x4a, 0x2b, 0xb3, 0x6b, 0xf3, 0xe4, 0x9d, 0xf9, 0xb9, 0xf1, 0x01, 0x8c, 0x50, 0x61, 0x6e,
+	0x7e, 0xb9, 0x3e, 0x3f, 0x37, 0x9e, 0x99, 0x1d, 0xff, 0xe0, 0x1f, 0x2f, 0x0c, 0x7c, 0xf0, 0xe3,
+	0x0b, 0x99, 0xef, 0xff, 0xf8, 0x42, 0xe6, 0x1f, 0x7e, 0x7c, 0x21, 0xb3, 0x51, 0x00, 0x23, 0xf4,
+	0xc6, 0x7f, 0x07, 0x00, 0x00, 0xff, 0xff, 0x7f, 0xeb, 0x35, 0x7a, 0x97, 0x97, 0x00, 0x00,
 }
 
 func (m *Metadata) Marshal() (dAtA []byte, err error) {
@@ -11871,6 +11941,13 @@ func (m *WindowsDesktopSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.DesktopName) > 0 {
+		i -= len(m.DesktopName)
+		copy(dAtA[i:], m.DesktopName)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
+		i--
+		dAtA[i] = 0x5a
+	}
 	if len(m.DesktopLabels) > 0 {
 		for k := range m.DesktopLabels {
 			v := m.DesktopLabels[k]
@@ -12808,6 +12885,64 @@ func (m *RenewableCertificateGenerationMismatch) MarshalToSizedBuffer(dAtA []byt
 	return len(dAtA) - i, nil
 }
 
+func (m *Unknown) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Unknown) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.UnknownCode) > 0 {
+		i -= len(m.UnknownCode)
+		copy(dAtA[i:], m.UnknownCode)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UnknownCode)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.UnknownType) > 0 {
+		i -= len(m.UnknownType)
+		copy(dAtA[i:], m.UnknownType)
+		i = encodeVarintEvents(dAtA, i, uint64(len(m.UnknownType)))
+		i--
+		dAtA[i] = 0x12
+	}
+	{
+		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintEvents(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *OneOf) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -14631,6 +14766,29 @@ func (m *OneOf_RenewableCertificateGenerationMismatch) MarshalToSizedBuffer(dAtA
 	}
 	return len(dAtA) - i, nil
 }
+func (m *OneOf_Unknown) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OneOf_Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Unknown != nil {
+		{
+			size, err := m.Unknown.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintEvents(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x5
+		i--
+		dAtA[i] = 0x82
+	}
+	return len(dAtA) - i, nil
+}
 func (m *StreamStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -14655,12 +14813,12 @@ func (m *StreamStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n355, err355 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUploadTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUploadTime):])
-	if err355 != nil {
-		return 0, err355
+	n357, err357 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUploadTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUploadTime):])
+	if err357 != nil {
+		return 0, err357
 	}
-	i -= n355
-	i = encodeVarintEvents(dAtA, i, uint64(n355))
+	i -= n357
+	i = encodeVarintEvents(dAtA, i, uint64(n357))
 	i--
 	dAtA[i] = 0x1a
 	if m.LastEventIndex != 0 {
@@ -14890,12 +15048,12 @@ func (m *Identity) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x4a
 	}
-	n361, err361 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err361 != nil {
-		return 0, err361
+	n363, err363 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err363 != nil {
+		return 0, err363
 	}
-	i -= n361
-	i = encodeVarintEvents(dAtA, i, uint64(n361))
+	i -= n363
+	i = encodeVarintEvents(dAtA, i, uint64(n363))
 	i--
 	dAtA[i] = 0x42
 	if len(m.KubernetesUsers) > 0 {
@@ -17522,6 +17680,10 @@ func (m *WindowsDesktopSessionStart) Size() (n int) {
 			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
 		}
 	}
+	l = len(m.DesktopName)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -17823,6 +17985,32 @@ func (m *RenewableCertificateGenerationMismatch) Size() (n int) {
 	return n
 }
 
+func (m *Unknown) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Metadata.Size()
+	n += 1 + l + sovEvents(uint64(l))
+	l = len(m.UnknownType)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.UnknownCode)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + sovEvents(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *OneOf) Size() (n int) {
 	if m == nil {
 		return 0
@@ -18786,6 +18974,18 @@ func (m *OneOf_RenewableCertificateGenerationMismatch) Size() (n int) {
 	}
 	return n
 }
+func (m *OneOf_Unknown) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Unknown != nil {
+		l = m.Unknown.Size()
+		n += 2 + l + sovEvents(uint64(l))
+	}
+	return n
+}
 func (m *StreamStatus) Size() (n int) {
 	if m == nil {
 		return 0
@@ -35136,6 +35336,38 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 			}
 			m.DesktopLabels[mapkey] = mapvalue
 			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DesktopName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -37530,6 +37762,186 @@ func (m *RenewableCertificateGenerationMismatch) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *Unknown) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowEvents
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Unknown: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Unknown: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UnknownType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UnknownType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UnknownCode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UnknownCode = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipEvents(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *OneOf) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -40324,6 +40736,41 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			}
 			m.Event = &OneOf_RenewableCertificateGenerationMismatch{v}
 			iNdEx = postIndex
+		case 80:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Unknown", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowEvents
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthEvents
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthEvents
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &Unknown{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Event = &OneOf_Unknown{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
diff --git a/api/types/events/events.proto b/api/types/events/events.proto
index 6cdcd923ddbd2..7a1e69e52b463 100644
--- a/api/types/events/events.proto
+++ b/api/types/events/events.proto
@@ -1573,6 +1573,8 @@ message WindowsDesktopSessionStart {
     string WindowsUser = 9 [ (gogoproto.jsontag) = "windows_user" ];
     // DesktopLabels are the labels on the desktop resource.
     map<string, string> DesktopLabels = 10 [ (gogoproto.jsontag) = "desktop_labels" ];
+    // DesktopName is the name of the desktop resource.
+    string DesktopName = 11 [ (gogoproto.jsontag) = "desktop_name" ];
 }
 
 // DatabaseSessionEnd is emitted when a user ends the database session.
@@ -1782,6 +1784,22 @@ message RenewableCertificateGenerationMismatch {
         [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
 }
 
+// Unknown is a fallback event used when we don't recognize an event from the backend.
+message Unknown {
+    // Metadata is a common event metadata.
+    Metadata Metadata = 1
+        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
+
+    // UnknownType is the event type extracted from the unknown event.
+    string UnknownType = 2 [ (gogoproto.jsontag) = "unknown_event" ];
+
+    // UnknownCode is the event code extracted from the unknown event.
+    string UnknownCode = 3 [ (gogoproto.jsontag) = "unknown_code,omitempty" ];
+
+    // Data is the serialized JSON data of the unknown event.
+    string Data = 4 [ (gogoproto.jsontag) = "data" ];
+}
+
 // OneOf is a union of one of audit events submitted to the auth service
 message OneOf {
     // Event is one of the audit events
@@ -1865,6 +1883,7 @@ message OneOf {
         events.MySQLStatementFetch MySQLStatementFetch = 77;
         events.MySQLStatementBulkExecute MySQLStatementBulkExecute = 78;
         events.RenewableCertificateGenerationMismatch RenewableCertificateGenerationMismatch = 79;
+        events.Unknown Unknown = 80;
     }
 }
 
diff --git a/api/types/events/oneof.go b/api/types/events/oneof.go
index 5d3476d536e9d..8181e7c98bcc0 100644
--- a/api/types/events/oneof.go
+++ b/api/types/events/oneof.go
@@ -17,9 +17,11 @@ limitations under the License.
 package events
 
 import (
+	"encoding/json"
 	"reflect"
 
 	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
 )
 
 // MustToOneOf converts audit event to OneOf
@@ -353,8 +355,28 @@ func ToOneOf(in AuditEvent) (*OneOf, error) {
 		out.Event = &OneOf_RenewableCertificateGenerationMismatch{
 			RenewableCertificateGenerationMismatch: e,
 		}
+	case *Unknown:
+		out.Event = &OneOf_Unknown{
+			Unknown: e,
+		}
 	default:
-		return nil, trace.BadParameter("event type %T is not supported", in)
+		log.Errorf("Attempted to convert dynamic event of unknown type \"%v\" into protobuf event.", in.GetType())
+		unknown := &Unknown{}
+		unknown.Type = UnknownEvent
+		unknown.Code = UnknownCode
+		unknown.Time = in.GetTime()
+		unknown.ClusterName = in.GetClusterName()
+		unknown.UnknownType = in.GetType()
+		unknown.UnknownCode = in.GetCode()
+		data, err := json.Marshal(in)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		unknown.Data = string(data)
+		out.Event = &OneOf_Unknown{
+			Unknown: unknown,
+		}
 	}
 	return &out, nil
 }
diff --git a/api/types/events/unknown.go b/api/types/events/unknown.go
new file mode 100644
index 0000000000000..d2f55cacd24a4
--- /dev/null
+++ b/api/types/events/unknown.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2021 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package events
+
+const (
+	// UnknownEvent is any event received that isn't recognized as any other event type.
+	UnknownEvent = "unknown"
+
+	// UnknownCode is used when an event of unknown type is encountered.
+	UnknownCode = "TCC00E"
+)
diff --git a/api/types/kubernetes.go b/api/types/kubernetes.go
index 13e5c7545c946..511f527defa29 100644
--- a/api/types/kubernetes.go
+++ b/api/types/kubernetes.go
@@ -18,6 +18,7 @@ package types
 
 import (
 	"fmt"
+	"sort"
 	"time"
 
 	"github.com/gogo/protobuf/proto"
@@ -25,6 +26,30 @@ import (
 	"github.com/gravitational/trace"
 )
 
+// KubeCluster represents a kubernetes cluster.
+type KubeCluster interface {
+	// ResourceWithLabels provides common resource methods.
+	ResourceWithLabels
+	// GetNamespace returns the kube cluster namespace.
+	GetNamespace() string
+	// GetStaticLabels returns the kube cluster static labels.
+	GetStaticLabels() map[string]string
+	// SetStaticLabels sets the kube cluster static labels.
+	SetStaticLabels(map[string]string)
+	// GetDynamicLabels returns the kube cluster dynamic labels.
+	GetDynamicLabels() map[string]CommandLabel
+	// SetDynamicLabels sets the kube cluster dynamic labels.
+	SetDynamicLabels(map[string]CommandLabel)
+	// LabelsString returns all labels as a string.
+	LabelsString() string
+	// String returns string representation of the kube cluster.
+	String() string
+	// GetDescription returns the kube cluster description.
+	GetDescription() string
+	// Copy returns a copy of this kube cluster resource.
+	Copy() *KubernetesClusterV3
+}
+
 // NewKubernetesClusterV3FromLegacyCluster creates a new Kubernetes cluster resource
 // from the legacy type.
 func NewKubernetesClusterV3FromLegacyCluster(namespace string, cluster *KubernetesCluster) (*KubernetesClusterV3, error) {
@@ -192,3 +217,76 @@ func (k *KubernetesClusterV3) CheckAndSetDefaults() error {
 
 	return nil
 }
+
+// KubeClusters represents a list of kube clusters.
+type KubeClusters []KubeCluster
+
+// Len returns the slice length.
+func (s KubeClusters) Len() int { return len(s) }
+
+// Less compares kube clusters by name.
+func (s KubeClusters) Less(i, j int) bool {
+	return s[i].GetName() < s[j].GetName()
+}
+
+// Swap swaps two kube clusters.
+func (s KubeClusters) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
+
+// SortByCustom custom sorts by given sort criteria.
+func (s KubeClusters) SortByCustom(sortBy SortBy) error {
+	if sortBy.Field == "" {
+		return nil
+	}
+
+	isDesc := sortBy.IsDesc
+	switch sortBy.Field {
+	case ResourceMetadataName:
+		sort.SliceStable(s, func(i, j int) bool {
+			return stringCompare(s[i].GetName(), s[j].GetName(), isDesc)
+		})
+	default:
+		return trace.NotImplemented("sorting by field %q for resource %q is not supported", sortBy.Field, KindKubernetesCluster)
+	}
+
+	return nil
+}
+
+// AsResources returns as type resources with labels.
+func (s KubeClusters) AsResources() []ResourceWithLabels {
+	resources := make([]ResourceWithLabels, 0, len(s))
+	for _, cluster := range s {
+		resources = append(resources, ResourceWithLabels(cluster))
+	}
+	return resources
+}
+
+// GetFieldVals returns list of select field values.
+func (s KubeClusters) GetFieldVals(field string) ([]string, error) {
+	vals := make([]string, 0, len(s))
+	switch field {
+	case ResourceMetadataName:
+		for _, server := range s {
+			vals = append(vals, server.GetName())
+		}
+	default:
+		return nil, trace.NotImplemented("getting field %q for resource %q is not supported", field, KindKubernetesCluster)
+	}
+
+	return vals, nil
+}
+
+// DeduplicateKubeClusters deduplicates kube clusters by name.
+func DeduplicateKubeClusters(kubeclusters []KubeCluster) []KubeCluster {
+	seen := make(map[string]struct{})
+	result := make([]KubeCluster, 0, len(kubeclusters))
+
+	for _, cluster := range kubeclusters {
+		if _, ok := seen[cluster.GetName()]; ok {
+			continue
+		}
+		seen[cluster.GetName()] = struct{}{}
+		result = append(result, cluster)
+	}
+
+	return result
+}
diff --git a/api/types/kubernetes_test.go b/api/types/kubernetes_test.go
new file mode 100644
index 0000000000000..2931ebf626a0f
--- /dev/null
+++ b/api/types/kubernetes_test.go
@@ -0,0 +1,84 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+import (
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestKubeClustersSorter(t *testing.T) {
+	t.Parallel()
+
+	makeClusters := func(testVals []string, testField string) []KubeCluster {
+		servers := make([]KubeCluster, len(testVals))
+		for i := 0; i < len(testVals); i++ {
+			var err error
+			servers[i], err = NewKubernetesClusterV3FromLegacyCluster("_", &KubernetesCluster{
+				Name: testVals[i],
+			})
+			require.NoError(t, err)
+		}
+		return servers
+	}
+
+	testValsUnordered := []string{"d", "b", "a", "c"}
+
+	// Test descending.
+	sortBy := SortBy{Field: ResourceMetadataName, IsDesc: true}
+	clusters := KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
+	require.NoError(t, clusters.SortByCustom(sortBy))
+	targetVals, err := clusters.GetFieldVals(ResourceMetadataName)
+	require.NoError(t, err)
+	require.IsDecreasing(t, targetVals)
+
+	// Test ascending.
+	sortBy = SortBy{Field: ResourceMetadataName}
+	clusters = KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
+	require.NoError(t, clusters.SortByCustom(sortBy))
+	targetVals, err = clusters.GetFieldVals(ResourceMetadataName)
+	require.NoError(t, err)
+	require.IsIncreasing(t, targetVals)
+
+	// Test error.
+	sortBy = SortBy{Field: "unsupported"}
+	clusters = KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
+	require.True(t, trace.IsNotImplemented(clusters.SortByCustom(sortBy)))
+}
+
+func TestDeduplicateKubeClusters(t *testing.T) {
+	t.Parallel()
+
+	expected := []KubeCluster{
+		&KubernetesClusterV3{Metadata: Metadata{Name: "a"}},
+		&KubernetesClusterV3{Metadata: Metadata{Name: "b"}},
+		&KubernetesClusterV3{Metadata: Metadata{Name: "c"}},
+	}
+
+	extra := []KubeCluster{
+		&KubernetesClusterV3{Metadata: Metadata{Name: "a"}},
+		&KubernetesClusterV3{Metadata: Metadata{Name: "a"}},
+		&KubernetesClusterV3{Metadata: Metadata{Name: "b"}},
+	}
+
+	clusters := append(expected, extra...)
+
+	result := DeduplicateKubeClusters(clusters)
+	require.ElementsMatch(t, result, expected)
+}
diff --git a/api/types/resource.go b/api/types/resource.go
index ef52ae8ca0f01..65c18167cff4c 100644
--- a/api/types/resource.go
+++ b/api/types/resource.go
@@ -90,14 +90,21 @@ type ResourceWithLabels interface {
 // ResourcesWithLabels is a list of labeled resources.
 type ResourcesWithLabels []ResourceWithLabels
 
-// Find returns resource with the specified name or nil.
-func (r ResourcesWithLabels) Find(name string) ResourceWithLabels {
-	for _, resource := range r {
-		if resource.GetName() == name {
-			return resource
-		}
+// ResourcesWithLabelsMap is like ResourcesWithLabels, but a map from resource name to its value.
+type ResourcesWithLabelsMap map[string]ResourceWithLabels
+
+// ToMap returns these databases as a map keyed by database name.
+func (r ResourcesWithLabels) ToMap() ResourcesWithLabelsMap {
+	rm := make(ResourcesWithLabelsMap, len(r))
+
+	// there may be duplicate resources in the input list.
+	// by iterating from end to start, the first resource of given name wins.
+	for i := len(r) - 1; i >= 0; i-- {
+		resource := r[i]
+		rm[resource.GetName()] = resource
 	}
-	return nil
+
+	return rm
 }
 
 // Len returns the slice length.
@@ -148,6 +155,32 @@ func (r ResourcesWithLabels) AsDatabaseServers() ([]DatabaseServer, error) {
 	return dbs, nil
 }
 
+// AsWindowsDesktops converts each resource into type WindowsDesktop.
+func (r ResourcesWithLabels) AsWindowsDesktops() ([]WindowsDesktop, error) {
+	desktops := make([]WindowsDesktop, 0, len(r))
+	for _, resource := range r {
+		desktop, ok := resource.(WindowsDesktop)
+		if !ok {
+			return nil, trace.BadParameter("expected types.WindowsDesktop, got: %T", resource)
+		}
+		desktops = append(desktops, desktop)
+	}
+	return desktops, nil
+}
+
+// AsKubeClusters converts each resource into type KubeCluster.
+func (r ResourcesWithLabels) AsKubeClusters() ([]KubeCluster, error) {
+	clusters := make([]KubeCluster, 0, len(r))
+	for _, resource := range r {
+		cluster, ok := resource.(KubeCluster)
+		if !ok {
+			return nil, trace.BadParameter("expected types.KubeCluster, got: %T", resource)
+		}
+		clusters = append(clusters, cluster)
+	}
+	return clusters, nil
+}
+
 // GetVersion returns resource version
 func (h *ResourceHeader) GetVersion() string {
 	return h.Version
diff --git a/api/types/resource_test.go b/api/types/resource_test.go
index b0f9c9bb4146a..9dd7c9e88b80f 100644
--- a/api/types/resource_test.go
+++ b/api/types/resource_test.go
@@ -322,3 +322,53 @@ func TestMatchSearch_ResourceSpecific(t *testing.T) {
 		})
 	}
 }
+
+func TestResourcesWithLabels_ToMap(t *testing.T) {
+	mkServerHost := func(name string, hostname string) ResourceWithLabels {
+		server, err := NewServerWithLabels(name, KindNode, ServerSpecV2{
+			Hostname: hostname + ".example.com",
+			Addr:     name + ".example.com",
+		}, nil)
+		require.NoError(t, err)
+
+		return server
+	}
+
+	mkServer := func(name string) ResourceWithLabels {
+		return mkServerHost(name, name)
+	}
+
+	tests := []struct {
+		name string
+		r    ResourcesWithLabels
+		want ResourcesWithLabelsMap
+	}{
+		{
+			name: "empty",
+			r:    nil,
+			want: map[string]ResourceWithLabels{},
+		},
+		{
+			name: "simple list",
+			r:    []ResourceWithLabels{mkServer("a"), mkServer("b"), mkServer("c")},
+			want: map[string]ResourceWithLabels{
+				"a": mkServer("a"),
+				"b": mkServer("b"),
+				"c": mkServer("c"),
+			},
+		},
+		{
+			name: "first duplicate wins",
+			r:    []ResourceWithLabels{mkServerHost("a", "a1"), mkServerHost("a", "a2"), mkServerHost("a", "a3")},
+			want: map[string]ResourceWithLabels{
+				"a": mkServerHost("a", "a1"),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.r.ToMap(), tt.want)
+		})
+	}
+}
diff --git a/api/types/role.go b/api/types/role.go
index 2f4d0ad9af991..0953b122624a7 100644
--- a/api/types/role.go
+++ b/api/types/role.go
@@ -159,11 +159,11 @@ type Role interface {
 	GetSessionPolicySet() SessionTrackerPolicySet
 }
 
-// NewRole constructs new standard V3 role.
-// This is mostly a legacy function and will create a role with V3 RBAC semantics.
+// NewRole constructs new standard V5 role.
+// This creates a V5 role with V4+ RBAC semantics.
 func NewRole(name string, spec RoleSpecV5) (Role, error) {
 	role := RoleV5{
-		Version: V3,
+		Version: V5,
 		Metadata: Metadata{
 			Name: name,
 		},
@@ -175,11 +175,11 @@ func NewRole(name string, spec RoleSpecV5) (Role, error) {
 	return &role, nil
 }
 
-// NewRoleV5 constructs new standard V5 role.
-// This creates a V5 role with V4+ RBAC semantics. This should be preferred over `NewRole`.
-func NewRoleV5(name string, spec RoleSpecV5) (Role, error) {
+// NewRoleV3 constructs new standard V3 role.
+// This is mostly a legacy function and will create a role with V3 RBAC semantics.
+func NewRoleV3(name string, spec RoleSpecV5) (Role, error) {
 	role := RoleV5{
-		Version: V5,
+		Version: V3,
 		Metadata: Metadata{
 			Name: name,
 		},
@@ -604,11 +604,8 @@ func (r *RoleV5) SetRules(rct RoleConditionType, in []Rule) {
 // setStaticFields sets static resource header and metadata fields.
 func (r *RoleV5) setStaticFields() {
 	r.Kind = KindRole
-	// TODO(Joerger/nklaassen) Role should default to V4
-	// but shouldn't overwrite V3. For now, this does the
-	// opposite due to an internal reliance on V3 defaults.
-	if r.Version != V4 && r.Version != V5 {
-		r.Version = V3
+	if r.Version != V3 && r.Version != V4 {
+		r.Version = V5
 	}
 }
 
diff --git a/api/types/server_test.go b/api/types/server_test.go
index b5de2617ae0e4..4b145d7bb0ad2 100644
--- a/api/types/server_test.go
+++ b/api/types/server_test.go
@@ -76,8 +76,6 @@ func TestServerSorter(t *testing.T) {
 	for _, c := range cases {
 		c := c
 		t.Run(fmt.Sprintf("%s desc", c.name), func(t *testing.T) {
-			t.Parallel()
-
 			sortBy := SortBy{Field: c.fieldName, IsDesc: true}
 			servers := Servers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
@@ -87,8 +85,6 @@ func TestServerSorter(t *testing.T) {
 		})
 
 		t.Run(fmt.Sprintf("%s asc", c.name), func(t *testing.T) {
-			t.Parallel()
-
 			sortBy := SortBy{Field: c.fieldName}
 			servers := Servers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
diff --git a/api/types/types.pb.go b/api/types/types.pb.go
index b8185b731b525..29ee65f6c47ad 100644
--- a/api/types/types.pb.go
+++ b/api/types/types.pb.go
@@ -8156,7 +8156,9 @@ type WindowsDesktopServiceSpecV3 struct {
 	// Addr is the address that this service can be reached at.
 	Addr string `protobuf:"bytes,1,opt,name=Addr,proto3" json:"addr"`
 	// TeleportVersion is teleport binary version running this service.
-	TeleportVersion      string   `protobuf:"bytes,2,opt,name=TeleportVersion,proto3" json:"teleport_version"`
+	TeleportVersion string `protobuf:"bytes,2,opt,name=TeleportVersion,proto3" json:"teleport_version"`
+	// Hostname is the desktop service hostname.
+	Hostname             string   `protobuf:"bytes,3,opt,name=Hostname,proto3" json:"hostname"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -8195,8 +8197,11 @@ func (m *WindowsDesktopServiceSpecV3) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_WindowsDesktopServiceSpecV3 proto.InternalMessageInfo
 
+// WindowsDesktopFilter are filters to apply when searching for windows desktops.
 type WindowsDesktopFilter struct {
-	HostID               string   `protobuf:"bytes,1,opt,name=HostID,proto3" json:"host_id"`
+	// HostID is the ID of the host the Windows Desktop Service proxying the desktop.
+	HostID string `protobuf:"bytes,1,opt,name=HostID,proto3" json:"host_id"`
+	// Name is the name of the desktop.
 	Name                 string   `protobuf:"bytes,2,opt,name=Name,proto3" json:"name"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
@@ -9000,730 +9005,731 @@ func init() {
 func init() { proto.RegisterFile("types.proto", fileDescriptor_d938547f84707355) }
 
 var fileDescriptor_d938547f84707355 = []byte{
-	// 11557 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xdc, 0x7d, 0x6d, 0x6c, 0x1c, 0x49,
-	0x76, 0x98, 0x7a, 0x66, 0x48, 0xce, 0x3c, 0x0e, 0xc9, 0x61, 0x51, 0x1f, 0x94, 0x56, 0xbb, 0xa3,
-	0xeb, 0xfd, 0x92, 0x74, 0xbb, 0xe2, 0x89, 0xba, 0x95, 0xbd, 0xb7, 0x5f, 0x37, 0x43, 0x52, 0x12,
-	0x57, 0x14, 0xc9, 0xed, 0xe1, 0xc7, 0x9d, 0xef, 0xce, 0xed, 0xe6, 0x74, 0x89, 0xec, 0xe5, 0xcc,
-	0xf4, 0xb8, 0xbb, 0x47, 0x12, 0xed, 0x18, 0x76, 0x10, 0x38, 0x86, 0x61, 0xf8, 0x3e, 0x8c, 0x73,
-	0x6c, 0x07, 0x0e, 0xec, 0x18, 0x09, 0x12, 0x27, 0xb8, 0xfc, 0x70, 0x02, 0x24, 0x01, 0x82, 0x00,
-	0x06, 0x02, 0xe3, 0x7e, 0x24, 0x88, 0xff, 0x05, 0x76, 0x02, 0x26, 0xbe, 0xcb, 0x1f, 0x13, 0x48,
-	0x10, 0x20, 0xbf, 0x7c, 0x89, 0x91, 0xa0, 0x5e, 0x55, 0x75, 0x57, 0xf5, 0xf4, 0x90, 0xc3, 0x5d,
-	0x2d, 0x70, 0xd2, 0x2f, 0x72, 0x5e, 0xbd, 0xf7, 0xba, 0x3e, 0x5f, 0xbd, 0x57, 0xf5, 0xde, 0x2b,
-	0x18, 0x8f, 0x0e, 0xba, 0x34, 0xbc, 0xd1, 0x0d, 0xfc, 0xc8, 0x27, 0x23, 0xf8, 0xe3, 0xd2, 0xd9,
-	0x5d, 0x7f, 0xd7, 0x47, 0xc8, 0x1c, 0xfb, 0x8f, 0x17, 0x5e, 0xaa, 0xee, 0xfa, 0xfe, 0x6e, 0x8b,
-	0xce, 0xe1, 0xaf, 0x9d, 0xde, 0xc3, 0xb9, 0xc8, 0x6b, 0xd3, 0x30, 0x72, 0xda, 0x5d, 0x81, 0xb0,
-	0xb0, 0xeb, 0x45, 0x7b, 0xbd, 0x9d, 0x1b, 0x4d, 0xbf, 0x3d, 0xb7, 0x1b, 0x38, 0x8f, 0xbc, 0xc8,
-	0x89, 0x3c, 0xbf, 0xe3, 0xb4, 0xe6, 0x22, 0xda, 0xa2, 0x5d, 0x3f, 0x88, 0xe6, 0x9c, 0xae, 0x37,
-	0x87, 0xdf, 0x98, 0x7b, 0x1c, 0x38, 0xdd, 0x2e, 0x0d, 0x92, 0x7f, 0x38, 0x13, 0xf3, 0xef, 0xe7,
-	0xa1, 0x74, 0x9f, 0xd2, 0x6e, 0xad, 0xe5, 0x3d, 0xa2, 0xe4, 0x65, 0x28, 0xac, 0x3a, 0x6d, 0x3a,
-	0x6b, 0x5c, 0x31, 0xae, 0x96, 0xea, 0x53, 0x47, 0x87, 0xd5, 0xf1, 0x90, 0x06, 0x8f, 0x68, 0x60,
-	0x77, 0x9c, 0x36, 0xb5, 0xb0, 0x90, 0x7c, 0x1e, 0x4a, 0xec, 0x6f, 0xd8, 0x75, 0x9a, 0x74, 0x36,
-	0x87, 0x98, 0x13, 0x47, 0x87, 0xd5, 0x52, 0x47, 0x02, 0xad, 0xa4, 0x9c, 0xbc, 0x06, 0x63, 0x2b,
-	0xd4, 0x09, 0xe9, 0xf2, 0xe2, 0x6c, 0xfe, 0x8a, 0x71, 0x35, 0x5f, 0x2f, 0x1f, 0x1d, 0x56, 0x8b,
-	0x2d, 0x06, 0xb2, 0x3d, 0xd7, 0x92, 0x85, 0x64, 0x19, 0xc6, 0x96, 0x9e, 0x74, 0xbd, 0x80, 0x86,
-	0xb3, 0x85, 0x2b, 0xc6, 0xd5, 0xf1, 0xf9, 0x4b, 0x37, 0x78, 0xfb, 0x6f, 0xc8, 0xf6, 0xdf, 0xd8,
-	0x90, 0xed, 0xaf, 0xcf, 0x7c, 0xff, 0xb0, 0x7a, 0xe6, 0xe8, 0xb0, 0x3a, 0x46, 0x39, 0xc9, 0xb7,
-	0xff, 0x6b, 0xd5, 0xb0, 0x24, 0x3d, 0x79, 0x17, 0x0a, 0x1b, 0x07, 0x5d, 0x3a, 0x5b, 0xba, 0x62,
-	0x5c, 0x9d, 0x9c, 0x7f, 0xe9, 0x06, 0xef, 0xf1, 0xb8, 0x91, 0xc9, 0x7f, 0x0c, 0xab, 0x5e, 0x3c,
-	0x3a, 0xac, 0x16, 0x18, 0x8a, 0x85, 0x54, 0xe4, 0x4d, 0x18, 0xbd, 0xe7, 0x87, 0xd1, 0xf2, 0xe2,
-	0x2c, 0x60, 0xd3, 0xce, 0x1d, 0x1d, 0x56, 0xa7, 0xf7, 0xfc, 0x30, 0xb2, 0x3d, 0xf7, 0x0d, 0xbf,
-	0xed, 0x45, 0xb4, 0xdd, 0x8d, 0x0e, 0x2c, 0x81, 0x64, 0xee, 0xc0, 0x84, 0xc6, 0x8f, 0x8c, 0xc3,
-	0xd8, 0xe6, 0xea, 0xfd, 0xd5, 0xb5, 0xed, 0xd5, 0xca, 0x19, 0x52, 0x84, 0xc2, 0xea, 0xda, 0xe2,
-	0x52, 0xc5, 0x20, 0x63, 0x90, 0xaf, 0xad, 0xaf, 0x57, 0x72, 0xa4, 0x0c, 0xc5, 0xc5, 0xda, 0x46,
-	0xad, 0x5e, 0x6b, 0x2c, 0x55, 0xf2, 0x64, 0x06, 0xa6, 0xb6, 0x97, 0x57, 0x17, 0xd7, 0xb6, 0x1b,
-	0xf6, 0xe2, 0x52, 0xe3, 0xfe, 0xc6, 0xda, 0x7a, 0xa5, 0x40, 0x26, 0x01, 0xee, 0x6f, 0xd6, 0x97,
-	0xac, 0xd5, 0xa5, 0x8d, 0xa5, 0x46, 0x65, 0xc4, 0xfc, 0x95, 0x3c, 0x14, 0x1f, 0xd0, 0xc8, 0x71,
-	0x9d, 0xc8, 0x21, 0x97, 0xb5, 0x21, 0xc2, 0xda, 0x2b, 0x63, 0xf3, 0x72, 0xff, 0xd8, 0x8c, 0x1c,
-	0x1d, 0x56, 0x8d, 0x37, 0xd5, 0x31, 0x79, 0x07, 0xc6, 0x17, 0x69, 0xd8, 0x0c, 0xbc, 0x2e, 0x9b,
-	0x2f, 0x38, 0x2e, 0xa5, 0xfa, 0xc5, 0xa3, 0xc3, 0xea, 0x39, 0x37, 0x01, 0x2b, 0x6d, 0x55, 0xb1,
-	0xc9, 0x32, 0x8c, 0xae, 0x38, 0x3b, 0xb4, 0x15, 0xce, 0x8e, 0x5c, 0xc9, 0x5f, 0x1d, 0x9f, 0x7f,
-	0x41, 0xf4, 0xaf, 0xac, 0xe0, 0x0d, 0x5e, 0xba, 0xd4, 0x89, 0x82, 0x83, 0xfa, 0xd9, 0xa3, 0xc3,
-	0x6a, 0xa5, 0x85, 0x00, 0xb5, 0xef, 0x38, 0x0a, 0x69, 0x24, 0x63, 0x3e, 0x7a, 0xe2, 0x98, 0xbf,
-	0xf8, 0xfd, 0xc3, 0xaa, 0xc1, 0xc6, 0x42, 0x8c, 0x79, 0xc2, 0x4f, 0x1f, 0xfd, 0x2b, 0x90, 0x5b,
-	0x5e, 0x9c, 0x1d, 0xc3, 0xb9, 0x56, 0x39, 0x3a, 0xac, 0x96, 0xb5, 0x61, 0xcb, 0x2d, 0x2f, 0x5e,
-	0x7a, 0x1b, 0xc6, 0x95, 0x3a, 0x92, 0x0a, 0xe4, 0xf7, 0xe9, 0x01, 0xef, 0x4f, 0x8b, 0xfd, 0x4b,
-	0xce, 0xc2, 0xc8, 0x23, 0xa7, 0xd5, 0x13, 0x1d, 0x68, 0xf1, 0x1f, 0x5f, 0xca, 0xfd, 0xa4, 0x61,
-	0xfe, 0x46, 0x01, 0x8a, 0x96, 0xcf, 0xd7, 0x19, 0xb9, 0x06, 0x23, 0x8d, 0xc8, 0x89, 0xe4, 0x50,
-	0xcc, 0x1c, 0x1d, 0x56, 0xa7, 0x42, 0x06, 0x50, 0xbe, 0xc7, 0x31, 0x18, 0xea, 0xfa, 0x9e, 0x13,
-	0xca, 0x21, 0x41, 0xd4, 0x2e, 0x03, 0xa8, 0xa8, 0x88, 0x41, 0x5e, 0x83, 0xc2, 0x03, 0xdf, 0xa5,
-	0x62, 0x54, 0xc8, 0xd1, 0x61, 0x75, 0xb2, 0xed, 0xbb, 0x2a, 0x22, 0x96, 0x93, 0x37, 0xa0, 0xb4,
-	0xd0, 0x0b, 0x02, 0xda, 0x61, 0x53, 0xb5, 0x80, 0xc8, 0x93, 0x47, 0x87, 0x55, 0x68, 0x72, 0x20,
-	0x5b, 0x5c, 0x09, 0x02, 0xeb, 0xea, 0x46, 0xe4, 0x04, 0x11, 0x75, 0x67, 0x47, 0x86, 0xea, 0x6a,
-	0xb6, 0xbc, 0xa6, 0x43, 0x4e, 0x92, 0xee, 0x6a, 0xc1, 0x89, 0xdc, 0x83, 0xf1, 0xbb, 0x81, 0xd3,
-	0xa4, 0xeb, 0x34, 0xf0, 0x7c, 0x17, 0xc7, 0x30, 0x5f, 0x7f, 0xed, 0xe8, 0xb0, 0x7a, 0x7e, 0x97,
-	0x81, 0xed, 0x2e, 0xc2, 0x13, 0xea, 0x1f, 0x1d, 0x56, 0x8b, 0x8b, 0xbd, 0x00, 0x7b, 0xcf, 0x52,
-	0x49, 0xc9, 0xcf, 0xb0, 0x21, 0x09, 0x23, 0xec, 0x5a, 0xea, 0xe2, 0xe8, 0x1d, 0x5f, 0x45, 0x53,
-	0x54, 0xf1, 0x7c, 0xcb, 0x09, 0x23, 0x3b, 0xe0, 0x74, 0xa9, 0x7a, 0xaa, 0x2c, 0xc9, 0x1a, 0x14,
-	0x1b, 0xcd, 0x3d, 0xea, 0xf6, 0x5a, 0x74, 0xb6, 0x88, 0xec, 0x2f, 0x88, 0x89, 0x2b, 0xc7, 0x53,
-	0x16, 0xd7, 0x2f, 0x09, 0xde, 0x24, 0x14, 0x10, 0xa5, 0xef, 0x63, 0x26, 0x5f, 0x2a, 0xfe, 0xf6,
-	0xef, 0x57, 0xcf, 0xfc, 0xd2, 0x7f, 0xb9, 0x72, 0xc6, 0xfc, 0x97, 0x39, 0xa8, 0xa4, 0x99, 0x90,
-	0x87, 0x30, 0xb1, 0xd9, 0x75, 0x9d, 0x88, 0x2e, 0xb4, 0x3c, 0xda, 0x89, 0x42, 0x9c, 0x24, 0xc7,
-	0xb7, 0xe9, 0x15, 0xf1, 0xdd, 0xd9, 0x1e, 0x12, 0xda, 0x4d, 0x4e, 0x99, 0x6a, 0x95, 0xce, 0x36,
-	0xf9, 0x4e, 0x03, 0xe5, 0x74, 0x88, 0x33, 0xec, 0x74, 0xdf, 0xe1, 0x12, 0x7e, 0xc0, 0x77, 0x04,
-	0x5b, 0x31, 0x81, 0x3a, 0xee, 0xce, 0x01, 0xce, 0xcc, 0xe1, 0x27, 0x10, 0x23, 0xc9, 0x98, 0x40,
-	0x0c, 0x6c, 0xfe, 0x77, 0x03, 0x26, 0x2d, 0x1a, 0xfa, 0xbd, 0xa0, 0x49, 0xef, 0x51, 0xc7, 0xa5,
-	0x01, 0x9b, 0xfe, 0xf7, 0xbd, 0x8e, 0x2b, 0xd6, 0x14, 0x4e, 0xff, 0x7d, 0xaf, 0xa3, 0x2e, 0x61,
-	0x2c, 0x27, 0x5f, 0x80, 0xb1, 0x46, 0x6f, 0x07, 0x51, 0xf9, 0x9a, 0x3a, 0x8f, 0x23, 0xd6, 0xdb,
-	0xb1, 0x53, 0xe8, 0x12, 0x8d, 0xcc, 0xc1, 0xd8, 0x16, 0x0d, 0xc2, 0x44, 0xe2, 0xa1, 0x64, 0x7f,
-	0xc4, 0x41, 0x2a, 0x81, 0xc0, 0x22, 0x77, 0x13, 0xa9, 0x2b, 0xf6, 0xa4, 0xa9, 0x94, 0xac, 0x4b,
-	0xa6, 0x4a, 0x5b, 0x40, 0xd4, 0xa9, 0x22, 0xb1, 0xcc, 0xef, 0xe4, 0xa0, 0xb2, 0xe8, 0x44, 0xce,
-	0x8e, 0x13, 0x8a, 0xfe, 0xdc, 0xba, 0xc5, 0xe4, 0xb8, 0xd2, 0x50, 0x94, 0xe3, 0xac, 0xe6, 0x9f,
-	0xb8, 0x79, 0xaf, 0xa6, 0x9b, 0x37, 0xce, 0x36, 0x48, 0xd1, 0xbc, 0xa4, 0x51, 0xef, 0x9d, 0xdc,
-	0xa8, 0x8a, 0x68, 0x54, 0x51, 0x36, 0x2a, 0x69, 0x0a, 0x79, 0x0f, 0x0a, 0x8d, 0x2e, 0x6d, 0x0a,
-	0x21, 0x22, 0x65, 0xbf, 0xde, 0x38, 0x86, 0xb0, 0x75, 0xab, 0x5e, 0x16, 0x6c, 0x0a, 0x61, 0x97,
-	0x36, 0x2d, 0x24, 0x53, 0x16, 0xcd, 0x77, 0x47, 0xe1, 0x6c, 0x16, 0x19, 0x79, 0x4f, 0xdf, 0x9c,
-	0x78, 0xf7, 0xbc, 0x30, 0x70, 0x73, 0x9a, 0x35, 0xf4, 0xed, 0xe9, 0x3a, 0x14, 0xd7, 0xd9, 0x84,
-	0x6c, 0xfa, 0x2d, 0xd1, 0x73, 0x4c, 0x2a, 0x16, 0xbb, 0x12, 0x66, 0x58, 0x71, 0x39, 0x79, 0x01,
-	0xf2, 0x9b, 0xd6, 0xb2, 0xe8, 0xae, 0xd2, 0xd1, 0x61, 0x35, 0xdf, 0x0b, 0xbc, 0x59, 0xc3, 0x62,
-	0x50, 0x32, 0x07, 0xa3, 0x0b, 0xb5, 0x05, 0x1a, 0x44, 0xd8, 0x4d, 0xe5, 0xfa, 0x05, 0x36, 0x5b,
-	0x9a, 0x8e, 0xdd, 0xa4, 0x41, 0xa4, 0x7d, 0x5e, 0xa0, 0x91, 0xcf, 0x43, 0xbe, 0xb6, 0xdd, 0x10,
-	0x3d, 0x03, 0xa2, 0x67, 0x6a, 0xdb, 0x8d, 0xfa, 0x84, 0xe8, 0x88, 0xbc, 0xf3, 0x38, 0x64, 0xdc,
-	0x6b, 0xdb, 0x0d, 0x75, 0xb4, 0x46, 0x8f, 0x19, 0xad, 0xab, 0x50, 0x64, 0x7a, 0x06, 0xdb, 0xe0,
-	0x51, 0x28, 0x96, 0xb8, 0xfa, 0xb4, 0x27, 0x60, 0x56, 0x5c, 0x4a, 0x5e, 0x8e, 0xd5, 0x96, 0x62,
-	0xc2, 0x4f, 0xa8, 0x2d, 0x52, 0x59, 0x21, 0x4f, 0x60, 0x62, 0xf1, 0xa0, 0xe3, 0xb4, 0xbd, 0xa6,
-	0xd8, 0xc2, 0x4b, 0xb8, 0x85, 0xdf, 0x38, 0x66, 0x18, 0x6f, 0x68, 0x04, 0x7c, 0x57, 0x97, 0xc2,
-	0x77, 0xd6, 0xe5, 0x65, 0x76, 0x7a, 0x87, 0x9f, 0x35, 0x2c, 0xfd, 0x43, 0x6c, 0x2d, 0x49, 0x11,
-	0x89, 0x7a, 0x55, 0x32, 0xed, 0x24, 0x38, 0x59, 0x4b, 0x81, 0x80, 0xa8, 0x6b, 0x29, 0xde, 0x74,
-	0xdf, 0x83, 0xfc, 0xdd, 0x85, 0xf5, 0xd9, 0x71, 0xe4, 0x41, 0x04, 0x8f, 0xbb, 0x0b, 0xeb, 0x0b,
-	0x2d, 0xbf, 0xe7, 0x36, 0x3e, 0x5a, 0xa9, 0x5f, 0x10, 0x6c, 0x26, 0x76, 0x9b, 0x5d, 0xad, 0x46,
-	0x8c, 0x8e, 0x2c, 0x41, 0x51, 0xb6, 0x72, 0xb6, 0x8c, 0x3c, 0xa6, 0x53, 0x8d, 0xdf, 0xba, 0xc5,
-	0xd7, 0x9a, 0x2b, 0x7e, 0xab, 0xb5, 0x90, 0x38, 0x97, 0xb6, 0x81, 0xf4, 0xf7, 0x4b, 0x86, 0x26,
-	0xf1, 0x79, 0x55, 0x93, 0x18, 0x9f, 0x3f, 0x27, 0xbe, 0xb5, 0xe0, 0xb7, 0xdb, 0x4e, 0xc7, 0x45,
-	0xda, 0xad, 0x79, 0x55, 0xc1, 0xa8, 0xc1, 0x64, 0x52, 0x91, 0x15, 0x2f, 0x8c, 0xc8, 0x1c, 0x94,
-	0x24, 0x84, 0x6d, 0x22, 0xf9, 0xcc, 0x2a, 0x5b, 0x09, 0x8e, 0xf9, 0x27, 0x39, 0x80, 0xa4, 0xe4,
-	0x19, 0x95, 0x33, 0x3f, 0xa1, 0xc9, 0x99, 0x73, 0xe9, 0x09, 0x3a, 0x50, 0xc2, 0x90, 0x0f, 0x60,
-	0x94, 0xa9, 0x5c, 0x3d, 0xa9, 0x52, 0x5e, 0x48, 0x93, 0x62, 0xe1, 0xd6, 0xad, 0xfa, 0xa4, 0x20,
-	0x1e, 0x0d, 0x11, 0x62, 0x09, 0x32, 0x45, 0x44, 0xfd, 0xcf, 0x42, 0x32, 0x18, 0x42, 0x38, 0x5d,
-	0x55, 0xa4, 0x8b, 0x91, 0xac, 0x47, 0x29, 0x5d, 0x14, 0xd9, 0x72, 0x91, 0xcb, 0x16, 0xde, 0xa9,
-	0x63, 0x42, 0xb6, 0xa4, 0x25, 0x0b, 0xef, 0xc0, 0x13, 0x25, 0x4b, 0x37, 0xbd, 0x6c, 0x0b, 0x38,
-	0x0d, 0xae, 0x66, 0xf6, 0x4a, 0xd6, 0x82, 0xbd, 0x72, 0xd2, 0x82, 0x4d, 0x2f, 0xd7, 0x5b, 0x83,
-	0x64, 0xd9, 0x39, 0xb9, 0xba, 0x9c, 0xc7, 0x2a, 0x39, 0xca, 0xb4, 0x77, 0xf8, 0xd2, 0x1c, 0x1d,
-	0xb8, 0x34, 0xcf, 0x65, 0x2e, 0x4d, 0xbe, 0x30, 0xdf, 0x81, 0x91, 0xda, 0xcf, 0xf5, 0x02, 0x2a,
-	0x74, 0xbf, 0xb2, 0xfc, 0x26, 0x83, 0xc5, 0x6b, 0x7a, 0xca, 0x61, 0x3f, 0x55, 0x9d, 0x19, 0xcb,
-	0xd9, 0x97, 0x37, 0x56, 0x1a, 0x42, 0xaf, 0x23, 0xa9, 0x6e, 0xd9, 0x58, 0x51, 0xaa, 0x1d, 0x69,
-	0xad, 0x66, 0x54, 0x64, 0x0e, 0x72, 0xb5, 0x45, 0x34, 0x16, 0xc7, 0xe7, 0x4b, 0xf2, 0xb3, 0x8b,
-	0xf5, 0xb3, 0x82, 0xa4, 0xec, 0x68, 0xf6, 0x43, 0x6d, 0xf1, 0xb3, 0x5b, 0xfc, 0x2d, 0x45, 0x4d,
-	0x10, 0xd3, 0x94, 0x99, 0xa3, 0x62, 0xb2, 0x18, 0x89, 0xd2, 0xd2, 0x37, 0x59, 0xe2, 0xa9, 0x72,
-	0x8d, 0x0f, 0x5c, 0xae, 0x6f, 0xe0, 0xc6, 0x95, 0x4d, 0x08, 0x87, 0xcb, 0xfc, 0x4b, 0x03, 0x71,
-	0xc9, 0x1b, 0x30, 0x6a, 0xd1, 0xdd, 0x64, 0xaf, 0x45, 0x9b, 0x2d, 0x40, 0x88, 0xfa, 0x01, 0x8e,
-	0x83, 0x82, 0x9c, 0xba, 0xe1, 0x9e, 0xf7, 0x30, 0x12, 0x5f, 0x89, 0x05, 0xb9, 0x00, 0x2b, 0x82,
-	0x5c, 0x40, 0x34, 0x41, 0x2e, 0x60, 0x6c, 0x8a, 0x59, 0x8b, 0x0d, 0xa1, 0x4c, 0xca, 0x9a, 0x5a,
-	0x8b, 0xca, 0x58, 0x05, 0xae, 0x36, 0x56, 0xd6, 0x62, 0x83, 0xdc, 0x86, 0x52, 0xad, 0xd9, 0xf4,
-	0x7b, 0x8a, 0xd1, 0x33, 0x7b, 0x74, 0x58, 0x3d, 0xeb, 0x70, 0xa0, 0x6e, 0xa2, 0x27, 0xa8, 0x66,
-	0x3d, 0xa9, 0x35, 0xe3, 0xb1, 0xd0, 0xea, 0x85, 0x11, 0x0d, 0x96, 0x17, 0x45, 0x93, 0x91, 0x47,
-	0x93, 0x03, 0x53, 0x3c, 0x62, 0x54, 0xf3, 0x3f, 0x1b, 0x58, 0x63, 0xf2, 0x36, 0xc0, 0x72, 0x87,
-	0x29, 0xb6, 0x4d, 0x1a, 0x33, 0x40, 0xe3, 0xd9, 0x13, 0x50, 0x9d, 0x83, 0x82, 0xac, 0x7f, 0x3a,
-	0x37, 0xf4, 0xa7, 0xd9, 0x27, 0xa5, 0x9a, 0x2c, 0xce, 0x51, 0xc4, 0x27, 0x03, 0x01, 0x4d, 0x7d,
-	0x32, 0x41, 0x26, 0xaf, 0xc1, 0xd8, 0x72, 0xed, 0x41, 0xad, 0x17, 0xed, 0x61, 0x7f, 0x15, 0xb9,
-	0xc0, 0xf2, 0x9c, 0xb6, 0xed, 0xf4, 0xa2, 0x3d, 0x4b, 0x16, 0x9a, 0xbf, 0x64, 0xc0, 0xb8, 0xb2,
-	0x56, 0x59, 0x55, 0xd7, 0x03, 0xff, 0x63, 0xda, 0x8c, 0xf4, 0x5e, 0xea, 0x72, 0x60, 0xaa, 0xaa,
-	0x31, 0x6a, 0xaa, 0x77, 0x72, 0xa7, 0xe8, 0x1d, 0x73, 0x4e, 0x88, 0x00, 0x66, 0x03, 0x28, 0x47,
-	0x1c, 0x68, 0x03, 0x30, 0x1d, 0x47, 0xb5, 0x01, 0x58, 0xb9, 0xf9, 0x87, 0x06, 0x5b, 0xba, 0x64,
-	0x0e, 0xe0, 0x3e, 0x3d, 0x88, 0x9c, 0x9d, 0x3b, 0x5e, 0x4b, 0x3b, 0xba, 0xda, 0x47, 0xa8, 0xfd,
-	0xd0, 0x6b, 0x51, 0x4b, 0x41, 0x21, 0xb7, 0xa0, 0x78, 0x3f, 0xd8, 0x79, 0x0b, 0xd1, 0x73, 0xb1,
-	0x08, 0x9e, 0xd9, 0x0f, 0x76, 0xde, 0x42, 0x64, 0x75, 0xbe, 0x4a, 0x44, 0x62, 0xc2, 0xe8, 0xa2,
-	0xdf, 0x76, 0x3c, 0xb9, 0xed, 0x01, 0xdb, 0x3b, 0x5c, 0x84, 0x58, 0xa2, 0x84, 0x09, 0xfd, 0xc6,
-	0xfa, 0xaa, 0x98, 0x98, 0x28, 0xf4, 0xc3, 0x6e, 0xc7, 0x62, 0x30, 0xf3, 0x7b, 0x06, 0x8c, 0x2b,
-	0x12, 0x89, 0x7c, 0x51, 0x98, 0xf9, 0x06, 0x1e, 0x52, 0x9d, 0xef, 0x97, 0x59, 0xac, 0x94, 0x6f,
-	0xd7, 0xcc, 0xfc, 0x17, 0x46, 0x7f, 0x22, 0x0d, 0x72, 0xc3, 0x48, 0x83, 0xb7, 0x01, 0xb8, 0x2e,
-	0x87, 0xdd, 0xa9, 0xcc, 0x1b, 0xe5, 0x50, 0x4f, 0x1d, 0x8c, 0x04, 0xd9, 0xfc, 0x9b, 0x39, 0x28,
-	0x0a, 0x5b, 0x65, 0xfe, 0x19, 0xd5, 0x21, 0xde, 0xd2, 0x74, 0x88, 0x19, 0x41, 0xaa, 0x28, 0xb7,
-	0xf3, 0x27, 0xd8, 0x28, 0x6f, 0x43, 0x59, 0x76, 0x01, 0xaa, 0x62, 0xd7, 0x60, 0x4c, 0x5a, 0xd9,
-	0x5c, 0x11, 0x9b, 0xd2, 0x78, 0x6e, 0xcd, 0x5b, 0xb2, 0xdc, 0xfc, 0xce, 0x88, 0xa4, 0xe5, 0x5f,
-	0x62, 0x5d, 0x58, 0x73, 0xdd, 0x40, 0xed, 0x42, 0xc7, 0x75, 0x03, 0x0b, 0xa1, 0x6c, 0xa0, 0xd6,
-	0x7b, 0x3b, 0x2d, 0xaf, 0x89, 0x38, 0xca, 0xaa, 0xe9, 0x22, 0xd4, 0x66, 0xa8, 0xea, 0x40, 0x25,
-	0xc8, 0x9a, 0x89, 0x90, 0x3f, 0xd6, 0x44, 0xf8, 0x69, 0x28, 0x2d, 0xb4, 0x5d, 0x4d, 0x85, 0x30,
-	0x33, 0x3a, 0xe5, 0x46, 0x8c, 0xc4, 0x95, 0x87, 0xcb, 0xa2, 0x8f, 0xce, 0x36, 0xdb, 0x6e, 0xbf,
-	0xe2, 0x90, 0xb0, 0xd4, 0x74, 0xfc, 0x91, 0x4f, 0xa3, 0xe3, 0xdf, 0x86, 0xd2, 0x66, 0x48, 0x37,
-	0x7a, 0x9d, 0x0e, 0x6d, 0xa1, 0x3a, 0x51, 0xe4, 0xb2, 0xa7, 0x17, 0x52, 0x3b, 0x42, 0xa8, 0x5a,
-	0x81, 0x18, 0x55, 0x9d, 0x56, 0x63, 0xc7, 0x4c, 0xab, 0x2f, 0x42, 0xa1, 0xd6, 0xed, 0x4a, 0xe3,
-	0x27, 0xde, 0x24, 0xbb, 0x5d, 0xdc, 0xfa, 0x26, 0x9d, 0x6e, 0x57, 0x37, 0x65, 0x10, 0x9b, 0x50,
-	0x20, 0xf7, 0x7b, 0x3b, 0x34, 0xe8, 0xd0, 0x88, 0x86, 0x42, 0x34, 0x87, 0xb3, 0x80, 0x3c, 0x66,
-	0xe5, 0x19, 0x73, 0x1a, 0x01, 0x0d, 0xd7, 0x0b, 0xfb, 0xbd, 0x1d, 0x6a, 0x0b, 0x19, 0xaf, 0xf6,
-	0x5d, 0x06, 0xc3, 0x4b, 0x0d, 0x98, 0xd4, 0xfb, 0xff, 0x29, 0x28, 0x16, 0x1f, 0x16, 0x8a, 0xc5,
-	0x4a, 0xc9, 0xfc, 0x95, 0x1c, 0x8c, 0xd7, 0xba, 0xdd, 0x67, 0xfc, 0x04, 0xe2, 0x27, 0xb5, 0x55,
-	0x7d, 0x3e, 0x19, 0xbd, 0x53, 0x1c, 0x3e, 0xfc, 0x95, 0x01, 0x53, 0x29, 0x0a, 0xb5, 0xf6, 0xc6,
-	0x90, 0x16, 0x79, 0x6e, 0x48, 0x8b, 0x3c, 0x3f, 0xd8, 0x22, 0x57, 0xd7, 0x4c, 0xe1, 0xd3, 0xac,
-	0x99, 0xd7, 0x21, 0x5f, 0xeb, 0x76, 0x45, 0xaf, 0x94, 0x93, 0x5e, 0xd9, 0xba, 0xc5, 0x37, 0x22,
-	0xa7, 0xdb, 0xb5, 0x18, 0x86, 0xf9, 0x26, 0x94, 0x10, 0x8c, 0x12, 0xed, 0x8a, 0x58, 0x0a, 0x5c,
-	0x9c, 0x69, 0x64, 0x7c, 0xda, 0x9b, 0xff, 0xc7, 0x80, 0x11, 0xfc, 0xfd, 0x8c, 0x4e, 0x97, 0x79,
-	0x6d, 0xba, 0x54, 0x94, 0xe9, 0x32, 0xcc, 0x44, 0xf9, 0xa3, 0x3c, 0xf6, 0x96, 0x98, 0x22, 0xc2,
-	0xa6, 0x33, 0x32, 0x6c, 0xba, 0x4f, 0x21, 0xc0, 0xf7, 0xd3, 0xd6, 0x5d, 0x1e, 0x07, 0xe3, 0xe5,
-	0x74, 0x55, 0x9f, 0x8a, 0x61, 0x77, 0x0f, 0xc8, 0x72, 0x27, 0xa4, 0xcd, 0x5e, 0x40, 0x1b, 0xfb,
-	0x5e, 0x77, 0x8b, 0x06, 0xde, 0xc3, 0x03, 0xa1, 0x19, 0xa2, 0x8c, 0xf5, 0x44, 0xa9, 0x1d, 0xee,
-	0x7b, 0x5d, 0xfb, 0x11, 0x96, 0x5b, 0x19, 0x34, 0xe4, 0x03, 0x18, 0xb3, 0xe8, 0xe3, 0xc0, 0x8b,
-	0xa8, 0xe8, 0xdb, 0xc9, 0xd8, 0x0e, 0x40, 0x28, 0xd7, 0x4d, 0x02, 0xfe, 0x43, 0x1d, 0x7f, 0x51,
-	0xfe, 0xd9, 0x99, 0x51, 0xdf, 0x1d, 0xc1, 0xb5, 0x70, 0xc2, 0x4d, 0xd9, 0x31, 0x06, 0xba, 0x3e,
-	0x98, 0xf9, 0xd3, 0x0c, 0xe6, 0x16, 0x94, 0x99, 0xe9, 0x96, 0xb2, 0xd4, 0x2f, 0x27, 0x63, 0x79,
-	0x43, 0x2d, 0x3e, 0xee, 0x92, 0x4c, 0xe3, 0x43, 0xec, 0xf4, 0x24, 0xe1, 0x97, 0x6f, 0x2f, 0x2a,
-	0x8c, 0x33, 0xa6, 0x47, 0x2c, 0x3a, 0x9a, 0xbc, 0xb3, 0x4e, 0x3d, 0x31, 0x46, 0x3f, 0xdd, 0xc4,
-	0x18, 0xfb, 0x24, 0x13, 0x23, 0x7d, 0x3d, 0x59, 0x3c, 0xcd, 0xf5, 0xe4, 0xa5, 0x0f, 0x60, 0xba,
-	0xaf, 0x87, 0x4f, 0x73, 0xc5, 0xf7, 0xd9, 0x4d, 0xcb, 0x5f, 0x88, 0xfb, 0x85, 0xcc, 0xa3, 0x39,
-	0xea, 0x05, 0xb4, 0x19, 0xa1, 0xe8, 0x15, 0xd2, 0x32, 0x10, 0xb0, 0x94, 0xbd, 0x8c, 0x30, 0xf2,
-	0x3e, 0x8c, 0xf1, 0x2b, 0x92, 0x70, 0x36, 0x87, 0x63, 0x3f, 0x21, 0xbe, 0xc8, 0xa1, 0xe2, 0x9e,
-	0x9a, 0x63, 0xa8, 0xbd, 0x2a, 0x88, 0xcc, 0xbb, 0x30, 0x2a, 0xae, 0x58, 0x8e, 0x5f, 0x17, 0x55,
-	0x18, 0xd9, 0x4a, 0x7a, 0x06, 0x8f, 0xc5, 0x79, 0x23, 0x2c, 0x0e, 0x37, 0x7f, 0xcd, 0x80, 0x49,
-	0xbd, 0x95, 0xe4, 0x06, 0x8c, 0x8a, 0x3b, 0x40, 0x03, 0xef, 0x00, 0x59, 0x6b, 0x46, 0xf9, 0xed,
-	0x9f, 0x76, 0xe7, 0x27, 0xb0, 0x98, 0xe8, 0x17, 0x1c, 0xb0, 0x2d, 0x42, 0xf4, 0x8b, 0x49, 0x6a,
-	0xc9, 0x32, 0x66, 0x72, 0x59, 0x34, 0xec, 0xb5, 0x22, 0xd5, 0xe4, 0x0a, 0x10, 0x62, 0x89, 0x12,
-	0xf3, 0xd0, 0x00, 0x68, 0x34, 0xee, 0xdd, 0xa7, 0x07, 0xeb, 0x8e, 0x17, 0xa0, 0xd9, 0x8a, 0xab,
-	0xf1, 0xbe, 0x18, 0xad, 0xb2, 0x30, 0x5b, 0xf9, 0xca, 0xdd, 0xa7, 0x07, 0x9a, 0xd9, 0x2a, 0x51,
-	0x71, 0xc9, 0x07, 0xde, 0x23, 0x27, 0xa2, 0x8c, 0x30, 0x87, 0x84, 0x7c, 0xc9, 0x73, 0x68, 0x8a,
-	0x52, 0x41, 0x26, 0xdf, 0x80, 0xc9, 0xe4, 0x17, 0x3a, 0x1e, 0xe4, 0xd1, 0xa6, 0x93, 0x33, 0x42,
-	0x2f, 0xac, 0xbf, 0x74, 0x74, 0x58, 0xbd, 0xa4, 0x70, 0xb5, 0x19, 0x96, 0xc2, 0x3a, 0xc5, 0xcc,
-	0xfc, 0x03, 0x03, 0x60, 0x63, 0xa5, 0x21, 0x1b, 0xf8, 0x1a, 0x14, 0xe2, 0xd3, 0xa0, 0x32, 0xb7,
-	0x8d, 0x53, 0xc6, 0x1f, 0x96, 0x93, 0x97, 0x21, 0x9f, 0xb4, 0x64, 0xfa, 0xe8, 0xb0, 0x3a, 0xa1,
-	0xb7, 0x80, 0x95, 0x92, 0xbb, 0x30, 0x36, 0x54, 0x9d, 0x71, 0x76, 0x66, 0xd4, 0x55, 0x52, 0xe3,
-	0x28, 0x7c, 0xb8, 0xbd, 0xf1, 0xfc, 0x8e, 0xc2, 0xb7, 0x72, 0x30, 0xc5, 0xfa, 0xb5, 0xd6, 0x8b,
-	0xf6, 0xfc, 0xc0, 0x8b, 0x0e, 0x9e, 0x59, 0xab, 0xf8, 0x5d, 0x4d, 0x21, 0xba, 0x24, 0xc5, 0x96,
-	0xda, 0xb6, 0xa1, 0x8c, 0xe3, 0xbf, 0x18, 0x83, 0x99, 0x0c, 0x2a, 0xf2, 0x86, 0xf0, 0xbe, 0x49,
-	0xce, 0x8c, 0xd0, 0xbb, 0xe6, 0x47, 0x87, 0xd5, 0xb2, 0x44, 0xdf, 0x48, 0xbc, 0x6d, 0xe6, 0x61,
-	0x5c, 0x98, 0x3e, 0xab, 0x89, 0x46, 0x8d, 0x6e, 0x1b, 0xf2, 0x4c, 0x0c, 0x45, 0x93, 0x8a, 0x44,
-	0x6a, 0x50, 0x5e, 0xd8, 0xa3, 0xcd, 0x7d, 0xaf, 0xb3, 0x7b, 0x9f, 0x1e, 0x70, 0x7d, 0xa9, 0x5c,
-	0x7f, 0x91, 0x59, 0x5a, 0x4d, 0x01, 0x67, 0x43, 0xaa, 0x1b, 0x71, 0x1a, 0x09, 0x79, 0x1f, 0xc6,
-	0x1b, 0xde, 0x6e, 0x47, 0x72, 0x28, 0x20, 0x87, 0xcb, 0x47, 0x87, 0xd5, 0xf3, 0x21, 0x07, 0xf7,
-	0x33, 0x50, 0x09, 0xc8, 0x35, 0x18, 0xb1, 0xfc, 0x16, 0xe5, 0xdb, 0xb0, 0xf0, 0xe7, 0x08, 0x18,
-	0x40, 0x3d, 0x9b, 0x46, 0x0c, 0x72, 0x0f, 0xc6, 0xd8, 0x3f, 0x0f, 0x9c, 0xee, 0xec, 0x28, 0xca,
-	0x6d, 0x12, 0x2b, 0xf8, 0x08, 0xed, 0x7a, 0x9d, 0x5d, 0x55, 0xc7, 0x6f, 0x51, 0xbb, 0xed, 0x74,
-	0xb5, 0x7d, 0x91, 0x23, 0x92, 0x2d, 0x18, 0x4f, 0x04, 0x41, 0x38, 0x3b, 0xa6, 0xdd, 0x05, 0x25,
-	0x25, 0xf5, 0xcf, 0x09, 0x66, 0x17, 0xa2, 0x56, 0x88, 0x73, 0xbb, 0xcb, 0xf0, 0xf5, 0xc6, 0x28,
-	0x8c, 0x34, 0x1b, 0xa4, 0x38, 0xd8, 0x06, 0x31, 0x4e, 0xb4, 0x41, 0x5c, 0x00, 0xd1, 0x49, 0xb5,
-	0xd6, 0xae, 0x70, 0xbf, 0xba, 0x36, 0x78, 0x82, 0xdd, 0x48, 0x90, 0x71, 0x4d, 0xf2, 0x93, 0x29,
-	0xd1, 0xff, 0x4e, 0x6b, 0x57, 0x3b, 0x99, 0x8a, 0x51, 0x59, 0x37, 0x24, 0xa2, 0x46, 0x5a, 0xe0,
-	0xb2, 0x1b, 0x92, 0x92, 0xa4, 0x1b, 0x3e, 0x7e, 0x1c, 0x0d, 0xea, 0x06, 0x85, 0x11, 0x59, 0x05,
-	0xa8, 0x35, 0x23, 0xef, 0x11, 0xc5, 0x29, 0x31, 0xae, 0x75, 0xc4, 0x42, 0xed, 0x3e, 0x3d, 0x68,
-	0xd0, 0x28, 0xf6, 0x6c, 0x38, 0xe7, 0x20, 0x6a, 0x6a, 0x9a, 0x58, 0x0a, 0x07, 0xd2, 0x85, 0x73,
-	0x35, 0xd7, 0xf5, 0xb8, 0x4b, 0xde, 0x46, 0xc0, 0xe6, 0xaf, 0x8b, 0xac, 0xcb, 0xd9, 0xac, 0xaf,
-	0x09, 0xd6, 0x9f, 0x73, 0x62, 0x2a, 0x3b, 0xe2, 0x64, 0xe9, 0xcf, 0x64, 0x33, 0x36, 0xd7, 0x60,
-	0x52, 0xef, 0x52, 0xdd, 0x19, 0xad, 0x0c, 0x45, 0xab, 0x51, 0xb3, 0x1b, 0xf7, 0x6a, 0x37, 0x2b,
-	0x06, 0xa9, 0x40, 0x59, 0xfc, 0x9a, 0xb7, 0xe7, 0xdf, 0xba, 0x5d, 0xc9, 0x69, 0x90, 0xb7, 0x6e,
-	0xce, 0x57, 0xf2, 0xe6, 0x1f, 0x19, 0x50, 0x94, 0xf5, 0x23, 0xb7, 0x21, 0xdf, 0x68, 0xdc, 0x4b,
-	0x5d, 0x41, 0x26, 0x5b, 0x2f, 0xdf, 0x64, 0xc2, 0x70, 0x4f, 0xdd, 0x64, 0x1a, 0x8d, 0x7b, 0x8c,
-	0x6e, 0x63, 0xa5, 0x21, 0x94, 0x96, 0x8c, 0xe9, 0x3a, 0x3d, 0xe0, 0x5e, 0xe6, 0x36, 0xe4, 0x3f,
-	0xdc, 0xde, 0x10, 0xd6, 0x50, 0xc6, 0xf8, 0x22, 0xdd, 0xc7, 0x8f, 0xd5, 0xad, 0x8f, 0x11, 0x98,
-	0x16, 0x8c, 0x2b, 0x4b, 0x8b, 0x2b, 0x11, 0x6d, 0x3f, 0x76, 0xd3, 0x12, 0x4a, 0x04, 0x83, 0x58,
-	0xa2, 0x84, 0xe9, 0x3c, 0x2b, 0x7e, 0xd3, 0x69, 0x09, 0x6d, 0x04, 0x75, 0x9e, 0x16, 0x03, 0x58,
-	0x1c, 0x6e, 0xfe, 0xb1, 0x01, 0x95, 0xf5, 0xc0, 0x7f, 0xe4, 0x31, 0x09, 0xbc, 0xe1, 0xef, 0xd3,
-	0xce, 0xd6, 0x4d, 0xf2, 0xa6, 0x14, 0x02, 0x5c, 0x85, 0xbb, 0xc0, 0xa8, 0x50, 0x08, 0xfc, 0xe8,
-	0xb0, 0x0a, 0x8d, 0x83, 0x30, 0xa2, 0x6d, 0x56, 0x2e, 0x05, 0x81, 0xe2, 0xed, 0x96, 0x1b, 0xde,
-	0x83, 0xe6, 0x04, 0x6f, 0xb7, 0x2a, 0x8c, 0x60, 0x75, 0x14, 0x27, 0x86, 0x91, 0x88, 0x01, 0x2c,
-	0x0e, 0x57, 0x04, 0xf6, 0x77, 0x72, 0x7d, 0x6d, 0x98, 0x7f, 0xae, 0xbc, 0x50, 0xf4, 0xc6, 0x0d,
-	0xb5, 0x89, 0x7d, 0x15, 0xce, 0xa6, 0xbb, 0x04, 0xcf, 0x45, 0x6a, 0x30, 0xa5, 0xc3, 0xe5, 0x11,
-	0xc9, 0x85, 0xcc, 0x6f, 0x6d, 0xcd, 0x5b, 0x69, 0x7c, 0xf3, 0x07, 0x06, 0x94, 0xf0, 0x5f, 0xab,
-	0xd7, 0xa2, 0x4c, 0xb3, 0xa9, 0x6d, 0x37, 0xc4, 0x85, 0x94, 0x7a, 0x69, 0xe4, 0x3c, 0x0e, 0x6d,
-	0x71, 0x7b, 0xa5, 0xc9, 0x91, 0x18, 0x59, 0x90, 0xf2, 0xeb, 0xb7, 0x50, 0xcc, 0xd0, 0x98, 0x94,
-	0xdf, 0xd3, 0x85, 0x29, 0x52, 0x81, 0xcc, 0xc6, 0x8f, 0xfd, 0xf2, 0x5b, 0xf2, 0x68, 0x18, 0xc7,
-	0x0f, 0xe9, 0x7c, 0xed, 0x9a, 0x43, 0xa2, 0x91, 0x37, 0x61, 0x94, 0x7d, 0xda, 0x92, 0x97, 0x18,
-	0x68, 0x55, 0x60, 0x1d, 0x03, 0xed, 0x36, 0x90, 0x23, 0x99, 0xff, 0x2a, 0x97, 0xee, 0x40, 0xa1,
-	0x05, 0x9c, 0x72, 0x6d, 0xbc, 0x03, 0x23, 0xb5, 0x56, 0xcb, 0x7f, 0x2c, 0xa4, 0x84, 0x3c, 0xa6,
-	0x89, 0xfb, 0x8f, 0xef, 0xb0, 0x0e, 0x43, 0xd1, 0x6e, 0x7f, 0x19, 0x80, 0x2c, 0x40, 0xa9, 0xb6,
-	0xdd, 0x58, 0x5e, 0x5e, 0xdc, 0xd8, 0x58, 0x11, 0x4e, 0xc6, 0xaf, 0xca, 0xfe, 0xf1, 0x3c, 0xd7,
-	0x8e, 0xa2, 0xd6, 0x00, 0x1f, 0xc4, 0x84, 0x8e, 0xbc, 0x07, 0xf0, 0xa1, 0xef, 0x75, 0x1e, 0xd0,
-	0x68, 0xcf, 0x77, 0x45, 0xe3, 0x99, 0x4a, 0x31, 0xfe, 0xb1, 0xef, 0x75, 0xec, 0x36, 0x82, 0x59,
-	0xdd, 0x13, 0x24, 0x4b, 0xf9, 0x9f, 0xf5, 0x74, 0xdd, 0x8f, 0x50, 0x87, 0x19, 0x49, 0x7a, 0x7a,
-	0xc7, 0x8f, 0xd2, 0x77, 0x2c, 0x12, 0xcd, 0xfc, 0xf5, 0x1c, 0x4c, 0x72, 0x4b, 0x95, 0x4f, 0x98,
-	0x67, 0x76, 0x31, 0xbe, 0xa3, 0x2d, 0xc6, 0x8b, 0x72, 0x63, 0x50, 0x9a, 0x36, 0xd4, 0x52, 0xdc,
-	0x03, 0xd2, 0x4f, 0x43, 0x2c, 0x79, 0x9e, 0x32, 0xcc, 0x2a, 0xbc, 0x99, 0xdc, 0x1d, 0x87, 0x48,
-	0x64, 0xa3, 0x28, 0x0c, 0x2d, 0x8d, 0x87, 0xf9, 0x6b, 0x39, 0x98, 0x50, 0xf4, 0xc9, 0x67, 0xb6,
-	0xe3, 0xbf, 0xa4, 0x75, 0xbc, 0xbc, 0x83, 0x50, 0x5a, 0x36, 0x54, 0xbf, 0xf7, 0x60, 0xba, 0x8f,
-	0x24, 0xad, 0x96, 0x1b, 0xc3, 0xa8, 0xe5, 0x6f, 0xf4, 0x5f, 0x6e, 0x73, 0x87, 0xe4, 0xf8, 0x72,
-	0x5b, 0xbd, 0x4d, 0xff, 0x56, 0x0e, 0xce, 0x8a, 0x5f, 0xb5, 0x9e, 0xeb, 0x45, 0x0b, 0x7e, 0xe7,
-	0xa1, 0xb7, 0xfb, 0xcc, 0x8e, 0x45, 0x4d, 0x1b, 0x8b, 0xaa, 0x3e, 0x16, 0x4a, 0x03, 0x07, 0x0f,
-	0x89, 0xf9, 0x6f, 0x8a, 0x30, 0x3b, 0x88, 0x80, 0x99, 0xfd, 0x8a, 0x55, 0x85, 0x66, 0x7f, 0xca,
-	0x62, 0xe5, 0xf6, 0x54, 0xe2, 0xcc, 0x91, 0x1b, 0xc2, 0x99, 0x63, 0x05, 0x2a, 0xf8, 0xa9, 0x06,
-	0x0d, 0x59, 0x27, 0x84, 0x89, 0x37, 0xe4, 0x95, 0xa3, 0xc3, 0xea, 0x65, 0x87, 0x95, 0xd9, 0xa1,
-	0x28, 0xb4, 0x7b, 0x81, 0xa7, 0xf0, 0xe8, 0xa3, 0x24, 0x7f, 0x60, 0xc0, 0x24, 0x02, 0x97, 0x1e,
-	0xd1, 0x4e, 0x84, 0xcc, 0x0a, 0xe2, 0x92, 0x26, 0x0e, 0x3a, 0x69, 0x44, 0x81, 0xd7, 0xd9, 0xc5,
-	0x83, 0xa4, 0xb0, 0xbe, 0xc3, 0x7a, 0xe1, 0xcf, 0x0f, 0xab, 0xef, 0x7e, 0x92, 0x40, 0x16, 0xc1,
-	0x2a, 0x64, 0x86, 0x3c, 0xaf, 0x28, 0xc5, 0xcf, 0xa6, 0xaa, 0x99, 0xaa, 0x11, 0xf9, 0x29, 0xb8,
-	0xb0, 0xd4, 0x71, 0x76, 0x5a, 0x74, 0xc1, 0xef, 0x44, 0x5e, 0xa7, 0xe7, 0xf7, 0xc2, 0xba, 0xd3,
-	0xdc, 0xef, 0x75, 0x43, 0x71, 0xd8, 0x89, 0x2d, 0x6f, 0xc6, 0x85, 0xf6, 0x0e, 0x2f, 0x55, 0x58,
-	0x0e, 0x62, 0x40, 0xee, 0xc1, 0x34, 0x2f, 0xaa, 0xf5, 0x22, 0xbf, 0xd1, 0x74, 0x5a, 0x5e, 0x67,
-	0x17, 0xcf, 0x40, 0x8b, 0xf5, 0x4b, 0xcc, 0xb6, 0x74, 0x7a, 0x91, 0x6f, 0x87, 0x1c, 0xae, 0xf0,
-	0xeb, 0x27, 0x22, 0xcb, 0x30, 0x65, 0x51, 0xc7, 0x7d, 0xe0, 0x3c, 0x59, 0x70, 0xba, 0x4e, 0xd3,
-	0x8b, 0x0e, 0xd0, 0x32, 0xcb, 0xd7, 0xab, 0x47, 0x87, 0xd5, 0x17, 0x02, 0xea, 0xb8, 0x76, 0xdb,
-	0x79, 0x62, 0x37, 0x45, 0xa1, 0xc2, 0x2c, 0x4d, 0x17, 0xb3, 0xf2, 0x3a, 0x31, 0xab, 0x52, 0x9a,
-	0x95, 0xd7, 0x19, 0xcc, 0x2a, 0xa1, 0x93, 0xac, 0x36, 0x9c, 0x60, 0x97, 0x46, 0xfc, 0x90, 0x10,
-	0xae, 0x18, 0x57, 0x0d, 0x85, 0x55, 0x84, 0x65, 0x36, 0x1e, 0x18, 0xa6, 0x59, 0x29, 0x74, 0x6c,
-	0xe6, 0x6d, 0x07, 0x5e, 0x44, 0xd5, 0x16, 0x8e, 0x63, 0xb5, 0xb0, 0xff, 0xf1, 0x98, 0x74, 0x50,
-	0x13, 0xfb, 0x28, 0x13, 0x6e, 0x4a, 0x23, 0xcb, 0x7d, 0xdc, 0xb2, 0x5b, 0xd9, 0x47, 0x19, 0x73,
-	0x53, 0xdb, 0x39, 0x81, 0xed, 0x54, 0xb8, 0x0d, 0x68, 0x68, 0x1f, 0x25, 0x59, 0x65, 0x9d, 0x16,
-	0xd1, 0x0e, 0x9b, 0xd1, 0xe2, 0x90, 0x74, 0x12, 0xab, 0xf6, 0x8a, 0xb0, 0xa9, 0x2b, 0x81, 0x2c,
-	0xb6, 0x33, 0x8e, 0x4c, 0xd3, 0xc4, 0x1f, 0x16, 0x8a, 0x23, 0x95, 0x51, 0xab, 0xc2, 0xa7, 0x7c,
-	0xc4, 0x26, 0x0e, 0xca, 0x62, 0xf3, 0x77, 0x72, 0x70, 0x51, 0x8a, 0x63, 0x1a, 0x3d, 0xf6, 0x83,
-	0x7d, 0xaf, 0xb3, 0xfb, 0x8c, 0x4b, 0xd5, 0x3b, 0x9a, 0x54, 0x7d, 0x25, 0xb5, 0xc3, 0xa5, 0x5a,
-	0x79, 0x8c, 0x68, 0xfd, 0xb3, 0x11, 0x78, 0xf1, 0x58, 0x2a, 0xf2, 0x11, 0xdb, 0x05, 0x3d, 0xda,
-	0x89, 0x96, 0xdd, 0x16, 0x65, 0x66, 0x98, 0xdf, 0x8b, 0xc4, 0x61, 0xf6, 0xcb, 0x47, 0x87, 0xd5,
-	0x19, 0x1e, 0x8b, 0x61, 0x7b, 0x6e, 0x8b, 0xda, 0x11, 0x2f, 0xd6, 0x86, 0xa9, 0x9f, 0x9a, 0xb1,
-	0x8c, 0x23, 0xc3, 0x96, 0x3b, 0x11, 0x0d, 0x1e, 0x39, 0xdc, 0x25, 0x5d, 0xb0, 0xdc, 0xa7, 0xb4,
-	0x6b, 0x3b, 0xac, 0xd4, 0xf6, 0x44, 0xb1, 0xce, 0xb2, 0x8f, 0x9a, 0xdc, 0x51, 0x58, 0x2e, 0x30,
-	0xe3, 0xe0, 0x81, 0xf3, 0x44, 0x68, 0xbc, 0x78, 0xbe, 0xaa, 0xb0, 0xe4, 0xfe, 0x70, 0x6d, 0xe7,
-	0x89, 0xd5, 0x4f, 0x42, 0xbe, 0x01, 0xe7, 0x84, 0xe0, 0x66, 0x42, 0x2c, 0xf0, 0x5b, 0xb2, 0xc5,
-	0x05, 0xe4, 0xf5, 0xfa, 0xd1, 0x61, 0xf5, 0x82, 0x10, 0xfb, 0x76, 0x93, 0x63, 0x64, 0xb6, 0x3a,
-	0x9b, 0x0b, 0xd9, 0x60, 0x1b, 0x59, 0xaa, 0x3b, 0x1e, 0xd0, 0x30, 0x74, 0x76, 0xa5, 0x76, 0xcc,
-	0x6f, 0x94, 0x94, 0xce, 0xb4, 0xdb, 0xbc, 0xdc, 0x1a, 0x48, 0x49, 0xee, 0xc1, 0xe4, 0x36, 0xdd,
-	0x51, 0xc7, 0x67, 0x34, 0x5e, 0xe2, 0x95, 0xc7, 0x74, 0x67, 0xf0, 0xe0, 0xa4, 0xe8, 0x88, 0x07,
-	0xd3, 0xeb, 0x81, 0xff, 0xe4, 0x80, 0x99, 0x7a, 0xb4, 0x43, 0x03, 0x74, 0xc4, 0x1a, 0xc3, 0xe3,
-	0xaa, 0xd9, 0x44, 0xb3, 0xd4, 0xcb, 0xeb, 0x9f, 0x3b, 0x3a, 0xac, 0xbe, 0xd8, 0x65, 0x60, 0xbb,
-	0x25, 0xe0, 0x76, 0x2a, 0x30, 0xab, 0x9f, 0x2b, 0xf9, 0x19, 0x98, 0xb2, 0xfc, 0x5e, 0xe4, 0x75,
-	0x76, 0x1b, 0x51, 0xe0, 0x44, 0x74, 0x97, 0x0b, 0xf2, 0xc4, 0xe3, 0x2b, 0x55, 0xca, 0x0f, 0xa6,
-	0x03, 0x0e, 0xb4, 0x43, 0x01, 0xd5, 0x24, 0xa9, 0x4e, 0x60, 0xfe, 0x56, 0x0e, 0x66, 0xc5, 0x30,
-	0x58, 0xb4, 0xe9, 0x07, 0xee, 0xb3, 0xbf, 0xec, 0x97, 0xb4, 0x65, 0xff, 0x72, 0xec, 0xa3, 0x94,
-	0xd5, 0xc8, 0x63, 0x56, 0xfd, 0x3f, 0x33, 0xe0, 0xf2, 0x71, 0x44, 0xac, 0x77, 0x62, 0x1f, 0xbc,
-	0x52, 0x9f, 0xaf, 0x5d, 0x17, 0x66, 0x70, 0x3c, 0xf1, 0xe0, 0x38, 0xbc, 0xe7, 0x87, 0x11, 0x9e,
-	0xde, 0xe5, 0x34, 0x47, 0x82, 0xba, 0xef, 0xb7, 0x50, 0xce, 0xd7, 0xdf, 0x60, 0xe2, 0xfc, 0xcf,
-	0x0f, 0xab, 0xc0, 0x40, 0x6b, 0x78, 0x19, 0xc9, 0xf6, 0x7c, 0x3e, 0x63, 0xf0, 0x5c, 0x3a, 0xb4,
-	0xd1, 0xfb, 0x63, 0x9f, 0x1e, 0x84, 0x56, 0x16, 0x6b, 0x3c, 0xa1, 0xa9, 0xf5, 0xa2, 0xbd, 0xf5,
-	0x80, 0x3e, 0xa4, 0x01, 0xed, 0x34, 0xe9, 0x73, 0x76, 0x42, 0xa3, 0x37, 0x6e, 0x28, 0xf3, 0xe4,
-	0xff, 0x8d, 0xc2, 0xd9, 0x2c, 0x32, 0xd6, 0x2f, 0x8a, 0x46, 0x9c, 0x8e, 0xe2, 0xfd, 0x5b, 0x06,
-	0x94, 0x1b, 0xb4, 0xe9, 0x77, 0xdc, 0x3b, 0x4e, 0x33, 0xf2, 0xa5, 0x4b, 0x86, 0xcd, 0x25, 0x1b,
-	0x83, 0xdb, 0x0f, 0xb1, 0x40, 0x3b, 0x19, 0xf8, 0xf2, 0x70, 0x8a, 0x68, 0xd3, 0x47, 0xa7, 0xd5,
-	0x88, 0xcd, 0xc9, 0xe4, 0x13, 0x78, 0xab, 0xa1, 0x7d, 0x94, 0xd4, 0x61, 0x62, 0xc1, 0xef, 0x74,
-	0x28, 0xfb, 0xa1, 0xb8, 0x60, 0x5e, 0x3e, 0x3a, 0xac, 0xce, 0x36, 0x65, 0x41, 0xfa, 0x84, 0x40,
-	0x27, 0x21, 0xb7, 0x20, 0xbf, 0x39, 0x7f, 0x47, 0x8c, 0x81, 0x74, 0x56, 0xdb, 0x9c, 0xbf, 0x83,
-	0xb6, 0x2e, 0xd3, 0x1f, 0x26, 0x7a, 0xf3, 0x0f, 0xd5, 0x33, 0xd0, 0xcd, 0xf9, 0x3b, 0x64, 0x0d,
-	0xa6, 0x2d, 0xfa, 0xb3, 0x3d, 0x2f, 0xa0, 0x62, 0x01, 0x3c, 0xb8, 0x53, 0xc3, 0xb1, 0x28, 0x72,
-	0x39, 0x16, 0xf0, 0x42, 0xa9, 0xdb, 0xdb, 0xed, 0x87, 0x6a, 0xe4, 0x5a, 0x3f, 0x2d, 0xf9, 0x45,
-	0x38, 0xb7, 0xe8, 0x85, 0xa2, 0xce, 0xfc, 0xf0, 0xd1, 0xc5, 0x7b, 0xc8, 0xd1, 0x01, 0xcb, 0xe1,
-	0x27, 0x32, 0x97, 0xc3, 0xe7, 0xdc, 0x98, 0x89, 0xcd, 0x4f, 0x36, 0xdd, 0xb4, 0xef, 0x6a, 0xf6,
-	0x77, 0xc8, 0xc7, 0x30, 0x89, 0xa7, 0x3d, 0x78, 0x1e, 0x8b, 0xee, 0xcc, 0x63, 0x03, 0xbe, 0xfc,
-	0x85, 0xcc, 0x2f, 0x5f, 0xc2, 0xc3, 0x23, 0x1b, 0x4f, 0x75, 0xd1, 0xf5, 0x59, 0xb3, 0x11, 0x34,
-	0xce, 0xe4, 0x43, 0x98, 0x12, 0x9b, 0xce, 0xda, 0xc3, 0x8d, 0x3d, 0xba, 0xe8, 0x1c, 0x08, 0x27,
-	0x04, 0xd4, 0xff, 0xc4, 0x4e, 0x65, 0xfb, 0x0f, 0xed, 0x68, 0x8f, 0xda, 0xae, 0xa3, 0x89, 0xe7,
-	0x14, 0x21, 0xf9, 0x79, 0x18, 0x5f, 0xf1, 0xf1, 0xe2, 0x09, 0x45, 0x4d, 0x09, 0xf9, 0x7c, 0x15,
-	0x23, 0x57, 0x39, 0x38, 0xb5, 0x89, 0xfc, 0xe8, 0xb0, 0xfa, 0xce, 0x69, 0x67, 0xa1, 0xf2, 0x01,
-	0x4b, 0xfd, 0x1a, 0x59, 0x80, 0xe2, 0x36, 0xdd, 0x61, 0xad, 0x4d, 0x47, 0x5d, 0x49, 0x30, 0x97,
-	0x17, 0x8f, 0xc5, 0x2f, 0xf5, 0x56, 0x47, 0x62, 0x98, 0xff, 0xda, 0xc0, 0x19, 0x48, 0xae, 0xa3,
-	0x23, 0x58, 0xec, 0x0d, 0x8e, 0x96, 0xa5, 0xd3, 0xed, 0xea, 0xfe, 0xdc, 0x1c, 0x85, 0x99, 0xa1,
-	0x77, 0x9c, 0x26, 0x8d, 0xe4, 0x79, 0x25, 0x22, 0x3f, 0x44, 0x88, 0x6a, 0x86, 0x72, 0x1c, 0xf2,
-	0x15, 0x38, 0xbb, 0x48, 0x1f, 0x79, 0x4d, 0x5a, 0x8b, 0x22, 0x1a, 0xf2, 0xd6, 0x2e, 0xd4, 0xf8,
-	0xc5, 0x5e, 0xa9, 0xfe, 0xca, 0xd1, 0x61, 0xf5, 0x8a, 0x8b, 0xe5, 0xb6, 0x93, 0x20, 0xd8, 0x4d,
-	0x47, 0xe5, 0x95, 0xc9, 0xc1, 0xfc, 0x5f, 0x46, 0xd2, 0x03, 0xe4, 0x75, 0x28, 0x58, 0xeb, 0x71,
-	0xfd, 0xf9, 0x9d, 0x5d, 0xaa, 0xfa, 0x88, 0x40, 0xbe, 0x06, 0xe7, 0x14, 0x3e, 0x38, 0x39, 0xa8,
-	0xcb, 0x2a, 0xc4, 0x1b, 0xf3, 0x2a, 0x5e, 0xd2, 0x28, 0x35, 0x71, 0x38, 0x46, 0xaa, 0x46, 0xd9,
-	0x3c, 0x58, 0x63, 0x95, 0x82, 0x45, 0xda, 0xf1, 0x38, 0x6f, 0xa5, 0xb1, 0x2a, 0x6f, 0x17, 0x11,
-	0xd2, 0x8d, 0xcd, 0xe2, 0xf0, 0x61, 0xa1, 0x58, 0xa8, 0x8c, 0x98, 0x7f, 0x65, 0x28, 0x29, 0x00,
-	0x9e, 0xd1, 0xdd, 0xe3, 0xb6, 0xb6, 0x7b, 0x9c, 0x15, 0xa4, 0x71, 0xab, 0x58, 0x59, 0xe6, 0x8e,
-	0x3f, 0x05, 0x13, 0x1a, 0x12, 0xba, 0xbc, 0x6e, 0x86, 0x34, 0xe0, 0xe7, 0x83, 0xcf, 0x97, 0xcb,
-	0x6b, 0xdc, 0xae, 0xa1, 0x3c, 0x19, 0xff, 0xc2, 0x80, 0xa9, 0x14, 0x05, 0xeb, 0x0d, 0x06, 0x52,
-	0x7b, 0xa3, 0x17, 0xd2, 0xc0, 0x42, 0x28, 0x77, 0x90, 0x5b, 0xd1, 0x1d, 0xe4, 0x5a, 0x16, 0x83,
-	0x91, 0x2f, 0xc3, 0xc8, 0x26, 0x6a, 0xf3, 0xba, 0x8f, 0x45, 0xcc, 0x1f, 0x0b, 0xf9, 0x0a, 0xeb,
-	0xb1, 0x7f, 0x55, 0x01, 0x81, 0x65, 0xa4, 0x01, 0x63, 0x0b, 0x01, 0xc5, 0x60, 0xff, 0xc2, 0xf0,
-	0x97, 0x61, 0x4d, 0x4e, 0x92, 0xbe, 0x0c, 0x13, 0x9c, 0xcc, 0xdf, 0xcc, 0x01, 0x49, 0xda, 0x48,
-	0x9b, 0x01, 0x8d, 0xc2, 0x67, 0x76, 0xd0, 0x3f, 0xd0, 0x06, 0xfd, 0xc5, 0xbe, 0x41, 0xe7, 0xcd,
-	0x1b, 0x6a, 0xec, 0xff, 0xd8, 0x80, 0xf3, 0xd9, 0x84, 0xe4, 0x65, 0x18, 0x5d, 0xdb, 0x58, 0x97,
-	0x6e, 0x3a, 0xa2, 0x29, 0x7e, 0x17, 0xb5, 0x54, 0x4b, 0x14, 0x91, 0x37, 0x61, 0xf4, 0x23, 0x6b,
-	0x81, 0x6d, 0x5f, 0x4a, 0xd4, 0xc9, 0xcf, 0x06, 0x76, 0x53, 0x37, 0x7f, 0x04, 0x92, 0x3a, 0xb6,
-	0xf9, 0xa7, 0x36, 0xb6, 0xdf, 0xca, 0xc1, 0x54, 0xad, 0xd9, 0xa4, 0x61, 0xc8, 0x94, 0x13, 0x1a,
-	0x46, 0xcf, 0xec, 0xc0, 0x66, 0x3b, 0xe0, 0x68, 0x6d, 0x1b, 0x6a, 0x54, 0xff, 0xc4, 0x80, 0x73,
-	0x92, 0xea, 0x91, 0x47, 0x1f, 0x6f, 0xec, 0x05, 0x34, 0xdc, 0xf3, 0x5b, 0xee, 0xb0, 0xf1, 0x53,
-	0xb8, 0x4b, 0x7b, 0xad, 0x88, 0x06, 0xea, 0x61, 0xf1, 0x43, 0x84, 0x68, 0xbb, 0x34, 0x42, 0xc8,
-	0x1c, 0x8c, 0xd5, 0xba, 0xdd, 0xc0, 0x7f, 0xc4, 0x97, 0xfd, 0x84, 0xb8, 0x1b, 0xe4, 0x20, 0xed,
-	0x2e, 0x91, 0x83, 0x58, 0x35, 0x16, 0x69, 0x87, 0x7b, 0x17, 0x4f, 0xf0, 0x6a, 0xb8, 0xb4, 0xa3,
-	0x6a, 0x4b, 0x58, 0x6e, 0x7e, 0xb3, 0x00, 0x65, 0xb5, 0x21, 0xc4, 0x84, 0x51, 0xee, 0x2a, 0xa2,
-	0x5e, 0xd9, 0x3b, 0x08, 0xb1, 0x44, 0x49, 0xe2, 0x81, 0x93, 0x3b, 0xd1, 0x03, 0x67, 0x1b, 0x26,
-	0xd6, 0x03, 0xbf, 0xeb, 0x87, 0xd4, 0xe5, 0xf9, 0x5a, 0xb8, 0xd4, 0x9a, 0x89, 0xdd, 0x52, 0x79,
-	0x9f, 0xb3, 0x22, 0xae, 0x9a, 0x77, 0x05, 0xb6, 0x9d, 0xce, 0xe6, 0xa2, 0xf3, 0xe1, 0x87, 0xed,
-	0x4e, 0x28, 0x5c, 0xf7, 0xe3, 0xc3, 0x76, 0x06, 0xd1, 0x0f, 0xdb, 0x19, 0x44, 0x5d, 0x16, 0x23,
-	0x4f, 0x6b, 0x59, 0x90, 0xdf, 0x34, 0x60, 0xbc, 0xd6, 0xe9, 0x08, 0x0f, 0x1c, 0x19, 0xf4, 0x7c,
-	0x2e, 0x39, 0x70, 0xe7, 0x2e, 0x9a, 0xfc, 0xbc, 0xfd, 0xeb, 0xe2, 0xbc, 0xfd, 0x9d, 0x4f, 0x74,
-	0xde, 0xbe, 0x11, 0x38, 0x5e, 0x14, 0xe2, 0xc5, 0x6a, 0xf2, 0x41, 0xd5, 0x0d, 0x57, 0xa9, 0x07,
-	0x79, 0x07, 0x2a, 0xf1, 0x7c, 0x5c, 0xee, 0xb8, 0xf4, 0x09, 0xe5, 0x0e, 0x4b, 0x13, 0x3c, 0x32,
-	0x4f, 0xbb, 0x48, 0x48, 0x23, 0x9a, 0xdf, 0x32, 0xe0, 0xbc, 0x3a, 0x21, 0x1a, 0xbd, 0x9d, 0xb6,
-	0x87, 0xa6, 0x08, 0xb9, 0x01, 0x25, 0x31, 0x5e, 0xb1, 0x22, 0xd7, 0x9f, 0xe4, 0x27, 0x41, 0x21,
-	0x4b, 0x6c, 0x88, 0x18, 0x0f, 0x61, 0xb7, 0xcf, 0xa4, 0x96, 0x1b, 0x2b, 0xaa, 0xcf, 0x8a, 0xce,
-	0xae, 0x04, 0xf8, 0x5b, 0x1f, 0x3b, 0x06, 0x31, 0xdf, 0x87, 0x69, 0xbd, 0x96, 0x0d, 0x8a, 0xe1,
-	0x60, 0xb2, 0x69, 0x46, 0x76, 0xd3, 0x64, 0xb9, 0xb9, 0x0d, 0xa4, 0x8f, 0x3e, 0xc4, 0x4b, 0x23,
-	0x1a, 0xc9, 0x4b, 0x4d, 0x79, 0xf4, 0xd4, 0x87, 0x18, 0xa7, 0xbb, 0x1a, 0x57, 0xbb, 0x1b, 0x49,
-	0xcd, 0xbf, 0x2e, 0xc1, 0x4c, 0x86, 0xe8, 0x38, 0x61, 0x6b, 0xaf, 0xea, 0x8b, 0xa7, 0x14, 0xdf,
-	0xce, 0xcb, 0x25, 0xf3, 0xbe, 0x4c, 0x6d, 0x74, 0xcc, 0x52, 0x39, 0x2e, 0xdf, 0xd1, 0x67, 0xb1,
-	0xbd, 0xab, 0x0e, 0x34, 0x23, 0x4f, 0xcd, 0x81, 0xa6, 0x0e, 0x13, 0xa2, 0x55, 0x62, 0x29, 0x8f,
-	0x26, 0x26, 0x7a, 0xc0, 0x0b, 0xec, 0xbe, 0x25, 0xad, 0x93, 0x70, 0x1e, 0xa1, 0xdf, 0x7a, 0x44,
-	0x05, 0x8f, 0x31, 0x95, 0x07, 0x16, 0x64, 0xf2, 0x50, 0x48, 0xc8, 0x3f, 0x35, 0x80, 0x08, 0x88,
-	0xba, 0x9e, 0x8b, 0xc7, 0xad, 0x67, 0xf7, 0xe9, 0xac, 0xe7, 0x17, 0x65, 0x1d, 0xb3, 0xd7, 0x75,
-	0x46, 0xb5, 0xc8, 0x3f, 0x36, 0x60, 0x9a, 0x7b, 0x71, 0xa8, 0x95, 0x2d, 0x1d, 0x57, 0xd9, 0xe6,
-	0xd3, 0xa9, 0xec, 0xe5, 0x10, 0x3f, 0x3b, 0xa0, 0xae, 0xfd, 0x95, 0x22, 0x3f, 0x05, 0x10, 0xaf,
-	0x28, 0xe9, 0x2d, 0x78, 0x39, 0x43, 0x0a, 0xc4, 0x48, 0x49, 0xc0, 0x63, 0x14, 0xd3, 0xa9, 0xfe,
-	0x35, 0x09, 0x37, 0xf2, 0x8b, 0x70, 0x96, 0xad, 0x97, 0x18, 0x22, 0x7c, 0xce, 0x66, 0xc7, 0xf1,
-	0x2b, 0x5f, 0x1c, 0xbc, 0xb5, 0xdf, 0xc8, 0x22, 0xe3, 0x31, 0x1b, 0x49, 0xf8, 0x7b, 0xd4, 0x56,
-	0x4d, 0xbe, 0x2c, 0x0a, 0x74, 0x2e, 0xc5, 0xda, 0x87, 0xb3, 0x65, 0xfc, 0x66, 0xa6, 0x7c, 0xbb,
-	0x28, 0xd7, 0x02, 0x97, 0x6f, 0xa1, 0x1e, 0x74, 0x81, 0x20, 0xf2, 0x11, 0x90, 0x46, 0x6f, 0x77,
-	0x97, 0x86, 0x11, 0x75, 0x39, 0x8c, 0x06, 0xe1, 0xec, 0x04, 0xca, 0x07, 0x3c, 0x32, 0x0a, 0x65,
-	0xa9, 0x1d, 0xc8, 0x62, 0x75, 0x92, 0xf4, 0x13, 0x5f, 0xda, 0x81, 0x8b, 0x03, 0x9b, 0x99, 0x11,
-	0x50, 0x31, 0xa7, 0x07, 0x54, 0x5c, 0x1c, 0x24, 0x0e, 0x43, 0x35, 0xa8, 0xe2, 0xf7, 0x8c, 0x94,
-	0xfc, 0x13, 0xca, 0x0a, 0xcf, 0x02, 0x37, 0x68, 0x83, 0xc8, 0x61, 0x60, 0x3c, 0x97, 0x90, 0xb9,
-	0x44, 0x49, 0x62, 0x12, 0x52, 0x95, 0xb0, 0x28, 0x2b, 0x3f, 0xa5, 0x28, 0x34, 0xff, 0x85, 0x01,
-	0x84, 0xd7, 0x70, 0xc1, 0xe9, 0x3a, 0x3b, 0x5e, 0xcb, 0x8b, 0x3c, 0x1a, 0x92, 0xfb, 0x50, 0x11,
-	0x2c, 0x9c, 0x9d, 0x16, 0x55, 0x7d, 0xa5, 0xc4, 0x65, 0x6a, 0x5c, 0x66, 0xa7, 0xd5, 0x9a, 0x3e,
-	0xc2, 0x01, 0x83, 0x97, 0xfb, 0x14, 0x83, 0x67, 0xfe, 0xd0, 0x80, 0x8b, 0xfd, 0xd5, 0x16, 0x5f,
-	0x8e, 0x3b, 0xcf, 0x38, 0xa1, 0xf3, 0xb2, 0x5a, 0x99, 0xc3, 0x63, 0xc8, 0xa7, 0xd6, 0xca, 0x7c,
-	0x72, 0xaa, 0x79, 0xfa, 0x56, 0xfe, 0x6a, 0x0e, 0xca, 0xeb, 0xad, 0xde, 0xae, 0xd7, 0x59, 0x74,
-	0x22, 0xe7, 0x99, 0x35, 0x29, 0xde, 0xd6, 0x4c, 0x8a, 0xd8, 0x3b, 0x2a, 0x6e, 0xd8, 0x70, 0x19,
-	0xb9, 0x0c, 0x98, 0x4a, 0x48, 0xf8, 0x2a, 0xbd, 0x07, 0x05, 0xf6, 0x43, 0x68, 0x28, 0x57, 0xfa,
-	0x18, 0x23, 0xd6, 0x8d, 0xf8, 0x3f, 0xa1, 0xe4, 0xeb, 0x79, 0xd0, 0x90, 0xc3, 0xa5, 0x9f, 0xe0,
-	0x69, 0x8c, 0x4e, 0x9f, 0x72, 0xf1, 0x9f, 0x1b, 0x50, 0x49, 0xb7, 0x84, 0xdc, 0x87, 0x31, 0xc6,
-	0xc9, 0x8b, 0x53, 0x22, 0xbd, 0x32, 0xa0, 0xcd, 0x37, 0x04, 0x1a, 0xaf, 0x1e, 0x76, 0x3e, 0xe5,
-	0x10, 0x4b, 0x72, 0xb8, 0x64, 0x41, 0x59, 0xc5, 0xca, 0xa8, 0xdd, 0x1b, 0xba, 0x68, 0x3a, 0x9f,
-	0xdd, 0x0f, 0x6a, 0xad, 0x7f, 0x57, 0xab, 0xb5, 0x10, 0x4a, 0xc3, 0xe6, 0xb6, 0xc3, 0xf0, 0x30,
-	0x9e, 0xc1, 0x43, 0x9d, 0x67, 0x32, 0xd9, 0x87, 0x1e, 0x1e, 0xc6, 0x61, 0xcc, 0x16, 0xe1, 0xdf,
-	0x13, 0xf3, 0x0c, 0x6d, 0x91, 0x2e, 0x42, 0x54, 0x7d, 0x96, 0xe3, 0x98, 0x7f, 0x2f, 0x0f, 0xe7,
-	0x93, 0xea, 0xf1, 0x4c, 0x7f, 0xeb, 0x4e, 0xe0, 0xb4, 0xc3, 0x13, 0x56, 0xc0, 0xd5, 0xbe, 0xaa,
-	0x61, 0xf8, 0xb3, 0xac, 0x9a, 0x52, 0x21, 0x33, 0x55, 0x21, 0x34, 0xe2, 0x78, 0x85, 0x64, 0x35,
-	0xc8, 0x7d, 0xc8, 0x37, 0x68, 0x24, 0x82, 0x24, 0x5f, 0xeb, 0xeb, 0x55, 0xb5, 0x5e, 0x37, 0x1a,
-	0x34, 0xe2, 0x83, 0xc8, 0xfd, 0xcc, 0xa9, 0xe6, 0xf7, 0xcd, 0xd4, 0xf1, 0x6d, 0x18, 0x5d, 0x7a,
-	0xd2, 0xa5, 0xcd, 0x48, 0xc4, 0x46, 0x5e, 0x3b, 0x9e, 0x1f, 0xc7, 0x55, 0x22, 0x30, 0x29, 0x02,
-	0xd4, 0xce, 0xe2, 0x28, 0x97, 0x6e, 0x43, 0x51, 0x7e, 0xfc, 0x54, 0x91, 0x84, 0x6f, 0xc3, 0xb8,
-	0xf2, 0x91, 0x53, 0x4d, 0xfa, 0xbf, 0x36, 0x60, 0x94, 0x09, 0xbd, 0xad, 0xb7, 0x9e, 0x51, 0x89,
-	0x74, 0x4b, 0x93, 0x48, 0xd3, 0x4a, 0xc8, 0x0b, 0xae, 0xcb, 0xb7, 0x4e, 0x90, 0x45, 0x87, 0x06,
-	0x40, 0x82, 0x4c, 0xee, 0xc2, 0x18, 0xbf, 0xc8, 0x91, 0x69, 0x34, 0xd5, 0x18, 0x1a, 0x51, 0x92,
-	0x68, 0x39, 0x7e, 0x37, 0xad, 0x16, 0x4a, 0x6a, 0xb2, 0x98, 0xf8, 0x19, 0xab, 0x41, 0x9b, 0x8c,
-	0xcd, 0x82, 0xdf, 0xe1, 0x31, 0x15, 0xa1, 0x92, 0x6e, 0x2a, 0xdb, 0xe1, 0xb8, 0x26, 0x0e, 0x36,
-	0xf2, 0xc7, 0x31, 0x39, 0x2f, 0x98, 0x64, 0x9f, 0x79, 0x7c, 0x7b, 0x9c, 0x47, 0x29, 0xc8, 0x8a,
-	0xbd, 0x07, 0xe5, 0x3b, 0x7e, 0xf0, 0xd8, 0x09, 0xdc, 0xda, 0x2e, 0x15, 0x1e, 0xe2, 0x45, 0x74,
-	0xf3, 0x9e, 0x78, 0xc8, 0xe1, 0xb6, 0xc3, 0x0a, 0x7e, 0x74, 0x58, 0x2d, 0xd4, 0x7d, 0xbf, 0x65,
-	0x69, 0xe8, 0x64, 0x0d, 0x26, 0x1e, 0x38, 0x4f, 0xc4, 0x7d, 0xdd, 0xc6, 0xc6, 0x8a, 0xf0, 0x33,
-	0xb9, 0x76, 0x74, 0x58, 0xbd, 0xd8, 0x76, 0x9e, 0xc4, 0xf7, 0x7c, 0x83, 0x5d, 0xa1, 0x75, 0x7a,
-	0xe2, 0xc1, 0xe4, 0xba, 0x1f, 0x44, 0xe2, 0x23, 0x4c, 0xa7, 0xcd, 0x0f, 0xb8, 0x6e, 0x9b, 0xcb,
-	0xbc, 0x6e, 0xbb, 0xc8, 0x14, 0x79, 0xfb, 0x61, 0x4c, 0xae, 0x85, 0xd6, 0x69, 0x8c, 0xc9, 0x7b,
-	0x30, 0xbd, 0x40, 0x83, 0xc8, 0x7b, 0xe8, 0x35, 0x9d, 0x88, 0xde, 0xf1, 0x83, 0xb6, 0x13, 0x89,
-	0x03, 0x15, 0x34, 0xa8, 0x9b, 0x94, 0x73, 0x6a, 0x3b, 0x91, 0xd5, 0x8f, 0x49, 0xbe, 0x96, 0xe5,
-	0xb9, 0x33, 0x82, 0xcd, 0x7f, 0x93, 0x29, 0x05, 0x19, 0x9e, 0x3b, 0x03, 0xba, 0x20, 0xc3, 0x87,
-	0x67, 0xf7, 0xb8, 0x6b, 0xcf, 0x62, 0xfd, 0xa6, 0xb8, 0x82, 0x3d, 0xf9, 0x5a, 0x33, 0x1e, 0xb7,
-	0x01, 0xd7, 0x9b, 0xf3, 0x90, 0xaf, 0xaf, 0xdf, 0xc1, 0x23, 0x12, 0x71, 0xcd, 0x48, 0x3b, 0x7b,
-	0x4e, 0xa7, 0x89, 0xba, 0x8c, 0xf0, 0x5d, 0x50, 0x05, 0x5e, 0x7d, 0xfd, 0x0e, 0x71, 0x60, 0x66,
-	0x9d, 0x06, 0x6d, 0x2f, 0xfa, 0xca, 0xcd, 0x9b, 0xca, 0x40, 0x15, 0xb1, 0x6a, 0x73, 0xa2, 0x6a,
-	0xd5, 0x2e, 0xa2, 0xd8, 0x4f, 0x6e, 0xde, 0xcc, 0x1c, 0x8e, 0xb8, 0x62, 0x59, 0xbc, 0xc8, 0x12,
-	0x4c, 0x3e, 0x70, 0x9e, 0x88, 0x0b, 0xe9, 0xd8, 0xc6, 0xcb, 0xa3, 0x67, 0x3c, 0x4e, 0xac, 0x66,
-	0x52, 0xa4, 0x0e, 0xb1, 0x4e, 0x44, 0xde, 0x85, 0xf1, 0x64, 0x7a, 0x85, 0x78, 0x15, 0x99, 0xe7,
-	0x2e, 0x91, 0xca, 0xe4, 0xd4, 0xce, 0x92, 0x14, 0x74, 0xb2, 0x19, 0x9b, 0xe8, 0x5c, 0x21, 0x45,
-	0x47, 0xc1, 0x52, 0x7d, 0x4e, 0x35, 0xd1, 0x1d, 0x2c, 0xd1, 0x9a, 0x35, 0x15, 0xab, 0xe8, 0xdc,
-	0x53, 0xc6, 0xd2, 0xb9, 0x28, 0x96, 0xff, 0x7a, 0xe0, 0xb7, 0xbb, 0x11, 0x7a, 0x0c, 0xa6, 0x2c,
-	0xff, 0x2e, 0x96, 0x64, 0x58, 0xfe, 0x9c, 0x24, 0xfb, 0x9e, 0x7d, 0xe2, 0x53, 0xdc, 0xb3, 0x53,
-	0x28, 0xac, 0xf8, 0xcd, 0x7d, 0x74, 0x11, 0x2c, 0xd5, 0x3f, 0x62, 0xf2, 0xa3, 0xe5, 0x37, 0xf7,
-	0x9f, 0xde, 0xfd, 0x30, 0xb2, 0x27, 0xab, 0xac, 0xed, 0x6c, 0x5a, 0x89, 0x4f, 0xcf, 0x4e, 0x69,
-	0x37, 0x6d, 0x5a, 0x19, 0x57, 0x54, 0xf8, 0x2c, 0x94, 0x0d, 0xb1, 0x74, 0x72, 0x42, 0xa1, 0xb2,
-	0x48, 0xc3, 0xfd, 0xc8, 0xef, 0x2e, 0xb4, 0xbc, 0xee, 0x8e, 0xef, 0x04, 0xee, 0x6c, 0x65, 0x80,
-	0xc0, 0x78, 0x3d, 0x53, 0x60, 0x4c, 0xbb, 0x9c, 0xde, 0x6e, 0x4a, 0x06, 0x56, 0x1f, 0x4b, 0xf2,
-	0x35, 0x98, 0x64, 0xab, 0x65, 0xe9, 0x49, 0x44, 0x3b, 0x7c, 0x2a, 0x4d, 0xe3, 0x56, 0x7f, 0x56,
-	0x09, 0x32, 0x8c, 0x0b, 0xf9, 0x24, 0x45, 0xe9, 0x41, 0x63, 0x02, 0x75, 0x92, 0xea, 0xac, 0xcc,
-	0x9f, 0x4a, 0xf5, 0x09, 0x59, 0x86, 0x31, 0x51, 0x03, 0xb1, 0xeb, 0xf4, 0xb7, 0xe5, 0xc5, 0xcc,
-	0xb6, 0x8c, 0x89, 0xb6, 0x58, 0x92, 0xde, 0xfc, 0xb7, 0x06, 0x4c, 0x68, 0x9f, 0x23, 0xb7, 0x15,
-	0xf7, 0x95, 0xc4, 0xed, 0x4c, 0xc3, 0xc9, 0x4c, 0x4f, 0x7f, 0x5b, 0xf8, 0x2c, 0xe5, 0x06, 0xd3,
-	0x65, 0x66, 0x0e, 0x93, 0x41, 0xff, 0xf9, 0xe3, 0x83, 0xfe, 0x0b, 0x03, 0x82, 0xfe, 0xbf, 0x3d,
-	0x01, 0x93, 0xfa, 0x06, 0xc7, 0x34, 0xce, 0x15, 0x7f, 0xd7, 0xeb, 0x48, 0xbb, 0x95, 0xa7, 0xb1,
-	0x40, 0x88, 0x96, 0xeb, 0x1d, 0x21, 0xe4, 0x55, 0x80, 0xf8, 0x6a, 0x56, 0x9a, 0xa6, 0x22, 0x33,
-	0xbd, 0x52, 0x40, 0x7e, 0x1a, 0x60, 0xd5, 0x77, 0x69, 0x9c, 0x09, 0xe5, 0x98, 0x03, 0xa5, 0xd7,
-	0xc5, 0x81, 0x92, 0xc8, 0x26, 0x7f, 0x74, 0x58, 0x3d, 0xd7, 0xf1, 0x5d, 0xda, 0x9f, 0x02, 0x45,
-	0xe1, 0x48, 0xbe, 0x04, 0x23, 0x56, 0xaf, 0x45, 0x65, 0x62, 0x8e, 0x71, 0x39, 0xe1, 0x7b, 0x2d,
-	0x25, 0xcb, 0x64, 0xd0, 0x4b, 0xdf, 0x23, 0x30, 0x00, 0xf9, 0x00, 0xe0, 0x7e, 0x6f, 0x87, 0xde,
-	0x0d, 0xfc, 0x5e, 0x57, 0x46, 0xfe, 0xa2, 0x19, 0xbb, 0x1f, 0xa7, 0x71, 0xb2, 0x77, 0xb1, 0x50,
-	0xfd, 0x78, 0x42, 0x42, 0xd6, 0x60, 0x4c, 0x88, 0x0f, 0x71, 0x4e, 0xff, 0x52, 0xd6, 0x09, 0x91,
-	0xa2, 0x43, 0x88, 0x4c, 0x19, 0x08, 0xd6, 0x0f, 0x6d, 0xb8, 0x19, 0xfe, 0x2e, 0x94, 0x18, 0x7b,
-	0x66, 0x6a, 0x87, 0x62, 0xef, 0x40, 0xff, 0x41, 0xa5, 0x42, 0xcc, 0x2c, 0xd7, 0xf2, 0x75, 0xc5,
-	0x04, 0xe4, 0x6b, 0x98, 0xdb, 0x46, 0x74, 0xf5, 0xb1, 0x07, 0x8d, 0xaf, 0xf5, 0x75, 0xf5, 0x59,
-	0xa7, 0xdb, 0xcd, 0x48, 0x06, 0x16, 0xf3, 0x23, 0xbb, 0x71, 0x8c, 0x4d, 0x9c, 0x6a, 0xf8, 0x98,
-	0x0f, 0x5c, 0xef, 0xfb, 0xc0, 0xac, 0x0c, 0x1b, 0xe9, 0xcf, 0x68, 0xa3, 0xf1, 0x25, 0x5d, 0xa8,
-	0x24, 0x69, 0xb4, 0xc4, 0xb7, 0xe0, 0xb8, 0x6f, 0xbd, 0xd9, 0xf7, 0x2d, 0x75, 0x00, 0xfb, 0x3e,
-	0xd7, 0xc7, 0x9d, 0xb8, 0x49, 0x5a, 0x58, 0xf1, 0xbd, 0xf1, 0xe3, 0xbe, 0xf7, 0x6a, 0xdf, 0xf7,
-	0x66, 0xdc, 0x9d, 0xfe, 0xef, 0xa4, 0x78, 0x92, 0x77, 0x61, 0x42, 0x42, 0x70, 0x7d, 0xe0, 0x01,
-	0x9f, 0xd0, 0xef, 0xdd, 0x1d, 0x74, 0x1a, 0xd3, 0xd3, 0xb9, 0xa8, 0xc8, 0x2a, 0x35, 0x9f, 0x1d,
-	0x13, 0x1a, 0x75, 0x7a, 0x56, 0xe8, 0xc8, 0xe4, 0xab, 0x30, 0xbe, 0xdc, 0x66, 0x0d, 0xf1, 0x3b,
-	0x4e, 0x44, 0x71, 0x33, 0x4a, 0x0e, 0x4d, 0x95, 0x12, 0x65, 0xaa, 0xf2, 0x1c, 0x8f, 0x49, 0x91,
-	0xba, 0x99, 0x2b, 0x14, 0xac, 0xf3, 0xf8, 0xf1, 0x8b, 0x98, 0xc3, 0xa1, 0xd8, 0x7a, 0x5e, 0xcc,
-	0x38, 0xb8, 0x54, 0xd8, 0xa3, 0x2c, 0xe7, 0xa7, 0x3a, 0xb6, 0x58, 0x10, 0x5a, 0xe7, 0xe9, 0x3c,
-	0xc9, 0x7b, 0x30, 0x2e, 0x22, 0x1a, 0x6b, 0xd6, 0x6a, 0x38, 0x5b, 0xc1, 0xc6, 0x63, 0x2e, 0x36,
-	0x19, 0xfc, 0x68, 0x3b, 0x41, 0xea, 0xf6, 0x2a, 0xc1, 0x27, 0x5f, 0x81, 0xb3, 0xdb, 0x5e, 0xc7,
-	0xf5, 0x1f, 0x87, 0x42, 0x80, 0x0b, 0x41, 0x37, 0x9d, 0xf8, 0xe8, 0x3c, 0xe6, 0xe5, 0xb6, 0xdc,
-	0xb6, 0xfa, 0x04, 0x5f, 0x26, 0x07, 0xf2, 0x0b, 0x7d, 0x9c, 0xf9, 0x0c, 0x22, 0xc7, 0xcd, 0xa0,
-	0xf9, 0xbe, 0x19, 0xd4, 0xff, 0xf9, 0xf4, 0x74, 0xca, 0xfc, 0x0c, 0xf1, 0x81, 0xe8, 0x3a, 0xc7,
-	0x87, 0xbe, 0xd7, 0x99, 0x9d, 0xd1, 0x1e, 0xf2, 0x88, 0x5d, 0x66, 0x11, 0x6f, 0xdd, 0x6f, 0x79,
-	0xcd, 0x83, 0xba, 0x79, 0x74, 0x58, 0x7d, 0x29, 0xad, 0xcd, 0x7c, 0xec, 0x6b, 0x87, 0x0b, 0x19,
-	0xac, 0xc9, 0x57, 0xa1, 0xcc, 0xfe, 0xc6, 0xaa, 0xdf, 0x59, 0xed, 0xaa, 0x4b, 0xc1, 0x14, 0xdf,
-	0xc1, 0x31, 0xc2, 0x90, 0xcb, 0x0c, 0xad, 0x50, 0x63, 0x65, 0xfe, 0xd0, 0x80, 0xb3, 0x59, 0x75,
-	0x3d, 0x21, 0xbf, 0x8d, 0x99, 0xba, 0xf4, 0xc6, 0x73, 0x09, 0x7e, 0xe9, 0x1d, 0x5f, 0x75, 0x57,
-	0x61, 0x84, 0xd9, 0xca, 0xd2, 0x29, 0x0b, 0xb7, 0x43, 0x66, 0x4f, 0x87, 0x16, 0x87, 0x33, 0x04,
-	0x74, 0xa6, 0xc7, 0xfd, 0x72, 0x84, 0x23, 0xa0, 0xc7, 0xbd, 0xc5, 0xe1, 0x0c, 0x81, 0x6d, 0xbb,
-	0x72, 0x9b, 0x40, 0x04, 0xb6, 0x1b, 0x87, 0x16, 0x87, 0x93, 0xd7, 0x60, 0x6c, 0xad, 0xb3, 0x42,
-	0x9d, 0x47, 0x54, 0xdc, 0x38, 0xe1, 0x39, 0x8a, 0xdf, 0xb1, 0x5b, 0x0c, 0x66, 0xc9, 0x42, 0xf3,
-	0xbb, 0x06, 0x4c, 0xf7, 0x75, 0xd3, 0xc9, 0x29, 0x7c, 0x8e, 0xbf, 0xde, 0x1b, 0xa6, 0x7d, 0xbc,
-	0xfa, 0x85, 0xec, 0xea, 0x9b, 0x7f, 0x99, 0x87, 0x0b, 0x03, 0x76, 0xad, 0xe4, 0x6a, 0xde, 0x38,
-	0xf1, 0x6a, 0xfe, 0xeb, 0x6c, 0x97, 0x70, 0xbc, 0x76, 0xb8, 0xe1, 0x27, 0x35, 0x4e, 0x6e, 0x31,
-	0xb0, 0x4c, 0xe6, 0xc8, 0x90, 0xf9, 0x1c, 0x2e, 0x36, 0x91, 0xc2, 0x8e, 0xfc, 0xbe, 0x33, 0x63,
-	0x9d, 0x59, 0xdf, 0xe5, 0x78, 0xfe, 0xc7, 0xe4, 0x72, 0x5c, 0xbf, 0x92, 0x2a, 0x3c, 0xd5, 0x2b,
-	0xa9, 0xec, 0x43, 0xf2, 0x91, 0x4f, 0x73, 0x15, 0xf0, 0xef, 0x53, 0xd7, 0xf1, 0x3f, 0x8e, 0x43,
-	0x7d, 0x0d, 0x46, 0xb6, 0xf7, 0x68, 0x20, 0xf5, 0x5b, 0xac, 0xc8, 0x63, 0x06, 0x50, 0x2b, 0x82,
-	0x18, 0xe6, 0xcf, 0x43, 0x59, 0xfd, 0x18, 0xae, 0x65, 0xf6, 0x5b, 0x2c, 0x26, 0xbe, 0x96, 0x19,
-	0xc0, 0xe2, 0xf0, 0x13, 0x33, 0x62, 0x25, 0xbd, 0x90, 0x3f, 0xa9, 0x17, 0xcc, 0x7f, 0x67, 0x40,
-	0x01, 0x13, 0x02, 0xbc, 0x05, 0x25, 0x79, 0x54, 0xaa, 0x06, 0xc9, 0xcf, 0xc8, 0x93, 0xd4, 0x50,
-	0xf7, 0x67, 0x10, 0x40, 0xf6, 0xa9, 0x2d, 0x1a, 0xec, 0x68, 0x6e, 0x2f, 0x8f, 0x18, 0x40, 0xfd,
-	0x14, 0x62, 0x9c, 0xa2, 0x4b, 0xd0, 0xb5, 0x47, 0xd8, 0xf7, 0x7c, 0xc1, 0x73, 0xd7, 0x9e, 0x3e,
-	0xbb, 0x5e, 0x62, 0x99, 0xbf, 0x6d, 0xc0, 0xb9, 0x4c, 0x3d, 0x80, 0x7d, 0x95, 0x2b, 0x1c, 0xca,
-	0x8c, 0x48, 0x6b, 0x1b, 0x1c, 0xe3, 0x34, 0x2e, 0x3c, 0xa7, 0x18, 0xde, 0xcf, 0x41, 0x29, 0xb6,
-	0xcf, 0xc8, 0x59, 0x39, 0x74, 0x78, 0x9e, 0x26, 0x8d, 0x99, 0xbf, 0x36, 0x60, 0x94, 0x55, 0xe1,
-	0x99, 0x8d, 0xae, 0xc8, 0x3e, 0x5d, 0x65, 0x4d, 0x1a, 0x2a, 0xa6, 0xe2, 0x0f, 0x46, 0x01, 0x12,
-	0x64, 0xb2, 0x03, 0x93, 0x6b, 0xcb, 0x8b, 0x0b, 0xcb, 0x2e, 0xed, 0x44, 0x78, 0xcb, 0x97, 0x8a,
-	0xb2, 0x67, 0x86, 0x65, 0xd0, 0x71, 0x5a, 0x02, 0xe1, 0x20, 0x59, 0x9e, 0xbe, 0xe7, 0x36, 0x6d,
-	0x2f, 0xa6, 0x53, 0x15, 0x32, 0x9d, 0x23, 0xfb, 0x46, 0xa3, 0xf6, 0x60, 0x45, 0xf9, 0x46, 0x6e,
-	0xc8, 0x6f, 0x84, 0x4e, 0xbb, 0x35, 0xe0, 0x1b, 0x3a, 0x47, 0xb2, 0x07, 0x95, 0xbb, 0x28, 0xbb,
-	0x95, 0xaf, 0xe4, 0x8f, 0xff, 0xca, 0xcb, 0xe2, 0x2b, 0x2f, 0x70, 0xa1, 0x9f, 0xfd, 0x9d, 0x3e,
-	0xae, 0xc9, 0xcc, 0x2d, 0x9c, 0x38, 0x73, 0xff, 0xb6, 0x01, 0xa3, 0x7c, 0x73, 0x88, 0xdf, 0xb2,
-	0xc8, 0xdc, 0x7e, 0xb6, 0x9f, 0xce, 0xf6, 0x53, 0x89, 0xf0, 0x3f, 0xd5, 0x00, 0xe7, 0x65, 0x64,
-	0x31, 0xf5, 0x30, 0x86, 0x3c, 0x42, 0x47, 0xc5, 0x94, 0x97, 0x24, 0x8e, 0x50, 0xfc, 0x4d, 0x0c,
-	0x95, 0x0b, 0xc7, 0x50, 0x9f, 0xe9, 0x1b, 0xfb, 0x94, 0xcf, 0xf4, 0xad, 0x40, 0x49, 0x78, 0xf6,
-	0xd4, 0x0f, 0x84, 0xf9, 0x29, 0x0f, 0x58, 0x62, 0xb8, 0x92, 0x7c, 0x9a, 0x83, 0xec, 0x1d, 0x2d,
-	0x75, 0x5c, 0x8c, 0x48, 0xd6, 0xa0, 0x94, 0x84, 0x86, 0x94, 0xb4, 0x7b, 0xd0, 0x18, 0x2e, 0x5c,
-	0x5f, 0x79, 0xf4, 0x61, 0x66, 0x24, 0x48, 0xc2, 0xc3, 0xfc, 0xa6, 0x01, 0x95, 0xf4, 0x7c, 0x21,
-	0xef, 0xc2, 0x78, 0x1c, 0x9d, 0x13, 0xfb, 0x17, 0xe0, 0x41, 0x66, 0x12, 0xce, 0xa3, 0x79, 0x1a,
-	0xa8, 0xe8, 0x64, 0x1e, 0x8a, 0x6c, 0xd9, 0x29, 0xb9, 0x83, 0x51, 0x9e, 0xf4, 0x04, 0x4c, 0xbd,
-	0xd7, 0x93, 0x78, 0xca, 0xaa, 0xfd, 0x8f, 0x79, 0x18, 0x57, 0x06, 0x8b, 0x5c, 0x83, 0xe2, 0x72,
-	0xb8, 0xe2, 0x37, 0xf7, 0xa9, 0x2b, 0xae, 0x0b, 0xf0, 0x15, 0x46, 0x2f, 0xb4, 0x5b, 0x08, 0xb4,
-	0xe2, 0x62, 0x52, 0x87, 0x09, 0xfe, 0x9f, 0x8c, 0xc2, 0xcc, 0x25, 0x47, 0x9d, 0x1c, 0x59, 0xc6,
-	0x5f, 0xaa, 0x3b, 0xac, 0x46, 0x42, 0xbe, 0x01, 0xc0, 0x01, 0x6c, 0x7c, 0x87, 0x70, 0xec, 0x95,
-	0x0b, 0xf8, 0x9c, 0xf8, 0x40, 0xe4, 0xa9, 0x2d, 0xc4, 0xa9, 0xa0, 0x30, 0xc4, 0x17, 0xe0, 0xfc,
-	0xe6, 0xfe, 0xf0, 0x6f, 0x40, 0x26, 0x2f, 0xc0, 0xf9, 0xcd, 0x7d, 0x3b, 0xdb, 0xcb, 0x4b, 0x65,
-	0x49, 0xbe, 0x65, 0xc0, 0x25, 0x8b, 0x36, 0xfd, 0x47, 0x34, 0x38, 0xa8, 0x45, 0x88, 0xa5, 0x7e,
-	0xf1, 0x64, 0x97, 0xb2, 0x5b, 0xe2, 0x8b, 0xaf, 0x07, 0x82, 0x0b, 0x86, 0xa3, 0xb4, 0xbb, 0x91,
-	0x7d, 0x4c, 0x15, 0x8e, 0xf9, 0xa4, 0xf9, 0x67, 0x86, 0xb2, 0x04, 0xc8, 0x2a, 0x94, 0xe2, 0xc9,
-	0x22, 0x0e, 0x1c, 0x63, 0xe5, 0x48, 0xc2, 0x2d, 0xfa, 0xb0, 0xfe, 0x82, 0x38, 0xd9, 0x9f, 0x89,
-	0xa7, 0x9c, 0xb6, 0x22, 0x24, 0x90, 0x7c, 0x19, 0x0a, 0x38, 0x54, 0x27, 0x27, 0x9b, 0x92, 0x5b,
-	0x4d, 0x81, 0x8d, 0x11, 0xd6, 0x1a, 0x29, 0xc9, 0x17, 0x84, 0x97, 0x47, 0x5e, 0x4b, 0xe3, 0xca,
-	0x40, 0xac, 0x1e, 0xf1, 0x1e, 0x93, 0x38, 0x16, 0x2a, 0xb3, 0xf5, 0xef, 0xe4, 0xa0, 0x92, 0x5e,
-	0x78, 0xe4, 0x03, 0x28, 0xaf, 0x3b, 0x61, 0xf8, 0xd8, 0x0f, 0xdc, 0x7b, 0x4e, 0xb8, 0x27, 0x52,
-	0x43, 0xa2, 0xcd, 0xd7, 0x15, 0x70, 0x7b, 0xcf, 0xd1, 0x52, 0x88, 0x69, 0x04, 0x6c, 0x43, 0xde,
-	0x10, 0xfe, 0xea, 0xca, 0x02, 0x8a, 0xfc, 0xa8, 0x9b, 0x4a, 0x0d, 0x29, 0xd1, 0xc8, 0x5b, 0x90,
-	0xe7, 0xb1, 0x6f, 0x6a, 0x5e, 0xa1, 0x07, 0x77, 0x6a, 0x3c, 0x5c, 0x88, 0x5f, 0x26, 0xeb, 0xa7,
-	0xf2, 0x0c, 0x9f, 0xac, 0x28, 0x91, 0x53, 0xa3, 0x5a, 0x7e, 0x15, 0x09, 0x8e, 0x1b, 0x77, 0x72,
-	0x08, 0xd5, 0x87, 0x85, 0x62, 0xbe, 0x52, 0x10, 0xf1, 0x39, 0x7f, 0x98, 0x87, 0x52, 0xfc, 0x7d,
-	0x42, 0x00, 0xf5, 0x0d, 0x71, 0x2b, 0x8c, 0xff, 0x93, 0x8b, 0x50, 0x94, 0x2a, 0x86, 0xb8, 0x19,
-	0x1e, 0x0b, 0x85, 0x7a, 0x31, 0x0b, 0x52, 0x97, 0xe0, 0xea, 0x85, 0x25, 0x7f, 0x92, 0x9b, 0x10,
-	0x2b, 0x0a, 0x83, 0x34, 0x8a, 0x02, 0x1b, 0x30, 0x2b, 0x46, 0x23, 0x93, 0x90, 0xf3, 0xb8, 0x2f,
-	0x72, 0xc9, 0xca, 0x79, 0x2e, 0xf9, 0x00, 0x8a, 0x8e, 0xeb, 0x52, 0xd7, 0x76, 0xa2, 0x21, 0xde,
-	0xe3, 0x2c, 0x32, 0x6e, 0x5c, 0xa2, 0x23, 0x55, 0x2d, 0x22, 0x35, 0x28, 0xe1, 0x73, 0x8c, 0xbd,
-	0x70, 0xa8, 0x37, 0x1c, 0x13, 0x0e, 0x45, 0x46, 0xb6, 0x19, 0x52, 0x97, 0xbc, 0x0e, 0x05, 0x36,
-	0x9a, 0x62, 0x3f, 0x88, 0xb3, 0xc5, 0xad, 0x6d, 0xac, 0xf3, 0x0e, 0xbb, 0x77, 0xc6, 0x42, 0x04,
-	0xf2, 0x0a, 0xe4, 0x7b, 0xf3, 0x0f, 0x85, 0xa4, 0xaf, 0x24, 0x61, 0x91, 0x31, 0x1a, 0x2b, 0x26,
-	0xb7, 0xa0, 0xf8, 0x58, 0x0f, 0x80, 0x3b, 0x97, 0x1a, 0xc6, 0x18, 0x3f, 0x46, 0xac, 0x17, 0x61,
-	0x94, 0x87, 0x9b, 0x99, 0x2f, 0x01, 0x24, 0x9f, 0xee, 0xbf, 0xc0, 0x37, 0xbf, 0x01, 0xa5, 0xf8,
-	0x93, 0xe4, 0x45, 0x80, 0x7d, 0x7a, 0x60, 0xef, 0x39, 0x1d, 0x57, 0x3c, 0x43, 0x52, 0xb6, 0x4a,
-	0xfb, 0xf4, 0xe0, 0x1e, 0x02, 0xc8, 0x05, 0x18, 0xeb, 0xb2, 0x51, 0x95, 0x89, 0x4d, 0xad, 0xd1,
-	0x6e, 0x6f, 0x87, 0xcd, 0xd0, 0x59, 0x18, 0xc3, 0xa3, 0x03, 0xb1, 0xd0, 0x26, 0x2c, 0xf9, 0xd3,
-	0xfc, 0xbd, 0x1c, 0x86, 0xbc, 0x2b, 0xf5, 0x24, 0x2f, 0xc3, 0x44, 0x33, 0xa0, 0xb8, 0x1d, 0x39,
-	0x4c, 0x2d, 0x12, 0xdf, 0x29, 0x27, 0xc0, 0x65, 0x97, 0xbc, 0x06, 0x53, 0x49, 0xa6, 0x55, 0xbb,
-	0xb9, 0x23, 0xc2, 0x5f, 0xcb, 0xd6, 0x44, 0x57, 0xa6, 0x5a, 0x5d, 0xd8, 0x41, 0x1f, 0xfa, 0x8a,
-	0x1a, 0x6a, 0x16, 0xc9, 0xac, 0xa9, 0x25, 0x6b, 0x4a, 0x81, 0xe3, 0xb5, 0xc3, 0x79, 0x18, 0x75,
-	0x9c, 0xdd, 0x9e, 0xc7, 0xfd, 0x79, 0xcb, 0x96, 0xf8, 0x45, 0x3e, 0x0f, 0xd3, 0xa1, 0xb7, 0xdb,
-	0x71, 0xa2, 0x5e, 0x20, 0x72, 0x0e, 0xd0, 0x00, 0xa7, 0xd4, 0x84, 0x55, 0x89, 0x0b, 0x16, 0x38,
-	0x9c, 0xbc, 0x09, 0x44, 0xfd, 0x9e, 0xbf, 0xf3, 0x31, 0x6d, 0xf2, 0xa9, 0x56, 0xb6, 0xa6, 0x95,
-	0x92, 0x35, 0x2c, 0x20, 0x9f, 0x83, 0x72, 0x40, 0x43, 0x54, 0xc9, 0xb0, 0xdb, 0x30, 0x93, 0x8a,
-	0x35, 0x2e, 0x61, 0xf7, 0xe9, 0x81, 0x59, 0x87, 0xe9, 0xbe, 0xf5, 0x48, 0xde, 0xe4, 0xda, 0xbd,
-	0xd8, 0x9f, 0xcb, 0xdc, 0x98, 0x61, 0x42, 0x2a, 0xf5, 0x82, 0x2f, 0x47, 0x32, 0x3b, 0x50, 0x56,
-	0xe5, 0xeb, 0x09, 0x81, 0xc5, 0xe7, 0xd1, 0xb1, 0x90, 0x0b, 0x9f, 0xd1, 0xa3, 0xc3, 0x6a, 0xce,
-	0x73, 0xd1, 0x9d, 0xf0, 0x2a, 0x14, 0xa5, 0x96, 0xa0, 0x3e, 0xc3, 0x21, 0x14, 0xca, 0x03, 0x2b,
-	0x2e, 0x35, 0x5f, 0x87, 0x31, 0x21, 0x42, 0x8f, 0x3f, 0xc6, 0x31, 0x7f, 0x39, 0x07, 0x53, 0x16,
-	0x65, 0x0b, 0x5c, 0x3c, 0x70, 0xf1, 0x9c, 0xe5, 0x9c, 0xd5, 0xda, 0x76, 0x4c, 0x1c, 0xff, 0xf7,
-	0x0c, 0x98, 0xc9, 0xc0, 0xfd, 0x44, 0x49, 0xaa, 0x6e, 0x43, 0x69, 0xd1, 0x73, 0x5a, 0x35, 0xd7,
-	0x8d, 0x1d, 0x24, 0x51, 0x1b, 0x74, 0xd9, 0x72, 0x72, 0x18, 0x54, 0xdd, 0x4c, 0x63, 0x54, 0x72,
-	0x5d, 0x4c, 0x8a, 0x24, 0x8d, 0x9e, 0xcc, 0x6a, 0x0b, 0xbc, 0x4e, 0x49, 0x4e, 0x5b, 0x0c, 0x43,
-	0xe3, 0xc0, 0xe4, 0x0e, 0xfc, 0x99, 0x1d, 0xba, 0xec, 0x30, 0xb4, 0x74, 0xf3, 0x86, 0x32, 0x3b,
-	0xbf, 0x99, 0x83, 0xf3, 0xd9, 0x84, 0x9f, 0x34, 0xdf, 0x18, 0x26, 0x51, 0x50, 0x12, 0x07, 0x63,
-	0xbe, 0x31, 0x9e, 0x71, 0x01, 0xf1, 0x13, 0x04, 0xf2, 0x10, 0x26, 0x56, 0x9c, 0x30, 0xba, 0x47,
-	0x9d, 0x20, 0xda, 0xa1, 0x4e, 0x34, 0x84, 0x06, 0x1b, 0xbf, 0x93, 0x8b, 0x9b, 0xda, 0x9e, 0xa4,
-	0x4c, 0xbf, 0x93, 0xab, 0xb1, 0x8d, 0x27, 0x4a, 0x61, 0x88, 0x89, 0xf2, 0xb3, 0x30, 0xd5, 0xa0,
-	0x6d, 0xa7, 0xbb, 0xe7, 0x07, 0x54, 0x9c, 0x3c, 0xdf, 0x80, 0x89, 0x18, 0x94, 0x39, 0x5b, 0xf4,
-	0x62, 0x0d, 0x5f, 0xe9, 0x88, 0x44, 0x94, 0xe8, 0xc5, 0xe6, 0xef, 0xe4, 0xe0, 0x42, 0xad, 0x29,
-	0x8e, 0xe9, 0x45, 0x81, 0xbc, 0x4d, 0xfc, 0x8c, 0xbf, 0x4d, 0xe6, 0xa0, 0xf4, 0xc0, 0x79, 0x82,
-	0x0f, 0xbe, 0x87, 0x22, 0x6b, 0x0d, 0x57, 0xbf, 0x9c, 0x27, 0x76, 0x7c, 0xec, 0x65, 0x25, 0x38,
-	0x4f, 0xf3, 0x4d, 0x78, 0x13, 0x46, 0xef, 0xf9, 0x2d, 0x57, 0x6c, 0x4e, 0xe2, 0xd4, 0x7f, 0x0f,
-	0x21, 0x96, 0x28, 0x31, 0x7f, 0x68, 0xc0, 0x64, 0x5c, 0x63, 0xac, 0xc2, 0x67, 0xde, 0x25, 0xa9,
-	0xd7, 0xf1, 0x4b, 0x43, 0xbc, 0x8e, 0x3f, 0xf2, 0xe9, 0x7a, 0xc2, 0xfc, 0x27, 0x78, 0xa1, 0xa0,
-	0xb6, 0x92, 0xed, 0x44, 0x4a, 0x45, 0x8c, 0x21, 0x2b, 0x92, 0x7b, 0x6a, 0x43, 0x92, 0x1f, 0x38,
-	0x24, 0xbf, 0x92, 0x83, 0xf1, 0xb8, 0xb2, 0xcf, 0x59, 0xfc, 0x76, 0xdc, 0xae, 0xa1, 0xbc, 0xb3,
-	0x1b, 0x8a, 0xac, 0x10, 0x4e, 0xd0, 0x5f, 0x86, 0x51, 0xb1, 0x98, 0x8c, 0xd4, 0xad, 0x5a, 0x6a,
-	0x74, 0x93, 0xb7, 0x4e, 0x71, 0x40, 0x43, 0x4b, 0xd0, 0xa1, 0xfb, 0xfb, 0x36, 0xdd, 0x11, 0xf7,
-	0x4b, 0xcf, 0xec, 0x1e, 0x95, 0xed, 0xfe, 0x9e, 0x34, 0x6c, 0xa8, 0xdd, 0xe9, 0x1f, 0x14, 0xa0,
-	0x92, 0x26, 0x39, 0x39, 0x42, 0x7e, 0xbd, 0xb7, 0x23, 0xde, 0x29, 0xc0, 0x08, 0xf9, 0x6e, 0x6f,
-	0xc7, 0x62, 0x30, 0xf2, 0x1a, 0x14, 0xd6, 0x03, 0xef, 0x11, 0xb6, 0x5a, 0x3c, 0xd3, 0xd0, 0x0d,
-	0xbc, 0x47, 0xaa, 0x1f, 0x28, 0x2b, 0x47, 0x83, 0x76, 0xa5, 0xa1, 0x3c, 0x33, 0xcd, 0x0d, 0xda,
-	0x56, 0x98, 0x4e, 0x8b, 0x22, 0xd1, 0xd8, 0x56, 0x59, 0xa7, 0x4e, 0x20, 0xa2, 0xb9, 0x85, 0x38,
-	0xc3, 0xad, 0x72, 0x07, 0xc1, 0x3c, 0xe7, 0xa9, 0xa5, 0x22, 0x91, 0x16, 0x10, 0xe5, 0xa7, 0x5c,
-	0xc0, 0x27, 0xdb, 0x78, 0xf2, 0x79, 0xa1, 0xb3, 0x2a, 0x6b, 0x5b, 0x5d, 0xcd, 0x19, 0x7c, 0x9f,
-	0xe6, 0x19, 0xe1, 0x3a, 0x94, 0xf0, 0xc8, 0x0b, 0x0f, 0x32, 0x8a, 0x27, 0x32, 0x93, 0x3e, 0xb7,
-	0x80, 0xb7, 0xf1, 0x76, 0x7c, 0x9c, 0x91, 0x30, 0x21, 0xef, 0xc3, 0xb8, 0xea, 0x28, 0xca, 0xdd,
-	0x19, 0x2f, 0xf3, 0x08, 0xa1, 0x01, 0xe9, 0xc3, 0x54, 0x02, 0xf3, 0x0b, 0xea, 0x2c, 0x11, 0x9b,
-	0xf6, 0xb1, 0xb3, 0xc4, 0xfc, 0x2d, 0x54, 0xe3, 0xdb, 0x7e, 0x44, 0x85, 0xf6, 0xf2, 0xcc, 0xca,
-	0xb1, 0xe4, 0x08, 0x79, 0x44, 0xf3, 0x08, 0xd1, 0x5a, 0x77, 0x8a, 0x07, 0x96, 0xff, 0xa1, 0x01,
-	0xe7, 0x32, 0x69, 0xc9, 0x0d, 0x80, 0x44, 0x47, 0x14, 0xbd, 0xc4, 0x93, 0xc9, 0xc6, 0x50, 0x4b,
-	0xc1, 0x20, 0x5f, 0x4f, 0x6b, 0x77, 0x27, 0x6f, 0x4e, 0xf2, 0xc9, 0x85, 0x49, 0x5d, 0xbb, 0xcb,
-	0xd0, 0xe9, 0xcc, 0xef, 0xe5, 0x61, 0xba, 0xef, 0xa9, 0xbe, 0x13, 0xee, 0xe0, 0xf7, 0x53, 0x0f,
-	0x41, 0xf1, 0xeb, 0x8e, 0xeb, 0x83, 0x1e, 0x0a, 0xcc, 0x78, 0x16, 0x0a, 0x8f, 0xc5, 0x44, 0x1e,
-	0xe3, 0x13, 0x5e, 0x87, 0x0a, 0xb3, 0x9f, 0x10, 0xfb, 0xfc, 0xc0, 0xaf, 0x3d, 0x85, 0xa7, 0xc4,
-	0x7e, 0x8c, 0x5f, 0x5a, 0xfa, 0xad, 0x1c, 0xcc, 0xf4, 0xb5, 0xf9, 0x99, 0x5d, 0x75, 0x5f, 0xd6,
-	0x76, 0xb7, 0x97, 0x06, 0x8d, 0xe9, 0x50, 0x5a, 0xc4, 0xff, 0x30, 0xe0, 0xc2, 0x00, 0x4a, 0x72,
-	0x90, 0x9e, 0x44, 0x5c, 0xab, 0xb8, 0x79, 0xfc, 0x07, 0x9f, 0xca, 0x54, 0xfa, 0xcc, 0x66, 0xc2,
-	0x2f, 0xe7, 0x00, 0xb6, 0xe9, 0xce, 0xb3, 0x9d, 0xfe, 0x27, 0xfb, 0x2d, 0x7c, 0xd9, 0xac, 0xa1,
-	0xc6, 0x7d, 0x0d, 0x0f, 0x12, 0x87, 0xcf, 0xfd, 0x13, 0x3f, 0x2b, 0x91, 0xcb, 0x7e, 0x56, 0xc2,
-	0xdc, 0x81, 0xb3, 0x77, 0x69, 0x94, 0xec, 0x84, 0xd2, 0x86, 0x3c, 0x9e, 0xed, 0x1b, 0x50, 0x12,
-	0xf8, 0x7a, 0x8a, 0x70, 0xe9, 0x50, 0xe6, 0xb9, 0x56, 0x82, 0x60, 0x52, 0xb8, 0xb0, 0x48, 0x5b,
-	0x34, 0xa2, 0x9f, 0xed, 0x67, 0x1a, 0x40, 0x78, 0x53, 0xf8, 0x6b, 0x03, 0x43, 0x7d, 0xe1, 0xc4,
-	0xfe, 0xd9, 0x82, 0x73, 0x71, 0xdd, 0x9f, 0x26, 0xdf, 0x39, 0xa6, 0x4b, 0x88, 0x58, 0xbb, 0x84,
-	0xe3, 0x31, 0x87, 0x88, 0x4f, 0xe0, 0x92, 0x24, 0xd8, 0xf6, 0xe2, 0x9b, 0x98, 0xa1, 0x68, 0xc9,
-	0xbb, 0x30, 0xae, 0xd0, 0x88, 0xc0, 0x5d, 0xbc, 0xed, 0x7c, 0xec, 0x45, 0x7b, 0x76, 0xc8, 0xe1,
-	0xea, 0x6d, 0xa7, 0x82, 0x6e, 0x7e, 0x0d, 0x5e, 0x88, 0xfd, 0x56, 0x32, 0x3e, 0x9d, 0x62, 0x6e,
-	0x9c, 0x8e, 0xf9, 0x6a, 0xd2, 0xac, 0xe5, 0x4e, 0xec, 0x3f, 0x2e, 0x79, 0x13, 0xb5, 0x59, 0xa2,
-	0x31, 0x97, 0x95, 0xb4, 0x68, 0x62, 0x2f, 0x4a, 0x00, 0xe6, 0x3b, 0x4a, 0x65, 0x33, 0x18, 0x6a,
-	0xc4, 0x46, 0x9a, 0xf8, 0x97, 0x73, 0x30, 0xb5, 0xb6, 0xbc, 0xb8, 0x10, 0x1f, 0x23, 0x3f, 0x67,
-	0xb9, 0x89, 0xb4, 0xb6, 0x0d, 0x96, 0x37, 0xe6, 0x26, 0xcc, 0xa4, 0xba, 0x01, 0x1f, 0x53, 0x79,
-	0x9f, 0xfb, 0x97, 0xc4, 0x60, 0xb9, 0xb3, 0x9c, 0xcf, 0x62, 0xbf, 0x75, 0xcb, 0x4a, 0x61, 0x9b,
-	0xdf, 0x1b, 0x4d, 0xf1, 0x15, 0x22, 0xec, 0x0d, 0x28, 0x2d, 0x87, 0x61, 0x8f, 0x06, 0x9b, 0xd6,
-	0x8a, 0xaa, 0x23, 0x7a, 0x08, 0xb4, 0x7b, 0x41, 0xcb, 0x4a, 0x10, 0xc8, 0x35, 0x28, 0x8a, 0xf8,
-	0x2e, 0x29, 0x13, 0xf0, 0xba, 0x3c, 0x0e, 0x0f, 0xb3, 0xe2, 0x62, 0xf2, 0x16, 0x94, 0xf9, 0xff,
-	0x7c, 0xb6, 0x89, 0x0e, 0xc7, 0xb3, 0x2a, 0x81, 0xce, 0x67, 0xa7, 0xa5, 0xa1, 0x31, 0xcb, 0x4c,
-	0xbe, 0xd6, 0xc8, 0x6a, 0x54, 0x48, 0x2c, 0x33, 0xf9, 0xb0, 0x23, 0xd6, 0x49, 0x45, 0x22, 0xd7,
-	0x21, 0x5f, 0x5b, 0xb0, 0xd4, 0xac, 0xc8, 0x4e, 0x33, 0xe0, 0x59, 0xc5, 0xb5, 0x07, 0x91, 0x6a,
-	0x0b, 0x16, 0x99, 0x87, 0x22, 0x3e, 0x78, 0xe1, 0xd2, 0x40, 0xf8, 0x8c, 0xe2, 0xac, 0xe9, 0x0a,
-	0x98, 0x7a, 0xf3, 0x28, 0xf1, 0xc8, 0x1c, 0x8c, 0x2d, 0x7a, 0x61, 0xb7, 0xe5, 0x1c, 0x88, 0xa4,
-	0x24, 0x78, 0x19, 0xe2, 0x72, 0x90, 0x3a, 0xcf, 0x04, 0x16, 0xb9, 0x06, 0x23, 0x8d, 0xa6, 0xdf,
-	0x65, 0xd6, 0x56, 0xec, 0xda, 0x12, 0x32, 0x80, 0x96, 0xd9, 0x80, 0x01, 0x30, 0xe4, 0x98, 0x47,
-	0x4e, 0x95, 0x94, 0x90, 0xe3, 0x74, 0xc4, 0x94, 0xc0, 0xe9, 0xf7, 0xff, 0x83, 0xa7, 0xe9, 0xff,
-	0xb7, 0x03, 0x17, 0xee, 0xa2, 0xaa, 0xdf, 0xa0, 0x01, 0xe6, 0x81, 0xe4, 0x8f, 0xe7, 0x6c, 0x5a,
-	0xcb, 0x22, 0x5a, 0xec, 0xea, 0xd1, 0x61, 0xf5, 0x15, 0x6e, 0x0d, 0xd8, 0x21, 0xc7, 0x91, 0xef,
-	0xee, 0xa4, 0x5e, 0x0c, 0x18, 0xc4, 0x88, 0x7c, 0x05, 0xce, 0x66, 0x15, 0x89, 0xb8, 0x31, 0xf4,
-	0x0a, 0xcf, 0xfe, 0x80, 0xea, 0x96, 0x9d, 0xc5, 0x81, 0xac, 0x40, 0x85, 0xc3, 0x6b, 0x6e, 0xdb,
-	0xeb, 0x2c, 0xb5, 0x1d, 0xaf, 0x85, 0x51, 0x64, 0x22, 0x14, 0x50, 0x70, 0x75, 0x58, 0xa1, 0x4d,
-	0x59, 0xa9, 0xe6, 0x9d, 0x94, 0xa2, 0x44, 0x71, 0xd4, 0xa8, 0x3d, 0x58, 0x49, 0xd6, 0xd4, 0xf3,
-	0x75, 0x6f, 0xa4, 0xb5, 0xed, 0x98, 0x7b, 0xa3, 0x4d, 0x98, 0x49, 0x75, 0x83, 0x14, 0x47, 0x1a,
-	0x38, 0x2d, 0x8e, 0x52, 0x34, 0x56, 0x0a, 0xdb, 0xfc, 0x4f, 0xa3, 0x29, 0xbe, 0xe2, 0xac, 0xc8,
-	0x84, 0x51, 0x2e, 0x6d, 0xd4, 0xac, 0x65, 0x5c, 0x16, 0x59, 0xa2, 0x84, 0x5c, 0x84, 0x7c, 0xa3,
-	0xb1, 0xa6, 0xe6, 0x54, 0x0c, 0x43, 0xdf, 0x62, 0x30, 0x36, 0x42, 0x78, 0x0c, 0xa4, 0x04, 0x68,
-	0x35, 0x69, 0x10, 0x89, 0xe7, 0x3c, 0x5f, 0x4d, 0xd6, 0x71, 0x21, 0xe9, 0x6f, 0xb1, 0x8e, 0x93,
-	0xd5, 0xbb, 0x00, 0xb3, 0xb5, 0x30, 0xa4, 0x41, 0xc4, 0x93, 0xb2, 0x87, 0xbd, 0x36, 0x0d, 0xc4,
-	0x5c, 0x13, 0x32, 0x86, 0x3f, 0x06, 0xde, 0x0c, 0xad, 0x81, 0x88, 0xe4, 0x2a, 0x14, 0x6b, 0x3d,
-	0xd7, 0xa3, 0x9d, 0xa6, 0xe6, 0x9b, 0xee, 0x08, 0x98, 0x15, 0x97, 0x92, 0x8f, 0xe0, 0x9c, 0x20,
-	0x92, 0x02, 0x47, 0xf4, 0x00, 0x97, 0x35, 0xdc, 0x82, 0x15, 0x6b, 0x41, 0x8a, 0x29, 0x5b, 0x74,
-	0x49, 0x36, 0x25, 0xa9, 0x41, 0x65, 0x09, 0xef, 0x49, 0xe5, 0xa3, 0xbe, 0x7e, 0x20, 0x92, 0xef,
-	0xa2, 0xe4, 0xe2, 0x77, 0xa8, 0xb6, 0x1b, 0x17, 0x5a, 0x7d, 0xe8, 0xe4, 0x3e, 0xcc, 0xa4, 0x61,
-	0x4c, 0x1e, 0x97, 0x92, 0x47, 0xb7, 0xfa, 0xb8, 0xa0, 0x60, 0xce, 0xa2, 0x22, 0x3b, 0x30, 0x5d,
-	0x8b, 0xa2, 0xc0, 0xdb, 0xe9, 0x45, 0x34, 0x25, 0xba, 0xe4, 0x41, 0x63, 0x5c, 0x2e, 0xc5, 0xd7,
-	0x0b, 0x62, 0x32, 0xce, 0x38, 0x31, 0x65, 0x2c, 0xc2, 0xac, 0x7e, 0x76, 0xc4, 0x8d, 0xdf, 0xed,
-	0x13, 0x6f, 0xdb, 0x89, 0x80, 0x22, 0x79, 0xa0, 0x5b, 0x0b, 0x0f, 0xda, 0x6d, 0x1a, 0x05, 0x78,
-	0x73, 0x8f, 0x6f, 0xdf, 0x99, 0xc2, 0x07, 0xe8, 0x92, 0xf2, 0x5c, 0x25, 0xbe, 0x6f, 0xa8, 0xb9,
-	0x47, 0x6a, 0x3c, 0xb5, 0xed, 0xa3, 0x3c, 0xe4, 0xf6, 0xd1, 0x82, 0xe9, 0xa5, 0x4e, 0x33, 0x38,
-	0xc0, 0xc8, 0x46, 0x59, 0xb9, 0x89, 0x13, 0x2a, 0x27, 0x1f, 0xb6, 0xb8, 0xec, 0xc8, 0x19, 0x96,
-	0x55, 0xbd, 0x7e, 0xc6, 0xe6, 0xdf, 0x80, 0x4a, 0xba, 0x2f, 0x3f, 0xe5, 0x63, 0xc5, 0xa7, 0x71,
-	0xcd, 0x66, 0x23, 0x9d, 0x6e, 0x0b, 0x99, 0xd3, 0x5e, 0xa4, 0x35, 0x92, 0xa8, 0x74, 0xe5, 0xed,
-	0x58, 0xed, 0x1d, 0x5a, 0xb9, 0x8c, 0x73, 0x59, 0xcb, 0xd8, 0xfc, 0xd5, 0x1c, 0x4c, 0x73, 0x6f,
-	0xd2, 0x67, 0x5f, 0x57, 0x7c, 0x5f, 0x13, 0xce, 0xf2, 0x2c, 0x30, 0xd5, 0xba, 0x63, 0xb4, 0xc5,
-	0x6f, 0xc0, 0xb9, 0xbe, 0xae, 0x40, 0x01, 0xbd, 0x28, 0xfd, 0x78, 0xfb, 0x44, 0xf4, 0x6c, 0xf6,
-	0x47, 0xb6, 0x6e, 0x59, 0x7d, 0x14, 0xe6, 0x3f, 0xca, 0xf5, 0xf1, 0x17, 0x7a, 0xa3, 0xaa, 0x09,
-	0x1a, 0xa7, 0xd3, 0x04, 0x73, 0x9f, 0x48, 0x13, 0xcc, 0x0f, 0xa3, 0x09, 0x7e, 0x04, 0x13, 0x1b,
-	0xd4, 0x61, 0x1a, 0x8d, 0x08, 0x36, 0x2b, 0x68, 0xaf, 0xc5, 0xb2, 0x32, 0x29, 0x5f, 0xe2, 0x40,
-	0xd5, 0x88, 0x11, 0x30, 0xd1, 0xc2, 0xa3, 0xcf, 0x2c, 0x9d, 0x83, 0xba, 0x69, 0x8c, 0x0c, 0xde,
-	0x34, 0xcc, 0x6f, 0xe6, 0x60, 0x5c, 0x61, 0x4f, 0xbe, 0x08, 0xe5, 0xb5, 0x60, 0xd7, 0xe9, 0x78,
-	0x3f, 0xe7, 0x28, 0xc7, 0xaf, 0x58, 0x7d, 0x5f, 0x81, 0x5b, 0x1a, 0x16, 0xba, 0xcd, 0x50, 0xa7,
-	0xad, 0x4e, 0x7c, 0x56, 0x3d, 0x0b, 0xa1, 0x4a, 0xb0, 0x70, 0x7e, 0x88, 0x60, 0x61, 0x3d, 0xd2,
-	0xb6, 0x70, 0xfa, 0x48, 0x5b, 0x2d, 0x30, 0x76, 0xe4, 0x94, 0x81, 0xb1, 0xe6, 0xaf, 0xe7, 0xa0,
-	0x22, 0xde, 0x55, 0x95, 0x87, 0x87, 0xcf, 0xd7, 0x3b, 0x0c, 0x7a, 0xe3, 0x8e, 0xb9, 0x1e, 0x2b,
-	0xfc, 0xf6, 0xef, 0x57, 0xf1, 0x95, 0xcc, 0x74, 0x77, 0xc8, 0x57, 0x32, 0x75, 0x78, 0x3a, 0x72,
-	0x20, 0x4d, 0x65, 0xa5, 0xf1, 0xcd, 0x3f, 0xcd, 0xa5, 0x79, 0x0b, 0x6d, 0xea, 0x55, 0x18, 0xe3,
-	0xcf, 0x62, 0x49, 0xe7, 0x66, 0x91, 0xbb, 0x09, 0x41, 0x96, 0x2c, 0x3b, 0x4d, 0x0c, 0xc9, 0x49,
-	0x4f, 0xa5, 0x92, 0xdb, 0x50, 0x46, 0x7f, 0x91, 0x9a, 0xeb, 0x06, 0x34, 0x0c, 0x85, 0xa2, 0x85,
-	0x77, 0x77, 0x8f, 0xe9, 0x8e, 0xcd, 0xfd, 0x4a, 0x1c, 0xd7, 0x0d, 0x2c, 0x0d, 0x8f, 0x2c, 0xc0,
-	0x59, 0xcd, 0x3d, 0x49, 0xd2, 0x8f, 0x24, 0xbb, 0x45, 0x84, 0x05, 0x9c, 0x38, 0x13, 0xf9, 0xe9,
-	0x3d, 0x13, 0x6d, 0xfe, 0x6f, 0x83, 0xad, 0xb5, 0xe6, 0xfe, 0x73, 0x16, 0xdd, 0xc2, 0x9a, 0x74,
-	0x8c, 0xb2, 0xff, 0x1f, 0x0c, 0xee, 0x9f, 0x2e, 0xa6, 0xcf, 0xdb, 0x30, 0xca, 0x1f, 0xe1, 0x12,
-	0x9e, 0xd4, 0x2a, 0x17, 0x5e, 0x90, 0xdc, 0x4f, 0xf1, 0xa7, 0xbc, 0x2c, 0x41, 0xc0, 0x4c, 0x66,
-	0xdd, 0x4d, 0x1e, 0x15, 0xcf, 0x7e, 0xff, 0x78, 0x89, 0xa5, 0xe6, 0x25, 0x1d, 0x2e, 0xdf, 0xb5,
-	0x71, 0x72, 0x5e, 0x52, 0xf3, 0xff, 0xe6, 0x78, 0x7b, 0x44, 0xa5, 0x86, 0x4d, 0xb8, 0xf7, 0x1a,
-	0x14, 0xf0, 0xb9, 0x57, 0x25, 0xab, 0x61, 0xea, 0xa9, 0x57, 0x2c, 0x67, 0xeb, 0x06, 0x65, 0xad,
-	0x1a, 0x50, 0x85, 0xe2, 0x58, 0x5d, 0x37, 0x88, 0x81, 0xd9, 0xa4, 0x7d, 0x97, 0xaa, 0xcb, 0xa1,
-	0xa3, 0x27, 0xfe, 0xc6, 0x72, 0x72, 0x5b, 0xf1, 0x6b, 0x56, 0x0f, 0x34, 0xda, 0x0f, 0x1d, 0x9b,
-	0xfb, 0xd3, 0xaa, 0xd2, 0x36, 0x71, 0x81, 0x5e, 0x82, 0x49, 0x3d, 0x56, 0x59, 0x18, 0x1d, 0x18,
-	0xf2, 0x9d, 0x8a, 0x73, 0x56, 0xd5, 0x5b, 0x9d, 0x88, 0xd4, 0x61, 0x42, 0x0b, 0x48, 0x55, 0x93,
-	0xb0, 0xf2, 0xec, 0x30, 0x76, 0x7f, 0x26, 0x05, 0x9d, 0x44, 0x39, 0x30, 0xff, 0x02, 0x54, 0xc4,
-	0xca, 0x8c, 0x63, 0xdb, 0x50, 0xb5, 0x5b, 0x5e, 0xb4, 0xd4, 0xd5, 0xd4, 0xf4, 0xdc, 0xc0, 0x42,
-	0xa8, 0xf9, 0x5d, 0x03, 0x2e, 0x8a, 0xc7, 0xc5, 0x2c, 0x1a, 0x32, 0x1d, 0x12, 0x03, 0xe2, 0x70,
-	0x3e, 0x7e, 0x91, 0xbc, 0x2b, 0x13, 0x4f, 0xe9, 0x02, 0x32, 0xfd, 0x8d, 0xfa, 0x84, 0x98, 0x94,
-	0x23, 0x98, 0x7a, 0x4a, 0x26, 0x9c, 0x7a, 0x5b, 0x24, 0x9c, 0xca, 0x1d, 0x4f, 0x1c, 0xaf, 0x0b,
-	0x97, 0x76, 0x64, 0xa2, 0xa9, 0xef, 0xe4, 0xe0, 0x5c, 0x46, 0xb5, 0xb6, 0xbe, 0xf8, 0x8c, 0x0a,
-	0x87, 0xba, 0x26, 0x1c, 0x64, 0x46, 0xc2, 0x81, 0x1d, 0x9f, 0x29, 0x2b, 0x7e, 0xd7, 0x80, 0x0b,
-	0xfa, 0xec, 0x11, 0xb6, 0xe8, 0xd6, 0x2d, 0xf2, 0x0e, 0x8c, 0xde, 0xa3, 0x8e, 0x4b, 0x65, 0x08,
-	0x46, 0x9c, 0xdd, 0x4b, 0x9c, 0x0e, 0xf3, 0x42, 0xce, 0xf6, 0x4f, 0xf9, 0x52, 0x3e, 0x63, 0x09,
-	0x12, 0xb2, 0x28, 0x2a, 0xc7, 0xaf, 0xa7, 0x4c, 0x79, 0x53, 0x93, 0xf5, 0xa9, 0x63, 0x14, 0xe3,
-	0x9f, 0x87, 0x17, 0x8e, 0x21, 0x61, 0xe3, 0xc6, 0x46, 0x5e, 0x1d, 0x37, 0xdc, 0x57, 0x10, 0x4a,
-	0xde, 0x87, 0xa9, 0x0d, 0x11, 0x28, 0x26, 0x47, 0x43, 0x49, 0xee, 0x2e, 0x63, 0xc8, 0x6c, 0x39,
-	0x2c, 0x69, 0x64, 0xb6, 0xd7, 0xeb, 0x1f, 0x17, 0x3e, 0x0e, 0x2f, 0xc3, 0xe8, 0x3d, 0x5f, 0xc9,
-	0xba, 0x8d, 0x83, 0x8b, 0xef, 0x59, 0x79, 0xae, 0x25, 0x8a, 0x62, 0x63, 0x2d, 0x97, 0x79, 0x15,
-	0xf1, 0x4d, 0x03, 0x2a, 0x3a, 0xef, 0x4f, 0xdb, 0xdf, 0xef, 0x69, 0xfd, 0xfd, 0x42, 0x76, 0x7f,
-	0x0f, 0xee, 0xe8, 0xbe, 0x64, 0x0c, 0x43, 0xf5, 0xb0, 0x09, 0xa3, 0x8b, 0x7e, 0xdb, 0xf1, 0x3a,
-	0x6a, 0x02, 0x01, 0x17, 0x21, 0x96, 0x28, 0x51, 0x7a, 0x2b, 0x3f, 0xb0, 0xb7, 0xcc, 0x6f, 0x17,
-	0xe0, 0xa2, 0x45, 0x77, 0x3d, 0xa6, 0xf5, 0x6c, 0x86, 0x5e, 0x67, 0x57, 0xbb, 0x28, 0x32, 0x53,
-	0x1d, 0x2e, 0xdc, 0xe3, 0x18, 0x24, 0xee, 0xef, 0x6b, 0x50, 0x64, 0xa2, 0x57, 0xe9, 0x73, 0xb4,
-	0x64, 0x30, 0x0d, 0x0e, 0x76, 0x7c, 0x5c, 0x4c, 0xae, 0x8b, 0x8d, 0x41, 0x71, 0x60, 0x66, 0x1b,
-	0x43, 0xea, 0x39, 0x6e, 0xbe, 0x39, 0xc4, 0x9a, 0x52, 0x61, 0x80, 0xa6, 0xf4, 0x00, 0xce, 0xd6,
-	0x5c, 0x2e, 0x74, 0x9c, 0xd6, 0x7a, 0xe0, 0x75, 0x9a, 0x5e, 0xd7, 0x69, 0x49, 0x4d, 0x9b, 0x3f,
-	0x4e, 0x1e, 0x97, 0xdb, 0xdd, 0x18, 0xc1, 0xca, 0x24, 0x63, 0xcd, 0x58, 0x5c, 0x6d, 0xf0, 0x2c,
-	0x27, 0xa3, 0xc8, 0x02, 0x9b, 0xe1, 0x76, 0x42, 0x9e, 0xe6, 0xc4, 0x8a, 0x8b, 0x51, 0x47, 0xc3,
-	0x18, 0x86, 0x8d, 0x95, 0xc6, 0x7d, 0x11, 0x13, 0x20, 0xfd, 0xab, 0x78, 0xc8, 0x43, 0xd4, 0x0a,
-	0xd1, 0x28, 0xd7, 0xf0, 0x12, 0xba, 0x46, 0xe3, 0x1e, 0xa3, 0x2b, 0xf6, 0xd1, 0x85, 0xe1, 0x9e,
-	0x4a, 0xc7, 0xf1, 0x98, 0xfd, 0xcf, 0x3d, 0x54, 0x70, 0x42, 0x94, 0x12, 0x8d, 0x2e, 0x40, 0x28,
-	0xd7, 0xe8, 0x14, 0x14, 0xf2, 0x2e, 0xcc, 0x2c, 0x2d, 0xcc, 0x4b, 0x67, 0xff, 0x45, 0xbf, 0xd9,
-	0x6b, 0xd3, 0x4e, 0x84, 0xc1, 0x27, 0x65, 0x3e, 0x86, 0xb4, 0x39, 0xcf, 0x66, 0x41, 0x16, 0x9a,
-	0x70, 0xf9, 0xe7, 0x01, 0x63, 0x0b, 0xbe, 0x4b, 0xc3, 0xad, 0x9b, 0xcf, 0x99, 0xcb, 0xbf, 0xd2,
-	0x36, 0x5c, 0x6d, 0x37, 0x33, 0x57, 0xe6, 0xdf, 0x45, 0x97, 0xff, 0x3e, 0x5c, 0xf2, 0x93, 0x30,
-	0x82, 0x3f, 0xc5, 0x36, 0x3a, 0x93, 0xc1, 0x36, 0xd9, 0x42, 0x9b, 0x3c, 0x61, 0x05, 0x12, 0x90,
-	0xe5, 0x24, 0x23, 0xfd, 0x29, 0x1c, 0x57, 0x45, 0xd4, 0xa9, 0xfe, 0x14, 0x89, 0x0b, 0x65, 0xf5,
-	0x83, 0x6c, 0x8e, 0xdc, 0x73, 0xc2, 0x3d, 0xea, 0x2e, 0xc8, 0xc7, 0x04, 0xcb, 0x7c, 0x8e, 0xec,
-	0x21, 0x14, 0x9f, 0x49, 0xb1, 0x14, 0x14, 0x26, 0x1d, 0x96, 0xc3, 0xcd, 0x50, 0x54, 0x45, 0x98,
-	0x36, 0x1e, 0x9a, 0xa4, 0xae, 0x25, 0x8a, 0x50, 0x5a, 0xca, 0x84, 0x8c, 0x81, 0xd3, 0xdc, 0xa7,
-	0xc1, 0xd6, 0xcd, 0xcf, 0x42, 0x5a, 0xea, 0xdf, 0x38, 0x66, 0x4c, 0x7e, 0xa3, 0x18, 0xe7, 0x5b,
-	0xd1, 0x90, 0x99, 0xe2, 0x97, 0x5c, 0xb7, 0x1b, 0x89, 0xe2, 0x97, 0x5c, 0xb7, 0xab, 0x8a, 0x5f,
-	0x8c, 0x1a, 0xa7, 0xc3, 0xcd, 0x9d, 0x90, 0x0e, 0x77, 0x40, 0x06, 0x6e, 0xe9, 0xa9, 0xf9, 0x1c,
-	0x3d, 0x46, 0xf0, 0x25, 0x28, 0xd7, 0xa2, 0xc8, 0x69, 0xee, 0x51, 0x17, 0xd3, 0x2e, 0x2b, 0xb7,
-	0x7c, 0x8e, 0x80, 0xab, 0x3e, 0x60, 0x2a, 0xae, 0xf2, 0x18, 0xc9, 0xd8, 0x10, 0x8f, 0x91, 0xcc,
-	0xc1, 0xd8, 0x72, 0xe7, 0x91, 0xc7, 0xfa, 0xa4, 0x98, 0x64, 0x7c, 0xf0, 0x38, 0x48, 0x7f, 0xc1,
-	0x02, 0x41, 0xe4, 0x6d, 0x28, 0xb2, 0x4d, 0x07, 0x63, 0x97, 0x4b, 0x89, 0x7e, 0x2e, 0x9e, 0x41,
-	0xde, 0x13, 0x45, 0xea, 0x21, 0xb2, 0x44, 0x27, 0xb7, 0x61, 0x4c, 0x9a, 0xc4, 0x90, 0xe8, 0xe4,
-	0x82, 0xd2, 0xe1, 0x25, 0x5a, 0x92, 0x09, 0x61, 0x12, 0xbf, 0xab, 0x07, 0x85, 0x8c, 0x2b, 0xc1,
-	0xd6, 0x4a, 0x50, 0x88, 0x16, 0x6c, 0xad, 0x84, 0x87, 0xc4, 0x16, 0x4e, 0xf9, 0x44, 0x0b, 0x67,
-	0x0b, 0xca, 0xeb, 0x4e, 0x10, 0x79, 0x6c, 0x3b, 0xea, 0x44, 0x3c, 0x57, 0x56, 0x62, 0x80, 0x2b,
-	0x45, 0xf5, 0x97, 0x64, 0xd0, 0x71, 0x57, 0xc1, 0xd7, 0xa3, 0x55, 0x13, 0x38, 0x59, 0xcd, 0x70,
-	0x1b, 0x14, 0x99, 0x1d, 0xf1, 0x5e, 0x4f, 0x39, 0x8d, 0x12, 0x2d, 0x52, 0xcf, 0xc7, 0xfb, 0x3d,
-	0x0e, 0x6f, 0xf1, 0x31, 0x40, 0x43, 0x70, 0x0a, 0xd9, 0x60, 0xca, 0x10, 0xd4, 0x2b, 0x52, 0xd6,
-	0x60, 0x8c, 0x48, 0xbe, 0x0e, 0x65, 0xf6, 0x3f, 0x26, 0x0e, 0xf2, 0x28, 0xcf, 0x85, 0x95, 0xb8,
-	0x91, 0xe9, 0x0b, 0x9a, 0x67, 0x17, 0x6a, 0xd0, 0x88, 0x2f, 0x60, 0x64, 0x9c, 0x3e, 0x4d, 0xd1,
-	0xb8, 0x99, 0x3f, 0x34, 0xe0, 0xc2, 0x00, 0x1e, 0x43, 0x3f, 0x43, 0x34, 0x97, 0x6c, 0x48, 0x8a,
-	0xc1, 0x2d, 0x36, 0x24, 0x75, 0x62, 0xc8, 0xad, 0x29, 0x3b, 0x8b, 0x55, 0xfe, 0x33, 0xcb, 0x62,
-	0x65, 0x1e, 0x1a, 0x30, 0xae, 0x8c, 0xec, 0x53, 0x7c, 0x5d, 0xe0, 0x35, 0x91, 0xce, 0x31, 0x9f,
-	0xe0, 0xa5, 0x1e, 0x15, 0xe6, 0xe9, 0x1b, 0xbf, 0x01, 0xb0, 0xe2, 0x84, 0x51, 0xad, 0x19, 0x79,
-	0x8f, 0xe8, 0x10, 0x62, 0x2c, 0x89, 0xbe, 0x77, 0x30, 0x3b, 0x2a, 0x23, 0xeb, 0x8b, 0xbe, 0x8f,
-	0x19, 0x9a, 0xab, 0x30, 0xda, 0xf0, 0x83, 0xa8, 0x7e, 0xc0, 0xf7, 0xa6, 0x45, 0x1a, 0x36, 0xd5,
-	0x63, 0x37, 0x0f, 0x0d, 0xf0, 0xa6, 0x25, 0x8a, 0x98, 0x82, 0x78, 0xc7, 0xa3, 0x2d, 0x57, 0xbd,
-	0x76, 0x79, 0xc8, 0x00, 0x16, 0x87, 0x5f, 0xff, 0x00, 0xa6, 0x64, 0x46, 0xb9, 0x8d, 0x95, 0x06,
-	0xb6, 0x60, 0x0a, 0xc6, 0xb7, 0x96, 0xac, 0xe5, 0x3b, 0x5f, 0xb5, 0xef, 0x6c, 0xae, 0xac, 0x54,
-	0xce, 0x90, 0x09, 0x28, 0x09, 0xc0, 0x42, 0xad, 0x62, 0x90, 0x32, 0x14, 0x97, 0x57, 0x1b, 0x4b,
-	0x0b, 0x9b, 0xd6, 0x52, 0x25, 0x77, 0xfd, 0x55, 0x98, 0x4c, 0x2e, 0x55, 0x30, 0xf0, 0x72, 0x0c,
-	0xf2, 0x56, 0x6d, 0xbb, 0x72, 0x86, 0x00, 0x8c, 0xae, 0xdf, 0x5f, 0x68, 0xdc, 0xbc, 0x59, 0x31,
-	0xae, 0x7f, 0x21, 0xe3, 0x25, 0x67, 0xc6, 0xa9, 0x41, 0xbb, 0x4e, 0xe0, 0x44, 0x94, 0x7f, 0xe6,
-	0x41, 0xaf, 0x15, 0x79, 0xdd, 0x16, 0x7d, 0x52, 0x31, 0xae, 0xbf, 0xdd, 0xf7, 0x20, 0x33, 0x39,
-	0x07, 0xd3, 0x9b, 0xab, 0xb5, 0x07, 0xf5, 0xe5, 0xbb, 0x9b, 0x6b, 0x9b, 0x0d, 0xfb, 0x41, 0x6d,
-	0x63, 0xe1, 0x5e, 0xe5, 0x0c, 0xab, 0xf0, 0x83, 0xb5, 0xc6, 0x86, 0x6d, 0x2d, 0x2d, 0x2c, 0xad,
-	0x6e, 0x54, 0x8c, 0xeb, 0xbf, 0x66, 0xc0, 0xa4, 0xfe, 0xc4, 0x1d, 0xb9, 0x02, 0x97, 0x37, 0x1b,
-	0x4b, 0x96, 0xbd, 0xb1, 0x76, 0x7f, 0x69, 0xd5, 0xde, 0x6c, 0xd4, 0xee, 0x2e, 0xd9, 0x9b, 0xab,
-	0x8d, 0xf5, 0xa5, 0x85, 0xe5, 0x3b, 0xcb, 0x4b, 0x8b, 0x95, 0x33, 0xa4, 0x0a, 0x2f, 0x28, 0x18,
-	0xd6, 0xd2, 0xc2, 0xda, 0xd6, 0x92, 0x65, 0xaf, 0xd7, 0x1a, 0x8d, 0xed, 0x35, 0x6b, 0xb1, 0x62,
-	0x90, 0x4b, 0x70, 0x3e, 0x03, 0xe1, 0xc1, 0x9d, 0x5a, 0x25, 0xd7, 0x57, 0xb6, 0xba, 0xb4, 0x5d,
-	0x5b, 0xb1, 0xeb, 0x6b, 0x1b, 0x95, 0xfc, 0xf5, 0x0f, 0x98, 0x16, 0x92, 0xbc, 0x41, 0x41, 0x8a,
-	0x50, 0x58, 0x5d, 0x5b, 0x5d, 0xaa, 0x9c, 0x21, 0xe3, 0x30, 0xb6, 0xbe, 0xb4, 0xba, 0xb8, 0xbc,
-	0x7a, 0x97, 0x77, 0x6b, 0x6d, 0x7d, 0xdd, 0x5a, 0xdb, 0x5a, 0x5a, 0xac, 0xe4, 0x58, 0xdf, 0x2d,
-	0x2e, 0xad, 0xb2, 0x9a, 0xe5, 0xaf, 0x9b, 0x3c, 0xef, 0xb2, 0x96, 0x36, 0x94, 0xf5, 0xd6, 0xd2,
-	0x57, 0x36, 0x96, 0x56, 0x1b, 0xcb, 0x6b, 0xab, 0x95, 0x33, 0xd7, 0x2f, 0xa7, 0x70, 0xe4, 0x48,
-	0x34, 0x1a, 0xf7, 0x2a, 0x67, 0xae, 0x7f, 0x1d, 0xca, 0xea, 0x26, 0x4c, 0x2e, 0xc0, 0x8c, 0xfa,
-	0x7b, 0x9d, 0x76, 0x5c, 0xaf, 0xb3, 0x5b, 0x39, 0x93, 0x2e, 0xb0, 0x7a, 0x9d, 0x0e, 0x2b, 0xc0,
-	0xc6, 0xab, 0x05, 0x1b, 0x34, 0x68, 0x7b, 0x1d, 0xb6, 0xbf, 0x56, 0x72, 0xf5, 0xca, 0xf7, 0xff,
-	0xe2, 0xa5, 0x33, 0xdf, 0xff, 0xc1, 0x4b, 0xc6, 0x9f, 0xfe, 0xe0, 0x25, 0xe3, 0xbf, 0xfd, 0xe0,
-	0x25, 0x63, 0x67, 0x14, 0x27, 0xfa, 0xad, 0xff, 0x1f, 0x00, 0x00, 0xff, 0xff, 0x0e, 0x77, 0x83,
-	0xa8, 0x44, 0xb5, 0x00, 0x00,
+	// 11573 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xdc, 0xbd, 0x5d, 0x6c, 0x24, 0x49,
+	0x72, 0x18, 0x3c, 0xd5, 0xdd, 0x24, 0xbb, 0x83, 0x4d, 0xb2, 0x99, 0x9c, 0x1f, 0xce, 0xec, 0xec,
+	0xf6, 0x5c, 0xed, 0xdf, 0xcc, 0xdc, 0xee, 0xf0, 0x86, 0x73, 0x3b, 0xd2, 0xde, 0xfe, 0x5d, 0x37,
+	0xc9, 0x99, 0xe1, 0x0e, 0x87, 0xe4, 0x56, 0xf3, 0xe7, 0x4e, 0x77, 0xa7, 0x52, 0xb1, 0x2b, 0x87,
+	0xac, 0x65, 0x77, 0x57, 0xab, 0xaa, 0x7a, 0x66, 0x28, 0x7d, 0x82, 0xf4, 0xc1, 0x90, 0x05, 0x41,
+	0xd0, 0xfd, 0x08, 0x27, 0x4b, 0x32, 0x64, 0x48, 0x16, 0x2c, 0xd8, 0xb2, 0x71, 0x7e, 0x90, 0x0d,
+	0xd8, 0x06, 0x0c, 0x03, 0x02, 0x0c, 0xe1, 0x1e, 0x6c, 0x58, 0x6f, 0x86, 0x64, 0x83, 0xb6, 0xee,
+	0xfc, 0x22, 0x02, 0x36, 0x0c, 0xf8, 0x49, 0x67, 0x0b, 0x36, 0x32, 0x32, 0xb3, 0x2a, 0xb3, 0xba,
+	0x9a, 0x6c, 0xee, 0xce, 0x02, 0x37, 0xf3, 0x44, 0x76, 0x64, 0x44, 0x54, 0xfe, 0x46, 0x46, 0x64,
+	0x46, 0x44, 0xc2, 0x78, 0x74, 0xd0, 0xa5, 0xe1, 0x8d, 0x6e, 0xe0, 0x47, 0x3e, 0x19, 0xc1, 0x1f,
+	0x97, 0xce, 0xee, 0xfa, 0xbb, 0x3e, 0x42, 0xe6, 0xd8, 0x7f, 0xbc, 0xf0, 0x52, 0x75, 0xd7, 0xf7,
+	0x77, 0x5b, 0x74, 0x0e, 0x7f, 0xed, 0xf4, 0x1e, 0xce, 0x45, 0x5e, 0x9b, 0x86, 0x91, 0xd3, 0xee,
+	0x0a, 0x84, 0x85, 0x5d, 0x2f, 0xda, 0xeb, 0xed, 0xdc, 0x68, 0xfa, 0xed, 0xb9, 0xdd, 0xc0, 0x79,
+	0xe4, 0x45, 0x4e, 0xe4, 0xf9, 0x1d, 0xa7, 0x35, 0x17, 0xd1, 0x16, 0xed, 0xfa, 0x41, 0x34, 0xe7,
+	0x74, 0xbd, 0x39, 0xfc, 0xc6, 0xdc, 0xe3, 0xc0, 0xe9, 0x76, 0x69, 0x90, 0xfc, 0xc3, 0x99, 0x98,
+	0x7f, 0x3f, 0x0f, 0xa5, 0xfb, 0x94, 0x76, 0x6b, 0x2d, 0xef, 0x11, 0x25, 0x2f, 0x43, 0x61, 0xd5,
+	0x69, 0xd3, 0x59, 0xe3, 0x8a, 0x71, 0xb5, 0x54, 0x9f, 0x3a, 0x3a, 0xac, 0x8e, 0x87, 0x34, 0x78,
+	0x44, 0x03, 0xbb, 0xe3, 0xb4, 0xa9, 0x85, 0x85, 0xe4, 0xf3, 0x50, 0x62, 0x7f, 0xc3, 0xae, 0xd3,
+	0xa4, 0xb3, 0x39, 0xc4, 0x9c, 0x38, 0x3a, 0xac, 0x96, 0x3a, 0x12, 0x68, 0x25, 0xe5, 0xe4, 0x35,
+	0x18, 0x5b, 0xa1, 0x4e, 0x48, 0x97, 0x17, 0x67, 0xf3, 0x57, 0x8c, 0xab, 0xf9, 0x7a, 0xf9, 0xe8,
+	0xb0, 0x5a, 0x6c, 0x31, 0x90, 0xed, 0xb9, 0x96, 0x2c, 0x24, 0xcb, 0x30, 0xb6, 0xf4, 0xa4, 0xeb,
+	0x05, 0x34, 0x9c, 0x2d, 0x5c, 0x31, 0xae, 0x8e, 0xcf, 0x5f, 0xba, 0xc1, 0xdb, 0x7f, 0x43, 0xb6,
+	0xff, 0xc6, 0x86, 0x6c, 0x7f, 0x7d, 0xe6, 0xfb, 0x87, 0xd5, 0x33, 0x47, 0x87, 0xd5, 0x31, 0xca,
+	0x49, 0xbe, 0xfd, 0x5f, 0xaa, 0x86, 0x25, 0xe9, 0xc9, 0xbb, 0x50, 0xd8, 0x38, 0xe8, 0xd2, 0xd9,
+	0xd2, 0x15, 0xe3, 0xea, 0xe4, 0xfc, 0x4b, 0x37, 0x78, 0x8f, 0xc7, 0x8d, 0x4c, 0xfe, 0x63, 0x58,
+	0xf5, 0xe2, 0xd1, 0x61, 0xb5, 0xc0, 0x50, 0x2c, 0xa4, 0x22, 0x6f, 0xc2, 0xe8, 0x3d, 0x3f, 0x8c,
+	0x96, 0x17, 0x67, 0x01, 0x9b, 0x76, 0xee, 0xe8, 0xb0, 0x3a, 0xbd, 0xe7, 0x87, 0x91, 0xed, 0xb9,
+	0x6f, 0xf8, 0x6d, 0x2f, 0xa2, 0xed, 0x6e, 0x74, 0x60, 0x09, 0x24, 0x73, 0x07, 0x26, 0x34, 0x7e,
+	0x64, 0x1c, 0xc6, 0x36, 0x57, 0xef, 0xaf, 0xae, 0x6d, 0xaf, 0x56, 0xce, 0x90, 0x22, 0x14, 0x56,
+	0xd7, 0x16, 0x97, 0x2a, 0x06, 0x19, 0x83, 0x7c, 0x6d, 0x7d, 0xbd, 0x92, 0x23, 0x65, 0x28, 0x2e,
+	0xd6, 0x36, 0x6a, 0xf5, 0x5a, 0x63, 0xa9, 0x92, 0x27, 0x33, 0x30, 0xb5, 0xbd, 0xbc, 0xba, 0xb8,
+	0xb6, 0xdd, 0xb0, 0x17, 0x97, 0x1a, 0xf7, 0x37, 0xd6, 0xd6, 0x2b, 0x05, 0x32, 0x09, 0x70, 0x7f,
+	0xb3, 0xbe, 0x64, 0xad, 0x2e, 0x6d, 0x2c, 0x35, 0x2a, 0x23, 0xe6, 0xaf, 0xe4, 0xa1, 0xf8, 0x80,
+	0x46, 0x8e, 0xeb, 0x44, 0x0e, 0xb9, 0xac, 0x0d, 0x11, 0xd6, 0x5e, 0x19, 0x9b, 0x97, 0xfb, 0xc7,
+	0x66, 0xe4, 0xe8, 0xb0, 0x6a, 0xbc, 0xa9, 0x8e, 0xc9, 0x3b, 0x30, 0xbe, 0x48, 0xc3, 0x66, 0xe0,
+	0x75, 0xd9, 0x7c, 0xc1, 0x71, 0x29, 0xd5, 0x2f, 0x1e, 0x1d, 0x56, 0xcf, 0xb9, 0x09, 0x58, 0x69,
+	0xab, 0x8a, 0x4d, 0x96, 0x61, 0x74, 0xc5, 0xd9, 0xa1, 0xad, 0x70, 0x76, 0xe4, 0x4a, 0xfe, 0xea,
+	0xf8, 0xfc, 0x0b, 0xa2, 0x7f, 0x65, 0x05, 0x6f, 0xf0, 0xd2, 0xa5, 0x4e, 0x14, 0x1c, 0xd4, 0xcf,
+	0x1e, 0x1d, 0x56, 0x2b, 0x2d, 0x04, 0xa8, 0x7d, 0xc7, 0x51, 0x48, 0x23, 0x19, 0xf3, 0xd1, 0x13,
+	0xc7, 0xfc, 0xc5, 0xef, 0x1f, 0x56, 0x0d, 0x36, 0x16, 0x62, 0xcc, 0x13, 0x7e, 0xfa, 0xe8, 0x5f,
+	0x81, 0xdc, 0xf2, 0xe2, 0xec, 0x18, 0xce, 0xb5, 0xca, 0xd1, 0x61, 0xb5, 0xac, 0x0d, 0x5b, 0x6e,
+	0x79, 0xf1, 0xd2, 0xdb, 0x30, 0xae, 0xd4, 0x91, 0x54, 0x20, 0xbf, 0x4f, 0x0f, 0x78, 0x7f, 0x5a,
+	0xec, 0x5f, 0x72, 0x16, 0x46, 0x1e, 0x39, 0xad, 0x9e, 0xe8, 0x40, 0x8b, 0xff, 0xf8, 0x52, 0xee,
+	0x27, 0x0d, 0xf3, 0x37, 0x0a, 0x50, 0xb4, 0x7c, 0xbe, 0xce, 0xc8, 0x35, 0x18, 0x69, 0x44, 0x4e,
+	0x24, 0x87, 0x62, 0xe6, 0xe8, 0xb0, 0x3a, 0x15, 0x32, 0x80, 0xf2, 0x3d, 0x8e, 0xc1, 0x50, 0xd7,
+	0xf7, 0x9c, 0x50, 0x0e, 0x09, 0xa2, 0x76, 0x19, 0x40, 0x45, 0x45, 0x0c, 0xf2, 0x1a, 0x14, 0x1e,
+	0xf8, 0x2e, 0x15, 0xa3, 0x42, 0x8e, 0x0e, 0xab, 0x93, 0x6d, 0xdf, 0x55, 0x11, 0xb1, 0x9c, 0xbc,
+	0x01, 0xa5, 0x85, 0x5e, 0x10, 0xd0, 0x0e, 0x9b, 0xaa, 0x05, 0x44, 0x9e, 0x3c, 0x3a, 0xac, 0x42,
+	0x93, 0x03, 0xd9, 0xe2, 0x4a, 0x10, 0x58, 0x57, 0x37, 0x22, 0x27, 0x88, 0xa8, 0x3b, 0x3b, 0x32,
+	0x54, 0x57, 0xb3, 0xe5, 0x35, 0x1d, 0x72, 0x92, 0x74, 0x57, 0x0b, 0x4e, 0xe4, 0x1e, 0x8c, 0xdf,
+	0x0d, 0x9c, 0x26, 0x5d, 0xa7, 0x81, 0xe7, 0xbb, 0x38, 0x86, 0xf9, 0xfa, 0x6b, 0x47, 0x87, 0xd5,
+	0xf3, 0xbb, 0x0c, 0x6c, 0x77, 0x11, 0x9e, 0x50, 0xff, 0xe8, 0xb0, 0x5a, 0x5c, 0xec, 0x05, 0xd8,
+	0x7b, 0x96, 0x4a, 0x4a, 0x7e, 0x86, 0x0d, 0x49, 0x18, 0x61, 0xd7, 0x52, 0x17, 0x47, 0xef, 0xf8,
+	0x2a, 0x9a, 0xa2, 0x8a, 0xe7, 0x5b, 0x4e, 0x18, 0xd9, 0x01, 0xa7, 0x4b, 0xd5, 0x53, 0x65, 0x49,
+	0xd6, 0xa0, 0xd8, 0x68, 0xee, 0x51, 0xb7, 0xd7, 0xa2, 0xb3, 0x45, 0x64, 0x7f, 0x41, 0x4c, 0x5c,
+	0x39, 0x9e, 0xb2, 0xb8, 0x7e, 0x49, 0xf0, 0x26, 0xa1, 0x80, 0x28, 0x7d, 0x1f, 0x33, 0xf9, 0x52,
+	0xf1, 0xb7, 0x7f, 0xbf, 0x7a, 0xe6, 0x97, 0xfe, 0xf3, 0x95, 0x33, 0xe6, 0xbf, 0xc8, 0x41, 0x25,
+	0xcd, 0x84, 0x3c, 0x84, 0x89, 0xcd, 0xae, 0xeb, 0x44, 0x74, 0xa1, 0xe5, 0xd1, 0x4e, 0x14, 0xe2,
+	0x24, 0x39, 0xbe, 0x4d, 0xaf, 0x88, 0xef, 0xce, 0xf6, 0x90, 0xd0, 0x6e, 0x72, 0xca, 0x54, 0xab,
+	0x74, 0xb6, 0xc9, 0x77, 0x1a, 0x28, 0xa7, 0x43, 0x9c, 0x61, 0xa7, 0xfb, 0x0e, 0x97, 0xf0, 0x03,
+	0xbe, 0x23, 0xd8, 0x8a, 0x09, 0xd4, 0x71, 0x77, 0x0e, 0x70, 0x66, 0x0e, 0x3f, 0x81, 0x18, 0x49,
+	0xc6, 0x04, 0x62, 0x60, 0xf3, 0xbf, 0x19, 0x30, 0x69, 0xd1, 0xd0, 0xef, 0x05, 0x4d, 0x7a, 0x8f,
+	0x3a, 0x2e, 0x0d, 0xd8, 0xf4, 0xbf, 0xef, 0x75, 0x5c, 0xb1, 0xa6, 0x70, 0xfa, 0xef, 0x7b, 0x1d,
+	0x75, 0x09, 0x63, 0x39, 0xf9, 0x02, 0x8c, 0x35, 0x7a, 0x3b, 0x88, 0xca, 0xd7, 0xd4, 0x79, 0x1c,
+	0xb1, 0xde, 0x8e, 0x9d, 0x42, 0x97, 0x68, 0x64, 0x0e, 0xc6, 0xb6, 0x68, 0x10, 0x26, 0x12, 0x0f,
+	0x25, 0xfb, 0x23, 0x0e, 0x52, 0x09, 0x04, 0x16, 0xb9, 0x9b, 0x48, 0x5d, 0xb1, 0x27, 0x4d, 0xa5,
+	0x64, 0x5d, 0x32, 0x55, 0xda, 0x02, 0xa2, 0x4e, 0x15, 0x89, 0x65, 0x7e, 0x27, 0x07, 0x95, 0x45,
+	0x27, 0x72, 0x76, 0x9c, 0x50, 0xf4, 0xe7, 0xd6, 0x2d, 0x26, 0xc7, 0x95, 0x86, 0xa2, 0x1c, 0x67,
+	0x35, 0xff, 0xc4, 0xcd, 0x7b, 0x35, 0xdd, 0xbc, 0x71, 0xb6, 0x41, 0x8a, 0xe6, 0x25, 0x8d, 0x7a,
+	0xef, 0xe4, 0x46, 0x55, 0x44, 0xa3, 0x8a, 0xb2, 0x51, 0x49, 0x53, 0xc8, 0x7b, 0x50, 0x68, 0x74,
+	0x69, 0x53, 0x08, 0x11, 0x29, 0xfb, 0xf5, 0xc6, 0x31, 0x84, 0xad, 0x5b, 0xf5, 0xb2, 0x60, 0x53,
+	0x08, 0xbb, 0xb4, 0x69, 0x21, 0x99, 0xb2, 0x68, 0xbe, 0x3b, 0x0a, 0x67, 0xb3, 0xc8, 0xc8, 0x7b,
+	0xfa, 0xe6, 0xc4, 0xbb, 0xe7, 0x85, 0x81, 0x9b, 0xd3, 0xac, 0xa1, 0x6f, 0x4f, 0xd7, 0xa1, 0xb8,
+	0xce, 0x26, 0x64, 0xd3, 0x6f, 0x89, 0x9e, 0x63, 0x52, 0xb1, 0xd8, 0x95, 0x30, 0xc3, 0x8a, 0xcb,
+	0xc9, 0x0b, 0x90, 0xdf, 0xb4, 0x96, 0x45, 0x77, 0x95, 0x8e, 0x0e, 0xab, 0xf9, 0x5e, 0xe0, 0xcd,
+	0x1a, 0x16, 0x83, 0x92, 0x39, 0x18, 0x5d, 0xa8, 0x2d, 0xd0, 0x20, 0xc2, 0x6e, 0x2a, 0xd7, 0x2f,
+	0xb0, 0xd9, 0xd2, 0x74, 0xec, 0x26, 0x0d, 0x22, 0xed, 0xf3, 0x02, 0x8d, 0x7c, 0x1e, 0xf2, 0xb5,
+	0xed, 0x86, 0xe8, 0x19, 0x10, 0x3d, 0x53, 0xdb, 0x6e, 0xd4, 0x27, 0x44, 0x47, 0xe4, 0x9d, 0xc7,
+	0x21, 0xe3, 0x5e, 0xdb, 0x6e, 0xa8, 0xa3, 0x35, 0x7a, 0xcc, 0x68, 0x5d, 0x85, 0x22, 0xd3, 0x33,
+	0xd8, 0x06, 0x8f, 0x42, 0xb1, 0xc4, 0xd5, 0xa7, 0x3d, 0x01, 0xb3, 0xe2, 0x52, 0xf2, 0x72, 0xac,
+	0xb6, 0x14, 0x13, 0x7e, 0x42, 0x6d, 0x91, 0xca, 0x0a, 0x79, 0x02, 0x13, 0x8b, 0x07, 0x1d, 0xa7,
+	0xed, 0x35, 0xc5, 0x16, 0x5e, 0xc2, 0x2d, 0xfc, 0xc6, 0x31, 0xc3, 0x78, 0x43, 0x23, 0xe0, 0xbb,
+	0xba, 0x14, 0xbe, 0xb3, 0x2e, 0x2f, 0xb3, 0xd3, 0x3b, 0xfc, 0xac, 0x61, 0xe9, 0x1f, 0x62, 0x6b,
+	0x49, 0x8a, 0x48, 0xd4, 0xab, 0x92, 0x69, 0x27, 0xc1, 0xc9, 0x5a, 0x0a, 0x04, 0x44, 0x5d, 0x4b,
+	0xf1, 0xa6, 0xfb, 0x1e, 0xe4, 0xef, 0x2e, 0xac, 0xcf, 0x8e, 0x23, 0x0f, 0x22, 0x78, 0xdc, 0x5d,
+	0x58, 0x5f, 0x68, 0xf9, 0x3d, 0xb7, 0xf1, 0xd1, 0x4a, 0xfd, 0x82, 0x60, 0x33, 0xb1, 0xdb, 0xec,
+	0x6a, 0x35, 0x62, 0x74, 0x64, 0x09, 0x8a, 0xb2, 0x95, 0xb3, 0x65, 0xe4, 0x31, 0x9d, 0x6a, 0xfc,
+	0xd6, 0x2d, 0xbe, 0xd6, 0x5c, 0xf1, 0x5b, 0xad, 0x85, 0xc4, 0xb9, 0xb4, 0x0d, 0xa4, 0xbf, 0x5f,
+	0x32, 0x34, 0x89, 0xcf, 0xab, 0x9a, 0xc4, 0xf8, 0xfc, 0x39, 0xf1, 0xad, 0x05, 0xbf, 0xdd, 0x76,
+	0x3a, 0x2e, 0xd2, 0x6e, 0xcd, 0xab, 0x0a, 0x46, 0x0d, 0x26, 0x93, 0x8a, 0xac, 0x78, 0x61, 0x44,
+	0xe6, 0xa0, 0x24, 0x21, 0x6c, 0x13, 0xc9, 0x67, 0x56, 0xd9, 0x4a, 0x70, 0xcc, 0x3f, 0xcd, 0x01,
+	0x24, 0x25, 0xcf, 0xa8, 0x9c, 0xf9, 0x09, 0x4d, 0xce, 0x9c, 0x4b, 0x4f, 0xd0, 0x81, 0x12, 0x86,
+	0x7c, 0x00, 0xa3, 0x4c, 0xe5, 0xea, 0x49, 0x95, 0xf2, 0x42, 0x9a, 0x14, 0x0b, 0xb7, 0x6e, 0xd5,
+	0x27, 0x05, 0xf1, 0x68, 0x88, 0x10, 0x4b, 0x90, 0x29, 0x22, 0xea, 0x7f, 0x14, 0x92, 0xc1, 0x10,
+	0xc2, 0xe9, 0xaa, 0x22, 0x5d, 0x8c, 0x64, 0x3d, 0x4a, 0xe9, 0xa2, 0xc8, 0x96, 0x8b, 0x5c, 0xb6,
+	0xf0, 0x4e, 0x1d, 0x13, 0xb2, 0x25, 0x2d, 0x59, 0x78, 0x07, 0x9e, 0x28, 0x59, 0xba, 0xe9, 0x65,
+	0x5b, 0xc0, 0x69, 0x70, 0x35, 0xb3, 0x57, 0xb2, 0x16, 0xec, 0x95, 0x93, 0x16, 0x6c, 0x7a, 0xb9,
+	0xde, 0x1a, 0x24, 0xcb, 0xce, 0xc9, 0xd5, 0xe5, 0x3c, 0x56, 0xc9, 0x51, 0xa6, 0xbd, 0xc3, 0x97,
+	0xe6, 0xe8, 0xc0, 0xa5, 0x79, 0x2e, 0x73, 0x69, 0xf2, 0x85, 0xf9, 0x0e, 0x8c, 0xd4, 0x7e, 0xae,
+	0x17, 0x50, 0xa1, 0xfb, 0x95, 0xe5, 0x37, 0x19, 0x2c, 0x5e, 0xd3, 0x53, 0x0e, 0xfb, 0xa9, 0xea,
+	0xcc, 0x58, 0xce, 0xbe, 0xbc, 0xb1, 0xd2, 0x10, 0x7a, 0x1d, 0x49, 0x75, 0xcb, 0xc6, 0x8a, 0x52,
+	0xed, 0x48, 0x6b, 0x35, 0xa3, 0x22, 0x73, 0x90, 0xab, 0x2d, 0xa2, 0xb1, 0x38, 0x3e, 0x5f, 0x92,
+	0x9f, 0x5d, 0xac, 0x9f, 0x15, 0x24, 0x65, 0x47, 0xb3, 0x1f, 0x6a, 0x8b, 0x9f, 0xdd, 0xe2, 0x6f,
+	0x29, 0x6a, 0x82, 0x98, 0xa6, 0xcc, 0x1c, 0x15, 0x93, 0xc5, 0x48, 0x94, 0x96, 0xbe, 0xc9, 0x12,
+	0x4f, 0x95, 0x6b, 0x7c, 0xe0, 0x72, 0x7d, 0x03, 0x37, 0xae, 0x6c, 0x42, 0x38, 0x5c, 0xe6, 0x5f,
+	0x19, 0x88, 0x4b, 0xde, 0x80, 0x51, 0x8b, 0xee, 0x26, 0x7b, 0x2d, 0xda, 0x6c, 0x01, 0x42, 0xd4,
+	0x0f, 0x70, 0x1c, 0x14, 0xe4, 0xd4, 0x0d, 0xf7, 0xbc, 0x87, 0x91, 0xf8, 0x4a, 0x2c, 0xc8, 0x05,
+	0x58, 0x11, 0xe4, 0x02, 0xa2, 0x09, 0x72, 0x01, 0x63, 0x53, 0xcc, 0x5a, 0x6c, 0x08, 0x65, 0x52,
+	0xd6, 0xd4, 0x5a, 0x54, 0xc6, 0x2a, 0x70, 0xb5, 0xb1, 0xb2, 0x16, 0x1b, 0xe4, 0x36, 0x94, 0x6a,
+	0xcd, 0xa6, 0xdf, 0x53, 0x8c, 0x9e, 0xd9, 0xa3, 0xc3, 0xea, 0x59, 0x87, 0x03, 0x75, 0x13, 0x3d,
+	0x41, 0x35, 0xeb, 0x49, 0xad, 0x19, 0x8f, 0x85, 0x56, 0x2f, 0x8c, 0x68, 0xb0, 0xbc, 0x28, 0x9a,
+	0x8c, 0x3c, 0x9a, 0x1c, 0x98, 0xe2, 0x11, 0xa3, 0x9a, 0xff, 0xc9, 0xc0, 0x1a, 0x93, 0xb7, 0x01,
+	0x96, 0x3b, 0x4c, 0xb1, 0x6d, 0xd2, 0x98, 0x01, 0x1a, 0xcf, 0x9e, 0x80, 0xea, 0x1c, 0x14, 0x64,
+	0xfd, 0xd3, 0xb9, 0xa1, 0x3f, 0xcd, 0x3e, 0x29, 0xd5, 0x64, 0x71, 0x8e, 0x22, 0x3e, 0x19, 0x08,
+	0x68, 0xea, 0x93, 0x09, 0x32, 0x79, 0x0d, 0xc6, 0x96, 0x6b, 0x0f, 0x6a, 0xbd, 0x68, 0x0f, 0xfb,
+	0xab, 0xc8, 0x05, 0x96, 0xe7, 0xb4, 0x6d, 0xa7, 0x17, 0xed, 0x59, 0xb2, 0xd0, 0xfc, 0x25, 0x03,
+	0xc6, 0x95, 0xb5, 0xca, 0xaa, 0xba, 0x1e, 0xf8, 0x1f, 0xd3, 0x66, 0xa4, 0xf7, 0x52, 0x97, 0x03,
+	0x53, 0x55, 0x8d, 0x51, 0x53, 0xbd, 0x93, 0x3b, 0x45, 0xef, 0x98, 0x73, 0x42, 0x04, 0x30, 0x1b,
+	0x40, 0x39, 0xe2, 0x40, 0x1b, 0x80, 0xe9, 0x38, 0xaa, 0x0d, 0xc0, 0xca, 0xcd, 0x3f, 0x32, 0xd8,
+	0xd2, 0x25, 0x73, 0x00, 0xf7, 0xe9, 0x41, 0xe4, 0xec, 0xdc, 0xf1, 0x5a, 0xda, 0xd1, 0xd5, 0x3e,
+	0x42, 0xed, 0x87, 0x5e, 0x8b, 0x5a, 0x0a, 0x0a, 0xb9, 0x05, 0xc5, 0xfb, 0xc1, 0xce, 0x5b, 0x88,
+	0x9e, 0x8b, 0x45, 0xf0, 0xcc, 0x7e, 0xb0, 0xf3, 0x16, 0x22, 0xab, 0xf3, 0x55, 0x22, 0x12, 0x13,
+	0x46, 0x17, 0xfd, 0xb6, 0xe3, 0xc9, 0x6d, 0x0f, 0xd8, 0xde, 0xe1, 0x22, 0xc4, 0x12, 0x25, 0x4c,
+	0xe8, 0x37, 0xd6, 0x57, 0xc5, 0xc4, 0x44, 0xa1, 0x1f, 0x76, 0x3b, 0x16, 0x83, 0x99, 0xdf, 0x33,
+	0x60, 0x5c, 0x91, 0x48, 0xe4, 0x8b, 0xc2, 0xcc, 0x37, 0xf0, 0x90, 0xea, 0x7c, 0xbf, 0xcc, 0x62,
+	0xa5, 0x7c, 0xbb, 0x66, 0xe6, 0xbf, 0x30, 0xfa, 0x13, 0x69, 0x90, 0x1b, 0x46, 0x1a, 0xbc, 0x0d,
+	0xc0, 0x75, 0x39, 0xec, 0x4e, 0x65, 0xde, 0x28, 0x87, 0x7a, 0xea, 0x60, 0x24, 0xc8, 0xe6, 0xff,
+	0x9f, 0x83, 0xa2, 0xb0, 0x55, 0xe6, 0x9f, 0x51, 0x1d, 0xe2, 0x2d, 0x4d, 0x87, 0x98, 0x11, 0xa4,
+	0x8a, 0x72, 0x3b, 0x7f, 0x82, 0x8d, 0xf2, 0x36, 0x94, 0x65, 0x17, 0xa0, 0x2a, 0x76, 0x0d, 0xc6,
+	0xa4, 0x95, 0xcd, 0x15, 0xb1, 0x29, 0x8d, 0xe7, 0xd6, 0xbc, 0x25, 0xcb, 0xcd, 0xef, 0x8c, 0x48,
+	0x5a, 0xfe, 0x25, 0xd6, 0x85, 0x35, 0xd7, 0x0d, 0xd4, 0x2e, 0x74, 0x5c, 0x37, 0xb0, 0x10, 0xca,
+	0x06, 0x6a, 0xbd, 0xb7, 0xd3, 0xf2, 0x9a, 0x88, 0xa3, 0xac, 0x9a, 0x2e, 0x42, 0x6d, 0x86, 0xaa,
+	0x0e, 0x54, 0x82, 0xac, 0x99, 0x08, 0xf9, 0x63, 0x4d, 0x84, 0x9f, 0x86, 0xd2, 0x42, 0xdb, 0xd5,
+	0x54, 0x08, 0x33, 0xa3, 0x53, 0x6e, 0xc4, 0x48, 0x5c, 0x79, 0xb8, 0x2c, 0xfa, 0xe8, 0x6c, 0xb3,
+	0xed, 0xf6, 0x2b, 0x0e, 0x09, 0x4b, 0x4d, 0xc7, 0x1f, 0xf9, 0x34, 0x3a, 0xfe, 0x6d, 0x28, 0x6d,
+	0x86, 0x74, 0xa3, 0xd7, 0xe9, 0xd0, 0x16, 0xaa, 0x13, 0x45, 0x2e, 0x7b, 0x7a, 0x21, 0xb5, 0x23,
+	0x84, 0xaa, 0x15, 0x88, 0x51, 0xd5, 0x69, 0x35, 0x76, 0xcc, 0xb4, 0xfa, 0x22, 0x14, 0x6a, 0xdd,
+	0xae, 0x34, 0x7e, 0xe2, 0x4d, 0xb2, 0xdb, 0xc5, 0xad, 0x6f, 0xd2, 0xe9, 0x76, 0x75, 0x53, 0x06,
+	0xb1, 0x09, 0x05, 0x72, 0xbf, 0xb7, 0x43, 0x83, 0x0e, 0x8d, 0x68, 0x28, 0x44, 0x73, 0x38, 0x0b,
+	0xc8, 0x63, 0x56, 0x9e, 0x31, 0xa7, 0x11, 0xd0, 0x70, 0xbd, 0xb0, 0xdf, 0xdb, 0xa1, 0xb6, 0x90,
+	0xf1, 0x6a, 0xdf, 0x65, 0x30, 0xbc, 0xd4, 0x80, 0x49, 0xbd, 0xff, 0x9f, 0x82, 0x62, 0xf1, 0x61,
+	0xa1, 0x58, 0xac, 0x94, 0xcc, 0x5f, 0xc9, 0xc1, 0x78, 0xad, 0xdb, 0x7d, 0xc6, 0x4f, 0x20, 0x7e,
+	0x52, 0x5b, 0xd5, 0xe7, 0x93, 0xd1, 0x3b, 0xc5, 0xe1, 0xc3, 0x5f, 0x1b, 0x30, 0x95, 0xa2, 0x50,
+	0x6b, 0x6f, 0x0c, 0x69, 0x91, 0xe7, 0x86, 0xb4, 0xc8, 0xf3, 0x83, 0x2d, 0x72, 0x75, 0xcd, 0x14,
+	0x3e, 0xcd, 0x9a, 0x79, 0x1d, 0xf2, 0xb5, 0x6e, 0x57, 0xf4, 0x4a, 0x39, 0xe9, 0x95, 0xad, 0x5b,
+	0x7c, 0x23, 0x72, 0xba, 0x5d, 0x8b, 0x61, 0x98, 0x6f, 0x42, 0x09, 0xc1, 0x28, 0xd1, 0xae, 0x88,
+	0xa5, 0xc0, 0xc5, 0x99, 0x46, 0xc6, 0xa7, 0xbd, 0xf9, 0xbf, 0x0d, 0x18, 0xc1, 0xdf, 0xcf, 0xe8,
+	0x74, 0x99, 0xd7, 0xa6, 0x4b, 0x45, 0x99, 0x2e, 0xc3, 0x4c, 0x94, 0x3f, 0xce, 0x63, 0x6f, 0x89,
+	0x29, 0x22, 0x6c, 0x3a, 0x23, 0xc3, 0xa6, 0xfb, 0x14, 0x02, 0x7c, 0x3f, 0x6d, 0xdd, 0xe5, 0x71,
+	0x30, 0x5e, 0x4e, 0x57, 0xf5, 0xa9, 0x18, 0x76, 0xf7, 0x80, 0x2c, 0x77, 0x42, 0xda, 0xec, 0x05,
+	0xb4, 0xb1, 0xef, 0x75, 0xb7, 0x68, 0xe0, 0x3d, 0x3c, 0x10, 0x9a, 0x21, 0xca, 0x58, 0x4f, 0x94,
+	0xda, 0xe1, 0xbe, 0xd7, 0xb5, 0x1f, 0x61, 0xb9, 0x95, 0x41, 0x43, 0x3e, 0x80, 0x31, 0x8b, 0x3e,
+	0x0e, 0xbc, 0x88, 0x8a, 0xbe, 0x9d, 0x8c, 0xed, 0x00, 0x84, 0x72, 0xdd, 0x24, 0xe0, 0x3f, 0xd4,
+	0xf1, 0x17, 0xe5, 0x9f, 0x9d, 0x19, 0xf5, 0xdd, 0x11, 0x5c, 0x0b, 0x27, 0xdc, 0x94, 0x1d, 0x63,
+	0xa0, 0xeb, 0x83, 0x99, 0x3f, 0xcd, 0x60, 0x6e, 0x41, 0x99, 0x99, 0x6e, 0x29, 0x4b, 0xfd, 0x72,
+	0x32, 0x96, 0x37, 0xd4, 0xe2, 0xe3, 0x2e, 0xc9, 0x34, 0x3e, 0xc4, 0x4e, 0x4f, 0x12, 0x7e, 0xf9,
+	0xf6, 0xa2, 0xc2, 0x38, 0x63, 0x7a, 0xc4, 0xa2, 0xa3, 0xc9, 0x3b, 0xeb, 0xd4, 0x13, 0x63, 0xf4,
+	0xd3, 0x4d, 0x8c, 0xb1, 0x4f, 0x32, 0x31, 0xd2, 0xd7, 0x93, 0xc5, 0xd3, 0x5c, 0x4f, 0x5e, 0xfa,
+	0x00, 0xa6, 0xfb, 0x7a, 0xf8, 0x34, 0x57, 0x7c, 0x9f, 0xdd, 0xb4, 0xfc, 0x85, 0xb8, 0x5f, 0xc8,
+	0x3c, 0x9a, 0xa3, 0x5e, 0x40, 0x9b, 0x11, 0x8a, 0x5e, 0x21, 0x2d, 0x03, 0x01, 0x4b, 0xd9, 0xcb,
+	0x08, 0x23, 0xef, 0xc3, 0x18, 0xbf, 0x22, 0x09, 0x67, 0x73, 0x38, 0xf6, 0x13, 0xe2, 0x8b, 0x1c,
+	0x2a, 0xee, 0xa9, 0x39, 0x86, 0xda, 0xab, 0x82, 0xc8, 0xbc, 0x0b, 0xa3, 0xe2, 0x8a, 0xe5, 0xf8,
+	0x75, 0x51, 0x85, 0x91, 0xad, 0xa4, 0x67, 0xf0, 0x58, 0x9c, 0x37, 0xc2, 0xe2, 0x70, 0xf3, 0xd7,
+	0x0c, 0x98, 0xd4, 0x5b, 0x49, 0x6e, 0xc0, 0xa8, 0xb8, 0x03, 0x34, 0xf0, 0x0e, 0x90, 0xb5, 0x66,
+	0x94, 0xdf, 0xfe, 0x69, 0x77, 0x7e, 0x02, 0x8b, 0x89, 0x7e, 0xc1, 0x01, 0xdb, 0x22, 0x44, 0xbf,
+	0x98, 0xa4, 0x96, 0x2c, 0x63, 0x26, 0x97, 0x45, 0xc3, 0x5e, 0x2b, 0x52, 0x4d, 0xae, 0x00, 0x21,
+	0x96, 0x28, 0x31, 0x0f, 0x0d, 0x80, 0x46, 0xe3, 0xde, 0x7d, 0x7a, 0xb0, 0xee, 0x78, 0x01, 0x9a,
+	0xad, 0xb8, 0x1a, 0xef, 0x8b, 0xd1, 0x2a, 0x0b, 0xb3, 0x95, 0xaf, 0xdc, 0x7d, 0x7a, 0xa0, 0x99,
+	0xad, 0x12, 0x15, 0x97, 0x7c, 0xe0, 0x3d, 0x72, 0x22, 0xca, 0x08, 0x73, 0x48, 0xc8, 0x97, 0x3c,
+	0x87, 0xa6, 0x28, 0x15, 0x64, 0xf2, 0x0d, 0x98, 0x4c, 0x7e, 0xa1, 0xe3, 0x41, 0x1e, 0x6d, 0x3a,
+	0x39, 0x23, 0xf4, 0xc2, 0xfa, 0x4b, 0x47, 0x87, 0xd5, 0x4b, 0x0a, 0x57, 0x9b, 0x61, 0x29, 0xac,
+	0x53, 0xcc, 0xcc, 0x3f, 0x30, 0x00, 0x36, 0x56, 0x1a, 0xb2, 0x81, 0xaf, 0x41, 0x21, 0x3e, 0x0d,
+	0x2a, 0x73, 0xdb, 0x38, 0x65, 0xfc, 0x61, 0x39, 0x79, 0x19, 0xf2, 0x49, 0x4b, 0xa6, 0x8f, 0x0e,
+	0xab, 0x13, 0x7a, 0x0b, 0x58, 0x29, 0xb9, 0x0b, 0x63, 0x43, 0xd5, 0x19, 0x67, 0x67, 0x46, 0x5d,
+	0x25, 0x35, 0x8e, 0xc2, 0x87, 0xdb, 0x1b, 0xcf, 0xef, 0x28, 0x7c, 0x2b, 0x07, 0x53, 0xac, 0x5f,
+	0x6b, 0xbd, 0x68, 0xcf, 0x0f, 0xbc, 0xe8, 0xe0, 0x99, 0xb5, 0x8a, 0xdf, 0xd5, 0x14, 0xa2, 0x4b,
+	0x52, 0x6c, 0xa9, 0x6d, 0x1b, 0xca, 0x38, 0xfe, 0xcb, 0x31, 0x98, 0xc9, 0xa0, 0x22, 0x6f, 0x08,
+	0xef, 0x9b, 0xe4, 0xcc, 0x08, 0xbd, 0x6b, 0x7e, 0x74, 0x58, 0x2d, 0x4b, 0xf4, 0x8d, 0xc4, 0xdb,
+	0x66, 0x1e, 0xc6, 0x85, 0xe9, 0xb3, 0x9a, 0x68, 0xd4, 0xe8, 0xb6, 0x21, 0xcf, 0xc4, 0x50, 0x34,
+	0xa9, 0x48, 0xa4, 0x06, 0xe5, 0x85, 0x3d, 0xda, 0xdc, 0xf7, 0x3a, 0xbb, 0xf7, 0xe9, 0x01, 0xd7,
+	0x97, 0xca, 0xf5, 0x17, 0x99, 0xa5, 0xd5, 0x14, 0x70, 0x36, 0xa4, 0xba, 0x11, 0xa7, 0x91, 0x90,
+	0xf7, 0x61, 0xbc, 0xe1, 0xed, 0x76, 0x24, 0x87, 0x02, 0x72, 0xb8, 0x7c, 0x74, 0x58, 0x3d, 0x1f,
+	0x72, 0x70, 0x3f, 0x03, 0x95, 0x80, 0x5c, 0x83, 0x11, 0xcb, 0x6f, 0x51, 0xbe, 0x0d, 0x0b, 0x7f,
+	0x8e, 0x80, 0x01, 0xd4, 0xb3, 0x69, 0xc4, 0x20, 0xf7, 0x60, 0x8c, 0xfd, 0xf3, 0xc0, 0xe9, 0xce,
+	0x8e, 0xa2, 0xdc, 0x26, 0xb1, 0x82, 0x8f, 0xd0, 0xae, 0xd7, 0xd9, 0x55, 0x75, 0xfc, 0x16, 0xb5,
+	0xdb, 0x4e, 0x57, 0xdb, 0x17, 0x39, 0x22, 0xd9, 0x82, 0xf1, 0x44, 0x10, 0x84, 0xb3, 0x63, 0xda,
+	0x5d, 0x50, 0x52, 0x52, 0xff, 0x9c, 0x60, 0x76, 0x21, 0x6a, 0x85, 0x38, 0xb7, 0xbb, 0x0c, 0x5f,
+	0x6f, 0x8c, 0xc2, 0x48, 0xb3, 0x41, 0x8a, 0x83, 0x6d, 0x10, 0xe3, 0x44, 0x1b, 0xc4, 0x05, 0x10,
+	0x9d, 0x54, 0x6b, 0xed, 0x0a, 0xf7, 0xab, 0x6b, 0x83, 0x27, 0xd8, 0x8d, 0x04, 0x19, 0xd7, 0x24,
+	0x3f, 0x99, 0x12, 0xfd, 0xef, 0xb4, 0x76, 0xb5, 0x93, 0xa9, 0x18, 0x95, 0x75, 0x43, 0x22, 0x6a,
+	0xa4, 0x05, 0x2e, 0xbb, 0x21, 0x29, 0x49, 0xba, 0xe1, 0xe3, 0xc7, 0xd1, 0xa0, 0x6e, 0x50, 0x18,
+	0x91, 0x55, 0x80, 0x5a, 0x33, 0xf2, 0x1e, 0x51, 0x9c, 0x12, 0xe3, 0x5a, 0x47, 0x2c, 0xd4, 0xee,
+	0xd3, 0x83, 0x06, 0x8d, 0x62, 0xcf, 0x86, 0x73, 0x0e, 0xa2, 0xa6, 0xa6, 0x89, 0xa5, 0x70, 0x20,
+	0x5d, 0x38, 0x57, 0x73, 0x5d, 0x8f, 0xbb, 0xe4, 0x6d, 0x04, 0x6c, 0xfe, 0xba, 0xc8, 0xba, 0x9c,
+	0xcd, 0xfa, 0x9a, 0x60, 0xfd, 0x39, 0x27, 0xa6, 0xb2, 0x23, 0x4e, 0x96, 0xfe, 0x4c, 0x36, 0x63,
+	0x73, 0x0d, 0x26, 0xf5, 0x2e, 0xd5, 0x9d, 0xd1, 0xca, 0x50, 0xb4, 0x1a, 0x35, 0xbb, 0x71, 0xaf,
+	0x76, 0xb3, 0x62, 0x90, 0x0a, 0x94, 0xc5, 0xaf, 0x79, 0x7b, 0xfe, 0xad, 0xdb, 0x95, 0x9c, 0x06,
+	0x79, 0xeb, 0xe6, 0x7c, 0x25, 0x6f, 0xfe, 0xb1, 0x01, 0x45, 0x59, 0x3f, 0x72, 0x1b, 0xf2, 0x8d,
+	0xc6, 0xbd, 0xd4, 0x15, 0x64, 0xb2, 0xf5, 0xf2, 0x4d, 0x26, 0x0c, 0xf7, 0xd4, 0x4d, 0xa6, 0xd1,
+	0xb8, 0xc7, 0xe8, 0x36, 0x56, 0x1a, 0x42, 0x69, 0xc9, 0x98, 0xae, 0xd3, 0x03, 0xee, 0x65, 0x6e,
+	0x43, 0xfe, 0xc3, 0xed, 0x0d, 0x61, 0x0d, 0x65, 0x8c, 0x2f, 0xd2, 0x7d, 0xfc, 0x58, 0xdd, 0xfa,
+	0x18, 0x81, 0x69, 0xc1, 0xb8, 0xb2, 0xb4, 0xb8, 0x12, 0xd1, 0xf6, 0x63, 0x37, 0x2d, 0xa1, 0x44,
+	0x30, 0x88, 0x25, 0x4a, 0x98, 0xce, 0xb3, 0xe2, 0x37, 0x9d, 0x96, 0xd0, 0x46, 0x50, 0xe7, 0x69,
+	0x31, 0x80, 0xc5, 0xe1, 0xe6, 0x9f, 0x18, 0x50, 0x59, 0x0f, 0xfc, 0x47, 0x1e, 0x93, 0xc0, 0x1b,
+	0xfe, 0x3e, 0xed, 0x6c, 0xdd, 0x24, 0x6f, 0x4a, 0x21, 0xc0, 0x55, 0xb8, 0x0b, 0x8c, 0x0a, 0x85,
+	0xc0, 0x8f, 0x0e, 0xab, 0xd0, 0x38, 0x08, 0x23, 0xda, 0x66, 0xe5, 0x52, 0x10, 0x28, 0xde, 0x6e,
+	0xb9, 0xe1, 0x3d, 0x68, 0x4e, 0xf0, 0x76, 0xab, 0xc2, 0x08, 0x56, 0x47, 0x71, 0x62, 0x18, 0x89,
+	0x18, 0xc0, 0xe2, 0x70, 0x45, 0x60, 0x7f, 0x27, 0xd7, 0xd7, 0x86, 0xf9, 0xe7, 0xca, 0x0b, 0x45,
+	0x6f, 0xdc, 0x50, 0x9b, 0xd8, 0x57, 0xe1, 0x6c, 0xba, 0x4b, 0xf0, 0x5c, 0xa4, 0x06, 0x53, 0x3a,
+	0x5c, 0x1e, 0x91, 0x5c, 0xc8, 0xfc, 0xd6, 0xd6, 0xbc, 0x95, 0xc6, 0x37, 0x7f, 0x60, 0x40, 0x09,
+	0xff, 0xb5, 0x7a, 0x2d, 0xca, 0x34, 0x9b, 0xda, 0x76, 0x43, 0x5c, 0x48, 0xa9, 0x97, 0x46, 0xce,
+	0xe3, 0xd0, 0x16, 0xb7, 0x57, 0x9a, 0x1c, 0x89, 0x91, 0x05, 0x29, 0xbf, 0x7e, 0x0b, 0xc5, 0x0c,
+	0x8d, 0x49, 0xf9, 0x3d, 0x5d, 0x98, 0x22, 0x15, 0xc8, 0x6c, 0xfc, 0xd8, 0x2f, 0xbf, 0x25, 0x8f,
+	0x86, 0x71, 0xfc, 0x90, 0xce, 0xd7, 0xae, 0x39, 0x24, 0x1a, 0x79, 0x13, 0x46, 0xd9, 0xa7, 0x2d,
+	0x79, 0x89, 0x81, 0x56, 0x05, 0xd6, 0x31, 0xd0, 0x6e, 0x03, 0x39, 0x92, 0xf9, 0x2f, 0x73, 0xe9,
+	0x0e, 0x14, 0x5a, 0xc0, 0x29, 0xd7, 0xc6, 0x3b, 0x30, 0x52, 0x6b, 0xb5, 0xfc, 0xc7, 0x42, 0x4a,
+	0xc8, 0x63, 0x9a, 0xb8, 0xff, 0xf8, 0x0e, 0xeb, 0x30, 0x14, 0xed, 0xf6, 0x97, 0x01, 0xc8, 0x02,
+	0x94, 0x6a, 0xdb, 0x8d, 0xe5, 0xe5, 0xc5, 0x8d, 0x8d, 0x15, 0xe1, 0x64, 0xfc, 0xaa, 0xec, 0x1f,
+	0xcf, 0x73, 0xed, 0x28, 0x6a, 0x0d, 0xf0, 0x41, 0x4c, 0xe8, 0xc8, 0x7b, 0x00, 0x1f, 0xfa, 0x5e,
+	0xe7, 0x01, 0x8d, 0xf6, 0x7c, 0x57, 0x34, 0x9e, 0xa9, 0x14, 0xe3, 0x1f, 0xfb, 0x5e, 0xc7, 0x6e,
+	0x23, 0x98, 0xd5, 0x3d, 0x41, 0xb2, 0x94, 0xff, 0x59, 0x4f, 0xd7, 0xfd, 0x08, 0x75, 0x98, 0x91,
+	0xa4, 0xa7, 0x77, 0xfc, 0x28, 0x7d, 0xc7, 0x22, 0xd1, 0xcc, 0x5f, 0xcf, 0xc1, 0x24, 0xb7, 0x54,
+	0xf9, 0x84, 0x79, 0x66, 0x17, 0xe3, 0x3b, 0xda, 0x62, 0xbc, 0x28, 0x37, 0x06, 0xa5, 0x69, 0x43,
+	0x2d, 0xc5, 0x3d, 0x20, 0xfd, 0x34, 0xc4, 0x92, 0xe7, 0x29, 0xc3, 0xac, 0xc2, 0x9b, 0xc9, 0xdd,
+	0x71, 0x88, 0x44, 0x36, 0x8a, 0xc2, 0xd0, 0xd2, 0x78, 0x98, 0xbf, 0x96, 0x83, 0x09, 0x45, 0x9f,
+	0x7c, 0x66, 0x3b, 0xfe, 0x4b, 0x5a, 0xc7, 0xcb, 0x3b, 0x08, 0xa5, 0x65, 0x43, 0xf5, 0x7b, 0x0f,
+	0xa6, 0xfb, 0x48, 0xd2, 0x6a, 0xb9, 0x31, 0x8c, 0x5a, 0xfe, 0x46, 0xff, 0xe5, 0x36, 0x77, 0x48,
+	0x8e, 0x2f, 0xb7, 0xd5, 0xdb, 0xf4, 0x6f, 0xe5, 0xe0, 0xac, 0xf8, 0x55, 0xeb, 0xb9, 0x5e, 0xb4,
+	0xe0, 0x77, 0x1e, 0x7a, 0xbb, 0xcf, 0xec, 0x58, 0xd4, 0xb4, 0xb1, 0xa8, 0xea, 0x63, 0xa1, 0x34,
+	0x70, 0xf0, 0x90, 0x98, 0xff, 0xba, 0x08, 0xb3, 0x83, 0x08, 0x98, 0xd9, 0xaf, 0x58, 0x55, 0x68,
+	0xf6, 0xa7, 0x2c, 0x56, 0x6e, 0x4f, 0x25, 0xce, 0x1c, 0xb9, 0x21, 0x9c, 0x39, 0x56, 0xa0, 0x82,
+	0x9f, 0x6a, 0xd0, 0x90, 0x75, 0x42, 0x98, 0x78, 0x43, 0x5e, 0x39, 0x3a, 0xac, 0x5e, 0x76, 0x58,
+	0x99, 0x1d, 0x8a, 0x42, 0xbb, 0x17, 0x78, 0x0a, 0x8f, 0x3e, 0x4a, 0xf2, 0x07, 0x06, 0x4c, 0x22,
+	0x70, 0xe9, 0x11, 0xed, 0x44, 0xc8, 0xac, 0x20, 0x2e, 0x69, 0xe2, 0xa0, 0x93, 0x46, 0x14, 0x78,
+	0x9d, 0x5d, 0x3c, 0x48, 0x0a, 0xeb, 0x3b, 0xac, 0x17, 0xfe, 0xe2, 0xb0, 0xfa, 0xee, 0x27, 0x09,
+	0x64, 0x11, 0xac, 0x42, 0x66, 0xc8, 0xf3, 0x8a, 0x52, 0xfc, 0x6c, 0xaa, 0x9a, 0xa9, 0x1a, 0x91,
+	0x9f, 0x82, 0x0b, 0x4b, 0x1d, 0x67, 0xa7, 0x45, 0x17, 0xfc, 0x4e, 0xe4, 0x75, 0x7a, 0x7e, 0x2f,
+	0xac, 0x3b, 0xcd, 0xfd, 0x5e, 0x37, 0x14, 0x87, 0x9d, 0xd8, 0xf2, 0x66, 0x5c, 0x68, 0xef, 0xf0,
+	0x52, 0x85, 0xe5, 0x20, 0x06, 0xe4, 0x1e, 0x4c, 0xf3, 0xa2, 0x5a, 0x2f, 0xf2, 0x1b, 0x4d, 0xa7,
+	0xe5, 0x75, 0x76, 0xf1, 0x0c, 0xb4, 0x58, 0xbf, 0xc4, 0x6c, 0x4b, 0xa7, 0x17, 0xf9, 0x76, 0xc8,
+	0xe1, 0x0a, 0xbf, 0x7e, 0x22, 0xb2, 0x0c, 0x53, 0x16, 0x75, 0xdc, 0x07, 0xce, 0x93, 0x05, 0xa7,
+	0xeb, 0x34, 0xbd, 0xe8, 0x00, 0x2d, 0xb3, 0x7c, 0xbd, 0x7a, 0x74, 0x58, 0x7d, 0x21, 0xa0, 0x8e,
+	0x6b, 0xb7, 0x9d, 0x27, 0x76, 0x53, 0x14, 0x2a, 0xcc, 0xd2, 0x74, 0x31, 0x2b, 0xaf, 0x13, 0xb3,
+	0x2a, 0xa5, 0x59, 0x79, 0x9d, 0xc1, 0xac, 0x12, 0x3a, 0xc9, 0x6a, 0xc3, 0x09, 0x76, 0x69, 0xc4,
+	0x0f, 0x09, 0xe1, 0x8a, 0x71, 0xd5, 0x50, 0x58, 0x45, 0x58, 0x66, 0xe3, 0x81, 0x61, 0x9a, 0x95,
+	0x42, 0xc7, 0x66, 0xde, 0x76, 0xe0, 0x45, 0x54, 0x6d, 0xe1, 0x38, 0x56, 0x0b, 0xfb, 0x1f, 0x8f,
+	0x49, 0x07, 0x35, 0xb1, 0x8f, 0x32, 0xe1, 0xa6, 0x34, 0xb2, 0xdc, 0xc7, 0x2d, 0xbb, 0x95, 0x7d,
+	0x94, 0x31, 0x37, 0xb5, 0x9d, 0x13, 0xd8, 0x4e, 0x85, 0xdb, 0x80, 0x86, 0xf6, 0x51, 0x92, 0x55,
+	0xd6, 0x69, 0x11, 0xed, 0xb0, 0x19, 0x2d, 0x0e, 0x49, 0x27, 0xb1, 0x6a, 0xaf, 0x08, 0x9b, 0xba,
+	0x12, 0xc8, 0x62, 0x3b, 0xe3, 0xc8, 0x34, 0x4d, 0xfc, 0x61, 0xa1, 0x38, 0x52, 0x19, 0xb5, 0x2a,
+	0x7c, 0xca, 0x47, 0x6c, 0xe2, 0xa0, 0x2c, 0x36, 0x7f, 0x27, 0x07, 0x17, 0xa5, 0x38, 0xa6, 0xd1,
+	0x63, 0x3f, 0xd8, 0xf7, 0x3a, 0xbb, 0xcf, 0xb8, 0x54, 0xbd, 0xa3, 0x49, 0xd5, 0x57, 0x52, 0x3b,
+	0x5c, 0xaa, 0x95, 0xc7, 0x88, 0xd6, 0x3f, 0x1f, 0x81, 0x17, 0x8f, 0xa5, 0x22, 0x1f, 0xb1, 0x5d,
+	0xd0, 0xa3, 0x9d, 0x68, 0xd9, 0x6d, 0x51, 0x66, 0x86, 0xf9, 0xbd, 0x48, 0x1c, 0x66, 0xbf, 0x7c,
+	0x74, 0x58, 0x9d, 0xe1, 0xb1, 0x18, 0xb6, 0xe7, 0xb6, 0xa8, 0x1d, 0xf1, 0x62, 0x6d, 0x98, 0xfa,
+	0xa9, 0x19, 0xcb, 0x38, 0x32, 0x6c, 0xb9, 0x13, 0xd1, 0xe0, 0x91, 0xc3, 0x5d, 0xd2, 0x05, 0xcb,
+	0x7d, 0x4a, 0xbb, 0xb6, 0xc3, 0x4a, 0x6d, 0x4f, 0x14, 0xeb, 0x2c, 0xfb, 0xa8, 0xc9, 0x1d, 0x85,
+	0xe5, 0x02, 0x33, 0x0e, 0x1e, 0x38, 0x4f, 0x84, 0xc6, 0x8b, 0xe7, 0xab, 0x0a, 0x4b, 0xee, 0x0f,
+	0xd7, 0x76, 0x9e, 0x58, 0xfd, 0x24, 0xe4, 0x1b, 0x70, 0x4e, 0x08, 0x6e, 0x26, 0xc4, 0x02, 0xbf,
+	0x25, 0x5b, 0x5c, 0x40, 0x5e, 0xaf, 0x1f, 0x1d, 0x56, 0x2f, 0x08, 0xb1, 0x6f, 0x37, 0x39, 0x46,
+	0x66, 0xab, 0xb3, 0xb9, 0x90, 0x0d, 0xb6, 0x91, 0xa5, 0xba, 0xe3, 0x01, 0x0d, 0x43, 0x67, 0x57,
+	0x6a, 0xc7, 0xfc, 0x46, 0x49, 0xe9, 0x4c, 0xbb, 0xcd, 0xcb, 0xad, 0x81, 0x94, 0xe4, 0x1e, 0x4c,
+	0x6e, 0xd3, 0x1d, 0x75, 0x7c, 0x46, 0xe3, 0x25, 0x5e, 0x79, 0x4c, 0x77, 0x06, 0x0f, 0x4e, 0x8a,
+	0x8e, 0x78, 0x30, 0xbd, 0x1e, 0xf8, 0x4f, 0x0e, 0x98, 0xa9, 0x47, 0x3b, 0x34, 0x40, 0x47, 0xac,
+	0x31, 0x3c, 0xae, 0x9a, 0x4d, 0x34, 0x4b, 0xbd, 0xbc, 0xfe, 0xb9, 0xa3, 0xc3, 0xea, 0x8b, 0x5d,
+	0x06, 0xb6, 0x5b, 0x02, 0x6e, 0xa7, 0x02, 0xb3, 0xfa, 0xb9, 0x92, 0x9f, 0x81, 0x29, 0xcb, 0xef,
+	0x45, 0x5e, 0x67, 0xb7, 0x11, 0x05, 0x4e, 0x44, 0x77, 0xb9, 0x20, 0x4f, 0x3c, 0xbe, 0x52, 0xa5,
+	0xfc, 0x60, 0x3a, 0xe0, 0x40, 0x3b, 0x14, 0x50, 0x4d, 0x92, 0xea, 0x04, 0xe6, 0x6f, 0xe5, 0x60,
+	0x56, 0x0c, 0x83, 0x45, 0x9b, 0x7e, 0xe0, 0x3e, 0xfb, 0xcb, 0x7e, 0x49, 0x5b, 0xf6, 0x2f, 0xc7,
+	0x3e, 0x4a, 0x59, 0x8d, 0x3c, 0x66, 0xd5, 0xff, 0x53, 0x03, 0x2e, 0x1f, 0x47, 0xc4, 0x7a, 0x27,
+	0xf6, 0xc1, 0x2b, 0xf5, 0xf9, 0xda, 0x75, 0x61, 0x06, 0xc7, 0x13, 0x0f, 0x8e, 0xc3, 0x7b, 0x7e,
+	0x18, 0xe1, 0xe9, 0x5d, 0x4e, 0x73, 0x24, 0xa8, 0xfb, 0x7e, 0x0b, 0xe5, 0x7c, 0xfd, 0x0d, 0x26,
+	0xce, 0xff, 0xe2, 0xb0, 0x0a, 0x0c, 0xb4, 0x86, 0x97, 0x91, 0x6c, 0xcf, 0xe7, 0x33, 0x06, 0xcf,
+	0xa5, 0x43, 0x1b, 0xbd, 0x3f, 0xf6, 0xe9, 0x41, 0x68, 0x65, 0xb1, 0xc6, 0x13, 0x9a, 0x5a, 0x2f,
+	0xda, 0x5b, 0x0f, 0xe8, 0x43, 0x1a, 0xd0, 0x4e, 0x93, 0x3e, 0x67, 0x27, 0x34, 0x7a, 0xe3, 0x86,
+	0x32, 0x4f, 0xfe, 0xef, 0x28, 0x9c, 0xcd, 0x22, 0x63, 0xfd, 0xa2, 0x68, 0xc4, 0xe9, 0x28, 0xde,
+	0xbf, 0x65, 0x40, 0xb9, 0x41, 0x9b, 0x7e, 0xc7, 0xbd, 0xe3, 0x34, 0x23, 0x5f, 0xba, 0x64, 0xd8,
+	0x5c, 0xb2, 0x31, 0xb8, 0xfd, 0x10, 0x0b, 0xb4, 0x93, 0x81, 0x2f, 0x0f, 0xa7, 0x88, 0x36, 0x7d,
+	0x74, 0x5a, 0x8d, 0xd8, 0x9c, 0x4c, 0x3e, 0x81, 0xb7, 0x1a, 0xda, 0x47, 0x49, 0x1d, 0x26, 0x16,
+	0xfc, 0x4e, 0x87, 0xb2, 0x1f, 0x8a, 0x0b, 0xe6, 0xe5, 0xa3, 0xc3, 0xea, 0x6c, 0x53, 0x16, 0xa4,
+	0x4f, 0x08, 0x74, 0x12, 0x72, 0x0b, 0xf2, 0x9b, 0xf3, 0x77, 0xc4, 0x18, 0x48, 0x67, 0xb5, 0xcd,
+	0xf9, 0x3b, 0x68, 0xeb, 0x32, 0xfd, 0x61, 0xa2, 0x37, 0xff, 0x50, 0x3d, 0x03, 0xdd, 0x9c, 0xbf,
+	0x43, 0xd6, 0x60, 0xda, 0xa2, 0x3f, 0xdb, 0xf3, 0x02, 0x2a, 0x16, 0xc0, 0x83, 0x3b, 0x35, 0x1c,
+	0x8b, 0x22, 0x97, 0x63, 0x01, 0x2f, 0x94, 0xba, 0xbd, 0xdd, 0x7e, 0xa8, 0x46, 0xae, 0xf5, 0xd3,
+	0x92, 0x5f, 0x84, 0x73, 0x8b, 0x5e, 0x28, 0xea, 0xcc, 0x0f, 0x1f, 0x5d, 0xbc, 0x87, 0x1c, 0x1d,
+	0xb0, 0x1c, 0x7e, 0x22, 0x73, 0x39, 0x7c, 0xce, 0x8d, 0x99, 0xd8, 0xfc, 0x64, 0xd3, 0x4d, 0xfb,
+	0xae, 0x66, 0x7f, 0x87, 0x7c, 0x0c, 0x93, 0x78, 0xda, 0x83, 0xe7, 0xb1, 0xe8, 0xce, 0x3c, 0x36,
+	0xe0, 0xcb, 0x5f, 0xc8, 0xfc, 0xf2, 0x25, 0x3c, 0x3c, 0xb2, 0xf1, 0x54, 0x17, 0x5d, 0x9f, 0x35,
+	0x1b, 0x41, 0xe3, 0x4c, 0x3e, 0x84, 0x29, 0xb1, 0xe9, 0xac, 0x3d, 0xdc, 0xd8, 0xa3, 0x8b, 0xce,
+	0x81, 0x70, 0x42, 0x40, 0xfd, 0x4f, 0xec, 0x54, 0xb6, 0xff, 0xd0, 0x8e, 0xf6, 0xa8, 0xed, 0x3a,
+	0x9a, 0x78, 0x4e, 0x11, 0x92, 0x9f, 0x87, 0xf1, 0x15, 0x1f, 0x2f, 0x9e, 0x50, 0xd4, 0x94, 0x90,
+	0xcf, 0x57, 0x31, 0x72, 0x95, 0x83, 0x53, 0x9b, 0xc8, 0x8f, 0x0e, 0xab, 0xef, 0x9c, 0x76, 0x16,
+	0x2a, 0x1f, 0xb0, 0xd4, 0xaf, 0x91, 0x05, 0x28, 0x6e, 0xd3, 0x1d, 0xd6, 0xda, 0x74, 0xd4, 0x95,
+	0x04, 0x73, 0x79, 0xf1, 0x58, 0xfc, 0x52, 0x6f, 0x75, 0x24, 0x86, 0xf9, 0xaf, 0x0c, 0x9c, 0x81,
+	0xe4, 0x3a, 0x3a, 0x82, 0xc5, 0xde, 0xe0, 0x68, 0x59, 0x3a, 0xdd, 0xae, 0xee, 0xcf, 0xcd, 0x51,
+	0x98, 0x19, 0x7a, 0xc7, 0x69, 0xd2, 0x48, 0x9e, 0x57, 0x22, 0xf2, 0x43, 0x84, 0xa8, 0x66, 0x28,
+	0xc7, 0x21, 0x5f, 0x81, 0xb3, 0x8b, 0xf4, 0x91, 0xd7, 0xa4, 0xb5, 0x28, 0xa2, 0x21, 0x6f, 0xed,
+	0x42, 0x8d, 0x5f, 0xec, 0x95, 0xea, 0xaf, 0x1c, 0x1d, 0x56, 0xaf, 0xb8, 0x58, 0x6e, 0x3b, 0x09,
+	0x82, 0xdd, 0x74, 0x54, 0x5e, 0x99, 0x1c, 0xcc, 0xff, 0x69, 0x24, 0x3d, 0x40, 0x5e, 0x87, 0x82,
+	0xb5, 0x1e, 0xd7, 0x9f, 0xdf, 0xd9, 0xa5, 0xaa, 0x8f, 0x08, 0xe4, 0x6b, 0x70, 0x4e, 0xe1, 0x83,
+	0x93, 0x83, 0xba, 0xac, 0x42, 0xbc, 0x31, 0xaf, 0xe2, 0x25, 0x8d, 0x52, 0x13, 0x87, 0x63, 0xa4,
+	0x6a, 0x94, 0xcd, 0x83, 0x35, 0x56, 0x29, 0x58, 0xa4, 0x1d, 0x8f, 0xf3, 0x56, 0x1a, 0xab, 0xf2,
+	0x76, 0x11, 0x21, 0xdd, 0xd8, 0x2c, 0x0e, 0x1f, 0x16, 0x8a, 0x85, 0xca, 0x88, 0xf9, 0xd7, 0x86,
+	0x92, 0x02, 0xe0, 0x19, 0xdd, 0x3d, 0x6e, 0x6b, 0xbb, 0xc7, 0x59, 0x41, 0x1a, 0xb7, 0x8a, 0x95,
+	0x65, 0xee, 0xf8, 0x53, 0x30, 0xa1, 0x21, 0xa1, 0xcb, 0xeb, 0x66, 0x48, 0x03, 0x7e, 0x3e, 0xf8,
+	0x7c, 0xb9, 0xbc, 0xc6, 0xed, 0x1a, 0xca, 0x93, 0xf1, 0x2f, 0x0d, 0x98, 0x4a, 0x51, 0xb0, 0xde,
+	0x60, 0x20, 0xb5, 0x37, 0x7a, 0x21, 0x0d, 0x2c, 0x84, 0x72, 0x07, 0xb9, 0x15, 0xdd, 0x41, 0xae,
+	0x65, 0x31, 0x18, 0xf9, 0x32, 0x8c, 0x6c, 0xa2, 0x36, 0xaf, 0xfb, 0x58, 0xc4, 0xfc, 0xb1, 0x90,
+	0xaf, 0xb0, 0x1e, 0xfb, 0x57, 0x15, 0x10, 0x58, 0x46, 0x1a, 0x30, 0xb6, 0x10, 0x50, 0x0c, 0xf6,
+	0x2f, 0x0c, 0x7f, 0x19, 0xd6, 0xe4, 0x24, 0xe9, 0xcb, 0x30, 0xc1, 0xc9, 0xfc, 0xcd, 0x1c, 0x90,
+	0xa4, 0x8d, 0xb4, 0x19, 0xd0, 0x28, 0x7c, 0x66, 0x07, 0xfd, 0x03, 0x6d, 0xd0, 0x5f, 0xec, 0x1b,
+	0x74, 0xde, 0xbc, 0xa1, 0xc6, 0xfe, 0x4f, 0x0c, 0x38, 0x9f, 0x4d, 0x48, 0x5e, 0x86, 0xd1, 0xb5,
+	0x8d, 0x75, 0xe9, 0xa6, 0x23, 0x9a, 0xe2, 0x77, 0x51, 0x4b, 0xb5, 0x44, 0x11, 0x79, 0x13, 0x46,
+	0x3f, 0xb2, 0x16, 0xd8, 0xf6, 0xa5, 0x44, 0x9d, 0xfc, 0x6c, 0x60, 0x37, 0x75, 0xf3, 0x47, 0x20,
+	0xa9, 0x63, 0x9b, 0x7f, 0x6a, 0x63, 0xfb, 0xad, 0x1c, 0x4c, 0xd5, 0x9a, 0x4d, 0x1a, 0x86, 0x4c,
+	0x39, 0xa1, 0x61, 0xf4, 0xcc, 0x0e, 0x6c, 0xb6, 0x03, 0x8e, 0xd6, 0xb6, 0xa1, 0x46, 0xf5, 0x4f,
+	0x0d, 0x38, 0x27, 0xa9, 0x1e, 0x79, 0xf4, 0xf1, 0xc6, 0x5e, 0x40, 0xc3, 0x3d, 0xbf, 0xe5, 0x0e,
+	0x1b, 0x3f, 0x85, 0xbb, 0xb4, 0xd7, 0x8a, 0x68, 0xa0, 0x1e, 0x16, 0x3f, 0x44, 0x88, 0xb6, 0x4b,
+	0x23, 0x84, 0xcc, 0xc1, 0x58, 0xad, 0xdb, 0x0d, 0xfc, 0x47, 0x7c, 0xd9, 0x4f, 0x88, 0xbb, 0x41,
+	0x0e, 0xd2, 0xee, 0x12, 0x39, 0x88, 0x55, 0x63, 0x91, 0x76, 0xb8, 0x77, 0xf1, 0x04, 0xaf, 0x86,
+	0x4b, 0x3b, 0xaa, 0xb6, 0x84, 0xe5, 0xe6, 0x37, 0x0b, 0x50, 0x56, 0x1b, 0x42, 0x4c, 0x18, 0xe5,
+	0xae, 0x22, 0xea, 0x95, 0xbd, 0x83, 0x10, 0x4b, 0x94, 0x24, 0x1e, 0x38, 0xb9, 0x13, 0x3d, 0x70,
+	0xb6, 0x61, 0x62, 0x3d, 0xf0, 0xbb, 0x7e, 0x48, 0x5d, 0x9e, 0xaf, 0x85, 0x4b, 0xad, 0x99, 0xd8,
+	0x2d, 0x95, 0xf7, 0x39, 0x2b, 0xe2, 0xaa, 0x79, 0x57, 0x60, 0xdb, 0xe9, 0x6c, 0x2e, 0x3a, 0x1f,
+	0x7e, 0xd8, 0xee, 0x84, 0xc2, 0x75, 0x3f, 0x3e, 0x6c, 0x67, 0x10, 0xfd, 0xb0, 0x9d, 0x41, 0xd4,
+	0x65, 0x31, 0xf2, 0xb4, 0x96, 0x05, 0xf9, 0x4d, 0x03, 0xc6, 0x6b, 0x9d, 0x8e, 0xf0, 0xc0, 0x91,
+	0x41, 0xcf, 0xe7, 0x92, 0x03, 0x77, 0xee, 0xa2, 0xc9, 0xcf, 0xdb, 0xbf, 0x2e, 0xce, 0xdb, 0xdf,
+	0xf9, 0x44, 0xe7, 0xed, 0x1b, 0x81, 0xe3, 0x45, 0x21, 0x5e, 0xac, 0x26, 0x1f, 0x54, 0xdd, 0x70,
+	0x95, 0x7a, 0x90, 0x77, 0xa0, 0x12, 0xcf, 0xc7, 0xe5, 0x8e, 0x4b, 0x9f, 0x50, 0xee, 0xb0, 0x34,
+	0xc1, 0x23, 0xf3, 0xb4, 0x8b, 0x84, 0x34, 0xa2, 0xf9, 0x2d, 0x03, 0xce, 0xab, 0x13, 0xa2, 0xd1,
+	0xdb, 0x69, 0x7b, 0x68, 0x8a, 0x90, 0x1b, 0x50, 0x12, 0xe3, 0x15, 0x2b, 0x72, 0xfd, 0x49, 0x7e,
+	0x12, 0x14, 0xb2, 0xc4, 0x86, 0x88, 0xf1, 0x10, 0x76, 0xfb, 0x4c, 0x6a, 0xb9, 0xb1, 0xa2, 0xfa,
+	0xac, 0xe8, 0xec, 0x4a, 0x80, 0xbf, 0xf5, 0xb1, 0x63, 0x10, 0xf3, 0x7d, 0x98, 0xd6, 0x6b, 0xd9,
+	0xa0, 0x18, 0x0e, 0x26, 0x9b, 0x66, 0x64, 0x37, 0x4d, 0x96, 0x9b, 0xdb, 0x40, 0xfa, 0xe8, 0x43,
+	0xbc, 0x34, 0xa2, 0x91, 0xbc, 0xd4, 0x94, 0x47, 0x4f, 0x7d, 0x88, 0x71, 0xba, 0xab, 0x71, 0xb5,
+	0xbb, 0x91, 0xd4, 0xfc, 0x9b, 0x12, 0xcc, 0x64, 0x88, 0x8e, 0x13, 0xb6, 0xf6, 0xaa, 0xbe, 0x78,
+	0x4a, 0xf1, 0xed, 0xbc, 0x5c, 0x32, 0xef, 0xcb, 0xd4, 0x46, 0xc7, 0x2c, 0x95, 0xe3, 0xf2, 0x1d,
+	0x7d, 0x16, 0xdb, 0xbb, 0xea, 0x40, 0x33, 0xf2, 0xd4, 0x1c, 0x68, 0xea, 0x30, 0x21, 0x5a, 0x25,
+	0x96, 0xf2, 0x68, 0x62, 0xa2, 0x07, 0xbc, 0xc0, 0xee, 0x5b, 0xd2, 0x3a, 0x09, 0xe7, 0x11, 0xfa,
+	0xad, 0x47, 0x54, 0xf0, 0x18, 0x53, 0x79, 0x60, 0x41, 0x26, 0x0f, 0x85, 0x84, 0xfc, 0x13, 0x03,
+	0x88, 0x80, 0xa8, 0xeb, 0xb9, 0x78, 0xdc, 0x7a, 0x76, 0x9f, 0xce, 0x7a, 0x7e, 0x51, 0xd6, 0x31,
+	0x7b, 0x5d, 0x67, 0x54, 0x8b, 0xfc, 0x23, 0x03, 0xa6, 0xb9, 0x17, 0x87, 0x5a, 0xd9, 0xd2, 0x71,
+	0x95, 0x6d, 0x3e, 0x9d, 0xca, 0x5e, 0x0e, 0xf1, 0xb3, 0x03, 0xea, 0xda, 0x5f, 0x29, 0xf2, 0x53,
+	0x00, 0xf1, 0x8a, 0x92, 0xde, 0x82, 0x97, 0x33, 0xa4, 0x40, 0x8c, 0x94, 0x04, 0x3c, 0x46, 0x31,
+	0x9d, 0xea, 0x5f, 0x93, 0x70, 0x23, 0xbf, 0x08, 0x67, 0xd9, 0x7a, 0x89, 0x21, 0xc2, 0xe7, 0x6c,
+	0x76, 0x1c, 0xbf, 0xf2, 0xc5, 0xc1, 0x5b, 0xfb, 0x8d, 0x2c, 0x32, 0x1e, 0xb3, 0x91, 0x84, 0xbf,
+	0x47, 0x6d, 0xd5, 0xe4, 0xcb, 0xa2, 0x40, 0xe7, 0x52, 0xac, 0x7d, 0x38, 0x5b, 0xc6, 0x6f, 0x66,
+	0xca, 0xb7, 0x8b, 0x72, 0x2d, 0x70, 0xf9, 0x16, 0xea, 0x41, 0x17, 0x08, 0x22, 0x1f, 0x01, 0x69,
+	0xf4, 0x76, 0x77, 0x69, 0x18, 0x51, 0x97, 0xc3, 0x68, 0x10, 0xce, 0x4e, 0xa0, 0x7c, 0xc0, 0x23,
+	0xa3, 0x50, 0x96, 0xda, 0x81, 0x2c, 0x56, 0x27, 0x49, 0x3f, 0xf1, 0xa5, 0x1d, 0xb8, 0x38, 0xb0,
+	0x99, 0x19, 0x01, 0x15, 0x73, 0x7a, 0x40, 0xc5, 0xc5, 0x41, 0xe2, 0x30, 0x54, 0x83, 0x2a, 0x7e,
+	0xcf, 0x48, 0xc9, 0x3f, 0xa1, 0xac, 0xf0, 0x2c, 0x70, 0x83, 0x36, 0x88, 0x1c, 0x06, 0xc6, 0x73,
+	0x09, 0x99, 0x4b, 0x94, 0x24, 0x26, 0x21, 0x55, 0x09, 0x8b, 0xb2, 0xf2, 0x53, 0x8a, 0x42, 0xf3,
+	0x9f, 0x1b, 0x40, 0x78, 0x0d, 0x17, 0x9c, 0xae, 0xb3, 0xe3, 0xb5, 0xbc, 0xc8, 0xa3, 0x21, 0xb9,
+	0x0f, 0x15, 0xc1, 0xc2, 0xd9, 0x69, 0x51, 0xd5, 0x57, 0x4a, 0x5c, 0xa6, 0xc6, 0x65, 0x76, 0x5a,
+	0xad, 0xe9, 0x23, 0x1c, 0x30, 0x78, 0xb9, 0x4f, 0x31, 0x78, 0xe6, 0x0f, 0x0d, 0xb8, 0xd8, 0x5f,
+	0x6d, 0xf1, 0xe5, 0xb8, 0xf3, 0x8c, 0x13, 0x3a, 0x2f, 0xab, 0x95, 0x39, 0x3c, 0x86, 0x7c, 0x6a,
+	0xad, 0xcc, 0x27, 0xa7, 0x9a, 0xa7, 0x6f, 0xe5, 0xaf, 0xe6, 0xa0, 0xbc, 0xde, 0xea, 0xed, 0x7a,
+	0x9d, 0x45, 0x27, 0x72, 0x9e, 0x59, 0x93, 0xe2, 0x6d, 0xcd, 0xa4, 0x88, 0xbd, 0xa3, 0xe2, 0x86,
+	0x0d, 0x97, 0x91, 0xcb, 0x80, 0xa9, 0x84, 0x84, 0xaf, 0xd2, 0x7b, 0x50, 0x60, 0x3f, 0x84, 0x86,
+	0x72, 0xa5, 0x8f, 0x31, 0x62, 0xdd, 0x88, 0xff, 0x13, 0x4a, 0xbe, 0x9e, 0x07, 0x0d, 0x39, 0x5c,
+	0xfa, 0x09, 0x9e, 0xc6, 0xe8, 0xf4, 0x29, 0x17, 0xff, 0x99, 0x01, 0x95, 0x74, 0x4b, 0xc8, 0x7d,
+	0x18, 0x63, 0x9c, 0xbc, 0x38, 0x25, 0xd2, 0x2b, 0x03, 0xda, 0x7c, 0x43, 0xa0, 0xf1, 0xea, 0x61,
+	0xe7, 0x53, 0x0e, 0xb1, 0x24, 0x87, 0x4b, 0x16, 0x94, 0x55, 0xac, 0x8c, 0xda, 0xbd, 0xa1, 0x8b,
+	0xa6, 0xf3, 0xd9, 0xfd, 0xa0, 0xd6, 0xfa, 0x77, 0xb5, 0x5a, 0x0b, 0xa1, 0x34, 0x6c, 0x6e, 0x3b,
+	0x0c, 0x0f, 0xe3, 0x19, 0x3c, 0xd4, 0x79, 0x26, 0x93, 0x7d, 0xe8, 0xe1, 0x61, 0x1c, 0xc6, 0x6c,
+	0x11, 0xfe, 0x3d, 0x31, 0xcf, 0xd0, 0x16, 0xe9, 0x22, 0x44, 0xd5, 0x67, 0x39, 0x8e, 0xf9, 0xf7,
+	0xf2, 0x70, 0x3e, 0xa9, 0x1e, 0xcf, 0xf4, 0xb7, 0xee, 0x04, 0x4e, 0x3b, 0x3c, 0x61, 0x05, 0x5c,
+	0xed, 0xab, 0x1a, 0x86, 0x3f, 0xcb, 0xaa, 0x29, 0x15, 0x32, 0x53, 0x15, 0x42, 0x23, 0x8e, 0x57,
+	0x48, 0x56, 0x83, 0xdc, 0x87, 0x7c, 0x83, 0x46, 0x22, 0x48, 0xf2, 0xb5, 0xbe, 0x5e, 0x55, 0xeb,
+	0x75, 0xa3, 0x41, 0x23, 0x3e, 0x88, 0xdc, 0xcf, 0x9c, 0x6a, 0x7e, 0xdf, 0x4c, 0x1d, 0xdf, 0x86,
+	0xd1, 0xa5, 0x27, 0x5d, 0xda, 0x8c, 0x44, 0x6c, 0xe4, 0xb5, 0xe3, 0xf9, 0x71, 0x5c, 0x25, 0x02,
+	0x93, 0x22, 0x40, 0xed, 0x2c, 0x8e, 0x72, 0xe9, 0x36, 0x14, 0xe5, 0xc7, 0x4f, 0x15, 0x49, 0xf8,
+	0x36, 0x8c, 0x2b, 0x1f, 0x39, 0xd5, 0xa4, 0xff, 0x1b, 0x03, 0x46, 0x99, 0xd0, 0xdb, 0x7a, 0xeb,
+	0x19, 0x95, 0x48, 0xb7, 0x34, 0x89, 0x34, 0xad, 0x84, 0xbc, 0xe0, 0xba, 0x7c, 0xeb, 0x04, 0x59,
+	0x74, 0x68, 0x00, 0x24, 0xc8, 0xe4, 0x2e, 0x8c, 0xf1, 0x8b, 0x1c, 0x99, 0x46, 0x53, 0x8d, 0xa1,
+	0x11, 0x25, 0x89, 0x96, 0xe3, 0x77, 0xd3, 0x6a, 0xa1, 0xa4, 0x26, 0x8b, 0x89, 0x9f, 0xb1, 0x1a,
+	0xb4, 0xc9, 0xd8, 0x2c, 0xf8, 0x1d, 0x1e, 0x53, 0x11, 0x2a, 0xe9, 0xa6, 0xb2, 0x1d, 0x8e, 0x6b,
+	0xe2, 0x60, 0x23, 0x7f, 0x1c, 0x93, 0xf3, 0x82, 0x49, 0xf6, 0x99, 0xc7, 0xb7, 0xc7, 0x79, 0x94,
+	0x82, 0xac, 0xd8, 0x7b, 0x50, 0xbe, 0xe3, 0x07, 0x8f, 0x9d, 0xc0, 0xad, 0xed, 0x52, 0xe1, 0x21,
+	0x5e, 0x44, 0x37, 0xef, 0x89, 0x87, 0x1c, 0x6e, 0x3b, 0xac, 0xe0, 0x47, 0x87, 0xd5, 0x42, 0xdd,
+	0xf7, 0x5b, 0x96, 0x86, 0x4e, 0xd6, 0x60, 0xe2, 0x81, 0xf3, 0x44, 0xdc, 0xd7, 0x6d, 0x6c, 0xac,
+	0x08, 0x3f, 0x93, 0x6b, 0x47, 0x87, 0xd5, 0x8b, 0x6d, 0xe7, 0x49, 0x7c, 0xcf, 0x37, 0xd8, 0x15,
+	0x5a, 0xa7, 0x27, 0x1e, 0x4c, 0xae, 0xfb, 0x41, 0x24, 0x3e, 0xc2, 0x74, 0xda, 0xfc, 0x80, 0xeb,
+	0xb6, 0xb9, 0xcc, 0xeb, 0xb6, 0x8b, 0x4c, 0x91, 0xb7, 0x1f, 0xc6, 0xe4, 0x5a, 0x68, 0x9d, 0xc6,
+	0x98, 0xbc, 0x07, 0xd3, 0x0b, 0x34, 0x88, 0xbc, 0x87, 0x5e, 0xd3, 0x89, 0xe8, 0x1d, 0x3f, 0x68,
+	0x3b, 0x91, 0x38, 0x50, 0x41, 0x83, 0xba, 0x49, 0x39, 0xa7, 0xb6, 0x13, 0x59, 0xfd, 0x98, 0xe4,
+	0x6b, 0x59, 0x9e, 0x3b, 0x23, 0xd8, 0xfc, 0x37, 0x99, 0x52, 0x90, 0xe1, 0xb9, 0x33, 0xa0, 0x0b,
+	0x32, 0x7c, 0x78, 0x76, 0x8f, 0xbb, 0xf6, 0x2c, 0xd6, 0x6f, 0x8a, 0x2b, 0xd8, 0x93, 0xaf, 0x35,
+	0xe3, 0x71, 0x1b, 0x70, 0xbd, 0x39, 0x0f, 0xf9, 0xfa, 0xfa, 0x1d, 0x3c, 0x22, 0x11, 0xd7, 0x8c,
+	0xb4, 0xb3, 0xe7, 0x74, 0x9a, 0xa8, 0xcb, 0x08, 0xdf, 0x05, 0x55, 0xe0, 0xd5, 0xd7, 0xef, 0x10,
+	0x07, 0x66, 0xd6, 0x69, 0xd0, 0xf6, 0xa2, 0xaf, 0xdc, 0xbc, 0xa9, 0x0c, 0x54, 0x11, 0xab, 0x36,
+	0x27, 0xaa, 0x56, 0xed, 0x22, 0x8a, 0xfd, 0xe4, 0xe6, 0xcd, 0xcc, 0xe1, 0x88, 0x2b, 0x96, 0xc5,
+	0x8b, 0x2c, 0xc1, 0xe4, 0x03, 0xe7, 0x89, 0xb8, 0x90, 0x8e, 0x6d, 0xbc, 0x3c, 0x7a, 0xc6, 0xe3,
+	0xc4, 0x6a, 0x26, 0x45, 0xea, 0x10, 0xeb, 0x44, 0xe4, 0x5d, 0x18, 0x4f, 0xa6, 0x57, 0x88, 0x57,
+	0x91, 0x79, 0xee, 0x12, 0xa9, 0x4c, 0x4e, 0xed, 0x2c, 0x49, 0x41, 0x27, 0x9b, 0xb1, 0x89, 0xce,
+	0x15, 0x52, 0x74, 0x14, 0x2c, 0xd5, 0xe7, 0x54, 0x13, 0xdd, 0xc1, 0x12, 0xad, 0x59, 0x53, 0xb1,
+	0x8a, 0xce, 0x3d, 0x65, 0x2c, 0x9d, 0x8b, 0x62, 0xf9, 0xaf, 0x07, 0x7e, 0xbb, 0x1b, 0xa1, 0xc7,
+	0x60, 0xca, 0xf2, 0xef, 0x62, 0x49, 0x86, 0xe5, 0xcf, 0x49, 0xb2, 0xef, 0xd9, 0x27, 0x3e, 0xc5,
+	0x3d, 0x3b, 0x85, 0xc2, 0x8a, 0xdf, 0xdc, 0x47, 0x17, 0xc1, 0x52, 0xfd, 0x23, 0x26, 0x3f, 0x5a,
+	0x7e, 0x73, 0xff, 0xe9, 0xdd, 0x0f, 0x23, 0x7b, 0xb2, 0xca, 0xda, 0xce, 0xa6, 0x95, 0xf8, 0xf4,
+	0xec, 0x94, 0x76, 0xd3, 0xa6, 0x95, 0x71, 0x45, 0x85, 0xcf, 0x42, 0xd9, 0x10, 0x4b, 0x27, 0x27,
+	0x14, 0x2a, 0x8b, 0x34, 0xdc, 0x8f, 0xfc, 0xee, 0x42, 0xcb, 0xeb, 0xee, 0xf8, 0x4e, 0xe0, 0xce,
+	0x56, 0x06, 0x08, 0x8c, 0xd7, 0x33, 0x05, 0xc6, 0xb4, 0xcb, 0xe9, 0xed, 0xa6, 0x64, 0x60, 0xf5,
+	0xb1, 0x24, 0x5f, 0x83, 0x49, 0xb6, 0x5a, 0x96, 0x9e, 0x44, 0xb4, 0xc3, 0xa7, 0xd2, 0x34, 0x6e,
+	0xf5, 0x67, 0x95, 0x20, 0xc3, 0xb8, 0x90, 0x4f, 0x52, 0x94, 0x1e, 0x34, 0x26, 0x50, 0x27, 0xa9,
+	0xce, 0xca, 0xfc, 0xa9, 0x54, 0x9f, 0x90, 0x65, 0x18, 0x13, 0x35, 0x10, 0xbb, 0x4e, 0x7f, 0x5b,
+	0x5e, 0xcc, 0x6c, 0xcb, 0x98, 0x68, 0x8b, 0x25, 0xe9, 0xcd, 0x7f, 0x63, 0xc0, 0x84, 0xf6, 0x39,
+	0x72, 0x5b, 0x71, 0x5f, 0x49, 0xdc, 0xce, 0x34, 0x9c, 0xcc, 0xf4, 0xf4, 0xb7, 0x85, 0xcf, 0x52,
+	0x6e, 0x30, 0x5d, 0x66, 0xe6, 0x30, 0x19, 0xf4, 0x9f, 0x3f, 0x3e, 0xe8, 0xbf, 0x30, 0x20, 0xe8,
+	0xff, 0xdb, 0x13, 0x30, 0xa9, 0x6f, 0x70, 0x4c, 0xe3, 0x5c, 0xf1, 0x77, 0xbd, 0x8e, 0xb4, 0x5b,
+	0x79, 0x1a, 0x0b, 0x84, 0x68, 0xb9, 0xde, 0x11, 0x42, 0x5e, 0x05, 0x88, 0xaf, 0x66, 0xa5, 0x69,
+	0x2a, 0x32, 0xd3, 0x2b, 0x05, 0xe4, 0xa7, 0x01, 0x56, 0x7d, 0x97, 0xc6, 0x99, 0x50, 0x8e, 0x39,
+	0x50, 0x7a, 0x5d, 0x1c, 0x28, 0x89, 0x6c, 0xf2, 0x47, 0x87, 0xd5, 0x73, 0x1d, 0xdf, 0xa5, 0xfd,
+	0x29, 0x50, 0x14, 0x8e, 0xe4, 0x4b, 0x30, 0x62, 0xf5, 0x5a, 0x54, 0x26, 0xe6, 0x18, 0x97, 0x13,
+	0xbe, 0xd7, 0x52, 0xb2, 0x4c, 0x06, 0xbd, 0xf4, 0x3d, 0x02, 0x03, 0x90, 0x0f, 0x00, 0xee, 0xf7,
+	0x76, 0xe8, 0xdd, 0xc0, 0xef, 0x75, 0x65, 0xe4, 0x2f, 0x9a, 0xb1, 0xfb, 0x71, 0x1a, 0x27, 0x7b,
+	0x17, 0x0b, 0xd5, 0x8f, 0x27, 0x24, 0x64, 0x0d, 0xc6, 0x84, 0xf8, 0x10, 0xe7, 0xf4, 0x2f, 0x65,
+	0x9d, 0x10, 0x29, 0x3a, 0x84, 0xc8, 0x94, 0x81, 0x60, 0xfd, 0xd0, 0x86, 0x9b, 0xe1, 0xef, 0x42,
+	0x89, 0xb1, 0x67, 0xa6, 0x76, 0x28, 0xf6, 0x0e, 0xf4, 0x1f, 0x54, 0x2a, 0xc4, 0xcc, 0x72, 0x2d,
+	0x5f, 0x57, 0x4c, 0x40, 0xbe, 0x86, 0xb9, 0x6d, 0x44, 0x57, 0x1f, 0x7b, 0xd0, 0xf8, 0x5a, 0x5f,
+	0x57, 0x9f, 0x75, 0xba, 0xdd, 0x8c, 0x64, 0x60, 0x31, 0x3f, 0xb2, 0x1b, 0xc7, 0xd8, 0xc4, 0xa9,
+	0x86, 0x8f, 0xf9, 0xc0, 0xf5, 0xbe, 0x0f, 0xcc, 0xca, 0xb0, 0x91, 0xfe, 0x8c, 0x36, 0x1a, 0x5f,
+	0xd2, 0x85, 0x4a, 0x92, 0x46, 0x4b, 0x7c, 0x0b, 0x8e, 0xfb, 0xd6, 0x9b, 0x7d, 0xdf, 0x52, 0x07,
+	0xb0, 0xef, 0x73, 0x7d, 0xdc, 0x89, 0x9b, 0xa4, 0x85, 0x15, 0xdf, 0x1b, 0x3f, 0xee, 0x7b, 0xaf,
+	0xf6, 0x7d, 0x6f, 0xc6, 0xdd, 0xe9, 0xff, 0x4e, 0x8a, 0x27, 0x79, 0x17, 0x26, 0x24, 0x04, 0xd7,
+	0x07, 0x1e, 0xf0, 0x09, 0xfd, 0xde, 0xdd, 0x41, 0xa7, 0x31, 0x3d, 0x9d, 0x8b, 0x8a, 0xac, 0x52,
+	0xf3, 0xd9, 0x31, 0xa1, 0x51, 0xa7, 0x67, 0x85, 0x8e, 0x4c, 0xbe, 0x0a, 0xe3, 0xcb, 0x6d, 0xd6,
+	0x10, 0xbf, 0xe3, 0x44, 0x14, 0x37, 0xa3, 0xe4, 0xd0, 0x54, 0x29, 0x51, 0xa6, 0x2a, 0xcf, 0xf1,
+	0x98, 0x14, 0xa9, 0x9b, 0xb9, 0x42, 0xc1, 0x3a, 0x8f, 0x1f, 0xbf, 0x88, 0x39, 0x1c, 0x8a, 0xad,
+	0xe7, 0xc5, 0x8c, 0x83, 0x4b, 0x85, 0x3d, 0xca, 0x72, 0x7e, 0xaa, 0x63, 0x8b, 0x05, 0xa1, 0x75,
+	0x9e, 0xce, 0x93, 0xbc, 0x07, 0xe3, 0x22, 0xa2, 0xb1, 0x66, 0xad, 0x86, 0xb3, 0x15, 0x6c, 0x3c,
+	0xe6, 0x62, 0x93, 0xc1, 0x8f, 0xb6, 0x13, 0xa4, 0x6e, 0xaf, 0x12, 0x7c, 0xf2, 0x15, 0x38, 0xbb,
+	0xed, 0x75, 0x5c, 0xff, 0x71, 0x28, 0x04, 0xb8, 0x10, 0x74, 0xd3, 0x89, 0x8f, 0xce, 0x63, 0x5e,
+	0x6e, 0xcb, 0x6d, 0xab, 0x4f, 0xf0, 0x65, 0x72, 0x20, 0xbf, 0xd0, 0xc7, 0x99, 0xcf, 0x20, 0x72,
+	0xdc, 0x0c, 0x9a, 0xef, 0x9b, 0x41, 0xfd, 0x9f, 0x4f, 0x4f, 0xa7, 0xcc, 0xcf, 0x10, 0x1f, 0x88,
+	0xae, 0x73, 0x7c, 0xe8, 0x7b, 0x9d, 0xd9, 0x19, 0xed, 0x21, 0x8f, 0xd8, 0x65, 0x16, 0xf1, 0xd6,
+	0xfd, 0x96, 0xd7, 0x3c, 0xa8, 0x9b, 0x47, 0x87, 0xd5, 0x97, 0xd2, 0xda, 0xcc, 0xc7, 0xbe, 0x76,
+	0xb8, 0x90, 0xc1, 0x9a, 0x7c, 0x15, 0xca, 0xec, 0x6f, 0xac, 0xfa, 0x9d, 0xd5, 0xae, 0xba, 0x14,
+	0x4c, 0xf1, 0x1d, 0x1c, 0x23, 0x0c, 0xb9, 0xcc, 0xd0, 0x0a, 0x35, 0x56, 0xe6, 0x0f, 0x0d, 0x38,
+	0x9b, 0x55, 0xd7, 0x13, 0xf2, 0xdb, 0x98, 0xa9, 0x4b, 0x6f, 0x3c, 0x97, 0xe0, 0x97, 0xde, 0xf1,
+	0x55, 0x77, 0x15, 0x46, 0x98, 0xad, 0x2c, 0x9d, 0xb2, 0x70, 0x3b, 0x64, 0xf6, 0x74, 0x68, 0x71,
+	0x38, 0x43, 0x40, 0x67, 0x7a, 0xdc, 0x2f, 0x47, 0x38, 0x02, 0x7a, 0xdc, 0x5b, 0x1c, 0xce, 0x10,
+	0xd8, 0xb6, 0x2b, 0xb7, 0x09, 0x44, 0x60, 0xbb, 0x71, 0x68, 0x71, 0x38, 0x79, 0x0d, 0xc6, 0xd6,
+	0x3a, 0x2b, 0xd4, 0x79, 0x44, 0xc5, 0x8d, 0x13, 0x9e, 0xa3, 0xf8, 0x1d, 0xbb, 0xc5, 0x60, 0x96,
+	0x2c, 0x34, 0xbf, 0x6b, 0xc0, 0x74, 0x5f, 0x37, 0x9d, 0x9c, 0xc2, 0xe7, 0xf8, 0xeb, 0xbd, 0x61,
+	0xda, 0xc7, 0xab, 0x5f, 0xc8, 0xae, 0xbe, 0xf9, 0x57, 0x79, 0xb8, 0x30, 0x60, 0xd7, 0x4a, 0xae,
+	0xe6, 0x8d, 0x13, 0xaf, 0xe6, 0xbf, 0xce, 0x76, 0x09, 0xc7, 0x6b, 0x87, 0x1b, 0x7e, 0x52, 0xe3,
+	0xe4, 0x16, 0x03, 0xcb, 0x64, 0x8e, 0x0c, 0x99, 0xcf, 0xe1, 0x62, 0x13, 0x29, 0xec, 0xc8, 0xef,
+	0x3b, 0x33, 0xd6, 0x99, 0xf5, 0x5d, 0x8e, 0xe7, 0x7f, 0x4c, 0x2e, 0xc7, 0xf5, 0x2b, 0xa9, 0xc2,
+	0x53, 0xbd, 0x92, 0xca, 0x3e, 0x24, 0x1f, 0xf9, 0x34, 0x57, 0x01, 0xff, 0x2e, 0x75, 0x1d, 0xff,
+	0xe3, 0x38, 0xd4, 0xd7, 0x60, 0x64, 0x7b, 0x8f, 0x06, 0x52, 0xbf, 0xc5, 0x8a, 0x3c, 0x66, 0x00,
+	0xb5, 0x22, 0x88, 0x61, 0xfe, 0x3c, 0x94, 0xd5, 0x8f, 0xe1, 0x5a, 0x66, 0xbf, 0xc5, 0x62, 0xe2,
+	0x6b, 0x99, 0x01, 0x2c, 0x0e, 0x3f, 0x31, 0x23, 0x56, 0xd2, 0x0b, 0xf9, 0x93, 0x7a, 0xc1, 0xfc,
+	0xb7, 0x06, 0x14, 0x30, 0x21, 0xc0, 0x5b, 0x50, 0x92, 0x47, 0xa5, 0x6a, 0x90, 0xfc, 0x8c, 0x3c,
+	0x49, 0x0d, 0x75, 0x7f, 0x06, 0x01, 0x64, 0x9f, 0xda, 0xa2, 0xc1, 0x8e, 0xe6, 0xf6, 0xf2, 0x88,
+	0x01, 0xd4, 0x4f, 0x21, 0xc6, 0x29, 0xba, 0x04, 0x5d, 0x7b, 0x84, 0x7d, 0xcf, 0x17, 0x3c, 0x77,
+	0xed, 0xe9, 0xb3, 0xeb, 0x25, 0x96, 0xf9, 0xdb, 0x06, 0x9c, 0xcb, 0xd4, 0x03, 0xd8, 0x57, 0xb9,
+	0xc2, 0xa1, 0xcc, 0x88, 0xb4, 0xb6, 0xc1, 0x31, 0x4e, 0xe3, 0xc2, 0x73, 0x8a, 0xe1, 0xfd, 0x1c,
+	0x94, 0x62, 0xfb, 0x8c, 0x9c, 0x95, 0x43, 0x87, 0xe7, 0x69, 0xd2, 0x98, 0xf9, 0x1b, 0x03, 0x46,
+	0x59, 0x15, 0x9e, 0xd9, 0xe8, 0x8a, 0xec, 0xd3, 0x55, 0xd6, 0xa4, 0xa1, 0x62, 0x2a, 0xfe, 0x60,
+	0x14, 0x20, 0x41, 0x26, 0x3b, 0x30, 0xb9, 0xb6, 0xbc, 0xb8, 0xb0, 0xec, 0xd2, 0x4e, 0x84, 0xb7,
+	0x7c, 0xa9, 0x28, 0x7b, 0x66, 0x58, 0x06, 0x1d, 0xa7, 0x25, 0x10, 0x0e, 0x92, 0xe5, 0xe9, 0x7b,
+	0x6e, 0xd3, 0xf6, 0x62, 0x3a, 0x55, 0x21, 0xd3, 0x39, 0xb2, 0x6f, 0x34, 0x6a, 0x0f, 0x56, 0x94,
+	0x6f, 0xe4, 0x86, 0xfc, 0x46, 0xe8, 0xb4, 0x5b, 0x03, 0xbe, 0xa1, 0x73, 0x24, 0x7b, 0x50, 0xb9,
+	0x8b, 0xb2, 0x5b, 0xf9, 0x4a, 0xfe, 0xf8, 0xaf, 0xbc, 0x2c, 0xbe, 0xf2, 0x02, 0x17, 0xfa, 0xd9,
+	0xdf, 0xe9, 0xe3, 0x9a, 0xcc, 0xdc, 0xc2, 0x89, 0x33, 0xf7, 0x6f, 0x1b, 0x30, 0xca, 0x37, 0x87,
+	0xf8, 0x2d, 0x8b, 0xcc, 0xed, 0x67, 0xfb, 0xe9, 0x6c, 0x3f, 0x95, 0x08, 0xff, 0x53, 0x0d, 0x70,
+	0x5e, 0x46, 0x16, 0x53, 0x0f, 0x63, 0xc8, 0x23, 0x74, 0x54, 0x4c, 0x79, 0x49, 0xe2, 0x08, 0xc5,
+	0xdf, 0xc4, 0x50, 0xb9, 0x70, 0x0c, 0xf5, 0x99, 0xbe, 0xb1, 0x4f, 0xf9, 0x4c, 0xdf, 0x0a, 0x94,
+	0x84, 0x67, 0x4f, 0xfd, 0x40, 0x98, 0x9f, 0xf2, 0x80, 0x25, 0x86, 0x2b, 0xc9, 0xa7, 0x39, 0xc8,
+	0xde, 0xd1, 0x52, 0xc7, 0xc5, 0x88, 0x64, 0x0d, 0x4a, 0x49, 0x68, 0x48, 0x49, 0xbb, 0x07, 0x8d,
+	0xe1, 0xc2, 0xf5, 0x95, 0x47, 0x1f, 0x66, 0x46, 0x82, 0x24, 0x3c, 0xcc, 0x6f, 0x1a, 0x50, 0x49,
+	0xcf, 0x17, 0xf2, 0x2e, 0x8c, 0xc7, 0xd1, 0x39, 0xb1, 0x7f, 0x01, 0x1e, 0x64, 0x26, 0xe1, 0x3c,
+	0x9a, 0xa7, 0x81, 0x8a, 0x4e, 0xe6, 0xa1, 0xc8, 0x96, 0x9d, 0x92, 0x3b, 0x18, 0xe5, 0x49, 0x4f,
+	0xc0, 0xd4, 0x7b, 0x3d, 0x89, 0xa7, 0xac, 0xda, 0xff, 0x90, 0x87, 0x71, 0x65, 0xb0, 0xc8, 0x35,
+	0x28, 0x2e, 0x87, 0x2b, 0x7e, 0x73, 0x9f, 0xba, 0xe2, 0xba, 0x00, 0x5f, 0x61, 0xf4, 0x42, 0xbb,
+	0x85, 0x40, 0x2b, 0x2e, 0x26, 0x75, 0x98, 0xe0, 0xff, 0xc9, 0x28, 0xcc, 0x5c, 0x72, 0xd4, 0xc9,
+	0x91, 0x65, 0xfc, 0xa5, 0xba, 0xc3, 0x6a, 0x24, 0xe4, 0x1b, 0x00, 0x1c, 0xc0, 0xc6, 0x77, 0x08,
+	0xc7, 0x5e, 0xb9, 0x80, 0xcf, 0x89, 0x0f, 0x44, 0x9e, 0xda, 0x42, 0x9c, 0x0a, 0x0a, 0x43, 0x7c,
+	0x01, 0xce, 0x6f, 0xee, 0x0f, 0xff, 0x06, 0x64, 0xf2, 0x02, 0x9c, 0xdf, 0xdc, 0xb7, 0xb3, 0xbd,
+	0xbc, 0x54, 0x96, 0xe4, 0x5b, 0x06, 0x5c, 0xb2, 0x68, 0xd3, 0x7f, 0x44, 0x83, 0x83, 0x5a, 0x84,
+	0x58, 0xea, 0x17, 0x4f, 0x76, 0x29, 0xbb, 0x25, 0xbe, 0xf8, 0x7a, 0x20, 0xb8, 0x60, 0x38, 0x4a,
+	0xbb, 0x1b, 0xd9, 0xc7, 0x54, 0xe1, 0x98, 0x4f, 0x9a, 0x7f, 0x6e, 0x28, 0x4b, 0x80, 0xac, 0x42,
+	0x29, 0x9e, 0x2c, 0xe2, 0xc0, 0x31, 0x56, 0x8e, 0x24, 0xdc, 0xa2, 0x0f, 0xeb, 0x2f, 0x88, 0x93,
+	0xfd, 0x99, 0x78, 0xca, 0x69, 0x2b, 0x42, 0x02, 0xc9, 0x97, 0xa1, 0x80, 0x43, 0x75, 0x72, 0xb2,
+	0x29, 0xb9, 0xd5, 0x14, 0xd8, 0x18, 0x61, 0xad, 0x91, 0x92, 0x7c, 0x41, 0x78, 0x79, 0xe4, 0xb5,
+	0x34, 0xae, 0x0c, 0xc4, 0xea, 0x11, 0xef, 0x31, 0x89, 0x63, 0xa1, 0x32, 0x5b, 0xff, 0x4e, 0x0e,
+	0x2a, 0xe9, 0x85, 0x47, 0x3e, 0x80, 0xf2, 0xba, 0x13, 0x86, 0x8f, 0xfd, 0xc0, 0xbd, 0xe7, 0x84,
+	0x7b, 0x22, 0x35, 0x24, 0xda, 0x7c, 0x5d, 0x01, 0xb7, 0xf7, 0x1c, 0x2d, 0x85, 0x98, 0x46, 0xc0,
+	0x36, 0xe4, 0x0d, 0xe1, 0xaf, 0xae, 0x2c, 0xa0, 0xc8, 0x8f, 0xba, 0xa9, 0xd4, 0x90, 0x12, 0x8d,
+	0xbc, 0x05, 0x79, 0x1e, 0xfb, 0xa6, 0xe6, 0x15, 0x7a, 0x70, 0xa7, 0xc6, 0xc3, 0x85, 0xf8, 0x65,
+	0xb2, 0x7e, 0x2a, 0xcf, 0xf0, 0xc9, 0x8a, 0x12, 0x39, 0x35, 0xaa, 0xe5, 0x57, 0x91, 0xe0, 0xb8,
+	0x71, 0x27, 0x87, 0x50, 0x7d, 0x58, 0x28, 0xe6, 0x2b, 0x05, 0x11, 0x9f, 0xf3, 0x47, 0x79, 0x28,
+	0xc5, 0xdf, 0x27, 0x04, 0x50, 0xdf, 0x10, 0xb7, 0xc2, 0xf8, 0x3f, 0xb9, 0x08, 0x45, 0xa9, 0x62,
+	0x88, 0x9b, 0xe1, 0xb1, 0x50, 0xa8, 0x17, 0xb3, 0x20, 0x75, 0x09, 0xae, 0x5e, 0x58, 0xf2, 0x27,
+	0xb9, 0x09, 0xb1, 0xa2, 0x30, 0x48, 0xa3, 0x28, 0xb0, 0x01, 0xb3, 0x62, 0x34, 0x32, 0x09, 0x39,
+	0x8f, 0xfb, 0x22, 0x97, 0xac, 0x9c, 0xe7, 0x92, 0x0f, 0xa0, 0xe8, 0xb8, 0x2e, 0x75, 0x6d, 0x27,
+	0x1a, 0xe2, 0x3d, 0xce, 0x22, 0xe3, 0xc6, 0x25, 0x3a, 0x52, 0xd5, 0x22, 0x52, 0x83, 0x12, 0x3e,
+	0xc7, 0xd8, 0x0b, 0x87, 0x7a, 0xc3, 0x31, 0xe1, 0x50, 0x64, 0x64, 0x9b, 0x21, 0x75, 0xc9, 0xeb,
+	0x50, 0x60, 0xa3, 0x29, 0xf6, 0x83, 0x38, 0x5b, 0xdc, 0xda, 0xc6, 0x3a, 0xef, 0xb0, 0x7b, 0x67,
+	0x2c, 0x44, 0x20, 0xaf, 0x40, 0xbe, 0x37, 0xff, 0x50, 0x48, 0xfa, 0x4a, 0x12, 0x16, 0x19, 0xa3,
+	0xb1, 0x62, 0x72, 0x0b, 0x8a, 0x8f, 0xf5, 0x00, 0xb8, 0x73, 0xa9, 0x61, 0x8c, 0xf1, 0x63, 0xc4,
+	0x7a, 0x11, 0x46, 0x79, 0xb8, 0x99, 0xf9, 0x12, 0x40, 0xf2, 0xe9, 0xfe, 0x0b, 0x7c, 0xf3, 0x1b,
+	0x50, 0x8a, 0x3f, 0x49, 0x5e, 0x04, 0xd8, 0xa7, 0x07, 0xf6, 0x9e, 0xd3, 0x71, 0xc5, 0x33, 0x24,
+	0x65, 0xab, 0xb4, 0x4f, 0x0f, 0xee, 0x21, 0x80, 0x5c, 0x80, 0xb1, 0x2e, 0x1b, 0x55, 0x99, 0xd8,
+	0xd4, 0x1a, 0xed, 0xf6, 0x76, 0xd8, 0x0c, 0x9d, 0x85, 0x31, 0x3c, 0x3a, 0x10, 0x0b, 0x6d, 0xc2,
+	0x92, 0x3f, 0xcd, 0xdf, 0xcb, 0x61, 0xc8, 0xbb, 0x52, 0x4f, 0xf2, 0x32, 0x4c, 0x34, 0x03, 0x8a,
+	0xdb, 0x91, 0xc3, 0xd4, 0x22, 0xf1, 0x9d, 0x72, 0x02, 0x5c, 0x76, 0xc9, 0x6b, 0x30, 0x95, 0x64,
+	0x5a, 0xb5, 0x9b, 0x3b, 0x22, 0xfc, 0xb5, 0x6c, 0x4d, 0x74, 0x65, 0xaa, 0xd5, 0x85, 0x1d, 0xf4,
+	0xa1, 0xaf, 0xa8, 0xa1, 0x66, 0x91, 0xcc, 0x9a, 0x5a, 0xb2, 0xa6, 0x14, 0x38, 0x5e, 0x3b, 0x9c,
+	0x87, 0x51, 0xc7, 0xd9, 0xed, 0x79, 0xdc, 0x9f, 0xb7, 0x6c, 0x89, 0x5f, 0xe4, 0xf3, 0x30, 0x1d,
+	0x7a, 0xbb, 0x1d, 0x27, 0xea, 0x05, 0x22, 0xe7, 0x00, 0x0d, 0x70, 0x4a, 0x4d, 0x58, 0x95, 0xb8,
+	0x60, 0x81, 0xc3, 0xc9, 0x9b, 0x40, 0xd4, 0xef, 0xf9, 0x3b, 0x1f, 0xd3, 0x26, 0x9f, 0x6a, 0x65,
+	0x6b, 0x5a, 0x29, 0x59, 0xc3, 0x02, 0xf2, 0x39, 0x28, 0x07, 0x34, 0x44, 0x95, 0x0c, 0xbb, 0x0d,
+	0x33, 0xa9, 0x58, 0xe3, 0x12, 0x76, 0x9f, 0x1e, 0x98, 0x75, 0x98, 0xee, 0x5b, 0x8f, 0xe4, 0x4d,
+	0xae, 0xdd, 0x8b, 0xfd, 0xb9, 0xcc, 0x8d, 0x19, 0x26, 0xa4, 0x52, 0x2f, 0xf8, 0x72, 0x24, 0xb3,
+	0x03, 0x65, 0x55, 0xbe, 0x9e, 0x10, 0x58, 0x7c, 0x1e, 0x1d, 0x0b, 0xb9, 0xf0, 0x19, 0x3d, 0x3a,
+	0xac, 0xe6, 0x3c, 0x17, 0xdd, 0x09, 0xaf, 0x42, 0x51, 0x6a, 0x09, 0xea, 0x33, 0x1c, 0x42, 0xa1,
+	0x3c, 0xb0, 0xe2, 0x52, 0xf3, 0x75, 0x18, 0x13, 0x22, 0xf4, 0xf8, 0x63, 0x1c, 0xf3, 0x97, 0x73,
+	0x30, 0x65, 0x51, 0xb6, 0xc0, 0xc5, 0x03, 0x17, 0xcf, 0x59, 0xce, 0x59, 0xad, 0x6d, 0xc7, 0xc4,
+	0xf1, 0x7f, 0xcf, 0x80, 0x99, 0x0c, 0xdc, 0x4f, 0x94, 0xa4, 0xea, 0x36, 0x94, 0x16, 0x3d, 0xa7,
+	0x55, 0x73, 0xdd, 0xd8, 0x41, 0x12, 0xb5, 0x41, 0x97, 0x2d, 0x27, 0x87, 0x41, 0xd5, 0xcd, 0x34,
+	0x46, 0x25, 0xd7, 0xc5, 0xa4, 0x48, 0xd2, 0xe8, 0xc9, 0xac, 0xb6, 0xc0, 0xeb, 0x94, 0xe4, 0xb4,
+	0xc5, 0x30, 0x34, 0x0e, 0x4c, 0xee, 0xc0, 0x9f, 0xd9, 0xa1, 0xcb, 0x0e, 0x43, 0x4b, 0x37, 0x6f,
+	0x28, 0xb3, 0xf3, 0x9b, 0x39, 0x38, 0x9f, 0x4d, 0xf8, 0x49, 0xf3, 0x8d, 0x61, 0x12, 0x05, 0x25,
+	0x71, 0x30, 0xe6, 0x1b, 0xe3, 0x19, 0x17, 0x10, 0x3f, 0x41, 0x20, 0x0f, 0x61, 0x62, 0xc5, 0x09,
+	0xa3, 0x7b, 0xd4, 0x09, 0xa2, 0x1d, 0xea, 0x44, 0x43, 0x68, 0xb0, 0xf1, 0x3b, 0xb9, 0xb8, 0xa9,
+	0xed, 0x49, 0xca, 0xf4, 0x3b, 0xb9, 0x1a, 0xdb, 0x78, 0xa2, 0x14, 0x86, 0x98, 0x28, 0x3f, 0x0b,
+	0x53, 0x0d, 0xda, 0x76, 0xba, 0x7b, 0x7e, 0x40, 0xc5, 0xc9, 0xf3, 0x0d, 0x98, 0x88, 0x41, 0x99,
+	0xb3, 0x45, 0x2f, 0xd6, 0xf0, 0x95, 0x8e, 0x48, 0x44, 0x89, 0x5e, 0x6c, 0xfe, 0x4e, 0x0e, 0x2e,
+	0xd4, 0x9a, 0xe2, 0x98, 0x5e, 0x14, 0xc8, 0xdb, 0xc4, 0xcf, 0xf8, 0xdb, 0x64, 0x0e, 0x4a, 0x0f,
+	0x9c, 0x27, 0xf8, 0xe0, 0x7b, 0x28, 0xb2, 0xd6, 0x70, 0xf5, 0xcb, 0x79, 0x62, 0xc7, 0xc7, 0x5e,
+	0x56, 0x82, 0xf3, 0x34, 0xdf, 0x84, 0x37, 0x61, 0xf4, 0x9e, 0xdf, 0x72, 0xc5, 0xe6, 0x24, 0x4e,
+	0xfd, 0xf7, 0x10, 0x62, 0x89, 0x12, 0xf3, 0x87, 0x06, 0x4c, 0xc6, 0x35, 0xc6, 0x2a, 0x7c, 0xe6,
+	0x5d, 0x92, 0x7a, 0x1d, 0xbf, 0x34, 0xc4, 0xeb, 0xf8, 0x23, 0x9f, 0xae, 0x27, 0xcc, 0x7f, 0x8c,
+	0x17, 0x0a, 0x6a, 0x2b, 0xd9, 0x4e, 0xa4, 0x54, 0xc4, 0x18, 0xb2, 0x22, 0xb9, 0xa7, 0x36, 0x24,
+	0xf9, 0x81, 0x43, 0xf2, 0x2b, 0x39, 0x18, 0x8f, 0x2b, 0xfb, 0x9c, 0xc5, 0x6f, 0xc7, 0xed, 0x1a,
+	0xca, 0x3b, 0xbb, 0xa1, 0xc8, 0x0a, 0xe1, 0x04, 0xfd, 0x65, 0x18, 0x15, 0x8b, 0xc9, 0x48, 0xdd,
+	0xaa, 0xa5, 0x46, 0x37, 0x79, 0xeb, 0x14, 0x07, 0x34, 0xb4, 0x04, 0x1d, 0xba, 0xbf, 0x6f, 0xd3,
+	0x1d, 0x71, 0xbf, 0xf4, 0xcc, 0xee, 0x51, 0xd9, 0xee, 0xef, 0x49, 0xc3, 0x86, 0xda, 0x9d, 0xfe,
+	0x41, 0x01, 0x2a, 0x69, 0x92, 0x93, 0x23, 0xe4, 0xd7, 0x7b, 0x3b, 0xe2, 0x9d, 0x02, 0x8c, 0x90,
+	0xef, 0xf6, 0x76, 0x2c, 0x06, 0x23, 0xaf, 0x41, 0x61, 0x3d, 0xf0, 0x1e, 0x61, 0xab, 0xc5, 0x33,
+	0x0d, 0xdd, 0xc0, 0x7b, 0xa4, 0xfa, 0x81, 0xb2, 0x72, 0x34, 0x68, 0x57, 0x1a, 0xca, 0x33, 0xd3,
+	0xdc, 0xa0, 0x6d, 0x85, 0xe9, 0xb4, 0x28, 0x12, 0x8d, 0x6d, 0x95, 0x75, 0xea, 0x04, 0x22, 0x9a,
+	0x5b, 0x88, 0x33, 0xdc, 0x2a, 0x77, 0x10, 0xcc, 0x73, 0x9e, 0x5a, 0x2a, 0x12, 0x69, 0x01, 0x51,
+	0x7e, 0xca, 0x05, 0x7c, 0xb2, 0x8d, 0x27, 0x9f, 0x17, 0x3a, 0xab, 0xb2, 0xb6, 0xd5, 0xd5, 0x9c,
+	0xc1, 0xf7, 0x69, 0x9e, 0x11, 0xae, 0x43, 0x09, 0x8f, 0xbc, 0xf0, 0x20, 0xa3, 0x78, 0x22, 0x33,
+	0xe9, 0x73, 0x0b, 0x78, 0x1b, 0x6f, 0xc7, 0xc7, 0x19, 0x09, 0x13, 0xf2, 0x3e, 0x8c, 0xab, 0x8e,
+	0xa2, 0xdc, 0x9d, 0xf1, 0x32, 0x8f, 0x10, 0x1a, 0x90, 0x3e, 0x4c, 0x25, 0x30, 0xbf, 0xa0, 0xce,
+	0x12, 0xb1, 0x69, 0x1f, 0x3b, 0x4b, 0xcc, 0xdf, 0x42, 0x35, 0xbe, 0xed, 0x47, 0x54, 0x68, 0x2f,
+	0xcf, 0xac, 0x1c, 0x4b, 0x8e, 0x90, 0x47, 0x34, 0x8f, 0x10, 0xad, 0x75, 0xa7, 0x78, 0x60, 0xf9,
+	0x0f, 0x0d, 0x38, 0x97, 0x49, 0x4b, 0x6e, 0x00, 0x24, 0x3a, 0xa2, 0xe8, 0x25, 0x9e, 0x4c, 0x36,
+	0x86, 0x5a, 0x0a, 0x06, 0xf9, 0x7a, 0x5a, 0xbb, 0x3b, 0x79, 0x73, 0x92, 0x4f, 0x2e, 0x4c, 0xea,
+	0xda, 0x5d, 0x86, 0x4e, 0x67, 0x7e, 0x2f, 0x0f, 0xd3, 0x7d, 0x4f, 0xf5, 0x9d, 0x70, 0x07, 0xbf,
+	0x9f, 0x7a, 0x08, 0x8a, 0x5f, 0x77, 0x5c, 0x1f, 0xf4, 0x50, 0x60, 0xc6, 0xb3, 0x50, 0x78, 0x2c,
+	0x26, 0xf2, 0x18, 0x9f, 0xf0, 0x3a, 0x54, 0x98, 0xfd, 0x84, 0xd8, 0xe7, 0x07, 0x7e, 0xed, 0x29,
+	0x3c, 0x25, 0xf6, 0x63, 0xfc, 0xd2, 0xd2, 0x6f, 0xe5, 0x60, 0xa6, 0xaf, 0xcd, 0xcf, 0xec, 0xaa,
+	0xfb, 0xb2, 0xb6, 0xbb, 0xbd, 0x34, 0x68, 0x4c, 0x87, 0xd2, 0x22, 0xfe, 0xbb, 0x01, 0x17, 0x06,
+	0x50, 0x92, 0x83, 0xf4, 0x24, 0xe2, 0x5a, 0xc5, 0xcd, 0xe3, 0x3f, 0xf8, 0x54, 0xa6, 0xd2, 0x67,
+	0x36, 0x13, 0x7e, 0x39, 0x07, 0xb0, 0x4d, 0x77, 0x9e, 0xed, 0xf4, 0x3f, 0xd9, 0x6f, 0xe1, 0xcb,
+	0x66, 0x0d, 0x35, 0xee, 0x6b, 0x78, 0x90, 0x38, 0x7c, 0xee, 0x9f, 0xf8, 0x59, 0x89, 0x5c, 0xf6,
+	0xb3, 0x12, 0xe6, 0x0e, 0x9c, 0xbd, 0x4b, 0xa3, 0x64, 0x27, 0x94, 0x36, 0xe4, 0xf1, 0x6c, 0xdf,
+	0x80, 0x92, 0xc0, 0xd7, 0x53, 0x84, 0x4b, 0x87, 0x32, 0xcf, 0xb5, 0x12, 0x04, 0x93, 0xc2, 0x85,
+	0x45, 0xda, 0xa2, 0x11, 0xfd, 0x6c, 0x3f, 0xd3, 0x00, 0xc2, 0x9b, 0xc2, 0x5f, 0x1b, 0x18, 0xea,
+	0x0b, 0x27, 0xf6, 0xcf, 0x16, 0x9c, 0x8b, 0xeb, 0xfe, 0x34, 0xf9, 0xce, 0x31, 0x5d, 0x42, 0xc4,
+	0xda, 0x25, 0x1c, 0x8f, 0x39, 0x44, 0x7c, 0x02, 0x97, 0x24, 0xc1, 0xb6, 0x17, 0xdf, 0xc4, 0x0c,
+	0x45, 0x4b, 0xde, 0x85, 0x71, 0x85, 0x46, 0x04, 0xee, 0xe2, 0x6d, 0xe7, 0x63, 0x2f, 0xda, 0xb3,
+	0x43, 0x0e, 0x57, 0x6f, 0x3b, 0x15, 0x74, 0xf3, 0x6b, 0xf0, 0x42, 0xec, 0xb7, 0x92, 0xf1, 0xe9,
+	0x14, 0x73, 0xe3, 0x74, 0xcc, 0x57, 0x93, 0x66, 0x2d, 0x77, 0x62, 0xff, 0x71, 0xc9, 0x9b, 0xa8,
+	0xcd, 0x12, 0x8d, 0xb9, 0xac, 0xa4, 0x45, 0x13, 0x7b, 0x51, 0x02, 0x30, 0xdf, 0x51, 0x2a, 0x9b,
+	0xc1, 0x50, 0x23, 0x36, 0xd2, 0xc4, 0xbf, 0x9c, 0x83, 0xa9, 0xb5, 0xe5, 0xc5, 0x85, 0xf8, 0x18,
+	0xf9, 0x39, 0xcb, 0x4d, 0xa4, 0xb5, 0x6d, 0xb0, 0xbc, 0x31, 0x37, 0x61, 0x26, 0xd5, 0x0d, 0xf8,
+	0x98, 0xca, 0xfb, 0xdc, 0xbf, 0x24, 0x06, 0xcb, 0x9d, 0xe5, 0x7c, 0x16, 0xfb, 0xad, 0x5b, 0x56,
+	0x0a, 0xdb, 0xfc, 0xde, 0x68, 0x8a, 0xaf, 0x10, 0x61, 0x6f, 0x40, 0x69, 0x39, 0x0c, 0x7b, 0x34,
+	0xd8, 0xb4, 0x56, 0x54, 0x1d, 0xd1, 0x43, 0xa0, 0xdd, 0x0b, 0x5a, 0x56, 0x82, 0x40, 0xae, 0x41,
+	0x51, 0xc4, 0x77, 0x49, 0x99, 0x80, 0xd7, 0xe5, 0x71, 0x78, 0x98, 0x15, 0x17, 0x93, 0xb7, 0xa0,
+	0xcc, 0xff, 0xe7, 0xb3, 0x4d, 0x74, 0x38, 0x9e, 0x55, 0x09, 0x74, 0x3e, 0x3b, 0x2d, 0x0d, 0x8d,
+	0x59, 0x66, 0xf2, 0xb5, 0x46, 0x56, 0xa3, 0x42, 0x62, 0x99, 0xc9, 0x87, 0x1d, 0xb1, 0x4e, 0x2a,
+	0x12, 0xb9, 0x0e, 0xf9, 0xda, 0x82, 0xa5, 0x66, 0x45, 0x76, 0x9a, 0x01, 0xcf, 0x2a, 0xae, 0x3d,
+	0x88, 0x54, 0x5b, 0xb0, 0xc8, 0x3c, 0x14, 0xf1, 0xc1, 0x0b, 0x97, 0x06, 0xc2, 0x67, 0x14, 0x67,
+	0x4d, 0x57, 0xc0, 0xd4, 0x9b, 0x47, 0x89, 0x47, 0xe6, 0x60, 0x6c, 0xd1, 0x0b, 0xbb, 0x2d, 0xe7,
+	0x40, 0x24, 0x25, 0xc1, 0xcb, 0x10, 0x97, 0x83, 0xd4, 0x79, 0x26, 0xb0, 0xc8, 0x35, 0x18, 0x69,
+	0x34, 0xfd, 0x2e, 0xb3, 0xb6, 0x62, 0xd7, 0x96, 0x90, 0x01, 0xb4, 0xcc, 0x06, 0x0c, 0x80, 0x21,
+	0xc7, 0x3c, 0x72, 0xaa, 0xa4, 0x84, 0x1c, 0xa7, 0x23, 0xa6, 0x04, 0x4e, 0xbf, 0xff, 0x1f, 0x3c,
+	0x4d, 0xff, 0xbf, 0x1d, 0xb8, 0x70, 0x17, 0x55, 0xfd, 0x06, 0x0d, 0x30, 0x0f, 0x24, 0x7f, 0x3c,
+	0x67, 0xd3, 0x5a, 0x16, 0xd1, 0x62, 0x57, 0x8f, 0x0e, 0xab, 0xaf, 0x70, 0x6b, 0xc0, 0x0e, 0x39,
+	0x8e, 0x7c, 0x77, 0x27, 0xf5, 0x62, 0xc0, 0x20, 0x46, 0xe4, 0x2b, 0x70, 0x36, 0xab, 0x48, 0xc4,
+	0x8d, 0xa1, 0x57, 0x78, 0xf6, 0x07, 0x54, 0xb7, 0xec, 0x2c, 0x0e, 0x64, 0x05, 0x2a, 0x1c, 0x5e,
+	0x73, 0xdb, 0x5e, 0x67, 0xa9, 0xed, 0x78, 0x2d, 0x8c, 0x22, 0x13, 0xa1, 0x80, 0x82, 0xab, 0xc3,
+	0x0a, 0x6d, 0xca, 0x4a, 0x35, 0xef, 0xa4, 0x14, 0x25, 0x8a, 0xa3, 0x46, 0xed, 0xc1, 0x4a, 0xb2,
+	0xa6, 0x9e, 0xaf, 0x7b, 0x23, 0xad, 0x6d, 0xc7, 0xdc, 0x1b, 0x6d, 0xc2, 0x4c, 0xaa, 0x1b, 0xa4,
+	0x38, 0xd2, 0xc0, 0x69, 0x71, 0x94, 0xa2, 0xb1, 0x52, 0xd8, 0xe6, 0x7f, 0x1c, 0x4d, 0xf1, 0x15,
+	0x67, 0x45, 0x26, 0x8c, 0x72, 0x69, 0xa3, 0x66, 0x2d, 0xe3, 0xb2, 0xc8, 0x12, 0x25, 0xe4, 0x22,
+	0xe4, 0x1b, 0x8d, 0x35, 0x35, 0xa7, 0x62, 0x18, 0xfa, 0x16, 0x83, 0xb1, 0x11, 0xc2, 0x63, 0x20,
+	0x25, 0x40, 0xab, 0x49, 0x83, 0x48, 0x3c, 0xe7, 0xf9, 0x6a, 0xb2, 0x8e, 0x0b, 0x49, 0x7f, 0x8b,
+	0x75, 0x9c, 0xac, 0xde, 0x05, 0x98, 0xad, 0x85, 0x21, 0x0d, 0x22, 0x9e, 0x94, 0x3d, 0xec, 0xb5,
+	0x69, 0x20, 0xe6, 0x9a, 0x90, 0x31, 0xfc, 0x31, 0xf0, 0x66, 0x68, 0x0d, 0x44, 0x24, 0x57, 0xa1,
+	0x58, 0xeb, 0xb9, 0x1e, 0xed, 0x34, 0x35, 0xdf, 0x74, 0x47, 0xc0, 0xac, 0xb8, 0x94, 0x7c, 0x04,
+	0xe7, 0x04, 0x91, 0x14, 0x38, 0xa2, 0x07, 0xb8, 0xac, 0xe1, 0x16, 0xac, 0x58, 0x0b, 0x52, 0x4c,
+	0xd9, 0xa2, 0x4b, 0xb2, 0x29, 0x49, 0x0d, 0x2a, 0x4b, 0x78, 0x4f, 0x2a, 0x1f, 0xf5, 0xf5, 0x03,
+	0x91, 0x7c, 0x17, 0x25, 0x17, 0xbf, 0x43, 0xb5, 0xdd, 0xb8, 0xd0, 0xea, 0x43, 0x27, 0xf7, 0x61,
+	0x26, 0x0d, 0x63, 0xf2, 0xb8, 0x94, 0x3c, 0xba, 0xd5, 0xc7, 0x05, 0x05, 0x73, 0x16, 0x15, 0xd9,
+	0x81, 0xe9, 0x5a, 0x14, 0x05, 0xde, 0x4e, 0x2f, 0xa2, 0x29, 0xd1, 0x25, 0x0f, 0x1a, 0xe3, 0x72,
+	0x29, 0xbe, 0x5e, 0x10, 0x93, 0x71, 0xc6, 0x89, 0x29, 0x63, 0x11, 0x66, 0xf5, 0xb3, 0x23, 0x6e,
+	0xfc, 0x6e, 0x9f, 0x78, 0xdb, 0x4e, 0x04, 0x14, 0xc9, 0x03, 0xdd, 0x5a, 0x78, 0xd0, 0x6e, 0xd3,
+	0x28, 0xc0, 0x9b, 0x7b, 0x7c, 0xfb, 0xce, 0x14, 0x3e, 0x40, 0x97, 0x94, 0xe7, 0x2a, 0xf1, 0x7d,
+	0x43, 0xcd, 0x3d, 0x52, 0xe3, 0xa9, 0x6d, 0x1f, 0xe5, 0x21, 0xb7, 0x8f, 0x16, 0x4c, 0x2f, 0x75,
+	0x9a, 0xc1, 0x01, 0x46, 0x36, 0xca, 0xca, 0x4d, 0x9c, 0x50, 0x39, 0xf9, 0xb0, 0xc5, 0x65, 0x47,
+	0xce, 0xb0, 0xac, 0xea, 0xf5, 0x33, 0x36, 0xff, 0x3f, 0xa8, 0xa4, 0xfb, 0xf2, 0x53, 0x3e, 0x56,
+	0x7c, 0x1a, 0xd7, 0x6c, 0x36, 0xd2, 0xe9, 0xb6, 0x90, 0x39, 0xed, 0x45, 0x5a, 0x23, 0x89, 0x4a,
+	0x57, 0xde, 0x8e, 0xd5, 0xde, 0xa1, 0x95, 0xcb, 0x38, 0x97, 0xb5, 0x8c, 0xcd, 0x5f, 0xcd, 0xc1,
+	0x34, 0xf7, 0x26, 0x7d, 0xf6, 0x75, 0xc5, 0xf7, 0x35, 0xe1, 0x2c, 0xcf, 0x02, 0x53, 0xad, 0x3b,
+	0x46, 0x5b, 0xfc, 0x06, 0x9c, 0xeb, 0xeb, 0x0a, 0x14, 0xd0, 0x8b, 0xd2, 0x8f, 0xb7, 0x4f, 0x44,
+	0xcf, 0x66, 0x7f, 0x64, 0xeb, 0x96, 0xd5, 0x47, 0x61, 0xfe, 0xc3, 0x5c, 0x1f, 0x7f, 0xa1, 0x37,
+	0xaa, 0x9a, 0xa0, 0x71, 0x3a, 0x4d, 0x30, 0xf7, 0x89, 0x34, 0xc1, 0xfc, 0x30, 0x9a, 0xe0, 0x47,
+	0x30, 0xb1, 0x41, 0x1d, 0xa6, 0xd1, 0x88, 0x60, 0xb3, 0x82, 0xf6, 0x5a, 0x2c, 0x2b, 0x93, 0xf2,
+	0x25, 0x0e, 0x54, 0x8d, 0x18, 0x01, 0x13, 0x2d, 0x3c, 0xfa, 0xcc, 0xd2, 0x39, 0xa8, 0x9b, 0xc6,
+	0xc8, 0xe0, 0x4d, 0xc3, 0xfc, 0x66, 0x0e, 0xc6, 0x15, 0xf6, 0xe4, 0x8b, 0x50, 0x5e, 0x0b, 0x76,
+	0x9d, 0x8e, 0xf7, 0x73, 0x8e, 0x72, 0xfc, 0x8a, 0xd5, 0xf7, 0x15, 0xb8, 0xa5, 0x61, 0xa1, 0xdb,
+	0x0c, 0x75, 0xda, 0xea, 0xc4, 0x67, 0xd5, 0xb3, 0x10, 0xaa, 0x04, 0x0b, 0xe7, 0x87, 0x08, 0x16,
+	0xd6, 0x23, 0x6d, 0x0b, 0xa7, 0x8f, 0xb4, 0xd5, 0x02, 0x63, 0x47, 0x4e, 0x19, 0x18, 0x6b, 0xfe,
+	0x7a, 0x0e, 0x2a, 0xe2, 0x5d, 0x55, 0x79, 0x78, 0xf8, 0x7c, 0xbd, 0xc3, 0xa0, 0x37, 0xee, 0x98,
+	0xeb, 0xb1, 0xc2, 0x6f, 0xff, 0x7e, 0x15, 0x5f, 0xc9, 0x4c, 0x77, 0x87, 0x7c, 0x25, 0x53, 0x87,
+	0xa7, 0x23, 0x07, 0xd2, 0x54, 0x56, 0x1a, 0xdf, 0xfc, 0xb3, 0x5c, 0x9a, 0xb7, 0xd0, 0xa6, 0x5e,
+	0x85, 0x31, 0xfe, 0x2c, 0x96, 0x74, 0x6e, 0x16, 0xb9, 0x9b, 0x10, 0x64, 0xc9, 0xb2, 0xd3, 0xc4,
+	0x90, 0x9c, 0xf4, 0x54, 0x2a, 0xb9, 0x0d, 0x65, 0xf4, 0x17, 0xa9, 0xb9, 0x6e, 0x40, 0xc3, 0x50,
+	0x28, 0x5a, 0x78, 0x77, 0xf7, 0x98, 0xee, 0xd8, 0xdc, 0xaf, 0xc4, 0x71, 0xdd, 0xc0, 0xd2, 0xf0,
+	0xc8, 0x02, 0x9c, 0xd5, 0xdc, 0x93, 0x24, 0xfd, 0x48, 0xb2, 0x5b, 0x44, 0x58, 0xc0, 0x89, 0x33,
+	0x91, 0x9f, 0xde, 0x33, 0xd1, 0xe6, 0xff, 0x32, 0xd8, 0x5a, 0x6b, 0xee, 0x3f, 0x67, 0xd1, 0x2d,
+	0xac, 0x49, 0xc7, 0x28, 0xfb, 0xff, 0xde, 0xe0, 0xfe, 0xe9, 0x62, 0xfa, 0xbc, 0x0d, 0xa3, 0xfc,
+	0x11, 0x2e, 0xe1, 0x49, 0xad, 0x72, 0xe1, 0x05, 0xc9, 0xfd, 0x14, 0x7f, 0xca, 0xcb, 0x12, 0x04,
+	0xcc, 0x64, 0xd6, 0xdd, 0xe4, 0x51, 0xf1, 0xec, 0xf7, 0x8f, 0x97, 0x58, 0x6a, 0x5e, 0xd2, 0xe1,
+	0xf2, 0x5d, 0x1b, 0x27, 0xe7, 0x25, 0x35, 0xff, 0x4f, 0x8e, 0xb7, 0x47, 0x54, 0x6a, 0xd8, 0x84,
+	0x7b, 0xaf, 0x41, 0x01, 0x9f, 0x7b, 0x55, 0xb2, 0x1a, 0xa6, 0x9e, 0x7a, 0xc5, 0x72, 0xb6, 0x6e,
+	0x50, 0xd6, 0xaa, 0x01, 0x55, 0x28, 0x8e, 0xd5, 0x75, 0x83, 0x18, 0x98, 0x4d, 0xda, 0x77, 0xa9,
+	0xba, 0x1c, 0x3a, 0x7a, 0xe2, 0x6f, 0x2c, 0x27, 0xb7, 0x15, 0xbf, 0x66, 0xf5, 0x40, 0xa3, 0xfd,
+	0xd0, 0xb1, 0xb9, 0x3f, 0xad, 0x2a, 0x6d, 0x13, 0x17, 0xe8, 0x25, 0x98, 0xd4, 0x63, 0x95, 0x85,
+	0xd1, 0x81, 0x21, 0xdf, 0xa9, 0x38, 0x67, 0x55, 0xbd, 0xd5, 0x89, 0x48, 0x1d, 0x26, 0xb4, 0x80,
+	0x54, 0x35, 0x09, 0x2b, 0xcf, 0x0e, 0x63, 0xf7, 0x67, 0x52, 0xd0, 0x49, 0x94, 0x03, 0xf3, 0x2f,
+	0x40, 0x45, 0xac, 0xcc, 0x38, 0xb6, 0x0d, 0x55, 0xbb, 0xe5, 0x45, 0x4b, 0x5d, 0x4d, 0x4d, 0xcf,
+	0x0d, 0x2c, 0x84, 0x9a, 0xdf, 0x35, 0xe0, 0xa2, 0x78, 0x5c, 0xcc, 0xa2, 0x21, 0xd3, 0x21, 0x31,
+	0x20, 0x0e, 0xe7, 0xe3, 0x17, 0xc9, 0xbb, 0x32, 0xf1, 0x94, 0x2e, 0x20, 0xd3, 0xdf, 0xa8, 0x4f,
+	0x88, 0x49, 0x39, 0x82, 0xa9, 0xa7, 0x64, 0xc2, 0xa9, 0xb7, 0x45, 0xc2, 0xa9, 0xdc, 0xf1, 0xc4,
+	0xf1, 0xba, 0x70, 0x69, 0x47, 0x26, 0x9a, 0xfa, 0x4e, 0x0e, 0xce, 0x65, 0x54, 0x6b, 0xeb, 0x8b,
+	0xcf, 0xa8, 0x70, 0xa8, 0x6b, 0xc2, 0x41, 0x66, 0x24, 0x1c, 0xd8, 0xf1, 0x99, 0xb2, 0xe2, 0x77,
+	0x0d, 0xb8, 0xa0, 0xcf, 0x1e, 0x61, 0x8b, 0x6e, 0xdd, 0x22, 0xef, 0xc0, 0xe8, 0x3d, 0xea, 0xb8,
+	0x54, 0x86, 0x60, 0xc4, 0xd9, 0xbd, 0xc4, 0xe9, 0x30, 0x2f, 0xe4, 0x6c, 0xff, 0x8c, 0x2f, 0xe5,
+	0x33, 0x96, 0x20, 0x21, 0x8b, 0xa2, 0x72, 0xfc, 0x7a, 0xca, 0x94, 0x37, 0x35, 0x59, 0x9f, 0x3a,
+	0x46, 0x31, 0xfe, 0x43, 0x03, 0x5e, 0x38, 0x86, 0x86, 0x0d, 0x1c, 0x1b, 0x7a, 0x75, 0xe0, 0x70,
+	0x63, 0x41, 0x28, 0x79, 0x1f, 0xa6, 0x36, 0x44, 0xa4, 0x98, 0x1c, 0x0e, 0x25, 0xbb, 0xbb, 0x0c,
+	0x22, 0xb3, 0xe5, 0xb8, 0xa4, 0x91, 0x99, 0xf5, 0x7f, 0xcf, 0x0f, 0xa3, 0x4e, 0x92, 0x2c, 0x06,
+	0xad, 0xff, 0x3d, 0x01, 0xb3, 0xe2, 0x52, 0xa6, 0x16, 0xe8, 0xd5, 0x14, 0xee, 0x10, 0x2f, 0xc3,
+	0x28, 0xc3, 0x89, 0xb5, 0x6b, 0x9c, 0x07, 0xf8, 0xf4, 0x95, 0xe7, 0x5a, 0xa2, 0x28, 0xb6, 0xeb,
+	0x72, 0x99, 0xb7, 0x16, 0xdf, 0x34, 0xa0, 0xa2, 0xf3, 0xfe, 0xb4, 0x43, 0xf3, 0x9e, 0x36, 0x34,
+	0x2f, 0x64, 0x0f, 0xcd, 0xe0, 0x31, 0xe9, 0xcb, 0xdb, 0x30, 0xd4, 0x58, 0x98, 0x30, 0xba, 0xe8,
+	0xb7, 0x1d, 0xaf, 0xa3, 0xe6, 0x1a, 0x70, 0x11, 0x62, 0x89, 0x12, 0xa5, 0xb7, 0xf2, 0x03, 0x7b,
+	0xcb, 0xfc, 0x76, 0x01, 0x2e, 0x5a, 0x74, 0xd7, 0x63, 0x0a, 0xd2, 0x66, 0xe8, 0x75, 0x76, 0xb5,
+	0x3b, 0x25, 0x33, 0xd5, 0xe1, 0xc2, 0x93, 0x8e, 0x41, 0xe2, 0xfe, 0xbe, 0x06, 0x45, 0x26, 0xa5,
+	0x95, 0x3e, 0x47, 0xa3, 0x07, 0x33, 0xe6, 0xf0, 0x71, 0x95, 0xc5, 0xe4, 0xba, 0xd8, 0x43, 0x14,
+	0x5f, 0x67, 0xb6, 0x87, 0xa4, 0x5e, 0xee, 0xe6, 0xfb, 0x48, 0xac, 0x54, 0x15, 0x06, 0x28, 0x55,
+	0x0f, 0xe0, 0x6c, 0xcd, 0xe5, 0xf2, 0xc9, 0x69, 0xad, 0x07, 0x5e, 0xa7, 0xe9, 0x75, 0x9d, 0x96,
+	0x54, 0xca, 0xf9, 0x3b, 0xe6, 0x71, 0xb9, 0xdd, 0x8d, 0x11, 0xac, 0x4c, 0x32, 0xd6, 0x8c, 0xc5,
+	0xd5, 0x06, 0x4f, 0x88, 0x32, 0x8a, 0x2c, 0xb0, 0x19, 0x6e, 0x27, 0xe4, 0x19, 0x51, 0xac, 0xb8,
+	0x18, 0xd5, 0x39, 0x0c, 0x77, 0xd8, 0x58, 0x69, 0xdc, 0x17, 0xe1, 0x03, 0xd2, 0x15, 0x8b, 0x47,
+	0x47, 0x44, 0xad, 0x10, 0xed, 0x77, 0x0d, 0x2f, 0xa1, 0x6b, 0x34, 0xee, 0x31, 0xba, 0x62, 0x1f,
+	0x5d, 0x18, 0xee, 0xa9, 0x74, 0x1c, 0x8f, 0xcc, 0x01, 0x70, 0x67, 0x16, 0x9c, 0x10, 0xa5, 0x44,
+	0xf9, 0x0b, 0x10, 0xca, 0x95, 0x3f, 0x05, 0x85, 0xbc, 0x0b, 0x33, 0x4b, 0x0b, 0xf3, 0x32, 0x2e,
+	0x60, 0xd1, 0x6f, 0xf6, 0xda, 0xb4, 0x13, 0x61, 0x9c, 0x4a, 0x99, 0x8f, 0x21, 0x6d, 0xce, 0xb3,
+	0x59, 0x90, 0x85, 0x26, 0xa2, 0x03, 0x78, 0x6c, 0xd9, 0x82, 0xef, 0xd2, 0x70, 0xeb, 0xe6, 0x73,
+	0x16, 0x1d, 0xa0, 0xb4, 0x0d, 0x57, 0xdb, 0xcd, 0xcc, 0x95, 0xf9, 0x77, 0x31, 0x3a, 0xa0, 0x0f,
+	0x97, 0xfc, 0x24, 0x8c, 0xe0, 0x4f, 0xb1, 0xe3, 0xce, 0x64, 0xb0, 0x4d, 0x76, 0xdb, 0x26, 0xcf,
+	0x6d, 0x81, 0x04, 0x64, 0x39, 0x49, 0x5e, 0x7f, 0x0a, 0x1f, 0x57, 0x11, 0xa0, 0xaa, 0xbf, 0x5a,
+	0xe2, 0x42, 0x59, 0xfd, 0x20, 0x9b, 0x23, 0xf7, 0x9c, 0x70, 0x8f, 0xba, 0x0b, 0xf2, 0xdd, 0xc1,
+	0x32, 0x9f, 0x23, 0x7b, 0x08, 0xc5, 0x17, 0x55, 0x2c, 0x05, 0x85, 0x49, 0x87, 0xe5, 0x70, 0x33,
+	0x14, 0x55, 0x11, 0x56, 0x90, 0x87, 0xd6, 0xab, 0x6b, 0x89, 0x22, 0x94, 0x96, 0x32, 0x77, 0x63,
+	0xe0, 0x34, 0xf7, 0x69, 0xb0, 0x75, 0xf3, 0xb3, 0x90, 0x96, 0xfa, 0x37, 0x8e, 0x19, 0x93, 0xdf,
+	0x28, 0xc6, 0xa9, 0x59, 0x34, 0x64, 0xa6, 0x23, 0x26, 0x37, 0xf3, 0x46, 0xa2, 0x23, 0x26, 0x37,
+	0xf3, 0xaa, 0x8e, 0x18, 0xa3, 0xc6, 0x99, 0x73, 0x73, 0x27, 0x64, 0xce, 0x1d, 0x90, 0xac, 0x5b,
+	0x3a, 0x75, 0x3e, 0x47, 0xef, 0x16, 0x7c, 0x09, 0xca, 0xb5, 0x28, 0x72, 0x9a, 0x7b, 0xd4, 0xc5,
+	0x0c, 0xcd, 0xca, 0x85, 0xa0, 0x23, 0xe0, 0xaa, 0xbb, 0x98, 0x8a, 0xab, 0xbc, 0x5b, 0x32, 0x36,
+	0xc4, 0xbb, 0x25, 0x73, 0x30, 0xb6, 0xdc, 0x79, 0xe4, 0xb1, 0x3e, 0x29, 0x26, 0xc9, 0x21, 0x3c,
+	0x0e, 0xd2, 0x1f, 0xbb, 0x40, 0x10, 0x79, 0x5b, 0xd1, 0x20, 0x4a, 0x89, 0x2a, 0x2f, 0x5e, 0x4c,
+	0x96, 0x8a, 0x84, 0x7a, 0xde, 0x2c, 0xd1, 0xc9, 0x6d, 0x18, 0x93, 0xd6, 0x33, 0x24, 0xea, 0xbb,
+	0xa0, 0x74, 0x78, 0x89, 0x96, 0x8f, 0x42, 0x58, 0xcf, 0xef, 0xea, 0xf1, 0x23, 0xe3, 0x4a, 0x5c,
+	0xb6, 0x12, 0x3f, 0xa2, 0xc5, 0x65, 0x2b, 0x91, 0x24, 0xb1, 0x31, 0x54, 0x3e, 0xd1, 0x18, 0xda,
+	0x82, 0xf2, 0xba, 0x13, 0x44, 0x1e, 0xdb, 0x8e, 0x3a, 0x11, 0x4f, 0xab, 0x95, 0xd8, 0xea, 0x4a,
+	0x51, 0xfd, 0x25, 0x19, 0x9f, 0xdc, 0x55, 0xf0, 0xf5, 0xc0, 0xd6, 0x04, 0x4e, 0x56, 0x33, 0x3c,
+	0x0c, 0x45, 0x12, 0x48, 0xbc, 0x02, 0x54, 0x0e, 0xae, 0x44, 0x8b, 0xd4, 0xa3, 0xf4, 0x7e, 0xe7,
+	0xc4, 0x5b, 0x7c, 0x0c, 0xd0, 0x66, 0x9c, 0x42, 0x36, 0x98, 0x5d, 0x04, 0xf5, 0x8a, 0x94, 0xe1,
+	0x18, 0x23, 0x92, 0xaf, 0x43, 0x99, 0xfd, 0x8f, 0x39, 0x86, 0x3c, 0xca, 0xd3, 0x66, 0x25, 0x1e,
+	0x67, 0xfa, 0x82, 0xe6, 0x89, 0x88, 0x1a, 0x34, 0xe2, 0x0b, 0x18, 0x19, 0xa7, 0x0f, 0x5e, 0x34,
+	0x6e, 0xe6, 0x0f, 0x0d, 0xb8, 0x30, 0x80, 0xc7, 0xd0, 0x2f, 0x16, 0xcd, 0x25, 0x1b, 0x92, 0x62,
+	0x9b, 0x8b, 0x0d, 0x49, 0x9d, 0x18, 0x72, 0x6b, 0xca, 0x4e, 0x78, 0x95, 0xff, 0xcc, 0x12, 0x5e,
+	0x99, 0x87, 0x06, 0x8c, 0x2b, 0x23, 0xfb, 0x14, 0x1f, 0x22, 0x78, 0x4d, 0x64, 0x7e, 0xcc, 0x27,
+	0x78, 0xa9, 0xf7, 0x87, 0x79, 0xa6, 0xc7, 0x6f, 0x00, 0xac, 0x38, 0x61, 0x54, 0x6b, 0x46, 0xde,
+	0x23, 0x3a, 0x84, 0x18, 0x4b, 0x02, 0xf5, 0x1d, 0x4c, 0xa4, 0xca, 0xc8, 0xfa, 0x02, 0xf5, 0x63,
+	0x86, 0xe6, 0x2a, 0x8c, 0x36, 0xfc, 0x20, 0xaa, 0x1f, 0xf0, 0xbd, 0x69, 0x91, 0x86, 0x4d, 0xf5,
+	0x84, 0xce, 0x43, 0x5b, 0xbd, 0x69, 0x89, 0x22, 0xa6, 0x20, 0xde, 0xf1, 0x68, 0xcb, 0x55, 0x6f,
+	0x68, 0x1e, 0x32, 0x80, 0xc5, 0xe1, 0xd7, 0x3f, 0x80, 0x29, 0x99, 0x7c, 0x6e, 0x63, 0xa5, 0x81,
+	0x2d, 0x98, 0x82, 0xf1, 0xad, 0x25, 0x6b, 0xf9, 0xce, 0x57, 0xed, 0x3b, 0x9b, 0x2b, 0x2b, 0x95,
+	0x33, 0x64, 0x02, 0x4a, 0x02, 0xb0, 0x50, 0xab, 0x18, 0xa4, 0x0c, 0xc5, 0xe5, 0xd5, 0xc6, 0xd2,
+	0xc2, 0xa6, 0xb5, 0x54, 0xc9, 0x5d, 0x7f, 0x15, 0x26, 0x93, 0xfb, 0x17, 0x8c, 0xd1, 0x1c, 0x83,
+	0xbc, 0x55, 0xdb, 0xae, 0x9c, 0x21, 0x00, 0xa3, 0xeb, 0xf7, 0x17, 0x1a, 0x37, 0x6f, 0x56, 0x8c,
+	0xeb, 0x5f, 0xc8, 0x78, 0xf4, 0x99, 0x71, 0x6a, 0xd0, 0xae, 0x13, 0x38, 0x11, 0xe5, 0x9f, 0x79,
+	0xd0, 0x6b, 0x45, 0x5e, 0xb7, 0x45, 0x9f, 0x54, 0x8c, 0xeb, 0x6f, 0xf7, 0xbd, 0xdd, 0x4c, 0xce,
+	0xc1, 0xf4, 0xe6, 0x6a, 0xed, 0x41, 0x7d, 0xf9, 0xee, 0xe6, 0xda, 0x66, 0xc3, 0x7e, 0x50, 0xdb,
+	0x58, 0xb8, 0x57, 0x39, 0xc3, 0x2a, 0xfc, 0x60, 0xad, 0xb1, 0x61, 0x5b, 0x4b, 0x0b, 0x4b, 0xab,
+	0x1b, 0x15, 0xe3, 0xfa, 0xaf, 0x19, 0x30, 0xa9, 0xbf, 0x86, 0x47, 0xae, 0xc0, 0xe5, 0xcd, 0xc6,
+	0x92, 0x65, 0x6f, 0xac, 0xdd, 0x5f, 0x5a, 0xb5, 0x37, 0x1b, 0xb5, 0xbb, 0x4b, 0xf6, 0xe6, 0x6a,
+	0x63, 0x7d, 0x69, 0x61, 0xf9, 0xce, 0xf2, 0xd2, 0x62, 0xe5, 0x0c, 0xa9, 0xc2, 0x0b, 0x0a, 0x86,
+	0xb5, 0xb4, 0xb0, 0xb6, 0xb5, 0x64, 0xd9, 0xeb, 0xb5, 0x46, 0x63, 0x7b, 0xcd, 0x5a, 0xac, 0x18,
+	0xe4, 0x12, 0x9c, 0xcf, 0x40, 0x78, 0x70, 0xa7, 0x56, 0xc9, 0xf5, 0x95, 0xad, 0x2e, 0x6d, 0xd7,
+	0x56, 0xec, 0xfa, 0xda, 0x46, 0x25, 0x7f, 0xfd, 0x03, 0xa6, 0x85, 0x24, 0xcf, 0x55, 0x90, 0x22,
+	0x14, 0x56, 0xd7, 0x56, 0x97, 0x2a, 0x67, 0xc8, 0x38, 0x8c, 0xad, 0x2f, 0xad, 0x2e, 0x2e, 0xaf,
+	0xde, 0xe5, 0xdd, 0x5a, 0x5b, 0x5f, 0xb7, 0xd6, 0xb6, 0x96, 0x16, 0x2b, 0x39, 0xd6, 0x77, 0x8b,
+	0x4b, 0xab, 0xac, 0x66, 0xf9, 0xeb, 0x26, 0x4f, 0xd1, 0xac, 0x65, 0x18, 0x65, 0xbd, 0xb5, 0xf4,
+	0x95, 0x8d, 0xa5, 0xd5, 0xc6, 0xf2, 0xda, 0x6a, 0xe5, 0xcc, 0xf5, 0xcb, 0x29, 0x1c, 0x39, 0x12,
+	0x8d, 0xc6, 0xbd, 0xca, 0x99, 0xeb, 0x5f, 0x87, 0xb2, 0xba, 0x09, 0x93, 0x0b, 0x30, 0xa3, 0xfe,
+	0x5e, 0xa7, 0x1d, 0xd7, 0xeb, 0xec, 0x56, 0xce, 0xa4, 0x0b, 0xac, 0x5e, 0xa7, 0xc3, 0x0a, 0xb0,
+	0xf1, 0x6a, 0xc1, 0x06, 0x0d, 0xda, 0x5e, 0x87, 0xed, 0xaf, 0x95, 0x5c, 0xbd, 0xf2, 0xfd, 0xbf,
+	0x7c, 0xe9, 0xcc, 0xf7, 0x7f, 0xf0, 0x92, 0xf1, 0x67, 0x3f, 0x78, 0xc9, 0xf8, 0xaf, 0x3f, 0x78,
+	0xc9, 0xd8, 0x19, 0xc5, 0x89, 0x7e, 0xeb, 0xff, 0x05, 0x00, 0x00, 0xff, 0xff, 0x67, 0x6d, 0x41,
+	0x27, 0x6f, 0xb5, 0x00, 0x00,
 }
 
 func (m *KeepAlive) Marshal() (dAtA []byte, err error) {
@@ -19616,6 +19622,13 @@ func (m *WindowsDesktopServiceSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Hostname) > 0 {
+		i -= len(m.Hostname)
+		copy(dAtA[i:], m.Hostname)
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Hostname)))
+		i--
+		dAtA[i] = 0x1a
+	}
 	if len(m.TeleportVersion) > 0 {
 		i -= len(m.TeleportVersion)
 		copy(dAtA[i:], m.TeleportVersion)
@@ -24830,6 +24843,10 @@ func (m *WindowsDesktopServiceSpecV3) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
+	l = len(m.Hostname)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -55083,6 +55100,38 @@ func (m *WindowsDesktopServiceSpecV3) Unmarshal(dAtA []byte) error {
 			}
 			m.TeleportVersion = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hostname", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Hostname = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
diff --git a/api/types/types.proto b/api/types/types.proto
index 058fa01a12616..c123c47bd1585 100644
--- a/api/types/types.proto
+++ b/api/types/types.proto
@@ -2776,10 +2776,15 @@ message WindowsDesktopServiceSpecV3 {
     string Addr = 1 [ (gogoproto.jsontag) = "addr" ];
     // TeleportVersion is teleport binary version running this service.
     string TeleportVersion = 2 [ (gogoproto.jsontag) = "teleport_version" ];
+    // Hostname is the desktop service hostname.
+    string Hostname = 3 [ (gogoproto.jsontag) = "hostname" ];
 }
 
+// WindowsDesktopFilter are filters to apply when searching for windows desktops.
 message WindowsDesktopFilter {
+    // HostID is the ID of the host the Windows Desktop Service proxying the desktop.
     string HostID = 1 [ (gogoproto.jsontag) = "host_id" ];
+    // Name is the name of the desktop.
     string Name = 2 [ (gogoproto.jsontag) = "name" ];
 }
 
diff --git a/assets/aws/Makefile b/assets/aws/Makefile
index d2c2c39a42fc6..2de8319b906c5 100644
--- a/assets/aws/Makefile
+++ b/assets/aws/Makefile
@@ -14,7 +14,7 @@ AWS_REGION ?= us-west-2
 # This must be a _released_ version of Teleport, i.e. one which has binaries
 # available for download on https://gravitational.com/teleport/download
 # Unreleased versions will fail to build.
-TELEPORT_VERSION ?= 8.3.1
+TELEPORT_VERSION ?= 9.0.1
 
 # Teleport UID is the UID of a non-privileged 'teleport' user
 TELEPORT_UID ?= 1007
diff --git a/assets/backport/main.go b/assets/backport/main.go
index f8bd1eca3b400..804bca8d3aabc 100644
--- a/assets/backport/main.go
+++ b/assets/backport/main.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -100,7 +99,7 @@ func getGithubToken() (string, error) {
 		return "", trace.Wrap(err)
 	}
 	ghConfigPath := filepath.Join(dirname, githubConfigPath)
-	yamlFile, err := ioutil.ReadFile(ghConfigPath)
+	yamlFile, err := os.ReadFile(ghConfigPath)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
diff --git a/assets/loadtest/k8s/Makefile b/assets/loadtest/k8s/Makefile
index 915636397cc06..71f785b0b3260 100644
--- a/assets/loadtest/k8s/Makefile
+++ b/assets/loadtest/k8s/Makefile
@@ -115,7 +115,7 @@ install-teleport: install-auth install-proxy install-node install-iot-node
 .PHONY: delete-teleport
 delete-teleport: delete-tc delete-nodes delete-proxy delete-auth
 
-# installs grafana and influxdb
+# installs grafana, influxdb, and prometheus
 .PHONY: install-monitor
 install-monitor:
 	kubectl create configmap grafana-config -n loadtest \
@@ -128,13 +128,16 @@ install-monitor:
 	kubectl apply -f influxdb.yaml
 	@make expand-yaml FILENAME=grafana
 	kubectl apply -f grafana-gen.yaml
+	@make expand-yaml FILENAME=prometheus
+	kubectl apply -f prometheus-gen.yaml
 
-# deletes grafana and influxdb deployments, services and configmaps
+# deletes grafana, influxdb, and prometheus deployments, services and configmaps
 .PHONY: delete-monitor
 delete-monitor:
 	kubectl delete -f influxdb.yaml --ignore-not-found
 	kubectl delete -f grafana-gen.yaml --ignore-not-found
 	kubectl delete configmap grafana-config -n loadtest --ignore-not-found
+	kubectl delete -f prometheus-gen.yaml --ignore-not-found
 
 # installs an etcd cluster
 .PHONY: install-etcd
@@ -460,4 +463,4 @@ fetch-profiles:
 # output file will be named the same with a -gen suffix, i.e input = test then output will be test-gen.yaml
 .PHONY: expand-yaml
 expand-yaml:
-	@bash -c "set -a && source ./secrets/secrets.env && set +a && envsubst < $(FILENAME).yaml > $(FILENAME)-gen.yaml"
\ No newline at end of file
+	@bash -c "set -a && source ./secrets/secrets.env && set +a && envsubst < $(FILENAME).yaml > $(FILENAME)-gen.yaml"
diff --git a/assets/loadtest/k8s/auth-etcd.yaml b/assets/loadtest/k8s/auth-etcd.yaml
index 15d648055ec69..049df023b70de 100644
--- a/assets/loadtest/k8s/auth-etcd.yaml
+++ b/assets/loadtest/k8s/auth-etcd.yaml
@@ -14,6 +14,9 @@ spec:
     metadata:
       labels:
         teleport-role: auth
+        backend: etcd
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "3434"
     spec:
       volumes:
         - name: config
diff --git a/assets/loadtest/k8s/auth-firestore.yaml b/assets/loadtest/k8s/auth-firestore.yaml
index a3acd6d26cfdb..3b5c3c3affbd5 100644
--- a/assets/loadtest/k8s/auth-firestore.yaml
+++ b/assets/loadtest/k8s/auth-firestore.yaml
@@ -14,6 +14,9 @@ spec:
     metadata:
       labels:
         teleport-role: auth
+        backend: firestore
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "3434"
     spec:
       volumes:
         - name: config
diff --git a/assets/loadtest/k8s/prometheus.yaml b/assets/loadtest/k8s/prometheus.yaml
new file mode 100644
index 0000000000000..3649f3f7f92d0
--- /dev/null
+++ b/assets/loadtest/k8s/prometheus.yaml
@@ -0,0 +1,291 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prometheus-loadtest
+---
+# Source: prometheus/templates/server/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    component: "server"
+    app: prometheus
+    release: prometheus
+    chart: prometheus-15.4.0
+    heritage: Helm
+  name: prometheus-server
+  namespace: prometheus-loadtest
+  annotations:
+    {}
+---
+# Source: prometheus/templates/server/cm.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    component: "server"
+    app: prometheus
+    release: prometheus
+    chart: prometheus-15.4.0
+    heritage: Helm
+  name: prometheus-server
+  namespace: prometheus-loadtest
+data:
+  alerting_rules.yml: |
+    {}
+  alerts: |
+    {}
+  prometheus.yml: |
+    global:
+      evaluation_interval: 1m
+      scrape_interval: 1m
+      scrape_timeout: 10s
+    remote_write:
+    - url: ${PROM_REMOTE_URL}
+      basic_auth:
+        username: ${PROM_USER}
+        password: ${PROM_PASSWORD}
+    rule_files:
+    - /etc/config/recording_rules.yml
+    - /etc/config/alerting_rules.yml
+    - /etc/config/rules
+    - /etc/config/alerts
+    scrape_configs:
+    - job_name: kubernetes-pods
+      kubernetes_sd_configs:
+      - role: pod
+      relabel_configs:
+      - action: keep
+        regex: true
+        source_labels:
+        - __meta_kubernetes_pod_annotation_prometheus_io_scrape
+      - action: drop
+        regex: true
+        source_labels:
+        - __meta_kubernetes_pod_annotation_prometheus_io_scrape_slow
+      - action: replace
+        regex: (https?)
+        source_labels:
+        - __meta_kubernetes_pod_annotation_prometheus_io_scheme
+        target_label: __scheme__
+      - action: replace
+        regex: (.+)
+        source_labels:
+        - __meta_kubernetes_pod_annotation_prometheus_io_path
+        target_label: __metrics_path__
+      - action: replace
+        regex: ([^:]+)(?::\d+)?;(\d+)
+        replacement: $1:$2
+        source_labels:
+        - __address__
+        - __meta_kubernetes_pod_annotation_prometheus_io_port
+        target_label: __address__
+      - action: labelmap
+        regex: __meta_kubernetes_pod_annotation_prometheus_io_param_(.+)
+        replacement: __param_$1
+      - action: labelmap
+        regex: __meta_kubernetes_pod_label_(.+)
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_namespace
+        target_label: namespace
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_pod_name
+        target_label: pod
+      - action: drop
+        regex: Pending|Succeeded|Failed|Completed
+        source_labels:
+        - __meta_kubernetes_pod_phase
+  recording_rules.yml: |
+    {}
+  rules: |
+    {}
+---
+# Source: prometheus/templates/server/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    component: "server"
+    app: prometheus
+    release: prometheus
+    chart: prometheus-15.4.0
+    heritage: Helm
+  name: prometheus-server
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - services
+      - endpoints
+      - pods
+      - ingresses
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "extensions"
+      - "networking.k8s.io"
+    resources:
+      - ingresses/status
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - nonResourceURLs:
+      - "/metrics"
+    verbs:
+      - get
+---
+# Source: prometheus/templates/server/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    component: "server"
+    app: prometheus
+    release: prometheus
+    chart: prometheus-15.4.0
+    heritage: Helm
+  name: prometheus-server
+subjects:
+  - kind: ServiceAccount
+    name: prometheus-server
+    namespace: prometheus-loadtest
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus-server
+---
+# Source: prometheus/templates/server/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    component: "server"
+    app: prometheus
+    release: prometheus
+    chart: prometheus-15.4.0
+    heritage: Helm
+  name: prometheus-server
+  namespace: prometheus-loadtest
+spec:
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 9090
+  selector:
+    component: "server"
+    app: prometheus
+    release: prometheus
+  sessionAffinity: None
+  type: "ClusterIP"
+---
+# Source: prometheus/templates/server/deploy.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    component: "server"
+    app: prometheus
+    release: prometheus
+    chart: prometheus-15.4.0
+    heritage: Helm
+  name: prometheus-server
+  namespace: prometheus-loadtest
+spec:
+  selector:
+    matchLabels:
+      component: "server"
+      app: prometheus
+      release: prometheus
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        component: "server"
+        app: prometheus
+        release: prometheus
+        chart: prometheus-15.4.0
+        heritage: Helm
+    spec:
+      enableServiceLinks: true
+      serviceAccountName: prometheus-server
+      containers:
+        - name: prometheus-server-configmap-reload
+          image: "jimmidyson/configmap-reload:v0.5.0"
+          imagePullPolicy: "IfNotPresent"
+          args:
+            - --volume-dir=/etc/config
+            - --webhook-url=http://127.0.0.1:9090/-/reload
+          resources:
+            {}
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/config
+              readOnly: true
+
+        - name: prometheus-server
+          image: "quay.io/prometheus/prometheus:v2.31.1"
+          imagePullPolicy: "IfNotPresent"
+          args:
+            - --storage.tsdb.retention.time=15d
+            - --config.file=/etc/config/prometheus.yml
+            - --storage.tsdb.path=/data
+            - --web.console.libraries=/etc/prometheus/console_libraries
+            - --web.console.templates=/etc/prometheus/consoles
+            - --web.enable-lifecycle
+          ports:
+            - containerPort: 9090
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 9090
+              scheme: HTTP
+            initialDelaySeconds: 30
+            periodSeconds: 5
+            timeoutSeconds: 4
+            failureThreshold: 3
+            successThreshold: 1
+          livenessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9090
+              scheme: HTTP
+            initialDelaySeconds: 30
+            periodSeconds: 15
+            timeoutSeconds: 10
+            failureThreshold: 3
+            successThreshold: 1
+          resources:
+            {}
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/config
+            - name: storage-volume
+              mountPath: /data
+              subPath: ""
+      hostNetwork: false
+      dnsPolicy: ClusterFirst
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65534
+        runAsNonRoot: true
+        runAsUser: 65534
+      terminationGracePeriodSeconds: 300
+      volumes:
+        - name: config-volume
+          configMap:
+            name: prometheus-server
+        - name: storage-volume
+          emptyDir:
+            {}
diff --git a/assets/loadtest/k8s/proxy.yaml b/assets/loadtest/k8s/proxy.yaml
index 4ef2396e8cb64..4fd0dac33816e 100644
--- a/assets/loadtest/k8s/proxy.yaml
+++ b/assets/loadtest/k8s/proxy.yaml
@@ -14,6 +14,8 @@ spec:
     metadata:
       labels:
         teleport-role: proxy
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "3434"
     spec:
       volumes:
         - name: config
@@ -100,4 +102,4 @@ spec:
     targetPort: 3036
     protocol: TCP
   selector:
-    teleport-role: proxy
\ No newline at end of file
+    teleport-role: proxy
diff --git a/assets/loadtest/k8s/secrets/Makefile b/assets/loadtest/k8s/secrets/Makefile
index c0110552f208e..6151d28f801d0 100644
--- a/assets/loadtest/k8s/secrets/Makefile
+++ b/assets/loadtest/k8s/secrets/Makefile
@@ -23,6 +23,21 @@ env:
 		exit 1; \
 	fi
 
+	@if [ -z ${PROM_REMOTE_URL} ]; then \
+		echo "PROM_REMOTE_URL is not set, cannot apply cluster."; \
+		exit 1; \
+	fi
+
+	@if [ -z ${PROM_USER} ]; then \
+		echo "PROM_USER is not set, cannot apply cluster."; \
+		exit 1; \
+	fi
+
+	@if [ -z ${PROM_PASSWORD} ]; then \
+		echo "PROM_PASSWORD is not set, cannot apply cluster."; \
+		exit 1; \
+	fi
+
 	@echo PROXY_IP=$(shell make -C ../../network get-proxy-ip) > secrets.env
 	@echo PROXY_HOST=${PROXY_HOST} >> secrets.env
 	@echo GRAFANA_IP=$(shell make -C ../../network get-grafana-ip) >> secrets.env
@@ -31,6 +46,9 @@ env:
 	@echo PROXY_TOKEN=$(shell cat proxy-token) >> secrets.env
 	@echo TC_TOKEN=$(shell cat tc-token) >> secrets.env
 	@echo GCP_PROJECT=$(shell make -C ../../cluster get-project) >> secrets.env
+	@echo PROM_REMOTE_URL=${PROM_REMOTE_URL} >> secrets.env
+	@echo PROM_USER=${PROM_USER} >> secrets.env
+	@echo PROM_PASSWORD=${PROM_PASSWORD} >> secrets.env
 
 grafana-pass:
 	openssl rand -base64 32 | tr -d '\n' > grafana-pass
@@ -56,4 +74,4 @@ join-tokens: node-token proxy-token tc-token
 # removes everything
 .PHONY:clean
 clean:
-	rm -rf *-pass *-token *-auth *.env
\ No newline at end of file
+	rm -rf *-pass *-token *-auth *.env
diff --git a/build.assets/Dockerfile b/build.assets/Dockerfile
index 8158548290341..171abbb1b11a9 100644
--- a/build.assets/Dockerfile
+++ b/build.assets/Dockerfile
@@ -114,6 +114,11 @@ RUN (curl -L https://github.com/golangci/golangci-lint/releases/download/v1.44.0
 RUN (mkdir -p helm-tarball && curl -L https://get.helm.sh/helm-v3.5.2-$(go env GOOS)-$(go env GOARCH).tar.gz | tar -C helm-tarball -xz && \
      cp helm-tarball/$(go env GOOS)-$(go env GOARCH)/helm /bin/ && \
      rm -r helm-tarball*)
+RUN helm plugin install https://github.com/vbehar/helm3-unittest && \
+    mkdir -p /home/ci/.local/share/helm && \
+    cp -r /root/.local/share/helm/plugins /home/ci/.local/share/helm && \
+    chown -R ci /home/ci/.local/share/helm && \
+    HELM_PLUGINS=/home/ci/.local/share/helm/plugins helm plugin list
 
 # Install bats.
 RUN (curl -L https://github.com/bats-core/bats-core/archive/v1.2.1.tar.gz | tar -xz && \
diff --git a/build.assets/Makefile b/build.assets/Makefile
index 587054299b88c..b6f1659ef0f50 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -247,6 +247,16 @@ test-sh: buildbox
 	docker run $(DOCKERFLAGS) $(NOROOT) -t $(BUILDBOX) \
 		/bin/bash -c "make -C $(SRCDIR) BATSFLAGS=$(BATSFLAGS) test-sh"
 
+.PHONY:test-helm
+test-helm: buildbox
+	docker run $(DOCKERFLAGS) $(NOROOT) -t $(BUILDBOX) \
+		/bin/bash -c "make -C $(SRCDIR) test-helm"
+
+.PHONY:test-helm-update-snapshots
+test-helm-update-snapshots:
+	docker run $(DOCKERFLAGS) $(NOROOT) -t $(BUILDBOX) \
+		/bin/bash -c "make -C $(SRCDIR) test-helm-update-snapshots"
+
 .PHONY:integration
 integration: buildbox
 	docker run \
diff --git a/build.assets/build-package.sh b/build.assets/build-package.sh
index 17e1bfbc52eb6..22d90fd713d09 100755
--- a/build.assets/build-package.sh
+++ b/build.assets/build-package.sh
@@ -232,7 +232,7 @@ if [[ "${PACKAGE_TYPE}" == "pkg" ]]; then
         BUNDLE_ID="com.gravitational.teleport.tsh"
         PKG_FILENAME="tsh-${TELEPORT_VERSION}.${PACKAGE_TYPE}"
     else
-        FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport"
+        FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport ${TAR_PATH}/tbot"
         BUNDLE_ID="com.gravitational.teleport"
         if [[ "${TELEPORT_TYPE}" == "ent" ]]; then
             PKG_FILENAME="teleport-ent-${TELEPORT_VERSION}.${PACKAGE_TYPE}"
@@ -241,8 +241,8 @@ if [[ "${PACKAGE_TYPE}" == "pkg" ]]; then
         fi
     fi
 else
-    FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport ${TAR_PATH}/examples/systemd/teleport.service"
-    LINUX_BINARY_FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport"
+    FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport ${TAR_PATH}/tbot ${TAR_PATH}/examples/systemd/teleport.service"
+    LINUX_BINARY_FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/tbot ${TAR_PATH}/teleport"
     LINUX_SYSTEMD_FILE_LIST="${TAR_PATH}/examples/systemd/teleport.service"
     EXTRA_DOCKER_OPTIONS=""
     RPM_SIGN_STANZA=""
diff --git a/build.assets/gomod/update-api-import-path/main.go b/build.assets/gomod/update-api-import-path/main.go
index f89054b2976bc..0163e9c66ceaf 100644
--- a/build.assets/gomod/update-api-import-path/main.go
+++ b/build.assets/gomod/update-api-import-path/main.go
@@ -52,10 +52,17 @@ func main() {
 		buildFlags = os.Args[1:]
 	}
 
-	// the api module import path should only be updated on releases
-	newVersion := semver.New(api.Version)
-	if newVersion.PreRelease != "" {
-		exitWithMessage("the current API version (%v) is not a release, continue without updating", newVersion)
+	newVersion, err := semver.NewVersion(api.Version)
+	if err != nil {
+		exitWithError(trace.Wrap(err, "invalid semver version"), nil)
+	}
+
+	// check the version's prelease section, and exit if it is a
+	// non beta/alpha pre release.
+	switch newVersion.PreRelease.Slice()[0] {
+	case "", "alpha", "beta":
+	default:
+		exitWithMessage("the current API version (%v) is not a release or alpha/beta pre-release, continue without updating", newVersion)
 	}
 
 	// get the current api module import path
diff --git a/build.assets/install b/build.assets/install
index cc3bed422ccdb..dc6ff9d0cd39f 100755
--- a/build.assets/install
+++ b/build.assets/install
@@ -13,7 +13,7 @@ VARDIR=/var/lib/teleport
 [ ! $(id -u) != "0" ] || { echo "ERROR: You must be root"; exit 1; }
 cd $(dirname $0)
 mkdir -p $VARDIR $BINDIR
-cp -f teleport tctl tsh $BINDIR/ || exit 1
+cp -f teleport tctl tsh tbot $BINDIR/ || exit 1
 
 #
 # What operating system is the user running?
diff --git a/build.assets/tooling/cmd/check/main.go b/build.assets/tooling/cmd/check/main.go
index 16fb6dca2f6af..ac1b8fe3172b6 100644
--- a/build.assets/tooling/cmd/check/main.go
+++ b/build.assets/tooling/cmd/check/main.go
@@ -90,6 +90,12 @@ func checkLatest(ctx context.Context, tag string, gh github.GitHub) error {
 		if r.GetDraft() {
 			continue
 		}
+		// Because pre-releases are not published to apt, we do not want to
+		// consider them when making apt publishing decisions.
+		// see: https://github.com/gravitational/teleport/issues/10800
+		if semver.Prerelease(r.GetTagName()) != "" {
+			continue
+		}
 		tags = append(tags, r.GetTagName())
 	}
 
diff --git a/build.assets/tooling/cmd/check/main_test.go b/build.assets/tooling/cmd/check/main_test.go
index 4c2ab57368c7f..3ca92aab1b9b2 100644
--- a/build.assets/tooling/cmd/check/main_test.go
+++ b/build.assets/tooling/cmd/check/main_test.go
@@ -105,6 +105,15 @@ func TestCheckLatest(t *testing.T) {
 			},
 			wantErr: require.NoError,
 		},
+		{ // see https://github.com/gravitational/teleport/issues/10800
+			desc: "pass-pre-release",
+			tag:  "v8.3.3",
+			releases: []string{
+				"v9.0.0-beta.1",
+				"v8.3.2",
+			},
+			wantErr: require.NoError,
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
diff --git a/constants.go b/constants.go
index 13bf738f230b4..1ab18552fc5ab 100644
--- a/constants.go
+++ b/constants.go
@@ -631,6 +631,10 @@ const (
 
 	// EnvSSHSessionInvited is an environment variable listning people invited to a session.
 	EnvSSHSessionInvited = "TELEPORT_SESSION_JOIN_MODE"
+
+	// EnvSSHSessionDisplayParticipantRequirements is set to true or false to indicate if participant
+	// requirement information should be printed.
+	EnvSSHSessionDisplayParticipantRequirements = "TELEPORT_SESSION_PARTICIPANT_REQUIREMENTS"
 )
 
 const (
diff --git a/docker/teleport-ent-quickstart.yml b/docker/teleport-ent-quickstart.yml
index b68f11aa837da..f6b25dde811d7 100644
--- a/docker/teleport-ent-quickstart.yml
+++ b/docker/teleport-ent-quickstart.yml
@@ -3,7 +3,7 @@ services:
   # The configure container starts, generates a config, writes it to
   # /etc/teleport/teleport.yaml and then immediately exits.
   configure:
-    image: quay.io/gravitational/teleport-ent:8
+    image: quay.io/gravitational/teleport-ent:9
     container_name: teleport-configure
     entrypoint: /bin/sh
     hostname: localhost
@@ -14,7 +14,7 @@ services:
   # This container depends on the config written by the configure container above, so it
   # sleeps for a second on startup to allow the configure container to run first.
   teleport:
-    image: quay.io/gravitational/teleport-ent:8
+    image: quay.io/gravitational/teleport-ent:9
     container_name: teleport
     entrypoint: /bin/sh
     hostname: localhost
diff --git a/docker/teleport-lab.yml b/docker/teleport-lab.yml
index 46655bd0304ed..3298d11034d5e 100644
--- a/docker/teleport-lab.yml
+++ b/docker/teleport-lab.yml
@@ -3,7 +3,7 @@ services:
   # This container depends on the config written by the configure container above, so it
   # sleeps for a second on startup to allow the configure container to run first.
   teleport:
-    image: quay.io/gravitational/teleport-lab:8
+    image: quay.io/gravitational/teleport-lab:9
     container_name: teleport
     entrypoint: /bin/sh
     hostname: luna.teleport
@@ -24,7 +24,7 @@ services:
 
   # The bootstrap container generates certificates and then immediately exits.
   bootstrap:
-    image: quay.io/gravitational/teleport-lab:8
+    image: quay.io/gravitational/teleport-lab:9
     container_name: teleport-bootstrap
     entrypoint: /bin/sh
     command: -c "/etc/teleport.d/scripts/generate-certs.sh"
@@ -41,7 +41,7 @@ services:
   # openssh is a demo of openssh node
   #
   openssh:
-    image: quay.io/gravitational/teleport-lab:8
+    image: quay.io/gravitational/teleport-lab:9
     container_name: openssh
     hostname: mars.openssh.teleport
     entrypoint: /bin/sh
@@ -60,7 +60,7 @@ services:
   # term is a container with a terminal to try things out
   #
   term:
-    image: quay.io/gravitational/teleport-lab:8
+    image: quay.io/gravitational/teleport-lab:9
     hostname: term
     container_name: term
     entrypoint: /bin/sh
diff --git a/docker/teleport-quickstart.yml b/docker/teleport-quickstart.yml
index a78626201ac0e..a8e1a7a7075d7 100644
--- a/docker/teleport-quickstart.yml
+++ b/docker/teleport-quickstart.yml
@@ -3,7 +3,7 @@ services:
   # The configure container starts, generates a config, writes it to
   # /etc/teleport/teleport.yaml and then immediately exits.
   configure:
-    image: quay.io/gravitational/teleport:8
+    image: quay.io/gravitational/teleport:9
     container_name: teleport-configure
     entrypoint: /bin/sh
     hostname: localhost
@@ -14,7 +14,7 @@ services:
   # This container depends on the config written by the configure container above, so it
   # sleeps for a second on startup to allow the configure container to run first.
   teleport:
-    image: quay.io/gravitational/teleport:8
+    image: quay.io/gravitational/teleport:9
     container_name: teleport
     entrypoint: /bin/sh
     hostname: localhost
diff --git a/docs/config.json b/docs/config.json
index d57ae33b2a23d..3c409cf64aedd 100644
--- a/docs/config.json
+++ b/docs/config.json
@@ -278,10 +278,6 @@
           "title": "Guides",
           "slug": "/server-access/guides/",
           "entries": [
-            {
-              "title": "Ansible",
-              "slug": "/server-access/guides/ansible/"
-            },
             {
               "title": "Using Teleport with PAM",
               "slug": "/server-access/guides/ssh-pam/"
@@ -348,10 +344,6 @@
               "title": "Federation",
               "slug": "/kubernetes-access/guides/federation/"
             },
-            {
-              "title": "Migration",
-              "slug": "/kubernetes-access/guides/migration/"
-            },
             {
               "title": "Standalone",
               "slug": "/kubernetes-access/guides/standalone-teleport/"
@@ -386,7 +378,17 @@
         },
         {
           "title": "Helm Chart Reference",
-          "slug": "/kubernetes-access/helm/reference/"
+          "slug": "/kubernetes-access/helm/reference/",
+          "entries": [
+            {
+              "title": "teleport-cluster",
+              "slug": "/kubernetes-access/helm/reference/teleport-cluster/"
+            },
+            {
+               "title": "teleport-kube-agent",
+               "slug": "/kubernetes-access/helm/reference/teleport-kube-agent/"
+            }
+          ]
         },
         {
           "title": "Access Controls",
@@ -450,6 +452,10 @@
               "title": "Self-Hosted CockroachDB",
               "slug": "/database-access/guides/cockroachdb-self-hosted/"
             },
+            {
+              "title": "Self-Hosted Redis",
+              "slug": "/database-access/guides/redis/"
+            },
             {
               "title": "SQL Server (Preview)",
               "slug": "/database-access/guides/sql-server-ad/"
@@ -517,8 +523,34 @@
           "slug": "/desktop-access/getting-started/"
         },
         {
-          "title": "Configuration",
-          "slug": "/desktop-access/reference/configuration/"
+          "title": "Access Controls",
+          "slug": "/desktop-access/rbac/"
+        },
+        {
+          "title": "Reference",
+          "slug": "/desktop-access/reference/",
+          "entries": [
+            {
+              "title": "Configuration",
+              "slug": "/desktop-access/reference/configuration/"
+            },
+            {
+              "title": "Audit Events",
+              "slug": "/desktop-access/reference/audit/"
+            },
+            {
+              "title": "Clipboard Sharing",
+              "slug": "/desktop-access/reference/clipboard/"
+            },
+            {
+              "title": "Session Recording",
+              "slug": "/desktop-access/reference/sessions/"
+            },
+            {
+              "title": "CLI",
+              "slug": "/desktop-access/reference/cli/"
+            }
+          ]
         },
         {
           "title": "Troubleshooting",
@@ -526,6 +558,44 @@
         }
       ]
     },
+    {
+      "icon": "wand",
+      "title": "Machine ID",
+      "entries": [
+        {
+          "title": "Introduction",
+          "slug": "/machine-id/introduction/"
+        },
+        {
+          "title": "Getting Started",
+          "slug": "/machine-id/getting-started/"
+        },
+        {
+          "title": "Reference",
+          "slug": "/machine-id/reference/",
+          "entries": [
+            {
+              "title": "Configuration",
+              "slug": "/machine-id/reference/configuration/"
+            },
+            {
+              "title": "CLI",
+              "slug": "/machine-id/reference/cli/"
+            }
+          ]
+        },
+        {
+          "title": "Guides",
+          "slug": "/machine-id/guides/",
+          "entries": [
+            {
+              "title": "Machine ID with Ansible",
+              "slug": "/machine-id/guides/ansible/"
+            }
+          ]
+        }
+      ]
+    },
     {
       "icon": "lock",
       "title": "Access Controls",
@@ -1022,6 +1092,11 @@
       "source": "/docs/best-practices/",
       "destination": "/contributing/documentation/",
       "permanent": true
+    },
+    {
+      "source": "/kubernetes-access/guides/migration/",
+      "destination": "/kubernetes-access/introduction/",
+      "permanent": true
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/docs/img/database-access/guides/redis/redisinsight-add-config.png b/docs/img/database-access/guides/redis/redisinsight-add-config.png
new file mode 100644
index 0000000000000000000000000000000000000000..da0298b6c6f02c69fd774aaaf84ec64cce2bcda5
GIT binary patch
literal 228417
zcmd43c|6o#`v**fN_JT@wk+AwB3WjXWh^1PB4bGrl6^O19orC6S;m?qTgev2uE@Si
zc7`EhEHh)4XMDH2`}zHT_x=3&c)e!ke3tY1oO7M)T<`aFo$G+zF#w-E&3l@Pit4P6
zwuUhk)yYUIDjEy}9pw!D3<EV46*bsdUHy)Zy1L*UPxpt;u8vex5-AS0wro1m5?}1>
zY;C{vNlBje^fQi)O)$2FcC~Z}whDIHb_r&^w6>n-W|^lkZKEnMYOQr)Oc2C>kp1$0
zcR07?{y^<*tI?E@3lCCiPQ3}_Xi0y5FN?8|OyzOU^QO@$8XAYw$z|3y##HuxR8zv5
zYGCRqFSSi?h9H{QY+5@2b?K>7o^&7FsisbR<$<YP;f7F6Dd}i0u4}u#Z4zu*T0}1u
zusnY7*lFQbOMPL)^U*jqmY-RWJ9pDw<rwA9GcXpJo*Za=pnCqK2#tsc9o?Om>ZVX8
z+L#LklRS}@Bw;$b_zFhGZ|p4gI#+nOYiciF(w?~$TOw_1JMV61JL%gjSS7)_Mb+gl
z-Raz=#i9Ubr=i(sB9lR-@|P+NAKGG-7s%wfcoLcXncInUo-Udufa<-0o&3Tl2?dH|
z%^fXu9_s5;U8Iy5sHkI{sc0!Bim<78DIdxJJddWLr~I-}J{q|v{=RxLGMDD>G7aYV
z#+xSUIy#hJ69-R6$0uG+?%r<Nrnf1Nnshd`^tRN$t>obDCTsV=-QH2w-|gvf6)F{f
zB}&oF(c4bY-_7-jmy*A#@E><5QOd`s<%9+QxW(H=RoGJhj-a}`r=y^P>?PSt!obsl
zf`TfZ4<0HRYiRvdopPiq?BwnJR7p<G&(BZR?~1Iu=Oa1!8#ivqUAioH`LYb<4jHe2
zC*F4cGEclj{(Q*a&(U!7a`1G1>h0|QMDX~zcJ}T*-m1dF$1nQl@6UER`aA#YO;5c3
z>K3Jga>rNX<Yh0({qt-}Rh8qjN_U+79bNBgIJ;5ALwN^K{*t`B${!W}$EAP0^0%s%
zzg4{|fBE;Szg_x&S2go;^i+3uqrB7`_^+|~tMcy`|Ej1Wcii{iWbvn<|2RvLH1M>F
z+&`lRJnhD@JVQmLMx~>1)6}1OGn>BdzGgj1you%c;4Nm_lHnk^6Q?EYZ{9SGvquJU
zZjZSf_IwI5E1x9$c1FL=-4kxo-PRWj<8amy+!w_SxQ_=MlKPc`5FZD0Zk-4~qV7I=
z*o^D>_SxbU@u8!y?l}=#+JrFHODD8i7`Unb|9@cln1S)`<5v(YOvLxh=i)0@GuBXk
z89&hZ?a`rl7MvbDNeLfVFSzkbb56I=FLY@eGcbYJ2K60D9qRos2_f%ex(DVSpIq1n
zN71;5Z=KN&`B79e0kMGw5`S(3@Hu8bWL`sy4iDv^<lR5NDvHR&(f~i-G6&jdAJ_U|
zZl-~e2Rrbv#8}!-`}5!mIo3U)$!<BODoAKrTs*VeroBOkT{;q<pN-*zW&^Uou>&9o
zw3&Pr7VjT|C0YFtArN*j6C3c=49*H<BPn6yarxN_Wa*=*90Z9p)S+&PJ<32r*YR)r
znT{J_2qjyeLqa_(lGrAYYxPO{#7ool&HO?wI{EAuW+w{-6rD!o_<EcQxU(LxO}#Tb
zn3Q<ojs21nI9e(Lm>w-S>(hag;>Sv<L?!;ZOahX<W!AG|QD^qwT37);Br1%uLZF;X
zg#CRByF4#-RQxumnY?C`?<H&_H(FrhhWny0eFq#&E_pg%u?^xpr*z%B8B1C^f^S_=
z5?|cErHUSV0e3xq$syu2Jqb@T`TzVF##PdYhR=<X_2mG0!`e`Lr*b7Dti@S$)+Kz#
ziCK;pYmlh1@(f!EzLjD9+gLU(zVwc#q|-Ei4{0+Qk6S{?NkybJlHO8UH*T)4Kk#}2
zqMy)6df!ixXy!6|>{?Kat~ZIaunowfA(2+LA%A_19UWO%8}5ALK!Aywl3BEJ3JdDX
z5e_@;1poOVEw};ECuHlfc6E^rSEpKq;%ItC=(<_g%gM2QtX{s%enYMZUB2RIHWJ5k
zhAW-bWNA*tJ@O0+uA!ux)R2q8S>)wo;$KuyhCQ%rt?>>|h2$KRB0>b$*pEUy-vH+v
zROGULFo94~IT)bPI{*MdDdq9^4YH<PLGKXAP}2B7Jo?E!Vj?OIfn<Fp1`H*cTdt|(
zub{T$$+%u(*uX3GLzs1l$Cr2*OA@)QHJ>3bfve=n7P`3aq|DqT93V`#%s_g_<q^B>
zk(b13>=$DsYGxVYa4W@^r`aJj9fBbFG>`?Kcqt)!4tqpc>T!yzK%xcKj|_bb)^d7?
zW{3LemTSQ~#EAhwwp1u7khrj)F@dmw9v#IXp=KKrq}||z4GAcD?^r)wZ2+TtA#HQW
zi`La|k`5Dn=a7+w<8zbiq<GLR$pqN>r4d7`ne#PO5Y#(DmBsy?f+T{G;oKR6tLt1d
zEtoJK<rtvGs@nYqf8m{*JFOx^&BLZ4N<wR>mK<a8SBvY5W+Yc*S}X5KqaIm{URb{3
zq>xg;RfUxTgt{AUJ#s|xL9t?oX(;|di~wI}9&-u;V_|v5ec@fr(<`L08wD6$#dVd%
ztX-VNeZOW>FnP!)Kd5X=q?!CI76EE-$Ky6oaxQ1fuJ2i!Ssk9O05y{4ZSqiY{p>%$
zb;W_im3=N$%mkuuBXZ-Ji^ic*1yZeJL+;0QNg^R+p$z0d?x9^*zE3EKgvJkO106Ib
zpkwby!`%UbK|QVSk-tRzO8M_LZN{JD>LqDsiqJj<Hu~SZ0>_^PFi*`#jD8;;DQ0Hp
zTWHe>PxM5KetoAUy?F!I(BLEgW^<@B^|r!AFFz3waG!vE4&Lz`!%+*x?;PS#8v}=c
zIcRB+UGST=fCUsBfwX~MoiJ?BGX0P=h#%OHs{l2TR^#55bEzs5hy?*;D!yN81Y-Lf
z=&!G(C=5}3z%R$G0bYBLJQR}?(J=k)k=YPyML+1GLbDuqKpvwxAT|tsCZHt=kk$eg
z4<hVSuj^eV#;Jd$f2V>j=nH42zaF}|oKdPt_Z&jniSHinsR&Rc590`lP#+?efWg&X
z-9l0%P7Dt_HY->XhEM^e*kIzsA>>%+_c0R#ltL%6HPOS+a+qKR*<fBdN9Mw5;LHrS
z`*Gm@9mjheX>z?0%QQE!EW$9|Y-SiuUSy>v91gs?|H!P$u7A&@=f&kNF4-NL1maYq
z#S`z8OG&tE^t-kn6?fU=X@>aILH!VgNh63gh5`o_UcD%Qg#`wGxIfWIM)Olsgc$q>
zC_pQq=R%0<6fK7Y)&vqe(QO+P3~*s9#gochA~Ee7hQ|^OwtEk{E8^K?+_f)!s2KSu
zCnxBl4|!?2o1SNLAAn&m?kBU>0_k>LzBQ1YTszbTCwz(=?qWq2z3y`B@kg|9_y;Ri
zl{3F$Rs%HRPu2kMtiH{p3YlCOU_}`s3?zb`M+{2{*e`$|v0Kg7SG&OH^8mMAabpE(
z`YLX865=)pU2`bN_6D+HIGDH&TsVSnQ>=xl-$@WOb0foG9ApFCvmviHqmR2`0}UW{
zhENSPeRv!|EIBGXp1y&^yFWM^Nx`IXM3&ckkA=NDdJoV&3OYPtn((hrZP+3&t9=n~
zzLZ1e1<T(XCsB=lkO;dtPg~t3`E(sjb>D~ZGIjNWs=}U!=bejUMXt-KW@q^bgG&(-
zKp$KuVbte@79Xy**HF6e3@EWG2LbGg2>DFdbCLbvL1NTBM=_MO-bw4$l&P34Lf}+r
zCI!xtTe^-_*=Jxr_$`S1CpI#dC#>@JZB(3Qu0XzaIa4O@Ew_&^RRUwBTpLNd`1nV#
zEkqXIad%3B#845G$>|flmC-wb*Rx7ov$ov|eBqfRINzpPSg{}D>S$=?k0z<#?N(SV
zM$GgeN;T5}kg1Lj-(A<aUe62zbgn&P;C{^@4PX%ze%H+gnGRM9rmB*=&ga%SI5U<6
zXvW)zq9@rbeD(|4V|<HooCPC<*M<f|FXO#=*^4lK2RJ@5I`{zB%{hiyokQa%K1G+I
ztCoXz_ff~=(@ggLK>9_Y9e|vsP|~i(KBgAA4Y=nLmX5C4!?*uAQ}^&A8v`rO#1d2<
z_WEl7>$o5xw%)qgcNNHW5iRMel(oBhR{Pvm1CW*Oa$u4<uFC46Mo0Isz#ZBbO1bFv
z+@xGovdz41cj6tuX(d`d?;)_)8)hSb&x)Y9Z#7IRB%#P-Ws8kQ8D|^Ad}FXPt19O+
zFHjy_O6V!uc}&3O#UD?Ozqrz$!0K-8)zL5kuz`92oqm>lqG(Sa=GF$3LR7YSNTk;L
zAMaTiqhIeFR-g$i0%^xXvA$nCf$-?#*_Z)wb>ky~^c%^;T6N^L`ZC{d6%=wt;Luwd
z#sESR#^T5$AB}J@Nq}c(@F*+Jw5*75ohjIv@#LjyEUiC~mb!29t%G`YC`>IOB(C6c
zj^GIZ)P87urX;mCmB4Efyl?GbVw2uc0C(_M8OS>=7JmiG?=FsY*e3MF2N{8&OLMq=
z6lQJ$d2Dr#Spu`mJJL8b`#tj5=G2btBab`gPr<a9KMPe4#vzM1%g-Jai7t(;KqyRv
z6##~fPC&DlA2kimq2|)v=suGYf`uG{XCq-UG7AyqhK;jb(ag77jPp}%<rdAZJ9ox<
zwMQ$E_Pjb2>+cqZE=qtd#OzAZUjXjy(6F=Z$s-Mv2q~o9kqYbA0Jrruu*4Vu1%X2l
z$gcN_7c5ByxB?5=PCt^ESX-homYcl#>7=YRI~xM3O6dgY9Y%d3rJsEcdQr5c^KcH$
zKSUfGK&;-#+lV&CVvl=>ieLg!@IVsUMEZpn2_<9jy&G~{@W3Rr!NUHdDB3!I$^eN^
z#ExeSOyDzBb_gR)udANMTC_9S1+R4?Kiwm<s2`H8Wp;L)eTdzJQL8=#_XiVb2(iqg
zYv&6XQ;Mpn{fcQkO=Ha~Y?}sg>uRIFkW3w0V{ls6)knj&1S7;?ihE$Do}U=Jo*+)q
ztPek>Kp{N?STqhcBnuVCSlsTr54`9=%Id*gp$mS&_J_JbFajsf%_y_{P=8z7Krvj!
zY(coUd&FXxjN-GHZIGZ5?05p<N#7g6SkeZHdB8wp;0`*JR6`=sYuP|eQKv1}vW(XE
zEikh^KFfbn6t4@WyY|-5jewRJrFybvrul}P_s<+;?%Uw9E#%V|i{uA<1E645Z@hGD
z#F~IXQx4z<MvQk5lU~VGsP-I~L^H^OU!>Qu%FRPT==@c!0MVO{;1Xs)&~)skDLl}-
z$53@u-0#}}lCiqi@Ef-UZpr_HPF2czx5E3On{=;1tL>nguTlNDoB5JmNSLMyIfR76
zV~EB0;U1r%uSC$S`>`7$p2IxjNF?l2EI`F-V8k(TRcR!lam4-&<_eIY?XjI3+1MuG
zitA>Bg`nj5z()j{dNPLNrwa+~@`*IeTSy{w*8CvG1oMjf^7n)bl+-#}?3+W=tq!W(
zVPir@2)PAy4O+S)ZEM|@IKkzIOYv;P6AI6I`ofr_C;9i8g-dxo(jf|ISP^+p085BA
zRuUArE0kb{TkmE%Uli>1X>CvsY~z}SXbxW$A6MIbgn5n_#w8;EbZ1Nt-RGc0iYHTB
zZ(#2h?$p%wF~6C#^QS>mhLAS`^Y`%IH{2_bO{9b40#*b{ULzmTAL^CqEzBw1g+BZ!
zJRkoBG5}euZbNeWkz2tV5Yvu0++D7bF0I2o#qsw~e!=CDU2rH7(=8s?l^f8}+-dVj
zZ6JezHXLjPND|XSXdF~ipJ(-tyUF)iqGPntw3`X=Y26~z*kd`vEHTw!$yC5V7>yN5
zLl>0skEUB(2*ED33t8b)0z<v~Aq%1jfA<DU>K$o4CgM$`!RfG#n=Tj8_xwusD09fL
z0!gIMCM1D4GKb6@(8VynKlcqO9Zz6KoY_z)+fiD8?)|v40ZhNgSJOatFhL;8&!n^@
zoXj*Qs8^fu@1~TRh1$p7e&No4ojBZ$d$j+YJ-l)GvMJSNp;M`*Hu~Ixh3v7_OZ4H$
z&B^?m^VC2ff0lHd4iAXCvjPRKsOu@I+3n4EUVtPlzeNqai<S^@cvBwCy(W6Ig0RNw
z%`XpX-p3tMNY31ELlYh>wNJe6kc(-h7>R(^`URAGRQLp7>{{E6zj*v1f#MATej>@Z
zBMZzc^frR?+&%Xlm7POq1;_{JPwe9yN;4Rrn=zSIg%*l4<sZQp^VwI|Ou-dL3V~(N
zp|J^Q*)BUcU$MGMb1%T8+x+KC1kkfL=D?nd^-a9$Q<+>fmH<8w6?zZ+)B_Bk7vY-@
z<LH(dq!m_>f3bLHvAF6>4qLVX6Pn?GAJ26PXBT524C+j^@iNN{WgYKGSM^z$u>1wX
zIoI~iJtj>~U|eM5mI(R@6lO^}B9xY2DF;BHeMbQQwPqtqCrBm>g-4Q>Le1m@>&9by
zh@7DK{BO6othtU2eXG|P1!s|UT!MdahHLB;&M-HIo8Jbg;)+)mjxxrz(}*FY251eQ
z6lE}xG7f2|*&`Hbc#}KnQvm*YF*ypiR8G}YbDmM%xhmFa4$EFNd6!d~XubBL?o#dr
z$qsm`N%jX)_*+A@6VHKac#XFHUY}5H*#p!=>MUmZ?<u&qAF+4G9HiwzAsr5lYp^_Q
zTJ=|0GNLMXf{P!&V-`vrJYU7KAg$c<65;#JFk4-mh3G-*0qi(uKyG-&cKzw5Z3NuM
z<6UOS!Q?+2vtw<2yG3)%^VavT&j|*Gl6MZ_Xyx=~hfjD?F|g7kd-!+)ipWtqO2KSg
zOGxV+avDm0ow>6PC+CB9q4PbewV~v`cfxC}{4i{(0Z3j_gbW5LF?lAZHef+3MH*}B
z5<7{3Ip?b#48}e-++=j9?a-jP$95{VOg**eEcc1%Mpo_+iQN%>Hf3*Z>&QVkNLbZv
z#l&^`9R);oOc+-($`+keK1^Vju(1U@+Hy#4FwShTxc(ESSFBTPwOBR???8G9pR6it
zytsjbnE`6O`{z^!68<nVeL)$=u^VXP9G+tR4OIYpGiK{3cZ@(A(bOf;|A#i}7{RUO
z8hi-^Hyh<p5+2vP-{LocZG;^fp&NWn@wk!3XaeD@xc0gJRR39R6siJ&j6cFjl_z?+
z=1w5Cys+a4=-R#P?uKon=W?^;*qHg44s5j#X-ORFS^%`U-otG4zJVZ-f+r01n)}<v
z7zA+85bZgiOP{iPep{<(*Xh=BVbUF4ImB=ZnSp!yLwt?>&z;mVUEnwW=Mr>4w$8%)
zwVK72Y0Jr~^05F6>LHxj0w>u@EfhU_)m%DV9;Bp!E9oXo*7N{=eqWg&q+1kWt`FQ@
z8sI@;<ZKL^Nv{t<fBGoJhZxYT9Dz_aZaU900kVOnfn6MADA>16;WLo28*JO+$GXnC
z&3P;bD->Xn*mjI1d#XR98cFYRB115ctPO1<;nA$eF>kJ!(X&!D*%=Bk-^rH&wxwS_
z_zEoT{oeM$<aY29zBUJ;P?M&eAa1oc6n$XN&L(?`m8xUB@Fk0n{<+MTkdPr@=2h1R
z@qm10-a&`kduyWDQ)*~@WtGuw-6U@D@tqVmRgfE=)in(Ql&|p|j6vA1K86$49By|$
zKVP(3QC}jrnqd%N=KCCinXr`Lgb(9N2L`d%EBN|Z5zsNBxDB#l%M_2_Ad^r>%zjho
z`uQU$=57fp8376<{n|YC9p|v`e^CI3x%oTA(?RD2K6(73Wcb)o3wZKarU)ZC3wHRi
zF(78%_HAQ8(+c{mppt(L*NvMz4P6{XkmVI{YZF8`5QcZ^R&vWGUmSAQJ6$efFO1ED
z4*=GERE;iz4n|qgA7D5~b=cbu^N=D34+5-XeKB_8q84pRsLY}W%jgpQ-EH;&K8Mz7
zn%J<fV_o#(gS6Z?E_4`YhE82XZVozt`+ad^asXYNq%Z#!V#lJ|1HEhleu8Ft2!dO(
zULsV%g&{qGp<VAidYK@7fFO+!4-y5NP5`@*ZO^>&WtIGb|Ktw=1M^CM&HKzl%^cR)
z34kh6dyNOZZ{bD!x&H`rck!5k&xkaVWZ`fDsP}f^9{yv%0F~&m=W2b9;_}5?BN9&X
zFp#4lpHYy;gA$R8CGAB%m!YmZ6h?8Yn2=!gOaO)}EDd}&6DMWm8e8Bolq5e0M$EWA
zjoruYoxNv2e3SlEQdpTLAI+F;dW?cv*H;HPAS7+i&hY$AKr4$=AWKh19Yf&MU>788
zxckM~<z#@5_nxyWC4M1=u<!QWdXm5ul2x(mz)s=G%SCeih)@j-9QU?cL80wT)2~}|
zkkHj_LKgzlg@Ry6OB-?smb;YD*;esRsGe%gU-4Vd&k_?+6gUeR`O|wUZ-#pK&A%$y
zw#1W`j!oUlHiAU@+SED+A`(rGejXeWGf{N;C<YYMz`cHvGEhl3sv_rF+K0R(xtb1R
z05Ntk5Bz}LVZuwo_eXS14)lXixp!GVbfsA1OGRBZXAE9AUaaX$xF?mp$0bX;^Bb>C
z&9CD{Vu#MDy1}N`-qHw&pDiLhkgKFJ57}w&M{9+md5iZZF9MV_em3t~yy#=r^LSOe
z>ynT~wa1=eENr!B6q&tRfa|`|W1}Ds^66|TuORSdEE@G#RAnP^b0;EUzl^_A<^l)-
z?Q@C6bWA{wjwn&=F|V74?7GKcAJ|q|C<%)zAipT~x-}6$eLUm&22TD^zhQXn;#h1j
z>YhTy?hPBEXNGXgl<*K`&X_hvm!G;X_xOks?{Zh+@@8I9ao#6HVbFV|GuviJQpc;#
ztYzcdp2IQorALk4@*rTWy%vPx{B90@HFs0BQ0kKdb+J3>7?uEc&!~Iv@7OClu?j{o
zvG8BB)jfN)D<g^iF@cKX7O~;guU5NK?zLBq)1&JdOsZ;MV;ZzatYyThm1gP0Krz5N
zYZ)K=Pd$dNO#3c`j^d<I%toOZWHSR)pO0L0kb<HaidHW|cMH@xAYLz^W8XI`mLLO$
z{7g6#utYYptrcs5diEy^P5WN3jpT{OejCFS+&Xr#5%&;lxFIwSem>?`LDHQ+Vtc6Y
zehRaraBWP+X9o;!aT}zH0B|Z%BCy1Y0P-HD_By!*6V<)}&mp8tK=d9Gc@U6$b2Z9j
zOV9|{1Za(AZ&U=@{gKK_L%x&e`5CK~ZY>{I)Cvt*0xd39zXr$o^v$bhV~r}^G7wpD
z5X2eWsG&}#ND>79UZ9cXfstnF!^@*E$>f(REx9AD8Z4XZ-R7Zb)m3JY@)x1&`$7&8
z5=g52GG=w0L-6LWL>vrefRo&}E64~bKTy)C)VvCvetiYE1k=n?gs!xRuNId#Tg!yB
zaWvV#g&X5`%1{&BN4<v7j=MLC#Nm`h2L#mmRQgjl!DH<3n1j9xs@Wnplg%e6(ayd{
z^oM6um-Y!0UN4M81jSW-D3K%X(|i=A3L%gA{Gll`SBQkNW{N}K%AVgKw)dlRU~ZLH
z{ZPN`N+Ze1z5t_T9XkPuhY~w+Zwll{FqhgS5P~^>AK;@(u8M*#5xO$?Cxt#(0P)G#
z8x)4vV80H`4<&db(#vu{afxMw%16QSAYXYT+NgpsRUK>Z0(_0Y)0<wL49j}l)iEf@
zlVES$#Z1lTed3vKH5krBEuqoyQoVlg6zx=LV#Q`!%=3ts!FPB8N`*Ok4n+thdN$&+
zdgv-IrZ>qr5RJ8!Q@ubhp3;@iX0>l}+AzHb-n8owqY*Tf=aLQxLR}{*ZJXi=nEh^5
z^_VT?i$0JYV)t=4GO+v+g+!EFcq5K6MXmxAR6(Y=E{Dv2tOSK@8?SFe`nCl;R4Kff
zQ}&)klVvk>hezaRKh(e4UtkSCNEnm7xeLe^Z>U|=Q{9dFP{!W9RyFog;wzkm%LuqT
zQe3k;{*w|)`Y<p?=b_&O1h}RnjCZ19Hm?Eg8Fd+&C4`~+S>bu{>_vUyXNf0XDLu0R
zB)dv*D&y_p9nHEX#0yLwUn{Va#ufs2g)iNDm@0Lk!a#Rg@cR_z6*sesS_&H%CPgNb
z<@y1tO0H{<NDMw2fn$z*dO#;sMdgX&25$0c3bY<az>i@BvC12+T#!@rXK>%bt4ytL
zV<5-H<A;>}`hG1E`sXTC&_f@3H&XiSu>;gQhkWs48xpMWa~uj^Z9c+yxB$z)c4y=2
zt^*k6itB3b(y!fv7sXmGO3@d&dVU%mi^=hi9Y6Q37ycZW9!TnVi4`2~JTe@+(t;GV
z;($d&CY)4EM~_6NNj*p2j;s;u&-@&0yS8M5+=G9MX<lPH1ENkTE&5~3ft%a|(Ktm>
zKt;|~=iy&x6((&DcwOGhhZac}fZ;aRHb#<##x8NmzQ5J&``$t7COo7mf%r~J_NV#5
zK7ZBujkt-6NsB#Nq1D;QfF1_%^tQ{3qMLiTE+9IVu;DoNU8UHG54r>xIFoImB)5o*
zzVF)IVE;v|YbZd14>x3<V;(xJsf@cAx>=AU0cm<4nCX@KlK><y1>|9LQJN}qmGM6<
zEf}Xd6qT4AML^R%BRz%<PU4VGc*rR0N@<3fyBAY+_8bbTBIj+h-WZGG^F3~qP$oAR
zmFKz)whFk1)8YELT#BuNE9D38e?YtShu2_^2yj$Xzf?BYPH?+yjl+HU2kc90Drt!X
zCn-ZI(0YD$Fem812%J`7W8TzvW6(DgLEdQ`3@E|~=eSRH`o5QncD3ivj`@%Ra9eR+
z5x-xZTCvzo>GJMa@4MO?^wa&@7*GzEQiZoo2j=YO$t0i7Wc`E!%pHZ@f-)5!Bq}Fp
z3+6oXMwN(Nf*T$mYOOqHMvn$(y?}q-6?$^nB3_Ndp62>j>N&;hfJs<!Aw;46o<^et
zaBt{^s=U7mkE#cUmD}dqR4WfBuX#OWkM;RF(@j(haarijq9C^fyOC@9>#*S1JeV!q
zmOV=0fPXR>9Jc&eBnC+9{mvnNUN4Jgw`u}iTG8A+8?>!zcd$9Np>nkO(Ruv+-ICH$
zsXhb<$v@R)|DV>dTjCkQ?b@R+B(aKU6%y>7USG1i#jEVQ*^bKgn;n6x9!xq0yyIF~
z+T4<i5993CIfZ24;oDf0mfUHL4%H}Pu%6ycBw}?(D+r4>C9QTUcKPl|4tuK^Oj*(t
zJ;-M~omWQFv`I_lhW?P(!DZEzucMBB+*Usw8*x5g5&QJZ3nhg(FzhD@HyL#Fvv$to
zW1qrz{CY7$fZV}uSV*Wi;XK<I5XF#0_Dpt@`H!pcjoK_>M@vz6>eOslvgIALUMu@;
zVf7WJ9t>l5mPXo{LEp-0p2i<WNye8(Iz&R3S>_l}Zv)E}7;MqWEogSQ&MB1SlQiph
z@!w5fedf(q*%PYvak4Hd7y*e2BqS%$uwELy#y}U9gSBrhO06IacAr{#D8f|pI+rRh
zQGkjwRb})V0RJ_<j}GS_A{OCy&+XG#&A@}FuYn<f_bS8o{&On9i|e%WbVAXnZ?96t
z46^FRd!#B<L{r<I#xt)hl?1n3Ym*Tc_AhY|$uVv$)(tl00_l7ex@@fS)*JgY*J8$6
z1~@6WXjD>=nr)xIZK;v#yE*9gHhg4s9@ZIo;dQK9n?b6RV}$I9+^Vk#;QGt=u0uns
zG{&L$w2ilokYCh|JcMso2GVMuc_BLgQ=UWk3P1HM_v+7u#=gyauax<-{W!uNHC_bx
zkW4h>95)MONtZ47B4vCuW+Z1W)ckspHe{&s(EK`~6KY?~z0696h2CLHJ$p5bVd|x|
zhIG*vt4<0{W(RG)<oD6VbEv!N+a#!XI2Kq|-&kvBQeBD0`R~hq-n<-6d^RQA_8+x4
zjFsiY)96i!$_bmGvMe8ZltXH;cMph-&Pqe&jbg9v_hn#bOdJg-S#p*G$j-O(Zc$}O
z=c=skR7pj_2Vk8+)^d9oPXe8!uQk<MI2(Xz>g{>@B!gyjx4?O~#bkD)&yR~b1OU9u
z2XP;bLY4hB9^xhz)Ia@~ln^vS%lZBs)u5k*H<t=GwQy@`P|-B35yQP5#Av5STwT#w
zcgg0o2CO0aS7yo*2iH4nTy|evE}-&KY&b*2Bf-~<G)1!6VrgcY^kK1LI($}4-f3|Z
zldu1EnPu~<<agE|KHmJx=AasW`Pu%B_aFPEElK6&<ui`*zvrv?R|&RMXjuJw8cWNf
z8r2pHlSkA3cxJ|uTPCwdqO?*;yP@%8){6oh&1^72aoz3oz4&&Gm{_t#1+dO|(a5(4
z`B-JD=!zX14J#clJ$J|}MjE=SXJ3Zu8;f2dQFVng4T(zfu!qFrotKJ3@v*%(Wi@bi
zq3O_gLiDe=?8fsd_Ft0sx=u;Gp|RjkRp7rHl63ejJEQ-#yi~S|o7U@$LpGk+gf9gl
zOZ{htsjd1A`O1xOvzWDH?}NVf;jb2F^)Y)Xe!Sk;<g4z73neZ`dCsk`IaSmFcV9+B
zJ_{z+NgLL?*e-2cE&KUTXT!O!pHScBja41FrvnKo+bm#$=zPYaw+pjW0z9W}BhF&?
zQQn6?{E97*_%Y`nJ`?)l+1|#l72NKL3r$Zi0{{k6<#qNAB>V=~4f9gb?{2mC7c)xT
z>lUIr-0xZb^P1z-pcneI*p&Kj7m|7lzKa2*ofd>U4Id9N`rWAg3{i1@a;}wboS6^(
zG_4wT!G?2-4MfZ5@v3^L7gAr<ig+F|iOm%OHc+3Urn@N0%JQ1uExeH0_;LOy>omi`
z>oB^q8ZmvV+(kJmuTR*K@+-fvxfw(>1=@446f^n2Ea=tMU`r*BG9Bksqtg~sPp$=;
zF8cRjIfv;<IRC&#y>@p%e2&f%*BkfqW9bTaO-weDt_RpnKlZdxdhl6jeGV$Gq6)lU
zxp&@uAyUYBJV@(Jl*^S*Z=@}u+OI!{ie>omyzUByKH<Gw_Ne(yk;`v(crCHTqx-x?
zTJ4Odp3>orR}eRUz;cT7n3;t>nScU~Y=<6x76>6;Q<!<$ervLa=@yn^+zrUsZqRU1
zhRyVguooevo{87SwZA|4?8d9)?IaY5sZc96D$pw8G`F-%(U~DEwL5<rGuNX$+z?!~
zyKRytL?UiOx7VO~ZjC!#&VAP=Zc|1OacaRFQ10_v(=4@E=IK|p61e5_f)p2d7C;M^
zH5qjcPt}XdUa^SJ_BYu<ump})6>;Rn=Wzc*pu6eL(|b6pTXrebFer7JCJhhGA#xZU
zpyOsBnD-^B@SAcz_HirY9hFNg)QLIVvFJ30BC!Oxz4P<Ef&z`0MEfBzdin;R?gXAI
z&aEeI-#g<@S1TM*a7|;U_KKZ~=iA|q*&Lr)#wVI|V5!(ecKDXANR-y*`w2{DYuT51
zCpsgQBh`Z4_eTK8p4X4x%&=f(=Q*p&Uv6R4xYIld9oIwn=!mAv?az4G_IA1fhAef;
zo0aO*LEBA7J6rFMmQxK4kfi;JGj=~-buWIL_L;cP4(@Q>(exAjJ%25{D2j^TKD6H3
zxF2Z%>;PTn-+4aTX%PqI@Pi2`%e*g&sf_40eN|c{+xFa8MVu7tD!I;Op^Myf2*#~!
zk&4)LKL|t>@-h}_u(RL%mdl;sD&g!B#_OHX?Y}lrR|zB4-^HIa-b`iQ;V4*s4T7k*
zH5E77wbj|U(;Zg7y~p>+7(2MLH0+-9YUthPyrA}^Gl5M!Gi!|Li5La8n5{}d;;QbO
zVVl*T3hyT<@_EnoKD##UOO1%^YNAK{ZwYyH(JgN>pS*t3j9Xo-9y7Pve;Pd>(rY#Q
zJenC`Gb{S=dvujU_nUSm<@b$0kG{{56#8CWDUM-IEY1nMNW=|5Wdmy*zaXcxY<8b#
z6rPc5tYqm6+N=V<zU-*Wd;N)Z;NB2;#LVKpSxsb%-Oo=G292;xa<5I`W>xoa0*~s1
ztsE5BJEAL9mSzAV?(J1TiBdZ+<gBi!sSIS@_{cJpVeP5&EUo-Z$JGN|XSnyoeZPI-
zCZ3Ug<?Sr<yN>CL16IRa)=zH+@L~JhL%l?1GH3VRd^k&MrC*J)lV)43KHB=6@l!H3
zU`UfI9rAIt?9uLyn7ozVr3vM&I+6PUE9sr-H*OZ90E&_hQMTO{<TFnS5*2j6yMEMP
zN9nr;S2P_=Ck0<q$oOqqTsrZ}$IUbLSNyN%)32$SF7GC<Eu1fqy{`B9SIX57Ef#F?
zG)C40!INWe<W|)Tk+HUTR*(F+7(;%rJbK%3&h>%2`(}aRZCSC))0YINQwT+UwmU_T
zLOG>K->mnG!-j}WuTSy|YczxWCzDAB@0Fc8t2)-Tm8w*qZX7Iosp^Q=+*iKzssDjs
zO}1ur`aeVY%N`u2DYtQ9mQBllgVX*pNl=cM{F$ZFl|KCTtII{z7&-Y`(TI4Xc+kBE
z+qH9{D~WcuC*KK?S)K;|*s!tCwyX(PTuxSJJEBuxGkAF^PaYVh(e2N@-2r1C38xpZ
z+${gR)o_c!oq~8#cV0C0WHj#;IS;5FO1rCJ3WQkN1NnIQzBnI<N5?iF&IYj`eYsh;
z^?AGbr1+Odr(UXI4^~91bhRO0AWTn#f4V@d8Yl*@_p&*I-vKz<6?OIjkbXJ6BG~aB
zl(>K9YhMlD{0SgKAf88VS>d~rTBCZPNC@s64f)@Ic`aP+dWHmvEtEA+gC3#N)Nho}
z4uGAliLEo)c@+l+iRN!=Tv}4+Utcibq=B%)M>(Y|f<~PWB}KVoov0Y&3NIFkpQE|(
zBr6T?C@0Jvgs&_XeS<eeU2`FDL`<k?t*W<}^l&M!fWe;)r(8Mmlv4GTD}T7U4f}~@
zmX9HSKJ!_8^xbdf<c9B)?|!0(y#M64_MSPxQtme!@aUPEBjA2beAt5(xBCpYzf$;l
z4uwyr?zTT^%vN&jNgIx8&Q_Zg2wcmHn&()LQ+4N8e<qx9-}kQ2eVoztSc6%?Rq*02
zbWG~#CuuhWDeeB4KNP#*2$(gm7mQ*3@^Cge%GA-u3$<$nP>sSebjV{`4qrMXNs7t@
zGCZltpO2?1RCJ)M$PjzK*LEx?K4ATX%JMScQPy~(46xUI(y;!<n}kDU)P})<__bT1
z5v-Al?)OufKX6M6ehCoaex6Yq&C1}a{rEukToqGZBD4JD8GH&@KyoPx+f^<HN$f59
zNBt;yzH02@TR#Wp0SlZWesN5@`YIQ)L^aB>;GNVpR@V}Bs<za3Ndi_=u-<R)=oaEt
zDY%`Z{@`i30@lQPPbiI;nm8q4aJt(!A65cs<x%m$3q5fbVblWdjf|6cs;f+(<p;Ya
z!D2Gs8K{7-MO#MbKgI(BgL`HgKpivI-s?RO#&gBqr^-4xO}CBZ%KeiZ{_)zRxfm+V
zXd^F)%7}`72dQaj-NKTNw&fy4-IqS3w*_vLS!nBQPM^}au>67HI|WC}So)H4*_zhh
zDRjt(GAzHDH4R<Mi<xF?V+LYvg+2*AW>%aJTRc<3h&v7AjoJ~x3Qp=HfK82#w}U1t
z?N)xyP~r!<@=SXnWs=JKuatZ)=IH`=pNT9{yVtbXy2MKKd>!X%-2c3kr2K*=|0tU8
ziNu43SYHNPCYb&Hij>vA8ykJvhB=mKi%5qAf=IlnqIOE<B4FQF&JEugV!X(X>zQ$N
zRS#F)sbWRyoX_L%(*7D=&Pmn{K0hQ^YNaP0S$X0V6=e^^RU=DJ^rT3bI-d|+EIdh_
zz10R-KfP9vbhepQajF-5gUX=rN=Q#e>Ccse8(t&k1sLWJK7xne9OFWIe=;-cSm{5k
zBlfDoPdLn7-ph+}Zp9P7vpTMcWUu^GE(l8eJH<PE<t%m0O<RObO=8##g<S9j{cP%O
zd)eeXb>^iEmsS%0-C6UM#A)AM3d)Kda6LRa5&Y)%D`SG7Ev}U*b`C)L6?1{BLp})q
z;Uvw2D{XweleTA!ei#TEkPm8+MZI#!MprUbRiF9kO(Q}J4fEd9h}bBN6@8}~h;7j6
z*)Qp?6c}?<re|<EP+C3vUCCL-YL-z;X<w+gCUP+Ia{`L9!e3J;B0%bB+{#_%J6OXr
zqZW$u0Df_pwVZV>&hBaDYjw414W3-Gbcb945Z`)2nwM+-%}d$S$UOqAEN}`f&!6AV
zm%2bGsMCp6Olhy5o(HY);dJah1m7(g-X|2>m!!#DSZc8$l-f&jDa2_u8LmgNi1FlW
zq}`5fb)Fx+c1iyQn-wMa^WNHRvS2B>2~SxGC9YM*(_V3-1|z$|`;woS148s}xOBZw
zI%Vg2l={(K;KeDs{zTHr@1zIVPiKZ__FvhPpOyXYaz@;w@=OT{VI|gCt1`J`Z!s8B
zY`^zS7C&La+H}qLCsqg3QQsQ(hV{<8`Zn8`T-F%!4L*I-f7e`YS^WDIHSb-KC$4a+
zSJMWQ@Qfx;M99I^uES%jFw20C5Z8CDUo|rF0jcNMtn)vKxL?C`Rn^4Y0j*paP%-J!
z?WaUh8eHYVo8<s_p{}WojDTBV>R&!|Mt!mBiU6)g`hyN89pZBUaqQFsnIp+4mgdQi
zs7paS5j^hK)twN5=#mipWwGC>NrIXlt>BXXj;VXh@Obar#hcFYG2h184CCmF^s_@Z
zSrz*y4G|1KzCfR!QDzFRGU8t;Fl_$7iHyq$v|5jJ7M1ua!TRhn_lW|oE9Ip3j~RLS
z&RWy70&Z5+rOB7O!b+IKl)wq}>!pevYL$6ObGL{VpRL^`p)Y|VKdylhZhEQtjmk)!
z1UKkzOli!U&r1H7!>#UUQOZcLW~?+V3!LNsSr!9S0ol3y21{zi3~HfqR8ccg+AI1C
z*mh^M_$s@hiV+jq)vG16rc48PQOLWZakt0*wEQ=#`bXJ5=2I`8xv~3BIcD5?Xyes)
z4Hn}2=-W#pypVT*9(T~}drc0L3raO*VbYFs3r&Z!pLe3=f@mkAu&%XKc|Dn58ao*!
z<5}2;Gt15kS_nOj(){Mv$!WoH*|+S|_{Hy*dnggeENMmm(d_)m-Vp=kvgJs@m~RhN
zSe9JVh3tZ2DTDWMPrYlq`Dm*sw2S9a+CV%J5s=E0AoN`*f`_ueg}WG|_ix14hC%HE
zESa6GEqR%ll%jOuM1^EOdp3Gerb^P<(GO6?2?$Es^>mSC-IWqk5%)-A2H}<;!_+|s
zaj@pH`5A<5fkxVEe`V0~E7Xw<UuKp3I~G||GD}s_J?h9!?lW%qQA3!GWBEBczz;Jp
zzeh)$^zhMho%Wa__KDYN3Oq&U#RKoDb0f(JcyagVmKx}*tD$!Iaijarsn>XX-NP@D
zS_Wc@yNj=MkR1QzjJfovh6pBrp-=;g59ZUHGya6<AGp@CooD!UPR6}bAoy473V0FQ
zdikLEzUcyByF2N;6@xizvHa>=qk_{oexIM{j%O-4*Idk(z!TF`A2?510ju!~H-i05
zGOqjWFS(U1Cd(z&n*cWNt^9N^cP(jsDY#^H%B$G$NEVz)3N9$y_>D+f=CImsl+O`X
zuV1-Br@X3O=-L!n8C4J|UC8tmd@7*WxBMK`b<HBd+-GW-z7-6+!?nPrhh8>D5(ZO>
z4Ou<D7aMJj3Nq;4XU{9w5REVzv-SK$|FMsXS~tS@_H@c}q8qyBrlj&7?-?c7OK;a3
zS{<4V3Fr$N+g5<!tLGK$I``h~IE<t<YJ<0yG75_aZX*#2B7J-<%sn^v1aM8P>y_DD
zg%(df3hLiYTv+ud^S<t{vva}|&D2L4`|DN~>4%gLHoQg}Rile=%1nkBi${-n61va5
zv77KNV$E2!y{{y$n?e4~dfHYA=eqGQ^jLjr?E9=3`RN`pX3l=bcllAZQMP5H^LLoq
z`x;@#l~OnH(I;l(6R)!I)xF>6tc4nmo;N?;9H_0R+q!b%9|5-PMyeh18WP?pYVE+2
zgBJl(Z54~^n&0Bc@2^1DV4D0X{_<iWJvuNAd!F<1=?L!8bU6z?H+xBXyv^__p>Olr
zxjM#=!)PbwuL@o0ptGVAYSjwMod{<RJZpI)R_G}Qmom3i=LHa^#b8HbsBhc7H`djJ
zw(YR+(VGnQ22Dw!V8e!BryJ)k7_?t!Zx)gLw(Jg+{-<?etp3fc{)C<G-f>#jr55H-
zp90V9;{;MMzv&%iPgHnkB89{<P}7qcm?cT6roZ5e+G9x%&Sw=W8sS-Y-eO@GQL&iK
zDkIsw$rL@GgU_8>Rm*aqMG1jWkK6TACQ3q)oME;M5$f8{kaTMHXM-P<FBOMhQKZdA
zSC=fsu+USxqC41r)xVB~smd>_gKlL4Tk?SyN4>`WEgV=W!B9C+elUGMP4VE`zeIct
z>%Esx{BUPz*N=lnk_%;LO)lW;aV+8`&qL8^SQwyhj1C?rM-+}-P%epgDPp$c$FdvF
zl;8)Y!2EJmc#h}Z7a4UUavun$WH~-tyK1Mqe)YyQoA>LtgxFq<m&sz9FhIzpI^)P{
zvW(9r3pMygAqj$ui~3z_{<ocDj~Tp?Lf`b>{!0IqC~Ua^7-}^VZv3Q&^f#Vfl+YY)
zb2R2Mj8k>n`(PIAI_Q-QQAmMyYQ=auSwEICP;iss-V<j`Q_r7gJUwhCKd5JKKQ$7=
z91^D^$);$*r*;Qy7<~SAlKRdXJ->Y}mv;R$zk9Kj*8GFt%>3Vk=Qkr#52j)}$Mg|I
zN(tRbpNua^m=T{5Ge#K<Ex=_I(ir45*xLQ#vfdcV{~Ey-b~CpY8xDoxFAK+tfo)HA
z#{l)sLl|$Tju%$8o@=6uN~$3&ikfx<f?O*#2lC`4Ld`i<71kc4LRj87|Ho#uFnC9X
zDe5U|Mb;?lf9b+1Tnbb)-{YTbgL}5vUDR5>QdJ-W(Dlfzzh{3(c(@l~OpvPD;pB>w
z@#(3_r~Y*9%XxVxeo^)@s$UZ=X2pdF>cJR^b1i~K6@4k3^bn?LJj(-w*;!weXSYB=
z?N^y|Eafe~Aiv|oza;Y4z$x8Q<1d))ck2dek&J<&VZ8~WRf-0zUnf1aV*xt%_x8Xf
zvx7<D$0p$78r?mas9d5BKVw9(zHL*(H(F=#bBjXh!1HU|{Js~xK6Sv3P85jH`}UOi
z4?EDX8)Py^hpq|-1rMcs|2KX9pSup%IH)}me!+jmS4(z+Rv$-TOtaZiny`ktv9?%U
zj~Dg#>hwCJx+#kqu$%_0#ZDGhWKTz&^wH*AyE&9H$#|~ji;i9sT9+7dW=lgm<TA!8
z;I7JVI=cwh-=kH=Ef#<6P{ei-BhtA*8uf$%Pfh`n%Rm0dZzk|>Wo~I<3HuzG8Tqm(
zGBvFQ6ju?M*`by7*7sJ6fU^I$wfOUH>!uIQhDsnaWq3(gx1~f?fozaBKV@-uHb1v1
z=r!*N;nQzKSw6q6#=oj#uo06TTm%22rixUI)g^FC7kL_qgJKp}AD8sLP<VEBC*Zr~
z{vT0VKKDlX(%+5L|FSbP{D6TGV6$e7)veR6Gw|1qe6HRhr!alumWG>odMMV=Uw2(H
zh3?VReJ+pNvL1z#Mj0{}+>%~`uJbLK1bbH*e9rK`#URC#sz&>aP92t<;J@b(Z`0yz
zoHl8vZmkhIx-*e0<m<@pV2lz3UXZ^=*L3au%l58{M!S2?!!xcQg1^)m4M+pn_oe^w
zD*lH`CA8RU+3t^7SZH`;{yHAj<k1Ddf;4Jby;0N$Kh*BtmKZnjZA|OFwOHZh6J(wH
zHM{H+IywklkDR+>f)P9su`W~g6XqO^WjD73lb^{u!PIi$N>$ojH?t#jF1=M`Ku^Xe
zB#B-=*z=HZFMpxrp*SkXhaUr<2ifOmB9mYI&bWWG_<sv?@WzR!6irJxiuB@mBnf0I
zXQwEd$BU;06hGKmeI|~tGl{}HVc8lA9*n!KNi@K8w#+0^F{c%^;Xt*M#c9w76(`dc
zDLJcEiyD=z3{)B_orQ8WJ4<S&7S`0@Od81=^<|@V!o+Ve&i}0yTqjZvH{+qA(Uagh
zeUBGwof*blh@S7Ald<GN0o=D4>1V1Ti)KdSFk3uF#^tV#=CUu9={K{aiHyR!qAo)Y
z6%*Oc4srl$wNr|d!ml~lZw(d{lwqr{N$N({P1+ZzbX;imzWA}{zfC-D>K*vgWFL~z
z&o7|3xxz?nRB4*6coMs+0)HI)_eGGGUj(W!>C!nj=9^Zew2l_8P}4@|@`H19BL*6a
z_U)`+&4Wh`g`W?K)r%EhE{#LdvF-2aEOw;BfdpC(AAQr*j_A<E$CL%Uwg0Br2COV(
z?s`pa8>}|A`)zTOYGYB7wT!~r7@Udxr78|`L5%Qlv$v0Wr-C=4iwnb6DkOY|FK+8J
zP4cBd^L!Y)x<Xv{a*3DI;^cgL2g}}W5l2aUj?#r^2z1&z7vtqPAN&qVu>8L$$0Zip
zc}@`&_r@ZiDm=4LW{X`JYv|3t7e6=3JnU$;AS=m=Ki;(RCP(E1>l_cxV)JXM{FfL0
zO&Zkb^R&tHZ)<eDh255DVd8vE&EKemFO7<@?4}@esqX+p0=)^R0T*^8Z^Xvi7I<*}
zR~S{&$TcCcDr0XqW$89?l6CH}e)1u)%d%%PxehrG*zII3YOVlq7F~IYAK2Y>8>4L}
zb+z+>>64NYL|V}s>}jeI$pTh;dk$beTNYO*shn8rv(`J6W}*9eCQRs#!ZHsA#Z8nP
zhf2NOf5EK12&x48VnTtxP87!gtl5Ob4w#CQivn;CNY1i1n-EGD!K7<`*XvC2R&ig(
zCrg&)C5WOASzf1Y3a{t_=tDmAjxBc2vrx8Zr^Gbu4h_^fl_u<PKzyg(v!(*8c7ze@
zwf~C|{vE`XZmJPPW*#gXb{e%Q8*`DhRd+Lo#QivPO!y^glsaPKu3wPzkYJrMD?`gw
zT?0-H6;SezU8MF~?P9M4@?Vn}TWT@u&iNXj-9IM0=EDM4|5h{IG1ekEB!%3pTDU`T
z@~cZkmMvVT3LuJ+|J8u-oLCf>yx=-VMTQv=95%UXC6kQZTr~yT{f5nh(UVdF!KI28
zloW=!Q)J$dv@`da^F-npxfyPO=ylRxhHJx{@Yi%USvISUE-P(T!r1c!9NwO-V_@&3
z&x0#e4SHzIImO#7^~u+7TK)aM0L=c)^Zs2je=gGHiqOsrb%NqXI3^@yO$iRmpdD7I
z4kHtR1y>>?%njJrB(a~5!5Z#=Rq)%N*Mms`&^`J(3DLG3nn}V|9`kCIj=6h6YtFsV
z&w*1W;yFxHG^ZnS(+0u8=~N}baWSesi82PaZ_q04q=PK}bD{!wcoGY@G?~FqlEm@E
z<bk|S5f@T2DNTX?md#YF`^6kriK-OU8y)d+Qbo)mR-sp)f0!yyF>RGNb&Klkvw6k@
zh16RQ3fTBG*ja8!srvHocE12lW0SdBnT<km4(*fR)dJv6+~N`-y;tzxS1A8&xsr0Q
z#!aoLO_?N8L!8a>859^wW$=Caa!=^uP&~?1+P=lPf1{=#vBFnRu)L<|PB0};jKyl{
z4lG;I)ceB)@msgodE<=NNd*Qs?)2y=u~F8*idz>-bsn=!3Q;n<XbX$sig7xO__X-v
z3V}>hY!Kfbgjpi98spKOZ6QYK|1%##`aW%qfV^~wTicp<|2wHdk?vcpcN1DJ$5Zha
zV!?E$z%bce#90z+g!JUoT=2YXr(>5ff3c#zu4kTwz~&0vphh0L3@Pe1ulkk2QX#~f
z%Yp6)SMwarU24&0(X3fZ&mwV~06T`}D{n3?ueTc(?K%{D80i}7gfe-u#49QMpAF*<
zFN&nn_+@p4`nKc^&&@BlPs49t@6SZ^2S2fC$khwZkhbOxFN&ig2+s(Mi!~N#1h3A#
z&#mZJjmu0E2-=K|Now#;TjOMhoC@51%s=c9VdKs^B39ld0a&p>PES>Twam~Wsf$O;
z^Y}!DF($JqGo58RPZMt21$lNhL^r8P+X>IoS(wCR)v|zyv$sZ14jY~~Qo+52D4gNC
zsOPwi{9i!yFCwYO9d0iARCVRkM^q90L!Y8g`m>{X9zp9OgY)MwcRHZ?5e(-hzDj7G
z9-&8lHD{S@H)=~a=9;@Jw=RAzaI6#h(5yX!n;~QpM&{TksaxB?E%#zg-IG7wwTNu-
zHWnT|NyV;V$i^mdgSe+NDhJt%gUQ_DNAvHE)jm%?9}-q_N)ma%^aifZK2cXC*HBdD
z*x_4n?#;%klSF{%|0!>2dIrWw2AgXp*GnJX&aq;8O0kGf8Pqm~Q^=8wNhhF^&(1NW
z(%fX0gWZV{P4E>y+X-zeZF3i%T!@!l?e7}~!)%YEHU)$@#OJ{MJQq=^M1nZm=QRfH
zOOzb^OV{-Pz&+TgX2ngDM`0a<e8}n>zw$KJ;PV`gq=>U2tW=cEH+%9P_FjT(uu_Ev
zl&0Xbx#mTJ28`fO*FLb~eYXB8vHSm`Fmk-KN<!gF4*)sJAokY$$agtk+oRu<VDbW_
zwQOIhsWs+f!K@vPh3^^^^-}7pr7l<MZ1x~@)@i#1^7KJKVc!xjk5S_My&-woPFAum
zAAo7af)9XJ)!6))#!E}hdV)=x#uR2iZKr&Sk-I}3?sR9gs+B9{|6%N{!`fVz_2HJ%
z0xj;^pvAqogyL3cf#OzNOVOf9Dei7Xg3}gvclY92B)Aoa03rFZ&e{8S_Bv<ny}rMa
zkn76J^FH&;+%t2}{o*)Y%pcH}LAUHqCuBE-69K?Og3lW=VK)=pZ@(vW@GexcYikyY
zBL?aAN*3H3@@oIJp7T%m_g^;SxlY@G*X@{e{W#j^5uV3|JswrOq!>t5)JaW8)X78V
zcJ7NY^{lDP(l{pelZONqPzt)swda?~Jj;yC-v^AG6Kl32qJ*`3bBN1X%e1J!JG`@+
z>T-=&SZ0G4!?bRbB19`m5~wj9FQ}s;lr!~oWHTp=Uo*R3P}4h-BodmU=8X?GWx`_I
z8uj<*4?14l&N>oD2vcKvg(+c2g$Zi7aDI2Rq5aa{YNsP|A^$O{ZfDiric1mfY4_o4
z%SW|w-1=l&bZv4WuA{0Y<1KQb54{C^vjTJaMVqT$a}vqQh*Y<GR&G}F1&_PT+(q}l
zNC0)C33Ry=>hVUtrl_S$`c!6Dd;qDy9B)Fl)%3j_L_yTYaL&7`gR<tr@0vx0s9s1}
zzo{+q_ow!Q9G^;|z}^Uptdnpkp!ZWa(jxpM5z|BT=enlwpdtNquOFKlGn^R&742=8
zNAUM$mu0|yCilQ6FBkcwu_&K3=4S6IawJn4#CQ0zvx)`^()*a%@W3_{24_kK*Hmc4
zl2FO7E#F12FKlX?(`;*GhA^*3FT)4(`cjZbDGzR|uk#gxEbh)nb>S5E7L4C099R~&
z?b{_x22(jMl21F<ucQ{Lr_b8-4^i5eCCx&r-pjaeT!PiBtwtSc$O_PIgzctxpVMXe
zdB}UiD-|YDbOKNP2B{(gyoBCKU7w@Dy=Nx(+F_T7Pk^Kk?U#iw86m0=5k#@=ufc;N
z?)!1(sn+Y|T3wggXI1^icZJt2$ZiyiuW_#<h0}=sDybagCwfs)pAVLVn~I*D=+skH
zUH*mZs>q<@sq{(5i0cZ8Jid_t(SB4Nc6z*;sI=|n+B|teHbB({xcwP2L`?U&{btlD
zS+wUHrrExZp>wa4sUqyKYM3j^^O4K*Kwk6Kvmtg2@iA|<K5=piZ25peeklM<K9m{P
zQ)vaeFcQwR%n)+OLg0oHB6zhI(5z*6y9Q)}?OLKFHQvYIc+F@_D&wM4MXA7992cP6
zl0rJgvIUd(3SpRm2~P@XQwahkm2b^+mpL8<W*4a6^QtjAQD7&$^WFa%dA2c}PogO}
zRDOydP|0FdmfVmS!T5;oOOj2};~Vh_)qG$7#3hG%^IKR^`%m&CZtzw2MK!>$ej+;Q
zQ`@zSEyT}c;!W!jXSs?dprL%iIB_Thc)M3KyLeEC{gC&j*#s$me>n}TIW!?0s+~*A
zxbj{YR<RjkdX32)CL&z;uiedmLLz@A|IeZ85s<93tU;$++(dF?R=oXS+v=xDXs73!
z@#LH5#6)PG*^D2lDSP&z^tR^99_}uj`>9L4zh%eMr$YcB82$TMrL2dGq2PRCif214
z(L|Z4z|*hFuMAq4MBz4?^gq~1nK165GV8BM6f&%}1sc@O_yyt9fQ`;LHd1F>a~<@4
z7IHRBcbr7gT+^qFG?LWeMPWRiSfVdVHhZKu6(CQPGeNIq>k_Fq`=7j3qFy1726baJ
zTlSbLnm(C=!25e{_Da%Zrb=BO+k&5~v?D+3JdXz<5{|FE8BooG{-R&k%hq9du|m<u
zjR(>3A&$hJ0Tj8gh8SPA(u%I9LFC5JfB~%M-Y5PS=_dF2Ep)!yCP=t%zTqadLi@c$
zm{2KQxjKA1g-j&t(O<%Dd^9ra7bw*&L5*!f7tidT6N&TfqNCueP375vyQeY3NQ3Jv
zuD42bgM7w8Yt$ttg_SFU&mAKDVXw2qy=b?GBRH8En6ny`U<xorH+nPMDLf>~Niqd;
z`ca3=s6v0re=CMa8of@eL3R990H7iDcIe!V?rlY0B8#={@T*L8X&wz19AcV#Y<Z%h
zQLDarmjR%T3Y9_p0lw#jio*B#2a4ER%r8(31l$Kfu%uW>om5Y7Dr^iel1!iwot3%L
z96q_t67klU*Xot1ThQYm{9tlP``Mot)YV48mXrAclel8P<I5WN&z|Qke?mT*3MDwr
z+ns2gr^Hih1^Vr-uB?P&P{5A>2)@^;JiM((naE_dn|r12#Sv3xgTpaxCXNi1oBW(v
z*au}oOpcA09udr`d4G8;F)<A@R=b*o`GHO}k}peFp;0ZJ_}z5AbpCB(&Z<pJ3BB<7
z<(r$-M+Z~#o>PgXc(j@e!BR^iie$g`?=LRpy6mVz8aTVKm^1KYuD;d#bPH|w`d2zn
zud?)&l^w*<3RS!ktvwj7Yxm9EW_$D$d>cWfno`RqtGP+J4j_Q_4Q#%bfi#R7a)LhQ
z#^vP$G8;5*-2@~0^Gk*2d*P8G%hYED`84JzvOR%i4b#w^XP%J9nyd@%7q$o9U$PZ2
zzu@Mm0Uk-2Vx1B>t5VAb%su$IQPi13rc@ecuR-sZgqm8xzRWSt2v0B09Nw1M*#r*`
zAtm1L4%Cc==GgXEQi67PZ>yJmH@o2D80S-@GCPIiqvUXe=>3-7G(zFImvCw0_TpZL
zPHP<*oo@%biDnn@b^u7^gQc*5vipK}+Ij-7)2~!T4=yy#b^ajGd3UcXY)g1)Ho+$&
z2m_C$0*~m&;0KV&^p&$ZX+`w~(>%9pqk19fNNN$bqsDQNZC;en>y3VOj#KWoljVyO
z89YG;Gs}e6CSN_4y{^w@PcuI)FWP5KT%8C3jK0nx?tk<d46}IJrwM&uF!B7I(YUwL
ze5|;W<?8+QX4!S3)zPnB;z}vqsqr;s3V7sqAyv7Gj)|9^fq|&DvDeJS*&~y8XE;=n
z;u5#xAyW(12quZIKyLJ0#HEus{p+zno~r%)nS?$>e*#$Zib;OFZ9wd(%Ev3hGwGd<
z%2bxui(lTuQG2=1#+07j&gXemkJc-5FCBjtUm-bP>i<+2f$;d?O@Dk~nDPgO(C-?^
z;#f0iWorn^LyfsUS5Gl=dEc~EcyLf?yYbri>($CNiS6Wmaf(FoLd@-C1h<Vybc#cR
z^CGC<XetrMSYxbG?6`r`D7D{kRp;x?QQeND?b4Bl^2RxkHWmqeHqPxMeNFk9<S)V(
z4=sB1An-vwa(CTU<2t<+)e}wVa}WD!8yw#AQFF=5F@m6b(oUp*_6D{%;)RpTCja?!
zkniT_8WR67oJ++kY3jMV%I@-+^wys3Zz_=lcRz<EKLq_`i#Fqtj3S^hk97JCEk3n{
z<9C+A1xRmcds*+QNaBo{lk?im%oqrpCFK|1%<hB((3@QFslZAl{a(dj*2I(Olkh~S
zP_Mo81J_&`@;?d%gRdYcHG}!LgwNVEc*BZP6Jc@B(#d5qI6x@CA31;l8j=f}cBdCS
zWv4%T=ZMChqxkMJ4l@o<>7~s@&FTBto@_1}=Xc{X^pxVKC!NMOw(Pj~uy~V%(HS#!
z&<nuER9_ja7KZU-c_ys_@1#V8_1@O_lJxN4h0T8EO?`EfBoel5eq&PGw+%B7pQuv7
zgg7q(rYesSQj6x}DVEZX(i{C-vyiiR)IO$@brJEsvB=wQ+5eF+DYkmoDgE=8=Y8#7
z99S~HOj@e#ZZ%rPb!SY;8r$U{=<zw#&PT+_4UFA?`CfMgsVn>KLIH4>buop!&NN<9
zp>{p=nKFn0SyRR<*`aHEx;oU`>jw(IEt44f)LQQS!1sX4#16kJb`XL*!?J~8s<jqU
zXJH+H!N(JvVH$c-qXx#lhngn4m6v^;<z6y$m2|@fSevKTh@Ilrl`)V?R{xIVJ!G#c
z0+}oyO_}ym+e~V|_<n9mjWv*`=OzVly%Z*qm)G(eM<IW%eSLJV0gpPpX?qXQ@s+eC
z3CHSfwC_^$l#V2F&#l*Tl()LIA8YkSiEcRW=)D4UrW)did-A&dJ}US&^-~Ksjn_ys
zr6XIp#Kr5hjCKyc{dUQD&qux}KF=P_@y+#xJmOW(9e=`9`iigW?IANTL+KPuN&@Lm
zX}dbA`GqSsoS(S4V+flWN1EWZQvH=Z^PtbB@pEUUfggO>P@VtX)HQH1M52)NV8`0b
zQ<ln%Jb?M>=#*ZW&$$P|wI!~l#n_{_(_x_xf*MMm^)TFr4!n-5r)Ongja0jbNiFVk
zzVCgt8paYm@D}=!B?NQ5&5RecP14VDR*NX)wfI<6_cg)g*|R=kS0zB0(act{S2%Wm
zNF|R4s^{@d(tUs0(i!i4oH)KbJeztm0j8iP*PyIObh}PB(Wyy4`8K2j+VMOGPs}%V
zHw4G~aF83=JNg5vjt$=}ie};B{T9KY`FyLtZe5G=7nm4RVV`j=)&?IvkS<9gKx(rn
zaGw49lW+*sjC<A4u}6lRO4&@-0QxBUjNN2p{MnZX4*YKFL-2W#?N`KFm$9Vzhp%zh
zJwe#=R-A^|kEoa5h@OdFAGVW1NnIR~I@HT2A}8-=mO6JJKJs*LsAzsAP4VvuTVEYY
zFTVOHFH&(gY8JXlF;&!C7QLUKZNfm~d14>IiO@W5FP~nRf}NwFHeG;I^H$--4HBX2
zeO&3J)-JJEWDBcUPs>KU@gmYz@>o5v#G)rMJ3ZDhiIcqkj#P!fciW3pxI}@i$B&S#
z)u7=RUwHd73T*BE=Uz6qyUxc-F%q|m`hHOYQ|U3@3J`?Tuq?|R5BCVt<#b0AlrD*Y
z9CL4gt`;cvDuiejhChv@R_<v+?v&{Q%A25*7bXCZlPF>ez`FU;VoyQxYSmKG6j^}0
zv1q!lOIN{O=_(w31vuNzi{`Z8al9f!bofN8G2g=#3XTg59FmOBo4S=H5PE)5wUa1Y
zP6EYUCt78#!uC&ZN|(S)704dzwp49>ucY7`u-_R>`bk3iI1~tkmAMTD?Ia<D+V;NH
ztjnh--ijWS&Cv$Xg~doh1%eE>aV!U}ew_p56=_{Xw#PElfpd_8Pwhu1d_~Q_TR0t4
zS22+T%+cIV66WBwS0TiFp4%fkLp!&1^=)PN6Bn<f`YUs*{{p3SbP%M*w~vnvTO6^f
zk1K<H1l!-GShlNTAJ<OKzjWw1adUcRW;OFfXXaCz$T?YIi1i4U#mCiT2_HE#jr|U^
zTtXMZFhTr;8iHF(8G|LYHz8|@ko{e;IC4#=A-3cp1Qh?#7ajAY*2PjqqlIrh$v3k~
zhL^>GExp>61^qFN{WssZlVPkFC@D^SJ!;34iKd330kAYwX}n^caZds7Jxeqp)qdPu
zWQNsmyLpWmj~W6f9WT&vD+bQ&eJIBV&4VZIRyqxw$d~>Y_)KUWnHSykBBi)j-U0<U
zu_GJi*VWti6EBDiynFLyH)UwVq5@LqSxm~V!cp}TOb>|{1~n0|BKqK+<Riu>=Y1!s
zk8j0&a4ihwxAmf0tmiZwUylc}_Z$u52@BJ>o!CzT)FoM8iT_51>m)g6X06h$xW}~m
zL^=0G?s+{6n3|+Z(-LP%s0ZFnd>S_Ret6e>@H^?=1mWw#-LC!g3LCLZR$Q;dtZoc^
zZ43@D69l$1!NE7LjaFXDuY6tQv1EU|2tmL?Ci&HY?=E749C#lz4#bogfsbb7z=zF}
zZ<JS9?&rZR<*`*PWi4=MOKERK&FU~7+r8htzm`Su<4tvDr06g3YU>sZdJ0iAaI7}+
zzWr{8U23-WY2e_;>utJ(jhMDq%1HQJ(bZzO`H+ero59PER^a<#WM-D{Ss0<W=ZYYd
z2y(BX?+g#D(FXBfuZI*Co{vdN{84SNtxox%SCLI)Ig^2`GjLMYF#;*k<?S^eB~wjF
z-nG(~wvKJWpTI~bTBdIf+u=ZnGFiqatGwevsxlQIVv9AbK9ep2e3I$(qAvV_3>3L<
z4OESt8<@uUJ-p;~XtLk(9yI>zQ*x=qn~K&x)^_B(1^O?5lk|2|5Z#PO3Vwy;{?Rel
z<<wc@IkHXXXht?N1dySBm9%2DMDuiT)EfI$B#)$|=4QyM1f4|Y__J+ZkHe=o=U#Nk
z4~}W^e?eSG#zNQLh_G8ZNJ-hV!UZH>(Fm~}Nq(?cl!*CV2oFBytZtqZ^>cU)^Hs|w
znFv#JI*>+-7$H8Tz*37M`DKc!Mo>TWDnqRxle3aosL!q-;=Xj>d93tyaAt0quJj<c
zarScfqu5!@%_bL$HKMvmZ&jJ6hE-i8>V!8e57K+rpu89!7DN6jsY)lEkOo5<t5Z>}
zLEG%DLWLZe>#)u#<q~l1v#AubKjSo3APb8-rv7c>gG{)Va*-fY<xAbg&3yE4`$*D@
z5gD}=^l0;LW6?8q`N))+fP|RQjMyu{+qlTPm~ShEB?^=rydzYd=D|E8S!Yu-O_Ncs
zA&elK-^Z@0V^s_&nI*tex|U8AK{bcLiZixi5|?N{9}#_mu1G{o8m-@@{i-eq?s)8H
zVvIR-&lfkc)Q4=iE^|8=74mqgboKq0dAXm@yfJ7mXfNLc&hpE7i4*5u`xh|F<2v(G
zKIa*z<!wz=$CEU2dHI;<39|<;lFQr9CZAAnK&sV{t_p!CD5jfHsOrGaaS-BQFQXa}
z-|yy1p;PSVLIQ~wvY>MzP+VYfnE8khvCgljzK{OK6?lZP;-@w7s;Mll{!1#4vl$-M
zN_H^*Z*|1=FogX@i#*V|AZbeZhCFjs3WTcjJfjn5Jr*-0TQQ8b;JI&k=-cf+w<+QG
zY0&kD;=G9KcH$A=ZiugCjHOFOJufdzRc9Ee9ctrb%>!>gMsOUT`WQEDTp0`@I=#~=
z#Kt7*8l|3t596Nipu2t+-hOR40LFaZ`wLZlJ0qnsQJFJxwe&K--CTv|ZngEGT>fA9
zU8#Ola!8ThYU*jnC+I}xyv5HyrHLw|{^H|pnfbQ9)p3}(S3PBSp5vXIQA5u-_~I;C
z<5D{hpY8`?x(Dway}bFMVs76ute(Lu4|v(8_^wZf87v^^$UkBG9D0!yQCZWSSMGd8
zMzm_FNP8?y`+?R(#I|4xiyBMv(z@ELh+W1hIJ`OkHH}a2;LMYqAJn^v0I}2ZOVA;{
zgDi_#9(*WA(!qeRYnL~k;nmAGZq&Ok>Bwys&2lXv@8rrgcq`0#s+glgO&vDXff%BD
zw)Tdw2^3wtbiXPEr}7EYd2oy(MwC(Ntbs87z2of9n$Fm8+A@rYo|9a}gJ10ZT#D4!
z?l?+hBh>LA@qj%Jzs9X?sv(2&L#mOO;l1|7bB~WEXm1D7bD9t9tXDv5C(@Yq#aN2l
zYC*y#H(l04>G=S7j5={WMv>&t0Bre2<L7{?n`DEcaYwz@w}!;)<4@Tm*?}JQ8i-D@
z!PW9c=^1$}*2S<B1}lg369C}O!7E+hcYu%M3tF#(l+$`b&}X$Tjz+W+23S6b=clvv
zDM#G21{m!4Lnut$R&zXzr&?S(n+|s*(dqGSjRD*S;2T??c}H=9Y)+1jeZgJ~)K&GF
zCr_>i+wU#CyWcx0IlSximkK}c_FYA6>kQQ~-umv{)#HH@a|=qA?q$4-?r*NQ0PJ-u
zR(Cbm!^XzA)UcfH)%#oPy-&>dk%fQNr+yOF(d*S58o~eC-EBq2^B1WTvMeKPRjhDS
znQXI^vVPnL+v%mRji?)Z_hN3(brN>6Bo(0A-m@&5A^)Y8CXK@JmMRu1FRi=z(r^Em
zTdn9m{5y5xF0Jd*XwlUCuzzNQT&Qkq<WP-VPlsc;LlAh{AIBSx>Up2)7&%w}=xh(a
zlVvt>&VdmaIBxZ8H>Fac)Se3RODnhSoTPQJb`$7C0~slanI63{yZoNntZe36scHD6
zQ`U4Y?3D;TfN)`=5aLPb@JBuu_xQ`%4*<XghhijV$nRs&!rn>PQwe&S1n|ufqKsrR
ziN9%5|GNY)HTZK`V*;DZo?)St+wUxts?bY_Py(~t?}k85r1w5x@(y@mVp$v-$Dokx
zXR`oo0E%pVYG*@D696oDoSe?`9P#}!he}#@&W^ke9!5LzQ#9$kxL!%Uo@?FxQay!A
z{%0|}(~Dv={z&3QFJnecemIc3>16r+UTA6UYzX#NjF~FYh%s>Pl?Q{9+B3l(UJULj
zzpmMwUL04Pe+V)SqP>UCsi`VFN9-rlS$#U*TB_n_*RkOZrg1$S2X7f{jY8SE+w)EN
z-1q%#QM`zRfisWO{abGEy^p2Av%1VR$KM!d9%R$27s=+6qy~-#Lfl6ri}=llj*+Sm
z?IWyF4{~P28kyxYygIiv&O?mfNCj_?zQ~Kyao?O4Iz#FvlpxrWiMlm>E5^$p=GSEM
z&FkZ%PxA#1ubkf?Fhb$C9#F^aovQLcNA{YeKsPoBY|gv@MKb|_kd<E1OGTy4_3`t3
z;}MQ3D@oT0ptCS=5;#8=@+VU9KNvpb<Y>nLe)^-#7%Um~+wDWRxr@0zJat(=jRVAZ
z{Mc6yv6{&}?DUMA(;t1S)I|BJ^GKamU2Y{@^=Q1P9TZm+`H0WUx!)<tL?kIfC^!vl
zlK;_Htm)mzmMk+OVQ(K}Q}$<gHwWDOcgX4{Mt1`_ElFh&7oVP?jW!8EiV`mFA>&Xn
zVJkE{fx7_H#AWEkcCWE{zHvT?gpDQo$3`Fv1(Cc0VSHF%fr$l*7Zhe+bwLMv5Nnpx
z4GGZQ%+EJDwRMe6VA$3%FsE%_5iHCCn})YPN)R9$8}wPpcQe7QT?h@bEpqOjy6q+_
zywssg&eG!%G)fIyPih7empxAt3dUfVBIQsO8c&7vd5kLMVGx;O-DUX9nheKO?Y$m9
z=c5?OD!(6epEFMS-F*GKXQiH=V;s0M676fyE6Ll=*>r>}mQwmq^6YfH;F{V;c7Go=
zT|QW?3_4FKr7dfM#y?+@D&hHHsE_JGFfjrZ`>0A`m6qLw+`n=i)bY<9+j?g!7wROP
zp~{vY;13q{iXi&9kvE-!S1eXY^OZ!$ORJ**yydyjVe&t!oAT*H+XffQS7^T;-eBC2
z^VdP(HnkXhw~qCzVY#K#U?XQ2P(-psblf-y+8v~ue7^1^sXt@9l|M7b!Fa5xE-|so
zaMhRYpuOl#<&CO(v3g`M9E0cLERi<Yw9yLKF~}#0gg~}>{gtdQ08H_%Yv!Z?k>|()
zBElsJhm^thn*d}(Q6iio`8sd1twTf27_3YwVW;Z#h@8fUIp#Tkq3>)vd=HPXABIIV
z1nNH&X!Vnf*}r3BPyQ?G+XeWC!BY)aggiIkG>$QU4EEpjZ^lNP#SH&isHJt(_fc^Q
zSO%G1we+xm+=$qkym_?1YUcS?K3h1mr-KxY+=bLXa%&AW>ZNbt9QhsH?p&df0z*Me
zx}p4tmRJ-qpXJ6~MOa24sUZt+^i)BoS6+V6!<{SX{Pkll$@_OrRB&d)LX@r(Y2$$Z
z8yC}OKsE$w&UP&Tm*8zFeD@o>aio$7fk-h;lpN`B+{2zV)bQv&kHoZqE_5(N*iKW&
z5G7e1(`m<!d4ZYGt4+-96`Km-ojWJX>x8GpuRh6=aQblDnQ%TOmxeC?Vtcndlcxo)
zzdiE)k`DKU%GP<0EB`YJaTun`Y(l-07lY2^ss}+;Uf`xo4br{{_(CVc4opkm{t1dC
z<zzf3P<XynA<T>nrK!55v@iU1wOllPiE#$=0V3QH>$Ti3>b%x4_7I>;l7hS1kTzB)
z&7X{)>8w}1FPb+Otq0R9kau99>Z<Um!dCx?#mG`!ydJ;xkHx%}gRvzlpxxE)YnnNj
zvuGr)D9qjVdXf6)xd%Jn3!+Ry%mpE8Q2tkmp`Ejx;F9*v;H@KD_vqtj86VXZb-k`-
zFPZwx3b|fqz`fSZE5U^m8JF9f_6RQFqHh9fhYFh#c}yWKh>DkXZsXvydD|3;r@^c6
zF?GTo2{gTNykR<iYi;C7$1EY-25|O62e8P1d&i4}krgG5>pBTlmp*}v_Dfy{LAwDf
zrl9@7{g6$ox*J2vzOuhUU+tI<sY)x4&zpu~1~XGu@#U|^?w+*ULsLf{VXI%`5%^7E
z3w+n}Gqz{W_$bW)VB~NbagplLP|FmprN+rKBnVSRHM0F@qU-!-=-wm+XrS@3+baD0
z0j6aVG0WOr0<5!F>C3ub6mVhh-;&v;6OrR4Xtc1x8Qf1HHN8$|#e(j*viH*@A(C+s
zRYb@znp`;S+e$c6%NJ^@V8H8ItI#_4yh|0`->p=PkmIS~yyhe`pmt(n{BxLG*tfDl
zO{gYsnS}X!b?O({gSiPdk@Ev;rz!|v6T7OnXOyOm3qO5jhVz<XdyTf*FZ}Vy$KPm(
zRwQ;0Q+3zx00Nh&n_mqjJPRp&7tC{Ese^FYXWb*gpwUolT>7wgh_RkJdb5+2wsN|H
zx9y0dt^8>PWPd}~B$u|eV4aZ+J~>LV9AB(|ei`kigdpGxl|DOcyaw5h`(3F+?z)5~
zql668v%GG<R~7O2Y;uh-caMYNt@3uETSp%A-&<;L!K?SSh@9r;sh{vw!#^6dE8);t
zxZqwg&XNboivCvr>3ltG*aWH8bb4z)yi{S}R4wD&`1@E#U`4mI-;_NP;JcH)XAVL5
zdJV%;+V54GuCtmam5WQ_XGegfpL`I`qAM;@(k(}4>7}t*%pfG$UQWn!MX|#gd%Q1#
zi>tm<mwRh-EjbPoCwH3TD%IAb%Kcl8#J@+Egr%a-`VNa?kai1`59$5R;pV;$dz~@A
zYY9QJF|GOFyQ1o;dt^g>?0n0^D4sf0395a%y#4pS+ep_n$>h}?@W!!eug`u;MQHU$
z3ywH9lHnPUi@9+#_ngp&n?E@L1omD41^E3C8on9`+R;JccV=~&+(WG=h1%~Es>V;o
z!LD|lpc&O6r=|tcn`)}Bv{Bscn@+vQ<wcnqi1(j`a=`9qdnj-IL7B?JECZ~#26)Vc
zSZeGY1OIRO6N>L(dP>W~hsrEYr}(EX;4VKU*`rmPH~j)~#E@~Tq;1=cjkcq3BL~~3
zvdjidp}P(WseQci(hVd8%BmOlSd1ly`f;^GQzjW|cN^*b({h6BpTIXASYN11XeR~K
zF&)g-R<S^t(K<a1eGA`L&rO-z611k*dA;mY6Z8!8QRHo``*|7qE-z?^niKJkU4Tjy
zS@7YmLg=ey<oJqLhtfL^qn6l=S5o-I1ibWCa!eFFI~kBYe#t5R9cqZk4xE^Qjm3(X
zG4!FUJUTifs~#ix{`eRF1#We7^)O)%8|YJWb5qlg<FquR?d2x-Fgb|!)nvhG<tth2
zVPnS(i`a1Lh*x9J&5K1u<P}T>1Aw^O8e(csIsqYv6MKvgSj3F?@eI)0=jj&P;e%O?
z<UmGs?Qhc=V(bVPAFng&bi;;o$9?U}1j=`HcK(~UUTtjJS~l~RT@;KwTYztu`lR29
z6}2tHuCQxE*`+;Wsd_AvV*R|Y9;X--NIjv~F?5Ok1v;-41i^KeSf-<XSvAv`OPK7>
z8+%No$+wzdQG8>j@%iRQWk-}?sglfU$&__)75K~VE{c!6GDx@Q*ud!mJJ4cFaqPoP
zjta*+DUmPsT)_68OQ-gmA4cBmV28uhReCSwQp*(uAwxf<fdS*x3g5D&4S5M`zKqJF
zri~Ak)V)DF94vsiC%)IE#<Lp*JM<6ri`0zlmo1p`S{_@xynFH}biPdNh*a6J<b90z
zN1d^Tvm5Jg?Y>ug{Yx=99_RW8B~-)j*CHr;_MX!Y9ye??>F(6`vK3R-el8BW9V5$f
z4S$VU>!V2l{7{nlX<I3-quihzR6_7N`K%<3-#jg(D9cyaeC%<MdCdH{<l*Yv{)|1o
ziOGQT$(r~nKYxkLHv?=$o;-pQ>k5Tgnc_R!qn_K&89Kj;OmRM>QRpD}h)(_RPcQy_
z3_o=u)n=8SlM8uHV*5A`nF#WU>z28DrY^s_wC`yyMSkO8W43?$yt~tX&;P*?(~x)2
zH;ynZ3*0JxGP)m)4#@fKvk0!JVt1Gl-o-pAnGRy=a=(}<+Ds{>ZsEMgX`#yUrT_H1
zEB+q)E6J+4A#RV**(tl$E9nfas{TDgXJ=vXfF(TQrTQFaL7V66u7lU<qrgJJ3r$3V
zdsR`nx(XNSP0zqpzo;8i@7&jEH3t@65*<!S{vJE(K!8~(MKwi+?L+g+1;wVfhc(HO
zhKCyXHLQY(R)>66G+$b0bD4u;$wje#Sx3{@SIkKMM0xl_;+;XqPr~0&vX~s6C%UP_
zDoxs)v`J0c1y!$4&kPFoXWJ_JKHBw?RB8o}m73v=lsKl$WS9xCSB|2k@wUes@#bY^
zYP#-AQ*`Yh^-Qe1>fL{+4=s5pQD`964$rx(_xx4GP0Pzp{oPdP1<`lIqo|ewPdAiH
z^;8`V_UEH%_(f${lHFsbTOF%3s#7h+Jr2nk@@hFIv)9A>WR^fw5^V8xOr=Z#p9%^`
z9SlPs@fv@9Q<$TaP{?bLrr$~!`cctLS#0x%D@U^-CzF)!-I7xt{d&gm6V(CnEJ??&
zaYlw;d(Q1<M_8&KI%BUJXM7~c_BtmOw4XgZ`P|^lWcFn5^{=%sFx=Ro&%@c-@EB7V
zE&4OV+MizD@S$aPe;OX+dD%NqzJ9l)?@zoUZh_5Eu9jvS+ZVs?|AK<}_r65M$-3L*
zs=%i<8qLOdKgw-M922}E+uSb(iUaYXBQFj09H!hGZ%OvpQ;=HBxdN-_s&kX$E9~Y&
zrlBv#>X2eFOSSgat=^Yk97O1;V?FW3EpEbh-$#EEPwN`t@2C3e6^b24F?ldLM(*RO
zGMgJR)ni--)v1)Ju*~A+bPfxkIiO(ATFf3gX)4)JJmRz92*!-Y49vOZkg8GI#vh%s
zKBr`lJv<4)bBNU{m-H5l!gJ7L0GG)0lM|+j$ezRA`0C%}zXQ4rzc}v>DEBB6SY6cq
z{$8Rm7-J~NyQ?t}<7X76fXfPATIYdQx|6{Zm-zw~G@swDQd%dbO=;jH)e17BMjM9x
z=dPO!7LC#52o=e~-o-c9$%j*CPq#RQ&j=LPst(DP-z5lLs#D<bxeYU*h*Obx4(zs^
zsj)ff<vr(=$*Tts^fJnwhRi=U{KZbJVQPt^`Jwir&A)&(n%p=^?49*!bx8N4-6rkv
z7@_sI+xd&XC>7UT62!c+?DP~TtLBqQ+vxo`f9o#z++&Dqacu#-p1E|0NpJEoXQJ-a
z$FCRboM|#PTk83o=D3HkiFgGuGzTx$Au#;@M(8lWzH)}3>De>+@1~LY5H-gdQ>#w(
zy;>!!%@~}?Ir61LqW5|FDv;EzFm(>!VUu0?&y%p-v*anedrO^C;W^RiRBN0rk`k~$
zi9_)mPFgx0RfDjtk!|7V)7rPk&+xLTBxT63!>bWHyK~0%rKPo3-lu_NTkl<v)ID%j
znm_xee|++9XGX*C*1<qa(I9LbQYxX?4nYbuD|&pqN{hxEd2{V`e$=+6u$QtRC}|AG
zjD46<92jtMXzDeBJLb=k!GJc-vO>s3s22|}64ruFDpYM$15e8r>qE_=Ho6jFQQ;>6
zy`rz&IHq+uMXTH?y0xBRI!1eu+dHH(<BEQn>c?#zl3WWB>D9={9@^biiOKY3lN5dU
zh11*3GI<-dJg0_cKb!c=X1k;tk2e8Bg6_tg2NLel0vY|~1wodrC#H?-DqL6|>o^?d
zU*)5|&a?l5)P~WWCt<WV{^fq7{@8IA^`PftqSxaZRi!OP4Mqf6=-PWT&?MF|w=?<x
zW}z`pK2H}pANgRJ7j@F`4xXocgNm?P70^p20xTQCVoqjE1R|D<m$dg1V$VzEt@92k
z#`(bllS|p3AOL`2y&=$u>z*PgUreaEWk#6{fGHhc`y)j)7ODNi^Su`zbF<MfX})lR
zQv31DZ$kwOCG80u@MmqEL@Bm~PYUjN`=TqM{C(i*gHLbBQ}muzfkuDdx5k%J4ZS)!
zX=r*c<TKOnPU7P_M7=@h%GJxjlf8P^w+{W2gZUSCgXBP$#ZJ*u`*PbkKheZtfEfxS
zA@D`XXKfkTdo742xE#sD8K@cjgkLL4c`EM@<)SF?2u()bx(fk7Qzf_G5EzOlrVkHA
zs@}7=4VdV=p(Y`FyUETYnQVbFO?DboW|8lkC<IG!Yy#$UP>&b^%(IgVmiQ~ph>PCt
zTJ}?-YO&-8`NRN#enjSN4%Ia~poWCrQD&B#+k7>w+QECvuFkcU%{f3UC|Pr#h%dMu
zLZWDXX!yTk>7Oh&oc6(9I$?KZNl&iDDaq;YfZi}EkNdS=3VVt(PUE-YC@BSWgr+zX
z=Q0zDuU#6aCT_i0n9u30Xe^7cS(i_fsoGEp0hIOz%fKC)p4>%t*c9eQv3^5SiD9^<
zoT7)(37gN-F9r&JQOh=EFsV{U@sm5VMpj>D%@!b%XgEwtqR!V}rI4`I%E+H!_>&`A
zH3SX_G1p1D)tUoG*1710vTbMRd0V`{F}Hj>TWYz`BArPu|Mb7%!T(#5=^g{Endjbd
z&!;ua#L&+$g$5<(*b@kG_&c*=nDS`1wM$1_?v$__gUOJnTj;iJZ%S^zyvJG0b1~>a
zr{#CRwg$Mwnp1F}zwd>zAYCLuZdApaPLkBd#M0>&w|S)yuy5{E3u-Zb(0udH0h^Yu
zMf){>>2_ya$*1q11Y{3OwhO;qj5$Y^I2jd_#x@xhZ*yTT+aNgZyw5nOEN4pnGTCOE
z_EF03F=O^Y4rW<FdL9&f_2D=fnxk!L!>mpJ?wI`}>U9vxKQJa3d)vau>C0q@VtD$=
z!Wp(0f0~Cx*^TgVzgI)&7xnGP8De%l>(4OT&@n7_sJ>C3rPmJt;2us&1g>`leiu~3
z=gf|=nL?M})bjt?Y1XA>&L9EWj37<Fu-L1%jq4w&Hui>p%w{M|oqP#;W4-;e=roPJ
zx`m(Wx0gS$0(L#7rHs5<x~<<+fK>fE+K^#-0rrPs3+1ltOXse3ixpm$1}4e69}fQA
zA^JxIFQ9)=AKJkm{;hy}<!vB$M!|sYDI~JjT>65wm`vg-(zZ7!+z|Ii1D8>G>Ph|u
z!R+@eUQnok6c6eAPlcGD(3ne#K`X#QiC|GLx_KO0UJ4hJH5P5Fpg*^n4bh}||65LK
z!akVFMm3<6PSOu|A%C+HI%PMyEXS$9V3wL(vJMSh7m!X1U0C00VHW@Vp<X{jd9O<e
zJ3~`S9LQg+z4vUn>;K}=|7U1_U{q2eG$<e};S4ev!EE_FTphhiSm^>kaOk4<$tw&U
zws>-%*>K{qZD6-nB;-iPqh{gMlKl(cmhvf?5WZLtaPqMzFF~oxm*+HJq6HSw&DEsO
zpAPg@tOr)6jQ<>s9j)rc_35jL?JMaN65V#UQ9p~2@N30n*RsHQued%Lx_;Rmuob*h
z#z#<RDKCGrdBZ**lEZ=CA9<4z9`V0G(!cny|GNDg446{$VeNt7Kv&r{mR<uhhBghs
z8hT$nZh{n6NF<%V?N$sa64TqEHw;QPkt*UqUgYtf+-t(kWY<CkOedYHBpYo*aG{?n
znkXSyWqCdynwW&c>3#D)>$UwxNrIaFOqD$7gbq#EjbGXq7fyR|YP24Y$7^W#lgxUi
zCgu^r;lK5<|1ghXMl{xtv=8`g1a0vlG4B~Z@Vn)OA`_n*I2Y{hZajLA3$W|;<12#M
zP0*F}s!{Ypfwh8B+&)J^&cvZJT09*Doi!r2n79ksXr{%lbIciFQ+?7xU%D~`L;Sv4
zW!~nO!{|c-*fvrmPiwh*b;P0FHGE_99Cm}DYsI=sVeccu*_nA?inHJv^bD?H1|a`W
zLh>g=NPdUTw`?|VIuunX%i&{<8?8ajY>qoyB+FyI5QfyEG3`SIGI-#JKB03=*ZBfC
zi}wvtWeIQTm74FRs}&}{(gRuMj?{$g-n3AYj6HN2p{M7I4_rfi?IP9e(*hW+GU3B&
zs1u#~$b*FHVu*A$>$Ka@fxXH?_9RVH_6ipVFWBD5>q9U(DS`MjfH;LnNJsSl0_A_P
zfni#-AE(dyS;pSt#hW+F!TP&+Gnl%**2Lh_leNO$ZBsB@B-KRFv?XyA!w&sLumn$X
z=L<lobD%xz@tk4wh=7wv%-<^%sivQ#GP87LphckOO<qs+lZtIG;G5&Z3qWpW8IcZ?
zM0w+158Yd&VB4`QS$!(`L9ngQv>#f#GUiR_{Ut*G#zwV>(OAc^##z3Qx86d5X(7WF
z*r;eq)QSpxH*fU`n!kn|^jHu1R7HCQYS;Co7-w*pJAa2sy;R#E8wrH)#iKEV>R{nk
z#+jqBvebnhK7Qhj>%cT$q1G|Ld|p)~7sKfnD4@@7suIp^Qu2C(-#8bl*QrAM0dM<1
zIxf_I1tsZy%N8J%jwEhWF?3FiNJlaz3%@zi6!p}^9ko9HHowIfNM|fZT%F1*4QN#~
zxOgfxtduuJc~}#i>~(|lYrfwYLvT;u;brnFU%yF)K;T05-=0?;On515{Bw(^E=&ie
zh2`yBK1o7n^H%!MifWzF{mJ<V9U=J(!&iC{EGUz+QyUTBL_JYw1J9@oR&jEsBz|Mz
z7j~K=i?d#VLH4J-`cG#3UpPTm5}$<#Nv@`6xTUcUbnOYTmg`w1jeH80?kUWz6y$ah
zlwghPt{Jh9LVK7xVBmJKrJinzb3idQr|%YeNCJS&^N@;UIKeA=djH0KQv0{yv#=v|
z36WUkO$|5d&XpO|aMn{d7D?B)sfu#xb7-T3tlqc6gtqJedY^}?vRr;QlU5Z(jm46Z
zbe<6r<>Z#p$4m@pKe+x+Qur^nj`}W^8;xWT+!fa4&n1Z9hml$<b3j8~EhBlxFasUg
zzQ<9sCZq(7$UG^^ce>I%*$i-JeN>t-`-Gf5*!KVn6e$n_KyRnEc&76Vqbn6w(rql5
zL)Gt!v}IyIX(^60Hvdh`mZBiA`I-HYeGSkX77or20u#r4=UuiKQmTr+427xBb|koD
zcR#1`Ti^-7&4JLEc!U?gzN<S_ZEWCmN-A?n>vqmRVE#@d6{G2h&Af|$J5u@Z7Qb#$
z*c?uaMnv-^%bgn2`-;&7zqRDOp#=5(23cI`Re`{+9y3qHeg8nk`)&m9&OY=0f3|8y
zw9A9J{>%my{RRd7P?OUbs6+u#Bb6$jVWF_rX)a7k;TdvJAI^h^9Lz8ai$Mu^Y{m#&
zXs!^8T?L1#B&nV1k;y%c;+?jj4D~|eWhP9cU38$7vfwzVoCpg<d8Wb`ZZ$*Z06$8I
z`{FZD#nfQ%hYKS+Uv7$rT7S2DZz$1{o(|!3IMJ&FAOrDAzrmocz3qJoLoWi~Dr1PK
z0L+qQ=z}R0V!Nxzyo%kQGHQRloX?k(BemxgJPQH9i%ut!SP{Td3)znTzcb097^yT^
zKfcvllrjK>q_@3mFdSSEG##ut8aklEYLQKfK~3*4QIu|uYvesZx{BUy?7Yj5r#Mm>
zEpl;2C&5`4K?!X5==^Wt=|3u4wA|>)j7Yr+IJ+Tx23v@ywsZCAW(4+^CmN(Og7ohr
zX<T<HTw_}!)W)XVFPQYZ$tBtzB()vdymJizQ9=;8J$S=L{|VIp*LMTY9-bzH$q@Wx
z$fuAW=PWLh8Cq=kEts4U_@v?3^32xCnWT-y943Oaz!EtPKu?dnsu;)<lg3`yVz>pW
z#BG!suGcp*jK}#$<hqbM_`8T5EhUNBAwqwW%-G!}L=UA)qK&}i(!?-#&Z~jt^r{cJ
z2EV@ui>@UsrF+h++uw3X4E)9?ZbwPgdZ<_K4jaWB($dW)>Uo2Ki_ckT`G`JIFM#XU
zgSLqx!IE`Z3&<FTyI~Bjl6i_)8&Iq4fhuzEKN_?!nis=K{W`Flq5#gG!C`1O)K0qo
z8Fh>4n8Pa`xR7<ekkClhL$7d<yQ+#N#1HkIwB~nsgOdBap$&FOBg4WDGt~DjHDEzq
zj4ONR@0NZ;9~*(>NCso834|bfd%@eo?Nwy3X$M47tDL{h>&NB<HD<{qkqJub(Y0s_
zezQOOlS#q)0i}K61X^icx3<1RinQT)3+yJlB%00@!z2KMzw^=`(TBcBwZZd*hkFOX
zcHE7y@t2Ywk-gtt+H8UGKUkQChJs$rN|SzEi<F69{Hen;J4gzq_pgoiI$RJ3rCDRI
zr_%s`J@T-H^Nbu;&clrP&{F?nnuxNfY--F<$RCT8BqKvAjreX9<#YSZR&k#;<rvT|
zpckvD;#T#SOd9TE)2EDvVOnw3G6;VG%3fXQg-GFB_p98?<(<fYDD07EDT@kX+!S>4
zE$;vMp!kdbS15wNZx@EC!;^==q<txwFdbo?(=xjNJO6HBOkj@{QDiT*z7#+LLmL0F
z>4<)nFVh}%Am@P%9q2K>C>%ea4a#pNf#DZbxh^$C*lrqxbo<X2MJ?0<eW)AA<%rOP
zv)z3*CwVo}_zf`LG(c;kOG~fA?2m(CzIf=BK`3iaQKUfL=e`)a{c|d%!uEz%o)SRl
z^%lw=T>m!_X$^Bz))e&WexaQKIhf^oTK+84T9A(83n`j5+S_!M{C<VSe(laJ2xH5w
z?mx8vyl~+%hx85__IpIG&b@eLfA0ZUp8G4y9gG)dSTFW>R`sFgh{M4%#_NV6FL8gN
zNeg<!12{-|BfiQ}7R%|>e&ib64_ZsY*<v8Z|2*9vEOSsJPi5Zf8~EV`=m)ooukT-%
z{Qfogq2jD1O7TS?<pom7S6KTBJ4AUH1>R8RVf%uIl2gO$3AIh-wsXFh8w#soLJujs
zcGKqMcNrEVZ%gDtV=B~q7$mz4n}EK&Ax4w{2}E8S?XXy6mBsyQkI_kZYp@C4@5}4O
zisRY;2rP8_2v|5M9;RTeV)iQn+MKO~*XV5vLW+rzB4QT=4(p1&;Hs>)3)Xhll_XLi
z6j-S~XJ4xCTx#pPu%W_>!rrbF1bb|c)fmYO)9JDw{CrX=$BfeDtkB_c(3KG%wWkrR
zGRHZm-j%(|)$w&JNy@x^Me;`_rZ=4EN3Zk-5o+rzGH8DmzNVt$vluV~rhl!aGDsjz
z*U!A=bO<7;LY8n`ojm_XBrp|`GhJyB5p+Cbp#tt}rt|uBxp*go^#8|xDoW_y=<-Ro
zm<<8#iccUT5txN?Jz%>ix0;g-sF(mGI>{pacIN9eo*$H<C$GFVvY=b&K7$_PYa;Kh
zo92EsL56LK6wd>*HW{JtZJX2nhf;gwKr~%mfpO}qnsA+MnA|W3UHzXym?Zdt#mWA`
zk?kdA*|x>Upq%~ae*_w-&k>QRXP+NqgPs25DRjSJcBqHP<d0X5oI!%_i0au8TISBh
zoh4FLnvJ@jLqlhzMY^&?;u_|kQtxSWRLtp*@>}6}>=QB5$Z%CB3+x%z@>t<8y{Hjd
z)ItF*Bb1^v7IOW+o%<VJ%vg#Mva7HSa787<lZ6Zs@ViL!>wmc8lNg0;<s{148cQGh
zd5a@Y=Alr)D!ktu`rv<zvIDA+U15RVLZ5+BG0|6+?s(TF!N#rwXK>xE?6%St#^3IJ
z$5&*bw|(+ZfekV;2yhJ_y-fsLazLuAIdcVeNz&^=O%tDv{j4N-JV}4SN)c&HRWRP!
zG;K_kpVaCrGi!Ga>jVncj1ZV0WQ1<H)O~0FS;OIYg3dzZFHF%w-r=6|U;7E~CRn3q
z0Gr_7x88)vK#TsRpP}-=za*Xj%5UqAddg^#u<j87NPsClg0|m+O_WaLy>ULLT7F2X
z+`zOYjt4b*lF_aerbS%GF8*PUn}S>pE<O2bcz2UrxXH52))$k11P^~XSt)@434Tuk
z|BJ1E7?cRX&sDPf)<N4%<$uis*q%Rx4YcDRDXyM|e2oBaQCHop1`*Sn&^Zw3$8}A<
zg5~DPF@HoSc6E3#q3=-fPMgOY3$#fDxY*K6mp3Vc8OsRM{{M)Qv}N%gX*<B~=e@&K
zI!yCc=jCax>dbFk;zKX&ChT$hFR&7y)}aUXFx{oxOa}{;BpIhCM7xL6N$YWXk0uF$
zKK}dC>^~2TR2XJr3fOQFZtdX<({IonV`iZDE$DcVsYWT`N6?I4qn{wkK+ee1<!jfS
z5o+XXs|KPl@6Lg-ig37ys44*UAv%AcQip#Yh=2a>|7kl>q6Oh4v7<62U#@oue)cxl
zJ2inV6AFciL0b-uWKshEXE`bm1}4x%F}Cck{M$FREP5gNr@O8!PtL=+#kNl%eLLU%
zFa-<xuHy*^*#Bwqe@<Nf<x>Ie8`zshzSEc>t`tgS8i`2@*M1_H^Ci3T&s;`+GJ2g5
zOoO;)`u7wJ8Q&g2AG#94O(RT;BTWd}&{!@5N~`?SbX1R&m}3cl_Vy~2!(i@z3sSRX
z(Vy}Mu8U}{R0$&zEZ$kzo<J7h>^`4;NRU77i!C8<tCTcJcV&6-E7`szOQBpV!NN20
z$9>vga1MU*sxME+%x3p%w^dH)KTI!sHYKu=r@q1O@%NY2{o}H|?BRJF(MT<($MCRj
zLk&2y&y-}?IQdFqKwDo<`nvvJzYBJyChU<+s7|P!ew2*R1||)&q7*^hMN(t204!TQ
zV!*od+paEetv0Rw2<1%|-g(Ky^M#O9pVF|?*5Hp)g^?Q79z^!DRjo5WmPXj#O%ChG
zGk^Gv@;lGyc)$qpJJ)@3Dt@!r(NsxLj+f5=c$7aILI<Bes>qCKLQn#IHBkU(xE+uQ
z*3MuOMVDx?9Wu8nw~TCsy^V9;B>}9wJJpnYSvw<1EXEObI>p=cEi$tUKyDK-NtBV0
zBPSe|h;3yqYCB6`WyxVM$}4Xp2d~PS-*xHT$=^!wJR7_v-0;C!|NMpmov*=tskOwT
zbzAL8%0nR`cl5JYpPzB~*1;lA^<4km{q?sb^ha6GI(E-HE)oR4f^S?$4b+5RDnc$<
z+T782)4^MVKEyU{j`A@YPh9=(?l45KlX8~7u)KCL`%hUtlL`6&_EpK6?}Uq(LbfmF
z3B^YB_P+(ls4|}A7C;3GTz^L<gk<F+<ylt`E0Q@)i|CSNTWle<QB#|k>W@=2xWQj|
zW=ij}H=H6EkU3y<d5YC(VCdV+;)*(r1aCM4-n{7gBY7hQq9ODQ;N(8&|LVT}Cl|^t
z!6cT{Dx<$q7k(@Jv$qfYWEHB4QXO?JizMiyAedm2vtz_yeH#(&@attlO2}YNKUpbm
zpRJWMxz+51wd*2BdRO@@Um*mCxXBlaQN8O^mJ<0O9Nt?UaNa+}N#if~ssm^r@g=Jq
z1zr8YY-mxGLY1RSPWS2(e!yd<NU510?;KGvzMU(nEo{+!f4*+%*rNG&rFvLj3*^(X
zWsFV2m5QO(!-OUGU%g)ijT+I!lYaFozfRYywVQF_a+tJWI%wJ`6WKBRf9VZ}68cjB
zTM8Z$Q@!!!&A9JIce#rN;~iL7nD8M=W0>~=>QSAG!`iIV^QhrhQ<Vr@vB$kBZaGx<
z>j^U6H&foT1I!*U8RhVp%vlBVf4Z5IYx&RITfKg~I}tBUT5isajrZog#0>0@+=rXR
zcbcLE7nVP?9?&gWRG%eb>b(ydszdc-7EsR{c4UTldql>mr0~P&St7cdgzxDC_45mG
zbR23F4^lSGjDg1e;jvAZ`%C^I@ZsML*St%h5F@rO%b?pe*Xi%W9!$3_TVohUNHy_N
z*>uAM`?A_-8W-3^V_|OeHA|po5*z#zU%ghjaW~~ln^YgZi7&3BUj>LpCy%ngr|&%0
z3+DP>pEO6Wdcl9Ye)mM5T{Sho8y6v4YF8JV8xy}K6x*AwF3~$D^}<+0O$L=}A1w-2
zm_P{Uq^QfAjhp}b?ne)LU+(K|4Ly@2vM;SJoB3`~Pn|{THz;{WV^%t+%U_g-+POv1
zgHnj=SkgcJe@DD*Hjj)j0O4$V4zY}a_!B^1lBki=lf1{J*Oi8d+&iJ6=~(a{kXHvg
zZOl(7^lzh^QQ}cmMUVtEzHC!t`<4ed6uxi-mj97!!TuXT!R{DNmWQ1dIy!;dj6ry!
zn~KecKd2n1M(a7|!e+m{o%+ynWGr@^TRc?T)*xpg=J?B*%6>B6*7*g~zL>|#Y+2j-
zm6UO*O*@j8ZgG1uX*Zub!Rhj*XXW?Zo-{kew@$$q$8N5y`sZ@I7PWT|?^T}<V1cR?
zV}ZT=Ix6tB68c*FvVn6YN`d_6qSMUxhCRML<Z+-Ty`F&Okj33WdHYa}hY~r&XCmop
z)!<k_Qm1!No2Ch!o&yXGiC{<ilokB~jpxngOx0b%rnr|R?*Q@6<3aHW>S9Z`*zh6m
zwuSLq+}l2`#<O7hzz@YUa}^i>@Yo6f7Swu!=%3v{aU4*T`Z3s>qI1C|gKM4D>Q7zP
z*`JWyhhf&<7K&mE98n${uj?_%QtCo;8V7ogTLN$;Tx=aI8>0u04@<?|>M)L5e|>1a
zp={o}W&i)!dhdTY8@B5=O-S?zqPK*I7QGKq6M~3DFTo(9cQT^|LG%)$N3@7uM;)T~
ziC#u0Mj1vOW!j$W+0S*~d%vIe5Aci6Ip=vC>saf%kkdw%^#$>YgP9Ox$to|m>5r6{
ztznqUdXLg^t<|E2=I8dR+7H9MY`h|b^A)eMK*ExAz<f*6zcO@nJ<a108e!rW9c`L~
z<;!+d?~T;%<#5qZJFvf>&tt>jX;>(HVoG*rM6S<N1YxQj6VCurel~aQob1^acde!#
zhrTu#TPHQWM$K_iGMx>sj+Y#XBrQCe{9o1SU4X`SxIw~#v{kTmUJ%y0S@)!>!+x%m
zkKK-FaZzrmY<D$l#o+mnNu;R8k~|{010Z0dKbv#cHAfM*S>UoYa${X2y^`BT=nls$
z_B{Ui0;<jBdg<HTZzVYap={teee{)+2>g2}&Y4(LR9BFIfe;H2Mh`kLGsjKkhmwij
z{SnC7NkU+3;K?*2{XsB>&94px#SIAqP^Wj#EoiB#+SgUgYV<dh4Pj9S3}-%84R&RT
zl(_d7VCq`P3V5`|xh^aaaAC`1>-&MTcO{@KJ;#427&&08Tc2*Z%@9oO%rK;dY)3tl
z@*6X6MGukN&a4GeE4kPPv9Lu!<&ozr{bmT4mW97YD?ov&Med-Pc_fsSm06g=!jVWE
zUdjEq&Q<odtZ~2k<RIxefTt}t4=hp5&1nkc2vcGLBJhZZnB$n=<FmEL@=i&5&iwM6
zAn>drx{+WBYSzh;lB~<J(xj+^SfLz2D8IxduYMiTo4MrdW%cHxeF-cqcWjwZ!K>CY
zo(<Fc0|fcO&v<N#;^p>D4SNhb2<3LRCtaV^5ns)i7yRVpTw|{mzCObmxHvd--tLD)
zaFH-RhXDv;pw(r#^F&YdjPu{EMvNr}u6n+d<k25wc&CFe;V$M9y(hAN>5v=il?VrB
zNV_!F9tG{<!H}PbHnjZVD>J8@GbC(hvciG0yMr>=s;+2IOJ_eMjEZ_M3;rixX}*f*
zGrX<YYah4lHea*$W7<ivr60z!Cv(2mK@o>C62p>GA~~ur$2&nCVN?wbv#w5bys>86
zCk^=9Ec2DEC|e(utwX<+Ko^k+#bc1&->tH_d`(stfy%kLAnaP}q2HBtmSUCy&wmuA
z?<%w*!D_3FYkZQQgVlPnb`xk$Y`A*$HM&*Ih-}+XSP#Vir76{Af1YzxmF(ra5e3@?
z2|!S9?~sU#hH>KEtS)6CDw%qwQ_lx29{;Z{deQZdE(+tNkNm&LqC~*@oE(tFQ`;>|
zayGgoV32+mUZCd#5rQ1t7rz5)7ylElfL1FrDNC~mSQ0|}=IK?yW2#t8vXX=Ig5ufG
zRkjt=yA}IaSqD<CjD*>7zB%!w6*8-J7PY#@J-7Ggw_oqHCrVzZB>1hnU?PkXHo)mF
ze$^$p!ID>zw*-Vz8g)4DH0={|sBaT_HtlhWKO4ENj^%xJm~nvReLHzvIk`|eRai2b
z<ae)ZJ=}fco4!Bx1-&LW0H-1%kLVJ(5#Vk-GW5`vQB26l{xOK}q|&;Zej_Meac#=q
z^{aqUqiupx@4z+G65%Au?W#qspo=4wdsT85hu-s@E<((kg?<mX2yHFj*xK8A7}k9D
z&5JMPbbYug#w4Fw@d(VRV>%}V-+y3L=7$NiM|}4BJ{3|}I7`BkbB+(C2tXG}7p&0X
zad}OwpCVqWEGx~1BM-7r{>rYl+6<Vm1Vt9uSxeTzNSkI9Y>#l&%CP{t39W}81od#5
z*Zxi7v#Qq!b+#xNH9cB<%>R1P>80#-v5~>zptJq!N4RbmWb(w89ceRVJXnfmxd6Dw
z9(>FsR%0+GGn>1O))Jhqw(5+4Ba_xG{e(s$^0%fc*`oNP3M{LjK&v3U<HL!Arn8U4
z<p$?Gpr@oJ?%K+M-O)@M2$O(f&@2T(Iqn{$vf_()t2%ojc|<H7&m~6d9DyvKjE4|k
zh{Cy~e>H!-t#Wn9@pF7wqpNiJ0Cdz`f*kB;e=0n1NF0hh@1S;utD0q@zF61mUhTdg
zsSlutpd;?zI*=s}i&w{?v0LAwSpfv;CA@MHg)Z4saPr^?>i+YcH=Gw2IS`B4oEThA
zFVsKbsQKd_PH!EP4a?F#B9m~L86g&)*ckBYnGU>v&iT%)d_rvZl1(!sKY^689<t(J
z5#^GQo(CD{32rFK^PkHN+!b|NEPV0U%QIGScK=Q*cD>H!aP^rlHo7G89#wA#!=nl&
zqT8_%Ek}ZK5>9)?Z5Jmw8xLCb+nf_Eh*^RWja8!~4K9!*#j90CU(D!iFU5sa1OTnH
z{WMF`DQ(I9?9t4Aa6(Uq7bOdW5KQ&*PLRmy9wyf!V5b?~>yX!zISB4c{CLKEpI=|U
z)z_lTG)IA5d`RU@g<;}hy&GpPBGT=nG~xWo-sLg*nwwhs`)=x}-J4W$UAe*N;I$uP
z>QeH^=#?t6TPJWg^cVliSB@lb=a`Bg(52ffX6;=av-)dF|4!AR>Z+VLTS{sE<<~Ci
z$9WfsL_HfpEiiO(HRfgzeK0xn5J-KO@+pw+UZ0?i=*K?R>dEa*1q)59ACj@-8!;(A
zMC45$_+ZENHYTl7FRYvY_t@Ea9IG7mnbPHK#-&_il=(=43wzN;!GDH3CxH~d?mnw2
zvAi1&<iVV#Q1e84s&kq@tT1$=tBWtz$x0h+;Sq3F{&`*230-~>feBUKd{(RAzp{_+
zK3~x|eh#Vd(#B9i7U}MU5kFhgnGxls26(UBMUkn>nO_Zx%meMj33p`q&aIik7j!(=
z14k)IGAtHf%O54IY{;PxRb>*)<)T88(Y-;xw|)#))>X*6*oxbaL~SzIF`hp9m_Pcr
zv=gNp`crOglh7lmQ)|e@C(?A98KF>p{$dTi6L7Mn{&Fx|Rk#hg@O(i3YV~Z^vc_k|
zLW!mr_P0&F!-w-3Z8ZYi^q0eiu-bi>tW_oh8&YqbKvMzSN@63mcAv#1Xs%!Fxob-^
z71J!pAGB$jn=I^oq6PSonY3uK`hZWP556T9wW(vM(D3afDe#=gPYOaFHU1&`@_Le%
z#_slbfpgb|N9YK=H(uuILZ;(9h_ru}L+m6UgNiD;?)mlU<@;B`SuC}Oyn31UJy_`m
z^31D5Z|$lkC~<If&fqRfHb4~j)Ft0*XThB1yn~qJ9_F5Gtzi=>rI!VP3YBJsK}Wi+
zNT!u;udR_gDBM?ZNtGDT($S=An2x8-fccZQszcD&WjdT#p&&p5IOACxv$)<JbSaxj
z{KO~uPSiwxK4&BdNy6WC>)2rCR}*Zs`?gXCQ&br?s%2)V#hSQ4W{u8vqpCApMVe83
zN^?iDtctrvW{(m>cOq_X`RnkjUKiD~2X;W)U9#M*x6_EtS#p-FYdFsf{r=wBk7L=N
zZY2+QVOFbyaaJStpS^imPRB60Q9aT`wBe30+z!%ivj|hdOpUd#etDiK8u_M5p9jiI
z*@b9rS}}2;w+!bpOI>-<25aw8yB^ewD>r~ZM=!iSjyax!T{%yZh-Q2-aG%ofVtc-N
zV(H0^;TOZ>LBqOI+ucE;;@>`o=LMbS>*UBif^M0nETz?dhNTJzsay-DUFL9ExKGpN
z(uFw2xOE7x3xkw0ksQlqz-K9Iv3j+x&5yfK1Ag7=kY+CgiDy78<sC+y8I!7zkQr0q
ziI?A=0`L`^=d>M&&x}C~b_S-y4h|`=ZvQ1dUSDo0<o$)+tPxy0-yx1K_Xd63_Xxi+
zM_s%pi91v0xh(ix1@u7skt^+~dF%(s?@#3I+y9YqL)De91to8wx`MaXt=0^D*ww$U
z7QPNmRDW+0UY%GIWg^Qn%t+g;Eg*ksEtGu4$qViA-iXxhD_=_#I_X(YBywW^ITa56
zpQpk@YSj>tSVT^M=fgSxg&qhIYB^;dA)_+Tx%gx%I{c;fo`TAh;`!-D<4Gk*qicUW
z@*o-woKd-*<Fnu)^#mBql_-<=iN;m)Ru`$wPLHzI4!JD#*pFpL;WY+7D3~}gLX(U;
zw|4j3VlqNlT<aa1NG?fuVj2Qs-Xi18Du<f}W}c~}*NX^YA1zLRdY*xL;2*e724vU)
z&Oh0j&f~@Sjm%1172&oe@kwtwuQN>%nOu=eOky&>Uw2&|UX!SWdINyX$+EIUS13Bq
z056jHNpZdlsJGjYOzpa_*$F-@2}6#~g63R7NS56l%ll-X=(~jQ)Wh}9hxZALxdw?z
z*wd3Lb<ezeTpT3HpPhlVu5g$7==Slwuf`w07ta2TNzDH;b$5OXa{zUD_@<H4By*PZ
z1~muuO0WZ`@N!+8^pe7IrVwaGS?V?P-8%yGDBm7<@TF-pEjWsPH%)~B$0}yUg{l1u
zZFLp>V4r~X@xQGZMfWf;j{2^hq(3V01@1!v;|4fRncMUFMkO5YWYGxE@3|E1i2LGn
zA^Lcg^qH2gI3x?Q^2?UhASHc*MxpwPU@t)t|IR*6uG!LWls=NH(C-O&xw3ivlmB%M
z>T!?&a7@K?$$hjaX-aQD0H;eeUza%0ZW$<h&mVa0BnZYpY^Ms2>mnV{p<;BXjfi1N
z9BSizA`~{7i(!2abhHdUdsJgiA}4&n>V8No8j~gZy5fT*+$mi+$$aaCG!$zJJ2-0l
z#-aEDh{d{fYzWtkbTXLvMs13jj0}`<fsSiRtiIro9KE<PZuv}dktO{3&u2da&qs}<
ze35SR!-3hHhoFm`>7Peh(e}^MW1>^|^hQ#7SAE7bnIlb)tw`2ozItr*^~eO{<pke4
zTs^9|bXT@=n(!`iugU*h!9->aNHI?|<-(2@gpd8niv(g*r!K|0p!}5jLcqi00IJ{t
z8?;-Cui9hMq@gcy%=DM6Pf7F5B->yoU+GySqx0ysES?8lULr<%JLy@Z8x1RFq8Rfe
z2u4lcU-){$(sQX9IjHLt&jFm4oZ!Djh%WWoXkV|N=h<mjf8^Z$b(M#Da$iG4b($sn
zTw95Xic}+wjQ+Fxjsg|k-t@*4yPBd3ea|$kw{1W3RFh&xR7Ad)`q#FmhXF^eL;Flk
zWGs-bOYl!I@Nwk!BpvPLFUic5_8T^QEZ*5<a!AKX#R1`;8wwRz>k`Fr&w$*sC^WB`
zch9f;c*4Io{zGcDkjz$~6t@!YBG8#j?cw4RDlYSmXWiW4)mwFDt}pmv&SL9?hh8QL
z-TwW8_Xz~9LW89dt9UroBot3$S+)Q9h+J|$Dmf_h`R2@_58RbTtl(~x<|zGaTBAq>
z=(5*AT<vxb*F)>f_9v~$3tAZjZo%pwK|D<M$)Q|X8Ra6i+y*MfCyv7b+>5?~q4g~E
zADk;8LBF$4>uG)sAo3!vY8-I#Xe;o+4$-p?I7%bh3D>x*K%Az7zZecax=E0sZa!R@
zjd&?VORW^XkQN2*c^1#Hc>HqzW%&8foM?yL44A1F`!fLZy6SxYL{BN+1i7eU!SKRr
z!$-APvI`UanwJdqw(yMErM&(!m4-Ja(;1;7<-#HI(YeO1-yL)w6H1}T37tu-AXD=<
zDHMEw-o1Q1qOu}DQym!|d$<!i^65<u-R@^kmY^pN5%M?v<J?+zGDi?eEd^6I#~7B@
z$9jJ_8kF?yFh@YzOBz$NLf_;t3|zfA1^lB*i0{JPpi+yUgI!p?5Z6?4Z0)cH8aGUA
z;~J2CW~i9JrKLX~<0RwER+Fen!8B$;?vd9_*6e75BHe%g{c9PBtb3(vt4sjYP<fev
zv6IgIk#dc7-E3UIPES6SCoHaQjss~pu7Y)3V#3QDIa&L3gA$|HC9X>m!oc_OjfIlt
zGR#+#dTV~uw?%C;Ryxep)>XKf4vBr1Z_B`9LaD=KZr-hDePy=3ULKZB%C*m;(zQ~)
zX7;u!|IycO`mly_>Kpo1EE1YnX<5<oxu)W6>-WuDVWrk0K*J8&1J=Pb(KSB=8^n?k
zb$>1p7HFGeJ!BRV_8$k_tKVc%t>J#zY*ePSzpr4*n;c=eA_8@HT~-CA`*VHxs|HQI
z$wVL6^68s5Z12=*RDfyn0HXBTnACRkz`|n^!p79kPJSMSRSKfV<Bz!R^+X}UO>3bW
zub%T7Z`a+v2Bd2djRy~<1zi7q=PQHN9>W(7Vb6a(T-ckmtG-5q;4k-Y=bMK<ToE~`
z<;(JzDbJ9y=@H4;$bneKQ0IR7S^l<67yBvi3U>liY5?amczzM7DpiEk^8kbX3KZ>Y
z2l4VriVkK!^s0CG>64*7M~X4CCc)nlN&FZp5%FG6e7M%h#n3c=mD&xEVS{7~jn%e0
zPJJO-AcjF>k0O}*hdS*kdmcR`lQiSn_ImLVL%?>OUkg`H6@1ONGOJE~+1=l^*>1Qh
zaSofme(o)@gGq88Cm)mT1u#i;O5L6Bb;u6X7bHoJd*%uwSvZya+^N>7ftpWHVy3C{
z4<-bvl$TgcfX%b9-<@CJZc{p+2sKK%8U*twOi_ykri?E1zh<JjR1ho^OcwbJO!i8;
zt`az)x6)re%R@acpN3dn^C*2KkbTSo<V|4`;2Qph>_?tQJ@*vz9&FLbly=Lvt9f+7
zQ5$2n*^C3wPv5CZo%*henC7c{^Wz-XRAVbvMagJ5P+d$Bx~s5vetplsYMU$Y*uYd9
zEzu)^=#2<1t8ASflOs$_r2Um#sj=1EFkTK{A+L&vu}futpVmgr83oyG(rJtNUXFPA
zg7iS`6`SR<mylUyZfS7Nu$7||lz`v6$i!c$UU$?H+Rss$XVFsHOlDeh)2}4wo^LeY
zWR~;<HnF@b^FN9VV4s<*o!(V{$u->ETC7^)vVL>rLb20=Dp?7CvGlVyeyY--|ILBs
zNxk{|b+_+Pc4EN+>>=T#^A#LJMz8c(*5Yp+P(9O?+b_SkS`DiedD5$Lhga+QfAcc*
z;UP^!se~!Up$MY0%)l$$%A9!3QqhWmSzd^x*ZwdazT%#5j_u`j(&dW_>vGc_{~Yk#
zG_?C0bimR%qn{(I&@MMkXHAdAI#!5Veya%)W$63Q$@w|6)!r|L-Do|l#{7TZ+eBMQ
zWXN+<*WX{U_go|YuDK*Ac?NHVssa(7WtXQrlg^t1YofL>SG_}($V3HB&7i5{aGzRI
zF4BSf>O=*Yt5J#CBr$@4{t=N0ZPhCjF_0;`0poty?5s&acr>MADGA(ZjLFE~HZp0j
z1Ak+}FaWlt@16k%6B$ezcI?f5j3qjGBwmW<wI=b5hfv$OL#QGB9k{--@h_w|^ffO^
zloN}>`BPR%YAN#3M?BQaY#4>ZD&n+e+vlS7v~SQ8`!i}*{i2*^$aqsAi`0hB<`P?{
z7oG9P==O2t_a2Rt=ise9P2XP?+9t73R0qrS6j@Ph=iG{h!v_?Dw20CN(o>L9>ZFV~
zyE)ATQ72prHNDvtMh%Hkb4qY0_d9xh>Lao&d`@8}{P?%>V9J|cpP38A9k5^Zk2?83
zL>OqTX9@@pZSR0thh8ZQqT1lOeK-HoEITRq->dz0vzFb4;og^H8ZZ^jkaQxB(lJk{
zi;2ZfEcsdBK}0&-jxqPE3wwVD1x~iHK*eHR-mRSrT^iZ)cP7VnKB40-%rWK=6H@z_
z421Ag_odvFVG0uThY4NeH0=Az_rg$<dH@?ARmXI`ynSmn;<_o#Agp4v96LnCCN~#=
z$Z-H2G?x%9ntE_!Vbg=`Z<1bVYz({QMtA2IuxugzZK%pDag${`+3~#Y?rp&KNo9`5
zSj1Xo;z~E7)$<`?lH6$?uVr?EgRF#S{)u!LqDyLi$##k&M;Q*F&(}JsZ8Vgq8UL>N
zJ{p`PfF3V<{LUf4>ayJv#>PG_kE!&jQ?<u0`7J)EJ@re-7zDcl?l5Mj=3tlQ-R5fe
za+$Rd&ep+LQ7!}~?c5o1xU6t-SYUgH1x%pX<*1?`@Vn)iwX%;0hfQ$M@y=x@UScOs
zU_G(`CsOuPkt{36pf>H*B1ZDl)&polJ3T%Pd_3Oy9`RrO;jT&uVX8!dFYw}pX)VdO
zNJKb9ZB_JAkID9ml?+?*Fej3bDs-~D!I<A0Y1->RWp;YOBWeT|XpyjdV2^%A%qu)7
zA)_+>sZ-Ex@?`Fv-f;HJ``GvZsR$9%aA=eTw!ndsFSHOkL1(XnX0O-m1(q9&23>UA
z?y3G)s_^{ONyu^k@EN<B>Q7^$PX37gf_t%f7%e3M&WODDh%W6%W)haI(=9#1h*Ev`
zk>Rv<W!vwjw{0+xo2FQlnSWIa-VnqK<V`-C0?;V*4jSkw+`nVZ&aQ6H>7#zWi0L$z
zPh+mT)N;fO{f)dz6*=|iThzdN{9FPdRd``OAceHaCS0!O{@JUruOl#A*W~J;;i&NN
zD_NlCia)%41{dMrT=&X0O|DMC!xCt^i)}r$3*L)|KcKG1?8d;>_xDm=IYCLt84)E8
zR`z-y=h*JB#@dK-39v!lIX0&1u1~m9Es-lM0eJVb$r<6yQ4}Yz?nBGpy=T(uyJSq>
zSl>jGh_Lim7Yx4Ed~;mKzC>6!wGjZyJ*Fk)@J-FRK#5mq`I9mHy{jvK@~Jvc&UYK%
zYU+40kLLsjQ8U#7iAa2j+7T`b|MtY>A$4HKLE@kt?NHXCvIP6UtTc^NT&6^gKvnxZ
zaY(Ofd8%w-%P#TU5TCFX=s7^E*-w+2>Mu1_6tq50x{in;oopbZjx5L?w8XGKV1M~m
zK%oa!`}}rY2=nL^9=b=opv)i2{xmK60KQ<EA52j6MybFLjwZZl9oWkUB529r;;?p^
zDV|EZ#E(y?lZ3IS8=<0;Ovhg$X^x>vtBE|^`F@8`d6puQ$2U7kuGdBlLbtAazq8EV
zyvmslfLA7!w<3Sk+4xFgHuC)jdef~K2aeipDZPdesc&7I@<Rp=#tZsAU))V89eq}M
zQ~0HRF&D9T&Nw-0JDt+bL#7E6Hlcbi%J3`W3(N>3<a2X0T`;6hPh=p?ZX}}IJ64!p
z3kqh@;w@#pgF1O*NzFt^zO&KaPfo9JO1W;t$ReQ!mjT}<-v5>@!3U)y5v^V#EfdRR
z!6J!77}ng^^lTRP7URJD$b+Lq)jPh@5iK2U(wAA<f@BsiP|AWGjQGA|xx)EN^QW82
zF!o2Y7Cs(hxDU%_|K8Kz(b9xCg%{i>3~+FIyC-a4CNN{|uQ;T(Y9e7hxdGnfcz>bQ
z*MF5>Iv}@sE>@LzdR~K(v^zZ=6E<N{2EDgI4I@HoWOY%he5In~29dSDnSO+1vwF$V
z&gW}N^s&=ExVX-_wL`~|pBF#w7!UA@T91+F<6Q_CjEYJi5bG&c4QD?3IL&YJPo{6w
z39gjNO8xD2F|qP-<_tF&3^LY}Gg`*S9<DNrg;L)MXQnQIyCv+~Qoh=y<nUW}Jo@dp
zIHohR)*fM1ereOD<^LT<yf1y2UG{e<SGv6DK3{mTwr1EIUOrkTEU#p5Zt1sSk>vj1
zer=O$(^l=h=sahuDPAE*t9i5sD_%t<RbN0n{T2J_?yyKToi2dK-rnXW(*UC%+4`HG
zUUI%8?_1Y1v)1=7tUk9CrCYqIFD^rt-qhCM?b&2$|JWlq=`|)Z{*S_>{EN*ck|V&p
zylmuV%NHK=F*)3=*6j(W8yO8oU}a{LvBW9r@W`6C;ct5O#4b`2%26Pc+K;S}l_fu<
z#qNyd-ngQr+NyPM;_s>0_Kmc?VI5axiR153FX5&||KQO~S@D@7=zg)&2Bxh35=p5#
zMZx+<dZw^QSK^qct*v9ykcTkR;OzE?;$vqm4!kGZueifW)p9-inte|RIjlzI3$<@K
z15gl6_NKDcd{^leI`K08mE@o;e`AL5r>K<zDtNyz1&VFpEwVF2(2||^ap)Z2WNJfY
zFrIvWN_>p`0v3~J7gcP|C_5n7hyMpHKrY-Y*ODK9VZz9kKA4&A){q$EkQekLhmlNT
z{cy!<pdzcXRUySB7(Y*F9Ik8;1qf37K#r55?rfSi_#deTO-Rk61gm8qWp`KjDc<LP
zbGK@?e{FqI)q`o188QzO5G+Z#8iG*szbrmH*18*}swK4*qy55{pUFJgLe3~xa_8e2
ze<bZs7fNjxgBw!tZ!aB!^m5R7<j$vVJgSOF$&HBaQ<P|jxIb!(r=|O0x=_#;xHft(
ztm40mNGMrhu<<I#rRoru=huL~+JXo~`2Ei-Y7<J(a@AGgaa*1nCW|Gf*1w`wQV9=r
z<@y+sat)87Gtf0L+(muPT3Krk-G5NVwDqQSE(qHG5A$K>T>_12){i`U<hrVFy=hEt
zsw1*N^X|<Fhj`;m2R6A}EoD|D%~sx=Z)Dg9FkXE;Ql)49?^!=GDaPA=4`P+*QvE!h
zVRF4pSZ=Y!ThRZ(FcU)QeOSju^YcQGD`0TO%B|sNmbioKh2AcQ6mr%BZIf^vZDKRL
z|FIopnPP&OwW@RO890&xZo8q?Aj?u8M>sN?k-E%b&HM)VdMl0C28Y(*cevZa{#ADH
zL0G+`xby7I$|wlMR%@isjA<`>6Yf4{twi5<(a}%Ch*-H?N0+eN>pO2fnP{Rv+83V%
z3<F&Lw%m~%2)YWW@1l21koV-1Ute`8h$o0Auqg58`sLxR%wV%hrcwT!EQduU!u6ji
zcf$#>u$m?67BTQ|A<o1WMbG#K<7RzY!p>?4PgMd)#VBo-5_3ey+dqpA3vpPfhB)(&
zS^?&q8wWFehb8;%TjMw64^WOGZHr0>bM+@3?Dg)qf$CRolf`kAOk#!H7Q&m_9pVh<
z&4Ty+@9=ZR4g7rRRCh0PA$q%3oB3%!v#UCRXUcKZ=umS$dL4S2)~n}%8AAUCXb;Jx
zDnh>UG`k9M$XsZ${6PiE@6~VE7BifgoPC$9fK97BbcZ^E#oBknjXxe5R{E62ujna^
zP-HVQ-l_gsMc(kP)P%w$y~>>{=G+`0v$dDPoLzV0lA1qTTPq9JP^{2mUIjA29dbSw
zX3suC*$&}aRLc#inW9s#KYr0k(#3D}njEwo(*`;D+LV6SJa~55MT&Y>n|rdPTDf8}
z{mY1&5L#KEn1DnMfzPvDNV#4ruJxJ#Yyt>oDRDb1b}x(F!)^=ok=A*R_x>mRVr)q>
z_r4$wN$f4(P&y*qC1vF^=O>+ScTX@s3om$6{M2ji*|$HQoHT8$BRuuxv!;EAnO{OH
zF5VIep&1S@$w{@$k<||6{vX1gT-n9NPYDb6J^#dW!@3+mPSfX{OvF{3jyn<kzug>w
z>SwRpueRqU0M&MJ>orttwn?4&SsDG2>ytx#6<7It$9|gMHO_v`5Q#b6>2<Q9{y*<U
zuQ{t2BV-N>P~D7&CNm$;>}LY@8jnJ%+cCd?KrW7Y_s<|o4OeF$=1pBpi5MGKd$?O&
zz6I#y1Z}zU$@J@S#*)e#yr^SlMYDz%{JTq;d$}vZ3jd8(p1zMREC;wXa(WPQ$SZ_k
zACqycdVV_?x9`3uzsh1JfV73=NI~MwDjW!MYYbUp4gNQ7*aR4J)|gdJ^hhmyZ*XBB
z7|&^3nZtYiR!zE?wv-hac=xo*u;Pmg{b4XFtZMxfgM-$7KHKZTH|9u@L6!`~y@T;4
z$}%I5AI1+KxA=hat8n=K`(_TKZ@c#3W4?>7bn<7}804_qXGiU{gpS&G;%n#p=<yOI
zd+a2Wl#O{(4K==*Oxf5z<@a|{Q3dOE8EYMrfz=5tJtJQ_v@p;PUIKJRo68Bu|I~8X
zR?W6^aI%BH&n7pR+0wqfK`IvHK}Tcv+W?W)2rNl^dy(}j3HbC#`^0DgYy!)d!4Mxl
zkH+4e0Ht^i>EcD;)1c<VWLR%{?fPp&3>f`-=KLM;DeJW$8#q5PU3B77RC`)@c%02&
z?seAq_(p2_>VKn7Y0|eYlmcj)Ufcq_X60$)DU56~*!icKkb*bE=QJZ-DXB45_AueS
zknPo6jqb^5G<9^g02EupV8)i;THVQ8@=27cM?<{-wtJe;_I#AoU>mYfGxA+ooCo)a
z_>5^^&qIJpp5$}r(d4&XCnb_xEJ7@@Q(#HBG1m<Yq*lZmmV&}4K2w0#GnUtWi@{Ax
zDi#)8&QAv}i)gakpe(e3uJF<v3vcu@-#^eC<PyMY?p!H;q$iV(ebozBA<}bnmrG#p
zqQI|Fm3rHzB(JF?@WSJIX}0Ltt~aR0jkixf($%e>wI*zT(PuJ(Y|UH5M0mYg0mMnX
zaSOA|<%!!bWH17N!O=h}#2-nTg)G-L`{-~frr!h*y8S_iPg$`q?ysgv>zV016y)pz
z3qMJAo-E~L!R#O~b4hEg@_xojs$?sK0T!`39Vv63dtK*>*ejL!X}f@><z2<OAiUkn
zQ_w;*XbunZsg4UnrP2tGTA9>b+Fi_zfH=KWmWjqsVxDp}?Uc4V@~_>VM!d2*r?Su+
zs&qT@>wFRE6|>!b8~=?=#eBZzxBrMc=w7@&Q_v}qOZQ8(k=sUnlUVEZl4HyuXae9A
zbBoGWt?jYsMEg@xLaF2z0hYcIN6V}4rpl{*&(^4A6XPScX&Sa4qm;|&e!#YXJbjrV
z3!H(@x8Ag9um}kM6B@zNjM<r}fA_6mHWXUq%}(&%`6Ha!&aA}(#&lQBH0djvx#hgo
zw$Rep^AZW9*{4!+&$8J^L<lIKD;|G*7+~aV-0!<&U1#G`$9J3F{#)f@xi$JtM&IQ@
zzJ1&;!*<i@#AX@A#oOg8qV|4@e<pRQi-<;pAhl(WNGcX5>E&_7g|LL6qjBHmkAW=W
zzCV(h<>gaX=RU;v*!cP`kA+zWSV3y?vq{9H6VauqTUFdOFE&1|{Npm!Sp9wI{$1J%
zRdX2bM7)Eqazut`X=D?Za6*&UIi2r+B1EBo8A59h6SRq8V8l@F+N<8?A4W<iD$hoW
zKV84kT`1eI{Wmp$_1?8wBXnZtHa&&n$sE@y?P!@u;0q#D!3+CI(5<Tpn?w6ut!HL`
z_Rf4k$NaZf0uVwZiCzzbtnotg*@4-st&n4?q8F&H*R+>&>oFti`*LnHOH?rZ5APb@
z8r3$;Iw#2z<s`5p=o|Zx*ejI(UweUtc1Sibl7!oDGHzjR<P{>_bnx99hD-lLz5J~;
zD?^dgG2_w~xTgC379pOUWmLDDE$=acNJ2H0EQ>t8=W^_8F*957cDT64{8o`Xdf7!g
z>pmH({<Av(KlDYX!gN}^in5B1k@-I-L}F?RN%l&+DVWe}71n{2KcWBEIQfrXdNV=U
zdXTJX<bM(dna5S@o@-V_<Vi8V(<j4l!9WU+&cT9oThkpCX;t(@KQU`#@HF)Kllm?7
zd$v6CGf!cmR3PH9B_Y0{)<Ef}4fyiAkI8LXnf-7@n<dl6+rJ@RvpUXoapceY;0Kg?
zIfSe92;X+~pC05)rIC%44^AuCf~R!3F!dEnC$Gj^I?08ozIf2xC7ZC<VPSqmqIGXx
z$||5Yc?3CPfQ~=&G_tBFoh~yQ*1(}#6|p^CMIvJa7+xLgJ%9Eo+fMj(0T}Im>7xg4
zE<ri4l&=iUSb(ORvPpN^@na>v@TIDr*ySk)N1Vq7AAGmL$@oNB>?EW`IA7rw_Xvji
zN_d8u*U7*0`wySwm=oeZdB66Ada!Ao@$fAnkQZ>OI|RmkCCO^stFI?T$-L!4)|9L?
zXy$_D#nJKq8Wo9TllW_r;YlpSWz&1ZZl2qG8^IwK42AyK>{!$KYFIrzvoNNCJq`Nl
z1L&99@vnVbHT~x{)JI2`?`_$1<4wJflPya15Tdi)nk&oHCv%QBNB0f@0+G&@9Sh<x
zOT1r`m@km__(t2<02rDkTuf0o+LBERg}iA@SZ)o7&NXWe+d=QL`iB?=0QCMYYtM8o
zQ3WqT@!K9Ocw1CC6UYC+2NGFAyW~rH1&Xl+42O{+0Ul}fWUP;f1ey3Wg7J4F0hYKI
zwd$`sGF21YqN9YoPaD!|yf5@-!`E(vn(L^u@W?!)H~z?K=l1RFLO+`9da=%Xp1C{s
zoj0}7*&$M8blsLk{Bz_#d=^-2oul${sjn`tTJK*850l;C(TGo=erzj0RrQz4W`!Y5
z=9|<$EV~ssQ4^9~h<8g#{4Fb~@H8$mG>J=_7p13^FxITArHDl)L{F}VMP0z&dT_(<
zbm$3<J=`scP@KB^NQ5(Nu$s8V^~WeA>cpS|ex_3re15AA-K~;vlyk^}v3DM&9(FeH
z#_egU_~U$xVm7bX<=tr6{Ut})ho0#oC=7o(|M~8V3>CPs6&yj@9mjs6*@NxpD)<2<
z?s7yUvVh>5Aue5e+~d8yKGjQ&*ld~?J4-5QheZgsd&@kd$k6`f*xZvdBL-)GRH1Pk
zYr|oBP5I<;{(m2chh)mPQ`lb4M|HF!K}hWxa07acAX|5X$*8wj=W-OlaTpRv8xJlF
zDwuYuD#&dhEX{}}LmKuZ>xkhr#@19qij-?(ZpABE9CKYKxPXe!w42wZe0EZE{*<2t
zW@7wwue~T#ImXaz9?#ci?}Zro@({796jb9;0DwGecdH%jAiTCV`$e}b|FsKrh~ftO
z2H~2k0<p_N>Wyu?%sDPFp4R!L^v1_OtdhfS$IVoKki-giK8kMc_q>%xcdJLKOGhJK
zv>t1N7hqj~tST+8$pJ99CFCSgOikM>=aHLPLT|;~!USNDKdRZT;eqZ_mjr#&#zl+w
zY6N;zK6{(0Y*$V<p)s*~cf@?C*wJgknvad8mrrigiD!F?Pgjnic{tO%(sYfP?A?AG
zgVMwr>9h0mOLAri7ItxT?8ITOn;KaisNnxR+64Oc*PBMF&~UZNR_wrtsm}mVD2`^?
zKWt_^n>6YxZ!MeQm;IXw9ZXTnN9awQ!)H%Qrw18bN?3^xT<2DS@`5La%@MpY`l*ei
zVmbV7hfbUkrPmdLx;BkX^YsW-DtDq&T)KVB7&l}gnY9d*EJPoK)U87~r%Ibq!zVu@
zv5U3{dJ{F1=(vT3Mm;5t*J^o+k70Wn_G00Jq{b@OQ1v+8B$}~V;-^1fu(vbec-Vgo
zpvfWsFYbewZhbA*WYrNgOu~9|xn<#Yush^!<?AIw*XHK^pq`Y_ZI%z+LH;FECs`6}
z4z1_MhEh)UgV7{Ka!(}QH*ZOyO*%j>>lev{m9JGwkg^B2wnlSY{46E}EhSdDJAXNO
z*D4aGM*+Km1-QfB7<#&%_Ww=B2uj|%OLw_Szs4%N%IwHxyY_^s+k$(YBO`@Ps_q*_
zm%_(e9NgcSHf~bA1!SZsZQaj0TQ{{6`2WQ0fON$RGS9Z_LI6K>=pG~)kf@OI3%D2d
zCxFLoQgQ_YrG$>Z1zb&RM20oZi6#^tNitZ+R;-I7j-@r;rBKdRxA=TmAidd9vm6K=
z$$l~Um3c0@A8C_wlPlZa-=5;Gyo;$cq=0IVSyQj$4<D#yplPp>WnL;rs=9R2-WVng
zcp{eW^i*hW$#ZttceF_JK@nHH{JwC3bN7$u0FW_1ki^Pod`(JbiX6bBpr-qYJww8=
z<xNo|<?d{wm+p%6g5qSm+X(h8??DQzjgbsNGXHpA+Drh*<;MKf&Fl$R+s`T%YIH%H
z<|s3`eDwItC~2;z6W{&cD61#8`*HxnPAn{)QA|d0yxGfsVIUuegq3bo_%7Lde5jyA
z*GRdXS6eQ{4}No<*jX`bT_*0RPK;(>e@X8DF<5~hP%G2LdKNOY)<p~~Ch1F64H{em
z{>XvfQrk-edo0iotps%#V0U%O@oQaZ-2E8ZezBU{XfxTM%Jd}|p3VWVVe@P6S`Juy
z!y@VYy`pKt^f$_9#(P?)JE(tQmP5%p46{TBjTnXOO76nBN=_TkLAefQ&VKQd@2BJv
z(?pCrW<?;nt(JCs&fxE(xspp)XD#){Vs&RNt+(I;6}q@BsgHA<puNi!F@(`;WDBKX
z0}hX}17XvIobhd+2t3km4Mje4mtr71)MA}KMIX1c>fjvL*lITYp`pBgBQiXawd!4#
zFJN@R)z`nXu@on@Zo7xsjo{jAS>*;4Ni@#y^*!$y%ak33vY&nnoH&nv8S5;_IQy-Z
zldhj|Kf$8_T8&Ex7DArUWr=zCQ_O#Cx2VARI+%s^xj3&kak#9?&oc0v{iz<zJn}IM
zXc%?biXB8xYbFS#TC=c4z%Bh236&w2GJAwRdi{n2-pE_Ax}s0nPxkm`N)ROI{w9uf
zbK#d8Jz~cN56vGpcY&~xA}#POcz7+-*Rnp?o%w$Feqc<+L`#8A_Mw44H6G53Mf)i5
zI5#dIaho}X1#UPTrlVG>p;Z?5o?0B5fBlfJpgoH_sFsB9+Xd^gxLHM<kE{my^~0iU
z?1L*aD{DP2uokv)MwUv@;+rciGoORbTaILxFTax_OXcMvULIw5P|LHsC&Y2!z6Q<^
zmStQUe2w5Tsj&e&YoAai!(^vWN}}*PK=)7j^e_QSTQGec^|*@>pLCf@0LD_H-Lq@e
z6BHNuE1F&<4L|$3rqp05y7pp+=Qx_0s@I;1rEi<obiEe9BlA4s-9k3QMwI&9Sj(2w
z>_;J|bDS64pQX5nUG5|=^|o(W$12TKQ->QmMd{_Kf_m6lwmkb_`dyE|wFnB3wawXv
z1YV9---GaY9!D76?jbE6{1(~F)}*KDH0}AwsrdsP3vI2>Bhr01e{xHigq!pJjG0iX
z%unYf%WbE;@CmBYH+PDt$7BNZ%Gk7&64zP{vlwb#cEv&bAkitsMa8{nu3sydRRMUT
zfxP@_i10t+m%8)(Fb7?XeYC<E5+fxFEav_@-#xn$7iH3)SZHJgZVJTC>*bHA6eQ}j
zdRzn(z}j`yG0w&AfAVoH`BQ3&X3aZa`noqb7nR7V<HD|K47B9RI{7|0Z|tx?2K`d@
zPqcU#uFAFsKiHwQbrfzDg6+-tWW}lYp4@j@D17!X=V;!qQ+nJ7N*t*v=f~SfUtb1n
ze`^yaD|Bl6Pcj&rLK8x<_5Eefu?DO~w)0;Wz-@ykpOCA>Z#R8n>a-K-J=D_0v0<5I
z|A$$t<^gSs0(;f6x5f;gL=u6q>pW(h2b=*N1f(no^|h`d;IZN#yM(>kQL&A4P_{!W
z8$LV`GiV@XGk{6z`Oq@N+c@!rh2+Oh;q&cy!hV_ZHz{(TsFhkh%%UsGTWM)m(%I4C
zyj}6$@0%-7sZ=&&u7l{z`ov$7A1dC%Q6MwU899<J%uUe2GTTOg?-FXve^?1<@`Prn
zmHjHJ{StXc3P9tY<J<a#)u=zSuc)_@HA?RAyKo(J>TM~rRwaqxL!VtpHC3y*>k6^k
z?RjH<<WtMQ9Jc)mM%~5^JeKEPIEVxHNzr$*IO%i=)s&0IG@<s3BGHr&&xU3^(gjpr
z_gRT%nFghM%Wuu<+1mT3Z0&Og%za$S;fcn$o{MwmQzkX<<tHpS>9H|6y_~ItPf^KT
z?thEJA7~TqY!X@;RXGD4aFV^y2N$oB_T8Fs&7r4O@Q)o}!>OwFaeUHuj>E05Yo9tJ
zlVny9a|h_2Q8P79CB|ZPR^i@fj!kbWOy$8+jTESJkC~IfZd(p+|JMT(1VQu75SkS*
zT>Pe?pD9Eh66a96pDX=2hKq$1JXX)NhMNGGU(6kav{oSKBJIY!%h*I3^_DwE0bopv
z|1<l39EylKA~XNzSHD{|H$)|qpB~68EYUWJlW-dU-~_*1B}GP%qO0%NLZkCqx5`|Y
z0OEn`DDtQ+;#>9w*&5qM#HW$lZT~0$!J5Q*tJd#A^SRl@^PS$5+iz)w4T6vVbo+ei
zE>!<>#6glIG}rC&|0CC3Fr<IUagL7Y%+O+_pC=fMKP30I;WqtytDVf!yL_DYLEZIH
z0Zx|g&;E164%-^-;2}oz+=L2qLBI4~^>n`CU=@<&Mt1(NSZrrI_4yMIKVX#a!mkRQ
zjN_8PqiGR!X9UUmN!az31<Tfkgj>Y}FJl{b=7a%n;wEl#P+(^)!9~Hk>luW4RBQhX
z8WEe3^om#DflB%WiCq#L75FGEPUiT}zU|IuYaWIv3VV_H<6V|KAlce6(t5cqz<2Gd
z-rSKU${Fsr%xV9EF3hx7dim&e>3nNq=Uzl)X&jrh=)K{<t3bQ<WxT|_HmCCC5ktpu
z8Nf^7M`3?C*4b{bb65q-D`2M9o7$@2)}*d<voI=?nT<ZZ+LBz*3OjX`rpZ5B+t<vg
z1XSp$nt!4tfN6b)8Ab4-m0AC}Q9&T(%EBY^oO8}*AgB(Z0YiQPZc1heijF<remR6G
zXfBE1z(I+0Q^Fa0P}7<=*a^U`OO}W^Fjd2svW10S3di5*%3&bXT(wn@a3o?P-Q0IN
z&bRjwBGr}Hhcj`m{34%`9^<@{1KD8?R)VfzDv+grZOkVyrTQDZTw&G8IuDe_<cN~T
zhnaFmqIWs7=*pQ!D|5K<%wv#D5C(keK*co36@ch9uobe78-^#3%C14&`^~sYrL9LG
zQa%#{##WN)dRvGQ{4g&;R1ioPoF-ao*>3rhAME`wO5c?&N|<aTVWmTIVfAD*@pmi1
zqe`PzpFE(Nt?<$DiF6fHk9nRlO^Q0U|H5qJ=HURC72ORty=V4ZSS%_s=v<?`g5vl5
z&z%+zSK_*iplgllW(~9Y<TfP42_(3(e&AE`@|#sw4yN}Bv~1@D&R1H;8JhCdSMc1y
zjx53Z1LIh5>c(}+F3=?t?XNWU1(U_GRN>fP9x$3jnq#HFC7$>W0`{^R#n3oS#i*|0
zUzdoJdjkBv*H)r?C7GCG#B5SpTHcJ$ZCoynoUc1a(yUOAJoA4IzuHU4i!DwpbaHF5
z8VSOoCrb*1dnKNvbtc5gX9M>lM*hAT$kZ#6Fb86E{qvFnwP#K=%pzlG3p(oE0GC$T
z#kxn<CBZb}L#339zIEL;w-x7)$>y&Ja(f&89>Ad<T77A3zuyh}^L{|XZwzr^fW?b_
ztWz>F2R={)zw)Of7hZVPNb)+kpduk=ez4;+%zRj~RZXQyowJ&svD>Migc<-Tt7vw)
z09(*(Tv8Li<QH)6YXy(-_wcl1w4nusBJr=mMb7Wn__@F}<8mGu$Ad(iv?2ceQNm+@
zE!dNjSpZ;rHDP;G<V!oTE{8)(f9~Crm)xFeG2dsqrt*<BNkUou8inP~@5hI!Pn^|Q
z9CEx(%hDu|!>DPAIzH{XZ32fH;?>jRykPBHoPcwMi(fY9K_?a>Op%+Lb$4CI$D5kc
zYN>MkWILL6?wvK;99Fk1QMc6&w3z#<Q*?2zC>}m-cQzCI=GJr;;a@&i?K<N8c~1BR
zJB3eztX6VfFjL*D@+th`hMR6=P4KF|^!;(6_}L0UR2aCL%S?e~lACWW%<gWe_!#tY
zA^>js^~qc3qGAE~wthz+ZYi)|2TgRSqy|(GQ@xY9;Kq_TqCvWiMht{@235l8W={Sh
zhLOZpQb;2Q6w}ui%j6=x<lDhkOQ@8Rq-ni;-mp8ppE?O^5NbreOX1V0H>`lq5#xC9
zB?v(pyp!vc<yO;xJ3dLg`zV}6%6z<W_fNBVxO>GyLrgZ$EjTgGK!Hsp{_T6Kz{^V;
zo^Zcqmnyqtni)_?%#BAcpmWkrGYZf=t>fOsOkxh%oUZFpdmefjwVF8ocKV=ok7474
zXt@o0PF8Z&;<MLFE;w1jxOkK@_VsfGEIn44fXAf|kG#t{BW)Ls{>$*|O{ukz;ffqE
z&ywA3m~fc0XZO0&w`hxH;V^Gmpw{q~3#}c0SZS#D%Q}CfyAP+%^Ayd1)8Ae-hIrnN
z%dDguSmxMR?75>VCUrX46iyL;Z{Y>qXAK)k+c$I8xcb3@{X_BFJrv7pN@wv8pH3F_
z>YiupOS2icKAZ6W+bAUt93&#esDEn=QUFIO(RVYNCY@UY85G*eP0w1m_WZw6Ffmf5
zcO{rMWX;9ybo2*?DB4lI=F0LOu0%wZ?+?w?_x9CzYsyit@lVhx8ke`PLD4EQeqT95
z-8Y|wjT*tbeC2+ItoHaWW1IE$I9`Yf{Sn0Hr5aqUoiN7S;<o)*#&$PKA8pAjEV%XK
zvzF-7Vzr(g<tD9D%Sxt0*EwLE^5YSR?|wq#8Jy!$N)vmw8d(CX9H+RZ!<5KPn>4pL
zQxcfYAl_Wkq}gHsTVZ(1cBo<`kDAT;s4IHCqHzX|-Y^m|D{JtJqAmhfB@$AzJ^s<#
zJ0$;sl;%be2@nsQdt8PzuqCJNUuimOBOpDbU92A))&Us?;D&9Q8Jm(=o4%fjg@1s$
z7vsdT^PhL4raxK!*5mb1d+HJo_@pZJ^V-}8gY7vowF)VQmJCWquelOC-q(4j^c?O$
zzK&<~8%|bVs{H3_l=_%ha2$NZ_{KltGcx)9@P2gKMh|P2XGkN3a5K>c5Nq3DSg~J;
z$*ablBU=VqS(RL4+3I1s<J3Ll-Fnb>s*%|DE8zB3ZAX(&SlPgqeW-0@tzZp{E3_Ya
zfuxg{NE|SK9?A(tf0joU8o+8>T?L?(z>H6CzI&i$m)(aIk9;oW5<7+I!>&C<kSi|N
z#G92HiBhE-i2M^=7!%h%1G?(v0jAl53qzj1KzIuK+AWg_x;^6d%=N#xC+dKXHGc9#
z_wiu0BVy7;|Bkg7le#WHFEyV)*+_<D!9emauA6nQ<L}XXsosfrGX2Hgfx+ZK$4C0<
z&6d_=MF3r`!K^dHPjI6ev!=&9pR_n;g`ZR37|X>uXy`YX=FFAER}Vl&fZN1TOkm~(
z-sgGV8@Ae9D<Lt<iJM|srG6A9CbH%)-w}vyBqkv*OwBEtZU{1Gue$#J)V)5uesFMb
zi!xOClassO9U8&v-zMHitHNA|bxo@7#+=ymii62F=jah{)IoJuGweiXz5-OXyz^{q
zYHHTshpY?zoF^d}1L}GE@F;H2JHsmY(i%)va_7juav`w!D;=a`sKkhN*X}U!m6p}u
z8^Dr<XC~Wt>+;14`b$F>32b*b`&Zo??0ro|Y!TV4BK8m$vLM1Qkrn_xOo_tc&d-#j
zk0^&Kuh=E==5hDVO}r%4E@cY<t68v<HoQmN$ZMxu8l&o14!#IbiCNVme<eSwq>iL*
z71-z2Y|SCAF(c#-Mc%Dn1l9?q!Xl+wCj6TI-I~*UpY`r<;TBil5}>6X3&#b8ir-Bq
zc!fpp^ZjaQj<p>U!PQM*QgVM`zv#UPiUt3g4WCrFXGIn({-~JpG3UPL#;J7fj8IB4
zg@H=LPC;ewPpivmd-kJY>{S&nxMgGosr11ncl6fF&RZ|v-QqfgWnC2&rCD%Uteiu^
zA1`Xl+;nZ@-d^UtXuQBEo@;B1wAz%k;;<*M2@I+|t2ons0V%!jEnZkR)*-kQgxc5{
zIT6;bx6>AE_HOy1x8mJhabA++yCmOoRyC4Z*@A8af1q8l@Ll0sT0o6^?~k5uDml)A
zzs3m82oM4=5r`c9R$iM<$VxF?g1kZ?c0AIv>}x>+Kw|*~i!5Ss1#wz<;c^_q;vnU5
zY{5gam#Kwvb6zMr!vP)LGj?##(N0<`dpx7N<yZS}I}pz@0of%56qtMqnzX)o50nj@
z81&4d`^J~+8&v6(fMKT*;m-7l_Z~TND8%7C{e@;;cH~GRnm3?)6C8MN_lk~k?A5Go
ziE6w8;B5c=dCPGgq_`I(^p<4{(~SL6_7`t<0DfFiyRgt8`h+dc<Ku%FzhweY4*8Sr
zWa;R_z{)F!GOO}VaquD`(R*W`8dzyQ&c!kX3)wR8?F&MB^yz?CjNS5BFn=efN16{&
zf$MtjG)F-uc4t1@T5S7qHKH4JLEA}ug~W)kpvCEVaPfSwG~?2x90`E*>6VxAK}7+~
zzG``R3nh;yWeYN2$4rgPtoX-xk5c;mZ3>n>{f3R9zy`_hA$Q!;t<n!ZuI_j*ui%qp
zc48|!#<v{z_I({&bo=Dt938jTy@oU66?c$W@$T$~S-1?>g;eI1k)=;X{n+iSLLJB=
z0Ehd<QkT{Do|D_T9ap*2Vs<b}9A+Drni;+byxr#G+iT3|q*elRoFB!fJfnyzqoaw^
zR=wri3&34WgXL;Z|DJBHGK-jI`EFfVrFxFu^ds4O<Q$d~X1w@yh<`In1TJS0uyr>&
z{gVg8-Kd$A;)1(mtI|5d@=uAc?I8X2#g#>W9~G2;^y22^X)GO#FjyiIK+87EbBM*1
z{y%(O2UJtp)>Z};MwF)XA|OqA6%Yvug4EDMkAU>vq=iImbWnN^f*~MHsuUq85Tr|J
zf*?o_9YRY8;g2(~%zOVl*UDnugtc;W&)H}1@7uL>_}CZG_T|bfQ(StN?~U}e+rgO=
z>2R`yMl;8z9%Oef>%yTUWIgps$F)hp(2_08R%sKK7LK0?!xD7lwRAdSsRUygKYqOl
z4rf5V1oSD^!nE}Zp@gB*EG6Bvav#^AA2|<}9iM%8Q?>B%@W+}2p!j*VOA-NGtABMI
zKy!3}YZ^X~TQ1(NR^4QfaA+mi&+L6{9(20d5v+2G$_<+))}W&gZrV29)RQ}5a9w2$
zLxR8`>S&gms59DpG#;Ot(YWit%DjAwvG7ZH7y&*KdQ!J)hAopTc;XkIUwUCEwg3J?
zDwPhqgYM&if^_KIZ0rx6?9S~kO!?CK0nSwx^C=x)vWjun=+bdni-N7Ynxjq>0uLwz
zBnucauB#*Y)2!t;8v4;ZtF6hl_(2qovvECLM1U@cwBOdk=>=!ZoVug5JcTPFH@6Ut
zXS1KuLc-x*tvi#oJ=L*A*<K9-oIB&jbFzb<@y~Y2d3#JCC8C^X!$A!8n2vg>B&PVf
z>X~@}*HVuAcREm5(J07Tne*M2m+K6jU+Jl#q16T0=INBoZ}75kT>SX(jD!km3E9Ja
za7z-*S2fn7Q{-81E+O{*(+%pOi`gy((e8I;H+In6fSD5Qa5#XIK|&7?o_yG1is|m+
zWW7775kULUI_TXOUY!Nf#L|(?_ch2x(UfmQY-@$u7cQXkLDU`w1qWW(M1hokWVE~O
zgm$*n!@h<`){Y9eBk!s0nZ;$Pnb0MpNQ5;A=6Lou(#r$D_Gek_L*s|ct#GQ?>@t*_
z(#qqO;qO&jQfQ7E`Id>V3iAo+4x5c@@~-<=(>~ulknSzdS&jpIe1@0#;-MFIvLnI6
zk(e}Q-54|}o>77NvE&+&7fUndoL~Q?H~`J{dZ&;UperIeDwFFsXZRz`Ag>8mpN-DV
z_-(gjr}d^yw$e9tMl&n_>4wz>Zr4WsW#DpdxVDnGy74m?^@F^N5?Nzb;S*#q=KjXB
z{+k@sPTDmR-jAJYVt97KM|=BPd7bvwk^e^Jus&*;nQQ+=aI?MgxAT>CAS<PKnS%z`
zUe8B8`Vj6@-_A}~ym@cUpz^EwsS4g|UQzGbi7~zLiBZy+4J<ie7Ji^BB0eos!5gCJ
zn<$Hx2uE`vdA}?stTOM<g!b-ZC*3P_LDr#mq!2rEhml4V`&akE5V`f!3ZBjQP(1u>
zuPAxIuQU2*0&vit_scOWhl%w_A#%S5hA3E`KXTLhq9-SkcB_X@CG_xlLwZ0Kg!kp;
ziiixm15-<iJ)%Q8LXl~ToXIF3cCf6Dy*mm(cnhmu(4UG>THK3W3Ui`=N7t2Ry^$fB
z#H)R|Vh4F#>Opu9iIk|);0!E-On1DWfu?PNH$)FXa1^}KAS0Zlw~N&}PzFtXoXq6u
zXgR>-?##VwaZ^NQhLp%UOd(>AB9D5p-|%Ti;l#Uc>k7W#_{5rsU<@P{M9LhtSm(KY
zek)oan=iJZhCF|v>6p;K_L?C0HgP7*Ez5z_KUY)zP``J%Xc+^$pEzxWzj$G@CfB~{
z9&Q?yBf3Fv&1`!B<hgztu$msd)v^<u(5(I8fzNuwi!))n5&jsCiyll8M%g#tH}*Vu
zn(GZLjF+<YqU{AY&0#ht@#iRzNzCglL9LU|@iGHdZV)Gl1aJc%zX^@4^=}b|166HH
z*vv@rz6~dEUd*j5WTtBgv6oh#9%o?{IIJ_A;u{|qcU&KamY^V<9v@8YZ?2J}GlF@F
zJ0YGQVy*nGv&f)>oARyTvmwQ13^)G5rASjL2+Zpw8G-?H4;rslTB3SbDp=;+Ty=S0
zlDdWMQj?@okM2)7&Qoe+@aHk48*JN&pEu|<;^==Z_VP&j0<6c+CX0Dm4z`=fL|Y}f
z@fx!WVw60~C>cSY)|QFn05$vX!^f>(J^Jc6s6OHUqjT6HQRNCu-d6Fo359C#0_AK5
zk9;eA5cO8`xVZ1loov^k&M-lJ8a|<T+1>lt1S@a-Z=3I|vfNf(F*iypbGaHS!A(f;
zB7i6n#a!cAi#2onYONW?6|(S3?H$|A+qe-%*Z8aHEGvWDUGN75d#+QcZ!x|}fmpgy
zvz2L?OH@@a89R`0KM$4Hkoo=b0G21ro?@uEx32N2p^NF>I}{b)j=x_Cv-ZnZq*d_=
znhZP)_lFJAJ>F{ASdyI~-X7K)Kcs#Y@FM_^U>@to3s9<6G#(MwD(5ca;3OK{+g=HM
zID}{j<@#`%C+k2plX!c#a?-kEnm^rAy!`!=ACC_VZhPs~)=(sO-yz!}zRPhU(Rer~
zP2)3cYdQ#%Vyti6tl2p6mA&#1m|cOgEa>1OjGy>&<7gTO(w*ExH#3nKKaq;0a~6I(
zEdZa>+w)@kGhI+-&h<f6(0b*E^@6>bhMQSaK{Fv%N(<ZbIA;yGX)0e=uya`R7I{Kr
zJMA?5FcgTog;82Vy=1y<ce>NXrQf{KU`mSHQ4IU>+_~oSsoHwwgtPysLOi6a{HEh8
zfK2mTQot^j`He$@f@IfNdf@nsY%Ua2#p48f*_?2?_S&_6V!1ES_UO=!Xdf|nE^HFI
zd|Os5uy){hYhxTss-V*MZoz9L_>Z{?F2F4|?KgWG#@Xz`+a7x}f^uaiSKZ6g#amXU
z_Ix2`RoPxE$$<2rnLsNx;b%qEbIjC(fI~B)5fU^Eu<(vsK8U*a;ML-(b>p&}%EcMz
ziEGZ@TJ~l$KL0~^;`cC~ox7!S^$p}?yIoh6ON2Q_(5OCLkj4{{OTj#oO5bK)lDnVu
zLio=~&}Z9EKEIVcw#XvL<J|~pR=5`$tegt|@@g%Q{b0+_OXTv@Z$#A(FE2}Z?9p+c
zh{WlD)BX!xr)NnShcl*|w+QR6(rlJTWWA~Ct%b>h(dTiZX83zXn)qYeMzuNhZGq-#
zZb5s%K+x|q!Pq5yfT({(i%$zAa{I{+ucB@6p;uH<(B4E#p^w@JZu-#oe1Mp(AMf!{
zEB*6ezfZh@65J48N^k|IxohFYq>A$)dz;Dg_k3WzYaz>Zk;9&+UlqmbF+3ra0j)<1
z08IN1-c44&#4ihy+AppJ%5Ag{-P>eTQ|00-uiFRA*Y4c32w2u;?AWuLZkm%8T3eQB
z7-8!|^dE*QoLc*FA8dfO(t!3N-wT7_DWT<|>TE$zuyd3I^^b%e{mO_R=K_N|FJ8lQ
z97GLDz&N*8FNP2M@3g$+p&XoXe@}*4Y)6sY=dW*Wk@g#sX#;M@Ej7rVWn@vIGNHxY
z2c--Mc`}~RC#RLjhadUWQ24WIqCDaXq1y4U!=yo;sY9vr`ORtg5*hAxP@p!pasll!
zJgAoA(NAf2K2zO7$z2-3WFekmzQ|!eTY65&DS+&e?J0qDbd8whDk{gxXyVN^6ANr&
zK_}-tX(oOWn>I=f6N;^_@HXj=E^0Jfa!2sA_c=?b4O~Rd1k}nb5n<(k;K#vp2c?#$
zELJ-0VuX=BNK=Uqdq`$8-p~YQ-VqaHz2xU&=k5lCk|vO&WvM`A(*4lAR~Lr)K~pbP
z@C$_j6P?S>5lu^UspNxpt6#adj6BCIA>%W(C9C`0$0E<iNtLZhMREH9PRT$iQx&=R
z;u~SB-J03If1(;U2FiG<+>5>z+Q9>h0So~|Vk2w%<TXR34@P2Ad2jAZ-R%>Pm+Ks=
zn7n$0EsWF%SJ*93Vhs%boE87kG5UM&o5eIRzwKKb3Sv)4Q?L<nuP^G`drFHL2cHCZ
zFES>Y9yEM^k$vgFIbY=9c4%ByrNL~#O?R$LFmFe@>n5gY^4nTvi)GU?*h^Ole+8R;
zjM8uJOr@{smjW?;N9H*-K?qlOTF44u_bBeft0H8V+Vvc9E_M*t?cXB%l2lTZC%?aS
z8e?7kG9e?uHxx3{@Z@QDoZ^ys;9ZZ%we`6$(0~KyRwwxEifo7{{ZoTX`<Rm9gy!|s
z`f1<ylk4fEle^G6bH19~NtbUC-q0Os#DepuGV~RHtPo?LWEG0=$ws&j*cA4j-1b?s
z!;%N3W^F~>ixb^wJ_|-99~@)TnGV12rTZz|W_mK~aG1jY!%Nx`ae`1D`qLUC!nmU5
zJSLf`bS)I$xW))9Y}qBoM@KRi5Lt<do!$2<SX}x(Vm0$H6$%cG)fS-i)8fJtrMdCb
zq`I0Z$~!qrjt)8R7JAOC?;Pt7@`Kq9?{kBAr}hrTa9FVZfE$+s3-6I5axWnRl>i^~
zc7NjTSR01oy&}Ksk@jlqV|x%+Hh0CA>Q}GY^t{dF;D*SwX4eq<{IZ$-R50dkE|9yF
zo*$*#fZBTPT04a9=5>)8NpV&D&bgleeH2{v-4&KukX9`s-mfx$)3!RqQ{}3DdHT$6
zP*>k}{_IXzO<Wd0CLWMZi1W?L8)W=ct{yrk*Q<3J3$#t;hE}ivp2nf}S5E@h@+$}N
z?uK7~o&*{SvYn5VIenF&p%pEl1(($!t{~q4v-rbVPNM1oX50|AWel2|n;0TVNadb3
z#qSK~U_fgIn?Ai&J@Vmrb?*uj)U0Y7#zjPddV=yr<u%EQ=LR=k5PMaYWD=7YTRQAi
z5b|%NoBTwHR~hM!aMvh?iyr2LWI$kL*2jj}y??@i<THW{j>M3`y6}qoYhLeMvwVv(
zhv$9oHpm<wcP=Ah#gCm;IKOTUSmCf%w&GpzxSNyOr4^Z{9H@0}=PBP_rwSah4B08H
zU6Gani+DafB$)H+o<habmo0P@D+0dGVj#1WC*Q372h%Sr92M7k5lc`sQo*~zMSX$^
zfYbHisoOuEF(Sx}6)@h|^n@AHt-<cOXWjo~oyDQ#R{DILjIE8;C4IEt+mtmK1-W>-
z!yQfT#pG@Y<wK8YHaTa59tgk>k|;mpv#&H1W?=7nSunxk=1h$@>O{b^b^kKwcUY-n
znM1X3QL#hJS4I7tRVNQ0z;8BHfVoP+<-yOt9qyB7hHm{>uB&aTE^U#^OIvJRcFqe`
zj?K*ph?D^^3c`Ku621*NC*KB-FTd>&o*G!6PXxp@7dj6HdChl4Z=GYZzP>zl+QzqQ
z%Cm)*u%b&p{CfP@vN&Ok4CT?W;LXoRaX`hz5o}@N4P^2tK#2cX;h^~GFqteE+{_)m
z7Buz9cr^?ch;Q|*C^q*^m78yhEnOu}u}D#`KU!#eG9A@8OdkXS-VXL!4VqS&uK(D`
z^j!elHRMU%B)mNl*`ETW4>CTgoj!ZoeW(%yBK}a^oJrVHw9c90%3}@N5cm>L`GtK*
z909u=rDXYLueX@=2B2ZniV<*iNLk71b5IeC!HNX-xh&OR{)R~-l@Q%z5><M#NERD>
zHx<cUkXpx*FKC&tC1>;*i|gLmPF2vE$cXY~ic*ag7KXBTqI)_GK@fZUUE~5!k$g{9
zi3n;*h`E)3vL|@_WWEn5P?8ikt%LNS!ptBglP%clOR|H4_%cBu_%vX|7r9t^vBCby
zEw2zf+abOGDK^>{xxE!M#e16pMDJ1ES&y%kfUN?&txF{5b!%v@gnfL@)E$(#**rdg
zAH>gu;_4uyYS<%_DNvvA%=F=R0B6wNYkb}<^_q=GleedRHUQe=kh->HpmN%nWl(#-
z&bj4|JW@LNM$q!c`-dp<{BDtpgE_mL-XC^wy+1ZlhZT^wEI-^!g0bIo-%lrXI@^|w
zzVhvCAN#gt)XXqnrLg#6<1&hSrHQIvGiUSugEXK+cOXMfhx)_$7^+r)CTEyi(@}x{
zoc<z`ZQ9BW$RubFzL*yEkt!6|k1`+}#tsH59VP=+62iRT+NG6^wo?-jTidRL=FQa2
z--{B_!nltoG}q>W(9r5`WLfzuFvT{nV%*^Td*A+#84jlUUmw-ow9N?qK7m{kQ7X#y
zB6LiT<WSf;O{5ylG#pU2TH8qDL~9n0IK$<)T8<Nl6ljrCs9}!Vsltq0U+?_E%<^GK
zUaJq{llD%F+Wo~Vw+_t*CFlEm>$<*0Gj>LOWI<60mlp>5bp<)kG|SCb%!JLyFhT7;
zQv2u&!nR3ajw_ef;GN6<L~5u~iG`Bi#zlA7YP2S9a0%_(wL{)m3Ey)UC6?z&51^z*
zP!2p$zohcrE}O5!&Q-j2oOIe6-{pwijvrAqB3lpdGpPD3RgE&L`uudeX0%b=&mZ9)
zVncwn-A%Zy(kp~-8?*6y2I#0iSkg&B&~oFAcT?_Gb=cvhx#7|%$jWfANe#EBYjX#p
zyz#eOI<(=PV)xf0Qs<1X?Mp>!+E>b751us7v~G-w;AVeA3nm6%iB!@k3G4<tEG(ZE
z$tE@ycAQ@L2R4D)QPRzS55?^Vv<HIT*ZNn8%m!?WH*X~;D3O~{4jym3N&w*3_a>a-
zi-7kiV$ww%9OYjrF32r`BBaq-%>XM=-vJdy!2$Ukw6}x7mUf8Ins?7$cG@&-p$>=Z
zn6kFJZU<?H5$#U*65YLf?b)6zO$SZqozun_FD$zM^b*#hE!h{s!r&o<=)LzB2YT95
z1athnETM?eIpEPuR5K7ha1s^qVK3e|f!(`FZ!>I`)I5CmqD0ZVK>jC^cUOKpoX$ON
zw0w|F_l!GEv40&70@FV^fE#Tg(t(lO91<AUArgZG^{tg{2i!?7xHI)q;)@1_VtYwp
z@5E+r#j{~!c&a|(8V^U|3#Jogb(<O%x=Y88tgPuDU)uZ$T9|WTPD)$epiZrI5<c(Y
zW^<>)#z1Ztv$da|c=IHC5N`Km@r}~B2?r+}ycyGa!*=rk8LTzs=3d5bzZz6G2-bw_
zsla9WmED^@0B49bxNz&iZF0km0rwjyYo7tEEBu63Kiq3Qy)src;Q44e81l+?>(s4j
zp=WKFTo`HDi)<{z<+mqX@(s;t3Vc+Da-R2x5){+l_|7wPzT;u`u&ROv9q4s&z%-bU
z@8i-r(jGyhR$y_=>LgrIGfwUbv4CQS{Z%&eybT=)?PJr0JU#JN!apm-1ngj1X11!l
zNsiQ~kgA`e_|I2d1347Xf-n8bLqL+|Ysk`heMnkP-zM~}tTCm-QW~uk|277Uj&sr*
zHUUUwJRQ>X*nOD@?JSBf>1Tmv^|EYarT!McV10Rn`pt7pr7wdpHUCMdi$mWqS#j#9
z?mAxzrAx_t%1wKc$|sYmG|v*=;hdwexAwZ9Wg|9JqM5`3R2d}>N;*I~YPP;}l-=$h
z@^Ai_wbe~ltL2Qr2d@du$CmJktmQbFfec$HesL`4!jR5s-^yl7ZL{(w<#(^HX<W(o
zN6Tp>C4|L+;WENEXGL@i?z#86Kaeg*Np!|<x-U_MwAWf1e6;hVajTX6B`^t-7B7pr
zzf%pDTHW*<W#JdhMG;ned7w?Nm{WGPtD7Ii8>i1eaC*HIV9<^tb*YG4)2>*T#f9-l
z*S_DJoQ0l`8mAAl+4v|y!4|(p-+H=vJn4)i8`ooEoGj)u{$Z)D0cdGurKX#DZAg>5
zrFTtvcTg45+S^<a4W3v7)ddc}-+$EHVN=S7@E=faY#$5(9j~n%s}d{Xw!G(+<StxZ
zZ=6_8-#UwY>bU;;L!QQocr(219bqeLbEZ+|Uz<mBiNb&Ic2E<!p<QdtlvPJN)|R9h
z!Qg39Ai7bVkSEN&r%h5zQsG*17x!lYaR;J>Sm!?q4Joh=Kcy{F>_BTuUA<tFa&)va
z8(Gp<;EpKWO+70hOn-;^@lfTn+Qm{O2hqn+N~_hr*Loar=BtHzC?-vIF!jei&5_ab
z4d?G>$GP=`)^6ZrfRfvFe@Yec2~}D1M<=y~fx*hwGML3nI$jQWMq0Uw>JRMZ;hd@E
zQ6Kxnz@i}Z-Qrc3mZP0z;<TN$Z<~zJ*sJ?Dg{m@SgzP18N>-Yhx>hGNbSS=q{$~$}
zRYp;7rboYLg+q_-smn-Z1e0~Y;-w*0+9i9=4OC%^nbWzoIezGB;kp})Gn~7Jg>&@Q
zH=rg*)acRecPvx%c8A&jl=qCbsC)ULcUj^Y3RBXeXGKm7n~;R-XlYGLf$)p~L;E4Y
z6XOEu`93?{Mi+;k#KgH**`X!bb6t~?iy-*!IH~K>PMs_V>vh#kDsKK!4#@rd{4BL>
zmXuY8idDn@7qs}OE~gz3bpMB1Zezz6r^2k`+B@j0V0+2MN=stt-MNV;XAX^aKe1+0
zXQ&=B%sTgvg;O@%I_ke^yVgpX;6WkqMLI$S1pZ!K$*K1TrTmjv>OOE`oR#?e>C06q
zHYL2(?`3hriBag&*+Nh44pVS|W4sB0-xKYkb46(RRV<Wi&KQHlFF32v;@+S%>X?{e
z=$+1#NK)31FD|Rb3=G?!YZWPY$9mxR9%Lb(S;{(C7TX)mRW=?8ah)){NQJl7?}Az*
zpVigfoh==_&^lk88gd|YmeD2gF>GvdezfAIguDA9rFXOMhBx^Kt3)IM2$DNLQUAYR
z4-|O6q>)&T**H#WMzo&0`0N&T7gRE&Gf1)M)j2VMM|m!!QqI15po8kLSd!EL<3Fc=
zy>7f)yreYm5hF!*X~(>VYC|sEggtv#r#+iHPD%w*zhCtRkR5yn)ILfXa5?e{{%ceJ
zb<rlNHM=|lh^!^WjKvi7@a5L&|5oAtjIls8K~!CX9e`dz_7|3NT=|frX;Y+Fixp%t
zDCtc!3i2|Lz!`Jr5T&NaZbVd~h}T+(y70YDq_+i&*VU{O-TZqLR3C{RJ2L3OtUsfe
ze|=c;^@EJ-*QWh~hXC2w%9WByP0ok%rfdZg8r|39q8XlIjU_p4(i(Jx0iAZ@X6S2z
zu_+jR4%@q399($m3dkx5OtWZ=juW}epE##3*HutkcmHviQ7eA6eGfJWhR+aeTkbb^
zPCSx1%eWGE1^`|h&aCYE_hSF$x4d9GE2~K}oz(trB|anIKIcmWt(Y;bX8@2G_&GI6
z0WrYZzplpZ@0isN@smvS#S6m%7V$k+=$8PTTw;Tq`;}*z`ImYO&$8d--7)pAeSjC?
zf$qLejQ<h|aBMt}zZb-XG*PDRW}EkOTyn6?hG6-~Nb^Fpe0gZdBc_TBH^T<K$B%AC
z2vF|%cN$oD&#j98;guyjX8-z%cnwsY<ZmkUl7C4jdP#aMQ7XYp@fsIoNW`=Y-fA@N
zF#>R%7c{m_-7`)nX_c@bNN=s<N(Yq7Uxn5i#Ua!__EPG8N{M^6N1t&CgJwzps>5zT
zuCHhDSGW}C%EeDx^%)oqXkB=%S8@Toh<sCi=@odVoBPv6u;&JY(7Dp;?_M0o|5geA
zlAb>=$Z;}N0^cX`v0^}h0w#UGO9-K-A?KduQs9y;4Y|sA!oYVvaIfFUK`b1R_*TN&
z-M=^)j(3D&OBXp-<s9z1Y9}Oj*y}ww>*y0*mGV|5vWZDYxt}Lta^xy#e#rEjvIE1T
z#S8fukfLzirW4-b>z@I%KbXXyeB!TvJ?ULcVJS}02@^I1<QPWxR1`O_X_a+@U3|^r
z1HxEfk?px9V`iJ0B$owN&89m;5IjfyWJxLk5GyD?UrP^R$ECZsRrYcBPqN+WJ9U_T
zlxa_vqW{>9zrKw~qq+}YH-N<nO(S4QHKRnt@7lSIWwD{TMV8~mN*Lss$>K>V6LyiO
zJPXwdOKz=821y)zTmrDwzIM7Oc3kRCwK2rddNR%-21IZMfLRUCE>!;YdH(BKjNU~D
z78gan8N+*>lbS3r6ayZzMl`>TtAJB1X+U0O=}8OVTqptwA(BZ#XFZozFVjpevOE#P
z3DHCO>4r5q{0u<Q$-d>+74j;|=C|-7GQ`op=%K$HjX%$elAxpzVgAb)08v?eS=NlY
zWBuO#hqWe+J;^(FE94_+X+3+;zE6_W{aw?6vN&ZibqBHxR=IRu)6C?i5AoR*iPZTs
z&cJhj7Is=n<nl=|)Zl(%$l3FcyWXJO+hRUBMqB^;eC9V(6U`f8kAg=47XC6Pf!7|!
zKY2%KNome{*HgwAAl0MPs$Fpuhoj@RV|I9zrIVX8oeH@7?awcGAsZo~5-t*%^Kdm!
z>vUM<jlV+PAF8iSBKgdz?T;CW3{p6*_xcZ;e@QekhZ1TEJM}0DNefJqEyKcB-eSOY
zX0jlzx<X5OJAcH{r-#%v0Ww;iseAjy2YlNUXGG4~CdB_}SFo>4GVTK6uE3v{R45Ob
zt`+J7RFpf4MCa*1{@sHOf9k&cY%0k1m;-ivUjG&PwBH*ytmn!x_Q&(jGV4Ab{zyDV
z|3#<)GH0=gE^#Y~wIN@)MPTAq!dSI&b?(kYC6%v_gL@P)Vx~^Wx3uAo0NfWqw5GNF
zjkK|Lr4*1Nq6#CvJOtNEaAUlZEVGY^^kqUT+$m1ivY<TCj^m!6qzTlWe_M*GA;#6^
zqWpTYW##{|H+r+=(7A4<3e1MEo;;p(niF(?I8gcLKaU(4XJ<r+$IoGd+gt2^F(O0`
z%C{g58nV>-2=9Yj8&@i;tMh=HZjX(ghz4>Xt`AqXrBJo(rha9&kwauDLA3><l!W^l
zmVWR7mgv$WRfzmIL;&G^sqodIRGi3p#2-rqt)l!1TH%gcL?B^JV*kX#Pciy$3|D|)
z#A+%%=Bmz#q3e(iYr2zGwASee$G%~KzxLKh@Wfd3ymZA<if^&bHa~Y@KcZa4-q_pi
z_xwAG!(egkK&HErb*WUZ%#cqDv-BKNI_A$BOb8^L5kaC^+u=s|$pJ8ILsPx_ufYGm
zji+iC<rhJOrqMF1)BfNp;Z3<Vz|?Bet-&-d0+aDrYr-i9Ii;YoDtIlBK=){oeRPr<
z-0w)k4e1rksteh3Fskp(h&!8ColE@T^-KLSKy6YP=K_LpOcI<k!35E;e0cSMkI*GS
z>i0$;<)Wd_>~mKTaCrn5b?cBRV@TaK{Jffn&B<d4->5`deupC=sEPmgJKclUf7!bK
zewN470owULdZ@6O7!~2jdt?LxMpPD*SDT?%X~^)+^Zp%{@#{~Dx$T(d^@937CPqHn
zjdjygMMpwep*a-dxZy}TU5`a!=JJNPx||t_)QgsX%GF;L<-e{Y%&2P-01X4#zSl)C
z@;t>$btB+HMV|}VopjDp+5$tBD$gtkLfB*l5req1XNIjI+oL592#y_wy7mSjU9r%Y
zxZ}%qc8^^D$fEdLBk+adtZQmY`v(%Mdy06kWnf#qA*|f9nIk`0&wdr8g+f#5=Bgup
z=-gGe)<2cDB}hg#u8z-*bSW>s%r8rV#$R$HQQ7@+Q}n56-jWn*_Xp9$l{%NIb)*vm
zWHjQp@JZQ|5&m`FFK+s*aSuc3Ipz_xWaAZ$km^Ll(<bhw&%NtdWEt?4MInf-(i9%Q
zTBQmq6Y!03G9;9Wd`p^m2`1dI659t&PSh&a@%I?nGx*R4l;Bc6Nt`sD=Y2boV#1%>
z*WLpe2}ybCyO_@H&>?|?MLMvk*eo5U(r2ck{{NQ$>yv;x`2?fJ`n@i<&*UAEUr4Xe
z2`WLEO|PD_R8q{0eOapcq`bo>`dzJ*{0-F)5A-!SAX1RPIna~JGpWAYqplCosmAV@
z^V(;d3W<9n0AJ7lGFkue_KR@DDz#m}fYJN)`=<-<Zph2-4QiaE%H_9c!$t|F)dL>!
z1;UKA^c>gAwDbAt18KmzB#Oe0qn>R$uJE|z_i=@ad-J7Vk6bF+(s1?-u24cRvG&(@
z<oS6=Yz#)|76uTQOtJIEj$};`bRSmg2C`45L^e$tmb;dZTu{0f%lE1DnSI?3LLa4W
zMND~|q&JLIJaWCvKOe(BYTX5<Ravx#jF?T;|CB(<$$#6c|7SEUuS;5E;Z=gzcPnIc
zD@{POysgyFM=;vGABw)_D4F8S72PKEL%YXXH`=uq<X}`G933kK58jjO9h9Sw(NgJr
z2u0$<BYo(8rGjd;^Tkf2o@keH+#on76IaSI_P%MC60Y*p%huHeN7pPCUB7HBU7@H=
zDH;8K&k&?6_C&D{sb}MlZC|J)c63D6cl<EJbzS+TVyIQmw>hbjIbpP^Yu*RCR(V`L
zNr8l>z^goHQi?j=pP;X#KvyY~TuNCO!uByYqu<9MI%fraL4o$X+mBMfijxCdB79HY
z{w)XibJ_BBC`QwJE@_=G>Rq{1`)zM9N~}M{dg0ZQHhZCs40ZXcQ0|rdD{k2NTCb3#
z^z`l_ps4ok+TP^Op|bwMfw@|9rhC@?2)!2iE8*n}wC_2NFMwIk{{D-HQUy`Il}L5J
z2UACKWD%T8@k5{xH*|px-%H8|>J~X?RdY!gaI4bYcnJzg+SZi4AILWyMqm?vW&7P?
z@Qy58F(#UO=iR{WJQ6=K0se&)=;q5%jFO{2D~W1Wrye(9p5LgDh$@R`CUH{F9<T<Y
z={%$;t)n~p3j1@oc4jqmRhR^$9919+Hf0=fsrb5*l>y)Fc^;K9BPbabMlAjc7UnV*
z=h1onM22ccr|L4CMtH=sHmpBe;+*A>0r#9}pnM0P8YP<QnSv;cDb_WQ0c#@Zzz}oQ
z_?;{>cPHQFoyA_3aL+}uu6R)M3#(Uq|EI{=UrrziZzLPZE8vG7BCtk&#Z3RnQDKb=
z=oJxeJVW-wBN5s_^u!g1K8HAHrvZS!^=UTX?tfC>|2jSS{1gBrN%74-sMbu@lnYyi
zal$RFu?;;HisifbY6zVuMR3KX1f9GE;#_)VBjryzDBdoq%Z)dx6j(r)X!W6U{{Vu2
zzccw)DKKJ@%qKOOq?o+7;UgQFdZ{n2#TrUeI}~(0AY9SaOy}QRO_8{0z_DcSNaHuh
zhsaeZM7RGh=J|`&%1{-d{K6p>prb!oaMK>c6G%u?snxw*i-<R3i2RdVawMxP^~gp-
z79McT?;4X<-eQX#y$FkgkbXX|{uR-9>d9*fp;V7urTH(u%<tnM^qiy1CSf8KJ=95y
z!2!$oJv+zEI|EzkJ*E!`rGJBy{-NYmdnsSApU6BiS*>)bb}2!SERko&<vzWNx7Ssj
z>f9EF8#$((5d}xL^v(ZHr7KlZ!@?vql&;cwEfT_-P8An5WeV+Q7eaw=Fz@{%g!3Ot
z{hwC2oWX@`(u>K)J)R!byf<jJ4;p)tH(89TuJ<rX97S8)6?GWV8WZ}W0owR1WiR#u
z-eJ2mRLS@;CC<27XwH?f_Np2*&NrSCL8J?dPNYS1pi?446Wy|jBa7^&Rw9&-Ztc#S
zO|3ipPus7S+opA__a)a|HApm2e-)#9K|R+uKtDi-CY<4Rl6)Xn*_F6n-#s9H4yoiT
zrEOnq0!42l;K7T{6DuOPdo}f!S3`blG&;F!5En0L7+aM10HJlg=%KFvNKs<2XpDIZ
zOCWVKIWI}kgF?h1mEB2yo~>46@lCn4BFvgKLej(iX<JAnaQel2oB!}e{Z+(gmj&PL
zlPXU+wAlAGJ3xdlTtnhRvO_l!o*HtAg`fiGIf-zSn>W-!dOD^M!h$9z-+97~M(q=s
ztU48JWy;Y5j7cW4&d8~-M)sT&!`Rm%pu_LF+|*aCCA9(aPhAank-*rq1`aCr!d$Hx
zb4KHYtCf3$P%_-m{T19``U8~d5}VaduY08voaIo&H>iR}?I2TD8^F1~_#@t{Sr2uW
zhA3C}a1X8<QcU)VrEdGtd`t^TQR3tnog(u}$qHg^=AfF*#+`m{o?nTHz!(0AABLwX
ztudq+^o@v&mg2mdw&PJ;0{1_sM#cWgD5)E>M25^9b-Qu3FRS5AarZ>dEA|khK0i$c
zEB?%m`xkoo?+aC93IO_~#;(1P)SX3kF8#JqV@Q{#8hb`Wt=Q9PRZzpC3)FoT?#ngD
zw{9<L<X@6p)4Z$c@(X)GM#s9dp#8(av@B-}!M1lru!2%DSg{<k4jD;syZ5p`b?#y^
ze;=m*dYvhzt9MeU*SLl1!|o3P6+h+6)uU~fyd@XAK2Tio*lzmC#)9CBUl_wSN=yDP
z38bhBMcIAeZedlmldOsM<X$P)XiTbL1a|1U&7kTTy)lIdS$*zoM7-)$aHQl(oIB5m
zl$b`~lKnzg2D0uIw?mmVcNI%}Wgif*;}2U*399|ocC;%;xH{*Qd&QrCp{*6ux$$IX
z<&wD)?-DmM#Ey!;AeLlw;*yF1pkkF?NU)Xc0hf$Huo7?WAjI{AJs`0cpH*sP>7EHD
zbr=m4J2{j&DWnv=N%{Sgy(Gi$XFTy3K|U^MoMF$lAqQHrpD&TC^9@H5zT5ei0Q>S!
z*7LGLxZFrd0QbW5Bw4NiX^#Pml)tDX=NkzOgJY`SGN$;}mEe5XKs`YwHLh_<!OBse
z9J3WD%5vD8%QB_ORn+*k%9E(fUx+=~J(!_tMR0ibDo@d5Z;%&OlBw;ENJKi(qzGKK
zK!&g`+ZiiUp^l2-4@R(RUsJtJ{JBZwAdbpW8c^09x6&1`ug;oWb*CHt8zJ_8%OqKX
zH1b0oDana`Z(wPJ(mjg<Rn*?tWWDd7JTB#b@wn*DBZkPMBLnFdiF2BA%bY31zJJ6G
z{#)$-JQ1o$O16r)mw9CC>}Ng#&^a+B+?c%K?pQWJ2i6&Wapjq>9&Z$Z-bu>#d>02X
z_`VRTc#QHPWF`Gam+-7KAe`!BhgqKAP)x6RFaE@+G2ihQo8*%EbLA-SwR5-;oCWbi
z20ABlS-%Cnv!L;1DtyRrvZ|JWNK8_RuA%5;IV0KMc>$dJdl6WJqx1Utz|N6^3yP>M
zIwq&|zcnO(ekexw(o9RSZw+3hfvqkxz2L#VKR#LCdsb=UdJ!~r&pobfgq()ZdR@I^
zaZiFwwfr+mp<?>sea4rmdv0LIzveF`(*1k$vs-R1|Fajs-}v)ZQrhxY{{U)ziMFv!
zy-+uSk04HkFG#&%pv@<7it?qDkN1n1KT47LqJUkxIh(Qd<k7YeO!%^nb;1u0O`KH^
z8R@n;{bI#dVpR7LexBGwdjH~8aybFnqc&;;L*(jZ8(S5K@(Y}0zLTy56eeOS-LDm7
z>1mO(>Xpm-G;=i-SwK*{lm=1yG)Upak6}kL9(-ki|AoM*GXDW_$(0K)e(sJM6x$S#
zPH-PBx6MZ+CpS_xhF<@wJ@rS~LLo)R#ifTGADP=hf>8dW-wjyF8+G2vTCq;RGyh8d
ztsWq1mvQ_r-l_k;VYv)s@TsvZ8rVzL2bW9j)znTsM!*)oO_uI~%EA0=ePcpd(s$TD
z-ud*F(vrcjYrAtnLQ*@fl7@R}s7oQFS0PIc&>9n;xb(Y+qQr~rB_yg3`0bZ><otQZ
zv<jj4YQ7WWo5FNJwxvM?tXjT2nOHld7gAixIhr-59iDGotHAp~TgZ$Zyt=1T+X<u=
znvf08dJ11MkgjMj><=XF&l(SOYI=5h-Xcrm`NCglW^zQMJ(a{7mUKCm3><G1f+tG}
ztCW^X^pDtcsf^C6g)F_IiespF)7P1jQ4f(5Sj<XlV8KOef@_G@jIT2mjCGfSvSxy)
z$Yt&STT!T%QchyH`HE|MUKhaRyAuauv{2=>Z^88TI>uJ9=?Yd}+H;cp^I3)JXOe?;
zxC1+fc{AD}lOuBJD!QZ|pf1Ekhr>$_ru!cu>;G02sydXDqujTK0Yj$ER;MXUy-Qz!
z-AGM5YcE>W)$)UYi|!pPQvX_XeGE?(NFqErxYXQ|2Feg*DkwnVt%*-9+#owIc#D6<
zf19owgqKXc903fe52-fmoyL8|=yu=Za;>P9nv_fa@-_jZbyoXznu`8fnqWvsCdWxf
z!H8P3vIR%~r1Gk$eypQm$Efw>2>YF(acvSg!40;ZN}vDk7f?Ik-cKKf*`8)V&+8Ic
zeHM3kD$+@`NtQzEj7CZ)>zNU(#K~eQ-^dZ~8QiRn7B^H|TXg@PTo<1}BH=0!msyx`
zL{GaW3V>$8b5A;d=?~{KxXm*a^N0865pKLb-p7(H``-Od7B#9gLuZ<gOlobZ=6%YO
zeOP*0=m^%q_lfyZd*pCu&qwo2aCXcl#{~e_oP*d;s&&<z<n}+2tiTsVvfttd*)0>L
zaD5*rJIs>`4z1W5|A05jzj|q(XTZo=O<7v~L7Zw-`>u0U#**+W{c|z`ug#^->G<y$
zD$mh@TjPet&B(gqto*M;F7^+RTbf;glbwH#Pm{Uz%(BG!Bi)8f+y!<_IsFW@&TvuJ
z@1@5&#I^3elBm*pf!Z~2&e4-XE2CFHH2cPLw;J$#&wg=q$e@OI+kX|VW(m9Je$ROE
z)xZr;dGFQ=`rA>}3e|M1o<x>HxI8dqypkZBSg-5vG7J>WchfiV&t2ooT68AOE(o^%
z`s;cABbGRwH(}yRRn5YmEGeK(Qw01N5MVJ^p^vXV^N(nviqT}WjGJ=bk5>}&JxJ(&
zr-6!NU&EZit`PaAqT0V$t;f{0chB_GtG!=%BNoahz-ff^#;Wy>s98-4@%suz8?WXJ
z^+{nJDs=rnYhGTG5(g|MR%9huE){`EedEe=V{rqRjQmS;#gS(+1dOZCQ1|q`uCzW=
zg_Q`;XxCT(Cuj!c0lCeVxE6@e66<qCs9zx6THOZ?LjVU&1Sv)!HqCOiGLX&3hL2-H
z2u;~xLj&IxHg%$IBfH;wl`9^%T}f7owToZ~#~Rc4eNOj{Zj1VCvpD`CV)q!~cW3Yy
zy7tSB2q%JbB-zl9vg|bLoO+nT9K}{j;t3+|y)V94vJEh}AVfu2vxRSVS${OlRUFwt
zT+dsYEv@%c2YKd%X2RXCOD<}zn~D-rjYGEG)40LEUR||((-Xri$DmcXrH;%=O<y88
zo$KxT`!Z+4RQ*i-#e!?@yo|wAXg-nfVi8u{f{t=@TUM6>Ni?q^Zdha6vkzQx79|an
zb$4HvL{-L}N&bc0JfQnW=q}@*p}Q3wa_CN{$;(7!Oz54P!|z|dI;Ej|9#A!k>fe=g
zKyY_U&DrfD2b5_d8l=Fi<Pl=borv;%5nC+$1mgJYT_ZW0{(l7uT_S#>rH*#gtv%q}
zqY{`It`|rU$tn#1r4H>Iw@pP!7}aQ@A9CsC>jP*t82I!1t@ZIeJyMibONP9}-|50T
zcrFAkBKsj+t8Vk{PwSFV((T~?$uY@%GvA-$X#wD}=ZP`l#+s@_s%oFD$zXGZyE-l7
z^#wP^qwOz69vp%~TC(Yn@ai&y!*^vh0D-KrW;A{&c=}ft1W|rJiv#}G<48snQ9{e6
z0JoG^;bo1PB&9DZ?C0#LYpLEzKbv$ag4(A9LQ<`FSeJQJK8d4w<<gZDn?+#H{>bY4
zU*wG(QTbOCj)KOWAlUSlj32J{r)q8#n^8_!3%5#Id=j13HL~Ilzx~!>vBZ|r7Vi`O
zjDg~QAS758=wB<jB%)#Bj_)Ns+GTA2g;0}Ir5Ic^Vd~>#{~sB-np?=Q-Qf2mm?pY)
zvIt$epgS&OAQ65g#g`)KaeogteFl`j5bjI;VMHpvw1PCSD>L?p)FbST`L!F%fnrpI
z?~8OK+3zw&KAjl9A+V!ki~f4&odOYrx|MvQu#fO}?fmj!lMV+omh7^Baz9r}mscue
zPqN7Q{*oa47oyunsdU|-Mfz@2QGhl!qfgC;lW89~7L^yH1uL&*Yt@!AyE&j+1aDHe
z7<HAYAiF&_Pe-w{#ZJR4{5!#P>Amv4l;(<Z11zMJp7BQ{f;)gW>DPA?c&s9PJ4tC!
zvJ_@EF6e1WD4E2VwU^t|q@XEvkxy8cg>NP#5~%Ozsyws7Ysej9@A>vQ|2x_h)oae0
zEH!6XpA4A#wX>dV^it_JRueJ$k!d80rF4~Et`%gN42QPJbE}fstY;E;tMvCUz-*&L
z%9)k7(H|^d5_fp&JM1CRY7mGJYrE!7VHWPPHgxG%@I*J?nBo#h<NjdEftI4^DjY$&
z5q{M(wNBd1nH*@Ae{(I)o#D<%qGarTRHWk3&PxNRVLA2Zqc0NeiN<Y?Py*eP=yK)7
zf~)COX}F&XwD%XXMpmF?8%`DTLUCkoP=B}ZbsE84_QK|a8kRXxa<&U$G*VKBn?Ibv
z`CN?DnFm?1w5>{4by0B&F<LaMF(vnC{h%{EqJ84OIO>+yu9YYGWsCzH;xUdErI)|T
zuU6K1rvDaDt)+WH=0PkGCCSCI5Ur@FUMv``!@VR4I<d?lWFR>hQcN+GRe!i^_;@3p
zGg&B?*N_BCG!qRqJ2o!Wgb~)Foe{kijr?NOUy}g6Z11NYE$4V=b3$hvTgip5Y2k^t
z7N^9+Vfv9yVMqKBC=za0L_BFYidlo{PYpQ!4Yqlz{lH+q>vcIyeo3?PUaTWPZob3I
zRbe(Nx#NM}wQCgR&n(Ur_CKZ4RbEO}8R=cHmWiM)v!6o}$sotrnrv4Bg;BddkULq4
zWaa*C+ri2k<v!^$T<(66wAp+XOHK<Tr`;a7g%V%E5bWM7$xtF(B}q75p0I+QZBGOi
z?ybC1A#6Vl80QRk_qV~?QZVW&7-j{}X$`LwCJq@DEP^b>HgHI_YKfWl{V{X#aN<s+
zSbwMMdR1399?j)ECBD4f_`vhG){}ZQFu7gWR_GhAoWXAwwovJ|!K8_R{j1DK80rWz
zeKaf2b|`rrfZ8Cf(`?#KX3p@L<4%r9&0CY1PT;@Mt49;m<bWS&n91QRL%|zZwLrYg
z3yp4;rt6+u=%Jf(`c_a3;DX7COQAc1ns0$+cCSJa5d#ou0bomdDvweYx;|HidhUc=
zZ>3{#*4AY=P@NQ|<D(--2cM{v>Bi6&J#!oW$s|{d|74P=E9b~<CVs|dFg`9b<N<e7
zA1e_+6}*Dpt&P1B(3ayc*D+Bs*LM>^F3k57IzGtu##|b=$;}I1|FO3&1AO~!QSyF1
zXlv1}lrVaq578MaX6jD6(Q~|o$|h~4reh*^be?x3Gj52rtjAzSY9z1+!-La1c+Y)j
zB<E7EI7)jm4D}R)=`9}_kUjnznA7H?`H!&Vsz7Ac&j@If`1A@=*^)in!lOTRl{sY%
zBYP+LD%}t>AB#WBvU()}t5(*z(w^u`-HLGGm=4L2%H8dRXLJ}qRxKlUXS;4jeN~oT
zH2${eqcQuG_Pb8DcSESHoS@=zX3)pl`HC<^rc<6A=c5rV*KcBDdgKN~j$DAnXN50n
zrcZX$j@Q76xl7q7=Q+yF@SvH@P>GtmmLJA3*d`UwWkyMHh2z?QHL=t+8uPUuu-p9o
zJI#$a=go*?Lf{%(<lgf8TzIb8P5G`If8<q=E#D;;$!pWTYkKASHSoV-gET=uOMi88
zjR|~Vufg_JdqDKi4c9_%?bA2l{o*lo3(opcg-}5$o$2I|IER#7eiQ+bi4h>Xl#0hD
z$@-~A&XzTTv70)I{$+jA+c&_o^ln<8KSgT-67$vT9(_tzy69|OwFuO*rtUWESDAEa
z6kqJpBrR}@am_uLR6{IQwu_x5^$}l1ZUV{mprK8(7!_Acw*b(}qs3V1WC68wn=@qH
z)pg3ZO9z<~91!}W5$Qi;Vhqf#|L&D8yR3{u8ftRN?Zfs{1F-j&i^!*=IidYwGBESR
zDf1-A^}`Mt=-s)0B}buED(_UzTCZv%?Hdx$Y_6auH9CUbc>i6OT#oyoY2|~=@XZ-W
zu7e-vr`qBEmtLrSbU?o;tg^S}^p0kca8ZU5dFt^FwnUIyC+DS&bBmr)B_gfgzhQIk
z^@S}R=DeU#y%m8rYGfXqTtig5H(q#ITc%%D$MS}Lg)J0&4%^+eR;gqltq=6B?|kHX
zpt!6>mA%!1Gy6`vRzmtsOst03<60gluRVC7lw9L003MP8M%B$gP6C^D2&Kb|>DC7C
z52d;|L_BNey+XDe;uJLo!pUnP;;6%aNW-^&x)u?p7Tm&f@ss~xvnr`IoPdR`*>7hz
z1dh$fiZLP$1#=-W#M>=|9-TEv5BkYPu{8Ow4|`?jby5AG*r||jV!oKe77U`Czzl}u
zJ$IwD)4!OgIA&hA)oqR<1x~tsv%x6i#4-f(9%6_gjlvaDjhk@LsEs3Lfb0A+?%OE3
zi7>$`tP<&7-fU>e)A7A~-ucH`C8|eoWAN5-%3kOx$p7f+Wq|n4>OudO@uc227EYPB
zZ<7@ymgukFA5L8N{D7}_ebt$+%c!@Pz1Q8vjXd6LlsVZT$_y{VVe(%Xel%`eZbtCW
zjQ~KAKGmmv#)&#xt++@1?^6SROsx*$M}~FN>!+NMvb`QC9r6k}<(xkSHZ6Rr8J<s6
zG3o6-^ym+i*DWn;)z1=D34(_cTtjDDq1X>K`dScyzwuh5XefxMb{PTpu;lzGmrQc1
z=(6Fhw-$x!>yF|Mh_n)gRiw$~IR@~*>s3Ya{JPW4SsJA#k9O$<tz_<G+z~KL8_3cv
zxtDfPz)Ufc<;d-946DsVPrcs_?j5N*Q|HUH^L>UYV-Y@OkHqq}=q}&ji)uL;W4DmC
z3E1Hu_VDks_%=$zL#fYlI6+eCP@=IrJTe~CW7L&243&EZ_nzmnP%k4lr{USC>K(&Q
zAmN{({?E-J>N%8)m#ra3xD!_AJpPT=LlU(eNbqKK&~7F(LbxbL3GNe4E<wVOmn_>U
z!*>bN6PUhnQ|C0kRP1|j3v4cLN(#+Vs82`g??`_0U8nNpR?VWmWyh>T0)VfdomaE~
zhZ|H${n|dc=9v@BI{C<|EPcG4*E!E|?1PHFvvfk>^#pyzQCV!q@W9|*$u+#Bz6FqT
z+;e^J81TkWgO%TA=P-5`(m;GPHbE{2p~B23+=AYH>;Sj&e(z40!^K>Sk+I(^aVEFu
zi&lsV^6os$U;Y$}v~Y&Y?6W-QZXAmf0lYijY~=%Q?TmuJ0?(H2rJLV~#W<z_)`NVO
z$n}|ux`6gReAxKusjcv|U-<J>5HM^j%wUdtEGqG5UEidzeiDFL_d=IbW?+IcXVvLi
zWoyrVG*re{X|W8o*z7~E4<@%rnfF%!5l-@s5fe|k$SMk~GeH*jeVmof*j+>+JlE#n
z>&^1krBHm>aZj&A=dvTYpE3k^1o3E|Xv!20I!(CBEB+#*SHcj@4tp}i6*w}4`B|a}
z+{EE<mQkOH*4L!@indUL6%&;Q{H?&Q93S#L#4{Sfi*FPtj`hEJTtV%H@HN+0SD3*D
zm{%I_D;-5K?mA}<50k5_^t0SI@fhnJqYj5eC535@Co1(jPT#KE61tpmWI5;qB$u9J
zKWN^vz2(RaBWH;J7ri>_q<cw<Y7;RuRT2uvi0%}^lT=*O_U!ifCJRip-+Scfu*0yK
zeIHjq&;ZaPh+{Feaxz7_9Jpb9BSI-N|J++(_Un$Xl(elLNzdsceV6Qa5n|x@A+%6t
zqN^`Cxui0=>nI5*)!YZB-_LYnr>FXGGPV}No<p<#nQ5ibh3P4G$Vx<Q|I%7f?)z`o
zZJ3a5iafp3?^y0Ge?R8R=p3{1YLYLn|77o4ZW@Msdio)V3+%9QY3};&mBxhp7?!^1
z$v_ZT-m`HhtMN^|d2O%P@k3PeW&{7S>a%;QsXW0v<|;m56eKISPHwE<e*0&uDtSw1
zMC~_ytD-uP%?-Gj`p9%}ji+3lS;bXBX2r#0a*0%2pe*w(kgaFA==sw%QW!?5R3cga
z+k-j<Ux-FR73Qt`sC~(km1zmvPw&a0nNB6MKBNk(mFuY7A_MQ9K!^lYpOt6*qgJ#-
ze`+W~aDKpv5@Qx;T!)ir@L@vPwbjw*yg;X!`(c~tsLG;Nzka;1o-1$d{yZ2zRgHZ!
zpFrgcsaFDbbd!q*`D$90-s%iziAb=9*~<Ow+T)t_)#?`7cJ`x|xqe#ZJEO&>Byw8{
z^IH}z{^XgbniK7zJBqW%_0SJ2TjaCZkF20Ss(N(r#Us8P0?qDUdt15V9J$r|)|ZXx
zn`2}@=D^DH<(P#hR+Qp&>1Oivv51Y@4Rpzt-uNPcjBMF+!VvR`ir3#S=fXaUo`>!3
zXohSaSXICerUJ8->%Z{EE`vuFH1;o|GLF33g7D9u5IH<K;4r9byX%2x(A4d)x~2*<
zg&j=m?L)i{DP(yBr{P|iVa^B8{Cc^0Jrh`ByqtdVt4i2<2I<}LforKbx8PIyQo*?7
z!GA|l{wcB%;443Q%{9Jqzv30R-mcD-G^o{KKYK}qDZLXGGsi!WmVNhG>ixb3dm;L^
z>r}&_-#aZS{iD>fo0c$<a!Z2b!5umr==Z6_A5QFsR6e0s*+ulz6O^k}#P^%o18WWa
zFTh#{;4u!wi9^4ZrQT1x8zIYJA^3xZ!B0RH(&rBNm_NlqUbENWCy|01NM?G@eco~v
zkWE@AV2O_cgKnT@rjKPz90VK(Y+CV>YHjPysXl$peLs`bn+meJl^#y=wIE#6Z?n&-
zSRkDDAd{bNM?7M1G#xRluOtv#4~FjCQ#2`^@%`41rET_v>nj|*`@npj3re2UI^f!`
zVVeWJ4cHvG*Qb`F!O}(7=%~~Aovi&@N*_J{S<Ff|9>|eBE{YoHdCt6%S{WNmDCtVB
zh-?7N+2Q)eWnv?;Dj^>Xw)3FxOK(jx++C27Le=8u!afI{`?{EJYyJ%fvkm1r!L9cC
z!%D&R-=X6H-#bCejAQJbT80%@8$|w(xVH|Avg_K11yNC?m2L#3yG!XtT3Wihb3|!|
zlI|{%?v`$l4(S}aV}^nGF7GGa`-$(p-~WDp%^U|DTwHsvz1LdjI@h_{41kto9}Kpu
zxs6Q*3=4<p2Zhp=Q6l%Om(Axhx&{u}VV@R8$<DfiSO7~SE~uHZxvD<z!x8~h5K1oA
zf!<64pSle1f-|&WKqjDIs6n@<(;NdyT|Ofe_vV`t-(}6i9$x4TwUvkzx$lJ`|1CJS
z3NsVeS5ikylOgR!0!7pNr17?ID{-n!bZszv_7-7qf8e-4x>3Wy?G3*~YG;KVgG6LX
z$}2py{RW_uQsjQoeenOp)mQPw{*_+l^Cd6wYwRDjh;3QpDsk;S`5!OhDE0~?mDz)X
z+bIhbjO0%&tl4f12PH^Fri5Udn!R++bnS31N!_@&Bh;gBfYQVp@LTSIyx6U!mfK~4
zr-oI@Lh$n2$wULcm<FXpfne-IEGs}JrohF%UEnNqY}YJ_O-Vvf9L$8irp|qPygjI1
z=H{`v_GBu3NQ&H(B0O3biEZhEW2@v%e@7aP7fUQN##*#UX(q?f`BvUqmm?;-CWpfk
zN*y5Pkk2){#5xOQKkJVt@3SmO7S8mVPHzVbUG=xW;jc|J@M1$-1@w}9zXvZG2UUc|
zB;L?)BspCAA4JURkEoY9{otJz^h^WylA$4$a-xWoQGRmNEZC>Y@LC_|yhp(`yG~r+
zd!FQE6n7hVDaxZLZH(#`apj~tp4Dta7<*iTxITOPnRJ$~##op7?CO_&Z)*>OxdwjE
zT|K^mg9cN8qR+VyA0#A9`g;dkZxL&T*#e<c;>`3Q*^6989Vk5EzI28d<c0-mY)@qP
zaNmHSbbRKv&KSLikDMFyW+DDm4(ljmJCQ22duiGSBt>p}k<vgPqwe_l`3?8VPAT_R
zIE!Fxst+D-{FvTa>GzVCifORkhTg55A%^yoe$rFZ#Rh$pRI{et4ZD5sb$o7~LRX$S
zM*UX}?!u*TkYix)h9k~>=IKxp<}!%o_P-R=e}pJyee073i5qmw-eD`?U_UVobKHY`
zy^;3Wa$qpt5|iIvmje-Uq%`VX;eO#uGU7<|xnOXUcn|xd`I2~gv0%91sTD5jByCbr
zpjD*}*i#m!H>LF=3YL?y^A!1zJz-&ZoGLjyOMX5{q{*t%UzrbCdzTtSC(c1Wl;vY8
z{-`(P?6Q8kS#QOo6cnr@+A{CBk3RXB*go0Ak+9IX5kG$C7(X*n2`!3iX3kSM$K0HI
zJ1O2fw4InWOHt4i7((Kk{<wR<ND()Z43rYNL|Q1}9?9^k;X1*Zc00rU-pBl;)zO`~
zFdB+`rToqPxDB3(e;!`)`yf*X^9HpaRF4U()^<6~Z)wWh22}KAEI)OOolMR2gUJNv
z09=a}vv=MX1YGUWQI%(b24{Cix0y4AZM|P{XBOAOY}=+Wpq3Z!1QRKSWvstzwH*_m
z4P3Wk(GVXtf7aXhP<<6Ks~0<avI{~G=d2c-sx&JAIsZL%W=1b)xRQSV^E`*rOs1NK
zAd0E{zLhCvicSJ>yT~Cl_9H|DbSE9AP74dQHYBW3;fv#N4c!5DyG0tI(T0t>7YVnY
zqe7cK8pjf2w_Cm+j@&>~-C%^(b1MV^$8ykcj9w|CP*9KBbL^&R*V;}Qk@n2KF(s*$
zdd%gLkXE48*Qh0~0@S7vq}rvc+}Wj$Bhc+igco?J=ky;eaB6P<ZyEvjZxmjXVq*v3
zv?>!7FA&Aj4hU`=qbj9*Q5+N_Z|lxxChvuG74d8*k~?3T+;J>~$^72$DobCjIrY~x
z4`peUHHfn^v$T_Zav8>q!95dEA4>u!%^Z_HP6UsS36g>Ry3Kk-A*L9%ktLR~%B4^%
zy%e$M+c5@?xmLu>PaW`CkYDurwx$!Z6!ITI#Hxl~s4B)EZ*AFWA5Cn*LS|v@U;F%c
zW(BqKn3SG6=eRCE!VBA{wkt_D6Yo!V9`)SlUKOjY@wB^qL35pD1W$%;MBOv2w9BUP
zZEUH}r8}lSlqA!);@UNd-SKv5<TjEfKvXPH>KF9NtX7ZlvgtYQ2J#)aP!2mHyT1od
zrjh&I_^k_T5wu+#?^qk&O!@^}mD#LGBuJwU>5iNZ4qX<y^#OVZjA`fQcWJVtg^?S#
zy=V*lvlglfLV9|M`fs^CaSilds_<k7_6F``WZbkljy&kRH+*u>Ha4*n=<7^g+qN<y
z+P2h7mNHUUUNUAcb<V$Me^uS3{wAa&Eo;T6YkE@CK%=aK7gAw-zEhq1!4yH8YM<Kk
zQE~sM{(96iWNdx<RPKSF@`QzPU`3?I@K`8Vz>6(ly?(>x<k=~5kH+lu%ff|gCch4+
zDZ?jIW#IQmRpJLb3wUIT+|I8r{6Kty<?b;Jqw5R8nh8f`|7`8~XYm`Hh4Sr5a-N<_
zj*to!Toxqmo@d|-$)BLiH<cBOXO?{qdowPQ41^@fT}e*ky>aB^J;oT9Dm*>qZ0)eP
zOwakLZ0<-RMqD;Us@@N*k~mCt@)T?d&>IVC02}U_3hn8wC4>*bhbOf|zGQL}PtTm)
z4x+wCU+G0lzfnE9!{leT-wfQzl&N2G5(`dUr*Uv!yf#^|Ef+B*7tbvzZ+SI~U5xcT
z!*egx2N}N-7(MDWYsA*3-lAp`->{R2+q8JfaB9E1rTGo2JigSaE6|}=R3%_n8qz*g
z+F<2J`SSCx*eH>lwS`N})<pg6qZc$REzM=ezPsS_d;N3UTJ}-i4YRdppt7Fm->}9v
z3>E0QbG*oof%%<+^(l1nUSY%QfufU}X{#4YqF&jdv&4dT{o!85-PJNp_$MDsyk~0!
z8{Xj^cx*a#tD@og8Pft@)7R^0W82W*|3byLrs^bJ{T^jvi|o$U!ImEw`>hvep)CaN
zjLzk3y)p+AH)*H78_vPC)xqqMd%(4^^-Fzzek`)A!vnyXtc*_PPWdJ>hUU`JdTBE}
zzE%mGB1?R4IrhANgkQXLsJo+UYtwi*%2k<^*+cWq-39?@(oO(^f;!%m#+v(9fs>Pt
zDXE#p;ucG%!|YgBV}gh(xbH@r{ZUBU-STUd6~CzMM4Gc9tg;x7y;G_4Z&Jj*;JrP)
ze_F>szkneqH=t?O3k7iRSSctc7^4_&QQV#TJ-K^HTT1QKFx9B+l&LPR{|~{1l=9US
zfJ#7fAJR;KM!=OJ&n*j`R3cTC@muGpKcFUK3sEX&>-k9LOn`YBRbICi@#9sjd_q~%
z(N#l~3m9(1Q;PVFT=kLMC;HzX=x)U6j#bR?6BoSH)S`BzIvwG4ZGafbnc*L;Z}AA}
z7CQ{Aj4A*Kobkdnpt&1}r$^;`({byVQm5ILdKD8)Cf$O9E^r0;GC5$b8>jKX@{&^`
zEzEa!g(dGduBnI^P3<Z8ot571qOr(}&HYyDbDmvtU)FGEKV7U=9K5b`nmu{xYo}1Z
z;-v~tzW0E>V%gt%WOYcyG9p^DX|fNfizXbkAD8(|Buv(SG2Y4a*48#TUA9b^-<D3)
zbC&aB)vxOtus9l_Db(MaVSFO&^=|p$^%ZgdqveoK-P;SOM-E$ikISrA$$mLAH_@-q
z2(F3aZpC)%cKjHyA`}&RU5*`v@c5ApRWwuNq?UGi=KUU>@?_Z~dug5W1=W>Z?XEV|
z<oeWc9o`T-CbMr}<GI&(VzldjBkUY}2FPAyGzf28wef7n9Uf%Q69MrIcWPmq2FT52
z-Mdm>E}v9*p23mk$?H&W@Sups{$WP5y%Mo~o5F$jsmo?%A<dDk@a+ZeS+V2M?p7Wv
ziz6I>S!mZC7ZN7-A|yd$5_n3j3EIqnl1F>Pxfcw6w_|<=EZgW&X&Dgc0GO9X(`JtI
z1m3TMI6y9I^Fn;_=`ah<c0?lK83$Yu>^#d+I7zsncB0&uo^eA+27*65zfR`j_%D31
z8wu>Upzfde<FBVBLEU+&PIE7fb?Ngs2L-VVPV%FqgyBjYmHEahgDl_pGJN{W*?O`@
z8l2*xp$tqKj&#<5Wcr5}81zqnh&h1$9_5V?_-;`f7~z(@a4F^(rHX$d0(&WT7k7hU
z2Q)bmFQZb>DzJ8lTgH*)cB?;RF|9m-bRp8N7F<&s46aHQ>(Av;8>Iq|UuXKH^@tvo
zr5hHkn8h3i7-N)<Y~>qDkzeij@VqH>#)i>iP^MUuU<f&6ra<7oGYkQ7?A%5jm%~eL
zML@F5T==qiDPjM${<a3u`ox#(6}|nY^DEdsQ-iR-r+Z)g3*&C}r>I%sK@gZrH)22L
zNr82FV-9zH`k>*HJGOQRdbVdXsr%S#oB5U1x&1o>1@Fh_f2188US+B`!1E^CybpDo
z4eE1m(E2jx&kL`~eNOb3TygV7I*IE(j!A5gZL>|dub@kNA5<xbMoYcgyk85YO?j0L
z6f_)rdRw=qbVZoEz1j@YAmVB1=F5*b+Rw-MTq#!E_!aq1AwE`kNGS$HAAJz+^M=(v
z$VsXL#I|(`DbV`r{9kshY=_M|inT&@&B48{wJ@k{TA^Esh=8wsoA65P@O6lH?5wtV
zE~C%#vis`fwNGz(6WktZ9u`{%c*Q{vKyA^4IaxKN40Uj)FP`zZWeIM60Xn7XZ*^PZ
zZawuv)X1mRY$qb2-rXKoTPwKOy6TlWt#3t2ku`z5u9xboSDVKRbPC5eXq;ztT`d=G
zuYZ}c5x7Z_oE5@3_y87$<f^`BZSC1Ko-S910n&ddTl*=a{G>NsDh1(y9DqVHLwX{P
zLcA1zNpDUGRp++sCE6FptZ~jzw!M)0IFzjp*>{N&MI%WR6NPNs*$xb3wxkM^v;-Tw
z*iqZNQ><;;PmC`Z$nK|Dj#>|3xgyXhCHG9pl@QyNR=y9nzYhDOCIODT&<D1l`~i3|
zFAEg5dUsuIF*m-@aQ~qFdL!_INN?zmNSin^p|kWRU7FLoYuMI%sb#%u1bx7<%(@y2
z%Xb)McU1@1{ddEh75TKs-A_#wPcURQ`2E>LrHxCcZ(V{+Zv2fLeft7%6-ZuZuIzs0
zqJq4NRm_mED)WWdZKQ-hrA@0CitYb>Rix<L0awK@D{@gd3a(-tXuQ*MZd5*V7D(eM
zG9wdNUiUPbr>gFi5?xDj1SgJjRlChh)4%o`<wIIhR-Ea$zT$D@>YX(J#orURtHJn$
z_eZXdh5vz*`~%~=p}|dZ>z&`LTS07XFD%d8wr40V*nj3<>98FZx?bEZYd(U}uG<h{
zB67hGx@A7flA)xXnXuZDK~?rTGWnYdx3gWXFz$$QGx?o=3Kpx<Cjg=8^;%T1fiomG
zk}a`m{b!=Yq;9ca42LP9S}cSCzmK!~1CCsUI#n;E@6F4H*?8n|Hf}mceDZ%PD0u!B
zP{3>xOghulzK4ZV{}?J6#Q)%mvKr1JtR$#Mcpc-k)E&*<ZLTPdK_}KCT5*VR3$Iqf
z9UC*%Z9cuyv9F24pmdh@GiZ_>q+8V}%eOGc9C4}x%%8h{S{UU*gU|iKbEMtJ;ykxQ
z#w#Q8d%A1wU~zn=V_SXc8N}l7i02=x^G_U<;OJ=<pApWdd@k8w@t^TW(#64i6OweH
zVlrteJ7BXJmR(g6*q{1k2G8T`!IYqFYcfY`Npnm2pN}1<#2(1U(rG<dXYM6|)u6&c
z6hOOOB-~U8C&8w3A6NzZHN_65@9_Upvj2#Dh(%y`F*c`G+@3R#lMhtv(;w^3qDpax
zvAt8F7v2&Ru|<}9kWk*eOz@2~T|*w0)P+m~n<ymcj$_%t@yCv79xV5KxOFYJ_4)4_
z{(o)&`RDg6b>xwYF^tPT)NgF-?uqyF-|h#sf2tA#T{8*j*|nT$G(TmvG}yUS?IIgL
z=khxjZOF+8j&x|+ZiSRB@LsaFAK_~Fb?f(ZYVyTDX*YwO{_osy0Tk_N@_a3~!u#S{
z&PkCW_|14i!Jyxe7oPfV+^!n)vnpD4|KN{;RTIHYU)hw}x?@qldxAH{)<cJQZBbTw
z;afx}4ChkSb-ftpKy1tUcb%;N+Gh3G|I@_)@Ma-^3d3tYoe_huwyETyro4U0TB8W$
z67GTr5w>QQ-=7CX53RpK;n0A^{5Meq?e_Kf`}r|VNz~N8i3t3Mz5F&De>~LR4aI{0
zOYaI->c94`Y{iv-ClRYKC8Oyqe=z?4OcUY1z7C)pBfHu+cvt=ZsDouTmtP}ePhvG5
zb5`mN<tMeiV5xIXDKz6YBk|gV_5=IZB5ePqF84pIaDedQ2Jmo403PmF@`!k@+-#MJ
z0-$WI0W`)t{BRL^csU{Uj_@_b)4A_(Z2w(Nb{Jve4>{7whP}OGMiFD%o$|CZ+K9iP
zBLU<mWG3g|{Kry&yu*Zlr>-%x->pybs!2t*#`HW1IdQ!dWg$#TLeMM?AUx29Oc8dy
z!ikl_H1-NI@jLt9OjkZj>^E~O&sw%HE^<H+W!6v`VG;o;PP&+tEm<phVeGmwYyvBm
zi&IbM-mp^LS-Uq#$B4Azj!?#ldg9n<gDdqZUUdV!rc~?$yi5BPHP!$AG-G5)>;!f3
z`SWU+xvTGlMt<fuCR?sWdVq{A|HFko$uYxe186|`^p6IVO#K&qKD{R$^*%XTsZt_A
z4d8e-LTWNo0ch9K|9YtbJ)-)A<7M}64qYsEGXedT>H~kjLH@4n8kL6lXJs<KXS@8+
zQRlMt2}S-K7C?cAY~=1A;!ovP9}>E>RGwb$S699iwnQ2d%0yB3CM4-i=^KI-_-yN#
z<5Jf^Dg_7pN{`Fh>~M$VO89oZ+B_Fc`Fn^y%u>|~cg<Rl@T(@;S7H7+JS{M@TSXKG
zjWMLZO+9yI@5a0={C|cr|9vv<zkfW!?w2K`6joh)y#?+E6~Iew)Em@i20y$Upbe-M
zWAALBH59+Ys+KnXmGp&-7$e_&`nf+C;|}K{1X=NJ@(DKB7Ak|!)C`V4STUeCw`lzL
zzyIgK>%h<67Nf@Xh@>d<4nN)yLAwbSQ-Eq(E3R~mQbkvz(!@eE$-5bS<1RweUjCLS
z$Z3RRl@xu1(agmt*t}0vU}{>p7YeTUcs21qgK9~TfI(vpDF6B)`}VCa&DQfV&;n7<
zP?g4`IkWTf<R!%?5R=!~mnC@y#smeCxoSUqC|@y;w}T7$hYibMwY-;XO2XoAe*bv-
z(w_ED)8zm20e?L1O~_kUXkXB_NcCOUY-dlE2qC2r&&wC@#brz?Xg^|o*698Y9yj}f
z(o1%(Lb_M%JRwhktie4V3+gxA9bk6;Io-5raQ}1CL$Xg*^1&}K%bg+_*9OakCIpy^
z2&`N5yVYK2ev>_YV7Sx2zvSx5=eJvOTkMNDhnj;Cog!33=D?IJeO&#o+{7CvsYHcL
zLZ_Lk43`$h_{3Gl)5E&G*u5(E9BvEb^Rb{>y3?ptgG=ev-sM3N0<&nG>`~xEul6K`
z81&8&#Ilw>Vh!pqSh%ocHjZu|?uy#h;Tl!VFuJJWs^vdF&E<Td&2df`o?i%NePxET
z3p)MEF(B)k{KrlYFQ8uV?M?DO%F?PfbG2HD`1>sADGX%Q0{LQ6F}t3BY*vy#R*_Hf
zV$C2;2U{m!)t&yllyV^GyG@r4)v(MyM09h4#V_7*0oC=<VNS5H*GWb(sP`3wHB#Ry
z*wHa>s=5y{<kA~-*Ma)DmMv6bykInlV*%9|SsJ_bqA>hjV%?A25y4lrVmbopu&I<y
z0~A&m6h0Z%_SZ*(hVnfj<@Z(f?adAHHO4iWn4ndWYN+N+^jZ13o_cTK+3QqJ)30s;
zj@Tt}3qasLXSN$okYJ2Q^Dfx)f-Q1oDsua0RGCd~ZsXQXz2!K5{$D>*0=o!|g;!1&
z$xe<)mOKpW`p$A6TWgtqfN$HN#=U2y!_`%*GA4s6))Mx{Ea!vC-bHv#z5#~#;zS`I
z1dvh4>Mv6_CiS(2<T;Nk>$nYF9rFeFkN<P2|NVIU-JE2_KNhTu*k*Qjb+&gF%0lq3
zzqQe$Fr{NP&&v|XM05yNhoS^MO;p{ca+23+BEof62-ORK&gHTsf+ocKY41&9p^xso
zF$~4}|ME!^S&aAN;II-Ktb2}NkcWmi+*YFGj78jr-pcxv%6u{%hfjW>VY?suQ)o+m
zRMUYa_OPL_?Ouu;Ih8N8kCwki0wZy6rJ&(2u9r{L?{Sc~&Y}Wulsu-Jwnch+s+>;>
zZzgFGU<pHtmrVM&oV2+Ys(sPYI`dfbC5dgJE%8iDkA-5IzZv6x=E(#>-~4I^>{?Cl
zKTh1g-T_%}kmFh6OBC*L6<=V~jNT|!GmXA5xWV3$CC*OA#xC8HjyIv8vD&59=84$c
zGIhEz4p$*Q<gA)YN%ox5O2Zq<sVHfzDK>v7VL*4Uz_f5b30whze`P2y#Inxvo$^nj
zPU6r9KnZ)~e(_AyjQlU3hdv03lOTLhG?}?4r%5>l5q(gd4FG6fPGL-!T3icVw5c#t
zpcjWa6=H}<w@EHE5;b_=_m6}4|6?5_{-UUAlBkKDBHWw^tun;0omg5y=cs5N75E*B
zToK1(!|=DOVT@*Ew%eR_=t6rJmAw8*FtK2W5%eSDWqEqlk;M}s?gMHX=ye?S%a2fl
z|8h_Nd6j|MqG^DG7Ccw$JFu*yHFfatv6l!UcVQZfz#tffd2zLv4UY6j6tU>83G>R3
z?SYt_&xE+jjH$?S&f_sc2OkZZz~h<;ASFU18|Hs=JD>i|55A{DHa(3ptEPn)HYmx;
zD8Rc0!Y1=y72zpzQBwhmfREw{KH?h6ftmod1v#EwBVu#N&~LQ`y56Kdg1ag}5YWYX
zZ$<w9WR8~upc!t&v)N~bgR~jyi#Cf;dh~t&IEk1*X^ULouhq;?=(g`o3NGM`WGjf&
zJy3W4PPCsF)xVVq<vNY>#s7<Cb3l=O_qJtgxD&L!Zm_0WORj#EoG$xF6ffHZr&Bzp
z<6<C5G*RM+elYP-KZbM6)MMds?8(S<+B&vig(mP&CT!YVjBPN<aX#B5mb64tC+@G-
zZWT4|^Mf>MWP6!BCLd}lGL`ZAiw;w(Tqe6X9D%qw8BaxP$<zxr%^bd)t|#XNi5YMm
z%^)cS-$@o<AenUI5H+Wl|A~=Pg#Iw(ccTtA(5S<r_n>Z9$u+4fQd)$x{)jhI_|>JJ
zE#h9K@fqt~`M>Sm>fgNMKR@EYKjgbW3uO6lhBQW9tHE}SwNE9S@-d_mNe>#svtsS&
zh8U4QG*NjcOFcss=l(;1VIom@{ztG2A^y|np}NEE+X_3sqZi2kA$r+d7dbzRGE+02
zD`&W`R=ba{{ZR-67vGtliCfdZ3D0_2&1ilg-{d^}k{8h1<8O+an<R0WPQctB1gk3D
z#Y!T_fco|4a}0#Hp0w)TkGuXC-~Mkm4GD_u7I}}>3=N{V7I?ZU0y2(QICx)hDgAAN
zPFaol`S0Ws-Pq=<T5wYun^Myp?o%MS%pF^=1d>bC6&u7Z(NDQM9ggbWmU|&n6xP3d
zNiHlbk>o@WXR2!tXuVnuLAU!y^G-{dI>W2fkJFI@Z{1S0h~y&P0kV789pHQ~Ua5*;
z=}i7}EYx)yP;qOK3CJX|ZidCX*l+4Q4*T<n++UdR8zld#8>#AGKfRO8Ii^971}rh-
zMw3_bw2Z!VpZrUuA*kDI13X}p@;2R%8|Agr+tfyJsO$tAD$v0r3V%ictN4PscczpI
zwV9fh3`VEx1NA&d?EjmY{D<dwYl!l#>-XJ8=NIq#qcV)b%s?&5TQA>GNFFPuB>io0
z1h?rGucTv6BfyYNam>KWVFPlL4>dNc)R&l{y10n5wfw&@O<rU^?3-pP#KCYssA^jm
zzVC9ItbiJx75FLs?bJ5Tr7?ABF2hdM7%%Y^r5iS0apTmfmgfCP&0qNeUSueCQmNJb
zeB8PGK0(qr;O*2;%e5KO7*ZEBN-0c?X`o#u*ngMR<0>PO%k`r4$QOg5@}W>nj~h-3
zj*NFEu@GyF+$h}+okpSmAMO~5ERuU{{c1|661)r0PT>7RJHc-HnGE%B?Sy>uAD?Kg
zNyLZ>qtf%y-=(FCCHeK%V(o?C0pJQYoO*b2;UtPRp$t<8oSg_OB)_d}ryBgF&0PH)
zd8oWW_CrS<EKb0_Ia_#%E2&&{tmzG>)zq6bzcb}WvlYMeZ-ar^LEO66?Q)$(<&rO^
zY#|*?_49Ntdbv^!x1*_DPmVF|AY1T~J08mg&NQ#>K*P=($F<IL#qe9N)$G22K)fR?
z=C;*gR<{Es#NOR?dTJ#WWYP1qA&aFQ-trDF2%(tX9Dp<?GEH%B{<v^{=PTci4c^Sr
zJi~KheqJBM5)VfgGn`?DcTA9}^RzIH)DOOP>j3T9xo5Z<aPRz+AN}nz3&5X-0_+2f
z^DtI!nr$6o;`V||ULg2J_E4J~^43L?mGtiD+Ub_#aRk;y#+7!g%Vce2HShDIn4mRQ
zFM8RjCe%p@zGfvcKMqEIizc2Z{1jH@-<Fo$MFO|fJ^vX)=3K*Z5qgksa1S&?UZ~ZV
zHR#W0xg-Z-%>jd&I+>d<tt*5ww4?z|uZGJqDY1R-bBXU5A{JvOJv*5R0l&f+%8AS}
zTW>(6Jxz?*8rr6pKYhv?ofej?ex-M|Jt2!BOy#sRA`sduIoZO`4D>#3;)25`lZHR&
zY4S5Ju$5gVza}rX)|{?d@vQ9W+L~R&+ljn~l{oxZ7Em%bZ~vl@_c{6>S^$yHb?mB*
z58AK3g?AZauJELff`4|5ptRwOL_jI4(`XX)xm~n;iXUhltfNl7M!r4pw&-2@grqc0
z%!Y>D;#VH=1$9?3y(xgWtevVl0rq`r)8{?;{;+W3_vZVcwV%{VsP-*aPQ14l8~esj
z(YL9EuBt<Th6^Si4%q(5Wl_x9_><$OnSN)6t)-=o8?>i$5%&LL>1K~m=v5^{;L=d3
zLt*&q4Jso#?9<GYTwz%cMVPv*l<lMW0ynN+pVOkL)2N?Pdd`+5n76wm*7wxWCB+to
zynV$aCFElBXlBB04x>pACaG$$hzD7hApHp!^GMs~`#fa_=1d{mmbNwH9iS$W3xpom
zVen-Gd>@<lH0jH}E%_}0l7e_u2qfA61+5c4`^}gL0=#K=O}3vPk2=d;vC(@^B8<4$
z`1wsC^`~Vev*E63BIf?}ayM1<C|Y^TjnBZ*c9L<V!;yq$-~jIHAPyy=x=l}x)b-AA
zMj|`|r`?d`8H|A@#WD1$i{BZu?Axr_$Eo5>As=#Fye}7CP2mIUtf1z!N9@!<NfmE>
z?&EN>))y=x;EI8-bs-Xy=SpeceyY8?z4QZVY$^~+I6=F!=f2`4#F^=R^fOzm?}2j5
zXj5ya80I3WT~k>L@zcvw!jWhSSk9m0x*{^<b#h8?>OKpamJR#5(A*j;Gcf;R0jl<P
zk%FEsgKtPL-6_)Ru#c(e0O<@(2+r_~ueR%hRTST_gp{je*^GMp+kB?i+R}Tvk%YLR
zLnMF@1*AAC&?r_o!kY4;I5M+_$tjU<_e1O;AJz|TVj8!pVA23#c=Iq7>f6C(*V~Az
zH@n`Kb$#RngwH9#!;E<j*R@`~mjKoA&R<#&bxpvok@;%+nw%<aRJfFCu*7nbugmWV
zDK__lO9=rIw@rVuVM{*V8;J(*`r#^ufYXiMgdAbj{qOeTc(0mFw$z)05=ym8c7HpA
zxKD2j74@i)(4G!)uMe#u<<ymh&c}tACErAv)Wl4nzeAnfhJH%*l4EMswV22|%DIza
zaPFbmNj!Oq@K*D?wUv!0PEWOMOcyeA_Ly@E7B=knwhz2s_N?AaFO3>2+U#k_`LoaA
zU`39nqh5WvM$#jvBHG)j-YL|nN3~8)m`g6?Qm_!j%3Su94SN`D_z**#n=n?WcQX~b
zuAR@2I$_S7!*?;nV+!Cr^0f|W@6C~2#lw5qsB)de$@9MdP!@4B3CBry0ite;m_D$o
zrik0zNjTYt^qzq&b}wX5#F#nqZ93IkHFnQ%^T#S4BegT=svv~WMSV+OE6=hZ<3gqL
zhmReBUG6K9WuM1`Qf;v7=DdP`*6H1z0H-oIwY<G*uz?8cf%lQO1GwteYBO;y`}Sz+
zy%tSWm%iujBg4@A1U8-U;6t}PV!M_)D%jI1_gSIq>M3Noh4IbflT)d#PV`w_GU@D}
zbxZIy&LLay@TAeQLr-me;24;-wKE4CBkG(hx<#&Hc)>+ZY+Gge=_A?M@~^d~5*Bpa
z*Wj_Dm(>y(J+0RQuUrn>++Ilpf$n7*2Cml5$L=W|fEEn@qUsALhF;XeDD+>%OoI%>
z2=L_Kv$~t_GkWFqYfhdw8&P4-N@M!OJr>6-!63Zc;7QM(ndZGc>j0r^zW$ubCjkI?
zjLoL0r!KoIC;i}@%qp`7#8FIoHIJyMSf?-P>9>s;Kd<Fl9BX3*6Y){SVm3H#^k$FQ
z-3GV<JZA0s&|;AcFL=kvs_)&T=~gL^^|D}^w_(rqL7p+@Q&qn^uDww<sSStw9t2vu
zd<Kc4z;1ubx$h6`H!uD19}DUQKENZCqkl3jSF0YG5n?fd{q8yC5|+v!bQK<6j^V5Y
z%k09K>%wS<gV9bUjWU;R1Chpr3CZfDr+?2j&Ui>5umwizoGMmT0J*35Z*-3OUSn8)
zZ&b7}?`t2=l?*Cm8srgBP@>!U3XJ2TI{@`7uQ7$cXuI3C&h@pkayr_28WxJ%7mT0b
zJ=j}TU3<n+Dat!*+XSsMjFAw~#yCG+i%-mm^4tKWvP;mPE>5~fg`E#i6}R`DFDuL%
zyo~zdtmSglh_C<hzGmadQHtzipTQ#_LmUN_qblsAailp+`JXlnD;Q;v?b#H^(ki9A
zSoXP#_n5o{Du$tLZp*IaKaJBb8Jn)ZRY(U*h>czHJbO(Jve@=W)Ow#Wh#Mu0bsc|x
ze&kIaO&JhQ3PSUhBpJItaQ`Te*5Q~mh2_5J<m<6h`fjrH^9vEIiST)7(hEGyMQ<q&
z&sAr_Ru!9<x5EwZ<nJNV&838y7DUi3{I$_vWl=k(e0vr=%CLE;Td`>ZCP+RN?{WLB
zhL8QbVxF(2eg6^+J5ff*vwtQ}pt35i?hpt&2?Uu4Zi!gteqkmlblH{4B#(<*7iC~R
zDeV%67j6%|7Nm0(=dSFaT>)o{rTPWnv=5JkJf5aBXMdFo=1{&P5T!6r24Gr60H%dR
zJJwCHc^Ng85(Nsoq5eAS65I<pm|&i7Z&zbB+5zn$Ax%hNWe*3^LBZzYyK|P6()SpI
zaK)Rg!~sJGQxj#t4XJ4{vuFz(6va}p-InT|xYqTT1E#?_%qD=4KwwYc>wYvr!rzT{
zRY>6sWyx3*E#*g^XZ^vv9n;f90JZLvxYxqhHH$GH3ZiuDxIW~`?XuFF<zzq0d7yj)
z>=EHpR?0om2l8pGl=9I0_0HzGMc(4Gu`)@NgNpN`weYpfAUah)bgWW*eWy}r(cF%T
z4XJOZrDT;owlE3ztCp)lw9_6h^E7YARS9X-?%S8MOJp;;CFb&zNT*HO^+#(HC3ayb
zR$D4gcvxtgBQ|XILlt{_OSu?sjTL^tzth?99Rg9A5x8DF?;dNI4N487j^v}^tQBn2
z4f%4sCY70_CDnX|Cf>R|azF4C9s0nreYG>(<N|~LV6LKzxjA@+Dd+G~)1any)Ozze
z+we;S_ZZ~Gx3>=vCwK0Kr!)z5QaL>RMP+sb@9<)b7kaRZ7*O`UqRym*z9nNb@;a**
z_OV8%mlGm)pbkUq?~XO#xt&L}&DbtTI>)|N8eGiF5iUMUl9x?AXG|Yc^u2n1{>yQ*
zT1g~~=c@mq&!^V+Dk^)80WB9dTapx=j%#_UW9W<EFCTl4fk|`Nb-x@nlQ9;5^1~sq
zVz-a*tBlWovYJ<$8Q!M50W=ODH_5`(rS4`()qWR!i7T41AKd>o^0aqGeRc&q>Q~wd
zFN;IhS3wAl^f=H}$+Qe#r(Ie|Xxq`H4w)y9oZVo|NroQ*OE1$h-roXUs0+XSfy=)M
z>f5$a_oEu}x<7-OXNG)9=XV|0ykv2Mk6aTvMhg5It=u%f-z&j3gsi%6z!Zh=T0HI*
zG&`U>i{WM9OaYdw4FQ)$8S`E>B}lwc$((sm1R6^-vrX&L=o-LCLo09Nq`-li8#pwk
z-_C>#t#JtcvJ+*r<q4<E^;`%cj*%jBw`$TY|2yRTN5c1B6=iUpd_?QZS>_{nS9a&T
zM$7?5O!@C(1OG({rcr{hEKGd#*_+-6NaMOLKLfSiMfp8-Gl^x}t16bz{MEjLg*U7}
z^8}fWZdl?3Op6uMuVde$t=tCHW^BHO5X#*<WJ_$~JN44_1>|BJ;=>N>()Hq6vCPU}
zNo{1^%^M#-G+yy_U&6auGQM@_e&-#CHhQm=WZ&kdLe~r*M}3DPio094y%2NJdf98;
z>1m!$5-DhM%sR-dO{s}r2cg%0TUewlJsBG%z`6JlyC#1)LN*>m#FIgNu;iZV02`1B
z{&Ka8D_r?zGZ1eVE4N6lvPa@zu*5CgTHqRt+m(->L7Mwb1a@-w)6f4=ZlW(HuOO$r
zux7*h#5ww}+%CStOsulDbwsDG<nWOZwoA|Ed?9%h{l0yLBjYS96}gJXTN=LTQI;T`
zZ)gd@2eUjRO^Bo9#F^3>*;(n6La)HR=<|~DN{wMsukH@-o+3jDOZWXYjqGCe-Vi@A
zFP(s<091ZEJi*&3<Gr&9>>_MrtO^@(6uA(hpbFCxw1JoC@=d7v7PG&-Qr48Kp2HO#
z+qW0Kk-j9s*b~H99niM?2MZ-*GixT{@D=;=^v=0V(6iKe+^5lBq+Q2oN(kQZrpAm4
za&@3_De)auNO$iA7PQ1+tiJ?30r)(Eng^BVc&EG)7j!#>b|#_)qWYP}EZ;UHN^TF@
z^n5yYb)82@uS9N&8hU{qbM6G8nWNu3Du&@X@3id9VGE-6z|JXVX*~JvFuZpAXgh`+
zRO&htWelqxc47#qRup2kY4#k;f*3};WN^*cOcMm%KH3-=H|ksQ$;94tO@%H5y(@1c
z5Xs~~ILmv$LW7yAnq^+~Pu31w2b?^-Uc|ooH7RW;5bRhcb^|v{EmeNi89q;cm27Jl
zGqx#1W`Q8b6mf`hm`9`&M+&=SLd?kpf~gicU#a6@@8w~wwcJf@U=sTa(uhS%Ngy`<
zgm=6h!NSs%;p;ljtdnd|JuQD$F|uvI5%TtDL8l^>{Eukbi7`oXil0h!z9nWZsyi2Q
z!79!bxjh4z=TlOlMJ8njAH}-a`Eh0fgx#<X#UzFh{K%I9pY$1}@>ug6eA_n5=9t|K
zte1+;+-R`jqp4pySMUtwE|~B&H&<!agZsxbd*N7leR8%Lpre6`%d2J+U5C?paK6x6
zfP_1qRQCx+{6#-hSv$|ZDAK_(3Vx~C12Sb6o~Iy@sb_T$$7A~(KK1yJF}<fBIZ8W`
z<9cM)AYzlft#E#$FiObB;1zp<zFDA0wpLiF0V6xcXa6D=CxJE#@ds{LC)xvNcW3>l
zue_m4R(j2Sek!IEx^eip6CX|*UAR8SOC?dthK3j)wsJ3iAG}bRDS0Yrg*Ffw-Sk<F
z<lqVZ)r#+J#MH9{LD41mV1-<aOkZ#6Wau)5k7E8az8_j>;>u6L<>8*gQ85<xt9Km|
zlU8wiU6&+Cl<ze+%MW(wU!pH!wM|~eISET&mZ<JnJ`CW*h^18kyGF95>Gb0(i5~&8
z=G6|J2Lc8K&-3yqye>B|g9Dw%1lg9wy9s%Ac?;h<d<79ue!V`Jj6_3YTBMZB!f_m~
zjKp7SwNq|I?PESWz_o3ul0b3pI<D1x9P|)_j~`3nx##dCUG$zR;~~oJ!_Wawm$-aI
zZHMf@ji6FCw_!;j6C{*VXQP;bo<qJ|ce~&uN3zrNE3pT<PHo<xnF-j;Gi2m?tR1wR
z*F6)*rJnDzvm177)8xmPF!bT@QtPf-f*(@f_xz4`G-{7gIz8X+$SmY>t+#Y5>_3e!
zPMfJq+<$j<t~Po(t4lO#n7zOLXH#UNjCM*YmN|`T*Llr<l465%nh5|RujD?vG`=sR
z5T^H#hmFUGlt?P;<inD~F>R=7PHC1oFEb+xt-;;&UvM6?1#mD$@_&AZ_vQ)2O8KG^
zD@2=V_*?QLOGgNg*$;7NQ(WRROx}rDz3r?L*MW9;cHt=)BkB%-IWHsLa?>p$u3*0N
zdS!RE?LS0M+1@kjd+KVi_fT1dXw$S)<Bvcn$+hi%sZr>Ank1+pN$+#p8ktPbRf+^3
zx8DYHZi=1)-PEXhvyd1?mc}xRg>eHQ>JRx8_z`G|M`tg_H~G$99+ff~zcoDKN4ORx
z;zxcM!;D1NGozk(H>+ZsMnI0e&1Tr|M%Bk$8N#;~SQ@L8d7m$hM&z$8|KrLtJcR1W
z7M{+rg^83VbqRTx$=j<%z%2Phd=RDIDqj%3)!%YLISUqyo6LVscdm?{6M$LMH^5VK
zL2M8Kr}7&U<Znn*>U5QRM-hRl(Or=fB(acSRH&AIV6mzgU+nr=&;WtmnV*3vyHxMv
zh4xDoum6eUT>e?dtr!($OEk6*Kext??%5(ol+<TDqvSUR0jXw*IvAe%b+m|ip1L-8
zCsntt7(jWB|KP`J<G^_NBqzob?ZdaHIS!P<jdW5ApSLtW(BQ-^Ciwu9vtmL5K1w#k
zxWf4GhvW-}g?pVhN}F=dH)||ajZ;Vu0Be&Qy)R`{e-YsDa)940R)_a?s}yVZK!ENY
zZ{mw;^#cwahwNu0q5PvXXp9vVtte;bKVoHWsAgF^?NghN8^)c8R+6n#uK9jf$N!H1
zzsEz4KOXIO2<Ilmz{N($=xu;IgxPx~IBmIm*M5t8c*WHeY9!RGaaB?ZXp9V-lEi>c
zGhenMPKwW1ZsTsGP6}Zz0jxoUdE!MJ{@eoZLfNp}!If;ZhPr4UpT{WF?oR6VeoRVw
zeLF10N$XuRpR&*kOb2HA&Se~2`N8Ziq1FyxD$5V6Nc7n+IkS)#qqL;^<}@$$FD$G%
z!pqi7Ip?WFJ)BHm;K%S5J18%H*E)X=mG*j^XF8<82FlH8hwLw!I)+sRzR?!aP$-kx
z%<76l2i$LH>&*f5q}v!%8)L2fFpygch3ZR~44-pj2qsH=G@DEwXHNKviVgNVN#T|J
z1TE&TkN4-B28R0OPBN-pFw@lfLp?sW>#_5iktBFr??KHoLZG}dY)FQ30*P@|%ev>!
zF1ch;jg|<ag#&(oM&acWno8(EqGt6<Cu9?t0+^bo;spJSZQ_08T;Y2}+-G4*RX#BA
z8>XX0rt+mUQ}6Thl{_l&vvytyo2S3@iC$RqIPW8eqg0dY$MZa%Jk`B)bnC)mukFeq
zEm`CZke2YPdi}u4iFxf&abbo>fW!u~QTNd|e-{k#N94|(yV+w`sVJ=<zpI))LoSV(
zda@}Jd_v0OW^*u;lGk-wV%zL?+HiM1W^8mV_b@Y}@9JnfxDX%94o1nZ>5$RBnuh3Z
zyTI)0Rl7iuSkSa;bvM<&TFdk$%5}ANf^P+Sd(WRHq_*W5P;@q?E>SEWXHggEVDR9i
zd?@pDNX*+A1adjVaId6Oa-8}un%0&QwAj9NckiVCi+k{v#)o-*;n}Xy+SV@pTQZ!n
z4r(bMN>>)rKQS_j02}NupQL}?^#_sRTns{v!+jRTEva?-rSWs3{66^IjgcIj9vFhO
zcan<g1<8GKoD4IU|BSH#$#)~bmy#9o2DizZ+su)JKfWi9{qVwe&xSWQf|d3Yg)7aj
z(a(IQ6AKPZnZutmiiN_pv`~B`upa;n<{kqZLWg|(E6{*aS<%o%n!MvzAF=H39LNQo
zZ6vU&&KP5b=c>GB(27mvX1`prmpiJxU|dv}qCoW9L;VN6xz*z4G9Ckpu1=`2pcs7g
zcf(E{*B?#e#=;m%@f2dozt$jOJ^#-1k}P>^J%y)Lj9yMQnPF*~f!tPuSOrO0Hq5Bb
zLm4Zk{nydY*OD<y9)~a2@Vv!@IybsjC0t$x2yUWoA`vThd;gNKDQ3~9CL$)GFmJ0u
zyI#u#;rN;$=<1ej?nG^c)|>NM;nJN$J}PTHpTCEuMY7Dx`ORrc4Cj00PkA;jzNHTI
zL`kc8^^obZcdA%@AWr3=A(Hz2b0pMx03J4(3L%oTN_{aCQN~G>6tbqvk~G9vfWZLV
zdLKUDBhJq_2H3R_h~3xI7@ZMfp>_wQ%eG9eJ;oQ`;^~})?{2<$*nB@~G)X<Y?cT7<
zm8|Z0t*a<>+V7#iKKD*LokbYI3DYY*Gd0mhp`&GPxoE0@<fM0nun33qKs;hBy+(EB
z&x&Hdg=`$y<N1c2<nTsHSZg1xa?KtQsxn}Og26XN9)g%LECds(eIAitNH#+0%g`xV
zIFytqqI0B+`&M)_V@6*B-NVlEzNcN7D}ey~8tGPzh_=^)f!{r@w_2jzKB9RU();Xp
zXo!yZzMdu-X=*6lco*p_wjy*@dUHRwGXQnd5;$&wouRQAoXfEY;wKJ`SpN&wZ58&r
zx^7$@dj@n?DS4=%EWrTY(%)Du+U>G4gc1kU3-X^8Iw+`&;=i)RLw@#Vp&EVa$RIHm
z%X-g_4~+5oN;;BV$_HV8;ydV~mtwv|=nKc?12c)=z8^npk9<o?kriUlzuaus&Q|{9
zg5pcO>WA|)#iA`F<~hLCJ~5~}4owJGit2HSQGCUW|Dol<PMEcQl)c?+r!WXZ$gCP!
z%kk)q1p>P-!^mFSKu9ten1?%gGQ<-5kY$68R*t#W225`|{Vk$ZqDA$UTqtMTMUFE&
z-}8ZXX}><w+XF*!Nc4~Jsj5)P{*U_F;?DxRBKbSWUf)p(!hQ;|xf@qDYE!dB->#tF
zZ4eJ>*1O<;kGP|tC#0*x2(da_cB_@9ae(zwCG%ADGnjbL&^b=JYAygXYw;ub?>WN{
zd>3;JqzJKFv|5rxwr;v|?C3xqn+eCNWr+ipewCN9<#At8cNDl+Xl+dGeeLZs89bvy
zQRE~%*&F#P+{VyFiM@fLvv|`lCnRmGSkgr^e9vO`QcgW1-@ZekFrhTt*Re`<U^c(o
z%E0vKpj85s_)W?9Lws`_o3+W7YzS?-A!m4{jn{s`9|p6tPxEcA7d_=ZjOj1d4{YoF
zVrw&gMZ&Xa5q{IDI3e9~zaTd*4<tw8OE`y%oo5NL!oeH9&2Hy?Q;z_Y&}OH~-;j7n
z`FXPM^rgGxghyN5d0*m^V|A44SI~7^vwalHRm;LCl2QsOtM-^v4K>hLYsm=h8d_QQ
zw0=KK`rH$~I2mP{aYZ2oSnDDwfHTZGjBm}RmP>(Kp0fpFc|tF%Cc%|B40(vPT{IN|
z$BfNll2OmRob_!AmAzA*S@XO`V!NvR!y$5P2H|Sm&WMo>B|e50vxcwQ7F~mhpsJPV
zk^DKp)|Vy`2|uf6C9l|jq;KpzU2FTg<+%LgY*UQ$+%w`1x>FJ4`=pt%O)Y8m<i~cH
zn<}v`FQWO+WnLipr>73+VF)vSQBP--<i}m>7>?0VHf+kc#cnEf7k7p<->F-xuB}-^
zeg9Gjp3UHWW~x`I)Q#STy#T2)4KYO5Hh6*l&A|3?@#I*LF}VLtK8*8;&`7q4u3IV5
z{@l+XMSgtJ+VO1tIs{H;XK!LS^?N21ag=kMMjss_!WPko;!k5SK0jPY{h~k67-j$5
zi|z{dGC<cdDgtL~K!TBFdbec`=j!SbcU?kLtq6X;X^a{8yBeV%;Aq&8A+!$Kv7P-D
zZn~^AeKykw*?uInDF%1CDU9hBayU*eX|V|I|9FODX9-1Dx*6lEE5M7X8Rhmu2-OF(
z1cA)NxA3wxkDq-moNAnFI!zfm%okk=Ous#PIq;Dzbt~f1ORzSHiCKJ1@N$l|9~DEt
z%^f~q4rm%_LO{RJ@eZ}IT~T8kt}Oe44I(UPqd1^JGOZ54q3AAJKkyx#o$0xGJEWJa
z6jsW!(xQ9!FcZ}4gfD`v`o+fh_OYSgRzAL(@>Y+F5|QWV#@fLx##O5)<o;gWWzaHO
z>BV|7s>K$J(Y$S+A32|bwNv_?I0_SXm(BhTWw&f)vYff(Ai3@lbhR$E3_bJ1D;Ay+
z*qo=`aspFVdc8i+l3m-!KE8f|9GLrFwYi1Ocx?-OAJTP&{$<6N1Av2ur4@b_*#44U
z&bZ7pHs*i)T>V=2tUDL8*O)PH7Z9Ye<H5KF_pP3f@zaz=wd@yWI=T2b86pi$wjnyC
z9z`0qpd5h_B(apvw<~VO4M(6vaTVv_boYAa{({qjWso8-)pJs~V!ZFx;v3~A)LQ%M
zkR=_v8v_edmPG2UP5@8FvWMTTJTiZ5*QO!marXKA6$=@S2zwq}IrxC|TIWhu=zbdp
z_8<yQta9Wyj^khs5obX0Wu`P>ZO5cAs9$g^WcALS-*CJ?60i%~`{O9YG(#Jxuj&)g
z{Rj-wWMNVHiCV%Au_u1iN7zoN1}^uzY~|-b@s<oj7~XJl2r2JE=s8HnPrXu}NBqly
z@I^7Bzn^qd6=Z}nkbDd9b1dI0$;ldZ!SSt`4n~S;x1@^(dS3F*i>fJ}y4qlm50L~K
z=1Rq}ZOj>}>i7;@tMC<A7|X(vl=RN+49c$+oiPZtW5TCkh&y&$mx!y=lk?sn;<4TL
z)Wp-ti^rSF*@zxF4Rb5A(T%ZIvRs$=W*(0BO7U?QBY=VoK_>xnWA;pvwO$~Mf?>yY
zp8t2DIjN8}li8AJyE@#5Y=4Tn80u0oiJ7dhIhz-XyRp#|XmgU_p3@MwQIXa-N8|d4
z4@Ux}uuZmBf+(VK$5J`^!Fv=g<$hP1{IYsA#7GJc4|20i#~sx%?QO4n0d1#o&)t;>
z=Shw*6++jH5d}taX_=nEAYH0r;B@4fD1~zqv|k>=d_8~tQyMGN#b{UgHgM+IJa`1@
zVa79A!gs_mW1{Egacoqoo{sp+Ie`Ic=&0CD#nFD*rX?EjJGg#>3M^cFiNnUqor^Xb
z+q%qj)7-bv+o_d@#nx6-izl0D65`grGJiOIY)ftrPWIVGmRXoiea4s*XH@#p0Hq61
ztU2J=;OW<OGfr8-g9bQX*(9)wTMC`+dV-cHe>ishlWJLnhQjX#eQip3C516Ia@g@&
z&&_CGTdz}=q4dRL43e90!lg;>Etb51E)&&s@=Va2WHG;pTk(D{#l}f|jXJwxI*zZc
zMuhA9=asy&uY4&|#pE+7N}**76aK0_ijovMssmi1j&69=sFFphgE8v47&HRU=)zf*
zysW}2)QK~zqL@GHi3?DioD8L?B2uUgAflYq7r)c)&u`u6gLD-s1I%gt7ip-9lduB0
zw)@t-dJZ;;cc|hMG2^M`@gui}dxTA-ggbN9bn?J&@X$39#VZ`>U0WwuG(@B2p9ad{
zFb`UL8Dhk=?&AIG9$TXsBLAI$&>+vVxKT&3zGBw7`rta#A-9he(=k<v{!Wl1RR5=j
z&B(lX#Ra8gIBB1?6EmHpNrF}L)ZLWd7K046+REP?klI07d@D;{fB)<J1;Edo62H1l
z%Q)m%f%5B&{raEOaurqWp?@4G!1@J<u1wiC3E<}ntCG;zddT&E+zyY+$0XeiN0^X|
z#&X|tk?R4~7HqiOYf^KtCuAr=+H@r1%NyCe{#V>j??S+as2d>{tb-VqY}ze0mTZv9
zaShVj;gKB!;lZn8I_l@@e~Z=3s8E_1E7g1)e{v)UBv}A#g)C-lEF?y9Du0R1Z|zN{
zKympS){s|6+Jw5=Y}uIezZ1j#o8Em|rN`wRTv!+B@t+|?SX#d{4`YFcI7bMm&e!FL
zQrN4?#G6Qeua(yQAuVH2xd`Df;7)q|c;TBPTUCCYPe1o~*KlDe+crfN`a?x8RG^N|
zu=jx<%!W|Xhphb_*kL`VIDr<D2m89M*llZ7lwTP5za_$cPWL=UhxjWC(T8ql+ZzYs
zKQH9puy}9Olc{e{;kh32r%`by5$kNzL8<b5GTUtA9ZB0iVyni3h24teg4tkLd-M1C
zuMN&J7sOxx61l><$gRjyBlw6DTl>cC6aQUtn+s*|xVbTsw!@W?&705u8F-(BZ1)m{
zM*7-qa!MKl;kkuSjenumee^;RA1+||O3Y^DA-~Vs>gFlbnB!k<z^a)cG3)l9%P5(}
zF52+o9=l8pP7QNNMb$0vP+V9Srkge(hMPCuYstO9`}!>0TnekVTXwQwlmJa~4k@N*
z!Ezg`G(5xYYtPf}DRO>R$XUmSJp%#LrEz>On>i`jGhnaje*nSqKjDjLVx*W(B6a>J
zIo{S{Rfn@d3iWG$LeKv8d#+#p&WtV1<Ay5nPA;6W2y4QvQ4}`q!m>iN`n6)3z}8f+
zSkEo2+rZY$G`?|=htE1OVvdm5@nhOhO)iz!$!~`xFtahe=Y9z1_nJH;-Db7(d;|Sg
zr0x+iR%;llqRa}Qso3&N{5KsZ-p!SG-Ypcz?8_TkB0k?WU02^5!T(_M6{(}Fl4IXU
z+{o0fkz=10pfpo~!vkMP5k5J<Y`UnFc_NJaYn_b_C`wu=@!!lQ+59xqZBs$ay~Jl|
zjw8g*F2TSHM9#;Hzf#6WvYsyb@(@;AiS_^Sb(T?aZA-h}AtXQu?(PJFOK@m{I{|`Q
zfDj<Kd-o=|LvRbhgS%UTySux)cLUvbW$$y&KHqomxc_=EfU(x<xoXy|dfvB=vV+-h
znu>UU-Du1lh}ZG^DyDc8$1$2bRAD|E+^?=fzx@wP&W{%}rV=&a2;hg_5WfaGPodUo
zq-d{#$c}OxdjEOgf0d2I`H<!x%mzfmAi4O=EWYPovAZ|K^Ma$}Z*z?wSRSWvV3o2|
z5|DumZp<g?7nv6v%TxTY3-jq08+=-?5ti>T_w%DPq+|*Uj(BaQ&@C|Quwm~DGM`Q4
zvx_SHNxPBcbr39MGNDIi{Z`f&Nhm{hxf>@0^{DAy%p_?UHZ4r*z6>^NxU3^PSS}ZK
z`Frv8MgH0ML2ivC)MvU$=Q^UMY>CP1f0M7AiqwD9_dQ3TK?m~N;t@3`Ojn`Nx%f#%
zo=oFdh<;)ip!9f26ozR~(4g^<BTHqrP?CBsOOX)|Nq|7dh?^V>O!F?HpEJL~k*(np
zry}z`!bbX~s4r!IgES^@YbiS>Tam+ydl$>Tc>!4W&%aCWZ8&;Yl{FajVbGjVcI`3i
zG!Q6<coNF~a$o%oz4_?^tGA4qM5!qR0O)v$Ik#R%sSS*3OEKdym$W_Cj~D*G-mE9s
ze>zL8u}P0j5MnWZNff)2wXNxn3{%YOQW<d0MuEs14;X*OG`j<awoSxA4#O_D`D<zZ
z=7y03(_Y|7<twN?-=EE9l5YDP)sxE+yeAI?jR3KExmjvavZ&4Ys#mnSW>To=$fe3n
zdu!HwkV5izLkrwPsOxyP&i{gKlU;H85)%DHI;=3)VKNrt9<Omb?ijcm;__lXD8q4^
zU~u}S%zqac|5ay<!F%GEbQUFbqaKDzh(ZFDJq)f-*DHK#Tqpz^QuG|QfyeQA;X*a#
zL9XYS@l~-G<rjIb3dYu5GV$@inDCxAeqZHLUDGSagYjZpwIVlZy{(?cyCpWFI)^-$
zsqpXnq=1_f%?{oxm`a2dMAx~YBC4Vxz{OMl!<bidA_dAB_ss%0T=vR%KX^Qy@SSDp
z#QFa%hB_dBavqJ{EXRjn`o;?sqS)<l4F!}1)D+Mz&GF#4zn%lv7(rK9cBgjDRR#<e
z7=4%mxjNPrDj$|%Gv<DM9nLx<MHoX$M50&-Xk)D_X+29>P9hfeRdV?>5VUUFnHkEi
z+i~ibPSD=^aJsQI)DnPaam3i-0Y5a(Zn~{VYd>=$|MyXBiULUiohxT|*Vp9dBo6Yc
zz{8W~wZ#9fpZ#7++&D}L5PS=?XkG1xf|;-32&KmyS^f0a&FM3A`pN}TLvLQX-bh8{
zWiuHm^zh2s!YW>2GvORnIm9-^58()ZTQIGxVXm##8V;FZ%B-2MAbHduKvh=+o*qWf
z&kGr3$p_lpa&a*ahy!cC?aQ}Ho*P^!y<!L+GwQKi`AJUKgHxU!Qy+pT@h{>zGLapC
z8x&5y@?_+}$Fbt5pD!bR0za@*wHqdc-${a?pVqoZ{!mOaixTWuy^*{b1zlhIJlC0G
ztwN5fjwBtnTb;H#7hY^|#6u`^hWp&KrTshph*Kh0L1nX@_VFzGu?!meu7cTtWb7<u
zk4GhwHmo#tUEMrWY+p^bBJ1a3JmRAgdC{G=f(y1|(Vk^#yqeDY*Gi^lUk~DyzDw~k
zc3$<<geQWFWI-Lok9%|r@`Sy5#6-zjk=HfKRF@19G#4Bb#2G&<W+?zv>(BU7MV#@p
zWB)y4RO6oeRj^qQb|U4bYbzi0V8Xng)9dQT*`mG16hSJVEh(X4jq}}6bu^Ffo5CR;
z)$p<WVIPyNK91t#6z>zy4xh`~YB)#H)#wilx$w!+2F`TPo^#DJ)7GO+z-SjY30@FO
z3VP&ajGzL!$t)8X&%XRq9F_r03~TQI;JFT<M`C=O;A&(OTG7v_AIQSqP7S7NE^oB+
zIGOLIb9`@`Bj%VW@m*{LrST7jXy;8v<qo`P5HUcXGS>i9*4d1{zf+-CCQZdKpK$Og
z<c_`N;^L3qoR`R2`nHj0m!qIS9J-(+uHvGD0Ty?RLAG}FhU-LYiNVCuP8`{9#45tq
z$wdk)PXF2S{UE}?Za}w0m)57*W2G34`wdTB$A*3rH@4Ct=_-c~Nq4CLmJ+w13{{0q
z@->CPn72XO&fB2Z7I+<c0{+}(XvB(#dN#ZtA-vi+jZPy1!U4b@TS`jAqE75PLq|1L
z?OUZ`gL<P*by4oC(7S<*;IXEqR<A3&1z)Z#7dOPL{w|pTp2QfMJ(iZ~LLVIs2cv|K
zDNh<6gE&7=g+#EhJHd_?IMTs-#|B&C?6(Hx?hO}V=saRST=vGeY{tB+9iZmB+WQ>!
zl}7-dxZVlEXh*C##5Nyo&MY3`i@_~*EKLKvdZWU-iNu%PPmiBel^a;`7%y_p8aM~5
z89!b&=JK8KTU~T<&am5AJcIIY#DXn8RsX2wvt7{J(#>&LES(K721D~?s93g0`AtHa
z=)aETA^G`0JqNpkr!cmNwNgg3GY8ar)mwe8eQ!i-2Hx533YJA*zD=O$8&58VE}5)&
z>TeULcsB2(SL;5M`CN_PW7OecxQ<vdwf~XvxcI%hh3)v$i9N;*NrTxx3C7(l^>=jE
zyWT5PDtIgv*#?DX)#ll^AxSFm*E(3m(<eg$eE8-{6l8l=ltT0H>6xW?#8mQ3DBIP?
z;Hm+zW!1H;2~xPYnkyr9Ay;kfq(ChA;H9Wbg&$^z04<21G%Ta%c~e9`)#YA}vXKdN
zO5kQIQ~jnE^Ux_}8t3;b<Jrzl5a1JX#1{CHQB$f7)olK<3dzs5ZkYi<2N>3Gxj=kO
z^is&6GjT-2^N`j}RRNxohK(YVv$gs`qgmW=4vL(bOPmhTnFA8}v-(ds5_hX%vapPG
z#j52S-;Sok8%)3$-eG<<#RZA~#mNE0d13on0hwBjfM%{xBS~&5;VGsRM^_1|iIIpb
zMd67~A-sCl=%6J<{&X`s_*oq!Zpd0{OH2QhnDi^Q-4ACON$B={+~cBnV*^5Ym2LIE
zD!@OCkzf1Us>9XD>00P;K5y_&tA>V5=3?3xf)(cRtP}zGR?68*LpIuzv>*y1O+Bf?
zKW}EYU_ZRikcRyU>G_`a95?z;ow~76i5j_{yaHfUgG((ZAc9;-RV2&2ll{Si!aNN*
z&~Pm+==h4rV8H1k$k3k^k6}dW-`4-gwaJ4^BGOA9d7S-uw_@w-U{|_lix1#OZfuc~
zB^~bBnW%sKA+{}JW6l}?CXBp~y9Kl|KvG?Hb@O~#m!{#pKNh0Jd_W?XLz`T$J|E85
zcH9VG)yjqvy~JaT!om{s(7yAU>T?+T)f@0>I5pV!R+Kg3&dH<U{zSj1;nSnk3485S
z6_=jVUW|LES@beh4x_f7=QVM^;>h&&G0r<AW`NWj=XB{49)BKvW#2d*l|Lz{l*}pC
z!ns!Xx(@wK$O}e-=dq=I7l~M2t=D`na{Gz-Z+7=&bEgvZPq4w1_Zm7wH}?S3hLH(@
zhf1s1llI|xE}dHhz#r{j<g~+IZ`y^k)zy!h%~$B`GSGT@tV2|z%>sQsGHPoj>f7a2
z0I+*!3!7e$<0b@CRTL_Bw-G+Nv4@1tiqE&`vp7~}=&e7>v3~uQBM`7{XNw}}jPNB9
zKG_|c58<Qj>`^5q0_>xr&X(O*yPzVNZS$WN^@?KZ64lKNJPrzFI~*2`KbAG_yhvLh
z7KlN=^*531z*7|=POPn+VW1S&jeoGH3;K21N-+EObBrXWDEpGr<+RDgmi)Q1zSZ_L
zQX_3U-0P#qLnR8&zIc?_4rqPBnmy7>$*A=(HOp`jYP*aT7?NNjKC+(&_&6E(oX?Mg
zvp{jLlwXvxRcU`|t)0~a@$%cq9be4l+%D3Mnr)oXQV0bNV{o(qbkw~v@y%OlOsD6e
z6-(BqPdoFH(ydo>9uUFX7Fw^Nkb<PX>xB<-RcI!1y0O2C&_T5X6iWK)mP$h13aD)J
zLs5k6eD!=i=)Oq<f>dXFaG^sR?9>rK3y~G&%FT#?O=A8(8ydCxjPGyIgNEzp*oW-*
z8S+&!NR52A1J7WG9I`wQR68DNhX~tD!&^)$FemRz3Ygs#Lm2$0e-tLxyr6l+^7|#r
zoMASGp95TanXkke1UnJyM~KneC1?G)1-X^t@-~4>{613a5()wBJbo9w+Ru15C+-d+
zH_jp!8U9DfdV4;-9SWk~c7^$SGKwEGCY@!nF888@PYA_0MWo#>J<rnCQ;Rv!rq2fj
zKYq#JC)Br*SM02DcxZE8+N?G*4K?oos$U(Cx2q|hMOMeIUV)UNGZ<U9RFBs`97aX!
z7w`z<oZ)<Hx6iCRugLPpJUKI$@n>sRe1~0+=2pc-F8W$iPAFcIwMkO>aMDli68sZj
zlN)i?>dk03Uab=+Ad;Hyl;2Ow5ZT2kOO@TJE=;Y9n7=CJsSh)=rrVG{k1Y%2x>FsF
zHQpclq_lZZUj{*4n)~rU_w>Mw);B}}Cif^_NRd6VkxSP@8mvd{>Vo`UNEUr?7j(?g
z+ujHy-v?BF25S9zF~7F(Wy;%}(9u(-wT$U@@Wl`<h=4S^me;s}*zQt4PbznxoFl;y
z>_RL{K9kc~*7cO<v|7%SxL>fcS(d2{7|3<pSAE+#?Uv>o)*+)IQiMc9iwl7aRp&kW
zx>Iu~>m}7HsO59du4nX5@$bvqPpZxq<C$Yynh|heQ)8ILvFi-KQ;B)QUI$OkFrX}A
z{OY{NTibh}&6j<uNGEX)t%;4hvtDo+k)u4V+=ZWaTvaKKqTeobBMyqoQ&QP=g2~r6
zuF2@msV8+2%kIm#Bci)oa?j(w`lDMQSJ{`=&Y;`3oqzVYioNfsxLrkmYV5)21E6~A
zU&BX3`P40dkpGTe?K$yVjP+pr%h(ZPpU}Kx=OxA^=iActbZ3<p9GE`rN1x^-OD<E6
zmQQ2O7K)#CdhUKRZ7{-XBI$p^6^h>x;dqmm=8N?W42yO6^{k*f+|!PfIws!x)b|~|
z)X#N!I_3MTc^2{HGwAKIZ9C^U`wf)!C*Xc{99grHJ92(EW+(Dz`^Wvfq-bOg{wI7(
z4wn^YwBbR;Wlc;54)DTQ-c^fL$q4eD_e7?c@^B8hR8r>g7N|ibnpTY5T;t7xV&2#4
zfQMI*!+~O#+R?|(A5V2FSG>rAyic1&VepIa(atj8`)-7{Py5Zn;m@-X;qt{ftM$C3
zZ^czuCGyeByZ4}UXPOmV{3o$}*wxtWHn_Ee6q64mtwXnluXlYahPVfVuV+>TMBsN%
z0m%Ejev#DL+^to9Ge4F!k1i7wrSW(p$h%Uqp(7zSi@`U?%i4CQKCY65s9(a?F`u?0
zfrPV8aKY~3_x6DJ*^XdgA(GSXA|||9_i~4egMVNik=YLY^d3;0K3zJBt)QYJd6N7>
z^~n-=(KR-A%LBfXR^GE|n009=*n8=-+v9@qM$`gdD0;-4UodU1Ql+D@EpXXVs%SIG
zx$kqaD;5^WDLMl&61AJx87(kA^3=a`-VIJAa#!jRM|8jBV&J}v5#iIudqx)MPIGlM
zpOzJKSpTH=)5xh@*5wD9W=E$e(9%x>&xC2Z^HI*#@w}s+V~b4Rc*(`)f0Q(9#(#<n
zKA1^fW^Neh@{qq~Aga771{8SE-GjR9NF=2GVy=X%L8eXOt|uSMuW0=ClXzexvRGMB
zmIkiZL>Hqv^Kj8TTI^;(X%*8b=SGSK!xv2F;7)GbHFVLOI@BOBA8LWc%pbKAL9u9(
zzz^prgDgHaL-qsDG!zg0yS7YY&?`+kpX=uy4+thrH(mQ=*{}K**&J#aHE{VcZF)v*
zdBLHtHq$0U@4UMD#sM%WZv$x%o>X6fUb5rn2VZHn?+JI^QBLC<#-xV?Tix`W8rc7U
z^k%1=wrut^h-DkfM%{IU%-twOavv1O##-*!9!o{U8pjYVS5ne`%=Cm+%3<Pa^8Vn4
zDLGdU0=a3o9A|c7C^>^325xh3Y$SGzmkDt|m-lI#S|Bos&{f9SegRdt96-wGVlj*l
z&I^8E>4Cq5JV0g1EhzHt#=JrW%tb+SilJw3uW-j5eWIjJeC>!TO32z{NJe$0T%svO
z-z;B{?)E6XI0fuvR|&EYs6m7}AJzqG4n8k$7|<3pa-v{m8-=bgF4O`%&pCtT5mjs>
zmY73Q?7DIH8(?phsylDp5RNSQOx$9QGah3g<tqx?^EC;Rw)3Ap^f!u9TVh7Tf3*$0
z%rQ}#62Y-<%=Ntw?2vzziKim`*l{N(NDsQBv34;QZn0i<HR9_<{JLF*@S9G}(8g%L
zkw8ZZm*a1v+Ztm$;7Zy8-YCV{`!G6j7cMK>8fMd^l&R^={I5)WT1$r!S+S?h??<2?
zB2Nyb)T5IUFP69ORRX-(`*))eIi0}}+=i4+$1t;g3il=K=*w>SssyWB)hl8Ty{Edr
z?CLJwqw?o9xgFym+Tm8cS_^<DqfA0tI`9&qV0baZLER%A=<XrTRmNWjU>lyV6E!v~
zTj!u<>6?P>e>!K7>Bi;e??#yJszLkNiw|#GZ&xCq=lyvjr!VaAoxgQZ_KMi$<31Y^
zjBv+x__pyd>Rx2H9XVs#j`1P`1$};aMYi^paw>6-pSE$U_tD0uwRggwF7<o<(+F`u
zhKr)UH%jX?AK`r{D1EbS+`Zk=t}x;CQe);1hJa#Z>6aCkSA(2+u#!|7@4_4ovc3Kk
zae92cP1?|LKu<|*k%Q$MJ8+>&<(ya0<SLD*db_`Y%1ewi@99TyuDIoJLmdA8iqov+
zBc^GxV53WMwMLAAfp|g3W|jdq9gyzGy;h5@9-d)(Npj)lF*6|`e#V#Dsuppkv>OFw
zcBfqBGHc5`$#aqlJ69JB=w0d6TL>6<YIEfOk<m2%$HuEn4*?l_3g4?jlZ{+7LL8{i
z4i4f+`Ysm7EUh^*jv{t^OGEh8%ddbILi0^xOb>R>(duks{*w*~3576;4zn_;RwomM
z40QE?D^#x`<4YQ)eh$_YPH;=n^lQa)n$F8wTQa)l>HMk9N!y5*h(c}#zaCwd2Kft<
zMC)|fUj(8vJ)E|ScJPWtyL*K<i7oFia4941#1t$oHuEb@%>_NyE+c1+(Uv2BkXr1s
z1MC0S-5pQtHc;oF)bPoL_YgyK-&0#b%7mDCUi1UY6AxirVjBDFP$zeB?H1n8KkSY@
z@mW5cH|gPHbPZnr@UB#s!)xP($RGw*Qc?YjM=F)dk#C#F9jGD5S}C84Rm}^{3XLSE
z4>x^&BCd&0#PrRHeuY^s+VtNpclRW7f!?d_%8*SIX&!z-*wYY)Dj1DSAUjINr6u#P
zIGDHWqxH`%(ne~~P}N7701Gr&2YeUFw?NyK#w(-l{Imq0*{zLb_fB)!*-TI@EJIdt
z-eNy~!#ynHo<ZbE7vuWFQ{7Pw0_-l)W9Aoja%bxEz<FZ36`Buyjh=xbkM*9S+5dSf
zzH#5+DW2WJ`TLmvszE<AW3Rb~gnD$xL#Co6$~f6azT)B_3Iz{xwrG>V2@`6~U(yRd
zYnu%bMJpI?Vfq5Ig@HqC=1AoZ2&pkOjIc*#{e9GQbk@-`9x7o03#C7;aP&ejq`&9V
z=}%ao5D(7m4)}p*zF2;nks+gaD7cqItP*5qO&fgDMV9KCdG<$R-@-O4hbc|}n{Qu#
zNnx=JG{j^$^@f!A-6=dnN)92<b&Ts-pSPfj7F6qJQ~c~_F9V^tyn~<jW}chd)xKrL
zdDb{4L9rqIjn=nu%^%zBC6$4J;~$LK@$u-H`n=e&xq%;dGj1b@9#8e8*d^>b)jwWr
zg{H_N@<5{^1UTlOEs`KQ@!V=@^AcrC(roT!sOUYRK@^}YB(nu6!C5JVbDI0jNFSpb
zv)$K+>$XRLQr9q|Mm@LWN|y!MT{&<HO$vF{D%NMdYR*(q=@xo9FX@1bV^kLJk5ael
z<^4|JW^S@$%a}2xy`FYlyo;!VZX2l7g}B0ptUY|}a2iqhRr(B>ttPHAy^dJU%@`B_
zD|fAzWO{IQyVulf(y*Af{zhTPSECb(97&t^P}LWS@A+2|CLvr&52!J4zbotk{&eGN
zH<>e8qtl>xm;jZ-ke!_>YHr6Q%{+f9@#yXHcKVp(c(*#<`5jlmHa#F@;V^>$8HYa`
zZL&{02!7_fgNAJv;3WC=;i@rebKG(UVPOZ0tursJosG8g_Q(dB4Sy}ZZmu6fyFE@m
zKtiEK{uCikGR}KXocv5q5L}(FGQ0E>4&mdvxEWx9lYyEEwDpG7g*B!2R0`6k)%HZ@
zrq$^+d)fJ8`yE@xd-NA>Jr&@mYBPE*`~S3!cqot_UI#=69OaEXKfOz{-C!zBCCS08
zXZ}LyTU!`zorg6pz#w)O2q<n_ZN%^q1EBPUUoxMgp}z&U3wu)IA8XYlx@>qx7&`@K
zviDRYtIZ~AKTk;-JCjU~m`SE-@?36FIT6X*a%)i_#$ymEt~k`!NaJ;`m7;KiZpB%3
z7f?m-duMqCN=bF=K}P?{#{Kk~b|F_vo?RTH?P)q#j8Bo27)^1>1Y4T`Chd)|Hy1HZ
zya*hgAbO+P#TGq>tJ!@Al&;8)@!w~-o+Yypsar1w)?QTKRLQZ)y$|8a_R+4B<)jJn
zgpydlyJAO{4ENj_-cJ+(mypm<(R=DC#+J8{;`CcyG|(Q=9TrBNHLx|Bc%tDVt*fZ4
zxUcrBx=1LEOw#iI3XU{pR4uC--M*tn*;H^_7cpLROAf=COIr*-xDyF}34Zl;7Q50X
zU#jP=x=DNfMO$o|At0Ndbo_vhv@_Nj6}?YOZ2+nCWqk9DAL&e40mn{)+BFpAMjq|S
zTZQ<uMHx)GrQ|il6DSXql4k3Mp7fn3*b|K)HmHQ?tMxNQM|DHby<g3n?kySx?BmGe
zcUwXXz1$M-X$s}!sLr$U8g(4=G<jkdw-!|<y}Hm6AitxfYl{)VlL^t7ww$Ex3bEUk
zK{_r2%^Wv<?9mo_Om*V+YiS9KQ)%CHEHRkF51b!|=61QP4QsR}g3Tmf6)$|<1rq^r
zZd|K}O{hTR<`kj69ns}-(gh-sDA7rT5m7SYx->?|_GA|XkERj1Y44@H@AYZ}i5QCW
zGVwEc7BM89ZJ~Xv9kJ~mao;8%Mb99ctex6Q2Ug~Q2KtuaZo{xAF87;+)H~(ltySR?
z&3}6V6!p5!E8B+nd~+FqQxd>z-|dO$4B3^{{y43D%hA2cWuHLIR_19W^dGeQ=a8TH
zHs0`Aj6(_!IwA$|-m;iSfpypG)k;w7XuOpdE<%fGLw&^Vj;RTW7(nxtI_P*`AXP?4
z?<@U~-AQ~?$x@Z%cyQ1wMh4sCit3{@L$#G4V$wj&xTGZDP;b<+=LA$&GPrX#emPH3
z-uue_rSj5-mEcOp!f=4P*@H&njyOE(VVJUetMqj1baHWF6>R-(&ZM_({YQ=}8U%6e
z9?>?DGuFanv1sca8nAxajv&kd8GGA)s7)Nq$*ecAZ#L{m6`cv++NxiT!n|Gf_O7{o
za8~W9kGMT*G`YJh2Xz8wuw+y?<}vkk_U)3ZKXV>{+Kwv$VpQ~2YHm6^R9;kk#1OSb
zJplb4?!JP5TYejq){Q=rbj<aR@|Z(A1fK4FLTIx3h#4-$M>MQDkA8&TpEyX#5wGt&
z?Alq`n?dQ(2?Ok<-$@@+4B9qMsx*_CRO;QWY9fd(9TE?oR{8BM`eO<SVLuxTyaLEm
zyu+IN+jhaTe0Lbxn^d-ZE)VGT6U_(hg11x4kGIPtZu`{*IQI~;bs@H|T*lF)B*V*Y
z*4?|RH58si`;aw1xMK<X`B+;FS;`b`SX2R`viF2P+ba0(5rvFWvF&)qnrA$sCB%Wq
zn~PG4n_0DQd$HuJ(${5m#Xj^40{iyPvK#f*OEXF{u>wgfVRjj=4Zy9cEiLCLsM~o|
z4Ce;47BY}V7nCP0Dsg3@n1$$^Z(4z)Jdx9#=yH%mHYF~!&DK);6;G~BlTD_6u<3JF
z)LK!Mx4b2=GpDiXeruuF&)IPC{Nqg<5$xnbedxIE6t5s=B*X>7D@(r;I5#TMy9*$U
zLr@bP$hQLXdMO}Y$s$(jN~&FvsS*-hEQOIT^1|2Ve#N1r%Q6dc5D2X%IFB&7*eL;n
zJ$~17m@;>bZmQlnWjP;h^(<sl5Dhkzg|0@#iV*mm*4?+6q?l`kkgkF+U6l&yt|k7;
zZNuji9t{|Jcf!abB%Lt4|EuLVw1tX|`Vpx<<R?#utomm&n<87(7Wz$QgghC=)w)2Q
zA_(SC07!!ghynjcxW?snoV1$kM?5l{i(z7+ntfTOb29fZ%v^=e1%b(pWLArK?(fgW
zdy%lyxxO7JVo|UmiJ}_X&|x=(9PtEUK3<tfGMLHfWxt|;oiq6M*zGs|QW*|z1EIG<
z-4`quj}HddcOx<QzfESro)-yLulDCiAi@>H_l9=ASQ?_v3frf_xvqVj53<|eb(KGu
z<4w(XaowwH({rKlW&4MI9AJ<_U}vPUh$2T1NuF$z4w?h=uf~nAyKLq=bjp%y#Em3s
zUfbIXMT4D?cEVQ_T%D(XJ?m)ZyTQ_Lq>LQdP7<SR4@4b$)!3tW{mVkEVB278<4qDa
zLoc|%GsAgbvjA%mDuyLyR-tteGX*YtWaBe>O?iI|k@DEy-rYpMR!^IPf^n9U4y*r=
zr9HYlR;?>_TAbTO5NAr);on2j4v1i&^n>Z#mE9kzhgSw~qsCHE$J?xs*<%}HT3=;&
z=)A3-kYvs<c2JLfJ0E}w2HKdh*dzSUI+9U0uB2USVw<RA!+pzN_$DccQpGzPux~{p
zRv%UeUDID*A^50fuB!QVc7!rNj?yW3#wpjQvde<&C~c!?(q|`}<+Cm+oE1dD+rs>&
zbO{E%W9mNm_bp-bKgw2JjvEiU+lm9hWFMlTjU)cuM>~4xzOBcts9OeF2bn%z)e;~p
zp8vR1`ZbAvH%lryRVEP>;jc%@beRt=wRS~gDXmc_7I2^@+LK}oQ3|XHoXZ=Qp}>rb
z6!M{e++!|%>I%aimZUP=ACnoA=6#-2B-WtX@P5APGr%&qU|&_px7%nG82i`+jn%d>
zk&bPsKjrS|;0ze+C5JItRsRt=NP{ke(m^N+)9|ih*5AufM5|<39Fo*dv*|0ldL}`4
z|F{c4TVw!QBJ~Gd3o(1<N4%ef-!4#g6-8qYv<gPLUBtMFy&L-kp)}LtwhHVW+BcVx
zj(!<N9~CpJz8I9j1LXyg?GE_0TMhIZQTwLs%Ffk&&r){j{Lj_2kuA7@uik8Dd%+mS
z04$GR{!{p+dbKYy!KwGX$g8CWb?4|&uAu}s&auBP4EGSF4q2>M5P|9Y`dMMugRk;W
z-nQb?a3?F%vpa`S&P?Lw&BdsY5*V;IE)_Z_{S0C%(s8q{E&<wDg1y@ktIHCIcJ#+~
zwgBz!g}Z$ngQoJvC~1^-ErW4hC!C?cD0gDE8c5-!satN^p@3Fcv}vX`7uoc6vFk2N
zxUV+)Bi~QPOXm!f@cH3dO1aBv*5LE&S;KGEbNByM<5~6pvq7OjmhaIaASahS>MPfI
z`qgAm!F&9QozTH}c3V_qh54K=0EgL-sto_ZhNvklrlRl|cQL#&!OCD_<s^8HLy|4E
zH`_J!{c1e6%*`mb#Dyt^ML41wn=Re*VA3FAD3-#e;$%oghvF9qHuts$i+~OA%9`Rr
z0?M+?GIEG_Ay>oo_|in9sIeo^nZ3uTpF<IU<o+^zwD0%UF!{8?Z|tp!Oszg&M5jQ4
zqak<o8l<P=`6Yoe+dx9Mkfo^FEmMOZ^(7e}y^qcQD`0hANP%E|t?LDu3X00xA^%9X
zekz5F518Z&)4*dx1YNpp6=WX@VC%1Gz<KEQ%$NyWFwL<0nzEO{MXqDPoJ6A1SmB7N
zrK$F-TEYc2pc#PA`M+g>M^+|Uk>5G<yR*vUu~J#m_WD6<a;k2nEU?+Xd{#RNk0YX<
zAp=B!Ym~U{*I%r4S(8Rnf*($P;#g86gYVXxpI;o=9pd>NO<`Mg*%u!6MG*$&vJvj5
z!I<;)Eh(%9LL|Jzv>>Q2YnPVUqy9jBxESPEm-IHt`tLKKH_jR}ZQRRx%j<YD<xrg~
zVl$+c{18J}GFE$`<HAHvu5uCD^}kG6mm0ngRK_EuP+~=)+G*<6z0n7;Kh3j|3tp<z
zPNj&aWqj}Ye_OJ~`R>q>#)&T2DBGHeJ%$m^q*iw7u!@=o&~Sw-)}L4hj~FKY;CjJ<
z<--mrIHz3P6d3%+2MOLNK{B@(TmsdVm3Ehe|F!B4@cnr8bYhzi;x>6jrI;JPyczu;
z78QT}TJkyen&?x;fphd;ITZa=+3FVvOS77FR-Bz&*B)x8eWLaO0o#D4FK*+KRH7cE
zQy?>37h+kC+Rg?6^@Dk{EA#a3phx*o;4$Pr`~2i;6W>HBO8Q`;Tv|hxNVG>6+m`PL
z5JKS%vSsc^p#>ay`iRecitEc<FdFGVJ({u@t>{wMjEmJqiORpJD$uukFit4U`}#}a
zSyn%7PzuL6FOEdV-xvLv=*h(&!A8@gz4}ag0+BDutUi`sJWon9&2}4ivi>)Q@h|-D
zXG!F5ux`M)gC~qS-}pBa)9E-7w2F_AZ$HqAd|=88F^ueVHH}kmd38xF%aj)mxekxZ
z%eW|=8LH7hT*>0xm+&bF^iY3!yWmvxRg5IyM>jKiFXf{RQg=~Gh{*wKy5oGJ7=v5o
ztGBYksbz}r@i;MfD0vTNw(k#1=&CNE-*3}^9sBkVk+%pya9V1bW57*}n=DA{&n07s
z^UDfCAiMG}d(LDU>^{bz-(kyhpX_7Bf33NH5#B=&zwJ81wed$$5vZ!n+&Vt_3r7M%
zF|9)cqbat4+<~-{-FaHe%5WUB#rgoS>%(!;Ea)Ocat|BJ&%_W`bHeF($sNkAIrCA0
zjoXm3ZbFdOw)T&C-dZLreX(t<`;Y~|&@j?*r;qCJPXR4qvr%VMve)c1X+x#V^xHte
z0nui^b?PaD3OR#+7{xJ|#QM4WmlMOg=SX1<hV8RGZ?C!YRSSyZaj-kyM7~goWKnfo
z*meD<7xk|jwZum50!f^Oy(hp@$P`e#+AF}fc)=l0B>~E1^W9*p-kp#!_F;6!hHX==
zXu{29!Fk1ec~XZO!ii4bRTwS(4kkz5(H<d_HDOn?z7&q&A&O<U-TxfHC&9d-9sb+9
zR+^Fr3sR*!1(-WL=T2IX`Y!bGtmNivgW!%O`KL@nM5{HPZ~gY~<FxoS_8Noz7R<aD
z!w<hqliR~zd85kID||ucLkeH2jvjpy1bdB~ua|rtKz$;T^sJ|Ts97#G$QxaoZhF2N
zk$M_Q#*cZlJ46i_q@X3>yyfY1@{Rmw5x%ScZHB#|-lfThib&~fmoqu9*Bl#wyXMys
zayaoVGwV>sc12i6kv~aBHG!#T>x6&6bhFf$HQ<t)hgXJTKGFt{vvs!@0?c)-|IZ<%
z=Xm{fTk3;B42e2IH7Vt`8Aj>0Kw52bU1mLlx%ap8vY(##A4o}iYXGIe8*}R}^R*%0
zC=FTea3SOayZb6NNENi%!MU40yfL*xW=E-4lU#4WgLv(mUCY1VF-Ur<vD=-9ibC%3
z(MY(v=TfDl^U0&p8h>YYxZ8*iN713vDL6PFZ-}sJ;j=aJQPOK4eqEGB(;#z02uHNw
zO%2e;zE@A$_4?-#oSn*iH-J}SBhbqAW&tx+9WjFQyt|Kake=+1!D5`c^lSjT!5xNk
zts%>l(kZj>e1X>G8Ko^?*(=rdBj;7Nu2*5kRMLZ@vDq90vgBn2PcY!#i*NAxnO_jK
z|E_Va_1*em{b%z>eY;x8WWd-inb%Rma`{u+SibTir^6c0`tQ<a0@@@xOxJCmpyLei
zoLPma8W-t0gkk-47Uh(r5tk}ALPA+bfeM*+ojup5>q@3gr14J(%l<|9F)B35X40!|
zEVoehCI8m$SWMfs_iy*XbMJ~iT8d6Z;DomV@KU54#Q@;aY2W^+Rh1zKm=_&Y_QHQt
zBArK(pRj-mEm7)%`(>=`33?|8kxMTOzt5vjHt7GySr8ZbwIJ?!^jWyv0H{O0!@MI+
z20pIfA@3s9hPyPN(_|9YxHplxQ1dBh@;!(z*}sp^xf-gq5aPoH=#|VP++=v)QYcBi
z>riWY2P3xVO@8%?UR5SZ*;gx4m<ijmpl&J=YhH_T%?7bI$oFAyUKn<ki93EpGxyt<
zSc>&Q6$8f-mD>Y)5*)PMOobcN3eK~wy{yWfMQH{2qC5YPp5NvHzHZCHGVqr^>nYi&
zw$;b%>#5f4XzkI^${%Gce+4Pd9NL(#W!P2Nofr(*6WG6ULoGx4)(q~4qgR_x+ZbkJ
zZigjMbK8mZ>TD>Y1aGD|r&a=gV`-lQI?$hfE1P+crE27NmTUs-v?NyB?gN@(s|FJo
z6o^N4wm#pl|0Xs$73tokNW6e^G1#wDt&^{lb(<BHayfn-G803hDiS=)wYka)r#P4}
zi4Y6$s)OuvY3px+O4-ul=i#L+VKYRbhOX+|)E2bnwNJ0i-lNBrxpsR-RO-NJY-$}A
zSTS*uuV}7#qA{|JS@|z%yiz&^vR*I914bIPWmBNbWRB*&<{>0h*7}Zt+P0)x>F4Di
zIO16}rGV7hn4%R8uO~2=vW11*<&5h$&e0n#G9hnMwLg;uG>}Y|8Y<Vbf=@7iAFf?f
z-&j-LEZ<hh8Hf{No41t4cA>LZI3x=l-<|<=gh2NdPtof5o#CAq!lzXh5#UXvi#(!C
ztkbr88FCI@cSrqB!ZdrLop0XXe#3pgF@YdsaEeVMIT>JVx*)<@|1iL{+}%rsf&Lpo
zN*0=?OXT_P{ky56AVJL#7_LnHB`F>=ZwFlq`9l5`rPh#(f8;0t16FKn2?s?{2nPeV
z5=;~kud@B~Y4i)M1?YM(RU0}qs(&lM(7rXY1859m46{ym{V10WlBI0p2WUXPRK1mv
z-Uw$_Dgd52yPAxaxv)E~ovn9PIy{>*yR|T|tK7aBpVcSydof=RFf2h(*4lB8@OQod
z!@?c=9fiut#$!9-iOI67cQF5o2Sdx_%=ZY4*U%A@2rl<AYmT6@<(U`9iyYW8QFpXU
z-lxYV1M$WrQH3vObS?bHrfAhc^?j4f?Qq<C=SSu(i&#vG&Ye22I*%`424ymb;$NK1
z#K*oJNO*u<x8l|7a6L^F+zv0g+i&e5wGN&sUF>pR{Wp=5yt1aP&w^Y=>oJ}-3#glj
zcfQg^i7@}>6>dDE!*%dG)STac!Qp?QS7V6-VTq~pW7@!^5DEmrlL?Kyue;AuO~PX~
z{N9tX%<Y0~4{FX-wmm_Z3z@@wi;NF<o44x#8WnwC^@!;!c@O=Ia*AFR1Uuu$sToIx
zs0!HHfPbRsdS@7A$ws?AZLE-mJdWC<fH&js@AFzsnuqIzdtVjyz#lX`9zszz?P(tH
zVMn^1de)^xJITJ7bfc@0tLHD4E;hS&btzuzg#TAE0noY$I2{}8%<GiQG~jMf*zJ2N
z&_b7F*dTuJYa@KJE42;?HxaO{26I8PBl|!?RlVc~%=TeMb&%_R&}H_T2mwAxm-qoH
zh2S)~i%xpPXH47U2v~A)lV;9$f6!57^-vt-I!iL6ac*ox@68R`haPj|kDS{!-?))}
ze8M346w4A*-+a=hT6%H@n3;y(sEF*W{TXfWMfHmJn>7Y)ad_(ob_RcI9wC9*rgj8;
z@vOJTD$BMRx*5oV)9JqKs(ANM9o?BK>J?NP0Tg_~5P+nsnKj*^Lw7wftsK(~u%=PA
zZM{}8i8pLm_L)R<d_iX?2Z~F5XX~<($Fxlw8%_7Ahe5)p4Kz!(Hw*Q~oB)Hd#_2c_
zU@5%1w3@GkCOp>-d_9IlZI5m)^sF=b_MK;Un^>f3t(q+Y%{Qrvo6ne#I~db!%%dY$
z(yV7&M*j}u)F?<&!bbp5@*Ab?G*9|Ql**sULaC@R?HO^Fwk*fya!C>AeY?WSTH_FW
z)?Up1V)962qWL!84G%B@8lFxHU`R4xv}rllTA$G`3*9mX#6U-(@nD%EW6J)SM=Swa
z+}4=Tr6YaM?deW}Bn1E2*1(E46+UG{JLGOJ=Qgs!i1i4#A96DO6ALnXk|vU@`?aT!
zPj}1TSHzu?2T?jF>4Wne7HwyPdh(kmN4x`SBhtYDliSHX$VxS%4>6;wIpvywg;%uf
z+qMp?kbJ3q55ms#K6d@!F<_^KNpexPy?Trvs&V!<EV2OH_7`4Z)KfR5J}Avfd|20`
z7wZx{_KM@wA8Uz347$}BvUuWsL<Fy*YK_^-)m?K|er9uRS}!4x@BE|w^R&<v=U3;J
zWqSC20oQmBr8gzESoJCzP)C(rDrjpy#v48DT%jW8tGnbzK4s%K#$#0d_Hpa+xrxdB
zH#r^c$$aM?##NkedQI@A!Oh5LU@`+o=reUT9f>`j%u}W=UT|5<M#tG<d0gks;w^@#
zH$Y;FoWH9Dw_jDPay+uZh%bCRo6%Zlzo7&HWm@6<roLN>Gzk1zM=IaxgyJX$<Pn<m
z$S6b$E}v`v;xYY)|Cc|Y-~YV>t)Wh#`VF9(ct|6+#ZtLAd}aPMAn<sW67kD6tV=V~
zRXXbZ1A}dkB@c@HuK8u=-dF+j&O(grva4P1jhXfXQ&Y&pSSC*2jLk2mxGgEXkAF&Y
zM%V3V%+m5kiyhO4OO4TZ>F{j>w)a_Bzc6o7(r(tN$mR;Bl5IGn1tS)*q~T3NFHptj
z!jemm9|3f==T!i&KD!@l4`#q=bk6Ef3R#0#|A$h?FzHh#zZ;-s8#s6@5n)M;38sRG
z4ADB(hkP~|g4-hU=ezHzAZNy$0l{ou9@*P;aDc7`96f#Ua)uU0_}gQ<=r-<RXza<>
z&!kJ7*Hx}2iU8-a0EetbgNnMkhlC-TFC<yz*0YpuG>{DFJzd!;FccG2_@t&8uLFnX
zZ^tTeD^&4s=MyEsOv0g%rNY=6vMbo&d7j}sVMs)uyV6cR%@)OYVW0D;D2bMCt@Tu}
zI6VPQ>~~bp)YWP^HPm5Qwp$j}@8YD8yY+W0Np*W`r=_R6f8msXRdkOt$}YpsWiBcQ
zz4!7=NXym4<$9WZTh#THYL;{Im64~Xc#D<%#8X;<B)%#F-JE-&#GIQ_Ij0HmX=^?0
zxss^<3+Os|Z)5nLc0kMhZ#IzC<US0aELx#I^R3&8LC*a`EOyZQ?WG~l1hTwL$c-A~
zGkmpqsi&6#s%}#*rez9msG`&tOoEp;JTr+fFexrn8qRx)O>?=oz>0K9t3I2W;XSsv
zbV0!wWaOb5H?{iplx}ou3olI&50|PkKIZibR_){Z#Er`>p3e8+7Lxkco6kr!j-ET2
z(GAUqd~AQHy4<wKZ7YwNmij?A4Sl@G-d5Dgy}t(r4tf6U*G#a#qsOL>ByF0ArJZ=Y
zPf_WIDu*GRiu45{PR*ojrH+rChl-ple>x$|MBPfnoR#z^syu4I1!#2MH<-uW;$+CC
z-)`vs5$t}-yb5h|&TJKKz8^_(rt;-vZC-le=Nobw4RN2k7Y;Sp+ByBMZA_7{BdJfq
zf$RdOJ79gfvG|_>W?u2)X?N#&a6l|W$M{%%yo}(G)`#V)srQ`aMM^3#crh;IxhRcX
zgm(|n8u*OKP8SeQg=QHHsaBHE0i!nswUxe<krIbIwNQR-pTqiuk1!4k&2sjaR7f~g
z<=*Jvl^Ik3MiR{o+I^r64UJ}JBGdra?m{oq@8%itkV@KYYmn-7@fThr(P*<k!p#`O
zfv;*`d3&42(Ymx&|7Ep)12lVGGuy#F<d;uPT!I9UM5*AqL3ce0^O6)1;*O;c&Kjei
zNcj{Wk~hz;&fiG|(ntp7Rz1i@m#tXeEi>_QwDj?-yU))#j|z&GP-v%C?yg#wx008I
zQxQ?}d{PQ)9a&h_ymOIh*`b;M(yiR0WrDxP82T+B2X)V$Xd96vbbauw2zC@LeoTEZ
z@lxJ#4~|%U8WKRfD7xia)B1R$ZxYIom_<wp-h;oF!8Q`9qY*F_8H!RZc}dk~R&=P?
ze&mjWB~)zQA~?V2PE4C^vou#}BL48`_iL+8-~OGpP;~(hi%YmxV(_XhhX}%8I)*5l
znEh>o8f5yXj;DZ_TqOS|i*KGY6+>04VJwM@ceoZVJ>MM9woNLB^+cmcA>+~(z0*sh
z0n1?c;F$q_9Yf4TkS&547R**Rr&6~6pz@G0x{CL>>A!mQiIYMk<mQ?bNz510zH@Q4
zpV@jN#97KIlM7}FJ0G4?a$I~(89#W6c=9y=MX_wG&q?F1A{5XpC)cGG5fvQSWB0f`
z+;3-aKEC8hfM*0S4bQNYuv#p#)loDa41`aTEnR!W7PGu0w&(fxoVPtSB<V-Brks%p
zRvZ<kL1Xg((*a^L`iiZlSH}~^Rs|8`Dk2M<3(m*!VB|Fe#CtGwr}137OveV#P9y6v
zTqq&t(?Dv?mx(BB#Z26>{Lo1i)(E}?D~m5v%!AQ9-|q&~oxTNgLt?G%hMrN?qPd7g
zRShFINr_8T)MYWf7%mO_rL<G3eWHjJx@qEQZR_MFjeml{l?-LAUkcmLbPLebvaWow
zv(-RFh4^_sKI40Pk6}j<K_IE$6OE|K2!J~-SeHL7ddSakgB8KjoxyK>AF6Cvk>2R5
zpPj3Hqa6W9k=eGG!-$z!rspQB?zq;A=*#||tQ?O^%(LT<xrp|XLa1gZ8CKpe%K*9Q
zGzV#u6bGG#XES&sstl1>{LMo?o+9dPA?vb~ji8d+8!x|7EJ6c^^@h)P9a}x%o)Xkg
z%~@Kd39BaEb2hd=!?u>@_$2SqcaP0IduGD$%GG9m7=wkXn-W@~^9x^EW{ur74<yp1
zABHg6Y#jgeCGB=xVNE#SIf>V}u<*9-Nu(q)c2Sw*v-9^GQ}(%mJzh<YPDp;Lt*^}f
z8mBpAqsztj;-o6e@pN6U=M{KPD~ziI$wD8eu4LnWye~1DB{mb>bWGD|UH+KCsfiy5
zO$%rzNYrtfzq=iN@kTQK5hMG_!{e8q>}DW~fP<=2QEws;E)jM`G*5@XqH)E>WB*-?
zzgJ7hD#7#A%+ddh&=ZyU!#36*l#6XFIF)#qSt&?jdu5hB&cPL#qa+M_<$K4X!m3sC
z&Sy+0FXJna_wG&NgclBxbiSH3P5}NSDSbNS^}KjGwp|{tHSV4DOQKw~9#a&^0<Zi?
zGGnh`w4~2Ls=+r9QH*dLD5y3?d>7TS81)8a<o4M~1aS$82p|<>R7)26E7Ck{Hg|*-
z=O;Ay_#{CNf-p1KeXoePi0^wgruB`_uoh~@QOI~b93D{EyP_@HG7lcAc_n=~73_R?
z6I)TZwD{RbL3U8f2a7@*n|AQy<Y#(Hp<a=15cqt}Krlps3i7aiRY3?(=}e69R<Wxd
z9w|KH`1?5w;}E|&=)U@1-%Y5`jUj$zSbVmRE?tC3eX#Oi1;>N)nEt?uYRBRfQy)DP
zTYRxhRj;&W;(SCEeZE!#I6ZTTI3QX9reg5*_HVE%BFvjaQDkcqiq3jgTl0!F>InVe
za`_embu_YM{IsI#T(u`*fTg@j#*3N+>^yWnT>;=dQ{?K2yP*xI=eUaO8oGtT9%nIK
za(<-OgB+mM%TZyLMYi)lwIT>+P)|xkWR#>sq<sQ}`Cu9Koe!6gQd+0#ZQRw}5n?1!
zS^x#Jk9CR+)7LuV)b6H7VDT@pw)zczHmvLa0Q$7RRTsn5_O`^cA~o?b2TCT@eyVF_
z^hqSf!T+wJwQ)n#aT8;fUVBC7P8Gkuwp;$(d-h<JqlJX+Z3aK<oar-@`XlerqPxuF
zDhu3|Niwo?JQWe_`Us-9)0h6-VkiGZA1$OtJ3;2X%!v<v;whj$r$@~W&PVxemB1Sg
zQgO|w8WT@ym{S(tX&h*cX|tfAhK7DJpBVb}8MONZ6Pg!N98J&xJJf<EkWo27vz%fo
zTtolJKEvsKU>4<7@xu;DTV|9nyWq*@>`^emEGeL(mW`saZ&KEa?D!TfQggf&hlqhY
zDnU0X{~Tn$Ev>lazzXw5ic(blP+;gbn^B+p%A_6d)`gseioKUIynSgm=4{0~XA*C#
zmRlZvg<yhLkAgmn3<b54;kZ_Mnc;xTTW<y`rnQ7~Ax6E?RK}hPu<dgbP)WnQ#j1a2
zG8RaQilg;tqMbS8UvHK&w)lII(<Ppc=#4s&!;<?}`s`&KP*J-JzC*ayO{$Ny509fi
z2484952gx>tS8>-!yPqy#Oxi7WIhIv4tnEuW7CyKE+QgGuO%3sEz+C`Z+vOb(6rjb
zqXwdg-JDOjZI0ZXG=9>nTw6RNPiS74YAe$HT;d~UF@Mxe^GVYiTeRPIt#oM~o)f(B
z@L5-vQcICe{X(3pOI+(tjJ&>6hr3LtoAi2ip!c)&&Ec#Y&fQr*Ii*(}9F~?_ngP2#
zCDN{dvn=62MomXWE~OUgOuFE~jH|Mn;C`=ae!-f%z*20tdDqh#6ken^Sm15=+W`38
z=DC&TEg-r{%{KDthnmDu*%Khd1O(7}fq(IFL8D%4AZ?><auxAQ#^ic>79-OauKVG1
z#p`nE6}<JA<mH|IW?sVuaNLhlx+lU*I$b?0b&tSu)ECJ!2@msoilV7r2fH1NQxzq3
zTkwn~HgkaK2WSp$vE8p+@)KmAQ+h|p&2}V`Cv^o=Ibp@0e-3=R{l(xv1Ami~k#h~R
zg{!KPoZHls8tEUozKyeax|2~|DI_p3?lyf=L*zzfDtWr*XK+`#YQ4PBU@UO5`gSo(
zPLdW8l|7#S<n^YcZvPK!^%@goZ8CGlU)`^RVAmvkJv0ZVSMp2Sta4Wx`NkHoLg%q^
zZpZ#^662$mH#74tslim9Ri%7_J{f19lggZ;=~mDSsQ9##OkF;m-L!iNrr+KN3h}sP
zN4~|MdAiv|`+OH~=3p(9=J~GY;K0+(PD8OM37hkr?-A=}1rKJUAOT_)%MFBurng!?
z5M1;@6`w;Agd5+GDnd$I{rX2mc!Ndq2Z7Lr7yOgZTWm6?on`K6P5GS9B^$BZ-1#n>
zss#e4xnAUxDV8{|<XG{wmvOq{yfrtAXQ;+tpPKbypkA9NS?2Tcu(_62wZ<cNot(-C
zunB14(?#O8i7V@DDar}KCEvm5qwfBF#;ILQoyx$XW)R*{c)Qttrq_Yh#Ody*w)U{u
zffQR@>|^Whf@n7wnQp6h@pwZ^JI>_D!=w5srOj3A?rzqM!mg81En=s?ys|v;vbFL4
zfLxU0?@UlW?xzSktKOUQB)FmeqNJ)2SZc8#uK2l2R@K&5#UOqA)`VzPdjc%qfKZT)
zz?hho<ks34RYy%VY9bHVGTt($W?eQ#Y@o*ELVEGN$ijK|UV&13PmgI{Bzadh72R{&
zyX;K$0)q%+92GNT?(_tFwS=lKg%nguzb<kk#-B|_ao|nT3-I9hgoIm}#&63~b+B7N
zaf0veK6rv7<HUyym<Nd<X=pB?f3O73zy4y2bs+k&Y#O-)AACRUT};V7`#Iv|1_5+G
znrNWA?1<j-#1H!92KKe8IhEHi&+k~lf6bj`B=k$$e9@1PwwC^Jd}Qs!BIwjJ98%TT
zK49M7xutQsbaTHwh%!2TnbXROwP7R5m0TGKJCChw#nb1Ts^(U?mV$Xz>e*TxhInbs
zXp?K4uDpgN0P|vwhgLbR=lEbNv$*~#-Xw7+AKvx!`u=C%H>CX&9)e1f5m&{l5n!^w
zFw|o@!8J}d&gE=~_o$J0n*$k00w;uqJ2FO%45(7I)!?bp*7#idR5oXqtDjJ#Dw@Zp
zvT_j`D+h2ht|##T&XPj5U1sV^UwCA6JJ`>yEM5}%ZCASBq?2f*Kds!;P&pV#xae)~
z#|g4!9AiTc!%94i`YvKQ^7j<kF@Cg`vkqs!&QD0KZ`Ue&DKS;MTSIOCbG5*SR)z0B
zK%etC7wDSkQyF3THN!eeFnTZGpah?gWggs1N|Yy80^8PdTx;*=rIYv<D#KVTOijCT
zjNw9)vu{5nR20eMA4aHUB2CIjFy=^IZG#P7=F9hI@);uk83w)ZxHAn?OaUvMJ0Z4a
z;Y#6r9FRBv&ZYmF{45{vlg<&#w45?Ss!jJ>KHA^OX7W!2sbAt%ugCe_Z2(+;DF|la
z4Tj1?66VO8Szs*N3P0b68s|#HMf@ViwPBtd@r#v0`@zGf-Ek>~tl#4ZyyiMewp}zR
zj{~Y1=j5p(+ao*ClK<nz|N9~Q{yY}*GxrBX!B`q1ZI&QDRQn^Hy`>0OpO~6Po0eUS
zd`gh$o?+{AiIjfEW(=<iUjHKVU~-LV4BcpS$Wp??z<Tw+ul&#d$A>BUG5F6Fd0-0h
zNbS`u=BzG$0K*vV&jIYu)+r02u}SBePTd8W{&%R&#BozP16xOh4_r0>-}%W0|A(@-
zfQqu;+Qt=8L6H<m8I_jq5ExWK1O-Goh7jrQnh^nMQ0W{M38|qQM(OTGa_DZR`H#<Y
z&UxSSt#kOk|5_~8z+&CQ+`oPAy{~IudvBU`-NtkKVxLt@qGK@}jj=YmU^Qa3`>QW+
z6=~Uzj{#;S!TPBT-|PA-4obxPQTZmsCa98tU}~agmj05WFD*oc+If_Cbq?2dik3M)
zT=-t8?1K^bu;QsSG$(3EFGYm$q19$Z0du5-lCq<u>2zkG>u%PUW15e|Mt{~p+vo~U
zZxGf&GibrPZ3TMNK|LtA##`ZwHz<<_p7OD3+~#D!iS&z2fU;M<!MhJ#6DA{r6m<Kk
z9csPR0^JUDh#b<C)4bJyJBL~7l-whsD*5cO<Y;$ytN+_NX#PK!|HnFLN#cp7JczLJ
z@oP1-ong_wc0_5a%Ui*nc=qmmwG8kWw_C|MOy_!sx$ub#2g~&(R};>dOFX&gjTUJ6
zVP!hpcP5s;>%uL~C!}B0pT~ah9kMzZI7O)#CV=znD#q5w-?}fiUs5Z0zp>USzznFQ
z`6%o_QhylTHkxz2O(;{&f4?tQuP7?(?o*@o!{lSCST`P2R{e!1(@k38#4wak*auxv
zeLNroKh`e}^z7IE@YJ!^nTOUWXkU?QJi=u9huir5UlQWl3MMa};gOVv=0Z)a_vPf$
zH(HbrEQD5e)WGf2|DsU-!;3HR@@73G8!5wbQfG=d5yJVvz7+}UqVo&6NVeYJ4hG+P
z5H?Nqw)FCWDH)iVEgr<HL;S|yI%%=v;erg%f#g@KPNx5GgeqtRh0~~g)^ow#8|3}-
z*wf#>RX%Y%@EL2JSBqyXxXV<dN9J+|(R*)t?1P{xlhrg^|Bc%Lmwt-g0r*!wO!j1O
zxgAFzPpcKT>ki(#&)X}P_Me`@zg>&yV|fGiH8~ihUFvy~WwC*&;V6hFDZ^{9Q_<XZ
zBE|EBDp@$(wIwMytfmm34Lma=vluJx`VsBYegCn()%4iJ6jmts!c%!p>aGLXcEFV<
z0~+t}C2svlCI*Qu$fxnAdUjKLQdx^}P$&t@lEmPDhsu%Gx4wcdz3K>kigI(&TXNlg
z=_1<n13M>7WH0_#y#C+L@?Wn5m58SS4<|n3=`Bw4@%o(t0ST&oC%T(m?k@SN@hed(
zKNSbFdq3TTSJ*Ly>8a&>mmcYq<Q-5>c`CK83q}noV`a{XnX?v01mV?D&kC_^#Q)*c
zfByB$FP8&PL%S=#1FJ%}#c<^xL3R9nwfN~>9lpWg&TgY%qr24h?7Po{vtwMo6184g
zebf4ju0@vz%#OUF!Ezl`bS(!YCB|ti&o4jGqh5bVGjYM;n-XOcPwSFoxvkb&%HrbM
z^7Wk7p^CT!sV|MsA!AsNx0ziL-?*>1-<N!*mmshDpqsua8GBVJ{2*bmMRIzb(}_jd
z!n#AZ^k7IYu&<+SHx*?waHLh8^52aiS>BjvhbK6j=Xq9PF2t7e>XJ%Jx*nR-ZA7L^
z{qAghP}ydw-jD&em!4uIYjZ)c`Pf0WTD^iHHvXLm-HWvLg<PTZ4c*^*YL-}!g}B%@
zWsf!oDfk)XwX6#)<ckVXTs)ourXtOY=JCys^0a~37EoK;C`|H6Q?XHeIPASoMbB=e
z!Vt+V<bldp?-sLKGLPb9aUgUiya+b`tS-a=N}cy3QGRlfiM%DP_zrCUGW^g_@x1U8
zAcHmzJfmZG9zmIwwwc<{I)(klM(&mavWO=!rFOE(D)dezwxCzfC~F`7&;>$;hf{cj
zxAYOBrv3jJDG9;yUtfc_19eV1gbDGdGWSH?rqqZT&5d&B0tR%gcfN?5xOBqJwG&Uu
zHl!oOcDni1iQ0))HSU-CQgL^y!a`9JNXnppkB{|%cG`c4ng2)x<ew7lP$X=<#L>LC
zeXFA5c!1t8mAkf+wJ$+hsnML;VC>@~Zh8LE;da|ue|7<ixU3AlbPtUI-8&t&mdutM
zxn08COSZfo-HI9&VsXH_>`ACk4~fR)f3^3Y#EewdkUS$1G^@0w(<ZcURT;FBM_=IM
z#!6`pd;Nz0#--$7Gw$xg>{#KzN>}gvQ(+6yTD`)s+6pu3U@`9LO13n;D@%{T=-iml
zdmZKxk+9W-H7jNWt;8LNfQ-M8!$j^n>Tjb|BPId_91kgUF5Uj0oBH?N9sDGZxnX9L
zl%DNW#-)R1tz+G>eJYSZ&dsOA_|TU_iFf)tL^x4$7__0qzfsy98@nX*!L>MTNw*g!
zzG7umX7FAxgSeAsvG6-%5JjApM)cR>NKGaS?U=SVNRmr*J(8Ohs_WV*rLBW)?dB1j
zKaY8uT21?L4VJ`t=%x(tq)`CmbLQ9oaxg#7MFUT1o7W@geOa6NQs3~G46D~4YgN1m
zud$7Mp|TbaR>_dtY;8GoQN+;zrbRQcQER5@#}j&mtqF1w0y#1jx>1)DwbDL+eD^db
zlJ#D55jKT5$K`pR%1CbbLk=sf*d0JymT_~*;mG(auoJ`OR~MN`9I?SLz@oQ!9a{S`
zf5U?vn97TO=pw~>E$fGl+EM}I@)wcIl5CU1{4R+?$3uyLLw515c$qs|DPaBxxptfP
z5nny~k)C1@GP8d%E&oEd|MMa+heS;cS6+XjTcIPWO}<g6&FHMnE`7gysZ-(2=s{Mj
z=O%OET=t7!M=tS}j88K>%`YdEVI}PbZgu;ByN$a5q5o5-_z&jyg_~%YkCPTxo`{dg
z%-_nZv*v#&L2MEw5+r!-Ia$t&Uls29O9ZIIO>R*tb4@Dcd%Wk;KBaWKb7vBGMXP?=
zT-U%-4Zh^Os*$dzRw{Y%dod7M$I#cYN16>W32l5dxTnfwkVC$?o{6;k#ACIzENxZD
z0hp%e8KG~F3vxN`QAb&5F~S;r$WS6Ch%iGTMmLLh{FKUfiGPYFi_m=hQW!bPw$CoU
zQ%hk{Ly20$l}Z`kbI{AI|0~{$C*y7Zm&^E<@A!wAiw3GFok!`$Z^5j~tbf$v4YDum
zYJbZj23>om-_8kiP0%MQ@n=76zi)Gsq(4F>rAzQ}cvA)UHK}D)xPqy|vJy(H_$e6p
znt!<b0!J^Z`Xv#suM3HKJf@7z90sP1fl_Yz+G;{99lIzE+*<UBisCKV5$1=H7KICW
zz4YBkSB}i~g@QWQ)|}_S6&c{nGt=(a$pXC!p4`I)T^?Z51-|z(jdh58IXX+UCvy}i
zmSljo$^-y6hhNvuHKZ$OGg=xXM7}Q!BwM&gAIf|7weU?;oWKDaksUJ*DdMv<tbX@b
zbutio1?+>@E9xzE{A2zc7nwgN$unqS0kAz;HXHJ}d<t8;u9{NXt6JyCTcxjQIu^n$
zU)s-gvhs`4H6=aR6zvN9Y|+}Xte)aRPvjy5ViAyP6NpeXKGJRY4I~U&A~8Ffx*#1O
zCF0wN6=K25euYq1f5lH_g22O|A*1a2P3E*FvgC&ck)!sXg_56M;rb^kOVn;EYoPd*
z=#owaz8WUJ^f9RHP|Hf@y5-ox;!lIFdGTh@i@$S?|M>k&y1dnK$J{tD8zxL4szcgp
z6xqFzU+}Or<TACZ2Nlv;W6fxrlS@T3(HGom%a|LU7wg$A%uz(Y+<C<Mz>6L3inRal
z=4VPIM(RIQb-qmif5K}9XuHrY-W$!-)>NjJB$btFJFT5P$cME{BLk29gN>t9Y<VqR
zPhaEdr!UN6PDqan<{;t|GDpIf(W&_G;)ghGH$}G<4cR+0#8a<3n*{ZmdHcv-8Cy+X
zt2kRJ@TKxzX*s2OPI52dU~y0~dZ?8iMqjGe1+A|B45h!=&=Tc&2(jTUAyO?XTUhp6
z=cWG`DR$+pVz^to_|C@fT6b;i`(br?YUk2JW#Sy;F6&$nk$|Nd?qNYAFED^_&B<`(
z1>*(Q^^SCubFj&h*kF|{3({V@iY}-yI@Z-UDW>*w`MBP#|Ba6>mfM+s?)evoBWs%2
zja*~!G3f(Kv|xDa^3Y>w%x<r`+{Kq?CtN<*{l!N7un<G&!Zh89`f6BagbKu=fVSzm
zkd8<{Sx!cof_}n}5ty_k`RV!CA8?-|*WZeeH|pPNr7~T44GciK=`<xC={jMkST9DJ
za+i-)Ha^8mp$qX-azLAcVRh}KD#qFAsF>gM?`*UMam=U?M3yJftDIYAx=p3Y)5l*V
z+ebnvnov{)2`&{DVLf^*adJy8j_eTki!)29KcLfK43M31nut$XOOopm8|<&`cJAb(
zbIg8kN7+QuW-z4s$fIAH4cVR((OE#+1pt_<^0p^QwswSy1R%M<yg3aST?2X--oJQi
zE_;UivRc!eYXn?NIG<zf3hmYBpaj~hX2u`i55gW3Yd&h`6~D(4^(!_gm{9tTco#*n
zBaGF%n!c8M>wfZNcbvL`%Z8ma9Pp6N=AyetAOZ-GBj}siX)0d-GvF2hsasT9T%n7+
z-*2AIpin<e`PK%Zme#5t_>JOHa{E#cOy}wdKWmIRbx@hP?Qll_o@{W)l+^{ehJ)l;
z!Se65lL1NPjj~?toA!}tyOpvda>m+cYCF;+#d1Vi9GZ^E&y-Y2WANiOxhS*3X)&ov
zp_fu@Tw7}OXz4WIhms4zK(ah{VE<-pV-e)eQP#w_Hdk5NxP^ji%+@1{BQFUI8&OgF
z@~>w(*MAK`F@v0DNqU=FMw>`yE(kxls!_}=cTBrP!n~o<yS@va|G_YM%+r;>G7^(9
z;7wFE%#{$<p3A22zw`(%OBW)oA*qX(a$QXFbhttl*%klVijg671;ypYMWCw$faoyj
z8uXoos6XTCSt3<<0{kC|@P7g^qW1>z8npz#eEP952Xg07bs}480yHz5f7O6dKPB>G
z!PECet;XRcqeA?z-+BK`kCH^1BW>GY#GuRFh=qbNLeiJJ`u%3-)pcK#jV^fU|Hc9k
z5>oemqiO<FD$}Fgx`ivxg9~4;(A|Kg!uxwg^fg5--|-V)CnbOx6$OSCx;XexE}<r2
ze|lvm+;ShnnrsL8P+X3Yrvz0qX)FTV@d0mM=-l#DzXXJoxGUPk6NEH7-{oa&l4(@W
z-#DgnqJCthxoYUh-r+IeSs^d5c2V$7&?uB{inmF!j)YP>uYR)`p~s4T5Wz(-MgE9_
zllvc*BJ+xC_}0!?noTP%un<ud)6c^|gqTVwfeBPk7~<d2cF-o`izca8<b1#UOCwW?
zjVLRahucDkJ%=B3qEfr6W)yYMnpLC&t_s&sJLKj-s2=%IEI#YJ$VC2TIbIuB!q%Z;
zhgs$3!%j1{J0L1^H!b71B*`>Te5+aiv0W7PWwj+fhj?1`I8!pj53O;%X+abZQ0U+*
zze~*&)+Ou$l=+i5^}%31UM~mot>Cl*&&`(@`4q?wC11%EAjAfnL&h(1SF<yO1KFk@
zerPq3J$|uNWNssjRQau)l1$QYa>%3HgKD%?_-=baPHg?`3+}7y><`Gd@Na>q$#@0}
zRS|YNpYOG=I`VYYo)j>;a$fBWF__jXN`o!0n7LNaM3$3pqPmy<@LaviqWT<)M$y?X
zYe^!i-X1Df-^Pd#a-AC&xI1~)KWNZS38Ij@{Q^hGb=C`*X)T6psh$xDe&g-G^hM2Y
zR{+HKwVm#A@)b~j#bWOF)>nqSIo_?y8ud#yG8VUKfJ<hUsDlyY@;}Se|0nSJJ1^Bx
zBG{g@2-?DF3tF@aGZJ62b2KUpeyyM#Y?{)|81ybuFA|`XQP!&0ZyQ&`J3pCl_%YU-
zIxPX@&>JG`681~z9!v6}+xTODG($%%v^py6HU|}xxcwxXu$KDBzb9Cx$Lm8M{+Sn_
zyZzxn*3hi=tY1{V8Gd{G9P&LwIKVn>{d@8>SC*!2Ag>2HPvlxp2UVIU`Jr3R3q;p|
zH+lH4c%im2?0#E(=xKz??;_DwqRaH(*%-fEQhV<*DwZismsgr@Gx8>x?Zd$90}VBl
z9j{!4*)pe`#gX_SO%O7jAccyuAjADKRFXFvE-kg_cqtusqV{i@nW-?lp!fbl*Kv2i
z)Zce4j`Z@eGFbpsz$=eqWwko)Z-Pqj<Ciw^KUl%PlEleTU#zGNr8%rnZ3Kh~I4n>X
z${T?h`GA+6M`|1O)5ay|U*iY~>L*^fC#h6V^olT#82eG6G(6#EUHpdC=k6fD&i`L%
zMjBz6-}uj20B!5}!}<lH3;EC8pTxI)3h&HAC<Aszr8IJFwD$d(EmPVxax?Vgvw4C2
zT$_Zw(M>!kg!2W~_l{IlQNC{F`!~oqA?MZdxT{Uqr?~RrUZl%g%69op>bJCNs@d$j
zwh02@2tuD+?BkdI-z#X8XPybZY&wpMe7Zxx#tGRY5iKcK=FRbwZ!UPU1Oq=1e~<iT
zSVpg7kmdf2?;|_qAA~lnl%4I$@v_)$Nm=bLe1`7)C5c|i#g=kM>(0r1z%syGT8rqT
zYlY<L!m`MTOc{GqNS|rEC38qs;LQoHAVkc?C(F>Yj#bf2ao&O14J<g%h)M0=Ycl_$
z8UK1=o%-`n=Eu{0qI+yoF=_-U8h%&saOl&`Hu`&(3{Y&R_FK}QhY6FaWDfa-$rVBj
z99%<5;%)ar{Wp?GqQZW2!P`AL_d>fBeJ}9!fp1Aihk;w0u|j$1uz4-CRXLi+?Xf!F
zCajl_;fbB2r0SQ1vcfk;YG9WrTIK|XrwpL}))9JtZQYp3*BiO%YgSC8YA7l{+DOlp
z*DP4um5z&f#v)2<9Z3A!sW^1*>MPar-Xnyvaq7c~w4}Ja=UHk6u9_dkK3--fMtoe6
zi%*DhIb_dNFpbUvKseNm&_7s_caGNFehLf#3KFEo`v?ry&x?+7o%r%boX1HAeR=M&
zx~q5^kS>5*B+*A@BDzhS=SE?j;8m`1hU_L8`X~Hxag=JHU1irO?_?~u2>H`{{Hr|(
z_FSZ*%MUwzL=uJ*=)`c}{$h6f3p-Azy#>yBtiB{Z3Y<CWQAhKn7P#wXSd1iH)?x>L
zN_`=G&CU9f<+POGXRga0?PcA%iD&mGg=0jTVV8!Km<e$eycxCjrBGUqS&s)bql7H@
zFD%esDM>uddK7+g2AzAXy&Bm5FfiFpQ_9#wo4ra<{z)-E5rBL%JrYOE9^U?HAXe`M
zLX_%c=%s%9ciJFkAF#r5@v<&C^xvG!{{aHOa0CiWpF%Tk6JUXnDrCnwL-Da55g$<@
z+1IMX9~tyM3?O!0f3#FsY)Pb$N_4hbe`Yt}>Ba1aTp)N1Gq9R!Wx^p38UYSzXTxoa
zt&5rSJIvGWrQMjKyQZ3)o$@$;OKs-eX_LRU01?c8Qtk=q<?q6B%#680sq_e1);m0?
zqf?zj8bWdPKSz+i9C{zMwIW1ef)K3Yu-1jW47U<QJf;a8oOl+i1hb&SfV|Y1rUshy
z84<q@KI~@&55vx}>OywZ50GVL(n>CD1?y1Ipki^Mqd*f+S4YYBq`x^Hkeo1rBqT=S
zANKTUn+uRr8%wEHtSkv#?Qb(At#Dv*SQ5fj^u)?N{;me#_>?Roy*@IOf$Fll@bYzk
zF8{HZJL8o!2ZGWF^9|p{JftPG0duHq*5z)uZBO}Cp_Ry0AnbwG&h7n$ha22wj_exk
zNbzP4>+#8uBq~hb%%y<zcTc$DHywcHY!^D%QO<XA+_ImAm7!z6nKe!aZS;@LVVx|)
zw4qN-R|Jc0<Um>B&i<n><-05HZ+A=F(Mn^v-QkVi|0Mx5uN02)By(Ztu^3jC=`UK2
z-Mzr!T&Cgr18Wru&{-8DbHl(R?66hswP`6`2J+gK=Azfmx0>m`>hbv6<o4@_63<V*
zrt%THk3u}P4{t+K6T}M6ITV1l*tYm;5yEJo3-8}6q7Xvu(ds#7`8VCk0O5R^BC5KL
zHVVqV-7CELiV`grcF$Hhx$RnOkPy=4qXxKCkLu&WSK|+Wf_F#Qiu=SghCYWXJp2JK
z*3O=;Jm9<F?#Y+`#e-^y_L__URS&biuA=P<J?$6Fg<ACqG@`XGQ!}qax=oxUkH+!k
zOCx&z`(yd0)0VB8YUUa`YA@<WP>rD_f*5<ES#{H&?=G8lbE8UQfX7;DR5_`(`Mc_$
z71Le2F9)Wd6ly{mUE*G0M6X=;+;aDem=YZ!Bg3Ir1Wsn99j<R>5&Ld}H-Gf3$l*Yh
zcpN5_u!=LsPyoi+1TSntg79+7^Y4`A<CJhdg(}%H+(tBzj^pEbfw=Coo+HtJ2A{kK
z_liEdK_`F+=IkC}UA~gObM7_ihlyT;c`qyfKs^$*6ouMF)h7x@I_JYsjNpe-+ll4T
zcF7e29VxQ2xn+;1Z$5>;G|fcaAvqG*uOv^Z9c%_sw7ku%d|J;`r?jwkF7d#AKkJ3o
zN3n7I%gOUEtaW!vey#IW&B@u<w-kFc5>#AwC!gL8<Ln7=%Xa6j$3~d_g7Lkg8hjM@
z8Db#NbeKrUhCYh=BRwC5rhMr8ouZK-B-^%K0XJc8l0K73kO?RiByd35O+d69UlsCI
zqwrW;Q|X&zFq%Pn8SiTkHEU0it~eX};CrTpFE8nJoxgF^`v~ISA`c(u#E<ogW6~G%
z5HCp~GArAH9qFJ9Bu(BYA*<25FgjJ<N_$B(QcH_t_p1Z=u$*56c7`i*k$NG~hf1hz
zW>_<tt~md`oeWX8HCEP#cs0yTbnDx15jJ8rNAi!a%sXrqp5cCO*@{&4`vOV)cKkF%
ziuo|ThY2gqqCp%P6Z?q*gIE4RQZGQ#<gHGW@k5`+!>>t~o(!0Sj}2CTr9b5OrF%<q
zFefs{nC@{(<Y2N4eb@0lNwgaP&9+Ug8W5p+7eKx;&}J6iQ(AxWS4lH2_EuB@Cj}7Q
zDmd#tqRa1_sBd-iI`(v3a4{~H$ALfjXX`yd>-`1i!LJ<zDKm(tu%dg@EV9UpBsZ$z
z9&baZx$(<^&6%mJyf#^&5E+$kNP<oV{SOX<m_7W0vRVCIuUkB@y0<Ixh4$@taOfqo
zQ>j(^_DXK3vFEuZ(!d{)Z~bVm&MIjyX*bi(C8lrm2pTdrt|t*Cxv=kyRj~?TuwowX
z-6xkbZUpFpwq_Qmax+ODIhMP4<0^HfTlb<rq-%P?P1HpCL<yIMQ|lE;36XsY_ymJk
zn1A1NjZrZxZkxa;x$Slj_=9Q)&EE(|f}B2SXZXx>vP8exU2N{nmfE0FLytLs_4s46
zoT)@EHy7wXqpLiCAQRD$!X3z{tV5|Ris8>eA&$jx9qa0V@%mRUf?U{0l=R;hDHyyb
zIJ&#XUF*u12!N1QOVDOS4~-;~M6lghBPu)PZddOZE$#KjR@@3%EsT7*W@7a2cJAA>
zN#ac3rBdes;4Yb=L%kbv<N&U^Q9ZYtyI2-EaPu6uhoSM4?zbWe|EU6z;qVuAG<pcD
z?e}U{hcxLT+xTZZ!u#n!{wy)l*q{7u)|UGvDORNQ+fC}owOOwU;lcro91`Z&Y?GTl
zcqk(=X<fd*A9NNXVFD>yDW&m~2c_EK%LSL-wKVVVc;4s$_<8p{tMdi+GXY;TpTPtS
z`t#~d1Zvb{u{$u1=@tIQZHX)2*x+%Px)(Rx_?qS<Qr*0;z3Q81i>S5qA%|)c*16fl
z&cJ`wQP5<8r|Kdvt)Y}?)>KyIrs0z3kf?ysAwHq@WlQuiuh>SxF(OnmQK=xL6#3O}
z6;(+uA)f1hj7aMEs?Ny0Vh(Ufc=LlAzTC|3KsHP)c6qv%GD?m;F;BIg<AuKby490W
zsW8Id#@<Aj$BV!PA9KYZm=x^E84yQx(*c=eBvCRu>Wkk;1}G+sJXEG9Jipd39w99#
zRCVR%u{S^51=lGj+wJ<agaW{n#SPod&O2jC*-d*zaLr_&ME#bOTwLvwaLMc2XOV&g
z`SC-C+mixbBYai2?23<O1-&~z?)PfNh616^?%tRpiMV+s;GA$Fd@&~wX95jCcRBY`
zU1xvn8%>x94LWb9UPQzKU-D4H!+=Cq_!afVDnrM-2=%M;ZHamh{SQ!Ui-v@?yK_F6
zzWw^A6eRv+hcolD_X3X3wm;<tZxz?dL|axa?fUHkYT6GF9ieXL=p^TsO5N-x1YSni
z$Y&#D@zMOeV6W_+|6+It3uy<7k29e)phfWf{mqcOkkiPL`Anc{lmC<j4A*i+ldFC!
z#&Gyyr>_gom9pm7TIzRWFe9DL>yI%yI&-Db*Lm)qq2SQBnGS8fh3hK@68M9CLBZmR
zfOWjz$QduiU>>Lmh+O1YEO6_KYf`qIaht!=(s<s$^ZPE$C1Gs*`TW2Jq9dQs;#BEQ
zA%kCk+T{Vmk>5D4IU0|kl=k}lmf+{BL6d&58PsW1*IB6e>(?7f`c4U}E9Sh;_BVM1
zcoh4NFy}rnTMV_%kc;|Zsm(6*6GTc#=2$*WqiwSby3^#P=U&RbB#ZQvJl`HEFlTXV
z1~mg95C!^^;hTXFJ+C>-fj=!I!B$Y8eAfZ(TVV;pZ@0hJY_VWItiUT@t<&jJyMi)Z
zmrBhD{*D5Un<ceT4f?cZk~wF(XcanEF|&7kB*=^ZEqF$A?)=7E8qeFg8u@Kz_tV(6
zOXUI+49@uS(FXE4q_MQutXlGIZB1J{VcZ&ZKW58j5p4%kyFbN(u&Up=dncw>E*$t&
z*9cwhZS)bH+6e9|8mis4O7KfT@ii?An;~9Qlh06`Yu@M>Scw&%d!Y7c)_udz+4W6_
z$5HvzX22^uusuWBM&eA!*aX%yS-KecCS>aeC+_Q}hgDFtxH`su9=sKO;CF^88R3WL
zNlnOr8}~w11IAY9KHRb}Le6{7j%gG5PT}I$^0dLnpRTv$7r-*=kgq$)fitYUO|8O<
z<pXk&PTR9A{nEH)q=8h^6*wYBPIS9={@2~z4jE;J0xaeX(N}$|ey2j4{*kAeB~n0{
znVO~MJkz-+dLl<$?g@n8s6Paqp2L3*I8B``2v`~42BRV~;s8OloZdT9JIja>J857K
zq9gWZ55#Sy<VbzGYUT%9u_jlO$!L8CeK#kCsiYOw$B*DjmbT9N62k0Lj?-B21lhG&
z<Y@br<AKRzcV2_3v+B96He0(wn)&!y?%B`=6Xt^%+{oT9-?J3gvR4pqf03m5AA}tW
zdh#Fr_hyF@P~+$fgHvD4)9L*50>YY^zS=}w(U(%`BxBvFv*3ehbV5+M$)1l$)*TRP
z^~?*8etqiq(qb#a??{f<kMC{Mi3tYPi0;m#<ADRm@t#;e^O2&ZT-$4H5<&O`@Pvp-
zv&%Ws>n`M`3t$zJHde1pKcmeg-to#TWlSmft4J?RI~eKfy&jX*l9sjm(##5Kl~8hQ
zi}~>QsTG9<&|CJm7vi$nF%v~@(@9l>sEo(?hS|`H7ukTUzlrxzf?xAPpyYiS%;1#S
zqGi?1E1|uNCf?Z3`wKhDo*oe_PX7QoaeRN*{c9b$1Cu=yvLS~ZqD`Yi64{VpLe+_*
zF|It=_$14NI<DMZy?rCrz5kFMKHU`x^f+|W=y*MFRDIG4bA5G%FgIVAXf;sf`*)=I
zAsyMY)czj{PoSn6dSxKR)1TWSiXh=}-~d`2VMiSZBop4{vE+;pUSvOxODDqv4Q&Y~
zr5RR^qlo@CzLJFHBbz_QY(O!4ZLv{D6yoh2Y@sh78Pl@se7%pq6AfuccHqxFF)EXu
zN4J`J1mL$%r_Lq1qO~=doTOzUh#rMFh#LZ<BA*ZjxI4w6DZ?i8{2KQ=pPq42*)0Fy
z`~cmPdO*e~T9f=Byvt5uaSh-#dk0*$LeY{%AxlZ=iMpPgUU-V$a3pyrl2c0JqYgxQ
zPrAnKeQ2Rz_!Qju^=a;l0DpJaZ0!jWxRmMMe)*0B#g*%~ZZJ6xbCB(StV(&CkDoks
zAL*k!qOhf}ZuxF;<;mSA17{MGdBctUUgH!LRgvil?Rs1mCq=Znx6&L?actf@H7D&t
zt5*VJkv)WFme`|NuiuQdklZq59*j+y)%KM$oJff-Cx*Iw+OwdOJP>?-g@R&RAhHy;
zH98fPn-i?N9R5P6E&iY{#OIq}jr*h%%(#WH5#{r=UBKd9rB<)qXv`i)+0}-|CPw}J
zp-!4VVJpxfsTsV+)^&Vp^%=z*i~4Y{IWW(59U@WX=R{*Zl8_R)naZ`!iR?m<m@IHy
z)45ZJ1cmslt6{Bne{?d=I*u={rvB-2UqIRKLmmYe?-ee|CMvMsg1|@`VT)7O+r>Ry
z<J8?2+)@W#xm`j-e8zd!`REoTcIiZbr<Uv9LKsi;&i&AHxr1evVu{2?=IghZnXBfu
zudA5O-^T~ZIo!U9%ESB$y~|`0;PHCWChbLYAS?LO+=BeF^(nf5W5Ogw%8|Q#RJcc%
z92Ji%%mjA>5IBD)-;7T`tA-!ieV3q(k=^`Q(szgHJLW|9Iv~XanA)iRHVPOTR)YEj
zB>czNik68x2BO<3CWKRomGOs2Zs*ZlacXvk<4s!tp~hJY)i@pCjmWl%T&JR%=Xqkf
z#;j{)dsmO%!shi6OhonP_A`R!d&VsWTVRQj0q*g2@bi}*P5UL~+TZB0M*c_dV_V9L
z1`M5=KAF&&b=wW@9#m5C93oD#y@7W|;!C?zoPlfRf-ZQMvz^6I%}YrEBCh`DxbyE4
zmfcHB18EVcJu(x!T!-_<VNdmdM{QGU=bk#q)HMSbo#h$*S^s^_{YIfC(wdz+Kr%Yq
z4orLEXL>S|&YlVP%kM*fdAp42d1k!lZYQDf>YQXhU^gXKbx-7woJCla7v9`$7HeD;
zeKdcsaksRHgt;56KI+%V<>$}`D<3!VVJ+Tv3i0=!8c@&LQ^~^1P*^t3O{BW*rp?d$
z2G}0^@dKbqnC1YzQ-faYCT<t879$Z?N~>!kYhO0C@7xJHBY)&ruj0+y^nvh;akFQb
z`De&`yc6h|LMo?r&vr`RiQnr{`=eK^f>qV^xx=dq{LhhsZ|Y#d+&Sseqzx3aK58{c
z^`1~VXbo@4NwEFkpnl7HReP4*#zo!55Ke(eI3Sm7gu;-EEc29SaoSCsOafHnk$kqr
z^kHh%;PF#`@qZ#u>ra;;Rtj;&T+y$VG&IlSYkKJabKNQRy<js>GcSSpr6-VSHS*I5
z@5-k|uK}YM2|Ap1^M^D~ugjtI{9kv3x)Mq$p@Q_Bz<P8<<j9<h)~)1+MXn*2crx@(
zJmzJ+uFmb4DI!vGp|5?o49epvbHu}*&=n-fVHe;wS7)TG@a(@`M?6$2%qv%mUD_B9
zIMtABE9rijK0J$54k<0UP%xujn}p}~WQBCa(ns1%|D~aQQzM3+=Us&4;UQW0xhRyb
zZC4$b@e%)Z(c&ke$sNS#vg87f49Lx{A#~~5Q{P?1ZW<+6CmDG=8kk{r*S(r|s*M1;
z)L#BblQt<H(TKEKoe13y+K|G`)vf~)gTk8HuK@{GZQOUd^#UM4(Je(1#%Vea%b!#J
z`n2^~Y%>Y4b~eX!cNepkL3;q{<LaKLnu-OSYu<h#ev>X;LbyR@vrTmQpo1l*5JuXd
zKNxjiC*v>|_<c-iXYYY0z2`JYfRxU}#Z3~M2mD}_34W07-YnE*mEi;th(N}MZ~`Er
z;Ytmq@8qj~OX!kCwuWx{ixs~C^2}v5bp68W{m}2}e5BYQV3igS^YbC6&Mhc<4Iy14
zZr&bo*g`QSK>7v%-hXVMBB$Hn6&^b{kg|96Y<CR`q4GT6*x!fw?Y-PNQ))s5yga-)
z0OY|j3-0#MINlhL#klL4t&FL597ZNdSW&t!ly;%*K2R)q3WPnWxUb{}ijD+IcquO0
ztZ<P?_~GupYrRIS9_)E{2ab%hYlLcp@p^6D0}?WVa%RpWw<dyzoZxpqkg=rh3J}-8
z{5^I@=X(PV5y<u-7&+c}>{r?qdf1~vcOa@2Sw{n$-S@#R|I|(b-EMC^JUr-&KE7FY
zemfBAv%59x$-<&rIiG356XEva@(f%QEeAfG%C)(AccM36O9!^~D<gV0S0=XmI<xC*
z$)!nP=n;RdcvLi0Ly{BxIneKJ>DKS^X%jd>c2u+AS8#o21zU5vgv&#wGnM9_;CedF
zkBVoO1`rh+nOPao5j#Y{1eYUAmI-Pl$waMSx~EDo|IAm@Gq#9E7ua;%3?H$5wyUBe
zk7qSe<}2`m-40+1fNV9IIKu-N=Yv;zjr4qeugeAPa6`}mbzVLJi*eL4Y>DbG<8hgJ
zgzKD6r-H1CYO4;bpG<j(p)*A{2i8)O?E0kkU>*>!)iWbdEk$jWFRZPv>GWtCRqdvf
zqi(-H{mbrzkX$BM6r^QQ?d9L&d%cQ5$2PA|0B-CxoXY!;_z+ma`hifdd0*aMp}oxw
ztJOU#CrT5@V%2N#Nl03Yy9l2iEv^fa!8qr)6~2$MayX9#AE0s<OZ{G|ot!ruy*99s
zY2l63iFWyyUiynAk@d%6X-os2VXfOA<pz~<OZ=;3e77oU@Tv~8`F-5p;GFy=?g8Xy
zVuGYs%p`n8-Pj?@irMOv=q(vS3K2_~%b&c7YU2V}5GX)ttLVtK=fwik3IVD1aWt2S
zublF~@hFZ8ecxcB_bYs%wZqP^G$o5mOcA?&x&>=AU}y(6l4#SP_d4FKj?-hip@#r6
zCJ`vHq%KNlS0)-oOF6u852e~0i}om$2Om$rWoLk+Gc5XH!Lnyk_xhqC-jmX%-CR1|
zlPph8AK%7!cWQ`?b2%2#+o$cTVI?t)c92JoszMw$GGkxMq0=x)rB6uYHF~49Wwl<k
z^(Z}i@>m}t7b9%Q93{EF?|g98>bjgXy8bC7!)SAs&VRd>0f7mBr~USkeWNCILyR1L
zl*=BZMMY%=Met}IXK-TCALq4i?Eyj>rIt>BnBF*A5OYPeVuG9BN=eN_{~iZVHJ*Md
z6a9@SWV#`1j+VNJ$K(ke=6liQNzXSilE5mNJj*chLKYK|;s$&TE-*UGv$pYcv&ToQ
zE!CrHD(;!S6R#6<?;Sv*SE~@G(q+d8WX?~I#X^ynH_F>;OS)a)Ab<{S9Bqppp{YTv
zr122uw_7|-bpOm|#VTQsoo67)c(;dEAJzuFqVokOfyYX?K}*_*o$jo7Hg`c@j2+j}
zz|Q+5<~r-+tovnqPx<|Y&8tD%NjmQjm8glBoH*k3v-VhF5+o1GD3)+B_hQBBprRbW
z^OLB!mKqm}7Q!$x8W4Qi1eyXo({Hl8T;Msy|L*$NgH;6)Y<w;i4{Geu5eBiz!ygWH
zos?`qt!|mkq3%Q(>iwpwV@&ejyIlpy7Yi+$i1a<9C)1b8V1gy}ygAE4Q|hJF>M{mE
z>W@x{0*%hD94%|f?!|x~fep-0D-3Gp_C|dPIRUI_Nn_7w&+ADMoVFVbW(-g#FrH~3
ztLZIct*O1*CRc!Kqb1=fYdAe>pEf**<FA#aoex_Xp)D(8KHTU(8r)dBG14yz(enrr
zsODysn-RNz2)1kzYnF+0q?E%PBjT$di)ULk6a_G=W=;#l9ScyC4g@=dIiOK+fQ`*c
zIdusC9drY`qAvNe!cB*GhS-7O%Eh4e%_Ou1Zx7uInh^o3{-`8;*Q2_M73sHyInw8^
z?HZ2NS9CL6DqL27(m!RgS`F(`Mu<U2^>OolGxx5!Ez@XGUQ<b5F;Y_i(kOgsi@yzw
zk`6#E6UX_twk{8(1SQvLtnz};qDr;<V<7K}DYbi4rWA9EbcPKP*LaX~F@UZPxr}`q
z#q}>S$krQ(Z>7`m+A22%&?ouVSN9K)ghW}?zVw7#<@+qcYDOUt5&0AEw$;u@<2!tf
zf`$4NxE@xbjMb}FsL>iIY)q|?q$qwgPaO!B`xfrO&R?KE6|o5XG?DERJ8PiRe&c>Y
zO~`e?N<ztO9z2=C<+yPu3t<AUZ-wv!$pjja{;rEndTeuag=C3+)O$CpY=3gx-i-{L
zI;A>3l67o139x)!a}ONlI}kt~fuYz-Zp960?wcy^n_b_VxK9i?$PmX!@{o)43Tj;k
zGENF4AX!hR*&VKz4aHX9@Y}`}bc4S#j)qOiVa~;O8v|@=HqZqll&8;&t$JfIsdkS=
zmk|S284$~aM}GZ>Ig$2(SLw(l=8<O=FO(Zg?b-JyK5^#C>QXI{M;VgJ(CNC~CokR9
z*uEX-Rz3lZ-PjfOlbQFyyx52iHMiFxmGFb!?#S=oBCi^J5Sf!;Z@VTIrCpEhopYIq
zwo!Mlsx!Np(pQaEL9+$<+hwGo<i;754YM#m#%naQO!8z*HF4NNzM8=Y8zaOdf%H(`
zg%^Bi$}fhC6JZI5i5akS4DDh?xqynHqVvGvs<wy=Q=>`iO>R}gjRKUfrfclMHPxbt
zp65Rc2e%uC*D*60FgpJRD8bOrvAd5)SJv{k&lDObBFiSm$rSs{v*5Ick1c_~1}dXd
zS({Pl+J<fI&|a<Y!JjPF$+1ELGd;lc(!VTFBG>Y$eT{E@kG=9m?@<lKJlS3oO0VXq
zdsg~;hQ-`iGoh=T+7UaGbNQ>+!bkn)507RwS0<KKRmSLb|HWS#aD3c~rM4Ji$QH|w
z{#ilm@p>aC9i@C7r}d53A!-Onk}l=?Rd1=ppCMK~6C_vh19&G6;L#UeGb$#oZQf|^
z+8X{;=~0d;@$mN*WetuWU4!cSrFmNIu}=xyJTmG}uZ1LH#2tM8>$c4lbszy_$VJpd
zDht_$u&qB3wwLqAIJbB>JQ%lg$zG&BxUY%6?%2486D+FYTS5SI<nS?<dgpQ`ZybDe
zB1{ja9g#q&iD=7l#O5`a|2C}1jSkhj|El~han-`a9hCy!w630~quyU={2o|@dCII`
z+j?%q^1K6xEIeIC^i&o`jRAL?_~bfm%OfQF@bywXO1R2HW1p$3i^?v0Z)BfQLYa!|
z9~RP9SDS8Kib5SWCUJEK9Q4uZs7y2ip)$#^a?iGGx^}<ixS!*f=x20F09(xmtVi@1
z&9Vo#@#<|mPjVtLPs^RSlpKRU8MJp4#hxFf*zD=I>YqL?Jo$92)cZE<Y}e35k*ys+
zqRQWB#6El7h5eDCl(i!5{G;g#b7P9@1!Q4YgKdg9jBQh#a>fSFu!#O+kylQ<extjG
zM~x#m?9$DFY}!<#9-0FHDpn57br5>>4C4r&l(4@IpnmO%D<nf){)qI-E#35Lujvci
z9#4ZsVz$5nJLhUlJcr&t>6>-D=wW=zrt>;F;pSnQVSV;9zc$+})Ft_5bHl8|*6XfE
zxb>}#^qvWw4fGJQx8K!;y=RFMb~WO&ph8b8MVX0LJrQRXyCY%RyN0mdDrS3?!=Rey
zNVHw?GsnKxm6P{S{ap!gQsMM6=Pld5EaaaA?SN8l&R;>H&HKf?Y1TAF5l_ADp^qpU
zpGZi~2Kp%H**=Ta4J=f)?cb%A06Ucc#3_jVd`4BX;aY_BExxhJ_N6r4+Vr~9)o6r~
zr*U)>XEgdqrp?u*zY={kk*fq>i$EOtI?acoj3QRbCh)(LWGj7wqGZ>61bGJn7k&ly
z8GMpBTfcL#r`&i)f{F8t>7-Z8CU)M;jW;EAN&@+)MSxJC0}1a2$haZjU?HFB2?L~W
z21o!l%l=s;`KfSku<2elLFDkVK<zyK+VftPA%e<*25OY<h7;3)-wyh5Z*sN$Uesf1
zP>MARv5+`jK(;Glz`M;f{r0+^TAU{DSV9mo%Hl+DjiAAK9Ue^tvrI#N1{K8oa5HVi
z7p955yFCfwctKQ1jGFx_6Xvj2flh+3Ifna<nlPS?x8XhZfN|^Y{a1B6uIo0Yx7Nij
zB~nyw4?tw3BXr<oxgE4`NbdL(8yHd=5wgd{ck|4&ic8uf<|S)TKWPUhO`extm8D7h
zd=e&1{gP|L`%1UH=Y0_;HD$YfInCuur@cti64n?wq2ffaNReK^(m~Z&nQ?f}O|BWG
zDBlfKT>++BZ>XcC@a3berHat)Etil12TjU20^|aL!4G%m(}Ob~ITnkSO9)Y{J~}+(
z%#J-}70-0p1YE&LSR}RiF#9eaET%`|Swip<OKF!SbX$*}f8@C7&xWT^2Bfl(caC4$
z?(#J%+&kNPis(25s+$WLvdQ2^5!_2uE=*ywXVXBkdB?TZk30O7@)7MUBips8f}j{R
ziWCImbX(S_LaDc(!N=CX2Cwv+{OV$A5%A5q&)#fB?9mTafiR2!UKaPekO^?9LoUt&
zA^Y7=37?Ki#_c`Ot$MKlSkEGlR9A@wq`<dM4WBfYPP8QuR)M>jnucK3K6S;Z%X~iV
z;b5Vlo(UMhjQ~%v_Hs<Rx*(UXt2Q?yd?(H;YYyWjE>G$*^DAN;e`BgU-8+zjbxNKH
z58cqlvqzE<&hzAccz+C%qh)17PI_^<e7IYG^(-kaMqR4@0ps$K>CG_cZk?_qJD36q
z{umU>b|50NIuGEOgP?nAZ6dGhjI((4ezoy-Dc%m?=fRkC=FZg);a)o#m1e}wo^u2^
zDSwxprNU1MU?*8Axa)K_+b{>|BI-rQnp_szD|)XMPu^?qqLllX+V1*nLYJ=4P~4i2
z^-DZ_%T!Q3g=rMg@o(g+@0fhB@uw7%75j+2k?LpF<LWkv$GVYcRzsQRXXPGy3BRie
zbj|k366oMpN?2VkG{6RH!fc2ZQGdDnXEB-pR;cOzhmXB>JD(2D#K@AB8|Qym{*~{c
zJnpRdf_^LI{NZZs|Haj)mm1mi*Qy^_H4y@wzkTWNnKLsNIiJR<`G5xQz7|iPr%BhT
z=D=IG7Iz;xy?{!0A;x&<eBktFTdThs8dBQqG+7M~>N{H1uT}=2FVC;B$O*`xV-YQ~
z6R{*bki8mrXt`Kxq`EPK68yj!xmSNqegv^Vl;BS#+Hk`_lD!7BeAew<iGLC>>u-s6
zZbl3OvMruNmZRpl?rM2}r?d#UUWYfCi;l&hiWJ*#>d-R(^{iW2M!f>Sl~;Hf4!JgL
zYl|p6zNF~KP65$Yv#6ObsS=Pb_+Au+Lo&w~7m}(}NnEQLZ;nuU_*1{R+^Wg+V3U*b
zTf_ma*=lORrb~HI0+tRjzPpTD_R@VVu`&#495iW!!6N+b|7);_=YEM<%kY(P=|@co
zE<vGWDiqoICqm1QgRbSunoTK}eY($5mdp3v*|EX<-usni)wy{s%YX_4iaJ|%iuZT@
zs>T^-QfdmLmRSkQOsZ|D-M9L(sd(s*N*4^wS%jEQ)_nA7MPEdDOmlNC_az87M^}B%
z6Ro1_Mn^Pd{Aekd6Z@RzSD51Wc~3h_Ho7M{yQv25-UPJ*%N8zRdBOfBnC`OA$v#Pa
zMRS!2(JNrKoWo_e1=c+hlS<d|Iy@MM&V|$*(a&nLNLp)HCWs2vLa&oEk1mRRtv{sV
zbg-g<Qy64qbZ`J+DwW`vNVmR@ga83oxWP&p=0_q#pJ^UgWhKw%*iHyLE@}(~-<(Rp
zqkxw&elgGyGmsUwd&w1kE8<MC5xQocsk3Eyrk6D_BBMLi_!*NB03jq}xA$t5&KTU5
z*6O{TB<hO);1(DVCH9KHKcT7&PP?9zV62-}E3v5?W3Xo6){nD2@tW8ZUNzpUEKaa%
zuAZ~g0rN$7SDIkNuH8>or~Mt!!S^E^I`nDH_|D`=y2MCYWxACY-h@H$WKeJsApkx4
zf>IOfb1w~0!{XZDaseaPI@HOdW1xi6_1|iGd3DNUt3btq=BDGl>FK#YLt~hM=IsyX
zi**w9%)<#YN~`Z5+tX2;lD7{&MJb066vdiKam)Y;cg^XeE1D|sPVR!2%-A78S_-~6
zPya9#pcEHP5O{jM!#XR9zgyCLNI=WKKPnqA;{W;Q^!Vs0t+KSsn|IW0=GjqPk&91X
zVFd|onO*tOk`EDtALW)*Mzz6}i%<X2mB|haknX%i*6y;qM(C2gYIvRKq?MmJa>+6D
zm;Tc<=U=gpEANY{+Y2Q#h*A?3Sm_%h5Q7dd#j%}HX_}<i0U&*KH1Zz!H@ugz)Yjs+
zi)F64_-4|4ycRjhe2m}RF5THwk=047DYgf_*=CpBs3v2}?j<r`ApG_R3}*(aT#cnn
zW8x_$jF_?GVVdy-j>pKz72hkesw{@mI?7rqE=FK#6DB_P_ul-}kgV&{2~s7?fzQ#S
zyPN2alk}%>uf>aXKt+2XKEf*PJ>|+RqxR==mHpcw*`C7k5Den^gn`bTBuvqqEQm*^
zz~R4|%flEm{^;U@?UQd)dx}L3mJpuhsP5u|q2GU=mxvXDp#<2TR3Bp4Vzqfi_IzO;
zMMgA)Vp@5GRL`a*?Cy3*!+Bt6X!er$v+dd5%o!&*N(sw0`NH!4qvI8sG*n|5N+2_e
zFi#JZK385}JT2RR{e99XaoOr0gm9or{3Ry?<)^x>dH0g{W7+H2JvL%1v~prWSn9CR
zJ87SlRQzr*4jgMv0P|6j{?=>vfL8z3@cNf1TN$O5)jIpy=KP7qHSX|hT$kcZnLVO&
z3stO{9qOLp#DXabLTR;XMa4a{|2QcB_NCAvC9pXqv>bi=3ZQ)uplf$9Mo=0GmXele
z6VE(2rnNYq`J)Gb$tmQ(O7>+4NTQq6ACIzf>3I*DFbXk|8*U`%5(A=tTExoGd(OHP
zlpL4MM?vQp8FjBgZ?hmL8f8zrsEp519ojJ4SM~ohyDpCGe`~tYoPRXkub=(DYPwlX
z9o24J?@xU_r=(A0&&vUz9xM(Dr=$a#s|;$VfO!F-0tlg%wR8}h(818vHuIIVZ@<$S
z;?`OR{(QPmr2D4jO>YWc<JV@Z&$79F`2T!{_@8-6ChJ)uM-_xmDgAVz@l2@$w+Gwk
z)rb}PXV6IYC%t{rVdNK&@6`WRh|N}ga9j0C0zlMlHqLVcR-x5yO=zH}->LO{4kU6e
zhCGD(AN@x1=<@1B){k!Va>_G#u=jCt2PP6Dml0e&q95waH@+=*FlbaBZaooo@s~>N
z0~lXCK<2MjctW3|-HP(Sn8#~l(QmenVa4=T*UZS`=~dI-+x)0#HSRyuVs1D0A#)X0
z;htz65~n8ge&V`wJuBOayN7Ms7JCDogdp~17c{6O6FTCD6^Hor$#{x1rN7_lq$c6h
zy6)kwj+LSb6>)LR5YdUFaEMB<AwzWizi7k96>X`J)M=-`LxqgOut)gGbpDTjOT!QJ
zX)jbzT8I3l438uz!$tM~M;Wg9Uf>E__EH?6LW{G6*cA1AJKFdky}Lqc8s7vQA|9)u
zh6SkTscJRB(OVzqDH0-&FPbvYN1c}q86N{!Xq-^NbB_n!p6IT=&omeXr5FkakN<Wi
zv_M+wchw|gm*{yUABubsZb}c&6+-40Gnf7tR+kzW5T{N)WIcU&XQ%sz405bH7S>11
zAsvXv<&tTsNu4MRYz6-}1@G*WFZwvmR7>?uXsRk7PGle!;9-;huCqtwb+%@Xb}d&Y
zW9KFE_b#2TfbQq*k|=8R2PN%8vA{S^e%vUPe<bQiY9VPYcC4Fu>rXeAY1zrOKos2!
zTVcuEP~)d*ssE;Yt_yv4+*OCRP#e)gb4sQ4K_i>u8G0JNZ?&7J(O%UtP9`D@U3vv#
zA-kW{r9zS;aK<X7B%_9pX9&GdNq4kz@L3D{jX(`R+Inztgx(WM@ryLpsrUZ0^&uAL
zY0#W5Oq<Xh)Cwn#wokjRpucpZ=N&;6^{kJBAxKK}o$wAby-NH$X$$=oo*oRPJwpe>
zqV79uR&psW9-v3Nn}!ZS@>iIEbzsGg{d<eczpJ{tN!^wHOi0l}KRlBE$GD|pMi+63
zYxkO$^2)ApCBMsq9<XU<fbSCK;Lz8S6neIO>;E1eC}0t<PA8uc5VFxSs!q1DR+x-p
z-miYaK|DTlIK2NmYc2F@(xeO-qp+d(>7rXp!NC0OL=Z;83~hEZ#B1JP^mjmCrWv+o
zD7=$QM1VTcBtRkAF$dMsfjDQ%4A|cm&FuHNqYvyAUK2KJ4t6mkET$sSjWrTzPZ#5@
zUkx;yWL6Cski$vJ94(|QZd@P8SE&Y_<AqM~X2q}~It-kIV%|l~dt;;EvjFC%K<Q!T
z4;Tc_J;DrVz<Di>Bo`F;*u89z{%^*XP26NXLueZYWD9+J1ZJi{kLHL7W!t<`s{T%a
zDD+;3(tD5-5{B%TQgmJ$oYzqLQHDJ5B_SQRR|FjEAi2WPVZ=4A;0ElronW)klHqu!
z@8KUw*Q_9xC@kgo5JKjVW<)~9C~cSghm`80bD(i-FpVr3d}SDt&~z5+ymt$JBMDk(
zo4ntZyno`fo9;};EaRr<hWJGIsQqL~nGLQrJHvNBe{A?E0ZvC>C!=R>o4VDk3}|8?
zuv>S&g5ccEwoI9fa>#+m#e9+RTh%6Y0eYqfec$ph8L8fX^eFq|J!io@>V_gR?j1vB
zC=ZHTS8^CX`zINAKm})`jyh`6LgCOxaI$Uc29blF?orM?y!n4o*AEg1Rf35B<#RM=
zUH-9dpW&0z&F~Q78D_E|_TJ%s`7w_i2YEk0cjbE;b-7oCDq-?b6#r@Rm4h(r{xQxf
zm=pk^m%|RIF7_pzGnhaQPWR`%&hN^hkU{&yTDl<&Z}ml~Qk+VoTbKl98BF{Z6ZOs?
zMBx@r_V<lDK7=IB<viJj@5v?UTp|$MerBsuN#sGH{r?|(?-kb6zO{WTVnOLBAT1!h
z6Qqj-1wpz<l@>`vx(J9;k^o9?QA6)VK)NWsDpi{FDvFd)rG*v(gm<EQ?X{QByLnE&
zgYV$IE)RkS%FO(iG43($-(XAjnyC@P`uOs<c63`X%v!uHW0xmv1>XJH4LOtu^CT?J
zK%NA6+^i?+`JJvSwhi-o2uu|q)3sRvC429`7BiyH7W5FrJp1%tHdE?VQj=bgm+4{T
zY<ptw9odY^qb{7Xdv&z2^b~!#2P8J{2xM<iW7J+boYV|E)LBU=fGn5Q_O{bFY@cyj
zLK+9(#BOlXBk|Z>TV9kMU<PNkFKY|=$g4{p%|W8Wcxc6%#t3F$mTMe$E?w2g$rlCH
z>>wOcR0qXY8l?rW9Q|EUP2*AZ-iXZbhO?`+#s)@M%sS|8?3a`<Z^$fLq%xMMM}97}
zs6y4?Fm?x8*jXUxk@vjnzrNLrN2ci>@m}U$M*a-x_vWM~T-K!-2I_~2)E$g<HgEbM
zmv!zfSJv@=i@NIk#(OFSJ#3s5%n!xJK#C);(qnp!z`=!f>@Ue%5#n4IPiRp?#~$DX
z&k)rEsNkQoQQ?iMsIcDV9-iWur`YW9Vw|3=ROYV08S4ZxfN#9>iP?70X+^?jp2gD4
zj9;i@LZ4B3wyPw4CtySR0u=E{_?zsW&ChGj`*V}unY~%Rd(Xwi-|)QR)TR9B-;L{k
z14Dj=CbxgvCt{b-R{)S*y`M3eavwzU%%R!g8`fIA0}u01hm8tc*Yq78h>AlylZLrt
zli`YSzSQYEd5N~&yqV&39I=b)ezyg&*XS`h=&S28CnAS~IX|}Npa^So`3T{;qVL<B
zD(~YIRem&Q7oNM?UHoL+)qQYeOtj$3LCg8-mStv<FEw>SbsJ-+7Sfz92-VrnPt-3T
zP_P-6&%0bhEDR_I2lm$D#<wgdGs`LTw5~fceR?rtxHri!sVd!mZOLpR#EbPXb=Fuq
z{{QAd2JFct$|sO_J-MtR6!N^wx^>2KH}wWH3slObrf<5yPw;RUp1O3-o4_?SB`9Op
z;X7GWyqNukabKTD$3oTYp%5Hbmjg=zJAl(FoxgkydeLiGQ#UXv%EM0b6O0%h^zySB
zmKSq8{Yh!s!V?#=Hgk~Ombth;nmygP9CIjvaQ)Uu(y;EQ(-N@r9U-&~Hp7l6W9t$q
z&vz6dZ;#v$G;L6wRtZG6)Ud8pulvMvGGmkMKRE^3TAQ&iqs^}RF#oqZn2FYALY%~$
zrc1Yq%eu@@F;CfRAlGaGz1bT9Qb=h!l>s&3M$YHv(wz#|2QTQ!6C#-p&Ac-U8FAKt
z%1|OGJtx3v+{<Wu(P3Se8Pjx8KUjuy;C#f?57m1pJawoX52VRdBmmXk&buBXg)kVF
z8I;wbqr&OV%6NslNhJ{`Rg=S-+nRW4#xgH_n-1D(SP1MI%w$Yrm3J6<Ck8Zoe4$*$
z$rvt{Enm-1$-%w+dAd`5qR@f$#+hwel^~T($CgDb_R|vwrGHXwe3N;OOq{^5p7~_$
zY5ecY2*dB|L2q2L*bXH;b98jtgVwS{fWYu5CnG@(k;(@ZTSKNaPs&5iS~uMzWsuPE
zGm_{)Px<Q3-2tKS@JO1tpick@qHaEZbB;*+W=#)bh4|cdS&5T7tE5-HY*U{gw%By%
znj@=W&y{Tf{!fvKH(0o`%;|1CX?{Cbw|n~b=VqN{yz9FuBb6lgnV5MYe-@BdB4a!!
z5#M8U)w_<$ezW)hO*aDT9@|?dqM=W*xbLW~y2t(gje>3r|E{6@@xg?L{os}FJUXam
z{*_&fHd8`wiKcBzNrszx<4jm@fMEz<*d)4)pQiGy_mmP5X143hQ&ytCKcgW+-lgxD
z<4ZP^rF~|;fvZH|+;WL!30MV_`h|3$$WN0Tgqtji1<(+e^orM7W3Hxymzy2}mJbQu
z=BRr1O~7IPYUsg(xdT*M+q@kz=f7R|*A)Q}-5BTDc+LP7wR=pNo9erdRk8;J?uTQd
z`L!bDu83JTPirDHcQb=&8T8C|bMy?aDa@zu*4S{eDYP-ZWKN15bIUSElIEXp@Ug+a
ze%a=FgDZzC#HvNia2bEska;>%>3QLolDwi1yYO?z_=bFdvu{5C$irt1hIkfi4!57y
zSTi_9S+bCB8*^XdvacZ=cb}`j@8NOQj$<-~-?Td31DDr5fUzEXM5qt}&=G<$g`s*c
zl<$3sB{d^8Z)d4o)2J@94{Cm(o_jSstPzKZl#P6W!p4A*P2C&zXo}xJgjcVR@w}&U
z_@W$PFbx9Ss|WBv0qljPzQm=X<wt{ngMTcK1Z?zNgdyX-vhgA#lBDTOtN7IIf#$zp
zb%Dhu6p3>KiBC>eo-h}MEVt{J{V!jd4U{7h^0^?H81%3WW{@wv*_}>oXX&xXtXF?F
z80Wzw7?MTa<Nt%*GU|g!n0SCFk2hJPdgq%5c(Dj6LR&&>FXPy{fdfLKENb7`xV?Gw
zSSKL`SxFIfbRmEE`($EH(#0S_3Rl=dN~hKa7sRbZpRye=FW$1x9JjnA9C5CQHpHMc
zMtqspab1suth~gQ9L3alneYFx5dI$v;r|mBLWAuiGohOTDxjP1!o-p1${0xsn_w-v
z)}21?KUCwSczA<66cEPd`7E2*T{qog*=B$|gE!VY;z=+I9cMN_GG*SZ0E&AmKLO%j
zS4lNaqdSTiFQUL;b4$rF=tE>BJLTmoVk+!Smb+K)X--Gp25_pFJNdECGmG(jY|cTV
zP=bv;KR~rSk<dj7(fz*m7YpEz%i-@I0UF~G(dwbmrjBh&qLq0YnnzG8=4z;2uf8D9
zx&ehtPuvLrG7Q9GsvyT*4k!#m?u|{;gfQF!P0weTg9pA`o+z9}a~!8&@Bo~|;2iI#
z<;0MokgRr&B!e-BDtxZG!;SyM65wi4gIUf4R=?SC25=ZSYE&WJ5Y_UG8?t`9_C$Vi
zAsQ1xyr%&$OOCXss|-=h&xKmzZZMwWKGUCd-=s>&*(eVY=QAZn-vNI~2jX9DiW6W9
zn|%3~`c%>$ivr}QG@0U9m~+{&`qNd?9v1Ku4a2c?X;>deDIr>_M3Z$OGu(xT@;5s!
z3%~#vW`Soo&rZ+Bq~Kb!LL%blvdoEL!!lEbVJ+i~sTZ1b&z=;cnC&Fx;=3A9h9GIm
zx(<+58Lk}GK%}zQfjI^%+DCrZvHOH$%;$>zq&xsI*h06kKD{kH6R^8RoiQ^AjxghE
zIniWJ{x_STL#E8<<3)@(#_~BW(pHb$1z_d{e*}gXC43w;*I(F+y3X~0n~a*B^!5mc
z&rdHOA8P7RWy=T3J<c~Kc{^o-LWq}W%+9b_4>;d&ZoGVh+XoiOI=X}G&?e#7tJ^5b
zUO|ewIZdq8m0#mPVs;P;6NR~Y*<W&28~eUF3AoX`GR-S;(^>?mKv%9GbEPO2kmfF=
zbO8{AoY~Lyg`3?bTSnV}(3MmFzWl*mv?P!5O(EA!enb8q6{CgEV3@E<Vw1(t<Z$qP
zlUdu*i@Te&VNpuXozCH;1yj^sZ93#FOtbodsPd^;!saFB>M|Afp6X|-DkE7tHvc85
zem6;{_^i`So6x6e)TFR6pEw`Q2++W}-~@SN5yrWV`IHcDZ6pp>GIJ-7&`A@Tg4nhG
zFxj!xY-tPH?7#3vd;NkM*uu|$OhVx`7I2tH%NF!9f_6tPR@#6Gv`^d6DUvm$(R1z4
zSji}_9yS9^v0Wx%z5Se@rRgc^SV?=sQ$PDm|63+C5_C>~5gk;7?_ui|>6HLHCyp(T
z;#G^3ySXd~Zy)Ig6~2zn-N#>41#zAw<Zj+InF8;=sqdpjtLYikj7hYyOOxdZH3+og
zC9<3Fe0<b14@A(@R$`9o>-bID6S?`SB3Mp(JqyBEJr29h|HVkf=Qzys9Zuh>&DK~9
z-Yw1hb-BU82V<!7ZxCK?c;PeJtQ-4RF2%!yW_w8pcn`6Vw<q93v+C{&f%iM)Op+)g
zzRhq_NyZu>Tk_}9ikwZCS}z_GKmk0#C`Hc2ls=<gXs<Ch^@hk|HiIa$GSvmH8TBUa
zfIzS#w#Lt_Aj&3BN<?j`<kh$iv?VL*1(OF-d1iaSh@$+z#h^!je<$kW*LC8kP54{y
z_j7gxd(2M$zwzXGar-l$_nLAma96vPPyhi>%T5?+SC~ftmmU*_0q7y#o}7K+sM$v6
z9@o6hZ;594QdgAf^oa1e_c<7(WwGDAaiKnAVFiW!a4E=O=*K+9LiC**CvtSi(L=W3
zQZ1g?pl^2%#-Tb$m*Z%ynyH2)Tl47o_$9r=Hvn78OGPQuDhzrsBFsovN#nENd4}K-
z_F7!$=J~bvA*!S;MKF9EKqm+F*AQ^!`YDxFOAOi`dM(F>UR`v27MFdaN5u%%<Mx0p
zx8s&~6!t*8IOarfVF|6HhlghHFFH9#Iy>7{G}O71><V%g0N@SuHYO&Q-b*=-d;+}N
zXhmQPEX4QmXTsl8ekuiC^iLXqOGY$dG(bebgrq+Swdg?8^9f;b!?6lfJBN!;9{=R&
zXA$0Yr;gbGdypDSN_MlXm*g5fJHXjPV8^i{0fLRruUs9OOqu6Rzw-;Q(9&lJH~tj+
zIsA02_UWtLn0gs74)an$!Oy(8<q>Y-#guV33%F@khb4MwvXwffSf1B)CZix5MSeX0
zu7fnhNM#@oqJGUBO0c$o5`<QLQp!5d{fmD`Q+%#jt~WFVT);+F*K0uQQOeOwr}QYe
zx#@M_ep8RQY8bBdQSR4hLVoG7w^1mmKw;R+Wd3DL8Su?j5(SW#9HVN*jUGlle`j%9
zEq3_I>(6MhP`6Mj`=IHx)G1gw7dzbxs0vHA&jtZc{k*L}ZZ|6`rZRr%=zKnwuTVg`
z2ykZaN_1{zd6(V!#lM?=m-8Z~nc5m`LO&TpWl0YbRtWw;(#&!~tbjYfIO%+gC@0$G
z^@}<eyMD*Q)oTF$uHdgurvE9XC{mEVG3a~hesFa~w@S!s@Z?wZgVN2hT~cieS`1Ve
z)%7Y?!QX{5`gu@ABGF0#ZAoE|9iE+mC)wS;V;Bl`bu0ks9luv@kvI;5hRccf?)^fO
z@9@WwLS@f=%#Hz8*b)71Xr_%Xi|RQX__wtiL@Fh+Yr=vjbq~x~qAOUk_1FrEa_WkH
zg;syZPybZ*HB%)?nyI4lG`z!Phx3T{bfE-+qWGnvFw6p0BAQPl^cR}E8*`x^??$2g
zlSfatROVhFc58m)?U{|-BAMCGDZ@~;`w}pdf>l9IT0!rB7x@0r)qo!X$m+Th7I-D0
z{KE-H|5cU9ikY`?K-7g28QCNHo$7D;T^QIx-v{p_d)XtXIcP8#N>)b_Imcm`?HgyL
zwX7!k@<LD7U~3U!=6_pfA-sOQvaa9W%N}4Fb4Lh05JBL6_SpvDo_j_e3K)ZsETNuI
zYIaKi7w10@Z-Rv|Fka#@R3Tql1M7T~M-TnrHLMKoHSz5lZeGaUTA$mxd_1P+9!WD@
zL*J!LU8!vEMV`|*wMInwrp|U2@@@*aik}J@4ljRG+UMjF60PWGMApnirva*0Hl5P<
ziH>Q>mTa=65Z-8KuFlb^VT0jHn{4uH+=h2pkEh=a+)ho~?8a;NSpqkWo)tc`w%v%Q
zXG(dbfc%PDGC4L*^@^B!MaX-4J<FDm!Nf>=6C5m`7gT4rRmpQxHYYnV->JB6l{&)j
zxM;YP_ARhH)G`eU84f<EBcB**5*#h{_m9ZrEn`Py@=Pwue(@qn0aCHxa{Rntiqt2j
zp{rR%rFgOCJO$ZcOCjfqA%b)8u{V(2l{-bmk=FoxwW{!lOkM+!$+tG&D!8`Ae%4AD
zCh6kmM-jMQ+vKs(dTkw%$)hw9IJBn<2{Xz+91H902FxdnRFrd%xs`nl$u2_lA2}|j
z*reN}E@>WyRc6NB4VCLNy9^K0;7K!xkiSjll12~8cH6+zAYxfiF1?GEi77%6jeT+i
z2kitay_rFimQBGMlX;maa*ax(z4qhD<R+YV_U}}hY^pwK-^%eGG65l@vL86eNz<yG
zP>JMbJh8bxw;nP`V+W)0@d(OnR!t0ftx-3kwfnh^vmR%A-98c{gR>MK<keo%dv_dG
zGFDN86j<!`y}ynMr-MFw&cxZ4jw^3qogAbc^H&4!hjRQ-7kbDFA9@lBw5+ce%iic*
zqG?=!4c-?iDvAkNi42rs!@(s7ccN%c8y|~*7WbVZn>>o7oR7Z9Ec?8=O|ylf1+1&D
zp~Q?*VrKV+_0QD4U|J4J!Q?KON%l>-OPz^+FziL40&bPv&q}Cf@xY=&Lf!u|FoB6|
zAQRG(xZDfLME13h>4CHi<3)r6fh11@Nb)F8zvVuOCN<sPosDgbfrM~NHwPK95;`~T
zb{0p-?zeM5go~H|*Ta>EWHpOeS@xR`&bE->_prYsh9do}ZnUD*6}TpgEB^Av%rl_c
z?-pid(#Qy@^vRVhP9T_pbPE)gzUrmyAG6p_(!KTfdD5ZM3&~q3n$Ph>zkfEH>7w+q
z+2)>K@g10$0(XC}RdBT&w&P4>V5xEPi}<G7w!At!_;&%S#hrP{`?%(uC+)Ew*fgwe
z@`zTY&9V99oeL)=RLQ@+#+1#6$3D58RM#9BofBAGqHBWddCfa4J1vH7YBh-)x`SrQ
zhg&%3g3P&DC5ytL>-ocSxM*_gM?yUpXx|2s#?tq{KS|b}|0%}FXB@x5IJ9;pq<b#o
zT0v_dw)Csn1W3ThXQAkr;8c>%hVkHP-QNjb+!-^eAm19k7Lq3Ou-N^!BluiM)JTV1
zq0h%ij6#Ct3tHql|5?e49W_UA@S#O}a|{7sq~1PiFZm0x_~(Z^g1&Y~$T_%Xt}L!d
z@Zf{tK~!yOw&7yY&tLR8(qHsBSdAvpCI1r3);*;ZV-uV$MKM#J%9E(sg}JRt6%svU
zlLfY+C_Y!otd!7nJV=#|q;wJ8Co~Mqsjb!Thinj<z|mRld$R|9&M+Rar1o1k3e9f6
zAAb@O^REPoi=-bmV>M0dZF}#<k5Fvoh!EVQ*5PNgrkB1}i~Nk{)^rrjH}&3?V^FbA
zY)CK`$U4sDqPyNRhNOr-As~gi@^=aajAWfx@gEVk&1pyLIB$Yo=7D3-Tb!4|fFLLg
zj+HQgl^BgZka5+6<+Mb>VUkBV)Z3ZouUgl|W2G|P5o6>&0!yznc7vKDW9qhx5FUt-
zjVPM?b}U~l16doh61HvM1H;TgmkFE8!%g*4EFhVU#L`zSvcCg~p(`irKtHRNlGjH$
z$(hT{=f@nE4|i7{RfnIK{~x>JE&H7qBI7V^y~w5xt}NG^eo0XKH{-6fcT2lLA_$la
zr5DyLZ=wi-P^r*dy5BiwM%Fz??Ql;uum4kV0%9f&h&8%nx8ye^AK4$oHVmC3)rL&}
ze79WoReE$WCmYE}4*EVY!S(KR>yJ-L4Nt!=-w9EC@ZF`O;I73O@DRH3uC2c+viA>Y
zf9!ptQDvjsW+~N?*&3h<5Jj#tTQ+@8`dX87eS7>GK=!;^usUApI`VAdMZ-&ugzP{R
z?;)8>!l>szXDc}PkTL;g<GK)HNK43U$hycPuj(kfr}3}(Q(*ZpTfsSC{#1doX{ocC
zNp|=QiXbjkz%uZ8iStT%cAZ_tw;-~gH5)6F?;0ZnXyykh^<)UK(~b0|<P;fbIgyZ)
z`%8|$F=g|7q$`zstCIl}#4Bd5T~U_%_^%CTA@14<<xd~(e`P-)Z0RgjH}|(73EO0W
zAm=ACo9}wlbW#-3Or?=eZX{^9|MM4*{dh+4$FlpOLy5`&WYksiptKEg324i4htp3F
z+d}=u?9?x#E~TOQwTaJnlIZGaJ>#-<YH)Y-NWe(!8-wp7!f``b*^Ai(rWpFlemrT_
zlLguqmTOWqbJx!XtbD5uY{T&SLG~w~S*|3GE?^@<rdDWFBgo9FpHiS9#K#p2EfWE?
zJEM@A9XtlJ+7Sc2ghG9zYV;enAOlQ~6y@VCdOwPIbYj=kryJLqk9Nq%GwMGEjiBfE
z9ck*$-WNuK@Z-%;@@L;YykrRT(~So^-!4<i&#(358La{XOGU_vn&pR~htpzii;-fE
zV*`CVuPzBjJEhL-oBVN*Y*D|(e|^!%+so*7D2k*kq(=d>I-|paZ+)Gy3{yLNAk<~x
z(E}N@7T$;oNb!{4wFtu0sYBf^HO3;^`60z>c&((Lp|qcyZz5t%5N5Nj6|^T##{zDi
z01pdlkn5)F<949AagaATaJ(c}C#7bLb8CH+DNJz!b<mJ{<3-2Q@Cw0emOuF|ZEB__
zA$4B2jLRHsWoCLf8?zPMoGS>q9gPnYC@2G2QBNus6Ji1-?T7rj5!(|DD_%d3Jmar=
z%5^5h5Y?;=PN;(q?_99$J(aF8YduOk{=977T%8Hh(h=7J2lIA^|0Rs{ygIjbY817{
zdeOogX-7ERR9n4PJGy#m|FG8k@Z{u6r3mu+>PZGm!sc*e23mo!4marJf4JLQI@u*{
z{l>`j()1%@|6zdk`r*NKFNeNY7Q<eDg!}W1q;DYU;46&aXyV%!C4Hb?NgA8r475sc
zL6A<JN>%3AMg6dxtl)I-*XWuVeUarrLT+As)10$OAY}BKfT^XXShInjLTHK4E`rY4
zSfKsP=~Iy68B4txOHELJ%Ye183VDm%vX*Eg3wm2sWHyM?Vrv}(*}afmGyQo;jI<?8
zHtna~St*6bKT=D)l}!tgiu>m8A2{Q_d3Ccch}>3S41#V3UlxB5DrVK*v{sN;9}mMn
zAF1Y15HwtyxH4^^MxJ#DV4!;cm6pj-`%de~$eJ&SJ((Y}{PcWx(x`r4jo^*Ym^hn^
z!1ZpP@jm>TGR^;^EvGwWYkjzmI@G8@VE?VSZJ#~syjJb+Y2JVJJc{{7+)Q=1^4nCE
zP$A5R@0Z>zxoxuBE6~dw2kbn;{uIXnW@{7My`{BKSTbW75r{|B4&`!Z!wjJ7Gk3d2
zv|7yCxT@N3T)FJK`;d?C#29-q{y~%A*>wRGa{IU09tE5#&iTC^KQJSq(5>}iL+3?R
zqp>2Fo-wAEAH(Yp9o<(dv)iAd+UilV;j&xJP=@5|UWTLcH`h|}Y0l?PmQN^%AbxaG
z1)e;0CV&CzE;9b4->I>||3drJ_21dtJf0M9%2HH^yK7wHu4~MA+S1|2$1an7h1BvX
zC)EE)Wm7Fkngu!E2+k5R?xuN*i*iKMV~9DDxZZTvDWg2baJSD=-FdP@8mgH(NOBOe
zz)A?TyCLa}kKp%}Ki>kaRFnFoB;J)neWf6Bbwn#m)&#eHf)9jI^)b-f=%mrf^8^y4
zzyMWG=9kVl$-e@}e#iIo>(9QA%dXSSc)ii9H-c_OJ#kdtVf)tT+?u3MzvTNXmsf;S
z$6ob%8VjD@dd=8bXu7A6DlJINsS9}YXKO(!8_7JTk8@$;iSfaQieJ+QB%{li8qc>V
zKN9-*#^Ha8FA}0lahw4o`@ulYupb+_{I~Yv$VZCLs~bNpOLz;P=55;1C@Nhl^z!SP
zzC;5w7d?^ZuJNdtPuJ)VY;~4%Sd475>`nLQe>9nXI?ZXKfw$9%Pkx{6==^$DOk=aW
zr|2q=x9BNPsXr^x+KT!oq2HIpcWUyr=a#B%_7cF#UD8Owvaa<<Una4CMEi)wv(!gH
zMcfaTG;eVC5=Vd+qEeKT!R42jqYaDA(6I=v?d*?9*_UskYn9JJbXta0GkmR4a4n+<
z`luyMluD$B*b*;5@t!s3VW|E4l~$9j5MsA`_S$Q_CRw-q-UEDjw>LNP?fAI69Ui!}
z<ZBNACIcNM8YHumDGI&(d41ef$4OCtU*Ol%tW(=808evqrDnQlGXKLDt!G__^MS(>
z3=ix7DZG4C(N3LeKewr}dE4are1t#MTTfNdt}UH~?4}H70eXlW&lrC}$sN|P@WR(b
zHHyKETfCXgkr)>F+%6Vy*gCvqzzW&ceg?2C8?@<%8IqN7ARJC)Fm8C%Oa)m|a#G%i
z3Aa2~5sSO3N{&Lz+!5rEaSGNWN7?ZwSEhhGI^$}SJqf!b-)=i#OP<!w`x|{BgVe%|
zt6geLLwDCI9(}6{#CF6;^0#@{e5-O3MEaPq^<=1a=i1{KcYZG`IR)S7Ix79I*Vo6D
zx&u4@9NfT^^3fwki)`3J?r}lgXA7_8ODi=S+6po&`S{zKw@Pk}Sam9aC@_Hvo?NJ@
z%?oFdh}a<-oqQN0oYr45Fj@dK#%q%6()=i=NCqZ0^*I<?xiB5WW=d<9AsWY1qDU4Q
z#xA9D#bmbhGHm{8w$@vA6pY3pxbaBu5?6)FMiq5!ApxAIllyYKq<#FQr?TJcVW$tT
zOO@J@xb*XR{f_(O<bFTHwRQRzd9RAQ|Jmo3`rM~PeT)(q)ps2j)mKFOQgCayPjHq_
z#zRdLRf?BXg%K{chZ~>2GL?S+YD(+7fKr^jE3Q~ul8Y~|xu~*i2+e<-4#CrN#kXt`
zy<~crpO3Z(rSI5_)O=pVLi(d$V>(;ZlEK%|9{1p4KltJ72IDN(&(|8R?H#d<Y=gg$
zmd<k6UPAn0>x=aN5ug62QUwV2zcng&-&U@-;Xq7Xd-W_qaQcC#Y&ds&AB^@f&69<V
znFdjm`6-&}Hhq0z?IBB#>je4SPc@5z5wf_sEw|P);DR9_lRm!n!QfxIn-Gt=6T$ix
za-pii^`Ml|P^4!HsC3*cWFsr1ea77&-r}x%vM;c9l9#HOu~=?h@RN}bPQGbTLTn>9
z=la5Fmy=bM1iV2?&GC=*N^#v!OwPK{6wszzj4zpj2-cazcDAG52fIVNQS0~Wy^*Iq
zX-K&8)l)O6kzvM~>m(TsP3=LJtO~O^33I(n`%MDUU=v^#M3szrsRFS^0e(zr4A8AL
zQr&MFSEWm|&u;2`d!wje8@n1!Z2MlKvv^fS8VeLrenyuV6122?X@k}T(v0CSV7c08
zB%bfV_2EkbWD3%(EIi=STfxIhnsw2P;Zfx)ggPb0uwx$6mx)XQnA11$uQ`3>^(98T
z?W87&=c=P_aJ6C5<Tq}Us*oA!4#5OEjf>+kE?OEEVOukeMg<DP%6z<Ak(e#vAwY3^
z_3{{{3MgLyeiCp_N&8m1w_y$%7;#lE92Rmk3ZmaQ0T=~Q4~&8UcA1L*37&O&5E9$Z
zW8CQ3vRO(G%5op%<pqavQx2OzM2e3U$+buq2SKKN0P1?U^k@`Bj1nX>nQhQo<g#cC
zb0~LTpY_SCH(ak%6jVBx*hGM)yc<SqTt5Y*0^Z2ye+p9i!Tqex7Tac@Q#U24TDY>V
ziyV5o1uV#$FGkdOlLpwYZAl%SN%yCD#2$@TxShY>84F&LsK@*s!<o-Y0>Jp7*MbxO
z;-&y$&{SZ%ns@#HPcNvKt5>{N3qxcy-M4v73zZ#jHzU5plr~LuOLoZ!*~a7M0v|;s
zlty_9!Zl0ZDzOxVIk%N4Qqsdnb@?Xv6lOiZLpkR_JgP!yL~(+}9csq8N(n;>><};B
zV2IbE(${w_bTR`aqCDOBxpvG*g^QkI!^%9AoZ?giGcbyHgpVxWxH!GBe#bUDX}j=e
z@0G^t=cBidj;GWv(*3|^jw*BhzvFz?#G}3319DxbKcMNNsnwOsYKh12w8;&@=hIAH
zXt%#W8{>M6$X)Sbgs81cttQvi4#VKsHwF11^R|-u5)N70xcfArrTi8?3aF6J7X=OC
zB|X8g4TcAloD4`uAB5+OkwSrWI6HM-=`WQIemulpn2s-*y6~2_*#yD5c1uGv;&D8)
zXz0rjFt0&87&-eSm+_<#47|knA)vpiskgOtmK0p1N`Ah|PAq14SmV|+wN#$yePgXH
zq?Pi?==%TG+<DaBsR``83XucwLo;9oaQwnpuIP0mg1zUiS?VQ<U25xvjhph~%J;*R
zgBnAuKg15@yaeh<ylKX=r#0+@bro<gp~an(d3pb9=|JVzR<QOu>cl8{zdfLeiOSOG
zNHdWbe65CvQaWj;_L1`wy?34L>>3sgYtsTx83Zb9)LeAUhf~(OeAdx$@cQ2hsc(Zn
zR_AyZIv!jqxTF=ODwkI>x{0%TF@GbH`(^lNM!HrOREzwsIUtv^!sCX-T69EG?X-So
zDGaOX=XDdd2YBm`*~=eE?Ks%Kz1Q9BwmTZ^`90%jl1I)s^#h<dWGNKM7^c(q1eoDh
zsJ;9CB-T<mdM=d*e0Qv^|GGl{q^{6LE^j@;Ss+RLp@oNyM<nl4JrR>*PsD+nC%R~q
z%4gmPdvfxy-pzJePqSLI6mpD=mM@uUbNeErDGS8xS&{=8XO?1(5`oxVO|{E@+DLw>
zG@^#PF^>7d=5x|Tj+0r<B@T+u#qHOy%<R%c`2fk9ps9`BdF`cjOOItKAR=zRbbJ>^
z7bz1k!O!XM34U28V<=$kq9Mg6oEbQIynl`GgK=-aj}T-R!@lW$IFhOiMYP|bXcqtF
z0xBh#48N)S-zNACsHesgNArn{7`ur5CH2F618*zQ`J5<%pqEBKPdxJ{TANIvJVsGW
zJ&XNmRpd|)Z*(-mL@B=|m&QEPgW!QIeDzTuRBTkamY20i4V=-%#~l5D+#0A@a5TZs
zEyvqVba1n~M!`8OGY41a0SV5Pv64HQ;O8&&gX1z<2%T00%hway1t$2hZZv)Hz=?M=
zeky;DsyjP{BRCt6!9M^yj5PMRNW_ty9r^y=0eIHTh`=jpUjW#BHt%)R0d}89pQx=|
zIbW)VN<;@~<j>+BoU0VLncx&D69R7+o-}$#?Kyg3WAok%HRB;h==T`Ke8Sz&!D`Nc
z9RA?<<N1dBfBek)j1mA#Wd3x6dSII+>b8a;k-Ps&!TvK?d8?j!*IU_Z=Eg?k(>7!0
zlKI44x3bO-<G?iYDb-Wl^c@?Mt+<*>VlV`h{R38m<5Ml1%SDA0UGyt;=7}=9a65X(
zfQvf>T2f}(n>I!6p*v+O394Sea-FB^M(MvmS!r3AD1MF^zJsjQQ(*Y_Joa~!v@fYO
zLu+v^H%K1}O_0GSK#!`o(4QLC0`^vYCp!Nb6y7hO{tTodQCuqCX7r$i2)j6?od>Mz
z^O!KKQmgWbhsi96Z6@c<wi}5<G<x@-@B$#F@3KvqxuWf1lT)-?QYj;H`N9aP@8X9O
z9T?mEm@Htm!<uN6C}Co=;6eVd^9fhZ7I)^b0ad$M3(LU)`Ca`K!`)K!{9mTLj{zF@
ze~##pz(k*RNg72r{n!t`lpzz^Aj|r%!2IvpXeywLH5`1XB=UvRd~^0dys>Q;6}}tK
z6Wk+=%{EX7ejnx$)L0S?Mot-Ldk_YO$sV-qW+3vr4xC2@-tgE5oaXvi1n+S0c>w4|
z;Wn5~L2VR*v3QJ8v_T$TV5O<G2nSyMpa}#h%Wms^p7~2jf9Ff{vZo{Xe$$Ux@{_Tu
z>rMAAK8lDw_(QE?7WCD|?sTiCD8py;MOC1LhYCD~uzWwWg_N+&N&zZDHX+}tuJ28#
zx{{TJCotXvk(+m*K5d}A8!XIy`^6Lk_e-=tUaS;fLGU#cRZgMcR|%0kUHWOCyF}Z*
zq<D65j_A4AiYp8ERc!Wtw-B|ywFF_GaotStik}`RcdDPw$|cx`ckdWTzDhd!)p|%y
z23MP%(&ayMbq9KQ5XyC8j-T3>1})2<pT~vURatqqI4-O2B`^^jYbSO8<Hw!?Q`858
z{TtbFiBX4#D=gE1v}`I|fc)bz!_`vR4xEuoDSc+6SDA93nCvgc5cyM;=dx}EmD1YT
zau12?KsSmLnk-uO&t&Q~<Aa;gjQQa`ttFSYw!Sjhiw)U25emX(*<AQVT>-30&JE&>
zXd*6x^XnOn`}l3nhHQ}v83!r%+cK+-*_k^t3|m*b3Abg|XZjmME+x)VO~wo#@Qv^8
zd~Li3Qh<aZp}S{A+!n{Vg<_?p5mPl({!>tj+v)54+1`9D^e(ufiHS$`+~aFYOX^^L
z=k*Jc_Tj5vi@fpkt)l17f?SmG<JMoO`m?mZ=vDq=@&bC;(iT-vtC|qtN_f`Q(Ul@l
zXiLY+H{YIjc+~*{YkkkEl_bt@wm*vI22F@6#MME`Dd)WLn|H^-t>F~b$;d~>Wlz)?
z#U6iHn}MVKK&ZoOmV>zlliBqIB)@jjBlGG&(Bayc7*Vv`PfKdylEQY|g+|m_7MAGN
zRq2ix;S2RuE8Y#K4l7hA|I|B}f)sTbUK4{_Zi8xRe944g8=^|o7b4}BHH4UQHg$&j
zV<5xQZLKWA9<kG(Vv2@MN@w)*7X_2eaxYi6#R|qL8_C}0;uM=8KYdz}nTtLp%pJ>a
z(Hvw+u_aOD*2EVf>3JDJ>$RSzpfDt$eK4=SXFzH4^^Eq9HBK~{Dq5C9exnmJ`8gv(
zxORC@dsk5g-^1C!&47}x*=^Z;H)pX*mU1{X-1sJ#uA!*t(AiV{Q?cv%Ts_M}P48OG
z`Rj*J1?DoADz^#(b4*~2g}c;am!H!qReXrW4>5j+RokY!xPc-`)RJQvMar&s3f0bc
zq$;gn0@wS-qXWy1{Uh1^u>Mbjn!`70_S-KEX7vY8g^E;3B+(9??J=Nm5Szosn6p@T
zZDsZqPFU#Sos}j;lfx%OBV_C}ZHYac5!&9dJEfxLv{{<T7xBz&KpS0lgS9B}Ccec;
zl)^eiq3oiD^+;J`qjcQ?bP}}l{ZiGlRW_0Osjrh!F&5;9p1r&c%vUX_zOKH5<A2T(
zuWyb&z-$J-v<m(6<ey(74e@5aQw1x8*sac|bZP*#V?0(V-c}Nr-Rzm|G7D#Y-?bqi
zC1RUi-`;9b5>1frv%XMIPIJ$abf!fG=P!^?0Yoi8lVDKE-8#5*+^kJb<Eco5Cfms`
z(s?M#S7UC&=s+n)W-(uY`_E^F8l7u!?Upy#jute^Cx_sP&-z8@_S?Sb>Buuh3t3z|
zL&2s`-|7P;PJEcSVO3w@RJ-*~Y_^tHWpZbc>kOUrvz5fPiHW_ZGBax#)1v#F&QbZv
zc-apV=VL5fZpb?#>}_kW{W?$#NoY}d1;bm^gR@*D=<sYmX)e=Bms`fg2oK{A54G$r
z!*%3|j|W#7_F6Hu=<B%qv@e29-`z)5Od3I`GNwRWkBYH(%&er2Dk+Ur-x=szSNQ=Q
zTV!+W%`^Ncx;~|Df?8&>G-etkN901x?CV4oZ2Z{{lXfl@Diub&ydzL6Iq?BFMCG}a
zK6g=kx`d(5^QVPv&{g|?e)i+`NS7~7QE9w&Cr^-Girg-vb6jbD+gw#E*uLu0!HlKC
z4!}}3+C|wmK&4nnLg_{F3F777T=e2n^eStmm;04vc;?^rw)z=O+rGctpB**iz;?^W
zAH4IE@B3`o<H_e@&%XS8w@a@yEqYKCnY9=Ueg8nsHtDZ#iBomO%#DAC#1&`MLN+z4
z3=eJy`9?j4`R=VU0`IQvH=q=4ssFbA;&5L(c6T=H-Q!QsbBoIPh~BlYv3;4L{iQdQ
zq$aMMukF`Zs%qKur@Drlf4p2?bi0mY-RskgT9JQw20roYOmI;q!HlZpKCuSTj{HMn
zq|^q4Y*NTfhOBzb8?5@d67>?*r1mJ{XBN~{5Pza3KcJfm#PwT_j%dmDNJU{}v7GgG
zAChHeFXknNSPN%K;yr>ggs(n#;XDUwGq@ePhDnqqua{C!39OV)MtEK<8V@S%w4C99
zfJ-`cp}TNt>>~~2(3ljAgk|e+zE$L$H=5TaFSyuD)_D$JA4xOi8FYGME_zqOn9;iu
zBzFHQg`TMsViZR8D=`cwji-A;<C{>eo*tgb1RD);XTpzWr<`MGtsbpMEZnl~W;oo#
zF1(nG_d2;kz<!@RMJXrI?6%Oy{aw=ALe6sh!yJ!Q$9AZ9g5S00DZ<2p$djjbEqe9W
zk|5qFlh&Oxe+2%DaGJLj;x|2c3X&s!&v+d)a}e1JyyNjan&GvK#+Bd_u9u2oDNSLr
zIiWc(_bYoeC~)_2bghlS(93WfHeGbDmuazgu9q!1=40ZjfxY2TuUlI9xc2pf{LQx2
zdi)qw!b`@=X%WlE`(jmRSL&-BC?{j7&gVY7?ztV-fJ=X$<2l_y@Aa#KZvX1U6)+XA
zzs|W;C-7BpS8%(q$j?;F;Y7@#aK6bsJj>a_-Ce8w$K_6_xq6^_8h+bIR{!hvRh{cJ
zsJ*-t|4@-#7=fAnT!VMzvX13sy1(vE;d9j{(w?2`0APq{B1cp6WPK`kLa+kDXj=84
zIJyeR)BiJ0wGkre1C2@&IC-D;a$*5%m${WmmW0~AO;VqjEf`^w=?^tKzuP0_HdS%=
zFibB8Wo6Oa`#OPz(K#fOKH#AM)J6Y%L;M3@3t&X$>mM;6L(!6Bq;RQJk4q2WO?S}l
z*syOiM%vgb$;Kwi@co&Gti_%syjX)8_9xqbnlq&0pc=+T7vZrw;(qt1>y4e;vob26
zjqiMCCg`GtP2;N@6P&cE4yM`)za(AD)`RUnICQ__Fq9uxnYV&}-^_MYf>dNCW1lY@
zwgAHM?W}pRCGIo!N_4z6w9%qa`ZH9Q`|{Z}e}bH9IKmD)ge~U{O#^N9vi%J54E?Eq
z`#P4c=-g{ZDVy6>Ayd4N3d2JDA@Q<h3X)1Fd~ouC*zoPn<m(zDfA;)_-}+@Yqxxkx
zgC5z<ntRgquHb1i-1@{bgT+-yvkVkWaPVAFt;m|#7N9;}x8IZ+I=k1PssMXk%r4CX
z-W{A8W+Cf%{f?cf_~L_&8tPl>{;(9u{HPRT!Y|o%KKC!#m6^_0*K0L_IJP=0dWdkh
zpJmpvs8vNLPrhu75ZV)yJ*^cd!7miCqrT$(k;5hPX?D`H3rW}9DCsPam7UPPcNzuh
zquOOETLaTulf`i9d@9UWw;kQd3o+1pDlQ3@U(XPsheMq>NK?m)?a>{d$1}aHSpdqV
zWV0_*W9n=;8})Zj`-h0{LjDm7iz91O8{K|!qdOSuWKZ#*75yUXOli10j?cRQ%g-Mu
zYxe%x1>EC9I+hD5bUOI(Ug5|W*9SR6R_8+Pqazv)eJ+e7H7RJr=xVAa#C5}CG4C`)
zy7)!mFn4_jLm;<E>jGg3=;wOph$#EE&DmIQwpRHVJ1lacNGHMM(#IQtENrvg2@DqQ
zD+?0ctl*UWpWK!)-?lZggAV~R^km|O!sP&`a;5kQhn^pgzt<yp_P4sr-&6;kr5cqt
zb6?L?JNIML*?#@p0BCQ<-(UxpeN@~S&`>l|ngOvJ37-YU2H;KkSyIHx9w#Zgf@F+@
zja0XRKoA`K;Vj7W!PxA_t~35SDa14}+djX|PflISNvkw-$vX>T;^(Uopb=O{LBqYd
zL=cg7)p97Xc@i=eJKezQEn4rCO!rym`npZUkM!=qI^<p^ZFS2k2X8XM1P|Y5gZ(iI
z%|`x6mBye(sR`C^04H9bk#EXUQKmN|i{+Q_X3{>`CijT?8*cukwWT)nM=|t?{L*66
zcK%p=Nwmz$)cqvoNi)Tv>z|qy7HIbJd9{ac*>rm@3=rCbZrgBvARe3z5Jl{U^b{TX
zJRW@JeP?@noURQ@(Gn5z?8bMu*5%Ayt*IpR-m>@OSb680w82gX{o#|#gHC}O^-pg7
z`2J%sZ`iN?8%m>Ma(FmX5<%Fn0~3c5oX(FMjGF8R(OmOCpp=o>-{*zA^+evX<^0uN
zqZm#q!;R>Th&iJ?X<x_>Va>aE?vuPIbmO_18vDa{9LTlthSL`so)r@8@FTn;<a4N>
z{b|ouzpo!+yZu%X8+pRX1IUf=g-JrnAzw&C%6U`A>q7a)rQ+kL4$$=BS0|zMF(kV7
z=7iQ>Kp@fCsV)19H)3gNl5@^m4zU^t%=Bq`qW+BPaOUj91s(bAcQ?oX5bh+XPg43R
z_p{c|qh;KqTU8CSAS%4@CmLar9x1YvHB&$ZLLMGgCt<=0D97Kf78NyC^d>EWb<C0j
zWo_SV3eK%Xo#s;Az9pLAB&PHB&dHZz8uHE#=QGe$mPWGoICW*8>gCUFzV8$aRJJUb
zw8AND&<3|PveYdB5%-5VjLvmXHFI!5;!q(&?OMC+WVR8xy-`G&h{D1fOhbk9^jH<5
zAb%P{m`Wjy!Y<X?ro59ueY}%dP=If*VFUDHheT4td}H06P**}se_c>@Y2x-Rc@_3T
z$vPLM?4+k-a);hqv0!)uetlX{V_1IWQuF;4y22Ri?&JiCO1-+F^rWezjoPWeS0WZ>
z#I%gk!e@y`TSJ1$cbiyW)%$&T@AqXgA4~eB+CjZyyALNgK33hYo1x-gy;2nl{qiM(
z>WWahAPJbj6VHR3-2fv=;R~tx)0X)x`P>XtSsp-(=qi^A8h15IM+7!67}(MqwI2q?
zes-mQIA!G5KOSkU#-G~c$<f^Nnx!{7Ivhg<p_1jA?|Xd#BbGlNlARenM6E#%bZXWG
zakA;jZ_)T;jfB8bbZ>(dCBd=&g8-4s9!P?I={GhPP6mGrY7i!C4Ek7QkzN3MY`R^p
zFeG%Zrb5d~5OTjHnafPn5?sLsi}=SS=^LT;yI%4{#WrCc&4^+PU#H<*kCEN%XqU(J
z+fjbQlrrUo7wRh!1f2&sqqi7~7yD^n=rY5@QUc}Ma>*Jr-v>!i4Z%zt#V5onagwx-
zr6;jrmTkCVyIi(iaQL7#1=U8r?)7co$NA3uDL~J!{=XD1W(i+)UE`fouH9k*jA7u}
zc(PqgKlE==<gW->fb6!n@{g#u0<8MHUYU?7UW<5sK;A$pn<C_!Zm&KN=`KLv!BhI6
zZw6aYs&1F^zy+F;655WL?42Yb*cM~vv{Zed)%D>h<3^KhtqWgrF(N-EwKLda$i~%^
zqtscTfYV~h04*8xG0bf-)-4t`0o>lF+5gpz`p%M0@#5^{d9pAn4CdZBda^(7OP)J)
zCpT3jG#66LXkIPFaPcpoi;IkHF?~9jFVqib{6vAIQ|f8IaiHU6jYEB8_`N{1R1q4D
z_(`J|He?U6eSeqwAx)?UE}Wk%l<P~MAwA53L>PIAn-U)84g?5dIjY*4>m~9t1EKG&
zo5iywb8iXVyc+QDHbrKNlS%a7Z7fDa?fz_Bv`<kigs6wzvW^_$14XSHEWYj2vZe9u
zg>bh|!L>4paTl6t11|}7Nfi|_BI42CUR&f{e`Q1v+~Bs9qL^YhP20rTh@Q;Qx#DQz
ze9;;+M!vBb6$)rj?u>al+Cx%CP)VDmT%h~@3iyvO^gkU7ig~0VDGUZcBOa#gjko$K
zb8CWiaorOG6WhXp7RDGLvSRU|K4=f0QaY(x)6AIR(*HWtkP7Yx53VmZHBn6&Z?eGv
z?au|aKm(ot)?!(ZQ}Lgif<HpO@T1xb(~ZMOwy*KTkh*rg_jb?UX)j)BrzJl@z;C#R
zOif>WNBiL<+kOc?SWnlbjiH(!B+E@smxnOvX2NnsFy?0xnrxBhw;BEsOa5nE34FE*
z1`3;xg$dJyA;?kz)YB2z&+hm9^uuKR?q5dEQagbC%!8Zr;hjt?=XfF%6r=#F>vfon
zc|KDoc5CZyZxW8WRSA`!1vDh5pXh-8*#Pp_+6Q)n3C|sQ4m05UyIQCPSY4ku4#p%4
z9!S<AM0!F35J4X{Jvi8otgctS(R9ZC+4;;<qyscQtFBZn9>o}cmj3^9ui0@OHA}jd
zsUAjds|nicASLeER+X^i-qI6}Yci6(m>NwgPwTKgmjI`P68WOXFLGMA&0p=-0JqA`
zt_cS2mo$}?qco3uHDbQ;=V}rNb7Mo$UXxyZk2fFG6SPF3QbBCW_ee&A!obd*lh&P>
zi7mmDA#k)U1rSk_<PJ4GT69G!mlE=wbdb2?eGv2{eZtJQ4)e3>)3X<^w||d|X{WeB
zpJ7GQax?f7K2lRPhI?f(Qk3})+Yroy(vFrhGfDp2bR!d6vv`pwu7e@Fj~_l86&S7R
z0h7k2AMf%I{_Snm{_SmbBhZ6Pve;VsRBYRnG?LBc!Wtv#K=xK9O4se)MR+vlpq@lM
z8K{v$HGi;J`fMtmSXrzndOMYk_P&W`#~CiZ4`-ltCjs~{+_*86Pay@pQo;s`9)9GC
z^nPo0GV8dK+kj@OC1Au*sU(K*ghm4f8Y`y9qwHsJ>5LbspMhaGUZXhf6M}{?(WMF!
z5<P8#LjZ;PW^*>nz#X9tTHpWwI8Gn;sqsoSNY$$T+H}5dn!ifJ70>&BmxhmWq2GUi
z^Q4E>H3?HE(SND9TV9U0iaS6dn5_+PyhUGV*_9_`!-DlvY8ZuO2XYl$o2Gc7#8C%4
z&J!rGoIThi$<f=tc{hx~GEFKR{h(5fE6YmTUZO=+LF$%>Nm!kqId0mTLev*qiDP)E
zg=H&I9ej{)l7p%dC$StEIzieJ&OCggdXxV5b{&%R1?C<WEzy4YYwFp*C1t?6G6151
zuBTm3H&3@scT)cv_Duq95uB`6v#CoEpUt#Ve_>$8_M%RpHZoc=7SRW_Z43Sn|LK@A
zHrBX{AFOcxJgID4$F%!p&4j!13bmyF*XHTJDh~htlK$fZ;M4&Mva?($^ZAq+M}tG5
zA)~}iqu?&*D!}t9%B}eVe@j53*|?MQQ?vq#E$oWG$Jo+J+T?DIk@pdX*)QPIfOmpo
z)*uDE<Wb^50Gwkn$M>uokO2Nrb?7bcTSvUM>bEHtH4fC*g<ifCq={i<YblA^pmixV
zOfML#;40`>ae*K&Cm2%N&1})U`l<(&{4+@X`@I8?q-a3m)VgP#Aqk9@P6q4^THin1
zrH)n%Jt3&{w%{QS!?{YAH`U%PPqj<)6fBifx|vg1xY#;yZ28V6Suq>8XYJZ`brqAE
zv5+!vn-(hZ7YiV_4_ay@VZ;U)sMtSeX>a>C(>`?ma2sBV$G?*r+t&x?eZwjgZk|5*
zMgc5uk}WyLxD>_tRAbB4`}$Vf@kgNv*+2#)-M&!g07J0J{|U_djs~N);N|x<XH-sP
zEnS|U1FN^olktD-5MZNWtPh#AwjdEjYHlocOx#7zE*3&%uv(Y@eeEh{(992oL%c=G
zEgJ&@9m~HJj*ounmHO(yT=w-*;KL6rPe<nOINwbj9iebeFWp%k$Z?&)9DW`_od<fx
z&}y3*mU|nrFaFwMzgEw{QO78$$-~C^6z8H!VlJq&7i#4JG4D?$8{5x*M56YwW7-I2
zvJ2QGxBGZ4WP|j;H)c%Eb!l+%0L`G5$!AkmC|kN4naqXLWDxCYNNnog2dV_SZ<<m$
zB~YetH$Ku?Ydy7M<*e?yFXpuNCy=vL+}r;$!LOMt?_5xO?~r)vCOY|gV^eUEL04sC
z(5p$}-YR7?h%&EbU>Z=WEi89&R+e2%2j}#=7oS1ODtC^$=w;SYl}<e;gj^DA$iH{B
z5xMg{N+w)(+fU4<=ZE-1Z^ATSxzE&S2<(=H9DEo|5HhO}8~5x0^*#Rlva2yo*C)^o
z&6ePIq(ay1<1W}1W+t{{hyGDt98*elr&d1F!UYO8RX25~Y`_xgwpo1w>z4aJ&^iS;
zyG{;M&0QPGK&Z#O9;i_jYJa&ym59({se=dQRocP@avN}%w=RwOyy(K9`@&gTHk^1;
ze@5(GdC}Ca#pa;l!HYjn_scDZgTVvc6K4;<Vuw-6=zn(=q$<(Pk5_8Q><7Ucgr^^o
zhtdmc^6Ip*cp*kyW_!foEt{0JJ0{Z426|fqRM}AMor${-3pC^&jMwe4#wsr-JgVV1
zUnAH^+yk+cjoBpt4eOC56Q)kPaAQE&#?*42KO`Qa`kT7>r+ZadnTf>mdS&O`f*wGS
zoGj^wMB;?+y{~9a)OtN?`H!&Ek(d2|#!=ihtoYV5pzLZJS!^1gflh9Fq0+__zMx^>
z9B7+t=*f?A*`VgVF7*`1YK+8#qUShNlXc?x!HXKMR*rE#?Xm2d%x$5V*oIEErtoil
zvooC9%sk17c!{F$A4jsc@sx-?PL{aBZcpt~Dm^x?%0>>_`rD~Qp`5A_^M!*=UW-?4
zbo;AQ5t%ph;oN&cvZKmJgdCyb9X8t3e-x+$Jo^q-NUGpQ4S(A{2V`}s^T4Wzm2-1(
z$ETfb$Tbjbd|UgSE?VT?T{*|9<+bI;m!A>>RoOgztm53xdo7phjM&bZV?OUTO`{*U
zu0A;nOm%rW0Wacmk6@|PljHE}{^qT7lSen<(HL)%%XfzlH%@}-PPzka?ii<@R1Vui
zy(~>&0_|b)v)3(bM%*ljHA_pIi-xkdI_18<*jfBq4s~Di-Gk|8Kkkg(3CNz#u~oME
z9^+9#t?^|r&qz8U^f_R{pbBL1RAv;r|3S?9%g>706)|sOO=NZS&gxjH{f}DjXN^Va
zd^K{!t4l0wC_Lzm$OnsBPhMgo`<HMGL#>w+)2NWzQrt8Z?hrTU+>G?Y6Fd4LhwYew
zE^OyU^*=8*M~*xDroQtbHWBhR;Uz)EHc?@{BH#sdCw~Ov!CFU6iMq?}`w`#XH<mVu
zWg}*c9B1E@=GM6gB$vhx{V;MI6VJP-sn&8cr$s0gZQFmbB~ssijRQcP?a$2U%7bSH
zF7#OU)1u?DMIj#ULA((jn!B-$j2dD*hFftT{@u1Faqgscymo?=WTJat4nW^DY6PlR
z=qpS4d`yehg)dk3SPzH4zFzZ~w^UWR@nmPMi4GmWs`8U@PNk{8S(+QX<8z9N>}<0j
z#Y*kYm!1qS^gDssXlIBsaL7mqm0nw^a2<I#Qf9diJ!HA{9cx*CKoxQ`6U8Fnf9qt4
z#t(&QuhmM<q^I9FLmKy*>E3(SE$gV&C~Q|0FT`Ki4(3C20yQAVaw7lvfx~mB&QhL7
zUnksgUn<Dr^>Z_5IckQ#=(y*f0Tdm>s&{uLfw^esvJ*WY#;%R!sWGao-6Ee&@{kD+
zU47T68mODGO@>zGsID~Ah!LS^t=(x_o57%)5k-E0w<u0~)+O`Q6(`|UQ82^0yKznb
z<yYHLF;LC)cZEYTE}OAj7daImJ3sX%d+}cw8@Bee6|M(w*Lv+lkgt+sc(iV3hhIp4
za{IZwk?z{}j%Z<FUndc3{*SExNP29}`i2N{_Aqk~^v&IP7WpHT_!$A1y?6qQCA6ET
zc$1;(fQDYT5&GpCA$ur~r~YM6>pwc5h4=geNGo+U6Z&Da#kc*}J7PjVTzr|r7-sf=
z$a~MQCbunWR1pO%R0RYC1!>Yj1Qdu$6Dbjp-a)#65Rgtpkq!~*QlcP4r1wscDqULW
zy@w8=1(JL(d!K#w_I$eUbD#V3{tG<H%3Ic)bB!_PnEgLE<~SorPHQ*EduN-n(C46@
zz@=e(k0gaUG;=lpr{8CP>0o}Cob(|@aFseFu4jzfAPnFCXyu-Mdx7q=*aOMAr#yQj
zSptD;r7V%ys?|dM%X%ykM6A##p3i;XSnjSQZPuOH&v4>1emQ2dxOoieZagkh7k{|0
z>HeYo!wn-=J#&HTO#{jFDl4>O$pC80f2X%tjL87Hsebv6f_%Z%8}S<5S=xCaoK`z<
zocOgdKGX>R*ufEF@3qREh0f5yXUZ4!9i@14q0-6Z@^kZ;9k^qa#K4G$)x_bq-e7bf
zb2aE<2qI3ut;BsR)dl-<#((g=yOh&RmT6wiB+c7}+E1u`g;NWS+piD0{dw4y*gRqJ
zRT|U*#z3FUb<m&;X1Py{tj>UatC>-xJ~VQG1}qsXUPr42cgG9fZzfwk>6oa1EPj@%
z&rVO$Tl_gip@>c|!#+QR&XKrb9v!Af$!jOXwpL%v(O}@<3!un(3Ob;Mm1Y`WytUgc
z9)s3i&}8DPX!WB)=-8TCXKb@8q+icgq+MzPjP1w(yhR#iO%pc!YC-c|IF*dlOpM6O
zC_ud(>TYI36}}af=-P<xNr~3pdi|rK%`c^V?7wZ4KMKgIua&F%k&L=co~f5UTBTc$
z&=xi^V81@AceW9HQB9pw`6@({SeyF#Bb4o&`%b6W<LRJ^pvZx+5n)vtw-v2}p0D7`
zT6CXR=x#Ii)|Q5I+UN`CCQP+3snRVr2bP!`kZh%VpE+q2vg6ux3US9DyR9$JPgpQF
z_AfYZMfBfY_CdU7y*lI4eelh*q!xsT^nj{vnvGpK)|0gF$TU(t&-S&Qa+~Un*rb^?
zwZB9SZ{lqmGpxy7X<os_uE4$mLZ2$ZBp#0~<_bejn5oV~?0(95c7A~T+?Q(V0i^K<
z*RoRDGu6ACzRkz#A2sUqIQcXR!l?XgVqmey@n|I)c7conv`B^kNC<G~tKE!*#XoyH
zsdxL9vamX<UYML-JZB@PMz)brYPOlRZkA+65tV(C>$Xjf9*PUV22Zs(w0;3gdI;9Y
znEqGAV?uQ4fyvU3ocbT1^y6~rO!`PadB4)NYtA$nAJz|Ai<XX8-tTuV)Iyag&BGqN
zz1nC=*5O{x6Gw3`tL2NB^IVsO(w$(Icg@$D`K}^t4ttgsK;!X^t8F@sTB<$U-|TTm
z6r{k*uEH7VVWo;QTTQNtvFeiT&rPvAczN%0R9V?LwxyVZpuTdX0XvGQl8s0L#;~T6
zTw+LyhkQK*8t87NFXT-)#SnYVw*_4l$%tE65)3q%5M76BOrG_+*AX@&$(bU-J!a5l
zme2T8_|efPcD^Li&5etsxz+e+^l2Cde0X@)pC$H6s6(bPe|$rp)`*o$%<ZRZfc3rJ
zj7w^~P)YHfJeF~GpXm7aHfNj#g9QXKF3~icD+$n9$Zrdu6Y3}+XEXYbKA!}D*y#E*
zR&q}qBxL?_knjt*A?UU~=ECVPUHsg1v>|YV^6j^b{WY!HexL?Tx4U|C$(dzyb-1Wk
z5hWK&`<AbiiJ@s+b=hdtbd)^LAf>qv0an@{v~@0<5v61p>~-GQ%1CrzC<UmJ%U!-N
z!?cZo%JxP$m7y1AY53+9ZNvP@Yw}@Xkhd&v<yl;x(=&mNBbbg@Uc9I*I_ObgR%Rh>
zsZvgm6xu?Ml)QNC*%*}k{>6wo|DKph-K!aHGugRy)79V&uzk)3?7F1mMAD4WEQLFO
zftA9v-KweH8mU@tK<geXUltZ<^=U9j6JqoI!h9q-RVUMTt)s)fs52ka{j4iVLapD3
zX>Sa&fywPC$ou3pKISg<NJ&EC^u)-r-S*GG(TR0Ocf-3s$Qo}>UypZymr9Iw=dN~h
z>n&Jwe*FF5g1_mSp3JeO$1{A4KlFg!#S^|p!uQP$0au${q7NF<&63_k7gx4ciu3of
z<5Y9<!h-&52=U`Sz@Hq!jy4qcdsvBB&pR7$0u7hrXnn~Y49#>M*PWD?*kLsTgLkTZ
z+n*eV?DA@o)?09O353fVtVZ<Uq%KvrEiDe8;{t_xpzrpYsxRTHn!mvnj+Ud4#46!b
z=bUEJTDOU<L9P+zgmsWSug~;bD<y<kg}NU_mP~Z6x4=4h;m!2RNuQ_G4-iPaCw8;q
z4TZF%VN>0}MaeOR>URDr1Te2}X{w=q*(&K8c&Q6KXfx(BIN7K5p}py*ka>jEjq$P$
zikfcFzRO$*YyS>@4oJ&Fr+b*3K4kHxK=H$kq5CuF3(l-V&MN-Wvaov}!BT4-jd3(X
zZsQWtH9Xqpb-@%#v**cCPP@c|Dkh!tW3Gcz^+5-w?onyt4nHwyetVQtizC*RvvfEr
zlJ0x^s4Ezy1?OwjozxBR{ov_39^d7x4w2?1rL=)>Ix|0{g4KMI&qw6G_k9e|ITaWp
zmsHIzb}Qz0Ov7|n+QoGEj0E^iW8G(NqI+8cm$H(wBfl_Jace<5br)jZlwe8%;#!Y7
zfRi2t<RF(tYM~<qEWPW!>Tt8vS+B|nQ_r*L4>uCZHk7Cy`p=mOMSHr@M0VKotS+$*
zGfIm=f{I&TM71zix9G0)F@4|5*=LS;Q=7I%{6S9;!$27JEpEqLW2L!-)*#p~$jF9o
z-Znx(YGYFU`Tn|8YWanY?foed`=QGVx7?UOvZ)EKvRa93##^@)`kw9m6Eb-I?my&>
zy7WEswc#&nY4wI~<4qL#RxN?XTnB#1EQN<nuUKrCMSvlMZ1hSb7S|}u=S}!3Fc)4e
zq-D7*3JQ5f!-agDx0Hx|=6{G+zK08CFog|(X}lkZcd7)(L=!#Erc=MjM@D69<M%-N
zSaR;&M<peG<@$VQo|ITUJsDo1Mjovr)(Cgyt$qc-W4@sA?`}ngclY_~?Mnt9HrlIx
z&k?l}H7(K0L3snb4(fIpXg;e<I`#0YCe}$w_q@GQ#fRCR-VfWWTbyIJSc}cXm-Ra-
z9TREZ1UotyLLfj_lv?ROyP{57ApbCh5qUf+3vJxou?~aL2O~Q^8EY*>!nGjBl-+va
z1M=EmZ{T9Y(Nyi8VLH1uyBAKE2sIyge2-F&Vz5*94NpM8;DPlw)ztM4|Ir%L`YABp
zn@@;=Mh5x+qBrI_Kkd#}z$ivoH9$nnf4uFw|B&R>HW8StNwnh?3%+KCumUsD7Wy=H
zfo9L`=`1Z{PS~uAqD@|=@AL>o?9UPCAMp4IhW$~K=<c#U&>2#cqkZBOvlnhdc&oN$
z2NW;`jrzewhf0b}85Tx%Pq~l;BDm_Ix_Y9?rIo9FgL-6*F}tmb7kz^pN>DJRze>(u
z`ae9O@$=kmiN%0j23&KX=okC~oHel@B)@hW0C29&j^0NJ_9ie~mfAi>#!R3tKFU4I
zVC13`wHwfTL*xkA)l38Kl`yON-zdmGU(`Q87eD@ZFnrlggCI*I_XknZ!PgnB*B`mi
zMsIE)OqSz3_u%on3nd5QIf?MOd0_w`PaS9w2k9~ern_Q>lkT)<e9tNgTh@MEudRfm
z*LqS1=*hYM?V@t1xO~4D@L}2R&SU#Qb~!MBFA=_z%ou$06x&~fNfVk>w1BiuvaxrD
zO;xUy-FP*_du}e$_^>!dv`vxeFh3SegV^OB`UP|MH^1<a{p58lS^A@iuFQA2gh~}M
zYeA(hv_SdV0+S$<-$eO>owg_fkg+udienFklCCf822HyZ{MCcfCc{K=SnvU$F@lKx
z)fv<};e?nm#F}@M-`NG<?kmwW_RPf$Vzw*p^Du1R=;~d3>;5dLjy{+&@JhF(P>#lp
z<nxxQ4-1^n$D*jyyytEp%@P{4wSA1Qp1$*6eC;22>VKXZK<}S;e0A+D!F#1`EY>pr
za088%DY5>_9(8alkf{ItD}~p5cyCC@bURDa`$V(GEOMU(5AFpWpmk*a9Xxhu@BgXo
z5P0L<GzbQxSROr|54T`0S~f+?fNx9B8!n~mjFCbdfa6S<$99$PeBa$>;T+R2xWWB_
z4?`+Gxv(!<@ZGgcu<yTI0H6YSc)!vjZ3#Yr(Z)QjQ5e3rqh4|2yIC=By$+WUJ^cOh
zQemTE^0vj9wgx@k?guJnpNpdqUfwzlX*vs<VBf=;r*|zns<(e^bAeYg42u61X8rQ^
z6rd+^XjRn5$SdFdtU5U()85~pGs4B^Vci<FlH?TcJY$}tZ1+Xs5=tmfd;pgFKH|e*
zbDlfO?wW@Z5HM($&XV=Z5GjY+48J0_Kuxua-FG<lxM=52)wH<NlZ={e*d76l(<owi
z>M+_r6_Gy?cYYtpZUZ9ANv=WTo@YJkK;xtG8Ggpb`$m_|PtWknE92*G6%m^>JzllA
zrhVU}O%dLi{~);bAo>kMh=mcWAgi<8Zb`1<2`%&4D(mq_yE2DQN^!>&T3-Wl#H<#(
zlFxV*{}-tEpZ#5(^&i(xC#w(UQGYe2kQ)7eXiO<RcO$=n{9XW%(?nLQ+t*Dur*529
zb1@v&wMu3rzq_>Q8dJMaEmJna0a$)GsLbq-Z+v{QUIACeOZyzXE#OR{zFPv=44k{f
zz!V{ktx-V_{S4;)m(BpZAAi~9V&;K#Ns1>^MmVdz<Dt{K1-aX#)SiR_a*a2&pN-IV
zp;IujIQzk7)3(9$SfL!FJ1><oq`q>PGdpLT*m<%P@J^!-lKZ;F@A2vgf;!+Jf$JvZ
z47YEFu|Vz0Hzw{ijEasC3R+UU0^^K5Z}1w|X3rv@I|VML90mUnJ6}uK8h7*;n}|1Z
zos_C{1M^b)+f6@7c-AeoPX-_+WTO`uQyLc&L?%fg3mv%^cm66y{tioj=8=y{_tWv;
zb4U+9>jGSj+}~V{<W6=^`1u0;UiBCj_{@^|+>dXg283s-48R}}Ju^X@uZ`Au#jQh6
z9e8I<BeBK2ADd1rL!Z7=;gN<lz=Q(f?#cqK3qu!nUSF-sgu}K9jGCD;u+-r|<IS4*
zlLYFc_A2mHN)-VZ|FNF=v>ZzCn`ToJTpNZ&3F7n0N-GmYx+OWiHvmKO*H&ypCvd(N
zuQ4;T*Xnfs;KWe?60o8AI+`N7lCv2KCwxI0@O3dudHS;{z{p0Qi=3#}!vyV69eS}6
z%|Aic|GoY@@<cIMwh=a1qvpa@o(S4x8Z{k;TRXzR1=eu~!I7_c*ED=la~=>J4OE(g
zHVUq_3z5>^)p!Bq)o_u_IlcRZ)p?y6vRk1jv}|sONcRQ68{u$BB{7CeS@KBj5;jKE
zgPS?b+vC!};JtZ>jUVzhv!BP#g8$_BX6R-`D3X4?W-%iF`EajGa$_qeoQg6O*h1HQ
z_p4SK<`ik_2}ffVpS1HPru*m&s80m&FL1jcRYX|#@f0X9XQt#Lk5+cj>lJwY8;S{S
zqMj_bjTc=YsAL#Z1?297qcS8;Lh|?r&L)MXtutpnBv3;YXR_3XaEuqWP(K(DfKt=)
z>BX-fOF02fDE&r90sLE)p+K91@Ypee5Xu=F7iYVW3>d};NNzQz3AHr77_qSu<sse4
zC2R*@XwaOjmgEDWzs%N8D=^VedUAqObhHQ^6iGBMhh6vcZ3n(aZ+s)!xFk?}U?9%g
zJn1%>9NDnVMT(4ZZ1^8d^M3^ler}|5*tFuumOU(ocFVoj2809GTkp>Fa9(W>j0ir}
zAt?bkb4g1C_1!hQwPKfDQi0EuSc@`f<fh=;6*Z>zNfWqw0mFJ2z`n4+n!TX-m@20;
zw5LT!;bP8$c^SqTGaT(qN?edl)%Zuld-!9M=CHwrwiurJ1^wp<#Dg&JIU3WkPO*UY
z+83tobJI|N5mnH=nvs3N4*Dh<-wn&XggoqYZFOrVk!Iph@#OPf4uxMB#H}LFn9G_E
zPY1Fj=cbw97YA{IN$xY5=||p)`t2o`tO$J`(_%=xZd)jqlx4?I^tR8&J*nrlhq2RM
zlU272e0H^E@>Dznqf+xeL|Wz5Q2Miw<;kCBbn*l+jjXrL6v!2(a~J937XT_tR{Yk)
zS?{%y$%}E&L*uANz8yj>h>9~5;<tgbG@JMQHuMtcU}Ga-AMR|qH15?0z`vbh1nDu)
z6_)x{iK4Hl{J!7pgqK83S$BDM)o!;%<o?Ir7W$bqyJE{Z{;4IFeK-EWp9Ev-e+WjO
ze-MnN@*H)zvKlXYh6$scmj`=gwG6=VZrLSny=aSgomQV*C9f1P$(c)=cj4VbB9AP}
zaRRgT=z*+;l|1mJByncI7Up(KoC1rFpfX@T!~l3G@g+Z;AiR?4Ew3m!hMg92E9yLl
zpr|<-zcd&KSR4iPgAS$|8phoK9d*R+;r;4B=2}ol?NNqzjBx<P<c*YDMwFJ_zC78w
zMI4g5bLOTSHTzi??S$p86SOWTE;iqLrJbX9)yR8#IKPSZ?77v@6;W}u<Ap?#dL$J8
zI{yT!6xeAOKvHVS-2pe#wEix&`(+US&=PJJ?XCttQs@Jk#(}2(yy}av<^p~GV-AJm
zdNZ=31D($WfJqUqj^2;%ln(!9>UXLJNwd6=KEPct8XlgRceh7#yQc+wkpd{9B>|-m
zTEx-r1(9K;iwY6v{zR@(&8^ka(J%QMz9i`y4b^&!UD(0A<xp~F$(u>8dkV8;qx{^y
zeJV#8wXBmL4l^n<)0-WtV2^RJC?mIViu$b$DG4KPCslx7bfy<u-(PMc-Sa%&;*6V5
zx|V0PG*P2a`Sk{Tsxk;L(m>d8Z$jkc0LHPGdqOg|5NX+oc4756LAkQHJa^GoX!#A^
z)iVbT$~-R}{^)Ms-1G^8=u+HVcq;h1=)c6=|DH`O0S$T&eGkjkosS?|Rn}UFm0<k^
zqAO0A;BQ)uoW^Y9>h|YvHBYtUzJjH<-)mG9v+RAU{Ho~9jBq`On&<R$qEt4$@~NAZ
z&qR7smMJ!b^~d>hzGkfr8Q&Xp+LG_k8gjGP37MUApLt$ga4!Zq3n?&deTBh~TUjU|
zBMeD(ek9izENetXd?-h9tJbN=#W#PvSQDKLGg~VBk!MVJaj2b}iw#JMmfBB)hjE4=
zX(v3ht{?kO7v{w^?X65ApI5sczbiZ3S;){R?aYxgNI6_!oIaW)XjM0qSyk3fzhS{X
zI_Pq%O;P27AcPR%`ogLd8=`2bX&Cf)62lxaFSAuT;i(gU$3DbBWn^~ZsP;#W*ZyX*
zBb0Ao6fp1dKf^|o?R7bx>Q(E#+Y^bvY)U%+ObyOJPB<oWisSm)PX*lH!Sehc9zTHT
zQ?G*K+?muLtTyusS<(2`nmYP|llf1&U}L<&<V_Yx@mwT6Sim^1#I`k4XFyxB;wb=K
z3uy}zIcu=$vESg9e{k9)TgO{?o2muy44|JkCGWe7UQ$yXIdNnzJ;zozUItiUJ-zGX
zH5-mpL>L_Ht<eGPM+Vet`(Mk={3u?oFv^)d?^6*AH@^4waAz@n>(1y!@Sx=92V3o@
zk65VBk&p3)2RyHp8-jG#G|a+4{WBw~Y8^EP?*-CnYJz(68nftW1@xkG&8J2J*&>)|
z?hJp{ZmZa+B?*A}9E*6g_Ol3?Aq1_~lXO<5HvtoyxD-T+Z}os3n@OE3)iK3+Q;+^H
zK97OULBiAv&uWbX<b<G<QKXR7Ubc&K#pS7ppLqShtJ3>LC&tT<2BWpOuSL0D(<D5D
zEoH`I2J64f@F1)qQIzdU+9AbZioBH6&vn7f(T)qmVLDRODd{dWX$B#j0lR>j&hXMF
zy5743R@r^u4v(gwRmUT+r2<!XA{ObzV;7Rm_w1p4io+X*UYhX|JK@C}oM}^SWYYq^
z%ZyuR=3)cL@~*5C29(A<T8tZjk~ML?8`ndTM+TGLzJIViKN*GyoeY^-(l<4_Yzpx@
zh=dZW?(YGFh>!K?HMcS56i@Wl<=!#9_38ODBVD*9#KS>%xyD`#r3SvTv1rusBms9T
z$*CEX{^0^`2iWYk8<qCR#L+6t#zhBD+qfg2VM4i+m=-^G_(r9jx8&i`a()Z5S2{r_
zLnYCG`Xh_?REmq-InGZN9A-0(+I=Lb7}_fHpK$-b%i|vm0MlZfplBY(S2<gF@F*>8
zyqC!bqs)9;9c8V|f{SwPl@tZ@)ZBil<jL#QYqLe8;FJ8YYez6{G0O6B7`E3SE$f}Q
zYl!i-BGywUyZ*U4D}Q^jJYys*HXLnH5+I4OVc(<X1RZ{V3lrD72<<+wzUB+Gs)QaK
zA9gMYS-pgAXD+6Bu@%JhjqIk<8A)&+V?s>V+O`~c*9WrPbZFlW*}Ba-+m^ntdNGZp
zTHlyAPQ1cXUYcI%v<q~fw)bU@N~V^S46L8ClyV~j&~NSu{cM8jPWIZy4nk9K>dfp{
z-N9T#nnYXguT7&?zrG9M@>A9A8UA(x*UGiZq-^`Yycjfe;|o_LNJs}&S$~oYk}N)O
z{~^hKY)wA?o<8^qbzpE)5L<u{WGOiwRX}U60Rar~=fC@4dgOEids-B-Z;w{XyCB(0
z0gwFDn|dFcI(Q@!>*F;f`2x7wL#fg(3AUuU2iG-DA!rljr`Q8Lu-j3Af$lT$EzvNE
zFsFU9#6hdBQa`FG%nL{W>4yuSNNaMgYJ;8@p-^|kx&tS3P|%P8>axBTSE|n7Z=a1y
zLI{q3gLD5alK=dGzVXD#g4mPoJVg$(ivn5g()*4@ET_3ykizU!Uf-D>Rh#s;3#<_s
zaE`W$i#j$Q@bXqD0UWu6e8XZZvjHch`6oi`>go%+T%cgVMqL!3{#0vfa=7(f5^NMN
zZgipureiHb=SN6qREOD}9AuSNkN>hk`JeA{^5e%le|TWbdk%o~zrX?j;otHa&oyde
zD!^gfY_mO3Fcd}$Z`AcOBPWeVQOoeY7H~SSm{U_-SmHt48D9V_ZFJ(t|EDA1@6Z5%
z11CeL>;nfuv&`x3h1%EhbNY>y@{++*bL@Y%_XIC%aEY052L-h+8w0*asC+G7dsS&v
zW&p7T;J7r1!V10pT}u2TL+ai9q4h_*b<A#$U5}Xu{Jr94%$rl*1d!L_X-93%g|#c!
z$*x_v{`xw3$aSuvD;IQ9BQD;#{4{&0;GRgx+wNTPyLZJ?&E*Q{KAh(5p<;Y}{tW3O
z&CjI0USw<f-L;EQo&C9qM2I7`gTr<;a#GqZ$F0U<E%5Socb9a9&2b0YD(epp1fP6S
z^~P)5oq!tBs{S@3bRkCo4^H1ne8zcv9eoq}1%Kif{DJu9_0wdJ?h{eJd-c=Dd~qUg
zM~xE2Wtgb1-fp)azDK(PrUkVa*LC1u2`UWJIT={BU;rG?KzV*&`nq~=v#D<9m$E=|
zF(x1!O$+nxD8AbLDw|~i4)9iKX`}enA}33m2oZZ4-xA}-6=*w;U``ftbt=Q!2|O>p
z9~#98p>l@E<%gFuQpJikho7S~7Nkof2TYqhX2f1Qo+@z->g=mqMObx3Gg_Zr+QQC)
zp=jIxy_CN%kmKeLuZQ%>MFV^-eIO5=D~aSd$P?)NMeDpCV+cMhsi^2dPqhCS>1ir0
zwjaGg67syU2d@;(&CDC$1;Tu=rLOPaz=!%dI4Vw$E)1**9nCr(6`_7}1A$e;ls@kJ
zzi?@?j-FkHdqffKrkYOZVmYnaC6>Dx#-l?$P_83`dI<vCm-+li^Qc0KIASI6L8Xo9
zr`g291tc2T10!+$IeiYQ-uz}G24;n-<BIzy?&bZzThi|aSqB%cXhOq92LQhM>G9Ti
zTdo_6YXaz-M2;(Iq^<O4QzaDu!zOUw9KvZvw?#oZ&^$?B!1=pX*k)ouWo7lAWiO10
zdD61;k<WHMrgGek6m}|s3=VLliDWI9u%B-2efE5lZ$uLRd3m&+5-o*W$Mt~dP##&v
z&XYd4f-V|H`}d;FLAh6PQDVGPcCH<jtEe?Q=QL;r6g4+({`_b*P0Xs1I_fwHG5T4}
z?q+1i05h*#P`G%z_)rjzw78=$T0Bg2#@?&E?lX&ML8FMXnuu6i0!_P-b8o1QzvV^v
zoj0Thpcs)QP^?1C-!HI^4cUQU%i|;X1Y;cV+x$XG>)n>1f~Bw?hS@hHwGXa|R&ukk
z0;4Qsb-m{<qTxADn4H85dY+HsgTKY$?yjwrNYJ>ZAqywzEUV;jkFGy35IUxpUbx)$
ziADiJp3sorEm@)?!Wj|jy3l{qts1}lO*|9WPN~#=zkM=I)Jr~@W1lfCdM>Ou5r!q<
zK9CnKElXG)k}lR<=}4tFYyBpkg84GbdGQ&5Fo;Qv)C;T7VPjG_&gt`IhS<_X$*7A}
zv?kaR^uA{KWC0Th-g5kM;{xv;Z^Zo#rFqNO_^VPcov=LETiTP&)c!l4`BQnnoid3)
zh9kJ8Q;1Ye$?M+2sX$IPk8=*t#aRlSqz#Q3M%%55Dl<XfIM85&?J5({?=I*xnX)YK
zc5ez|XI)m{QEQV(piKZ(e$pl&<v&Fa**j?y7!PWiE8qxpBL+N$SOPCJma+&*8YVHX
zmf#>71LFfXB0{l4Pk{K)NXiRh|9hMMw5DG$8774?B^s~8!~aK<fXyx}g%MX$b*T06
zQuqO-RRToDKnQSNdg!4bXh$B(E)c%`RM3kmL_;M1y^``M92;x_8;L>#M0j0>;{P4!
z{#;guIv!ZTjz1WGbuCJ$^d_$7S=zGj_7lDjwv(*2&5^IdE>DG+gd(MwybeZq3i>my
zZY?(?`8b3~Z4WiT8MZ{It3KoG$W;EXIQrLB)jc6zSH?kXR`RTKtiKxc=%#hP6a(3+
zNd*-WJHMm1n;B~8{*dJ}=;+;Qeocwo?zo@G))`%#xPuKUz(yf&;xhAo`{k+W1Ma)D
zC!|6n(t-AX1!?(l5wQUVVD{A`YI(Cp6L0QVg*dkL1#V;VcX#K^>@Rsz)1)Wgg`nlg
zwatdX$b;D|{c(-vRRlSkHoD(NJ5(*|@2&JdX+iMfpRVYf_C1UROYb~RngcBPQ9bfk
zGaDWyYb|EC=W<9po40;qk@{{9a#}Vv^to2D77p5)<AhcEGz>G4RXiYqsGU+0W+Msu
zs7zkFcdEa6viV&@_|4k!ymfvS7SvvfGZgvMfj9&HQ?&WVSE~C#Y#D~v-S{%_2hy#N
zbB#VHX{&aoLM@E=#1ehaR&#;0E;xKhi8=38oqCi+;PfjhpRM$BQq=9fCzj|<yWj~{
z98SIBG5EKa8o(|Xi<ij7>x5duu<eftOj^)+-lfbpSRSjDi=RqFU$gy?*Hsm9$f%KU
zKEnxdj;CpVR5M4J=<4}Y8w&Rrg%3V5S%wWI>K*in_yjR#feL<`Yp?sYQqpTd!z?R!
zce|4;cyUE*V5Sx8uVaq)He@xE3M2uir6gJEa<1kpcINSjs~*AWMzT|L1z^cQ1piSs
zl{d*znbq~&HRCv(NW>^Gv*DHEZ!at3{&nnJIo3R<A{zttBp*dy@kxkkuSi`%EeBmX
zpIuRKncg5OrlyqsA%9>fWrq=?0wl~+XC@&En5s^(XSd?|V3*BRckwuLu-Of;SYjPw
z`t8QOL8|;1n!OujOpE1orOSfuVLAB$k8(Sg!LR{Wg>MdOpj6AguxGh91zWn`_T0Rr
z6V<L!Tkw+NTdbtK|KzE9g=?OIU?5RIgt|Y_^FJ5HDF`1&|Km0I`J<qaU*;05F9#}b
zJkMmEO%+rT*HKl)T=IpPnssi0BWT*JQ@k9k_TgrntJi=<T-=*y6rdgYK-Ej0#W<?S
zxX(~e@y8!K5=0Q*W=MhPs&OA&OhEG;im}@2*>RTDbvM+ltY{L@9F@g@<{@|HulJ&V
z-5T2lJUJN1@ytrl&Yazr2M@%F_=uig{PdDH6wa`gG;|y6vsdv2mLKZ$eNGs$Sco=O
zvZJQI0f5=JEQ-7)5!t1-M-ARh8AS^p>|#~cOKjYt_RCwO+9!^@zaWhYHpZ%c`Dhzx
z;zhBzqMU`{F7EPbK<ob%sA#lqYv*RKxXAjiadeWjQdv4hMZ3y-7kT*-Pe|Ghov*Hz
zeoeopHqo0T;nb?+LmumaeX2d#!UPgB=(l{n@<glxV`Z%WjjVb#CNB$I)x~d&KSo&f
zC#w!t2vlyq-Y%3%(R3)sW3M)~H$47DVD-BfdH=+g8KZzQSb}-jI{-sFQ~))3Jk1-v
zZ0$svaba`1{?KoO*gm*tf4ZgZyd(xZi3w|NtL$u;9G+r(e>vUhbwX4U@!qIRzXg(;
z$lhd%Gxjc1$lYu<rbUy1fdMu;wsUL(R_&enEipT4p;9wJVCZrG#xWb%V=$)lA@$HK
zd)}>kQd^n3B+c1{<8N5>q>%(f8#nasr);;ls#xu6>?Mm)5_@BZ^67x>A~=&8`Mrax
z`O?vCnL~1>tejH4Vcc5*0hq^_sznzX((VKm&+x|azy$`4yj19l_oZ3*k=RLiEXe>C
zHeuT0JfNu^dln>7&Ez{o@puDH6|Hh-JiB`JidW2$eT8Pl%yxTQH{J0UrmcoImADd=
zUX?cnv@ZZ3-<X}36Yz1BScf5b>~bsi;umXYpRyILu^i_Y?ufwkeX+AFv2;j`=zI|Y
z7wkNe3B7es+R12mUbiad(w(9FB-dt}`BwryrAg3<N$fIga=CT>YWHx>*nF-VA17|o
zY2JU9@MAJj#LeMwh!dneanw~7%adDPEzMo6>(RL~sfV`-<-1_E6^CE!n=b~z$6#)(
zzp5^@Xo;k9II(OGsUeu=MD$zQR(g=01*SW3g^7(eJUZSwp<@;Xt6s_t%O0L(t?dLm
z$ah5#VZf3lLsr-97JYg|6EBBQ4KW7<oPKwPI#fX3+m;e;+4%0wqeR>sRg}21v&aGK
z-V7M(J;%YngGP5HGK7tsS2cNX<?-O;iv}z<P_z9Li4Vd+=d8*^_)#r|Z*`LP*<K1f
zvZl)IEOIG5kM{x{|ElcBgPUHp*l>%`qj9A77UU?#F1My~6<aOUX5@%1+h$?$aHOlm
zV;O-t4bFMaIyr<IM;4tsqpQ*ud13_piZzseJJk*azgx}dczYmdZ&~#P{umGEWqe+)
z=3#$DXHd^;ZF}6&w`8+xBK*!s`T6F&tcTlF^ZtY*8Ql`>xo#<UeiTI8xaPUj<WUTC
zc)ntu(fH`$;iz#pKY)ADw1*nwKWwj^LH3fBf!%xi+Po&p96j1s_Ibr7+-0uhuo$~z
z-SMA5Tu|}7rS0--aGexFYFwPY1M{IP*;dj{cCVL3^U5S<V?H_x%nLv4uhq2neeAJ<
zL?Wv9t_UoJj+-Yd!GAi>{ihDmp(4W=U8OQC7+`@^Ex}h6f-C@GXIer;IxqlwL%H*1
za^UmP%HSOC(51XBr`Wk(I1iS0M=1OiO8ik`e6z%LyS*aIuD6dE=c`ojwKKE%l)viD
z&7`SYGZk^X(d*TVQ$X&eY5maRBBC=shB>?Xn8mHE7Igufw40&FTpEkE+|;EuD-bSt
zdk~qV3qQaCLMrK;BaC56&G#C%1?jC;Fb|2h6JZ<LLa6l`*{eGvZOptEbgeCbaUzWc
z7UVTI9T?p%P*qIhg52E|h_jOPDsv#{R!Jk1T<V?X-?4aC8F;of&37Y`o=O)@Li=%x
zS5n9$u6b^{p`#iUV%zy^K8LxkH(rX6R5^wdw*0n_%zgFYFKcU8D@U2<TXrbcYz<%F
zE9Mi83F<gSS1*r#bLPSHb?h-++*y!x^*svkCFl_&N%SOcFYb-S(MtH8iO)>9MB|rM
zcMpyxZyA577YD1@{i<>?VP}8kD`Af5_Czh^tR<x7&CH@lKce4Eg~$b|nEC6>42K3O
zJ!fbdBw~}U7`9R&cS`6(7_#w4DXCV8A#z)%cPS+p%~#UM0~|N;m6t$T&xsNztwL4B
zeRfwS#*jUt=(w*rNPK`r7n3jPxaoebF@Fo_tb1D@K3#G?^WMG~?L>9{^Xk@&<VPVp
z{a9jqJ4DJcV!d^$WKg&4c|jAdJ<qq|<2b)n3Vsnwyk&3Er?O$#g`BE(*bvanPx-$7
za(}nIeI@GqkVTxKdM!4+dv}p^f_`z)K;HrPYCEHBef;oXN|T<^vDzj<%IoEDaV^md
z51g=pXO1dT1?5Oqhm4sI_aLReuI~8x-1~Mo2TImynT$^K0@J{*<bi)xI%j_&_RI^r
zuPqA+<8S>As*wi<(06E5^so#!fSH7<@6nrs^w_<YzUpe63BN5mtR%J9n|J`A6v+(1
zoODX$c#I{J#hcgMO^=u^KUZw~Bylq~)yALV)14PH-8X2!%3ehs5-yGAdkHPzYy4R1
z7U@{eRnu%XdYVN1stpg-X``YS^D%L8QL1-+`wdz2-*!D<+l$qA;O9(sAN#`ROz{17
z=rh?VHov$P#4{=0y29<gvH3M?4j~6h_mVs7Rlw*tb46s9G0#ODDZLeH2pQ1C)x8y)
z7=m{vRC#{dUq+;;^H&|euZ8az>2y~$GuXN0eJP)NABy!-cBtS(s)jqeg$fJ^%pT2d
z!1yVA4$|6{jPU5fBW3}f4ewDSoEw+GhffN>ym9fw=YV;Q6ZD^ACFoe6__JaZ_VjU4
zqC$<SP8_tLEo(&BDpg;|ow<_3<zUq|CM6Zy7wKYNjk1##ozlDCHyF?ADfL}8|4gZ9
zqug_#=TsWbelG2X)KJ3=Cp^o?AWC%CxzBY(`+Gtk8~`W2C`wvcI(FcFGY!~_sCAAe
z4>vTQj!zfdi!sK}Sk3QE#C`8f>5MAbN6U^>Xg&=Gc9_T8-C?T~qpo}Vj!to%>op$x
z^G;6BD-V4h+Za{lubo+m8!&|WRG`~<+71^}G)kdMY;CXz@!QiDIIM-^N<SiS^aHNb
zvNz=jot1~4kQjR|AY8NeA*)?ebbVwcms<gMjKKLAIXY?hC~N~lZNpq7zS22QMNA;h
zz}pE5-RUe_>K-LCV8#b2#7*MX2X{5;p}Zu_n;;8<fN$FKnzb|SED;iwmt6UOlL&iQ
zDvU7-vig|s2R*Dk!UbCG&p^$-x0U5DvgmQA3d&24Sjw8BXO!S~*RT{Q6{cAeLgRwB
zb;g!jo<RT0P;6x9O+gNBX@+U@#yCb+F|pQglh!6Mub46up59eGN@^i9!SevoKj}uQ
z?aWhdcnk||<Jcc5_7aZO$F1eTzV7JGC+uEBR^NKPKV3W3<P~d}vRf_pXft9Ql<e;9
zp^9UzxP*@DGlh*zJIzn-`9ggz$@tR8Zh!V57`R_K+x-25Ku|-(mkrJd%S4hGPRZrW
zaUMp>c;hX!SoGvE7TSI#&KT7cwkzbmUSQU|jhow)X^%=Ngj8(A>bs6Ijzea*r@^bn
zC?l_A2cLcdzIYY?Ixf}~Wmu-~hzIZUfql`)FwL*E3}&VtmOdogvuL^j)1nm~Zp#5g
za`$1ou6gsyFUxtJ(|$nrReKFyx0~KDwkWk7IM!<I2VIiB(V=2S<;*rVvlt>63O^T|
z*H`<UaZ4=qg&BR6OfnNc$xVUUIm?@3u3xB3D^!n~6M|qNab8O#;<`d)K#WdnOLH44
z@II_#iOw4o@IPwmhN??r@oq8NYrC<xFtzz(PmL>Hpb`)<-5UgBbD{$bVvjG+b1ktQ
zu?PA%_5>NdUVlM=i?EYGVA=)dUyx%Re2^O}?E#GTPf>=BHQOs`zDBkC$$7532f|f2
z>D|cfUa9?C0>e8c$s7AE_)_n+cD9XE%tbb?5w7c7X8IswRWYmevBK^nkQOa!P}x9Z
zQs5Zp2+i3%3(QJF9u5>*UHQCEs28gg7(Qx|ql*QWRP`9?>R#O=0o85|2t+T|OtAx{
zqnBnyW-V%lQ-S#odU@uX``|D0&sokNw()B@^3b`OkBuMgoSRai%`mOjK4h?5+2?c3
z%=oY#>0u>8*nyyPa63&?_HxWvDb&?%OX9*x7j=>=xopwPE?)+YKt_|UCT0mL+gZd7
z>Ak+BmTdDeLG2luc4?<p0K<qpNP6qB_vPCK{ozo8-90IfeNnLFaz9#6adlxQZb^Rf
zxTn264pco%JrHlZUG1^c_WJCFj1Lo1m%L{$iMbe4$FbUF7g+9JUgayBTU2~Wdrdpb
z_<QNd*Q^*IvzYcTaPA#FlsNF3<W(5dmd~!mGK}8~Y{_cTsH`sZ6YyX}xrcacjy23}
zt0syL8e|!`jhC1Q>^#Guckv#bje^ZJmnMz`J(~Xkd1reQ$6^TM+R|nd1%K2`ycdY_
z-1jRikZu$9nXwZNRcmc(3fG#vpvF)0NRdk)gQN~$a~U1hF?<V_sJtoE!S=AAOB0c{
zu=E)dwAU($<?_-&!?NY~GQ-!0&x0{_fzzBISB+3t5Q$KUC__<ekPzn$v8G2iwl^13
zox*TTVLrT~Ma^*rd%(nMCEOmzkdl;H#kseWbEq6Ov6>J7>uYT@t?qOC;ZSa>Hff@a
z^3G%&lr0tih8eNTOW^Y9s43`@vYdJq<ygZ6zQ}R8$5Tfr{-9}`QRtVDgH9wFruHd6
z5fzr*lU=*f#DRtHea%bRqQ=cKh#95xR@x`^P#+Zij&*S(6-#7XJO=i|z|iobC%2RR
zwY?zNrFB=lIE^gThXpgZOo3&WoCu2E>$Lw1Mmq`_-W8@4Q4bycKv###wFHrL(5sPZ
z0KNiObNI1y)ZOzCD4(ik&o%#5M7??4Z$9x9#gt}yLskbTVAHQC^nU&MpZI(Zo&k58
zZE=+s4ME+!@mZZRG{5b;k-V9Xh9HqpJ@0OBJcD2TBmQ$g`X49H<*Skx%u#j^rSNzR
zjKdHhFuBHscB!!J<LJ7}WG5%HjCh-0-j{cE%B%oCAYN(a(rlgRAt<V6i5g=Sl3abv
zf0PrOaCb{2gQSwPLf0xgH&+#-J+q|n9G$N1>MCs}=xLrEJdeK6Fq~c6Rd^MOdM@13
zEoUC`nakX}^#;F0*eb#y`6a}5jy0o`ox{#79$ZNX`U2+u7r4;uPb6Q(Wk`#6fn!U-
z%VPX$7mD&F$s0<uQ8TV?11dkY+P-LmFs3k9v!WIT^UwV9(z~1C10XQ-;9703^i$~M
zjf=v+T|v08&h;-Z0Q&d$Q!v*6tVR@}NnlC?EjByjBQ-Z5Pbj<Y&e%5&?`5!(ixk3>
zZWHMcn|gO>2n1da^hR|=G5U#bErV6ebQGAFOQ9+~KjF4NJ>!dVCWY8pSuAHIx)23Q
zYjTDxAu#PR_*K_tc{>Sj>cY6xg9Ht(RC`<5)w4SO1`C-n4U}|FVh~%_&4@ve6vsG#
zYCZk>>&FJ*K>0dEH3BjE9{^{5u0ODKyEW?!Oe*-cHi~|wR?a#+?b2gEtuIY2eU)ob
z)zuyJpb~mWfdia3w;cf2$>SQFxzHSOqB{?s90V*IH&l+4VSzcM*1rm)CqPHt3@NaK
z9O!XW$<B9oyG@VM@|<_WWy<6~k=6lt?wMB-_&d@C9{wM6h)wv-u5MAqW%P&SsaARR
z&xL??--A_csTHK2r{Wvgkr(!4epSEy5uWN~i9Nxj6loyUGQ7kv9ycm4ZXcc~_o!(|
zhBQLRisBosOkKE+GP9kt<zT4z!hyKK^-^5W^zsbGBySC#_;o#(+{vK7CEx`6mNz-%
z{^^nYBLFHZpCI`s+=P?O$pBKNEGTAdDQ~>9jL6=)F;KiciE$?629f#YwtKI2Av(Ms
zHqnUJ!=X=-KKR8Ln2q53!MtAmDNms%y7J$?aP;r%PF8>@V!Ey2VFm2VFb+nQxX6?7
zqerw`q7lT;KA+MC#*eN|4>b%L1*hNX3<9$(tU@$aBU_m9{Xy`^A@((6rQbf2SHuCV
zFRajTC4H!zot(yeNEd^BY1N@xDEefs!J9@MfRpq^8LU<L&MGml=s4@lB50pPX&}av
z1{J~v;K%ICV4vT9`FC}K#HspSmvInY+!ZO&eIay8MJ5WEY9Rk!kecn>tWtqwC6kjF
z_|W-P{|!1jyB|^UTx<Oa8UoJc0OX8qVlf^^rwChuT<I&+5vo;sVZVKoult#jev~j<
zij}kpod}W(?C2{y_#q4_h`7`C=$bsb_^y@VOVO=JMkR9G(gWtBU?l<?z4FE0@i>?h
z<k7!2`tiE*LkB^>1Hog7%jS)PbI$~}Y#teyZ91_XsHaKE%%ESEb;o;By)SBMk2!P0
zN{Lqp^I<-&&ChIM2*|~jU8Yi*zrqdP)rCC1KEhsUKJlFLhB(7B1PJBh(*Aarm9|D0
zGP6}ux$qI+`k`D0YuVT>35W-5i-Fk~1#k%u3AUXsJt10!kg`jU>U+Zi4!D>K%2cax
zK{eT@V-nfv*a8uLLTHmPgPcc6Z~90;=DDRHX;j4xEJ7L=YJ7|2ZG!0qTHg4pB)ieS
z-i<uMeoHXYs-cf~`sCt1mKEP(MYA4IkL*?RIRpomUH;NS4`{e$M8{T^(BbPGlny$w
zhc5IykBTaA2*2qPHKD-BR3J{q^pP*6LC{i_e23`{tD~!{Sd^%!Mp@4A9xOjm+@UmF
z1>8IrK7e%i<;ng}?2|*zL<cAIf&K16VJ`?0TY%{<1vzD>WjZ&kRns^+HK!V+J>iTb
z<_~dd8lhjXkvB5Sq$6!Lhr5%54fk}}4#@W$yYCx}BKeQ3n97hq(vSKr!KdtZAJgiz
z3+yJ{WjKbZ6v~4Y=8S{L4d(PwF<#bzm~#u3bMScC3;7$6)7^-#xf8KKznkAE!bu@>
zoq2T-welLRfG+Gh)W{3pnDMrd&6oHUe)~tbkfA&w##X41ycjT=UyHE13pT)L-yU4b
zy_&TW@p?SfSGF_bYO8^wNd){tnj%9!M;yZ2e2w`vpGO!e^0YtfF2*DU5BNBnrHBd{
z3_Zibo*n!)5Ir(6Bhu($LFg00YTG1!=&(^j1QOibqyU=irtJ4l70QOD4^A)OskasR
zSN6WP^9zu)GW#wFktZ`?tdH1O1r!OG7r#7G{PF4ta`=rZOn~mu?1H-_WAT;WeaO$(
zQ(04)n3I;6>mK)8FE(a)po_ZYeEbc=WH{m^q~bIQdV0Ua+yDH7(tf&Wlb})Cl(i(H
z_C#RLHUm!7N)9sLR;j8$JnYcx{f^0$R!mXXs!^<}Y*2b2v@Vg}h$S-MR9g~#?i@QO
z2^&ZhT|9~01!sUnZ~smqai6GxIz9{^lq->p<;3;qNQf}pVzWC=7+el2=wUdmW7J(&
z9j>Uh$NlJx!=0_5x`V!ppd%{x1oPo;NqjK2NNgDo0OEb}|9T-4fER+W6~L->kD&8<
zoO_JT*Sw>Ll<v!FHwTrDNygUaxHI~_ylEyYX~_be8M+|5uxd&byc`u;W1v(7!u`va
zpQT=^5oWElbZJ|PpSw}c4+Gc{S#VP-G9vq&bQ*n&ieT$Of<km>lIW4H$l?qR>2bIG
z4{UL_oHA}y)RjnFs;HZJD{L9Kjx^&VH6EK^2ZEE|Hgmp`zAE)zV$d0&o4V-iMX@%h
z9xc0}lN&{*lXBh?o>k*yHiNhh@g}Vb&gtul69{30OPK}P=T)vQPPb6T6_j##^_wRt
z6Bu%T&GDS%&G`8H8!=Q-11xFDs&RNANJzI!O<6Hn5ErA)m#KY=lI4Bql(N*+{Xs~Z
zcoK~ct(JH)6a49AqnTNzjE@=pFdN72O7Y6Q82sG7id6(R+k%!7dZe$$DF9AB#%Xz}
zInG*p^1~mmCow*z+KZBnJfN~H7~W+K6z6B)$W=We5*9izZ``{4Vw8pDp<qcLLdpeQ
zDCPptskyzqzpKvtOvz4oI=LP}gbE?)BZ$E^3yGRfC3m2eNot~3tY=}V=arWCrm{K{
zB6Z57l|5ic@=6#;KDqz%xt;!wPlz!9p&%(r`(@SuN;5&?pHA}&r$-;)N}!`_=Tsf2
zLqTl#Rke7Da6PuzfS__oT)Qu$40*-Y;)|`wIA*G7k(us^r$>X-|B@}q$domqNe(zj
zKFE_#k9WVXjI`E?@|A#CINZbEka%RSxXC(J;I%n2+*F{Rzoam(GCO$sF+qzdqTHaY
z>TWB`*OO42_}ftXr<Q^v9fbPO_Z3Qx0on+2O0hgEUCt0)g=mXL)+yE{;YHiG#>XC)
zWRqXUW?Xf8A6SBmhoqAnEyKn4zD({R6Y6Xmc}szHmUIqp{H_S&4LA{P01NFsR!zi9
z`~X$*uWLcq-iFg!J8c8Q>l|`POR3!0>I<98drr+<STO6qLCbard@R3t>0>E*fd@l8
z4%3m~d?x3Vlo9lJ8Ep73#f<++U6}?ct(<qqa#CcO^?ibpqw|tZuZd#qy5NzJmv^{6
zynn}d<9fX<u^xj^OHdOvi=d72^Dz4D%>wXbsjBlPP2x!7O)-<v>Pjg~=&?N%^)JuJ
z=|sU1kxL)$EQu3wRR3snyW^e`VeYvECr&pl(OIawQuRoWXGbn2m7Q{0^q~`~QMiSr
zC${{y$y~-3dtmvTU?IHHb)+-6TTVGqNg0)SZyA3wx9+z~3f}a)nhr&Ig^-8hLsA$T
zSk^>q)rk01{l~vu4=HYXl2XA+l;)4%uFzp9QhmOcY9OLc#|HO2XhwJ2v8qS;W-8+S
zaXx`B*gyX^1^^)$$cv%!SxK}wNEm)8TL&`=oSA5Dl$K;e4uXo-ROFZ}pMfN7i1UNW
z4&o6;<PXRXvlBS!SYiQOi9;xxjhtc>nengXte`H=i4{j<=&HK{?=h>8z-VCSA4B)<
znx~a8Ns|pLsU3H4U+%dh%DT6pG|4)Vp+zoZ&^X?a8C-YIh=7TA0Sa=p%-=?sI<pfP
zz~Q9gPqqHou1v@-NlWMrmF_XnHP1ex{UjQ3hwH4~Ct4QpN-21I+rs%Evnf8*_2`+C
z;oeR>q?{>MMop|DJAvYLy%-QKQ3JIDfb!tsZ?g=o!pHq|=Y}QNQgmM?lzf!MCnn30
zsZ#X3+$s5JcKTBtTV-3pooxM$tfwGU?Ln~e+v!@~t|J3!9NNd3ao*1AQQ~M*nq5x*
zL&JQQ-=_eMlQX<KJ<h3ex4U(3WAaYDjoldU!&}YF4_|~yc#)RU6FD@RZR<pdR2el2
zwX{qV6|5;-1k)i%yzB{MPhH(ygJx5u@0^@wgoxU~ze~zMrBcJ`&k4kZ5GA0gS;SBe
zm$oPmU2~|tVlBfa-Ke`TMyY*~iaw2U=EaNzZ*2ALHjQtqa$KsNb&vUlG8L|&Ib)@~
z|NkaSV$1=$aKnO14XDi77B~VC-fADBMCgsnuqv%h;!Imq9$WK~Xw0|4Jp}(s<{l#D
z@35Q^Q+F#XTYUjgXyjPsSNxQ11TXs~WI#*n1$G|buJDyQR#b?;ulrDEK#J6Pf0fEs
zt+n8`O`^h-z4`axQ_7dN3yl%UOQ95YUf>EOpgbjlWOzGN%%d#AMNv$yfWe-&fWCdr
z8W;S+AJ1N=fD9nVV&_j&xId|3{*xpw89r2fo8UFMUp1*Uui`l2wJ`CD^F(R*U$s}8
zoJsQ%d>5pI(R9(gJuKPC_#ctd8?yRG@?%XwHUh`l+)Ss%3#hzSw5G36>evc%2A+|}
zG{rIWEAt*v0sf_QgCLJk%)Zk6t(vRP1U$ER+NIW=y45&qN5|KVjPToo5!)4i$g}*e
zB-TOTWeUSi2+lYX`~7#@NsE%m)twYr^pVyB&HvevFE}abl?Y7Q(Co!lW(9pM>|#Ek
zX=-Jp6Q_tBbD-KS*YBrz&DL1hlH~uuue9=R<ee8fA}~Np#p;kkYWWNvDO2)V#Llds
zk*Xb;`E0J9(kl~uQJ&lj(8IL^>h!@q%vPTMwWJ9L)k!;|k*dUe<N9})&nivZ4xI3Q
z`x8a29mn`<tAA)Vfh)1R;|EAIS$de#68N(r$4f~|vGmxRo;U3l40L$t%Z`@d!R-7H
zv{_jH_jvp&RVdtZ&8=wK?r6Y*z|>L2xWrLI5n?t*8Z2>JI;4a)GCs0q?pZj@lPN?m
zjD80YLAQX(#r#T2Mi@D)HZMw;dlstZ<w61VVFy7h<4Mn5qT{IPaW^l;VeIKqfaR-5
zKR!?Z@wPDStT+JUch=Qk`mA4Q_gRNbI`4E|XcvHCbr0tSps2NJB&JvCJi%ZeyOPT{
ziA9~Bw<lmzUJvCrn7`!RuU_N;{*^?U_YR{m{~%y~wGWPR^O^{4J5%cMBtg_J#`$=w
zCH4&k_GLv4{*~uY1G8pn`9|#g-l&5Bh4+s)?N_u7v}*SNuwOwMEi~T)^YtFw_|8Vb
zhrEZ?#)%NxySn*D?FspXwm#4~xT^H0<IVhyxI~A_%+dWnp(R@IRCbZ7K=<(OSwOs`
z&F5CLGTye{4Ye757Nyb-%pzaeI2$-HdBL~u%CK#geOu8AP18ztk%Pqk7^F?C7N73C
zRx%h}aD1Xo@Ho0Rp<TOq2p*hd<6qyNJjf`EgA-O2=KD1W{W-vY$aBVQ_-d*i?X+4P
zk$|#063ZaEZsWUc7Q6e=hk-0lyQEjb_#Lt*t=4M}K`~Y!yZu7^ImXxv{Ni~@?)6TF
z**}N&x-eG3FCf<185u9xD%n2S$*@vg#JIF4yC=uiYE+cit$rJ0B^4j<VDkvIGd?j!
zIe6VTA7hNRyji~W*SY!Zu;l6Id~X%&&kY_F#?>EK$ItlnG&_mtkjJ=tOI&<)4meKi
z1~sY2d33=&?Y-$10g-6&%upKh;gGP~ZpFOM25x`5qT9Dna%H$G?nJS(DJPZZyPMe7
zL`O*TK9JeqC+vU-nlFb;Th=Ky#-xPqt=-OJ!i}c2Js|PPI^!HyHC7T*Ou=W2oq@*r
zfGWY$hE4aRrn$!_XwdF)x5PJZj?^CEk=w6wSaeD=X9Vv6e9-ofK<TeZF1=gxxDBX+
z#7<b>T_=w{+oF|<38SXz?l{9NYd?BFsoAUDYesJX02Z2k+ybpeW>+-pS;V3Llpvdk
z6BVHy7bu_yY4_B2QTmR2-J@$w^GT4d+`LG4eTgX^_!<h38foD!RO?#6=xS2ER}zhv
z_YN-HBOcp2K5k;I=ZCfi0eXUS<HolfiaP%fd+!+)RkpQ_Dk7m(pg;s96iG@1L6QW4
zQps6B1tf!jNX`;VKqXTuQBo<0s3gfb7ddAnN|7@ZsVFMkjop1t_j!-~-5>Y<_{Mnu
zIB*OGd+)XPnrqJagy}iuvp+m~^)R1gR}v;u<(sf0P__Q3HsA+C)%flb_`a#lUS(mw
zBC}UPa9!_qLTtYOhN094?3w+;-{col({AKP?Ek&dslWNN?C_Gq74|{DQ~|@_N1-nL
zru{}4Rn|Fqw|)Z<QV@NTHMiT9K*<1sNFLkzq{)YrPKPx1?UwSG3+#SFAINw2Y&2vU
zc7cq(k!KLb-PFsZ^&C31OTJe%x!||}CYFC&$486DuC3D50X56><B1uzVgKOcDDlaA
zni8|{g@y@eHLSN4>}7w5)H{B>DM&bM-4FY**6~2k*dQ9Zc{nv_&COzn5WNMg7oW6@
zC*ET;u88Prjh7?x;2**8YX%F&gPOc$lYVZJ2V*nw0OC}H!?f;p=9W$CJPVJ?dIO@Q
z`RX+`yE7HjQTA{)aK8YsN&H?bdp+l8W?7FUB^<5v^5;*iIV_w3<9atc6+k`(TmFY@
z3y`V&iZV~moj5%clbe&y8Jngq+sDYMt=c<>Ya3p5Zf276ueT!CvPJ-TxqfLLY$aqT
z|1M!WWaa?~b9yQ%E1U@2;L>3b>ze5`0n7?$Aw7aHy^-pFz%-RltnT0(A;|8ADoKCB
z;kTB&h~Y1@5_=`)dKW&@!L>gBy_);xN0%5*keI?ku)Ir)KgpFlRwh|oD0}f0|JTnc
zk{>UsC>NYk;r}Aqo`g4A&m<GlM-SQ{Z*gLExb8Y(7s&K?O)j9nt?LTnnRM%9&g_hz
zXLmk!DD!}YI>9R+`J(|=1*X@yV{3JdV>1AtnXJuh=Uc^LuZ2JfJBhAHP)KamXjbJz
z1FK<lVM6UEjg2(M=(!HQ{I+5!+9#B;5uGCGR<!{9QwiyL)@V1|nA}0O<}@aw5I@H3
zSk47Ma@d~~pK`Y>JtzBgr#DH@*rNp9OT={%*yz%fEfM3tR}zsLKgKL!x;;|6d#(=n
z{i7s+SwQY^&$MB?QRZOX1l+(E1fbnhj+*tS$^G(hyMt*4ro20EU8gHxe7j4;_qYuw
z80%>7t#HIn*HYZ~{Wy7PCcnpcnFW)>@f`ba4KiQvRXZFefma81->NB^@HJeX6XXG-
zUn@oOui6|RpWm@b^L_+_Q^L&4ALRZA#k5oKv<btbT%hG3lzxkIUVbpLPVF<{Ns`C-
zN<08ev87*cNwSmQuH;G(^LXS^CUC1Jh9Dhz>mhN7%WK<cSZw^+qp}hf8d%!F!l{eQ
zqBs`rkjGG$ow=sa?gq~JLQR34z4KQW=gpc9oP4d*b|dej-6|l?-uR`O>W&X$q(Ars
z>WbaE-^parJ*Sr0^R=48Zno*wqAx5|?-Cy7eYFtOTG}j|sZEubShSfwrc4DGhY_ae
z)lJ*Enb9m*!IUSg{l(6lgUN%l=dpkb0=cJFcoajH=}+wA(iP_;tAx07g4Je2WJJ~Z
z1>f2{KhzvJhhzg<S>si6EH~A5{8Et6s<0q}IC^$?`8`B-#dhIH@R>mrzCMuv-#DJu
zMAl$X5gj)t97n_ItGzILgIX&{Gvow#_>j(0&&b95FkkzbutbX~b{1Yz*9$=HhFx~t
zkLISD{$51_-}(<z)|;37X`_U;h*oU=F?~5<QH;zV#IX>&#V2WB27B6Bhs*PXa6?N^
zdvy|01(H+tG}J|>*ITtr^m39#!MrpKVVG}`7yy$I5=W*qUEv8Ay8wCuuw9asO<Y~S
z?O@9Y?R)vxOWxgmeu$PmaM4;fIoI&coBqreVL`=geHK3ULHe-5*L^D(=Zg<YJ7K#W
z7rw6>f(>-iRl@V~ZEn;2fNVMLv&Mv;))gZ3X*xt6>P*8rbF*|l`DT)uaw4H(CYDiR
zRhRvEr?O4(Exf}bDkrE_ho;#^3CO_4BOe>s3>f!K*Kh_M<zOGB!SH4Nm0qWJeH-8H
zi(MEs_T4BCaQzmumf*jM7Oe8jC%HQ$gD=)y%b(B^&>O8A>eQ|Cvt`{9T2xaOGEpm#
z!*llIn$4H&Wi<(d#Nn(Eut9I3`4aGFJUXIp$yS6pU;A6vgMW#X=O?Je)Ey_1@j+No
zzNZ?_e5JC4n`1=rvxczC`XKu;hQ`-`i)QHyN@~Mmrw9>zqxJKh>yeTb`hN2Z_Is^k
zbLkIP3zdu}5Nt#1zY~6Ma!~+tO`(Eb23w8`GRJ-&eai&3g7CA4N(rV!EUao5tXsE|
z3ghV-G^_p;=yinFaxM_`-w|0j+BaN6V26yQToSXY1H6ZND{I;VaLa9SRggY`T%t54
z9y>3j1=kp^CE}f8mt?jS7Kk-oGnz&}{F|$ZIzN-$z;?PHtQ)YLt)qp}`-=&to+=fE
zhp_@%9>iH{*gY72Iy>i~>8P8W|KS$kCNYU$nA9h@Lo;iYFt%F0ijqfK5O;xT=DHrK
zwFd=<%P-vP7<Q~aI6a%2SgTsg=gl4&y~z5|cjvfI|6mlW;12jSD|-(n&-CM)7rOWD
zTZg^AL+3xhS@?|p&iee8LbHtT1jZmeiR|iU_BJMc#BGUt64%eWJ1+<*$&vD%kJ$jO
zt%8@;<8C&F9ftr{5k<QzH}P~@*AEO@$Gu0{nIl!qG%ctUcGiVHX{UNBYRgZtkU_|i
zy`f;ak5|A=t+xWd(BDaXV={k(79r+4kK#&5s43K3U#;=*xp$oXlmDR!@IR!C|0n-L
z|8l$ZY-dbG^{5xWp+m{A)E!3cXMKx3sfL)~Lw(=i0=iu9fy6^x>DIZls{t;))oRb;
z9$0(W7#igq|K5NX3Vh>LJ7Y4_T<hFbzcW23n+EIRoRc^j<=eQm+)BAN8F7raPd7UJ
zS7CNiqXCMdYSh$HJbv1{EG(F(q6&X7kzk5LG2rgZo!!413?!OAy1}wE0Xr@n>dn2%
zERU=Y3@q1Ydu6@b;dPbR3e0lwK|7Oc^m6X-Fffsnhim`FqCQ$5PTNPLWthQqnzx6=
z6nF9IXqV9H{HwO+fmk8(S+jYXm`7odS2YcoP^9EDwCl|gWM5qk7*_@l*ihPkA`)~8
z#w?P?*mYsj^&GLHwKUlgCHNF5$ZGaSGI_|{E>F7{sr}x|`F4?le^X7ebpqTAeaCfy
zk4)Fir4FI-DZk)vU6J}!MRqKgs%DnZ2xw}j#YZ6{XOO_=R;(c)&*xfb&6Z0Kj`wd_
z&cuA_R$!5`^#LgnrC&~tnCIszQB@!xvvrqLD&DMA+2YdRG<?$**C@)vLnxIHj~|oT
z0C@HSz7^h2=f4gHm|&GQ?Cc7~;|N2ee_Q6iZFzO&_lF%6?rrZr!b-7rdj^}QVS6J4
zf4aWQcR-FAcOjI}yF#4TUm?US^C)VEhZ(%x-XrPcHbR?`Iw4r(jY1{$)lu6~uWR`B
z;eWcw^U>M|$+lRV>^eXNqF7FSpvZ)>vje&7zQA*9a|gUIh}08%Eyu!efle>W|Ma`W
zXr7*@|M&LGy}eye+U1yX*K$mo8l0koX~)Lt>p#oTUXXtJ`jbyE2Clip8h^ZENID}y
zQJ;|9(#ryUbvrqwl(8GF;JjWYw5~9g`S3s|0f6mRX2P3532O)Q$0wt9eu=;QPKyx0
zE=2Z0*JMh7_x!-IWZ3k$EG;>LE1jR~(rJb}36gqzI8?74`)YBKXm@Cgbk0U=3ZKlF
z77<yXgfAs_lRo^vOfxKk93D}=t(?hz$vo~&O(gQ8gt(@8{XJ?ZgBZ!nH%8~*e~FW7
zH&11;Xy-^PkkLbbtpaNiEB4bb#rrZE992xxC5k&uyTTNyum0RInf$<%f_D}tB<pxv
z{|L38e3JnV!1^ASsoQq#_bnc{5PExya&|eqpDDvZkuf^{otW3{^VC&uI|H(<K5612
zR{}Rx97mY4v$KOY#}9yEk1KIw%lUgP`gEPc46j;gUwr2dE4ZL3Y)SQ<O+ssv2a@hU
z^*TwcrpPljtvypV-eYmzxj;*^r%f__5)x8wP%BrilX#~zN8uIIi^hx-v{+w&a?$|i
zoz?cuh_G~c4@fUk<;`XrUwY|eeJT6yF>0KZX8-B;j+ogIga!`^6i<KZe$OwL5L!3L
zvBua<3w{OeFC7*lcQc>^`^U1Jhha0SKEbj>N(&^Fd~}2Ho>BR3o-xzprzOpBqD$6{
zLXJTZ`Z$(I)Ot+BmH6LTPu$?n+22V|bZT`&M)v<qdisNdBJyaVco|{22d7}cdk#4$
zDMSMk1Y}Y6zPg|grteysmrwHt-Kc$dwTGjP10l9Mk7^=2){SArfkHwyOm+VO>XZW|
z<`5(ROP0LKoc-P>1(Qa5k9=G+p}r?wh!Cy22Rav_ZoerMYea?CoU#-|IXqpsfmE36
zP64Jz&FyQ!0eN>EDDLaOyPp3M>-ghOFrxTRgfO0PvdXT#-bc5Rcx#sFy5q$D)DY{u
zr+>P$Q|x%mEhwnfqIJE+C}#o^u~vv^O=(*A#u8rHZq@BabFtPOJNgZDcJhBa_W#?l
z|BJ-;e}%;VD<uB^KuFBdQL4zU_qH$^5HuZ(TToQkHjc5yN+el+VVxEKM&l!S?zpSH
zfs@}RDnC_;U6Xiq9_bE<iAf&w<vY}L2Y0xo9X6t84>ydha|>0!2ONjQ#b`?BP5Rgc
zP~=tHSG)ZilnbO!sK=L1ezo_m%k9K(mOU_!PW1-FkX<5Ld`c`XZQ;Ii)9?N`g;r=7
zfx%^O%lo7=j0-hcxTI{3r6wNwaZ<}wA>m}I{39bx@DdM0z!9=)Gst)6OU&imv}A&@
z-*4QKB-fi&7F9{yaFR3?w)e8|$=1;&zNe9GQA+GR8hydu*roav#6Cb(7#QzRHUog9
ztI76-wq9%hlJ45O=D*qRXlwF~|2Imcze5RlmlkyzPNRD?&&#6P<T_yZQ6)eI=wk~Z
zb2~hS9oW5O{1e6xbfN5$$BSUEVfg@^(9Ci^K3O5fA?gK1-8+b6GYR+c{2=#QXlYmm
zo7f{zxxlf1q9sexWl++fpm=@K;crS$dSv|v0Kady=+y!4dmRc4CihHATZ=j_jG78k
z{d+-AQ|7!TrSU=3?iNXb5+OlCX*7#Z5$Acx?EF)k{xET=SJnJ+@aC|$6l*D}=-!&V
zO1~jWc=D!Slq1xU32M3e0cMd?5!&>&Gs&B8vry{-c8T)w$VQycd?}&QXo&2rIqlWw
zQ22GXQ{fjb2T;A0D@2rIcFd8BW*}DsNWwE8z<gMf>ZU!h)Min#SNRH5Pnm>y6!P5k
zC`mm2`WErI>y*bRpoJhfN}{(Fh)k0y6>goavPTu@X|LK6BbVj{)`$@4b#1FMhU)Uk
zHIqXD1{3!?N7H4s4++le{r;MN*Umm5hG74tojun4>yi7dn&$TTMS76*g-8yPE!^I!
zoe5I|9WaL0NLoQXI(-|BHtlo!ovMqzZ8oxe*sF+;x2&%4l3nZ<cd^p2M~+d{^g|6q
zly=oqJv9Z6gD)A!vTYcI$`REyu{^KDe7^$)<tB}DmBJR+Sriut91ogV_Yqor1>oyQ
z`GQa8RBb7V&!4*et827TO#iOlaE6fPx{{d?3-j%?`)XDN^KMVezkWE4LtLs@FxU@S
zQ)G59dT0=baLSaPH;3~(`AkeNgoOCjRqsdn#v|~UZS)9iCd)nmalI1XDoY4kXcmNN
z9QEVmI;sfxsD*r(WL5Q&|8YE^o67hTMT!?BS({qOTL`4~b2iAV6_NEM=9XP&9?>If
zez=$@>9!b4F1y@dm0L1G6}>5@YB;$?z?TT2+o@m09W8a--;!DXWGBD3@WqsLhSB22
z)_Fzt9zL$^=FlsUAQxQppOvfo-#SBzZp{d9FI~ULtCn~xhTF89g0Liu9>#)rlCB~E
z#2xFr94MhhKL@!4wQ#0tWa%^)hA?oEpD4l+t7CH=N1vP7Tpa$U2-kNwSa<Dm3V0BJ
zjX7EX8oZk(=UjRuZ4!=0h#Z6oN!YvXG}CRAOy^;pznLUfT*<=)3M@?FiuEBct^t!$
zmuBoa<p4*|9fiar1SJY5h>N3j_t|zasT~<?yXCG!y)Y?r2l1bt2tRtRd>a{Gi`7~`
zd|9~ZvlcglTV+_N1ODFT=+2Z0X27+xTRfqLxWB)E?i4h%wFJa)Dd^}!zt8r^?>9P|
ziRGWG_xJO!8akGEd|x^P&L_d<pkMX|e8u6ipu&o>Q}C#Y?EKmRg3-Ixd^)eq{AZS4
zbLZxxrBQvG5p$up=NC};25-|FS|qy!Gu#wI*D&m~5*6nTEOn>9;N03D*lW(?6NzOg
zA+)89rRL43!g~ebmYG$AH#$LIRL3ISN*E56-BVvJXl+Z95%Bw?LliHK3(LB6oMX9B
zZ5Mx`MO0(%q7}UHbiGso#zK@kTBe0jh=t0MT8)joBQ7Zt!x&S>jkjZRP~ffyqp5Gr
zSM7U%CSsRliOmaE`F_R*K%=lT$u3W9cB3avCd<BbW$^@tV5UFJ?1fbl0x@lkbUM}H
zz&v*Fz3IJ?nyR%ZrvTrIjnavZ7G@`@YppMTMtF5-ps!N^Li7A0_k^r-)#mL9*=3HY
zHdD4~*qXy?9h-r-CC0{S!v0pHRg<s%eMC~NQkmlU7GO4gLo?&id}~Vw&duuU;WS=8
zX_4B5Ug*Ibuf@NjFNmZ@Pf>m}@*xvz%=?80#Q8{2fD%CoHXncKXrAm5SK?#9cdNs?
zCkdbP&TU83F?LI8gWorDXzuQ$!{`v@kG(EgU!=&VnUBXO{hr*9x%WsHdyH$UiChSN
zt%;*|3msUKAA?#lnMPh4Vi7g175n~;MXONWG_eS<XT*5QqXg4apS=cDS`YKLU`zF`
zli+}|CqZmK19##>5}4##m+OuKgQtzeVp-i~CYalOaTC~-2e6LOf_!f0wIo^G_9znE
zdStT+5lMBUGriHg=bRqtJJxL+xULJ;@wT)<pf?{bBKUM`4mTN+Z3&Eic)7GwJ-33q
zr4qeyED4a8-d0E^8-jO|mXq)A=S97%(kXvoA8xn21%Mcw>J%3!V#DfC;s|Gq9?^FT
z)(>LhLN4x~2f5HGQE6CwQIoD%zY?Oq80k$d<gyc^CM}C%6vAbX@_A$ET9vP(Ce{qK
z63dQL=rpBED)nfqj&N5h`^8~<X!HWLQ>nbzrzBtoOm(4ILy!tEDq9=Q>svh^w{Sgw
zrsz1BzkQ3i4e11DKe<Kh+w$6?3|O$6zJK5|%yxDMvo@1zYI4{i(_xihVpNM6-im92
zJ-c^!#oZSB(OXL}yW1oeH{S-17i7Z(ql2%V5`jCE&&qUYoMVX3&a37WP&#>BKKj5f
zxJNPuw}DYyYVV*h!sEf;OxY?Mu)l-Xh|c5S{F=p8SN#5{M{S(sCxV6zfUo<;!HnFs
zD;DD4z`9E}E7yi+4i``K>yKZ&6GE@x$MoO9^3?aIkL$MiU$!@5iOIS`q^4;X7sWt~
zL0kH!*FvsF?qs@3vr5Ma#!Z|Q)q8dxqho)b!#bSX;a&*C1K*{oc%70r!V?Z<#*(X_
zGaNr>CyYdpn|YhXMG(WRkqP9MyGfzz9}H<@X1c<fLS(~131Yte_hOU;#;p&w-ORuA
zV-qtX-i8RZD)E=RE0bA8Qx%jL4#6*~+<p69%Z2J?LBcb|^V;#uTs-7vaK0T-U|55e
zAXQYo+WF(IxhyJ%9b^GKlg*cLO|qt7qc^QIh_<|jK=Y`mR@~JSzf_Nd@5UR-yq`QI
z9Bz@$Hcz47gn)I@wm)XYi)a$vj&^w=^hlFw=4xUVbUKspr_xmNI7g(zU>}wwUb)n=
z5DY$c_nxVm{={A_QNDT77fB=|Ip<Vq8_U=Q5+Jm;={8CBbg<|W7mJMmees?CC_PjE
z;m<$MpwNGvL2g~T_0^C>uQNr9Q}q;0`Y+5zLL0)~^@vOu{;tFMRt;hVri1!$`EXkb
zxVKUOc8Kd`0QPfYhp7J34v{J2B`2Y!&2D#)E;Uv%K56KOs?$NJc@)_4BioUG#%(*>
zB#X$4oV-!ImreP4N(+!?q94h9^>OoV96wt0bx)|NyWAm!u8PnPJUhs5;?^hp+_wgS
z8$<%;*j3R#w<)16;9kYv+lbDWFlgOx<u+6vtx)NCUn@_4z3u5Of|>v7VT-_$?~K&9
z6m%9{<<SRnSeEa&J>n3S!=JNtt#<J%-&#VSe=flsJNaRinfouT*uY!Kw*d_B0gaGf
zX#ECVQ+UINx!)U4w2U!;UCYgWFvy{wYYwjY$T*`|{lM}`YX1!;A-^Y?p^c0?Pm)0|
z$@jG^mZAFME|Ei@$P|q%R$hL1*D@+ec6Qbt;EYD}C2<1D9Hy<EL*MQBdKL#c*Q)?z
zmUXHpVMzTtD$Gh=v_;DS9SR^nnU1J4=JYchMz*>2o}JgrV&PlI(}e(x8E@!RQ&M~G
zji66;Q#5g|z$zcQ*)Qo>xzbWNQM9-(9!5OL<rJpRbV{w|=;qa8R{<RNDQs=cRA7eC
zqE{*S1(<hfr?gS^m&*2aJzDwH=|sN#*FVC{b9`Yp@<S!iuL*;VopVPrF@IDDlI%3O
zv>R{Eb%W$G9<xOW`&d~p0$9mKXLP!iBAr$0=-rQOT>Axka2{1-{<S@uZs`DvK7|Rl
z*$g(JRG0dZF{Dl?s0o2AHA97|@P|Nn((Nr6ce1FCS-8m|KefpaK%0EJT=Q5FhWZk`
zz^3>xAg_<~#6*X825g!xa+R#Cc}(xTW0=HW*kp;6r0C*pb%|`7KeP?}Hl&X(6v;f=
zQ%Y0j<{7uP_$lNK+fLSZ?|kwZ04f+aiYl>}pY{Y&b0w5ZYqQ`*DjbN&CH|aSou><<
zB_?im28PW(Z|8`YvEOEQIPW`ej<gZ<FraISBh;HmxddYhes-d`e*D^RiHD~?IB+=K
zw1)y;lvZ{^PIm?85;`i2CXGfwR$MKL^-((Al@H$UP|M~fe`5Ng!8USW*%QaMo&~4}
zG6E)`TVw3MdqZaanq(VsrSDj$0`Q=$Ngw=lLcY$6s2Vo)HRrOhgK0y&r|$aYnsrK_
z1^Eg&io&JJ1SMKR^dmrOEXN=}u1jSeV{-P<80H4?{hcMAacROC?PR|A00Ti`$K%&o
zf~aJb=omQEm4|h-=oji2vkC~nB`qJ8>}TSlnLE)n9Y2Z7=@-v{p?a$|kEy#B%_r6~
zymX3&W!f#lmg@ZYIk<I462WMwzR>X)zCP4jFwLRPc~<DRLe0TQj1J9*cpjD%A4~;F
zrsgrHpc_?Bz*9)tn@Z5zwc?2OsL~}>m<8?6-Z0fkZ}@`Wwa-+iTz;XJ35-kmvjq%L
z=7hP(lzO`^KSi=1yk$;x`v$atzh?;iu2rR~w3|Rk9x)cY6VW**cdJ={ZYf>U=6jb^
z@{UcntQ*cq^pkS<;t$MQIU`rbc9kiqjYZ_rPo?VGP^$Y$M^*99H0UpZ<o6$ej%wrp
z(Ck+TacH)1q=yyjjR3vQ3+7%ou389iy+U`<gBTZX0qjoNPN{<LmQg~k%8`Dnv&`AB
zH0itv|4e_thE$I6@!v7{KUtJOsSGf=rB`m9So3LS6C@R3Jy8oduI%Y0Kmy@`ocKwz
zw*7-<P0{!lnzcBI3u+LNg!~pQA#G1gO8+H~o0c)W{_%cm*vaf8E5JM~VqvjQYbAjX
z|9veoYQz=8{a8?8M<nZ>{KQb`*tu^M6<xY~AshlI$HgJ}AFTN>AN5Lr*#G&y*k4QN
zzi2C!%?eKZP0K`qfj!!yeO7?;<#@mPiUQ(EUXIX+e?;G9CFWR?+<Ou5ERP9@x3{-&
zz*C_`iz!(HqXfM4B8x!C!o4940lUTE_uCf+>t1=3IPJ%Q-uL~rO#RDxu?IGTPK+jR
zoXkCPUqv(>D48y-GKV-u-32`dSy7Uma>F_JS?vCtdt`(ZMsW#fe4#f@_1yp5P7hnX
zf=C(Sj`kUo$A_r}Fsz6C9v4p_h<~>&e*PF3Mgeg8*%W_DFADL;Wl_%Km&GGqhZls<
zuvqp0@~>CVnF|u7N9Mco7+kt`T*`0TAA_0(n^zi4CZOUEri@up<)7gfh5=n~WIbB<
ze_rAD@9RWqLpcjXfD+We5VT)C;URIkqTjSC+3D<fUnsRpyrejiUXHZoYOEJ&(c(9K
z^uSfEvqcOaB*f0}RUnJ;Ul95SpJh(WIsd`y7Wl|cuCVxa83BlGEY$|U8aI;!xTuHI
zzZ_gg*|AWzDW3+^7nq5rf{^?gS~Z6x5JI-=`_iW|F1QTt3kb?ppf+9?|I2rBn)1BD
zkDeiDLMb79B>YnceX7{Fz1OZcUassjIJA%@=m+C2cR_+=1;_z#QHZzh+R<ic0`DYv
zqZqyYktu2U8vwQTquWg^9T+UGqyacY=5^mDIq_r-%sOcM`EI@yQ?3_w3aC|m-2aa+
z<Gk7_hd1Z&G3183&USmPtE&f0LZa=<ZzB7(VwBDY>}ef@E`^sQ@jQY^UESHU5kv{d
z3h;BeSv<mv;Rm^Vkq0y6lh;?3ZZgFvyNpOO2KY_VToSr@ck9RLP+Pls#n9Hz!8GdB
zdB{R7!92i8GEV?rGh{xmnkvP5_EkwK3mt%FHMsgo!G8xeye<U-Hu5tDx$9hik0oaO
zBu}ClD}k}>BmEp)eZUN*u4bw6C&l+qG_MesCyAK0s4F2dKCfE?Py+x6?_)c`3`4bR
zv3VT7DiWi85(-L;AOYy!lBa-KNB_UuO2ThjerZo>a;^`p#pndHg;_y?0ZM2T7UJ~g
z!~`cZ>zDDSiS`fjwL*~+-YOGDm0jn0X>aHbKCZ~)Rp0pK2GElX{wyZ(!D*I?z!*u%
zt}v^QCa$5~QZiq&>w2p<dhNKs?J2EmT*s}vlSM`iBlLe6n_t&IrZ}GsRV*@!$J+D=
z#{)t&NVJFOgUzy3uk>p@`e_{scQiREjV>D9^7H%C3t%q1M5t>pvKpx)$mxt8gQPX-
zCiss~)CS`xL}*42@;eDkts5s^s=q$9b=hhBU5)SsBSsIg5SfsTnef`K_64JUk2QBB
z+1Zgv{ol^#wRe~pp65ttQlPNTkIIl#l;Pj$YHy+mB|k3NuY8YvQ<>vN7_ytIk}zcg
z+5f9M^w+rh6Bnf+JyB-)AO(RByfR`Ku+*hvz|(h&Rob<zR%Vz1+e^F1R#8}wHgRsL
z@yT1Voc0CY8U3mdGc`7@MyFG=8B{WfSx`H4MWT(yd4`+s2wY47zeom7>W#$u`+Kb`
zfPq22E0yR71#(htampC}=sq<iU{g(pbS|)FnasMX@wT(FX0@=h^G;z1!aGtfi%e#m
z5Zb0T0G0WrStei>t@5*{+9QvT5rJpc3AiGHgPchpk&ZFm-O#@T6&sf<uua3RyJ>^X
z8RlNMTWR)M4cEp0ll!#R&yHkilFhBGdh{n)dbT30+o0d5qA+g|bf*+xs&OkNHf!jN
zFzs}20`uPYIk$OUjVgWQcrFZi#pm7L-q5BMCAD$rgpXO#y6_KQ*|(FPUAmoS7C{9j
z`miVRRY%)p*rJD&g?+K&srXTm8%~xwvHrgeJWtk;=Da}=ZR!mmHCfa@5P`$e3F{h_
z#5UdO;(suYh}1gajudw>Wxz&?0QN|+(cY;3Eif=OfTllADE+!PJkyzPTJb$=7$XS&
zy%iAMk-U-g)t9%x&RYnM4y<cI|KaA#e|Ep}m{NtMc)Tg{Ix`6EO#QkA%lTZ{fxTB-
zT<Fw=0~SG6A~xLtBV85Gh)!u#d4oNLt;#Y2$OTW0)Ki+h>qSb^mRR69mPZ4IRDYSu
zum|o?zSmNOKkg}+Tt(FEDi}ruBzY7MU%q*=P$cnyrNYuvr<6ntZyO7^(a~b9cy}QJ
z)n)@{w3x^iIQGT}A+2(9+u8ORAwVARPeOE_K3^*&kkmZM8q9>1;xl?(sWD7SOs8{8
z8XfL$bAtfq28hp2k#!e+Ls=!3(}^nfnZ;+;f<*n*dk99wgHRQ~0voHD39a~tXQ8A#
zUoFh(V_mG(vY<`0-ydDhev+LMSEGIND#g+(oj>_D_MSCufX(x(u<XIw=j!JPj4sk=
zCl6XfXw*0MY^hT#*Dp-X2*za>{}NO;(<g};0NZJccG(U>A<OVrfIQiw;&X6vGmQ=4
zzOdbTG7bP_iv0fEg8G!cYZ%8(t+R7*ZHU;H25B+3W!@9R^oI36D%}6fVt|AB4*R1k
zbFTTY5fR0Ng&gmC&wH?q8PBS~m}DfXHx%l7(ONTOBs7zQQ$UMY2pAR1IpQRZ{N^*2
zNEae8MdHJRk{7>(>y^#!lIRYf$k|!e;U*E6I`Ml^5Klv{=eL76$smD26vZHG-AFM8
z&Kvt}fU$2`w|6(`rEgzUjIdl(5CM;Nj+;xW#62#7V|?PRwK$NW6JWEqz9gM25)aVJ
zzcL?5%)geaJZd0kojjC$^B)P?zfRY9=!rGTnq9>Hi`<*xgitGljHs%+hP%p$(RzlH
zHNpdx4ii{!F8CxM23S)ZSFBsEmtbv{a=>2_2nHep;0)Me>hlS2U+_ii7?7nV$(nS7
zS^-7fx=R6rC6wHZTCF>0=SqSM(iFWMgOl1oqth%<uHCtA=#`k!d-GlMMWa!j*f<a<
zh>L`H)SE@0H>i2+2Ix$3JBtu9oV2667ZuE}{z?X^FMFa<++3Vq>0|6?sc>99VpIgG
zL9xm!iki0|mpB+;dk+9^Ue|7)fD4i?Wb^xhjiBQBV`PcP7+kT#&zah^&Hy+Ba=%5u
zKeF5)uh-IztPzd=903in*5r3tcVizh8nRpa#t?T)W`g<Li-vy}i7_A{jPX{0jb1V&
zu$9gaQMBeJWzOh=;Q|w$&_`++^DGs7{#AB-!{bC7XqZZuDnueg=*oZ<!du!e`-@;9
zgs!#XK_w=xb!%{LOj2b3zw1Vx&dOoKwZb|_!0RuPCl~Z$`*H@m5U+ZM=#@)qer7+G
zIBzPR_dXqyv<^uFK?}NsT;DQ(Yuba9ZS?wlVYaxTb%qOFYH<T#(K$!ffH*M4nzyY@
z|CC|<j|3h7bAUU{;8V<C(IQ5ccWTHtRTu4P^~AdkAOLTCKvJ<*oL?erI!|d%0x|(v
zGZp0x25|UIvR~jD6LvD4dVLwGb55=M&G51ZbFcJk@?+iL2!B+0=q!u&W{liqj@3TZ
zEJbYyi=Q$vY=+o7?OXrdJNA%ZsZzE2_PSc>e7Hln)vd8T3ww4_3fA)<7?lHI1S57M
z<z=A?4)L2D^=IWsC}~zR83sv&u7C1!K5cljyYPDF>f7PWxcOthrIeW}H<Q#U8Jj~E
zTPu7T^;Qpn_r5zy^|tAEYISp`l|Wn1$^$-7OS%m%QQHITZz}AbeZL}mg+ImU@@XzJ
z(#Yqa8zhSL6pVlSPoT<+=NKglQ&0}-PJbMZ3)>~9$lF898pJkTJTJ6Xi@I6RkVbwd
zAGe*?VT%5cncMPV68XN)J|mlUUJ+M+`%G-~y!tCzbJ{CRUG)^2(ArRY+s=pn#UNEs
z-DQ?a&!cz67H_qLcEDmV=qAmjopav}O^EN0gCsBDCYPke5p3}SE$<w5W^2t6v}B-&
z|8|Ri+;5^gg?lr!Wx4qQ+eJc=M!=i;Sd=N>>t;^152a*+uB9olZRV=jg$(&qJm^ct
zDi`f&Fh8`CEB(akeF7{jf=%X~vyPfFp*nRuL2F#9ZxaRMvm^W@uGkCx&qew73YiUX
z^j#-PTqaWHk2?``jrebe=U;)q(Sr#u+v9?Ylpn21u>Yn?v+{*27PIZ_aK-^tNdhk=
z3ua9>8Y&3>p#Z58)_kXSWR)+AqH5uSqSV(~<3K6cm$>UMV;UF4Xi`qe;`cH$RUYIY
zKV;4O`>Xl)UHp7$&V4jb0=}eRlrRb(=fShwv%<3)B1Fb3)!a8ZO(iE)O^;~kOzry<
zgfa|Vk_Hk&9O;>7q-Io^wFS^-O1vM8!&pAngBn8R7jF0W_ae7--(t&t@RHG8q|kN<
z%Pe)hTDo~UZ>iPf=+qe$!yP5U+t7!E^Y@{7k?by2gLTWGHnUo1s#$EPXJZNI(l0-!
zlY8c&Cg~Q83x@Hx8)B3slrV}riBGe&Qn&*!T+Z3(K*++Kkn1j=J73AVQ|$W$e4ovR
z>>~Ofs(1Jh?pgI?(9b`9{CEbEB6gMMHmi&ZcOgAr6rAUkgXA47jfM8;sn9GXpXL~-
zEXirZqv&|>ts|w9L*aoHQ{fe<&=#4-W0?2klgF-GN~@v&<6Hmhg1QIY-hJT=!Ob-+
zLaVw>HNdFii#+Gvg!e%nCf)SFx_@OP(R(ZuP`oo+EZ{lRFC-DDzt}`ZW-PhPw`-^K
zA&=szeHh$5whj!G@*WFkvS1Zz&$yYQ)Y;lweg1KEun{L0*27sweonwaQf%|l5xw-p
zqz1YQLrz|cORf(;3gBH|khZ`}ar8#DvCCHr$S=O2beTHySb)<P)Ha~~7J<Q7guLfs
z6AI106`b+tP2boLIoRrG94N#1sJ{J2|6~5fXQHNuOn-gc|NOH0^hkezK^O&$O3CaE
z(9S0oPlaWM83T06o_R#H(oK|Rv!zalz*osM`?h@9=Jy(Pu5m|9MdkX<nK|+=@-CkL
z?Tl*51HCYldHefC7byGI%-NC6R8Uam*Fkt}z!(aCmBC6<#lj+kQlSKUFE*JLAq?@9
ziR(2!s3;cQq^SMzh2dkTtnc@Lf(kjt*@(r}Ah^|IQb3+Izqbqx@T+W<=}|s&rt+H4
zV_%<FuROB=J(Ga{KANb`_i$3QvcNa$zs9nk4_v=YF?7`W*7qV&nOEoG0qP1zcynM!
zbmWz-FcTb~&nkrv>VsTg!Xz)Arv3`?3$F0Gn`OR{w!;-K+d%`WQ>+eGu9Ncy#gmT3
z1`J(6f5_EOiUl&Muf_oy@@HD(vj%bI<A#CD3*(_#(hIyt=jJ<>X=?pGq-=r&j@iR^
zW~IVB<y~!kB}O=ciA!pxae%fVCA!_rIY^>~+|)w<zX##pZ=957IUXiGhO?={ZC4~I
zoxAw@Yv%1r&R7W!iSS5;EHkNV*Ig5IJi~(pbz0aV!57^$Sd6&>5%w#3vMZSpd8^CC
zsC#HL!(Q;$>2OU-8<aQ|<(lYr;aZ+n79zm^E6l}+Cs^>AD%*?p9|wrDkYElk7<z6i
zOVEF%$aZby`o;yjae&eA2_ilFWraX3A&w9Tn1NLnS<im@hp4>FczP#&JD%kg{peLT
z9rDMN6bWBKZdOAMVv!%XHQU`3MJC=i>2ZQ_?SWu?p)Rn+VGGwS+t^@7pfcLn%pdP5
zEk1{w3Qgf<dQM@bp%YvmKenvK?3Wn2-buK(M42wvF*(;W0~d_5bf&3yDxXK7UTm)%
z$$!fWda^8ND|tFcw`mMzX$wC!D$hRkx?xO?WiI%tqGRz<L-P-xarZ+7kHacKjb0cb
z;+VE-;yo}xwaO!VJxdGm#$^BNC`9?$FOQr}Bn68w&c=`I3h_6{xr9gP{Oc^=BKN-w
zX-7^-zNeebuBWM9ronRfHs5zUOS(fZ^40rBCF8?@@G!)4o_Kxxz4^i58no^}3pGa_
zYDq2ict6vXI~cccZl2w*;<uoXY;FlwKkSN{Q2Ps^D?Xa^YurLoYJ4P>BIScI4Vh(r
z7c<uR)&%`#O|x{hs+20{qWx``qBmB6si_)z#`xX6Ca@pG{n6XZR^*z9b&q;Pw4^60
zkcZKH2Q@d4ZMsXnB9<SZGG1c0RGxn4s-Wa1M%3f0$*#-Gf|y^uP96~w6xd6g++YdZ
z9AixovPWuIP-Rg<zMjcj-quscsL2~$!|}+U!z<hJ0rL~FJFVm#(0$=L%<zCx!OoYl
zxyev4_o$heGmCtm1%yZWaSqvYR@p)Yc&@Sq)>h<d;HBZohv%^cbAe+IWWGvL?My5r
z%-r6ii;%pR;BfyKvOrH0<@-{rx1BvugY=O4a7VEghZg+k1WX^WJy@4qDWB6+KCB`J
z5BP8H*6*cx)zxsN@9{E7i)g$P7V|$40kdw=tlRt|(K*d^;|N64do_)&M>~c0v5*g_
zs!I_E@q5y47yshAUnX`I`T+j)0Yu=g3QJsv7C2xzj9iGnmfrZCV3H)6)g_*L;caFl
zKa}rMHmEj``Kn^)Gj2*@nJyN{_vkPb@V(wPr&VUkPPrkwFZ3j`L&dPdl_0T4DKzN?
z;>{`CqD(bwq_CeT6~ixzk1j0{VGU}7F==~{6<q|jPI8lrZ70!v`iNSq$hupl(+TH*
z#k4{bZ#quCX6rR>K7={*A8?^AV%`D2j&nYME+#gw*lJbXNcBq?M7Pg55e^qtZp{#^
zI~fxMWcXx+Tv<HkgWTuPGiN{G3W^=4lI%s2prfMFc&1(rKyKMvY}p#USCWsnk?oJ<
zLhf0D59i&td}jnNP^oJHQyx43<9FFOPy3naw^hb-fcX9{rqzx%D`3m3j{KADAlZO;
zowqj@7>jH24&jVycR}Od-AMr>9BaM3D}fjG(Eq+-Cv4_e_C~7jX4Al}nIqUhnv9(7
zVvfN|vtWP%@NBZL0f|q1yoBR_o=bnGsb+6E?=68jO#2&T8jTxm8-2qkBA;%C<iF@e
zrUm$YR$Ere!Yo@Uu{Mwe#2H;7GIgs$2ywK`@+sE>F7sJkip{)wLsPjXO4I+h$mkcp
z3EWV<#S{GGUZGM}!>M~R;DU?PhVm|7>~P_F<2F?R0Ke@Nf6blu38P|>kP(1zK=*j_
zi?=Y~Vo)={1wI;M4}``NdJPFe8*G<VwWxG19yJ`+(P!1d;_~Wd$M<HbYammuof-y2
z8(`XQvCCk~Uc5MQ%l*3*g2MG^Wd$>*)#Z;%gc95KLZLqD*kz>|#Pr^$(X1%uk*oxO
z&SC5P&84aR2?6dmG=~!1U1#iUKDsZA6d@J9i{JB2c_)isfqy!zK4d*|oH-}xXR^t>
z)|wM~^m>;q?Er}*;AaFhW-u*!!n^@EN{H2HM)afCgw=eLHxHXjE^j?+g=PVocVT1a
zhN4G}(ecC%K3Gy6Hw{0i7UQ(gVW>`4#=iXOzlVeyl%VBsSmci73^gI9+!BrG#ud^L
ze_OgX{lMz;t22v=IGS@B!YSVKK&D20m-fp0D5v%p3H~&t80}Se=ley`67%m(k8J09
z<%~CW7U49PxNZoOBnNfL_%t-ye{);v*(-q8K&PDXCARyk6KLDXsuVxf%?TR$&G_rd
zgQdBK!RJlVJU1ubYz@|6zalaP17-(pH^zroR?B0aEp*VYAY(4eO1O3$T7vPnAAv}P
zg=FbQHO@DG`R?2LfPS*|RuVB?q4m>Rf^o7XaaB(*%d2KL_vq<4<wbJoZH_y)Vba&D
zHWOABlO5GfLkAmdQawB$efzO2JzWrxW8`gz#RBshMsf_|v_##q&|k79#j0d*)Zo-D
zeZpQA^sVE$sx8=7_?{_o|K+uL{iDOpDP~9>G$qun?pQ{m#X}Q|TatZnRAupth!m(2
zUjLyD7H;|y_R^C6PM6XBUT3+U_@Fb~{I9-t-f18W#qL1D#`o4fz@H)O$==kVMT;*C
zBruK*WcekXa){O)2>Fb7)}i$Uv%vVRj4==dN))j%887ru+a&JiC!GCIc_WqBr-W>u
z&Y*=@*>ojJrVApM#A{u={Q`d&tRR6|x7i@;?xa-fmV|bdaz~4%R~}D4`5zx-GCSdn
z9~I7*i^dZl+_`D`Y}WLnu4auP*1^cdrCY2{8PGiQni@15{*b{;hI}H2VsO`Pj*2)3
zF`~Tr4VdMfd1)Hm7JE9cExI=CkH$^CbC0)Ze>*o9fl=)36{7<NUV9C^>?K6(!JxS5
zV*lft6;+}n|2<o;|0wtV$TTehmm#6}tkrlYbTBrJ7L=vJI<4cQ+8kW0@MPC4q%Gm*
z{@ck+1mpbD4aX{6c!*%BPkLqD5T*GAni|bx;Zs4wXJyXxv#%ti?k&^Ui`@WK6fZ=`
zNVdc8wUV!h!rtk6L}h{6p;7e|6wWolZT-Ge#{?I#Mv*z6P^YDs+KDm;HJdb-UXb)$
z{>9+I!3Yza_)+opupW_fs&sY4ecaZ|sQ`R=AVH_}^I-88VE@;l8K5fJdb#R{(#O*)
zckbY1cT}|0ws50m9~)K%2dCL#Fn>8d+jAdkfRWTA@?6CSQy)g{$8L}2+z!e&g{oUv
zp7y@JA_`^Z?Zt7y-)5`*s-#d?C5@&L8emKfrIS#cBB~kVcpg5r<l}ru8jjH#ADWe>
z&&ruogBkbHA+lJ`d2S=n+9uya=N{DUVHWPptM161{@4g&O{Zlw9Z{^JIz_o0a<Ao8
z08ePN>?(=s8AvqlGoRM|BE)zsQaeC(AxqQfd$<sFTr)*v<SEE=@b+`JIn5tlHW|?H
zssJdlLhBQPh-<CzFRMzeMY!EdiQC*8><t~PFB+T>^ta@ZU6I(ThUQ?u0Hbsp)p48C
z-Qc&ET}P{?x%~NR>mB%sB0ZR3KfRp=;(jx7m!a2JJE-{8w^y+X7dOAMM_x&poEn$j
z;GcTd;juRIso5o{A{K2jKb-BzEJ8F!sU2*(A;>=-)@`M(RP^FI_p(h*;__>+T2?y#
za{q+_tq%!BP$dfN@%kZ-tC~j|;yE;X6{JZKFUuKw-#X*dg-V@#9Fj{wh+b`uqYiy7
zOXA^pCK$^vd_VbpXyliKn|mTRu#|Ue)H~Sw_=G(7?1YCv``H5cCr2x5Qc$8wRWn7g
zoY{2s(aL(!R*VU@aP;F^UJZ{6RIt(ZA@;TH;HONtUVr_(HF7;6=PSVk3*_Zw`cZka
zh{=W6!2!VJ;@Yl}<~!jlGDq!Ny@zLa6<n7P#8AIXWH0O>!*8SU3Bjwbm1#u??yZv~
zZ1wa2%*d!*MoQU*Z>bC8<7V6c+`43UT^Z?@c8FtWj=NaxLl=V}%pb4Zp_US4^_rxV
z>;wEG1})i+KVAcT`Wog87zp0j#wBQ60p11ayI4fXY0Uj?KK#EQ4?w9;Nz%>7Wp<I8
zi6GJfWXLGjS<@?4{&jSXoR5WCUY}BDt0B=<Wf%@$&y23IFw1&Oq78XjK>r{jYJIx_
zLC$(Gf44W7T1xf%7q+h{rb1V*E1E$`*$&IIKDNppwA*$rPVDYenI55+2DJjv!5y2O
zzzA@kgO|N(OS1Fk?^qVqP^!SR48$k5pl87NZMEHma{PK0H2nBEELory<6t|u!My8n
z!Ee@x*KRaVCHrB%dOm&vre0*zt1?mQps{rf_gajp9wlRvNg|fj?ML~&Y+fVIYOF+;
z`(nK6jx{P*zqTZnCmh<sfXcXx!8pZpbL`ECe43UYO3t>Ijc`*$sA4gRkIwYTp`M_(
zm0#FYUa{}t=H7y!X}o4sRpgb71sIM_KzVI0cBeOJPqCJ^ycR1)yd^WwL9GQ0;DGVH
z`1RJlOqxV~s+lhym(fB&RH>6t1NOR33U2^~6lt2SUzSC@14z=!=;%kj#E=3eJww2B
zd;nCn7q<AV&p=g%H~R9&Ad8IW=mfCCD#aO#AH|)4cbBh`>8a901hBoS@$*h0Wp1v2
zb<_J|i0t=_41p?YS=^i6M33R&T(2BOVyfP&hw4up1@T!IR{RrEL_aXjxh&=jIt6rA
z4b<10VXH>*8l!q_&OZBK!2ml{9$=7!QlOK4*%4+^%jj5~&G4x=@r@_B_BgInJN<(B
zITxv<?M$~@rA{-wkNJr}5{XXeFS&)k<*_;>@j;pfxzU41Y2I&8yh>~6mfN~+L+}wO
z`&E^Hiln!0d2#PxRA8BxaVf=3vl11~SH8RZedl&*qmxdf`Q7T<Se>kS5J;Z&)_28{
zuY6PmG~=NbqK~4CmVeyjZEgsM4&$5lGJ?6TTyh`<4u!TXTK`K-*|~S#(0o8BHLx4e
zQ^=_B_J<WeaCRT-WVmJDm!Kt@&9V#%)M>ddt!m+sgm@OO5`F69-2SL(veMBDh_u+9
zZO?0Cs9>6mql6UAsfqE8a~58r!i-tQx4a%c{x)v;reUmvEBMyV44o<aX!QA(1VP_5
zawc_qWwURLVdpo!0#Js(>JB)w(>y_gr_gZnWFr4=)4Ks{s%wVtgTGxr%LU4HeZHsA
zCwEb9fb+Mn+{+R*=X8x}E0Eg!s;S$}uWs&y@fE%cSRJ54ko&GLD|O(Wx=AtmzeC7&
zay+jG0&ONHs6=ECKX-2WStY$DIbGAQvXzq_MN9DQjSh-uiWp^8neAvPdj8ttd1y1j
zg1VL0aBr+BRVV!1aKqTW2RMjiESxqimR4KcV*9GN|5%?Q{N7tVoIvGQ5ph(=Ti(|}
z1MrMJ(!1<73bhv5r!7J#PT6-L$KqPw6)3d6*w$vlU9>YgI%*W`{18|lPA{HWR<n;7
z5F5pDn&SIbK63=^G$b(oQy22aY0^KU(r+Q-(J(72&XA088j3L;c|`bF=EZ(B*1*IE
z?CzM*oJ<YZecj(~+qWqh3S}hu)9V&6=Cqk>;?qa<zYS*y@d^ZtiI6>3os>6|l&AS2
zc%y9E$IWNUmvF^Y>&7_!*@f8cx!LKNMN^j!$I)MXus~IFTbv>^`-Sg3NRmH|&XJCJ
zC$8|ri>x7Dv!k%iixAc1roz~<_gUPsL2RiK+9=Mae9(;nD&}YXu13qDS!3SMuU>KI
z{7pXWeS#&^y@Ro~_y$WZorgDLm+3<S$kGGnAgO*2P#F?Pn$s-9s%>x?7n<%5{pem5
z`13ZSP~(rxcNu*_O+(lJdy@6DnP!$k5zAuDbQi~EDisn{uJJvT7|WJNi_$CIj=zAi
zODu0zJW5YeaEKe2Q=>8#xsz;!(&)r}$irycUklW~{!)|Vje2lKG|lVN*G`vSz9>a@
zSNa0~*Wu@)66>9}o_8h=#etn4XO(~GI1&?B(34$f1aEY-=qZw34tYJKGF6~#{-!OY
z@1o58Uu8OsK)QT8CgN*(Goy8TRJ=UD$b0H&9TtcK8*Wy7Sj*581+6gD_d(Ihxuicj
zvViyLp%Dg5(2H8g!tvO7rM3*83A#r2x2HZtpK;*1qjCdOx3|*=`CxkHJ+-!aNq>8S
zY#ZQT0fx!@hbtx9_()?iMs3Zb-bw5&3;=gY8}co2Tjm8+ntJL#0F<A-yOR|RVI<KI
z2<HRSNGM7uv1y)FdxUAdH}I-Rew%k~@6LQWL!Bzr;YB6YhDC^s=XRP^0G4~K4{pp9
z65#T2Xw855nw2AxI*8^TwdVQon;vX$`xTezZcFt?)Uuo}Ek4WUfO{=W<)Bg7^+kxc
zj>2qRsRPdD`^)Cl?~&v^7ikjYg~u~`#2X;dQG2E{Z?=u_AjAp9;<BIV#d*KSeUAAg
zVavG}p`ST~{LE#MY$a%+AI20*%8cvl*P0fN_Up6E9vf>bOUBK{yJ<iARe<`VY`5g>
zljh(z(Pdds#@Tp3)ni!<L_wL7TiUCiG-aai>D~HDKdM@Do#Xt@wRA?Mg0`Xlh+>6&
zQclPIcJf<C_ejD~iejS$qrn<05mDpe6CMEo4Kwnewz(Opl>Cp^D5#|-%6!&zR`<$s
zbB*fg-M;h}W4X+rkLSsDySQi>d5lzc6k-!g?S~<YNpH(32uQh60qCgwRi2}ZbVTjl
zW2)KPZT}SaB5!A%U{8woT;j-I676HaY4jl2#1k>tU1WUv{{){{J(>sEf&AvC$5Fc6
zV<3M-zA9~-)!Yq<X#Um5^ZUl^1CanhK4S;5{T06mZEhBp#OR_|v;(k(ecIt<g5>+W
zSAAAVX>GF^Ieqstoj9H7)q)!|=kr#PFMhD{*15W;0?b0vum8MaE%NV=GF@xtp|kR{
zw~t$3iuNv_<~iXKdgBxus`ACE+Lw86s|=;j6+3#rO%RNc)8bc^DejDE?$5z}7Lm9R
ze+Q&jTl{4-@b0Jz;YMe{Auu%L{kLEBaeg9KH!ht3LTfKzFS4W)aW+{;vwGgw%=<EF
zlu2)V<Zn53o7LY|(2(^*%O#RTazj=3F<#z+j}cF!mDJf*=(Px#t2~}aImJ$RDz2yi
z_K#OGBUO}p?|rwNj<934i<nx>|8&9S(Qh#?l@*qQDdO*CQ8!)+tfx1K1UvYVp&Fv4
zq{tvNoql7^mHL0+Iz2Am<~U>rv;$0;`cHL2{~@412Qjh+E>h0sVOm4S)ChDv#d=50
zOX0BY7(vQMA2?X&`8{}$T!EyD6r_^;zGM+?T4C<j5@kWn;k@7GBcf2C5KLhvwXxoj
zzZK~>gMZvu%QS%}SCIq}bSEL1k2#NKA2+Y)xPHE*Swj0JU#IQ%mDA7U$I=DKmB5wg
zH`fbPUe%!QWg%4hL%{ya^m0C`_K+m#-G9O!PU06Uhco+8ugPw{bFTAOX_P^8_hNgQ
z=-o5C5gcdU^tD9G?iG7?R0U+lfE~j8o@78Sz3+g0t?1bYZJ_6%Z*a)6|HGS+x^ugF
z;X@;=bPm|4V(@rLkuN&zk3p&_G%N~a8M-%EjW1PX>(-vX?Xs=V!8ngpRKMjyHrEiM
zRJzB9*c(vLleJQ>0}zg@n)luKRsT<skB;;Q3+S1e=6ItxCyK)Zdx_QP6WcgSkvB|E
zCFSi>q;+%{m1&q?n-UdnIUyAt@)f1sIk{{Fufv5Js-)7i+@Xu*kRq)iQ{Y8EkX?<b
zp|yZ8yQ`C?TEtquHg;bMP;I7rlOrpjcZuS1vV8%^D2SjV`F>e54c6a1B{??!5Bq$w
zf`-P6a_e*Q1$okl;4YlyUX$TwG`S&0b+|xD51r&eh`H%WyYL_^trDZ9+RP61aJ|NW
z|2mf?q|>YOw&3c;YW3%I>5sYZD4Cs{5e(nenBR*UU}^j$E=0D$--hVVXCc`P(S4tW
zf^z}*VdO<yK4xAExV?MJM$?4xv#HDz1OIe;M>I4<ih_utBc+{>?_iMuE-_<312#-Y
z^<NNxb$da4DM~4`i5lidgVq(?jWE6L|5;B5@<JuA;pq>F(D%(CX8Hd&-G6Y_tFUI4
z4mxCiv3pQG$hz-VVEfHqCn+%({~yA>1FETY-Btl9Dos>CBs2k$-aDaJ3DQwY5JbB4
zA|;_jdXbLO1q_H(5s=<{FVcH20)YSl67s@6_ndd%J!juH{xQ}_)_{@K*Ei=k=llaD
zeY~s!yp<8@&M_;`nIcCbr*4tro|ieSr7!PQ9j5MtV)dlI>1Wgsv%2U#1Nx(K*a7Wj
zC<Aw^Mw<<q#FweE9L&Ka0W2h}1e~|%_Bgf^VrRCttY5T$Q7nj@dZ3EpBgu=>2hn6*
z&<H87=M|fXL;bEO+LFmAx0dgWy;e^9U%IM+YLT)TP?(<*(HXH937jKd^xMm=zbI=n
z^ivNK%oK-=&$PBmSs?fUSUp^tIRj;gs6>YACN-#E9A&%ap9epY5-S81sww{5(KUBh
z@6NU=rAgeP?C1oHJfXdRV?>Ld0p>HU442tKGWGI~(xf?T;+N89#XwOo=dKsi!+(2L
z&F?V}2jj<jTv6`F5yj}4usTj_x4OxbwK*{(H56A`O}}(~m3kc6gv3b!jE}OWk{lf<
zw>grU*4&bSbeyudx`eXQl`Y_LLGGs9p+4TsXCaTgJu2D6=Z}qHM(s>Q9_y0<N#JXW
zcQ_eDF??sWqP#yk*k!2!A#r#;e3$&2F9XhQ9^fw!)suTO9LoG-MWBK;!_tq>*+LJ|
zIUWBbLJ#_IL}*!J9{25^!nQa_n`n;A(WRY;=;q#K_E&nG;<$I8E{G<ln5q$VxWqz_
znJbbDZ}d}__JAGXF32^(w`LwE9xq*t&@`|3b8IhQhp?p|KmLxuh-#KomW4Lc4)G1j
zT<#%@o&4>sQ8J<cQ}PyDvzlR3M1k2s0zlq?-0zv^;U{FSN*Jr}&ykVX;%-xQm`sh%
z`HQaPdvtzp6v7kp_gsmhb>2LUPnKcj`J?Vn`vSpeUs$Ah7qDW#a#yc$yl1);O*u14
zg6H$vL?ro(3m;j%s2S1qfRO+9qw?Pllk?UdzMsKr(#&f$#FrI563#}q3Pe_Y-U?Xw
zotPouXYS04HT6G4RQFhld4lX(6A5&g_bAox5kF}hju!japbj!ccvOh$y$mI7+zOAT
zk3GtPgYH^b4g~`wJ9HakyGWMhvM9*jNF>gDIT-GH`}cRAvbif`HgGA*TIip6TZ{<}
zM>N~JKJ)UDa!yJ=&DTq#YI9Dov*b-Hcq`57R|q<@P`FD#FAtQs2!mf0Y{(#2j5(}S
zNZ8dMBZ<qynCf)2pjN4L2z*OLwSvCzT0+GpLUo<#gvSl{>|cB)s0zE#Pk~gTkscXX
zGAp)(|4-?}hli&r@N#XBsRi1pw`9-}6wzn37hka;e`>)vnxvD*oyYT~ne{zqP}S=Z
z#@KBYUdamrW{(RB(s(JKt+BB_^x6;ia9K=c+3c%YQpV^|#8WUwDG_djz9vA+p!{jf
zND<Jz7(PI!CC$xJq9*dTqL$0xMcfAnLkQ*J<<i+}Z(-!snF4KHf{&YY#N=ArGG(k9
zG4W(iH&j3wrI+WSE$lv_r3t#t2E#$$XY3^+r>qnvBaACXT$RmV6jjvrBy1vhrCo4p
z5|7R=soKRBJ+bk-EQ*Y~_$`|~@O01L&EF>MbA3{~8waR9+xSyuzTlIj`xpH9w{sV$
zKpfZ+Ney4`OL4o?YK3U_YSoGuTeBnH2}7<Z<|mM+vx?lC7>Vps3~lfRA+56fo-Rw#
zQhV&NR-}MrR&@1y8$Z}6sohYdY6%RLm7@4LrK-iev!yuqj6-5?J(6BztB?J&J{giY
zL7_J_LS<U>>hYE=re>*7OOxSzOXWxb^CG#t`}Ntbv^|!Cj$w5SVkJ~*#&A7YSeDM(
z4!XLFSgx|1{<OQy|HhaBPlUCr8f5BadQV=I`ucnOk54L2pI#hZJe^c%*gxU_HK~F*
zepEDHFYv|quj<YU;;lQ=FK5+P$^R6`gH-!{7CU0xVv1n0r9@U*DR8uketXbUbh8IQ
zXA#NOnJm`c6@q(1Jpk&7pL!py`Zlix-N}qk<~B}d*a@wO^0--j`ErIO62ULSQW`TA
z*HyDLhubJK;J>!D?XqZ*yomt<R90?22wjYgGYo}7QJBL^7i-+QG~>EPwiajsB8$rc
zfT%nyIxOwCY`Rs_qXd39BeoL2KbTmlG^LY5YABqoq9^jI?et?^yZ&=h7!8sM$y9qG
zx2mJIS237sLoT9mp~OrT8G6M&zdrth(BN#lml$*djI51hHqML0HZ0xZRgHYet&XD)
z&sNSs5?J)H+v2F;U^gbk%*Xbf0?nDGkFyoQ9WeRoIJmZV6hj&n6+5YNZe}BWy|p9n
zOuhYuPVZdr2^w+;)x})?n3p)bTEgVa*A8E<oGf3DMTQyjo%}PR1M)woq2*WIEfSB^
zA~;!Os6<v6`9u2@pT6H(UH*!X_)=-r)nWiJGoKzMvM!vZ9A4#Qa9CFe4?E5?>(rr>
zv`DsW23aNoF1ct@bO`n7*$LTOLS+E3C94cbN0QkUbHIZiQTo5bIqA-yvO8Y9;Wc(A
z##H=b+^5L=9V-cA3ifz}LLU$Ht?|A&v`X>kF+H6g`s!gndFz?Vo3wn5lnqFjxx>g=
z^!@#tOzGN4^1o#dZn8M1G7Ue0ElUEa$<x_9=I4uQz13%?4$T$l26ggy97#k_J!T?_
zho7yu5a~H3oiBcG^Ez%N0MC2mnp~eb6+CLUEfInahj+^b3abTCJeJPi%Y8)}q&BSL
zswk3p#1umazqxWv!#snguF+65qLNxu%h<`jhzq@vzTyx-#Ygh0eQfJXHcd%3o%A`P
zwn&BVZ7T9NZm}0_@p4ARHWkzqvpPuC1JE+wz(Yv(qUi#8J;U|KB}{f;z?s59XzriT
zF>63ZjQH|`?O;9CD5WlP$hbk8hdrX1{_^x|ahhS?&uX(zp6|euDbOY|P*&Oow-_ra
zD2uu+x&i8a$?)~15T()Wvpb}#t0%)pGKZJ0Hj^8b@7tnnZO(o-)|Z}OyuJBjiVR#+
zt!^M<>*T{pv)p^MEAAxvh(IYjroz$Db{qWVI3j46#jeP~hR%;&+`ZKZ4fo6v0Ltv}
zcBN{KK4WCfpox#Vm-FA4pf3r(@<}~dyE5&WD9)d;dG?ZvRp^@dl}*$nW>p;(HC52A
zeg;{@Xz=`6i+3MUqR!8^=5l26vSrao$<&T(XNEF`h;#RItn_fz=jGQp;*Qb3p1AG2
z+y^PFk2~9TTXu6~n=gZ*;QM_om#eR9frF_(`7(Susm8t;LlO<p`w^8+2QPkcnH=22
z)BQ@8$3nfpol$`#**=@}FK7PHH%v7hOGLPtmz$DK4-0-86E;`d@XJxEcYWi8uh(Zu
z`cb+Jut|5<z)U}`l{J9sJvdzVjMvgj*Qv9xrsI(N*GPOAE0=$NdNiI{ya@T#VcHIy
zTT*?dE{)akzc{JU*x}F&l$Lwg3P;mllob2|0^<wZ&QmN{l}%H7aqoFMufG&hZENzz
zmco5qNB5(Aa$Fy=ql-a1Yh`5P6M+0`%j1=iB^#OluQi`Vh&mf2jXhW#b7xtS%jI6p
z`ws*XAWC?9%Ahs~#DV=RAg;2d{qN-}8xSx3Zpht*ny(0O{Kev{25kTSR5iSny58x0
zVAA*Vo2wCc6`J~oH0i#%@)DoY4U1GSd(1cR>4U)Vk8K0E0QinzOPJ}}vR+x<2k2c^
zM==e8tO^i=B99NE2sx%)fGaAeUdPhcTjNM(5)q`OVP{U$8--neq+yRM3na0fM<QKF
zmh^_S8s$ZzQ67&E>1T<msga=on`4U7D1|Jeck5j2Y!o{XKiT$;xTje&(!5MTaTnWQ
z5ZUey@w{NY`}THt5$iL|E$TdtlDfQ2%N?cW@Or+6?gN^Ce+Nq9<C##k^q6Dmim+K5
zUp<=CBDMU?hsps<pNY#KVzNR6X#(2_Z!Q$~)QgIA5e^m5-^kP^;P;v6fR4s;JEAlZ
zSz9<+(1r?!(%v_Ql7!U66=_5+Lrx<1c|J9}MjBcQ#bTFoPA84f-TQH$W?5Ah7Eqa_
z$0~6PR=`Sv&kpbb1m2t2Y3K7G1T|UoWyaUECz$7kC$H*2_TFegKx9-zBaa^y12Fe{
zG{j6X&BB!DW=mqET%)3AUD7S-guf^5A(w;ysK{KzC6Bd9KU#pbp-O*Kg$&>PcgEm+
z&>U2Dv1o(=-=*EG$^A8HbS7bjjdLbsakgP>=2(U_fvK3%(=4e<pJq~CQD*AADMLN~
zd6R*z+sv=S?f0sxR-w$wN>Nqsi*>QX5-Z3Kie>5>NR5kN|9(z%W~kW9@xm&Je8V)z
z&enU?=M=Xln*TxDt>o5d4|wdInCo6x<W{YCW;A)4KHz76GLh2Lp=O>zR+9CQhbj?w
zQ2iJ`q~PAS;mf0*0^=vGHE()4RvdU3Q?BpcgW&%F58CV*3JMZBD_3usQxm(`KCUNY
zLj#b$Ku4}o5{y(HYAChPdn%rb@CI`4)y%KqpA?mqOrE>S%x)Z%sn&qFX1+!BZ%Y;V
z+{Py(%1>#Z1OXAlKl@4(x<*X-|In`=OwzY92hzS^_rmkC*P07vy0{bF*LhEbtTXUz
zc(?g_90dNqTeWmJOLRo}6Wwyml81OyBSdCKF73^5f${x`VA9-zgDyPVfy!Tld!bc5
zLp7AqO(S+!urO{V$GB={>prz`+pl?G8Fd2l8Njf%p%f_|1KL(MrIgrWniI%hp2O{0
zGlpIsm0Wh`1wZamdtDOy^g|KL4l`X`XXWvOdz1=>pmBe)w{?rq92a!w=wI78_n)`Z
z{AeHlLBfd9SN<0=#S|%>ExYEe2XakNtnkBa7{s#=7}E)DEjmrZ-lr~_P?M4F1>clc
z;doU4cpRR+RY;|3oNW=dcZ=`ByMXhd<IYt0oPI_sMLo;9Az5$9(KX{&;^#g1BWuic
z9e+~Z`4)j<De)4GwVhXW+5RK8kdpLf&kEHhto$m9Ytg8EAa|E1I&>0OEdNjZheJ9E
zZVcUf3J|$-%2ArH8mmhu!@*}ci<f4r3Xc|t*j^5(A3VU4u-_(9?{7TJqBKnB_|?ra
zm?R=!caL~hN1f%CMYa`1^HVi2k5*?g5wxSZ^i8&~EonfNYj#^K@5kJ{Vwn}jhymN>
zmhZM(-LYV4;GYIet-uP-Hf(=hQKP}r_#~m_e9bu>kSu#Y67}Ha_p#Or7u&y44E$AW
zH@B!{s~NNbBd9(kz@T|Br~9#mRTnlasO8u&Y&%hAA`yMn*5Aw9pZrtaZaNu|`Q+ZT
zJelQCZuo0s&_@}V(YWx9mF+k)#9C~uY_maQ?s^yKO8Za47RWs5O#rF^#+w#t&-(P3
zO0j(H1yj&2G=BuO>+^GdQC8M_Tw~SJPd2-eXZ*To#*NDyOtzU1^t!TZxm556znHyj
z%P9v&A;qKf&New`%>A-To%K1ScCB!&+|b`6!eOMfd4?}LO3#0RyM@%3wRx@dCyV}E
zNzy`oVtr~a{Oo-iy5>*&8fPp1JHwjYT+Z`6)r(X||9hpw7N^z&g<AEn4-6Po_?8m5
zbKEzoWZaTBCk9MQ1O$Nab?y8TD|<9d;Ze506CQY`u;a<jPwhX&Cb;tUNSN~A{aM}d
z1O-mxFg#~g?P;p7qf#RgbaepPlpL^s!b3cYs#qXX9XWM0a5S;Pu+kY)NdEg9j?9hV
zAwBe<(sP}c%<Vqe9P%>oY>q`s!kNmM?Yasq^B5cO&nVx23ebvY)kx060i@O2?}<bU
z+bYH>QP0Ixk@srUW>zH1^U1tk%_s?W=>c8TArBZXmV^sgcHq&{cuo<So;?ZQ06Sc$
zry$)4^?h|UMq19N{-1>sD7H1ihv9NI&Rd6FnR3ii&hz-e3W*wxquTdE|E1f<J!m_c
zmEX9g_eL5pz;v5U$ZzuZr}Q(`GSt*F<7K?r9v%Df=M7pwJi45VDYTEe+i`XIr1^A|
z;u>vUqtWZ4kb(ex+1y0_*FyQipRqyxfEqK;3;WS)wp47C_~K4m(fsxQ@r|72tYdcY
zv3i{h)}~K*&@AY@nZsCOie@!eQv&%WBUP8gUn~&wYu!KUUYd;ebM<K@;jRSI^9eXj
z<+fpo0MMnQ;~9??E3<q4u%u?8T$04jlZ2-?eWdTgYNq0z!%B9LEL-cr+#UpyJBjO0
z!o$s|BJ2RU$fGWJf4J#TKC^%D;kq3$Y?p;G;MXII8h{sZm#z6vrr`D2W4RMC^K<As
zl0PCEu0~Oz2prDF;gaiJyyS}txW?BwpxyM>PK%{4hPv*LV`PwL{#%j@KM9I|gb!6~
zVSc<lVvvJZ`iF|amA~L3uoMp#{T?r7F%a)nLk?^vkUmZ0wYwGHk7H}vq<1K-|KSRF
zZ(GQM3e&QxsML>u=4;aDWO?He`uAjvlHW8r%If8v6%aj@ipUC|wK4nxV$BP#B`nU~
zVzSuQ#dE(Mm1#sQF)<=2J2Q^sGhU>l@_7!we8zZa!j3FiG8{%mz<3V_u1MP7sqORB
zy?e<9<E>c=dd2}32^}_^F(6DRYX$4D*2CV>k(Y)N;z1a$%X}nc3p0GlM2tEMgfjfK
zaKE^`Az7M&Uv1_S?G@7%`&Cxr?$F!R;VlnrYpyl?r64^2lOW-%-$PY@>c(O+d`D|f
zW?g&ng)_~Dh7ga4AMa-|JVm-e$0gEadsN!-u_WiWu}@8Vpdk`>BrYh`T?!8~@-s#J
zr#NwZI=yt&nnhg>2(s6UwyNLi4T`RMdXWScA5V$y0BkCc(XdBtwSAI^4dTcq{33#{
zXKGbYk;pGZN!ive2TvDUiY23qX8ERXyeh{I#=XwI`So(ZGla{&k$Vv*)D#nZ^0_+S
z%vXwhxXznmT;=f6_(vlLZl=k_Y!CB)18lff8*&vi8|TX4wzpF0wAff_O`Q4KwO3n(
zTh+<?xG9ecB*uYR*#vH%GvaRSz($4Cv1W~!jI@oRjLeXb)BM@r4w}_Y3!k#26@14s
zr7uTE?!3MAQtD&KmqEAewXNK@`5*4Q-AL&5JqwSt8<26FNp#2lW}N$H765wXm+eet
zq3z`$e$&I)J9`_qJkzT82l4UYErEr$XE)mmAH;?KY<3;o+qUhi>hxoK=y>#AYeN!7
z&1=?A-&$`z$JB2TQm3dss?W=q4=^JG>@D-?e+kwLImiQLp+`oP^Wcfx{AK#a>DC3$
zfa^-3!<}Z3QSG;Z&$*R?<>7%j3PMkBy}7ZqmiwfFm*^RtyToXeG=DFDH_!Mb?tNhS
z<^IhmNAW5FEagw#&8buU9eBv)=kMe#eNBT%rh0{c_xh315nP-f6n%({QG;T7C-W~C
zuyVHhbMI-#(vq<<{!0x9>fk!GMgrODCqe6cq6}XMMTP=59M4yL*ld+_#5tSb=m?jn
zcemBUt9JeO>{%VNMQBM>n1aon;QN`<_I&g87Gn@k%NS8Mk4fDa(AZZ{54NMP6xt*+
z&yUw)-1(W`{}mfM{P{G1AgbWgC^K;;hsql|?^Mqz?udjTikW!-IIpK+?^F*+s}Jsa
zs=3E-)pEALuuI~bF%0YgQDC(bYW||cGV5_xM?dO0#Z@08@r7yKSza{%;2#&AOIhM$
zT9Q8exTZyMA57z^ZT$+*O9Q{dM2bo-18$=l5b`j&BJe=ZG|#!mekGDzo@{1HEzywG
zX9rcF7ZnfH=ZV%meZ<oEQeEKThoIiTd+acY9`E5e7|G~Ank$5+3HjtLq1V`zgRLCb
z#>3q!Ihuv={@9o*HpQ!L1g>kQ-SLNrv=|x_af2=cmNItz*d3N_#?`d=2cZk(4Gca&
zf}2>G!vp;5MKB1;U_M!T;+moh(m1$kW*@~(LO;e^`bz+VW(TUD)ld45HthR1Aulu*
z;!o#s)3vM?f%lCe8^8ZR!eR+bYEKyYGN+`wjPYZ1U}1U<?|7wr3;<Y7&UZr`_o3Pe
zvZmFqec6D&J3T0+*t7V62}QF(Qp#_#=yEHqJB063RJYz9b?N(UYI#A0(_!E_9xD-v
ze0dP!75Uot!fSsffdO=XC{sN3A$NMlS7rZ!+D?6%H9NYjn6FV&Lo}@$VW@Juf#d?A
z4T&!pV#Eu<-^FrQ@~K)wFqApPLa=SyS9)8=sGsxb&&#hmfuf*u0F|3bwTmxXQ~9=y
z)WEN`b3VYWgK=oZtbGn&mdv462eQlfmaDf4=2n1b4{*nF+{ODOjvPb<O4JEzvS`K4
z?2`@3jJM==?1)vT{+dMYakL8FfR}iqn4Y=if`~1@U$>n2WVg%Z6gzd8r<PfaHI<+6
zV^9MB@S8-rmepz*;j{haHerA^GCj29)}l}u!}0L-uzzC{1pX77kbBnUDvorJu1DpU
z_P;rVLJ&W;qp_%3KU0Em0Ja_ewFz@6nwL_)H}Q!g)8R6%dALUJ_esLn;y|Ik-}A+C
z4vB25f1KuMrBWIF`)J0u6?Xi0e>)AaM~HhANq*1(`_25^9Qc$u$%GKIeeP>d(aJKt
z8M8s|Zx&IcBT~OVwe@qc6nJ-g@sT0p_gFMB+*v%@cdefG)0=_bjabhs%acuhp=c2&
z+YG}=1oKo#v}8QUdWiIUOr-te8W~Fs6OHm8p4^?P2slWZnUoBqITjSg>)0!yuuvM!
zOvAseF9J8*CZDc)sP2aM3OwP*HdQJn{j@_cViV?e-}?5;sLWWEC#BbN;`dv;B*xy)
zPuig002ALpCa`##XGvKy=wT{yi&Uu!?&A*<yBt6G0(BHG?6L{sY#8k<gQZ#hkF@FN
zF?ZGb-Syl|+j$V%U7>1>R$Q7v_i$adFpVtNQG=3n;MLNw*eU~kayjKN7+tnz#Wm~U
zbVkQeN?w(9x`JbiL$Ar#KVC#w$jQ|fX5<ogQrc{xT$8?~r%gC<y1h^LITR=Hm`-1~
zN*2v)@TJ2>v0tr&&n+$ztffT<GNsw+efQ!k?IwCFw^A(y<@}n6($n7dr+<QAXTfl<
zMvUf!bR)0-`Qle1sV$~$O()c)`?6bB%3$N9KTbv}`W5Pb34|ZuW(=I@@|Z)gvxV7Q
z;A~`>C6^Pz+w%uL#ytF=B|PkKza}G^FxrJf@0^Aus#)l%(9skb>^A1g^ySJI0;-Ns
zu|F%ICy?_hd5J{F4t?>st51Soty)tOnmk^frv1c$c%;>pqss>Zus|s91?YH)L?^-i
z(eEzXiCZcIQB<XJpJeNAz5jwrpOf}nPEYqbSn#*iHQD}nEUM++OLotzB~Ea4aEar*
zZ(rnHgl>O33I6n(E(^aCNVh>rOzI;;qsNpm+Y%L$5ot-#s{GgenO~yC^JT^BK6gP9
zZWZ1a$U@u6l2ol@0^#ta%e>W1I0vQuId__XO#5p4$<k7#x6|qRSgn0pyE{D)*9^~x
zx>0P7iGuFPd%w**D=vCOq;P)JWchGV-K3~xuDUDTpmhH8fp>^Abzu`@*xGsEbi}L(
zd>%o&RQ(hbvN?1ZgUh7xS|@tfN;!(2QgS=;?=~@R*?uDfCE<^a8G6mQuR+)}VC?l(
z*j`+FK^711vfx}$pwsUZ%^&bf_3hB3Fd$if3_^?4<Zv;`F^sivm8GE<flN8rRb0fD
zqlE`a5<RZs$ZyckvB<XAMyy5KJ-i4cl+nd(g#hc7ff9h5JOE+6mtif+yp4(Xd=(`S
zrHNB4?YZF7XWM<jy-6G7>E6yd8S#pVVHfvlGVVppO(@>KBmG6>G>ok$`$iaKr(L-q
z#Syuq3(P;-g*jUpUIyb;C2LbGu|CUR;JGZQYkI)DIu;Qy89J%58)4)49@pBaED8Ia
z{I@IUw@$Q&44tZDN`64W+|tM76|+e|tnEydqkUgf&*>g5ZaVDm?1ry<&TuneXMpN<
z=SSIPE?WGc2V<FtbmWlJWi@iVOH_5;k{U-j_ft0^M%^7h)*E70theWm0iUmy<Ey{I
zWtPduI-}|CfnS~F#6o3=;VsV(@14a#(I{jL^wNB=`slauXrGyjHuI@h6K24D+FAyX
zchWXykKJEkTqGQ|2A-7LJ=arief^{%o!lLYar{;-%#*bGXLBZmUh+&Y?+&6y*V|x=
zl>&Z(`j|Z@$<?5KKCWRwM)1BbiO3{a_POg2iTp?1I#e*il$mXfxqV}hh8o7~vm84g
zcWnK&qpQD%VC9do=LS_-7x%{CLMO?xr=>QUudws39I35jrL_})>Z;$?C%xc9*g}J^
zlZ^D;Uw6vuI7`x&E(jecO6me?*4B7j3OGf<PerZNDF$A5`GJfCc=vBEq#2aXK5_%}
zD{_PTyXZT^(0ZjqA0S6A6+X%oh)Sk5S~~DfjSPq?n0HFn*{w?uOwgT5^p$i&GOQ(m
z-$L{=7@+WE$tRX7xj%Nu+OYnhZY)j?E#OtQ1QRecI<)fn&H#!~@ZlA6HCPMNT_4F5
z^-^vu2^t%n4RSW4u#|j<sINTUAhms3wlsc>2)r}t{XJTDbBU~n+_Rd{#Z*09tI)7v
z7E%oF&HBI}G5%-wtL4e$A4!|ZbCntpN=4lzsnRMGkV$o9m{548Vu(|UStf^ChO<a}
zMrf$XC?a}2bK$Q`T{wW2&vq+{@zj}ulHZ6OE=9diDZLq|D3|+6^RtA`scmzj1btLA
zn-bYhFL)zwP%sX?{BD~d@Q7Dvs>qc0K~ag}EQXW-rqUoJ(@8|Ivn%gdN`5_>{?!{=
zV5kR<pWXV|0DLTS*@kl~d}gnc0AXWJ&X1MeO=5O-kTKPb{0+PGPHG45C-b)>oFKvj
zp9DqcF#ru?H1M)8_NyUw;Le!6+0~b_^H(yOezE!18z#_mpjooN8FZv?%y<zQyUp!{
z4h=ik`a~dkRv(&=OG@UDKG_}uP4d=>Skyl?J>8DYH&i0|gx<t1M*fs4(pfbqB>TC$
zF1KsA@|Hs&&#d=*iJ@;LMD-Pn_gR88>l;3HZ6=2IA1j(1I6GA_)8Y_W0Q1MsRwNu@
zOGCE0svy;cw4h-Vs<rKdcQZ8YcIDU*ddn5JSCGC=vFKXi;;_0X(S^ofzMLT?;RR)T
zZ}eKgxYQq>I|6EV<ZA6se!soi{*<`ZH)~Kl{aJ+YeS_;s@^hhJB6$)oZ{s=2de?~!
zKf}XbeHXB^E-ZK^acmXI**Yhx<Y2LKXPGMwtZ&DxiI1eH@26|Mzx)Qh(Y#Yd17vri
zJ>D1V=-UR{e5aS2x$UIt1qwU}AL~KMDXtQggU?t*wwc78jDLvlRpkjU_oeob6Gm-@
zq0B{Y?QcyI8MNnS3CjW7g<GxL>cunsW_K8UaucpBsRss6{o<IQPt6}kB?#XPH@khR
z+TdVwHre;C9l~ZrysEsD|9r>ir^-$W1TUXZjPi;KjAN;0af+J^sfH!sgRBn&L`FEr
zd5Dlf$g8&JLiin@ZuY$V%euz)mvv2xzcPL;*34s%Mu@*#C2PeNuaeG5Pfy-_gciu3
z$N=uh!|8Q!qLBiulF}caLL-lcnSCclMyZ{ATql<C1(@3Ix)<#2kHQQ?Uhp;mz5gP#
zavFIH{$Q35rx`@vnPjm`Izd*2zRLKj7ZW8(dOF1JGA*P7PQz64o8C_>vij}&RFD1W
zOaFEJ%=do!UeY3|+}_nlE+8#N!cMMAdN<RWh*Bi6@hk&7=(yK-ls~jibPN7rWFQum
z{wUema%V(^_qmG5s-DkOJ;gem8g%$lxa{pTjYm}7@8p-JrKjE(;`2RjI)3lxzN1!z
z6%jjDaKz?7My3|r^_k~PWsO~qTFBckVloLVK_7#~Zk-josFWPdQFdwKnp(CNZ(gNC
zJ_v1G;FU0bbpCKl(dBrx7(D@ed=P_LX%l0mgR!h_MT<H;_qBYE9EuuiS_>UsBPb>)
z`IyiWrhcSG15VJI<K-1e&t4zrGSu#m)%_v4qR7?08DrXpJ!$MTO!}-UNa9mcX6{GP
z)?IQ4u6_-k>yV;(vXkz|{QmYN7=}nJo2NG9Q~g$>*>pmua>ha^<~aMChUMzBAkFZ?
zy*J4HdHe@)K-P2`2KLAw{{3-OP3-j0H#4+Z)bI%0E^KykSpB{^sp#DLN`OKF#>v+^
zl;ZujSCN!eg2V3{FV|LRZiY4$42Q;i$Zjk!z%^vgwY!uNk0RkC%J7teHHAXXs*7+r
zNQSI|SyKB7rRX#Ng3}ZUrYQcwEf0rJHz~gJY|(}hsx|H9sf3yr1@co~Oc*?ls~br=
z&Q*E(K$P<{aJ&?41)7*WPvSQzWorJyi_0U$vC#O&`U?M`mzK_2aQuM+#ebnP95fS4
zZ6bg7>gqE6DoSww6ZTJM=98SONnBQcBi;&_*I)Nl-CKR1Ga{K!rG6+gipIV+ua=+>
z+v8*V$)@Uy^L1YOmvq>3$uC#5f?}U&2^N;jXX<iYZtG#{$;XK3*q<9N)G}Y&lkzwt
zcOqCC)R74n{t<y>rKbkUq2gh(g&TrozG2VR>b!Syzn|^CDYF>A>^qIx#{blP>!7Z)
zXYO(7FVC8V0Hcr5CUpVMcGXCD$xwM^Pv-!`PD%+<MTKrT<`t+T(|N95?5C78w49zj
z@Q1WYoI=g3Kwr-eS^<?#*vBjr6JMqrgP~Fxb>dCB)z1VaZmGg<uh^WKTtqubUV+3|
z#Gxg^knz<KURQuX{Rlvn9WYrVV6l6e^E`f2_g9&Yrr(2mz9eUO2M5$3#7or*-};E7
zT-c$~QyVw0Lw=VgzDb>ckrF>R>M-0%Mz<toDfXscr%DI<y}_KPFG|Q;dBMxCXOei)
zC}9bF``qV3MzIyrh+UtmE5@;~i}BF=hP_0rkOas~qLge0%Z)(I)A42CO<KAMoH;`y
zY=kMI^zl{!%Xgvkr@W`cju+#+(*EKuCHH~%WuHABVR|;=@+zh3Mws2L8<+qXDdsr^
zeNW*X;)_D6P?>d|%oq9+JENBH)ZSQ7dD#O?(EKP9-cO~)BiDPa7_J|$`ElwVZ{cf|
z1n%NEXye0ib7+~nrG!|>zt%K(GeEA!aPek_bLk+dbDr((p^Gtehhwkv(2s)*k2=pk
z>Y|ItOJqTp6n}>IXwNqA3PZn*Iq<g@soOeOe0m&%^*^gyT=*DciY`Mo6J?|{o-Bg<
zuGXMh9|y8fTSTL=(8Kxfbaz`(Z3j@V2UuLi1|UF=*xLKuT=-to_=TsTIX7zh*xTx`
zpt^CO!T#9F;?8PcM^$M}1M8~M`3nABW+znQp3SLSFq(iNY$~Hem}HKj{{b1&&GAFY
zi&QGd4CQse!n7RQ?M1&ur;qPVBKd?tpX95U-Gb-1ttt`b)pi3_?mImQB_|iVl(E`$
z<@pEfM!FwU{I+L9P%Cv@lwrCJTNIsQeD-!S<==N{Xc*e794cNTf~kH^IrAcFPkfI_
zHg&bkJ|5gN8>^gkswefVjA#viDZ>uC3@Q&b56Nz{T2J<47gRs&kH^q~D^!e8+6)uq
z!4z}iasAX=2=N51EPQyK?Qusy`e6e{iQg18%6Wxait<7nGoZF7j8JmtYpm2F#!Hh-
ztj47qsCj~Xou(=UiBAa|$5vyB{6<XaHCB=YmOV)q?=c)buQZME!1MS@;ziO$j8#n|
zy3$@NL#f<=Wp~8Xim988j;hRk?cEv-!kIl|WB!}lb2Qc*Jkvw&|4?;8C(%TWh5+Q6
z-Sn8CQT<uKFw@k%P{_*g*BBe~Z>y2!!AtORTLC13LSr>In%;4pok-@r3Hrl-c2g}4
z1~d;3@B4)wq%EA5AV*WMjy}V`$fN6gp-KBL7oWCe&g!6<D@|q>LoOFih9B*tdHW<*
zzx#d#5?7#*HB_jPSbvjAKEFfYm9+F>%O*Uf=>obw)+Ks%RlPlwiETyU6}@zcZhx@t
z)%1%AcQr2#ij-o&DS4cYhzW<YFWB=4<cB_)PmRbAL+%;J&aP99mRgN=fmG=de~h!R
zt&Hc44ij2wyR<dcRaDC$BT&5sIMZ*vH~2X*(Wg2I$7o+iuXWxyNdZ+&V(RYITt(++
z+J{_oh_q5>V%Io{HynAcq803os$^f{dEu+efLTqKjFuqOJxOBSt;ZXEYGyOlozlOE
z&ubc2rVeQzuSJA28f^-1q>#>_1LjOBojtEcg}dik0y#c)&(mAdXr`_%FcuK4_WfpT
zX5yG6(jKr53{(7IuC#G$uof)Fxq{Q%vK+IJ!PA+VBoS?)Lv}qY;x1UH)rHO64bkq6
zXnrCBGB5L`uqYxJAAt);)Y+7n++B`-VaAIut@8?`pJPv)pD($t#Q&l->~>UjDya>S
z0-EHX$CME;8FSpcn;AzA7>pw)peHZAeJ30e*Z!>tSo@8J`Qu3VVtY(YWq6lvr}f>4
z!h0DGN#OIad>0krJN`-LFCy?b_*vyB@7dj`w2B1DOYLptCYtApA(@WG2!w4q^o=1b
z>yxlBQJt&wVW5P9EcAoRw9&WD7O}$(Z~E(jlK!Vq_Ag0j?KDxD(na|@2)gYcAJ}vl
zr1*Y=AwA;?$!qp;AKUCU7GeBO4SQH?$kxahQ;)?&_l;GTqI`S~6#&T#n5$SgyVSYu
zHYfJ{Lua!caCcQt^a6}I>P7aZU}9_f-0d&=s2hbEmItu++Go;Hc(o~ci`di2Y2*oY
z1G7KEElWN2VwF9w`l`=&OfU<xxm^T4*YP=MYB0@loi<Wx=u%SKIZm~a3~+$$TlSc?
zP-LAWZMn(c@WU0DA_YH9?uFh}22-{QH@VKG$9x#>S6t(J@r#hZJKPu)?izj5>*A=x
z()V;OPR*#h-I2eFTh4-6y)E@TUcf?OV=yA2v*>pxhhF&IU8`b-(YRj<hlAu5RISJj
zW6|}?cd=v^slG5Ki%*-$jFGg>ziV7AJScihvdW%zYm~?u{ebw&a1<RrDi}Q=33Bs@
ziq&mzmwLOL?w7(-%O&u=H{=mBeXHLqKa$6&`N!~@N!OVwTcTh69;7N=n=R4}>BA3f
zOKZ~oHq`H4G}|$DZ-LN<i*(-KBY$y=xhiLJ!nnccPV1lmd_$SX3|==F7z~}A4PDs;
z(^f6}{a((^iP84^kEgG^<+{L=-7)#pvgwVEfB#8p;isFEU!18)ZVO4@?bxe&A}W7i
z*U=DT^s0(riMJ-(5dOhao`loD4PcU_PHZ>Sf+e%^Jm+;|)41fP=RMD;i0J@3Qp|62
zKc6HXwZ%x_iT5$uM0$5-Q8h$pXX15+h={C*zut+E^Sj#nA~m(z1x?AGLRxAqh61j-
zt@~?tc6Ptu#H7O!B$|m%wUz(Dz0urGVdS&83AY0JF181`Z#6iN@Snd5$rzw&@u>dg
z7ifaE#-=$f>K*LVYJTTH9CXf#Iy&t3o#6S=&R?AD&YYfUOq18Ar2D;V3aJB|5HBWx
z!~}MkfJ`Q{B%Tyqb5_2`5t_womXe_)TQy|Ni>xMd6UO93E}cIKFXDgtU=?TDLv9p<
zO<#1v-h5~uT(g?ySI^+}?>l?b#(bhGU?3-v0x#XonH_*r0XsNKH$U>Ew0x8^I#|A1
z(%ul7NqW@YgRmr<H=h=W;i0RZM`C!SYXuk64s`biRet|V$9&80wbWsrlmvH_8G9hd
zvdnoT$(F7PyRo~6u>*yXKT5MhC3HBJtT90+>ltfpCm8>chkH9Ckw3A-_6VgGD=rJb
zz&MzhNgfy*Bv<i_!Y5wm3zcor(pFgtujf=YZ<dXL_%I7zQB<LKV*8E|5W!{2IE>a%
zMKguPdKrzEq*N5_PIyA`Z{iy6(Xoh|ffuzeW_R1J$3f_6u+KKGdmnr)#60nrb37nV
zu!PcVyV0lt<A$8(XN1oqh&#UON%eBOgdQXh{JgYH!!B_CQ9j~brMx3hvkw<hq{DfS
zPjtj_Ag*hc7nl@b$XoX(HeAR=kBrD>LaPkwo4)5jQSXxFoGvn8DBu2*BK`L7ZF7)!
zgixb+iD5Upc9NkLc~{qb^Mr6ZOMB>H&znPH3{?xcYZ6t(OXV<dTnh`bx^HOWHX@|5
z^G|D&m6RrMAK}Op{Gjydv7hU^QPCqqNQHgWx1ALF{C&FxUa0JNv)o`C!Wf-IC%Dep
z`xwmNoin68F&KS%wPRPFlBG^7Jp0$JU|9REZ^L?;8|z(mJ|qB4=WyJ}uDBKA*(Ik`
zWf7K3Ankbm!VuU(No-y|HN}Dqf0+pMZ_kO9$e(FnYEi+AEAi|ioeL_4;h|$KYm98C
z)akA>FUJgu&FCiD6i<cs$7v57&h1P7ld_yGr1{J0e#Y<OdRGg%JzO6P)9kw+$L^8d
zL>;0a*X$a~`)2<8r?DgbTPB9tp}cN&(j}TTjwi|JTMiA~+ce5c=1gTLr^XkbYd>Tk
z2#n!$2BSyoealaHBSRI6oHGuipD_)&>rhJqE}mMkHzvf(!0wSH+><8%5?nrR#haPv
zEk(>Kz9fZUdU)DPH^EgoQp5n<NutQUA8-4@HJK_#ohzgJ<;;_K01l3?Ws}DNBmw7R
z@T#NSHba@p!eeud=jc9?UPBq*ldkBpAMODGSGCN#X4$nM|HOS!88ZfMU%PW3T%mil
zjQIh%m+h^9zHDm({<VnU&dJ}wU36_3w$Os1j@`PZ-L!$cnD@V0+@qlwY@aOOxJNOG
z&nS5Q&f{`%`lz+B=3d|^&3Kmd4B8p0C6gu6Euz<1&FQy$U^jVS{U?~Fuj%cA8r3_>
zOv+^?*o~0jL^CPdf(rWdXUw2@33PsqdWSsGVvjIYd$XCJgC1wbQ8o)yy2Oto+;k&_
z`xixY-AF{1hkT9uaJw^eKv1?yXm*=Qu=x$vo8Mtu<&-UbjD6k_g+>tyg=&_i^@*tA
z*w~d`Ek@_An*2Ki-hn%#Aj6p&D6~Inh!5{teco2|8v7Z?zII&|Ss1P2)Xx0%k4{Uk
zdD*?DXCcD>{F9kL6NW#oKgW`C-LX$zH921SOZkP$pBFwj@sv^Ws=k`77H#Y=zCE&v
z(l^n63|6h=jn?ut$@_zs<>_lGnIW$Ws%(mykTW%5^?O2|&eF=JlmS7cjaw;%XHwN4
zrX00>jZ!mpd1_Up`J$@w0bK^poQ6|_$$Xor8D5R-78Tur@nwYJX)|xFt1{k7lor{t
z5hT%+`Sud76Kwu5Ah%^DGRr+NOns+U=`LmS7Hj*`2)})_A%;g%Hv5YDGnt9Qe{!@s
zQXDpw&IF9A=no-INq)#cUXl6NunZrc{X7due$0l>C)lTKjOR^h3u&wXe&+UZ=t#0)
zKcber2$NIGsu{vLI~*@Gq|a?5v3aH!y(*SEO*5|-7!BNT<|WWwHRbRZD#YD4goz!5
zpOV5LXmz?B^_T`#oAr;<*P`EOEYBByxpVWr;H6R;l&ib1j}%gn?9F!|K<GRAhkQ0c
zRLa<&<+BcNZ|Q6ONA|!d4xr;75M2wQg(wdHQb;U!Uots`BWP)}%nleZ&5|<Boo~Ce
zx?kh4J;k9<>fz<^0R{&qyn8pM+JP06%|P`XMJ^x5hlg>j;6e#ZdoHZ)e%4Df1v!%o
z?{<5O(AbqRoG5p);H|dbx?x&84e_~tY4`LT6;SA@x*~oashWlwAMq=^?Hnz6Aik_2
zPKdw9dc;cPiQ;J7Q@m?0kDLr&92KqQ{1~>$$s(I~XF0`{<1b;y|Fw<W>ASQd2}K<G
z9Qr(^z{#-|sXJT`aXqYZ6P$c7bjl};{QLT`+pKpb7jbFqL$O+a-~|So@``BEv`Ab8
zr2_jvex}+}XihN5e;lJNKiq2B>J;IuFRAx{`dO<X8ZKt&P_WC#<vG<H9w9l=CwdS2
z44{8*#lZ9py`x~r+82$|CRB!#j1x6CQv}%tq;KgvZ@&qa#@r2)Am{HBL*5i&WI^g0
za_x*JK~Q%)bL&FF+r->k#c-?~<<=S4<}p~KT8@pDd^N`_0W4-lemzKWo|tQC`n6^y
z2gjj^jYApuhz_iY-T`-s7Gx-;(C1baL+p7k-;xI26#>Wxlh)ZwT{Hm6$V)C?xjC%R
zlH3?7xYICF6a#3CkEbRiqcV#R74g~Gnbf$o9a+H8sM{{!fuv|}SFnj>U<EoVO3bux
zv@mEJTiV*B0Xt+g!YN~{<Vh8&K1SmSxWtF`D-9{!?Vv7?1kkevEAjfOyK(^d%SRN2
zOGagCIdRbkI1BBp&AGJ-u@LsQ&UEd7E8WA@*HR&d3JzvJn~3ZFTt5Z=B{#av{~x}d
z=U0p5pVsW?ou@7E-lY)J#NHz<jphHX&;(_ugwV|Y{A?LK2}@a13eAO;!tC$UekZ*l
zqr*(+x4lW(^~_gY45YrovZ5N!n>A{7zKiB;>{V)rQX^Az%O=Ni?dTb2j23AEJ&;n&
zjt}(k*~|RO63AI)A|mNM)TO5q8%Ms+Ofg0jqCX3rKPY8YJ|{|h+yYcq%0}NI4S8q3
zEo?3b=*;yCtOs0=e+lDJSm5<NgtH~l-2BU<WZ0H-cA2wI@RX{M>h8M~hEfE=XUk3+
zd3mO=Yu-5#1YUc=N%sq-<*n)xuRY+uBB7s*W*1rE3~$rj1m<&IB9^sz)(;Y)tf6`R
zyryJk!e8XgNo9S4_-@>?Jd%0@ixC=&<z+UWsnBO|gyBr~!7Kn=`m@J3v06booOAp2
z3WA-TU;S6^6;XJ_*a_ypF0E2!d|%v&=&c^c3HV!f|Fy9S=&bq~Y>wM?C4@6vHIXNr
z`PW!3E(m!%s-`201eRX;nc-CYPY(Bm8{4u>ei&T(uTixYXTcGC0Pcf+n*)uHn+*`~
zF5*?EKqH}_br;%l%%J`mEkdastiwQ#6*s%me_V*}0h8c!{6n5gThGSoYQ*)^FHyBC
zEj%(tR30Hj?01NZq(6^fOvZJwKQ<;xF^Be{D<bzDiqaz@7X-)%cA({jq0UXocJ!Z=
zXHhg+r<`rO_ylOkHHE}4fOqY%iK>^VhhE^myA;$j7>kyw9zRU~Enrf*c=a9ZOn6|n
zTIV~tkv!yt%S<Y6a2WQ`w4cQkdygA;!ednJFF~*&$bmtB<>Y}Ar}wH|3y}FR_Aqh<
zsD%7|uH`UI;H`)kiA`+s?)5~oLvT3*K9X00<G->hGMmtm1XpXnS*{*5aea=OVb)oH
zu~V4a6(UQZazFT{AQR#9EW%QwM|V9xKbF{OZ?DeGf+&h7W~q(AQ>Ta>jySI>%NM90
zbF;AU{RSJ&4aL*HjEY6jzV~PkF~mmN4ou;^Q9oHnMv*wBsm)7@pCQ-XOh>g!p=$@%
ztA~ok%O@jsC*|+f^|z;}03Tya+<jIEI4%5qLwUV}I8i}@-e->%2k742{Vi9icy&Wf
zvLXtBJ+KU5xg1@EtO`ED^GZIUJkWzw+qwNYxir4BsQ*I^bllo1+=|P3k9Q!hT;_W}
z9uoQeIO`~Bzy@tyV_k^z`yZ7?eez3OTg{1nQ3|`6qVp)+&nn1@f>1ZUv9?04`6<BB
z;pghe1_zOB7NOcZh=z_uFt`7j%JA{WSnR&CBad4qKuemT(YMP7+}in{UZ2X@aN@nW
zMxObaJq_Ct#91$F9cRMPn$7$w{yo@5lYl+A<^5#LiRHc4`5@s+U;9^dipTZ0;Cb7E
z8$=2>2h4F<<K`yB1eEpmn}0stT@b7+-aOc?=@bgmO-SG1`{s=kpW^y^h}iKCaI1a<
zJj!lE0HHD^cAqFy&xE59HC!4hf+5aVwMIT7FHelrS!E)0R7dxsNBZTV$(}Gi&|UQe
zof}93rC16A`Y*6YLNIO!a;$6VqmBxlbS$B!Lo|tTM^08P8|}n1pu~C?1JHtaso+(u
zT)>ARu!6}WqEh@OqW{;T`xo=j*+edTd+{i(6z+eC9NKz!W%YIzM3E|ROP#Sh=<Rgh
ziTYfFZx#Hc2=WQ*-@iH4hgtwPGyy=n;b-CJ%=M)hGpzWC7?iK-Bbr5B#98D~4K5;u
zU{D+Or=%doj{`H6L#3tO;1^cxJw?I5;2N%xUo63T^@vJl%C*ek*H#;0;qD{4^+WGx
zZ6W7}TBH@|;{5EpcuaA!IRlD9&YB@GsfyeZF`Nkj9ah+)J!$|rd9A|G&c{DKv{tC0
z6`qZ4Z@b!}6)b7osQoU+1-V<CIxGa&#DDvrLIj@Q4`eIk+n7(K8gLW4j5ODoCg(zm
zpR!b0J_>9j4TLlnu_pVTHiyS(4T^83yLUV=lts$00PtM!Xi5@@a!4mR8pL!!l)3O|
z?#83wzC?PT9VyiYZa|WbmPizXbM97{iUZ<1E**J|V^!tHsCKF9#GK6)1;0i@Er7J*
z@%_D=cpE--E=fX_yT~m@C#9oj)a6QtI?o6_ToWZanpNN-I3heTH2w;n^<QX41G~(0
zX_vC#C2oJEo|`hp+Q;|M;F#CwZ$$Tj@6K*w==!Wy7e8Z~mu2fyqUio%t+)cX*Tu$k
zL71^tohu!YV>rOV1mle)8a0$+Nq?iZ&?-HutoMaVdlm%*{gQP1G8!q^kxV4%`a+%E
zSUqE*UF%eP;B@OSLE6V*N#}vCL@$?n@|VD5{A_T`2q#So<xJRx5J$)8jj|k^C=v{q
zUdqLtGI`^Kj)xSz>CE{Liqer|K@<R^YKQ`wUE<NZnD?8Q5qx>n;GG!jw|}e1ceYkB
zuZQtr*U|i4kMWuALeICo8DB9yc;9ZTEKJq0!Zo5%kQ>U_S$!WFwxZo-=F%s&B9pJn
zqYkjJWbtn(Nqrsf_(rA9BGrurGW=2^+xp`=V?l0kSUwj!T<#0|!yu4Hht6G`U%tj|
zC8d__!Gy`?MX0Modm>qY($ie_D%TSFnFh<wL=N3pTl%*~Ml;OWO|_MOD*xAv1vSd0
zCOn!)k6uxY&C-&inbUK-O~o|aSL6$G74%Y~YqT;RcZSGhh;?SF$eYTvhZ1!(u7Q(^
zxb(Z42Ae{@_2$U9JCeLc((n_*nk#X6mL<<`NH?1+s2Sr<fk#qAAU)L>?1u8$Rd4d+
zDUPoz-=gUuQ#~mX<W=!M>pYz#U7ekmQs?V_b+!pS#A~Fp<$}#Q{VxYt(cIaY?+-3Y
zTBARjC=h%9Cf5~JgZudM^X*l+_MC6+28v}h8VLAds*gI@9TooKtLa9UfzF1qN}3c(
zcl0e+l5B5s&`lBw+Aj*j_RNVNf82g`$`Nu=#_92#fIgVH=_2>lw6-B68jftCW;V(b
zINd5^<(0>DYSK+|Wr!bdReJ1JeMiQQP#%&jk04x1|K7}>K^2J8uznp#6LpH6#>fC_
za8YGq${9jRMAjse9E}M$eRJE7sa$F>Nhn7X&XWE!JUD|u8lji$GCX4N&ilnQhv7Vc
z&V9;?^8L3eiTgCtBI^qBGf#3#*uOon*QBSQ=x8TnxWU*6gLEWvV=S6`l#DH#mCp;0
ziG|K7$d{aqsxN+jI^Gym!^hA28TBDx-)KbbbqZI$QMT8$S?KSL{?~a3&2JWoaLni6
zyEo?Mi~|{xqQx(Ny!AwxGQ^_PYE)#rrB|dBlFqe|Q;g%w?7ND2ejT<J8h$RHnKL_}
z7C6B=5Ypa7O-cO?y;Z;oaD;g$b-%nFMN8~6v7KAoy!C)UI#{9iO}p%nbW^|+is9up
zg}WDs+^ia@2n7a_(W1c~b98<RuY{kCrN(<ZDPDgZZ7ga%A5z>^Y+B9q*~^s{7pFkt
zD(}5BUf9F_ft?^X<L}dP$oTNkEfxn04HGSm??!n|YWTQcRobkRLk{svXua*FL_6@i
zdho$&Bts+zs=kIlU<Yf1ueUjv?8+(MbFL)IoanA_&K4N_YLDwRGkM03kfXWdBlcn<
z_Z6aKJPE%^{l4sNwh)TD3am+Pw!CzE1!F21p%UbX)Bs$7)R}!*dw!M(KDC&YLq~f|
zDoQm>0~kc^h$BlyyN*|_Ca-L|>fgHst%ojEM}-8KJ-+%Z-{5zcYszb-d+m22jA_j^
zdxZ0=?>CG}ApY{wOkvMr7GpaPEDy-9B`@C4VTjTH&>~#(CGVjDeUEr)`+Jsf)BVA%
z`jX|2uJ|&IS6>S*(}qLuV@a}JvO6zxF0*+!KQJaRUSUE;p6T&)^b>v{#Y~NrBD#}B
z&dcMv&3x8}Fn7P*$2;y;bJWB$z6ICg(}X=i*$5ylLjl@ZdlO&Za3!LiGI(?_f-u@y
z0h_Qgi)WqWI4J~l{Od`d*I<^{+$VRZ=?dX~E*7TdjpjRV{<ld^yxtNh5<1P`tR8ft
z?@R!0A1Fd-sK_}=wBPVJZsTT&Q1@0xZz+_ebd$yC;T|rA7tchm+LaW4k95MLVjH}5
z*4ZI1W8W$$j(^j{r3Lf|iQUSNHCG4GF%X+l{&+;-KV^5LV$6KY(8RrccukRFwGDro
zvn9Da#quLBt31%NtVvhI!AR0_VeX~EorgT)A)J&UAt9sQ2lvmRe{eI+y`7Gq@|gWB
zei|2z>#DN^e*93gOy!JA;9gol*%8)A$^&NOi*HU75$rAg*v0O3&womKId3|z@6Vi<
zLCI-08PQ;7QTlyQ2JK&Wh`kDRs&<<FG0^<hT(FFG>aGK!2!2}NzkL<`coQm!D#fK}
z1BMo{m_=++6K1vv1CD)%;q5vujp;J|dZ`+)?=m@+WxYivXnOX=#?LD`fLzMa@6T4@
z|EccHqnbL`zF`n0wIXS&6%k4FP(%+(R1{=L0!5`(AZ_)C$`BMZAd?d2Oww3UL4#5Y
z$`BM4D<Ja>35ZMr35d)?kN_cs5JCu<lWzz6oag=HTkqfB=ZY?ny;#ZK_kCTz>DoI@
zW0jngMQvUP8dU`oJ8s(ejWz^^N;lq$Ie74(9{Yy9xI(z;HwRy$Ul!HW?kU)-I$@k0
zglVgk%FJN5JEx|~I#zc<5o(H_W|5_;BdJhowni3ClEBn0Bn?SbMp831Wk}$q0BM$>
zs@&!d?kkcFbFS`>hHuni=<#U$|LwzFo#X{HBEM0M3y2ahQKMiX)sF9hn^>b2)OOY9
zaP@4sx*MuqN~GI8R|5}<rXo+oFz246)mwcNT!%YOwu<Kve%JwB(px^IKN&C{!#I7}
zzJpr}?Y1BsP6zI|rmi@a7oc>DD~1?uH#zI!Q~LGq)Upxo&gY2;pL%YcM_wl?9wf_A
zbxy4G^wDj+(z8I-Uu8QIE1J2bFBL2ZQxof`=|d}9(CT5546U*yX^cp+LCtgwU6ZGg
zQ8mK?O%hv^x2i+hV=JG=%a{`U*i0Fm3wxl{D0wJ<sRp4y-p0z{nzkEj|E=kmghOLw
zA*gt^rrMxBt+@_gX`y02hi;PD&=-k|%fs0#<BPfce|`_8wT{=oVOvr8r&uatxhk8o
zc6@JaOv67%)Uha)EYXcL=IRUN4#8W=mm>%gMeiyOvG(g++2i7gFGmQ7$Pps5%?B}>
zst&BLoA~F5ae?coKvvy}!F`0@j~T>$IfAB81uDM0S$VE-G5((;V(8FN`j@vvIx^uS
z_~(d4$^VbvG)c*ZYWPB>g3WYMw$T-JbOi<!t>J!GO*dIUYig<QV`TC+w(jD-3SqD4
zE->F|u=!e_GdUpaUoCne<=m!`m5Mr0w^5C&gX0yDVqZpt668nIw>rynig>`&sSDxu
zf~KQRw)wn!RQF;-tj|y@leyCL09tPq1z!G)GNDpKNHIN9;XMfj3_&Vq=t-Y7@<|oA
zO~f)~qJb9#MaaWJ>9i!>_b2+om4S}&)AyODt!yBs%xMg^n93$vBD{9B7JZBME*9Eq
z95h6kn9d8AP{&CU<*+D*$$|r4s9w^MmFgk6KaWzl_66HaoS4*26{+(ZI1Mrmu^T>F
zkHPWP-P^~2IRdt<jxA$RI3&d_&2>MUY^%WD6*#_b`+(6Aw9ig<U4Dj9o9x&S%7G}|
zpLShB2FdP_U5gH}^^~oy3`2dqje5~Q^voS0rpy{oI@d3gBeK|E@mo%&@^TWfMuql9
zu(5#Ggx8Ldex|ckn<lxb$(wgpOE*YE<}6}l`QcNao2JizDf~ZYHoanrF5+qHmLpBb
zj?<vkI~%U`ozPpAcNrNxN_{q*demk+b?4GiG|_SUbY6OhGvXCXdOdonm8E3HeH=T4
zidOUGqbkl=a~3J5VcR%jN4NxiVOW$0k6g^3*$_6dAgdF%4WPY9-Gt{2&4?25p!S<k
z)r{dK9?D^AfJF#yKM@sBk5(v}?ete%sEeG7s?)DDtG4l}dr(!Ue@!cjg~&UG+d7R5
zygx2)DEn-w8rWj|6dbvXpJ5{#{^f8U<)to5Xqhp3fNCQf?b(8xf2J29xh1wmj7ePN
zGe0;+QPUp7(p|}i$Xqw4daJ!1ACpMM*@!->{cum`E9b#Ixt=Doxu^Y!y2;Q_+3Cr!
zU52%YrKD_OYCmTmrwTE{^Ml9Adamk88$s7s8pb<s58wOTtKZSlBMV)Sy=8uuGeB7(
z6|%P6(I0;H(0{}xE4zu4;Yv%-h$<P9<0*P+_fh$ALKf5g#D{eCeFc)Q#?JanSXkJ&
zh?5EC=i$`8xIel=R5!BBy+|Rd3NdGZx|+a9T5T_+GaH-{s|vQg^{S#dx%%2YmHL=S
zh{co6);0GQHmsV7z(tkSW#dZ6A(Ux7!%p633tyd<%05t5%WphMO3PfZ8e~8n*-6fZ
z@09<^Yh%8Ot`(bJ-O`mF%jYca?kMkc78(xpxk?^K&h<ItCf1(}cW#P!cgbV;cr(%A
zKg%Yc%8NvsfAfw|2J|Y;!zTlz9fr%g(#9({VC9F#*&IEjCU!(8%L8$bTIBnbn4(+F
zVm#|}2QdU)->TP#R$A-ZJK^T;urHDG=zDA+>7`SR5oa?yT-&IJK5%yv-|yBl(Oh|;
z-Br;lzPd~yh(a7gWg3YxheaHF492%7o1tMy;Uvln{5ot9k78}CT|7sFm4(PE^_U#X
zV-_NdM8Cp;b5`X^!nw?k4$h+w9}QnVl`-1i94N3^Aa<)g2}3v(=NtG`32f2Za!%S3
z&}p%&ncmixmq%|Yibnm#a+$eQG%kG?;FLj+L*L=_x}t1kf7FqVV{j=bg3Ydszp+0f
zRBplz*dyBqj2T-Y_6DG+;$3|faPqFslO|b6x&BtoF6bfd%4C9i&p{RbU3jnRE=WGS
zbDC`Rc6)$M_u!wObyZ>u%lViaCPg;w*%11DWL)TS?BydROU^_oCY8Q&?{u1*!)UDX
z>3e)!d&YG!+YcTfd&#b8%L{kphAPdBsZKN-;6!zibsGMU@&nWxdZqg8mJk(Taf3p2
zW7fGLFnq4=!%pFXWKiZlQ}@ApSin@NClranRO!Sbx)%C`gZ2;9IQ%8^7nErpnq&M`
z61XYV7uW2Jn2T+>@oNUM-YTwctVK^%vk~uTBfCt7g^{+TKXAn#t}Tu}EDsUt5QV)r
zP1{}BLCFEKU}gWK0I}$3ZT<3NcfvD`Ub-`Bm-78jpjo#(or{>Sk1wtpxXBH~xPaVQ
z&rf1NWGj>`)*VTmUeJXri#Pdq<dOyZ_GtXn;JNZVbZrPP_t0|@DFtljR(0dnaD0h)
zBbqdX8%og)Ew$Um58)0V+7o?c7M7X?UJ~sCk|jHEJ9-r)OG(`z&cknoLfsVi=`xlq
zrm)V3#8DS3n2U6r`oDE3J4!Ub;#^E;feEMuNt>Oka!gRf!wqWB5^u3lna;z|=@Nwk
zr&4E2PAz^|r(9$_<z;1Y1M8@VqmLN8!$)393eS>465z_Js=%0yU7ocquQCp3AfXYZ
z*~)hT>IVl$Qa2Zj$6gaXoNz|qcepq%%Qux-U|3|zZ34+;OV&cW6TeK{%CxdzeS;j%
z?Ef{=^t$dn@H-4|K?k0-|3SiR;(lV*Op$Y+Ia9y;HbGc720xGTq3OVB?_E*EjWG3Y
zqRzPQ#T%C@WiFEELmZ<4m>l9%G!!elohvM3Q#J=CcPu?>T9E3u<c^Y&Y!q!MK<>yE
zVLs}~rz1slAthjEF>s2izN{mrs#x^QT3;Wh_U4dk9;U%bRX`^T2KE+kBK+y}w*r<*
zJthz|kbc>%4jQAM7liXk<CKPI&8HKEiqeId<gh3kqEYpD_d~r3&(f8S5t6Uy?qCDB
z>#aKVN-CW!o>C;%ON%)bBGSMgN)f1M_|~}RvhG!MxrsFmG}nyTjiH{Ia?6{?!xG%<
zm0$hj%UQJ7ce0>jofd%1i@~jqgwuYFt~N`5w&ht<Lwp=f&KP}|@_>%CZ01l8w7(Jt
z=5mwb66<JbPf@kgH!1jeGtvyH61>{H=ZQ^i2?qq-+&(u)z3Yizo=Rm(hf`AfspK&!
zHR3Q<TcKMR^x$#6yv%Ds-RE1Y5M(29>M#}1s^Y9dR5fBr0br@Hl_z;P!wEsrKW9QZ
zAwZAex&_q5jSJy{*!p-KcO(6f`_NZ<Jx;)*kWPVTU6Nx(Kb}93y?I3MV?xIzRRRxl
zm{^t%YuU_V+g9SQ*eZTbgg1Ix4?F<rMaZqwq{`px_#LK5V;X4P^`EL9*re=p(aU=2
zRkwYlw*#a225A-8vh*=QcN$a(4G6qB>tf=bX1Fl*SIB%%l94-b-;F;GnK)S(dn->F
zQLK9OD`Xo&*45*C1{qb#lKZ3-R6K2IPUbOm<iavlAb-e`j_BBgt@f=3BG?xGbwZ|N
zsG2Do%^a3tTI#)B3hk70J|v7)wC0dyv}Rm{VY0Na=1uEDW=MFX@19Yh^a@n!Apw}R
zQ=zJ0p&4YA+L6AS)*=uL%sF;CG;<_WToFSW(%yID^E_NHzJL9QEI0K)S7l~kt|-w1
z+8slR_%VZ)XqaI|$^{SfLAr0lO>%tjK$td3*MxrFX*7Lkno=ONKn*CFz7D1c>AE@F
zXQw-Dzc+L?JhswhSdxTU;@%qm2zy|7l9T4B;#v}k6*$A?6Z9pnc_KM>q^P9`IW0Cr
z$L`VnNuTFnIz;B2_+gXe$MRm;3CW9$BA1nSo~hqJ-O%`AJ#m@Meuyf_I%svIg%SN=
z2BP_e^xz8c$gK=(2Teh8Fk%5fIT#55^;VVRa{mGE)QSIdgV^QVo)9pD(ZD9*WqcUZ
zVYpX_Cy?GXvU7BLL(v71n;a_!J18!T=s10R^y*hbdb3jQREC+8TcqOW)ecb~A`_-m
zGnSH>jMQ;w+MObI>VqL{S8oV65Y*zwnfT2My{y}or#Clwg`CC=7@npw@>4$NzeBk(
z=K6I*(q3;cvpgicR38Ff){PW89VRL}zmco|Q)JU%b?vjVX<BU#GmYk&PK!v=0cuqH
zxdMn|q;wZGTG{VvpR--=sxKdGlkE!L`B@<?%SyMJbR~A`LEwn?o*5_w;ze-#D=Z!H
zB<~nV7Sd*6iRgl)<YEl)^=oBT5)oRy_^wVJtr=EH?87rnbFdcm9A-A%i<BuI*Mhw_
z(8d9lLUqXsXh=2NRuz(x0}B$#!`lrcDNz9Jx_neqpyA&bh>4nXMoh=@NmkflF=4Yv
zxBcVhn7=c+-$&|noii|^D}zMtB)Joc5WlNo<REgTL&sNGA?sbuN%De}o{oO)7z&(I
zy?E(Jhfs$l>&q@*-ISyJcJESfZPbg-u66M>frsW&jKI|T)fEcZPq%D+u8xjv->Kuy
zXTe@Z#gUF7juil5s5^Zzv~+3)1|7~Ta<?EJ!4X%Ej$fX7Hhg58JP=H)q~&s?ecysM
zFK;nrR34fnFZAGfn@l4Q<)P~FTj?c1c_xHnh$DWBr5C;!*i_P*|1Gm?Y(d+u-;R{n
z-{3LxZ~wK0Il#g|rZ3ZxzOz$5br4B}4^2dpFD@}ocf_+-p{ij~S$&c`Sv*qH<zGJ=
z6@llmq)zr*QXP<UIdIv&zdDC$%#YkKOO-UF_a@w{HV_qGQMd4tyqc1L7xl(bTwNVV
zAlVA#RbP5v3zZ#~%$+S7swnG3M<}5;o$En%ue>alt|fNNwmfSbk!(L>fsER=*z$7l
zL@+<HTxJNJPD=7BwTen2+rnaoXDJ5bC&GxAob)F{t~IwZw=IcBq<#A+D>@`$Pe{ko
zRTFf^{<!K`*(u2{1RYvi?DOH@@i{Wvj;V1rTe6fo(MpfNy_gXi&RFf`WN5NT-5Y{I
z<+pqOSv(iF01Zfd)4H;(3T{@<5oFW*w=o_TY8Yi_t(-7nc5kB1gEv2uD95#&E7%?A
z=$!B<*XkWF;9DoOyo+&;6DUrs(e*>w3p?ydLf}==AzgQAC5zRv*EHJdH&GJj6!7G%
zSE$?iDxPn=4#Q%h1Nt;nxSY!Wbma`4o4^ITXCF{Kp~z#3ss1j5i4jSj`;X*^tiDo1
z{yb}%-)#Eb@3rfX>Kuzp_dQgapzA39_>$^zq#^F1R{>e2g!Y=JZPk%1S<57qvD4SV
zSvVzGoYL2yC!d*#HtwPs-JR8QBeEA?esAd`kJN!QT)rmie{ZQdLzLhswxfypuF1wG
zMbbH7TTw;99M)U<IEg{HAz_J>R7G<(a`4H#cNT}=z{j_YiahsN4awObTGptQDvDR6
zMS&yo&YEH^dst-6%9aicvfezs01hV4v*u}c@8>DXu3hneYc-FayrzfqUmcN-2!lD~
z0uan69^!bT4B6iH@(_(E=InXIAw$1Gc3J!+2=O8Kc|vmqY))sN+#)ZZDua2ZQixl&
z*Mru*^t7n3v)LGRkMV*stM`%2y}2NbxVy<@s~ZJ+%p@8PlJ)q5UcsUG<~|#H0I|$9
zs<$07A^O#F@BUqgY{@%A0xu7T+d~f5-Ym4B3%M^W&%wTb<uyjeI}wizdEkg2kadB?
z-vc8e3Ad7{)G5p+7CY%zO&J>pl;s$87BA;0Ms-~9zjYZdY1j6s5xJ<qI6t>ajgaU^
zohfEPIkxHeA!~^un2rQ+T`h>4ffYb$-3kzHTP$Bug@t*C;xA^hl2$d1b&CYlm~n5*
z0c19<O0M5_8nmqnxlvcNv6Sgb9C|^8@^={{`#?JyTW+>6!ERyu#kTljNMoy6S|leE
zV|&F_q$}I2sYs<aS`Wk4=l%+6-bvT*h$`Q7u89W>l}3GzPoX5RK}EeSW?S@Hlc1YZ
z$?81p9Dcw;$a7K8J!1!BKqesLo>yM@NH82#(z9YxWn|-@Qr7+Ud@9TX2BlYnWW{8?
z<;y29%$P0u;U9XlrE~HP0NJ$7(D?s|UndIqeU(AS-cL&cz;EWzm!8GIzQ9Ij=dUJ7
z=insf(*SJ|nzbL6^WIc1Y}xY04)1?F9Kbt?;<EqJbH~?=OwJq8zYy}^eyVaCFy{kT
zH^ndcEe}I$cR3u%uC$x*O}uKfxGV<9u~f$cxb^&zF5q^H9wpC%`wkF=e*V#y49HV+
zXv7}(yc-{{xE76>PUmjctA%p|)2bG@w2gnV$bXYp|J)v#5E<=z3)1a+c`oHjeriZL
zuXz2`OumgnWMwL=<(g4N;)ofswphJ%p=)XuU~$v<t%+|}gQH_1Y!vh=`&(E$#b(Em
zs|Y99`3wU$){N{=@3=-Ls0*1*%*Cy2zOyCe`+P|R1+6HQx?e}ws%J@Gww4ywaO`pX
zyEyfmZ?w`4FB3!z)8aiMDU)}JPG?l~NM04Jga$uYkZ>wI+wW(_t}1W>WP$P00T%sJ
zTh%;uK;o_G=Fi#{T>YxN?tI~2lWn;Z+ww89x5Mz|t_AoX+Vn=I-iI5EsE@C|V-c-7
z$!-=m919UPy+AQq{6RxAWOWv*ZF|zNBu%=)lB<s$FLKfKP0RLnUcdCI<~#S?2aj5c
ztV5=n>|cxKE+>Kq*gsll=v%{{2&Jucqcc!eD!jm*@qko6T?T7;XC3y<HY4bRm=xxF
zj%$HJ%I(kF^E0h|jw7+6bLeW!nGEV>*VGnEV(NaxIKHC;j({L#|Ms=106)eQ%!SN_
zDX|Oy1lAOb1l}<NKL-a5vKEnbnrwv&hpmOgZ_M79zp)*$4jy&oJo%k*^$YVHllNUH
z6-x$KtG~yci~K7@)u8=`Ga|hxjv<}9^cETQ^yslcbcAY`L`RSpzRsorRyuIVpxvnw
ze-Au2od${jK$-2UvL+j5FeoAAP04pX(h7*%Pp5TAFMrI3PRoMFE+JOH+3X@#K(_LV
z5%_AFhOFHEi+t~O{m9pTR+c7?=*>MX*W#yF^o~GCbMnS>Ce)qNfKFYb+f7&DjzAGZ
zk26WiyRDYrF1_e*#OnhQfu~v0VyVy0R8WWsUERxuZXK=exk)UKCIFH^H-g%7_*riU
zch-~9E4Luh?xjK;*}+WdoU(b^MDx=-U2W^CQ@>R;O-z=wEdZ)TQBCm|#Iq*eMA<+_
zr$m|Mu3;(yLDSv_EGOAP*s6l}1}0I6#%xy=iu2n+00au>C=~cyj<S-`G^Tl;1s;D{
z^9$cMxxS3O3mW6AJa0LBHyluoM1-%WP6X$B>K*Y}?QKz_K;Zi<TNqB=ay&KHxpWv+
zzl&IpzXz0~t8Oh$7EDB)%Sw5(S)#7IEM*Gw7_kxiHg%_DS`Xc3vYuw7&mN@3+#|*Z
zaE}^4>eYMXY_Ur+saH*$&OqCb48McOV~EkRXKj$Jpe&a11-K7(J9@>L7JG=>&>9Xr
zmH;H*^VWh6l1&=f)?H>qSAMpOUY!gxqI3g-plwXFy1_fGPR$^MFWRm?8V*~$6{D${
z?OCLIJk<hcILAqG5_|c7)=k;SB>)6P7h6>VN=_f)N6u`+gPt({ttvHbpl5*f??NhF
zy|}zmD2q7>mlOro&fZ8Vl=0zD=w}d|hS)7vGdAPEPkn+De2;k7#XUrfxll5pa{2I;
zgU0RP+M!F)H?62!mR(z68LP6XS5SI=6I^*xB;4~$Jb3-OokyL>udy9|>K!>A)sBCN
znjjQknpWBB!_bB%#Hvj{)LuV)gZoYlgVTiX7f8q23~zA<=u(-bKH_yzh?D<58(;qf
zq0EUX#DJ0>FFGS`x~t4`)52u^d-TrG>zk*@Q@Nt=vxUOOl`3ITW=H?5CbRR4$|V}I
zLNBBN8w)e?g=yYc1bdOPj*>&p#@wz_*UxJT>7>}~MM+!5)m1J3UR7Y}$Z>N5lf{z2
zeMYnT95sy8NpHdZel@4G9Cs}E(mHrV6sP_y-|GkD)aUPQkt4!MrTe%tHTRN}Ex|ty
zMpTO*lWb)6?HI(;V(on-p;8w@y^dGO_rH){c!_!!*}UORO76+4zqp^}L$aLH4n`C9
zPUiO2^d-*iMinJ2|GK|^Vd<U&I|US3+5sE(Ix-$mEEMtg8AbY<AQ4%`H%i$SPJr%d
z0fPnLb#C;?-se)7l9i(>F37k}37xi{eF5-pq0N7bFQcJ>fc-C>;=vrIE_jBi;s|Cy
z{a``0jFPHQHAsLh5$R!XvL{Q4qmgPTfPhdW>=r5>TvJNtRwkzhzO^5&f8DZaPN(|V
zNaQt?F*2Ydw^?=Sp3BT1C?)N#D8r*#7|4Mc8_dI=di(-u?``?lU~5~aKGW=KJsEGh
zm$>!oOm}C_r1ZN_px#@N!_RdahG+9SeU#Z`{89yXsk<%tVHl0`$3f%q$migJX0XX&
z)g{o!Kb+O~D8MifwR<PhH+1`_wuSPJ`k!u0L8tXf2j{NjmgOQ7h=-Pfn{y6*pNC*b
z^JZmOHd+ubB6SyLkvJnGV%wOcVEWxU1+&7lvtyCY=^7Go-dGnrgp-QooXp)EK-R2O
zzaG$%%pzLo+6Eae7E2rtRH+wnxdoqYH))9j?GJgK<n#Dh&ATltWg>d##KgWQt~kVa
z(C4F!6~h4$?Z8tv@968%#g%2ZA4qkOKFjz#G#*chwg<`nMGU3gPenEw`3*jCZ8dt0
zns&C~PO@KSOk`9ar~iF${mxDA?P_(Wg6g^o*im0WyP~sBSKaFCqfX^;ix22$8rDUE
zmzz+w1f~4u0A|&?#QpHHd|Nm8=CIBY<U+jh<s*<taK`ejwmoPW*LL%C2XOv2p@m6k
zYB>fU9SdJ@ykAF5p>NapA?52pEpJ%(_oGs6W##-_!f*-(Pl&7jN4didd=HSxxPK%m
zX2m3aLE);pmEBX-3e?t$86t@<!31AklkL1zY8zKRzigl+CZWTHJX=o4_DQ)P9o-kh
z*^n{yFpumx{scyx>Sdd$xB@@=oRMj?_zCcwHw@BHn2TDN`+gG@T92RZgTF+qq~!Kp
zN$Yk-NX4HgV&b8{8z5gOPyM~=KTX57I+3A=!Ny~L?WaFDBdjo&ly=qlmPDDZIt&K&
zapKgakI3il0y-r@-R`7Wj#=&%{f)j)?oJL*4(F!cJsP!xL?92duu;X3gQ2}s83xL$
zF)85Jg+-|h&`V?bA$K3ulax?<6OxE73fH#bLC7d^7*eAUJT|GBGkBN>C%t_d$YkZ)
z9C7`S828<gn2TOo>!1YiTA*GeZ%hd83T}D;>KUd5Hu*c=0boz`rtD4CEKPWNLUTtk
zq8eNv$AIQ@2`m{4!Xf+~;)@$RlNd^S7sCBCtH*RfzFwS5tClXz^)r<}utkfx#}0a>
z_}pM~(yX%PS*_GeA~DaPd(mZA4SL-={ivJ=EC;iV_Nl&l^Q8B!DD_<Zt0Y^fP0so2
zLgD62gc=_NKx6Z>W)4HCsKYs$ScncP<B>rd?3K-qA1D@_IXiCr-!VR`Ev{v}phqPg
zgUK3Keb5j7ZC6`SL<$A1v89D%{<7F<zBsFS>hGX=OSnA9s<|4iiL1c~)VM6t)jP5h
z4zuQ*y`}=_GuTpb+Y=Dr5L8DLiv@Nt?fxm-5zG@5((Ceu1QaYOBy^>lCYBU=k?N=-
zk4!HezHZi)xp{QtbyAviIF>F^F)sq9E#3zG9q@FS3Uv%7_70U06cQ^@R1N%_G#A+$
zS=agLBq}F^pj1xttWW~?uF2ERZR-t}pOLp^MBlw3<C%9S^ashq>dgQ0v6lwc>ld1K
z>)&B_JYXrOU6j7>KAq^}Bw5wfg_gRk+&RRyy)92c5`<%I%or!5tyMzKX_M|(r}9h-
z(Nmy4bj@DG_%ezbR%uO)Zb@L>qfjYiy!4i=li7+Cm9A+Ff-$3oZ|gMPIL;z{(73M#
zI3IBgfehDufA#)6wGjCh{$i|A>z)iFYPArJk)qY_C~G1fXPxvYjjp^rl`9kriJE>N
z6U0ST-aw5@bZa0(PeGMp$MCUpJWq@{q({HwW1A~GiSiaY2NXPO8f}7&8ok`8i@X_1
z=+(?Aq$VbGWgw?nTISF$Nf4&#sO)uk>kG`xJxtuZm$}cP{><FG(0hY?!nT+T1-rR1
zTJ@xz(et1CfM*>d;^%pu!sbY>_yq~r8mh}LC^m*VZLUlqJ8w`59x#KrrPaGS9x+%R
zJ^zZn;zyi2&J>z1fY5mRUG>7EF(y7t&5SDr0IVedL*PLYDwbYsKT9n6BI;%bzq<&q
z=B__f-wjz-s%z&Ng-B@MWu68V+$>M$Z~@$^9FpUB;W(hCEJzaJLcj$m&1g8MnXHgB
z--nH<{*+NTx)Bd)(eZP}AZSm_T|Cl%&f_Qgu`*I@2S@fE0Y8#8pP}rb+RJqp>+P)U
zWp7x@D<)tohBFazSY1D0PB=|pUv9?@tSwG_0M;e1pS$T}Z*GYT)%zJq+9Jwzw@~4y
zIH~otXB~|%`Zo9dEdbB3LB5q8mu#|qKRF|GDB$X}WPKrXfNK;kKdQ#RusuX@O7!u6
zuP6IAVj@^5xDgz#?A8Dru<)Wo%#b+dYQTT3Y90j(oy!E6&KqpLrb_LINgTN}`@H6`
zaDe4S3I~vT49hsn^0QR?jS4=%k{fif6*YO|G7zXct~w8UR<-e?bJ@&kRRTIw8Y`o-
z=PxKPyYHl;ez~7&2r*S*g~==;gf#zLw<}M|wQx8OPLGcKSOoiX(FWW+NUZ)!b!b=m
z<QC~uaz+GRhe<L`9(3vrh;$Th4s`;2#Y1ykD21qrTW><x|E+t9a*r9H+%GwM))Ait
zr<Mr+yk4qY@zRf<?zjgY6evG-!bSo<WTPXauOqmRIEgHEoIN}xENK_AqaA}s09b?N
z7({%QVS63>ZyAGbZSg-ECF()pRE_6?44d80&z-pnXi2oQE}>ff8}%C@A#5DjB;G8j
zmxd~80?rlCfC0r$v~vDCW<!Mb>)O+$sNZR$B)$Slxbc>LPQzt8YP#7B4H-Wasb8sS
z4skjht)mG}rqk%rn)A^2gE2A5{Win>EO|D>q;!N^6223!L*#zuNOnPwD0fdv+nn^i
zj(PYY&9M7HukcfEh~YqPS;*!_a&}{@-lJyx%>Z+~q9iuH_Ziy3s}|pzsGGG<<BhkO
zmd#!1PYXEsx|<}7?>*>CaPz2AcV$8r5{a~-yHxN>a?BBGXrx*o<OMIUX|;f~Kh{@X
z_|S(0lVk$o5*#mK@#=##bB@>ejW~6t=%t9nM3+syL227YuF9Xs3Py$AU+XIcHG9V6
zM&*Bxk0od&xGKfhSPT!Gf0+ly>MDN|d&YPcb<@i%1|?PSO`qCk4?y`CtDCZqi^&Fk
zOjlOW@T*iMAPSn;PY3iRR-RXVG`Ane-_AQg6)iq6+)LyG2Ky|iQPxAFm<XC1dnpO_
zU-O)@`W_@wvvp5OzPna-BIaSzKoNcq82TKv@~@wDt{(av7;V0NJn8$kGpzS+;c_?X
zft#Y-Zcx^A>=vn;M;_~3&l6(&-?38|J+fS%rRq85u`LIKU-1%Rx=w{FtutnfCY1C{
zS1l;7KtyZoB%6>ifF{sZTa2_ZT2)pY_DD&cPr870vyW4BYW3`NTdb*eowzE<HQ$zV
z7S(ke6!y}hNo*EO)b%8Cd3I2X=YgXje3__^NsXh}45E33V%tH$nVId~Lm{Ogt2Ni)
zeR>rw`&;XiPG=`)fzUg_!^tL44@p?eo$Sh$tIEY6xzkm`&k53n9>3Ns<r#SbRbTDz
zbP(LrJ2$*>qh(3UsWgb4_s1PulS!z?kW`K}62!aY`F#J-RL}PoP-zFdjAz%LXl1a}
z@}$v%NbG4zV#X|!@jbEG>iXkCaUo|HR45frCZRL#pSL!&M}uU^4s4Ng8yT#p7H!t6
z*C~qDE*D#)r>=8Zq(S?j@jnV*`jF~03%~~kg#E!9;NC)j;0hDFps?%ofog&HP1wHS
znzp?bCIOL!_#dr+$ij$)V)3g{Ah+O8M-n>(l=(5mg+Ev-Pf=+Z9ZQ^udDv}Zf*8@1
z_wG`t@h%Fp3oF6GeCIM4#DT^(!c1uTjo5C0$H=32)CUfwy3^R^ZIVE}^zcTT9Ud@h
zB*I{Ww7BV)u5H`Ae>aHz(X=RaBv7a9l0*1=K#lx4);>MeMygCwaN6|P-HDs;82R9<
zrIEic{2U=Sua$<}Lt2cjG~2Lx4?<_G=u#);-=ZDvMbg$?h`rlt)oq=c6<g6$$2$2j
zac<HT<r)rS-Ww7R`kEQ>&4eT95toS(O(_t3aWuP1d!7+or&*MhX(el%dgNP)l3(yR
ziP0O2Q-Ao-8J@3F+XW{tud@x;ij$}B`*zy}iQdynwL&fWBI&6s|3EmOekM<bd3yq2
z5KGe6YP*^=2y%8`T{gZ9F#Du3=G*jcu{3dB@BIP9sGt09+qTB3ftXM^JYd*}v|1+G
zdDRlpKwY1y-1@o?pW~b!t~Y;T?nrGyR}*A`GugZO5sduFYMb{u!{tjLBU^9$VR?3d
zc^2!@R~E?jMD?GkGkSYEQGBv^I*-yO`Q&U=b*dnXNyhJnQMk8+vJWxwpD#D|4u9GP
zMb$|wzytmd-AOY)jIY&{n8K`q6TJ63MgY8yQt$yTL%e`k1%gpk@wp9Ut6Df(fsD-d
z81t>wf>XZfmY7zpOyY@s2G5OFBt>H}OlmOgPil>T;mwz5h#F10$ks%(sT@++Fo4EB
za2#nE`80!JxYjP@LE>zt`(DWil7~bo1Z}c3^DSyjI<5)IBd;Dg8F}N9P18=jhDGbo
zQ!`2Km0~?XQi6#3wLOFB=8ZU=;xS*JaC2%ZPRFgNY3lJ0hiQ+V!F3j^w#+?AnfjhS
zowtSRL%5Vnishz$=79GIo(ZV0ITl2@nBL)u$2%eS?(vdy15<V7VqGgl?fJ-$%(jr!
zHW<w&OP=U~VWVYZN`Z1z9K(01(_|_%+R(u<SQa=tZUWM66uQhfcVtKu^FP{$VgxyA
z2Dr-h$V?+IQkZJkaSeA!P^@N&YgG7A*iJ$bsct{wEW|%Q+lEo2v4fc)ebnuJZF(}E
zTa%?tt@I#qbwqah)n-2)B|LIje!Vz5tztNm*34}lxx5VOIb(sN@oe2lt4D{M)Q5ZS
zQrFpUip)uXZ>PrEUwkz8F}P7WY?~u@p>(C9<*EyJzWYnPJATeR*@{S8y60tpxQ7Bm
z14I{<@~CUs$i93O@X%x!t06!YxD!~9>4fH7-VI@v${CSBtUQ!NWerZT6M*#)o}F$B
z!1D&o7wvFuQ)rh!s8(0KU;;<%M5xw4=g3;xqI3u_OnqC%h7^fdk4WNc3yHerXFJhB
z0rbQDIIKn;Exb4}6peleflTJ&;Gs6LEzV`S2N8_|$I~8v(Wm-!uhaZ~p}y}D1Pg_8
z9t}abI}@fzQycl$<fUQx@6^rGO>T(%5&EYYTbB9hx)%|@eYdnZCk>Rgw<9y{)j~@S
zdO4~2l{65XlbC&@Cp*9z0hMJ6^WduN$j`<|1hmDdNSKoP(lswORtZFbnCems_9hRb
zZFJ<TEY{^f`u9}omp$;7Iq>N%Js6s$Xwyoj|NYoe=iX_rE+A<PN+wEv$Y#Zs5#J3i
zj)r^@b+kDXlu9vrC0|i^?VdssBYVQ4Cdx&S<WLS6;ior3DlFS|A!;Ex(H2G;EgDYk
z{lgikV(^=kK$cre+v!%{3}!1TW)<^+o635oXmijshc=P^J)L{}@lL(Hx&b2rbNU(l
zrucS)pT3*>J+eXs%5$L_-b~t@=lMJLJylrNWckc`8)6de{mm;>jQj+rY~z1e(l=<l
z8*ta4QeEygq(f=sdyt@|h$7pHYsJvl@{eyT`Y#TPF^M&+2UZr5rPs5KmVjNaEIv2=
zPS0Mms<gv?%r4~!w3ppSEEu4Akw#4bS?gLp<Lm7U5|((pLCmqUSXF4cng>{{7*!}m
z(XM9If>|6=)N#=>0VR%kwe>8CDfrH2WjTwo%39cCh47^fZJ6p(xYFL=Oa*-GjJrtu
zFQj=_^=J8Uw8@cHW6huVCRCQ{?_UySLEqThHtDn*?8;hL)Vu6TPvH4)Y_~C~{qD8<
zxks#fOwSw5!+-U-%*cLwe;<W*fCBx`E=Vp*W?FfrJ7#*+w<d%;DtiwQRd(m05135X
zsiYENkwhCQ`X?`=HF70mpi1?z!FK~_Sa8eyNfFyu^FQ7J>%nqQ6~v$*Yru{76^V{q
z>wrK*tWv5j(G~j?top_Z^oZ-|Y4Gw5!5^@b!FL^flsX3nAt@d*X4^i(1<eZqF-7Ai
z2c%^+7xhgR!t@45Wih^T&)MQBAGNNDXtnoSa|+tDploTOIN_+2j6Wm=F5XcE-ra4m
zuM^phQOb1(6Q|nzJ(oX+7%m5;hB*rF8|A?F>_z9K{l|^JoEpkErqg<#9O~<qypL>x
zBPIYwXW80HpU}(#BUVqa9b<>ljR0r{*QtFMNu`H5Zn&Xf#hM@R-^G2*x>612G&v$I
z_#xx+)7!KxTagLUk_Wf|-F2@914x+v@oGOIODRM16sMuY5WHZZPu+&{|J^y=x3u-m
z_?9BMbr-0;vUYt@%?YEeP#^l9S-q{6IOSBgf(bn1bHx<7Q}ZWugL)sLG_+^Le#iCz
zy_aXY^ncbLTKVZ(yiKeVtY#H&Ck^rYW}AO2rWr;=)q;3jbeDW4{87&nW-tDIC&<U9
z&&X6*>cTVgi5An3fp{Bb&n<{4Fgy*Q(eAY^?X!i_X<3I2T53Ws@D}{$Yoi&g9|kUV
z5j?lQRKaXp)r^yh2rp{-yhpwSVJ-rC)Y;CkwWKC%um&h?1FU|xtZi$&>7gPo{Ieq0
z&Lqr=6r`dOhKw)a$7_O6Pc<VTSv4q^YC6%NcB3mC>|^BydI%j;NAO5r!=4=hxv+(M
zP-H`Zkc%UpdyPe=oyi(FMcn+t`O^)4V`KU0-_pb4WzTu$3BLa}z0p2*1;iGD^c)*o
zQw?jYuOHt2L*KSEpH%TKs<7h~L6t?k3hfDy71BqP>#+qb>B8af^QG782d6|n_{c-A
z;E12jA-N$+Q9}n4kW_-P>IJ34Amc4Ee|oGB0A+w~znZc-R70Hp>W5L4q^sp0rJ8T5
zm6?7mJj$fR0-7A>^%xLaoqfjyC=$GUNAO$f;m09blGOD_A(He&j?MOBlmb88=Th~c
zp-7p-$xidAy!?I>v;aieZ#P_ktRuZ=B9oC4!-!qki5~2KxwLgM7rcZWkD$|L9x;U@
zNaOXYi#@w!;l;fp`iDW=vrN5zQ}XZU+!|oSsDCDg#>e)#@^Nnbh~MzF_ze<i2R8?P
zli(Mz6`dS%kII~CR(>wa5>jT(!VgZKF2E^AB8hIw)-QFe;Q6Kkrr-ZGs=l~U8F~~^
z!V#nmBDEi~3aDKgg{nj=NB0i4-UYh#2f)iAP+91C2horSkkB~u^lKqyel!y1L@Adv
zz?#mU7a0Rl@<xbJBOh5<Cnwy2(B@`P`<E^%7w#3o{jagusiLC^z6ZIn$Q`ylQ2ylR
zX1l%ru85*FJ^t!2_+~2R%=3!jKX0!1Il?Z>|GsY<TGq+jO}vzbRQl>0NCVPPk@7tr
zH1P7XO?ga^B69f@X4QctZGnZQ8%&!l+8PDsZ2q{9SaMal;wMZERa!%5;QLWIV_|?{
z&X+q#N&wQ=a7n_l2J;`{)b$0w+WRy2XJIzRYvWx{O|*Ub3ZVQMFySt6x)z_VVH00J
z(vVy<W)3I@gDq9wq!^10ECGGVUh-}t1ltf_qoNq}Y@V|r%5!#Xa)*qu>quQj8MJT=
zzS0_DoS__WU7Z7hNzQp7royA7^kx1yJ{!?a+$Ozf^v*u78KSrDlH)<pn=E3a-k{YX
znPt#-W1E8aM=tgK;T#dEUW6SpHnG?7Ks(Sw;H{r$2J^`HxjtS~urg5Heh<C>u+uiM
zl}BlW5nb9BUUF%vMmo)%@n?5_kU>6_Rccdhb{Bl3fw%y@!VCtuc0148)@j<`ZNz4m
zGZ)p0!?r+5o%-w_foM?{j0!|+Q~Y2STI4;hW&g7`Yk{cxg=3fArp^}>BGI$2>Kn7H
zk5sCaaXeJbfx%_qsc>Ghm_@I_qAU%5d{DD;%Eq4*rY<{eHBo@fa<C#hkPMgY&_g{}
zz<Tw{eya4$Hn9G1^JQZZ({Lv#bT8LDat|N~+AN$ZB0j$PsNdbuXSKl~ewgF3zurlK
zxVub7MwNX|5*SkpPVFTwPbKw{6ZKm-mbi#jYhvZ_L%rIm84w*mE%Jl==d~GrI!WIK
z1^4iJC#0qS4S5Db$5k;*D&YQ)1o9|luYR*Q>+qlOP?fpmAnopiT%;r(vduJGE)h!}
z-qM?u_f81F7yc0k0fn%d(aRc<v=yW>Oa%o8Mm1TR)E43W{~6aj%tsD4PwTXjahWCk
zZ$xS#Q4P5UHmU8S%RtftnqmtUNOseh3QaM@kxu^gfH;{eILNluuS9Q%oDO!mdvo*a
z>7cYv`WH#%eE<=GBvTnH83uoyKQuQBeTAAe&j}W}dQeTB$Or9uvW23IWF-W>Gv0ms
zsx?BL%yhlcj9<q$MrXiouGW7~dJqFxEdL1RH8JNm@y&qoqtD}{fX`iRi*$@t=I(z|
zz%`H&+bVVZ1yTmIzaygTzuSD)2{!|{DhDdWk|!X{zOMw5w#O7?zW|JFLI@|MK0}oc
z-Z=Qx<5Y)cl%mbHg6AA18#F|3Zyqks3o<f-vvY^d6P;;!XeDs}d-~UZjulNQQ~Qi_
zr@Lb}N9@t#?>n@h1G)H-E&k4Yvne$+4X{yl4#x+GnwYjSAVLGA$x(FkUHMdNB2A!r
zMm2Z~Yq8Kg6}Ie~1#(j*Ku%T2plfM3zClHju!5ODeBr}dU4Cu$Pbdmbq7O(o1JJ=I
zz|h6xB&~-eJ;wv{jvPe6kuz#OQPUzJsErcC%8AEgG<R$Tn%eO9lCjYRA$dibjw6OH
zUoLGL%q!9tm97SF*r%(%XTq&C-Tdz+6k%Duoz<BVcyn+%W&cf1@2gFvgae2gL_h2p
z;c!X0P?xHFaR$%Uk!DW~?y*GJ6OORlOL5A}4cn-K`!KR6qEiAGpl4=W9z?5sc(H?2
z;~Ve3AZ2Vea9w;W?vGyr(*01t2gS4$khIx;939Ds`W1emVa*V{R1|_pH(!gI_J7Ma
znr$JH8dRz)(2Cn1MqTH@wE%-&XzD_0qyR-=dupC1h{BdjJE3qU91+KZW+5`Wvk=F@
zCdW)yJoQYKFB|>L>ztb(>9;wwV@f%vPsEHO2y;m2O)xA`$wc-Be0L!^$fO9-qt_5p
z8z6fRJ4s}lKF>?eqCGvfk_5;&+ew67b!|oxtguD)QR+S+FBdXn%GV$w^WW90Kyqs>
zUcv|Tw6)-D?R?%fHnX4ZMWQM949OKwfff_`1wSy(;(*NGg2a^to&B-moM<W!$WlCw
zQ(q%5uHMsQo)>oiT8qCqI8VjDYzEtB!Y3Rx4`y@St$YtFi@uIp$=5e#obK6~gZKo#
zyH5DCw_|kZ_P_{)E;01fbndOeR!f^qx-os|dNfG3<Vq(UO3qf{4iIS{`>evM?-K7o
z)RPOoNhB!J2dJE~VZec#^@-)MY9<PH^R_O?9k4yLUp=~>jFSNSfZ#)n)~G(qaA;Q`
zsfPvPu+~P}J>`$q!Kt(3ss$O<{4C&N;^qL6XkyKa8gNPbiNE`L6dw0eg{#;RF$7=<
zmm16P>X|SJ3mvXGiliUW0F!PdF~>Nhm|H80B0A~QslP%M`=KjBXFT6nFmbinW*4&!
zPUJ_@?QQO$zx(-CwfVEO-202ad(wMEe|$dm9b_S5n;Ucl|FF5?Q*6t?YCtDOXi<ci
zOz^dFWHZw|HIpl4gabqZ!BV||Q6r3~#Q6IpHq~xeNfi+pfaN&o+k@!2_-O(l@2Pyt
zI!%3pMxYh<cmYfnR-@Irz`>Wbu;vXsKfe;7GF`yb$;C53aDg^^JN(i7y+V4Gn#fag
ztK_O@w<FIDZSkvEUu;!Qwj=UxA*9}_hp2SAOhqjadwQuk#?eQhH$9O_XsGxJ-1L_M
zWs2(BFF%sFhCi)Kxg~Q<r^cFp9Zp-2XHuRx(c*Ojofe;gQ$@DylSbC6%U#ldUA}z$
z5_;kCHP=*}lg;O;U=h0Re8@c`7%M=V9kc~IVc*(aUR(gg2*5)1k6TdVUNlYg^u^^i
zXyv=^#A}=Lukyebs^{s9bB-(81mP2qAFl{Y4+Ny%wfqw>7y&q|95UesqTdSudZYsN
zTgU;52<lfKt^Saoh-iNs?O54BUg2&Hr&&f4yF%?{Noe$P9FW5O*rYeILb@>*AvOX#
zuCs}~`>6dp_}T1@R;RAhO)nY!P?QyZZ0^dHv<G*8fJ&s|B)C0#hOxeVkDKjYkHf3k
zQb7yG;+)OFy+q;?z*&1@%R-eiPcoAkUToHyKU}9?*iys?>fp}1vh_fU;%+*pTZ>K^
zvf?k3X0(F-D)ofc*@{;wfGQ%<#wRq9G$aAFYC04AqgR8D{KSvAA07FS`U~N+mUd6_
z1m})iPzd0NVS>8F;W!Ezh)+Qs$&U8he+DvsjLWgeKpVvTElt{hH&1Eu+;!Xh6zgZ-
zQ{+BwOAvXbccszI3Sts(4om=T*$o9uiW1S%1|!z=i;Vp$vY0H5Y;<KCffn}-aHfnv
zVGGxLhU5qIpZswhip14lZZ^?$wE?BktEihKTHgq0Cp#S<MJNH^W)WD3-kf%=j<g`d
zEv76V<Rt?x-j0yjmf>2C;Hc-c3*gwaJ-mflbH<Bi8|?s33#gmC@S}h)j;~`uSNC&b
zB|-f+g&fr;Up_NS)4yQ=*|4g+DiIV-jj`$HNZ)I&ix$FHW9K$<ji~z}_(5tV{j1O(
z*1A9M_+}y==NvSyrRZ08Tu(vexTG0u_Xm>Ae)6ATSuRSQP)fJi1=x2K7B|B%aB8dn
ze3z8lEzL_5ao|K6*9ht}cAaReev;9xIZBEFiatH6lqVPo_n5yndS*m(eJ13KEfse`
z=b{N9l)f84W?8NQP}C4GT!0ca5`n<O0Bal>=>aUql7oh?iS}L?lW;on?HG_G=dq~$
z7rV{)1OMT`h6$RNslK=)@Lhvgbx8vU$?6!Iv7n!^fTu%DkMyYfoiTLty-&;ytb)v|
z)vp}33~%zsn00_NVpV_N4Wi6a;SG_(dlcK<8uy)tGa52K@@>Il7`3Pc`H6KO*~auF
zG$@Mbz?I^{kr|{i{z&x)N?c#&wYO78sgr&j*5mwTTkLHhvA|<Ktzl9CknMBaw;*-d
z%oC_3J|tiRGE9&XWzE3PJV5L$o2~L#n<CIw6s-%H&qyppGVL$(n5>g30-coap{67I
zbtUq-LK)gUDEfGF{}x$8XA-K)?kFFFuN|*>l>w*I?LXC^8_bF#8<XlRQlAEpufvkV
z$~!MMx*AoDOv~I@o1W0h0cwvNPC=O*8Ll^I?K_wLgAsk>FJm~(Rb?c&ED?HW`RJji
zi-3iEhM}Fod%CG`d|+$HI8gUR*I!JPAU|v>);zWhjT_VENaGfdK()f|pzm5~U;Uji
z2GBllfB^OzMQ8^*sa_-iGilQpX#|}}<Zbnw1QSDKY!%<GwA(<B(nx>_5U@nL;-vV~
z#&mnp>I(tFo?|G^JFsI~6GG5KnlE{6xSP4F*J;@qrtAJHYjds97Q}g!siQv?_UVWD
z4G(jL>*{ya`PvNQgdKfx2WbDY-%DgS!StcK(AP^>*g>iN%#fu;pia2{hDcDxw#{s*
z+u6B$Z`w?4bm=l=4+<16(nP5EN^7jgLFAXo)x7UZ6h-i7*2mA;pPmfpPKzB0xLzsL
ze#|`kfw3Wx<fnHQ|J7~h9V-q*wvJfpj@3NfPbg)KAM~{WME*q}i7u#kOI(!uzpap+
zPP9rA@B|eK`T$nIJzt5MghK19)Z7YnS=@GFF!F~PobJX37f0CJv;lp`D4`SVVHj**
zrr}PCIs`~9z91iBmj(UnVQ&Va{m~$Gs)t%D#O$}%wF4+TN3+|JIGGTj+#t)g2hvoX
zl3y9`GBnm(fU*%au_O3FBR2GL{&Zo*-&=sx$Xlf7xvVF1qd<+l`uwQ5XEt2(bhkw|
z?sU!1xiv?lrnK{xl(=4eAOnc$*;)5KePqd8M0TfaVK%(<e%U+r)Ly6^>S(JEL>$4q
z14Qj7f$klTF%s(4_PfAH%G-~DVeVP6bsD9;f|*I5NU&LGh;<TtHSQob>}vzh*16kW
zATHW>ByD2t_C?5+0#WTT1ZrvcJ$1I#EzIGDJCD47yx)@4nCCDv{B9-wAy>Q(7?^t|
z&jcn3ChoDqq06U@rlBmPKj3vDcC<Mo*d|~EG)EYO1D<_!;o}xFAB3)=mFgp(4p{SN
z1Q*eTH3O%DuMJX7*<=3Nx4y=Bw6kpa*a+=3TmEA}hARO6`4R=M*8sY+2tQX}?y{ij
zjMIFQyvSTp9k2~t!cNeIk6FvGlPpQcEH2&>;S(>X0%Et|a}VptPmPkVzc+EuzW3n5
zoku~q<nQ%|p9|!%Id@aw8f$b1ItdskT|g%>D>t5{&XGr^v-g-74@of)Kvr`8m)R`y
z3yROg%>k<EMIiUpMTVD_eLo?Rbh+9M%bN{qX4|zrc}+G}sG=72IE&TVI2?g-3mD@R
zgtNAZ)O@cx(!n!XpBwRo1AizyJXSBNk|gE|O>&bUMo;v+sE)gWv7c`dr|U@4I?GQT
zyb@Rw_%8{lP}oP6`XMd8H;wM-Sc)(2AYcB0xtJ>yrDolD?(7dt58Bf9XBNxov#;!i
z97kl55;4p1-{Jo_=ic9E*=d{6sP{oY`kVVy%}58PGwferBYBkIF#Mt-_sQ7_t#b?v
zV_^RiIji-JU9nAFfR%iPZSPOx$eW3S*_fRZ;hbj=ZERLP6%x{d0gbH5s4h-D)el>V
z0X<ssS`Yj1gRt~ntozeJX`*!F86yJ75#glnbvIm=UW$mUB<B9^QFYe~%GK|<#&L0=
z&b9tAOJ7|GuKeG$6bCW_sZ$6l_GFsnjAa&{AtKMT+lTi6pjB4Q`5E_RV!vVa>1sM4
z>}3wQI@j2F)oE5Yn*mY}mI0~(wtXfTC~0j+p_S@`W^Wq+@W(o*8dl!MsB-xDn_0#k
zzHI1}g`3Zc=^}^eL*s`Z({tB9R-0C^**lpHDD$=#9Jjwf5;7m9Aw_zwMwpRV7%$RR
zE%yD8w)1gOY`7{S*YRC%h6ejr_t<0RnTVNd92SGFh(F}|6oxfC8nY*?yQw#Z)LkN7
z=yM0;0-*OKI3|p17>;8k8_ML|>~NQlXrCeykag5CRM_lKqAQGNvyAuMX2;}<MRwb$
zgxZd&CO@`7jWJBO@RMk)!4hhr*|FLv8|+~G2gJCRNU}Idb|3Liu&-;ZZ-~BnKvM)i
zXu(j!N@EWWN$WHjdb1mcRDejY!tlO&5SG<FR*_wbk`#*5Cc?i?OJRM=2_p+l*3pe`
z=7#?pMND1yYLmj<?BF43(C3#)Mw8ulx6-8}k&D03mp1}|6ndOCR({~iO8TNisERMH
zaX#XQjsY|Va?xTLutYDQI{&bXNCaGDyN}uH*4jxr2pDT#-1d(YC(IM8J`+YYZ%VT6
z(u2}Zu*2hX!VTUUWev66O7rz?w|vx70n8JM9#xZ5iB8~1Au+ryuQ_aOW<-0dg0=^-
z{HoQ~)v;4~X6QQ2ht|$b6h$01Tp+{F7S!{#rCjUcE&`A%iLr^pcf?w_Co#14e~9YJ
zQQ$A>t3~l_LxULe#GcbVK&5-AfZmD@pFt(RS(0rrS<Pq;{qfeBOnzWe%(l~5tUoZZ
zt0??YKAgy{{5D6|m?edTqSVV3z;IZ{{Y<xX**h3Ux+{4P4<3{Xh*kCN_wliSTqSx@
zQ_c$?q}us~rf=CY8{ZVpm?R&38X|!{Ip!P&kW1BI?NT~8TbrvcK~<)$^&suLJZ7@6
zam#F60xLTK{4TJxkRC9#z6Kce$TXV0jgJKc0opu;{TS}|HY$1K^O;~$*#G;jasKZ&
k&iVi7PbUYv8Z}^#>67T-9oX|az@JkmJdVHp(eL;F2fNHC7ytkO

literal 0
HcmV?d00001

diff --git a/docs/img/database-access/guides/redis/redisinsight-connected.png b/docs/img/database-access/guides/redis/redisinsight-connected.png
new file mode 100644
index 0000000000000000000000000000000000000000..f0f54ce2f1d26a7363bc62588c299c920470e86e
GIT binary patch
literal 181286
zcmdSBc{r49{|79DN|qMXU~DCo{mwR+M1~SYLUux8>_*lh3W*^~%1$K9SjWC)3n5FE
z8T;57`!K^S@3`;hx$paVe!t`Xy??&1<CtTvxvulP&hxu}zTfjaMc&tioIZK+Bpn^y
zX>BbHeLA}1VRUqiPgs~}cfRp(c+t@vgE*?I-`7@G7r5`?YVYW5M@M%h&eqE6jP~^_
z->t2!tiJbL6FceQqaP9RM&AnF-qb44EYNP%E|C1e%xs#6W18XNH@d6`&6Q59Zv+lX
zCB7GI52WXr_f_hc4#fptdJ=~^k>hu+>D}AM$*kE_I`_vOY7b5@FxZ}qEi|*xr?c^)
z8xy*H6LM_K^X8fti$6m|3ZpgfSpJC<9!#aKbYt|L7b0)U@>tT1DQRoXE^9e|sTXL%
z&aPmyIG#Ou_H^b}Q+0Oe+o9KIIB?09_e~O#QXgbav#@@Cc)YLfi3;CwVFqDgCZ_uz
z)E~mx7{f1Rja~>drU)@HMIl*Pf1Ks8(U!fygQ}E~(i*=Nk$2t7YTDJ>Y82KWP;!NH
zovz*WdYfarCWjp2ECa)8J(UX1mzFBlv$rCEW~kJuC<>KY%kz}N$MlN9m##q9T6(79
ziX4rzkL--K?eE>AyGpxep*t4tNXJOKI!60kq<!e<7~a03W2Swdp?x&c>Hq!ocvw2a
zzpoje95qxkP}kO`eH++%*x9*wK6UjHVArdry=v6)p|O|oJsl-mSEz*b6IUBMiRVza
zqb_vH&y{GGP&+Scf#*<X7f+?<Dnh@vP@-KQ-If#*_`QjjlZue>z54>{t{!#*auQM!
zQbMXH1q1|?J)YPr>1$~It2^zNiqKOpFE=GgNgp2{2_IPrR}TkCX+=dvNhujg85wa}
z3vo|h7ccAQ;x3-Tf4t=1@6oXHwDoXw^Kx``5jc9UwT-K{mx_?k(LjIx{V`9w=Z=4k
z<l^}+vS<WK9zBtimXMPC^WC(r%13vV?mIrWb2ia%gwohU8$(rETIM(9-#h$|M}H0Z
zx30#2>-w9t%-_5I?a_aCHT1OeP<MsW2K7??OE&-N{P&0d>ZmMvMEl=(@du-Szf0q^
z>PcnEKc%L6a$sQwNJn>*PFq9m;qzl_^~`n9+rInYeUDRSUAHwf)EKiPu5g{ZUl4iX
z$|%N3*f>-A(U8b9QpXvmf)apjz^{nowzpr(bJ^ToYt}srdU2(G;vj7Uy;!@S?7gq(
zkmfJx*1bUt7*0xZNcBxknzC>jE|^NHhl#}ra4^2O$-zReCcwfN^8fuGRg)aXZuPe(
zNeq>vg((+%zkSTKRC%YH2jY_(G6)~FP*K`mI$ZwvHB0=!JyUfn6yDot22X-(?p)jX
z?D=eAY8>uC<tq><rSMEQp(A~dEhB5MJCNVu9fqfTDVvH;Ql@VxU;B29QX98P?-r5D
zaC2&(W!9KtbtLDgy-jyvi`xUf%TaJfXOT14{jrb@bw+QNJzS`|sVhjIJn%{e2Gs!?
zLtV|C5(&*yJE1!)oy5dd$(_E4s;5ZAkH%0%q5ZURco~I9rQpfYu(d@C=<f&qZpcka
z(jtPB-zM&8P~Sk--WX;0JW;kU?bGazsHgWe+yS@BNJ(FKq4~BcCw;O=>J?n;<Vr}W
z3?3bek~^3dF(|Ll^>^O=93zL0cg4SlswV|Fsq<@-j<J!>>y>aKr_*-&oH{)-RV=?(
z`gNoFQ5AxSxdXs-)07#U;kvTCvZW053B_GvEBPssd%JM56j~02eiu%HGbwD!@AT1~
z>O0++_ye2-Prj=xie7ygkYDKxfSLlfwHDH7WAu<@o4$Fr>|EN>TL3Pe>5JU+6P#KR
z$7o`PUn##OIs`MoWvQ&io8y}SCTT>6u$4z|cjm_4hGW3ey!oOhslNpJPGI3DN5u*V
zme$?mbF3B8@8drZX1M_d0U{K-P}=k*M=Tf8el%87=P2D>=?Mj3+RR2Oerd_7B;rR{
zvI@Y=i<-kz!rLb_0@kH&CoUqC;cjem#A|()zLc&bkq!q^o{boc%g*n7ca8g|UHth3
zPzcBy1#Is)jgay48s5iOJiAgTPHb3Ws1N!MNc6+!6zZ)V_@S>I-Ar#`&IE2pf)C!b
zwUxL1MnLoe+-FD+hT=SSkDK>49=n=qnczX5KiJ{N`dXtc43gk7)ZM<QW@i}!CiPkp
z-1LbiVU9xM(oTf_I{1hRS>rN4^A9M`XX`Yg_Kun=9W||{qQ1Y`>?HdHzg*<}JPxlU
z9ZK#TOOp-X(dcoxP<n~;8xF2ud`>VMcY9^dMa53yDF%fvS9hLTfFgB)4e)|OZrgy>
zcvwWk1m{qDWs0K{0uJ3$3kcw8v=0}}$DIWe7D?DH9_^yWX5J*CgPX2Gu1uqn>qnaz
z;#;EpKCtiIk&1plxVG9?(6~dQsbsU#>&9^)#`|F^c!!j<*w>F&>s^dghM#tGzc<kf
zkX3<4X0N)gCBq#Nv9F~YOsPW#?`vC7h5Kd|Dtim~sg;PSl|0N^tC}l}56PFa!5b9u
zCZw)rPh&Q8HWc#sFvR};;t4es=DqCHCkH#TH-c^~Gn#sh#yvACn~2N=u5sw`AKELg
zC|<|(p6v~KnhOlLn5KmLX`2OH;lNy?&^c{!8FkNck(d|XEWT6l<#*SeCjrcSswpzm
z=P3#!N{A<v<8kBgWO+|&4>_^o)#~Yu{P!vHr8FW#tG^w-UX0vf@q9LHX##f-dO}vL
z(XEoG(oBYwQRw3e8k6O<J*g9<Vc__x!nq=+4S4pZD^BHYAJ5hSFo6l4hgJTW>J>O_
zSuVU+#ba2%92FIHuQ4}^pI!lI;jbneLkZJ61$`R2+r5&v)6%MGrXW@<og=DkcskI!
zue0*mosokfeslk~j<%2U!?zp<5qhSxOGx{(K#s4B)MWS(4NoY1KVITg+753YDULl^
z`Z3ry`a@}q8#xhgG@NDv_q@$o#J$1iOX2AOS~2izrGmF<Vxt+r9MN`%=GZ8`^*z1;
z;|B<(UEVqIPsp#j;f<=)FRo}8xzcK{VRnsa%u8jfN?^it)?n&h&`nhl10+yi^*+`Z
zk`yY(t3w(cE3yYA=>=da+4)C|0y^RdBYlfN67z^&Z(}liq=WQnRdNK#@`Tb!iYG4C
zSW@jNJ)}=GWukezBc99eTN34~q!+@RKEXdh$=1%q#`k*V6VvM|iq!9l4cbvU#GG+$
zRgN(Bj7twXcLd!9vN=#oj@WSfKtpf2H%Wf_P;FD{>_AX3H1LL{s9eo^DHkk=Y1XPt
zdKMeS;QprFwF7w?HYYz!psBaN%RC9Ya?zYxP0`#zF0v4g=Jn}NZ=GsFbtW9ht|AK>
z>niQZZ7V{nNM&ktgkf4^y`}=Vl=6f2u&>9K+<7r>^<BBSq)dn4_)gtMk`mP&H^^i%
zwb~esNK>VTPXz%ZT+>qEYXDV_-9U4r5;0O7Vf@^|z@D1aaRhsA&!OPXF+#Jc<Y-X(
zn||$JrM0Jh{V{1udRNf;IjKX0@)DJrHUsY)7xoa!w^YJpRG)_akZ-VkhFz8aJ!p9&
zsm<@+ulD&0(flbbYB81FT5rt4cZ;m16@Z7$sftK@TKF(J(pYJBf!=qa`on3x@g{J4
zauR;g>e2Uuof=cPM{h~{%RyT<8&xz9VYRXb;Ib~VLDFLld%pb=M|1@%W!=NE--N!V
z|3WYNbI-sn4?;JgjN^&N>LX5jC-Y_>i2Q1oGrUor!RLn-I1qKMl~eWAYZ`9flWprr
z#Ac=hu65+bP^`cP0V{k_a*>v5d1pwF#rKOJ7WI1@n-#xVmUQCf11Sujj>1NYtOD?0
zzwsyl_Z);?vn|)`K5z<#3|nSZymVq+94KgHT4aH@T|SacRiXmi!{rH$mR!%vi|WH^
zS>CU9=7-BE+lIoar`}BXi!Gj@m-r!ARtPTtm0J2-i5k0C0>v8WIb%nhMcZ==<)BJ-
zFtRAy`oTtLI<vUd)5liCU^-6eshsl9KbTvYe-8heEiPd1aH%G57CK?$JGdGb3Ly|c
zSA6?ONA?z<-f3yxD5XP<kA(O@N;BL|mF6&Ce^ezRYAN-@#W$vMlJ)+u%N`P_^Fa7W
z%d7SmDBXNF_NS^-!Dddu?}&0e2f{RBz-50ZRiPt!nS7rTT~d}~BcXvVH+RL4ObyLs
z-79%eH=-{$b+AWq3RpWJ^Kb)e?`evt7HzOqG`(eh2xi@8@ngfk$d8Hq$$p&g#pxPU
zv~3PsNlcw|L?oXb>8oqt81nH1v8h*XwEq>)68ZzQ;n8VKxpaG*Jc?XFEmt3j0sjev
zWT*?2_(Rv)g{M0v@F(Op;xu}&;t7qxJKyl|;i=HYH_C7+C${1D*%q?Cl#9v0S+$Qe
za71%4_T;f5MU3*!V!JV1YNUKe(k_hHafq6iYrqc)mJcS9w<(AQ{EZmu&g9d80Q4(k
zsPc9Ml<D&-(G|0`nsqIBX7=nfk%RGLLtMuzW&CRal=p!&RF9)MSEb<!2)5mtBGM4}
ztTGiNkNr4{P>P8@-&nIEHTGc(L(zQ!-irj+RLSq|uv6kK;fhpGvctbD8eEXK@R)k9
zl+s1>F;m(j)FZOu@Q`8P9~T`JWt6vzwzzgPOwrcxJ|zlxTQ%m~GLm{Zvd_=Ds1I&f
zVKRkx=;j{iSk>Vf#a{~eNe<cX9^DK%aa~O5xPPRPsAFKcZObbeT;AeS@{o-v`D_Ov
zo3~w_Neuc0%Y6CVE;K+-2`%i|mOE)2gD6#6;nZKnZ0(cxJ6zN7gNpfZUa+6-GI$H}
zAp(#`V5Ig}9G5UVd#AT?c}I^Hfr&HTbG}CaiLr|2=97hck=4{Uy(f?W{jE;2=svKQ
z88HrL_7wX)B4-6sx@loqasjfD)qBna&K66Tc%)%-7u^GW%?leN2UFp_zjj}$Tbu@k
zQ8E(YfJ#bp_zt`WMsbu~KXApy1LcDPo;n1=$xtwcGTOd{$L@ExR_nfGvj7T7wO8s`
z64Dtj1YhyjkF{Ctr@x!Zu67@4V5sg0b-ruo@9`!IiF4k{lT{_Jc64;;Y>8fIROPFM
z>R<>r9?lxE60X1d9j8q_jiEoaz}Bi5MyewA`SzXj$9%A-T(CYBGaW}{7Ga{Hj2+j7
zseazLBe=1i60v`OyP6sUr!de^9Mj@S<LA8}?8!GinpVfq1WR+tu0>%X&XKFG8_aK@
zZ;8l?3zd{x@`GgVbJ6lHl$T`*)IpRA^=VZ4PFWNCEU#_@5IEs|8Mah&a+Fy=cBqm}
z_gh%aUTF69r%S{>I!qZ^s(d77h#lzP6#-i?RZ+smyJFAQM)$#)>|Z1LhLJR#dl=uV
z3F`W;vsLoRl_bZH!^o8Uyrio2MudPUe%kl1xXjA`xLV?J5*0&~+i_h7<A_byKOMRr
zsb2IjV6K#MaV8Ewvb$JYK#MHF!JU5qs>OvgG=5=$L~6$CQWs^Zp4=%=(r~mXyqalw
z3SN@pND)jWx5l*aEX4(x)T-g8ktG$bt3?&cA}ijP0wN-;V(-kprGIqlmN*+Q;S2XD
z*Tc&UsyqRnyWohg7Y}YU$Yqy9(1cbsQtVTQfZbO0rTneD4mQ3#s1s^1!w6#L{6=pg
z0E=}}-OBgnPW$ao*TA&n^RN7<Fy7cypvb7oXm<pBWJT}ri*u`Rq$tftmr;5TK&u-^
z7q7rwJ00VFz#oZ4cW0(9o4_BH={9kf)bCr8-n2BzrXHvRMjF3t{%UtH*SP>#+(jV`
zRpx*g!d}`Qxi3wwaFn^De;B%}%vV#S!NG_q1;&Ja*6mM~Nf&;R%ic9w@j|b|jvs_J
z&Y6_S3vxCxY>Dp;x)>fGp^W3uU%dhdt#iMZm!$$#DF4jA+yO}>FeJAs(12|>K9MN8
zBk2?VN2F<~I5raMbalI^R;TQDRoXZLMc4Y$d@1}B*IK~Ek6EatV%vHF5(OAD?7eSP
zg7Z>M-%!O&6%qJ}La3Jz30XcRhb4p$KLWQ34_6Tgu{tOy#&zXaB^J5jq{m1^M@iAe
z9us37sAA(07&;*|zZaTb539>m+oVgA<4wMPAOZ#RkoU1!BS>j+z!WN**RxGj6C7lC
z`ZjzwscuVZQ$)=*V3$QHMotxah)oj@0#RDoDT-7NvK{5Z4+ih6JtR}<&4BM@2QLdZ
zmpKZkNnjPxeB+y9+#ldi4^B&OI)3!QX%2hBV27mG^bOCoAFoVxATJYR@$yEkS~Tg%
z=Kk=aK0p9liIB#nR^Alf-CoR+IW=<?No{ZIKx6{DMumbV=SnKZ+jC<^Q5kjpx4(I1
zfz}nzF?M417zFeJPf7Ij3zzr5k`bsNbN!~)nuGrg)JKnT<FxyIJz^oni<{sxs1~*q
z8xT3qr{H~FVsSfiZ!X%^^66lEuCf8i9ox|WoGMuo-GcBiQ=5rtJFadi?qpgL+5?}S
zsq0Up%1~L|JXDWg6WQ6=ZM%DfbsfmEA0a7{RT95L^~2vGx-_@IQ8-%u7`Y?3y3tIG
zT|_LC28TCE^A{t%iu$IAp5r^*N=V@mOAFIUxHjjaC0YQ*;Of03CQL9W{#+orODNMj
zkZaSWW-mCwcuq}JNO&!w&ygxaW%bb1n+0dJZf-MV>z;wx_3Ws7Km)~L!8<cnwb}fE
zT#a98L`UoKQI;hA0+!MeWTZJ~2f24ur|;{TVh`1Q2)9~IKm&5B^E9NyrYEq1*#b1S
zIph%93nX4)^++`5=z8FtwCegB)$U*MtI-6`x)4&(cmzE^iAF5<foULK*?{=w#yYW2
zsaRI;Bi?6tN?ejgBrTm)m6DtzIxQ?B&!11LCP=QBQrOLsJP&tV4ZUCR|A^y)?+jt%
z%jc<IARTI~Hg6NDvJzsq_-@_7JnE|t^#BY87_vuNuNB=WQ6JHy3-DJk?g|!^YK4Yu
zsh6b0i@=s*VVt*AaGdyr=v>#X1q@-%F_#_dln*@2swcZ1hSR<$VTC~Kr-9y*o}r?T
zUUJZYZM4BuyDN64Rva)=4g^|~gYxf^`hB@bo|Ji-WX+F?FL2NlEgvA~ssQUYJ}yu|
zAJsqTnLCw_MAsa7#%aGTG%efp!p%`W9ZHTc^cCUAIVq4%f82)!ifqj*4{DyM*7@G}
zy}Ad9hpy|5fJ4f)k#<G7DH=SEL6HxEHSUWgJN#l>Xd*kD1s6LEw(EnV$M`XirYz*!
z!>`EEYBSm3pk4H9X4ul3EcRW1A&Uo;CG?3@PP_ZfRuM$(*UEcF52!4xcDTo;CjMwg
zr>^j^RFQ-9=uEw?KvS;+p-Zp!2u*N6BUf%<RlDeMW=7!pZ^Ma>03e@Dz&13%xueY$
z=kR)i5bgAlkmV^y@NAzaIU#e+;8{e;KLGr2J+*S@_IhLJjq?iSM<Bk&bk$8f2|rS^
zN<D(UTA;MwaSO=khzqW1@TZGWN6gt&gnC-QPp^lS?N}zSYEelJ<G6!C#j~ah1Md3|
z(F%Pl$coR=Rc}$=Xd~}RQ)5uz0Lq-Yhc#$_f6kHY7}Zcgv*fVgkyk8q4SeSqgf^^7
z9I>V&XruUyXjHj6Dg9VIK9WD>7U-DBMtF3zs<z@|Ff>&TO?yKQe{(wl<roMERYEV9
z+2^)FrVfS@Vc9WLB_<>7Mh<3!+Owdb!&_g$1FgV-SIuy*3AdOz65t0IhhOz}__*r2
zPNSZ^Y;C$BmI(Jk?y4rxQZVqi|4~9%S#NYiFLNKv1YY9DGcIrL^YJKo5#7HxqMs^?
zQ${b8QFyH{*_*&!Mi0*Nws|xx0vE9gq^-e5YGp$tq<#nJ{n|SLqf8UFfmg%Z7pp93
zEV!SQ`#`*fUUqv&s`4$1Pja+q7$Jrl_C625>fKFtVTEG@$_4Z{gc^>&2sl*RTNQCN
zwUolq2}#`mk)|2%HAUo2chgF07cD`%qnw^Ogkj99A=rV-p^i#}0tdA7>=c#%z6%D>
z$mawKS~D#XcLb{jqNdRO!&|lp<0GKWTotUh3AAcf?C0)F`6GLOv%p#u|3}>l^pU$7
zLi1ia@YqfMkNA<N<P`kklEvF2i2Z}p1nyIbaD*p=v}vUGTnJ7$y8Y?fLA+<&YJ7vh
z&P?M|8t6gR?{y02%*_m3z5qs*(*WKrhk%2^bO`$S3e%0y(Su)H0Me*rS0Vc@^wVQr
zkBC6(P+?`c+6YE_kfYeVy#E2niMNYxjE&zP{Qz=@Z*PusSDfd?LiA4*;r34_^`t%e
zJA6oIfmgWiSy{aec<kWh^8=Ue3cpdyUEK3%#63V3Ufpa3y=8z<pvdtPQE#H3XK+jI
zdbT-`B7r1DR}V_`LYf&IANGZYYNgUpJK{uC@*kCe+U3kznkVP^@yP^kM-%q`G%;!{
z#6PFcSd}_Q6h11{{h(Dl)sL!7%ZIQ<KgvQw$aCP#_>4uj@7zIrfIk&)q5k!>FWM$b
za`g*jH=Mse2S0(x*l0Lyw*f~_8%<R0OcAnKw(xgNz;p7(yt_=GuWXxbY7Wa@pM35c
zsuZ}YIYavm9$n88W`CaiTQ+LYqL^;DX0N4a#X4Yn&p-v$t{!fjDo$zg*tK3xbO%hS
zdeGlTSnA(4-7Snr!Mc-hJQX83(RvoZ(H^d;pk>4m>Ohy&KSJNCQFoo0+K*4%arHXw
zo;r8%$(PbilC6?dNQ<?n)o(8K79Q37up`^bqIDM67muvmUqT_=BlXDOk*lowFFiHt
zmGt}g`f`t;ODEZ($?5sM=k><DN14r@nH$@@@&zC2%bky2l$ZM}mT(VysE*BY{0Cb4
z<(+CY(w=)dvkxWi4GmcP>F6|e*p<Bng}@(Mu4oquH}GVx?sH@CT*pjYneVBCbe=&>
zsVh|(C}6Nefsf2gXv-tu(uF#^?V)^i_WLM7Nyo=!6WYNs6HTp)o1yt*5(uRG)>e;o
zJ-Gwyn+=?bAFe@7?zKL{tO89j@enP(d|V`gt-sM0MNWr3oa$%<0>Qi}QAF%z3SIa#
zSb^Jv77V&cgZB_g@N29%m65{^x)fT@46jk$qDZe(5Pac;IEdEo)w!Lf9npPS$-|Rs
z2jiWv+$PDADbhC`!t_$9nmZ2bjjP-2<CY4gln=c?JF+*f0E{_IT*V~yf`@6aZ58On
z;<qgh@2ICU)kyPr)%tCiF#4ebW~cIW>NTDq!i9$hATOX}JK)zwd(WkPIM_hEd_Ekn
zzwq=B+3<D5(ycUOHvIytZ@|ejq0Bs9{H%=4seaB-$ejzOtItsRMjPR8PTK?=%Ulb$
zCJlpO<xnj4Y|554xwzlSvTQY3WK<|7t<?5%kiX4LE?=WG4f%+=n)krGZC+adhvP1$
zp~!?i_aeejr2@b}#r@3hmDoExEF(;BX`le%K*M`uz0@Q)^N7|uILn`T=jHzM4eF$W
zb|Hfze$JE1XMII3JBe0F_v4$V<?-yE_Oyty*jE6qQfDnXk!DU?+$fYzmN$2JLYDs4
zzN0B2vWkpuq|65Fe29k6qH);1#n38>@CF%ZN|5h$MW0~+Y4~FwgqNqu2A$hE@Zc{=
zh4q%9{iyx&C{#--rDChZ3H!+v-;T^lS;A~7sID%)TXD9C_G>2;$9rj}W#htwPb-C_
zkE637;dJLRi=wTsd%Z}nw?jX3;MHdf*j5_@duf5+2YyafW*$J5o!+|O1h53@<L4Yh
z>;3fEbcGIWUKirCXC0pftVJXE2GCC7E@lC1M>V|3qy-w7??|4Rsk2?FdrJfLv=nP_
zM3$B)4qxj%`>(|0_wf09janH_9Jl+pi0m(e)TYt^F&+1ap=s9+cbc@!Adww0oXTtg
zjG6LS%%*H9ySscAC%%^)Lh12lbquS<odGsW+9=N&IE+;V9#y$;PB1OA_zeWJDK>t^
zQn|bmPB4~iCccWm@hR}BkFX`kFv|^{lJRA%2gb@}AGly_5ar$sJ=2mwn|A}qws$8L
zhH$0`(_h#ayh0WK;gIdVACHgOSHv?^j1|I4y$(iN>bF)`!9u<Zuk<)!asqxvf}2hz
zADkgEN6h^zg`rWKb%S0uYk%O6YP?hVBY{Nx;%-Hi=j~7S<dh>oI8W?e{L##+bdaz5
z$12B2&LOGIL3Z$9!>3|>5l?ua(qM>?U2)e{;YiJ`LYXi>FRaYdxK4>y`+Bbj=DYe6
z%kB=fo`hu&CHYYu0|%HMjP!y-Kl)NGjlR;tXn!{jmaXVLb|L=~`~r&|b8oM?s?;v7
zHYm?hpB?D6bsH4&WvocY6!%7*54P*j=r`WTzmI`dPH^FBHyVsK8V=V%6X{(jj7zQ4
zuf*f0m?q3>Vbe9@mA=mBcSrXJQImB+Vu-Shj;GyF3pkdvWCXxGpm|d<Vci^?u~`vV
zPy>|Dw{?%~bswaZdxe=gJ(bFxYLv>2Bfc^>b=f)inS;mreu>6i0XUd}ybDvH_^IJI
z$eR&8=87!o`?{oLD$aMtciy)@)pfLDUJl6)eGE<wM~}voy0=#tjG)IJQI7_Ael);E
zhWXY$;{T5ZIKUNE&AvV*Sv~hQN}_7|#oa#D!?n*h=0gvjsHoDUzA7khQkHV_oDG9~
z=dr1(O#abM1AQb->_U=v04rCV5bUt4SsjQ5aa&00=t0I0HPe-QPB4m$6?k!~m+Qp<
z>_v<WN8l$VI?QxS2u*DVPui_177NA%53NbP0@5q(j0%;v^*z8>9Y(tbU~4C_{QJg1
z_+LgFzQp;&#QdU~uLX}Qz7|;2*MPp>6ZyyGWpS1eC~7Rn?Yc!>)lhVX9dUc!ZmiU<
zkw{tu!~2PgY19g(A?nwTJOlOj!SAplFD=8~KzBUeXO}m>@@suapI8dT_@S>311$Ly
zym+b4YJESy&DnYOkfs@844(~H?AUkFC+O_9(Xj(urU$d>g5G>?J#1vF@TG7$Ui8}z
zO?dX`WG(-`!tPJ?4X>YS%oBT=Q4;9oZ>J=$;~VMi=DXhUagI|K)6ts$xLQ7XizE2Z
zR{e^Z06;^scCED3rtNhKoAPGU1Ptw%yZvd3^s17rNjw$9YEpD2hLaMf-oV-0AJD^g
z!fHFVX}Ht&?Kj`9=ri4Q<2jCn7hk)7QNQ9piY&4j05e(u1$mf-q~>spDYp=C6E|;E
z1>XVeW`)9TXd%Nnj;^I+_tRPhH=chHm5@6e#x}oWRbA7Ruj$Wt$10I%;pb>l_G<H=
zSNl<NjMGeluaMOXA4_+7K~r9d<}j1{+SXNVmLpgMKG-SDR72!>r>(G_*oNaBz|MAj
zHt*ZG?evwWEg=?-H!u~=OmUD)2whNMW}30ceNh)FyQdvuXx{*7tF{o9GcY!r<kK}=
zbcgo-D?`%8(EbMt3^J<T?Mg)rl7uTTCd+`Wwuz$Y$J{6WX)}V=HApaD%Nl<XGO6Bi
zo~^Rb^<1z6NmJ#3l&c}>XbQ2Ql-h@fiTi4-pIbj;`uy$yDn;4ekR8(vx5;In{SMEx
zlynU383_q<2AB!Gf4Kdq5jOmxyd|bNPV}=b@I7DM8|9#ier`Lqm11?h8cUURpH@!D
z^~J#EIw7Gm|GZU#<Cuc_<Q2F5+Nr?AuOJjZ^RTTxg;Rc1X#0c5dj?#@VFLR*hIiBi
z`ImjIniht=XH#q%wJOS7GRvo`wJ(mnVjH{w5(7!l4aW_<QU`QHJNn0l{nq*)w6jZd
zc8BVV)nQvGR>(B+>iTrsyZNbj_8b4lgqDQqe4ZZ}<O83R>Rs!W2yG(7tP^qTXBYf!
zA~vDwGpnnZ<sA!3yfVqY+r8`MisjU=g0s6jTuRcwj2*Am=ARF?S9tFmdMnXs@QT<u
zEB=gI$+EAN5ero>7R^CL<!&!2L_k$gyoHS|`{SN{`Bp@u!pDaBLjSp$#7c>tg!cLm
z2Vk|TNw?0ywzVMNNbGvuidz*N`EC=ZOcKe9g81Gi+{vB?&&%A)OKi~yr-`hRt>_#)
zJANCvmn)Z~!_yiN7K7q*#>ns}u|9=;@M9J`q2o`7y&0~crGKEoXQN_=Hqqk?QjB=X
z16&v(R2G54e3GB|Y|b7()z$KT!#HNry|#4fZS&&uz1Q#N6S|A8ikf?vn3zmmk^!2S
z`5zXyj3i{al+~<N9;V~Q8cpx(lAGn`vt6%WzefHp>Rt0x&BS*uvvlR>OS_(XOq<u0
zU7;qsDL3r4Mpj~tdXVt=SJCEw?x-oA7ralkw%EhCHhN6@F20lPRj};_OkWp9J0a`4
zXaTYtsg+pPtCT;!5ww3zzILpqi&=Fu#G~_4;*S9jaz2-Y*=T(t8+%=v#D7S;*ionn
z@xxHUJse$&`K7+DA2jficYOYJo}cf)<26QrG1&Qg%LD!P#Ja2Fmv9`;b24ICl`8Iv
z#ThDM%ngpAY}BQNO9~&592x?=ymo4(q1kK+%C|1KOQ9f(!MwlOseP`ev$^Zv708q-
zw^Y%%bri#QUUFL)8_IUOM4`l78<t(>n?Bb7M)^x|1K+lSQ&5t6RNV3T7ltsnz2(pv
zY7o7hgMIXl!S$AprpI>+r*1+2!mIm@Eibm;?2BLJHoJOV_>+5eMK^asKINIVNiDNF
zpz~urcfxspBM)N4OS@X1f-9#alK5SpB$@ri&P&3@RLWr@U~==-JWb`q7t`RBWc9+R
zagRgHRKs<X(mB6NVau|C;SuCcy&xHfM)_CG>$Mw`(R^>YZdFk}dYROCIgSM#;*jTW
z5yH;uei+7`zxF8Mltfi}z|1MjD{zu9*n;mrT+rx4j%nrvE=h~JfUn@~H=BuWac4qT
zv<3I)WSmfCEnIQbu%E&RaWRTW$ks8cql(;;!sguz-%7=8qtXX+rE6YSQ*<177EAeu
z&VCPNV_~Y8+Y;-(m)dLH(HzXVOSt(XUMQRGgWQ2f>`<2QugZoiXG0k#dX5-AF<j8x
z^W55DQ$ePx;?<R)yO-W1UjI$U6r|GEJMI3&&FT09(n6!L;rj?p)3LshlxFPr>0#DP
z!b;=g#}E}CDjL?w{O6`FQzm+5UbmaoJ1HAx0w8(O5RROw$_9KPveG5ZYe0Lx^{n3Y
zMl#M7`AfA}nD|4sZ_UECoec`R4Ec|cCnwH0&9S;LF!2nzR}fATPDw}<k+c+}Uh#?K
z2l*s_4KEJu_^ohELeg6MYM-{hhN=F_{GGg!2E1$SW0gvsTiSc|97DaaSJ`x4e9-N`
z0M!!1sDUO9vcN+aNoVw4#pth7`lb#5(sEW*g<pkvCeh1xX`63&?1J)y&3&cxx8K;u
z9K*Mpqa*=FDnlx}x=u%r3Y=w_heouN=VF|?n5p3zKdxWfDD6=Kg?5-A$FdsqGtm;X
zZ4_1!e{FFyJw*@U^L{wykQP`obE{}_maFm#@Nl%FOBaM|MT#V<?2Tp>a~=Fb1{u=s
zlza5t7<u#ZRZ2}|?F8-)nKRm>|2Fr#G|F!7JZOrj>u{LPtn%f$WkVfl2?D-aSvN0!
zmmKa-#3SJo#M<qyYaqaE>FS5QqlijulMH&$u>B5sj_Vg;o-i*7H-SxfkF2M!M+nC(
zp(p1q%ZqgY;Q_><T-6)cqA_>X$-~Kgu1P8gqi_N2K6<`q-SJ?!D~&vs_6{&U%``8Y
zM${paH{h0RN=xY;;h^yhjN*^cQSW<}W8$TP9xHjdFi@-@4oLhCfk`hP#(>t1`3X(T
zu#Nn~79iy(?gM3mO4-;B1(MRo=OuiWEnJW7?eg)Zbx*9rD%U+J!<7xc0xyRHgPxDL
z!j$1SC(CQh{Lif*<<vC?@HI>7!AQ6HhTljpdu=+=xpBXK!yCub=e*dd^I^xOUh7ZO
z<zPf<FkWQi4C1sHFp_OjLn({+J@0sA6lGqG6&8CKf^6kx&a_0UoqU{A6djW47iqP^
zsrZ20pM!%q{5Fy{Hul}y)OHHx7}~9YlJko2xJ%K`DJ%bMF~H4ttD3JMC@)v{@FO2v
z6_nv8FQ0&CeJ)NFB+=5RArpz~uS`h_SZ7XZh5h2YfPNwa#B?gRU;Pu2jt+5F5oV*p
zMK<OWEhjm@*3r*oum?VcNKn>&8dtTNOea<z%{Q|LZH~^Y)$dQvH|*EDLOzy8z1xc|
z@TtS{f&5vtwG1L|vrOKO;_}YMmUQrAehsE7&t21yMrH;-tnUk4AN(b0iYjn|V=$Ab
zyUVgj-SkElksD9eoU>OIfUQZ;WRCRxMk@K##_4u>?9zrN%o(2_Vz-#$BLM*hdO7S*
zYy?%_WEpgbTrDbFB{F~GmEqgw3K^XbVYuG>-n@kw7~lpm-U+=7KgfkYW&^Di#{`6H
zg=^)wt}%rVeZEI-j_>7uqH4Fo(SG+rGLctcWmVGNM?;EnH;qb6^JyiUEp{sWsHG#G
z{Ts#+=Lr#$ctAN5#3^{2IZeBv??GlfqLs;1WBsA30enbZ=$UA<4uJF}9Q2DBdWpYt
zHQzpWUaapb;|Ij(F{Ru04e*4_ECQ6-u72-K^Qb|%ikNDlY@eJHdN~w#;qHpyW;Uv=
zm#}oD?<%u++pi}c-6x#c(V?61o#L)amAH>8m_8V+(aA-w8n>3J5BPIp&JrvESisa0
zZ2T5eY3T0mpxy=yam(x0_0lLWwZPk4B7)gM*$$SY=et4PM=8-ZP0Nc9ORD{+4kwSF
zA!4Q|dp}7uC~jZL@NR#d-)G#N@7NC)YmBMhS_hc2HNifjR(`b(w66|4xDN@-v@Hqz
zA>H96A_wx~gz>1mp}rLvea0W_RKh5188&W@aAs}5sfV>yi07@sCqZvJPBd^tJk~Oz
z%}zw!V&5(&sJHyW4F7&r$Is)G(UOUiI8{P3J6F)*i@sSs%A8)!3Ia~T@|gtXf+q5W
z=b8_qEJ-#-9SS_a+M=yahf_1F`Rb#e?}5VnEKHkgKVASnkq76<1A@$34szSf%m@Cq
zXV*E8r5IL3Ph~-ldgLyB(O}<T5j_!ijd}$f$>025nNdJF&zH6gJ0_T@ZSgHJVYIwC
zwWa1G-!`qSy4K=lK>h>Jm5aS1Y(M-`27R}O%FwxQeqO*RJWXS|V(SptQ#7bcWqpj{
zqC+ca1?RHaC&HE-2cw}Y>IH456Ab}GqYR_S;a5J;>E`+&K({67FK7Gd5<N#4ORb*Z
zP16#WWH$N_>LCQ^?KAN}_0aoIm?c0D@SQGC!hn%j?vH{|roc6Rmxfm(HT(;{6`>+I
zcPui}%T?ci1{Ib8M-a+;PQe%5r@<oIK*Lg57{~5>1&;P_>`i#fcqs$0!$sf|No0O{
z-&(tUqJ*8B#^wgQp!&eAY;07@V8rM^Dy+`pg^yI(>Ib|;D>V+nKNh#SBv`%-0;P-v
zvJ$(GZT*PB((Ki<r4M?URMUjli>j{4{u`hj)#v<hzznVv;<fDtf3y3hcIR6cxTZEy
z2JexUUG7Nidd%DKir$}OE8Iu}*H=BYx<XudsjuM(l(``yQJck@?*v`y<D0x!t}FVk
zaW-YV;pk9H$GQoOVsh-mz2{0Ypr?}eP|{3I+DZlvbstkqf;@U&dwfUXna3{2mKjO4
zj?IfUn%rj_i(2m$cc8NII3&Jov@jiBQ>o;$;7XM@86OkQk^9THnQ>01l(Re$ppV<9
z0ix3G9Xvb&yz>0?t!o^09MNmacFbao!k~MH;2+(+2H!O%K~Z4Ff&M*?xW!~oUC6mI
z&v$LVA;s_KaE)+<=aDtl{7Dr9Zwm?$)$PmcbAX8@&50t@_Lknsq%e2*@?Fc7$=Xx=
zmDN4au1Wum3EU66O6WCDd|AaMb~U!;?&ej%_}HmbEl|;2$@+5P(B_xsjaDqEh*1(P
z(ckcjU0kEQB+Q>bTelGEejmZHL9^UVw?(PFx@Rv+dR_vv<p=f(4d(Rz9#gCsjqe(U
z7>Tsd17gnh#+{=)a5*ES>rrJNPRfOv2A#1?!R93dbo+dRuXLAxeFa@&-rGhV$h=3L
z-O7mP_*VLcNyzS|S8q&wr7he0bEcRF!$v)9xPJGiu6$y&qJr0G1*5DT)2i_r^Zap7
zaVx#*wXcyUteqF%8o-P1T?$i_U*MwsxIJZJ@Mx`vW0A{Q_)leN8V;w+zV5M<5e}>M
z5M&k<7`x!t=RaBI57`h5=N%ZUTU6Ot9@t|?zMg(}mULx;=C*&vwH&V3x<alTK{9oN
zpgGpG*!b%SWBn&*p88KBPKBIs*HL-0r~|eMH|Vs{dJOB?#zJvLW7g9bWY(5aXklcw
zZu^+W{sV;HLrCd?(o1)VeOl^K1gyh+01oY>v~!dPT00<X{SUpdU8LuHwzdUUtrrbt
zs$AKR^|F84T44?Pi7-+jTs&Q@De#3@N31KJ#|ymiNekS&FdT0!DuWf`5<!W87k`)$
zykoXS|I{-UdQ(yQSohebb+*rI_78pUcWuYs0ExtP3U7WKvPCqxcg5@H=-#TF2S>i-
zV}_RWBeuSj6`}~~;(pt*CpA4!=$_DgJ)O`y&7%@pnRNrBjo}2jK%OGfM<g9rjZ8_?
zpV)7v6@s-a$<qwYG0M1M-I9YFAPZH$WxM$wP9*0JOu9<`x=1@rg198l{a#jdl;}T9
zJarP~**S|Wym|^Q%qwduN$Od70sSiz9X;Tfo@lOn9Bf|85gwa;g#T)M8n;if1R1k#
zZ_mZ+@l#>}SG3u-KZXtJf(nIo#_UdBU=1OR^##E$ewd<C_G?GPH@~t>UOQaYgV*F&
zs(>ts*1uW!(rG)^Q`6;tiKzyWut1-=D`fkTH60sMgSCZ=qKs=|xykwhUSpSZ8hs_D
zGJytOq;!4_De`nmBS&6r0Tpjay^Uu&fpnTKv+}utEVf#d3#-|>cluW2GJ7DC!FR{W
z&p#ZZe@bduY1oXNt4HpqZ;YOyTI|;tEh3~}w3rdbL<c2|DS!E2HLKN|!7ty3C6k2n
zo}?yU5~D|oEk^d%)m@U~Gg34RcO~2Q^+R0>#cl-ze)F6S-y7}kmAip?XWDRXqTm*`
zI{UQ7O=eXCkWx1t$M)O$z)jvN4T(MIq{341rO%StLneB!C(G@_8Mo#6X&`g`duY3J
zDJB!z^~tryRM9QZHTi?fX=_sXl*N4s<KrmLZWmA?EyTMRDsEo(@;48W3OexTes@YD
zg^{8}m_OBJ2(QR4m}n8y+dpAlhXWOfoszf!bgl8e^Eb;1YkGU>?nxwnFzJ(qfWX+V
zYhzlUun2I2zme2NvkH~8Q){GG<&WBk-)nvAygp)SI$zyh?X^5$;&ZK%Y@;56eQIgc
zk2W*%J@{7pVX+M0Yc}=VoFz!0v!m0Dwv2!FuMGZo+)5A)GT+};XD2Bkvz@^&i(h7i
zT^C{Rgq-wssJ5@&8@-Q2xcfr$LZ^jqf4@tp5c9P$aRqs`CK-yjINbR94o06l$H(H!
zz{#rlt9NMaH~UX)^a&{gqVw<Ppxtw{VmzPU;S1e3?T+`hTOy!~0)D`q{Hb^0l2awT
zWrL-qeM3m=G*cg&fQ5l;-4KcDf`a4@_Aa$u)jeEPcMH3v!McC#4ZAcz|Ac-onfz^g
zjB0MIx*h$}ZvM%*#|T@d&)Djtgm*p@IRy=anWYEqtc5S!Dd^Ik%17_oEDL)d`RaNZ
z{s;17J2oi^0?wT0C_CYlpY+`d-SaC*ZVI3;Kce8^?|mCAVLMmB`RT>a#M75TFEBGw
zb)HD!J!iuIqsnW_KyP4{Ny_2PA_<G6k+8v=fX$3EW!q_i3+yTlo5GPJ2id(JvbFAB
z&uYot+ESZ*egkwJ+s(5y5=V=YN)S3`?PtvHE{nXe$4Z*t>s}dUVew-}r&qSLH-%3x
zaf2)cAC#E~w1=cnwE7EESKo2|$~nt2#cmeh=<@{=d+yslgQevtA7IvD6m_N{N-uxT
zRYmAe1-i*mCBaGf#@%p#RBZ(jYo1tg_S)Zk8LgdJB8!fDB!}B3Vl#F-&5MEZAZEzp
z?r^hqSEN4Td)9z%@7Xk7w5{!R+D3tH<&D}lO-ocIU(hb37Nu9AV18LJ%sW^%tXGgR
zqn=Non9ovwr@Rd7#ir(vD&vb5B&gASQf^>uus@|*(h&~*0=Z(qY&@4JNBkK5H?tLB
zDUhUZK)?bqxqsJ3T0TB%#_<6y$SN;JWua<YOb(t?vFwPC|BbfHCWf1XIKgNWeD8O{
zhM>FcQ8*;H8@fk`2UW1uOQR{XPLBk?XWz<QV-(|a>@;DD=sgzy)zdBEycgRLj9@3g
z`duw<AVz6T@RgY7)4Tj2jcF}zoxlk5+kf{b|Jz|P`&(Ae!lgdlpSd;zxMVy7>~DS`
zw1)m{k(yA-`&mQW?6R+~{+d|U$Rp}#`l3LCoH+G$bhz|dq8<6+;MR*~vs)0wb18#j
zT1J8CM(8HA0R*tJt9|u^S(&=P_pFXa=1}ZUAU-&hefPz~vMh@3K^M!#+y7CS`0pR1
zE1bb$FI$qM;Mo=pXZ#hr-XDfxG!Dkal+d<Or^Q~dYt#7C>A14120F}5g|R^G&x3yZ
z#Hq{68{@4DSm7=3_WGd)y5d}X+co#+1C%+4Wv9G@AK={YIm%2nGR*B@N|Eypm1_HY
ziu>PlV4+vD5@MXYKEuP=<?%5#8s}oQ>sGL&So{(=AKWqo>2|PzjLBttq~E|01#S;v
zQXf*zPnEwr)%IR_`HfAu{cm5+7Y?H0S%=tuPR4u^{hZ2nKYZzwRqUgU?l`=<DO*<%
z3)<*cET5}dMyi~aJZg=DKRB-OZ)#4Pz<&u#CoGsZtJc$D7HCQtkYfz)cGk90)Qx=N
ztVr7emo4E(+f-)g@66df*KZ<s8~n&kDX}~yV<*9VZP<=UtNN1fCA)tA^eoTOq+#d9
z+(1bwB^xUTXL4Q#)8%9tAS?dOZGUv8Fzl}&`#)zu({L#<dXG0W(~3&ao(Iy@)%T<5
z?eavb$V--2$b_<jv6$K+N#)Do0iu4}+sN(Ya>y40QR<i;sKp&lv#jOcY&f>rwD`o7
znAM)~@qJcLh+J$c&Rx6t40U$R`7Vfg@E`+vNU_2Wut`4(dgu}ip)iH~Em8Up6FZs>
zm~mQS=CYu@_Ke7R0)%*{O51r(Bk(N!-e|Ke3R;p?&|CghDFyFQIUGNWXo$6eSonMK
zqDR(hG6%h#G%xZBDao?57KNfxL+)<MxT$6FXPl-JAgJj$LL9WCZ>JJ?4`>xJq_`a;
zfK-MV4NzPyDC=6zO|vlk=M|Y3O+Q$!KOXA;y!p;8&Mjp#fkiC5RZ^~j{#GXHYmFa4
z@A(~k_V?Jb<gUBCXYa<G18t+<(zY^SM`nxR2au5kF{CgJ;xgHCL<o#t&=0dBWbvEs
z(l4fKm9#K5M&P~=PU@<!JsUg_=?j7D2cVgKPOo}?N`Z|b$E_;Q|9WyQ?p@>L9j1@g
z|HQoLs3uy0EL*+$-g8X?<hj=NCc^Fg$dJ0lTV?#xjQot|{0%4Ahs5r%hnmyiPA4Z&
zwXXh(&b)H|GcBe;=13=K$)^Wis#$7<O>w<T<w7h&aUI;v3g11YSd@OjUMTMchsNr+
zzYkRocXvW{W5ZkgpkFF!_-`}P1^@WY|HZyJmL`>NlBjXf<gDb+0U~CiendURyHyW%
zSx^arF7uit!hQV*t-7=tQz*0;8?1M!&0ffn;f>SHpAG6M@#xg1_s8$Rm-?6U`B>y$
z(A^{qih4tnV7w8&<deL1Y}sYzR#71m@X&ugKwBm#&==X`OcKVIBHTWCykDBX+lghj
z_K}v`PMb4TE#m?;rz-gxCIkw7P$IuYsg|TY_>I@$C);~JrT#m2hci1SalHv8mC<yu
z^lYezP@9`9eqIT9y)m^oAwnA$06Wc1UD3(E`X9>!|MOJu2cBa@h{AVO>eK3Z;Jm!H
zV9?Cf^J{Yo{kAO`X{hT|ll*XHQQxozf*(s4O0<m`Is=)fEeD%t$jU~FNXYSukKF;R
zp3vavV)Sv#G5l3gDO{MU^qH?}>q}P3%{ZTQwljd0t<~qnYCr$kE3?ph3KhdPDJH~@
z_oiWUFA-sIXZ&1Ac;)Vwv0kQn{L<4YkAm%dLfDk^>N9r>Qhs1D9BLMD`sGb5V|{HP
z-_xnykh6?{Fy(L4JqGPu03}VdDD3zt5Sr66EqgD1k2fMTvk<p?_s%C2dj(I@sSsMl
z&R-&a=&wS!+Vo@f=|wP=Xgp<-_2%WJuD^MPAApcT>-rmmJfg>(nwQ9Bo3Gc~Upjfo
zUiT&5@zq_KlbI2#C>)Dnu3*ipJ7agg>h4bYyM2*1=1llOCY-42d*4~5Jfi>{X!z@<
z$Yb$Os8>+Yp{z1-hD-()J{f^vX|0ut&jxeH<LW4Q=(AkDCpU16DoU7@vnk{z&2%R@
z86cxX-R3vqhmOB8courV@ep&L3GYW>ldK;n^{)O+-K0e6O<Vk&illo_41A|6a@SUw
zR#3d+*#!Cq=>lhF@fV#5?0#4D#jaXscSv|UcStaMY3}x~=EBUDMn<WvU0bt&EXW$b
z4v+R>x(Iu@fN1~n7yw$NTZ)~NfO);3TPkUb@$04w9hD|)&&{^L+Mxz39JaCC&WCE(
z+0cdjYuiQD|5x<mV$89)aI8{6j2e+LemS+LFPxfvx-OS_YsPS1ab9HxG;fKY+D2CR
zeV^9{KN2y;++nEH%@dVMal4PsF!+K^*9EQcGWycad2)u=ZGFkLOt@zXKNu<ccsfv@
zSxpDjx%gj@>A#&j2ctd2YULg0Hp1-<?`z&mb;7<x$hLUn7%D?tIhXeeihnyJwuZ%h
zOa1jz`75U>vlxmaBzmiJ&_#3EhfV!rR&GX$%oJ=~d5_fsR$~uR+Xw-(B|*Ch71->h
zXrzi9@4?qG>m+4b?&O3B!Yx$*&;3;b_}@K)31@7Yh~e`<29l@}u>)n{Vh}SRgF5ql
zGi5t@p(OFn9Ou9P7r+QGAV2w<(oSnq7#xaO0#5vvk$L{~63Z<WX0_8gkRe;w`p|PM
zYXN=7mDY+KnQt}VtuMH7GTi}$DRmKUb@Zd4(0<I+|4R<hfG)!0qerwy#x_Enstq9C
z4RHI(R+3^DX@xc(*-l$hm;=+$$fJAMyIW3x?e@!U9rvZ4wY_><_}lc&;?G$_f=gmf
z>UUE1=C&3yRMLN*(0{2!`b3|-wHvPDdpOMYgNHr_PCKFZe_;a<eZ7(9k3@J_Z36fu
zCgJ+!FMh;(iuzr=ECD&N%})n|ug(E*k%E%XEc4XC!eI2<(qAq-4;``<nnO~W6#24#
zq;o)ZO4N9R=L-DR6r2&_-U*KCW?`_1Ehyr2;9?@>fT3I*x}D{5KJ1^h_pC4-vsj;)
zWn>W+;B=D80*<s|4%g<RZRSfgup|Tznkm{rl28re#~K^n-=em5ur*hbrP_4a&ZnSS
zH8%5HzAVWYzzfQc<wXy1^3c!<2x7|YC|a!k({`1P_U{USfwQ4XwsHEJeHr4E3R&8T
z5HQ_^y_de>QpFno3y}N^$9<q}HP9kLJ~lnbbRzZ%QX|yPJ1hJYc1!d~f?n+q%hkSf
zeYd@Na&L*YKe3XO@8^ua?SCAu?s)C~<GjfsU0d4@mZ6g<#%znrwG|nuN?yFMUKs{i
zRqwfbj!v`<!S^~n%ePEppBesNg5soi``{KGku2g{b%$l@JyiqwQ?ux73Mn`FO7iER
zJawIZz$yRj?X(-16LO<i2VUwOfNlRUB^~gZ?|w#xTK{U8@-b*=VK2+D3)BVr#nWoE
z(z{)KQK0iK+bTC`o304j1KaAagnoCD#q&Sa`M=C6iSvWd+3<0jiUd*I4q`J!JZ-tx
zYRy#QA;o}gurz4-&71`BG|k;0ByGy=ywp8V*M`7sFV1CfhJF^FQxpm6cb78ey~ZSc
zTMxu&89}#X6k90&nU7N8gtb*q+1he!EZLZ~1R~#5wG42@pyU5pcRnf88-TBNfPy%y
z^(;a$+*R6IH=ScusgY~|-#fTD$vk0j4E47L+&nnnSF{~R=o3rX!XrNJ@eXGI&Xk*H
zP^=v!Vw9cJJwX{Ny=zvdbZW^-C|rzX7Y!8In8=ycZ<Pr49ixi~?tfKBb5<6$AM0Hh
zg$UxcMJqALjgnGj>)c-x?h_h%34aT3G~Zb4E#S7>4{_yVn7E^v)aTiKkiO%)urprD
z@%<@ElQ9RzvhS-&?7MXS><J@+j<y9+mw2~}cRS%mEgMza-}$MqsMFzly7peeUjEk_
z+W8Ocg?Jeor7OQ00|yeAVD!TD`j<cVo=fSqt6t`z{1j$w)r}kAq8%FYTT|K0Z~TZu
zOWk+I1o5Q7+Jkvqz~^QySLsiX2z*9~?zJz{im_JTvn9zbFFd+_1y&*P>zDp_2l{W4
z&I(CYs8>yl-?^)$Qq^((+}Eaix5_is=dOrhxBx_L+EGm3d)4}i`p|n7qA}xFN%;X+
z@$Etg*T6Fj8E;Z;wOIEr+_}b=Fpst$<>3oCF$&|cRLBwcV|HMEoL1q-!t0B<fSh6i
zto%Iti9tH1X(?REnY-Y&r}%eg4L88LsZo(wW0jxbSpF&mxIQdH{P(o}JLUR4B*`6P
zoD-M<TjQrM%?Mt4B_=%DsY)w~K7y$HKZLz^R8!m5J}ig=qEw|w2}MApgVaEx(glfv
zh)RioNC)WzQp5&GQ#uF)K|n-$?;WJ~-b*N<haO1s<=o#r=a%u_^Nq1a#vb`2*?aC;
zp82df=ekj#JmLB<L*F^_F}E)jaH14BuU?SWQz{3{2{D)ch>_Tojk;ZLAsV$wLt&k@
zd6_$HCTwU!`EY10_K>+_W3@%t`b>#;@Fy1jC@-Act0+<wJO&!s==0iag$L|>zahna
zd@PvVfgN_}aHe}QoEFtdF6Bu0|50BlO6CF_dgJoeUaVX6n2*$r{bH@9yIBF`#LROC
zeaUIcF__F(V;+cG1xQ+rI@-LWH#vFaq>Zs~@Zv?>8@t0?=%puI9FZuvNu8QZf3MHL
z2C<$g=tA)Uw2D?ae^2|MA3xN3d`J!0hm!rniQqJEJOh(s3TJNCN|3;#_}l-<#{5@M
zf51%!vj*)?6}6P~J!DY0gs`B(YC&Zk3xoHSBe8!()rZh;!8wUG-Sidu3xf(1&s}D<
z=d}+$Ks&}f?=?M<8lr^(@ALG>hYj_AR726f?-5<)qEd$Qm8SKCMP$zS+v;}Qg*!4D
zp5<GWJC)fYpd1CD8&XN}y2(X*ShtR7y3X(?G;5~f1^}wR@znL6{`EuQ9e1Z1<T@TS
zg2|xFDm7E@5=q3^{*r|*cK~uH2+%<TThDShfpm~jL~fW@Yo<8~0g6%H(7tBnWzG3C
zNPtQ}`K}u9Q<$%^8t@%X#>&xzzm&B~ru2A+Q3X5v1<QGE*8vV6xG2r@=HA(@=1j4`
zvH8f-?9r8Irts-QEG~-kda3VtAZ}$cM}%P<`9O<C?K0YJxY6xG+JACQ|0QGI*ERf7
z2Wf6Q;o_q-q`-QGQav8|p?0Sc$5DFyV$97fEn(wZz0Zu)cvzB<`3{SN0896=nBqmS
z!zH%+@ljr50#VnnKn^XM!N55##bFBH#1yU9Z|S9ZlQiIEdCk&DMxYCI-{N4;w=xL5
zY03>mD7mCQz;ksq6Y1dPrsOj(hv{UC#sz%P?MM!0ivfxkokpI<b>ij(9oFj@p2V6+
znm#gj8!vT_&jkIgvN&+~XK^>WCAmd^$0ab<zy8elafzG)DPm;o-f4>&e9RjXChqIp
z2l_m6d=79c#HZ17%8v|$l@E=F*Y+G2udCyRWkRn6O7~pbE9DDJYW*nVw0Z;dJG;ox
zE9Hr&{BbkD>4z-Hn(#0j;HU(@a^bMq+qj_M=DK$SzE&m`f3uqU_@@Jwp*e@kQ5)Ik
z7NEb0?>x$tAa{s8iMAdlc_n?#iDd*~S5G}@5`8-|M*)4smnr{pA@!ai^?z(x2l3a=
zUvarfp5L^rUMhWw^6p%v+8nun=_a|Tr@on@BCH}=zyv_q#^dKWjv^5P&V&CT8QO)>
zDq_M#b^`UDJ@Yo&#6N09M(uLfr_vNQd$;k}=^^_07}OFqW=;&FFfTUG$M<etc%HAn
z!H^&OyXi|ui9t;7_bUUXk)-D2<I+LN!{U|C3WDLQ#>l8z{?@zTDA&uv^jtS!oU3p2
z`@#x0+b4A<2Eq#84fIev3ZLWj+sEql57Glx@ukhC%0|YKx!|$>F!><};-g#{#Q@=s
zsS^nk{KTW`qr!W3BHlWh%G|JhE{kYd^2A3W<=t01!{2jhVU<v&gQ3q2U)Qwaoc~PY
z#_XAPEZl?)-cak)WUAOYmt<;Rtfdv;<=F64F*fFlD9;cuVWVVhXybC%Q?Tv5)^ow*
z`>ITv%f!liG#{Epy;h{=uxQCWam~EeF5G!<eR_R%M{-b^u)&giJExkKb?z3^3FP>p
zb~Q+8o!+9|Vxrx>5poMFNI5SR`i<MOSuMl{Za_crVicEmJW%@z2t-(}+%*$sE{XB9
zrMB(E{$^4CCO~y(`)=FLWJJ-jPF5MWH6nt)xp<JCl^awbZQh-`7(gDYG1l*#c4=wn
zBV*I&hQ*fwpPDg;@Wckz42Sl)4f>fz(A4EW_t@&6ygkPd`Gq$hM58T{aQ{|(Zg_8T
z{ACIn{@3W<EyScAE8i0nO3Fk5#yUhHqpC7i(XHD#0bPm))T~3-H*GSwXYp&3P6+~&
zXMTdTQ^ElX{a;GX($0Qx31MQo1jALkl3_HKPUKE&ZeyKiXgBmw`(=BV_^aI1_bxSP
z>nR!IXi9N;QBGPv>*nd9ml;J(_@h<A7?UCbQk*F6*Z>VZV{~?{ZA4fiucnOc1{b^j
zE_zV8$$5x9XAH=x`)Lk_%|v&0*07CwYdo$vTEHU%qzh}CrGRhCOztRTcKSIN|4gj4
zygMJTT#LBUH11~YF7S>`+}sp|#MxmM0fZMPW!^Q`!Gss&N<0IQ7cRD=4diPH>#dr3
z&VvtZi;{B~i3(5hSYQP%Ul#kPL#W5|*Pj=BNtWAYQ#$d+6|p=><?H#z!lp1_jILzG
z%bsPrpPLiDvs-ka(rM=^H_SET{p=AD$!V`ix9;KfT!am-ChXnKW%V~nSu`tJqKUfq
z(QgdEXpfa7mxmIy<;0u!UtXu&Vs#7xfa!7<<8gzDdJoT$M6q&ZZi2H?JT#;IPqVfa
z6Mc=XjaAp=fLoRO>jlT_IK#Spkh3%UWbDlV8tubM_bB(Kb+)uj6^zIQ<}dE|zgjGE
z$aKbTo933|J{8&v4rwh-sK4p8kEn=RPj0I4Kl@%t-pXo3xJUTye+OBWwey{WwNa30
zPde`DCI#ol%oWupczWrdZC#G8`YzU%1(^8ka$?}onyK$L4tfgt^g`fUVCZhB1$U_x
zt;Ih3IHR!F)ubf%J5qgPzttU}MoBY|0b~6fo4W!`A)(~C7k4s~3kj**7{P-(&;6Ws
zO3Vx0`WM{L)()NBqY@I(N_&fO?}j(LTR?}P`6~p9%2NpwL&YAmk`(xE#|6xEtn_zr
zUHNM=$0Gq#wE{rYS<|2}rO)``WUQdB>adV~VSh;J_^YpOnN8aU$h~!FG?ai_;q2a4
z)Cys-WUpACCVeM&5h%akQA|mt`+uG>hlhga`n2E(>dk%wbK?ud%kjd^&LZOS2h8uP
z=^|72ZaEA#JNMQ$e0{wWg;)cRx|YpSl!>ACs@Y;Wr+toab5>hQzgCdMeU@b7Ezj+=
z%F~nH9;NK+^-Yo~5|_5k;MBEI*qMt-&+}EQSmRL;t*e_m!!h)to+y#LS3HMN2gNH<
z+2o$Fvso14>$1-1d5YiP4*@ic5rHf82N7S!Twf#kmP{y%48u;&Qyl+TOn%6N+iCMC
zp~DIcwWIO2(|tQ51tc-{Ma$qPFtft~DsQjTy=Prf=&Nx+9<LQ#h)rFJm}z+mQPw6C
zHw#tGsopJ-%)>Z!w1NF5l%31<vq<~G`q+`VNb{nyicRhg2hs_&<Iz#|V&BT$vdRar
zcG1~~=J>{y7yxk&)#)&E+~c<6<ZRO3X7phth)(hhF+JyIS=Menb~C<!#z)mRsZ>*(
zsY_0|T|pzPymPu^5DTw{XC|%7Vg_(6q%+5(3fVd>c@U-Px@j*WHMw^fRt{mcq6^ZS
zL{=dgyr=A7u%20h+Pu5jvvvX<3U&7+)41ApgHSRnk1>#sOlm+rb_-@KaMn!MFQj)i
zEWAeSKhL>e98h&5y#_{jV$|ks5Ob<-V^Z;OVt%r4x4>w$RTDB^{yl2bp*!sNaPC7A
z`x}{$JcWJoLh0x8muR@}jC$2ml*kub@J>V)4jOZ?LFWp-@$j)CO=eq1GJ@+s;9Eys
zn|Ts>Q`Vjpr=<=Z-DM`GVYAj>3rE8yV`u4M4wX`7ydU!_m$A5A-6x)H`xEWDb-z{<
zJrA&jBy6X!OL6>D=UXqOUaM|CLzyI>4K>h*KH#oR*DVv5BxNeZf`Qnv_2O({l}%bq
zMK657^SW%qpJ>ogpXRvlx7sUF@%T}!aC_0>>VeD2s2jO6CR&)A6d1OI*qsGus%%N3
zpND~#DF#jR<$bWS#8UWn)oemW=1zohb*)6=XpAs;ixd^W<(G%6fS{^Xwt`S*$IFIL
zB2J|D=IqG`$)iC3v@r`K0zo<36mE+jN_vBETbSmfnyT3w7#Q!lhPj@5G(xmG?JrDq
z%wOx5s7tLdd**EFeM6rlvPDhK&gb7>MfV|MASzpY)@a0$DC+c#t#{~UcE9e$cbhk!
z<}yerRIDXqS|m|su<2}bQ=YvYt4;v`+(YXUm@F3K+)8YR+kOrGS1%O|ZTKzGC#HtA
z`zMB#ulFimof3d^^(LML(8JWa_1`bnNt@7_=Ud)GUoaF$6@KKOgBpb8xz}50O$}qe
z%koN1DlIU4vL8f~P9<Dm*(R|oH9OXrE2RDK1NU+h*nZQNi8DM>wPO*zzh7(D!AU`(
z16}DKNw4~t_3rmJ%4=0HWYUXpHe0uPZ5lkzL#zj9yKmOqY9LkM3XN-A%L{(Gpm8)5
z=4|~uX$cRMM_0h}*G-5l=7z*U4c1E6vrMjx^R4s^0Ig1xfu{Co04g1FEN~IDLCzw+
z&vJye%H0uO`)Q>tNTI9xG7ogZLj^;S!7#_U0XAjCLZ`n0q^%#u7<t}r(WI22*}F{o
z1aHJa?14BJ9wy+E=L~vsa_OH}mvWUhr4}BgmRN6dIvPrt7yU}~8vj|SEBL03ws{Bt
zThL)724GrRDQ4pNVB8DA<+$J^FDP?d(d+kU+z)Ny0qypk4FH*$9~82&dR;1VIM#u{
zo{W3f5jp`_R3CVMds_s3+9lk|@7F~DOl{Vd?`|oGfPtsKaA9S&xo4}?nX$mB-5uPo
zmD>EoV<JlYNa^sdbsd30Y$eh26>N~x{8<lZFEc5RbLRCZZmDu|xzE1p)n)>2(*<6$
zg@>sfm4GJeits>u9CeHfYOk*IJkMER?lb{#w&T_dR{hCE`a$hc^>s3=py-HuoA~f#
zNEl?`HA~2_uCngzaKNHOY&cm+<1g77Ews3vN&Kqv2kq3NoXld_YL|ws`%^VA8j?O<
z4J3EsmPXPh)+oCJm5h(al`7Q9S3St!i@Epzs=pjVX?D)Ft7TOA^CkD`u=cV=rfr|T
zDRdmC$8@{+4DW#amN~$=RerNilaEL>)rq)x2)!9{5mjrj-7Y+8cHdhPg+!lTIq<G(
zL&wxO*LuU|XH~7rU)6_MCGIOc+_}Q%^|deqwhpe#5XfmQ33hg-dd}}Q;C>GnNc(=z
zPNL#u<}~J1b;kljdd!SFVmr%~B{cygHb&k7PL@{IbNd*s^`zw(oe77Il`0lj#^Z7b
zdM7QqtmK#%6XV{)1IKVN9~bIM=0HVeogG<{uhrr)l3t{<_-(mK<?0qBwFmGFx;wxY
zwN2Xgp7?2j#B^N4>~ABgO!wQsQJh=8Y2QHc?M!dZEu)np0;Ae>FZV75xtOV7g2E+M
z2#2Fdv{gE&lRfk>Yz7^V&a&QLfA<EhLvpu}&|L9PBE6Q?HyL%wyHd4@+TC;S)B+vP
z%xCl0!Y5Wbp(@0@%2C;zU!%`o2H!iE%cMWR5F=A9NV#&eY|Zb*ugJmoESu#z*B^gV
zr8dp@gIpBDei>m!J|-4r|3cZmqvr#`7Sjas>PCb;leA}^x5nL}@m#W7ePLhfu5E9#
zan38E#)}o@F`)l>KxA@cBVW%P2tTMphXe30(V@CO!3&YXAlO+>*@hw3c>mU~?K3hT
z)G6rDsp@6=*eiDiP!8`4HIy(jipe>we!4AX)<l<AUg(%r_MUJE%;)kPTIIXo=3`JH
zk9@r~)QhN`+Ujen^j6qCXqzQ28(Zhq9Es#*L#yzuC{zhZMYTx40ZsOKvB45}wG*#t
z>A_3EWj3Tu@X)jjX<}G)$s$}L558&AxyVCE2@9OI>irrmta7r3i6rgL<AU%r^TNbo
z+0JZxf@^p+>RE-QHS9rXlksm5e8F#BB1z-GtR`ICZ*-ay;x}Lwun9T-O3FLkCQ4#0
z=bMk}s#NMg=L!R@sPCSJNuQRyZfLwWrA3~0hKa2^ex^0nBcDM!!5eqX*3JoH`he3F
zaO@%=*9mFPb228pnyc$Q>2#Efy2|5s7TIAD0C;A;e`XV_>Rf7!xN~-jTf|2jdf(P_
zi2J9>Q2FQ3_!HFxs=|&1_YR`J4vos6ZEVPXe3_5rjrWOe?ok*^H-+~DfCqZp;!A*8
zo3s5k%ow#wG4UP#AGPRNq?bHr=M$3J5GO}Rwb_%=UF)e{&ugnyjyND#qBNlmZ2q+N
z1PtB$nyJD-b%X19s%!3Y#P4L2O)%Fh`_6TcBH+fmk}7h)YE>w`0$G$f35=}a4zdJm
z!JyjXlip#M!<sBV@g^d<9fGf{O0BFS6%d<*KLTOn8pF(A){g!n+8z}e*JYgzb`rn&
zJ$dMI33frJ2ELM1HQGRKJ1)fKxWK#r2qnC0lX=St`<36rPLL87X<r&wJgb0HS+(>#
zzvpdS%mzXO>dXD4&|gU}1(?yhia?JdMDAJB{-&qZV^Mg9P4aFeo*_l|xhKwwakWmO
z5fH~|RhgBw#Gy0KG0(+!ab5v-MCVJ73Z&4F^!3rhaqavRw+IFVnw~)RjN}{xAn&gN
zCq7>%&s%NICkDQ|;xyq?GPb4z{Pr$q?rK4r;-if~YaL4itfLhNd6v-CBwmd!Afv&=
zxvK;CLOt-RLmk7hTguRvQ50L<md_jZ8D1q@3j*9>yB7WkA>J&n+wll^<pr=(m(3IS
z5oLg4+<LJwVo1#QvZ$D+tgOY*l1iRDw|qM7D8c}?84XAc6#**}sxY`tiOrdI?+G>%
zbOm3I2dE<B=9^LEp(Al1Oc8p+>v*OLd94US1KuF1lrsNV8JTW+$E}P$9t-IB;$3H4
zL2mPS=JWcVzS0THhXB#{d2eg>qg})TM)Pc3&s$JaLphXB3`zaNd*+hn(1uX;lchGW
z!3-(c+e?F7M+r?lEwV(7pHvx6&j;sEzVoKzUwQls-rXdN9ldCCeGr1erRCO%J)hl;
z8TEETdC$01dWVKi8r2yRDBce{Jc-@(9{UDQCsIctfBneQ4*HX=8k=Bxt(C7>Zsh}_
zN^#P0DPPaELS5ci2*!?%{>YoX9l^MD)rz=LIT>2z9bj&Rs$PwjB%C^L?ylDPSe~>Q
z6Wo>N?ZTm%7f4)S;unSubIE#e+DU*M=`wN|3aATnx*91^U*WG;*kqh1&avUF9!R%e
zlw>#!bKRW-T)@lJd?%JqNhoyXKHM#rH<Z_{UIjo+cuvcO*^qZOGQlSn(;WD(p7(g3
zp*f${omR%4m=`H7wXK*F@MYdhd){?>p`Mm0$DNrfMZjP1O;PAn&GwMnfG5+O@7^$_
z_{n71QbKdgx`zSmv<k98gNGnDnhwxj;Dq958_WK0W-qQP%on|sSdIoPoouvrcMo-I
z(i{<R=OfyN*9qb-aL>A17!JnIR9lfvvT-iA>`(OZYCJrV)89V(xP8H)aX(9bX1AHU
z#d#I`pBe3kn)mm}$R7)`!VETt$-^J+KCd0Boyc7us(0Lp)#SP@1G#_RpjnwaO+f0v
z<2iXtPxT&mz&RxvgLA22Do#u|Ck`{tSY>sTxZTtVyO#5ngkQ6>o7k`yf%9MqQ-dud
z@5_>Ts^vBhwx3NCdNI0}ns>xs9aB^u1ec$bS;k7L?<lP#KAXYEtdSl}KGyUu`Z`@L
z_Dh%!2s5d;JN;qs5)?gU)mwv=n3lshZR3wDu92=Rts65pN^D8Zi3<J>UC-uXb(U4M
zhPc%B91sSnp_`TC=6<o{O5L*_uPKIFk86e~pOOn;X8-E5mR`Wt%t?DVO3M0ChojX3
zx6N+`2x+E|s8w`U&y&|Xr~0;<?TY_<BnC`G5Gn^>II0P^|D|=G7(Z9<c`{v23ecga
zy}+Xn+fi@pNgLNzoq)QYV5aq7;Bt19Z!UcjT_z?4IjwIq+>x)zC7$=)Opu!f7oObB
zDy!Z@VCqd~eom@R;e~n`+A6~44xXcr!x@Inf=@l`tnz;nZF?qX_7m*3g*M9|Fl9>k
zGBXSOFfwq3<uF2TNomI#nJC#qr@*woUPdM_d}n@D$yU3>;y&`d&Ni7Xt=?(Llj!|H
z(w;YR-RMCqyAx~u&_}Z>>+OSyd!bFFqYB8CI@)~D=thFC(_Uyxo9db!#sPXVFa|)s
zT5Qt-pAokLy67u5zhQJxgf6_ETO<xOOE|P6=vcftH=5(_jmq`nX&Z33cJIr&n?Xe{
zn#-JCWpxfWdZ4=5n+v{w@h)JzoTlqG1b4!ReDxhW!IQ$7>EhJo9=dlcGjC*lTlau)
z`bC`CKg>AsI>$@;DS?2cTSm^#WGafx;2%FwuZ^gFDK;hOi!jgvPNbFP?CMaz97w5!
z<_;(Q5FXa*T)AE+o57MZ=IU{=h@xjg<$&su<9e9sJHuJ}A>aMt%p~sbV5eFDi=P#9
zU8n`TZD_=3upI+4mXJI$R~g&%+iqF(zKf%uAC!FdsK+F~m<x0eHZNfBtIqc7nP6yM
zqRQNp7boQLK2vo_tb2zc`f%z&#MR|#{f!w6HSgIiOxQsQJ!0PTO7&4tk`e?lVD)hr
zj)<hrQ)A#vq@bR`&Eck97>I_w@7UbtKd=q4c)fnUg{r^Xq`?VW@?Ig7Iu->EmYYkJ
zNEWrrCga$qs|fkuAmr99E1Q|pujHYcknz3FrH&kWQ1gcJTC`_C{~r3ZSYmnJyVgPJ
zTdm=abQ{5X-pu;1A}AA4N@gTsS8e&ENlnEAKi8fs@cUwWEfUyKZG+pv>(ABZpTFuB
zdwOcxD4OTPef6*dvJMV~rPn7Ppy#UfErsR*J&df|S$V_0z0@G{x{<T$EjeaM7>2VW
zjmH;FX2cdpTV+ospC2$^ij2@;)*CzOW#~nZ=bt&Lx;W=|UI8)}nlTK#iuK(xeNCLJ
zX)HP!dycL59pHWwdB&nOwdEBK7J;5(V?Wk$Hm=lff2t-m39}`ON@UMIRCj(1?QGp9
z?`4)qmf0O8R322kI(ahxVEt9JarJWdbWwZx=<l6h^`4#C{9ZYnPkDA%7u9GOz5uMt
zU&W&<E}F=UIk>-6`t52~>P7JFB+p)OsMsF}?)-@div8v|_?iG9?9|1s456xPh{KZH
zwJT<)-#Nq1q0`;-&<^X->rl?EVM1>N?gnL6ugg~TK`7~V5X>=yajeVhVs9(BQ0?hV
zF$TcrZrjGMhcw_m)VnyOMw~kj#2wf7c#ReB_M5aOo3-LIb3DiRjvMvC-<!*jW93-o
zZ~kFj!1@u6){#izK#V-Q=W!FYd|=Y;o;$$RtDyXJeN?fU7Kco{a<lIl2l_GT@cbmK
zb3!Ayv%hmB<{g`p3CQyq;cmrN3GaI4JoPFPHZF%LF43(zx~z6dYeeJCD9G_Xc^)~E
zknI+r#vu6z6Qpbz19+x{tv%W{pRTV$z))MA=45X>J97|2#;eiEPl!cZKFba-7<^X+
zsz|M~2V1D;q)wCet&hCRNeH$fz<zmZZRR#pIMUSrA%=S4DLc-JK3sW=b~^8h`}z56
zS5?jsWR^nATV<oi>4yZ$Xu6=O#|qz}HUS}1dp*77-n3<*Hk^Yf_|kcDk9N;3@2ZuW
z^{O|hhdNt(>&9xC+orY%)us9HwHf!rGEeU&hB{K6*(~ay6I~|sSHtqyPsTSlR>A6*
z&UtF<Zk)WnG(Y$5$DtE`+67glLX<?0)LefHxL`<MN2aP6u&U*d!)LP@;OrwGWMYix
z#~aP^a&?<tlRbD(*V?zlKghJRy>;_(f|NvF#13~O>KTe<epz8wVf&kte=_g(3aF<T
za@%4uS+=yl&2go>VkL39rVd9Y6SH^DYjxzfxL0irQ=05CbOe3Ks>*4r0YBz6bQI<z
z<l6)sHhuu%=v5qxx>M;<GaSFT%+N|cAGq@z3`dR<(h0yBJif7vWRCx&5VbN=q71~_
zFfX4sr(lZ@d-L6bbbbH2b#5j-@a2Fz<)m>9(P=vSTpbPyO&Mz+j!v1iIOXnG5Y)v%
z<nNAa+mX2IiHjq>UA=u3BfW9GvF8hYA}Z#Og^8Zy4ta=6RV0|k%a<}#aI@x@Bcpl4
zS7!&v6+Iz(`-~MsS+ePaZV5~C;#q3i2f`w{@#lffrR21c(j=T=LG4y}a2|MKLU_@5
z*rVacwJRo12E$6dmWC&FJn(7nmc*?l0W{nt;xNlx2;6es1SK~~G1RK1P@rNpK8yi)
zKQjxP@_H~1>u+?Mx>71~x>1fO<Ma^{J{=iV|Mj#YwR({uyHheZ;Y3Kq@HFSHqzF9N
zgsX4!YAvX(%kQg1-Pr)HwTx(@L}rMiwh=2|F=+E$227y9w)xCy10;s6di5Gc7phX?
zCv04YCYjeIcn$>282d=!=TM0TTcnhLXz$w1&_S=sKhpdtVU@MD=~1z9)h-6j{OmYm
z-TXl>%%^Jysz{e#+w6W1POK1PehsrKh}M>KRet*L*{XFvg7c%9{lg<x<Yi0dcqctQ
zXGv81UgrnTSSBbPAz*@GMmS{Xr{@wFYuw%QQ?dg!Sp|AX#E_8Rk?H#Zm_f9n9e35u
zKgmBTe}gc^g~0i(8@qGgBB>t*Uf_9X6H(N2rgQRyK%rRsv7?Ii%jC>fA1)s+Pz=D=
z*Lh-q+{jqB#@Xup&hXQ{=)u}PME1&jI6l~Uy58lI$~R<AB0yn*2NbDtY!QBoOx0)-
zR<@5Sxzo=ca;(#PmG7oKJ}Uysa8Q1}^qH<GsQG(Uzg}C(mmloL0rdA4-T{0du=|8t
zc;qQyEPm5#ak_I5O*q4!Zxr^-<B!kU9Qi@*K$AKiRspI5Ig{!4*h+wN6@sv9|8lK#
zGNx^GJq%#^N{yy*eI-nJnc|>K8`K|7D5@P5+k`#w(J&ij3HKx@@@-KZXl-qg<^p23
z_mNV5iG-2woLU!Up+)Y+f-Fh^73lK2-W3QzPiboxk_&8dnUZ@~jr!dLn63dU&z8qA
zL`06`ly>9qpB;Li7|xnc!ZW(4OZlAE+cZ=Ui3}p%xwA_!qC0w`#@R0MfyY-cW!Klx
zdL{my5E-G@Uw(VGqdLAZ$Epm3Lr6=|O@(*!`KCo_n=NJ*ScXt;-doqn_3UkRN+L~<
z>E0)$@w8s&#Pa!F(dPl~4@I^yaLdNH{<QxgkjDc=Tn8k*c@fMrU5&}`RM?4K-}XBD
zHGbe%q~Xvh;5CzBTKekQ$%1uu#}%xoKx=yrmZ6itKl`1N`ax#o)!JGpV3&ZWpKSvz
zkZiV9<~GHC9;njV?MG<S34RN>UYT<B+J(Ch?_AY*l=qbJ(c@;yz)No1(OwmAEvs&&
zETDx_ZZmzJ`RYM)<Gub(3d*&UURl37=qr>B+Win@jgIi%Jv~$?de!}WPZhYdRBh9<
zp*k3#y0g|fb}iOCQ37OEwLF@$kUMi!<7fG4{sX$worjHIN=t6&^mhL#2?0@DKdQT=
z+s1$t4c`l$X`n{PZ1T@-NcL<*PWw#D$(1bC?Noz>DZGY$v;+%?-)>E^lEBH?|C+Y>
zL;(Tq`Y5i-o~FyWO|>K{6%E4t6Z}?V86L~#tF8SOpuf@-5Ux%7d;qyiciTDc4J~<z
zrBdySW=?g=`|hv4UXHiPaFJrVT5J{MqH^%S2Btp)KBU%quU1P;dc6#l2qMLCGoz+`
zeDMc36PH@P53aX|4}lw8`rw22mB7du<Y~@McODYN<+@a0K|20=e{Z>m4gyJH4kK<^
zcrNNFFLR52L>vNnxz0`?->;tm{h<!TL0D`{9)S<}6R(qmj5AAEjeUDZtE%h96K$&H
zULBiz>RKl^eP@(xKAh~OD*80qxhfnltRYB~Eh{avKG}qj5KDjO{hJhFFOO#<!x?5(
zvE{{kk?#H{udx80lbqC^WfMo17_(Ou`+VIWWaTSyBu5Z>TR2R4!C}7mm_r!Odt)}>
z1vO%=ZzsMNrG$La(YH@%>{c*iLvq&z6d2L$kP^w0{lgx?ncoI2Y;SIjRk&JRsVYRd
zFT?B%837}RMNi`ZbP{fMT4%jtlkrX$X4_~+Z6dT9^=ZDB(jCbBUTF)n9sr2<B9aaY
z*X^IUuEv5{luyM{5@>^8WWr6G&y7om^aOeZwYG0TJT%wBkEOPb`{eqy`UUKCw}-+k
z@y+)qhg2&gzMO|{wP_)6Ut+m_N=`>6{_IrLg!5#=jwAVgE@v#<YUGdmP8+fk{37?$
zB}P!lQ=F7O558DhT+eCQviU{V;KaUEi0c>K^)v_<VmOoB+n!f8DIF&FGTN+e7f>(B
zK+B>jrVZdJ^DylWh!s4@f8Da~ejXrW;}CWS#q{A>N%Pzpt$p(xJY{G(bJx0{?CQY0
zVw?7DtFuqBJqpgRcnY{x4Q+ZqkKVgo8vhUFBJ0=t8@N*8K5?EF#SoWUOl*vy?gigu
zk!16@Buv_Gn~!1%r_*hPs!5^<;8TXWFq=qXsiGe)<|b~VsI5oNPFR&_dpxiL;yJd!
zy*-B70Q-+asCsC6HoHhbfiuA^<s>#z_h5hCw-xuPT*kiBX&wezdKyNVAZF~!Q4db!
z@U1(Ey&UUw|6x}uG62z2BS6N<%AeZXBuJ+k{tn|e@!f%>5lIrteKe`;qpCN;7?f_S
zutyTp(%-1ud(vWh-Er=?8B}$xwyBQTlDeshpk%&sK#C1x;H^v}0oHA@w=sULvn_y*
z*SlZS;M>E$`@siA<C8QLGe9C>h2Xf47;@QN?Y-ycd7PMXv|X;@*L0|G=MMktXI#!N
z>~+<CYH4bt)UCdUW(3`QtKa^N?>OD%J}F9DPs}N_jZDd**U<xJ6_Hwan`G#LAknQY
z^Xag$s++VvG^UKM-{{?QMg-+vOTMl69l9Iz=nx+auX#(L1^xY>t-JlLd5X((i;Y@P
zhIIT=pXtI-Sa-2GW^P8H^wHEo=cLbcc2QGEi{|_37>*d$a);_YZPF*;M?f;ShSh@O
z6{g=B^Jd<YvZhSE81Bm>GxW0!JC4YUEK(HzSpFZVl<`6=Ogi_}l;~ZbR^4NJl|6e;
z`(|*%r=_xx>jh^DU#<s9w(;su`UccDPy-UFf?pB!ZdXRULe9<F_B1e$#?KA1^geSL
z)JcO?ost~WJh_bdK9gQZ&T>p~!WHlJja;XMCuv+Ana$fIyw(CXJ~I*}I@@*+R^5j%
z{@~%@Gkc^gh)=srFjN-wF4hfUpGXiud-R+o2bUf*!K5*ZJ>X;Zrj7%QK=?9qlORGK
ztp>NanNVS8aqDLzE;6tbKP8QOm<V#07QaW=Abhj=X6(XV%Rp<O&5DaTWDj>X!Trm$
z>%n448**+dS)9Y03JUlz9~%%t1Jt<d^PzkoDTasD>yw=e!d;#DV_Vza`znXt?p{E8
z)i{0y9@OZNXQ-4|hsqtumid1YBY*lY)9i$1BCl~2+?@^Nmw#dXrMzMzj7N{^%;uZt
zwooHu)wwFmu97Pt$}`naKCYkLv!i&R-;U~T>YjRa0R9{2wj?5mR1B*-AteA83P=*p
z)96rQt!%maJ-oog_uJb05c*HUkmYn^doI;Ty3ng=d_nxa!Sa05?H)5<5v1kS%(LU5
zv|3QPSZ~wQ<nWU&K}{!o^9@nDMk<TvG%QA@A2>RP?}v73CBm14g+ZYXe8)o>`ZLsA
z{F3gtf-eQVT&>0OTNU9d?6tVPbpIan+S8Fji`e;VkGx~&4;ZL;YF>DiqwpI$dh8sf
zX7*2?Ivl_Cn3WfV@^1+tvx{Ur+W=?<u_+aAb)OeJ;flvs9>sOOq7-`Z&-E_o+^i`-
zX!lB{7u{a>kGeH3z3oD@bqeF>b2s|)MAwA^oL)2aq3Ng^OvSiNAr-dZD^T|XklNe4
zHarExw$gSDX_hP!CT_O=%1>r_k5y$T&6v6$Ro?L4zh8WxeC$HpzE)UdJ%meI**(&g
z!-_d>_sjV!MoJuppw`D<s|TK6GZ_KL2iwuZ$^$z`8LONw7>XzIC*0v2Oce<c$+|SJ
z)}o#zq>04cWb?Mf1*CVU3i8PIz)#wnK7=P2+~33Zn}y8xuFH-To5@jc!oHOVUk(o?
zpQb`s{<V{brS5ZLYngxLxXZ^&Yk{q9X{>N(V~AW)P^gQ49wzsfl2EYNa#IA?<ydXr
z7wTi8Al>rO@?f2oCRIGWJ>y3O4XPzpR@;(C6YNH%3kdXa2o4RzY~5^N>o&0bwGY7$
zNHgJ!v)RDA`xUx$(dArbcIF_cT)&Q;RaY8Fsr-it6T7H%@vhZWd)rxK2UZ|>c;R-u
zrJjMs84j}`c429h|F^~!@q5UHa?NI4O*EXmg_@=`l-ZpgXR7i9v6Ud32L#+=+oPgw
zni`jzN|vhjQW3J$hXYYO;5W|Uf<93_p#kMEXAK{a%^`CV<n{YMP{#kg?zpggCTb^{
zlA@r>B8%E^+qk&fIukVSC)RW?e`Lsc%rCv$6@Alm1ibk0C$uM9aSMb06n!V&A$>`g
zPCFE<3%bi7^vy_TXR&EVS}QoESIyS+!ZUVh6{+10j;|laemz|X%<Sdvk5gJ|Z7Y|^
z(SZeJ<|tU$LX!DHZcfEZRlA<Os1P}T#0Pd>^5<?CWV?K&tl5gMe8#*!ZA`D8>VGXf
zEd>>DEp|2BHjMpxx`(dicjH?htEiyMo!_l*2_w{BY<09Hov|Y=(}N<|4AIh-t1GSr
zUp@NaX2(}`t3r9Zcr(<eq|XxKgdeL&f3n_f){Zi|?0weJq!>KX7%z-o#`bVw_yVZr
z#>7JKrb`XBkyULuOcv!esVlwaDpNckUVQx@0woLjPTh^q4sj=x{ha-xCp*%X-<?`t
z$*iGqETTDA0Zwi&LcXYZ+o40UYPXK1mYFlTTL!>#3VC@xIUkTR?}w*oc$r#?6(`tf
zpQT)4%+{E<;#(SQw3NMTp%*LwntheD@;wL79FUg%TlXvec`P=Y=it%vH8$yKRT=(e
z`%yQGxRk@NNFRRWL#~3jmbv#0l7E@@e_!-%(>w-0&h2Aeq;z+>&1U%wXk{BUpt$BP
z4Q6}0CaRCm?4ihjn7iGCII>o7w6P0FjB4$QqTgE|R5)x78CPx5TU-=*vqrJH$2g@U
zG#~rYw|-2owVbt{JtGmjIB43+7!;p*_GvH<*S~VlOz>iz7o9`*l7-l`AMSTxTv4vh
z27(_cHT68WTlBpJZ3E=^-2&FFXz+i(bryeYK*w4L^tPs57@k)t#v~2=<kU8X-5n<n
zdT)9*V9b#j-anFIw(vWryYOf4b@oW6cM|talLK6HV!dFOp^wBo7wB}{tRh%{T#(X#
z6e4{s=0`9zIOBnsYe*3<`9*i`tv2|uw=6MeepSN2s_!l>M`R`A#VZ8P-1r#t<UE}1
z%f9Ca|KFzc4-@nFddD;1b*_7=?0w$WywZJ0Yro7|8W~PB=Xp5_A)>0@n}w!%M#zq;
z#<wZ9niUMiLKDOgc3DgHL%r+9nhV))mw0LBjWq9BM#bH`bzdyQr=h-A<5vj#GHr;P
zOs>z?aZq}ww3hpY(lmTW%TzUp5R>42q3mi|@LzE6zwho&8SP_l8eQWk%`EO}Yl7i|
zglD?NVJT5Z+%DyLCVVx+^g4M?eDm<N_e|!3S7qZtnw)j&CTF+mlLA^Zm74A7y<4Ld
z<PE?2m^ClC2R(wqzUIz;wV^4x^Is-#$AQ)qd4kCiU$w8fU%zdWx8MYGt3!)x&17F7
zAP;Yu3vbU-U5p}fJh~sCfzp6P&&M9#f`;A+X0a&aQjbvK=#Y(7e-ZWinzckm<Nmd5
zX_3*X_F!o={1`i|^}$#lD<ZrH{5AVY_Wj~@$NyI4Kcg4<`*-i|7~-wqFYTfcsi={x
z@SaaPbvgS#^JoexvhrGV6T1QT7o@yf<+MJW6WV13IAI3)<C@_3VmUTIhR?9Du=Ktl
zy~1;_e!>5g=pQz&MwKuO01klrjr>eVQLLTh22le@ELJuq#DA*T=Rsdw#6so+{-Dwh
zz5=!v%x-p~v8-x|&1NO-LG_d7h+*5x+VGIT$4-Cq97)VSkUvZzShQ`bZAwiBs&#5W
zFH3{lE_YuV|3Sw#T7bdet?7@JHs@)$uw;P9qA;7c+5TQqOMyvOTK7WnQ&tW0?sQ1i
z<x5b31FNSUs=Zp8ZyNtC(Es;e_i_ATU2>`5RKvq`;<znh-zc~7sfY88h;tz~b*0YP
zF7_^7%N8GM=0E4o)X5ESy>(yW#8MU`ARK$vk$KYfNPppXfahbhVmG7#DgAGu^q*+;
zuW$UrXvhkwkP1F5A&xr|77Cd3-4`vG45V8b-&z-QsO7gXz7}Ma4F|b@YztPLIDVSQ
zyL=F6;ay-a6*D@jrs3V8#>IA0@DY3ZJMfZNUBds0ZEt8j^inF-%0&p$uQqfDEZxPK
zSl!-eVge6{%~nGV)ckBhg)#Or6T85d9-53^OX+SyzRgRo^zIe7U5Z&|jvN)Pv*Zx)
zHatMQq#FA>jl05Zdmj~|RF#Ihf4U^Gu8+9=%&u~3{Bdx`^SEYXrK>4G+VUG?3%zV@
z?6qeGVih8q)!4pQi2;@&u#kCU`jZNl$!WawhwlIB_{d@KI)C4NLQ&>{aq*MeMiOhk
z23`#|je4X~KZ?1-%1_QFt&Z2+F*bybOxV74f*Jr^@#d#eLHq<4;87lEugVa8CjV#F
z@Yj3zw+q|%Z#+8v$>uT$?KeE&lI!hK!+hiocC}${RS#-7j?y!U72L9qm85&fvup{Y
zw`UeePf`(BXyKA*k;(PNb+QEvNLaN-2LNMn&96FIrvFCGUQmWI-f?g46Cbw=o(a?m
z7}_#{+s0R}>T+WAdA63?J$uF;DD6rcXDAJ&UEE_gPQ+>%e@j~~*%eJbNzj^U?0751
zvj65%bHMy)YPl|am@8Do{6di7We^V)+HJ|<p(&UC;#4%`USX@E=`+S+`4(oi96sVh
zrH8j|tXf0toZqHB_zPF0T%bC0iDJFuMf<04{52BZkZO$f4t1;4y@%Q_GQUl~D@2eE
zOEc*SV=GvVwr2^K9F^<D3nLa@{>%m<CkDV3qFT9iKUo*;Wg!mVlf>ApTyMh6-{{1B
zdc+6_5<F~ubv<@W7x2*c>9S>)g@TkOPYBRhg4tnysG--)*c<>rs4^Zzqwx)ZTht#~
zop4L-q13>Ef2qQA^?H(~9g}VBUnceRCGGL7iJVK#zSeuQU%$Zjg&*LpxMJmX#PGri
zH@!LbqFD&c0@O}x=nyNIn9_HYy{UU(I%pAwm>6)B(>hXo9RK<HaIDHx%L1YNH!2mZ
zO=eEZeIu5FI89?;_Jj7UYFJNo?R&G9-F(<Dd$-YQ--E^czg5lz{=Of?o88RZMP>Vt
zob+U3{HSnP?QJ6-MHk^+)=a$)xl1KNGXB9YO$${%mVT0k6fCh&bz3F+utLmR*94AZ
z)>j;OCGr4OE!QV=wgm+0U&{WQa{ib9Sf!*`i`>M9OWU}tp@$rckrMcUR}$+Hxtw3G
ziPHV@l@h#p6rWz8!f{U`IFhmJDUX(G2t01VPL@H9S7NktFFoZrwR*n<iRoN4ObicU
zl%M^VLj0u}e_mYY?TaF^?=j7C;)P+rVQ}`rHDSWFZllWVt^N`z3v4r6*7#K`nOLE|
z*4__~)Gw^c#+ua@!Y?<(z^0gx7ia*mA9qa-)@0GarTFI87TrU6T|3$T8#?~OWr^ag
zpk&Iy_!;%}Y%0rSjm`ZbxujK#x9?3=siaN!D`MMp?lX0#qoD;~m+knjH$hBVQ={Kq
zhauFLwuX$a{N3Z|rAYW+h~BfIP9?S{tgq!cC9`~!Q=ob-v^eSveLqq7nw+bQ=6+&)
zC!$aM<V|j2psfiR6iTkx&l2&ED|M594$jLe9bp+9zs@J+JXNmQ$Yu4f%u%S1-hT^u
zuZ*NRLjSbtUqVf}OF4aVH1>I7&n6v`D&3P6liA&Bw6CRyuq<JUan&Om(}ZnuM`T%i
zr_cEJU;_ato$Jsj*RWB@ZS&C1-s<AOq2K0FcO--snmpPRswX7Rr<_})>1dYfIlo{P
zQhLX3erdS62OFt%P>~IC!r6xowb?jC)EC<gCM3?k{?oGmP$-%Z4%rN?JIAwDs&D&s
z{z@)b?^3EBY!?LT;{~p#QJJlUPiTu0n9Nv`A{8fWqsBITFz(+?u*q+KN*~;QRBS{h
z{}MaW4<152jSR1g65u?<mw`nUU!oQ+WpuxM@InQuzQL;TEak<VaEyxBCzXBjp~Z0%
zT`hqPahWA+7VL`y_}?w;uFcuxrVU|~b*%SBwBw?<mn7`slOtl41ou<AL;HUT?@vYi
z=gp>|S^nT%$isEN$onq-^7*FW77NHRz-M|9nS(WN5h72DF}(*5)^exX1qhMH@Y-dp
zzJANk+J*M?go5~xg2o$_9e4RT{7)=z-aPl5x8V3?vnciMEzQgBKQdjr1vFi|`kUq=
z$AX~;WEbpeuVwr^&+WC#sMwFv;MVj1jTrs{UHRI~|6qfpM*%J836ZX}1yj;%=mY_P
zw}<{&rKl#tsjz#`KICNJk)0u+Nz252ty7B#*WZx1E%;fh;kYySC6nom!MIC&1NTqD
zx?f&j)CWnN!ys@p`S$jS(hC*Y=7R?g;e^2W|1%0})VjR<a~8m#+Smu8*w<P6Qe1)0
zAwDxh7aOgSW4}qL#WgEl1)&!Pr5r0AfJF8a9c@lPW3Hu@>`C$0*pm<@HAiHNvor%(
z$Qsz&&VEv^U<m#=`Inyj9~UWBl*0l7WGI-PbQn!`d$FKS*|`;SE1F*wI^`Ox!&DRO
z?TnvF(u{SC-m~}YVyZ(-e-FRC3c0KlWDz0{6FijBH$mdunIK$?aX9IZ{eVX`D+e4!
z2fY3~Dv4Fp#+b+d6ndXBC9ytlq`*t?-xZq0R?vUo3)5=o>X#|cZ$O-dD|_XQ#R{Sh
znth>P@met2r`T|7;9iNeeB~vA;hqsoQj~l~;?kUfQ)}S2aKNIz*)p5v+o_uwEp{?N
zao-z{F`X^XF8zjF)|9ZfWx}zveRw091_3SS(}z?oKSayNj%ce$hYaV;&IEL{_<W_k
z>`Tcic9CGRL4BKoW%WEIvB4H_$6Mz=Z&93LE&Q<tO1)SkoXj%Vc?{dehjjKSr(3wS
z?R<;Io?i{rnvD8)j$tV#=6<4O)`xHL9ma|VY53H;59V@paF1vJ-f&;uWh`F_O?L}K
zj6shJ$pMRsl%D9wf*)5sp0%OTa{C*Y<F84poxL=(eb8I3xmNh=nptTw`7p?9ogbd5
zsN4{$+d7uhw4Aun6Z-TL|3a$0Y;v1aKn2dh6(<dmyK!?p3~FVT12FtMRzfdDjnZrw
zaQd7iHma4U5sZOdikuUrra0d3JGRpu(?}UkRN-hTE{We&`6x|WwKNci8xa1ed*JT+
zbis{FA9lO$8y+M>>G*fg(DRR!oeXK0Hw+0ykD>Tm;R)+``;pPTjIVa7+}du;4a92e
z8YIzO=8|ZA86t4bK>~@nss~T#WVdmZ3Rg}5e6>sNp%u~}{XO;y<mqww!$=prb%4ME
zCAyEn5<aGSf1b>mHL>^%{s!p%7Yg|=)%Oj!bD)OtXqCJ!(8xdf>z8FHk)5#LFD|{j
z<kUL0^ND<0i~G_O1GXj7F^W!IMhK@?YkDOPVToRrst>ukRVp9zUT5gT`Dkf9rGqs3
zGrKjU@$6QV?_Y~{vZ;w7#FIgL`6>(uRS$DR2Ll9ceRG*H0KEGRFEmj6w^>;g)lcC2
z5?FNk;l9>wT@M5DIhMWT({Zo65&nqScHgRR^cSxh39a3It@{*{OPv<_=$v8ody8wY
z9?4k71%$g|mtnW5!37-;LYCzX!TP!-<$rJehLpqI=>u}<k4iI9%T-?K7Nz$|FP)wX
z_i6ydqsbw^;F)bs@%p7knmp!D@i(u<%OitIkB#m$ii5iO^xezPYrw2zOM*r<^gyxf
z2hn9~cskbn+y9kU|7Uu0Tm8kIHS})K_omdk)Xa_@UBBo&&6JiP-{<uFI?0zY@w)s{
z_sc)Yuo+t5KMlu4IczPp#6dvt1FXB=dp84!Qv9q1flp1FTy95oI7zCnH!2O4pZS$r
z$F)-XKXJ)EqkqPJ+f&2m*63BVCpN9fa==Bj2AfSU79(pM%JkxZQ7?v9)HM#cXkcnY
z^FkT&RAWyi1mkWiT1REs;=aN!d{A+NKD&1L2WtU*l}jEPbjz&n(3q0bx!TTWhj=<6
z=F)VNM)sA1DtU;{r0lPv9=ye7$*69N@B`o5rmiP~^Sf;TJA$QY|35X-H}D*ER!Eij
zqb~V?5t8{AG?wzed!Kg{(0@H0x{SBUb&2sDGA&z*GqYq0m2UklFm8YsUhGgqoPDwe
z5vpq~ckEQ;4Y?2)en~{PIH*AaAHnqFMsdl*iMR-nFYvDUh_P&HW);<^=B6dT?{YB&
zhCf{>j|z})HCs2RZv6pHy`JXV#M(8w*vvHfM&N~X`GE_^?9J`U_2l_aq7qq5Z<qoG
zp9Wg7el#JqmZ$zhx@6v9fI)UN>r5(=7T(<v>e>aK>&hy3`ZI2kLn<%jFhg`C@#%;V
z)Ajxv{WASp9GT)21_>hkh5I_w?IQkc&|JG#=Wic6@~#wK7f|r*@D)Xf<*9KUyxgZ7
zq*96tT;s!iSg=Z5=rUx=ni6|bJEq5QlV*R<6e~+z=eEvr)^QMI?EHfF%<}jLny&v?
z%B`1E=JDmoUdi);=d`r-#%zm<7p%g7(uv+Z&*uG4x4G{?q;_Hw)MxcB_n_anBm%&j
zUy2=$MFZg3j3ImMW&cDgDS0$pxZx%TWcCNo9TSNY2BlMbr(B1Bdo-!ne|Rr?f;5{;
zKcJtB>3X`=&pc_nh%PJ8$E_@-)$gXqfr1Q9Em9vD(#&$nTW8q&c$*DT;UhP~>ivuZ
zK?`I3t;;{+)Ss!ILq^zJd<xCI9WKop3}|>lmnmuVL~7UKIKGX%LDbO=e{a4l)g#U5
z`+H2xvLv?}v=;|f4~l=msYu26reKfc_C)3W!pu%T0n8l+I&97-&1?e{8Kln{chJwF
z(MW@Ustm@D<En|Z4HBD`Sge3CsW2zL2eK6N%xhfgcJg^5`Dl`l<iTRBhf@yd*O+T4
z2A3MSG@;T=W%8L$&*SpvTj$ZnW;2E&>&x@7Y_RJu;LJ4}Kc&e%?{rO6d>U9%wL8B~
z1wCp(Db&YBLAXd)ghgCgbl}uX^u8c`^*`v7)i-wz{2tiFPWAJUdC2>ys4Wq6^EA7G
zZT!H)^x%l|0PlUsazubDnQMHk>-!7Kk_PYkmb9MHtaC9s<`x<&EBUO3yYX@aucUhZ
zCwqG7s}BvjzvTsd39qnkdnIE@^(MfY2XQu3pDFL&{w*N1I|{<^yBw!`c^UK_CnWQd
zQ=4jx1HRE8zy^E^P{hu>?)gBXf&WhQrakHbj(6qtVMkp~giJPbbM4C*wm6=c!-nN4
z*I+9|X}!d9qpNS(=tfNu*7&s^TxTBRDPA-)``RR00p7fm-zC#o3g}y+={?*i>V1E@
zRU_K1{(H(U^XLN7eI7b$er-8Zz$roRxiCCE`U!2-_U^ot-GJ46C5liaWEsw|$<2d2
z_TM?SdbhY?6Njrlo2IW@8-!jVk23T2vG0hK>)i~ajjK;pODURtzP2@*r4jHQJ@juO
z?HuLs1MSsM?5X^X;t4M$@@2vRU*1Z4=mnMIG>ix2)1d=4At3jBI8Vur`xi72)SU_1
ztN8wPpfxJiXQJ8i=es(opsEi7^0##~Zr`PSO0~D@0CH+J>BfYG19!!k1wKwUb!7Q;
z3tj|hB50c`!r@E2VDC^7>b)OrK3B~je@b@ZWtuyWxk2QoV(<XsevmGYLXUc1PkS1B
z9^V9RmFtdKv>kmwa~;*tFZ%lCi!Mm;<F0)>bZpK2wVqq$EU7*SCtewarqu<yd)t#w
zq&m)TVKoULcdeqFTFC`zk~g<!=2b0hua@W4ECW=9F0MaY=}BT~4Kq^>N|&tONt}9z
zLmo|ge+NsFYf@;ke<{mvRPRaH86U~^>TT}8)(P=hE9+80)MWF<U!$n?T2q6pi-))p
z>J1mU1YGfU(X;9iz25(U^=>lVK{fZW^^+@)QO)1K@?WwF(S0AK8GmtsuHd-*>bqne
z=e4-0YiwUd(3U^)q%kSI<@T6^c2V&sunIPzyT<ga8t1&lZyoi=oa6i|@{#h`vw#uD
ztR>O9C%^a<6z;lg^|MzMrR~O?M*XRK;lU%Ptu7IJiMTwE_mdYdQG|UOJ6c3b#OR)W
zquvsyTCjX^PLA;%lW)PHx<ycf4f<d`2Fx+bt6;TJKJovt_MK5prERpzpnxJ>2-2j3
z)X+;Pih$A)lp+v{(t8I9h)6FH=`{#aqy+>7q_-fw7pX$%y-J9bdzkrV#+fxU_x`wR
zxm+iUA9-`$bDpxFz4v<<+libL5kw}9N1};w6e2*RTUF@MWGkB}8V2B4nRb5Xg)cyO
zkfx@G9lYZpnV}0prByz)tya~wIgv0aHEC%c{t(jw=xJ!p`;z098qR;I$xZv%%^+gy
zS+&NHFtYI2V#B&1*zVH|FL(9uqq#OJD1POXkDTY};i^f%4UubH$d5`CuE<B06VtVA
z@lS)5&wVxL3dY9I3?;KIOe)LVuX>cv(7F4ldoC^}wERLmrSpFBSxl(OFmMRRBw8@e
zZl>02ZmY)r`u5b;^xS-SuT2?Re>cVcvzG+rFYb^@;K`tw@!5|QB1EvKdqN^;Dxc_z
zZ#BcLCc+=qF7=_<Qq%}rf{EdU48<R0%)7%(QtT>;xeECuYL8Ltmz~Z(<gyhQ^w4Sg
z#OV4>V@%Yu6nN;3Ja>;BCyPW`KjEsSRz07P>e-qlAQ!pjcQ(Xey_6v7ved068Gv}P
zl~l4eK7#XV=VKQy)u&0{;GHOsLJIS~^qXg}S*f`uymPv>)1)Nn(~6vP+DH&sVB>HO
zh9>qXCVJW?!>pC7_HbTk14!?dx@M71Ry=|hy%B!)#p;r+UF+_%xGEXT_$xl&q6FgM
zp*vA?QI=laKfTo%N*RSROA}cKid&Y+gG@>JBKN>{Do*9B+H1V0ang1Xo@>Cca(RLi
zjo%n}rf1jwlr&|GEnWFoOW@UW!lmnt>QMQ8d8Lf(OW<S3ga8mK4ZJzpoba^ku*Y&-
zRJ%7ukoNmgbD#Y0e*<{CD$97xxGsz&=PP+Fc!SL4dR$EW_xLjTn;pJ7gFQQA**jZ!
zRudYmw(>Y6i^t<eQbe2=@>po&Z6N1UE^}v|pM)$3$|flpiGY)g=;nF9jx?(Rw5PTi
z<)JCM`C@~wZ<Tp(%GY`XjTym&r`(q9oX4gTbWJ--R&$=dUZ3AuXfX1$PuyKfnG2}d
zzIkOKtg&_}*(NYM!6+xOtoQSJAXU0w{YnDONp_HIwI_wM3plYVYV=3<kXB0&joqUd
z`_mgDgniQcu91A(ki9Q*r8Tz+#;T!q?k)D8zb-w*t;b~Uw@g*L#3U9tVM^AqrJl8|
zaXM#GbYrDI=oud3fai}RMUALNp?>#tVUfZ^6k?9rS6*$fQXv@VeOAs&%phcD2Z<gW
z&wF6&Uwn%yMhV6gKT*jKU>6f|1Bo}Q)pzNc$&i&ZS69c0qJ}M7#U8z8W+B-qJ*r(k
z)%@lwXmBv*(o$48r5iGGc-B3<ADxwT#A-dUdOB-9=@HnTDJIRC{voo-zN_fd4Xqpq
zHE+$v+eThH-4bb_h?d<ZF+SoOjc)AHJ+@x5G2AYk()$@$xq9hxd3(@dJBX|2t)dyd
zzIE3@pKgH>Y&2szq$dz1Yi~&f@}TTt1?v)LiE|8uG$m_A!R6#NmrS{%Jh!~)ee%gu
zgbzEqJjd2-+@4h&D&zdv^fUg}ZTuQKArRWUL6{>2B79ew&N0Q%YTRlFbD6dtrLilw
z8uyqz4ZqG<#hfB+WA2HLT=h3B9m=VrFz-$zC2<~$G@a)Wodu=)Vn6H*D)XVHn*f8g
z6lI<Y*J%4SEv;s$qbX`5uf@gY1kv#;FIo<Df)mV)+<RwShul8&>f0bw)@~0o>6?bY
zLJHwh-yPF4bL!5pG(o!n#OI=N-(o!tavWM7o|J|h592D1jq3CK{`LD66Zg@*lN3cw
zkKw#egv;GY<Q|`lV%!J!?!w@ZJ>#i|HKsk@q~hXmDqmtLPrq+dOEmUXBD={a3-8O(
zH!o98if!rog17eSB)6`aS8ir$zDd93f#(2{NkrP>&y$Nxv81JS_dXjJaL}I$tldSW
zP|lUj+uQfvUD{auZhNo-Hc4|EQ<n@ony{HY2=Hg0KknG5@)dA4!xP2<6M7-qTP+HY
zEOOG3Wk>Qh*dv%nZrbX}*BB?Y{g~*1g3=|r%Gu=CTj`J(eK#M`%jCKbGPq<C7x0o7
z%~&YSUAuk?4~@8F{sxsB=h)?YH{#o}-o*nGmGS2B=P4;{-?TDXry!(e)fy>qPI|}k
zP%R^$iNQkJ<69I|Efd4+YBuxI5TgZ@Hnd__)8@;ogLkUl#7>h~a{r5BIkaix5{e|S
zw2A3bZZK!v1B$cZ+y;$^5*yIFDx~|>vNz@)Dvb1^lDVGW9tAA>)_(3vV2r}C93|l;
zy)PP4WBK(Vmz>ZN=rUb6|K?(XkoJ+Z87f87wwU&v>?Lui&)jiI^Inz~grWa?vB!37
zl!7koP<W`6Xd+FYj}eDa(z<fSyvA`~b&QHJvXJVXSKT4od&4H1q6+(o>Mm~y0rwnf
z8o1iHbC(@DYQ}HmH4__O-NB${$utXh>B3u+51uSn6`dD?O1QFA>qO@@Nd$aCa>iFY
zRd6ks%E+I55@P7ov4{lH0~_7k&RPMILui`R_v;AHi|Ux8;Ht&>9~};U-RV-2bS6#F
zj3LvYdpwH15%i}~`~vjbjRT-X3l;y(TG#LOw~ftCZfDvepKp+)%mQ51azTjwgG!*M
zKVZheVn?)~E!cr9FV3HlMk!_43D(b9Y9e3Ml``}P8PIgoWZ(eZ1EmU9w&l;}dgt%e
zQ&rsD+SQ+8**z9Br0uN#K8%sI&JWYXWeDX|U@$W<<%7wtnozeSG9TXEuX2eF$4-T^
z$4eYkuQNS4tR5QsMH70=wbn>-&-OI>5(7nh?>95JbnTL@@%_0bZv1_t2Na`8%`l#;
zWo*9L-xsue<;z;24bKfE3nZ|@hV!?CecKoYDkMd0F(sZN+qF9?R(L#2E9*!;3i0JO
zGcpN*C{0T<O&?k^4}@u|Ru^?+K~cSe@fg3wn)|b|dGSx@ReOW3Le1+#xl|T7q92Xi
zr+lAn!{s%dLiz1a^yh$lu#%?@cK@*{8eDhuRR%)qacNmZntp7j*Q1^ba<UU(Ma5;o
z#cVBVgS`&Zol@-~n(`SF*z|rSZ6UF*BYDrB*LvUAkv6!H*YC!Y?U;G-_M_<+Ivq3(
z-&!FxFh?W{#KrZOnhYKN>W?Yas*aLT3NutWqlOlAjJ11<g=wblDZq>({8IZBry$2N
zRP_pFKuY$K=buHO?gIV;zu~Bgk7r*hQJ6be^gTN=4a;PotS&=^LT4q<+jw@k!3JhM
zX4&vgD!Fj+@(+DJR#}+$$R!s`s!uyLJ7MAT`h}FexCG_*Ndq(^O2d>MSqUnZdV}ay
zh}+WS3G{7q>YX{FYVm8Ps`>ZcG#J5p%*ObuJ%h>v68GutPE#6x+2z*#8c<qf*t~aR
zR5EiXwk&-`2ky~!b2ngqUUbYSW_m!hYr=43EW9tUZ53G;AEj%&ykzs0SKHmE{`C9g
z4Zb)RCsIn6CWpm19UfoHyQ=q%rFZPVK2Lxv-aaWCn%XEiU6$d4+sed7349Cqa!Zd-
z5)KWy=Y@S)%~9)|?!=4&Uj@!Rkus_AsF%D}a^1p~Ql@`%6vJpwi+ox1v2#2yz|c|^
z{)(&J+)?{gMAn@k;<3KPg&V6<CblXNXd;^98SQyvQm>SWS$i?P#}zofU)Sq>0&;6O
z^2>R5p83}L25dK}F>|Sg;6Um!ENwnG*4pFK9lFS2Et&p}!u0mPWI4#?)rdjy0ov>&
zCQ9_Oq(f-!O5#fFfs3IamF>P$z5f$iTS~h<)2WWEnl(Wb<YYk(6h9Njhoq_rtXGm$
zRf=4@{t!&YuX$a^gsgK9G;s$7nJ`!|(>!LfBqxUK38*20ImY_NWDSgD+{1-GJ@sqy
zQ5wfGUnXdxrD?J^=_Ni}IYSVoQroW6;P?cb><_6cSr9M)K*5lj@#fWDo%^)SPIaY_
zV$n$llo_4a-b+D0uzP^>Nn>lzr;xMGq$V_~=;q9idP5uc_wJwA+)M1sdcLnh^k17u
zk4G}&u|1a8UXr1NbLcv?#kItGDs0wzos5iBm;RDm=IJrvl~8gIV*PI5P?`*$C%dv?
z%kJ!T<w)_ar}mUy_W*&wnTP=smjAVC)YwXt6sQkmZf8>n=H0!A?>oy|6BwtXSD~uk
zYS-(KUUmG$q<S%49evT@gBnIB=KS%_r`hVch|(SILzqlU+c0~N#684in5$1Lf)YO>
z2aW=(0VLPIp1ptL_{e8-J{a*=VAt~1%YzR0!}i1iU}|a&%+{#xS_vk&4HOS(bIl4X
zI*i~i46+=u&XeU_3^R+v9Q&x0XxqSx@jG0)++h{`YANEN&04s+Svhr!Hi9+`*}6E1
zev}8rl3$Jrm&KLFj*}046jSyrVW1j7V8)(auPLMlkQ<io*6fd~YQIOAn36;_IDe@e
ztQ$zvJ6v-cIoj(QdfSL8g~RTsr0?CY+70q+BWA9-V_SI|WrDz5c1z_8#}7rgyrvOe
zx_#|!0C6Rnd)&{+%_~vdWscX(owhGkTrjMhSU6dvO^O;W@l6ip?sdN9M74f=qbQ+5
zBb?aV2IaXli4I<44C&gcMUPfZV(Lr+2xwTNQ;7}NqnwO(FIfLc+ay8qr0%^_;{MZp
zKKzDKHD}lYbo9+_q8Bhs*6Qh;WvET@nPN}WmiPXxLn%5N=32kKmwoSvFD=xXNz-aP
z+3r)3f-3q&?V)*M$AAvizn<9<YsG%m_hrXeL9hGinvK4N6YNN+*!CxIsvnLYd#L#O
z3a^m575w04J6&3gq1j4`F0TSVv0P27dW3u8;<1ouU&=ZHv+ujX7K5m9)(~{iVG_)x
z<yH!hepPryxt2A)S)UsgX2m;sm?#HPFyRSve=f<u97h|5F0NiM?-JV8$K+Y3fUT`k
zy)X)>aEVrv2*h#MK4pZrz5W^>8DFliL!iCXa+MQ$KA6>w(6&1fJe{xUAW-wVl!4C8
zvxgtB0i5z25;;r0?J>dH|MkV!t=6k}<BU@YnfzV%Gteqf-mm?hz{xbmhj-2PL|<4`
zaxQPgN79vUxYhy1e5ah@8qinTeVUeDtmUCU>?cPNS-##f__h^VyIGo_kg`k%bg&ZZ
zl{20munlda5@X+<QU<SHZ$I<3V+n8Qo{v4BH!enEeA2Ih*IT>htQD(&|El|W{1qsQ
zG(cQ3k-_}?cVh7IKG<t-p;$&E_3M|0_Ro(SWBv?D#w6q`TMg}OYN?>&>LtKZoesp;
zdbRu!Z`5<y7pc^I2TIsm%e|yzKzM%*<+UoBN<vm23<$>s=&lyDnzRD(M)DSiTPSmS
z{n{$MAt#@U>!OpDz+C|{%@E^?q?ZF0(Ge!MawDOzn~!LZzuYB^|1pB<%j~$z?V=6$
z!mKFcM)jDc(&qOWidPrVr4&^@Ek2g_G~Y}6uru!TH0Ouptc&A1m4NIWY0q=mFVC`#
za_}v4cP7>krtuCIEKaQrpZn{cnQtGq8atP?e5x}n=^4FUUw6p#sJLbeJGbrEkjG`U
z-aA)2l};JJIZR*R9sbSBqMdkhou}aFox4}juXl3d1$58A9!RA?{H~{j?bAS2GWitm
zy)WBgmrAA#!jE92C`%dtD~l$LG|#t}aDpX>o->kkI@-ZJJFS!NR5RI}kaKCk+~AmH
zVsM#BCa3zqio6{XIg}&K<XngCY&S4<Ycqc;r`j87O!gqsJmSimLR*Yp2xUjr{6c#$
zX+hxb?TDc<1MKj7X@K;on{~LKY)u@QGKXy?32><U9-;lB!s#iy31+pUl704*q@TDh
zs2KK?B;Z)K+S~kH6@A<p8cnl1Gh;X6mo9R)c+-Qv0o%zXY;o;q6f1T;i8#1Rh6Pz^
zEsngvzX@G&HVBsn2S^~qr}C>d!?J$Fb-sTV4=cpDn4XF5_v)D@9|fthcwmCt<XntT
z?iB;1>hb|d9J_;HWsc*9*`R#(yZNlhhtTYz&-zFqqs3Un_+MB8?Yl$=U6&3nag1KD
z1O$S?6XIfvV*p8j9EqKJj1cjvK!uq`RkpdWfm5=>4qwmi`*~<EQaq(F!l24M>>Xd6
z1qx0J_>Yo3u-KpRbx{s;_T^9bjRKS5gtN%Zd<(Jq;Lmjf43#{_+rUs>^HuSIqK~e;
zU!i3>etGLVC#CX5P^eFotMWA3QNVP~DpSHJp>{!=w<s8!UywYgySlu;!!DQFquO?}
z`(9!pLB!Cgr|s|T0WnJXe-aOQQ8P!?uW1FGbTk;(D=Dg9k4S48uScA!>e`)*ekhu5
z-k_LqU*-!ejj2@0+_6S~x?}n%1NyfK-p?Pg5weG0@K@oM5#<9k;=DLKZ);90;|4h^
z_7il49<3s}b9wxV9h5u(g4Qacb$MS{$Aci<3)U8+ENmu7Z5BxSCMC>Shm0~nQ{&PK
z7bPOXrxlDcREXH)53-_nbLC_|N-tEeGpfu*7<jV0ZZ!^bcEzm;EZz6>({M6q9g5k0
zAl>kH*6L4FuLCLnwP;dc%Jx{P{h9yi<MU^cD<2XM#*~l;`syU+0%r!Xk5k@96sV_!
zPggyvHxo=kRmH%sYl>~hD878Gg^n1}LQy+pO1~?r_#XADAFqp%mYHNdVs5m!cjV{W
z@V9G;+x_p)bhA9Z`=99z_X%rR6=AG#AJKJXEGL9<Gd>|_#a;Kj8d}w@#dz#&+-g&d
zS``cytN0LeM4FJ)mFi=Ae?u@B&G@@i!=z$amff!l>b#pEQWIP!S+(d8aQ$DYi?YGE
zfGR12D^px4VWBsg#4^qjE+Hbi3LgQVw34=bZ30*%cc^1@yFudp58`6Li)JbnNeEyL
z9H+J0-6n+BVC{k|{dikNfGz&YQ#PvsZZfS$H=BbsxWx8sqQltP{B$R{_2<Fp@<n!H
zDz{KGT0nfkk0px;RXzN1kHj3$(f1jyWRN%?h*Y;G7?I>-aqzeoWWM{?`sFXYEdP2|
z4G969I?a1LcD$~N1obQMh-HA;V;Ull*5>w|A5i<B79#NM!*PD7ni7qcnzQ2v5wq3@
zv)O%OZb?v3@07MmXlyKqty7(e&?#QL)k#y^sWj=DKyMrso0^h`En7?bFVRok5*2B*
zjIcMx5C~~)-k$Blgedn@CK6>rb4GRb`ns_(^iN6s4~oj~7pmkJT+OdPw9hv(q;Fa4
zo!g<`V8X=0of0^>8JfAJw=gWd*C@<n8-)@;rldZhEqu&yX90z$;uV%BhK1^%XMW8W
zyK_#*Ti?9n`p&2CcGPY5Li0s!5&t?qO_ZG_ee<LPc4-Ci&>`+D|Hh~1rxh8YvMDLU
zS_IX}AqeGWZeL>#X_4#EqI^+M@RV>cM4#3UARb5)bbc1p@%qAOA}(^B8E<!?X@$?S
zEt<3%l)8<hR`A7$B3Rjiz@o)ISr$$X5;RwVFT39ROI-S6lRyi&&Nl@8v{&I}nK2+&
zRo<in_2Yp%;;eT|SK=2MK`qFda$tf4_3#0?gbsnpAD$Ot=XoMOP{JaYZB&}?1PELu
zc*f)rA))}L%xfbpkhfyQujuYFvn&wXJ*IAq;AFQO!Hb&rlqDEzwKmL0dbe8DhJ2vK
zEm~|1p%)3Q#jmXfb&EGIpPyxX9_cJ~3&57TOq5%ldb$}U|LdJ|jlAF)T(bk4cT@}*
zgk)d(U7)}K(?TBrRJ@q7z(saG@mO||@ak5xh()Z0Gm2_aj*4e23$CfSdCyXnc{i|?
z(7D}G&|jLkDUFHDml|#QSCN7rAX4aV7s~NDs0J#sV~k$-63YDYWvCInl)j?3)mU1{
zexr)#7lzyIbY1djdc%mA|KK3FhF`20^G%e{j<oJ=xM7pPYSb}Z51E<T4BJ&ks)mEd
zsO+bMqvn7xhMj0y5ZRX)0YZg#?eq8QKVK|e&;egrZ040_v+~!!<Qrxh@uB3t;fcPG
zooT3<!7D!Ly+tojOlMK@aR9+RFM0=(>gs3tRQV2>CsOW6_N(X?dmv%I1l4XY`wp2M
zrhfSg?)8`Omf>+B3Rsq4m&n33J+W3ke?}V_BaO{DP(J~tf{bL!<0E4F?BdnRN6+Zd
zAdj|3P+zN$2Os$Aghj%AjTrns0>OnO@L@>woBFV|D0Ko-YtApt9l;1?4b!r5uu4jx
zVDVJgvYOFeN60|H()uIVJcT;UohSxxNKo5b3Zt)1xD<l_+SoROfnXpYFSYYuS9+Du
ze{Jc}YS<t(Ffrz2y{g=&jaX*BTAENjDBk6@uv`q@6VQQ8XK^jw_2^k2GM82;oS5ne
ze3xc=u<H`dt|xU@*IM8Rq8n3f6Mg)uBd#ynvfzp%-?eu486DLTW|^G&iS9YmRPp?F
z36iK0zC9k@MiMP=)EdBg7Nf-ZfrW2vCf(~b{r8a4PlfwlhG|DhJB}z!J(<;sj3GNI
zQ+d7xq*&g@KK&7rAiX;%$ogzv2j;3XqC-CtDQ6|M=8|9qTg!c+M`DiC=A4BL)X=yi
zT#8@D9pS{2UgOLmeFTQS5|H%XZ(H+sg|~20?RI|f9=?y8gEVaKZlS0#{zAf2C(u8w
z^BNiz(686HnASAivwi$CYWBBln9`*>(i>XXT<J?uzBH%c@R7s=t<{V{nXj4=#G8*w
zOOvn@w#ra!?pi?~#AoXIY1tYx;<ZMbW&J3*93{POs>E*KLzSgYsvMSqv{nODxw0r<
zYZb2k#GQP+_i)dYzIR0@3#}B$iZ@!s*HUYLWqRQEjQg<WyT15d!F2U}aQVs+_Y;eM
z<@Ng4v%Fb{lbHcSZvJCS<*`^o&d9gYpIMpsvAOs4d|Elu0oF8yGVK%Y{m_neuB!-?
znPA&M!Y5@TZ1Pi|SB3|y%o-0ZZQhlGS+$ss6I)nIb%<F!y-RAVtfK?O=t&q#Tb($G
z?ILPMvppj<{q74Z90u_uBHKfmrHp~JAw|%bOJAlJ9Vr-q7ZXV>XwEMcg=qWNr}7q)
z#;Jz*D*U+}**j8IG9GeRtkVS9Z2)2cDI<o{Qpr4b7n995DE0GB7L194;8Vk#>qQ5p
zwM0$;59_p9=q?ePsdtFaI}9jSY+w8S9ntGCd?G`?T*EnqBw)LnkW=`b3mjwcVkS|3
z5?`?ChYOlU39j`Q4SOjIS}OmCxJGtUPfRLyZ$kSXuTH8A<*2StUa9*0XB;Ke0JwPA
zOE7e;?Vsr&??O>Ri#6k&0Yo0+OhQWS+EBAWmZWwc!f7p+{)g2&q{{RYVJ3tO3N;2$
zr|yxsgT8Tqa<PaVh*MctZZ1xpqSgS1e)PU{!ZOlKL1Sn|Z^lh2^Qwqa4VqtQJm0b-
z2*2LK7ngF3U)ODtYIghJO{pG`47^}VV80MD!FTMovwf#I?1N&#f3EcJg`cbpv&J+d
z_vTy431*Mi&{g=L)M88(jodXJty}r7n$F+QQD+?nd;GxviPi({+6d618PTSJD65)4
zUb*(MHo~i8K?5OsV<`}nOJX+hScQ~Fgzq*u{<wAJu4x%bkX1}L-dGC>V$33a^d9~E
zK}l(nvxj~ImW|BeUms3@JM8a%5iqkHOkwZ*GK0Ts!&a*Yp+j<US4>j(7<&g55*Ob-
ze8)yQUoy`+W1W8OVVt=%*h?+6Em=8YFFN?d3+AIb!XOZP)brP-?r*Q@4bqG1g!)${
z$p+`?P1Pq@E{|4Cp^;{m`p$QkrXM!4Hc|T3i=lQF6HGf)!Sj!UMbNT8=}3yO*Oy{Y
z|F`b|<UK=JE`6@#I|;5&tjbpBY$OH(IFxT+j~-x;0-qdIkJp8(ckFwW|4&My^wep}
zZRzS}t@I}E*v0sh^B;-0zX!>F&daOuzuY^IP}foigkB>q!w`PrI2s&2RN6xjIqOxl
zmVjMad{u#AJ-4h^V)&wX-ouDk_q`oP*Y3GT+~|Dv1|KJmO#yQQuPPT#bz79d!GC`p
z=(3O^;q=>{l1HFyIqLv!@c&Iul8pT9Mbst;-T(3ws5%of@K`jc2>4Z(dU04d1o04*
zq$wY6pFx7eAtCeoyDMt@yCz=14~OzYm5W&p|C_#l&$w{~u`BL;db5s-M|ccsBlIm<
zjWE``6PL5AbwQ_CK>5;>!qyovR=UeghT>LbAWDt_DulC!Txo<duEPDT!uq9(BAM48
z{-e|e#K|GDQm19GQ>S-15BFvUWoSmAdhFiTdVbICIy$X6o5(D)xeGwVS$Gx#E>{!*
zaR*zx<grk&?%`wR&tXmzUa+X>Ms0>to$8%}oHdfMoU=D414+;S^YQN`5PC0z5*p-w
zp>;m2Ke2+y#<rHyTjiJP4XI_`QA=`PWXiH;im85pV!fydLHiWS(xHvX?P9y!MsHUB
zC-G4K10p^-`I=<<pI;b+{{UgD;}@alt$hC8JnPVfG*-l=;`oz-R?({VFT0%n^xCIl
z+7WX@KCcZZ6`}jW!IEv@J(IB99tfd-l>uL0!mIi4y}|9;`bzxpl<mL0Xg_~UBezuZ
zGpJgP>z4Z9_c5yXuulor_CY$iz*T2j4;szyHXlB08wO5NCbvXWk%Z;R+U8Vm?8Pmb
z;Wu`pqjtFbL4Q+uM2_gVK97R_33>gE#1DMT0M3A-pc!J|O2Vq07Y--XcS`i@>Pe!?
z^3rJkzluGszcmmiIaD7tQ1`RjPknw@7l#L@knr87^bYl?TGhfZE*Z4Jg5r3a?)#;|
z9CP^CQ7CD2{(p#lGPH2ytlL@*_PZw+Rz<NEhwu6yXE#_ESr!|t<@Ot3RHHD>&j`ve
ziSGe<bCAv{e(j}3Xa58=bBIZ*#2vL1u^ug7%A8MY_jTs7A`u{7XP3VHH##mKWLV@|
zgMjbN*d~YoRov4xS?p=aW7UZWpYxlQZ=-yjBxpp4g!p+RO6|wVFTOiX{doufcg_EX
z;KIn`zTf-4z_UCv7eGiO?<mi}N)#CbvURWB6CdPpQ@=X`@~MU%b|@M--$@vigN-~^
zwJJQ=2OL~DHDGT|ujQn*^Y=D`*a<dkIl>!}&8^_#;CGQ$26o4i`F*-Whg97<R!U!i
zVj3HE$#f^*X8Ts#x43z-g9dMCQO<~4@cZSZ<2mDhe6&{(7hOFe$Eo1k?n51`>J{Y2
zT0`dVWVZ+6YVJS1Z>SRLvik(bjy02sUN8#k6hXjbhvMg~7#?U#ECvu1sS8d61DUbK
zPV@Qc4@X9rzW0L(#_3#TN2fn?{2%?^uNey-@urwF?U4lAK8eAPth0_=16tr!WSr6J
z<FL{xTtR9XyU>r;Lly?G2?N?+-c2`^CaGMw5(HMI9(6D`=6`TPg)A3)8|L+CUwk)|
zJdc)qV60%}2X?9dXxm@s_on*iy+|XGMa0rSOetVkM+D9!BlYyT>TmhS`cJ)QveDs3
z8yp9aGs|>XqUFXP+uE`*WC$gIO+$K+<2*}q?Ia1M5O%W#^o--_gbRRW|N4VT^NwqB
z;iLTwoyl^3o>aAe*q{6)5zAA|@P2k5ko|TK<zg*9)F0@j`@1<I!8p#$51M)MuaFB7
z$lNP+KbX%&g0{$f%*sf-uH4^kee={5T)Mz01D>L0RyZ~jT(tjOf5oK#Vt4=Tp9C`i
zbKLW0^DsPBJCCsGI@DP$uq-HyE4?M>*%Ns?w2UnH;XNGQ3Cto5{bb^`4&=Rs%&Sa%
zY%)#;%#KeYrH`ElM4>{5NqyPEWa@-wWU)7?3{7Sj{ObLxj_UEO{+n(th%?9#D(AN#
z^vl76<Lnp(oyho(D#9YITWlVL4En3I5(9vgV%UmcQ222$Xf0v?PLyPIhd*hquC<9}
z&fd+a;k<fF4e~0Rw>}ij?Q{tGkZSJ-Joj97$-90b4~8nxFFuR-<a~$WjCbUSXzoF;
zISx!E1G`QMs|`ETnt@>ZUd+Y)y<EG{Let?4-l;x%aVl7>`I*~BKA|YLLBXTV*@Tjq
zIJ5&P=^GiHC=%+z9RDh$DsLiU8Qg7Be4?M~)2(#_fH%-%x;pFa6#tp;R^G_!9Jbew
z%5)tL*bJC@r8l!+I`3YRmJ;%vAaf_R6lPaf0NdG_L*OPV&Ain@Ikg9&bB|69XydDB
zgSF^;9P-X^ic-IRqGxQ>yCWAwROIKS><;JO>R?$t&EK!zp`W<e?hGlMv{S>`tug<N
zZOU`0A^PdFb*O#yqTFG3d9r-*Cv37wq!Zf4XX`KbpwXB`<Fv>ql<meUJX#L11|-Ho
z9j_P8r*Xa?_o$n>(`C03aSgC!RuA)C{QX<n5+j^&jeFXVsjouSU8sljK*Iw*rhkGD
zZh#=8Fj(zKLP9sybe+gwuHm?D=Uv@*RnDL%4Z8>#L?!EMXu7Yn*!lS>xZ-qB20wL2
zrh(97+RFwrl+>VleO~Iv8F3VGIL{|tv8~|Q8~aO(=Rdx~g^ybAj6ywZbxn@5TZ%j&
zw+@zFB1dLOQN<Dx5G+P;Zc%4uB~+l-1ScR~*1~UWyM9^P<WLxuy}Z0lekL>I!~s2S
zzHGAFmVnQmjx8uz?|phhUm;+%$^EMv9B|R~VJ2h{fpjNJ2~Igp_RJN|o(k0NoVcul
ziBF~yns??}THsM<-;KR(Wy1eb`<F9nOy36Vs4n>6)#lHegt2A^L&y-bn>_*!f~X)J
z=ZDbesnQBhZxxB4$bz?$#>UL2R(KDz=Jy~G51F$K>05Ltl+!Seo&+VnzhZs4b?-LF
z><+gkRRg8!Q(2J3-Gk~c3CkuCcrlnRF}p>o*L#qe+s-Z>x;irnvq$u|cN*B~7^+Gb
z==_{Lz1Otn#u_jP`Y#(4b*e9?y=TwP;LSUv%*}AL=wZNP!XUIi!qZ{gq$aW%@B7(Z
zVCw0vYqycOvmZlD6qD}BOY1v)ekfwSEb4z*J)^8)eV^g%6tEj>-j%`nR&B=9ge}iJ
zE8_|KL<5i%T6sPZK_QqD#{-XgN_yDByAlkU^6NSoZ0JEtOG`cWxa4-&smy7g*}TmB
zo}bS5ZHv9Nzr>`B0^EEW!~UBt(~oe#z7^SinQ~;x2tOg^U#%u6UzPsmG!awds=fq{
za?;^GTud-mLSPNL+y7@ZF>E1@Z^}dfCL7ezoZjVRyvHN2D|Wo&LZD<z$;4+z*<0nz
zl`iSk!OpBeoQzaH4Ap`heic`tSLxGOJ+5HIt#?^~x4ds>xUqb?xRE*2PK>eD^*z4X
zOr4uX8znPW?zs4zD!Ay=SKf_-bmG@KP#EjUX6Ak~U>mBp!Tr=XaA3}67Gpo|(`DEE
z)S)g8)pv~E4l_)bHx*50YE-YPcWWIm>0nKWGToUA1VL=aOLnUHe1vN~5~iEKXl4Qa
zaA#bpyJa!WG!C`&5-(&@^ks?h{LowsL}SwjvQ_)(?UFsU-Gkx5h_jV4E1jL__B6Vs
z?n5YX+C3K_YBe&+y-b_wgGdQO_I3hRlV+2_%qP3V4FptBPx~h02DqODcg4ZrE?#5q
z)%xOf(Ljow?~@L}Ekwr###?yORTh|Wc4_h_`d)E6I{`<*LubnkEwLTy9K(NQM6Zlp
zNRn7-A6VS?yPq2i;+E2arH6uAjh2*_xtF66HK;FL28V9&;#j<CVWfJ>F{sqqg`FzM
zJ#3)8Pd@$GEp2GPUO}Ij-H8DOTj*QsIgC)SSkD|_PZQZQ%w|LdJ~l8N)|ts!|3PTN
z|Ebr$;c%&{U?oO)nRx4X4xR&*dVZ6uxatw6a}18JuHwz@v!(Uo!YU7H(xC1mu~9b5
zKE!lffsQ#p8vAg%*;1d1nr)a24%-#_mXJfRlkjzHUX!7VPe$SdgEvd$vb+|o$%t)0
z;9|AZ#CUzqC!sgGcxrsan6CZMwb-^8y1v>(AX)bUUA6AvnoAu_{FM7-0S^xag)&e_
zVVbs^Qyl6IyT7_r+BGLNoS0YbH8TW5Q%~Ybc7tqkN)cxmm$}$;NL~nyxU(nbl#l2-
z!{m?Yz`h$7<qe1%7x;0g5`fj3JA3=9^SVcnW)`J7{5xuWXlTn=qKmu6R#zmQFT(H?
z-qq~X?!#`_evbJ9@VN6Fk7xOmOm}|FoHy+(B7M0G9Jdh7j8KfWCm?HRQCAmdrel1|
z_T#T`&(*7!g}z+Q@<Ua8G+G6YN5W*+b?Pwp&)*;C!HbJ|2XT3btDyG?AcNjfftKFN
zf;-`HqkQ(}3Ur{7aJ1vQa?uMtVnCsr`*cIGQiJv9wkMN0nSkI)4<zAQ>bOi-Ng4i)
zM!jA$_4{DBreiJmWGUkO2E+M+#SkV+a+?fQYnHt;gocOC-j|MbFGxR1D9gO<BMY95
zTq5wXM8bp8W@~K3M0|gd@#t-4Fp8w#kJ@P>hOunU%<I&B?Klh{QoA<U@M5`S?@mFG
z!c5<i&d?!sOJ-Hg)JNr<>(MVlIravj)*r$=HTm`{8|u|{9X3lJ68g@yjfK6Da-Wvq
zcZW?qKS?w5WiayEjC8z5@v1$-h;7Qbo!O)-bp5reC_Q4{W8623-?t~OrKeKLpxdM6
zqG-B$-G3SJLd55k3lZs;%S-C(xIr*C&t;F#-p0^t59ngt7<RL%pbu(7ziQTcLF`|h
z1umb9xB0G>K?$i)$lU}Z=erl`jkz(4)LZ8!mA5xA>4s}dAOGqKgyp=vd0_XzFQTs>
zsQ1#ag){)3QMbl*&&IymIwFsYG@*mci`2<Vnbm?Q=iViBBA&``iZqt1T<rT4d`^j}
z5iSpDpTI&p^X0h}6^-?^vX{q<*k6u+;boMzUFn^4AlRVzd@>jwMyJ62ZKh^BPp=(z
zG<B1NEy2kAYl-{RyMxiEg3Y4!Fm2MZ*0;(*H+A&Iw`6ZooA-3~ZS&rnT6x`Ap#vrT
z^kPhHPC3|zIaOckJc-k$sLoy@->eV5K{ejNlOpxv3ATje{;S>@^&YD>*gPA$rK6oe
zJ5~a-UxQa1OrLbC-gSI6P{zTwuFcy7OC#7E&ZpWpJ%|3WL6V+~eN=VO*@<Ys&Q~p-
zCVo=vp@yGu3N)mFzsQhCe{7d*fgQ<EyU#xFay){?G!I+kj4U{||F%b$eO-cyBhZD%
z6=QmQ8;8;GKytO?=NP#9b`0*UcV9Is8QsE8eBvW^(1ifbk2;p<*(Im3`=}@3r|YuR
zmjd;<^v<UqpfCJc3CYT^1Ng0F<RD+RaA&*OH@ULd^xqI%$^As6>PJk7Cd7jmun55>
zt8?$K4x#dpi9Ud~J4A<f&-%1f@0`$t)#NQDFcuVGeG3;iAbY_XK|l}V2@;D)wI;_S
z<cXCq=#-=BTIVt{Tezhesaa=oA(btvXn^_{VK()agKs_o#kk|{a%ENb@P>XKDbvHT
z__}A4kE|8o+2W{YMUWMrkIC3zw}cd5?!Rm}-;`^yYLMXa#s3zYK^*Yv2=Hpn^7M02
zy@yeUSu5?iefJ$z*;wp7B~~NAqjfdScg8-%!@ECKP+Z5}o!&AVaJX58NGFey#174k
zXA$Ago}4+Lov8N*quC0IBqT!T8X$*nOy}1fYHy+nOH@36Y<`_{(3ztD{?+D3$;`1?
zOMD8F+!q6ln|6>dp}A<F_#fa$&@{MXCw^cLI!Q_4?Pm09XRGj*3!w(N=&ZyEI;^3>
z>(Og;OT&*A$ENciTAl)79pfRMuDH;l?S}323${3g3nsaFj2>v5e%c&D+zUyeT-N<_
zZkrguGwrQq5<rk)hy*l+_X008g-PK})j8C`*Lbvjo%!*!?AKxspI~*3fJE~=!q+7E
zb};=T;%Gh!1~dfp|BhC7Dk^9jm+!?9=Nuo^c?56My4fZkjAsE#m~<qkjP#aL-S;)F
z>kJ6{-r)XPY-g9rS}c3Zi<wHBs=d92n>AsI5ytHU$uo2YB<uR<uNFB$3_eFCuJO#<
z13aRJ3BGAmnwaQddi)qfsx}LK!>Ghu1;*d+ULVba-@O1XG7|X1mB^&BC5jr?<#zSD
z<;37#_stov?e{xn&{G~-_Z_2EiCqgSHb&2hE@ZF{^hKGu#qM4g&&`>1aY?C;W2#w-
z??1lOG&?E6?$nCF6eRRBufSKxF1D-R83*sIJpoO8nLT*+^z(O79zfqhx5W1i@yyO{
z8+HV@xW-4-i#<h#-R-6I-K@|V3Vv(kwAvPkU=BH<k-kDC`g1vl75865$se>E)B-|z
zm-`N}Q6K72?;i@lk3pYvmoj3U=a}Om<u_Xr&n~O|fz4YJ`LxEaE9wZKV!)iDR})*G
z@r2=JM9RQ*3bn14R+>V37~X&*49Y7m?XA9r9t$DFU&$6OxnEc`!Bw9Y5EwWQRIdhf
z^8T0%v{M2K{+ZPl8_+j7+wURm%D~^eIJedcc-0$<Kl?$n60?}bg-?$8=x)h)ZZ(Q{
zZCIu^o}SmUr|v*y2o=wEWQLHq`yaMF+V<0A4wLxas|T<%FN>Y8V6>V6J|>@bY1E8*
zTRFDZe$I-oVL;>S^~|atm0b?RFE;D#CJwvacb$9bB$k}5naoyQ_sqVTaGfD?ej9r3
z`V3Tw4dYzi=c~PCUv=D6vZvIQYsNaRXM2IL_%}Uxi5#INEj@c38P-1Oc2qYw7Fe@g
zRkZV=bnlK?i=WSK!76^{6;1vn8)2&NWBX^c-^Xoc=TGKJ3ySE~&JP({fOjTq^>3l9
zfen~IOog0{k6|s!4zF*;`PETPvwTu|Ag>*FNA>kYa=^=QU1eGY#HUu>tv#^L=D3Oi
z-M6>urh>4Oy$?MG&W@!tpcZ!jq)&T-y^t+ApJ(^q_v4}LhX8rvb<r6|yOg!%)YBTr
zFJlelPpBnDxT$1HPx86W=+Aci8Xh>&+U?Xiz*v3IAz3Y#5#k)(K0h{hcI1wNW6pn!
z19yJqmcLErinRO2+8jIk2{)~C|K&LhgP#noJ0^PW$Pa6CAqa9(+|inQ&vDBo_H|*_
zkrue9p22PEt7;r%@t`3{_=%sQ*g-hMHLY}SaO&Z5K}%jVb92HOI$&<y>1anwy@A5_
zY*HEM*`y2?>bCtmOoBH>i4qJ(pOA3AngWV3%Y;izbC1Vn4F!E?puI#Et;ERkLk676
zS#K>d^g&EBxIG<231{FAuG?uYoBN^Y!$ZfaX|yVe9<!WR!yuregfO3N;@2{WQ$Lf1
zJWZ<zI@Az4YEI_lJJqV_BkNbwe=52!w%Jz+@bMBGWB7VGf-TfOX&sIkkfD~Fyr0{;
zkQJ%GdHPn`>>w#%asNvs0-*EnT1f-=N*ly^2o<Zd&P=IAcM>?_nr}pANrn#7#6gkR
zvW}w6OJ$d=iFR9^ETS<<T~5TEALNIqESJ75XZ9E@KBiy%#>-H;&`;}pwkov^l#wsC
zVEiIfq$&HZmGrJtRZb=Vbz!=*X(51E3bKf4>r*T2I82dArRhCuK@LTe`Ur-uh<OyB
z`F$X`q0C+S>|0CE1PwCM9a)1Lbc2CDh?s`HuMbwBn*V*KPsD#y46{0ci6pkPD0i5a
zLsttZ^9bLmJwr{}QSMC+HBkDUdMRK=qZ{l5N9o#Qj?TepWna^1(|=V~*WG=ItUF0F
z+_t$Zc!*IvxDbrZ_>`5-E?Ba8_`&G_PDmoe%egZCtJXRF`Y03R>z~lpRSy5Hvlq7W
zt)X+tHpO>ok8Nws+pb5F?uMngkhu)V4?w8fS#F^dUUpSsr>bL>J*-NmszXfZsk}L=
z`=y0ZY1IPrp<4DQt^9adMO@;ZCim=Fv`x44FFgdK;@(K3F?-6T3v771`En^v^a^eO
z#e{axg+2aO=hrx_)90c%Kv-NpNzXuZ7#03ytVuM5F0}4KMcuLsNtm2w=lAGM{fr}<
zwQX^v(=STBq&SzA4yqlvYV+D{Okdc*b+rgq#;<eX+3GKSyK!u0E3Ao|M$=1^BH+h2
z9+#gzNc?9Q|1eK0*Z$Q!jl3vX?cjD5*_V6I4noZcWnjGS^YdDJKJ<1;Oa1NYycvT}
zXgy*NybqIR(|%j)g|K-iLFTM}Nv>1-JgkfNA%j6y{q`wBR&m?n910uL!7N22&8;9(
z>FjHtlVWcK6r=Z4{sEW;so=hUN<?v5mVOqNp1+*u<=~k&Me+>1rP7@E0NPymwzP{X
z=3+S3%1P`}3c(W&jUH5^2gXH^HUTvr-s8pa;_|LU@Zwyrylu6w>sNjGm&A9_`4-FR
zF6L5|u+zkg1<4q>S0;!&UkmsD+1vL|oVMf(>2D@%gj_|M67NO6kOjnl2(K^K+*+7Z
zqn|M7Y)g}Nd7j(?5>9Ndn%9>3{D^*}$A#lJ3pU3k6fRGgtRYLIP?F^JHyPcuKKl1<
zDTxyS#}quE%mZArlcB}xz{m{VP-^*)Q275~YJYQlLeQz8bnL-n*T)A&<--PkMFTHw
zB)}T4_{dqZ$zq_G)fioz5>voO?VT$wuE*m09@^g~W^c59nwWiHkQr+I&#7l5SzfN+
zrve$&`&-O@fN@yl8nW<;l(3GxaKa($J7M8`K3wIDxQ~Sd5S25>kn)I!h1or{*j8u2
z3zolF+KyKRUA~W{W%lPJDiwwItlJpXVL2cAd5Z7lF}Fzn*qUUBpBGM)?IPgTeRIA&
zxwm(klOcYPQrUd{FOlpw$lAXbUnpNj>0m|mRLkZA;2d%on#HFYXVE>`=5BhGf3s8m
zF0VR^p8Z5yR~ooSlY!xw1;?fROII`Nyt4(-E57(;(^5dMWMWpvU!*C#>JlwD0te;_
ze3>uu{PQGDny=ECzgT$}+;U|Z0d2i~RXvgaowpr{uk)087+6%rxP%-;R=L*ay`If)
z-4S>7N0vL*$MI$GKMsA2Wl1>J;V$#}yAR9m58V%s{Y0H&mFjRdAQ)<qDqj9P0<GnH
z5|$N7niW}D{^21+;VHVCIZB#M_3`fK+`AIhoTb`mXM}DfCs_L0N6?-VIKI7<LnZtX
zL|O{>W#{3ZPpfIC^3!#ldWdw}VfmJTNeh7q0`@(}y@d^od3BwaQ0BNp{VhjCpE*uA
znZH%v3^nE9bSXrJ_Ma!hr^&y1f0E6=kUM8_09wO}`uX<_nbk@jBT}F5+;OwkhU!)g
z+p-SezFo9Kxrikf&{f}2v&MZoUu^>sxvsmwO0TIa%t8VHE{EDNK3+FQEa>Cmk0DYR
z@1`qMuY>7*@`fU+L4|ZJ_$?uwAzhIRE9D`-s2E=&xtL4s9GE2pf(z`aJ+2`^9vy4Q
z#LFcZdtOpT&!q^e7!br_w7_JgUw-*(O=$1XKTHQR`0y97S>+E${m;Y%jRxu5EC{D#
zyjru=2NQ@HFZIMZIRh?$cFrWZUO?GbfUK@Q`v5MAF#zI($C?d<hxhw+Go0|-8g`si
zUIJ{EsUq^jec@mQX=joEaMTC2Y#luc@sOMNOOA795iWt$Eh~Zw(pz4DXeT&ln*9mD
z$f_b}HNI~W-UQqGRAtFP`YjQ+wcmox5coNK4|EuKvKOCwx%0j@2IM5pC%l%wPy2rw
z0^J~&EenZXhYv~&FjzcpUl>Xg9~836(#p9%QnU9kHoH%r_BVdI&jmj{Q(#|P$79i~
z*k@`zdHC54vIjUP6P(>R51xpeaNh^a0-g5IEg>V#o+PMM8(x^T^}F(<0O8*(=(IY9
zo5uid-X^8}+*^ZATx{&i*BYBqMQ2wgb8W02J4s1;R6Kn=>GpGt{m1n!b`5O3A(rJ<
zR_}Q>4=kp2jhqYo8_RsqAP(<T%Wg@)NMtp0_{-S6)Pu(p`2`@W+D=ZHQag8iv=+_;
zh<w-NGa9{uhkbsD!kG4M5(wob>k~0R$-$EfNmhL7W?H5S+sl*o7|B&N>WMR@H!Knk
zZz@{cwEiVnR*%Gx;{Mzq)m#64bFb__Bk~`&vBVOv<PJe`+||Kmi3}?F-5<NZ%n~JX
zi&aF@=$Ljj{&Q}IHDUb}61%|6CmyG~{;qy4KS$^Z_84-~L1N*;%o%u7C8Z;|(X&2e
zoF|Ow?Aldd(~g$RFLDTxoWKu7E`g!{YD8D@h5KqHet8$+H5^K1ytc`e;6KNSzlE-g
zY<pKO<Fl74;FZU0cc1_$jlvgrW%RQT)HlDgQbuZH+4rr0BNI}7J2HWN_t>XrBrP@U
z@n7iTWKKF{Z%rvEE@8vk*qIreBAgOPvmg;B$%=G_ogH=T>srXM9#cmov-|%d=6T;t
zO5;~O?bUPkrxs8G0v1LV7SiVArYjzoHD!k{KZ}!>cN%t5NSo!i7vv3@&p<bGglC=I
zbTZS?p1MnlOM!a@C+QLaInFb7n_S6<=j%UaeC_ic9FExPviDQ_mN)Yy+}2X_9V!zc
zr#Z!cX`X*;q+MzJmlDR_+b9*pMm?Oa&-eSNc%ZF<wXxFPt>C$v*oJY@d;)tbfCR(n
zXHao_X`chFqT+oZA<f5$5S+r~WQ!<I{gHxd-_IY*6m7TsUCg$os=<C|C;g|5$9P{B
z>kArQxRLx90cphrx1T**ad3IH3~RA}_P$6-W<+<w`WhECUWe+PkFRxkv@_>#1(nM(
z@!DKbtfvL->KAyS3K`X4YYS$r&qqJ9AqteuMjfSIe^*HP@g-oc00IRMq(MmnNne%5
zs7rI&SIwb5%1))ZrA_`>A^!2o{O`he8D9uW?Oz<S#9{b0o{O>n&H%le9iVww+96jY
z^uROgRxWs^#@8jFNF?-V@tN9jqL$t0GM3A1Q5#|dE^0zfl=Bom;%BA4&UNJ}rPYw_
zPrURPfR`@A4HMznP4vR<#RLa`ZUw_R8C*bS1gO@0X%{JL{3gKAoW5<#^dH`u-(H^*
zE!;cB5wZ@k8p;T~Y0X!BSmym|fG7qs{oM^u-wHVXC<Zu#*}Bd;GiI<oHij0G-$M%?
z^q>}0Hyllf#I4p;Nf|OFD}4~S+m#SrM)3v#iZB>9CW=9b(c>CWo9&eb!HmoG<zQII
z1oLhy|Csq{I##3lm^in9X>hX9WtslXC$iPG5XBR7$Ggq{uDdW!V7h%8t(qmnG?A&;
z$(JTnt#6ss{i`wFped$bi8K&AKOn+-O=k_!s?i{ToVV=Y;fWJ#dvsk+Fb?UceXTk9
znLp95?)%E$+S+f~y#mwp*IxSwHqBG4b<VM$(@|SwO4rrDZ+5a^PFLz(&c67#_BP?h
z2g%n%>D-roY5MnisYc|o6`(kPT)6AA!mMHkxo*mZt9__^S)rz%BczE6X)NzlRQ6Rl
zys+0F(mkXeN<e@BcYP@4i=v8&Ex#xmm^HI)$HpXGW4DzfzK5Jy^9i^d6Bq0yk{Ma1
zCSCNn>(;OK`olalhoS7mIfAhY(+6$~U!uWo6T@m{e4eg%bHPOa5PW`*LMv`K)j>%P
z3Rv{g0*k^#j_G^9PWY41odR7~WvjgIIUTM|!RpRi`QQDC&3K%=vvje!qf3W3k#+pM
zg^x($#gxHzQPK+cMDlQ2t+g=Y_{Zg?!#o-Mxjm$PHob|Xci5fsiD}z7`D{W)>b0SV
zAwxdmIW@=#&t;htImr2Oa9JhMX1)XTX2Z!MpJc@D`+o=-|3lzpw@EF}G^#&-N_2l~
zlT}U9#g+shabx!ro^`i)AE@>SK1n@L-=d61)GlbG5Az^d>CJe@WUgCaGkpMWES^K~
zS{@X?DzNhSdT7%7ww1D%;NT3_q}R|T&%_uo@&<n}XD$j;9xpx}`0k{zT`1Ql!Ye2z
z_z-jWspNYq!{<q41m?W{xChh1V6Q&8GJfXThmauJDg2KGBgudTi%;){pM@-aX?fc8
zkrHbLNFd5ubz_c_<i51=!Q#A7AXr_wGVN~byBAA`Nin1?5GODCrR?ZIWNM2J?-Rno
z1cULmb|yOwnnrca2=QNi_EU1yxt+Sp7*P<wXP=)v?y2xTKx1E&sK2|g6#XF`H9cCa
zSH{Nu-JQmWUF7$T{`)iFPtV+c67+||em&rQH6TX)o5Q~E8YPya=(S-F;IJR_<TLwv
zV!P!{W!Q0chd}S)s1P@NAB(vjgDnK#rC?)JxQDuvPl+I78h#WT8AB`s&v<Wt9BG2J
zP4!xQ0^#{}?1|TN1kl_#)3LP|V^0f?$j_MdscO8d>O~?RTbC<%S9dX?<m}%)RjB~`
z%fGMmf0=8B4Onl9tNd!j3VbD&EFjy$y8Bb;-Hqo(uDzX*y&>zU+QJcCJLj8T{f7J4
z13frtfizDwf4No!*q45fVl@7CH%qwXzA;bE2;2UR7%nLDz!MscUWzBW(ocRRu$N*B
z=S<Rt^V_9KqJ(*u*ViOpFUvq=miiD3><FJncPh=?TW*M6^}^=!7=A8C+V}kU=`b8=
zRpZWBPMEjfOzKZhgzV$La@sLgzj4}km?!3A?DeYS!2qXSFJSI>PW$6RRJp*WIy$q6
z;<cV^=@iI@nIcw6mAjdn#>^-s_c2l1vh=93#!@7JOh~+$5Heg~G7^6bPY!8}I2;A9
z^S6oI&_FJ1zeOVISB4DVw*P6(`}YI{(5`4NA1DZ^tRk?N#85>C?c7gX2Gz3zl+G6-
zO?^1x!&IkD3lr?9mCv<dk$S=KC;9AN<$P9EVFTWq?1A=F-r;veMuRN9bl<m<Sy&}?
zUC##0oa`R7#i^$l-&m&}%5B>LIE0IH{jL3YM8^e1h<pF#(a)xF(_jBkv0Q02DGtm2
z+1dl}Z8jCB{gIJQKVnhL&*nU|R3Yo46o!xvb$zhdZ<1}UT>F^UE=Vl2W-W%?zp@US
zujz7HTra@1Iq>h{n600fK*%r80LTOvX8}y-_~rb57C;0T^*pBkjw1bg+-i+*c%|FE
zsF&9WwM@0;A%E{Iw_3}d1lCq9<+;|vh(79o>+W1Zj_)-tXNS!wF6IaJ|IwPSKyj0S
zvq5g1lBRtWJ?yhy&qD6SMyf6=FcCC{e8m0brSuuZsMI?!Sr^xs-qdQBG&ghMEuUMs
z&%#19^te1-xbq?HaY@t~dG4Wn$$zQ)0Js7-d6uMD!EeLvv}_c+XvUnngt|BmVCnzx
z_MTBqZu{Qo5>areR4GamY0`=GmZ*p*RYY1Sk)R@7dJPdldQp*%fb`yb3kU&ehTa9F
z2c!f-3k2?iYp-*3pS^s~d+!)`3_nCZkik>t{Lfzn>HzSu|EdEh4Fg&3y_B3;nl*KJ
z6*J7?R~fABQ(f0U5jmmAI^+5|Tw8le_wM`0`@fOr-fa8vP4|(imunv$-w|ESA@n(<
zqv-uHXP~`rDD9%aWHWEsNlZC!GwaC3qs!D^<8?$FXo4cOipruG=Q$|%={lJk;+79O
z$cuib5zFCx5OEY^zZP=DyBeWWA-diBBputg`A{&<V)TcOyPR|S?c-p`6tlzLrc&`-
z1|tBGB>{?L=9QQejI5ugwsc$T&tFNLp9vk{^CQJ%o^4FQ5Udy4`^YV=R5@OdVha97
z4!AcZ)R#?XVwy2AJg602aK5QP|CQFg_A`(2?|)6fY*Skgni0PY@Sy(VdH-+WTMqlx
zulBmVknujC5Wp#n-fZDPHT!3HnZPH#>mbIYci6$Ffwk_P(HE~%TK<huCD!1J{FI8j
zauW|X)3av;O&22lqm<kpR(@8r{LPal;%z~mEDc|Zs{2<Vz<A|e&y8)7C<$d1R_NxO
zjM)`>X<V^RhB#0Nuo43l0`TbSD|K7W>dLK@ht)mJ1=gJ8(|lBHez5qI$h{o#IIX%r
zX)+l-nNJD<JRTUv2`!kP6ap+%ofHB{o)iL{Iw=HjtPi~`BKnL{4z$Dg;vRuJd2yF*
z{L01R60B|Ui*dE$3T)t!gGf@#Ka9i4P?A2OUKXcPZ{Nq}Z(bk8Ec6O8^(hFr16#&y
zr<2;yOmkLKj8yD$4q78g+#-@=7^WR8wH-Ljie>QQkW?!YfiT*+Z}jtk5c1gu0rfIe
z$s+S<m@9u=KbtfZp;bI4wRQ86^;pHSB@4XNo?)B#(LV4V0~36M+UJOa`=YBCiq_}W
z>&EU;DGoEh_x{uJ{nO{~I;0kTY_ylnBW?omXA$xy`FPA+=SshlM&#YNn%9ZS28<+@
zHURXcScQHR(mdDhV5fr^>fwos@`Ng|hH7(EcWmLe2=1$owx#pzsdM9U6bucv1IwM*
zPfcD}v$Z`_`PyI9Ugw`4)kd59$xy(f{?uhTX-vg{U}l^o)!O%HzjdB?`w^NK7$zRP
zDSvZDj&t_yJP5BH;uOS{bmwutX`-uyhVjB>jy;_r%<f6D$i+?%tICGLkUzABuMFS$
zE>t1=!O3Mmk?@~nz`#-9!Rfy`0(f;@fR2E?ij$52Gr@y*1@SdpxtH{uM7Xk;OO+km
zZulBX@UX{J%Z1G_?u(%N%~<?y8tMyUbV<{NJ393a09>jeU@MaP(~#5Z+J<w{^Hp`T
z!Pu`SzTKM|RE%=2FD_h3gRtW7C=UPo_V1l@ZXgYkk=L>!EM=69d{+s?HCH#xJYqX3
z4;Y&pODtkc6ShkDBd9n=>HN~{V$<~$k`Vn)1E4*CqAAL$j2uPc8!nfVO$gD)D8Ob}
z@{=BpxCh_-`hqC8Gen{6<R5nBl7ioMXgyx&oGy@gCE`7Ht}C$~*%ea^%YE&zz)Z!V
z6lOKQ-i2Ez{SurS2Cg6<w?#?gHlx`_N8d>-!Z!PK&w7+PUGy$CZ9@a?fb^+%Lv7x^
z!F|IZHM`<>Uoiqf5W&@+jk~Y5<?u=&Swu4q%)ey><7vE&G>`8<B9DSv`KW>8@MW$U
zD;x5PfFh_WEI5`U_T_bn>OWDfT`MN)()QGPUi0v-jP_gdLs^LwjWHgtW1Gb^DBzo*
zt$kL;arc<UE{4#+S>X{L3EPn?;}v4)SK~>+vJFI4<}FM={7YwRYjV?RI6jTN_!%!-
z9i!dKyau`hy^RaA#e@!OSchfcX^X}45BkeHXS|d01mNm>8x6&W#cFmK@y?k!jdh0p
z#n7Nmb;R{65}T{xj1Z^i3H#_#yHRsWI@1Pb`w3rHoPLDq79k(>?4ePf(GXRo;pP(o
zWJ&|`ERZC6a?jgHzesHf7B417%xWbOUgYUD<S~aFA50zS2pH}?AJw%q8_3cGc^$Hr
z3-Qmig~wBE$4k%?zcu@}Z6&%qmfL8omwn$EeC-Q(kp*Nql(07z8Qsbe{{9H%cub@W
zahS6AnsAv)f`5L)Zntc1);1rFV2=`TE1|pL#i~=F$C|5K7$ncV223fK0Ly}EnKj~;
zQ9gY2mq*XL;a+mK<FQo%L>W-RPb9D|%xQIMrkVFCWx**@wZV9e5Rk_Gp0S1~kej`o
z<i%j-fnl<a>;mY#X})KfH8lOI>eX`_E7mZHn<dK4n7d{77wC8(K$WR=hz|&(XL(sm
zizyv*C2x%2rnX(4^pG353L^3GyAXgn-V50q+7G|<YW=16>6sAWt{^TX6AP-r@jmW5
z2%(qYg#BK1h+myqO%(M<*UX37p<^i-JXoS8mk}$&yW#WU!)<;3l4WDZe%hh95(l2P
zd|d%+asSx>Q67dAoXceW)#Zq*AuOKXeO<TG9cK7>AdCh~+Z?*8`+rGFZ<3MH3&gNx
zCTuQL&1?!gQE49xz>W#g)1%Y}qZk`LVTDI`-;`Z7y!%kgU-D&=L1_(@!`5pc920uD
zq%@3{cbU?x(k+Bu=BYbMtJ(|_UNo6MvaTfZEntvEjHso6X!JRrgy*-aRNGj78uq;#
z)F0pMJor&<AtAB;p#iUEc!f5&r$vkAW5r5RNP0CNB_WfL_q3sJBO-}s>bzYaAQ>-!
zGpYnXHTELBCO2>_5mvs+5R5aiz+E(F)g?*(W9y{d0&@xnQi3Iy*=<@FnQgbH63TKk
zlIq4%FKx}0Y>Rm}Ih{6rOt8s=X%gyh_g7?8Exc+YF{z?gXfdkH195*BEmOO-x3(@E
ztea4&JK-@Kq<3J2RWqGm3?g3;(y%=b_~qA{V0l5n?}6{dG!=WLAGu^|6AR~)_8YKj
zX02O&OvV$V`_Xv6VW(k)WQA4lx+h^O7I6(&Y1Y^`#-|SD)MbeiQcKASvmgDB#&XDA
zNZ4EsnPwG*J<Ts<=LRbVvj(pe5RLPo<tf@$Yc~VrUaYa(Z4XWb1bV0kZDEcxt7gNd
z(77;#A+__@@+q}_zZRy+7s^0Khs0X_Zoy3c6EBD349*7-B3=u(#6j8Sag2S%DDSRn
z=-A6JGmNU{vZ>wHb-TPPdsPHbhjLCNUV;J3{48<(_(AaJQ0&F;HF)CtP!?J6P`*K~
ziGTj&<eJFmh+n{?9?28S$j!IO{6x)^KLx>#YL4nNOR1Xh0PX!N*eHwO<b{}u|1SL?
z{;Tw3)|2Jv)1@rXebAYHjA@LSLsx{am+^bGX<d_<m|=FTX`C+XC~R3&*MZn)F!{cC
zoAXpbpzHU7a`bq;u(XH0s`QH|Rw|H-1`=EOg<o7dV{*ANSZ>^?*RN~nRy3ruThzw1
zYOcriS$NGfq*sPY<_#U+t@NKjZgqUUePN*zdc0Avi;i0yYH2%~Jw_`g5$=7Le`--D
zL`<Lhaf~RZnP#{@oC&-B!G2jEEgZu)jKYOxrg`|8p}C?xuN@In*#gdle+l2MU-!Yr
zd9T9Z^H*9GR{UDCdedbssUtJhzw&&Qm%Szg$Tw&GR#0rVvg<~;lIR9L@NxC|S<$4U
zU8(7pKC?Z|6v7WfnWg#sGG(o)KNQx@s1$?GMKT!geXJtxqO5b@BUY)TzHRfgeQ-Gf
zZUdq~yJdSAA#A*zV>*-PxV|NO{4L3J4BS6!2KjpQ%z2)~>nsKMi81qswE*x=m1K*C
zO~c0<Ev7%cZ$QsPDQR3`$VfUKLn=B9OP^o3W;kifzOxznW=UD)s$hyxMoYCTzjwtY
zO`7o7HXucu^exyS<_>&$$wXa4cPKM4-~Zg<-X}%e!LgeRw<^;W9wRA^$^8%2Ae)XJ
zbr;Yxd!xfnLI2h>s6+;(dNXCi<F`B=yB8|U_l_J<8)>7>rX3U1f*DHcjLh4X20=}k
zNH3j)BUowhVh^qJ_l6F7MZ(_Wg|1PM$tPC3t?<I&e1rb+q5IdX39?fG=wP<>S=rqk
z;9yJO^Cn~Syc#8_f(npbE*Gqj5+Rnp(Pi0>+xtdY7<7?IqNT!m{8jF039AVze@?q1
zdIi^`d10@Ihc3Y@Y!bGU%$4sfn+bZ=_HJ?slj@UZV-122H~lMGTU%!+87^MDh#sRq
z#agEFc)1J<a#?G_hAzV@E;q|J9=@_ugdZa{gu=cxD{*R8aUFYp>xwPy+dW)|?<Dm3
zcZ803Q?hhzRoni;@yOp#-tQpC#`W>0o0ia#4mV`|gn~z|Fxhj&yk-uHQX<RLnDNY;
zo4e&^D)6{v`R$F+syxQ|hjO5<Z<tv(@hgyRP=5a;Bdr4QP;M_CYJBiku7Z`LaeVZ=
z4NOb!lKk>lt(ng*Yb=roxTe3y^s;|p9kyw@dnTJKG~_kXidgY5@#V^OFON|zwEy5&
z&)%8Mfw)YjKL4R|PyW?{^++%|b|ZqjHNb8^T*XZvwX7OfrprEYwd-?~FjB(x2XR=G
zN?P^l+biUO-h>0@!~CV$HVyL0wfWO%dyfU6J8Chly*ju5XrX)ib#h*#8k6MN@Vu%|
zkDo819zUuZ-#NG8|5fyhl%!4FH!|y>rF6=-vOM*%#9q$U=z=5HxwmAqEQ=_~BYC2I
z^8RWd{TUmzPbF(q3w%Mr!VO}q235&bW2uVCWWO#%E+-37r+`@Nz%|anOtae0B?zJF
z^YXN6w4v|B@oq~hmXQnDZcuD`w!x5TVD5lIc44i?mfYOut^1-}cM;|V?d3+Uf@iV8
z6ls;O^gpMzTmnjR-|<S5X<04P+qGB<I>^XL<I`;1J}j@4f05&HkbRhRSi#CIvh_Ok
z{3$8n+Kn&eAm_p;5^FGQbkS?tPRqabsPKxe^q|Gz2-|RLlwZck@#odz+{6iH1;2|S
z_e=evXBnm{g<SnYSuf=#&LNwL<2r@LvEXlrXTiv^ZepCU7mlB>+k}t-whSAtM&Zb{
zy=H5>zWZkHSLC7#GMb)sC1~&T#=ZeBg;KJYZmW?9yM7BcMG+TT^vzK6U<X`uus@7D
zad&4oZRNFkNPEO?nD>1#<46Q$lG_57QPSr23nL{n9as|hlEhbBmpJXOCZZ8KaxoPC
zB}HIVdnx}?QuR?s;$?@k<=M4g$v=l)^&~HT_)$OPo6_}X6u?<ohtk2VP9k*%s$mm|
z&Ncu{VV35xfGJF?GAnmGByiAE2{`p^i+G<*DeP_Q)TX<WLVvKmX&K|9w8?Vk8LyB)
zV}y*E3yF<o)2C--N~aEY-??I?$ER+O_Z10#6+Tq0TT|#asJke)yM%i!(#_IF{K|^-
zG_gzK-j&+)wy!(q{Jpp^+`NAWyRNjm4=fKgv5gp{mqVA^<PjDc7pTZp;8wMmC_58l
z8YT?hySR7@7}+Cs$7HLXrSMo03Hb9U$D|i#F7&%C#?Fyfc8~TGU5^jGgoh))zuNSf
zMh;e@=u!8kOeZ%AG;FN^+**lFY35j|O6Uo;kL%QWSjY&mpDb=Iq9EFJvt5zpwfmP}
z&b@>Sr;eE8Rc}8kC!~r!K$kWE=tCXY<0dQ}eDJv7HGAE{U8-yR!Q@f*R7hB9W-_04
zX<z)?{^lmKA2>T&Kp)jQXBwKk7@xtq;#Q_K6KEndmAh=U?cc$5qyF)Vu0*R~wA|%P
zq>YZ4)fl~k(uE*12AiNHFK0WoT0nVhDo3alx5Im6(C^DYRgcb8LKylf$B$b3zC!eL
z1|SEy4k^VAyvuz|%_~uoE#eGv^uTmz+NU{W<WW#u%wBMht)zwQRJ}}~*hF*nQsC>8
zQDmf?a^dSq44cfU0;ei$tL03-t%t6g@UXFiQ-brDG!Cb6XqKnOrrtXKF&eh>dL(9z
zdhJ~5!dDmK$1Dwxt?uF7JEKN5trhsdLb+<(T~ZQ=3&u1Wv5lGu5uJh_-nP40!|y&?
zVm8ykk4g|W?_D%|b&#;H$mueSTrtpXDaGc)e?2>YzYRdIB~S56Hlov%pEpw#Q>@{8
z=}#Bnv|C*t^`nkn7(sn>a&p-M%<^qivIZdik2HU9L;NfJItQr@o^$-Z11bH7iYYk@
z<WU;0N6OxPR>}qYKMuVBxyyeFDoyQME&*$+gL7RGZ7mcJDfjaN7gpznxp!lm*O1fS
z#OmYqX5W2~Spuf8J_Cq~Y?s}{bgpbdVM3k?T*P+8W;}&0z9S&<^6*7AJwyJc__p#9
zOl5+RifdA6el8RAFg*!1_rt^plwMw7mb$*Y?04za3zs2tVM$wZj%PZ5epp41!&pwO
zonBCP2bW=nz}~!C87(P_!DEzJa6d?RzMf`HX?4&G|DOS`C!|1JV3ih<HD1!zc*1=p
z|M25(9{y^|)x2xd*XnL$gjcmFpl+Pa*8-Krw3rNKVPxR#xe`vDB*I>SdNeNOtfBA4
zuVmWjC*Kw3N_2z5LG#yx3%Fc(-+;Y22S{k<6gT+omgzI}BszhB%^{O9-%SyXi-RT~
zJfXQ!;vEV$q_Cm+yNH=~A5cLEFZbcoMRKc9KT@a+VzK&)#Iix3o0ZGmjSTzzR{euu
zaWShkVI`dO$qp}d%6Ei7m^`qB9Lszf+9q|K9sd>Ptvz=Nn;1Ekf>*jj50Al^{-CjV
zn;6-Un(zENn574l4^#_E)^ZTj&4A)m8faC6#t&l_x8$QFA3V7Si{aEXR`uubyJ*qh
za>HNShBMqG%!v^fr)AvQvXKRT!D!0-Aikg)08XwmI%A_F)sQQFo(SpDHOHZbL&V19
z|Ag01ev-^X4#3R`_)eqS$Et=vcM^fG%AQyrqTwH*kdoJ;cdqJT&gI2F#f~~EowOeb
zR_puEZ!c|So!!a-hON&@!^62lEsju>Bc)?dnbT$O*W)(Is4q*$wlKT9Uo8F!2^^6>
z`BFom%2G7exF5p5tTK%Luu|A<B6tRxP!}8gCRgcIev46HQ3!~F?<V1;^x^&rre!%4
zcCLZs{i4Z-$+ORl#mjkEt}-N#=Y}V_8c0&<jpOf3)NgAQ=V2$kcrO4!{Sse3>;EI3
zUrXk_AnDsH?eMiko){6W4T5_>0dGER^z>LRUUwB{9mjWh#==J6<~=TUZj;C;>GGEA
z(qufK$DjR^{Fz_f?u1@Q?nsw|HtSgiJiUl3+ixfns_w)Mu*I?3o5(1b&lMUe|M3yu
zkPrLbm!SUZbMW&lP!G&m7fntgkJ7D`8Ka`IK?dA@(MI~6o&`_&!Vk-Gyw}>Hp@ZDI
zZ+}?EVEd0$iu+*Mp&;(4Oo0oQH}?PRPdmIKdY=tK`TBlJ+L#nLpIzPZxqfP0wgEnH
zSV6TRiZL{@a)HpGz!>uDmia4^z<2KZLxP!1gyV>zz(N*afVv@c!OVudHu4sYgE{EE
z8EatU^(np%sA_QtU9NO1qhNfC9#A!9JvbcSW?qw5rmH>WLhjS`&wnZR1Flo`Sc6Ca
zEZ@mF8oi6y2{k`X*W4ObzNKdxSV?2HrEuRo<EgRbBl5>IzPMgpu=OkPJTq08B^MRH
z@pk+D3#Nh1gF_lB|5*+8uZ#MFqiGAnYd8+B4MEb;_ELDQWvnJ*;ZM_RlGeuO#WK?X
zmEpaVeEWOf&&2o|5<1emsd(&k5%$+MDs*Au76t4495mX$uG2rSPBAw#e~=~o+Ztk;
zVm&tf5G@<?jDeIeG2K?i*^-~Sn#XJQ<Le9)Ly`>3+!+^b=`&5-SP&AK-6g!67J{aP
z$m9)eEy!!S>PkWf`Gen8&B*{P=tuj(6H2i@8>wT!hKS6xvXYUcx&O!A_gsvB;Bkw%
zph5nVvgR!+mEdqGI^f&~j5QoQ;XqmQcHV!LHRlVzBK~T8`?obg=GqD03fOXOSCYzy
zgxQ$BiAhofzX<~QQwgMEm|qF{z2q;BaSG8F<&<yfZEIT~1r;h?uw}?S>)?i9;j0do
zYr(x?%gs4igPJyVe>uth`nZLi6GO2Z0?f$`=k%k%XJgvi>5IxpL5igFWhv}zGXe;T
z77hi{)_ZBPuP&GBtFAn{XM0AJ=cAtV85K()6Dk5$-1W9LgV6AQXwc*Pfy*Yyp0qWm
zMXsv;XlpL3J85f{2rRU}epB$A>q%R)WE*qCq2|BZn#~dwKy5M$8~px<Wi4w~#P`2z
z(tb>$O}%uVSepA+TQloPTXS%8B_k(gih#G(oz@tsg$>b#_H{y}#tLI+nIFi@{*<=m
z!^$NG#2tfeeU#{S`|qScCxpqp$_Z^erUI{vfAk?09V`9FhP;GPFj$0M`9f>v6L%;5
znS#m9r>8rbp#qp&YVfqOh)f~*yl<KUTPNu{<~ac5;5PqpUK3Cp*!PZETorlR@%~B*
zi^VSozMmH*V$dIP9DX+K@fAy<F^>1@5y6y#T9l^dsbzB?xiktKGECmmvROWbD#%+D
zg}I@#z3d~M2I?fd(51#JpA9OMZ^fLENhSdby2^Q>frZdiX>{&YyP&4FTN}Je4P@wa
zEId(XpOe!vtTXb=Ee|aL(7=^x%E;4-))jDc&=|ec*iX}F@>LPLnL80bKRruqq-jPe
zvdhm-pKI#7dY%aCPBoB7^9Nc2wgcOuSK<J6*7T&YnI3|`CY5!(T`9~#*Aepi|HZ{z
z2RXFNQJ%RR5z_!%krv}2_{&f4Bfyq_Br|$KHPq1-vt6f)O9@c_k-P~-1Tu@6{2zA_
z;G${MJXbjevTIbO#gzzaK*k#Fkn*u=Lme1_e`KDPZLm~W_L{wH;cgKr)Ym{2Ev1^6
zQ2r_vY`H|Mq5`bdI;Mm73O414b>QK9k8?04k>^nsITUu*gFHjOSxO(1lv8EtAm2Y5
z{Xodv>5KZ&!CWk+{Uv_)ye3`d1$G97TSK?$H{OIOMYZ+lf`)jbJZZek!`x;@<=kS;
zLZ%J$AycRA+=yZV>&0JB-XhiC?F}qfuOdo}h@koJ0Id`^ID}Dz0T?H&&q=HDNhC=w
zMFwf4sgAjjhTogc1x`}Y=r&De4z>(eLS8df0RPJTeo!)A(e1M3aYu9;gI&Xo+anYI
z7={Xvowt&K67G4923fqurgIKbVpul;uPdgDEwG5N^!NmS({QglgE82x>?PQXHRKv!
zV@!G7Jb&jRm6g6y@CN_Qz0V342|1V;fXEQ%_9M$p_cDL|yWaQ{px^n<2_daT;5)c!
z8hNuze?VCME5NS`ym^zWK-Js~v>_*^UFwCl?nn5cWvuTw>|r}c%IqI-6ov=XiEe8*
z=l^Fy?yr5L?EVQx|GfY}P!=oj!#az3mwdT;t~GX0S&ZM<Z-2WRsBJfImgs*-UdtFi
z03{53FCg%i|CX^G;}J=o2Pme6*xma*!@y>zjV&DGkK+$-%{HKU60E-S8cp-euJoR1
z`JSH`X5M!D+6JHB3dbX=o6EG#sZP+;&|+ihhn0qq-QkBx%)hzyK-O{8O+f-j%`@BO
zqyZ(<r<mtiWg)oSq#7<@KP3?{!rX*}Yd&1KfA17UuIru0hkSlXZs+Ropzd5@q|$aQ
zpn}8-+IIYIcT-J9kaX+bO@6v|gJ3phS%6aRR76J36Y1f?r)Z4KxyI~W|CN=)o5IN|
z8V+RDox6ru5D9D<=xt6&Ech!c=O-HUm)-j1xiXcXkSvO(a^dBq@6_^i5l7G~+MeC(
zf9i;wmwuFfuQR5Fq)D&6J(d3&X^5Wu!wl+ZeT5Kv-bBWQjYV8d+$;B(p=_`zJS!=Q
z45`&=33=Bx#6@~na+OJRHWc&`n~d+yS$UU$;A*dU9-w`iHHc@Xt=Oh<rlCY|{fAll
z-?rKxv$q-0pYazClp;HnsdVM(a@68ds@Z0;X31SsLLW5U%_339-F!J}TW_Z4KENn1
zOJ<M(daCHfh-b<ngg!%k17pJreGGKH22BEUn(#kQ;&$FA`0z?N1xwA8M@h3JGP^&l
ztW)1U<v%YSJN}lScnyh_Aqi;0*b-i-S`ljTp(`-B$a^VTv)Pb@!GBtEiae;E1B(QU
zy>1`G0XQNEm^BL5mmgl_yej#Mb3*y`(6vKybU+!SS8JI&=N>SuD#dHs<?~dwz~Q)v
zB)PIK>eRz*gMmT!*1;j3p`q8LuA)_tKbs;0eoJSwp6EMImbtSzu3~+O1CT8sZ6zB6
zj<GZeD6GEUqfN6=9>BTD(FHdgY`ik#dOfRZK=AzMS1&0!!YW?^`Y)<i?fEkM8IjS|
zIV%SW^ECNF5(R-HMpiB|D{Gtb+tU9*mVa_0q9qZ>hVwF9c~*!`Vi{0U=-wU{vs#@l
zVw@4U+j;G9lf7#u70qL(lN@vUkBssbs@%#~xX#b133JJX31fJQ;a!$bpC<m1LuSr`
z2>k<xd@na`bqjb2QXTboI$&jty32*_+9jSOl>R`PTrkXmGecu$A|U<hwE`iHFQ$6U
zP*1tB1kXIJi^PkXf?nOL&w){8h>3LBZ>23uGRL-1+HoM6@kXBQ_ooL16DMaeZzG?^
zJbg?s_TY<E`KW$r5(CHGkQ3h6j(}ZkeXGQ(<=Y(t;y2!Wr|Vpi*1gXW=IT}?X)sI$
z#0^_9yH2x%><6;w&t1j<l(7`PsM&O>$V6~q^VHP&p{*V^F#Ha9_19wA?|h`rkC1mz
z?}tX22xd<az9KtKi5;y>wbj%&uikq2rR=3Id0AP^JJ7-{Qf{`DO-6#7T|sQ)=gtKC
zK3znM37Xf|p00Q-dO4TXZVql3hKr;QyemBVzvqt46^fe;gpqtYLIvS2o*p)NUKS2w
z=}B+$&A%oU7|~N6K6y&*@X3ESbUxfV$fH1?o(JiUiUHd`GIU;6=q-B778`&Az|mM(
z0!#FVod=+WPWCpn0EQ%SX^FzAE2i9o=&`34?K-(MS~q$29^d=x+;CHzR9$*IFGkAl
z;o+hggq~kVKv-CMd!TeSj?IgQ6?us4Y=Fw9z8jIUIrN1_)8S@YL&FIKHAUn|(KnFU
zms7Y(6!EFQy_;rBtgV+pSAsNu!+vNdyy?~c8Jd`e{k*Li?}K9inH@m4^CVFpZ$V&z
znNf11e_n?0<mwaz3|i`-Sv|gAK2RN(EI@rbz(pUdnbTSR8pMfLB<W`3(;cGkXLYc?
zM5OMQb9nx~PwMiPNVs0QTWe6nQQ%c>h+F$dxoiVt6}eW!0wnzxyyAY3BL51gH7nJN
zeVTr9L74N|JNi@%Nvpe0G?2F(JIkAGmmLw}X8lqcn21_4%e&Z*O2TBINi}GhuUe`J
zi665u?#o3C`D%bZiMhcWSXDUXZU5g>%JHoKPASWL{=cD=_d&&f$!Q)bOe2qX-%8=q
z`e#?}U-+)<vC%~K%1r4y1FEXJ&dQS}QbT^#>inmt*UFt-Pw!PP>a@j)=NbrjHZx6K
zf)Lv;;uaxO+IzZ%U~ri1&P80Pt!KGn!dVoGSPAf%>BqLnrt`+kZEVM9&wqL~JM{B}
zi=jOc4Yw|Yrhrm(H?3@TdN0+ODhAsG7IUxD2EPdg3bwaGKm>R5XsMaN{@}tKOhO3b
z!by&_MqQqL!A5S(E9IcryW^CNa8|Cg>#cs;dMQF))^XtC77)h$zZAF+Hh)pz+IYk?
zPS<#2Z9WHV^D9Gg)yCsy;?A?4_x%RFK<)Ciq&21p(<5=_TP+GDU~D&OY_}fD4__@!
zmkf<e;=dMCD_1Wl0E($5Ll*O$9ljXw&Gc*=A(Ajvsk4o8UYqcl4Mid?Lf9nPb@HK?
zhYcOH1)zA>W7#Z?CxD%PmDFpu7S<L&>G-TmZTM6da?dt@*^Xz!GF+ZL@%WHI$;ik^
z!1&O0!nK(azP+rS4|gEDJ$K51GKdYxp}`8y$<OB7B3ve%c2}{=fy0+fB)g2GJpaxD
znA~W_KU;p|`t=-7>r$`jc{?0X;7j4<fSd`;M2lj;EazE2u&ulAlEDYEdU3_!NC}(T
zRbAY{6p>qa){BhPFWvHLnCwv~Zm`f3e1xk%9=m1_r0#+^5s;^*tzp4VD?=6|Cb^ZB
zvKKag6@%m1NxE&xQ$-hQ(n&cFmsO7M_;W^qK1Bmb+sm0YAH(~UM+W79sBQCfkCHIA
z5S`+I=p^?R(F`!9sp@Q<mpL~=`wcTGdtJx97@mwbK{Ua<#v&VARQw!%P9&)bUHpmk
zkYYS&=y`slj#g5+8=|#>m9tTtI{a&Sg=_6DmzhQwFIiZKHCDFdX=wxEgRNg>NHr8b
z#?H|nk6sx!Y}BT9G2XUf-Y($HU*K6Ya36PVwji!sd3+{H7ETDZOgH)Xw-`(kD1R`S
zK!+^?mkIfLIWrA8Y5imSU|}zMs$x3fI7=Bp?%@u|p#V8dBGz{}=@Ot)2@&@C){kq~
zI0S-#rj%yokM{~+$JEN_I2GC~_1yma^sJ^^$ACEqz8A39m3hqJ<=9_t_oaG0fB`i}
zhnp8hNPu11c}$N_Qv@kc#OiWhk+y$yfk{Rn@C*Me6YN;oN)IIj_Q18xP*zUqbRDQT
zk%q~xh1%^JA)jk4)nhZ*TKSFb9AB(&x!EE$R6oebZ%UT(^M8+Divw=}vIXt?J&*<Q
z!r-JMd`1UV_%B<3GKS{4mx5kRikLF-OxDBWE=3;m82NN$iR3D6VhHu5>yl+c&C~oy
zulQFl3b;$(fbIe<)G2~qbjkBQdu4u7`5&LMCWU};?g8z?G?~SlC4NffGWqMWzD*;t
zJG18*(Cf#G*ccJ(=LwGA09%2}LTeT8#7=K<XsjW_v3=)9yQacLwB~v&%`kE<a8th7
zI=>F`Rank^XCvlD<viJNNP>ve^6<iOZHN?ct8@l`9A_lwpID@1fF(p0@*1@q?qiG?
zDKjPa_bxIVb9xlkLxUHI%RS%_K*dx^GmYZujD{F^dFZ0gW+3S|J9JrDBn^-2N2=@;
zti~$@y?~o|3DMF7wOSbx#I3-l-q~9T79gKLe}3KGdZY+URPm<+>`POBYTm%KBWJHL
zF$F^&QDLA4PNW&?Uo)vjk;7k@2KzJCm<~U>K82$=zcR^r?rp@#Si9G@1D(StslDlD
zfN1W%U(DgMq(C;Vws!6pWN7K~$-rf<(y|+Oq_3HT_&gF_rn}#<tM!@PTiX=+u85Jt
z`^b-rnh~w$KjcoQBWJp=7oMyVEc5xwP`~n?cD&)!7-*q;-Zydc*0Qcr3N5RMbt<7#
z*wDfN+z*<00P+jXJpS$9XlBoXX4it$z1620bZj~<TZ+M*#g>US_t>D7#H6YlcEh_-
zbX)#OVxYSrxpkoQy0R(93Y)K2$XFcp>ZV@{-@knyt9<be(~rIX`-M}JG+xJKV8aHj
zC_~Sx@t3E3;7<vFPChDqg?VSf!G3MI3{~yrz<!<oMSn(U6UXeIrziO;R^?9l8iUE#
z+OV*9Wn3v+!fNX3!@izt?=&tAQ)t>XrBY@h5t{{78{a7DQC4{qXHeulET0S&f%nY|
zoapLlBDbYFzDv|C*d6(4YXMk^KL7=NnF=;3fUnxCoxYP`y3DUL#%UTt&jPsjY#9OZ
zYL}QmD<MIwwGW~VGadSt+PyNHT5*RB{k(oB;&ufYosU&scmHP5y+CQwGv@r~xpe<a
zL+>Dc;gAumiYt?2hHiUnsSq#OteBIC!lY`bUT)Q#UpHhj-L>HDS=fq1tdX%wIz9h>
zoMRWMmERgpw6nG{e;z~(pJ1(BZtn&?8EK3WvvigA!XZ{(nT;&nDqe0Ul%P<~6so(P
zthkxzOj&jaL$udEWOjV2rUb=0xCj^<mTr*%qg8P2T8;eVhM#0)Zh?^jVg74_=nntE
zQiuv0z9J(+*4IE_BU$Mj^U)y(yfsAM?rsgmOhnS5Ax<?xO8N_;Q`X0llY70~1$VA~
zU%m$eK2XJ-e@V@u<XkgMAP{bouPuens7FZsEtdZ480VgNGoQc#7$LiqiL^%A@Ebf>
z3ZfQNV1JZs8=nPscnx|RFHv|VPV3<z{(hPQpFah^c)Z(xgUuwVKimKa*yXobJFf(h
zbzll<uW-iNUFTDKFFA*V++HXQ){a(`^LjbsW?WavGS0A34aX7}P|+<an9(Epu_!-l
ztk*ZQ87H>5$r<bEYNc>tU-LDowRMSST_Yn!CJGx2_EwWq^+hPQ(M4eGUScOf5#}-Q
zq3=Y~!@a(3S%V6zK#%o${xF%%a;(o(>!sT1=!X$J>nxP=hr_I+g9Jz9Mvr5X2-{7w
z+^|L>a$oCk{LFe_un^(izJ9rdzUO-FR0!;7GZWX<uYq3h>&Cr{ZYa6;nF)x8oX?%b
zrfZ}h#Emyh!6E}ch%Ua2sled(P&^Fnt3QuE!1F2Qy+9ec0$fG4OBc(=@tF4palGYO
z9Nm$i)+#IVit71W%DyzwJhv`<QJm_~Xwsq>n*XzmBLAX@&PC6>S=$$7A>uq-R1iu)
z<o5K5Dq@JbFlIoo)u4Y$(W?IDV`4{Z)%-i2Sv;mY$WLt?z7%i^_x+O^t{)>*U@ob$
zXd9x0tmF>!!VFx4DFwHqrgs+M1e4Sb6PM%1`kKez3%>-m5;C$>Y%dfVOi~RSZs=KA
z&$Xo^$6;&74$O8fowHNNv!d7}1KS{Aw3|9YJWc|r^yD^jt4TvPNcBEJ>L9`8z2&59
z^KS6U88D$&qs;*u`pxgsR(YY(m3Rpo)Y?bpiHjeAk%FEr5eV@!d_M+h6@+a0$2$4N
z=Dv2dACD@4-<}?(qtP|SrAw`rIh<$$G}s7|B2j`K5`fvOa6tu%2Ois1G~$a7870LX
z!n)!1cG*HKJ&5%eDC8!Lt1<Xudk<TBpfWN|5edW&fyOuytRYT$ZE467KZxtrGzUE!
z0xjZCnF`Z~+2ts9dTl1OJQ~s{_*8~UNlqwJ&hx>(>3SRDM&Wx^^#WLxsYiy?z&gQg
zvxvU`3UqTCvpA=+w)wTO%R&FD!(6(Cy6@x7EDdI&3AU-hW580K&H4B=W%S+J=HXT@
zS*H%5dZ8tVPH-KWr|OEYu+^!NVIJlJ#Z)>~TJs)HI5AEcML0E+(GM$cEZ7O|jC(H*
z(oFK0Dupn{PSQ*c%&30>S8Lh=bt1_yDn_yA4{%WhM^3jj*n%W|_aD?Me=N=1?VVb-
zV-qpl?*SVeoY2aQ!SsR_kmR6Piz7K5#VbGY&VYLTvDvYl^N5K*8fbcNh1ekt-0}V}
z`~zQ@<9$zjFXukbD7o6+7Fp<f&|R46CRMm!w&(NMy+C%Jt$}0>iUk}f{99_cP=|~?
zNLb4YI&>r49P+vmY9HA^^O@6I;K9cM!CmU7Aoz7<<_v(0*Wdq~3NB^@4R9pgF&c~x
zXC&lt`BTK#%oDn>A0<Telw=!q?{fZWWQ8q!g^e$WE|b-mEP89Jw9aJ9H*Aqm4jE|;
z9fS?`vVB<*1@1Fm$h%@vX0@F~Tw-&P&p?-UNzfaWi}~jHGqBIyL;ZvHqyvd59li3-
z^0jH#BXD>Tx;|Q`M8G$Dl`cg*?~IXdrODoOnrp=<AfNyuju_gSgWFw++Oj~lz;k?1
zR-9R4`;UA{<ZiHp`395+MK5PM@nxx%CNf$>-2#W9@b{D`Uz5Q$T`gdFJJnZE4xnMn
zW4;Kfae#>iA6jn={Rb%Q2NV5+tO;EOtTZRq^2Lc*!t;_om^rmi@1ss`oHoUoEUr`G
zqy~rk3o*^nkRUEebbu}kq08a=f?gZ5*ZiBLsF4pR()pTqjkLH~yc(9x_KS1N>)(17
z{-?F3AyDva`$<Cr(_0XCnDk+Yn`5NUyTz5If3Y`_4KvT(x@+<Yc~h|j^Xh#5b9qcf
zQfn+P?D7~lqW?GCGaXQwP#bhK8g&v1<50G@VD}>w21;)t@I=5wryajs(qdFUuaW?~
zSDg+IA{cpB=f2&B4sBeIa<jmF7KYi=*<KdSlq-|#h^SE%f*LT;-n>q<Jah?kW>|Cv
z6j=XYP+U?Z0bIT{T*A#MlJGwE?N<WeGFADI^iXA$^b=l(MoHZ>FVg&?!@y&ftspJp
z9N$X1oAqIkS^d!4N-HS`Q*VlU$*eSwp{ku{Ij@(Vg*BYApTz(`)U8WN7#^2mR<@|&
z$!`SUFiWF~JPGUhhksddjY6r&4BB}Df1Ci+q5xIV^U~nL!>eRyy_Z$N)De*C4uMm8
z#WWuJnc;gn>Yi497nSkoOy+?H0$ViR)Nf^T3!U<pPY}J6nDl>wes7kOj`cyt2ide9
zcE3f{;xQK6x;w8Dq1mXC%1=~K2M#@w{P$1kW<~bD>G4Y~m->N=%jWv8z{Pb!=lC%F
zm=%Xm(hNdCeaCAU5V2iVu}u4WXA_kCQ7%Ne^t(Dy%fnpdxNC*BO)rjbvHRe4R*+Uk
zrM>3=rTZn~Hx$5QvcDP=RHbWA8WYO59eSg|mZQ;*Uk3#B(;IVqcyG<eXvcL%u+No9
zpKI!xx4YE#*`GHNydpw6)8X#caP2xm)3|jEwK<PdOehSYlBoP;o%pYSiXR`esj>hc
z-G0D21u>%T!*WvhHqgdJ_p`U<VJUAboK-M6Jc%qd;7^ffg0}k|o6@8PL%r7y|D*zM
zKJaN+7JVj9i3kn+)?|?lgMKUg&G&KlfV^3H**px6-#2uCd-S-d9O$=$wN6OY^PF?b
zR4p4K8Tko3yozN}c1LL@#p+DG%wB{W68X#npI11pt*asiU;GHn`ls)(rg_fy6;jI&
zPyy9~#PUID{xc@$%E*gu_>NVmdfCq*;M#`!v5V}GPeQHS<xybq+FUQ?A4lMSc%ntT
zcg|gS?glt9+!hctc=3~=kdV6*w9t`iw;V+}ni7F9DfZQ$5a`nrY+&zp*f*#ruM7G{
zAg3dJLulD}{$c33X`XJ_fZ#BOSU$k>pYwVC9zk=s9sqXjg3)*a&vvigsOS|wLDLg_
zp*`kv=pU-XqCFVX_wU_k9=>emW2I(91${F!CJ{!cZY_6C0YV6i0+@Se{Egp|KF^bG
z0!FCkv9%#bu{&`qg?;wDu%~XQs*GE-Wi(H)wD(9T!eN2t^D19UMpTkq=dY@xN#9zs
ziwVDtVMG`Exv_fI$TC7GEgj2!XEu0wwj+IpDo+29b)C+w`zMcGBdN3X2@`Zrw`*I8
zMU{|h?3<2GLt2D-mMtah4f5SJH7-GC<<`YD3$sLmw?Urx@~C3ZIm~d{H)jRIZZ)P<
zDMf8PFB)x|nC-b<I%<*(wdWiy_wRAvt-gdgRi@7p;%cPUWGwPO^vLSx1OT&iKO@=C
zOGz2`2~9qv?(y?x<tz?_^7nF|4+WJkg>7Ts-i@u9mnJO5(g1=R5W+maPflEezh2C#
z(_O%>&lE?iM7(>peN(P$em^aiCbdCKcPNU1!3VEM2IpWr@Af|CQ_E+K8(fQz0VDIZ
zFxUL2>i#_bC%FJx2;Olw^#$iN@c!?(XYL+$?*)F29(ETl;)yyQV}JIr&!BUW`yXf-
z{kcKEOBxrdx#($CST|`EI+;NoNi~ATvCr~6bJWIl5b*!gw*~QY<P4s?m|ZKSKu=_u
zcG<%PC}TwR{Re-OF$2GnF)h>4)NKZhKqV4+)11x+&;E{1!@(c+#;D&cZ-CwMgo5Gy
z|3txj|MjHt^L<oJ{u8J%Fh8gR9`EZ$QT5Ab#+8ZXp5Hx5c>bGe`S^os5wbnLk<?b?
zSH5ZKuvx4w&Url-U0D6Yq4&#g{QKqn*AJ5wNMv&$I~7Oz`fT;|f>B%V)m{}clTP=4
z#PvrP1>ejSce@dU^_d1_fH4t8Dni}7!lrQ7M-T>oE}=~9weTT8Po;bJ<?kA#dM=+F
zopOPdS=vMUI4=u`YDirm@Xvm7lnUkQ=!4U|pmxM=&3zK~GCKXX=5=-!G$F5f(;e^j
z$j5C^m)T(svm!|o6B47oa?la*D)M)}ZO7Zm`wH`bxinsD=LDmH)d;N_BCRPbd3$E&
zx($5|<!P+A)|7pphS)tgHFJ95$s9X9hmP%`@&;Y99A&XPQ;gf-K%(PI!<RONV6Q=*
z!r$EcMp7A0K!qeCV^&~Lk%`<a;Tr;|qx7Q=)*fS^eCF6<)XXF@h4;K86$xjaa&kHq
zB1BIWN0R!fr6a(E1-y_Qzu0@_u!T<&1m!Q<uMzwD3;{H9wf=s+i@v$V^r??7T@(1m
zW$rVZ_nU!6u84Z`qye)Kn-0K|IUs16k2k1SRJr;o*B2fdm>v#G5wzpG+4&J?e$fu9
z&{?;cVbjZF4Afym;bJ<IaVrNDCL%woCjRZo`1`*(oJ9aEgH`P_=>=@pe?^W@U<_E(
z!bm44lxXNpIp1swP&0BFDwZ3+ro-rghf1Z#K4MKSu9$Nj=BO3Gjl38KO)nPOie_*@
zRzwCZHd#J#T{R*)b-j!Qc}xcux4l&8lPoRB?ccR%$nT}%k3XV6U-|WtWqjh&V0~59
zKMYPlx9CmVJGJkRM&A$s#K^DXzY!xNEdr0E!1P~;(Y|=~&w!DHN6V$u?J*5db~2#Q
zc>XWMi0ezA4!v^0?c_nfM~3@l=a%P0Hca;b@9pM`=YxMoE*Rba1GE=#>zF#?tQ-VE
zONeH?!1JZ$|LAlcWb5TiH`7^8TFQC;@oP3xIe0$41)P-$s1Eo;0w>Dc1bY(R&17m^
zV|gg;sFyw3)vtRJ#=zS8-(d_t;1}m&+_M+RORxAr{|m(`kjl_^vsUd`b?WkOM1OV5
z|2xs2W4@hQ%No44U*9EqJsV^Gp9NW~KQd)3@JfyylLL_4{P2bjEeVMaOo5z#aCFdI
z_=B*w<%(XWvw%~-bPGsFD<uTIQ)w6w+<Y6M<Tc;#K6IVOZmwA-M<Zc~q3Nj4iPYJ@
z(nm2Dl2Be?^IYt>O|{MbuW(WI#~ag4pyzMAP!lWTxU>Jhx+P!zMH`6pr&f2EEh5im
zbRciKLFi&1fs<F!1nalOh<i3N+2L`;(zm)+sGG;pIZcMfFn{H>Ym|0!b8R^}fWT6@
z$bHN5>&D^uq=)Qf8H)!OE)PlW^hI0}s@rfV9yZo;FG;fmXgRzBNvYX7o9MIe!^=<p
ze{wkkcvSQ<u+sIj{v8|fJbNw`P`iFD;c(*Yy7r|{$rW8jMGdGR%Z=O1qv+WLaW|Vr
z{z$r=kr33T!KS5x*esRUeH+d^mpPbVUlb<Zl_|-wZ?SR_07k{Q!%&ZtM(Ru~t;YK<
zowq>>t?liI+I2xRf~AF-n0(Gs2J}YwwZx@+J}_;`kA~3kGYq%MHpolrK+2`#`dnUE
zLU%JQqtT}!`uZ&i8{ZJ7`=;?TiI!35_M}PS3=9)p^asKNF{`<8HjvkHkJMIh>1;_q
zD_^Up^jy_B+)OEV+rqYiX;)f}UTq$`P4!&6-q9U|bn9OpSMRWM33dwxaEv@pTPAq>
zn_jV}zBJ?UE^0SluWF;Wq;Tj<mS!saa8KUCNT($n;P#d!tpy0p{*>X1^6QPR)7~B~
z*P|H}6A)iy;X`@SxN?5sP$gDgA`*Laz{a@PFn?IJ-T*<rVON+L=>HPdDSU8SK!5WI
z|C2+xJi}r+z)(czp*kU&p^-!lFosSO2aB~(^q9#nuLUCJ4+4i@LjXA2?*2=@`hg(s
z_Ra#vt%vOCn)I~T^H44@E4nCZq7P(F7hR(WMn8Z#bTk3mPsd7xE;MhmFG}rI0kc)m
zA5d$)-QLU?)iWC_CLD8IVTLr0K>lNMp?FIl&@(9k;gk;S^?q1+sHVvZ9hwslECu{P
zw-nB{Od&n*dafKQ{n_Nw*m%mWmEjrs9V#>o2CGSP-H8DUe5rACHuNGm<D4<E&G4_A
ztyME!{=qDiDz@7V+baicn{6wm*k&f^2Y7Q%tLtcW#Ox4%R7G5~T}x~PQ2Z&oZcMd(
zpQ@Dt?0ma!zfT$$8Nn8kA9@(`uMCnL_M*p4hf?$JCEMttk=bz@Ii^R1VH7DQYy{)w
ztmSq&<;JVDGv98!i<7B4bvO|>_&O$DSPs|HKcfTzHtp(zuut{wgB>R}O?0HLr!*!1
zt}Q@*0{o5-dQVZQPC#Ai+Z}-AmieXl==(KNzU?+ckM~FS_%(HKeO%N*Dz_iq$GlIB
zTS?4|J_0gt{E|Fr@;4U8c(=$KfvieGP`4#*AvC*|co9e{X?Xtd46c7TBk~fmKwY%8
z%x>t-`Q}Wpm&E5708BZBW<ue&WbkfkP!Ch#md`vr`!a+IV@{DOo5vSar?LTh8g<ir
zZ0OPn{(AMoFg&1YB}%;27vWdIOFl&;KE(xX?F4z)8d6&(3D%qE9U4+MP0VAhO#+*`
z<oANLK~*+4FR+P94HXUu+n41aD*!S#ytEI3nRMuz(@UKEUVBut-b$+>Hw2+v(E`>T
zAOLXcXkpQA3=qZKB4fEiDG$i@oT_N|s%EDch26iYnBD{UX((RL&}DTOKA1!I7eDRo
zKpB`@cyw2F!r@^8@(6-vaXAz+CN9qg6#?F8n+{1%fThra1ECFe>-8>lwp<RC!}0HK
z67c|lo*FL4yiUwK563To?0OYp0kGqRsH)W=*!<Ip^_PuBCe80&cs%sPsw9Q(qK*{=
zuSsS|7OnK{YDqYM-_xtK$@gQaaQCQfzN+zywDRT@$IFV(K1YF7XbxBblH0{(FHNaW
zS!Gb>)dt5MkW$@dnvMQ>F2GDP#=9NZ+?D{GK88~@LheYyAHl@Ml&tKsP7Fp7Wzc&x
zt(=W*K80y`Yu!99ypGM)*YvoKk3RRRxhavIj}w))V|3;B=T)>65r0R)oM8m`>1+SZ
zPk)3J1fh5H!!y}N8P!4w(%(Hf>YmoYYMf6P>e<XBqlpEQf}pCc9JARh7qvh(guP~P
zOyEJ(q{L(q6p}NZxsIxKJcD-DI9_9M8?ZcKg)Q7yET1xa?FG-UO&t^hWSD2sGOB0S
zRtEe5;6BSqE38Hz9^S^j*TMuTu_2@w7k64E6KS+E)@Y**Hv>n?%(dz^BMZY$tkL(A
ziO<C(Dh|_)8f=~uHaay^Ra}Oy@oA_@-wk1;X7Jkd!3vGJ;VQN!=``dTL{7ZX!3UO8
z(WIRUl(KTHRmYQ#NL&_U;#!%aV*`*VfUcb)dRJ|HqC^knAG)>c2zt{RBkd>L7S~O`
zjx9n3tAU3ueZ8sHbP6kK`lM#k=fD>Qh<u>vc93ano}=Kvbj<q#Mz^E$VF5`Ko<14B
zYGxY?ZvW9uJu56v^Zc@k|NEPNE42F_nzu)+B(!`qnK8{*wT$_XDLT!uOy{o$P-pp*
z#?bedoN6%&5#QUq_=X9|+I)o~WzQ2_9lX6)RJQ|2+59^qAMdmdv%#vadmTeG+I-Cw
zX4B4_waB7GC0o@lk70FMRSSZV)$=`7)5BXcS-Yx%E0E1Q`-$Hw=%<p_7!t)iTvcOb
zQ_%R&=X_GV1R*x#t9T41sQ=i~8OQAYDeS9mwfuNN{{b3fE7U?WnNhntS!;@$;R&KV
zJLaT5{Q-EK@pL4V;Jupy22ozr(O$jp#~bmO+s00FmNWj4Iz9=j5vuVD>+=N^BSm%!
z%=Vw_<jVTNx3`3mxQN>W^929yc*(Z>xv?U!PJtmSWo9K1Y*%3$EO)q@UtC<g=W|Cv
z!RO33dPf;nRkh=wCxCRNpJ@<fCHltW<^JPPx<KNwe6^GxB^!1Bj(Ix-Cgre@hnGLD
zjgim9f3)Xto>m~+@?8719z~dX<S8E0!ZQr(ebW2Tfmr_fY~EwL`DD_{@;{PDVO)2o
z(f*)tf*<89-SbU;9<W3z(jm*Kqg}?Eo1u81Nh8<abr3LB%7hR)U=wEmX*@qr{=(3*
zcc!wCmsR4$Ky7Br+w}=q8$wG8#cuN;CCshg2luX&r)|LJZtEvVg_i-ZMx)auRQ>nt
zndW7ihUa!}7Tx_9u?j2r*$4Jh+x2~9>?~e=EsUUo%{COkXFCC0QU*Hq#52wP9aQ`p
zbNU3k&5HU%SITh1mMz$0t-7@C$>H9)rtx~uWIY><TxnTV0r#%c&{SP@1J!%FO7q#)
z>9=&cj2Bi98A5_w#=)n2C;#0x4c@|rbAuWjx7#?v<rvqcj_Yyj*yz*bxJYM9nkXlK
z5nW9~Ph2`~<kK1SAZuhX>#tXpjq55=^LU{6A@aRCbSWHrp^sadB91$SHa}#$BfF9z
zJw3&C;ff_IKjIO1vp7*)&+Ck0d#Mqud$>n9p1$+r4C#HreiDf{Z0c|U0KETL*sVOL
zRxs0ZWs#}FVPQLcE*tFMZK@rivoe;WVQoN38?*nZ_w^qM(MGO|V~n-Y4f*@3<3ADE
z)?`m6+m5OvD#XOlM@lx~M%!}>j5n+vtHz1fF<0+3IAIAvP9Q6MvflO+#OTzNETHnU
zwQIp*lZZg}Va|VFWYnXYS;|WEeVz}R#+wrkmO)1$v85eg8QMOwdK~+ciiZ2sXM{cN
zzE@5qNUeOYY%>!&vd5hm-4g(}bjwPgf0J5boy!H)6kN`CkG(EYjkYQ~+MpE~8Ch)v
zg79F(v2Cjik>NtW?Dh*HzZ6UgU^(gfDW=ZRN7?md=_lFbrUGho1#YN3Zc*?1)ptMs
zyNTdcvQrl=W}&@P&XjbjgRsvU(76Kmn!;CyY-iDQL!*F?85nS8-^}g?6noe*yrjGb
zUwua=`N+s^d?;gY6dgQU&K5)OdDGBrC;r%&Mp)j=UfN2fxdO;q5XIF{s@dWsHYQTr
z7(R))Fs}>k#0}R8A+A2aTFV^iZ%lfq1){(&rq=8|lYoY(WG3=MIU_~UMYn@C-*f3m
z>qc?P-3bRJW``~unhd46ne0Ou-0rc;Vkp{6Tj7NuyoS|ixPE@KdOX!n>*O;3pIy_2
zl0YuWHa2uM8g-a86H}+z<;1QMEp*P+<w?sL>e#zjqsDlqorl5c(z5igSF@8eO#{fB
z&**lEKDys+v9g#Vj2J2r#@1vT+_*D3K|a@eEtG49CbwGd^6i44o&_c@b&EuMl|4EE
zU*nxma)_bFG{8_3y~{<F+i=Mq9#n;Qp*9ev(nFPiP6l-;qC;tlNq+^S4E%vy?F+41
zp!#l-KKjcPWB8Gc8Z$95Td`qhW+MXGw2DFFo9{+8uN^g&q#TXHKG244t7%40G8$Lb
zu@_WN7mtj^9AA%&#&>=>jU=iZb{-$xBfQDb1W6%!Fp>>!`hedO#Xcd78U?>Uho}14
zEL}ZQK5WR6`N3J;^N{xVvSq)21kQQsB)Lc;!^79(Q<fVb$GX1UKk2!(EwAYuT~KU2
zKIACxf25})^XKr*s~amm`$7lHNc3g12JtZYo$ddJyY~!hy4m(X6;ZJu1e7klsMJVD
zASg|wL_~Tg(m{p1h#(NKK!5-W(n}Pi_YNvW2_Q{GLKO?Wij+_cB;1Mb-uLW%&I$Xu
z<;%U_c>FTvKQn9ATEDWOykF1s$ZD9{{GPto+tW+CrMSK)zc^SNbtiB!;=Wvi@t@Hz
z|7X)Z#2T$8!SNEd7Usk)19wftoY9W_*m0uthQK<^rSg>e8yx&(xmgC>ef@1cIUL5r
zdh9dnZ&%>PhBR(Mn+CH~p7+!`Ucqwptx&@IQ87e>>(8fnXZlq(*{buz?ye6n6)cKd
zdlyx3?lCPXJKcu5>qRZ?i!pe<QwVZFmJO0vw!?G3?(PzcEl1)K9_rkk^z0kaeAGUA
z@`&x%@qp=D)=ZE5EPcPQG^#W>{|j=xF77<U^eq<=#=yg!D(AV-|9~(9%IkZ9G>49!
zy0&-0{wg2cR-5a6bv9__jkzUY^Oc)2cC<U}@Y>73n$2T+$rpuK#4YeaYG<T({XAMD
zKBxB>Kfd&@eRN&{ppwF+6W52|`mIk4THeuAR+Lw9Nps0o9vh0x!<~IK7mtyJckw)T
z^^<yR%k5fRRWxMLHkZ<QxrksKZi>6uo5Vu@{51~JYqo(01pY)>|Ft>?=;ez{hG@GD
z^I)h`T(^BnZj3GB%nh#JA1<Fv*coW=1^!-Q?l)t6w%K%P4Zf}^E8fJKD7p^7tu0L<
z!zn?H{k9v0215X~w*Eg+>*UrSWWra1IT-%Tq=qgo{nfCyDKEEKx_56Y{+G<1fIoWj
zfA+}qUNix2?2lVjI+&*6s|XEWU~%P|yQYhJo|Al~b8$|(Gys_Yt<OmsSac<+dKL96
z2QCQk*BaaYHq$N2z<YYqPHRbpc8c|D$(o2Z$%Whg9_9rQRIxH0=fFROHpPW>MIJ;;
z)9i(Hzk9iro4@ab%KvYE_W(=!su$e*{(}b)LG)4PV1H+dkd=rQekXUyS@dx76DGHT
ziAn#X7SG*;M6eF8%#0XAlGy$g-0{rz?=tlaoba^1YBye!`dPkouPLyVU9pf_H`K0H
zpiFcg``Kzl`t=3z6w#m!Ah^<-(mIec6gNK$z1FFG?0oPr72OTd>NLQG|8K~mMFp;(
z_GKqY{{$25v!^qgI@f|C3;F1t^6FyMnC{-+y{0E>yO7XoL&S+5^|~O8wmR|BPY1}O
zL8oK=NB`lDZ9lWDLZQ=PaK-#muBw{b{K41#zYj{@GrE^c6%!805cw3~`1r3@D-_=8
z6>LG%%t8;iIDY`wJKVO|L1sqC67#yVP;vLO;k*$~i?*#hdzUsjK%e8bywFqaciW=!
z9m4mo<|v-I@@nAAyL`)}8JCXsmXI~5AFY|JY%kYpRROSPN*D@ywV%)p%sRpzAig48
zB`OD+?0I~{RvFLda_Cy>+f&p|EOs|)l4m;@3^2QbuVNVNP0RBww+V8Ri^&3^!@D}b
zeRVhK`A=ZBGL==F9dx{wnoT1GWumx~mSXaZQP1y<Qk)WPDUuram-loZ#941=KXiwb
z`#UDfZnO6<Jo^FYjn7Oufu+t=f|;I}-v{_faU|{>YN6)7V@mm2zMLn;qjBHG!u}zo
z0U9^y(%y_d(>{~FYsv2RdNab8jdhZS_+vlBT#uyJVQ@!JzI-upqgITU`H`&_*PVm2
z8>@V@ah5)7`l6CZV@f$7WU)^tJ;dz~h2xb=QbP{v-gO>&aD@8HsvosDpeuo5b)_pz
zDl&!zi!%>#ICUUtkV(Dh+wnF@ff(=DM~&WY{g<qOhWtdO<-a|w|3)GRxj^@?BAEhK
z57CXGwet02X<T4_4A8(lOHzH}{b&00TT)j5sAmQ{OM5!nl?I-^C}L@vxmOi*&7PVo
z0cE9-Q^%I_$irVKVikf#mDxulxnqsqjKT1*Hn{D337X=;sg83w3=a{iG4=+O@zc3)
zG2!Eef5uOz<wPo5*cww<FLL|w5}f}C$SESnC1X-$W+TBk8epuL6aC{d3FmYpb(%Fl
zW%tINXxjFn*8oNpnQmScr@9vVW)10QjDh;?8LagCRlAE0fMF~uaNLCK@NfOGe}lX~
z9s37F<Y6%4PIT4`oPS*h$`Qq)Y_-TZc_hSp<7!!aohT#$+IIOcnjtCfS(q8dtYKC3
zooVozGH${1#~!vpKBPumbn$`d!P+@a*T}}B^XFe_XaBl%8Bcf3=6FCa8*{vJmSoCF
zX`3TXQ$i~oQG$|amjjpQnP^|dH^w(=XmDhUD!FRDIJeOAeQc*`@yp_})6f1f<nsDf
zRQbo0^;BEwp<fvfUXXn=s?FiOOXnG`AD;6e0p_`n?6IqAG)zx}X$5%?{<l9lk9EW8
zvXCZUz0=7Z_Qp%+2)*ThAfl`$r@i{h-rI=2=Z}@?4nj->K7B?*wZsy(gLM!N2;9@K
z7$4%GQpY>EhZ}R;Sa7kQr=KHgw;G1jr?M2&(`E~rb>{bdXR-`S`eEzBhZi(kl#PiZ
z54u$6d%3<okMx@HtovlazBL3TyxTnyLRU&xIVOFlMUyW;nU`K*_~OTouT$3_L4Cz!
zohzsP{DtM8N{fh8=d~y)jtK0ay|HQEz`2*dcxkk{#HaYI^vT5k?H7ap#@-z|Fj#mc
zs+r^LY1;vwRo}A}U$e|7T2``BP0k|Iy3)4ivZm~|`+2^~k_x#k5S1~6oFj`q(Z2*Q
zCml#JMr2ILVAk}+7&_X_dS~i$wI&K<0@mtmE3EMyGiz$~wb?e2+ju>gH)BXL(m7pO
ztelm2YMlM4bz{)@3EN?zF|+^Lgb>A$LSXDx@h_XBKsxq9KGRxjZ}%RjDJfROYA(hz
zZP+EQ8@fD~(g*Wvp=m5Y)VN}2%f#2`u=7|&zwNpq^7dR0cR5ZFwlg1jY$0w_Xx$^@
z606R6F0X{0Iz!|Jy|cP&hW`j{-~|fRSZsBy{{9@{=&6m|%{wns{+Dy{_h|{yp}j}J
zhq9cbH-I>{>Qf6Imesm;cj-}3{by|TZLynOGjUI=Pq+3aUGe*X|Inh<<CN~@<|vKx
zg7zk*(7jzG=C*$%1v+YE73feqf|kd+VK<j~H+o%Ogyo=W!XlimNfI@Xj?qwCv&Vx9
zZr6|Be96L->$9k16Rk9v%d%zFz1T4!XFUaVLXL=~X5RKrmgau+UOpRjVzF9sB_8tP
z)Bil@|M)$gv@<*x<iWVeT;*#dq#KH0T=JxR-tBb60n9mFsRL}2rK{mR5DElTkDiW>
zsgubz3Gf_VG>j7^<8@UP^L4m3%JfO$x<L$^k<`DMKJARi<J`Fz?PApOC~9?>E_dL*
z+2flS*~dTF5QB^!P}(tc>l9QZjN!gOG*nfN6<y5(O_MNS7<AiHzKPsY!g(3;q~ZZ^
z-EH^VnA&w3*0T$`a$kg0ZmfKj#N0!8LDcSzB9HPk9<O={0oD%)ZnS799meq7FFL1>
zPUTbCh6aZ#Szap09ulp`;mLTom^=PkeiQHqP8I&|Vd0;_LQk+Pjy&wPti6ZX>`<w}
zl3gnL{;EgjvFQ8QLu@Cnsx6=X5n&hEbURu$VB?xtwX0SDQOYSj%ppp7a3xo3cP#wt
zojsE)asT^81pg`(-kgtzF<789-8GG-BR+C?*1&c@zw%>rJa$U}I)f_@#VVQx4&4dp
zKyd4xLhj;e+`LE2V*CPe1>~t;xv-6WVw(}2My;|nq1Tuw>hG3;m{0c0a|4bKzOhnF
z0!Jow%ekzh>r#yxJ$QXSw7SvzGcjkUD>>Iha+TmJGJ;myhZ2bA5ralymrNI`>`Pm%
z_xTY|{`Ps$u_S1TDcv&oKB3;#-Kso#&UfK%uEBufm#QJ0_H8jmLe^2gA`uBvs{6~V
z!Ef8l@SwH4H&ST>S3ewLN{Xa0i><E=q3fLbQONm1j?AHciXnFU^|vt<9v+hizv`R7
z!F@Du`d^{r-}lV!Vo1N%o(KHqhN+Bs6~3TJ!nIj9j^)E62SMIt2OPezpc@j*%vqkO
zY;!OqTNokNazubQp-b;Cn6QCvMt}H16#4av9F%93l}q)e8XYV83>#XADRvpmLzxk0
zZ<690UgSmtI^ZDv%W95y5SJ{mTy_Q{p6IdWjwG%&oOiB`H@ZhzCB?n`W8LPgEE8bK
zZsxF%33@yeCL1Cq)IVw2iI99ELZ%A@oXSLFqVrEU*SbrA@}0B3hG(3`asdf2?kWvy
zYn_8^s8`CfM6(4=S_AGyT&3Sa#Ye7pzGF?xA$6lo`m7JEzEJodI#gHMRO2O1S&+&H
zl*LGK8Ady%eTmTeCDGTnIX`-cmCd}nVW%u2>R!!uMItqlvD+dlOHoTjY!%Z1EE(EK
zZVlY{##a*SORx>MfEYmadN*TD?YbtZ*@3${AV8KPz!z>0z-CFztbqI{``UfE$H(xU
zs;h0LQ$OZbiJ(+l?~^`3`lPt7^WV*^)ysrpF1^2VU_9%T3R^A=xmM5SY;cmbMt9FV
z)K=(!yyySCxE{h~tfbYvjo!J!r9)A&G|=8yFVsS|&iYeEK6!@ACs~oplRgoj1?#&P
z2Xa&-IXgIl+Msgj9E3a)<k?m~Oy#XEwRp{Brt{<d$c{5y8+fCaezt}Ce=O(a3Sl`Y
z7kd3o=R~g7S?1K4{9Yy24ahyHT(VUgLAi)rTtzj;T(wgPkxuvyvy|;s%4zoM2Sp)B
zK1y9mtdeWT^`8EGwDx3*uCh+2Q`t8_WX65trX<ZBhx>sV95m+;4t24KX&#teyi1Gb
z-op26n5+!73!+A2bZjXTmg&x&P1Zrlm~3J~JJS`(m@jvo#BK^4=vriF8%jFunEp`a
zhdpx)9R}93Qpp{X2u;|)On%2>tJ8OS4gC7Gs2(K2vW(_k3fV6=iafGuu`%RQKUZ3=
zWW)5}7<#T#B~zRsCj0K0I|83R@;gmH7q^+)EqE_F(MMj@!&((hD}5jn`l&rz2agpA
zNueAy{_2@~-UsbazpD}rvL+39Yi83&r>s&#%%pJAtzC>jCoqTH=w?T*lE0^&y4`Zy
ze9}Ng0ynLcYj7afdC*)S;{oyK80vR5PjT#iyK#`vG4~8p4+g_2ez&a}n9EJpw)C`@
zM!e)WW(J;+kH$P{N!#Z?u<^XV?eL{+XYI1rRHfF*@(s6sP41wRUhIXk=2_fZ*2LPo
z`=o+SH0!2XO9e2kODY#gm76iDUD7{h8*kCxEPU^Ib43smc|DD}VLKVwd*)qjJq!OG
zx##yC^3IkgnJrw$vMm=u;)tHZJImRy`hBvOC|a#j4Dj9i8MosF7$0Pgz%!ol4HY%F
z5SJAgp7R%pg!8Wg*8`DJ%~M`hGI~~=612A*R@%{%r|<rZVc<&|oi~zCe_f=%{41<e
z)`IFnQt{0OM1*KWsNXH(Y$(|Ul%t;gac7mqLKPytM2?{X=qdr?8L7Z|z3AWpT?r^|
z=B5;x&F4lO2gXP`^&1lPosX;g8@0O}a*Q_9*c-M<bpC<>eg-LrY7iu!)nT85A`IcJ
z*h}Oh!z5@_0Yq0_!^&W<!UpkyPoC@{p}O{2;Gy^Oc4f^Fx%lxuyDbpXus}&vqIa@}
zGF#V_PelIUJbG|@?b9~9_ORv)eFJf=$^b^LMcL45x;OYvi-n6Kp`xTh1un08@hzne
zEG0_`)~9+aY9L9dyfN^33jJOYXY)Y9#a+En+WlsF{9??xuCtNBkuQLe^YNzbbq=)L
zQbJDsq##2fi4B>3ba5W5Fqmh%gN55kJJf7$#Y58LZK>Um5OGRkR~tuGkfdxv9_laa
zF=JGEnD~h*1x4V4mn!<u6ZaKe)(z#B3EmE_XY)a~qI<%>(={HvxyYE>-&~aIy!rfS
z9u46&dAlF`n(AKjhD1@4yFSIj+w}%}Q)L(KohHtjp&S`pO8aap_r^w?Ys+1(UEzKl
zOjihTamBF-u;>Ofzk-%S9X_<QD+RizPyG;)s}9$>-8}fV=4}OxJc_N~XM4m$ejgj3
zi|9KyG>`R*quI!`&$s{xb&gnqbM)=bR)uvrE0<ynT!})cbALS19qx#M0YaT?b9z`?
zBG*K0OZo=hvqe={l@%(RnAC0LJ4>cG*irp`QqP)Qvr#q95vL-7sDh(~=cjC=Pza02
z`(*_*e>GdDw5f*O^A#B(R$atQc#p+%_ho$Rhg|MPW0Ie~hTCUJ*^ckSlp^d3^%efU
zEgZ#bR|&mmNPXtzbG4NtyP{V-s=F(HqboOF@}ELFt0=nCmZ596*>Y{<E}#0{%`U>q
zldw(56^3>ToPz)Seq*0FA4dn`%56$>k->5g!_w9A68l-wlvp_!^~7x?fT<!ObDQ1h
zT&Aa+#!^pMqvl)vVvo=|^c!{~<`7@&J;HE3$cbHUQcW!FL_>aub)J1i4i}C%;_pIq
zE<D@w+=dW7)5(QsETb#-!oN73cST&)U~w?+Z9o!NkegR;>)Q;m+aNq5<Pw2z-GXqU
z;w1E3fDy5_%w~rM^f``Gjg-S$cI21dMikas79N(nsck!L!IoO0^^)%IkwQ>12X>h2
zr7+9Eq)4;nZM3eDTkBA01GjAb1iWD?E-nRU$nXV^t()4iYogi(U>eq-)DjWo`*`AP
z35hi(>aImp*j?w>b^r7N(7f7ercM_Pb)tXAqTU>3rpJx+HmHhJXxkpP;vEda-F>Z~
zVpd36zuxn8k+EGf(BlTmmL2+NntHw}O*z@=gm#lvUSI*(|7d|nMV{!6+P?59R4V{o
ziSgqtVdIz5;=_&OD$T|GT%Q}gE7Ck?(9?WP0-CRVc0nXTHsI0*2n%*p-_4M4+IydQ
zEPF_E*gn<z_RW4CeYq3~-%|sb`4VCi?p(({q|;bIJXVK#%0o+S!n5Ui&~To%qV?-V
z&)PZ2cr^A>`OeSp*IfRYRQ=EICk#=DC(d48EOjY%DX{7@&+6F>vrUot<5?%zmZmVc
zB0XF1ix?&8*Ny0~kH%W4=^JovLQ7-J2C%y%LT=+eSO0j(TtaRnx&9hT6W)UqQ;}vc
zroYTGX~3lAfU^rYpODoB@kMqf(!V-YZ&rL6?vPn!G~0deSxdaxV80}Jd-Mj(vD<&)
z?(DU6xuxnlcj`YPhw;x?YemW^A<eMvc}pP2t54GAoHjVSjL%ncPTfq|{tzV;7DV8U
z*}!F^km7&gM>$aw9dK?R*3e3hV}5EhNW%lV7k%XzFDG*a_#DEw*&;rSUuLo$N_{gs
z+2Zy~Wot`)+DVFZ;opmv|4K3Sgzt{dVSk1fkRya66F~MPM1SA)GmYPM3@xBlB>5Z1
zE7II`5ZH`u7v(L(-|BW6w$rc;$iEzes{q;zh@a)&R671UL%chIYGAOt5MoT61*!g-
z9*zwL-MzGerV3U99<;l@z2>Vj5m2D<d_FBRX}{3&j8lO<t|iHA8LxY)JULezDL%+P
zM1HG9ql?0Q!@tL7%&U(Tka2F*Kj}R_DPt7I$uEiMyjgK=uZR?m;MR|yEuNGpn7~Zm
zlsN9qr1K+_&9taZ%0POJNw)#r+<{031AMFplLfY;cZO6LO?PVN9b(*fz~C$?S86LY
zbJJ;HtqNf^DPh^D&q%ku3&e}UiGi9!o-N5yhX<9-j$>wTITo|1e{e)X9-0?=$+YK%
z31vY2*l1SkY>S5;jV9t9Gf25MQNMtp9RD!&te=@~=@qQTAIB3)*7;gYoPCR$$OJ>8
zwS0RT>Lo4=i~Q8Zd!#(;j;C$gu9r%Abr9*TIL%q;PFFMKrM*qh8-Ra#bdum~pvpSg
z9X|g4-aM>prI30DrH6Ji6UJRlW)F-Hd{M5&J7a!v8Qvh{%FV<-HN%G<cla3i*1#}D
zFww7Jv})E-z`Uhbp)JSg5qC9=e=UfZ8wQ-=|Lbu5`=6r6tP~#XEzMJW<cx`nI=zZ4
zj|G5_TpOdCsrfEG58=?SykS0@sY($o#dRfRgbg&s4^qoKKyEH_w{305xp2n3{j|bu
z%0xTD(9)Tnc+qvav||;4*BhU5*|W&&B+o|w!UYs(ENK4FKUo@cRsDdY-bvH7*tn=?
zSPsv+Ia|^jLT>0j@!&#;HFyPjz$-8x)7F{McfDS^9qYyU5%a{2*3M7m&?HA(W|7g;
zBg!5VkdW0}_Mkz5m5Xf^8D6`o#L61v-pKhoqx*!iLFS~Ui!|cvRbYUb4ak+nSxK@c
z?Yh7{4q{!eT{S&ke!67BlXlb`r>E?67ByjZLZhw79uhtu7g=p}bOakj^~L86sivI)
ziFgTn`b8ySKf023!@XNEbNOb3p%D*)Y=qYsZ5#&cr7;5N8X1ZRiEn$U{qH=7#ofp9
z+n>}~&Ek*!AapCa<B;&C^c~5j%`D^3`|U=sD!WQ7bf_GZ*gKIm93+`_mqKw5N|AT4
zE8lLge&G=_Gwd+?r24SF2j@Lo)pOASgJ`}Q8_(AtT4MMl5Y@u&_{m1yJ(d!xjSwc#
zdn0$EtvA|Ta<#KjgXBJEzazV2iI`wF<GQHh8G;Uw2xKNJ47ps-zb!X(WvVBX34XF#
z0O*Cz0_VVVS%(`<^bfu_5JXI=X3m0T&zk4rA$`(Wf!?raqVs@lR%vE&1&}^@h|$f4
z+<3epXeb!;*nCOj%?G~d$k1^2mM6h_C&_GHX*4Ay05=(33S7uBO04c6k*?Qk=~7)N
zhiO;`<)PUp6{EK|_KAlc<maCL6_3JN8J(fag5v<8W8v`)fH)tDkUe16Arv~CcD#)z
z%fRi%BQH0n{s+szpXJfW8)|o1Dnza7+H$+ip2q`>M3)V+`Cd_z1os<>A5(ng+sJmT
z>~ZNFLs<t`G`efvcF_H#;#3>9r&Zg=U*r16v#7z%(WZE+?c9UMJOs;3|Fk*0P!yCY
z!`U7ZFv)wsmYV}MN%w}Xsw2PEB>|vJ4Q*vC_K6ney4EweyV<BSVFD7h(>5Z%<A{{G
zgw(^U9L+jI{1@<fWMgjbacuy}K$Zz9-mg~KY6jw1kAMJa5IfR%oE2qrs4w*EXBpqL
zDf?<3L<zx8g~Z&>vEjbAe#}Fwdyw3CF|%@wYRkCnN%OAyG{{wEg}^3&bxI=NER?R7
zIfBev1i(v3&9bOEPDp}c+oL0lJW{M#r^?yN6<0am$p^cgbwF|?Z4kOM)(#j4+YIrb
zh(`M#s@=yx6Eq+W3JNZh*61sHT#Kbk2Y<>E-8Zq9c9!H=^mRTwVq~<Jr4f%}L*N|3
z8Ioj#<+M)vZJXuZDURdX#pTFBJLrc~h7wFS+iiEGhxWOQLQ*h3E^8>qv=T}B&W#r~
zGTlbN4ybl1j@;d+4?0=jLQfROuj=Hw9MiZTbv;e79J8ujB_u&#xBh86R^7_Gt}^4b
z=Wsi2mOp2PDb8<Uc?=X6j|{1vWnm@-FsyG=ukVi-2(g{j&{iw>X+mT8>`}v4Eb4wU
z5p)=)jGQS4*KXx<^GNTW^w(^^@h!Clu+s3W`owJE-<&%;r^dCeQeEL6w<XJ%JDgmf
z2~!efA>ETpMQNgo6a3_OylPZ$;_R1;L`0$vu&lE1OyawQKk#7{C#NP_n6PBLV5lE%
zJfCD4u}_=_^Wiqy^}#!`V84j%bMOPs+r;T>sKM9e*TqxeR|apKh9Qn?R_RBf8-9PP
zMc3xX_b{@0$s^qOS4tMK+?TdMP8?N0bpa0{slDs<kMOWQjXpI7{XLKBtmMy;s(n_;
zh;CMvm$K0u&uNVFTH9T}`o|_R#I?Z1m+O;;;#xs?M0C$on9FH?ox13(eB{ZUYkMq%
z?zTTf1=L<rjg(*L0Jw8If{Zrsdrq9iljjPpP9XXR&YeEUW|&}iK&s7lk~vj?V!4fk
zbe-k#a=li(Jz6%DC2YEzpBUhMBTiw#K9$IvxXZo7O8rSsr2{A?ypJcwVsET^Z=xJx
zP`FBw)VR~VgMxYP6iE#vvIAl8G5j8+osB2;1a35j&44xcsCzYvyP*ET*@?Qm82tr+
z13Q)NQq564gu!Wk3-FK&+@Sb#^1n{Xn$<%6WUxIv`Uwptp+XsOXMorCxyK4=_vIpm
zB%{19BvsS3=Chl12nlcGsgrOOp?7jYD4_A6`c{Jao6;<)=OIatifj!B5wkk9`lmm>
zw2&Eiq8Sh+aIoGeSoEPd`L*KU%7AD&K8JmEz9q?rJ3@BNtOd)liWIrmM6x_awVZs~
zEJ%}kV^7(Ibf)->e!QrXd({YeMK^Bd@^hi5QMe=!w1Q@=HmsXgg<|}~6uVcAPULmC
zwy4f*KnjU*P2dRcbKUj$7{9Ll)dw@3FP+Qxi_UhQd07AkppNOhzlveQNVa<ar8sfh
z;CDp`o{zOqc1}m{`Mrg-5ee@)rY?VCE03+^LN3M}es<X^zdy8r#dn_{ar$oq1`*Fb
z&hojZiWFmQY1Va@tg-x-bS2|ikA53wp8E2sPcht6<r#H^J0(w|Egnq5m4A0+Ex*5O
zBEZLR)lTBLozBe1BmC#$9+ln>9^D3SkMh-tMStX0K!DlLhFJiHjGfG(+G7vtpf%tm
zRjL>c{9z{-l3%|%D5-D3%MkI5V!mKhT5wVOfPn|jX6^oA+JqF$$VpDjT%@Gz+%vO5
z0U7~*U=9BkJU=hJqcW)8RXw4yYkQRRKGQslY(I}R`s2KyG-x|wDgSuTjaK_bR7IMT
zvR<Hq_aPC4Hyd+Tx_<|s+&aOfq*ZBh6brnt=VOLbEw=lm1JRZPShIaTsRV7#LQJ0+
zgVA2MjmbQ=8s^oVmB04ZXH3&Ltvsz$^RfZ|F{{&)5d&;(u39z@`K%BHzaqe4&F@k|
z(th{adwq1mZBNd6$;%T|{s)Drt~7ioWG>Eqqupe^i~#pH_-U(Y+cs5EI``UBp|ZR=
z<*07RYFbgzfCF8<hr|^rciHF}wv95Jv@nA@FZWjAhX3`Q*w@{ad-%dtm5-)cw5e1x
zeLI>EN_!z@yX6xs|Bdlp+7{dj7+??0mDI}*X&&Br6&RkPFCAMS+sp=I)rym`Gmyv)
zK={zVOHf{>YdZKiMu}jTM(*yIbx2c$S`AB(oY{losREg0$;~!|_N+lzR%r!;%pe_3
zS+|XppD5g;e&z9)GA-1qyFO;<{I$5Li>0Qin{Pb?-M87>hyQZ>l(ng?@eRI5SdpMs
z8(*~(3OV8Y3#)Q=1HSq88cJnevHjs)S_|4?wktm`L}EF7^gL2>RTr)B+QY5Gx4hZ=
z*UN~tpQ*+e-jEI2k7hx89s|mYNi^;Hdm5%u<dlZYdT+;Xq0*OY7&=*F1-d7M&##ZI
zrYDsS7y*xk@bL|ZE8Ppg(Ya>hT>)J)%A#i_6`~T!_<gc7aC|8S3n21~kp4DU@SWL~
zzTJ{sem&}dSgEs}72?KopW~l{!}OK;rN}ZZz5cW|ZDxbg(I_L-;JszorD=Umst4(5
zvp)qxc;T2K2YTb~AU_5qyS9b<I!i*lnW9_h8fE2#_r`Cd)Gh(_OMB5IoXb7rLz1i*
zKQz$0JYkV{ryoxBl@}~apny4jvROu2?Sc&NHWdDLyN)C)rA9SsL8DXcVppZ3&!s|<
zgVN63tve{BQXTyp$EZsib&QFNX-WsvGR&Q$?k~^RBKM|;f~v0VyBnWGva~PGDAf>W
z15kY?Sy(4-&*~>Vps*9PQ#{kHWEyzaVIr3o5kU7Q+_Po5>uBq<UJfX3uuz}XZySnp
zEE>EO<v->-|NTAHrllH9>alKH_VPk9+fPCsp?4HU6zdJf?!-c_7ay-Rd>5x7cE!tp
zFyZ`B#gz8@j0O7b$n}Zvm-m44biR6^LtUko-a@VYuQ!S0seRfWa!hOu7y132s^H6@
z#w#MaQ>+a(J4a)q4v#Bek0{F!jKIZ6MW(y3D&oBQq`W-q7@vl};}M89YOaQ<KDKkq
zg@65Pp+b%Vb`QBwPs?x8T$+z5KF2ZhY#z%=%z9};s@8|!TcJ2hx1|g2t^#N2$!N(5
z54G|m2gK@ejHyQNwh?$8eK#qC9uNOsQefC!sRvZpLBX`bjA)Y%((oeIGp5gR#QoH8
z^u|ytV(4(1vLFizKq^}HZ88N~V)PI%MN*f46kpibc4htc2i+LD&icvTQJbAwrhRrh
zigvSr(%Mj5j<Jbk=~@>Pdw2&J8g!{oI&;~xhR7*av-PZ9zFRcJHpstpL)1OLD~+v$
zP&#oJH(fKfD2SpoRu9Tiy%m4=iz%OH=Gg)^i`-}G2gm>ye<g%<DQAlLiqS|slt7eR
z*q!Kg=N&DxOqq#}Q!d&>bjNcS<$|I<E9fUmHKYeUG74~=zf6LjQ44rAjDG_=lW(WM
zCV+K(yi7?x+%;mr$>5g6mD?qBH4tBc_ZQpme>wo13>@&l$v{pdNMQTO^<s4ogF}@W
z86!sAFOGj&Bu>In3;Q0bBrK!WY|(2_M8vfe3>(g25u|vP7Y$md9x~Dy`?W3e{4qa9
z8vY`!7ugU5#!PJWU|bun4b8{Evq&iRiG73}#tRGAAGBN_UF#%oyQ60I*&fiU5P6&>
zs+DDxi<;3tj*krWD<Hr(69PYD6<?nR-K#HmUshjKoj)xO_-T*`X^{jd8C`?RKIqHM
zVe5_7J>@%SR7<~;v~7jMTRB{We@zDkg}oHj-`A``lN(PS$vCehMxm*kL{$xKC(v4?
z(Y=}Ejlesc>$QS}7{2d+ZY36#EF$M_SW<7qDuDIhHrbe!h2-lr;RR6$03eRh{ioaF
zQq?H{QZs_Kb8F`Jk522QbmapVduIeb4u(Z2bf<4jy@E9Jf15z00hXBJl(ci2Re;$<
zKQ;v?6{DbBjneI-UgqiXmlcxhbig~J;z5$O5Mu}ny4GYh-)kYyQsB6*^T8rw!ddSn
zx+Wh|F3&?`S(U4<V4vV$cGA<Q{pLgJM*vLfVy58$wFN?oDd3*(Q=&-9IgYuP^Vs5h
zGDiM=A}OLs%<uR7Rc(fkZoD{Ny{%Ae313^Y_ukHLRbgHCuc!mz5i?>X*Oil(YBhst
zf3czuLZtuC69JC2=cu=dIVtdtejiWY`IsAfX`^6Dkh{IdYmO)Uf7=AKZMz3JARnig
z(b`Ek)K3aX=;xoY<=phgPes5sV&MjEOxh|QMyQF{?~h3Q)Sq-_3jA@NIBB?ueY0t+
zEcf13mYap|41%6dp)E<4*7D>*c?YOpcZXu1#01+U0vTeq18JF`AlMae_NvSJma22H
zZj|c)Y8~!m0`(lVhjN;I0S3}aDfsjl3Q&Zxxl+=2p&BR0D&NP8Ga+>j=w`MjjA6{Z
z|D7WCirXg-Yc{y@^FKhm!hiZlvRhdwt(__EFL0F1h|B9SMKBxabs4(UOOV(1_+8Di
zR$KXYjz)i>gi#p*)j+n&kLu-G-0s^(0zu2T<yw>|^%9aPN#n=O1?<t{rp)Thd~Z$X
zD7h~@L9U;b(G|26&)AR?W-YyGg^i2yjZ@GVp)kcDw}Y~ZplR?{)xj9Gw$+a%?sMJG
z(`H&`NDyZ)kj|*c_LdX6m2b+@nqw~Mu!Tb&t!A4=OK6YvoVS&Gsx;+LeMBWZ{Ify2
z^cT%jrVi%trtL|0UD9*tA}BgUeL&SZu}{Y^iJ~)Aubp}&?k~V{_G0dx)t6vEA-CuA
zOFnf*xeIBYqwW&|@(EnTzDLS~%!%Zl>Q9F5cXq=?V19UOwvTRtQwNWAYaSHq7#mTe
zb@W~tpuf(E0&mYzodD}Q%Na2Yg$-L{002pSN1)nQmr8DS%|g|P6#VTMH(;A6^CMg5
z#MEUd6QeKGVZqpVhORk0YFL-MG`RUj95mJb5hQRm`-lpt&ot~braVb;zBf>?n<ahJ
zA-8;5P&`o5dl`2;OpJsqAa~k)GHNG^K3EL>WD)g)uF5c>9}||(pndztExl6+hk7GP
zMVwOxcTcsMv(?Tz$1yPy<blx%lz$F`S0RzPkZNmzY4}O=O%gO^+I|5$(nTSWh(!Cz
z7-!T*zsZY`PB5xJ_d!Q6B+|jEoTEjd=Yy`;20x8Rj1L&y<74g|{o~TI?UtI=&+j>r
zDkVQb<=^~@>PioI83VnG0S}TpfvnS;Pb!@2O0wEKV_i${EXQKDZg*ZPBQCz$;v`>U
zk0zZ{aa$i(7I(t^wkdl$++<L-4TGEQjYPjqtiNny`|nP)-8$7wUyqkUw_Jdr*oY!N
zwF}sFayWqDXE?sfZq2;Tv%^+N8dkb$T{LB4o1A^`5__b(WBU1>q7uI0*!HvI^1&;H
zVceL0tm1DgjI>DTi7(lEVlAcAprc?~Ip*O=3gQb4s5V2|I6{(~JL+H?fP8rs{WLX<
zH#AalYgI|pHP&hdP<t{Gqi)f|CfQOA=>73z^oN~!EH_oo3IIg}?~X5#Ds!{Q9T}h<
zAfhsB#u%*@d4N+r&)RX-C@VT#e;x0f9!aDO>(P@y_;Z`=nON+Tk7qQqcm2W^r#PQA
z`cXFz%xVDL0!%Y10q?Q!ht12suXqDnI6=pZOO4Fy)&2#nA@b0-s{Hf^pF^Qm9l8c`
zT0w4A<C&<9U!SoY`^1BM+It}K%Yw-N3dSM&Kudl4BNwX8Q$d=g01`aCaT4RM7g1qw
znPa6aT${EH>$Ghi)7-_@<=?h?XQ6lWBgr}Ut!oz5gT!P82e<)URX2sI`JkBSUS&lX
zGCM07-axDI*EDxuLRkBax`<kci!(%eHOXf;93jrgUKy$h29`(+dY`?8B2s<jgJ}nu
z0D!~)+Uc*(xuhw+I&KO*FEiJn&(^uJZ|Gc`7qi~Qpf-r3w9`lb8BG2Cy*ma+Ywc@`
zymGl&C%n^*M1uRJ7mFahDx`bMO}nEpCe%5Tfa-RDc#Ckg&8ppGFYTA)s2icbJFB>+
zj8fRqise2upDkc8(AzzI3&UV9U+y^^`1^&znmLg7_*c*KGr&UYFas$?hA}%5B+ELg
z&5x^gfFd9&00`(=>D=*T^BryMH2VtD_99Jz@wnWD`>|-vb05QPcDw6mBYu3bI`K@N
z^O`ag9}UDkK6&tyzJq8TlH5|@)@Q60)ol4`vldO3sg_1Bpf{61jc1ICYK*Aqv@y4=
zDCbQ(dJQrdr}1nX;#AK3lRr#Bf<w53o|WbzbQ^*5I$pQg9>%EmlaQZkU_B^I0k}ED
zsV<asjl%vs0|XBjNl0~+49LlA<~vStv#6)F*2O&r#gBQw7_g9}KR0+FSSXRr0eOK9
zg;C1ap>NAi)(7n0UyP@meo?#2&9pRq7wUN)kSc#dUyD8HIrycV{QCaV>)^OB+(a*c
zQO<QIX$_#W`S>MrQRb!4Dd15c$I9b354o)9yKDZ%eP50?0HSO*D6NflQlC3$NM}6J
zT#0&gAi&QBa1NLFKMCiuWSOhdMQ?DlSUk3Na}@VUW^Rcm8*@e1jU_xtpMp~wtIau7
zZ^hp|VhTA{`34DzhY>HtSZtWid|kVnto?jCS`+Aaz+~hnw!4179sZtf|Cm>7*gz1b
z{_~>^0x0V7rKDbwGIppXfXdMyJ0+=pB$j`GIcbTMO~6xpTnd^#wj_XAscGGsA9~Kb
zlbg7$VK&3Yz@Zk<Y=u$6IpAh+cWA#KDDXk|xY`Z&OF!s5bn~FUHEMSrZcTNsDTfN^
zT;|e@Ye5m=ZFc6;aT2nqsp4qW&|K*VYI&*hi<yiNAHx;3#{+a#G7cC>q>!rJ=cHja
z=+rnOy|LQBdxbf56elQe=Wb(ZGs1)V*=w~=Xauc_$9Ml~b$Px>=zXgb;@>9)k0*D0
ztAG=wwdJQB()>6js!ZBM(ldn^$7Qd0&EPJ!@$@Cs$^7`JKB;@kt7H75|3ZyD4>LA0
zDMeRrCjSkEk$6&z>hDXs`lAXM!b)p~X##3W)OgG$$M;yZNM?IqE{$gvC#RD|`K7Mi
zPl=7phOXnB#5-ku7aXRH7`_*f-wN}~&L^f!-B|*lAtxX875=_0Q6_$Z#Mub)T#*^!
z%ZLa03}21K%t!!kgm@hiR$rNsCPQO}vkbr(Nv86K1<YXLA{lf8h(>X2GmtPKY&pMA
zoc|+ik*B;PVZ|t|$m#J<@cBehlKEoWm1+;wW9GVsyO{H*`{ZQ#H)qtp^MA`RkyE$A
zeZ}O5H@_)C`7e!u@>r&T>H=l)6hQCPjXe!!%|j|Oq{@M4>Z%r1y;HF2x>*MsI7=<C
zEQF?ZIgOn5iR(&RWjoz?o@8lO8W;jp8c(Q3N)G`Fq;sAqpfqi`fHm65D)kn}=$mF;
zr?t~Ce|WH&4HX6Vh`!Dod7xWU%r^j+eZG3ay~QRb#cDOzX01a<e<Cl;a{+F(_MnU^
z!xCVv`~dz?)<h}0k&r{=$aXD-;<gt4R}MvdwC!w_p>~mcKeWVzV-ytupOy;|;32{2
z4s%ejPU9{bAp7ObEc>7*Ggaj%f|I0oYgBVo&_~^Uyh6c1?o$fB`O6zI8JwhQSil(<
zbpchJd7Cn$=}8D%7URU-i4n1cw=$go)8{{(>trXCn1s(dwZYuQ(U|@pU|o$r{iB&6
zLaz&U46y_3G&uDWFNL}F-DG81m5rvIGB^nO7u$<7W-X?rxErZXxLgLrpx?Q{4+wgc
z8?HBfn6!CEh-wL`MiWPuc8#?D;_q3eC38i6PCG4<`YA^Z6V&9G5C&ZCfZ06YOKMA0
zo++P_YKM!z5Y7cngCXsr1voi~Xk<(Mx=TG#`>U&8bI&TfDKmFQF(D&4tRR$^LNpeD
zI!HC1?&_OHzfqj-I&ve-s%Y?q2-I*iAL;bw!}v9^#d%g#fM-7TqLYeG9Wom*(JaRH
z=@=T(y-;+ROGvBIyo1YBpCO2=R&`r-XGMAEp7LF|nO>>?KtEurEmj@o|FqqI;&W3y
zi;~;VDA?+hNX+XKE#^^=m3c$z&jkx5U*bf+&^y)m`k>n+czafO!%G)?zOJv@S8rwP
z002ZfiF#jMm|4LS0J<8+D9t!c-D2Wm?2)%Jt|7|jv}h(IwDcMZI=K!iltUhLOrBvh
zbGzsy?ID#Z*@%Ck?O+Z#{OGsEs5OHH3Vqw3>Rko&?F%F%Nbe(@qKJS-WiVhna>9QB
zkb3WYWwa=SaD~WqdZ(;PZH#}QPs4QB>xua;2!#!I_h;3!EMnYIHUc5pFo!#C<M3Vr
z-)&=*!#<z%4Pz3ZyjLpgk)$7(Q-~utXiQG$`k)u9u~(b-1=hog;evM!F`_02wp@0<
z@N656A5-N9%Bi^$i`|fbcG4m@x{&ncuk!Y4Q2Em)Q9Xfn478c>k^#VdZ21hESFA>z
z31pA!YRp`$8SieRapx90+=i^EFo^`V*7bDniUt%?5cn3R-X!IdA@|2h2Ny5@)LppP
zOExNP+fuM)hj>uU^Z`4aLa|htU{K$CwQNE{euH@dA5N>RH#6U?SkEj0C8C>L&()c0
zG>Ba*HvP}RiuGx0Q3IgCu~sLrdxTMS;nO28qO=GWh(B?6?cWfvj@wifZ%><@Xde7Q
zc`<+dtOXd?#n`uUZ2;l&7{q&>5qB3lt7?;bPCvHmt&QjCdd0J%ac3?>KcESY@<9Ax
zr2ZDFJQd!Mcv^|H2Gr(Xc-YAL1=7Z=S*{cBAubR*1YLEZSdbeYTJD-bEJ7Oc*s~(y
zIvn+STNb`w+lN*;$gF_)O{z3rFG3vWk_S%K6p96KvX1xT{75^Zdd~K0v{Yp3t8Qew
zuS25=9LyFK4js~d#TR^0I8@ZHqoeHuJW9@rP)fEY8maFS58|68z+llC5cvsz4;CFu
zp6soocW%2POH=kXBg898$8hlc)kEBJtLWzK{*$mp$bEK%d9MOlpJe`}esAfyyeHLz
zq(-wy!3{zZ`~W@EvlQgV36W%u!bzd>#9(yEn84`TirI0~RXLiUVh+OGmC-P-qQm@%
z!7?<C(9vp9@@NSTqx#DK(F23zdkAB|el|{-c4!h%^0Wyz#fXa@azu_+h1(Bx+Ikf-
zJ=(g>d()t-zxI0Oe*lqy>@t4xid6}6f%dMyQ@ZR#eeU;<q(s}Dz6<+RN6czi40lJ;
z;xH(yNt%{XK`DM!11xf&uzMCfeN$@DYU5paIQAiCm2XM7hW?Et&uMK{cO0W-DNve@
zw=*V|Tg1sOczp*d(|r(dKoLMW;!22!s{X9cF!#N=O65aA%eq=>)fdLJ4#Szs=~@;0
zBC(2FR*-;HcfK_z^>C5UQAlKX_Nk5V@sAwP{O_R+zifzc`?Wo;+7UX@bIE|x%%e@J
zTqvdZ5R8br>&me_UROK+-aqyn6YRa%y-e#Vz{GCBRgYg$6F!2%C>R_BGGWGt`RS@Y
z{rO#^Q-9Qc*;LbVAeRD+&rFvj?HttYxtLHu%9T?YdH2VIz&CcKo#H`osS#ayu$ALL
z*%T9K>K~qrF%*%_f2SZ@IS&}WXWzeD+D8t@Yaz6SC`Hw%XeBz9D%xEdv}KL4X1%-i
z)NB{PC>&4N`|~);Wi)Wp1WBMi;Q|v9W+ntARrt@%M#J16?9a=VV;U~}LuRjo`HO>b
z-j!u^jb4nwk_=H;ugBK3qf>YXnXaSn%54y4k!8BYMcEQahq}*A5iO9!FW#kbyOhQ%
z?J(6_VfUv;{1beh6zu|3G!c;U4GYPgZ!Nhc*3lJX<#cs)uQBxnE0M6$5SNzQt|^xc
z*2+d>pr-z18RT$86tQ~mH?5q2lRLn2`pkc8Qqv3$U!joy0hqHM3pN3)Gt_FmG2}N~
z0c;22>gnq1`G>W}qUgG~CNCcXwgZudz;<9bZ9D1*r&{%?az*-Xe}5;qU+@LB(#04U
zDS!V%6?BCyy>cO8kpMqc=%D=)MbUKzZ*q`icY4zU?{P-v2u@w5Lzi)cBxqrv4&}I`
zdK}E00-?$QMg6sdI;Vmhj8c=Pj(GIAcZu#ymXeb93yn+w(upo%ivq3#$@1r~OLENQ
zgOT5sn>whOxg5~Fy3_JxuygyBQ57x!Tdi{+)6Cko1xA??kBs@b1a$C8D2|!KzsfBk
zCXf&#WO#?Nk1vIV_%4s?S!O<#W<qp+kTX{{2dF8~-9DR1OC}dD{-x+g=Way4R7Psj
zY8`_cd6&yLWegW-*3TGNV*(b&0cB!H<CQS!M%-=`1vC_(-Xr|SZRxuZqp@ez$CG|0
zGU!rjPZK}Rq)Rz9M!}Nj!i1FXU|gKmfyn!jF<uLf%u`Q$)4aS_?Ze?HH>MWli4{Cq
zTyvi|AKqL-oD>G{$VM5^%9ks15zmvnvtjOE&GHg@MEKm#M_{2(_(yZJaNh#vEOB4(
zolfY;x>Tqv<o?hGJO<!UooFp%steRGQ2@Qm3s{%TzlHdteR}hnSeKG+=*)@8PaN9x
z*FrAfCnl?It8{dQb&UW2Nr*qI@dk~+#Pl3?_^Ev|H?sdx^(c&CV5|Yi0`cv_6p@Lv
z8TA}hjv1WhZ-69vh5;0O(kgl6K4ezYW>_hWrwcAjp)2X=L<AoV;`9|Rkjb^iCTamp
z-{SEE{$$Y<Q=C8kWsrk;ORdrVux`@TKkDJJ7&1^ZKJb8%`fg>-d(U1MPg!`+-`Msn
zc<g-hnRhIxub{M8h&OZV$7~bqyOkJPIsA&o;ZfW5%x}K$F9c)?G0I1ASCJzIBXT;=
zq|1(aptgZtn75PZgO)>gID#IAEFqSB-;QlpPT-o^&OeNws<P)<C!&o>9p3?hyU%sc
zVMO2ddp(COB$yKL%I%+}*RKyS-U8%edqJ&}ZHW$wuerSBa|1@y7M?~9a1aEAuU+!_
z=)tOJ74E1)nusYC-!N(`0!2p&-nGRh@(tBG_^RFUgEHDDzsAPZ%te{~^&zdXH7p?+
zjJP*k#*Z7M7a(g~OT%Nv%)IBc8P?3;Rz&%sE84{kt0Eb@Q-;3w3Wd*}9u<^gJzOS;
zbUp-m-to><Ud?kCygl54t3D0&4^&l)Hi29d5E_s4Q|+ra-=d)?fHU$IN?j^k@{Li}
zpMw*H#h)H+y{b0Wiq1DRP8K*IBIh9K_m+l6SHBGm<<TOvCUOw2iY-FGP@dWi_&1$D
zlx^ztlpH3rY!oHE?<+FgD<kyg19;^!{45~y7IR*4mwhPkNz2?onmb38t3D(Ss)z}n
zHfWe)O!f1Z8FEPX`q}F)SVquZ(ih*IPgcbhFTjiT`J}8gMu6s?5SEW}k}L$o5v;;Y
z-%Y=7O3RrSKAIU!XYz_Xqm_v8YIQp~DI*|Rj*p~EQyvU=UdKD8D?a>Hhx&TRs~VLm
zu~}C`v6_gZy3$gJ8lj__A`~?vim2pnmS##Kyhlv``YM+;VrJL#D7*Q-fytm7^s$v3
zD_>GIhc*)9Z#Kam7skgJvoqkYk{76BJu`w@7}(~X6%}~cLp9Tv3i(5^)ZVq9!{Wad
zpg!)1NB}_0{jZ_1)Wyt)fu9>SdUDu1taR)!*b`Yg98w~QMvdjKL+y0AeII{6@Lv0@
zzmx%LW(o=Yn8qgIkw~sQ*>sJX*o2}Kko<%4_L+_x<#4BU$Pk(YULtWbe0*1Kb3bI0
zm>FwdJe{rMojg>i|G-8rR(2PI@KBPSGu#0acydwx_o?z!1j}NZpHy!3W>D1NV5UO`
zAq@zdX~bzfPQJVs-wKaX5|-;R!um)o2rM~xT&%~;`<am}UH8ey{b`)Vnou=v89sU;
zlR2o&LO`*w>9eZ8c&8<q_sh}g6CDsIuej%a%i9LsLksyfwBK+mM6?X;^)}pHAxXs%
zw%_@Ep^@Z)CS8=<K2j6Fp#~N#L%@P1j_gvj#7-Z73AxK&JKk-Ur*$A<NLs1{dcITX
zuxoRRFc5d4QpTNCXe1G0i|p-9`7rlOTiEoqoG7XXiQ*>!aDz`5;eej`6Q~*bz|<Xt
z&s)JwCdR(_2O5^#+`8izzG=Nk*X+h223JL*tJQ9GbFcu*t9r98pQogG>JAu8X1WyN
z2k_xJpM{7G`{B<8D0%3N2u)OakCtr~Tf4qg2M|s_?@3ZzOqQORAT=qT9Sa3Rpws=W
z&|N+T=?4sYiz>C0w+Nu{T62e42<^KYb8&qF?8vj0BxGZgOJN^eI;Ljyy%Q+xn99<Q
zJEa$@DnM6_o<db0f5p|<Z%sd%_~0DH<^UWWfGscE#6=VL3N4l8H-tOmRGS~XA%G%K
ziWvrKwR`?IfzJj{V1jdVZ(s*qp2?Fhc|Uacfn$t_|ElzChUmjPNO6sC9_LnZ*DpCh
z%keK&p=0I(!W&=8w!Z43y!UB)a2~_hutQWRlx9%lnUG|O7e+5UaP;hGdw7@ooTeF^
zNpnIwsTBxHxhCpdlIrBF=sw_n#6a55{}|=rxgu5FpL<)$$2^q+aJyGgPs=a-VSJvZ
zU;jYpr6=`WFC>rVh+MjFcG8QYn*_y=)2dfHtC!phvqJ|GtQ^oi`F6X|g;&C|Y`IQy
zfbrX?u8`C~)%b#$PNQ%tXlbLjrhTqrN%p8mJ8^NMe38b0n<)|oV3aH=1c$LeLMXZ}
zjqKRa_Ei1$?ub>uRJJzl^w_GiXX*aDY%Q7x0~7)~*OqpvX5_RV3(GtCQ#32nF9FXG
z47y28v%on0=2ZX^8F$FN{P=3Tqrpj2qN$g{gtz6gPb};|IQjhDBc>2y*RO8$8t%;%
zD!UEXCi`}^IC2{%Tw*!MdN~nldM0RfR+bTHuk?}aI@~5Z(3xutgZ-eWH*DI3VVj+B
z9u%ltNtC*j*zynIUxegkvj#Q+tn<3AkgUXD$>QSWeUX(<-jwzW`VGWB8KLZQVD%sp
zy1*C-No8(=1RTm6<de${`Tw?c8TPM;1hvOQbgjwEU2G@~%Zbmyml&b|!9ghO(qjIX
z&_KNa2?sX`Xmai{u*C|KVxxL#?D#|aukCsCo<7S$p{9hwM%@E+X~Yd4fAwP2bb~&3
zE<rb+8+W}Xk<ix7oLYTuXe>YS8C)fxkhq?L#=o+4i)|_gpyBPu|LL~KSWG{g!-^8K
zDjoXnI9L8QeLU=z?7R+fUR2lQn)&GO{h7`Va%UB4(BScqYb{yYKmyo@&BOH_lC-%p
zMw_ztiSxn`5Ld=tfp>(vhRiOW5T*{xwk;tz7jvE%sQ4{-OI&kRI_J8^7d(16l_4<l
zeyYXDNiT@6bdE61uh-=HawMfZ&ZAD9Gob)_mw@>dn0ZV1MCdiSlybgdj=3jZu`R$J
zVlkO_`TX@K76EC4#Ug&cr4)DZ6B&_yD&}J#JhpjAq&gbm^(ByPi0j)qggf>Pn}>li
z<22PsSr$csbaLim=ALWkqYQomEm*aboORR{NHE0l*pUN>U0Ky~#Vh(^G*YbPW2=zF
z9DGD6{R0&@?^djThlq%5coug}KFq7**E{O0O2M*l3jA^UkEYFfN0OU!yo!S%@@YhQ
zC?gl5o8zH)XfS7alJd+{nhUEJX0^Ott%!sk|I5q2%w%WwWy+f&AO$22zXF6hha+9o
zb5!8I!u*~>5}lwFd^tx4VE(rWL*y0X7xYovjLz)qYF1DUJIobyOSp5T+1lrG?>Nnu
z|LFw)@O|LUk`fYc<!~cLiQ*%+eeXX&yv%=kNhv#hFra3P`I!q#@sP1z<|@!MvNppF
zDKI^~bhwUxc%n2FL2ui@r0bai!Kz}+XJ48L#K`XELtwrRTVMX05b$mltqrMdOHA&1
z`-$8`|D_EInY{8p=wiPm{vTj3WxUO$k8Cz85-q!PPZ^{sKzAc;iPhr~rf)yvpC5|Z
z(VpF%9DmTXWpeb!mXrLO)|JO1yK#r|tMfm!O57_Sx7m8Vw{oIsMKbKt_utE@SKz-#
zFR#5_jk+VZOMvg~PO#tpD=T$re#gV`$LUkc51NiLPzF;l6irU@>>0Hb-$CwlY}`hs
zR$hA3zWZTPcs8vhB=I#qd#CqVm(@%~*e0EP{ruJ`_-;PR-(_QQYjb;t%$sVnqcp_H
zy;Uc25>A|LQp#Vtyr*|*u8B2{`~8c_E4;6#=QB|ypTWGWbuL}2|5t6%q<HmI2`^(f
z8uyMaO9$+H`OeWu-YBJ?&Dd!ica#k5yZi1i*Q*f^=QOYKabQcnc{f}avuEUn{C2s-
z=BL{bn}pB2F3(k+$N7cUB#xsu+>O8h@bTZ=-%-EDlbhD7#=C6EpL0GLHQsxwEa}&w
zOK;lLCd=BpvW?nqI$7#Jts5raxLSSUyVqH()#Iid68F5w%sX~V1*UI^QpPJ&J1Zio
z!Mm96WO$3;Y#`B2?k=Wq1&PKAj4^ac_~dUk+()Bo|M3yA^UxT-rIlG!(DDk{>{~ZR
z9+8vpeL_hJt31Bk{zQ%ZFw=4k#rWxeQ6ORJZ$w@~dIQUcC~5+vRQ`V!n!iz(|1Vg+
z*|9C}1&5s)YWPMUirV@`-dHIO+R$m~4_eH(mht=ah}%o>K6%J?cc|rOZ{y_Xx7zxj
zBQ27owI=g7L9fNec4unYRCmW=JgUDtnwI%@4S((!#t@ITAh?kW1~16OxV?du9C=d5
zV7tn|&Xqh;4E%R*%d~{=@8SoS&K#6~-KYNrc6zsG<sCzi-S+21a!&17+tgpgH|0Nn
z{m!?0TijmqAdT42Q2Z;$=kd&<?VeVP<@dGF@pbIpQs*b@t%eG;0YxxR@p^##i`Rp~
zJHNlUpZ_pEw#~ntBSj;rit)kO1hAC`zX)=hKuD(@X^RE4fx|M@=xm0d<$5$6wcOp&
zGKVD+cy_NVp8NMV=m2d=pTV6Vf&dS9BSGGFNv&}$UXr0{9g|BBtYxjqYo=^Lb?MjM
zxbDO+0)O<>melWr|AV+UkBfPK|NlvdLkm(-4WfifMjO>|LgyS3(xzovXfSHjNM&k9
zIBiOt&^}{1N_$D0mWeiLnn5+~O^X^e)l}0g&H8;#-k<mTb3WfszW@Dx|GD{NW_mrZ
z*L6Lw?Q!Q185M*q%=9zIV23w!i@isORUn#k4<TE~HFfEcP>MO)l)Hkd;VvAeucz@E
zO>QX`WRz3FAP4(K^|`9~pHF*;JK$kAf`@*=5(#&N-2_p?P;PO)nK}OpY~ZvW>=q9u
z78R7(wb0x*5vP2a`)3%es3788j;-bZhiW2UaI52_fd8sD`VZ_biH`|!bfye0;m-)^
zFbwZLkvF)5dwQy59k+(NB4RImVNV{tX|sjOa^xy5PmEb#R?{&R0e~DSG&6~C=vHUt
z`<agre$h}*XAOC#!2tW5@VEE~<^(oQpo1M=Q)fq*`-c6R5)fr#d+Te#I$KPSoyrSM
zaU@I_8ClsswYv9vEO~yHWMm<%K)9BN#*2FE>L9a8*gsMe-U=7YC(go*T_vkbw$$*S
z6s!XeaBBo?A;D2zg>1_gwo8PRh#(?Eqi)Ji61HN;FkHfJ>d6|BnD@;-2-1-HH?~FX
zc!Pm>#RUU3K{?AU*sVdWuC;fs30}}g(-6OjZtwD(4ehf{gI0}9q0|N>;-Io>w*VgC
z*b1-bGy;>K-deX8K5Gq*P56$C=&#|AjlqqJD&}7qwBcTfL#C3agCvm$m8K%<bS!5b
z>xv1Y*aq&ctF!MCa2zzT-8R#5oFMr$lVywb3g)-riVX-~y3EVNV6^emK^pr0vnSUT
zU|S&y1xTScqXzP(X1qo}NEjv-bBW0EnM##>pf%iNnknudG*VUwuC3$4=0iDElywG}
z?)!o@ZT6T-b{@*aeE1RUtNU`6MO~96ClUMzc5j^{k^e;V-4wm{9bJv<%;uUKcGhqL
z1(Zm8oO>^}^zReXK~*FD7xGq@5}=OimhGq8u`_q+K3O!A4wn*Z?B@Qtr)3(NoEd8c
z$LfiWUYdlWU=S=u^I?-`3b7~yqpJxvuE>2bNXV`g1&=BwFB!l>g(J9btb;`m?}LhE
zC%mPOt7{13vWR`S3?U2<$qL5nvcq%+CySW}`^rR<)t~GOjH{SoOil4%2+<^ze)zW&
zb%j$DW243(&fEx03|kKu^*FA^KJfM8cQuJ$4%rdJ-@eiy;<CZHDTt?oD0B-q0J{&!
z>yjk<<JnE$|8~P&JDe}kS#Gn@<}n5c^`(VD=U~4<^)`kTU(Gc#=3fp4;CA&`F=(VW
zW?5@K#SjXe;zHII&dL@a6_VN%Az<L+qbI&~Y$(A_aCWcAiSC8h1PM^<7LnRUJLY^8
z5Y;%fPYkIT0<42smZf09ScvhWi6&|^=l^hg_jOoOHJ$UY`QJlfgUs#WAaEX-dfc1n
zXt@A0r)NgeL{pjUl0%xS1(K%5WAZm26!N01ErF|$(}W`>p7EbC*o`nl?4JS^{Jeoc
z*P*^79y@OkDd?kzPdSboSPDCuU_G+8Prl{mT3!qmG2s2jt04<t2<pMOvHR}4zMC;q
zadmorA*q~!_Ttpb3mkWaBG%0^5D_bg64DU60K>i>mqRcz|NcH+eW2Za`|UHB`!0R&
z){qOfy0az{xf}noxFY_u(|Ow`chMGv(H9o+M$tE5{yrG?hw4=W2@4S>RX)6g&YFPo
z56T6measq#X*7ORo)(m-pItMjY@p%Jf1?r@{$0rzf(mJ2*xu4xwPVBv#i<rOS=BBa
zf?y|S4%>K$ZjA&y$#KoQAIs#ol?85>gWMU5w7lU58yDP#1=Glbb_D)0+N{R(^~|AM
zq<hXU<!m#>p#0F$oSU9=f5zDjD_sUaamEclCWcn|E~(`T5f(=8jerU7N~qm1@W)-w
zbSfxR^ka6`zjW!Fqt@lX*>A9OoTp{wHW*P;b>v?7Xm(vOo*g?h0ulU1#|$7W!@fp;
zn6)GeNSW`B+<0gnBC6Lz1@;aF7GUhHuQLVa&wj}#_<c~6T)+OLl#&S(nY?=_8nM}b
zi-Mtb6AShbCUXuPtM9Lmz{TFyQFj-=kyr|^2%wb<t*DL~6V#z9K|k~LD?YTCaJYZm
zuMSFBfTuWd@`q3o4r2;4YdnRalSPnI;_vb9U4MRo@Sj68EN8;G^F*E08pw_p)DuCK
z0)<k#Fj&GGc--PX!CkP1&8b+RHYNn(OcZ+|f-dwsr$~<`8nelAI&CPyM&0^zZbX!r
zHI+`KNa_#@2Dk+r3a8-rMe=?)j2YHRC9FurBS<oySRpqp=#iEK)>g1OHE_{Ev?D4+
zQ_L=j5<?G#70vvWSmnXPGb`q<7hq@wl4~P$+0v|mY>OTHBz+VKN`%;mLs6=}CD&O&
zIN$ZJ&!OL9QJqYIjVlAM2742R>(5xjBTCW`@&#d25Cz9_p>iZdusR+xATBitbbEm%
z)X@8xlQ?`yV|Ew|8i!M?blQl5&%dA>J(p;S5cNU&ywj58$|*!>9wmvWf^eOT9ioUQ
zMJtHE2i)B{@VCTjGYn~BXyHFh5)+kC!J=4LiQ*SHZ455_Fvs12?0LVTYhKcnapMpp
zx41_#hE?}vt(^Kb^B5xbIP0ROr%L}{{$5}7qFbug3(^iZ9x`&aCX&k6s{}@QS_IwN
zX>jN==R=wyL$&BzBLJ6Z7AC!2-t4sHVcL(8|0E;L+h9T7+m7cI8%+<-N{?LDR}L#0
zx0TNP|Kjn#2`ep=RU~4WTruN%Lh3+O`d>nox&)j^G68XVtPpKgHTrfC-P8PsJL>v$
z1=ClCzBd9hz^c(%zB4j`n3gi)*l(7{AJ#r{{m_Gi3gIEK1v7*=L@dEZZ6FBxLh62j
z^8}*#UT1_Gl6Pw3PNf%0*_N}>@dl^gXDIFHS4p`(lg=Wxbuuc0%mQPM-0_(EOEP<B
zC}8S5^u;<(?af0Q-lw#c5CoGUZt7OGL*3Nwjvj$~NaS8%DMnkj3qiK<8_ctLfc6#Z
zE9ldf2LWGlAcA+Jvr=69;v3g!drCrzw;=WA76Ah;xS-M<avHxkqOip>q*P#hR$v9;
z7h~6^bgl~hd(B<SRUPB*)jRAa^YT{f_zlH%HB>q&^}+h@jdQE$>2;C4zmIP<+J58O
zNLVN<6;~!_b{T*F!=+k+0`pf9xUh5{qjKemYy$p3XwDj8D(A_3)-^>H82^g`_de6*
z^x62SJKC|c)p749L1ZTF_yz@{0yCc+#b+foLzpP$m-a4>sBrfiuR>iAb;-Za`<`kv
zTd17<9BGkF@WL@Mk{g5bun(r06J~64<70LMT4cgXiBm0X+3Z!BYrT|k8wzx~c$~TL
z4p!g`b7{2DoT-gu<D7<_LsmoYSi&G)y%TvoS~@*S9SfF&h<2pAs7bV9!-933O=&c;
zb>y)=>?D>MB%z7X5wxDcgC>%w>jj+N^&?C>EH%!zqbB<3d>9#x&BRIOs%ryBw)W>{
zq6Ebn+>dEhhsy|DTS)=&3(gPa%^%<>{34{vN<K&Q53Vwq7Vz(Lpr;S(t@)wYmHBI#
z`MO2P;g`=FRl#tUs=<})#LEw^$_DJxMQ?#N{us|Xy>UA5W&Kc-legxONnzI}jAy!`
zq3Xz?rbHtkzcg+eSI;fy#Q#sZ#qgEk3RMz|6)KtYeqE<A7Bfc`Ao!Vjf(CvLBJsr-
zeFzjFcbG0HSDqKd^Y^-qf3mQ&oR)jkWijnf8JeDo**@o9oi2Og-tilxXeX+(pq0i`
zSkuoE6%#6dtG7}YTo4!q$!@-<XSs7a!X}g#O$Z%+A^uYZTgJRHw0p%p0=Re)ZW?MA
zobgcG92)GNS6A?W<=WK?XplqOr&jP4%ew2>J;=5A*;v{H(vEojgTc*yh8r%Jet00|
z3K6|WP)VzP#vOFz7g2E2FM^_XoG*slW2x5cJy?WQIs6-*!LJcmFu!LyDmjG^4oFPH
zFPk-#7Dc}nbaN&RPj7*PY@M;AJ-ah~Xa2z6)x!2c$ksw%nu5jU)<n^_eBF@0Qi+sM
zgAb)!Bu8qSPapg6X}J&libQetBvFVI*&E;n?!Ai&?8VBfx3h8utR7DB%J=4tw6pls
z&c^d2CW?L?V*j<huiUTBD5wZE=z;P=@5baQx-6~}B$4;U{@O+CnrLKPrGsGMLynzd
zV9qSPVXqs<8_xf#qC#XJ)u@RtK&LaffAxy5v3hruz=+M)Io&~;SeA*TZurR#yQG@D
z^c!Q4R$iq3X&RJ5p<JNN7VX+EfK+yKK5zM=S@GHYrNseT^`IN4<*QD_U9>o%8F4e3
zpz2k0!Jwi<pW(#sSh#knG`{`!xNLd`E*`P5<Bfl)E?zdK!#`ywtU_n(!9m2Qh-f;V
zZ9MsT$J&h)?AN=q<vROi?%gV}=F^iWF8uP(eavtoMK)M60^+Vn`!n_p!Eyv93}Nc)
zP{drE;ITd*A2PN}fSa*aU29NZS)?RLXQt64-o*SzExInU3b8e-^<;8$nhJE=m@jS2
zk59&2vQ6$htX|V@`I!-6QvN&a5?FfN)^&b!Y>4klP8>?;3kwNKti<AQ8nQaWHQ+|Q
zE9`4^4RnE2%DwMqE>XL6_K;xYiCobyDw5w#S-D>CE3XF?*&BVN{Xz*03*j0v-&Rje
zP4AyMw9;MYPVK$#)vema&a-%iZwZ6HN8apW$&}zZRV|*Ia5%rj@4+?_*YX3(s0J6@
z$#7Dv8NBmLM5dTPwCoe#47ygZP~Li-Y$hoWE5H>JZ9{;MxqA!$OQ$fzSI~Wq5O4R|
zJV-g(nZDpv2?PUouqZ-O0)Nd_tle#5P7qOGQC!6V)?hP?NeM%DFb|8Xc$hLs4*OhY
z$#^NaThFq|d;iD}7)2>``o1`jIZ>p0YC&(U<)-<$DfZSfluj&x->%d7=0Q9x9L$d9
zT<rWFFI4apM`{OAdH1a~XTK+qMn)nx%Is&f54zdc8)mHXZ`ShZgR#Cjh@i-Bosy`N
z8q@QXTQt{HgIHPPqaKY5S1#Ot^f0jTU~`qRcigS^ZL7RBP7=DWmFiwq+^YEP`jB@V
zVQsD_Nh;%f2-VhL1^uV|T{w|0tGI@D<^cA11$LQ><>e^5w`mW}E31FuYA}Oae*L@r
z*v1so*~1&P4Jw{}{Qdl~aH1b^m{f43$<&Nf!ikYR{mK8=1O>wITlYy&V{w((bJBt}
zeo2dN3G2NzT(0$Xhr7^CaOUu7ZbR^&D+TaNX(_^fPPUw-M=bYF4acb9yXPdKEwV(O
zf*wB!zjbyDT!;FvlQ)W+XGS?OkuY8zLQjZMt9=N-ia~yJ4ElU-DED0Dn7T2gC+7jG
zd%!>x&B<QnzOgotYzBk&Jx@OryRGU9JTu0opBZdED)3B8Sa3(17(T!0M!&00>^beq
z(q!J6m<I{9JIstgq<3$mxuk`L(GSzU8i<$EReBHShFCP05>{YB@b5Y&J^RCYDNj?H
z#zV0ihf-{6TO%*MA^+ah)qX25Uih+MH93qnQ^oPT=5&nR?ixg^f3op?5sNI4bYUu!
zT!?Ia<Wzf!?;8BW6Y|e8B4p(Zb?aX%_TJMzXSB&K>+$(3d!DHd{U(1f?#K$>*$o@B
zqGdPkJ*M>c30>9Ht0yaSl2qelb~Ucppf~Ke?$+yCAH?B&1Q|JvAsf*{2@CmbF|Fi#
zpw5Vfci)Iul~TeLmn}>oV62%{g3hr1P80$6MZ&_0J1v9+ZU~CemqOroaxQ4n{uGBp
zcq>ri?p+ThaE9arZ_P7|M3^Zrxxe0WXwFt0=kdUH=ptcN_y{g*Kim4PHQQR8YHMU8
zA|<70BX9g6B2n!gU!rW2hbCGehd;8?jQE+TZN-GTTi;GgdTNleHd@Q=F8NFyceZU~
z?lLRZRJk~X?`l~+^kVEy2K^)({;F8+*ftrZs3WpF6vO3?4I&OLukmj|$n)OsT=$;U
zDb%9Xgw_2eS+InyYTAkvZV@`-*qzsQd@Rf7p~O#UbMl9d9lAG)T6hYt7MX5ZPAeP`
z3vGxCWqt&+K|ysWl;bGMhF9OqB!;y}8W^~>qV>dire#>!6XvTq?EyUjQ9>ZT5gplt
zT0U)5lOx!RZ7|W>&S&<W<B{rM++In83A`9PKl60^PDw3Mgvv)OP)&%zqR$!;`&+^!
z`RtdrRc>n(Ec0f6!M-;*^km4I%NxosxS+0VY#XVdUo-P3#H9o`#7RFb4m^5o$a-2V
zU>7tG*zPs&*np1`2$5Bt_&U~wDLC&wwwZt9eSz5;WYw1m9VjrkNT0j6qaO0mOd*Cj
zr^XQqh7L4|&;bOmfGOBk*z88h0-x|5H^M(!4S!QIhAEQ_!shcBt6StHyCS)sW5jI>
zaVH;hVW~I<pSx8?^BSH{uYE~jwd2V2Y9|<*^0Xybd~z%H_9MxhtRMs?VRjAtYT{>G
z9W-6uu4ZX9f^(?x4`XuYrjQKEf@Y^$la8)9k}dL?o`S7d7??H?T*6WK%gK<`=Ruv!
zK7rqSs*a?j`U%;jMN*FwHkINiGi#n(oXTp5kC<B%yAT#wb5s;Z<F%Gu7?sG$@tA@U
zd&^y5^37h<fnnihRHw_DQa&)poN&K6BsEz7g+YXd^206uFp}ACywZIW(#te6zSVgn
z0?)2ULJIbEHaBg78Lqnur5tKEa%>2#c=HcK+9rb<5PpmoW|>H4Hmq16%!=c7$%SFp
z<l$xw#PKNc41|AotLDG~VVQW4OI&yWm$;=qY>7WDGQf@Fu&kzdRI}TGZ>vYJ{RM*c
zs2Vy3%hcYvJwUjcv6>vZb(SX4g3XNeN{Vp8R+z*<IBg<fZWt63cNvSG<LC<4P;=)P
zM4^Fro^z5NwSp*tOB_v(Ughv;JkQEqDZ+fF2$U#`CH?%_x40lpxEssLS4b(sF;If3
z)b9;j>#82b90{WY=gh^6zQBZIl{E|kmL+1~{-C7#N`@4~k4&n*2swwr=@Vil9c(QO
ztYkn{TtNOLBuJVh;;~H0SILbr40+5zGD;Z0-e&fSzc7PYzBG=8OEhuD4tG<eNQ2-`
zSLB%CrYYhw6n1>WH_0p90(ce)xVhCdp$Q`uZ`+Lyai@x!4TRrQ;Q}O))ymDs>4gYl
zA*}*5PCQcwx9w+G6%XajKm=bPSXMtx<Wg$#2}k3GF-HSw-Aoa;?r?O=Y+7GtlB<BS
z3U-@wGtB*4rKA}*Hs5>?BAJDliJbbXwn{2^LlE)CUR?8RG1cXL)k;1=m?gO^=p4(!
z$(!@d6D4MJ;_Z-6cs`<qBpH&-N0#EqLNbjV)(eYNEM4GEnPA&Y2p{m-K_N{B!f)|4
z3wjLP+1W}Qg;*Nqm=3vC#U>swHFCa>aYd*zVDGS1tX`t%aHr(ZP|!8*iC8+JAu10u
zH8)^8YQZj;st&yuRL`LaZAGOfl146$#-Zd${o-cI2i(G(3N?sfBs)yxbc!cZVJrmp
zS4URU$s;1AI3>{|ixnazNCpr{injbi9qCm_tZ5{jExR#r=Yb(FgC=f&sc)1w8ulFp
z$83O&km`tPk!@YQNgh<v&cclFW@FE>4KYMy$h&RqkME<rnYGsPfysv6AI~1cBM7t?
z^8UHe+&;;tKG!)(HGDxq$S+u6!PwC6j_O1nQB%nR#pf4D_-x5N@e}&4L}lPne>hic
z#716EfvAU_F>Xs#`BN+@;(p+sIe=>0euRYbCCgMjX)(EjN~d%c@Uw}Rs(pp_CdB70
zlD-rO$||<prz)()%}<T?c~lcK?X`a3`ip5H;R=THU06)*ZRng97vnfI&RCF;j2mrb
ziY#cw(VFqpYGqqkjlDTecG6)IExdm8VFf4eiwoOwlda{^4`tp3B4h>K9rD+DNzFwP
z%8YhPJWgaYBh}DI(dB8oQ+^`ET}h}`{gk1&m`sG^ciTzSgTI9YKgCGQh*U`yu9TEk
z2Se2G=i#QU&`#Tq$|^1O1;j_RxHvdI2l&5MZ!a31V4ujvvr&1{aOW`aN}_2eX~~lo
ze9T`haK^PHLbF|EUB?H*B$6T&F9H?J`qLmZT=G)5m3m~g{WrGN0!gmuatbNU8>^C}
zE*#qushv%OhUOXy22+u9t;e}<O)O*42hUBMqV?d@i)gWfS9Y518@BrLa1|-ZpLcM=
zpPcNUrsS<b-p~3zQmD;}oU|qG`%k!&9!_oaGOsU2XUWTCUts8shPd&QxRDIiP*cfQ
z`=cFOY@?6K-NZ1xZ0aMpN=~_Tp*HIpB`vrG6JJ6@*WRi}#ZBM2>dUX%`g#qDUaPX6
z2haKN^Kg3HK8DqsA<g)h_cN7j=4vwjjWrqs4hC#%ybv?@RFzb0&ZdN0<LOzFG`Kgn
z9p>UAFS%vO=FHl$^_g-_bTML9voi!WL1e;m^qCe6+65SRFY>BRO7t>>iOM)8jSE~w
zL1$)6#w_J8YsmtX<w7(Me|fneKg%KOLGwyW2T{Udu&F*#5ZT{AL*4-+RGGUODKFA0
z5v_y1uFBITeI%&QgrVY}bo?Qi(oA}q66G2(Qcxf{XMX=*w}F3O3{<v(j)#~%g-a33
zyxOZKy(lDT&!Dm7&YFc;n22C8zb4j}A1)cIH0S?)YbUbNItQo8%q-2uPPqF9{;3hW
zIyoaIR}uN*&nWsSr9{`E@2Ry>CY@-`H${4iB|5(Rl)f1&mU8T29b!k-R@VI4)pbD&
zp}j|Oi<gpr{|xZ8qBX*AD`4VzaewyWeWh)CE%z>DL31vXbrHv+&GS~7yxWoT^4(4-
z;ogy)W0+%=_3aR|I$L$a(8H=Du6ch!;ZH|nw_N_4`i*oetvgkiMSN41G5gJHY_QCP
zm8^6y&Wl$b6?f_btieO*{@Cbll^Szpa$K3QS6*T!SSRruixpGhEqNR?KOyz_fBR+s
z{Ac;e!Qlj@iDc4)__LDpci9iV=h$7d#Q4Z(E*#lB<of054!)9);XwPYNYhm|aV{+h
zw{zuU6|_#j!l2c|<leWJDuggQaA7IC{;#9>FORaLFmYMTu+B?de&vhj?rrdph?63&
zM&z9C9lgff-MI?yRUlByA-Nc+{_W(G>xycWW8p6!fHjhy6!$HXVm^2M&~g1GKb*7S
zOwL8|cQz%^I?#D~;+N7yK4ZL_z8nl?wJ~F9(6z-GUk)zH3-=P!D5?P;JD8*Mj}Qtg
zFCm0@i!#ZcM?ZZu75ot-gOK>I#rFhV-o&<L1h7R?B4t>b6|1%?h8vO*>kw-z+viB{
zCZj#Oa4~f;EsWqCZ*jgj3`l)C|G2LH^Px*Gu``>(N8&$O{0+-bDagjT&pU!8l1%X@
zEEGbnez6alAw{F47=pET>?$uklj1BW*dghTH>%T2>!q2JU&92foG?{GTMjcpX={%7
zzh902@m;oxrsCIqR{W8oZ#m-x6;Vf^zpaR^dQ%?=b+x+QbB(-{H=Ms?A0~FSvLbAM
zrgVkGiN>>^QU083m5W+|_OoSvTXAYR-vKA&WcqFXcbxdY>|H;6WGh&Dw=1i9g`0b`
zhqHxGe<l8;@!7otUQL8@`zFsF-1UC-_9LG5V1p#r(93XSrMI`2k(7&K7KYG3&um2c
zdXbbTNiI!}f)RqK8}aYE{y+X8>Hqp|Fs<31oB#Sm$Vtik$+hivb;8_v+vzcjaf)XD
z<M%zH3;4GVRA!YFi<0we5ys1T#PRJe@+y+~K}&QLG%^{@$R91$9ym%O?P{zJgiO;+
z?!8Z1(h?4@2|dTB-_j0r0u$`#*AshkYM_fyluL@oeZVYM1Xy@4w`p#;MjCLUoX=1G
zF^bj6XC=!azfw}Z(Wb!Xt33Z7?)*QltLx<8c9FlbeNL#di1i2VhQlclr|_`&cvSk>
zK+9e-Ir5yk&sd-O*5#*wrZAEbvL@gog3{v}nl#G+M3hP8NG=DiyQHBhhP%mXc0icY
zZFhq_Ts8nWe$SjocM*zPO_Rn(ZDvR>c+PgeeW7lNsTO}v9nLGMTIU~AnGbf|F*!sF
z&1ssB*5-~Se|+#?wX@cvmOpqXd@nvdJ5Rdn{<`8#Qy1aXbNi-sZ)!JPot-V64oyge
zNCky`Rtpw<W_$2+PG~cOmRGNl`WR~Bvze)J;)l{6_(X!zvycDNy8dkenR4p5^M3I_
zP<SDQPagn+!m$bd<5xDFTXy2{F4bkZvy@=(us@~hT&s#myr^Q`lKH$*hxn9rA}W-i
zjs)UdlkT`-677y)<I<+ADK%xxd{ZYC2ARU$x^}Paiut}@_cW^gTG*HZm5OsYf*~x<
zw<@>0rc_>enj!+`6<pb+nbs<{Y!5&MMtPrs^mY(!PpEsaP5v3f|8wZ&wu8Kg8Sr9e
z^R`O~C<+~L3m~C~;pu+<!wT>lk(yD@f2@rd<6FGOx<8iPF|*rUno$T$7Ho~w6r~Me
zUgHR{%UqUxDJOT%JQSB-t%(<Bahh|hfi#!1k(-Y@7`w7a9?p?pk)~UFrmz8K(4<yl
z7AwV{lqn#|A-l;RN7fOI=Ajz}H6q98B@aHTR$qqjO1$v=$C`V@p`4yc&I}@TRH`L>
z|MFz?$T}FNQAjPYWOX6O3Z+}_DaB8FQz+K13|p~aJ`=m-4?pIiuspEE_PC@f18lkT
z)e#hum5tTIh9n>*e12Uc!VvD}(8tz;>w9Pf6gl6;*S`kv6BhDe-TtR&!FXrcgVM5C
zvod*T-63Q}hZlKCYm%GXetRtHxyxJzkmbsdAMY*WeLkQu*>NH{tL{{K7CL{*0SF1F
zERq}3wjv~>hsIwQn_x$pP2%6_)S1P}LLMGjy>fp-a>eaC2h4b5D__Uq8Xwl(RfSO!
zF)dAztpk*4TKp#s56+Ti&}B22@CDYn(MF_fvso{2q5!dFrrT%b+%wfRQI)EO=u=Oe
zmv=cexX<xqWqoX@t`WcN;SU$DvWOjZ1>lo~Eb&-%8xiuvW&VF=wg2{>9tPn^KHUa5
z7<Me*;1zDV16~0Z+<|lMH@3Q*exgt&@6(&s;G~7?-_|x6ndL@b%D|h|zbk7BNGCf}
z#Gxl-ieX*_B{RKkmi2B7+iOdo+MtpQhHY)slGqNbZZQ&}fg)FR${xz$&eYd2cC0+t
zO&2%*?r|ped8;bbSc~E`p(~TxWH#%Hf0tHlJySgiV;<?7B$j3#9+(6!r}puZ{+P1u
znPrF_&eaJ1hvaYI1nlN7+30i6b-K0Obz7TjnY2=$dojcqY_|uP{pmsWQExSz@N6uW
zN(k3XnlOBiGU5ZfF*rsmPcPs0L{y&HQm<&&QK?@B%*I`S*=PyYqXb(sfgV@(^hA{_
zT({hp3h9tSPxgl!VOO2lxV2Cxu`IMCM7k*g{ZOzd$CW!p!H2Fwa_jdOTJs?X_*<8D
zI+o$|@9_n|KNkcj9CTReg>PVU+QHkj{pj{ipvLtczc82f;-F!oNF7-@8lps*DW;ac
zHTrG{_C$!bILtxofBVRPU%aIEPVm3we+;%nGAY;?zD`h02C;^fmUyQS?1|(?oWZot
z+j-|lmsGIL5NE(<`^aDad$sK!pIx>lbXq7VwqvCs*M?pLO7+?NoS@_AOXcvEyW1-D
z8X<ovgEf(F18TJ1k?znOmGDkgONgh{vI^}8PrR9XY$!5!G)poM15#W+30l>%no=n)
zxZR=@SI`NoOFr>5_65z@yH{jAu=sFxY|(D|roWdfAc1%=Hg$;Z8lGr0R)G|8`Do5{
zNuA5U+vcTT{66jL!i%yO#ul%or$zPvcVeH)fEFb#JMQRn9PEe`&ul^|Ush0BJ)49U
zHu`HHqo#Sr)X)20ALD@)k;El!Q>py-L0+?5piST(fv4saU12BwTXq9i_U@O$PD)<n
zA~}osjeuCAQS~%6r16x+s^PglJL_7`d>V8(d5U{o!lGbv|M<xh>XrSh)1l=IwY(r=
z1;a}0*>>EkIeRBP)K6(GXXSa2)mZPNzt|q7@)U2zxwW*?6@YHAnqfV;s5EnNKg1Xr
zaKd8DnqM&U6CWQY(`0+XJR6psUh`CJCdi@8t>YzAVsBruE4N>1676))i}t;Ng71Dl
zSm~<ssPh*!06J0rvCs}O5LHIOD3xm_YHt0>QS7=t+bqXERbo2^Qjj!$j&wUDXmpaK
zztR)(aYtI}F(r{)aaXSq;G7(_8lleZ+_v#9T<byEZ3JK|f((RG^)}F~w_oZ7-~P-C
zM$R|cgXNHpdCFn19Fi%1SIRuJxE$iGy@n`N;3DxhAyzi1E!&Td-cBvMGmC65(l&B(
zX*&t4#L*NtqtQ#<<qPlLzOajBU4Y9!oZS-O2rsN|hug+mD1dGDBrHfY&L$bfWh^op
z2gIYHU^OHkYmgalj@iBY@CbLZ;^$G;O@`6|#PKCnlRp%L(@wp21c=7a%fejcn@X2k
zlN&CNDZKZ$^ftBYdi4}Ry=1$tPHd;{;OgGwqQMGcg9O2&Wy#0Cc%hn>y17t$5$gpJ
zsBawto8PGm*Qb>)B^$1Em35=W>I#RsP(@@#vQ0V=-)hC?s&NMU#Et$ZMBS46vie$M
z%^=tD^6nt~PuKJBYW*6SCdd=aZ#eU(p+?fL0peR(M9n%f5Z|f-fJVldLi;}Zdza#8
zpUDib9y=&q3t?;}uC0+t35;U<dXT5a(?f6T9-&RdgUZ;?jVaVhH61<iv~1qi-J!wV
zN>bGhuUOHO!_VOcjp0+>VlsB}w#n|!-2;I3Mkn_9RC!!Gl`G|&m}W9_y}=%Po=t4U
zo%9d}?<!7M3={n1-LR2qGP&2G+_4)qPQU`?t*c1{puE*zr6cNonR>vf65f(P{lrf%
zlj2S6ci#k)^1_(X`tIAwk&Os>|FQjOzy6XwYW?A;<cj+8vgtaJAY#AjKieGt&GCBZ
zgxdlf0OjvRHe>dXBc>xr`!j%>RIhvSabLt7=?qw6FVn3^itFCWNd9C54K$p~iez5E
zS#I>S;X5Y?E5YZ_>{vRiV%C_0Z1ly|Cj~EX?&I;~m@Jy+%_gE;QClA-q@jD^OiUdq
zE!A7=wl2^K_O&noV8%)3)cXq10V&y}dU$3)y!U5ifcv#C`6B>~<Hml)wk>helovh5
z$_vn?YOC9-s@CA0H^Go=b$c#Y6?H<w?5awhCT>6N-)RK)*HP@UCh%}B*1t$u((l@C
zkmk9OKe#6FQxeyb4zRxtF>>Un3KDeRP9z=OoCK(h1JrcX+?=;mBzV#TM%(A!Yp03S
zr(der6xe!+!r!o|#zN%S<sdi-a`#P3`raS8`;=597{sT(ULX?ee?Z?N?$@<HsEkHp
zHB@fFqT<%Jr)m&?<5y2>O8O?wCOoIz8cXn&3U2i?Y||E8uK!<kqyHRupVswItKfKm
z^5fHAifjRt@laeO05O_c$x)rqi-KEwHYYUU)5?&FO<N#|8;2*Y*P&E;?-qB{A}>tm
z$@{OH@UG-@o1<3bickFKbN^W?;I2`pDPn)axhlh?R1^MlehxjG=%)Z%dEv@;tF%k4
zD+~|*SOsZBJCn?}E;#H*tZkrfdRkHM1hzj+o<c(v{vR$TT~_le#Icq81=eAiT*3u%
zTR9mmq?09=vvur3J3MbgSE{Zp<<Un?>r5gSktQ6^Rx^bLwUD%-vIwk?7wzX|8c>xj
zZim7CwYq)=VV~NsDZW-L)dvnxinH)f8$wW$X#5U@CZ<)L12)&sqp1Ndtc56~s2K-_
zk0?v}Mvxvn^IORJPUw{8{e+Q8fRMie5b{tU4;=HJw{I+`C8n}wv}I+kmA*0ZbAsxV
zn-ihf^#Q7l0e&zMpZbOK)R0c~^l?Jym0ch$X-$gZ7P6n!4R4$rkV<W}Zx0h}hFr+F
zTivr88km#?4J4QJUmezRgf0>o(Ib;YR~?N&P9w^EVeBmTqG{%%!4(_6KU?N=0IG84
zjP`0;)v}UVQ0fX+9HB1+pcZ(A-GXkB;B3VT($Z#7xhC`gC~>^VBED#T@#?gQeQJee
zZ|)JzO<K$SRkVB_WF6SMY-<jX1}5CD&23I;xqkFGJe2w@vM6mYfSJHLXjMUc?#qDt
z?n`C|le@0lNUE}cgTbGbyqc#}^Y;cFwFQB)qSr?*uT9S3nZ0wVngSH^z;&oxJJP6#
z)DDew;&Pnw+sqi<1j=t79P7!F%~(uNWI0k4{gW7A{;NlU__fc%U;NCViVPfCTwmm9
zHyT2}wb9=HYR!}TcdqSNvo6N)ty*1=&o{M`7RNnUraJf*yF@fct|n1L*N93Lb#iVr
zr2>~Do3!MOVo*)CT?aK0pEGuHoG{<li;JnrZ60->c!vxrJQ?1xy0~@}zmMVrHrDks
z6-nK(Qgl2im@1V8P89i6>s=NV>0_9vYBgd5yIHQtXvquwVL7Q^zEw}W2iS``Y>GE-
zq#bB%b-1M`GWM=4YvsR`f=tx33mYl5m%UbSzRf)?Fs3M8YxX|DQ(lzVDiL)jP&}sa
zs;fA^NvuxbwEmSD{8xDXk8|kLnNb(bmauKv_S4~w*+)pl<pX#=c$;?a{>E3V-`@p=
z<Lw@6kG&yy`<9s-3<J#Imc-Ik7CyLR-?-zb__3vK0NZ37*Mu(2h`MdhO1_ah=R1S&
ztaFME&yL^jP`p}@jJ--SDl#s!q_2~1tGj-6rOt<DiF0l&X->xmjl(JFINZ&vc(hG;
zyp&>Mk7MUw&R@qxhA3VvYv5VE`LNILufD@07>s!;3g~NXsiSLMliSu=zn=tcy8j3j
zS7Od4h^_f{T1%FfLG8L$ODeC0T$I-uC0~9`nw+h4Z@KHgKW-U`0xiTFZXQjOLgV9r
zATSClOxrv2rqMhoPvVXvYfj^WTT+dG^5XZ(J|M&%X%SwWrv!Fp5wiip<SIH$o3r8B
z_fNT(Tk5<w<A?KPrnV1n(?mZ2W#4-rQ=q57rn)>?9r6YyTGBSR$(XEBhp9c!&pMs;
z;CIbCjHcJP0HCdPO2jU#<mGtfN&zOt4vzy{@n~+YTBxM6>~3cOl#-Oybi@^pnUL$k
z<IyL~i$&m15O>Gh>n{C-uBR^h-#aOHuk7@wQ6`yrgEe)&?#C^V5BWvNiUr|w(>XJs
z1#Cv;JdT7|xi<RPkY6_mf0HQVmkjPo(qdV26qqR~Y3uw7L*UrX_~kIr1ljMqwk&&4
z8{pz6w^sAIp@%nxCNg%;-P%49{k-&FOX?)hRuh%<@hvl96+bzON?CnNwdZ(HDFZv<
z1UsBP{J6_#ep-6>t8J4jobRC%cE5mlZpKuuGOIVde7WxeUJ8px*3WL9nOua$bCMHF
z^%0c<sTXuu(rhPpNlS7uFFb2f#37lmEfekVPLA7Zh5OsdUZkBvol;dTHNtT2Gt(8z
zd;lw+@30>mcZmA;DkSpOID*UE`oYWZ!GDT~|9pXOD*i9ckfQ(ZnjymNrvHC6LvW93
zFV&lOgPQBLT>g@!UGt-Zyq5tA<MB;@6=X<zE}ab)>`w2l3LvOu0ziuzYfED)V+tn?
zHP0Ur)~21%@G|rY8*zN^c%)dqsAfH>!lF7sVgJhSE~439!n>au(*u;;OY~{5vLkM8
z$?igaCnSP+cLW1`l$hLyE<X9?u`J}?vOn!tUf5F97}XG~5*ruYA!U}(=hFj8?`?BS
zq75Ajp(qXbR6LG@ApGRr00oDL!gnvWjOvNn40O-fu4fg0g;k_-|At|1*n#2`GUV$8
zXCiB}6j`#iVLJL!9Q?~u)2;gfWRbL;tnNe3s|01);MIoEL{%;|tQ_RJtGt)C;GHwS
zj}sWl?Td^>BjMEoK6w#Xl6Z7ea>E(CS`1iBH{PXEY>4r;u&eON&_7|xo^fMP5Ib^z
zhavyMm4VN9zqh380_93+qJBPa&VHV<7Xac7!RpjBPi6bf6pTTE>0!tp{z=Jb^flT2
z4KAU%dGuWXuxNoq&w4iY0$NF-qxwKE?$yPAS3my~+WvL#y{Qy@9#@qKw$f|finD&;
z;VGUtvhj#VN}|bo=>1`Y&GzFi$lV<NOH@o5b?!jD?({q9PI{i06I>1|?oQ{I%+Usa
zm*%+wsdO!1mE0dE<djNx(qE2!()7k1_|riH`ccLX&=q^%v25J2QsLhujY)cH0}}Je
zyLGf`U*e1Wib-eqoeyQ1lC`~8aapz}Ztqyq_u_Y47oM%KkP82T_=Ew%zXwh?zREoN
z+Yh>8VIyoLj;(yvOX;>+{eclJaz^{tvZpQ<R}aj)P(lN8e^+N0VnoqU+%MC%OI0=$
z!!feJl$l?o6^PKcl5qf6%v^*kBIMq0L6Q}(8Opjgc+GVsux_p&b{ZK8_%#h|q)&Na
zt{V#kXIiQ|K+z`bnxn*0&Hr`>ZK>PApry3s0$$9VVQC6?3U(gHc4c=?4P_qLyFM(c
zI5%WlM1)-ISvmi%VEy~a2rb&$u~W~xQa&6=RArov<TnOHFrWXt-&&YZD{ZzcSn@M_
zbc#8aKtikIMsi5jW*hd!n1Vy=u4gQ>dcRpxrH<f@?U!Oo1}t;U=+8~H;-Nz7XUeHb
z0SCToNvqu^Qz;kvluwVO!oOVja$apB_iAx(9l`ghRP$H=MUl<}sBlsZOg`{Q-UZ2Z
zny`}FSIHOrkd_etJlFygP)dH{O)O;F^<bbim?DnBPoUEP3f>5y;6c?&>#U(Fp&>NT
z*}t<awBmN)#|EGEw>G>4kP=G4QTaM2@>C|AcBp6Iz*yfQ(mF=&sKb4;C9P>kVdSzD
ztq8y7R3M*~bm(ssZP=>iMxo=@OBwRezzlLlsS6PNy*h?VSDO1TEdVKD(cdpkl*st|
zC3%1sr$aNJz^|hp+z@(1Mq^X$DW5T!wV%EXrm8$M7OPpwD|iXb;nR8$h%p9~)L?sp
zZg($f5*{YuwkIU6wg=gc2c6%xXA$vNY7wc*AMbkY+&1l1PcpRkS?S@e45WWIDkd2@
zqt*0Zf4@)JG7nln#{sM)lb^~xEy14m`?7THt6DaHoM6IkvTuh@5Fd*x9C4%i-?OBS
zx_904z%B3BzTMMeJmNW4_h_$r=eI)br^&a*6d41WErEv+76O*q8j?7wn)(4{D^Lu|
zgBAVc1g+&JJ0KnV;O8Xs`knKXZh|T2YPLDk74>4z>DID<vkz@{h95PIF!pxpjWzeq
z%9OjNNv}tTOazcM-*ewcs#f?HOM39r!Nt;spWTwa+5GNp{x{I+=?K*Yt0fqL?UzKO
zioTO>L3#=|bqo0(o6GwWM!WY#JZu@=bjK`p5eKhENddCIyf?JmvXyx->LsQq&t#;m
z+){0O>5`XukJXDlI-ZvZ*ouO`#UYcZG@zlC^Dc)K5cX=Y)EReP3M#3SrSjBNZLZbg
zT?ghm#?<cUg^=WkGExbx!crJ!PA#{8V_mK0IPT+j)Y1+}Ad7zqt0@&{)qJw}?4%qO
zvbnR@4!l{BvVXcl?x?Q9jJ2R+zSg^P(797j>Br6MC>KV)QlB+V#zzS)MN?nYm+raj
z2{(Y$zy!JzguaCoF`tZfU;AP0Te-q5zfKvo*~V39Q^%<Ew4-77++t6rw4~q-I&e>Z
z(oO8so~d9lDW_Y}`MNVj(ti6y!2m$P4`KBb?o5`dF3zjkNas~i@d#F)yR5r6FZAB}
z<=;|NBSOZ44d?QTo@R>MB){RV{v?2LHUu97@>!uai}G20Kt3zk0^5lU*)N}=bbBFW
z6&2d}B25Z{&y@=P`bH4YE8VF{^n5mrLFuj&DWF2yw3l`Q*Hdd}6O=9|6Jo^`)1VSu
z0-%|``ILHhnN4oV%Dy4Nqz`sg_RlPisn>gxXSX&bD>|bibT_m$y-yyo;$*^?w9R9K
z+TkNQTJ1(1x*dkiR@X(UY};v|odwFkH&t-<v4K)R2{q<Tem8m=Z*-R_;oqFO;5ViQ
zWvfQDplvml_qL(QQHWAnornSx6z#dRbcpu@V!!9(FShb7vneB@c83nz{+zu0LTSz>
zO9E|l1ZlO-3D`<!z<@Wpsb@lf0j*y|z2e~}Fq1Ij9o5p6+pNY;f`EC1B?J978BjQb
zsm;C?zrM-8z^6|ZShhe15tdMy44WYb<vu9_KJ29m4C51dhZ&H5%-!H3fRi}v(|&rW
zT_++L>Xl1;>O!N>>zMrHC=zQMzypJVsu}1ap(hF^axUleJt>A(Zn_t??f!MY4aeuT
zNM5MUZD2NQ{o-uasdd;m(*YU$A^^VElJ%83dM#+t3w~O%$^{y2pgec>Ajz=}#+<jd
zO6N0rY8Zo_hV{;|$vcI7pqgbkVwa}839+n}v@61iwzje0Y*R|Rhp&x+Xi^+z<wR;-
z>MUyIWv)IUL8^f*z1DAW3wzHwhqJKYnAbL2dGXU{F(*8!2U8YViXnnT7KjiP{OUBz
zxyk3xCSz&E^q)uEpf%=>K+s;qdh<i&7kywQTtjw{^&DijUB{mpAvV8EhRHT9#15ST
z@OQj(qJ`l)fvvxje~1PukVKOXXx!FY^6~$;TuHB@EPFQPzIY<X93*SqsIj^V$H$i%
zHv#s$Gc;r7K8<oDchtu?u<>_IV?mKm*Il$=Ym*uqAu-rc9-E{i0QJ{6`=!ggI?{m_
z(0`eAngfj~@HOwsGsU;o9ag#QKj)+WYrfTc2Y*MUrxuNO*G55-+Fo1jJCTbL?%}Py
zOa(ovaI><^pt<E4%ffPCSb^QojcInh=M8d}%fMGyh_f<gy@+)VH!6R*0Qe|cGRE(w
zZpvSScNL!%W*<4JMO7_In!QtGShNK&Nk-CYiXWKqqDzbo$JX8)%NxlN&4NYWpS&BO
z_&`&1a6JDK%!2WEt(?g6#5#cHGYdbDi1+*CF@@E$y|9-NG$2Ki*gx;GD9WAP+p__&
z!bfup!K^;Hj#LrY8Q`*!xy@&6!^prp1!>;vL0Zy+(`7AnMQDqJMTTN_1boV#mMjI5
za1TW7C|3OhwNg^u)d#5W#y+TA#GX!4d&9>}%^IX=;nY2&afHnrlLJ2g{+T6R*T0hX
zZ2OuRamXtGeb2yRx-=v^>QAGYqsj=nm99J#?e`#VSq9MdEn!yyfMPMiSKpEpEC4hT
zPD~v}Q1JLCeI$LE_=$M#yzPySL@KP~2lCx)lG5#?eu_1x9qe;fn5+BuW#sw>cig<q
zEcJqWglU6YXZx|i>JFMFcsL14_pdJb<IO>O_%Z<UgGCZ%C_;BQKwqhZwYzqEPugaD
z&h}pA>;dSB!7f2H%`Nd#Vc+7rqR`@CU)zw}inPShbL~cn7L1c;c$|5-r^}Q9s8ya>
zGCI}T$v%MXDYM2M%LMTWjl#{_H#V2gA6%>ZgPus`A*zaM7FDwDI{5&U%i{}tYCw*)
zO$3&aZ2Leel6A8H=0ApdFN$8O%CX~meC_P|A&bS)%y<sW!uZ4ZK`A_OWZiZr?^bZj
zh`62ObV?HwFpz&#9U1C+I;t3ASmkz2f$W2WT&*ZORB!k?erf{Dn8+6{J(1C;1KKY<
z&=|EBE|N$hCkpU@@@*m9boteDfO|JmsQ(P6Ki6)T-%7b;$h!8;<$ap&CKo%Wu?^l9
z6K7~n<Qa?hpSzfw8-hXO#fWAtIWM?K9RRXexheWkgN_$j_*1j?k;}=OJa%^t6B0+(
z(bOBI7?R#dBf9w}#5ey4+7^CtbQn#Xb8N|jKjxtlPB|wLe&+AJus3CoRl2?JO$@KN
zbxx}3d;B1$-amq1;f-ZD5<(`8&|M>$o6od5xA?Zwwes0Ik}$p<Y)Rh;Qia>^Ml(U1
zunmYvg*_++sP_zjdM5!%-#x2FijxZT_fGSl8mJV?S9Ikbwe>pRlf_yv`sk_JQX!gW
zxLEhPG^V*kCVQrr^j$Ul$)G1k@d&#9vtCHs=4vIo$oVOk(96m4oU1QM?VcIrcC*f#
zInnX1t&7w|a$K<_ApJ&r_g3QUw^Zx?grT$(cNBhmc2_2;ndExpXtH`JOQyXM=KXQ#
zXe@!=Qaw6S=feagHS1CN{emS2b0)QCn!ghm(HY_x?fXv;u{)vbdDn_%Le9j>*1N?f
znPq&+U3M)O$oYoK$P{ZM_3KtDhs`?Q)ocvN2LKY`c^qqC9E^bJ-C8m`03~M763+lt
z!CNOpiC<ydiGseB7Hr_0{ZhBTJ+0*w?r^Ew$D9;u8t~^xiaNFafE`8MtH0N~;xs)M
zfwR;K?}ik0Uf@k#feeF_GhX`CX5_-FL9<}=<OE@0GzCm^Y;1D3c|uQT*qm?3T5!-`
z`zCtl{@snAebymUA0hU!H-)#3qy_8Sx{<rJc<vlR&^A8~ythpQB^^5USo%hRP&`AB
zc6w64wAoiQN}|huqn(J!0yDSo^;bGTNHU3-H$VzoF`y#t*Zl~n6!E@)#91ok3+JS=
zOP{fu-c42$**?O}ojO|e)Fm(QliQ@l)CncY2Ea=sw8P>>adx=lX#1c*_xyrQea4J<
zDSX5ysdfu&#mngRT?s8NH9h85g}dU_h8&OZURx<pIS5<JyCoPe)h;cOf|@99X{SS|
zMK4Z-b~sk7-jX9@NEyC`nE-Fo!)Ff}R*H2Vl+cjVXH$||un$W5=c=L*JZGe9&zAWl
zk<uetCeb2g>7I-0u9?v~E&_HOObWr<;It6($)ir;o0mISy{`7*XBl?Z_w@18ps(W#
z@B9Cbc5Y+6;um~f(wr2-du1(y#G>x35VFxqOXDAVbCoYD4)hg_9(~xqc|@UkZE^YU
z0nAwD)a<pIj{CL9b%glB?YCVw*6pXL8=R;yqRzGB_z<8j@ROkBE)x&L5K{`Wa9<&D
zPY%C)exSICc}q{B@%=%W{V+=HtwyKEXer#?2#EL+TW8SuwJlp%eI;Uy$P8018PY@b
zEEz_?g!e{M>;V})mUK4KEmNEgup`;6?BuSKw_ofnexauj?;IRcw)Smg)ZJi`8Fs{U
z;|?Tw|8XzAsVO@2qj-MloL{bQCz$-Y_b%hmt3%o$a`_N|sMPpkXUOiXn;tHRDO!Y%
zTsTWL!jSumeP%>(n!I~UtGRcE<_iCi=`1Y|%q_CoEQtgDgari5;nh!`kgv@5go#JF
zYLGl}NEM+co1cX#=}^82^0Y^{K^vVOyD(V)J#!lpaNQg8N5@!^!yoCfs$O&_Fq42?
z=dYG(WcE^%r6qC<UfRb?3uii7V7$BIH2kC_P1J!1StTSPPSn2D?aRKC3b5`)D1ddR
zOrDu>%TM^o_%jv&M`9Z4&qea<_oGk5vO5D9f;90rpQUc_M`Wirl=Cj$yOq(S!vb9-
zFe?|P?E9oL;HD3lB2>7jM7DVmg}vuIIkg4wMxH(QM}}+wQ1=3*CYRb`z%}%^+KX`S
zd6zaN9fZ}pu%y`nF9^zWdtxFMuJY;W;>)k?aBjUp8s_^VOz#^e+=D|t?6dR<jVZn}
zylz<%V7fD0-t&wmoD#O==8eB1^b=8X_bYxf$ay61uZ5SLuuhGROBFc=UG5VFnN9fB
zrXjzbB0{m0-K3NgZHs(FlqA5?`{Q;;Vq%*$-eS{ZkfU(=ei~&5^~32C(!ou4&JX3@
z(;0&~0FP*S5KCQKDff1a<aLl0IcQ2SOw*k_*8*j{(TVVs=*sWaFBr*tupk}KkSkm=
znf-C0;x3MHXNyC=z{8$cr}Os;T0>2_F>gpoQl2}qaT9h{pcV!8q%z2+&2>I7>N?DI
zKir7vOYx-SxJ;rF>msPX78Ok_S>~OQ{ns*z=1FN|>I>XWh1(8~_oM^K*#Q7Y4BXwd
zXL`?vH%-B3md~z0ZwZWQh+@aVSHhRK9;)XX@27L-Pg~Y*dWK>*p>PvFH72mR5lc1;
zY;oc1802^rJja2v=vzJoc6$Yf(UeyG<8~WD6=gO#C||x(zeQ^^)P29Pwu6*2lGYYP
zHCzoVqG~s~z9&}&hL*s@-Gs28yc?k4u=T@4%+<$W7L54!5ep*{<qyd>zkvkt<QE%I
zd@30I9eGJac9CL6_H3%ud1{0`?lOF>mSi;ojWk6knUzh0678@?J;~Lp&xJb#a$VKf
zr7bw2RtL!PBhD>y5j$pbswWO_ltM<_SDn4M*($_mx6I3Xy^mc<jgxWgQ==)#?^GAs
z>p<a<5M8J(%Kcs34?aIwY3Z=~uSC7%lj9dy!8`!Dx1$s)N8tCmu1r@~4Nr#dZt(OW
zw-zbYZbHo#mEsct6p@qL+7PLRk`hMT{ew}GCx0#7M*?#+XGOCBP?OL9%Fq0Pafd~U
z%zDAZt^0s1WnT=z=+8~QdC$8T@in>w7g|~rGs_t%DRNb1{N54pa1MB#U3w}*XN@$^
zwfeyqG04E>_gu}Ge-WRu7ZWRL-gF_5wC$Hu&o@I*46;ecf}xqP-Rou{0kyecN;lpp
zk@dzk=H1vEMA(|OG`x84wH(naOSR=OOZwj680k(5M=I6};?uNLtk+a65r1O)${$3;
zEs|Ihs^jbE<I8*$TVmr)Q_r2GUGQVSZvKq2U^N$M`?uFkvvtTqy>i%3{Gt*t<tppN
z3d9$2CIBL)F9H$Mw#y=O&8!L=6t64aZ}zq&_Zmfc$Hlj-@#knol--|t-#y8+(&IXS
zq7A#qO*+=L++pd741u)$0t53OG13$cDmo+TKzG2)A_+2i2j{nw-;9N;ZrQQ_#P)j6
zk&1mj__)x$NzgyNkZW69y>hKJCbqVy)kOY3T+C@1Y2#%~@SSj#K<W|9TPN7JT^f6J
z;b2FCZq3C0+GLq^D_w-FfV831Iw@KtSWq~Y7C9ViPM&eGf<cRzy|^b!Z|ulT?wE0&
zAV4nQjw6rTU3y)d-Rh@+D|Oa9<}6bY)rdDG&lDp_DA5EozS>6~BW#z+HbYkAEriyW
zh`)i!_KBaS2WQHJ=jSO%{@z>J6n_rMy!{}+w<qt6J=Wk6x|!8+slkmlH!4Hju99l>
z{r6Y^7O^C*GF#_uRz|>vF)m|TlF*F((A?suE_!22T2oZ5rp)CBs_%B8dR~}#O+2g#
zyRV?v_TJt1aq=Njd-5TAkDt-(qnzYL5@Llv2cDns;1FiS1Ru(JjX99k_S?+zH8;*I
zgC-~cvU_*JU6lLn9v)(ynR(PKE3~34G_-3Hl+i@5`<DAGZ3g|amTI8H@dXV2T>Nql
zRERQ`6MP-EDa1UwU4CB)+H^iy`F5QB<gR$zBOcU?t(VH5y)dvueg-WdWdIc+OrQo1
zOGm(t8!VX}a5j`@;0D@3C6Mx30@mH!MNcZ9WlEj1FZ3SuitOIc+5389Ba;=Z^RK%m
z)TKE2Oe9<7VlewU$J5x86vWQ`0xiykUx*e{R^XCX|C1P?xxLU4Gzda}7qwNowt;Dm
z;jWylxhiyZbhfDx?bGq2#*buIHK_K)dip}=Vqf8R6o#a2q>N^@m|<jTEn=2@eXAIW
zc{kE3ZTOv9(jU*PlbJ}6c6V5>=522QEsEoC>bC%c!2S~Ru2;1acbx|VY@Z^ERe#k_
zw38dVwuo)_F-OkrmmO}w77uKGD|Sk(=9Ue_(*6&7Zypcj{)hjUR9cY=B~z)i$kJrX
zGL_OfN0KCDr%XkOIre3evSgXc$<9>Hp|Uq2S%xfA$1*7fk)5$`V-~~A{N6Vzb<WKB
zJRZOAKfmAO```KNRNVLbeZOAUbv>^x=A}DL+&|#A%`H$hx-5@_4#Ws1IUDZ;%3m@D
zGis}-k8ZcvvGk!rk+mYm-AJp$*-O2gJ*tf2kOH|q3R1JH1z;}yrJvcu?~z%qdTW<?
z{mI#pgy(VSh`5JCj?fh5e)>^c!|i=0W{!G3;BDHl(b-49Mr=4nj=1kP5mYlVJJ&Q(
zbYd;SK1|2dUlNDdIXN?xcZ#cpUC1w$zu23>9!>#HA+kMlNR8;RPvF3Zoh8=<avDz~
z6#HV0<4m!r6;xqY1=*{z_MXM(Ifh5LK2AG<kU*}*Bh(a$`N<^&s7>Sr-V;=|2h8NC
z3%qQxncZPxy;=F!(S(U2jl`NfPht14PKvM+|9yKKvA&q@ig$UH7ZaI!05$lWM@AP!
zCxuzU<`hM$9y2N18F~1;9gSh0*;}d-t-Yj=EN)B`3vr$+Y_F8!>&_GRt=;5qVw+e%
zLT4h7f^<Y-uWlTV7ymkxet3M@7kDGz4AomUfGUxkd`%IrRcC*{eBo7Zr@|V&i3@%-
zAtxb>D#1|#dHhn1c=9i&VJng0g3VZ8uFs~BUmWE8I@@?Y<vd}RU@6tM9+5BQxj&ih
z*<?Ozs6c{>L`)9+{l<=%??qZ$%o%Da1@?Pnb-nF&S)zsuzk?o8RVuOB7yJ`A!-N;y
zP2Iw;b(i>@(|D-Zoz#H9&<#ut5iXgzZ{Ds4bJ_-ZAfv}Cz~aSN8!v?kS~oW3w0g78
zN=(NKYYj^PPeK`Hhpa7b53=6Y_fO7h9!6QPEStSlp2ST0JYYY7#o?JU#9LT^M2J?p
zYif8i0#vor!YpQoW45g>u5#JnQFI@ah?r(a8xNkvirLi$WwS5d@WFn<w(|H@nDdE(
z9~cpA%GhF5BJj#(K23Kvs;wP9Cq(m;d7J<1#yX6ANRhd}M3>m%!#57<K}GF~UG8h#
z=Ze~|&s6J}M&Z89oq`9rKDIzy11q_cb@G<LtojMI4g~V-XEOW)D};~=b`Qsgw4y5r
zp?Xdi&c-iY0_-w2J_p3`+S}~U`R6DWP2pzf>#P-&c^EmL86HAUfoCb{jf@+0d5aE<
zI@Ls3A}ts^;8r;%e%IvFmHE!Y5ldjCQtcU}J2T(m0&l+rGfE=wTefxgxEW;JBv!He
zb3i>D@%=_`7ol6kz)IppYf(Q^yh*4XTS$To4}jk_zvf|QPAiumMpRf=^tu!_D4-#O
z#?oA_KmPd-syQ3CQ3FDbnVLBX2DHog7(udyex$eo)X`oO{Z`Hwu`D|>uDM=Z+M{Wh
z5Nj=1I|AN{dMpe7OUEIbL@3v%bb<S7H*q^;XaSmw?Ry|bfj?%bE0H;*Fl_d?;(Z(_
zJY2urw8H$PF-=Tx|8`%iGfC^S#j=YhQacVjHVHItU(wf^*!F&9G~ZM@n=zvIh3mg2
zsKgvfZq%u!+yDXcp38>Aic>@#)+4pYMc|A=BS-U_|GM(qZNcNW-oD^F7-no+Zd19Y
zva<YI`Tal)idlQ4uS1&jxjgznQ%qiXCXIlY!SQ-Gc7a8*vAKR2@PZ9QZG4szFl{n`
zZLRV8h}C$r&p!v8hgZ|n+C4%*b%@bj8+!T6%FHV|@#~^N*<qg$ay^_(GOxO>Tj(Dh
zqZ8^iq}d8)U4I3xPq6C-#-CF}>gmC`uEQ<9IYvInx#Ezj?f0r}_7c~gwEE*_+{2LO
z=%Vbz=VovNQ7Nn^BZEqY3zPoDD!#|Jfd9YTajr+#!l3@*!t{P7`4K2*k7kZoyUm6O
zsnrxk8O0|E{-sh~ov*6I7u|JGlSHCy07Zw1Ir$9v?h()$(sW?`*a-d{Pah3Po3(vH
z)EQb{<eZ<cW+!JMka14(HC1sPF()T*$@ib8D{k~+)hSn)+Ixt1ZFDm?5b>j5KzpgT
zf{nY(3$B0p@m<iI>$A`qQZYp|G_Co=VoD!%8Iz5OIi4CWe#vhiXgR$8WqOYsVoxCU
zV)c3&rKT%Kqc^+H*&<R$ztN1ACU>l}<rDhu^&EV?wA4}Vx09YQlu40f2`5Y{Qi(;Z
zIwNuE?vJ1L{<$P{ua5i@<8JIkC3Cf6wm`{Ro0th<q`|cT)2ehyMR8_2Qd5<*E8MfG
zh+Q6oUrv|i7Eui<(SROh`doBW^D}3vNg(BuyYZd#q3}CaVT#}@LyRxOM!{qFy+^?c
zr?d$t)g86I<>Ri|8Y*!tpJ%;ogJ5Z+nVSlHB`PI@TwNG9v5@2fiJ=qF2$u{4?@0!8
zh&FEU_)!3;Whbc%X=(9S?!BYppdM9GjeFp@9F=_5LDw2Qveai<KDMf5^s~H=n5JLn
z!nWQpmcdAbi5HfA<>j?E)rIFnl06Sq7;RgjVsPt;RS4Q59PW)0gDOHCVWfD<+4u(p
zabNp><Q|&OOy&lzzjz3OpsB;6XbojvNx$-9t;>a+=8;aKQkDN+o$aD^O(Nj`LJOTv
zxAf`DZmhP(U@sn31gQ;0Eao){J4+wXWAQjmB>4s-u|OKsMW588s@8%^_E=EK4z^Yg
zo{5DLZHnKdy&f_xHY+*OV*`@g!TMKIYRN#fx0WH(K4m&?yY48Cy0OhJzy&B_74bX<
zbgd;d!diJfx~5awr?-8~bDVf``AAc0*dc?!m?H*cvzGKdn$C(SsNGOSxt3k!@=+h@
zI9nOvDCwdXfZDQ3bGzUA)mD4psHMv<JCE0_IlGk;x+8F<f^VW6JrW}rR|M8*ut#bo
z!(1POthf>=Fe@Dk%sw&~fgDae+<~iE-E&M~gOHnoO<(kW9A8%Uy`r9pRRYzqY58kK
z&rek#*LecjXQ%wmNds1mR|>Fw<@IylcUkZOe^eaU1P+Q*LA<*)74IxMRSyp5g6jbv
zj)Yk)zxe2K+=M)(^WCO!duL;js?!>%AQwkW?~w#tB5OL7-ws`FVc(gT;uBOr!Zz{v
ztx56I1~Jzn<v?>v6bQ%<>q&Si8Ya4BDC=)Z=`+pW`)<#}lE-3NaSCbIwG*@J4fvHX
zsIGi<7gZ#t!>bwH=J&c8eO=G35HcO#;%<;nJa*J)5~w@ZivM8$3J!sk{;F8B(Z4bZ
zB3Bk{H1?5SV>bGJ(qXgKyI$wjrSUa$RqUZiUCDr>-p!7rmfIxQ&`Ua-6gOdNh7A=m
z<@y1i<v-_dJT<EWdJTQfanxzbXIPtR48JsZ<QJd2*^-8M(R^4c#+uK5c5Ub$B`ZBy
z$LVX7wWX2jc6Th7b|$UYFmAzWOs^%423uQUrVy8=xH1cZN__Z;bB@sSmc5c!(pHzN
zhYXE82XB+s?c*7O$JY95P<mBQUbT^(Q6;%nQFbPFBGa9&+JCU6ojT!*Wz(*3wXpBJ
z`KTmHupP_V2;4#5x@aG=s@!tx<rn#l*FB-d4y06?iP)otP_>UW-^y0*uDPsBj2guM
z#$!crLxj;fO-H8msWxt8Gy#p>kZLprYS?e$BUc`CH4R1VI#AuU=Y0{pIFEpvz97e!
zso<^oHeiXf?%FbSRH4{3$+*gZGl2dRp~&OX0@2B*h^O|&$?RXzhcAqV2K-$ui66>Q
z7hCyBpk!8k*^s!cel1kOPI5nCHLFxc%;%G{uSPX8$Ef7tPIh2k;nfK4FaB#?C{q5a
z8uCNBB`{Mj$}&@x8j&_~OYdb=-^*23x9i;3w*Q0V&h=diWJXx`>7X>#vW>w5-5u2v
zJ7zv{pZRy*jDXx;gRz5u3`Y0tc<mbsTpB0zD(Wo-3qtVwE8nczBaW~?Y0@~X>PCz$
zrK5e++z%>KLSsDFmiOkTgx?w&P(_x*TgE!sWGu`05s#lx-m1rXFHXI*^M1u7PxxL-
z9ZVT*xM0)-&1rmnKstx_`HLiBZ>NF&^(_UFaYWcXDJ<M3D8Ux^5Eu&OmmNqwp`O*4
zDa%eCXFOPzVMBqv`@EXZL4cny!uE=f!?EH^KPBHxU3~+pUoQsr>l!$%Qn&mwJ2OQO
zC5l};uvtWB+n`8UwYUO=%NqONa9Lne29zUJsu9)jmEq{$%`xVy-)i1JsiGVV@v^e>
z?C)zy_y<&`_x=jX*YVmCj!TJi<?Gk69#@B)b0PC<-W6V_AheR(yQMF60PDs~dUA&4
za=qPUJWH%grt<U#UmpP+BYI+A?dp5*C02bK0H|qscjGf#-D_F7$x*(poZ=laeLT#Y
zOLKnf!&rc4>3mdgMzNI_@YYItNp|$?P+-+EG?L`)x9HCG7#6asrojzi#<DmA^PrtQ
z>smS1jN*OE7VsygLS{{mW?0eYgOOy_nA@44#&G%rm}ZA}eu#yK)K$Z7cY9afOwQ6d
zNKC6r6boRbsHD9v49`2#HwKw9N+P+w3G*LRb2jc5O!7%I)ld=)Xv4~s&ej8eAF^Ey
zde_s$4Hy+;$n7L&c-)chU4n5eWB71sJ}ay{l!@brt}@fEj(~Qql`puic1uJc6ARE>
z++`p!>Ll95yww1$5s<Lvm5K*kbVuV8tJK%20#%aT$Cj51R$r~(u~~|w?7PW(`Qag<
zp_Y>PmQQNaOAKxmH^A_$=e*f#i~#u~<obgkKwg-3uPA`+@f`2G@|6)dqsFQ=lnXZM
z{yKh4;H<IX<G+OMLyfE5OPivN!^9@XozAqI5F}>HFUE<Xma9=n6Af$z5>4arZh(b@
zqd@9`7y7{e#d^p`t(Qj}U_}&o=rM7plrLww;v=QgA5qmD>ox?9zc@RbXiQ>kx*m*M
z3Kt9`N_16Q_qDzOYuR8oAvh}7$?;1dH0#Q9-SU;3;llz)b>gpc{e^~QnY0&Uryo}Y
zXL*UAcwn-&H|B{z=!P2x&I(&`$|U$Bd%HoK9s|Ml9JcqKx3N>WJ=1RB|KE9XFV`_=
zVNh?_ZwV+tA3@=|0bXM`94%~<l24z!hod~%7#O3fOwe9pP*_3u>}dhY3!8CDqA<Hc
z*7IN2dR255v5bD>t{nmI%qc3t3&2eVb%wCl=IhoaXk-WY`eY9e5p~>NU(&{NuW|xx
zG7-#Vcl(2KTJc>O_Sbffw+%XCzz^qr&`CwEfB8h9LF?xWK1V+de(F~o&Cb7;8uKwk
z^IFER0!`ZBN`r#Gj67&AEKFBx@98D<j2nbBm--f)6asJu$*i`@dEa1cRU&owUT-gE
zW>z{aig}5DFW0lTV;_`BX-PsnH30Whejb9kzx$Gz=a#!0=bH=dXW?zemQVI<UK)K&
z2CmuV@Y_KjfK5u;qlKqdOA}(t^#uzWu_~0j4(^mW;n$}inw8|-2IABV78Do$K381m
z6d;tA-M6-MvsQ_r%pQz}DsZcYD{9J0mp5a?+GKNAB5`=ZoL19qU1IeFS13rn(wMso
zV^jo4F0()k-R}!VxSA;~su9r;{YBDu^{bB`K-GHeN}DS|C1Q7l0>j8Jqdk-+0R?5_
zz4U!DsNif#muHSLNQUHp95HHh5QNyVB=ifPL-u2zV7eD{qhg}2)t%Q%X1pj{f?O@X
z(P4sE<rLt!-uAgJylbQ^7A1KPKB-dXxQ<m_UhK#*<eu2snH5rke2(_L!rGL+N%zr{
z+80U%8nexI9zvH__3Yf@)umEKOjN*AQ;F)dSk>VPgEi0k(t30ID8h}Pn@yAToJS6<
zN$cpBNdq7a4rKN}*CaH9n)OehX5H?g{Dw{b6DHM0QJdU+s-o5y2bwvM9!o3iAE}?7
z-O?i;+S}^Oq^2j09JH-XFRRW1v6P%>9_CIjfyb&g{gH)NL)wC#YcXjDHD8@x>6N2z
zHz;p_9E`UwXed9GVYi;ue@v2G*^JIVb7XKhtlfRGCTaBj%`;M^D|dZ3wzT?^o$TYs
zr`H#IEWOr^Rp=StUP+|%woOi0<LF?GmgKxLn)_qmD#8GPS?UR3_K7&D1N_P{E4*_}
z{M7eq^L5E;S4$XNzOY2;LUxq8=2AbC2*s$*+xLnYX~zU@RgL(yPx!vTdyGv1+t=nI
zuG0ZnD+3uEAf`@gB(Ze{uwGQ7(c6ih;Bd~X5xSTnoOU$zr2|~j4m7O4b<$mLZxizz
zxjuVzB-<<nMZzJl4@!nHP4)+8X|DvG8kr(I?f~~YB^E#+nA}a(8*|nL4vt{k%;di*
zwbVT?y6U|Th%RqFu|aI3?G<=HPR%=br02boKBqJ4Q7N+IVPS8%8KRny@=WH)K)5nE
zas=eLe^I~%p6NmAP7QFF4dmx>Hu{)ER29{`G)`JY@udpd`BiC{B-Ypn<eQz@5sedv
z>eZts(%zQ|1<B3Sc$$7-+M3ha+CAaEAwv<uHuhXU;9Z5F1u8WNy^0m_MsE;HU{?aB
zK>mw@BXW&Kt8c^sK3JUHF8FDyFsxr)`HJE9y$3C?C+=u^NC+K2u-&`<$x8bfoHVxd
zGcaopKVS!ja%UDmsbJMP7wBMW>#{IIzi6aWkp>mKO~0IdN8J%*orNq`PuZ(meHlUc
ze8a<{96p<-D0_XKCy4F58~fBQ$<?-gls{twW3qDwhkeR^p8#H{F?I4^+tZGQEJ@u_
zZvki3N88(6zu{9WUVo~o;`N{TX#>;eSVjX}AE%&_>wH)>4tuy>ogB*tivt?_3-+LS
zotgM(<K*^tH$o-?FWoh1-IecFNvF9hwGW=`Pz)fRY7#n{5o{fe3>TGZ-(v4Eh+tu+
zQnYzoT5^7;rcV7{(^!ufz*PR7P<J+_x!bKMa%H#GmZi~Hq?LxP%-^a|vHBK_Kxn%i
zL)EC`a+t^HMNSbrUZa&W9;tkt>ou~SFAqvQ_(e`be#i_Ekght3Zs=p49^QSl?vY7d
zWFSFCy~1?)XRY#M>U|P;r}$M56p_(86?`P(RW&c6nOvXEIi9EQq2uNT3Fo#&sPi`h
z3{+2e|MO_(khR-{QH8N`>8@^MI$#28kVj4640fjD%FJH7L<Iwk-)nVxy>OO>207H-
zZU+1lW^u68bKHMI9ZE~5ex?3G3dLODsJH1|H)PcpeI8t`2IjP1N`Q2Zs`S2TGi7jJ
zQS*+uZKE?~TFa>irM)&AM2q$bA_88A*2Ko^W2PUl5Bw87{4LuEEz2T=fu;LeO6Fex
zKQV|?U*_8fm$Lf2@rGfkE~r#*Quds{Azk+}WE+3&p&qXk(Yjt?WAj|g$0k};s*-7+
zPxU#2cII&gyR9<wK6G3IY|5sAas>Qw#rJamHdj@{=^SfX`BH$qNB;!ktqjd|opX@w
zhYzoF)K`H*^~Rv?gB{Ith3X@4x$EY&u8{e4b2`_@c7aQJvJ7H2ok1T4A-s%{g7uP{
zwc;TZW2T_>W`ORkFgfP5VhOOw1X0tiX1BPc{ko1sn)(RHhst*<T6vf^A76MsTQ`Iq
z3Lkvg+92v6M{WFMOI#MOzAL$19FN>+r<-)O{G*U?R32It+z|Iu+p7koh?1-S1~ZD+
z4W75`&8QL-6~cGQ%_KEGt(a7oHW+U>wnP)Q1z~^Joc|)qP9b($>m~pK*KTxu-W%i6
zEK-)m*%-Jfs&V21VHPrF@HcUN6Xrjt0L%&i2n{)f{h7soC!JwEV%cfNd!00~I}LTI
zE84EcGgxcOFW#^-K*sl2<6!my8Y+3<t<Xo)I6M8Sf;?V=ookaZmFsHP{WfG`0h$YD
zHzY>&XJ&+W4Q3LuPyjva*tfIi$VP`vZkw!|ZPlOMV)&_s9VxddXI5t3&b(!}&BkYI
zG|J0U8fLZnLmsm`58=Y|VFGClZF2k@5Fn3;GR$uLfRF?C-7Ok8qgV;~WV@)R`&MZR
zEM1+t`qg2ZFyRn!IkBxGslr;4nzaLJL(%?NV|x+X3@c>Yk>bxV&M;Av>xb{$!eO1Y
z%Spw*O_?c{=N>0+=|ld7c2*wy6;10;2Fs_$$v<;m`jQV`<P)~obnlBu)fW8IgHB3T
zeNQH0wBl8(<4xVbT6SW+4WJ{8rqA32v+mkT?oaTq9T6W9jqvAXPXS2u8l%C2ny~7X
zim<DkKO0SJTi*0pCbP;bFm}`~K>Tr<woV58w_|93g+I#AUc0;NX{4BVzof*`l>&83
zwj4XF|L2a&ckF(f*zoYsZ!5}nmmU2j*>s2BV?Mw8J4JPt5=Q-m#5X)Wp}j)PFaN`7
z5@nP%Y=K0RU(%;*r)%l!i1=#>IV3boZpi0N$~`8vs$kzCQLd)2@6aw3GzT5yJ_oJe
zee(~t%DoqcZ9#00d3LZXt_5NT&&x6Y8JE|5#rcH?C{f}>hcRnH9in!<`GMNCWhIXH
zAe0EgDW{-tia+;oirFt#GfB=y^MjB@99wnKAfyHjLMu(IHqXI>XBX))aTT@&Rg3cS
zWBza5e&Gn`l6-S{=H+E~X0i11wZIkmcU(O}5VD0e0bAH2Y?takCL!B=(&9--4N9kE
z@=T{l`i*RT8`zIgPDe|&py@!6!Toz+zC^4%yOPj*M}@xN3u|o;+%lRo$L(4PjY3;_
zj6${2Sw32fy)38mg}*_g5MXcuZdZmNV$J_N3Wfj2D712e%5P{1#jz7}@s!a&zsFNX
z7spc|e6YvADl%tgFuW8Qe}PtA7Ujhvd@yrdTB+<uMdruEym1DUn7@dg9QzYN<#D71
z3Z2a>w45S-ng@54gINg2EuUhxzz;4}_?l1IdTQuvJ|)}Co>x9)JuiN+30a~g=Lboq
zEa#Ixc_Ai0x|Zy)i*bwp$lhBq)z!;4{_(z4*%COz$n)ebN~Z;7!WuQE1KrU|JOU~b
zr#p)45CoB$c}*q_pZMXHo`d!`YZ%6a=QLFO4DXRg1%Jj0?$eOUA0<~oDIBwVFA!xi
zbvWwh=YsMx%mYvU6u0@x0&p{3_ryi%_NFU_k=HBBs(<#0t!*5Qr?&pc@%qGbG*SsD
zc>={%T%fqhVHRq1L7}n8{3$h0$jTM>s63}9+@xL`OrEUojn}w6=F6D|Mllw_)r|oE
zkJ)H9n2i#jBf?`FL0*OOfsI>`Xw)LNwunL!&F~nIXk@>}=DV+i>kGmY6+OiGCVcVv
zZCeg6IK?FJmApw_D}|spiW-Dp4~8SrL2S#n;YhF%wY;&0@oywAESKRZnjOb$I8wou
zT%IDtfk5H+z>3eHNL=SPps)vL9w@9{=~}Z$qZ!2nc}w%o&7bER`|ORT`2y1t<tlUN
zIx%1Ft5qxoLV5i>9eJ3uPVt(Kn)wsmCTDQCKGn>9H!~Lp=Vg>{55I|K-%pbdiQ7f5
zWk@z9*8D5WE4!77Wf6FeM;&MR2vB52`NznLjB;hE!#q-0f{RK+1j+e2mhyij=au|M
zq@_L_8r#Z3wYrez&0-!t#~05>At1977Zmo7%!=7%p7T-dt}ND~%nBV$rSqAUnj2&P
zo>`HsYFNmuw0&m^yZz3Iz_P@6$u!7?==^IWl{oS>Iv<`D<|My$RWuOwYoiyr#j?$O
zzPiQ0GZZyP^Xi)$kfPaAyapsq=qD8pg;pGY<HRpOh4sXi;%eTe?|=Pk`Ob|q+H$_M
z>h;UpJ3j{(TD)_&d6sT`TE^v>-dZ@a+!!s>SR6H=$E%LQjL&PqE><i`C7OK0d1d+h
zFd>zQ&8Jpu^F_X<R!|F6VQ(PRxZZ@q^B=f-^0ih;{DlaAdL>#p8J!6E#YmO}n(P0_
z^8#l(PoCHM?O;UmCJte{7e*vHwegEB@rT$7?i*G({3oU6GVj|LwaV-Qy6`Fsg`ZE)
z<KRD~=Vi6wXn}Bw>JNso5YTSY?VfJSKK36o(oVh>;3a^*9~{qfT8E$+sTSl`8h*&F
z$jottZS!O2xx$O28WhKEgGy-h8fcOJh(~;WjerA)6@bqm)5%J}l!W5*NS4c1*K_~r
z7|UNo^jh-)`Cq}6+TGxL3xI`52Z?j}`GQp}l;xuQd`7MukNiC9d%sD%a=0EqdX4g&
zlJ-E~kWg|3`IRi}28?RolPj3sGxnE#T6iT_z^4+FT$v*a*YPF`cO2!TKVqx?AlBT0
z0`zW(pq(hL1t%%rJYxum=_SdX=><;SQv;Z!XBT_J`mrhV(G}%_5fEKzo<|G+r&^;m
zgW;8+KgJJE6Cz|9%QRhV8cTJOkK+yXGGUE4{SKT-3eUJ}S$Fw!0jucIJk%>^0Gsq3
z>V<~`s2A$~a=ZEL$|ANf-b6jOV6j}Ixz{^z3TACTf&|+I9&*k6n*$IpDTTkXz}E<<
zI7x6CXkO$R`v=uaInw?IsuzVRf@E)L<%;9p&PNt*D&FB8#CHD#{OT+>2rj%;Fy#Kd
zf9N%Wp$i#$)Ypy^U>obS7=mnLu8^fG+m8p<%bTx7`3~kI>{LZ6g!Rgtw~aB!asNBk
z>ltsX*UjyINmB%U%9$y>96h^{Gt8v-F9r@#&K-;$tlenoBGz$wX~6A+>}e>y@~?E^
zu~(eE+%0^<DnTV*>JgcX(kmH)XdC#Cbm1Qbo6z1jK(I*xA^I~sL-aQVK*`C>Nsjuw
zZ|saZ;CgMn4GH|(Pi^EiL#78`c4atDJ1-r&A5yarUy+pXmk7v?Z_&dSJH0Bt3_uyt
z;w15^oXsd6OHUzQ@fDZaY;*g?cwvN@+BTQb1;wWJX6-*x^iazQxNLxNOcOS$2w-0H
z;@_cbav6?maG|7>e-wNcsn?~=@r7%dL#x&?%I)~S)|^nHdDFZ?m~n2Vb5}9<WUtn$
zcyI@U&v*zh{AP*>#6h6hyvYQbO@q)y<hLCC?9V+XH%CCv$&c1CHQqQcTLB5sh+txo
z!X7X`^9e!zN*Jc@|53C-{acWJl#T^OC#`4)H#hbF;CY$d20Sk?cRlkkXG&`bjvzu7
z5W}|l**<fKVKzVv_kC4uR2L=b$LMiG>BqVknocI{d7H;>E}46aFpMDp^zwSb&L8;(
z^t!2Gbn{E-znaIm0KLKo@b7s6y(qwh0eyKG_&oA@oV{O&B9qaWqM0rJJ;Op@$gtQt
zG%jKc_W{|)?ITaw=FIN#j2b#}>=cO7W0Uc1wD_5CRVR>ptng=|S7QVE4<1CXc-;;U
zX%J$uPo%{1(PJ0sHUwv>cNrlA-?Q|7Bh9n_W*-x)GUqg-PxC~2fhArjC<66}U`n&<
zjPv1J_QSnqGYHPM64eVS7H*W`LU#PNFK7yH;RY$vG#93a_5|k0g|d@I>BUShoO|lg
zg5ahgLVUM!IDE&;zO@Fsk}>{pf+26F*J-{MJ?&@qFAQGTJ`C*elmjF+VU0}&=r6-G
z_6xD0J<*pyOT}e#9Jy7)enmTnI?|DCRx{V;7)4$bV>v}fOgCfnxw|NL-u$ZEcwOMM
zep7A)TEtf3zNYEFx1DUOYWUW6V(Z{GZy?Knpk9~(1TUx;8Tv_e8ME|9rjn<K`3pIg
zJHqlUGC#-Zw`C;!OPrqIJmM9@GfodaB!N;pS9jtC>Q25n$X2z8E~a{cdlxJMw`@_4
zR9hM&HoL{CaJf325GZsS1X&=^@JeVew1T^K19mq0U}1AFz{8eFRt0@0;Ir7l(d~b;
zkb(1@r-iIz354~c7qV3suwJf~=r0;H?^_Xp<x`;2B=l|C)x%q}51%OS1xXgL(fXlw
z(L9&;jT=>RnF=i~=nLYF+E3z5-$J1Nhr$ya@Q|s8Hy-JO{RebsehEDH&7ciT`Ey*a
zH2h1;nm|<M-m1`j9XtD9+Evd*Srj5u=c6pGi+UI7XlcK)p!_Td1Z%=wy?K4Bgm$Vo
z{39%Hx8rGO00Qa_$uiGc`o9}b7MaL!OML#bc+m{{#;Q|Aewmb+lW*caAn1$bn`<+?
z<eSFtk$R7AMm?KB=1KNKZUEnnbIpri!z>;kT)(J!(RdUzFXk2TXkHBOeFHTw#zSEi
zNeJA)Bh0dX*G<a-Z1-Z=@EHL}zoGl@{lD^w!2gv`{;z!Uf8~?^@5(3tzm!b0{zwQr
z8u07rCZ}L3B%0WZ^i4l4uam&#zRk=M^2}dDPJ3UvG4e}yT;u9;n$ZqvyD&B2DZ>xs
z&1zozl1B?bGe+nmUkcp0Ac04%`DU0>pQV=77>qnDa;ol+r;r^~8{d_Ekex{K+YnMi
z9k)e&G2xUW#u_`W7rLY=4CT`-yXniV<!YZ)=ss>L%zc0H%B%w2FTJeK!Q*UKj0UWV
z+PU#=Fj<pkRn#64xLJVOCrP8n^x=d(KW;d$H+e;r8$&paAH@69A1<3B<b^#M?XMPp
zBkfV1r1!EhFg$okwW=axM6t`*z+Z(D)I2uU)@s6;s`fe;qB11^shyJ0ujZZlpu@jf
z^g?yQN#nVhhisRoFd1Y`^OkWFB*f~NXbF`+lq#>H!FZv^ks|JmeKWWj=H4y6MHwKz
z|7ohRMRK#Bi_&s4L%Ukn!3hbK>F3s=REN<-D8TPCAK<qz;^^}V@GJR|6K2`NX&$xq
zt6S|C^*q9=!nPO4CVz|0Xlk-b)bS8VEVRA)@s3*#XTD}<{^#Kb?4kZ;^a(H?iUE#8
zD8Rp+_OoZrgQcqWhSSHJBUZZyC?}xj(I*KVUQoLboyl~2ni=>lI%5KG#$Qf2oVfHe
z&UioX=nUA=F2WfXiGIZy-*ENff-^SGSil)m78Thi&0uGT3D0;W_*K3(tZ1a7Z+z>j
zzjHm*zj?v5Hv1hU7T!Df4J4)j7Lc=IU5At!q3jG{3dSotLs{j35O+!gJY!D-Cb`wp
zClXmg^nNQ4eSP!KuC?`zXa2>tW}8ndI?dCyM&8ggvp^CndWHtSjfJMiJ0oirhi6t+
z&I66NRwdl}3N)VS))Gk0_348${Qi(X*q?jHio|anKoHn?vaC>nMTrL}F&z6yZl2oz
zR`qE4hIiHD%_UHJ#>;{uv5=lA$i$CIdTIVZG!8S~va@TFCPzm76yld{LI1%6l@qVi
z@sioCJA|ECXq->@sc{~);9L8FC1wJ;9wiC(+bDwnVdxMQZUT8^Fcv=ZNCJSDx%dpp
zvN`hyq_JJ6C?4x4R@LAz7#gAOFuEwkKZB1bu`V}j0)fXg9xW?oM<G)WSopU*1gh95
z6>3=-%52Gs_-~llqOwPmTblpLG?s;AlKyzy4UhSn72SR;FeQAiS;_I?RkQNlxkfH@
z@&;{>D4qct_$r5asImIj()mKbFk1vQmT?16;}%{}V}i3e1U0UOO6M{EQ98eJ!|Ti`
z;>6+{zw}(s$_(gP33;Lp-{`0R_WEzKcDA%i&t&JC)8?VxgPmY;`4uOY57j+x=YFmP
z&e?lTHtcsi!BL;58W%KQ2UO$Q`PTXW4D!Q1qyOZAa9qFhW*XZa;)!{FS<DkN4fAj2
z-S<cY5t<}O`8&ovLL&<#as7NqRX9<1G*g!&v8eAc0qT1M5t=n~SYzKswevMy*<ThX
z`RT_x)&ArNnA#&+cqaMh-<%y#(~9mOHjsA8^73$~4sj7sOyVDfkJ)BJiwhqUpbSkT
zuMCX}ri8YxQ)|w&ff>Pjf!_J%e~<E8tzD>EnGr5)si1W@jE-roqhFjOiups0kL!3e
zK7t(=kbZz^aKFW0pz+ZYkoN#ltT7P#zc)Uf`j5uPWpk={tlQJM5RKc%?;#qu#UUC9
zY^?ro#q(Y%tW&&-=a2D^CbK;n7J-d@7{J-`WAXftS$>&DkmXkaT`O)Md3LR62|P1x
zlVg&v&LhRTK;>gIw-imr0@=7j>}!f9EQ$IxMPr=7Ger}~i)@^R3Lm-nL-Ty+=YeOa
zg)qNc07~iSf)%-=*Jr_H12M&>Z)Sqd$9(!<&^5W0M~r6uo}2Cc*zRDv`RaL+rQVei
zX(g%qD=U6E+FB75LrCLU`e<3-Uf2SaKKgSneFRtWVHV{yxQ#*gJaAV@zL<;i`+zuq
zda~zmqSamFTH{X+mXEh(d^tb}$`Nw{@PJNwn3Y{^O#Viyw*ZYK9}d@)Ds_;sk)sBe
zzU!>kOoKIz4iG;#Wfxi$xC~vcO2TNoQOb82dSH%AN%XvCj+h3ga`9$v46PCky(M3q
zNUA2OF~zoNs;9^&^2$F**GV<w?5uEB>ewXo7M*zeL7VFOo4E*Nc~?r?Y>NY<&)2q~
zVC4{XDXD@ccv3;~&I!3Nj16wz1~|$t+{?SZ`&_+ErSXB`b1;OeI=@n5EG#;nrRILh
z>t$Z!XSDYrK5NG3(>siX88OJV*Ya(QN@V0I$^0C3X215XKEB|$jWo=Yw_N_puh&BZ
zPuBs>SEpX-9M+xE&8f*YBi0?Lg9jVIs3EI?tMFVphNwakQ~Y4mpc4~Jn0k&sB!YSV
ze9Ks&r1SIUUu^F8#Kve>M<X{^BDE^aVdWPY3iNVY&0SGlvhlcNrAp7XZb~RfYp^zj
z1)FqdP$GnbN-bv@SW~%@xDw>5VoXt2wxO7|1pA(}g$93jN@G0tEFfLN&xa*E^1!d}
z`GxmwDt5o0Ibp4MzE<(1*(;sd^1a)M)arzxTBbDH1Cg6LfXuB-BY#G(%PrYMRrMoX
zT0KW=mTFuv>~n?G<h^IRourvx^hGEawA@C{0Zoq@LHuS}v||NDNq*;;%nGTEQhfID
z*Y9*FXYd^&bIrfr)Z6eH2DMsF86CdhVo7b>cBQ<z`TVn0zh8e@!QZ7ieb|YZ?+-s=
zeyw_Emaly_`D6X|NQs&0CBxGh0mpIV`YZ%ak*v0s-Vl3x%s@{w$E&+h*>9wLYiY4+
zVeuw)O(}2tpm*N(j2LN89pf|Hl0~mY1q$uG(XLH^#-Q+2t=PvanHVFXs7vaPw0|<<
zpfRNvs^PCv4Hz>>rzq65x_0IJBSQ`v&Qt~LHU1jA4w;Q!b*kYxzH-4tPqX`gTTO@E
z34xkvARVjthyml|Z~}tULBH*>mGQ}fdUdF!jM;xiM%CN#b>5xKQS7NlTuKyfZko5?
z(Ie(Ht|H*Q&kWk=fV6=42-0;$a82K|F!A2cUG;G7ir4^w^75=b0oIAC7NOqup}iTL
zVMH=QF{6Tp5Gf@~**%DcMYbrT+;vpAMgc}aRoa|M`bGX6w(YRdoZ>}^D{((PNd?cr
zu<BiPLSR#sq+b(e2d4Mp8U)$mj$+?svxty7m=v*~4%Y2Z49iiGx-p8uGE;#FMsG5I
zGC`8-8gnRQsi9ZgR=x%E=pjkGG#w+4uD|$W@A0B{O<CJ&2H+J=PiY_4CiRDT%kmw3
zXo9%-7n7_;00i2w^Q;JO5)<iT@a0j=kwI)Zak}qFYECUHEG1Hd;H+5dn%w`wf9DoI
z%H=D2m&pAhqZ#IIFXRZfdG`cM?i03^P>qL=@1u3)AvB%CP#R`KKIx_2*Ihri;FYx2
z_N^q#14nc0L~{_=5W{OX0Wg|9$xs=>SZrWLpzd1Poo0QK@By2T!GuJjm*vZZp;&mM
zwJti;H?8J!CgyXRp5hw!EAs5=a~b&p6|F4-4=(h2$r#On8<x~8s`m^ZMNi^jNgp>g
zn>cdLwGodw6ia!}U<e7)do1gy`?(e=nuRZve*W7?dOjC4><FF-^<Dk4GBC@2*m$&U
zTrmoQIS`sgLBY=c7L;!75~BBMj<9czYn?RAeJ09r74|YY_&u_>2g41)o)J|-ix4IZ
zLdN>q1<<whTCn7}{mb!wML)#=7?i6zcumBHv01*oD*CRO+@(T<_NleV`jiYCIdU4+
z0DDZ`$=9*TGv0a_)>?}~*JiZV&h#vET!BT3uBs&Wx^gv9m<jq70TQ6{(^H4kK5T1O
zSP>xmemV^eSkCT;&)80gU|j!B+dLSO4bEajO`i0TefHI$A*U%0Zqw9Fh#p8S4smpQ
zeWMZ<XY%f8e8e;CaX@l_ibSuq8fUBnKd!LgZtM4T;}b{ga|J!X#_A>FHOFQ4S*wBG
zjW)K=@Fq;UXbY!I`Hpx>vx#a-MIZOq>IkIdI~8ngKoAEo0Y`>154`gU>^cB}Bi1ek
zM{I|{5i+;soaQjva451BHHzK_%E0?#QbaYkPV^^X+V;%uWK8-y`<`kFyrjKrPayGE
zb#S|qlSqqRpCA6Sr05ug+D>dl5Ef9|qeGc$FDXmUNN)Hv7TOM9jZ3a`_!jH>3AOFo
z%uXtAh;dvcHCyYr3_+RNYLxBH3GBY0;9hPMTxvuoKKbp3Kkoap^4f+kssZMBk<&Vc
zu?X2*MHvoNc123vI(mDfzwYDheCcn~Dw^Oze$P*}NtAis&_pkbhTFf)MRa93k+x+h
zlDwMRearPjSh9UbfEjF1u#P^^dmz!B%2XOppU}>7WMw!CA|?*+Q0q>&Zd+UVj(cRr
z3w*|(>UI6x^|~`H>?y(~5fz~Qyz+fwsVXy>JRD}g>1lb(e6F)@D705L$~_ck!ZAze
z#!x?;q|am%`nx?h-834b3Eow`RB0Sh(x&Ww_33z(xIa7$C08PDr%Pv4_pY6YQfEdZ
zBJC5~_wA{j_+T8N2SaFeCcGy*BxH6+2q)351>t9J#ov~DDu;d8G138jYE&}1Q4EjN
z=y>ku3>`94hQoZzK8V#xh&#fx)Se*LOMCsU6B_SPBYs@gmugtsY@6nDHA<x`m{MUh
zgGv@IQ*}aZt8MtjWDMKcqG+nzO_Uk#l6t@9W$t!eg<6NSXCdu6xIK|7weOL{$8BbT
zaKjs3wSs%@u+-U0_2Zs26InU66zT0s?VEfrjRXqB3wfvaACTm-Zap9cOqlK@)jIJ_
zK@$ZRI6V?!5gN>7rnGOPZT?_V_3DDeB$sm$CSM}dYZdHl2Qn>nBUx#A;UhN?bOJth
z5a)IK%IRaFw}-C}h7xZJ<Q(qpsxKo7{S8hiF}s=y)x6w^>iWMDwL=Au0MKl?xE{Jq
zB6)ou+`+YR)=0l;I=017lN*T*Jb*xlZP?TxUI(k&x5>W&{spzhM#$^EA-Od(3EK=G
zd^ptR@tSm`KLdp(_1Kobu}j_@;Ce5cKzv+#P4W%>EZ(cuq#OAmdgo?p*L*XpbDCP@
z5Y)_yg2HZIzjKC|0rFAYEl_T1b4Jeo)UsL|1<qN3Ab)AOj_e>%Fmvo)e)W74Qf~`r
zLaKZTs2emfcvLymg!G9y(>I~gwr^x56<_NpfQsSzh`8tN?1(E~Ie_VY4{W_)Ye26o
z<k;o03giR|j0z3o6JWpn6*J$?y4-qEJL{&Pusnofuyv-2_Z7|q9uRV1x65XBdqCU`
zmmjzritFuu>O#7;ujgfMWYmr`PK}C+!tVdamj)PVP>BP&kY?>Bz_n$JQkARv>zTc*
z7is44__mMeJLx&tkqF_(+}C*_bKYbj2>-W-O4NetSzRmtLMGkklYc5xy2J{&=>9<=
zH_rHhLS8$h7e8%(lY4!bK>R5yu;$q@w>2ct+MzNe2X&d_`zytdXH~|+`Ayd@HOh`w
zr}e1If93yu?PsOap9FZN15OdM3379nui$|p2ixIxAx&WC-joSp$csQUG=DI2sEqg%
zh8!<komgel*ZdCD>>2FMP0p&`Z8xe1_<u<>{r_-`AD#0E_a)3@$P*S}$P*T0$a_`F
zlm-8dywP@*qtAo9aZ|{z;5phNhkcK9FZu7YNW(aD7{FA!|3KbA|ImgcUgZMXkj@P0
zu@k0Je7Sxboahh&06=;O+hd`i)!k0=ni4k-x&4O-u}7|h>MGwj<lR?%7C7YaNPC_f
z@*VsiBouzvX?u0jvAlkV&&+1n#bp1Y&wJr6(a+&S@wNq|AJ7}GU5^a5F4Q3<bjFAA
z!|oqlxm-RXCjZv$L#m8EhyW-t*UIXx*=nz;=`iXu0D;I?@BoqfuWD6hlHH%0%(FMB
zjUrpdgKGr7ApjLpt5=s)?x#H@NN<<7f7y4)>};JVR<R$z4)2u&y%VJ>kL5yt#^Wfi
zlqay5)a9rfpd}#qhRXmJG;e`IBp2YezmdA*RjqawU;5uKYuux!e`Wx7eg+J{pL$s@
zqHTEO1PMYafEI=;JOfbVz&%>~mA)}#_+ukdpBPC=ifBBzk1vj(I$@UhCLVWc{L2`k
z-S2fir)hN5-423VCUZSEU-K`ezK2tRPx%dCkxPC?Z(hJ}0FU3y9DaiZ;WxfkBB3N|
z6b7v;aeD-{wzrKbH=6oaE>Hlw8+kXg0%sQFw3nP{e1bklKh8q6w5xyuT_YDGa;IlT
z#~X3*ul;8;D>x=5qlJB!-@zQ2vbv6@^}vk_qyzl6eL_dnaV_WtCUTM2p^$@o5sW-j
z&j*;JckS(A3YE(@!N;%$f9&adi6t~;Eaq>3PNcCvd3GYj|JGq1H%4s3fL)HJF1lz$
z73jAM7{J4zn$<%$ttOqQ>dzD?5Q{n-rKpja%GsO1^^p=*i7TO;@kP6m)X9p=M->;9
zB4K*9@0*K$f<4@1=M>S?Cf>fR1vmX~-K+|c1#BEAnqANR#1{bjE-?s4zUK!VIi|N#
zB|2<LH4&bb$c@19|3b~w3o7E@`{vMr&y(ZPcaeZc?kbWk{0|;^>aZT3>+=~@62qUn
zm`85$l}G-jd4%=vJaQ1*S>TcXbD-pf;BZ)|MWUy%^NYULA_?azthbX|N&&zoamsfR
zpju?=Hxl6d@Ce#j%_87~3b0S;J3O$DARf)SRGtk1$#n;?C^Xe1aVdhbO3EtN<h9{)
z<zVAGHtqct#Kh(&9cpH34;t5q>#fb%6cYT`dTOwBU#Qp+ruQ@b5bHhnLKA^_9V?L0
z9*hAfKoH1N9r{|&Dv~QFFmrTsXX~ze{imWUB*hkp<T7sGh~%Rf!5z_`X)zFlV?9)i
zw2pf*(#^ed*6fYzC?Md30xUpao^NU!{ondo!FkTRpLHpJ{r;FS50F^YH;*h}-X1At
zzwsKL{sBp@WOFqrsHz1YPyC6(QQ*M)#+CJ}nw!=~>GRD<u0J;;Rb1&4EOpW(EQSFh
zp@LS4OqXiJGpOv^l<T!?c49$hOzI08#CowBj6CX10FylS2PXMl%URzQHZn%I=kPO=
zS^0}F9HX2we1XC!Ybe9=l6y7M&82=Ln7_CEg}9;921sp<P&HB-{zloE)&EHYZ2aEP
zYPXb`_Fqu)eEwWVfh1Jzn_iQ-ZY1R=XfQl~??!5%@#;p(uwCzKldc<@e>;IvIq@7+
zw6dCcy&${5C^bhVmtlR9+jmxP9p%OkRPyXrKqYtd;z1?fR^<Xw$yKAo=p+qDHeX@O
z^_L~_OGoiX1mOn|hY(bbG`dp%l5D_a^;v%HReAgJqr;lF4#oVf2zODKd>%OV>KhM`
z40W{nbMI(f5d95P3x!#fKjyLIU@!q#@;EQKOcgc6A6@cra$l2x)xA81u_;mKzLusJ
zsjsUn^#Ax^@>5BxMk-z-d=!8!S2S=ve_!8+b_N;qC9OqDEL8pXl2*3>ceNIYOFP<o
zc0WLscbH58B4E(vn>W@?+AaSaNaGtGvA&Kj#S|gyOVesv-U?<UhGEz}BXlIk0RUzm
z9<lLcbOvIAWDj$hT*oA#cv~R**`9lQg4ypv+n$9Fw1MH!qsMj-+w(Z$(6}&YwN;4k
zEHfUXD~FpAUZBH^6l3T!f{oYO95=bT970*aWsm9`4T_n4WdXpJAWjxVgKb!!Q|09e
zsU}Y+T7BuAV8Jpy$z^3@2bz1NrXH3}YuPgH+vbN*El}vmcX_fC&3^oCvwg}iF%#qO
z-mj9=k2zVIpRR2Cwi6gd%uU*|F?EtL!oDCytU=v38h$?^@_E1u+27WASNCIk&IO{T
z^lFFylC(#I9;Ed{Cd#|dY&(C@5X*XRsvGFVrxCx^>5NpZcWU$=3)dTu#dI_kG~XGI
z-mxatca{2xb&=UU9-@On<g)PIi!*Pb2-<n>+Jf+$4I!=x*bn-j7&TaG7_nS@p7|UT
zOM%en0=TuhcVmwSl~o>Si$zKqUY!h%vERQrZjOx3%10C@L5l4$8Llh61;k5RF#9>p
z!w_H|(wGO}PnAHx&AY`YaB1-ao$+DYbSs_p>t4(FuI$P<t}q=R(S32kt(M{}<q(FG
z&dzxL-ZLO+?{!Bz=e|T+FZyt{QK5~;aQ3Oj06op=`pKRlOEf*UaUYi_MEJD<P@uZg
zG+rPMC0%`S^5dr*tbYko0&KE3T^E7*D{8B=Caf9Akv~xU{lMZ@T<I(rY8*(_3o2Mq
zBU(aeOWySox%b1zqu9I6_I+6dy@Rm7RqXKjrJs-3dUQQWKUw{R_1vj(tpZTT5={c%
zj+@(CBz?na34Qy;&uJGOXI4GdkW2#ctB+BI1?lKS5>|~N(Q1#Bs1C3RRgn7p;xLYG
zU41NAd#w@@;VUr``!K{wwJU~vgwbRg((GA1EZ2hm(*iT0G;WWd$XP>4kNR>^lJk(z
zs7+L-RQA4?#+o$_Z7pj-*=CZJ47oOfX51=CGi?)Ol4WLJYU?CWjYw+U2V0s?mms%m
zI>?qc%hcB*E0={UI*}^K2Wm*sV^*yK1?dQ<w%{1d0fVhLe9=TYAH{|BEFK%salNA^
zt|Sk==eC}<Iz4i{ug040^V@Co32x6E5Kpc}^@sa5Td~jaMOjb@3Q4BLwrg$b4wxU<
zLwwU$%zmG!Qd3;ZFiAxpGPNaHj#T8^PZmlIHP|U^4y+)r*k!Ghv_o_C0a|#kX9mz%
z&T7i!i>V4`q}EiJoWmSD$b@@2F|&}a)vSqZx?jJe4^ys@n&d1{5LBw?JuNb{^)2{e
zO-)vRB7Sg21{JR@w<UUnM7Q#HZcFB-yuOYSc!t<HY%{}5Ix_GA5su3F)us;EH)0eg
z(}R73_5E|eX1Pg1XB}0KShFLN9Zv*Tdb(D8ep+KyddLW@+(>Sy;@7i}cZZ5qSIOI!
zKd_bYwaMQFCs&*OcEvV-G~HSvTcDtNZRnAD=@oG^aRk#chDX5kx~}Y^i(Xy9(vbuh
z+M9L0TxN7~Kwy}Z9yM~pirA>9)A~kHQ+lGl!6Nw@m)&wuiJ{0@<RxwN3DkM`Ntw#b
zEVW2AmdG{~NfB8Zc_c9j{YJ9tOY9plxJ&#9QQU*^JWxKZ?VjVPa;}=sBkJ|rSvK;^
ze>oqzJJJRxtfdY|_Pr($RHL45hF4y+j$$(2ckal_C(V}h47Zo6eU2z9BC)|1SD>uX
zE_J-X2Ogb=c3f9VSKaE!CpckrEIRK_)LrF}7_MV&hop2?CSqrCmzLLwf)k%kw4ZO0
zsG>>~ZP18tr|OfokgvsD%c`tV=uaK|tGdUE33`pLsu~z5w#DFD_%GZwl*`6T6X0vQ
zlb&q9Qqn9zD6^_B3q_7-ExCe+<)odGu`?&dTa)6zC^`hdv&ZF=n}%BOg{reJ5K}K)
z80$K}U}~=4?IuWiIn<1BZJfMG6oyzRdD847Q+k6I&(Jq!wgQe_lX|!t^T3dKsSBL_
z?D(h9OCY@a6<9x-c854un>FJ)Zk(Yx_`x3qp&~nbO)PUczZ7lJV)%?G7rRonb&RCI
z7^lmb<{jBsyi}-h=+SD^GT-0$9z?S)+SYT2Ie6VGVLd~GVj=v~`B<XSyC59y!Q=74
z&-@{)%2AV7yDaKRDuep|Vh*%|O5$J7kIAUgC`+3t=Id(ZiO;RkcJ_w~B&$*t(5FYi
zIno-8pK)A6OtAA4!#i$le?$ERA*<|v?fXskqZqq&&v?cJtJxaIepVSY%Ak$JXd<2K
z51S;JX57uiQ9mFQXluLVQO&r-3iI0MC(#y_yNSiMBq<{p<+=6;hZVKQvqclSjfdzD
z8EJ&&CI!;2oMW$_0XXFxekE1$q}2<_N!<?H?o3*)A=leRcIS9uL_4+!yTHm%KRfK}
z<Gs8kW;v)0X8ij5SSSW&Z>yc3t3nOc&raUKr=XDb4N_^FKZKaUfa2f-aKv;;+*@x=
z8zsaVg_%(O!*(1-cN`3xbiq~4Pqetv>mZgw;PgyBfzjTL1R~unX4}Sa!z@8s=(|=f
zuOawIQkdIwUdw0|U-wA7W)prWyA=cgg>OxJ9vV`ud>U_Xe??Hy&rM$z=-Tj6yhl}>
zl98?Vq#rEIt1kvg($hTqh<H5fRKMYpO7!QvyDXBt;;c7+Ha&uM*NBr+<>tc?Y*Q+p
zmGf=L$4uN7ExhTGDO%LuDz@HoJW<Y=U6SI>oZJDM{J6#z(V4Ah!KS%+w@>EbSzb|&
ztlBY4itOqA+qqn*DMJ4i$Q(j$QMbBq|FZ7(<?imYo9##-`<ET1I6>N8Yj?Z{CzN<#
zgUGy^ES&kw0gX6lEdgMQXnT3fI8e?))oq{fcNTaH9nYy^g~h7sZIUFRdz*YWh4`2@
zMbBJk$Kt0AtMUp*haxeI8d$zJ3C5c3RYZ5EMk>#aBQE-~(-Cf?N#3Q{>5qmztYJ=v
zL2a1Y)VL+*9p<9um>xU7cZidU&!5$6XC+isAtoLT#Z@3?{W(_C50o{1uEccx_&9&N
zz_T_qvC)rH57aV~?$pB?WMUMkdZ;OdBvhB1Ql*Amv&~da29nXBZ}JINM)+(-V?INW
zLq|{nuaCruCaLOPPs1Lc5#575;=A*>mBrf-A;Pi;dZ9U?<fSSt82YD;t;^xWf^6vk
zHigoGZhTMlT}#{))6Q>43+xv174|Y}k5(X(sDoZ-WGt4AmLWKFy;+9mkZ2L3s4<4M
zl|3PtF(k++5wtk@Im)Np(ZZLR!om0ESkhyA3pi{y8SHrffv9$xnx>schu_LbM@FBc
zd2tVs9o&1+aXO}V4Zfc!hwshvotmWO6<wcpw4hU~^1MGa!cO;)(QI<05xTj%%8gYt
zX52<SfPV>oUaXaorw{`M1pLWadv5m3j&uC=u)0G=VIbcS?zmMe%vr__nO3K?>B@U2
z;>Gk$us&6s=RV(S@F1;@m!eKnXtG$7Ss*T7QnhD8cdUj&Y7O81^>OYG^7F$~4a#>D
z06OywjQTv7h?2WaRP^a9>XKEZH2b$m@LP>lp5EqDUphX5X!pFi3GFV@l!u-^%)fJd
zzW`-ANWo6cshIVOAM`4?;ph^eD(V1d+CI{fdDqgon3>6G=xt{xqgy5!STuE#G|@LM
z$oYUU^PS}|vwJ(~GdWet-XlhG;3tKK9=Ms=-Um^v<X$=7=_pw|H3?0aZ06L7%5a7R
z!OOG8(PwDY;Y{~l*hNNbxjmk(C_Rf{>!BU2XJaiX<CCj089lwWXgc8_heG#loJ=a(
z=6%~B?%RX*!<S+iWSa2H2<m$#`#w}G<U%kl$Tj#m!Z`q|V$-IuqB8&DZsh9fc>QJT
z8e-#3FmSJkOwzS9#V~16_)2_Hj9yc*)nLWdx3T=B=%{1`JN>PlT7PT`_Z>72iHV-J
zHbGsju&p&2N?Gq;T<#QJ!}@YSOvD~C6flmdoaiLrFHx2`9Uh-4p-Ar>znXVL<ItUM
z)2f0Y%zK||Jf$F#?uEC^^B#@zt(=_N>U(8+3{Rz2DI=%}Rno;>22lh~HCYxxHQ+dS
z^gjuV#B&ljW%qi<!luX6sRyettp2T0SVl1V&8(Lk+QH+!4!V0%&)1!jo89V5Boujj
z)P-1h$88^;o+%ug$*>vEL~{hqd^^z7Z4;X({j1d4CR{ObTng!dP69a{5c}(2+C5g=
z&v=S()*QkP2k+P%_Q`m*JSpK&>fQaaf{kZ5huahT|4dT=<#*POwL#Vxm~FD$v|3V$
z!(oc^9)qA=TY*I?1b6s@-dgR0p6;ty<qASK6>0TSfnHYCeIKxjWojGr)*>~x<5Y<j
zRLtLDpHoLpwC`YOPLzwJV)E`NJFa)s+?s8IaTLIet@8>Ha~RF7FQ}RFgH7$IlEYIH
zs<vX;gaV{znUEV|xXf{cM(K(|Pe(-&S-0gb5@GJ_KFi(Ztv)kda<ko46fB;TIf&9P
z+&%lkh|TVGV`pGY+kf%x!xmbzPFJ9W)47~pH|3X7Pi+uN-{?e5jd0eqkGb}cQFo+4
zK1RVi$gI9B=v2%3jctvH;3phk^X_Q+%vK#a2hwjwgyO%Iq#0Jb^h<U!z-;txV#Bb9
z0P*^}il8U336exrgQKqfQoq36f_H@wIq#)Noe60=>h`0ziU=;gXEs~AZFZYJ58gpr
zj7IK&CVSErC5A)|4|*%lP~ZqkU+;AH*3vP~QrN569u7rh=#$So9g8EyyJzKYc%5V0
zS49;uGY=w|QbZXnd!HN(%kpWP)Xn6;97D<`<l1LHr7-d1A)JWiJEjk?-->3E5mOj8
z#)Um@3VX2Kdw+KPzu&+sh0dm)@VW%>?^pgvYuMXxAk11j?)*{h?(>9r`<Jw8&+2+Y
zsG-PTvVCprVUr>073RMei)s!E<F>5AIR(vC94^<}xWig3`*6>sx{$7GSY@n)GgYMO
zB2+K(!3ETdK+vj2$HJx6$Q^A7h;>ezD>x%7i_xs}Wq8ghcGKii7~@z~6+!SlE1;cW
zT}Ahyx0@UIGA(E8C+*Q+GA%V3S{82#8Aa_#4=mlIy_X|#dz@I@d$4K@JuRJJ=sGQh
zrFc}4S<l1z)mE}79J+K=yK3>)YQgtKQ_9}`lUK3R%|jCy_Pf57tiC30HW!uqiz4bT
zK>lM}g{KmqK+ls+{wB5?Pdqk^&Jpuku~VM<F3#4NSmQwv6-iSJ#sRa5O_t01QgYF-
zBcjVaE*iK^-T=3WXZ*Dp$932(Q#S@@$(&*7D7hI7XP7A-1YI_!ZS35<gYC0nmIdBJ
z?bBl<>Asdy4hhf7u4?q{HUR&YI-;=!r@i>bv_F;|7^TPjL(jCBGgCZsdOwW)?o?X4
zP@5p5uhHkretC-R@7~wCqI?HLqZ(O_X#435{LIMAlM!x5!47EkIr6IFfxLZEKPH+S
z|3v?({ZrGI$eZEC1FBx#^@!=*EZ@O%Wk+oDt9DCvhrTv}RXA$Q6d;ok+OS6ZCk+KG
z+nuJdj3sG4{!ump_|5dC)QGbD{CL}Xs}IY{h_UMUyHAX(V{8;PQBxYPsM%Q5#yc?s
z)X!+T8+y`<-66=@?`b=gfKZj3nWR08D!k-DiEH<s=4(0KwuEiO8BDJ#@V!hQ`<$@{
z>BySKn$qRGJG~APHD{`-TH1YSn38lDMH2gmO8VxLZQUAewjN{p6teFqGHQf##jR+O
zC$Qkxj?O@sMcY)e@)!N8R3@G<+P`7<_bShsKS~nV?Y6M#2jI(zNcSeng@Qv`fibo0
z^X@l$`DB;bYI~jdaC~-WfbmHyZ_35eD6vTuTdUf%U>x?y!HKoCK@|w1Z9yV&=l?_A
zn}<W)zx~6*U@BXyCBrCPv>}n*3`r_Q<wDj;5<-@-n=zzFwxm*#AxUN5WtkyaE5<Hl
z>@&tPgE3~tEWhcxzW49GpZoq^_j4T2zt3NvKjt`$d4JCLdA?q+^ZkCE;I%>5_Jztf
zq<TI5Z~^3w$|I*VPo6dT9zT2enlvus)|Hb1S&_2Hx$nWc*7M5Qnvf?qhQDuzN58B2
zLcOudD(|@$9etnTRZOgev(30$!Pw%%6ur_2Uia=dXu1a>Fe=URpWY{5%KjEt*^^+I
zz<o3wTFm{J(xrg1=In!M^D}%OOrs~kZ0X%XQRIvc=I0I8QUOG7d9meY>gO#rISReh
zM1SYmu%V;6((lu*B(x<-i$sZ(AJmxJ+5S39t~UvDV^~ISVO=qvt`hqHW^T60v*zgi
zo``vpV;ztYarfn4?q-$TE(O)+En}R&JOm7e!uYl`LOpjY_{U<DMvsr}^#DF}{Cgti
zRjOCf?@2Voy~N4-<y11dCozBUe;L8~U5IbQVE(p#!G?sPL2F=Z6EWQHe~rfck1I9X
zZCA5pA2%PJ*8W4fQX|sM$oli0g{Lyi!B!9S?8mm+`^6Vw-cQl@cx#J4|53$#)SUa*
z7hS8qw0ZfA<-!Kdih?j_5sz{D>@_yWf85)aJ`|$8<>C?$5_R<XojW~0%J(!sb6qR1
z$<9!WN79Ra9C)%uFHqK4J`msKhQ7wz^S_>yiT-_1rr;s|<X^^T>V@d+5i}gV2_@&#
zZjbV>m%jYe`YrR+w*9P1+}ZsdR98d83?Ug0vEkwM(_fFR9@nx?pQvPw&yx7+=B=y$
z+~^YB`P*Xe_@<TCH8ZzOEBf8{lZ*W<V$F;C;~Pb|>ljXt&%0RBTSDdUqov(@r+l4}
zGLcc2Q(if=*V$3sQ(tww9-9lhNPdmxU+VZ+O|Rr@sr&y)*E;Oa*HZc2mbd8ZyL>nJ
z7A$-drz*Sl9?N|X4*Z^0Lq~`+h+(g1HV)jqCD7d5o0O`XdEJ8W-%rhutqcR`hqeEa
z;~w_^`{r1RM9}%oOEin1OCnL57PlzxxgTvKF7pD~k^|O$))_uL)w3{?V2=<1B*mW#
zdP7+FgBYXn$n6TBg$I{^hG;Z8`$+aIa36QKHVq$2F+qLj4!&B#koZ!+?f)|5R!#Bu
zAvQSr&x~`ax3ln&4laLft9k}ldFcLa8P4-a>(p?MO5;Ln$dwx##$w`oWb$^;l&$UW
z_+Ht^ey^s1_&rq<%b%+G|5-aeeENSiM|+~Hl&Z-d#`j)ce)GRyJO=Hl%VZI4{>x0w
z&1oy2IMB5h#%gcNRZ=wB%d$}htuqJ(?;l_~<0J6T;dTu^sTg3T;|LG}zvunGY+A5|
z@vr`j8+^OPA?+>x3Vk=-w7Sbbq%i}t;#KMNhB%;CjlYA<mmPwfeRztUx4s{7JyO1P
zOKM}t3u0;f)xIMRAwKiSwf)1!-}iH}Okmr<mdLaYJ;I=3$Bo(eB|516)f=ndc^?YP
z8Tc<WLUU*1+#l+C8_W1uE~VV`;(`CX|6TI1xd?Vx#GBEl*rzQkQ-7q@sM0}sZ7$EP
z;*NiuM#G4C33TH_vK0q$(oU&k^84$xxlH1(VHu&}pBG-LH@^~Ii#&EmVX{5@GsL_h
z?yG%<1t1zbcyqx?GsTEF?5^%}OJ+yQ!a<^GN}hOQ)SnXjJAP*Ji_+}g$Nw;LrP;`M
z>Nt0nP1m@?*^qCI=bL0bR_l_DlS+_G9*{vs?Tpb}A3WO;Sdi`z@9@=&9^CFHj~rCW
zuvgumJSaoyx@@Sycbb~LAw3QgauvEJqvWN)_&M;P+U=xWd4^LGsH3RsH5ech+l#z=
z@S9$_jO5oz1E)a@*k^^`xAwjH&r>3G9|2f-tRoSBL<U>9gxHKv@Ii7z5x<Agg-qjy
z+w#)tC#{X18=Y@@(|1$*{?40<6StJ9r=YrgufCEl*DEJAH^1kmL`I5@STfv=wuqX0
zUvgrKFC<|=#3ZN~>pMrU;Ggdu@lEUbo_CepP6s|ZGS1;Q3j(8Fb3a1$Q|#o^b=&!F
z)?Vdg41!llvkSg{t2(^Nr5SifJ@w@!#C>^fg_5Da&ikaEfs%K+p0u0I(ww^H*e7L%
z!oec9_nABY;E&_nj>PbN93RxZ{)bw-J4R{ehqP5%ds-<sL4kiVEP-;BGr%IhBV(3_
zV9vcPm8H)xjn`|Wk443wvz5Ag&hPu}nc)1}Ghx9rV$Y0*dNJvnf|7!gOY~$LH+!F{
z`j0b}!Nmoh-+vw)QBnFjj4Tj>a_38LK)JK<fIF}JwrfVz3H0Jp*hXV4+(?K^la5+k
zcZGy3<$zWRnX#u1?Eil@QuyLjT_)eYV2^LVy7ULPKxrfbTz>?M;-t$|ThOe6|3nRT
z&>Z(cysNME{6gG;dUL+hF`G`+4!1%v4{zwqrb>HI+%NO(6zHeF-kMu~QCg}$o}~$S
zbVhPjHseUIXkfboFUpE7!J>=^u$<67l{=io1-?%8vLty^AKSR!MjG#_NU7|?JSN#C
zr}O-&O0ad>dIoO&n?%H&nLSS=lVKk`P5uoLnb;X)kIs5%N4pSZX!$E>)fKGCdUyDA
z^&>lDTT?TjdouQ-#4JBgk91m}X!B6p)Cf#gk;sz>fW~r+a4YLaj#gA?$1E(r+UiZn
zP56w^9F__HdTMq<Fk5njTp6dRt787B=*%tQv%Uwy0>N~R0zJWzOMpI^81?NTi)b{6
zkt)cI^zXa8oa?ubN6sHh|4)qg9~op-A|{mYoN$ug=uoPEH<thUhzB{9^y=%W@4rtJ
zChhSSpE;1wWx|_F+H|Mc1>WIL9?!a~_40=?->d=oLGK>jx>aWB=Y$bajJ$F4<r8Y<
zd!h!1s85%cLdm<ma+VgD^!bxoPgeLF>!P7N*Ew#*w?}->s<lY<-bfu5wo54$`E~uV
zl|ILp{Ea(+Y!P)SW5?KG?=q((qq^KJCWZ_N`*EHN*U|IpXr^<692mXr$9p+%4c*jy
z0a6I_|GZg&_Wi9r40CZ?vo2WVpgD@>++dOXKUwnD!5Aadf(&PkAK&KKyPN~gHk{z$
zOMMo<N}CS&H0{vj>&D9$11U+8`6;rezKfA%XXP5S&M7WrRi7;mUkKA!FXkI<1;q8r
z-2K7XS%K3)Vg=zL$wIpupzKz7i2K`9yu9tvR8G@3yQq0M97~36zn;f2<ls2=M;Pai
zZ`(K?sKhEJZ1Z&~^S!lMA#9BauVUw?g{sTErJB+4rj*Z(WE*stA(7y~CBwJLYej@I
z<bp?3&pKb#rM?}E<g)YCIr#Z4b~Yh&+z7VTXIH{wyU^b9a7~&q^!ZQZpjSJ0KQ%rp
z_#j*g_^5NgaoWY(J_#Wwl2;6abnc$`@a+#0xy81{>(I&Fvd>Hs@Ke!MHxrLae2=}n
zXUCC4PXHGcj~p7XxP>Y0+2&UJHPvtZ+L~<go2ec76iNR%`_b8BwAz}9bF(wt#WNhB
zj9n36zI3~X_kl*$4He&O>Nk41hi96gy7Yh-{iQcC38wMI?>dG3It%mihGdHFOs59)
z>y9P@yI5KRMva9*ch@$>s6ZDR;wY>wEBO#7#1H@Vu3DLFE)5RGuE|kguOmpNxM1DQ
z!AMH-Ptp;=1mnX`cKr88yqggFdY``XmZ$2z36=_yi~%stZ(4a{s<{`%5tf({*djue
zS)j1X*`V7*+RroIAtCPVQ=o^UOl9XTh*OklM`pfNw3uMf?c9B0%Xpnr67SQ_M~X<x
z0*r7n?Kl9$k&%{CvW{PK<<(ci!*wigS|}MGT5`j!^_An#7<!Eo(SIhN9a2(QdpX_9
zV^_DDL)q%B7mIIhz9BH5O)vI_El`U*peTzD?DO^ooa*K2drCQ-9Y$}$W`4xOxOo}k
zL=5j$%we)McUDrYLm`w+ZRkbO&y%O+1^0Y_i&!)A6;CDy1Ap-R6;XNP5tK-R9(yyB
zpqmxAG%jX^B1?+z??m&=a1CkQhbeNaD1v}vY2>d$bFRA4l5DFqmipQ3=k9$m=M?u`
z5Ze3S9;G!qmf2l9$f<+UA6@TT`!&`(4=Q<0n}C|9tuuta5;v_DhjscYSMPfJRt>{9
z;T&Vr7Z&y0GGPq%>RLJJc&u%~)Q($#JiKg>d~^j~XznxMP3+Qsc_tp5g+wa03MaoU
z({Ya(4bU3CWSL3wGCdd=<C_BDDM|^KpqL%ymimiQt$7em-86;A^^4Qt48fC>pp-^L
zJi39)n${q2-woM)8AqOQyc^XNmK8E)8gKAxQLQ!6g*Gv5M2YGkyZD8C*;(u#M)s#^
zbnr(vjA|gq-Lg*^F1x1Qg~vv%P}5S8{<^b6>JYVt<^DC%#Q`f`_H?ozdtiFaDr~*(
zsmuCPqGYHaY>4{7+$f}u^{FsU8pmL^>JgEF>~;E!mBKMAOeCFJ=7$=jGJD~t8cAE(
z22p=RP;9}5{QoqL5IIc|%Ya8Q{b%I}w;5arV{Li~$IWg%vm)BBgIg4D%_OihT6d~s
z=^D<;_8wdVK}m;Nef=Wi%Rew4XYjbq=ff*A-<%=`Sb4nJT$`@M82OdXc4n0BZ>I#8
zZj0GfZ-)(Ja&IvjYPmS)WzIw|Z{2@b1*)ADwvisUJwc4h>$Stqw6%IbHx}23I@$P{
zb-Z5`<A&}Z?WN%>h3%!cn0sG^A*X;8S?nTKQYO3MN?YhK@S%$+ZiD9upv*!H5NyHh
zki60dpP3fwoOS9){^8ih)leKrJQTa(-0^aEye5n_J+0iKVBmz>9BRd2xk=O6sv%ZU
z>!GP|KxJHy?(Bit4PFa`rQZ6(O5ZE2xm;3qH6S%oqL;hLgR<wWxD!+r^m_MnECfk-
zE#pT6zd)8;vsC#vG06{9-E&H18!AdguwniD(A%8ysF%A^^$UXkybbW28r1V1uUEQI
z`|`5UfWwEH-BlsG?)}&|K1J@&h*PJU;iE4<%pEa#JPUTC2cIjKA_n_YpLHlm>j?gW
zhU_>6kjPP5O&$P^D4+tCT}^o@UOtj}7<b>=Fn^%18V)&;nKntUsfCD!^CA|^hd<zW
z9ExldXCx~8<O6=+zBz?Aj`lsq{^8n$KDiuH+c0}nA2$NyRgOsXhSSjy(Tr42*qZ>>
zBH`Dr7T#(0JRBRv{zCJziforriUQH+947*Gi#bxu1nm3|Hvy(cHuwAVl4Dw`AX!|F
z2SaXcr9e{*xbKVWSmJJdbUz;bhufhwG^g87(#|Ekjrsz|EL?+VMczJf7|33w$Wy|I
z)9&i1X=;pAD0Xx~<zR~8dS@SDA0~`N?Mp>^GDzky-6WX0f3Kg+W)!U>>Mq-tpo3lO
zZ7+QT;Zn_0X`9@ucqBenLEmKy$BP|)#OX}se${QaYh<^zI*x}i57Gy%8!*SiHZn02
zyB1O*q9f|OR_SC|E_EMlt#T!_AoZZ=Vk&APR1Cd|=DkJ5a6qj(zbG*)-V+1n!7~B1
z4X9t#x(-gmbQS_;bLHN#RXf~lMvGtAueZL#-#TDX3*-VNsfTyYJ*J1&wZ4f<RIB%&
z+YQQwz+YkryVhzOIP&or)<+CP&0BbGr0Oh1d@SQDY&<IDA>m_G$2iZmZszfc_{v_W
zcUY^O3k)3ab<Zrq9s0vHk9cZJZ{!N>A0q6llCg7uOX@prm(}3)^!<0`_c9%L?|Oxe
z&0k14w0U#(jk|QlEV(tY3X#5rZn%`ZS4;4zl+GU5QGmobGx2GeY%{0Z@>$OjA_Dls
zr6u~brhv6@%#2z+$rJMe6K@Psa07bgdx7+4&#9GRluk)C$IT0lo;TH7Wz3q>hwR|h
zX`?1Bndp_z1+g<O%nCZ$n}HL1F?}tSMW6m|3+Cn7HTmqHDkM<0xe&Q~gk4cz3SF4}
zYl(!}vEIvut7`;}Mq0kQ43<4_A%d-mngT-J-q^0E^-mvIS+Yk?E@f}Y;*|5R?wZ)j
zR48MyUf-W4G;Nl~TcKH5)AvQ82FQ(C!&`GG)__N9g<s^jV|(dSW&{npvNYyMVAZq|
z)pXHyOU@K%)T?gkwq{ko@a`KA6bwYs*{mj5m9cz#DT;ZTQC%8tv)#{do86p>H}nZ>
z23mT<x!DbgJw#||OS4^f^8q_24K}TpefESh!8eT2it}aQ<0oN_6cpuPIE2w084sG^
zwX`n5L)%AT<j%Y}`1TN70av52bDY|t{(zY(h%~_|Fb=FmAQ#zgexdaP&hg_D3n8tW
zD}~{rJyi92(#9-WYnr*f{bi&oe6x|rY4`sXJW|cOfLNg7(3_#{=nE;OP1C4V1W}TL
z?0`vh)Xp&WQinDpdSiIT0)JvGw9i`nkHYv@wUlVvLB02@`Sl;c<~s(#AMG4?LZBj;
z%YgqpKG**;#NcecX{$&`b%LsQ7M1o3Z^N<v8SunR!P!`T+5bmJ^mjF3>jzhFpE@25
z#A~Fu8RzMr&Awj@ED7@MyZ)|NNAw=GEI}M;taEDgejFGH07rKA9R^D3*Ky?zjzae2
z0M2WK<;{$opJmLnNvAG1RL#u9k5fRR$TyevEL*@?Z{L|>IWyAg3OHKRH|Nz!ZYWQ(
zcs0Hh<~R8`K-z`&kiPvzMVv=VMdM~rZ#jm7{)vtgcg-4>E7VgN?iuj0aXMmevwJZB
z`Ms|ri81O&dm}d%y}XG+$T8VM4=YBTLsu9GasEMpH|^@advwX3855_tU|`jW5=M8K
zTgRE!K681a6zMS)7<1?AJq#}(_L7TaHZu`65cPJZBJD~5b0muMSt%+p-A}Iu`Re;f
zx1gJoAhzUyTHREoQbhknl~h<jORp2vdavMCub&R^Yp79XH^tjgv_|e{{rE3R`JTwO
z2F6TcoFw<#c01-zCN&;fcE>0SK`*fF&0q%5e`3IiEk`%Do7ofR-sqgjTT;vnmlz`I
z-#Kgf4{!AIj%S#po6Cc;AFUj2R<GVzdOLiy7;P&{&e<O?ut@vpczxij1j@gerBVzn
z7sZ=PWbV)L=2UjyQ1LySCl*yL>6>xC%u@AzKl!^!1cFw)|Crm7qJO7iIq-sciUlf+
zE-s<fo+p92P4bq8O1n*8mwt6ErGDg^xxAiJq-s%fh*>knVs!l0so9xYpHdvRo<9D5
z>mYa83SN1T96R27nCiZ~f#GG&_5zD!K)dZ(=ChOdD5;y3X3YqP7Ktepg}Ww<V^&P=
zw7|-@NetHyrjMLI0hhfO++A!JdW@TIfz{2Lzyc=k-fWF@*zS6W=w%L4zr)#!wq?*;
zVRS@xt)mW{**%~4UDYqRn;h!z7nwQk_rcucmAAxxwHRq0cOx#8-)vFBB9s&uyCNhC
zvH~*?EDo<g9D!<|=PYJ>T^qNZ{U9!zpE6RkeEiqkRhu&^$Hk)#EnA)S(b5Uo+HOgD
zPKaG7Fntky7VE#5fis+7s)be>Ow1|k$fDKmhgaH<lJq?DSkGQ)|3h+qrqtYfbybM`
z80%w=tMar+9(XHw8o&u(*{5%|Bb;p9nm{jeHLA&VL+v}5q0gWQC-;B~BpxSiUiATx
z?-#a?=9JzH&M-K3`po6Ty~XEGV*Aey=&7Q7z5s(d#f@X*!LeE6)>3+cDJLT)wbrRs
zzwmu8Dn`u|#>eUzWAb)R0dsrIvx8QS$0f`0r)yHpPCZoL<sf&UQG51@dNgm^*H4}|
zT}k0s!A?sF`He)`G5A3B>+}pg@*^KL#K#*{V}Jn0n?JcDq0^=-iCvtX+pP3Gl<;1I
zIF%|w6>2aKVi0vKvgfl$EupJv#GeN;3}e3nKF;T3dxQAxUzDmf6?rTlY*wTFDQiG@
z!ulpLWd8%^UWT%cUWjfj$MCCrhVyXy*4&kc&oGcFkK@>RM+LpBqy^$}%O+xzPQHQk
z%nA7FrsKHZZp^^00XFD9obiyS(a1jva&U4os^^vj(iJu4MKI)k73L`(!X>glTD>{L
z<*w;WZgE=;#(EEDp}FC$lDy7=I3<Ue$Of*!XJ#F#LBSK#7u6cN2uYC}>D`AzjE*q>
z<lwfNC}5%(E{$DcyC1zgn>~nCz($4fwkMt2w7=>^NcfF0D;4Dq?$G>)*Da*f%*)5R
zb)=|Q<!%U<oVh?wb^>f(yqh+tAQ0eQbmdY(b@s)?>@$|PbNkK~<YRXp^=>+#a1#=K
zyG&TEDYvk`5Sw$TaHX8I>ss_q&qq?xC2wQjSF@6mDkQFEYkTzx3=T=v3q9g>ylJuj
zP@-KGixU0Td8uGXBFM)%Y;(wNf<|&nfi9B0!%||3Q<_&Fw^+dYPseTUx>*{v36aRC
z!I<RKG0NhN0@;MAW7;@YD$l=;Mg9o5T<$GXH}=2_6I1Hpw_kS$@6;Xs<oay78Fd!p
z&uWH|hqSY7X~=P^ibrE0c#Rjn0+G~doKB8|c=K+`$@Pa5-xxGb3FC~ov54^i3xlzP
z%uIUfccT)Hn-5|5aW5s3x3KF`QYJx-I}PEMwpK<h+I0~2FVsdJ8(cj`onIA&GYnQj
z{dpUFa$x5i?7j_Jh7PuGzMpRAgFLkbC^cqFEH!M-Z46csLbSbsLo#ABn*7=8j58}b
zj}m_Ma@gw0aAE5sQS&EUDiXONyBFX>sl4)cC?m^jFH1W|PKfy}oS6QRwB<};5vS+q
z19GXp-g8|A=-wMe=tT>cGS=tRAEW&3>~kJ=`rp#?gyvkCn7r|hz+&!KKc{uvDaUW`
zdPrs~X%T;z9VfrW7l&#GC8zKO^H)x^&t)+RAvpv6we3Ig*DQI@Q`Au84<t_u+2ARG
z^_A3f4?B7+5BY;sEDKG8PJM~a@9VF9GL8@M?=&gwDHIFZ9xbjw$`&aEsR^E2s>?ql
z%D<}7zO=o{3f_WldZ!pp4~nWU<E#?#uHpvJN~_w?c!P;t)T{6w=+DvP?oo~}N~24g
zUg$+l#msE&8z0Ha6hK4o-)G!;JcNAp%}SkNfExnw8U*F~pWC_Eca6tcUuY^py|Rc2
zvvTF@KGu#&u|!I*;dlOcw=809sSDvuRzUj+2NRAr=yAseLw+b~mhng_<;KPt=0r~j
z?ac|?W+twJB`eN0#_)QyQIFdYKT-11u(Xzg>ncX{;mOtP*2%GCmw%&q@K?G_e$Qye
z*ziS_H|Kn(l`tgUlL1K8+BI;l<z0c{TRTyAbDgA0o>i(t^lxJ7m9?U@zl;^Y4hi(m
z6w}}J-HNSOX*>=Re^TP?PHL5lxqnv}bWT+9(R~RojR*TkHDc$DK@H@yBZu?_b*1a~
z2bCA1NVIA*2pAfJGieyq*+CNs_JjrW5n%|P0fAGq5^9E<z&6vulLDEDC+0U7b?!*c
zJz>Im9NFk%g?L``*i+|SGuxF%EnS2C{#vZe$kP&0$8YT{X?np4;<ZK~+}}x-I%+Cn
z#oo&_4w<<=p51m3yOR^S4j!Jkq5lt&b!fi;wB2B}ZZ?ijMALQdwsQR&ifpbU-VI;8
zviG3zuRZ#0=a*jL2Xp5uToS-_X9l|~U+fge76;ocBZj`bXLT+C4FDBivUK{1!mc2j
z=Zz*}p1TVGhVqVs4<(XKfSrn^>i!_-l`uC(j3vZrn^g-CgN*-)q$Z<Q_9$YdprstO
zmEaDrQ5KrL*6}8=&n%N?{`~bl#XX~^1eZAA^ENXU)6MjAQ##ojuyI~{zz|)A&}*x@
zi{eomknum1tbhGV10{d{Uz6+rBfc}?tp1D~C%l^X>p|s@u<N1kL>5Opq{7o?E3AI(
zmG>N0m(!<vsV;XHEF@fUP$LcMc?meUuc`lfeQb99ETk+IO+9ln&GzuwqqlZ9#{kzv
zJe!{M?E!XV8~WVXKYU&(Ic7i#IX@j^ipXJfDA!Essc{qw3~eGFH+Kpo5i3_%L`@i*
z9zV%kmAu!M=RF2{5v<q9kG<YKqu;GemMha`Zs-U~JAd_Sgh0z|aEFkLb4Nm-{`()c
zjM)K>TrLL+PiyuXrmOc(4wr0<xuc%G7*l@el-MFJ@BM`KJnwu$Qt;)VB6sZ|A@U16
z|EKl8Ei7UsYjxZ6&Pkxjt>!PFSA8#;g7h<HosMaZ?Ko{yA-NB%pJ8?*S>Io*(6mrO
zRi8u#gN;~YAM1x+=#N>~id=HgtgVQjG#I!00%@9?u|m-pvnlc^Mj<2Um%ASRJ5BMw
z#v3x&toau8j|`{vX?if#eEb&<;UQFXX0?QSq3Nk;8FweN)OVPrTzz#}l=>`wRrp8!
zvEnoK-XA*c)$<=xZXB%t)JB#YJF0cqfLG+Y`pzcriN6G%wRune$of#ZcK%T2l%@w`
zG<W_wL26uN-)oz|+nmb>u>u;q$?#p2M0g`Lu0uYuRbFM1J*)x=o=aQVdJtN)ooaK2
zX)0Yp4B1k+7cr1oLvY02rih>WhYI^I;ZN6i&!~@YB0=o;$+h@>mb$KW?DcQ3z+roj
zH{)^amXK@v7c89azC^BBB$r3Y`ozd!rM3LY&&g+kHigx-?!M@>LCpyun?X54nCCeQ
z2`Oi+d=9})2>s;(mfk;t{;)a}vh&kkHhG6qbUXOuX#lVWFM35UjJEbsLI((U_MOGK
zhzJ<b#GlgTybj1H?B<ccERiK=aoBp16>^T1=^WIOObH-+b$~<J<poY5i}S4q>|D+)
z*WKyxUkM%&AE`d^KlR`L`mT-$#@h*{_&^>h1P@*VKAe*KMLIugbxw;d7^VCcC5sGc
z7~iU0GFqva^mOifdn!onZpt7;73*;I0q6?Kk%50+DfL*s*;bDgWmtIf%r(-ekjy?q
zuk~q@yi_ZH4j(uGYyAqJ0$&XTd=gWQZ81?jH9n$O%pLT7*C(OVEG%!dJ%i7m2BP=B
z$sM?xN!T5?U<NT_RMq;90LO#JuJ}b%Dp}Rf`>Np<*Hj3kmvX-tjJ(wPzJz2b@=E&G
zW9a4+?D5VU7V+;VvS1WDM?_=yYC6vwMra=Zas3RE$1vMPD0eHp`Dd40zLpm>3R-A|
zJN{B*I=uC*hOemdpT}@RD^E-R7_;3Tn&dxUumAu1V^wC;lpyy?o%8f-?~>1T&KWg4
z18%pddLy;HIA3hbYGuabaF4fi^;L3;lU=PSRLg;!D|Npmci{S?eRgp9<wrU}Re7o`
zfHr`{C$1j?&bG$aoRk`fH~+D(IW<Rua~Cn!dnucoR4k$K7^vo1h1XJ+&!&ULRD%H7
zZBCxgC9JUZooDl=P8b7EiWHhd6lTAu6|<`IjgvUzRZH}hdW(kDQMJb{9kt&g+tfn9
ziCdDtw*5$*wUUy?psO#W4yw}M9PO9$np;YY2l*NCy88lG{CKQHzGeJ|`cf|^+DP=K
zC4e^lxwr3L8@B+r4Eu?$;N9j0z&g1D+M^;r(UIUl?i~9HH;sLQ=>gmK6iwvJ8aJX}
zr7u&M@q{1CJgj-t$1cR1>J8Rq@6Ui;Wlo*_f`e;yB!u7K3KjI@th%m#O{a5Zx`?wp
zt!Vp@sNxdid8~w`@9u1E5|CsZTX4C$lEzMh3w*K2aZNrPt3eWz0T=9d)aZP8GFJE~
z{=O1Ocj|HLz<Vyqd!Kz`3zah_-7tkeDdq+@qRQ1IYM7)Kz*tVzkCIf?Zqt6^50s#3
z)Y2qXWY|}so5-bKu!`ud$w+5AgCu#!P8s;B@J+${y-d=~zVP-o#I4J;&106LrTygv
zX#bUg!w{b84)MLb@3<nI7y723KfH^Z&dK=vWJ87Mx1Kr&?}8OnrcLxAo@z5gCt>T{
zwojy`!xT(7&ytgi5sgQ1+BSQbD*g(Ay?`M9$v@f_H+qu6!Zzevh$yAxYT4V<N*&1c
zH~Z_QwE&S*PErw@t{B4?7LIm&q-O(Vjkc>)Fo-8^87m<DQD1=XzO_nflV;61`P&_m
ztWlw=n3LN0j1l~v4ycx!C`$NL20&lBN61}PNTliA$l(N?SnHK&giUn3%e+Zze8p6E
z-+IMPNw6_Q_HkLXnS&>_4zSHS3z;~piHsgjj1)3YvE_-&2QcxQu_uF822@h2@Bjut
zH3Fe;IG3!1x=k~OfE&oCp`0AhuR?lXVaC=_XCcvOBo=gqNA5t+^fm%c^D4L%yvy4)
zkw<;$gvFEV%Vj^9nr{vjL7G3$Hm1GUsKsdZyqSXxOms0bH*|=8J#d1Yk?B+P5#H(4
zn`&VpW6HeOJ@`5J?bnVO=(~kIuv^O$dG6eu>!b$1uDng8wM0X7(Dr`Qa&i3i#vzr{
zn|FVu@q?;}evEp*)f58F0f$T@1X$%mDS@3NbEA<XD2{Fj=cjqQp%uzUu)61wLP*nH
zf^JTwXik}e=Ve(Dz|AKn8exx1Y17Agn*pBt4bl(;CQ|ag+CdM!3#DxPX8V;Rrn=Wt
zJ8W>Iz++bBc9@hF!BeNl@`{Ds7svWt_R0C061jshB`G0G93{z9QvSDFJ_8)u%^gvP
zI)raph2Ks%QIpdG{L~mwF!bK-tW;Bk>po}&>m!{esm|T^S7`m-WqOi<+$u$_4@CDK
z!ZE80+&-fDdTG?1y~(d5Ut25lE_2^(r8c6=A%IQ8AKSz#j|Gkag%IDpt<%=IxegoA
zD&ABXZd}6U&MNTV@2V^~a@5AWKBAL6qW<v26-Uw`bJ1wGSg3R${TSKSepz2a6pIL7
z71q1ig`3SW8xHUU88vHM7*VGX@b4Pn$0<+&`Dh7oyd7nQT{v}crYKe{?pgl)7e(Mk
z?gbBjeP7biSg^KFu97Ll$U!X{YB=ALA5#dzd?^#QrKw)M`e8^}OU>ARIoEOJn38z7
z55Cl`Dis|>ianv!)L&-m<e7``D#*=KV|4<$w_JFl;>HrExHeJ>K^+gkTE62m5F^%o
zLl$BpGR<6$XB3yf)AD<z^9pT`{)uKOP@)#2?q+gyh*mv>Imj~Tek72im(BKmeWLv&
z(_`I=j-MlR;ZS~e{5rSIfA7iwY7@Fl?T0s#=k@MDUC5z7!S)*vhiKbKTFd;kDjUe_
zjMLR03gzjNYT@{n+*}YeBOfm+{z2H)A7DgF>#GTw);P~vm#bd~u7<Vrfu0<YNvG^)
zwI~M>Ve9z1C*{7R(~4!X%^Eq^XgT4gQ~(JtvpWX``rz_>Ks#c;m%x0Z>#ox7gz>|v
zC`J|Omd8iQD@Jq8LtZ3uB7EhL^@_&%pq!5&@rG{gpte}sSpi9VK)wFdSXxR_w0iW#
zw@}pz%NKDeId8%t`q5U#j<oWYhmiS$`hpw=rTo+#8b3e5hR+Yf;d0zRlvl6emj?uY
zq9ec)78Se&Hh-V7m6&$xy>o<c-YF}x{n=FWN!;+lW!gIT`Ih?drAZuXj9N-@+`w*k
z$3*c0of>(kqzGskNZo8zad?{9RrhJvc&Idr7^}rk28N5H6_TY<YZmbEIhl;p{B+?E
z=G6Vku0t>xTWm-JZ0~>ilUOb6oJ|=>5!TnDWMBbT!hP%P4qLkq*;gxQo%kYnUjwqg
zxTn!%dvtH@5I6!5Ym#EJBxkVSUcj?6r_{)Q<)YuaK9S-^2T~ix?fiRsp=1~%K2EHL
zs&0uR*Q_3GWuW}2@|C)Qc;robU(0(*TLV%|Yo2h9jj{CA;e;JmoRNV7_~yQJiIk{K
z^%Sv2azU`&)y2^i-Z9$*URB6x9_wir>l;6j|0{yJaPKP>`GMm{&_kx)w4CE8QQ-Uu
z@sr0A%pNwPw>)=CZ;87--J+OoaK^WkFvm94F&{S|vdxAE^>u~+bPwm^(}Y1&;TO$8
zdbpVn09+~n0GqgY&g4%sTZbW2mq>B>mB2eY$*%D6P9QD+P=T{&r&7GCH!AyKvex<&
za}j8<G^@Y*;mJT+afWu#v%H5cu9KyWdpcU~2-wRb+@!7*?(?fyZ<g29Zq60x)=L@d
zux+vrX6WtkVWdlv4ujwv*1R9*tu%DjOxnoNcLW>KL_8jgMm3v<s8L3}$G_T^1L8qB
z-bu@HBX{Ar%ZDikUSD1L6D-RD^xlIilUO4d?$D6JmOL*3y+EkCXAg_^ez0j1FtYpf
z?+sVMqa#K)QiIbrJRGE#<@M074xn6iOKuI!LAr2H(Z6$(-b%vkd3$>29LCz`k=Z&$
zL2}{ZB<#K638sqX+g5HjPOl-sfLW}n<e&U{YwR?<iv#dqhdr)?8hCcvGKb{_;H3U9
z9U$Fk1%P;CfBwaSRBTk~J>8J}V}7{u^V!-X8-A9F3a6_jlfMOM2Z2uz6=rjU!E(B+
z&V8AW`8fyxm)5E;F?REu07Vx83*7O>@&H|(M-oVulUUr_6M&|%qKc`>mmrwdif19&
z?zL{QV)9Pm)w(&iZ_O=R0yenr{?kz3gTUaaSm0<8ay1?+`F_3p<4H;9C+C;)Q9)HP
zDO<Ma@Ac%9%+Ql8a~Iy|zA96GVmi)WF!(T>kntNM{a_A^ob4e*LF;v1YaZc|Hd?b1
zZ4H?t&j`xA<s}tnXetoB!PRI}q`*-wbDR?t_<~G0Pgj=!BX4|ULbk(yphpLC1hRQe
zBfPsEPESLy+_ZB&?8u(lo&r_mec;S!8_w-xam0FgZ@#6exf8Fu)x2jLGd`CU3Ko~|
z_;SOWb4{Mn$tn?+2XA-Be)A(evfIXo2<#65b^3dW#UEI11rZOIRqaRb1e@S3P3?gB
zx`_(K^%G!StpL_cR9j(V{gvB;eacWjyqX{|8LK}P-R8x_ubGNUW(8P)>_ASDQ)H8k
zmYW$ja#F=^78+KpPk$5@2S1TWxe_G2B8z4*-kH5%Xet9<*YlMSsG%CNzuTMiSVF>C
zj+Q1ogX?$|c7%&^xy^OwxbwQWnHwI4hdV0!D>aFfXKwrzBf77b&SAQ6+YX)E9qZfh
zN!&WuOTxr9ZHtoan9ue1ABG%FD#_rP)=thF(%I=9PPOj^d$=8yBBAp5Pa}964H<jf
zf=&F3ZwJLG1<`aFbzNx7(7w=<W94lM#&Ed_AXk6{m=)T>u2Gt1?F>lw4W!m0c*#wI
zK5v1FiC1p7$?5llK^*7inB^}o_dJ;m^e<bCwAPKY1I<r8NtY1MI=e?#ziRBhL`qY4
zt>l$()LXZ-y4(}L?uzQ8f*C(|`WufY31?aSy40$klRaw<a%qChH=*Yiwl1E`30Rx@
zv@-16W+%HGJ0N(b1YZTR(sRJ1*SVP}M5mxTd=eE5OBtA%u`f><wKAvd>i))3G)}H+
z{4&m9OQ;u2-?5ejGm_Fn+aEKM>ViE*zY68!rDbm=er%cY_nU5+Utm<3ZQWBee*iQ0
z*NC~JL>De}b?3sw@}3#cX<kiF+l}vNx%yAA^3-sy($dfPqz%WW?)dXqz|B_96I(s1
zL-fOvo<{#fBhiL2Qw6X*Ln@uWB&62(0w+^*g9%WTz7)#aLe}xNuxIDbv*sA=HVzfm
zJ!A{!9#$+fXqE-`9a~2j-P?cgw3Aqp)RPpkeSIb;5|j4*nI(m-r>XW|vc`2^lWBi}
zo$4EbYS&4#rpUHV_6|8U4Eps9sBz-SpxGh(kddykicsL$wsJQ^uR<f1g`&JYExEj6
z>;dJ-KmqiLuw6~fWNOrtVnw6>3!qRC|I{G$AN-i&BXjtHE?5NkDS8u};dz9go>uJb
z#~abKGc%F41ikmT{tbTRD{Vy2bCzyK@hToUY`_*yPC@S|G-D~q^Vw0)1&B{e<O6-e
zYdQf^;Vrp)P8fs3J*&nvJmPyE`ZP@qfbf~pan)T6az^`ei4t+7qT{y37UA6R1QE&W
zP>xphXN<Z?pA0EEftNWLY}`2$9VPtulaNRzNfC&Th{aETLp+(()qe6&LL$1gKvE(H
zzG9rYUApxiwW1%w+Qi~pVC&t3(4Y<gWFir|FLx}R`1Okv^qqkk<<<5Vks$v${QTQe
zdD42?{1^3faeX>~G?pVNuV-vDpB5W0IaeiFqEM_o@2&Fp>cF<rYix?>yXgCyQ9=_a
zQ|52DiTD?ZOGJEO@0~!zYBN207n4(op6is~;3*xQX;oVsSZ$}wQ$9GLC%B6BYFy`*
z8&M!%Uok!8A0u`}_k>H}zYy(T^3DY10|~@GF`2rm?0TN7752;-pIJ!u=X0j!m@#8p
zG#)=4=!3_Ds;nARi0U<iX1&{>jtn~4s5!R8j}?vb&cNsXw3T(wRTTt|%aiIPuFKN`
zzT5;C)kSpr+wT}EsISH+CaqVEJ{iW_q{-+b!#B60+R6*X*6Bm}!VKn)RRR0k$01IT
z-(ckS=c*WmEy?JO=sw`H{89)+OrLzvJZO&Z6u_`^91XdipsDR%=Ec`uN6%$Tz1~tH
zl<N#1)vOhO*rWK7cpI=iHJ17}8&==8qQiS0WWlmh2AD55YKc}~9~j-rHa)_-z_mg2
zJT|a<imr$VaW=sJz2Dxj4Va<p6wY(>Y`iFyT^=(3N|jJ4XMg+q)>NJaMyko-0v{#_
zjOD>g9Y{k^Rp~&|qDAJq=XBrc6o(5U{Et%dSm&iPlbkarF<3coVOGH9Du8OFZq3)i
zliC7qOE>g`>C&bRz%1RX$$3i7=J@8c+yj23qZXp46vKzq-1^>|U7ve*CTK9vtaQvo
z1g}=COFJm!PitC^Jatyuk95fnQspG_tK1k^D-0^50ON^Y?-$7Xw;P~8tb2?0*sOTs
z(##c9qqDeeg$i0h0_<4R!aC$KpsMpvgEice;UU}hiMqWF2W$CaLGPx`h*R6V2dDh)
z-?cA&BXmXYH6Lom6P3J8FK~y5X6wDjq^-CsWRivku1L?LZN35fo9JEOYX^C&d2;h`
z>JxXu)TapAFZd{8N~3lHJr|iWewW{ppMzwt55d|T!mCLA*GmhzZS&(Zj(l#K%gQ)k
z2npV_b1xGP>z!H}f)pP+9IJq$(SQ<H>es0{!pD7%6p5X0^J@ESe-CieSZpwJ*4tUo
zB1Sqoz6ePgZPC_>h6Z`jru*y^<X8_<Ae#sE*K;;D)n{YjzBl8`|J0|`Y&dx!`46XA
z9TMx&P|r<oWZ5A#+!!7dlA|Pgr9Qy--GMiegUY%gX#>);hq){hDcO=sb|5+9O~SDO
zL_Vc%2DaAAURwHN>30ATvS8Wy%ZYmEkp<b`8T*gFnOybuTaWX6<UM|85>~LqQ%Gw>
zSDqi$i5`SRh)J}uM0@XHdFj$;L3Jv_u+3whs|gD!^l1&1BDc@+he1~vZ4#>7XTBuQ
z3{1v{pyk7P@}eF6RG=d9q57OmV$}12Qe@EAv=LZP@R}Kc5yr!V?M%(7+`f6}bR=vC
zJ{0m$!gzf5sd@waE8x)4dKa<B84$nA`Zaxa()zlpIle*9V<aF7ilsBu+!OI7ZSZ>v
z&JJpG056j9h)DhZI04V~G|+F%5ilpf96hW&I>jCGBdO^c(tP{!Q&ne=!?WqRi8?`F
zy~^F$Z<6prD;HWNuCDyxwAxu=Y+S&f8CGmf9t)bj*^z?ZdXREu`vM)KkhYAo1{*pC
za*K?330Hdv)q0QhK;chy11|C7MTu#?E;+gJ6kV>Q%sV}DL@GP4|0#OU^F^_F!z<k9
z?80HpOGt?vA_!4p)P)<&b#_4G7dCnWNEt6SoaLyW!EjSMGuK@uodQ)hpx5;^cwNmh
zvlDNmn$-c4S!<7Vf}VB6Yad<zRHzzM6<f3=2+uBdE19Kp)1)&97Ya3oHYDqBW>E!n
zv6Gn`ccoEz64>6~5j-t)Faza~(|s%!DKAqYa$b&fw|2eS&e8Xy1z(BCsuA-X64){s
z&<~-NAH!hXa&18RAxlO%dFpcj)(kyY!19*zf%^7K;bZzzx1R{-wA$HbR;4(<`efZ<
z&C#h2C?ey{)wu;>%G_7zVAa1d)3=L#y%OVDFqCuHi(w-rBBjcM51g3KH)20eXSu5W
z!MntL#m_^vM6ch(ciMhhFO8j^ewwNB8ECu|H4XlVxPxB6BzbUCoH&|ltYBo)Pb@Qc
zYv4v<M8;OlPiCs2-DW&TU%`JxJLoxjs2<}M3lHvd%c@EFww*zgA$f}$Frq<!%5`?-
z+0=~1N{sd_Va5icGO{^sQ>%bipWQ@+bT4Ef+&cAkhY8)c)e`{{uoWq>&>GIC+HRfo
z9qTmVv{FQ0tcaSG<LCiA@k>Z`+e>h25T~$ILKTV^ctUj9<U>jx={}IQsbqNqq7YIB
za+YN<-lZBj80%}PNY%}1a=X1GVKZZQ-v#)PNT#nosY`}0u3;D+-15WkjUH5|ZH{d1
z-`csA{=3k<5!FMt`?|4bnG{*?Br+>4{yr@Wr^hdV^x&@!7r5hFaeN*F)3r8KF|_)<
zKLgc{@W@0FbUOd2mo4Hl@xm|I+#dDC$V~KGI1$2eKz|}i2d04Po9%lMmHx|<B81mR
zbnEGBN|xTf;`$+AkfAYFpV7gWGDssWJ-O`;Kd(dVee8JnDPVtfjHG8YHVK9btLikc
zWl{(2EMdvjV)~8?A)h2piQEGW_SySRAM(q6CV&tixtT}eX}L*Sn~i%!aieVz<k(}o
z*XyIiz@(|@kdw`q%q75%RSe=MI?X~<F)=BK%H){N9y(?ria%&~yDrB|R9=mJVg!Fc
zG4*6Ipl38KzQAfz-rTL2?d@j7+l<2R<7cYS)j_>9X2xa)M`hcu2a|>4Bd4er?84HA
za~LCuIg16}!qqNZ<mE@83<@lq*SU?^R#`gVx$Q9t`(?0{)wxY<S>twT{yfT?{mIPk
zbO<pr<)6P>+IUcMl3z%)Hbh19vz4l+5>x6sWAZv~2zgQ`LaPc&kEbSS=ge9&<5FrC
zdnvWuA0@@FN=0sL$EO-f2hNDguO0VemshHhf}CU8uf`3V=y}q>J5)j1I!OqYlgM>F
zkz<mPoq`eya{W^S=96+2y)pnAz#+<9hBs#1q0wp{|MobY^v#>}!4$$>Wh<4U-OCe7
zw$$Y_Q{ZUY=Opo(Ck4HA&ADCt>RAdk^mkYu4J2F+qvZle@sPk23m(~y*FS^yZQRR)
z!ZiP-Y2Kp~qT1*FtDw?o3i!Pw(ukJO?nZRVw_8c^-mP1KtVW((VIyA{Zz#!VE#}?~
zsOmu@K%T?>tjCL#3F>sYwx__%m)EW<)O<DFoaD*Op2M4Ek}1$B{vl^8i1B$xMm&*^
zf^SgK!40%jXJ4(LX9(YcjCfxX4K+E0K_X{>4NiCgCKl~lm?H3soWVVO6R8=k0THSb
zsG>d=XG&bxLpE1Ru8Ox<XG=v+Xq}Ema`Fn~#~d1mU=gElQ;YS_(+bfXMM=q@tS8TW
z=lay?0CyR<eCpOiBel7y6F^9GO7W#opT?`Xh3XEh=qRt;X~>gO9yva;xp(5dn>7ep
z!2sptN%O3c`_OmJW8(iM%|&!_$7iSPpKcU%#BLn^4~aY-U5YB`+U^+J!u<x_niRrE
z82H|%bRZ-;^u7b^<2LM!^3s(_nAVaN)~Yiv80SO!U;)unXLZ`}Muj}*50&!jxu4KJ
zd{IZ%Ky~x119K=;DK+p6FTOX7w$lpb*=V(t0YwH6YARPT3WPtYvbs%)f?yAdDtl;D
z&|7+Mh0JZd*xnD8d@dL4Pj1nPCcBD)UrHWS;PTn7*-d~^uxE9wVg1?XF(A)GXvA2*
z$Z0vIhZC7GMUsQ8xE0*jPMdETuuGLXRWo`jyNc>1TY0+w)4l4hFo0ti=~m{&D-dc_
z^YlO}PeIh}PSIbYE-d7+msK}+V78^PlWXwCE8C!EHD3=M$W`V8py%vLj2xfmzB18T
z=cfJUB78Y_GrkqaZPpYaGd=o-h<@J;lnu%1Rre_~qh;?!B<npARBHzR;0@Mjdrpso
zMoQ_`CUA$grG`^1s`h&6y?u^uk_M#3UM%HmC$RHROy>Y*-1ptD*tigNy^A@m^Ec&p
z1KoFvOhADTN)+m1?~xAXj21e}*hqjC_MOdS<;)Ax%pjOfL3+N;c*+&t*!A;J?z9ar
zMOq)b2&6yH7bbIJ5j!nIf~lg4Kue!;(Gs`=i!6iQrVjd%c4d^H$9^z6?y*()wF>p)
zKlpvehBi^%zFiCQUDHzlv1hRh_P&mvUG+-5y`Ua99J^rYXifFs64Gt;3*0yCOir^V
zU#k>7pAa8D%s%-X`->^<ra>%ZOu&}HvU!S<y63Z1Bb*ilpT~)_Sb36l=J-qLmXL7T
zhvI8TMV?uMWW!P%aoq;WtRYxk&GE_3yezKQXC4_S3&^H>wJmW$#bdR8<D(6r2U|jy
z+dsL{<X@Uy^&DL|pVMXTrv|jbV_RB8V&Y5W=hLpaWD4y!mQ>*8bQMsf+r^!K3WI1G
zTas@?8=RuKEz^Ak2c8s$G%s;tM*{l!+)Y(^M^HFPap{2%sS|Owbssq0tvod;uss0_
zt$O(8FU0enUzsvE@lB_<DM3;du&_H}CH^5{lXL9F@>2?5J9X#TE9Hs`U9cNx1{?&f
z_(5`lIZ~x_gkRFz?0>i0q$35Muo2y|-%lhYG8bB2qcb=99&6qU%y!`2VlTu|)6Ci{
z0ombCYdldZUZh6@<}d2}4*^F<6ksYbU?e(yR7Si1XsTGWm|<{LA$ny>ZgK(#osI!c
zCh7*Q9HnrSfW46$**URGsoZ-lITTy}0)RvvSeNBAAvTqh-?t?)6<g>SZez9G=~~N*
zCMLIHHa^J%i{2<>*GnZmJ9F(ENyeM=z&EfR%im1Rad-gIByV1j1f-=6#1&Uqijk&B
z%yE@YV>|QAAs4q&Bq`I@o?+wSh);_pA|C%=(nUa2{!6!R&Faefv|xQE^%B=iE5gOA
zh%^!=Ycc;jV0yOA32y(%<FBH5w<P?6xRt#E!<g^ox#^Ncp*$*JW9MAokOZ{lGflm>
zF*ZbrM_R<?y7?w;?35294V*=Q#hsZz5H-=~xt*0k=fzfqFnRU*4VH@5?IIi*IQAa!
z&`3Z;<WJC)ghW;hu>1Z#Fz&lqT%rkZs@oQPP@2x@9?3*}r&m7|tJAJZ1#2;eBvAtO
zA<s=9S>?SPH!EI}r2TEA=lVe}p*eX;q2L_EwE4uEzB1d+nVD=TSo6e8BulhRa@8n$
z)?*c(N&PyqQ7Z1B_!n>YYI5gnq7H5MR!MvCR)|WPN`Ln|IE^of$iIcx?8$^jZEQ}5
z<^!pJbvn|vBndj}+@USASrdve7X4(vXBgIdFN%B3XWj+iBLH>t_o?K5Zk`@8yu_on
zcth-cKaO8eN)7;2mla{5o_(gaJX%`p`>ZX1vphx;<$fZ?2oTx%_JpF!2kVuVji{DF
zHBN9#ri<N8d65XGNnKStd0k+>y6#agT9X$j^$J7CwZ}ScxG?vG-m?8%u+OOAh^?vJ
z=_&jPI4{Xr-bdGVk$h(OC<yZ{GS-DcSo>4fpA?OB@G<CmlAEd;Rx@P-(&NMcX-yy&
z{&OS5-v=-z_!l4dbJ%B(9>At^3VIWlaRV&sawosBSe%uo$46>Mc(?uty6_wMQXm7e
z{DhiqT4wOlG@8gSHvDF6*6>%mRz7aY=Is8kL;#O%SrUZ<gL{po6{=NlFBaxGvz*%Z
zfj=Pqm#;SqSH<`mM^J*Hx`CaZat0{}vP5OoIzIS@MF)<S?MVJ^sE{N{<$9%=LVn)0
zviC}E(ijw6Xn*=95ttQWE%7C0yw*m+mqtQ#nOjAxhq-kMj*Vn<b7Ku;%N$ou5IXbF
z4#s-476DXOdWu*E^0q8QOGQBPs)MOrx&Zitc1v|~lsvG4Ca}m_!%oHIeG|sc;nM6*
zZIz~eM$gT)q0yH7URZBd?cW9WeQ+8llrN44GqjEntzZQSrbccEu4TByMt-|8vtz&H
zhT#lwj{W1WUTf+0S$@kJvcWQi9b>_J#CycXBHDjfBiHP<%O4S@Eba&N6kq;EFX%_Q
z{NlYN1b;8)dvaRBVKo*Tkb_r!7eV@TDqn&xAKZ*r3k0ZcxkC=3=35>fcML9zH$;{=
z@CGG{`OW=Hexy}_hfM-BfAY<s%h56?4O?3D%06}UUdU<9XsQCRqTNhW6QMEFXB7;%
zmx20DEI-omu$eJ4$t)?}Sf23IwD&4RLBI1OrEXD9lwyqvYR)e#g?C(D8a-HlUtcQd
z*@y(n2a(`rzPps$GO{6AdX{a4IK*e&-&jlAa6Xp=ZA~omF@Bb4_UEj;89j6X`xu`<
z^0noGNJ)z1vi$OaE}Y};UB5d$knaL~K|Y+<y*)C$$u)BgZQ4lPC|l(jMq<#uY10!$
zJlF4ynMSRMAr8=fb13&=s_I-5zxRd;dIl<m_QjePS_L%=ERy@K!;0un+LR*>;Dzzm
z;)d&5wz3yk2*)cyD10Al?>BIkAi{$#d$cYV6iO8mz~SpYscs$&f0p}@@?+ebP~Pk4
zGfenD?VbBKl<WWhM}yfVX73c0b1J)>lCzj0MQvr;?{+4_*dgZ}#vz9>Bh}P)n52>%
zh7MF>B1B>6faEYWIV2h9!C)9OhB@8ed$ix{v%YJ6|A6lgAHP_ZS=N2uuKT)P&*$^;
zx-R{`k`KNfsZ(_?6twjN<D`7XeueI{OQf*2FxGB+O$7RbM#$rL&I}X!ruH*MBm@5M
z-fbj&(qH6l{mvqk$seGumIm;3mKT69Si5Wcn(yueRxX&duMx32U=#t<`{_T-{CLn5
zkdo*7SAtX~X7NcuVY`9CDA$!6o4D`~0=TbtI4~}m6$K!-7C~E65IHes9L1?m4PlS|
zguNE(C%9Nuol)8$+7S|Y&Tom-SdS5A)NsO+uQ%0dD3}qNqGBYDlp@=MnWdb#G*d#O
zT#Ux=&_xFyI-<_<_aAv2ry1kV!H}g=^)oTb3aKQd0!ZtnsG34F1u>l?Un*0=0%J~O
zp7ZjU;4)~v@7mmWXyJg&Gn8PE-&7Re(|(!0X~a{4mYbeFPyD3%XA(9N11`zMAuk0v
zDgfQ{n5eY=?a)VXH2fR#A$13ovHuocrawWAUWW0qB$v<rs`VfIw`_rOz1fSu@aK(W
z`m|!r@*C6$t>4l#g~nE#>Q&WJUND$pWGX_E%hwhQp?}%=Euj<&R0?Lb7`;eaKbh&-
z%g|wkI<{Lofxba-D^tmgfoyKXL{!+xYYi0cPk{DDYSg7JU(?8kZ^jQiv61b{ONBSb
zr4Jrl6qLX_+pbjD`qk_?$*3N<X0&igEvVWBW9O0N;7I!Tr_6oHr6O)UgiGshGECCb
zN(yVX+&inoOr<2GYs3e7a(j#6(^P&5bumlst4u#NHfRaMW<-K42HW=M{hQ7|2HAp>
zQf8-slaA08fQk8O&s+HNE>cKEuIS&VafW}T0l#8u#%9C=h=F0Md)`E>XL^@NRlR6(
z7qe3GDATt8b$phP8at!=NtENn66)2}G9_vulUj$)I0H3(@+X0jff9I;g4MOzPfPYt
z*zM9Yu-8cu_P{E%F6WQz3OjI$EicZ4ZDuQusFzM3`ZauWB5g-q>VI0Bixd<Q<)Uj9
zO;JbtAeT>{D4}=-uBOQQKntTMxknWgtt0FicdniEuk3>M?~QW(B{UuoJgHLohj)}U
zk#)_EfItK`2DJT?*|gJU&>nuDU(vX~3_rJ_eHt^^KJYP5=-ekPZ+e9G5b=-gmC!xA
zL@eyvn!D?Ympy3yIq?&d%uG*w7Er*=M_K~~%2J!|R~h~$4rf9O=L)(jk<x-aO)L{}
zlIzWZ_c;v%{e75DQ@hih=8yD%A)Ms6xV@%TUH1Y3Th5R5!k_6|#g;(xS%bV>?ViU5
z(Gf)gGW`Yg2`bIVCcUPQ$|WgIFNTOIG0yj+CtuvK4byO8Rm{d^LU&r+@i!Q71W$g6
z8X2VHb;~b}(0E7j^i!~^pvN(?8doe+!Xi9U%a9lEDJ+(Z#4FFnFE4&Q>P?^+M2CJE
zgTJ<&oMyc$*42h<5K4^$)z+Nd-Y9z69piE-<%7-??_T5z;TaQ0f561eV!(Xi^td8*
zr7V0tNLO<1#m-+zJ1v7+KW*P)?3)96DPZ-{SiN8wqml9^Hq_m+qIeEDXZ8($4<0kT
zJsX@|fo$MJVjzb!GbepK`XFLp%%FDZ1Z&D%91hA8VFw+v@!3Ipf!O&~&43fNhk#ac
z)9mXX$GuMj=PT|5Rz||*$aDE0l&WUGw2=s!NkOv?P?~Aa6ALZ{!-i^v1`(SiVL$M5
zy3k8tA}SQLSX$+b)C~cT*ng&F;ZhPzH+S2A8Pv1dyyZX<H|tN$*H*USTcshuOve`w
zb7yaxC{XDl;HfG;1_Lii>aR2ZEO6R6Bj_uvTC9=F)KncAD3GnCX{7Q0u}v7*(9GM@
zefIGT8FUNYIadgXC5<3(fydFthzdgr^{ebiy}dW^7#G8>Y0FYljudkXEJUFE?m4QR
z=A4>+H+km7QfJRPYter@F)DLCcG_`YT98QB7FFI3!pjr|9}<KkiH~T)SH+=6>X)8F
zB37rUwA)0c1dfYiG5D??5U<7fdH5So$iY>*YF&;QbDJU0+2^BtQqqj__jZRol7qY0
zGV8a+a$8%78g1qrS(fs;!-7*NbB!;jejrtLI+3pQkJ_z^Y0sl0ra5;P_v@0iJ%-Ag
z7THcIg)-&ihlhQFNwF7UUd0^_bj^daIuG$d!+Ozci&BgDrgK21E?n_N%$C1l-yyc+
z5AcDWE|Qww0sY)Pwvy61wU_Vl_uu8>pWg=?shw8H$+dofM$Y?76+c}O-;T-wwN3@$
z{@hDkFXOR~)Pxi1urP4h#WXqY0sM|~&2LFnOijiFdHmKfNj(;0b(>>c==p;lBB7IK
zqb2>G8w-V)UgAaa-L#jEG{oy|IV9U;&(kzR?qO#Xq|Ksg@baq(>frO(<}5Tr<<Mo{
zw>h=Fr!SDsZ4QO~^=7CuDfMls<qZQX%cCEDsD({$G8h)T_<Pm<4h1pV+axKDFD9y^
zd2pppUhz|C#YwTFvbq{>Zl4S0&FnYka07lqmN#?gTQjR}Mxnh&4Ca=g>kz$e=Ytz4
z_ieff`ijQqv%~>|=YE|2=B)1r6r4W-?h|Bq6ZAWDnBioFPS})_w8oN7AqEAd4M-VK
z@xC-)b4FU;opKq*3lm1eIh3Xgx9}_0kq4NJxn&pDH!)+ELEM<6EmwOnow;1lWL*+f
zJ-tK0@5M=pOaa3F(`54HbeqAi)T-(Zv*<IX`HURg{4~ZU7UIFCW_}Z*lck$*+6<~5
z8n&(7oNpGsNl4pn8&%yAm7ST|M+k=7`Sm_cxp{%c4N+*!bcp}ns;PH5nfDMi7_1O4
z7?_X&0~c@zMc+>8k<)(HxQm&3r{p9!#=Pc&VD1rOv{xjzvT+A6&|=IPycj5Ar^6~C
zTL4WM^Vk%ItXyH;k7WJQzP{4N4O+UxU6`1kHsa5$BkbaFi625vX*aMCdB8~;EWX^!
zk$moP<)<~^dAPAt2|%>cn^%!AL{G9Miw!K+qbK9|qNUNqUsy!k)}1dVFooua1gmEU
z@jIZl{>>UFP+5N6>GkRh4f+*E;i1}&mTk7+o|!B|PAAG*4Q!%iLIY^qEFrX{?VCNV
zTM3)Rn+A)n64TElK}*88H|Z4|1SAZNq|s!)vKqmC6g!F&qu<=yJkX1Abbf)EY^f|K
zuZiQjCWS<%*ji<QDj*vFZpx=9PQ)_Fm2Rid-`9=ilPn}Fe9&-6w+i5j3+o*Wh8%DF
zwZhQMUW*TT9wj;8vNvL(t~N?CwO)Jo^WiJ77CX=o>t@)f+B)9TlMav<NYDydZf-PP
zV^$lbZ!AwF3O~9r$y36-8_2}|A*5M~$!n_h@ZcDT5i_ZhUSD<l$GY(5@u58cC%s&v
z7Jsr~%3_qlWC;5~rWMzgj-O8mf9N9|zc<g0OaqTtfSq93KOS}53E%3oc!!;4Y8wF!
z7)v$Cu`jCLS1upi=Gx?NSVeLR-}ax>9!F<lB}CBY%`@&Y(Zz^AS!R_|K<jTg@iR3!
zD2uMr1mU&x%Jc*IC|gjYp5)eS1CBgIlGm|e3I)dhXH7DeEPXZT1*UJl0~z~%>jter
zW>Uvm&N5PpdGi0m@5o2e^A|fuMD3s+$uY$?Avlu$euYSxba-VHDrLdr4~f(d1J{m3
z4yqg5H*%p*YdK;@6leJILV3T}OZt>;K=stqf?3R=^v4x=fhQrM!%Zk~zPp@L*-mVg
zRDn{d|Eq15`Q8!FVQ@NYHi~YeKNYU_x6D7xy<?L)b@1#~Oryz_&A(b%J_v0Lidoyz
z@3RYaKyd>uHAOLU0jBQm0fcO@D#FjZxv#AfN%+W#O9MP_k2rJ9)kXC*<<untG}9|@
zu<B^*l6J^kbIL5{zQrgg^g~P~ES>ED-PT1^y4EA=5aspZ`?O5Y57L`o0?&T{KMjpH
zLXqAY>`ed><c6t9J;y=4nw{U_3D#ho@DRD~8w~*e{>D<!Sy%eOhjTOuf^Wn5_-SK1
z{9I-D+qm+&(y_LrvSQspV)vJ|G{unXy(I~KT1z+b*Qiyq7Jb1D6+wZEGtkvGjD}@&
zs7!6|1?Jp4jC{kL<`EfrR+qI;peMpANzG@P_rYExl|Jy$F6@b(R(x|)l;FWt`D5>>
zR<@ewHITMOkk=OT^p5^oe$m{QNA%LAKXZTw1TCBnG5K-L!Y?$!Y)_NzoY5LsYm3+R
zNILT+nCe;2Pyd$NuNF4qN~cX^de-Q=V>`wYQtnH|NBv#am3SRPX^{|Rz|WijLV5;4
z(g$gW`sm=PH&@&={+iNpS~EAFN_Y3ozph|a`Ef0KndxJTzxS{c)mO)g4-&s=(kBTc
z!wD#IylWWhY`Da@7wknhij~Ek*J{oge~J^c=q8{01bQ}D%qk55THXq@1d8t8`jXHX
zhkGXOf#u`N7Xs^VB<PL|4S8Nj9$$t$ffY1=ZhM8}6|>OZie^^P;?#$__UMu?AA)!!
z0|9UJEk!cAk8)8rBY~@-Yj{eySP$`UsVT(^HbnIz8#-WZu!E2~#GF3VOS9bf3JNJH
zW%j-`xg2TY{r(@91GP8sq+=ja*LwYzrHIS}#5xF5*(yokjz8USUBSmQUA1y-OL|xz
zhIFh?`k`Zem=!JlFDt(qHH&4{5n|BhNYF7N{P&N6?ER4{z%?ZOI>?$ySeh-GZ{_O9
zAVESF$9WjPmpfq8nszpFW2=QQoOEo35tQ*;*8Ctom*m-fbi4wY1YMadbJq7sMI7uv
zYhuqe@hn$qvm*30H<~vOj&hG+;ne1l?LlRO6iHU(^AQ3rnmKZBircsl?(8s-H|ZoB
zRIL*BScmzD5D=lEW?QkQH^ixYCr6cBB(^;Gu=kYsJEn&^9=BnX6zK!a<M2=n)Q2oO
zGKu|B_@rSE(C&a%#R&$3rgsY4Tlf-74raV0Ken>P?md2tydFT6vg`lLrTks^^*@g$
zFoyE^aBrze%oIN)XE&kiEru+MnBp?IVwp-4*H*osp#5lBspPF@^ZfuV$bi~6g=t6F
zH1=~GIdJ+PHev%lSrVvfM^Mq~V{jklBOX13R%lvDAbz0r1q={NNY^qgZa;S22&cgf
zN5r~mID2p#7jB4Fy`hZ!ivk~?IvFilNfC6|s=RuqL3n;1zqkmtT|EMN!xlZ+LY!)J
z!?d@g$}eo+`MOF515^_@V*)e=Sg9#)XyT&u72OGlA|pNpKh0Sx#!t7S3(aD(;yl}R
zP+Fb|j%bT9d_NO2?%25nXhPg@0S8K~C#phc40<vF90_EpgE0V7;jY46!re=dp+nig
zZori2?`?%Vdq`>kRw5xEk^L2lzGH*OCDsL|($!TDK)hJ96e_cBe&Ubahlk$=_PqiN
zE1av^>N9Sm7a-`>Oe|x<tAkY;5Z|ptxDV`y&E9E<83d6qT}QNxo}*vfcc6V<HoQ6S
zovM}P*;MF)YV)@6i8~Dmwer8j&xa^edtW7aU<_{aMt@V#y6p=R)hDTg&thrWB&FIK
z6y}Y9BH9DQTrLYq%c$45#9Bkw&YJ9Xc=P_#aSh<KK{_cc<6)1<x>u98V%sm5cw&Xz
zl=Bt$t}&+%w@1jXW=@H6&yR{;lrOi(+y!Ya6j)9m=U@ckhD+Uyd}>2~FE%w^=TgOP
z;9mC-C}s`vwQ6HD>wBbNNu}``Z27u5Q@zZ}Y;`cMqO!Ey64)7X2JeW{SbRpzUt!(H
z^dLC{kgwQKnmRmjpK1{>e2#?yoranqaV4kHQ7d9|<EyLq`X%rY+^QWO+R`}ecPA#v
zTze6Wp5WUPA!hSm$>EELEIDWICSM1X*BmEe|5uRIq)2M67OsS`&X(bEGi0}&v5-I)
z$>@AHmG9|4j!!_e+AOh`4Wvyr<}HOXe(U&SDMe0Fg$Q<SiQi;U09fPWGR{b=M|0x~
z;m0NBAGDe5!DWlJw!upiqHnwtKS}QXYSg7BO`|nEzD{U0u+Nf;j~+2`4wl?FxeQ<Q
z0PJClqGDs}6wvXvDuRIbO9zIizA4^}a*w!^<$ryrz0zoSIv;f;V)GWusjeMnsV!EI
zOjLNyy_7ncBNg%m#3GH*5aQjY+S{NTD=vecbpP(OGpxBxGAg9;DB@seoX46AA5NJK
ztHIB;AyI!P6e93}>l7?wWqutNo)V2d0w-@#K$zrXzLfP@XEzwaP*!}42r{6*!WEl>
z>j0<<#yRf2SdIi)ek0WoIN&^S<3@Nj(1K0w$NnXLET$|}wx6+!pB`nbYQqo=yhdJC
zr(sb0hH07hvxh)BZvHY0pGjv#`Mmh9INV@);#b*JC#t-IO^fzDuHti<2WOPL*m5>S
z6`aADp#?Zj^A~WFK6De}#A5I(0VVk}T4@Kjx-=6f4pH;+>F)Oq%kmwHnTt^$EZT-{
zOBN|-X=?cfP`gPx<Ib0cuFp`G<*@#%EdM5;vi3T9g}hHkdv6S?k}M9eAs3)(_PBn-
zzXUFTGxNC~jTJfmjeMjybg3bxr<yDxUzc`Fname=uP^;WT6U=5PqxP;@r#q>sno*A
z>KJ^gF^S2tu_P9e(z(|v5If6zFxLKHZo>P+pNrBuMN}y|gVw-(?$@mPF0b<Et1btV
zxs!)EtzpG2mXK=MC-R?@Yv@Outdp_tDA-YjX(+8OUsiAjk&{Jfc)fzVKAoc6Hj7E-
zk)Gq`ebEsH?Uw-8zCD0oKpBX^z6%$riEFUC!2xQs96sOh1T1bTl!7^A9s{ggR;;s^
zDN=dUjnTa+3h(%w4MGyTC{nlm<w6=5VkY^7O@Q-rKFBgRFpx=TpZV}uv8m}j)pqFA
zw?e%s)h~BaGSic|Em>ufb8*#do98^_gpBy%xiDHkrK(+@2p;e|aB4WwA@;j{+xID-
z3-=%q*#tu?Zo)hH4X<q$#g+bn=1<zu9<0oj+oi^g<9~`<9<uK><Ls-s_0^^2PCF+@
z9H7q>#}0unF68wo@k91@u!BieQt)D!I{v*KfBGC2;Et1jk3J>>FLuFy9Y1!*13h3a
zyJxP@8ZQ{m1sjtdyR5<0u{-+UH$@NIQa}&_EYUUpCAQYlzHm-3c5k<Q1*J~_Pu#^v
z*@eAiW2U!Lu2r13?m=dit*KV6?vi+$OR$;;2Y(HJly#x;W-{(BCrC!j_wN6o!nH=_
zh6VBC9PTyC@SN%+FK_N@z6_=HR@Tkl!yQ{}k<lZxJhxqKe~N*YV^%X2<Ml`@U;B-4
zkshJTk0WYQHbb-$T_ik~A78>FA<THZ`a*o`r^lX-<J1q$tG~g=W?mi#>(4XHi&I*r
zj~&69B6$c6c4H+Pm_&j%D@9}3)fNK|?pk1G0_*|&&805IdS4N*QCqs0a>WPP44l!6
zgHt?M-;Fh>RTAT99ADCVM0FX(;dVVoP6SK-QBoy@i*-{CdVT{Txhxb_(B_1bEEdmO
z9;g#`jk-F^(~2A{isV0z(6*RCokM7(;p5?5?fn%vt)k>-VG(SMoj@hJ3<yR6wBPMR
z@>DbkZq}ju!C<7dq<aYYTHvfgD>O6{(P3Xd-;G*VTRihyp!B}+Kiul)WdrQqWh8dr
zShlE)Tribgdny|Y1uq~V6+8NGE$^0^E?^>t(UpFK3C|BxYp29zeZW-x+?Tb}A;Gq(
z^{(Qgt?uM)W&NI~-c*|dpH->|QM7tOFugL`l^N;QXLoowIb=t3itOc9xvxb#tWury
ze=jYRxdOkq;ep}|H=gjNm!27Whq&NkT9w&y?<sLJ1QQ>+4^<`+rT97?a*;HWgF_Y=
z!oZTgAtWx0#Sq3NRd>8c{>Jh-p$s$?f?X&L+Dh(tJCy~sifvCSRQb2|JI;Y}600L*
zZ-p_hV_V~8f2`dW6Q6MJ`2#bR5yO5!Zj@DjTFBGZ-+!_?^!j%RJ_U77o~Cm~3;QZc
z^N~mPFyYJKx?#1=jn!JSp_e!25f$dp1J=?3rr>YhTl?E}twDS0dueC7%Ez9g{PXbx
zk@LZMD%SpApGvY?G|lYQR*HjAo&YxYS(>q6)tiHfseHp|?h2z?=Ub1pHpY8EC*M^b
z&1l}I;H@Q#^9zb!<=m#!KAur<2isKxGd>L=ZHokym78Rtvr5s?+74E~8&FMK`HF7@
zN}4!V%fTo-7v@R8h6YJKeG;)M$BbD4aqDs#xSoqO{K-s8L5UNI4+28F8Jfyt_9sGf
z^*<s#evOqTSeTDU;rR%|d#COFDMf6dW%UI4NO4=s*&W%SzN~jVVH+2Um8joa&Z(oI
z@z@2MoUq(+wQ~GwM=&(L&|I}zFq9**%=+`1+qoLA9^^qn6$lH6{~>LHjgc&qwUdn3
zc7sAm-LF|DURLvo%#}8W5yxV<HZ()Q^UWD_Vn!pU*f3CZMYc#|QX|JUnj2C^-2*JD
zYgt@LFs5<gKRzWE%N6N5D-5&(+@W-LoC+ucP-JtlF*YDb;>bUEHy3}pvr1Be(-We|
zs?tT{zGYniSoB0yO1U(5_%<md`v=%l18y0}dXvi5tS)>U58OMSEo}f?9rhRYawHB)
zqq(DqmW~6|D=33>q7Zh_960r=kJBu3seM1mP{yOzM6%f1QaYZZq!dWuD=jiogAW+0
z$mZJbIHje1H6)@!KqwOKNN{xaO1-F{VOKQF{_>7!(f<ySya=9c`$k=NMP1Fzcp7^s
zqq-G&&~sQ<lp#t44*eQh#7+Qcyby)38OgX5bd`oIrt_b^;Y*j_Vc#tqGf@ovD9J%n
z=}pYmhjV(G0#?qL%!6GWrC4*e7B2Qhz%Noq6fJG;05SZT{DC|^C0?9y>3rK=?7;m|
zC!ui^Az^HwA7%?cHEQ?6<D0SMyOEG-nUxlngc3dt+d2z@Pur{Hn_3uMcGuedz?>l8
zgfR1arerY!ZT}8K<1>ZL_fE`$J3jcywY{3aScl%Ug3`c)9>B9jK*NG`$25ht=?}1N
zhXuZF_036;0cwHXPwAnNbCg3;xi*2ZD?N{&*wvFiJ_o8)sQ>|!!gwGs?{AsqKaQ=>
zDgpk(RHXvGaZh!8_i1c#21kow;ttG)g1yTvnnfr<Z+E*b4L_wOPSNZcqNbQd$Y&q9
zqi}%Me(d2<w<0(ukrUK-Q%-L$$i<!3Qdd6yMo@EAufoU>qG31h&=0GNs_sP|bgjNt
zvG-K(=Kv6_>6V*v_JaQmex;p#GXb(fU$9w}ucHYG<B)<bN=HquC^3OO0@hi2L#Cb9
z%V4wzXKuiP7a!7p>?hjK$4I*3Cw5FGSHD_nQz0bd!U<D_X#OG5K4Lm9u<v{`+(!GG
z^*~GWj!PcdX3)9RlJLc#`e)v(%u|z(_Mx=YU-XhzK#zX!X0v%4>t`q1QoJSuukJ6y
ze9sV#$1UKENN{mTHdsOBDuGcoqd>QIdF?OedY{w^xkd;iHNJQUI;Sh{<5{3>dIcQv
zQIbo;-QU-eZ!N!~=4S=ytrOz9YcL^1xI2-VL=6R{ploqUfXgs&8n8OM96t5b_hC)9
ze8JkMp{sjwO@Ir!_Qt|zfirk2mtfTbINVxUS2%<ZWJ<F7FFL{zBdto?v~S9PZx$Tb
zY^yBOu)!>*IE^mwseJe77Klgsz^!q<@S>}kVESlK{^oK$UNG<<vKuf08UOX>Rk(dz
z{_Jwz-o={Z`r4%Ym9NgNN4H8F<uDkyJ08c3pcehhP6l~Ri00Rha7cyV+PaS6N{7rW
z`+htySHA&l{VEVR&Kf6r<L|qjLZWNSB&|K|y#h3j9kaO!`0|#b%0vh{u3LWDlq7Mf
zMIVMK94>;N8TtEHKXCGKJ%{m`6xxqQevUi%r0k@y7V)*DYQK_xnRvef{K-o3XT7Nr
z7YR;tAgV!8Bkff+%}afWDiUQ_FKyAgxL%(BD=2^RXEhecU6?;4$G4U=e912aev#cR
z1!_PZ{aY5lCx{#oUc@VSITjCe3gc$suv*EfWxEKY?ijvFpT1Rd!d3QK&wY8%wpo3>
zp4!1HvF(J7BRZxd2Ty6K?A9tIn%f!)!M0wWH;|?dzp2oq_8Q(xWSrF{H*MTyHu(%G
zUdCwORBayJIF`p_Z(pK#iA^txKj29(mktbrmr4%FwALx)y{Z?3{5&J>r*-xn)jOdj
zRzD6VP4uL7!)%JMT+F^L?lfaw*;@$an5FeRCmzgS$_9yodyqd)cOk#Il=D;io2r%t
z@aTz^Xuv;XQ!mvlR9@-UFJG^|y*WpZvWJdbtl$(oDo=p@6z=gIU)=JzOdD{ot@h^`
zcTBEc?0lb*8||+Q1bHj#69&H4b^2Z~U{<wmeQh%~dkkF*vi}713|1qo%fDu$mqujF
zBmHw?ZH4ACZhdC$6xgp+ky&T+<xY9>O}UXX0#E02Sog5QXlG9_qH;sFZ&=)qt9V#m
z|J<UuOt&I4+P_T8Pv+7cME~bLPq#c;?{8@5*HyjnDoDd0WL98^QQ67q+3RJxUf*V6
z?hx<CJu%hhIlX(MW8U{>RfK{CFNE@iX)}2LQ?T;?Uf%ycz5f||it6Wo8*vaE2#bFr
zQkAO^G>a*lGa4SG>YtmLJ%3uQ<I8MX?bzZN{-39nx=!GfjZRls-UCWL!rARP&#9UU
zeHkV?i1%_&5?w!x>ag?wW67ely+6A{b<F>H^J6e4mYAsCGw$99Zf>mgXS-w^arj*1
z`FBZ?sK^Cv&_9^TsJ<l!wg>15;n<Y5v3#FoKR{;_-DVe}V&A#3JG_41ks%$6Z}^h>
z^PV1O-LP_=2`h{_YNuRZ2KMq=mN@746Rhj2b?m_{6vr4~a(DwVNY=A6#=)iR)!dN^
zqWz?!bIC<{*My1cry79-?kaofiAnD7^lP_PQN)N0l(aqfr<EqCn69@WId?M>f_DQE
zg}Z_KQ&+)Hexwdrt`n$~2t=Kew3F+CYv*!CJRT7~ZAy-k)ZHq{_j_=HWhe|^VL&T^
zzWPf8V;9|s^NJTat)i~q-m_ZgoKCXXmuXcu=v$DH;Qc;m8Rt6%%EZiGxmIEnCQ^Q?
zbOTRbU%2NK?SJS?6<K+tj?==&|Jt2dqBJj)HNAlM4MmWymtZemoWfgIDG>YJx_J;X
z>jAoZllNP%Zr=msPaT&!C&a^&NlB|fZc6NG*9lY=!}^?xTxBCD`_K5F(9Y$0#z2ph
zYCaiR>_xY!#1oQv;M5_YU&Dp{o~EHKN!)xL{jcTP)=0Ob#||C%t|b5qxcIT$!=AR`
z>BTtTC(kQ8LD4|8z6rYbFsY)bro0Xqd>!zmXU+7(N7Jiy>)h(g50|Wn>36Uj5$N@Q
zS}JH+H;vt|jOn6*;`+l!yQ_6|4D~r-I4&81_L#|}axUxrzc=0gzc*d_|Mw@D(FQ=P
Ypl$Vw{iu6A1pGRF)b&WkVV}$Y2X#Zw6#xJL

literal 0
HcmV?d00001

diff --git a/docs/img/database-access/guides/redis/redisinsight-startup.png b/docs/img/database-access/guides/redis/redisinsight-startup.png
new file mode 100644
index 0000000000000000000000000000000000000000..3102842af9d8e7d9d9dfeae8f133d9914a08e8d6
GIT binary patch
literal 453447
zcmdSBXIN8Pw>AudfPz#N5Fu0nK|oMyAQWjLM8SrXAVow#dI>EQ6_74ngy;rAM5+|2
z0Z|A=ij>ehgkBOtLP&YT-p_OPe$M-y>%4zIuPbD^)|zY0Ip!GmxW_#w#NIYDJahWO
zX*xQ(GsZ?Y%<1S(zM!LH=w)G|ox$ujL+R+~4P5l}ZX4_A3E%eic;e#bL`Nr;;$UaT
zZ7eH=eEitX4*5$)`m}d|c}z^axgD&d^@nhWFxwBd*sh-^6Y1%-v?bUSE}RQ#>}X~A
zLw+N&m%AKv$@@FG_13nAM`12u;oCV2&C_!?jjxz7{f33BUa5co=|x1u)sx8ka`Mu2
zl^Wr0DWdQ5!#CB0{ncMI)BiAwtVjwUdBLd0Fs>5r7O@n6<2`@8e7IY#xcHv0xbm<q
z=bV=pZto7ub;aw|o+5MBzjchC>7R=6@00%|+kLBF>W(MlEA!8h&bC!~iIFK0DO?N;
zQoSOdLClfuZ|-ce>B_>m7@~eYU}9Q1#Zp<2&Biuq#m^`HT;#{y^9l;PbqWe@8j$3N
zX)FPBiz*ol*Br!HaynxpB5*TQDtv^GZ%k52ft0&TrS9lcsZ<-bYgBfI_6Q)I`R?QQ
zCsR%j(hPgw>7nrxQ&YOjv||=J`e+wAM%ocQ?Q?<lq1pe<D>`P{H#hBb<Nb+$Up@Ka
zJ;T3`8G4Uz)UnVrHl}@BICwibJ@<L);mbFBl9To*l*`?Rz7I`rsXKVM%RP4Vuy>LR
zboV@NLI(^~ryaUG`92m7ba#91qaLU!`sW?$wBzH`@}k0j-s0=3Df-a#wy>Uux0A54
zoPwN!sMcv=VPT-R;}doB8wUSsPWzvx=u=-`Pjz|ufPetG03|sOZ)f?dYHDio3X1ZI
zidSfNT=9WE_kA3A<++d8Uk~~Bb8a~KIC#5w`nq^L7e0ROV|x!jUrkZb;}`wczrXtF
z6zKBzo1XjpYgn`a${$~mzbdC7|6k9hH3c4@Rln^L=;UU3!^NFu9@;y!)KnCKf8PIp
zUHSWs|7iK}@0M4uUHy-y|G4zuo8I$r^49Zkr@hlx>+h-g*L(kY@m~#r^2bB}hbjKD
z^PgvFhSoX_l>e_u(>h&7e{PSCPMgm7hR)qU`pss`WOu83_<BX`QvI3CU>8QYQeoRN
zmYB$~I+4haWA6>5!uH0`p1X5rUQa&_cf0%^_#PJ=XU<{3=fsDzyl>1Y@;WAj`~2&t
z@59H!MS0y)?!WD6p7Jrvb9+WwnL;$9ZR?MwG$yb1S*oEg`dss&pf(SX>8=4b=Ay|g
z;wNIY|9|<_nk`b{^CVBcWpQiu`yFdLqlW9qc1iH*uJVsW9-$Xy-i04U!-R*r=kwD=
z;1nL}MVK1Zo6KMO^-J8BoU-(#qa*9avdhjF7G5U1EPIm$AD`BqOFsf{gX*bEl+@#c
z?XR1xOVi+GW>=%Fme22sb&=KH_0&X#lVZEwWEK4E6wHVEi;O2wST7lyhz?NSHx&>+
z^6+w4DBG}0n5nAECWZ9WvGtqS__8mGE}JKvt-2*REQcA>uB*`(GB3|C2%EPueEVNr
z>%ytv;d{*~%|p$Kc*p<}YnX>H@Dc5YLn(dzfWt!>5Nz~%ijr;^MXvM3e0_1oWvvb&
zpoJ4jWKq61dngg4a4EMa5B)USIb{8tl#)T}33>+jgL7=m@eKKzgz!@#feXWO-oqLL
zDT`G?Ey`jV;v0hDrR<0MpzmA*Kg9RS^*({Zyh#Zww=^=nDa*w6K)Z|8!*I}6mRD&?
zbY7D+?DFeSk~g^v*QpeTeRT~rYYh`*_FK+s3afT_)#OmD2|yoefM81$4Jd{7<B`%t
zjW`}Y1@oqM^@F}JT)}}5`zW@Jc^@0Kbq0S+de5j`1B(@Vx-9hEDKEmV_A^aCOtK5M
zyS>rCDH+FXD%8So8;;BdQ-#wA8hNeX_fi%;t`+@wd6v8U9ju<RM6^QR*an@8o`Q9v
zegR?e2g5*Wf<p?rzu`$>-upCkIq^`uAHKNp=}5-m$KD%sKM=NZn96_ktqhcM;W51&
z?dMi8?>y-z`H$QJ>&(2dUO5@4(i&VPb@<nmz?RNKXgB-)!1dPD+4b53q*bC@isVnG
zf-9KPGaGXssa$=r)Tg})%HQ}PTVq~Lmd<KFyh-%BxBC!W?1@SKY_VK4iy2^LQE+S6
z)Yoi*vdXO~7c>vFr&oIEJ?)BW3^?usUt15(`C8wxQ6*9E!R$<21TNo3V*>Z0X&Jdf
zWM$E*r^b7FhEzKk#na44R_O;oDW33bUy6OH=a%P{;*uT-!kU5CVB_x@?dRO&XOag6
z6sS^jJxRIbXB1Fz*n-(o9*{>NN>j*NSG_}Zg&zH&hMf}>@;r}|mt(+HijyCxa#PjI
zoD*mPl3%GShlbeH{rFx}Ws0h&tPpzkm`{8ep^eE)b^^+*oaRHh7Y{@$Jb&~Cegxa5
z_GSX9@mjMAU~7vkKs_}QNq9TCt#3b4NNY>%;q!t^GkiJ}0sZ9!md~kv?oR4glP3I7
zRf>IIpRA{UA?dHo{;>ygKM1wSs>+#o>Ec=bfsK)JD=KG4JKT`p`+Z=3(_u|5lUw?|
z8FhC>K9<ee2KV>8)G@T~D-&28A)w;rBNusTMu0{EVb|q3c}$D2RKM#?O);V72lIHw
zPwREtWfG!pNOZ)dEy|-IWguG5XwmJF2f~oj(fvV+-Piz4Lo_-mNUOIWa(Ji&f;k@t
zR1q)C{+AQr)svsIF+X*>Yp((cWz$O^lqvI+4m4otk=0Tuib?BHy_7BR4+h@YrpHs9
z9*V^w(3!yJZ&luenZIg+GBFH3$PDVXp3C1tp4T;_u1h&&2bDRI#Nq_qlD%svHKuPV
zGG_K~2%Ya)xRd^Zr#~^Efqi(y>wp6PcQ3(xxBrHK74%L6do}!u5+!*rGwwXh8x-K-
z4CFCd>E(cKi<S3Q<6v)_8Vcs}O)Dc|+iRjHUo;noubbwR!;-N~!D18D&0M?9#w(`H
zDM*cny<&?spJBN3d*xp!gO#DfDfl|E>XKhpfK5@u*KDD`*%gzOm&KSrQeX2wto{~}
zM5xWGgKi9-d?2+4=)Bqq5#&{)u1_Ix&ei9Y6urs6aHwWgJbbWT0zV6c1-3lvw|1Wi
z8XW|}B6RaWSW+%}#~<*kAK+($JO;F=nmu4B#s0bC0|`v^U|bNUr-M42U;cFk<Tq;Q
zPq1WzC;MmYl|QfXG=t^g!z)zS6}lSVTRivR+wB%xUgrT4O<oHg%@B9@JT073<|D!C
zU16@BLCow<>!>wY3S|RiovA$Od_<3MuOlnxj!^eGg2Yb9>}}7&3g#pz!dKrKF8PoW
zIufvb*U+<1e>uMkXD#-*Ql<CCu=}JMpsT&-keOTTVi%eukidh^m3HV*GE77aexuKv
zqGoG~ar2nVNul6e=k4BXc<`TZ4~;i3L*zpj8eF@xx^Q)gDaXk7*j9l(i?^Q2#BwI~
zlr(SJ(GCl%LcP?HysH*s?&GhH^{0(Tk-<+YUWxY~^*2Lslno1N!B~L&A5BOSYo&;b
z!<+5ft6!AZlfOPUoCVG4g?FBWGDrotPY9UVHv4;KJpfqkUbGH*9O*YB>p7UG9CdHv
z4^5|u1L+br^%a+|j2>LnvC$`!9r{N}h<(V8(?b8#PydPpT=+Fta{qDCnSyQPrJ$2u
zGq~#JA=W3lvXI!Fr(xgj2d)%$gyeyaofMq}gzfUH_d|vjIiQqYY*Fw{+O3qz)k9Vn
zG{;zt^Em|@e`=f1i|xy3&<<RALb1t52Yp?*H^I$A)Tv9o8>#wuX-M)ppHoyVCi!03
zNP0QYX}!|H#xa`0cWbONPkn2>WCsvD+?FX@SG*;9y*$zB$k5V;JY>63Y|(Mo>dy7y
zkyn@l2yFe~Xqc-KIcYnS5aXQl+Gzp4Se_dY&)R9+hfvS7_IRh1kqfD(#IM{gL)23a
z(9s*lIqI3-RQ_MN{(|TA%(3=Q)KKs}tQ=v9sB}S|2GuiH{VzKAY9hUJ)H{rRp$Rgc
zXZAQ}&kxZ6aZglBjdJ<Y752W5$0?_JLvHcA*Bdxuy{Vq%hy#E6Z5`$7B~cA`ibMNR
zd1*^xVDja!pJ09?uH+ODFC!iLC0%!{Q4Zq;VUeD~-QoF;y%@FOnH#>+V$3dazAADj
z8gIK=Km%7T{r8f~J-Wwudh}@nhG{g!z?}90>kedE?yDk@!6YBjGO5Hh(=`s;SyO65
zP3xkC96W}{HLMH~pJz?uA?0Z4m5wji2iu5x>Ix-?=3g(IS@9hB5n5i<g1x?zhrp12
zHif^FJf1xKJqqcnG^IoR)GYZY5c`T$fR)6?s+-HNWME~h9D>tBLT}Hmr`EaI@^3#7
zfE7@BW7%_=s|3SEZ(kXkIotN}*OVvS)@<PZw}JVE4l(qLST_;(8WmkCai}(Iu03i$
zNq&DgcLk#9E3!0lC7#~HoXU$!O4<h<QY0yfRc~o|<uG#tY!jW!UpD`x&aV9}y*z66
z_0J}<{IN4)NhxTK4m#J9ndluL>?Gfr<wKc%2$a%|<=qHRL-%*>!GSRJVGg#vx*xEc
zt<e)kv75P~P6ZAHCW_#EM3wiGOr7TW`z?}!Vj7G$V8y@^09km=vO0=EOy#U6<CzNa
zh+13Aw!&MWO;#1-NJC96VT^UMR){&@Eb#%88fL5w<UfElcm_{neMWWwhpr=CgEL^E
zpQ0ck3+?K^TVReA;Lkv(qa=1-$D6sVW#l6EP@~W-OB$Jz(VA;LX%Gub1a(AUe;)FD
zQAEEBC_HAKG)UNPuBTSqj6Vp(lmW^l>#3tP*N^jgH`X~1WC@_*BOHXmJ_w`q_RsQy
zD6RF0*KNE*@g$S+qp1$mlV7lPVc#0fEi4{LU4LA(0|8WXJll}Yk7`jiIwWxb1ec6U
zlQ!4hXy=xp)=lXih0mS3Hm5z@BRN}}T}6K`;x70o@>lfpK*sQsd1nQ<amdF*^ajn|
zW9vsA4BdBZ)(2h4`5qeQ_mVh#g~|D#E@}Y<Po9)N0-qi)fArbCkh%ui>)(6etWS$G
z-sADmkYka?0uZ>~AKBk)6#D^-Xao?J(7}SHq5tSt{XB#ujM9CK^kOtti00tjy_Et7
zm35#wwy}TgsdPl6Jy5LpyM261mCmQj6A*Wvgczq;QFl?-DHW`Pwj}M^5#?1#Si1U8
zxVtCz?DY8uk)m_q1Kf1xh60mk)%>gkx84_-IYu|Eeu}=86F?_Ai>WjgTr&L)@-BtB
zzxgAo>_%|1hkG4#y<Yfm-PJXZ>O$^(LOhP9gp~}R^m-kwzZij{fPoK<slGO(jYT#U
zoy5hy{c-D1z8{j$Vf*D{8KC!%W9B%d)*gt&qMpKk(dG+*#TtfDXlZPdE#Get+x`Vx
zSE;x^Wnm2-DeA*ALyau4eIVcJShfNfVc2KIqEM6S@^uFwxQTan)ypX@<pc?MbLJHW
zsLQEFvc~KRZy;GOK#gpi2C=WkGtWO<u52HvOJG+7p4&K+usKj(yN{A@$3NMay{kd2
zzB2J%lUPSRK;5-;cbPo6g-z1R)S7Hko~PyMI}5Oo=L#zqWtIfxX~``@_h*FK67Yo~
z|Cb3h)XLAhKxs6M)OGUN-_kBjJO{0(@CJI5ixt>Vxz@1t23FZ)delzr`bk`Ccs6rA
zJ*eaK@)XQa_2k8RDxGe!!^@_{mq3Tp-qY7#(gOIHO)U{~j{1ps2!7XT6msAna}<&1
z+OVOvR!xAbuSx^Py=@honmtgkEsJt3=%ifIS)pQd67sy&uCO`wW#t;ccct1$yD2-3
z{yTflZ=v;X!j5jvB{B~Sr|$Y8dr;?{aAH=DDLxE_X8f4aer3Qt{Rc+{$VszqB1%QN
z0OsfR)ydp(7e#c#-ns6kgjp}7a>>znxwR@2zls_~`|%6YKE&Xo4%K6RO)J>EslSfP
zstG0M9A|35=D5;vb%owchJy^Sq99m&-`L?{ei_G?oWn!bvjz?{zg<Slg96@~5lK3N
zOC-xBQbdz;YD<fArtxA@DBIzEW*A}nh+}m3;_!qh2afDu^<B%!QP=`QL`gb@S|F}I
z6R5l@$<Xfq`Ya;cKvFt5E8H-*D&-0zhvlS6Ud{_(ajQAF1t-!k8C$%l`v6feya9o=
zUDmpis#}^zncpbEl{ZmR49j+ADYrXE*y(x-k|~pv_M*H7OUk7BR+ia1!rzKyb?9^i
zr(h{cW<I2(6)z2V>nj;FNCqsiC;akJ6K#G2!&wR8ri~rnqtTS1(b#;KGU_?KPJuC<
z3?I@x;Kbe=tUMa9NZ(B}5~M@7u~R{AZkeJ)Z0Z4aVLb$Sw*duE3KGlg6D0$pGO{pm
zbC|DQ&PBv)WXt`Ab#iXRVzxo<xvCA$I254ME)E35B?pkJLML>c0cf3J5yOe?gznk{
zH$c@JidCMUtEtOUp)uVin>5{ku?II$&WSd~vL#Bz&BLeoq}5N9YDwSFTuMNn9OCwW
zbTlLG=LW|VVo8fujT7HNBtHVL$z;TI?O$lbn<^@WhWr#cF0y?7s*n6Mm(ZV&f#{bO
zElK=2!Cy9R(O3-oaq6QXEtXUti<NZUtR_6L34KN?7lgedPhbJiQK^F~C^vT|S0iLw
zG*YbRrJS_ZH>3rJi@;0)!I|p<vZi76&S;`Ht^dQ9icdy1ISqwLUYWeqZGFXaRkv`7
zzT4D5fE=ZcSx**?j;|H7>K3w<>c@gLYxm1-x``?;otvfo2<_}Q_|=T5-K$AK?#YlJ
zAk2DJA@#>><xkb_y-ch;3h+etqcv<}X6Zu85qMgUUvT@wk`Gl-Fp^(vuFdv@LE+NR
z-fMqWf$p*MG}6{8jE5NLemvG9oY=k@EFFsV1KtS=_j4{`Nq&d@kay>Jv#Cf^4VdEn
zYMsxr(3q;lxGKdhA_L%ACjc7NI)Tb4_Am8t7h|w|U{Z4{k8;~tbIky0@cc(0UyT^S
z>-TSdy5|hvh9@mC?v^bstP0-A(u$l;OHC<+QBX*jQrqH`d#G!jdmV`rFmXM}+JqQg
z1jAGp;lP{?IFDfCW+K_WM?^VIOx_ezZc8k8NIZH&pkdIV%A;dBMv%#yTpApA^y&y=
z^#s8si5L1k1v7a1jT&clOl7=R{)|@)Df_SLeTbk(gI>~>+N4hn+ThSV+oI4rp9ejn
z3iEjt`2+{}LPUEk9iip>mWDiEa?}v4F8#EHC#NIp4m7DluZ)jCAxAeRYD*xA>%TZz
ze;2Y$`oHLd(#H$4^0}A{i^)Tvf#JrlLzj0MQiAT3x7d|{$Aie9c<=qxD)vurgHw!)
z4m*``C4^2%itzrG)aV_DgWC4m@i22oD{3f7YRI6>n79TCKXvm@!X{A4^%p*Zrv<#J
zr5oQ1uzLThI|mOz{j>Q#;)^uUSwfeSNZD|N5=DXNHqzlyW=?w9+^WjTr+qM6rC6|q
z=IBOVmV7nl;MS!=i3T3^R}&z2&wYR5%B$&C41OJIK6zpM1BliG5{APZuIRoL>D*{s
zS!C0l>@MQhm-gC^+Df<-lQ<w9V^*y))tBDg#^IO}ft+-q&+q+c;}ms|P>>vc`9ZxO
zXX{r)ZD&xZ`Ewl<B6_km{$hbCrq+a7z)4)fx!%mJ>W;~jcHcPaM2pjyUZIowWXmYX
zeH9NU(khDwG#*YXuya|zu$G;xr&M?+mQ%~>>M5gMqCzwc;{euiYa4Nnqaxhe0vWum
z@ax|Kn$xddZ0FO`UMz1TjWA3QqR^#($}~Qyi}OG@La?MZ#qZZuQ}qo}v|P{|@<?Hb
z`&XED9>PWsoeOe_K1ynH^qs7I<3Sc<ZmUZedk^da0Y7;dLj9hWROvs?1#PyfyW5x4
znB?_HY2tii5`(^W1)mb~yW+y5hB;B--fd01V{4g@$*`h+P~PwVWoSTM!tswkwx#Yi
z86(#LT2Auhc0*o4Iil;VaW31^$5D{_m>YR<$a@1ozDHg(yh%N0xNG#U`Bv$Tr71gs
zOGJ%FGW-Jd)VpjM(^Ohu?%(aE4bp7+FyDS2n#uL%SY1q{=~jlWCw;{5v#)iw5q=4F
zw-g?X8GbAL3BZuJ=GdhA0r}URY|tE|Yxg<<bw6==O-BgmXj6ui2DLsj5w<_E2M&%$
z++h~kAxqX!%Sw<>tw2Mh9u$JIuQP#93MJ>zPS^6x#2TX|m9Hsii-~Og=88$Qaz@YN
zp{pXSB8HkOy*b+T&0H9qgP=M$aOqJVgHdqz0>o-}pMyhVc!NQRS8@Gz5jzz3h`K8+
zR@96<{~M&pS<H|DR4=d|8#UX2<bKLq1!$2yw%Ve0lT3}R4#dckl=xF+f5{nYEtJM5
zRj(SJM_RzBI(@jamQsIZ;ZmOnc%KA11uOAy!cVI&mky&eBWmdEA)fv3H(OHB<;RYY
z!+&QD_yd+zhh2blt0rkuQ*<%8)KLfCsyvEW1GW3yJRzb5?ctYlb%z)U1UhQQeUGw+
zeR{w_EtNlkM2_1!SyAuUuxOIsGpzAw`Wm5h)gQ)HMx@kQMA8Xk&Un_^eOTvh9@jB9
zQp4;%{Tfbp7U(Ax%rJ-z6{};0uHyjX_R+OE$O$uFE9!*g)=|->=@3YIN%#i{x>4zY
zm>a(j8?v*xduDlV4WiXRhz8ppO<4Z`g_==2I|1KxXX1W<Iw5_Ch8b1)e{tr&3Y<R&
zM^j7VwOBDw5fIGFe6zt44#Q%d!zg_Oy$(P;br1SIi`6w6`uhM|hfX-aGP}lBsxBpf
z8YmCJxp15LlunR0;k~VS;$7;n&xaD&R^a)<7Mw?;QSp#mP};c6rJvL^Jp*cr;8&gL
zM=^b0;wpaXGmCd$yU&UAS*tr~>{*<@n9)_jJN`kFkQ`nUG+GmuJi;C#H~A6tdo&S>
z`y=QN7@>ROIkbS-mbjG;uHOMzO^B4kEH>Msf8=<V80I#_5m5%Nh62P(rqo!_;)(9P
z2VS1rsvh&|0p65^(F)5AINzJs`FtxxrSA&IdT}-{ttvmqjABQf`Bo-aPe~k2w5CM?
z^Wq605T^0UNYF6x0}cNjq-ZJ<UpG$Wl1Z{pCseGzKdz6K;SC&UBI$9WFUGd{<s%aJ
z@sQp19nhC6p_<Tw&7Cq3@znkKMxmMzx5KmY-m9X{pJ6=(tJ)JOhU)zYG{^oCIXwD|
zoH2iQwX3_Mq}j6pc88+bhZ>P=36k9G{fVu0g5k!R#UXylE)gP0vbd@Dqe<=q(N$y1
zD)gm-<o8OyK<dd_!zg*>FGE5YLT1vJgZXjg$qQc|H<P2IFOpyEyS_GEx1yG6lEo08
zV9OP!K2ncoKbN&nW9To%I)@hdh<w`849EaIPOFvrzU0ZMnN+|c&kQH>_BD4eAAW63
zMel@*^uzsR1Gldoml`y}Ld$+}ArwcaMK-!$lhjG<Sy#K@`|o94IG}#X638A~QBc*(
zWW(8S0>#S6;3ql;!3CkzVcNvna|rR`jjU2hhPW*10VxV#WL3baIEJD06g`)CCV+So
zar-xubV3wz=v!@KQ}`rTAZE+A;&gdB7mFiN`Q(T6ot{<0-3q;y<vL2GelF&~B+L~;
z?RNdT1q!;2pzbC|&k|9u+{J(9QN*l_;Ae@4qaeQlAk`gG?flomhF{*uxNk^by_teD
z%_AzhaYcz)G<tKPTm5(6IXq$twyyfP<=f8NW6i>YW*W_x*$Y!yY5nAY7w1%I;`b7z
z{lc5SgwT5#KPm|(c_72AZ*^~<V@SsDGYBXk$t5nB|B6I^9#hShc=?qLDKV4W4FIs4
z7+}We`ZOnK|C1ir`~h`0B?T-row2(}EV11H*qmxne$-fM>NMbjop`A3o*-Weyv;e)
z(lR&5k1g<>Nc_xDekSJogAC;$m$)kb_?b!G4N|G1`h@?$sV09b>bgwHtt|c-w?Iyn
zd(@X)phuyB$kkb`!9uNAu8@g*StoLAj@JHc9qNFY-`&;cO_L(Qgc^%*c)6Fn$Z^(S
z<30@#3~2HbF~LVr1m{eX4K@E%J~XYq6)hd++gvd~U#UM91~PqKUZnw{x)KHp7Gymp
zu#&+yjv0_C$>le+J8MW^9i~+H!37N<exE><!S;tJcwGMHUM@WN;I3o+BTGzoa*^#g
zlKm8wvkG~86cjX3U`9G~!lKA@U1Zr9Cl9Z}jpB}GCvNQga2(hdf8{1CE%<8led}q)
zIqmS5@$aR<r&GGynabTbLkLSQjan%pNt))4`=^pv`RU2sNDv=Nr31I{El&_NwD`N6
z*mgOH*m=os?DwT&e@PtZbF{k-$8YwA<SqCLyk$YJc^^*WegePR-@)>0l5sEmUiekm
zcp&SX9KFe>I3rtshPGcHt9jS(Uu6E+2J%M?!8BdcKy~R@26_hvDlOA!{p{hP0||RR
zn2C2ujYgvG0b7@^X~8PNI;p$VySr5BGDPf#rdOzH87ziXa647n{W=ZFS%s9>7#v|~
zK5~52>hh4Xec*?9ILOK>jI!VR0fe#)5#1ri&88a_$w+ggG1k@S=!tBm7U_lSL@(*r
zauWS3eoa~~ojjkH%AysNA!g;))0uI=w#v;Ib_QhuCk{_D3kA-tknyurg5=5RQ2aFH
zJSn!ire;J?aQtJes6+4lJktF9<GSW%8#g=V8O7lVs~hF%U@A>6Li~jfJu}BEkBH-H
z3nhv+a+<&vG+DaH!2e>ue-<<Us$oKHL9mcD69^IC&m6j*3MVZ@1A<n|z%b%a-C{ge
z!>d`M43SilAj8eJq_}Hxx+bK1m9tTt607Nujug0k_titE9MqGFxHId6ItIE1EkJYk
zx~7+y(!G~wgLIj!E8F!Meu+(t4jHY}clMckRAhz-TuZbcEXoU)BU&SMh$)7ayQM=Q
zm4$S#(4(QegX*1-Wf=%`cBa&-KWKl@u+ggSxnG^f?Dhd3Z!)Ls_=Y>;hA@{A<Nx$E
z$1Tz-U*hlY->`uy4+xm@G7Q*h#`_1%_@NNw%(~_+Ryb+6h$7WMl=LEpS^tnskme4!
zw!%05Msn3eGh|)FAvZ0-@6An&lmPWEuf}dn_V@M-8Y+=m^%8rUh;5G&;~&Zw-TUZ%
zV^UinkrC&c(ILW6BaIs#WRi0%#=F=$73;A>Sz4Sh!>m7WNR#0%Y6}w9slpig%fuG*
zI~uY3G8l9;-tWI>6~WD>rK<XH{gj=c<J<pb0UZsX&wI2|{xDEszav3FkmI!hWrnw9
z_a(R)ofljSI;c$IN)_)T41SyVCVJJlCq*#WbA%un;us(GwssG^9t-;}_Ua~Q7SJ&y
zwW*=wdWs8K0G6IaGJo;)UW~z9+N-r;GppJ=1=h(4Me!cyZrT_r*2pl%?+2e{V%F^q
zEur!(GaQDpgmZgAF_|FJPkDbxd>nmp+W*q)2ORYFQ7RrYn+FF64U$@WvHgL+Q{hwk
zx3i*6K|(0!MNzpf{ki*pu<<_>r%09G{lO79YGv5;CQf}L)}yx46oYJ6Y2hEw-g~f~
zd5Pgm&*fS{?aYque7E+s_l_-Fs_MwkNngBc6Yg@3oIATdcS=tBLCFzdA+)Vr4$K51
zc|tF%uBZM_p7Jj*ntLtQ%G1tx0Ukyr_Y*eJS^<VYwOe#q^6!*J$2$a<`IE$-xP&@J
zJF*RB6<#&z9yb1=kl^#?GPpTpx$*;S{Yon2^`+~9Tnwv&+7}+Tjxr4zZ6Mn-2V6rB
z07<p%ntv>C)&@EXSZ<xVU-4=O)tYqB<)g`oa%~|`wrrgOGWE%b{%<}l%*7eeDf$E{
zaIyv6h&VECJ8Juu2SEL?XSk5g4c(vMlXO~qHyo_*k1Wa?ljL=LH^e8S+*<;MN>q8t
zNJn!g<hNa8tnwMF`MNY26jd{7A(?ddk33g%fh|>xudQXo`&*ochkL%ef_tW&{UJ*!
zhJR%JZ!;U)s(RuFyT{g+Ce{TUe4#vHPGm@bG3kd`EaU=%gx0h8R6YqDnNWmV<)glk
zoW1stXR&;EgD3kV%TFg{;yBj@H--c|hyGSssJg6loFH~Ae4tKj)lM%v>^;9$6=SH#
zQdbE_5~&AH-gKT_>Y5{y5BvakB_;mbE|VPnaE~f2R&^PK^B`(J`ycMus?I6wZ^X6-
z?GK(Qt-!yIFlF~)jEU8}0J{bb`3)=<hmRE;JD6QkkK!J9@sm3#HHfgvsWj48O_0H`
zTDUrLNnB7YZoAgqXCK`$aoZx0(Oudhy05)GPto@x{~vYL2|<C8`nFo?)<~nJ=DB79
zrATvYFG=$t3uiGjU0S+bgP)piUiS*{?Vl~J2-!af!yiE!Mw-_KI~ykVOkea2Jg+9y
zKwynWGrZG@ooO4P<kh0O#yXg1UGPwFK;z`hf_{SS<offFq5E}sKYAqjo(nqls_5*j
zUqG|QL@mPl=)7N!_usp2JX^S85HHpV9ZMPKmuu9Q${~oE(4M*wlS6%C;|#7W4EIqc
zDs{N?HbrsGClC8>Tc%|}rU7<T2ip(|TK%wH(z0IC@Su79-ZX$b2=Ig99>A`nh6|3A
zAGk!eP6y0RllQ??U;KD~SZ(m4z^tl{{X4&r?W4e*um5zGRu=je$8E~d4nk5D!o#~~
zBpP_JR!uc%^?-A{<63?YUuqgSBo)Z3J|=p78>)d}6sa`Htr}hw(9+SDBTv4vI|E&^
z(pt{GD+X86zjXh?fV;qrc6V99ibSSV4}nYXnP4d{ZCq@GTCPwhWS!z2S*;3IOMI^?
z=WM5j_LD&i|Jp`KNH<R-uQlpkde|OrI&tHAQsdX7m;E6vN4@mZSzs`f^cWAf4ag5}
zBQIj)!$x&FaSZa)8<b8ezHD15X(0E|H_!v6Ng}S!DRnsE;XGneWjT8qaYtbit=ZGR
zyq0DEcEi?}hI7mEFeqMdc297+6GYkDKI0Lnx7M!`I;7$^OZqiC6*|WNSe>C9)bY;X
zLuc`R@*(rAjR;Z?VsmCMG2qq~UNB&4FmxIfYI9h)j1}Sx^A2I%XW#%1XkLU|AO*ni
z0TxHsN*81h7@0-@NynDsL2URg8bm$Z22kb!>cp0t;i_7|v!vR(IumWxmePhrW19)}
zq!#KC0uj91#@ratg3X;in!&d~7nC-38aB!jS*dXYqIkhCYqSn8g8XTeqv-tA9L2wV
zDVfDul`-%pfw;XLYTBM)b74b#%#f6FHZQ{3K5J<{Rnp&ul$tgt&j_(3q={hH+g(Fl
zEMTkSmmEtaL75$5?|puDGCob~D{j3CY<qvpd2T*>RT(H?bXsI+B_(sX#&%#X6|D;}
zH-J|!s&R3)Y|PPpxx@oz0-t88`_1^8if7?NP=??e2kc&Ixq*s-<_h0Ngm07LKz{j0
z9%0K~(?Xwm{|Hq4#uT+R<2B#z?B)jvA>YTppo&dofKLOMrPTgCmR1S<IS3U8G3j5>
z;JG=MqQn6%)`d`(A-3jWK=K+`{t$MU3FF7e1-+URkJw2H-E@#S`65(3%Okym2|Utq
zw9p`_xn_K_2SjQI0k7VG9XP{ABMv1&{IJm)VXj+R(tD1(<>ZNSKj3_oTu>XU?SR+x
zH!m@U?;9tsZ~eV1uC-n-9J_B5FiReO$_GBh!+4GJDJezKt4o<;Je4{pCLIA;Pm6Pl
zwfvkU2VE@aP#wHVVCMM!O1*S?6m&2w{Tdr4E5KR!*mg|WqunUs?vO&awf{{{<C8K~
z65!L2?DJClS6o?VX}eY;G=00otlDD2cfN%0CQbREDkY=z@O+w_I`e?ADVu2lKsK2e
z3xJMqIe?h}O6TL5^ZduiyQt~y8G=yQphE8R5C>nW6D`<P;XEOOgECOIWH#>K=F}GT
zwB#i07lEetp2<dLGrpvfXQ{a$FPZ6J(jowo$Jy++L7N9j;0FyLaFa!NHh8Cbxp=`@
z3!A+h&zLkP>75#b5(@c+3Nfwh*BH?v4kl$tKCLvoo&Mm~?%Nkf+l}Rnr>QF*l)|Hd
zXsx>;6l4;~2+AP<PHS1!mtSXTS%{;<#X(353)FHdvAi(=aWwt&`a#RqWJ?0R)(=1B
z13p#2eRugB+ZC=XQr`}#@B8=Be#&OQzegB0r-!FyXkuu+?yx^}+h^K?JnC^S18hwT
zrGELXcPJr+rC7I$q9n5X)vzuTTk||V$|Qn3x!q4C^_x^=`||{LDC3h*#-6jp{Tj$o
zjUX?0DQrA5)Uv*ON@kPOuEl@rQQPTF0RCHNdJBR|-r3P2v~gqv@4ZDe7255{h_z5Q
z5G_E7zSMRAWjDHq{Mfn)SL$&^$Cf+<*j51>Ic$Kb`{2e02;#_cp0FOLP)Hb71!j?c
zi{~Gl_uDm=G(P)KL4h{aNdFFgX@SK8L<gv=T_rE}9dx}yCz(&Evb$DD$jj8+?Y46^
z5YtU7*NQQi6ss)HDz<TLUpL`1;US~x9kqUu%t<}$AELkH#<{JDV+fV)qZ>JQ1yTgN
zy~O77J>DNFn0>wT&a6BUr6YSY4%xCUp+&DXyDnN4ET3-@H>g+@XL+mmZ!)gB!$KI|
zQOetk-?r=zx({tgM@eY|uWSyr!3jSkZ*pQfVWiHUlJhK=F|S{gQ`XD3!}bkfzV<56
z(i7!5!pL}lElhi0-wJ`ViX-7e`tiQAyJu!^+k&+<y^%Z>5_VlOtWSC9Z=66e7N5Gy
zeen{fiEt|2qD3Ai?Stlt%mG6!Ov)ce6R4JhF&SPKTM%(IUq6v_?0MX7c_VqEO>-Q8
zORY222LlHH;s?NGKAzP}!e+^h5|BylR-uI&&SR%ANzQy=;R&m_8aqIb$ZXzpTAuE!
zK6UY@kXAW<PTKB7n_bV*>r={cn)HyE*8MtK_T;_DFTi*R$2XzR9U*TvnPk~1;9rN6
zRKjR`!h?5T%7;8Aurhd}XC(ek8plDzHOGtBVX{_}ZBq~$$HZFd4j;b13|xd4AT69j
zl&TysX({<amU5dZy2CZJy(yd_8=vZ~4FCE#c*?Wvsn-cQCfkG;L)!07vxf-iJgavP
z(NSI>kO((X$ToW_R`qgVo;$>G;Ofto-21aZ-L+y>scUU*yhzhBLA2I46AR~|C~#3@
z++Y;GKXV$!G|f{s?vIDRbo<9fUTX<P${L(f%t&Bi;rS62xSobz#7wY6whVx%SWxDi
zP=v`$!a*LssfaP=)J<-rMBr25YN;O_CmJutKrg2k1*V9EvnD+d;C%REX1`D+{r#ql
z?cQt5@Z}vDN-F3u)jYcV7?$P1Qncuzh72C%&K~AshIck>@eK<(D9~=2Y=jAmjjgG6
za_RvW%kp&=?$G(>I?yfy=yqf(;;0d!QKtz!rxDB2Kp9IS)Am@tmGlysF}?+Gu8D44
z&kdLv=aOB<vDx8yKzlsxbR=;IF!#)10WNs<XvQH6k6V=iFGg}f&Kid23YXQ=3Y60s
z)!E8?fgW3&W6|G|fP1WEAiNLg!3k37#lu-b!t5%6k^m=l!DT~59`;*I*tG}Fo!ZrJ
z5ia*o>G>NTX_@mZBh##ePI74ih`Uj|52?SIBB^_7%&ScdX-ImbUXIN8_OY_(ey4C=
z@t%cm#ZZfRr2oSt(3XIL+Xk9hfSFx1+vG&JFjT;V!A(53E~?<#X-jo&e#^ic_oRJX
zc*CqZF8L(~4YQUB777JN+FM##dA*IUJ3k?BY8_W>?@09wb#I>=ZBZyIPjHd`yHf5`
zIl;&#lE-+-&O|#IrM{~k=}fCbB?gQ&BNowG_<BbZ?UXqu6Gjpda^8TG`we&(ix1nu
zpH9+Ve@?1;CoB$L)oqbMwO$6EXk@(d0V5%}clI-cV3NBu^d;>G{HyjLZKsH_f!75L
zNorLNTGeZsiJ+4rr(UY*3?O5cu9G7Jc`Lz=C6k3T7=T&ZqIBlov04-U0MS-zzCa<8
zkF_r%fW>59*dDKhYOm(XLKG|5B^Wj=c|CA5bZO)~<Hu#0p47e>0n%^YkpB#(kDQ+>
zZ!EmA{=p}*ki_IG&C@6@WUP?bqy5FJccV>A9-x8DHb?82046@%5>(`L5rDl!b=)0{
zs<tpu3bS_;8mAK!DbKGJ^S#aQ=cXFM0uA)fOY5OifI1qV9HFaHuKdufeD0#T-#*|=
z*FL@u-^dFw4ABa`=7=7gh1nMc?|p4Tef<a`y5xXtwkJC48p!Bd<sPp7=cz4k?q9+F
z?HryFT*7p>v@;~tpb7N!rZEBi7$RL{P}BWzyZ1Wa6PdJZgRof&yiN~(hY_zVSC%@r
z#~{@9@I?DqJB23E{O0yuF}@So#>jSRg<DoRys2B}B+Ctqt^J9-V?JqZORw`j10^@m
z>EhVRO};mw_ddPI9(tXz{9fP;Ht&J$phCH3m<!<B(31)FnXfS@yKu3<y(Ojc$vI*x
zvzCI1yS*U&v`W+bnPnG9-tMK=TRDNBvmq?iH#{@tdyc7O94t?9MS5QAOx~-tubtfs
znjO8m|J?MS$wD8MHz>gn&>=4^P%bWU-}q+p-p#<YSYvZ$eslr*AM92W5)!J#rVPo-
z`j*`^A(2U%_eQh&*t?r?j4!T!<`S^WzANBA)>o6z%H*`<&R4AN%anaz<#jvzo9O+I
zg65Mi<djoHUY3_5%?f9!ze`^-d`I@>(`u%G`EZ3Q>?-kS(d8|=H}x|PdFgMwZ5`1I
zFM1KmAy01@6EKW9`8XNOh5hIVOgGWqZEV?S><)emb(Y;PK@dwM++my#L*^owUkm1C
zN$eVhXB9m<)v^#3G=uHoMWjTtgvgnU4FSMQm>Wvv1;T+uX4o#XAVdqrP5(4TSaxS+
zd2KSaIvT%=F|)O8)JZ<D*$G1R9)v4_ha)?|<YDkRV5{?my|5YD@)~a0WeMNB6Dnbp
zBn#&4KOG4E+IbWSJ;w+>86`mPg2Wrv1x?A*o}!%<e1mRs4l1J}Q*JXOVwxN_YVqsq
zrlZY2ZI2d=SV`wn9wCT%88FlpTx^Xud1J`Vk16PoNVvnjdhb%z$C)bPZbIhwD5Hez
zN71H6ps~U7Abq>v9O;rHUG49^`KqVX3uaiZ2N_g#4c*2KE=LX+CRWRfC7p$8l$K#8
zKHd^^@?{kM_L(u@1bH-5XhUeiHAh27>LDPuC@Lk_5P@r%-u?g{|FZTQaJX+4y$NjC
zm^Pg5>qHytpC$1a3RW5aBNT9)!hxr`&R!$*@U$^qSmt6|39W82i<D1YjO$8<_E^oB
zw-l68Ur6nIlu+m{IYan<E%G~u=Kk&Z`5kwUV5`nXDAYSk{<WC)&G*Sg(KSx5n-0Tn
z3KnSQUAvTJ>X{KBh>vPR{$|d5)p1_OYzAFIDL8mPWR5t)Xaof--mv2nn8+CxvTfAX
z1alwxDvxQ0PEPSEEcvmANasL$4JoA_p{{MEQpzBr^4rgEmNf@~Yri%`TWEQwu{u**
z$^G^N!AP7($f7`x>!ojyV{#c?{z|)6zFer-Z^|O?23p#ifm&+4@*mXAk%iN7@q>j!
zvTu^&RYRIwqAOybGTasIoSdl6kTmSjA1GPuw8d0H(4JLa65ii4&hAllcQg^iv8FIN
zpW1lwN-9b3!bss*Yo*{*fm2DVMY)xUis9L{4Q+Ci<mE`l$flIQEm1wq8{N2V_~9D7
z1+51layAw3r{!*K^TIJdwojs5y1hj0NT84v?6foc)0vQ<?nRD9>VAX3H0w587TikU
zrNA2-`hoU!PbPu!I{+vFXEi;q^a5s`7rxhw;D*^B{`3mV_@}Ct^@<Ms1%sw;1&0)M
zeV5ekE|Fw;cMvOYmxF&6-O~3(@qh)${Y6<=&7=hqFtIhyy8V3mEj81zmgfr#w|sv7
zbI`IMU`$L~Gl7MK^;JNK&#}%2CLoW~Pe$;e31Z)bhvD~-n*`|ZY{nhYlSl{qcmN}#
zsl65-<dfp;-f>jFxv-gPcq=u4HTAogQ1LBC*8b?HrYWfd*zddz1-nQd;0=yOp&wRi
z7>t<JQjH;0^s$@J{6jtEPa~D7$lD%z#<aZ{!@P7+^}`>)H_r3RZC<cRax1QD?tWU1
zd&yR7M4c=TT{8(FD<(>T3py9NV(LQHp5Q$hL*Sfk^TD;XjpT|}i#960J;{%{fd;Gz
zsr^{8-yfT~k8gxQn}Z1*_h~YUO+de(;dIzOK@2{z7Dfh_2T&)i76!sn3*`;0_6`@y
z@E!QYQ0ct6Z;~h4176vVH6Fy4HDU#$rx#&LbONE0J@y6`m;W|J*|igl{$#~!{qVW9
zS<5!db(FDWO@KK$4Dw_==dAe7MxB!<<bKhJ2UaU|3PXgRIBYt~#-C5c5LxyEi8)2l
z|4kt^VA;J{L6A_7o}~J;N=O;W4ylT}VK7J^F8H<Zv2}uiY^7OLQ_7VWXBOYCKAfG<
z;nZS;Kz8@tKMPe^oSN51vag-Zy`LE*5W&{=P{Zyu&^x&SNqi^=^s};DI(1PGQ|aKD
z)ztc3&maeOpajAy1;C^zQ&;~%RsQs?Z=YFqPlkqNUj)CzRx6Y@8r}R4&7aTkJybVK
zeo6Sg@jwRQ($Y{XQxtUK0l#_7UFZ@U@w>&Ss+7}mtk>JRyt`Jzi{%h!wa+(gN*H$d
z_*FIU4=N~#&W{<i=Cchx6mS=tONrib>O8gko1US5oqOP(a+SntoFI$Uu+=MPx^KVo
z<=ubg%dRMy{zngt7|X;@0OvP(*=>#Ks)qiCwqzFBXl;Sp*G7%3Qy+@c+nPHRjFvbg
z^JxJW;7IOC@q06T&nh}%f|jbIFW#`sDJ{bl3=g$rJ2E^ut^ZL_{9}8vVCShbRVl-R
zbn32AbSG?Z()r~ufs0@4nbq9Q4ae^`uGT3|v|jQ<F{`JD|DERkhu^<bV2&VY#R)HF
z{16ebPrl0sySDt{fqhC^Y|4e98?&uf{nlj!zC8Ytrp{txq)AiU;b&pjnO=u}N-udQ
z4Z8Er@Y-oLc>yP}HDSlaUjmGUZk(BSgLi8pWD`8-b^8>92qOB?O}Gj6`zewylZV0{
zFD3n568;a%G=-wKXO*>Y4XR$+>vGvMWT?qfQjM2&oEqUPq^(s{cub`#D*n(I)B!Xu
zrEhdXQqa1zJce|zK&0f}Qug$AU$!?wci-vw#x6CaK-=`!UC@1aS3wau@o<(SUY53i
z!3Jds#aQo(V8-UE@_^(IX7Ci#|MZ^!kB-?rW{kJG5L~dSSM@_kT5mX2@+FwWqeyXS
z%?Juy=b~QokWH<+dMA+6$pJo`8XaweY{&qUZ|MdK4ceWGvb`2*Hlf|UR9u&uA{hBW
z(2;cEnZOy^>Sn}iw@UqFRHATFe31VP@zZ6$RpIDg1^=s!&g-}GiC6x#+%sGfUnp?D
zIP|Spu>&OSFr-NAFzu?V98sox2D-?I0dk1n`|duv5!12AxX7t)%VfVLn>hbLujS0l
zGlo3OZgRfQ?!+rss~p<ql~DPKh<8bj4$<o7*#8%ch%m;eU1%4784uzX``D7;V*cFN
zh7fA$kjvyhD3<Yhil&r@EEfL&#zr43mbYClIMdVlJIo>J6k~pR+lO5J(O2K2*w%kb
z$t}~f>Dq=~Fys&a6b%;A+|*uLc1h~{!_~$y4$wWub#@>5e+m2ljHW+DGzCBe@uT+-
zfXHG}hlFvg6-~!izIjO0o*@)PSh`p5fgS!J^EqcpT{WL68z3fwZ}tv7{IaE3c2lz{
z+i}h>gR{?zanPtd!vkHcm!arbM0clxjore~VdQ$a$!DOTHj{QrzFW~gxE@#R=F-kg
zQ*O3HcY+}?{}1sc7(tHWc6E2i=@5@~C%(T7wa@t>InPfsobzs`dN+6NTuQCi9n24v
z!6J4+`EE{Wt@^ZtO$F7di6~I|`BN;D+VKNY@;wFD7+VtFM9YO-kRIgknTU**4RITg
z>*j>6TWR@q8`dUcY9p!}@y3vG&AsB_dkd#YO=x01D;~4U`7m`fq4hrLQtU==@$4(&
zm2Ao9qj$!n$*f0CZ*s>L#syUU>qcLUjN{$v&!_$TS||4|XAijAJ!m)V?lB?(Q$-OM
zo7WoD&usKov6oJ}q8duwVW6NVzp~fAx%Dx`7oE1jyw1(tdLG=lc=KJw0Y}4R9bSF3
z6{~GEIk_C}Cp7WKU3Hcvjca2jv?V8q@<_$OWBi6gPhRlHCkJ=xem&|q_b^kF93opO
zGd;7lRk{k^+^K{K2?_bu9X#)tsRSIV!R!CnnUuWXTImYV=r!B^ZrnK*`&O;q82u*L
ztd{5#`%7KmCx7TipOMoltDLzfafR}F!@b%4XS64+Pz@S8O(pLn9bURVyWek%2s5-)
zsjNW28Yde=OC}Majg5k?XUH-etLrO8&*Y+J?~1vW+s%H8(8Y6ViDiU3o$&<W>*eR>
z&1Gpzs7`ddB568y7skIwN3(^P_Y`(pbXp+N>MPcm*`wMDc2h>4II`ZUWuIIz7V&%L
z($}wl;yYjA2Tpbo0Uf=`@GBuKYU=uybfQ*{#)Dr!C|}enVAraVe5n6^p63qU%WacI
z+?yx~zeXQXs#>iO(tYNkr`J2XOO~39>mB#Aos!`rUB%5s&Lgjcl+iU~kQd#3=FT0J
zmooL&vc6xfWbKj)-AG7Jy?8miOK+x2Yqi=l<39V=GlbDFI~#|tzf(y7;%4PrmospC
z$|sE&j%d`BC3w)M;nBs2_IA~~9)=b63dv(ib#(y?Ge5ZsZ6LfV*>7T7vxQr|1C}BK
zFI`bZoAKmWH0WI4wdgw+ao8u!(wklKyld}k9RzOPe&4$t3b@=BO*r`nTH-`&otUZ*
zCpbe;P>{V}rj+OEQ>e*uCg0cX$0p+sRG%9+t0<P4sh?T!M#&GTYVHKY?=4TQ)uk&@
z)IVq`?^Mic^qb-h6FyXgnIvT<C9Vh62BUEo-T~#R#EbfF2;Kigj#*aJGO6ghD3mOe
zQQy$jOyLVVuse}>-(722DDsT7vtS2X;E$H?^_r3G)xk02b78zQx(PDhe6U@fTu6z&
zRlDS*_>idj-HD<oX}u1^8rFV-6qFEl^M!nyBxSq<Qrdorl2YkD+~(@uDv%GQf2{sA
zO5sMkRBGopx*N5_cV^cI_yS9XaI3l#!sS;sU8BwlRP$&_14#lb9m+RuHd87R%zmF`
z?A|L8{`JH7k-&+Qz4U*)yYww6=hsBY6^Bo-Dm4!GM}_1fxt^sg-J#EN^o36C?|yHk
zk1^a*eSa&;oxf4ZooyvAS_5_c$gv?Fk=ES6lE#6F-pl0NOH;_t+-o0#M0@S}#@pEV
zR-t*%L}a_7^*3(S;v+?GqXvkmGk&I}hC^{`>Kl0#g3t9?U;X=U0Yq%&j`6a)a;iqQ
zk-leYpSk8*u9{%`08li)7Rlb_cA%zhH%izSN8~*@(EM3WZr=?G9sBM5JYH$Bh7i|U
z6GC@^Z)X0M`cq{XwAIhE6(Vvm&F2{+sn%I=?b@USOK2fHqB%NclsY&a<Dvg!_o>XN
zy;hX>D?q`?xDyMapPn}U5RX;5fM8_rF7RtBkBV*bGD<r&_g&9SaDPtk$MtA4(Q-{U
z;V4;R2gHinCWl+~DJ}uvl5=h{-Y(*L)%27OdT~(7SV-E@**IMS+-`hktoF=#1-GXH
zLN~HmsjK!;QW{mZDOVKJDp^H3Ps+Q{GZG`-STbjw>@C$Vm@PCm=-1PbtTD0WPma=i
zJYUIa34L1}w{N#s($y7t0f%C7{+%;)<GD0snKv!LfZ8=&xPH^IXVtSeS10LcBT4|A
zof$Q4KhX4aI=&K^|7`sE<JSyQ?u!g!u;167c2^aeQ_gZqImF<Um|g=Yb%E;}XG4nO
zXbFAn><L%vVbt`EgI5)6YVOl3;2|N+Vxz{e(dsWn?XTV~248i{&u(KEQi+DJbB{d%
z%udFEP>Bytb0zarjB%@;chZtV3)e<A9tSn>ndv`sndE7D_2DPbY@m7R%j>;8vkV^{
zA@)QDA9gjIgO`o#(J!AVa7+4E*P~khfB=X3ILW&vFB?LOfA-+k>~tOWJaxaQFh=%_
zbX+*EQg^?LazV1g)vqe@>gZBwTT2jfLh~WOB)QT?MhtYweok&dYt1BYUgueFiXznf
zEK<ghjYq4^W*zBc+@YJIv~n5@buW&~3o|N?9v%S!*IlBUM&)rYJ%O>e-+0>VUAMnX
z+YLJC=_U%!4nlT}4cvzaF7;ZJo05DOs?Uv^8=eN!c16X(<klbMN?kJ5og*+F9Nc=N
zrD=<>3GM%w?pL$+AQz6Yqp#9oTW^zwj20I;ZMpJlKdN9%#BTQ#2dt(E_T>pKvnM?o
zmdSW6Q6a?N@U8yqMfuJU{EFBoc8|_E+cO@PJ_=c({h3WF^V)#xcE9KyF&})5d!$?Z
z8NVsz>oEnqrv0H5QvFVpb+FZMJDPa%<^KT8Kr_Dwfo2h2kHNKCsrya*jNdT#k7{dm
zbPC4U>)3}&K!lVa>Tm}<g$AtAh5exU^ozeBIpCe0ag{F}8XhJFPRGh%fYz!saJrEC
zdN4joYZq$fB@`;-;u7}ja&{@s-D7ifkzR6#z031I8E{r4AUrztFXCf{Ot{|J;r-;a
zA)<dJ7#u<2!E4Oq&#<tus?ws~8dpBq%!g@XZE6h<n-TZ?U~u2L{{)Cf`%~SoTD=K*
zx=PH^_x~b79wPooEV7NA5{vA|KZ7;K(-wLXI@*&*H@I4xw1@a9ZQ_FJ02zIJ!7e&O
z7!Ya+N0SHzjOo+{YDmNA;+#fP$7>v@Q=bN6r?sU`d9*<rq?FshFg$d$i5@=SlW+TQ
zN0cQxj-8fgU8b`TU~<f=Z|b-yqln6&VxYh2g`l)?u=p&$s5hNB<!ou|5*V+wd9nEM
zyhgph<?gN3d>UH}fl0_OI_DPikWz~x;MyVnZg!Tj<Nb2xOtsxAO%)nd@F%A6ho)st
zj<}gSR|v3Xa>e8R+<y+-e9_z%Ph$+~&aAy<JrD0^wV#|>$J22lZ~_FDT&GXq>1wJ5
zzGbf@ZQk8@GT7OLPiA4^o1vS*#?P7`|4UzJ1A$<^xM_b7j2WIG5Q1V|K8-cmW>%-o
z&#4uS%&hE5^=H|>3U#ya^DsFLhe^8gbf(!#{)Q3oX7z7SEwlFVstAI@>mi<Otq&w%
zue>TE)*6Dr=k)=Ff{^QC142QFb@Gf!+_vJC5@nq~iof`X`&II^ZP4~!OX(ID@kax}
z#2WYFQq;I;u!<~$z}O|J!CvGI1{2pbZVI2WA4wxyh_VBZdh9^NU-d~nb|42IJZxI-
z+Z_w0q6neH)jHLPjU$C{sBv}Fvol3-@WTdCR8M(q!fQdYE&4b3OR6lXy2!O;J6m4n
z=O6&+PJ%h2rP{-gvgM{RiQ;aQps*DiNSU-yzYQC3wHA}Mb6Jen;#?yJ5iFCsV4s5p
zx^31)&-WLk(jT#2q;q*c7D4GmGOi&SsVhp9+Icd#k*;Tb9drwiHE(D@i__Bh&Gg}Z
zxCw>$2I8dii2zgZFkTT+g298Q+sgYQcjCQm<qLx*&hk^~%xFJh44sP0bdm^M90Zox
zYcEc(&UH(HoV}1>2y0TwuVHaw9X^%YS(ehen6k3d{_<*wNJ}92_FjEY@Pt3lM$6rR
zd^r=Wdbj3uw%X_8@A|3se*Jc@ip5#@IX-4#(br!@XO_LJTONV=n3owiFl<b2<cG5v
z>&EV`Uw1XCTP??$%DaenN?Zl+JRQvIYWOm_qxb^k^GLJSK+msd+U~(R3wotJ@r%Cl
zN{K;G*kJzPeej48S0rvp5SKEy!gyqR6ZlZaz%a(COt6YPvTe|ovhmM0D2zTnwMSlE
zmkLtkxFqE)D?^#KaJBLi1HuU73}I3owu<Dbr-90tPI6>jh!;IlI*u%j)>mYUKjh&<
z_@|6dE;|X|S4p(8+KlR?D}w-&niJy%B3tVOJJqK5v6^%EJk_?Pvqa#WBH#hWxob1a
zCRIMM!eI*<ZJedxk9M*TjF7Z!MKe7=2ykn8n!5yr`58B?1cl=uo|FhA0*S!YLZICN
zV==7%1A?vibLQCpHgO(5%}uiOhd^-s;wIkHdFvMM2)<o|22*bK5S0y_r%$u{Q@WSz
zQ$Qf^^C^J5X&12&5D4Yf4h9t0;S!syNl<w@ID*0DuM~J)L<y6Xs*Ceu+B(^fPn>3t
zqD`#hd?_eY{t_@!&i@TDO^H7mxHUCCiEw`^W0ntx)Oo{{rwpM(J$zE+;Zd(W`NUtz
zt3z5pe2)0R8V(HnYeRq34+(?Q2uBc#HkxwVDV$ShlpBDkN0-Y6N47M?#!`mV<x%Ul
zu{0XL>iYr~_{hn}9(jElAf^o2`C7`KYexWpd8gteV)1H!JH$;H{FY^s_=$Ms1>sEO
zSV#=ooXFsYl}j5-0BIbf4ZEFdzTC?)%fK<j+l9Hecsm*A8cl(P5OC2N6YgPd-Nc2h
zy;llmx>f{S&-^nZjgQ~Ex^?ysf<<>skh>V~qK%y{-awGMm0+IJv^<FsM~eD|9&s>_
zz{j<top@S|SAGNy*7MT*oQvo5E@rbX9RgGK$V=DHbJU^X89T6#hv3R*0DeI>Mr*z=
z{4#E{RL|n<)2#9A-?!sw;Ky#<tbYm8IHx5OTNCSkeMLqiyl8eFUQxeJ4Cc98wAm@Q
z90IH0-q)$;jph8N^l}I|zsHX3i<*cVwjF=<x4TPdOG}F?AD81eNtlJ#Pxu++;P7??
zg%9GFRQ#3UO07KZ=oC3+4ebx?fq#0ljy|me72Cm6*fc9HHacGuLHzO7fKMQd%O{5o
zjG;q!-5@bUnR;~FPk%PqfNdK`B~Lwir7@A>AAib4b{K5NhdTO0Umy6@Ph_jHl4*V*
zjB?+Ae2t-EqmYF#t{#o1EC`V;WkI4N%C|PnqbE@M)(^JG!>0|{6eLo0eQ$KIk`jSL
zAQ4Ce5`oh}z=H%S8x_B_@-SCh5M2JOHt9klz=!jlh~#^p`4(gTY>z)H=6)w70*OE(
za48We0gqS#BTC`J7#Fpl?8(F>wj!Xtvwf|s-?whv?DirU%qxLP<wfmWwmT6>1Wp}+
z@=K)%-X8lU*@`V;ec~5X*!5wQgMHo`9P85s3<j?V!+B8SXix0X_+$BK7iHp*#zT#H
z@}MkvWQcWg`OyGAfm}ZT$~T3N4{XAdPYNH>pY6dud2LcAublPRz(3_NA}HIEjkf_B
zvJpCiPhO)qHIF^&?GR;2zJB17he%r;Wc90_{_PO$SH`E4k&%~sd4O?Vh#OOW&9%V>
zm4FMY=OV-h__JP2!#{xp25LE2FVgN!$P928!vh@Ss^P5Tn1VG=hm?R9Gj0jO8s9cO
ziB_>U$<AfwO@y2KRhGW-o)?rSDvZlr#S*aiR|`JT+s*;TcpZ<+12|>}KQYHzUd4Ma
zHq!VYnvV#d`{BnDSq|Va$Gl&R58st}t<1kcH$u4nN#A&YxW4CYFqY6AjEi&M`D|b!
za3%=E3@IDfnK)0U1%Y}3<b2Bh#hO?C6nePcUCbL)pX9Ai1JjlL2(a9^^=SFBIL-v^
zj=#1Z4l$cQwATH3U<udr8<!Giia;5UQwAmHl%&%@0H6s?jfh(Um(LQryM(0HLGd{|
zJ}dkBiTWP%csh9S#g+z$*Wu~B*kF$#_Rx}_(^}rVd~4yP(_)}cjI!L~NV&lTb#X(U
zr+p#n;c@BKJSjE|&T7v%XjGL!W&9I;Wzj{>vJce;YuFa@#!JahB78b<ZC8=&2ZV8i
z!`2}AwiDD-hObc?ZO0>9>Ph7z&jo0t_`x@M8YdA^=MCK0RhB%mwu_Vt!hWl-A9-z?
zibDQ4TLid4o2Es5oU6gXF5X)JH;vQc_7_ETaf>OrDFlw+E5`Y;p_Qk`!3{XR3Y5dh
zrfyHqE+4fI;wdCHyQK4v009vW;KL{5qREVx@_w<woGM97Ljn#vI|NWXGSz!cFa71f
z@m~;}e+;sPiNL8LaC|#EHP`7#1nMvTS<m>hWeyWHSb1@84zK&+Y2fHg1cLdJxV^Fu
zAMzI-<zwZb@5c^KVscvP#l`rv5K2FZz<EJ{wS#r?+O^$SU$)CyQh)7#vKDg2^nn%D
zsPeD@UuZmd&+W;qpHJ;}<vac<?eyC`*a~QtvB-Y2sN-UnB*tmId_LyEC#H!E_0;+P
zVS>xpZl5gnDPrWTN2axp9eqW%*pw&Vc2U+pvbL3c3AC0>^8-h1W6fg(qY!x-g>mcA
z>+_IThk6KkJ4Eo8&cn08$gxw~5d+6|0y*-2b)&lQ3?gH{_|CXTAdxf~ffyn47V9zy
zPiYWM3J#oRaOxOHgMJ@tgDWF5ET~{O$XCwEelBM(wqRF^lesP0wQF={y>{2ow6&Tz
z>fNtWTqBNaZR`e(O&V+cdALbfTz?2C#>efLOuZYkp}yng*u375ughkZ@xc4Uwytsa
z>Jw%h&$x%913C!TkyF;Et(xC1Pl68+DXhBA@YF{MMigNxs(ybg4m2}K1TGl@r?c)|
zJkVGl>UwZm>vec6Fu6wzfBEIPZ&-UV&~!BgKmY8SmhbJwm&6^!H_As~g#b(Kb?wtC
zqp{wf&>T~43Qe|;9975f?+k^$fqpquPoUkmmgNhCz_cS|8Q<+7zd(JuI8Cj;Xu7sT
zC@Nm@aKeVO^!s!$>jQhi!2w@v8DA!MLEjy`3M2)`sjt^_kDP6J-o032Y9LBn(qJvI
z$A0{iGO<ZyxsZX#6Q5L<R2iD69p#ZFkBnWQYz!41b*&zLk)e*OuW!9JLZlL%YN-{l
zktpjF9z?2>)&@M}1p|A?lD2_g?F75XQ;!ej^@ly{;7RCv88F5#JUa`2XWHTzbxBto
zfl0xjW01rG+z!@b^=oAGKl~p*Ag<Bb2~3rV*v`htx5X2fuBuDeJ1UXQ_1>YfW`y0-
zyYnYTY_5Uh2u-+Su*!$ex#ljFfb&d@N_yHj;I!aBNKXaf31i??{9a@yfmz(Ect#_F
zzp;aqZ=tV2;iLTs>JGX_{I`swQXUnKqGBBNun`LmPZ4izkLu7RxLjT*G}wd6{&3pk
z@*>}=Z2QGQV0=<soOW-xrLG~IM%H}Fn%Z*C#br&3KT{^X*iQr3_Lo3#d@|&fJ-2V)
zj-bkZeKo{7*HhN<KB~tUeF4h|E-b84risA92r#-_PZm~6!KDyjz1)eXgSY!%u(_0#
zMmTPozr^DFS05ZWDC-vw5L_h+XeZLTmhdI!hrp8(Z#3pe+!HgV#yyEe%0t#Cf{~@H
zj`G1OQ`LBCziEEVXyc>kP}UYH_LR|ou*Q~wG23l0w-vObq&lJDlrcaavNJkWzU6BR
z9&+m9+aPgd3nA-eAXpu3s*eIPmaRv={(7eRLoO*1SQ!Bp`AO6d;7*b`DNi5M+Hg|)
z3+eY)T<~C)PKIS6lj{;HO<1BGc4f*f9d#;fE@Ae<$5Ds3v)o%sSA$AV2ZLhRYX`|P
z5Cm?^jF-M?4tnJtl;47%#8TgKmN$U_L*#&`gyVjdi{J@g`qBTB<G%Ay<UW_N7C*Kk
zKuj2Tc*mK4gRxYC%}BQ66a9e=`0fw58RoGOG_+Yt`6CfHuL$HwJ<B^&SD<JC>rPw*
zfXjK4^rEgJWf`R}@v$)a!7tYiZXc8&@WJ58I)2$!MqcUXl6PQ&&N8F8;MyoO*(Dn?
z5bqi26<4#FT9*%jX#=AiNG@M@Ppe13$~sE$wtkV^G@zGj5$o4ZyxxZOnDZU4m*cM)
zZr>(!mN%`SIbkgxo`si#``B(bhHx!#V-4^caHYmPPy8aoMJ$pFB0fo8li1iB@Y=y*
zy>U$gxs<6x7GL_LY##f{xBj(7eJhXb81)0fDBw&%8v&oo#zuD7LHH0O6kRTzB2REu
zyYRj21Z4?1<f-GLebl$UwIwLX(N5ZoF8m<?F^7^8ft3-M6^LDR(OI-H+Mm^iMQu%$
zi^a6i5)*}XRjv3rP@igl(-ox&i#4Klu`URUV7iD*#g4`5;x9DzVA$^^#>A#?^IGjQ
z=7)V752~%|hY>i$Z3QE7)Ej8Ib**3|RZbCsI&L_e^FB)MKOY2+;+?_prY{F|ttvlj
zw#Yj7>YDEw)pRGuYzfp1Sjvxl)%FyA{J0G3QPca(UN{6|a67&)T-&c!gSk!h7hAE$
z44w+Us5j4kbmcEG20@hl+k>Zq>mKXc>3+S+Fs+!aqFKjQJ$A3I-yfmtv(&eo<;#S?
zv~jY5KeW6|u+8lYYYM;QxpwVZ2?}%mI@vGN>Yd`ti+$SI*F@Byu%8#^Hto_26r_w}
z40>zqWUZaAw}kj3IX<Wvm8VRe)VL&aT*M>^{I(zL7%tpEWFc+BBj%}Hb+oM<I@BTW
zc7_bR)+X}W(^jxbJE?<*zBY<*l!v4M41`c3)fmob1Rd8PDSUVk^~ej3oum#~2zl%x
zLxYvEGt}unvISISDMRQOY{mw8{MzQop3N&GUUtV(_ZPQ>gJvXMN(5YlhQX!H^|CB*
zF{Dnm$*ie;(O)JfWP6;<Wk%PkbNSO-w${d#`?8?L07~o@)F@(QHEEZW740nJbKSDT
zF|uyM%i0^v*WsbTK{06_Teqx_CFLi%Ued%u;_VPxNFjx$BEWb)JmiZ#;@A;Sa+G(y
z9mNqQD$2_v%1vDzamPeiZKF`vfLL*3Oq#DxqlEil&>nu#!MLt}PB>Vn;SK6Yq{55B
z>Mhh#rinlzaG?;0NnhtZLE!oXT3JLcN+)Q%3s_{!n#j6Xo(PVr_)Cqw__8?Ov&lPx
zUH=RMFWt=(oC7wpzHY?m(x{}uWkR4orkeS6nYu||PS&*v+QHh1U@-3vUU`k_fsCEH
zHgl}24;ql}$9h)Q>c}UJBd|$C2A>yoVce5Aq;X4vvTgj4xFk;uQ*Rye$Z$c(+$y=_
z0a|3Vk6&c51HmWWX&~4g(K0glZT0m@9n`mZEFg>!N(OXMXaS(k&cml{BjuCAr-5AL
zmBlWBTN_VVS^dxfWUzxAq#Zizm&s{^vOchZE=0Zhg|X=$1cLwT#~*a0(62l~_agnG
z(3E2SxFiVFcdOOGH+tf5{hb>uL}8c%?|SV!>82T;=+2EOQuR&OwHdCrm(^OuZeov4
z>~7(HhkHJ(EKSk)_TCo@-iM`)%~r5=!#=Ic4|eE8+Yy?wF8edOWnY|2q$MA18P4Ng
zJJ3;YhUv9b)h{DEoqeKwXkJUJud<OC8_|7+4DY1e*|`?iPWkgbP&qoNLD~LLUj?!1
zX`mVY%GfPMXR6bxj#oZJZ112|T3B9f5n9KB#HTUuR_Sl*oL2-`yU%OevRw-yFt~-~
zN!oZC7%Hz-SV;MN2-P(;p8loz<w!x`geU2?V~yMIZr!?7)@1kkVXH%t6?2s#T+RYR
zL(6B@y5|n=;qt9WjYMEF0+Z&%=yWkz=OS~<+R!`i_xm%u|Ad@c+K#7#?<n6XvDymL
z+N$|$*I3i|D~E_N@X8y$05cvyD1Q}(h=<EL{Wxy<a&ov|qc3${PamBZ*dBZqG&V{V
zgP;xQ;*<|@#3@@<_{KSjPZHyVFe~2yWdN6Y<;YXdWz19_{tY@~5C7Vv4F#3~FOt&U
zNq(uD7!cNo4b(x~5Id_ZsU0!ZDSoIINbOQq#sDy~^07mnfG=`%T*96<sUweF+KL`J
zkiKeZ13&vg;MT?KA79;*{x6^1>fUy<?LsS=`9$F2Bfvy7*vUqgln9(P0tR%CeK<Vp
zhHcn?&b|!;+?eNGl-uPU(DjHjd{Q`MTn`)ZjbzJ*g!q6kyzeC+<-s~kKw@{7Cjp~P
zu~3(wa<mye+COS1tN3*Cur*yGYZ8G(;Or6T&D6odz%M@uobr*0U*`|ki?eU=axI94
z$FIHW>w2P3JPCaB=8Z_}m$uJd#g=omy7Yxbcl9o(W+Jdw1kT4yp4TN_6;a;xJ5O*<
zy{k57NY`mpIIkT<Fqm~N>C6$R8)%JB8mDCAfe89h51%}n02e&UT+~6_ZuOBduN)~s
z!<HY#p-prgGRlw|vvu;=26VNpt}@h(1z9OmsRPO=VL&AuDHGXJ=M%X!oH}G68vzd+
z07Bk|M7Hoq=>&ECh^Zi|W4-p!)4zU^(KqQvXjUM&b@-mg4!eK8x!*m9-W}^+E1CI=
zia>e7Fb<{lLw32*o9Rky3guhp!+PB;=D6Y0f6z%<G*Ne8cb0d*0kvW?OY-W~ts_{@
zEil+A*6T)cc<+bzJ3c@TnG?JX<)V(L(+nD`ZS@8^Qy1<zc84yp8L|d~4<q=+L?}=C
zM4jnSJ~9i<sa9c)c|M%4lj_)*isCw5T`gP8yIzk8!<K+-{3%~~g+mB9miCYK%NT4z
zwLR_i6puZD7Q=}##gobsPnVR|5Bk6uDSzhJ^oV&<zJMtL#bxdc=3B8cm`{9pUeaYj
zV8VdDEM2>@{ix?ew!rvb_B#H0p}$6KdQDmv{B<vj50UYgRjfS(UU+Xi>(kz?y?7${
z=I~ssPx`$w1#te=&{8%4d;_#0vm0n>n!HR1OdEIgEO0tKEuX1R$JI(+Xdj>FuHSLJ
ztW7H!87O(i3PWMDuGidy{r&hd%=jxbz6_I~@G+WpqYxaN-;U`dV`&5iP;#4yKSHD~
z`otZH)*Fn4??G8Pbd`^6sYjk*vNp>wpfbq#r#x*VYdhfS3m#>t^`n2&DpBogr|=B0
zDqyMu9n-K@5vP<PQtBD0Hio=lz%#E6>~jGi0bT0t05asYMcH<ew~P#Wl#!*a%3-%W
zCA`l0uxJoCe0OhpI3{m=3;9#G_T%chM~6+LHYpKE1QLNnVBHA#;gL-tDG@kL1o&`3
zK(&6wT!dTVgTl_yc75mDX*Oi0FMdffIK1)dnh0VuXABmVHkVgl)T31WK!yUZoZyLK
z^f_uJT?zy|bzh3kWG5;D1T^DARLpCBF;(aH#lO+luSd`&`oy13-+1gs1WEQvAo$|<
zEXQpkkO*8v1UL)r?8K`gI76MV14ZBOqA0(>;~}%bUvZVQ*J1IIpKVSE^or_niy`1Q
z-U!Ds?*XRF)jr0}L7I4|x6Q*das+}&jei<%g@+IH;89O%y>ZXBY%m%><h9wxQG;D<
zkm93_)51FzrNkJ55Y8aW<Z%K~XM?Gy+|~gCeC%=I*uXD($Z9{bMFt&YsaKa&yXMuc
zpIAoiQw|&W!p`B~CPsF3S|$*zmnR>_7Yowjq^pAfn?iffV<hr{dJ|Nhc#HvtJ2oRS
zoAGqA)|dXb4J-JR9}QNuTmlWq_HjH}6E3}W|7n);WMGT=+7O5X%G5`M>pdL0DidM6
z5oNTFO^~7VvCOz;Q{CF-iJ``x`AKuG1iS{{Jl<H_Xx69s7e6faFl<^!js0ubGqTfd
z%}~0URRPsH(BicV2S;(#i6Be~#Dvvtf~zr@hfn98A;M)VqNBaZRRhHJIJOndALL3)
z%k+vLsFn95ms46bP=duJP+Wt=wT$^%KZfbR#u;`$T_*w;7J)LO2ET~$mp68%op0<B
zH3%FZhhhSb=HMu&-nmXo+c{73R}Aq{E&$+l5Cnk_;+I(E7gI1}{W)53ZK-F16QB@&
z7bWfy=d`j0&rw>!>>Nv3od~QSfimi+4E;sM_cAT=>|D+k%P4L{mXlFE+h~4!>sq(V
zyMu>eD{EFy>tAzJfcfRu!NKive&iSO<K7qWF>Ntf_l;VhDVq|ZEAD}t@=@+a1>g81
z@kQdA5H*$=B%G2-BM4Yh0<@Sw*VJHez0tJ}d&pp~9>Z%niiN0y4E`d6KB;x&@edz4
z2z#w>>TEmpLo%o;!^U7hBh*<oPilkhtn%2v835Tx?UJHLJ-!Ltq6gU#^6)5QgT`Bq
z?2zEuF;d&3f9!8-e5kcxW|biDBBp=g2?yQV9^39dxJQ$dE)xRvj*jkY{nCq7N8lV}
zirM%vT<}MJ=V+d4^|9WUjY#eQvFJm|MM}-EOQ+h>3+$|a>xFkCUFtiV<)kOuE6&oK
zT~`e;P7IRLWdl?UpuVet#%#0euJzDWocCL_inDdtSjBJZEQUag!uVfa9}y$aFLvXA
z&wxCPzZg1mI<__p#?*j6s;;^6b1;tM#TaG2Ip>&Xd?D3#oU)F}Q7w8Gvh|(B^~o0P
z<;XqrJD&}>;0R2cOC@Mh<{|;q`kwHz;9SuD(jS7_{3$j|&)(i%d3WYv2?Y0oA|bmn
zh3W~k7k0~i+oB_jwDmL^v~bH)FcCOw1e_4AerMgDasNBlcFS5d&RxA!-yO{BBI-Gk
zzcS}F5&RNty$FEodM&Qr>yv6mKL%&ilUiCpAJ72LfGR0G5BJ0$3HHJxehCqaG&qZ#
zdE%euv15D`UCPE#_0irm{TY9yjK1+tb%Ryff=viH^4OwX+KFssl+54<l?Xzl3gZN_
zp1M}fjwnN8l+{M7BTxWGqqIfmC_~5yj87M1%TA+X9$9T5!|NhQOH3}(rRYE2d9(ZP
zo@^7BQk^UOs=E%mAA8(k2?!Gye%p=h?n@#xS33nR5&~sF4i13?t2RMHyMqHKhw06D
zn%?@_MW-Kf5g=Hg5hEE6`RMbrwbS~PUkz7X@_Yzt<uX6QWU>2j+K4SMG-fu5+s!?%
zV}>*+2E;OUhx4Y`nmm9e$;cZ9#qd3aMlzG_kExZNs{VQJXe%3&$igxR1mp{#zKq3%
zWm%hQP&f`T@vh6^J9pvpl;1J~bz!d?5*)U*&M*45)&7-0OvH*a>o8Zm;}b>%bc$+S
zsAGDv7V+8%(m_yXP{*CZ`tW`YZEmPfX*LnKhzP`dse4M9gz>&|KK{h4DgQkO4QJ7X
z>S0|wq7M-S<{#_ity}Tl%<_a>tQW2swa3f%ZNi$e7*bQDrm$%k?dN|>6o*S`uc9Z~
z)@D8txKIehG@D5EEHJU^OqkBm_KY&WA*0T*9`VHg^<7>U5wW6a9iMM>Ou|?Ez^t$6
ziob>^zX&5HxJD`q(x^Yx^28NtjZQC(DS#VnzQfd@Eg%v+G$;(;2p@V})WdI|5{7SZ
zH?l<rJudyBqYYDIpx!*>v9C{4<&i^&6o2H0WbjpnN~9`k5E+!)vhvE3s%zc`+X(nJ
z*e8UogO5ICQp@Ba%IJH+=h9|mhn=+!-ct0U?OWYDKi_qq-M-#EE54cg6?fB|_0o&3
zAI0O*2i=Re_qzZ2kvrFGJguD@1PlrpNZLfhitPyp-c9(LW^;T$<jD@E<Ro$`kLs%E
zKt8HliE4)@(W?A3t0QZf^Ija)N7T;^AnUq!Whh`Q22Ob`!(i+ezMWs7*Ne;>WQKFN
zxOAMBBjrpl>dh1yR${OI8=nC~fy^v{K)Z%4p|&PbgP(CHV?6StaQ!05IKIS@E}osO
zCzdsNI~_A4M8}r)DAXCjJgNO9gEYZme<SZ}ZHQqN4fH~h`NfB;h!ZCz0*SyB1j_7-
z$y3%7<`);`GSj9gT@W^X;TLD@djvuD<4>gb;|r9y*0n6u^{Ak@94f1*6rBl*6FM_N
zYPt5MbRuv85MZ2782)G0@>p_$;>Ym(vPe@<syayXg}m+S9Tu@LONL-DujOJrEN7y4
zGPnkXdw&%%%g8cy1%pQ6Jl&wCS?4S(N~COB#6t<x5}PCss-)DDhYul30JxQ*&LFS$
zf;Eg`s;f`^S@sU9OA3!v9y$;yzU0#mc$A0K4+v9%0K$;Q>;wkU(HLb&xmv1?Le9n!
ziMDg_eG-^@eYKs#u8oDSU()hragk!rc9Eyu+CW$TkzI{=5Acn6RrH%~SC_B750fXS
z_uuTgPu<$@?hgBR6>}L7o`fnN95;F3t-;3XnMHV$w2b|>T?@B~PuD@^XLJSJDraE}
zYZY7u&Oy^-BOFcO(wJcf>PToCSnc=jnesh0Kn$z;b*<4$nD;)2v0apJc~;ujoh7^O
zy7Ajp?;`DSj*u3a=n$jC8@<SUTUJIt^l`jh>*)3REv}<g7skdpgpaYwpZk@$7C$)f
z7m8EN#S9A19t~x74t_94x3=n&eMKw!&wS$_!QuMUbe*%jdzp#rQ`P8FZqquq>n~?&
zH9xV5Y*Hd{c@P*4>B0Ce^M?6U1HxtB3L)mwMWwP9(68tMGnu*1pGDuk9Zv;E-ayUD
zJse=RX?$w?R%qo4Dx2<0+D`;Fia>wNmyLX*9@lJ~2FDfsh!@&)ySv1N`kh+MCF>!<
zWzUGbDq<K6j)Tx>tuH5`)tsc(i4b6~3NnsKN*vSpC4<AkVEmDIC4?Mx$fC!)g$Ex7
z%Jvt<Qa>1ACEjUllRE4mPf8GyI?DPdkFJC-<g|ypdF>!$n<86jQiKyl1a&})5qJ=d
zqEk45$m>i!$~K<7erz~8kT&R;fnIoaMj6WJpl>}XWo<>akZr*x`4dz5g1E5q&d=|a
zr-n}w82-~oA_#mK!QerwZukhziCcLI4RH4ybsOql2`CL_`i5K-v*i%Kpo2EBwV+B7
zGe}l9j{xr!`ZcY6OZB&Y@()vSv)lV!iZZ58<)M0+?(|-r+Pb=hsy|*gt^JpQUvGc(
zH@e<GMih(|h9b0u?+k#knY6+A%J?#XG;GqKo^h|vu&$R`WPDDNnZ)avUa5%PYI|PG
zS2BO;mCh$>F>fN+xgP_!Jo#}co)n%pl*(dLgxrq?g)(=C%SeoOpBiSq@-E`xt2Iyv
z%!+KJ{1pK2U*-!f%YC-4tZMV;dhwq>5`hbV0HeA7H39npN4WB1tmT{9gT|a}q)_)b
z+FyS+#*=VI<%{C>BM|I<K3pTB4dho@+wrlAUIBf{zOQmWR%+Xl?Mm@P;5;GFAM@wz
z4;UAKiq)w8QhI0SdUq|Zbx~atYbc8~vA!y&J|WBs$TlF2ovUQ7BW<0u_Ub{b<y^^p
z+!lzR#2tw*Lfo`EFiNrfplm&P-h^P>6uxoHHvS0@g4f*bQpN{7QtYT7*)jjf;15F1
zvbHUgLi(?z_-UY42FB{BtiqI0wvig7j1w;FZM05ogfcb|d3e}H7O=D%*;2L*wntgy
zAls!+c-Yhz<zi!S6DhBS2o9elFibFb65SIme^lfq2_$bb2solPV|_)d(Wv%4jgzb}
z113=n__ATJxR<`2%MOmU+!mUSRn94t`OS}^G8;C_z=)`t2G>Yx!Q7&ThV5C<?uNxq
z+MKmwII*u4*zz%M;A{{Qs(((-xJED1;RmpCfa%?k&^>8iCpPaCnDpeLw*3^~xqvR}
zU@WgS;Ys1advA`vKEg44&hGvun-g7jeiJl5;tQmBG7yS+U7jKy1c`T|d~^+kkc))C
zQF*6mDOc>u&%uw%sixYWo9s^O=R)NHD}gz+TL#pQ&oS7`UKSr(cnt*Sm#DN}`B5X~
zC^4!zm$^Y-hCz=gAH{lj`}SV9XCRn~9T=?KqXB*=>;HW3^CeE!g49j~t_%V$V`tFe
z)m_)mm%H(0a%Hhv-B8nOenD3M`h(qpzm(vNLr~aXk~P9J*T}Urr*%f2MQ<a9`;Jaf
zcKv4`*(`BL#R;eoKP8|?*_dTy3sG)^x8x=2(7~2^)WgH3K1c~>Sf<_!erty^Z9*2J
zj4UZ+{FOXBZQ4%w#{$9#s)#WhpkNe}GBP?wh7OS0cy)A08GVD#$nq`??AoEo4t=4A
z4i|(BJP2OvAG?&HRt6npj~pimEK2{=WA}Bh+>Lid1if-M-tRDhRt*gEMDSe`f_=aG
zl>P3n_O?2{XzsnY?D_=9SBNzX{A{St*gwG$bVIF*0bK^|>@iTjoM=W12nufxeg(VI
zB$#1)-BkukR<T>58pn!Y!EsWC<tG-0LC{#)x{uVlzOLgCOc&j6%E;1X-{5JNqaF5P
z71u?VzAVxI<@}6ruYsWYr7~q#2}8v-1_8fW(EIb`yw2x^u_*lmi}NyY7H)Y8PDCK?
zB||pq2zK7y+bd5B6A)(2+u>*vOBG)l!rF3@IXcn(37E|^JAsv1s^e>EeQm@*KCmc3
zbdPk=7@i=8Xczcx$M-t`YzZdwg;Sx!g&rTM#@349LF|J$vkDZ=k2*#RWAit?@q1OX
zjKMk{c_Q9DY|<I1N*%|k&JE6q)Sc%M9eriaMH2~laPbPAy_>hXy;uvOVIP~Zw{(v}
zx8hh#F8-tOxv)~`@GmJ5NCZ|xV6Yvpro1LC&I;v>u#7!aLY}k8wQF(yD2rG5v5b{t
zvYco53$l8KiD212e=Wh8aPsHaY3IZ^0WIIBW38FOn6_4)gPU1D_to1`?(38;tcl%^
zKVp_az|A6Mb1-H}nTt3jJcGW*Q{gE?ifv^mL)s$W#yauG1y38cO&teNUk)D-ZPia<
z7^E$Q_<^EA?s_y{9&$Rx5b~r3g>gjQ4*T@4Wo5NZiVik?tXf<8L08}+TV$!T9v(W{
zLRL_BRvoXm<2OM6)!j$kmmlqR@3^tueZ^J{5aX<+HZXkBFQEJWyAM0Af85{d{=dhz
zx?g#Ot|TP_t0BN|7t7{RW}8!PHCq>1tF8fcZ6sfi*dCO5IxRXkZNF>#?T4F|m-%%d
zP(L(c$)FAaH1ZYmt2=hrfo|G3KL~Kp-`e7fL*f7v9|XuBMByO5Kq+Yo0<l0xsJB!e
zmiG<E!IQN?@xagE+HU0iU{!u;8oC6bjs=O;%`_1>B?SCsXMGniPlVO|?v&i0x*PWH
zYw^WP1iM+^9=q{a$EzVu;Y0hW_ca|R0*S!oM}S{y?d}q)S`V>Cj@}&{uNT|r>EQa^
z6S+>V2jewcG4^Pjk%KAm$My^3$P<G!fLB5cQ6@zeq8{SluML8X9BV0)B2RtGGwz8D
z_1eT97xn1C*FUn5JoU6&YvZSllYsyiMlo(41CX7-QCnw21gUK_dd?tpXsr5_$<q#O
z$S2h&wj??xK*&&s9J=^`XIrp+$f0Xl`tKiiv-^oBU<%spem1`O?Vt7^*S-6Z{q7mv
z^uTcY1$0lY%1i(Jm+0L?HxIf84tO&8zNPgqlY$@UGAMNXuKK>kvT4+a=W(InP+y)D
z9?SzL)kNV-%B*WZ1)#qk@L^?zCE}7IHM?7N9x|rtxSB0JzZTrf6^AU066Em^)SvT|
z`2>At_X_`Xd_y$)ld&`F;f8vaW?KXp-}~{WfICO=1tL4VH#dSN5ftYB^My)0Exf($
z*`w85J>OsRR=0Fknyd@szRQ!rLsnGwrcDjL1-|j#W<GHF4Hf9|i&6sft~b7_qO3i`
zHHKjQ&_QMrfw>5@!=>z3p+U;ruGC0GwhZY@ILHWimq2jzk-2vBv0L@2w|0L&j>v#B
zKk+P}WP_@#$?1YvW6%3{+|a__j;kgo5l95iJp#R>MznVjdyDmh_Xh9qbnq}db+YcT
zR(js!jKkBx*k;}ApLyna;?q%oiSw^X=IO3n-*?y=TDAkN?h5&`G7tCKo`GiX>D4S;
z9CVfVqXAYncH)hL0aD_R26btUd}5QvE!Ah3A%hJr-<klQ4*<wP)ag%O@E}rnT#$O$
zZT-X7pR&lKj~sP{`T^lq2|<X)U{FGatL583_{jDh(K&pf12{H<#@SeOw5fcsN@wqg
zlzL=aUHzKkpV^9Bzi+`>jGlgUE8Y{_b^qA?|Lna>&oo_k-__Ugex4_>-#D3pkQ`@%
zaYhVq7&%CmVqgF>81WGp=aX>w21tkr0|XL6iIH*;5)vW^2FM}=lnKT-uk-r3uOt88
zTJ^8qT~}9kRd-c)b@yKPUDrOXz1G@mpI7bP^=<XrPoJxQ?JqvAep7eY{pN2xtp2}`
zpH_cIhT*@gyM(uaKR~xFZCBi%YNPT$|MGqH)7$se54#X=DUI5!uvG)@oK;0z)l(y9
z)PM)zLs_uda{CQhEPg}`!%Y81EC>EWd0s|7YvnSetx_JS0WD53NV1H&=gZRS4}7&6
zBg%(12y6x_?9)JJ<|~32c0b}JlZ@+eZ4$K9x8gqrI-aL?tO)}#*G^~+Mqb}fyibCf
zUNvA1<YqiK<T1ZByGQ&*(=_^Zy6RsKdYQ$~sTtqCf7jIzx+gfU#8HW-oZY6RwY@Ut
z=dhh`jjbA}8d#zRc(E5Rx~3Y*Soeu$?s@W5Fl&)Fel4bT$YD^9TZhs(jPnw5m8CD`
znL-mymDtwE0^aP1!*BZ~?05*{V$XCsc1gmd**FUhG%yN-XMEyqBPHGsd3h`gu6fx;
zs;HJeG{AwL?XBhy%@(>wQxYv4elxY;5VcScF)`=CC6B@QxCYYA*R(8fDYWx|OS)yD
zK&07)27K*;hu<>Gdl>vxod*6{RrH_!@!jfQe*Rqj-mg8b{*pNVyT3rB$JKxR&)!x)
zy>B-RkLCFP{PSO}ej1zU%JFR+vU}ylJ*arO@1VJ>6ZA|XOfsQEZG_idHnP+|RRiNS
zpk`!~ZeN?*Ml@Pqvr&$8wbzX|*k#%_0;h_TpiC$wAbUH*lnE30^Awr62DgbQUoM%Y
zG>17f$WZ;RaT)hhCxy9}4r2-~Cy04D5`9AmIsXl86G9t^IY+UUL6e4qVg<1n#jEc&
z++iG+``NhpDF+O8pYbuTTwXT{RQ@<Y94CtNj%VlvSrjZ!vIyd;BT_FPqG*?2jLAyi
zYK?hLm7L*xsQ{C<Zz{pK;adkLlf{JKX*nEsa<?rnlB8k7#*LSkpTii8Q8-?(1V&0Y
zSS?Y;9_*gzmc!2U#47);^;yQw>(9}tY%}xntJJFoss;|!K&%&<)4>lu&v+m$Wn<mI
zdV#f`*Zo`*@%E~9pI%J!F}Z0#<8sefhzzWIW(5jaLN1ufnA7=p%qO{r9jprqW&5LT
zjdmfzLm2xbxIEY@jbqnoN@@+j&?Oywz<%35od-Pp0DgE92H$>Mz<Dy1IAwm)joTV#
zjcgafWCB1g{lu9FEtehwJ`eE#eypa1%Xk}ttt@Ce9e<hMLKBaIc<}Q8xLDLVJq(y9
z@%WGLxlk4S_PtJltE7MUCoii%*G~ri)~{zV{vh1PI5GUc>Vt5<1Kxq~$DjABzjBAz
z6|8|=Y&%rlZ5oKJfqKm@!<;)zY=GUvwh^mwRRaSx;JJRt9PfVIP9n;*t-YSCX<GP!
zWd*J6LnHExLA8#?<f*uqtO2zs{m+ks%A?iI1E*TmHlMgx_+4uO48u{xll6>CR%k2x
zhPFIFp~y(!j{^BW{rcO!m}27)8$hZ;8!BBn5t}w;W3FY~qR#v=I~(mq;!2>=&y|$s
zm|~!b9G6w|ES_i^dVtoYQDs!bcmL4rrUu&KxuMa5^q?16`jrFv;GS+i7Wek1Q^CCK
zYJ@yQTJkii9#_-@n7J(D7#)dyjB<`-U9(pWR1J*N059twxDQ?9U4lFCI67c6t}$Ld
za1ekspGL~~m6BedF@|Ck&iUnl!R(7TJv5ll4llwNE=!LHE%c}&)G$C7&3t4`T<o7z
zAg<%(4f`YU81!t^BOSvbxW*^0Ojj^~I7<r-v<R1nT#1JcG{GlqAZ&Z7ZLOr0amFq4
zZ8ZoRp>z=l!X{`zEGWbgm~;bSXn@0mpM3a@hf5eJ6+qbhDVz(9krzM~;>hECxX|-M
z*fivw27c6uU<||mufB5qZ|KDEFC_inl>0YD{vZ6=^9sZ8U+eh*-82$ZDpdp9HQ-Ik
zwp4c#%{DRFOx`iJF|Bboqk;a-8*i!op{M4Zw2d?;)(&mHU(U5K{e5GWDJ2+3-yI^{
zTFlGzwFA*^@du*qCUOy}Yz7ciOByvi+5vaUJ;)Hr(uU1J8dsWD+21%XqO@lbQaa7{
z)ZeN?t^Cp0^r_8KygVgX=2dp;hx?ydwZ>=${+GvTlr}4@thRnBz&|&XlAc?Z3Hi5k
zPNRM5vP0hMr%g8z*SKq6WbXt!Bo7X{#eN|$6TdHf`Xa<1*>aq+K|?2VbpQGHm+#HT
zF|!Sg5!E{HV>?xR$fQ18p=zLNplV={2AK2p(kourPh?WU5X{3+#QKkq$;HcNt`a-J
z__T8zWIZ!TF=LV7IuGTsl9c$?MM&1J6H1Kq7fH5bM%D%sKek5zQmpE+Q)1sFjGuhC
z&Idkz(t~}+Pa62(nHF@RLmaeC3)j4$MHpP;SRO^SJS{J@12C$VKxPxcg(!~;;j}WJ
znF}rQ;<|vQ2V?S*55M!6hoS<&2TUK{;G+PaL?+B*fR^)>^vHV<{Ow=;V)gq^dD{2)
zpZK`jSKtoe|LIR(R{!+w+v<0lJBI&;+`kd1KgnqPtFM`AOx3_l8rZd<c1K{s*@ZWg
zXqD^@XdpJQZfKqIhQTDQUY(Q)gL@WHOcH?I3?1;d%coc+96+tjLca_hwlP=eQTym=
zB3D@0F-1zF@aN~7#%Go?X>ef^^6{bYoi+=cxKmr3YpFg)+DpTYp0%gpMe;VB(78%%
zw<&zgqx9MM*=IAZXmE-9hrtQIjm1sfb!arC7Udj0J}#;>g)q&yomEV|sarL1#`5Ve
zKJ<8YK)wZzmS_h3JlyALxzA5d1?#S0oebs*9N-}B(U&6k$UmJr9FqG$PD4mnoT`DU
zfh*GhhT!-x?O`L-7H#-fM|WD^vG&skZZ&qsi+@ePrx~C6xy-i4i~+u9l-JtmT+prq
z_N>pEsfGezf6U1)mwql3aXi>dosLU7F8T2Lu3+LQxC_tXpE&HFwz-lA`=@E(lI}dX
z#NnDAE^z>UXpo+pi;OGjDJj8*SBEVGL<}XtQV7yr0EqLDALcGN>Ey96q&rUD02_M=
zpeP%D!2`&{hvHm7;!G1hmaog7{H8&kQSkZrwEBaeK3Bi<_`~YI{N?BBH+7%zHsAwv
z|K~5iul~;Gx435*qi}_)fn{re?o)QB<E3Rh4~o;0JzlU%VO9-zKNc;jX;v&XVo{-R
z7_s<?wfvkEo&{ziJBzFxqK(Qru@@S=;Cfhs#%T*__<fC2!ts(oeda+%M{Y3)g9{%%
zL)iG!NNv5BaZOTnrq@7@Y0yoDx5HZFiH`*8=b)}9kAZn7ar0ApCAMQEm^~Y!<S_MY
zJ-trmqBx{!8z*H@sEBC2ZQW=~u!%C4=+{RVy~VE=nkypo@uTnGf7a=?*O=!=6}as*
zqjGhS+uH5KZ#02UT7RAn;z@$^?`27Jl44gTRRhb{Kx}F`9sC#{|D9yWQmON!wmKaw
zKWhSC6EWT0!N;mLcW@;YuS3eXYw<_f^k-xlLC3y`%@UwGu~h=tB@N(Uqr}D536R(9
zZ0sdm8j8UKpovkjw8=WZX@duUXc1TPS1@=*b8FJg+i~CoY_ncMtQ4|jYC<j`M8HRA
z(lFfGZvk<k0pNm%OFVvLAWS}JnVxa24Dby$0uv_Pa={;Pm~uES5{CTw4}bc3_3!@%
zVgUE6|KK-PtAFzL7gm4o&)!xTfVaVK>6(ZaRp)=A577OaKb3X24ZFrw4V+#BeiIgZ
z&$2fiDN62T)#XI9|GndpOltN;YGB=_(om%zLgmS;c=Men<I=EofcVV{%!By>6eiEI
zO_rm&k~+^F_lO-uWb$GjMDPlVa8S9Y$)uLmG%gH?+#yW6;O;t3<lWz4gt=e6b6QyG
zd732i#FZ@52vMmF(16FhFQ_>Y#wL&Y0RmU!815r=`G{Xt?K%|BhwcsJq)=n(Co%H!
z2fTo0EG*M9VZy&%UK5f&m{e2lJIRJ7VvMma8lvrsM#ZnkAo=*;!97@xo6pFH7awID
z;k?f0>QyI#<BABiUAM`#?)NB5b<)<^9@LHG5p|jMK3Jj+HYW|_5T0%Iq>L-Gs)5sL
zz|+fVxgN)jaq3Zb2ebZ~3NSF|uTgRxhd~%)FeiomE0w8u9YUu&cE-#*cjfIG+h^t-
zYpiiRN&}zml`K#Ao*4$hX3-XQ)DqWrPFw){r0th4@)OTf+Fzj$4QTQ(sS)<%MmqQa
zwod%UbG-SHhct(wgTIv#VM-to!>p0a)I=;CE&xOOEvT80$7$dK#=(V0H*Ef0KF~x~
zD-V~v@Fx%WB`tUZUH%!n=kLFuI{m{xS*`x4IQ9E4J$|nKy}$IZ`sK$@tN-qoZ>!(X
zl@Z(EU(tu<{_*x(Cbps1xT=9OX@D+5m#I)SaJ&XsMC3osI5LKCnvse2+FRH$<;zJb
z?<Xrw8OPVg87Lg1h%<<L2`s~?s7As|7JjxEch1Q;%m>Zhwe;cMPH^7eWnj^X)aZl4
z=iXbOR>}Em8AI=Sz0JpBs2Gow@~S?co}OYO=#3Y9lel_9u1^i+$Lq3Ep%~D52yFy1
zeL;W6x5cInhpto*wf`6+6`dQ_b>X^Wr}enTsJ^2#Af00n!7##{{{8!R8H0b0d44$E
z@hxCD?K;+t(N)E*8n_${oOfP(WNzlb#zesPAv}Nix(McOjKNEVT_g8-YiCN0QOez=
zX<p8Qgk6ye<FPRn0uF;?JlqloKXKsGux!A^PdqfBPrOx69@4RUIvre26uWVP3m%X2
zK?gj8aR`%-2mBUbP=Yh#f{bh8Wk&p@J3lzaH6znfQk!PF#8EKQFfY@<wK3PUjZZxM
zacvlOenkb%GECe-;8VZ<u}=N|_VZ_aJnq*-`QP~kY#&$u%|Clv@sYU-C(r;psc~;{
zP9W5UvS{?k#8h_D3oT6*djT4_=k8OrE1z6s(DuS-r+D=10xqsSTK)sarcX^*clZ8Q
zYN3dQdR^Rwig#6F#lnY=%Dv0PCBrYLN8;y;7{`=|pHq5oG7P_b*V<5VvM;JV(f2SQ
z%Ty*;XI#SY2n{kqx58;Oko~2jag7yWw3G<Cg0)zYQ+e?}>rMWrr~H9i+3y%?Y%rED
zjC72foHQz7<K#<80KT*ZplJ^=?lxnXrS(R*#myY~w?ofK&g*cv4X#gxnywAJ8@Np%
zKj0(XlqaXRAu7(g+(_<`Zv&?Wc4`2<QlF2yKJQUu4dFlk)vw~t;GG#eiL3(#tpz&y
zXq!U-tR<YR8zO5j4t<(L6=qnednwg~s)4J~0CQOMi*AW>!s^CO8s-H&FKc6OGXZ7B
zz^5ml4mjd$TmS$-07*naRMvd`@fO$Z@Y0v5ce!KOj`5r804LDRIZ4F2M1yXwt9F&9
z9hr@UA<#xyFTSun0uJLhJ}&8`@z{<^JmC`0c1|-T-G1`nhd+7nI}Z9~SiudtrU5+w
z{AMwj1S7Wj1G0rO5*ZQB@wlb12!%BpARZtuc%+#Qv@NW>0nY1u7M4US0GAyzc>(CU
z5V-b}*H6h)(Z|8>=+rMI{KG$aS^e{e=hYwlx;nK;{w=u_@$c%y@c;HAqcM0Dss^eC
zss?UE175`NhMSX%6^3gdCaW;+d1@P;w_@I&2G|^7^z%t!48A}9@Wbj&C-*ol{Hi-W
zKeWlvPD7iE=H#$8As@0jvgi%NjM^K<wu1~bx2N)xme>Z|97X*%T^myoDC;ioX^$}k
zqrW^hqUJKV5gmjQnjyN~X0r<l5MurpEyg3g+;f`U1~YOHC#K#kW1vnlVdiZxHyx8f
zRv_u5&r(E!{=~`Z!0V<Mqq=izfVzEn)X88OgL%>Wv+fIieXR#z=GJ?qUo}uQaDELu
zJwG>d?KHA5udeq?GNfuuW!{Wmf=$DsQkh=^EJ#=&Ve`a~?Gir=AXY3q_<3?6)hu<I
zaI;WSDDz@8EbX7o>L~1=;DB#CDt_~~L6^K3rHxnecRunE-<5~FrX%lHgD@GLxl6$D
zxCVr<;g&f2VN8C)F08y8VT3il`IfYyLEdg5j8hgIJo9tDpzlSf(kFqxpcBFWy$r*D
zeD}QiJsE`mvbg=;uRX4QPt^b6pFM|R_^;|d;bY;Sew1oEmfGd#r*ioztWPaOE4}<;
zZ7o4=#5kR?<IUXGoZ}<Qjb@n}Jx|?tO8V7*=^AJ@{;{Z`t$0`-SFSP_ecbKQCj&4Z
z^qUyQ@hY*WYTvE=VdcosT^m_)?D5NRx6-|^U#H?8{2F~T8i>sUouUQ$8HQdNeD#$%
z?ic1Kh>wqXa`;gOVGK5}`p6T5_njId|5#=*n?x5?Q;T0GHdeVX5-TlE6U$Ki`Kgn|
zG0!&ruHjD~Y>j@cJk>L)213^x72b}0)S^>ztj$5D{VPwN=R~569VVM`A;9_yU_27P
zhM_Sc(tnynw+Z9;u3w{-u5m108!nL=f3(|O2wU>hsHrr-*m0kCXKH-GIREp{KgY@7
zA@jUXfLj{3TZgy1!rFuAwZZoMHMVM?YG8>Ph+%voV|m|8&aU2gx%wFQrDIMy4qSdt
z2Pfne5pj2Lvwzw<_#G$0Y`Js&xSf2f>+Q*x8e6tx?4LZ$Ts$nCNXK}G>(j&F08Td!
z>Et8K1K6eEc}DD}JKl5&^W?%UZKmWWjB7l?;6V>OePvjbUDz!!gmlBuT~b32NFyLE
z-5r9|kOI=(NOw0#Dcy~9hcpb0bO<=WnfLq7IoJGs{_Sh;S?gYLlf`j62OCxlSP8lr
z5%xQm*+>G5wzpe?bT=c{Y-W+uz2<xO5h-ywdtvAuW)HcfFb#j$9wNt=j*7`6^MKd;
zI{${J=W_m&mzVi_%%In?!|@ZE=i~8{*CnyJo`0k?x;=NdWak&CG5PLU54r;x9`!GO
z|Bftf1$;Gm=DtY3;oDWkx4{vd1RTO0SrbUAk|vWYVope({TQW_<3xJkb#{IV75Lf!
z;q78H!AND8-=uANZMzCbRwsH>R5WCr%ffQr3Z@4){P6wVNhpsp4kOGzn^=@@AKuDC
zT@bWY&;G`|Io&EJO&Y&`v)ARWHm%k!w`+cPSw%SD%*_k406N(cxmmk&_DhLk5B=Z~
z3OB>*Z)1!Z>L#}ZdUa#`VAH{-stJN>uj6E)js3_B_*K!JX}JPgnsh6u7g$p!FWBOX
z2XUKY`Oh}-iw+z-0!+7XoM0jNpXOAV4B__|qy^wv;<oGMUXt>&HVfU!$}t|E>h4_I
zEgTV|c8Il5-q!*-<q+sR?Z<!iOX9AaYgruYb7_{4<HIM;fBCa2(ZW-2Ot8jO9*uZZ
z$g%sK|I%w)DhInQv;*e25Y}UtMA|71!k(LCfGCB$#mAGcPbxqOiJYgC7R3#m;leWK
za}hPC{+`o16C~t+B*KldJI8;tn-ouDM2hs76TuIeklze+bWx?)dugfj1wpX=!gm7H
z&vss)eqL1ftoa6>o2I*XVZl}?S^lwH;8wrF&PEnruXwm#fhOs(r>N3omzsS%z30H~
zhDT(R%uHX*2t5r3FE@-&t}eg#Vr+BnKjK>KD#_LeH}QTiuDZ|>z#G<FjWm#LRPbPZ
zU9gjXJ*{H@MU?n^*fz?rz^+)V(va84f{2ArfXS2CElQS*-K~+qdUe&m!o!50-#!<W
zWtcsS`nCDM5EDP<F)d=3P9ZzG^)40N@!w}i;o5M`sLHvLaQt@3_anO6&+4XwUIS$S
z8629oUl-K6Ot+}l-ktQyp&Q39F`UG%ZSQ#>F8BZn<qzJx=m&T%I{l;^7EJeOed5vt
zEU<Hy^*h=H`lwl6%3w`)>h%NHsYpAX{ae%88D{Qtf|&H3a5A>CEVj&!oon0egIeqY
z?~I27GDGNhmHr6QM-16bm~#$k3nvHJh6f4jn0lY-0z;deigT8KPwP|M+kUjRIcq1R
z_r{%4MM7g#G>iG;;i6E=hReD_<EMhm`o;hQbE+9mNcW(KBe>=W%lEoQw)MaWnpSZa
z<&4QhZzt$J82YWJF?$zHnH_2EdjiOHm<zujLD~SaYo;hpS~Ou=hRI|bf+h}AM|wEe
z_aa3$>J>fvi*GRgUVKCfcbn8fJ_viDHHZA159?LHn6S_urt_L8F8SB_HMHU%V$kc0
zA$i{G&-DEJPZhu#RHK@+{>JY|7K})B*lA$S(tYn$-bu!+cgo*dR1KH}l*1Z>gpxT@
z|1jAGruABlGS(F~Sz>LjskS?g%a+C6S)IpxS+a+)F-ZKI&RZ&uv}Zj^=befF(HT3P
zlN6bsZpUFkmlo5|B-Lu1!=obr)u#9x<|&uqpN$3IHsLR5>XSypW;+j5&mD2f{z8Ha
z!(r&m<h;A9B^;m;#IlzeK;6rm?{9y-xw|_AVYQ6Q|GZ<Yg3QET8jKW#ja|K=Yg_~+
zxJZsSU-R>zMDNL9qUK{@&LA}X(&Yb!@<CfR!xV63!FIrSChl=JG5$pr)p>2266`Mk
z9r>2TUp$JpaN6(ELQz<Ksv*faSz}+YWp*^hlMsI7x}G@&1}{Dg+!4A+>lKYun#GkH
z{cC#BJN59q6@T_~edFpZa4wtCiTIw=_N?96nQpjQcDMZ+bZGvik=+^Lm?+!}K_Xk6
z3yMZVDl!;?NqwB>e#Y&+!$Q5DB!2thrxH1?OBuIwwiEdviaT~c6B4o)ty5VjB4&g=
zxeZo#Dw5cBMlA|I6%&fzoC2Tt)wZ5+3E~u*DRnQu3#Zz6z*rZ$+z$Lw_tfH!KSR%2
zltb%t-n?jT%>Tu8=R}^)|K|ZIS(1>q@8#ULl}?ph?2WSzY(QsF!zyZ>iy+~9<Uz(A
zvZwNk8}0LsYv3^b;$-U(hlVNac_dZGA(~!ODzl(&8_c}$t-ud*cvP<X;xBkHH~^$X
zHCNe?He;wa`PL>Y-~`Rs6dcVVT_E6w5-XL)m<k@0NQ$MXEuph6s9B0~Wl8~#1c66Z
zV=p}+_<xg;7;cx07_J^K$+*dP<99yA_J65fCRN4kIsWQ4=Vu8wob!uN^)q?#SJ%Ef
z?;^=fkRw%h9jjxxcxqIYZ5!k%W{ww;f7(E(*#N%NOc?D*zHDOFm?xg9Lexf}ICN-t
z6EgeUaojN>Z}FEd1m$mHPmg_p&S9~svm{Gv;u6KtbPAiS&(0Z>F5&-z$$MMcgCFMx
zH7vNxmSQIiUF26jpkY})r{TKh6l~#EA#h#HhcA>(r@b${OU^|0i1xS#9oU&#U$W04
zv_Xqem{l}?;vcd%RK9K#cQCsQ+w06m>#ylLp1N;x`Spv=K>Ur?RQDbC8z@W2MqIX~
zMi9CL9V}}Ja|6d!iAjU4T!9j?2p2Y!M82dG!P#j8t$}K2>9@Ui(BO93OI``1-kl`0
zha4h7iA&}%y6_$G@YkX7gz8tR@NJBF+rVhFF_da3ul2^NVb0`~V`H|PjM|aKID(hk
zSOv;v5hC;O!Qq|5n*kuKSy-5W`{-Vn@HFPjQ`<VxJL?v#T!pRKkoB~=NF+;#3A@jD
zF+&V(M<Nasc;?UOGDX8=s#$)%oyXn@gaiYa3wREx>-j%%nV@&1g}YhIO4T6V@EnD7
z6y#oCm)Faja@jo=%JQhM88e1IjICcZU$7I4ydIMW)i%@)zg|+GYlk~euV(C_9d6$8
zL1M3q3)FQDZ{G+-6BY`x27Ek#y002-9LGa*zL3d-Js2eGTI0I!;cZF_QyYnOFPX-G
z$#yeO@zg#Y?7?QR$Rf-#x;o30aDBr?doaR;dKCDb^h0>a(^h03=(wdg=J#gfsf$Y}
zxwC<3)8+VV;4(ld(e`LnTn%ll(<A3L*6#b2_t7{on9R_7bXcTSKbCrAkKXO?w4KbU
z-IT@GID>1+S{qU3OjK!<AF)IC3T`c&N&DPj(T7~s75~eIfG2m59m18rYgDHoBOx=k
z(F0US?O!3T+6dtR4<~F7jfT8ID}7CRnN~TRU{*Q<6p9d;bbv${5&UZ$>bq^3BVc^}
zNH+!RW5@$vqTghsJ+fDoT2q(&N2zinU_bqj>iMx^bT2#z0!na)f-to#Ar<B@8Xrqz
zvbbf#Np%580qWetP(4Q^dc&h#z;Nu#+DG!-3v#{!L;tw|yWW!a+L3-1Zq!-O%kV<Y
z5MnvqZRbzC0|5Ec7u|KWj=dj;NO%mM{%<md#FiD!_F|J;a!LSMu7>PKXnOX{11$fP
zB#8O$7Qpziw7<qj)62`t!Oz!EW&gsm=L6K)#|W>lM^L~zX0sN6#-ttLSTSBaz5o^)
zLF73mKS|dnN5!bbO&F(ay<VnCnO49e{MBh7{{ThdcI0>J>9Y6rnw(7j_oo3%<k4Q@
zoV5hC8r8`Jkhecw{AP(hK}}GBiW^}0wmby;biNN5K5eKo-bmR}jcXI>wC-JM?L=he
zjO^g%4%f^i!x+HkbG9FSy=s4h-e=vkyJUo4@el#Fg8-bZ$>){x{5hnQP>SW-9Oe{+
z@{ok@HANjYTW|J|(1TkC0dFGkfx*r1Lu5K#96V4*9uDS9<$(;fc9}h4{Nmu5koYhb
zTyqG-Td}R+Zbqx9^Cl>+3w{~{&r1Ve?Saj74+$p`yYU+0A)g%He);H9yb?4gn4@<W
zd=z(Ct1M9Sd3%_DCd2W^v>n17F}~fLeTqwOZ?semGR4OI-5Kxn?sKV$4~d_-|GdI?
z;^{Cc4l8ZB6OL7M?W(?XNRIzZ<&T!X=?DCS%j#|NOvR0tsh<<O76R~%eS{1PH53c8
zU{1+)CXO$kOM~M0bUxAdk0zjr@0Ag@HagbtUh<58<5pHgKe+kS#rO<H;jr#He(yOp
zw&9gf?F`4q>MZ#@7(GXiGf~8u-PuoC;kg)_++RtIqcIX*kj27O+FghVFMsDScOUXM
z2wJboRf^d?%K7hTFg2hee3g7goqa0*kI59EK4dly*B=>v@kvaP_!N&X{&XqH3;4&(
zSR8=MXgK@d^I8k1u!I(VZ8a79<c@|<i7v5zxJJZ05G;y*90On`Vm{WvYOR-gUQ98a
zl@k)neXzBH<>qmwuZ<ICDX_H1E}LJoS5PV72(G6Y0@ft@%tPdJjMF+xWB?Mi^LyA7
zpWOjSNU-gYkS)<Y$45h)HB}`j_v0AM#5I}bXbuZCv++fVIZ~6N6f$_zJ1Ds#-G0vj
zN6e6d5KQCP4g{CbC?Rg|VubZd1gd#PYEg_+SUmKIGfWPL6pxhk=F>!M01xcijP|AG
zU(4n6uiB(qxXfQco}mlK^0oXi9Jk|P;@KjZs}S{7r`*UlPtlp}i$5bE1QEWg<f>3q
zeVC|5fwcN4lf<!n4lo2AM4J}d*Y*>?#usvYJCjICn|4@&iO<Jrbb_AAWYYLfwN_LV
zhQ|_aYSL3@V&WgKq6B=5@h!g|?(%sO-Z%bLsW}9*e~J{+`L(`iuiNc*+QzPit&7cJ
z4ETFBj%ISi<G@!oYFj9IU%FbHW)h&?{hycu<qzDsSD@L=#juzxx{FQ&@zfq1Z?7wr
zW`2IFnmSd<Kl5j~UY}eq-r~z1GRU9$PudC_BD30vWihg?)kD;$0jqzXobq@l1$9Qy
zYlfO87hEn|)K_6DKlhvsnv=;#u4dLg;|bz3&{Mu>;6V_eyQ>7o<eyYR+^?Yo5!<0P
zL@8EGU}}*E9-I()DXbYDmAT7wSndcc_rmI&UJZp$B()dg5~<)g@-uSnNmQtl;CYP>
z*LxbmRFkf^EUc=5*FSeL-~=(HinBr!^7;vw#BX&$!FE)<v16StxKa0aC--e`+?Al2
z-jP__j8(mVv*t>PV%u|J)MScvxKW*vOHe~HH&aiy?{spnFK4Dp37+5afGwMS<QWo)
zH4yr|jp<GQ^mO$$x57zSIMzIaN1#^mqp3*J2+;cp!gJr*J$Cd~AN)I~Je)>HV*M5P
z-|;*|F4)g6bt#_~3mW_WCC6{7r&Se`HB35umZ2Grv2NajTZe%8Ac`Blzm#=I`gWKf
z@7%{KQ>su876O?$hLQYNC3}3nj?X5#_zSW6(J0CUUfIx|IHd_?ojkfbr><A{e{M)G
z4g!j~z7g*DDE{k*5+3A1JLy6#-y-MwDbIt}FMYm`oBMk;Ov?0LF<a4<W{b&Q#h!nL
z>W$jgku9@79!5`GZ?hpm^K+uRLuROVFXFfLhwYUFIR0D_qcWZ23xKqH^BjPCIw^h-
zOv_MTUpIav*N@^y`i0=60F)c1%jNIUp~J3MGT}p+4mW{d4I&Z&+l{>^wzxWb`NXcz
zpxi0&Q_%)=kyrdwulwx8LnjEya@X%QgHg<h0t?u&<`JIm)JDVi!MG%+Tzl?cw-24R
zJX#pb;Y$jXhm?njH2@8u#Gst{T4xdKh`!WnvWL%iuC%5|-Cg4dCEb2o!0`M$xG8})
zWG19Gu^`?f?ziyUmOcF^3iAgLUG><P+P=s*M5SLX&2jBD*Vpv0adqF+lFw$D<gCmW
zUxw@SnPI`ByiFfVtKioatOKBMyKfjgn4Tuzk+L^hvTex82xQ{#>K@siAQqh&7Mm{m
z94xI(u!%O`-ypH8QJA+<|J4F{m?_t*TzLJAio>MuFq9iC871R?LqFL_6>&O=Vz)Ph
zGC?8XRi-_>#;oKM7$xkGu1uQ^m((*u67WijDd&G$5D_CK;RM?6Y$H;8f8cic;MUjM
zGE3Uy(znw<&<+dP{MHm_tJP|bJrijAf#>rVidcdV+=Vx;b;|9m5`?-4)+sIsk*&-k
z^e6cgvk0l(f-mZ};%`WtXNtxC*b#kA`j-l3wrpX!*UaT*>QESq630Pt9gY~Kp4VH9
z6^Tg77R{gR0Iv4qeGlWMLHRmgIlFw(Zm(l~*eFvaS$g%r)5e&tH1oDFcP79@;+j#w
zwC-S`K3zB`lkZ$#F~(Ot-StAks?|SQB*4cXXW;U*T3oceTG9gRTj1{}eg9n2Yb%v8
z{4)U)Wqw`v_sb5d44(xmYD^|R@muCIr?HGBLCKW{k5bipc^GEBn;`V(zh_Ict1=1g
zV3^qs(BE=vcdMk|q4Z$uo~IJrD_$i-UXykp>XI0z71txjSWU+)Rd%i3*S(sS@Kd%|
zpV&1G=4mOzq_W6eF1Oe|!EIG3LW8SQ5dO_ZpLZlZ3G1N0`Ml5s>VfVp_air7@bi0;
z^9uT5vlTviIAqHbk=7!K2kp6ld&FzrAbP5hRyJA^9FC@TP65OM`5_+|XarSuKa6;^
z4=@F+8I2}v@n-ex2cb%u9Ayi+)F28WJz1K+NhixapD58cdqc=I-+4o~8Ow7LEF*4I
zKDzdn_=PLbE{n_SA$PevtR{t*#x7LiNhE8|31gjnOu7ZL75$xx!fO(2Nv%5BWGC)-
z3`8CM-}qPcp~`;h?}(0=(8DD=qpOI$q;;d=>R~TF$pg2)BGU{bIH??xZVkU0n>ZrF
zI8YV`q|c05WVbeZMsyGDaKkeo=`7tt?|ydZU^%8?BaYXu0DrBx2D~yttJCDgmXmXI
z9#*35QcKt+r3Fopk7kcoohO?}*Rdx@FV%8?86%Z=X8%)Jlak8or!jfnp<=mN>saM-
z0(RdD9f*cqTo6qka7NaiI->6zrC_l(RvkKMC!I)WGx1yYOO@8d?a?;Hjk;IafaJ=e
z4Fw>vs0(FwONW85wBRL616*Y~WcwJfGNLf?+Y6j2(>UwLDeXBo+b<H+N^^2Q|NeZQ
z^;BRMi{9}PR9unJ2c3TMG(Y6P?%57e%ISM_EC>r1GCBZo`9qXMkAmz)Z&;`YKxR(|
zaUC8~3ENB=bjZq~?h$7rO}(HnM6k^pzJD&`?$?R&eM@r2-V9UM88qN2d;bHO4E~4Y
z1d!cckhn`b%1<Qn72!>Vm_n9ksY2o<@|7ij_Y8U>Pwn<OTT+UBkJ)NxE$5Xb4b{?q
z9?k}K7H^)Uz2og~dX9Adf>lz0n@ivcRB_^fuX1|CGUxq>Me#=Wj}>6-SN~se5<kk+
zmG8L6fjvZCG3<bAcU#!|9({EE1K=y=$}aEntyF{-&FbRN$Ray$mH*Kp)B5<N93%E+
zW0(VO$E{$tv=-fOw8xB;GJy^692TQ%26peWFxAM@#>;H#{3FRcUl0Cls}aJqKA|y^
zIMw~wAByL4vpFQK^BaSqmJFnpW_&mVEa(=E?!}I~@uc51D#(FlK|saDb5%5_za8GF
zOHL{CQNH#${H)$Mwb~H-)SiiJ&o9J>DR5wF%$qozbK#+<dOM<+d#ktg)5<J2oh8IE
zi(F0O>2I1Uwe^~I@6~tJ42Hkd^GCk<D>|E2W4v^03=I+lhl(~l2@UCB=i7SORWN4W
z^NPgThz)x8@rs-xVkDH#k0L;}<#-!h_n2Hh5kb@5oIRE;`5qnAgv$BmnE8+UoTBKQ
z0ssPauQeKhUW0Lu5u#;K=Zk66M!kuN!!08m89k|YsnED!>io5bD&EdOACeR&I>#mm
zX}`!dGjVgzg9_pBmE0AxfX8!~(`TQLQh!^rrL1tIMHE%#K48(E&3q3^o-g>k#^Z1s
zONEBsE|4rBR7PZo&dL0PGtpx?me3rp`^No?lZ!B&!lIjW5}OuFum{1d_VicaOGY#W
zM3{0Dy1IRjq7rSF7Hpd2L>KJYr?8XI0<-fZH+*c{)pSsuDhIUa)i5?ip$}9Rfv`r<
zuJhcAZ;BFH%!zD#BUP6BFI30yOW6#;lc(in61)7B4akZE^(P@$AFUH0>TF$S?Y)(o
zRY7(Fy%WAgZR$|p#w*~(T3$mFSePm2Lv0Pgx>recxlUi4P-qy@)|m_2F29>^9avG#
z5@IKEGPId3dDRw^AwXqmYeJm3W!48W`p$npM;<KMVwy1)5lIF9<yic@tsFt`<C~+S
z|M70%0G_HE;D4)%Hjp|tLV~VGJ{R?O)O<czE=orHa=UN76z(tMq65ze)fz*C(<!=B
zeqXcuIQqr~zJQa-Qltatu_?BcdtFR+b5zAK6*`HpIeKnH@<g|x!4dYf)S?o@#WTPl
z#LHZhgSf$`Pc5h)jq>L{@ZIi!{cwct^DT_Vc+m0{e}3M!;V*b0@)Q2z6~|MNDKj-Y
zN?Q9Mr!qGWk>Zgl9252S{&Du~iJ1K~44w?m2qVMP$w%1mBC8MUZ?-UGF`VgnAJ<1!
z4CRg`p$^KsS*RCe_L0ZSPPX~YCnv8-n(UdCO{ThVU}vrxe?xrkEOFE==I0)tj_MNk
zo*(t)==Tz+jKoRKr%_;Rl3bru!S<sv6zG@M-Oqd>^}$@j>1if*S8GnF3h`-c7(<l7
zW>Kyap~$)#SM)M*RLJ<J239u<p83+X_U?Z$NNFLE6x$P%tmQp%rTka#o$N1YYJBZd
zL#JOuEgcW%`x?sPW#JX0tMHzL@9{cbc($PiB@P`*zn-|OK)UTIff3}}eF>aND2(Pt
z<!d$yqNrwbvG(t56=X&!j%Rqj)%kWviub}M371{=5XU+X5-?3L#pBlGegTlA0n7)%
z^jO|Tto?yk9JIA@Z8J9wwlHz#Gxr-;6Nq9p_zDMV@gCKPwLEcJGOv_!=!fzrml3MO
zv{fU_v}S!EbFNd-x9G6qpA%>FviiT>Zca<LV(|`Vr0SFfb~wm^mIwcQ6kV0iq0xWC
zl2;))c%_`x+-|bH8&afazJ)N^nY#U#;5mv!hUtR`H>@rbxvvDf$f=O<&K;8k^&~?U
zv~z2%fmV0wZ~RqIkb{667na#N{=cWPufbblvPwG7rsLg)23c_)KPWUSr3?bX1Chb<
z&p7yw<T(p~;fI7}+~ZgCyW5BLycOz-QoHxR6`4$l>NBH~`+?C5o)^$!w}k4Jh)zTB
z`L7t<4sWuS)RkQZ%`I5zzC1L>&N!ltc!F>s|JIajWbI1h=&-JQsJa;gEDaD&%d6L}
ztPH4ltqN08Y;x>k9Mq$a84h1K%x)1Jtbh|IxDRbsvODsG9qZ=O_p-tzK7Bo8x%TUO
zbKi;dkuT<0@gBLuAD842`BoG>CkbvoJ16k^B&qk6)*jojOj1T}5STHHltp34ZIq5x
zlK)9i*>Aa5W7fX51TqI?CWzu>msMwg{Ee;$mSLmN&TCY>@SfwLx6SCu)3?2A8AqcF
zVO)TIJUTwJLghDzlPkgaa<=T#!}{!qq#$gF;}O#of1Hf}H6Ct&DLSIWO(2Vzeu3Rn
z;>TAw^2TttzL?x0--^-0|Br){lm-n;9;vVjIq77`07Q%{RPM!==G`RgRb-aBu)Zz`
zEz9`6=7n!hgN_vH`J!61nS^-j-X}n1W3jHcJgP!*r^LkUyk!j8R>vQ!n6U>OHqY;h
zA_+r*via6Pe_vmNuFmeG(*D0I$oq5l_Kr?+CflF^d16xu)1r&epd3<B;1r3bTK3!8
zLTkHi-{&uZ)JF-T1iU6s5PE;f=4cJLjP_BWo(LPuSf~EQI*$0}?|TO0?=kO%!Zm79
z=6!-L>W!)p-Pt@uaw#WlWek7m)~eTK(qz*&e~4{IxR>8m7FC~rv6Hx0T2pbHU`jYk
zj@Q&0q~oyjbc8ZeiCli!ObXEda7l?u0|AnP;;@dL;bS?(2}-Met7ZuE2OzVkDhrJ{
zG9pK)%XhrXs1QMS(0NvEC%&i2xTVoZGVX79C25JU@#gJ~&aRCVASIPg2d!px<<cQY
z(3sL7g+jC0;~S~~+wt&NPpSSw1tR$`6JZ1w9U?(L?~{ak3g=V(-XptzZsP&uQRRhm
z7#=*-Brz~iPE`}{nGF4>A2`e9r2IRd3!jQK;gpU$D=@pV{e7N(EzjOX+unoZuX|s!
z13s%58@d75DaG`3gSofw0}1M{4AUtid6&3Qtfd@Z?*h(o+Z2hmJ*%7K*nYU3rBY?c
z&s)PRp>tu}=gb#XHo=OF^CL~Uz0_{N(Zck|KYQSC+X-|>e43r3Fwa1k<*s68R<bm1
zpkuFuz?h%`tln)F1U(^N<o3&QifLf1i(^}T4&Lvvp6%Q}B6D)q7ijv!G84GAg|2sI
zjc*?#hQt#$WMH%<lku51hIDY!&eDXk$IkEDvTUb)yJ&(!>pSW{>f<IGCZf_@ds!aJ
z95!;qQ9k=2Ye>wp)U0!nEAJCOu2K`ng6sy9HyxVy#=-MJsAeL9)X5|6V)*ZH;5Wox
zbT`(%I}P)x5T$J}NM1Z$YO@a2951)QDjJ0%kQQu%g@e)?hIl0kqMO2f>;ps&wBy8I
z?P1qL%48T_xJsZd<48e=pzB1moN1?#k4A78=Kubr0a#<5Gq$EqM0Sf`b5LQ0QP2v?
zG>T1cf?d9IzahMw80|$cpH-Ob=fG;w%`JC}hp6OM-d?Wvio;Ptqa<H0?NVj`^#=|r
zB}BA*?XrEKK67BZo~mr-FF9t2ZTG!1p^5SJoxmNN82vd{OAfz(7Z=_FSjp0zdovj~
zSB0da4WNt=%ToRSxdadc?0PQmXwudBnvbr2`TN_wvOrw8N5odS=DvJ>=>okq^<HgF
zHWR*)vc&v%yrM5h=KgB)as5?n$f<8xX$AMa8l)E`0<FEw{CA{Vd*{v<afoA%9BM!3
z%7@c8kwA3Pf|+;*hcXh3WjS*oT`ckbd=CzVE-T_p6XKI0REYBdVb7xwo$w+8#6MZS
zr$*fk&@i{b)*Iq^5C-v0GbMgW+%Q*VGt3KBk}(lD$kn(Zol?pbIDem{M6tU^BjeJ%
z6U3=+>*V(6`O@#f+whR{V>gdC)|w~GrywI^TF13&`Qc-x5tc6O`zw?G>NFAeipG$%
z<0)Sv*I(|lr0YLOn-BRv6g@|OWQK2_B<BGApY>6FjTs6xTNhZa^Uh8ZEqM0XiKutO
z0O22VflE;b|D18FTSi(IPh+rFyCu|k|Cw9^x$hTZJn;Wu<i(ptQw)6!gUr3;=0|m(
z2$8nS(PKYwNT4(h+%ER$Rs{XL8&dEX)hi~YFhH8||H&;;BTmile6$eIytNw5qWw5H
zD5`v(eZy>HII4{uyCC_3k*I9CWP*Ri<jMHFapd9*F}iD{aJGGWO15O(x+#Ap7N3AS
zp_Af420f^C>9ZV};Y}E_q;Ws)MSN4MNVsyp;&9Tx5<QtDt#M4dvr3{M8kgm@ZezZ(
zDyFoajx_yHhEBD+eX1Hf4tQPf{UqY8Xi|$XB1{9HU|&2fI3eGnA@hX=J>wxn0$8;&
z<wS!CoF$HJ!uv>Qam;I!=OIDLq|2gx0+QKY*Fl#18Rd^M+z%HgZ~7}im8d1IjpBdb
z@KsLC<GT&y#P9kmo-_XAVV7I%H2}EJA62^+VN<Pt3Q4MzY?3ZUB#H9=T%Xf#qmxj@
z;NMRYv-!^PXlwWVVYdG+wcIPP#ORZ;{?l%Umo7nBYYdg-Pp%cK`o3PTNo{N(1rIM5
zqK2SxexSoD(Qn{bMCFQ?OHxMi)Ou-4<x$}^ceAVDB8|m?+}}7t>CQLp0cqkZtWHHs
zGXkHtG2ZGsW{`p%eAuw%c3Q`c09LUQq;te|4IYcU+So?Ps8fO|w!Hp6OB;RUYpavf
ziP0*S5Q3<$Ap);A=I3Bq!r4#kXNgSNg8xeG=?(_hL6$v@#>wHKXK=FlCt>Rj!3r?}
z?*GQ_SdR}B@#+miO_1Pcab6MZL;Jud@vzN;1Ie1-aTY(orP-atB}csukvBjHpC=eo
zrbPmU6d+RO@opj!;5wz_OZUf!zIai#zCq*iH=5_~E<%bBo!NIm%+Xa(BqbGL-D(}w
z1~;I>G&sod1b$$rd`R+l^cKL&?jcNPamRu(e95Em@Dvcxz?@qQoJu;B*!1E}8Qzs0
z;G$}%JF9Y}`rX-Xp-dFNWIA)gE*a!Xz&%W-;)Uzm+J7N^XqB^nz$qvvOw!5mVQbUs
z+q~KX4|0q1aWPkikJ9fn{Smhl$M+p+;?v9R*NvBl6g2GK*p}>$n8k6WyZZz82Dxeh
zqY2GZUEb}2Qpu5P`D*+T=6Yw}nj_6K-ra>`ke|7j6_@nLmS@+shOiwDfAg73rQwjZ
z1o+$%iDd-H=EwtPH+vdKH2=1HkD)Gl^%avw^8Y>>d9of)Znlr*T*p@>efP}DXX;&-
z_~WqR)Gl>dPbuA$x#g#VBEcX|`3kwICH@TeECY8HwENZ02hEZZ)m&}}_|8Li@Ez)o
z7rf5X`$-9;HkQs-WA0|v)Y#7(;1Kxc>qa|%&x54x;Qg3mxb_;i)E-@Ij2IzpELBS9
zg9?E1Xq6R9T#<n~$H9tB9?l(p0aiRQx?Q4#{EWs`M7$1q)P;>h>ceP%l0k*cN3tW0
zN#CT8nE4t3f@z5){i!jrs2>x@y?dE9MByRVzEQO-<D=}dPGZ&4AdjKq7t|u1CAMY`
z;qaisUe8)g5ACG9>t>WyKD#C_fS4)jTF_&6(U8t_^vSM0x_vBv;JzuLJ1ki!yEuG;
z>Wuf$jr{&c0lRuUBenh%8+$m9%12*YdLJ#_xhQK*l&krDaAF0a$(7s7y?dEzdb0<+
z9i!sX;UKROZ5xkIq>jf@S!%eh|5EPX1v`8q3QF$eiWN8QV4`Bd`zzJ8<ea}Ebk)fd
z4jH~ZpdZ~`*P3IxlMgb)!kv;6CNh;%m8IXn3x&z4Ph{dgqx177*Hfcib9sgU;k@a|
zecxN*vuV$mP4_xnZk}>c@yaiiR5u#s{rv(nSiubwhOHIao#P9V{0(KfDw@FqQHgF{
z-Dm0Hey%UO<_}p#`37Zs+<~soLv`$6ufDE6mx%h0Wza^oq|$QdsjU1C92(9pR{ff0
ziPfbKd?oEJQ3FkrDPC)!{W$ks7~UrU$bIy5h@L-Zx$_qqHCLeh%fT7AoFW|rUb{{v
z317Z+e*qKDf<h1iX+Sa<{rIex-V;CxIpcooPAF@I9e5*5V=jDVu$YJ%mWG&4Jcg@6
z>HhsA?3cCoUJXPLyS1zZy@3A@aR~d{Z)ldzP;kKd3hyMhIyagK{;ES91E#K{vlO#R
zs|AxSFPABO{Z+A26P_%MsehSoKChYqy}_I#*`G^?OL5v)oVjvkX;NSaPvj)_tzkY^
znF$X`_sM{ZH+`~Q{m~j(bkE(i9(ILJ#7mC#K^es`nK7bk`PUQie%9EX@aq|%AnBH+
zk~gKeB|5y7U-aKncgcs4irNmZnT`IszlzJx{gZ52aa;jdH&UTCwHX@zO~fx<r+bac
z`vzF!y~D?hRTYCBtP)T5B|YoXl%+183BjMZ-&G+1c=;j*_iA{;1pgKE?Vk&)VH`eZ
z90eZAQS>2D>7@JzaWnwb!sD%kk4?;DrlLm}<xzUIYH0S1v8Ercei)*f`~BT9kdt%Y
zKYoc>btQ)ph%wTi7Su6Mt*CmwnQm|X&C;>gD!8{hJ*hL-Yr0CWaM<^vKurz*PcjF%
z=-^$=&^s{v>`bH)nL+N!-n!RVGYFeo{n+9D0W(mKRJj$NXrs5WfG67c@%~G+kq(d1
z(fC7m+P6JNp%Gw=Q)xq!8<venNa2WOn-Qw4Hn<7(J4{bhsA;dYi9->BP0(hZYhY=e
z<eKj>(7~oA)W~I+W=CaWnI>yIk~cznUFb{#o3lsZhfErZDYArIcAa!qo_lp{9=oA6
zg>gRf+9o(?9r%6NO#E&mC13Mp_5DAV=bs?E$T@4v!nJknF}5&LcoOM+X)*Ua#G%9e
zG*dIDx-7SyvTQ_e&WQq+ur!k;k&V~RNyDvBeCg&!pskeeF+?+Y1wzUpSvvTTdEwzG
z?T~jw_ynSUX=y<t3xAAEwbB&^CdZ@2t=Zo>Fr^Qy6LmHxZABWTqZ=P7V)F#}PH4iY
zzY6ghDfd3D75|B0n}$dg?@byVdw=#iAMf8Qxnvo})<?e1n}}Gvx#>DD=^0OcIcZ6D
zUmMpL-~UiOOn#=laeMD`vadDIso+y9AZB?7O|D(Zs$h|vMiXb9|LXP@EM8Q7DR9@)
z{lkkGqWAC2v^uvs?hiYfEAbEWfcFBWK9`nX8$Z{l@4}})c+51lH@{!d^KMf8Wk-0)
zMX#k|tOeW^-<1bTCA%L+$aC~%^TTEkJ^*mZ1EB*mS?Z6=SZ7IzBVix_h0Q36IRs%2
z5z|@(#2n}QkUMfqM2sMA_B4Y+gYv-m!;bYWg25D;*ma6akk)IC8ld)%6hZ5~Cw)Ru
zYqEyQck)(F?3q3<0=O_A621Ngcm`T7IjR*xdJMaV_3Bu@%P8Fg_9$9jW@ACb$&BPj
z^tHsJE3#j@l}EnBy>tBV(6$?s2Rou%=Bu}p3U_M>17W%CeyncooC~#Q%o_m1ioPm%
zdtVh+6T3DzI$|wuik~@^MTmPQ3jUjPNDc*iJeK{_&$rUb{%k1{WtRG3Q8EGbDEU!J
z*cfpjqbOb2MF`$AFFL#^pzO+bpG`gc+5JB=L!3Qrc&?vi!jhD)CWH9!yTooi!-jjC
zZOhn+<i3}T_4mqYs%0JVtGc)$;{zwQ?;6e;LeOdAe&s3knmQy27SX3Q1wF&lEail#
zkWsW+?6K`{Te9PFaA-d_G5#<^i$hUylOe%%?5UKwtt5IIB}CN`tysUaXpV_kgxG^F
zO;nEwAPmEQ?DOa|mc*24hr(%2Lpp-4<jN%`wIsFp+e0J*G%@OjUYd2TfL&#oO^m~Z
zKnmr2tkc`wGxd?8eo3tN?!U>OBDr|F*<?s8qL6elYYhMfl*fMFSZT9|3)D@WnT5Y@
zEk%xpvlq!8zAGGjs}}}E{v$WnF+E9428iYs+8a#0wIC0vY*EWy{lW8~k_}Jr=zz;n
zi#Bj;kOfkpYtd;lS3hNA`!Cvi{wjo1aGtF+O0K(2wWZLLnRvV&J$G3_S&n$QHco3#
zX&ARUto&vpaCy?YPyNkT-J;)V1u<X{TW)x^A33X<5&ckq&@WGQZS$#Wu$xNKUR|z1
zBolSl&<ki(oRLqtwI@19dzE^AP`ObxQYkTId#_YG>Fuo|<+1x&_%DCG=)P9eu&vp(
zxc^{(#CMqkho#YJqc423)GTp*kNs3+*Vdh}eUofEJWrig>)h3>vXtt%HE&&~AHv$_
z)LIf8!hW9>zN<&HoW-E!Z&vKR*MM!WoJZ9V(sJXPS#q1(2AOinjmG3Q$GW``kiN{&
z<Ge5hs<k_o9-Ot3q)!;LV#>(zHQ{Zi_mkzjW3>d5(VInKa?UsA_wTmM6&#9gi^OiZ
z=hjx}JeD{@aaI2>F<o0kkdaV(Q4mXE_&hvuv)p-xvv1+sA#;<9h>H(pFy%#^#;_R7
zjR!8)=hUd7+E>X&VhGhB)|zcEoJ~u-ezzxk2sGr%>V$}-yV_>?I-m@2<7Nw!ye1^z
zR@3-DxZDjSNDQ-4tFGkN&@t?-d<vEJ+fDkHysY#aANlR)#a?0lf<A_)+FEaO<-P~R
z%fvDof0+5**%~enOOxLrC9h82e`8N=Kq+ctcVrVU_XrEp5(h5scXfW|F{CW+LGfGO
z>{E}auCc6&Z)o4zUXq+0YKK>7l#JFyUC#2?Ui7aMti1--U@nG7_e2Da8DZa=B>j?Y
zpd4I*earrk(E&>vRZXox7f9a@4^4zp4A=z${A(<PqjiRrbGNMK$mFGD1Nqhj)gQ6c
z8I2UXyLST{x6w^U*H%|Vm2-O3ZnV+409Lil-)L*L7h2!XVX|wt)i9|oFV5CkR>vnV
z99>u3{lMXz9oPx5p1dlik~JW>@fwtWy|60S|74frn`7Tvv<c3Yr9!$8@pvr4{dM)z
zL=`ok0_Rvk=Ja;mIy**!0_&s+`TRnZa)vdVkV?p_FVL;U$3Lkrob-)P;x`X>tmgry
z@tmaiuL-8YoZplC9cr~+<hwq2!;Y7kE|g%D&s4<?!%?+P@%x+Uuj5|x5qg7%sE`aU
z=%;U2>eA<Ci*|Oo21StED((th=fz%E{%zqn&GSz8-ICX?ZrNS|keb>S|6j3@n7n17
zN%@nG+qEOIf%Xws44<K-Rva~fGLwe4_Oqy;X?4z=yZ|@KVZ$PiJ5oKvnYLJpmJolA
ztTu^rESpq%OOWJKP2cgbSMAG6?UuSD#|M6QxkjaX50z&PD?zi?6`GB9T16Q%206-v
zv;5zZ7Nr!&iqWMs?#cuFeM~f0Tp)ghk@I8sqkr!kI)nZv5H@l>y0*I=L5=&s*;|18
zX}Bqn*~Dhh8F3UB#~U*FtC482ER)Mchd??z-EP|;v&>O8&|cpGo(N-d+*gC4!tMg@
zwpQPm8f?=%C%i6}Mj7qbkn823inem9*1w$@vfWmV340*(wXDdMg$QVgkD+kCToJ<f
zQTaI2G|xEJ*=I2qBpWd}ee75o)y~hY%{$)6FjBnj9^(WM@|x@Q`}w~x>(f9PcPWOM
z$P(%>wAg?P;#x1=*i+i6EhGm|`~`xsJfVlGG~D}xl+Wp;MGq2rsb!~(*M|#_t|w0^
zAC<KJn^;<5KTuEroy$Q>*K^<toTcavGJqRby6{^PL!~9TR7Yv-*5(F@ACf~awqMH}
z6ZiWUA6lDDgW*A)t9`k65d67!ETY};9~q!Af=gV_yx+~%MB<c;*top`?WpE&645~f
zWJ*eIx_azkqJq0gq@r`mXsaYTn+TWcIX6L;AX6hQV+L*nWA;V<ouIA%LR6+ZPuNwZ
zZ+p^SlPr8!g%wLyoz-ZJH0a3n?K*pf?O9X>6{3`rG?i2Ii<BO}s!ryAkcaPO>pT*b
z%+Z+#jgB1*;yKoSM~(Vceg<(nn)1}A9X)M+YCA+`YU}nt{gUVEDnwR}2j)RhuAM4d
z&nb(o(&RDOGKB(Mf#XXoxFOFdFKj2Rx=-FGwdos~gbu7FYRc-as#tC+eItJpK&uZ!
z(o@o!5MW*XHhFGXvfvXaZ}00In~b0lF7AYqHz$VNj_$M822?uU5c)Wo$neAvpao1Y
zm3b_oTUS~wY$FLh44S$b4SxSFjMXW@^q^7`WQv?XDJ1UEbJ<b*Ez-2If^#oMy=&cj
z7bQh7;AHvn=Luzq#X0;fA)Cp~o~4g=XOQ+9q~X2Uj8y#0^ToFJ%sOf47mm10Qh05Y
zp8RF-*w=8n#xJ|J--F9WIEDkPc1m@po@>%PliJb-n;UBmeVJ~IG!*N9=28kBf3zTR
zTH(C1gilSK>_P@@6o8_T?@Vi)#Ke-D7e0#r%Hc6&$q`R2Sc%NYF;l?hM>H?%{~yb8
z=EYFEiHMzAXWI5M0w~kH;WCqmjbixIKh}XS=LOAnR-ho?J0mF?bm{BklQ8O+dTnhd
zO;rl1HY(`wuH?nIDAiVB<Bogil<l)(MxSDTUzwEr;9S@$jQoeaGGaZsqHCapfnxZ$
z7EG1mA%o%~;r<hMyeZ#_6lzjVHm|p~zcM7sp-dB}(o9l(6d5PPA}-O0hy7;Y#k?{7
zn|<WcK~)D+N<cN1&R8hQG|IJnPUp}E!sYCvh5EQ@!+o%n6^VMlU4BQ{Z}%FSF5B6t
zfe17|esx`i!2|ZRSQb17yqK~gQGe{Q<PWm}P3AR_OmfJwyKdKnhBAW(`TK>irr(MZ
zeqe0Y97=!xgQik{gAHIjSpb+$E#LV?nc+hzuQH(N3TIw(ND;fWi$j*?Yn+I0Hm!uo
zyD(v7&vn^}c4V_yXh@bh(URV<QZ3s9hiq5Ko}O0riXi6SH!Fl<6%$cf8oe(cfQViz
zDfnfD^{qFlI3zR2@OZiJtPHt1buSlxPF?o7*8?EbJ4?m<l10MY2#Sx2>vJj8-HE<I
z%$7Mxxg2_#T}g%)&I*1QKwu}Ojc?=vZ}LOD5iYM}FcFp;jX~pPBBij>{M*3n(+Vyx
z57L?-+w|Ki48G63GNZ8^Qz{0sSOYI6!cXoyg?`*Y$+V&TensKPIn?V!OjGLjx21VU
zDo6~{o3Ps3pD5=Nj&V(AjRL_dstd483eiryAs|c){zm5_DjT<#w0HL8Vr;Q(6Cc0F
z7E=v$X1mxFn@tmKBz<uyx{zV{M=egBbsuBCGG1RprbaM|%5JUM^TS+^+bHk6RdrX2
z=Hp(7`_@g&rUt@myJepO@<u<SDh_^6i-m1|oRkA*F1fY<WR(2ZW1{B37Z(w59e9o$
z1;E2yu#ixEI2Ji~|0VXV%WmyPGkUrHGU(QH_FH#Jdy~P)M6FU%&)5$m?3t0DTkWaD
zKhAR*FxPoZNB~8XKAHCAIFDStf}Wl0WA-ktAb6M+_gREng0Y-ZXd$S1;Xp8zQ;4go
z-q5^QaY*{Nr-DQLW~>JsAh>U%<B$su@5&?m$tOV;y`h~7H$uL+7NUCimxXa1yo^>R
z<zqV-S&E+uj$Hd?A50QkKTl^-xE~kX3JRSJ1ylEn8a)SMQh7lmYHu`X{Tvx=DM-b)
zvwG?hXcMg2A6Z3?MB*V~>@$HBqr^nAvLENm@1_NWO(K%wxlrDA`v9$ouONA=Z#3uW
z-w{bWjy;vWwC`{Hjws_S(H~M<g${@)r}H)Prt*+B&n&+$SGgG<uNGW=DV=NF$6&^M
z=9BAKE=hGbFjTCQ9uBv6_bc^$_(x_sWMi2uw-fR2aOF0ZS=c<hSvl#<7_}$?*S{zV
zKZ;NSPAbJpef~?V;{FV~Qt)zf?{OK@pc)E@HIi|a!``d<qI8E-_|c^bHLV8mDLBuj
z!$)3dQHe$3*6zStTp6t-ktrZN&IPQ7_i43&i&*O<U!B~RXgt-|14v%l7Tu`^xPA5m
zYnBUP>9c^QK%`$<Fe2)$sHS2#Or8$zz>jAkunfwc#x6Rrcj;8Yno}4ym!{PoE`^q$
z#R|>nnfxXKq<P4^gOLUo?EePP+T61%4WPaREVIO;^ZiW1armFiQoe7fisojdz0EOy
zBY{3r)YJ--G%&CLg$0Ls&y8*jX5IcVSkP;GtqQx_8$V&!2oHjI(?~<v%bSR6$%`Pi
z?X-d<mUy}a?~&jSFB@t@H1@A7<CI#j4vk-TD`V;be%3YV96Iv$kveJ{|1Oq4?C+&4
zvudRw7^=)oQfRP(1Y<l?L9G|spvtLUk2HZ}PJgF{Z_qJ$e`1%|<}WotUbBHa2QuNA
zYMdPwP=*sthmv?Zbh_m43RjjlYO1h`34)Vjww`M$mT-?D<iECV33giEU;V~_XOs;4
z=H9=hhrvG_cyQT`Cbb3XWdX5LK%e7^FM1I_2jueaxg9}!gTFZUj$Wy=e~~_t755jr
zXAIJaqAaLtvljbQqt;3Tes8qg{q?v4ngV60S35%bB%DOeCi@I1(|K5GJE92tyWe?D
z_B=Vs0sc!81(^p7p4%>u(dLGK5Dm<a%Z=+WqG-s&TlUo2MSxtvOAZKeCzHfs3jdQN
zvi<~Vw__D9{3_l0J`e#nb20^FwgXWai0y09D3GU~Zwf3cE-6qGu^VQgraS^qy0l*I
zBP!3sCNYJnr@9)@(bXQxwf><0=88ytn<FwE26Y`YNMSr;Rkh_%tSSzRQn{bidK={S
znfBzHRP3xT(vdx(uxdONr!1$c@P5>g_-aJt28pg;a{k3ng>Z4qkKHR%U41-M&5<2#
z%4};+s^f|(cUYPl6Zqo<0rmV>8qTzW!>QtCwN}l0EZ?}fokfEFaSCdC)0c5CcV3k?
zCUHC=$Zfsz$EZpcahU1$`zKW%zR2xv02VhWO}^p!lxAl_hFeN)J)bB#oT#^hV_y~V
zqxumpc$Xo@wV!!~no<ap>1A9TV+i-y&`jsUdCLcCiR|(yvZ0%l&8+kO=uUSREi`Jk
zbWu+(<G5vJ(=`>+kML>UKV%JPoHGMI>N<4D#MBK?qZe~?%Cxli5<YUJ%oW@(zG(WM
zu8fdijX{RlN!c*Y9#EqOd+KEu9KF`6cTA6VI;(E>5OGcyH>Z9OmT<D8X%bBf;fI1%
z)z2UaG(I!f^*qbwEZY_zhXe>C=nxnJ!I&Q?AGk80D&yuxy<_waKHE=p@%*I7CI=Ci
zV54h<{P}?cG!uCG0%1|@XT^VVIV9I_XYje>cZ&G&&2cQ38-hDDMATsY#~T~`F||Dj
z_op2TL3^1Lx817j;@a9oW*SeZQ>VOmTE)B|&|H@QK=%K-0D|bWMbgD>-!{;tIOPAO
zafv1i5x9Paybhcgvjm%Lfv|cS<%-*^ek-+TEp!W-?4C0j;ipw2zHQez;JFLA7v0)8
zE|It=G4a_S6;&m6(?}4<Wi}k)N4`1DY#rC+3b(L*-(vsr{dwer?u`z-W(#Xx^0w8y
zg3z+5JcNZjM&J2{GsO2X4~j_>Vm(m_i6M{l`GnLj7`2l&#FHr6EW2ugPVN7vyo9hh
zAC$cEmpPulw^2C(Op!D>4vUjn@jn`v|ABWvhqWyvZjJEeKj6%p5=qh@YK|qD!cUq3
zMrPqoxCu&dS#lpei~!%DC3x-n8Y8=uS-(Vow#!7bd)S#y#h;RSX^mEN3S(cC+?2g<
zf?yr+e5)olQf82}HJe&?*-a!g`q94L)8d1AJwtApfefUs1N46wWR*b5I@^t;M5%gG
z&H0!@_qJ@C-Y$K4!$(N<g)t8IV(<BrL-dwz9rsh@(nz%`c5(+9jVHc=q(MA)hxPv6
zA&_cH{rmZwBo#ZWkSv+{C_B%?U!bg8;v1aeXz>78RlaHW>C|Rxhwk4i9%p5aWn0&z
zpf;FHc@PaF11kO4{q5lM2rtIX5u+Hl`W)!iy6aumK77wxn?L~dR<fZ)=HXaoHA0<s
zIF_rf`u3!>m!rZJ>5PnESVzG}L53$>>BDWUc+HZ-++0PHsV=-5{;Mt%6S2DU{MJK0
zHNpTh#wB3TI5&+~=4x%F`L{jG*j8HN-1iF<7gH>=R|0&a-Yw;!PDWy*5pqHs-ghOW
z13*Z*0n1@sNx{g<JTMf#G^(uZG-9SY_3QHx)yMvfoX*7N$yswD3=&V<IFOwn%tmI6
zAI72D^@blCdgJyHK@?Je;x;GqrfuzkVym@G-hU2Dl?6wC&7fIoDN>FWivZb01#5@(
z4YErVT7(zWix@8PPnIhsfKbimPoNisJu?lLdvsXXMtK@swj1lI_;20*zs?^e(7P8L
z6f4X9a<@(yRQx(9fZxWjgp`upCsN~WDWUStAS$)jio5{Zm1*EP+dsNe^U8O|kxjBk
zQoJ@HGI`=eC}(|Sn(Y(TKn|r5{mf9}PwD?=fnM04zwjzLd#hb>i^;(gt^EP9BDKMd
zfS9(dhJH)baBEmY;;oZwCs08Czt5%l1L-o-`!#DvyJ`y}dHij$`i$#dNi`nc4oC6V
z^H{Ff*jcj2;RduFStY`QE)J<BGH)aj{tLRiwaZI|^r4~kc>h{kRpyLvEKftDyiR@G
z(UnfO0kPs=CZq38bXaX8jv-ko59|M0XQ&Hfp>%68vd!QcHVy<o;5nOI%OU#CE%QgA
zCG?B*K)Xj}3KIcYp8MGCt?*tAl2XJkRiXrmg+Ch9*c@Q%M#e$;ufxY(Z9o+^cW%zq
zVxhBef|5|tC~p~SaZPooS%|p9-7PF<L)%rk=Ihb^^!$0#5xnNYzr9XVbs3`z`Yl|V
zWc@IZQddwuy;wCRzZehTRrK|F3;l7Y{C(0{skiVIUb)M~h2E$8Uh#gh-*WP&pY~x;
zaftwBW`B)ZI0{vJvU}{ROY~ZdvPg?>WJ@jQ6mlt#_;Y9^{8J{PoV3~%K0gLxd-?n-
zWIl`rXRf%rV7UI>baxk~D39{seLau&UN4WD|CNktc}}Mmg3C`Uzj?`$eYw@2uR^sY
z9c52egSgx^Am29YjB_FS@_!gR%ci)Zc1`0FJP>FcLU8xSEx3o^?k<hHySqyWE<u93
zH}3AzxCISPrr$GXre><<!_@u>d+%CnJ?p;i3o)GkP>CH_j`MI+OZ%Aj*n!I}FwA=Y
z`wu72V38Yw1LyB^8c<(_w8rW|+J^0tkbSkbph*MQ4~FwNk+Z((f&M9C-t1^dy(*kA
zjJ%-HOBq2i&kjFxB9Wkz9j6=r>st{2E$?J<&&j&54au;CW0ly-*H{_Y>x|%5WdOl4
zB7Iy#sTltgC`!Vqzco}fS#u;l0@FWsU`G`j-c=!m>y<j-h&|w_%3-k=j$8CL4~wm^
z6i3we(45<ll4y*8<$dtEVl7jvP<OO`X8#Vh4Cm-n)Jy&A7V*SMi3ee*>9tpr`i2@C
z;j>Bewhk`$O(T(!by}|uUqJX9j>zm3MyA^Iv0NRNpA%-t%$wg9_n5^cr4rh9t${g(
zzuy2|HSW+waDaY|n*5Yr>~8yief{V}R_*RD(7xh#ePaK~YUA_!@w!e2@rJfJlg^o_
zJx2~a&UmN5U>|Xi>Bde8Zpz$KcpM>~x~v99t~k83d$#-3WlCBIo;OWrFzU-rsTeRo
zwb#276VC76N$uLs;B|)XY8}O{gW7nVT-NedCKH(?aLU-%>3kS5!Sy^pp7kV41i0DR
zyxM+Cs9F9CeK5&^WR54cIy4T3Bha=FWncstDtjBHU+a9KgL2i^P^h_u4^2+6d6vv(
zc;2?4)h3fY{k@J*3e#N-)WIAV+tH()o~n6n4NRp5xtBMLbIJu)cc^MJIQJlF84VGu
z8ho@Wx46Y+E)p51|91H^?la~uS8rf>Y(b+CPi(^Vy$MgkJe(V}t_-Q#hcGW|jSb0#
zA9yK02&}yG^EI6$xo;=;NPRU4h-aU-FJ!bG;ZVLk{>{)IvG6n+#<ZWeJdVmQyanFO
zO-R_-tYZHfx1z)EHF_f2sP=YCS~QZ$s?`YeT~a4lW9sgjtu?rnly?Pu0S5}!b}Qt`
zTRak!Ws)x}qva8nwG%*VH!G}OY?RNooca#hh-Q}|60sj+KYdTF$)@WNb~#7(`%Q>_
zT;`3@`5aqNh$eCax(JOOtj=ov9c<5huay0+Z`xJF@MA$8ywIZ#zXan)p&Pv(qju;a
zl4HnxkjsxKg6aR*fmTg@Q<?R8--~ybAy@RPW2xc0?8EpFa4J)>V?#H$^y0FNDD}}a
zhwiU5R@{mZI~*igsdJv>GP=JM%U9_!7(Nxa&&xWeunuZ%&PtXt(Ch8I4zbiR_jTZ3
z?$k9gV+i_hpe6;GQbw8&e=1t_JBkcHOifq_vgbZ!*C6F2BK)?L;VT$1Vp#6@2Fp9-
zOed5<uM8=h+kk1KrXlo2UXr%3L61o9=R`)KsWlIOxDI#~dGvR>b%i`EvD0IgH9f@j
zX6VFJ2|Zd+#6Do28>b-m>kscW@9TxuJjYyrn-rSVTc$EMkI{hV=6d;TjRR7w(jdKb
z*N-({A}K?wh=lJ>Vx)!le?}-SP_}1(rN%I2eH$>kE!ElC$7a>N6Rb+u4e;~S?}DmS
zs|i?VM@{(nqwoZxDE9P6u7K-WztsY>fmKM(X5Vrk)O)M^{ne74EPL6y<EvlLb?g^a
zgE#=ZF5Llyp-Di4pAj@8P%f&FdO&r{HnvYIRemp{x~-I?N!!qwdW!XhFIzzHX@s*!
zBl`a4%g_XO2=X->lJvHQVTRA5Q@mWRVqt!08PoTfPzquWI6+L)1#Y$TYzw_L_9z!B
zxMi=-J}L~7xsl<|X}~#9-lfy%Hjm~Fq$T#y(d!3nBEj>aqMmIpGy|>$=r@-t6X3MQ
z2lR)Ia}j$*@tVfA?<8U^Ti-Oxh4r8rWtXCn`5%SlA6y(#Veog}{Ziq^CUVlP%NsKO
zNa_(+dDH**cYD9NtPlMK4L-NcBZnJ{jv0^DEZkB6k=Ls4B;&JXF8b0}Dk@Dt>Rx3e
zy;r5mtESMtEJB)W11b5yp5>Dr7h%qfC|-~Gg-Qhs3U#oW?j6100R>-X{<?<r)QBM%
zg9Z?3RaBAf25uuB$ex!mY~jIVeUJguN*q;&FSiJa4bXf0H)n<KPHN)O;*P{F(Cm?q
z>pwvn4edzS^-KXvZ~f0&2Ja*!3Pv^0qlSl9XfVQK$p5Mks%qEIYk$`@sc2TfHtpVP
z{Q!xjU=$5JpVCZ<R_85%O)n2Mg-)j)M+wTpbqCm<*gx-<lIMl(wyAHKyWx*{YJY5r
zuE~dnM4LrmKqzw90<k6*n*|y76g}^w9U%`8ESwjyo~=;=(K~g6o8zdnQZ{LQT7{yv
zvxP~E3URe&5$}|NM44cSH64_i@jD&)y22+v!1}oJ(bCDE*s5?B$x?V{54mM9gsc_J
z8L-EW4qxiH)jIPCCp>$Gz!@4Cm3Ub9)`|}(WrG<;H?|OQ$WjuX(<WRmXLKCYCcA|n
z_L`jbMM*&lxWS=`6P%${Y8g{6Cz62%DbXS^ApA;VeQwREbPeNqlHGwl3iqE5XJDjA
zvc7)hpNx~Yzpn><qgq+}_<LZgFuyqJ8?-zjR(kH!o26X-=iy<Seoq?VL@;)&7*Ltg
z>{la1UH9AcQ~vk~^<W8Xn`F*JO3wE6eqzk9+V6v6J?-XeF3MGV47*0GpIo*ya_eD;
z(W{?8u8;A!`<2rV9>SM@yS-m`Y|_d+qnxK;I~Uw?%``YunVU}>J*sHU7EX3MrS^nt
zl2lNoG6J-ao>jWF`my~$YS(q*QUWLo-l<M?V1~Up?wQWiB|ye)tp4aPv8@K2vT(0@
zG^K8*F+wAIbZ~jK&(u8@yjrz=DDg=&<lkOlQoZ}1q2&cJIH`N3HOvGmd_OZ~*<+W9
z3e<HCeIFFpWNk;<uHvC*3iSS06UQjD$@o`f<b<lqkW~XKDchJyjKH@fpriXrqVYNP
z6fqA`MO?$qYQo#RKmL!ltntp!)$)13=zzpC&wI4Pd>;rJk5JCS5^=TXP2=tB8a2*r
zx75a-Q&>4EPV+2ILE8C-{r~1>etkKj+yd?N6G%e*`BaKqKeW`qHs#tyJ`uPLN-1s*
zb{#T&-zRha6jl+IsRVD%X!sCxa?Bd>O?$5E+o!jGg?yxfzYr~jPU{}cZjTkIz&o$U
z>IH-5Lc7S*Ak06^yQnzNW9;=P8e+14zgEkqx15(T7v1m*Z-pBJYmz*pGsx!u77R3=
zGk&>rdydEuoPB6adM!oPHZ(B!^77D0%*EqxzD+bfAE%7LxmK#gK1zf^{zwC`WV(nB
z_=wT!t*4JT&#Wq0*{O@8FjKCZluOqVWBA4X{<5frTP;pd3cm6)dMC_7MS!mnb~>!K
z-v*X7`%>s`G_y6_t>Ciw>dJSb@DQ4lA7HHov$d_dT&+!Lm!lQMdceC-zMs5h(WYaW
ze2<CJz4g|GmZ`~YVED-_t@gN+Il}vgjM5<Ovslz+tiRGfxX?`#_FdV;jphgOQ9Xas
z<arj5@Gx6Jmo0cKvgUxX^*tbY4VnVkaZVYOltE_Jd(`&#S_Utp94ByQiP0kfH|wq^
z5lD`xr%v`85(jlDr*8ymA*1lZES{}MdwsX2f*&pj34F^kygum{+K6IQZf2J7aFmz+
z{O97gaJt}~z+pq_t-ZrZkU@QKE<0}Vb)ZN}Ne7we-|GUs`r9~ez&M>^BZ3rYr`*Es
zv#ibXHrI$8H~;lOSNUv2sUCVINuf&~pfkpn?i<e~#*~1f{7J8w_d3$1r&AV#yb-Bt
z@JZjiZ77Fd_4ZwEZL#h1i1rwNQ*PT+GeWCZe|xNUc)<2ZIy2=z7KuHaZ;$Ybl?F;{
z&T)e|mjnLa$oIz59%X6O187E`@<7VVy5%DCwSPozpTi>}$`%tu#^_!vU&7jSGqDa&
zH1XO(Nf=!@o2B>`FCm&pUi`pi5(1qb%gUD9dizuQTqWX2o_F=%`0^Jq0o1<ibmebN
zkJLY3bNDzx<SZ8*1tt+<7)mv;39Rk|y}I9v!~2{40ch;}Pp8==1Z)hvWs!^iTjoa1
zeE^P{fAkrjkr~C{+N`v<Lg*J`32I>1`ZDS-GCA1YF|GEm4tl|m6b0c+lHsdQI7-AB
z%Y4@{Lg@XS=Y*f<RnMnWy#gzzzpP%{nW78lPw;%0Jx>diKZEp5OGU(CLFpV^N0I*%
z&e`WqoQ_f38$r(OdD`KR7ZlA}eg*Z}_LYIwQM^P&t$GLbR6;2e&<^y={tr3_;D9Qy
z*$Hi@I2KQd@QeVle}*qkTDIQjOdO_7Ak~C^tn0IZKJyo;k34c~OSWfiKb<oq9^*~g
zj(uhxzBro0oRpQ(E0fv%9>p-m4@4vc?`Y<!=#9&*@i%65gd<t^UYMddtKVZY#|<PY
zu~+&B%-(bHC%qKM5tF;46)k4A6Artv@v!;}yMF%n{$9k_=F{Wt?~VEI?5s-(Jz)DL
z*n;f|NmWE7&XDlRWON)-&&BX=Mr8Hkb#_8c%8CU4%XH1&edY_O-38wLyoRrkOu~Eq
z?+G#wg2N02Ht<a8BP%O^ddmbO5r+w&;g!A^!ei~2usK*!*v74r|Dlwuh~>aJ3=c9m
zFpwu4_=MM^@nh0xWrsiiu{Dip+&XuRCpUl^be5(2EZ1YR^Gft%+NlZt;YJybh^Vkl
zm~<m|%kdJvmelSevmtC!ri9;3I5>h7_l1heiSI*5<XaL~?_XtnjQwFYg?A2eFA|<f
zqjJywN6;vi&@FAk?HI8r;Jp;t@MYA}d&i#1Y~=qYZ6<<onrAZvd8TwwTLY~FZ6#Pi
zrPd@j(D(Fc`W*?&e-QQxfeDREQRL%k!Pz{F<5JKoa6T-<ak$jPYIJYE(C2hU!4j<N
zXgkF;B3b9igM&OaRvJQvyBr`TFd8R=nMNj#^~K+*`OvJF;_unbcy$BWJ=&J61$O;s
z0)ssMnYW)F93~~n{G+%CO_#CreT`l`ULeOSBz@(iVfQ`f4`D$kyWY>6MtTS{`kDco
zf~7}xh9}>oBr>ugyk*`dc}I+0l=Dvj$a=C8u4RS(-zN7fw~22#QS#{4PNVW)zMHOn
z_Y3e!1Knwd?;csqFE%3a51_&drI-2b`R{7RE^!QUiHJaN$i*}T1y53M*G~^#N{t_D
z9%Aqg9@Cb4jSvDBVoK)IuR_Pp%}d(jPSr;(S$qNWUn0)9z{H;6D2l`qN?z=h=AF%m
zI+jVu=;?Y-II7~D4g??cGg*K7!G09z4Y%YK)$8F`jjBsB();=l8^)1G$E@62&x6ol
z9#j@tC;Um*SPnyGdUb8-tIM%&0<k@*^r9-gcED?Y@b&S@HDBCtbU=nNP?_~cO!=){
z#(sUV^%8AgnIG4VQ9S>$fMpXG>qsAD^9Y0CdUgf#F-Mz*wpBJ?<qmanna|Ttk(_wI
zGYe`<5B3KyYR=X+BGE~W*P9W9k(>GpT(QbEqJ5;n8~GeGi7llch?)+xCCC_#Ll%ik
zqa@SY8&xJ_1(KANN1E=?OtL(o&w%{*<lgg<B9W(!uV5oUu(#8R@1LzuQ5+8`aA_LC
zIK}$ec0v44C_WAi*x-8cURunxnZ8!r_8X}cFXjXgsj{$HMA>cfp{v(?K=3uH!GBkr
zLIo3xFjTKuL6VdY$p@(%U2M5lkpw&pjI?x+DRsiI9yql%ycy{-)-Ayo22;aszmw8!
zx0jpyA&*-_AAr!^;;4D*oB9KqY2X1-l<&#!#P&3u+k8=Gn)@N=XDgxzH~Uz0D?O^d
zl;zR$@{rG{10Mcwdgj$=Gpj^&B2~yg->+nrRWVxQwt;7-+EA3WH@c{4ve}qYG5IG6
zT<TMZS}_A4J2ImO&`)f1DQgPqt{hhb>768_JaJs~r|t9`RLV=(R|Y=s4`_6@7T3)6
z=CJrLF-%V@t1jd5Dv{d?8Hd!z4P;bCGk7eDYQo1FZ;bw#@7%nT=x1k%b_jgd1BA2*
zJYt*3Pr9gw@l_>jL#;b<rU7Qbk{u-%s(mOaQi3OEQ9y{o@L!Gj`s+-=(j2rrbb+nc
zu%$g5OTF7By%|S~^h8uat2Xo-e{PhNRYEZyHKr99W2XrK$%jBR_`SRcpvXQl76s-R
zfAAGHj}~yAG9O4Vcin0p)awFx8iB{OErOO@XjZ}E`_-%51z-PMdyz!-S>j1`6U;-&
zW!s&qZoaTG-5_Z$h#zH2b#4$Lw4M~6jkvqjjaBEfSCA4yVed26+bhzr8)0VwakO%q
zDU3tQFYm@3w$H<d>rW0@Xy0~Iq4SIM0r^mS>vf3xeFgO<b;2dkr2{p>+9?HmBK~ll
z6545)>0VIg+bSpCqooo6B;cYM6a+my7rxU=I5q70E>s9!{)fXG#hO0hGMH-7_fqHW
zJXhWROMhJci!=R9@0nzPz)x~LJ^v>L9aDlU;hL>%(%*`wXv0vam*9X;hxS2dPF*Qh
zrfbG_DJJsmvg9J}czF0bB|<jqrQ+X|TBa5%B+4~t<*8Pz;AwxG15ZObxE7K3T-on&
zFS0wWjSNJMYYjrnTj<QSJ??NMD=ROfU&Kr>sdVl`lVUS;>SL`Nq32ga&x6fD>>#B(
z>=egri3L#O51Lz<;hUsilzhqJl066*X6qmbpMlAmzRJ49$4+E}6&wG2q?-)f>d8%V
z=rv5dW9?H``0Q%=x$4R4es)B?4LefdJqZxLVD8<zgU$xpbyA2$a$Y`o8)&&+IsoRx
zthvof|Je=I&A}3okR4}-n^R4l+=OpG^-A)<5TdjgQT?K#F!`bv*bj`a%hI9KBMvhT
zWz$Gi{>N{pSBM~*A=tW2)MMR;T*tu-y!Mx&-SU-tAGw}s#JXbmj-i)_WP&q|#E?JE
zK$h3tFNzWRyL3JiS*=x~2^}l-*w;!8jS+FMVkn-{q!P~LuTg`Pp?Tj;jhcufNA!?T
zD(AJJ(%+M{Rgkl*%fqOfRY+#Gf#%jpzrHLM^R?^8xMDm+qrMu%f>@t!`4p@Hg_b^I
zdbJ?3=VC__&s6z<I06gj`H>fFRuJ&y_4>W?+F2idwdWqT3uvqm*<Uk{#<Tb$3BUSV
zqJYDo&}S`@cOQowWQ{$wI_5*s%m@uXr+^O)`Mbw0J=C`B(iGS2NPW!i-dg9wW9+|A
zX-;ShtH+M(?|}GgM}Nz9g<C8K-WkLT9Y)k|`$bSo0-_HJKY9B4wI6*TUZR*Jt+=KX
zxG~>4Rvcbpd}`qpiqYAWUlwibi$d%B(F1R_4&v8x6aWOoJ6f#Dxail^D|JFX&@a(U
z@J`k$yGObb%62Sz6Pg1k4^X3R*Qr=0!;NussB7#?TAL+5{yB^u-$Sh1Y#8)Y737ll
zoe#ydzH(y+dF^0zK}{8ydy_Gpfsowk8_UXf@p1(0i3PX}IBewJ5l`$Eiotb5jsYVy
zY-!m4rlSbjVOo)_aFvCfm~y<bMec${QcR&&1cgMAVX28(fl7!GT&m<BWxOPJu|JnF
z7#(mb!K>!oYFage>~V}1?Vx$dbL5jR7;uWWTb!Ae38YJo4Y_=2g2z-W4{J=5aLKE*
zn7gCXd{44#i%dYQ?>a4RSXE8>6YY5N8}$o0!jvB!0;rqJA3F|6b-~@=GB3a1@jMMC
ztPa6-{f2#6h&bBf3mca<X`B`KCs^uI4v^W)SNad;CTmD-`fzYy!0Kv-ci37o7QFii
zYZ~K(dpNsUN|Qk*j+|Lgjk~Y@%N9E}rMq<@;Hv-`-rPJ!ga}LsE%ttA&uIDWyW11d
z6DB^`wHXJP{+B0v9U}hHhY2qTmat*o)puEa^T{VGC7aV?GL2sITi^tJL6H$SAmXR)
z?CMc;j0%qEJ`wqzdDr8hdZWg>#<la?-lA*33C%38O4CMgyrcQLEU8siA1ZH?1|mkF
z^9ERR+8*MpqB{Io?mgk&5f&n}Oqfo=ImiAsU{0FH%FDJxrU~~v2H&$XzcERoy#DWT
z$JHsn{Et&l>keqGt#vP7W(P1-XXp*vj}raA;Vp`g;gGlaaD4~qAKw3e@Rq0tfu02%
zP9Pxy#?DphHGZO}Q%5ZJM}z(AVMwne(CHeIU3&fL6L3F>B>`=xGdjAnbw=z7OkE?s
z*b5bb1<PVYrMtp8(GpLO@g1xQ<jYLff5&L0oT4sR<0TI2xL-aPj0$)C87|VOM;ZSm
zP59925Kzc=XSP~)gzb?WjZAD-bF$J}V0Xz+RtZ7eAzi*1+0^u4qQ`_;o~)n=PWtRF
zFQ8t_y;*VWN1qNz&EdP8gKpL>&Ub|_2a8$3@=9noVZ9SLeY^@^bl^wm{wg7a<AI|N
zi&AWev7o&92ivU5zq4DD{0&waV!{l-yJWE8NwRS9KVz$e6iu%WXqy-gma44R(l&tH
zGX#e5ze&0oru#Sem5et*5Y3E<A5KMvRc*5_x(tiUJ_z4R>Dr#*-nd`v@@X7ub5JDM
zV|9Z=ipyoFxaw+hCl!eOVuV|jEGCbtM4j!%pCK8K*WZ-NXFbxSsTy9bNe&UUo>Mer
zT@<^nKfQh~<q2YC;J5wS;y=YO;eYtbACv)ZTn~j1f6vEsF!1Jv3SPogCRAU{b-2J`
zi+_H)t$rYoYwB{&F<$&DkL~pz8yW&i!|E4S|9KeXcAgI*%J9(4!n#ltgpxHu0G`G8
zDvr@no}4H>$MtF=poq#1qaQzb!XkD%SYYexdAn$<AQA*ZgpE)Lb91X@bTyKoHwDjf
zawsO4fTrX>cP_robpRbpI<+EkVNsWd&5o2JHGefuA(m^!8FAL`EL>&Wg5$<c^W4iW
zo{chh7)|l8J1x#%=`HxGxLOf@U**5y_TJ=J@L1ujM8ZXjJIZGMsXRn{into+H-K#D
z%ivHD$eU?U8Q`gSskXpV8Bg3V*($X?T&YN~Nm;D>N-v1QM?GJ0a=}o9t_Tug^~m)<
zZe%WVcl|g^>p;JB%)c_^=t%^j`dtD;Pw+q{vVG>in-K9DnPE1SFqNk`v5T0EH=h=q
zeussoY8v?=<eSSFn-2ALQt25mm09<ckkP%7to^OeoE6nRhH)P28mlmCZ9{4E$z#`U
zx=je5-`f>|OW0r;psXdJ(o+J;^v^x}jvjwXJP|dS0u}i>m40;WnBi`o5&bJ+Uy+mN
zT=V@q>;eY7y_#lj?m`vo!Ndjslh&{i9+KAh*8s<7o;1Ls){^<J^_fMtSL;)cpHr0<
zRBV&}7(s{geX&$(FlRSfrjb9C5r?@op3P@UBv#*8x|kZq0y2ME1vQKCP+7U6B)ATW
zt@5bt*$<>H7qJxC2@ZM%p>A4Te*N%cxAV~ay%mN9njKyTMX&8h07xEPZ&Usrj73H+
zkXwF6=R|>dgyk%z$Q?l}7*@D?Sy3na1N>k^q~uYUx^TlAZ%OUM1kZwhPo51t)+&5V
z8owFQEwtIe#;{T?*1(%j*WIEtD;*gKp3K>&KUOD-nGt2_R~Gnw&@cCkAOE2dR6N7R
zC~<v6JMjF9jn=RC>C&>ad%4F|@Q11M9;-jk3B7guD4ca>WUFJ+`<PU8ZP+a(pFhoo
ztbIVCBY`PDso3bkh7!pUw{B1V34v)JabEpXe4jGC$N1WIK(}*#_Le5*S!TyeH9?j^
zQNeMF3#jY?{sFQ1d0W4kyXnNQg7=xNEQng)v^rj~^7VSQ^sw>jZev<GX)TJ+Mgp(#
zXMoLltTlNy=OZEl5|v~PdzPkNM5VY5D9^i_Ump!P7?FFh6fC&)kuQMv{Lxh3^Upl)
zdR~(TFCYIumfT5_4hf8cW+k=eNOckx`(Peyk9`S+cP&Gs(AmzI!X%EcD#2@bCk_Vw
ziUY&n|EZ8zP?q5BR2046KTftaK<%&1z0v&W;ZdDsR`H{jQTp!5iSKD!j~kXbSv`$i
ziYs)}Zp3i+Hy8FjuyAB{?Pt;*u6?$O3%_SHh|-$P<JKf&ro;d5jwAA;xpdFharvm4
z#k<-A*%q@XFaz^iJm>COVoU+*QeclBTjJC}@BgOH9L@(N7_%#J_CI2gS_N-UCQPOR
z*L4msAip6f@aEmWkc_EPS>RT66gv^?e_%@)g|cBILHB`21CD}v1RE@#{*gs>EUr^u
zZQqLp$XV_@nFw5=+q&2#Q6|0gIqxqDEX5lO(gbA|P^+U}p8GUq(Hby@!vF6E*KZdY
z5Zm-XJ6(<{4{xqfw!xE1sDpo(7H%ewQZ9!b?+9{6vqi23{KA4UvsEq0rUf@{PM5PD
z1)Nma^71lUqwp9V$+Ap2iR+?E6%OPm=b1BSbct<Zc%Li3uHtnDwTLY;Pk#>d$+63U
zNB1Ft>$pDX$P%)Eb#OOrJAVZcl3jMS8yjhm^~(+Y^peai${0z2Y<F~Lf>@W7i60`O
zd{NS4&uGK3YGbpGT9Wsu47m7i-dR0>a8;9l3C@;P2iy<yBSVN-yH`siC_ROw2DLy0
z2&p1xLhm*I@Ti?hX$_K8y5yI7a~Dhg-d&YrP20qmboGt>+Gk7K*8|@x#|oVL?RDE3
z*x0<+I7Ja<Ho&GoTRj>5D<(`=#DR*_sAe;-Ok)sGQm~ev?EWE4Kgsp{9C$}1d-^dX
zj>cb-r`GpFw*7VhUT^O_0!b7gXay7h&jg!CqQh(-L^;tLt{o``APIEs70<$qm8By0
zKVlb>L=42r6n5>Ch82#oBZ~e2Ri}w12%76rEJE#*rd-%DWG$!cgvfi%#nu(;ft!x-
zyNvzuwU_3$6l+=nuK8t5Opn?C!mEbXX*Kfr%>$0Rn%g6`?d5WhS;7MRoV27>;ikfC
z=^rbBN>~*lv04B*Hq5T>5>VB?x=nR#!I(%XQuqi*c>ef~pv19&@=5%trGfdoqR2w$
zJ4mkOy>O3OAxgqv@4<y~dD;J0x|}JHGxg2)gX;6Kxhxi|<Cbmya+PoA@rS5ZLoM=r
zpSig|vEF(Kyq!Cv^L2N(uRukjM%S3ZQ~e$U&t+sAxGB0n>~6Vd1-Zyu&>j8qVSA4K
zvmvWu^PLuVh}DbSm_Mle`wYtq<3-iFrpN5%lv;<=%UoiiK=|EmK1cV0Joz@u6wjNs
z^uTbtumkb+8B+4BA^=JgwDhv5y;1+!PiOkZ%c`DL2DwyOQ>o@2K~*9Dbhyx)!ESI5
zX`7JHHK>@s`%_+2%?Y->@ezu;o`leN3`f8!smr?jkkW4{xR&H!zRoS_5L&B&GTmhA
zT#iEQmV!b;v(an#&avl>o6>}tegq&r+`bl}ehR%<$ze7=)h*exo39+xec|}W?ADmi
zw%P34R}qqdapiRh2yI*xWOKQfQepDKPTC}U;8@z_yhy2da$;KRLvvp%Z0Yv@3B>im
zPh>ng2h&28#b|*}sQ7SSC1kOG2I>Pc>Ci`%3-z4{X8IE^fnM-Xby)8wY@XL(<V2|R
zr!8<$3|fzSh1@b;0Gv;3`A>G?KTj{SZ6Kn>>w<2X&LIpBFCZ7g%LZDLGIx3b42h)I
zXtCLG=jz?;BnM~>P&_qy`_Fx=(?iWy{p6+ds9t7%TehHwb6bu~wUi?)^-w<$=`B^?
zQ|BNO9Z_>{G;`>k1LPZOUDP|NH~1SssY+FeR5}|-qjD(MqhfrE%;wRaw`UozC~+;0
z6oPkK`Y&8ns>4|cx95xiLDjOJZ0v$B+}Qtm*DX;hr`*=xZO2e^K`oniGqfA;T@}33
zx@P>-A)Yc56w*utLGN+hJ*e4$jw-0QjB;pr<OA_fPogm>PGCX`F7hYogO>bd+vB=+
zUW%N}O~0_ZuW?}N-FgVV79#fCBYlU3Z7mLw=Qr*J5zcMbh-D%~riqL9DkzSG#wE-Y
z8@D!X!$DKNb!@GJDaeG-e|k%>^p9&lIHM&E8QPd|?K=;@gG`6a@gJ+OcCC=1_jc3t
z<I6fK=I2N>ywGGc-Tvl8>jxMUl#C4u7Iq{05B>NTg}QsxS4bP~8%7~fvhtgw7-N!O
zT8(6U7dI~fCc~m6qxjzvsl$JaC_Vi1km@cts&HJaTvPYaywLaIFI(bkTE0^_(>4`q
zvRT~2$H+}XTCwN4V{h~I`&T`vAG)duPt?_k?I6QmoVR4$YX*!P>I|RL8nl&J%C6ui
zPUdvv&P5^-(a$2ae9YfI5S{w7W{_q*VUR_0*Qko7fZp#S@QYQ#!{6_t*D7BKh`Lx=
za(dD|G2hl4+sH(UysJ7VDijl8i?%>pF(su$=0t&T+xW;wd%qR5tK~eDX`E?XKn!Ww
z`6h3#&)s1=oROH<-=+%$<>$NVg~TVfcJvr-T4yMCmNKPXi2HQn5mOXJ0#xsNr7c4Z
zLGf3c$fIG#j}G@g8+dA0{RT10+=qu|1&K#U85ngw!G8xfNut{<GByDGlKz~Wi17~b
zX;AC+{}Hr9t&fZOy@A^PM#FblYdqH2?Ic^v+LN>7kg&P&KuA8v-F|v%tCmM9>cf?v
z`+cB{`vwO5D^s^atLiJ&fM~V;AO~>os136E{(CiKk$D={%s^&|Xaq!Dl;dz-rN7hM
zX0B-VRvdIG1!-H#_bApMp4#=q9)ai9x9*fDN80DM9A9S2=oRA<CAFxvectkq&2GVp
zpyP2t#tK~iljFWy@as~kV~LQ;$t#xlBKm9uvW_WPUTKUxfoN`lks244BYPgpWnmXb
zURBpA!)k2pxk2Z%M;-fyyAi=a>J13Dt}DikKr&{Ti?R%v@_mHtIBJi0v_EB)LS`uS
z##f;8J?kL(QWWw0uz}&e8DlgX8Wsf@4UzD^i2N{mh(_{Bpd3K^m!PlHj$@mGu58lM
za6#t~GZC;0$tsVOcY1J{vi<9{3_QB((Ft3n)4(TQjg1L;h3?N&%Y!atzc+?iLIgg%
zUv_F=f$+5j?Lev)cWwWvVmG&w@&V|OnOah*WsI{?4TLSga@AG%x!s1J;<a{nviNJh
z3g@y+_#_-no<Ig91g-kmCiuF2(9s&`xong@>~j5lU8q9B!0@re=aHrgaS;+kA9QL*
zron!klsX3IHK`;cqf-aSu95X697}b&${s^+p-9OuLE{S!Ie)<NS`ov&=Ww>UL&_L-
zb1uA&M@V%AzXw(rKmPs1MBS(2rrxCOo~d){jZyTM3`<078oP$_FRpE0etFREIlYMM
zYZJ-6pezquPK$3bCoUvd5KDft&XXWfP&i*lRKv3XIz#MGjx@ZB4X?F*(TE_csWQn0
zn_+E<_0R(f-j09ou;gP=<gJx$;f*^t_C-3mUHl_Y_ct>n7Q2k@U8?P7)j3daVgeO9
z={%dFQ6Cj4fCRYD3E(Gx-cqeLQY6-bh#><zl11)XnUs4yq1;Q-HS>?CjL4F}9XNQ*
zZo;he<Ws?U>Pb0qt6L5XU&i^yUy;ADdC-Z;+x=c;4L69FM9*uY)5lEqe9_hzb(l2J
zvV4M~U#UIciBzZrkK9+PMEzciy418n=wr$N-+b8J<rK&c?&_3~;O`UHQ+Y#EI{upF
z^2wAGv#$sww1IXvjL=yxo;+pR#}&wlO2ch0xem_9_zHZPxSvT#<ZGNZ!0M18?6zph
zjaLn%MB$pFJdM+VWQX}EXxEy+^sy;cE~{^z6nwmG;DBp1#)Y56l|`fP>{H*0HoF1{
zJ{yVQ!fFY2z#6dBihXaDH$m-I5oGgj+==UjZh@76#ZhkbRd&Gpk&=^|oHE4fg4fr3
zw5OzyYHDvv0e<~#;#V8vV`TcGBq1r*+G1uVRvn*zU`zIXW`K3W2NSD(SPYyc7-PDn
zfiJ$#L7jn!_6nLPtp}DK7>z_>!&FH{4h)sXB=PN)r^<YqB%?*pK#l9bftCe?%oT5`
zMD%-+HR6@PyLE++p^#bGdd8TPFI4)JKQEyl@|X7~hQ(aZn^O?aKoZT9yTYOY61#E=
zyRBbdDGKrtkx(bm3oZLPYy^*5XYbKz-}|v*#lc><@7x7?!t~eZH$2aERashte)fr^
zKjF&V14<Dhz+wT6XLG$-eEoU414LfEWeW7VFb?cUb|hN4{fvGcdb5;xcmn?Y|8m9!
z?*>YPzzua~*{s4;@U6gOor+Ratp0Afd^v*+T_`1@^Tu{%7;0K*Ds~o#i~nzqJMrS`
zh9O;c>DzE{ZYKW9Y>!11p6YtiPQ2Bkl8_v@i80L|@ljoUTMtZ_yGB3q*#zVWRn1fT
z9h{95&*MK|5j_KlhgGcErf3(KSEml>rnL9er^_tS>(1YgAP!zN#})E<QqeZjIp9EO
zhLruotx7ceo(_4l?;H-UoBd^Vth;O>siSBlSvZb6j44Ts=0#g!pPc@m0htYlu15N1
zQ&a)OqPXq&Ny#!rw<uC^_?N{`E1cZd@BIfRjJK6elgbyu{WtepO1(}JSpwmF?&2-U
zAK9L%-=sl@w<c~|(=M_?u}FG`VtGNa+6m8;LF9xl-08`gj>amMu`j$UfrxNQ@oup}
z)+4IKMkHVU)iL8BSsop-x~m9k@twp>94%NcJ-t^SFAH)tn|gQw!m1*Wl|&f-)!7JF
z{k;4Vd&j9QnS%4}cWZ_%683q*3Ui@Ukx3bpaWspj#3W%mloO<-MBMK^h(zU`aIOqR
z!i2tIR0%ZxDb^?Wj1V(oERwm7n?PIs4>Uz6-$n4r_E}(Yhgu{=QQ%@+0N`RA593dE
zLpWPkhq`m&NUfXVscctAa8s{WQOIxA5<~b8rQ9mN;LpN6o5R%4ii4gX><)5u>wYhP
zd;Tu&#MipZ<oOA`CDmTgOw#J}8}qqx{>Af14$Yt{EO(-NrIRI}_7yern-T>-Y-4&H
ztH$<k`C0??OYst#W!%IdY2GhPz${y~UP0kgrYR4>YlTY@Asr#J<b#|JYP)nVq#Ch)
z*9pZEpqZFlenX3OhIs;<Oet{SK~=zS58|*UR{BmR1z$mjA#fX~zx2#g@D%sWIMmP2
zT(H+EiM+9G_NhPg)>pxuPRu?R^OOPmt(pi-F5Whelbwr5!rOU;4|<2g=aFEE!Z@&a
z*7%$=yKQ?3Xo{<P8(-W3kgBvxoKkjZ4~hAOG+1eRGcx4($KzeANcwTc^^ego!OWp@
z9Z-<{WB+65FqvDsudT-C&hBq<He*#95g2OtIga1Ru7m_9y1jjt@WdJpyR+Anq||N5
zx3CdFFmH7JLBW4!)O&Kq=goX6a~koN_syC@Mz_1iIH+8;A}5G<KbsT_b1$g+*g|)P
zME2iuj-VhHkXG}o6Eio(HHK+URGX8FY>(?Z%X!wI(Bq>FGOyVYd`MifOUNkIR9FKR
z2E^?)?-DGZi}nn3YKw#r#{->aLV9*TDMZXRx>Drub)(|&sBuzYsv4oJ_f{F%7gOu;
z8}+ec__E~A7ly$v{V$%<JoD9wPZikw2>mVVjXEOxD^NSa3`09zP%9`yRS`55C)|Q9
zFDHKWRUVtwR&7yiE1s*^gQJ)ONd=`@%igs2jLA)D)ZIe%iUIHa>L&x4rY_E~<o6sE
z&6|PX+deH~OXLK}ER+m^f0_MSb{gb~bC)5|&43k`=)ddM-^%MF{_``7DA{@C3fX+<
z%4XBVXKj(X#4|Z-Rk|F5@w+6oK>S^8UN2s6Qm$^LDOH8Z-Yszf-(oUuNa-yhRk+!1
zm}PvMOi>dUoscH~F_Rc6x_q2@Epcxq4?{f_o-20G*NHWDqWU(*UG>zvb))9UIFj0O
zwwDH@^&sBX@h!ENJI_B-NUiFc!ZX$QK0_wPpNgtJ!n$t|2lxC6>yadcP}9UNsm~LH
zJSVz{UH8(wp2|5_b{M@|gC8C@NJe`LtS$a{wk`^T1u;^Y0WiVW*O`)BQfaCAlLxge
zLwVl{Lsd;-e|tm4d2?%c#kaG8MsESy>4NmE<Biico3)p8pFWXHB*2w@#^7P(EWvV9
zfQ8M=vb(I6XE>$8FVlan7x0#3#jxW$LyHHF{8ta`pLXDQ_Z32Xt+E~Qetr#Zjq9Yb
z>WdU0|BO%Mi?a0f6Ax|~?$J#l+e{%$vDk7eUZk|d3=fmB(d729bfD>~oUok3HEnk*
zZ)K2HQ66Zu{bqJ&yV`|S12)D8UlW(r#WD3?Z;DffM_1bq&FgR}4*Vx3%#NC#rO!<w
zRq{JO_XN2!Xo`^uzpI23u?Mhkd`ob%&Q{6eVqlBq&E<@Cf-jak3Xj85+mF*r;Z~+Q
zIkMe3$6OLm(QLe@Y#Y)KN3xo2Xlj|2%+IMhmZTLDH^%Ndi?8jiLC9-Gug=~6_3l~L
zT`SNBKn4uNL#h+q{5P;o>khb&ftmoS6pi&*wNCBcEQr@Tbutg6nm!CCI;mC8C<7O4
z1}3o@j+cJ&nsQdv!KF)X@57<cPZio*!ub+E?uAuIu;5V+8ym{%3VfP=ob7SGOn5Kn
z>hUXHsC4|m@^Ae@*P1rdX-no;nkkZ`c$QxcAul2M3%I|U_B0wfoX16_i7#9#4=uw}
z@4L=x8F{rt?&ArriR`*6`~rjRUp|seZfL`a1tyniehI5>O^E}+!xk6Yuc>hwai3&J
zhFA!((0Ky(U5OFU=y}d+Wd{Tc8Rw0AZ0=bTMaO!CJtG}%4r^!g>&&$PT=h{oWPgw%
z`n%!;(CLU*pmLAG9u}JkPC>%G(u@4qGeICT16>Amn}VQuZq-~gIHoB<(!b@#S-k_9
zu_0tr<b{(fH!p`=y+6<ONR#s#eAVv3;vbHvGcK^Rq@-AWL_V|?Eq<S+5sbVWO|e$b
zg2R4Vrp%En;Z9_0bD^~HB0ULKbB<%ux7sa6s@7R{sx(<DDa${*VP{fysmHcOaZN<#
z<aZ+ed5r*LiY9O^_{lDCn=*z5Tob}}PB#IULh8K{%5>?>CHg1t^sjB9#05^}{JPQ<
z>$y@vyuh!G)3>4450`p^LN%#HV_d6iGn&h>5M>VZvjvqn^?FG88gr-NX4BK%P(NK2
zdRGa9W^+wt>PHG;rm{r_tdzvKoF&~jHCFE&$^`G3Nd`!y8CKdbAXmx^9jwd&BO)v`
zIE!6^Zp(Bwao=9mp!D$verx!1Kd?~lB7Oj9SnfCOeC+P0FsV2@R5+$TufAP1u(-#z
z%<5L@@aNV)A9=csY~&puNqUMZUP-~0)rwTDFk?!-lBJQfq~iOU+HafOIFiF4Op6$e
zDIhO9?>=zC`C9Hwillr3RDJRTvN@O~O~lM?O(%Y%-Ii#jRFA1IrC!;C$d>UL(uy)!
z4?InbC|f8yb7c|kn91t$cgNZ5+Bu(buP6xOW{I&U`qW*<c%Hyyb<PN2L5@<Oh5fy=
z);eB~Geb$Lb)~4=$FFz85nv?$d__Ag?4?KTCwb=kC|cyMAL4|H{fzx(a59xEH*A0x
zgOdenvt#V-&%t+f>V=nX-~EIx$QU80H%h(*yzxys<UrWmje=kJ&#CMO(uNJz$X;gg
z=F<jR7ZoaDI~pr%a00zyh9<Kkuc=Ayve&@S<!<RWs;}vD<9SGD`^35TowtgkqbdV*
z2d0sWM%m-`_`_uWWg|UpQandWJ5;Ld%^MnMeW;lb(OLM8m$_5i7<u%59;7&`8-v0P
z0*k7PhsqJ9wvz&Qeo~oB>=owIQ?9?1URlx?1D$4>{f}`lhd)-_#xZ_?;lLq)vJPma
ze>|~~2Wu_k_SRttHJL$}*on44c&+m?EBFJ6Bf0PMwNHEDFL#`(4b@mq`f(6<i<2&w
zlRuHsyJhFDF{Y_<b<hECxJget%W9SXy6ZNLt3S1XbQIvhawco!3dDYxq&EQJb#=+h
zfZW{Q`)wRusl@xh5#xJB4g)XS=q!pK>$h}pX!GkuYCF%Kk6HO$w)2E(2p0K6P*#z>
z&<EgMwx&j((tR?<Vz*gGlD!X!oFH`pt{|6QtMeb|0KI0A_b_X->YwK!UOlhd3ApLj
z6_z;p-9S!E5X&BTxaHz|AJLX`q9vdVR+9nK+ie4^7w9zAE3M*-b^t^$3Ux7_z<ZpF
zlyA3gqj&@|Ruv;xvl1*I24y_$LP%J>V5TpPZ{Zz4F-Y!nqQZn^5!tviz!jH}F+_}S
z=F8FXi|lN5SAF%^{pMZ`0vR#oBO7;W%&o_b1iR6QCiJXWq^8D{+wJv9Gfu{$Y0={H
z@UG}S?%k(`<K<ef2Djd%;HXL_E{vsKwP-vnjL><vtc8?W#Ep*$q{NG7D=pV)Ch^WI
z1r9mC+}RfdUbt2(l<PPFA#s^aVi{Vx@HR|5OWY7e;{A^%e0$u<`4Yd59@o>*3B5dB
z0I17k!BNVw5pgy&VJ6iIQ7wC2-G^}oon1J$se5b2y6tps+@eG9#FM&i+vZ34?|+k8
z_M7B^FTuj%^i-@6+w=Ijr~Xb3pIdKSM^Y!6n}=>%i7QTGS!c47r5hcg^Uo7@K!aqT
zlWl3Bar?n>h~6C7+9;X@i<5}UIr|+ii|E|CkY12!nG18i@J(!dr;PnNt4fFSWpI@1
z<1K|uQ6iY`xo!Y`Ih55aKDVaH8gNXfi1;a=2oCbZ6|p5B+gVG0G_FY)!`T!BdG(0R
z=-dQ(WFYhwb~_)@OFs#M+X<ho8KsPjB(B0&vcgP|ln<sp6MEC%^L@qpwZFkMKdHd*
z)9^Zx`&2ZomuTlHtf}43fioRcuCRHBTX!CPMYA_ss-%)!`F=de#KpexJF&3I*=yI-
zhuSH$3;XjW+trGQh=%q4uEID}Z%Mh@IkC+)NE$9I$czU4u7LgFW$3-l|2go9qgqia
z0KmY=<RiG0@SPoJLM+eNhElYA*0~9CAXEyG56pnd*ph8@4#mifA6?8sLA{1N_Ohrk
zx?FXN@NtwWHN`dM3Cx}x523=N#~pFI#FKwm_Sm)RR1TKGb@GhfO1%uQoS&;0_3K^4
zdHK+PAMHEiWTO2I87bLwp%NwN8~W_Rj#S2xzAXtaJqPn9NcPPb{ctYihrKC|z(c<4
z^%YBeQl!70+dkE(&>&Kl!TrbG@%xxq3=-;~J~7CO;@AU)51S>`vSSrGj?Nqb1``p`
z2cxbuI%4#B<%^Ku(h_^AwO&d+`;sQdM@YJxNBOQD)SCXeA?`H(-syntv<&vf;(izR
zf(8>FbV+8R2|A}+(wQZ;iEVk*QM;8Q?+CGU+9)mV%YO;XITgl#D^q>M1Md(<Hzh)w
zWh-mqyKpRXiXbcGpcQgLlE@Ux0Y}WkENQ?xeI0O~%~$wMnXFedCMet&3kV&Tz;D%+
zB6mMAY8|Dd!xL6GZ<1NT+`xoVbVv2Y2KQnYxEjguqMrbb&>e;Ky$9K0a+a_IjD8@K
z?)L>rkPtoUmFUg1(}Qg#2_EpdMDxJ&Mm8_#Br(C*2MYUy-=Z)&yl!)m<j~Ur45N?}
zR7+M1EEir}?u^>c=cL${1{;*zB;0vJvMi#FfQoqSt9TYx8tZ93S5o!H*$FGEWMTa8
zBT8@5IT`;**2yV`*fx&97ud%G8`R9`Lf(iuJbH~g`Z7&UKP0&q!A8`AHf4SDMFtW@
z$wfbP>Ew&6U{6MV4Vube{Ot7ht;A)en&HK~T>9G?>fH8=dD!FH%d>&hab@P%8z+yX
zJUohB*)<i%jbD{;q7>r;CC*~}j?<?%w(PG7Uux6RaNc;hPK!|n1<M)`+Uk3{=A~%~
zr-SiVW8H?``UJ*?NSFrd+)L`=iP~zKOdsEc6FNK>a!{bt8%mFOUh#f_KU>tMQ~L$B
zvBVBWG!c9QtlubqCQ|dF-l%6mx6uautK61LMA?Y(>QQ>%U9f+XgXiLpEQndWP^|nx
zb`B^5Yk4RfuD{&`gT^G*T)T$8qyf)yBtu-6s%2p|_QWM4g^zub<h$`jjTV*W{Z%G-
zkCE_8R-j`mSFVA&K=c5R1dH|-wj{ww-Wxj(u3UvWBzqn#8mEfP6YMy>Ar^k|bsf99
zD(lao(<#}{G%SteElIPJ(Ers1aCWMC<{BRhJS1{qxt}gf2?Kj#%t$?-*4PM4{hpiy
zYn&&9x){m0uZYMtOp8ZDFJ=y%^Mj2gsHX+5f{?@OyyyTYu7Ghd0ARex$UcDE--B|w
zgb-bniBtyL(hNQbO%tC&jbl<=gUXm$5X5rz!?+#b0V?i`aJ~J;_Tf0MyHu9n32*69
z>E#EEoEWCnnkL)v9_!^V>mPQ6v@E)j&Qdq%6-C|GgXKq9pX+R+Q4JfcZgJ{)!W?GX
zuX*l1p4kM7(d&^K(G3)ic4`ggc8oW)+!1Lk8dz~&BN*71v*;L7@>u+(JWoH=52zUP
z$`a@FxI7{G7UqSRiuHX^{2c}DaFfe9Tq~`n9X#Y^dxk#VrCuz73A1kHIMdzGoK!x(
zjK~#4Wb_?|fx2{E{^HN?Mn)uUtA^eqc>CP>9I$43QJHhv))znvmDd)fz|;*m9m~u=
zF_(m~4~H8Nakf08o1Lxp?x3IE$a?_W!rW8b6iR^6sfK}P`jM!7STIfz^VUKmR(-5Y
zlN|{R)Ouofzg|$zT0KkeCKwZFCaSC#I8}9%N;~$2`?-7St;Vc+u|RCQq)CePRS;eE
zrz&v_-<gIhO$Vt8&21(Q<<jEX;BK3r;oOW^%i}SthwBmMMZ4O?xEcC;*y2Fu=Pu&R
ze1FZRY3C#v3{%I~?*zusobEWvzAF~O7K}Xq)L&&{#J~`wDQisJh@ScD-9K0hSt2J_
zEKkJ4e^m#7`a7~ra6<`E0PJ0qj9{1$PNr_OU_%aWlE+>#w7w_^uC%O1@O+^J0K(=p
z(-?x8VchW=2jKuXUK3zUlm>aj72W3*`uxh*pt97vzIVeX)cXhwSZHhXr1WPx>PuIj
z5pZSk$Fybo>k<^naLV&(K$lPiUQ*KSpi1*zX%|mNa@MPhT_M3y29=M@Uk3h|b!un9
zfgeBkwnNY8=0l4O1OB;j;;d4B9{%|)n&%T9VG(~xtJ!8vT8UaSNR`#``NzW_UW`SH
zSCG!#0il+s;CdXHj@d(vzsK>i=_y5g(oCRlNjFJHs%r?DONr-{if@$*t%#!qx#_ZY
ztk7?^jhkJ*ytIj_U1?Iv>*^Ry<0oR?JRL@sJcvHd_??3Q(`~ya1R}$RRdOvzFk(%V
z`Ax(@bsm^Yd&ie1a97D5eNFMKusUnHwea|hGzsXxDwI2X!d7ERb~5S9U*f9LrI4|v
zlhHN1;Ju|s4~3za{=9}c_(Fbu>$2^=rMk)uDiF}U%?wEmbBSu31Co$8#t@@KBCEdz
zlAwPykJz43S9C;%BgJcJqF5b0lj398le*Q$|CuAe9B-4o39b+zd%iiuXs=4;i91F*
zW<OXD>^6&Af`M#X?I1bP79;sle098)Ec!fQp`Lq@K4>5Cr9cu7#A4)>I&#$ujKv~(
zaz!u8xSJr)WT~-lUdl8^)EO5gdJ3nkH8-PnfC&UW;>QAG(Is*P|Ex5LEq8~(khNY`
zev?fKR}KndjO#AW>GAVSgUU|8<owVzovj1OWUe6ZG#BB7#})8&%H4^d+acIsnw63s
zi*vU(coGw!g~8>buH?SZZ>x34?xfK<;IUtK6I(Pjry4*s>qn;COpNh|Au-)3)r6!X
z>xWg(6V%8n#EDZgq9W|hZiHZIoYnDwZ+exhGi9;Wcxxr5h@6$Oh&U@w9;ZaqH#;@q
zS1ph=S?V*Yj8i(3!W8N9Y5411TF>lYs!HUnn3Din+$s24$HmM~f{*+RbD4eCj7*9G
ztWJ6ms=Bef`Q{hvrR*(pfAz?|r7>dumuHP>0K}9Bx?0tkVP_MwgVM>{U_XvoMB~|B
z;(5_nwM77_aYjOYP+RY&_KDzz$z*Z{S-CZPmMzz&lPw0WsqHIDtK`Jj?MM+79)ozn
z*Ub50F*tP&Z7yP^S<j^y@R6MGazVZ-xD_jQ*TrDwFxG|uw6UHA3{=x^EUJ(hxKi!L
zaS^`FB6nXJBc$ozMh@}Lhvbr{)_CZ;pvwb7Taq)8cA|5`n?(Qo2m&0r_vWCL*i0?7
zIyw`&ZO*nm4Wh&<3!hB6bgt`Y#llWw8X7rKqdy)>=35J3Z1bqy^bQSY@fz<aR4GLC
zjKk|GGJPJxl7Yzq5zJ1A1yMZF4fkua%YA?y9nRvrYYT*rc>NeINPtdgcSmifHDC8%
z{=-Oi*)IhDgRQrIi}H)xwSgg}L17pMkP?yZ?oL5aI*0C|8-_+&y1Tm@fuXy*yQNFi
zm+$ku`#AOw`+vCCTK8I?>%2}k3{XyQeX7jSd#dV2Vr`8<HfVNsyvmUFP)J6t|CD6O
zZ(TkYiZ||AD7+$x<XU+pRAn;nNa#Gfv)AG3HmcQ`Lve+i0;#^H;KWi+J8o|{{)}4e
zk?bEe_XLh1PD(YhTa-4OC_7Ho8u)wHdu-!hS-D-t)L5%W2F_iFvvnNqZa&K0HY;=P
zG@GnZgS<Ee?Y}%pg>n9s>Kf10PKh%IsL6f3%)^uP6mU#TRuFyG@gERO%s4F5D8Zgb
zJoY{c4=sY4nV&TfhU_f`X?&ugl#^>6?eOV^?iyq>WgIdMOq4x7uDQ50v9<>{#w#w~
z^ZDvO-P5nqtd%i;*v>$Auj2Nix}vM^oFd|C&Cm;?-zNuowQ;&dTd$+wHg}dYM4_ya
zj4pQ%)r<hschjU9`yo}d2pNOSd1%DEnps=LIyH>Hy#t(&?Ta()?Y_Cs$;}1s%%>dk
zkHn~PXjsv)`OSHpQB8c0#!Yy`q>bcj&UB%@@ky0-<XejnLJIsk@Zg3uqESNdcB=)Q
z?6j!S6BvwZgtd{shI#U2`Ci-bHqm#vY#X1IpJF|16dKvK+&EKpjH<W7CI=4*2Q2Wm
zUfP~j?!jb2QM0_gnQy3dubamcy?c|UUzl*+c^z`?Hwxxa*TRm_Xb_;Z#zmY%ds>ED
z;pwbKq#hXQY|?s$-Eg<802j*bUq~rM$4D|uEgMW&f0)TVraVeNsrK~ib)c%xwgWMW
z5>_!wDZwkVxu(FKPCl}pBakzSOQt5x9<%gbVSJDde-Ib6Nto+ZE>xQn!>uuIIA@}l
zO2-%wnO}>SsN2wH0YL|~KQGZKlA56Za!PPW!_2HuT4;6RaRY*-=^4AKO`W&lp5EQT
zPJuUfotD=uQ?s0SjjeFacTComnToreq6&bSKN&(JPG;YfrvEW~;FH;(!JP;xW<ID=
z(<CD3&f9;P<|B$})zP#^o2#~I5M87yT(eH~qG@4f)#UiQ=W*a6IdOj8xzpVC<P#Qi
z=#bFY<f6!&|A2QSS#q?k!k<+y>(so=XR2e-X@u>3Fy@#M!It|BOhb)OLHa`<Wf9pr
zf3fZUzSy1XfQ|eoJzZgfXRZxd<GJ42dh+{36UuzJ(F%5IteP7#8|oJW^a%=Ub#mh`
ztitZZ);H+Z>mwPtjV+UTAtx=M%Ew=oQNBnG0tbt=Gq-A%Us8#$mAaO`yxzpDx)Q`e
z-9q9Vamx|`D0hY+m3=#X9;xcuKll_fR8gbHYq!S#O#FSOq&hfXkZ@l;O9Ra?BJieQ
zI&Mu6jA=UutzsJ;{@Qg6=bh!Tf5||gYJWnkbv8psB&6JghF&qTDjFd~lJt%ly|7aV
zUXx(h%zb5@VT^h5Xn1e;s%!+eU82SCdTfbib7rQswMYR-IaN4gsag=X73;Kr3H9gV
zQ33(l-lc-g$TDbrgyF<&u2Tq~TS*Q&@Qk7+au(GqLKnVK#qIJACs%$}Lo1)x%%LKW
zsEbw4cf7A?{Y{M7y}ByUiK=y#+Su266pix1RF#AkRpgkOQj4yh-OH_Sjp(3?@91j&
zKFR6Ol9o9x-tv7J-D#M?L`NT+nMuwy$3nL27Jt+|J$VPV0~5f8T#mZ+d(%9%DgBjL
z?`0&Puq*q|5H`A~g*B|rL3j5X2Wt4Ggs-!*se_jMGA`8`SQ7KkgxEy^rz`y^Z1qm=
zu9j7V1zQ~gX#WVUC<f|W`WQ99r(^{U38tvIG~?`8(9#v#Dh#S+p9`|sXYBK4WxSF(
zBRjTAH;lzgPH^^5v&+6e?>-`DDn!Z!d77?++D(HM!O7%KK__dLarn!snW3M2D%N*D
zHtjY3VnKCWVTf)vu~=k&=xPW&080{q%!?5pG=EzoecRoR688RRUULNd4)LQIzn1~M
zAJCtvV=H2s8PM7S5Bxo54P?D6l307~u5B6mwOhT%PXXLb6XB&LH)?A<FM3l{kGKF$
zY5TWJIG9><Gt96(#KS0z(&NT2oD3DO|DMll!YcH}I5o1ofE6rYM@tgwT#Sfm@HWce
zr$^=GYnZ2jGd5m|;n<i;aVzaFO?6tUClcY->8P5bzy4Te1M57}bpd+^#sN3#q5H%|
zBUp+Jp~j*3f`f%S%>3X=enQ#kuSJMdCS<L(tt~1OgHMF=%Lren!)04L#2h@^{SuvL
zh}^r>%iFW_19zBdV9Udqth!M`9`ljUnsuN{ybrh=@mLz@W16|akh4Rp-Yi*rcKjhr
zETi>18|8jPdUK1`Iy0z{X^@CDCvRftmvWU3u1^A0RM+I)bq;RZ`pA~mu55JYykSQ?
zRy$=XOaEb!M)HA=e&_u8&s*ot=gVO_erdG)%Y1Uf<0#Z9y`u=w5yPRK<1NJHZUvVs
zwoL4S754%4k&LyqdOX^w*}k0|4uSDyqPiYapq<wDdtyf+QxtA<*t2&DLp<hy;wfxP
zs5?i+7uDA{pTj;GPK8sH=!fLDbSm$Y7?^9L;Z7gZ3JcZd8nD$ZnwVt1E6BGip&rS5
z+CKQ^7VS}w*B)AW>V1m+w5;-$;kk?oQ=B@$gQZRjW6E65$IFe*Lvzq3grbLAGzF0V
zCtR46=WzkeX?KpReTvxa7?h$CPJSBleM~d?A*~{(myPDpkt#$_8%K>dDs8=|uhw#)
zfq7E`<Eg;w@U@&jKL`<**WJP87>K)Bx$uH*y;<{mNucmeGUyq21mXVy4r9qv`X3Kq
z+kfZ=CUYJJh7#aKJ2UKceUJa;>=3pK2(>roHEhK~(~Iop-O4oBkv_Ptx7cE`=r+JN
zbMy(<i{N~6HTS^W*BzN!Ku~A|O7Zn>1qbU1{8MKm(({%|UH1)3Kn0U)%PM0gD$Uhq
z`VciSer(10`qFY0=Ln%vUCwG~i42BMd|?TTKqbNs>JjEY&-J`ObRHWIM$LRoDHsSK
zje@e>tMkmGZSlei%#elfygj{tgs~(VX<~Y<gCX5!Yo6{?sswE<#}9UA7+6G8Qh*55
zjdoPdzqLd=J-o!bybt6+1x<$e0ps&W8}b>0Dd4|>Q=W+&^Icish-R_*dO<Dk;w<z*
z*3rK<J;e(vIz8tgaSRS40W)5hU^S_FqW)l`XeS#WtxGHJB=y93#*BI>h5={Y9eM&o
z2Bt~8rxVJ_)mEj$S106_xD|SV{=?MRo32woLVoBxEkDVQJ7e`J18`+J_8?EPyS>|_
z$u;||Ook`xE%>Fr2naxP<31xCu?C27A2g)i|B?GZ99Mxex~5r9V6!6<6U#Yw*t9E1
zZZIs88mG#rryhXDr!;#U@h_UI8@aiBwvCQRsD0;GAn^^G2m#f8Y^u^{;bk&OKukoW
zTHE)3%pg0W*c&2$(tSz~*X`EujgBAodD0SN-dG7|`t^{(mW2byL2Jy);$Oz3hsl(%
z34)2@e`n7l<}Mk2BvmW4DRJXJ6KX#i&o3;uman6vtI{1lqYe(30jDNAW~*q2Oiq5G
z_28mR<n~$mS780-Sf3ixtFjZY^Souw$XO^nqFrFVb?py_l}JaYiyTz*oBs57E7^an
z$sUL;_*|6(+Wia?7B}u+=0Y>jFYF4}(EnZYz_96Vvw%FDUHf=-EXEFPa=0+*>TESw
z_wJoISbcR(oMG36GAv*fGm7bb8%`WRi&QkHRApMJMY3CjJO)?kCPVOuQX=NM6S8Xl
z$+k#IMUq%KU5YWkEJ-QqhU_$Wd}M6#F3G~3^p9v_ssLB7obsDy7sqc&xZ(48*EON%
z+$0!$(egFhd`>*JT6<qD6jbu<M&u;CdC#uYg6|jA{foKe$-=e`J`I+@!MFg~T@rIm
zC`@L5PwSuRm$(}V%styZD?<6yRZE34Fqi1>jQl7?2AxO)VBq{;0i1T)XcT5wB~&3~
z#^8cMf6evFg;#8TXA1&E{n-Z?gw9rY>Q7NB@;`1YN8m<7-(kss|HI}(w=u~KTeNx5
ztP9_XCL=<_{3GjCJ_Pxjp+>^dt@nFE1sM=2%t75NQwnL8AXIM$*-(*u42LOB+{af?
zx+t4(^j9A2wV$0)@R|;FkhN_X7`fY_=r)GQxI%Ru3F>~2*B%0K7BVjXD6>%}*gB<7
z`t|o1DI!YkHw_*_0b-q7J5#JICpVa>*o1qc9wwsq?J!9mBWs-3>!@ME0I=@sSLT}T
z*z$`5$C*~ZPp^sAL~%<Rrl%GYiN^l}mcHsmrU#cOsCOV3<>?y=G6KTK{&Y?de|r&Q
zuh&_U&Zv*|P(oihD{M|`6lcPCUB4lyoTwr728m@EmOEm4jjo=zafG1IopEWQGmJn?
zCvmQ#F6{mcKl-MqvWnF^^(yW>l|0TZ20S?X>935_6r@?rLo^S*2ODh$iHN7VBEG;8
zclV)Asgc<;Ea6~EXvhvD4L|7PV50JZSYAbPhwF(}h@ty74rxAf^n_?yf8SwUZ4&E$
zZc8~d3h--C;+1^nVfy0;#UR^dSlYqO+DDjxZb74WcgI8^&*z{ZO0xq5LbT=H)c4R7
z2R;hH9rS>DypURPe>&{{1<&6|ueBr%)+nRBnk_ALuQRF*Ly~{Ht3#J3;$_VLOzV{N
z$oUgB1S(`P>bi<<;P;#2Eqd-mas(W+TTQvB(#-Yr5p1VThB>wnMk5G;!d8`%x2yO`
z^E77M))OrU-yCWVw*COUwIrRkIG>~sUdcgQfJy(TR1dIF2+*&?(dy-;NnI+<eiUDr
zCia=Q9Y+PGCc%N;`7ECfYc@k$4M3QPp6_1ZKwa=)9mRe#jLi1a%DjVz>$w5^?ZYHS
zYQq$RUPEmiEHRZ1OULhz5QMl#*DguPsfD{!-6)!aocdT|yR2!4eY~erO5%2$V}>?z
zFq&u$2fsO05IHn`Lnd=j$0xS9EF)PXbNcsn3G|p-Kd^J=Vy*2=;4%Y^Hh4D-liaGa
zt4Q@xyKa3GTA!a!v*T@)c&O+$KA9idtYkW-X@i|{s%idoQa85br}SIsNo`>H=^)t`
zd+|2)eTl|K#a0r90>Uo0MdD;20|6^A6vlFZP1_>61<<GS_tuuFHU6Vbe4B7>lky<m
zH7?FBJcpO*9}}75%(!@Jb3%0z8nb9B<&lpnqb`{#!GkwrF(!mS5nqn?@CE2h!o%xJ
zwGu2D<`l>$ps6utOTWOMU4(b)p)j&<^`3O~+f(UZ$IPQAy2zfk&s$>i-70XZw1}kO
zKXKDoj{0vIfYH1jk9&ko)Z@-MFb*=(7zxQjQX*jScKXj*7&Ueq?@j-p*k)%BXYMXL
zLcJLt>Qor*D>l!IjszL#RzdJ)2p3F=J;3xP&6ayrY({Rs#WLT{=?SJD4|e7kww$7(
zIOM&KLmgW|8%%6!d0pmQn~^`f_flBD6OCKE`4uPG?Eh6T|G|Q4Ui`ZpALwULPqtD?
z>YLCK^TUFYsd?Ris2m>q)pTa}%f-p^Z+5M}1JZ^wZD&huyMbS~G2WWTOxxMULNvlc
zE?W4)C_6%9R1}CBJncY^bQ=|o+H8}H6EjN{a<MU7!*%55)pubJcJYFLb#su~DvN9k
zh&40fsN58U2yCe})6FJipP5{}8Y#I6RvGF?>4>~JuzJ_tJBWRnP>tkEF|E*1>QD8K
zB8=(C%so9g_*xAg`8bB%A5KQiICy)B!0h&h2lBDKBP+|UarlW+xI1v$9hzJSvs>N#
z(5Z95-4eg2aWkSd>Q2xPj;239w0QpZXUEF7LY10Q?ZvQ+d#vxV+=Z%L<cZohdT?kC
z<@-+Nt+{5xHW(9(Cvjs2(?<?2<I9(?nO?H?UW5oqhu=3E+W#^^En5lj_;n(I3dlOt
zUWwg|#t7u>oi{f*8!_$ist0{s5jf{|LpkhpY|m`wR9O+RB}Q4hmq`<3<-YuZmSLM7
zO&Z<8vYVPzw{Vu-jev_q?5yB@^y9!Ah1y2YFb*4y@oHsR_7ph`h)yA6lpzi7jRxR~
z{r_A%1qz>?CM+m08heVOtmc)AH#gOGnDL4G-1e0461Q7a;$%qtAkC#Bat>u!uFuG-
zU&FYk;fZAS&;r#S_4G^1$A5zto)5(9pinJ}W2=#lk)#oaj_|~T(DpsbNnHNCLlJxi
zs(-awr!y9QUt4-^Bd^qf=O)3rx`*nY#i&gnAi-J{mJLMHKvwa#5rFg_fXC+Sanpt3
zU()cdYcW|}fkRWXM-HD+lY=h!+h|hVVjJy3Q7-uA-G($qz6H5qrtK{0^K=J4h5a36
z$6{HDKr)}Q%L}5^q4r8}oqfOdL%<~v#u@!ph0}EzwRKE~BCzkPRx3j|TFYlp`O2WI
zyRUr#zc;#`dLc%>YZ<~WYx`x@DU12$+EK=B@nB1;>u+443C5ka4KuTv*wq}w#_qU8
zkgb`T-*UI<A>-9((+Dg37Zo-qul3Yl0y5xo%f<2BxqWV8Vcbn)#fg|j5B;9Y!}|W4
zZE9N-fHM6%{E`L&1%Fz>dekXbA>EP-P%(c=8Dh*hkzg2DgJYT?Xg=80bHT?BPcC|c
z42(-`1p`?oP0?EBq~V%X4O$4HC>^A^GbC`~LzKN(kJVCaV;(t`L4w>0-mCIgwh;|c
zZ#9=7$$iTgTD`&_*B$Pa2>A<o7BdmDG5=2OQc-05Aa3C;Cc*Wbz(hb##6jR_>@Gwo
z*#4NX{oYPY)~&_l)jKK!>V4I>Y$K&I3p+!*SHxanT>n~|1Ixctn15GKHDV*$-Lc>L
zcqi3G0)b}RYJ{rRQO$>6V?D(o{si47TKrKPWTgjRk-7KZ87epwpnkcV({7txt4Vm_
zGAvV~TzuCak}oCKq)b}dLFxk<WhP@HZBpUV4P~TMtSie_$7<~36yBfJ33&kU9#ava
zTrZE0^<K-#NOdg6+)sIah~YykNs@>^OJYmER}m0w;9NacWBDz2SeUR_vg&~&R&bG5
zSW?^f5ASGtcJb6j(;Bhd*M9u~AM>nipHX~3A(6?ol+76*4&9B-y<j=~J-BrB0;(R+
zKmG71%|jZ9u7^}Va5}B8eq*!|KXIcN=s-^0Bf)Jq*ZOibrs+5KDKsp1m$Gnt+&Z_p
z2&Vo=H2+-O`aSr9O>fI%N1tw5dZ3ALcZ|A6+%z85f)CA}keuQZg|F)1U78xjv~Lp4
z6UBK@Q?ENwG;7Ote860UKnCiUpEjqLb4zyA-z{;li}{Dw;gHk5gy*ecNX8IaI$!g#
zZ3^#)03~o!CRx=U=04oYA0#~V$lNQI%qG4o?PH+D#nIgMcLoLTUV&7V#Jxsng?SkJ
zL`IL-AGX{3*AmWLOf7k}2LNC*`&lUWEEH*9kKqaj$-((1pDuYQZbFHV9}C3bINmcS
z#%|cXv;_XVDT!`7-42PzM6u3>|AW?VJ?=ugslYWsS4y*&@^63+IiveXKn*!q1TI;E
zz2*#&TQ11ZZm^Zotm3(_X#W!nHOEWZAy&b&oUEZqH2YQl>G$OXXQG|?cTa!bqN-W9
z1>z|TTyb^x2B&Gc-SN8#l`BKNzyKZUJLHq$d29vS*Dfh>+!-9XKeS5XP)SLIZjPse
zaRU&8_SsOh_^4)iJ&Qdr<N|@&{^NBdgrBk<37(U$QMuVh>b3i4;Z7y_v#oL`)nS5<
zfUeT5E@1iJLgDGX;f@7LjKM&ZcV%>ef<ux}dBdmAUthomP8<7(c!Ls0rLilb!jcT5
zhqW!@O!W)BlPk0@*Co_6S@z$mjhvMLjL!mv`MSc=RQ4ew>%G9xyJ@~mmNN*ucAY$8
zabg$kI00V{>c9jxoA#LCH&i~ZhI8AfT8j(<9Lhu93Cy_+km1XBKM+Qu!4oH7#YVq1
zzD2m}{Xqr7`vTDhR08L(S@G=qNWKz;>HA>SqCahR>_8JWlNvLNg-fY{1A>pu*w!8%
zvZE4XHb~DKGB#U7`R@Wvw8nKj7!io8VXhp<Ov?TxdP8r)yOJGH{$pTTj-i*SN1%mQ
z@p&?WBmUrERyg&=cy*8x0BEuF(I%hyxO?eBuKWNg850Z^hHhb(8!AzNx_K!!Uvf3t
zU!gHYe=%-IFVWiZ2jflNM_t#D!Db1(&Go=ZQy2_D(HaS0d^!;0PsYR%_PEcrPkY0B
z@r8@E<zrz}c`9rx!!GtvQ8CR@S0UcLB26HGZ7J1Fa6hZJTJzmxWemMBW6ddOsLY7>
z1X^}ud$-TsgLl}kf?KF6x3$XZ?K93g+!uxnxQ@zOLE}{aboI7;C@NbwOQI*YO1k&;
zzp|R39<xAV;rU~lUp6b;Qhbm8>bx?NJK#+q-XZEw0K~z<+q@sU{Pu@a9<e$<RD`ej
z+S$vhSRwN5qC&Z_1Iyit$F0bEKqDaw%>qcGJZ`|UEip2)yOp77rYPa;s)R8QI?|Bq
z5M92)q?;+_OP$Y3@iUwUU-FN76@9Xsx<@jWbVB<4A0eoZv$8-q1-Y<Q*H*r>tj>9o
z{y?PK*Y)W~Wy?d(==Fh|zdL&^3Of0Ob{BN1og_sE?DZL3>uzs>rN>i48Mb*E{dS~@
zxIZlf*fcFOOD!upVn&*&G=EuL<Xd70ue4sKF5@uU+f%xJE=XDR+PMGH`tweXpzLh4
zWX3A<q37+;QR_xHNzIy9q{}+HN$FD<+08qfl=fw^j5~vQ>sVqNVjsp;l-G<To=Zn-
zUgl^@w~o%$H(0L#Z>)`90VQE*htEuy7o}30ZOWSv$|O#Mf@K6OJ%`SzkPzrNrr_2k
z^zp!cL)odzC>$^w`dJ^SPd)X-Mlk$pZ;fW1z@kSNaD*MQLwbQO;mOC!`8h?~-o)}+
zOu2G0^twSz0AZrL&t;sibbin)o&T|=C1SzfS}!<^zK8mcUFNe%S(udU*QAbR<Czib
z8SxhrT3!Um?G?FKnM^mJ#F=zh7yTfXZ{j1k(~eYYpP0-A*%{-D@k}Q~1JOMCn4bBX
zdmxg)da<U&Llpz#%FA<)QHdz2eMXQ@kgMupsraBQ;G*N28`Mv8E_qYx3Yc7d_z+&p
z!MfgZhBUod?m3<=8y#$fF|4U3E<GbCLJ+`1omHmS?DpKtA7aE-VIqLH88?%UR&{VU
zELctkaCM68gK&Mw`nC`!rQID}2`lxXJ6ME#uCr=~r2mrJ6L2l;d~H~pA_*jh=(Yge
zw0^T8kG`#Fq?M*3516l-SLcrkIjT*!V_Fh~9q)V|{75S`Y2?p9=!RqNV}vyTHRulA
zyIh8OSE8lO@z_60Win*kC7Qlp;ibxawq;MA3bxLvSnpVbBzxYe$eNOR$*igd>fm)@
zw+59Xe#p5Q;MXBHx^4xUbZ<MRU4^a29fZiWVYhIz17!G}b1cc<gizagmD*OCBv>Mr
zWdE?Q7F$9nj1g`6mK>m|5~k*VR@ldm!^o;TKyAb8O}r-T&?TGiz}z5X%MjqbyDbqj
z>L_LoC9Z;LWJ{<=AE*)M7Ei&nvx#X1r%hChf5=00sqv2U?Pbdye-?(2@qdAR!Hv@2
z@U)QkXs@ZAp#Ke*G$r|W@=0V3KVrAc)<sUrYrWUHdDsPb`h3DIOf@(WU>5dEzR3&h
zqi=8p;%N_j@}Ijo*;X}wwx>V50LMfe$5expPgl2yBEBmd7<QaTuO6ysv-sX;;)3{}
zrjyt3y>V#Q^g>El<{>Yo{>zig_-o#bKcHK&7vDdZht6siuQ%bwOhRek>w3P<(WLut
zw`&}+5~urRxLr96ejXLc*(>Uveh@b8n6=wR8-B?lwO?Rn9CWH8&ucCCNrBzhW?~H8
z4dSdmrrWuAqby(!2JR|TZUS4GG0ZZG>Ltl3alZ-UI=%yZ%d8!n_4viTt9uM1V;+D+
z4L?T0VDhV!@5Qbrp=ACxl<zmt2b<aDc_OQ{oW|1J5k7Fcux86<H`XZ(sKIAM2E52M
zznC55ADTz=?m$Xgvj&I!ywaIs`La9A$>?EWEG&X+W502B&ah>q!?52Pl?7qGkXUrP
zDEdWpjqx+A7|z{x5g7Xwz)YzXtb$s#qN->pyy%TU#L>L&j{`U3Ob!DKaQSHbH@uf?
z;W-i@=xpy~NJc~0>@c<j5X5`E1;EajUBv1&v!IY<Cho<uNeKo9!FoIrpt*`@1Fs{&
zCElXq0*CHhMT)lWe1u<;+}O0ifk{_6Xv(QXqN9^}uzYJ#rs--Xwq;ffj#hTfX<0}d
z)H#<ZBmxzLy+;+c{UaE^^7@haIpnvbOOYCo7RLmuD5zCsE0Ke!<7^A^U2825_D~61
z6N47<bP|?-7|Bcbe^J?UTH_57Q-iOS4)A{~ngrSF3;Tkqr#Ji_@%~y$Z%F4x2Cm`%
zJVMXa$n+T-pB=x;v@5Fm=JsIO;p^>L;mYroy1B)Y``_y=5w>pID_-nb_`AWpGI*4Y
zZxFtwH<V6jY1VQ(L$2?85W|T&3CE=NnTk06<c5~cJ_u&3<{@_Dvb>DCF{b{-JYx*`
z<|3l}D1|Ek(_dSiMmQBA4V?dY@Cg`HBexPJpU(yb;S+mIJQ!n82pYC7_o1PB^9Z66
z^)B%abFjcA0y(dv0$*PypYG-0sVv9jEsBG_2-gsJIUysmzbma+*v=WeTM{3^`^|Yk
zyFXEgcQHM1VnCltu&92Um>10Jtv-Q5gYBt%2@|Q&`&*D25)je;7P}?S01|r<r=7Wq
zT|?*QNC4>v^MrY*(cb5UQl^OL>(NsPNiS2`2c(Fn)pro`vgDYT!P>^lj3PY)e&&Lg
zkbu&bWmB0unhxhDGpN&Bgr4&n1$?{Vi$6bnXV=Ce!tf~40(Cux5tzp&{&D84B}5uX
z;cDzv{`gC(-fWE7rE=h8{l}q7Rae){ZG|sJ4>Z*=84Kf`jn=mx0h*yZAVs>LR4%eC
zgUpX#M23fXa#)^gR^wfpUM-_*jF93{FWFS?nItTBRW$V7`@xt=(CICAkSi9oTLmZ&
zToo2IXEv(XNizvd<|66n5>($c+0b0y^wV75sDZq;FU<BUarz*v#h<!xD=`M)yb9Y)
ztxgY5TobF?Pp@@H-RvBdNRDy1;0eyuV;QO+PrlnL9KF#{;`H4*y22H?_`Syw@?26+
zlpAosELP1YzdSG#4$aJ_=55(i1#ggbP|PkqqPu2Ejjd!F2T>A3?7kKqRJLUN(wo!h
zM4_LpMYhn^UPz6WF$Ro89k6JnXj0ek?d|hj-6&Bd2|s;fS;{(8^!oXQX-N;ekKfiN
z^te2z3|HT2&Jb_W9<{CFK1zm=IL^EAeXBY^a*1|*I^{@qaBv}<dh&_;o*<OSVTtp+
zyI)zSh~#HbVZsy@cDu!~KOF^VFTHs-A)(3|@54Le!dP0hR}Utfn$rVlN7m&3IMuBM
z^q%PvL*3cxY3ID=r|=EYs3`<*!FHc>FlB%;e6f~Ldnv%YiFb7Wl?luy@~h$oBY|b)
z2E8IVwnu}&?sYUX9Lb#*J0X9ET-VWV+=wW@51J8r975`I^sPF`)F90udg(Z~A8CM?
zh~f<Wio_)9Z8Bk+fkd*}Jw$$G-sw(g3i6$mwEAPjv(~EpQ1!#e2YV;<@9hx#qV??2
z+o9jw4)-q#eg_}o79}85(E<0n*))wwboPR~n8z#>rf<6<AdV*Ac*8ZBipr!FsRTcI
zZ3DxB99(uAMbH#IM_fVK-LX5O9Re-R8a;pu@e+<FL73hi1k8W`=ti*LVOj)u(5Yl&
zCLX=o9(Ru|vnoD-{KXf3@Vs*PylV!cce7N2%i9gJV{ymUQ`{p=-<cdAm1&z#e)V+D
z#P!M@LQUeFv&-~X-(z%9b9K-&s32$0V8A$Nvq4=^s&I6mu-C__CU%!gl>t=nyE;t&
zTI%_{srGy5%^Ga#LqZ#^Q@)M47rpUo;-_R(s{5~I@5;n6N>)^7_i0D3=A#%coOMjL
zStx;3gZuC8yUO#%pl#gGaQuPPY)k%Vn;>hF_E+f<{*34X0+wvO!y_+{-$v}e)@j5D
z4lLnYdEsasxgr3$k;#4lvoPoX&A(^DP)jPBAX~QD9s<7vAy1s;tt8{afo8>+xWxfh
zYEvJHr9+Tr_(9?NhWg)FKS090W7%Hn)NA7#77PM2d`iP(F#Gv=_>Jaw^2F=jwK1j5
zM9(%&d%fr;yauU{FV><7R6{gNhzAT^+f7BX(szAt7fu^OH)f1H6C5)Nj&KwIPS*a(
zL3z-cq#)4{nGIO>K%AEhNkmh03;2!*kbVafPVuAye-NTY(_8eB@cxtY4&VR`aLFHZ
zWE-Fx<q7VQGhE)k&2#cJ?R&lAFY55&#(CB~pRiMC39AEfn`noks3No19P}&|-mwd>
z3l2tayTf;e>X^=6TO;C8i*BdEX@cz8YV;F2NmfN9w0mp~={H!Af)-0*abdF@8%(}M
zD#k0`c-{m3fyoXeN>!(l>`%_!pQXg}oVm=%EF7gPt?MXBOYc+ZW@`8g2dr*4L@U-!
z-%2x2)cY-vijFC@^OhPY2S@)q@s+crueA8)Leh}91Sb4}x4|{$9VJ+MhW<S<PJ26O
zY%{0+Wh@_NQT}4`&lp?tfsWT?e*#`!@WYmDU<rI>>y7gL`+%!lAWh6DPhG*TKQxf`
z|4{YoQLi4LTCe{%Ro|WCEIrWtYTu<wLJGje;(atT(Uvc}QB3A!z{njR<-C0DMQoxP
z5np1p@jkl0qVs_sRv^x|kgmk0tpA>-Y=IPU+z0h&1fmcI8jy~nAetf>Mo0nxz|1Y7
z7TC_u(7een166+=H&&vY8(Q18@oNx^Ec;yU?HE048+3610E&pPE)EXD0$fN4Q9=;k
zNHE8sre@jh{fP64WDI3-5@dU`8gX&5gtXX~Kt?W#Pd39iV`{R5uk>@B8Tyc}8>#o<
zGEbKgcym_f@a*k%N-__mHE^)qy{f9b&`Kjo$b$l_)6;ltWm^t{zi(La2JUd@z!>4!
zhID1LY3>t5@A?f|&jMkkc(|&nEG|BMWIc2w+U?OE7JnS$iiOOy2wO?)q!L@=+sC5{
zVj!vo3$5>`iPnych?Tn|N)vCJk*n!S8%Oq=#3ol^@a@0vLb;&qqGZVBLFm)gxslY$
zBPYs_2YE6src$%@aStp`2U&HK|0xsHqCuLLV6f=V-*8-yb4hj~y8H0aj<P$7CxGiS
z6@;)ll^I6D8M`j)l6(J-6iJph#Cl1kk@qZSBf;uFQ*gm533;|RQAzh|v^@V60nTr_
zrvv%_1I~|UPC!i?kJ6;+S!%Xlb!Yxe2{2Jcrt$yb=J6WviFLPzILIt?G*RG)F*}jw
zM#G#2-V^UoiP8Q?6fCx+F|0NmA<&3A@*P_XC?>-n@~ueKB64s=xr0Pzp+HB52;z=b
z;47XcpTi3;;eu7<KNKQ&;#d53z|CAZGV@igdX~6OF*s4kD_O9lh6|GwS<Oz5tsj`H
zNG$m2uo7uCcNl;8nOUD{bem7f3Q7gm<wTNUYI`5riIW6ssVg6F_gOSMkF5U+nfaZY
zJU45ZqZ2yqD>RfTS#easrx7lKX|CJ!(bwGW4$Z1;-S?c7ZDv_@betGfzSnv8<2=kn
z%rDeU6+JPOnuWEi?zLXN%~IoSbuGERe-wD<1CMjmg_C0cd+*|W=GeG=maHo0$e<G%
zibyrJ|F{v0oO0OFXrPlHX`6lLT!^Nz4=9CQpBz#!auv_Ek<K{t0sb<!mSo>v<GQF@
znXRd@#c{0>9NxrQX!s>^by9WYqwf%z43?DGvz3{*b`}|9U<|qFbL3Xa4cDML3h8GX
z8QEJ`TH1pu!!Q*d`KUH%M;YCCAoo|;py1PY7;i7I27mRG<;!q)wq_~p(bcyiu8W}1
zY>LmSce0D%Pri5w=W?j98>phh<SZ$uR<BO2xj}5EHXMK!*-x$9M%DsmQ(Y0kP7jpm
zU5$Rj{PbErJxsydfDBH)>Za^uz-=kYH>8rxc}AQb(nC@nY!0MHhV}DdL1x0*Yu+^N
zpj*4&Fj-0f*6b+dfy7|m8#o>LZGJU<UCXRxcND}NqvYy+9Zw+_{)m_<Q@!kvbaFsY
zCAR9@anfvLMSPhdAhpg8&3eEz3CiG!+4rGk3bxB~c}yY2+}dut1<^7t5t}&pli6dB
zF4u&`L0LmiY9cqfuyCN%7l4w0p*d^B5PK(Vi6D;xiRuZj7RorYXVMTBgJlRL1Wa`H
zxvSo<qaKD)CVCwMWab`Vnw9gpE1J_CxP31EjJEPx^lGl?zl_<W?`uhDBE@>t(Y)bj
zbG7kiYpe`meQS#St(*K5DGvAcrY5R{+h6=3M$>bcxK-qLsvXJ1=L7Rm`{TC4tf$eA
zgG^O#nec5J4g%dZG%{M<so^!`ZI)m^&%JR>EVw!A0J#PqX0sF^pR<PB+@|~casdeu
zw<xpLVHxb(ouxA4u70R77RF%52Ou}w7LR>jpAE6VcMg*vTjA65AG_R-Lf8GTvp2BE
zUaKFjW6l>}isda1Z+MAk0o7MGd@1^}-^7VrQXi4SUBXTkUBX}~>zj_2U^6$T;6Vx7
zza^v={a<T5KKE!RE9K@#&HhcC6Xe{E@37XkkHw+*^hqGHs!u}l$=PT}o%ddb;uud#
zb?vF!Fn@2&@H)(C`%D7vzV2NN`PYYkc#Vg|ObmTZ!=mB5Dvdh=j`7<59}NDhcEF|k
zhutgS!&@wYiB@6RZkW{LEdMmh`m}8ZidVF|a+^m8+}M~Hcd!><#c<X%6&NWZ0SJ8l
zxDV{3Q}VW3U!~<m?{mN3r7V5}O2C!zE#tKZb(J5ecGk>lKzfXs&ec53><l<lFFc+n
zFSg*kt_*t&6H|UOsRrP8`0a0S;SQN6-86HR=`MY=`^H>Tl{d=SY0bJ;a!)MT>G+<B
zgr2-{U+;SI8150sc`&qSw9g#}-%fX+Y>6p%3dkzJc_GaqzUhea6Yl*k4?id}BW{8f
zq#7GsC51|QU&NGu&P1?nNrzxX$8LGMP7s+5vhsBN&rV?2hI({Tz5ZkpHa0UE!s(=X
zT+ymk{^eo(PvL+{Bj7-abm*hH&}QiI2iCfZN<OOirhf;#LUs)oupc&Kh*4v!e0G6D
zPt2I{H~)?|&q#mpMYffNE~$d&`#l+Lku4%zw2sgqeihcABx)l2eEmV%U;h*vRQggO
zEfx^G=>2rjFVJ85Ox+PdsQrb8Jm@G&S$924mRLT}<#uPqHQaCs%=Wy~c0Z|T`)`FA
z1Dh0rp$4||*JIpj*%C{`ZtZJ-Q9}DGT!f^%6_Q~YYfp}-15%aq=M6|iW&%oP;Ns7;
zI-sBT;_>_k-tQctc^`GBvpPp9z#hMlJ7X&VHE$lS@V8>oqJG5WRdVh`2;`xb#3rpe
z#qIQTM-@o@7R4v+0e1U9Mojjc>l<yNtDok@FH-8NhgE3bThmV94fV_h{wodUb*G;U
z6w9viNU2?}JZz7WS@m1k3CV1-&h+N^>bPr>NCX_%(&;41l=zbcmyD>R9=brG#bhRB
z&G5q#d0uA&G6_zI1J<95WLyrTo{-1cGW$7v*gfnoGR7<wk)fl|Fy%#!mWvb$xT1N5
z7*UUE$R+LeXnADr3RL@qg=fu%8Ip~jJ}b_^B`d#>RE@0~I6<U&DEC?l^i`FD@5eUZ
zpn`B0i3{0tno<xM`o2dr*uKZEBwa%|EO}7Y0hJwfJ2W)LXzfzDg)HSZ-+5JCL|x!c
z^SpE1C7cPgqy>2WJP0YJBONQ&klXjTUeAj32J_&M0h?Sa-Fih!P=z9saTTpQ#6vaq
zz6bh-&&Tm+ni<(7ZbPUA;n=&xSPA%6$vsC9<BA~G+TGtAg35hWRBq=jr+=9g(TQU2
zfmlpPGSQr%Xxhk@{NF{N7hHxLsz!$RM}8GMWE0#CwG}^Wu5+}9x8`+#V`wvS(uDgX
z>={&{#D`x<iB<)+E92X0L85<2<^)a#iNY&?D3j<FUGE1wy-REq2l2FRLGd4?z@hfP
z%dz_|{V8fTpo(D9vSS@o+SjfP%MeOz!JVQ~Lt716aL5AsTM<@v<79Lw7@4UhHSkb8
z;n7sMWe*WekeXQj{dkA043rtYhWEx92+S}=dKER}c=D3ZG1^Ucn_%x<P;)VH<;>uX
z`S<xZz6N%GX#lXwem@{$p#iZqCCQC5iqfw+$yJZxPxySUXyv%&$fI+YzB-rv$sK8d
zJ4S`Q_PIiX40Rw(Al8m1I+;NCG;)jS#5hsJ_T81(bL(`pk&x_YsAa0#iGlFPhdlmW
z_bgsq;em(trD30ZvWXbnGhmT$a@@n5OXH=%>mk2oYvJ$pML2p4#6yndG|>(Y(W=J1
z?5w3%IA=>qgnM6HTy(+Bc~(3^r#Eaf9=5fb)=RR8zuCmb1t*jBWpG47w1^ej%epR{
z{St70!?tbyHpm1St=&~T<L0v>>sAI$E=$#`rB_@~LqsGROSd!nt4!*d2sX*W-n`11
ze<D>TA87SxNi1>NuI(?OADP5|_P$=9B4hTz|3H>@iMHrHEP(@$|GaejuHr^1u)*Q!
z<8W;V20h+ZKuapYU@A$MWeT+PEim9UagmbrT7N{B?F^4cBoB7Zn!Vf}4dzhto*82}
zl0HPTf}+hLe7EPrR!QCy*YyPk(ee_~w`)Cj8MoaHG*~$}S-j6q(EIU$Sc}B~uwtp=
za+F(a**e-{wLRb4&uhI;y!1R_n1sl9@5r;98-h7eABn5_>PXYqtIBGFIHcwKRV5|{
z$y0QCDD1SqCbm>qokye$mKuA?ZKW0yCM6OEOhYT%Y~wp<ksI&52b2a8e@oNH1S$PJ
z`#Vjg)(*+a5-E!@<{WD!zHIWQh0$-z+Y_p|&K@D73gtlD^B9s^*T5oz77w>K@RPq6
z@l)B>%=Rzw+PLWey4rTR0fY65x`<TI{fzB&uXCHO*7z}8XoBSC%1L(s?UVWz=ePFz
zMN3_xBPoEF_4{8W19yLbr^!u1T8Fz0=_ZF-=DpK5o#W(swJyKPYKiD>95g?(vJco9
z7aGYL4fG2V3~ZBP#pOMvImbE4x8{7~Pn%{kU#n-v&+W7bXKhm6;5CAy&+)n?^RY~9
z`cT_)f1^#z8?mJSUQB^AfFA$ts9vjl-GaRT(r&O5`~J=8$3=%HZl~XrqMQ*YgG(Gw
zQkib$q2n&+_c`t^Z~GM2Vw6IZHNPsqjoN`uk6(7~E|TgWrxcJ>o%K13?t+x%tZ%mm
zQ7W#kdML4F)*3E{IU-HfzD)HDBBHH3a3AnrV0k0=^AHY>ql1YD6k(yY!8Gd)-5g9P
zr|UhmLWVx6A(%)kH}F9|{c8l_O)+I(#FiIE5O78mYv3uKr>{0bDykT?Y?1T7XP+LR
z7H^uWMt7}3qOy2TX3w#<Iji0NO$0=5{!_$a^|gdd8mO&2(MOBvF#<KZ0P!GqK$L&8
z;+F7Xvi#?7@5bj$^CUIKLY!Y8WjgdfWpkK`_`ay~a6YT7#XVAV1%)1pDna94jt66E
zsUI%7TIB=<AI8Bc#N=PI7Z)d?YLit)kth_x-gRxA?bCKfSn%_FQEoL|$Nv~=P0mYw
zt{S-aCP(6EMcLE00ckytG08NQjwVA6_4)x|@u>-1=5u2faV{B+El0rnQ-F{PC)Y+~
z&(srh=J)Zop?&kr1ec&9wzE;ZBG2}&ZDvKk?>A9zNyDc}WO#zL3*m69IIn6~Ca$`s
zSr*QanOdc16TsZCsZPOpVmE#hc0vohd$#5OX4oT~Zg{Yup|3RAsCdRGm-y0U0^(AV
zM9B<H1xXv7FoX>!Z?CnxfReXGcK|@XTX7t47{Pgi7VSLat&42=s+yKBdsR()1Z_`#
zU*g?bEh^sHdDZ46&bfZ!NbCAI$gsO_Fi!}<vwc&qzwlR_yPbN__;yz73o$lW65u?I
z5m72vnKF+Sfpx?Hj{o-_5qTP+G86gAC^+zK5(<U@=Cvf{o~Qd*3@PPdu5OZ7%~q&!
z`&1_@c10uML#8sHfByMSGLNNGW6kSA*7_6XieZG+^qY(%_}>XU3JZ=++%`6+gI<%L
z@qux3H)a&@)wS99ZJ+7igulx}KxFQh$j~*>y|KD9c2%(qrk4)Sr(3y!Z=J@T`KC1p
z1Vu1GU;J0Z)g~s!Gw~^$^ran~ekH<+CRjzj3wN3y@A}^B%)a6wm>tBK<_X{p?lQHi
zNuJ7s-OM34jV?7+x}LMW2x2;AeTgEOXqxmCH9S~agl?7}=RN1y%+cvU<;s~E`PWE7
z<B4y$=%LcJw3XccG;iaZ2kxxgYG&^*w>^Bmu2ajRx^@i=%6Y(9Xx0NC(?x9`q^xMm
z8_IY_WK~Gc>IT-=d<pJG0EjcCzugr=$E+q^MaN%8RoAZo3E*9+kRLGkW1%9K3X*dk
z?Sg4={`-rtCO-Zw%;g4=JkFiH<;(PUusqNzeUp5KB`^y@<FJJQU`mO%x4pmO=`d2l
z^}f-lDUt$R&n4OfGK%s7@KDhMm=P?|2g#7Ju3%^b(wZpLWE4Pn`sZYF=*60nb(je2
zRA6*4S|~5)W$Wwa<1))>*iXds6IGY=Mok#lpR#8G9I8@{Ek@-NJ-~jn7*N;+RhFS#
zHh_55c}%<e_jkVNa-Xpp_ViRCXS1Y+T?wpyX8gcF5{nV2=AC22jROy=h<GiPI_$L0
zS(Sc%E<7xL913|>cvZHz&C;N5QN*!5%9vtZ@Xz?({&v)}-o3Pkfc4SN^X~grudic6
zj(@arKkr36n>L=BFIqN?=gI^<#J+XOr}z_kbtfj!U1b2#xL7mr+LX(rOk325xq6S+
z%KCn76GF3~O3D6a_QMkWMfz-}dnO7&CHtp+#saM%O-|MV82#?yOkQY%yXCRvTb$DT
zFA-^#0Vx2Eh~L|s!@8D>gr{y`^NkS`onSViLmA29hGNl;OSK6-7Hx*UKPX?mvfGII
z_-Qq2gZ2x$)HUYef6SsxQ_7+XD=Q!`O(#gbTZublcV!80!Z}_0T`pJWHbfZ({J$Ee
z7e-YsQDDT|nM104Y!de*0$G!9-d3DfAHZ-0S%bzUdREM=_-q6k1-tz<cHq^{dTBj5
z$gjHbzEXX>76(&AcG_9Sg7m;(x(O6=PDP$(J5!LiEDsAxKElSaby@*H#whAn1MV9Y
zi#-QKCZ}-RmmSwR(Ms9LHv%(!!fELNphoEq;E?g&tY}f4JEjMqQBV9AdX-BZnJIRj
zz+)BSM<a@7pWCDcw=zU7n&v{)*P;JZEc1N)wIBADc7%d!c&&fN{MUU<NKIB4#Czx1
zEsO8IB3PN(;CNT7fxffT;EP3*F3-k@E>#3-2xkt-uu|!pK2^FmGIbme7IhmaHh!`{
zUJH63H)c-^+@D*XGgn1&d*DbPg6z5F-9t%bF&I0ZmxxGy%RdMI`afL&*KnSdVQrFt
z)<lafrQFj8iQ8gVXmg)b!OS&L_usR7Y&EojI}KWyyK}B8*CSlX-ED3ed%=^JA>z#S
z@<qGdj^i?%2l`(KqtnBY!;}1TKcIXDP*dR{r@d6-oeVcutWYC&&gC1V0wYgY%hx&~
z{=080nB93W60Rwd$tKkeP8l1x-t}+Jsmv=J4p&a~ci;WSm@CpFGSG{cL%4(}gyH@I
z#_YcsG&7SJ-DOj(-I4w6D@gZv2<AR27>WXvtmP`%9=NM2hxr%Y(^_PTadN!6S}F5Y
z7M2A{)78a1ZoaeE2>5>gREGJR&Q%@^R34NLzd_YxU>EqZ!ZX~AnCzfs8PxhJ?iT(}
z+-=dj$*J(S$W)-zC<CWcKd>eoIE5uI_JvCc7T*585W2uQghr9giA)#$8BE)QcIbSB
zH^7SpMyU;qw)`Q}vS$yz;n~>vDS$o2IrC%|CKqz!B2TO`ucVf`@y6}i(*1V}SN@D}
zAJN)>wA)tGH|DeF9yjaxqDfh@KbSk2e|wcgQ2mcW+iQ>CEenAqZlYYXdXl7Q+9xz?
z`Uo91O1}$FQq?DqHAu3tZCZw5-sZui0S#Zr@)~F(O^&}OHOlDpBMA1RzwrD`p`Ek3
z1H@2hh`j$tp;x<i(sZ-k?<ddX{wyu|2#h2jD}f8ut7S(IE;bxTjIhXKtdcM8uLJ7r
zzr1N9O)N?O`^ND}DFxU0UIJuHF5>)2|BOg_lf~PIJm2ALMCy38Q8<R?k9rEJzWy><
z)xADR#WK?vTDWm@O(f!HXy0civpu%k1(x&ZQpi_u$ZiC~dbGUO6tfm!x<DqHY;`du
zxguO`DEhuV@XbSYC`jN_n_iO3^zdsEP&}Q>EwfWY6gLinoh|U=22g*wvl4MBAVFRs
zcx?3EKEZbpDwErZalU9uw-pgByCiM6$`rmjBq<!>wWHfQH9=(SZU`Pg!<nx`ck`5+
ze0hylteBmau~mp#lgLtUvhFoTR`g*bu;Oe6;D^Q;g~cC|wR0b>G~;yx%q6M=8gIz(
zP*AHlpOH-d-fw@M0oarJ9WmPFp{np!bw!Dt67Pxo{&7$^Mv(`Wan=S^*CD8p)^R69
z<>^q6c57>`E-I_hHx04GNde+HyFIPa)AOa;stdP!6t(vDPkUM+4miq6mRm@At_)Mz
zPIPJdVhf>fXL!Gol$to~3bGebD-fv<d@MHRG3zK1CAOdLPD8bDt6ccpP8<BsY9?h0
zym+*VVB?3KL$~es_p$C-gu(!hw-(=-Wb!mB+$WgsqqOx2Eo4jM9QlCPUsnP>B7npr
z>Ld$8ESch}#xPO%p+GPU=ZVcLBT$rS^L=YpWFDhXt4@5uuU7{uIB7a@y+trKev48W
z&q7@1cpP0+&ArO?dvPuQWKKtW7jB?`RBr<{S3#RRPk2o!jU7SyWlUCRw>kaNG*>OF
zw*tr_iX|PBXxuLw!=B?QVyJV@$loKVHr<*$`2hnM1YJ|;8=NwJF+d&haPCl9)&uZq
zV{CG(p2g_9PFb)a?Z$s@y8-{=Hhv8)*Tac{x)^{ik2v!cWq9*=f}q0{^gs#7JNs$Y
zHl9`_Bb?8Ug2sQmCBovMn;Q9*L%*#6(gyqQ?fN%5Tq59ruN8pTx~yBa|8eMsEfqn`
z|8gEC4nd{nZ4#xf9-6I?!(X9i&*7wV^17s@79U$KErDy(wvJL=P#%~7F6ZW&fbDC6
zMTR24s^bD6!9FKsBroxca>44Ms4(tPnZjd~ES9U7{A~S4&QbLe1nU5x&?>-7@wdi_
z_XEI1v8(TQStfP|rD3M#Smj#q=BLeXK`4gPqA{ozGPTZEZxeisvl~a|*1Ppem);3Z
zyz_alFOhKe{J=(h%is!_{nx8k%UG^UG+V2U=F+PVlV*OfKG?>yV`)o|-EO7-IhKyJ
zy4A|4G?IWvozDD6L<Fh}k002^g#sp1K8DkXu;yd31wXxK^d4s)wDw7m#XXs6$-xb%
z%h!^I71NP<U1c0%4zf`PzU81EJm{+16Rbh`!@0amiWmQAY0@EC1-WfIx_Qq<D&!FP
zcbgnOJ5x2i%x6I<^SLr6-_#~4?CxbfGur=@)Dhsff=f|#gD-Ben~Ga_lDmz08abY)
z2x$;y0WIkP8YJ!LEblIw`q)m|=xQEaBACuo3XI@=h}Ib`LSHik4Tk_R{q?q4j}vHF
z|6?M*#L$txX%^ht?hfwqi2p|FK%GZ{DbXS6+!Z%m-;MV{|6qAYp^XGGhk`2TeMk@V
zmJ9q}6FJyu*R#1M@ykw}%!_GNk9@;Mc=<|H`s8vlKT1?O)-Z?%<!i){hI)EBBB>Kq
zdbX0CF??Ctj<B5eb&+XV7#@()cz*a3KuyZJG;kzrE!HpghjVgxY+EGy`xL|A8KaXQ
zE_EV}QL^I@RmP%cvjd0l?RRb{_^7a!rb`FA1y>UhsBD?+vPwf;%o-SZ--)^O*P<`n
z-|q^3bK>XOq5lVwf!)*jZ#mY9)7O;0_qUIDJW$bK%6LbDV;4AI=aw=!@Ed#%5n_;K
zK$N?h!kt)Dtz_x#R}l?qna0Nk>bvCp4&h(vGaL{c?pHQr`S<^^^_Edlz2Un*2!hJc
zHFOFhHH0vPARyf$B`r#K_s}_%pmZaMbjKjg&@CMU4BaU(#2mi=-}#^O=B&NeUi-~{
zcklh&&-L7&>*5nMt!jgr+l`&G$~aKrf};PC<6D1tJIYN?IpS8=Q3Rqk!xWdq|6&f7
zY^I1>ppJA{I4ZRdRI}T9V-tZ|jQaEwmu7g*uv1eq)o0jF`0}eR`P*_zmnnsc0lsIo
zabB^FC~6^lhn^p!Z5dlvoi5!q?S$nqUG?`99*V;6iffgMw5oEw|1TW=Dp8QesxxZZ
z<2w&8EvVy%(>T@-aauFaK^tAU)da_t>v26-#vh{qGaIG>&m}WIJb)Gu!#o`13Tz+7
zjrTiRwg2CEIHtMbxd6lZM&~2bv=M~mKY8(Iv)6tKLkZyNoK$Yp_}es_hd<BjNtCXR
z*ygFK*HVJ~lyfHyT3fKFWr^+$xoyy+(N~5Fph(zn$SSh;*ajm@)$zvYwd#`CVnyB5
z{=*UJ#7x9W`hmXm_&M`8i4lh<9-Y0m@WEQZ0F(|l9VEyS+9`D+Ty4-4WZR9W1ELqO
zAogN9s}M|>ivPqx`2Nf4Ya>gW*R>7d=-AS}X~-G-){$zr9b^af_43#ceZF_R7c&hx
z-?g|D&T-Tkdrf#BmerxIPWYmB<69|CVy2wGsEftnJ?Fv$^FL6z|1H<k+=|vrJ6BW}
zr9>lYOSpYmO<b>xBS!K?5^`cIaiQw|^JYcqHtt)&Dg65^xJ7(~`{pGJJy=_A4J^%^
za&wxXex`}=^lUDrDgenR^ej}!Q!lXmVTK>-1Qhh?oN2rln~a-<g@^7aj;T#2O(fNg
zVNA&!oqhWlvaEElS4o5T*zZ|6raCzPHa^krfI4RHpkl&f`_6;!t-M1v?!Q;)(oy^w
z8c20T&SXTm-lVo{v4|KrK6;gDtuH<Y?!{m(O8DX_C8WAJ#Mwxoo?h;@sfmd~8P!UC
zVkpKt9h1AI|B~{x^&@DGCr1$v^i@31XD}#?t?dwj-cOlPjBj=&H67-xIwd0dOa|N~
zK=3yZCnfPNz@LVU*Qs%#lbwG{RsGh%q#hF9FKKVWdy5&b)%v#i32wk-5r86jDXt{v
z?_}ZTedVmkgd;)IwV3=<dC0MDRSXP_ZzY}k&-qhTulz?r5w4i<j{|2gtJP#`(^EL-
z*9aG2$W50s*9&*jF;2K4&8?&yRxI%+|E={8wa;*fX%Y!v?n__YTL=DgG+)g87dj?!
zhnzNnv>4r==PXqO9E7lUbnjouI~eOqx}4Xc;_Jfi4Hj-s5dOMypMTVfdIU;b&nyeK
zJ=Bxqm@VbpyGqvSEb&5ix0w$!5U3gASh($HsLHr%BfK*up27X`tP=Ta%z;*MHP;jf
zp-P$$3J=0U&juWpmX7&t_3237b>~E7jh^DnN&VD|<bBjns;nN@6J@OQeaFixhl<*e
zYPIE$wlA-%0=A_D7~Yr1XETS;(SbX|&49FBpW1726unnErCIB%?y}Xe1o=&j18Yf&
zILtkJ=m(BW*9AXKIyq!+BpqdS7m=4*V{8WgACQ~D7<?{V=HLAUm)q|#`1~mi()Rs@
zIjg{{FpMG^;np+^bHm9@!fZT+7IK%$D(5T$f|KixwZ%k&Ox|uyD+BsK&w!}Xjo!SV
zPaLi*Kj}5=`x!`s*svU4q`uoTV$n`Z1*L-JM1m$vUyMMdk>nS>k51|78&`~Cp;_*k
z?Y;?+q+cbq_wG|b^Li}ZZEa(OO=P@;Xv%^MCGcL-Sho~)9YYbLen7C*THWQoNPMO_
zXiHD~_;G+1I1Y6GN>fT7tW$hRS^ck9&hm!4YGFMF56h}A7QpVcc-2cKQAbmIl@K3r
zw^O7%d*s>AD#)*+%XSE=4s~*Bc8P8s)DuS1f@3L^C23up!*W?K!12#tLZ<)@K5;2k
zr6BA@AmIHG*@J3Wph0=t=_R^Fhyr4LS^EbEiLrFbJ}bb;-mdxuK%<;z^Y(Apl~<*~
zu~#Hq|4*Z^XFVoGmQS%h<yC_77=xgQ2S8F>qR+eQ00;*{VeRPm!e~$a7m_`x4Cl%m
zAEBr7#-1E9KpG_<nyzehp}<VGQUNx5vd_7(c0J8KDk-kf4u+!~;4Sl|-W*vhzB98s
zn%(tIw8ES#2B-W#+CQkm-_U%2eO$GnYW@8qs@TrR;UnW5I+fWq<81f4?hreh3t098
z8M0zhM*Vvpc<b#%cf4ct`<!VN_8dl6OxG7}W`t!mVRwsD7^<U`Mn7V}SfnvZ>(_<E
zY|CbVjt#1r{|NLNgPYZbpgxRM!4sz*Wr?0FInj!qmv$m5r8v>=PO&glj9%3|Ln;&#
zfl2EFUz%ZGj+&TOzt3R1Zcs5G?nn+3D6=N%Te~`CAFB$5-6<L@(M)1|rz4GE!-7ij
z>ASNLP)m7VQnaTFrf<#S)wA+Yd)-n;wt-~$WFw3$t6`k|-c~t54GQmKpE8I&(VMHD
z;`T_^#_KLO6jVE5<nZW!PKi5m{Yw)Vl`_GYTyv)~i4ksk{46`P3D=1_T+-+sj=ox+
zMqHcoCjDd7%Z101n+Kx?5wp>U?Pz4*Gy*M;Fk0>hiaW;hq&8UCHMv#t*a@$M9V;!w
zUaciHq>WNapl@DGIK9jg1U71U#8;nR69%BKbW9#5$KqKhd8erPV}3QcnU}j#Gt_hL
z7dUhoz-nd^7M|zaA6V+N-@*|3_ozy=l9+i#>W1%(syGrx=MNQDm+(6?yIeCSq$~CA
zc(ebRDxe>Iw+-=Q9753`2@~|b{imp=8ey6H6!rzpr?q<q1Ik>=4!0NR0B_;0JX?lG
z$obUM;l+T3RpPie3f^CB?tID!O`2BCDZM8Bf~0Pw2=Tq0`tK4Qv#S1WE9CwLJuQFP
zWMvwPgF1+J2$!>bCR%jwN&|6lX%@j44L2kFSsu5Fq{7w}!@v;AjY<fw)tr(0Oopuz
zC7-%tx2Z4k%-rY2Ot^*VJU29?!djF-qN%VOAur9C<o%8^!tvn;AO8w6o)iDORT(t;
zkKkL4v}6{~`d1qGsALvE=LVmd+mc517%?BtMTFtEHycEMze!Z$h#Sqmk-+n|alS8H
zQmvQ7TTCL(Yu8#wic)y`*{vJ<yTDyTw7uu?yjya_UMNIW{<W=+aQ6J5_>=bHJYRRD
zqtw&A2K3#T^@CPWpEjcFu<XsMkWRdcP4a<L=cS5N$k(WbvYcGYe3|iJtN@w=Lh*oP
zGp~A7#O(P2wME2qUxd0Y`W;MOvR`lK>Eqzk;l(R6v8dE!!Lnk^%-nCHM@-KqE;n?P
z7#vJK;aMwVXX7Ir{r83U>AEuc?nWE~<Zn*qAkR@hdG8M>^ij1kV?S%A16$cX^(ACd
zAJ0i$UZV<6Kg!J-JVNSJoYeXYMZ@FQOWP8pg&+XKFq3DVJOBqs<nVX2^2mj!BXZ>C
z6c`^dG^cP~UwOaqBIJbdVYPjZ^@!;6^88G{2XlX8`H*8VKYLFyNoLB1n04p5&%Ce)
zvtS_h@`MdFKDfh9@o4H@-Hwg%(GY`@7}`B&yZnCpI};tCNIAzZ@<MGJw-zTy{KWm)
z6n@@RCS6%pr_Xtm$SY{)^YKpVxQa{G6Zb!V?=zP>MP`0hRvVlf01IKe(E@6-zdAhz
z!6IDSFSorMjHWJMQre^+xQUDA<!JopHS@Z2yQ^sTe?a%EuJNon>%kYF1O?9y7U7B#
zZcz2s4Z_y{2kOql+D|cx9n~E=bhAn<Pm~!3f|5TGw>}9bfIm8EgVy2o;^FS1Ui}2>
z$Zy+zPX&fktH9RpeBNnNZvLJ~Rf@Iw_;n_r@$*xIAG{RH9d45uXSN-V%rw#&4yMAn
z-1-7mfz+>U-67wMY>*2b4}R*hd5fw9+_>A`oBJlyg8Yra+Cc|u9nT{8QnRoRo|&%6
zFRPgspN1C8bXiUSg|G65m^D4tGr8l-J7jdnr6IidJ=bduA2dI>Sqc}8q~8Jcu+#Rz
z&$l!HcIZZlqccmkALIO<6a4<K8u5(a5l-Qg!fSDz9H$Xo_*o{`gS?eZ)Z5~B)&(DA
zSY#wmkMB34=?2<QzMJe>*hd+Jzko{F7raVixU6V__z#?iIbH--3IbA8AU7$HdMN!%
z=&3Nni>=X`R6@aHaY++fPl3mA=*)2u(O;Z%Cr7J18x3CaeTy9f@od%A%y5k~LJKA0
zQH6sWGA9frbN9!MAI6~iH`wsdcKecRceK=oY0Ewf*VOLbzoRz()qhed$}+RF!q7E+
zwwcpvF+E#?ySO(V)Xur3I2s;&G=j}0&xn>qLpz&-FX0K`6g>=gzZ5tb?aCzKzmyLd
zjwN;lL&1lMF>*tykFFHS9~S7zW5M1+CdB`t>c43=)8k_M#s!T`oz=R9A;mIDg58gK
zFa!_t6Cc=CbCLY7njDC5=KnXV{sS76hj9&J%)w(Tym^9vTTWJ0V3~uTcI!W8yeA4$
zPVQcR4GMInz3IRVkJoMEoF$_)?|VvVM7~|~7jE>r?)A5vi|Lmi%~&cs3_?nRBCwYK
zeWnWM`;j>`^R6*`xohx)yIJNe?tbgkEtC68)W7O?U*`+Jw4LuDrDK#K$MhFI_3S9?
zOjEB}7QMq~F_ojbVT-YJNV$3%#=(<M?ZLzEKMOpjKi~^6YVQFahQ@BE-bo1dN8r|e
zZ(IB&^yW+FL;a#;GfFr6ap7@Y7-$|CF#{e&&um_8A6M!^wzh08CH?%2?wS0*P&CHc
zW;`Evb#~CoX4$Ga;4wP_Km4QZvcjkpXJc<hy`R$S*IhBm@zR5zir=Jzb`<mTT<r>+
zDsbnYmsJi8r3TsoBSqwxJu-~;V~MF^`9K&+`yFz|DR&<O6l!z`u_k}fqkdar_$X%Q
z2iYuFt*{pn%~SrEsrq};_9+t&qJ)5ca-~UE4lH-Gdm-{Uqr|x6PxIzT`%N27N7Jy6
zga=LOl6X%y5v@FhVrAbBl@%Yf$L=+gVeF8IC1}>Vyf`9OkELIFrk@2G`mcbHv!<!B
zB53kq_bGU!|IvO56Evq;;5~pl+MqfaNizz%h6`}NET5M=ZxFn}#5J0#vMWsNdo-7)
zuM$#Y!TKL|od`cPzV<{;P;0#dx%dje5?Y<#dOPdf{eqQN+%E7zBTN-f0_<dDwO)A3
zOrUzsaTDU|dT~k}HQK4jS<&H2WcdvM=#s8t0{`gw>$3Sdp#sODxR*ytHh*~4^9;Xn
z1VQddv-}b*{$~7;#eXP)2dX^zSP8W!FTE~UFSG0$zq?iDxx{fRx58<*MQpryQ2Tm!
zs!shg<FkFN-sRBQP-GEA-C~**lN_E2#L~ltgQe5?KYM095sTx@7;M<cYRAb}9jCW?
zA<!7)(7yOLJ?I|SNBg1D=zc(Bq5U4UyN8=2vHYte3%|SWCYDa*C3@f(W_-VKRjz~Z
zd8~?f1`{2~zM0nZh5R#Tp`5;bx+;_FuI=ytME*>o=l78I2xI?E%J$#pz?s;5bj=Cm
zVY^+AVb*ldM1Qe*KQn+qr0s7WmSkM8)$!e7AN%Ey2`Vk2ncKDwxViNq?L1JjvgQWM
zoo7ln;55Z&$kO447<PFk);@N8W*T}dwA@5>BvnLk0DcI@4S+T`(=;yd8Dcsa_BcLl
zA%w2w5c0}Se|s9+?;GWj^-&hL(jG$JG%LpZkNR}lFAX5<8_1%2{cs#f&@g7J>RMej
ztvtM+s3A2q5dMw<vuH6;s9K!8S$MEy_=vIfdBAAvs@S)ipF6H<_q1s<$<6*&2jXS@
z$nBY%jsE(REDu~nsIwdW;P6Y~1t#cdnt^e4DP7m6S%zh8WO}{9EVq9JKSiGkPm>_g
zwkQbD)2a!4k|gi-1tQ_YL>Vq%)zKjD_c}d{?h%=%=CQtRkX?{d5*@*Vv5tC-k?5Fc
z0{m71j_Kn}_-*b2<y|Kc^prQN$*mo|BKSFYKBHPy^Yt{u_ZX%{6isA-g0x}$w4vP3
zb_r63L38U0GJ2d-f`*J!y%9VFdSX^E#tuE9b3w??Q#8jur9iV4`tkf1Q1^YE3fhcW
zg8Ox{@gr+eG|g}_YEjzbMaff-iH><|(_yF8fX4U}zqxH853BFpml9;L8QpL3Dwk9{
z9E|-1gXv85u;66lg>ooy!|13ezLFM@+->P}cA(rhgAN`|tm&Q(&XC>LhzXe=)_C#9
zx(_++zQ*?%jl87{A7O^&ZIDaEAlqI1WpyJ&&hi9bgeDw<gq2P+?3x>*4-TjI`XqLS
z76mTz#t=s35)jW?RD6BU-EzeCGz7KmBIl8JP@HUny2&YxE%*WRwcrU?1=I><Qxjkv
zq_|y*Og6)T;q9lFCMHRk=_i}PYAK#6#cP>u1dx{@r(@ANx8kNJPLHKK8!Vq=24vy)
zqNSVosZ2i#zo_UG;lIQ(W;oPii&!&x_q&1@a<lFJQWd$5?&7_BY1B?8A6ccW!mc<Y
z-0r7wRBCcRJzbR51q_C4Sq9jA4FL(ZU&{vQavPeqUH9gEx<4T#^grQtzJ5x9+q&%8
zc5d+B8||&AQO}1I5P^9|WV5s@+~kH6y}5UuV>@;K2XQMVXLLWwd%xZCP%9ch5ai)F
z&!ahyY>?q4O8JTTsry6s_6JK%noE@FyWeSBGvO%f1q`?W+<y!2)9PR6lEfU1&*wt&
z<4JL6O_Acb5-UP>ESai+jGodXv6K4~Mo)Y#G7s@>J~<B16=CQ_5}GP**g;Y)>-~)W
zgWci>w;$4D>}1p5#WwX#7b6GPX%-6(zX|Tdw>W)#<zzS~*~t<+MI8KzJObwt*az=;
zF{!8DbVgLIWp4W+JNxd|WdE~jslv(;JnNe1R@P<4j0~Z|J`7xYJ;lwq+u=c_3HAy?
zIwoPnICYS~g;l#bIZQi(cvA384PQ>b2qqX5=JJja^TfCM3sw4BRbKJo3(eQTItQ?6
zOO(MnV21v0V<6A`@p~+hoz3G0=9H>!u+eW$S;)f2xRyd_rWlwPdUQc7B5{_~eNGT6
zlsm3Iuh_BQdE)z5B$1GiAw%B|t0G1_#TBcp_A}t~1Unqqf-E5Y^7^jK2v7r%Um;5`
z`g6TqirM%bEX)HakFXk99BMB&y1$Kww4!v69d*%PUb2v(%hfN=2k!TTC05EG5b6xN
z5T6h;;59`0emlO7VXgfp+qhmAfzo2F5ZT(apA=L;r^G?8O(bpf*}5+r+iNm8Q&Pq`
zDtl_BlJ#cw(ur<{9M(R3tAzYPL>jCUHFN^IopNZDi<4{P31BgYC{y(66<XMm5VdLs
ze5i#SJ%&}bP_5WQrRKtspof4>-s#-%-GZ!r2CB1q+ndS&q;1goWAo1m=)bNuFmUm|
z8ImkLvFv_zr%JUwKN1#%A%j^Vcp)c!YR<x|xT0vsU|xaW0!$X3;7|zXoAWA?mAICC
zK%yu2bOScqCofanp*<1Pu@b=-cNav55x98Z1=1q}#5xkPeE@o$%ni|-(F+0X=ETr&
zct-kuX#OcsY9Bq^H{&W8;%v_}gp{T;7{BUt9Dd7=gU|iR^5e5}o846q`~5c$(zpWV
zzrtI)^nU%^v(rvqGoQi=5bFiGH-qvcUSDhpuVrlWWKE)-GVx!>_00Euzo?6E@_gqA
zj6UTQPr;)O?Tb4l-!1SN=3FBE<0yYqAiQWiZ>je*@F{VJTt}mGiXTPqDv1!jX|8Pn
z=tK~2GAPJGFli7sWheym|2Pf&SUgK>&tN_&Cl_<Z!{j#;s9#kRCcfn%l1Rx~J3Y*e
z(g2?{bAg;z3j~oE%5B~Wqnp7Y>e>D~8AZV{V)FROSd1aDo*dj*V<Iy%%v1S6?)ab`
zm*oLa;F@5>vU`*N2O#@8i+eu9-S6ej$C&avnPy<hZ=-&$11DgS$wlEDER3+%H_z7(
zfBc)3qj4*XR7Hrj_iam_hiKM6!X2EwM)Z#LCE+E;mO8|x5j86zSci7+VmQ)8B${0l
zeg!^g834M`g2Do#>>dnPx9XLp2=sMb3&g98(q5{Pm=iZTQN^yc*UPdyYl<-_vC-D8
z_ZcciRHy4i2%DzOG2)bnjs`zAragXtP)Wb-rrdF82Q~5vSKcBS?z9RM3u-)V<ZE)I
z<ZD7)qh^CComNy0C%;_rA0h6e(C=E?zw6ti6ZmeQP__jwA>wN3n{Vo+zy^HnUw>}%
z7}GeQyG*Wk7Z@`EI@P6fILH$CYMaqO(dCrnJ*95@-85R-a$(4d8`(V)p{^r&sU=yA
z8%1d5b?pn`^~6DMs6RwdY_8uoY&B9^qWWvIww_c!>W>|Kf=*>CLnyJagxNu>hG3~F
zp};vhLw|))kHC3gR&)YI+>)fYwj&L^<(n`0Ov*P7KyP}ALUaM{<qtIj*x_7BboGhR
z)Vq&4ADY+d%O~&{{3cKA1)kFD^~K7xaL(hHI`DTsrN@nPRu*4{#ymC`hk{?9X8w=&
zz)HFlnB>x&bscnzp7({B*k&KJ+2+h{-;6*Lv#`mOqx!0u3&Dm#edfd_Kvp7>AiRWk
z^yVO8zG(LB8~H$QXOhs+&ud;5WFX2{Bu=E*-<&PZEEt_bnc3h{PC*0Uxip09%1waI
zWuvG2@zKhktD~boS0dWm7e_w&^)tV<wM&2N=;{_vJDrhQ29t%-HFvnCfdU*Uhmdsg
zQnB5;Jjvf|P~lRq3_G0Gn#?sV9RUF+db!tYLwEfKOC<^&SeP%SbVo7-H&AbuMgM^a
zKk1I*Z-c%Rr~A4#Z4InEIFRNzA4W7r@j81vd)y5O9`P&()QA{U?Lc6!2i$YCP5w+q
z_*EdD_f_b@zl*S`WeTu4NgQ~fJJg=wGic|~M|_368XOeqRr!d#t5cGEYtC44G5av5
zJZi4QxX`vYW!dFjL!e%$x;@7+xh%<8%gY@X=yh|1+-tvcdXx*H9q1Yh>1@RZg~!T<
zdCrzPLj2lM^niAOCYnRCdr8Qnh5q3X>o{(!lK$9Rv1kM_IUK%pz4#S468onRa^xy$
zUXzFjqCK)Tx$T`MydNhN<2dpbB_7`#w9P&bX|HItFL1z``0=jI7dU>I)}y<A<yfdJ
zrX6%^0gUz(;{;|NoX{=kL-VeWA-52`Zr2p4)U1wv5_7NLje^2h!bi#`sOZUg5ksn&
z(#w$~iZd{M!s);FHrs#S!dG+3J<%RiAuI&}et$#p`{IsaShEqleU}XVukN<dNoX!;
z*NN-T>b-*a3ik%5b*ek)Y~A$iTEgvIjo|*(&L+c%@b@2A<542QM@H9asbPxavI4+)
z3h7LNLAP&D$XQjNYnV*U>UZ^5E{w)lknZ6&iW<MBa>}4Rpj0{!uIpr`Bkx>fqeX8O
zEd1++WmH@G4AeJOTtxUXUVP5h-KCr%TLHfS_=v5@Z4|gqr}ZeN6jzfSBx-k5TDInY
zWIxDH+~9s`Gex{)-`|^~UUj<NpfK571^E^+<UA@r7uVFf8yIuqv;OTY1UIvz@w}Fd
zF-{!*y^llGFuPLdLNpPEc_#MENWqlrnSc^4i0DEVNNY^qPjj;Xc#?x;iswDk1K&>K
z$~(*dz!)5%j3(ZUPyCALJxPqw>Zg28_FSPGv9zLeTCi8_!Fx*f)&tk}TPR;@0rR!b
zoo1#Rc@h{pp)x$VZ$jPhI|`xc_4+;Gw|7wa=~6!~jY;e~#$@?{;pWbqyKC5Ehc)V{
z3%OyCtb8!L)OJd}F&AaIHo0H9DpiM^E$=bFsRE~Jt|4#vv@=FG;mbT__ACwzt+6nX
zxTRl<@TsTAt$vTHR?0CLhtQIt@ez~Exm#*qZ1!!$UnJl1TeTmBUm6lDo^9;fnmbV#
zXiJ_q!C-{W#*V&feQGOrdJ$ZnhrJ1SOTbx6fQPY!PQ>l7<-<I9VO@%ln1SAH%a5yz
z_d*WOSN5AZuCuf3lmEH6pId#3XG%pfkMC;5UNk$WMMR2!++Z@A9OI^6c}Fz=;h%i0
z7H!y7Zlm7gkh$Bk?b77j&o}CyJa>MHQZV$=DL$z`ut$Gc+wbM|T$E@gW$Ug!%n|Xo
zt86G9G&qluH1rjEZ$V?6l^8r9xnC#F5Z0if&_`@(Midd)ltkEm4$R5#l47vDqu?iB
z&FY5}2cr1sx>kocgPYbVeqbnZniwuJghb>1`0*Jp)k@Yu374N+P!KwM{H?X+=M0^g
z9Gi>?ABICpIaA9GO9RC5_xY2gyK^92pTcL|RGxwIp<2#{q|o>XF<sG|Q#OwgHhS2g
zKgLylV%xhiAx5K4O62hyMV}cp`GqGiQA*dm+K&=POFcv1*#_o<dCe&c*S}Q7)%H-B
z|0Y_{e^O`gb#Rfu%+MCBl!%I5{)Y40oc-dx$>1{uZQ9AWhp1b^()RM&Ac*?mS-hVc
zO9*JHe0p!HQP=rx>r%zT;^T-CVw#u`!7%mnerP?5YdHk-Yks`N*TrXVtQSqwww~xq
zpp3MonwcoCji4Elm2^!-YXvWdF>%abP?z_Kmb#zd)9%H9@xF1p0212dW*~17gTS2s
z5<72-qkkc`sF3p};#Y869CLt)adutc^k=D<MO!M8R^%+qBewWBj%k)5eLsYX6d@>4
z8>u$w=d~J%H~RM9nRIb!EBY11`stbo72C%baw&XYM(Hh5giqD>v>k9(sw*1*I7qGf
z!NwPY&%PwdWU_pvwz2kEcB`ooNvQVW((*k6dN2;Y7Q5_~HB!-Kcy4Zkx6^4L<ag1!
z{E?6U?8o(Hr`Wkq%WUn%VJ*FdYk-p<qYrBlN5_ZfeP-!uEyx}HS$;yl#7=R2#7x15
zgNh%<N{(DM2|8xqco087E_$1BL8BK4P%Vu4T`-%s8$*OiHg@@73~sN3c*8=GEKr=-
zO<=tg74R$rD8O^4qM;zb-5nAFp3I66b6!%s$^vKZk{my8KE0+7yeqSm;}}%Iuu5UU
z<{0&S2IK%F<VeF-d2-X3mYvVSYpYW*<loJm;L*m3|9?gk1b&9&K@wH=s2-|_$9VOZ
zm^hulXPm*dGF88!pZ1+?zt3WUgizcn>-_o~bSyCrZmHq{FCYx6$kEbf!UkRms%TdL
z+y`~#kv3XO*6mW1W9-CZeo$wV;srjQ`{+Sj=o<9~L)->8hztKTom@asVQ@!7y`hi!
z?X!yCipwXb=`@w{vp#W(=dP%oWvMSpTl1_$Nfz)TwHMm=4O7@l_z0XO-X%C)hOe(4
zUl=5}HUxe0qc%wLXKxSsd>J<Vh#4c>Ott}#t+!e)RV&_~nB0aI`L{d_dgkaLCYsyP
zg{Irihm)~CC(BqQj^^q?olWzWtF+3`n~F3W#Mt4B{?^X#v2j+#+r5PkRgot@<i<Zw
zd3~BF2sr?46}V=89X=%u6?S$&J}-#y@Y_|{9edb`$3ArQx4n~JOb=fQnCa_!Gs;S_
z&*e0wR_ZP?#{@MtZS@|H*xtK%qaev*nN_2V@Vo2+@249kd#9^f6BNiE84LaCw}3;{
z{?Z~GHBuLLf<2$Gz1^oGZ~2i`O)D%|Ufr5>y(`DxzU%A`TMK#uYGDzWp;K=G!cK}g
z{k_EKf@b1tBmP>{J)5}@)<XCI@;loiM@S+%s<qcs?F`%=oxh^WN#)b0><?Z7cvjD!
zi+ER0Z8?wTbW1ZB_WT@Z6aS8t?Y5|-y67CfFPOR&##9iM{+xe%m@3;1&<G|C?WCnJ
zgj-97^*ZJSjd=&U1KUqUjWp{|6!-H9Rh;n@7+=c|DlTyR%G;1xn;o<p>G>4(@@s>d
z$asnZA+sV^%?>T5c%*g8dn;84w|=mZ(tgd+n2CW7OjDBED&;Fx#oy&gY&`XN0r}g%
zgkm^zbmHphlDOzdLLO7o>C%t!o-K8UnquQX>ba<YWt{Ya)-J5->KxlK1l<u<ebvIu
zqzj?uxWBW8<V~&Hy0VG4>X)?eEHlmI!{S5divRE$`FXtb^#eR6uBQ*W)T6#%Az&z8
z2g!O=IbM-m_mS^3MB?Gv;qq}ci<pL>`R*+bA9~dd%O6zf*iYXc&s2_AY9$>rTU{t}
z4>V=56Vh~DiK>3h7jG^dT7nWJh;olr6-Y|9FbR)3$kcY;HUQ{$B}-i6&W-wUs?Abe
zqnl?OUi`MTTl51$?xjS%)>+&#MGoR85+&bse{|IJEJrB|j`xn0GTcu<c!Jyi*&?8`
zrc?Uei<cLA=8pOGw~mvG`vD!4M;v&Svh6VccAv`lv2qjZa1#^Ql#i;&5*ogw{(EUc
zZaD?MQcD8L-O&AU;qk|}|1|c6?H?)|VNAWQ`({v(ll^STJy=L<4w|%**p&QOYdNZf
z8K%CyRYA-ijnPj$Face=BhaPHTFO0rfo2}~lI2%c8TtYe{<6(TE)i<Ql(@{*heBa0
zs^iyME<a#iVlRoLV{=9~xcD8bRJyWCh8|M87q$kLADaJL57R-dTNkIZ6~r1`W;7N9
zRuK$eK=BMrMDW%9d2+KzS4{J!%y2Vkyx?}HBWiUFFBoEi8vL|WMxwwORu>tTz^3ua
zFNc^`9X-Q&*%N(M$DV?FuBZC2bd5UU>zO|9k;sigTDQ6ylGch)iKe(SgpOt)t~y;`
zcpHX)^)@Tk`Ou*?727KS`~9UVt2+q2_sIk?y^&}Rq^D0^T4Kkl3QtC<lhR4rrH91Z
zgYBUf#Z{hQjoE$ne~X~x3lY{p<9O$n6bw5zKb+kO@=4bL{+i!|h_N25wFYuWN`H*;
z&7%?S6-$m*x=18DqOwh3-ELJf*H4$>NC&bj#-IbyXUO+8O(<I`H(opN07+9Dx;N+5
z@m#wbzTReA`2~BUcMVWpXd?)*bRb$;x^Lm#I=z|WfSNVMd+_%><P&`uz5gnfUBFft
z+a&}b9gXew^WtGsD@h7#j0)07_rGafW4J$vfA9OpGV!+%jcezK$`JgE>x6t3H&pXU
z8weY*v@{61<DvID3m;^%cbJzRQRKE5wkjZoxSmzBA89ZSilHQOE&2a6vkPzM*uN0T
zZYPub&RA!r0^ha*yRLq$zDOrIzs;aY^W`@Z`Q7pM-Hzr3XBJU1EoIQ?rc_?M!p?w?
z&IDGvdAiF-b4SL~Etv_p;1RPtpeM6$_)2GT{$>}(`Qu8ww97i$!;fnbrB!&29GDlG
zlU$pQ+e%9x^7)pws4pA`t$J^0b>x8bmb)YBdIuF?I_hzyN@-mahEmlrQE{7jO(7j(
zLe4QA_0FI8PYM3vK|SGgpm?spp@|75YyIx)yDmA~v+&*F&K(#&418F+?A-?SLOzh>
z8ke3{mgo<E{c8>T{Cx<&%Spbadp@eFrWTvzk@Zb*jursQ19LrCzP;)x)P#|A&2brZ
zHFsWW64O2VY0vr>Z<iK_ND=HtEJpjo6}Xe_{;{W5c43}Yyh>}XMdNDyM^eWEMl0<I
z$E)dbY<0n}mkml;y)s0Hk=r|D9@BTe!tte&rzMX%>zV#9(e3z@0?>tv&<TT`xU!=Q
zr8P=#pmKMe#Z~e&vDitqi9?$FHtSb@EABshKr2v>(5UY7#nRS-C4pnev2tI(O$f-X
zJ=ZnX6?J{HLkmZ4xNxj{HaYP57ygS=7k_Zuc)X=8fbKSV(bDJLo|m~xsss)bQ|hSe
zRXn*snzyM5)l6=!BwE&nY!cWh9u%JD84@#iUq_4Lkt~I<c`8ar@?Vt`h&k)tZuy0@
zpKaNfYGYH)=1a0dwo%!NC9|rRDnK4PdaWlDhWvCQy-mWN-sAqWt(d=Hv!}Phx5)zZ
zcDfk~>)iOe+FMt4MZdo9Ej=}OhOVeNOXa8Xoo;<$0GJK?LWfM-o1($%GXB8VQc_v|
zoqgM`hFLAx3cW7Eo@B`|W%}rwk=C<Fl`XbA#~ZZm;MFBU+n_eNoT<==I2~svJdMLL
zq1UMjngzQA4A8_4Hw%EAF{GeSp`Jk+XCAU$izPrBRYcHQSK2(8lDBK;<^?z75gDy0
z*lF|PQ239~egDS*i-dPT(~nHw*H7c#5;DJ$U0u-4YATM95`vw{Q2<$*LwLNS#blmq
zba%VYI+z#hDBu`BjE?ekj!TmElyd$tmRQ%m^dC$;**CXG$)ud@k>Z{G{R-QF_k_{4
ze5z`{zWjBhQ<KN=&#a0){*pm`dwv>F3>0rQXks^r%GP)?Kr|exTV7mRqM~5S^U->#
z%y_O0-mrtazy$HUGIK|tNZm^_glM&2XSDk^qV^fYi<N2b6|?Z}9Q_fu)91IIrHHt!
zKi!!R5{J+`lYp!4Jz>dfV4c~uqSj9>p{?gE&o*FwNJHbS5m@}tX@VqL&xo?E;=(9h
z-{Im-0H6|Bhwdl5uPRt?6OxEv)6C@Ho4(v^lA9U8it5XWL$V4bPR+L5oDi6KkQb*U
z{G_?mKuR&ZZJkQ_d;hy?QM@Td2nQy<n`i9fKMxBtk65}am-v0*;9hFf4Xhs1scy=R
zS<=d|8te7xjyb8rO;ke5Wo<va)%df^)qK!!W0IFEv~VAl!Y4<2xUu;x>!ftF<;~r7
zFi2Rr@1(F<U)*#`ufrnVYg{KI0*>@kO^6uul%epJ)MB<}m|<(pa~(@0Y59B?+eo8m
zFACpiN}s3%ZD{8m7eqg+vX8rtw?~U7OL$BzXjUz4e#^^}2BeD9x6}3Oea9I3%EIFf
zS|@=Y3mv=RO?t;7JikWyneS|en<6WB&4*q&h(6!I%B+)n<(7<s>q;*(yLoP^_w|B`
ze(vJCYJFf&c{kHwGcq+l_#2+mtv)&&#Y9_vj1B%IV#C~5fqAGf?1``P;cTZ&h3t*>
z-~0^5Bw}Ol=t@FMaU3gL&FDKW87|R&v9^3W{gpVoDfuY+3mFERK7Am^OJTR7<()m}
zaF^qhz>U2uLi!X`kh(zcVGxB&iA0C(UW#Z}(DS<pLWW9-nO^MdEWw*eXl+otK^Fd<
zWZfvvLsWc)4m$ktVW;4+IH(?lYx*?_$}4jJC2miX+Xdbtx`uMu1hdZ(r5;NSMk!KF
zLsrUdJmyX`2#xFg^$A^uOi%o)pA2FWhtv-`er^>hl+?~1^RMoDc^~{(@O)4YQgUm9
zj0t})l>LvKu)InFMVWmv!fGgop)!60Z{rfZ8ifD_uA;>>%BQHooiD0vjuJEvTHGF#
z=;A@!wf#8~4ck*acRL-SoyzT-Vc8;=;Sd?iL1?JjW@=>dUTSuU6`44awL_dF#E+IE
z?~M-s=y}zTv|pA5NT)3Bzh<(Jp7byNsV{0!g$o_zL@!!E>_4)|EiNU_udg3{e-aSy
z+cEbnrgJ8MCXk%mxv-wDs)q*GlP43I7lJj@#PP~$tJBNn!Buj1t){-IV9;Ov`CJt-
z{(HO+9^LaIu_s(H=f9a}$yA%Y)$1~x{qqX3N!$HFFCPS1iQq)|pE9{K{&sk@eaNU2
z#SCaSvR>pk#7U&_cwONkGmfPSSz3_H^rXpMTj%LsoVKT>oY?w<*<kxlo3y^<=|6IL
z&7Da%O}sN-|HvKl8@}Ich0e3_Y8JoZe_AIMTpUmY5HD?pL1#yoa57oS8mtp*N=0yl
zpq=^dOfsGeVMS&o!3N2VB7?qPGV``MZ|Kv$EB4=NOBffl-gc;&)_=!?c67(p2I*$v
z->tb^Mm<V+5LsC0TVm9(uWE_gJ$$*=0~1jxQ6I798Tp{G0Ghom{@lO$={Vo09Q4Bc
z6`KUgl*>V<G{=#yF9Gs*1ZQ;V8Gzo@#oU=jKI7b;AEVvc34M!rh#hqe#m9Q!ZG^7a
zr*j-wyL#^NRQrJmt~M+E>Lo@$r`$c)X%P`%1~sB4Q`%ZkaA64;YMl}dJqZxtF%>b6
zAPn8ZPWC$KJgVjmI6W_wye~%oJ^I2vk|+p{`BHM?H58KNazJ5W7u_hqQ)x~-(zlZz
z|7ll!uy0Z7M`K#~Pm7Uiaw~ld6a)r<UiKa`1^I8;ey>1;ENIqfyx$tHGq0440G?jg
z%paAbt!*<(WWcaVw^jW*b0PoSa}qVJ<3T>2IPXvVIOj7t7FUzyJ0o8G{ub`S6+O37
zv56OJ^;|185^`@(oPI>)T4ySU-zx4Lu!rBc%B~T-W}=H%lm9-UdFMkHaFE>8hS_nt
z3gQX?PJa1w)ZdYYW8EPgU#g1m$~~T<=*Kh65g?fC)W^eSZN?ITZay0UDr6FntT#I`
zmL(24GRLtG_imRphu|(;ckZ{6MPi+H*y`PNq)VKR%20z{L|+K4Kcj3c#&+p`ilyiO
zoFSOELLpaS)m=GIAjHut44S1m^Ouw&O+*Q`8p;N(Az4D$%5PvM$)35eed!WmDqzuM
zVup4BA!&fV&{QLm$yAlD!C>b?Mgvnmijr#3(FXDZ-ho}P^ZV!pT$qs6x%jiZ!y_%B
zoW~!@uAQj_{}nQ))#yIJLeWL??&!np?KIjM-HN(|6;EGTTlR~HLEGE!h9G&G*nmb@
z%h+yHxZ}{f448~3)^^j0Csp=5_d(qf5pAOU_05*>)F^`Cw%R1RfT_iU6LR|4ORZJZ
zN&Mh@VonBUyo+_b>pg+&Dw_;+cn4m!qFVQk&LyvEODh8|$0APsq6%0Z7EEqwoZt73
z-7h^J?aoWy=2(cA{}D1YG%l*fejDKH`;snz+x(xuD8kt1Au!KIwd^_?`@buW6?5w&
zt@96hzg~bXiCQX>^-+^D19aVJ5+^0RQXoiv2X*Ctp|zix1L>6y7wA3>+A-1eU?uzf
z*&?=_<hH;*{$>#Pu5XAY4s4gQfn+|20mZ=%D}{(;uzWiBo%_bZ@TUb~RwARI4R!`I
zWO5@stbIj=Bxny;dUQ@s8i*?`pho+?e_MLv=G-j^+hH}ZQJcnVikZH%nXzMCWh%hb
zX)DSPnB=_LeQKYx{xA7m8%Q-AS`XrOD?|iH8y6ocKAyFxmNO7r${p>WogK!Q8?=3C
zo5RtbOi2v1=}ymM28Q?X;oHmMEX$G5$Xl>+Zr4i8!Lbt+r7ymh=#xr#j7ej;s~d@n
z2aH!#-#)V}EBmu|q+;lN0N!yu5Db{4(x((X2Cjsl!`MV-6r7=99$iKyhAL2|u`hVd
zpK@Bb{5QQyPyccqV%~U31z~V6{@hqMx+=jxlz%gr-!Qm{e==50v~)v#@n;k#z-JOG
z;aw~rc;e)3n8)qCgz6D`RMN-rJ{vVd*w+3$1O$}u_obQ*DbhtRd%ACgLdPK*hqYsL
z%=-x`3#~?zwfFbrO@5XY=kCivw*`=koaY5jZCXuuKbqQKU;BAF5nRcLwx?uu%7p7f
zbH{1<DUuv$I}ALMQ(c4ko`@}9ESjyaxl$ICI{)P0)!JBIPHDTF?!O4*^)vQ+_@K%l
z!*^7hqYBGh+h>=&nj&sIWZzw^+fQw{drFne2XHlGg=+?k0^w%j4}|CfwAW>9CA#;S
z0DYi&#SIL<>p-ai6J;5&Wy!hF_LDCPX#j?01nd)zEgQEbq1oczw9JOkdVJEHEm<+T
zg=-yYDKNSXD!kvxFtZmRnV_i3ome3Di}rKifZwnk^J|R$RIx~2`6mResBW8AN8{c~
zCvKtm8xNSLR%!&cE8>Fi-i|tpqu3%Zto$h7yN2+&1{+^Ef;#J$cu@a@CPya#eR}1u
zPMlN_Q>6P6GhfTHQoFeelrs!fX_caVUKcjVx_H)u66N&TGAMR6uHMr~3aQd~>K_D0
zc$o&VEN9I>WKsmI2aTM{<Om`Zk<6plo8?onAx%zYJ+3KOfq{4%Y)U}OttOg?=iAbl
z4BpUL0CoJgCz88`RM}ppT(px;qqs&qna(ckqjjrD8<J(V_l_e!2fWgWBG&1N0y!-)
z3R%gYXGUT#luy6jd_O0~Bs7j0@cmWEymealcpod7=q|@)h=)>*GKq`>EZd`)ZYtHr
z%quhKoxL&|NXFBPyZO@)D8ff{{&aPoiyjuUU+AK7%T%dk5jy4Lu=`-+bKBVWDuy1r
zXX6v*=ok`7KM>hdO;p5J@gm@6)8Z0Isa~o+tCf4?mousF-+sSbJPo-&o!+~ZY|;0Z
z6AN<|S41b}B%n!;bs(F_?djvCw`C6<fo5R-*gLbBZbWO-<8=0>y~=QAd1dIq<X2B#
zoN32^{Yo0YzxTxfdx-c}U>FS0z4}G?v~nOpWMdW6+;MT$wwr6$qk{+`1R@Q`g=UW1
zi$S{z{qq(EmV|JU(8?|0nKuJw(hhVNE~$J0&@RYj27(M?%?|Q*p>Mz2G$DcvBrL*l
zO@!!$r#|G|d^=m;X%~7yGYX4r7J#R2^@$2?E|<q~d_Z5#oo_!FUa1))2agv`|8N4$
zL9>kFvATVRRT(!@IQaB?)p~J{rCEfllR2Q!t|t0+yYRX=se?zfNgb)u7t2@A@sdY9
zN%!3Fs8aTcgXN)4lfg}DhM~z2M!%nJV_DYtj?cvx{#W_8Q%9y-;$SOUxN|OtWQ0;~
z{b;`0x*0VgSldz@J64sGyGdps+dJR@8W}C7I-i1Hw{jX|{}&d}Of%Y`EIa*Adr>s2
zF;?<-QP<ktlD*i|lp8*VLMpg(N6=8k1o`ugxcQVs>V)BI#qMKR>zZBQ&y&Io%vGlz
z5q$9u<QaJ8l^Rxd6`qoKRZkFUJMx*Y?g{L5mY`|#!#QNl1l5Q@qtHu!+#08qGyZ%3
zuKw|4#DemO3IV?&Q+q9e_(`&=pIZk`pPONa1pG+I*P@<SGr$$-pE~7fFFte|l)z)x
z_AmAT%Wf9y$YrSG2T)YVGnIp>o-RJ!ScV!|$1VOF#1?17LoFO0vj1L&YW2_4I#H4n
zcgzjPaqc*Kyk?m237|)difPZdiFeq*3pMHm1fVh2eNL2r%bZ_3IsoMInQW=3NXD|D
zV}p|%OvM-d*i_!cQtxfNcdt_E$g+1x%`=BcmN*F+lpoEt585<t{~eu-izIu~OePGl
zjT2h^zC`kGI0yj5wjFI7?~Z*R2eP8##os7%K;$g}=yt@tX%*_hAU)XsaQ%J{;eAtu
zlDWi*5cR&K<ar!7z4!4tuWa{gMWF@Xbh~o-%m4pg07Q3<Zp+=r)LecOEi|f`Z3~fL
zFTQk|FxP^E^nYw46dA;Inl(chi%%tmD)bk=IAz7j(fE#%Tg&W<*qs^RgcfZj()Cp(
zK|53z+HW!-yvzY7xaeIFj)^rTkK?aG;m(Ef-)WxzG-R`9{z&M8Whaa0Z{SpE(67LF
znROdvy+lS<r?e?|(CH!FTS0ms)x0s?#>w#z_g}bv;+rKm2WG$Cvjok|3D#@;a(C;|
zYy9&aV*)-qOfGAaQfiYeJd3j0I=mf!1banfTF)(3M(};a9x>?QRa}1sK|0)&Yrs)D
zmqRXBU#WfMm*Pn7b-EtesmPnAJ&?bKUj`4&d(X@s4`0c^7|Dk|^xS^~H~R-W_Z&t*
z2fiBSb=cnM`gb>4>kcPO8EX8TA-Mh-v0N4WtCy@S_1drK7i<wvd6T?Nn`ndsR#nEV
zqocjf<{gv`4?z`M1lS^sk^Oc(*Um&NvC;|QAslBeA`B-$i`dzx0<}einaDu);je~8
zmA|M{tP{c+P{4?+h`ZAc<EwQPYl1a8)#(>j@5Qs-%cd{TeMNEBmi4cJ7dx^yOm@kw
z>|8;u&bfR99wOgpZ#pB#fSt;%1ik~L4;n*Sl(Lnq*55i)pc5i~?$=UcAxQ0-R?&up
zk&n9X{>9%95M30`{*%=S=_Q7C<>^kXx|f8#`$LKqu0R8R_#6W?mgS$$hIRr&7iC2&
z1E|D0N_7uGWXsEl0bnNdz4c)7V58=+M|G)F@M5SM&SL5G0%+K+4AIN8N~m7i?&evK
z>N!+hc)3K__U38auTr#}91^V^ZVFRXo7&*feR=Oct>@9cEw?J}c~X#5Em$lNxMgUE
zD*ie3(tT>_4_aj?<3>R|oT(|~=i{zm8w*6ok>|Slh9{R|S0>Y(0p?O*LWStMiniS9
zJL&m`+)b<II;4PK6IU)s81>300cS;{n?X~K-<LEXRzqJFKJhm=(?UaD#9`8v_AJP9
ztqH#hvRGU<&o&x~@CKva_*eN-^OeWbD4;T$---$dpWt|^QV2(Sp29FcGFv2K_&_h`
z!}fTfzP!}ib!>hx9%@c3$x$Ks2x4M_Tb6tl6>1?hKsyDk^>tbqR*V2a_u?-AEoe0u
zy!#jgbb;@vhh&ko_E2Nz`91$!s9)3$qYEQ={3#>B)~jdFnz0B0r))dg&q3kBSwa$B
zWvtNBcnQ!d7UA7$zYLIesoABi!#z_tO!k^9Q+H+W!p$%9*#5zm1w@iPCpBN@mglh`
z4lm(}etA@`7${VfSE+yS&#nibFT$pK!y4~q*|Ho6>u*q+dHSKxXis@>R=D--k8*|R
zZJ<1@QaD#8l2-dBja9<t3IoPI``aI**OUbQe!rT+l<aAD>1fDf_8X-DvGIbYuK3T;
zp)X)E^EytNaK#v*>90Ve^u?RqY2=IYSkdU5o82QNCL6AFomyjNrAu-cM!{<iY@7l&
z9eUVPb0#vJLW>nO`u>$8PvY5dWBJd(2b663!(CvJtmMNPBTIF$*`Z&ln?scZ&y}Q2
zI*RVF?GDqz`YjLiqD1)(V;i^6d-QVdq5?Ig#@k9|jjtuBr}m~S_Ovr*zX)1qvbw2?
z741_>WXh(97COFZ8OQD6&}d`Vmzw_-V9&l7b0%rJ>vjbac_m!kbsR0$X+;@zo3-Y?
zS{0E_9LEKgX-@M_%Wro9X}5VM$9T<)L6r*ZV1fBp;9l;dIg*`mygyv}@|RD(Jnzt%
zej6r-_i^1lc`<BE^BIDg$i*Y)?NyCH@c~aa9^(1Lqo-I4{#Vf&Z+G*gp3wM4k@a5;
zYoCw04M=z1wWU>+8jKM(ZX3FAAx1~6-_@1Y7E=NEm9xPsD(>EwE_Cku$7Tm1jtO&l
zQMLSJ{i>Zp$}|RPfygl$5dqtEzdjvBQSgbYi0VpJ-Zu;Cr663KcI$qcQ!dky2>aqK
zT;SQ}O<oF2Xp}JlYn7d}-&*<0YS-pd1wM{Zm6pRa?=Hg)tcX(|&gahKOe=L8u}{2;
zE1gLQX~WzD`kX&vhlLY5p?Hq-_VCFn`|H_Br(XpzFaK82Ce>20p`IMRc4o0HoW*3D
zbI<jP#(q>vVX^jV`5$P8Y1Y|>0Z@C{dExoR^y;U91g1|s{Lj@wB;-ZvFbDwQU6c=V
znm?b`7E;D+;rb^>#COmw^chJ;9Sfb8tkgl(lXO%Ky)mkWLeD$aZQYc_PjB-FPVvMB
z-NGhRug1H91jQ70ozSr$Mx11&2k)HpkQr>SHv8X<#Z*3=ZJQyk!0fNBJ~I)395=2|
zN~y$>(OHKi_+)FmZIVis5FLE2a@SoI(6tEY-guCB8+l`7p=}iRI=_Rg=JUOyZlClW
zBHuYu*(C-+9Xs|n&Rb5PBwVCts)$O~htt2jqQ}|(gh-_EJV28nxqI4@s8n@x`qumr
z+1uMULI1?o@^|8Sf{Hq?-}U{RLDvWbR%~8zmQgk|iFALsQet>FieqviEU!3j2_|@s
z#V3ZOzu@}`0%%2U_O>U#AN`?L`-Xs$MH|ti1b8*=ZE*Yu#w*c{S-asa7&zZ5GHNe4
ztvuZjlf}o$c-xv^SyAbx1KR>wI|vwV@Rh7W6+=?h!%bHT$Nf^8591t`3|}$1LlzTz
zGM*IcA5RtalkSs_P$D~vg`V{A*>p7!w&{mvQ+IIvBAwKDannN+Jx3$r$o;-hEEXYP
z6O$ommkf3c#CITXxSz`E#xXRdvy?PjRH4K5_s}9HRNJAkR6{h`F}#5yzjKqbiO<I;
z0>`mk<fQor&Gn9W6dW?&5KIn?Wr2a7n9o>PcUEZ$>F*wMF^d^JR{7K>Pqr_z`Yy66
zmuiEUM8PBj>o%D7P=ZJ=Y2m;MRUZsD(eS0{qHaA<77QCMDBe9DFgo}2cF*hdry2K`
zZ6_|v$^H6)XQ+!`Mp%A^F;V%OV9d35+H3nC?Ee>CZyD8A1Acqr?obHs)*=B~2oR*W
zJB7Bm7I%Udcb5XiT}qMSTHFa<oC3i;xOejY@1475t(jTpb3UDQ^2mOEdncOgQHJyl
z#CY{^h$62UYJ_&^o&vU6ZWsBuc^2Qr7J%S}l#Gz~ep0okB=}1oM*Y*HUTnxJG;!Y1
z2mw{K8kobw2nhwvC}NjCeE$`@(Glj^!fcOpOR_i*T#Zq{{+Bv>`7>r^{%>2y$LFGq
zWc>GMd2$CviAQ&4r|K%gc0R)2zBD+tdP~92-XKHqc2%}`{WdRyf(hp~x42B#{Ehf9
zV7&hKZ*&LHh6f4d&>xoSJ#$Lx!)E(3&{{P5mNs6;vD*ilb6rvc0UxVtW*vp;h!A%t
zGntT@z11ODYY~9eHVaM1a9&wqg`xgx>aDI<=EHiL(zMq{kDRoHcYBXmyKA7-uzL_j
zSH+;gu1COQg7B1p6J(#URf0_@xV`gzVY;_b6YjSz*<K#dIu_T@*of@SEeAm6{%USK
zX9(^0e`xkvX2x}~I*W1}2*lrX#<|;UjAa~Al8(QJV-5zKc5A*q&W)dhXNm()I+~U~
zy$*l%WdhZum^!>6JSnXf8EMc($UKzM0?=FRJyiV@t1An8BdESWZ+)3KqNuxjN6vUl
z^)KYh&fRcxoVeF|=~$Y%AT~bgc%qEPq4zrDVx0}QpN?62jNEMSNpKcFbTA!0`L|g+
zk7U8q7TwGTyBwprNxH8#q@qSveR2s5_}F4p<LKzUDJ3^T8Qlj(KFgQF3`35q*A3YU
zElDPE`L|L<@irEN_|>^A{dO{^db&}FmZ4M4*@2geK_uZwPe`73AmN=hNw%82yNyau
zTL9PR(+5%IJwf!x*O-HJhx>{Sk(V{zwROg#r?wE47zUZK?#;hv1+sm>syH+Wh5(4i
zZ|7^pozMtx+LM5Q*Ax5=d&1!0OzGQq6{Q+_ANNj9G_J1vZat@T!}(k!?pyPW>Xcg?
z0G>wBH!l}@T~zcnmzaxQDMg>J6{T$ZxRmlNzC;qH4Bn@MEsD$B73WiTJ1-NHnl8Cs
zcsvXbkVn&?2K^f(=6R<H;I}g&8YY2Zds|R>l<6+d>bH$nx`Mi$t29M+1_$2+M4b3a
z7AB;kPLcxWLu|{3l4kOjQxvBg2r1Rw4f<1g)?=r_G0uzj{5;P;Wc8t`91DDn^yo%w
zn8Y5q5qxJr^@;j#f4*A9Swp7f?++jq8w=aF|NI}i6`tPdt45|#BC~0dvy;Aw?Oj!5
zU$-G>&MZb`{t!Y(R`$oYg}7&8S6o&d1X%H(R$WTt{$BaB6JYvZ5Ya=2X>MpOkWdxE
zJ>^LCv~uE|V<&?dY4tB)Dl|_9-ANHwG~sV4@aU=<&#C`_xIzV=yPM~>jr?*-$It>V
zs9{9M)2o_M^grjq&RdncPdp7MvZ@=H_tEXd{QoZT#R6N{&9~i;=QH|cROl?o28m+$
zGI$9uzx$tC-_KKigBK4FwTCtO-ghr-5N?8?`^ibfs8U>1y7c2eV4vN@JRn$|tQVzj
zgF1DumAQ)38ANd7`o*rd>fv<s4KQ9$G>J;Dd9$y0CppW)-B(jN{2smkzLkD7P7gYq
zJ@oymzmVs(DN3<++B`@2614I4I+@~U#?Mow-_&RK{hv<v`rs9ApXezV<vN)GxtJ10
zdschzD~l3i83DA_)z`YdIS~^pbnUn41pSzDd<(k<PkYv$*kx`MHGFu+&NQ>;T;)se
zXk_j7Arudi7)m!O$=#d_hg}``?qey*&j<YGBfMOSN#^UmZobrnKg_zk0~5!^>Wdd0
zs(d?w*h3hd)Ld9|?1xb!Cz9u{ry`zo5J$d{Ag_rqJ}h&<pvKTNWc<>&Ip$&-03KoJ
zHH~c}NAgq^`o0>km>pNsEkbzb+|-;bCoU52kh_{g0Dj5ta;To_cA``L`;<s1Z*-m|
z=+cNRgz~^h8rT9xq%~QyP2i!bFGj*whGYJQ@*Sc`i=V2cG?Tx+GDL#CHQG2A<-Hqs
z5~a7<@D8|k&<V2#QDi8VR(qlR$#53TXYLMk-p{WMn)lPe*3n2;ZfMu~7NcC%w!|yn
ztl`5=qJNwBlB4=;iC<)qHeUStI<1Q?1xfpsF1+INmE=F`twBjBqWg;hAf51bn<#C;
zzY`+siUcX5;d*~DHX=wjCAyB3G1?pI9R9T|8#Nb$8%~w$<Az~@a6FUYy$J#5=2{?v
zO#od<6yXp3?Jap-u58@Y=Bfcta+POouhf+6uq`5~i#)S0t2}!gPahxK=RD`XFB%%X
ztC>EwA4R+0*3N$Sdj3TOID`2jQzVKyXjE-HuV`>g{<3EYxT)SWPOHPQmUb2jU!cv}
zPH$UY#N5|b>hCO3)>Boq7MpN14|AP~I7zMO4UyZ3R_N5ufLAP(xb016f%7*DsGM4y
zyUsNY%Wb#Ig|Hf8GBNXyiLCr~0(^hCiCT83!5D_dhk*tMH^u6!IPssNrTqA@@s74f
zhL7XE(7((qyE-L1ftkg?;;|L&rLSBs?flBCa;~N(<m2v_MI0dXwhz04Suo`?F|qs4
zIMO11kWbpX=Ux(_r1SRAU^IxM&55Sf9(j4ImEZ0AqgGt8t15bo@wIP1>Ri3OBSP)J
zUTxFxC2x39iINh<{=99&+6y<{2x5go?;Y}46GY<<kYeZ;X$btfsR$&lqK1I60s*tT
z1o8L_xx$$YSh1lh1S^wkc+zAj-5Cu1$9uVDDGBa)O@fCA@qTycD$vDfR)Ds*_<f#V
zs3J4rT~yZ6DgzGtVO2Mg!v8+qH6$_FoH(sKqW-bYQ;xdz)}}ju&?0Cgee%-|Gili_
zkn(a)RF#DC(>I8slevt7XxL_O7^+)-h9CFj%$I0Di2pHqrrELZ7_tKH_9)T#G|};P
z`{TLkb#auFPgVY>0)rtNrlKQrY7>5fuS|HocQJ2BK-Sp#?Pq7F9}?0DsU{ucodDIL
zQKvV=6nb3QmSk43n;s79Seu*WlN93C_Y~_f2n7NviL#&Tm1XuFJJw2>&)AH+C$mQ-
z-V2m2j^gu;v|FIOf7Ud~1DjB&!e+3^Esw$}sfxPcBx#X8s{Wan`t_jEmVL3Mivx_y
z`NsTTLmoQc`Jg#9XHF`JXT^Fa4hY$UhybB>59i63ar7NcS)*A7D>z76cGv<a#l)gH
z4KxVHTIbb|hRzT$gl7+ah}zQ=0@ozE-0q0R>8tD8eg}qZ(Xu;D$xcm4{1J-WgmJ_x
zy0iq9aU3+Zz4NV3^%xHl#|Jt3JE)upJRXuyV{mOU1tDXHnzAk5iMLZ@5YcD!OC<=>
zhIe+UO%?Wp;$V95gJhkP@~((mKf44{<xH{i^%J0ZN;8t<*&WyV%|U}SCfmQ}SUO?w
zo$qWX3QVw9a<J7=DHKx8cz<Ov7*+^>?`$K#@;;%D`l?9rAYyHd*lDf0WzO~6ZsJXx
zU(50{FJ;Z`u7Ve*5c=m1`(b?wLf&#zX!qm!T|!?T-gVE%Ejv87G{5h^oaIh$*dwjV
zGk@^T(TzQBgm1<0d1;F%CJ5PC<kb{AnbA?q78_hgxqM^~v_0yuRTD<uHPrM1|GX@q
zuljeW;OmuGYS`LQiU?nzEar7`TrbN}#(L{vjLPdN^m|{~b7DGvitoUIjMl?t40ZNM
zUq?W$_iN=p&o}z9J5uEeCNXG$H_d?-BUeGp9=~H_X5mb@M`3+rq-h(`fPymgQJTHy
z_FJ1%!6bz#WALifyRstJyF{7?FEn*hIFOoZ<jr7#A=cD7@gSvebD@9Bjhbl{geFcV
zE4yQe-Z1x@hC2wwAeYNDL)QJR7h3nJN$=v@HSE|x_pOgu)PxY{ZQwR40hNIR*xN`i
z>wx+X1YzpKb2=sP@1i=chIlGLzy%`5jK*diUAu{Y1nM<VW2cuwqJWcQMa&7;z(!EP
zkd2lVVnT$mPY?w&kie^K&zl)O|1Wm`Z9R4v<(Z%miUoCavJnfB7!6;xfiJ&wdH$@Y
zitE<9KY;Fmqkb;T0PfMB<csL9<Ynjjx_d8N<|PH`UX`M>FYe9;oA8e<^`<gUwxKQb
zq~KvrW~<{qCz|u)2uy=-98E1=`GrkcB@&=yAUo)-l`xCUsWtY>Hr1IYT>gY@R+e#b
z?m2QHuce!F{EQiUX%WYH7FHSsU^nd8it(|X-S;*q`yVGa+-+8@o5&WslNYJ`Ox^n3
zGJ0;6Ucx`}(9HHwV@?cf6qYRRu*$QU0=^k7APlSf)z#BYHB9B<krhvTxY}QSdt)~|
z?B;_pL{ChhdRZVvObD%gIxkWA<eN_X{i3<jM2GQ92Q&+4mACdo291clsIm4rkexu;
zi-Ky;_|Q-(%cR0?y|Awnn$xTK<LR!@#+lg4wZ|-|mID9Ip}ybvB(&1h0dv9yt15|3
zCMp$`0>f-5iO~9CHEzr$_iEc4-p34qB|~NzRA`WpV6o%qVU(WdRFtOKo8t@+#ED<}
zC&k_qhZ!{??mcwz=4jG0;O$jOicCs}+8C}J-5L1X?TJY0wV=E_9cnXv!t7<V^Xf{g
zQ~K>n(!dJ0O}m6_p1z+eOQl$jX4%f*n?^2$GDvpKCrZA?;kc+^@)kluh#98GTHoAN
z?3G!p5mj3f`@O$OaZk<Yuk$z8yS(}#?_*QaH1)@;s>vb@U^oPiqd*70h9g@Q#qXz2
zSG4?bHx;gTRaQnGejN*$kV!wWOu~X<x#@q^%B*^?=nZnJiPx~M_6}q$K4qnT*N@;&
zZ;)o4`g5>R^pAUU`MLv7H+}pl+_K`k&*OSErcDo&k@Y}skT!>}DyNlZ+S!}aTw%Ya
zNoGaI3a_a79f7#SB@zxQ4!yf7#-_6WaMI;d-j%1+G5MdCOga@l`CEQFxpkaFrXXRK
zd~u<+A=!T!AyH8-h4NCYblSX9D|+>QM|GTVd3@mC->r&&alS~M(V_eRma4MOd&2iJ
zB$gQLXQ8Jplj1{?z6s0vU)F0AXx7xVe^4eM-+gfdgf&)K41w&@It@r>j6Uv-ky*ln
zGkXB-r4$XVElB+@3RKV=brH0CKD=gj-EC~*L&t1#qfeowUKb&gS0k{Fi*NydSV;Br
zwt)BsRSsF{O0{YrP{DQAWHj<TD}$05Z?<^TKD&{q1s02{Pwf*Wpw^d|2kzGf&|@Qu
z%?7eTI|66#m^XjEG_X&lj1<f-86u}_N{Gscs`x;w?ZY<LSQzFl;woa{C=<Q3Xs(pF
z_&2lA4ZFC7;EW7jXMT7r?_~6A`aiAh?F+qsU<M&+Ff;?P<+@iG2uorjJUKneM&jhr
zdG<-@F{a#ZgIQr%5(%9`WS))(g|Z6I8y_345n<8VMEPO58r!iJsT{Mrop-15p4+mI
zD%#;WO8O&KEgZQQc+&VKrM7>g>KWZx9ptea_B4;sZ{s7`kjh@ER5f9?M1L!De;9Pt
zX{RLNJ>i)u`bPqI`21{OPV{7ah+23|KDggjCHR*M-|y!Nk&hUy9%+rS-IJeBTXgd)
zpcQ-3Ia@r5Hj6U>$zn;(fWZ+B4tfGdW>KX~<Sk$R9T)a<Z%El<C-xbp$l=?r_e_T0
zb!zD<kA}0n@?WUpqd}75d^cC)xC<ixkWg?f)|zdGR$^>1DJX2R4Fl)H6lAQ;n0hSe
zig*Yf&BggpB5@y!o&^a|mBIJ3p)z#BL!0b$(|eE=kfJs5$y2D?gLm4}J}#k=A1FtZ
zfC_&>5G!S=ADJy%z&f<}edyT1HZvYGNWc`Z6@;7%at^_SRl`R==TXG|eFFRejbNS)
z%8S^jr3>Br?nW2?wp}plplPoaYlAP^J4}^zX5-dSkN>{Mn!_USa29u*I9Y~Z-F}lw
z2Q0S7yyr41nD_S?Qe*4H_)*pePr_Ek6Mh{WwWTP6{o|V+ZwSqFz8kHu6%+JoEw_kb
z9vS<X?Z=JL5RZ^M_?^NJc<2+-74-zG>K*BzHnn<F8fj*gT~rt@@haQ|Yxm9Kaj!DH
zL{zUEcu24xx%O4%d)icU*9OJBtnrnn-!IO#dIgOM!0BRDRRObOE$yKKk?{hrXaY8y
zE38n9*j}o*;xUi#vwAvx*Hcz=ll{>9uuT2>c<k^avpVX<wy1~-8e+7s{e}a4B!Uf9
zal_csr0Q|Ch~*<x7bSL9?Afbc!P-)M-QwRyM#n!0F84t7-t*&xoCrWxs18?WREVw(
zZlyb3aTQd@92-GPlWU<fmob!09#O_7<aOex%RP9Re@KT)OaFZqi~ML}nsnp4{>cbm
zUT|Ka3nSHW!s0vArp^pD6)MP#14Ww9RxBnB2v!Hr01x7FL0wi=|H3PntK&LK$7nHM
zzWB6}Vyd0D;9am4*?LvdBjxb1AI^iZf;JsP$&mDW``zA$f{eGD;hCVSqi%rOy0aD3
zE0P6@;sS=uveWJXpNKKXmDPW1&m2L_DN@Zh52M^zMP9qc77@tJ0z#bS0Av@f=ORS_
zDA_y1zpwYQqk&EAsv2yRZ)>WriG{gA?@n@&Oi9uG*-yGvQe=$${pY-^OzUVQ#+;aP
zgc~}4mkADN<$9l%yfp1)M%nNYr8was=m6e3$(~-oztvlhBnrzMjLB{ZX==)`+?Zbr
zfOx={_0e&9d1*B9XE4}Lfso_1CbD2xM%wtu>``|lkH{4I8Rizpl68utZF;5MgJG;_
zebS+<in3__(CyZVnse5TPCK>jf&S4}F>jNiv>YM>g5Lmae1M!4pJXyb)8^=@S4Tei
zN;I;d-P_rx0u}_s8Tu@^>_3FL4<xv(V<TTeXoHhyB>+*Z^m3*k(qtsq^&<Q({~n5+
z=Kb}<)Mq;M2Y2J~z~ViN+$?8OEcvtiqT^)8Eibyv#AJR?tyXK2bFVbnFd^GBw4L2Q
z^SjML<1NLm;DfeE%p5-*u+Md5tCBJGX-ShiN(zHaFUzo}X2wl%<XaQ_4OV=RNHh$K
zI^NwFYHgsjT>BNp+^0K8Xp+!qO99sF0ueXaM8)LVTwYQ*!s4fj6orn9GDqU0g5iQV
z(pXkp9A_^ci?t}&m~<D;dnVLRgXpw0-iBX#`yZL`)MiHxQX-1T|9-n<nZB)1I{O2B
z)kQiW(7349kP-HCfJK8dU-mjN@_MSh+EaF7I_E&NBYN!AL`S3@NKfad(@#T2@uNRl
z!!maM&WAIEi$~S1avR+Ve!XiA57Y#Rv-nl|rK2ZjMcT2kIp~;`pe5)wJ@@ZxmFsLt
z9E-LM<s~n^y6dLw0ce{A$Q;P0PJMxx+198uu0oh}0~2_I5GTqxzYn9>EgNq@U3b(p
z4V486s(5$%DDh_98>9EV9n&+-`c6|B0t|J9KR~153DBM_{66p;li$~`#7=@5n3}lk
zpI*5|S8VW*D3F-o(f>srl+KOuYfi_)E)W9o6#k^U<zywB?NIv6+}j<?qe`FXyS4aJ
zPweJ|xz5GgOy}qBx<|agH`X0fza1=MI=LxZHP3YoT)!VfO+yXCs)HYJBDm+8v`+u?
zYB}sRPw!7sGa&Fa9w_1Y7HXN@G$FN+lPgMb)iWe3;vFf(eX&Ke=cg&l$@v`20YP#O
zn#0?}BZ>$~+>~^bi)@x)5APwDrx_0>{q52sIXFh!0Wvx1Rt4V&@;Q~-JZzxuwyymq
zyR9^QFd0OXwa130@geV~$kqJ~HVHM|ELML0o>6a`uTmZcYXeMDP|b0Ax8y=cPm##G
z6yJTQC0z$%3^~5pv@pBN&*|Z6(-UciH@3u7avgvz@FhjqkM!vugD~UkOtc)$d0wXX
zRND+izUpYLMMEn`XPnc%h1=}m&<p5@#$E=UHP);Bs#HonCBUZ;h{F`-3Q!kat)6vf
zi=Y}@PO3yv5%h%Q^J-oy2KqQnQWsjbe4UUN0XDA~COqUN;&SlMpSliFy9qto`UEZv
zSYF?$h)9Vpn=PC?A3p3pA7T_?tEcQzm{ENGNHer-VquDKbMNyR9+e(GvOBT*LyM}C
z%{{JWogpUjoAPMjGfQnEn&6|K#HLr|dY)e?r~A_;G$FRy-O*=;_GH>D!AxKe57mvI
zz79Lcn|!D;F4y<;{SCK;%_MS>C&hPpype^URxKr#fY*=2=f{9D{6R-o=26MXA?k7S
z-{b5rDqbxduTu&|4MBlHFtce@@huQ7V`U>wz1Id)t|$TG5+qVUY=1*2dp7&jZ;H?V
zav-P0FIX;MO92;ATK6)M`rmWqJtOy}4Q0LG3UVMVbe>{Lkf6il8b^-FYj>eC(nOY~
zJ9lkGg8nG~B)ReaE}Zpe3sca4Pct_%{&2I<htAoUU|Dy56{RRU2x*Kx57~vCr%K=w
z*D-D1*f(9PxQtl4Ue=;&{Jvw19+TRM`|I~?1uBb$)zDwPGdirJHJ*2cH;|gOZo-7y
ziyr}l+4%OR-hW`ut^X0$*)?d(&#m&m;f&es?d>3?;E2+)^J(GGcy6RVAjJc>c%&XJ
zdr(kBM0NHweRxLhuN<eHSJ3~q2M?^k>b^^0ln`plK{5SG6IpqIT8ayArq>K=<Kbt#
zap9r5hBzI?ud*a2alPTON7RC1Q;yJiSy(BO*9H2ALp-}j)&qk@f!384<&1a*qo+Y+
zJdiyZMsBqn7}(@1cdMPzVL;9X>FuWeuudfb3Um>H%sP!HE@PMqytjH{vmK;$V(F6Z
zMuQ_bjCNX(DV2NxkAOYR`40HMh{1lh){SlU3CKBhS%=fOjVXQouz!qdKx+rdt*q|F
zE9`MzWKU#8#xHgKod;D?3X2N%!MTc&Js$PhpELCGy4u?2nQpCaJ3eb%&b-EuJ*(<P
z8miuqkB{~;_4D0P6AjNKJK8ZC>FHbMw^XYXIk0>Et)9=V2xwr!5n1!nHqAjw>f`F7
zPSEGNBNmZ$Pd;gsO*9Y^*`9D#_*`Pn`1Td>IKvftXxGu{C{Yl_qQ%$WJhXXk1)zL)
zt-#><VBx@faAGO)QSb3n_(jFM@r;MCUIB$jXwbOVBkbTl;M#rYO|^*J*3F0T)Q0i=
z7dAJkftDyHh3{Ti0x<u=XO`!eV)G0~r*&PQGg}YeEOBuPLK9&WX^N>8IKecRjVwxy
zI*JR6%2oV{Wzm={{ThMD8=1p<Ll&UhRaq%bfr*)8KuLsrga}=O+spm6ZsQ6m0ZTb3
zJf>YRuy_Q2**)~f)iTzw5H5+^wI3a$V(p;FH@68#J8y><5JuFEOF_=zdgM%?a9&d&
zmi^a;pTsUilWVlIg4$aLegvX~a03u^U=J<<<iiEXDVGqmx8wLwdIDlaSZZLS&Zgxx
z)P9I4yN0RANaLY_o<O9<49COhxnrU5$0QxPGZ2m~jT)pNb<X6wS7>k8U$FDg)_GSn
zY65!n*Dgp=*pm*ev8tS6x}K0)V>pg+iV_mH2?G6I#Qs1@jpW1>Jisj)Gt)c6pIN=%
zfzzLjKA!Nss$Y|MdHU*`!M=g2&oXI?rDY(T0l!S}<`>osBMH^pikzz+l`?$yY|Ewf
z5GqTPJzPjEV}r0b*(<S}5lh79{T`h!`Qpmoie(e!1B(VrZ86$wkDjOd)4qs#(wa~8
z=65=tf>9Fgv_3hsz4z6dKg!-5^tyKe35TNJkZ_QEQ8qc&e-U{g6bTj@9Q@YC{S$ng
zfHwq@@*-7cipIyBNds5;(2|TP8$4+%F|2=@^Lu6^kI`-z=4_=7dE@0Nu;(bv6F_d{
z>F}8a@l8pL^zDH5nC;WaT{vYr@LTQ+zk8hrk|GjdSCk#>UMV<8JHQyZX@-}fk(Z))
zLH#o0k(B6|GfZpoKv3Xjue$hCIPCP>rl@mQWKk_o!~Hw|nVbaCyOwbZuk}=4O*rh@
zfjiP4<Ks2|xu>vBvY(sO3Qs1AOCd@3)PQg$@1$+VA2jNY<SDfVx^<*n7A8vL2;Z4)
zQ6j<IUuJKWahDs3os+l1Kz$r#VF$X1mXQr1dmc}13$HmZv2SgKPHALi-w&^IdEz#&
ztngROoVJu_d6Do6ZgA9@=lU6kmq}MlRfT+gHpwWkPlaoSC&|Z$CFap$O>c92B6IS6
zj1ixHgHuXmw}9J(v2+zRnV(d09L7Fo++qDXD88w7TaCWC{iJhC<6iJ_!sqo@j&+-h
z_Q@jcVvtYbhe3Q+3GrWV^lIAq<A1d)K47XQsEK`p6&U;Iigpsavaa84tcF4BhxGf@
zxZ=m6FfIIL!Q_`=j!E5=3X+Fy(?cn3`v)pWFs4>aw)e+RcHH$*X=FTFg4&G5OIjV2
zUIqBnDJ_S`CW0A(&$8AS60Qbur{?h-D;qtoD+++f{rM$SZzD~u226*CG1|+&FLhiI
z+0eg#c~nCLmyFDhq+!bqaF&-@Vz!3W(<VEvGLIVXftP)PFXY&>e0ZUqWWV3U0PkBq
z`&BTrg7#pJzdIOZHij{ILUHJ}u&5~@y-;<4e%}TrX8hZY?jScmz$a~;hj;J)jtuWe
zWd!2aZ=>)5K{GB^qh1UuRQKni32@HWH0K}~Chs{`w`fwFwB}~_j^75eIvs_i)4@=T
zhUe*kS`Z`aveqb8HKJ^}C3oNKWX`83H_E)Bh+`dYQJ{s8*Km=WOMy^%xuVT)gWR!1
z(LrO0QKlW=R(d9n;y>X6q$lgy#D@5Bn5|nrHa|3;(Ht>Qit1oA3K)I1kO$Uq&g_zX
zqOe&o!|*dM?Yeu{ib&R_iMOOqOAa6)*|){Ci*q4h1&qNe(&wJ=6(q8F>leRunqM<?
zUb6W25tF!dIoqv+KZt1ehP|Y?WC)A9`O}S?Rkdzc$#wpDzDvAf@uT<U;kRtXt!4_k
zXEhN^;;`AR>%>j6l>DhOR)2rQ9+}(LHuv<k@FSLI*c~wAynrI}=#h#s$0p`qcwOr*
zckm0jN#txxU)c)2)317QF<y$~J<P1)xN@>F-Qee>n73u5gD&j!wOpTCP)W_EX(J@D
z%wa4O4S0kETMC#2h_#yHE$x3s2!sJ!aYGPUR_neWeO4%v?KF%EE{F=Jz$g=da}wMh
zXcg{0G(rs>G(xfGuHU2p(RklcCF3g4+_mJR`kSm=MF|ji{|)a0^kpWw3-XA?M6r7x
zaB3O-Odi5kvHdIeGgS-9jy#7HUI0`-l^i?_eJVSfq0;T}tUXF@A!Ed4b2_G(DRy>c
z54LgLU;C~#GilSz=EU0Jpw}p`n?aDM5JKJtx|fS#s}$Dt8TPT4lfbL;@Rj$aj5z{1
z+t|DpJ``k=1KNV?sAXdkuXdGnYdv9SDQ?{kNY=9UrSGIE7XzEW`Qz6UeiLzncerA=
zbZ-0mpE5On-sV3nP@OL^2yd&{fs}T|rr_%xtjHOl6{na{&<rjN&Cd(S1J?%ore1ps
zjAZ~`{VNe!wpxJq?3+@qZ_zxak227R)`E6}6Jm^->GFSCcJZpt^4$K{Ld~Wii3D{`
zK*T^Fe*E0^+yphqmQZ+a^!ItwAi^~<F0II41`M=TnMZzltPSH?W0SvQYTfo|)OimM
zu4avMq8+_gpt0rBb@TSw8fM-(rFFZ^W<MxPT%>p|ppn@e;Ei#_MFy;hb^5YWB*%63
z2jSjzNGDN<I?(Ms33FZb$Qt-g6M_#m7;=D67tZ3pP46?%5_eQ~W#Wb-@d;;(O<NlO
z;<;jCLdTuibHV458Gci{`~hX8f*l?Bn@EH-3y8M!2{ekV?lcS+p&T&eE%%NSHWHXs
z3kKp9=^&EMuu}7wf&@~#1GqB{IQKq9<oRqKv@?5?(F|@Z(y9m#?NUe4jld7ZNoBmu
zqyRPXVSHX@X3X9qoVEJfWl@APSbYhhR;W`PMy!j8#qN!t4^6sos^N3bG(V(vOswDi
z+A{0#F_Ew3F;cCHctI|>V!a;AqscAAQ}PB8=SDCp*(OPHBR3Caq|DdVOh_l}AH7mJ
zN+>Cw;%%*p7+i>!cmLIqV2U;keMM;iK&2KDk{2F4+Y<7kOsT_`M(heBEJfb(c;dQM
zBdiX0F_`0_<bP1IF>Oa8>rHW-nBElp_X<-I1LynH#`~uUzW+Ol%;H?v3c(z#yb?6|
z&d#^D7fm=(K$h-q?oqPs+yS=~4)UVw*=TT9oeQ&9YKw@eTwi?M2a@p>(H`m_h?g?4
zE}mMXI(z-wkvOk!8G0~)flGCqx81oQ3%&#5eJ&0a(?p5)>P>rV=lioTxXYW7Rswnz
zJ8OErQR8h-9jX|rh?>a}ON3w#U<_X*Y8eEHFF>m6&f%K`UD@${<jL?vVu_AVUaLLG
z{+E`k(a|kD55=9>6nnF#872@aT-~+23WC(T>AAryB7e^9I+pIDA)mAe5daJ?qD_Br
zLNTf<C$`7WdC)Se)<7yseA8TTm`d!jeBqXI!@SWT!JKpktgTa#d#~FbJ7P04@JP<?
zBvfHl5qp==rr`2uW-OAYByIc?CrpT~=|Y2G-E~tR3yQsqr>;aPiq}Nu3TowTr2LC_
zJywz%c^i_N$`tgIB=SZMv)sTvDvW$dW8ym6+biX^ia_h0HIrvE)X`^Zaj5VQeU7r*
zv4)YMH#rFh3{D!3JP`&c`snWVyR*$uY>b}X@2BUD>9``gL33x=BA3N~aFbOs(q(d1
zmQ8F=?eO@U_`)PQWFe<7CAdXExB4wLS(G_-JPF(h`WtQ`(Xq^hvdi+@fnV-jEFU!o
zb``n@^#G<sB?2ZtuDWd>%S5q(#jx{`Ay6!-{sr+_P$sz8{MKFMZAX#*dLVlI*nKyt
z%2E8-K}f>bQz9K&ul6%Y03z^Z8$sz?C02DOMzmv7rWYQ*g|R}Vf^BB`2~NpNT|N_a
zf2W`h&oNfaxr+Mw`4pwE290;Xxj=73gN!1ZorM`bTTdsKsBe(eZI^@;lOI#&rJ76&
zhtXD|Mksx()E<|{GzX>#i3jvac@SW}fU;uOdYDX#av-g&BSJfb#!l0UJEQOvcbDWI
zWMe<8WK6AoPV=wJ&(o<Mg)Vfz8%n;^>wcUugL!+<)5pyEDLhlAZ!fNeck@A!_qx`{
z`N*Z2DPT5cRm6q}E2wrQlOkHaZzs{)NOzu(#>qFx_UhSbFRL;Kd_O6(qzYQE27`?Z
zB4PHR&vy@UqT!A3t&EHM>W1lX{(h+VLD!ET)M-iPELZueu@YUw<r5iN21$}h-ET>1
zNixfgKeC?8C?A|vAq$c%)3Jt%|A_Wl(Xf;@&X?GlfeV9MBtBB~)}u8$Qx1SOf7zSn
zZTrv_m~p)eSu{55(DkXgJpEgiV4UYFx}4e>Gr>gN$Bm1-BH$3ivJO38RUBGG>NqLy
zCxvbzOv6qwRN9{7BgDNUAvAZFwZZrugGral>&^~8kh`r$B`wCeCyMvRKXEWL5T|!^
zCs~0v1nV!tQR#Yw^D<ed-CNzNf!;0~jT&*JRCoS6Z(luo8h$@7dEMwdJG9GEczGD=
z)J&p0(yYutB_z?{(R_8XR2re+@8H@Y{pDcjdleiq(Q10Up3|pTbu6+Qf>hf_z%0&^
z4ke;Cb0)BY5?b$X*;4q5d9P?8<nU@ws~=t3FII=-I%P=)b>q};8sC3*5E9d$k_w?^
zpH3yPS9gmXjOm<BwAkF5SCWitUJDpAIKgUE6>GTCcoX@{Oz%{>5ynZ&+%t%~=%BZy
zK^*Iq4wk;tqB6gnO<BjELp3-f@9NmLpT5E%cDi-u@ztpLTDoH@nvPzGfGJIIuxl||
zrb9S)^&+m!?3lgG#E`|q^QYJgw3F8}g7<>W&9G$#nr;8d>=DMQF4%sy-rlDI#;%b_
zG%0%??g}c{e+vyl4ab#VY*Osq-ieG_eX-GZMlgP~uOtpOTzu5%L9gjr!1UgcPM6X~
zu%u?+h+2VWVi01ImU+Mb$66vZiut&AbOo!gW3%S~7eoUZUg43+5(gt$`>bMPzL1_^
znmJJp#hdhxYj@4Zc$O8cvQkZ8!VCt1T3>|zvoPD^L5{U}yoJoEobC&?-^N&6jlu07
zG8;Ar!2>(ETZTNQNQz1cwd+VNGeeI1umaU~embHE#zoPDk7$3_{@T@zOw0E<re6@4
zi`?pX;vCHo+{ApMAWX&n5nK&?IW$s-M@h(23@D0b@hO~3ZoX{7Kwm|~TB>m7U+1n&
z^2o-6#awL*=)=B=D9GJuZlEJ%Zzt?2`xOUqxx#16<{U4Z+k{i%FYKve-6wntCXaEQ
zP_cQj>stdVsyd;={O`<>mUurPaH?YufaRhW-v?`e!}prKw}fx-<>fc%gxOHmE1hur
z-)uCW=`ASz{{2rQXF7M?!t~bdlbY<G3vI*@2>gI@I&8jK779~ERO8t9car^D$RmOb
z=Fy(ipA!nCL3Hs6Po-DV*tElYI!i?WF-u{qoKsD4rOgM|n~Gh+SiC-h!;HUyRfB`M
zcn$P|!L=hCOC>%?>Tg6SkkMIam=<V#*-Y647wP?rL#V&a2EA9{%2i|@54)tLfi9>)
zI?z=zaGyXIuEe{Jpx*8v!iVs5A>j-tZKi5=JMpHFCMg4+mdW`__Zz4Fq(7eBBu<DE
zf9H5i3IctYXU}*DeEVrHV5X0@3J|xydREy3lvGTL=uy}))#Uj}SL1K5=04fk9rh2g
zsA3Ju${GcLrRyjgK5qQ_jARHuccu^Tpj7A#NTqFSG5o^jeiTDXRZzKNVolmr?)hyt
zz-!_hF&r-%z7#H0j{*Dz=k)>Hh)EcbEXn1X(t~iZY;JD$A?;PpE{MG>8<5X$sKb8F
zqB}jDcOATfoarSj%zK{z;?s<HmG`WFXmB8YnjwYqU17}@pXg79G~A|ZL|Sp3tEFr3
zZQoMQfwU`JF6e3C6*kT5pfB37@)1m*cz!#iFEZ5$n_Uewp5$>h-5;r;5>T7N&5dQz
zR$aPX-iLswU9p=Fs0pw9RnWbIj@$;{x7ncCJIb)4Yy-bBzcpuY5mAWT>+Na4m0pyg
zQO}4eqHp;>%rx(H&_eB9&^v#6`uB7*-AS{WwZ!r*EsLDlo=6?wgFfv~8O)#$Fs*wM
z2K6Teh%Q;uE5tfZg*9mIhujT!kb`JeOu%9D$N8*A<^#j41K~C&z-2={R*`cDe`#6U
z?J{lbR|@l7NN1-vZOVb!?tFkqJTk!Cci-x0uM+u}oCJm5f|D*e9a!s@2Ga!s(L3Q$
zbW5+kfqDLF?4asi7G?b7ZRW0>*#3MpXPO7n_&jMSkXlCeHL3fFB+}F90F!Qu_h9uV
zy$DCP^szPM!Ifq^bs^wN3a5nd*H7&~;$CwXazdUn{&(lKZGSM=K*pdEO;E3SMYS9B
z05@l}rKst$3jVkw9JdoN>{}!h!^2x`PT>MR#s_@U8-b5{{m-FP*&Ad!@W4_JX`Mpe
z-m1%FUT*GPcMTnf%?#D|7P|{U;*%690Uc=A(3bzs);;RO*Yt_6nv;(tv`K_rU(~aE
z=uu&cWA$_`lz1Pzfs#y2#)xWB`z9VLBhF*uS2Cax-TXX{VfICmQ2z|X7K=YWKPx-t
z63!@bkA+wY5@S|7JA?p}SVYXJu}x{PCO|GkjCr_8dy}*1BrQRxbPrgl|KB*YVYd6D
z5}4=iP0|H#0q~<GCTb24JJIbuv&;JcoQnT?R%zC5yZpM9-ygyv%<Om7F_aq6LT=6d
zDriDHe)Cml{tj(p=|2C4*G*zOM}MI*XnJHp=wNuSE)?%NWd&l+fZs+D0uCxENMs&t
z273ko%td@aRXNYe>2YHzSro(u$SL7VygA5AKi<>GOsSn_$8_nG0sWxWD{EIcr~dcL
zqFuXvA6c0)BKL%f0qQ(QAo&O77z3}9d(FSZ2^D-8t=H#m`|*F8fDxrY;f0f*s!S2}
zBY1O{Ab0evfvxgL`E>@4hYe?J-k6^6|8(Ru)4S**ytHLu3HR;~QR@yd+m7GrB+MXJ
zYgH-ni%~<HL!~w_o*}uw|4s0Y|NjxZ4k6A2NGLpsSsbR>nJ`BhwrpH<zimDvfiGYs
zoTuUxE3d7fI%kDGVS4vg=fRO2&}?wRn}d-pSL{%5GN7-V*^)jSiyZ!d;&M!b73QS5
zml^Y0VS`%{=~c4mk8H5xVxG^myMM(8Ybopx<gReyC{w{371eg#CGT#uq^OM|wot!F
zHXZKqW8H=}GD>4##?gzsbRqjf66sHYWkn#sNE?gW4C@cC(whx2I=U}ho5x3({<0wd
z6Qdd`{!&1>=CGVeOL=d*KN#~bC_C17t(v!sx~)Gq8g2Rd2FC-(KcCf+Tvxdje_5G0
zUQ0UX7mwch=~e~7C+(2(5V|I>M;^Q%gv*hdC*je}Y*P|H!JGi&C!&L<hW6Ga336L|
z0^*4I`(8de8#R|0O?|@elt<qA5qy#O%vnF3z8<n#Cv_hvGl<PmZVQMw{9q=uD);ex
z_YY+7RX}|Kl{V)(W)vi22TYZbpm3_Q(_Y+|B)sx2r&qskPCYw8L_K$Y76s`Ft7_vA
zCO;qTx?2TMeFb9WMHNX#MvCHh{|_L0gkQ7B5+z{3LxiK+;gADe8C1`})!*B5T&d`I
zC$Ssywhu%AI$sQ`Ay~;cl3{m_&^%>eN$I;|40SVAA@f3*tx%`;t-6qZh$qxH<|)TT
z;hu%XyMfA(!3m=(ge_bA*u`ob?~7I`Q{BTf0i3p_F&cRuP3DNd11CL{58CXngZ7(5
zU~k0lOguo`HT!6I&<=5WQMAQ_C_a5snE@8nPRx-e3r$g{F~#a+&h{X0tUYGtnM4nx
z<a{0*_G1hy8dDWhcp&oTJ!@l{&hG~YJwM&K+<pA_l7$qC`1n%_u~HzCUxP+q1hMF8
z*(EhVBCA5n_?juYCI9`MS7V;uDW{G-G@)c>B7I0njQn#a*wsSXM>K)958z4#<!GA{
zLMp>GIp0Lsl3ES=(leXB<o3g!`wY*Y*}gBk7jkDn4N%<WAtNt^_7VG|N0>7e>L(GX
zyBQL4#uI~KJU-^Ij8||Ij@_3TX+V&7N+9!Z0wJS>oh_A(WgnkOTX4yYns#WDiI0+g
zP@Qm6(~kHws{i(WA|8#v7xNa&O;wh3homMwlnDA2j)Tw>_Somk>gXTE8Zdrw)`f73
zS$_XMq9*#MskgkLtyr*g>Rf(%z&%1S;olCl>WyTKMdh^N0lHvCb{If0!Gj-Rta-d!
zD)gYODAZhFx=UtPp{+sbd#ZqaH;d5A#IGxw*(lz9YBeW=vyzH9rkd#P!?={3EUh}&
zRA~D96nZSq;w1U++&<28b>B<9VZGIRVA=CEH2f5%rY{$TKVoXHhWp`!Xeu;OPeGW!
zciHT9^wdRed4-Gm04%`kEmx~yzFt_U+tLi?Ln^ro&3p*+wMw==zT>7bg~uRj|K8AH
zW3TNdk)md?POnazm2g%;)l-xtc~H7Sb%38_qakmcpb2(fGukTGx_($Qg{I<;KH&0$
z&F8r>EyM6-0CwTgA9MY*zP7(uSKnm7O0QN5cwco{;qB=zExM|BFOzue-k%*bI)`&j
z@EiRZk~i45H(dr0-qU%+fAQ0))NF#m!M}BI!kB`%Ng|=Y+j%}w>p>>7b|pv4sv!fX
z8=xZyZk~B^7%!CR&kFJ%#e>bRU5Gt{`Dw|8qXhiT65(K?pCNF+*Z=U+z1YN|%YxHL
zUjS^!-H%bs93RxzNR(Vax?%6;o)O0PztGL^_`kbh3VjJDWct}IfLwDH=Wb+Fp2(Eb
z!-GO6uRbdJd&PP;5tnmqJ&%>|CP@4!Xi^k`po}60hHU~cus@3d4l==W5^?Yg<wK&@
zqxV0%Lr=(LCp2|--W$C~(G%vElG=B>Rx|DAtvGDW574pHx=ZJOTQHM1s<tT(PrFM=
z3)DqBG{GK18GXA~c3Ws>T5ic#ae{0Y2O_p9CKpAM32EhNM+IV(t@V_z9OT&93UjI%
zhvUaqmcOk~yNHc&sC$z!)7IbWgxWVEJ4Kg_jFa#^H<n6W{nnQLnC@dU{zjXDx;w=e
zS$1_Z1x!@;RjtS)Nc+^$kd_uy8pV-R_h&QpX0V74r?;%)=bhM+7TG#7=9uY%egm@e
zRGg^l$*}Hh213}R*SGY9w=NCPYXJ;ex-K(-<K9P}>?;vJJKp+O2|$>!5s9(*zdNOv
zn+VJtZW`-e>z$AB6H*ll8&@nF@$E|oqTX@20x0Ayj_D6{M}cqr8)h!Y9T(wsi%9y9
zzRXw;oZ>79qcz0>-Q6~BAKQ`Zsk<3&BuZBsY-<@Y-tHwR3y192#}&#o6O2awIAI&>
z2TjZ#ZUZZ(x`~;=56202QO$iXirHse1`6_3cdglMPKz4aLu{!VftcZ5vx!3IwRe2<
zcR_p-7k_T__9Bc<mq8(t1c7-fM&3K)JLt}ITjRyPK~bc;C>Y?u7#9k88u!S_6*}}Q
zHDj2LPPeB19%NP2dl;3ThXG=cD>0Dz*9bdw%1kq1MsF{*?m!k*ZJEy`>Bfo|`#&4$
z2qnoi`<Al0^KHMH20Lrq^Z3=sU(O*C;#%w{ihsYBivvS`bIdU&36_`(4^obE0V*vH
zo3VvMF99~MB7h&?$t{*S^iLCAm;t@~Hojo_*NKP!MZI4o8kUp64B`XQE-B4Xry-q`
z*iO~xqi8CL*pqoIU3B4NC)k6r`l`#QfL-E;6F78D7u-necbk!Ha*-fgri;DESZAoH
zoT=szu*&=^k9k2ZwAFe&sBRygJR%cI@PB&&BtT0D!%8nVFHv|V&a!`TwEQhaySM>s
zq4-)*MzvDJMkp*iaBLTd@#rrkOdTi@mS&s{J*nMZ1(v7B#fKVv^<Zf(jAv*g$E<m?
z$UfP1=dG-Mv??d;U&Qt&BSLU@35PV+w7#K8W06*3zjrc?+RM;+t4?#P)_9AZ!1|FL
zLSwVhEes9lZORlOczBV_Irv}XAv=OR>{+lO5+p(GrFqFtN{rpY8(Tx)%q7(YZVVIB
zw3uWAA-z~5QqEwnb8{LDf^5%?O@8~VuFDoYsNQJ^$wr!>a1+Cac^B`@<FgLILdwD!
zL;sLSCA0q)Gw~!Ew>YTB8iJlE#S1E$5m&Pn23JoOcz=R<@xDg;Y^-iX_`<K>ayE)r
zXUc6&y|vzvvbF^!Glr8mS5sTpZYC3ZjJDx4)c=!Ftc0L?OG*j@QCOrA36pW?WIviK
z4YF1~sx~b1U!>;e<eC0nY2<U4PFob>4EjRzlRS9F-!dLkGnItaCwA*&@1+v?YyXE$
zvfc7Z)YywTY5QMTPM7SjBN7^s8$KZr{JYBL0LN;ltswhYYF$G?0VuVSLusX0+#^?i
z#y_`EvYIk;qOR7>;mWIN;dMGDu`Wd>{d8X=9^4y**1{r54-mr?3s3&JF5W)#K!bW(
zKp;)SBgm(72SgG0r!L>Wm}+(+uEKW^=u#WyS>hBvooj9Tj)3bOKz`+f+AW^xee>jt
zOXf}Top_9=WZ#W!!Fm11SJv&Un;o+ZXuSsA8yr=eJ*E<n4F&6hvpbr+1JqgQSpV?-
z&QI?FbufkZ@R)A<>abGrf7sw8vGg#oIAxc%JvZlG&4?78An0wRo=cl-kfPnC`9qg9
zE(j*Av9ga_+>*n>fPIOK*9j(h6`2H63PD3fn<+y<D7jvuB%mDfgrp?gc#Y^3Ve;Iz
z3<K9v#`pvU@aj?HpOo(gDj&9Nh{K*(L`MjP&4{eR-9)&p{aix+Rf?S>1@nUs-<f(w
z|K5MqtJ8IePck~J;;1KN16xb;3gSgfxEv(<8Ym9_3q|~VU8^>^ahvZv@y7PQ6CB$!
z>nGku>j1+0KR+zeT%u7%zN2XUbDbYC2<OxMgN2xT$*{*+f*QB-|J8|l;S4eNzx}6v
zmoei_3XmT}WIj@TiB2Y`8B;b{vud8EBW%T=r8(%KmB4ddt&?c`JmmsJabwT%DidDi
zp~H39SlT=a5{O{@Z8P#2=1ButQR$I3It9%R5@x&Xz?(*r>HdT4a#WDAoJEVGPzgzk
znQ374CS<ShlH*bTjK4<(T_ooACGG|zI~DN;^r7@wGBzAwcKQFQ?7eTw@eG5veaa9p
znmOXYBUgE`AWSsXZ|_U=L3D^UMkpUXw!d<B)z0@s>qm*zQxX>P!jPx8c8MtZ`uFeO
zA2mfE(jh7uE-7O!g@ub)qnMDH>WVAk+;=|k1WgZG7jp4BgEKYQyWOEj(N5^GV7^?z
zmBup_g&9YD`5fH>zi9@YGvjwpYB?=~_SR`(o!SO%U!f=T2Rzn|5$rhcEP>cd`w)qu
zD=%l*MU>OSPlyYTW^B`yv=i5R&{brG)3hw^`7B*c1f)O87#pYkaP2u}@LSpZ1h>4R
z7lJ?U%VBv-@*|<xyGJ{gn8v9G)xs0+?|Rn)fmuB976<kOHCl#k_w`g%gA6%#2Pby1
zxO*g<%0sL;#J>;Df8sqCuq7iuK#j!DFW?9~+iSss5?T?6@2Ln5RwTJec)`JLzmw_s
z(ucMLzT4^h($AQsj5uYlF1g=vJ(AL|i;Gc!8F55tk$EEc4!_$Re<#nxbQIxnsX%4d
z-*aIX#Pb>+>Wu--w2H1FLb3i2SQm);{{-t&aMP^a+XPaq!h_he%a(?fJFv~?(8K*!
zbJ(1?b@tnl25maJHz7u6<QQN7hpY3XPyOAJ!`i(7`;pU|#_&<c*aT1tGo$7C&oIu!
z6Z;M;xPmRvAv`nneqO-my3_ONd^4jy$FC6=<dT8yeq8#eP`}<4-xW{VU~fMo@Sul2
z1*j`7+H<OVdrb6onlkxW?fk)7B{FGaW6gB$_3r@eG=!?b6jXxHaa~_7wPX1w=`G0q
z-1iCzWrsqjPCvF|<mJ&@l&fKw4)$i*-ScrB;1@jrqAqKKXNkNv3l$hrBp-&0R9Qdv
z=B{V_6G%uq+>WI7#H_zbz>F**JmZ{CcF@B%(er8TzY;QBSx<`yxZB5Sl33;$u?RsM
z>I2`X|G$7ULJFw+F{WSyDt&EuAEEzNr`P|+&EyAHgHp%4RQgR#;IMI^45MTRw$yk4
zBAn!2p={7$4squ@o^XH+>nODr2~`XczsE|EqdO;sD9X4zDl?pr?cyeq2o7!l1Axxp
zp){!c8?ANYUe-N7lG;&8RsA$oMTe-e`3k4C{U>p#O9_j%Xzn1!>1gfk)g4*Q*XqIq
z<%-_kq&86aAJv&GKJBsMI6}(e9J~XVNcyL%(sP=3Go|9{86#i0&??ugvneQy6Ra8Y
z>zUhg#&GejyE8O8WwlN|MD2w#0?(a({D42tq_*GN4r=ibJIQ^UT1l2{P=DpEBKoBd
zboM4$|0?`X{IC5!+_c6u>Smj88yTnPt=8_h`h-0ssz2w~LDB3G7xDHhXIBc5>IgzG
zYah@Fr^L{=xT)lmW#%(mz`SFwnR#RvZ@%Y1GyY8cCIl`x8{&ymZw?~Ae^)lN1@R0b
zL#dHO>D=>&q&YBlE;0NRLihGcAW*oRlskkXdtSgCJ+9D>kb<ukA}ari_*?f2SW5c#
zuR0=0n19mFB0!>Nt|)mVt!JNb5gR=oDj70yP3R$N1e18eaomx?AVg|xJP?8tQ@0S{
z-A8Wof1o!C@3<jBt<d*06o@t5E5kBWSjU~q_Q>TXX3a_I1)DW$RUZ*Lk+s}8b=|Du
z*rozI{t#^u7i7q7&y{Y*1&e?#HX%5JeNR^h5Kr5bwD_MkQj0*|R$<x_Z4}KlXqD*x
zR2;0foC0W*YDk``Vn?|Beo-xmQwt$Z<R43|IJ{3Cqpw6kcGtqRe7kI1yZe(MPc&z`
z4bBrhxxb4O+>Wy&XJ5e7fxI3vXgnit_P8cpwgT#CaUr^0?EmVRWjyG$Z9br*hOcsX
z=*U#!yAtn3iTuI_`{d^@688d71yEFRE$FJanON_XSS62y!<#bovQNa}4@wzhlO<w}
zTHkpumwSvY%T2rDVhnw?$^c)gdFVYnIS^T|G^-r(9u!CW4-}oMOj(V1x(7vW2RwbX
zv3l8JlXo+MKJ+m=Qq2k`3MjOlE?9n>Z)uM{)L^nP{OskYP;nDNc)a(JLe|MdI~kp0
z2Srb)R?FW-yIXNNrJ4eJJ(@ZbO~<XJqsPOb?;?Gs`@b{)UyQwFQ(RrRwF@+9+^um4
z?u|DN!QEXOcZcA?-QAs_!Gj0a;1V<tXf#-G4|#d^uJ?R8r|SHHu2ns2tvTno$2Ep<
z@4}z}u{RS{9K~tMDJFfqavCHbCt0QEBPJ<PWGh)@K)*y-ZNk`_J*MNci{38`G_sBk
z$=R35ZoXa_aj_Xo1OdGM)}cs#9JBl^NM#xpbwAk~bM{C4|C2dudO2l*{~U<REkq0k
zz7<@KlzZORB^lYlt^NLe-0PSgAdL_w*UwxY2XZQSc(8+W9OX$B0_1fp>#d@=dITCO
zuL`#OAx25CZ-*ayXGXRpo-c~N7|@@#T>e94bNIB72WvJnz5B<Lfl8Fc448JFs=$)9
zeSoZ>vM;B~8eQo$qvM15MG-SM;o-e%KF)M)9~nkU#&;M7A4y1f<v`(;9si}`c;t>j
zE3@E)l9J#*;#Zm1Y4J3ewI4Yi&xzWiW=0FK{+psmLnlu2b5#Z0i;-0B?g_pj{-@q-
zgv8pP^ZdxA!TYs7lx;|YXdgeyM5T8w4Z~Y_r8xIu@*>tv`+m|UP^)G=V<XAG1po47
z3R2AHS*;tSPvn}8J<37>vA|ZzO6;G@wjes24RPnd^{K$Uc&VBH+Me!(5yug+aK6oB
z`YSci(*21~UhvR}<pm;?9W+I1Mx&k&%0BEccI>3+T1X@vg9E4ZM|}6YZT+5?G!SU@
z!!Nw)>>VlI!8c9!0dBEg#$*;uYvNU84<w-2<(&l_{d8kn*a0N{ryN5A`6C!xC@}ys
zC_p}#NJEizIN~B2&l222%8&2^>pyrc9y|<<6qb<z*+96*H%E;w)&_%rZIl-{8_b|7
zITP?36OAL;b*e?u6_NXHFG9#o&z}{jyyH2krB8FJcz<^<3FI;s+7N@9(*v0@-d3F9
zeaQJT8D7QKn#RY%9fU7LfdXWBc@D&3If%gJK(#|;Zn3Hbb)0<oXihyLfTtx~LoDyp
z$GsGieN!-AbFy1Y-iksXyUAej1SiQlMga9%Wl~Dcu`dQQ-^}_p_HEsWK(|<7p>MQt
zr`IJJ-hJT_P|2QS;U8zrP{+>iD)-t{6OfSKvm)LPh~J6u9CN*#86iq*-m(#@4dKBU
zwen_Eke~2oV)h{c8~%ER-J{Rr&PB@kvW1ffap=4%K9r4a=HsV@1N51zZ*SXX{=Ppd
z+R^I7)SK6Sy}m4bm5Gefc%%VqPsHA6zl3{N6~t0%@N|42=cPVQh%!YLVjS;rQs^wB
zp|nn3$NL~<O#j3nJ1_sw#{&-7X%VQjULkUN{%Av#xtri&{By}|In3#=DIoryR;#ip
zq;i5c-wh+7vo3;|)RID2Ak0;cu$vB366CFXn&dgtGl>xWcm7U&LyQUXsBgKEeDJ0m
zQ|zLL#xleg2|W(jJngxe_zvMj_FhV?1YHqRx+Z+5(%krpf(=B;d9$=do6QYRfuPxK
z7ymD~n&ew8y!b3naSS)dHqWaZqnM^#Fs7l1$P(3{DH$d8zc~5|g{8h)I6r4T%{g{R
zEaE|?c)iR)#SgK&MVo~*f0IKlSxxsL#JMqGKN1?xOtMv0V``W2@O2q_pi)A}@6ldI
zN9}Mg{fY_v?Id}w4{~UyqEOb!bCsoG_Zpz5M=pqK4U6W3_L%x7!#F;;WMrN-_poJ=
zT-kAKY<OL}3FNuq4Rl_0z7OhR3E6KKfmQYpTYr12GSYSL^ad=1z!laX?7(>InN3N7
z-@PSPAL}gK_tG)?Sdl*Gp2I2!G<emdOCJ^BCLX?rL5L%6>2X}}zL@@VHa8X=zQpFz
zk8`{o&|o`X<isU0y-g-4b6x*kN0<A2xS&MnCykJSSVKGs@$Dc@3@b#BeY8F85SvpY
zJUt1)coHR-t>gvT%lPfdV|hUMoaHyga)M>3%_Dyqhio>LB~xJX04_mvH4=Y$jy;s9
zM|fSV6W~RRj)lyTKQ}U&#|>A-4ZX_c3mnWu{GAUv&1%cTRSmjw-64xAg4D40z16V`
z`s5e6suTqr03cBzV**p;Hc$WKqykyeV}hYvc>*-F=s4_eh(0)ednz2tioG2J;P(Na
zlQi_;c$-{X=#8aeZI%4)DHkx_+G|)Y36IPBfbc^FTIQ#I7&s3nO=o1hRbCly|Esbj
zc*^R{6d#`fR}<*~&#=EFjWR?V7$a@c!Cnklvrr$6c(Ua0ACmOTz+3;jZ%T^s^u)i&
zW=QyChH3e2hNAU2xs!sS4snFTN};=)qm^bAt9_v{m0ApmqqI_Lsf7In6uJvau0;CE
z8#(<wrDJCucN4CP27zl`ft)Va?%_5{?tM8DNjxTpZdZ+N#5KvWC5>c`f5{qsP9@Q&
z6!AX9rQ_1>KMOE})t?V0JLOyiPHcHcWwOi+Mtg##+Gu!4C2i~<Kb+G|4VTLlEAF}g
zLDPIe3;70hB=kRsNx`1yedu*$6Tu-2-Z)$gMEyT4Tu1Gq_zPsegFIsf46YL_m);y5
z4>A0ykhW-YDEXSAR!aYS++wV=1-OqP1;ua@m=<6cw1ozSekS|?^i>BqPq}sK{Bxlg
z3leX_fmBbMEVz$O0L>O5)x0Y`oYf?gYS*SO`NH{g9bY-=RoVW0yKIVvmEtr7TQ`fB
zxNnq&;?O7fEL_XKa~lO<=3lP*I6{dDL1S+GfnxyKd?MffXtp5!fL+9-Nw}#<36QwW
zRE+t+Xb3h44;YEy+WuxpM0V>PH`V8Vk9i^pj!fgv&jBD2B|?Z6E`P=V#C}7fc9I}w
zko5~E0orEQoHgU40u;9u?@uDOKi!f84S#4UbhjcNfjW9;c5V=V{1pOz7CK~a0`=;x
zR*=_p?~x(Jsocmez<!$D{;IUmy20E(!L<;224%aks=`@W<EAO4Cv$xCW_LS;kf|0g
zH@o(t=w+it=qVXBp9notd|f?2#_mNZs?pvTEoXc_u)<|7gf*<6Q8b_>rM$!7{rJVK
zQ0wJCiEdFoxW0|kSM({=z3Zxg;4{Xz!w^2zxm{83{jFak8=|0yhI-!mh=tjmOb!7o
zWK$l(Z?0`%EMzZZx6wulKW;4FCD}tC+lhLZW%dd4ud4u}*#C6Dezr#{;VJEi?E@M5
z^t=2cxZ#@t@j8_ESXN-<4RFA!<t5zb#Oxmi?x}(s6=aGy<!AZRpx$&f@9L`H>9eA?
zxWT%!Bp#aoWzaVG$oa^i{||x&5C$7<PhW?<9h4?XgAM_NTW{sP^#uv7iEuF?9lMP2
zyU1ay&}|9ZGH|%rXz10sX%q%avg>ve{FCuMKl{-(s}i?L5640be?h)zfKh?+b0sYv
z#2d=FW4`j2O9j?9XErFYT@z_(+qrN)S_?8ul|TUL{^BwsV3tO3K$*MiIKmGk9|E5k
zIhnHR_~kZbayeaW4uyP(qwA$IIcxh#K9Nbr9MnTk|8g<);dIBO+p|@2+uW1#2jW*=
zPOJB8o)%`g0+<*Tx%<Dl>a{7|?mA1gWvXQ-bmOefG@7p=JDXpIqu9CoQ8wA0Y?Dx3
zgJ=bdQ2q}6jnXsQZIA16r<Xl0%p}&AD$)(z41k2Rib#F5LDyGk%rb&;pkM5DEeoXj
zA#*|m2>O1X9ytG`Ym?iy#kIY!P~&9_^x!%8O!M>nQ@U$=f#>ses;4jazmqiAmVg54
zuV32=6Pt7f<unm#33$UkB&}iC42f-ReyJ~dpgMboD3s#ee@Lljck=X$b<5aHj8_c6
z|D&*bG0p43B%&o0xw!hH(1LZ?nOc(;oP)TK3(Y?`4lDilhBqh~F}RkfF5Sayd2p->
z?}mX0PN?!WNR<>q@YUQOsH=xN&Z9K&n$Jf@!WlnG?>7m{!~!1NCXXCyhXOkPt~++1
z6f74H2Eire=`kdfVE1ApML?-1Hvb2H>uT(O&v%*%*%0y26FoME{7S$R9+udE9nQQ9
zyl_iVDa<GIbxZURy%1o7TV{bF110cyhXeq_JB;c7f6+IArw(D45l%QL`u1cmb;vt3
z3K=@>m<%josdo`g<3Bp7BqQEFSH$wcC@2j&=E8ZC^ZY}rtY>d$w?c}=ncxbq5u<(5
zK~fp{7(TxF87o&xb2C`0qKIc1`+PU$r<W!Z(&ae*rbWY=K9UE=etC(=;eF$Hd6KN*
z>W5ON%8}@?8oa_6HjcUvO>fG@Ti87n3av;|h_-j(kF&Gx<J0-wqkrD&bI%u}8>}nB
zFUtXAhm?3@kkOyR7P>;8P>B8$bZoD@{cDjJ@d$HYtpO6Jm^wuPn>I+Qj6I>p2?|tx
zRCkJ`>iSb={;kHi&$|WeWc~ea(0{a)ZuyD9oKxOPuC6$<<VY0TZo@ego)@Gub}Ao5
zkFwuHB7PCq)f7s|!r)hoL0@_}H*7!&IoQazhnSXPm5&+~iS6oP*R6k$tns0fv~q`l
z0K5m!k%hM16I=5Rks{nhZ(%Fl0(azB1Z|8u6*{1PVvSDyn>%iUiEe|1L-SY;IKT_E
z#co#jcIV_y?LRnQ85aIdzgWTKKFrbJ%|||a$_cD2xaB+Gg<>LC|0_f2&!Z33Xf<$c
zV)W01zl1eU&z`p~`+YWD1JM)uMWvCMX$Wfxg_cY>RNIa5h6cNeB?07;($mlMs%|>P
z{O)gj`ksopL7c}?&Q>4-rSlI5vD;oovC{x}7;uCVjKPZP6Fs}z{Z|<iS1G_UdULG{
zCP5wG9)nY0kYyk4`lb_lD2RI`yK1(5wQc*-<{;>iX$Ac$|7p>NyP%Z{EAyiGJU6_k
ztv(F)qBYiBcnoi=Xvxh0{=Gwbh<3d!Cm6;Pm|i3Hi~e(`Iiyyrc3XDKR>>yE9Ms#{
znIM2FOW~G|c=-PL^pWviJm(PBx*bT48|`~Y{ny8?z-0bSHq2}PL7yV&$A02U_V?6a
zY+^eZg)(&))Zl3;CDpe>$v4FlmlWS-|F2?0CT&EQ2sKCXNdC|z<MqQnmZ)RHDOcTk
z5DFC$^qlV;cNA0Mf3P?or#CE4NA5o?4tGr2gk4pu0}r^>c(wd60PU4Wnz<qU^34gG
z56_Yh`eOa_QU=zIHe4|I=D$2MqqQrO0+3mQAXh_K*KmqmcG$D~p=ocq>H{wMSG^Jp
zcHua2(n;x`j<poWL+pe3P}9kwHPPAG3KPdk5ue`vOdF<<rB)k@f)Ua&P}R_sq@)ig
zgjA#<x}wFXl6e)>i@{AW?X0don#|DEkSo_fJv}6Nuot*gu#RNYOWo;Dd`0Q??I@e#
zOQz(nL}ozRat%CH#E!vHs;2Hw#_t4QZ`8o7@b+;XkjbZ<2QI#F@$afB{V0lN-CGdo
zfo#k2vd2)aJJ0$A+{Vi-wTi2q+cdyTL^ypXswLvl?9BZnRP+_pYnki^WxvWl!_9<3
zL~AA=2a{_36I<8cfY79ta(om|#Wy~-L1=g0Jg2WYF32(I*C=D4C?CESDCeUa6n!R1
zaU=53tFpZ!(EjP4mtvo~U=6Hw7)$m|)>}r7I!K4Sjel@mNI&;L5ou<K-1y+a?*G~R
z5rK1LioN^Oo3m%ChAp3pPe;QnfsV{*2E+%KF;X#R6X1+snVNFbV@qq@@G9zXzNa#i
z;)+!ulxW@~_5P#VckFv`lOysth2sCw{^QJzr>?H{if3K*Z)z7KGHH_UEGBy%i@62x
z^&_S|1eKok@3wiq|M@K)=E{k;0uF-{2VqO1hRU)l(KfylL3g@X@EIv#omcBZwURHC
z{eYLG0YO#-&gd;=O~Q&LDPSlxx;4n%`TG4*bAHcN7_o(R78iID&hRD<KND?}BN=3%
zL@4?%gdw^T6(Q>O!Sx7?%hGwme(8VlQ(;!rT)4k~uWSGt{&h1rJQ@??Kjt>J#hR%{
z-(x%nsWKU<(jBp<-HXwupYStx3L(5Zg-j<=sLwYR`pW7TNv=(HYrY!|>rg@*^%jcb
zXxX4lyOTzvyh<AGq!wdta6rkvnSI}|c)kZMiG01Q!~TXdd<l%?%y^a{k2mx&Yh?&&
zmpfHi9~>TI>;C*gphW_T2KM{~?MrBL9r=xMfAK4t(Q>ki6LG)@%*OJJ-5lKJC3~(k
zuv<(%z_R-ZiaeV}=l<3O_4;itjKDBW%I~~V9OP>WsMr+WIGPzn+|q*$FnCbkJ=iFs
zj3PbDef{=s7puwF74kqT8p+>?Tdj*R{3w;CQ068+OqzfsO}5hpku8jzgKo(zaJs+@
zg`d=1(Yy=j^!b6)w%9T}XXI1-!Pb7==HFJ1*m=~Q_&b#4;%NmbySrIkB=iynjBV@0
zOK$1P2tK{U>7I}c$$80ZS<Z0n;i@nogloRxdu0FNdnJ(lT?6s_SY_eXj?9#`&_YVV
zImEtf(>skd0}Q(M62jlf2XIaAqh0-EsG_4|5L1fh#LX7o8P$R{Fdvc8l3GyfxqUsc
zWue-(6D+UgER;4!ZgT7y1EtpVJ`A#l`v7CD3?!s#%uj3^&ZU?8vo1h#ocPD=w2@~x
z9ywy>^$eikf_NOexm=iNBqx8OukPpbI+~r0_w#%CZS7*{ZfiO?G+aR05baUIE*HaQ
z5(F8ur%a#GV0-ZajPE<!<&oDGUhIDSvX7TP^&CeRQLfW-^IH##{w~W;_Tg_9gDNAo
z7!CILza~$^D$UzsC!A#y2UoZKHx1FTm^(h*od^XE>k{EKl5GhrGOO8{Ws?*?sdQsj
zeGBc;Cd{?&+tl!{FB@jW_f9Xpnb@$|i-+%_wv?f2OLleHf%z{4Uj3%)ZXg0H5vvt}
z!#O_=1oH~mEVO^?w*U=YG#mf&n>Wd*>;zWbihM{S4&2<Np0sA&BR5(Wjy8$EqxCx_
z7luZClB>5@`?ivT`R5u^Y<F5n*uD|L6EkN0Fm1?uCtI#SM-zXhF1M<PvbYUbKQX5N
zX!#FO^>Lw5y8ADl@RdXyJg#7M!6JJB{qOHsSgt>|Q6vFW7{a!2u^%NJ;$!>FtGI~;
zw2(QIp_xY5KqM;iWVKR&#lpC(p0CtwDOo>~6lK?T8JzF?xJYRMamB}C*+QO~6zkI@
zUgmW8Rrifg)9=mjnD5+|oUZraUqE7c+r$iI1;kF<=5e1g|GCXc(aX!3zsmpuzl6*$
zb;4*<bo$Ga8XRTI^d|P(tceohtZBc38;nP>+OqFoL9GIov4LS3-EqXIACo9X(upu)
zg6Ib$L*&xqUPF5E$OS7NHpJ%NM;QDf!dNf2U>%`BRdvp5+{k$*c>ZJlda%-2m|Lty
zd3hQahp4sE8-K=WKV^SIvTu&gWn`k=x)I6QVZGFFPgp-+JzxJJ1Nb=#SoQpsPgKP6
z+~m7C=`HTZ`O1&8O_^n@-RQa-Fj1rWuL~bZKd2n+>9F`h9I+x9ruzlQ(1&`Yhe13B
z(O9U&dGt;!)T8wA%lT`j+1KV9Se<Q$)tUKSSY;W#Fwtq=Imx1Zw!WwUWnQb+BUNAQ
z_bywXJIHB=3#;#3>8uBYKo*U+@5spK^fT2y*M0il^Jy}*6sVEe+Tg5tt+5m`z92B~
zm>4FtN^2!m0hgLO5FN%-;SdZ{5_Ppw14g}QAcS#19rMd$vMx#_$bNqx%7M(3pD2-0
z^$trG`OMF+mA)UpsBu7nFQuYGRu{JcMKi{atCncH5~vL(*F(?*$5$uc8H$fzpiziZ
zh%#3q;3A1&KJ-)meE$h1H5AHCRyR~Od(A5bFQ#Nwtuv{U;*V<c8NH=$kAEoKtWPVF
z`WF&+gNhZJ+I%g~oD#s3atOfNnNAbe(CKmdRoNtoOkC0u&H{cUM`t|B;DX0%=!R+|
z&|o|h8XrtG+*?gogWJL$$2Hw7O6we^&ZxAbq2DdykFhgKY?&6~Ebkd!w8+=FX)$z;
zSE%-sop|jcgYwRrOHe_}c9Md(;jt;Wts`+aRE%osir-?zxaa)Ok`WW>cL6&bXYARY
zL69JQol$3<ro0ws25{6Auth{5Sl;?A@e_(*D)`S(xX55zTwBzNi>=Nim!*$U#lhB0
zPQIw;Me-`T<ms-EP|)1;y%%MFK)Hv04%V;${D#52QE59E$ko=_$VU4DW!f5a<bF%D
z-|7T1PuZ2jH`MO`kYIca!~S*HjVQ9Zp7$ycxV=l6+TuO5%-Q?V)fbjUb%8B+BP42v
zpm?Yykwsz_zRb93@X0IzFc$>+h<jmezp}~-FEyfr5?mF^DUrO1XUHI)yI^&?Phzmm
zor9hHhV+qCzA&-Blt>#D6nkTc{%+2QZHKWkeVC_GVjb3?*8KdQc5qPEb^-j8nH63@
z60nU<Ve_`_0#^3I_@j<k3LJI}8&w3h!^WEWF@wS40?E~(Qh*-jOn-!8CLSR<Fa_Vu
zs;T9kx4DB+z-3`a$BJt{To=*L;(cOEeU^2LI(X*y#xW9$f|*|AYfSIQei>-7rGMr}
z8xxSstvrASLo6D-YL<J!S5TdyGJ0nr@eLRH-^jahTsd7AF<)+x+%)3Cxe)v*Gi$uU
zVIM~Y@iL!3MD9(!&5{CdY+~441I1L-S|$$gEfj601V>9<MhSAgc%OTOZZza$ePi!i
zBc$A1c2O4NMEV<}Ks;(Lq^t&wdb(<M#S8s63&Bre_VdEa_X*A<fYZ_uv>~!QhKH>|
z;qtr7>Nu4E?21;-iF-^wmmL9*tWg*0i{uT=H^e4$%6%6MG(Qj^;Wkvd08(2?d$98M
z)7HFem3K~AOnaJg<{?p!zBY<)xAH;iE?y3|W8t#p?2F&1U(L<$%($PWaXvgtH}>;u
zYqNDHQn1m*$?qj;baPD<$uGgMN+!m6QMl6};cgp^@UDVdd{T0=I>e_Y<XaURFttRw
zoErk44!L_{V7Nk}4-GJMUf8}r4r%&?!(ZYl8%svLHG#ja?E4R>@=8!~vZ;wF;^2}&
zTrH*XG9Fj>9oI;c@3JczsYl64;AREi{1W(26Ljl@`)&yjX?$e^-vG+o0cN47=W#AP
z5qH3M*6`j#Dl)&;9=lh4I7V02cE`eDwJa?^&4n4E%w62N0AbI@`r%{2$jV6Z4co5Z
ziUV(?D^I3_(zDB4Yikl#`umSg``0MNY{ziDduN7N*$fADYnxdmVo<>ea)tpW`cZid
zhgAZfGP6vlFP!gyYc9%Aoezj{r!Qtr-4IrjR)`Yo@@j$S2tL`IfJvu8vzai#!eZ;p
zIiI54Q0r&t$+;&?Qu8;u5|Bdt2KD;{1Pm>;{WlI~5S@$O)v>AgtsTky3w<g0=}Gk1
zdBuR`Diz%rkK`BneD=7W0>9{sciugNq^7!?s6>u_n-ZY$X*{sh0LIi~J73Nbyvv6>
zH9!BEM=<sZ>|%jAlt<g<yrb<$rf{0gpCl5wE9>rC3$!6RHZ*dH*Emo=s)p$=28+l!
zFE{voT>4bBG?8CEPWL6{m8zG%F~XdZYit?ln5LnVW?>TPmct9rwfjcaWMe7HK5A4S
zBN|w9ELA>=oZ19j_0BIX)z!1LkmOUpYk8iecy4hz%h@!~MaRhCj^pEXBf)7?1O~z&
zmj7re;AGPf2Ip`v<`J_3hHIgzQJ#eT3Q@hnv259kK;6e;nnw+?!MWXJ;b8#)mZjMD
zDSd=kpIlCY<ht$Ts1{I6ru4pDsbYS5_#BLmB)>vwKJ)#;hjDP-%be42(E}<f$;HfE
zf>f1b2e!!Ig-+{+1CkA}?xCr(^%z~ZKK3o+AOy2U8;LQHWxPEWl+L+YJ~Xam2%DmS
z&JW3KI{kuSMTp-Zv^DFkSW0t(f+)33)qbEymU+WDhi1Lg@8=S*F(0rDxHRWRR9y{&
zKJ|IiMkUXDSf|WhJyQ7_^8rJbYm~MP2c}tm4)1)b|ALpqubAJDB|%IOrvS(RGGk1M
zW6X`28yTCMw0le^hmV01X=o@b9DiB{_UBtKP&mrc=<;|^=L`Yv1nx31Hsl)LMPitf
zG}~;8)Wr%1@@~7xTv}7&N#~K?0ru|N^3E_Yl})jHglb5TJ${z{)33+~vNvMzt&EBM
za>n`E6p_j+W7=R<p$Xq8X5L}tR`ZSzx)4KzT*Uo*RdpbXJj176Q~0!~ycR%Z3>_JI
z%MxV4eER*>czK>6LCfSyP#pX&nJztfJlh~wUNs^^qnPHcF?E1O*|V4p%60@N8mlRa
zqFDOiZfy#^LYT|YkjA43_bL}=>k5@2F>~F{9tlwoO`5tDfa8TNLK3CL%v4P~oGuO<
zS$-WZY1kxH@LTLIXf^HD!WZf3lg|!>IzKc=KR`zuuQFhJ<DL-tE!y5JD)ObD0@q&(
zYbQ@46n2Hj<w?y;!Z{P%Tfnhsv>7Giy2f4>xkItWu?{sM_wYJE%J4H`%;1BbqNzOx
zHqBGbOV|ApBA{7(Et%3VrO8brhe1MdT1k&S6+^91hHN@0*m$Oe+PI^oc&5!ITRZ>#
zuu_*QhWrgq&ZPB|zN4XSBjhTIl%D@~JptYt`-0CY!2LzkM@OFpqe{de;p$(By;Pw1
zG6Q<XeQ?gmtBmIT_>{<fq}FoX$7w}@@m^jV7(9e%%;3wwG3VI%cQ#seO;7{_J<)T%
z)$2<KO;J)r{c5Rqly2&Td~bxAMfx{^;f{XJS@gkICtOlWLN<e=>%tBrvV#1fMY$0>
zJ(8pHfA-6>QVrXq)jj0AHs?K%Pc~#+JkuV2ETj&8q6XycpP<u2l3qoUR)%%MnVcRQ
zNQ6iyQn<IHkN&vx`f5CpJoR4mS{|&^zp7)Fx_2aPgw-pxgtUkgm<k8tS^6d4u8X(P
z@6?I$NKP}uCHgh95Y$s3prcOUthS?#xc8(F!FBUUI6dm#JIXmrc){i}T*6Nkl`jKf
zKp#8ND{RyBsGd@bf$?#`T2eTJM@n$CJ7GV5=r#iCP&TAqTMup7n5O4qguem<<BAY1
z1y;4a9YbkTU+~IfS44k)L`CTtaQ(RR9o{AWtwx-BOA6~bq0CR~?Ow7r2Nwoz2z#XB
zE>_2U;!5r0)T2xxbs&%_V|p*MYf7fFkQh`q;_{wMHS71}g@K<BHJa8mX|5$G?FeF>
zd*_=CcHr7d!<jhnm&_G+Q^z}rT8T?hGM6n6k9DdD`S0bFDThBeiX&um2e7=Idg#;*
zuM*@KElwPwruwC`JHz_yUF>|&uYs6Iz(!PNjP%bT63R+e;mv+Vgu{=X<zr(+frbPQ
zSW~rRz*bBq#n;%G=Bf}0-ePyp{S!~a?w$1TGy=mXwk9`PL*2?j?nc+?Q0+U}dOKJ2
z)b#~wcH6RVX`Yyl>8GShxiHov=**m2uXz`Yx6y5yI*iy?pyPm5xPAcd(~hAQVz^4k
zl=+N)IC5My$W^(dpZXN|Hs2mj(Lo%E1KME11q{w1^b<G{C~-xrFn=PU-z+))Qy#Ny
zL$Af>!9{z&@-@v_@+9DI<!E4-ufoV;AO#Y1=}N&C_OOg=MDXk6sK`wkO1u)hV%H!)
zjkb=Wa{Y5!GrwNj@R(EFp)}|^!;#q0!MLF8<~FR7dxQ1i#ClYD)QrFCYk3{}4?`ox
zsb<{Y_KZS)7c^)>f9r-ax4y#!7zLF;KfA#!X!rf?Z}THOMZ$HWpH4-5dC|3n`}@pI
z{?b<Gzvtwsg|<)H`|o|Cs3_=8`CV?8>wC_v@2l{<19yrwk@X^ST#4&~49Nsd?ETU3
zX3Z%#m)EsS$!e$GR<AO|y!&eA{U1&l2HlDL${XtCAd7!`TxGyL60c7~i;bCru4EJ|
zK>H)XSQo6}zY)_H_M@~tl~;i(vU=$c-*8OAY@X?2zxIzIwAti}i3Q1_(PY1+$}J_1
zeXswjWd-^MG`OK#o{eW14uVGtJxW=v$~rc2e_De@?b#yX9T=PDabyhD`u`r~MY^73
zB(>03;gzxIusIdH?_jn%a#t7Amz6IV!Vc~p`7#z0<vsM*=5*T$kBD{|jf5qVtG@A#
zj(it;Hw!ZS$I?y9V;N8PmXuvo1Ky57a@+2*^=7{!B7bnmL%j-JL6-{iJc?}~dOwZm
zhNy_50FGuPe?RO2hdmWzpr?f2FxYqtfF7yA4bEwspblp}6|)!(ZpZeuB~fA7F>wrv
zlMq?d{Awe)kQb1Fl9bgpI%VQwHygSz#On#q$G;@-kcaAG{CLD&)uy#h2G(g<{iwAo
z*{I;3UKORLo8H!W)~N2PzT*)b2`)9k7*c!d>-xqCI<97|9xiY{r<i>vTtpiEW?<Mb
z!AZu{mDR1E2)VSr!fmI3)&fkvV%*g@UCUd2>6t$ACNSmdH250*ambX#!sw!@gk{1{
zrk*ABhaLZGu9;i2tz}BY<shZy-PGsrdUj^QyyAdt=K?5FZk@x*q%}^Stpr_BFTXa{
zHoa58uEdU!|H$Uysj`A_ovmp%h?}B+)F~HSKYjN%$yZLaY50!FBs9yzsk;O^p>s)G
z5BzL%(yY7mSRXxYXI|ORTl#TR`p>o;(jT*Bz$-bhh~rkZ@8iU%NTnyYh{HmML%YS}
z3*QBI{&Rm9euLTaJlvU8(>LO>FaPBDw~-8K+Z0ZdkSm8mF>wV6^8cqKcH01H1<q#8
z)QTz+>7_qojB^DvBGpImX(zept;*)}JCAPW9VQ?YW>y|A{oV+GoxVLh5FWrRl`E#q
zk6(#F@z87^#$hsC1|dK+5*H=_A|)&B4P~Q?W10E?MD3ajrq@|U)pN-MR&23H--MH#
zRP&40%DBzXE(*r8>JU%qk=06hN&0KJWK=s~+*|~#Vg!S0ZiT)E2I^-ob=B67*yRkg
z>z8~nxOTO0RW+2Z`jWLd%7rykvCKw_c3;e^Ps9J-fY7N9_lH=i{S)KAhXR7&7(Nq)
zw6^UVd47UowR-1P)W1xKGF2$tW21sjn{WH-)pM3HmL%VzonsoK7|FIeo>$R3RWiy*
zYPk`MwI9JhXk4n6n%o$z)T5pKQrwdJ0K}=iQme-{ULxZyJi@}$u{0GVZ`NQ>#v~)s
z`OW@VyfLz81fjx&(>#~3A-TBLbhlMYvu|dk7>_WDp;gC?<IoY&Ukp28^<0iCo~c`D
z295+ZJi)-8jDxf%lXcb;T{C-=C&BoES8r34A9Iz3%Y<bB1y2n#m19|xNJiz`jSm2l
zEF~MwKL&9Dv~HBXll9N}dxd<($Ln8%*3;E$hoDEZ8*v2TZlO)_)baedYxJRQ)m-%N
zCkZF?Csrw&gpOG~7u2yX-v(vyT<6VBh@R0%M8XR{pp5xf@0El*m;xWtK6BfV4afAp
zyY`%?nt=~<L}fxigix`6HUi)#w%A6y)!-kc$a>NhAL*qoG8FLa;9(`EOOg}^T<pV1
zrE$B#BFH>CIte^0;fvxYHM4a+qTpxfw@m0A&fAK-#zD!pnU^QmH3&o4H84(1-Z=+0
zmYMdKY8o_LL+}q^C+=7KGx}Z`Rls1}f{BNlDjcEICfp-Uf&u@A@~cjVj{BeJGMri2
zpE^etxsjq@h_0GDY-)@bbvxm=Oh$Gk`RDCP(B@p3=cU(19ZqA1oX7}IMGXpou)woY
zHM(MrF`G-i7`BV*rX_}W9A|c!{<m%M=1a)x`ZN6^2YkaeO3Jz5E$!|D@JFO3N|YV8
z$|EL&Qj9=H&f;n0!7V3=Jh)M1UGy3+&BJ~}4qY~8x^tBleGK<_ZqE^Y`BM9(v(1=j
z!@KEXwmrpckZ;;q;yP59DQrocAyDI_W(ktvB{3}oaWM-dpj*CPo$Y7|omTes8Ok$}
zQ^(Bel_GndGHAFp!%VdDpxeL-oZ`a7|9Yx{*^t=$*}@3CSn`F=mID-~zXFf(RzAbU
z$Zj*dL=E^N9JGHCtDFkisffd0)3rL$+Ik;YFHl_al3$`sM&(P3WH+cz<}-(r%-@&E
zsT-rP9bcS3BDI1Yj8i-q&Gf*WjY!01>;WvVOQ+}%)KVirG=Yr~&v|_Z1oT9WVD+GO
zEd>MnI@&pETEiCm2eNK;&_EsA^6ieFtns~Hbr#8JPAtbpY(Kmsi}eH6|Fa4S*~D;`
z!<w^b`)nZ^hW>met-3&gXrD{B4B-dv`Z{8S@SXVYuZbU=wI7bE*G+8NN_W_|>yvux
zn|Iiyj6&cOz?{XTrOwLDZxJl_Qx6m@`QItf-m@)_EfY0AvT2<Ay{MZ$?yWvqyO`F;
z=SmHwt(G@-C7xwHsct3#p?Om|5R-d0V?WA5BVJ>z5-V|lg?>oYG_E7@oLky^TO7hl
z-ytTKrXmoAE|VqX=g60P?or)57uKdnL7S71O^_AVNpRI-skQ&%va-r(NX1mdDg67L
z2h_m7e7IkuI^&7d56jX!^RBczs)5bjD^+Vev5GB;%=r_%HtdC`!avz73+6uBbHE^~
zvDaF}Vc&AIhU~R+N!d*oZC=7t{GxZ7DS6u0^@J!eBA5c@l}i9W*1lQ&4fa4$p=+z!
zmMn*8bKbk^yEE5QmJjj8?C=?4_{F_f%010MeNLrS)C7H46?5`{{p_`usFWm;B@=gu
zw7kUqwBz~(e6z!$-*JG=HaJ*`zP&8*rcgxUtAB_F$HPab0wosU@TE*J_W_i<bw{bH
zNNzAJipycUZe*BLoDXJj3v6JAB<R9sGP<i3QqsDL+O-_4TIE=3!(9!@X*S$*k?>Tm
z?nZB!+J)O@Goz%nfvVA177i}k`i5ErB@?UHOjm{2%hh_?$+AtwAF6)4WpB1o9)4bP
z^Ijzo%&k~f10!7Hbgtcze5VQ?Kn-h&pN^ZB`)!I-D46OsV6y3v8*#UqpaQa7qgm}K
z{qkqriyKp!mrVx=O0@P&@qIWjQP8A$^{Hr3<WH~>d8`9T=_2x#Ze%qk*|^L7dK_nY
zb2;8BN?yPE*bDfTweEtdEkOtd7n&@Y>OitNs<4#EQ!MHdzg`t*F2<g_cTxpjL}hZ>
z#rMo%qvvnY-#qr7BA-9wy|h5_5$A_eZZ}~iuLlHf^*r`kH^zOYBg-6iq-+{q=A4oT
zr(ZIQm<+WXx=lxgInI9CkU`jOe2ahTvGvxCr1Kc56vCL3-n*V+(jRL9Kok0ZB1WZf
z9Wpj0THrP@B~K@<^5?bm=}S-7GvB9^EHDrH0~T{uN=*)4azEXrwr7~pmHTRs?>TG*
zDVQx0pe!2<RhM%Cxhd3wMnmY@60M#1wGp$JNGk35WQ`}OBL1e-4D#BszH+{d0*M!q
zEri|?VPovHBp||3K;}XPerurH!JraYXr>*dNECJm6?linmAJ8)sMN`r?-2#!K!fVo
z$nNwMWUvTHVYtMLkxIEF2lW2ZAMt&{K_y|raK0UpK$}D@c3W*jnQYuA1P6j1`_N3^
z!NL_;9uZoz4~L^r`YigSKO^5ue*rst_|Vl0sR_Ex7rz3Rcw1*z1+4uIZb2#TJixIP
zypzSr&QfwINf5!WLZc11g9euc`rzs^{dkVEEO(i${BMucc%MK=0g%R3&V0nL8X;Lj
zIE+!``Z&KG2-lE+^rw<;;y0iRvyCE>X$1SlaD*+8$>;<P1s<PUv;P#{ogU?lkZ_4_
zjTrPtN)oc$PymPGM#K8_V3@<v5R2JJ^+G@TkKm7ezx58zd?5*fCr>t22mT!1Jm?&r
zyC+6>=RW{L5XGYc*CGMpA>#H`l~AN8VWlDqL)diTw|=YrFi*c-1{K39n?;}Gb4^q2
zyQ+}auKa^Q0*?oQwvS-o&u06a#k~ZHN)YA390e!v+2{+83U`b5ktlCpEw?7eW=7ZT
zI5YW2*%p4s&xG;s;9OST2rm%{p<Glikr2mBt~T>ew5-nzYj)AYzo%gNp2#={YPs(M
z=aq76h-@wfs97lpZ+sB5$ifFwgb8l~>|UoJ;;E7;pSjgaXDmZI&Pj5DTj4n0#6CGY
zwLy<*2~pc<_EF<t$OATq3E>UG_eEWv7^I{@<~|sqUhoH+C{)Ir#g}c}xe8z@!mVJJ
z$ltNm-GmX1$l^^~pMIKEAJz59Uwkn`M?C&*+5ms)X$D^%`fD`OSYhLuh7XjPz`BvK
zt_3DZFPs9{$LOq-5%E#WhRgm1>MxPDDH29g!|X|X{SNH;oY5Iro{MnC;1?(R7@WCp
zx4x;lU&q4lgInXU0RWyu!^PE{=P{PXa}mp}ekI)C%=PK-rmX%ym-|~dxW(o*v!VRU
z(J?5sfCJ)#+f7Pj^xmo<jw?Z;zS8NT=m)--O_sfWxa7_50YxphDjqN`#_)I3SyqFl
z<K54X1b^k%54-fsRtGQ}<C$Dm(Nk{W6o16GW(F#(_%xhg&fc}AKMI<3`fSb=2ysjm
z5dFG3NgfoRgQ-DxL)c!XWvnA1X)%|B%lICLGwmn7&iH2RUsrn~?Nmmd#jppMOT*^H
zQT|e2|5RBfn0}6cxHxKwA23{>g~%Jxq^mF5Q(RnJpY8qxk%{~|@n4X^)pq;Bv;B0f
zQr;rS8IgHVL$@@^)LN;H=w)m@X#Q*_5|beBFe5?8Dw<r9bx7kLr+>KiE#|BV$JC{)
z+Kk7aa0hEcBAbTyB30tjtx3xxn2tgmep?=ATLPe#KWH>$dYQk|fVC7Ob~&f?$dYtg
zKB(SPB5O_|7bGPWjV$|iEGHB1$k)c6Vba`5p%k{IhOFdwj*hd?F;WPIb7F=eDZ_h0
z!VUKtgqg#xv=2pj`(a(y_~&VQS!-pLT%!!a*k1-M{VT7ue$jN5>z3$}fWm=4L5^_=
zSM+|j8eDqK(eOv0T~Qxl9%9jsk3(v}KLeS{e^I*j6T+p@h}KG7ONj9pPDQ!qg4HEh
zFdkqN*gVPYgXCHy&(bQn67T)0HyX|OlP*iSP_Yzt2{!*%eN_4Z=Z!VGFcNn*O~O4m
z!@Wy1y5k1lwqo8>B(x$NdAV@on%~ZOaD9AH{>|C+&7jcC+usu|IHsN%m@J4U0>5F`
z#Me*L8~Wd`X<$q>Uor-5M0uf6rkt23^qZ?80T7}2+VE>^oy*%2f^7=*0{!p-kIps=
z{puz&+bM~gnwLx>mq?Y_St{a>Y}u0v**=(8$yqc}OK)H(wm1+{84jf-TaaHwZYY$q
zxr$}-;o33)Bf;QM(KkzlVGZ0p{dgi*Uw2&?3DT?KNfP_$<DttkCD2nAvVEHqWPiaZ
z{@g#4vAVhB2Qd?P6b;0^|G?ViZ%?ZZXyQvZWyrQszNOd(;GB|@iL6cbA~|n!{n4iX
z#M-t>>Da{P2t@Jh#qq)T74LLMWIC%GfFa4bxD&rL-{DNh6~WF40Q&<h5D&HtX8F8k
zsqtOZf}Gr&7ayW>ah|th=q{Or1f}Eh&3!;4L;gb#+XRki0hiW!)I}G*Fz{ZL4=Xo`
zTEWEn>uP2#W6>UkVMsU8)N{%Q0bgXEItqciSKdw}e$3(CmeCmO$wG<Hqai~FtqeW8
zg6kq)!}X>pPd;6J+h;Ux-2pIJfgr47Ltw<6(}LIh6LgDbxEnVKYO-@E%rMo$8O|S0
zm?M$LAI_+}6zQo^FHG?DoVTA0q^5jQIGF5_UHlq|lb1AABqlba{T+Lt#?o_Xu!Opo
zfS_G0W^2HzvC38suu5*;!PTb7u%Ex%yMCuOGgjnoOIQt#igx)kddq6~?$Wh!xsS->
zXx*PU=*aVp*IF_Q-b{;t*et~8=GGSkkD!4p2gZi@y)AEzi62KMLj{~h+%l)}1?LXY
zqxqp1QY;Bs%9)->IE!E3P$2#IIN}kqfN(1E{pdn`3w3s?-*6qcm=xP7Q8)NeJOt<g
z#DOSiL}ZvuCF8$-vxRw>vs@j)R~(Ku4k89NE<k-66~fimAHL7^f8G|xxs|e)ejCQi
z6o+))xeg`_0BXXV`-kIxe3v0LqhfK<S(AY-Z@H_km9#zbx!)$ArXlzjk6^<nam_xM
zJp;H0YP-GCTS%k?m%v{ajw{#}rlK~r9R6NM3tGOZ5|!XMS|{ofELpP)N?zedCRH?t
zhL*NCx3RPKs9(meuT|1D54t4dyp69w(#Ywy)xieN?1I}}?yFXHq~j+Wyisyo^A&FU
z`KN<_rCF!Y*(P%oj&Bbz*P+`LD;`;Oal0<zEl@S#T2BO$=cU(Mx$FIx4pC%qPmA|<
zSX0Y%^qEEE7Y3gr5&yP8ve}t9qBYsW7l|h7tja{u^7>{4z~Y(r#T_n|bT)a$ySXcu
z6HCP1-hoRCcehsqiiT#(!Y$9aL(f{@-3GUYu{u(qp7Gbn&ySZt<gEd5e+X*D^Z(5P
z$V?niUMZFiucv;GyUMFApdm!>whD%K%|P;lv)fLV5hY}9_I1}0d<fTky+}9CY_!Dx
zG$AP(+%rey0&@q{o318>?+8v;d0NpcBS>bS@F>fez(zo2?2x_PIv%tGg@`^>s@zgE
z3g~`Ddt-X)0ZqcmgoF-jnV83bwR#X>GdMLT=4RCq*<gS)p;G>?j)5dHfdNl|0wgQ>
z_1zQ|*eH6`zD78sIn+uM@EDfdb!<gJ&-xyW>|d!Fgi##SA{WvVKX5)RNX6@q5}z|;
zt{F5T)%n8RJSs8$;l<FmL(C_WRo{_fpiO)~sH-yO-YRq8!qZ_QY0!Z!FM38CtM>aJ
zbR%ZG4;t^2V6n{=kdf8_BUz^$lWC76EL7hJ>GscK5+97l$9^MJ+*Q7|%@qwZI!2xE
z=j*%GQ2AaoXH}}xJi<<f)$hDJ60Z1T{kP7$qsTw5kEF3bPD*D;bflz?vdtVfN@CqY
zzT}OVKT3Wxw<KOk)pY+T;Su+xkPOprvZT;rXE5pneUP>4PVAz%@$60&>(j&LpTQW@
zSB=TLMJB^_i%phUr}c^>KcTjsw+eMNoq0R2&r>eKN7K;m%0Jkzt~(Js;k!xKT(z<+
zwOJw$bM5<r4?k^0b3oxK>~~I@`{DljxZ>mnbp%WWKF3paeY)T-K87ekw9AM#*?&eG
z?O9PrO&png{uRFrdkwgov?GWEa}1%NL?E;+9bDF!K-{X?)_bvXfq^8FpmDyXAOvvF
zm_vHVZv<$2tsi4gY%(>AVshLxQ{CkqtT~@x4Xz8VQktcYl$S1w1M29^Ju7cVnjFYg
z0J+@M-(`a%-&MRWKP{;k>Pl*8zAqUSj(3XN9>^~`i+|WQx7qeV5BGc}!LEi^5sYI<
z7@daeVvJM7=p)f8BUr~qPd5b`*t){O%D^2=6gL{a!$m&mL%~OJ{5G~qA?6K;9$Y8M
z;I2qGs5rt9K5#gWdJ6v_|MOejq>dHWvBBIfZPG(XSr3ds)F=)3>B>!+#J5=0=yf4A
zf`!o#!1ukx)j|EB0$M;*Px3P*B+SE${k4ffFvW3TR)EB(3LWF*rN5$<H-fscMlW6p
z@H;<^d3Fr*ueM}uT$n9lvR4`5)&O5JG~0c52~L3$X-^L|0;%8Hme$zCQ|ayxg#svK
zbAy5X)zKT<YF;3vZh28Ef88r|iFP&E2yg1VEQLOUj%5J<1Jg|Uu!QuHL_ROBNo&D0
zOh9v#>SVEd>!Xy<4EyY~qE~-V11A5bPuZqJ8%gYYHKOEwnxY5K)rEMIevY8KMb{|?
z(ab|d082x&!o&GQ<)Qj^$bb91GtWgynHWjin)7p{J|UYC$hq%to9l*Cdqmv7m&%L9
zqI_bCj(@L_9p9u0{o}T(7+3f<oQUq${Z0Ff{0qh+CON(hqYn`=b{<}He+*E8yo{G!
zy_gCgEbcJaEU%jssv(yL{wjVF`u@@!XtI;PvUTXT)2zsW+1J;obKuTv#8_<lxq|gG
zR?QM@F}B^cOQ^-&4Bf<05&+brKpaMLF>v>mZ4f&x59s~elre<Zuz4LE%0_#z`ZG@V
zWi3vWB+_?!wa<8ga+mqz8VO?yQ+e78(EV<ZnOBaNYE3iUU)Xxo3|UEOT@vk}UCGaA
zygcZBxa9ki5n#cI<7<h)4=bUH&UzRLQ32oBZ*BfM5m&W&l5i22Z^sH92TJ5Ooc=d(
z>a8Zg4CEiPXcoz)F{*!oKl)k?4h`lIG@5*sCqw$3@L=d!h?#g5E9Scp5U$>Q`gSoX
zM(>KO4o1ffZ>*PJ;kB`qb6pr8;<W+M<R67%C1Z{&u={PJ7AuOvh8Zf#gxMbBN}_cR
zuXwRB8u<n+;BLzTC=!^sz6|g6hni{+F{6z_313Zk1$4o9yyAyLC8k)JuNETl7+fAs
z^ToO%idOKxLII?xpU9>^&;_xUX6RaQaLwsHLD7kMcwO&4IHdb(0e_ha=P|0T)B0YP
zMg%o-P^DS_`iHhpNVS~v!O|PWuTs_mwP4r}1-<FAlin?NE56<}w*m`HG1PcFnRb9e
zXbMf|_h!MkXUCGs#pl}$n0!fX3uS<Fiu(4<w`I8~?BuY~TSDyECY=C;NK;H-X<xqC
z8-Mh_yh9r_aA?3Q?77t(B*la<2Auedp>k}V>=#(OB<Y@j*LS^x)yasgCzWf$dctJp
zJ1RW%UtT0MKCsSkq#>i#RQ~7`^-9)->0Kq<t>IlC-^lqA3~gqm1o=)3n_n*(IQrkN
zn<Tc$-Fr#hmn%%~03Fht1}!amvD=AbfiU0egQ$1cM5_+}4g?&p(fTgelv=c?na!1X
zx9@Eny=GoyoahM$tQULfZ`t-w+4`=QX{Q!<N!8{ogLeIqKDr#)*PJkyEc7?>Z138K
z@#_D3DdU7V*WzxVY{1<@mdgRAiqB;eo3(#6`IdT5i<BQG8R;!N>rGgPnabZ)=+anB
zFYw(OJPbw<x*2&e8Y_emUgBql&dk=!>k9jJ9K6|=LN26Cedb2iF@qa!cp4aV!~hF$
zs>@E`K?5%AAw9e%n@)a`9-FmSs<qxhop%qryd3oTT9K&Mr9fcd;kV3@%EVW=(g5<s
zkS5SAL#0loes<$@h!`9bbbCrjZvD$&c;9?e<swS?KcjH*_{$8BEXAK2VqzYkAP(iv
z?I!lJ^B|30Z%?9i&GS7`6o&KopNcUXlk;Rl4^~@)u6I~6dSb?HO)@VW-Q`<UJ!=Pf
zQAIiJRv6jH>=>%+mfZZPEI~hh=%Ag{bvt+bjwHp;DB@Q|A8g;eD{?(yYu~feHhbZ9
z9f!JLsjgWY65Y7hQjP^&?OIUZu(iJkW$mgb`Dy7jnsvVTJ?>{=A@w{ayWSgrjPUq$
zeInf3AnsPTJrJ1G&xgbCZ~M6|5W!H!$hNSV=uWQsr{hTPn&PUgfaY(;-HBiSOja}5
zXr@S??unLq!Zds4!+-A!^kiXl3%lH3<o?|{DrIesDt1}_lMxuLUB_VHP9QI{HL}{a
zvi8s)V7(wJb3Dp={XOBAdGLxY6(xU;B=}R~*XewLwuErv;N1Xpi^jmIb@bKO;I(#s
zrek}a=2_%=Z_`o3joXEJe)Y<~7CLk@jrtBJPy*wEHtqqik;V!?O^v4Z_~l%10|t;f
z_N&;(n&!4BWx0)-R;!GeJoD_xFEr#n#C465xC}xJ&^Lc{Jb=}1FoQgu$CYQh;`cCG
z^q6xE<O=@#q<$-Y)`FJF{2{BsoLd$Yi&l(^iigUanGtc{T8U&O_=1+ohS;NoL6HaA
zDbHfulTJi-^dT+G$Jk>u8a-LYq#{LCoMI1Oc|`XR-o9TXBH`81!L@2jnN+eHz$bBm
zldOx7`t95H>>jlcW6=6&XT90lg7`X)rxDj=`oXomVO=+dt54~KLxl8F;v=6_oqTF9
zCLt16eBS(GGjth~hR(%EYD4?wt$!3$l2g+ovXS)9>fMm5DAfP;QM7rB<DwC{lRKPH
z`Uv~Wy9nm$9H8FAbKn(+gnrfEGg}#Zg_k~;UV)#!W8^#Ywe`n#)lsgoJwMWRb#Uy+
zOa>h}b}S<3<m#3rL1E_a78L=tbyro5qa+S*DS^K{H3bH1{dMSmhaAH{e;a+KZ#HN2
zd66NF_|mp6*mLaFaPRQ6|FP%!+s@$itjC`T3O#gIwB0$~B(deB5Kg8z*QT(`rec3s
z`Xh_!Qz_-<A%$}yfvyo}U6Xa)HJX!9>QzZN5G-9Kw<tp9bb9b5)%SGM0myM6?&iHL
z8<scN(2cx|HN}uQlel4M79O`@H2g;pJZnaZl5Y+ZM0_esYwuprUR?-Y`JnA0edlZ4
z8%FI@c=w$>?*9PCKsdj?^=-TY&tBI6eN=oCtEz*2-m)IDbC=_d?fmxAKXi`WgHU6Z
zrBzu;Lx+Qa_|QZTPI$P-8!0^kc1wUphg}o<Bf_VJqZrs9Ndsj6#4tvFm}^i|K2-*;
zMN{hFnlNYbLr?s{S6&M`a1DRbIN+-=`9u#q(sCfN2x6dkuEFC#7>E%TAt?wvK#UPu
zg2*@vuIPa)8sH)vKwMftuKVE+%?gI40VYm7Ew_WkH4Xro6To04Fz?`CM;sKh0nuua
z516yrL_Di{EC{H96)eLV;0AYhlkqpuLj#?Q3Q{~(2=J%=*&cH&TH?Y*-B`rw^*8de
z4maP5VySxu*9@G!QARpHve(S~iL6DGBXw^w^_+|Q5DR0TJ9ts!LA^BK74`7L5847P
z?&<Gu5!mDzFIm-$R<$GQgoWtTqi0zQ8JYSt{wpAsbm?k}$|{LsFJ#a<4>N4L4qrH1
zKivzN7I`kS{Y(XqU1N>#=toE6u;Msx^^~Wkmmc2Q;`{@6TxAV>#g$eH>#x6Ij(gc9
zHQIS(6_|k<$a)bC1bu3NKK*Z3T@}9fo&O8p{l9PK)YwX5gAE^_UzZxdP?{d45+4s@
z^m)E*kd;$sFY}PZi+yf3L=A-}9GT~G9u%+~<0u<wQ_SJ*YzJF4@G(Oc?rtRZwpR9N
z(Rmr7MtQ>o!|$R@uDGtAV;{zwZ(B$#XYJKL7Dl_OU|MP*&bzbqW0MkOy?>L`LiAGR
zrFguv1~oHAX;oOpU_Qu*dBm(l<|sm2!QeH_UdNfw@SnI=;68NG_CeJcJR|f+<)>~=
zZ3MJCbm;mhSr>TG>w}B%S+Y2;KXToRZ=>^6SttNEnlr$F3#d?>Im)zu!ULY1d$GT&
zVsb_{RZ^9~q9S0ZO#x&TP<M{ZguVLO862)5E=F8SXaojG1B637IM5+ZbnqA^j%$Ex
z<&`|bRXqHVUGzvNP3abl;gaU;(5s+B4S0oN!Eb*ovK#HU)*-2$&}j5{QSwAcykmzD
zUrFnUXqBnbK%xQf4BZHsb~y<`pFsx4xZja+vfhnJ-o%m;JcAkZfb0}6rq6FGHf`JY
zue35PG4C8-Jn|q4g{6qor+70)Quh=#FX1_M@Ax2TS+|RABc8MKF1a2z-C~Py-fzy%
zuOIP<{}&$r_>KIUSMpb}*Y$zTx7x}UZF6kgu*r>$A9#9gw)qxy+aERBKbSFQm*?#k
zHrZ_Ru)*UWA68v;weato{}pb$;rejakIxMM`1{pPzn`CHJ!dET0N&PS9Nf@6|JDk3
z-F0WU_22&vXaD+_;lkgZ=ZnBr^q>BWXN4`d-a4$m!G>XN+pG4r|J)j`yY|{})s>fr
zU;pCgP4n;lidTj8*5ANM|MjXX!kMR?8a8_3lfrg8JR@xV)Tf1&%wUcI{=(n>HvIXI
zzt2V3%J#zDcKfG?O*Y-!y|vK=e184QpXWG@0vO<*|H2oC$3I~s*Chr~w(+>`+H1n8
zKl(wq>&`nHWosDsf)~9cY-;y!qbF^gr>}4Nd(Zoi^y`Ps*!1~Ne=<)?15eoKiQyT~
z-qDS*l>dPT?splk`Nu!PS*3sQE#(}-6_;IF7x9EAJ~3SVx4+iKaS`j?uCd;k(b((V
zzi$pVUT^izWNcUO(CrIf{8HOXdlS?56T|)Y-xp{*m;B|T@TWi2?&TE57D1bN(?N&i
zN#FU_N#S2N-I!k!K)z=`XXmifbDtO1Tx;!s*Xo^j-Vv_5=AYrmXPj;Z@GI-^JGo$=
z<yXCSzZ~_eUp~&{zTZFAN1fa1$y<Bc4cA{6PW|Bz!WEZamgCk3W`)PD@z}8E%l8RS
z+IW+&`eWA!4?XlyxWhi|cm8kB4Zk?+r{Tc|9;nMgnGZPlEqUCxPx{7`GLyIfy}o3R
zu<@pwdRzJLfBzdUw+BfV|K-o&kEYkBJZ+os++BBbI_zQi=}-J`PP18nvhl!*J*Ij4
z;Rd_M=bm$R`1wzN;t#QvZ;LIr3eSJhivu6}6U>`8FTC#qN9i(r?SwB``~OdV-CuxZ
z*WiG8JYzbZw-{V!@o?M+in2zFUSzlN${sq~#$Ep0aL$}btLt$aiMiRH!tO2XhHRU!
z!J=*vI!f7lDet)D8El>Fue7Obgl!IQ{UB`+hlR2M+8h9Fh3!^Y_f{}M4OsJ*16*1g
zMkvuVVa@*R*1wmw5~vlMHll4zd0@g?u@7K@$w5bs{gDR8tu8iju1VuedfG6F6CG#(
zqJv#iVbKK_;97_HD;}D}30HhM1JEQL5PxW?44we<6hKr)ki`^hH^4PGVhj#6I7>;&
zL!1usix+X+5d`7jS|H(|!2uAbLMom!apWZ(&^7WA2M%k^842-;l}%n)+}2G<hNBLD
z+GBSoF8s|ftO3!U)(jNz6wbguW;8)ZW3QfBMX*nQd4-7HX;wk3=XUQwWhn8CF&r2~
z2Unt)%M7Wg?fBbGq3|ee2Spre5{rPj<{9Gkyd8mV)2XZ0UgokDg*6vE?s=+-_j@Oh
zwlGS^b>99uAuy&mlp}g#TL*8tp>J8d$h>uyEUfi$Y2gjO-Q9JXgYJ{YNS{$X^-5A-
zHC!>{VtL7uxS+<kFWLGTvoD|WVYzyP@Rqh+geHf-_}Ne0c>I{v9~+imeueNvGag=b
z<rO|wOqdYqb`cm+i~9$!^SH-_cfR-i;fZEcN&({$#>m~C{~|Ze@p?T5r*7e~w$;Jg
z-u0faWoGD7{ztC7a=^H|{WG2!ZvNN5!Ux{_&MC5iyV_$O6ApdHyTennJ#>{H`H*?H
z7rfAnf_sF|e(K|H@Kn0a7^0q>c~jGW+<o`m;qW7ms_RQI((ShU3&T+#cwhMA?|&Ee
z+<Tw!#sd$o>lZO%LFZ}PZWliGkq?V}-FchswhxEC^W9TCx*zkH)!m4Oq3c^;|5`Zh
z<R8}MYj&~mW}AiQ?DE{YWW2={_kbA^iw0r#@qNwf_YZr#?B#W3WRK}}*IPgAxYI6{
zws$!0^T&h>%n<LOxm7=vwoc0Wi%EaLRUhZ|?mdS$u6OoeVz=kNFr4+%Gi^(U;~LgG
z%JRMse8`Ob>nDWQa6>#s((iryTj8F2?oQI`gDb4CVy;J0esbpNb;eN)`=9vC=gg@8
zgu0B>TRfh3wg)Kxchc9xx9#W#$glfHz8`$=+u<Fi2aK#KP$#$F;hEu^U;C<;B~4=<
zxa$jE;O!zE6IWhk72jrIb2F;GZ0}cuw;ghj8;F$`gZ56lJWrS5C#RoQS7s7;;PCz<
zKO7#n-g-G6#%3O(?6uFnUfz4}y*H<`@ZpEs8iZf7-y3W{;5X#-2&}r=W4z4IeAbTP
z1MhoJJ}+2ft+jI6%0L-++GST=h97+Q+a(!<8_h+u6wBFV0WHmn@olb?x%{F<4~50{
zmLDH;i(a^vx8300hJ3Hdn)5BSZ7r7AL;BgajRbo3Jz{N6h({=1!~T%kyouRrLZH05
zuFl<Pz>J>iZ;RQQ#TW4gejVEd4-IhK)n3?|hnK~kdZhk~bpd;#`iGLugMC!(qO7t_
zXF9&#w|nDr>anSl<FC=#v*y~o+f0O}yE1_{!=cN4@ofa{&67TPU|&Q?8oD}mnzsfy
z(!fcLy5KQ5DvoR6kynTEiIydKzSybM=OK;*x@mss5~p+vdKlWmLk<93;&K2f1&9cV
zGa%uWkvuwti?NrmjLGC7j9?PPg3g>c;VX}Dl^<TE@UPk=Y9B55(@T3YGb+H_OGdr8
z?-!kfs@JHbs`yS<4frc4wjbD_zOGKq#G@UEPc(VOCB6>U)x#Yojdm;xixA48J^L6O
z9(w3O_u|5Xs4JbgR;!=!(Et-Q7BuV|X?M2IZuw?2kfxrbo0)+ug><`!i~jhB@RvXT
zIZxiw44?w)8pa{P<;hkQ#Nmba#V?<j8|Ci5@4j&E*}ryARy-`@f^e35>>Y6MTScbh
zGltM(PdKs87>rT*`s=Q9eTmRoYp)$X^6^gxjAbcc#60eVuh$uaG4fq*9;kQRetV9(
z(UYDOK7afPZVb#L8w8$UMy>ZAailLoAAInEx;96D_}&kE(2Upbb<a`yn?*dRv9_7Q
zvv=A#;H_MQou9XB`0z(Ro*RR2F;7>#AMr?*cPvK80}pv?ok6fjC%wktiw8Jz2#|+3
zKkmLu(SBxe{jpCU6ZSHLwiepx`>*E7ikC9?6L{34A00mM;g5tDy>w5%F8gPTt?Ku;
zzTUiDQ}B9s{8#Ji-EXLOKXlLDyxy6ob?VV78pwal7mf?5G57)VhQ0EN%iX|9{(WEd
zny~u|UZgBtpLu8?WAMXf^yEPSUd!B9!K-brWF8Ro18;lhdvas&fA6`cu3b<E*^e3H
zc?vwJ;US6cF`msoIpZ|z2mWMR6fAU99;AHe=>JKxwGCtV{oJu%t}_PHC*Y-g(~UQ{
zY{;|w3p>~AuDib=HwNPgoz`UpLVwTOefM0pg%2;Zw+HT;;@wP~j_K?{$iorp6I)4)
zQ#p`ju|2To{@@)9U<jPQV7_f5v7DV3SbbwY*XQ8ol&hcVqJep~O~f2~>xlba_MNBy
z(pC}7f2o7M&aDg{)1`V;awZyJyskNgBnf>6*<Tylm>&7SINPf939@~1j)ZIWOxZ6x
zv40{4`N_jUN1^;oHq~X6VShDp4$y^<WQRwcVNPDVj%`06aF9X55stIr7-yGGRCuI;
z3!VxkhGI6)(g5;MK&6WYa!4t}K}S5n6@Wv$a7b&!Uk2w%uM5gO6VEg>lwbqJC=Dm@
zX5nwXl`fBeQ)npngJ*TTYCmC>CO#=*Fy&wn#mkT?G$>Eup%k%V(zOP(z;Bk(JD<!5
zkmFdTWzfPiIKBc#H&iCXt}SjA5$Q63`DCxfL{Cz<%$CjDd)DzOtxPG0Maw4%ULNb_
z&6|J8M7H3veuVx+<?Tcs(VBugCJK_*>J<5`kb~~GwOr{=qf;d9Eh6y(^ZnoLjSimb
z`~B*1@Mdd=9nG5)Sbu}Z`|Ii$y?`fg9rq7@=)niw*oU_)p0b{1UaZk;ahBy-zRpN`
z$;E$(_rYZ1;RK$$Ec5}kG<g5J-x2OH4_X1<#-BLm^Ns`k-=6y$H##Z3-TAP0zb9Y>
z1u%dd_qor8U;g}OCc|V{=@E}G56EYPx4!*d{yHi~;g|0DvT%}lL<$ZwV;Oh=#!+5P
z|K0h&RkC|9AO69k+z5;D0#E0+9`vTBuhXq*-iH{Yk1;xbzxr<hgEhvjeP8`rr-`h)
zKK}*bUVBCUbG8-3?=Cn$tgzw=VaMm}9QHrxVDrFU-tk_t=U)DyGzqfu%B#4cSJ!MS
z@!3y)qD~HsuLmFcHb;5$TMzSX4KV7qf-imHbAjUnM;#q@c-FHW^-{ZsN51df4YTdF
z&nv={HrdqE7#qI*t#5?yeDfsNH<1|F5C7nYZ5xcu9B2On53+4C{!lY=s(<dW&N3gt
z`*ojJzRKzIgCX(n$#xO6i7EB&J@1@a@60=wx{0UoZ_hoauHL=w4Q~v~udssiU|jk7
zSHBWY`Qi8TK8BBx;XRC3YcD{ZV>=PS5hmYNW^5LG%w*d#GkViT+ig#we2va{xu1T@
zkL*5uBj9<<KAn5MeDCo3Hy!Bc)N8hHpdJXGVRZpr0~cTP=Ww{STL<fBH?!?!KJ~dT
z`XyV9usus^#EyuKf8YF;L&JjQmh(g&JbdN2FN8BrJtaqGKXdfDaaMnnpy8*{SjKi1
zY&G%4&mQA-f&0JBw%ePR{)en>#lB&Wz4rEpC(t|R>|goul0EhchaC2HXMvG>-#uR}
zc6Nr7mQ-4vCCLK`Qc9In47%q%Yc{fD{K6YDe%uYC8~2lD=Q?bpNU<EyIW~FLH>@*o
zKAGcQ%*aKZ#27qhcKpDtdvRL3<6chH$$$i`$hOr$?s=?!yg`oURV%I`J&P}FXW6(s
z-;a2oNh#L<1`IlgLOkjfUh<r^uJ-wG3)wp$U7?Ip1F;ifvOh{Gdg9%=#Om|NQJ;&t
zTqZ!B?Mmr;Q7z+ze}Bi$9?^ms>ml8a6fJWi#D1y43!$+|$}WlBGCoy~4IVrW?4L61
z;w2#kpb%(q5HBS_2Yi4y@q-Ux;VDh&$|pq=4=>_56Aujm`H3UVL4<X!1TujLNC1d(
zkO#aXVT;O{3zs-Rg@YExTJaSP=n<!aNqH9Kd`J_`cKo3)T=LIoP|X+zC8UE_tqKl7
zGCEm1;unBp6=R^r@D@7^RrMjrQn45d4bb6mw1OfIbq3GfICu@B&RCr^Z@X;Z@h6&Y
z3^qw!Rz|5tBUM%i<ckwfhO}A--l~k_n&y*UAIxokU|RsPuw{D)_DS<SUb__B@0OI3
zp1Y(oSoBn|EX-+{hNP9zN87>u%@=4rls*0U8-{inVb~f1!zO@%mkA<!rt0AkM%?Ay
z2)oqxp2bU8;QNu%_DnVmS$G->Fi54wVB+y?#n2|;mGMr2{cE>=O3kQt?B|XNY;S?F
z0l@R{mp?nJ?sfQWY|mc74$pj6ooDc8KJl?SV=#DEn&;xtM;@UpVZ9AD2ru5Vxz{U3
zuA@Krem4e_>9*Vc;|A#BKCNFk=2LF)MOF;aY$x#3GtbERthLTMd6>X!_kUwxUuS?<
ztiSe^<LivU#GiTEDY;P*Ts$Ys1h$e$U&}w^w3Ge8fb<P7ysD2d;~}1?0NYF8vD_<s
z^pl_QZ57yB;n=U77=Cc-nc-b#l*fPs;0cLgT^@(T?YPs<VbjevC+L8|x?#Pu{gwrL
z?Om&PYpu0*c<%FR9;K(Ba&kEN2jBBHC;VG%Z|b8yaJWB&P+T|X^*7is8-wgY!~^%|
z_f0g8{p_d1*H8GeA6H&+nWB3-<B@;-7eDXDU<gou*b*T%K(l{w3h77sFh;A#CBRz%
zpZ(;=y$(_j=g*&?W^EdN;>H{M_ANsAuI;Iu8iR>vyO|Fj{$AhnSa|Ku|2B{65550=
zZVU#OzVQ#gzc8F;MsNWSgW{O4n0Dv9#O)AEOczg``y=fmhUtQ~;UAu}`;N0oob~ia
zyWia0Bj#-Mm&nI8YYYs8>@Q87;z32Ld0f9TRQY?*fZZp%Sv_PdW-+%T+cVhrymlj3
zIdwke!rWMG-s_vyeVxlGL&~iRR~l%pf$myN^R~cTyX^jZws{Bp0B_>^x{)!W#rnCv
zl#;b}UK+g^o7o>hL>;m{YVkl^nf6cULQ}R=3+DFJM*K+^uF@$3p!j%Yze-Sq3Prrq
zIFpeBg5VH`VA7W2IkRfv5HoP391D7y^64yG=oW=0FX<>%e7fOp*=7z<;l0uqD}EN=
zd4m{?&b)&70A_<29+*T74fxO<Pw}JSfy#&REq-0zs+4^Zwu0%U0jf_lmv&H*sBYQ4
z@1&IKoP^6njE4y2x1m@HjKOY%vO0+|f&~QwS+hx=%a^okwS9}49*|AKqn@K7938v&
zwR!X}T5PX}E_&GZPhMzxutgvDu0_cxcTESeAJnxb1}(Dpm=vXNoLOm&&XyyQHx8vu
zsATuJacY^dlCw;jozmjoW`B0?m--edc1<1W5{lb9$au@1xPpuR^hXckS@_R?T<u}n
z-j?=pIe01$34Da<b~~t-)K5NCCt!<;3+$t6jR2#wV7>J=P_XTJ^DVZ_ac;Tg-{Dt3
z|9O6$27djEpM@WO?>m05{e_H)>9zxW(CxzW&r7rAVT{&zNeVXGyvA2?I$wLuKkZ|A
zH|sJ#6EC2@`u&9$=rTX^Au$2QSB$BGl;_#M{6*b%AHw0B>T=!n*H4rB4nN60tj33b
z0Pa0|=r#h3w5c%;kJ4U&d(4(392hCtcUQnZ)`uN@pl{=#IL>LEy!mFUcNcV0?`pc@
z19j<}2tWG4cT@6t81L(|fBDP&ItJ7?aBdFlwJlh2#g)Rl4nM-TkI?JQH{E!n8*MS%
zrVk2~r<?O{?4yc}01tKnUcM=$A5?q!zOVF;-r?2krL%taXFvUMF5eB-b~=I7n;K&v
zM)pQ<@4f%^2RV(>q}?=)k2O-~ijbBMBO}{@^ahQ%_C_h@($Y`oR(*FryhWdf!x&!|
znqk=X81`=oSQ?~93XEI4*%d!@tB)Ar)wy8)a$&jURtWR?038MkhdBQmsmNo^JkA3e
z&IOns^e{&#r?^=?^xH?J!y|mIk0riFXjT1t6ac#Q24V9^w>}5Ya|b5D6^vX1-n$KL
z-ahi;b|`@Q?X+QJ-<R@wo5puYvI!bC9p84*Nb;~SJ}_*)KGZrfo*NU*npSM+)5rcP
zc~vNGf>+PvtTgx5%`cJwnbOfJ4TA<j?jF4mGilvv;sLJl)a6<NSTK*nz$+R`hhCZ=
zp2EQ>%mEGuz<IG9tS$&chdc@+m*`n=W`GYw4T|cDuo~^k8`%JAf*Eg@L3iB*EBnb%
zgW_jV#@YU@d$2dqGsC&1uvoEYuJ*w>CLRb@!Lq0U>Rm5YpSHt7+F#SkMuoEV6DN8Y
zo8xO>`Bo7HMtO&3a=2UrlBd9SaF>)LJLn16=P3^0c>TnOH^isl{YM&+gh!zcq_a(D
z{5KJ$Aa$COgxd;ibiMeo?@Dr(9&|QFwNY70XV#RUw^EnEKS*kY=b@csYnm-dU|&#-
zT5Jaa$dLBrr%W{nll~Voin2#8z#hYFcaR!o^`SZ+TTPbr*WbW#`B{0DmBR@qH8vpn
z$B!~hj5c_;-gn=<dERD$_02#i_~+lRZaOCY=hj=@n^CwrYyVcRulZ-q7_0R3e9b@q
zk$*UD!zVl;O{xq3$2=Sx!GqaW9Hikzi&3};>^Ypm0^3^?&py26@Ng77b(`(NSHJmf
zUDlmfFyo@28{@k2v^uByy6dhxr+D3_d9V4$-}6fho@@nB{McZQ&?3MG`hXQySia6c
z{?Y&ML%z*JqpWrH&bHb(;p^XQgy!Rv64H9d{=)(ugtXdr<EEQ#5NbTvHNd)yIy?-n
zJZQk%9@zQ0yZXTvE&s5(OxmApPhs}5?icW8ZUpyP*#yfi&+?!KY~8ZUuDf{z{lmKt
z|A4ixrT(yk?K%E>)fM44zy6hb;Wsou)kx)`^^*SJKeyh}(1<H!wgKrBZn@>=hNx-z
zKv*u@s-hus(@5?iN9=E#qIH!}9GRQdlQMXVSDdrkw@H2OFn8{P5Vw&KkFE+(Dl+v4
z!?4yAJaEKYc<x*tEZTf>$sF%5*#bk~I4M<tWrUb!1mjm6)j_LkHgD%6(DUZUElj*w
z4M5<yPQc8;S|%F0cqqc#uied(1|VETGSPtUMrQ9wQf78gZKkFLcY>;2mJ;H_o?1)u
zQTEus#_=fr_RK~F;LKzfa)eXE5#iJpNje8MQSxvoPWiYN5GOH-hZfgzoVB3mhYmEs
zFXorMRJK+_$!(}bI;1&3tOz2Uo)HKlVj@8#C^Qh5bb%BF4hQteM_72ARdAib(?J}C
zRiP!X_>-=DoT0}dxl{&=sz4g>g{@t5I^k8mGS88>-JVG^#d5c}jk=R%GHOK222zY3
z9CR8!$l5|5nQUh=KT9`mLhnN^Rlq(-G%CT2kCR^O`@u5Q5-HoWfg0E(URy<|?bH%`
z4>47U^}_0*c^+bPCeFWxYK9fBgIKT=gP8NTYoPX<3fsFp!_4WjQ)bFyWpqO@o(^_s
zU+*YSt&~}TTZkEPTOjn2)CuiQa0()De}U|t#*0S3Mmr~Oc?N#Vb7m&Yz?n5FuvH72
za@d1ACIH$-C2b20Gi8yNU2<{YBW3``DLg>sA&gh=t>$?vxY#}@wa+VG?U!4dK^R>2
zCly?J$tCWcPF+PS>#V!3l5DTxmHfyfS_IZK<LA|Xy{ZL9Oj>un^>dtCn;5-vga(0i
z*IO@-y~DP4Xa%XqB>Mv6y^FE72pSKI@#%H9OCR)sx04`xI=1(ABwv}3>idq{Zfi;U
z_JTgwdEC1724OXowD~lk_}YD6=Ek6nZQtTgf9_cC`$60D<@<#5e|w%U@Qc~%>)ndJ
zH+B)H(Y5Mbx_!bOx3@0mop;>Ph*XSgQ8wzy$BsTKyzj`Pa-%Sr*tZzZbq+jp|NghX
zg`+=oMBN7tn=@>j!h^$Zfe+lB_~kE!SMT@w+z?N@=D`F9`#8VhfH#M4edEM%^7p^z
z{jzRpGhVAas#a%<#@b?@;=_?*dU}nKXE@O8hPEqtJL$;J0sTfi()fOO(Jx!?<8M_h
z@-q+Pn6ojbioJF_SqGO+n}|kV`-aM#2{#=2HWKsM3l^hrW*F83@P1S=xMGYK<q~w{
zBsBl(rF6VP&cF2^)VJIi+zYJ^^Q7Lv7`fbOg0q!l)b+f>B2;KIP6M<w9rcAbcaQ81
z?fUqBu3~$P^Gf>ON%Nl9L%DwFCS3*g$8_+5EZ5i`)iYr)C9DZ9*W}|2E&x8^R5@uF
z93}zakq=s2Lx(u7MT;}n%Fi{p!XXR|Ks=!VDBcaNF)IFwq0VIFP$9%XhFNkU05|~Y
zfP@kq7?Vam!pb9h7UcjwAo|b+9|hp?o6@jL2WTlD>Eub{9I5(=8t@xs0~pZBA}{6|
z(68Mk7LhpRx=5K^1LBsDrFt-dG(C7tiPgtDl38=D1F<Jc7>%t5h+{rTy@K*ao%c$m
z%2(8Y^jeJX|GLf?Y~*I!N3LeuhvcXqwXUvzK32i3e%WNwj3RCru_96DmMn?;<cb4)
z^V*Y!9bs^K5dX5yUIy1;O^dWO|47Ud7IIdWEPV=3%N+GTC1ofPx&E7QYnR?I8~58g
zAQihc6_tO`{q|HT;)9BYWf)i_^*U<D?ZVl^1D9<|8<;8t+eXMBj3?^zc6)x{17^TQ
ze~#NlDA$!&T;WDgjG=f@KI2(Cy7#KmFT2D(D2H)|x@iv(@4e^0`M$Rpp3gt;9HF*6
zr?1nuLcGsjE&qT2FYc?W55u*>FQ(md_dU6MD`j+wIJ$mBlFr`5jf}y<E&Htfct!WD
zAD`hL=+kwxbJ^Z>_uNza7~o3Te#XssYrkWq;}u;G>W`<kqI$e|_1CMe3}>8vO5j6a
z03Q+~eA>xBj0nju`V#+3t=?U5-nmI?^PuY8Lk~TeBk>@k6+H5hE4NB+nTE&o+ic4V
zJifPn>Qntge0ZO0OA|70^rR<+4}bLI;jIV0(dSz&36`Arqwjw=@bN<S0_P)v8*jFm
ze_T;)@VI@`L5KKOG3TFq4ui6i8lHJ0L9o`^>nPap+%CPCiCWZ}dof41*KlZ7S6NQ=
z!#&O0jE9zP`I@xb0z`Zt6QZ`*s(}Z~cx=wGSNLT_OJ-5M@#rI$uO)0C<JEq~5`Wvw
z=Y4E3!2HjQ!pLoo0L+QnRJlGRSyr;9b*uL>buyP~&MCGXjQTu8_N@n-Blj+3lGE1-
zcFj}-*%=GH46WwQN&YHWX<+yoU>unW-g?ZFw`RVZiqlIBeW}(;{t-`m&=$urIQ9;-
zIRk#NNov5N#fvZn<sePzDm-WMfr~wpvjkJG!C*)jrI03G!iNTNq$`j3b0%G9@Br~8
z9{R+Kj?NYp0m3Or2oMD+L5Ko6!$3q~M1Bgbf~$ZMhIGYQ&_TvtF4zJ>hF|ai^31nG
z1tbo79PoiZxJCZNiG~F$n4*EKhUf8(W+B39l$K}gFW{3UBY`2#CvEAS?vHfa+|JuN
z3_6gwm#|eD^D3a~)O#wnB~>8|K?5}Up1?D<&n;uHFsT#l3l=>T%dMEyIXu*v<UyaO
z{P7FgRv%T!)DWh)X?9jwVtL~g<>d8p7H$r)@#iH|o;+ftf$@^YhdNbM=|vS**UQw|
z7ClVr7>jtL!`cK7Qd-@W%PzgRP6PYA>NWZGU$Xs!6~P{lmtT5m{vozky>34xnNjH0
zz}5_L_%kJ&-mkyz+Mti4J@n8+;m4<+=8H1jf>v_ngj)ozyXG46R$Rw1R<|t)TEQMK
z+uOa&z&YzDXZnZS*t2(?$34!ot+{6X9;!uJ`p6#f>3+aPyg^*EWx>7wHRJaqAL-=T
zU-rz?P8|fRmNc(Rw$)huv8%g2^M0w2bB(pu&SR)IO}7A`GIUrGPCD^~u>I4Y5gxPp
z>P~yV{om+&F{fVaBv9|P?E_mdoOyb8x<bE#RaaZBbvfJA8_{WX{_`JyA2<LW%4}jE
z#Cy%__je;KaqOK;dD!QA*g)Mo)jqz*0r0`eXYKf$@P;=XWc^FLaa_AW*fE;l%<Hbb
z#xeNe0S+ITyZWzx&Ephc{M&ZB?R7Z~&XifbTEF6oPBT50$qTXLN9SnA7=_~;E_)-X
z-=g%9pHT~$F#66mgY{f9CNc+{YewNYwx{rf#rX&6Y<`p*`kY@gz4al?*k@Ip88bn(
z7PecWJ%eSaEv>mUDzfpDv5UGP$ECPVZIq#kt28hU8fezH;|wKJVL5U##%c=+dXGul
zF2eiKa>%DtAdh_!n<YRYZIR+Yq11VSLp*0}od9V{Cr%227I@e+1?0s}o5m@BiVF>B
z5eNSiz$aa{Qt?(?j!Whuq=g})m`VunQ{jY9I)+<73=uHJg_dY4OkoL2Y0y(1aCJ>s
zbd_#Vp02b;{K2W9fd()_r3a0v2uk<GcrmezYa7_2QP#Y2%`=j)+lF+f%iz(327Yg|
zX0i8@RVRCTKRLPB_}fIxs-kx+)>&Z?Y;AgILcEF|kOtJ$J16gxC$DGC^HB4Pwcob8
zx5b2g{KE`TQ&XGM>NLefa@ujL2<!B0@M5um9Bw4e48=vcI;B5yJPK$)TcSJ|@+jZK
z3m^24#rcOY^2T0&2gu{Ed)ngM&kg#fvdTyMZv9slr*i1HZs?bEOsTo$@JXpiKWW_1
z!q!IzJLs2fnQsqH;yBTYKgKWZ(+b{dk9mxvW5m1k;@ZdFMB^{EZG=F^SgtR#?IHkG
zKfJqA0}!wLue6eVl!`ur`c6ONIn2mpTQKZvhG-p~?)7<{8U6&DZ?Tmdt8|^7*WX~n
zaKOQD3Hu-T=CJRpUlTAA0_+Pc;G<<}c@)nXL+sOccxE1z=F1}o97xOhl&5Xel-p*T
zZ;|Wq`7e5LQ@mCQEZ!TzHD*8;;KjQ0^Wq+}ic8PCz2JrU<qg+g?+>-|h`K<m3wdRz
zORK-&p~B~n`BWZ>r}|;<cvpU{z;)Nw>II&yY{Sq9yx!RsDEnrI>Rsx|%A#q<opx@N
z-RU+<YnXvZ8i*a+Zofk~@Q_3O*!_jI`?P4$qHxJyE()Lg=toRvT0@2Kxb@a+O0w((
z?!RQ?jGhEM_`!4d=V$#yQQ>jxuIJ&{-!>nGd6=|t;le!MTMm0i!+W#W-us$oblh7x
zNA4h?kx}Okvg9Zj8RPsVkLn@-N0wjd(M9$gl^)Uh@Rp5%IabO?Vd8rLpI0zu#E<hX
zviq~djI0h;EcNF-P%b44bJ7WG2eb<wj5Dq<p3k$7&C&iB%wIk;mXyM7S`uM6^$!UX
z7y-bw5$8!;BZgTMwpX=zciVVD|KNy?kV}&r<5}%3#kgIB)$i=X?9`nKmH`c9<LEL_
zlB5Xg+Zj&`teq^K#QG8+f_af+N}s>1Gov}t`wm-c($89B&5l0F*RnI12^gqg!qLe7
znBt-c@Hi_xX!~c%A4L@TBS#K(7Z%I446|eu5QZ4S6GjPKGs1!oa1C<~aD<og5RT}P
zraXkjANpxQ2=~h0vQ{u1G~k9iYs5VH90^#hWPnXyNp-`VEuQ2(JQBGorbE{N1~7lE
z&+h%8VD4Poo7fg?Oek3pu#YZnz>Q0TVmbu6bktFQd_W~`?$4s<VKaOzv<1+}+IN{{
zkA;k*65&yU<QcUbL*P#vp}nwJYz6ulT#Cc?5Dz~*b&uSOFRB@YQ~aW*F&xkO=}*D~
z*~io{s_ys3H@T-5{e>?MGXe)6_O|f4{omvVdy_WeoAOflS3f%|H}3K(>RaFb&anLQ
z%PZN>w5x;Oa%dih;actLXFvUM&^8E+Ux&T(-T77n$}oSyf^g{D-<2D#*xOXzlEN9r
z`P3hNKWBqM_*u`{DZf?#!{_@xcvP-S4B?%^-FM%Wqdv)u_jsxnfqk9RhXk*E!~S8t
z4K^sEg_rH~iogQ^!M9KPx`KV5FEX$7U;pCgIUV-9-tGA{<1+~uE7N-ShBqEqSKpNR
z;6oeNyDKlhEZlYHok9!y?SFuIlCPUz6To<kF<KvFtV`_RVuck~2ru31Wq!Q*t%v2?
zv?!~8Ov@K-G3GY&z8@Aa25n;=x{_~?m+w7=^}KnthX(2X+EWmd2=-(C&Nsi2$6)mR
z(pSF`UcASifd?|Q{SSTQqv1_&KBUfYoM$LGkk)w~aPaV8e1IM_J%%A!^rplp{P4pM
z`9o<W7zd!w<^c&_!Lk32^G^Dy1<Tn7^6Wg_=Y!**=Tc<I<{R{3^XD%JjG?oczq@Io
z6b>zk@DLB<8Ni;X@feqy9ObHhD-BH5fcpC^#p*EgWVT8iB+#EmgK#-qGFlV{!D)%p
z!Ty;l8JTr62$NQ4Y^%+FEX6>*iwez|j6j-^FvOH!jKqXA(Xyb2g(CrFNXFtKeDUKf
zON{b?FI>q2fAJJQXo;Q$E9g`MG}3fIo94q)n9;}=<82n=X})g4;;n|vL<qj@<2zi4
z6G+zwUc$zF>1?ZBR_@9CsgtQ=wyNQ9rK`Agrh!;jTjS<cE34Dw;l4A`)1HTMAc*m`
z?yxo8=BZYPj0gMM#n->gYt{_Gi*2z=z4tbd$<mz07^b+)JfY3JflaY^054wjaP*?1
z`D9{yyUG<mn6eCdlJ55@9~voJ>>qk9O<#4)>T4`-eA}W|89K=)y~cZ~JK9Oka&V%a
z@D#STGGUbn;}Y%Fjv`<reb$aU)kR}?YXsL{cbyx{;)l&@80-<80$lF8<M!~?<Bv5%
z>w7%u`7e4&;KO9+o%5S;n|*X_{q;BSk7wy4b|C%ajME*rlOJfDaQt!M(9BEpsoQKD
zjy>UP;oRSx9q{se^rKe|yPC03+dbf6`t=iz&q=cl!?B<JOgQ4Gqdg9z)E7@U(O-Z6
z*G)Ht$J#a&+nZ;wwv_<sgfATzZg2BJwVXkTfj|82!tk44{nCwQkUjj!qrx`ZZWk^w
zFYX8Kzu&hRc$!^PW&oq!FV6a@hdcR6w<EyV`Ngk%%{^7o!AFidGGHX4P95{fkA*Lt
zc#<35;q}>Lj}K>?Tx`FwqIrOC_2jL?mUak!^Xp%Q-(7INE=xIo`M58Jt<5OD$|`ZM
z>o*>BaQM?7ejo0<^A4xahu*$w^#TJw@WPk8)D73?oc(Lx+GN8GAMY~O)w?s#a9n<<
zCntX8`0(z-kMKCQjrij6Cxmm)Ioq~vxWT>Xx7l`kuOI1F9yx&y0<<|Ee4uL{W*m9+
z|Af;|`BC`q-FJr#H`*vXd&iw^-W1y^_m^!jh6#WC{e@-_ez~)JzIia;Z!%nE4~bS>
zX~lpS`m=Z1B^T$4%P!5s#emOElLhU`Klq-1wDQSMd8(tXvF4iL5c3pH;omp^E1dny
zU)Trj-jGK39WM5Kc&?}Lp`$+<E;#=@f0N-9+alwtD=tryy9_fM26~zMGF}wN4Cob0
z0DS>zCGgBxOkjY0aEZ_D=Fhi%U;UM3@f!X)4qL1@Cc>h{_I8+kOJT0Pm4>lo{=5Y?
zPn_?@;>C*>nIW5PB=CAhW36;H{BjJ9V+nI(`ujMK=tAl&5BFuka*v4fjbc^qf?T(#
zwK;RV@BZOwn_u&`R0ZR#0p_MrKCgG<Eb72yD~uK1fz5Jfq0(4dM@k#fTVQG*zAh_?
zNnG<eF|~YKeB|3Ss39^~k)FMdQio4G=_mwz&cf$fbU9<|BwZan=?W_z{@@a?IOwI<
zc3DSPG*WrV>j1$NK$cKKA|t{nz9_7e0v+%G@`6X2=s;V-TF?P}6sLR=mPGO8%)Y|p
z1)xh9x}vEt*BmKNyR2Y3X@DEdO>{3X8-RWCL&UJa1Yln#Ge^4t*k8G`&c-XRd1hf4
z#)wzJm}`KF)FsgAbH6dzdL^{{B2!Kkj88`Ov>zid+bB@iol!YVx-517=;%xX<`OFp
zuS5C=R7#k@_b=VxDR_U?51Vo;SwE6Yle}@Nmp?>l;K^U~?xkQC{qYY?%ZHb6x?O<w
z4{ns<XFvI|8PHY_d%xmUJ_+5_j7c1g;EdBw31^&oa-*cCaeQEH^~XNey;A8b*04QY
z*?OV~7&JfgiT|~|Y;UYfI^RAx_T^*0;NHu;g3Rmjd%k?1Ivg(WO#AM)P6|J>{f9>d
z$A118_uSp#S<iM6xCiNdkX*dI^U44HNchL!uU1ss^RLY7cAr<iCOmr8Xi&xoE<<?w
z5P^N7kN)5h;cf4Juj>k(?f!xnHKc#e*}pP_`==YG^%HsDefNehec`j={U7|WlUZ@a
z6~kNJ_Kxu3Bj2Bs#rvD>PgL(PVsbQsM)mIOU;V-!R%{h^-Teig1uwVf?z($j_N%VE
zBK+Qr-ETPHpt|@@E-+qWT*t5v;GNpYLzTtxr#|*S{>r=~4(aFXCww_<w#Am=@lV*u
zJ^Wt%y4N@4{5Sj9-zkardPAfnk_Q!szw7PcC40Wi+S~zk9{u!D=bF);dcN~>cg=H^
zxmeAKTHuE3uk(i$+wbrUkACFJD+i3<z%T9XgZ^L?6O?j!GEZUqh>3@m_!bRw%`1E?
z-T<^Y0PSK4-oj?6_79c0H>w$kZ46jq#$xK3ze&bc0Tm2Q1JoIeP4VM#)W>q`WV?c}
zB}Cj7f`<p?dOo(}U8VP{0o9eN&AKL8V<+{wU+tpRS=Mi+5BGR*hVxzo>Azo2o*#CY
zg0Nc>#&*dbSg8#X#$1C34hO)sY?EA*cVTws8bO6C;lY<3l`!ehQF_WBJZONI<|7aB
zMR~|8Iu@*X`1*zYkWrb71QgF%08<Ep3n&a@;<$#XAiYL-;frrd8ye&-79zz_!NC(h
z&RjeF8DfvH;tmO{G3#cFW7khxm9fbg`Z-MuWi}~tb8L}ull)~w&teZUYg7C(0rLUb
zs-hdcFc{h~X&!3Gnb$G)y7U}VC8$mQr|NGib`?|9Kuv$el&RNVckITc9mQ0vEGD~o
z;F6C)W%e9<{xmD?wwmVdB7u4my^QfZwr1o&-D2-xKyiLCu0IGFmE{8az|JFZD_dNw
z#QpH($wDzw!;2TIw02w?p*n4Q8*fXxfMA!Nk9wEYsXC%Vxv;*4(b7O|AYPUKOX;mP
z7YKLM;tF~CxujQMn-!B~iM8FtC`>PVlX*R|b;8OkM~_QBB$e*}Tjczgi~d|^h}8bU
zMLb=9>+2_m^UP}(PtJ`u-88JY;z~;LGq335IrzH^FQ|*}^x_*|{Yp6J*S|FShdBKe
zR#-95iWepxs(1!B^XxtC<R2Q&Z^N4`KSnSNLxTJ7yDwn)!_&EFOcu_t&UlLAt-IaR
zcL=Y1?S5gs^*8W^xA@bq{Px^)!pXMBYq$Fxv#;_I?|G+hyOA2~{UKbTx?XJe|G@oT
z;~zfT;hE3&kGy%CHbF4FUw7TLfo&r2+U*>uoSkD+PVTFWdFTW$_w&q)SMaTGe9gVl
zz20p?y{pv=aIUa=hcWZ_P3qleKlO?5hu{4!?0>+4=4HNi?6)i*b%GDoedk->3@><b
zG$4v+H)lNM@n+^;Zk>6|ruo^P13g~e!UH$OFEh-Zt?zyNVd2Gl?iKbhPhow~P(0AV
zsn%{z`_T`5JX3tzb2fP64b8)!we7(J9^16je_VZaxZ{r7okaQu!X39q&+oRhJ3vrR
ztg7~@kAE~AU|Uo?IwQ1=002M$Nkl<ZZ@1^?_ZKqxKDr&yY>ko)G;uP}8ntC=ocqLO
zo=VXygLo=WGrTtO{@sv>vt(kSds*TDP}}kcEw+=T4UayOnLACG!FTB*`yif;X~-4#
zf?nWZ`a_JvcsslL5mh(755D7)mGX}g>Qu?(!rJy+d)onnaGc8yzi#m6olm_@oC#Ym
zxKWsg0(HWUQfn3OnWTaC)eelt?U>d>eJ-=|GEc)P$>p*ioRSC+prtwsBMneMv4Iu#
zOs*NIus>obCM+?O4h{x}MOhlx9DvSgzGAxQNx@u;KQze80YA>d;~G5Z!Jq3o5Mf1v
zB<7rzt}w(21Eh%=;ncuOx@d6*z(KIo+n4+t;OH#67UeXRpL`rjCk#*JTVP>8acmZM
z(sQ1>&+?aCdX*>4grAk>-#^r1dSzi^GC-iQ^NOA?&ba$s0>**<!K#@*)#B-v(c>_{
zvlHWs?`O&DJ8npB#jPA^T5(tw)4DMTr+YxR(*;i!0XLx8J!SIED|-&vJ&qUF(fD<*
zbtxKznc!<H3XH)_?%g|BOve3eIzR*7CM`_8=SeJ!ljym?7^5M=@WA!Kzx;v?swG8v
z`?$}2c<=PbyQX7bRMl=nEn$G6ZrW(+Vk~8Uy*Md^w(4i;d|D7()jT)XSYyrb-+S%}
zcieuv?HBrRoJ?68DWi?!<-6MItNZo<(C_xa1N*{a0KD~<Tg+e=4OA_PGqNNm_G_)Z
zc6j6?R}Qz^{;ZT018%>t(jy)b)-+FR77Mr7>-%h>&<ZfX^U*VmguL!g|JE1y_|X@I
zhM8Ae?J>U110PZ3;Q;lnQ(%AQb*+r-?|$>Y{^cIyo#yQXkG)VIv-)FwPvUz_KKA8Z
zX#2R13#@G0bF6OiF~8)E03I53+pad*Z1bS4A|`A+|Kaz((^QZD^T|(#r#@|4FFuCz
z|FH)lWkRvbUtk{Kw0Z6Wx=;5PE{88|qR6!u$}HnL9dpa#DLHK>VGaOn2QbHse$3GZ
zHMbDQPS121d?<-|Dg7eA*uG@K-oUcDw!}Wf-FLs#sW3yrqkK(kR5oAlM-<w3vo@ac
zr8c5-H_E#)IO@M2-aX|tLFUg}&gDRE-*cKb@a%~9zSDNo6Za}pNg8NbuZuiNsOLqJ
z?XJ7&N78oEm@XKN=Sw&dvBp+^);NE6u{d(Y?ILVVYV)*(wpAf>ZnqhAJg&6nx#^~x
zgwsy@9+RtA+o6RnMqhag<Lyg42ZbjM;7pvZQ4ZJ2CuQkOJn1xS=qPMKzm{T2Ck>!;
zA|C)9u1Vu8eB#N&L0H$E9Wb7z009iJ5K!+&7y@EII@iRfjB=t`x)_Qnd1TOq54=TJ
zc_|Rq80ZR@u#CLqBOY1ELmD*1i!hMJ#hB`MAR2ImXA7NXgKWQy-O#{djHjgBdfnxI
z33rv>s+bvk@rs*dQ)Bz5L&GC))>1qBB*RcRQyr<1fO`$cVD;O*2BgOBbGFG*9B}PM
zGN>@|wo#;Z{}M8u#SH$j`o-TQxlIsb6$WSPJ}oO=!4o!__Xi4=vs-Fyn3bBWdw@Ya
zzP4ua+oXNc79{LpmQEzHt{~xGX36@XHC3=g#*%|MucRO7kVUMPc#@N$_wv$H*6+RE
zy(}GyoS;cw)tDq{;6WC7Rwqq?QFWT8^rOY@gvJ<mhaECT`#z&a0*P#huy&G+4JM?t
z)hQSD7Ut*`Fm`c_JJ6rtwR}^!u~bnp?Ed}gzjaKL5ACsaKxq&MknV4M8v!tybMyju
zQ2*_!!8uIek;}f<95qnQA4NY=lY$UNYL0#(-FgCV!f)Bz0|L#9x7qILxiOfue{@k7
zMXTLenibwcJln6mMwbIP7dfUZy1BpL7V)jqYzSrX6mjd9c{tBp#^*B_hv&t)nxW8Z
zM~<!didMO2x{UZXgKc5Q+iSMw;F#z83}Yl->_%bVp3C}8X>e5XmRtISTAUaq5#0yX
z4yB`}6qrM}(aP#UW(bakrKULsn!uVD5Ag`hbEvP;5ow@|E8>*~O4UGYdC|E~^|=HF
zwphZEhBit!;p<TX`8uow9!4S~N7st**ebC<QYal3bO5JO9JWjHae$+PYk;%tubiO)
z5BPzLL76ZIwouZ6M!Xa!9P*QoYtgh|PK&S`T0M~bz(^U3M7RbZD8Y$?3HelrG=G|I
zC{7zZ@G<nF1n|X+coe6CfD4GH!r%asiG2EmH1q&D0LH88cOV+jV5tGObS734n3Tn8
z%;d~&x$b)D%$gC*sw0DOhT^aKTQ9*Ae4ctOH4BUn){eu#O_i;nR}DlxOWVCtX_QYB
z{8}25>^Zho1cQ}BgZkxn9&zlRH%P7#YY<{EanBQ;AQ%lcy~n5ubW5uN`GG~baSIu<
z(a;US7_<EYCuoFj*E(?0^Md37Pb=%EAF5IOekgQW3MM8Ix2OJ)iHw2wa{Y*FLZsOv
z*+I0WSXO?;Z?Ify{OUs4gSWiToiu6C0XIW})nzFELTr2tF!Hl`h?&U{AEe+#&%LGH
z3%h(dDvIN*0b0ilzxOKsNIHu0>&9QNyfR#W?X_XO4K{G%`@Hg1_5rt*!o?R|6xbJ<
zj}$)nsZY)KZ3gMa>#q-|ce$^4`I47Gk(;R-TBH}}2F2LM*Tu@vj3&98@q|W^PGfFU
zVzW2<d|qaq^n{HkzF#cf!i*s!1@?`NM|4`SvBl@B$i}>tH_c|d=O}M#^)&AoY5CeP
z@9~y4qS{P1V!^$3-I^hIuHSo^5*kq(MqHFfZH#%G&o3<CZ>5?DqpqF9&_cyy`fGr?
z%Q}(vRc4pUN+-U(8+GJwlNp1yFKhR%QYP@J{S!(Ic61gx69>>d>0UG#5+<*VyKEZ)
zJ>tOyPqZzVhtoxa_=B6$hd*gLlg5$Kx63>oK9Y<0DF)#b0RcH6E~Z=q5{@%QT|kUe
zr9h87qALMKhkW3ZPMYv7m@83fisKAl4nQ=;U%Z@dnH4XxtA3klKoh5CgD&|x!D&X{
z4RYBc+j;=I@pj9(>!Sdx!M41&T8b1l38Mq@Bl8wEnGls)>~beEs`8IY^hA_pDj1Dk
zt&3FDIrkz?0@*v*?wwuh{<NmlX{u49UN8vSL0#bKe*P4*Q!+!ulTKVOCOg;2%s^W+
z1beY+&9A7~(&g=dfunSQSGsJ?2%0P|j%g4jju7lNng|FpdRYdo2CuL7u!Yj{pw3;T
zX@i4ioYK!0Y_V@K8H|6N2(z%~!C}#xE6rSmmuU^CFBoct97m02{n0pz)`d*8<qy68
zz2URRec89hU`r@IF2~UbFcKeq)CX+qjLx_AXhf%zxaq55@5QqscGFObxN2;jXiGSJ
zG}^ZES~O|KR<;nE>vOl%=pfADo-qR2TV?h@e)eSa6h=PZPQvD{I2`biQ0A6AxaT9B
zapF<b$#A9aoLevVsy%hB3mQ=;PTJxA;t|Y#(u~!4LZgiB*_MLA{K4NU%&0|U@btQ?
zr6^*VAi^9pR;CeFsgY@tb~cN*9GH`r2<{zhbOG9judPd@-+)wR*>M}B7t3%s%RnoS
zUpc%Y9C5;x?b4!h`>G7V%1adiPkFfJ;9B`Pr}k0dOAgY6qd1GoDj}grFRzX==EkHN
zA_&|y&SIi#1d7_P6-G?KSHUE>Xz7|WAZ4ZWz}2CGsvz*^0G~6U>y!uhcn^yocohsm
z0}NgOH^W*czf+)wW9f}irsT;ZJc}9BjP@)Hu|8-=o;l7C12Qp8+T;;nA2OcUyAi;2
zG0P?vZu~QOIY%VU6nu1YM?sdcU+PAaI;WE68c*sSalUsPTR9jcNq*h`Pkegm-oZu;
zPmi(Q_l<gMN?_1tpk;qx_Bm#dwV~GPwzWM|TCU3^)Q_&zminQARO(;)qf<_9$<nS~
zmcy+b6?7AE1}%^7B@aJ_58}x<VGH94`eW;tc_1SN3{fa_&4ZM<z%<R69CK~fVo~)U
z1sbAE6{}HeKy|d%i;h~Nk?{B87j)2O3?GS{9WZ4pmxK0yUD)GgdxsbAv1dp>0IBQ`
zJaB(F)jn2t$`8ID2oDPi8Xifn+*?_*Idi_;Y)6HX7E7!7cDuaw=?oRjcNW{+hyEKw
z;XE_+dp}-}I@|yTLHWKb))I^<CY#xXJ&e~db2awm#5f#3I%jg56PlJC!xgd@ZWz1O
zFZPnZc^;pKG^0(t-E7tXZ1oc7=~*2bj5y5&ZIHs8CB9u06RC^-7L=E#Sl1g6sG`P3
z19AQtodL#1s9_3X^Kjm#PU~}j>}eaUuWfE`fAov&tv-lVd?F`}4r2jEAMB6x5*)Hc
z%3cW`VGTfBD-1sNPxc%pP7PVKM9-3PL$Y{@zi_x#7+Ua@EL?MN4Tu-`lmXm2C>n&x
zkRnP55rz<e5TvQV#GxSaaws487-vP7d^(5|fAEMWPTNIDXlRMQ1#?>BK^kHBvt>le
ze^6tLv8kY$2Dp)`D9v!<?QW0NEI*B(1H*9MoSGpIDc-jLKql{`;^N=E!YqzT3b@=c
zSd+VVHHgxTKX<G`yB8^F-(Vk5(uBUlkq-tS_u#NWi`NnHu;n~{z~E{fsmV)wa&O>;
z$cwC*&S==fhAwz^fjaC`)Y`f@*H^<S=>si`h!<s$Y|GF&Ukvg<11|!V-O88*2VP>|
z+t~V^Io8N*gmA;KE#rN0$Cyw-rGZKV(^~`g{`bG(q!UjF-#+Q<Vb#@E^N;EA(Ym|u
zyffT->n-+i#5-#3oxxV%&A;jcq>icQM!HG#H#I|fG0fdL7BBLL<MZs}d~>pKggN6#
z!PJ8BclK=d7mgmn7+dDe!!SI@=5FRO>>nTF+b4$HNR1;cK&Q+HAh@+Z?jCD348eE>
z$0j-Ad)h`N{*arwOf_d{qp2#nQw<EDbv0y7A652S7JQe-*Q~~oHh}}vfI+4l*&KBp
zy#k~C5tVXHnhd|-1Edi~P;8ZeXb7KeBmnThffgMT>FS^w@fW^uMUVWX36xG8^5j)O
z23a8rfoqT;r~(j&a1;cBoWTc&crnx+0Y~`aQ>4c=24K-@#$O)4(2?-u;Tjs8Ia0Zx
z#rms)A!~p^mcxyoO$ILS7~0^p6C1BZZt`rK{P={YU4{Xtv()$MX{Y$M7EiCJmL{Wh
zhOQH95_k){i8z04SXJ6lXY5Ze_mJw<ZgP}&0ZCmXk9+IQTVTCLymMtL-eoenb9j1b
zXX>gOS?xRyAe|wb57bsaiCba@>m^Hga2dhG?;HAAIC)-^v3p?Xp<PMe6a+e454XKd
zeIjl(J*kT(kk^qYA6J8f*f*ntq6}qo)qRiJ9<I)7WuaHG*MHgHeIh=rqs}|fC)W@M
z8?yV22A0@_m9Y;QTnrkR4HofUj7mp?EqX=0i3ZdMs6IA9n^Dn4T}VgMNC_C}ZoTCe
zKN^YcZ9hrCry;)HpF|EYs6KD-y$xe<BY^Y&&)%EIOH&kizxAB+EPx9Lq9Tf*xUjl!
z$POaA8!B$&@{Y4PI^(=EbKkl1-uuseKli@(z3*(UuQTqV2qKH(0s^7}?ji_?h^Q<A
zB8tlLJZHV}jjUgFc6C*Eb$3;tKIc@NQ(ak^kr9!RnUPshSy>vFi_-IPdE6Q%C3zMl
z*BfR!T3T9ONVeHSay~e>X_IX$VD}x^@|A6(b|;Z8G+0<<rE9u{1kRV4Ew*ZSQ!+O<
zZ*xyuG0Zj?+5A(jprqi_5M8rk>35p*Fz02(cf1|LG!(f<29p_C^}UhKoVL?0d-Ajq
ztp+M;fL7G834=3@((0IdGx=ppM%r?1z+Ayr9kalKGH{R08@NqDYCFV0K1(@Uar6+D
z{}VA70EyF?fsAx$5av*t1>K!Rns{&q9~{EsVZqF2DmhRrIFbh(^2Pb{18JV7GazFO
zWP&&&1{pYjxBww0#7RhvFcO|?4)Q@mbaCzi#KDJn@v@*7Kr4MklX&nbtnw?)JUX5S
zIiRUC>2ZFpTUcWnV4&Q<2ZZcN(bR!WXgUMAHO6#sXCmoM(+s7rK4|`_*3_wH8U*4s
zv8DhgAYTS%5Cm`s@xhO20p#-m+Rofi@HKK@4Q$<rakhn418YhHHZ$NcoKI|4uz~x;
zmA+@=mCt8Q$-Xs<$u~)-(3+~-wlJ**S`D-sn1BXw3M{bd)*P&SbdD9ndhj^`_5)ck
zheO8jke^qyXOb;jwpiRImmAr6U{SNLb)a0+fPh|b0JHrEtGrim8ZZs&Xk}<MFcA%K
zI~lfYtM`5zyX%W9?2I2Jyv^ENk?`Lb#D$Q*k&gio=D@jwpAsO0;&IFZS^!HtApfVF
z19IRh&5=?(aNsXo&iFg^fjaRg-qmhr@mC)CM}?z!Lk+|{5dEkSLZpC%V?kUq7AIWJ
zDhTJ8sa-lA`N4x0LUPTSYm@{ZK=IHajB^+~XbPaiA>2HF<xv@wuRTvt1KxoKjk=cZ
zc-EoQCoscFXe|Rr+l)C^nf&lDYPx`C9DpZTi)<HQtrA1lnY6LjFi-kJb7hAx-zUoO
zr>;0EOpWKTcCJQ(c~a@@7bC(<IBer!uhrSau<lu5s5h%$pKylyBW{sN_)0s3>1(C}
zoWXR<McagKZgHzSgi#G~<2Se=+AQ)6Y~TYCOlXFIA|P)*t*DTb9ww~ZsaWMsz^3Kw
z$RN#mH%a@7;_5hu8VtYC^M08A)<M4#4fejquJUU(*dNX<*_6ZgeXm5J7Njt#3=axf
zpUkz(LPxNJJ}C{=!muUMYG5^MKm$Yrc4=DF;+8ReIPG)b36-^Dk%K0JU7nOy^5gO_
zW3X^3L7q-tesJ<7RsKBg;A?M={`q>|rkYC@x6YfBakD#z8PY;?&GQ>fcU%nT8z#6u
zpX1|m8_a3V*uvhzJb+{?304f_IN@GHj%}PN0vnAKoX~m1`@RzCD2nbUC<!IwJnP#+
z-~_hzViA)sXNkalqNzI;tzZ+7S08kyzB)D5hd`UOdNmLXi8bKWR@2DaYhV3siW(Q~
zdEeL=9(d6k@R{%i#DoBoqJzQ`7IXP6xt1bGXQ1MmLrx)-C46uc<_sR`_&pUL(-VJi
z@_FU6B@GZRVaY%o>B1qc%gM^M5I_bvOE9isBpj|u(~4a=baj>x;Dd)kx|pYNcJcy~
z7CU{37k{1M71KjegZM+Ig%#2O71s}xo^Kfa^7N#c(WHTGaN}tdMYIQTg(D*4&T2KB
zLH?00?^ZVW`^sT!;HHcv^K4J@=3s?2(<pn|R@@|*T)D0_=+?^JsN2BD>RSdatpJy^
zzgAY2iG_y`6qhy?ULUj;Xg3ARe6`yCTosMzV~~(>%?!frmtICEAD_P-%kuOSXh0fr
z4B{QjItX_FyTas{J_t?l=w)1`<h{A-im}#ieZXI1vzskjA8&-M&rZ1QBLi=@g^x6b
z6~lBw-YRhW&x6AjS`D-sSQi?QC7z50UTKx8w3Cn{&#OKShjD~?ynVdQoUEOXl1-vq
zc^<iPS}~c|@rUD=@r{KLe1Hk3FsU2Op~75{j~sJ$$8de>$qQI|T{}w#P%AG^sEu~`
z+i>Xvmr^07HX&E9R&On|8dy~tpfCD^n0#9vuN2(JJ6M<Sds(}m^#?xVkuA-QSux<3
zn+DEI(p4z@o;ZOyhntE{nyv!{Lr4LiDEO@K1qX<6pe<gciMHZ6%V$a&c{u};i!gYi
z701gbOS*%I=~`zp$)gREd`2+`U+E}E^rRTl!6iQcu7raJc;q2H#vx4w17A*G!omfI
zLrTc=cY0|h8d?ietpO%1senwhh6c-n(~VWPSzi#rp@~f(gB8)IYixO8at2Y;CT|z)
zJxeUA2otq1xug38{dn^RV*<iXAB(Jw^eKK(^>471yEFa)iJ-r_OGaJtI-2h-XT-Tt
z&})2k^D3l=0BQg6n*eJ^A<DivZL5^&BkZ$;Zd`R1pyzQt8g%FEzUrpvPPcvtUFaZI
zM()Zv{Ds;=HZBfNVx%0Vcd_m%E43qegru|LM`Bu<iFQI`@#d4Zp;F|r6I8c-I`G&$
z$_Rw^&chJja)>^{ihe_%tYg@0y1&vwpEQ}M06Y9OI6H?|;8sFEWqNDl8__`4*QozS
zIIMo6^o^db&=axh%juRW*9Nk=PQ#_kv2|{f)3C-iI9BBfUVbd36h$TR;-o*~6~_@C
zhIc1#Se<6`@;M9PgiN<2=wPg1$cn^jVaAmW_K<OjvyXQ;hr{aO*;&RR?w`V3l{unT
zqh>Xc2Iz)^^*d&HGkZ9gPS!Ulm!Y!|gME~J?&}Wlv^{Xj3Nx7QRA5+{SlJCw9?Gg?
z)s<x`6xs^WoCfGzI=Z=dU$kZ%T5@;Vs8?>of-$l_5x&oZjcXFb&Ui3@z>I@JbB$A1
z0^rw_wTb<h#A(0+S9vrbkp>QF<in>)9O;~uuIre;e6Hjt436knFp~!w0BO({Z{jis
zu3y-XgyA~QsB~o}O#(xh>o`qLUgE_Vr!F|;<E%6bI$z@8A1jbJ4uP)88y<58`uTjM
zL5K0Lg;k&duO_Q3+@9VFMvys7YRtiE69K=u9)ZS0vv_ag$4l)`xt#w7oWx9UOe;2d
z>%3_JF0XqTKKmv+&=rVZe=x+n(UpTvXKb>FL)fiS11jTz1S^DL;QNKz<T{(QHoz}W
zGW4V11a=wH!IIZ$nD9$y8l?02hrL!StduVZR|z##&`{JX(#@lZ$4d1f@z2Y}bu3dq
zyrR6L#04Iy6&{5^<vc1)T*Atk$3*PR39!2+0YYF;vALbZF}d{5uJQ-lZ&%#xSr+2`
z4Fi*7d71sa*ROr=ufaBT-D#lHX+qIg!gw^S^k9BE1)b#Fq2ZzpAg?kHTd8?`(J5os
zFFjAIj7CvBZ(fD17_ix_Ol3<lUl~_~KIyo0d<pHz76h1#at?>B>zFh0-HS~&?gWQ$
zSUkYPN;@nrn><ch_7Z+!4$GJw=G@^yYA39@u4f;oYD@Sx9UWRK<?C?rGOfb0bV|^M
z)}{t%l*J9x?}?eu8b;KV$4~?J@#YFliQy0N@AJ?(;?6P#hoY>hJ;4Xbq+EVUq@ZYu
zCk_86&el0QxQ-pa;Dbw?K>6jMB@YK6J_>^y<3SHx;Sq*E@i>M7(HC#d(C7g&#sE<=
z>kt!NgG(5Yz%YdY@nQ%wg*nIR<Rcx2t(>|R^f<{Qe&8st_=ykKq`{wjT$4r~=o1%x
zBi623SOpsB41l9dhCNR<6X?)d1qHXpn>O)u)c1y-8adgyFln>KZV}!w*jj>SZ+PH)
z7f|^@5QIcsO~rW>kwVcZZ+Q{2VyAi#DwA`zifG2^W0P!FB;XLXKiVM<SYO>;F6!7R
zlr5B(wr+<xqXX}BB99Dq*nTR`OYJDlGy?xjyZ!SzS{^rl9g`?eBSm!>=cqp{879MR
zbonKxDAX*klTUfbmWWmD=Z4EtL0&8;tA%Zv>9Yv852<~vkbQg<t3IzmbWJ}s-mKyG
z)j?*n!qzU1F+Q)B!W3)3>R2B^$ajk=mbw+KK@Akxp;6|=qe`e|I63Phj<LkUa0izI
zIz_Z%y7_R7KMc>5j@fQ<E!o5OdEP#;c^3{=Z65|!n6;<)D|n&}h3{P;Cv!&}!gj-q
zqs64enQiNA9mf}-m_s-?hRJ88w1aCev8$@1FG8^<<6?HO(%3j64#%0)2hub1Y(Q_)
zg!w#WAhwJ%X{!%9_bRF0tq893tc|a}GPM$~6AhS+@Wl=E*U&j@DR{Wg4R%WRx}iHv
zr0>g0$sdXTkvRDu5e#Q9aludpU!<I~;3<s%Q(=6T;ERrYq!fxc4$_PGTXdEVj`E5>
zdE$J8p)0?s1p~+dt817_s}h7X5mq{BF&^op0i1nxuALRnnL~L<2T&X`h#m!zOv-Cf
z?l{)9oW#mQyyC!xKZ@q8>9qx0SPdHR29g?&Q7692x7sEM9h<3c!q9Jhm;baogA*oi
zOf8uNg|4JBdk$U^a|oG~Hcj=PN;bSmrifG(L*?~>31@IRnH(x}C1jgK8*S<a;KNnf
zQ_D*EM?kX1z`of&K&Fj{Nje{}gEvkt8jl;wPU9MZk+RU@sse4ZI(BD>>839VoJXnm
zZfgCm;2>`5KmG7mGA*>Rjs!l`buPyaQFjorzSgYLGmT5+&{`X2DrVUkew5W#8d#7U
z&9DMN?IA;KD9|Y{`lb(40sa8X9`I1RJXmr&-gJdDRKk{QRSl>uOsefwm1_#|^5e@I
z>>J(+a^;-H`CNUigA&JWpZ=geQH6_eV;WWRfg|3-@(lDtH3k0E(ZT|&hL_AKywMjT
zus?h{uvQhQAw20QkVjU{6>U3VA9t9?2IsI{`@B~78CDyt7B*mSV#`T{jaj0Zj#Gg&
zN!{QPQKYF{vr5Ir^TzC62Rv7B`k=I{jdZi%s)uhc%GAfi^ZHOnojCxy8l{C#eW6<c
zr&0szo5Ki)ZJ06t1oPNB+p60HD4I~%S022@He(nWhrx}8VTz+eH)FA57-PxmVARIV
zWH6YWE=xM`S~)CQ&>#$eLq71}!I7t<e4JH9;3%&JyYdJRTHwP^@>{UueDw?a$uo$B
z04IMfe29y%m=dRS(j+ADQpjctE3e|o13qW)I17jePlxbO0#0B6e5J>EJ+b{+MH)~K
z9Ab3WWZ5g8#{p}q1u*flBH5M_wD6#w)OlkU;m_*V_QM3EizU8XAL+p-agG5}2z13M
z&CXG_D0aMH%CZ^}Ay*Kj428jB#&p8ozV$<>2p{y^85~|;VejBZXQk9P2M%r%fkAPB
z4}-uLNYh=0GQ|YUdVfdaHBzQ}<?f<}JZgAd2`h9VSyn(#MJy%G3TdM;wpK2)uy(LA
z$_j3MNYDu>rnxf@bKI7@xw6T$^>N$g(O=tjXYml@VRKTplv@q78dwnx$S$>ZppW{C
z2B}F}aTCqh;XK80%BtZc+3Ztu9ym5Lv+kpgs!7(Sd<<l~@kIq;!2xB_mJE=>Nz7i!
zavJMiBXe9be@e$J@TK`cGejsZtEsd-2j`BZ`hUPeD#k>oAJK#M`hZMJUR>#JeU!Z|
zW!)OcT2rHA2#cg_5?ga))my&7*6@Y{?!V?CRTZk!LCH9{#uteoTyrLluzZ$;aR8Gh
zTxR&(u*Wp)vMU`r0`h^cIPwAFFP@wgM;;)~EB>6p%RsAfvj_`-APtL{3W_k~QK3@r
zgEO;eFPP30Rt04=1fZ>D(n=SvxNy*gHwW>$=8O{=AdS3Aiwi~`tvt413#(BBVd9iF
z#)^hZPl|kkVtF>KDW@<_z_cdKDXa$Xs!1>0k&vz$)@oG@Xbk8^Ml>v;x6Ik9VqqF1
zOI)_s;OtkCW1j=1iu4eR!kH+Ps~?ccDqtX6tzgO`hJAzi&_pmLVAKVn9NLNksyK6+
z{)n7Af>Y-+4&a6KV{tqv@Mteys^hG|j8o=8+V9YI%z->*);swW>Q~G8w6uiETH_h{
zVt|u|sW^U8Ve#(n$IWxM+RW9ZRtGi3JJfObEqh4S6mPa`z}8XQJXi5nn%a=%^xPQl
zh_FhJ9ob-;Ug^yPJ~T@I;^B|m#VAi3Tw@yWLEXxf>wjykl=T)zy7GacxzV9sp@*k7
z%Di}ZF5NjMH}-b(4Rf~qxW{-nsD4S0aVSB)6nS2{1~1Q(+st9X_&ZCRZ(DHN+yiFI
zHzk`knPb>j-9oRbOvCaX1wS6|gYH6?vatP!?a#toMC%TExL9#QiS(PE)4s|4lwFZx
z2pATV1>)2Y_IV{J>f^mAYb(Zd5to(mUWbnfIUTO8!ndVqTmxx)YLXB4-5ct>@3y`l
z?tO!yU|)0I#GMqRrbhz<w+Hw&5rEzp_ecc9;UMAU|HOEbAIC8H<9y`NwP=Qd20Da^
zCqMMWpFGNIK?knkFM1j<xh5ZUz~Kl6-2woa@{ngBB4h?6ln5c97=xoQLQ8q_#z+aA
z0nq?gj$YzKQ#j-&5ApEVmJsk05BLHxf6)&q?eDtMfbYF%EyTA~P|IB78t}%S-b}Kc
z0MMCOpbU@jSJ=`-KZUQ|s|#5tvVFzKp1MaIr<R`%i^1f)?htr1z<|qH8=T|AFt5fF
z-TJG5j&2iwX3DAFt5K+q<u?(&BAC|^ZJ)aN@XDSh%RW(b^H-hb*qEbN&)BS60xP5e
z)p`BhX@v?@%+~v|m6cTv9UEGV+f*!L*rM4Jx_y`on>_Y_kDEgr#x1lOXf@Dkpw&PX
z4fGqZG^kafGdj+K+3cmIt!~4EV_38%!(ZH*IQzW<cidK#)OnJz$sS<#tAY%>4U}u3
zRbaVp+LUS10QcT{cv+WR@m$>BHpsTBsf$B7o%FUI3x_Wfr!Ij1kvMfs&K&qO6~=!l
zzp0$L<lz7mN0>MUgZL~TC+X0Ezw*ZX$tO9$(>3^jt~mpu5w7ev?+}KVn1jqUnI)VE
zat#v>rIU|q-K9tf;YcCi69;YR;M^5m3;MP4N*>`Vo_xp-Pvs>|=@ty(hI}*7Z(%|j
zaHC=~jO+>N5PX--V6e)S)m2M8nx-YK6HrmJ$ry!KWKIVd?-+c~T}5orZY&`JCk4=<
z8{+%@dfgd9x`?+6wVV#Zro2+Yk&6!B1BRNd3|8W@4M_G;j}6&Y5rsL0J@gp|4O>yj
z1TEMGY+89eG_fdyS5a!X^m+`{vt(OB%x&8m96?r;jxI_nHKI98utdYXB#<H3ZhDc3
z>26y=U-~W1Q6*NjS#Rl!IKxS02<@>5YvtmQEw6=U<Wzl!KAY!RuLjf(!$YZhX%D2f
zLDLwU(AX-3S(}ywJ3?D%w%mEy(DkDAecw6)&#*yw5H;I6h4ac<YuB2<<~=NHt(<k1
z#|H+D4k=;ju}(fKOiS}(iQ#js36(RaT^C_;RuS$TaIDI;AFjrBFGk5v9;Y9@5)u~8
zTU_K^SYUPAQnJzZ7Y<u56lt`a&NQa@c%2qwLd|d*)liE}c4tvIx7N1=f|^%<o2f-v
zYmvy5bfBu%HLd~{lVP6uFlEP1#~7o9)hF1}2AK4la_JNd<{WfBZvMGZKu!4pf@{(^
zlis<Z2yvnV4M23{JSLCmh60Cc#fv|Ag-4ul#aD7cpLBpY@W`h!Sg_Y245BiEET(v{
z0j|LjV{j+{XBZH#JjCfBKX?Ffc-IkxgKL3=6CL7-Qy~@4IW7=*x<)?ofWw=fEv#b=
zcmuSFmp7ocF_gB1@H$wOoH~7NR^rZwC?#_Q_wQP{RJ+uQW$MIJRUZuve%XrJSoj*l
z?hxifAtryAsL4!?$HaAGj-RmSaoCf1VQ$V=ZHHIIGyRRnW`enMZDE3(>tjV3;-RWO
z%JooM3p%bx6HQR@)d*Jo;Z@(2(KQd^urNG?!uIg)txuTPBYvveW)n5i(rh)*YG8e8
zK=yZ%<FR;3<KyvW%DZf<h3Cws^RSQA!Z?OoXf@Dkpw+-?)<9S&g&VG3VD8Pq0+C5O
zgDFYsrilHY@{2MUXcEpq0gfEJq=6^jrmls@wGQPIElcY0e}V%(I2_Q8^Fx<7rCZR$
z$_Fm80pN0-L4E{+h>$n~6h?7eLs-|~Lr_j(7$J-lrPaT>7OtT<Kt~SfEooS^-~&jR
z5}bG)q!TYbF@NNkZOGRI-xemV0e4OsQ>*dvRi!zhtO3wKIMkqX80}?04W#-jLP4kH
zpj4R%!<5yq+VE7Nlo09ETnU0jd;c!z<m|i2*PXS>u$;p1DHKD469r*qvVU=TKzYhI
zk<HsC?VGSKqh?j$TrzJTB%zT0XNdTL{F|+wp^V}%@k0<&|Eo-1CcHbt5FEQRmR!a3
zMy!Go%0<yC6YYA^pm7`-;!+pMAvu+XX6n-p?U2S;*8jw{p0mnYpZvqh#i|7MPhMVP
zQfeR5@v_^V!>)*7sf~^w9Mk3q_I=@bSjWeGHkhpl@{LZp%{kQ?&=@!2_BPcz8AiCg
z-lWfAXiPb7ct|8$8HD8xxjOBBKNWOyo&;APgwpbjGd5@}hhBc%EGw~ildk+_xV`c0
z4IhBT1WU=>JRb$N_fR%%vV{N}eWY$;?%FF!8#8Shpk;)<6n>E}Tm7$QGi^e*@~l%0
zMECcp256$$qJ>)SIjkS>pN`@53bu38o63_=eE4>X+j#~E9WIJp<Fh1DzEaNeMM^>7
zq8j{?fc%~@?wrL7PiN7D4sr0772wPPf9P?LPM(;T3m(NOAM})F!Op5(zpx(=#8d*u
z0uTpKDB(d|f)KB8%uMf`6Nj+SBrF;#kmz!TE&#3o+QgF&9LXl0;txG=mh$sJi)&$(
zYJdu*T2pu8P^I9B5)Q%^Dr%s%j-zfYzII*n%~+npj5$<iH#WHMr|HJGYcM|CaPdmH
zwu;c8rP5Y8<6QDr@vVU~$c2x@EqJ(R<u(LEN2o%&63%ess$zpz6}OU@Q-HLZ%9EEh
z-%G|-XQ02qR;kw9oqGgRN$M^^52L;jfjc*5?vyoL9ty1lAcKE!&g{mFIfii@%-EX>
zVc&Ng!z-()mC(t$;Yro1L#&%Zw*{@Lfqc_g+m;|M?W9X8-u3Xs;ouMTZ2mVhyOeCQ
z)xvBM)OPl&Er0FfwZr<_uj92)Lhfg|2d@o`6x6u44s+Y^*6bwv16Dq@^!P93M8!bk
zdz4=i|Km1007M3l1OKNSyX=l2a^OINgLuvWbifCQ6F>M67M{|Su6(Yp6c=8^b0!`d
z0`e1=7OmGI9A^R%fEfe@;Bdt85|DUs^Nc7Q-Z=8;<8k039Jquzi>B}`%5lg8T@DpM
zc`Yha5Oh$!a7k-n9cVy~I2u6SL*Wi&S{6^`&8W1{v<9dJuZf6}97p;12xW+17!2~X
zaE<VhH{0*i>$&E-Hg@i8wu!p$-)BPbpdoyGsv<AsN=GuBz%Hjn;bdC!J%|^=*PL06
zX!^)ESIRdY43XcMcVU-b6o}M?T#(*ORGw?Th1AD2&k4%SaT{OmSl)W&^og1mzh1h%
zWsb|B)TVigkIvXJTb;nAjVbOF_CDR)SCylQGZSMuesLW5ise}zP;KxPXP)LlPFg=r
zl(wbWYM^Efq<ywSb#3;OFn?eXg+V&+=#;tHkgWA&G%IfTG7ZBWTy7Kq-O`4u{=ecq
z46kB}tQKBcu<gNYjA5lP+em2N{^A^M?Aq5rxOWPDIXFPpewo`6HlYE{8Eddqsd&AV
zn2-8VLjj=9R+D_cLw0a+iN#W+cxnw?@+9P|$jAG&{FOzHRrxO^9M^>9+~rz}UkQr_
zIM9_-7<>j5;=z&MlQ<6Ya%hm^%r*GJwO~eHzEY)g7Jm(1;Ja`hNPi>*48)kQ1XsL>
z=nMnWICBVu&sl&V2n~>*LjsEiN>d(iNf!^|IaF}+lcqEDMbm;UtP2g;Xi23r>5Utp
zmpzSOwdJhg^`x&01x>n;-CFj05&x-6jv}KS_86MkAoEfeuau58FdRTyxxwT;ysBOO
z)p0$z2!k7CFdF6v<^v<XN3h%Jj@-iU#Ecj6K2ni{ZYGP-WuA*u*M4li{0uwO4AeXa
z{j$4njwiLz^#7v%I3DGEZlsT)&Qip5`-i1JbG%xgb+C@&4p~z~UdH~k#!p2C-<zEY
zv#rYDfz^iP*<e>(K9i_cyF0$jErnJCQ=x&b&bl`HNj85l8?Z9=vNP&5SLak@S7k=5
zu+hVmd>CBV#JqKz9I>w)jOFJIkOiMxV&6Az+!W@WVM11!VvD$zG!VDTxUH<EGPY%z
zga+gk9*<Yt9y^p6Z~Pt^TUEonGqiNk41AW@9&IR_-jT0Lh?4c8k4W-A%GXF1;yG);
z(O^Kle3%yWbmDXnCkHTep&<tbG?Z7o$Oj&0fV23Ex8js8T&}?>%1@dncp&#9!bHOi
z0uq*MfHNL#F(;28W-40X<LCun4qoDvPjoFRQz~KN;f-Pl3y*UVf8t~QcG<$3(tx!f
z3{QN-<?~5!!Q{zTVb)-zVqVh~j{E(zNTx2UZrdxDFqD$NR($cfgYB=Xu(xJIYUntF
z%?PoQ!zSy#w@^V_>y?%E>bw7XyJclD`vcF-ZS(zymw4)Fe~^lgUOF|$psSc+9PVP}
zh#;p&SK`!OOitR#aq0|%y?rXSiACY<w%aaw>)Zcxvi%MZs=v;x?L6U$PfA|%M{iEs
z)aWdBd-U$f%U}8G<j?-{9itN&A}4zJ%fI?t)5{J+<VxQVu)e!wE4r8f_tr=?a=SeI
z;mNMMKB5|O4vPuCzp3E%$W-r+;aPW5`&elB`L>WFG1BGcEt`|Sc-vnk4|-5&OM5(S
z&r14}EF&?EGHt*8_Q~V++$)OdAEb_vcl+&!spI}MM@g-!r()XH!bWXm#RMlFJE;5z
zA9{Fl$l*s!T&__Wsy*vGDxElAzHg0VA4FI3z4A4$OP=`TeH2~m`H;hoNDe*X$R3&+
z9XU@PM&U{)%O8Uzk4qVc2jweHXKu;2DKtl9YqENrImP_i*wvx|wae8aZ!70&)Ik4f
zhU}Y47TP3ZjK4M4KeIAbINN<Qi?Hn88PHspxpsZPyuI@`V16aWoaM+REI%e<#r{Xa
zq;pKd|7mPW`Qt;S;)?vQ<m*`>OdNs(@tN9?x0-kqp;f#v064=?z%{t!<xoDt!jpg&
zmAP@i(*X?>3NM{4nDHl_1K<oj4tQ`4ofg)Z2FyfsYCTsr43b09%{g(bnzH>CoklM2
z>b|7hH2diSpTG|6g#p3bq26gj2?l2BDk$|nYp>V&Rt{Y$<6ndpwISKaN9v4^uj;i;
z?b*i@NLyTvk;SG7oI<-~Rbj}-KEcTbOj-wMx>@_}M2`@P^*AWI;i}J+qRO0>BD4u!
z+0-=cw!2>IR}MTlyk&KfKjEYoC(nA$b3Cpyi3;*u@Wn4AKe+Py$s-@NoAnb7!Cl$M
zxS$;+2~M|%@4BnEsW4|7t{+Q)6JPwY<i;C*oLu^qixky!ru0DvXk#=!BFdyQ=%uO+
zHGZ~#vVey}D1gcEvYmr$N*#PY?8u|szMOgbCk7)IU?7Q)Z6*_SOP|IbVt*IxIMf_$
zhaGve+aFZ*zyl8?Kf3PP<dQF6kZj$$wSeN_s2Q82KjKl3@_mfKKIPO`CtttxE6I1h
z_07JSUvcVdl6&s?ZE~Tt$8lhv{q|3edf~Cj|M&m=UzNzvA6#B@n6D&M)l<2QR)JJF
z9c~rEDX+42^40Qo@{or<#M*GxepsUdq|acuDifYW-x}9G#AE!!?cvk*J8WOMe8V6<
z<e?8W8`!^Hl1lTP45%H!ahP#Ak1IO;q%Ol5mUrM0nxj4JGsp1U{CqNF^G&vp*vP)|
zI7tj`$fnv)_%>~oXuwVXDv`AnbM<MUnr)V?!%o`l+cIIVnE!@*@M=`5XotB#7{B;<
zvMro)(*4JnDs+Xz9C=7-<p_?2Ak0mbNXh9cMR83&&dLWqVe%+n9JXj5w7?@Dv`{#7
zh~rwcICHK1T!Skd!q5Q36B>ZxdmO@Is52QkR0uJ^K`TH2Z~)Q)2_-r(CXIZAl}Gd}
z$^m>p^q~tr3Se*Gn1)?CKuh^ZCr=#bNbOInflLExeObg>2~aRV-7#EE?pOR9=9pvS
z&JUX;hbNP{#5zQ=k#5!ox}a88<AskpF_6SJS}`l#TY9=(;H;Uqz2UOgUD7I=cunOP
z<}TwRwBc2#f%89mZo&b)`gN~Q?*8?!lMBD}#jGU5t$@w4jUG?~8=_lo*|H^h>>iIx
zKJ|%@CV%+-??>l7;hf>E0h^4B;1oXZGiR0Bl1jxuzou(!63*#huY!YmmbWG>@n<*v
zH2L_4Kj`Eh{NM*CM;v`ja>}b-lbrU^4^?6@2<hGb^3TcqJReG)41E8)-$|~y`s!Ml
z9ect_UVmTs+<Ap`pR(_M$&seF_rCLA3e&4Z4y&g>`^&eR1NGA6+8@?i)+(}s!;0#^
z`-gu_{^|eyzmxm!yRT}tQoMKnYp0#mO}mt7!wF6It+DMxQTa7VQChgu)|H?C+*Z`{
zkms5eYI|M6toTLQAf`dCNde8Sn=@q2oWe^ug<1T7W7t_vf`5}`YiU>0KwHn%^weVI
zH6Y8Sb3T3eYf%bkS|$(NXKd@TIsmGHCUaQPOz*qhy*DZs$vtX*7Yl*pM3txz#Q(@a
zn$o!jIERUN@MlsyaL6yA@M99j|4AA+<dFj!8pM&VJe-N+OuEj*0pd$M^obW8oh>SW
z9Iv{T5FiR-f)E9ChJlE}i2M{l1y=zj4C#uqpo5&fT(AX%9KYZJ<l&=oDj;#t<A4wR
z!Oin0PBbjoLaPC5EOxW(jl~^&ag$o@+EJIFOe<Ng*mMl5)4@;b*i4?1cEAP<8;F9_
z!(#I{IUU52Lat4t87ALh-%wuN1InGj!4ZQjd~j}lZqA=<#w!ZR?@v-|sH)2A5sjBt
zjlzF0$gB>=oOX;@&E4&%Zpq=qumqQJ`a<1ub<=y)ZjVk5IqWsb?vHtF^2=Y|lAQDD
zGkn!1SWmLoiC=i^@yRZ`JUsc$-M>ygfBt#N&whHN6FB_H7rMiYw*S<pKf_m{UjDU9
zlPfO!S~ml`0_Qo;JILtmo1Fgf4|^Ya@k>uhp0dw=zC!h@w)*!w-}**ZK315$<<H;d
zah!j5&ppWp-~S$`b;#jICQpCHvwe$#n{WPk@<nsn-EHy#M;>*It(vmEbFFVa=lKUG
z|NX!HpB^9oAkQI(9hp4ina@dBg?P)&Hz!{>|J>wPcixeqJ?hbqP7XDk$2@kA<hI*x
zP0l{^^h_`0KQxtL2iqp$7Lx(Tp=7Y>s+H|2$>B%7$hUv^^<8%*U%B|p$&Ej`A)`<J
z=RW@hrni~ohgba|`QrJX^D*i92Or|At1r6XOLpEq`IEnRYx22s&+%91cYn-dtd4$}
zoOjlzGg)vtA93^xlLMamG;3<hw(|Q*w>3BlE-{`shJ#Z$?5jSzF{~Q4S}|FclY8&I
zH@W^t*Cnrd^=mWP9&LP%J?@0$k-P1d-1D2?8l4N1AOGk_o%G#zPmVqQL|<k5%Uf?v
zF1_U9ERDd+Uhztk<9o^V*Ik$J%KJ&S%KOPr*~eEPf9=vslJ9=|TV42ER4MC|_t_^o
z#@gdU9=fCH{1?eNXPuec`-eXydp-W~$)QIcoqY5I|L%1A>g1veGv2iQ7aV$+wf%0r
zzVJoIB~N?CGrX<s{lq7l{?9fi`b}BBeasnr!i!(x4$`;(&EF>9|K4|#%gj+ryEyo;
z!;`03e+cd37s;1Cf4=pdyR*D;AlB2~w#CZxUvRL~I@n}-*v>mA*I#>`J=8hJUKd|T
z-uTCVlI;43M<mCcc#^G#J|=nJyZ+6b?(<1kUHz82`f^rRhaGX0_fZ~DJo~xNw-wa?
zE!nhrbHdvL)CcljcilC~`RAT%Z7+;vtn5GLxZ`arfv0%8x#9ZjlP`VYe9!lv{^ZY`
z-dq0st;rp?-);|TJ{}jxcs$Ry?l|j=(><Pgz={32bIwj~x#eb$JKXAt_)DxFUUrJL
zlOKF9xy{;88Es@d(%ScdPkXxCm@B^iwd5O@U)IH!i#%`Q_T207$q`2#oqXhj|G{N~
zUZ3{#XLjnw%B8y5?|=gn>Q%CX|NMgwO&)6Yfj26=ehzv;@||yg)7sz($+>5rmE8RE
zpMh2iMSY70Fvpwz_j>#jl5Mt46n%j*`I`ks>CprFR%{=t_ALZtI~V8sgeREoxF@;X
z+ADw+(A!kB-RC^-`N?+X_`mfRzevvgOt3R=ddr`Nwr6r5^`c{w_x{_zc-woDwUHMd
zdt9>fE{qR%n+;`r_^H#?&q1cc7aVdZgMhWm>#Qw(E}7dF9u^hlzbVbn+a)i4>B~(Y
zk8#?cvwm>%&wuV@(cuXvza)9Qm1WzuZB{4WN-qD}S2G<RW?NM}@1TQyE_n4-SDJ19
zY?c;EJkGe>Z!CvylaTWENsPVmv1s$jr8z6-#$?mRE#VD~W+ydG7Otf|Py^w9!n#su
z#%)~>)L4tqtpVnP>C)Qngpseh?V&q^H}Em{nrtEBT6<^Cpf^rf9lWqOpL#dk7>*=8
z-;$~UAi@nYK1%?B!epv*14ukL#B;{i36NJp$l1#^w7`p%OJ4l6ah&qUxbTM-arsIB
zpLA%DF5Zf>r~oA9L8B(|WE4{gL3}Kn@JYvU3y2{C#<&uOv%(aXu#^Tp<$;c_N9AuM
zT4*)UYG5sDfWe~U>}aNhv*u{Rax$p;D=WMnUII9dIT&=fY2k1Ovd`v9GPTjI1}3Zl
zZl1q#@kO>e)Eu?;K;^g-U+fY*_#qETPJQhkCExqbw~}}L>;Lqd`B$F$I-i(<fP>+=
z&p*ibHvHI!KVYlJE=gW=+=&TJwmdvx?<bmL=0)x>z`2D}Xb0Q7_`UD?XLER+?Kk%i
z&+VIg|9$r-=bFP0_^df!aEt-R9)D7D;DJv|&i?f2wmS2llV9F;Tk@xGeY?r?U{Bw{
z&d+@IbCR9yb?7rs|G3BHe{ksF7&`l`)6KE=FUfCz^XuddZ+eTbwi52)M;z^r(2srO
z177CiPkM=xT!sS<e7ec-sYnL)&<!%+=zi%brzT&!^y1`S|LK1u-?-wk<Q1=eO@bbP
zy`S{t<XO*sZt{tbeJJ^;Ije9sJ^h)_^0Xan?_!*Z0M4+TciF}Cb(A|@Kk>1T`o~a@
zJ>f)8=jZqnPd3NM-pQGtJS{o%Q=d#8{_tJQ8FEnaAaj}k!B+9HO3hINT^^i4pH&x6
zf5tOSkGDELj>tFv@t-C?``Jy&zrXiA$+y1wjpXI8IMp3hAndf$!;&}tr#~_0`JKs!
z{^R|=-Ndoxq>SOA=CIwed5cFKcKA_N*E=Ndf6qIU&wuV*YhNe(Rw6Mz;X!4^Vf+eP
z#eDIXFHHW|yMr_IMaP}sWHxTvob0sYjv2{8IuRnT_~XpZ>y@o8ZoJ`!<fk|O#2tjU
zn-e~UpPM7_8<&0ER;~Ze)35%)m7a{V`T%n*o@);K_rLpH3HjdgXK(es66aSq*3+g<
zn|w9=KKt(Lj_%Kz6ZP>=+}pN&d9I^>;r!3qLy_Ml-@M{-=Se>*tgBOAl|0(^-3E4e
z&<^&{<5`BcOLCSy&;X8p;fs<-JmQfFefE<d|7fz;o_m=yHSnMgUiXGKyQBLf=3M{e
z$3N!n@8p-hEV<uS1fO@#XPgEPC@#M60uRSOxBv1sbE@u}P!`}Zd+g!7o?uRO!M^+N
zZ_ebP&xcx_(N6l&-tT||?2Vd*<g|}`*q!b?penL4KfeA)$-evT=Q<Iur#|f&$<5~2
zqz@cpj>`iMc&a-&-~S%f&0l17!`lcCwTDnK>|om|U{3(bgmd!w2OVs0T6`h7BiAP4
zd<y6L7B{tTu)YJJ|1X-Ol7|P_QJ_lSitWQNed`Tx{$qd8bjBx6OTK!^MfR}lpk$|q
zJ<R#?!;1Gq4m&(K@9eX@uksetu_p#Q^LcyN724iq$)`{Mq(7ht<HPH1eE4?4N^hLK
zuQ>I!+4um>efK{w+4Yf+um^eXOFsUg57<^bk8)c=+MxU|vvy3~z3X59DY@?2Ym!$P
z?O?BF5**Y3w)69*!>5}qf1Ww(fhU@6<>A1`Kk~ukBOiEw@<g+(&v@3eJ#8)i(6)In
z#CAW}g#0pzwOHo1Osxi54NR#9d``*IB<_^!0UlWTqF-e{5&!@|07*naRECt?f;oii
zqdtm^8TZ%$Fzx=&SXK&vA2s&B63(FO!eV2`tem<a6NVVhTf!)TYaG71<KP<R9N-8q
z<{=!>BTab-i@%(}7UclWsQgnB?P)z}fJtQ7jGSiE4XnywLbbMla?*Wz%iDZ8>7JMY
z&H-4R#L*9!#8#civP}a=r`Ey;*k)$f*O$FADSLh3+O#$lzVK{q$-+2;wW0@3$U-}E
zW5z0FTb+jv=I6KCYMA?zWn0N1z1Uh|yJ^A^(>X?~sxaurzs95(ybsV1(!;L%gG{i_
z{jpbTDq4t-X3F6$$Vk`QF1ux=<<alrqZ^~_>MIw0Ir)V-xHzsbCs+75*G#fy%l65a
zFZiN4pe{3q>D|fKzjmoR_HaT8?!4pn<f~t~IQjKmzj8cQ*yca(#Yd3XjsWK@tBh%b
ztp57RPk!v%SX^)W*K*@NXAewbppV^t`)wX|hn?><ClV{eo@+P$pZ?S*e1$0c&tCH7
zFD19$a!Yd1A%|tzA28?D*=K&rS2L@B$R6UfWz`xqZvMs3lVAV(E_YPlZDqt!Cb;CH
z3zA=$Q<US1uYWb!bI-jz2^m;@_UTWZmfU>v&wZut#i<N0NM$(snB&ZG`K9FAYpzOu
z|NGx2SAPFH=7hP}oZ>HZ8oQX27v~wyY@CKT<|soM;IL;kBF7cBI&zOa_jFWNQ9t9^
z&rUvb#;2SXt93tf<{2F_jBTl1Vyl`(90q1PA7v|lPkrs{lGncBjmh8t<A3#4rrKWQ
z1*RKTOw%szHr;&xyWdWJeEoI4!W+T|9dbx=ht)Iqzq;cN-zWIei!SQ$%!P2w-)N52
zyKMy_tBgNpjv*e7l|flqcid?w+dp&89Z#%AJl|IBvQ<PL2I?frP{xaP#g+*7-+Q0y
zHNUs=1NYzWs}^y<P=~+&-S50@;$%C^+8wK5p@9xr{mQD&D!@GDyt6;!&i3oB`C;;-
zYp%)a8eK0~`G5PH-#Aako1VHd=bYD7>R^N?va-@sD>v!0pF8htZ+EnRR);_4v5$4}
zp1jY#$&L@($sTl^;eGQ~D+eprAN=5l(2UFpdb{I6<1Xv-d7!M@wr<O8z}|a5$;;1b
zSb)009^hz?fj#)kXy0k&W~&1F>9@XdMRJ$5y*(cHxH!9qse_-G6CVdSzzX?&_S@I`
z-gi57V-Ik$y0MkiUN<kORyWYxVymZl=z`8@i#8b`x(n!AuX^q4?Sq<cNdEqR@9tad
zb^XvCA8M<MKkfR*iG9Uom$^-YNK<`_mCw7F&HdCTPjfp@KRm<2d<#K<{XNGXWc>6e
zKQViLmpOXBlRWmZdw6nad-G}AyVd79IMBoRaJi2Um)QzkoYnF8u+{b_XLa~*%(mWP
zZRRYqQ?xPKKw18sZG1ti;9UE|tCD+c)jMO%XU{vwSN!g~{{il}Kj$-N`r8sXqA$Pf
zYnelse6p>)O>vq%M8lpHgXTB+b8o#C=g-H+<1b<BG(C{#)q^l(gpF_}E^npG%{`Dh
zhUdMGh9uOYPniZnE2Ite-aqm1KCJ8?wXIHBVOw!lkp^g!vUL)hb{IbT#yxVe?Gx@0
zXQzeD4BzaryMMd?hBrK_w|)5`I_DzWTvaa5%TEw&b@)G#RiFx@41`JRGBTZ+LC7L)
zsnE(uYMhZU#FSr*#Dp}_vS9F;q-P08?E*M|g)e@bi3da*eBnwK_=~6bK}+;3*ur|%
zfEv#FDL*Bi5>Rg}5obVhNv=4Wr-!qCvoOp65mOix4tpY@Q*#F6Sg`@gA0*gd6=E&L
zUunVI7>+p#=FA!FICdu;2FR4lid9Wj#wyVut+eUYHBeRe)hX76iK9jEt6%-fSMIX1
z?e1USom_eEcYWpRF1zfSY_?a;Y0q1>Y$tSc3U%@ld8avRa2^TB^V-+H$zKm=Z_NN3
zY#++2l9#^xRqi;t$(%#iUHijIdjvmfx7}@viLK5@JUHL<(;I!2t>S)Z&Q|Yxiipl^
z1%ZQ4&SsKWVfCSZf3IU{Z)Kd^f;;cL-9EnbAYc6!WO$%JhM$-WPxh6Bk9g#xT&9rU
zES&w{XpR=Pb^v~2AIUq?Ui*Kut#l(E#}H1oGQdG2z#)d?h1G_vl;pK^94-RNjbkhi
zZf7lxhiQ71eP44>-SgXfk`Mf^_xeh2@}M7955Me{ugXa5yz|4Y2*FZ6>e0I=H$_`t
zfOOlfH)pu{0Q=p(<mIQB6K_v<(DMPie)~a}mGv%bo4>aexqtEYcev9Nr{YaF-k4`M
zlupWc#Si;>7?eb?y~ft954bZoM)}!IH)bot<M^WR?|yfWw?(DhX{)ezv-&85L3KsG
zU)qC|xG%811zThseCXl6I+m~;-n-j&1-F=!nEoKR-SV>%yb8eQ#v5<&SNYi<g_Z9-
z7<tvJU+4XTSNvJ^+3$fso=<F_Nc+{V?sNxl9*=9bUpV<CFY`AZ*pA?K+tz}I2dvD;
zImxQ_7;uuutC!=nqA=}m(B8@S*+T>#a<Q`cH^2Q&@`3lg*ZN$z#lcxj*-w1&OEdB~
zMt9tCC)ZC?eQP)Cvp1Vllr5_Stjhka$tS>u?)0#oeYG+xw~;Bf^}^GcJ?XE!_j@)z
zJkz!m+SRud;buF|LtBdb5)T&9A@=b{w(7TE{%fxOfvu)~i;WG}CO@~agH^&jfRPT_
zhDNa6b{!qw@Z;-!OBJ>tp$%Sd&hKK|+HXt_wodfxJNM%`4wpce{>N5Hb2dkvnGGMF
z^S9dEsWJ}zHt*DFpsA)bbp>q&S{)joLE0iG9#q)elyJA}Z?sZC1$x{=;|%88JLyz(
zXo3w`b&<sXxPYj3$e&4=bm9fV=S({OOYk`hpX(S8UnlA6@uVxPc=(ftc*Q|4zP8IQ
zx}p)wOI`;#baf4~gc1@N5l-=(V_~Hfi_V<5<OPp3(Sf#vwV(rZP#kAK!V(r=&YSEY
zF92P_&=pOEx#oy@+GPu^2D&v6ZkEhx*VW{@aoVdv8laoWEP!hhQ=6RjgOJ)Er(b^3
z=-{)nn;LTlyAff<uQ^EIMwxK-;#7h82E^y=gJ4KsSg@@jc!Ft@a-WAo1OU(f!sYP4
zA{26VUv*P+2XsG#E_4tpBX{LoYZubOc&)OZRy1@82Tsj#6PJGH_=Y{k+tpUfzVVOW
zlKj}58@Jr@3v(uHv)9+37o%8z(D2$7on0)LV+kkMWB1szYmeX`UUii_XLzOf+0Q#D
z;R9YD`uF$ws^2VgL15En_9mmhg}x>fK43<gAa;Bxj=IIlYb%314dLnReOwpOImp1O
ztYR5>lYq1^DNZw*p};P9+=iv(u3z1eyz`&_XR`l+2il6c{gT6NpVKefYv@ILqe7uf
z&)AbLJ}EmKddQH6(9)KZKiF!@AAJA&?lAfDzx*qEwR?a6SQM*>H`}Z6tN@Oktv4k%
z+RD$ZPHsDUAn;pT{Tjm}lk^g}=IX1gyuY&5n)@fuwCxYrR)IZTS$$drWo5;whI4H{
zTOr8)wx_=4^|sRVM%%~sV_js1(McJvE`k*=*irzE_qL1qWTQP8sRFFt?ty}O6i(l|
zO2^-PUpW4xlasw{#qRgN`(57~o9#)q-+p^1x!JaF7;bNQNzys9)y6@#A{x3o*{W{#
zUdE}+n*)!3!V{AlfBfSPa)nT#PD;ir9Dr<%!nOhIseNU-g53M8<>{%L1*;pYx2h03
z$~$?~&qCe(;Sax0uDa6tmOb=&>tFwkZ=rFmt@Z}c@4bJxx2tav|08pH0!{TTRyP06
z_5#mCyp7EM2R=19?u3(*?|$c-_BO^HzPJ06e4pub%(7y}Hl;H@T<7D%+}wQf>~wn*
z@tHUM=7Ijnd}>hs^UpiiS7JZ;Df=cbI{t*PZ}z+2>Gs=o_|xuH<~WQ29ss=apUt+~
z)-Bjp-pXK$58i&M4&IXuojNV(la&eO?ILvZbAbG{h>ytI#usufE!tKRX3v*Q*NjQC
zvooENj8i0u*PbV$0q!~CIU0S?59>#rdo0<YiHOuPnS=%g+&?!d!f57!`(4_mTzI2V
z$(IY7yiIE-d)Q^pK)e4Q41@g-gJ}%Jpnw=}1R_kq8SpUr8bI(_at$6hQVQ4c;6Pqp
zo0Ia$FI;E<;LDFnm~`kUJ?0M{G{B4Vk%#!aJmeJ}3kC!aq(5YoKoB59o`}-P0#gWr
z%R!iQ@*o`7gh>OG4vvH&jqCWZOV3w@KQff^U%~!G8CsZT4bb9Rs8<8(#r0C{qQ>jz
z!O0SvmM)a>E_^TwPbV=;yvFXUgWW`#u}S$eSP?&GD{y$NmsJ`*f~Dq2%?rHD0uCve
zvg+J7J4l%+9F#-p@wqScHgRMP#5z`ZWMYkG<mUbcTV3^8+b{IW?|si#Y85#j`w7AR
z*=O3;43D!{ytSPI_&D@fq4t%FE^M7sc%)JH<&&=1HaoVHN;>SQ<8;(9I<{>a9ox2T
z+qP{xQ{VTWnVXsWx~lV>cb~o2UcV*1d1w8#PiORzXYvuEhNq!W{lrY%9j?cvv68Iw
zfn7uwG1vg-_H@tTT99EvH~HwYuH8z{mo##Hyg|HIRVQ%W{Q)aWszN>3Eh(3d2^?`=
z`<NMdZ0tJYs%++cIS&3LYuScBqLOQfPDX@xUcZrA8nT+{oB(QMRzGceO6Wz~Kz;P^
z4?FdM!rzcypi=<R?anKs0@@T`Jx^UpgypS!3!Xj;!#9g~{WWG)2sV=&&Q~2H1&?8$
zZ<{YwjmpD_hcMn|xNfGrbXdgZ7ss?~RY}O+p52cWo}-;_&qK$%(s`%kg*nwKqGvqb
zQAhF4E2oO-+4cT7ssmE$=-qH1UXBSzBd5+pryl2h#Pz|*I&wCPLuDc>P=3no?W82S
zXONFs2l@`mJ{Ll&;BGz(H*yoE!EF9bfJfHWb4SlU#HBx^Y-mVGXpN{ldmhmnd$yfj
z905Fzb?(?&RrngV2+U4(1)>PZUN%pT>4||-<3PI5muyf_Vb}7L0aR8KlGD1WxHC?f
z_itzmeE+(ZlFk7YzVicoz{AL>cMoYW(Iv5mK4|XI@07+@eUrO_e23M`Qr*O%A?LB!
zXr<@TT{7W89VD*)BgFS(TFrC(bl2;})E?-t(z$!r$T89N9{qJ0^)__z;IdT;L3k?&
z-$}r$+y2p*E&NLS#;>mdYO%eakiXyh4)6Hb9pf+>ds|FE=+ocO@C>>11@81ekCmQs
zyC;wFuiqm#*H@=<Ol$dzGMI5BRVH{Qm~~r7Ekpftzj*}<W)_2A8$cBxI2j7``X}(Z
z6CH!)++lj{y{k9?v>EQ=iTG-ef_zcmSGUDT|8^!VmK@7SMK7yE6H@JS|6RV_#D~nw
z?(-B+6X{q{K0Czw*NKHrPs20BR|NB_eVMNk04GIu&T?V49*So*v88zMH^8r2ZG`>o
z4Qfo9+HkxM9*1)Bd}e?|{7ttEh7#29Zal{f>Kgt5`rAS<rSvUJ9oz^-?MO;w3f4Ul
z96!ACw0?9eiU%o)(M3(gtO=Han;NsinTBcbS|I75rR#Ylk5d^WW<)<CoS_8KxhH$w
z?h#8M{n$0pX%Q!I4=3`PXSsCoqohl=YU)rGeuK=zu_3QE-bWQDj^n0qC4Bb*WF8__
z?rLt-IHxHFG2kQpcn|E9qbLC~JT)Q9Za6OK4iU0ye&w0RkwqgBAARpKXzoq7=r+{p
zVs|~P%QUXa6Bwx?HmdqdY(>04M&#Z-)UWL}N@vl4@1D6<s_AZ--eD39`6%-d<#~UR
z&`5mkbtt%_?^x7%8NE*AIP*7R4F7w$z9@4U?uvaJa=o5n*VBddkBp*a?W}pks(Rr&
zTlb3ta$5twJGH4AWD!Uz<|qTpz?lKI4wv=?WV&oy)}Yo+6Gu;TRI{z-z(Civr{{-9
zw^zofCf6||`|7Vj?H**hq=c4Q+4!7&kLV8BsbHjq&pVTI%TYL070+*-;<c6^LTb*Q
zA~u~nU<blRTdYS)gxC0cBcqbw#P9lJ{<W=ejzr4s3*7pP!n2lI%gFdc72Bz0Rh&cn
zeify>qZ!HZAKQIM&V<#oI9glYU!EhCEy#kj0>(u5(}~C+-t#`yiP?6Vg*g=e?l3@E
zB^+A_b5-=^*484l2b6*)oQK(=wn30mhVL%CqX7!3A$OS;7FY--cJ=8a>R$l=v5Dwm
zfueOx76bI|aqGzmcJ0cQBXArK_YmdaPCL~omoMDlUEtS+?tW6$a2zZB-Ba5!kbU80
zGkmxO^?NN(rdV#;Ync{)TR3q#(l;6|jEeZ*kMoec@fnZsHGBkxr{~#`Dc*1==k2-7
z%l#PWHHRYZ$*Pu9=)yikSR@MzblzzGL)A6!7x|%$nMV_^l$FH`3uSh&D2uaAIX4Bn
zSt*`1M__MvR_l;)<QM=KzZckk^0f0tc>g24_Z&Uas*g_&^OIqc-6Y%oO8<#yk^Cny
z`^a(l9EmPn-@G}Ax$rooc#y858&#ax^f_CZKL=;TcrIODgEhX+x$K&SimHP$J-;*E
z%ob4ee0R%z$CK%v2Z}#}TZ{S8bx?0MT<|6rJPK;>_eU13Bj#r;&Eb}z<lpZkdoH5P
z5J}mzyi1b7FgLU$KP8yqTWc|fa6O`APH=gyDUn)7$5<^A$p!y32lQZi?<NGZn}lHN
zkwn3>Tv(U+{sQ#Ks|)`Q51n1rMaPrJu98g?A`w8@MtH=JS*4pyW|^t=r3QANv)Me-
zGF6o}vn|i|@=NR_R8*TKN4q4$-f|k;EQBZa5m@>yd7})9G%{!4W%saih?HPP87+6(
zt{9G-Z9W(7gJ{uRuboLtE85k-a53;lEdD1p<L9A+&ppp8S<ugxV)ta-ByO|5#spSj
zy3*g@kGLq7H0>MYD1`-*&O6p8`Og$bKne}}OI=e(UlWV&mtrGgca9<^NCI_O8@e+b
zS^Ipw8t-xJy83W?H6^w^YIsDs6o<!^Wyk$|xAfj~eTi8-$$B=S?BkkX89#e3>V!I?
zS46i*^L{{klb_>as6R(CR6*%_sQMhV#3@T;s$K}l>&6CUyT9qqF?rHK-s<SJ@?Dq6
zT{*(FDTl54t+3ROKR<D6Kz=SZeKl}nKRsIFWV`l`FiB`z7<Px+^hJB`PtqRO37jrD
zySm&K3VfpLD33T1VryMftfA@3#ky~&CFvv*IPZ>({P_IrYDWDETxihFxe~fW?+F_V
z@AAmuF4~H*FxDVgH!rJRF#^2Y$!k%)q-UI&mv`KOmvwy&eUY_HtNgA*V}WWE+6Gu%
zJ->ZTJaHZDsU2lHs@T0tP*HflVp~f!rryOn*$$p$U3*&ZwdVzOJw%Sh#aVo<fb=!j
z&MP)z-1m3aqZitFY-^r@Q?tslN>={j;nGj=HSwpv8VO&8P46Yv2fd}s8WwUoDx83G
z-}lgHujQv^&r2cbx6C?cRc-;0y3U)iz^wxc2^*m)>Rf%A^{lFRX7t0q@c$Q_dKbO0
z4Mr@TFL0gH&RQ(lM&Gro7U>1zNv}DfZYjrSO?^l!aT&4M2xi&7Qq{HYAo^E%KhTYs
ze;r3w2CrFlOsI^0b`ym4)GUjZANRJYtac^GxzuSkMiZ-Vy_PwX3$PoLubHL?d0A%d
z2_ygL6_9pbt7uvdUYfKG13jW2&p|@@+_+H(x$92N(29Td!M@#_ywQ1j*Rdb``aj9F
zTq!N{M_`c0+8!x1al!kV_w$g!<SMs&;23z7$Dh@{ybhu-h%F{UW45v=SAB@-=i4UE
zPF?-m7pC`J?DL-fnGu#D!mEqxA6xCc0`tE%L1!;KGQz|`NEC&1<cWMYrTzt2W_u2m
zbCbMHGSW!tV`0=q_Stauj_6RX&hn;49Xi&{=I1V!uA1&qgZisfz{YqLk8FUDn1o&7
z)%(Qc0@h}m$89YwkT(GYOguW<;lZro?>N-q^>w;TMA}!eaIa{{(v^WXX+z%S&*alK
z>g;5yUbg&A*LxPyTg1{AN_w2+WwNjpku;lE@WViKw%OR$Y_D>p)@Pb~vy5$NF(T26
zjRxbPKL(TiP0;yY5~Hv`n(>Pcw=jU{8jw^$17p7}OhHJ!TL9dN0oj+s3nAIm12RIP
z?F2?)Pz6O`>16!;g?WrIe;S96?qX01K>w^6_w%!rAu1Tbl_m%_K~E&(rk^<mhKCNN
zARux_3OGH_RIPrNmQ~diKY$}|dR)Cyn+zz-GS{UIrQ4>bAeJT3#+pG*sB@N)3_`d5
zB6KMI_1#_&8*0}4hhZxc?8;Sj&<~}A12nq4fXK~y+aFoeMgeDVIK%`!<(WDB9wfDx
zSbAkJY(J%Q=fK0#!XTxDn-M#6Yzlp)@yy6n|3Jmkw~}|;D1P%qn*}c=A-l+C*9ZSJ
z$SeF)8%30Bv=my-2Z8;N(;6DR1Z9JDBUE@@s?uRsdmA3i@Om7ZwEn7KMD|LZ#Xou~
zoetU$<LWOb(N7EhogIc?VcSzW`aOHgYQ1@YfauQ3{vAAiK=}gu{A1MYq)N*zl>67$
zHvRJBj`hTh7f5xxj<#^TxzP974&~h+GLna0Tcd3QZBR^&Ygn&ABt@_7$TQVFuw3=F
zMxh45C|;Gj(D~&!Du|GW<#}!c8R*E|q4(~i*K87;P-}2_hEK&kVPsQixRACKLQXSV
z1uwmx%ex0{lbvscvY=}sqD4&$-svbKq~1o}&f^HY_Gd=kw(cr_M){vYZH%j~*i=SC
zTD6TL;#elX2(Mf9SB-QI0GNoBFm6P->hrvaC&!xjj%T7gJVK~UX(KX9<|5OK;2l@_
zIz>`uNiM3(8QZN_g-3I1n=KnSGq;4(Sc7WHlm56$ckF3zE3%6-)xJC4HolZUm>QMz
zKv_K628WtH{4UazvXo@Q%bu`W$2kpinh;)ofn3X+JQu$qI-3}tQK*mt=xOT8qW*+*
zkg_lZKkTNyx_M-7qKzNjpFKQ*IFGDLi&Jx-Rx;=*y`9*bSY0%%<0R5gYyR47ojBwg
zWK11(N$hkRN58NqG`NZf<G*jhDNg)&+T!9qN|$2+_pBhK27_k!l$r$EV;c7aghJe)
ze5Ws}B51M28>Oh4gwu#0qRC{t-)B2Opw8$Cte%8}mkZpL#*6bRP-6xv^2L1i!@vyW
z{E*V}hhsq<K!rcX^MFO*yA5Ro67<7%Q)Rg9#6clB#1{f5LGVD4ID5@sMQLS!rlvp3
zi4k4)e&K`D@#)+6|Ak^Z_k}WoUtrI!#IDw=;NDQlQ;axxnAK9|$6=P=M|5Nf+|lpr
z>|TT_ujtN7Lxds&Glum?M?$j-N=j5%vp(i#`4JH*n{t6`ghn)~(O@~M<lJu}oM$SC
z$5gR3Gkj>*6S#wTjF%)l5BGTs=K}qg8#5dcN9IRhS^Y5+fBc$3OEkkyp%;NM^K6~r
zw@IsqKKZay!;<g9DQwFx8ZU=OmSX@#y86VVK7R><1!XYt@yQ=ovF(Qs*3y-qJx_dN
zosEwDo=+QRZ$2tHqy$V2BYlg&Wjqxli-rVu;LtVnTQcqfwBy{AEqN;s_F@BCFmDpK
zKdEAoY<AOx!!&YOdam-Ss6eX!?CqrP^&7WyM&{|{X<{pm60xBy(1e8&i+d-1Dp_D}
z)@#x}>*@_ADU_wyN|UM8kd91&ViOwai$!?OT=BJGhw=?e0|e)5#hov@vy{81HnpY!
zP@OthY1}j~@^#)zE>;niT4UXa1-lwE&(rK(gF#15y{zX&dAo9hJles@&NWDP+@n=3
zL$D>`oX%RSjps<%kEBB<IEN*otnrE#im6LrmMMU3f<fc72Gzit1u4@ZbM5-XJ{Y{~
zR{~O<IknMq=in*})Z`v7S9b%b$d6-^MU-BmlnJdyE{BSVH^1_7<OsRWUn&;5L<)&7
zCR$_9_Cfhb2poD7<kyjCMkqV<?Jg+OGCy1cjfJi@SUlsWz!49Qq=|OH{x`SsdY6{U
z+KIuK@s|%8kc`@xWrhPn7owQ?FI*=aWsj)TQaU&dT_JQO5~dQQZ_=|Zlmp=%m=0aU
zzcSG7{h0{B0U)SFuetC<_xkX={AVaEo$N|=ScPQNj?J`6G7fZ|-ySwJESq6;lf&+z
zN0;s{Rd#SWTwS+KpjnLuqCwvat+}wPE!FgfN^K2u%V7g>F|xXpQRn^pimbpzUgOf?
z+_|v3d-L6+`dU%Er&4%2sp!idaK3H4kLi3vY|kpr_I#5yXleHjSz)hz4x>_$YEG$A
zCGitacVQ0{mU>BydltP?*oapw1yDU{g(_@4R-(hVSL3%Ebuz)X<ly*#R;+@~Uns6u
zrON|f)dG!SDNB6+zV+w&R_m7VtG#>u`0$czMjp!G;<>-aI&8*i<CoW5r3a+k$n0(p
z=z;MBd;Gio<0p<oOn#zCH_q`Xr$UHA<tqXbV`%Kj!;_xjgUthTAmv7SIiQz(Tzutl
z-Qv@nVd6-|;!(aMkb;r^QuGatqe_1VZQV|)%}`_^?e-J%?uG)g%#mi$yu(LLLZM9q
zcBT?hM}<EZ?3na(8<|}ZujdmAh37ObvKjL(m7QJNe>kEJ{QF%GM=5rCXD1zTsORkm
zmxhzLGKX!<Y?K3D%{smukjy}uj9C{eB1eInj>8+W_pno7$i@OGGr)1_uPSqk+hevC
zqI;@tq5ya~o#dK&bvZhV)w3k9+J~;Tmhn0Mp69aALsjk*O0(kjaifHaP6rdrW7Gzr
zOOSz$LX2^MoYdP+UmjbZ=HQMv)ng&o`4LLM8TMg$=e|zsd2G)kp{=Uw09~iXpLPDG
zfy-tQsY{pQ`ipZwzD>5Uxm-BBkb=pS4>`j-jIFx$sh7#q_LY46Ox=;$Gd7AI70Gv*
z#^)hDKVx`pXhh8#cr<jL`E~~9<`{|CP1hz)dIiI|GL+8DmX+1SwS%>ssvB-i<xkT2
zI)$0GbP2|?whzUQq5{Q~f}X{IG!eH27M-{sW}ZD*1Fis6JPWjPYaB`507ZYklw1M^
zkAgV%GSg^)i!>fZ&`p~tBz%SX)|{LyvWO&rFSt2x8b3d>^hye9|8M#6ltWb*2LtsE
zQ1FN(xjncZ7aF2OHravC`DHkw?}1F3Gh|)Q8q9g31h+0T5;4Mw%p?%KBtr6#BuG2d
zFbLfK$VfMTi+`gM?1al@5-qv7iGajq;Iw~K02T7m^!7OF7-YrDd;0k9|Lj*On~;<%
z=|c)DcKe`a;-m^w+d)m$DomA!ruSUFTS<l_T9x^#04ks~0XrNmg_}V*<p%a$X?3oy
z{u@54`{~e%pT5y*?#xChHNpSaOWnOX4aVu2b}<nJ0L}mVmisCk;OFvv8^sDsI2W7f
z`I!t*l_Db*woZiVfc3!}nWLh%!CBniGMrlWPDMHC17s>%r+|=;=x3Y*ivbBC)la$R
z;gmAAIOExzow*a3A-|L_WnQ4aoY()r2PJvzhMj3$yZ?PDzud(=@yZwr4&n?$*q;3E
z9e_mPw?&(MuwME*$pH<VM$uw;AVcEs4^M*Z$W}k0OYQd;*Gtf`ePt%JEB1-yo<#Nn
z-BxwPh!S5~IpSa~T<Iz0qK6o*=DI}zC-%Z_iWL^5cGh6w<eJ_LLac2G-oDT)-=c&b
zRK&sbo+<o11hwjZ0$d^DA=dU>FjuKt?3^asNE1PhY16XEYL?tmYaqvzWxE1%1OQ>?
z!C&Bj%kep&Tu3?FRwFtND_ckmpk%<P_hxdC+tHw_NXW&Rr<N8GN!jZkDP2^cMx?Sn
zIbIzZ$Q^WnEDpX?jchrsGMI;0j)aIXgQX(wtMV`Y<@1Qr=-^x$J=OkfgtiK&d_v~b
zx3%0E`|UY*rg~KC37A|YPBS2N#5;)s$zjKPsj)9ywU)R(X<d&jYPk-?AM|fn5DAta
zAI;5mx|EoAZbm{jDM`9+szqyDUuuM^rWwe{Y9X<#8QzS_jVq5#Bf~Mi%<U){6nAgS
zHn{Bl@ZBQAv5V%V^r9BB<<8D3Fz{upToD}=hWev+^J5iSC>;R<H0djXKnVsSafjXL
zjM7;2jDMB%j)Ir7PlBBgTw^mDKi{o_-R#Qow(Eb6k_nX9U|1jfCPU{EqoRI?BqxCX
zhD7qefrr<_$VBxhnvmOg6g|-LybdsX1W?4O-;QlyxTbVmm7osHr~Y%8^Eu#d1~Mc+
zwnQf*c-=AnV@iR2&}_cx?%Clo<pjH_K}09Fh$U_eO>X-0+f}&?g@l<r-VpZ2u;lO0
zR}zAq#-oKQ-{wm5bBhK#F*{D0J#rU_0qH2kt}vKZ1D%~}G%|~=X(sUv)6xkWVKa0F
z6-|Svok*v+Q8*;Mg^7-WB@kYq+ibzdqIh3NK;^rR9Y{8`-*|scu3d3VgT6zIEGURP
z`RrXcYGSrUROJh}S-KRO4VJik|4X3#7j^9QL=An(bF8`w%3~(JX~b<cdzGW9xxM7<
zVspcbkcG9#+HEScKsD1&N>!*6jvBWL#U}%a03zT3B5^C$oE!PqP>9_GI1-rg4hY_0
zeEn<as^mF2^VvUciY}`{l2TK6!hj^oVJBwsz~Dd~h6IpKfwRPnhP0G#I#5Z_$|D7H
z-4l1W=!a{PpVPfPAgdG8uVd^oa6ilyBH*B&jD~37pX_Kx>qy~ygW+mmq9TcPVo-2!
z%qXxCp%27yGqfRfZ4A@pNKFAmd|m&=P*5hnK+>vPosbHh<1&Lr5QA_0vo!m6xr$DQ
zNxwm3Y<=$b4edOw_<O?<tT~Ae9S7HprfGi#aS|<%yS70`5(@Q_s>-G`YXLdKY>!KL
zBC$ZBWP(vo4rDd$Ux)Y$PsM8mrNt)1<!<_OOsK<xIFoE*h*3OOM9n80t56MaDo|g7
zr6L9>-hBPdRo=sou|hxL*fzF)p1{t_J%P1xx;R3pzODdh4Xg}4g1TU`u-|@xJn!r%
zVQrh)N}byc?QZ(Wh=;P7hTdR9tY%0rx5Dc99o$xt`4%bxyLelY4PKU4f3{=_PRm>w
zz}hZ-g0FA-R@R^Y4J{mTe$Z7>$eOfI?9S`3Q}Fp=TUDShk*`9$R?mZb&pRIY%xC+}
zo^nI9354+Gm5She2I3h^>l2uSBtf#RhV9X3(Krl`;l^kN^q^M&wf&(^kiHk1XN*A9
z;vBJsaX-Td@r<JK(G2El3eJMtP!RBTlOdn5AeqwQJlnmZVSyg}3O_Tu<`j+D+p$zs
z0ZQ?d0cun_5-H`jB*>8_17HQy0a_uL3FJlJswy-!zoeKXz2jv|Ns}HXQV<_ex$U9q
zoC|~jW;cJd<y&EW0XRO9RZ-O)^Qsxxg&J5oPcnD%_c5j5kn-DDW^-U1>`HG{<7y9E
zRRVs(Iw!%3DLWw{v22sFU8Rb2g8)v$ATlF9BOFead9|=)tF3CQ$w+R>QK|_8oKdg)
z19_U6F)JS9h2@Bm`~^~@f)7ME6$c1{s&q+qjr{*qBWZx5o=Iv2EK@G%{65kSI1%S*
zY&C0C#hYR{;F5}xj&Kj_h1nwd2Wjf6yBCGV4l%TE7kc%)cXCP^aR+Av|0oB;jiz_!
zi#l>5rEyxb;Z1uQu+57XtuB<8#@0y7Ec={mZ|zS5Nug~op0;SuV&HxiZS3zFNkRQt
z0y-|B-<XHFoez=A2H|QRNDvaHbS1Fg?#w}CIZP7lisSHVjUA10=#5Z+_5=0-!|<Lr
zl#KS<|4GM!6(O0#`OA|c5!bzK&(Iriuunlh2z2ZrB{l~2Yjhaz%3w1XTGudiRVwhp
z0$I`Q$MiDKn<J`?@`d2msx5H8K@yohVV4pKzKZ>Ad`@MSORIt#`;H6Cto%|HbX``p
z`dXIX8hT$VXfw(ifgSh<Ovf`RF>WrF+aLS9`$Wll&gL>Ff7YDTABIV{sjEx`Ft2H{
zCIg#pjW4<$X46f^pS2jD&Z6alHG;c`fL*wD&pW7?g%>rCviy*g$7*li`x*wTBHOIh
z?-baI(3L<F8F9>E!lUibhBGMh=$59Hc@s*2Jo`Rav{_1|w#ljgpT~n@A^4#d_rKj2
zZ^n|xF`~@|`(yEHnoAHtSBQ|;vZw#{XRU?18zYnb@=ru>ccyl&C5=48+WMP36CW1G
zk$bB%D!w02WnNRKPe}9DKenTCmr6#^DODOm^0-%@`?K@O#3McZEqf9Vvs&hJ7?m9w
zOta?9iA>1?xo&c(Im0b-!5u_iC|gvhlz2^_1#BB9S9%=JpCO4gcOm2{Ws%fxZNU2B
zL2l#!FFcPV2n7Xo*0F-w7#2Yh$A>J4Suxo@U6y~=RN3xSeR_{P`nlx5mceVckHcX{
zj=xfZ4Ea8^PA<2eSq6{VuA7yHKFnI(3Sm<6+Ok!1Zw7f|oa(d$k|0{!+3HolE6wLx
zl67MhwImy*@?c5Zy%9XJBeVuXuhuYaxv#G>$%0rfy+_((hevyjI)%2#gGQEGU6a4J
z_Dr|FdX-%eadz+w+WH@NE#57LRseeRTfQ9HeBzy56rHeFtqETXZh^5M)I^{qT59P|
zgqmD8T(IKuu4h8!3XJ^#)SFV7=eeFHPR|hkE?=N6ibXZt_QP&<g-u_=Z)#=y6*FB#
z6Ty!bQ~$<qrFQtGw*~KS6Oexd`-4=G@REk~G>pu5N^Y=Uw-a_^wZDlCo=x1oI&&UA
zPah8&#Cb-n2+$tTe-ncZ<a8rIWUgEt(z-ZXk_{YST~Dem9&oZX^VnpII=0*d$17eN
z#P4uBH@ybOkdWI#P7B5?Kq4M0cUnA*R>l3qay{OU8%DKI7Jbw&)$)^&cqR^=lR?5l
z1p)6^yPv-wq(jQ-@ig?V7yB~tXpVhJ5I~=ZzBBMhL5sT%WbxYa_u^Q-$S~jt;yNHI
zg5#3I=xN1Onomy0Z0G+AHlJh`1I|DalMu!vY2J5Z3MP5<hssHdyT0CH3!_?2&E@zu
z2g(ME%#jR8no%6exBzkZ#hE+_;9uQLtxsK8tmw~&2yu;MaY8(D6JihcY{P;67Z1iw
zxaced=z6S~yQ}MEnt-#MNHtuV!YE~J{f~j68@xxS{vbq0fPC;j&YkUWeYY7ar9N@4
z3tz^vzzedBI$n!0ZqL`GA{njUi1YK5D)k5qcME0U7NQ;jD@&&gQ%VxDM~lCsb*<he
zF0IqnjMgNU#gja{rWQly^EUXEqzCvrYC8SM`0@2aEpiqFEAXhTlz<io?G@pK><y5(
zQL7Xh7TF*EXS=_#GfdRav}TU&F3-H{??D32ZBEp|7yVB3xKH}b&ZyT7$`A@R2A!N3
zw_eYf4!lnDHp&o3@N5CQ396hP&GF%Vs>47W=uh0X#e$K$4}{*hhN(#Ex@|n7ne}mY
zGph;A2A>PGy6jtQv8}UKmrxQpKFph!DjvL{Mc4oFqphUQ+GaxZF=42r?i*j*-IB{Q
zzo=73HM6lSk~_blT|_Nwvah8{^-@J$=*D!)8p2#DctgOAn@GYe%R8bUEzsX2B8?H3
z$H_=D?B(4n&fuR6NR!#9oR`!~ShXJ8ApKF-V`0>4_N(N;c&>{}GD4GEWg%Wy+!D_?
zN_Q)0D56>JQYJIdHO;(NfBXPP+0gVxY{6$W;2`?aMXX@)uuK9V>R1Ey7CY7TJwb1U
zQhEG4`tc!4tnmXBjf8N)iqG8OW^ktQCU2I-YCHFe32`RA;byzr!w>F}6LemPLti=&
zG#c;`Wb3^`U;^rmaKr%q6@G_jC2f<e*Qk1pYWL8eeavV6XOBq?)UzYhmKyvq{3~LT
zx2(vFE;_3x%@CM`7{31I@j<=KvY1DDyAo8Hkk$FHf4ruXgD9K};{FKozZZs)5tDrG
z_Nm$KgYUNQPT{sA1f+|qf<Yvg%IBj(g%qLqgh+NLGyCmYBzC*xipITb#_5Dr>jr7`
zXSECBde6SzP<4QYE)`IPN`TK*TcdBMn6o-HwU`zeuyl&_Y=WF6y~A~@3~$w%Gm)wt
zyY=(`K`NVY$cICz7L3izi?oKtEX(RJ5Ilx6({=W2+8pF%r+zBu%<ldluvT~JjE_ua
z&4>M3BZWqj<pYcE!f<CQ#DhCVi{N=D#YW#s)49pe@`4g5^-IOv_`zG6k#~OjFOr2s
zGh3D{M}d|l-bYq58xX?vi|$hc0S5T21sW{A>0H!02Qu3lgrSNC00m{$xI=%V0717M
z=vlza9gHe=PoK=4+GE(j45l?R&+#%M#rv*?h(N>|3he+sxyyvhm-CTAgjk(a#^+F*
z`d8Ga)T;Kjg;aeBK<h@_5sskWUb1&-hU6F(=hO$44!sy@UI~xOvYNWoP_s`%J_(;$
z39Wj+(9`%wWS^PQJlHK!Epd}-GvEZ6A4s)9R<i$F-Cg?vFI&Yop~lMh>Hgzzt>sma
zFBU2-b2Zh<UlG|qUb1-Y`bPv|xiSn{qaLMn?h6{PVO6JkvzWws<C+F`<J3(=$HVs8
zZ8AevgR;If!2iP9T__UIIw<~CYGTiZt+!IR^u_JBX9cP9GXc#X*~Xhx3~8(J$!P!O
zp#?)SE(4uo*r=U~HLUSNYe`Pa{XTmY{<0w!qw%=XTjd_Ad*5bHo2~wxrs=X=gfppM
zhuOBCq6JLh(ef&sA>olum=>{BNR3W~$TiV)Y32i7$y7ngSIfw2UgJpmJdCbWI_N2k
zY6__cVmQ{8&fy@y8SG>VAgi!fI^ck7;jikgiLPS0sG*n4EKU?~Y{*oo2;hAX`Qp#S
zy<KFE$k}>`5F*xGt3yir?JqM4|D?1S5@rnZ$u?XxFAHCwC_Fet`D``-5rcBo?$b{=
zeUj|PI#(}QnqfX0ykQjYR|C094b*Z{@sgUlobS5OUjVWS+z?`!uVKJ;wTZv{Tvdv*
z<j?TvXjw^oGmh#<4wNR(z%*)(`X%(`fK^H!f&wm5#8P2&F3LOUQ`hZ7-G%M|P~OJ-
zWP=c{`s{yN#&SeN69d&X6<)>zJem?ji15a$>qbla#*F^=un1A}Jm~wx-XZ6$s+HOD
zmTKcJ;+9~l4(_$&glV5ck(-V~$zc{wIXbY#(58;m7V&7yEeCVD3$tfZs*5iSIgYa5
z&vD{#iC+ok?^U?l9+BYv%XQM0|G<$sw=K!|!hO?Q&=g$Bd5v$wv6ozya>jZZe9UkD
zNRc9~g4y!)XE_Ki#rp!U6E)mT)lG850Xrw9sj70fc+uHoB~pR8NP8HBMxyBi7#+w)
zewUtCECh{<TIN-VXYX~53O!jC>i<4y@~e=LDEk^vxS8DOIy7=G%e2ocafk)m{=zZ-
zY=K8xE#}Dg&2>UYb~7(7Cc~h}Oq(ylB!1fK+4?nx6-l!1L;r$TSw#TAF&@$TqpzX{
zQN+y2q^hKXggt!pUEPD9CJ*RALf3%n-VxZdhFjNYhr`*9HXO+iwTD%x3MkFWbYdG|
ztrDM65-6?WC<buJovdlfczg1z=xow+TGxPb-e^Nxk50ofTI*I^t&T2gve&*2C^T5w
zK|r=f%)T50!-KTeSm_Kwlc*cTs*ATZ!AF&Y*oz~A%Y$jpvaOP`W>}d1_D1bDjKh6=
z6OF}u3;p10%MiS=-o6Oj&Xc%T()Toe4vbtVw1NWZV6}k9OB3T4Q9UW~eQ7)(D29Q+
z1xSc7)NuW4DaRw%P$DzhoMcj%0NP>ieH*370p1N~wO1GkOmmktCQbzv1r-gne@mB#
z(aZ6iet;2#+WYIb#RV9l7W`5!!7no8qyOQF#rz38Om!jD6jt>3`?;T@)n`vJy4f3o
zcibUC^l!R!Tr7#kC-(T;_~~!4x)6Fo?J{S48^|^f5Ngk9z#wd)=aZzHa2o4Khn*po
z5d#@lJkX|!GvwQezl~Tz_QVn>>%c_tqN|-aN(F94#@@b8oeTcoBrMK)79z{o%_!rC
z(R$c17c`}i+1cyWUU&pIpCN=evdc(h*AH*YLacM%D80J-{<WEOdoPEUwe<fwrLv$5
za(c1s=csh}&`RPT<TXrbm!Ad<-37V1lDJuIjW{`$bWUz%{RH6Ed&N7(Q;hUaYWb-3
zEDjdlMBP!^8`Y=D*;_eXo;}J`#FNw&fP3wRddeAKh777cl~b5!$=O^27l~K@*ao_x
z!=_^EJPOhe!sDYcH1qqIV27`8_a@cauN|;tj!~d>5@Ok)-*bk9cwGO2JT{<A?P<kS
zGC^vn|Ci~75X>M*&?}jeoAWJ{(fIh=He9w0?@RYTi(Q(}Y5PyN5UV8ykOz$NGQGeM
zG-od>c|mO4fO1Kyk|0%+QR!F~&NkwD7j?yfdGCV(?W6kMs^#48K%OpV^n@EZ@n$C2
z<De4sKdNi|xe1ORm<b-A8$iA!n8pc~#h!Wmi)kX*u(9z;N!M(EvXl^C(DuPaF2RY*
z{EAo;!zk>EXFRKy6iBVHj5TEWgDav@+`Y5%$MLX9NdXM*p*(nTtNm)zeh*RF0@sIr
z67KRcI%?ZG2vjW?=U=`hT~mIh#(pa9*bwxvO-XAOZly(~blL9euxYNkl!wW%E*C%x
zhj(Y~M4znaGNV$rDyi2PtZ%4$hC`&%XEB69l;6sRgP59Ir>|<q;8o_UfM}w9SO+xM
z&uFrcszdlExaFLM+?RMzrcVTfbx%j)duA#id5?Z3I!FR-txq6<0bq!rKjm&whc01+
zYCw@f1pW3<*#LgQ^yi-7>g)JIhXeoU=e}^4$$lYWL9bobhXcZ1TS^r0WFdJlByj>J
z@K9*3sgT~DaNbuJf@T<KM!m^g8jo;0f?L5PVMuxH@KFp1!gwalS@q<<h|PM*)gG+B
z(u>e)B`Qaj>O*j=Xj8M@mHq8%5ul{u@ZaG&)U2``R&k5^V=du(%I0q}HKdh1(ci|g
zqGs`^$AFj^XZ8d<3#a)5W*pOUfcoxc(Z{|D0mRGLY*?D(GNIGLKShNW(n+*(AFH$l
z$(@a54(CL3d7tjxzGNi{b(wW4VHC?ARH2H?{M6>}?THioTw25r@%aUyRFN<al08b)
zF)H0&RmY>u7OY17K*^eKiJpOy>Y%-F?y9&+)wE?75yBTI%R3JjhndEh<c13J<gZ}V
z9G>8ZDBSek&mB$0z#peJi!Z))E*)n@4BmWrFo>b9xSUHzQ7DzBVaM!hIAA!)ms3NW
z`{*WbreCpLwZk>EUlg-8HWO--T9pmY3DqV(04?soo+T7O)O%*XZA_9dR6N_#G-@Rz
z+v{}9dcG9rZkrj$6-pwC0hWF*n&!>-+&Z}a6k!sN$!`#H8vb`aK@d>U@52SW+p&y9
z{r1J%`&2T<$Ds8I4b>|=6KmkYx82H;=ANS&JIuL*&Vi?<@vUx*JY+(tp{J$d*%3-P
z;s*!?E{yo#i|?#uzyF2f<Koo+2c_Cgy9g#m-C*X3*HkhO!}afRN1F2SFyvuK8|#uq
z-)cRT&c}L6U)mpGz2E8==PF(QvQgu$>6KC1+{beKg18&r#B#jGw+g7iX)q_=Bu^Q)
z0qT4ny~=h)hZ6;(hktQPj7gU8p`vR^4yIl#D+cha`xr<_ve$Lvib|y?Xn{9&MwD9X
ze_wBJ;&0Y3or7MG#vKyO7$oA%pI&kie@*5+wK*wp%#PjtO+0>@wc9*I4Qfv;R!{fQ
z85Br7=F}(=M&r1ju~*rqh%=BbPXm7+{i4<(`;Ib|0-U@}L1Q8=gyhQr684XPBWT@@
z3cw*AU^3nM4&iRof9_TQ3*eK?ZNhHj4x|1c?|a3Enj{N>ksySSLh6Y!J`?<v21PF{
z*|zUe7n@LP1=i*>=7fsV5Cl*FjCoJj3T&tU{e&e;+ON@tKl=^9$!Hf&PW#Oby_6)o
zd#PBlpHo*draYz?Bx-ygjnJZ>i(uaFLMi6a?^k&>sjC95fv=0QYg4^T&v<*U*w{!b
zcc0xjmzr3rZhkY$k*%U6hfH^*82>#p7Mvh3K_$Lw1xTK)Gnn0?Ou*#^T=v=|(oLNv
zfY6f6^PL(kH)RX1RzA+{Xbktf|JXKwuiM4{mavJQMH+#bz0QC2gs;B5tb~}BzG)E<
zy~CkFtdFUyWh@JV-ZVRL9XVDclrVa961yLznS};pMSb6`4<S7l#T{bDzC2uSVX4T<
zv+BBwKS@$FV5|7q&R<>;hzvG(3x%Is<LsrUQ44|%SgbaWJPvG}_f5XGQ-wRS1JfC-
zSd_Sij@JhjzQC5Z&l$w}@VdtnCvVIedo0>G;FKCP>dR6PLFupOQ!(o@T>SKb#8c-^
ze?>Z)MPZE$e+kiM7fHhHg->bAI7MTKPulIHMbY`&oQIQV0EQr3fuO3Q2_K@!fr`vf
zxra}>n*)%!zI!=fN~l_pXC*evL^4GZ<zVQ&!PQgx#VU!477w&R`3b!=4JPg}oP>??
zo{Z$`pgR2$)klm6YW9ZNt6M3FPJ>dO$sl$w^UocpF)P+veApY~6MEP@RC^gylbiM1
zA7&t>VRRTD7K|w~2~dP)zk%C}9=G<t+5}`(=D#wAofh+-G8Fu$JG;f}rdHGR*#Esa
z-5@~FkOm{5(Gpbe*I@Fkt;@vP_}PiC1S|sf^WmO(r!r7ZDt|$+%-69Pyor=wO(Qrk
zEA~4wft>%&Pz$#)amHHf1voysi^<BQFZ2Ql&rj>y99t$#f?m6t^8RA}U#FZMsE7uQ
zjF&bq*Uaf{Z&_PaMZ~(qL6QQR&a7{VdU~HNCe~FI1R|cIW^8)$=Er|DlL51@Ykn_i
z)yg!(U$_UiZ7?tV+;LF;36I``@4ubSEfU+Y2*IxG5DXIc{@~Iir#DN6-~BfE58bJO
ze#W20bf2u8H`n+#(l#I$S?jt4tU?3}G2AX@w#7$V6E$l3vmQ?nfKYhOAQk<@gr$*=
zcgb!xO!doD4tFZF!YU<k_8x^&=OHmwLXum{9%{<s7PHr8Lgg%q?%Qimx@rc9F76Mj
zrpjzweI?U>rpzk@&A{9C@LU;e=^0S%aVgD-Q8WYXcux-3;~O)#{#~3&FRiW%D$Hyn
z&FRacAwNux-oIC}EO2I6B>5ZIgDjE1jIu<|R)khSElD}hMm8*US*<MO{UXG0ZEop2
zR~JNpS1Qe@>D3dpd44XE>%17$&--}Mj_bU-aj0)Mqflp3RiP?PJcR0d$Q>U^RD2j9
zw?y=xqMOKvMrU2AH6u?U_yaVvP%2<u%1VdWUG*H42({?gGxa)P*6*q1BUx{)*R`&+
zkmR&p*(J_AD_qi+03fVLjlqvZY;=#Jj%SXyU-WY+xGdv&xR^zbu4FEyLK&Qmjs{{5
zKQ-Yrtx4KozC(-w#m{5kPF$jJjtD6tWVR!j54$hvn8nMWY0=8uk8}I)(WEgC_IW(c
zmm3>d-1p0F+LB*Cpw*aLTX9iw!|fn*MP}oP;_+sO#l5)Wdu$t>pps+kBctQkZ_xPb
zL&yku1>d>jD%n7Q;%f?`*Z%ORNi0mks6Sd#Fes2LLLuLH`UFMvM7)yAwrR5iNVROS
z9AfH{;2V8n_ON+<cs-P4A<2>42(Envnq5EpLxcWXl&(K)T$CFEL(P3EzMI*9JIa6Z
z4N^8bIU53ccn%05O)*V$SDh=4e9u{J{?DZW+5Ke!(jM3oSbyWr((nH;_{x#g3^d;U
z?Xz1R{PttgNkF=P!^>G_uuQ?~Mjf$#-kj<GumJvNdZDXq+HJvCcAeP7_=Zz$t7v>P
zTuLk6*UL)2E2v{cthYyDjHM5J68QA33^Ftssj@_LX{&w2AUb7NRKbc03{;z#z7prS
z$8`_!gGc371?LsGx|^(qnbHhvTzUc1g$rkc&7vUrBGcp6h4m-vqUx0OX(#Xj;j7N_
z>{#q?cZ(wT;)z$of(7bB{Jjyj<B%9nKqV#|F2)%K9ll0&IJpESwE7w~m7SmoPD*fc
z8jKvlcz47fK{F0{lOVUsp)%0AM;bPu2Rd3moDfXU$Bsl1Byaa>*B<*O?r&4}{8VpB
z5UUDB*YdHN^R0IKqm_rQg8`?CX)DCmryfC=2{$=zWntj+&-N%`Pj@^i?j`VrUU~&*
zdADaGOCAf8hXmhB?Jxe8nXVn4JRAMxpSXX*tRZWXqq8Yu%{~8qab!-g=CdVu(b1ji
z7Nb%f+xMzJj93+`smwAkt*HE9Ym6q73UA(npwxw^Q(z<I60(6pr-J6-Lg<wAzv13O
z(Hed<9$;tgajN}ms2Ls+&J%lThnTQ*<Zi2$k|kT5E?P)i=NNg01LAn66D;libsSVI
z2<C3BY@KTSm%f!ZF~O8<?=ty_y=kG}OPSSHMvlkTW?$JwHz=w@dOqfB`QBI)7hG1}
zov!pl$6K9=$#!llkNQaS4;&|%w3n#>+hXOt(RnjLb}%2(n&|C~uv?uaYTTV%{0;7u
zMPJ+AdJq+HQ@=P#u)`m3A$CR4Lnc86n&)?5fc{X}d%=GH66oEWLiZlcQu&^Kq80SU
z3&K)Qd13SmBM((aG{5I;+n_Lc7ef*f^Mk#^!pq(4Ql+*AA?-*Hg37)KLEX<-9$mro
zfIWn6c|BNK%KhJX%|13jVWz`8^JlW8W7X-tehF7l9J%)h#VXc;t>`<5nVVtegD=Cw
zgP4aOlJimyIA-ub3}m#2(h#plZkkACYi?QSIhV3{Fe}jA-cF$5x}Kp%TcUSYbwUIS
zEQq$p_+J0-zqdvcaGDf}Q&Z1wB|)iOJHmE;jG{QAf{1^vEX1u(MI#pzU`Z|wMV$9g
zn!7Ln)n;3rw)NkrHPBp88GuI<uvOy}rdDR0;Gr%_@0x!FZpR|f)J5@je78QEK6M02
zog-Bm48rn*vVoZzU+zF+#0rv7q?6^167?QkGc%jT!<nw7Vwi+^|EY7pt$v*lA($(N
zRV@5toJ&Rn0`J>%bJftwGQRO5RkHYQa}!68uOp3jQoVRB24N11Ncw>XWRmnVV@i4K
zAn6y?4Hz(W94#oyBm~5cAR{6W?391clnm}v!SE+r-KGV_9H7Gln?KwBBHCT=IrY64
zPvMplM2%(}{1%HzaBG7_Hd9+nFXIpz7mK3aF5+JoPqV5Zq6xztltA1n`W|YnM`$W2
zE5Py7`==o~oK_W?a`KI0i6bMEXE#p7AK9EZzu$*s){#Je8IjCoNMoDjIGEsXawB`b
zgIV{aA>imT?pvc?6E`toxU+NNm;yP@DQe@YpgYQw=ia4V^0<y{9K$$5$79$mNgOPP
zdvSX6i&SDbklj&oUTp<~h_NS6LSF5ZzK{8K6|s3m)QUC*tyPf|pG}%GlnY@5)y8un
z?&iQz)#_Jsi_E$2Zf(VNcO&#a6-jY23==+skyQ!xWruPtWKo?ThU3oH9Lq!HT95Ip
zTTb}p(?pwyw{ZD8!$MlJa-N4rYub>I58G&IcSd^u{<K`UlRQF^SjUWyV|1C~+@~$s
zP4}z68)~Cfp&>mr9S>cSjQ_iQ;?cf-$ctN0p7K96yywS%mHm3}DCrMauD)HzQ;5`W
zsp4GpY;M?~r7LweR6^8%t6#UOj!kiSyRlbAX{<)M%<~5<_a;)Dq3;7SUJg)D^rYC|
zqk&c}YDofd%qRWu0aGas0f4N!>z1gSYwuXb#{a*A8fFmezXs|r@5f0%cVh1Ho9ESK
zhX@M^i5M#!ZLCPY54W+Bd=CVayb#K77Cx37lCT>ZS||iL&*5NP*l&L+sdIOQApmI7
zA-x^W&R2iBPG6=@*r={jxR1^+=P%P`7nBzk_z2D1+!UnPPD-j3;2aG4DVSXHLy_t!
z%3TS&#cfBa^dvBJG$%1BK@RPAkVE?g*1mw3LA6g|UeF4rfv7Kwv8cjaf~MaJ_cFCJ
z+qyq<ezy#-)zUo|IY`%W1(*cP1k69KOPuoOjAw5HLc&f$X~g_^v8o{O;qOvUzRe4!
zR3t4ffvDw!OA2ces*UWszd1J!p*ZmvCwSL_m$~)g7}rF1;#f4)#8yHQ;xFtIG2y8O
z&ka9W<j=PL^$cACPmICGhmOsPIpoc=MG!HpuS8wKT~R%Em!{L!&<BBG9ONavNh+u0
z$|kf)k@Sxktc$|J(2=-pBbK4`hezYxeZoB@G(XfsxR7c*D7&4jQ)#F|!{^JidYyCw
z5@I%bJg7OniWj&B>1XYjmj7bDW>tbPn~4u=g>1gsG&g(ak!{sw=^x}~NJ&%FD?TV!
zZ?d$uxIf^{;&&0JJpO(5A$E1Xab14POjEWNyqXD(v3aEti2|_j5T7SLx4bNuq^*+F
zsG&h26Tk{4yMViL|LrYWKl~nJlLPL<^n=!GHYe{sUchA<jA=rgXgB;e=8wbpnpbc&
zD>f`O(H}67Cl`JgS$`L%toqOrj;#GUrv#oC3~!$SD|eU}w;NqRvsX52P@xZP(We1Q
zN6G2b6)V839Ca?rbmgUDQNjkLg#ya|Wu3C(NyR@bDlBAismI_1dd)dz<x>CnElG&m
zx>lKFE|JUU*X-<GoWyQF#S?X|lR2VvK2#V(gKZN>{{?iBFJC&c_JsjX)TxJk*}kEa
zfkQ_93`3fO!hEq*f)FewD@M5A*o#@acGLQ+BvG!)t&_N~G0QKm$z9^Wvv)4s;F%DC
zW6QZE?34K&7L)EX(Wh~o=OucnX~FYINfP!M^4(aHA3v@7KSJGJXYQ|eRm!7gY?$mU
zVa+WU8;~sKg0pC>+jKUVEyVQJIK~T6CJro}wtn(NhNvIshhx~2KIf6r;{~$(>)-qC
zLS}CjMc2vEf+ETK!un{YwlW`cn8Z=#WLYsY-Zp)<89*nGiNIFq^fi!icq8Ni`l|Wc
zXZ=jmSnryedC;B$=81@~aVeG^Q8^;*RYmzQtIu?gx2!UgAU_2NwqO#C2DX9;OHt;8
z<4{%17=?cP7U%f|RuBh`PjLhlC#LFfFqpQAR?9xH7nX^@7toT89Fr8zTzL%>PW&Ed
zy$J)8@hwHKSSo-VqQ4(ZK%}RK2~g$A7ghh=N2=Xq+YUS|7z?b@q)a#8HdL0@`;=-!
zh%2YJp{<@B<p&uT{Gs!@-<;2eC*IFvC3is6SvGSQ@5QU5L3(QGAzhEQ+wmRyI*%tp
zdpiDjKQ%E!Y%W<iyBKVPdAk4~Wq_G=g)i(J*o7Ovvt`OaG6e2!yr8q|7=dx|ZfRD?
zhi1d73M{!z!+L+g$^&e}1o}#7Tg1;gsibi2dTL$!#oM2Q!L@TmWOD4%b=lQSC2RCE
z#9*~JKKgCo#k>+`l6SK{3*!pwwOmYEGP;yqQ}A4G-`l6=o92RDbXbE*1;-X{gM@P!
z@9b)&D-+!(OY?@ru&}32v*W1MJVeqO^vQvElbZ%L8NG9KyDz;NW68{y`9Tnddaipl
zs8$${zW*GT;!mLVuI;?njL#R^sxeko)VBgxIVnP=*GxJO&*!&!I2?{0rKFw{P9u3w
zAXf}CD^tdF(YGd}p!8PF*5eJGEpjslJBTA^H$h>*oHw;AnNzTNq{*LtEndPpHQpg;
zTqab~LG;pt5{*(Y`u6?D@E8|aER8RJoFq(4a{P#Amj#q@uA8@o2%4W;!rn!pKY0rM
z+P59Q&5&sE5^!<kqJi5&NWn@nhfouK@3#ksspv()LLWds+&zZYJnqI9a7ak{c2mH6
z42Lbyyj!(LHY|+CuE39F5k{ujhc+W<@ykqB#l)QOrQiDZ83~R3!T|<d3wM`^$3yh+
z3q%1V=}>ypklX8^RSl4I_klVSWft`w$`QMRWhngLX=PVz<e$ydH*zyw{)&vmCL4`)
z56N}o3Cx7p&0Nn|)n6vk>#mcBR9AI<{xqt;p)s*w9%^yI#ecD5(Tz=@R6AA3V18is
zz@4@A)-rg_!na|oy+0@>RZ9R6;eSS0sZys-p9(7DReSLg{oNYR-oP=p<-9{?V|$$8
z{-Fcfx(n+LKFTF6y92{?&v$}IQ)>+3nX?!mw3H^ud+F9>Z@!t1zxl`Iv0FLv67O7Z
zh{Mpd^DxuMVQ@54`>l}9ma(r6?-vK66XKR2MDotb&X+Fk+FvrrRx}x|a<(G+$BIJc
z%{iMA^qHO`85T~eXMFuiRbhFZjmGb*VG5E4M&h^MafK`rmWltVCV>i@DR%HhtcT|I
z@ppvn(N9_c3vacjUm4+0ZD23JWJt=kmsH>dCcMy<Pgcy3s~#=oTj;1N`A;05YzQhO
zN>;2rxx1p1#C_BKgx@$6K1|yEc|c4EO+nrRXy_Q}{k~)bLF8*0#u<$-Mp#5us-NQD
zo+rPbZ7-MCF873|C$yc`HaZ;R3b#7)zcL#pDgUJSdkx11Kwvg*gIH$R7W0=~Pd&}_
zairp;ZpiR(%4JD(Y5gInrG~K3)c~b{$j))aPI?1x9P>k=c{DA?{02_kRUJhPFXt`r
zt%x^t*Fc`4Krqs_uyl7OOH4L$tJI}oS_|uq7;AHJVwGUs>4;HB4=qJHHKxg+l+sUq
z-$LIh=~|Dp_hw<)uv5O+q`0JzSt_)Y)~Nr&kfy}Nz)+d6R91Yj*-dOFW_erqE0;rr
ztdU2Dr?k7E{dZZ?I3C?j@rzLv??M6FU_Q!Ob{uEz&B$QDLYZ;z{5jkjL;LI&!T$m#
zLD|0ak43f1W^wJJQ=Tn;hP#%?$%<fH)GlFO$M@s<>@49q8^disbtdejmtr(JrA-am
z2GCry_G}iU{;-YMW9uR*+YroIyDwj6X0<M5Yg62|QLbZT$qmfNhB4U8bUetnBx(XZ
zvekfp+OB^<(u}~qi?~=(S-3G5Z>^cO!jvCL=abq$;eh>-4oog_074=;@c@4E%DBt1
z5zr$ZT<}EOytyA7(gE=YH>D4M(&UoHmD0Cho(><$MSP1vI7L7}E{KaMVL-y+YL~GX
zr%Hhyc|=zNijE~YebPx2KJnm4Iivx~2VX8gG;xU&FXWgip=}$P8Wx%cyrZ$o#~pkK
zSZJl440&DW><q35xWV;G3xkL63^s#s4YdYp4b&PKxdw`}l93BAI)*GXIKz>Lah%;a
zE^rx)KZfb$Q*nHsWdUJ};u>lV)EcNYP-|cjX+UGFiX;nw!kIf`Zwd0ykPptSSYgN2
z*{knM1sY?smD%*Q+;*#SjxggiJ1d7V5-u(sc4$033dw_tq8(`nyK4__)h0J<pgF`b
zjKy*eD-ARSYKP1r;q1pp*gd<(cKLJvdL&1L$;?;0_eE&@E|X0!g1JbkO9om!g~2w8
zA0^-lFP*H)zA9U%@)qe6=7NUu<3gJ_fG~c^L7H$BXHilxUdM;7gN(TfD*+clam7So
z7^;?47%>H31(V>Sr7$iaWu^4M)un=}An+1DTtMNJ2l(tB7C-Qo3~-YHJSF9CK7cZL
zgcF~{%!k70^Z2e+_0kxEd4<ESMP&@OiebkVP<)y`AB}rG`|Z|W?#^F$k8NdYnsa^U
z*XDXjKwF%~5RlQInXw5VTh|5xN<3?AW1vhma;<?yp#j~Q@xJe`NWxX#Zn=s$%G)hZ
zb!kY$g%njt5{;42_A#ak7MXIQUNudwkWt33y+bKkbR&m-?VYzYmT8LCK1bQHUUCf6
z*7y4dg_z;k7(cyiI?OG%-B2@3{l=xAvP-*&=q2;AMO3P#S(M`ZPIbG8wBaKM{aXS}
z>x(453UBQ18<a=Wqp7@u&Z!%6mhFpk{Ztz^26bp}adfo(uru+kL5`7Fu@b{D-x)Ct
z&R2<^b-tNdr=gX!3}tHxdgz5+!aT5zW3s<VW4kfe+M0=ns2$W+g)pVk^qrz5Qf#To
zR54ar)Rfkka?4_`vb4wmgH(>P7$$UDd2*k}*tIsN1EyA*NzS}wv{t8qKK+7vw)>Z3
zUaURx@Fqf(A>wCII9c8#rUGxV&qInXrH`+ggTPIO;T8fEfD1oqvRBG4MH7}EeC(gA
zvN+NJ(Gor4WJne-aN#c;!tz5O{*r|-7hwRu@Sy>26BG@?WJnPugb2eJfGBAYBn?1t
z@^UF3_!wtJmwdX26MyiCCk}kVT%tuh7l5mHa0tT>{u~+6lveS5X6z;uq|pf#uXM4p
zijEzSnpo*v#!qlu^$OpPV7s;aDJps|AE1h%*$<~Tzdu>z*az<-%I8;8tTj+;V4-V3
zeNoqrtAs+rr)nN0h*=s5o7nqX8EgIZT%Wa-M!Pp5X&M>U+L*K4zN*fc@2?%&;x{gg
zHC60Qug0h~P-~#pz|z*hsK&~QwanmPMWHlnX4d$w!<8H(VH;JVsjp)GV<eB!JHEkV
z=8vp8F^2PzIUZ)L9eDH17z<Nituen4T}m)F`ep`5SDpDCDli^ZS(bS##L62V@aIiu
z-lWouzO$N*c~)pPaIIRs%G#)%lrS+$$m%&4ns6~LPqZXY)8tY%M}@IJ0@xoZAz{*F
z_yr#z4L`P1Z~@T}KF3G^;DG}zn3FC6+wm8^a7B;&qzRNx9P;EfB7>|Dg+Lf22&w?Y
zAshvPATIde5HE(r1K<c>e2Vl4V*nPdPW-jw7djH2JcOZv%azInttEG4ggQ96rh|b2
zC1#C(;Jl;EKts?IW0e=9q5PwiWu&~U;MytNjW2t;fZ}8*#>U@n`Fp4FdIzuWPT7FM
zEm{GXm^urZr>Gc%XKW`}r*n+EOF+wxI|lfA{lWmcH-PTU?@SNXKeYzts{ys5s_y{t
zLC&gqb=Cz^q>_NCd#ZD;K~j9YF&0DZMCyYfrJ%=chB0W?M2N5Z*-l*>Z@D5^LQ%YC
zVM_~nsqLZQ>?~&{A_HGor*B6V`^c#8K*{8(U}0BUL6#CB)q@t?OR4OOwXDUuj5p?@
zD{buKtv|6gtTo4|3Ym7P)%W)5%ZsIhbM@SdT${se3W+hD$68iBW*RV2>26l9v0byX
zc8rAW7-pT)&}GBd%%j|pcX=aPYp_EYgWL3U{FD+O_lEy+J5M;C&&s@K+;upZeut9Q
zGiMYE{gl7Sn#HxWgrS%YR=)9JQ);^?t2L6w9IiZxn2-5=Xg@mMk@kq%tGCgpAJbev
zD{tH43Ab%x9+~y~Y8|p!%Giqi5kK()8FS?#4C&Co&!sf;`Xb+Jgn$8l@WH_^9_ICU
z1eYB6!I3=X&F!zsFJ+Jh6lpqxnAG?s6U5OV8MuJ705K-UNl5SkF;@+c4;rE?%Mo$#
zAzr-9>jl(KU(qBUJPND)id)A#C<Qs7Dc8J7|4(QMK=n7;gelQST$9Oq8Ok0fZWAVB
z72@cwtb+CcG<jv0j~G<d?z~QU%4l^<k$DO}$L?U&`v9^=RHNmi(!d$(47CPo4J<ef
zq*I8hgcpzMJ7sZFNvh{4POUDxakcTN-8p-$Im(Tp?0hxYUY51lp^Zb?!(g2=??&r#
zS=Q8Q4b&RwrU5#radt}GWE&z){q7<xTA~$|GKtE)lTvcY*g+nTZlw9QM*NI<d!vPo
zD|W^4Aum|<o`yJ;^1>9(S*(;#W1t?`uC+CkeRgI3%ce>tuZXxc6*epZ#r0`1+$_O}
zDy*65h(nG0$T!jD5A{nF1IsUif&Ftt1X|5%Blnfatqm!aQAx#cuXv?LH)}K4ECmz^
zd*dy3;pa*XyqN+#9vdZq{SrU8fb5^R0BO(w6emAn*-RA&e|?}%{6#b6FIuvX3P<tK
zYike|5g{TR{!|cYR=Bt-2yV*Mg5D0u4<57-oG>n7lq4l69y<6j4uc0x0d%;8TjZ}i
zDueRX?jq0tjiG5|!w_r(o}a5rOIX6-y7BTid_$?j$S~1p2k3jbo!{tsZ-+2s933!E
z88vvb!1r^E2QdaCdfp}o&?Ru?k>;<V*1*!!K=BS}f0vh|7xAi+NB@#mBMtpjOZf)r
ztNJfMf>}*j5(b^U?0j;g@SOM2z7W+kPGWV=T}q1U8>6sY?BHO*PdzO2^Np>i&*DpA
zRud^l16C&vR!=o7Mh&Q5TYAGqP+0nw=3<O;$8dpl>v+>FT8W_|XGo8)eytYl$e^@%
zCQC<gSU1>ZXX?({$JVB8w=f@{(-Cx?^QH6`h93hsM&T8#hwTr8FvkIKmhhDIyEA^=
z)50iAPboW$BR>A;nXQq;e~;<dL~{J@p271sR?may?JkQ_)&C4eA8fm<GxLWA#ZFDc
z2XrNaA3=fQ4Q6Lo+x^F0&d9GMR!+P1r>Rr0<kUpiirp(FrIz^d>XI>m0s^vI5|;fD
zTm+Hv0UQ8z2_GE!als`WyQkt)dg2dGF|Ta4qyfUkFBym<T{xsQ8CeMn0b~GIf)R$1
za0rv89lJ8<%9Rk{gQuD?Zw|x(6d1hJ=u5o#%Y|1;k9@uOL#Kwtq=96S7Z-m_(yS@b
zN@_3-aEp`!P|~<tq!@Pw+wERS4{vqKjxU~Enh^e^-_9Xw46j9L`VAW~e}$`VEd6S%
z##<U1;Ew3jb0~gs+%@U6qs+Qx97^e7q)fx*`^BzeHXQ^vuG#Cblrul2fqr|$gE9Q$
z!YF=Nhk1eTk}`v}&w$w;)v<MVC|(_1tp=zPHQ;JF)zn9+0o5t>yT~B+?<!!{qg36=
zPlOIBbEDj`<YTO0tB59PT$E1oWbsx{bM{Kh8eAI>_(-)MBSEEh$~qCcA4~{d&&MFg
z_{W5Vhor2VSVJvikhbzKisHtb(TbS11d80;Hd5_1W2Py6`sblI8EpIHFff{n)S(aR
zEG{X04Bm`-tg*Z3Y*2yFzR$g~JCyUh**H+Fr$OoVhp)N4u&ME(Yu$-uDn@ZkDRHqs
zia2&pjKH|0r;HUYRtLg@&kkR3fD{KB;zgQhD-KsSQ_{$b3rH^f;E7fm4}bEI?jT|c
z%Ow-YVqDB9=HNq+bd)1{QjA5pfTROr4t*~0$U}OHLz)VP3^MxS7p`bX2}S-+ufu&}
zWNKJw8la+^R@ii6zWB6wTEh|s*G-4=x2CnmC~NEe(jGUS+gRaI5%z?eCztdXOkeyA
zqIoUqkv}#L?=bAAwTvqLB)e%nEb+!Z$<<WLwtzIC`zXD)N*13PckIMUCR`+!@hL`+
zFziQ2m?~{Qk}WcrzL`u?an*8o@#8`tR?G|hL!`XLGKC!W%AzfXt6rQ{UCjB?zr*Ht
z40qdN3*RaClOO$XzGO<yXN`qze$?F<;5N6tZP<SMdpPHdF8pa&y;|RL8G|r2%LS`}
zqM;+sFDo2V7ObYK6Pzw&t&g?hLEj>Ov&%RzGq>8-6wCc=Vb0q1H%!OX5jBf9bcivI
zk9e(E5g*KAoMSY`7>@Ce*Y_9bA}H2SR?iwXiud2p3LGT?Z=)R=>ImdOcdWCe%VAkU
z2b!vr_*O5bxiX+EDf^S9$SrGjR2H^HFRHl;W7Jg^?3$|7)Q(9UHcS9q<#Ai3g-HX4
zH1eT1**tNT4nBVH#9ua7!uTbl_!AG14<Ik}#hbX?fa?MKkuZeQj7nE#(j+j138!f?
z@)9q`7<IuRAFk5On->cHDu8H;E_nErSG$F!lr$e{gy*tKG;a+HUIRAJX+h^54jqpf
z4r`DGbk8d+w^O{*6BivP!FFDI=4?-$<11HHXumN?*=u1YPyATI{00?X8RneHyuJ8W
zDd<`j8c-`-XuJxoFEoAB@>Zb%wX9BkfZ~NWs0_t?qBkg=GVqt#aW{9q%U!~@+ie>*
zyTcvA_19e&{&4m0!*725t1`$N4JO8sl*X-+2)B@lY;<JBxU>piJLBCKoHkKoq2c{)
zi@4Q9WXkprj`C_O{C%+#cS$iBoU{0<>!MxZR<2wbcHVWjrX=L}```Z_uD|x$@Q;7|
zy(z8i!2KWiz;Mt@4hd`4tO-wi)We+orkidSj(+no;otwhDg4*#Ul&%b;wZe~V5gmT
z3G1%AZcYTl#Gn84r*Q3Gu8Hj;Pm#yk49!M2ilRs0-eZRy!yDi7Hs`eezWan5uD^Z+
zT$d1wVx4-o<Ufl>3EuA(%IP!c5fyWi#?!G@s?|Y@F06lT55&i{<Z3g?EVn*tdU`rc
z+2tP_YoXMh%B04k3C3W)w=!i9L*vnYQ(i{CzrwgP+fg@@RVvMEBo*tp!tJJ{h3Af;
z4s?&`&WLj~#g?H$XzAj?#A<JE;x`<J)D$=zC2|j1>a4nCf0Qtgp?HeNxPbi=g9T5R
z38#i%@WCZcp!_n>l1D}g@c|b<xG5g=z!e^T_!Ey|7!ZB&#)U=;kTC@@gn)>UuCV;L
z5*Vg107ndACO>YPPCn8x*vhDDUXPPJ;s=iMil6upCJp}NBTO23pii8AU$cfu*Fdq3
zsMHi%(tS{1U?^gyxt5y0sHJMkkH(iL=lWK`CGPHu{Tq{Of1+I~qq^Ocs?M5Nt$_um
zfqU(ApK#=Bjt+O&eDfB`F$kaZ-yaN@T=cV+w0TFQUCwB_>UoPgbVe)Rtew|L-#x`x
z%``17|IiHjBfz-9!$5W`BLi=>aI|pTwW8@{f3$|h+UVA|4sU+jJ3Es3#m_GZr=0wW
zaLL6Nb;Kz<Vb}Za5w^Sg-JR?`cHA*seBtoz{m>(h44dEaPA#Hhi2lP>zYm}N^vU4|
z=bzV-UPsg#SS%W#tMlEeV>0+G_Ti=Pc9M=c?Udqiw&BF;Y1OJ#VcHC+Jh;o>IvvNL
z)py}~Bl0i~>nY1*jKXZ<Sz%>mESy`t%8ezxsf-RItuAr(w?q{fv)ir-jZ>t4<Y9|I
z*36@*-Wbg5(;qfU$&NT&NhAw($d2^LbFDpqwqqX0&<_q*ny$H3R81hUKN2VVBMQaX
zOPrL8EfPEcJo&MI%8$(we9@7O6qORkMS45_7M-VqqrBozo-`kR=*n(t-U!N|FiZuh
zAovv~U13~k$Z$&<GzjCu7~w=0e1LR7R&vn;R{&k|5hp$=9p&lDUkpXGb|*^%bQb<9
zr!C$(z0#TEnCJ`;{#471lD5K|tip^z8oK+e%dePw>{BoX=O6B=fFrd1bz`eq>YW{3
z=9xDq&dq9MXL4jaoAd5x-el{HwFVZo1~j-<T}bg6Wl#Q`=RQ9i_ulurF?hz#H~Y=6
zE(_;>@0@VsjW>F6x4-*6!rR~Vp0MLR?_E;y>32r6TQ=&GC12xjK84uq4x5J)KJZb$
zw%slo4ZG24!ry*-D=#~dX2KeK4WBnWyc4D)o_|-~jeW;7#*ld25YtFo0NMP3F~%2~
zERMzif4$*`aOp389xnUkrQtvS`L|1OuY2zljyd+Yu;abTYID5{_Wg6u3Fn;k-SCam
z|6jP&4ANx+yN!Q)`ESD2W(39<ykf<Qu+=u(`i|T;z4aYo{q;9!X6J3Azs9lWUJnTG
zw)>Z>-W1TR#)%Gj=VU+8LKWSK7I=Qb(I(?@HRI`DT+Q<neSlnWVHuxZ<0)@@q5Bzg
z>2DYpW_`Tk<5#!ba<lhWJTx55x~jeO<;1dnn#teHkWm=JFuS40URz0@@3Po^<MX6!
zjXx>IU|I>Hj(YCWs}0C*k}q&wf9No|%uM2Qv8*-E%&xKay~^iA+`IbtZZBRv(@jCF
zwP{q#vCEj39qQ~zZv|?bego5;KxVwOKPmc!+rJB^PFMd_S};?R5}Y`I0wXvst%eRp
zN)Qg|KsWoRXpo<L@JZ=NhWYR(4<KW74B0Oh;uORLm%^k%fL9C)U%22XFL6qj&{7hG
zrJyVAQeIr*$pb#F!sc}#9z0#bgD%!~pvXVQ*1rp01Kyaj&W;99!zeWn2N_<iDtz9z
zG$DK-v&jH=FoPWfitq9&jYCbS)<CU+rL2J+?|HAV|MOnpljh%F`MdCzHy$1S_=i8Z
zN?3sGX1gYjdB?lVfVDEb;lJJ<_S@%)Hs97fZ0Trjot5i^d)@m!Uf>Nk+^}cCyW!J^
zW0>^^xi)@}8kj5iF&5_X5h1Jm_)ybinq?Q&h~b>G&I~7g<b%$Y1@L|EcR$}fjM0>~
z`I;jR8;L|b06F%pZ>faW)mL2=Uh$HHoHq5o^|srELk@jq;9<-C?!Q-f?tuq|51;tn
zdGWs8?KTegl;NEA<g4|0k*YJ*8mKi;YarJE;}j1uXROa!VQZb~=@mX#$PpHpCmtO!
z<6|#7H@R5C&CS`k$M|P!tZ}WS<HI}|FHtQ1s9@@$hQTy|>d+~=^JBBDX4hIh^8v-R
zoYn6T^$MQPg$ODs!<etb@tyJ85m1N^;vv1rYLepUa+POcY>_M!h?AWYKk?Es24K>J
zi+xiDUvP*A(sbel#DlLm=mW}&OB}A^Qku#u`ncfbP&5dW0D@LPBBp{ukUT0BVL*5i
z5Ld=r=xNrCU)!XWE?&wD4s@Z(MZChe7?A<e$g4E+3CM$-qN(`WoiGjfprBEpARB`j
z=~SW?as<+fE@W9U!LpxT`%c;}+M^y;Os`|gui%!->ezQ4TLmMFjKNG=hO2J|Lny?F
z2Rk?BY~WhB^9{;Em*;myml~^+Y7Gppf#Th+dr@vNeHf0SCECN#YL}P(<*-*B<zouF
z7GM9GBg1ueeyf1-=Epz$LHPc;-wO|T@ZRBe8*d!$evci(uP(b(D88`T>wymr+ibgi
zxcw%Znlbq*-(C5OpI@Bg;K8`}<flEu<9__Z3&P+3_P4Ox9`_6P-f8D>^MC#m&Oi6;
z@XJeo9{ZuJGkWBs9~b!0)$gwOKRd4CLO*kM=UsOX>#et*9VKvKIOohWvc9Z|mG8XV
zb+`M5Ew<V^-1v`wgv)>Pt8mWQXZk}mFyjcyxEVFO^DevDPSl<3{N%fae;WR!zqllP
z|GaZ@qv?Hi-Zk8J&%JUcdq4CMVO#t7*5$vxEL_~?7>(Ze^ug9^%`FQ%-DlTuPct;%
z#du$T!}Z~c%P$WXeE+<hcg{5N@DTDzPu<7s?f-szdCSoTn{KvQc+lPt^&F>v_0;?<
zTnv%--|K;4>+QA+o7{dAH~e4r%U}4;Ty)~Q_>A@j8*CUJ@#x2R{&UYhD_nP7qfOj?
zlTE_j4}G|&o$>8&y1uAe<N;_ef4Sz*fg?yZ*>uzJt*?L0<NN*LVZ)DpaDneq-`?8V
zHYO`$ZMq=dc;nl<5tSXb)Ztb3AmgkvzGG+q#@)q5UKm_=um>NMi@N>kkA74{@i6i}
z_#qE-|98Iijd0^X|C!@$yWRHTfqOs1%Y@<h7j~4z1$NYf4C^^!A0G1j_BX!{hrjHl
z;lz)8ENpG%c)}B(62ANGZ+W~(tXyXu*Y!4LJl^nDw+esz>kZ)t-#_2(lV1oWJp7T5
z4!i8Odmi5B8T-1fE;#>OKdV>?TiU(wK)Z)I8+_HO)#2*jUm3pht#9T#vW1trw4+Bp
z`muK8#T~<+{`kkh$M@LfTm<Te2S=QjOx>V2c6*=qy|Y{Nv+?b3A0F|j$N0U*N9%rf
z#c!?d&S)z~qn@|%GF^4$mEo-Kwy)>Beyk6=@y35z{aoDhJ}Q=DBEqIihlM*K>!?QB
ziQUXi>1=cu6*O}m#kvWOMXoCC=*lgQa$`LxWO`s2?AYF-ob=19?R9r{RI=`24DtuV
zR-YPA8x$woNB_&4P#A*I1rH&or&n5eY%PQyEIrN)N-RgNUuzFZlfcWk+#Z-GB*^WN
z7Dy~*>7dn4@m)&hl(KyInY);6-+71+yK(1cn|b;!VyCP4I2XfsOFb02r!EroN^0B}
znj<jBj$Av{H#C(tc)bsvqgNTar)RptZV4bbc1;%J6jKT|ueW&YkE8*zf6}>-AHy*D
z(|i<1VbN3(3FF5lKlH?(Jj!cc2g2|dJ^0E`KG6fOsbeNn5sC~5LxjwLgc2bH6f+4%
z7@?&+_>d+g-~yrnt_;1ziKcMKPafjok5L&sXo?3s0m%YQ(f5S<XEHUQhE<d<4qgmk
z@me%vMX{h05Z2ApP82%AICylbsdl*ri;MK_7B?0QC_bpnW8iGhwNX0S5>GK_?8*4T
zhDMndb~$S47qSLuh1K;6<!a_`TWk@y0E~O7G1w!spHH0h-{H4rcm#MbCD>xit-`Bc
z`$jX`ZLg@@J?E@5!in#BSGeh>n>=o%?XW%QB`<S7{mtW^^pvpKW_QT(pZfHD!~0Ko
zcR2mD|82yXack>swlmqj5lG*Ck3I9W$C&|b&-*_xy!|b2$m1|@zwpI}gngc|pC5&g
zCz$6M&)Pq{`RJqkV_u5iXro()!(aWn@PG$BL{aWO&GNHb`iMhcY6j20hdm$gpzyS(
z@0a7i8~DnXKHt_L+#7$b8Td8|haP@Z*!y9R$mz<1(e3zS-x01dqg^}TEX4clvTN9F
z_xqah^_uX41D=%|yTO0rlb;%%X1e3-=P!Tp^G;%mEw>Cu9Q8Ug+;7)H5~J@2-~Zll
z^S}S&dc*Ml!WX~P@sK4o2;aeu&QRLVe)3~C2y@P);{Nro8^bG)JSyDXK2XLn5Q7?o
zC0u$=z7}|-J@gTe3<tmbu&_a4m-c@9KQA2jj<<#jfBF-V@M9QW_1dEYM=A&&`-CT&
zA^hs_!wbHzsNB87=6B4?f$>uY;r*Zg!tkv9pPS?1LB~J+@sI4|bFcL;*f%Bi8DLC5
z`J|79W8V2L)BCcp*8?Av8-$VNxc7Y^U_ecQdi~0mzGyqDKjhI*+2`qDtF5=mQC@J+
zi{1aHKmH*%2tWV87lmi+_v{=;p8cM4KsfZ^7l*&t2kwfnhdlr}=p`==>#WoGAl|bN
zcwYG2XFe59`Si&-I(7dRdxK!7`|O;@;d$ayo@x&Xo)%vH%0u1wLLBY&O>cd>8DChg
zG~nsad{#L86$b~74iP-`;nee?ZR+{C;kb9ct*M^bMc%f4tbGnsKa!<(%hNzQHZJ}d
zTUy%kbT~YvX1VNfn;Qwb(#_T$99g$&Zk4SUX3Q|W!rm;A>7r}yiAuzf%{0c>K3QKB
zcM78iOSAEnzPZfy2``6i?H-Bu!=WFXiBfM{VJJnJB|)2<OOES)!qgc?V0W{5c&2ts
zc4#L9M>?><uCrlYx%+piZpL&jHjOc7Yw#`zm6PohpCe3^M_qymMJIq!7r_3Aol(Wb
z<--0bKlV!&65tX~e)7mZsW^-BI21#gT-i8DhmP_SPWgi`Ilxm`otDD5fcVFd{UT@z
z5EFBd36ojEi6CK^a4DU9gb@Ug5W<l{z$Xsc&|$VDy5{w;@=6}zDxQ4E4o~GJP3h*1
z{?cqpP^@7j8el=>MqnF!V;5+Rg<7t`ZW?ZdlE6syqKE#M+n0D6uY#1sJ0s)uY@-Pi
z6z*gOISp`SaiTr(+KiuVWJKYqC(+B6m8j3M1g`1S8kkTGs2i^Gt`QHZpe$Y(bOo3H
z`q%QdxEvwz`Okhji--I2u-^LXnj!0WH|kz{?O(#@KK;pnd-r?nXvUf61$NQWhrRX9
zN4L;>?h9Y!#?FtQ_95R@jPd7IW*~jxiw_Rp{mwW2+`@F8^3aDrD*WT`e-B^!!YScD
z|Gp_a{85h$ce?Xk!b2?IX{UZU{L*%P0#D!fId(leth(iv@YVnQQaJm}?}RP3+}ez}
z``V7)yN4sqczxty2j@FgUiF$cg!`MZm)%1D^ZC#EPU7uN{>MM@sg`f6@cK8sH5~cM
zL&BLR6T34HddbV3&*wjTvde$<Rabhr_|p&m5l0>EhG=9x<ufN6?_Y<_%?S9c1D+Sy
z?f7OpSN5d`KF@S<OOd>XPyO=$xPgt20Pbo#L@`bR7{wp@h)22q8(;f>?yk4~`r*Ic
zc5GnBCq{qjGS<}&Vc%!(A0G6Ohq@v7oyWY{7e$N*g4D0LZZ5`Cc6QR9F1@6Amw2~)
zY1+=a?iO~~@tz)a*`=4}NyNSCHAnk+b@rLxHDmMXzEkZnk9&geU_a{UH-;BIe}6Yp
zlL=Wc1~cBBe%h(wCqMk585lPRPkGwYy-nnVyLf14GB$q9j<xvF1s9mHdk1@v@LJy$
zyXRgH^qsI>NOVp5mF>_L-1V+^lQ$gkn%B887~}P4KlMp(|4*=oD0@BV!6y4NeMdAq
z=TH9l$9(56yKVuDrQAE($;+-?8G}##@|SEU{yBbJ#k0-8ee2uYCcNn2m-#U<IpfUp
zl0#nZ=P956z3+vU>#Ph<+2<MI9%kg{ym1~hsJ%V&S<i7}FlQux{G<OJ{?8sD-1mNa
zdb<Mu@lSek`07`_<Wvu{2L%{|&$Qj#U;4u5{EdUdj(D}V%YE&E%?D3B!SP}}zplBS
zZ5R4u9`|^=XZ8+9z3vU+MK3tO>$$mpKIFU0y?%~-jo%;C|9Rg#Co9zga<~WSYIA4`
z<gp9c<GqaS&P>7Q-)ZNcCYJ1P^m38#;?r=S3Nu9%`+0u|*G3_+e(dPFSu?)b+Jy6W
zr>D)BX5&tCd+n3=SkU4dCp_Gy+{n(lj<R4-^z{*K(8}kFuwp|QKxTHXrZjR=?#V*~
zP+Tgg(v8)F_k~)S^AW)4XZJ64#hTS)%pcv(Ix4nvFfjx(Z)%s;nNs%@Z&%j0(XQC3
zyk=%~_Y8fcN+W%smVy%X(V1(eFK&|TMsfQic1?PY=8ipvNh6+g`~u=c2OB0JI@mSk
z7hP}x!nzPtd4)%uaK%@0K~sejfAT>imks7AfT)ZhizyatfG{{>3=TAKr6lDcP8a#b
zi#V+72*O2JAmO0F1rVn~Djt_O@{$fHjC{m_;~#r9w}u6z0d73M`FwC$K!R5+YI>uT
z#j59A)an332d^1b0?^L}Ck7Hf)5<3%<&~B})F*s-0T{N_y_Cl%CtrJN4J>jE_~5$0
z%81cZ@aI4ON!}iA>?fYR|MT-5zDFJYa@&pgN6&ZRPk$WPCHnHiUggIY>|#eeT==ub
zu1%1xw<8E%df)+hAN0qoud?%0kMLLeG4NdRf4}ufz64>ye%K)g`B4PKoo`22eC$)7
z^JLCo#UOm!+uqI$fCqXUyNplz$Oqhih3#zq(;u%6@Bhdr{FU~d?D&U^FZ`()t?uu}
zV36MR_P5xp=-+mH3}zUA4|&BAwhMPRKe7U2?JYOok{g66<3&cJ6ZFD|w{|6e@WkW8
zH@<e7_rHAL?U$Ec5<dFLQ~U#e7~4MeiIdv0VJ9pfD7)+3ws51H40OD@e_K0d<KMP3
z`+H}d<$2i&iZK{??UAp{caC24v!8lh9rB7-x>50)Uqd%P^M{3wY(MCpt98r}Mzg#A
zdh7dHxiUyLr?wAawA=iSoBOy*ectwVw{t{}@4yHvIM~kIWgf&a8Si@ATNLd_lwd^O
z=+?KkovBX?pZVm+-6)MQ5;*IOZ#SLK`~7pz4JUp26hA&8C(^;Q^|sr33Lm@ssu@&y
zIQyqR{=r>#xZiZszdGdXFPdX6s4I3nb7Tp?Q4#3;*O&d$cjU5L8TjMXSGz$N|919(
z1A{PWn{K+9AHzWWS!O85P$Rg@UGExxZ6Aqb_w7eN9PbH^bJ%jLt=+)7-QC-NAn^=4
zPU6H9juRO>s^a_BE<f$ZM;u^=cC|NlFhifCLQel`+}-~xlbho;?sTU+yPOc==ocOo
z06fHD_dD0S-hPao&An6jyFKs`9Q=yI8ue`H0zUM|@h)D^wnO_fCx60^+aTTR#|+PT
z{g}aOGi&oV{p%)WUwE#jWJvBiKo;NJtYt}KMI2Wt7vdORPNPm6nkcrfg@{Qd*)ew3
z&2YcX&DjPSJAYx?462!tNJJ*uWqrlY&1oyt^5s!>$|2(-hM#!$Y=6Z-H^uT7!~IdJ
zvGV0;wlbw2d=6q}EkCNnnxO4z@^-jvd7-UZMZ|X6s>jy;Ca&ihZ#(5_rP5DKX0tKW
zcyvW>W9%n$3r@MRwUF-^(W0*eGfTq|f_O|iWEZ7E2;-6l4hrxZGZ#E;l8PfNJmKIf
zpJ-WBi~SQEaKYh%u4qU$;*@S)_bVT`svKk>oP&(CihziaZ~+OgjABX{d|c?@!U$oc
zDDD1LSh$Ab01xuuu9Nvi3qAmORcOM*>mm$I@k#lUXR4>c3kpjBP!fY0FiD*@5_v;w
z{Fr>i@m#EiGBpsZzkjV#4?b{o>m`R2(9c40`nHSLo?yq_!TrnFKYM6qbhB~|GWqGB
z&nPkJegSorF;xH78W@EJyvrT|Bk>uwSKtg!0Utpd1n!-^BF@nYfBqB3WTc7`{owoO
zxj`6u;1vzR-}%<peR5Aakfv{HMm7w>DR6!;=h6y(f8`Z^1~G<1@PX~jkjU%nz;(7$
zd9MfU?S6h3J8$~ezx*6l&TGXW%-O}j-~RSj+ev(eV|j%AU{GeKBQRs<CYBBN-f0&n
ziQ(>o@1Gm}raQt{{_YCb=N<2Kr}z;&RH_Ou2y&_!zz#k9$Z+5L?wRlYebi$f>sai<
zWY;EeZ!@?7zqd13V_kXBe>ge;gD`NfopuTrnel#ZPV-}9ZDSD+D3L8a#=$eR`C(V`
zAjV)wP*yGhi}bJmzpvUZ($AYA^Lmfw+-Mz*0DX3Lr*NgULq4n~oUOLm#&-{cgRwFN
zc7&h(-S32b%~0M8uJN`V{P>CEPW+(nu)X|OzX}(ecV4dFUNpL;^I&<Mb>qGFZ`=J2
ztX{P$9P#pl-OtXYjqSYW+t_a271q9GJm$P(4d0H~;pc0oeKl|a7@co(o7?(*fB_Z2
zNXvtW)QC*{*G`Xl@B`@VJKy|zc<u`iGGp>qJ`ZAU^4{a#<>|B&Xy4|xw+ZW7UEOfq
zb#4%LISu2VcCIiy*I$1F+j)PCy$SFw-)YQl<Md4A=6b%|>iL0AUq8iqz9xH+1znEV
z;9=3_M)QL6%c&pn9lP7;UdJv<)dJ9#d?XpeVs&(C?$D{ba)%w+%cvof&qXv@I*F6*
z%$&8InsaOIV{FzRu*){Ck&vNV8OxAyNE%iyGiSR|c*V3C1g$Tgvc52Ij6_!EwYCOp
z-aOObNjq&WAx6MPdhJ64ZeBO1O(T+y4a?Q$Kf+@^)X3}WV6PO5%V}ALVfAfw?i;*H
zS~DV=w+n9waVI+Kc$c|L;~2IW1Glx7w%dk67kLwG*&cBz28(cPmbgrwiNlpGl6Wea
zcwFp~0O>_s7AV4#E1J+D4!(^>6aDaq9vA84NqLbMP#i87^ps}a#;#ot*bfL|DuGi0
zhyy5;@E|Nfh?hTQhQSsf4q>HC(NKXz7Z<t!xB_UaAmB(g@f3gPIsg9ZSmYP6Yj>_X
z7H;541K)v~h^5M(G&vWxJhXxSN<b4~;NZ-x;xwQ?3cazYb0$-Wqy@OzXz$#EVNh;p
zYf=N>Ia`Q(FEJRY3BvBPGABslT9n170ky)U`<}=`vg1&&+2+x(s&FrN%PqHdl%M!f
z1)6rmlHYLsb$$l#7F%u=II^J#*ZjF*+$Amj7#RIf1hf}5c+E8!oSOmT83tkD-_3Xl
z4t~Yq^0v5lx$71lx8>H`xceu2C7(ectt*Vc#gF2(5E>$4%dMkMe*4?s_)!22QgJ-`
z$&Y^EA8EVWmRs6bV6w40FcmP%aMpLv2+z0UH`p=x*vCIHU?A2x%U?hJw4Ce~X21h}
z_LJ6+soik>^=>HM!gz79qJ^h`al*$48~Xr^huz@ntFG#n+&1l;v%VWn``@pGM?L0o
z;n8+103R%32egdAWMU^YasV6=!PO4f5esOyE&dB_Cv*|6GlOM6fbsc%?abb%*as0g
z0)Y#_K+1>gKK%aobv)LiANrfvNBVT8?$x$aUckrSp8JA>!XEd(zZ+2%-|RN(sX4wm
zMBCu(WFCg}3)fzAO$+Luv-=i#c@V=x8g?`9Z^uaRp+P=4*a?`=yzltq>?4-(hzK3S
z0Y3GE9yuPPxt<^IyO`V2R6WP~`5!+9q_uv|2p|5yaP`xU_t@gH_Mh|T=3Hc;dz?Ob
zT&1Izsh)SIeiY8tbMMt`R1e+OADP+S<+aVWVU3B6;f{w`T&$NS9x|DIr!a<K8)$u<
zH_cca+n|3pAr6F1#fis3G(|1yz<jzJ^7L~j)8dy|BLdg;ZtaMjwe6tM4U%g(psqOr
zl6o%%jEtX2Y;?JYxF7gF5B^Tlmc)4=@!_d^e4va?$SyhdOH~w|8n#E-B~k1uy8w{E
z<KjjmA90+HfNH!6m<tUq;?+q)2Yi4y@q-V3;VDh&%IC$+aN$F|_(4NJesD>1z;K#E
znh8VzW)KvB!<EKMK;pqIGNN$sB2V1b5@{eDxa7kXP2pRVE1Nvf<x&BZ*P?O-K?mgv
zm$VwB0lP_6sfrr4O9iDeaFhCtnnsRVs0F|ey$uZW$`rZy(_@?DxS@UsI-O*u&hrm6
z*eL3|vF0-ZcVbY8XVBH;jU>wDJB2z7!iDU0u+~7WfiY`91OI%*NDWZ;wGX!azf&6@
zbW3S&v)y*##1DPcqd0$-SGD<A+&b&7n;#pI;$x(}z3plQ{$U?wD+PLthyPAq-9Pqi
zZ}uI*?f71A#%ka{_NqRxt{rhugkkksq*n~H%M;jSlg)grZ(ek-&38TXK|2g1ae~mQ
z0CtjM_~l55M?Lm&wgdA&ZcOE4ZX72e@Vc^(gK0Ol;&EeL#aH?N@sEF|N$!uYXCgzk
zQ0`$6#!xya{Pl*v`tb<Ax82dZ?6#ZB`SMr3D!lml2l%d1=urj%=g<Dq%GeH8nN9%h
zj&6rT+=hjZ(sjZk{$n5hpr2Q~>+XAmd)jX6op;^UjkJ$612)z3-s6t#mc45l=Qj(k
zvK`z2yLM0bz(@Rn$M0;nJP%!{Puk6quYG;Xht`z8ovRP7`3~Q2eZwEr@FBuoce`(R
z+!LSFE{n&p<2HRzLnOO*1^>D+ww1TO^WA>r!{7e;S33&gD}D?F{-^Kztgz!f?<I71
z&pqd?aLL6NhCS?z;T<du889O6V#j^F<?Y9Y7wo@Zb3NM!5r6sf4)wfR>rAU3J67ad
z-#9&Z{n#$?M*Te27E){TUCd3w)PV`tfc1C9F0aD*@PsR4jN(xb*2$$%2sV;fxA0b@
zoiS|3Nbu1)#ur~RHIOFHXXRlnG&?(EYcM-H!v5GPyv)umcVMk#SFt%xUO^^MqPES)
z6rQ#rTXXu65Y}!?(^2J|2SHw&cT@uKH`3ldd(3GD;ZNJ~wY1TWYiui#8HAZX`D9@b
zV)Mo|UiM!-cqPhS+0L*k`z456gmGouC5#=Ey!b@}9O%j@3_c|y9vs;{iQ^(K7kL0&
z!r%+nyg7YnNN&=>6aOa76%E1?g3Mx!UxF)MMC7VKxLg9^;|dT2p#bu8Nnr5Ek6g+F
zF6rVyJeLYie$wPZUo_2I0~&C{>m;axNsbSiRz=iO4LvnL<8HpKdS-Ei`5lQ6chUM8
zQ`};ad4CN1z=}6&{Gb7Y6AaeaPF;V^q>udbN8w4Vabu!mgB9ZyE^#%~8mKiee+`VX
z8yBzn+_oG~!1<qdzsC;#Avs~iv;Y7=07*naRH&Woc!x_azNn?(&p+_R`Rn&O&y@2^
zIX`r_-S6vZ?68SbkhNh)Gs<jut6Mpp-(B(B7J7q5Xp*gb%?8vMd*u~ZDA{)>{qTbG
z^DrKE9%8`0(axm>kZbRUJ;HaAZm_|IX8dXx9H(s|_=(SaF|1>|AK!HJtHZA@yVUdK
zKXjIZKmq@X|GPZ!p*(gtZ-4h4tPXyeQ{&hR3}gUDXRuK9MT>>KfA*Bd&)4i|g{SYk
zpTDmE>;s<X3ExO|2NQvAFf#7C`|e3yIjS4&R99D8odTSfEZ|J%OD?)7Ti7qNGi2|q
zBm`>sOYrdlz4sme?(nvE9q)$17rgi-;R7ce@02;}0s}ZZQg3H^`_T_BXyS-rk#nSP
z$&ShRL$dpwbBTZUlOH$X-y{2IT~lP60Og1FzwF2nK90u44(2x=^LE>feLpuow#n94
z6uX%Ds2_k4^;=*6n)~l}|Gm6zaKyr4hrA@LSrd)y7-Xkc6qhKLB^k7-k+d(+PU_E`
z{7L(8;wes_pKZ3?F88<dY;S#n9-b(D+wHe^FX#PYEM}K3=l=r7y!rKJ)W6LA{Ot40
z{c=AZK48Zi1MC$3j-5};1?+3*WOEF~=6AfKpXtn5=6O9^eg5c&9qKvz*kYr8Zfvff
zx4bRZ&o1#^a%PL|NB3V+|BI!F6pemAh560jQwsh2n>jb%Q~gt!4<?*t4p4rU`{Mz|
z9BQHgaR+B3ocOZMB=kSCGkkc?&gY$45mu~N>0?)<mEcd1mj|CSGn`LrJLs&B#i+O3
z-UiJ~!u~B64Bc8UO_1mlEeb6sH>G=k_M@W^%`|2D=Am5?mMu@)TrqX{F!jj13d4W-
zJH3&e9l^8KrdG$&8NX^v)X<6dof;b&(N*~<mh6wRHBzC(;}VCfPK<cjFwN`f#OWeV
z2H<EAX>^FtP+svOA9%O`uK0_$;*>62!r-*aPnsvVr|=`fM8gaM5|%K4%gjy8$s<Ua
ziWd0H?!c#@gt?Rtzd(5i6Ay0`qdewye>?u7nHC!S8YVyk?8@{GDQ%(?AlIT3A-$Uh
zDqP$dRsNt6g`nDb#U%FMHiX#IM1MtTAQ|U}>>YzG&;(Q2Yc2{eTvy#<>Mq>U)RNa4
zs6qowia+q)_xM?D(8mz>lzpD=A2h=lx`%!I?C>LB6Lz-`l>vN=iZed}9Z9hM1{;JY
zKW!h6<A;3vJmXm&{^vjc5!e+t3b_38Ux%x%{GGFU>=T~s#$WN>+KgWx`_$*dhd%Zx
z-{DF8dEYxbaE3BQwu9{qU5tE!{hsq&Gf>^h($@D6m=T|TJPadlFX)EPnZ@kp1)j0r
zb9})pdiy-{*)BVEbNZ>LW;>T`0cGKKLl}m{@11?NXUCX)qn*{tIjSjq<7=mTkX@gA
zbWMP9^{G#PrU%J)-uKRN{|z@>??yQSd>m}O_1E*oJ?Fzd?U@muG#1QdFY-Am;=AAe
z7UcaHjC<{LANR9hKhw_r1@^RaWz*fx>zbkeJ@5Z;IPoJN3r~LP(;bI1p!K1$17Cb_
z{y{Sm*-g!d?D~P-_t+!6^Z56M<KFvz`{>~Yo`r`Wd{_?n&wp-qx7QEt>vkJ&?Dy6#
zyX_v>x%<J7eInoO%Lm_dt}jP`0K9h1!wJFTpY#;Fzt&YScW+7_W~3j9BfpIO=tw}D
z=Lm^z@caW`<VITIVEBE+qaNeI^UjIwZKI8%oJ6j>Ze#Z_26)bMPJss!?>z2=aO`{D
z7kKa_xXN}u3vRyoW;Yn0X-A;|dp_U+R?nL$*?3UT9||Xa_@jBBL*E45<4)*QKk+`x
ziPWA2tbuxwG!d0YHKbPup%}x~*c&6ath(98+Eq4&rDlu{nZ_KA5t|2aJcwn$<w$`Q
z)(6KUFc!dW=P~O~?3owHsLR+L^}5>I18=MN$I{zPXhdKHu0Lou!+#k-QMe*aZjSii
z#M@CB3?`C>_s6P5Tp4olbF&NZ%l@cN0Gv_SKarsme{84}qMiMfd@i7SlApA|L=&cP
zvQ`sD5fn~^Hm@^+p&+)Bhy$MT;TN6+B#&!5!vmL#I0^?Zx#rFJldgQY(BqO^(5PYD
z8nBv4&*G~qrN0Vkza;LS*XAVtRJR9K<E^Od$(rhf^M#f#v)iqtfkSdYpBt19_AuGt
z?w+&PWY`_dV`}jiepN1fn7H`>PP?@7Gl)esAmKs;y2cdf{%WW-uy{3~J9W^0<MQA9
zI=tuI?+gdO{7^Ietsh?cvP1n+pCFB0ckQ*|zuxe=yf3}r{PV)M?ITm1`}(4nzRZkw
zPYTyvcWu~etF7(BQn&R9|B3H;SK*9YQ5()}XM~)wMcljJaZEV={T~TC?0B#6$y2@*
zF1z&SW(eFQ+<k`~e4_qaE9(X4pX<yyuk@ske87yshlfW#=J8=?dwreP^Y5_v9mCzW
z*wS&{cl@#TQMonNPcQS2&;9vNf3%OE-8mfi;zPW=7um<@PI&j*+ZKk8)pf$>qjw*C
z-*MqpN4-8gXzz#FF3X*L$1+A}=mY=z<u8PbF8YxV64WURs<}Da(PCo-i;lHx8+{tP
zRv-3=M|!^R*s%cGQR)%)!$<yzf8?Vd8xDHO!6y3?tgfyLd>o7qfw4GyzwN};@gCGY
zM!Cn>dA|2HgY4(Oa+)7CaJRc{5&poL%NZ=UF_H6R+tr6~=Hq_!LmvpcnxXHu){YK)
z)luQ42R_dY)F*xTL*YKV>>4(=I{L`RPYyr7<YFg(&wJn7jI|ruE?#zt{*T9DT>SV)
zJ``T{+M@$!D1ZF3pEDg_;k$_Mu=(cUH?}jLU9i0X<NAL4KQC;w(MI8upZj9C<iZQX
zZES}!yXt{+&pxvk2~XeB?u%2tbZQGOM(dB*Ik)GYeO8{vM--_8jK3fF?~jK|e}1vG
z;T;3JVX0dT6e;}1K5`e&z?=^6HpA%kR<|7Oa>lp68Gdd%{&%%q{Os7}gL~|9+j-aB
z)9h{iJk0s;Pkh?zogIGEJqvu~{p_bc>3Mid;Kmzobltr64Q~!V{qYaoP``uizGk;~
zYJ|Sh9@g+ciL_(vn2BFl-BA`kWC&b*;m`bG2L6+*-tM!@F0r0ZvU;}i1NXewPHvQs
z_53A|JO4cD=ee<dPWgiEX1DsWoyB?mjOc-s3p1{tY|h%m-rCP%12#^?S#vBI_XyW0
zK;vu5Yc!nUsJ<SKqvM*Ewc%&;O0zcnHUBnZ#ZyzQj%+=#X3mVPYiH~jiFJI;@WoG?
zJPkhM^06rga}GO&8Qb`-%QE|5?Q&b2E%T4eV&EKAyBn7ly78s@RsKd>h?|;-XZ^@-
zYu{1rW~#Xsa<K`GZk^jI0PFe^=PuqC8JDSef4C9ccFFr%x`lZe5o}azz7NZwIv9=o
z2IhuAm{cJA*dB!>qpLbI!sNqMKJf9ANBL5}MSFt+k9^RgaY2VT!lH#sSosNqD;)gL
z0K^j-fZ`oFM#W!c7NVG_5D+B}1FZl7hyzF$V=*BN;6hh<$wQn9VBTE#6o)*j0PqLp
z58WEZqyaim{%V+P4bY)eR~T#?gI<X;+g<MTZE+tVp1)-yZHY{JkYW(C!8?5w4}(J-
ztb62LP{||I>4MTrEo`lU;D+6Up1*%M`^@j!hoY|W$-er$zus^|_|zv(3Z(!2Z+~l2
z*YU@`!;G+R4ZP-kr#s)-k2=`!RvX#}*)9n$d+~w33%4ml#ev`a`m%7)bN34z7s2ku
z2S4QDz9X2|S5N=ySHf$Kc!ixU+c<ml)GvQA9Ci51?P!L}!|iPc;~snN<;LKv%y{*N
z*BlYfJR|N@mDuli>l?#0R#pJRZP73%Jh|QQzx~axg;yMMVEC08$!=xFM$SLQAp8gW
zu-GwgdaZqA>jaU>-MG^xE;8~+^RP1*U@`X1ugBfM9+CW<@a|*7amT*h<o~nFzOxxt
zIY*cChF@{;ivotV6h8jZ59hnPDd%SP5iwr#|CkwTbD&$bsmxTeyE;!B!h^x@!zaGi
zDctc+cM1nQ|Ap>n2kjvTy}&*|_hmO?@3H6ot<K^{*M9Va?}wvad8p~{>YVeLXM8)n
z<&8%N4Dc9N`RLe+l`Fz=?|fT0*LH~a1AKJv^{+m{4VbsO)kfg~58m5%zp~@)bDusr
zeBqSO_CqGeVRzJ3zrWJ&jZfQs^`hrJr^y%$B8JlszV8G-2b=P9R`JS}>x4JH_SN>G
zy&G~`^6+uD54`vIaC3HsG{-LpsCSI5)FHa!++H3KV07&U+}C{U599k5TW;xRgZ|Xc
zGJd(;*VGSy(fzG&dcE(K#$f)?hd<JfW}&}e2Yw37GmbIbGr#j~f1trGY2;yN@maR>
z`<-ulOOEdK{Gu27nZ!J-;7tXt_3eQbM}-`9_+fcHd;J{ssz&`hD5;;%d@6k5bA#1S
zE=29AH83$6V7<8T*NoiDtE}JTSRX%Ebz=0}DhRU1ox*0eG1W64;!I?Y>|rxk+|ae~
z>!h{hy<>dXHyvng%)A35I&&*7-n`QB8Y5lL_7*+IXso@<t3%%%oZY8v?m`EP8(eq%
z$UaJOvss~+9Qz~}ijXo01GwX`e~LeHVtkS8l!G+lb7<E((l}*;2pL6G1V|?i7iK5{
zT>Oel^Wf)kzw%)CMJVFPm-<uTSpg8{B9C10B2L=~z$MJ}*@ryhnJX{8q;b}l#Vu;s
zaOF)SDIXO`=ck2q6H|=9sg;eEFySysM(g=JNAxF{Rw-UD9dw;ngVmdWeA>M|H65QK
zVj<0Og*b25C}qSrzsPq78!dMDFbQ$F=S_Ql8EKn(Wg1;GS&L718+w@^<w?nf!s#L>
z6Uu8_lUcr6s_|)HK6fy$ly9=>X13GtS~vRiBR#u|H?~*eF(}9LgvnLpPPiD?5A|+1
zk=|N9LXrS|IL0g%b$`9#dh5?L4@{5}FGpQ$y4mL8hU+_*84e8NoSlq;4ntfoy7aBR
z@HrL$S^sLrM}KWTm#eu<inhm;CWnnp*~7{sZ5J%YxQop2_qrnw7g|S`y1L!%HV)VR
zC9SLW=-{$b7ejJ7HhGU~{29YsN*g!P1y>wS+sodb%lu+DwhtGsyY4z>@V(aSxf>OB
zLa)EU`rbZ!)mbMx?0DV8jxfOR%7^eU&{qkJ$sC!$dA<M4&c5!(kGTZ*Ek<VyrQTSx
z3>a)Ty7g`Rfd=!8ej(mRoBOU~?xl91HV*%5|MHi1C{1yc>-L*$>N}jSyY@Plw+W#T
z;Qm?H4Enr*&`Acec>P%UZ@$^;$Bt6L2wg*_fn<)mSaj0T!&pSs_jKJ;aHU-rF6^YE
z?%3?uHafO#+qP}nwr$%sJGMGmF;<d4@3(88{8jsO9j>ZpV$3nF+n8&+Wqbj?BALTs
zFr^Q5PzX7q(R^klHof?<gYJ?Nr|-po3;Gg<p;#onKBGP&$a;y4+{i|Kie1&ZttkhF
z%j%L9{}S;pOc}DNh(>>`WMQYF?TGENy0jMICRV>Ucl_IGHor?<OQ$8%qGcgPNQ{b*
zk`ncHe;q<U95w85S&TI8De&BcSGGpiN2)eY;G8(^3Owgdax7=DDz@*G#|^eD=ZWvC
z-aS^wTG6E6B#{7&!9tlgZP7tu?D$7=DG)V=yXv~o2}CdE=UZb8G6LOeaxVPaJgHwL
zRY}mCNaw-uS|L#}7Frk~+MuKqvw-|yL<6+Hl<qIu(IaxaemQOoU%ImhGCD{daI!da
z=s0`J7YIFrzb;olQ2iRQg4gQc1{EkxJ}Zrq8Id-X6Tzy+x%0;-T&Gw9;I$Otn1bdD
zcs*wV?x`jad&C&|T*hC+KZoaHqbO7`njye++a8%QV>r#MECLzDv80ArGk{f{s<y>K
zxJ^w@$!!M^b{2QfB*GPEROBdkt{fQ$D~h!GaPE0*jCaH_C%PukCO$p`1lnYe$*Rj{
zteUj3%sFE`myB2AKflZC%tjk#eJ^Ocpl_}0eGMjMc2r&)zBej1NW<!-0YMIGq5F-m
zD-Vz>{wwl4?XZ>2BN2Hs4j5+ph81TiV*teb%!Pa{8OG4qTr2hnaVI11T|-9v(-yZa
zR3p)Si%}%5IyYocBMLEMTJ|9Z%Q1q<jqz@eVeE;u&#0r%!Z%DNMXu4mG$zYKx~8O?
z?ZHf)YwFUmeVMz?xogg4DyA3T3$urp5xmMO;sh8x`%z~8RibWFDS&M=zp?16@d!KF
zt?wm5AU!U0p7OkKZ=DAeIE*sdUo|Tws()ZXFnk%oY+&zjj`}jmctJp;t$nwcfO_2&
z40<;y=leP#<Qt$I16#b$IWAwt5Mc<N$Rrref{9$03mbYDB!!&@E}tp#=O+}#Z#sYi
z=I1ym=ZOoSgZ6kJ4BSf+0&k(sPApKO%HSv5IAV5Uev(C?U_GUc0)%tiBb_~0kBG{;
zJt31!rvz~g%1uAf42}X3&oc&d$@qZ@2d{)i?I{&5<}W|_HFrTi?5yhw>blgISZ&)I
z#(;@oB46l__2XEX*;I`=BT6IWN>eQ>{RB&YFB)piQ{VdR##8S}LbV?$R3w(T2;T!J
z@K~hcI|Kzx6s5mK3m5b0@)Q+)9mxL;;lEO_L*6@d;A`9WB8na`c{i%VPPst(uqbZb
zp7dKK&D{S>2v=dAVAX%Kv*cXOT`qRa-fUuF$&a+NM2xCD(-kDEgH(yDsyHat7*VO)
zClYfQt;zM8q<zF#>!FkAVofzO43540z8Sa^FYxADbg`9P*Gx}b6vr>XQnwPjPp;W2
z^qy04`K?Y<0j&L!@|av`sxaIGeXBoEGv#&NtbYu?WYtJi2;nu_^RfP`5ZF==&`5aw
zxkY2LCxfo%*EY`hMdb)q%fpdh%>0zE?<(6mrkdGNtCe(@UO0Le+~C0}DQu)a8YWe+
z!ZGfDov0PWLASvd0o4!CBEJ_BV-ZHtzC)rX92eqrl`9d#4`KrNn+H{S&nI|O!u#Gi
zNZ=i02Y5B&n~XwWsSPhhSNI!4h_xG%Xckk$r8)CU3Yr5X0mae_sYLxLG)%D6e9nL}
zg9A$n39yl@tszT7Qb4*h6ICsng$aGyut0IzEi4PA>{5Rc84K{t-G&V?Wkid=*LMO%
zUW3z@z?97`H*k1dFU!*#IYp}k@huys4IJ&8hiX7-8<Fy;4zys%KuXRcyB5_GHeFg>
zGs*lYwDnpjU$Xjd#JmRdpHttL!1V(8W9ceBB=?vfhSvnMgk);zko$a|>)V*+npm0|
zvO=WxuvCMLqUJ8Femu|ha$WG0F961Gio{M$W*iMdy1%`A&E4ucQzRh<SIJv@1a@Ro
zM>zqUbt8a<KTDwso5Cojd!9Al(rzn*=3$WaXf1m;>Q7-q%YctEFO?FS<`E^cAfqp;
zK@ufWl#Bi;RXrmyN<_=pl{HIut<Dq@^6#)=cnO1O!6#YnLfGE#=ZR#6bVgfG&RRw@
zGq^BfRHh*da!C{vyMqf}1I06|zN??%f3`lRzem2)w>s|L=p?(aX+~ojr3%F{gDtd1
zD2;YQEQ8vAdj*Y*z0OCsg|L}3QVm_F^G5s{krWyg&8|dzCl1w$Ccg+b_9D?G@YY^z
z&<p&==K#S<+*f(UQPk&m)Oepqgt`v%azp6Wh1A#;-A69|`p^VY6od(kEi6g7(9|XT
zVxro2fnu3w{91#VYoOlWFg0?jFkr;woyY_9OtPZz7Xq+TF&ABD$eWe_^jtslk&d9J
zgQs>u|76OD@Tll;>LyxRzo$0Ef`Uv+FGSFSpK4KI=ZB|KJZHW^*&e<q_3h*(l@QHh
zDs179Qm;E?ye(}>^6?}l>_@x$lT(lfxX#HLi=0D6-=Cx*D0c0v^oAgh8X0s=R9-o}
z!>Q6u`qpfKgtC)vCiZP=`lHH4P^6CvTBd|n@4ry0mj^MWMP<^61vhljJ}UGNG-rL9
z2x_>IK#JCkziGYplF{{_oP1B@_)^%YnNBJAhCm%tm<bct<d7Zz45lJh<oXD8r=Yt(
zYp76*{+SDBnWOv%E8{9w{*h|L<(X?QXI}TS?*rAtA&&woi)eN=BX!qwnbH>oh8b*|
zl*1RMw%5@;rhKP|V=SQtv)|`gkr>x~H5FvTtmq~(;zLHe0pTKhZf4gEtPr#76iL23
zAK~k2D}{xuBL+Tf=N6RHG41q@9Ux}sMluOl{fKcoqnsLE3F*mVif980;e~Za&b`*C
zC)WjvVktG7d`7Ad+>GZAztg*HBTe>8?K8e*fBryB0R9#!my5y=td4pO<k---YD&}n
zavB)S_%vcN#rLwRjf4FEV-f<?JSXwFUxLz3h!FrH9^=%UCpLXT>KRessBzT(l;8sp
zM`4T(!7A$aY#~UxFZ0U~cpz|h=r9ULaj<(4_;dzk-&c)6)@dOyiY;o4xSP<1crjr^
z3zO*};E~A$3@Q(kwmXHD^dCt9Pqiq7vyfmC%$SSS^_Wz1@(J9Yn)VsR=F+xANr$uU
zGH<h_*hupce5%p2rc2k!T<;~_lPilR_!D{~du+*88s@h>l>!rP0TErRU90aLH!NLZ
zCiT>7$*Fmac%iMmLJ>0d%O6w%v=>B+AU?Pw0A9k@v1WQ~5sCfHzecfvRqn;lgi5)0
z0!aW4VHGV!+MGsB+5(0|_STpOi~~m2Ar16*(*rEIRHJwkw-lddGi9Hg;*m!ul54_3
zR-4l~p;Zf*m#28pF?Wh(`Bq3}tp=48nVwSieeCgnQ)HAz<Qu3h^I#WW_m1Y%GsL2&
z0>_<~qGK+|90n9tsYP4d<o_tx4vTBpRks+CmrT{O8jG-;yLFjM0Kx4lFXrUmX(lvT
zrru)}HP@*Q(*7myV<(NQOYX(SqK2Cfp&0m+oxd^tX7Xn?QL;!K>7-5&_J%L0lr={}
z5a-<Els(FB=YNCoIu$wkKS_TS{rNPNF6;dhGjG1a@%00a++5Q@TJ)EaBOTduaD#@S
z-*N){V)WvGKtwi<G`0a9KOIYQU3#s%Oz1Bs3kLyRy218AVpzO~J$mnZQT{X3ahj8M
zqF_Dg5r2mNw_}(n;H>zn#CHxqw9->fW1BXKCjJWjjxr@3!Fx_Y^wXhG=T}ZD3kpZn
zK|6?Muj><oJIJf>l=wU-9d!NMgO1EjgPIZ%%ZT817bK3bI~Db|>X3u4@-~IF%k`M4
z`iCK^X@At?ZfVbS+zh5u1#DFDb*w@X>*YRc{^~lDm+`T}&^-1Y-E#<1GJ3islH0s)
z<jA<DSNRxxDbUC+*(bOklj)Et-64}NdQcU46cPXVqLpWGvs~l9A-Fwk3OZj56TTzj
z9dNbwi8TlLB@kRBj<z%h<4xGQ@5dClp&aJ8=ILk?tC@CARy4Rk>j#a{hJ|ANGzL*4
z`j|FGLzPyh;p878-<hCh2u2!xTR|H5PK@AP-PQXofJw5S#!^j*J$i_jzJRe<3>cia
zC<+Bk;>%0VEaSJ$jf)*_Ql@lwMNC$6bqdU^B3@XvW<O0unDK9P4$BBo#DA5iNaB9*
ztr0c|7WF7wP|5*&5eTPXwq^5~;^B1wk3UK>^rQ6|Pz4yttDVCU=OFkQ$Sr*t6}}&B
zT!n%21t2d4Ro$rOB|7tHbiVc@dG5!Aw8tU%;)jOPA6pt=u0l>uVnKGLf>;4F{H^r^
zM{PR7AbKz*(aGUaOkQOtL1CE$=`-;-Az4Kj+T&8@Cc3tAuxVRRaMo7VA|~OYE9Dki
zG+V-Bagh}ENuy)igX!EaM^UY_wWdi+nxjORr}OpA+A2C2R4wqU*k{E7)qSKH@3ath
z6{)(U<#`pUQgz6vH$tThq>@L6S#h?!t&fSO=?@2Bi|UaElY(_HEK0GD=zbv!@mx<!
z03$oh&>9^yI6}B1NpHHQmhG3;2pQee_<_y#omd0kef-~;qU<T*z0Tp4c32Ku>YUKJ
z{G_z4pe->F%E7vYmN`iWBRSp{(k`FtTI^?PYxk^k#0Tn=>6~=oRZtnCoP8aEqR@_S
zI1$xpt1q4wo6&>Xym;taSD2AwTMW$13+t1%2GN5{OIPM6MJBGn;GqVv!Tf(~aXy4T
zM+=+sI0H|>rXet&%}%E=XE0$x<B@ZZ?8@ubb&-eRb*;f|e!2DEuxlQR1GG-rEiChV
zqgzag4#jKGs3*O^Fg<#Bx_C+qyu~U*eczKCsG2Vz1mIYRtWz?(F>rozTpyIf-Z^w|
zGN&>4OF{kEZYB=Ef7x`9PREg{>A|HR`6cFv654AE{_RDZo4d%}ff2`#|A!sM_qPuR
zNb#Z(&E%EhL@q%hcx$u_V9*~ZWJCX;Bgnn0Dv=_)GmwVNhoaF6Hu9m-_}FTLbdOmI
z06VhT+bc3{e5y!zmazsUb}V}782Fu_&$$qzWShVMdHK|ol?}Q@_KUY%bys7qivlwQ
zYsH($hAzm0w<Cjnh0~}eKojggP)NB3bQFWfIl7KTb*3SuS1!<|`mnsfU0Kl^C5&-I
zRDc=PN^&c+Ew<uY{L25YTSOCVVIFJl)C8_^5N?RcEn1Jy^D^Y{5z~tC=N2zE&htTM
z9IGB>s0?*wosve{20o<4>c8lFO(mv(^lfn+tHf4LUG_$r=XM}kwCkOihkQ<0dd&1P
zU|H4)?My}ben*h;RnUanWuY42zSfyc{~WEsox`EhfW;_K<9T<3a@_5dJ}*gRX)JUH
z!n@rbo#u$A{sL?vsGvWz5iyho{ey?l;2337e(>Cd*Mg(sN;$q2Cy{v{3?w*;gC!&M
zYWtfXAd~BkGn)8F!1b``vvc_IE87cMIG9DLAV*pYKNoVmIr~|nK}3u4P)EQKz+yTz
zRsD@IA?_v2J=O0&pO+`=7>`kWxNMsJt0$(ZkRh<1B>@C9HJF-R!xVo+vWs%tk+W@t
z*I8&NomSJJWIIve=*(b3RBNnZs}Ez}ex~^jy;=Pmp%U=%Y|(zB1zi*;lCgN3*@BCk
z@N(+BY#9_BQ#2=^V~B3<U#c!vfFJouEC<+D!PMD^!HEO8BPPN0;f%ia*g@vewRBb7
z=m?1>_0<p=CXSV1A2++sdeU{_qHj=-3RB)`Q@2{NX>*rUOEc!hmj8-xi+M%N0CHnG
z`E$U-F7YAgs%~2r?Q4D~Ks$ut>WQ?8hb>kFGYrvd59aW5%siOKdU_-oVXsaLgHd$x
ze88oX>E@WL;nZypR^P0TL@T6k5BAzR2G!(jPmOJ1UP>o((7Bd>06&`?m0aKV?+){;
zfy^4OHTz^%6XH{+9MN@Dw*M4{Z*8-)T+5VJ|5hFXOS#@pl%37}On5NGmUzt=-8L`&
z%xZCvS;^@3&HPaQt>{&eE`xFRx4s-A4ZZA}MZA7l301RBJg?n*2rWY)=(En5)GEGN
ziQlK<tF<mWnK@4QUHnVTVNXB`<c6EZs1`ZJKPtZ+ktAvG#Q?mV!4SF^8WIoi|9}y>
zWl{KUEzc@IRixyGBZTLdB=8li_ioFQUC(%O(%ejSIFTfK>!o(}Qf{HC>)w=Gxz?Sh
zHM&9GmX-cuGHzg(f;C`8yYVi@O&)Mf_8>mW{r9P;Soq@&-V9Y@N|We3MyVugH>=!I
zxraX;wMRck^E{1oT#R<ojfhNjXP%6yr(bfFTU%!vGMYrG`H5Qs{?~%??d&OI&zsk`
zd*P)t=BP^Gls@#BmvMLP2d+`~2uzJJM_0A-?pqtU!k%7kLvCVvJJ`&qTNR27)yLRP
zl^wRJo0{2F-`kDl--mC>inAca)M5twNhQK#G>37M+PhYC+=%PCrl6?x%b^ncvZdeT
z3AxNu`IQb3aHh|AHwzBH%48~f0Zvkta>IX2F_}t7Mkjy`(LRY$<w~`RZ%_{m(c@4U
zybg?gc2GqnVT(vT(EMR1iAsBc39ARrhm{!<PK#jn(|b>X{QsRoDh3CN@NVr%DBe+x
z1=2jagJFE`g9xxZhBWhtK9S?*;UE^^?dkZ>W5O?rI2k5a7_hsz*`tHPw-9hLJJp}L
zh@B5?@eJwJEjfQ|!AoC_qiSE2TclpmH340yB{qpEaodW3?y@5bORXahQA1c$F;q0e
z&b$l_o3tLZ0iAJ*z}O081ji^ge-8cX6@P0o|31hd8dZ2Q%4CaK-55i&w3<7e*^pNu
zwU|&B+G)jQMS6HRbNv%MtIiu9Y3Wl4VGV5agDfQ68(i7lUkoLb_{~cpfCa9DI}MHz
zb+5&L4A?Df@d~Idq2o1-4f3hP?};1;cV~@0+J=lqOT!AZ28DmSRk5}hnO=fKt#*~B
zN<X>{VpwCCR(cmK`YkC`6@yAvWZ<OK!Iu3RWST{3+#y~$=2<RO`Bo(@uK(4er@(YL
zWBk*$zZzy8GN83MWH1t~0;n813-!x>W2f8Rg=;2%+Zf^SterEPVq|?o>G53-uXkFn
zTXFgt7Y%J1|DAxIWwN@4_StY`w#o=>x;J~fPU6otYPqjM9&&6IksQT{+QyEAOSwd~
z`Q_ng1{;ll3$<k{Drp>~iI)L8RF-X;!p)1>38enw{*4vA0opJ|qdH-3vpY1YX-y*&
zNhNoITVRuD(`^@1fMpd8zJNyKC?|gtiz=6-aC|V1Sc1Y}7~Zi7ApKxanhfMRlNMuo
zFN0`2cS&UOoDSnj>@--$Ar#<)1OoC91n~RD8vPLXzYj*@-9btRG4hCb1~L6bs!;r{
zUqWJo$q@{`<?aFI5*2(b1856~<>q>UAeOr27kF88T~vv06Mu|<(7z)%K!79n5j7@T
zrTho(djpXw42|<zwZ?VS4u?FM3qwOuXG`wO%^ma81jY0$U1_M(>MA;$eHhKPmx00B
zE>WWHhjW45)2aoZZ9B>=5tZv{;aTs4LN)WIJmmps0@W*vXNF^Y^OKf^gr*d6EheXR
zVEXs!xZwsjF|NWx5P`F2BW>(Bl|Cq>r2FfM1&?L*zb&=j*gW5Bj0uYgo-zc3k@9pA
z%T&cY2H_g@SFBDoj!$iNNS3@v8Kq-5|JQ?eQ<5Ld*s8|V=|QbFbHAuY7@|RXb*ZfC
zt^%7Du}07xR6g6RjEqT^<%zT?m!Ur~g^!K-As)WR=~;v<Lb+1Su!SKub9BGTk&MaZ
zYVX@&jw10G0jdw}ztOEv_s2m&bn`dO9bolM&n#qOB}N)ePd(ll^IG_PH@Y%fBlG{2
z6R+}yCrlc}I9YC;C}+BPMMz}0?FXQs`rOmk4l@)b;WuPS5jc*d?lH)-L^5anqbcJj
zPHRsR17O5q5RDA8gOzboZ+BuFz2^~iqPxB`fC%xl0R<qN=hT_#$L^@AuV`(t9^*m3
z=i{w(%c8o91tMKYi?MUuYv#FOy+;jk6QOEYfbaZ*W5Y_K%=qpd*g2}x92<QX`bMXk
zG1cGA#!6eqPb?i*TLG>in;Wl3atJlZ?wwtxF*&ru)LoDc^=%V^x_qfo<RiKne;}f=
zvO^=LlY`23YWvJ_;jOM=x|+K>)c}<>e*b9_pj~5U5ba-4JpONDj1JsGb;u+_E!v(b
z{E9#8v@OmoYs{DrMBB6%kvSYxQui?_+sa8{k?RygaFe?E+HfUd1z%$;N!BR36(GH;
z&51@w9KFT6R*Ad=LJ-l~t`(A<1n%QMD~i9_VHz|zbuao>_q?{aav*It_34)84y2TX
zk*#mM9dS#NTu1T__Yca}G_B&q19l~2T&5|qa@MDO2Rb~6@zIo@+h@frQ_o%6PpSX1
zCx*e+-L(@Z*m2p38CPG&I%S?-^4XGF91}+PJ!wK0M7r7soQLO;PE{p%W2hyR`*bC?
zZiHnnRaTFV1Gee8hi8{j+@OqFwG!j0QZEMT9iwz!I@*6VDE%;(1}qRPu7gN%6TFw9
zLg(5VkNk>b0HVdg{7-0%2y>g%^DxFoi#>qjL3Wb6BPJ3Q<^Wa@?12o9s0i3Al@1br
z=PU@?54Hz0-bwz741@QL9@-O70>P!*M}MV`o6Pr?np(l_=9ike<OCTNrb;*M7arl8
zHUxtSg25%Q*fIDsJNS~&P;?QIhJa{_*y`pXuh=nZkUxZJ9R$%8L^)NR^K~R9g8Ih+
zs_OG9)vTY0YBkTNqSbmM5(owBrBUtE(1cy%@hTl=ds-Va2xi$NTE{xC`&}OBHj{kw
zH%$LKXd`FQFs$fE@1sZ{laW|n&@Fu%<L}a+@yD0Ka+|4&Waq<8=qiH@x^O+4Fb2&u
za{r@)hx<F|u}GkG8A55Yq6a@C-XLSbf7Qi%m}wLPhtK0W^);HXg<O7Y^}n7{PdE~z
zL}tC<=d$OV5XVtNy4hX|EygEvsnV1L48B@7Er|PtqCcC|F)`Fnq172d>;6ryp1Am1
z2U!d=XGO3h9@zMUhX$vcz-#5`A#PY5yA98$0&XqxS_7UDH(%+e$rM_p1S&KLM+@7K
zzHnyz8WX1~ZfdqDZU%%o{frE$7YE$?z3+Y*ouExrmni^#LoC<v8LC~d{C!}EwmWyH
zIsc0Zc<Oc{g9XSr3*Dgh9*A=7?LY!P2KQov7Zq;_`R5+${iJEtD6zKCj0r)k^M3rQ
zu`wwPcs!`~x56MgNGP4@dNr9(ttRM?ko%AA{)GQGf53oLOz&`1pSF9+!}wa%ci$>r
zegiUSNzv<IcY!ecJbOU`j_K@p$0!9S5uX(Wn;54Cd!;Ise8&h5WlQzvNBK{`PK+`E
zlgYhNQ}eAPealFQ8eOQnHm5Fz`;od5rQ?NkYtX7G3Rg1kG++w32AEO?5KRw-GIvV&
zk40hg(EnU-%oNBov~`8^eh~Q~du;Kpjmees7WVA!R4v2O!e^;v3})MS6Q)eszstFA
zq)a5aqo}G8S7(7dho{LoN(jrM`-EuPqOMdHyl~a9JFGFk*7*N?tOsK(zLV~rpW)Ve
zZZC-Uu&`+7(k)=%+hu7rO|DT;m#Pgz#X1`rDVkmhGKStIw7Um`kLuIGrecPbT@#;n
z%S=9-0uP;d%c=@%3W6C0xt@G5oZ_L4Wl`eJD2keq7uan!IQg)HnxNK97}V`qw26Vj
z#LCTDm98262H>NlIqoHtG%1>iU{7+l8~fBjf{{YL046(GEr<5T48gGOc7OLnD7ofE
z_YGqSH$=ve<HTRajC7``PPa&b&e2VU<Rj|IFyfpbwZTD9?ni_?BZM*#V0xl@z(I&G
zDM^YuH%}>>?R5Hd8AcPq!wC7-c&a3h=6YDo6+`4<)Kh%&rm{Sm_;zd{u~B`1#Fhqj
zNoKGf4yJX#j;&s?i%u$~Vr#hQGxwijx^iMy$hsB;yay&o;>e4*F7{k78wWOx@F2Or
ztSY7B_k|`oVSK^$HYS?gVnw%&FUDKJdae0<EbR0(%Ndq%(IQ|w?3iYwKOjG-1U{5j
zyx*vUN<}kcAJeMXRkisULa1WvdhX#vksc{)29eU^TvM21xvq=lB^y$PdpF;lZ`RJ2
zJklq!hX`<%HW#S5W~KC*>ba=s60vTkDWU_`KY@qsss9MttO+eWby)N}#Xg9wQFMYU
zlE@^$8k)>g&5?GBu&r#4S^I1|HH5ykMMdMDJ^t4ew|r?*VyV#A@m(tDWn=h(>4d<N
z5x=NrBa)Z1Y#nOVYWu_bJ`<@YM{o%&x98It$kAw*-wp;P^^CHR`^QsioqndKoYk#%
zv(xLf`|iv6$CM^IA_J^$g4%<N#0CU1ag4{Gma!}O7h~{jfjU0ozmH?h8?X=Uq9y!l
zTCamz3~Ev+O{Gzwo|WK4$!E)m2156H;W|nfbql?*;h^^wF^g=K6`QRp6PNc`JjNjU
zRq$8^_v1x*ZCww<$5c88Dg8FI_oMWfBKwX4Ao+FAqSzfeK-a*&n^6!0Sd5}AjLBqv
z1j(rf1E$8K^r9Ir0)=?BOETEisDLUU3#dA`x72m6FhYIlaV%%kv@vX!q&jE%Xvcm#
zU<US0Ysk~>>n;VFYPRp+eFUyG>J5wAPvS!(j!Unv@}?ihKM^3EY7P3`#IW|ox3t;W
zP_XIcc{!1HDXj~oGYWF(V(UK8W8e={n)Uu+<BZmA`I6QG{$q^yd{=t38re2oAkZ49
zH11v#oPub?#EtR$4VEp+f?gGFs4*^%gWA`VFqQsNL|Y+@{qeM5tm>nOh{1_~#&pQS
zbW5=M{4eKW9*CjH7u@|&#J|>3WJEKIze-Z2R`(Q^V~aVvBaG!`W(pVK(vw4kq?#TQ
z{#b+)W;1P61lJYfF@)-7(9$WemC!O*IM5ZG6&*Iky+?<_5g6zx$bCY&psz<31|cT(
zBu1&JQ+#0ZHN4)rNjF%rkKt_}fs(I#V4P2ifI+}}7nF4%fS|p<KlUlv4a-zWztcW%
z4$4#tqQG>Cj1n?1f*`J+KIrex7@PrYx8QsgAJeBUs{M}4xC_VUn56bS5K3oxNs42z
zI11o(_>HADL}E$cC9)`Lhu{A(59*bZRF(ycechj@X%^(u^&oKQU6%3aXtH!I1`qfL
z<wo$kZ!0y#!b|W<4hCxSFF8|``Ig7;8|mE7yUjVOu6O6CCy6ru(6a`&0$g>RbfYz8
zZ3-x_y9xc%ByQ1Cq@WvAw%)`sjN2)-;gGI8N^Z}Lld>Nx37t=`3KdQ(*c3`&7YOg?
zQ6WO?4CA&@uj7|Kim47jH;zSy9s%U-u?%~mKMt_6649b{3SIYJ<)zx(qP7Sl$?AT<
z%@&$j#uM+^00GyMnerMr8VBD6-O5#UKE8Ec^@}ks#+?m(7?arxBX%da!$tq|-ttez
z<~WCx-jl5|$YnD0{hrDO)yzFt{h;CUe5GC8BfaD#=Y!3F6YT57$yh6Lfd(n8X!1io
zeq855V~f#rM(;<<9l;FvCD-WTW-J{Ee%eFpN-G;}tsc+SF^=dM0Ol{QlR@5tv37RW
zp3y}$5iWkRv&Poc-{(Jkk|CDW$vd~5clf^6>6TIroHBT+NlqgBGC^Ns^-o}zo7Nn@
z8l8uPWp^J;=nfWgy?Gb+doM(-kV?)=mB_<C5;$1l(N{eS3q;sj#j(r=lJMWlfYRav
z7`TIg&=`l|q@CFB_Cemoj${lz{{Os2?1Zb*lNf$sXa*Ij5mMOj`b7yTfH(#n9mIeN
zH(lD@S*(!5IDsdsFcW2+NXNdq0i}dTxZ3abTakr!U&Me8R_S!eZl&hf5J_V*iaH{2
z__UiQqwM+v>1Ymf=MFe%OuDKcXG39~hfxhytLwI<RAdpW=<XbQa+GD&2vvb&Ad;3>
zsIex`hmz9_u?^{QT+9Ev#{6XEhbp$1{kgGPjh+X&o?u0-pqKp?=>aS9z-}B}*B4=E
zHzo~8@ya4z>2e&E$6}rOKLtpdA8-u5)eSZsPOY{^WA;PY%sYb(t%rj@xp`s?)>l<p
z0bx)@!9HX4*UqtrhCB<Gs#?AeDj`<BS4=r<7cNOw38fQH;nYGfkRaF<S9w?PWYIE7
z93b8xUZjA{KQx~6;tu0bc--xg&dCUB?BOpkYPI$QLFjZql0FZdQ8k41IHm{zDsYaG
z`r8rk-^Zk~=SM=neu{OYHZs8^)w<syjzS=)5pdgg1Via~a)Nl5lzH$pd}7Ih+1876
zm2Sw&>5mX@y1udmTwfhwfYs+dWH`*Zfi-n4B8F6Tw=bCgMNNVXeI|};iw{|nmhTbz
zrx4tsn*M@43%%xsR&vLTaLtN*;Ws<WpWT3fwWs=vJ0rUV0ii!>;s@k67pF@4PPWPW
zr(tvwWO{J>gdu=_WXYzfsOnfHzx1!m{|d6U*!tcIYpa*u?l-&8NqZc;5rXWpL1lmX
zNVHhBks)<@9s>MNycm^N>qd3)(+>Bv(a+hOi#J})m9I&8i>-vX;{svs<9|ZvK0%*e
zW#<IgIidMII{r3_KHu0CX4K&L%H!M{pu2lPLQYu|s;%5yk^rj=;&8YMRvDugfkWL2
z-kc;_40+Ba{_Uio^E+zUE-hcWio7f%zS3AoN|5gnT}lx%LUEbSw;Yx77tidk)ka)8
z;#rE0RXk6oQJF2W)bk3LzaU&YWY{5xXFaS|)`xK|RWCK@T>tDhXEA17yK7s&tDavE
z{mn)VD!|FVuAKBnpCLLV&^@X5ERf)i(#&#*3842F3mHOAe#6@XfSSK8-4Y{jt&qz#
zQgDF`tl~xl@M#>t;i)*#be8=|c<5a7^ft;IchJ{z@R0-rd0p)V#or$OEOjr3k*UNM
z?6pvh_=wAsBGM2dn0Mv!mV|>z{_RXBf^z7@z)i9mXMm!veLjo~-2vL@NH}b~sBTGu
z96#PQx2pDaYB4Bk&E$nFQx&q%D1|gR3Ku#T`&=&U+d&UZz(M{tgp0031MEkNu`X=o
z__76f8CaXuB;<QL3tgY~GE@*-3c@4n6H>>*wQggp@z)i}=^;PB$n`j_!7L@?vq$Bg
ze@J;B;g2-EbmMou`ARIye&v7P9wK&rT$5KNK84|H&xYJ6M2r%R3t9+L+y$#9Joyo7
z$?O|QkxzsnO%&b<scBq{k&c;SN!gJj!1BcUX?|f;%lM?`x1UgmS5Q^x|M@7R1;9ph
zT~T`!5>6RLY{jflO)y1IR=ckyK~;-LdVOV26h0^WY<3LFPO-U|EJh|%dTk>vM^xd9
zq8eCJBCgp$nZrkkN!+!}sQy#+b_K5RbDG!{x_p<b9Rs2`?an;iSLbu_c`p9&4%1Dt
zXDhSd(wzul9$N6Rw(Fp<>iZ4XMtmehN>Rr}_J4|F6TFi{5C4lu@CRD(-citG4ub{*
z4ioV`59IKUS?j<IUZU{4kID1S0@jo(NYDjfQROhX>4F0=eUXUZK@bp)f>Q~YW&^1`
z_aY(Ne?lRqp~v4c01GsR#98%MO!PXVp%TS}>U&<yb0S^NxX-1c2W*X-b<1+N6caF*
zn7gzN8lba>hHDh@US_Pp0(YBxxz^G(^i4-~p8*1a$qS%z@_&LXXJ=`j;yPamN^DJ?
z9s4IR&d&OQ&3e&*B_$2q^(7Czwm4NDFba?yv^vnnwQ^c)dHmHxhJ)}PyqCTDXCZuE
z!&=g&qPdA$0gCrppJ;RLcB)^ke=RR>zbEz5l)5g_wSpg4^>)cArIk4aG_DPL9#>(s
ztUFYo*pg8wvDZ2;YjNN`M)v89!lZq~#zX=ZMwR}sOd?J#W$lk<StEagi_BueVskzN
zQFqdF>(77o@wl$i!;T|Jk?2R*wEc)fpnNB|NnKCivR_}GJo|$NgYfU_b2YG-ntvw2
ze%7yz>Y@9_bYhC+JfONs5T50_&b)*0c>|VQK|j97?s!-4<BQvx-}g1%@fk=`o;KPx
zJ+ta>nx5_QI0_mnxgy&3LvcdIxZfD}_tJ2&*|uq(2qmdU9(kPryG59&3pPc17eZd4
zb#G_K@WO2ftJm@*Llo|4uS<fEHl#8hcOjvx0@J^&&B!lFw4CNP$k1xiPB=IRM_aM9
z_-Zs=nsmMxzbv(e)OW}VMJTIa-rdcRhZ*C(kKp_rxM&7lifLO764`#;vy(1E-~SYb
zYV9!pv{s>lQN<34FQ2VP2@<=4GG?3Q%hy#8RKAKx>Wxks1yy9^A0ku6Q~$z1Oa;c%
z<<`v(FV9Z$ZjYPyw=9pFnXEPDZ5y$s8XMK=KZ(l9s9;n?h5iJX@<<6UAAVJ{n`U`F
za-FBSPW1aU9Bwx{UMrQADk@c#sx_Kir6!a5Ss2UoJco5?1E>4VHDuvn41w?`u;)KN
z$SvZ@)-)gLhD+EwGCKv;`lk@{9xy~~u=$^U1YRX{#MRJ;0$?5F!p-Jbupr%`IN<m9
zikU^ZX+nPy(-K@CjouHfEP;o4-TixTzj<BwW^wh({$wp#>sB4`+Xm_j>Y}q#%)F$O
z!(#kXNw6hCbM%i$5j=phc)>RJrW3aOLUB0~Yu_k2wyJjx4h!fI?rG&)Sw*FwP7D-z
zXVQRfYZgb1XHVvjIJ3m9Ln8c%i@I#>YJUP%Wx~7X&#|N|tq9F%q8=mO3(qo<738pr
zpSgz3Q9tMV9>(*uNe(<l=&K@h{V06UwW5{D{veR~ICEtwG439pXt!MC`zri)%ie8F
z8Y4#L()6a`=wrPIx%o_;Cje#0+qqSbu$PZId;(n8(M^NnX1VZ(xqfuNs9l{lGt9y|
zocIvpcpvl|)>Oi-oA2oiZs&^z`@Xj7B8LlhOW*$~Duvp$FN`Lxu|ZHFm(dCo+I(qX
zHk0aZIV_bBuqCoi&Mh{>b9sl;V%mLd!8MX;(mv?;1%Z2P_xeatjqubciWv45g5keW
zIW((Rj{P=~xlH@FK{H{xfHRf0ctT8vePZn$hU<{MG+%hT&WBq5PUZ{?^?9uJW$N7~
z17?Fcoy)UjJkWL1{hdL-cx|}tvbJ)v^tvzC_hpm*0T^RlA~968ZHZDRbClEgS5x-c
zLNriemQCrw&CdOFE0lWu0nb5E-KM*1zg6Q0qv!LgViai@XnOpwhz8U;o}Wx*LZon6
zs8lsWTZCm!is`f*)997oKaN**{9IvL`CrhrcXhL~hdk_9T$cgkUl}@V`R-A>IrR`%
zZBXWzQ0^r1Ch--nQEt86&7NEgqw{Q6;su8enG)j~j^`^&db|ubg>vZucNMW)%{zpg
zcc-o-{oWbRO-|QrGm?Ltn=;-Z<o$)Y_*bG|;v-568xw4E-S?yMHUzRz*#1ib0ejD~
z7~1_fXlio1LlR*OV~@@qKjt6E1To#`0ZeDDErOWBap|(lGP#65W65FRA@(GH1m6=Q
z4FbiyZ$SnbG9bqQ&Q^OFPMqM#Cm|2^wdX$qPUnu|IQD3wf>QpeV&$)cSlbeWcbDl?
zi3f)ZzL=@~dUOXe!As^+<GWW)XfUN?U0WJft8?5Ay06bd;EGul_Tis8`n>Y<0<ML1
zE0RXqBj=5YEI=hwiCD-UnM?{|JO(BCe3SjPS$N4Mwpelryh(hG(c%{W@^+R{|29-y
z{WDED)OJ!u2DRA_T1|t1&%^@UZ~NK^RnG}~dq|QCPLSg>LD5VOB+v1#q<QWNQJCY^
zNt4zA==H6t)xVkwgQu~LkBRnA(Z|5pb@LWTF0M@UP5HefF-S^YUz}5UOf(D1N8qTO
z4F*f{#<br*t!_|7Y=>f?rT`!)XG`(3e0Xc78w=o!r3&y|rX5b$UkcuDsQCkWXrd2$
z&Hgo~j2@tej2LCFP#Zx1qz^+7!}aQ>{lxG5+Bs%$d!^CwdrUFd48vFdPK&jyvX5j7
zxBb|XG1!E{Z}z$XoR{T=etpz^)zLin&XBKzx^WR4LLvO}18&=K60{r>M|^Hs<K!-h
z?w93xH+mbJn~aN?MpIBxF>_2QHPH4|05@(&v5UY6rm9F(v<_dkFfU#k(by46fg%uz
zKSUY|&wQd&Jk!2IS2UXA?FRBOQx(<8aW9)PvL%Z{wb&lgXtj(T*=ikh7^@%85^D__
zMg`oo(skohl9HX49Hszc4wHI0g?a-|@0JxXyG8OwDTP>^qT&GJo8x=64=t8I*(_`^
z@J<9L*tpA3m2)O#2BnXAwHPI(+F#;uop>qszIz?EOL@3+4(*=YWhMElZ*uni5MlVv
zIiaUBE~VX2-#^<c$bcLLoPujhT!IQalhlHQ02p$46y{LX)S#0PGaN)a9_zk6XL(pO
z$hGwUYXRhc%h)_l&$3a@AZDdz+4f(6Tzfh49NyQn&dL@eCoF<klCBW@a!`<^BF?1B
zsKKF1MM3ZL#xoFJq{Rx*R`d`CN*2=<sQuZ1U<AwjoqDSYiKy7+=Ju>W&7aEQMlDme
z1?a=2uxwCY9wy?`UG>$8io=}chZ>E|Zn*SJvP|(ADYjJfF1?SgGPs^RneRVKP<&{{
z1U5ITeZ~pLNTqu+>nH8^vhV3(QFMJsuj&tD14d5Q^yUx{cHHFB?{<y~x$|k^xSi$K
zedc<GF085vONN$jZ^53!=88!`?7;#;z@ZC$p7<Dm_!`l7-oeQ&-|j|NNZ;G!i)!;9
zY_I8hl%dt{IrzeTQjO_Ytk-JF<kk(_F8e(Ju%UL0Tm+#wUbeqZYq<MC6*uH8u75rF
zIsOGF4PI0|L-T#U(ht6*>9U9zmUNSWJF;WwJ@wqS(=_n{^(#Z-Z}2~_PWRucYGL)p
zBirg?KlAJtCkzf{*kSUjx}SI1iM%;j4-&tO;`j(3k}gBPvmOY)jKpG^fv4kbo$h@=
z=h@%XbE+S$vZ#aq$=3X!Z40AW!E=0HG~ACbMf=xnJCf#Ctz)_SdqVJVR<#>k-RvHU
z?rw|4N4V@may&fUOrOWMPs8jcDVxNwT!5qc4|uLn2pIHWvs~ZBJ2gZBgx_x6S5SPg
z&#~>)zd6rt>(5QI!s2){kwpJGbZH<3$#G$MJ~$ZEw5+l5Zo7=x80@I&X>>s0GID6U
zt>{J5baQ!+Cm5)$bWrhh7jiz2{7s^Yl3SqI?H59rDq+>J*fzD$ah@<S0PE1;IC()a
z@$ha&{pf3@_rw7Z`8{pl^w+EO`R==FEdH@xsp~@(7Yntj0~R&bPir&(_IydG9P2fh
z9cvm=lH(@o?J+t7bKT~-V$n~tf1hFZeDK#wYFX9f;s)v${BTBD`TE{?Y&<k+HYWO+
zfXmE7(-})c>kGuRpRHTh`7c4=nJmDKvpu522C@1<(Oy+@qq&|v!^atbK^U$p{72ii
ztdEnf``!-He$R7vZCVJ=(~i^w0?cJ~lWaQgwb0`T)DXFoDYe+<%TmJ%aVYFBuA4@!
zvjY0IzWb-G)G)i=*U>w37m`odbr<&U^~BdA{Eb<7b+_xLBMlB?i-P_+uAQs<>k}16
z%RH>>rXlTU;35_3ZT>XRuh#8Iz)Yz*-R!CWw?B+{C9G}R7fM6f<yX><Cl~kK{KqPt
zL=+pxL%I=|PcCPcaIT15!5gamlLtod8d<lYjfd4l)vKN#E?%<Z)5r5p({p=QecW~g
zSl7RXu*I`d-<N926<7g3wgNj!1RUFLhxGT2({COYALgd`ZPj(_2Ge}%!R_sJNshO+
zmtBFILz8=bX|j9f+t7NyK|&~%c4$;oc81yQ0DA2Yc-^p?RQGXwR67mg)XDs`>jikK
z>#gp8uhZJ=&i6AlyWPNpsQuT5*CbF39ZwH;U_w~ofhu@;5kBz9Y(LbhmJLhzwSt_j
zpTof6K8D?$Nu=&Jm)jTc`q$sk9lKFx#*TgEH~<O()@Rw)R647a&DSrTSjsS8vFoh1
z)%pC{53^Q9uk6N-KEwWK-bm1H0{kp4-kYo&^Q!e7Z@)hvEO=+U=6MG$iP<sAmGNb~
zz!dF$!z^!e{q8gQxw?DI())}Q>x+2e2teP5D$4gB{fa5_k7z5t428TG39tPWucd=j
z;;y-bIF6I7TIQ1%$iV&3?=#{4P4GAZ5U`xp`z0|h`_{<2ExiNFK$zN55w-@CNQyGD
zVCZ^DtlJktSMlL-xYcd;s9FN(k!fV#zwbJI_NO*&BnHuhVHMZ9^xAI-cW;P~zi3MM
z6h0b}{=9Be@VV}os2y4%>jAm=53e+>9^vCE=N9zTIOValpeILw?juwsb2y3GRopo$
zO200Lh4q}iXGU*Q=(VgcrgW}^swXQzs0A2V(2$9-{r?;jby(~@m_3*9{BZoKySxQa
zK)M>rmyBj*kUTU#+g)O>wk_pRvs*Z_o7r-kNO}<SN$PDS#5qhkP)JqL-Z{BYaHd>U
zc6Ci(VMnfZV0qYZQJ?!kLls0RCyPb%$xgWMe~H(jIN;3YoT_~o%&KdUNo{HYvV-{(
z%v}!C;Wx%e<l*azg<xL2I%6jie;WR|P!Rr2giw1K8iXM4^r67q?m3%iYt~<U#20~Z
zagbje@dOcnkmi2xg8+a#D2G@fwEXE~VZ3wmdpz!c*H}M1T~Uv1I-tHJ%Y=o6?x0oP
z&*gqIAd14OH<m2?fZw<2HIcwQxrFkSiI39b3dmHvju&qb^Tep4m3Wy2u^98-QvvIT
zgn}Ec)K}uv$5NwOD;dOzuPG$aklyo~B$pORz{WHmi(dJZ$kS8gt1NPT2!uT0kl}0{
z?_QVdv)Wl33}{*VX9RQGw&TsL?e?g$AB3=jK%VCtO35C%AVk;|m29TY^Z6RN8=Aq)
z3%&cXgD{9~Rc&!b5%K)jE3ZB_wqwWRat7V?!C~mfs*W7@lX&|_YM(_zpDsV+UO&lO
zpcGxpSf3?f6a*1;=?4P$_+Y2oje%q~7y_sIWC7Grbq2nNa+j=+UnHeo-?HIrtd=c2
ziX-%?qz5fQVVKL?!>{d5W;+M-|FWHOC+G!3^Bg;q^YMdszfRWnXV`atmPt^Ge>DL0
zfI3Nk{CfUf+}0oa$x$N1I}4iB@f?eSgd9c3m2Rmw$G$i%xY4tV%<6sGi@5K1H0&QO
z&BA6`cUCMI5c)khj7c#*RZ^OqNNzX<CsSDP8%!lwfRJun+>ry#I(~V`OI{g;<>*h=
zvhY4zmn-ZH!Q)#;24&f{&&s02qx(1hYi6En@B|Lsd`_V@i%D6))pJ}HvEa%#KHT)x
zXpruda^6sf41+@9(LlIblgEnf<faP#E5)g0jLIvD;~LN{ILhLBj=KH3u3*W`em)GP
z)VO&2v}Gq*&}F4A_UgtT@LI6R48yRwD^ZqB81kO9@7DLpr#Kh`U6$jLOQ|^!re-De
zniZ<sql!>vb~p8|!E6Spoon4-!Y3q#B%X6szvNHy2G8}+I8x)s-Ul`oC*4HiPZ8T{
zJIMt$hl9)g&8n~8>)->6C@_@zYunGur2`C<Tw<Gmk2urmpQpO+2`vVb-dBJj>!i~F
zubW?fT>#HxgGc+pTcyNgdFezsHXK_uy%yhyAALW&Uj|`H#XarrjFtFjrXL50k9VCh
zD6=<;U#D*Beje=)-sqC4f%F`_6e@%?<o&__ILd~hgMP^x4SYQ5+d*8t?$X6{U7ScI
z@;UE@p>J(<?lE47S<@lreTFy7^AkuUPWH5>>tS^$q?F)`|Ka#j;o%Vi+;Hmyo2I%f
zy{t=FytR1M=NV;FC1{NOi>v*RBPEmJbBzCms2eYpl7zPVjt)JsUzUSDDjoqG+x=8?
zKOeyutT4;90q8A<qC!tUll9?v+$t3OE{rME-uBx4NCZBeH^sIv9?YB4^-6ze-d)J`
zz1N^l5(jtHp}GqxzW6*mdg?_YR`XJN^#6v=2fifdFuxz(9v#MMsF(2JSS^_(&9K2S
zm&!3Kvz>%Sl8>iU4TD`I&Ooun`bS<1J{mhJJVr=!JU%ofr-=>a9Sa&JupNfs`9v>F
zd~Rsq(9QemOad-zJD8?dN<p(k;jNzj;mTsvZOjYx<`?rFKQPy9ORH@8**;Ko$h<7N
ze`T^U1`JrjSpOz;Q;2=us?=LI>*N0Nde)_e<u;aYKb_?o%&UFLp<JO)t`^l*iHyrT
z>UrMg1Ijqwejia1caLn2Z7uAg#xT_*!)*2=kf;Htgp}uf@vz>X9gM0c9``3``n~s0
zS_a>tYprb8^sY(L`q75AVTr)t{j$sh;B()rT$P=+;=`^fj*!?%O$l2DB%6xbT+H$L
zE!uVOGIt)@Pe-yZtp!O{nm($ON#$GWP*tUL2b$4l7UwMJMhtG4!W2{O-Fm_y%`k`Y
zg(w}P>6f<k_uuE>F=nd_?O?`EUi*TwfrS?eF=h!#>bOoqc|vXd9EjTz!Vrv&rDZ^9
z=DEY(1grg6%8D|g(4l)rZ?%@?CC>GCR;OQY4Emw6ilhHq>*;@qU-B6!GJcTbj+5gu
ztQ-c-IcYuSxvQC1eX`2h8+x8;IOTM@zz{QA+-8y|vWpM}K`HoJkew~`pK~bvUfUf4
z2hpsC#?5mEIY2srfY@Df6KPngPUd~URcot4pHIlx%RDY`7}!|%<>ima!;LzX4Gg3Y
zqSJhlQSTNPlf^8S4?eyHYFbUE#!fZ?sh2D%3SNxy#g|&p{pVV>GPS0|0WI;AIAN{E
zwwS>ogMJOJhG`RTUD}#QgT9egpPJ4s6UrOO7w?V{cN1c$<4$4$a)A;ERz1b^=Jp~L
zNEkWZl)1VM-9LaA9J#c0+T~`wx>$U=V|RKm_;Z<*m(5`^9Z|c3H2Kq8H~rsF|C0{J
z-gCT<!$yjM((F={V_&A9-c1j~lj$53JRF8IM82aB=aGI@2eU5DP1D8(o^v{FQ$&x%
zlt0KaOOAd2gfN6lm)do`l2HckSi2}^Jk*mN5+~x%q|@bf>#29H9I;Laqp`QUx+~ct
z$s0#|zfIWpRkNNmtEU#WV>_JMNb0?=3Hn@}EgYyQn`02i9ABNA<>Abxp{>(@ZTYcN
z?==vMZML(@r&j#F4sFZxW+MMSk#Q_!o2OdNV>`bf?UPcT*_Zhn{uFu7s_awrcUkXh
zgg#tnR2@~vp?iDM!U2mK@py|ElX(sQ;aHu_ppO2-O3EO%gp8&BXP;c^Fntfp>`uv-
ze45vFlU%!yr0B)aC3no>vm75Fc=4@&5r@muI1$~(p#j||uS&OIKwS~O{N9bc2lr{y
zOHW8B_nKr1@O}28SlAKC!V?Q4$BXlRyPKk)zH?n>mXqvoSN_u|vfHpOGO(rxO$0*S
zGsl~Q!nWn?q;VixqWNXh+QdmM+5f`_l`3W+OD);2T8b}q5q?U6P4}(Rj%l}_9pGdn
zTH(`8aC|@3`02wBwzXJ)ILr0R?y>$|*J}d%&X>}0w}G?&0s-Q?WO14Her2^fXHDZ>
z?CY_1-8h>{>dly6XH*a^LMN$*emK9bmWAiG<6xCec4>TI7$EM`lmV7ky@Od~0vA2l
zJI8qmSv|?8(!~~KYLlD)(|AFAXH}U`uw&YbMl}KL(yl&01J<jzKE9-9Ni^5}0V%}=
zPAT*4J&rHe#ODx2W2fjLo0zZdyB=QBb8={|9<ewoVbr}z?_;(5ad-j;J!+;5d8TBV
z+`p%fhUanXlFmmz2PU^vmkrC0r~eBMcHM?ON#pi%PY5!EQnB1<V=@BlZS5x|6~b?h
zdDJS|qD7a)qp2oGcA-}(P}SCP3>uHVDtue0JJscHCEaMyeFE(WhTFI|82`4lHLB&k
z+J*@<BTTwK&<7|*k2bSP7=~+0jzYob5+#UJWf7L!xGIvW@V&o0WhCDb&-Aga-b6&}
zHLq{tf8hE<J@0zCrB^rvCE=<&+L2vah2bfB#<pL|a-H*k@VM{xV3VV7Sfoe-)|O01
zq;ul;lEEMBde7@tO(WdOCk1&Gbj>{0(R1B-qjb#XGD)%8$K3_;geH<hDelQac$_3H
zjq!ZGQUD2GVz9i6qwx`&-NFg7eE5%7O`HDX)cZ>hn%nQ)>vg1J(W;DGto@?UEoNyv
zY;Dg>%1+nIf7^H*{yzZ5KsmpP<m*ts=2a7Ir<ad`;@p=;agE#3f)NSpXOz8Cd@hy6
z?h>qaF&w0QF4249rG8k4miT#-GW=3FxeVoT6d)^PK1RoU<eLRr+iULE`4Go+J~W4n
zL22z9*=*wSu{p*CHe$M&{)2TEzv{tbl)F|>%`u_Yc6C&&V^m$`%7C6n>Mj~mJHh)k
zv`Cv(ynld@jfW;A94MuKj7-Z{HkA&*yn5<Cp$pA)rzB4R;ojIheZn2r-#fmCgJXd5
zG!0%TZ;5CJxc7)2?k&)-B*Z(e{2Uygs{=GWv&82IeQ=ycT4@X}?>!C2Bi!Tjj(e`q
zcbd9gHGy3o+uajKU`l&|!4R%$yfT2c@6<&B(%uxB@vG*5>H%d5M>b<quR3P+hztz5
zokH{lObW07w{}oHl}^KqZGVY)<O5vCX2mAV?5v81@C?6PE$TB&X6n-;JGMN{)N13v
zC!fTl!o+6b&2e9|Xv};sh~xbnH%H-;1{A+oPdTuFb_E_E4r9`mcJTln%AmLb5oCS0
zaabq?<?$yBcM|rop+2%+c1tdlcwb8yRV`GT*J|m3_r`0lhV!Jr#hRL9%x`I-&4j-o
z|HvfCKC?K@<sYlLET9lUiGpGQCDOwW<lPc%w8<u>AUpZAGm>cQuG?2*<TBg1Szi`$
zC^phCU6zU4@32!kD7i=3Km6p=OxZf+y_jzl1f>84hr?_soL66c4dthcDRHQWAN=^I
z;cY3=-h205Q;a&UU*SF0Y$)j+Xb+Qe?ioCcYhhZmlC(@VrV*>SANRs@;lz_pl@jF9
zz_EWUA5l`#hTz%z@4Z_<1*Ps`Qkqb<wgO7IePoIHcz8(4%I(eSaeJk?#g<!Hnbwl>
zeCqq}wUulue3Y6F^XGppzS1{)hwkDnAEzU|Q)Hp(fFC_v9nAZ3p7p`KrSxS(#)0<A
zdp06tznto??3(VE1uu#`(6<*z9%Mf(hT;)rxqVblN~|u+PzZN5D_rQux>YApd!~-A
zz4FgS9aj!mH~J!)z(qRkgVpWEn{1l67fAC2dG)p0T9j8&V5Q$fWA^M>Qgrs_Hqf__
zJHt;q-JbbV(6=_+(3G~xOWkDqTKZk~9>w8o$w#bkQ6_Wc!~lR5vRk%#Jov$;`}!Mh
zkhqEPccrc<2P?q`Q>TWnzWP!YxyQ>5O58{z4t;@-Pj0rwmIXY(x{r;cuhhTW(k|xA
zo)f;5EcxD#eq!<rnNZB#5XwsWAnt|IK;2@=3gDagYi&+q*^jk43KTXtdghet>3DvR
z>j>QIpln}58w1><e0Si3opa@K$APx@p*93I+-M^UDi<GjGWaaM=#op#Iv#obv6Qrt
zhkYXtPd&{^n}sAieC^d&tKvx#u^l&z9m7r>ZW}S%$+~@}PA|C3>#Mdrb;^_i>Qkmn
zwhhHvWL^QG<@f=~QV#{xa$LlY$(k7H>t@F9X!WbpjRgi7alX?r8Oo*-)qt$=7f31G
zb#XVFcP$UTg~=)7-%_om7;BM#@RBQ=ql|}a_Au6EH+r(ATw$Npe(W@OoeKa>2eV4o
z_!(yt9=gh3VF#0180ES~v|`RC!gzL_DdDce)NK-naDD&^WA0u5>6HKtkLzhUp2y|t
z>3iB9rdLMSad`%ZbUZALYu36TWx*p6PGUZ*=N@n(6a;f<@cDTn+`G0a9qwTi)M@y8
zFO*&tWSVf8!jF5;16Njqm<w<Z9cL)_<jeD;+f@T#1cgRGGC7x99nJe-2XFYb4Z7MQ
zJhBlX>`Gv#L^?jORYTbqqo!=ECPEX(IAFtbj_C}_-MZ84>)*Vo<G2%U9;j?0zC_lx
zIPWh2;b|>eF%RBO)JQCPl4HehIA}L{i4@tiH6{u0ZCT88U6N)ZXT?yVS}V$P@6`8}
zX^=HbYx1DHun?yov~=kJ9@M3zO(HdOfK7ocB%L7tqMMWnlB6a}UE#}H`dv3!cR64g
z;ebWNJSis9N*>;^xNwCq3;(aankPj<p~4P@t3xrRs=q6Ctv0X4;+6{I=sgx_C|>b%
zdc=?;bxitqrno4~e`Fqt<5GYk4A&M|d7XLAd1k@qiVOU`&XQ7Tij>Z=^DZ;qELiZZ
zj&=7m{$r(_hH{IFHzrIlpSe2?7!dZ+adup3;OiG<6hLm%)$QY-y-fX~&Nya2K<*Jx
zKAb5F#L2RFyyd1FQdn_Z$Ko>!w2SOwEv7~4OpEyWeUUbqC75}hECmk!1v&PQe@`qR
z0b7Jgrm^8=GCn8QS&)&>T9hMLBM&?26tiIDX!+f@-)iaL*LH1L;7-*h$zoYE(qAe8
zCFNHPv)Bm|hAG-NfX~*sW-S@{g_0Y~R}`R2RK7`*-V)DcrNj6l3oMkipU6^t6DdYf
zF1PBJnv8kBv;@lh>E5G^JjmsbIROer<OPZ}UlcECk@c{`S<uBcj<T{xJWiWQ6Zztn
z*St#09!E{{xfstJFX>xqw+>Un<nXPOh~&@wRf<pTftSaP3w!UszbUu*P^52$8NXBy
zS;&?z`#$?zjVwf&$teyt4-P%z2q|mdHkpg18tsP@2yE^+V7bf*0^C}(rClHsuKx2M
z1MVQ`cW0b+j(h`8maCW>owQw%Tg*RN$t}fqz!Lnti@qbj(r=l?IdhP`w4qTBj*(lG
zep~l9tK=CvNwB(<!nh=HD8(yRDwK<lVwI0`;$s`7^&q*@dHm6b!>dwS(~hToIMo!t
zo)(*J@UU8*c)a#p@ds=&Pn%L~KD;7}Wx!;f^4KEfQyNU><>q+l@T%^uTV(o1PL@^`
zza2;>-7;w*(;5PFkTk@^(;>_KJ#s9n$#Pj0@3L~!*Tfc1TQT(n5<4ejb+d@Yc^b?*
zIK!Xx`;NR<HoBPgmsOC~{Y!O%WwDJT$XdpAa++y2jnAR76S)|ZS|Us4r3;zwG6qW_
ztY44r(Z6svDTJdXF^Xfx!-86?DX(5Tkt=N_;e9Go?`<Gs>FVR<G^B1l<CyPxY6F>8
zs8*L+AG^<J<CiuA81HK<YpWzymH=l5S6Ae6pRQEyscaAD$`Ab~ark+d$K%<7Ft1j^
zp~Z84K#%dE15NO=@m*i)x>lhiI@By3-WfnF3r;wFB|{MLL_8y&QD~6i^h(9rn8Lu}
z2R-6(?|59j;C=<qe}qw3FSO^^)91a%;|e`~o-Z$hf>sSM<u3zJZs4^=qBs*fc6ID9
zrsm>XMM!z&ir`jU%;B{PZwAzt15||7t2zTaqDix_Z!)wSQ`YBt743<IE$t^4RNn+U
zfEtPsYx$B4+9s)UidHctX)*~}W(zYWED}rNFAGN&HXO@JPi{&QX}(zLIe>ct7Tj3!
zVcF%dv6M?3%Pt0=>FDoTvXsSQHvLt4tVmfr1AGK)z^=R6LfaQD$dA6VWGl6xFP2ui
zoz{|9e2?RE(xJDGvOAC;j<j>c89$<rKJ-BN=`a2vY}s$?qWMR;gav1%{9|d11@EvE
zPm&+ZYb?1rvI<3!G(jJQqi;&E8Q)iv+YFBEV*$6mtiLz{?EpVZ0g9SgvfAdDJijx}
zIakVq-4caxsd(9NEVgl*!I6D_8_7Zx%Rqc)rU7L)esi(v<j6I^Ns(=~*;b0}_tL1T
zdmGVn&nYQxLNSF_=9adD`vlwq^j&{Lxf{6Iu(4{#BAO4qeJl$)CrSQL`Y?7_-Dmu1
zq8uv)DDvk>X^+oNEU0JBoDq8VT1|dMkCQLzb;G20-YONfF5y_l(iY~cY`B$()6rlq
z8F00M<t`u0!kr5iyo{G9dZ{y9KX4?U59YP*mmAAcGxp138TJ0jJNmrIgH7>IJ3T?i
z3YY%pVEk6yU~P_~o&{Z3Z8Wm)sbz6E>)i8o9RCK(=N@u%fs&rF2Vkrx&*e5(Je_K;
z-nU*=-*TV~^ex&6mhIcAop4;=0iWpb4vSwPEoU4jeSKXg35FhftUhFRv>o4fp24qe
zrMMd>R|5|CiKef>8z9>b(=y28wB<VLnWv<z9S{yW<PdYC@y$0_RL@sg=S$w^d4L-c
zP6p8z+R`q_KYpP3FeyK*#xMWDk4z?Dwdat?Eh&8q<km)cxwZE``{^TsZ<#9|;?WLH
z&M4>8yzeEx;p6we{^NgJ|0WLB@4b3$%B{gVa#2D*K)LMDPcr+tv7>D>r(Aq2x>-{^
zKX#1$@ClC(Vcc(UT7~vfjEB|o#PidhD{Tw66$c!2u#Go&-*KCfOJtrltI};5f6}<&
zDJApPT(h*yYfnDg8`nkz$$}<S&w(_ze9S9|Eq*!<?TF2}WDV{S9HAiM^7;_Vuu$V4
z-)UhE7B|2;xe($da%-_<Ny`%4D8@}!d<l2SZ9;bI)>VcTvKH2_)P{V=aJ_!KV$7t4
z)sLda1XBp}Jt)<6Zll?oYRB+rg-HedBdkxepL>)G&N3!h+@p&GcqSfKj|V>Y;Ca0C
zy@E~u2_EsFg+3HIgt?wmw?>C&j}KjN9fx~p0G=i^01r<x8-w$a9g&C-^g=+CFjvg#
z)-pgCz<W>F6X6-)3SEy&9KyT+x=k{l#vzVZ0QhZ9AG)gy$c9&gkAGN843%JH!Ofx(
zzrs1Q&I~`|&KZo2)}gvHp&$!O3IC$XU<SO@pqC+7@Mw6B@7Ds1=0i0cu=?pDYeD=5
z)fpHB_|aa>+Ew+$vnhjFK)Sd}rOO5~dE!?sBxImZGiyuaY7;4jC#CRGO$e4r35%bu
zjsh#5_{fJAtsm(M!x+%J&?gg-*HJlYrn5Y900l1oHu(q=$A5vX^?@2bD)qb;*u{Vk
zz~Sd{s6IYsn+-zZNbu&HZ;_z$^>(I>9Q#E<g(6_^kw@9r=o6$0H&~vbup~ZEQ(mP6
z+C|o2SeP*u4LV|Qk}5Lh;6n%LLtgP?c(&oC$>}T|5igeiBgp^31C#jWZXT0wR}{Sd
z!6H6%#gTgy(DcF8lpmC4TlL%8$e@JaC^HHX0L3PjzonqR6tR>AzQ(b(yZPbF;#U%L
zSTdd|WirR20j&Nw=Kbxr`6Jqdqbwb#GMsVtIc8ml66~yV&y#FnYE&(>$glF};!8Z*
z?Xghc;Gee?y!_HQ``FvWH(o1H#*Z2Oto#e_C%$ec<!Jm+*C4rz7(3=!lXbJzM)7Zp
zwJ)%Vc)Fu}5SN2@-g!F=I($f?{Ke{$qyM;&z#_9Xl;bc<M*dX~^f~H1_N5jbvtK`4
z_I)Yn^)WmYj9A<cI{XNgYi*5_i`AZX&<E1a(u{Vg^+{a69H|e0dA~$iyIHDVW^+Ox
z>nnvGb0vVf=NLVflUR2GTlbedkgwnu#^#ltgi|go)v<;;<j}(`kEDys6hA)u#_O-j
zb<Dyrc<4|&{!cmsg^MyfeOdr|wL-dYkv{U`3|Z)J*{`3GMEQsBW&A<|C`$2t%cd28
z6+at2&I1d~{9zMl!Yi+Ye*OCwC=5{~LKmes@&iTXF~f#QeoROdnketEz>hMhYdBQ(
z*B)Rzzwhq5!XbkW59=%6z_{nfguUcOWYf(yw`V?Dcgf{HFgfG$`pBcIYZoYyu?oh;
z1JFZdVv{8+6L`mo2*!>?Zb><rwg6@>hmUOM?S2OwU^0uifXjGuB|!jlLA8<IId>rV
zKSqA1fxga1?x<@NMEJJm)QY+8s1P4t=qH|hs^LQud51eB0Hr>8$3+DYdH8)(gqPz9
z`8Yu*3%q?<<aYkS?FBxvC%*Z5fy^5_W|Thgy0_%zHkJbNjgNSa9X-mPaczRaobdr*
zV;3L9Z36LM71pLGMUjn0YdW+AGyV|YT3w40YDb{j18pk*%h4iRUQWNZBbknf>T4yt
zk|5QjO}O~uUd7ZnU`og(e3(s&NVBxejX+lBj>u_!({TUB=oc0)S|B-uf8l6-8&k@a
zufEAvN6nfRYb>mS7sdII+Eer|EZ@RC@GsoUPXCw;^tQ&e2JkBMYjq@;qiHSO2C!_h
zahJ=drKfwwb=qBfff}P*Ld<C92wIzEt=fbv2jIGxp8(wRnt)+m$zIXUM6Seh<qdHN
zvntRPaOG_phdAxge|q|)1AWhXI(-F4@Pz%DLO7y_c|p<{=N=#d-V=u(@kx*$&%F0|
z-1FYUbZbCiyXWpXm(D#j!2^gREtt{c8E~4U<G9)MiSIOsvx-2h8g?Toz76^a5DoeO
z%v`3U^l5M$Bm)B(6wInJN{TdUau2iH0w#pp5}}EkaDa&itsg}SLc3AC#Jb37yJawo
z9vVbj>pRJOk(<~;d6A>)#LKj|B4nx#%9Cg3Q^#QRuS*vfIaQNsAEL@;N0xFtW-(<)
zE2R-nZ{V~qk!I`_nFD+T=~x}py-ZeMSgLZ=nvcC@{fK%QkqdlW>?AF$`FI+~=qKs8
zJ&RbE_gFLCc>T3Hf<Ih}i^DXLUnGme55xT<?shU2uUMj@tp4dQ{?Qi3C_&nq*QXwP
zG@Nzb1>x`i>A#s$^Vz4L)Pj1SByAM8he@%D5)F&97oQ)SSi5EO|Izem;r@F@Byr2#
zU`h9od;*^^{1kl{?Va%9)c3=K_ueaI(Fx&%?x&cN48@y&Ea<7n9}UM2J2Cw1@BhIR
zFDPI}J^OU>VXSOg&q)Dr%<(6Lzx#)O)YyqX=P6}BLYIy2&sfDh0gt4dMoB$SR=0fU
z%w)eK<*pAsaG&{y<tRD82cl4>o2<^^l)toSlVPmd#7SYl{SOFN{^<&<lfgrd3ipn<
zvt(5K$zlPEVmJ*bPf-Y+e%85(VtVw*r|pA%;GrBHsro+m!ta=M?R3>2N~3cAOK}^4
z!qTmQS?F<09}7Wu|B=o^z3)fL`jexv7kuYZ>sOTfsV5#ul$UqhdXu@e`0?NU(tIp_
zCd=P@?!H}ZMjsT^T<cEtOWNEo)ZQ1VU%so4&#~En+%E=Lvh%^TU;NX*gvTC!Q0?($
zeE{xGwXNgBrQiEuln2@zxb2pk6N}e09X|f^x9hJ9$H^L=4?eOe#$x+E)h8Pti}c0#
z8?V16950`!KmPeIZ6S|bxk<8t4VijCvA#w9xuxe=wNu*3S?8TEYu)IA>X|1Wm(TDi
zmVCm4f6npX<-C<`I)7M5PkQGa^T+Pt`2M~7j$6Y~+8i5t^l=u<M>08W;J}C0=wCno
z$A8Yrpr=f!=kIH|^1(l>NQVtS+59#0VKH2eoOjX1YBx*5{Q2|3GfzFPb`$+oTf30F
zuBKfe6UZ}4b(0D5KaX35Vln|d#*Ux<-7mrdwLvUZM~{3)a_ayq7RvauC4c|!m;Yow
z<vER!K4CFan~TW7pZ@(XCF9?ae7!q7`NU)4LizaRBYjv`vnhkcw*#^ff9*f~$<L&S
zUPC_ezYe$j?Z(6(eYyB->Ts&ydq4b%^%v^&kq2X4jT$K)s_)_Af-wyX=x3gKBJqh{
ziYIJ9?6A|0k~cFGS0bL*TCY*&&6m4~mkLPm(L37msb`#($h<M5p0&0BB7KW-1D-Pm
z&6qyJK0L<<Tss9McGws$0IdsKh2;?1wtZGWwaN!p0h#<%8MD*Ta>}_RADV}0c5nSM
zE@4<l<DQO%Q|^}_uedj{*m3nn*%nLL%|>*$Zc9w@ira?H2J#hk9~i}PD$_UW<A=R*
z_pw;xGh?1v!K&su4r)m&_7R+vSZw;N){s8GuTS1ZIVB5d%f3#o5B-&r3e`b_j}w_F
z%%m(aKriW)4G!U4eWJxXfA7j(o}mRE$~y<*qNh!VdHggk4Fy_+k$xJ$=Y3QP=F|4D
z1UI&}<k4<O+%ri4IG%Z~StTqP@B$N;d*XOzxhEX(aNcpx4|-0ME6QIoP8{&KIv&ri
z$pH_1f94uZnDXJ*A2#Il)nA=3QLk1F=-q36uAs0=3`8KZWhp>dqLi|u>bfFiqL7c)
zpmwB%qXJa7*SN)01w_Q$Q}q{%r`jtu@u;5C%7JN<1Qo^Dt2(F-Q0VIbs4QRH$4|w0
zsxPzjt%w*A$Vyiot+D#j{o=*?imMit>}=Cc$^yO9x@fCrQ#P8vwCFrk%@2=R>ox9%
zMg@568?{pMc-}w!>fz}tT#T%W8#IyE^hexBXb@%-$5^dD2~*M(I_lmN=j!+MOS}FQ
z>zB9XffAEFEVa_df-B{#N6#MCebUEwvvF83qnz?1<JtF>o>>6107%DgYhJNn<4Arf
zpd45-7K0@JCX*sYx&Bs+Mmh{jK@{e(%h})LHL{`SYCX&5H9^)5R*5Vy(!5E(FLhs-
zYQ&<PX%`^rxa9eWAw$D6Qn2!YLV%6JU;NWQn?l)--lyY~zF#J*JKEU-S@`Z_7RNVS
zdsRtvtf~(?;>hr)-~Xm04lW+}K%0Y)cL+9Ib+DnyM-J-^g?uc0DoiU%pK4_g?F%Ii
zeX%uFj;Ly(sd3ZWtf^RR!4?;yv}ZMof@AfC`6+y&?oqzw`NkZsZSnvbl#gSyaqdUE
zq~FH&iS;bPBCQZC%tia3yl)kw1W%CzDEf*)F&?DxF8%%wO+omM{NWY@(x(5EIv!j}
z1{I^(*06NDDHgX-UaPh$G)TsSg$pb98|I1d54RP?0EI3tPfGD7E91@DT5=ybSq@6o
zccu972?ctwajPN^i|~ZLQmSm_@?YxR_B%%Z#((+46{S$DEteY8C_f*%a`{k_NVyj#
zcv?%Ja#50Z;xBvziZ`+1p*i(aLI!zJV-6yXie*qfJS!D(^Vw?DUCcr(G5q7s*FoH~
z`OBDQ|1=+o@>)*{rWo<et?oPUG@_F2SWsChC;Y)h1MAanUGXoBS_b|&c*Xj2M_gmR
zPyn+*i?4t4{j3UNa~Xv&KRdO_x+?|gu{RZ5_BLJG(ujrW6!NHaEPF%$v&IFlyW3`z
z7@u^R3b9MR_IzWUg#TqkMYOWkcWy|p2?+-V4A?o`d(UkQ!a53OI!Y>(A7SV{0qzOo
znS~7ZFcO`rhx5$6E0cK!mn)rzV}VhO#4xAfde*FdmS=#teouVAN67(g2k(&3<sDZ8
zSJe75FFjF^JR-z+M}mZN1xV2E!Q~x4&w#&Ekb&cH1&5!f<Iki|zMPJ3?Vd1x<b^9V
zNS}D5<Fs{KGJW2yA^`iutfjI*6lZ)=5ZwWE6%%12PQwv2@gpR)2trGw#2?c1bW5PD
za>3Rs+bC$6<aV(Sme9l-0}PhFaj-<~fkA<GQB{f*sw%|dc{iRwg3$<QBY$F~w*1w?
zSmm>cf(?R*koG~+cghUX&LXU@nNKE@6)6=$i~6e;@bPFF>~yZQFJHCA_Ow06wNYut
zs*M9IXxpL;CY5RyoTZeE)#kF80;#QeEwym=Jd`U(I{(%}%k(v;SMKUc4r}EudlUiM
zD0VC5HBGx#D@)S$-sbeu<@7MWlIL~ST`!z--i10QE(=QKduJVk|9aln@-sT#(W<<*
zsGTtnZ83TO(Eaz8jkoXq2eq;e&PGTpgL&sN9r<WH(ju%8kd{<geio+ZZ__afG15=u
z+xucR28&_FNq!E@tK!BwAuUo&!r$tlSlzd^k2wvS>uF}pm9eg?S*xL(W*y>us6KCP
z!SudWEDk&^r3?n&^It43E<Dzh|M7QaAzTW|rA?f+^y^Y-R0>bGn_{?ya*n#lwywfh
z)hL6BVREa4GMM+}_|E&RjCaKe@5(_bo>z(wpNc7iNvk3cizvwJsSG9$`|fu@V)e^&
zF(}ubqRcB6s|{h+G*a!ux^A}r>U|2usS{L-+9(^xT)U~RY6i<&Dub<PrTRcCTvBaE
z+BIi7Mx-5*KI<ZY4^x{$m^phUUp|fK-1)m@v+;jaPqCcQhc6#^TOuF6-L+O_<2M>4
zrRu!#IZCBqBeCS6(r3LTmmb=>)qF(bpp@3Q&qM*r2h$g8{9bA<w}>NX)izUP+jW~=
zXSQxXmB`aC;VtvNdT=(<hz3ed(3IrL2=6+t*Hz*~XS|QCLn%{{JTUQd7QrqAgjXuz
zuK$dJBeInD0Qk^x8cq{j;t?LJC(`6SdQX23eYYsqt>HqOpT~oa=TEl@4)@UG=lLPb
z60n=xACJt{Gw8(A5xMsa5)~ZcaP@?omV%OZPM0ue5}Ee2oCa5Crqgytfa`g2#jwZM
ztD@->zDk0LICd~qHD(bhE}&p!kc*2Mu@wObm)k33d^D_r(_Yb4psu<o;wMU4e9gwe
zwLz>P9oyBVDaa3#{6f`xV%^r9cSQR@G0P;cizW;7iP#C+n$z0w;WLvJIq6W^afh8Q
zNFR)DTU^Otp|vH_?pV}<Lucm0^U%CDIZ(&}o4c!N*0Xg&YnhK_4O<)(mZL3CH{W=J
zTtw_HpR}8sJAgM{n;=E)izO8+)zIcccI5y|H~dwbf6#J>CErm=IeC&6D<$z8`@*wO
z&vui}v5hU7)AM1s?8dmKoyKp(J#)OJ+GJeDhBED0Kio%9X2$o}v^y#{^(i41uDBNH
z?D<K3N|U0Jt%gQ5%v6%i+wvT6nTH?h<qE8A6gCjwcq_=K4~_+awLf@@*``_>MW|&c
zWghD~sF%njNyc*J6SuqEACsZTN^&dTxe=SSLT)&7rdY_T{RdvzsZxzOSp7$9VcZZJ
zw>pVAQOUbZO5ep=bJ<B-l+}!hth;2r-*rjXXfe#jE_GeQ+^<M$E>qroTPuT<dlhk$
z7)l6h?8Y=Z@rpTvc);W!Nwab$S2YZ04f;of0s_JHnXZfU1w6cQe6GAle+j<pQ3>Zc
zjfeh|_g>Y!_j?Z~ec}-AVbD)M>#=~Y(@5u+xCRhR1IV5!M<QZc)6DyHW}PX}aV0Ks
z!Q-9NfwpH>w+7(DIFIL<<)x>~6?YKC1)%Fpb(*BXz5mi_DtJ|fIGDvRc!>`ZcD_JC
zD4Ip0)s|GoY3|p+GNW5<JSHpcO|aUuRxmsoxHW9;U~(k2=wz>6Wl|m30HXvM43@}M
z#8T~=N-J5f6so2}xec=Ig0|8qkV2Sp^D{n60pI8^-FbZ`gRjIHz9s38Y}zbo;W!fo
z&gH35Wv@sVzVma@TQNctp~-=c;{g4Z_9=^<QodPh&5UornG|fK{80vd*sWH|v61_V
z{6zDs50C?&f;mN>FUDsq-5z~7?~m27s=Y>;r_C<oWwj-(mU<yx)^?`&(#G@P+%Ke2
z%~Oo&wqQ;#7gN?_wz;Y=pR)*!vYi<GGPu<wRs#;H*tmvLSYv8j1jnPjU9{+9;TJzf
z*fII3p$M&_;OBPbgiIY^k{KJ=%30hMpj61b#~yijxyfnL9MqSyGOlPQv-9YpNYw>e
zdPXnKm8*+Y2FnVQlqe!*$JvhP1Ei_Bx2Y*~%X-*+%N7}@eBPc{X_P77D)uVjjW&I?
zij;dBDTli(k+rbgNa$zAXmxClRk2s~nU<=Ick#Ex*42!MY>?Wx$aPT{eF$)o4r>Ze
z^>1;rZL&<l-kQ^C7DumsZ5^9o%nR(x&m)RcZhNSDHfvt}be23U(%h2NDwm<{DXk<i
zU=0gmR_NR_amG@YN~H<#WAe;1c;GlYc}`b8ad9!>lW*cWu1~<hcReciyoZjzPp1za
zG{8&8BM#x&{1Dga=(f0put&}k@NljUBnm-r0lz0<!g%(=>bBsS%sW0b{RbWZ4dP}C
zkxidGfamFP<=N=Bp+76iN(|zf_I^}Aluog_@cE+$DFGz}Bm|q#I1Z#6ZKYJG9bddr
zKaB$|5=GzJ!x9~n=Exum*){_mtx<V}ZUZ}Vv=r9DUAx6heEHWNpsuT>5G{q3He${c
z!V+FmAS}}a#dd1jlaac`O}E}^OIEkUn}nJisK5axu(4e>rgcI!-3KaUXQg=Ez%pkm
zX(eVY3R%Wg7MN_jGOl+tFm(Dj)3qz(oFAQKE-3d<n)|s=%#O}mGrcAUnj9$PKvq2Z
zTjuFLS8w2S*pn-H&E~K1;=BGSz(=Esd|r%vMyC@uENv4_g>+t*WJL2tSq^YIWue9v
zToCk--+DGimj|9krSL+_4>}M|;oA2Nuo%|&0B8@<)s5D|4PJYeWnktd>r(p=c_zG;
zNAFP-&+0`)2s76iohe*uDNM)4an_M4iV~g?iTu!K^2{U;{iC~d;2q%a!9hnE{k6q7
zPS>x{@OXrII9CsMMGepVpbrq2AJ1GJk7w|pLHdrb+X!Sj4Mg_DxjG@w1jIZ6?jZ^e
z_ojf=6(EdvS@3YD!Id8XKKIZ9z;)VQFy8TVI_dnU?|E-PgKvU3V8=D%-VeH81hd48
z1fh1uTDnUB;wC_w9#tv>Eq*(g+vx)XdGA2MSFOUG$w=33J#FW*(L90$?2uYVmk%Y5
z`*5$uQ5$cRch9rYX=lev({Q>)>nz(2YpGYoS*nQuo2BO4H%qh1vLyA)j%x+klaxuc
zP5CRw!laGTpj%gcj7Y95*sS4Qi|#uQNShx8s!*uT%Vaa<RhR=wzhhISj(mtm?V~tE
zHa8MH-;GVB+7kG*jHy)pauj8rmz2C{PSS9`#`Iz-3d@qWg{gfTFj7yK$x0O&ZGI;8
z%))qC9BbWuLqzC+zm~O_Ka{`xu-w8j$o&y6(Q#-j<B;!_#;p#>aWe_}oHx~Gg{%_o
z!6k@U?3E~SgGFVDRMWx82hV9PTx&*es%gwN-#gu;kf}aUB{9#3<xzCZGPO$_!`$-M
zHpdowo;?N$fY0(LQ@$$GZldKm(89QvV<Q`)-z->cE+l&BgO~oTnml&r+~IG1*&?}-
z;KQ({2a&>B*RE<WoXlk{W*=dex{0D#OG(;h$L5(f*`klhwdmAvJpsCulVX{oyk32|
zo|#;}XfZKHpwJ|!43xeA_pV^&eKGKGXgDtSG%fU>E{wqQGzbHi^!R1dcRHkR=ZbYD
zE_kKDY4AR2+B{@i7sOr3>jXVxJo|fyc&2r01@Xf0?1>P@k7s_ke&7ln(&iqz9+v{?
z6Uau}aY+YUPv6}~5XbYDPDjB;*TZ;jLc#$lzSR4za^a9_00k6Z7hb#=1r#i8LT7Lw
zDuWrER67lxl*EA`zh@IS1gLu&#i|PoihNAZd@VM(4q9`WzNxBbBC9^hvECLf+}W*G
z&uop}3~6$p$$=&ZnjBamIKcRBA8e6qXME{Qz*R(xj089p!veiU^FOSFStQ%$WM^is
znRb%{s~87tKAxLzqMT_$Z5%+MV9GP`QnP5y<)fhs>l#-G!{*wz|7y$EDj!RYnsp50
zAG(I_vKU?->VUpxe)hH2il=hp>6vcbIL#xIxvq=s)U1u$o!T)u&5Mx{ExZoEI#aaL
z7RM;=O*32v@+&b3DggBvx=L4=AhFX@8=PWc=q`!J4;=sT3~+V*D_3Zc2I+z87RNlJ
z5b!jMrR8CcLww@#>@;<2VTp1fs}Kf(mmV=ogl7PPo^irRgm_+vbo}&tp%`uOz$bl}
z0KTV1IE?dxfD3q<eh&`dc_JRlWB_^qx|JqmIKb{5Y*{S-b_fKNPY8!@`Z_4S7*P(g
zIB>=i-2_p+gi$6x9sa0tShKM5<jUEAb^=KzB-KJkSq58vRCbEb;%~7A>BWoX%0`{V
z9qL<sFGrmxsUB~X3h-O!Zx+YDVdU?tyNZgerI-NNt}*T#@MYFUVDV3Wh-tj6HooFv
z!PV93C#Flkl<~6Fm9^ZqXQ$fKn|MtQtk4|D_q!<H>Q)%<kM!#X%SG?ri9D-YA!;FH
z5=;@vO(Sxoddkh#jIWJIB3JCl*WB3Osw{3RT%TpCQ*o;CgjSpjm}Qd2n675=<5SgI
z>ZbNM%u8s-@H{SrsfRcZ#EnGU7;Ru>)SmTKFJ@NWFmY?bip7Ck9n#lILAIJp;Vp0B
z%x}{z5~<OyF*4h}bBr-*lwy+4tL^G1V1>kHmu+fcr7HX=#o}Kl?V-yXFIU?9Sp7u3
z!y*}-Enc!vis7DSHJp6^Ay!cbvp_9@HlnmK1VSm=9X*H|N>^RuN9Zt?<GU`4qHZMB
z20gR&&bsRjZ0)&B8^~IR;?5%WwDzY)`JxLCSJ~w@tGz(YYdH?ME|RN@KJ<?WcfWdk
z-cw<O1Kh)OSMK6A0y>0)3m)$Y1N=Un7WagMo2F0tyz?vX_z~vxb(_3*8iW~S6~bu*
z2=IfrC(1M6nd9m-JmEA`phq01>lt)9dS&!^&pXE_92{p3?*NZSy8HmA$(1lqi+rG0
zX+kRw<k+YS%BL<8a7<K82+DE=mf6=r_09%c;wx~4XJxK2cq58z$(4#r5kVhu+VQtA
zv7&?`-*tpj$5a}UhfJz=R8;j%)=VKRR}uMi33Z;NYP=D=$>giLN6%9^##Vz<JT;FA
zKWxVoZnU_FD;}qKsPbp5OehvdD;BD>*|k=}+7;FmKqQ!?prkfsLL&N#MQ(;QIj{<I
zz~z*6yBhjl3D!BKa#E*6)D=9~OHMHwReDdOQS_IWD#(|QMJVHo&%I2@cVIR>C#D!i
zfntkJ=77<S1oOc--uN`T12fl5s>y+shyy0wa%+!dZoLwfuXUMRy40(Xa4;I~xWS6M
z-N6+PYnY|>acE=}R>6j@KTX*sCM-vgYZtmO{w@6W+px6TQv2wf`L*|TXD8)2wi|s|
zZP8-sL$D5xA9RoIBXS?0(}@~%BaDp=ha9`2@>XMW1NmbcD8_(>muh850Kr1-M1d0p
zAVSI&v~KZ>;=rwbxq`zlEtp)t>bg#ko2Ab)zjS=)xb9T9Nq#&ZymK560}nb5&`X}P
znht-#m5g%rLi;lWNC@!4c%tBY!93$m%b&Rd&a5;&aQ){6^@5O=r^glW=X4t2V?FHY
zf!Bm$9Izc!Dp;&S`D;qycvPZWcNPSEY)*c5mSaKD7UNBCcv)7kTU?tpX_ivko)PqM
z0fxV#T$4^Fj%}k=4K~%tZmjLd>Ygv^vQxWM)=GKa#5+1vK8y!FRnrb~IKGhporVC}
z5#fS7W)e!;h7il)WuhgISjjKZM3btC_2XhEL21~H^*Ql!iTKXPh~R(p_o#Z4gtPaZ
z(P$f1;wIrH2UY+Ms2^r!Nu$QcY&vkKVe+&p)@S7()4uwFjTtI*lzsK1o23L_^XH$k
z9Ch2V*7cmFQ{A)IVm2Mh$;XVan!;}(M^)W=xjM@A!m=S-^S>p!!B>4W4qyR{6;aNO
z1W1NhuT-0KYUY5~gW5|ImOl>o+}Crqs@0N}H`_MVW?M@@=TPC*`9(7~GFr0`Ij+-C
z{%YM~LytlrYP9V}54qS*q>yxtPfm<9N<k?c4=)za>6ODN7Oy>Fo~F|%m$u`U!*M#L
zu1+KWKHm~pe@eNkZx?YIlar9ihv!;H%M)nuU9=QtV*xi38k;ea(?)5xZj6V~&BCHZ
z3zc_UhzYOS%+@krVocWhQ)6*#+SR62o=M0k%7XTX>{Aa-sEPwH4c#P)TPDO*2tV$5
z=lV*&r_y;JnVrW+|EXiyiGEeL2`#5bm@AS!El=NZc=mhJB7M&b&-{1>xOaTY0B!+f
z6~aVFBYGyBFbM+?<sAfh2as{%^7DA$qnvfR#Pc6vo<4Yl6XxzB2y<G5^8>hgI5<3$
z9_iyUqTpTCeN_=xJrMigy4sU1kl>^QMHCidqwck4$?b+2;_|~Hn<=y{J2aN%1&qfU
zX!6H48lN*ulloOs3}Q>A@JH!yBSH~=X8A?@0_fDvmB~v%#{9u?vL*5N<*yby$ETnV
z0@<J(J52eAb$n|U5aK%mj{KP7KzCS|F>z@^lLJi-bQ}jvCS>Gb^$UWI%V+&la#>n`
z%6W?EG-{LCd0OS~Jf+g9@W!#q(<=AYDMSTyHZ|s5`nObAdSzBpnYLAqcHQ2^<ZVvS
zqD3z4Ii5^m(J0F#EgZ3A<_qK~V{E=qx5S%-njBa;IAB(*Nm0D#CjqO_P3z4x<XqJt
z83^}?!}o45RzfD(IE%YOHqi(#3Z=q}B3BjYHCdXn=eIaHkDq><rd8~H8n<5e=`@{Y
zskGC$rEr`^xoh!pFBRZW?&AOeKmbWZK~zI^$#+vw<4~_%yYw*E2%Y}nImWwOo3rsy
z;~-;Uv>J~0UF1RnOW`H>^P^3sidFo!GDbEY(*YE>ti9V)55?$0n?6SQ7~9*PyDZg}
z{n=^&Eg9fCM}J2D2%vw2l|1v#6~EvEyyKq5JGg+;aD3cI0N{ZGEfVLwH-lp7JHF#O
zJ>v7u!QT@`ev+zpg{&hw0?!~p&<j8qnWG>O<O)7GgnNR71K>Emr<0|}GYVj*RVsbA
z_=S#Vo;W;1gDbyuzM$1~86hTA195ysJjf!_s#1U1nlgVnvKCHR3d7`TfQqUXw;FmY
z2aW_g1B-SZ`JfA8-WznI%7?%=WpHkBrx8GdT~r3!#A;=)B$bc$-JW7bR}HxZGX0`T
zu)4L*#h_kgqyjXx501n!A>e0|l4wn~L_WZ6!fb_uc*9$g(m>pjR!xObye2d`&@mi{
zvJDB_Sn!Q9>*fvagI<<K_w?#G)|lKt)sF@z`H0L-9_x4GWpIjl&iY*z!!g@_wUV`t
z#-f;ZqZw_q&J|v5gGFoFZ49Bz%TNmE#v3ez8FTD|HnNavS<+%hv{}3Z;Mb2oMzZ;*
zS`Osq6$yH?A`(_K>L#+d1f%IQO1NR7s!@gN2)gjb1giZ>M#(%sP4XyQ|0G&?imo6~
z6za*M=}%GC7Y%GcsmiCr+o%A|CtWH=G2DEtM&6amQDK_(&0p~}J(Qu2IyM(YOXNmE
z#y9xaH_KeJVpZO({tNTi5l=B+i`5o$N?_LQ%2PLe?3)c-l);O;MBl==-(;<3K%orC
zc<q_T6v)Qj;tfBSM)enRf|SDI**cQ~mdZk#e%FLb955a^qg-d{%2xD`+!OBL%3QzF
zICu{Y?)mvU-J0T!cb*1U@WJ8U)6lJjQ;D7r?!oc==r+;6di-4D<ds2|rX}Dn{Ys=<
zYq11~1f&ZPLt>a`(tCg>&NDyaLBr{y+yw|D9m2u$bSR)(`Z`So86Ji8_#W0%H^d<y
z(D18njV{+FROCPu34Dc*#Ytp53b5$RJS>g7VTr)2NKXi&WebaHaML)6Fii&*-g{#y
z3|)So7+9i04@Gd^MMOuHBPxU$2xMI<%hDxwREKU8Yr2|zWN};((wQ^hY@Uj@0F^N<
zNmLiLz*3IY$k!tECx_1kBumnx5Af2mkj_NO7zHo9D=;~>Iy72XZD~^hF{zCj`%117
z;j8hD2h!k&m~TRp1Is4|Y!RufS&#Eh)S#@o9JHR^5nZrB<!C!urf+~x@#0gv|Ej(U
zC8apqAifr+6D3<d|DI?TE00m_ol}T2E2o=_ZE{=lF0qkz%bY8oMyZy1o$<tfa!6hn
zTe`@E%dC`846})?1@Tf@HQQW}ilKiss)FiVw3Uxssx5KbU|F~F@vpiPnM6`EkNwzt
zb0)6%pQ??_%T@c)`Im4(^1^u)$4!hIq?p3e5?NyZ9Ye87u$&hqUnPmv=cbx;s=@Kx
zv<27WwCCE^^xBGFEN@lONUE8ZAO-6pxsuSeM-N#Gr`F2F=yy~Y?b1J17(X_SQJ2>7
z-BA$7adEMH5A*T4<P=RJi<1JjJ-brewrH&xRb_3DUMxm*8_C=)s^2=qA9Asbte9aw
z=_U76Ec(U;xqF_eEcBEB&7UxSC|dwGfF%rY{U=udJYQUU7~$OWi<L%5d?tPWK%J)#
z9%-l3cUrC=bsP^Ddhu4~M93J(WR8T=jPS$=;~mdlV6GnSiSeE=u7o)*aUI{8;Bg5D
z*9+k96_ga#aVw=yoF-Ju0o4iu(EQuw25uH9?1~`_<D?Uo$I7pk?5c$4lN>K|wCwB_
zd8h%TBLRg4=>u_*$KXcyqWd)nY*ObN3k^!6R<g-J-F5=-FYaV_v~O)Kz)4$L1DkLt
z>$X#^{uq5+(H~=<Y<sC{i9y?GVEd^hOU*d#=0Lx#`-ij7yP(~4oPa5}s+4!Dt+rbD
z{*Qhddab^?N3YAZqgtx<K9emS*$+#zs8_FEVXJ;y8$$Q)-Ho?vt+iI^2)Q@a)Wd-X
z4-7{P8CsE6H3%%I4m|jf@ZHOQ6!zF_@8VHX;*Bz$f6;dnywlD&C+xV>&dGE8Zd%t}
zx%PABIp>FMx7)sbNv2}Qc~@?1QNpQWr?5)jQs-N4)vq*y-W()eA9~mkWpUCk8E<Ud
z!E#t*5c7#{8h3m?7&k;(^DRxIdEYh;95k?PbySM_7F%vrR-PVw$e=KA&|#&bw+gqp
zr0PG`d8^ko1@!3IBYf`%KMrfGv4+L3l;@ffsUnj1wW3#Tg7}BbsvxzBqPV2=Yh*)y
zNF+QjC)iM0ESGhBq>C%=>+I+{Xa;#)4{2Uk1rD%!)<@?SE)3r;Tp%UuBGX57_IiV6
ziD3>(Uw-CpQDLmVdUWp@diIPzJ^*efeQK(zRNqnaH#$|$pQ}lZ?GuyXhAb{?Jhu<Z
zRTFuY$4TT7H~w>>hC&74>Uzm~>Oa#;BTw7Y;ki=!9w)1R^*oYyQ?}Yo?vJ-dA_H8B
zKsbO>)^T{|om=d>!q%^z0r0`|%<DD*FC>Kl59MzfJbk~CR+=91Dy5&M*SxQa1Gy^J
zW$|KJhe+UAWooA??%1JF<b!kC2$4XE3gW5=SA|6C9SI0YD<Ea510ZDi88CU)P1kNc
zjgJ=Q?;=LS|Hc6Tg`%W}EJ_*7Viw3*?T~QGW_*!_2{kXHuD*Ck@Drqty-BC<dCD=O
zs*HFXKC~F{Wrj$jZ%}?&4mT1ai(`E;k;YYo`<!H9-Xb4R)+a3!X_4KiT#*Jqx!c!{
zj7;;-a>0R~tMv@)^<BSidD(aW{lj)U>=^!f?bQ`&vT3!!MjOS2cSY>#5KImui;%-P
zIaOWEwqrq`o?y$Fw6JMAsfsbOJ+4@CJMFwn7(Dc-@bCZjD=Yto;w|HMC7>R_E%b?5
z7^`>h-eHY3d*=dO_SGhLw(h@8*mwT}!|gZU7{2)8i^7ELDPMP5zJwk<R||dD-yp$T
zw{PFFO0NX5ikrySXdxS?nnZH$X1N~1dh7KKJ++ZhEjay1)#>J9^O0WxA2ZdoOBP7@
zEYx(GcBM9)!Olf0yzIF108`Ze$N&1*!WXHhHMJ?wqlZtMQ!mQg(vSG)9A?b43&tL<
zHXp=zKzVnci)|TG%Otr<zgn|5b;Lo*HUf2&f>TaEGmLun>G0wU&!<B3x4qZut$OtS
zn-4E_cix2;Yr|nHH3KX<mxV9Cm>XVxaa?$Q>=;#hVcMl=WW!0{<UVa(P$|#Z`0ag8
zdbP>#<f)LXidI|c3dyX@PqF&pQclX{Sjo7EOhfVH$Lf*eE@h1;ie{r{iv2k%D>KWQ
zWh=n}ok6iToKX2zCo{Wg{cInd<AjRZQ)hHWYmfGawycwx`nd%&h7aAlM~mie-B@EU
z3Ve7j8eVm^w$BG!%Y(*v^%H>69%V3dfO7M&^7Kl))moLl$~S1(h^dsT5>!^fVB-{j
ze4>l~F^Z|E8^to1L5%l=`#XQmvYLSxd@OupgD-5^#P_sxo6z<!u0ElM4)o(7nonCn
zNq)fhJP}U%ULKw;z-}^sh~$Kc;4=o#2+!c~^Y>}yz!<^-=y?2e;=~0H;C&h=ojz&$
zyEdm^;~a%NH6h0VgffG<P54!<2xOE{SRL7drOBzH956m<k{bt#DqRc|rPRK_s5n%I
zRA*Sikrou1O=uSfjF<F@PU0o$V@=`ERTCv9CpKB~zz(~*sPC`@n+dG|9AJDnXyBpY
z$;ThH++xM~{U85q1<3izk;Ru^8W(=^fB${CFHHY!whQmSH#vOt(Two**Yhgpm)T(_
z0Ls=M{N(Q&pR&!WISqnqCymvT_0>w)@h`m?e*5eHXlNc$2Kw<>ESm90hywF}{D1#5
ztSx18^iSB(ER-aE*$;jccHU*zlJCpCXir?HyMtuh_jJl(d4b>m=0C$r<6f}r^y;;G
z`0u~^x5N^+);vD_<P+gv|DS&e|La%(Biwq^jbY~jyPBM@m0mVpI?vg6jd-TLnk62J
zrY6+P0occ8qJIPn*?_`n!MERrZ@*m-7D_=D-J4Y_&1%ld@*R<8R;j6#!twA%UMq1g
zopu&C{f_%O!6GSGX+w(^E;3z2oyfME48~PhGMh1u#%bgTitC=*wC1E0YyVoI-qyk7
z1Df<tAg&>sx&UKF^?wjv=p((Q`}1<C|5QHH`d3QnN(1uWs`6dC3?e|`yc?$@+DrXO
zD`rW^nE-D39dvmn+!MwmfiTaYzf+K<%RAENJ>WE*E@9mB<DFXzLq8jjchKQmOigG9
z2U>DgE0ADEDahfwMtxH}wcz+&eso%7DU4z)er+=<j8RP0s+{sFqf%ESK)@QP>|Jp>
zFX5{@3rgN~aDm8!!&3QyHa}g~T|BgY*K~c=TKDzKO?gV5*Cd}_cjcqm+a!*jmPskQ
zSbXi0`v^kGdKP^)RMaWzw&QCPZnNNz3mTNdz!I~@poA>eEvSKi5XAs#H#{**srjdV
z9N2A-J;T9=92(Y?wdZ@2Cxv$>O)4P1+G@SRQO6!<$Kq*k@4Wq1c<kYaG&%p)@Xk5^
z!Z6|0SHccE?il)Sv#k_*^TUJp-4mur!N>9SCmwqw%$PPUpiDdNgp<PRtM>{&{`oHg
zimOr2JYA5MKWwz|CgI>i2ZhZx+dRyWlJK58ZVz+ker~V(%6b_(n{Ba0Sn$m^Vf4sn
z%sOrV0}l$DZN7Q9^R`=^OxS3njl;>Ooe}>0hbwHtzN^a0QS3hJtYdk4_`&<boY}Jz
z{PfNGvOuNWn~LVVufCEM+>1(Qv`wPHJNvu~!fO*=3ERv1d25w>{?}iJ2k*aEip}@p
z*r<-T+n#%xD}+9M`h@8pei$Blfb>32CzIR{JoK=z-vI}N)uglm_ny1%urgyUH+|ZN
zRz^qOYv29CmRoKW?!M!;P>dhX$yyKSw{`z8=!n7Lx~u-;QIl(TSsxxh?8LDBjyqX?
zC%*Z5xNpRWf(<ULUr#;btg!j!TZB2E%(1$hoM|6UaLqN>495;TAz<xG+jw!@^I^=$
zXGPEV{2jCKdgM{ZguV9J&*W4;#eMvdhr*k0yk;&S4n1tJS*ue=Pd)i)m^|qn;W4I4
z&Xf@~>u<0@IOez$t&M#3<(I0v7sA-lBdzXEKJCmfbLK~3?5JlgBb#ixnJf~|3V;0F
zf7;0z0?)nhk}&SMF>31*b0g)lfVK7UC!VbKyL$M^-~VG6FPbBtdCF+?R3E`@MgMKL
zGllj8_l{8ef7jme2R9f84IE_c&f3BK_k`JM2Ud;*D^6lLHh<i(ldLa&K6kG55#o=3
z>80@QJ8y@fM;{x$`0|VJ+?dfxOzLRjn{R|SUw<w1>$i0{<nSZH4cA;{?-~COAADpO
zu<LGmUKU<`WqcCPZ#LO%vv8E?Zn*KrVeV(2iPw*Zciwu-UUQuPc=fmKx8E@=Sg=54
zemcCQvIC5DEQotc34HN)FST}b@nzo&AJ3c>ZoBzLvj(Jn9(ByICHs*PO8wb&_dUYF
z>Z5DQ0{y+o?}mwQyb<=<|A6F#0hU-t3^_9Fyz8zyrrTY0^tR;DgW(&=f(yR$-9X(R
zecbVe^QS9*D=RIGZ}QN0{q@7J6NiV5RqvmF`bl`;zI(%mA51M77df=A(npy}-Q9cl
zorx?$2Eb1?y0GSb<>i;cu_v5pxIg;Y&%<~<kAC(U%?(QDnVeZ2sZ3T!;_0ieypqpw
z=5C+;_77XCj_<tnW_v^2%j9n1{t<VDX_6BFeIBdZr=EB$3_s;m(R(?}m_8$1eCcJD
z)+LvJKg^mrGu-;O8x5cN%;AHF1bEN9b?m5-1?|g_iu|GeKlx;i`1gL;s$V~o#h{gI
zPxgM3O-;6Lu;E7GqZ!k~GfzEPKz;Zrr-fHveL1{6aiUHGlx}|okxD%<=W<Xv5gY0G
zo4-n<d06wB=YVZVi2$oWRKH2aP5r?SDPY!%OfnU=ly8$r9^{Xp=XnoGjFAt^Q(uMd
zXoE0A3@f=-D1#H@Mou<@YcWsd>&SW$Ww7>8h?~uyx109n6^mi4$`>ud`c_6(lDFMC
z8L519X5Y1{RN)pamQq+Bp2H}|d<&b!@M?PQZVF<?p@oYyXI5q_TM8qiq(5ls-fE7}
z9zIf2RzJDAGb2A4H7T$?WLLGgEOc4)#>I9NYp~YCd58XUiGB<9<C#eaOa{lV>4}NQ
zCr+A<9+PzZ9^5n@^wRn9^a=OLx6}8uxk95Ac%l4-KSO{Y5&8MEZtb2c2?K5o%(Ev<
zVtx-z7{oIGo-+f*t%DbmXK=wwr|;>d>3~}{eMbhd3GL*7n8|>FV#_Ut8623DrY(l!
zpwP~=R>0_#8*AL?TQ7ICr4!3xi)YmhorwCv+6bji6Y9(X^@qfos}gD9))$mE7W~w$
z2=mdOZkmK})M!=hhxO&}%1aGPI+Q1`O?Wk2E2ZJw&*z3Cj?DXorTv_L@ptSb2uj5p
zuD!;TKW9q`?6CIQeZpYHdF#zL!*y3*6+Zaj{c!T>XP6B9Qp&gqIR(_z_otYm;Y+y$
zxZ{?alW?b#z8-qm;o%usq1|-Db)l>BKpq`VJL~N5g_Og8y5cwC;Ro&uLytMm6u(p7
zf8Q(v)BcBd+GQ70WMaLs>u!6PGVQrBW5QK``hzJ2&%N+sQ#d$nznX&UvdhE!%JZLo
z_uFv)JtM;2`|cYKJ7S2VgtgaRTS_ODTS|)?uDM#}o*IUq8p{pRF1zg>hDzD_f|RpY
z=F&U=qT=bHP#QRBkd(l8hQCO8&En#y<BqemW=x+JcHeWaBwcQHm*NH`F;I#hyu(7f
zkMdazh8%fR*kHpAmG>*dO@F;E^y{~^6kq!npdK&98H&f>{O5m|0{`rD&kvhyvPl6B
z4~+j8UUI4KT1*l7;QjZ7J@(i;pro$^<8+jL@}##-`FHy*H;L!(nUea%lTWjw?pOTR
ze}osF8y!wRQwmpE5?2E1?z`XnQFwpK<nV{z{8~!xJ5_fFgu`?Gj%R=Tv6Q<55;EIK
z(TV$s&9>Om!q!-0&9IFWyUt%nr2USO68TFhV{g0VMpLr+JN)rZocMaU_Ub=}52n5!
zPLYC^IRLQh?t7|@9xpzQ3V;6nZ^KM&aGZbfrD}IQJ$iDDe7xK&>HhM^->DBg77jRQ
zVAx`-eo{C_{595G!xWB5B;8Qvo?0LS-E>XYIhz_gNa_EStn_b}5^=rt)(g9-Z91&8
z?z-Wk?_4T=O$k^2@%Q0{=bsBFpK`kDc~e6<bkN~ag0B(&^2aN}gAd#rjz0c)+l1gH
z;|;&BwHb1c6s61!QHG<4WFEB6I_ri@F8^Nm;KL78_A83^Bj`9FkA_Nl{N&@0g=_xu
zCn;X%s_zd|U+d#2w&~D++ijK3J>hSEy}_(qPdNEhd;gH+!54GCu+5V@Z@VQ?@F$UV
zbCTNChsw_%WH~!=;+wYNft)KA7i-^vhYm6&@Rce*{c@=I>3|Fva@5hb$wQu}s_vf~
zJt};qHbVNZX`>8aqoh=xd4JTg$HzK)?6F)Ots8dRJzq!QIM9A}+-WE4+l0|>H`s6k
zqwhFuUd+;_2e8&!YpZSav<<6!r8EYRXHPyBPi^qLv*hF=De`W*{yI}&50TtrQ?44o
zZzlDIVi%~?p8E7zCtPsxC4qi;?bUyg{Cv~OpH6En@s&IS<=S65PN{q9)_#&v^e-$}
z^UF$KUY3g83{P_aK6aI&%RVeASx<jA3rTGNE?oGnZN9`4bCL?ob6r4iZNdt{0eVE$
z&?e-nsg_2h9jOfhi)59{2IV4s$ZdH6PHe`LGmFdsfev8)g(b@{j=*A=d4Va^D`eVb
zmY25zdR4DY{@I2)-ILR;O<h1$j4MQPY39r;tAA9~TJ@jkLw$fEO;4|u^vOdyo_Cr!
zN!3dS5Yym^5=Lft=I0sn_x{Wk8kj+H4}ilnS297t((&|Y@432S*y(}m0A1oaWBi%-
zj$bi-&lHiGP!A5MO0*L!HIxL31fPCP3>g2rbkXjZeEoFQLbN4ktr*{VTdXpDn@qGZ
zPL-tViH1P6@~M$g-mW?-!j2%jduB=9V861Z%3_=o4;eeX{reYEVQptXCna04sGhH7
zVwC+V#wdZHKCx83uILl=jdEZcDyj%iyBuz{@2o8{z>BVZY)*X;#W22&JFCvC&3hBC
zb2u>Q@FT)YFT7w@h*+*-&5M<x0}2s*#g4f1cC!Qn=Z;%%2^+`?Fa05{SH_PIZz$f!
zvu4V|^I<7z)->O$PKWC^^XG@pKKoP)$R(ycKrvhjo_^wSQ>>v}8!H71J}UvNFUa2`
zvIzY2lTTzx`nsiw6)y^q&p-RzER_vee^C5+c@9-s@pC!;rE%etIkI+r^bz$9aCUL@
z<jRMZrc9n}%8@VRBa?iLxbu#1;J|^J)b~p8unvSi<%S;Co$E^B2B6e_;kmJ<Nd1)b
zq=1n`w&T?af!xivT1=0S74+nHCz*2TrE%kA9leFUg+9s|teOGp1MBFwWD#15A6QDe
z+_y+Y{*dSUq#*j}qmROeQ>U6@n|NtJ0g6R9R<`4$D13dwgrY~ocN(yZ6i;h~5qI5g
z^xk=EVi+@eq!hvjiyYH7e#K$#=bxEE@#}f>tX*JfJ$T4b=4J#-VHB_vUL9|iso9U%
z#jj<f@Dc6YLh+D6M;ITm-o>gMMeg0V-y$pcK~{H@q<r2?7SFDbr5%4HrTf<Xx3vtS
zxcg}ObhGp&Ao8&#%%}Z+s`je|DEPDsBsensm6u-(Z@e}^ma!k1g>$<74?28scwS0%
ztdu{QGdn!?$b&X#;Fx_D2*c78E7VVAz53R~H^P1Q+!<Dr(rt+>t<C>tHd2{qthV>w
zXW#JfgZJ5{59PY+_S?c-<=ue~%uSPm^l4cI)2Fc9f9IXI!oCL_XejH-N}P82smhMk
z@L#nlM0-sG8<I0WnrT5ZXUqt*)V5F*9Vlh?6j{taH)>R%erHH&c<<eJnUy~MC_ny1
zE*~b#R{9Zbj`UDkvLWJt;u~veEbXxt=iQ@{1)NSm(Kvh7EY;6K$$`(*mSz~AJ+5EZ
z?Yo}!S=z?Pr=KzfHjDORaTiL_MZbUV-FNLI!OPY!3;W0<<@H(7p+A|7qm8KSq>qfN
zlxM3WZ8kluGI8P{sUs=2i@^-l;kQzR_=f|x*=AeuVS2#29w5E-<Wn2#>NKz^Hfsh-
z;$_xO(<c=^7T-9nfweC(YtF~B!WLU@nT}p?&*s|cXPu*sjZ4BW{`p@d*FTeW@JPd{
z)Smbl<t)*E;67Q&D_wjWKclu+3aV*;>A2?KTC%{ei9)!dL`+j@-qTLf@->QAj7k<t
z2`5F|;svq>#wwEaABHBH^I~j5r_Oim`Z7{tBFU31l+8*xijI6bMR2llI`uipZ_Izu
zyp+N55h-8bI^R{nzjRm1=0BT1+D#Uxn&;A`V$6;0jkdRN(KqHw0)reHUL27d)c{N9
z3MFssBg&ofVm^fB<^ufy;V6Q8_P~wA>e|fH_k_?9z(`x1Dc9;d;5u-^LvQN_mX8#*
zXw)a3#Z0H(G;gcm09E5ZCbx~yf4UBphD}<eBLQpRX?u8E)AtFvD~5AqqvdY$pqq3;
zw9a%Uz{@^6zT<*J7|;CtJ@LGNgmX_pF>CO+9!?zaxuy%MM+*nfe~t&E+}b#sKJl7R
zR}P5%)PTSQFq$+#LJWvIQQAS~!&|O2O$j?gS_%G8PAjXF!Av}@c{(pTv3!=3#1cYM
zM0Makjyft^x#rPP$+at;m{)JZ`L^8_qA|8616mwQ1smIiiLfG6yf4&gFwW)N(#8UY
z1+E?C)76BoCMY&xFOrpJ(5lG+CaCLgu%X;L+*`na>2mL|{SG@>*ruCqCd=0kOu^wu
zSZ08;@ur)~y~H~f{K+SIw+kpmaIvt4lu@C$cLXO@@`_@@fur@kWTA+hMTU)f_SvxQ
z_S>7K>T0sOaLWtu-*|n3DR^Ib`DL?W>>~?B6gF7O_LY)kb16A+A;E$KSgJ`l%9AW?
zqO!SlpTEOmln;KaFKfJM;t7Ca*@1GS^rGC|r6A$Md|2-dKkal!u}Oci5B8ya#+nj~
zTCC%+h{T!%z{+~s2UD$FV@HoP>)8*L{#W8LP>vslP~y+aQv9Jv$5jQ2Y?Q$Z7JO5H
zjn#D;cs}4Dl)Qzokz5VnCgS)Lh9@sp)5i%Z2R`(&$MzGXA~)0(N6GOioCaJlV4+Pr
z$b(Bhzv{TU+Ux`!kx#?4X&;!sb?9=u{p)#Ohpqbcmm++M>T^T0=EM^5De0xKLY^dr
zXd0ZlU(@fnpCd)D!~FSQhk5g8|Gm`?J~iv(&9~gj+)_9W?GD!kS=dyr8>s8F<<7^m
zJ~E4V=39OWBpa{PGam-T-|q)f_@{xk%oqVscen`{e(Grn%DU^Wmn=@%bUAVODN+z_
zB`f0h%%YPGf>OX(YMbO5<2Kx6<M6tyWGSyH=u~$zwE@9<HaR#=pa*-#H2{5s&6hM#
z7t|ZDp<S1SeWXCeV&4HJJ^XaHG9F&+isJsf3%_IKm^x*ODcw=v76aVgAVc<(ay;8F
z9UsMSIjEFpc!6bEw%qADO4A2_vXs4BZ?lal>ak|WM>`5y`VKBzuz+@#KIyon?$h!X
z9Aqwv>QXRg&c~*-$1)!O#3-{JDz&GLbi!atMp>O!`a2!JR@46ImvR10tWv#HuV|c2
zD9r(}&bi0tr5hR8HD}*N`=ifx9(WEt2id&vK8xeH%iFb@d{%=~&vLaTy=ri)!O7-7
zTc@e_>9%K0QC8~avQpN#-T3Ie);=0%YDqPfN{zR<RFy~jC%L{z_qYr)R}x)uBN;91
zyDna&c{RR=u_l%(EK_8x@aw6pjT>Xor28s&=w)gw<tiQxw)u|==f^V>Q}mELb0v&>
z!u=itSl&6V>p{~r^t#|ZaUF<<-qgd02k@Luhi4BX97xCI-t*zK45^jLutGrq8E|4e
zlQ@|njuYb<a6Hc-S6Ajj&u3iRqqybS-+Njf7aZt9lb@%{J>e*k0iKELxWscHPHqdv
zgPPZda6nu~_yKMi*+sr|qPqfBgM>3OoP~)AB6gF(Cy;1Tih0Ewk<=d#2dxp{^erPL
z60u<NYRK#Y;vyq<n<!+JvqZ6%r`U-6R!tM0vcstCkpIORbnxZq^;9*TRTR;5`d;O2
z=7G4ZiNLaDi=}vyh|6t~w3$qe5$Izm4(NBZ0ap$yOSbUT=jv;u+>Ev|aR3WR<k#HK
zKQAbjO-^$m-FrmWBLxV0-~%5$r07dPvb`0wLlmYJVrjbgjpMj67IOGZoh{$8ZYc-e
zo3Fhl|D%WMgC0G@jspgmG8ko~xsgy=QMO@mniJ--qMIB(lT~CED0e(sT=*tiZd)7|
zqG*`lgR7hp38pxX=|v<IzgP>ycjFl2ieSKQyUFM639{CH-h6w0Gyfa&O&nu|@Vcyo
zchxcfv7<*8SUp$bN4Y9EPX2@Y_3v-Kk!Q@9W{T`yy`mD@)8#AKX`oCjy0XCW?s;F$
zEAX2O4t10VrfZb9NL$Gx#UqtUs7p>^>8}>69(}RrVc9Eu#lp5wX&kXo`cba{N=E!$
z<8vLQ;QLZG<C20tLHI2<-4G*{{Og>}l|}XFrSdoMs+$yaz_btEmql^j;uGu5Pg9#7
zo(%c-#ViV$2+Qm^KYWv9w}o7sJ1IpHDFb}i2IX{C;fVqgUIO&vSs%|dOI|01RWE%E
zK!J)iDL%mWlC?2DpRd2>s#Y#FJZ}1mf|5Lv9%E{Y7NPV#^3!v*9y-CIudl;9{aRY|
z(OuzCe!4|0T1&x^VCeCk3i@pt=vSW<>Bngtzh?ssOXuz6`+LaI$ArU%3<+1tO$$DV
zvw%<EqmLaXpUKagUu1Cb8J>npn;n(%%;r<kIuftEj?(FIKlz<Wc3NR|ZRGS>r;jP>
zaV3E)L?Jx+owu`5ia*0>{!=e`rsr@=w=I<V6XfUk%P+nRXP$ko+@XxoIP#grtJI#@
z==!|Xm_xfL4(ax{w|uA5{%*LI_BSnwU^$Hq#>$htXx?Nv5Ia_3&FV>WLbp)l6ao;}
zYO!z9HWX7mm-zO&_#f3l`ZaN^U8S*Wz)45X-Xk*$AoE!8Zn=5zOd5wu<f<B+5>Z!z
z;B38G3oOa5=>A}tHU^h2!DVB2n?IOQjCet`!j{<)45I#`Yt7h~v?+=*SmRqaDTZ;q
z!WB0}%x(DiqW3v-%VOi9w}JNOm-#F_g`&APG>hu?(_IBA_ym{<EqYA!k2JA#>x9iH
ziFgON{uAL!d=$gk32|&Nk&e^!2EembT`oTKJpI_bi>L4TB3-{Hp3{S7!QdM;TMA7<
zHUXX?lFl53azfmDV&M2anRe#6a@Lu^6>u8h`U;aUr|CGvCl28hhM6{aq~~dnE|5;&
z>Bl$Czm4U9EI|N$$|~xeG|^zZwuKH0kle%q!Kal#A^<C8${STByqe#8%PB#?1gQin
zg|VX?64nJ!A$|dFqaQ4f;=iue5j4Rw>)@oT!ObR==0J`=C{AmrSD$#eFE!gd=pdyq
zbq=^ftxH$htJ;AkA3!|X=VOxvHUF%l9N=g^KG?93Ok38aeMjQwkt5nnWMg}dvK*YZ
z-gvVn&c&r=O;N)(Qr7Wtr>p<`M;kk!vY$Tq<nXbMB7Y{u1j-)VMeso<z^r#wUKBc5
z4?C<QOUNZsZf9YR%8e_5aXLQjfVC?h6vKM15`6Ow*243Z-u&?D_<VXCYv(AT_0!x~
z2(3e8rTa+k$T-jaw(id*fwyF(d9-|&Vr|F=rTCZ}P>CN2fy@o%;Nw*P_uv1gxr5*}
zesnjLaw-iQ>Z5#ENjhw$e5I|TJsb<!0s6?-t8yJ;W4m5pfzAiT@(MF#6F=q%r3EW>
zgas=6=NP`j#<DClmkm-T76;LmteZW1mMqA3unzz_9(-q0V7A%^z{lARms^VN-Mg84
z1oDVdoR8b#_R0OBdi?A)N?A(bcVKv#@?o?)`q_MIcP}PnusX%HK^90CpTj5-oo`sp
zni~?^$XjZbpID)jny1vegf%Cw6U>LK6y0fyQLH#|NdfS&K<X;pPEj<jCS@`}J)msF
zr#C+=Q3uFpY}UuJA!q)eNVa|?cOy*s_+!@Zvh2rQ0AP!D)!R}nh(G&OeOGmd>k8*4
zb?Ja5D@uLbDx~`%zOcXkdY+?|yi!g+qBv3g2{#ygjPA!j|E2m=Kl^}LHsZiT28Bl+
zx?iqRUbR>Kw%$66QuNu%ntM|z&!5Z1#9ERqY+|*lqY_H)$&)9A6ZNsUU8JyPbAj<5
z>uol8upAye@|mLfs&^o1z9F|R!%jRY{PntPjC`f`L?5QU(m;DG1>4d7<cj6lr=AQW
zpL)uCrVrR<H+>XzdSMiAFomJbrwj*dEu%0~KG{{9H8LPzZipp6r(lYK%bKKP7C|zc
z+#HnGtU%Iz!NMX^61y6l1i9#q2qu{;im;pol37$4CJ;;Hts0yXQCEuKB6XT=NCoAL
zZI(9et`Va}F4nkgG<H@4iRs3C>4S^55i4b|<%#buNpY>YHLm^Ge8-PF1{vht`)NTj
z+woxZa(pn0|J=q;J4mjoQJKKffqmh?;yOL4^^VO%)$h??qPGN>aN-k(AK+o!6Gp>H
zU*iIvw~>y==Q*7|@nUDlD}8weAMp3FVdm41Z}ry^J%Gq0KzKT`XWk3wnFZJJh?A!0
z_f89jcxL?_bf5vloHqBo=SP@d!F8Of(=RJWL~vyTTaY=IJF9R^EOI{-2~hyW>PG;Y
zu-4?9ql(-U<~vv{>b#O|HlYfve{qr&#341`RGOBS1!+f3N?^;c1h)?`#Vp4<i_NXl
zRXI%X+isxV+5j2(-wL-GP>}=aR#FkU2m<Y%-B|iU6kQo4+O`t0HkWzTu1DIl2xFOL
zeNQQ1EzE*ATA-<cx3_SuGUx=;*H%c)faQn-D1rF8ynl#o<4rczaqRt)9KQbAt6|}{
z3&Y@{L(MNRvgMFLhnW&*;+wB0c-7uujoc@v{HQig8jqHRn+V!5u(@0^;14zpZ_1((
z*9+@Q!8s{qDaXg%_R=wP+#~=f*}i-E_hqS=_GKC=JvU~wS=;Tg*It$umbk|Z8)iOq
z%N>`GvE$!y&*#$HET7&bm;b=>?|A7+`kHI?wqVMJvNjF4hro5mu;C|%X*%vdPp&C|
zYWR_+<M+r0(#9V#!13^1cWwO<D}1`*4;Nf4Be&J@^cQtRJPRny*a*W<FN!V3%)$C-
z-GKuSNl*t5Ju2m%gDIo`5|rd-%;;ysUVHB+Yu)WE40jrb9)6_!5<i>Zl)4!^dSt*I
z#GbNd?IwjUb$9HrlT>%FB+74;Xt)sBY3Ki+y?2kj?@Q~u&gb_1O=%ObGhmE0v6T`#
z!PdcwEg+W`5eBApT1+XVRH3#uHK8pQyj1`9A1_U8;w9E-(;^@#f*^=Y3pft;5?W!H
zN@B^xKibq_P?`CCKUd$cXYKbs>+G}lIeVY8_dffa&syK_{;b<`ThF>bXYI9rvy8*(
zdI(-)|FSRtoe_^UR11UuTR%2n(4>rAjylQR$3FT~(Wl%_-}~P8t^U<N_HAkhpOJ$_
znA4E7uW$N;-x`M0e?oV)e*N$Jrq!pa`UZ%5ia+-^{zl!I`&nuL&(hOBz4}ZUyxSai
z`SK&lSLq}y<38@UeBcW<`pi#%?4$Z1+2_SQyueVlZ_uevpS=GK`Vr>K)eflBINhYR
z5C-C=d;9iX-Lw2F(eIoW{pi>KhSdkYAnQjTq96TCd@$}&n_o^O#wlSTeMAQ5-|>}S
z6?Y6{*!&uOY>giR?Eb#q2;lVcmwv@p#GS#U^TW?KeA73lQ?82tlExUW!fA7yO#YHD
z{jxZ1PkzjYniv0Wb^mb__eDndU!$u(4EtNZaI;@VM&nP6ajF}C1aP0sQAet$ulky=
zUDweUP)BLpXpoO6KQi#+0rzG9f=&zL(91um4>@8`fM=Uab@VCe=X2V!*J}b#;q6cx
zsXzL|KOFl0z!&`1NZ;3<xObg4%XKC=uB&03!Q~@@!?Zv0IZfAWf80mh94mv+tNfFV
zJW`&9?CN1pV1;O1D1&dD5Y!Ja{3w+SQR##tYsCz)3LCfbqhe~}4fqBu(X}8c+yc@I
zrVa1x(&~z+BoAdO+~&J*O&rpjX>It2!0h7byi@rq&qiD7mV+NQc$@29*PC&jP`m*#
z{w}LqfQ}s26<iU)p#Z)Kz}}B}m20)QQ=ccj;gsH%888gDatwT!sJ-wH7yCkNGZ8C)
z4$uIbc^(uxm;KW`-6Rg-500xnEe2DZGSn{Ztm<eOU$NX#*wm6zp|N1&NQW4{89)PA
z3u#4Jczp29i#XPG1mPiWN8J3OgCh;vIMV!>KlwPvk&iUsUe=SLVz0pQx_UBNs`zN&
zB(AFZs%ClB5l8guDgFAz5#lhoa#xPtCkz9!s-CMQd>V~Y#5kREjK5UzxaMKerGYSL
z>b~RDR??};>+AHoX9(awRe2m;lrQ1=$BCQ#RT-`ih>j3{7bWq+g=y(OF}V&C`$Y!f
zCr!X?X0Ftx@-CSS51ccDSDrJBM-$qVSQv?Y@aAMY?c(a@je40rdZ2beyARkneb%Hh
zG*0KpI|!65$xvDaehv-%xbB|(T3sFRC;!yHq0?#a#tF=y{3{<>ec^BWqF|3P_`lZ4
zuMd6r_pH9~JH9A3kbh67XE_bld=0&iycm-H_9s5R`V-&rZ|XXM|84c(=>t<k-2eWG
zPsFtk-}!I<yYUJ>r|+7lIe%8yMtu42{O95$cRpnakDt_OVNMtROW*RZ#7T@#=|tg=
z>*IBtV#MH?_do6h{l4${uGLq6@atCp{MUS4i1_m#|GCwV{Ll~f7MHtyxia9JzvWw{
zw<j6P{=d~<{_+2@K4BX?D{6dj?!!9q_k}V9GsN&QwWh<+{dK?l!}<u;U#heE=mX%q
zClY>FCsw(4^jrV%AB~TrQO}>$bsE3=*Zk_5HUT~`^)LUSKOEOdaJ>Q_`{Q(N({ZZz
zzxpr#i`DN^JNYvGU~tcg+yC>E`e@zv1t|CW{`TMg#qnXfw0z7d<YPuk$B4=)Sx%#J
zss{H{Kk<?HFk6D?{!86`?|1)&)d%&e|5tzTLjlMK_<r~Y*LP*p)<5~lUyS>w{c%H1
zLUU@kd4F)uDcbMPe|+`r-}$Gbj=ul<zNck`+bj<sw~Kc7hyF-xPC3c?<3IKz@qxLV
zHen1h|M`FNAFsanOTKLN&wSCBgmL(L{+mC)`h(x{N2G_e1pn)Q?PIHd{Qd7=ecQMH
zDP7a?|HQQ%e5|d_F~5B8cm0Lc@75i_-|=t#X&HYWSHJKJe>+YC`yTC2{^BpL{(H5l
z4}R!h5Zs+M(QkFt$|qJoQ{BVN2l2k<>prAD`<)Vy`-uNee9W=Q583HsU;hoiKRy!p
zXaCH97#~)v`_Tu#Hc)>4=RU3v!Tn&GDI{Oafi!ycLE1g~`M?MMDV=ux+_>_EQ{8-=
zkognC@%MfAcdfow{or5w6W<<pUUTIOA4l|f^wa;#|E#;LKddqAx5b+ToJh^xkNyuo
zwEBwQ@s+Eu)YStR#Qy3}f3$u>qKW%sKk_51-$TC?EktbVmpN_1oMug9+;>LZ{DAsE
zE%P7$ldE?bXB#p{9sS;aQFZk1gdu~w*?&fFGVD5hz(@7I^ebc#R(;~QLg9_Zw~zna
z_Sg{s`m?U1Z;X4i|LmXn51du`ZoBw;s(NVvZA7_u{D*$v`_*=SZ^*K*J$*vs=uf`)
zeKD>u?l4C4@j!lnU>y`!oxy>%iq<SY{n3xEzFKcbeA~bN9U%|x@8duFvmpZ?fP@Ag
zrYkO=!kEvJM$oDEROv%f8c%f^IO?}jS^`Zt`MgASTBBBghG)L)<*37bfPG;0(Kv^E
z6u~~$j`%+17>53s=D}_AOOvkY<5SPLJ}?P#4V&|H-s${iyF`+<wn@5=l+oVrANT<T
zqieeUj4|a@&V7OF8=s%GPrrGtf9T>((s$l)SdMRH=nxUMj}Z*F=m?sr+*h%VNCxs#
zY2obou8mRat03H2@ZH%w$dbn5&9+U)4M*G$w85jZlZI>BKY<|+7#{L-eCQg-g9g6w
zfXxR6^HFjVJ_6Yv2m*wUa~K~+q#MSJa%L7#U~#nruqXrz8#HoD8%APi0K>5h!lXeD
zI{0~*Yb8kcqhQd3reT4B9x#9L%fIsXz4@De>*ET(4)?2Wep#JggN^R`V=)k#=w0-{
z=nZ`spsI!1(V`><c@5B#HZ2^&D4Tx8hPGc{!fX|faMEeZU7TrRb}+)_X~a`{+*_A~
zQBq|bBbU=OFEpn!a;kIwU0?Gg*_l|_oO7RTaffTbtw@SIoCvj}Nk0t3UKv!>Qa>2K
z?}fA>bJZ?*RY^Qa;*<y*#PqSbW6IT~5;(Q@p<16^s3m<?4RA`~9eo6hSKPZCCoO3>
zxskOCc3(P+^Ym(;*CqQfHuE{fNZUO`7Wx`@tL7h2bN_=&vu*OxI$q_5-yyDzUmG3f
z98QSDtM3EHnM3qJkLQFWb%8;5mqQ0!FVeLE%W;tf!(;uUt}^+MABOjz_{$&3L8~y5
zbnEsr^g%&Ro*v@3uN32N)ZK_fT(kWq(oF`N<9VNUz$xP2^#0FZ{n(HGaINcq=-2(a
z)gS$1e|+^H{rmskh7p;zf}Ycr3oLbaJ3iV*v*M$WU5<M0Y74X#8<x88NoOo!1KRAH
zJNr?n?j?T6;bVe)G%>zJufF<?f8d)}4{sk<|LyncniLfv$&l{Xy}rF(-M{;`RUGP`
zHrwUU2gbxUm*X;DBm1xDRPGShY$M?EsxWtOck%60M?+-jg6*oKR`|wRr4^<lvDu#T
zv6cS7)ioYhswU7uDUDUl_7~%}F#3#3orKRh!wN-t3P)8bj6UKp0P8yr*vPQN7RdVI
z@Jl4Ll)Y&%OS+BPsh~Bk9nmIQSiX`Z*21o^p+!djo+C}ibqLM&b#}r5cNa`^4QAM!
z=TLd4hL>#o-?L7N9ewqYciJrDufLs<Y9jreTG}Rk%Z*HYXXZw8OzaEg)3rFn#SfgU
zTT<VpE{40n(jVTGy4E$9G5<fjO-AA2<X%0-=YRhDSKt4azMDnEAJD_0RvtPc59!2F
zI|diRG%)g5U=y|>hEB&r9&m(N#6cs6gBE!>V9CRgPMkc_cubGMfIMKlFodtuNh6O3
zJYZ|*Q@c(uagfc7FvvIy2T@?1M>=8B9nP8A2uzxV%XuLOc&2Nim9#P10po%I)5RZp
z!T&YRU9lk0pu)m0wk2p{F-}!jwI<}$@7FpYoL-$z>10y1s=!L_7|a<wuhz|#U;lC!
zgKU-N2IBlpNT+uDkXe+<x<y^*Ahe9Z`GPJ^%{271Mkt}a8gTom7s3bVl#}f*Pa5y_
zL&LRB>DII)MBR3yjgQyzf>PCq;PIqI2G_KZ6d&|a;F0ba#x5GYOWId61@00wfbnjZ
zF_<#$G9(SvLDN_?6hFUfb0{wTAU6hszpMXs8OZwbZR6L5OCS8S44)YInsZwle4ciQ
zJ{TJq4}7vRr`HS*(LtLmzoh$WKl)QY*(6)VktEIc>*eJd^iX3k6m}T|*Bpk2n(a5n
z*=ohWIG>zDu>y-W)@*l8&fNL?TXZ`1eV_f=aZ2~Ie(gV?>kU4z`kO!VH#UsH;F;F5
zeo()akui3A)mY!8OT5bnnZxd?=RWNOTIq@~mg$>r7wx3F^s%|G|NY;%`fDHi*y{h)
z>F3Y=yw8j4E&kkp_MgV)m^qV;GhbjwtLfu-xAEg<a8uuozO2Z;y5FUb9G6Y`P-8H%
zG}{Pi{6Nps<#x%`g>y)HR~@y|YOZy5w6P|BJ*NmK`bhYxw*dPoeLS<TYiob5>%KJ3
z70xP8Rlzz9ed?c7$!NnN8Sdatuc0f&Lr_)V(71NW>%9Rf>w4Iwm$Xjp2fK^TI*%<o
z^lY<O=d43b7~s9t->_e-QR+||tmzr3jdvG}=^6JFJ~DWYG=JpX=lZ}j>6&I6Pv^Di
z&w11O^;)eL8~RFWFLVh$-1hY82mJ_st2vX8Dl?DZ(%%Tq@MmN1r?vN^P7LF?I)anJ
zH@Z`p!)nYu@j-aWeaKiBrK%3xK|kKYW{xCM+@TtvvOEaU!I;o_P%E9uzfhxo;CQfq
zf=8N-#=sMY1`p}(u+T}3BBhxhd<Yv3-#ioy{^n!;mdpI|1qk@Skr%FQG%z82oC$(#
z0;D$uBMk=(bn)#Bi;r?ln|#7Nz?&Cv&>)>OEP=#L*Z77ZAABC@lTO-)fBir9`L}=f
z@BMuRUx&N9uG*ut7D@^uq1Cld2i3xDAJ~ZbF*tg~Q`4=QPBnP3S!O`o^|*xjz?l!c
zHR+xK)9VR-dNApbUm7``!%C6KgiGp^qYD*xtOiDD6RH~)_H1mMj`n&?n{Co-jf**_
z5h+XJmwuH_!|a&tBsjE+Fp3^qDVM~efg?09NB`>~UOtEQ0AD=FFaDkXBj%(1f{r=<
z<lLsBoAc-j_g_<SpC|Wv^U=6}SSN#-BmTx;{a;r<@sa;Yi{P#@K);$d)PB#|acv17
zo8x1K@6$cEd|d7abR9%|WKJg?<Db`oip3R3ta)_sfgd>Q`SZ;6u;@A*pj)pm;<_sB
zLs*v<H(Uc&8*l%GQCDi@<lv*;{^Q|ChG$;`(LGE={}|4FYz*1}PnV$ZYr;5A-Y&cx
zH;2vf^K`;?T`<jb!@p*KUmYx0H>|DbFC3cp_=JC2m)cmI>gUQ&$-_RL1AX2n#{AF5
zagc)!2Y}e)aa{y&g{tg(`_LdJuLk&YKIgM_9n{ZZP~|Q(8&|MZ;_w}IgL0Z-!NoR-
zBhSWJS1fUGeY#k|jf1kOp`<|&eB$6@OfU_?ew>!W+Ga`~k7ZRb8BHTl{mB^+h7iOp
zIAPLF#6E<{GZO{F86MvbnpTQwK_3{?uz?pGV97TR!?|G4aKZ3hc+0G$*XcNEbY0yk
zj1lO327;>URI{mprRGEBcDb!Q4S-u|UC0-Z9w%q0W7RqJo=&2?`YteP&AL6s0%G9g
z9POBeN8s^651rtT52a`rtJ6mnx0P5dh;%I2SBv25V&PaYa0-X~t816El|)G_8n{di
zsO__Oz{RWhDLDJzxUxuG>5FN+m`;Q=zorG$bX@vUPV@YFUELRNH(ZR@E@%bn>!@~P
z4$s9ni(9X?9CFTXnw*IKDc$4UbjCKdb-q&6PGa0<9yxQz2mg3BoXbTyS=FWgRbQ26
zszVRxhz;<q)DT?<XmI@6yokC_r8WT|oZ`<0%M$6(0E)#`b%M@aJt?F8uhH6bOKQ?U
z(k;5GjlZ;EZGU-<oDVSi{?B!btwNR8Hr9==-9yG{<5(KTs(s^C8%&dq>9zS?ux)fV
zWzo9`TLjlS-^v;_VN;SsdM@7m3eu)Oublc(I2Dw~s;B3N)$_gHnAB<9yW2NmfZg97
zCze{3%nFnrhM%6edWkCruXLJOCx;d0jjk|e^WzT%=@?X_t&k^>WDEurWAI@ojVCVk
zxsj*wGdN&>w5<`9la5aszKt)W+lHxNjYB#Q&Zl~z3oh_DXc*VLzyZ#<_~vikPE%IE
z8J0LOZTRHHDcT4${uqg5m_YzX7-xnQgcG^I^O!MVjJm}0bf-~J({R2ErK}C1Nk=I>
zge?O;mh|^jY0$Ak2{%t7E9sRv4GN(!28U{ZI7<ygt8&xYQv#3pd%!L&dqX>_>tqnV
zv{EjpJUb@jeo|6LTHtFK#F)QPfBgs?0VUp?xYDo?8xJUP(n_bSQoCW)D6VMW6>5M^
zL2sP5LvASAtY2R*bjk6@EWPPk&12Fw&C~g{LHKkc%)+_7)|ARzR?Wv4#Qd;njvsb7
zZB=by(hmXYNAoZa&m#E+Gl{O%>|YmL-ieAv^VKgKLH$Z|5QjRRpY;6?jKH!Bq_(QI
z-rfn;Qq58yFxe-_TBLO-Zzp+p4Y3(&!ZhQX(3`Pcu)Fd$sgzio2AcXiq%E}3oimO7
zk9wAjtm*0@y=8K%56@{2bZQrJ#c5vd%I69R&0d`Ht>k-rlrdXJoOjP(%zb|QQ&XhI
zk#rT=Io8#wYh;7J6^L&`E@5nrc1>F(`8?P^!QpY5@rc`z=1xYs4Y)Qk14lY^pb2~v
z-}X}5S_M+uP@8nf3kR{LGvVAvAc&ZW1+k#epa6MqA`T5;cnE_>*l_qRxP9RKkVau$
zXv=H<<QoqkdOVg3I<MNH00slj%cj>4q$X?ZY&7Hkf#7E+{G?i@e#4*`D@r;Ji%EV7
z%=>&2A%UR3WDJ~Cup@{sT~2f!tx$hFz#Mk{t`_<-3O{SOV)9PI7QX0L^%;?g{>0sL
z&ssEa!b&`@tJiM1Ym2<&M2L~6l021ZqGA-XMFS&iAR8am38Jr$%%KmtGzR3{(<Y`5
z?ogPV3%DNFhSC`a9%*=xVj4*p^B}!@Q*}&ftWnF)%#1s>J+;y0m2u4?d<gfrLHn2j
zp9~khVnoBIJ_$$rk*bom_|cWn+Rx`}Fu`M;94=K9sSr$LscCos06+jqL_t)v$Ow9g
zVl<urzN9}co6A%wBBCiT`c0MHgf>?3n;J-ZjPcz4)9p%koTj$Nx?Qa*+8{>Y)Fy*c
zz$(OCH2G4>4642mJ*cau4cjd5^5b14+9mlRIJ@W#$un>FNXK{4FzhavbIXhFqd(Cl
z+%Gx`fsQzElU%zt)ayh`doaB<$zd2ip2~MtxQ57UgVbeBr-Rw($*KRx9m3DdTiPSW
zN6Bw=*D&9i;K~>ov*lOH*pxuxra3Q_JN9%MTiUg-iCSWNHGut*29Y-k!q^_IVhk{Z
zJxCG<58rsUe*$N`Jgnrfe*y;{v>2G7liN8J4VvT|A0EJx<}fsH#DRkb&go%jO-bpm
z8QKSt$AvHh8)m_RFfcgsaTdySU`!r(gpFf*N(u)&&h()RJPPnhWYbVmIA|FUdf?<~
z0rYDBXwXC%XrB;+M8wZdA(q-r?d%FLjlinkq>=PDEiSw63DSa6V0-4#Y2+M8HOWbt
zT<-%3Obni+N;*GO#;V5Rb-)*0)4=u5F?^};raV<KOg}y}@RT;nak5Ga5507oUQg5y
z3&*)-*4=SsD%h_<1MAIzd&>N!4$c|-a~QYB(UJ>2)%a1-$0|4xi|!J@(7D64Wz00|
zTX;5)TH<NL$Gw9`kRLA4LNKfe#7SZOP5-41jJ>Y&G`FHJ))+D8DG>J&lVAc0`ZO`H
z)hasW8)hB5j8Iklbz!y=s;0G_zQ!q`Z4F3Y{IA*<b4yyMV~k2h9om?Vxhu{O@kF}Z
z)VgodC*Dj$wzjk`nU|G*zLGCXkEf9))gFB$`ph07fZo-c>RbUm>3&`2&>IZHcRDRx
z&!yAv$GVCU#%jry#tRw4bZ7_T@Qr>Mx_)yVM(igY;6ZNYD9Rfe(pVGsjg!iFQ;fk~
zDju4Sda+5`h)VMcmCMKe$U~m<iR19W1D1_7J}}_(;IIG?#>PpWc^MuWq>*nNeA4jA
zw@(_*d`X8s>84{}Ny*vp>bQjf&@LwkQJj4km?(_Er_e6A3us};cbbCXZ0se%6%aQ3
z0*3?VjUE?}H0bfb2mZh|`IBZE3chaV1qfQWN|vYBt&j^TeS9E{g=W<|Qax*8P}~z{
zwGK51EnsWWY1k#HC5lv+Ye|wdWns&ihQvzTCcvI}ny_Oa6M?wzTlf0n4x_h+U6!5d
zUB8g)q_EZ*v54@Z<MGL-rc&85w1GiNhNCo7mnayOKScwVrvVoERjC-~r*t)+DVgl0
zZ7FiVG0QFbH4D)llXNYz8LWvr<eVDxr~oGnbvJwzs4RPPRffLZU*r={X;eRJA^Bb;
zDKCYUepA(ufCI}u_%%H^1vLT{-F3W9i`?}e*S#SfUqkE<88?SKgwDF`4Qxf7;^MAT
za;~pEteT+xP$8AVtT!|hZAA)vqV2_1UG!Cq!9pOd+CuARiFjM9OPg5}?E*O>J(n0V
z&G<0V#%^n)reqk$4ckn2K7JpV9RAY6yL8hmt6{CPX8yQwb8Awakh?ns{b&q_ky-!Z
zDnIql=eVwcyL`15i{f>aaSZ0|G|Z8)BE9v?xRH#)elwUuew=Q`D9nSquD%OHc^;KF
zmWtY?e3hv*Iu=^kEOAs7wn`kEcQ;C4Z1?mDEApIgV=r-N0q+g7f`N;jHcvBt4hw&1
zk(P`H3RDhw@}WV#c{@!>$u$kaq(UqgGG}T+CTw^LOdf_?hb<sJG;kIMpLB4LfjD^Z
z<}rQe6F0nq8_EG5IG%U(;0WU=2Qn2W4KS$0FJKx-Sp@0_>Eg~@1L<T-+6G1^hzS9M
zFsBVtH&`$DQ(@CQx>@;#U6eW`A{#c`BIV1Km6VF0d1|k)%b0%U)i2aBB&I$Z8;xF6
z4g*@Z1;&Q-27wnEdO1nu;RK6^^uu_FNQJoB<_@J+@QMarqXwe)Fs@Vh1IC#{bOulN
z-b3(@!-0D~W+2J9(s*v1YJRcw%@e&zFU~zqOU7oy_@YH!D$}^M&Es7Cu2vH!fM`~0
zi1a~8^ytzmKsdaV=sA0%c?LKecW5Ozk~rnn>9+du8m|+l>I3bN?WvhK8)Sh_C&@OF
zw<2p@Y-N=MDL3`G)P|_iXjjq<ZQ+HJhtW6H4%W@A)?2hCDR`~pjykL{#ty*GTXfTI
z#+|<3?<0L5nEjjzL>~>H>y~EM2el^*9J*?hv2P0Q?k|kDJ;mGwCS!130<K+rdeC0%
zS?^0~Uvzt`4{z(lO!U=VbVkq1rAm7=_KE8&B-U3+U=-$x34U}+W4drLY%6`5IvBmM
z3ny6DMLwb1UP>#(*7#PBTO{_!9M*PD53W=U_D|sN^^gud48t%Z-S$wzJfuU@!kE93
zf<HVBM;K>*rs+6z2-h+;4Z>t1q=C#72BcXyd>jlNwxDJLj`M)U83rGEIUmQZB+~(p
zFtS>C_|SmA<uYw0MOqtw@?O0QqwoSQPd}_8s8$@+U0mp)QUwzMb!#_7L$Mf@YOP(<
znA2a&yAGLuGv$<WTBbH1xtg-J!L_Ebc~Azg09|QgpMIH6)DEWE%BVZ>S(_K%Da_)B
z`?PelB{sEF8BMySDLF+0C)NOcvf8Q7)dzc(*w%wlc0;{5UO13yxB05}#FLE4kJYXi
zpE-GWbJQes;nm!ucu9TCd9E2wWwj&v2ZaPl8%oztunMTVXlzF^{GgTQ`g%^S8JMTx
z+ZY=Leuk4T&_p#$YX&Rc&Eygvpn+WHffkAn-FpqrI;yTxDn@q&hugv(z_)-dR0EBE
zh?MKfPcnNj$V<?K$@5D1^cqn8Jn;cH?Z=*E7{1dr5?smT9}G_^Ap891=ll5X%dJi_
zV*qBqNHZhPO^ZW5@uSo!g}oTw_2h}ok%*12l#r1f+a&`%c|5j%l8yt$1{%W9F%8oM
z7Ch2{!GS|Qc2DO+-zSO{tZ4&lJm>&tm-B}nkL3v%805~#_!iK_bHrRg@PPpb-;7L4
zNp+s-l4d0#w0W5ZzLja(RzzM18-|S!-8TND7bgvPaJbT-!7pBQ(>V+6&@9|U+$_&R
z@X3VabrEZV%|N~($UgwGPk`9iK!^!sAMjN9n$6nQO|aW4i)K7edQ*vW5M33(Ei~{4
z2<gowcrVXdh-iqs){lOqW0Z0|A0*cRq{oMc>KADJ`b>q~+({luQ@xf1sVm)iTwKw>
zrE4GzHtNG^e4MKX?$#<&c&yNHEjMjnbg8H1vb)SF7fHM<^zyL}-hP;*PnT5i%r7JA
zHBqikch_{2Mmd|5ao#ViAlm3r1~!A&GCuLjDDL!i7Gj*$pZKsB^KB@ZKRfEDQm|_h
zh1cP(Qs<TJ^+94*_v;!JdWNYJGXjZOmXqbxsaYVh_rPS}C75XdwMpOBUfN4>2t#YN
zFv3t-8N7o+=yM9&;N$xqGsmIq^7o-OHtZ03edHShhOX=R*z}$oeHOWM7@Em;zc%*x
zep7F4&2)UOP{bUQJ2>a2q&#m~;q@MeYb5UDr0tFNLSY!zwVOL;h1m+i>E8z}0&n7a
z3yi|L`&ixG_X;y0#n{7Jp3x?0th0%Csf^rxus`}xsu!fTMUrl3czp8d0KnUhN;>fz
zjzODz*B1E>J01SuknS|-=W#_h=$b|@FSy~F24R3Llz~7*IH%+1!dfXxu2<{e0!N<d
zK-<D97!Eop4j*S>37aoI_X>lHgRYfon(!d(C+Df;;x;s(fdS*rO&Ak%m2W_m$l^7y
zt~<v1xH!JC5E)zqNYcZKJGlm8lc8ZS{qno6>p2ATugo_re6-@dj$faz(tT7q{c^aY
zam`zn!(}a)MFR`hKpC&6s~`_kXEq<6nYh!{-$E(-N2U<3G6bj1x>CGpuVvr<S;Eb-
z1}T9FHIRB!81qzDT>rrxqpXk8`i%Uv9ts0dYvr^iPAGFBT{KWMFt!Hb-fvC}YyX2$
zm=DjTo_*T>o%U+Tl}-t>UrYvK8G~gh!ytV1$UVc4Wov(YqhP?t{)pX@Ft$rh>gF~`
zCIsTZ0mFl{-7>`zE>}$C_D{ollMNl)Q3;a|9p~r#fuk`3m*as$dQ%>7O-I4RC<4_V
z5RKd<;B<UDm_pD!!eJPbM%;x}a3hZJhBx1wHZ;I(79xjn!GSYBeBwd>So@ghT&#Q1
z!X}*(mdemtac83eHWfFz*GQv%$Sf1T4)^N*ApH`U{}Mg4K;S|$PCw*5Z787w;LQ{M
z`^s=iIr|jNs;kR!;6Rj43hTrd!&#c$C-17Y%$f@L;fOIJ?y8o5tIEM1%pF_29_jYi
zM<;2H0++25?W_zs{q$C#POX77Hl>roOKP`qf<Nm=mU9YyHG8YaxG8w;r^&JqhZGY?
zBAxON+URsFmvor^u1$UGkohFujt%o;%tm_N04r{|22}Udc(c6^C)AD+b({6sb||MF
z(-KUh_(L>6)zEj+So#!eAo^6>I1{kdY5XBP4uhpdx>d6E#ZA-4%_Z?T?O*2Gt~obO
z;%a=}1#=4Nx#M-0i<)e}xGcNy#>#8f?|3uZJ_+G$-M9_!!#OTLl{Nj{o@x8jzKScQ
z(tY4>-#)A!9`%)#+xN&YjHyXZN=(CgQ@bg9s=tXRZz}L%IqnhGJ}piPSN`>Fyz%)c
zqwwP+--Ma3wx=rd3F+p_qX84A!g)MN(7<UFzS6-B!ujA}qvYOT@`#(ReP|f3neTLW
zAmTjG$AQa39N%!nfrB3W4X<EwRZDg>kj)(5gb16d84!mkFodCH2BeYKbWS%7d>$O|
zgrS84*0fzP%V0XW{CSxCaH+F6R{UH8X#!fmUYO^V@bWd_&VZ!p?lQXRYjbGfvdbM4
zy^6^FRr$TbbJaAzK#O@8g~Kqc*ORoWSUo=LuH(6cD13?riUx`XY7Kbgx$LpOE^Y}F
z4HOMbqJc0rR>MiU8cU~tb!`^LBMw;9>&rz9HO=*|$H7TdQ-~G~OrU`?Z?hT)u${c<
z#O?FbySiUkr-gMYH{POLz>bJ9>>&<^rTrq~+pWF@bFH^M*+V{t+!(eOF`!M*z9uDU
z+a-+{n<GYF9O2yl8HtTQwo5|8u!N}y?4Pa>;CMXP1522v$=`I~?`tZ+1+L4P2KnX@
zun@@|#BJm?K?_FQ`4F+t;8PG6hPatHoj4CyKj1?L-h`oRTnfaO`k-xC!oZrpua5x7
zvgLe~yuqJ%acvr4P?HAr+fw`@o_+zNN|x@ZZuf(>-yN1N|MBwGzligThw72nS*Xca
z+#XLp{o)=JSrm^za3T^EpEEQu04z|@T6OWuREjmfUDQi8+L%1+L_e=A@;Xqw1~gMw
zg$;`gS{NrEVu5k<Mpw?<tsbh4QyPkUl|=YaTTs(8Qz80^R-lRoc4~kjMk8Xh+Ofvk
zoeYO&YMcqVB<PqYTie8N&#lL}HlWGVkiwFf86(wLPWoh+k_&x~T3E}yO_Vl<V{RMn
zG*4)K6vM2AA5P@eW2FA0dZ14oR1dFSg$q(Z)t_P=hFGdmbuEk{>13VOH<j^sW8AFP
zl<^IVL%L#b4M5xsJbqOJPb-aGd94U_qPf%wGX$o3TOsDUx=v>($b>BFvdl1dH;a+C
ziS5~_2|ZT4*@odfANPYxA!TucaB|N&b^BHypVMjF+v<MdIQi}TgSi}s7+2fyhUa7K
z*={5o-xYZCMn+;8u%C2N_)*ti#5EGt7#9QLaa>;mHWf?5#a5Y&E~(Mx4HuYZV<rvT
zC3rl<{Se3D+x}_;acsMl4y;cc!yf~fdA9L#nqj~PkGN?n7-=@9g`t(i+>vR-CK2K|
z2wHH`U;>^Ck>lt20two{0dK1|@a9E2igQ7L#hItWz~C$sco>s$(8FE1t*2=D+tdJy
zA5H+q$-lCBXsT!7aX0;m#EhOBe<oru5?P7J=GOzpNK_{v<N7*O($rTOI{9$G+#f0l
zqp-#c7WX$SdbAL~(J#+@*dYBNF;r#f!8#d=Ti}ZZPN9J`(9HRf$04P3Z$iGge#wL9
zp(EOmvbDpy#Lk^U67v|B_B2${18r1~8CW&NAEW`-c2VOXwJi!b*$Sz_WB_Kr!}SkQ
zw+a)t0XTkyiGvkgMVPuJK;Ny-GPLn*OEdg({VAlLg663-=(03hz^UY!p07)6PG?l|
zTJ$6{KP)|9V3jT9PR7?;UFSIW{>)mm@3AfJK9-ogUCIgJIE1}bRNGP4?G2<j!3!aH
zDOM;NAh;Fx;tqx47TjG*ad#^YMT=X3&;Z5VH57+prFaj|^M3Dlac<67*Z-UBF?RNv
zYyRdM`x=r&Fzpui0=e~V{U-K&V(7<4DeB6r^EKjn@ej}OX8sqpuS<|v7Bfw-410z`
zX`%Ywr01r5E0^4SI%MnsULbP6bDn5*hcka$CTY;Ni@imKf+j*Jpt%jjjdBKC<+7ps
zZf4e^L#RKZ2V4yEiX8On3GQsgVw%$A+HR*<nGC^F$X?*QT&P4Ppt^|>`7_IUdo*Td
zme5i|vvrpvMLBg2&cg~!5&B7LEc$la?>xEifHZ-NnXE2DBn9>0Duc;cWow$yQG(>&
z!E3R!rEE?*8)e|0X}Ku%pB_aufzXpkRwK^Vmk?WsdV&Vn3yefU@S-%EjZzX8h~s=d
z2*RC44T_aWFJt5fS0S3_V+cmOme3NfJ*Iu~wJ91kZBCV3V%iGSw=7cM-n$uC;0<tY
zlGvNADScqsReP=Bd{^$r=kx9JYeat=+6Xc0DU8QgV^8l?%xa*)f2NsWO++MiVk;AV
zvokqwnm><MAXQt2XHB9@>2PQtFSvTQw0#mg{K#Yt>TsqV6w#oF(#d&!9$$qZ7K7e?
zslLk3cPG}3`q)+_DGVuUN~?*RZnLGq@xcw{cMqt62MLYBNfzXX<g8S2o_9x3<3ESv
z>C{8_#96TaY!<%}=byYAs3Yk5kTR-<&dkX69AOJ@QAP3}knDwIoS!=iYuBd_x+YqK
z%26??JL9TaxEHc82ISQJu|jvC=AbPj5HI>V`nS!pUr@2}pFa;!j|R~_BsV_>-arT4
zXnNgz7axMzoDwjgkL2a~LgerKuu_lp`FiX8%!z8r+EU(v%w|}!^i&T+yPoj6`(N`J
z^TSDSy&VqL2JsVl=g@P&s_k6u<(<{>FKw~J?&1i@ZMlg|o91%RIak?YvxL68Ib%(s
z8A4oiz==ggV5>WaPkS5&u_R#YX+5C{Z>$L)=*cwG`w|VFw=!OR_@lxfR%wP<0j;ve
zW$e{BLW7B^;>{|14#?Ehr)L#3Z7VT&MIz`5O)w2(wo4Ot!(lHlC7O2p_8`|U*g~c4
zlrD!Dy~B2K<3$$#?g_imW)KcVJWJ8tK$e34JM(fmps^KF8DhxEUuGR7h41J{>oyJ>
zNB)IrU7Ow0;rTJ>!xu3{hq)fU9#J^edUWTX{uUjJ-tySkk$VR0EeTc2Be?M{`vfVb
zucE9=HOIM~s;IuwbViPfF1PJCfLU7<@LKU!D?UYW`LyT?#X6??Z{w3#!yj4{83?Qm
z%H*<v!@KD04?yWv^L_Y6BjFx>JcEO`je|#RnItHjYEmkbD;7q`ND#WSMMz~tgG5b$
z&AazqN@w3bOY62h9HEezS9zFGzunC~!3my>C>oOfzCmcbykjXJjzXXD0Y})Pc|wYG
zH$ODgbJ)+W#RAvt(~Q~gdyi{awQKAbuCBMSdh0uPj-;*eK|fn-hs~*w(xC?4BBlpD
z@;JuEx2`PRJ*&m4>P~+ch;g2W0=0Qt7OTU0c^T|nEkk>RhFOe7Hk-;2LIj4T_I*Le
zZ=klq5PUK5+0sq|j2A4wHYvd7@tK^CeH*=xVLL?~0U7WlajjK?v>)Px=>Y3xR6W$~
zzGzFPFiqo@{8jwpZQeMkCma8lD;FjHsUKu54Rqy0NG2mZoJjh*U!62@sNP=)oJUGJ
zKmSJ?ZsvNb3yy<W54)y3kFG_f+p`@xoY!XR1u*YB+vGb8B>Gwl6W5ZvV)luA3;;a4
z`{K;b1qHvG1$^UY+E%%bJDXC5nm6UnC_lYP2R%=ypjxT1y|4;7Okb#Fq(&xO>;R1I
zxLf71?SDt9_q;-|xW^%?X>1C1oB%yesEC33JZq8(3<+E<nr5&vbMM-uUQ|rHCNtF@
zN)^f=IOY6RFZ0CsZ3(@aaX0@EcoJm*HM9^{0^F}bh_wwMz&o&#7s3a@bJS93V0gV{
zb3Zni1B)!S`sne2{`p26Hfd}OCE?w*hgauw3P21z!Wqu|YsEQ|;KRZ8+tS6-ClBk`
zKd89ojI$WgSvcKdL>V`&4K?P84Zy<Z(Ui91x3UF5U8HEJ7Xd$J*z8>ena?aOK)3o*
zs(w1m+|IjHTy(vhbJgU$LGZDyxO`lo|5M;(?aqg-#Ai7;@Qv#<*Ql|<u*P!7fcEmT
z+j#0lZF`#fRPPP=?8Y!b82JtQc{|;RH!kMN_V4dv92c&}g%>8tG|D!BsXJxqi*rV0
z3)(%Hi}6*i@X2D2#w795q{OTQA3-P30VQ<^0#?T?N^qI@_@V+!G`HU`aEmm59;_j_
za$MXxV8HmN(eV?v=4K!AJhFbU5P3VQ5n7hIUuSU0_f64X7U&Qsz&p0(C{sf1>E6nJ
z2AJszT1;?S^QNAU+|s{1TeG2@J87ELt!mE|+SWRq=~l(PL=~Wj{Cx#$g^IwV&6}Xk
zb^HSEY3sR@3D(4boQbqrnyyX@+Cfx?+Qhc$#h)NHlziRaQkXj7&)h{z<2mDTAFZSL
zzt>}8aoPShguAf(P;UK1Ynq#0fb`<?-eq?t@)1c8Xr$O|^ViLo>Rbs0p2R4%JfYWj
zOzaGDy3!H|?m>&yR`g{sCUE9QTMPqGtRyERR70ZRice)a<oU7TwJeOIZnNWp`qnL;
zz#rBL>7^@r;8IW1?&VO)W9Q`C_xNVjA5GxPZC00JokEa)>QJMMuKsAYoGohm;m3-I
z=TF;0-m8N;f4+1;KX(J~*YU-mrNmMh{cS($n3$`EP^GzB3jUN=7qeiqC#~<oeOw}4
zmazm=f~L|0rLrc{f>8otp|A>!)%@`<t+WP16z7xW?zSF{`8CuSWOyK<xw7Zjdg|V!
zS6D3(g%sRhn4iMf+aH+8$_egk|7<7EE|*i)VVCJ!QwHqvvA$xfUO8gzG(B4<3r-m4
z_FP*V?(%>K^nfDXy68kwgf)20KK3mV&13pG={T<&Da}(FbDy(>@gvN$7WFp9SyrU<
z&A&BCQ!i3)%t>c53!M4BqNAo{9LF?MfG<5|F*Uxx1m@0AG2sW5BjFpg6}&;yTX~lP
z@h2sbu#R4m1}w`U<$+)<IVkxHP_Fs8WAu33w=zkwo0}4PD9nGGWmwTg$Q{dq3L`#r
zQF0J6%#i#1@hxTDjUR+Ch68BOg*J}DRc>yZVDrstrosjCRYp*SP8UYZtMG%`b}HgR
z7imQdW#T0rcxN8L=lwUtwlJ2g#wX{CWk~?%c%^Dmm6Lr|Y;%(dl%+1xo-{mx;;g;(
zh%!<$QnfjaV-w@FL4ypx3qLLJQO5@)zN3e7?n``n*ukMPa49~XrLdaoflUsK{SpE)
z-0zH?a`Wf{yq4p?)6djeJ;yJc!Tj;)^MT**or1-b??F4J|J2fYYN?P>Qw8}OD#xXx
zPfet5Y~Lr*Ce+#8e<o(dDT51|vXki1!d}!aZKurdO$QjL)eI8e_!?oKH;Nk{Pz=Ry
z8ZkCvanrJU_cZ2i8IC)|btS0{aE&jb+h_7#ibfe8`zyOHr}nJuLoS789q~T|txVj;
zuS59N7?#8oHoKQrlgloe2D$Lc6FSa$Jin4#$h0KfY26yp_VE!VGz1~-aC=nT{_~s(
z>PR!c5sQWAx{6g+XjT@I8@Jv~q7czI#NOB@D|*T^p=`H^C#!*BGy-;DR`ZKs7>E{n
z(cmW}T8=3~z@=ie;;@E|$2Mtzfdof(0U6j}JY&I7d9qk&ES_|(NWr29L5nkeFlM|I
z$vCww6i3;_>56gf;RMcBj=3)OG|B1|i~*X}`((b#T5D5iv*`~BMop*1u61^&)p9cz
zfpI@@lXEXD7WqXqFQ0>wYZGno|B>Ko4Us>0#{XOF?*Rwdtd4}ukj)&d1U27g1ACB6
z)4j!tp3#)VbM@ZZZyMCO+~J$onzsdc>lu%XyL$OiA{H1^3E}kv$s$6eAPjSg+TTqX
zopYE2v^0#D-44=5yc%mWJuix^Q|PbjTEw?4f(H1b;iu6=pn~X;Yc=#EZ$i2vSI}bc
zUU(gICl$g|tvrjrzGQ3V*%D)W109iByjWxgTIaAIY$=bz?g;@PiA)I5n32AR*iUXz
zwn%@ozQJ}v9Ws~A!~%HY?@;=%xSnvJJy=I7C1`RaD2vDmCd#)-LMYltj<U<I(mVs<
zn2{MA!u!KHAryD}MJt~qmsob>AiU2hfYR!oe0I%yJnkMzdXCY5Anku#Jk-ZR`u7!3
zG9NWP1TVwVoxOA}h*8{nK<hIkd!FJ*BA0aj(U&bi@>(%Ps9w?y$m7dWPD`7n>1TNk
zugo`m>s{M)W?nof^{P)6TQ;MZkR8kd-Y*Z?kD5!6eaPf39r5!U9O7rZ|LhqXu6=WJ
z!SooNivvOUvL3K>znvCrTQIm#*b*wj-`^FF>yGWR5nAvEzDHxQrJL)#`WiU!eY=H^
zP$=2%D{Ul|>SY6&x3@o~Gf_kcDj$w$Q`^%w6&DG`t7HVzBs2Dc<!IVdf7qob<i~sv
zuv3+S`11##B$O=OQ$Oz9xWp=>QZo@X`IvPE0~gM}+=nrmB`4)J*W+^7E~2ab4YBIy
zn%UkTOJDAJ#g|Q~Qj<^ln)E=7DrIB{l?D$kuuNN;FdmY->DDILZ<|{v>rwKlRpld<
zDsx1;>5WirN85bhg~mnl1Ybnzd8&t4lnGdbr8Z7kL7(+GiyMmHSvHrv!mZ%OfIbh+
zcNhXhik#KkCd-QTTvAWmuI%E7nUB~!rDKAjE=A7kC36_7pY{_X=<^wbHimZe&9F!&
zE**9l*J8O3(Ev0(m!x<-C4C#{Tq-l@@%69(gGI&R^C5<(<93OyZC|_Iya$84fQ=7d
zn1|8$OEFgG%6GWIj$R7@>|KW0kk=pH8Ptz|`6P_V;m$%{<-mzm$<7bDoayeT8{PYW
zNA!;}kIV|My^rN9i9}brd*9K;EvXUoB`~%ygh38T^g1);9iJ0|$Bn(`i%+A{h49bK
z51y78JLizirPhir!}5nu&K7`;PI=RY?`qxZv=O*)g;I&YLmKUjTDq78#oTxKRBbQo
zLwOr6&pH)dX{O0p@9ld3<hE}2w2=e6A|nQa|5Zc*c#ku-QB<_b?5|!lGl;s{yb18;
zSo0c<-dda(?(n?y@AjP~AXH0OJ$Smx#)G$rFLNj`P95fsmr>p`Bj)`?2i)MCXT8Z*
z*8Y?>eOrB53Gm)smr209OZb+WP^5Y8L5_eJq=o8Jdl<`5;OGF%3>(SLrED(ILD4^I
z{vbjta>2d0Tv2USqEB-PK(y^ziwz8iiF*$W12FGOPTHE^xBu|4mk2`z%sP64n<;Nx
z-E7pM;N{^wJo|=vgkHs+dGD^$h!Ih+VR)=xYU**W!t^56aY(_N6><06_mLJqcO}(<
zua^7C-ZHr@N0|Kf*>0*oeOWfj@t5p@6uW8SCQY#WjYq(b=#Ot-SDB_uUt?^@{ArDJ
zU^IYC$^n|p5ie!i_3sU7w+zfaKz3tNUEOjU6^g%mHxKccCTFym=+F!bp8nAdN#`!m
zdXD*+8hlw}_IFBRwABt}w86T8_(-#Yo(n`!MMEu=_@+uAoa>Ft%XdcB+JBP3WMp5>
z-?ZWje)Qk4Se;92&Dcf#3ulB<%{)ZiiO#!S;?5NlzLjcz{f7>M7w)OUH^sND(=T+S
zEWN_K`K?C~mbF}U4h1F%tJU5Ag}wiy%MhRy$wJ}#R}c@bcARxpOd)HoN;+ut>Y-$T
z|KzmT*E<lLK0_1FopMfD%w=!z)2*Bj`KNjPVKy+H_VxjG-wyHf9**yKKksrGc#_XP
zNr33Zc9*oDe~4*<kwK#xf`np;FuiB!Pq9BkXf9T6*xJW2pHGZHHC`?gVcA(3I-Ha!
zoY^tAMKYLGe>ps|H6*|;hTi8TB$fbM6;`L>$)rJVP)2CK2gOsjCdW#5%mhbpen#xc
zJlhK9P-2XLXbqJr#qgq3oOK(p{7T&Z+N@d^6S60erbaY7`CZFwaitXsy@2&^bBw}q
zv}HMg$jUg?nh1q}8x3X{v~=WI$!#I#4?G|7D&-@q7T{4WM~}1=wq?sKeS@2_P=@+f
znt;bzJut>@YC>X%;oTM1KG7A{`w)XE!)b*r!r@;cE&k|11sJQz+w-*xRi40C4Lyky
z(0(uZw!<SqRn$SxuO?S{$}+Vqe+>!z<9}E0GyYPFrrhRKXyMRTee3dV%dshnqiBMy
zyK?(7e<tUpr;%~ya@SnE#$vAF&csC`Zq5k&v0Lm%f7Dvl?|LjN%m}hCNT!B_OI!1w
z#LjtkoL<!cvDG;LfH)1k1WUOmTraH%+T(<_Rjydk<e5G#W_}g60d0A)12I7dgUKQD
zUI0E#OVArVIEY|F1x&S{Qyu_E!+h(1qaTRAfLM6G*pf!+$k8&bR?n=^VqpqyV%}uQ
z?rb}8{Rj^sXfF~F<t!)U5{M^P#Epgw_6m%r%=)Dk1S}l5swSLs;ozvd!~GigGMd<_
zgO|Ph`RA7=V>g#bMf>0j2~qio_j%5(!N%!`FNtTAP!JQFo7-hNi{Dy}lqcX!WzZ`b
zpLrMPLmAPn-!=7W`<IOL-<Le43vuJl*1TccI5FSmC1RQ93LD&{>kHrW{~8_PYRMei
z>a>5L&iTzGsssa{<}}8V#I$oG7GV1?-$+C1pQ10D3~%Up2%<b#i~oi<pur`+!1L)<
zV-HRWp?qa&+M$%=dp5Dgv2fq-bsOJ)7}aSfq+6qe?COc2GzXIbEy0uW&ug`qopL9=
zw%-MYdF+WD>0QUR9=s^LyXtWYVE>kXlbR>ZMQ^A^)%#&$U|rsV6|un8i&$A!am1$+
zLSw=7(VO08&PwjPJ3Qo21)7eqJPb7l-_dhX>nJIczo&-tB|6_}W`4PeKCIbRCS9ag
zfMZ5-9pGD_Fiq6AgrQ+7XFKp;Dzq}t0vcv|;S}T>O}XhaklI^h4w?JmOdC<<6H4$T
zl*CPve%}JILo`S+j<&s$i7QGQ!*pyhJubkBL<1PxTqK@C#bhn1d^Uv$M1)=ZFBWZo
z&{m;(ppg2Tcwr0V^i4`}Qi=&Fh{-Fg?pl67CjMG_8R|8(UBb~pO4Om3BFv&S(%Y6P
zkQbY6o{23i!LxrGmd={NoAK&Eq0v6<dgxtk(dDiId>@1}O5qV62DFH#F=6P|2vecO
zR2GLsXtaeGW>hAbe31b>&(9Lb&A9{#Dv!7awmb0RO;aa^b|e!&?v%FKEm6^Ccc=2?
z$q9Z~|Bx@e>SmnzN6X`i2GPP&F7~ma8Qsl?2g82PrL+~-%^-jFvMCx4`p|K-^#TpZ
z@_YXI)c!&W_wOLN1iQ<}#fP04yYGn>ULv^<r++Glm#0?ZWN0QVpUA(-N3FHXfF;z`
zT5hVuSc1}F`WU;Ko$ikWUbyA=5f-Mpc~(91A+)<8a%-HqctazVF~}>j02W6B&4>>R
zmRs_umr`h-9;adySH!u?LlT~8>(TQs2RgQ86nJT}xm;p5VoNauK;#=xJoG_@wg(@+
za23o@=SjzBoPrAb6de0aohdxn%Bt@Z!`C!x<kz&|1YV$-<38gU1PBm=mcTc3rFths
zHlx3>PeLAtSf1h9U|C(EAb-#oCp64SRu(z?Uh2v4)lF(~-GB9b6yGJv(0ld9cy<!s
z*DRD7okgRLqwH0<{ITYD&;`pPO{#6QDnFKfpLzKPuOF<mxIYm7N<8qRZ1y4i#SDxy
z^;vW;K}Doixv8uTGO-q6_T#Ry*Zq+hqY|!<k<AtQT0x`a^w#LR`bQKK%4EV#c0;4@
z7aTM{ft&q@5<j*^4V{90rm6eHD0Z0yd@Ap`_5m|X@$pipC145~O)u%R)&D5To7Y|%
zZXJV$_cIkvgxXgQ#spGE08Q|<oPWZv+gqK#xJS}!u<!NeOjPBgUk+jzG25k>9tpi`
z5=Ki&;JSCGvnPj)Vodp`WU`*9G~FF`pSgVet0`pA_+?t^KpwC~S_NK+SVCNLc!TM(
zlcLbg=AzgEgi!|kQZYYZ1v(rRe;)lj3vQ+A6~q@AhxzB;mS;XadtnH9-GZaT9JZ7b
zp~~L51T?T0efn5%J^J1h499)5RX$^M1}CEt3%&BNsN*vThtIe!R|KbBSFskei#g$Z
z^={Dt$(bpd61b2Wc&ZgYM&p<*$aH!*j4qs}E_Y$<Y^H)`Q3pQ>{3%EDAl@U(E}e_2
zY6*AAaudLlUJ$!=?P~9D{&|T0N%hTKw8H1f)ak|EnyZEkHkI{1oa21!5MsBFFE~_R
zT!PcKU!TYD1m1D=mG#Cmj@s_L(Tc$+n+rzZ=AB`+HY66LAAx3z6Fw6njbr012u}*P
z#7@OFQ28|)Gve9b5@hsR*gkdayhC$N`ejsQvbsPJVCw)xQPY}R?2OPNW|~5IJLD`@
zT1~pz!E7!-Ib|bz2k%Zw{e7+xX(mQo9VEm+b?J@8s|3>*kL~-^Ly*_?+mA9=>xjr4
z&q@8NExV#%ctgXz`>e4emPUY_<CK1TDss))=G@KMYBg%L9G_L1QZ=^Kg2d5cmM!jm
zna|>VzKM-+Fbi0`!#upZ8~GVyO4q=yasCh=jlt?i{tEk??)2cvpX<uns(!sV2QRPR
zL-M&|EI*_6{Hs9RWST1Uqja|WJR+(23TT~7FS>%YxTs(k&*n#Ctv-2PYBfli1(F+D
zM!DAXS$OTC$QnA0XWx^KdsoXn9SoTGsP3{thgV31%CE`32;J_@<mMtpp~WbnjDm=7
zuG}bt|A$7m-cpWopEi<zHeH~jjl*^Tn3?1Wzj4R~A~B?@EeNy2B6G;3OcOinx7n+$
zsxSf%gyvt<Fh|VE)P5wjLMxbI42w?v8uw9|<!r(1@#3tWn|_p4b4we-6@`(RHtyzK
zi9kfBK?pLUabai|po0&^rexjBlTTvldn-r9mUF?sT0bvtT42=*+>V*%|E;tzeNw<2
z;?7Kvv?xec44mo(frnPA{*GEqQm0_>Tqlmn9H0u7xjQyxMmoE{_f(cU&qTs|-xLHG
z=8nd>cAi<d9xKJn^i%myCWIy*Tt|vBmS>$a)?M}bZykj<%^Ydw1Y}KMldouV53JjC
zveb-S%e_GbQF;#p#{UODO*mIp(l@+TGYiIy#Ox3hb60Td2_@pEsUM02q<fz@lz5=M
z!wXL+=2B(AHy;d%Dvayrk^-^)EDxd<_$tvaIf$|ERaI}>hiU!sdDi%tsMc}2^N@tx
z4Gr2aKK>>sbWwBqsWLD=JMQ;ZtPPnH4<rH?ri|w6f43v0*sKu?6)j2%=~-d7epvol
z!JU+1H&f<|`DlD`A|Wi9zO1lscVAK;v1PJ#wUq%0NuiNN2Pp4<3vQcc{YXs|F9Yzn
z-yO@D3nRm4XJ7SWCM`<j0B33g&UG-U;NAjkN5z>wMmtny#*xJ=r?S_C;{QOKAImdZ
zI)51%aO5=TEEr*F7X29ef?BKCpLe2Q&X;zREJ7PL*Y$9{)@s0OW2lp6pIru-KQLVu
z3<wn}R6}-L1E>S!K+?WS{_pItq=wwL#b>m(qj5c6-17%O1}7PYIMJKi3%-0B6J5}1
z+%>lRC-S>zNtCm0V?1Oz@UvzbZint&2>Z20hn(?W<`--kf7OS3)gUCL%yB;mge1bI
z_?|s8Dz>t)P=Oy-cb&UKD=q{R1k3Z?;pUmX?cKj-U3hQ?S*@2+7X7Luc!zZxuz%4S
z03-p7_mbY=*ZfNU4r$LS2iXCJl2EMZZQ@3FcinU_Z<no96vVp|<woQziiY5JGttRp
zb34~cWM7aIg)UVXWpoy84=ph=ENP3*NmAYmY8}}}CI{}9N~yPPlPHTJFs7>aoMfUF
zF=Nm1$rir~_Q~(;j^2|IV#3a6GmZ34DrJv&1NII87n-`o0pJG@%n>u9T6Yl1hwQ*o
zV_saUpj<>s?@@Ky`|U3w|EV6ZJVw*v=3g0B7a4#br1vR0PGqkgn&uf4#A)G@owj85
zQuo<J^q=C&z-W<MlRH`S)<j~!>+w&PxWqEv8T)5)-k>JkB4x#y8e6Zl$<-DJgx>m7
z>zcW5adL{fCp=EeY8@vy<T_>yJl*IJ;G6vioLjCRIl)pcY_X6Ei*om;at|I%vI;z-
zcYy8*Zg`*Z2i+t(1y0rjo;9@oXIrfxaWFJfauOeuFS3S~jPH;_6cI)aee$NN$HHVc
z_n(1uC8J?b?O(K^Jhw45bo+(=@MPUp5V&5_8_ysD(Fgv7sMArECSZ8%;G|V{tNi33
zJO5o+=e@6%LGYyGh0nJplye>;D64Wzl2}T{uTnZ)sEFuVwTkU_j}J-M@ho%16fHA8
zjGZbUf>^c5{-j&roE#GN1K)?9AIlZj4vk*zRujUd1pw*QS5KywpIS?QTtTM|sDt68
z`LN)8!#(d6`THl{{79lIBb*8NBjL)|?UO*;ozNkkZd@hn`zO`PkbUM+%jw(s4l6}O
zn5{04;`mL7-jw%R22gB+TK?O)S(PD{UB^sZz<Tno(aQ8|X?z~3MGHU5%9JNF%{yPi
zv@13H!wCzUAe@mXO9#8uls|tDsCl&9<_{v4*idDcj@Yug4Bk0WIve!1c&l@22sF6N
z#+?X7P^u0U<waRjm-OBIEOv(PyNt2!QDkczv&{wO7u*Izor_$5L<CU8(AL2-$0+x8
zbZCtoSj)4x6gKdN9qJr-zb*%2(<M;W#B~ldgoP?CLV_b|<NAANl;ts>mA+~3-e2e8
zk!n=l@HcuhQIWrxHX4)gyO*Djlnl+1m&u_o&*{~*F`Yk+FdVr;-=<r;d8uc%*(=9^
zL{aMTNgPLphN<NT?B|q){)j6@4UG6KiKt_Wm1&!#s6gfWdlf{tP7ykjl5w1U!A<;j
zT07KWy#-s-w(In=WI<A2t0eBIDWU=DVh$fYdUv3EYPo5aXf0t{RzzJH!v=;*08WGA
z#uiXht>lL9zh-fIE`AFpKPhjxz{{DISy24ua?0TNSdQ)Y)7zi)6C%~~${Y_tmz%4^
zogS`f$55UZHJIET7C(4h<KW(rrbql4gRD5DWmnKMLHuj|Na8lvQo>->QADs-()#|W
z`xiR#chAx@l>4jb>Pe01xVTAV80%~!Y)@nX;A#K@z;MJx&$-`s`}F^bh`Bj8w^pb`
zU7>ZfFL_m!T?zcwl9lX4$rS!yjts+WUkcZo3KE-xM71{Zzr;kC`x}i%{g)z(*y2Nr
z6PJBO(NEa>OBqX((17Ypge;j$)_B{eV}_*yciVse*9}>=duqRQCT3KE%%i9_NN6)r
z71XY**0-?raAd+#>1OVl$+4Z`eEQf$_UGGjz$BFmBuaPT^_QJr6Cz-jf5-u&t3IE_
zcm!kK^~|q-V5vIOY0hUuXQVO8&9@5ksouI{0d^Y5yo)JWOrhIs<%rJ1myj}y3!e@e
z;cN+|gz6w)9hGvrLGrdTaj^sZ&%5&1XBvYZ6yJJXuJE(6hYwz;^KAM=uZJ&@)Gd5^
z<7~1cYQuPs1@v|#d}EqC-TpWEHoaXpho$BZEiLV|eYbB|g^Ac-$BCsjm+%$?b%L2C
zbG^661gg_EW@~Y^IWrljX3e>5ukr@|P<&kclxttvvSTvw@n;p~8QJ0hHvdU)neoI?
zvz*`402<RpeVOwNKSmo<lahM5HN;~$zpC#Vk&CToyK&3Ha5VD`ufB>Ce{mp(2Gu}w
zl*k%eQ+z0oW{j6UW5;~FJ&^f2Kuyhv5jB=?QhP;1>tB}4lU;~q-<jhOqXPp;BcW#)
zqp}#mwVI3f^PRu#S<?PRK8ozTYg!=+A2KH0=Q7~P*<6zrEAkfQ5A)uN9U;HODFb1+
z%4DdX`X>giThD<aR6GLnv;QE*=&b~~w9_oPxN!-*K^JjR1fnz}=y}_S>ENa;ui1tn
zRkgvfUX@?ac;tIw)%4JAcAz&kq2mDXqvR`t65qaLl`e(R7kv@`)Nt$siDZ`+>BrUa
zeOWB<zJrerD;IMw?0GK4&MjjiV7`}l5pUQ(V{|}zUuB7qJs5N0su8p^{`08?cBCp*
zdROE@m^>w0%5fL=F}GSZjmvdTWJIPDtdDZxQmI5CF*yc+O1^VZeAxT%`kyW0{}_!#
zS;0Y63-8QW((4t@*0;;PsA!1Us7khaP2po)f%NOX<Co1!h^To$aA1*Bz;3q2=6o?Y
z58pdaLyr|l%L!7MDUr;uj@2{ns+j4b1H7c+o2Dr)d`4X)dNW9Ut2evBk*jvPUy0D)
zeY`wE&<LI|SZ-{q$T9r4<dN~@K*kGqrpMm^x?5mREk7;BsfzpiSj|zWLYrT*a5w64
z3OMcm$>MpQcKyB|f=LBC%f>J`3+6SU(Q$=%?}uW(6+&@$6)yimPjHKf;;63_EPIB&
zcCnwwdaZc<RyMTnXvq8V95N$7XeeQB&dus&0E>%W1_!Dc&G*nvSQ&xwrbe*ZtDMN>
ze#sH<NdU7NZsCPB74Y4UsubU3P}HH3mXt4dadg}8_>ayrA4l-ngG#lq+~A|yL`T2m
zjK?2bH=faP4YG9J2_78YyQ9BI-zk*eH+rbJ5lzTk>D>Ne8#7m+H{2uNt$McjX<vWt
zBZZ+Y-(v%I0Ymp4q`cYHl0LIS_LWD;>pBck$CZU2Du)H%i8B=+byQdHS)|WWb^}$5
zn_Hp@VR(Wn45o~Njx`wpMO&bI7Mi4jxG*_&)(ROw%(TQ+gTolLsAqX!?f09>ak*e8
z<-b?_Hos(AE|wbwK3(s%h0L>|oe-9gyHidwdCDfZ9+;QDl);mTcr{%}YAeM0ka-Q8
z5K0<}+PfK|v{zO~)vsFy-)PGI$fTv#XLbcvsy@k=xqo-*IuF;lAu8q~khP?Lr_WYY
zo?4UQiPcN%kj(#u=_M1@ae~N>U;z}LR^-f49RuUpcIv6zzX%=X<%COzK`!FL)WBl5
z*9!0~&VxzjHTPpSRzXS=>Q+LO<zFx8KYt?tkVFvOkS?Qpp}xhtRn_Fmjq85bhSncx
zy6LicrXl!$L0e=3pD|{+HT+E|iYN0Tu#%DEns=}LZvF7V^%~5+F*$3YFIwf(c>`M<
zhsc%iySL#35B(pu4Q774ls>)U_@nM9*RH8p?9GE?-@CVXrqZGF!Iu>$>Ptu#M18E<
zrTTtH`Rm{Zk^mjbIFO-UFS$S##^QjnExQ#7U%qCZhT~FMkjQexdrg4j<Id{<Q)+Sx
zE&@vDQ`}willOmi%l79$d<Y>hSj6GdC4A6fM$&y=ywX{<?|p})=#RI$02*OVm!}nQ
zP9xt4=%v)m`gc2&pNW})^WztcbHB?{JCfvD*Xr%@@1;ivM@Nc1W`DXISw*~<@PC)y
z{vFKg_3tL%JzSNhIRSYnDt6e?Ba3EmKf?F&MdSB@>WVwP%5^D)OLZPSH;<{yOOH{R
zp>B>n?>`>z+6hCWtL_?2ZKhH{z+Nddi%#YiRVttH)`pBW@i!R)4lWHdyS9j^mYGT!
zo22>G5`dam{Z3BnOlqpp44v|u0atprGA7IZNI9Deu2mri)bpZ{Z(KJeVPSX!ePIF#
z2f_tyTQ9$+Nr1dJz1OG07-Ea5hOQ2cSlDEVD*Kl~O1QQI)G^D^`+BT4Rc&8FDj~hs
zbdR5SUPe_O@DRBLaWY2NSq`=(-;K?7M{!aOV*Y|ip9v8mZ~}kr>h9d#eTo4kl-2%_
z`ey`jA>!5S36nf8O`utLup#AM)IoA!bd|*?Al2*1i$mIFQO-3e6}>Q4KwpK!s_kD%
zQERH5HIJL`xGqF@qkW5BOf9Sar^2KziUnb0J^vCyVj}_UUYchv*b|jq6qjsR(Tju{
zwKIg(=L5aMRn?t&c=n1dz8%j>Gt>|@iyW8J6nMmiU%Nf0gz5NIzH8S{LS+8jAWiJ1
zVv@KT{6hr#Tch+dsK&pRODgTStS{eiTbX2$;lzPc=Cwnd^Pe`CMOrt#6~Q$LmL|4M
z6Z7e!DD%v1$-)29Oe-{1W;<|9%%J{Aw~pJaGUOz^(a0hMD<wJ+qjB6^B0B;;*f(j8
zYsa(+CD6+?KP$?(gsm#_P@iEjRHsD|0B;OAW^~?{G@mp7o`aHxW+NbS5it2MMfTS@
zfQ==a^xbf2X$2*sw?UsVWalN0DQ=3VY#wp<hLq#!2I(kj*H`zo)bsYg&dPa5r0RP2
z)A?zuQ1h9{SX)kfzZ<NUzWXS0+DAOm=B9{?&R@qvQM{TYNbV{FD4#-!xpr~jP-W=X
zFiKi_oDcu<j^TRBh_kL}@3L6W4j3CSHz-!K+VE&4sv?3&c>5$c6GJPmjdG{9ju_<B
zJml+>6K`si+YA#UNcfARjU?c)i5FcBQDQB`6z?~_>X;@;CnWzR<y^i`ewtIh*<AtF
zYvUTbgLS_(I;P*&7}#YgZN2}6Uyvla>!C?kF6{N`!J@y%#V+F<i2SJYm;R)|!<4Pm
z*J2v!rXAcg&qEju9uxK{YY-Ki4yZeN-BjM$=~w)_xxQn_R%?LyEYrT_my*Y4BY(UE
z`?pTj9^-#%)>XTw1U{xBT0hdze00;k?ah??z(#MmLy+>aC$0{K4yQ#)&2wkvNkIrd
z)6O-H%Uu}`2|-VACnun~SaKJpy%W>;YNkS|hm^#GcIJv-d9$naCMF6qAcZFeBq5E@
zgYghPjxCW|o4kyf<_lNvnch~Ov5m7y%Ad5k+yCRX|BQh@8ytk^>o1@2L@U4R0(pz3
z$F&IiOZwfV96d=h#`M1}qKiKG>=l&XX({ru@i~W=_c=EsWNwB11oDwee!Rxf#1^OZ
zf7(vBISC^#7g;yndqMo!u7LZ~!;{Y2zWJF2l#PU~Fz-M^^tB$J%d)`JHr!kHj+VR&
zqvL{f@{N?vlgdR?dtK_wDkKW!lJM`<S3tVkudjwMX}~55-X4-PE<0KH^<1qIIP>W)
z$X`CYF%#YWWK<pDW8ws16DgNkO>G8%!*@EaTJC$C3VaBi!bkG_xAn>Y?Qm^_+u86k
z4&BAjo0Na;H>vYU81W$@o43+Tt7swdB1f3#?g3$gsly`!uVm{84#4IIyf8S+s4=_?
z<430K#Wm+-ijoe96c}5Ds){4$XEp9=L7N8mAMl^UdvrbSIcUH%RzY@MT{XIbITW6{
zNZ%|eZ3h&Sh&X%(T^X(0me>>-OaQh;gfGc_Or(h)!`Es5i1tiVsJ-|5!0XZ7@jb}!
z?+C~~9_+ko$}Z3YKS^s9Zl$(v)N*&zx@Asrcs7it9F>qJGm)2$migB~POnMfeqspI
zbg^v%0lwZvq<hQMDNjL-Rc#abXCbR&LoW%b9;wiTV#aTJUblHj?o8Mxmr)EM!4XXH
zED}%QEthT@y@R1^GAQZe8y4qqk%O@b)7#k@9BF$a290y-o@K&jz+r%4FXZ1dh;6=(
z|0~KRu&ZR>*<GPbF7$u10KVMb%IeD7d>_O_AQLA+BCX*zDuu+AmIcQ@JckvGR~R(>
zogBv4sJr}$usPCiR-dp%@WIecM>$4^r}2qf0A|pptB8wyR1gP2TUoK$2hxzkgb+z5
zVlIvU;6;Rbx$x7M1IBuL!v9Mb1^<6^ku=5(1I^W*J@fXBfzhml39znovou!*AZHh>
zaY)<|kD+rKFg<VUF~Z*MmE>Bo?&^L?wqk#pBlY?4&m9+DhNSp{&a<0|6iD?I72|kD
z2my7*Q)5%u63f8odiUulr_3Sr!_`2P1#(c!O|&IdB_!wE;(+|Q)A>*RvOy_+8@XXg
zN~6hvP^D2eCTRy<-(C`zySArqU2_C@JIx0e+n-y4tm3!fy9=BhLQ+EM`T8W?N&iZs
zGzUOYN7eHN2eIjyYROtSFkRwnx$Q;v2Jt&ZOts)~ObklKzZfZUxtP`){95IL)Eif;
zEUr(zVIu%>fB2FZ4)BI#!v!l(I1%;QLW&FxVI=|j(o5J9qT46WQ1={3y#_h+aZ!yT
z!`GYf>>EOI=NUbTC<nF)o{;XgLpH)@E12D8Ulm#}E3vtW``FB%GB`y(a;X7jI;~PF
zHW(RkezBYyLF(76r%PHPw?`@cSo6yRuUk*4{bxBB1X`V^^?Lhl(nGay(civ!7=d-u
z&4lji=d3>8Bpi|e_wG#lU(N~C);dxMOeW46YFXoi!W_kyHPUk|b{F6x6O(u;j~uK!
z1>cTcMXINEmz7@LGWl;sM%dr5e5}~-hV|MDv>tbD1hqo!lvfA$`F}0At{kQEtCh<A
z81bUr=NxLx{(J>0-@6+LGD)mr*456~ti7pyNEXY(_`(bE9YCis`y?plY%RLyXJ6Kd
z4d?^B6PR^>xu|+8)Kl3XC1~O8h^~l?SNe2AvtrmcV~B&cr^Qw7WYL{k)N1joGS<U~
z%7D0D)A1m#$@<)HvN?D{EtkycyD7A0O$ghONAy)XwB&m(sVw=ZF$_f>3Ej}d0&vTk
z$0GLMbn2X8%^O$P%z7#~#DfB0D)-ikYY#^e43I8KMrG87AcLabEKFPe_Zs&qPi26h
zjad{97vpirP*mBiEWPXNPYimhlcACWw}kY0n3#Rp75!G*?%N_pkHG}gI1-=^M5%;7
zD?vvjBi`5B`#UU`p)lETxv4nF_K&!)Ar)Le4!nojt|Wa@S5e3&Vgt|=%>E8=D}<et
zS)6fTW1JQfInQKcP~q~gkonNJ+;){UfHeU<m>lasTMfJVpAo&rGkv;b-wSx>wh4uY
z`n<EHR7f|aQW9@2;a?m!wanA>b36E8XUv(?bFX0VF`?*kwyYmYzwOZIbCM2x^3)6~
z@G&61`qlLDs8(AjIuJ44N>=%r49Knm7!$kh-`w^X)#%?%z2rV%`7+2Lcl(ZsyiT$?
ztJ&0-!d-?T)?wN>)cL(F*V5;fJ}=lj6-rNI76Fav%_nHN>utq~<Bk1Ax^*6p2Uca$
z(T~Wj3`@|iG;+Zo^gCO?_@*ZgZzTm3DJ}faM;2X^T!r26#?%CAmTSToVb@?BItYlR
z-G=(Fm^#u$Vm<`_iMCjg+6u8p{(``RpJ!GxTJ<f}#Opj*DF}|`Pb#klV1!MZC4B>k
z5B-9H`E_5101L9_sVH4ON%7l8gl4eagXgf1kry-wOR6iEF?%jeyIa35jQvdC&%z-X
zvN=X-bbjVbUr<&5mGm_2bNou`Dt+O=&PT^0$DFWzrC~7I6da$Q%Jh#Mcn7}Lr`pdz
zR#)fDeY;cW!lA5sYcaR~ne&D9oP-^slG=1YVN21^qK=`9j_Uj1w-?kK+AH-<!jnn)
z)rYnXlW`Ld>YvA=Kl3TTQtWyS&n&ET@cPb~;tX=e-<Rq-E*Z%D;XC3=*xMTW;JN3}
zKSm*Ze-2ap$an8VSvOs<(!`?y7PWa;vU_Dtz;q<$v+AFapI*%NlQ>Fa*7SoB&9pO`
zwPxPDiUHv3rO0)iCO$5G{sJXmMEp65em)n@k)zVJ*91@R`q>z$MorZKkUYX%R#33?
z`yg=Zr%hge2Z?@Eh&Pmd;K{|(+VFKxx%hFyBK1j5sj$Go^UiIR8H90dTrmDYFPimA
zRj3Da@8eVN?$y?_B6#8LdiQz$wgsL{7N64EK7vY^h`DX0NM*fsrUH+3E0rLinrRL$
zEB;!jCgu~#Obud-63IQ^90}u9@t+>W6?BTcQtKlZkO0)iqOzc0$pZ`Bz@Af&NuP}f
zeZj@<7%Xo*eE966r$eI<d#TODf_+!SUPN{wCC6<mUWh&cGR|Dmbcb^sqL}c*fXZeK
z@3+p_FM+vv7_%+KdzGd>lJ1@#D_-E=YR9vvjd(YXx;iHK6%VmCIy6orh{MiUv~ZJf
zrzO_a9P|WByv<uaVIcf#;+px#j;>|l_V)h92PczJLwrK<ICDD5Q@5m{GJrulI<Vcm
z!Gx9AvFVxC0Qat+Y=89b*3*wl`pPQHuDGOT)!!ubs(78;h{0xli4xdy<Oev-snYn@
zO2#|m+2mSQq=g4?BZc3q)qh4JDo~ZLH!^<`FVuD-`rj9}7ARKg`ukr(uPv{l&108%
zfN0|J@Nq0||E7aM41<E3AN+@!-)|xT6XVy~D?)KAC2F~tV8meSiB_Kh&4^^ac`gQ(
z`*ES}pyQ}V8Sj~+S16r)JV_+ccm%iRnGqMRlR-QZ`SoiqO?{w|I{6Ee-KYdNkv&wA
z@~AO_wr$yY6r8;qzCakS9ZH_xyH;_A`+hqEV4LD#PA5}hMpAPza*!!yrXQ_sx}V<B
zM07`uPD%B>A~M4Q-_Q>^!a3M>1tya6!lF_Cr8d<|VI!fkShI-yK_S2P_6u&qzGR)@
z!<HbJ;2S-6Y+stBH?$_gY!>KBe__-F(&3L71y7Ij;6?@N@QJdV5#=vx$^9F#J$>zd
zr<_1up0VS~xVS)d$KN?JHyO?--G2YZOzJwq-5FT_9XrhBH>@qkeOBn|#rEk-gzEQz
zg8?UEVOODLO{EJVTk8HyaJgdv?RL}I$w?kw?Hy50!_5GaTWGuL)85`Q%s)z5l?zgJ
z{>;R1uI=y5kw+#gqu=gn;~>m-R)Nl+26Ac;Pad)`EICQ*B|`8kiov3yE&ll%mL^5<
zzMWwhi?qDt34#-Pf$q+l*av(*A+ad)c~Cn41G5vlO5mFJb0H*CMaVNDFEBF(y?ZTk
z`HasV60M$klT@?oV(7-2Moks?-d@rra6Pp1^g}l-Xjz<afbtC$>Eqs`(GjfgI<>N!
zd#Yu}%pTs=u{u7ysuCHiu2P@dBM!2I@y0OXJ}=M$nIZ8|>Oiodx(D}z?@_nmJbz40
zh(bjXW+qA9Q&Cwux(ZCj(ansPvlpayG61BVL~+=C9$xh6XXHg@6u8mvu~({AFn^Tc
zN3IbIw+E9cATZUG67+ECd9<|EHPYaJ&|OL4`W@0N&87ska|DYo(v^?-`yJV<iFOAj
zj#wZLO53%tR||xH%3VhTC8?A1f?VCZWPe}!2R)Up=!c5dsJ3PLx=0{C(|;(xb1O|4
zwvFNj``L+7e^B@{VVD7~OaoJ&nu#@-tk$i54#a&Xk!rOrh9n-Z*O)0xZ}(RnbAPJP
zjtc8_6%(>4X|Yq&()>xUc-~zIip=``oKn%zG2=$9D=z~3gMPU#`N*2ODQlfmj9jFJ
zK`=<=b4B>Sg90xjl|U<%l<~HpeEZify{Le<nJEQe*`K@wjF_=oKzrZbEb;nrW}yBN
zj`Qg(5QSKRa6o`NyqJz~;Q8X321@_GNt@+nmCYokG=pkB7i@Mz0K_Bz`K`4(haxRg
zke(5k6kxQrep_<p?~0g~N%>b}LM>%Lrq51#^F_#unWlv<Q|+n0(x$Ku<L-K}=SmfK
zaLCm>Cds#685Kbv%L>|aSQV}rm)i-{kAuDYp)6xp(XUB4AVElptQ-*f?6hVsRB=4=
zTY_y^2Jq}Xszt2>9($1vN)OP~;~zf`b06E87SX!-IYwS<I)qGuYG6WZAvu8}>o2ma
zTyl&IET%dASn<9JbcmtBT|kX14$3tzm=seL^P!3EobdYCz615i=IfASRBoJ&0o!e6
ziioHncabZ{(iJOP3$|;y{+6Kk68r@vOM^NJVi2rLs9IlrQS$%Kw|sRhONX~;jsWny
z1;rj*7oPDJSCoD_$y^R}Gy)Dz2}K24vT5VVev&;@0&rOjj9d=vFE7A}UW_7kV4qzA
zkTZ|_-Q-1DI5~u>a*w0BpiLj>#G%X7ScilG_BXfdD|VWBO@N$ECP1!J1g6yN-fdsZ
z-<?PEMjuAjRoR8$!};={o1aI-#&5NoQTFeAnPak|?$riEw+=hN9TDGX{FvStvzM6Y
z5FApm<8*Pgb#~54MVdy>tZ9<KI4xr^tfo*douL#I)wNLE4c5$o%<>RPV_h}TeyY)*
z7Nh5>_(Xk5HfvLFu5Ko+Jgi=cukFL02=PY-iY~y(d46yQQfpR?f0@C)_oEdD7S%^4
zlC*9PtRKHP?>t(ty1o=NfN)vHa#%>jpkcn&50Z8l3x0SnAxgtnp4jZa<GzQMfgsRG
zuDuaxDaJ8z7nRHvqrN@Kzu7E56!O;c7(1BfC$}#-k7?!0cukfQTU*<7`t=Q)>YCX8
z+1N<VTpk{LNH}7B#eGtl*Yx4WGj?D=<mH0lz~K0dHnFa6#1%cOPp<(lPOdJ7V&D2r
zEls}&2wtzbE#V@>|D3;M)?b3`_tm@|aO`C?dV7j3o7v`ArW*ELT;2MqEbCI>?TQ=_
z>AtVcHj6bMr2L`}r6oi__XU?o3H=Lma?r+sm6e|VG#+m4mZLU=<Dj<#WnB0D8Sj|b
zL*IW9io$1%!b}#(1$8544OE$bt?ci#$2s08Z`Lq$^zK|Eyd9nO;Xl%cNgBonhW-_7
z2P(d6Qj3M^s;Bph|I_1r3BjF45%2jCReeho*zZ~@z^>L{0XC^1r#ABSZZi$ITl4y5
zQD77aw;4w*^yW>4lT>kC2YPvVRsZd}r0MSVC69_|;-Y-T)f;%XNE`B_Hae){k;Gs4
zvZW@q&9SPb95LT1#pO>Kv{Olqm|v9~K!3gVLLR;ZJ%$eWe^|gUyeC7`+hp$wZFZw)
zec__wGrA$x<?6e6g5*rxE}KRvCpC)JJZEud1IjNb6FYF+!q|lLx`#^)Nxf{rn_2`6
zG$bp@_Ik8FD$icM+9>(m<~Qwo<(SR-6cO!S)po6J6!Kg+$bK#c*6o3M%gqul3y>><
z^AuJ4i4>TdfgvI`8NYX^xmQ|*T@nY=2Pd?;5eM`*#aYbkt6+FE?)OpNmbtU*xWM_1
zvCALU>O%A=9cuBj%YS|Wetw^goUR_a$4<Z{LQd!Nn+Xp7GOEZk0?+{Nuo}zbuIOP6
zTq<jLQ%7j2#E+fJ1Os}rhJniRITl8`FcE~uFWQ3fKuPDPdI8ElnaUDO#9&(}TK3(p
z!s<e`0K4$Wni{p7Ql=t>Y1Bb_1POdvv5V+4st&DyuiM}JyC|0nmO<rL3m@l|$;}=5
z{N3XpX*ZhtSp1Et@qD`i4UFxdBmc{A19bN*KiC;)izXf_nrj}&_V!OKNWcF0^^(e&
ztRRltTW>O??-$o3Kj%d-<0-^{MR^!NPHWwc1+X^o5qdDD*|hsWH2f6&qMky4XpD*!
zD>=cHJ@;jC31OmtZkBWbCe&qU!hFcBFR@S7v_Fy$$W}BgzW;~D`CVHZ0HRLnA3Tka
zC|W|!0`*>p%Z%HymOpe80=cHQ$c($!q-x!!?M2v2G86asjYLID>#B0Ra!CVK|KgPU
zbtGqxY<vm1oC(IjL`3aIo<HEYiV-U<fYv`$higD*e}6o_B`ucsT?gB6;EHT`rd45Y
zpbN;{i7l0F>f4Y3jcPIWHOh~t;Cx5iW|_0_LT2q~oZj`1KOb?Ko!as7kS%}sjAoD@
zj-73_sfXcL_tz(e#??hLZT{Y>Ppl(Juaz(lO-yKz5`;WIY|ZC>eZ%{4tW;2N6-RL(
zT5GZV#w8WyJ^RHcP$*P(4J9$b_}hC#By|eJAropAhm<Kkso63AH&AAq!`yQj!kl~A
zI`)z#{B7|`MLMPkRokS1^Rykn>D?9PYZRE^2St5`6zh->W~cse#~nro1jr)<m0-gM
z2g7uF^EX;%*#Vl|Vw>1oyhkP)pGhB%dj?zc59DDwP1!fR+^q{LG{(#U%*Lk1_WhG}
z2ABV?uRD&+pQgW|47X3?U))IbCpYB317GO-_q@L+{XS4;YR8&+S@sqkH*_}WrWA??
zH+bP<kZGEDJK4*VCRC$?^JipA!oA(jEYlUvQ;BFi4{krz8n;Mh)GK&ue)n=<xA%B-
zTYzu!>&TbZvPjvOd(3eNMjIpZ1(E&y51ZWPt)r@i+AAU-^7rJ0A@q)y&8@6LZjZkC
zN9(-l$dQX9!2o&Ds3m4j%#RM7))4GR?29n(ohz@1TRL`U!Jh-O98!uj{e~B=Ky-YI
z*Rl%yGPeJRw!dtP>V4n1VPK?Fk&Xc=1*BVGKvF3IDQQpv$)USTX%Oj7X{5VLI)|>I
z8-^ig;2OWb`+r}r;M&%<%@gLyoUC=8>)4Nd{~TqjEW^tljOzW)`sk(+*(wK6J1~yI
zmv_JnCHv5^+J)iI2H0^?P3PP1?CXbjWnGUj;ayEFr7b)J17tz1qU=qF_0-I{W%Z!K
zzwfnVL#M0t%^rK_JuAc9?QY}({=bTs3>j!IZ&8N_sA);tJ{NAnT1GdiH6l*@CE2v8
zHfUlv{w_SJFB4}R3q7zr;zgZS!9c+ywZK%8Cx0t0eB_Cm+PjW+>pv5387kt6=PB~e
zg8y>o7eS<E+jsBdz93%6>7at-`#ZJX0`E<IYc*aXfgKZ-aW7`mIPL@wOal3K+rBEb
zF>j&e!F0H-xU}VW)p5vCBH#?QrR&AJd$&<|Hd?MN^}=1e75TH)ia=J~)#d%bz2Q1S
zE^Q3&JzEO!oT;a$XjGD7`U5+OwTOe^PNuUb?;E1QXDRO+KL5oviCoeFSMqq3E**S4
z(S_LRMw|MUq*+jfh^F^;W!GX~x;(q^aQbP@?2N=LFMe=`HP6|`^ge`B+xYc<{ZXAH
zu%uQkw<v<2-ZKxP>;H<|x<4=fgZv$oagCiVnjiJh@K)RgB|x8sRvZ`Nu`0YhVK@+L
zVAx9gU-YBF|Az9*c}DcOIqe1bB@vbKc&Nceq!MMHs2x)^SP?Z>{0x)c@34WtfDDq0
zP7a<lyCX8w7ci*Pr(!YvNT@hIqh7Zct)qQgVlk6;k0>U<ug3hw;Hf{mO?2{y^w%)I
zYV9-;`fb549cOKBzP|@XZ2j3o3UMWC6ULcve4$C_PrB1M2$%9F#-mXWGmO{4-#GFk
zu;i!xg_(D)v(^2|1{!;Ig<@WbhSUo@2kw(;_UML-Nq!=1bA4O#RC`aZIzcdaW~T-c
z4O4YMgTUyNh+f)A>$PK<MY;B(IX*eKNOWp{*8HhHj6<VdbC=U9GQcR=nfEKV`nCt%
z9OnBwYVA;tMd!L}1|*AnTzy3M?+ebR+XmbrBc&o+Al$@1Q9aqqTNEdlYl%nM_7kuv
zf3A@=P@<Ti#{iwR$qv3#45A%$`x-x6$HjpTLcQkue|WwG5~Wk7O=GnZA?-AJ*Q`dA
zMlRq;dFCI4t(FjdepW6I6E6FI6Ceq^LMT2KQ;Ia#6Nb^ojnOBR(D)tivkw^EadsiC
zzc;tu(9v$*H09__HZycyP!cs$27px_UezI1O3^v&xJ~fU%*n|#mVZ(!(rkGLZqy}m
ztQa?*eA2w&uBFIBhYNFyUR+gC-ZF;|1bLD!@Kp6{NXakkHZJJ|wXuHg5E9f9rGz?C
z6#Zm*d5z1&CaGC94JjC`e&1+mvO)d9SP98JN`;?Puhlw_ZS^z4QJ_CsJ6Pho?P1!E
zdne_G7#**@#3NpT?8SmW%`Y+1RTF~(A1Vp?kn(<iH>qw=m@aeB$AFjA$?AZ~T;eUa
zfbs<&uV7J_RDo)^ydh9?Ei58bO#O9{{&ijIAcccsa}m9NRE$4+r#qcJ_b26;h8J68
z88yGwh2gQjo;EWvk|Ig#@uoL=MRrZ^16xAuFVnxZeR*{brT(rk#O5=gp9hZDlizHy
zri!W)_I8g9lJWnl_R)}Rfc!gMyugwu?o$0bN&t^XXdT^8@xA!yVc6@!X<m{ygyQMo
zbCqE$Q59&aWV@9#o9eDS!#x1)EmU~~GbB5PDnWtPLIfWb<m0-G50K!!=C#^QO9BUk
zaS3=Ry3qoe_@c!fGLk3=XtTt%s~TSk#&Y<+mkbd~U44*?>L1fQ*l?*QIiPo|fRDc&
zsNAYrH=C{V8zPgV-zM%r<Cif!yu-P<Q|b`opzUC|huo<rlf94w)O_<_O_axpA+7mi
zOu+x%UgaevfDraoh9hdvtd~0w)rQCmumMjj^p;9iN2su!aOKDU&zQ+T$m5$&TKVLU
z^ghG!QUACT?2NVaBweME+3OQG0WD@4^jqFCrL2ci931!Ytiga{n0(?j3YF=gar5wC
z<-+lJb;3oknX^>kIQAiQqP>GRPptWOMSNq^T!Wpn<IM?|a?Jc|@JC8lm7|!^_j%9f
zfkUV$`}ekI-UL0ryCI2$(fi4Tb<+Pr858_|4w0oMBAaKz5;tN5nfvG#_oacjuP_#}
zSOJ?P=u{Rt$~fqwBY{s9EIClfd=7M=1$F1*gi@*%HI_H3$<t98?4RY)Not{&ZFLu?
z{-B(X?m~}MM>%4EPg?DH{2AJdP5Q&PtAvh}NNv)mJRb7A_|)8tPv4}=I>j<iq(9>M
zkB(Pm*3|BT3LU+U8tyK6a@|-TLwTf0@_0I)!PrU793iu$0SZ1Y<i3|ps3Ljn1K^=r
zt|gkvYsT@pR+iL;OXqgD7W0tc1g)`z&K3`gcQDozBJmCbD7Tn7KFEQD;*e3yz^0{~
zmPPBIC{Z`0{*g^uJGmYp_jvi>!U6#wemiz?U+V}{LJ<z!;-~L6n)!%Mf`|F2)DGba
ziS6ok{mT;yEZf6*R}QvcIeN;!*BI-iD!~SJIRCV9Xz7*S?w;=(xxrTtYtOvQ)+m5?
z6_>nkqX>0kWEG57Nw)JG-5Tt3eT&_$LLFby=`+h4(uPt_adM$NWeQ=^wJSfJ&$_^v
zVk+<ALNSJFvZ%ZQqt63ST{L@9n@bi{Fyr<{1g6G|6wD@-3Ps-+{S$(6y>M2A0@#Xn
ztE?EaLtN;cvje)7m->xO6l;jfOg&*huht}jzB<cJvZZ*fc-9Gj_~_POD7_?l>Dxb+
zCPIW~K?8Y_Rq)b^8t~i}hW$xGyxQYtK2L{HSU~e-6_s^v6+1PhI$$K`OEj%|PRPuy
zb@l=20Yx9#f4Ou{O@Pqtym8@Anfww3gQ&J@x5|E#_k&t^LA1RW79<yr{y=(qXEWXY
zje#(c<eDc#^TaP8Jw0s)eOD_yxmWd|5?b?l(8d5%)d9y3n)hkRI42BQ=W2RUVUEkw
zz&Sl5B}F5$$(2ntpKQ$-WxjFVCCt643&|OlS&nYJmBCh^t_A1c^7>tXqnUtKowN3A
zFAbKTP=~+Q9(cvJ$NJ%fC?4S%(uIc{py2b^mhJdPcI_#+-cp`CxEHVF0_Wa&6YTAN
zzu##5!}u%I_ch^e&5<EXg4!#mr00K7w$8`z)7^<9nd!eupf7YLr8EKUX<U(cHO_^F
zPr~}lyL3if;8qq18luY-hu}VsK9Dh?yPZg$YxCzXHMAxtn-cBK1KIio1(3ufPM^5)
zf3%u)ur=;xro)l4SL{k!>`Ie%whAbE{Io-S054yx>zn@KhNC+&Bzk@(-v!_Nyy{P(
z&*Z1*>;_X+{oM?{t=q5n`3|hJWDr<^H8cH}f$;kfQB=3Y5KGJ=c6#w6DMa6-?AP#d
zR(-_OPg_4(GZSyLU*hXFOU}y<y-3RO+Mjh_9-m;jo49AEL1mHzb~z|bq3G5!Ppf*Z
zu|J$Jm@#<MhJdNT4hRuCb8b@_r!K}w6LQ%u6V=p>D05vX6SGHS-VL{vw`$)jzli@R
zem}6Ttky-1mNwY2Rj@M&uNb4^E5G>rI(#P{9t!hFC*NVhL7Zv)0~B-~QCrerD8jI;
zT?6oXas!;E&{|5q-792$Z#oK=&vVi+jH^S{^w}L)C8mX-?m)&vc;BEo3vgn`?o)c@
zE8Qw;d6IHlOb7!9UCk-9_6&(!nhz6XP<>Y5J5Ty|;p)3ufaO8G#iH-Rz{9KBPHYRl
z`y$I-8tu<@Dnh@;ekkN@h2=3c@sr3Jh;*N<<!><HmBAF*l$(3D(x}`XHWg*`I(J%Q
z0pinr!fGbR{)}`6Ce1f3fj5>WU^xIqQGm#C;>!2IQZ|9BOOA~`vWDlD{#a({Ozy1J
z6~NxRP688AoEgB4l8}(Sp_MM-GAGf?-n!8HBoqOG@J^HXKspOkDmAd;wxnumlQ|Jl
z%JZ@4_iKjcpW=!fn5fg6o^ax83Y!_akc%;OlcG)T4=*{?a_NtkjdJDG?;T#=?p^Px
zJ*JG`OeSc4`|sg1NXA<1AFJWW-StX~-{D3plBMFPBc$x>qc=3SYvy_p=RLWvyJFz=
z97)+vWA3r$^()3~nUo4{>nnlPTRZS6;e!Nz>_=5R5D0W&zUEe{PuDNHjlwwmbP_;2
zO0tU-P-Tz8j$6oXpA7;~iqIcrNzVV}h3W<lV`EW^=eJbLV7t>=?O+2@cB4#K6t*F(
z!Qdu;JBq-2Y7ieHfU~QJwrTRqb@ORCenOGH6u&)RuEQC|05AqXzTwXjX`dRZqtWRf
zL?F)P4^I5Zfg|>Et!fLERd4`Phrj!>5~E}Dvog~qB$)LVYMY;Wxu4^x59Dohv#@81
zOz)P;2z5j}XZlQWA@`(*GlGTiBGJ_Kfbb}_fi<5857cKCtW#_D)QtnDA||}mcEK=o
z6NNST9nj(?X${xQf<4T>$vQWR8`a-WHoz;-4S*B}B+Vj={H)-^kC5?7`qhVv5O)72
z_E8-h2lLT+9tH!;E~V;!YSNenpvZWaN7j+ya|w%%SYyxZljM%*SN5cC9$pE^XLf%P
zoEhSW^u|P3D}yh+X@JPg3NEo0oWLSYrFxy6Q1YcWwjGzUO6gT7!@bW<VwDvdfRH96
zAdG3hbN+-%<0TOnv51KGW+#nySE{6dKUlK;R;I?4b?*tjbTjOXaS*_0qR4L!oo}e>
zgeqdsMSD+O3{*|jP3#bJ-M-u>d3eiV_nTTVh;jC><}wK(bDl%@#A#G&?H-?VDQX!@
z(6vVyUt7j^lvCIea3mkM-fD=vPS2vWbKH?dOec_I-Ss8Ag4QhKjL19#L7`UXD9HL|
z@S9L*Egv3dg{8?`LKA`q?8iwz?f&)a?@Ctoq$SO<zKPV0pW1G<P7QsoKo@<bs6~ct
z3XpId9RycF7EPa580ob)VkBYwJ1{s=okp{(%Fi~c)J8w+v^E-70<Y&Hlgyi<{wTGI
z7+jboK->*BRVL=wqvV`y#O8vLtUd>-@}|f4^uX1M6X5DBYF5_XO><zHqGtcopFhMX
z?u)kTR2Ppb$4aBxUEY$R4YlC_G0(QNq$neV2ylbU6)4>=l<_Hzw@sjq(F*fpBE9e2
zFiC`HeQErroF0CVH|P?|MqRKknXwp@nb3st65c^P3o?gFQ8q(Vq|}%j=SWzP)H;O6
zlJ8^I->w$Vc&XQcmj3GyGo%Ks+x?ihiL7ygx`--An7VF~?jGcT#>b(8GDN?mlsO9J
zBEl+?<YQlWTlP<@ltB@&#=Y0<7Zsa+D%wPv5tWiJr8-u^^S+|?mw(qI$jctXR$ph<
z?PRI#6!4L{KvPyqJ)g8H;zfqZ(ck1hxgTwEQNja%B(;K`dO{pub(zTDr%JEQBZ$&8
zY^tOqsmrtdvrULE7P14w71=Tb*1Q@@AMGoUYZe(kcTQKUyUR`xZ~L{`QNdjUC%98(
z%~ibskKb;Wu2zhWHE!d()!wu9*qHZA4-LOaNK>Z1LqA@;WGpf@0}2H+>-CNxXTE-J
z`5T3GVZm;wx^u8`KtzO@fs!P=Z{8psKU$^foPVt6e=$lZ3>u0Uos31LABLa!;oP(F
zjclIEi;q4~|6wwrxxh$}N5#ry87$>ulWt~85|o+)+;=g@Z_jAPG2#cDJ7F@kAwfxo
z9(gay40d}$P>An9Rg@v8ZAMDKj=&sl*e!HNXv49jv~psd^R-;mj0CRuiNaTSDef1h
zrwpxTaAfu5PTKFhflr#kc^w5=F4b|`4GDb2EHcW5%Whf~*89~M6~g<@D!uSI=~q6J
zog~za;3O}?uCE;8n|)uA)1Osa&rO@0$T3?)7wqK}LahEBT@KXYK1WkW&#p*%$i&T}
zD$lFy1V4RRv<gSW3)8Dd87o58*i%B64AbB9XycIC3HG_M{WW-xBWlb;(B-{;yt(<3
zZgAs+>hlW2{-#KwceRWnke9wfLFB9QIyP}=rWYGx#%&&v;$vaf9j&I<Phz|$x{2`U
zHf?r)3R^yN^>wc$?3qAQ1Q1jELwhDtbEk~?Yn9~x`P3a{_=3C86|p&g?sp~&Tx__}
zPiuZeyYb(bq40j*xzZ_0hzZEv_RddWi^0#oD6%wJ6PWPUjV7-gz}m1x-fPcmWU2~C
z(WKzjW__hpqqLz9!*a6ON@oY4xG+vi*Y8bZCB!ph+q{}yr?4`<mY*Q(H&MkNc*QZ}
z`KuynFVihYSAZvPjlAz4qsX}|0C{3P^m4?Lx18!$SIt}6=fGg8`Wt@Je|kH*l}T-`
zkr5rQ>}yfg0(IIvjw-PRrHn<1nbp7y^(2Q0Z+tn8j6+RFK8Gv9QQyCj`O%ErtNcrH
zCyp+mDQfcX_M<%xKaBHwRf`O**cz(DQDDt88(Il)^2_niPo-xDtDJ8EAXr}<22cCH
z(~*Lrq6J`llC|MXD;^HtdstSuz-Ztz7W%v1v}i*)mMX^C4Ohl+VQGE_qRp>TVp7d8
zCbU{4rLYbf*dIS4i-Q4ex>qgJwbCF2B!FjtOW63SGPvr^i~N>2F^2wEuTSt%KR72q
zuO7-}=_Vc2CuIN(2oQRRVlCv_8_%0O`wA|34D&o3PjYCIf8n|a<4dZ|4ImS!ilX4>
z2-o=#fpvwNZo9afT)}lY(BYi3DZ-L&e{xm9rxfr%zozz#)KSs2ehrzEs=~FZME~N~
z&bH;%`3Qnre#4`T=r5U)5bSpQmF9v|@2r05j4I_TZo%2_)qVBv1)3tR)IQ5<Z^>vQ
ze79`327s7&YF7hupK~wXj=wPTp0b~DJ_AsCmGg9y6G40<+iuiZxh~VO#fU10jhXR|
zTCsHV4~j_dn@LWU9w`ei`g}Y|iyLyw5U5{llO1pwD7_n+@*WF|_$tXPGxHrf35TSR
zo2wFAD4Z)Urd`f&uj5z&WX}6cN6xZ2p2xcmxu**<k6-F|l5qEu_kTOxzfXR_Y!7y!
z$<zi1^ORyyp>i6F9d_LR{W;^CKfEPtA(;2^jDQ$n77u<()q>W)R9jR6k}p?z>nXas
zf{|`u)M5y>Ph{vv+#US5!;2WhTQsXv<*AD(M*qh6pfVw9vc^)Alc|(Ktu}6_Eqtns
z5=}{$WTOe0Qk$!Mo_T(JPBvH*aW!tBjpv`<ge3C=n4|YSt2do1fBqRk0#pC;Q;IUE
zvV1exbPOO#>@G?SO{TXR3tB@AB~d(iY(^y3q4oveZ~nL;0{{k6BCOvSasY@Npt@^T
zf76L7C=AQK;&z@+>JgfM7DYOTrL2efzklq%Pgey1Csk9#Bne8QJYoM|I`e}-?A*mN
zd}&rJ^KjeIlfs+X3*YOPPlbNPS|e;{)ZI)iw4j>9WJ=jpMfgXl$>T_rwDQ^WKx~ke
zdD>TkR#9D_Mus;`A|CRH{5Ks`Dc@o7#5{D<EMuilX`<c@pNC^B(|AKak>8}Td7!&D
z+$y}it<eQg3ZN0t-4p*5Omxfm^GW7VQ#b6;Jrj2|wUdZgjom0Ss(Ic$^BFs}t{fl|
zmjFK!cZr(ZT_L?NY$1N&mFeq0jrG#P2&~+JnuR7Y#W)QV@MZWCrr#DTIwN7q#x`(A
zHLa)oE!{x=J1Mdba1|o^AE)d;R@nu$A~vpoidEqZa8%_yKy+oa!!pw_Q=#i0fa@jo
zyevS7l!dxFv$6rhXW`{$(qA(-Xy}N_Xkgp<Oi!NMW9iS=$0+!hB%Wl;lR4Wxmj+pU
z!8$j!#i;t30o<eKVL8a1a{f^(w!7IKutCAX3`5$2i^<Q?$ZC+;^RG4gq2HF6&at4-
z_%UXD$%=E_UH5shcfvYT$8O??A(>Wac2XD_ZJsrCQ|lHXgA<WFD-m;Y++?V(2h&){
zi<Llq27D-wh`4`<O3qJV9fPqoyzYYaGxY34Si>4(5y7PSFHdR+5J+lWP#IX<){RsF
zzi;GvclTp|mTQ{puw}5Gg^)9OP;W3jD@)6wS<;NgeieF$R}ot*JnOx+esjYtDNZ2|
zfBn0>>h*u?@o!D4u*@_IUCjC3=L<UAy^P`gq5q#}yDEZu!hLr4O1pNt?SMadB-|+f
z_f2v-QAAbLhO>jyEHuz(^hNVZfo7E;J|u&LPJQ!iN^Y6Mn;M0bFd<4<-D$R40yfw_
zF8>6%PGj-Z?vNZlk!$>7V&h^^TtoDRxR+<XnQXzn2UQO`4kd(b*do%g-O&UF(}tzQ
z8?kO+{$T`#3L<+7OdqnPK-A%(e>~V|NXP6S?m#OFnvQ<iDTXTH4N-{Shv;E32K!9u
zm}0a3VNHj>=iOy!*eM_Kd8mo!zAgLm8*~uR&pOol6<h?$uCdLgu(>>eTlXD0MKHC}
z`$QTdo?ox8E4tyq;uPNbIFymz@9&z@FHIffD@fz*|6fD5PN0)Ez8y==wSB1bi2sv$
zxt#L=A8*kGhTslcVjNsZe&goAXF=px*Om;7s$A6o5pEhr4PIF%Z3CO>X_gVE0V84a
zQ8-^jMW^P)?%dh#{l9YaBt7*WDUGtssD%pShpn)fQ)zaoj$x<7@*f5mcMno}_YaRp
z9Gr#Qw_4iw8}W{}xBk7rE5g8$`Hp?hWJ-+^c6{bp5j$JX4pr)_Q!>=1^qpJ+>6IBL
z?!su@;uF||!!nc*_uwuRl0S;u9wXL?hjDXo3nPu8cLWU-;);Go6M0%?IFN>Q{tF%5
z>0$jsYAsL=TDj%_8_^?g61jPm8?a|!s9sn<jWa{mhv~fRO_6=<>}dN0mR&9nbn8B@
z9nsMg!OET#@ev%Zs-I!^PE|-CpDV2S+D}RSf*Zm1MX~yoWX9aKk!fMH>AeVkn^VTK
zt5;u)#wLKGE}ar)|No84RR>^z9$bBi*yQX#-xfM;(a+S2SLZtU<a|pMBcL<Ot!}aX
z>imCuc-l9UCM}OovuQefgfDj;Q!;E>gsJTN+*UPw49ZyciYV+DG_bDN=$&>ggz~IT
z5b1|S(XhqY*AWHj`eP!3!9KEC8Pno!uAZMVGFMBkL!6w(-q#*KyJ{Ncy<QqyDBN(L
zX7JIxFY@Z<L%dcS%W@QmC1s3X;Sbe&(vW>KBs;$!{M`-x>EFPiCEXl4V#)D$$8WJ$
z3lCdSY)FWEwzUCbJr#6*GbBST;3$a~-S?Dhq6W(#K%(Z=mW3sQnE%&QrKnYB9KFoV
zpAOCMb7#f~>dI*)rt-rw65kmh3D`Yrc@vq*E%n*s4!i%<_L+3K{FXzr_%Z!%Ws>Gj
z$PQxaTj89;be9A!5(bfK`u$WF5nyAgySIjT<G20a-8w2j0u^=>Klsc8!-l$flZ2nA
z)BO=jb$P$&Gm;uCM4ETKJR;*AIlHaYADfq)g~*v%4S7lM?*O@a58$Q!mL4g17pW2$
zHqyC}GF1dNDs_4H8CRGh+Bl8!1~aG9-FeybB>d~&wLI1oSie-O=V#&mZ@)XA-(GlA
zhAt$$ik8^uE4VVDXdYAZ;v+gL`!LIs3pObwaEvVjilVP8NA$S9lcaY*kYG93`t^li
zi7!+7Y$iMSPFYcN4{TukdQ<eS)oKG+<Dd}y(22v$hl(6xkxT`WVpl}<-M|nY&G9dy
zT7~fPo}7(FxIf3HLo?_UKgPzcQr_xGCXgZ)N#-Rln7L?pLzunyT{`d0MT_zf;VdDT
z<Bu7lBujU>RG*g4+H_o@oO50K$r4+kHnYAoR`I1<*84^qJxlXWNBgFvg60=SUacu}
z6J&0_g+s<{S(`d0sfeWo?X6}3&x06Bzv+P;B9_j8yREKUX#<Wf`Bvw#f>}M1|7lmD
zlW4}<QQre6)9MoEzscws(jRp6pUXrR+wgB$&~+w0vwBY}-_F&<qrgY;yH%Y!F-YZN
zJLj*8_kR(Af3I`vNOVAvn@Y_eejBdtl*ERZn;w}gErUQ$FaD>beV^MANdf1>(i=H>
zqknDrlWuvn?d2zb_8UfSL3#C8uA?IOToyBC0?iKIV7-I(p8cM2DZV|{1v2g?@$$wr
z{9Q2HX8197oYiaYm;d(Y8Fr%wDRF0JtI&y~Z7>Is!I`rDYCmyw0ZO!Yx;tYV<+2hN
z^}$SYzR~5{WMUMD14#&Qh!{HqNw7&y2b4!CA<Eenn1eLVio$f8B=q8&O9+)PfzI0z
znj`@b(VI2(7DkzTDPn2|Lbz0Otbr;ZFDs{*?-C^WjBm0pDNn0v2W1_f^e#iHeeo_h
zykD4oR+NP{EK;h1++_LIP_Uj)Mq{UnnO(%>`%B-LagsB=<%?eN|5W1VgqPXqs_ue1
z?;REu&ELS@>qhl3#P)mi-<4vN(M``jwaL+a^H;>cm`;68Os9Z60u}RU$wBXrl<be9
z)bv`msiKbo+uI7NQo;F|X1J&{AY5jjKZ<&lg^hmJ=Mui}bfQacaXI|z?H%p00_QIv
zcgj_c_btOT*hJmATca2&ovtd-9m71G``u@VxZmi(LtTNJ@jGwDjzlOXOpElXxEd4X
zJyj!k{%$(+h+u6ZrP8pspY8HEYj1F0V)%SxFzi&Vdp=)}B@dvsZ*{ice~P`YwBoGK
zO`kh|Q{cBU)gd;cD^*arJ9k2!nrh8tWNr~rX%HcnP}<O4)U0q&D0Eho`r*QgZQy7X
z$cA3K@%21_F+lQfvWIt>@bp8c^tBCs-@jeq^*4WCzw7JfC32Q|!#N#I;Z!T4TDpzP
zDt|CS16U^7(OBTIEzo~;33spO>`vjOklQi53rhENH}&Weq$;y=ew!R~+UwKZ!fYK^
z@K1Eu6(lh?Z+&SlzE2{c$}7a{=ZxDr5aH6azi60<YZlkw8=Js8b8%t&^o9~+B_PUB
z`Ezo=!#(ET1YgE!TM1{Dx_p}Zfpj6F8FVMnj&*SqWz&td=j>HSamAs<M->lkoN_b2
z&(&xw7Yl0cFYk*yer!|v{WV!)w?fBB1f)bMioeF+_&$!SDKd4C7~`FH&%OL&Xdp=L
zuk+Aum<SAe91rI5v^V9~Ek{XC;&3Ps%BLeQLVVlOR3aCQH!^`%S5G13gkIqufEoo;
zi??IaiB<G9Hew!C$gX>S^UuQD_fEnaCwq3n(z6#h6n<ZdcE=LY4^1%77!ivUo+*eS
z(j*R1x~9Gf^}BDHO^`f^lfL2T*tsuRyYK0sG{4Aryj3bykVF7poG9xwwqDt<8MGZ#
zu6;mWj&~H_AqlQ^bxOpqMc3xH+F)b)v!%wc{)6$y3;R-_?~YR`r2S-6<<n9EjN$m$
z-cJYqSEr->?t7MpG@PcxLm_Cj->Lh}>iNlmrX&osCpUV*Cw>$J{NQui;G+jGs=P@%
zh-gPV;%c}x4M!a)wVx%Fsyze~SK4(T<>7b2t#zK~rwA+fk+C-z{-eXad?BjI`0_SO
z*Jt$+@iW{UbP+1tF8CMOO7Wl$PdD})vP{s}H9NXn03w?YGOyi<Z9k8dJZ|hiR=?Hh
z<o8=IExm4e^nxTOj9K_T2!|-=muc9qcbu!(M>P8cT;6&Q&4tQc{+b+B5I@P8ZSaOZ
zPO;K$*gt0OejLARqEJ;?`pRtX=H2-bhF_0%5N6HPLn75nhOYV!EH*En#Dq-$_2(Aw
zTPL4VZsdQbTOx|fua9&b&#QZl!SU3J$@)lbjVO+nGqMZu7ChdG=Tu!`iJk)Gx^zs6
z8KTch-($x;p6ss({1Ipt@x;c-nev{=ANiE<riw#oEX}hMTd`+cp2VP2z@bYGzbP1-
z2*tW@u9JuYf!ApumxJ~X7ef2JjB1+ZLW6-%DA7TRB+lsJK~$Ilj9fSCB=(`bfOX0>
z@5M_Tb2OoHJw#Uky)&n{2aXINi7g5L)AnDSSEgjTvoD`gI97I>uz{^K?6d_I;GNGc
zgO>td;-<x$ub>x&v<kDKhSbj%M=r(N`Q2Vf@`dG8vJ86IPiL*tmKOYODi`}@!|pcy
z*ov+YPA>b}^!Z$`F<tfTHb88j(AQ>F|Hcq&<!z%R#!#aWMmTqi_1(q(#s{PPpQx#x
zEtLUF_HTYm-Z6n>i#W$hNZZysd6tE6TAp{@#)E#ZB2V;ZW$3*-4!#5L!`*r2ACgY*
zE9G&Ms-a1~a5tCktBP4{zlnRTtP5gLuIE7lsO%2(2vgJQxI!dFZ`1=Q+1C(rZXbz}
zo!8~`$Z+g^4+prQ@naBKs}lo)e1pnvb?Z~Z(=v`89pC+;Fy5P(lbh0mTW(Jecvn1B
z6Lij08gri<rt^rp9hKl$9e&s0?}o!nZ?*W$KxgRJ74)#Zu#do3&^<Ouc=c?@!=gp-
z24wFizB!Lr2N>FTN4ft9F*^IB_yAvX*K-+f=}@@Ix(HU#p)~#O1!<X2`Z(KS-E+<k
zzZ$WS=(uYU?r8IzmjPzq`Fw;EgC4-M9d`$(6-IX#I+!XCoHF)gE3Nydt43{GZjWU-
zF}qrozCF6`$x>dfKrmd~uM-&zrwhsN4+}EWPw4m9`PCCtE0>a<D1TXhEF;w3@0<Uy
z+w){#fbIN?tI&wgc-#_~-^RcEYZZ`M5qjj9S3a-{h?*R=1VV<(EAjV&eezescyxL*
zE$7;q&Fj)<^g?;L-w>uj)BRJ*ycA&pZbB24!}AiQQ7>6>eJo%E$8#NsjUcC@A_Ghp
z=Df40{%qsZ;q(O|B^v#d<@2S7@2xgx;WbJuu|$Ljan%H2_9y{ZCnk^<vBPNJt2y*P
z!!yzC1>#tK0tHMQOa`PdL=z2l0=6&}d0&maZPwCt?-t(*3f(tb#taW4KHp)nf8NRF
zqmtl$_OcB2=0wQjrGTT<bVaK)MFUEufKT|d(zF+N<iun(!p;&Bok3&p57Mu`Om_02
z=ux^V&(5U-zBoDu%K&Gs(8(zkno+msA=768k*F9c&%ejv#*CT*Rk>K1$PqssiQOb)
z4GCzN?-x_m$Sz8N-_1alzR&7(mWITJIla2iq1%J^BBItY2zCMTb?KGd#*Ha?IDWjl
zJlM}V4?gGsof4OVZfhU{^A-odwM#z`N4IzEc0|WnLdp2U2%DDiIm=`5UHO`-{5Dn-
zD*vkn>ex8P%tFo_WcjVKeayP7CC=i(+5J<iDC<B+B|>#~uIA|suW(x{Yd<*5R9~@T
zs`+~+KvfGuR1;@dPwdE^J>HXckRyN>+4tIOmvG|`5(gW^C6dr-$@)8R;_%rPTmJMs
z=t^_ERMPm1_a+p$KpEVzi|xB$ISZ9M0`xE-R@NSsNQ+8!em59<oSbU;o&SYku5drb
ztCc<s6@l74%Pe=XHsmg~XGb|658x^^mUzyX5+nRJ>E?NP6tSq2KE#bYIqULF&TdN{
z)o%mt?bdDQpN-9Zdiq~qK!q?^x=}K_n)Q3g!W7-HO!={!yRTmH?_;Jj75^IkE2|M7
z1+hJbgwGnUgp`7gqukgrKqvyu(N8o{+L)+koxb0*+&iz-4EzNw(V}azs%#6R%>nzw
zGbtTbI|!BGD|M&{y{ELe_yUkrnkUwFeUuEHh!~6$u!h<1(wag=kt70*humlf!k!UV
z;IBK&VS=U&LO~vQC^=V`^Bdr!$$&t12%^dN*YJ`e65><9Mm=L^DQ$dEa+vy~p?!2-
zGB<OTk6-rO0AxZs)Stv_hUycAE41GB5s!1O%MINwsGty`C(%D7`SF{k-CqkiZyrRx
zDHY+RO*@@z>#oWrK-HJ^IRPyz@T-GRU!ev9@%{4{yjtUlSu8iizOl|JZ1q%20%3aE
z!NbA!$?w9#n8ZEnUQaFadkpxX#cw^Sd(f-Wt6c&9D(mbiKX?h3yFx8__0jj*hOPX$
zk#=ayvaiO9D>UD8X=zn&W$G1akDK?YQ%U877PTLOt<rVo?KQVC{O%yF18IRljCAMh
z^VuAb{NuTDxTXPiy#DBf9Ppm$*>t{on@iQ*48QU;v_N+Nnh{0px%^H`w}12<zhH9f
zO&BUbMrs_Jd+%;d-Zq`kNKX6owBEoP?epot<|jXG5YBTQpK?a4d0lCipQ=Yt{;QJT
z6r=a!wkK5Ix_8lvr7A2;^oQkayP_v8(i#|5y(|7Qy7%IZ7bVC_tpP(PPU~tuNamNQ
ziQZY{AI=9e@vDbhK$xVzC(zH;3P1h5?eStp0rt)j|0ty4vb4l4M5UnLS>Ax13=;L6
zLXPwl^VxpyMuqhwa|eon*u?3#YXxhFlzwCJ_DQb?0hd42mNpaz{G6V)6HC8^++W}f
zcenO?80coAtHe(70&5GAQ_c05YJd_=D#EbL4s&tCalflR2R&LhAHXNN>Xp8)RtnD8
z+P8>hlYfQCDvQ|oexY3L-)AFluxS>R=)4@*gekfud%{*Sc^XQGyW1>H3;+gC&#Qq*
zo(y{A(t%4e$8|^td?3ICx-N3{d9P_)4MOYC*7L&M&PS`4uW=%m+Xq1kr2G8%?XMO9
zc=mApTXHMs6e1pRlhCdh>UQu6>*P)QBl1Mc2h!ke1sCPp^1U&aEN=eo<=ezTMOTi|
zf%K{@UcDWAQ+ho$OLg6Jy~1?JBzYNN>iihB*36{(;;~EV@lW%iq1`n68L(DhU+eH#
znz+^8fTC-b?(s(RQ5vpI)e3tPoRrg0Vt3*RSxRlr$#kErvR+^4JMq4qx?+v&F?CRZ
zJ_zk(+&a$D@RkFi2lxb3>Qa&2Vy_H{0ys5{-*Hnn&Qa^yi5nQoRnx2X>>Z?7Y$xBw
zi6!N_f`0`M=D-#B!i(;=Wv*CYG`5((#`t>5hhwoWs6-6qh=;6QQgjlClz#Yv%ahiM
zJmWaBsT)imgHM~U#yzeeyfi#T_C@GofJw{&dpUpmt}{|Ku{WQldm8bH{H+TMH^k6m
z#PfGW^51~?Zi?}Ip{b!{vpc{`ZTDA9Q<&PbXo*$8^_^M|E6doH?4;J?0sS!<NfVZC
ztNEG#V*zY@4*q-Eveeoeg5g4>T<JDI&9Pw=(ZSxlR#tft+G@RW^V7j~)VwPDD_5NZ
zw05qKg|uB&x_U#)Ab#0}Vy_J$%?+-sN*#!+s9ayI28{Z0vTAy-*j*5<L@<Z!xy*GY
zJw~WScv(-PW3{V!E<#IU+->;yd=K4_-tZ}q=XS8C<a@Vev&c(@C8NvDHznK;fof%$
zmp2L@*KQ-vy#m<yI5r9G-(yYPuUuz(TJ5u}3yeHHxnF%WntpmPUwQY(kM??7@&<6C
z-v;qot-C`#@+}AVe(o0s5tX-)$Ip>t36k5^6q%dVt+3BGcaN9mvyWF~kDBm31<B&O
z31W}O^{%i>-~Gq?l>`09;TovyDJ2v$K)ChXb~fnL)eGLv#|H~&X506~=@j$Zh<Fq^
zq28G}i!c)RRlDGvDxF(;d=PxBW$bf@6Fx#>1{6+dn>gFFoMGW%5><EY_K!MW)sgEl
z$m;`a-z}ZAGa-r0p`vl3Y4d6AcNzoCz4Ds8;I}GnFr&g!<|)Hos}s|Q1y)%qEeK^<
zlWU}C+_bT$AyrzN$c8ew{?+G=f74^DEU3fdz~55L^eUbXm`{JquU3pvjWg#Ak&3LP
zUc8AO*eOa;*n&EP%PeBG9tA=x@VNqDYTVy7lU$riRz9TnEqF#zRT^v8$m)`09b(M9
zV>CDFw~K$KS1dn0)NMnrG8m>$CirzAxQYg&aSR&5ZM7a7iX^or1m{D=R!q-2*=*7{
zOcA{)(XA>u+32xYK4;Wb=#Z!6p$?go`(w(fn4vry;-m6Lo1>I@Tq0XNE~%(5uB(Ze
zq!udC`tF8gZrkoM5sFb*p~Y3A-er^tCuCt?g-F5sPpFyEw#)s=FIpGOdN$BgDl;ys
zW1W0HS_??p$TdrR7HjJ_d{kZO3FPLCA21PYd;QjsR3#)b7(9bX+Ai7d-Z?%{n+*Mk
zG?8dLsie5Or50{+Xd9kXKWKSaI8oeuT~b}Os!!N@Cuko@{8L@(q;i|d%xy-8wiQZu
zn)=C3k^$S{@wCk)5Oxah5|G5|$JJB4Xy4>EdLx*{ggmbi?%1X?b${<O_8VFOUb}Sj
z17%L&waM@;Yv~x75bOjWLmt9_)b|W&lN~Us4qfD|ag3x!{Rn>Pm(Nl$#)ZTcEB8Jp
z^jI4TzI)igVC1yqeqKpKar$_&S$e(l^s?77)b44N5xTQ)ktD(OBBV{!`N6{PLHOw-
z_;G#X{Oxa_L>cD#hq6!h-ak)gD?KzR3qV>$!H>v}+oEqw*QM>(*pK=jjDD@MH|HF0
zHG7V(wf@%nVT(0wS+-zi6Sdp)IrVeix!0CC-LJ^*3#&2Fi7?yl<k(dlRVIE*1I52q
zU%}fS&|w;Uct8{Z`#AgJ`PY9(8blg!OPP|S!(@Z7SRR40A?YJ_b8&H7UXR}>O1`tN
zORjY##!uuQBkNU^X|fE%&bcF3_8uv5Gb%kKo^&)(&6*h6%d4jRVUxz37DuN>eWg}7
zqVI{b8)|&k#WE&^Nn!zb?ct8LNqEyWdY+A4aemg5<xbG!kD7<UCBT|(OCltLlZ=x>
zTMvX_^gPE}Pi7oB8W^1(QV?sgrE%Gg5*ar4U5z6Z0>Kyw3~v%*c&xSpP{CZ;=X*u~
z&QCoPii8Fp*@=w>M{)tV^7HHc`_XrQ5c8IUgMH&O+&p*+>V_vA#@`Fj-c$sv@DPk^
zKU-nEi>$C0`M5TDY&t6Nrngv1ZHuj$GM~69ObM?hAkufFCUWwdE3VS}$xa(W#Ihf<
zoHZ_{3VC&kyj|98A820OI_G<f@wk5o>KL*nX49jf3I^Wqg*_1ilITC__nF05K1Jp{
zvdWy&lmc%vE2mrtfx2Lg8#Uv&$U@PWq?PlM9jKEBLj3UsmB{`G9Lw)@9*-N^f0cbH
zS>|<j(mvjIKRuuMJbLjMge*1W(=v?y^eL7tK_{`-9-!oYg>5AakpQ}}?>}qO-sFw(
zRD`$qo$Z>RA9squ`-eUg{1M-K1~@|%c3@Ky)csP@yz%MBn)i?+TjtUiTE1l?>CsFM
zv(S_m)XzV!Pt5!Mj<Og@sBWKoHkwel@~Y`R8gD<@i#dpB%F5`o-4wpksJcyaqp??x
zOQAg@KJuSfkTEG0`8|TO9-v6$II_`mL(Sbp?X@WInMeos7bkI^H@_X^mV5|(@y|r2
zu~3oik2K9xozP_DB5XchEJML<U4UcgO7SSBci|zNkj$JLe1mQiw~oHP5QCidwfVK4
z7Hykf93?_ORdlZ7oIn%}O9gpcc;Dn$xBPC!4Ie}=w4);rb|!Tdvl6A>&qr^h`~s$n
z8HS4I1O9*cim7x8&=041d9z){Rq%Q@g}1?@hVCjx#y2Utv@G{OBF;*OKOfe6ExG*D
zzT(;5L7KrmYd=>@Zh2qySq*qHMB}f)VZFt*jxN0=2L?2tS-(4dZtl547cKs1@^=v^
z^RZTcA;{B|?~C-?*XN|%J{XD#s&~b~+U`Ez1#&s`Vox=Iz|9#-wmV(|rz{@x;}l8R
zkCEL>E@W%2f@h7y_nik4Yf!FPd|%l1tW(zYlzj62>Ms3k5(1`Hk@+&n!MD3cx>y2u
z8GBvczV4Jso&)rngDno3Zxl&v^Ufw@o$Vc*uAy`)(GEm>b*)u^8_ubIJ9M|i9&w$e
z0~YM1@VRv>eyl=uPJYF0NQ#jm2p_MUO4p`+x{QCv3{r(-uinkMiG9oQifLIZzdNYB
ziR`>T&+=$Lq3*zu;d~0ZfOfD3!49dZfyk%8GR;9CR|d!|N7{Yb6WZe&so>URXuL|!
zsZ^=7B7nKpJiz~+Yw)t^MPKxk#+X=#Di%$0eB*Rx*6)65eJ8aoYBQogB$@_B@)y=*
zpYfWK(?o{Kn)p@%KrEWy*-=f>Mpx?aAbicaIT>~{8}E#vWHL!F-x0;>fIl;Nm(IcB
z+Tqv+_l3NC(#=F%R0&Ci@tQ{q<0IWcHWI_T9%Zj4udV{3a5TlOLhB8!OH|7Q40N3B
zC<~>*V#y<%ViHYkQ+YC_^B^bGpb+q&g0K5o?f#a>>z5*D!WD*46kE~&H6_FYl@URy
z?-t!I@}y5#D1KC(M;(fEi>tC_g)q~DFu%y{w??xO-!!goP={lW$DGGLW#U0=pN6%@
z={`6Yqq{gfH#BJwB#CgLO5_;?gI={oygPXdis7Cp$C|LDawb0%fJ|1@zg0cNGKt+T
z`U9A=Imp_q^i7S#2%9}W2UFI?a*!`a%o_0gz?z%tRC`23lq9tyw47jfss0uc_j2c5
z0!*;!i}5=ksKRpsaH=VBhCDTF`&8sYsP-7i7OZ}aetIuCn@9hEe*OoVGVbXMf786k
z7-nu;(tct5kau9$d>2644n#<wQb3r!VGT%S_^*a`CWVasfe%P)Zg)NSPd4$AyQ6V$
z4S3JE_X#D}pVr&gP>330PYvM-C(lsEoQvCtdAOMcA5b#wKc1gTHrySr`Gr*Ix!Y$H
z`q*49Af8_(^SG>^1Ccq+-!|Jy?$@r3$bd0D>ks#Lmb6$V{+bYB`wVu(^1)cz5!<sf
z#ugr&L;4MS<XBeL8_6<Fdo`~MbLZyU<5{0mpBNso9{4{oi^urC{mWUvmLaU;W*G7s
z{+40fNedZyjshV(M@>q*!((!(EH7^{H;Okn$N%(-d?7aCmR1kteED}>76o`VOiUIs
z`hKVA*T>muiEn+9XKo)c&nHw=>SDG}597H%oit5Ow-ffwH)7TiPWQ~_Q`v4Yq|Ao}
zU222s6^~+r!ChTytw_#!MgEH8Y*9j%n1Td|lq9R(KpZhcI*jp1WHUgV+jrRXQ^1TQ
zqcSrN1AtYYatB9-o)m`H=}t}p={MNB)fMmsCb%|xh;oZegs{fkZn8<zDJfcQ33A;M
zY@H9850Ev;5b~VCMF(A8eq&@Itcq2GhXm|PWk8F?wk`a<is@)hwB0M0a>z$!HI(D+
zibMvOcYOP0-&|U%J)Ok~6LJtbHUj7|{kT&kIu{L(;5X#p1e8T~r_ZPq;X0N*Ach!X
z?_OGKU%HmX_+(fMsa)grcp2<G<iGk^nSj-Pc<%?c1ADwX503GWg<myvl-~6uwK)<b
zWyN-^%ej5bdiV{b!&0W<m-f6EkYJZA>7NB~-;BN~$@0CzFQU%0I?Ot^0_wLNt_b&J
zkNh?vXf`mc!t-8olXz1Rb%Pl9{bsOoR-zMgLLmQ32+_^`sA^7Pq=2P*=C|U9*f{u4
zO)8Q+p9H_BreD@VjIKS@;H#aQJ@IXnEWAQ#>nsGr<M&ZXS{*l~9W+oVw&acPEMWE2
zXVcuViFf{zx7FM~tRJ{?u5+9#=f2{3pFZyCxCNShb%=V?FQ1Kh*s9b4<=^QhqF$bw
z#@kNmZ5g<6fK&QA!S0zBmVRE6<6o0`)u&pgM<nCswno(mIJPz1hNtU!+WClW31_&c
zTb+Lyef&n7oi#y}{Qd8{jq+J#Qxu!>i{QFCPx)6|kI0(uugG5i+ADXtD|_qZts*eJ
z_OwF&OMf{Fk*9wc6?^}VTq_kY<QN%w3UhPs?a<GHTa+A6iTT#29kxbc3a0HZTBQYR
z(rrC&9COs^JRZ21fi=>wqE5+Ffr(;A=nxBvydZ3}1bRh#%S(^|8dsnXQ{n#}ySL7k
zi9m&bE<`F@(StYaJ<sa0yeH7ZER;87x1>ZYq`va4Q$s@d08e^}{lnHO62p`puAt5=
zAvq9n??nh#NRPeueb;~#0ca|GfLQV*Msk}p)At^T*r2;GB5phc-<=IM7Z|#(Z<eMj
zC=@rbeHe9Y7(ZKQoqKH|d}Q~VOCbt3%Hv4UP4eRES$5|5XFV~{ZW7@==BmG7T50+7
zaShI|?S`Th!w_LCTc-tZ5wTusyQq0JMMBygA<a3IsUzk{CjMP&m;R*pHd2u-n9#s#
zgM*n?XBjzz<^x3nulDct8YQ@A+fHsX!GEZFTm!&_M}O>$Tn5xax=ai<;ctg4pUjJU
z^xDIwI15^~(JRo*CBxxhevi8Id*U8y86F)PmTH!^UeFtw41-hSAKf|sx@-`Es*|?O
zguE=<Z@+`9)sm}KvkHP_Yg9zbcdJb~y#|A-JtiglAT5me)|b=M(;*&ThuYqGx74Oh
zybrohUUA@ebaD)nZq(n{b<lskuO8$18IIp^=H$i>0ZsQXhnbRFox`%34K^2b<R@a^
zu@Q3-gT;l;#FTvz$~O}=j3XY&o+?2C_jFk;6EAES(ote~ZIALx=EWCSq@+E>>hzm9
zOgJ$qsJC5A^fN#|BR%cecYeCa#zGEz^O-(-k4Wp(GX>XarVN3i;WPwCG~E_Ql@x%I
zvcbH}kU<xFh+tFlcmlmC^a<hf>>Ogk%w7@G-0oSBmFZjY=%ItRZlv1SC-pK)5Fp6D
zH~z#BfIO!uIx5d7pi~=`>7S2IZ(?3Lhef|w?N&msj-}NlXozGEl3`-Z9sl;CX@aiZ
z;y`B7-ptdKc8hAm^_YKuujOu^Din>9?|~kewHFd?bbylAWg&G3|C|$1f)nlWX6Auj
zvg^%z{Tu=6vmX7xzIli$RXOffDa6tywTb9{??XR924!>-LiueffYpLq^JF!I!im_)
zm9m&ugCpAGyLFV=*g>W(%DsxJkn^Y&LrsG9ZJ9q2dcnF6ZL0d&)5?D34a_ea9q!(f
z^-ESlUP<2Dowg-GC+L1{Q+}#U`^C_<C2ODi+)t=r-ow`>M!Yx~D|q9HmD5sQ;8WHp
z_bDd;KDZD-*y&tly=dROj**kNDCjpJlOO_3<>o?D5yppwWe%f_jl7k5{<#wa8fG#!
zPwwcDF%Y=fjJBRa1g_83w}d{GcbJZE7z*?I@^DN<5ckhus1D$jHjES^v|*0+kohDw
z<YGhAqVrY$+O{XKy^}R50gjto9}39Aiw=o*?!$f|8b>0(xzYPF{r|j&^@RbohTW82
z6-htAJ|x_j4d|2-u`=8oP?Laq@64plt+T*eXPOrjng5D82`h$Qy*(8XkXN{&3cgm=
zcfW#Yefve7Vn@8Jt`@gL<{N!~5tkcr3{S68)^Oaj1zy@cJ|`Aq64G)<CxYhgRgW!7
zGLDpVD^`%XcAz+4yf`w0q56BtPeYAQlYQ<WrVfso6Ls5n^^5kOxX?Uuth&BmGuij1
z5!a3YuPud*`53NdL!8;iM)Qgsi|YmRvCahsuSP1l`nwphG~I$s-LLYy-u>ZR)e^cQ
z5_*xNPkyp%@eXoc7rUpCuu%Dppsv{V{p<FyxD}33t+*Ps(QW(^$=i`UpA<ndFDC@g
zh|%gt;8aF8_^*-ffx@%{%scJQXVJg(1(7HfYY-3qQXbPX!1k}pTGgG1mjl%9Z_O6>
ze`dT!UuqM9ETLStYG2B>pAAM9qx6bAUdQn#NoqyTb+5!sRErzblrdzal!XS1N3+R)
z9X05x@d2y*x1z_KBm>{4I$*_r3y-Iu|F_6G9{|<6v-7p04%pz_XXZ5KIrI-!No}N9
z8&~cT>4(z##&vBb5@z^LIe+H|KPM-Njno57mYBFSa&cG<4VK=6Z6lahHGy2N?>b$_
zX_Ks3vs0jHtj>x-m1F_K0KdKSSXKJX(TG-mX!`g?(MM#+2O@^#-<V^V3`G8M=cpki
z;SHdFLrNHkOv{z09RidoD4Nk4u`Ef|Bpv=Yqa@HzfD;qXIS(Cc+Py|7*lY!(cu2ZS
z#pXjHYLR5($ag6Y=qZ0vI*Wc843ub_tewJsYQe)QkW>2MPw5K_V=@Q<M@d=Ep>^*#
zVC-d~;p!f@tm6~|{jQa{E3lBbX6Wl(M0IjPH+K3ZNUf-EK9S;|+40|{s|1MLIezM+
zpU3W~ynC!mmAowh2|5??*=~Q0{PaziOLLTcWH~;7c$k;F4?C?^CV_j)VwIhnJxSB5
z>t8Xjrv&(8DqudhCDK6+k$q`fkbq*O@)-FauZz)INmz3lkA2b`w%9|f8Fg~`{f5Mh
z8uutks0!t1VEWp^e5K&W8HnLO5QLl#HC&693g`^LQuEc}aYi+x`9U}9Y(x&J(;39g
zJH)`vQDSPWiy+8LNO08p6TSc(U9|9vSnO6IQ#rZTa|c2$+FG8u)JiL<7!it*znUM-
zO@vnD5IOb+7Zkc0fC@y@-ZwHkN~iPpn`7Vn<!(bxa?IOvx%3*HxY<D-?;Pr^lU>DI
zUTfAPen%{)kuK$nUMTaaE;d9a>_cA2_gPH-a;`3T7IAyznlIqOaB{ZY-m65fV*I-v
zJC<U#wHK9#=(9-oT))FnwGc$Qqlw~0{I5rEogE-RaW3rF{HhVc*_5Vf^#5>mR$*;*
zU9?7uySsaF*WxY#+EU!z2@a(cr$BIuYw_al#e-|G;t<@ucu)HM&p8+8$whLtFS7Su
zYpyxRJ4RfKO@533&EVJ<VqfNTg5wz+@w54z$8UO;M<3JnOP*Qg-$iRF|MOHeqQl~`
z0m*^rqw7WOQph7#mq?57fGK>3Swc6wjG2m*E?MKvpVUFl20n7)cZ(gsOfLuhtKW`w
z#HC4ER#~dlx!-M*eP?{SgwL377AD2VUcVvOxi`OCepN9_yVE?7g*1QgqxgIz@LEK%
zcqnuuLY)l<Div+jvg&cQtmPNW73kptRkA+AB)sJL_ST7cD36=ziY@}kX`a_S)R&W*
z<bg)8*pW`8)R~@o*E1-U9;oco1K%7*oM6xb9QlDzFAL>^AC0SUeB4}>=ctzH#B5lE
z`PiC$*8A!)ar+Fu9skLfl9NZbR+>el5*41DLf#w?v4vM~y&hs;PrD$KGP15bDnI_f
z)d+dT-}I0s(mAQX=8DgZvUlr$l_~vyR>D~@ogEEdzE^6GxiqRUCGN2|I5E!b`)6AO
zs~Bno6Esl>Jp~w?3{HfKg-S2W?ZjN|?6@qZr65aFY{n+o4w9s%XwGksx1YyXNQ*52
zbIW`n?%SAAjES^o3}u2jix8y3|E?r3O??T*5N6k5P{oWTm$4}T;gKuRyMh#`;-fCv
zWn#VSEECO63jR>=^lKpAysN&p*E=2%{9G;O@$+w>??hs}YRQGum6N0Vw~r5Oaj@~>
zK<IJpHSQGRJsgMU$T1e9U$*cRO78V`rj*DX6hV}xZ&Q6t(||Fo^mZsLDuU+?M<v;o
z`}l8!#GwR!LCy=_n-Et-Zs4SCdvvr&BycO%;$r_2a-W=gty?S2LasG2c-TOiSPn+e
z)j^z5X*3&h3(M;jI+L#w#?@^y>fjLe-(#!IM7F?dF-Q%pwOq|&)S%fe6uUIfIrxw)
z@-k4gFo2wuJleSf&x4Rnc|0Ih8g7}+W$7jL$PJ5p`?t|O&IB!Dc(b&PlP~H+E-~;Y
zRE#*ofb^%iEGjpo1dd~m;pGqf!c<hH;t{qg8->c@p8s^|IOL?U+V&dl)EFN!lo+-u
z#k0*@cb_QMx@eOneoGTunsi~u5BfNngz;FO*XHJ`Rx2VNNJ736Y~&5a5-dg-JvUqS
ziMB{>v*g&KK9w$w@5EyfIcqd@C%JB8n{VS%4jW_EH-93Crw@o;oDX&!YwqkNU0qFA
zm!$CNtqZ!>h?EHYCRcD#&+giv=lPF(!jV9gE0tCv|0XlHeD-bcEO8{u?d$9=mIuXK
zLCrvSY`1etH}`--u~=^1r=MBh)>ouVNEsV^HwHbc44+~iu-G>&{35^?hFjCC?G-&(
z;oem;;49xy$64({QX6gvAxX^SZpCk_Pd<)0o7p)zLn?ngo!?}+e3@1ve5q@jk4mHb
zw?F;+Gze@y{64g=9=63Stvmu0@=6vIB?MyO7Y$wFU@vjmBQl1b3^KLcAI14KD<D!Z
zC%moxD2x0O68@0<b;w_T1kIxQox@Zyoi9uluO;BdBp^-m$2@G}4YsO>%7D91=$9Vz
z0LOmswzkSt)d4t48oQdvz5CnH?O73Ffb0sQ%rlwhlKXIjs&JAF76tm;EajZ;<*bSN
zbJ4l^-MNN}6KeC3@-PNq>HpDGG|_$W^_8!yH3wSszB{4Bs^PGb%43wm6IEQwvsVy1
z&<+lk_|bD2oDE~CY=!8_qCDtmRVm+%2Eh%$7iHCDz%;J~$DKQLlSm0Ic#=bO@$7KV
zIuCL!(kSGcr@ycwsS;MS@%=njweiFWW6(Iy=&J1bhU@j>RjLmcsQ5UFU=m$@L~_Z0
zsmSh>zKQfzCCQ_<{v-V_u_rHW6xqjSv)lH0M5d#kVE@Oz&-8*csYwQbRe*Juus~1Z
z!*F-LilJmislF|^Mz8Y=r9pjP4eV{-e6$PVWidWo(8+)nPF^OlYg=VoX6K;uj$aN<
zeXPW9i$kt_-*G&x$Av@bM8kvvp#Z`WO@*F%=$_=cfQF+u7wZ}L?JY47C}7=`1d2c^
zCFXAlGa09SL7uvZ552o|ai04P=D&fe=singy7zE#OxuynFtNYuLEUT=zs5aj+D*39
zgNEEX0)-<SM!%k*lR6LuZ8{q+6R^HR@6P?VRz+m7eDhw^v`aajYe>aB(0vKy{8|5*
zHAVBWD0rgZP->To41L0jH&19!Ks1*BM|b*}POsU4J%ykjg_J<LCBxVNvLUG$6UXP;
z)yAz|fcfGC?iINF>&|v5@cn9Hb$rjD*6M^x9G$AR@Bg|oMx0nhM9};8x{3$iBtWK4
z>Q*_CN#!oK1wbq+lqz>DVwUH5Tdpj##ThkDj#<pE@6n@#&YBe-Bk$iX*flRLHoZ`#
zVi#~?eJa(aStkqSF%}Z6mEQnkh>bzK`DZd2!6&zH4(a=FPN?rf?u1TXh)ligE5E<g
zDhdiPJEg)QdCRc1>Y!j>ww|EF&t{+XSBDiK<;H4VDVm%#`ek45w_ZdN13z_k!fz&H
zW6e&i0Hal<Ehw(~5@ysn-`uykfmx{fIn5$a)1d~WMo(-Uf$UiRlZaH2i@V(TNJ8^)
zu6@gh%OwJ8uWK{X0c2wQF4`L$%MTf*|H+W&1#x{u+?ir*`{z|Eb3z^IH(ePJboH_+
z^W^hPvg}4$-(gu<Uf+eWX2&2`2P5CL);#R~6^gAHS6TI&iZY*y9oH1XHw`8J6#efo
z#8Zas$s_yp`&SSf48nZ+%iH!#z_<8dSu$$6!{zU|^<a9xi$F{FwyPOO{?aN>maFBZ
z943@A@E<J29bpv2Gw#>JYckm{QlgZ3y(#>aBAAE>ZnFK^5r6QvJmT}5?9jLnU7e5L
zj3Nm+(Drvp2&<A4@pfr=JEF?p`!-P@bQ<b|>0f6-9oPv+4HcQEnwHl)lsOctdM_$<
z#-pA2+rJgrvLwah+Y&^oK6`tAD9r;{)(yv`(E*TnK6;SfbBOy9m4-vnqh5)@r^M#(
zCfrx<nX-ui2N?O2o<yEr*K4k-c)PCu*83Xr)@x(e6W{VN#zZOOsCaw9ziAM`ZVBve
z5b<(-PF^0kd^J6$)&|q*P5guO^#>zo#`5%<R$2Nls6@a2>j<9IBa`wi=uatbnAVwr
zK8!4>p6SRqvIZ8HmS$0Xp6I4-&@1HaG(Ertt2#dEt(@L@xqt>98h-8(NH&M+Px%v)
z?5ZByEKD9Ay2+NpzbBn@CpyU+c96F5k$NsNH*}^|VxH}q2xpE11!1+^K`m&7%=cm4
zzWytr*KDo`E4#h>$<SltiU$f)6%D%7UCmqs3Onhwx4Yh0&eF%KHn%@SJ+eMD4V)sD
zQ69cRJnMOg55?F50)FI?-rak9Eq>gGw_V(E7z@pAu*xCYC;=Atf9m;!!M^92!nUc0
z*)XALfkMrWf9_ez6B~{+TUVX1c}Q_*_3^||gW$%J*U%M)KREHNKewkj5a|er6;$GD
z3rrUyuP%xejYuR&HQ1hNWW<3{uCoAm(CEOASrcl7*$|H#Jd7!r8frGB04w8*GnvbO
z53%t=kQgUbTB%P^e0t?bv?=Wk?-@9l5V<;NKFkq(K=y?4q3f|)ZQ1*YL%*ieXl87g
zCN};!YT|C3?j%q2D<R^}^9Rstvrjm!cmwB<RgthLbsEp%rW~T0s2Ky7{br(#*yej*
z3`W<@<i&?8f$KpS?81)Uem^1gCpnL0zuYX?kKAo=vM*{---N#b_jB|g!xjOTYA$6-
zQ}ZQB5oM+bmmjf)7^a^^7{rmW`dAnAx3SErsM?ms7efQKb$zI}^9k(DntegauJc2R
zbd1+jMF!b0q1Rq%sXc-AylL(F&jdAI-7aM6rdskKDF?*r!+ARnu!-p};PSQVBH*}!
z1B#DD@uRz!_jsru9oJY?phC(yHqz?o56NSOlTjBz3`AgezF$6m_KL{g*OB}?ragzI
zRGyrP(9X)s!-eOU+p+{IIt}*nryt}pjbu}523>CC%(2*whhs;RKHY8p6M27CZ`c2P
zRrh*YJA;gKi@#5&SDfjYUkG|!>ezUQI68m5!>MR6bX9{|)i60s;os`j(oG52aL9z!
zMer)dl?2@vYZ#%GR<0@6hhbhM!AaOttC#L#-z0zY)FI>U|0LnnLb(#616xCC|B#!3
zAdl}OY44T&KMxpp-`j^t?35Y`&I<slG-vJ*KA0I%dov2{KU90A3-HkRw9TEd0iaoX
zB-g5>BX|5*pIs;wO1J9_w{01Q*1DUO`rc$Q!IT7b?M@XRKf?LB9*vylfy0sEs8+Nu
zld-8v_n&)1rF{J)uW&a~BRfkN&WmKyL6fV@o4!Vf>U5}FW>TOihLgTgabiVZXqGF0
zf_%rBgnkItiRYIx>XVW3;s{4qx1%L&3k%_)uXK5zW!4fXkN*)15|KBrd>FZ#NJpG^
zW&Wlh!xHr}-^@pF6iwVU0k4qQ?#n~tA``IbHc~)CTOL%$pL4myn_`aOKmepkYNZ<S
z9o)_qt{iHY+*ViQ41CRvh%z7eO-!;FdTedz&av$%y5bAj_UYm{<>Mgm7B;Y8HH=tQ
z6=C?YupAeA=ZSxLt@l!?9vTN&<xfqtHQ>~k>IR%B3unJ-LaDxxt^d33)y4Zo)r0+h
zatz(?Rv+)Y7%6sxCx3P-wbhhx>vZigH6e}CcqB_IDsOJn=b*=tq%|dyK0^#$t4y9o
z_raY+#b-Yes`Jr*?@YJ|+W+bf8C+&aEYw-_+F74ycNC^w_<S3-<wbV9s&@=l?3NO(
zip}o-)Lw5Yt%7ser-i^&Sj(8rY{liK^jfmY_ndod=>go1dx=2qWHA2VQxNX)$aZ(u
zm=hOmGW_58qzXRP@=NStuJ8|3-ZX*2->SvY1wzDOg-&&EjpA3o4NpF?wy}__2Y(5<
zPuHnUbYFzH=CYF|;ait|K%LbOviN$Vv_1a&aMP@?vp7<quf&mrd~y-s)5)UHC-I5i
z&kq$!9?#=D9ol`ls}VFUn(%uZsDav@kqK}9EhKaU*~E__u2CpRt<!$<3N9{^7_QpB
z!z{Je)BV9i>JYvvaPMH7s}P=z`-QPjr(V6pc?)Dk`7nDJ+WPsMg6kLh?W^|_<?EQV
zoUtogbuzj4Uea$MLNxX0R<S&OyvV?}^j%GqE32yaYMdeBiI!Bqb5OqgRwn$zUHl<@
z_^bckhj2Tt#(ksDN3%a3IasQgnwD=`GzIUBQzflU<;8E=YwORtSU>C^y0D$Ldy3=?
zzpJP*pSdXo>^4q@lQAggF>gx%-VT+cUEU1|wIbN+54M3UchvG1f*g|3tG=gzp9wEy
zyMc1MBU&`qgue;X4CFPWf%cNhEc;8FP7Plc!;MA`+r#50G6<4<RYViD=#e3C&WopM
zkHh_;XuMg8VhP2FBT()ar(?&O-|zpV&>Jh$T=ww*_L)ODzAPLk<&wrHf5#k`St=I|
z!(|C4Q}r??;~wF<Nt}cAB^3~#N`hVXBW7CTUSNSV`y~a{o<lu5`f?FJ7Xs?p((<!s
z;`yS6s(Z?IRDMh_@efY0ah5V%@~eG97;CWRwd`QT!YJep+93F7`4yBhLo+1T-)cf>
z{<o2EGXn*<NzbX7)qU8rAuO0c(y4DoUL*$zD8%(+{=az|hq!dPC_!d&9|QS;66Vy^
zfj!~aNIf{l`^D12H`0r(_q~E&O=)DPXY&)UwcR-4+~Dndz$%2z92W%p74RIU`aKJ~
zA0e%C2>4JnzMg626m(fEllw@?`rgIEoVMT6xt+>M?Eoj~n_eNzb6|9O$>(yevWvI3
za~YMQbZ9YWS{a(?mJ;oq66KSgnWqT-{?*eG=hP1$-hmt#1PdzZyxxC;P+T5{ImLV%
z<NHPBLT5Z<cGQ<$T?DtVKOLSJv7(cH`<D^x<?YM%!RCbssG<MXM`#USTUU8tiNXAf
zMfy{}WoLFm%U7y99mCU~2i=Uko-9HZE;=Qbl4K_7k=*5B#J=dNXN{g9#uV1#4DXn6
z;*kC+9fnYz$JV!wDV!fC0QFXDa9XZ&G>!!$ch$o(aA=#|6R$hejo<x5I}kXqHHPo~
z2T;=6Ur{01%j1qxfq|T4Oa23tL{bl_61Ihx9@yncAO9`xq2$9)_pQD~;{d85W9Ae)
z`!_QM7+?M>LiJiK#gA(Rg!IV+2d9~m8z=d_+A7H!Hmm(I<b;!_97Srd9=Qv=D81`;
ze`|jXvqszx$55DxarJ71)*2_pqfknP!5giZ0!MIgxKjdPprK1Z#?S_z-dT3Z@S9V`
zLsEkkX?o0&C1zPtX=MxmW$TUy-4%>7)Cv*u-CX&3iqMhII*9~N!lU`r3(rAt!^4a?
z4UgSUg^E9Od_^+oPF_A1T&=d&wyh-4bh^+pt`Z`mkx$SIPu@jP{R*%lx84ZhCPT6E
z{0<s1i@(&7r5AIL>}*;+!$TY;y8`~T`&L-Z8oVuEu*%Ol&D~d9ht!KaCu8o_B#_{9
zY3!1*pY8izsuXsDz$&)C>6;3JOdSeL+GR^wbQaWDl5!F3XaCF(Z?m3%mH25QRu^Xb
ztgd+1h-@Vh4>Tdbd%dN#Hj?`5Z)CgwUf+hLI=B8!U1K^5uhQg8MFXd3#B9*<$nB7O
zmq`T{Q{P9)Gl>3nN*RY2cNa*rlM+<XM{3o~Gkwu_VuXUdt;+%2m%QGo+heLaXEG$0
z`}6*#SPLdLt_nVj7_esL4COaAzU+#luK9b(k=k0rz3+LrQU~hyS~aPeV6)n2cRK!L
ze!QS^tzcFcV$4@5;6)5#Y&KnfRZhZ40kM|5?KA<?92xQvmE3yyo&6}jPL4hIP8@!w
zvrZGp&HfcaXA1~z4QiGlm2vOI!{4@X5Y!hjg78>g6a-_uyGpM{5};xd^erOG^L4AF
zoQ2yD<;F3~Y#qqZz1Zk8K+dR^RL(Ll%4h8OAx~9s>xB+<mv*Nri!w`*5bq$PaAlVy
zS64gx#^1-)M!uPaRBdqofMgja76B3nw5rn<EV^=)^CaFXg#}o9RuaSxGwTBYE)|o2
zwy%ViksVN>B8pU72c@4eX2*2)dSpVoHUyJ8T>a`)Wg(d@-5&rJljDoP5W@&-Z5A46
z!g3;*`?l(6Q!%^G)oqAJ9DB~)>}F7J1kD`$*h>BFwd&UwZ*OAD+13H7F(A>1im=At
zv{%A8ksiMACC_MvK%JRtM_fnJqPPhs%f;Qb^y%3*Nr8%wnR$uCqlmBdetRD{%D*@U
zG5KT9Wu?8EDEY3)Y>*?&O*TlPE17Qbz45uW`_nA&iY<lSKppEBRYB2+?R*Try4zbY
z&ZrZR_UfPNh6Y8`TYxwt@%%r0r85%X`G81Hk@<3@USy3gu`mV3l61uUY9tJ0pD|FY
z`#qkjF|#z_JB)bRcw{Ja?eD9uF^*OCgJP|QWvJ8WHeoHlQrmfStWydrzqz$beXNZ&
zu9*+H@qGG5&xu+Z7el`8#g}1|pj+}{belN`Ri)KW<_Z=SvpHX)nT}#I8LviNk;@Y}
zCX)%IEG?_+3&vT4qwt{eM&JtB&W!5E4Z_>(OJ}?1X-*i(B7RU;Ti^3^1K=1*m28Fd
zj6J)-M|x0idiXCr_psMSBU@a4NAA?Azl~ONM%N<*Z-3;2RTs*(rNT;xMQ)@5e~|QU
zt_HFIU(6T+m)AVIw$#Y}Fpj_l1i0fHlyCud_Dcg+rF8%6w7$bC%FDLjPBHgBnDA-O
zO2k=XT5n|`H|0gYu4_YJz~bo`P=wRf1kGHk5pvR5=bO>t$N0Pw{%-=&`h(nzBPKr9
z0o!b%1q+pIJG>mTZ;1CXLOY#TFRuV{kD>VA`Q=A&BJwu2d*IqCdy%8_<mh^fF6TKZ
zkeSXYnbg<bOkG-{Sz*}(jXH2e8f^tfvUxGfi_$*GK7$%4#F&-#KoME{G96iJO*bw_
z+T$893U@}@h}CB`jK>*<)=wJ5YR|<3L<N{o?<3}Y4?9en!U68#P+txNYo-suQb4q^
zU@0J2QvXsw{Dw^fAKo&7;9aGr1%e_BdSqjUT(=EJ5K(lhZoy&z6lE8Hb9P?N7+g7l
zQ<K1O$D(wO{cP`nzgvFZ%!mjmku-tK*5Tb<0gfY?99~2PgCvMW6cFcHc1^9AV|3tR
zzMjcPcaF^{hjr!o&`0~db|twlwNXuUe_oEpI(^9XpwU}==Tz*}Lz$<;COeZE&d1$R
zsB1?Ocv~)a1`FA0JJUW80W!7q(Q>}t978Ql?y^fDdhf2zk{i8n;&l`mmsK(`$e`~h
z=e%#O*sDjk6mrU0NIG?VZ}iWs?Qyt(UBC1`{o1`OL#%PtM<8y^Bv(Gp)OPhsf7~sI
zY)h-VImfYh7OXHUY_l{&w6fSZCAaj8Ep|>*lr9POH6Ip}I5Hm=^qDwTkJw75IF_Re
z3_fggd~hfF4_Z8R%zxMH%B<bsGn>;Ji9%_>_cC$N?7`2xBH8!;^*#4^dPW4C@8@&Z
zK=Yl<=2D)%R3putwFBnH^|xp#9R-q#z80~gxpiAm1(aBftit|#c;Y--@rejiVa3^t
z2EAL^`G54H6rQH<rZfgpf=d$ss!4ed7JPS=)!nHf1{{VEP9p0kz%gv1poMV30eK2(
zc?Muu*!IM9g}WQbRnpl%j2A9zf#Y>k8b^#cS0bz+cr1AgiL+XPV|pP-a4Bx1xb`R(
z{+;vagFV>VD;g*pVMcqL-@)j0UhkHPQ+O|vO`00`V+3b)ScfFrt})T%J7Gjo83|}X
zgXGkhO1u~D)HIx{iD2}t?D#y~AM~NVPg(1Q@K}AQgX!cxN~2RDX?1DI=0IbR34$@p
z<|64_sA4;-RC|<Yq+<-JhvhJ5SKz!5?}d8PPhX_373Ap)Vw7or1YxI?PvO6a$KMHm
z^hb-3>1*P%+DZ&=J9v+RxBVu6PYKjFuJcNJlyF68@~@K2vg;{SZm|@7n)OWYyAe(V
zYOlLkn+}}%m$n>xu&(vDY+1)UrwTP&d>wFoV$lhINfzl?daDwN97tU{va)14fk+bI
zc99j?89OoOzU1xT*F$HTOA{#CXpbC92``mF>%ytm+6lJ_KcKI?m>SM9j)*OwP6FkU
zrVRKd%<cET<dA_-CG(sOV9SVHL1I5r<G5eo1qR17oFW{tzWtzZ(c`Ahbu#7%ZY6q^
z<{K8dvY$FJeaFb=pjz*utZ6uw2rq+hnn@~m3*R1Y*}}h#GSlUXId+XRl4m5Jh~hXW
zn|w9bl8l}(&)C-*r+Cm+jpcGS<sNxF6^Oh(L>O0|PTPJYLjGmW6lPo-Cz+kD^k;ZL
zS`ttIoPFK=7RwzmBCrUVdPH_@*N%(r%O+PecoaO;CF1Y{>Arnqjh16$NeC=JJX6q(
zn8V3QPKx&*nV;#u@#cTm9Qr=$0@vBAxrhVB<HB7i-f+DelzT;7FR>fa)`?se?yaF!
z17{dYCtcW}zi?t9L79KW_F%U|7POTvHh4~Zm`;+4;?L$?<j3~nZqe{d5Ns1Aos#{o
zH~fz6y{f@e95$nyLF+$zAL&2j-<t5ObSVRE3L(0s#U+AEVoVo*c>Imu#<Xf4(!Vro
z9+U_=2?;MaE_vN7D&?xzM?5zgxZ?Xv6MT-iQR@vrlIE=yUoS`bAL=HZ+5DlCq*xNp
zk!TvN=X$^zk?VoVR?7TdoSNkIRXXQ^0B0h*`+5oBKski*4i5w7cO?%}hQHho2|^?#
zSw!lc$RM9$N3o+5F*oXCMUxDI7KGA3VP{2wp7^0w=hsOnpNJ`N-;S2N3t3!}E36L%
zW&NH%>Do?9Txx%Rlux#HcqLjo)X_{x4%zRBc}R=W)EI16ecLuCwDVGUL998i5dcyx
z73iB!%l8u>Yr?k&2EKb62ano1TD%s?S7eZWowgP3AN|=QqNWOOD8WK@x&(XaCKobf
zg*<(W$IAsU`$IsN3KTAEElvJQ?h`j(leqQqMGQpyQcE57(-ghPyJwFfwqWKno4A;d
zLL*c3y*6iavJbCB1?$UbJ5}{dYPr@%F7oneITf{Pz0k%M7{P-&&axVUrwjg?qcm+G
zKxTcr$ES3%Mw6tByvKsIR%dE9LAI|a;KpFei}}X{E4)__67*#3Ge{lFMj)`ysIj?#
zx5ORrjjrm-*4%}f#!-2gwiKM@9I}rzmS95ZqRTv1FU4ixB5(@lGA<3Xn`vH4;<1PG
zO?N@P4novY0iz5B8eJ$4ogLn1=UT&+<}3;s3L`+#n-YUXW@F`+(-Xhf;z=XBagv&o
zl11{^OV%Ch1RG<(OZp0}kFErr8WNIrt{z|{J*<T50^$Q=?&V5*B(U<0?FGA#MAdyT
z3wPmroR)&dO3KhRW7<4NJ*@(y2OM$gPyq({)tEDMp8n_3ENi|VWHfmdBw+AiKNi}6
zMCx8Ww$jUBQRP#(CE?~9UevyEz}79@SiL~jU9(ff_e&%0y+*#^I?NJ_pO#TwNXx4n
z3a*$aER;-@F>PJ9lnCPs&e_BHrfNN*2U_<2<L!Z({{6~7l}c+9c)%&`rZmTMd|A%9
zzmxtjE<{@$A5{%eTbHQ2`$k1X@|CoHTz|c7w}4NTbyaO6yaOxux=2nvlvAi_5%8q>
zRZWX9<R<eLHfjWXnQ2nLR<+MQK5lN3%5Em5gRWUr2Y|nu^zNQ!O`XVI;Gb?ASud8C
z^YjUnB~5G#0$+Tc?lmIv{d0dv9s$>(pQTnY=KoDM<^_Aw=TBR|W9IV#2G@F>BtBCH
zS@@0}Hh3EuV|48eTY-3Mb#0FErUX&LZ$B=T)Jqmyt7;$PYdaGRzS_~*`NG`mRan;T
zv0GxIV9_>!`w+w(ksV>~S@jiQYjZ}DqKQ#Y=Vd4?GNseGz6d2fz2AG}O+8r)f2Qa?
zs*Knu?>lxyZ93XRxK?6p>dnN+8_Gxl63hUKFP9V~l+^466H*7KMz-I3<of$$WXKzN
zMKELSJZa4cCVz;%Jac>zIqeiR&I}ul%|nc8YH%`2TZl4l@7*m1d^kQpcFxW7`-AgS
zc%J52q)PjeUs69jF$!lx2jyt_Xln#cj^Wt!#~|fu>k}UM<AimcL<|o;6Y;x}F4m!v
zLubjg@75ni#Kvo6BNTO7t(Z>|?%ozTg=dRutBAd*%DxkSB>du7+f19`%j@&a>1=W6
z5ecq)X*%*9bdjPW#S3oLdu3OF5R4I22YGE~tw!GV_)6ir*hjESCEYWV%@5a*!NDqu
z<0bAG#s{FU$1-M`+;#0HzgXxs+G|3CdhR&Xk~->wc&QR|6<`K-d;Bro(83~M7hWWu
z9>!II16u6wc(n&Ih@bh-zxMrlV+9Oob!VXDK1Skyb?Fiwmgg$Xtzul=K2KoI=n`b(
zo?wpR%D(da>wsz1vaG}*Lu2QnrRkhv38m^PaAmY?@z{j4c9X{=lJ}_H+HA3rR%pOi
zJ4uKEZPBkYh!@*)I8q~7WEPln#^bx^`j6L2oq6WO5rDgr-RO*R#B9Zzrr~ST@>47o
z=eH*&4e0aBjO`rA;#D+u8;(2{@XM0z-9X~efFR*?Uq3eT+^jq(hfXRO<PYnbl^|R2
zR0%)xCyJ>mV^z9Xxbx5=aGczm4YWy;4^d@$?H_+TzNPEm34@O!sz29_;ZjyQ2yn;c
zrim|j{n$nt0Sy$r>}S=`xb`~mWYshlBZvEXN5%T^E5##kbk@P=EqO7b*g197$<oFE
zyP>R&24g#z^p3TsNpwGRpNt!7Vt&g#_O9<}2xj2SL`id1ph?54dr_^_uO6^dO4Hm>
z-u}Y@Y17KV=_(vv1i;sjqKu0iR?k{1M%+OV>qKwC8yiwrhiuby8H;w#1hZ#hKc|Ku
z7Xxm)2Hh8S&ALeX>qbZ0abn!6LjW=2p`;FRj=MW0h-mnsZAX00OflNN5!<SsGd+@a
zw0D_@s{AL&yeD^(cW1x0Exhe&ynH^2uH=mnFS2|_2|kS<ar@pJ&nS{R0W&58RkhsU
zPGWTv5*ck{PP)RNr%rob8n?^PET{~Q5p*k3>XI}99wO{&WTy^C=E3uidOE~jiFXV(
zM@MuU$F;eG?j7zh<osS%G=_QBU8U2AOgaYc$)yYYKj`U^*(F$k+zdCC8>Iy$UV&^;
zxw}$IR&hb@tW&4S_`vE|lx5ON<V`fM$Xx9Ljo2IG;AA&3yQ&VUhx;LwBl)?SST;v(
znyD1zVXMwR@{}|K@BgSRek$W%aCM%#xt0Y4HUum4#X*)^wBAC?itH&J;uY<$Q!-F|
z-eYl%-SC|h4YQ-|UY6uu=#F-vyF<u}hQX!;%I7-uOKdMGrf_Z+BqF4~*Au=7$LZ{z
zrVLzv(67OQ)qgVRU5y(9DKBG-zrNHl#5)Gq@pB@UG<X?nYOcL3ZB1})4|npi)?$X2
zrg`#cf~f+an_d^bCyiR4Z;)&ck~ESXf46#B<$T(+elRwc5cu9g(ztmlw^8i=b<5hX
zds*|;eC{oNOQ0XX0Vi-=B@^X7JUt+iR|;1!NuwZ8rgHl;`D1vtX(pe`gBt=ewDlJz
zn}2m$AcjF13D(IkWMqo)xpOktxH!S}n8Quu&$S`dy8EZD@wJPTMoMbYlTLLRVg(6P
zPomHO&Wxd&la_BLT4rAvCo$6zc<=D{2icmHFW@dthF<NZl3DLd<kI`JShszZ^T4Jv
z8e*_p__{N4y%h<IhPh&<rAJ8*LDj>3W<K$pb(fe`L3Cq7t%d^qvWJ=?wi9}9Sif1j
zn<#{DEt#{A_<i%CY`svJX_f3|bqy{jpZ>wtrK6PN!t#Mv{2L+n<#kR9CV-S+@>anI
zGYTnnF{o)5dwx<yEXGVROYRl{v!Opo{nt;mdyk}qT#ct6q2M0@!M!%5WInMmPwUkq
zUR^uC9}LQL-2-Y9Da^4S`hCUB1bIzp4g@RqL9LmJd;>)IxAT}3QPBCf0+-MQv;HDu
zKwvRs?3PV%YY@RVWl;am09C#jCvnwg>P;)fd#Cb?@Kc@no<^JF@D&|Sh(w#9$xs3I
z6wam%^iOA{adE-AM<5ZsemYG*D@Q0EHy1ZlT2?n3J?BU8aY3+4M5T2(M~v;-^=#yn
zA@gy#WsJBc;%St<PR>+em;N%>qGgF-XJD-qLb`!g(P>^bHZuse0QNBQMB<(&_m?2W
zQbq=B_J)>f3_Z9RNA0;9b%2p@3|h^plUAfxRCm;E5-?;+yqE565aO=!_dTx)-h?r%
zqqk{Ca?)Pz(1DI?JK@2h5q=>k#-JWJ^HOMcY7j!IAJGn$C*RhswNXBKnV61UmvTqv
z9Li9mbbrtEAC+jc&Mg|^R3Z8FkI#e?!NJCV<>Qci47ucGprq@;F&?qvV#cHxJKsJy
z;MA!8Xz)YKM-ugN4AoX&W)UXzdApKmnjh|K_>jCT?vGynIgJje@^vE1{OzN?GH(*Y
zU~xA?uluU@NrGgWd3%7I>MRa-pp7b-pXmHTAPFT!<{85_{)PeJrQ0zxoC&0qH@cZN
zPzM;O2Hi`<Y<Mis24Dy?8nzmvkX3LW^Je{`D&>!x{qej|Wmxz@FN?2wEN8FurUC)*
z*ThY!z2viGzP++#gWS^&wxC$7r#CHh<PL7V5IF4^A-M}=A8orEakX2H8Qs0Y;aseJ
zo<=Z?qU<CZfwtdhR*%`NnXVHpeq20smEvELP?=A{Ug~h@DsN(LNu@eUv%h5Tv5&3Y
zM~i{<oN!yjp@(XV5%zZdnNZpC8)UQpcYZ7gwy9~WlXS|;l=;?V-F21~JR|S8TlqEe
zlD(-_*4dEYcVk^uqWd3-(<VNLm8O1Q=kG2Ruphc(cyHyL{c*peNX6)qi<onBT@bh$
zVbT<lEqYI9M<fl+jyTfNBv(R*QPR5~HpSv3q;nUafxV6}>XaG&%^xEI4;j1&39gR@
z@QgOm*w#x;yd?g5Kj5DwnNK~hM=?;0eXnuPdAJm<f&{L_IJrsv5@0i3PMGp1d#)+C
zHfPCNuL-wb7=xel4cU#RrY6KbgzJIOfM2ku9F4f|xiLcFQOg+dmpSIAE)NuYBgvn6
zex~0^;Q5IR@L>iTmBF6)rXTVj7iM}QB!tk^JIDJjWwb`zpy1e}k69O9XGAtXuo+qp
zhD((w{4YfyIai(Is>vPcTXb#z9oS%pww_4`S`+F8!$H!87TR(g=K(?DRrc{^-M)MO
zcFu1f^@y=z_+{n(uNMH!47e;<kI6z4^=U9-Ko#af$s~aLlsuDV4GV!5{Eb}4o?-J9
z#Q8p!g@suT#7!D8lDDsxl}l)wxqgTXj#mrJI~lx<vm=LD^Z^{C0yJ<ko4ZHF+jHp<
zZu5i?`*26X<yZ;&Tx~X&;%kfGg(eNqT7&F^9ObxyCH9n8$&tS3P<FaaTj~oW_t%oV
z_tm|o>~!Vk{=xcXK!cR{IEAKmo6<s8TnzKT$;9g7Aly=&sYxqLlPitQ`f(+2n6=0F
zkl|j{!T5->wc(w{egIp$N)<{yt#?63rdO=T+!xpR+!#*dY>%3(W%AM&y>wlrqa(g6
zM$7nw<76hk<}Y^;njrmB-}grx+1gwXG6UUI?pVP>JX<@_$88dpa2*bTwM(9Pd@>E2
z$BK-$?j-zIGFi9xdY>R7iN!5kGcDMj7QU>gg|${t*>sq1{07U=P~EaVm^B;l_x)%Q
z;=$m%gwrckjq-`|PILWXPoa<I;`{so=UDw;_ILGCX&qzNkXp*-CcSkhtC<W-Iu|q+
zJ6qJ^lUmd^&b{fXv;~(7rte4>>-Z$vL7y<F`1L}JV0s^J$UPCpig4^&EZ8>HloV?g
zU!Az%o94K}qe7Ha{diX&<@-&`At6$q5%)x8CYVddqF_QqS+!DN4g3O)tti>JJKob^
z-9o0}d5dv{-DU*dqa)dTzc;T(0JWZUo#W!A|Jz8_tfaAetIz6U@EH*xZIYf><?O+}
z-MTtrsjT{D-ZTjtOqX?0+!TS1X5ibm2SLZ3qF*mKBV&JsX{;Q=ZgEipOve##CFGHS
zX2@zpz=*{RBPVIh-@tQ(0V{DYqC$l{dCoGcJMp|t#w?A7l5u`-9d;Ip8n5qc6nMv~
zzx3lH*_e;oNTk}@)o_>jE%o%4Phax~9;thIV?J0kAkK~{i>P^x?VL&vd{^G7uSfkg
z=evvJQYml8Y2~c8IYME4q@uW02xZjHCUj}PFc?rP;j|ATUma{-j}nV`oBb%))5!~j
z2LxQ4s(<)#h8FJ=ki%*wN)Ot-F_+vJrO(lj!nnn_z4XXAbMC&sHo`s9S;shwcO9)>
zkPrQ-!)F}Q<qU+xtoWT6?Rrl-XKxDm#jCxST{K2KZ5A15waAsbSPp;G*xkuQ#)JUR
z1IF&BTT)_6yt-co+s0M4<0;ko>R!K3DQ^9;X1jq&x>Arcz4S@m`v}~X%QbujInM5J
z6L#P}8ce%QwAN0fAAaj{TPZf`&|0GQqy6@R*TMXD%sC!iF<oF=WyqCw(lZ}EJuY@=
zhu7E*erPMR8wx2(J;1m9)e3i0_2xP<4hE@&$&kw1j%Qf(BGaN`bIFFt!Mjy4VyI@*
zT&>)zQ!aSD*`jl*b(`LV|JEQ&8SnU7gow>R1Kc$7=jQy|6uAUaqccyj)V9L%sm}PQ
zLES2f)jP83`=J}mXvxqg!P~(#`esUpG#{E;%TTDqZr*R^nQKr=z&BMC8~mx1VeWR8
zswgr;+s39O18r;=H-dpI9I7CH5GlUqS+8}f6`6XhAewTuWyU-<iLc0F$9!DL&&-cj
z{At#O9eM!BnNv&pLgBuTKbgus)Q<idB`H>ZwI032-c_Z+FZ*UlP=tTS0%~lZtwCV|
z{u8_$0nXc#lRTON$=x`M-p=#bJAg&T1xe86{QD~eloB`l7W8yCGEDLh>!?yv#qv}F
zZ2F=>`WEnW>~L$<b|}3WUn92ol3$wC(@U>Ak4?Vpwi>sn$+C5@+uvxuL|t-Yg*Zo0
zMXWR}8jGfqBz;FO1(IDm_Fs(4s9rTGWJh&Gzv&}7zu(PUwIa2toMV$SHYe^@k7_HQ
z2=JpuYOve<=}3#EbhB6uAI)Dj%N@D~x=|-wNUd~*kPEAk_8H<7Gq4E;&e^1Bui}Q>
zj4^m)!KS}#g5Ltks+GIm6()Y+e`(qOQZ`Y9%12*&-(*a<(>S7HziFl<NO$41!WhRR
z(8G^ieVvi|gZU(H5)m866ULPtz$zTS{_}uMdI~tMEo7%6uQ&3bFbq9kTY(RKo6u!e
zOop(!9|16)2a3)FN4?YARdts|8~}IKJ{=bIM~*aeFZr5fY6iR6)@q$xzPP>zT~pJ-
zF2zbKDi1FP$#oOjn7-;|?q|8*P6@tt?yH#rD!TVAr4&2wRIxyGb~JSIh=<a{>u8<k
zC?yKGe=taZWbNN;ng)TtR-SzZD<R(+vFIu8gUu7Nu!~3?#T4`E_9P5{Nw)c@8ESaA
zk=8XbvnZqwkPYrEfp|%P`_&~%LhYBcuKmAq_|x}mo`m=)4~zIJMF(Y8Bp@gk+m@0I
zLaPlilJU^*$}51G$Gzne%~mQOrk|y#`T|;xW+qQLlIztq?E^75mUr*=8`X%U+Nd`W
zt4%@09?UP7YN;3YBT+K8-vy6nEB9!T&;4`7q%Sk`?yD7sf3#GsM#E5l(MT<ox8zHP
zSUk+duk8T5{r&7*@;bGvo#l#qkw>9L3Vq(B%a4U8Nmn(6kb-M7>ge0-(G(&tJ6_}+
zVNo@JrO9z$vyu^?#ay3FR1AEmh|vmt6bt)ht5Y=G$~%u$!)W1LV@Mb_@WQKU^Qwo&
zUjh~Yv9Dm#1Dr&8SBiuX<__1Z&gll5F-R{T#)dV}4y@$y_nTqhM%I2R@oSSViHVv1
z{}~{MRdga$tRft^iTB8ea1LstS>b~0xt-=G{j?l|a;NW+(F5PFzUnWi#`L}`8}Rlk
z1o}us`O>>yXBwL((F4$rcdChp*i3)^)%O#M^=X5~to+pV?Rz><W_whjVG*=&pSLNO
zu7+P6D>9+91W7Eqy$boL31+{^a=+q%09#f+Rz^K9I2l4|`H*?m-Q9ybzVM=(f-&0B
z_`2kKq`>~&goIz$?mm4T(UYP|y`cMJa&vAkI2~g^FjLgphPfKCPd}mInXx)5?QJ9u
zt-Kdnzqzn!D}|i!d;j+HO2o`9CD}3#ztQ(fZ^^CDifgP&XS%Jt$5s`ZF(0f@@>a2M
zsPbV>9z|=;q*<ar+NFJoGR5OM(QS~=nZIWijUSYblN_$uSyGHhWIK}au+AYSnAfYu
z|JSWK_=I@mJktW5GMZf?-lh=f9LON$-?urX0~)P!#+JNGVNbkywCYUhsyhy=Ee&z8
z5)zcB(5~EPgRw|IU@Q{;7Chb)RO20-d=Iqu)xMvrg&}ARHnZ@3E)ew##lDC87sB*B
z01xmGd!872=1hB#>6Z??P{y#M2)kCNMc@fdgs04vSVzFeamm7y?Te9k^`&e@Md1oG
zf(ZQjfe<M%y$giT*40iVA%TT3wGI#^AkS{c$Pgj+N_@|kHRF0On{hvez)eP{jBd$8
zlaS@jmp-^D|N0V}u6I*Uds^E{J-~85zLj`W^MT^XYyUA>@_EmP&4bS+VMnY~Lq2O~
zUE7}iWx%KuZAyeqeevwQI0b4agFdXo(N|JM5g9AkIqf_N*`+k8))5i<QVRXm7L8dw
z(&l%B#QWt}mCt?*yZOOVCblS2@#J37`r7lPGV!_6W7%|XRLLKRp?M_$Vdpq$UEwIa
z*NwdC{tzis?xi&)dgwMZulTn>I*}CCpQ9l`Xg{(-)N55>$GLPxn}0E-fyLvsuiAx}
zi$rrr!f$8Wz|_EFlHe2q=VSgN-uCfxL;fQs)K>Y5V^+!NpH2Z6T*lTVX=zGg!+qT3
zzZ;A~1KZmdRO5aGy9nS~u7Rr8_Grh#?@9w0LIsB&zx>khDXz7`0vet`mK1i9!u6vL
zFNU?F9pBw)r&Ui?0+IoCLGu2=>PT(c%YiClIOawaK4_L^bliauI23Xr^p!F-36bW{
z20T|VimZnT^A~W}`9KblvJ{#rB|rhYuT@BVP~i_4XTAh=7>N7>t~`>}@R_Js33)>Z
zS;+39IITrlD3=mkA`dDJ7+)YMEpQb8<SLW%wP4A=dRz5N$-MLcWYgndYnc@}UD0uf
z&gRdI{Vw*Yj$oRkOAkrOcI}OqjP_|{`Ltp3tdM0MOsPNz>}=qBkw6nbStNp-H+oOG
z4#S69)wy*?=~!B+9x)?~lTQsd+|@_$+mFbxbaG9uLi3k0qMVx<K5;iq9igEs+u>6g
zCio^gIo^hHWK9KcnJq;(Vx(W@XD5k#e(}+JWeP34Rr<Vc8sftX;4Cbv2;r|{GA8=n
zk;pI5Lvu>Nbx$T@*bcwXl186bdM}8@Z)McPC~V?1X_%a)420D|t;mlQiR!=49HQw-
znlZk*+UR=Qbxx{Q*sHWo2K>q-N54C>3u4MUjc*oI<kykl`q#e>aiu8fOax@pY&*e4
zaQQjYghyOwraeFrTK8Pn<2>4dXrYKSL%Xf!RmkO7lkyVdv~Zg!>R};n^dte){JrsB
zk#5xIBIpj}0H1;s0cL?q)^L<=>z=_MfuE^RsMram-1VvbYS@$!FYmI19SwZ-{fr&t
z@}h9<UrtOVeuUiY-g^kW>~cP-3-XWb#`50?SzeO0_T@$LC(q!c4dcyzgQxi$bIfo9
z$);=9%q9ez5tfn)+EHF7;(W0KobF2m&h7)fqC%X)LcGb0z{l1MN$;!x&djc&!`W8n
z!E4Km9-=<lzx<F2yPL#qvu)DT>?!PT)2ACF*q|sZ;i4~J{RULbZ|%WUqrz~Ep#qEY
z_a<BYM>}C1u{b{=5KmL6^p8rTWoHlq=<^C9_=!>|**cvV<^$O+wZKo7B><@W^uBiS
z@GFO1O{R8hRmNIYas4O=e&b92hM*EA<OBG~DD&4#xy$Uv>G+h1YtA6|-1g+>Q@Yvb
zM%hE#LtsW!F<1s4@P;P(Q~QeE6Il)+c#3;r+rNQG{%skIj0GS%JiSx`4~;26&uKRb
zzf=lLspC0ETguEm2W6N?1}-2cBtoov#A*$?l^w<&(i4sdei?a+u^G$FbR=InW~6Z&
zofC_$&Hggt#6z>=YlB5d!hMOMVb|ekm(#(__ovUOYT3?JS3*K_LR7N|B~_0aB0hNF
zaK=I+bD5}yJKV5HSV6=~bJc|OMz~atTIvdUL*rf!x{MIYint(_l~A0*ylf<g#}fKI
zIQS|%?`7=NHbh_b=Zn01{7IeX97QR5q|qDGgUJtoWd06tP(k?p<%mir(OF&DXC?oj
zy*eMU4s0aVh~J)RPeS0GyYxP_ycO4OwQO?gs?T?w%zC}!u&?`K-+yh54CG}?nN&}z
zE?%XB-Q9%a$>!V#1+~ZZ5xeejZo};~$1&3Ml{adwcALu%w8C4J<!@pWjVwtQ(ZJjG
z8e&X_Gca_i=iW5*G%t5B3hcVF&-Gi%<B6TX(8Z~_bC@Q`OB97~<>DAbIHzb-y8EC-
zAOd$7q=X0w<+b1GKbI&eErYv&hqNS>!{x~f#Y)f7*oo5I3?~n<`D(yha!SpA53c$w
zJrU*dcvKqF{`8%o<h5L<CgR`>qfsZ?4sx3!St*2%!T=z3FPm!T(wEi@#jAF(jU})R
z1oohv_xE4>iXZ#uf?YWP?%=5bC=)!B0rqCpsx2S-5S2E1@>4oH<6LsTUI33l5x3Iq
zqZyNP!A~nKTT~;Hr<dcAS-tjGQSULC3EnQP4~C$-HO`0Fa^Bxab1%%#w?~67q6S0O
zeCQtJ>|nf{U!>@yH3!g3h!mJ<#O=x1r^02uvpjI>rn=$b;T_dG^u4<!h8W=NOkl*U
z;Jb~k4G;O2PK_^}35(o2ZQkF!0G)2Ow3+ZA_)~&$eytYbwbWl^EzQg`9N^Pe{N<eR
zPWJ%vWDn=L<BsoaUdaXTs9j)TO=gwbJbeXwOE-@FGpkLCqQ?)e4wFbP!yY=1#gvQ6
zbB-16!`45=)U0NDcJw4ak2{$>s@tF|C<4A5d^4q@p~*X0a*3#uX7~;cA*B&Wr993Y
zyyov3k4~xBAYOLFs`03{7`f74xSF!_2IL+tK#&>h%$I55MH^I-^;A9DNw!-5myPwK
zZ461z7Z(gx$@C+mAs<LQvq+cXI`sC)aPkP3yezTQ)ka%p&-141p-;w0a*suq37mx|
z6_vU#dXQ0mZbSHnXr%XS1P`Ci9C(!vN0K0Nm01F`y+rwIAZtWa7oqK@Z(V059-Zf2
zMCo*5$vfXTZ_P&3IVrfg-o$Lq94x}wJF=!@zHSkK&6x)qfu`OOv4qEy0nlOHBz?pO
z%tmYN1#6m@OjEZ?NX??P!M-Cnr4?N<@n}QXW%bjVNZU;3!E%Da2sOE#@W;NG+#l@~
zmBHSzrn~h{rgz?^zkkUus)XEsFW6(b!(RznGOB;Qm0+S<+AqSPX^7?g2iozNA~p!+
zN5^9ei3=BUM`i$8CEbLUv5S>QE9efe4^Kv8WZ7-_E*KRsYU`}hU^vdV%Hhb$voEbd
zyYX-l3qo3?6!t6OlTp4lZ#E*<DKco_)rVli%{0#gIz)3j=@=BcST!+o=$QB?)Qf_C
zk1XmQ_dc48YAUzoxl)xURta!>KDX|^thL0zaKiGZYa3I0q)&^|h20$N;1o&_L0y#q
z^g)23m3>j(*eClASp+G!-RjNf2S|3p0?Mv$yv);f0C?mwR-|C$i%a=&{P7PG^J>N!
zSSEMNyyM*Gn%(9A-Imt?!MLYSHAhDwzH9N8&t<|(pjoHp_&6@;<k_z$FB8n2Z>9*t
z#b5b_E@x5xq<r4@+PJ*G$=x>@Ja2AR%@uST1Y2H`w=E9$)uSqVoIbbnyNuS2ZUi^B
zL@SHOsAbv6%h~ofhXcR+zEZ|d$PSm=>YABQtWdGde448?Dms$mn}B%f#y%c~A`R-{
z>j{G7Ngq<je~}qHt1{lQVAhj75{=E!Nn!7jFkTysqdVE&!Ozs_%a@1yc>gpVwLgss
zjuu~!_iVWc2XI?7t{4A;Z5J30Gd*z*`P8=aQ<@@VlrLR{k{i}hf+9S!b)Rm1Xkage
zf!Bz&t)0TVM)3OB{Q)c!LQaVs7-PWkj<gz5*VM?6h}w@DftFAwxL*0<PA@qWj*3h~
z&>#OLxwGZS_W;O4%p1jm2{Ys#An@jeiRyYc>J#E<c%&enq+<6JWGl$#_?&K&gfhwv
zZmn>br!Dz5+kI~=UWP<kryF?umQ?wu>bI3XvE!skz%sf^s>;4)f%6)>kXzC{#q=;p
zV5SImL1y`8W}TZ1?tG|OI_U+J2cds*Ax_7x%YBd-sJ(rxf9HiW)}F>AWqbwB<Ni<6
zpkt-SFg#7KKN#V5mX~#+WU<(@!t_&<q^=n15ZEJ=E?i>nB<#Yt;k~=`?TLu(&9!tT
zjm1`~YIZ!)Obxfbk6Wyq|5j2h^8Hx)4+1kx&DEJ<y;Mo&DDC@Cwk-WdIxlH<tbmIx
zl_v4Givq8ZZAH=O8cVD)-XRo~ma;pAN^X6W=|l9&vS6czFNaeSk3YH%5)*C2lRzGW
z2Ym%$k~l3O0YukDxoGQLkST=HU72n|M~Uy%sEivgZ>pR@Z17*edF@Z+_va7;EnTGL
z>Grp=beGpNune#8yUHgqYEXQ1CPlNb45t2|W#>_Q@iK4NrUhv)(llzbn$!1z%OxRI
z2{`OSxWI$-2>TE<$?abFVL35x%~H8MEXvCu`_SWn>AC<>?7*u_J?iZc8Q&wRNe~8K
zb<{qY2mA<n9B^W|QQ3!_>oDkh*!13asD4I?vqF%gz7wf;;KBA(|9~-tv_9}kH6~31
z)LSi~`>Grq9o4c+8VWJI(&O=y6OiTjRV@%Sn&lz_5I9nbft1xq3Vpt1<~s`~b_^6-
zq_ia?DellR&TS2pw^lVxAM|BhPh%NLpTmTADL1aur1)H>(fm^Fd!u11%yiyf^0=@q
z@pu>xQcZcCk~`&a{!~>GKHADb(4NaDln{>-^d4C<I~hPaxjn1T8-jcF;7@mk75OLe
z|FCtJZ*BBl-{_&Z1Sr<vUP_T7!6{O#xVr|YxVyVsad+1uK??*Dyf_pq?ofghDR6Gi
z>w50vKK8TsACOm*nOVOz>$ARr^q(t*g+G24TS8+QLbw->bH?WZWE13`+&~yh1<(w7
z{DZ*C4+jl}Zh{X>Z{jp0>u2$29rZ=5QA;<ne^iP`f24aP9ttU0QEy)mN(O2yU$bW8
zqcma5#dWdJ<C5=PI@Y4Mj!$>Uf%I$=H<@=ItWzGQp<hM&MMe!hXqUc!i6Mfz=<A}N
zup54#mz}|xJgE#>8R6|$<*{_MpI3_7pE3>fsGGaf$2sRy%~-iJNRpmJ?qS)1J7!vb
zJSthPX*4q6uTv*iVMybl;5ySazU6oMV;VH%tPs}rajso<8vuhd<pThB?WKe&0&wWF
zT-Pw;dLSHHC^96B_u!*Dz|~ceGOn<Jgt?E@62VPK_Ie5d>1@)DEun}L@EKs3bT4uM
z?*W4GVxeekY=JMl&zsf<`B1;Q0t^2!(6u18Pqg2ZT<rG`-cD_V(K`Dl+!bz29;C6n
zqKMRu)GMNYnrjT=z@s2Zlnq8jg+Fp&&yt2_TkjK?^jU2~NSpv#gLJbp@gFQlmq)fj
zY41E@QpxT65u`qWwz|2OQHz;rMki)dCH++8XgnDUukv<d3=L_gc=b$ET+M8Bj*OGc
zVgGMMm4$W4ySK9I?smC+>#||-yVbaPeY2YEGkQqjYCtH6a6~mf&_n&iTX7WngRkK?
zuV&9D(hT1D(i1}V&UQEMZ`*Ep+rJ{w*Jvh%zcdzzQFSPF=zVC7FlDoapQ!>rI-2y^
zK280tN&LFkP8hN77*l$79=>7ep8g)s{Z&$0m~X(lrCE=%TQrNRm@FqtVB%9!<d?u+
z&!H$ib7~l(-3_@p)ezLgK>isz@vt)?FKFGMb`m(bzy=IET4jArt)Fds8e>OvJszT4
zD!1=mlYOC#^DCw$2jK-@0-TU|>QnK#c<WY~cMSblj7aP11f)tMgD-O8Jp>9FN5)kO
z-2O7(1-~KPTuqGq^_X99g^>iqGA>9G8S2=hYdjheehP2m>A(`8UP98qtf1z;gk}lM
z8tVGM2Qh#5Okbl=BLObkac1_Da5uAQIJSz!+;9m8ML#|0X{cLe?nxfuzQXlAV$@ri
z_`9*m;X|T-VjKJrGd1IQeN(iKyM2<9WSIB03U4a6y$QLxyhWYb`vJh_@F9MXTo6(d
zo<Hd5WSRMXKV5bVV~^D&iv*|tAw97p8&BOap^5z*7yvKz4{}+(10}Y7`iwhEg6I3Q
z(l6raW|!oheQ*tz0>#ml8-gTVz^7a^Q1TYLP_B86KQBXnQ9*%>!r8F}-FD8&4CA`h
zrvr)-tFG(O5OP>qmoHSg#y+5T5;g_Pb{t-R{iR{S5zbTvBcaJvVWT)<vG|!awvW2K
zv4OH!$N)`g`!0BcMtpo+{=v}ZY21GJgTb=r<#-!Ty`+!4iCz&rwda8R?w_B+_(%pB
zCFegP{eJrmVZ2Hz+kGdOau@JUj*&$|oOqOsT1{NM1zD<vR*iswF~(H<H3Eew)otpt
zCO78q_4VGrPeBV;g>%+_@;=(`hp$(!3+C6<*3|CIUtiC|2Z$RQ!D)nJ8?~KWd@a>t
z<q1~fjr5C;bp~EH;_puB$uYK<F}J;aJ)&t%_@zcMbpA-pd^YY}rpB5}?rgFqv@+{|
zK4hR8i!?3|3rk3K3zK7*KwDNyQ~2<5J6B)?1#`Z641uJlDgeJDFmq}C6NeW*6*9qj
zZTX4xm6=sAP08kFM~KcwG($b!CZQ8K#PDU16D`<og#&17Sdlhf_*V|UXovdkW;Jj6
zg2;to0WyUSNm2elkK@FvcQgb!2diq7vM5?qRiei?G{O$!iJS^voJmyqS22b8gARQg
z8lyGbYUtjG$rO(^mnmY=W~jvTiX4#0xp#iYrXFgmj1r~s&pFY|3AsA*nds;AfNTnI
z5#6Ok?K4!M?;BKh9kk#`srKuSpreE9f`zf?C1eJ6H?EhkCn+n+hheYKj=Iol9GUCt
zJ*}6(r}UaC4bQ(9l^$p7$TC}$xkuPWABB%Vx|gjkA%SBd@a&iQjLrKqGl+v9$R=|Y
zGQaLcmP`Is(Sd1<HPuhYeP?Wu()h^*_Q_%p$Yv^3W-=V6(8tB~=5T?1PHke;RWGhZ
z4r~OMRRuSLKVgO#O&YkpZZe;>HN^r=f0v2l;B2L7I#>S{^9;?kwa3#9rH`k3DdnE~
zN(XGxoK8l5pwLf|{xY|u2-~PB!PV#Yp8Qs4nbRJVexG$=yIX@8J5*3R`J=LZyg7vo
z;3s-ahCSQP^z-0v_eap^<o~Pn;F>R55B&eH^>BhsrT?q-8m{}iN+e&xdK#|OX*Xn}
z8e9-zcF#k?__l%{9>u9M&ANV7gT#l66omp$aWnkrJ>3y#runrb)fy@1+>>%B=fo53
zr$W_(JQw&ViPYFgVey0K(@GaDSuTmWZ;kXB-D^wL+S{N_pd2PcH?OIwGthK9x=qSl
zhw!cZgO;IcZGB?ysRFcBf@XCAzVA(xh~I0w>15FZgndY=>^apmescvldxerX@^0d;
zr9LWYf**OV%7<p}EbZ%^$M<}6@@etjpADMba{^5mCE_>gX9LIdRtw@rH~C}cjusl&
z9ic8x+*JWnHMdWfb`55tW*-JqHuF6N=@owGzPFWDZR~p*@wClH-!BgNf>|x1<VGct
zrCjXh?Ph*4c0(GgOPbbp@(EU4QCpAYd(#Z@q?tpFlb$XLM0+$1@7Ep$#283yY?gXt
z+Pc1q{x`6XW3Ues1=9X~MI1ND;`;DR;O)e&bwP%N8nR%}4uP!bU<Fo-?ba`Ig0~!#
zEiC5wm|&z((zS`vgHKspwmw~<bV&bdI)JD*Dc*1=?dGd}TQLEod!)mAXN^N77gXCz
z&+l_KNWv5}ggdc#1N71P7W(nc29U75+5RFq+aC>R0Q<d7zVwT!?pg+l?J$~S*vZ4D
zEZ)XKRd`L<{?XjS&va^Zn=xAY6JTPihTzn<Kk$#&@+L%^Mx0kXF}!phSD?D6eHI$Z
z*gBH64~FlJ=_Ut=w1yT)<-n(>vQDkPc3tByHGXw7w_l@2Cw`f61e4gS{FIr=;-exl
zCEia6RuZMJMuh3O&YZO;rqkAUfU@EhgmxTSMAE>1WKi{p)FDh>vY3FTzbijPy^Urs
zZE2~`=O6rqeC_Tn>J^6UdcuN}NIz`fEO&w0z;4M^ZqZlz%K_i%GU9vNvc)S#Y@_-k
z!_6!d+LGPH4#?kmVMA|FWtbL&yN~#qMKSobH$%c1L!LX@+szU$)fDVCqcLi8Y9Cd-
z`dk6T?Qy3d0`j6?nzz;($Ef6gC31d8f~R!^zcAImtnb8Hdl(UA`{#1V%^ub6HjAO0
zn1%)_<T29PDKgkWi^Z!;bCUI%m!Q4hL16SJ#D}ACu5p`%FafxfkU>F2a5_dIF0{S;
zE~KzWR5{d~p-55$vYFl9lP-2(`MkM*y`_?4Gz)Qkz}7yxXf_;@{p3CNZ$cm@9a0IB
z3lgGlVm{tw64h5bxJM$&eU1)qYk;9|>X-Xxl)N83E^=3UO;-+-Fy)w%oX~4zG%dC2
z5vs)45mF%~#L;101v=+iIC4~egxmX1E5lik88*FOni)sfGM5N5nGjz-dd1700bHE@
z#~gzLG7TGx9dkEZ>+>F8&$oGZPA-gUr;i8T<Toy7r2B8pkY_DIJvNk4^3jC=?&P}Y
z08W+W=hGlb`{&dM+?)?S;-M}!8nPUSNTm*2t7nfH7sEh+bI+$PlW(@x_m<Re>6}n)
zfbvCsKO)O#4Y}DA-h5vn2QEF2a0u#0p1nANuC}5G?XyDji{B@~Ppc2U=sKt}s)iJL
zRFT0rpDDr4(I_<LY=Q9H3@9Yn3xkO7qjNwu`gMOu=Ka<yyaSPb>)WRLkfniEa#M@B
z2=2KO=ASDkDj^k2PNkUFIVFPiY#6+SUi8IwRt**I#tWG?Ep~=K{1zBI{v1*glgWVF
z$Vf?NJa;eYYP{Dna;jF?p@fo>7*J4h>s({$#(ClM9T?Q*Z7W_=)8VJ0KBG+}uddbR
zyH?wIs1e_(fJ8UkFm<@G=omF=u7AkQ)Uo<D)LJj_adn&Bz!@0I6#f7aeb<_SyKq!{
ze!TOk4py>w9SJi0`b)?eu#`>SK`mySwKk4>Ahe{Hq1U6_PO{L?|NS0X%}6tEvL;zc
zFQ8G;^ZVPg4fQN#vD&*ux5>G}aI@Lo?*=XJ>c3Si<P~|mbUjFMvLS_8Wwd}zbsAw{
z#7%Lvdmk5#_~L6q->Oj=^4X}fcBkL~*^;^bP>}d{8uK~@DxM8K7*OON>XjbfS%SJ9
z`c{Q3^Qm|A2eIbF8$V}Ka`Ig8X6Yi23uJtw1?^;v*c5YPxU?n`2;jobDB^6H4k@}c
z{ab@h45;9j{j$$KGGwykrur4Kc}ba^ADjaitO{UJq9Rl(S#g}fg^w?LKh{L6D8fgR
z8T2uUA_<VxW(`fZ{h!h9^YQ)Tzf~xRnha%&c@Gg`h=MuhxPzp%S|`Flj~53cm<M!X
z6hPrDeU$P6fOJb0ix;|v8dY5)`sKq|H_Ee!Lk?kz3Dh6=n)0ZkS~bqqW1wBwSg`Yu
z{W8mchwZ&mpKKE4LN^dzTCc28z@btZq6ZQ$ygc!a&z|eA3veYb_`9!WVqSUi5IOaS
zou>aZ?w3tTQcO{y0*?slw!JyBa8~`vPuUi=Pa3SYttVi-+G;SOH?Q_IchR|H%+gWA
zlX{u@D=87qdHcaLAFH|5O2epsIWNx)d5F(NRkPuP=`8>4J0NXVWfto`R)Y(!#GM{S
z<<2B=^1G2miOLYk>X5_OQC0HWsB0y!EG?brv4LFVZhLX{PP0d~U+_C0)mQ-q5+7n?
zAEUC+yNW43*{Ei*SIaak@4>V7cW5*($}kQ2Wkv^B7~t^onh?i1FEhvwyQBC8sgMnv
z#Z_j;^Qoz6mRO9Ip~WRcHA31ZNDLJxc;Q&l{E|O>|4raK{%-;w__25A&HoU#^l`NM
z^O2VXK3DMs@}BX=Uh_2tlOnGhC1n>IyyjTuh$c$p`?+%OW6-Oh*<Bmmy-7uiYv%My
zfPW_I(q5f^QOvp7!<;fWzosmr$rHPyllFrxbnc+h)nJn7r_vd5B!4$Ay;4hkz0Y!1
zPiw)V&V5Y#cvHu9bz|jSSt+$+uZD6XwAWt;RG}HdOVp)K`829Ra}qHAMB9?FGu||N
zATY&`>s5g0?iO0o;qQ_@4U`uynspb(X94{)gvUB5w>L!?Ke%S^<ZxwqOuAoQqwDhz
zZ3}e+0sIoO9v`trM}-ZThvQ)PDh33l%71n}s5fNTjplM9eAwC64|Ro5^BX|D`<S@(
zVAcDy?)9OOfo}|^fh27z4Qy-l5ps=AzfT#>PYr3>EzU$H)4Ny}U(41}Jkh3OWX*}b
zb8Ogi|0)ECZw%?}?G#PC;XF1EASXIRuEy7dOI^3be;6S&hv^NfD|jSA7AtHsn<l{u
zY>z!sa~}nRJ_39AbQdes+8yGobITLzmuV0OB#!0{MnZT;)BQj8Kt9k&`5d3kP<*_=
ztK^QBY<;{{Wp;dl-SI2vhbW;*(`1HCW}=~LL2hScA7pjK*l)=Vwm2_0q5m|eQG7R&
z%LUy=&u+pi@5)A7LVW57k3cw8TGS^74A9xw>e2(I7iR_f@=+%&YB&7Hy&;>$quFv6
zBkWTgGJWIT>(0Zk4jXJ*MEbbK4B>js7AN)Z&BHFcQQ$*W4&7|1HTbXjM&M;@7Kaxi
z`NJ38aa_9SrOQ+$JZtm`ZlBE$ou`hB4zqt>Ywi~kb>5;Z8BtXlFSbG`r0bRUkRr6)
zZ>hS!a)3%)Sdvay+la|_C<OwrP+l=5{yj#DkB}N({_xYDxI*d(Ge$55#mNW>=L|BV
zW0F)k>eBG>myHd|A)1fM$dkjxi4C<7;A_Cfo^gAhQzy)&)XT!iBJ;zK1nL_YU9Xuy
zHlco+$N`tDm8}vsQ9CFuozbNc7c|k+qsQ$v?LRE3_!PkfM0uSHgrMfDd7qQaa@lL5
zKz%#6zcK0y(_9S`7=9!kouweL4H?qSnXP28^Y76`tDIOPau4{Zr5NvTdlwfCDP&u^
zZs@XfB;V^|3mS`qEK{f~MHI5~U#RQD%}Y_YGo(2X!Doe#U;yOqUp2R?NQDs;R5bOd
z#B<=J-=0JcM@&=L5b(WbP#1sfq;1gN+3uq4bXf#_W)|akfycm1PWe#$P4B}^xBxCS
z8kaa6BnK_L@}j=->YG~EL6NHm`3I#ug?s8%=;W(jZ5JoxmcP>z<jfY$5g6HY<<paK
zkL1Wk_44_sd>%RVG#@Ln+*&=y**41AQ`(;E**-47w(*r`%45!=KCD0<OEM4TipSuG
zlv@MY(q>={8HV-u$MMXJc+xM_H%7a*rkEkUj@9vfi6gN*Jt}(NFAnd&)v@kbhSW+j
zGJczqig$}R(5cw0_XSH87hXMpC$wskAjp{tZ3&h8R(p;aEAqTC%FF04gN^xjMo)-O
z`SjG0mJijiX|@LT#=jP`RtAQ!^3_C8yhpEK&sWR-M^MApv`zLXV+^@EAMsq&+1GE&
zQz{G(Af)JfU${BkOFOv}c{PF=lCu7p;}~sKR=$j>4bRCmRLW>BZ4)Ao{<Ay_Y4TF6
zl&JLMT8u^zm~8D)eXwejb>HmJDlI&rOU8Ts!Ly@%yTIEMuT~oDl&i~rf18p~yz+)m
z=5dVxx!r)U{VB!WQ4iBC1ZA2k9zXF3vYC>&K8Fzec!g0}@Z##c_+MOI>VI6Fe&PS+
z>Nc9~!W#bL>fV(l`H(R)V=L-AUNdbxo(-~AMwQ4QqLeYrZG+KpXwD?oUjdv~SK)J}
z6%cN|a`w#*Uh~+oqk*`XlOjnw->=)gt#b{RM8c<xj0J`JycCQ)UH*u4wOGChjzQ;P
zPXijNEp$4vh}=x`X5tg*aoKFyV|COw8w$lAUqn@fBYqB$b}wh?%76SCXO)E2$ybj;
z+MV{P(Md7K?f$|?^>fh5eCMDYg;0rQBK@FOWzYEjeh!zPhIQ2MLx<qAONp<>6hQMH
ziDMsmQCTLBI&B@4I@#nvtVP3b@40++9O~j*(#=onu60<yFJ-LZ0Se43S@BQ)h%lf0
z6j^HzYM6krD&Akvd@RfN>p6=C>&71IEP7v8^t+~)-OHbV6AiYJE1tcRM;}5Hh?+U1
zBivH$VoTih@Iuk&Vd(X?Q6vtJ##G^U7M$pI4zP#1H3HBtuIjf_hM`?vvnaGOx2+WV
zPeyhciTtY@@)Ym(>0zmy*=6<YF(ZFt)!I$EBAA^|lc@Kb{nSSxWkkP0Q71;RXvlY`
z7ibtSQ6f&pW!ddJ&JH|G2|bWtpB;=Jt(V?+-6ES>L-ff{$ygRV4b~vH7V%{FujX5I
zK<S9!G88Mk0FH|hN#8`t9Gpm8zK3o823uV$k7tSBoA{q*M<#;bR}-MSkY<uE>((7s
z<S;L5U$fbZ2v9PXj<7ulu=&hIVJ>8s^4BuW^yzc>b7R}ly`n)V&=l*ZHNOi|A8+Ck
zOs;jfcdM>Q<F4fF{nc}zw{cWXl`%Kl4e~?GOTF^n0LdoLZ#5+vNWvZVG1&usrU^S%
zPKgU7e>EISUlG#$M)sd;hQaq4Q6jfcZl+7#yB`Q@l23DLiq_V|p3T(7>Pp~SF5eW{
z-FHWH@y^8O@_+4})8i4*4wvuBoO$`(2kVEH(D4PHMzb=0JH{|v3t;TFL<Qr|8Jb)D
zh6?Esz7JIH{@Qvdj>R03AM5U14S)OjjUPt!C)~IKBP<ob-@=~-V99>5mcDboD>XpX
zoiMqCgyq8gW~Z^br*M7DbR`PJEaRY5>JU@B+LEM~<I|6`tX(C3_7@j7sHs*Ff<ko(
zo@<>X${c@096UO>F;RWD1O;s)Un1{D^!X6!kU29H(cnl5{5W*CemnU}GRwKZis1vo
z>SgYk@^VW^>1FNPg%`5oocjRuch3g9efjSFX9oY0zH?1O3=hDNQB))cyL#~Tkp4LF
z$KD1{oTV#80%e?*dFqo$lG$SyqU3YcOhXjA<9%S_wcLC5;JK)x9vd44_Z3ZG#JIGV
z$nNsIb5V+!fuytIid}p}+NUp2+nhqs@7BARgVxT<(Sy};*TNihYdGT<T!^i%^=83$
zf4NwfK&EQXJtY0a;l@9ha_-v-qn)o=6JA#vemZ#z&?NORII5^fo7NhV`_>~psGRI^
zM$B=LOgsIc!i_!mYG=)P)J;kTtZ(P9s=lKvuJlK5sAgq^O{%LWA00Lu46Ay8vXG^b
z+fSLx&436`dV6TNV67kHb{`E3+I@0<81qlc#W(e?*7fSn!9RbuWQb{dybhPySM=Sh
zr#E#Wr(&tH*vTrT>TPZ>_KA&(E?AX0aKMAwfjx1)DF913wT9!^{cD*t1*)3)m_Nx@
z&-H&Lf48KecmD8Lwn5^sBD}>jFS%{WlP}|uPcy~%=0x2m@lf)hd4NL`GO@FJ@#WJO
zSYvy!=p%bv``D_~D$U0j1`c{5YBcaayOCEAj=|2Ymx48hM?lQSRj4dC>1lKSWu;gY
zV&Z>u#{M9M9w4c4|K%o%8W_g!2L`j?z7)7wKa+AR(~{hA+xd>iC|ok&kNqyjS3ER>
zWdnu&;c^W4*D(gnC1Eq<pK*xhS(xN)f%A}PCtSjN*a)w(&BE_ia-Gj^sQ18y^9E1b
zB6FiF8*H{F*1+x2G=0-tp8Ohcc_+8$*9;Yu=OSEYOe7a8lg=sxpxCK^Naj{J0X>Tq
zGFtzz3X-ZA(-3`}DI+oQ-iM|FBlcP}mb+Uj=+`ZeK~3)D7nfc~s3)lU+5qq7g>_tM
zKzY8eeq_cipY{)t+9V$=Q@JshFBB9&L>pGr-Rvc&ijR<SlmyBg9+KqcLg_*ZC+aGu
zFAyYD7hi?G!y-&L$Iq^pNj+mwW2>}sg8=6kJa~6JTqbhA<Z-=*4Vy+bF9rHQNo{x7
zy#JX0(@K-e<f8=VQ?Fp&hJ2<OGMUkOL2Yp~v?>MoV(t$7>HHypCOqi;RVf<XWO%-^
zexj_9EfPn@8$<YxtDs8D1miGW*wN4A+N$>-0*S5lcX>rQ5Q%C0ccJ+IJWzO*d8y6?
zJ8ieor@*cmd)IiEzH$K{pz$2gZ9DpQ@->w{Z894AZNvaauW?^*eg2@3+dS+ipXMgt
z@Fqd`8W*W;@!+7J8&Cc(&&PP4);pN^8Mqc8_owpbb6?fd{gMWI(&UZjiMP+Pz*KJK
z<ai-&w;bVd4@T;-RG{ML4`_v}azXZ2#n)R|*Kdb<yp`2sA0>gE{x<XIH!g?y%Yw%C
z)k#i{$GHv1cIwW&TS;j_q?GPGwZnh(@99PXRN!V$DfrM!n-M79eGzLTCi-+{EjGbX
zKiB`rOVDk*uy|DIW0L=!ani+IZ@Zx!^p#gOK!EA?#swC!rD-K6@ygM})yDH9;V(ym
zd!IAnDTS61UI`A_?<Q?jkvfxD%(JplSCgDikh4g8V&l2?a?sM3fSN#~{IFjfe-j_*
zW`YmmUE)^7s0oj0(q?_TX>f=pU@$9d-1gM+0^PJPA15?uz5|>!otP<?BFntP79gzK
z+y?h_Ilpc9>AGIxWNSJ^;2mdHuHo;8@Rx`LB8|LAPg73+m34DeBaEM!H-w{<@W}=7
z?)$?qbn+9gw)ELI#eYFO6L6?oowuy-_v+DzJ>Mo@97JlPv3?@h;qJ>0mNYEDW9P7W
zofN#O>paH=n00-=1KcUC-YbrKdpu9Ac1nW!Lq)`dm#um5Bz~6&0~G6#Nr`|qJ-~vT
zX;iYG9>^-*JOa}jNz@-}h7|(5bAxT7x<KTc6*^kvHwsj9?Nv@Dw#eO}ZEAaovY_~;
zneTgr%>C>LD?oXa_?I`7bOVW7c>lJc4na-+<k2KCLoKTr;nTlqmyqy3L7P%!r+)r!
z!)}oR*wPWf7~1i?rfp62cuiSxFRLe8V3+Wn46R-1kzvB+Te?yA^bO7OB)HNzefY7r
za(T$5BaEG9DUI(L{6}`XbEP#%dGMF3Fuo&N*!frSCas?lt*<kM*)Iv+CUBaHGzvL8
zID}AV*dTrHkP}|-$$OKx_FlOM3RwvxMpC&HO7KU&^gd|b5$b3_Hbx}y)T!Sf_PiU6
zZ<cu6x0F%7eGy*=d1AX!#!ThT%8D+w)ix@baz=k!9m-j!J?Vim+#WWY54(JXE2!9|
z15GNZWeI-=koBT)1LTjqD96Twc><4oXG>ycEX&^pV_mBiAXEMvTVHE<i`$EU*Nii^
z3Dj>7ad^&v*^Ox#$p}oFU2!!ePU+LsWjpr4#ADtkda}^6s90IErIBdENybc=bq=y{
z9UpNb10zIlW;-`G-GPdB3gA62%VQ|~J|CU5Bm}hUGp#@mLi9#O5LZ}`mzv*`f8UFa
z^0EBoX*ky)yBFxdH)(0;+n0XnFax>&1CJ~Ixx-WS-hLHd9&SK%`oSx=+W*%pY5U)0
zoh3^_jGYwHxv#R?SNLUXsz1#>fHoTB>ba<fHQN=jcvYI&j1Q>s0M|)D;Sca4kTJmz
zV7Wp<iicKL)D>i*ZQ9ok{4n?qcj%*&t(%?(rR-;CyemU^Zdb5Icz_9S(tRgKfq`z2
zU%fdm4aW&)H<Nf6Tvuk8UY-Mw-faGJ`o_1Q+2WBOQ>K>(_ai$^wp~@>h@I45!hSBJ
zJ3W`^1d-p5%40Ypw(NX2Z#*s~GO~nT{2LvQX|W<E^5k;pYZ+Zue9<z!{~N&F{r!w-
zlY=3GJpM{)E-C!H(gX$g3OIeV=59|);{p`2spb20^QIn$y&7F4dU~VXtNl7Q&v-R$
zz=~SI$T)W`Ch6LgSo!QZ+SuvW;$4s1p!o@7ta+77%-c~fPL~;}m9Vp7$oIU(`OW#j
zwfAK%(P9b83xGN?3keEr{W=J0dhrk3U1ir@iQ#WxmG>|3j1z%A!pmf0f~CdG7Ftc7
zXm_-3&rf^tj&Q)>OxpW-nG!!_c{o(D+0TbKfunb>U)@f;J{P?JimdzXCV}p~L2tB=
z3x35f@_vVw>k5M}36(WUsWj?jN||Puxkn|EOow#6TCKIuJN!(Q3<3%q7Sp~m+ZWs9
zu0y@qQ>0dXvF7<!biek_Kut;LFbeEL))-8?v(`=-tL!YVFFWI+J$UAXPb)H8tyoF?
z$kRspX;VAq4ob%#8_y6c%4usv^_@T1tBaP2o24I0otJ51zL7h3+N<^_J<WP*Y>%o?
zuQF3rRz;WEl>KZ=NOM0F5ZlTNY9PFzM5l2EzTy0bc-Cp1HvYm2j~mQwAV9>3OT_U~
z4seDdkq!!IW8Mu(PzV9Nlyo+ZdrTiQ;E)PAQH!X`tJHmWpR~fnWeFvey$0ce(}>p*
zI+YN$#i@p1;HI5V*XC!y&|C{)Ew^&QgopQQv(4$LXx=lRvO~(bf_<DS$FtthP>D={
zsoUA-<_bDNTwN~41TmX<7-hnYnXNT_{zQGX=-b+KAx|R=J>R^`26xXY?sJQ(YB8|p
zgy)kwJ^t}LU0{;VTZKnOrr+HB#mMn@E@=womwe(5w<bg)k#nE<?_1No?-(`$F^S>w
z(~fJ2kwi!8LV&t>^qLzuGWkDdjJK`Ru0i!b$bM?J2J<B=%q22TbVzhs_WoIPKl^IF
zKZdmfStO%(|6~Wi<?Ct7(0+ZDo~?w#+-gp?<Ni|E((>R!yLN^-DFYsnZhmK<G%#>#
zq7>j;ISf>2nDS3Ief8|TRLYo_jKrR1y0#4lXYd~^?#1-6Teg6a*$Z@k;>*iF_}8e%
z)c%>(dGLJ2yLf-Lqll~ICH`yR&j=d!AK7@TqP=!mGzLX-L|G<`_g+2kXnEs{5Fd3K
z+<gFzGRp2bu>&y#*|+N~`fc_agWBB?-RG7(T*4ie$3kk46uP;YLyLx#$%!!Jq?>wk
z@8JIy??gxdmd4*dn2nb*)R~+J=M9=gj!H=qaL&>ZKAaO*2kYB&0;>moUQOc3q1Pyb
z16FcC{ie%D&aI2;9rKOXZKe5x?s}qp{P^o?vcRAnsD{2Xoa0jfat57wl#cfU>|D(f
zEFe50ey{G3pfM(q<pH>H-rc$RT!9s|rs9F3Dti+lo&JHQ)HP_At(=O$<gM4#8Yr2X
z<q%Kj<NJjT!-T;vk_a$<IzK5YTi*i5-Q8%8MU7+AK}AxcT4l%|&?dr_+RetV{ID`F
z(j|dv0^>;zLuAN%bkCr$B93+CDCmdC>Z?lH>h$I{%R1>rn(Fyh?w=MUyBOxO+0(7+
ze~J&<@L3u3elf;9FY~eKZJ%YhCbZ(ma8%EUAKNChlH4R6wx78C*e!(!k*G8vKk&(H
z@%94x4eSsXF`|hkw`FB*Psr1w<<teGIfV*eZQdrdc5aERD#yGo3>|JIU>eig|D&=h
zEz$Cna=N+PuR!j-7Ala~g!p{B=U-7?HX;igxgvn0t&4~W487pb3&~aQ5#(S6Lo~iw
zp;z=WgJ^6$Jo<Fu1MoIApbVzDw9joL6h<PCBr+1_S9krtJWcw)JPltK%Tsj@DK5`D
zLZ>SRpY>vwEN{NsZrRA05Wr@JEEwZI9!t?U=Nv9~{os12=66jy-?~OA9Gv~dTnQ?5
zjiEH=?=O$*)xOg%&elBu_3e23wmQij1rzOnuWe%QTwybp*6|U5G1I@*LWREMz@#V$
zj3|9!^Gpa@Q&IiT2T^v&9G-~x98NGB<OazI;nEBLnxY+U6@U%ySwe}~+O~+$53_|O
z?E;#W)MEa?wqY=3R|Y-&tae=lEELps{$@Q=PK9~8#Ld>B>OS@lX)gM1NrnXPOhsAq
z%MN)me6{QjK7kFDptW!HE3Eqt$JM3lW#~3X)TnFQ3efWNbRlzRo-Sqhn=w2F*Xy&U
z(ZgbVxVNjl^-3L5<A&k+ij7R@pQ;JJg2a?gP30aga(#t83I*#~vFRuUL#b=C@f{2Y
zzagd+3SIjQNPGJB3aKpx3&fr6G&T6FK(L|Dh8Xm5eKY6ni#9d!QZ?kblT3<pza(%n
z-bJH4@Xrt{KYsH`Fxa$$RNzgp0Fn$W41z|t@tjA7ZV)UG-o~v2MdLOyJbblDUZf;)
z-`{M%Z~Hur^K5Cvx-5~kR7PMd@e255o7ab3NL3r-n{AOO!IaF|#ooq@Y+)>*P1;lP
z>v|u1J`7SsVVx)+Bb|sVbseV^DV4yP_M2FA<Yuqf`%#UaEQ}~nE6OGC+q?mJz!~10
zVY(A=5FB@FkwG@etd4wNIVt?Ql&~|e+7^wH2Ki*&;f6n-rKfXC1zl0n`%<K}jfyPT
ztFx2i2ivb{l%iJFFmt&z7<1+N-b?MMNM7|aRv7WolP#@?Xhgjbr=(-5`bP!A?iH9q
zI>K+>R4zT0UszkO<HmE&hO0(>*Rq&#GNYU<JB5Wx%VS%LJ5riLmF76JkIWHTB^6MW
z0ACmB@fdFS)Z0bFKiFKLFY^RoReST@o_u-LH`;~m7TiTN7ohgC$YtB@GqDv*;Fy}!
zmwofpyqtrb3BJ3H$i=E<%Nh(Zauh=b1-fU^Pg0{_&KND6+!{#d)Jrcl`;xgM9(LX%
z#%+EC!N^}g$%Fa#)({d&a>?eiRQD_%cjRQ6F!rwh*#&@-g!8u&(A|Rvz~OK%8j$wq
zo?u#idxzxmuS|ov<;-n4iT-a)maM+`I&GfytJlGL<Ye@^ByW>Cf~}0L!;>%QlYXNP
zNDDY4c5*5ZBqRd666hRn`h7^WSTO&UX=NS+<jE^v@*^rIj?B?|d;RlUgaB;nD2m}H
zIdn@mT!7$=qmU{<=eArOrX9KVKht=)@q-J>TdoKGPCfRL;Up!a7edAkWyLZOHmkAW
zU?=Ay!bJ(D4ufvivX!v+?>!19h37v8I2r^Ug*l!2=Fn(98O1q12;n&IDp(&Xbn(4u
zxMH<}zdYg!(ak0%&GvsDaJNtTer#|LXs7Gtrd!gNXI~~LC82|+NOm!;i@v@>4R|~C
zC;!_uA~Mdq;+sKrsrv-k%i-x;gF)d`r%Xofy1P+(L2U>3!GK`5E=p-)`&x}I)=^g9
zHW2IP03w^(a9@EJ)H6DklWqiE2+*w8j8_=P9eHEjk+={X{t+BvQ@sF(j<+G5ku*)w
ztNuMIXDaA*1~g;KAlo-mTIjYt5lV3kLio-JVR-V!j}^#x?heH5YMI{7_P1rKhP!+8
z_`wQ5|D7>|nW)IUw^SlmDzWOQs{EK~Hd_<GPo$J$h__}-KF*!EFgPzQ<|pI|%a8#E
zvHt;Ph8zN*&o992F+*<yPc<gvwIy6G3`e*^RTCp0Jwpy9&w8>C(|E~zX8hH%3L+<i
z=kN<5mgKe2flxVftL)u$9<GdmLC^3EfN9asS34g@xNX*y`Mf>R>k3Tl)OG28(4~#b
z78=UZP+q=i4S?>lFh3T1?`%hlkBA1VioRWRxdd5Hx?En1Y(OA?w@x#)XR>6xrVRJA
z@&SZR@;Z^=E@}+;qq8lICADtL#mY}n<I^uQ-OUZwy=6yZ;|11ED>V3@h8+SJMu!EU
zuehgXmrz(tueY0QtA%{?(N|`~TlaiT_Cr1kpYDGm`T4P82v_5S2~=HICoFOzQZIov
zim@-?i>FcQ^-*eUf_u*X-`Dh$$){@H9Yp8i-cczq2|r95_@+&Cl-J2sRthOiSrE^@
zCOoB&pTtoGpULCv`j6*TC>j;)^KwqP(EAxE)V+*g*vyNtSqFSQkFe2a$8Vfu1*5T)
z?96BK?haAZ#&g-Lu1trqP%#ZOfY(*H3jLHT3rG>kUkGpL8S39VxmCXeddHY;F2c07
zgL{`*R2b*U4+T!V<^W@oF_|L1%Ez>}gzfbyYaAsQ<|<P|tC3hF2XqBEO~_fJX!`f4
zzk7T{FY?|jJ-$TL$YYD_5TaYF2G0HghBK&(O-TW*3eXTJR-Yx7Q*cBx$#&pX3Ia(l
zheK{aWw)w)%^d|sxpRm)nR9bhp(acMjy;@Ym?66X1zcC(CFiaAZwjvIAIX1@Cy&O$
zhsOKfMZSgl1T*Vv-@9n%t|^I%GVQ}V0!8p&Yp2TMHqDZ#w9F~xzfVZ%<dbN$*b*u>
zSU_qVC+QY~8}L*24(rvjv2MG#)kl(>`0VfNqjSr>KJ%QGjDK%_a0HsREt(U5`Pf|%
zvVpO_t!Oe;WP;ShmuNK5>?7fa>C;qdXOQdH#k=(C{cdnGu5ic{_Qs|#4k{|!fpAtM
zI_ER2K|gy?;B91-S}tPi$^v)ad^8?q2l&qc>%Ft%OrEYChP+_lV&sgmepjxAqCvr*
zH?w+_h7_&{b2rfZ3pjHFzksvM|AI5SNN);f2MhEh??Z8-N8i9z1qVA4c}vOqIXZSE
zGY`(KHEG)DtQfTBqUj=}&YQ>=Z?-k4BKin}dJLR}9>fV?pL{YfzG7a#cP@rob{4r+
zfpt_KL3u-I6{=rBE#nDy!TEks`f5g7nKCE~pQIX3n$waQC@s3M?(-H~n-EP>QfVpg
z&(OgZTc>rUcGmCPJK90~T&Ua<RH<NTmGZfZ8n^t9W0A#g0Gy}_6b?xY+qtbq*aV@t
zbN`?U&^>Jyg6B(n!oF!X|J~!A4HWoWE*QkaA&hgpW;n_e71DJMk9h_<m<4NoijZ8P
zNuJFYX7}`A(s4pLwLi(qVnE0s0VV}d-tm#|<({;)xh|3LFZuEWNAS^*Y|}*<n3To~
zo4uU&>q4%PR01^kbFYq_97qIVv<Vc=tTxNK^8{`uHKMM3Qh}eiCw_=4>=2u~=xu^X
z-#R)xc9Fd8<%sh9JJz}HXM+pv0kfE&<`|cogoAY*@&scsGF^64PysrK1z4o$R`<*Q
zVSs#O>35)TY7}nWiaxbG2G0C&B>HTCBe_4<bHS#ABU+~l+GnxBnaEeO=0xc*l*a~0
z7Ks@EC$Na`mLb&dbB2rDA4c;L=FZF4RNwV=Qkhg#6|w)&`}Kv3Uhtz<%gxE})R%4T
zzljvocm%S<e~m{QC9OVeDojoCK0u)n^U3>g%PMqQxS5hP2B*fR+E$lMmqnr)oKgWA
z?ri>6GQ+|r58i=J=akGglC4C%%ftbr^G&4UAonAG#$fw;)Sm^q-14HH)6hh^3qF#3
z<4?SqKT=U#h4g<M9@;GUsd#l(qEl7A$Fpcy>fcAO5enDnC}wwWy-v4Bg>#<ZO6oLq
zKc~le)2bFx><_{X3yjh`$0N2*ck^Ak3MOzyI9nqtGMA%sMuAA*(VsH0<|^{2_dt;C
z!4ZksdfH4Cv(}c2^ZQ-NV=`G;^UZiI>oCncn>pO9OdAu#Ku7fvV7obp(m{9y^w>5V
zjbC+GAI=+~7|oELssyZiX`@jx0=_!r=!C-$x5o`H4IiNk8b+6V3V<ZOqYrN5<ctQh
zXpyb?oP?D|U16N7iRK&IS*6z*apwq5Qrq+R^@y-VZ3mqB8IzBIs$OS9ZD7dWWydAa
z;PJvBQq0G8Ryj$$+j5uR)z8XLyZ9yczhW3fi%>;x?YwW^N<a{`&XWQLGWhO_UZ!UB
zs|u-*jAgmNWdbmaq3uJM3#BoDfA;_*w=BVico<Fc$goWCqn1=GGYy3AU6^EGZ5V~)
z<FbGp&xak!IDy%Gj7$N;*)u{60t}PwVwIkwWi8E@NHwZ<0$Os{Py)2m!G0;QRA5&3
zCPz^O-MY&q`tq_uFazz&3=KXlK25qCa!eTY8~;sw$9yrD3cBB0p{+au?1Yd}!1T{L
zk@fSUxqf+@U@R#jESz6PXT-)kJLo64da)}1B)kceU_^g|*cD;MyJb$SJdou}8Wrdz
ziF4kK4F?92zbOp}ZT_3tqOO02v}oc%5H!TXKIJMyyrqhf@jiE%s;!U$o{B}s&c~z3
z(q5t`Q+h&qeB`5lVDhs4x6n6V@BPv`E#<+{*2Na?Cy~b&Rz}p$b(J?#j-N@;&30jj
zJQ<cOP^z{w$tT?0g;AxgaX`%p;H<G;r+v6Id@!c)ozI#PgR8b1(>SG;!#~W~N5xeq
zxu(3$e3wvK>Y7l<QJ>L4Q2c`wM}Y<ODzl_*#O84j9~R$XH_NdO5z|?{da!kl^fZHV
z*7GHDMGq4PWUddM5}zlEevv(hD<i-C1Vw!Z?{e`4oV{I<?;(-?=TGe;G};RhH!mI^
z{WC|Pa4`$IM4WQ`F`+19!L4&0l#K64SHPN|BLhwvuF&mj>%bY^d4z%TiK#!qN0hn`
z-=iL8mPqgsSZNPgVX2B!EHx?QaJ|TTvlG<MZe0nz;ZJIvYtQn=@zgIlZj!5re}mjE
zejxkLI<WFO!L=YBVVqb5;}H|tImuWQG{tgIXS?rcLlNk~IMf`7yOa>l`^`zq2W4h^
ze;-z+O$-{52J<eYN2ERR3P}w8f}!BwMuBw?P@tixppZNE5q6I&c@ebsb>-A#815PI
z#!KnCEDeN82uox4(dQcj=J9aJBC||5vB$NU1ZUy1B4`~9(&L(1MG&7w@6CbPMv4Vy
zPX)7H0g=93*Bq4(zl>x3Tzr@FodkI~mGeWsb+rE-mkbgbXl4_xPWtf|y}PS(-ybHh
zq<etPAmGN#>fG?(n{<BVx+SQ{N^AjsmkQtp>(-?^eSiE`HsI+}Dye-~L!hK!POUUo
zkJ=y-w_wQx0~WNt+P#b9tV(xEO-N~0BVM!<X&pKwvc}HjczIW#Mb#gWlaw&<y#Yx5
zrr@qnn&r_DPDv;dxn#U?yhU^pmz#5^p#Q0+(DH9Q_Y)oYOP#*<R~1t(k7p}ku%R+n
zBYEYohU~An8Gl?6qbjRv^CZx+F*dV(g7qP{&S{ch!&x2#iBE+Md-LkXce^+Wyga)~
zjg9vP(H=EMad&~dne@v$k^jGrkCp6YOE=-`+0O(>rs8=KP&8AU?`XV4mjVF8{ujtM
zelK9pl#O?P!BCqXg#)-V;F#0a90F{stP~@YV!lI@ZsI&F0DiDu&=8xS14p>LsdEw4
zk58v;Z7gPLudhnzDC?PbayJ-N22be|mjVz*tMezjLbo8i8|z935q2~`J*0@Tf+R-<
zO%|3>GJfpAmh-3B*G$faH=5ZaEVKe`n*18kbC!Bd=r;H_`<qRE_zo%`c3^_H-M$n>
zljdf}$KsJTe|s`2p9hsRdU7hi(Jw8toGzV3t|c!VdA#)bYpalx{z*SQ#yPLlT8s4-
zi8^D^z_~1CNHS+nE=(@7tFw)fS}K#IpK;2O)|wTSiFHU&8+LJ35rNH9)tone6+G`G
zZCXwJLzQU}-C<DHb*+Cd)2VDEv#!)|2F)oY|6ZZzCq=yw<o>ePum@SXXyZFxttbAM
z&TpbW?xw|@f3sXO)`OGoy>dJ|WkdPs-)U7uW$U6+1vUw8uiRm40m0oC<g^LnFKhtW
z`7_3aBpjqjWO(@+A5WZmw%JdJ>S05T%}H9gf{q?_8u>@^RTOpR9u_5VcXI+l%K2st
z(iuDyB1vt?!_6+OWm}<;_b=<SB!_5M*c!a{q5BW(!`oJQEDrUrvp&$U#x<TgPEsB;
z&CywQja|vnTrji7#bXwLiR1HoOFHJS4{`|&{{VI}OL8qNv($lyt=kat1+{j$YI2v1
zr56_0tI++M51!gQin2IqX@)04{76fC7fS9Q11*;2$zqo2D767!>zm*A{e2;(+hDYi
zJKCDA#XQF*cAS7AxRkToWCAb0DkU8eO|HSpuv7Ws)SRuU5a4BgjV7mm{wf5EZ6x8@
za7wP=c7>FQ2EMY-n<uL74Z3nzbUu|+KX#x4MBI?_U=0sIGDKAz3KWzBeE-qEe{eq~
z*7n<pBiis0{J3!B3hOP{#VR$K$j#|))lQ7c7CAgM-2)LQ6zeTg?nS0w7txZ1>)gKn
zHKz6J6<R@S21Y`c<Pc4hGBC7r`S6{(c0-nwRe_u$(%(}4a^I3R_EhgMgp0#>)L)*O
z+t5^1E86&{G<O`8uBXH(G06Y%cwgkK4Yyr=Mk!v-ijvWa!6_rr&WZ5Jh&FX%Dg<N~
zEeSLi(jJk{k0kUC?+p^%v=5TUs%VVVrCnn?i1NKLud)Q6h>-+Fhfv4hUt)G|rd4K%
zl6zyMmnn_H<vsB-cZ)+9sXPOY;^_A&ZJ%oY+2_}omZ`Gbw!E=sp*uTL^E!6bCiWmV
z?6b`c^9Ki;4!BZi889%-u#c`iZpszAcY^26@cW+99q!lt9FOW@Et17A{0j!gK4H#d
z?mDBi5nXG4w{XXnv?=KiEE9a}WNExCe1e;}r}l>(74QycRXn{{pcf@#jum`2R!Ft!
zROJzQ<0TM2l9`!vkhtFmj5wd0@38bf`!J&&G)kFd@^RS(u=m_Bh6jJ_pJhenwKccq
z#aXD7gZ?II`p&~K`n69qv7N|<m0E6+t%jJr*+tJDZ&9rSHMfVzeiiZ})1J31m8@`l
z)XE7tR+oOExe_ITHinI9<^2zBN>}qBi)47xS!(`^sU!SP5+0ZADmw{@xN&0E$p0q^
zuQYsf?|wwm--!A$C$T3+?PbcJTgWXxc*h0689@sPe&T$a*o4FCWCGkuaOx9uuu1MP
zj;4g8Vf=V>#=>}#^!ibuv%G_XqK-sxfPV6*rK1{q7Wi^q)IRL(_Ofxe(PQwZ13YBh
zVPT2+RIn{0k3S5yTk9><=9v*=n^d$S?mtCR;|H%+S?nb_^i6GuPv7o%dt<rcoe&s(
z*hWX|%pjTG=00J3+pTXD*~8_`SdTXxWAU(VdZx2SI!N$!fXpC1q0eaMK%zq1K<Ha8
z#Y(~rL)U12p;}h6rEJenhjdXsxFhSmNB9ud3m51yzs}H-X7YJC_BpG92(H?N%*eg8
zzqS1padiYn;za|rbd4nAs0_w=KdsTU)5a_s+Dgx^Jvi#}dhdM``KI-~%udLUdb;kl
zQ)-=E!DrcAz01HyKFRB!0<-Z(gKDx}bc-FFcg`n#xhz>%<9B>}hc+FJAriegT<?yJ
zZVF+2p!W;#ia+Hi0(D*JHYQ5z-5(-2jy+#Fa>Jr1v-eQ94jo;aU*y~D@W1kH?JN%u
zk57II@bXRfjp<8zosNo^Kby6@$aWEaa%LQ7!~cuDStZ(ix}zJiM8BiM#tWqI-b)ae
zJx1a{RD_J92~g`JK`PEdQ(%@tosXS`*TKH)!p}ur2;X{aC5(-9x;t@?-7tMyj3z@|
zV6d<oHt#LY`f^(>S3>1R?h1<`86?O2Ta>!LVJ!OqdHZ&o$W0rAY+~$fMjvnG4qMHZ
zo5~`LAvBXXfjU?sAb?uPw#W2}aakM1p$d0qilQVvP4Cj|pk(YjX=Bf^>6Z7CM}cs}
z>#|$VU~07Hxr(0AZMx*7j4G@(G+_YcXMneHrE@KB<nBU>LP6#`_|YSgUH_LeP4XHA
z8m2{gE^7LzD+wz-w=Rsjmy63~{jhV#@KHYjBgeL0$c5dDY`-c*u3O!Gz%_u-?jNWX
zQnvXzC7yO#dp}Ae$tuUumt{(>hgTkdtz*yrX)_`u=Yws_jxLMU+h0I7B`6_xoyU(#
z7|$DIGR7B?A-2hm)FHVPYB9kAp?j$8K&d>u*V~;);htd3+?X9Kx8{7jH$oS%|76Gc
zv*35ZhVdKjiGGWeNiZCgnwn5<NunS?$;{L%ywMW6+9l=hg=JXZ)_iQF<;c!cC~qYp
zhRMj|-8<L?NwIkg5L*6)pc6;FtWVxvoTYzf6Q{6}KcNf;fSRWli>lY(lsP%@Bebjm
zw*GZ^y5?11H9XAOcNTOqX75&uHq0p{0cwk?60;~>s<~re{KV7~2U8tkb5-y>IOtC-
zakn+nRRbaEQA(X{6x^9k)vvb)w$a!_qI^Bm+vVw->$p&-@K!USmRZHzclqaftWhV0
z@7=dPncoz~=b!B_nD6XFjg~rLM*?qed~O2z&8Y;i5pyp{0Hrb{%T1jjsiirRf|rjy
zm+;tJc$f^7$;WbAgs78y*qM31L`1^9Lu^-3(SOn~V3$?_5r?0Qf@V1o-nG)Xe|El9
za&*bje5T@4;jb<fVqf8R>blqh-0=h<KH_>3xFN?S*K%0DIbRYd&yBpDvAN&#ro5@_
zO8A|t$yycYYg9GY&qyBqw+7l&u!oNQ?yovF?gKz1FiWvnYgX_mvTqlFWUWfsu5jrR
zvh(6S?EbQHfHslEoO^e&I8peI`e}_5dGPK>WtTyF2@nw0S7drO+8MGKIKDV)3DUDW
z|9qUA=xjb5O$KvzG^(%%CW|$cD~iyL>>;74B#H`RduBKRe!(E{E^j-FI7ikr&?zIC
z7susTX@KJyd0r4YzL~}I7v)a(#H>i`6sU<<x=bAyk=%1n9a0WrUoltDD0Y?Y4(<(x
zpNSF*<{Nh#*4BqybHdJo+C}*i-X12M`#B$=vl-(wWXQ~^o?ZSsTk>zms$XIr$xWti
zo%B(Szmdk_&NP7xU8<9+t_s~^B9@<|dc1*Jr<G8+Sw|6NXN87^v;zz0TaeXbN;Zxj
z@B*=8=2TzQC%GJ{PcU*g!9fg0G8@{;iG*5(+CdwRLe2Fr(Sb?cJ84KCD5B(0T%Rw{
z6^SwhuCTlKp2NI>;tEL+@E**ErMQNmMm>@jhYZ0ozX~`S+LfvKB1kTo-b_=8!&@7|
z`T5TmTa)e6wF_kwQWo)fE$=Z9ZhM#O#oSqRWBHyp^f3k_GN<0`7BWS#E<%oDgf+J#
z#&$)F04-R&vMT;i+C=(rG}?m>1$eSJk**rRNg7>c%o}com!IO)^bXSK&0C+;li!Io
zKDhJ{Bp=lb#a(L0D(SjCC0s5E;=LK^9@&NfEaSMBzAZtSIzK{Cmg6I!9J-o<wBPj%
zrk<SR{RoUsQe@w2xI<+$Q``O&Uk|>k>zg9$qo5EH%ljU1?D4KRhLBP3Aqf%J9E%~o
z7M>j>QbksYM1*j_@AOD-WA>HxAp;eOs^<QLQLJW4{82}T^#DZ<SJ@l0ub$f}p;G##
z<*OAH@1;wNM>81bQY-EWOMkTDjsHJvy=7FC;n#-?4yCko4u}YfbT^1}Nq4t&cS%YO
z-6<)J#L(TykkUCrcQf>v{~Kqm_pI}MK0WiS``*vq`}$oLj=9Q8{^WsN?AL@lF)%%w
zs%AzQ6-RALkRm3#W0mbZ+mp6^9=Pm&E^CIcX>6t%Z8rVaY6YaM?`lvY$~Nu%kLtRw
zsE#ao>!|eVr{YVjNwMY2b)?iWq5-iS2?ct<E<vjB`;EjAk{h|lwex8E*|q@Z*fiFx
zbmpJnsu}OYtJki<hmXw*f<FPDLEALrd~pC=0kjKE6AIUyJrsSE0d9f_S|qyeFm|;w
z12#+tT^!geO-+P<&4{H8^A+o5A1WopJ17sxiys-WjSf@ylTku#`jz(k=wVE~gj_bs
z5ct(ETuu2@;^bAVO}-{}-`;`!LHT&go7lrMF;&AYQg2<Y<KQm1b-4B5uQrikW%;($
ziEWeSUu4s#rU_MT1>@MoC)6K3KXX!E1B{-qF~Ith$@cs)(5JoE+#uWE3jEQ+&mX<R
zb1N&`FQ~u~Q$dl=PFdY#5ratQIO>D~!-qD%-^^F!?=iIg{O5~&u-pFTkiN$cC0x{T
zvtP0CUdnGcMda7&10`);!>4SJj{r-ABw)K;gUEB#8*xt|DPwud3!gL=5Q2*BW7JFR
zTb4HxtS3N8V;sd4KmN?Ys{S-6#eus^-t)>grMHb<mt#j!v<YZ=jXSoFf9V)oE<uAL
zr;>hiJVz28T=rqLR{ODCC~W6O)`)C=C-(;-c-eP3Ph=K*)vA&A<(=5)CRr@-iW}aD
zg<jEd%EsmpkDP$X!)vn_p~4u1a*lb14iavD$$<cJn}GLc4WC0>FaYpaWwP$$kXG?@
zEdF0%Y$l`tJo<6e4>&y|W7~ckX4%{Z7kBR<k3Dp`d}ps+Gg9xE%70l<7a>#-ySRe5
zcO4%U*ZPp1a|`6+IB?02$Tl*t4td|BS50Dm0%0e){i+jpH}PZDzuB^&Rg=m@cbDmm
z1fk;m`!46p7!x-c<!hzqE8U=$KHnmrSa>-e)KiW5b*`jGyUZE#QK~$L%HNKq^FZN_
zw48K-%kB;Dam^d$fyLscxbjebAGV|2Z<sr>bWbX|e^^#O?5F_gP!I9Kzti|wS51R*
z-Q=7{TUhn7{dUwE0Wlw&LjITS+~Z<vL-V+98rm0qlsfNl4EV(taPMhJv-fk1={K27
zV?1}2{}qi|oAZ3bq;7xTUu{QQMdG1~0T#7Y5qbObML}lcmI#HRcON;P!1+Jpwq&rs
zswv&dcQkSmO}9mm%fh;8&%V*KsvFTL$9Ki)$)Ei2Ctpxb@{f$*!K30>?Z35)!!Zj)
zY3Bcu5-MB2NkTy{Mjl{S+L^$C4STpYKI;x9{ws@1yOn53eG$I?A5+_z3@2X>-`4N)
zH8dSMa>RLv=Y||9!T08sxc*rW?Hblk^ltXfyV-sGK_olfKDh4?tJ`NGZwv`Q8dDmk
zE=2?co<H@LzLKN)hw$q;%OJ)jKE8^|5Q}(!^1{kXb$2Z$nFdAo(XuWV%ZbbQiA~+P
z*FSVIh8f#CI*MU*To`9Q`pbae(I3HSj&62)71L*Z7G5w#A(4YkEf@VxaSrB&Q=F-U
zhb0uE$%q5g?DB#TjmaQ#lQkT~pAZLaCu#Mt!Y~YLJv2Z1?<*(D##j;fTKKMVmsLq%
z?Dqg~=h@Bg*xp>Qr9pi|acASgzgO4hl}r3R5oFx!-!Hr4x3%<s^$Q5DStcmh4A}@o
zq=F>>NGTqw+ct2s3-n5G;bnRjGOoH!IC&k028`#-@x|8;_EAL`Mz}6;<Jpg3kMhV<
z=+%ir8P<#un3-Klkpw_AZDtFb;*-rzFs29}d|YB})bcyOonWKTMm*~TZWrYNSBQ9A
zP@V#w)hsQ5B%Xw3pokB1UuCqHVCNn1|BBnz_H8r&N8C2FRWLb>tk`yOvpWCw#8{SV
zBg!2{PEYKWOA)b&2C405>D1q#m&D?bn$tj0ngucYxQF`pK9C9LjB}9ApEuW^@#OFc
zgyEYd)r)X{{w;JYtf$N@VEB4gh6w0`*X2$Y#!Hr1)JNqHXED@?U$+2Pq7Ps*H@gCp
zzffJcWIySry*4|;?Rp4<E*rhXQ~R8i%(w*m=w5wX!$5>jlzH%hN`~Pn_ig4ImES*n
z8mJrll*1%+@)@iza9qTnO>X^bVvD)+wU6Sze!k0-{A(GtN9n1NYo0gYJ2!_q7i-;2
za};bGa-ggBI-h1XOel>N;x`%=RiAe_J@DdpN9BD%7@%t)3i=q?kQ)|@$-p*TO~+(A
zd-qpIqemUL;g+CM!=0Bp+{W9hk2!~FMex}=<KCJ6<&E!(!0kZ__t#I_tW~>uo9{p$
z??pbWFEz7&=)plOBAb&(LiVW-DyPuvbjZcJ*SuO;9`zSQ>jaR@orHMgx+#o*qT9V(
zZP@~<XI}m82MqD3mG%Wz#P9~r{JqQSJT4q`7P|VywmA}@&>u;N7sw)GE#*8o;4bb0
ztF(z%3ebn*WwWuEB%=Vk&nJ68&ZI(bOoQTV62nDzPla|){c_qqlQY`JM)e6|l*3&-
zDtpOXh^#0TNhgntYteeWHvbJ8Cr4H}WNWjXgz$d;-TGVA0*j+pips)0btWSPY-0jh
z6Rx8QUoc=sEED5UTgLp0$*Lffz@reKGc9GadNU?N9|~(lz*yx2hMd_H`A{G0Ai|uQ
z@~#hi?p(yx!AXs_nDCRpK<!;1OCCGv;zG_uNAJ&^)gPC5{<*w1_7V-A?7MWHw)e*G
zafA0xNlO7&OWg&6ZRPgGo>zJ^-CUPX0ln#K9F=3`?jr%OfJ<BsV3)HhU25Lw^>CJ$
z_$Rk?t<J(b)DX6|P^+-nxlwFvwJKw)6yv{-x{NNNq(GXuh@X|IW7iAmgyiCdMrXn1
zG}I0UJtcp8NB;CUTgN)>M_$=<=g=Iq@d~KEL|X&=|1k4S#?D|?2lf3GL2L7u780mn
zMN@p_d9~~yyKo~touQ8?901+@aD-<8lX`zam@03EGtlY4+rHkNHil_d4h<^9i(}(2
zrP(WmMAqGC9BN`t*<0j2RL#un!HfdmSe#^XL^TZlW_;#S$SSkrNMgt@d=U%9&H1mr
z>2ys%ov{kIa98n-`OGiRc$MaNjq9(Pb9W@wQ@k4@25wFq$ZL`kQiZTS9wQ5e@r%6k
zFsQZtmRl$thc<s~AEPCkaV$4wcz08*Fok2@bHjWcthnWFNaKN4Vd%Y(pnLk3nBT!p
zhuFIAosOqBk!PIg^y#(HQR?7^dAcD}lbbn~W_<C#WlHzix&y?SXH3M^J-j#_xh>95
zcN!6!>!>L%p*S+^<D`W-$c9#etMb=<O>R40g^!1Gui*O<3#H>+oi87RkY&D7G3Bmy
zvfyW1ODRWbd~Bx>#&CgXaw#QO;M^Uq?o{i==K{3w2C%Lhime$H%vC^3_`}!buPswf
zp4%T@(*aoa`vu20$xCa0{+Pfqatfl1c-)c9v=PLa=TVy;j>b&q4LDO^0)Z7%uaF2_
z7g#dvrov@~3o}Aa5x|#^Cf5GO(ivuTSO~h;7On6Q?Kmo6UCQWj5H(^<uIv)mr_qPV
z2OV7(pxZu4V@*uTB9N{Ks1qZ4t<Wk0@O&F(0xzPTRqH@1-?idhrC~c2V!rvLpj{)L
zgKQv`LHgdb=eXcg=~|^I6|i6)`FhuYL>femDNHE}X*rkSWMFg`DmeH+9CuD!Pa*)+
zTqhtn=J*_o_DkuvzQ&a*q>6pd)vT>hbGV{LS710_*eldVy6Q6}+3g%`94YS4q^*+l
z92AZb7jNB$+oV<=_q{ZDk!!<4bfS|ltN(briDd~kiDL166zua)*bETrD@fyAUpS7;
z-q`p|3{D1Zo35EUXwQII&EqX%KNZ?_ZDE%M5dKV`FVr-B8pMBlj*YY3r`?{N^j!9Z
znML>{us_!|<M&u|X@Zhq{zqmD<)d=T6z*@U$z|ZF%~2j=&4Na*dAPlB7L|v4obO6q
zs<-cPqE4$PD8Q7Y&Hk^Z+r}P5C;clF=_oT7>MHobIaj8~of;RTC|H90&RB_ZzgfwX
zROsyW@{SxSVt7aANRRNOP3PkpqPkZ^h9T2V>|sF^GEu|XHigEe458zsg)DqqeeRj<
z8U-79On5>ws1qg^UnVZ*E)&qGs2x21XInu#$nJ0$O)7Sr?z*6c3blB3L=aWFzZf(=
z!smuarRJir+ef^SuWTa%r5k6uP5vQa3S!k#Y~wt6AM~{E!-cS3K|dHdSP|m5yNUjH
zat5Nh5(E6jKg{g%Dr=6^(~kMDP{zwM4SQn4I!wtj=&&bQ-yx-OC27<GtPv(q7qR~O
za639X;6~23M{X=36Ew&k6Jp}9b=*Oi5s-p*bdb(#JfZjZpc-%#L9=_KB)}a?sZ2hI
ziefxZvbl1GDbn0emc5Rqd*OsE+nftrp~UssAjcJb{5iyimEP$MOMMe{bx`U+6wH|6
zpYgNLydPKFIK4N>i!(Iiso7iLPG-p1wh*E9u=4(kOS#J}dP%E5{x~9yn0kxlHS?7l
zIiQb~Aqy~Zlm1(12-0nj^oWmeTfEEK`6G8VJ+m)INAOdLg@Px03Mk|1MSUWmJWsD6
zG?4X2$<w2W?ggJLOqnh2`>gdL(?sq!xEMMv;|zKY*V#TCV*{SLgEd`l;{Jv?Q#Lgv
z*a<&~(GZ1qJa8g(l`AB5&s%o-?Oj;BqM0nY=6>`T`hg1VT$~4w3gEu>eOuV>#|kfJ
zvl_uYuj|y#9{wHu7;zI)sa)hI&%3Kd*;$)>GVEDt%sJu+Z2g^9mQ*!dnL|DC^>A*w
zkB8N3?>fjb3(LHy>as66E|I}Ctv_SI`sSpD>&a2-=$Q;F4pJ%3J8t9hkIwBnl)maG
znmb;AEfX-?rPeT~a*HL)f)~m!qq(^^h4YPjmR;matoA}Jn%GSD+KM2SzV9*qsZFkW
zQ$fp8jc83|HACaKBp&Y6dhc)SkQ)9x?G*Pgk3V@=`K0)<87e3CH(_Pb-bi!kI)(Nv
z$Y(Ps+9mKneprd#C_j*0_3%>lHU+*Nl57ookHyzD(}UpJ82*E7g(Uosh%C})wwGIt
zz(c@>pL&0ApqQpPZfM(udK#H90;@z?{BzRfr%zZzIC`=WiFR0b7;Ds^;*FHI0ADt_
z(-<hr0aqkKjVLxP6K7AQ#2L!`*8H7G8eqt$+VOp#-KU=srNrscRvbt@oE=gDTNr)G
zQf_2np4Z~#|8>JyYXaD}4ui+yg#11X;hJY|bNnFpH-cdo%HP)(ue!yA8ktat7t5dg
zcg6dIYZAI-El#iN)0D|;%3FP6dMEZ9oAfeO(Eq*8WogW<&2g)yooV;$yXJ8bFTAP_
z4pkKqGMKb`uo!8W+nF18`PT|B5MQ~1fe(QE8-f7xOoLgY=zbh(PJF~CGFkd|IxM%A
zc}83=qq3fD%T$>3(EE&GoGyv+=7(_NYENiO-7U?2Pp})b!*!t{KLHkxE9ABC{LwKC
z=GUwlbeC0X0Q-T?tPj@-@b(>?$JiUn_)A0bD%<D(s~YPehqcEs;KG|XHpwH=C(_RI
zvnrW<?*tupJ^s^ADne^Oa@oD=7K!mY;{8^G+LaJ?jMA<%(!+}u%Z4?=>ZwP(>3&ST
zvam%qD^<k%VI5DhC}jWolkweDoFZA6j<mx*BPQ`n?oPNlE~;uAWjud`k54X7G>~5n
z8>ckUDZCV<^gHdtHYufG=8}uC_I=ZLOXuRh%l&2S#wx1ebNi=)L(#FT*w-Bw8TFx_
z;|(lXa5{9sko^aJ1XHC)!q71DiJG{P<?9fl@pWNiJXyvE4rnoUpB>|uA;BcB8_d;X
z>AubQI16Vbh#vgw(X-^3HQ`oloD*Yy6ad?+<35hjOE%#fKTb3&1$$ULLuI0K?Cpp%
z*GKssTBnuLFsW3cRYEj;fB!oax%4~w7U7;j&rdY4A1c7rqM8HDgi`PPXmw;~xeeY$
zUiu=(Hu^eeJPVMO>m#))L=QZeiJZ?ni1%d>s&DiarJw_E>x${~xo%pSD*U)U$}U>8
z{0RiG@eMXoag`Qqb-Gzo45y(j6H175KQa?k!-fG{-s3=$_BZVm;HY?Xl=(kDTk<g^
zs7ay_AQxt&tr^Qz?N<Q2Lvd+;XS;nvj3iUPUohs7*}o`Z-e!w49-Uut<~+w2gL@-f
zh3uWM%XX_VAq8O`%<WkO`|EDv+8_stB>mn{y(F-B1dw#DG?>2eOTfdICMG!C#KtV?
zwUmUM#06?iuqbKC)ti=So`yp@k+PwRBWOp5zdokJP7KyyJOit8YCX{@DfDmuEe*~B
z3xTit3?W}qR4NOC33I{CJGgEAt(51cH>qUu-AFD9bU6$JX3kbK`CqaOQepL-cMrcY
zXw5u9`A<=`;bhxguhXV$jA7?1;w-z<5|All`<88FI8!6=Z89#+0AK+1FMa{T4r^Q#
z-V5Bi{7u7{#Q4HyM3C#8Wgc}yxU`i<wyjt59Mi1A%%`tp<T-(S+aY;h6en7ma647g
z>Ov1@R3=n5NA&00b{SSE@)F^{HToCZbpWzM0zrBA`$dw+*BUOCp$zm~6e1PwNDp*_
zfFn==SqmB(&Jm~xxhYW9>%uij`B@0)P06E(EA}7!3h1+=Oud`J8^rdg$f}|GCTZfT
zo382=$G-wd5Zl*bENw=DFJhcc#-aF2qxH^na^0v30DTIdpPY)YctkE~9}x46*BK|S
z*Q-?2%o5=1RYcfN0XZWHhr?HgBZ>1;g+1(|@9j@?E6IdubXjAGX^!#c1?#Hw5KfF5
zYOSdhh-v%?aqi^E{>g~^*Ki|ctKczGsv6fZnK6=J+6B$)&_`V{PQJS4UHv9Sov^vN
zxDx5eY^u`vmEfi&6FlGrXZuQYyk%rO69rXc*PrQA26(PVp$OrVOP7MHeA3#rE*WfC
zNyyE_GbxSUmEaxw7qsga?w0JI5I7MGsT$h0+Ur^kiZei1QKy2e7PiTFBR&p-UA%qz
zRDHiJS{<jl=B+taWqs+}W?R%T*bg@FsB@Y1N#HlDMtVs!QU56t)w7baQ^QRb=Ic{A
zcj%66P})C#$gQmA0@4Lxw7-4Ni#j7LZvM@U?7*VD2%+;mT_E54=ff=D@%(+nz=@1o
z441{%nNR096}|H2p2cQRvAUu?3Uu|h^mDcIP3HRjd8&$_*)Spaxc3smjDU$-oSO9)
zfXBO1eFzwfta&8K;ldZqP*RdIgu=$d9`>F}0HVydi`%)4G-0Alh-hx^<bAo9oTQ|&
z+@T@(P#?xA-pjV>B5;R6hha<`V-^;qOxaKn;ymxR9b0>;OAQmq^&7@f-lZSkzxWVX
z<NWqtkI5WTEJhhIQ3!bi31!H%>P<#~1lm-!dHT;K7jq9CAA%7Pm)}PPfa|3WOmNR#
zH?RHWs~P8O{hpo_17*s$O2D&?88wb+YmCu5tPu|P2Ak!x`d}69W1Nr%Aptcnc{I8l
zCQ4vmX6E=T8T0xqN^1;&yZb9D<w{O3OTpN0B|Z~T1^(rG#f$UWFx>Hhi1*h>*0kMx
zWwz2%-`C!X5f37J=&^HL;LAZY^gdlPe^sHH=_?ENX*&h#;1o)wR{fooF=U$6?wGSo
z$Y4)+j7h4WB+KDtm4wPDj44P*H<HjnMv_I$y{a7k?AjAn7flC<dc27a%<P(uGudfK
z2ZyWcD$idOzfmHjTad3>SSUO|>Hza_I~Xd*xqfKtgXXNc4s|f>Z}aVSHYoA$6$_nh
z7aFO`#Mxs2ugUQ{9;~TKiP`C^H46@$ykDZW5=1*3gc(oa{?6|U2WX6aw|>zu#uTLg
z*!f>F%Xc`H7pgGCOH*P7WA|1d(eHL{-Z_Q4!6rE`GHbSfbfzd%auvWhhTG<8uzqpw
zDAaui;Gv+;qkKea4*j|N<F#|=FfO$iLP+Km!{8Vc#!2<==l>Cs^;?RzP<{T5R`xzf
zst(K8J03OT!inGlwPP)E5oKh%puk0?vuunOvsX@=HbqUnX}Cg_N%=d;y}M*`l7<5o
zPT)w}C|_6vrystrD;={#;}Z5KOJUTJ1fA&$5As^=g$gVa${jP;`_@Y(Zg0?gPM+RB
zydCQ69S78H#)x&#?=(wUpZ;C95`HO{D236D0^ZNw5_`~<AxD5l2c+4(<i!Fh?)TmY
z3JSo49BRkd9Y4Cwzn=QfF7qLI*_=w1>-R))dDT;$hR@5P(?vK#1!3$Fyt3&U-t|}=
zhl$aShIoe#)VdsjQJ$26AG99AeQ%Ly^_1V8CC0ee_AV`qkqZT%;$h(HOk)F`JKQB>
z)#Z)?h9<>|kAj;YN^$;9OG3l}eM`Ro%(OXg1XR6?qVF*&uz#@@XDTv!GvgKtMSQ73
zi(YxQX=8lT@Pv>0!wkS`v$5E;Uwe-6;36`kI!*n+z_$_7_a7$9?Wb#N`=+OeQvx<p
zn$!QwWHH9TFeDaC&S<R**<$bpqb^R2B4U}6k@gml{Qn!uVw(9ua2o9f9cS1DQBvsS
zA%R0IW{?_7H8;?>anD!c+mWUiTOz9R-m{gx(^LC)ZWp!jcIvfo3Z_U5Wnq41ZMmdr
zAkMU}x+*ius(8bL)5CrY(I=Y=xwWPb<BHfH4+VOAEXbn=LuDK=j~eo^2c=7jFd>$L
ze>@Vs90ww5We)dEzI@<zyR4LCRbfj>Hk>!_();x)bz833w%Ri7cc?5exRKFJ4ZAtP
zRPOd(w2mpnmXgHvE3WB*e1Q~ctYT;#4xm<)yq}#z`pP)+JPvdNj~Oghg)I~x;t68^
zEeRGse$I#B&Z&3!g}52747ACNg(a^L^Pu`-N07foJ+`6S7k*;de*8QIMgHYhTXn}2
zM>YLe?5Uti#8rHc?^b>%{0XH1KA(32;qAo|qoNmHTC7=8?buPM=QdvT(f?&Z>OBY%
zEkV0KtsDG1TfnRixMIA|^-UX+fb3z1)KE{?I`oUaQ3Zc`u>NM}s82;d7FD!-6B!Nt
z#=(pG-{_XCpN7VTSsIGn?O$gQ6Lltkr_GlLE_iFAQ_BXfFw69aM7wtaiBtBa&U144
z`n>@jhUNEQSL8^5vAIyB9v<{~BEzH>HBv&GX@*OmW@aFa1*sZ&sXqyqa?CP!2e)HG
z)SOzy1zo-nS*pR}H)D;QoVWE?s=v~JlQVu^L(weWTA8J#wL}%ohb!}J3q~6-m9-0r
za*W6bO;L|x&7T^opR@`!VB2B+$#eY6xu<Udg`c|Xd%wMsBc1KO={ub!pGHanXODsq
zzZv;8#CCpvSY|mF|0O(elNoiV*F9%<P#doX=5Qc?;-knH(|a`h&eJ}ZT&`9g0c!mq
z=Nsam(9wtYk}$8mblz6xU*!x}*>(f2U6h!rNV-h(FI?O4YJSx0kMmU4X)1<shA_l*
znyqA+@a<M*1x;@jl$83<fyEN5WM7Ba-PYHjjlNkVDV5jP#Gdt)|HtsJ)Ng(GJcPlk
zP~A*?BTdxIZPkML=Fe!@)3nrUggBMjKCNHdDV!yU90|cxG2BJM+)xDGlbBdL-ATA!
zgxeGN1#w-5;08dEO8Kdtcg&s<5o?e6CN!d6MX2eueM&S0kwK_Ij3nOO6$FUYMGD;c
zjb3p~v#PsHw5v$h9(_hhRN%CNCt=_oMcN}(We{4sae8SPSF80|OlD(367F*|;ICRq
zNH0@os6KTFTcv`69eYa(0mYz^$C&2)tC*gY%0!z(`2GNd*y=7-D*aQP4k(KnE$=wT
zo-9ChOy4SPV=Bp<bXsY<QL%C8O74#BgcLMfzs~*n^kQg6(~H~r^k0%cWj6H<2i$8m
z{)IV2L2*p%A&v(z*T)4w-fxkk><aBF6Y@51Dn=>Bsb{>cb{@ASBI)X<A6scib2D_z
zUaX?(o9W(W2@He2R`zpo4r6-y%e7dXbq(FEab1O~fL=PFN}g>IABxjcqHGNhbqD%@
zPYX~S&lbJ9mfxPl>L=rh9WCDu7;5EKY)IQ!|6Srl*TBY^{6_g9?5vucmn~zfr#eDA
zue(G!sW7s)E3KFv0><=+lphOAi9`dB54pb7%f2INgVRS<7+t;`$zOQpU2Q>cJX^;)
z`9j{Zdeq4ig4@UK(dZ>9?XMUh{<)?SPw&Q4eN{kIf|}V+M^@`u-=f7Q7;@ZHnLV6)
z9z@{<0|4OtGA)wX>UH3LI4YXUT;W*P2gzO!$FAvC{64FPrL&dx=DAu?tC;GMvvOY9
z29LN?)&A`G{cvxswE5+f3h(#S0v8)~?OyWCU8W*9ih2ZQ&Ga>Ht|?od)f(1454L{S
zsx~-Bq*QLjDT4<o``z;T)rWfnf89^=u)HfZK){!}Y9JAUz^U{d<edH26jpkwk_;0+
zfT0`8M>B4)J<w@LdR}ZrVB+mkL?hgglVK(Hr5Bnvv*M4kywx-QA=_R~uh?>THohbv
zcg6NV_PnN%+Sva5I-`gI*#?!QNCvR%g_x1IOp)qOkN0`?3yRvnoeLZ@FA)7NV;}6Z
zEkWHB8Ma}BXc<jAA7#Nl&dn?tzL2fCIAGaQ<`8qn_T}?RziWqI7!}=VU7<Ah9gvme
zp^wAkJO@qF2*B#QeHewQf5s4f`1JS>Dz0GoOK<JIX~1#iS!uwt^YR$Fdg>>g%a!_)
z9wXBAP*h5o2Ztkc4kzAeokB+r0tGcChn-%ge7h|W4gKx!TCC6Oq8%2{cJt;X?rI$&
z=oE-a<goykc>QS-93n-1d+Zp<*dd%>XPk2x*0{HxunsKFj{42<w7uRg>#D1=0{y^y
zM0dVI(oxjBH^8E~^7x@k{c$hw1<Y!n8*J1uZXdn;Jm^SlCAysq?dm#@g^E5O8%2=_
z-SQ7K#m#AJHeXq==;_O85u9atw!1n<>#eoI)4)%z&V&1FUehSsmewn$;$0fw*0NUN
zXo;s+!Cz~9{@JP{v<w)H!(&F9Q3L+KGn&S(Xz5W`!?V(Xtmm7W=&pxDUa9m5S|P5M
z?J5T~%75)LK(9l+HGQE6GUW<$_-{;uX0Ldx^0dw)<%*h0l9$W%7lZaK$qClAdywM^
z%p>;YGBDbA?e=-#4ifmhunJ$C2x#@%QOni$J4njg>&x=oc%#*txTOS`BD#*>F93O|
zpC4#Fd!Iu|gdEp?xjkxr1vI2Ji%tbOggCCC+4_O%{Wan`#*P-|Dd_u+<)sy~@O{FR
zZiQC;m6hpoYG%Y9$YszrF2+^d^><np7>Tly8lI=BT!k>c8zsj{bfJ-A)roV6FV98N
z(qZR+jH|UT=?^)qy~LY9t<4{Bd?-ErG7S4)q^+k8NJ6vP9NI&coYx>ME%mi1Ap0j<
zC@s>K!kHRg(_zqr#UPyh;4K73B`q!+5<YXjd&m4Ap&O<sNzfRNE%h-h0>}GEnq?*l
zQIgDw8LCuoG;NK0qk`;;32Tf#Cc3t0iw}IUQ4Vi<ucz30bh5+hfoyDor!Lq@XD`#j
z(Sh5O{?R8Mxhv6DVRYlv?$A=d4V{+<q=AcyHbtGZCBx<AU~fM#el!^FfhJ$N@@R^&
zxRh98#sK@oJL>kpu8ME=?yEtlK=@%l-_(|_gQr=PFy45kteNpL-KH4+QndPYZ4G7_
zHJW1gv3t#3G~15S13AA`MTE#+1GH`ZSyRUOT;8zNYm_rj?eR|DNWc9?qb3raeR<&A
zE!Fcg?*}{wv{_q&ht`A#m9D3FD4cBM49u$}m|=l2*eyw6GQ`$KM@G=BqFs`DAqevS
z;#{0}w+Nl%?b@H!Z5irNW^!<@(2J-$?Kln4a(>3tuWeqXI?;aIlNSB-e57o|$G!T2
zbL~;f(O^Zq%?Nl`yRO>ysGU?4GRInGfOvg?tN|~tLH5}m1SomW(t)IcTJ~7Ejccq<
zJ($FS`Kyz_`|gKm@YAJUwC(e{?SMogy7kZzZs1u6^!Vj8uaESv#4D_Rpx?_w6qCW-
z=s>LFJ(F`^j8IzhR&i9R$l)SlwEY|lwP3wdyS{cLna9hC5Wbii_+6R{_SzmZBA4tM
zsX?5uFCjqH_Lq*+kA}AgU5pU75>BEnr`1Cu<v@sQ^t$(gL=<lOX@_E&wIw+)nT7hL
zOqvk*uqXXvZh+N$1d5w?|Ce#-(D1T6V;?LZw9Fnf^*apzQ%qh@zNfzU8=mJw@5N9x
zn-azuht~P|a@8W$=X`_etb(oz*pHxQ^qxW*_WkkL<eh7)_2qXPZ{A8>5RiAS1aorm
zMfBbX_@-z|y5-VOinW3=emyY<ALU>OV^6NCzL<N~%y}$O5qf_aLZM!V+N=E4-AHz?
zYTzD3=kS<}M>{BdF#bcIDo9n0-2zvWEUt9dd%usE+K%*X^X<~v(LlHrga|&GP^4_f
zKK{pwcm3Fuwlw!Cc{E(NR6-Z2|G>DnC0Y!RodDBRydb#Srim`Omj%lUJ`%C+)y&dt
zaOQ_EZDL?Oh7dms0$Hw_Ka;o#AZ8ER0CID)e2ua5>EYFK3Rm<BJL^iHOn2fOaCUe3
zPdn>Ddgc7sGXJ7gFFg+8eHc|{^KvL@L%*kVbZ{eg4mJs9m^sQcH4a%Y+zZJbtoTv$
zXH#j=lR1x4X~R>)tj`kGKc~hDqx$CK<CA=<z;#BEyPu%3;mdUBJCYV{#E~Oh(|jm=
zVvsFg6W{gRSo7)mz`f=p^<%9xp;pHdceJDbVb%ap_}nuZ6!@7;{lvLuCTb$^xqhI+
z===}Vx$7ljKxe|I2|DlSDNUB*peeM`>B$su_H;^;)^fBR)rJWwr0--7nKpX)XG9!$
z89uKS?SiGyjuu$$nkR@QcN%#5JXjd5e`Pwbdg7i3RZZ(uIDa|~tbv2UT~%Ipc^!Pz
z_bU(2xRr)&FR<N?TCa(=H8N>axQ5?Q$2UPU){lT2gH!L*_-KRaz=uKJy?Z9IDBdWF
zwXKqYnw7`YftlRLe#AA?7KUYNgc+huaDDe9t-TU{hAyh@w|SYz6!66B2prOUT<+@Z
z@OsV@YFkRN5ji?(KloRplI?dfGJyGVG-1*2TY+`L`kL;+-qG^`>eJ;F@}p2x<T68<
zgw<y)4~whFg|Me8;JAt7&9mBhGQ(4_EJ=;mVxGqHN(eq)$U24L%Mx@NkxJnBn(%+K
z0PLLIj~^dL(_SjPpaj%f#$s(xIVZZ=K5J^xfpa(~R-&-|@}UMaE0U|#Q}^|SDfy1a
z!{xOPIUS4#sP`<lBwg^k$>T+3{s^oDM~sjw)&uSUw;pFe*X6>HJZ~N=^;2YohN*!H
z+PUEB^~v`<M4A4O>q(^Sf01Mg=H~UIWO5FnSd|$f%+~kY>H~htt!{7(xC|_B_sYFq
zAqmZexTMyHQXA1y^&VOZe1Yx<UKPCxDLG7sp`5rb0iu|mj#6OA$nKX=5|J)=UCeHG
z*_GHduKoS4MQA{;SwJbghSi@vj<MjW1GfHB<+UGeL}=})_VBRCWK`Vz;(vmVSjQ%+
z(O!W;JR=P{LJn3N0=J35D}@rJi^W~efBW>-9&x7}SqrH;8+<)vUf|NAI1TcK2h#%)
zBJf}+DDQl>StsDscby7tQ(hmcnh<dMAWU<0-z+VxZ@)3-?0R+^c*{HB`f@b^-6Qg#
zs6TuXIq*CZ2;7nY>aV)Jz(m`BdkxsWlsBI~0o7NYl)7x{KBeUx+_s-SMddxURP+Nf
zZaW@U2QX*R%LKta^PLAN-)(o9SxWv0op@4H``_VscG~V;S6T_`o#S_)p0!(vR=}6E
zy571?`0dma-uiEZL{;b`oQmMiyK$&SjhFWT?!+CdQ!o_b*=BVv6)R5K4Sa&HgFKwF
zjJgcY<#{`8&h>7)9FGXwx;$)+?slumfn<dfPb2lY__nDcrmnbu*%m;|OhTF#O7jL%
z7S56m!W(^M<F;$~c~=8d#zD?A0w9i0!UaWcPpw<O@SKxgW-tHsC8-^`{FMOczD$HD
z4i$1^PtNSY+Rss)l))VxDIS2K65ur5?-#3Y`l3=KnPLF7GJ*%X#fwTfS@SA$T^bZz
z7sPhwgouNG+~7Al(Q;c5?V$rUXt#ff;9KV3#uf<80k&?Cql<DOU527<z~vSQSI6wW
za(tN#3u1KU`8!JS3J*QrVbJmmX?IxlWnu&$iP)MPoH9bF8tIH-8+R2)Qyfs~NB+lU
zN@iMPn(KH)l7Xf;FLdHnZ1f(EX`<YqbgRv)2qthE9<P@3PW6?-y~0Lo`ZQI);DP4V
z!3I3oVUb+v$j%mg=A4qy_pq!NU;H7%T%qPoF=q_>2dD5o{A2YUnb*wp(;5f6#=J|j
zxt8{7>i+HDx%07Sm;0f84Z*WG#H?diZ;NQbT7k0#4~y^BCjxHNqA(5M?@*;hkxFxY
zM93alG_r4k)<20LBG08(R!_Xwp)IUFHqMAoAsxSsr&DGx|HlN7_m`scOEr>CC+D@x
z+#0wMS(wPpCa%<DTGwMSH0R~+RDjd3qIp=7)llddlvi3Wt^8VI$4d0__bWPrHauhq
zW<UevUU>bE_1j~#$LHK#p;BVfk?<bWz>Cr-tH+T`I-nqB7vkC_0;jU?;)A^X%<qm$
zMKt_w+ty#dw5{Jkp!FQdI8kk9lB~Ky+d30JVFYZo0Xs8!EGN!+Gf_sZBdifD69ujw
zAD2S{AMgkMna2wov=vOT53v|CW}~vW6+{!xx2#=93yyZnl6e(BmvG34?9mDX%Ju`L
zw(r(FyC?*2)}A0QpF81U6Vh*M&em0|XzAwl)-OONV!rqFd3weh6@6i>E>n@eVsHcY
z`l7Ykcdj|2I)&n1=PS5xJkDeOJ`y7A-n;oI{J9xX?o@kCtL5RhiHV-qfd+AAj8Y38
z1?IZ~%u5aba|#is&ETUt&O4|dY|jV4JUC8nmfmbz&hObf_zDUK$qZpU4j!K}hU`rc
z8NJ-kN3#a*%ZneveoZ(7(I7t0$I>F7u$tEA9IkAidfmUmc;DT9=z3)8LC+1Wj(DZj
z3{CkWwcGg6dE2gsivqqz+C+%<wnd{~<|Od25|b~*r(X|hx&1`G&Y1A-^ca2CKL>MY
znqjqX#yY49!D;ugmQ?n4A|8ra18DcuL^fQ~x=blo<MWLCRu5lH&pS^2d9fyT`LAd9
zKpQv}p3^Lat)xW~(=Pc2b+D%fbdl!fMdkqRgST{W2GQs9c<hykmpMRmgwRIAXr#O_
z;xl&=y|*JjF6*ubw-Y$H5y==Rf_O%ffz3f4nR&N<ySO1Ir2`X!wPFt^o}FrbPqs!(
z5C%HCquEi6Z>7qCH<wXH&5-M;7x;YO$F)1)O95wRV5ip)hzuHO(q14~Q+TG!Qypi+
zMBpS?B$EBMG4MQUlHoYf2buaQbbUr5(dg}Z&0t^f4E5CpbY+)cx#-;WXs<3`e)VNf
zn!H}*epBXQRI5|JUHaHmZ=H`%5$&kL@R)pHjGLwXxaviH60+FQNoqVkWUm`A-i$+8
zNMoWtP^)VgtDJ=;*!hL})k@}tLBzAI!Md-pe^Y0`S0MUaqchi>9Rk!Iyl0+sl8)OC
z9%By!N%?GioRHdrY3DcS#e1YfP&JylD1A?`z=TX+4+3yP(VFWw3bq60gBkZsn7(?8
z#<&NszKHCEffK=3#0PV8WIp*|B4C7|U3o@jJ9T813j_2dcs(P1B@!UCZ}Ol|{J_A0
zJls;v1U^oj<K<sID~AWIoE`FUh=;~N>`2gx+AN3jEJp~XTQ4^m{zItOx<I|q5sbPY
z3aS^9cih3BX~d|@s|Tn*?fTrG5#CNk`2jn0s^GKJn$v+mSyll0s?*#hWs?)>X3^Kf
zC{%gww=!hxq{&IEJ#&fz>sshu<>{HTiywu$#il}WRxGFdv&||o-~+ay9B()qj`#S<
z(9A?WIBn2!|KS?FRYXln6|zayqEFMY)p%0YZ7=TMMJqL8YgGz@+R8pf(tYtm+GPj%
zS(8%NTtf~CK`&1XLoDkNB4?cmm$J(KnxyhdQzuFkhO)+5z_y<?o*@)Or#?enB!SO=
z(omjrPJEPClWRyoKK&AA=(N|}-X-9~g5A^So!CtdX`!RwTPBgG-{zqKkHAM0(!C#I
z$LMs7LmfgJYqw>P5B~5%YKri|F~gG!)V8;GUX)S?B*Lfs8Ye!K;f2`8C;>-wK<Ys{
zyv5D?3h;9yRFMOPd|}bM%XiIymt-h9TK2?u)cSGz<zCe}ZJ8mY==_8GL}gAnxb2#`
zBBxT>d#B#w{qq1cY-xK8BGs4m@_Y&fSd%syo~>9(bD^zKteg!Fv^`%^4HQy8Pewje
zbotqzL({tcG>-|N5J`#b4q5QBcC*OD;Tl_=vaX#;4Rk2A1!fmKwrb%9Xi(D~oC=>z
zCEVVz2G}?!L>pFm!6m5G@g{V@N3Bo$d7Xae6C5(@cMhH)pO*EG6Y93{k*nb$q3Y%v
z_Zp+ehJ)=wplmp=hrs&zykj9chG??M?b110kWU}ui&Dz&1;<|J`E{VqrbGlxD7OTL
zxo|u#J#Kgz-i4i6RA-jKo(01SfcF83^IleVdne^}aVVpmG0Cnw?^9T{d>%8Vzy0T=
z>1@7TJ^gI9p-EYRxMFfxJyd5>gUp7Mrg5NIM65o~u4>Cm3{Mp6aG!yjj%flkRS({J
zy6aJ`7P(Nw9m1lXErF}e2Kj^e!d-J8{Rt$DD7$R>+~A$JokNV90ml_av8xkDYmNB#
ztn2WSA5^^)e)np<WqDTlMs>^NbQhveFwuSoeGxGkUtTXe=XL4lB=yqn+bg_$97KN*
zo+PT1{SNTC?F^f@b)WUn?h=!D!e<Gnu}c=>Td(*0UHpNElHaGOxzFB_XwYI1o0_qG
zdpr=h{R%zgl5Q4K?S6bnXf#{xa&VP%3I{>iw@)qt)nD#lyIsRu_xksX6tj-izE2eW
zWCwxg7ip3LxC5Q}=&Ut?#}zPf?r?XAq9LXB;bmfXy#=HOne6M_Ex>~S9qwE#``7A9
zbH&!Sw>uTt+UIQ4*XNA^<lnRypvtrHjUPtQ_NJ21tcp%c&GMW;&>fF|gOIS;SM0`3
z7@oD|#XF7?7Sg?6SO*KAk-s8#R2B@QfRs>YgOM$F5{9_;&;nFy9z}q6-OP?NBoFol
zpxfUgihd>wu9|J9(%PKE?tL%znS{gY`<D-PexV<*`>LLZ@kq##SiGA1VbW;5TOqt@
z`+_;O=iA3>IPeYU;-Qm~8slU@hJZFL_O~e{A_0u-+)`|g(@<J9nWyL$A+6mS+irnq
zxc*c*)*+u$xQ0^B2A9crB>$m}Ow1^!MwW5O+*j(hC=YOy0a>Bn;3;E(T4`1(F)k7!
z+h%=Xi|*ae@7J{P#hh4R_2?!RU1VA8q^EG}V!skzval9oI@(fKTp;%DyTKTR*}SnP
z8x7y=40lp~39Azyl7n55hm82kq&&DbJ*%MKqVN!oAVpYtzld_;R-(Y%<`t(BNULuq
zwi9wH;!(*5#*!snV)>QRdi3GxZ>gxp_Ta{F+_<>Y$e6xVc=4(FpqbNJF)q}E(bV&3
zNUjf--|oFa@1~F9QpdDl+!9C0ubVUSi0gPS7^^Hup2pLg9?2dBqyB}ebBDK3dWt1y
zy6X~9i443p^E_03nhkrv>P=<#<o^WdKC|eyzSZd93H&X8x=Q;u{f*z(HWB_#qz&ts
zw61&i0cHy%pd}te6z%42!k-7LH_mmLFAJ-oyV$J(1x>V+;1=T9PKVVyY#VYW-4IP_
z#<qcuRDz!X2;h6k;XyWb>*w1QnzR7ljTv4G{2N1m1BvvnKd^i2HM9P#NE$NIr-Itu
zSmW8j=Sm{lHizs{87DV^-J3l#=CI4OCt>-QoiaA4;5J+!GYB{5{2Qv5mL>?F9cuNK
z%0(ZgZPKwQ=M>z0Z4X_*ydRyr(LCQ0g?ET3-L|YFa?kQ^vqj^mM&G;S)?s(@UyLy1
zef%N%xQS~X`63Qi7Pu>-q<<u>A<K#}Lm5QfSbyF=j*Ei5<KuW`T*@DGbi{?m;{02k
zmox@=>#H2Y*R|T6g(E_jijE$xY#Slm*2@qK3fPi3@7~^?Dp>;xj*7yAZxz4%GSQc!
zFrJ$dRv|l`7i!Ts3Z{>o%~avpo^;IM-c+v>N9=+JbsS1=9v{fP1gpKUpZfTbi2Nl#
zGnf?-7~b9YpKLAKo<}NtZ5A<v+nLjIAEPM3;Nf-2S#=_e#vJ(bLqhyCFYfWT92tmT
zVqHh_Cbb?N5czx(M8!SSn8T^~X=G=_l;jcC8W}+yZW1Niep~==i3AI)ugOH<A_XFX
z^V;t+O8O>yj7HKm*P=cKfBlRr_2<Oo|3A0_D{za0%DYcF`~N0a=%S;G0n~Yn`+oF&
zY<i?}vs#XrL_HwSpE16|+H>V{&tarf{chU@IQ+xyK!8_$<?;nB-GyUbaj-Rp)qaH1
z?O&YDuAfl3_O82cOz%Y$D}WZ5*(Z~e`QUe8O<C3Wi-2fC{y=@rrlnS<knmTN&?kzr
zIrUzP^%<dWSCN$mA1m5Q+#t{;JlyYuwG`(M>~cR)$#1@ABBK?+hCqjWL9FHel>@f^
zMt2v1sE`us-t0<{vj2<kdd&{i+ki)yTc-`pzkqxaX-0DwCnff76?E7ux2E@L7PNU!
z!`o6=tkigQ1gN(<%KmaIerG<WF*@W7Si?OK^EIJicaNs}oR03v6He=%UG7K9M>%1^
zchbmz0HX0d?C9{kL;c;<+<E!{Wfq7(nurE9;0Lge-m3SHeA4`JLJiJCBWevn_U;xZ
zc3Ik=7@nnI-$$&u{nsv3{0{LH!27YQ>|Nh6(MNyhdyq0~wd?BP06Xsdr1ubS`?+G2
z@7lJKzX0jid1s+`wuQ-`4v*qrmQaC){TsrcR^5(F_pBnWCLWJcFd;5G?RwPu#_ykh
z=J9DAbq>UfzK*Goz$&$xNdQuIo%54jEs8%N+5~^R_L+>By{FlUcgDPDdFRe4NGlh~
zY~f4uow~J!Eo)MKSb%*|c)<6F((>b7vA|N{fCs(xa!7*5eFnsB=WHqR5Z*ebGmCck
zoaIAvw(Wv-_i~hj9%Lt3ck6q*CLdoZqVkPh6lV2B(i^S6GLlhN?8iHrA2jb|@bJHi
zi%TNYV<h5#QxPACM1K8l=PV{DN?H8d$V!`U*S$vGOGa)zr=YioCHQcy{=bZ|t~t3P
zMdvQtU=P$0|5Hy<X~hTPCo$kYL5}9hkf@(qGejx#QuW}D)i2@cVAEprwZ|&@?dRJ!
z6n19{49?prT433z#ZM4zXQoBVCc`N<$g6?$6EsqaS>e>+)p>>MWtEPzOTXMk%Vw38
z%Ic^^l;4srN&5UgB8X{|c24w;t2fE_#l43Z@lK_8#)qN-Wc^F|kNHId6T9rDxv8-%
zG2{4JgIbq98h^-4Xb)Fc^cDG*it^twyPZo&bAA0!C<!Z3VuV}MgIq*}5@FW7a}P{K
zWG{$8=1u}6eZhx=|B;cidityW-)<6oGRqzf!$%uZzv5!I;&wvOfh3LrBlzTDvZyyl
zOf=ep&~jlEXgs0>ANXPRfRja%f{5RC>2rhb9$^P&kr}8$lF7TL&2G)_(vhI!@OwV_
zPbm`-E|S<O=h@x&8*d->kBVCGzjs*XLmS?UeCEHOWW#sYhBnPEKT46(Ys^?7#}p&|
zS#?@<H~FWbg}Ix3ZS!EgROdne<+1EvO~4&yTi+$*4BWN0CpCgz`6M>cmuDqni|AZl
z>pNaG*Jz@BoaXm_?PMU<<`hC!*3z{3=nBEf`%{7B)#<wkK31Ay)RG+<4K+zlleQCM
z8*~XnmV(jmu>3&>uvrYqgl)pRl6?K<b*v0t(#g=I_R*JC7_!La^6b#Q1TkTki*+`W
z{gAIESeb8mxcaq%(tMZ(+A27mB~>6F<UlGcLZai=qH}^aC9rFI9k=?SRC{+k7BF*6
zE88F0=V14JxOQFe#lg|*+|e+MApOz;0#j_P83hrH=&$!&4n&KbGWa|G0hKh$-TocP
ztEg$8mJmE?kM6?D_dlQdx)pGtmZ$4EDmb#U_Ps-EMlY;o=SPK1^LJWQrS5fC$756^
z;1#SKW9dcu=zAPtbNCPb1Y07MhQ{l>JB5e%<=AKAh5^P0_>d@jrR}@~#$H<XR_C0E
zx)$obihr8hV`;8?u7C2GvxXZk6RwoCNd9nN$JC0=I6C>YNlWqvds-@{^3X=1nRLnf
z@Co0}`P=7*Bci51JOe{$d3Q%vX*zdoCg9p0L?a9$ygMTvz6sgue_rRqHFGSq`oN<O
zHA5qQZYiL5Zvk<N%nDDKKBV+OCFP-JT6TA&d*?+1L!xtsw-@A3s_KTk%cS3J+xS?x
z6WNEjtJ^%TIqKtvI7?P9O1xk?)1TdKv6IaRVQTEu3DFffaCee<FPrhnOx;0J6YR-?
zVCT9(IYa$%w?Cz(fy}|L5U&%**q)q}heFg4y@CLIvO5#IKSx6W0OFcLCfRvA++Iwt
ze>cr_J`kH`nMgN^Om(jOw6!bit;^P@{XHnw;vHYeZyqY$o;%qf6b4^C+x)4b{#VUM
zn^m${goVkVpYHkDKJQPCoqsFB$9mrbvFa2fmn=ZZR^}jz)H3Xo>`ace757o8NW`wO
z!HL1>Z?SNZa0TpnPMK?ZQ^N0340Fe4AaO7=y~F1M<K=Gg3Tz&O5I0D;`{$l=8Cc^%
zwGO|>!v45>^sb}dG1K_Bwzwh2NaqBQgu!j8Xu8Vr!CA}Y1oo-OBj84*_BIrALQt@>
zY4Bh(2fckr<o$Jy)4*+))$L*cv(R8Q|H8|LM6V=?Azricjm<=4=^pv(i^YlTLtwJt
z-eli#d5G)k!nNwd9tp#Jz*S!bxrGhsEoz%!GVav*6ra*pm%Ky48$lX<!(ol_eo~+H
zhiW1v{!7X>pUu+E$q?K~DFO<nNnxoG)}>YOgx5}e?*r($cD2XnH(A>YxuFHHs8{Au
zXGY>pjQwe2UWY5_A}Q~JtIO(!MD!&ihxExcYA2vtbE5%z*t9Z=HP_W(i(h?RL1uW?
z8+*Ka_HuJb%CmlO4cUEkoybkdJLJnBe`@zVMw|!rdCv=?rV$0Z)2v29fUYcz1E}l`
z=ZnM<Ab92H!?3jQr}mX<sg3fVR}7E!Q*%Ub^?y471^IIge@=Y{-p-ud-FPlsqen!D
zK5ya%ydy5W7fo#Q%i6XloVdoXS@j#ME%ZMFfi#?%M_C-bZM7{@G<sPC?SZ<*S~jMP
z9owmTkC5%LW0+0**%mA&%dxSs(8bY(vuw_{ZN4CKZNBqj`|Lo`h~lOm_rk#W?)C}g
zxUDkJIq@c&Q`xhjRL=-j=#xDvt$8wumYSKpQuC1E3c2vv>T~m>JRxrLytVLn>X&1x
zvbz-ls{IAg`rRid^=;mWHy6h7&s{P%fd*Bisvr1HD><_*?;|`Sa=~E19xX&RjA+$!
zs_@N)+H(wDYbM=zU&Pk4x%=a<w9b{7hL_#>zV@XP${j$g<Ju;6fC0vQt&`EkIPdBf
z@S|VONDw5e2YY^iJvwQ7K1+qn?8%kK&%x_4DVI>htACRPk#9FioPmE^$8HKsYkz-a
zavOEHlx*2RF%WpQ;8nvfwK?xtZ)W{c#5U_^nk$>?u2yI9c^8m3{ryr`|1>^Dht&Z$
ztb$up05<O;<?)YA&GOJY=}A&izkOS`fjGxs*xGo|e@u8X^RTiZwy5QABVWb~<@cbv
z$eC_Gq{Q=|{-j-8W}oxYKmS$P58{sa!(&$UBw2q&c}ku?##y&-&YDEP;Qrg(5pCxW
zG6PnwGTqLr(CEPplZ%TIK_w^lu5dzYq>Zt-D5J-e+zWJEvTpgyga~-K&=wKZrIggk
z$7dNYqR;d+znWjAf5Gz;3%J0S)(+!#G$7p!W9|Hi$Qj~I>G|PqR{I7g7ryz{<9;8-
z(V1*e2C!}V7fqYHmi=vDk)&eapuqHxxL~Ikc0Y~myd)Q0J4X9|>8cR{qXYNoek6L7
zE_iuq<pw<2-?xi7Rny+PHbJ;+pOggWE$;uZ1{#u_{67HUKpwwG;O@Kc3g@2nX)|2D
zJ{)QvquYL~&BA5h`nsPI+~G~Th7TWiqJN<7$3MC{oc5^`o#iF=0k?I`(DaH;HVp^9
z=e=%}I^T>?JD5SP5nTC$%fm-Lcx2fAO*@B!-gB6r+T}FoaUcEgtcIT|ElxwOW~XGg
z+i|Dx!H;~*uW<OWordJ&W6gjufYT{lHNk1&<%|>d0*MU^<Hb*|{ZTmfm=A{Sc6ejh
zbhFnv8H|C)ANvtE5T|snG2`_=?8NDQ2fo{Xj?Z1VN0|Yt5pWOe`ewM><t=--0Ug8O
zp$8ohFw$*iMzt;M1ASa)aO{Ua6fXPrHye?#4+ZWY_StuTH)e5il)B>XU_Qpy55VAf
z%uye3L+ZQVd${Z8M?bteeEcKFv|TTJ@a_lpl3*jdzxSz6e|p$v^UYd{_BFfH`3Yvc
z+jaLn%^18!_}%aR*FG9|eAk92PJ{BHK6Fbt*o1PY?1^@-E}PL-=~aPQb6s=wm3}Af
z53h=+g}LjP_QO>Myj*Aojq1G_Zlib%%I`hoz_9bKZwcGHVFyQ9_rVV_Bk$Sv(Z^5w
z$^1hOJEA!8zSuqtxJyZf>rF5S-)immt-J1QM&td%=38#<xai=>BM$SA2`a-?SN<Tp
z`(69_UEw?Lw!7<}7ZD$|{?O<p2d9hQZ6AJn>t1gUd%a^nC-Zx|@As$!_iK8^13G)p
zLGKE0+h<?r!zvad_HiHmNO`jUeTN(z_C4TWFE1~r&OPgN|JY%A0$4KR-feY&(HrCR
zyG<86ZM$_i+jK)24nOik*0m@6Zfah50QcIdG}=MAmiE}r{$Lb-R&i3ebEEJ~UM8Z+
z$rjBvcOICDqkF_jSw3A%%HSrzx~tp{R?-r*?9Cd;8ps+Lhz2wwF<xT~=8j-rZ)waG
z!a%rZqC?XF^%(0i-4SAcB&<~InS`-fVt>??4r&ET2Zsre`^ZQm%mc`UhVoU@6%T)a
zFc0(r^70VI6&_*mpa*~9n>T_8D-4pD<0@T#h~o!H6Epm&ftPgA!Ue!Vu=KPq`FX&R
zE4mitG?kxxJW9t8Pvu+D{D9)PVEOcoUcA-HKly3xBQuUMkN>Q?Li_;AJT77`TA~3a
zAY1MGMxZ=FVd>sU<BGX%GY~s3c@iR{?4`F`mv?8B<#aLm*xL&B(`<&OA%Sg#I3bK-
zSergK0{Mbu%GyOQ6+JF`m#$6TK5h(MpG6-Mhf#FPK0P4e)_dIMPWk#@U)XmJoL23n
zh4w=reolNJJ5l+cfB!3_-Gz^6{o78oGWO7~b#E>_$-^mKeL$)mIry;Mop;<Z<9^b1
z@}@Y@iT4<5otLK8`;l|Ti9_on^b?FRlnFoO=hQIw)6(v}?OQx>>9@Y;AHu^R#!1Q*
zS6H$9&{{pW`Va=sJMX-sjz9VN346PGL%ucFvJV2<hq^Sr)pO}R)N8$PuQb2fz*yHV
zxX$mhN?Uqtm*y&~tm;2Y#VFheTBSG2(@k8Xdhe9Z`gU^twf0fDgZA6E>v~^8TeW+-
z`B>g;fL@l_N9&qhMN(aRfX}E!Uv3v%7Q6fU_S+k;&uN2q+o|VfGF18am}TuJy|Z`)
zyE=+?Ri#0n<K%PKP|Shno_o4q9kGp_6uzQzr!YE#Hz3!yYKiiSRKsXK=CAXpS2~Rw
zf8W`M7Clq`lQqzR24b7Vd{6_f37PBlNKKmT8&wUc?MyDRLqIm}P1y(Hm_w$f>|^7l
z{cSMPkIAlVFomBBs#e*|X-|CO6T`({`aFxg?d-vr%22_?s?)-p_9dQ&#knS3T;dca
zA7SMq48C0ANvD|+FTZ&`tc5@6qyY?M<O85Xm^57B6YoveT>J{-I@FJbHO3&2MrLIa
z1LE)#pE4?mTD<ZRr+DII&{Y9bT9)huA`ZG3g5`%_GydWsK89MypKyk(fd!`l|DtKt
zphY<CDWk5Hv63~O(B<c=gEC&ss4lBdKLKP034j5UdqTM{wABZ2Ji{!1pfwgi8yTl|
zG8Rf*I6~5Y(hqg1<ox^|L!Y0xuZ*MQY1gPJdVKJ$C&NrZD1M|)OD|Dx?9MO-8=4z@
zi*otbuFa3(7K0SVBgPM&nqj9#o0m;@+|k&mRl|xtj8#?s<nKgpY|uINImq#}*LvY}
zYA42Ev_pB?)niq!&BD-YW(+1ztMq1cJB@Et@14@P!wjeYyy@ni>YcvU${37X=%s2z
zolRcwJ23`B%VlX|3?`j6*oh22W?BDAfx2%*gFe>{F#luh(EYsIZo5;s>Z%`xbI$p6
z*zh?Uly~v^l~ufyHe4Sw%r#G3j3kVG>50LuGL|MN*_$<xHIOwh(i*@Z%P*`JnK77s
z2V?F%c1JK{avs}8y6Somu9(~6td`n8wfjtWpiG_Bc;W_O|D;Ufg&%0fKeefX!$Vn0
z;52O&WL1WVGT>(iLKu+2R&k`04~F=qFfmoSC3zZn;KLuQHu&O2Jc=U^04^Y&^6MC$
zWFjA@f&mqBBCkE7Lgw->gQP0ce<C)Q!i*7b=}isXMQ5Q66b;)$7Kess+{;<u@KfOk
zs)ZsrD9708Ev9p9)Co-{Ni`@j=7g?oc&3-x&or0Yg26uI<R|dT;b<@tq2p!t^HlB>
zp0I_A52j|&LBaOY+CPxe%}L=}uN{}VGKsydm6LZ*3iob9-$KES+Hg<QJI`FJ59N*Z
zLO-hAwmzgjE)jZk-H71wQ+GWQ>oI%OW@90yr)`<SSL-=ZJK+A@V=-E0*SPC_#guNB
zNdyeT#LM{Ox>#iKHm;m~=BMpv^f%P{KsleZWR(%J2D;L~ukFKYJfi@OMg;YtQIM~c
zAz4$!d60P_LY=%t|5aS|#g7cTjK`v*#oBh;y)m41)~WvB$3R>{t8u{@iffrGd$I=R
zOas*qn$DRZnepgqzz5OzD_ji09JJw^I~@F(n!48y43xsBKQSvKXY=Ioa5n99o5puA
z1_-i6%Kix}?2l}{<q`)V2rY<s06#WO-qM24&$*yOJh<SIP8=YA$_qd7;HLDUN19yH
zc!(2y^OotNL7YR?Ae<sVfCu7YN*IuExS}D(;7cjcBai4xK+&-zr%yU*!Y3XaDTg#b
z`QXa~h$b#^;)NWGTCGtGC&Mr_pxu71kj}J?-b`oJMY~@Wkx=rEAsr|2?rj!d#mnJ7
zXdoITr=~F9P1`9N`xz%A(Ez~*N2}v0KP7B!#U?}Ai{Ha%4TGODVfLB#pxMC}WtuX2
zDRrcQF@4m#5R$6+y_9(9c~woLB0Td`gUXKgb<?i~+?j`70kj)azFpnHJVQBg{W=MI
z!NeHCN4A)6@Uwxg&OLJ=a%Pz|kTp=z07I$PiE=9_9%QIZaT^W2F^(~zo&xdPnj!dX
zGYapy=Uc*+sX@3NHHWeWMp^@n+WklioQ0bc4X`9+-KXy_@REEfdn#Ki)$OY)V`Xb$
zZ9Ul<DPwe{fq`lkJ0rsfE{ycZK&z`8bl?@6ByqwcpMVVo@v?O)Z<Rh_9&nW(SGH60
zmhwmr(uAWp@Sr1rUKy4#SBXl%MNnJ_l1X9wFalH<F$G@*li;GIFfJfvrS!nnqk^g+
z@De{<K;e`J_&S=6Tp8wC12&?n(&t)~apSLry-sSBF5QGyKL;S08nKpqO7nVWM(s1C
zGE{l?nN?ThkZIcPm9nLSw|(yTjl*bH<l4&wPe19$y;kvVE4%E}*xDUewt$Joo^FOj
zOh&N|`(Kmo6|GY&wTZNybV?(|hmLo*2FAh^Z?Jx8Umd?zFOjd}2P?&3sAFu6^3Rou
z;qDsdPeqlqC;tToGO8K|qllqX_2L#|wD%h;>y(B0c@;A^Nq+r|t;m+!l53KUkfmW5
z7JeyoL8lC7Pu4)zK)nX&TNdL(jP;?0P~g<1Rr*%LVW?3)@hXV5dS5!LTm=n2GWW5M
zf1*yj9LO3NDGgNnmUoz<zg5!8UbwuzS2gMj4cC;#+QoC%^;3RP6rtoXQcB9g%+Nrr
zbX)hZ_K8>Kun3wqL+~=YBN*4$J!Dkn&LGk<v0;t{6=}MQGvSz&I*u9CIJQX)w`}TZ
zEj-%b%U%f{em2~s6PBMa_D}8{CXO^fv_y|M8Ir|I{DnhUerUl{vJmDW42T!_lmXm2
zs2YUHkRnP55rz<e5TvQV#349&d6W-)jI*LkK0U;VKX}9wr|TjlG_=Iuyd^F1APqnK
zxiTW<pAWN`LgpH%Sl?C7wIE}{U!4qbHSx$DlOha7OgGY17Is5n+y)bG^Cp`wBFtTE
zADWw()Nt1Zfi6*KC(F$c9VX3mV@7B{>Bs$kMvptL_^DHOpdq@u+(XUf9mxK~fu|3w
zjgbGx0M-X`U6SzPSl)UO>O)<Up7U&R4^>>xQ7Pdtg_Aa=Yw`9ll@CHSQAlI#&L|S&
z2oGgqW8{wg^$ikBEc4n};-_SUi+(a>4J-f+G;8TI`cVU2I8M>0W~_^gKIBHHI4G7B
zM7tSpA+}1__|+0m1S>A5gMp8I?1V~64rUFEjt11e%e|AYeTj{8TPkS{2UCK2TCvtD
z`lRU1y!OyiCgQr9nKJFWevE)$6;=9j$~*f<O#{XC5R-hY+uDNF|CH^W{G)Nx9PqKY
zS`%q1d>bfD^DdZ#aq1UQR&AhVb5t1nBf#RAp@J}JGW>!MkcJ=IX<SH0JPVfi`YJGZ
z;6RJ!1U)sYM*M{@T=6GAX#%AahdewERSSg>NCXLjDgbc^M?oNn3qCl+iy`p<IKmg7
zDm}s&fJLhrf1UV+j)W%<VQAp;q;f$kUm0Oa$S|53hz;5Pszn!KmWvY$r~bA|VS^T(
zpjU8_SO|4U&lf|zGH)}#bkh%>qSc7C=+B1JC?9d;@v9u{gzlonaj`h)pPj>VnxB9h
zOxmJ`I$UH%VcexlIo+pW*ikz8gMlcvu70$!4jA`<s?OCXiA{$QjIK!cAYFG^kzvl5
zcPDZOxujx-pSgjV`b8A_RjmiijbwAemGQ(F`v)1Ua{Qldlzd}s<4UQU;^eTxrZ69K
z=0xVqG;5%r8mJCN8l(yyniV`)q}9bGvap`en!-9rl49QCq+xwz4AHOZpehrzD&*?$
z`w+kw%;{jRjmVHS&=(ERu&eFX<B}HNsI3>wXRgbcrQ>`J3NJ0)EzKDoto<?Mm_t!j
zVH6+TnWxN*ej;D&+mS{z2v5g@85%RpK<ugZC&8*`l0!q+K&%U6YxTtSSX39kxQurN
zb1K+ZL8`PC@|DzD;EhqT7ik`rtF0=~VHF=*$RV4hjIG!o@yq@R4)#yt<kEmhXL!QT
zqcron4b_J(0tWcO2M51+n78CFIb=JPJm8Qo%@4m6sx+NJih!R?5U1u-;nD(Fk^^xP
zQY}To6XpR2I--kl7a$Hk#EX}Cy#PAtE1JZEM`4v;aVwgKLL-L?hzq3oV@&>=H827i
zh{gp3v8GzI)|m^N&IRpPgI9;_7ro9)GJ6i`s(y1dd!AOQqFKe$=FO`qS@>1)nuaY8
zM&ad4@3E7@w$QM9g$D^*cSfV|lz$PIGGG*5zI=t^Yq$)h8YVlDMtMfHWh7-WQB|iL
z(&&9UU?U&ti*CYgXx=D7P5-e*R4+plV<3#8eywcOU03b1Ph!<7Iuf)#>>uZxA8PJc
zNo8w85By`rWy>p0&|nz$7f<%`iA@uI!^b-|;)NdPvcGg(*qkA2z*~1s4Rzh#+O+zE
z)&>z%u`#pKlGu`9jb6=HCbsL*7}YL*k9esuxb9<eJ<`qD7qAAb`7@vJU;U&uSI{@&
zQ;U<X*zQ{@^AT(7f<`2Ssh|Te#<d<To*m?OR7tOV&_NoTD9vl16e$2s_F*#r&WA<%
zRdQxBv2wTus$`Tcy93pLtKHWzHDmqKW%t-e<Lp<J#S4W-!)>kI3{<?4A+9-XWCR+T
zAXd|H6X`q2f-Rkvf#_~~@bh5*WOEJBtQ7AnW((^8Eb)NspBl8lg9e~D`3cKrsyO)T
z19jprnkj$LlATmIiici9gRqDQ5#jKsf_VS2IN{=|Ah;=03pyV8!Gjip6UHTslB5L1
zLkB<B6Y!uZfDVsvtNfKmWl+BCHqZdd1yEv!!Dzr2ERZ&3yS`b-un0&t7j1EFG%K~0
zu?wVO^6El7Wf^GuO>{v25HIm=+oiq@nQI%COxkegoh|mbLG?R0)}Iu%L6kS&_HWrT
zJ`Sa!xb0GmIU+UCt+pG~yht@j8goU>z4+*M)b#3oc+`ZNyQ*URn3(o6P&SR3pSjE)
zjKf@4qfI;;DjtPP4Kn`$$ru|W^53k19yOr0B{H+LF%9EFE!`py^QGHu$^@D$TMve)
zq77I1CAez$wJ77*lxYoXlzeY{+wSGb;A{*YrJ5N<S;`T<CR~Fk66rtQKP+7*Z@o`B
zeqrcUAFENbmyoglxq*s)YWQVeEIU^drU{*)dnqUX%(~%o<}?OK=1#lbjX{PxjK^$j
z7`hJo%+S?sZD^6{pE~f5#@&0bx%YaT8apFsZa;l)Av4IKVLfc3@yiG-yCq@SA4zAx
zBFqC0zyKwDaOB4Yk96#wicjf@KRDIAve}Xb2p7L(AdYn5kXC18B`gGx0bB`27)HV&
zOqx#Y%AhM(LVyn*3aMjW#F^s-CM`Ak5-<L8;g!-uQLXqxC&O$SV57@|)&|9~8~kP~
z*BqtI+yGbyK);PP4d}jIIjNs^ar=NbOkUlJ8yAzkw_VzOtG3?`j@~A#JdN@!z4tCZ
zDZJc<Q~%i9fa+ECCu5ARjaa<c_)e_oKZTl}PUkI2-P)bmYKPl4TT57v;U5IEsJM@i
zX6kX8hpe>46&%9xyTz<G#=hQm4_5ZRy0J9TFgJ6G?JKLH65|vNpqCm$WnN*Xv7yn}
zUO`<j!SpUg^itE!l#MTO!#=ra((g}?>CrIET<E8|Y}{i`RBxQyUbJAUZQd5Nop$6n
zb@MIre!WU!U#~^_Txabxh4}N~G^T;SlBWU2SVUnAe%qdJ@oOToF?cMhY_LMAU6&n)
zZFmBfUYiSI{4|D6>q2EOvY(j5i-?kZ9eAggb0`j@0zd7yxdvJMq%eF6E)x~GI-ox=
zRJ#&JD>ZodFKRH4n8?%17rUXGJwZA8lsX=mL<^H}(MH@5Z)=qJf?;{M*9^f+mvP|J
zz$&4BS5qH~NTc~z>#xz2Zk(i&IkOyA7+ho%Wq?sv1(D4(F6qQ8P2qC*vowH3GWZN;
z-~cHO`NfMg(N-L;Y^J1<7Z(t3{NRaJ8ZVnH=?-z#u29V-lL*5^coKv#I6O*Em4jkb
zFz6^habiwh@Bq?NoRmNKO6!=v<_4H#$Ql@y1~@(CPjNb`T%-(3fXruPHGqMZlftzj
za<HN@2J+UMN5CCfOYB2;ekwtc+07cr8fd72t+w4hJnZ3*@U%xi=D!=_v=h1d8f%os
zQsKXD%dNvB9{DH*`{J(q;0K4-Z?}Edv}P;gmapG7JY>D~W~Cjkj+idS9evC)-p$9j
zvt-E%_AK!iV^u=$JmBDJ)JTLW_j(U|cuQH({Wfpdp(S3s2+#SS=Y|cR`@DA1#}04n
zZMF*!UGHHH<zDN)_YL>E|NTAfS<ik>c)>;+yFZODGn(-PWA6R#cfaso4_Mo;O5!Cb
z55J7znKVCh9(Zo}wVg)&%M67%(H@_LymrgR;IegP4;rw=r2322l&od>;FcclTwP{A
zwND@6`inpew^#!D0K8n(Aq@I8FDc!iTD(l|1B;=NKu743518q+^w5|uKt{9|<_28G
zdN&3yjV~G&pgMAqTWG+B7J!ipdn6$qg-6o<Y4WA^R}0qJUuy;dQVe8hjiFe$SnT?Y
zN(Y|@!>sbAN&$~FtkwvEpGUonJj9cpP6<+~Tub(RxZ)#!NBoOQByWah8qg$~mDNl`
z9#7-sw1^f&a#@h15AnQ9^nd6Uy%xPn8<9q?m^VuEI3Z+rWHk^MqqgB>)5+7IPZ1AH
zEwi5_P1(@s8&BHRV2b6<&lf$*eZd*|EVs?^q#1=*u%AlV4Li$CR&S&l{yUY$dq&-$
z-YJD);Kx48hNKf^n`XH4E!kv<PW?1Cj1n~GLCsNz{2NDj%N}nJr=RoLaMt->2$z2Q
z3ilI!{ze<yqTNc>VX-jae(ka=!l%!^Ae?sA`QfC~&JHhs<*VCLO&sfMs84^!v%-DN
zFm<2%+$X%}eIE#`uC`h&v4wAi6;=ql?eVs7;%R4ucOP~{IPY^`2s`igR^N<}^(jw#
zdTI1(L8|TKHP%=&tpChswT+)5u3RZ2#<#_0#1%Yk{bz)=*1E5Pv%A*Md~Wm?QnuOk
zJNa0L+8k*W%8M!V!=ugFi(dRvOOE~1tGuJWI=eW%q(1HG>$|bB6^%94Tq``|SsS!M
z3lCU(?UpzoJp2)l?E4FYwipiyDYmDz>PD?NmWA-jO*Rd$e$8vWt<awz^WTs44g9NK
z{hF|;#q%@YHS8tJ>Z`3D4ZRkAh2_~~)7R9|t26E<?aBFAJ8U#h53cyuwvi!y2FI)?
z%A5%119JIfa8GI+erBJ*iZ<pyz-7#B@NiOh`7&RJvKF1TpULwqyZ7!ewe;?=%$}v`
zWA~~qBOSbH!?!2)t=hhbvAqg@J;J1!0_<v`@~I+q6}GjUm5Yym`I?TtY;@vZ?zB(M
z2VF53TBb=(51W1{57!l-W9r81&Bh9ii9-`;9y5wB3e5~<`lfx~bMKw5?@)KDoK}?n
z8<0Y*Vzs~Mi`(f!c|gS)U9yY`>C>L1#j=5n*fce;&@CD86eewC?4KqJ^2qRutc~oi
z799b>Q=m{jl@zWDsW@;o+QSH7#FA2Q$%6p$<EH5n5W#c>gn2!W<Pkq`lvn&nBaSdG
z{K-d{H1fcoxJe0X{tQhtfD$vb)_^xeYfx2V5~i@SR~VV$ZZ2BOoiT=|fp+?maA-#u
zNEo9gC+(+iiNUeo5{oCs89TdSr=_?yV!}^MajP)@r)@(3-n<?&RX8c6ZADi!BRXy8
z&xoxw@QLF-5_lf+(DlLxKXQE7VVl>r%F;6Z=9_K`J8rv$<E^^tYT@{kP78nf(;vcb
ze)Y?ic^e_zdFP#ByDeYaD5+^2M&Mum{AXdeH|}V2$Fv(i4>;t#VTU)pIh=aZC!6M*
ztAx8MWkmjyPB^Y>ou%dA<kJL?jXiWBT>b$%xrv_>#QxI7usBsV-%d;|w$st4opoM#
z<%>6>xC;tmohS1Q^N<;GIlWs#F}|LA=II{gC;tpj6V%yfd^)bPEN=6yULWqf<Bo9t
zdFMFpIcJb3574D9d+=mKa1Y9x)2zNLv2MU&6}HGV@Nt#yVdHSQcQJno;CMf^epw99
zX>t$#dOkf6DzX;zD5rVLLl`DM*8pH%jblN-`SvdP3<@^9MToLe2Yl;;pZ_oR4^e|K
z2IWvOM$korKG#^gW-YdKDTa6JAGH5c|55NtaKNP*F1G;}W`xP3=bm(}4k&vhgDY{e
zKVtvn04#B`pJI#DAPk=T*gxgRW(mIN5SIOuI3Cg)@wezQ9USEqfAXaH@S_CTP0brY
z85D-8fD95uT2#8ixX_T`<OPQ?E{qW_&1XSR$JNPU(F0ciUGfnpJ}DjLnUz0C8L|c%
zX&^3)Y)QmqPyt^mS-gIdq!Yl6aD7Y5#<qAWq&z5`Mrn$hEx&Na%~hEO?v9&c3VD5i
zv;~QOz`z#nG{r`3tY5`*<BKs_W+(P&(*O%3P5>@i#Qap95*($2KXH>WvqyD6VkoGw
z-*={K)1FQWkNm`<>2WB^95@qB4L|P%8;8$){u2K=_^D@pCfsM0RZ70Q?Xj1gBz{pD
zZsfWB_S?cu|M*9E@IxNz$^88P*yB$MU;OH~!bgug$*%*D);9c~=Y>z(sp8LE^yToT
zUEgX8kXYfkr<`$id1CgByX<B-7l+f&yCCqB_A0FZ%nbr3Y|lIUOzYRNzwy&V46OgU
z_0}qSSaHRb!rS)QH=K3B=fbIHof}^Bx@gP>@xAXqs_x1HP8t8t^PcZCIMut~f$z4{
z$6pK|KJF9YVUKvk4BA9+y7@^@eu}5j?@v1IOw;EBJd8dLKk`HFR~h$w`@Z4Pk9kZu
z#Eimkd&fIHjX#fg<RhKWg<tw|c<WwoFXL0sDpo)H9dwA**_Xn}r=Ml|*|1DL?d;El
zjb8X7<9|jt`@+wKjbHLoACIPsYi(Yz@y6lgPoEji{p=UQ%U<y+zg~i?CSLr~mxr@H
z^Vx9GC6|T+4>{CNh%#s%`0hjfH0iO&e=>ajlCOq6_kKsoYsHnKPR}!1=U#YG*uo5m
z0<J1J=3~c)&t3f0aLlpC)m>fi><#}XoMLjHbK&R18{fREtwI}jdUXG;gAWN8SUdQr
z@qc)tdrp!ce&h#T-ZRd<AaEKMIPR0Dc$p~6OJDv<kK5QzM%R@sF_3aH{QxWDXHDP7
zpY*Bl*vCEI^DwXO@|Hcq1z)%%T=>N=*OhJOUEkty&`jGVS5Qzc@b^FH-C>ngR&`p{
zKbvj7g`Ltr-|^mgz(M{Z1Dr=$dpP0bQ^Oa&^7U}+2`7fN?W8lB+05GNcH8ghbs;$)
z|M(~P&$uz@zUZYdv(x{d_4=VKix+eMXY5(@$q#@01aB*cS{q&KzH1r9<>8ff5_pTP
zw}EX9j2S0{smB*tyV>M5n+2}(_{7PlF?m{^P0Kvc-^OG*<Gc&KPo>wWJa3~HdOZEN
zpI3a;1ns~VCw`ZoGSr?9Xk^s!(*O%4>f5)<%nv+ldDADx`^U%ZM6Vs^O-}T3s&}cK
z=Do)sPWJLFweT{3?BiI=?8IsEFvcz~)_;5(fi;jMFvb-iWgGxG`Q=ybq%h-ke367X
zA~jKrLwTZ%aVW4u9CliGYMK+n`J`|+wa5HKTUf-LW9uIFKdi%Wz5n^t&Y$$@f)n#u
zu}5gzwLBTB8bBxPMfJ3+BjGo58_{WoOMDHIoOtzslnyQo*8Q-5iUtz_yx;?EK)e;-
zDSs7A#^^}Z{whHcVnjUtlo2?@Ywo}mK7P?6PB{39=YbaS6pDB$PIN>=d2q=iy5@Di
zXe*y+36HRF@Mp*xXsChINGSwg9I-&sLJ5ER2r;|uX~245s^>xa+Y@MXuv{02W9^GY
zI(LZ4Xf!A(wf68+cV-aw1*X+eGzzcahAw@<xi=XYf=3v9hR`(8iJVL+qd%>Thm`H>
zeQmoFbi?O9KkT#TZf4Z|d-&5Iejhg4_{B~D!_r0@za;$d>MNQO<V5DPpYz=CgeU#K
z@XMe5)K8!udGxX2>z95dZ1I{`gs*+|5;J;!!21Cwl;6JJf#H-Bj}LF!ZY%GX|L-YJ
zjrDGd<$hB7(c_=+#PI*jxVppEn};J0J2dQRhFtn|3K&j*^Xp%wQSSfSjeiZFyWlf3
z;&<O`Z#RtYw9Qsl*4@JkUbwLv(m=eg-Hl3F1^iSVV<)i3Ui;X~%jxjeH@`8Q@`>Z!
zkS4s;z5cpCg{ME`nI83+$38AR_@NICv1}nc)viRi{<`ZtO=ZMz{fFQGK78=~hldl7
z`*=xegAJb>4m<e3u=nn}+4Ts|4o`Odl*#VFn0)u$cZD}?zfCy$14o3t-?^U|4<G1h
z4=^1*^3jiRc}d&-ZF`56tt^a3z#|^@=<wEE-V}~G@`$k8o_mFrS6(@+zWQom&$quL
z9D2~Z?DY7S0UERcPL{4|Mt5{|=)nhsJ$KtBJadB$!jqr+G^h2}J@@wOD7Jt77UAvo
zaV(7NPkq|@Zje3VgGYyNe*Mz$`psVxzW%kZhJz11%-aA4%DvvPUpV#T6T>b$z9F`O
zCqLQgRsX!rWa8!8ZaeQ7PBPtZvgu|e3I@_!|9MN;a<fgs$)7x-G*s`u&)dvsvo!4T
z#_hv5zwx!O+UlztzkS2O?|Nt0ZmZXM8+*PPECnxn<*UM_U%ohO{_0nTvra!P9A+;E
zFhp<goDJQ`{H8Z-6ZY8kO<}tob_)0ZuLp$3Kk-RkubgIo|6%V5ds|s(o9jL7Vd3rj
z?jMdl=0jnJ*KZl_x%-~*#$C+VT>*^KJbUl4Ti9vatpca(F`Cl4-|@}^!o^?seAx0e
zukyBy!Ie$+Dyyy<UbofO;nJ^u+0r%%oZ>z7{YUzXo7GoeBfQPp!+Q?gKWxAC7UBN(
z65@F;cwsq`qO%Vkad_C~b(@A8uD>qq`>umrB3}AbuV+C9#b5T#Z-%d4a&frmvloPY
z?Bi#E((u3hRhxuo*wrcf@3U8UhxI26<Ij7+M&6Hhw|24bUVDT$@35`my}Eo+M8461
z5uZm#M^R%cNnwn&v75CY22HL%;NdP=p7L&9PBU^>uUzv_=>gvk7AWs>3;Sa<jcDbG
zs-hoNA1Sdqk12j+T`x#1r{7at%p*+H{^2nH$SFwU1zJw9Kk)m7saGpo9u?ZJM{1q@
z&E%y0D$@RWpR&1ksyGm%NvK(0XrGgI231P!ggfD~P;jeyYp2}RJdMItI*o7?SHms(
z9F86#5pHIGB%WuG_RmiEgNxkCgIj_MQAU^t1gz2+Y=w*;AfAE&<RzXs@Pun#XUNV4
z#sHRR(Ih`%@=GxDmbi`hlNV^lpS0Qdlb&ILYoIjjT2o1<R1euC%W2>mjx{J26+B}O
zZg}*C5sM@1a$03rxvFUjmpG0dthZvM002M$Nkl<Z^Ob2;eI&G-;#Bj@ak#8!)%hID
z1A7*-euYG_=o_d=R%hryC*R=}jlzrlr0~Q<@h;BqVAC+(nMCxQap*nW_4A@1b*Gxn
z6xkCt0;W$-#O5^fr%w7rxbd%l_Mz$GFI{9ON8^3KoWlLdwLkKojaLQa^x{RAd?Q@)
zwadbr?Ih))2k#&L_O~0|D0=(tw})?i<5E9mdfB(X;fAMm*L|?j-6UM~gUiF^-@Pnw
zs`#waKV>ILmK9p8RXC?jFh*jq`n6p_v7;H-ye%a{thv@&;kJMOJBexT<#aGcvXeh?
zf*T7tL44XNC;4f}=D9*x$qcC&Mo<6L$>E>>ygB^pm%j+#yX@Nyv;64ltHM(XLn(LS
ze(yWqE)BxmWqi%mSJvgb=bpQLjJW%5yJye*f-imkv*BO=x;6ae&o_i?et1=QxEa1v
zz<~Q4`w-gs=bYun)EjQNKK%6BYwcd+Xp9E;GiRUar*wYw!>j$|_Jh`0w<PhIv(9vW
z*O<JV>R$VS4+?jg@p2C{5?^OV?K|v>fFE0(KlEV_b7L<Xy^FtaQMm0t{|WzR#`bHB
z<|FMxeJiiDvgzhU;giRGEG)GXL4W_--@=hc9A<{ly8`9E!`i^NzxfRx`@U;BTh)x3
z>sTA$)b0<jydwPI``@!RaC<o0t}b9hUIldjLVFoOJ^k}$)BP`g9=`MKZ<S~leeS~W
ziQ_-!<@~|-zw7q~bARC-b}a|MRR_y#bINI@x9q%Axb9DXbbi-f^TWE+%2!?SgK+JS
zuJQJD#pT~OBmM8(&`G;HaKC-RfBy6D@PAge-~RT0!$ZuN&6PllYy*rTm-eu|y|iF0
zL%EQT{1~9Vc+uy=|JaKb=50<;>DhF%*M`%~82)c-gXsFi6F%;;Vfa1zs3XGHF8!+O
z;|kLcFHkhXTz$nA;U|ThS6+U(zf4%)?%$?-UUz@|lb7$u*IZNgVZtwb{z8-gMsF);
zocgKoI6GOq#+qxEdTi#wK!#x*`doEV1x}ZL-i*bx)&E%A!1(_hJN?g?NLki29{;ia
zxr4nd`0HQ(T+KcjVNIk}cQmA1cvASHhCgh7(?=Cl#Bo|xhS|cM#%OC#X~>m9*T$A;
z{KWtqAJ&5DqeBB2vb1i~I+ngY2yn9e84USBi0pL|PYRp4!0N!qrecp0%?_9z>{(u$
z%LgP#|H!(iIyhp#B$P3;e;noyrJ}u}GM~?EoM&%CBj)7%Qu}txw6%+xiOX9^=jHco
z_Q%>*?dhD%c;}Gr8o9HTtPy@SuA0A^-Y8tn)4wp)Y{14Cpg}Rv(~vaqo7Vx%VcI`i
z@lWMMZe*77>PGh3aT70x{{aDHA>u+Ls-tF<g$aOyz)ADrXZ0-QNjb4sMtYX)3dIH2
zzHH<GUC|_hF!{+#JcZ%6&BP;<c)$~oEYOsUo{;}6Yz?S^*lgg6s51%=XhAg+8fP(-
z3Swn-4U~(dG_mj(IOJrrm_pU)L24_UH2+-teSoOcx0kR|&SA+Z-T4WTDNc#l*Kh4a
z!=eGoqZ)N1wDDnZWzmEzeCUaxm7i0^6U$}K=};xgCvF{P9|pRMX#K%Ntn`vux!39p
zG?jDKEOU}r)qMQH;poaco04w6`5)ds8Gn9q?KSpcv$gyRg%`f)CE?2#f3acKzyJO3
zVVf;p9k$+fdpptlq;S<0mpdND$F(2$!0?Gv&M5QUeb-%Pgjy@C`{0L!D=z<D8IQq^
zJBO)r)jNs5u#?6={qeQoc>Ae3hO^IIc)p!h{8E_@&p(X+Bki<nBfyx5p;hppbsiLM
z`R70D46lE=;fC-aGf>V34}8#r!c8~*-3_P0<IdtnA2!2)Ncrw_pH;$B%piK~(H{(l
z9`OM;sy_NL|7~UZnMlm)-get<WjY4$mCW#(!rCSi!<Vk0P}*<*_c!u}+iv?$&2I)x
z^dXp$w&IFz#N|Zn^Iy2JZHSlqiRo{D^XtXtczL+ZjQ1G%*aY5g@^Q@qWxeH=Tf)8f
z+*51{gWu;&8`|`>uQLPf1H<tro+7qh9~cSOU3cAZr5Rxbw1NNq^{*8y-3LBso$!x}
z?tfvrf93|yb{wwaInb_0;B+@eoW(Y_Vi2z0iF}W>gXh?(>lc{u8oc`%{x`q=^^(tD
z{`}|CkLSj}{?$)glaDJS{`+x{^Iw^)`;dp&>DNWpE`Jn$V$UZ}J>9P+`MkBwuU!14
zK)c7-`n2`eFX`QJ$L(PSyR+HvQY>QEF}-0RWllg>7}9wdPdJ&)l^nbf!SJ6NV*gSY
zRejvCKY#n{U)%`J%Y+$qXD6cte@)7Vk@u#X{^50_^lse;uCq?q(eCPg!;Wt(N&NBm
zzc-`X((uWT9~<6f*N&{X!iwR$mwhXI>cmepH2Rkr=giY=yml?mnN$msvGs+xWZ*Ab
z(Hdx7Y$yhX$37zlN~9W&BbD*9d8)M>`&Kn}HVQqYd3l-ldZ01PtoC8H2<YF`Z*tp=
zzy`(sb3)YOi#jp$s-X&hm_l~WtG4dou4LOISle1;W)bGQ3=K43^^VT8r(wQj4(IBP
zSm&Lr_8ZVIqH6Wh9A|!~FfcS49Ozfg`WE<|w%cZWhN#_G90m=9Us`a+{+JFVDmeB>
z`Poo2S%6DC`N_irC=Ney6gG9qCxDLf6PNNQpOg-s!cw-vxPbV_ko`r_6d)$%AQL9D
zgcCu+FyT=;`3P&4ln}y^Lck{u+R(wcE4t?Ou<}YC;VPbd$PQ2CB~9t(jsD7fOnioU
zqyZWRKqC++PGK#|TE10vA}OVkLg|@3wM3g+PdlqO7D%n6Y(j@gaE6Ynw933Kxm0rw
zCtS)m9CmGSK_(X9W)R>M$%HTXqW;>bt+rS+L^7V7K7qIYtO{fF;>edlyWV)wvgT*7
zsOA{a7GZKr(heo8qKnK7P2`APG*BDAP2tv7zig+3H+}6EcAxE|+yFKk?F-I3JACp}
zXWE^+F9_fN?q%WDTmBjT^v6Ghy>@?dlFiKJR(CJ4Q<NAJQ{X54)oNuN<P_zpC!H9c
z^0cP~KE8&5nCl<}7(n^x6^22KPy&9^zt4W}3OjGVt)kp;iE)<`#~3sLP8ee(2DnmY
zg%$MP+}@zC82z{X=eDrY%JuTDYVtM$PM`h!r$6zZ&ST8O=y$6bv!DC?jl%DK`<pr$
z8|7~|?q9du>eKF?yY5_P^lmqQBRo!a@{@ml=8u7Qt8KRP>j9>1b4=aDanoL6S-oh}
z|F2tbal`-WYpiLfful}20ldm;tA_vl>)+w}KmEz+#TQ>SuH02j8%Vo0ZJ-LbnIRiJ
zdSQ#i)vW$JY;BY)DEM&T)ppt#xa1p`xm*3Sp`E6F)^j%WYeMd^vTeQX8~kox`14?-
zPGwo|;SUeLwv)d*?YxVha^A!Aj1rFc&@r|Vjz5p()beR3pH$a2(Z{7<xg?x%>M2zb
zj8TmPc)ZBqbT&X4IYG{8<Gt<5iM@B<HT=V_Zo#;`>s$9MX;n}4axXP6AsW>kcT5Y?
ze6(>4*Ywd|fp&Pp$3N=7AV_J^cR3x;3kB}m=8B3J+7%gJGu@00(CBMbHa23<y`Ytm
zyb?sdGOErKjfvK+Eghqrwz{!I80s9-JcU0Sj-qOY`PWr%mBne$_@dCv1B`JzRHB&(
zeCEJg8j^=8VfVavX~^kkH-K<wt&xf^`@5$(Uvkpd;vC2U7h5-(uDE7p$`0G~RL>|m
z!$Q{pgFFwdf$qm75C;?UB!DfFG+fft$$~i1fd(Kt*fr%BU2p-ydc<Gx&?HW{;)@GF
zQ!QBhp`|i_Q)fU`n2Znw8IZvEA(%48vMm9XM}p!i4Ls2yj-3&%gccs*zVc^4$S{vJ
z;Hxv5PXylxD$ZQrBw}D=0&NL#Vx`G6ds>p1V+1Bc{p?e2wF?Mmwnge}I7%z&H|S(#
z+8pbn5qtC@`Q*-~i$*jC5$A0VUD`7}#r<&iSi4<nYgaRJ_;5K0u8}4^h=tRXZE_HS
zdxSA!acAiy*GF)5MAtvD)9@bMT5la(c{-+SLixSnoa*U7*R&fJpS6ct99{4>W}{mi
z=|)%1*(CEWVw)fgTd&&WHTDzuZ(1Ljy;WgMJ^HBkg+2D(*Y7(0i5YGm_V7ozF&SRm
zfBNxHp6W)xYwfxLjKVU$KKZFnH#|G#YmCz_z@57XzUMIGJso~*Ka<B0%vY;Z;0l31
z+jR-M?7l~NLKWlJ_B*}Fj89)qQT?auoa}w&CYzQgTllaS25jK(|M$1>WHZVEtK0p-
zPkJ)<8V55Z|I<!^-V*-j`7iJ={g#hzH3P1A*k=13TxM{7X1dsJ$DP6tuez#X7L3zw
z<ZPJQIFg^}|MB;~^LuDDwjO-w;dYYs@r^UI5zC40Kii3EjKR?4?qhGy_9yLiS_9zT
zYI@-g=a;<f<#ADKac?l)uf6tz+%Uf0!yjgb&qw(<$DPc46b{2LhW!^?9!@@U$_QiV
z!yoa;@&q#T20Ss=-)ct3=f2>D-aZzaF*ChG_<?rS#qWOmTQ42=S1+-<tdV`%HmCRA
zdygBmp#$EZufIN?WVUqfKQ_m4@jTb=y<Kaq`#OK_0p>c4pP6Bw6Uw~UK%Uj?j^#(0
z5tn?N06wTe+r07zmz#0+x#e{X+=G3<A&0trZX}@}*~3*CFM7$#%2V5X5bo)A7w`S=
z|6g{6#O-bjCX?D@BoO??!kTu<9(ah|Pwg*juD#Zc^3}Ri9$fD5)&1C<0H@Dz1xGvJ
z?X!Wgp1fE7;QM|DH+lzNyX97Xhcx~Dq|?uGp4a{HkKvcrPq|WrQ|hnS<khA_wj!er
zv98j38+D0?CSTExqi&3A8ul$FzkcE)zTCUZeWLNBUGDnYOIJA9sX}{^w{+><;a)z{
zW<NLQ1HjW3$KE1+uqpau?C8@z%UWmj@sCcKK0{N)I5Tn$Mm=`%H?Hkjo6%3~US>|#
zs&1?<{Pd`qCC1T^N}24;tGC-}`xtdkhR$(rB8lv=&zUN0zMfoU<F`fd0-Sjk9ZgJ3
zC#@*S*tVCxoUZl9VUDO44w*5<>1n47Xjb@Dm$XJOTb_1!HljHaaR^W0Fevq6|D-U`
zVo1_MxUcrlf;Kdzba)ZgP>5Rs*60){B!v|+X%t#<gryL0z{iCSE{td~<N;WPkyl~i
zk_M1Q9^4fRzi6od<b@`A0pj%#CSH6}{@!v~2V|JP8qj7_)yyWasd0c-mLY3kOf<kt
zjOk_e(=dK!JZZz(pxdwY9Sju=qLYj4=XJJd=4Zj)w`^g>2TL-vp#jyC2BkK#WR%V|
zfFbloGs5z*t#;sl%`o_VI~BOgTlNee`OpW#5r-ZejyUSWc6GsRe){&a=bsbqw0lUu
z^X+f=N4ZWt`vNyg{q-+5xbe^zK5Xg>;GWlwUi9Mdu}_}t_djwM?#(ydq~y{){E&m~
z6y+Y_lrzru`&cn(au4ih&!72GxucJKe|X3K2ZWcsauYvU`|Dr*B3y9p*-q<%bI%Ef
zec*$EJ8}KK*x$q}44Cge^#1pSci1V%*KM(t<Nna@-hKM|&nRU`J=a`)wSAmzU%M|j
z8h|l=ZfhSS`;i%n8^KrX8Vn5DeAMrwM<3M)rC}T&qTBa?gTrPf6Cao3o@eTyTi}jg
zJ_7flV~_JW{!TMYwgc#9-*+7tUh(Qp-QfBotGCPSWGHad`wk0-9DanK$mXR1_sw!=
zFsDZ!Yo}jNJneKpxqahb|Ke9oU}TWt(!00)Ip!#<v;7VTTWtM$r-@#lX1d1+dBJ(-
zgpYmVBtMCLvt5J0eYcF|Qxj9+OBa1UeB9E$WOpBb|9jsF?>qA7aLmU~uodlcZzqhu
z{uov6=H2&zgWOn+@%UpOIoj`wh6W#_d&$dR;hW!^Z;tJ+S=*$2KHQASC!Kbt-=)pZ
zXixaqM_ump&v|x-^B#Ne6HYtlGk#SBedMSk4)Z&YxxV7~lTY=2Lzz;z+OF9^PENU}
za<-~Fu4Fm#n2*|r1J`iF4fWD=9hWjR|K;ENu6+>l2sfg0ayf-_?CxjU`swFh;HRB=
zQSkx$$R1a<Tx_~K_Jk9|-PRvD>HR7D=-)%vdsx_c*WJB;-g?U|DXHuqMGefDV`GHx
z1CY1a4-i}X6+m3asC^kq1BlyCOp-uDlm@wS)Cg<9+k%-aig6W58DF_lA|ALHzgqTR
z$Jk4aI9J3rJHj<ESkb6UjKSv8w{;gcbz57tH4&jDLX&(sdckO*7#(DL^zDEZ9vdh&
zOI+DXab=4no~*PmT<nqn>BObDoF);TT+xIMaq!hZh06nf=<$$Fo|G4P0mUgF^pxfZ
zM5I7ij|3(x0>Y(G%1as`MM)^qi31Qg1>#BPH;?3(5!j8ml`v_dMLKyg0P~0^@rpCA
z(<9$m8@+g|m45Qm?l&P28z)$Gh4wZ{<4`6o*n9#vfy;0reEBmi#i=zaEZ16)7I%so
zxNAH)X_<om{61ZQGKtxfA#0$K259rX$XT?4yXp&#aQhYKJk21?hl$|FrV3-pQZowk
z;S+}JiOFUitrIDR-Xq%+uIP>~T@QWJH=zAcQ+rZ(jTJXT&9krfxXnHB`d?qz9BB?x
z9{czwh8^FyOW1Fp+E3QI5reA%Fa&$MPU;K8-x9l9_0GHQw3jkVtpCNABy7G?;6!fx
zx_jN)Dn%*%e&?#)Ron{rz#J#j=yxe_LS?0uSE{?WHBIMd_;=oUS7Q7~Q@i(b?=9mH
z2F*@^Q<q$W&}jbdlot5ul^UJoM-FWgtNB*8Hjv(htMu3gmV~?7sIz9eU%~D_26z!r
z1x}$OlYYU}s%(wg5B0)H<~#4aqe|Y4*NxjIZFohKE4{;dMrMnk{5(}W%8E`TH+i>t
z!w%j?&N}_Hc(-r^owY1qlX_?*TQ!dQt;#7J^gy?5)PAW0K1wH`kJXHaiXBt8GFFXj
zDT+1mI*)#pi+JPjzhG`0XH^&JvKb@~+fO!p$SxB77gbJSwExu4AWdYg7Ptx8P@=6J
zP1vt;<_7w_PPG2*zj{jwqkWmJbS*Yn1SB}4>_tP9>=Eei<I?B*sZi@H99~&ubK#Vo
z2IiMqehpr`JZRq|rMG&!L2Q$)+9mz7RUd7X-VWV%6*+(Lp7f+AgfD&ZLN*FJ*uy}<
z!-AMiv5c@R@=z#YHUxSI3!ijt7KjIQYXW}K6fa!S!Byi>8ZJQPk}s`f(!j^nV_paB
zrqEOV8HQRCAco)~N(M3tL^O?01q7Ec`Naq!G0>7nm*9~G9|?;qn!>jz#~}}Nc|=!v
zEvimI7>0#QT81&zKy`rjhF4uAsfCSc8MD|~1FbZ`rkkIKEnjY5j+c?PRi+-({fpK%
z)M9L4orLQKVx!Cb#<iinM@FNVU1N%7z)_Sj%M><y?Uvyymo)yETqo*@#^9MbWISY(
zQJsrY?DTHnG`^9)9m68|_y|`cz&O&#a4Fn7?wDy5R9Y`ChUuztx?OtBjCAehuj1)`
z<!XGZ@N9B4)2Z4(E83(t(|sdDu;`_RNa9+Rtx@}7erRM2hF-I_iE(~5eUKMuR{myX
zjk!Wo1A5Ey`HLA*>CBz2Jk9g~hiV<j0NEM$jNOX{e9BGM_KY<O>P6Cwdhz>vwDpYK
zHFftQOU^sbHDC>kgG9{fn%DhQsTEsoZrn6LyJyWlX-3h71T4|1!}yCvGX|RuFa~q=
z9WdTY_*D9KN47MNtDucP-Q;P5?0iFsRUmt1Y+$jB#GyplFTwOKS-5PN0n+K9<i#%<
z;6ekVFfRDeBOV;tJ&6+^@`DTD5(Zzm<}K+%101E}ia+#9sE!^Ig3Mx!UxF)MMC8Ii
z4Dkzuk1IeBga*jZBY{N&xs(T7(#3;#9u=JYq{)T8Xqq>}C~829JR8l6inA(ATaF1`
z;uHn&<Tht)P4uHyc9)CRSwdZ)jLn{`0oMT5Sb#gw_$Y#P60VR?zwxww|0#H~sN(b}
zMrck=Em~x<SlX01ZXEJaS5rebLe$Qt#!;Xf8iUK@()oB(+c<Q>O?}<RvC7!i37x^?
zY781_A!n%J>@!adH~!@>)+B2m5u1V3MubXVoqxz`=kx7k6sLo2$)Ud32F;9;HL%b$
z@a2npe>t<zbT;tv&bD6eW;_$U8F`sISfA9^?OKDI?X5Jl#TmwCR$I?FuHV_uI9osW
z)V+KvlIk%$xBcm5{ox|a$)A~JnJGp&FU?FE!<g<%(|yinYC`+*K4A`7&`#ljyJ%vu
z8H+959(N4S?;vhQYGmS(mpg@7uiN=KgrCtzM@HDb2vXLW?@uPeGBXBq1(JR>Jfq!M
zgvO-42vA2v<|;+f#&{ZmOWr79mbh;6%t9_F&CtM%_L5*EH3^#RkFqtAOgwJfq}L`U
z;$_1$ucs5Ihd3F4p$iS!N15D|SG>pv9xi|@{^G4Tr3;rZIF0g?Hsge_N7^4{A`CMK
z0Qdnhq#&Hg1)oQZ@nh5_oW?7Tf{KRHRVYg;`3nc7@PH#3aIvVbRK!6?3dN6HlE=Im
zMo9xR24<_xnFe4YM@j15Wr+<kH_P5NxiBcyw-h_s;BUV5M!Y_?Um6ir`Xi^$2=jA!
zJbq%h7}`0JFweSYy$V%0DWpENjgT^mP#an10A)O+oT-=_uD{MB+4r#j83gE>2sT&J
z(;)a{npp$mu7Q8udh56sA<N%F13t|12P-d*4ZLya<!>#{6G`#^4A61(EZ6vUhc?h`
z+-?>h=`N7Jtqgi&q@>ZCJ876m6;BKMH##iD!H0OGFzva9Gx9ACQLR1jBE^nu#245j
zFLd_;vKsTf2-lccKUubnEA99IH}y7~;b)L7u}VA2GP9K6RdHux)yH&-U!OaN`k;YW
z1*%kB8FKN*$uF|OpV}fx=fVC-9v;OhA7KG;s&L|Ez)jzN5)U0{f?v%qd#P-#hEm#4
zt8_?nfLIkoICT*SB4Q#zBq%f}0O<n4&;W-AKl$(r4_5`33!Wb0D69%CdBvY}<->&@
zkK}?*hB?xJFBMzVfF~D&xCZlP;?6K4H$xm!{HVz@q+*wB()wzqi*|5Ig4xqj1N>~#
zzbeeIX!n}>0N85d(2{Bsgo3VrxWa~i>X@I_O_*_bvAI+BEL&!B(24nyvwND*Y7t!>
zCN!wG$Tp<pcv=Kz&D!~Ff+$Zr<Kb*{2A?LaS8HSNoJWa6EIoI3$17T>KWS!^<jk^U
z4P*^u4a}wibe&aOTwTznfriFi)4034yE_DTcb5Rc-QAtw?iw5#cefBcxI=&-!~4z5
z!5qw0KVh%6s_Lm-_d`5+o>1VrL_#HQ$~uLsBs-FFwg5LAx#2T2coUFRAFfXR^+ljh
zJrM~UX)9hW9_NT;Hxpar`LS|z;^``}T`H1Z+WdNPjYoq5qhf%PiauOvzyIe{&V$Q&
z1Yq7DjdTZPn;JJf1)F_k(5DJ+nN1R+&0UJY52FR#&WcBl7(bG_7>s;V?AWN#jF2p<
zeL^obpp-EZQlremDv)SByx=m@8^&c=(6?UpUde`el>VWndTsU{3kQJUZ=VEVa=S}M
z{PZ-S-n-;9FC-EqEo9AVEE>VH&O3eP4o5HSK7ftlZw;{rk1TTIXdS0|Q;#=6NuGc}
z3S^r~MuhB#l!2v4J?{T>h27O6ns26oy@s5RV0xkvp-z$<`aw`w>N`iS4EiJUJbTT#
z6VkX0OriZCP_wd*$r?!Y>s9K=v!-WCU3#-Rx<7pce|5{v>U33LNAAF3MNn?^ZY=1)
z7S6B@|1IxZI})4mhULJEsPOOPl}s;^u_*<sC18)Yl|Xo89<kljm`3K>U<dSJc>GA}
zWIqgMSdIId9%27u5jF`ZDn=Re+q|wmLG&75Bim5JUo!eFcZr*DVX8td_i*BWFaVjA
zkY9A)-VKbLnjO&$@8Qbze{6P<%|LQ?N5MN>V6BGhq2weff3Z()rOHsus7=IQI6glu
zJbe*7{GIrkNIq$s9p==EL}}ZHxIc(h-Bfp4mTF%j(BdxQ*Dr5<LEPiR>OiQX*PiB?
zl0+90s#>tC<){C>F_NoLhBU5IK2KpIJ9cpZYqmbB!6|$Ar8%<8(`n5i<2Nn7#|A(d
zq2$IL>es<ZsQ(CI8!);|0&JSHWGrH)x^J9(K&p6>&Eql-TZc5UQ-X}bPi11CTN0IV
zT_j3yVq3D8Am6q1m1<qTNV)rXthEA;t(%U4R0L}Wci=1Bf(gkF7Bb-ux();xq1O`n
znQj!eM~oc=xG(+#fUzOz!>=NHg`)uCrx3kE<y`AbZt*@&V|jUU9ri7>D%coR^IhA$
z+EM)7#5gFMA$$|rKN2lvhznw%RfElx+gvOYhOC9Z={cmDRe3u@S|LnPjBV-7YaC^{
zSotmB+daw{!0*ic%O=;wb!t&Owik)2fb98T_2{cWHVc<xzK|ayV3b>{B~hC~P2%mN
z8b{ns!C$$dv&A2U?)fK{|6RViARgJJvgqvDI~UW%z}7%znxn5QzP<50ZHlJvKtPGP
zX`H$)sB+l+UL9)~2yLKH$xd++7oN5naKaICJ{2hz$BudAJ%zS0kZU`KqBopDdea|*
zn{fq;)~A02t$<RDI5tI!j8ra*N@NhUnK~seo@M`gz?#znA659vIaOh>3>!qt@2}OF
z%g#AamMvwV%m`2^JR6B|Gc*lZo1Dm_+Uw5PWmGLD2{S5*8MBGsS0+N^v6wurICXz(
z`cHT)8Ol3tpfX=aNlg151D)71i2}p08mW328O7kBwDkhZ)&w)8OA(|Dp8no=2vX=c
ztP|0^7N5y(PWx9V|LcK$op~Y%VG-U$TJZwT9fXwvQ?z`Oa|=j1fLy^dY79YKUD~{x
zc2g{<!1I0qWu_v{j^LokfDP%kh_}vNyL))MSVuVaCWIdHZC&`uG{$^;fq4+kp_@7#
zoWOT&60>o=8AIR#$2?PVFIExYtyt3W?5TnO3#B!0X_h7-rt$0Hde-}ilLRfRq^hMZ
z0d?@R^*-6ZMEy^Gz<*(4TbPUM4uffDEmdZINt>~BC~MdzjaP$It6)#c8Dc<K;+BQ6
zZ(sggh|)6~<X?;Vy$G|NwUQ_scY$-Mt}Z9#gjbSNgOa0~NJ`|gs=F9dsu)Z+i`0Ld
zgo7TJcmwUD;86D5$vi$x(X?LwSf=Q&H`~CB_pK1xamRDNJ8k9)sV!x|cfaK6AvmLT
zk+XAuQXnk7yKU6KfSmH<slE5hsrexGn4w(x(27@rAc$ZMsl21ft!iL=4e`C_5e-!k
zX{aL3YhC>24vqPHg|{G~5X5UMB&_ny9(6W?IBWo|+2{8n6GMQ9f(S;V-gSn=n_w0N
zON6-$?<F`p7iHY4YRh2|Htk7k5*_b}0p644TNo$yK{wQl;=~+*O`P-A=%<eDF>x{t
zsL38OgU_Cs)WufFv5`Q$18uCEw%jxF<CG9C#Kqa?%JjUVdr1&=7%Rfi_lZlac%x^@
zre~DY#!1K$)wZz0CUjejucB418#g5nr21g)sxovsF&s)e5<BAq4i&sqxz1=+i4Zy7
zF1Uf~7!LnS<YD?uQ*#A?G&BcY<AVvX>B&>M%_n~5y}#Ar7NeFO$1LiXqpF6Tna-F$
z;;*`emuap0jasBLyHhY*-A_9^eg7=nRlf@i%)8w#bw`Fcsf%6LOJ?qDB%rrH416ke
z$i-3{bKjpX#m=wKv%ae$tRD*}Hjy1{y=v~dqyPXWkBvZ690qD2CiT;CM7(t*RmTCj
zA!Cj}iP_(;eD@wd*19PjoYPSGcHq_C=k}8X;sGI8sb939qP?<Nu@hf+5@EGsB_@AN
zaLiLG$%$FtU?A($s<)IzwxF>geWon@8)_kOR8R$@6gm3fatG0v-jFK$S(u!a_uIvl
zfY<j8ol5pc-vx-CaPEW2i<0Yw6AP0YQzTu>s#ch#LJ`5VurI>J`}=zCzbRu_(Ki`d
z-7E3K9*%msd0QAF!g&5lH4=Ar@_&i6z5L2VFKe-NbH?>Ts!eP&tmdKHCWOFZtY*me
z`zgz5@CEs=%cgMq&xUmf9!O%pXQ%(xvR4A_3ibb`@AK@#xIvxmiOH5yJ6d$Crbq~x
zm!guS(MYDR=bg%6jnY_A=Qm>>^DSFAQMZo|$o4*?7+zTXYNx5y`WHxFK{jZ=Rb`i;
z8&ZpAgB9wGx{UArSEMjW!C?d}#GhlSCbpxv&bMOTI*KZ&?MKdgX7~G}3%=OEhxTIk
zDPz;$ctZ)1`Bskyww)Ny+(!TR_&2o<vfzX<))|~flRIwuoIgY*UU$)48xt%!Ksn^f
zMYDhs)&&TQ*<oeA8>rp=<e6b)p}K4MaxVsu46gdZp_ahwrw`#?VMaKkwzL+9n)mpb
z3MX6$Ls6)NRH(XuBVA3Z>3k`AM)yt<72jNX!;wcIO7sv61%v+$`0#Je0Zd^Gan}!8
zVUzsSav1jeD#!u|e!ZT@3AR78p9%U{1h9o~3Hxoj%_6+ko#G-;s=Pv<cwnt?ar||Q
zNW06v5^RTenQA*S3&QILTDRM)co(sn0Czv9a04-ky#JMIv01>iz*L|bf0%S;buykZ
zM8WrIy}i^;bY(8{BT4aVULP4uj{!b@9e@s?$EJT3-re=;U*qgwDHrF?P9?{M_`j&v
zzGFL~+!MV*^jz$mW)0M91@kL!BG@TWvuQwU_ch{uy(sIS2PKZSA;XrkcmmhUDi-Z6
zG_dFS`m9MC!eNNW5PVI=IEb+2)$X^^!d?tCpU5uJl>Zmm#ij)xSpiLjs6YzGL?Rp;
zMP4(Q-OdzyJ&5}|m5XCck5MAJI5>pbzauoyzs)3@N;eRviB^}h&QpmQY`f?L=mN>)
z@UrRtchVw2J6ItXVna)=KjYzwuMdos5y*)UxkeEDPbcyQLs=2_nOeVxmH!f(X8Fbc
zb+k|wPh*c~Jk@+bJL@ORtlfH^A>WXPyfeh}+_zQ~V80~|#XPsvjy00wr|BQGa&-vZ
zWodqdTE`T{=R;H22#o$m<xt4@(%NYQ+pa%ZzVEd&AFstfuZK~4M2m?xloI%z{?3SZ
zD>dIXJSbw9;A-nU4*O1{wHvPpLP#J7_k9X?`cJIX%UP|I?w>j?<$~F&G;PwM*#~Oe
zM(iu>qlW4Bd7|nwW=(-Lx4p`D8h+}~H(gpiqwjA?muJw1ELtx<^{1z#0q4J|I(q`M
z4}{FEi$Yi-N@7>PH7ez_B#bgX*qv6yWc^*eFE)q|Qlle_msZpaCHgSt^IcenSH~7u
zV~1ZPX%s${gVjh|7#NTm?-?jTKY~0E6MwEciC#4p&xCz}@b-q=M@V4tnhWW>p2mkP
zQYUH7+>b`{XT=5#qQSuSA$=NA@GMk8Fx~tJngq}g=|Xh;s123{&dVMuzm@REjz3Ym
z{26|bW!Y7*nAJX{Joz7f42utFu3t9b=zvMSU(!!!xSfgqZyKwkF_tBHWRXKu+}NZ-
zc%{uzk2ivlw(fe#Yh4U26xkYQQEp=xusiPdb}*g5KHRF{s_LQ0$98~%+UmdZs1mr~
zZ@^zWsR>11R{HX>RH$?Ra5%macInt5DMviXKDs|f(0o-)#$M@fUD&1SXibuj8ds+A
zCHvkzA>PJ?W5>+$1`WatUW<J=<>Rd)R%lVgK3`Mviha{@oRmt+Sa`=2GIl`zB0KU4
zvQr!Op=Gqh_(AN?oR_Ugn>>h+OFFg}!vBl5{J-MzrFR-4&>&d3*mAz;6UdG#5DCB)
zR!-|X?l)TfnuyzNNdhW~iP#sTfQcm6mQx89l{i5o&4(4S#tv`Dq{(MN)e_zjgWY~A
zs_w>$WIhzt>UbK!4lp1VC0Zy<x@|NzAlQWg=svxeTa;QhiSg3N?!=hDOnDq~>qAh;
zIC#A&y5V~biP*@epORVQ1zQm50L14Y`~<dd@ax?gh~uB}<}~|`)r4^Dh0t*SOS8;|
zroi^nHsi~ES(7Mkx15<TE1gg&BcpR2vd5YT^~Cg{DW^l3TeSo>LYF`97h7U9Te!f?
zxex`MKfY0XY}n+La2Br0^3MZO{U8J}=Y#Tl{P2Y?YDxfcNdLVrfH{#Z)8Y9tJhubq
zzH;&5n}jS~T|%Z4A}#Z(cs)x0608r~1Pv54o4wqpo)SO(dO5cqoRQHr%i(M=w@KI7
z5w6HzdT!Ait@-BD`nY6UW~~`XF7C?G_M~5`{Z1Mhly9C<@wE9F?5g3+$aH4_p(mNt
zJ{2a8QBt^-wPEQuJEW}dlFnUUQV{JrXg0SdmlU90#C=VaDc44;GuAo1{H+?k?67wI
z>`g(im9h@q8<pQcSKEq=Qd8*rO5G-7pXSa0DkZw(8y=}HD#VGnNcI)jIVMHgnRurI
zunO$J)+rH8;#6G<;0Np`7WjrrE_M@Xp=fG^u)tB!nWe#*Km=pt@?<6|hsoTPpM>wV
z3;>AVX&`-X$cVs|Bs)-hw8A`rpKPNMa|oY)2@8gV#=B=H-5poRsKy_f){JDftapp;
zDmbin&5y2?KFbh5-2hSZya3mE3}O}7WoiyMHxFoWMQ^pW@XsbAV~u21*5s(!oaD4M
zusGESd^_7HkN*p<qMK|DIqv<a^WS4%M4FZ!b<IN{b(r4AjT`&rZ?o3O++uRG*5MYn
zRu8T(uLsL*pa*Lv{|E~js)fV3`to$~|GuN3bzuHjZW`3cfDfkD1vsb96AnDvvfrio
z)=Au>-l7(DG-Jf{=Z{ioR<7do+Z@Np4yS`Z<Ym*d<$y@S%VMvR!;qdm?sQwWq?=WX
z?_+WJXsOiMB%jF{?@0$k&<eyBj3c#9DgC$UW4UlupUQ!Df%MHu_RqD3liE_Mms8O@
zeK&MrIh)n#8$~R3U~@zfk*$i6bnDakBnU4WXdW}HVK)3O1DirGDpP)gf%-Y9pxtK@
zE(k-p*$I~Ba|wK<WqutF$ytaHwsDo+Csn$i)+>tvx}a!;I7dT362*}rq^J(=Mu+2-
z%LNfVOK3r1P(u{BFN7+Cc+^mA0&fR0V9^xy_l74=Y=1zzh>EBhV;v%zD;i?;UMKVr
z)s)?N`kvdd;u^z&jFF5@Ea>U<te2JGtVJ%`;e<qfl5WswDIr8y+>|(P?by*=l|!pI
z8Z@oo^^BL`I&RRoi^rLCGfWaBY<~1UbDNZEtfExcbmj~HN~QiY{y$CofBe2oMF8Hy
zyWd^CmH4<#6cE_ccZk-ze!R!Tzq?87<Uz?5$!S7Nkym7%vM33@o`i%8I6MzGF}i#9
znN~vNw@Z_CBtAGvgx<S8gI5}zrjd(i0R}tXlHxL7;I4}s``B(M!H%MOjA;I7Bl|{@
z%rigWhL?Mub*sV=n3seSC+{{-4yaXnJ?*FGlHCiX-Yk_&d(>FxOKX=aU_s?b{r{4Q
zz=hF>qHMIW#8MD07>PXB8Z6+L^w0mbQYE!N*+k+5Hgs^^!>G6_Jcp1%<q=@i?l3^u
z4Mf-!KES#3(f5ULJgb)Mm<BknH!pQMTz%S%u4E8Sfaif+0+g*wh-@#_y=v?tT7s7b
z8U(@|yXq}5HYIGj=z5`3)8f<{*Gpc+eJrWrANYkvkNLfAM%PiC(=UP=d9Fv+N6QO!
z)vSb0qX_Kz_$Jq#&c9#va=yNGU4?R9erR(e-7OCN&lC3F@z(*o%|V14D*?@rEPKc2
z@_`GShTnNNhN_HQ8_-VvcES5>jF4jzoONRG|1I>;R>bJJ&X~&W)zHyb?{%hMky)wp
zL)MxUf)!dxl;MhgVO%od+n+JML^;w5Ki7I<f>#?2Yxsw7aBhx_WCQ>U#fHoLS(yfc
zI?Q8IdoToE*OUiH8H7#F3%2^G|5bTUiYB@v$Fosj;t)O|!gk$?BjzWEu_RbW;Xchl
zw4+o3P1s5zF~mYip-G@^=vZ9flnjXu0mS<?$H~g5E_<j%H^V1gaPY{CH{4FL@&YnL
zr~!4cGS6pn1~G<sDmgVT`rFod$L#Ys2S>qHq-vGYDM8^`pF@59PhqQV+H&$~E|(FB
zb>a5zS@cVof$~T~kauta#6MH!e3c_{H+jY|@yU6b^95v$)@h!{zJeI_gw!;HgYc@_
zu~@|y#emKq2LzHQ5h8h5N*&{w_9Hf?4=G}KE3`0#@TfU*<3h$kvD1k>$Q>kEug08n
zC9ta=C(zX1^pZ7oo@g((hi$J^J8=oZc%-RSIOA-2y%ST$cyf<(TW=@dRta=Jh1)cX
z8S<K-u19;nns!G^KkoM{w<u1k`>b=7v7$t=>PwcDXWP}ieQb;x6&ljBq(}^L)$VQE
zk~=af1NQBe*0>pXWD4nSDyW_;m(lx3R=i^8R38$C9E?1~e8sSFc=FPqA6LU*`RSty
zmPcubf8>O@|1pC`z{(0k2^U!UA{?Rh^$j7gC@t36CDl>MR79V<Ro7wkKA-)73ZKiE
zE{Y7>7=kKXsAw=rT_h<1Ob`jv%?=tf!5*Y@D6^1;Pbe!yj3)a#-wh%myfV??T>qi$
zVerZiRRRdbx<&vNzx~dS_f9AWOZ{Np)MADJNuWot6v#G9vq<AsM&Pi_@~fvql>Pc<
z7I1+}K(J?Odsq)KOMfrqurPM8h4^V9;k6ho2KQfZ!s4L(M9QFxP|Sr!ZCi7bN4y|@
zfmBbW8%qArTB=#(Z0xUvbXHc*26tL@;%4vyR!*L)+-2~9D<ggjN2Y8sL5yz{`h#i=
zW-o=BSL)X8a^BxAu93g03rgu0UZA;5EUG;=gT?Q$R&z~47v<v$Wl*D6VFeCr3gB-7
zq*|i_FFgCE*(Q!}?rB+O<69G{omR;1)j?7Yo#%H3Xkqz_HJ*pzEg}oP+h``~GPkBo
znaFrNdw6O?!NlG<^~AOvZ#R;J>`GEP`kam=ZQk2RSx5ybm~FjW`z$erb+$XE@BvYp
zI}g&yo|Pokgb<=zj@9J`nuI%@+eig=WF1VV&+e~iT+|_c(Z|k&<UWLviK@-OjTI5r
zc-sfE{{svf4bv!@2$agz_aQj}jlt1RcW?8{VxsC_4-7C99WgqTC5PlA#~(mO_}aYl
z7$;#A$t`}NQLPI{e!>0X1+k|Akw7zuq4uWwi3}n|<&ePLXA&U@BQflrI)j;$HJYa&
z5<sYajox2u!2<CX(yn$Z;c|a6Nn~0D@VCX}%-BGsd6QxbeoSZm9Q{Asvs%x_B|S|u
z&Is^=`Sra#$Or&U$|at}Yo_c7W`XfiyI_+n#`y9wBs0-_b`H{G%l=k@-YgpHk^>3P
zOeRTdTJbYiTfo_>O39)8#2z!S_E$qu6m?+A@OfTQkmmA2m!@Un6uMbikS;!p5u@=w
zqr8Qlg4>T(%vbE-XD^#w*+*$jK>F6_ws8{>rwYhdKtCZ`0!VA!TR@&hS^E}e>uNWx
zhMtsC2a+UJhW~YJb5mn-3ba52qF_V9&eRhE&qep5Y|DOl@nt4NT7CjJ1d*}6r?u!U
zer@F5c0l#dU+S-pSMt^OT1M%|fE|0U1g9f)$hnn3p%OeH;^Mx)h~zzCUWvzd4&Tru
zoEHzOb{9#QUdp~#pox_PKB<fLLx#pw2k(?Agh~5f7ls9fQqo8nK0!oBp!mlQ?TD&F
z5EAWbKGP>m6#A|^6b5xrS|_sLs^Y~0tqX12W!S`8Vty-kdx=C){Q@21O&hnhSbAgC
zceAZg{FE#*|AxdF$cl6Q-S?u!xnZ%(*B*uDY(xC*c^}|0Uy#9MaQbPSz!gCdL#^2$
z>f7|{73#*IRQeF{-Rdh#bW5<~h@6tpQV?w^zQMmJO!ATxS`Q9bf}K$K9oO%E8%q<)
zee{xU1Z9>VP8ZPyDn2upA00(iJB#$Sm!)_Kx$n27mg{y5Ez3sS7xk=-1pK%lmG(Oy
zhSTq+7{zr&>;jnui#?0WH|0t@QpMZHj5%LiU2|%yJN{$c<pS-`cgkP!SgjuU9hSlQ
zwS4^*B}wDt8?Wl6TGK0$OlL{%oM@}mNqr;C^J%^sT|HsNhCF_HNwXR(7Qh+WMZ&&V
z`9GUpY8k3pT7T}TB+s^P_!$3Kp9a;B&uIv@9xda9pH0ScTOzF(7T~7oW6#T;$=dZX
z_I{zYE0jn6>cgX`j2eRMzuf?6(!*F0k>CShnGhk%Bw`Ek-0pvtW}eF6^7~=pTw6n+
z&>^=IExrGq_n11ZW>3=cg8V1XXDgK@R*kIWWVlYssPh0@{aOXiTYZj3DM(g6u6HM@
zPv0wu+ULLy{9EM{F89Bq1mqk7Nj+j8GzLo;4*5zD``uTYq8Tq&drJ9?YKtcJhHS{%
zHgKAhz1|7UKmswtA^fBh=n`T+p6<v=K>cQlsWLRt`=74s$SIPLQWS)0(XpF>%=s4E
zAjnn2w}X*K`Y8ka7sg(oox`3tBIfwzk(JdROY=V*=VHJQ4>D%_IY|?w$A><u+OV2j
z{l}ywk;d@kH+0;8#azN`f~-*c3!Q#ZmQ01t9@ryg_`XU{wjwevg`(Yi5_&EjO<Bo6
zA|{f~>kw*Pn{NB268^}{LDzBUCOj?nXx=9{QN9UuLE4cY`XURE&XfcK{p6@8v?w-o
zcu#CEd$>$I0%~GueT#a>h$d8ps?ZsB5*9h%{o<7J<~t$k>%+FQe$X9(jZPO~&G^9$
zzFElCDKQsuJ;-1j;fj@Vt`_^sUuO1*q8}Z3H+lzu5v7ZrZ(=M{LW&G)o!q}}znV)@
z`>@j~z9gSjNFwtnsmUr;$;}G2;Xn#Pl}%Ee-k*VXzI;f#f8<Cca_^ojHXJX5sjVsH
zNvTSjzs+!nsMF3Mf?fP(D8^&;Yyw@#-q}dHa-qr|c^-b+M=$nq`Txr}FT&!__0jW?
zu?ANcoG@JQeL>f|t&3%4ykQsnPgGPM=}uP+VwE(L02REjnlkOV+fh12tKZq38OEH{
zqduQaqD{lS9WF3(j_|Ea3%$<Zx$pCNKDU(K1#ew@Q91ZY>DRz3;0^_LTrR<SMGQ1f
z3~5-{1)vlb!uAc$)TQjh9NCNXewKc2m5^N>kjQC}vpKF9BNf$_(FW?se7_>m%aOly
zOcX<Y%`sdU8|@b%IO&kn!V?%L&!IPYO;&xSMCE|E6*KCNqDSr^Y7jPuLYHA5$<(!6
zpkR3lmBj0d?S2B|6*KW13~6M0Pl^o~!JsM5!=U!vp0=>uS3k>y%($yY9Zj>Sff}M!
z#qnu7kHj)rtxJShWM*(u{_0n-+@0$Kgq)jr8?2)FDIJo+lRW48$?(L1fWQEi!3~WA
zJ4A^Ti|qoeGIq|8HXzuC!hv2b*^z@uTKlSJqnW~5HSw0B9+rMkBUtt*`<rI24yGMP
zlT#$9fv-rHBOf)%&2l*l*zM%X_xq(OVR15DioBsVet+~go}zS1!ZNCQ-scA9f4a-P
zG+^0(ZN$0AL+87jM4D*8aGh%9f>SX>>y-F4_N_~SGx@x4oFay$XW6fgzj5CX?(9$$
z2;<mLr0#cJY#D^hL*@f3OW!ksyagAuO?W*iI7Gg4CVpO%!n>5uG{OF;99#Q$L!5{6
z6UfNq0(F=XlrA6;_%w#<7!51v92P<RK5T{ulrZXcDPjeTWkN}e*GMa10da*%f=mzq
zdtfxn|5z&r<b;zUv7dV%Jmcj4J2drAQK%*hJIX?XB}uR^!_VFbZtO^^fO$MtesMa-
zy1=-!LPDLeP25!k!+j#!nNp@MTJ>l2TU*gC()7EjTA+4lqj771y84vrBP$X=<J25q
z#Y2`Mj0<0&)5NoZX)dUNAB?k^%3?tcEIWtJ?K;uVx3=zcoijF5@y0LR=oC&^;lUa$
z^O0K$VJ-~Q>-ZrZP;**wU?cVJJ{+}m`Xg82Kzml}zL{T`bEnn7ovpR+S!dyfCT)ds
zDQq>OGxt5OEv5hc&|}2LKe#4nel%$N#hze)Qnkn_`cxR)8<h@kf&96;#?spXw6&{I
zBW=r!{058qZY(n1Y=*k9T5ktRNgOY9IVCaWOjsE?4vq=%jXxttibnqWn#g1{AK68v
zJY}W*qHQ1?#!!aPvbtF_pQmDI*EaKwFbiVx{O~As+M$x6(ZEw$_|F6gFBrI_&)H!d
zK%w*~4W!~)7#{ckv~M5Lxjq<urxoUszm}BdQtN_t5jZK7##8Yx4Jq#4OJJzndMcv-
zS?NuVmINiSOic-QLRRCxpeC?DNy0?_xrXK9ohsdo938U~kx3<9Cz;`WQ_M3@R{yk*
zQO|S7XLP;Gyor7DCA<PsF;?7sos0hJ3)eG><VeSUwg%V3l1`EoNh6ij`ABB}QjxSs
zH-i{1==x>ox?h;Tl|O92B#BYYVfRSb<t*5;n&A{<jdO1{&y0VMW6M-n&=|`;dtV&0
z)ut4Cd0w&nH^&vVf>8-B9&+6TN!%hu(NjZ?)sC_WUNmox^R?0@g<>ed=m!nePef6G
zy$G$94T&~f7|}1b7oX5B<G_~aT`eqi^}k(7g*OqqFY{Kr++BR*$rk_J9WB7=75KI&
zzoT~G_0Q`tLL-rxgcy=;GqQec9GfhXym^W=nMNvpu_D!nQvk-V5&EFSd9B@}juTT7
zvEnou^Lyk_S-_9f0`J<_3eE`8Ej;}c@hZDSL1_zQBn?2TrjA)oi?Y*9dN4k>^E`_@
z7a#MZj1nxS5_cn+DBsPRu(~eZH+2H*AXro)Wa~lMJ2~?k+&cZ;U|2@|Ct3eHDYKgI
z(ZUm<)v;u7a&%ZGyNFsYq28%VLa7jpd!>ok(GAcP`2wLX*j)7?*Ahlvb6_~6MCFqw
zTr4E;81EoR@%I$hVi<R{x!9$Zi?vs<R2;J+?si94+yr->#ki|_P8&&U7=zJ2@KcAi
zX;hEu5CJbqB*XrjNgGdY%X~fzxiIZwj+_#L*;C1Hq>4#T%?{0aJOiBvko;&7TPe+y
zgtx8)ZT22UV?QSh968}WM$M<q!Lbs+o%PB@_EGflU+A>hBU>438>`S0o~paEVe$=I
zY{CV{zo*1vTajbYC_j>Uz~5ZX|I+v+M}NnDNC4}*bcjKhVHW@T%Rnbz*K_11>R_!6
z))~K12d8<=HsWIRM|8{sV|m#403>oso^J>b?UwFKuc;TK3YW0CsYNsA8<y4xSnV-Q
ziz=OSP8fL((k^e6>03|>S<g4!%%ix1Iz%WF{Zcz|Y2R0PM`SI}xzzBYv=*6&cnICb
z{b9UY$UWx#j!)`&;t@C@wqqx)(C^z96C$+kgQMt7glLunbk@PZYYLLO*v`2j4CI|v
zR-4k8jN4#<f%Pp~JqweRc_7CvU7Rn}?eRh5Ueiwzj=%x)Hpyvw8-wZ!eTXHR667Wv
z{sdpT<`e!QFS~wNqvdksYX5|*)Gt;#!|TNZodu;>%DM@^Y3&yQeklQXVOb>hhsV_L
zEV;v#fn%Le6qXyTG#=O?C%;dhez>ljB))1=t!LN?!qxC86mXiI*lE-DozH@f6#?CF
zRplxULl2d_OSs5ba(`K8W1$@3^4rc_&%^ZhF$dta@X1^WDPP96|0}fOInXj#ZdOgs
zr@kn=2RD<8kw<MA6CNG~Pe^c+taEa4`*}N=X6m%;T!wVkznBUgK^=^Cvl4j2mV`I?
zwp2gSbL%bK{a93j`y`j(!5~j<4~2t0=Kn7X!1l9~m~Ahm;>H&}&vrLWw2gEDM7*gI
z>OU%j1fN-vQiP|aBeb+Rq5yFFqm;t;!vz8pc80Kn*SLbn6rtnPK0C`E5^Nep6Cx60
zNHR3&Vj`^R#-ZrC6Dcm5a{Vw80R1mMQJ9LK0<ggFkdc;Hzp}s%ybO+YbT9RRu-}5n
zJo}48?T2|dV}Xy<hkP=vCGu1j@U^4?xn4-y437)XTs=YRxN=Y2?FR4-6O1an_kgYz
z7VZ;<-}#oYq_`YLw8ya+>Lk9B%uB`fi-v<NYrhE?UJDtZgT84ybo9xlIYJkff^yFW
z8GDhoP1Qy0d~I0xqnhNV`d_Cer3&a}pfw!Ku**@!a(|x~?z#5=bU&-aUi<^&HkmSL
z=w3@aDvxSN^pA#aHIb#U@$zAac$s@{U!#WMLTpLIzIhF69m#A7ra>5^93^@(<W1H8
zJfkTGL)riK8X|f~ncx?dhs8bxA>V{D&!Mu=IAs3d4gg^vYL8g_vE3FeJTo&yA#(~t
z2^xMVRQfX+$C3nwqQzrD3AxOLql_5LbJl-q(zkG0HwWULUUbYha@<b$e_UWS?ol&q
z_VlLS=g+ArGwKVVt%^19@@;Yv(I;FpfL?losY!^c<agCmm|OyPqU1O(DU;JIQ{hE5
zXYXlgkoxYdk$B?!pML}@ZwO+<II!}XxKT-&7zwo7n@ctN{C33Oo6!`?n73Y1^57s}
z>jo^T6{ag`Oj|FH()XEHDo+>H1ijnz8)<6`-*@^$`1J-P$Kz674Kc_$DCn6J&znDY
zxv&3vZ}sS*5c^f!Jpy8mv$7fe+>58gABsJ*2NfT#p>Xzl?TaTN^Z3eicxE_6gpL3W
z?3kutbrs`+ugCT$4O8eILwK&Tz0LR@qYoX~K`=U-sYTlS&U9<auzIXK*Nsy`c(vYj
zigI5V?F#LXkqR>wb-a%=*N7YK2Bkt`yb0k_!sYq=Azgj|kVV|h1*j5^M<B_<v6<fw
zu!&p-v5oX0UP=Ia%0g)an4gj$S{k}JD>xV#4JaKu5Cp7CEfE+#A?@=*kMJNA^@2mB
zAmI3vEWXNs_c5dm7a+ru5_p_DpxDL#o3H*C86aozn!|?-MsYk99iAp@{bAUnwVE~d
z#<en3w{mTj^hMETs4xDw<p#cFrlg4LEx9<{4hhoiKR;QU|HZKwAeIr6tB$n{Qa)qb
zjygn#$jrCB@5FYE^|s)@N1!HX;By$Q4fdf$6%JW+qo0_31Ht4#*D(3!Hz4VbZgj>r
zLLc!W4c7c=ts|ZcHZN)h{s5}|D?k5%l+z@<;4zRCl)-UrzWG(#EA)Y;z*=Vk=^r)E
zPRJ187l*KWlzNx<uX^7dGJFW8T@3RQ4QPqbP(&3xFnV~y;EuS8lnEYbELQ1a9|Gd4
z3PB+`;66IcsAUHrlZBD%C0K&VEJPb{pq+}lR#72{mp)J~Xd?wj&xw+yZ5v5Wu^Sm_
z`Zwvh!X#(2rUbn*WgC2rn&8}Cid;5{%gD6-^j-3=Qny$Tt4ttiHn^mKh2<N3jJ&+z
zNTtO;7Vxly#Y@wDW)8cgf}$T3d3NM7><@R8>2U@1z(H25a&5(+=orUVyJZf|gpAKw
zOph%|KAF63?%#o}y{-lNE;9jk+@5W>*}UHLNHh5*oBMB)f>xh}SqG3~2qjl_un;r9
zIgct_iC~-~Uvi@PP<A-;+cx}W)xVAC8|&>f$2KU|6<d_EeZEFWd0`KS8oVpLo{Kw=
zw$;!#wpsen&b^Q3zeIseSRTCrdEaMx%u^XuMMOk`bwpW1Xrv@qt$y8eJ^#L6`Q>+6
z*XuE~`EXHpCbZfzQDrBBjueURCL-#Z${>@B^f&+d!_R;DcYd~zAp2*yS<akvwJU49
zoo1Y_roC`4FT42h{B#uG?EHD7*g9~z!L#w*&dT`+sjc<Z_wmsvDhs4y78Jz5qK$e?
zA$K`-d#jM{n=p(-hIT_D$6!R;=$mAUz{IcsD`ZT2DK&|x+~_q3i|4B0V9Inro)F_|
zt)?@F0gXxc`t=A7tsD}XDK$JYagPMe#FXqX5VKHScW`XKff52!@O6AB#PwQcm99_6
zI7c#PPTRN!rx20bq*Ytw+v2BLtQkHBXKZiynE5v*z8!{q&WQWm3!MA`c7h<RVZ;az
z&p5+oDKWDkPV1l>k2ej=t*5e(+yQ)Uhb9=V5qqSr2}gJJJoq*Ud0-d^<C<=?j`%of
zclv1_BLQ{$L^h5+<K)XXP{<Wuy9ckl8<&%pV2zNXH3Lg6&KMW{cz`UY+6Q&q&#4bt
z*t*4!@e>3PmfACrDJ{WBL&>^K;C8N<`MJ%ep#e-M9V`=x7E?rdr(usE%^Dm_Hd-eI
z5lh3|B}62hmD^uZgs!}cKlZ6Pz%t#-*)X294EMA4ItOtUg}^NQ@`@ik?imr^+TCCi
zbNL2^Tm#?3NW#y>ANGCIc7b(k+*a;I2;&R_@$P6MQ}2rZS9%;Nd4+<$!Ul<xl_Qyx
zXCCrRy5%Tj{rXK00`W_^>ys%00n<G@m11dBIJ>gAK{d?zE|Z<}J-AHpfvawF+!Kh&
zoPBfjhx>VSAGH6_W)Q+!1GA!wTC4V(EdKUws$^(81G}XCioPM_^XzEjRLEDKG?wV&
zb`VjKOKgq@BVH=xnUp*8{oddfe98w3(~abTvEAEq&i{THt+}b<99z#hIhH1~xFd9W
zQLHxmsfo`yMW-Xe*oWcDD0BaYpk{_|)ephz=M0dFNd8E6WnvvEkR_@A)m;Jx=zHy)
zQv!+olgaz2S;m8i^r0Hf;c+{jFhc;s6Q%ghPlrXHG)D|Hc@`U19DN0>YO!H`gh6Ue
z5tmdlky*;Hfe@k|2>{b!GGwkic0@iK_!?JPo~x)BW&ys8d;vsz%pzJA=N+g0qs(>z
z20jj^n6T{CsV#Dtc1kR@+1KG`UBMmyZFbf<xReK`=FTlFX%cIvAiG(6adC_@%Lg)>
zro5L-5k_+cYJBMT1T8CL@;W8<H`wBv!9B4@7X_k&@=}zz{6*WK)|KI^rS`~TUtd(4
zhkC6;B+Z`kRtMDjb_SNpzXGRVBVpG;(<2P3_=?WjAP2_n-|Xq90^JXME;8Tpn6v$3
zxc+b!HHu&()+i{S%hM6cyh}fWOdxW#3Dx3=I(#$J?_G_%0>>edjJ(E#5m4vlaNKWp
zS21wL<a^B#%Uo{}c2eiRd(V^VQ;;RF;GxN2QY1z<kmHi7ttID&b9>S1v(V8I(P@>|
zjM<cMIL8i3>hhuOtNs=U8Gr@tl+4p}hFYvTk5MP3BZKx^?B`3Q%pgC@RKX@2yW&PC
z?m8ir3GWorm*6IR)rh9l86yua*o!@}t-Kvnyl1TWpn*hV;-%&U#|CvTLTM=$%C(LW
zpOi2wJ6k-pHHkz!kbK%aNA6&@yIBx+Q(zpU(8$4_i~ms;XWrZz{%F;j6Ye>|<8#>4
zh>=-2=Pv;{y5H`(7{xUZ6^nk>#3z~}jdEoBuFT76FT;GD#qs*SrBxVxqDg!@jj={m
z4m!_X#tU8?8!X$S!~`{5VVvIHZ*$UJ+UNLW3{821?<=LOu^=}oW`gqs>>VDZ)zgb^
zPT}ghi&8<i<V6_tbph15Bd_lXc>|YIj#S-Dns(8eD^RDX+x`627@G}=k%wcH(|`)G
zd0bgu+;?T`j?YKV8^*X&tx>%7$`^`Q=o-3DhB=_pw>CWapGpvIiTjKKOmtY{2n{qQ
zd=i-&mM)!0CzQ8W;E*JUZ()#J6O0{Fj)<40Q5prGtlW7VxjRbPv$F`@9Ee}_B~^Y?
zY*9vTS`BkfH~;N#n4BU3KG!mXNP$sR(JU@*=CwtnVUr{su~$y(?ibkF^a?}$y8@a;
zD!^|C;~2x=v;vq%43=yS4&UmO=Os0oL1vcR*-18Nbxj|c$a9f7#)#Id$zNl|6&KaE
zh~86)z5&_&NAd<d9a&Hx<D!<#vw50D7AZ7)Y2AOqhD>GAtCO!-RGM!k-gJQc3K<w3
z7Cu*v>VFoz$ep$*9mTfhEP8&IlaNU{7MW>iZvM-YfU7}BZL~SrGYDFn7%uGpnOCNw
zO}i<1r$8euNfM#Uw1f1hNC43_r<weVq!x&%U`b#2ffnt*47dE-yl0Y}dRpMZrsPJj
zDjJER1e`12KKvu)15;qW)CTZVZATQAIW<)I^iNC8-I53ds(B!yf{hp2SO@?$cxRGe
z5TgQ5j7dWb>L4>LD>S7nw@@w$HJCOezQuZYR)naZI#Rf4U=(5_ih&4t3&A`;pqz%y
zU|O5hC;4X@RQaf~9E%)oDM7Lty1{5{`2d!?h{X^8#lUj9a!wrEu)CfS)OJS^FI=2f
zbvL$lGkE&VGw&jsg`8o{l$S|lIpe2}C1`TNCvIhA(K>INul$kTxLjFPgV<0)eHd2&
zdtTB#n(M-bJB)L>%;R=|3dw}O^nCkH9LI__naPf5(f>F88$M#}7L-s$Y8=B#rIb)F
z*|!5RTTT=Gl-<aKh)T|99)Uo?<=)e-)eGMZx3_Ami1IJ!d>gu(RG62I`Oml)9ts6|
z3{pz|ZO&8o`Cj2)QEFTM<$81&0qw-hAQ@Q9??6T9rCEEfsyf2OS^FuenAl{<Aa^CE
ziLXleB1nWCt~4Ql9%y!%&tH>dv&`X%iTY`9ky%+xC$ItJGEB}-09;})Fj_QT>#!6$
z5`k7c69bD}L;)RIFijJzAxbOWX`FsfV#WMryF6tdR{)B`_p1^%G*Fo7fP{GKhp+LT
z$#^R|2X9T>#)_7_->U+#cy)r?5Up;1mz5ss3fjV2c{NP*HsEgu7EP$Srlv?O|0E-r
zR-mtAeiqY^`=^jm;R+-DA+C{RGo&GLc5~j~c7OU&^FH|kEkkMUQOhaEyG?DucDCo8
zY=h_f<U5i)JYrQW{V8JyObp(3S+lvfxw$|rxR7UZz{rnnNPB`ReOW+Qn*aOZC>zkc
zEN?7wv;O<VADWFEtWdG$OqpN!r9OIv%YVP`bKyN`lRTC`HfrYHu^I+u@6#;z6{@iR
zng6uGy(Mk(GIU-tT+F9P*HbIqkBRZYdLSsEl3Dny{d~L>yA4ogsklYmZ<`PW%uaJy
z>@V!rJ=ooFEG)cv(R4#vVT2S`Y2o_Ry_q}43vODyB<zJKRws=Y4Ghgv@*%{JJFA#A
zSRg}Sgyf-yv>yX^{bjS@2%ZIRJTPd~J9B#uc47Rh&|02s)H9FO^$&&+wHu2=lz9bc
zGVBMCu*By{k+3W)lPgtNG0b+0IV^Y_)6#>7uSsOSnC{FK0=$nCrzzj*sF{7`+rGg1
zUUzUc$B1N$2+mc0CP_M75ygn3mCz&|l8b3_Og75cY5Bw)v&67<5)N_}<QS3fP^{Fo
z!tn<o*A+g=@d-QPZeF^U_R`yYWvDrfEiqou%eiRj(>%-nq^_OK9R_AIxXx<|u2m((
z-c=4e2Z^)VAsi<?t=D*%OcRtEnj=`x2w}>NVX5FxIH+Qd^zvHIeXX|8&74?NoJM|h
zBYRTW$bk@RP!MY*tm?^{d1#Q$9iW#7tw~OPMg2f`2E8B+KP|pOE&npFF5=Kzed;;#
zcT))A4r|FPJL#e){2jjA0ar3S4JuC6YJW%WYqbdq+O+l!jFcMsh%7+2d;(p~F5vJA
zfYS<6G6QEZKd4*qFQ8C_35K$*$A$m|OgjfX5qb>I>F&=9VXh0%<Cw~ayW)JSjmKzZ
zXp~_TMKn+f6X=*|6&xKb>1ftpEoD&$NyClkq`kk$`jSw@)v*z=3M4Z33~!2{(5EQt
zV1f|cTSV;28(s{hm&%MG5RI4d?8oI2C>0{b+36PlIi1RYtOxQmx-DXO7JeRV(H#05
z+)^!BA|i58<P16d;`5|mLvDLH;LFgmF{bhD#AOh%y4a0?p`F>4lxLnAb>mOzbTsBo
zksfoGDFjqv@*0!9mt1rOgcZg=#1NyHd(k+z*yB&#B}qAhe;uGYbO!5oGAw2UT#%lQ
z?olDPm^>srv8JzR8%yHs@qF3rf-Kv`#yK_Ww#stjsQqWF#7^Wgi!+V#9+;c=){%WC
z5arRl%^qc2YnV5+<>TP%n`R$ZlxLA1E1Q?ZpFX_ub-OG*;hAuK$*`ei*vm{f!fJHs
zE4oT<QP+IxY6m`e$HJoNW!}SioR-oN1}eFA+qFORbzC<mPu8jYAzNt$Hhm4o-i2$`
zb{jIKHFR2vTt~P;Dd&OvK34FKP?}sZG7ZF8rDyE$tNHz(M_XA~;y@7INAc81gQT>1
z1H=gBM|t|&jx`G@GVu+XvU3pt1qBi`ar3>3;C(~YUiQ=TMBe>6$v=I{MP?{L{sqDf
zGJotnGE*BN+FMRW7eNdGg<}|l!VowyIgFbb8@iB8Ni@t><~517BZtcyF6ks$dK<+3
zS-P18jX;U(iJ;^beW{fKwvpU7vpLZ9(+b4zAgZKH>I}ZS@aw(V22DgTX0u4*H2fQL
z4eGnQyV-t@H-zwRh`kj!(ViQXFDrGLFsaI<=9+=N?=nw|@fcW#OwA+~Y+-O+I+`uf
z>%XiN&fFA?WAs?ScD%P^`0SrH82a@GQ1{l&SshNfUr_8I_4w8*doEuiCt+3))AwM5
z?G0FKBI)ig(WJKVEHvk<2W%KvYGAsJB&mE}b|7&_89!@H_QM$HIuc*gXXb$nVr-sg
ztb{P3Lk#)Og<x`G&`$7x@U&iAT)kJxi`ZGw(=bX?Dh5U<4K<HTRZXnv&Q=s6qgQGa
zYIkW3rC>ko5ISZFgUvYQk-mvF{B@ct81qYsM=2ZfR_F-Sn+}OXr0vt2i*>_y9T88D
zhzPcx$QK$Xx3+uH)o@#6lTO=4kEh?FI6^;MfJs_8Q%qk@_F@EYPJ;W?BxBmt@u&&o
z*Gs2Z2?+Hc>?rgY)*^DWG43F-J!PkKhjcfv2-!@e)WzOzwc^QZgHDpTN={s+Hr5=S
zn;Q@rw~ZczTbf5PhnfRyn{}p8<N&yXY$8Ph<CebBO_;G!3hAfxn=)pz(tmhJJfRq8
zhCQer4<fNXsHH{NQXy75!KUrWtbbygJJ&aZQJ?55r;p7Sd*9&j>uLYSzKarH6e}hu
z^+f$q_~|e>p&fW*{s6SoAuN+ANU=T62e;wttn_y{tNZFl)W#LRfAY}HP8(YB+AN~{
zwFME%7{;5@UG{aiiUv|uYI(*I;7#gG;yK%6ro~&}{Uyr$zW+-^w^P&9yyb>!dgPvM
zbm?`hl$9AOV@8ba4Y)6zsS>qRmutfq9Y#W87?$1tX<p6*fEA35fg$$3?w@xcB_>X1
zFoD#K&y;y97z~4j^nF&9RYxICE598O7xJPd<miui5uq1KkA?d@{US7B#t@=OQ4^%1
zG)M!7WQx2TG}8GT7SL%S<Q6pK1%~M!U39neMa8d{_JgU4$D2?sBUG{DP%D1Y4TW)t
zWa(242{D#nCe*B+I$!H~H1XU}^y56|t9*Ug^<SLL16%Lw6wxW^gs%H=JcVy&I8<7H
zeI4I?+~j6;dYyld6wT44HE!E?%@AB72sk^tl)0^g1$SwZrn!F$2<%o+M_3WK)wIJq
z;R=bCtAD7i`9}~AEynwoH7hSBb5}jdD*O4Y+59n(0{7DY&hy;ht@+)5wOtF2h4Wl<
z8NE&|CnjuOqi^=Gzq)hOJLeZBUi3$;K~>O<^ifV%DxRkzv~f3lfJR*|W)&OqkYn6o
zFFz4d5UA9+(kz!<_U<$^L=4ay_P=i<-tt(Qqgk1oEUot(;}CuVd!z;or#}C#{_!XO
zWi~~V|DHHmJB4FrXL*}<#q(`%E)fNdp-F4wgSY0j?R)eh7jorYM)X-_aEqn7b70D-
zNp%ZBKhPD=0t``?+g-9-N-aOID_^MJtv<?jxR-KTP)7TA&W6-~jJ$v`wK8`0-#G3_
zRr^PDzU;jb{wSSaSm@2QL#^UWi93ZhX&k5#2C>9Jb=0n^_Ow@&E&6-8=sfOTOPUbi
zkH)|Hc%eO;wdxUyv<rb)g+E4G`z*Q)_E$Kp)E9dTRFmu1b>tNGDwp+b8Xj@_xVY!5
z`ag;NL!q0FEQel$b;jKxiLS5$%&O@Aj)RMdvTr%^a9TC|7&Tk(##sT{p)i6OtyV>Q
zp#sMy5glg9zw(>i+;;Q7U!oKUAF}U$LYor?*|NW~-S0hz7U%C}5&Qn-r=4iJPuFw6
zCi2-C*tN6DC0e*=8zzO^v~P}E-ZlJIF=*TOMhvR!Je_b}WOgD*cKbM(^&W^B{5JFI
z({ZpDlaB7x`bm)vj3C16y;)}0weY;+nDNeSxBD4j=`765vWa~q9PEPIfqweE>u<b0
z4CUWC%9`G<8*Rg!ghMbnBbi;^Zw-uXR9BuJ*3cXQ{MsZSh2pyk%Se<#{01G7{ixX8
zZxZ{Vfz>RJbm_~BT@Le9Z(73maIS-=W}-js&(Q10;|0TAa{ic+5pjMk3t)2Nh&tsQ
z9|1!y%P>~B3pc@H#z3!peUoXLuO_}9z&cY*d&7%;6u_KXQ?=bTJkLFO5qnL{^^YyA
z9Vy;BO=-~NRTRV2?P(kB64%L8Ixv_t^^HGAp~8AAK;L-h_LCVZmklIF*!@T~-H`=0
zES>13G7F8ZvSQD9o}KTRSof->>DNPxz+@I{PpCu>NF2sa_IJXuOl9e2yADK-yEVdu
z;|YBY<nWc04|`H0_6?H<>5s!QfhKlHbxPoA8N?6*MlVztBMZ7}ev{zeYfTR69pV?R
z=w%g(p07fkzJ|2b<}#hV>83_G^}XDOFn{Sp!7xmU0#-#IJ6I<ZM({`LCUOm9Pgt`&
z<_#Vtwhj?&c&4w^rsqd(RT?WzN&==fLNNb^8w|!Ak(kYcv@TLCs&^gci-oqC_UXgC
z`Nu7tgxdzN=H3Q{E>Md}1s=z!Khfwy6t92&y$f!6tQyo^UVgv)V)$6K8lF&aUvwRF
zR!?6mHnS*4-2GQ*_ntWy<oL1dP};E%>^)zuM>P_7Xx`1Pt_QUrTigmg5nt&5&ww%)
zbln7&iUa=w{hY&hVkkUNVtDP?dWjtUhCU7%#cHH*7u(b>kCTtIM7wH*wqn{4>Vpwh
z48zudAogX)wRgN1Wb0pHr5bD8lgJAzW_mP%5y#yY`g$u4Q75^sFuretppk&DRxJuw
zlV~p<>6@t%i1**xb1gA0rJLA8L0&jk&N?9k_nJeK8>Dvd=EwV$Ax(D2KVX2?E^#L>
zZT%{mWrzC#!&>7DAj>X>6UbaPyk7a^j&4{BR&S`r*Lqhpa)9^F8M*6$&Q>*<MH4h;
z{5=(Oe!BbijpzUyk8Vtm7_^wSx!7kfL5qT<fBZEnRfv%r>kl%~)2(gwU=>Zcx@144
zOxeN?S_$T>GZp5J_}n*L)4FH=2AHieuBZC(ehOmb2CC}5?uFCrN%<v0SQ|RVRS1+y
zw(Ut1bjE*rNtV1BKBN`%%E~t|dQvQ;8WpP~BaD|Mk$1oNHXHkgsEUaBc}2m(Ye{*7
zQ)C2AXnDq5jM_v0&Eg1pr#6b!e*CDru$D!XNscEMjB%!C;B&6D0{y^8S-b6}+~A6~
zpDI>%Y+JY7%`__@e7_RzX8#5p`qyPw2X7?2FTdOIr-!8b>i7TR>n!7%e&csf4<x42
zIS~QrlnxOQlv0uI2I(3gV}QhHL=ccvDV5IAHM&b+^k{^UGDdBO-|L+Jd7Ve+@%HE&
z_kDk_&vm`8752n{t~X%8ZU$?(B8FUg1)?W&b6UK`uYkug!W1!!0xh@C0Hxv0^&Ovw
zc*i;a_8UY^?rBRUx*kY1Yw7QXU365UcW*vR%Pta}h}ojA2n@y^+~#_r(4I|bd&reg
z2%VDM=-xueSxM!oFz`+v$9c;U3fLm;7^BpD*rp!PIAIRyyg=3D;Udx%o#0D|iLnof
z6Z`i^F9wWJ(__$i6r2C?B4h4d4BWi?d@)EDJGrgQC@kJ&GdGb44V4zJXgZ1YL_aYM
zlE21$wFFjtSYjRFgqmPC6QpIB{o3cjkMcqe#=0nY+Z3*`>dNGXnYg*Dz`i^y`7|IE
ze9_wnyKAico))2lw$)Mx(^z^RN1`OBj@zydD1q~SaL+DHOOE;lcbF%#kP)T}-G8L~
z;$!{Y!?K$?_D;%~L<a`+=zNESt@3AVgUe0w7QH{CBeiy@)b0~U?<K8b6`q95Kg?-4
zS;HBXNAaz0Mu}4zd3AY8`bqVy@%6fIN+_4K4ceCsRQ%a+O8$~Ww!07Z<IZ1dQRz&^
z**@zNS927#FSR5~mSxGb(SB6uPVZBr(J?N@Chz>q<V$J|&qH5V+NyxJxa!`sc~7Z^
z-}>R+MucE9_j@&QAjUVuhf!*_VH2iLbG{cO!71P;-gFlaV|uipdOd3e?nK!H>X1zD
z1NT}<NN6}E$7ToltKw=6Vu18!(n^YWPpTIoZHVU9<{IHJafCC03L%;3!;VyfcmlKZ
zh*zRj{6J-=Zo`H(TeZgU3~>}8Kppa!D_W;IrYFTHaN^kfJI}Ngp=D}@m?1)S;lb9p
ziPhctI*pY2^xw{Bc5;Er>273omOm4Cnhm;^8{4R4z{#MXe!C=dcm1$>TQ4u`lspMj
zUn2wiH>A3>L}k%6`m%ZnS1R%w;ks<xsETpqw5@OzzhGY!?SiPzLaCVPzPkBp_ts;o
zW+O;(dR|sGVz|xSw&dJq&txq;=tx8U6^|<BecXrvay=riBxsx6pQPNTgRr?o)__7L
z9OR*c%EMvRQLL61-mHHab*@SeANIby*wuvydI}%J=|a@7`^7l<meUIS!)zanF{;iZ
zphnhbiu);RT)Cw5Qh@CoK9o4e>Rb^+CF5`&*bmKJISeJ<XNum5pznK^H<owF9Cl+A
zpM=}KLbT(Dn)l~o!@Js;f!QrtQtnjvf9D~zN@vITJ0dcu?xPNXd-_ze72{=zCBEqB
z<`61yjb2z`7**WfKPo6z5OQtnVMv6J)B`=)#^&;b;EVI4)QRoZ9?qlYqYgZ)0rjTz
zxHIz*P@C^OAIeLeZPydG`V-n2r{fF2DC5uzh$3y)k+9(G^!0zZUc*uHkW<5u1CRlv
zJ0G-n1Y`fuAiD%VyV^aU0|?C1qoaLb(vguD321a=A!9`@Pjf;xk{mZabHhS-=v6(e
ze*X^)S0^sfDN|zpiC#USzN%aF!)DL(fI(?54@#`YNPzh%{h^7+MG13$zBa&2`e(3!
zJ96}a#BgxS1l>x3iDRI!X`KwjB<lWO1OIW2-vKhXwYLoUiWuRUhgtbW&RX!lRc#6Q
zs2ZbWISl2ps5rAjidQgi!Oy-|+e0SfqLp9D$Nr|T{0d2*HFKHjnv2VO!${>v$R&j5
zVzqFl`S9}|hbSo->mVO3hy7|a(4J)CW&K7>#mSFwOOcB;G*K*#HN~TupV4<WNmJGa
zOW3v^r|>`iVD&1zVyUx(E_CmsG~;!*<;i8T$Hwi%>otsYT5@l-?!H1n2#dPnw6#DF
zjs<GgP#xfAE~r>~dg}P|(=l^w-{Adow~x*yPBhjgJVyRjnG$zkDMB>~tg|~G^Y~m7
zUu$U%W#*VOZVihK)37nrhm-Cualf#FT1qH%-l<~XV5_K#E(cfj>xh7*d<sP;Wj>J7
z=5_vkr&Cv#Qx|mDdY;Cx>~pweT|=F<IXWCCqM&T%iEBjRt}X)H1zhKy65p3d=;)WL
zD{dXvb78JfO)eE@fY_R`ORt90QF%AReVovbXTMoTxYNz-XjV0bj61e(_V+6f+a@@#
zKix7J87+OSS>fPdUn-+py7MSJnDO6;^v&eh=~54P$-R=j8NlxCgx#8Le-E}el86d{
zA`7iUe3*)@+le_?+*>ypR*or`8@I2g{RxU?S|??qfgxBfgrN?;MSc~j5^rmaO5WNi
zbeEpH$G+$?YO93(glNeCQn@*dI?i{gE1z_F&H&pFJ;AJ?>q^xg8{>VUsQ?wY=oo+i
zU2Wt>DO;6v-}FdDiO1!}Wnb^**IE;`_&nq6p<WSqvWyqQ>vm=}1+On|bo}s8cc|c>
zSLuG_9%5yuXSFH-i}X}YbNTT#s<&x}_6htFx)dw?cCF7HH~p%9)cs+fHu&?xZ^LNG
zn+2Lc`WGI0iSEeWeS3oiZJtKxIHxkD<MqUURZjL7)0~vO-6AZUBnZ13wjLVE)R193
z38L62CDj?fU>uL5F{y8ju5eIgRzK;arGlK8t#MzF4F<j>voA;<1G7#%U5VFsh~S~}
zAY>_qYdjpI8uR%q(=EXb`_oUQ7w!fTat-+b`sl6@sY3ao;<?&Q*>726wa;`y@YD>W
zaCQV)`@6{Z&MSOu#Uvj73M3bm<_RsJ(gvpl`N(|Yj3sHANVm)mozwkK@o8Dc>86#%
z<o=&G&xf$7i`zRIE{>b`so<r8J%Uq@4oxm@+}=2OEq|O&Z`$0-LSW?gUk@II0T-1P
zZ)x!LdQar^J=$+DZ(AOIV(((i_IGDx;@!Xf6VpK>CX>84_jhff|C|@Eztnb4ccpt9
z(uoQeei$OMUwNuy9gcpx?2jkza@4^+4>)sKw#q7ZK)5#_GMBfU3|?n^e)m{CeFuAg
zl@0J+0hEnkZdt;}V~H<aTme2T<!WOa7OwCc4C;3O)qb<csUY3=xyWR0*=`AXRdM~3
z@{O6_=2$RXJn*)z$sz~_Gh(MdfUiHC%ehut(7s+|%)Xm@lf4bo6lt6rQ;(W$$E~lx
znhz7VmEw33mb#4<JzoV>O0ifHn;$hzwfP?Z6*tPhW8t{kcXy=f=uAo|_%EI03yV3Q
zFuBxtpzS-`uRnXWTZbQU0lLNH_AI&5>t{$sr3&jEUf7RRO>(kI+=S<`AtfC1oqqFP
zBIgTS2`eXmpL4bw<sTb3W?U_1&8$@aMKIj_cwtKIA(j|n;+O?;Z7P4V(O1E2$R_Bj
zkx?t!a>i5kB0=fQ*y<;S-{u3olKSRLTGu1YgsDAN2Fadpp)vI+L4v{TW5C_;F|qq3
zM;&2|s{ETQCPN#PmJMqFMf*GafGDLv|72Bz=w}ar_o?&=t!_t1RvJ`FG9BD^WeC|&
znmWm#z}&R%k`##NDgeX>qz(+Y>r?olvqV<BD}MY|X)=1C^r?2?$E*+krcA|-(V0xb
z!lra%oipM5bc?L5*W~CZ%9W*+eeO6~V$L#OBCKZrZm#WoB}G4DU8c#PFP}&p5HQhc
z>U+Xp(NKzi`4%pYDt!lu%K<2~J1bQZW5j(Vi%_2sG{AIAurZByu|@7)cEb>u_|QRJ
zJNtC1#=D@bet8~DA)=i2jNE_8Ua}c&@eSDvp0wDP_m>Sh?+B*>^BxFEFKx&t0%iA6
zgndHlFe;V<sm4WwKmJtt@?c8`;@QSw(<f124P*BoRsI1B_q(~ATkiO(Ir*dUwps>3
zw&0Z$B~;DD8)}_b<LY>JyD-_rt~rnL;6e_ehI0;CZU~9Io9v@_+a$_7+#$Z2eav4N
zQFiCsaxFxeHa##j@qKV~zT%J504jF)?`mob+b}tyaY?jXStB^G5dGNnMJ4SV;~%3!
zh;tPf{bw4&FW52Ik;GZ!*ZC-NVAA2UU`?9euQL7UWJsEKeRU<T5T3U;O~O#D?bRSk
zB~#Nr%@@RP|5@esz7=pIJ~xiN`_S*tAKVcpT&Qlr606|D>mEyzEUzb|Q!KvvOVla!
zdjWq80iVaqVn8n`4dJ%1O#kXffOiMyPomXn&XuoHAuN>B_Jl0<^P+oe3qTN?>5YZL
zFr&!v&ZC7qy!Om1nQ(4Xx%(BhOY+EH<g?$3*`vSsf2nEcx}~yQm6bS|_<Eh&+9P{j
z#mgk+3O;5WM()T{_f}SJ_yw>{$iR-Dt$)guC>9;H&i)EDMt(*WrnkQu+xu5kvNt4f
z7DWsSscU=gfA++#dud?kD$kQl?8#`8PBj2E8$-ri9D;g>H<}j)&OcE{s9ZO2<ubKh
zZVt=tQjg=ty@rJI--XDWFZy(aVZ3SquJBd_xH_p4U9}yK*xZ^fM3vwlXzlu-f07he
z)dYp1Yfpu(lN2%HnL|%cxj1q$@wUS%!7<wvqS&dtW32_Dpychikb}CV4pY}E`+JLN
z>Z3Wg&)7D|62yV)R}X3pZT<J9f;wow&aj-dQd79C|8I?Xz<#nWmFc_~D~uV318$nF
z&jCHI{<z^d6<uozW!u-8`@WV@#f9dx0m|8i_OF8%@99QIV$y-D>~?+1s|vjPXRED<
zn2Lb9;+3PlcKQZonFNuRRRwtr=fS+vza#YsfWlE&;?yC?Baiu>Gmy>ECfEr&bu*KG
z09SJLPTMLo!GtyWf&ct7`8a=G+q$(G{5A?B@f6LKsY=r|4DrLIe9&G*5_!4SgQ$`B
zED@W;rjA}NEzgs}ofiil#jEmJ7|XGi%o~wcP|M860}mn7;NX_(y3oCLyGtrr;dq0K
z%LX6mSi|5&-aOhpV*hUjSXM&?zv+QqA)mTAemIST6s!jn;aE!TBQkX%J0tSGZF1Ly
ze?ipPp5dGR+WQR_{(>BeqLc&tJO6h*6NYX2e;+omMt0d8wYfj#e5NJGO$K{lW+Uqz
zgDR1?df6Awp%C!qg@ugweb&b?1b{6uj6mcMy^`75n^X~&Kb@~{%}w9__go;wfsi4M
za?5Is3AVT^Db9`jV?|RIuPpDkL1!V(TLB6V^+_*z6mQXf|2r+gn!;iN7;_kBiMivS
zXeE)I4hlGIMpWGCd-U#2deTJj;eun-%5}~P5We)G1bsh`8h=xj6cKdTSj-hDlBqeu
zc|~-EUEoFrb{fu&+Ou`ZydUaH+K*pa&%L@ns#FD1=3PvOq<`P2)SZWI=*S#zqA1iA
zk^7$QvN<Buw`^@c3!RT3mfLLx|3u+zw=Y7~ZTp{ny2X9yhnXbTb6L%=cSo;#4G|@l
z=S7|wIroMq?$4S}=>Tbh!;)rN$&GcPcOF!X;kF>>wSP8Mnh!Xj=RzTD?yYAG%7^Fw
zeG3oGJsAdU%iOYxmx^<|s}V^`7$j;BldSCfOX6F};oWKw)sNHRH0!U3aKHr5T$w0u
zlk(H%^<s#Y^ZxYh6(wL;71Q}{YDp;4L$3`t!Y*OK`Jiv{ZF%N65_y8SD7!i%t9Z1q
z1hdC+ym#xMoLrkR+~nYmUQ#d77r}27(HZJ5ZKQ_oZ@?c_^l1$q>wn&k1(Hlu@IgFN
zdB~Dfh}(--`IL_uJNPCC9ZOWy8=^Az9+;qB*Si|fzhw#M{qEgC#6>Wh4E#W(5jjMj
z8e=eOb25H^RW(<9hhDXhn+aQ>w>ToC+d)AkT>C?Q_m_HJ0}{DyX7#P^Uj6d;MQKN!
zb(q++_yXUbnUvlKQuHdk53msxS|nu$?O!KuW-(t{2#Jkl`4?x&nv~{Ej3u1DIuRg=
z|9HLrfjyFJhDv}|)tf$zyn7x6V(r|^k|M2=4_MCWI&aJ$nh?J#F|e01Fs_(mcZwoO
zlKZ>uPuEwsD-&<A^iO!9qZWEAvOlku$n<-~LN;YnGa>~~8ed8m|NE6AqA30s*kgUT
z>^^p9p(Q7MxK%KUeIK&ImFxKq`!Q#8Ncc_H;Z0{=ghboF$lFd}<x_?8;PB(eP~S1i
zU}ieK>!mKVjl8F(U8m#d0WoMtfb1Y?)VGLgQJh1q33^(FQP0vjXoagUq}y#XPD<JG
z1-nMCLgc2JQ#oXEe(ec#^6ad6kYxBQQh~P6+C*R%I5g_7rG?EBF2+!{XJ^^seQ8_E
zF5Q)w5cI-mPG`HdhW%ZpCfYpGkuQbjDRwuoiTIVW)!yt--?USf4BXLgpd^*I>D8~O
zKVN#L=`l@HH~Nn^4c2cQf}Lo_Rfxv~*6#=oWrR4ON2HZA3xqqR+DDsGki}0d@nY~>
zBUZ<TX=v5A_aLoaOvJ{xDv+W$2V>0f&cc}yNM%Na%)S>-aN<io*^-;y%MarU=r&uW
zoc*jrEX>HMT^#7dhgjiL4CQ-F9pbw|l=m_=L&5pD%Fb>prVGTWO0JT87gj>@o2~P)
z`coB8@@}spSBmtHt17C2v8s(b6Do<e`s8NEPn8<fE=DUhj0gW)N35EJzKyC2?U1|h
z{H*>(SX6WpE&$y0)aNk61PrtCTBGSW3RCpz|E=>6|J>WR^*-nj>pNOxt3U`vY0G$u
z7h9B_IX?S6;I-*r%VTk~Q#%08>-{G6Bs=obkBrOhZl<`9*WzHHsewhr7g?)FMEQza
zeehH4*~;b8Q5<VI@M{0`ljn`!Y%dUHuOV}9FsJiD?ZRo>m9Zm{J8a!9LYLS4t)uA1
z5If^j7?6Ddbct+NyE4kJP@wk830B~116%&o)PEB1IQzQxjp4=wy>La2Y_B$4P5z)i
zK}>GKCHvHSsKP5ezVh-{S<t^Bv$#|q0Qlv<xRuC18L><&3RGeY)+4(m7a3G$FXKxM
z>&y*o<n%Qzj-{T!9|@Kejcmn0XSDU~J6<5`+z6u*M-c#SH9S{fb`uLE;OTwXbP`28
zw-}+>gdHs`Jxuj0B=aQjzRyb~=cCm0u`deFyN@qAD8}!7>v7~qc6bBI9ruCHAKZW2
zMecl0k0-K|SERRKbAwx`Q^v0|EYZk5ZCD@@qW@H(hf!hjM`YeVp~*L7d1};FY3^Mt
zbx)7OWN;rXmzZ{iW&INWPUrV_%Z5^cjS@{}9vv6ASsa(*QVLA{&8Ktu(R68C-3Mi0
zRF8>&I;xPlOggUA>mPUX$7uJ*J<#;^-#I2~o@{j==>=D#%`2Cv!CMyftl#x5d<I?D
z5(ToHJ<WTTx}>}^TuT%5jGC<qPbyjd$z!MlD!zmANCTc;&b<WP*{9nYUiN^ZOKy9O
z+{-P)N|%b_1roUVI+-S`@Dj>jRegI$nd%E!n`KYgeP@0tl&LtA=RoKtjATjjnlzj#
zuWP$2hm!B@F*v%NC8Ra|{aibEkwF-g)Y>X$(D;R{)Pfyc(v^Q_G*o{lPU}N~OX6>;
z=UJ%qx*;kl^7G#&TGY8b1zj17)zp|;0lu-J`$nZA+-A($Bn~0^FPx7#P|qIFt===j
z&Au5rS~sFet}ynoA3~NsPOZ5<TYpX++a0J7wBF~s>*CO?&OUqoq~Fy@k|E<YWk3FL
z`=fBu{IFFjIjpi*{mCWA#q=?yQbPyba}j`$BumSqTd4MGQNR(gVL(AL&`jRH+p;<a
zRVDZ|gNz~~EaP=~%VhUkrtjng>O}X7B)v>%*f(WdH>c|g5CusaVO%ByDQqXHoFKWA
zR2AY7tNQa23YTRfg)j7~%%#zKpYv)l1$BD9iD}a{1vDjubRM9JXL?yLn*~}0ORuJ3
z%im&4iG#c}CnkL#(LSGJ&p4xCfM*B6N%KExzqtA#&M-$g164;Sz>{So3mr>~gxqh;
ztWEzlBVuRKGg&m4rt_A@*c+z^aIDhE`p(oUm5%$!1ASMgVIp`2ZHCL-_>BeKe13K2
z-6(ns+F;zL(SWDzm@k~b+2d*&cLa-OJ!kkS=(GCB#&pJ|kIOY1N=?aZz`TcC`=<@z
z$f>?3Yc^Eqn`1w8_btR@iO=fU)MN^7HrP(6B6KI^?bAq6@@=BHuv&qW$3y8qO{1hl
zhxZQFvs_)dzHOTdo+^N*Pm`<ki{4#FJH3B-Oq}03aw5fe_NuCfw?f1xAv7`onJGwf
z>!uYfseYC-m~2QBn|S~{c(<$aPQs#Pm&jvgaIsH33)t24{nm(}#_+l(UHLwqOY{Q7
z{LK?XG-VYj@^;ktD76>=OET`+Q4g%;I<KSQu}F%?Y6~0N#49C9K6d99fD3IQX5vuE
z2k#K%Vu2r-O0uizlDtv(_3qhp#xy?9=Ov(m(X6Sf6{I*(ZzS4o+CQ2gV5BnJuyI;r
z!Q?Wf^Jsk`oj!Rp&l<yXLij%Uge4SG`l!cm@a`Xul4ZmlJ;k^)P}<?o-9Pn`k1?t0
zq}0YkrW5A{#GDeN)uf)!7LzSW5%0g}o!k|?_eM5`HqF+2duz>$ru4b~;h@&#^XEnA
zO$lNjBy-so-HR<qy<SF>ew$(NpoQ1J0=L3*&z`gQbUR~2Gf(4|{65c@CQ&TU%sp|9
zd#33#U4AZjxc+D&BbFd<bcRVE4%;f#IUs<?o?sBE1~FM;nXA;(`1q(0L|r&(6x!7O
z+?6TU{#x#*5}lFvpl_jIB&Gl3uqo~Rbunf40dWVA^qX4hKES7uKJZWv;-mLR2x>Yr
zD?mY4wYtfL)1JJy6_L0;BY7_;l~3Jpf*`*2Rq<v)9ftv1D^ve^2rOtN#yI)n&ZeWo
z?Y5FrcW5b419H3<REJJl;lO!LNYR~-HGaQ!&_ARMa6zZ|7yNoU(D7}^up+Imijt3*
z6{i6Pr1Ta4>eL~=v)NJSV|0scTzd-O5O0WuJXaU2<F;&wjilsgiB9Id5kh*medxtS
zYY@HV?%>;s6yaQrX2=-)jv#*wFe5{$dj6niV>ycH<T4<j$rVO*GV+QNLcSE&TFhO4
zeMpIY7STL_79{yX-_herVSmqFe<MF;-X%-K+dz$aNZ^)Y@8?r;Iep`hQ)kUE`31o5
z?gg}~`*@8jzTws8<%x9oN-W)JZjd&f_-KIH9)qgZmI93;4NyowjQn>YUv>6?KUqtd
zw)`=MPADW|saX4z)y<#F=aiquc;QFjFY2<j`SRbt>kiVFS~=ELcOh~-E*rL=2iBQa
zlsBAi?qK7CBN7eG%Vq;}KRi+$&yXxtr&{N>9T2ot@LSL8(_S%gM>%C}9+8QgQ0^Fe
z-Q`pG;CCnd2;EzelC82zmB{iS?o`%O(dIYJ`lQRJrhn>FnOt&H1LCq|>*)Z4Sx+Zf
z3r2JTplfmsVz7lgQ67q5Bpmo_{%}FY{;6zKO?9fK9K1FeJm6$rBBLgBBCzGNxcEZW
zPK|cYHD~|SL28AnES@=VsT8@gwzC626FaS4g6^j+hkv(!LUsGmZ9|x_^5<({-m$W|
zv(rHnQ))xM1k=M*1u@adjxW80T3<ak0os8^UZ%3OcgDq>DahEvApEcvs}2f2A?ICA
zi^PJZhTH*MD1o@ja6cED{kMA(BR{)RK6ZO=bpdrH!)ohamY7vPr=)?P2Dlpw!q%Vj
ze1aJ?jPpGW&t2mSpw&$wZSvFkqCID)puOehoAZ`(93v3#N)>IQd{r&P&Pl0%9+`9b
z?z<~@4P?$OHz{KT8Mk>L`up`UC;jLcet1+qC#Q$mtxuiFGJCr0B0xhWMdQHD<)2h;
z_it&rgcTyHmmh9_f)_5vqbK3vZCJve>%>^>pMBGZiv4}}61!JB7YQH@-UCSqRs(W9
z-<dgzuv>o$Kcx3`cRVCRA%BU1*Z;&gSoIXgRoW#c1v$|++r6BzEM*U7tjs&lKV~68
z8Xfz7{hnUmSR-M|$he&^Q=Y|MYUc6r-<s^Cw|jUljDGfkr#U#@<dO=dUV^Lw%|!>g
z`_+fC#LreT<&*YK-l-Fyz;h)<2yWfYzT@cGjsF>$d!47C@GQxe=`vM^m|ygm<i!Ks
zOr{UmmrB?lbp?Qve#Q{R+RreZ>yCUu;9YvvH=!9%wLZPIiTHS5u%|!2HXg<{Xh&l6
zF(6bxT}1Slj^^JufqGkFL};<ygOms6t9&?%@oVN}QppQDT1P{^n^my=w8hV?6&mw}
zMm71pn2w0Hzv24H66NH-&!?x6{}TNNp@E0vpEe~2_Ur-#HP~Cn4<{o{6_SLCGutBc
zKf#ho<?F-dUu>5~T~EC0L;tmWGYY<wwQ>87B{x&=A$k+euZUy>#ac@zt<W!l%Iulz
z{AJj`r8Ct*83`$cHP5UCnd{WX!<MiSW*~V3>rUbM2RiTYPe+-SX*{{#Ux(uq1WidH
z?k5)m%V49$pZ0v3NN1{%#AW9em$SdaKdW8sn4d*lK35im{M&gto?z*9(}7J%QZjCe
zo>Cc3{kZTxE9+jL2;-iR{9)@ln%+;EH3=yy)eC-WI4?Z)(}&dOUGbA;d(L_O<o5w4
z(qB;UCsl7FI75qiKg&8fUfh-N*}7XATQJ<Npx2SI9fK8oW?r^3M@;Dnm2tWaEq#G^
z^e=D{Wr%wIy`S+o)cL`Ktu?|o&e!QDSwt`n7CwQDFt#o8k;&Mp0dl1u0Oc=-=J&pl
z9;E{EzA1>QoY;=y?z|!34<%UTt4cK_9nhmGKl=9af=|feF}b3O{ZSZzjMhUoq?53S
z$qe-_&C+^Uy8d?5^PdXQVQ16<Xmmvts_`B_)OlrIPheVUSjN~Wh&D7xORB!@axtm>
zww$&98g&tQENgRN&1t@KVpeI5AoF?UGG9{oUa#ws5&>4VgMdX9zO9<;N~7e;*!4Xr
zNHyS}-tuJf)FriP)cVT5$jXbfh4eMosy~USDqTEnAJV;;_>~vSs;_CNSd!SN2<ti%
zBQM{0k!^?-g&7Cr`o+0c;GP=hvh0kIEM?SAwg!=it@Fetw}0Kv>i%c??Ud<N_|Ngj
zFYG=pVU)xb(AW^xd*@N;0waQA`<Au*i;oGqSyFB%afjT)3v!z4e+qUK20l0?jIt=?
zRa6I3GHr4J7pL|U>fa<hm?nl*R>Zj}CZ=S7WQ~Di4$6NMTXGXZdx->G2q8&dZjz!{
z0mz+if1ch>hx7Pxx&slpE_W}+={8f6fOcsQRw3HNu|>J|y$t04=yWXTQwd~!3JaVH
z6vY00R^vF7gEaOFd`gETxOA*)6BKEl@bNxQf_8MQYbWx=&lBBf1>CF}OqgC@D@jW?
z58K_!aExL0OeK^>>=U>ri}wu5{>;0QPdzqph0Q3*3z6%|Y<!AMu=zDsPJO5O;Aww!
z8YIhWP}{6X=C;R@AO{X$JlMND+jHwEPDCO`$ba`Pb}HJyA5vO^1@6yOB#G1<t#;Q=
z1$xBh>u%?{n)P%=IJTY?R1R?@)q)<l7T3%A9X9Tzqpm^0{pCRQ2#yf=l6%F`aC)0E
z<g#^)2EOF`a?X42*1WSdji$qj4r1h$r?VX|C7;S~Avmt)k3!Ms6qbq?ArV0bEmf_R
z1NzlZz2d!o>_-K?i+vsASEiwa5pu1C_Ui<XGD>0E<SE3`jKg#Rht+-gT~!s>Xjy{&
z1<o16gBJ8(&!L2Em`~ejuIF||xpRp!a6&=~+RQaRZO?{+weVXHmHF5Ie!puL`LI(=
zwXy8}YsHry>}QoG;bs;$ux*$KZgvPEQgP*MiUxU2A4af)1C6kQ#mkFiAVY_ns4_RL
zr69Al_n#01`emRC8Ps0nJJ;+nz5d@XU2vmh1TzWspJQy3gt&tx!a#)gX1~yiPbYO>
z_cSHg{5z>@K^l4R711A8??Yu4kLG=U?o#V0T^GUK-d=<kEIAZOD6d{M&C+4u)YMye
zD(l{@%0gG^>h=L!=XrgLl~OeI!}kA9xf!IAMe8(dFP{=DF%q7{O`7-9>XFgV(gq42
z9lgBs!XluHlOZR7xqtWF*HkhlMo5op6QN!sx1#pfBT45jpb<x`fOZCXOvZyvwa4E#
zI(gIdm{cBfsUAxLK%0>+4}hsEsx8K83?dtMzv&ka5YMV{<bF;WggHpD!&Ka#sZr7a
zPJ2JmQ_p@Ylck&^--vs_KkAekUnRB|!skROt4$`<_xtT!FZe4><mB$irA;b~xrjtw
z$tIBxQEI?e^0(aj)}l%21=&fgw4!;-_RNLz8q11j8olYfa#cSpsMP!)7C?Vg<taxJ
zxq9BwAu7?d;?ArYZY1|l`^}61A_Rv(Ad0RI|Hhb-S|<hPIyFHaEJBCq^~YJW2N|sR
z(jp(p-g8^LWDZ^lnXC1Q3RX`Qp)NcMSXaBsn0z@?bP;B^faYN1sGYS%Oz8&b%4|0u
zQYg2to|aQ_A+*Gmtlon4gpk-ygpauXbUCCYcvrjB{5hhss)Nq>+Z<!;1>f&iBKmI0
zT{62guNVZCz}4YjmfA5`S7O@4)|1Lu^jiy5mCDlEK8sY${Nfu=Ah1x=+<)|99O`M%
zhsSXh&2-fA{)s$;w+q>3UM)J<w@G~XnJL+wKzdpC)V!>{#O#72=3X=~6{cdtp%r#-
zh>;J(=h;LBefjY^m#-Wx?D+x2A*d~wd%I41x9-`CId35T3(kgWGSrfEMmH8H+jFex
zm3iM&c~<E8n?RK4V+6pKkH~EIT}J%{fvPdHp29oMW9}#sLNn5Ul837r(gUdwY$If=
zi-*c8Y=hH*;BQq*CEsN6<Mx#iZIM>O%<eLm(imvxvmR<|A%r@u$D_ic7>wxt;)|h)
zHJg5Bdo!W;_UW{CpCI@C+{^b5V@PThGgKzS_&UCtV`8s?ny%+?e98GV@Nm}u*_=+i
z@zr1PUF|G~YfhJB3EdLOD1FbMIr@vZ66oE7)~l_`O{wO91dJlKq4GRzjLK5}!vBPY
z<FY~8<YE*Bu)J8gMG-QfB0XfDWMfdY!Tw%}sodbjvrk9ZeEgz6>5A{oSeI`5*_c|Y
zLdar?()$1a3(gdgpL>0UI^}IuaD}hqz*IeZ2vX&Xilc^N{Fvv~uUlEUVM`qqCV#+~
zD04a1rPHjuxM^`crJKQZantL<=Q;;jIQlr7cfZa5a-oYW@zTxbFPdFg8SjIFSzeiL
zSFL;(A<vRpriEhvw2NVXHC{^|uM+2?)D2zhM#8%iW^?J=E*h1G_hz**Gr&1Tg)4gA
zNZqz=W~q%z2n9+dNJ&m%%Q=Kj=VmND0QZ%*P1)?j!GQH4Olb;zzNy<X0BWI;UmHP%
zA}n2-OZ_qCQ7g*p6>hU<g*u2gEb1Ir^_2_ZNuo=KG>o_nTa@EUkcTiLnd|~Fo-yGk
zw+*>lA3i?Lm|ogWx*#?T*txb&C0v9N(4BQZC<XjbVT5L^Hf{D&c2$YsJsWnLe7elx
zmV5l@M*P(N9BhSrVg6u9-u)&Ji}c3}nc+_l=M<~pY{Pulq3jr%q@dos$Q=KW=W_vg
zcGOypvite|O1`jht0z>ilb7Rs)br3>I<lti0%*~;!YM)p4BBTULhlysjaAiOVvb6(
zL{6(6vyVVC?#ir~dHjwj+&b>)kM7Nf4divs9ZJ_ZS5uHFcxC(Li~$202CsmDLT(OQ
zEcL<=c}J!*xNTS0Ir06VBcD?9YjMc7W(dQK$K2o!Zo0Q7xJ#rQXMvr$y{=Nr{;=7v
z$G6@eyxQDZXA&H=eL$0LWV)`dl%Vne-FEl}C8m3`Uin9=Im*%^1dQ!u4xvA2K=T);
zYt3JWCEePcu<dLpIfav#?I4Wo4$^w2_rgWwDl_5xq3>69#qGncGHDAZkI#_tUH^b_
zL|01gDG=oYg0zifDd3|#Zv{w3;cBm}OKOgP89yCY<}As!rOi{7*6jDpXPzohdg(GU
zL@RE)^?znqgXk4TQ7I!kOh|*D%S?Y)nyLKU`rbMl*%}+wFVt4gmc;FoaKb0}zCSqb
z`&5(Ee59;sxq8XYYkGC@)|-rnv8DoHRAj2Gz_t0g+(uXP{RfF=LoTb|wsdX7?wN!x
z|KQLwr$Wn-^_V*!TfYDN{kuelw@N(z7}`wk>vYs`6!HuZKXtET^C1u@yjr#XTxpdy
z^d*P42Boe&zk1t-M%%y7Ext!E4uwI5=&BR`Q1a&=>7Ft%O0Lo~v-YEIW2vt<S0if-
zynBeD9q+{S2cHVV#E;S3AY4~u8-+_Z(fdl5f~H`@6rCc{=PTWM8XY!L!cL}xQ!iR_
ztfDt!Uozx^k13(ZP5V?{#!3!D%?~NRhlu8~mxR6gG+O|E#|PcKgSGXY$LvTVh`W2M
zENmMhwix4XgZleG-=>750$44;y1k9yIDPLU?nYle0tTEmi5*G0*7p#1F_@x1g*gnX
zRHYvlX?ba^56c~V0iEVQ@?^5~J5EQeCtbunG|9y;?}jiRG_7BHE(4Y6+Av>Ny!s?*
zD%kxMCD|_LX0!D6a}F{P#y2gqP<}Iy(Y+M(&sdKT)Yx#$@mv3g2rBi5a_rEJ3fN)Z
zG3IDQ58shJ-xsyrejou&Qa=Aq+ZE}ULznnrRKAR3C<)&2{koPB=Yu_##_7sjC@0pe
zYaK}RE$21mw%V=tdj&m8nb}|5a;MbyEphXwP70m}HJd}PM?!o>Y1VIm!QW+D@S+e5
z@!0t~MPe`#2AP#Q-)=C3P9L{nCk$bSnK>BcVYaBG+uXWAVsN?WzCmg7lucdw;NpwW
zo!B0bGgd5W=*r&3O`hm`tMRg{vcqr|7xc=U#&<*UJm`JES`FS`=KSiAvbg225%thT
zR~It60y95XdN_=1sQOb6yfYR!Qrsni?u*b<I$Atx6~WufU?(c-z?ZM`4cDXVL$I_V
z@(P}?n=a%^AUqu%badL4pNHX{d7<p8T$^o`2&e246S?>%Px8I+M&a*3h!f44CPH@%
zV(78S8Xr?dU^^uya`P<#ZhG5*xv!5J$_r?{A*j_1=#5*++H1IAScnV<oxS%b$-^Db
zW}afQkER)~HD%T^;9u9VhY04pfN*&~Ke8wC$fVoLlY<)qh2-44KA%N#!dg1!7fQTy
zP3MxdV2ZfeF1QlD50wg35?ORx->(u;9tinFMDg_s1b%jVpy>`d_3`j(>I0p&ce!6F
zboOT9>Dx{Qq+uibi|6@?x82(LXtZC)MDErY$CVNiN`RE!uU$Z}*I%T`%b>N}vBrrK
zM$dxPrmM!fl?rMH4RnXo0C-2VS|5FPjVn5cG8-_=GSH_!BNRTp(2#XuaPmGOJbcGe
zCnf8LUeDmbtMAKA@kwky3pFS_ja`Pf#AniR6ZQKG^ot_q6oIDqE#?47{Y|*o&(A6%
zTZVljLbE?=y=QYAi?pn>5j8bsQpjiSZxcvgI1?Uf1>bqCUh;fq0Iy;AyaAGQ5<*lm
zg{QC#81#QXu$X7Uljn{4oh^5lBuVxv?o^WcHyufV*Z60K@2g&H?-QoUf5c~Ks$jeC
z9HmyRB1l6#ySe;W!ZjQ1$bk(zd|cX8A;-0Lv@@Sc8;<WdtJ0Om<dZ_ybmGOTd!9ec
zPb*k?$MAqzx*7Es>&BHt5C5C7N(_^9eA@f$v&Tfw59g}|w8d|Cdl`!@j8@Q_5=<f3
zg+56!vMqbvC5y!EcmVmM2JE4I{?jQ-$^Ohu^=C#^njO$6&WmV>0d=dU#nd^9;5j+<
zzCG-l_|{0#R4Lq!Fefi1cYKuI^|kmWCU2$0k$<&-K2<nv`-lo(+1D<%csX<%|7icW
zt@B|)o3WW|Z72O2cJ79X6WOHPg0${|<>6;hKJ4*x)L9<3G;4Tknl)24Ohz$IrQu+E
zrG6>x@c4Sk-{LTF+A(YDUkj*BWcEx@{?2;(Yz|sRCjWdMzq^%j<uW7^S>w^R=+99T
zevvuUhLX9gIje8}N{h|){KIWoMJ=8+jJlqwT++D;I!38qHw|rJ35aN1!N8j4uk3;P
zh(GDjC)fWL@PBt?W`TkGd&6GXXZ``i*KNB4#)JL#fWHP?B+8rNUXDHuD2Q^&1xgpI
zU2+Kc9lK8{;^sI|b{N<9x?hS+lm=U5bybsCk(>3fYNTLj^n1ZSH3&S%c_fJ~LS13k
zKNx<c&zN^`F(e{0!d?dhU6`VxO4>kk=wQSjWl7${_OGK7%Q~Z%TX+h2rJcKdvw5wc
z52ZJEJs~n^E|Ds)EhWJEPV-S8h$cPz^yQc;{1&wxT#2%9kRPJBJ;Xne@A`4^I)l~r
zBTnHW5N~(>CM)KLO_tm7)0Ita_lnz8O8w&d;-j7vi?qXno2_lAatl_v4J98?(Y$7=
z<9kZIZM*_)FCN2Tlwri6<H@5O5u9-YZtzfMe=;vvPGQ4(>{QZ&W%b=wAMr9|b=U>E
zBex&Da&)??V&i{&`-=0nHRmXJ=(6FrrrZE0K4m$<M6Vn0%a#}Aw!P}hZ#z`33zOOg
zmp@^v(((OZ00>_+)e1BVy7-F0^c*s;2$}OVCwbs{8gb$M)U(&)>!zhN=S#GGu8!l!
zNiQ<o^AkPg#Et1mrzdA6rIy8TJ*Vbql(f&_@jBCy3=NGfE!MVrhslCsy%E#;+e)se
z>_=?ws=u8JY1Oj1=Wp^|055Gnjm>Oa3%89)yaJ=dqneY;891}cl!`pGHQ2a$kouwi
zXC~8++ca!8KIHkd&5^U4Zl5n7UGo0ZuCD4>WjLCdm6k=<z1Mg&9_qYxYtwWoV3N7b
z-$T+!R#*9Ni)PJ8*m?_EuZ*aa2w5hId{<-Aj83>sMFqSSP@e(C@wwIZG}eH5(7j}J
zCMxm*iu)RBb2QXS=_Dz=zciI1DPO4dsBZpFrQbY>41d$mkxbL=TC;ph|4=96POzBl
z`>bt5%b;O8k@?dT|3#1$P;8$&3h*k40Fq$(^t!p}1-i0}LQ={&?j-zVcbN|C-+wuu
zyuEX$p`EgxwpXD_X}#M=O>>?oZi;2vlcT@Zu+@0~^2cnz7_x6{?hn24hrU|Lt#L;H
zM*--1RUl-&PiVMoWpPw9IR4OLX)CNb3$cga`r;NM+PQ@RE;#n4w~{<aI;HG$dlfV#
zGU}B(UU-!D;B7LznCkdI-d(h>t4vl&K1xLXuqKeBC2ODF$-;jbT1?zk;oivhy5Xii
zFKB<)w4!o0|GcI^u$E2+-{1-pt=Qr^RrA2zmY`>M&6=>6H?J*>x)k5G(5-VQrJQni
zsuz43Ic8vkzu{iIjyv_PMf)rDTOitQBPV*I9-}IW!w-%IF)tQ!E^n2TrPFI<C30pf
z138jtfL!!C{m6O0I-a>cTXR6hEYXOIu28Ey=d<(8=e)>$OU$1$mcn;7b&cpx1?<)9
zS+=TB>qJY^-jcnFYYUm-#81&~cx!Me!r7p-(1ko5x333{iAoYUa5=|lf^4OCv}vNw
ziNSMyiC+Wk0w#UdkMGePIZ!I!eS8blyd!CSBG>_x+|SiUK(~%oTu%WqPJk=Izv;6#
zkNnAqvsZj8<m3J4dU}V3Ifw5(x>MVDg?5UTcWrswfasNIE$qa0iixW$oL0PZO*H9+
znYWe^wOl1yZj4%;u*rvVEFc4Zg>o6M=OfCrm8aPz%<jlEJHz7l&XGXh=KTw!6;j=h
zRdm#?YWE~h8oYAVe=S5i0ZwH0Xb5P@N2JW;|Ke5zy81=cIw<k7g!&8z+LrAP&rAm1
zW;LB2=N<ced`o?4CrQ;5W3O<?@Q-Soy0}y@Zzzqv>2)~E3&#TccL;*PgY-nl!93dn
z1M%}`Fyi`pD`|6uUrp^o&Xqry=MOYyUhjP6aOLpk*m2H!f~^d6%~unC=(N^L6mHUC
z>YUg8BEPfjzP+$2b%s%**<|3<*rdt0b2SkF&ns!Rp(i(aXZ&XnA&fCl_KVPN?NL~<
z9RcsB^!9gc2CIDW3Y=d||K4SI#*%+GzUOtU#v7)5(ak#>`pnFL{{wST&A)}Y=>5Mi
zmv;c-C)OiIp^5HgVQSB(2!1d5B_s^U<+E6`8-Y{SxF9VavO^nNn?uQ3Zx}R89`TLt
zW<F=64Cs3-0?(@GtYz!`rq2@1qNmPt##rg%KLDm&n4e0LGU5rtyjAo6-4Guj8_F&#
z!6UIkVcoJlSLpgPOA5K?*MiwD`yh*!dGK3xGV=X>m*(mbvCdHua2C6}JX?sj!w{!J
z^ry4>nsXg_k0;a$I~Z1(YEJ5G(_yhYJ)t!pt0iltsX3x2-)6R+CD1uUsrBh8{d?%&
zePFLn%;pB7YaShqQe01I-=dlGMxG0$ED8ToOrMD{2a`YpqWidN*S*so)2NOXYa_le
z_ALG4D=qhZ|G6oEW~dKjWo>i*7^4eqAQb)J=0)bwc&2lZnw7J#dLFy3a$>dK%i~fk
zLAJh@TUO&mtmx&~SLl(5reF&`1<rAK;`rrvDSU7$Bh3D{5VUP-n)R_WL+I=nA46!{
ze8fNvfrr!)@f#NG<L_);KHzsG>I!tk&4>#Xo$nBc$TQn!$KiF@<9Q91@}`ZUK!fHn
zpHN;;nYwvTIi3lqEM-G~ih^>%z4F$z;mRyos3Tf^inSb<jDOli<J?<g4uaTWFC9Y`
zjx&`V2+MM+2Y8lc4epl_yi$1B_kv0}BzN+!ZI-Qp`WVT%_W0WXLB6f+?pJAA-nJ7~
zsn7n!Bg|j7Lh26o?q{uBHsBS{3ed<+@6syg*~Te*^k>P<9s^EA#`r|p1Y4~|G1rwv
zg2se&30IsX0~4HdI-D$R2tlE(?1n4&TG_)E!siT0COH|WXRjR(<86|3TU~6VWN$Hg
z)CDj;@iCe7;}rRT{V2dTc}w^xVqp3x;zO?a&4#@39R-C`8O;x()w_>*HTaHIMD521
zoW`T`xD`Wn?}m7G{0|c+RB)mbm`S&#F_QPhfzTwhj^s(y6N9U^l9Ct&Vev~IP;5v0
z2UoT<SCzh-ALp0BLkwIrHuP+9r3yvt<JZOxVb>NsanhWP!C&~gmj)wDNFCJ<XxzAS
zkybS@^vno{Rbj<K!TV<G?F#-yPMxtm3G1zCl%F4)u9?KvKjd_Ma|v-4s+0R%#{QM!
z3qNJgX!ki+R=jl-knZ@>lf^S$pTd6`Tz8nM?d4y&<cf$|aBu1!D{bkpC^1~k09cF^
z2~sagJQD+F)RC?7`#irwsHe*mp~M#`hU;#G0g>w~0huAC2T}_+@IKXCn+h97dk@CP
zDXNUca(yrFen9RSf+0OyrtXg09vlv%1p(cpzPI{JI_l(9$r1FVdC>x`H0sY2r|hWY
z<G?E)vq!^zr7_P_f@y5}5}qfkiFL|S{Mrl9^QklzVUH}x-o8D@QOoyk5CsY4<}7LA
z!c;6$bQczAFe=^hA$|$1$jXUq2W2=HK`xyzZb03wrINJjroa365iqzr1{^V%C%Y0f
zJb<rD2@y~@?FL@L_B<aghpeF6D8Cx@sfG@}q3_8j&whF8_*<~!z&eq<^WMUxmuqid
zMv1Vj?YE|*3DxC?4U5Z}POKnT-U_x((*+<<CUFXM-}9a2r(nAB$5`+}7?o1r(*pTi
z*{&CTPt6=@Q0i=F@=)A$U3v(@-b<?+2Wy?PVy$j_yOF(hw#Yx{bX8eUYBy|#$n3Fo
z@az=_8#}10bkkQ$?#tY#{4RtEELHw2b@_6*n~(QbD)+@3XkEnGJc32t6{J**eB%r@
zdn<>g(etpo0H*d=UPR0C)gv~|nvIP{EiD-r7Ua51Qv#b4>z5M1jRj<rM&D>C$BSU^
z1F6KdG`xRwX%Pc)>i?Hkgq4Wt470c+R+aq!#T9**sbLTxOk;XQAex~`ut_qgrrU!m
z(`@)f7<%uW@#KeD1BEb^a6+;#z$6|?hTBk7C(++j`qwV1)>Wu<zhmqrtEGA(W89tc
z`VNiP;5ts~WWJLFn0|8FwF#xY)DB4rQmU3d(alr+laL(X&dsNbuEqIch6V#&C2=@Z
z5tOxVw*F_1U_S%kW5Ry@(-14rIfpgysdPW>P(&PDDNJaOy7vM=o?6_eKBJqeAgImU
zGMhb#lH|XB-Wv<<d3Oy6lEabA(QI_o-LtP}Jt@$%VeO;d(wo_Y`d7%VuA4RiEa4U%
zPbqxK+kX-K1+?dR093jQeu4zB2_sE2*D-Ejh0uX|2?yjr(2645xYg1I_;T;2?!W>R
zvK~zdUhv|nv^%gK?GC1aq=7;RJ)oaf&F0T;SJBaeK7~zSmvvH5_?|RIIULiTNx%6$
z4JdFg>EU>NeT^-9q5`I(s|{?i2W-ET=Ha1vxQ#zjwGMG1-v9Jy)l+`)VC6#j`rDrG
zgf32C|90qev%hl2Dg_78*4NkLn`e|fd?7cDNTsH;@QOArg|kTfU&p(|?MJ0aMpqwV
z&Uz4RZl+h`vpyC#e0Y^-zS;^o4A_gvVq{Y6d4#&sg^(17yT_M|sw7MA;eI*!nwGkJ
zc;39ZwZg^m$)~<nF%XF3q5vKNL&9X}=e}GsUA^WMOI!{I-Mqh=@Gu3zBT{<VvQFbl
z+P0gHZCO#BV1r{lORW2z$FbMZWl5V0Xnb*Dn>ZUm;zU#9Gs8SKZP;Q}hPM_P22LU~
zGo<rm?#Fp>H*mShIQE*r-SzMs3|4i&&07^;3(&7)&yw0sTpXo%PhP}VBnWspeY)lS
zR1>(ALOEvSj+x05SN*`wZ(h#E&|3Ijzb(>i_)GF@Eguu|gZN||XwIFL@!&==Jim^~
zbL-X1=*d^bTA{QZhHBD}oayd@P_JZd22n7Y4HTh>a4Mbf=0>E)K>e#wAgFv~|DlHN
zM!p{H%n#CPz*|}S>Bloa_<qkILmHo`_K-U3|6UHzj60@(Bv;kya!4`{YphKb0!v6G
zrW7i^A`tsZaKA+k>SJK~a_(|;6Y~5e<*Uj1Y)i5-)e3tp0fL5fj(~=rp_YuVlqX+U
zvx1c`gc}=Wed>Eq?Rl4~B2#D86u_N`K+~g>V=9KGxg2(eJ@g+7@Es8(pznn5*T?XH
zw|#s{lTkIXO4SpizgsS=ZzW+U+M^Y>AG(1s>dVGL{i9F*V28%=*@q9n5yBy!w?!}*
zWCix8yvke-ct#r6Ihq5}V*I_Vwr_H^wY_|w<2)W7)u(u)n?qo%j2)E!KzrU*N#=)d
zg-6wlUibZ{-nuj=!k_RiYoq!s@$${*TMycgTaFU+v@jDM)Jf785d!FNzgtNjExUcI
z1nQ!%XWJzJBdo4{JAc6L`vYmvU<->hY%d?)GT<YcTnRT~Np+s38n}MrA6Wstl)h2b
zT@Be?ub|Y0VC09LuT3$Censfk4t(F%KcD=4ap21DdFL13wHR~D^Z15XNo0NnJg9rI
zPbbl~xc_XikQ{d9g2O^sUDk9gNB0yrZ^nFJ?ft^n$LhmX^??B=l(>P7z8jkDo7EfC
z=Ne^ay}`E)$C))<=liy?GB}RYTKuk^q1n;JQOzMvS+lQ7t!0j)<+i3ZWd8V&#<J2U
zf9wVqwB&p~oDS{plTS=rMcC|<xOLr5;*;8Pj$>wFTzMC>s18ef)6&Y-{>Vqou5{(&
zC>c2QYsKFE3dmXliu?-o5jY^GB>Lh#ubkjvEvPntHY};@n1>Yf>1uwUJ^2tLL>qKF
zhq;UWj*j%W{G6cff0<;nQU_e{N+q#QNqDpWex>rFUZpQ<^)9sgO?y^0XmNRFXruI1
zM#9&&nfkvq&m6SO%_=?U=1goRW_rr3*7cRf>%aB9TiU}s#Mh<6n?EBJrST-gKBZ!f
zvrs`|%EZiPuF3{_>q%75=y3(*pX56z`Xpc56q1A`2aBvIMuq?e*OyL(WM5{+%h)Lc
zhD>7qz5u*PjmIa4vDgR9ZD>}#@9oetljDc#_!&)Nr8^y~NobTAVyUD%21-&s0dy=7
z$s4Two0^P+Pr@{E1NecU$;L#R_o6^LhRBax&+f%>61|CjN>$EJm3TC1^o0b}a8l5t
z`r@Ghi>;3<iHhexA{urvPa?4fUd6K=T50*KY|7BGn98%L=9%Y;SHJBrN9w9B&z?|P
zi8BD|BDtI3Lgk+IV$bJBj?A;4YSU1XMZPOXl(oe2@BxqiO6%Ci&7|)NoskG9Xzr#o
zeYu~&Vl)BGH^`3<VLva87ZJ4-ToCw`y=hW-<GVIR{l5UxKrO${;+Aeg^FW4wRT%(j
zD`Qs=uj><ABM0bZ-TqW;YTa0@SQ$qY%$Xw|herQl#*ai`=WMiS{~S6|a5g8-Q$CV3
zim-meR{p`JlsC7V_T5eP%*?ER_>EWp`w2KBk=cokGJX_ky>8wQ_x^D67QNErTt8~_
z3agC^>t?iM?1y+TTshc8O+VLeEXIw^%>lP@<6U8a<7Rw!B^dcyU1TNkjQ{Ym@%}qX
z${NtLTY#Oqj3YYMp^o}g86R-q;zX_*c+-J%f(IM><NC0wtZBz%ov3ls=LuUA`%X&U
zVqmT8g;n}~yCs~j7`GR#xg1Aq)ERQKPQX0Jc)<F0j&tg59;++Re&EYGmA5tLZFhQ|
zR>X#LcBESjk+XmQgLZGBPFYb#^LO=HfHu=_i?OHq0mcP<0EZrWNcj9|r*QV#tL)-I
zLe5_~ep47}6eQ-7qc;9ZYJdzTxGF=;1)T0e1xYhO65vGuj^h|OX$?=JQ(guV4!kK7
z9r-*ISHmf>2*fxgBu%;K!I41VqP3(4l@U`$P{mTmaEhl<PQ1Yvu5>|uS~>WZ$p_wq
zwQ7NE0++LnM%IMx7I2gC$9k9S)}6vi4P6dCJ?Ofvjn6{%HDu>Ok2U0!Z<=<T>`y0n
zilcNtxS~-kJ(W*mU%I=_DYSaJAH8J1>fEbfGM&W=3{j0Lg8Ihk$2LXgy&U!NA=>6&
z96z=lVaA+5{;*YKG(;X9vf+j1A7;$)yJU{w**Tl4OdLCg!^~#Z);R)Y-gf<PC!A^s
zspBPm<6AEuufRrH?H0JecB+2&^taW{7luA|lJFlpvXLeSQZRYJk0#>Bfpzi0Ixa1v
zp1o8*z>Xj}@>zd1d6nv+(I@`x$+mmB^#Qsb=uL6W7U1}rV_)`>nz^nHcDLPhX*lHr
z&tDytDb^xeAoyAbha2Ohy(P!-R(=dbzJSO^p6m^}A{*tMJX_BRmdBH}z{?eD617^u
z8o|u0xjI<W)(~idtdDU9$G6^+^QviZH3eEYyN+kkJ>!c^KKSfM1L7F2QC>}IH*6--
z0<=pmT2(f7cGA-tIRE+y5xbN|K>Uw#*5aQe;D4kXxPtJBDaU^azWk`b$)|YuIw@D@
zqg-jhkq-@U!Qh|fE!)OdJW_q3^&p3?@*qnoAwh_8f)l68$|weQI5D)~Q6@g{ma>-g
z03QrTOpvmqC6}0=l%OTRS4I_2WRTXC$~5rk!$Akz2W5^w-US_WQ0s#@C!hQohn@WC
zPmf-SMnYqO8ZAIaOFLvw){fkw!1={4U^zL7eNhbK2@7aFfoj!bC9hakyEU}f@^)u!
zjxQe5kk{F6O#c$K-T|z`y6{c{Ip2jkzhtj-+sExp?kqc$=d$U``-7&(gm8kB?|a8X
z2GWkcz80EW-8+#6GWNs}@pFfDH%$YD{xK<Px_YKtJYU#8nq%Elud?>i@zS4t%8vK=
zR4=s3<*B2nwL6P*kJIz>wSKS6wn3aQ3*2z^55tH4_MsD|)i~6lx9O2h^Q9j7#vy-Y
zWcV1vK*&63DzF}LC$Nu+*}9l9Xb|<B`5=T1&1$f~I&<De$8BA;@mV{zRcl*pqNJ^6
z(7J>;A6h&=gfQ>P0qtu=8zNX4^W4~k#sa-9ph2*AdvT23XuU<Y{Ezr8;mAbBPTkZ8
z$zqK>lO8ydtVz&79-w8Hu_i;GCSp;(VHQ5}qmqUfe6%1;<%0(g@KQQxfEV?FR(vek
z+TrUN`y=HcE;0~PVg-c45L|-N2nI%8m9=DB9_58ExhZdWKwGRtild5yCwau=o&TuE
z7CD0D1itXX3q!mv3I`o@pgD<OXsX1}IE7`26^hjuytVqD6;fo1#9D7FE?NBn)~X<L
z`i=+BgKXHG;p%h=k|jlF$%zb;pkEz2_yDP!gQc?vl8H3>5K8%DR-qf~$A_G)l>_r5
z8w?m1(gmU%xxNI8+6CJQk$)h@7VsRUKv=NO!B?Suww>|2RiEIA;zT{$6{@3sw{u+i
zT<<z9x5LV7Jsu78+smXjbB!0AEo^&~e3z8>S<C6IilU`x(shm?8n0Q*@+2PL*tIhj
z*{uZ#$FLicA5=kVLSunxuz(tCr+6Cb(7%q<*5?Egwifn{5t(z1AE4rtSeO_~#KgWX
z+m#?Rpsp6sysR<4EAo^SsxBOL#0H1jW}@U7ftDHHpy@ON4sR^#5#=oUe5W@`{dhO}
z4E=<~V>96mZ|qge!B<SQ)^XM_6@~)jeaN>Me<pc+mOSj~NCyq#DhG$o%kdFDOIR$v
ziseJKA}<r1So~ywR6h97av_gcc&Wb?`Q+O|d_rx3AV#1rF_IDpmH^T)1&6ddU@ay9
zqpTPN7Y|}C0{EoiMF3a4RWZuA#3$81O;he+l;a7`;J3c@tuBY1z?~ev$G_-B?ij{7
z{Em0LBV2gFg_(9u)L3A$EkMW5hpJ3f^(l2!pSW%EUgUgWBS^pIu0`2o*K&1f$9?hp
zwz{e{SZy*x_)b6;p|k8tu!)90qYU&1Thz{2?7JXL9x+Z~`UJ1d*|OI(SiN_Ou^<gT
zUTDxr3#L4+@vw6>%(+-JMrY(zQPR5g*$pq=_erw{bC+43A8OXQZZ<yn19$oDXw@&4
z7pqrJ)d8B>0-io5*aujnLy579w;D{B?6?^mO!*4A1G@&?SYR?NK(9!9MlnAbTGpjS
zUejzs;76uKJC=qwNCp}Io3-<BcSiGa?NiOj7+0?^b3&avguQ24y@+Y6tX(~*uGLkm
zhMDnoS-dsJ`WX31y}YdUn^#S}25VX@P+W<PTyGv6=^S(we2zGM2}S>Bgtq_9I+go5
z<&1?NmB9b0%77;sz~sn9W>LQQAYaE+Knq@{ARd%^mltBuX^U_n6AM|2$T3Tqlov0-
zz~v%<qdes(O&*2i0G1Av0|y5>V(|n=aME1jt5`5-biH7oha9s0h8u4(Q2pUu?|PT-
z27d2*-y6Pl=9#$w9K}z1(v!Umpzj#I=)$nmPCNOr5*J$f=9_NL@#{=%m`%^Du9NdB
z<3+3SkS7Fa;(`U#!I;D2`Dcb;J(S;gwRrHI54>l@1nv`i_E1~k)nvzG0UjpuYdj(+
zLW&$I%aoz<THB<(dVBU)?nsR=m`o-zE|+9^U-ZfujXqvFLLDZEwcDNhutoz_Uv{k#
zTP(Zl%K(#M2&OM}$-JrNiOxFKQXR>0B}|s(*YSYNScPbG%atSDgvJ7sZUJw!rX(#m
z>0GfzPrCBU^`md9pJufp8)tf}A#=Jp)BFQ*nKL-nyZZ=1sq=wXes!l=u3Q7@WP#+C
zbwcS0pOm}7_b}GY#*GC%mF|H+kECAyF=Shp`uf@0Fzr`8w+D+_is?6m_{^f%&K9<R
zt{-KN(fnyFKwHsOzco6w`(1X~Ib3?l#rQx!YZo#8N?niv6FG451kwcgGjZI~oWUhl
zIdE`@@n;g?A%CXIMI%|_qrAEbe3d4K4*|H+#G=cAASp-zA&D?$PFe~}py=Qu8p^of
zMLBe&p%p%r1TOx-DVKc7QMna4uHaqeXX6YswFY+m5>7t(<b203u#^7lB;Pg6ZeY^F
zV^=V^1f4bPndZ;fE#Qq(t!wPkr%RwOq_Pz%FR;2pm>mx+dgpETgI(?nZtG}`ai{Ap
zuP$vhA+*&>?UUEh>_N>x@TOf5ZHP5ykeOZn3Y^KKXRzp<vqgQ}Eo{>mUlnh{s<uFU
z&`Exzu{PijU!{$8^_hZppI*K!%;ps{1f60cD(zZWpY`2+wkwyoN=WNQdZ3Vv6>UGV
zvLo2wJh1a29(GW%iy71=G!~d_3#7dQO_k?SZh8Y_M1J`=&b-c<-<!hx!bXo-W5~%B
zv3u0l7#8P<9u!S+MGLg-T9Kdwnp$s%;<14F_}V(32YjX)UM6#$ap8wYf3~xX|ERG7
z6O7M$ys6`|<NC;tO)}lIKB%eI!`rRlu!0s~{-D*4GIZ_jC{V@!h=Md(n5~HaGm($Z
zG8_+_q>0-WxWy+?RnqXh5)cv84|NyBoR~6Q%1a3Rpb=l;iH{YzQj}9BJm4}SY03zq
zt1N#M&lx%bf@31m;~#WhFvmi?@)fW2oxy^kd~^zb#?BT#D6osT2`g*?Z%zDBvsz(&
zCP=(GDqYWaH5$OrMYY#^IFB{|Ix-!sc;(%7f-2OgQr!Z&`HHJkP7da>Hkqkra6jYP
z+przmFlwi8CYD8R`jIG(kC?UNBi7sH3;b2uXVip<S7{ZqJ3MF<cYmgKDy9eJ+|Uhf
z0e?8<M^AUi+H#YJ)btvhbtTFuKN~ar0ofMHHfH$lFm`e^ovD%?8>C6GKyi(&b$1$1
zh_34AZR%t@6>a?>2P1uS-hMRNv}ryb0aalwQ5@TqZxhvIMrHx*J<TDuJ;wj~f_QmP
zv^LE;mA1VSLGx~OQ^(`h;t!#wC2RU7G#2Q~0-9f{5mjvURsE0YsRk%O1LjJ_;Da5R
z|1*;%ziOHMwoX-a2uo37%0Q;_$_pj|%BviFoWT+-!%?2{B9F1OJJ^yQfa`)c7yN)J
z51)SI8~SKMdS);VUXF%Hox~Sjc+oP!qG@&sFEh>90p3W}+Qu$@as@_TT66@{=@xOG
z*`k+^WaW-vgZtuyxa2ZW6Q<Mxakl_F2I9qip0-eIlUhthIPMg70n(;7`VSqWtRIV9
zzi=>FUy>7=A6n+tuMZp6Z!l+%y#km|YopX=e7t>p;B|LhQ`nA1Z7m;bWuH#*^mV_U
zX4ABr#@<IKq>aP}Z!<g($P1fntgy?LtCs6oHxSZ#k?uFdF_$sQb{^Wi>u=<kF2HB)
z?SdIQTX@ON8upJ<_RGA%Z!9oY3(y1f7%9PeG*m43<ir|wnWt@NwmI7BVPD5&4ZO+L
z4eSP9v^7M_c?N~9@_OWRVR5XVka4eE>(v3x*CV>IQ&=rNBp26-^;81CFF!PTv-P<y
z{<xtzs~#!U42?{82%`tz*swQI{mnXq&)R$!cME44p?DJ-3-qu+eD1QgQlY)*M~Jw3
z>&Tb}*pL5F6CZR+(|E__|CCHBq%`uWgM6!$c|fT&Kp;fm_=6w@E@qbW;e#?50w?I)
z3+P1$?RvY!7o+F`Ci&pWVBnMI5-)HiN4zA1JZa=_uuC-1v#GK6z^-4MziD9i?>jDd
zM-IY4e9%D$=J_;Hq)p43bYp>)w16Ij>5Tp`%CE(CHKDP<YP0|ghWYtTwo`Y#J6lFw
zM<%2td!Quv0+-kvJW-FhV>vEN9HsfwSfH`M3R=LIkNl8h56w#pOMYy_N~nVq%6A8w
z<A~!Ue7S66iSJ-u356P&jRjV#1?Xe$1m*`9`WTKW9KWoEv&UC+3^$>%z_=~IM@IdJ
z(-8>90n0qYrUh^R?kKkQz5+j1(7P7wxF&iV>tlYA@$>Z2Wg#B>HUbkgEE@~-vVfc+
z@;NGx|B-<Ik>;z-uJ}0bw+nm%Wu$os1eYKl#Ng{gVBmoRFS-Kd#Dp^W!WXXiK~I^2
z%7LK|mj^jyl@|hekYK0^07E${0z+c(!2vFT@o6{W2w!rF{K(?~7Ozh7!9gZ`q&zg_
z;X%xm>IJXaQH^C~yMIld2b{rged}92&G8Xsfny_@Fc}u0(dZW>&S+X|fhzlC>t=|H
zg47Aj;$Wpid<d?lMXGx>iUupSfOfEAbMCy~{~m3C2PgHRl-H!By#<%n!SuF;=lrGx
zJHlZzce=zGM$=5aHE=!5R=)5yM-xXz5I8;pJ8!aY)>7uv+L*f?@=HzR8a97c$^zZ)
z3lDLtCFC{98e!i28CzB;<l~0vK$<i2<9WU;ZCi^`&vf~d)*!D}7yPm!AD8K)jLQ~t
z2Du;O#13NgV+Ugs8VgLN1$c}j&^z=f>44Gwq0eMvP3$>~KL4>Jm>*@ChjB`=9>{x^
zJA(6EsczlI>r#RSI93ak-JgEu(fsabZ6_bkM>J0%k7pVjqwMC*<<(%dxI5T5n(q9#
z$l2Fn#(wxP-h5b&ux?$pSt6^i1IP3SJ?Mu%+hz`G9U;MYKs@AnMSZ)g#@JG)1-naY
zN+;g}eQv-}_ouPZnB;8bL5_6V2x+#!6f?<D?%m5`@+z~W^P@~Mh`|Skv}9N^_nAr$
zbOA^DfCF7huSu3NLXoEnh()cx5UJNdz(oMA3OFFkOG))IDNmjY8hD5=&Rqg9<Nyax
za;SiI`iiH49FNM1Ua-w90S$V<L$M`C*Yi8={za&cgWw$DvVb$WaR`@Lrh$#q0^UJ+
z7mjXX3j&>S>dw7P5iOX<saKh-bRZ}zPhlEJQdpB7&H}ycKixLBC4p67-W)4T9==E(
z&Ro5zO&~U-&uOPHI{^KcPg~&nYwG!w*qdF0(O96dz<4asdQi6IYyL1g2HDw|VNdP8
zayHknzshc&VSmN8wS*pnE{%xB0#j~*=opME8~$?q3Oj)p=x4s5Q9R`pZPZ^C78uF8
zG+)@$_SpgN4d3mh6pms$JT5v@#yQ_*cMUyo3a_(H88@l$qbT04*{JiXxVudyro;mH
zEEQ;)JTl&A7iq54!RymX2FFK9;1Q2BxCHq>i3ya!gCLmF<mEFJ4EeT=$l;PNo~eBC
zl7Cb<g2T@%<B8;tm<SQ&NT-Tu7!fY9DngtJwXBaN(1Qmr6emwi9wW&Jg2RV2&SCK2
zsQ@1?;TGkKMs*NfEpe|SA8__^mT;%g&6(VZrh$*g0yHE74Q}-Xb~#xM?Y~d&Ho5Z}
zoG%1e0sBHY)_hVN!Gqj`x^zz+<LFVww}>-{zLQEr-DnN;iL$z<dV9ag7K>AB6WblJ
zFmH=uc4F`)XP;iYW@%OHOPhUpJx{woury9#O?2!|qJI`gqh9x7Pz6_Dtv{%$4P9n|
z<!xd0I59N#;B<{6k@b)`J+1Klj}OlF$(#HEb%`g`ilJDAenuFdrftbQW3R4r@45V=
zuQ-JnFYKXyLX1?=8Vy=wfz$%@4j%ow1^QY)y{4TPls;~<6H;?9BMhC(<97VAT%0S*
zb%<qUR1K`Lz<?HDtoI$V1JW1BXzTghVP%U;99PDEyX7tue@0}^F&E8@{b&;VPI=oe
zh^Z}0&*V9k`QLX*XZAoBoW+z^3(M=*nQpjorZeBBq<;%|3#d${vAi-te~3PX7zr^A
zikQwrkl!-xOqA1@z~#~eN2P=hj?%>7QO@I_;J^sr>H?=oE1xZ81mTjF4!|fE4rTeX
zr)TVs5I`mnOEK~Y5)OIFv}0EeUByxYeDE+xoA3-~kyn^9JqrUPNWNlZrTj2dFZuAP
zJ#^dQ+i7R8l<4I!7G4uK7O2w#OrAcOXT6YzN1sf6AzY`VmF4Ai98!fip%j?dC}bAQ
zfu%Tk=_*L5U0A#66=d`2wn=;_T(Gl3gMGYX9Up#4?sqR63{sB0xMJTl2b0;FbK=au
z6J{1z?Ak(|*Z7j)ccb?$Nhq4+YPCSIYpTnxmilH>l~pHe@M`xfSkb5g=Zf0#5%z-(
zA9$PT!y!D}y)lc#{}wY&Wlm{RiVyE_>f(|;+&7`IKx2WH1-#EDgC%qBqRp-R&=lw3
z7H-v4!mcVwgV$J~Zwt_NXKaIlrog@#bR)<baoiMS>r8~TCf$sZJ_6i+K(YD8-J~nf
z_+14yNZ2ms=oDtXjDwhOaPZ?!iR#_z-juCk3yiEW&<y1h<-yFS7K`zFvhX6N+`FyC
z1m&Sk16>JxcKCurNO9mHS(J&lV8rs7QU)zCL3)t}PrOpNe6o~#08kbn5@Uo2Pl}KS
zhfC$DaWIT31|QJ_lW=IYa-}@QN#%pDvcBc}KxPc;3@4v_va>t>MK3C4>mQV}bA-!6
zCz>+cL14bXG1L2khec0KS6nn{@r0CB8hln^CvAI=n%3H?9x=ARcH@{laRl?aI`@^z
zMu${%7|Xdgk~-TAUX)cOKN4NKF)h(^S&JyKTa~&LaeP&SE~PRHN>;%skkpY?|F6PJ
z^{awAkvNQ*)<67#(VelQAMIF><6w$A{A|Lrox+?e9M2YJ`lH`?6Is>_C(?$EQY&PE
zRy$F9QM^J5t!lBp&hmb1OIaRP#}#ahic1ydaJx({PHCLN>(<$M<i3I#mokl<#scHC
z0Igk*f(5yBiY(Z4na!EN=r3_j=Qt++q1ETy*pEchDb^UOxS51IS!z1rt@}Dz`un=u
zRANjIOK}}oi-uNVU#DlxeC?UdDV_NHQ@`~g??-%O(dIp$ggOz70&Y6Sk344UWs@<(
z2j@6jnR$;NW^EU9G7Jo%g~l1in&w(r8??stA#P|Lq$r|}$P}aeMEXBXztsOq{k2F%
zcXVzG@-7QV<v=8)gb~v2m_?9`04_!%kcKaL(h|&0USLvCWd_QPihRlm;wiqsNQ<v_
z3+tw&bd-@_WT3A*TzJ8Sfny_%KmLUlUl7PE;P8#`3&T4uc!$6q<0z(#<0MZ0^rzd(
z>dNR0APia4s2Ei%7}CvJfYnupiQvPG!la2ACqkkAmEiU;=~Dr(hfnx6q2`X@xG3nK
z^WYTd;W`b@Vl0&C$^GvZymfR(=|<iv<Gxs~%r@?@Z(%OO@wQpd>L-!Xo|Fz%?wfE#
z)6Qvna*U%3EP7{`!rZJ)XSQQ_l))GN*?qL7t@jaL1vihdExco&wJpP=RH5O$3M>$Z
ztPX=xHqK0QH8mG&oT+t<GpJ$AuKal952dr5R@Prool>d}cQ8e<H1h^$Kk|lwUA|M<
zUhK88%D>Of_~kQ8fvm|k7MN-aq&;SNPtn*wN!&STj$q$GXuZMuO0RWYnQ3ZU>y<HY
zU@L9`wHfA<v~{hdV$y?lysqZ;C-r5%BKX?V`bD<<bXfVHXd7SKdpDw27$1;(JS&y+
z8vvTg!6`h$g=iOVJD1rhY)2_AW=FxGC-dUqVHn!Mr8blkZ2|coW9Ny@kA@<+{GU9m
zZM2I#JAl0#CowPu(L<B+p<Hs51~<inuY9HdKYQ=4EX$Il=dIg5Jv5`*0~rQo&e-4;
z+Kd8Kn(;uO0LbizXoxuaJOYG)1~kklkUEABKnk1&$QJ-?AVQdP_PX%@+~d!R%2k)F
zs>rOYTH$-=ikpYKhsWJ3G7=o~C*B8cO~005=Vr2I1~G>rzykpuhvgl{OBe$_4NTaK
zVP-!xF%T05z_T(i+!|a+!r+2e^Ebbm4!8&T8yUowFq{(p>8A$_y@oIl%UH~Z<7!A_
z@J|snmoXUPgJI$L=w6F=)Ni^6UHBiRbVCS5hcv=lg6K5*6N^{`S2-{O`=fDD7EP=d
zmy5~y)aRBIxumRRp)+O~3)Nc3BZR2KI(?sil<(Z2`~Rf;`()V_KZ)S7NHGb;NqSC2
zc>0-F2K1Xh*d#yd|3xQ-d1C3U(+?fG2F}vJc(^``NYAuS1JQ5e)YLL#MaZG?B8^^l
zb%lk-j65mKRTh1`*jHaY{ysE73+I;cTvjMVpHM&K6!5D~1HW?Z(r^gkaG8_F=Vk5X
zi{-<7durFfXAR_TnzzM<eb#5Bvtr_~ff_p|-p#ivP9v3j0iD!kZLB`GG<bbJ^liz&
z31JMwd8I_3`<AYgTjEFiIiuA&ix+tZ?T=z{uKg2xXijY@rum)29~tU=HWZH!1P`Zi
zg&#mB_aa=vJhh?NLK=@WAD?m_!lvbdkOnTU@kw(Wu6g0-F@Rs=;U~_tD46~74)<#O
z^pF3^U%mY2|MK_5HHH8B_y6_bPydlq!aqIy?svZv_s2LjO#I*ehrbQK8FFg)_rL#N
zAAbAW-#+~O^Un|9%mv?`ewmB(C%QHc*^Nm{Sa-JxQQgwGZUK;!Cno$@7^i`WNwY3P
z?LW6%)N_2$2K}7yoXhWC^VPZ=m$6Q>e+rIqaiiiHSzAG=>qF#f{>S`>=v*_+eT4Ci
zsY!39NtgAsG>>#Ko<h3lnLd`MIr22%R!5#kgiiGiH8AdnIWXLKL1TQ&`N!*zYnBM(
zY#OJy-_Rq-<q}Py<aHPyAM(5$b<8WYthD2UK$pwXDRd27Qv)CIqiDQGQ`Vi5h7<DY
zB=5TapX<>0NY>^@+?cpQD$j1|b12!pmffAB$KIU=E?Fn5dC|g}0kWu3@`f5l&X~U&
z5#O8+etUTR{%c&ra2{z1$>gGS@lf`L^WIUJ#0$Q;MlaaJm4`VmYvq!PJt{><Se*u@
z)b|veO~L-rKl<~B|L_0(PZ(4Gy&f`~0FBItV12OFhGN38`jQLak0vYECx=bPMqt9=
zfNOg4Mi>_$9l&K%TIazwN?yRc!E+vOVry9fd2AteCR`Yh(S*q`4jbRN;5e@ZBuqXF
zNj!cE%KLTB>v-ei+UP590Cd3fLl`_{^l4+lPRBnRa8(2!kn=SWzAA##!9V`^7s1yb
zpW})NP8HYJOUx$Nl?ccEm*UMm9m8g*4A@r^>Fcpoi)V_&035%Zh6dCfX6*@IPtCo=
zUq}No2y>_KtGdz4xABxYj~*CH<Fz;$cb?0ueVh^oxC4=s9UZy`x&}rX@ak_Ay=0Ji
zm*s7oQu4&Bb<k44SS99~^R*IS{3z?Ol&g;$OVvZ?Gmi$+Ft+JW`Q{r2VA?iY!VX;n
zx32*kHMt|VDO7V2eI`!$#(MHRJ~5-PUga*|xWiX56_2K}A0TF<aFn9VdCY@x*YSaT
zJ?Wk_F#Gxj27YL2JcOBeY+%JDjx^%!#{f*4acu{!X()LsoxBF}VK;Rg`2fN-AHt3!
z9;ox;w;ZMwNV|5oAb<>*7-5(r40%k9Fkn0jh-+gm^n64aKZaYvPB$;-1qZs&<S}3T
z#QTyq!sInB`3&SiPSbS!EN*=T1V-W72>cZc!DFQ|F!O{_7{3PRII+qkq43Q?k=aJ>
zHI{%i1BPH^W8=pnnZ}<TApc&Zcaez6{vskh^EEU;yO_GDr2Y7Zouy>;!gmTk457X!
z9b-q`vOVrhp>qxnAKrNV{tt0|!-wv4iw{^pXr?hO7Pu_5Rmx|5Wty;!!mqE~52}=l
z?npaF3q8-hXn^V1bDGP<eYCd-8>uzcc~F?CUry4G?(bFC)wr9dyC&s1fV3%JBDsjW
zvM^3?N-_-6jFGIrc<or@$a|caBA1u$yD0Ryu7N9SKn<Rgz{B{YHcXpm&W|5UnHS>&
zSKdBa-f`IR``uiB>`%X~l+;senREOZk3y}v+!noI44!MA5rapq`-VPnp?au2WUlvd
z%oD^Ce@X3X#!<h7M!Bv*^fnVQf%%}8o4L<MBlx2`u1|W`-NLb+*8RdA?o|Vuz2S@{
zWFZC6%&=q9foOttGo(9VfAk{D_D>og`7sQWzs~0_NStXB2V^Hrm;BH(fAF1G-T?DA
zefZi>KGOqlt3&KF2-gfC1QFr@h#`~-;WsnqBW$Cuyn}JpO27q716&(=i8D>(ASZc<
zhd)MT@Zd)r08hZOK-2UiVa`7`3frBN*Uiz^ARVXO$^d<H@~>FnVKK`lPzEcEW$p+o
z7Q2hqHE@#};4}rs*yk5bJDw3|EJ+%7aw_#}erXhbl+ou`_4VG{XH<VD-8FEL2I5q%
z);+C13N%G1jQdYo0uNV6$SBNym>-KfbPcRp1Dad;!Idf21~J<0$M^5Cmxv!>`;Vck
zuEH+dWg5Ut%T*C`0`pTCN*gg@JqpeEF;es1HNfRJo{~lY06+jqL_t&u?#1Ttthq1N
z(tYl`MwQ$XPZm$uBK;jSIw*18h}HH-`)wQsm(3jc$>W8X;}jKfG+ol{)`I}{Pv@6+
zu*Jd)e9K{@FJbTjr{e<VpCSDn8-&Sh<{+Dig)>3IFySGNF!=~02w)+MLp(U(69;Yb
zVca!cc_Zw+mdCh`Cm*t#9_gexUEcK1_2V53IvmzO8Y`&U0##*rk>{kFaEttwokn*p
zh)%?WtH&oMwkE<01&cCXX+pnH^q&0!4McC%DV()JoMkAl&{ZQ#idz<clVn$4c7K_K
zZzOek&g_1?{-RU6oQC)o8`c;Ls`1U}t=w3+i<qyEz##qj_(Oa!Cr)(tlMk&_{blGx
zbDgoxUQ3a~yj%u|aE8dGrP5fTdrdjb7;iMh9psmfue*x#X*|>tn*-mB58j~r)bOkB
zzhV6AZx}4y9y-5W8pyerR?UgXJQb<)>|y+Uef5@7ZQ0}1=f=K^><|}A<=AEpQ5(;R
zv^E*n=*wN#F3Iv7=&qFGai~b6#c{-=7`sNUqnQ>%;7vMyXF!W?YI~U<McAA3V1nB?
zZ*@HCO|&$R9LzE)k=kQlM_+(P{J_$@44Uu6hr>y_$vzC)GHZu?OVvDlDBmLw<t_V}
zI8gEUEezJyF*Th}h}i$!xdyTgUepq?J@U|<=$uSW5F9V+2$P0O`eqW#IMaa!U^+G)
zlgD(y1ssQK{*H$aamF=YTmbr{1H^#`9hX7g&jw)-ov~($1si}MIA#nE1;B*?@jNgg
z&JX!*d?pU-IylCYH^9P~4w1yUkdDW#3k06S$VVP<xUHbWwKPCYM-xZ^;%&u<Q&{zK
z$pR%Qe%-%Z!NH`)eSw?Ft*t(K*J-QITcNi0dfzACzW7~w_b{|8?P#1b^TC=o^}mm2
zu5);ah37>yk1(Z=W7uJV8y}1kJ_c!4_iwM9n(`ERgiufJ8mKfdXPd3qT*+IF2zb?p
zmWGsoQ&TZ$=m#Bj*(HB)W89$VoQxU_ZCZ?L%;I%nUiIzJHE?YW!~ulZvZ=?Y!E!xQ
zyoOHuZPjh7;o#cky+!^l)YqyiXVo7CoggSEEp)Q0EV0hxLvqbI6p3TqD6>qn&NVIt
zbDriFDJhKX;<q$J6{>s~zT?VD3BZp{&ocVw+=oOHDtc+bJHIt+ptgV7E=nV^{gH+a
z4ht*ddBC%6(_!No2iN&bOHrTfpWuKC4i9uq!?F?Qba}(?eBgS~hYW-Vu#wgg5HS)i
zKw%t5*i0=Hu8qPlLKrK`r+*zbu22G?OCH?c6u)V~2e2|NIPrc+C*FK&{>bq>+js}(
z4yS2AHI>^FWy3n0|4*Z_25dK~g(o>W2@8cV1Z$Fu*HJIjM=r#75LvivJ0xfx6>YDK
zB74i-oNFhzN)4!e)1QEIe^7~j`1UF~dNo@HmYl|d<UD^g?!*s3l6~vM-^({GaQToV
zn`lpycIOeLQ@wo+MEj3%zM;`&&1#{**X$PbUrtWR<yGK3t>95;M#aHb52u0iYxS%n
zv@zBS`AsYS9RE<vHI*}C`8(<LXrSC-O-p0wVeZ7^HLW~~Q9`(Glc)EQ7}kavem%wC
zEy?NS+fC;dVoxdS^5fC47F?e7rt+kse48Zu#U`Qhsew<`q>I9y$KMk9;QnoyUYu4@
zZtCTr!lUlf58m<Jjj2+%5hKdS{3mjGVwkrNWI*CBa>Y^KL!Gx_*{Lk0ftVwfVm9!x
z?Gcy8Ow(fXhih9Yu5FRT)6~Gl#V!fh?pfphs(9nsHO*+kN{4SW>*C^vKlFG=Cr{0b
zyny3yc`QF^0T8MI1RjW5;93CU019P12wM>1?XQ_(umy-iSZLxm4Hw9CaiI%<Yk;;3
z0*+-fPxFUf@Xv*Tvv+qb8i*4soRm>5O`qD<BK@**(2%1w<7yD($&Udj`jQ6D0^ySU
z$a6~&s>@;JOO^YU>S!TZvrn-drBR&EG)@ZZm2gNr=>t-8x2t*qYol<UIMfuYzWn}{
zS6f|Br1O>0bKaH)V(yj5GSXxVzAf>mO6$H5>kK+RbLhel<4v&U#8R%;A9dZ#Ft0a|
z=UAy?<12$SV^oeEoR-o~hVKr9f#4X0210fcUswb5g6s+LSItfD*~I*tZP5Ex_ZC!D
z`=_gJ=<Cz7TnY1Q?S4+F&8v(?VtN(6Tdhx8DvH`?tc>KTd$&>`(8)*eT?ZNFEomtL
zTzGpe4uC06d;YoC$YS{!2IFC|t4SG1$X}VPCFAvL{j<<L=8y)W#+I))I*unQ?2p(U
zZI{IU_=_HZ<^>)P_D}K=#|912c?d&;hj?57I^YAunIC-c8_#J@cfM@ei3=a%%?}y|
z@`FoSz}O&MX95v`83YaB@YL}Zka%#%j3^wu$m5U4fs1h9;>R^j<0~p~$OBy-7r=QH
zH7E!=DBrlGby%qe7=#&+KXh{CHkU;-H^5ybL#_UrswYtNReuD)@yGa0#XCml=F_Fn
z+iYhyulW@hKrO-@ZI6`E%MUC(NRQX!<mL%HPltO5Hi+iL9~XqiZ)z&Q6Za}VYKqn3
zJFbsl0S-?8@J<75-#LjG7q`oJpt)}&-eQRU9-aDn!pDbqw6u*Mb7FIfQGR}auh#=U
zh4!p#Z@AHdTP3zP#!E;vf0;Xng*8w&n__s$NtTY6Z44t(tY<M61=N{J)Db7BCCSg2
z`{F-i_L$XbfJ!{QU0hTgv5cl8w#PVM+QdB8dOU_7H1iH^y+LxMAkKdTEs}$W7rL6<
z{b5l@4KyZ{d%!)xlLs%<*O_R_)kQ_H6R2E{iq3fWL6k8GU8mtG<CDWN&0j7@r*N|x
zpt;aMb{SS}za*W9Fs_Zegt3E?7r$wM16>=1!DlES9vs^}V|Y-QygcLqvI!@?afvs5
zT+2<mWg~uT7#kaeEd-hIo2dyq-bC!WK)5^x<Kr5jiBJIfc`Pt^<VP;&0he_1AfCqs
zCqHR+p>LY<c37<jG%#mnsk-w2YDL{8m~AZ>w6n?W!n!Oj?g|zOPE>~xNIC<&h={<k
zKVFm{!@KkJFa|R+bm$r=8i?lbX;nN@4~xiA)K-vm#xgxYPsi?NZ)Wgg^n6#V*5a0N
zBJN3h(Ql`(uS!8CrSo{8+7h}4x&}5H_&lG`em3d%;B#@d=7EI^S&ujGyh^L3EN>Pp
z_OT0%6X+rCRaDvI2Q2-V^i)1x6j#zjWrJmn-9zp7GAyNm5B(VF@g({hjLTaH{^kX*
zt8c>@Gp4eb&o-@VhlWyLTacUPpDki{yEw8UJG<O&PeK3K@aJ{o8FL8q2ZOHYL@A-e
zI!@OK#dv&x|B!b|NuggJNamp;cHW=+&!lok&eQ*}VvQnF%(7-ZoyvJR#;Qbr=sf0K
z&3#-T;X3&|Hl4?_=ekP`&}?jfq!UFms$Ak|Zl2&sw+&NXHf@oIcpkt8VCa(9_EBg!
zZ=DZ3=fx!tu6a97Q3Egh064qyN8;EZ9FbKf!Z3pXfFCeJ3c`t8m{?$W!w+o>i3>Q6
zf|`c&xlrKMLKBZtc<@^WTrBE;R^pt8c>Ks^zVdchr3N%G$K=K@b^=extCaPiP&B(X
z&COKM1-fAZAB;^0WhjZtcdwA0|5i_w-)pTLE>|ovg>uu|q;a2OWjg};YJOdrMLn;^
zdD<KyHVnqtsqx{1FH(yxM&ZYomxot<Fp5bq(u3b;c^it+N!_6a>RIG|T8~Rom+pF%
z7eDmUQ}v@wY}&ns7>_qIh!}<e(PcZF8+46VT4isH!ZR@KB=1@SF~>9aQA+*s`jvJ*
zOqnPCK)H^dde_y~3wM?VG?#cfIXS;tb!pghw{PeVJjxn%zqs^Zuh{ovU6K-pSFSFK
zkLFppLBdN&PtMD@MAfBkRA$!ATCWqE2J^EkcCri|@mvj@S2yS7`Xr;t;M$OjpY4_b
zKbt?t<MLqtBoB|{oR6@9IClu*p+(q6W_cq&bf5|TIKS<swzUdnu%V9WkQM;3F_>`e
zA`nE(#DZ8*Xdp1@2Es0kl|w%K#=~{N?UKh2aTL~tw!G#~y7S>ekH>Pk42tToW(~xh
z!etY5Yer$OZ(E!cMg_T?<~2?&qGKUlP99FEz?|6JB_?FJF_b*@D4|uvTWcpbrs^i*
z#z4+%Vt`Jf-D1m(K9waH{>EwjA++((U*A5yYxB!Tn{-;2h2|!?t*<O<L&q`zV}uTa
zuz0@6K>Vuocgc}PVPQRb?a@|@PVN3Q5MyiIaMgS^KQ7!>d52=CKMdf=vgX)Ws|Jk4
zJly*oV+<#Sy-8kzyUK2Z9qNcjanBk%I6?fbyU~Hir%G=T)Bki0c#Gw|DDxaYf~rk1
z2hx5%*rrwBK37Fe@%lqpQ*h_UnQ=a!U--_Up$3>v&TP`dSUVPHj+3*oE-VMGShw<n
z-#)=(I@BNbwENb$W0_A6=Q@<{;85P@>f0Mj%{0MBx?uie%;MsR_~<HSfBHd2VI8QT
zf&)CponF$OqrC=V9qOu?NIua|%(S026PuSz#v+XE(M+(H;%A}+2$K)j!-nmj;5lFI
zS9I7v!6P5EXpGRQ?VJh*P12no9^lp!H8cRyz=H<h_(9l=-efi+86oIGz<@X#X5|gS
z!~vx9fNv&*0bJ-hFL{V_0puNouW`uZ3IP99{?P5vHL!XOa1ZEHIaL@F5~uuzJJwb&
zeiyK7plg5yr5-lLoHSU>(8NL?eg%->MJI(Z?%?mxHPAJ%UJbDMWP{AOu{797Fl>M|
zUOdY%-N%llYvR`U6=MoN^lFOX?U?W1zw5>#U0KxEt+!U0UEV8eAPkdqq?y)h7+Uyv
z<1o%&xxBECACK7QYTnB;yGXe#<d34rkOpEbOi$&FyJaQm+-^VvY^H1<MO+#zaR7@q
zo;BG&y`V%+Y`K;lnMvE~a5lUuKA<-II*v>bA)_<fg#qah=OI71JcLPiJ{y)Dr=$Rk
zy<G1Aa0P^~pa2hmCLfi9p20NX1AlPG{E0ISc{{9K12G|#mUW9pj65lv)7q(%I%@z<
z277ZBzk;d4wA9{NZTzyjJ7p*O)goi@QGSJOQKw-rzlDM~(s+I#Y(oqkw$S5-;=Dep
zine-h5Fe#DR4CQc$NP6}lGU$uQurwTAzH`M)W19-b5#Vq7&qed1$iY)8k?vMVfK^4
z$28j0M;c&$8jm|{pl$&y<siTM%VIy&Oi)ma>B5T-ZE4JS*Yf%4*-PRH1R9~lk66-8
zj34@8+6Lj=tT$rP$=s+0at^2KaBzXsbgWThUcvZFmvYI@Sf527I3u4~wsx66J9G^k
z)BtNd5Y!Kvw3eJ?HPJ%zAm>Smka%V-SPmIwf5qG~0VG3wlR~Jo&GVF3AQN@GQShjH
z#&hl=9@EZpfUaWxm9@$9-t+T|%Fdyz<>cs`Zbk#N3MNHtmH>?wTO~l_b*lk~cwBeB
zXl@DvKI}@IKPrb!(?DMAv~`^GL(}o_hZb?;&I3N_;F3-la9oD;m&7sDg(0JvS_tqh
z1b*X_j^P$CLj<gGEex*x6c)dg20iD2j>G5j7l{rxp#irVge{ZBO~`$Lko3r0U_Zs;
z+8^CGMv{CTzJLbmKJf*LdyhqYdwY!q@9brZ8PX?(v*BPAe$m2~=N=97v+J}o*sFm)
z2klkO*$LT&WoXkW%WIq#hCe^zvN^^`$4RL;E!8Xg>^i-NjQkLvj}9&9S58g=zrO0n
z3r_Z_(d2A%4<+qo=o+|=2ErJsA6uFM9TO-d^CYZIE19&ezd7&tFw`|<i}|lUDXjIg
z4aC=wr}JE;2I@|<cKc^7D<c6-ytcpMA7Fe!xHil}$fJ{q*f@&|VDPmcT=MWhhdfS`
zH^4Z!7Rr1at}Wuk0pK7j4|H*%QCq}KThV*@lXllIoPs$}%4-g|2gHgbWaD|%!vuMY
zKtp7eOhesg*ajyaZMr@*0mXg6$`h+=^6h~s^}8qQRie|buabTd1Al8Jf2!}I$LJ?w
z<~G!tZ>QHz10NqcW$>ygOh#Ew9n1%eIcgCaN4Uc=Ce&yzdGbQs<5$<=t@M6Uc)qIm
z0+c_EO=^8iVQU3MW4w&HXoZ3f`i$4@^M{?d+c1m-^yZMB5;TXQ+R7T_t(vc&9`$1q
z_X@x2N()~F;14G>m!uQCng(=24{$#zQ-|uD`9$~PV<;gt8cX;p?8rL#&(PLOj;gs$
zrg1sqeEsQi**b-_YoJx@;RiTq#Yx_evB~6oEzrlH32laTPP=llznp8HOnBT^833Ty
z8iJ<&d}v+z$Rh^9d*Q)>IZiLy4X2gS;q&uT{P>k0T$K)6ReozFc6wVH$Y$EKu|kZ+
z7%uil6Q@OByTn#W9FIFQ@c=la1Nfn18m0*@`G|KbBM<3p9-R(-pD31hpbf6`LC5md
zIQXH*V|j=R2H`1xoEg^wns}YD7LcsqkO$X{OiNKin&}c}B_XtVnFg+vY1&pqT?iY7
zogccp_!HmZhBQC}aAUY3vA0BZ!`+H30VWh)OS1tyX4qr1Y)tS_y&Z^G?`})vRVnxL
zVyqI6#gl>uaVqrgy`BbGWU?Tq*Ux%CSv7{l{cIXD{GmDcvXbRnKi4>Ycs=cR&a-GB
z=CBRrs_AVaSLPem6imRtYK4}hk}ZGO(J5VC`(0=rMMvh%-14kPqlm^Wj0&t-ymSY#
z!`)~g`b4bQqW)Q%GG{S&;ZGPh!g2VxHpt=bcN}{@jMF8bPnJ&k3u{1qE8pJ2bkPp#
z6UVv!l-cHtAM(b1br=fTi8@g7+@l3*3=-Ga+jyk2p`N)nW<UlERZ)zG+jg`;{_a_u
z23(s><uXz1j~H(0xLy?DC!KhM@o`DVehR+rsKgVl@vwiA?rDm2`yCH|@(}Mh=+|Kd
zx9FNiEiZWkAXo#)7RpFuL^#Le*1}pTiXM!(<OPp3(}A{yl{Wx7C=M5}u=vdvmkZU%
z3qaROHBETn_fzv!bcb34`v%#l;5kS8T8N{5NrNoo+30A#l_6N4YMC~UmL+%m;ur?u
zJtFU`r#<L55gjJXXlPU|-L=D68j$X~_RiAW;+dkJXzLmaKG<N(`-pXAMxcu^w(zC}
zr~TL*U>Ig``@(5IrN4(^2kA<OoKc=m`u;VL^INthPkU=DH4;Xjl<Su7@S5Ze*~*w9
zJ8XGlN=skHk|hA%dSY=cp3K+WNy(jx`QsKsSc6Ll)OobfK;1X9&*t?YF+UaKZyJEJ
z{?jkcC$_u&=nJ*qPs+L$-%o<{h^~Q+2GmiSUduzrQzysBoGqR=Q2AkpRbLBWF354e
z9!pwKHjS8d#KQFXL6Z4r(b-1Kx8^?y$2wY?)jFQ<{n*Te)Qd`HHGL^}n1`-gYAPE0
zBX&#tY~(npTiYOGd!;z=z;WZS-BM8j<o!jDH-mIn<GQm#*LGC=q(jH)HGlA+0bZSt
zJj9RXA+PDkyZeN&Gmi;49@hX<2!adP4`bp8yRh<Zg%RHP(DVZy01fhv3o+)84B(j`
zF5#f>0Y%{sM>K%qYULh5@5vK1fKCH6nZ@E;0phrOjprELozYYcECzNd!TLC+gP#6b
z1JSNn_;pyl2DbaK`u&?0nri(RS7w7U@x^$~!d8qv*dVCQJYkHc?dZKY&{ne0noSj*
z@Io5!m`<Bo`AQ=C1#0may26EGj_&#^Vc*|h88NiUCpJ^&u2t)ZQ_74R{y<Tf86-!Z
z9AydL;dV5zS%+F?#{X#k`mu6Yle%9BiMn@NaGoh{tnZd-s#C;SsMkyqr6b*e2I@X>
zNi%0mZ#k}qEMW{zsW4nJf6&jXZhdwQBn`%YNYq+5o8*p+xq^7t>ukACEE;Z6fF0a+
zMY&|WO~)9xc{Bqu55M!{sQ2)F9^9qFc5$kWY;f&Jo=3^eg4|R-VHzh7jesy4JM53X
z(xEioAsrlSl)vgBjW7>j7aGntPItT;A7LIhLh|wu#x)*c@Sq2O<I9_X&^3_R%yCT!
zznPi=VTgi*-v(ZJBaXB&fJ?k-;PL>DhZX>?X}e&S!E|c*Yd`4$3yvRVdDAX~o`Fig
zS|=29ri5A^%XNz`lNx1Va^Y2!_!x%@veCBumG0ME#=(Fjd29Kn%6u#3oLZia*EMj8
z1{l}g^+BG8mzOwkkbUT!o-~~+V~z%$<fnf7%q!@6@rILr+?TeQ_NUYAm|X)qHK3+E
zZq4gh%kPvnB4e#1-&pSbIhId(Q%B`a;rty5B`+kcDi8hSyf2^FVieX_9%4gWQg<k1
zA^CQ2?ombe?sz2_&XA;<Q+i$tvC&vb-b5Vm)$~50okHkS=GGBc5aytAT9<E3PyN(`
z+Bm6)SEYfcNBz*JC!j%{L4s?3JekGa-@Mi_19%GZFw>ev(nWS1UWi$z>^Xz+LVa37
zg!T|7^vWEpHMH&(e&BEi>2d!$>8&-;>8(ryY@BSD#O8?67Z}?=Gj{v0?UK;2F&00~
zivb{-nOyM9gE(+$Sv+I@rUQRpQ$b$v_JL`T4o&loLe!Zcj$k!G3kDIVLxgx90D=Qi
z`OU=fgn7970T((H06%n{mjeBu2fD_^53c$9`Uvun2927Jf?IKfJDi~bEB1`6O|ryd
zRf8=CL}a-|2-&MyGYr8@EP`>FZpBcV8^a>M%QmrcZl#P9i__7%22R%i{a+^w-t?il
z4_)7oC-0czW(4sJqp(=S-E!);Pft0m@+u)eROxaFrRLZ)qa>a57tp|`abE3j)h(;c
zW6W*id3g=hWqp3=q!*uyj8pzvsxPueE4s;(!rGP-jyQhge%5A~J7%?XuPa#TCEFU*
z_XTBOyQC@^PO!0#PUD3lhXV<zn5-*TpWRG5@;92o8hec8zUJNmy<SN-s>GF#xUQft
z?|L0Zzia}`VWr(cF+NzX*3h~sCOx(9ncEs_(TJr#c~Tc+ELTXRsj7*_4il*q7slU^
zMRTx<&Q%}pZ+XW$a>lz9SL*VI3(->>X@J_L@nNgP{zw<|BX0mWyW+52l8*-*KZF5X
z+h1)Uh6nt>^@(G`^=54sFUR2m<R>3t)08*jpcSxd7fPZtj)@QkAZWpfg9-Uuh&q3r
zE|j1R9{BJ_3E-O-@hHv(0T(b&`@sP$6ZtSE1JDDwLb1ao8t`D)6?v8xnV5OPxE)59
zJ!GusJ;|$zM%LaQR#hcknA_06_H>k|v*=6DFBo?`mCaWc#vu$l+#?LPG)6zlIGwKx
zr+nK|&L>T${ADyiW9!Z8;_8kKDObJd#21Ik;$w5By1*JD-f+?p<+wINbqas}y=wf(
zLsE4m*M5YYe|)nlx+~r5KgJUv-UMO&$w@)hZfYww8g*SA(7**v_JXVj1Uez9l>llk
z9olOEwNgcK{XoP0)FU53)58w}aR5pEepa9mOSKW{DSqR6()?$p3(R|4`U@HKrf=w3
zrfHoNMudFp7hNx<j4i3|IIuc>+7^lHQ5O3nc1OFe5BCn@0Sbdn)5cw{jc}s@7d+C5
z1MIJP;U^y4nm+tVvr8Heaqz_tINdZdR)5C^;Tiz~JY+Ug!hnUtH4QTc-%5cVc}y1^
z(~>s;eA0<GJ_+Qra!3Pe{_qA&6PGyi3c5>=6$o@sFen~HHk`EXNk_ZNVnZ-46UCce
z%^q5>GB|x#-nGYVP6(}C(go!k4>Y~6EU5h3U=_w3wF~-wew;!>g2o1o4jK@?$17;u
z6Pi=nJY_-##_{iZ!YGU^Jl|d(zU!x1UQ3S^_oJuRdF1F+zm^7azN6`JN^!+yS6@Ip
zuY1-eEP4du<mcOWU1O-tXx<?qndcolf-(G6fqbMW>NM^n*CycGpXsEOuAjm9Kn2IC
z;i{sQ&9Vob{->D+qCdr#O4G<2Ekq}_(LO))RkaXx@ZmNzQ3B}Y9j6mBTmfyCA5){v
zvW>h!P#w3>$>xOl4eH<wk>h%WGxD99#cRQ5T^qL5K~E*L13#`ZpzUf*U`%HJxtY**
zWM~lOAD&EVu6drZ4BC%6m78md9P`X~PPZOMk>NpeV7zT7<>K<z4*Ps`jxpXJ-kVdV
z`=`wh0JY|)l^Ffc2yBjEfE&|eaj{nt_K9B~cx7QmoN>u#V1gl@yv8GKOrJ0hxXzDT
zFZwKx<si*Cj#Jc@a-av@fbneS1Y8RWL5Cd&Bfw#&yI{B$-1!{_m&eK?-QYCSgFXeR
z!_YZ}ziD^3YhW1-uox?gZVW7GWLbuF=h8LMHE??x$h&;Ckc{2^0`iMbjC8$aRGU$|
z{)syTEAA926t^J7p~ay<aWAgH-62RI#VKw@inq9Ha4RiP9D-Baee#}jX4d(ynOV=*
zooD64v-iH``dzomtIFMtdz{h*gb>37)o~8VO2OsUI;S(dpf{hs4Y!Wb1~0Zz!{7y2
z-F{)upl*NBAL^-|%Ujdk)g{>x{L-}?$ZvKgwp|nUFf09+`F^NF6emXOtw!~v%u}1-
z8)_@sDIvxh!<62Yj{_Sx6Jb`UcS6?xI<g(sbspf2NBKKY;(ukWmU4~GX$?sE$6lFu
zimwSG-hPc0;q$Y4vbW+oLn3oKKL^tLwJ!F0YL(J&j?+tQ#$I?4kx>~ATp+aw0s7W^
z@;RBCe$_~re#m)1;&{(F$v&PO!Q0`m>NsDD-wQG;`wTU+mGk0IXjD>GGc6O$`;heK
z-1L3&D-T_CKBQb+tv?xrzzon-vp;^zi!=6jvtD@o;7Rvr`FRnEfvVL-BJpt8MkpVW
z6+!&pA=i6^cg<{s6E;=5CkhImn3KJ<Aywbs!GQPlr0xSL9+MccSCmI?&gQX}!N!Gw
z!)g2u+T%tTXqQx6Y-y6HM_zi5w&QR3=G4}eMJO1a<_O&_NP|P>_XR`j%HFOFmEp@Z
z>zZZtJ#fMUKa^p3lCw?6{IYjCuK)ZTV=ja9L~t}93T+?#aqeaD4uzg)N)pnT@4w1+
zlYI6!n!p2c7T~A}gsd_B;X>*+S1C}Fr~lO=?6m-(Ra4;Z>yx|jN;_ntN|UC|pa;L5
zs=INLe<tN0?g1t{u4ucf5B(V@$rcPI9ju$A=09~_Vj>trtz|Esn*kXDN7arTHmdG;
z?iF=}J)Qdc)+`9{8|VPu!+XjN6Ehb1I5tD_KN(c1geT1|eUTNZf*}a&&acsDt%@i}
z02;fQxDP&#i-T*oFrjznDK>6mpqa>A^N6Z`MFu=3G!vvv!o+ZCLh?Yj7!kQmWH*Sb
zq?LapA5!+5<ny{TKx`QG3z%2X&Cj8=;1&H+>e9w1p&t3Mad*@&Ddy@ZXJZzfAIyvN
z4JZ*q%Tw(6UQMi)mi)CEtzH_kL_dLiszh!CH@7fwvDIvh%?jYq#2d_nMDk=~-x(})
z?dd93{}lS`FP5(rlg-q*Qi1I!<E}lZA6tjl??{JXm3V1f&oA@y=o^aEt+~FZK4sM1
z{oTw+nFZ<>Q~k(`UV`JA&z)p9`lAmUBm?bY*yww_2B?y16j$6P7yj-PG<F#hC}x-&
zLKobP^tQKY96Ow8SH2S=u*{<T3&X#*rXn;R2lA|ql2fO}-DMntlzQZ;pp9su0L@D~
zKMv*#)kk)F0iEiY2-3yZOqdwAysATwWulr_@nOHB?}T&2(t@b;?MV5lm)<%%4L-+o
zuk!xQbj+|O-k&kvBKFSenDJE-02rV4_PWxYD@x$L8w;bS8Dl;%5Ai~H^7EEb;yIu_
zehvo;AXEAxZJLC}uv_5nf9)T~zW9PkRT>W>XCROq$j<1{lFq*rQrqk;uA4k*SsRY{
z_ysk~d)vfa7q7h*`3$!tjw*hpR%<KbTZ5!D4k|8*&exdSPa<0p1FWoB!A@PQJCxIz
zb<xr{#ww_wQ04K)jBcZtqJ;at6|!sn-rxJn7tzn+qjLToCIuvzQ&aqP<8}5F^`EEX
z6gX4rt9q$Eo~P0u9~!O7-IULQX{V7?0(*qMKF4sp**^&>bLjEd>XPJ3o75Yyq609S
z6EuJfGkMpDsUZ<F+y;{K(&}`mXs{p&MKtDro?selh%JAy?dj;hlxyabWR~uHq@5-_
zk3Y@&I0ruvp1f&EpRCfQtz#_B?K0jg0wB0G6%(<J2}<8u21P5K=8W2Glk9TreeAu5
zjxDPD{_#vHrC#&y&CCcx%lYr`dG!NLa-(p5k6gUwDNXh!)YYUCcl>bdH^q139|zU_
zhy}}QF)?sduFzKgetuvsw?{Vn>p9WP)^!IU>Z=PD{Q?3v3d*!Xmg;NBn@JBpfbCiT
zJdxmZh8VVwe>(QpLUa6=@KS&&1<0imXOU(R&zr=$MS6P{dX#TU6Sf=H3xYA@g$%*_
z*67OxLN+%{E_~>g-Y39)3)$*VbwX4JVz9v7WN0)!EiK$wE)&0fw=e;QSn3oRyvjd_
zX#lj36yV;7Qe-g+7%k$L8NGLHOG4Aes8`W*xYy=IpY|K(R6D;GZRCrc<))N1J~|c-
z_3&e=7E=oq_9m!ZK7}uF99`y(`Bh<b0_iU6c~Im1N(Y;vnWXgj2NkYnrDK~(vGwuy
zv6aj^dK&&$)RVOi<88*9{1`qN*>ri;f1Uje^Si|rjExJH87dO0b;8ITGspB;%a`)s
z>#0W%0>l?%T;?#iqbkQ*X;_0G@CJLAE$+5h{CaiV2kt?A^0a1p42Q24SWV}VO8&+j
zp9XA8BPcsDAYJyiX+Jg%3oU7ClD->UB~x8KHYnW3g^}rI3L0v*6)}C9@{bGVvHx1B
z*Mp5>^RgXRqc0_>9e=<uH*Y}BhsjH3_RxTBSy4jYe<j0KejxwbSnsDdj914-j)z;l
z#7olO`t~~3Vx&)}%IrO6@#)=Vz~n2tP}U>xPV^e}>m@GirRNX+4WY!C1kxuWlE7<t
za)xJ<d1CGUS1BO8qv>xlVkV80pl=NG3h>;8+5npx`7_ddI8k&G2rFfWq+NJ#v5{~+
z0xa8<nE@2lGXDh=H@j%Yt<9o~6N8ztBP5tM(>-=SEM$Mw+b&2<_K+o`J|*D^)VCY_
zfFrYcHaGpU^Nep?THJDY4PD}h@Wr&3j;lL^!3Wto%Vh=z9<IMDX)V+jy|%J{o6m1d
zM+DCxt3N#rvRlSfzE%6QA+Zsvg9vJC>c2VK6k(J|1Y;deo1*S{-GbO4eWw)AuD!0g
zkfUbRhkLOGUzlLbs5p(6Iw#rVy5C#B*>}w&3Z6do0!#5GMD(*}D`FMDF-fE})jt)_
zWs>NtoNHigv={{&=Z$-vudN&Ehm3acJd;=+#!ynUciA$mv|XA-<Z*23o3!v4Ycam*
ztH@QmP5D`XIp;By3d$n3J2tf)%Ix*xpN$er_>1=M;u08kN=nMN+rTSTvt6u82Poa@
zMgrSNPrwWf-OVqHOnvi!3tBHd<bjJ#5e$ChAwM+Kjz0-xe7!clc8D41!y<nu<|J%q
zQ#3dJ73-7L58s@Y=-G|r0ZJ#x1z#{tG|++_v)|Zn4Wf@zOZk@S4lS{&_=m=dI%TLb
zWS;?xzeYd_ONwb`e_E2hLP;hFb=+7-rt|wy3;N*E+tWNl-VN&As3(R!Mwk+)_8lNv
zIr^x1zu)PnB3or5QT<$E+8qhuJg-FK&RM49okORBQH<dE2-+#sb64?HZksOiVyN)V
z5CHx({<^)nzBWlIEbT9I<-6PVJO64}@5?{pPIYuAO1=FPq73Dc8o=E9#V$c|l3lr8
z1NNxIo1k^L-~E*<knb3f8K7qvN?}%l1?giKJtln?#Ap`;3wmP>k<1CJQ!tXgqP9#*
ztYr42N(2-H*->gdK8Qc$9|eL-fTH-%LP4<(xjCwi>3DnUOC<YD>H^Hpx3BJf)j}du
z?&bmu%i{&X+>(t^1~{Uzd&XDE3ZB%tua)0tX`v1+(FB<*B9|uD+^=98G^L-sznB5~
z8K&!9ws0U9ot)Gfc3BYEkF48OC}Pc5YAF7(Qx#;7M%v%;eV~pFk*S;Wf8-r&7L_G<
z`oQr5hTUdn*BVNZle&df@sU+oN)Pu%JF{`7cY8LJYqb*mEN3L>soA&DT;hw3KT0!p
z%Vl#)W5K8SHT<5fX@VqU=<zgSx6ZjH^2|u_f{l)WUfOgoTLct=EP`?`$4VF`W(9NN
zPq7K>WpnDgb>13ug;99*GSb(~ZqeePhmiLOs*y`PP9DzoP1El(<BJ(v%vo^b>$h?q
zw0OL_A~9*^Z0yh<fAIQnxTPIUHzSWa_kd=Jha-YbH{<g0mitnP>eRR16;GFWCsJSC
z?f!#84rz2hBtia%Iay+VA4S9<mpaba&Ap*|Rg^qiS_88WzLR~A+}%XttkE|EGX_X4
zgp<mu1y$nG`J3$?N+I-jRx+iWq~rpU;~O4I;G3$@=M0|S6Y2}@FAgDdCg%jB3;E79
zsUN*nPU+}lQnHG=%nwq>&~8<?J;tqRYBC=Z<J=XvY9bpsJm#-3+S`tlUpG;d3CiK6
zoWUaReSQ}4bs?@6`OAbTBk==GN!&P~?Y46g_7ne20j*@1R>SM5H$vWDUuzB32WQ~P
zC?6LGGyJiLhqj=^v>mwBV90jw+DN9ll5aQ(H%Zxe5p=rLseCM4km754{tk9?zKz21
zixuce08-nHz@sfB*EcbnVG(pKuzo<uCLbPZsq1RX^ex)ws$M)sbEXn;C#f3r=r?#h
zd~%t8p+;pXP*1!j;e%0XQ2Nkg56JXFfWEJ!H$N~^i5YMidzjysM7)EN3MjbbLFMr5
z>f+Kvhmv?04h(&kTg=cJ7)R$yxz=+q%Kq_PsFjhc%|5RcVS&PhuQ@2$x(-lxV$=x(
zaGkG72KVw;l7vXfKVXqesUD$P5mU#rwNgZ2dn}$9utizF;%3v7V9^WrcAf7*!ymZa
z;mZTmFB9VZa>3ZoZGt$Gzv*tP5yJ7onaxPj3%Z?QOP?eo#K$vSP-B6J^J6;-JU)+_
z^xg5gy_0$>Xr}WdzSeS|5Da$4X3?VTc8CGZdpPCtM!d-RyvHd2XTU}=dZjGVh7C{n
zn1(U8BNzI0`&V~x{Lx3TjP0o(CW=;iE{o@~X)W<VP{;4cuy0g9rd)28#GV$PJq+or
z1N{dCi8`OonNs<pPTsv%SkXS@+jc*&)uw>yCA1e8-Z*8I*_Ir=ei4}nJ8K$+H-E~?
zf2-bL{w7RF(tks4=B)P*8)YS&ie+vli0hp}A$pP(=TGSs8x^*jZ1qjsQp89V=l~JS
zny`PtvAe?}z5zrg@lYSK2%SjoD3x2d*4XrQ%1`sL<DES5bju-^3VkaPy06W@q{bX3
zCI1`AT}!4V5}CwX3@Ajm4;%c((2_W`4Wj#nOu9RhB#2}AHAhd&0_eS<`~z=5oWS_D
z$j&$<P;Zssr+rW30jmgg@hhTF29)c3zkT_-nfBY*|C8GKlp>SeJ0)9+-c{MVA5YZz
z^2JJynh%9z`Nk%I5z4y=AIAmXNX;jWdFlC{VEk#X{W1S@E5!$`>@vIDfy}{Z2^cpF
zkif#jAIBTb&SJ27w#cWh`2N*a<_PBsMdaTiuZSINuE_@o$q&!pHDNr3$S?!N*;f=1
z^JT8~(RU{%rA&~zA2|5%<7LM^WlFvm;`F!reVg!!sSX+De!bdeW$pRvb5tAE$uo;1
z+do9F(p{CJoyO&ZKcMlBb7(t#t$Xh-mdT4t)1(z@%lj+#X2fDPTrojT@^rmdpcEe1
za*EOu)&)AEBA2k+=$kqpYv=1yln%)m!E<2jp#&$mvaSOWpdwp-)azB884$v7-E$}f
z%**ZDf&mX3vy#9`AfiB8+xJ@i@GoT1G4vQU(2WCaVvTu#C%|B`I;9s^o&BbKuG88w
zofMC@W$(^3dtM*Fy<6w@=AHt6g@_h<6j8|%>SdR;-Zn=y>s1SV*7WtCvj@*qWYPZR
zj!%}L@Bn_keGGqNn8J-gtJa(>jcYJRYU*JO`@Z{}MRf|rKN0c%=&NnCD481TkXidl
z&~)ftHJq=kqnqEw&Xh~9w`4iucQ#Ywd92_KCTi=Oc_r(b#Oc82qO-#%IEy;3)i^sb
z#_@7U_*!`)H>FAh>8N}f2aa=A;aBY*`Zm<yjtzimpW1}+C&P5bJZkRZ->l6ysLtii
z<)10F+`s{I(#CuqsOX<1vKOgP^=SV*rMlsUhCsH@8Pq!Pe}%g-Q>A8{#cnonT<jM)
zUrs_nJp%N;vq-smm#Wo+v!e5&bo4^x?3=o-Ljy`@Ek^kdS65MlBeE-ljPcWd=Z&>(
zsqJS)99BZk^^W-F>GI_K;@_9udac6_Q`JnprL>~3hDlaxZ<R`Z#q@iLon2cYu}-u!
zMI>Y9nDZ*LtxAhwSPr#ri1F0ei`JCxckDnN4bOvxu}Cn(jf!Ji3kbK+YH<}Pc=ON)
z8u`fm|Kg@JL6yW;I&#PZ_heJRzF-g^6KYA)yuDZNa70e&8&_~m7zULl=f#M*#xZ`m
zH}QYAhzV+n5Mf!A(AB$rZvJj6Nzsdu7}3VA!>gwE>bLfvtpCA<6l@lnMS}7EON8Qv
zONCV&=Dn9MB5|QSWy7O^<9Jr1Ey5RVhcpum6z+@f0%@L*v0q1tN9p5QniIbH*9X#t
z-JDpUy}3Ts;f}CH{D+#bekzKass06#Bq}(qRP+Q=d3>`jxj^}ZW;BZu|NLpGGGs}G
zzcf$Bz|Wd6+J1ykYSKl$z;w#3tB%S0hn%Q5iA}s`_W&V8DuiNnNu%Bfg~5D&;F)4Y
zqb5v=?t$4JksB>=jzBFkAHBNt#ZrN@mzH6?!N%uuQ;&rk9p@N?(cSy~^TFp|>3o~I
zN3*~7X+Kd4FyImKqmqqA5>Ai5rLc%>I(N!xBz8ldMVgN`-Bg_gZm|K*PH)l(PXz$J
zDCy`~rS#Z{gQKT{Dh4}3MwSw6CVF-m^;Ge_1CKrzR|3nLLGJjL$j3IsxXI3iVA+5&
z03=LRPF@Zsi!KS;D+%*P&O-Kb&maK^ph~P=o)!E4QH$4KKCRSqXDi1S3+(wW_n&v4
z0;qEq*!!O<UX%6G?-U5(w#t#zN545t-y0K4x-5rwMXfgS(N5Hevm29bgEr)hB79aV
z$41H}-c*7j)#^V7%nA`>kMXPwv5|PZrE?G;pgKnV#6BO*|F%FIW|b=$U?t&A)H4I0
zg=g%EIF$W1!TR{}m#kjhU|~&~Fb!nJ$1}6m7q|D1ds_OMvn^HZ<DU%gq|dhL?C%ME
ztXGLJPxgM2>=f9QY5$cax8nU;y7QOOj5ex@&xQDn3F!XnDPp!vXin^LI5lf!n8dZ;
zIXwQpge$l)z!#CU&#5%Dm*-e{0C1YH9p4K30rcGF0D?azGZ}PJ_@D#O24z1z8v5MX
zAZIHKA4<BZ&Iw#f-Q=sjwLS5+rZ~=qqN(@!v5JQJ?+3W~$_Y8>i@8Ie>T5iQFU&(4
z@+ZC?l@6rjOVk(-z2Vq2SI;t80xE$MFGy<cA^;jl65thmS{VAcl-#}es)FqJxD2bR
z4X$l?q(vXx^PEVLut%0+2nRVIXeWmWuh}1^w%BcyfO$#WeWA^pRLPp%R(naP{+rY;
zHxo*|*7!;m6}1nm7(-zJlr)V{w~f~zHv*|l=%;PwFNG)vT8ds-IYlSp^o4))@xaK#
z6L$jIpo4zBWIncDsJb)Np3Eh;0@W+zsT0D-IaJw#U8&r%M=*k1zZog`RaxR9EHQau
zmW?!QRQ4DmLm~-`-wzjJGU_AovqJQ<!j6KI+ZUG!f=XtjKQH_N6GhJuTGe6sy0AKj
zE=tMg?b?4hkU%Ebbzn0UR|c~jR~-J9HhF0m+iCi3zFYGTc<en%%lI=-UU|6p5$K+y
zXq|&^;B)$pEe^yAqneAq->aJow_}PD1Fw(!u?M2hcUka<`0l7%P{un|)ov}Fyfa;U
zxJdq?g~re8Ivs4#IRwQBE7UaRn`s#A3G8&MFa)IIZ7$Z9cWchK>Lv4KN*G;S$uPa<
z-?;el>Y-SC#rHxXQ_wgQE<$K4*3_Jpm@u@p!N=`~NV%R9F`>Xcl%057X{k8QdBH+B
z|M0_K2D~DHIn{b|R6?{NNN*uh%O_&{{}<9C6M@Mv8RaR#4Vq@6b)&e8K`py_AE5A~
z|07k*sAToerdMhml+t#e>ldKtQjD(;-MsL9QCVe*6qSu)@7vnk1h5H<7gZa?|LWSC
z^GcFdTvNvK9dtM<Z`-U5-6DnaJ0*S-;z}8kRreX#?>b+koqzAkl5)c^%NDf)9xc6p
zp&H2a@gS{@zP);7;w=8q?<{iR8}w;0A*FA;(3&pSXhSsbEP^aLSunj$%W4^ZQ`&1M
z(aaFA7ouauew1{UxB)q2;6-9K%X8{mA#D9Tyi|LyQttA(eR*D*AZa+C*yqD+=p(`R
zcL(Z1b^G4bYb*-1bNbH1QS4v*cbu^jK=v(N@_i<LB33i2!Ht|tjc~z*K`JdAhw@_*
z6_yqItMRNWdx`<=th4)o>^ilNOZB@Mk%yA<DxZU*&|ID;?PljP=c~cZyAu`PM1OxO
zQcy~I6ySB;RWdhbrC=@Cq_S@_T9R@m=Mo}UWponfIFnfa+q7SI28lQf^ooKal#~B~
zV)jcd{^o!^k>>Au8bMT)SO9b8YUW|P*T$iJz{I+*hU~`FQ5KQBpHekm#GH%^(WK`w
z_WnPam`f0^_;Mb`Udw~t$j>zJNDqnZTViFowhC+?;iIbfI?V50N`F340fJ|qEd{+*
zjU;my#RS*uhknUBpX81Qe!P{VhMx09X8y=+FEsi*Y-ZTliQVh2b9tz@CS)}<A{Tvp
zbfqXKBUTacM_T>HK{R0L!Aqr!(r;{Bj%`8SRIf##b=GXH#FzT>)N2pRrXS81Lb!tz
z;|oJ5`D*^1*J4S&sGcw(#k!8{iwF{5h0>z~vh=KQ_`f{n9^YjtFf7MUIlenb!TWq{
z-xJ5o7&YUviS|25D~$BQkc;wLALLhD%RRtKAyK31CGM!q0CS}<8>S_S#@jVnaGCNs
zN=j_&y_7=*J6}!^j<aqOnc%MMPCMJ5Z?zxezViN-durOTU)A%}U7g*K&XeWwR}`%x
z#;}moAq+b8bSb83dY4W>3;X1hu0z<QOofNwVrqb!L^SQM&D(7g#)kAEwuqf2M-y0$
zWK4G}2L*ec|Lz#Z1y0@->^4Y;YT`3wR-o6QGY}ML!XjGG8CRdPC^3vefsu{;YW?W^
zCdPXx>r@455_diIPCNF`)40!~d+fgp9oNzDeJv)Dj?`k|>I}158NWl>$o;#_GZzFX
zLf)0@Xf^MDgZOA?E>(rId`o0CVf{$~_2vZ>Pga)dNj^q{tTENc*tcR*US&mDdGw*E
z&hmHn!8owwrjR=83BK>;#ZqYoaIi(?_R4kiJAzi)c8@(g(&im$zDip6uzT!kX7&n@
z1PJ$2aZ+%PwhZ150?)5u6>Su1Hk<f=zX$Tcc3RS;Y?OqZr$w=iq3zXk;bxX0#0S-$
z5>{&7zYs04Uq~0SkXLHi-Q$r|!1IJen*3EM-mqnkR6o<vbBQ)jrSMvE@*2)g#vhNj
z<5~Be6vO%&xK6{L2^K$&d)smDbE3fp%YG<#n?Lb(oRPM<eKW11_?OWt{o#R`cFJ4n
zAGDj4fENvl`M`D;1NTOIy~_x}PZ^@mN)d6&UPmqY4+%qp37ptJ6`{WX1I~8z0Hj-(
z(1y@@nU+a3CL{qYs-BGsI2Xg&dLkv`>;GR8=9M3)FycHx#TXHFr3kJM26x>Xo1Pm4
z+W?hz5<6ykV9^B|>yrlw$OJLpWFe7>Be%~t!9wexHxA1P$_(^$?-Te|Ilf5lXpQ7C
zW}v}*1NzqW9;mxIHi$_jcz0fiF?g|2F44+VrB;@s*liW$hrc!5xuWb?yzEc<nzDKD
zxAJ8Z%o@s7Rj_9EC;zJWV^!(5tz~E;?t<Y1MbsMI>Xnvg*Y(pSMBVx_Mm*{wwdU>5
z>aQ5k1@6>)OVb2L2GZbJ%&Y@{Jp9xv`S``C-vu|<ERM4EnXkEv(j3!Tm!=e$uE$MK
zf7*p=aqUJ6ALWB=1zcim9yM9ChiR<fZ>jE71;M``@2crsrK~3D`vup9V6!9_YNi%~
zQnnt$qTEue#=a^tSww%58}iopaps%e?RJOE8^u<O>Wf*f^$s=iVYCz2PDdZ5A##x7
zh^63IJBdh8y)8;)(Cw@Lurc@uHU><0w!UzzlymnbUjnJdk21q|b_gBQzXYBob%{ao
zUtr7xMfd*!#t@<vBAs98o1YFtjVDpL_jhC@pt$P6zy8Ut32q;`RZ^MPt16hHZh9%0
z_O}+{&9mREoK=bJ7$w+qy0s5}dg!=jI`B^O$xr^734zMnQzbyzrWI|_Sl2|<XGVhN
zEFqwWI|W<;$~a`nz<I=Ww8Wq85gY%G>{<eR#W_|rXLgZDn~zg`mo@9sb;zTR<0#<=
zpIrT-kg&e&Ev=Q)Ov;&%_902ibnv~{+Ss#NAUXFFo0qZ3X5TOI_LW1jQjcy*{FW3`
z8S_O4xogl#OYpkGAM}EhhI1ackW?FZ;|}Mb%{E<>+)~|AO+`t2S0zo9z$b>q!@P-E
z{>y%RtHE^LSB%ca7m(i*GY4C!wuk{wzmxNT9}b$p5`6_$pId_pjfJa!41#G{<sBg2
z1p}!=3sp>)-Xr4o9R<l#H)P`r5!WHnm6pifziIgmydBZDmqTA;qAAgk9z!WV5~^>7
zPg%ik`3{I{;I!{$)cW_iQ<Iw_S?Ru=t~cYg=>LAH8ju;n8H5_Azh5N~`G)+**z+1a
zauP#Vy)@M<V}a0b-9S2W(h?iLya<e3=qr)=wzrD~%GK)8$i%$<$w|dKcP>tFU9V8T
zZZXvA?1#Z&Eri2WZ2#u;JVJeG1jrc)I-~%r!Hq>U*bW6F)NguuATv>}2K^4I)(*#r
zp1d*Y-!3S;8oNKpL0^1%A=9Z<?xxn?D{X>(%t1_0<N2%FHdLdccm8}1nHl>f&+8oX
zYoEFJzeaVUh$FeY=WmeK!VN1~|5a13Q-`0cKM9)3GeqaE+S9yWe}Nq_f6!B%oN4Ps
zsu;2pJc{*+^QjEepQYKi^PrTr|LJ-4$zw`8P?dWqkL(qhm0nKd=eM&)c=z>BronFS
zPxx%gkKsqlWH{}i7}_FYHWLTlMCT^b9u9LY9F=&v^oC<r=g=nkhpi)8WY_gUK=Vyo
zX(<ZYoZmm5P1AMPwpSWr1-<`5TVc_Cqs$~V_^r2x2@?xsN@D+^{!S5B3l?>Z$3~28
ztL*<`W26!yflG$lv`*z#VkPL(PI#=w?O13;0`&}Jq*PcrTxpuog~$Ye;PVX;x*A*;
zatWycEq(IE^DL?TNigm^x-s-zgqi_Uh%h0>3?$UERa=cY6JUv`>mVvSYIdQAGziNB
z;2VhSLO~q^yo9$0>d)ur=)_Vj_n!qvb_{cJi<z{Gp%Wje&H{N9Hx_Q|iFP(HAI^7r
zKX)0fzp>qV(F}&**IJ;>=?|8Yw57y)4g4pQtqHTIIt6=|S@={5IWX*CRoh>HXE-NF
z$H9!Kv$~@_y<dEG<aT(!t#E2eUh}MV1;yXJY%t%DX>A?qU|zom&M%)?1$Zjd{p~f2
z#D92m=Pt(z?YW+6LvfS>{x^AoC0Ewu!9nrk%kkqdDj^-N%>V5Lzzw<%KvkrWutQ3O
zb{Z;fn+Y_iDAJMl;W=fpkVp0+f53d3y5Ey2c)sC7H><6KbQ`)aM;=JJo-$loSdL^T
zN`E=5J%s-2V@UA5?aRN7vi#>=^P3^5=LfLVb9)G)6Ipo?Yu(rYJr`0oG0C$+;hi2>
zA4RIfjD=UI$I}$g%)08JehcE)$J1mr1kW#oH*Yl-tUM)CQNXwxw~a}UH6zq}Iy;}f
zdme9ZxtPJkYEiw{MPmA525zB5u?mNnfhub_5qxGIJ7c<tZq~65YMyw}N=EC>T-<@=
z*n({S4qd;+H>oU6ql^i*s5=n$)gX$QM622D*&X-`8;p`-2>Xp-UbIQm@dkjBrFq%M
z1oiA1)*>HWm22^c=d=lsuIRV;&9SYaoPQC8R!If7;rCYoD7?x~;}uM&ReJZ`aUBJ}
zMMyxh0S(sn>(5OxEi9BdrYhw6CZTf+z{+cLrg_jYSLb{O;5XyY!bxmi=Ln_;S!=$k
zugmy8*Z!LC&u_0$T>=&9hKrV2Q?J^qfW7zOr_bsQ=yS`N3(>IFNS)pD0%*dbGd9Us
zL}Gqk<K}u~=MATp@KdV`<;En&sN!!zJ&OVz*%HxQAW}x)R<jHx4Y|Rp{th7wW}jVo
zl)n{$!M(qZyaQEfGdV@NV9A3S&houGMS)fO8Do7>oyLoaXrcT<fcP><Q5J(CMx3F*
zp3&Z^SA?PVn`{6aV1|?+87ibV<bF1Pv);m&Zzp#K(Sg{?qK-)RlF-bRuSYZ(jI~h5
zi>@5D<BB}z#_S66NPRqh3s&;s!$+vgHZ2!d6aMn2kI?2h8GcDh37X=W8p{`SGALKC
zbX=#wU+&GMfrIY_s9WJylcLIEIcyMmYiF2$0*Tz&Tz{eyMf@$8C`{ya@YD0thAx0D
z5gq~3&7;Wv?sk(`jO+;dmnT=byHC|pgyEEC$0~a`^J98ef7lB-AJ1`O%apQk&OxHs
zS5<19zVKq_=yR5I)mnwmPCwE<%Rh=NfUC_3crRGFp1GVKq`8&dCDmuYZd=pl(Q1j`
z7_O+f#l_OoWpBjNS3UC_3n?eR`|>Ai2>opc8t-x<GMw|nTo-mYCJ|?tC!HNdzIKO=
zeAX*@I;0F=<DuRuLAM~{g_aUjAt~Qb+{D?l7e#=1>vLJiqsH^WQpht;NPd07i#ydV
z;N={!$?ARo^04;uywTkKbkx80eDqSWD<$zCqow!;`j>Ma=BL`1`&wp5uP^uQ_2rmx
zNk%be(D~TXtzO>_3R-@ZxZx3REAd*60h@0nqLk#L&==y6ZAw%10meNVPQ?z_eXJ7-
zb8gtRlg~H&6}ddCSpXp#QPXB}P~8UTU7Thab=ADn-LW?opL=J|u!QRvw#2O)Q!7R9
zdntdL9!HuhGB5wO!!MeD+*H&Jb=;t1FeQQMP!7_^I8|r*JG0-O-+6gEHgLH*-->Q@
z${lS)<(cM<$i2bP0$H-t!C?-6aZ^isQWr3o0Sk&aU^DE^7eY)FclwrH)*eP^9zMNK
z)bW>7mJ0QV{)zs%dp5I7I|X8H%+RyayBzlXDwKa{p)<Nr@fA(9!31aa!v;C&zxweg
zV0fmjrKt+7wNtitMg!H;l}*7Hl`{{Q;9zys)0D1Pr{&^5F8&FKUCn-o#vOjV%YV7+
z54nfF0E8z(D$8_av4#sji7^Q){mO+Q>-kJCdRZZ7#4-JgsGnw_2Tk{~@B|z8ZS|uM
zyDm265^IPFs`Z0fc9f`smyxKoX<27vvqbGDW9kOrD7+18;VCYx>Zs(r1l&N09XRh}
z(wOHKz7$AeIQ$SL1t3|<bz=HlB7|&)9|jW9Kndw$4d-MQE{nX_s_Qq~=ZN(nRk!9w
z;Vn|Iud|eqb>mx&C#@3@)kAf3#uS{FX_|Q*;9?Nawe&~20i6rWpaiDhRLkzbX;Jd0
z;b|NutC-r#0M>bS&qBt8<JY!rmquGFuDVKOpyeJ<AbfeUo1Tc$b*N^XWtESK9<E0%
zM&ur>b1!SoSk?DNbLl_Yo{8WwSkP(0Kfv+hLtx3b>p8!Af9h;-Gr=DXf#8TMH}%yc
zi6eIB*`vZ5WWfT{_VC6kaGZ*KVOd=hN3qV&0|numzQ=l6k`eN-kJl;(-_lCm>69H#
z+M;9V+2G7>az_oDo-yh*+aglajB*VU*1t^6HFZ7&#7zINPv(4`Tr~yyM(hE68f5Jt
zwYC08PKz%z1&a;EuPG@Gbjt8l{^jfR@|q55D3?siQ?*~Pmxcap9jPhG^2Sr_l8+{U
z#CCCAjNY?HfC9{W=ld1_>fc|)+Jg$f4W&tH1?Eta$!X5lvy$xJID8N=*{pgUDa<q5
zgUCFW;>vL?`s*&_e8@vKvr(c=AiYvAmHG6%1TXs<AvdRG-Aj^p@iQ4^>bvrMe(f^8
z8eVpu!(q-E{*?%?eM>ye2I1#ZUNNsds&XMh{1QBO2fDwqO-tBnc1odUAEX1g&bdaq
zFWR~=gyXwNK5H3mr2Q0WotlC)s%ALI2|xnqhLQwKLGgTg(XU&lH14G%OA%A0hz_x1
zQUGkJ--?5=@&7qwHA`&y)hy)6xRi0o1;dEmfeg9XiWG1NmqvQ`#*~U^`dd6GjOwkk
ztt5&=`#S<k8X{=KPrrP9xsXQfE53J<2IUobe>XwJbud?!I?eib7uD}yRlOKCuMLsS
zc0{!-u^;+;l}d5)bKFrM)lJq&8_HnxzDBpSAr&Jooz7j7w0m0V8B0c72_NJWy!p>i
zPUwp{CN^j;<nyT)Xod~p53*p}-Fq*!cDiwtClQ$u;`7DGR_D9OQ5gao+H11i{2y${
zwjcF>VM8$awx`4!WP?pw%qOv`buyFL@@*DZBs52)zp|9Ekj8IcFAeqWT26&GlM(V{
zRm?@QPpe3$BZq-x>GBtY)$jH83@b{p0gu5Bd2ucPsh7u#e){KAFc@)C4spS`E!KzV
zU)*_#mu}-NZincjYE$}eutb3-pMI22qbu@Yy!DMLEE<2CjeYZj|8n`JGOX7|0p7~*
zTR^vXMD^)|-rR_u)d~Kv()K5D#<iuPo0i!dE!ba!0;(bV%H<8pTHg!hOm(!=nOCJR
zA~jHoIqjbxe#Ne~U_|pxZWrJ$g=p8X5=_yGh?yD%s#nw#>e<d=@JPh}MypkMzwO~J
z;d>bDE@@tIgmF{Ctmi?IV6DA(Qf<n`<bEX@HEIv6$)0t0wgNlp`Za3@lp}av^9&3L
zdOp1~zN)!(Q9@?3RYu3eYSHQpQv#KoPz9I}0`jY&sQ4KStZ0Wk3kSNtqc{F@OwkQ5
zo+!-Y*CU{wNB_*}__L)+NtOwN|16r}@cB#oK+2D3LkStqm@x;;c9vkVw%X`|9ltt*
zA6Uo$8uBE!P9P(XPltaULoKKfIn-60BluS#{4z_*cN(d7@;%+=(D|2n&#jdp*@dq|
zXf#mA&^Ktk=>Nccphy#azvezH*Fd{_WI!l}-%u3A#e0m?aX^OK^jbSRi7YNwzpE(a
z_`Vrl7xlD~Ic115;ST9pKPp>1$QA`k>_Hw#aK`mO)8LpDr6E{i^jq5`{kS_319nsj
z39bK{EPut|MT;yx&r=viG4^|L($39-H2rMrPOG+)Z$gop8{ZFOn~@2Yr4Lj&Hh#VH
zabw~p7-LNUM<AjjcPmb)z(!ex7SPX`e#@=!^GuiZuO(?syy%)fO2(sfj<4JK2a996
zz?qiw(JP`rX?4Wt^8)Tesz+z#vAw0>>{Z1kA-mSGX+zYqshhH0Ak$AQ;lhfu-8aE|
zl6@y7pA%f`C&yHupZk<vALEHCrp$c#@z2n_y%Ei|$kW)D@bIVYoZ)akV`jg*a{>bh
zi8&I^@y+=w4~Y$cO9710kT*5k!~bO{JBD4(@u}tckbhEd(uADGnxxcCVnG1=XGQPx
z9w+Sw)Eoi=;Zd`zFN&F%b=lO#YB_L_8sHhpf^H9WYnu_`DABj`|6oOw(ZQ<2veM&t
zr*fn;kHV)2p+iXmvhk)GY6hm8L<5qW+7dc*!qES4MSp+?<*eM%<~=ae{O9ehy4pmB
z#6!m5$1|QyhginvvV6MW=l1;UVLsMPKz$TSIxXW+Q4USwXl`X+oS?AcblmOj2SkyG
zjB4Q#sZ#ixu&R;icdxHgb#@)~!E3TFW=R-Vv`4D=>&t_tru1i(lA%RVQC{>ZiRWLR
z_!jCkgAz$lbB>FzJryaK2~L7s#b))Y=1h065y^m<VHai(_T60Mxz;^Z5ODnyF4M-E
zX=_FYl@vvGba>i%qqm^?fYcFz9RO5TFR9#bVA1r-@BLlbyQ$zeaXpT%>Y@iHJg~tx
z4q&cq%gaBlOMQb;$7nUh$c>FZuPvMd?DJZj3y>QxCYFDP(!G{XnN8~f6R>t2CVb!a
zChzqQ3Yqq(3g(=lX#Tz)Xi6#W!%rL%41u)rP|5x_xwx)tHis-d5@xl@NI?Tj)HVP?
z{Z<}A)O`9e-ej_8LyVBAQ95f*e?S)>;KBm9W-n2Mez=6O#Qg?a_&ubnXW{v4{Zfc?
zMr1TO>#Y_o?eZ%WIt`s%W4E&l$XzzUV~{qgU+)rTsZ5(6+A%PNl9|F@v57&Q4WEXb
zup5{8<V$TL7~`aLGb?dlj0c^GppAVv`1TBFHnAq5DraZ(h%JH&=?J-SeP%sD=GK#P
zQ<GoDt*T4t;vLY3gk@^?cPWRH^hZWS+j+556_g^V^Z$O{eh&k_c^jclVbxEpsqyV1
zrf*YF<CcX-{g1h3oZgD%eID4gY!QJ5@Io<wTphpDJGhbI<UXQ1*l)O=8{Y)Y0F2kV
z{@BVN(5$Q>Rw33QzVamJj*RLNKG-%;<b}$a;AmM~ZGK8<r#HdHo;myOi|>wnFt4*!
z4!5%gzK7%F9|S&lJela#al1mIne~w=NBbZ2xO^+S|2Z~m!$LB0V;eX`qPL`jeW96-
z>|LG7+t$`IiKJyzHR2Re4gbKFU%l)VYzH)1{SO$_<PhO%I#3KGM>Fn`IKsq42)DZE
z`<mZ;4!kHD5CT2&wMspoK_kw50u5Vibf{xuZ(=Rg@u%)Utq4_=`abgabo+$oTOpP6
zCdxWt7Kmbrl3;LsT&*F8S`z)em>uHFHxMLLY@Fy3JY`QQ!E9peN*eM6OX_Ud$v=;M
zIqTfq15Izoskn+7MCSP{D#8)m^%AEK&Y|h_F1glugP2CIePs@5@J<PDwE1%^4_vSe
zAFg}(zVs3iGCv4?an8TacJ`Ipx&L@Trx-#3%c7=f=6ZNIG`igI)fF0zTs=%CcEJtQ
zB=8L(cira}?t*agtsUTC2mkYb$-C$BaO0BMsj=d|(cXLn9ey-~K$`LG1vB4|x%f0!
z7ji#w+4XSw+IbX%#2x~(_#pxItpx^VGKGxlB)Jou)h)&x+hXSet3|a9e&cUa{&84q
z(ottF3tQ6GR4!O@bCkaACK4?BtRx;4FVs1=5V|WrHb%!*8!%c)%fHsu?Z=cgN7iPY
zPjpd502)Thp)Z~6@R?`QRX<1_D!bJExWwfAQgX_km1v&<WXLL6uEMI&40g)uQV(}z
zE|8OGSx<67O?wjJc^rr^ngt`Qf0W>ilb74HztkdHkof12!jVx3Q5bLtF$qtGR3|9r
zqreDAX}+bjxTIHFHR~(}bI22Ma87lA)JWzncE^MmMX4hadcNekvz=DlCJY{J{l|>-
zzn^P|9^B!;KmI(1vymdX9OIQt?hd<PRlI?>=7^mUh>q{86~JSi;Aj{4G!`Bu3w3g*
z)Nub<IS~aTQpXi2wbN@Z5X}9Pj!~X7H$@gfhwvV#!QiEOCnfS&zA(J5y5Gm}ULvTX
z|GSW8ZCR~}$(f>QM{f#8zvrak62`xXxYX0}GQZp<s~nW)4KTf6?Ri+sL$3B4%EM?|
zTAh)nVa<5$BPb1`Q+Sm1Ws4GPWJ(cyY0fr}lz5a`f;=gbCglk|6FEXO92uRWTd?9B
znJfDn*9V9&hQ{AS;(q9`r<_8$^>kAM7)zBRzjIr+4sHqU7Xq9H2~t0+g>llKo320l
z=4d?jMLIIV*uq;aQR-$EZg5C2s|l#_$N5_1t!7IZ)Kx3f@JJ4#oo~GG-xi1c=t1B#
zDf^Mw>AlB<c>6M(a_uJ_V)E9s_A_QIIAYmWfeX5$>m+HOb*0|coesu1P<8=03tQCM
znx{v~qC<{qY%SStiG<#Udws<{7n=m{awPKmpEu&J?w2Wj9u?0!`}~r1mNc*qBaWHW
zyY=)@?av8fNmBPU9MO&BSN;1hqG3FpL-LF+kPz3+hmtc+jqAN_8QR)_kQ<=@=S4h^
z!H%D3CqYjA%QVfc)uO3ve+-o<{B?u8^)oPjJV66`Us=C}H?h<O=A=Hx%(knyj$1ob
zgiwUcwn4-#FHn|V?Zbaq3QryJeNFPv(Vg&fR>wJEn+P0+rbZwOuj-gO<n+>{d(gJ|
z>L99_-P1`Y<lM^V9kk9>zf3lR<C|ha0{V=;(>z=)F<G+@^5z#aU#2@oH=oo3x}VPh
zbttcvUgKhu33|%YA$CD68lc;`Ao2*4{$ZB~VNBc8pb7<=6+4>lxYG1p%hBhhNAUtI
zkh;&_$O#jC#G#n6;19Ly{jkgEwAms}tFgezbv|!Tnj=vfC4D<F))E&7Jav4YuJp?v
z=)MXKMZPtAya-`LJ<0Fmg-la~VZUquLVW9xGjC0Na35+c?0&;OpLPpQbJ&DaDowox
zu_09a%BVim_eOxt_d4;g1)9~OosY+3uc7Ewcx?5^u_?%^Ll-it*UNsNE`B*cpp)Ct
zdq2*{+5E~nF!0Bh#O5{omXdnCh~9mI3(o^@8;+B|VF`S{6-YmWCcKT_cueBN|IM`(
z>wa!KKN~JnR&R#N2V!qcI&5msx6s(9S|~(L;HzrS`%JishbDfio)E{!c@nhk$y$4N
z!9)F6G0;U3j5n^5+KTt65AeGV+huCiih4M;NrVdPd>$z+Nw4&#hAz6r=t-Urd%5JG
z1kYd_5ZIOQwWRuFp4yQ4BA?rzPF5bW3tSD0V0VSQJfDv7bW1$mAM&)VCPGD{5e{7s
z#RJ{npDwUM0QwQ>L`~6)z_DSu4NxqmlWwW*0x^DKLeKib0bb(Sgsm!+x6Dt?kv=5<
zwy|E{fC-wGFs40*Uj4TQvQA)u*CYAr@uK@)6w*r(=!ZuU=ZsjjP!^SNk!Awm-<T}G
znk^#|SiIA#qty3GMifaLLn-f65n_yFs{YM8&neO}gC>)02gOHqYy;c+Fksn18XLZ7
ztwm~(|7ZW)+E-CA-;Tgq*{qdO28c^!464X-<AFm`bR%VgTKTIdbylI0*f*Tl)99Xy
z(2>h)US#Fl@Jdv@^n5gDLPOY(8|YANCl(2@`#&qkFp0&>xSLr_Gn4s7VtyUhx$tJ8
z(h@DZ3=|4c@tj)ZYs}qUy4`V?X~)khJReV+;+o}*S~zk4RV(Rwc08@S{ucZ~Z7Pbv
zs#hI)8PPhmOync(?^uwi^jaA1C(|7rN1&rN9^mjIx1#tbov(fTYYL7(5wV`swEqD4
z)3o<kg?IQFtI*mxLzhGyZbfaOMrLy~|FFlxKoF#D<A@Q`)$y0q#kf8!mY=f`Vmue_
zoG$rh{2ZhEDE~vkQwp%1keQb1)-Q+Eb;00&BTT~TV-`yl+sNR+|ASy^$!?0O#6_Z$
z&WVETRM$nZjiV9>s?O6#F#iw0gd|CTNjv+RP6FrfG4UZmf|N?sSbEHO7qgr4R^8m#
zj3jJ>+{$%e1U-lBIcA9>9(9A@Iglzw<E=KHEZfdk$fUH9VQ*`#md4H>qIL|j>7G@Y
zgxJLEE?gQj)_xOqN5~j<Ktgi05$hpW<<jg%EdS3BoA+3yo9=Pz@;GdT;8aF81LA>&
z1TB4S@tg2q1{Fk{5ilc7S^4hs+QNeIeE9p!1;MnQI_?tVgE8Zc^$D5Wn-r-_i*JF-
z@7^$ND}{MR^QfN%rRsSH@oX;0dl5(IGHOo>`y1)jrxUYgDK({$z3t!oRcWP?c6D2q
z=GGskZ#b0S6h)Dh2-7fy53w7MgDv*##*PTeD-N3uJInU_1B-*pTTnejUHb+l)tsYk
z`T_kl^Rq2^@oE7@Z2Yn#XylF$r%H5@g-F=kdXd62>RqBDaiNU*$=Y**Xc_b|)`W=x
z$#NpxS-5KW)-Gkk3hx$ZTUAh`04g-DI>YO}PN|`Q9%8`4b1d#cX#5)JnxtvsH|X>R
z^I&{U(DAv{TD$^81L(}fupr@MLLV^0CC<{y0f9`uECL;=N>b=EfM{$G6$+MKM2_Qm
zYDI$q4W}ru$|~8Yy%UGtiJJ*zX!l4yjlHpe^jHw?++)2Ha{880$<o5VS&2&fD>~l5
zb0bWRE3&s1p`KfDH18ms86IBW>-I5wensZS3*lYmdTVxSwSl?@TFPX{#a-~J2KjD_
zb+P{gd09SdPrqg3PLVoFpB1SGPFFgCs^wElp}U27JTG9O$VJ)bm-9t^S!B7XN?3{o
zBn7E)?flEGiPQlv#!S8k9Qy~KqKiU6s{1EGE1cRfcWbl`I0qF>;fQdRQtuk)qs?Rx
z>P^?}&yo&_SxK)N)$uW0e@;@WW;naI`ayG1*w5|dhV6tCCrd8=<7yR{z$Z@p0E4Rf
zf()x!>a~wCn!u+iZu}1>h4n&$8C7j2A6=%Pj2;P)ZWdDO;RBkkU(vJIMVzU96jgs3
z{~kNTxvULC$)fOAHWRN+;%w<<^3O4=;bK^6@8*&t_+jpbN@3EW;KW!*=DMTwNav8(
zxya$X03gywDtej+P%krWdl}r(fBhmgnE<%HXrn@9Zv2?u>z5$6n4Xlz8*3w-sY(Xn
zg+Syo1@jjY-evcBbD`a?7ZN@SZRPRcsv0_9qE9^@^;MR>-+-Qh)jdv!wx3UVyqpK1
zcVVJy0An*EEi?KvI5dQ)<;lwZn^@*$`Crjcna~u51~QD+0Ls0cY27lvW-1Cv*4<z-
z+=*Xo$4$QvIVj{bDP-NMLmqK^P9w5m-Cy8%c^2y%+?oa&d1k@WUvd-njs1t@>$-T?
z>t;4@9*1}pJw`R7b8lJlE4usj=B2&MjwU9n_XnQJk1H#=BZi2L-=!36#X=8<>GgX5
z89l~s-4*|lv`^lAXh)p(uD{({G>)06zQA53xVEbOO)~3W(G(F+o`2QYE(yflVd-hx
z>a?;~&UQ7E{j;4>KEC4I+9_G4xy%!v;HX`$+FR%VpP`S|gDn7CDZbu}@kL#~gFC_O
zF1>P-vz#GKI-3MC7@`$=2Cz|5QV&RNk^^&R$(tMG!?Nkulo;leaLaej+9rcXrWj=V
zbnk|ic2kww5+728rn);rpogcAu$DuJ`jA8`z#W}viG4}lKoE#JI)DXH5j#`&@HPJ?
z7^;k%PtvuHBt&pG5idCFO;h7sT9QOg&g=TP{`J#;41m7SnOhPpv5*YgNKD%8tjm4z
zOttd=1Syi0{)H?6mIU~2F?PZjC(z|EsDsX^=LM_KZp8tf5vz&M<t1Yly!Qtsr&Cfd
zG-#qMIc(sI#h4A!`eSNuDwz3hr*YiUH^LOV7!9FGv<Aq3!RAzc0k$ol1k58H+o#2U
zzGfW$>X*iKOuFMZl4Sr^;M&^Jm;a$ppw)T-Apuf=tp~zd`&_F^ked%F%aT6-eyK4*
zB^N$vBtQ9nu3+{y2>-<#OS1UnCm$S#B4pipq=uT_Hu>>!oD^n0LhsJ*@-lRip6b@+
zFnQ*g{T!6))UJ9%zo?tiuH0F=n9Ffd<6b51l9+GU(X}}d{aEj?BBr11+3={_&|(#C
z$2}ea2zDIIl4v|R=H{x`jBEV4nm7_4!5850EKn)#Hncbj)tbe)tj$52ob560OlG0q
z6)lYp*RXMlFZ|Tnq-6P92qE<ORO_6)PNXNy9d;;TQTf(>T^bztoR;Nz{x!OP-GFY%
z7{LkJi^WlGRouy~b@Wo=5Qd#&GTChTf^#WL$tWVYReS0SO8%a72p=pW{gV)8N^xnM
z1mHgsM99$ywu(~(8uv}}IiLDIU%i}4J@dS*yj+Fs26f>~5&T!xpe8w#hz*?4MYY-e
zveE6F#us8DuXfQ}CkhN3+>t#Y;a5}m!?c#*!b_n#v2^y|X%wOrn=y&`_N|{Vj3%K0
zsycOnY~>e-ZV>2UKF^fp_;$1(<z(M}Rn(>Hm)EEoqA*8@F;ps_!J-%dIEB&@n2lWB
zPg;Q!UXjQ51N(e8IbU<L`l5uLe|I{~z)PK|g-Y&mMNT~Lqh*Q2iGgJf6?H*Umb0~&
zRp{p~ld~oD8#@igyA~eK;}&0toFiqw(3jKafA(Ilj!;BWQ+Koc<Tt<4TU-0%B(>FC
zDOZqV^3U*ApqJ2fJ_Vrjtf#|8ZU_Ez!Z?38Fz)nmJm*!gkm_op&BWtlB&BLyQ9T2?
z!^ON<Lj9yw-ssEond3jes_B(Y@iq2LNF0IUiti7Gm&^R;Km9Lf-7l`)?EO;ns9(+E
z<1NUU-{N9!B0;KeX~E?KNmG6!avdgnNLw4o0P;GO9Q@WTs{&q=3pY3;Edv1Lov>SH
z4@OSI!>~n}87>h;pi8kWyomW{R9JRW+|b#P_hRUUjl=*#TR1OhJq+Hlqc_Wl|GdSV
zD|i8b*Tr%M6P@Z3^Zs9aeP=jaZP=||qKp=uAwr1gonZ)xh#pChsL`T#M(>&EQ4*pJ
z5k&Of&FH=NUIwEx>gdP&zTbD9Kj%8v{y%f={p{!2>%P}o_uA1_eD>>T@b`Tu`Jc;#
zoopI%^!vpQvcJ<LA~fhgW$emH6GrRdO!r4z133Fkwi73HUGW}d6bHR$JbXz#b^E?D
zi<-pevN)q7TDRpr0bMkwv)>D6GdnZfnXG?*b2)+$;X%2iHaw?wqnyh7zCE~5$Y_=u
z^xb}Npz?<(4p`RKj~QJ4=>d{b5Sn-3a9i%b+_lDCa6M0aee-Tg;Sk%#kc5)a)Nh1V
zZ8#F|-T`zULO|Nk{%{@YH`=LxxZ8DW4Q8T0RPPdh6QRNk*lNJ=dcPv<@*04F+~ux^
zs}|la;xU=9eBt>Th~MJas_~?#^ZqGdNdzp;(tLAcMX|HUJ9nFS)3gguh-#;`iBrh{
z&@l-Tn2=cJNO*pqJB4jMRVzHLJ#e_$HS-`LNCPw{@E+ZloI+sXPA93~n(;sPc`GW|
zPsqsZ2c6`}VJ1~%G)6worG*Vg3Ej{<f3hq*B9aLI-ccT{Tq__T0B{t30N--ZS`Ie@
zZAClX9e0Rk*2nrF-|iywnkVy9O=q6N%fFHoFRUs>U(inZInelN51aKs#hvKoT&O?3
zE-W7+sWbFKnaPxR<vB;0wVZ$SQkSWwIF2a8+163Rf2V2?)NUAxWR$$+&=}v^z1gk(
zt=l#%FLPs06|Kw~|F?`DHzZqtAG+xf9TYFn%z4g!{IanMtHj<xN|#imv*Xb`brADV
zjjG##SdguCvTA|HTUCaarZ4bVZ$vIPQMaT<KhT`B>hsZntj~`cPoE<U&`aEZ*b>Kf
z@Gpq~@^^kW#bXG^k`D*gELnn_9{I;i*g@V$z;XJetfx{i4A;Bok9#5`*=nmy>3x1{
z0?fwxJ6`59gsI$@wpQwqlC4;hYaCz@q|<G?kzZJHkoVv{>tRa>E&uf)zyw*q(fNPv
zN69?@*^gMk_%{l%$I=;~Wn?hamW>qz?o=eE55hi7H$p|XmteXc=&R27<P_#`)ieL&
zN-<W)l>!>b@s?sD?)7b1G@e(3Io&p65i73>DowLG33$L-Io|=+LZ?HVukz-^oPdmn
zxuW7)+g(!x;vV<W9+~h&wN&TAH1Sc(;}>S+Kp6YI)CVzOZSuNekEty3uUK@AxQc<&
zQ{g;kP2QC9#qg(TZ(@@w_G#YdVs9ue`X1k$Rev5~PEHWiXa>RC6-d(w-#<&&A8I<Y
zJ`JBY(~@ThlEN=ERu#lK2GKU4a27cKvW3zovi9fWiL()HMico1C@?};36=(P3Kd!m
zC2K_|^{>|29JVEoutRO-e#A+#W)4O!xg@`5izaJT3dRyP`4nmzBe*6c)EbC>##S6%
zH{3==wtOyRotK()9IP`YW=u!KA-w!NC=%vNaKx5pE#2HeCZ@&fOQk<Szyu)>)$~p{
zQhza;NqG(m_wVMa`A6FHul}i;;M1p*PGr3En-UTK#+}gp^BO2B33!xrZU0_fQL5Os
zCzHCx`E{TaXLIs1T=Gbzm|d-mG@_KF{dNac+&0FxouE0Y0M!rhZSm$V7m_V`1aH>n
zdFwIH@~)<ath~v_?{AUbqp{M@HjfzzlRvC_;SJk}8gZC+eATEFo}kZ-_OO#TUd4N}
z*=uGll`j!1x|8$a{kROC`HQ6$S}_XuZ4bZSSlWFSO-^`KuW6y-Ck1LJ-O{zv@beOb
zq=%igFIm_&c(>@kTZ=~MF13xj1j?yI=@aiv&M`i9A+yD?;jwwf>zMc9Xj!q?T8yE?
z7ti~i_-qLI+O<f;^N5k0M}qvR=B;Lk1Tsb%A3W^RDznJ_CV560n$$OYGtBk!L&baL
zk!e0`yO?P){bDwGK0N(0@NA6r)st$CBQts~@Urik5X)F4Q79T2zx2e%xd-__9-@{h
ze@x2%$3s+g?;#3{+3JxY!Yw9i8g@6mhs%w_A@GvWK$w?2UFoyo%BXw8i0GvJS!bux
z&=V8^Bblj1dAjl6jEesb{U(A&iU_h~t09r;!<OXf#BR2oE6E`?5vj;7Pg1c&_S>zu
z#?KOv?O0=SeWB#W`nbCsfp!90@G5w!!_Tm+67O`8{AU&->!4iEm@G>wI7!?yx+lL+
zSP_;}&g=_{Gi}_@LYWDx28JQI={3cyD++k&;8r~~-+wFBK*A8>b*U?xP-=)8g_#(4
z8&puXM>PIfmo<+%(l|<)y3^-qK0k%Y+Fh}8!rlHD>-6Eq{GUeLsysIhT+~D2-YlH8
z@MZO%`#p5)NHY2Fsa050vrSuwo`#LZ8i~c}89&$=HW}+Xz&o}a4SZVc=|@7_IMYD;
zWX>pVP)u9w&8UaYYLDhL$%B79Jm0>EHdH&uYsekR2v}oQaOL>1GTN4L$&om@aqKrQ
zh8fu`H^iu~DTMxCNj3uin`8sJPqMk6jrdQJ&Arhi^lp}AsnwwG6zA&0HDR;RxBMf}
zBLHzUXn2Bp{bu|7;;Wo=wSN?Xe%68E@dKT-QNbUrb#Q-O6o)bCTqZQvvmmeQx){Ld
zlS;UXym{v(q)0<V7MO-?E<u&!eQj9fwgU4sYR}4Ey`88Fx;5x_cD;)#vm-6?qTAj6
za^>W?zVwjpN%Y@PL(t!~2}oQjp!vdf>!VC4!*8V_Yn!}>)*o>Kn!G5^g}*rK*{U{u
z&%Ck5uI6VcpJH*$=@P2vpDMyWjm+9R_#s;3A)z()w5z%9lV{IsJ8dkR?sC?4IUdTQ
z4rN#NXL4wcD`K#GT)?r;N?e4rO1aDnONY45-aFoh!WWK0vHKy|lBkU2JJCC~y(aku
z>5AH?hU0{szpY$Y@UDoP`2v}&f*zJgCH0r(#?Gb|#)sUTicSclkH3*zaZsVhtCjKZ
zlb4>=R!2@+4+jy*OS{>DinoFZCCR6*?~9Dp`;s2iXQ6)|NVFVBey31frjXn}s3&5P
zM~EoBPo@!dGL^5#=e!T58HkiD+#&iD*2|<tVrBGCE=^kziIOEWE*7+G;F4EazC>8q
z!mVbpRszP%KBost_F@m$OaCwJ<vS^FCvM63xGHGHNI;ycEYm{JL3sXv{a1N=t2{}k
zUSg<razZQd#orpi6oy=IK}A=gB5vhoxv?=+-s+VCFL+j@sUn|bNAmcYb>Y=y=~;zd
zUhR(?ZDr~zV2rM^W={aQLzJ*Kc9ba&DdK}}dGneP5`Z`2L{+}t?Mj|1)9+e1vCjZM
z(4zMI`1{W)@u@HFyXc;LR=K<h{dXRnIDB>=XvNMtqr@(|a-<G`!fk0L6uG27^5We-
zj5M>o*Z4V}UFpslHbP)%m16!WX61WgWrEY6M~iWF4YSTa+Z?i8tn}Qo&N8N+|7OP=
z&%Q{$3~+GAhxb)6d?brA-3c<Jc7_lk-!MCsW=oTS=ETE~w>};I<I2g+`O~dTFKF)+
zjtnZc))QY%<9Ec^8i`{m#x~+kzuF=CN>5CeDHy|HmrMI#>ZK_?JE<2I?ACp{_GgM)
z5AMy<W{cy8L+nB|5{*WSQiBcT_29AZB?1V#g3&T|YfC(>!LJJuotO3w1HRSK+-2Nk
z#H`+H*Nzw(eyK$GOifS@`}+>+!d<*!iKkfcgcwFn<Wb1m50KCAGA-QcWA#F@F5X%5
zQHL@{-bKa0-zz?xXyTnh+-~{lUg>$6KFc7<vFttjY^6fL{G*Y>=|i|iNDfXmM!Ptb
zXtYMEsPEv$IoLrV->h+%C#UpP*Hc>LiB5*zQO;n4t*ru&W5~pyINyk8<;EPhR?<-d
z!5?JNh^=u>tc!*c(|QWHw!~hTpgk40;u)Lhwv*;|c<1s(m2(NRAmTlr*5cFg-@^{d
zuqjyo+2N2^nC&ZiitsD?jU=u|2H%M;Nm>4+<&*RlO5PB2IQcSbKvf{TDBLl_$-uH9
zO4iG{L!M7EUf$hj%5!XGKR;Epzktx29(K@f*?)Z(sLIU0h2<4>RdBslf>s}^*2lz?
zFCQU*jG*5i!#6aIundm700MbEsiCbpw}A*;?XPp1mVuI3zuZ&qjX3_J1Ee8*^31It
zezvc82B}Rwmtmn33^?WzDF2yvp(ua}aG-y^b)QNmcjr=(%KVTb^L6r0-v~2y9yZ7t
zDfq7V(L2xo>b>Sf0=-Znei6$-F(a2wPNR#-@!P_H{+6VszetPrKYx{`T-A=oKw26z
zrL~qqSfA5*rmK2-!+7#p929X~t7bS=4>~Hn>dBPzp4odxnHji$5W8eoR)UVuEV0lB
zLS1M9oH>IRrl>6yuyAy*T&E-B4{fea6?6>Xl?wf2neT-x`C(Y|jQ4I)QSRzIf0^Rt
zj6+||$4-7J<WRn%R&|u(9#Y!-X8b8HB@AXh_*s&?g|}0zQ|h9P-T*E04%bX^_Jg~x
zP2C1!$fnTdqY>$mYvA6XGf?9AYw>%Z4R0~hmh70ZQm+B+MC#9@j5$Nx0)$FhrTk&T
zS(F*E7%c<+CEn<i<r7&a6~6vj4TS#|8S$BNs}Wx5I_3pHo*jW~xg}<GrjHEIhJ<Fd
zD1!LW!`MK!!RzG^m?YvpuSRY&1-|tYC`$T|M+b{EPi*|BJf6u$(?e4y$To!J6{yzi
zB@MaJ8oCRKcp-U+ZgApHw7`Xea!HKRbz2k^+OvI~yrc`|aUEXqQshMb!?*u)l?D>D
zYUR8D5+oWd4}z(k4)lD(^>>&xXyjZgwJ7p_&~dw331t)LE%<345<GdEN%n4U!@9hT
zVY!*+AsF*#9xe35J`)90d3uxOsIhDP>;lqn-%(+nNq!W;>;!j07QUTm`Uh&$eU@)~
z1ytc5UV2?2Y;3w2HMZU;Mdzv~lwj>&r#UPkyUM4afpeVAulu|a+}OOu;Vk_yjj`q7
z8Ug#w&h5uJAfI)9cMI3{x(cm}**s^IA+-;;Ka-U;)-Zxw&4?*Bye2vk0=^fx00LF%
zeQCKj953&4Em@|nqYM5lJPB3c68UOr(;6c|*)SN=XC^3DjGZDr84v5i2~qYRO(z6z
zwVUnY!$j%Q1g$+<IvhzF8d-|7unDjo%{P_-_7c@Tl2W4380mrk^!Q~2$!tjTV1wpm
z8PeZo?W(QMa83oq!DciYkK5Hq;L7Q&Yi2ah$n@M?;$ttcvk&`@Rr%SBT&rJ!9!i-v
z{0`jdi}XgNxt3^udZ#l!AqEj>ag~%U2|kKbLb$&I<3AFgwLQy=8i1eMKUho@y)5uI
z@qT+}35tss53jf!Zq^Xl`mDRi7WX7Q`0BXEmnoQ|t;{gx-M0pg!9RYa&9ATIa-sL>
zssy?H=WSo#bgrauTo@bqY82g5mqX{Yt)H^M^DOh1p*BByeAbaSd*!3^{tk=6xJUJ6
zW4*{T#gADUuB<~fuQS}r=eP2-4MoJm5`A;vYbi2hONC8KqNdIMcTmZ1aX=`q#l3pw
zl|TRE5?5DPIv~jFewc2oI(5=u7z~P!t%al#=SPDA$q>_GDo}AOvg7>YAXH=RVF!Mf
zzd;}bNkw3#>p$B1fhA)EX!VG(l>*C#3&TV7^24E5KRuWuFU+kG$<6IN>~x=3!ZG+?
zRLnh>tT$fgLk||siiK~KnEcy`_-|E;gL1?WtI1Ps$-`27jd<<BAo`|z1yTZo-G(4-
zfXT$x{p;>Q_GgJSa-n?11+w>RhzIz=)U|G0PdM>KFI2*;Ta}>;v$B;wX2huT`XSlo
z!r1)|aRM`b)k)tzaE)#$)Q3<93w3_^b~Um{$3vVDI7{UC4P+DZHH6sI<o0gH=bTlg
zdacxv_1tJbqM@%Tu~uA-5r>=p5{rOzb8JVTt@MsUtxfPVLoT-Si<H$Pmlp~3K0py9
zrlZH$@~y{vciDylpGTJELsDqDI25Iqbi>pA%_4$9me3z{3dUP9X7_T%fPTMtc>mQ&
zoLMVnl8n>o8@k5GMAkKz#cs}lW7XN!d{?>fewuG<P;zcnmNZo?$k6kh5E95qrVf*~
zdgh*2zEu&$Q+@`da#d>YW4&H2Rp#eq58RcM<8p9Mtz*TdkEERbawvb4dp#>phGoAu
zCM7elA`-|-9vr6~L*-{wIYBw`MU_J^*vsJ6jXI?#>H~ZQ2zN&ol{k+8m;TgMI`S=1
zZW6iSWys)MXi?13+H&p8>&W}->m>J{p1#au+&nX5IvOf+oRk<1D??j3ux`EZPjQ+?
zsxy;+35b#i10O!IbtF8{X~*Q-t?f08$Tt24Nc|XM9wdFZfh!nbw9h#>|MQt_-{K2p
zk%mvj?TQnDJWJC2d-W9=>6_%|Qj1UjmR@+JP)35pSCZ5~5MHMWu@|`Wp%Bsti7<V|
zqoII2!j&5I8Qpo5#C7NKPhmqNMr`tKR@^CQ7be9YNJ;N`g1+)5b5u5RoiPo(9Sj(7
z#_!Ur>0}gsUwW-tq}R5%K^Kt@Of}o+dpI9(`t(SBrIxJSHT_K;N|K+5Kx**n+<0Af
zfJHVrUf=+=L!>*HlV38jQg-+9g6FIW2)_R2v;2fSXsfuakBz=;Y&CFv5tVuTHe&-J
zE`f^O`oKPRW{|L-fY6Q~){3WRQ_e>n>Ocqa$EEF05K!j&&)I~`_U_s?BrKIH-=Wgd
zSoYf`7(&8U#!97ceHxzwaX%;^E3<GtUdz&d`NHgOfygor1ZsgrF~ot6kH$8rhI0%i
zbWeNd)_+p6bpzgaaJVfz((YsGi*?&3dXkdEF?_#zje$f_?&8dTtqTPy_3QB;0AaA*
zz2@$<3yCvQ|CkU{!3+Dv5+~}qby<+-g9#yzALI|`%}|5eT9my)uf01$P`0}!TRSb=
zZFbK6^U=v_&Z`tZvRYbt$69JNS!ZJvcMoNKA;99JbS0!~I&3hzdi?%R?Ua`pRc$QE
zr;N;2*`gJzu+d2bWk1j!7Hupq0_Q4b{Tt07Dt^AoohL%i(If-ig6vJNmz{pl@zPg^
zh9!ZH=&~;8gqiUwE)2_d@M;OJBmNG(4U<R%OKWcxu?8bo8{bNEy1icebEV(1{7vE$
zDYH{rfcHj36yfl8aB<Wb&%_hsOv{GhkrIKbP=S^Z-8t!?=RwjMS>H%XD{;9|&smLR
z$PJ~ow_~?SS<iymv{<iO0c>qay;;VHC!5nFa2sHX?pvk|VH}@;Y}b71vIhepY~}mR
zp;Oa)0;dJ*GB_+jF^GqczU?s0Og0W1Dr^xyHE3{j7kmc@8>96jqwhGCk)?V|^=|a!
z6<w=V^E-M@z1wS_-xOOf?`pO2G`zIB4duSHPS2`~Ij&7p=d*CkHLDeEtr+hXZOqph
z8kFEy4^4Q+7`(Lkz`@$BX#Nc^9Xbl4S?s!!$2?c^wE*2g%+kNF+567S)7M;Y*%fjF
zA+|R46(xrPl>AYP6CJL8Qh%yIGR$kXtG3|?(4EHCH&>5%XM4*%pK}jC1DA+ZXyY^E
zO%^VsVDf=WH!=#^m}lxT@$Avrugv;O2wtra|4Q9d=&QuS$A#y&RKn*SwXq!AJJVo?
zjYY}L>N)O(yZ|o?Kv(nmO4pYC^0enqE9BB<4<{wPhroza!ROVn7~>2D7fWLKwL+?8
zgZN=D0v-XYbSzPRM4Qp<X(m0Rq+9u6rlJ<>&1zXJzteQd{fzaSOtP;`MVPv()~rHl
z{pi21I=F*@d0Ea*wuXc}BiLH4P*TV?28&hda66%fKv9-}eL4YFeb%B)xJf7{))-7A
zXcF4kV)o?WgoSeE{ksntq3m8e`stmySHb#Q<B;J7xGK_lWb(t2eef;Y`}2APEb~C<
zef&GQ58SuiKFP^c^PaF~A_Ha;lmMMN1MAr2iR&Y$(f6`|uv)8<?P{eidg#Tn=4rEx
zL<!;Vv4n!vK?Yn@H^`=>kOAo={(}-`IV1%6t;UQb9c+YYcW^mEJ3fY@p>1W=Xnbww
zl03ybjtTL(fk%j&ry=W>9v{$6O3RFW1ss;Xa(}x3N#{<RoX4h|;jt+zCVWG-x$f&Y
z)R%=3O#v3{ib<)I(=1@;yie*t7%^xPlQ(T8&e9+xTvN`YJV{fwjQob-r#Si%3q<Zx
zt#umt%n-#$mJpU|fXu>GJBqw-yMH01I3x!d;jw)b_ZC?JR2u)|VX39i7-q<+DLLq#
zv349K(ER9`nN5h0bH8Y})l9D*QA`&$^<yK|h8Ad(%8yCC#tNAf`cn9ES1r@BRAh6t
zT%Bhy#PlSSNp}0lDVd5vbA09F&Ks^*Fd(K>fg*#-CC*%^?w2;}x{euly4XSSq;BQp
zU+I5$4vGak!SFoJR@v<Fcl3MU3@{ZRKlR}$I;3}k?Yu?uD-#zaRe*}zXgyLwR_@C^
zAKXFLlw-g*Pxo|nSd_5!+Uf9qI9Fl;1$Mn4!J=^WFOHfN9YC;u4yb>AC+Jp2aku?@
zzF&yDxp9*08p{8elIo(bxONKEzN||gaxG<Zbs~D}K`F_3WOiDYE&waoSZ94!<@2?p
z<tkmOS0QGs0Wqs~ONn@j4ic#MlS-Z6x@po4r~eY8ba1FwguKQ3wCjhY^Yfx76+VAh
zcTi=9!n}Yf!@pY^GXaSy&D^9(Su49;2T2to_Tm;oCey8W892ryvz80v<Bv6~Ay`vV
z4Qug+a!${4@kRoH^@O$GlaAE@uG!MCe3$)j{-GDLccFxSn;XJWNBB<_SQ)30qXABU
zMT(5eG?r0?@45=x!?Idm2=!l+<@0KZkTJUj#^i@krATvck(xXq#cRA=Z7DrE(q(mm
zu}~mX#go(5E)zG`gX8-)dEP+1^0Ze>T`zyIfSyf`$H@P?Q6%|rj!gyU(9x6n_J<7S
zNX@31@}PxKx8>qvkyxwEH_YNOYZ)O-yU~q2OQT!R@*TV@96ls%6d`$M_#Vkyxw_9>
z15%TaM&{$q-L!4B19Xd*M{Wd7!<QJ<T_CT_C)N>51jfW?UuUQ6rIp-n3|ze1m35JZ
zeC`05x?vXHXOISe`57`u)Ltve=pxE8un^Vtayik*sc>)(P3G9;?ZU@f+;@;GFuXP#
zU4>iQ@rOzJCiP3w!#mp!Us%R`y2xX6Nc>Ikopbb1uLTQCj{Gw$J}Clr*2xUi&SSoK
zzx%e#dR>+3Vg~WECCZ3P<XzX;{itFQw|P$up-)1Vy%;G1=;_7v2(B)x(fqt@WFcWa
zk#`RX9Q9}Tvuz;N!g3U(h=VZWSo40064X-WuZ(wr+~>o#)a9UJ`(*dmT+C(2!>vMs
z5mVFzA(<RYjE!_S`oZRUVk*_J{x(5i{LsUfwCM)pIaA~<x*^)9`1vb8C{5y*K+7?K
zA3c7%d*c1GD~9B7%2FCKmku)%!A1UE5<(ps#dVaI3zHKL%FR4#OP}BoZKeQ+=_ZH{
zDj%?4JXtdJ=j+XF%*qPUdN$6Z8!~u~1)YOXKrUgu4Eaz+?Z)*$E%=2-{g^8G7vwE!
zY(#JP$n5dzZ7i4sdND|Nsu3VJ)M@6~U3cU467}%Rd+4&?&p*}pSBFsBsYw*fI&rVe
zPu8}`ItGyuuD-9#Dj5)^zt2=+^<!)=eQ_Et|57X{R^sx|w2>HO6thh7QSr?esjpq{
zJa$>0xI8gn4m>!`&?={Qa!^?i>7PeuN3)@_Dp#^Y0h#vc;^j-~oO=(_99ttBQGd3d
z1KhA!W<vm1hwr3L0;ihg*a|ZK+_#%7Is6fS4nG7zzO#pD11zm|y141&nX-f3W+h7s
zS&Hf>D)yDuN1B7QfX#WgMz+MKV+hQ3<<4Ahh$U@K?eRs!-{$-&fQ#+!J%W|S;l#1~
zRoH|Dt(FKGR>!%FiM>ybXdFBIbhYh~ClI=tlje)HTmiliIXK_tKWL>R4^!b}%n-pL
zt(!l9jfKlrcNNkriUE^b^(~1U8%ZS6gro%0Q)hQvln}LREl!2JGjhjSXKTqDl3!0b
zSfdyHSLdd?*m2F)bSk?{#bWsk$j+I9+A8RtLSK=U$lxH6#*m?1Z$t{B;{&3DZceV_
z6{C3Pkk5i{3EjHAy4j6b$+Fxx-13(J=nX%El85C>BQqCf0`wsx`uD6o#&4q$h!m{F
zDU)&%{Gczf<Nvsq3%wubGZjFbh-YVq&+%~0<cGM`4^l4j=zJ!<cts0Ix>F7yq9@yb
z4eO%g<9o)M_`Wr2eg0Y7E3Y}+yJbO1r!CQ(KtY10zX^;JSoVpnis@LGTtP_;mYV`$
zyDrO7mMYWH-?<nCU0NRlf<KdSswP?z|2)@wB=pZI;smGc{w=n6FQ`~?@&T81b<ho>
z%@K;TK8pko#=t*9n&x~)X^r0Cb>jL#`Z3`Wb34k>ZuMSZPhlYGYU#S!bvzHa;F`yf
z1j$^#jB6Imdxs|_2)v-`bKB=(vHAE9-f~sWJcpv1aogm8Q!ONR2YIn)47?|P7!MKw
z;gVC40<+@_dgE=79POv;BdSzc@z{t)RBULZi1Okg{-3GiA*Et}2!A;Fpr|^4Tk1}f
zH;_v}a(0o`qAGUaL+pm{;A=mUU0hM~s?_v9IP_=V=-3g8`Yh;WT3>hX_ly`DJdi!Y
zxXKiY6|7uR?iS<N8)5{$#a^uPGcN^XykVIwsAZF2rVfg0Wo?r}AF}!3T=5iMl*Zg{
z6$!C6ODD*21`o{rgU8#6AbMWio=c)q?XG+u{0AMm`y|2~ol{y?K5U{&ik8~v>Ml0+
z8>}TFWS40V#ZQm*t$mI5F#Vc~Hjp8!&Ze73U^$!*Z76zdm*^444F<vpsVBIn;X_j)
zdS5!ll>Z#3jKHKcr_Bu(`NzD|&m|6sZIui8fUDTQur5XZcNPGokO#yM!WWcW72<l(
zEbw$nvy;+OXi@13gEp+~;9k|vTj6|ZGMgUb(uCUAHmy$%9}jiEe6ws8aP88q>b}?A
z#rSQgf;wKYE<M^Ddf^d$3ISO>TN*6jwcem}NO-Dx7TmwL7$8>EAy}9#NZd3W+#CZ6
zg~g3&z=<rF11?X@8rLWsaqj5rNb1g#xo32aqQ&TI#Qcq!9)9#bLodnr+nTFM28-c<
z26?s~to&sU*>9%>#E7U5O8SZD8L~ds@xHYQXT`iSXohWmw91$z{xJjJPLf7=IXn=k
z-*_AvGASk>O59RKHH-DYou0X|_l4N{N)T65wR>=zaj-m-92yg*fhB`=nLo!KTo9|R
zF1v|4oZuAJr0@==Y&{N+UGxz67v{?=FFQPvFJ~lv**K#-+M6W2;H}C?=;y1a^q8Ha
zLcPKK@#E2S#rc6{$aCdKH&*g$A+g|{b&<0STDA1D*G((&L~C86ptct29TGxtp+y;D
zjj;{e8P4O|vtTz9gV=k7SQ)xTok|F{Rkzk7QYxKUJ#iypd9RP8CTG#>E!Wb6$lp_R
z0AajK86yW1-;ON(s1g7=jshrm`^}7Rsg~$^d2Wy=HxYG;zq!e3-(^Ad1e6ir!bL11
zIRxgz{f@=re~8sc`W&ngtZ1~kyb=bezn)wfDN{VlimU4_@jE57&MjavXuXuL70wLg
zg(c)l+sm6JZV#7Af7VHYh8Q~;Y=_%yLpA-a6A1_z*~rp|+jU%eV)@9UmI53i_pbG0
zpU8DEPJf+I`4$8V-W`xsX<^^EriP*|HLgF{W(Yx*QYQcHA{hDNz1q#yI9x8pFZ}xb
z?bIsYt&X#vpGgBF=-rCYwW-?)@6%mg=k+=FZcF*7UZLKYweTStE_Y136}_^h&@S3)
z<6zO35-JIlyQZJh{7rl2H+v8>zGx@Fj^pfj%x--o*469?CERNPL4Ip)N;7fI2+cz?
zNGb;$%wf4g*K5EmK_9f*cb;5djaA=a5u9s0a&#>fuNuw8q$#Eqv&`{$u|1_NYZ&6D
zQhkelz=6o{c=k-@u8iuu&+|1LmQ8mx`OYP<>`Uyt$&^H_l1G^;$xk7am4UyP{l#XA
zNsqCh#?EN}x!rfhaAenZMV;z(vQ9z)1Qt+5t@6n0qrVbPnMDz&GxHs6V4;99qmxvM
z_-0UURP&G$;POt6D)^w)1RmnpZu8*1yXELR?XK~ui-DguF+%Q&8BvS4H*?c0;#?9f
zZt)zg>kLnzO<1UuWp3G$(2_+Wx&&_zhG!N2Tix7H!xOFNbnUhz4a<N1AQOsyT|j^<
zJC^X9Pha0~+>eFDmbVgnZQbQY&+KhChiwcizFa<TC1}K>0k1%lR9PmP-7tPS^m8ye
zHR8LTbU9sq(jq!&g8jk6uWcqLT`ztD)&yMFTduzRcj~{z(>s23Le8ob{la<joCl-h
z&}s027?*CBgzh71kKp|+MmQJry9qrDvlh8oFG`27Jx)eCNsh*LKYmr3m%ce#Ty>rP
z0>S(R{BV%nbE_6UYA{|>5N5kQbvhMM;02+6Q5;#A2ckKwTWLSDZpLuYZEs<5Pf{-G
zWha@!7#)9AoJEDKq`JYsd*Ee&aLmTRbu-yy^<2BuwU@IEW}lT%LO>5Chw0&1AGp;Q
zEO6I*+A4#-JjLZ}l5djI5ih>mVLExT_d%*scca0w(FRidz1MHnVy`XcZX4<pWjJ10
zeFdpTku$jW16OA<**nknvUs22F@lnyt>Y^zRK9_MFcI}7@-K8)2kLz^?6bXN8^NAC
z*AE%<$*zw^Hhz(rZ&P!M4`=QFA=d*EacD7Uhn7aT)8=JnQ83E0A=ovES^e#_2)n|b
z(Mie>z$D2%tRr>ku8;nZq}5A(N3qeTAF_ktf=s7hY?YUP6g=PD;NmJ>Rt|$E|F-~#
zGfJ6-Au=lS@3B6mn~&iZ9}8AI9*>=6wJf<5xuRe>%3L$_t#)+SsUw@W5%?M^ZPy%K
z_-N@@6ed=2CGPLx`ys0J0*{*S3z9hQ?a8nEht&Ghw`NgaTx~K)EF6k0{uYVt)y<mC
zk`C>Uz@LPZu%P5buxc-yy^I|lz_(QFvDs}KUA|`DPQT->K+=eHAr%A0uiC@KVixCf
z#GL{tB~irz)yEgXb6s}**40@YQ+ShK2M`%T658J{zqF1cj9C`enQO*SQSH$tM!4UL
zow__seWeT<1rbJ|8>)bL(W}zFyU`CEQ^`m7<If41D|b1V@s868&|HE(UGZ&E$Z|#P
zK)U*?CF$x;o9W6b!!LgW?a8*6e)zuL&HBu|M;L^!^%82W<8n*vByP==LI_{R2H5e)
z-o4GcPP6!>$gm{&L*SK48<(%VY(R$uWa0^#oP2%rUygK^XUII#N|WcN?os5!lr*zK
z5CkuY(YK`#D~mmDU*^@nsw~rmXMR^Tto&mthuy&?;=>`aum$CpN-!AShKfd_Bi0`a
zthcps`8L0H{sl?*-;r;&MvsH*Xk!X@G96jp59}N(?6)b|x8*FhQPpH^IJ$G7@jF-S
zARZM1CcDx=j-Fc@0KG4XyLmsl6fGB@hB@AUC4ot3L`8Mk|GM`2oDNl=-;mC8iINqD
zr|I-&sm`m0FRC7&&pHn%Z+lU+)0-HY`ggtXQl+0|fFMmmy3kv))d(`+VXQ!E>Pr;g
zg7tzYQ;>nF#>sxQ*}0OHk?2(;?XDp}0}eJ@__<Gc3<ey$)Ns{oaiK|HY@0i4_2qR`
zx$cH^&LMoo4;yNjahu*GUrIN>^*BK*Hs3H2B77ALc8z!DE#?&u)*h}>{be0uq92>9
z9!=n_udrVivWrRXN{-1IQ{^9eCRMoJ7<a6^y&R1P8RU^7%rS3O^-M^j{XLGm7=|s|
ztJ6hr6nK_nrs}^Ph$=}O9w#BwdLm5)QmRr9r+82oM&yJo9pQq_EUm>2?_|N*)+(u>
z19>3Ycv%b&Hx=JflZGC#jVR1z4tL7cbDy&RCA)egKdgaGN7$!h9=mEWf%+6SQ`5_w
z^XKP(O^Lo(c?a{taBQwFsJGa$`E#$Y$C4?wH-+btWd%+nJA}|y4mRBpc>d#)fZmX$
zxL2QIB(%QbIs#&q(nOKBY>GPb((VBQzXU3!y&F%7mN6Efz4jgu^6N#s%b0=hU#u+&
zuaTG~&2<ECbwb&|RZlWxcJt^xop@EMBXL)P=4E1=q(7)gwFIL9Uo1|q=v;EqOGgg9
z@O(l_p4z4FUwANOxY(Am<FPA(R3E(RXK5sCN7cT1>b&5x7^9uKg4DI*AnZ%Ri9)##
z$Q6jMsspKWZwHWqXT)Ht)iy#n+df*xe6e_Tz=izG&M%3tALL-I8#=jr#aad6G{XDh
zsuK9kiL2)V<*CEOjEZR<Q5|aOVVbyT9K}btszb15@5QTS8cbJ5qi5Ie8d0$6;<E{S
z@KI$}WbC%qkMBo{oWeF(A*;*SYdOC;4yW0p37%eLwm`{0dmwO4Lf97NotGn{Si)_B
z<uW7dy}u!g%*;<D{*vtwQPjEu431kM8ED&qyc)md9_aqHu#|6G6Gn(HCePMB{NFFl
zq4XmY7tj8B*^)fBn+H25Jk^er_TrGsc37A8##Mcpruj1mlf%6eD=*-xYlzfueb(m?
z-mtfiZ$SshbCd&2;t=vjl&Ah@5Z&)-JxODFi9wS3GBJ;D&V>g%+h!+zE=kL$GFNV4
z7rx;FCEDUkG%+#JU>T3K`P#g-YILorzZhjez_;^Lo!bi$UITw$rI=Cws5*2y1b@5c
zeMQ?s{X_})%agn-*Xg;ow~KW{TW-mG`NzA9$kk-1$P^{xd4=yKJ$$>z_;FVm!LiKJ
z?GtF-oz$K{{w|A9Gf$}Zub78t4F=>$!gJ)pl|TsX+gS<s)w;wn0UW{0ROhc;0-U~4
z62aj1ImE8Ezwd0Bkr9XPia)b#U4+?Gso{9~TfboKR=(B3cvoe_@$1=DS8ipd#l{?M
zVf1>KMpK5@8z_`S8o+c^`}vQm)a;R#w`FP#|Lkn+cHu{sBY9Ob{h$8wYrzbe<3h9a
z@lbKmrRfeSM2KN}AW$wnkB?jN31aL*jIH1psbc4}$suW8RlxGv>x<G|BM7G^>a*eQ
z4tL%B&g4IYgBzY)AJKTu$>=)M#oq%doO|_mxU)a&_<UBKi+fV(3m4mXDORml0*k1R
zOstcJ3x_=q@?>-zwZ5!-lu6BW6g(Inf%+ZGUF0Rs!|VqOq+LH+2;B~PaW@p{l&CiB
z^v<38O7>GfkI|G%O#=t8#wyiywkwQE(oCjGm%)bN;uDk*d&;j;=Wc@j>mjlpzhcpx
z_=RHoI-001mX9e8UEMjDoGT0`XkG87vmVkVTZ^coCm!jkL9;L<uBC!IBLVk~B3}?*
zmlY*&711pC$t|sJ>}B0N$7+}U^hUiwTlJz0g6i?$<2uRfssd82*)&C$4C2MWNf9+?
zg+UQ*j8`^2Yv!nR2pyq-y>sGn=9F+sh4J`G8&K5=OOAs?&U6Qh7N=FP?JMGg7E&Q)
z3s1q1fIzyj8<#OJnhf(T%g`&6op2c!I@s-fS>&5Z1rVr*h|p)o#Pnyuzv9IbPda(w
zIaGz04G##~Cs%qNiYV&-Pg|7%8@?OWept39xV63l70`KoA)?sjZTIFfc~3+g^z_R@
z+_SDML8!zo%k8_K?9n`-wba)8)~`cu27ud_lE%903Vlilybtqg&C72}ZrJ^ys9V=1
z)7vIgGnseh+!b3O@k?Sx!u#DXO6O_s$XusgNW7!}fysWwN*Y}AzzC|lkpf%QUr|}2
z89eMT(;(j}YYuJ&Hor=!A?+#=y=2&MkE-<9>Y#sz@~-fwZB(19GfLx!!miFj($3eY
zuIM$y=wJfhebjC{w7D%BB4lk?8gwS)2;p*LVIy&UjfV{*m=3<XMYJqgoK91s>_zz^
z)UEiytO+Q!7mHqZT0*H3csb##8Z{tC{A}!jEIVoQa9{mnhpJ=NLy{g)xQqkNa^%JO
zkHNfFDRD=OgGd3;Y(E3Yp|4gpO>@-JHP_tR=~gng=PMToOLFJXg+gs>=7}f-;gw5F
zE}i2x7xdbHHY3^wnC88ftwe}L#(=R*_K`Am`(pX<t-L7>yDi1?_m>NbM%#=VT6C<^
zy*amk2Gd*RL|@B%ZS-d!;^g~FJo_74{bRr}60mf8azl3zFhSVLkas)s@4oqG73qN3
zRMWmXlH_5IWRKY%Pd%PT&&NZzA9EeFdfa-QD>YOBivpC`fD!$qxZeSa&HzSfoTQh5
zWr+a~4>OFf1-moIkNR>~DZ7kkP16;h9-=dp6#rvG9#Wb_uOCVT<PR~mTuf22-Ze(>
z@4J0sUOPH-E!=jFNV!tGK8ma0X>ON1PXjdvUsqlY#$+!*D6l)XJeO|v9YYT74KjSZ
z`K?uOdOO&1PX>$u{&o4o+%3f2KE*03bLKy)*~qSrvPq0C{`eG=05km|E7^&(6ZkYV
z*$Om&@KWq|5}%&f8$d*f2BbNY+?c<_?AZWiE300peALG^NAYCwKsBzF37CWKHX4?0
z#(=&T>vZtT{f2|=8F@S+yXTLa^AH$&t<dX;$cK@ukXj}<Pa90fzra1>?%&pm8=jF3
z-q8?L^J6*C<9i$V<c(gNtQ(~JM6y#%rhHb-4wzJnt?XvztDwr<)9HAqGTRB$bDZ;*
zxsf^(KNXym2-|XOe8&9qB{S^{QWg0{6lxBg0|d`Mrk#GZ+?<Y^Fkg6Y4`ubw?R0Id
zmFIE^WiD3*$f0$W%!QEw_XT(;RFDmfLQ?{6h$5r_-l6aw0TG<K>aZOkI4U;6G#$@#
zkw`|2AWB(|H~!S3Q0Q~!?fza;9FxelSEKbN5y%nG<)&#E|A&1Bwj*(0v5@|ZAQZ3$
zFsRFq1=2N~$~8Nhtg&3jTVD#7Mpi8vwGfTG%+wIw6Bz$mBCW6L#e^}u4SP4AetlqA
zKfe*qzxX4)iQ`$a2n95DEUDEGLjfaW_90bKJCpYB*RDsWO>c{4tOAWwm>p1n>tFjB
zwVdZClFAeAe6ev7{>5Se7ZY@j%{OPTTR7s*;}@C+OC%LNU8$VfU8kT^ViiB4W&{Y4
zEl>hTFBf@Bwc(8e3<+DXXK?`OB+TXG*q`6UNH?1r%WAWHEmQ-uwGwId7Jk|qehPGx
z#zBOLBrfyi^Ww7P5k<iiNXb|viT_Z`K_=ZG2<H|OM5HWc<TT)}E#P)8;AY7G66$!1
z2HvTPG700L_{DW9d5X#M6M*wA|J6Xll*t_5`c}oJUY-T^Us_T>(cQPGV^#66JBMDn
zb*M+qeFI3E#uC07)nRp74S9CN2e_`?D3ZSDY!t>`?bG7SZB#k7Lttz$zK;-~jTHZj
zV{?{R(;psY?I^`D$fMZHISJrW7#Or7`cJ=8HyYux>E2<^zQKR@BWn40R#C638#;{$
zcWfqOMt6%_80j`epJzS0ly+$w@heXP`qRTHFzqOuu15~!UO@61y7_Fs!vxs%$$-St
zH4F4>fDl>|!ZU@6t(2Nm$|CI49%vztIo71ohuj0<wfC$Z-ux%db;leWfq6yGKpF7h
z65+~`Xj0B*ZCFd2E+r9!=g)J<U!Cd#N++yxgYD-UPY_HL<PLj*5OX&wIeEj`sf|o>
zmMVeGP}I_09{l3|!RFmv!u^g1mhMmz;M+~p`cH<eQSwUP21uPMD*d$f@qT&hwAc7+
zd~=-q4|~mWd@FEz{8OH5MtAeD5Ndv7;P=8~(zCdjWbIxt0T{zBa=iE^MpK&+;Cy%$
zp4`FIGX|4&v0a2CQ%jM3@{d-4dE$95+&4BT{$l(Ro&v0~_u&#Xo=Q)0SL{1m<YB9b
zxp$MXT5cS)W*u#IZB`UPjYC5FpO`mb$D{s#ePF;+spil7V|kJf$bpMT?^*cUr9;3g
z@8&~&lIvhCdYk-4VmM}3b*<AZ5&UQN`uB#O?+^4ujs!^h3m+Ln+D?~=)}_yii|{qg
zI`s1w0^l1%xEkRt%3s=z7Z0U2<vS%OhhFTwQT;-P3CW0IeG%QPPB(IOVtx6kb_>aN
zO_D8@P&Yc=<T34Ww3at}ATCoTD_32X`oMCHJ`RbB0+qL-2=A^@V4vf=>yEqAEA}Il
za~awNyB6t{O~75`^Ft*S*TjoQmhc6kTf>HwmFyj<3qLFK^<Sp6^6oz&@g!+yJl}I-
z{CfY|`ZGx!iXgB=GKFP=o|7B#ykngBIYh2K%JAA;Dm*9Jfjr1w6)?_BirFJ|-!%ak
zt@#V^Z@znPj8MQWJ>P-fT{+5KFX}qpA*bNi9l*Oi$7Yr1caj`9lr!~-uq;#fD?_(N
zpR2mm(f@#20}*C8UUltZyb3k=G=o}8+<<Du_QEX&z(Y;`?K29SkKdWwz*JICh;Hh*
zmg_)qH_G{qBD0qcz2=bsHkx}+&fzIiZ+dd?x%cS=rHI4k$)=K*9h)P4y6Q#`*@Df4
zL<Ax^1UdAXAz(g0V6yRJ>u^Tohh&E1Kx6Od*pg+<Ii#-USXcV|Xzb(yWvx11%n}n|
z20r`DT+Y~4qrw<Hmx}cUYcdv-zVSKG7rQiuZ{P7b#XQW_uYcaQ7rH8liI3f$t@KoW
z^-1*0V7Ej#E)W+jL>_YU`Rnz5I6XdPoXpX6Det}~w9Y}L3HJHsC@Fx#u^N8GJ4lt?
z74VQwCn!}VRivlr=RioH)z4<)U9a3d6BYf}C;5a;vzfmKu-a(vOV8?cl5x__BYgeM
zO9d9Gla@AodxEs$Or69)`$WhLPa^IzHcLgQrq`}kQqr4yWmet^zSmCTW|r%?txO8>
z@OX~@Z1;_h0r;*f05br)o(i}wY2F}PIe?>#8jUbV3!YOu21-JCoSZN#57~jbpf%k0
zPosf$nb<>c3d6F5qQCzNdFI)0`ewcAj*8r6Pk~x{xCrbYR!<B?US7$xHH$T=Qfm@S
zGdp%rygL(noJ6EK-5zy0eeT;vu#XBnks;k#+ViEqc>%6_A*ZJ9aXii2CPf~YzdH1Y
zGMbw0DipirszQ79)ymt|;y!l+qm(;OmicW17RBW}w2r=mu7Kxv=AV|cFjn``8u<-#
zp2iy2KVqJE8L~K1WW~!bG*X8XVC>+b9p#OYlfwET-{QWDizReFGw1OshcW0I>@<Gd
z@0S2B(C|-_32_7<q}%ulJX&DJ@6O*BrkKG{E7ug2VehSf^)#dozea+6pYQx1aUA40
zh*u7n?2%!G*Vfm^f9Qqi9<x*LE_k@PP)~bxrDng7<k#51;Q^jXX-#c0zB}5H2spF4
z+n0b}oz2||ZQkh^ByVU<h-loGLp)NI_(L7sBZjkB_FJrn5gcs8+#`K;c?xfUoY%wL
zby%uvShLf*8RG8piz5**?vEjz9UKPuMP^DyPL+GLoje`L%$Uzf8t6_z5YApzqv*PI
zc8F?fb(S^tZNT-yLG#V!dBCO5(%mlVZdDiL*0`a#qDa_^l50oR1eEJj&G6zxK26QR
zeF|42msw`|AKGkL0Z;8EkfJzL^8H=iRnPZ%-?wB9-F)Zq<1izqKn7!Zi`jS|dLAN2
zx)}3Ln(dZB@iE}upgqHTpM6|#iJf1&Lod&@g`guy?x@r+f=O;I)mXAvqECkg%qeib
z-p$)}$-bC(a`kYgx6H=C^*JHe>q9R`heh3&rBe{r_H@aPUNNYC;v(W`9<E>S^=wvN
zneEHP!{BdMILFDcV#&9^KCh8LtA^mU^C-m#O~T*QfQuH}i^GGck0-Xz!jUDvFrOAY
zo$34av3KI`ie2;0@GptcWA(5;2mWSL87E)XLx3~ZuEL=to@F%aRohD3N$4%i?CE8X
zZ?^!fdI+^C#U|3(L(j=Dw_F8c6OUsKk9EyxLs!6Vb_amht8|Y3$Eom(rGT5HfQtjg
zE_ifgEW<JZiDXMq@p6kGgryL)I^5Dx$7#qKVwq+rZHIW5BHc12qA_>)*O&#VU_NE#
zwB6b)yrov@DgTJ`HRZ6-cUwIWXD0QjyM@zmM+<62u%7qr$K|*e<i@3BENLEykTKnx
z0!Oktj_W1gW0?PCB<yYt8gMIci_tZ1cPzaQJjiT%D(S}N`$n0gb%!u7VGU?D*g?SM
zz**xczc|mtCpQb>v3QwdrzFsEa8~h;3h5Woyh#x=;Kd5q_9V+;9&yI*nm4*(7}m7w
zq^a?)sb>f^kJG1UQ5kMZ5J$t!N@bZBf9fB=+=%X~m8CfxBgsc&2?}06X9r*XB;-A-
za}C0BG`L{P*4S4ZN0ss2F7^pQVvgc(SwfW=$X`o1M<6ulv(YrReazRQa-iYZbvob}
z^J>Lw&cR^AEuwh^Jbt~6Q#t4v=T%rlu8S{eU$UU?4AAAWqvbQJu<Pe;y02(#9RWfE
zxuZjw1zM3aE%M=uU`c*CuE+x&2p_`lgSX6OA0s$6f!?PPI}M7^_WwFW)XW{=6@mB(
zO#c*_W*wh;Udx!Q<F>bwe(Ep`vu!^7*%E*`opNlxZ7V?vV(xChx7R~=*8;6g;K;}!
zKqnvnpr8~{?*1G?dq7<K(aO0KeZA!2DV9`94+$%)`5#y8jPN%lBU6N@qd#IuvB>3<
zsA<w57Aq=R!{VH3@9JWL74xCRjDWY&>iMRx`N=I;^7dPbB-e7Xm_RMVPqt>sM(u#C
zn?{ZAND(AtKI48@m?`bM?NrCxvjWGvEeY^N(%q5fUEh#DI`V!l$8jo~$X4@V)??Cn
zTssybScP60g%cmT&f(yV0IZ?gu-EpI;<k})s_OJpl{%nTs#}I%;7q(4$rAKY2_be#
zTR-uWI4k;%T-e^H{oU>9t5r6S*`dMrZlTM1zh?R$3565*%ul0Uri2I-t_$F+6%RfQ
z_jDVNtg-$>9fA&Ic8<8r`R1IlUvxhGW}%wLk$hTj?xzzhSNP^@{oWevGhkcS9dg8H
zC#&$dc>6+@o5K>&IV}1Gxa_zs=n7R%i_13iS=%~rc`a11*qposS`gJLx*mLlz(#WR
z-A+suX?4%{xF_ied9gOIMp|!PKUz%g&~4VUyB<xrxGXmTrN&-$oZ%e`QJn1EGzgTl
z@&cxRH+=!ldlPWm+8C`lX<POCN7V#@eKEHKv0z^qkVI(llGSUVNttaa_?(N?D?3V|
z+)C}2$FCSeoi&z*JC7|@-UCIAc6`qQM))}9s83+&`XmqRbsTAY-I8j2GXiY7=mB5#
z7~jp@T^{%!?-<{$-!XXH)zsc5)qeTd_n_rBD-#;wHQa|9b@|b=hIQR<0_osn_h-Wu
zK*3Izr`hqNrK@>%a=;lye}N3!o1yT_%^B-VtEO>k6Qd9j1LftG($1A6WwVEQI;-5y
zYVxs1%+sUQiirlp9dp<gpR;3aqeBSf6Jke0R>0wxcNA0bi**6G|D7`Y66qLlkC;yr
zO8k$m;F#?K*zGamiQomxc@=*;6>73&u8&0Iniu<mk5G5B8F8x#Up7ndT$#r;Wi~R1
zNg-pN$0o{20BnZ+WE%#{IRS;5WqlLin`-EA*d^|5YwG3HZB8)StQ^c3b`WGR^0Qyl
zG2pT0*oIQ66EQ~Z5*(Yq>vj%52p|t-y(_qY73eK<8$QZ?WwG+KCb!2izkfbP%sFl*
zBOu@B$m)mA$XhPWaXP~gHh9jbD#M*oo|?mtl3o{7x#%#*cYV>@3^nMBAUobbz!%^}
zwG^{@GB0JC$$VW25v}w{s@vXC)}KSU;e;<gfGRcmC*W_q(g`<8SDU!Ga_bUy$^qM7
zTkGF*?XwH7Sa&Cc9+`DQ)3aQ+`$GI_*#D}~N%Zt%Ml)m+&O>iG-W;scM9!d8*4b@8
z6s>=y1Ol`;dAq2F40lIUkm*k&G6<a$bY`e8jjxJp*LB+Oi1(;ln1dSU1sALuyszSY
zL?^49uU_&GV2?ux8k-31vpAey;~mijTg+&CG|hf3;RGE&s1fOkJPC0xw2=ovo?I1Y
zAM6AjM%)xyCPVHV8nZi-A}?}2S#5dqvwxxy8Wgjarm;{pFJfwt6r%g%qho96%~y~n
zJUr#{(f;&pUDfUf4Tiq1J=ab3=59KgV_jq9aiCXUYDPtM%;J0XE2mYSbM#p1>w>)x
z%FxoVrPdZ0hW>o^u<?a|A7Oo@+TsPsUMF%sFEJ7jtFkgCoXd)APP<+3gkLpaqLu?N
z4e+ahnt+?BfYYn{neUELX*aOEo&VF^yT>!x$N%GFvLsuF`@SV?9d4lmDaSP%DelOb
zB&SN<l!RF3xS^;VD^ZF~l2ci7D8jfEqL?#N%yDcEV}{x3cdb63-}k@o-{025qaOAs
z*L&~l^?IIO?+bJ4%<!RNqiu%!r``=HWG?eR1|qVqIx*tBLI??&_qt`7na@oXVQ-l(
zDa!WTCJ6LXENU=jzzXS;_XH2$f6Q)QlKmpe66KrBeDeniLPl;@FoC;fOF>BB5wfq$
z9vDnOtzhjfgVdW^D$O_>U~yezF=WG)pdzBfCyF9he4rF_pG8Sz*-mWaeT-I8Y;4q0
zs{uvILU!3%HlQ01*%-~V9t4v&8co6MWO;%XF}#0utOS{h$&d1PL|cf5qet;ACaILN
zlobKKhC5I;!15xC>qILXJv<i%u}-`yvO<H_f0$=iHbyowkU46=zho07aztER#MFsb
zL_PdY<3&tqjBTB$y1B-4p?q<-V7O3V?JnM{h2A|r5F~8*82Kr)+(-+0z3wFvF&P_o
z6F*gXCEG%A&GJQUjHS`+Oe|uwXyOD2UpKcC*$B>2b8x|gPntFlHk5;%KknETAAizn
zX1oZzy9m49cL<|KK&y0XvfT|^&F{Z3#DT1QRRrDf36JDa`3Y71hhVyF5O&4MXfF8T
zVW=nXNN!O=&4z-$Ka*P90C*vD_$Oe<&yRax8ju`h{%yKqdVXCgD^b@{cHc&?9Mp)t
z;>f4>`V6gR@^_4#IjXPQ&rK2EyI+<&w=}>Z4-h@^5n`o?8b9wvN;W=3)W`E-jJ~<I
zKR}mQHOEMe7VQbRh}xW@Kx2ht@JGsy{VNpob$WFQ1z*nVibGSf#J7OSfh9}Tnp$d6
zuvB+pFm4M80z64g>1vd`qG#ZrsasvXctecVi>w~QvOZq$;<%jHdyM6X(J@u`*COce
z8Tr`ieM5GD-GoFfCpJL>^+et8-Q}J3okSiWn)^DofD&HqesF#F9a%UUY4+agXOlDc
zqS;UOa7JcT=KFM}IV?bME_$XFhg0d}DO?Vuk?v&5hh3|x+>1~nMPHdQfP8fm+QU%&
zePw@Y`_9NvE!^tHpFB3dv9vRC)8sq3hCGj{s`V+;*R+DVDqH28s?nuIU|j<IjAywC
zPs#^INATfdy$>@2?@4PnR=&>V?=u3wulV~G4C1LvVI54tCn9EpS3<<_d7p@sMILWh
zukA<tqaQxmVrm9NNo(!n1x8xsv~+9Nzi^F$=qY2F{sXn#qfe`r+5e<oU+y~RW6a*v
z*<yAP5>>&<_o5}73tCU~wDcuJrMcATE>&=!Fy`9S-=gu}ihG)A)}J>LPWnaq=QSv6
zVxWYkG;@ty@)Fz0h`R~7MC}Db(;z4;q^@>wAfsmNt}R>uS{+i<CaN79yaV-3bWj1C
zL<cU%Jx<u6<hy<<TbXH{@4?G^hH9glpL0v6T~2c?IHhh<ck)Z#K#Y9qYLPbt#MpGR
z9li2vRSc#rIw_ubCQ`Y5V(XusHAAe$W9RNAMEEXZyjwr6Ijo9?c@_*W7{_bcoI%XS
z-xdw=)LGt)Q7fC%hYyB`j9!|$4;moFp3Pg9K4L}waJLCqN>#8y@d<`)k}D2m*;%L3
zPA@EZ>~O(pCsm=)3cf5GR)Xk#Xm608S(Ub_!EFGFmL41ftOsmhuPVOE_|sO0ShNOg
zhta~$XdH#=o$a7Jljk8MY1wkssW9LG43hmHjfs~O_Cet4A)8eqZ=X~esn0i48Dy&H
zYWb5aJlMHCPzRTO2h4T1=#|(4>+BErmhOKDYXmRTRuwL-Ja}y3)msvIBsZu}<Z5AH
zu)U6+<m2QhE2K;LJHsz0XfNAeZa3^HB^^e!ULVDoC>Fy5X?74pNL~f7V&sX}Er{|f
zQVbi(vV{xhg#~M)55*y(vPp%7zp#i+J}Fah=~50^jjUf#8pIOB*}o@v7jRNLFi7!?
zAW!lKLwtCLAknP1QusFbZw{jW$f`CCPN*SQk2Zk`5XL47s_im`Y1V8NeFZg_|0-Ew
zL`HVf3|d=D|6+eI5v4n~p<iZbiIWPeVALyEM+dSUrQ3R5cWiR1^&d~6Oxidbtf&%}
zw)y^prXlaRTX*Q5noS;%x;mHEVK!jTl#z9vCz!>@IbjJqCpW2U=dWr?T{#rhjz+D&
z%q~1Y;1JGJG~OPHdts1KlL=Hlq}s7@B^0~c98T)&9;+nMr7T&_naeXfdmXv^n>IP|
zq3r9Fk)8fk!W4>kZp-K~mk3d^Uj6`aJ0yB_<J0E`UKih1QihWBUINP^o)-is-S41;
zt|di_l$MS%78vAc(XGQPoPmW4jaz7)2yes~qYj0qCwlh@5TmP8n1vXstN7aU<2T>p
zO><y3i{zIbUdlhG0j3ug7M<JEPpOQWZ9KMizlJA|l~QHWmJv!F2P(e|KEV`oo@rol
zuX;QOx?s?#boW2g7&PE9BuC7%@5a9me^(r&I!5nB>LShMMmjXi<WepM@3r_EQ2xeS
z{>3qSYviq&$=I99t{@}-Vn>f|4X(9ndhO|?sL8P+#oO;pDF;<+!{?9tGeNb|`gJ7l
z$NI4LR%#Wz@0Gpu@&uxmnQN`;$^`kd=u2hNAuB}|&nw=#L^J*I_sfEgcc_Zh^ppOa
zI9b=?CD}<&<>Xg3hJP>AQ;Vm;SfFMXcwZViV*Zx1sMZoP^3><HsP1!o*Jby@P|;6b
zC}Z^7olQt_bdKP8&_8oh953cvSm~I`qc*UDl2%9g`S!`=>(c%pCFZi@fb9F;YLeqY
z3;rj$R45a4j7rbbqCnc2xyk4&MTcCL{P@h%@ioX<uc+sSSw+uxsIml9wBv4N+_fgy
zo;ZbuTNURp+rzionfv@Cyxm_A*PEYcW?*P?g85&N76{T9p$Qo=b787{K4?~?#qK?l
zmlet0lUjeF*y^XLO>{_W!W^1U&&|s`fBu6mdKChMERI!F?xloSO>EZY79)&7V5grM
z?2~K%p|S17iYlvpAHG0J=R*Y%g5)p<hLvP_+(VB<2t8JFYKSYM<Kx}@#q-CXYD+qs
z^IA`hr=cxUJome3=SeDeTpejaQ7GUp=TK^WrtxU)FK?~cMyBYrY3bf-F&m`vvj2q?
z>Q=Yrlm!H98G{ti2O{CrmrdXcIJ$*RWTlj<XQ1cug?-wEsruN49q0{NJ9W?LlXOs|
zZb~}gR@=Bm^23eCVM4Q9z4|KGd$U{Zcvurud`a*w^K%Jl+y~dC1#G)E7|dUbsnUI!
zSe5W`d@8uS5K`j@$5pCf3}IPIJ8MzY-k5-Xpeorbx>#}hL`{h~TUrCVEUu-yx1J2%
zc4_Cf0FRLi<Hz5#Z^qzoX(g*;E-sa}s=oYoWA(q9i!)TkaJ;cNTo{!7{cgEn+bAnQ
z0(EYSx_ATUA@2LW=Oe}L%i<17%gl_V;}-@uR=&*m)#sD8b8f8tX|==-5n+b~?dO#v
zECb#3MD#-@jFCXmRn;0s5WNr#JYWEQTF%;&$(8P$k_wz!`;lxA-v`UKids(Wak-km
z$Z6EGisr`OukPHC)h1}Q=nFt<A-<LA@R>VUx5y0m(S<!O3V$>d9IsMHgH+M$s&B)y
zB3sSK1W#!xuO|sDDKQD2S092?ZTzYIw#-(m#OrM?s`LsndZtwx$c3G&qiuriF+<Q@
z;JX$5EwSU|di#?MgDuOa^|&Tx>iOX>vnqfXF8!{pu=h#cDOu0i3huyYbOWSyc=d$H
zSd<Yq`Qu{r(bT8f#^PpLAIp|Z`36~2WV$c-EogRM3kEU~MCm@h?Pmfue+@tc5n_-2
z?E~>6_!Htl%8a0dqkZdM2j&E@u{dZ>!1Q#zfQS_ga@707iOMgL#OmBQu;U^IH8>gj
zI*LsQpY$4rkfD~eH#%)a5R@TEndxY5WEsdFPYu^Fa#<1B)-jzhxDK5scNc=4oftJ6
z4cB03?!EvFeMsgh9Gnh97LQ$b@)?UGRvAv^N>#Bgy~SFB;H5O##l|B6T<JkV3)t;S
zVZ>>@S!Nt!w|@v#F_8J#yy&Lox)hTTZJ(K0Q_FU=z(48pBsr!$hmzuuSEuatslkH#
zCnEJkPf|RDcOa@WGQHMC-!EjkgblYj02LdbO3A_3iITXzdNjQ%2{8JBi2zEpcea_1
z{`C%L)-p2sMyRNA^4;&&@ADf2d>t9$84NYP$Bghf3HALP^@Y6*uk>$z97J%w$#;gw
zbT7NT-7wIYph%kMW$Dt`*AwHeK!eNL8xQZXePXYu3(GRTWB$6ki;P)zxULwzLN#Ew
zUMP5_&=BC3&D8T;ZVga2YKV@79JcVAP&b&`bzb@Xd~*^MdS+fF<V97|b?Fec`?5m;
zcwAFzwm-kAWF-8kl?UZ|QGF#G2b!7bg#=RH*?v8JQ3?l&GCP+Ac1Pyxa)-=eSgr}A
z!Nrs5zEvfrD*PRpxZyBM1%(yE=gln4Nl;7(%ej;pz_+?_Le%~=C~|dOxxAP$+Jt>G
zKrFj`^kleDmGk-him3ce{^yr#qd%9%MBM;9LM*(^#vk#E=fn+ynhQ(!OZW(D9e|hL
zc1CY}YZtupWGEOiToy6yv~E@anbM)eNMN;B^I^B#RqCZXEan3}n}5i3u9s_hU^M!`
z+8}a>Z>&Da&#R72aO}{5bs(3!`{YZ<^PYt_$gSL!r)puR4yvm7cX|zAXESDuwxk$u
zYu=+;HPNec&h$l!85wH22FfH{`_z^@8t07bx(mg9c62#VeEeQd{rhxKzWzL9{a}ID
zRuJx?6a<E4GtCloNYL{aKKS21d~9nVYxx}N_DW(6NyT4qlALL{5*U-va@#31<T}v-
z%_Yw_HK`dF`(rL&oYRz=82k;bL(xYu%&dM^=lSPAp>Dp<w_3!&7?zU0Z;1J(hZLW`
zb=3QE{V;#=ed&&!q_xp9#(PQ#P^=&v02N%#4#dw2SYsE4cmrX)Orr<E$=zJV-Sq1F
zh|xW&o-Kbz_DZo^3!giv<YT#(q2I~ju~AjzBUY2_)7xy7BP(Gx5rYZl$|Qx4;@APj
zz~$T?eKi7{S?W06cdZC*sb#Vo8`yeIWnI-S5K?{JNlha!`LW8NgEYOw6zZ7o9L8KW
zW#sMNnxZ=cSBaaDeic#3YC+vASlQ+pHaY329XZp$Aiv(R+tAlJb>5^iS|ibuui&BD
z`!KFq4ezuQhENnX+d|^jO};OWQ^9sGpAY5^?6MjtMLih}zc)V^+Td+vmuko@$@|sR
zxB?c}=grg7)Y9j5qLga;HF?&lq^K`K@)}Vm{)gW+qm<7^^+}f&DUxk8%nw+kc+ZDK
zh5Vcoepmxg_)qP($1h8;WC^D;NVL++GvEXoi$CiaWEYHU)IIHaGymgLP4kI?F01TE
z(XI(Zt8gbyppvS}$wR5C>mW-Swb0ERi>CI+hxoRc<&|ppcY#e>&<WoLrRIFNjxXv5
z@yi(hui)ewRDb1t&%g+&{8TB+k1|irsgv%vD5;Q=qu0-RYWC%q$FxE1ZkcTH^jLm#
zwO3o!^(u5I;egkZO|Thl><!$`YfWU2n+Nu&?gpu{%`eHTY&`7JH^jQW1lPPz@2|90
zhKIzITmQW6<WsY8y{NR(gT0*VO^osd;E{n2Yh8P(aH46+sU42@URV>j^_wx$Chq9;
zvN~5cycjNIar>^z9(&;g{^N<F42cfVL>mT}ODJ%I@)B7xe*XaXS~xSS+S4mS>^f}+
z{0%oN3=K67@(9ZQ1=%~*#21fT{NX6Qptgc23?j|L&5DvZr<Gv#eG1WaqT&JLVy3jZ
zXLbg?FFy%w1}=`G_0>n6j^CgG#ze%zOpS>frb5oz?)63~6qlBJ<R|B>l`nhl?)4km
zj@#%xu2$<`CO`?*hToiF(budVBMKr<{H205`PmvQwM?tJ<Kl{o+__6>r4drsowglD
zk%~un`m!Bw$@PvsG%t$stxR1e!QNTR?Xggef*OVp;>-{CDcGP4h50h1y@^TDt=^;8
ztP+_jI|Kdrt#9T_$iU80l}`sG5=l9iAj!`6Ej8w=q7$o-@h)CVtLor!RmE&P7NBni
z$1lHuO+FF|x;njtf@;1X0NvF&DiqA0C&_q@b3(bp!ql=lPw`X<OG<b<HSMOdD*M(m
z??y7J>Rn?#9D4h06NCV!g9}pWg?Z0+7-@l&mX<ZhnDk}8p17+F{hIWGQfSC9#%i{z
zFZZT50eY=fMdl71{N$R+Gd+0I-__KqFGf&Lx%i601KB%NTQ$wTnrhynrUP)9bmssO
z)#|VYASi@<3`)=%_7zd6WbrdKmMUu)=|0?)68#^T;E1U>2!THb<qK^-uYg~KkD1E8
zSjuyPsrh3Yfv4B3&VRTSlV!?Jm&VSOgc76HhebQo$D8|>yryscPrHlC8yGFqe;=^<
zP3D5fp98>Rkyk{Yvc*R|fkM@MhJpCKQlS|93I}53j1jN#T8vS6&X1<*p?U^!&s4RX
z8XZ2(d)x_8d6c#IY^P%^WbTka8u<~I!%q7XeWTS@6&}>v#WMAGdc3e#Cj=B`f~Iv-
zH(h)z&u0&1GR;V#kuk3+)bt|Ju!ZFfhvJ>1`H7scExSR{+8VW)m-ZFDL7KMcnHOor
zSw6R_FYM?b!BA?Dcd{w^#|*8r<uBUBv_N&|?O#G_4CnXCLmT2ra7&!w(Pkf9b;Gqd
z<VISi*QoRpK}8u%dyi_gmN4&*ECHhN@M^;zGBluKc{Q#|ccqcMxZHgXW_V*CIm$9j
zvm}Z}&@V>eXx+5v7Rqm0(!9||Yt0(`jV+r`Z7$@QF%bI|SwQizUE9*uLCItQ<6i4Y
z_5(0>MLw5fAz86sUs~G3MRe2y><`pEVQS~nRjmOoCW{lk$W#0nZunrUKgU1B$^t{@
zJk_-Xp$K!KL9>q|TZ5gWDvV`rBQ79TY349stl@Pj!2AQEpLsfk-sp}W<(!D@MNBTK
zBJ)K(`YGvbP4agW|G3!U-c5<7PwWlOw|Z|?*Oba8q{{C$@MwtwE2>h*3ZNwL33f@R
zK8k%ZPlj&aZ00r9ue(B+0G)qcF%N8-xi|By;Iv2PavEl%X;Qt`_tC!TgAjG%yvcW=
z1+k{racapL;rA_xqT^t&@haDX&;GizFFT^7t_rh|xU|RfHxO?|%>dd`@Hfc7peMcs
zJ~7fQA#)wc65h`g1W$^y@oSufh`)_wuni2%t#8pHCPTabezeHF!}cDqVs$wT^2cns
zQv92+lu#z!-|?2%b$_EH#Fu|EKb*dax;Gi+6lMv0LK;&AGSmqvZEPuX;DY%lCUn)+
zQ)NQYXn6glN=;*rx(R0f_^lK?Ks+P=NQDYdrPM6j8*jZW*p{h!bX%Wm;JDwrCtcg2
zP6}|r^1=4KMd5i_$RoLp<c>CZsA_D&+YIW%scq+<k8704!Nr9oR$jglySApFNuQSO
zEg&Q`j_%wnYTuu%&!xezt|#LlCzj3i{FxBkdgX_VF2rQ7BQWI%oxgC-W2+Vov{D>*
zd)RBizRpKgyj`)`I+b!2y%WaJ4Y~w1T09&fI<my%7D!;{dA)G))u=ha{)CeYdq3v^
zkN`6eXmXWEvC2g3P&be9$aXs*on$fs`t3M3+kuU@)GZ;wjLFfCz5UPMax-hM3I**o
zGEaL<81Me@V1;cV^Xnj_bb@z=gVD8CI|~C7507O(#hQfnwwSyWuXMsjdckKOoV#O#
zR7Fvb1xR(nSJf4_lDCRb5iIXMWHsA5Lqy9k_wHfuDopPVceZ?gsi0xlh(!(j$90D4
z8wUx@sCr-dqqwPkQ*Y<ya|y>}r4dEmnMgH%tt;<Rll-SNKQLo*<|78(cqFj1LCE|d
z{%S*9o`)4*1LMzh2TdVGeoBkh-27%`RX;w>m9=AZ_5S~V<K14PaI*k0ZgAjUBHwEf
zv)>?)vM3Cl%WrN%c^hYb4i!C|wP4`41AHZ19F%(1<2+fZyJ1aqe05wxWv-$>j!LK?
z#IInY5#?8x@qltplwXe&xj(PieiK0G>~{I=#N#JMi|@)3K0v=mzf%Nd(2F8SexH^}
z1+-TwTlF={I!$%nO~)~G_|8P3nc{nC)N1Z(GIDjPDMGPN#+R8_fi8@QemS?RVHfFf
zRpYg@1r7EP01IIWDRT5FM@W8lufdf!expD`xNGY+BI7$w_ZUuqg>S;8H{}RlLX#aZ
z+ysZ`?4u^HPV4a+^AaD)tGa>Z;4$HSRuTSQCziWBhb_D+$w{kyny~tyzA9`R4Uer9
zs%fc;e=Z@+{)Jm5AzIF+V)m7PyT&;GTaWYTPuiV0g3pMG$M#lMtc|K^)rqwx_8B}~
z9|P{l#U0N(FwHX;6^i_BFc7c_dj@PNXnvj>nw0x%9X)|AFsI{vJF=cnX6<LG`^l&&
z(nVIvXv>a|yDSL)thSyE;v;#F*1b(W%MVhoOXH^Uo%u&&yoN(P%towEFip>)1DTs(
z+L<+)Qh{xM?~5+%JZ^Q>a4}sL7-y&VrjCv;?MyoW7sU~PqtkD#>)d;6m|Jdd4SCfV
z5ZJi%JQ5V`OaDCKE3~GlQeXR927&~w{D)9Fchhd*{J^fx=bs6>fwVti7-YqV&iY%+
zJ@GEjD^r18)}Wp|xF-P9psXDQb&{^BlsfsTnWzs!U?+>rAQf>bmX4|UtCgAmEj8(@
z+3}X1>w~hxE2ZEn!W;ZgWjZN<n4lA{5|E_Ya66T<Jr(I0F5+%9;Xo37Gog&iUwkT`
zEuMT&<+<F+<#cvX_&o2>fTO7uzrBQnl`y|KxD_CkX9#;aS<xb-n3u?HURSc+=iWkO
zcmj-r^(Umb?M%Y7;azAwtw?v^gypU2@HBZFH~XJPRwaVgYmoZz*2Majx&5h~%==7%
zip9@p``wvX@ilp7tRlu%IxhIlHk*m_*wVI>1KW2THBoLO<Uz@2b_2Ek`60r@yAN$m
z0m@;fMwVJv#`+LfY8x&g(6Gn;B|As1k5)x(xy5{4p$#NBlG7B2^fdCwt6rmYGLoJE
zi6-cWYx=2%v0K}e`()N-LK@xX%}z9nX#WCb>-7J&!QVQs*RcnH;&%RWm&9|DlyjhL
zCo?Yen~{i^77nUxa7{4UIr_;59wh<-;;`wcjHLOu0?0<V=((90=h+rltbO<Nv*Aa`
zg!jzY7Ax0~Mu2>2;UaG*z*It*?#%SR3O@tTN^!D}a>2nu)@>yfsfe5Z>MiCr3Z;=I
zU+-#JG1+-mh4uG`4{t~RncgKgIe*WPhAa%G9)ug==5#}F*Blu;4#JSVo3fE1A*SHT
z0k}WY&lSgNJc9Hk&$ojqy8ba{n0nx3QLAA?JFkg(jGCSIX=Ol+0{IsztAwjwVfXYS
z+D(k#!M+cg79_u+{?<}>-)m=h2Imqy@y#?7-T#rj%k(8B=GR*Ae_WbHf8DsaK<z|G
zG$x`Ie5i9YO2jtGrlcJY_>N!QOz4j64&U(_F@8@e;T_0uRWStot!PV?=J%nZ{U2_&
zd!zGg<_{(qk7~)f%<l(dKyaiTwgl#RW2ownf}4|4TpE5QuE%Sb4d3)5$<d@Gy>X8s
zNa0;FXQn_Q8EL3eRT_nx+g!^$&wAy*?PXTva;epgB6)!Kjr*~4<H*Q&W^NHxefCRj
z4${jSwqL)HzLa7uuQs@BOI6jLVVk-QCmhIe0BR0Ca9nsK{&s_l2~=G17QS8q#^A8`
z3VKs+`BNr3p9Z?Gth@EU+HBQ)*Wu#G3P9x&g6LlcXSg5M5Noc@VDG#&uYF}ni5-}X
zsEj445Ru;HZeGi>VC?wziMWqW7k>aw!CYNO-UvPuo3Zo@BLK?ylb+f)oKztX(kYxf
zq(Ztmk0~u*!05fEyW>@Z$76MgR{mcQ&w)9p#-bMCVp`OCr8aQtl<K%fmpsPAm7~pE
zZ{!smW5+?R%hfS+-)>#EOq~Alx)jc|h-pi?obz->#<Wc4ZO#P;#_}{f;|O+gt`@1W
z2}}LU7F6iCtOIK;(JnsI16Qk+i9;S+w!mh@C0G%QQISm3Xn&%}&uh29q|Z!MNTb3g
zmr~o$zqEJ<%|_np)tsdqOQ+^KQz3z^t+v_d9`pG28h!8+q-HL8z9)cdFHx8r^|s`I
zKnISWIc4gUN_o0@Q@AJ@o0hh+QT`^gPP7VGvx|>{fmQh|(E-4Ee@TR<pPh(Lop_<3
za?(*K__dKFH`F)#&O~^GC}{M<6|qHpyZb|KXOq*4rI~qkVFw5%XnTy0(D)WygI({9
zv0>(nI>V>BT5|Pk*_v)qr24AV7b0K83;nz-tR?q)+^wH@;T<oN6#2q%$aI74UFf^H
zw2&9wpc{Q%iTh<>XdH-L39f4FvNwqilKCSG*^uW_hz(mgvwL}PT>8zhxjN)6VWV=<
z+D;u+c@xoClKOtt3qv<0M^;suK1XgmDG*mw7NOJz{_^B^Yizo5klJ651&Byfll*wo
z>BzUr6Au>GwI`l_Tv<=tbJhfPkh;J#=*M|?Nn}ciVQn_j%d=(R=OAuj8P%KAGQ(UM
zUfK9Eyy3qZo0`vTqDctK7o`~Q7yt$V0#r60Wi6Ug8Vwiez;c5SKYE^JE^ydxinemS
zReZvRW*xmJ9vhMs8je#g{2b%Ok5y5;=*nBMf1a`2)V`4i=MLj7u?^m;#?%ITMT%Bj
zh{_(^7T?WE*{^Q0Nvxwd6SOp|QNs`kB74pK)%Q6JR|5AhZrMY!QmL&fO0>v8Dx#6^
zG`gCmOaq;ER=^a(OtYCTiYVt$uCi-XAz0pZ{o{{&?;s{%l3br6mjy%ViF!*$d#j71
zu6&sDE||C2CXE#BhYIGFK71?6!MA5kBYRk#?-?r_pT7OspE80s-x@Af4Zfq(C2=FO
z@hLiX96;OV^YVz4!M(q{+7?5)4+gJg#Py35y|Vo=!4+93vqg?HJn>Ki@7t7-q8e`M
zWmW(u7N9|6#XdnZ2MnAGkPYDRq7r$P>N<ZW;eB3Z<SAJkuB#|2utKv8X0nr1gg{}}
zH6BX&xP_B;R9xj>EP5Ds_Rz~?hSKzVQsu|>T9FDiO6y~lJMFErP&Crtmx@*6U4Vyo
zI};6W1YL^TfsWCy0u=4}I7o36bNsQP(4<-Ub!|Rw-ah=An+LrSuo`!GKn<5-vbZLp
z+caR%VOl}2`bu|yJ+hK~b{MgiJ25&zW{f_SFa5JDa%JQA7t(L{T9pM5F>jAK2@zZN
z4ZbF!VlQHFE1Z^_Hh`7yeb&%tgI7+(gpJHF76*ia?<h!BKZeZ}wOf2e#+=RPN4AZe
zw1L7*RM9j~_Le^(+N8rZg8vMc2A$2_s8l&m_r6UwN|rcoj6U*7D)WbV2M4m0q4zJH
zu6KYYjo01wDi~z+qQ#JuL(^0l-_~!#JZ#7WshOHVQP{XsMTgZ;?8JgUdXufO=lC;E
zAYO0tz*)7jBhi~QXVX`cYea+|?T{HvzW$iA_Q%~Nz6Y#Pk)Rq-2s!A?Q(v|-pO)K;
z7K|T)8ku+sZqYvow_3O0cOy<U>FDe`-t6%|EM9o0nvP^;wV}cH7P+CHA3Ozan?J(E
z*iwnE2(%?{>!SmgldnXB#?1jW|8fryf&kj~ZPA&WpS-o@7nf|fJ903%1OJUWawyxL
z4d6QlnL_o{!p;j=nBIX@V?3@o0p1`~tR<w>h#FX72<*lcx2W;hbP%G(Nc`DWU{-Lu
zR}+fV<(|ee&TdB@V-vUTHg>j4NGpkvwsosZH#FY{Vp8ig>5X0II-moqHNmZ4)sw5j
zU)i5jAB<gPE1+&u3%uHBRoab@YBVanf}CxX=7(+9=M}lvT~P1cp)$;MckRiF7?pP!
zI}={47WqNKE4}6`fugDk!_FDygbQ@ynj>G%@jiUIskE~t(YtVfcy)e(8#)xq3hx2<
zCkBi9c>DZqK(F4LEiUU>`DNxKu%jV1KqjP<A{0<w5P>c8=){j64kRIW;SyFgufzEG
zTCfKgmZrXi-V3I@U)^auZB?2${S3alWI(^>Ne`@p3kum|E9XlLuY^(F(@IuzSqATC
z%7DQ`XLRuiAHX4A|9B(rgwp2T>Wc}Q3fpQ5BTT`84n6}3<y1ePLS<c6Ypa<YY3B+4
zT$9UuQ({t7{A;h?%G0g^(0UDUvb@n%%|4H)qDW@msm!Xn*$Sx{LVzU!k|5ebPktCp
znCP~ccNw86@(G?e5SB@PKWITDys7oae~v#NgcW4&I;yW?_Bp?0^nJ#PK-tfCYoaH9
z^GSl=buy(r%kpfvSZS%%bO$C}>@jW0K(xEh3cSA>BgLw$Qw*>63tf_3f^L_1tOnko
zi^(!bF`Un+%)#7K*D*(!RHMcFR`o<|Rirrf1M|&VT6oks(h+T50}Wl#GPf8ZGU-=|
zb1?3$W}69_q!mF=w1$-{&lfynk|})T#h-~e&}t<&|2K8!%*n<#;MR#<?@C=PDjiSw
zB%}wEsMG(&3upw3aHq#DHp&D&4-a-8MAe-(05vq>6~mO>-B!8Q#sJdI-ocLdL#XJo
z>2vZQfp1V7iVhXK4xn*-8Eby;ldk%jeE%Wx#{bcAGAes3%Lf2tGIx4GuTFf}`wMWh
zoam=^V9ZOWYXRx~60kKGk2?RyTF%CYis~kv7P7PPJMU*^;vaKBa~%FMf;}x&if`TA
zM!S8O8jn{{*?c0Q0+tH-vQSPhzKLUTwql37f#($X@d054?Zoe8J-evOh-N{SH%f1M
zJM!MPoAG^3#_|b|x#oqojM>B328ZbR36xaP9&KO<a<8}YPp{^yjNG8E)wh@96aZ71
zD|3*i+2uM_f}uI4=ws&txGkeHgZPj`>Uh$>RN2iT?N)$4U(MWKQ&!%eP%HAo*p+u2
z5mnjVkqr@KmYqBmE=UgQ`kjbs*%c^eN#YuBBVTe-%X|QAc1!N%C7Vxrfa<3*aTll!
zTHbeYA)+&XZ1BjO#SY2|adaKefDeCHDUK=O5NiOBOFGg$hie)vCf$)u*+Dv$SuN+U
zg=>_j7i-OXTkzW)ipgzG{F%EjQm+Ng5C1CWL+Oz@C(J{P@>yEvxoxqxRV=zJo+C3=
zA1Bc7B{IL+M*ZxfRrRD3)Hizj6vVXpm<)(fVAWJ+=N`u`>su*mx}MiuAo&J&YN9Q$
z&2e!MK6KkkE7=%V+Yr<hPj2h0sfoMVZ=q`PR~m#*_YD{t$hlQ9A6n_kVnX|?5ITF{
zu|c}#|7#V`0w|RTAkWB{^B@3q3cG4^Ib?~)xxgSsi&%`&jc*<-wA*`pc#er`AmU+x
zBmu>#CSsI6fufIk#zgTDs1&Rfj>S{<27EgC-WOI5Ua9!mCtfQ0)r2UXBIh4htYd86
zr1YF3j(_ruGHpYkWA_!JpqkEZa+zu<Y1$zw*3K%3OCf4i|1(34b(OwUfJ?l$XZ)QZ
z&p)rAUjY<ZsfECS%~VZt0B?EeFP+sTaM%nLBrHfj7XU&r^Pn)h`K{m9HFF-xBL;*P
zh&`zrPx@dq5E%ZWhSC;82Gui1d=SsBm-qKc*$ywRudTCq0|1f`m1_ZElsAc=%>ow#
zF|$G+1MyyTtj^`Aw^;AZUW=4=!~HfVJ1J^f&3C%XCU8t15Tirmxf|u*{$l(ifn>d9
z^xbX$04Bna4^TP!QviS;RCa1=S<n>rk6bTL9a<aQ%h9%4GvEg1F!pL0u1K+mZ@c>?
z?%0iLyRL0_|HE73`9t!Eim26GFxz*u2ARuxEQ$qB_AN9(N8b>g#%J<Lk7ZN4zxUb1
zPP_zX*#E3nqRXMKZo2Z1Z=<(-c6xuG+=z04@Q6pFe!JP)wEda^Y~~NrPIdp-1RJ-o
zK!V6Ga|c?=gRo4kkjp_H>u$_-<Zq}6&+|9lRgt5G{`}v&z}?Fo5iV3>;mDMvdsm|Y
zFZ1ur&sRr9qkQcy*UOcjUP$q-rC9)0kUIc6f7i9E6C)H1NQ&a5T{b=y)hL*)oEjZX
zU6?l(Um$wD<p+qapwE2$IMhZ_wQ9w^F09p^M2QobC{b@w)I5;jc@h3_Q}IZQ(#9A#
z%|%w3$q?)`fxi&OxVV3TY@jaY*8M@fWD(@<6J&?NHatohl$yMzymj<n5X3GVd_C<|
zz)&VEyT2>n`ift6)oK@`!R)Ur;nDS~xb%?qu`i*%y;30u_os9lnv^4;=5zZYttB?t
zSp;gPrWZh@XNG>!*US54B%R<S8RLBzK$LR^-tmY1r`xI}!rJf1#Q!1mKs#(L-2iYU
zW^kt$pQD&3e9F=8sJ_>d%hB%quXpyivf4#A<2eI@UkV=<GEHRQTQxsb!Qh_g`-B>T
z4db1mWv762$=0hOLL>(TK@f^0uXOhf$ajV|(<i3U&<eMsyQ^{{tx@XsNyhwU-KqIK
z{_C5OYQTB3#kJ89oRS-Ld)pFbwsz-Ajhw|&`wyt?fhq}hcJ6t71d5K@p;#zG1BIBV
zF2m+7TcO##V;{tAp2O(y%D&b8yLRq+oFYDkmIGu~R)<*P1bysZ*<dk0CEW)Cp+Y^y
zU*%7tNPnE>xB%VGQxfh&m^ZwrkbK;w+4wNuw(}7;gm>$!Y=_JBnM`mCj{D>Lqq4(z
zCk6+}q**|XE5<xh@iT;~!V?B75S3*@xCXGHdv0gvLsP118Z^Nv@_3Ce!`gw&2h1=+
zw_i+$@(tuoNU?%{f6AcJHD|>HiVU2+XV=h$0h=S0#Mq@g=3f@~;l3lA0}E&g2x5h8
zgg?gagdLw!1@rE^Chmgyw%62F_SWBacqiDFYBTS+g&8}tYT+c|3&x^mclF($|EqRr
z2S`J>q51cPPEWi!N+M7sVB-XF4uMBzg&%;>9i{mVkn#L1sdp5ndmy>+sssxjGyhip
z{m|hrO-&zXfoz_3a}52$f9pVwG3L8>3u5ASop>+IhN#+^f^Vsb%y3R!9jKjoDPDFc
zWiiW9ef5G?dHOrYYrRtQZjjD!ybi7~yzJ!}DFYDIh}IvJRh9kVI=uPT{@S26Gsl!2
zn5n(HD)Kp5y2$Hkq#)jw${1&iKghWDDyjZD02UepCViV+{2dfwss1Z%ihW@X|25r(
z%POla1L;FG+zO~_%#n=jU(I#FJS1;a+5(|yK%N?15Cld`9OZ%muiL2-5z}M!%s>m!
z*P#Qvf!6)c_9p=rgrvf!P8lT&%ZU_oXyfj#PNH`dKn&3M8BV4e`R~+Y2^YWr4M1P7
zQe{2yE6+~t8v*l}nNta!T&(B}Z~(y`KuP>~zJ=R!9L?*s9_H`vlc7mRw%!t1XaWYf
zFPQn|0KvVlMEJMohS~m1X3_GD6FK|UPEfw?iOUy1O40jKey(7doJ2aw5j`A}HQOu2
z(`1>x#|E6|+SjGiD{bX8_Ip)Q`tURCn_RD~Rex^_VILZZP0zL-q+CT@_*Kc>9$~%5
zB7;SPrJNGR==&J%MvugpdIOc*!#d5T5@MKz2@x5uS`5gxMT=$_zz1p+`u2Ii3H*)n
z_sDppctP;ItjX}=*$|PE>E^)b+A2XDf9oKHD+qlH_?${OC4@611d9utyC9=roZ;u{
z>s(M9V`DVj=HeOFzxuEdT5ngpzqlOH3*@$j)q&%m?qcLVSDHfnT>S}|vN?OGRj;6f
zm!wTR01Ue{YSLF@Af2`G5()88?Y<V#2qBsM{Bf9T$4oWYp|aWt&R}}6>=Qz+Gz3Y}
zOQ7>s1JOX^?(Q31J^m(4oP1p87~1ZO<L@5Ua&}j6?f~&8w~<>}T3xC2lbb&<s*}Mq
zWJ;7L1|%<UZL~xDE#L%THUYJ}%;%UQvtF)W@N!y3^5!Qy3d6(2^TL6p#=#jNM=)CO
z1Miv$O~%Z!d$EaSmdbR&_o!H|ZKQ{oUcy57Z^)%aj$aq|InOsi3dz8KSnA1(@9l;O
zGNx<6E%~q+;P?sHi}~x0BZ-!Oj7ZNp^(mx4!Lnyxs7@Ye0IQCY93d8NNF3PmYreaa
zBlN}X&%iNSBsjCRs691+aP!9GT^O>8Yc<^FCTqp~jNSuRB_NAjC?&$S66^W>2@91`
z^QH;^exels8rG^>F{j0424WcL&)+ZGocu8aNCxWQYgKlpgVuBKN)M7Y>GkW5kE33W
zusV;~08zpHs5+62_nn~ek9)Q1L|T3@&gQ_nT;RJqU=uwOg(Ydzz;-48gE^n0S{`9v
zam3N0Sq24wKmxxZgY$|f#I=XTE0KxawS7?u#w{F!H6~K@qkM=`o&I5~(|FhZJ$csb
z=~(_;d!o%%mS>^ArK#sSH?ig-5g1#z3lsDk6|8opdNIjW;3%UR`cxMD`q6E&^~gnQ
z(%+lA=L!L<XkJ!9C8jYn$UZx$x1?4;BlT(_cLma4x%`ajpgUSx5Djcp^5bG^R`ar!
zsULwzQy`n8bbwl1T8Yw~U2PFTG_TFrb?nFz^r1ue@A|}*k-u&cZ~Y^jBF5-3^<B!6
z7yzsOk}Cs9;+*pS_Dm9N14`f|8&FU58U@7*d2bXa7qju&)$yIjf%uY+r0I9o+zb&_
zep46#1k538bN2;Ju{#lOlv3xFu!;!-6ohMB(Wg`zzAcJp@kIS*rT;>FJ(I}k*kQzM
zJqQC1uk-anMYc7yY`Q2<^1!MsU%(7H1<2i`WrU<dhm2?h9B)#`Q1)(>RGCx%?IXE+
z<2<pa^`sERQEAI1W)Yg(FgJpa$5eLcsYcO?YU!Wz3O1w=Cihh%rRXl0xXo!$g|t%q
zYJ!6&Z}RkC${S!f>CG`9FcQ#$NoYl(0j!TRECA$193YhRCwbyS*LF<b56+ihUdgos
zmp8?W`&rIe{AmpI_Y7k|A2E-f<y^zylW<QRxttb>5&J{TfrLKb%it(g9i#5zv0$Nh
z?IHP*C2fzW^lx%uU0<e#vT(fb79L))dZxnh5}T+}<QsA)0$}E`d2hXzNiLY6lcR-R
zs(~y0?-ur~He7m6kiPw>o3vAfCQFgkrpnPjG8^nXJpj}1zk0BRiscxjLCTLm4#5tf
z-!C^MXs>RM#yVaH*mdewlIqkv1s7HUj%u%8A~bKZs}fFqFjEy@y|J?1uG!5AxO2&q
z5-uE4RjfE~5Dp|{0V@^0AO<`yo;9EkDg63OB}4|uDpUeC#Rjjbu8c@&hJSql+7Nhu
z9t*~cZY77fZ~K$!{!OWqa^CUKh~NbEs|6q`&vsy1o+EE8CSq{7S0%8p5LyZ|B??_%
zRVt=R3GGH}6g=IxxN{(9zP^=Gmbsg<>q^|!0<IKV`m~(JgmqC2;Q*qxw@W@p-jlmG
z6+xA<^j-C;OW#oL8>+v3IDg0-s!Vgiglz0TQv7wlDn@F)i2}e-KbR6fbxvn>tVN5u
z3TWNysY}#}fX}%MFER#5OI1Ep8q4Vd@*3!*3%@euVcowC2<=Y81*J&`ceMDPkMNf*
zb@9g01B7VNuApD>SK!M}2JGKv%}&JJkp*p*(C6Fxy9+r^1BkUlxcoc_+)`?Hw6m+f
z*<-IL<|7F5;}&|=0!3frtxI)DpH8&jyT^k%?`}VMM2JzhlXVCuJ&GrGPvzesK0kTQ
zO9d5UiHf9B&t%J!zHdr?93FDf42W!Cu}yikfJCBjei#@-Atzs_K>zSJae@B?=<%@V
zo>dERd$&Z}+XWGXM9px0T-#mUB7~~^^NW~v0FE!-7WMF2cI_`MnEp4tl$@T8-<B(Z
zZo4K3#16m;&v*e06Q}`ld5EZyW;e>zHSiIVMkIJHX*)qU`Bab?1imqkNm6gwrB?H^
z{6mLW1y4Ol<{{M9-wI$#Q+YLEqK|0t9b56+Jh#z?pIf)CeBXNZ!7M5JZ%_!7l=nn-
z#AINP9VCF=cY0Q?R?1P`pZQ}O*CE=dGViI7l%h2=V&WZVJ(XL8Db@rN<#!`j{sf|2
zu6!6=Nt?$64f}XKbDW!S1bnoJ7Q9kKQUM&_F7Sbajm1?1K&0EoORNNpW36tqBjqIn
zTB$5w$tNlqR?6%Iuvv=ndkF`3RaAm-1z)1dJ25F3{AKgH3I>ex(s2QEjKD8aGwc-i
zvJ4*)%WK0$ve}hS%NR73KAA|`Zai)6upK{rP?1EQ&)bPo1gRRa4IoHPx=9NN3B=fy
z30I!tNIHZmpb+g)!tS;M-#a_6?jQCr_~FuY;ZFF~se(JUK%}PFhO0?VxoAaFfL&D0
zrYVw9^)7r`{Nj23%wH8}hQohVU1d&VSQjVYbKdX4E7wQwNATbOmSpt&=C)5hEZy$L
z3t$l2U+6IOJCAz)lI{ls-9sd!G!wa;#j629sY>OqIH{6Q8vGq5=a$&R>fulu=G(*o
zpNyOQ_yWJs>Fn~B^?ajZQ3dME3Cpgf&$;z&g2S&CVdSVo1+w7NbUEq#>=wnDkw1Vl
z2<RVF`_jP)wNXVe&IYw@#f~pfGljbT4qKR1FUxtWyi+hc?zMvP$*bFP<*A;P+BV9m
zLx`;SC~lQ-`vgECnt@Vk)D6fch=DT$G*5h{upQ8gj`w!};(_7O1NRcV;~b7MNd9$_
z;4~}zKin@&F@kR?p8X*ia)GT`w%myTEcR^t(F5N;9d3+*@-jJ%O#^1a%(ZSo&ma(Z
z`t;(&IT}*5EbBI+&Cpe=-B3fQ8JgD4KhJ=_9O-R^Pszj)Xkk`^xk1~vYO&bhicOOr
zRaEFjiR79z13JAVX|?Wa-@k8Jw)fP13z*}T!6v)aZqYKQEvyG$-|?B}?B%yr39q_`
z2$cRb7KMwBc$5BTERO$9G8X3@brcTVQ<Ck**acpAmW^LTQ?{jUnRJx|;}9u{(W2eu
zzorSAbm*QZ<p_%c&a$9qy+*uk)QklygPbp^8c#*(YTdfT87rJtg6Ff`>oRExHmXzu
zOHeeBi2S|-?YrC+ee9jL?Z5AK?W0O(8*G*}ukpu?<$A=~y73C96(&i_o&htkZPE><
z6S4nNpODq`eM`Ku!ZkOAe3b~k!BL3Jnw7CM;YC}qMu{rZz4gIBslRXJxA>@6bqf?k
z)Am;~{D0+k7@5@d|E2@Sw8KTl?f}{QrS+8A{+4{bo>~5@^|gk|V=T{^UitRvNF!Ec
z{YM6>9T@-nmDf7Vc?mQ`?qj{!GT`F1*LY1!wOEmCvV2yg{r8BQ5iHT-3B1`~fus3O
zFnz*Xj`qA+rWbl{fP<kiW7o<A5crjxO-G|`P3)>Q2?k$l{4KQtWI|Z2jttpt>ro~R
zV|Np33{3dUi<hL{L0|$uexKq@Tj_k0I_h5pdLyt{XeJEco8x}~$_C|^<MF%P>piZU
zcq$3Tj)+f)ha^0PDQMpuBEqlp5)CCIG60G7{_?A{cTm=d6dkLl`wP(c23z-P5N-Mz
zOPH|g4G?tj!eX9YbaCci*ySrL&it-O&+~{2=mG<oR+F&=|3KLbNL?+0L(MVS-8BZ!
zYeIO{U;A?#t>gw*rw>}qsu96=s|2(!ve95>!-0<*ZO9PZn3P6WE|Bzi<;m++hxv#7
zT6@ItJV}=l<N5!-{L!p%s!=Rv-Pn2U^1Z@+?e_Z~%@$qoKKd~O7F;?%CBKr%8&$P<
zmpb0roVV^KvKKjvTt#($fBS6-)^wZDj9R*NlWPIIAQ|>T$ty<tsAr^$a0-x@ST6PA
zCHUt9Bb$zm7Tldv?)>q*za@-=!V{NL(VgxS&%T+8bU(ww^ra6=mH(-`K{#ZcHnu4z
z2sgdIfZP312A3Ywug4Jh&4}Q^0sY4nPeQ*Nzn(kM$#~HjjR{5~{-_s=hK>t9EW|--
zUe{;OU$YhWiVU>{O<tpk=vVlm(b>>B20nu#0~7o!3dPe!*#a2eQJ^XM1OM*M=`W+>
z<fYXciIgv1<5zhWyaCEH{Equ<y_sia&oUN6UdZdLx{6pWuG7mV!F5rcq(xLG@fc$`
z934C~u$C9Kdt8l}4En~9Q88M)A^()EUIwLJQ&J4M(9bsjdnPg5&DMBt96OM>3nJxq
z)M%Mir22I6*>6(;C--y~Eb_BiQC=7BWvpGb#au3r=dO(HWi*9GuNUCY|Mxy|F5uEb
zv8xCpb_0Icg%|OWrU%96jh^tFcrH92UMR5IE?gh(n&@5sT0%Vq)xK8njPj_Zn{fj1
zmN)!G)V*fFDC>w4np?E5VJ>h-QA<01-pBSUCUrup`B4?C^<Qm|cCMS^#_4yZUxFf(
zV(+WGT#VfK#@YA6jD?#1m=Lk=acGVyp)PFZQ|FhFKT`X73tv(9>f2_Kt1;8=i<fgc
zBR7&7%WtN5{p^6;N&HW2FYckdRU8`aP8M{o?%ddVAqpi}A@fGZZI?a>@&qM<a>1vK
zybYEPW}nyln{P$MqW{p-1_~>2(ZH1`)+~AT6Gi)va$z1$m}`5neOa()DDQrJb98_9
zsCZZ0(?!wB5abr3d3xQSJtU$&!wg68(4J4{(}TBrrf2>$nkW_N+u{1??bB~li4;XW
zeh2nj{bKBky1ktiulF^WRiF-P92@Q7bkzGjlV5zcGUW=WD2z|AV{3uX2dJxaO~_~p
zD-yx*Fw4eY+A~ex3;Xx7vPfQ@t09c2&||lX;5uK$llVl;m(k_aWo=IUa;HaXn%~Ju
z==6(~sdh{|r3A=OIN_b~v#_PqK4NNRe@P$lvr+4(&-G(rlRWDmMz4hX;}Yn5qb5iD
zM!#Y4%l2P6*VMaQMo~TWejS{s#p=$UrB0FQy3E;4PZe>?Z<a#C9v<B4-I^Y8t!>cj
z?#X7uh`n({*hHJhL^Ok^F_E6lVer0H;>*@JV?Pl&#!k0z{r|j};_u}|uI0n3iMOKh
zj0DOCA*E2vX39ryWD2M78P<|(SU+0?+{Q6zx*}<r{KVp^OFCYw?kI6b=JF!&<S#N)
zTPWrEa>K91Ua0ob311%|{3^T*{_$Z0hCwuUNnM$CWpDG_Gi@^M#V(CgAL(Ax5gm(9
z5_WKu%oeg9`v_2@Yu<B3UlsApOcm`GwSPPhMByP5o(EC4w7;Dj(pw>&ZFN4{e++T*
znS1*PYDJYY$mhLTi^Pe!Wy?I9H{P(Fpy~h0qjT`}j*JBSub*4Xf~P(!=9aH_2?CZ1
z);|ee-L@B%1)p@c_;ow16&n;|iYdjI5(-~LUCRs=h)$JSzy*Da_&1k;EwLB?Jnq|e
zBk8&0(Nzas%)#2;L_GVw;4kf;m$V<rPrQ#*vA9|GS*->#KSyM}XhFY8NFTCz9h}W5
zxtN6KMvj0TG{=lPIZ*-4X=SfDYd;gj-SR8@h5Rg`58l^Wq%Qsx_0N*e(5a=+*;Blh
zs^n$za_9f9r2u5hWuyRGqK`Njhp_*id+q!F@3|F3prpN35WT_7omfnwtmKoKL{_Bj
zMh+ta$xw5P{`{%S^-T$=wHg)2sr@I&WEyq#;2(yKd}^rHTgJPN%DI9c)!CGza$+kZ
zEhP7}v3&v+5hClbW|M6xuFB5F<($8YA3`7>imR*B1)ZDX>Z{f%!Mk-D&pp7jpKJIJ
za=)x*-A!;>o3xy2fj_84vjo;r5os^N1}oy16lrIcLdW7t)A2VBH%zP)O(B#Y6Yo)2
zw@2u<3iArlZ9;Y5qq`Nh#5S6=&6S{J)K!mib`7-pDuurFyFt!X?pnJcvvB_h5J0bw
zFwDemn?QXlm=~~JLVJ~lt&DG;!U%`MUs}f`t{#YA{X(sl|2hYY#4TfZUMr;aa^VAX
z(>bCkM*JzLyC61Eq%ZzdaT?XTx6C1P7vrmV8s8NsSX@0sOM0ts_WMnQMA3o&%bUbv
zI-Z*=SooUQWc6Wj-E=)q{@H`J_1f02pZ-$XqBZu16Yk2g;TCX9b!T-vcKkbX);*z?
z(}WTBoXkkR7W~gtIYnSATGQFybNvBk*!CW<Hhb+wx#p<pSj%=w8}O=#UnU>V$iQn+
zTtyzgUe@&?(JjcR16`AS%ZsVe11S#zTEk2O)_bB^>Pj<=%jwcn`s+HcZ&bb6WUJ6v
z=ZnpnYutS$jWhN{2mSRp5<j+C|MD?6_D)+Iy!l!a{?bE{fA+`T@ltK}jNF}$vkooq
zDRVH4bkWZ8)4%|Xl|@4=B+{2dkxvvX_TRTUval+hnqxBa?Qj3X;^*S;Vy$-SfqxT)
zf8ZZr1~=C<#6?s8!Y5K@P6B)NzI@6j%AFRQJ%L%TQjdsnqk@Ur;05viA>iPh$uoOi
zc5b&by5Xt=E<JG+jbLm`!)nO-w486>y^&=4Bk|be8!S4QzL)W4WMU|#>$aqMwL{-i
z<_*{iY4!WW<?L4R&1?;z*|uYVg~DXo9u}913Pl&f9)(RXkMK>Vk4KqHfJ1%xh99GU
zQ0|qgGyVvwzC?84(~-z2pAur$`}J*`WBy<Ny{;r90-cbL7_k_RJO~1QojGlDs`TW=
G*#8fTJY-4$

literal 0
HcmV?d00001

diff --git a/docs/img/database-access/guides/redis/redisinsight-tls-config.png b/docs/img/database-access/guides/redis/redisinsight-tls-config.png
new file mode 100644
index 0000000000000000000000000000000000000000..c35add5405589cc78db80c0e50f6f10605e5754b
GIT binary patch
literal 326444
zcmd43cUY6pwgw7<fQodaN@!A~2`VBbK`EgKNJl|JRS*#Aoq*KP0s^8^LKP8diZp@H
zQIOsd=`|n-p(G*YhF{z6d(PSW{&{(xB=eQ|zL_;^*88qCYk=L=2cJL7eU^fP;=Hz&
zx)BA%=|~C+Y6m(R@|iYHCT|J~O0ct<+FflmHU7Jv?hl<^9VsZpQtWMPShOX@zS!E@
z*nH`e5I^hbXA~QoU}OXBYU$u_<?piT;?H_%Wi`*qG*4yHMp0ncTI)iez>oVN{pJ1M
zaBj(if!aHkqbVVm98zk|ya{A$Nq>Gni@uOV;c?&dmf;yHD*Lm^WmeWk6n1_TQ-T_*
zV9F^k)h%zjAgb7GYFhwh>6tU0G#}h4rcQn3f~j8RgiuT=YHKZSXt};^;%`}6L@gCC
zJ$88Pv~atnzA)nXXdDaE&n(E@dugw74D;vd=!;BF4>UTcTs$pAB_u>cbN8j136z04
z=2F2VSEL0|kcK9{f}Z{xE0dk}RW8n&TDdD)Gq+<)ByDWw-ED0qeVh5K#F)1!y4)o@
zox3!d<l(GTRGUpC5~x)6N~OU=8;sHdi8L2aB#}OIIuS3@L{kM&yw|stUHBv>PnN8i
zqlNZEJw1xc<T4!vWsEZgHMvAd{&15&6ckj?qbX>~zbxdBdhV&eubz&~rTV)}?QnAA
zEn_upZSt?Ny{Dt&6E7!sZ+=FDdh(+tolPvfE%fdv+Pk|++d8=0IZFGxJw2&Hq3o|n
zF1k5-+w%Lnxjyky^j8u5;|@h~`Q)^WApak?c)O?wTIk*7S9AAt<d>JeB7H>=c$S}^
zU)j^)p`wwx=3mvxM=F9&-ri3YWn}#P{G|P^O1pbLl99c6^QO!dIT<-QDe@gsUI9<M
zZT+R5cnSUakiVa!?&xLj>HO5&+5HLs$#ZS(+<m-N1O-oC^v~a)?R4~a{@0tHc>UEa
zatCEjuE@wrUy=Fe+2pFqCubG!I{Q1i-cxsWBa4Up4xp^8+%@GtD*TU2|9a(bRV{w2
zdQDdD_o}~L`hQn7^>Xx7b9W=Z)EoG(vH7d=?-&27s4R2R_upjkr=b5hOO`b7tg_5M
zqXs-Xyt)9OpirgIR=;K9Pq~#%TlYYto+#SH^nCC(BX!Aekj$yGVs^J~nZ(&41KD@R
zT#kA^1(}vll6*U(-{$TMHtFo>@rSWFYx5rnV+Y*F1CEIOib05v1KPJw1t8b%J$l%T
z?fLfE{1xG$qp!{dAsgz1Fy<?#G+XF6DgXa}VDXra{@&wP5DZMn_uS{=tJgBt*ZeYm
zpz_<JLvc)4U3iirF0h_|^Owe)PN84u(hhoH0<i<?JC-=o{b3wJIzV?1%soE6Z~%^?
zauMA=rxo&}sAd9U4Gkpx+yUTnOn*qdh87(i$v{bae|}XIkqD&$e!gY))X_e!^}(DB
z10xQ*@UX;K>Q4vr;0hV$eSyht8HOrIXj)u6quZ99eu!;45|^Ki=7DAdvcRzeAPBUX
zbPX2oAA%uT{t&|BchM7@@YM|V3S=WOVe@hM`3hv|qo^DNkvP<$W`Q}*KteZgZ~GZe
z8esq>SzSOvJu8w}CXnm(Ne6^0)Ah}~0xjD4te0jd3-}bAMr3$;oC-Lz99X8_85~ZE
zz3|3-$q5`Sl>$tU7M%C#z)J99B$T5Pf5{PnByXvWtk|`42XD<Sfgcj(N0}i|b_V>x
zfw^s-m)ctV4yc*5Zk_KXXe~2ZVC{zeB0qf>984;CI$yB^V!xnx!@C(nTsnqtUs4oZ
zJh-ib8hZhEJ$cCy;w&u@M>PKb{22OG;)uG>&617f09k|DP&=n`MMI4Fc~sUFT*j$c
zwioM=sIl@48!?`hVZA#T77m{Dj;F-4RDTa?GYN-XT9c88NNXg%CAV(eOiyp%^#nvO
zp^^B$pDfYLW!BjBpcox*B5`2{kVQo#uIxbm`WibvHn%d^{l<m>6EwuLsAc3A)RrUc
zciZv)^Fx|&eS%NO_G7K;B5RIL)e42t^o-CA)2^43V+R=Be5r$mTp^l#h0$yzmg^ix
zI<xW8oU(i5xiz@DqE1pnE*fi|myeErQ9&N|z^?ViyId9Gb5ODf5gcPb3UNFG>~l~d
zIlW*!zNB(6K)rVW0D_Xs<L?`!O}c{KA&{ZO@qu{Mllz3kwKxQl`IQJTlxSwLuAINJ
zwi8dn_7cJdUa1|ytU^4##KV}9NNuh8ba@FJB~P|d#eJux<|g3)L6SuV(mO7X&~1mj
zB2r_w7$a6QOBaV-DVCdNh17KLgJjb{<~*XM`0P2%F@CAXDXs#E;@dbj@X=q-=^>aN
z>7`q&2k#Ol1_0R-p~OJK!a>Fa!Ww#f9D{_KZi*52f)h5yprrj1{dBbkjP8fD%^@#a
zRli9(O7xvWMi!3GO>Pk5LAS*dU>BE03@m3Z)>J{(-r=jvAM6$+;SCMu&goy<;FxJa
zhjA&z0M%DjA2j$2?%vvM6&h+DHVIJ_SYK<&F%o^XxUpzTbTy*3^qw^Akv8vz<tt1I
zC<a`UUnxMSxnVaVM-&{26*^2paSkzjJe_%rDG0Q=#X0wdcQsG1631>9pmh{Blozx1
zu;vf^nu)=rA)ox9vTdPe(z93usKFhF-CUD#IbU{T-^$eT=zImJkvMOiw-(pW`U6~7
z97tF>;8=^9K=f@!Za#BSKQgR9s&;J3{J0@bz=tf9f&9lkwCc(a@CA|3_yH}Tz4`=n
z>>Y8qJAgl^r}aJZmylm6@4cq2_zN7pM6FCA>Zia)|65n#xbpzUsriV}@53X-jI2Bh
zZQ9|9o+#n3?=&U1Zekl6d}QBj4Rxm8k-zNaCj<f>;4#m^yPjiMN`d&@BkbDdz!6{$
zS{h^<{AN91VGWKzT0^f*7&K^_d`KF^4Q$F(fSQP_ac|2xRFv?9f&dZ)&o5Oxp?wbY
z*Vj@MnxHn|m*ds|uf0ziiphy+n11)jbcng4A9Pv1S%xzpkKPOr8wNiY(2@j5YXOS}
z;SVS`bma(fYF}yJDWeMd!Wn6Agl;WolxomChY)w;yN7!!0u)HYSbQSXhk(JOv9;H>
zkz|Pz!oyC?3WkWrS3t=&m@sh!Innt8^uz$U(1~nK^f0g(##=%*8CNclII!wiQ-hs;
zEVzHy@qR~|OmD<8)h!H@AWSEl5k{34S*Zbs1Fs!CGOe=h-#6}gA=kwry-Srqm})eC
z;+=9O345J(&*r1T9&0?+5N|rDA0j_#2(dzw;h@5+cMV`}j>a7wOf-^Eyp&`i2LAyH
z&<f~<5W)so%OQa^frL&}+a?(UTv$qR#4?vibo-{ki9~~K--GT6c{Uk!9S9yNL_W&N
z3A*e<TAJ>r<=Q#`pjnIiNzAoCnmw0q4J0Sm4%NX4pCbEv7@<Y4dz`ww5iM-~!3tI7
zjIS6~0gbrRHNd;8Z!;-ECKm>n*9;K)V!_TM1|@jR7r>9$?PjZMUEqs(fZMM)G5l10
z6*oKaahv$Axi!enCbD5Tn6Lp{IEL?#t%Zr-X%IAXGedtIWDVW7CT%pMPP$<Y4Ip%e
zPz*JFcpN||IW9bzzJY{$KiC_I!NhSyme+fah5b5O572!wIy_;R@UKs8*d{Hjei3cH
zl0)JK%ibR+QjC5O3%fi|UEL-AbOTKBzz6>_b@h^p{Jw|h-OD0HuFI*W=XvmhOA%r~
zA8aRn)aR5Y54N_~K(g-~D6uLB0qlwh`HbIpk^bO8q}RDXHk7sANgGz=shBN<XP0j#
z2F{XNx=vKtXJ9_~Er|3dHZqnctaA5lR-9$5K)!Z4S0?K%bAT&V1Y;yz8;N_k_(!m9
zL>A9UcS?dp)*{H0(<gd6qjv<SYnixiWwRal!ZU||zD=dD;vmM=(ZJFlMO3@jEx%ff
znCU^3YNP=mQym|^yKZp2o*4#cUw=l&`I=4=z{D^3uA2oi9jqEmQ6+PO$E|a4W-JNN
zjI#?xO|qE#92B(2_!eW?3r6s-4fKaz#(Q(K7NPwPu{<PH@FBLFeGI)ihr&&KiY`M{
zEeG!%teuQcGs*V@@fVqP0CJi_iF@h?=vw3s;J!;(I;v_P*Z${B-N%h=4y-s6O4jl)
zH&**!#{~(n^w!P3t3YlDX-Zb5tl!hMJm9n(fUI<v1Cz|KRhAFcJGzJY?oz){%tf{5
zCgrXrThHrsC*B2|Rix(e9s+y4VKfBztniEaR>LGh5{f)lwppl@ur@J_HwQbjs&YPa
z17*Rb_@1)e$9PO${K@3_i!1#JtnOA`9SsuzYp4g%>1W9&vi9_$Z*M}$L}iDINNj!Z
z@xG-I>h<nX1q#o^mv%A~8wbS`2#-Fl%^46!H!dPbuaPvYSw~v0FZ2CYK_+K-Hr=IR
zG$15lERHnt(GUw02Y7Y{k1}IT%8Kwe7=oSYPhY9VQ2PU^Df=eh+N))U!c-GN;tJ$)
z_)h_#c0=PcC8@Qkcy8n111o!D>-3HSxV^{9K;BuA_^VJ}cTtS}4!$ow$Pffwn!_Hf
zq30%$CsyZ#B`~_YBaTC}-y=_KPVLA6@}y(_WK4_svry$Q4q3!neD<hFbZKk_LSaJ8
z05EKH0-C-2sA+I+Z7$u7<})!NSinAbHWDT!wGdHm&^X%_&3LE9C_mLkX3_M9b7!nq
zd$c@p->XBR{$63|q8R8>%$@}8CE)%p6)VfWEK*+)pF-RlsjzwtaNAf1i;V%+AaDo*
z+4WxGk_E8<TVO8T=|>b1X-hQ1aFSL(otCy@WkEny$ekd*L#s`s^s~-EFAKMH9?hY6
zhX`W>h}D~Uo6$xX%t;T|A{anqJP?OA5r5%?LP=;`@21Q)JTM8Rzi{v<in`99JV2ro
zvEvy76Sz#}UHnMX>#C=*=Iso&!RwvKPxnboYDXk1soh;?A3`^N)Upr3`N0?(LMZd-
z+Wi7Xm#$URenmH)rLy7{v`K@wb+yr6N~Vmh(Lbx>>Z5K`f)=1N!8(|#<tGMjB#4qV
z>%&h8P)N@J28D$UNkc`^=6CuY0597UvwE;sX@Xy{{Go0TG~ek9GfGT9)ZW%MkPTNc
zOAz+$KA{*UrSL3f2gGj(JDET@;`c@{hPb)LIH0dSa2FLytRWI<HLam0YiBLivkW&5
z%+a$wKFfbn6t7Drdv;dP&488}#d?xPrrD;9_s<+;?%Uw9ZRFDzizEl00Z=frH%>A(
zVx3RFDF^TaEy6vBPOoGrRDBLiq8envEz)XR=H{(IX#7<y0nuBI;1Wha&~)sU2|Uod
z$3SIO)bHB>lD@jv;2WnocFF&Pc2&wnx55XZTQsjhtL>nguTlNjTlwN$NSKB)DTIi{
zp$Wyf;U1r%uLRJn`-vMOn!`BbNWdSEEkMO;V8jV=Rc<7ru!R0i#tIO>&54~G+1w#w
zi|b~C1)!w)z(;thdJ>xLrwb9~@`*UiT}Z@t*8CvE1aph}^7e%DmDD<#ADBVYEf1^Q
zVPgV@2$=;nb!wU-Ei0XtIR52_OYtm(Q}WMx`ob8aCwUJT1xvX-(joF`7$I3u08@w-
zMjRBlCy-!@-RNexSQPB_X?;)^Z0(wcXbxW$9ar6Zgno_~#wH^FbZ1PC+~=SKvL{np
zuW#oT?$p%wF~6C(`=>!uf{-=?^Y?MzH{C0cO~k{K0!9c*S|=UT9_g0pF3c(3gFgHy
zI3NE7G5}euZbNeVky^o<5R;BL>^+W=F3qETh4J@Ke!*ptU2rG?-7Ol|l^f8}+-dzt
zbs&R|Ivi{XND|RSs2^5SUS#%<yT$WatYfs%q?-ZoX~R6z$YVLfG%;0w$%Ic|5QPy)
zLlu<qj;5Pm3c)P33s~Y(0z<v~Aq&C@fA<DM>>X)6A>vKM!RfHgTP~MT_x(!t$#ck{
z0!bj#CM2FPGKb6@&_Of4zwiwy8INa0oZFNy+f`hE?*F*E2~5AwQ`11QH%1`K&!w~^
zoX#}Et5uuw?xmEPhT6s6dEw4`gD~8UeRS}gHN0_I&V)iv;7qECwH_ybA!}^)5^Xqg
zYcl`VJS7mwn<W{i%?0A@tXKnA)b*6q?Db|mFF@j#->wb3ix%Uve^VaJxh{OG0>94e
z%_|FPKENK4NzUAFLlYh>aX`3XpNnoK8;O9{`h_+3sPGBE*!8xXfARPuJlPup{6vzl
z$L8o)s2v3Rh5PQi%DYF<3Xl)bpU}rXl%_vEH)A}l0xc9}$UlZJ=CiJ@n}92h<pay0
zLt_)rvOQLCzCv}C#(sctx7p8^2%u+g%%L3z^P6~;r&779OaVL~3e-OMsRtN7FT^t)
z#?~!0NG&KY`(p9#VsX`%9F}Z-1{B>PFOK63);3085Y(A!?PZ!7$~@kYuHv&YVet!w
zb*}B5drX|1K)XoCE#dVN$jp*>j4v&}S`L6f`;Gzr>&=GbP7sY33XjDt1e!^QR*fh2
z5II5i`QL7HSaF;f`c|(oGR`9FIQakI4A)u7oMCPZJHG=^!4|J99A}Jcr4d4i4bU1K
zF-m_TWgOB_vyU%Q_a=4HrU3kPV{+tgE1#*UW<RI0drhR%43@oU{4S?7(Q5rg-Id%+
z;vMi*<LnQ_@V5r4r=9~<aq4aTy*{B@(uZpgDYF=9zo%f|e#G1xvzL?wg>=|AuEX*$
zY1Ln0$%v}l2@YP|u4yP?@M0Cyf}~Q<ON8$?gKRZXCV~gC2e9j$0lDcF+x4fLwi)mM
zhjW=F1(W`8%uclR?Kag3&)Yb-F~=VmO4>bwqm<H{?LXm&#lTAA?BSCMC?rGfC>gV{
zEg`LQ$Z06)b>{8{oRkmRgU<J;)P|D!-U+U^^1?8s`XE_xArcs*$l#fr+JFJA6sfPP
ziR~r^=3K0{*B|@XaEso)wnLrjKFgWdGPTsA^PH!m8<{yn#P&w?Sd_fAtRe^DAVC$k
z6=T=wcVrORHKt$5C|h(={xE@A!o(KrYRMou!C2G9;`&eMUXf0b)ne%&oIUX+e6p&n
z@$x1XW(uhF?w?a0Nch9d^aW*{#BQLCb2zf~H&6!b&zNqkxuf~o2qrFx{y((VP7vHm
zrok7Fce7RsCE~EX2Q7XRm`2!<A*#XG1cx1IjK<@?ifUcxPxYVGT3f3?Amfj*66J|r
zuDKJ4Z7<9?0=j-bySrh>@VU$^DK=(4rUO&$LtGMtx)uPfZ}c!4zHh*brQq;Gy=MM4
zG5P^)R0KQr=aOe^pWo3e+H<<ST$prMM+PyRLZaiG{t#bd_j5P3Ob7VQ|G5|qkfpQm
zL9IryMcQ(*ifk+Zz4j2!XpR+cr4)#sy=EqvE(=mr$Ch;CCu@2DKfkX`;M2{E&^HF|
zEe&w3p=GQMnu)KEK!5ru#Ybq+tPCDsHf}P{Gy$@Prh#4TrO4Q~L*_G(v70PAq9?k}
zyu*GX2g^0UBBAXBOZHWMMl}-O<wS;{Az7PR1pK2}j}zWpGox#%V!S&PVz!$v1#C-~
zJNybP?fu^N!T3(_60SA}AzzcGl^|-lKNNjv$I2pohMA&cyznKHkKTpMmynPlVCFSf
zhj>6fBln>Fo&9xT%o$Y_uCmJTj!qJ%==g4mn+nJc$LyL00m{~R4#pttRv*Lh>-Kj#
zpI<Cmt*9@NS<TQ7F!g;7K~GqSvBQV4r2~VQ8x=hL%n0ZhLDU-Aux*0FZIXy<$Bcec
zsQUS1DEeN>S~3C@O8m8T;ycb^-v1&44rB9ovZsT}3w-kUN6GMsqZaVwu~ZRScouB`
zV{<^ntnJ(8fQBXXSwSW5I<^}-c^0}jiXh3#W7j7La3Bol)UD{2O}aeftb4Xx$W9QG
z2Oj`z_^23O1|5zvqdvf}j%u*C9cCd#_8xdx$Hrpp#AQwDlu)TfA*RtK+Iu^!0X+7t
z)l{)zU&p#=MF*)lZ(iy!$_$;ljNBTu2lxA8$7BFHSaDz8tAvh4RR`T{JZ^$&dI*AD
zvRcAd!37~bfuUXRJ$e}+eSjeK5Dy|5n@$0{kZsSr@}(91g8$?X0R!`jf6e>MBaIy9
z*a?6NQfr+HbztsA_<8UMeQ)uEfzJpv5~bmAKB)Ij;XdwTzyO8tiRWr{f$Z|dTOkro
zbJ3BaAfMMDjfW*dmrL4<eB_|6yJSXjyBMEf`HT;SEi4UuHxnme=^9($F_a`b2u94f
zK8-!V?4Q4HH++lsOj1~x1`pMkO?r&HYS&kLI3Of#-`3#bEkG-iQy^1MMjc(?)L<7R
zY`FWy`Q>DQkN3W_D>;54fw1fL-F}k55t3E0XU|IJ$;(AD{fJO?G#vZ3TVB5HT+^@H
zbCA&09efu8-L(cm6PGq+5KQ;Tp|kDc-B4YXn!n<=o}a}gqR4O-GV-VQRNf5r@SA^C
zvSWcGE}fXVl^q0;__e8Z4n!arAOAc&B4n=7<gd}KF$~=A7b*jlbgxz9Tu=Lumn2iu
zVFVz=F6Mz9SnVgg#C(55*W^Gy2$Xx5^+Q*R)xT8KRkO$71mi`TzJz;H*m+#Bpt-pD
z+QjSzPAGQhf{Gh#di^aGpXm7_yn{?7g;~gMdp}Au6vbV<KY1CTsQ$Bg&-_InqpruR
z+C7(qEQ)>B3?o6yeZ$D?)dFny%^qucS&&a>OL+yJJ7dwX$Gj>ViJdzY3HxRAojeyn
z2xy;6EV^R?a(qmVVvl*<I%3s13H!jd%R-45Yys&-vDfX1`00}w&oglPhuTep6BoyP
zlV0b{TI~L?A!=p_yG#xbk>`v_V|4kM2QrV3$?-0CWe#t~6=mlGd=whBPdv9{iX?Wt
z>daa;y5l(<Ghce#=q(EZ#@cB@$j<N9;8!y@6?4Tt8BiCiy|zIKaPOR&_rb26k`pt3
z1OpTAbsL@Y*Sa#2XdmM#*lrUVUj1sdE#+K))i^!6k-?y%`ZcCOYs5-Qlu~h)Mg$ZC
zth18xvHR3x;L32|g6}9!8bxmwnnJcRK=t{^MSBS-imqt&GIXy%jSb@U0y_46t6~W<
zV8F|OH3o}iBimXr=4;RXWT9!_3wDrP(U@;z=z`lPE;iymVjVk#!on}c{3=Mg`$ueV
zExe!1?8sajo$=Woja}RUsUQICisT3^p(22^kFLEzYC%V}Z^Co%DH9OghXgJJ<o;ZZ
z63GHI!Z86_XWAbXf_8tTuvC}r<a&P2a;00-$8~LmiX?^-6{%l`V}1JO)v_^$m2Me`
ztT+hb9Cp+|J5wkLf_u-`$mC$Ck@`?>6egbhQn@8}q*a}1YopsNG_AVI6jJ^obmKt4
zK0*vhkzdBBhP4mg`jv=<!Su1>2et(nA?1gP+LapDpwq9fVwYeVSqjjV7SYw>@@6Zk
zkT$j^ySH#7>~7iG1m|(D0kq@Z%_31adC>s@wK|jj)Q$fHJ3Qu~?}BQ!NzEj)339Zv
z?-A|MIhCaY{DjvFqY!>k6(4fsi1REDS*b!uV?KXq%FI;)zO0$-(6_SYH;C;2=p2|^
z<yJe=E4$iAbh0ZzYg)xlK;of<PVAck86wQ3HVK4a%s&A5sF13npiB6!4BknB59UBz
zGUg_kAvV};0P{of-iY+F98g?h8NTvSuq?<|7Kt*fz)w}j+PMH<BXG1PmnXxr9(Q#N
z@^dBF8FevI@_3(m=35PhGf;}DH@sA<A3Q@nRhn3_l@{|n;$`q%Zh&H8j;?(XLXnn*
zu&frk%8l+#G73atY-Cg}(Tb*Y<+E5G7@svr?}0b%*~h2{P35_y1A^9W5EXY!aCr1V
zw~AWKw$f!E$S$G#Bpex7{)kK>%FVqICzv8r0Sc-hkzJP~#y?hqLUxQcb|8H_d>$%f
z-pnq2-@M798M@0Q^s^u8U+vGgjvK^}N#EK7WQ#V`F6yf6MSUn^?Ov}Mdnxu6&ctB|
z+#4yb*&F{!4kdjU7^CsfYXSmX(-B6yQ88QBfp+vdbj@OdP`#}1ym;24zVP#eQ?C@C
zSp$+?#n_c_cJPj79b>{J29K{5m`NjZKAilQZe4Vh8c=?qJ1zKq3ge2K>19p%%}bL)
zlgTpu02M{o^+!ZHAN9a7M;=|E(^^I4sp1As(pfUJo<zV;U<9$s9j;W6Q}kzW-`uNA
zwQqAE$Hn7^gx$tLEfV_YDpb%zA6hqJ`s|4V)H{cK@nZ)PEdO&H3SVtLMtisb%fEJK
zW9x1J=;n&+YVOgl--j2)S}aP?7P)$U8Xb$t@sAz9@U9pB9GD(R?0AXcAMQLh7`xhn
z6t-l8MMNf?R!B#UM5akRN8X975$VtT9Bi|`WR2X1e~W2eXE_I=Oern;W6XhDoCDEV
z1z|u%&Nb)ZU+3i~Z4S9z-phs-Nfv<N*4H;jk_E=Da7e$u-R=9{Ug8!!q$z>$PD1*p
z+2H|i)y2)YiOWfgJ({7_*~ow%I??ntxkcfveQXyH6^q|=9Q&?Z?8F0I0t}qXHdmBc
z#6~}G?QXF9BGNS!AjX3oGRrXw9oA67UJl(VND_lIy${Uv%KeE4l9mGU&^l`x%5#<R
zKP}AZr#ciA86AZ{(>)_S1`ST4kWP5WDDz5bhN-(3Lv{At8dO=v+j^rhc8$mPq)`Hy
zoZz)Q*JZF}z<sPX$Is<bOch))KltDS%B?@V27Qc&uSNAsWOM8Ww@cU9Kah1`U0PR8
zOT;@#7)XFN^0R~4L5GImv<hpproNklzM%-xZsTA;5n3?EeX`T{y+pLD9dCBbhZKO@
zit~!-gX+|Z#cpz!_r`kP)!w9??%zR!ayS$#ysbOX=RZ#-`E(}hB^03V%I_7FDf=MT
za)P#D&LeMB2$&_f!O5ZK%5z54XmHjG_~$)=CvxWTs%&;tH@;HNDck@|!ioza^7Z%C
z8^wV8LoZZh{f)U)JlHJVw%(>%dN_H_>mqxsF4mcBt+f!A1@12LbBeJVx~9Jl3y#f$
z*}!dBqvQ{HCzHWp%a4U(fYjda?BnNkv#9o}CQzjn&E2y>J1Vw^TT`3L$6Ftr$KT&8
zDJ_-gLx7OHQ(bodX$`w2o-W+BJ^E4-vyf&X-p=Xu72Dg~O1@j|YuSFYBXE_&NymV9
z94kv(+v4$I?A_XDkaS!;n~Rd-yRFfo>P2)`(|d^ojLv8Ue({#L<!;3u&t36hZ&m#%
z3#uZAeEPF_WmHXD)D&*04|yFNmR<SUYN*F;_0zEt7xNV`PrtlSl#c_$eiE^hLB~I9
z=R7|4$$!Uf6eIXZ9jpe0_=;1`vyA~!bV(%7WH+h*xC-B>#T0hD6m_>w)tV_=)?V|q
zlHWE)Pkzc_7_+-H(#{C_R!;Ra{wPX3zBJN461vPZN4NGiuw0(b29?}`Vufp;SrdPf
zX7w)qyUDB1-1*A;0@XfFRz(FPAYs0Q<OC|_E2G!xXrgj3cCAIJ75KsKGb;~;7;0YU
zQsgD_QLv{fk6s7hzQ*^_VEscxBK+>VeHyD7aCrI}7!r8DGHm}prxLulK|N0+5WV*8
zRjP=7R^51yM1`_&YTMIz#+9X#;FjxcQi6j1CH6u&MvcWf!6qCa?XLoIM#^u!F;8>N
zXRM@vll+T@B?YP3cKJIN>bbsKgKlrbM@HviospMb$EvpJr#d-CNT15B`icN<ynOFE
zG_*=(6pBmReA@{5McK%O|8{jCt@fE0qVqrHIfSq9QqFR&{#<D6+q(Zsi8tGiE$mU_
zWq=RSSY5_(t3aA4XU-ET<)c0$K69z&*Ne0v1LcQiH}IWMyJF5|W)dv)E=%h9YhiR#
zFRj!ii@sQPl4&w4XzL}fj}DGa%}vibLD|Exz@qx*dOL&4N;KC0K>G8RTsYy`lwjL`
z)Z#E^rc+O&x5O$Ztb@w3d}!C~Q-i&GKrA$t>dJ2vdUd`p13P2lsMty3vur?Cp51qg
z%0t@Mq;;lBDhfUT>-4jh+rzjLXvBT3DBi+Z01Q)aFVZIIH>0}wF1jryvl@PWT-3n_
z;AT9G`)C-d<gfk^JF%el>A$3epy*mI_UEVs{lveyQn;mwT~C7wr(q1~?(ZT-J3Zp+
ziq5->H>WjV3{bx^Q<m5`-eKah`{Hr|l~-cJ=^`HSzow@ulFk-MGu5CCixtu4v1IU0
zizAzSy|2qmTVKV$Gym}M=3O=e)$q#B_HVxb*e_{8EH5vgag_Z%U&X(QzokOm^54@~
zS{79)wwV|_nhwS@GnU*k89fpu6-(L;j2<&z=3{GSf#Hkm?xgR>x2wm*lGH1Jbw-PZ
zzCFmt%2P#GZCR+8X}D=QLtfES(Of(KGE~n<_zIDtE1Y3SSe%PBBo^nqR2+(n?Y$+f
zj<pR<hsNWhf5l}tUR1XGlDyw_M&b>XId7^w@4b+uqi@+6{jX&uvX$L5UuPV#aK$Ek
zDF|8WKQ~Ni*>Av8Zit;luP1vS_O%axH9xP1-cRx4_QoV%b3a-raXHR&Zhg(JtOmIE
zG8*!kKe0~Ipx(u1Y4cjy&wn}_&T-?E+8%eT%E*0fNJ!aM0Ru$)GX}L&n57)xIc*bh
z9&@nfee}bx*c^!)bN=Bop(mQ{ZS-2+?Y^kM^z<?Spf6EgXV*Z)ZF1Z+D;56kR{LNv
zqtv}_A-co;zQsSUIY|wAp+}8LssDB<skh*}2td+lL9o-{@esY=&DzfpW#=asT4}}^
zc~DQ&s$rL`*|%9h)I1)qs)u?Z^;NBi=Mj^bTp?fs<rzwv%fie|uX)|V3n`5r=Z`W^
z(;dDJqbaKq(X-55l%eqYgc&Kn`U{hrK|qnAJqJTJlMbdqudW4KD0-A>JEt0+HJ^HN
zJ<w#)zYoJcOiRT22R7=qy945Lw3j&ExL+Jgm%nFhyqR<(z;^nvr@5lTXMv45sI0OI
z@ImGNMfZhB0q5}`%{NglS3kXxw18^8{v0Zj;m7s5D;WBOTdwR;^P3`<-|X;uVv9%j
zMf0@U8BblsqZzLtPTqj!6z4Hhb3GD%4K%V7di0qugm7Jc=4t!w$sUH=7_xEKCt<ol
z!$ld^(=Wnagp_(FULV)`{^YY8x1zU`KqR_Cwb-ygvxwcy!Zt;F2EWwq{AtWgm;7)8
zaMj+9ahd>;umjy$hvvC8?shr%U7xr^9zn#J1v5ao&u>k$&}5pYUDZtBl+6oLSmas&
zEy!um>lmD=7nQzh9-r-Ryo+E89IYy1%Ztz9{DnYu(_EzWa8|SElCPmt>@-Ol9-2es
z(Az`DO+hg4D-_|kWPI%6R>nIjmzXFMb2wvBX>>&*32-~-=lcZ(>M@CSLn5@a4L;oo
zTvwf2Pu;nH&Yh-KFrwhP`flx2TV>C;!yU6ZKC|>sG-$vQv5TzmZ5^Q~&8_zn=*-r#
zFY`_`hRVk(1$*z00g!#KAHSJl{>sh^mX*KU!YHw4xe_{Vgz(T1OqSc9akK32b^{EU
z>Xf!B)uw}XnvQq3-ybih8t5a52NmaRf4u5m{5b71@qiWF;kv8gC;WT<T6j?u1+QIb
zy|+<6QXkj>lH=WdKH6y>2W9hv@hM5YFN&#*=r(y(S|r`}+(=oJ80#v&!C|h0+_DeG
zu51&FSam+|MHO<>7pb$d-ujlyncyns>=MT9ozU&SK2cW*Bi7%;oi^G^W!z;eSbhzH
zsI@f}H`=z<S-aC5RlmK@^T-G@xVtp$p7Uzx-RHcZ_M~%xO<XhU^y!Icd6t;%N`Ats
z&YNND)t~b3C&==7&+$IHHtkD|ko0PzNBnOIc{I^2Z!({}e$tFxU9286vpjejJs;9*
zIr}`C5nw$l{P25pm3{Y{b_S*QjX#gS&k^POUR^DYVN5K}3A{|e4nU;?YaG8Ir?ag0
zo@W%ElWDAE>I>Sc0>74X)ZxDI#42!q2s~nH{=l>*vc>l2rwRQ=SSG30I&iD1dpLnh
zWx_@VitQcIktj>k2NCx7E1(34-4`;JS5=h<vTlB48p^Qp)P9y$ey-!%A+|Hzd*XrL
zfnXEYNWaofmf1bW^u+<oVGgUOw*q)DeeR)NLNl4O`)@v+r?%9qM%zlVtX3ayf6n+R
z9vd*E!I2L6xLWpTZ&yUtQuoS)(srHDgMgLv&h(qN3fBM%;`UKC-R7ioPYM#{b-ufP
z)Z19oa}BO&I-E`lzAm5f+qAfH>Xnb1XY8-|U(cssQ!>cyC9f}BERepT`}tSOwGS=k
zEb&x^R(Sr?V{c?uRSl4_HaKRF{J0ncUa%}`$6(IY!QFkUz~GLwh}`rQ{^=BaQJ>9j
z5u{K?G152d{o=3zV$183?7}+LAn)m9;^BKGr_QR54K2kgm8YAB%U&wlqBRecu6*iu
z;IGNns80W9D1X_3!!%?zFU_)O`fsw^$r1Tw2+5zBDqU&A@4S*Lsz%Gm)(S_&8^(j~
zJM7fXg{~yp-kE$SKw^3t_+!)BT+5;+Twys`jpdj|ZC(H6l{{HslzO*6=S~NVbtIgY
z&tj|m^LE2+I(IVSMcsYT)RWP?U*tTXawO@liY^dfY7gY$=K11$C>kBxd^8)xdi>>9
z-S+35=F_5I9-VoqiaA^nveeOne1R}L4gTo@v1}k4yk0poI=@43wCmb=2O#ZodPT6~
zeJJ7J+}FMup7~Qix<DM4%(DD<C)Gx^K%o%q1uD|N0rPse>WvIBB1<T9o;oc;yQ$wW
zpA`T*UlUtry!$E+3=+=YQopjK#=Ehg&rStlhL5sKm<NqIABhWd#yU~Z#}!^K61_lm
z=}A@^&QV5?GYD5%Ec^y%vUc4C&lWMEthuVzV%)=_v;qcyHkfi{%Tr9%Q>y&o>Ne~r
zl36~6{Q1mh@zHm`nbVuTPrmyJA94Sa-`acb6jQn1Y`~*us*ZpMHSu8%D{c?y?tCTl
z^BgjtPTgyN(wMF2*poIK)ts$5$rreu7d6ke5vStLtM*JV<ALuzfd^Q_8?pMc{Hx%_
zJ?NOk@lWDj22#@fF>fel!4WWPR?i>9{N>?na+Haqwb$C7B|s$#L)RgTZaI2spCm3U
z6-f7_CVxJjqENw}ydp#B{a)L#oan&(X)Vi3pG!&oi4wq0=SjoH8*d_ZEu%IJ4#chB
z4vk=rRB(Tg%J_j(lK)G95a;uZ+Gu7vSFOi~(if^2@)8+kC(q$hz<lCMQJAiB8AxJp
z(Ld@(&hu4e4d4DbFb`N@7xIf^*wa(KlqIZQjsfqct~0xqs8O_~zDwe>oPza!dq=Yn
zuR_M{95sih<?<L~?|p$ZLTcianEu&r-+WjJq?JqA2Pg2vS%_W}xIZ#Z<f^VRhL#`h
z83&6<eW#-Uz7}p7q5T*S2n_C-X#jQ1Sb1;sK<F<Nd!H%mWH;F{k}3C3vj4|xljNYQ
zG^LKbA}l2={2ipKu6Y|nJl>Is6n0<wklq%!S!S-Ky)}JC{nGLWy6<EhEo16S&Sh!Z
zcqiW>8%nqQX4WKhJuhaOrHv7Yu@U$r@R(6yK5X$^2|e~Kj5}&q2*W?AhX6J;I^GGI
zth8PEIYW*g<jOMahm?sc9lTQXxtym1+<PXpMCo4BV&f7k*7J3oqw(PLQj*dOs{G?<
zo+n}s4Y9s-HViPkgB1zOe>XOI)D3e?(dLo%33#D+69ui5%0<9|uZ$b6GsI|-727l8
z>Z%s5vRlQB)V`R<=B4#Dyquk+6MS(<rqohbG_vy484B_qh--!xo~TKoFf|?lxJY=C
z8f&XHuzq^IAnANFv%*v__$GyZ;nk3yjMASghc~@O%nHzqAAI<azB$H)^!{XI)V9=n
zSV!npfuFLUliSaWa&E;DzB4<n3uUkTR4NEc{5!=veC0f4%`F>*bxmT}44GW;1pRF4
zZF|||Jaz7+6o+OK@4Z>GmBeY^Ju=FQ9CAE7J{A1t&MPB4zYVsPA$ATx{1tPFqeC_b
z_u({^!__vP-btHthClTA^+|`d$f8~uWTPvIqN>mA?3N+Eg^F?iX+&(4`ih=Y4a6qs
z?Ch6xS2Bz_D$&w89V)J#|E}mPWjRZ)sdykzToXB%`8i>Yy~1BZAR<8Gc-+!m>N{B7
zGou!Y^#FdcpS75EF3#?0<!N=bYz>}VvT%o71rXkPLYkLr{>@9-SI<2LtSqn#EYDv&
z$d|Z;FR0UwRY+;CpPmP;@L;v=Jow)&89cxj+m)nAU0Q0f#+TZObI8YOG#P9}GKp~I
ztEb(GZFQa>y?#aS1&bv)`19V%ZL(k~xd}&J2_>vo##3K)qXZ+n!uyh+m;pj`Z@P57
zPda1kdYt;vo$tjN+x|r2>F-1b%%^k1GY7BiNYBcCcR3?&QFx|=gfJ88tW+4>F}LXq
z$hP167L%VKeto*;`xDE<>8Njw`@_2DUVWQwOfG8-`39f9<-cbpvn=}ks;c*%&=XfU
z#j9!kNq9z+CnDr<YR~>LMv!U1M}XtI=C2wl*?`mwELQoSgxs&AyQ*qp?t)gX4k#OU
z>GYGMC=ISM;mtAtoIuyqW=6p6FtslqI-|Z=c0~YJBmF^#llJjBfH+plfy|NQHKyjt
zk84+gxFWdRZ>TvT0#PL)I60BusY!yWE;av>|E`I9%<y>c+r?YX@iE`V+6>}oi}bQX
zx0n_BCk+sEKfXYppHpH8t}^6ZDKKdMz>bW|3AEgZbQTu-D#rXwj`LIj$JKJ;`^WU$
zJm;;bS^>8z>e6J(U124RVT#}c+Kp0$4%N!Mq`BJ!^Uqf9;?S2sp&!@52sho-{6;0D
zc7hvpFQzo+&1Xe_^wD;Av@m%jm@`(ImiaF5{w#|DDuZlYeuE{|Vmj5(IEtv5D6JK}
z1x&j$N_3UgK-rK1<?7WET2rPDye!~d(YV)RcUJbBW&NXUAG4_!&)isjryMhGKeYDh
zyABKSee~_6Ax^+MK$kOU_Pqw1@g>EYvM@=<xrL^q+0VPtGC|Z6Q5e@+ioBl8FO8k_
z;_*zZ!<l6l`OO8MMrnNW>tr`)lk+Y6G=BNJ#r~QQWR|$1_h@$hbnl41QrU7Of6TXs
z%1leH=>oPvvE;$~xUbf=(|o*L6xzl0C~Y8~fCxzCN)Y%i5Wz)W;KE*x(fv2#YfY#6
z0hY{4(h`?rB&H}{I#nUw&zg-|l&TW9a`XdKu>*pV_B>srnfD|_ltn$#7(v+O$1pX}
zVH~WvY<>n|Q=p#q+FuFu{3>N+!<Sh_|Bgkbl+02URF4{Ri}RctZqxu~?O1++2Jpia
z%<It+CpmolT)RD{h;`z1nmkw0MbW_fYMe+C0$$wxxupjB>RPBRZrt#JbLw?2U-$4U
z#Fl}W;_l+B9Yn`}Ib$w8Dk1y{U?^0d?1T9<=Zrt$`UkExZRY8IU669G<O}}Qx&mIr
zw8|Y8KQLJU>~tqxw4^g*E|y(=Yglj=%j@$K)$vR@=emp85_n>I>I3^}OJFr_;bySE
zamEe5gC)1J#blYJdSk%W{gt2Y<*p^IFZq`&&v+FZ97}^UiNOVBo4*lBiyUT~&GI??
z>W!;cX_Qvg3SFBbE29b`B?}q8g3kmL`<7pTx~`iinE6Z%)3$<PcR3a~bWzJjNc><*
zu>rHk_hQ5CQGPm|2dsJJ>cSC*V>X_jXg~H*Q0hb&-I-2VPIN={+!9yX=RT(hd+F_Z
zQ?o;(Apvzsea8|IeC?vVZRh^GUHg%=MlJC6Qbu9%z#Sw)UZ{_!g|X+>J|DJ;d80C$
zqtN`xM}EC~i3_X#B<|P!b+%48f~nd_V}ISsBJGgU;ilI}qe^rUR*As?ZT{#nS3>uN
zH?|YrMa&tiHV+g<buvi5Sx=iP!CW^kx*p3<jeVaLB0t?H#LU^v_%1)HHq5qYbp8%g
zeP1K!xKipSI{L(PeBxC$uDbX8oRvVs@$=@VTLZNfb=y}@{UgAZy-3v~ZUg)q1<hS}
za_}NRqOD?4P2*b}>HSscI!uE%#a~t=q(>X3ZpU>|HXXq^nl59`<7OvLi?bd+Bk*lr
zD_7g-aTxW){563~9W<6S0<D^1xf9`xf#)r5#tJ-T<51$X?7Rd*x9IPR4fXA~_r|&!
zQ@0%zK6;a()}SFS5Nyy8>~!<OCH?jrtj$8w-<I8hlK-?WjM=}L*&n~#-8)Y0y41q>
z=~Ljj11w)E`Zv8J?}-ZUOeB+7I!am+9iuog)#Mj^QEM#8;bK;yf+3E1_bmp778Z%w
zsxp+`pG?v9IsDwIS+y(!S`_08^|(_%WvnO=$sT4y7on#03`wJEcRtvme5pA6sseR3
zs=8z;hKZKa71hD=tNwK?OhtBC4Rkvb*pd&tJnA*}Z{fg7F}liu^26x|X$pte|0UuR
zSnriP^~0U6T`vwANh*|{HNJ$a$1;hQJP$>sVPJs1F&cQB3_&n<L8&C(rHIj%7sF~W
zQ-T|m0Q1UJ;n<#gU#8cI$aUaP$#Q(Qe$7^A<J!$>7Vp<@@v*(?FOx+yV1STGHTsd&
zWGSC5CQ9(lLLvkk7xlZ={BJwQ9@BXv1-|LN{gwVJQP5%mFw|-&*!W2o>2EZ>D5f#m
z=4ixW5U1j{|G_lab<isrBA){7)Qs_TvU)6`FYhMBxi3nerj|cXe|FeZc2L*OZfYck
zF(gh~oJGN$NA)h)Ao${)B(>djT3)+c4z2oWUiV^4&3T94%>3Vk=Qkr#52j$b!0-`7
zObOjhpNua^m=T>3F<R3fT7XN*r_sr(v$XrgWxX+w{WXFq>}G5&HW&)S$qB}afNf59
z#{l)rLg??Lju%$8UTC6;N~*yx3Y&BTf?O*#2J&RZLe1D!<kuZiAxv+a|6?;+=)5Dt
z6m%6dBWo1&zI0*auLLTX?ek8y!981SFKaGettyZL=y>GT-?zIfINXac!b?=`vU9{q
z`SjG}Q+~Ss<)W+;uQ2Nv#jlAL)8aw|<zS51g%*CpioO(fS_s25j>!RGdfr$0*=-O|
z>s96)Q+dlT$nW^@FNyp$aEiB8c?)Ly-MT@VL?fVZSZ{)Gm4ZI=*GW&USb+9}{e3Xe
z^l(z}u`#%~MrU6tDwm+mOCM3JXVcX1joKOf+`LdS@ZvfrukU5APaUx1Qw2h_zCC6B
z!}e6H`k9Q;p{s&H!9ywE|4pC&=dQzbHcF3#U+`b?)#9C?)yENNlWdlhCX9hjtPMuT
z<3;`bI^E8wZt|iAET;iuzMF*++Se8(ezd;OZU!Y!GOla+!lTy(HpGUUS<+DUx%9E}
z*lV&|&Mt!W_o<bzi^X3%6fj+ch;$B+dOg0tlbw&~@{j-Vn+g0|nOj<z!ahf4M!qbH
zOigP6#Z^RRc4%h3^}XG~r{w=_J^rHGhRH+Ip%TbU8BQG5Z6Q`wARXk*OJ3Za&ChKL
zdd+=G@a!95rq8ddaj)v=tVN^;*TKIiDIyhOb?}^$MV^MDpqRzg$0fZl<e#124ft+x
z@JE!E$GuUu^milmzwFEmKcu4vSg#vlbn3L~^!;@rpR0Aq$WNcTt?p))9*QyW*VzzH
zp?Ng*fWzaCv`68jVTRNtx1^V#8$3(K!QNH+pEJB~(@Aips!~6rQG+EX`0v}tTemnH
zrA^wZS*eGP?oQ+i_&T!M8?EsJFUek~X}bRYWqVgeqwRg?;ThKt!C&eO2P6Tk2a^AI
z75_t}5?bsuZ4SoF&DA|Jf1QkK^5_C!L2_+btx?zqH`MOlmKZnjZA|lll}Mr7DU$Ys
znmyJDZEb{(N6x)5{s^v!SeGfg2{X3FvRm8y$<Jh+V5+%r#VW0?TiFrXSKcbnp(f)K
zl7!_B_dUei%U>vZD2&SR;KslgL3a6>$mAElGw$Ck{@=nJym{&=S<_OEBfZ!ji33^6
zS;>m#@#1L#*$;MBn~CG;Od>N+Shl*n2mM}a5*09=B{NA_#A!u!I8gO;aT?U2;&j>~
zIcK$MQN5CxjzV3zvrwjHcS+U6+=>#MNhMyRwrse8pZG1t`M<S-<5bGgRy<TVdJ<fx
z=ka2_GsB1j(eu4?GL}@xhy6Aq`Aj8b(bRApW`kqPkn8GbF8flMek)6oKrg5x>@s9u
zF_G<TF9V=dJ)<xw_?nIN_FzFl8K(NWxK3o<q+Nk>$E9ZP%O89G+r;Cf+=V|)_8}Vn
z`~r%bD~!ZMm8RK<Cb6o>^Tx4$Uj%viMXVJjUAf@Kc*~NQ*3rTdYSQRjet3aqL|=W;
zuATX-S@5WV;PXL|dXZwe(l{gy%fY_(Vn;e0h^J=r(KAWyhz?zROkTiS|8I(|&&)*P
ztk=-8#%N)>-xepSG!`XUNy)E|!5K(js^TD*MDP!{diyAME4U-NIM6Jm0)lsW;<nFH
zC0`jd%ZIV5$;Wjsmv}iXPR_S?FzxRZv6aN<C|-JoK&8ENF<OrE!R@Z`m;V>#xWYs|
z&n~paxw#0a3ePN*+GbV47<lvU$Ip#24m+AINQ*P$PByK)$x;5mJjaDK-}+iA`{jjy
zlR72pB6afo+Zr8jLANDpm?%$E^EV2?E2Bb8dnpJV%DVueKyUn6z@=UBo3ZgW1s?4G
z6-E`+bB&42N|-xMSvpPZB<=gmpL~d{(yZAGu0zfPw!2x28Y=*-c~_po2Ud5T#%P;K
z9j$y|`lPrRfm-+`Ynn<#GN0xCzCD=7hRM}QA}7}Bywz@{Y3M<oF$1cju*`!_VQWo>
zO}XCozhKsW1Vw^fF}}cGJBn=p)@)2<1x&@sL;=_b#AjKXjq#<6VB&SZ8+9f)%eXJ&
zlO@ZtVg%ubOs~_n1Xpwbv>_jQ#}>QinaEqTQ(_wSh6d`KN)vY3Aih)YnNxvPyMl;~
z+W*A}{|@4cw^Z>$GY-oJorY~nMjRw9mA%X%Q9t$^V_vZu#g3S`8<%7}#F(c{%TO{^
z*MU<*1?2o=7m0&b+t{mtyw}CXmRd}^bH2uB_m2s#`!K=PzST^3jJ1dlNg%hX7VeUr
z{OS^+Wpmf50*FH7e>EUnrxr!UFS*W9kYM_F`z?-I@gyTRR}KDlzhSdr)T9JoaH)bh
zIfY^F42e4=?c4*#JfS#xPP*G5TJ7|g;acz}+;#0Ormbp2ImN9?7;7G%{oC_(bgZ4U
zd2sovK@asgr+Dk7KH2&$%fJ5@fa$+^-oH!c&qcaiA?kU7PEgzk+k}|33EqAgw95?D
zrf0x2VN0Y0IROV6MAnNj7=wea@_q;Nx-ba<sz*;dA=-vbBT3NGV_vn=F?U~J-MKgV
zIdIBYG>2h|>TE=A+8{VMouVW-E=I*CQA+>LO=^YRbddRfPE_CwPh#SfB+>ba6WN{^
zJIHDmaUjK$(&TAxTTivRU(RtAt4dM1*%2QnQN$Qx8G7ychpF-ulUA`aw<*p)o2O5Z
zPrdC>z`~=>%5+mg#g})l`vq_slg!b|Xc&sMZ=VFO765Ny7ncC(z5M^aLiumYmE?nU
zPD%wW@+6TMVsDnsAj429o$u3^`vRAT;@3<h?OL4sH){$KD|~hN%WI1629xu|m@Jp>
z!m<@iygytLy?tkcJI-i>SfGFNZjZJi3waH!xOJga`!Um`06DXZy093o5T{L#ON)Ol
zAILDp0`cuZm?ko+(jVX55ulg+Kl33ZA5hou$x4Q}wXJ*izmq5w>b}i<FQG*)o`Sa!
z1Ex6xhDq-s&J&p<BqyKdg6E|>9lMNpixu>AJoC)?wpQT!HL}oUNKv<0)vpYu3IXn1
zHdIHrs^@6#Qi~RoM$LM97Ln5!*fBI;d24Zbquror&%W5hP{%+!l);lJUQz!4Y#3*F
zQ6z=>FUzZxcf@acZhg6P7JlbOe<q?o_=$Bxu5NIKq!o8~Q5*$ca7Iv6q_IFfcy;D|
zZbiRJTxJ?y&{k|rQiFHeIy)=mOyJ&Q-eLO)Yj@@mk@7Avz=}C?daC-XMTRC(O*C4T
z%O^67KAA;{;XK1ds&Jbw$g}eyI!R4hPB^B{!XyUEmIXwdofT?w*x;g}GWIP*{v5|;
zUB?~d{{o_a5lLOna5LejDl4Bpt`*Tf^eOtJH#?f=5wsyRIDY|sw*#6VL3d%|tC+^w
z5!$t{W=xaqhHdFa9CP<%HbgH3j&(vGnzm<f(uGXINNk%Wb?ckh<z9@5d-BJ7=8-Ml
zMuMZKDOlAFSXjhv685!6Wgz=;Fsa+TDBk_C+ULm^L&8eVh$9af-oVvZC+ezX8j7kM
zJA4Z+yxClJ5(^OiKjke+OGh6`XMNrHM(M*lIhG7h$rkY`o$8ig3MrC4=@eA_*#(AF
zs#}aQu)8tB3BH2oJE3i*ZSI1T3-Qvc{e8n=n9WJlrT`y@_#AkU=OQeTh!<t~yiTWe
zg`9(b<%TW*xDOlEsJLbPD6C_U2U&gdSDyMhe4fpb7;!#?nS#9eW?$CB&WnE?Rx01H
zrosPgu6Yr!4#WG?v=6L!pRd10=>ESbj0`umqCohP10Y8U#M+u4`7Y;cd-R(UbY6g@
zrp+r=)y8}bn7N~|@Lhv~Zc1IXgj}WeRu4jZgSwk9PY(nX^eyr77$wZ#ACi^sWG3nG
z02o%xc>pLC^{tO-+|-oJr&zS8Oknzywn}H{IXl$gPIpJETK^x$-a4$!by**7DJ{_A
zt_@n;i%TeOg%&7o#kCYInv~-1RwOuWad&qwu0?`daR?BSFYBDWe`l|A*52#;D+#%-
zygctS&&)kD_uMa89FF6~`~htlbj$8^LUuzq5db_S_`D$#b~C~K_IpAH??NTJwq~I?
zVvugHWWl{5ul8T-Isb%z|7A0t>$Dws-Hu7ukE4Aa;dxxx<59&+ih)!`oz!$hoji1I
z=e`(I&zj0Cjbmazc}P$JrJ%c9dw!YBv&_i+eZa^$v1ThGN?5x$hq#=zOpE%v!#k^~
zF4uU4Wj1&*OzSo&LbQ@3fg02Cf;uWfIa5zZHgmH0HM9E#HN7KABB3d2-uQ4+CM?FS
zQGb8_pyS2utRr!RFg2!Em=bnWn4pFW=XXaN+Ar;`b~+*#@*k7xc2@1JxD>&jb|1dB
zd{i69txvW^*CrR@I;vVS-Xa(J&|APaD=?>Dw7KdvCy}g-NOiks<z_Ws@VLv&U3CA8
z1W-4cK$knA9&hApidwp)Pi1z+2apQP@g`(jP2bBw6hwUt=e(;rC~GeKu31!w>V=f`
zo7y6Oe`-I-@u?IF?2WL<IthmYdOw9DEy7O{F+D_ou4@Vp8q!bq`mw1o!<j))(cX4>
z1b<(4SqAK9au0m+a*<COi}FchZuYJsM>3^Be1|VPt7xDgy^om<4{SqWaHe!{O@&4*
z36=cX@?G@$!lt%4&9+8n2=jXMGJG(vF9ms&^5C}mI$t5k;_iG@7fx|+!T62Bfn{;q
zzFop(FqPvX`LtvGN@}5c`m9a=5T$)t(k!Ivy^Q<DC0M=MYSf{ItN`ss*lv3FIbD{Y
zhrBnuQehHBC-Bs7kSa33OX!`{^*I{cduDR49d?QM1W5YOep&dE5uyqaK@{8m8aycC
zz8`0vYQ0{r)pe<TR@HBOS9slm>_)Np8uvO<IF0D9lFC7Tq8AnQ`Cv)7sp#2>PCZrC
z<zKk2iVQlQN}qI$xUP`M;~NPO?MKyNr^l;_O50wp&66i&15{mr+n*sr#B`tAZ$_Px
zMSH$sn(gZtI`>MMD#8w{hPk3VAGtga<TY<S8)C;0AM<AG6DOy@mJb-@mjb}#Lz!_s
zl~%9|BjHTT3?YXs1a2rHf>(P1&02=HYd|L0t|dxR<9!T{*NnELGA=q*lnR{1aRJIL
zDWp>@TQGUA5QZ6;@T8D7l^{@3`PMvlnd4Dlc7ggmuNtEh1$M$a-~F$VXB)%$B$|Rl
z<)`=ol`K|e$qk7SjF0HPB-tcAz7d~L&G+?BTym&4zl9aG|0F-+248hwR0I6#C!&)+
zwOz~DLi|i7-n1TZmaAw28p<b(6Nf^8w|h0SiwAYs4|#8zO_1XEm(#$SLleTG+PSoh
zEANG26`LWZ*O=U4BEp6L+THvoB=TqS{~Wp=0m(|s8g#nFO(ZvF#oG_It$vz>c6z=U
zPri9hOoZl{&G?a;vS%MkZ)?8n;qJn@pSslhTXsBsIs^cM(Z8Qn%6hmM3eG2{c(%h5
zO_Z4mJpHQt%Akcw6mFwQ|AU>B3F96rv;K-iA;Vf*ph4}7Ul2YG*yxO7BXzbl*Fo=R
zA!oyM$4L~;HGRrRBS{@z6vpF;CHkUdvqySU0rEsS6ZBfPE|Ge(|H)e=>J{>6P&Y=i
zWsj+%>60l4yuasWuOv-os?_zdE%>=gJMy#6^LP*<;rQB{0o6R{FZy-8Y#oLdD-?a)
zcn}>Q;z;ZnK#>b;i1B4Bt>}6hL~aZX7{Ge&ed2$SZgQXBLg%|}f`t3#8*Wl7wBJjF
z36;{7tHZZb$V9Rp{Uz+iM<cU-fl}QP)Yv9;@yzZykvQKjItsqpRGuBUdm1y0G`P;<
zdaFb?$Y&h1MqP4JSh*tj+#%8*_Bu=4i*|cBf|HqnIjcblrT|lPqc^ji!b75*BvT-#
zA9c8lD)guPw_=E-(d)z-RL5Th02)$nhtA#T-d5x#vRK;=zsf|H=FxD$A*Q*<mM1D2
zwd$L9835|2P#MG@;Co)ED14uPpoqQ2`~t;5z<m$|ONxcmN%aJ$!o~n2$pi|~S(z)%
z;gj1e5pRuotzL<`1w9VJ4<?tipZ$43U2PO>Ihijoi7WOyzN~To?0MeuC*-54P=eFE
z-HFzDN<6hzpx^H5%1S5(1^ftr;Cr3Q!`ph4iA+|zxmWsL95H1!I2_Yv;>b|B$<LXE
zeNZOE<k)!W5y70A_m{U46VotbwX0c}ALv9Q`Lc8s8r9N?-%aOB=iesgtlGqs&<mem
zzPU+#bTB3FIh9z7N2|FIEVU$}NcL<0{^C-u%Z@6ffwK#XIRjtj>RY`}x6pR4f2H&E
zDobBk*+CqwP{k|J+JoV`cHhixwntCFw-HpTDYa~}nwymC00LOwz~*}yNW-WhC+K5t
zTwXpPvq9t5O)#QAzf^d>7ake1Onp|6Ph*ZE+Y?yUFb&Ol<_USM$-3ZvVSC{HC0haW
z3vP}Y;E|Lm)+v#*Dz$9D+=HJRMV&chN~K};8uWfisHqj~%N+BJ@bu!$;cc0nP4M6l
zQsVvYK+RZaj%|M>C1{8DwtCrjvkN|saXv*Vvr{-eN)AVe-f!tmBNU!{370l*FYa~d
zwAPW)`F60IXm$Z_2Y^IASPBa$yDxaBttaq0{Yq8z;6l?}=MMs%clWx&wuF~v6MQm)
zFz{F^@Q8j4egK(FUpcFjR#aaw&2zgpsuz-uq!wX2Y8(gI=0yp;-so57IOT3TS-v=t
z!4q^avrKqx^3`M6>-uc=H1pH)qJ7rH)rk<m=<6Kf{zsp|FpH;sn$Y(J6VKlnje9H2
z$BH{yuHIj7mR%=W9sTMhu9VW98edbUfJc58QkARdn0V<K7>H^cd(B*&Ju-QBhC?MO
zE^#{^GPPihV3PO><VMd$Tsn!<za9(ZsoKw<N$5lLCxA7tnB>RX2E>l4e7qt&lium5
zOl5h!_~ktuwU_&BOzGL}e4bbJXuUG`((z~U6_WF%{!fJw2#*im^v4H=DSuE1{jPy5
zjx~c;wuYcQ)R^mY^%NtQ_f1=c2M2|=8?TMOUaee{*iP;jr$`hp#N19saNCGPr#Lh?
zFM|4wrV??CHO4B%jvF|QQu_^8b-vyl)$K^yE**I&Z=3^ZW0BBj<J>;d*OZ@0{vv$w
z(4t2V0w2^Pch_w-uG3plJ<)_d_pq<F!Qnk0HJ7{`BM7=D?L_)#Z(xffUO2gI@}EBk
z`EGu$A@L8xxm3K8rk=a2>@J^4Z|&LsrV>eT_j6eCL(osQXfqzkC;}SuNT=V>;!|5V
zerG9Mfb^EOm-ViSB+i&QIj`N!jDfIOQhwph>`piUy~zci3anJp?^O(DO+1M{2~UIy
z_1a56aLtt=|D#Ya_zHqjGnju%_^eHXH>@Z%5f=9>om?h^1B3$nkpmc@A-S+=cY487
zcKWk-j%e&TitjGtFyru)UfNvLoW76k$>ySQem6ctPbq$S(rJ8S%Z_^wi#JIaoiS4f
zy#Q=X^_9VDVHiJ_XVNP0PD(^r?`@4QNe>TR*z9NC)K@o2B4OL+Hzu`x+c5L+i7FLL
zi1Q*~s`3~iwP-$`Vkzw?z0tol3ptBN?PEGw7ZKkZi@fcY{T~UFVykzZ(m#KB-q-HM
zfhF_Hq@~*KR-;v1cgB>gv0V;=9-mX~d_<hwz}Wql?{!y@y0YIc6aaTw7gNaVOyeaL
zYS%-bDT5f0HD$b#9lFM+t3$oLexUH%GKry2t>xYid=IEh?C`r{2O-EaEL#|+T5BP7
z7S;h6d_2J!rlA)#YGCYpsA;lWdD+)l?j=K4NjGeOwRvid*ePyZ83U<g_3udDL-wj7
zkje7VlxZ)u&7}5=@8_n}SOa-_Zc-4}OJNduc`d(j6!PcV*GKmn@Tk+9w)X%XUrAe%
zaID@&`z|$4=}02?+<GlXd8=Fdu~u)C=!Wx--YZaNsv(ZJC$HP@qk?Z!Kecevc#Sku
zI<l2ZT)a-pXy@?TZ<n0+eB_Jb^X$<a-&|kFBVOg)@h42BulTCo9x?+nlup5<B#{1;
zwyUF>U$|n!`H7o5hOn7&qzPUt)nC~&5Bh8xKX+yt_`!z_)%o8|T>}?GBnn9ncC5`j
zWvR@_1DKzVPU)5ToO=*lTjE+;j6Hfg9Txf^sG;Op55s-v!0WhrdR7M3NVR*I)Z#wp
z``%ZpVJy)DZ=oMqLNM3c%y>cDB>gOBwTMDqi;qQhUlUxOJ?kTORRV+=&1@BWg=6=J
zRPuPBdLG{--S?+0o$=nsiQ~(|v#B=|U<zt-4a$l{x9fBhotpHMZ$mnu9nW*{#C&6S
zLvXwg2f2a0qd%bP*znz=XcjKsZxI}t&$s&P*0m^qfr&8{_8He=ZSc_p>5?P@q&ABJ
z=h?qM35P(<xK|Awdt|t&l+9!fppT-@*iA;ppM8no!0)C$1fLh#enqTx8B3af_!@WJ
z6ND{q#c7EBh<f>r=$YvCVLK_5)Ws30L%n<=a`J9wsdES7BTx5+iso0+6#t&E_0^&D
z;;WDHA{BR|W}%xDQ$@XH(fbM7CJZ#5C-xDX2+ia6^67;s*f|Pn(*-y+ZxvqLAQ8IW
z$CXZM?Gk%Mwy=uzv~0v1FCuLvkJST9EP5id(_<ZzILYhpNL2`Yx4lS(OBC38{0PZf
z4H}N|g||PWz}D`6?qzek>wK&fBXO&!?-wO7l^)}*06{nn%d*_@aE~BePIojx>5>S@
zG4}@OYJp;}LWpKz_|r&g<(?+wPMI#Cya_saVFCa-i6W)|teY<__7o(qRxKq>kp;*b
zi>CX!bQSECuENn*fV1tqXif_r$15^KhflN`^F3Ul;JCoRA<6i>sashBq30J>JBhO8
zBv9OSqE*%^Z2$D8bP3E<f$XtvOV!r*N(#OK`<=n0pCqJ@LxDh8ncHB{P7*?>ZSPyn
zx_o-#t>{779BlwySd1i8AjohV$8zB6*EvvLk=9jYdn_{@I0q^C)P8irSJeEwh0`&0
z6%#qY9L?<{VGdq<6++DCxjnKov~ycm-&Te{aq&v3zcRP_FHlNH2SI9l`}o+f#SyFe
zxH8yBu>D<%WxFc&aqZ;%ONX8lH>YQ2Rx?j@W<IrvoRbxXSdVa7d|XYI@R2jq*zZ8g
zC3GPS6U0xbA-J`aF<4T26S9^F+20k5BiD2qVoM%EK=B`a(J@bIT`W~JTKLwJd^4+L
zcv&3S(yLur&>z#-fAfty8ODl%lH$bIqjpT0XlfW5082xa#w*qt_Z0BnvqTe8?Z?eU
zW?22Uo7af(s3CyT@d6#UV&Kf)hjM(-Jb2=6rPIKPeCdyY&xF>IdC^TTQi^-!El_|H
zJF;PZUA=uj@q);}yEk8UQ-($?Dj;>9#iZ;i992KT^pJRAP!j<wq7U9lK4N@w-glDv
z_*UEp*TPVKTQ91`dQQXf^>`qA&(ScRurQ6=iTxx%U6S>c_-|ymPLgwG)++6adrYfO
zlyhI?p4YR0sY$vtEpe8Fdf?r}r(uKdhj+~fzmx7w5WX(l?b=VTuo25-#q~<e>c+s=
z#^3-mL0~%*9DMWIXyv8+%GXsMOZLZ$5Ckk_l3yM8?jknGf%ie<Kun1d_-IBBeAq1c
zMtOzhejeOX9$Upy)&hsNl=fECtPbO`-TU49YgrUO-c)Bsiv9wxwr;_orw~O0$7&<*
z+wXSRrDkiN1`d9_-lj{~h-rJJjD*h>T`h*252*;U8NB>x1->6fW@h=Gg%Nstt_VVj
zAom*j&hWq*Z4m$UdPrg6`Iw}{AJqoi>XZ+971=bFGa1M_11Du2BajkZ-d^)jGS!si
zT`PTQ>)0mz35;~2W%}l@9S(#jlVyCe$~!KkDpLU>wphdJGwCA0Cz(z!>cSt$K#}{_
zK-Ji}foY82!%JR=Ci^Y#LF2zZC6`LPsc7wEZAZRap#K6mNpCj=(angY;8#fQA02aD
zPMtNLBinS2W@IBn02%sMNh?-MG*1Udt+8K4@<>W*ZicK%&`D&DKilT@IDC3@?nQ_E
z;FuQw7sQ2REOhOS2)mVol$1RyTtM;_jS$<B<OhpIiJ0Go@Ze+4>gGvNKZn;aU$tD4
zi7+*%18KB~5#mz{EVU?-U#6I91ocC&GSmt(IV*{U`s@lK?o0Qb$4YMpXXcjaN)K`y
zXD^38ik-#WY;vJkBdUw^R+V{bSk*<MPI$xeAiZ}D%8TJ)G32k3s&vu`X)vU*Iu+F#
zw9VcsRLGIJ4(ps!E&<m*n@TbJGfra#vaq;g>fa_l$b@St7YQ;|zSLdZ%t!yWk0iYq
zkx^Sgk2dc%7CmE^k4%{fNQfEDh`j>5jf=dC`L<G6qCm;PJ3`fI9?Ub6bv8BAG#TX@
z!U(eYee9Y#R>gplSpqzzYw1)GRC5@tIAbd&af$Zx5z!~;ibTYu(fVE5uj+!}j>mo`
z#+XC*d~qX7eaMFEGPi?KA&-|zSKoh`m;3q58-w<O_VP{OEWezWIC1W^e*v>Rt}{R7
zbDn`(-qu8QJV_&$myda#FnjPKxxDRc@(Be8q*@K>st|aBV!9cHst)`d2O$pjGO7{r
z{cf%lI>ml2B#?L^3py79#RV3JnU4q&>->7^`{-|6fkzlCep(Z+n#$tpzohawo8eKd
zWC!E_R!3Y9L)c%m$OD}VlBSez$TL@^K&U#;GdgkBV=+Ur6~kx?p8J-EzTNI~n-YGX
z23>zB&WpHiCm!+bhWJ{>Sh`fy^YX$}b%uf3p*Bv|Jn;5o1jq5Ik8#t+mBA3A(>t9)
zY)qoAQR+GPFz)#dy6b1*?bntAV9fWuzfje;Gg2xOl{q6<OE2@=%~g2rR$C9s<^P4>
zmFh<&hZO0prk-|uf=*=4Tm1Y}ny51BFFxLunQ!Y`9fyf~)l+uoIo`<`HS~;wFV2!R
zF17RU>3$HVd+^@T%bOo6=JqYa>KVN9fR}BG@A`C@!2*Jg{1dj%p%+OJl{MXY<<3`R
zM5~sHw8z4<A81WPYzwBasIeq3t*gz7*kzo8!<+M8)A;lb&OF)qLA{#@5IZfu1Rdf#
z$g-H_!H04r9SjJ&c6s9&UcG$dM!oxzj@)L^EY}k9POe;ox5AvKia9#e)L~N{h#|UX
zYi|gfK+(lZ_p4HHDxWZ&2gfL4L>Z;d8VJ+hJI?;B>5L7hEyIZDImtyl_{HAOrAU44
zj-y02LLCnh57^`IYuwtV8Zsz9q#B7C-fLex_xNan_I4mWr}?nXdIhw0B8_QZjHS4(
z79?zP(`7xBo)3V>s1w&?6iNOJz?N?`eh#R*Nj4}NchqZrYe>94{**nE9q3W7f#?()
zTrF>uo{`65T?{*6uyRO00RZkCywU}J2lzO?p!GUPIjtuIeOCM8XhbVvfaQaDemYy9
za>Pw*fWeMGgu>KqHOIqvs>P+V>2OC9ogVMj7{F}+zOnV0cN7=M=H%$u7wpAAT~(iX
z^5lB3{oc~M`@NHr!@Ev@sqph|-&Mr6&QKlWt?%AlJsv1Ax1eO{UdFrV{^oiMz+Sgv
zbysseY;2564a@0Xy}z~I`^0=7S@>6d>L+0xy<W|s5&W;+-Bx5ge~~&N%QC`N#R^B2
z$u>(V>&JbtonHFdh`PadFXr}KCt)W`QUR*%J<GBg@?UCc(kL8nsbZn>(z=^3{q~Q!
z)r#)Jzf&jf(z-5<7ER3$`)4-Dh3d9O4%Nu@bU21P1c9ghalGNEp7*Jak#qHr&i3#-
zS!NUG92kLt<5s_RQz{io?WrKYv~t_dNm>_cH-Szxkdcy@>Cqdr%kP=Z%4WWmnubq0
zWliV8UWw2H2p1*_A)bT|f8=v<kH4J#003NYC`Mw2{5}RP?45)?m7u3d0N)%T%19=Y
z_?ss6zf15^gFlxwCa}ru85UZ({mw$E3cZ8~B`~}FZV2Q=dhY`!?|>I3mc^lQ3<}A9
zHVeQ8pvcyzb~e;B0l<RC$>}W55#KL!sHA1*?8xijVYDMZMU&2p>y^~&xz^n;)l;bC
ze-^Vly(l*0k0f67GG^4|hXc8rPL|*Ag_hRNhG1{Sn5hzt7z5{Cc`!JsJrnHV#o(Uu
z>zd8!#c{>?hal4++I#4nnySKc#C|fJ)u-dFr7C`Q9UI<Y8rQ>d@Rq^WD3qPMJ>Qhi
zec#U(#fwN7IP*B&zvTws`&b%0tIJ$-{EczuK{ma5k!(ImYT#%f#C=4vh~IqZ7^w=;
zKEfLHAZJFbky$>&t8-i9JjD2oRPgrbi@Z1;_swacGo)@p34$$|s9VFgV!RAueoZFd
zygokqG+*HG%J~ffBNTq?0d?HosVWb2WUomIbYp|S=FAIFG!p;_S?LwMR8-nrA3x7G
z9^t66l60K_Itv3Qf%9V_e<BtCgW*F?j&=;-r$5S!!IELW-9ChyyO`_4Q<wGAI6#cY
zkA3wJtC`%xPS3bG{n58dO_Z-XkJM?^<yOK~kH(AIL2)&akNCWt`<;?ZM3N$eg44hz
z`5%47n%<3U$uc7n_VzJ0Wq*cubHL4ihpcX5bT^RGl2jIP@#z`bXp<16DB<EBG7c3J
zwnDQLxC<~%T!vn3_Zpk$8|Q;a*jS=}Yy`4U5XmbL#)kzKm{_2AL1Fe)7j&=(v1U2l
zkO1Ay{CtyBTi4hGhHV`KbK3S5!NM%CX?Xji1Oc+KL7$a;Hxu02h0q||BIoX@+itSL
zOC8GOEIl4UqtvkVq-HR2+4D4^U<`&SQVvz2@l;5k$EZ>s29YV&U53xB$#6{7-s|ym
zK8lg7^7}#eIpd_?&DXzsR_f_F#(_H{(Y^+~lDzGlO-Hz5DWwl3&rZh+uBm-w_xDlL
z<%8AAp!1Yc+Oj5S{PQKL5}pr+`lv1h6C+TukE#?_Y1v)K{VUf&9sk_1t#`I^p-$2n
zs%-fI{$NqB2%?W0dDAI)#bSjtUrBVlv^omFTb>IYCjX<lDW5*HZE&%Ch4$;=4aN;Q
ze;ovFQ;WfO>sY@UmRmXvHga|WMI=i^$Bl!a-9fs^=j%?A`ZLB``7?7IjK`Yl5)-=&
zSAFRY+Kb*)-l(b<t49XIF?cS{5@~}?8?AsHgM5-m2xP0*U&;Ccz!cxQW=;wad5$a~
zB3zPiNEv*;2|zX!CBi9^uk$9`IyBUb!OD~pcB)>F$Z33-W1jOD`p&k)_wWe&VOT^%
zp#DRFRzJy@{W~`H<iE1MU4VZWJk@YT$a4cu;~4YDVE;}3W^BY+%<!*;T3Sba9~Gy7
zWsvDrOAq_Ujfkzun@0<*W}a{5vxPHzI!MvTT}b^Sx7JXjUiuc!k>Ann&J`LdFcie3
z8_JJpiA53fS#I1_gk=Ph8nOUKPZe}}<>ePW+_{p@Uq9xOynok31!p!aMCm$_HV*i|
zaWQ=cWJ93lY}W#C3Eq~%cfYY4M=F^Rh!oRA$&n7nJ?vRS4Ug{gNK6apLI*>H?KE`^
zQIgd$op$V)7nljX+Qi&mv8fQ=xpT6-PIy}U>XR%9rw_NC3FlLCY3TAVws*@jd0OE5
z+avEU>2P1DY@PSG@;{>xhheJBCe%B5G3ZRLdJt6Q1#ZgJAnl8QFLW~Oz_j%3pP)!m
zPR4Trh388Z!pz7}nyOn$`@&yW%SF?d7-ujaAi^E7Ud#QW&T9>04*|L)DY&Z*X=8QL
z{K@#4&U)4RqIq-CdN92Lc?Slnt_q(jZ1s;=j4ai~>+xIvSj=lV7+azO+Fkv=rkR5|
zi$>y#!rX1I7pZ@qd$9ApAj%}fTo9rL<$skJ+Bw?^E@|%!-a4{%k3No;@ljn-*XvsL
zlBv(Ekn42@+-u#u5?nZuak<TDkKht6`X-=usIV!K#}v|nsCa4THV!_Uw@s0F8oUZ0
zQzz_^K+_w?8>Zv8)<&Lm%o4(F0B1jR0E-N`cf3d#SyAG+u9Hx8=@ZCkzvN{Qv>UKu
z3fdps581S;yD_BfEBh<-)sE?qs<iU>ylE(AFf(NpU;b+B?n%2nG<D<=w)!<5f!`Fi
zz;``AV|(U|kJ1bPMh>SD7pWc%wM@}kYMeYnf-q%NBinx_y3TKg?oCpF1{yEBt-{YA
zU|J>-v#i}Ez&d-CzO4I20T=fEEtzdP5jk#xMhh#P!Tl6c)9YkbEa;9adp}JQA{iG^
zMT88a$%Vtdt%M`Be4(Za2E4Ad3axX`yHwHr-Acs>Ii3p6Yfdr)Y9}VfKZnVMeJdN(
zglh7ZNtnM^r+$$=n44e|IX|Fws)Fz}v8#G}Mrqo(@Y7djIIkJD*J!K#!XJ-({Edca
zMPm0bRd@XkAaIGg`PERuvyj4f!8{k1ItZ72);$so8V$w9r4M_D80)E{H#=ErE2k@X
z+m1Ne%AZz1_BV7*a%o!&))~p*lcOZd@x}V*m(gxY2m-!P>9fPeYmn`@-<3M#u1jb#
zO2{xh%j@=gRS}QRCf5ja_c$2dDsLCMb>uPsy`}aRyn1ho$Z2k#`Uzh({G&m;5)Pe(
z3+^T3EP0Tu=x_C(&ey|+O^|9$r?>XQOBDuA)iTbFzmIhUR&-1IP1z#>zB}oA<`9Ih
z*Dx%l{a&T%I;(k7xws^Lb_7WJ$p_&qy5bTg-Ewr6UK*Rl3__Ca<%B#}6g#Z3$NM6<
zxavD~xwkgglH)LOa;G`2Qf)n|+`r{W{CjjsSStFg@31HaX}2)>klybcZtm-_*BSG>
zmJlQx)0z*yE2^HlM>f>Q&bK^_;;BQGpxUR)+kfx7jdWd;OkUjqZycNU`s}AvgjRpF
z;D~c08J+>Tm>V~9&k23F`I8esVDAM`fZq?H;j4k59UUZoXI7WVJ=A(qsQo^nYW!pz
z>}uBuno%8cYFZ$@siyi$8^zte>C}5%UX-bUc>h@_2kd^fhw|nhl&LJtGQf&!fX7^j
zrN-Vd@c*Viq4*A_r?fnLsLbMYiht???($QTJzBMS(=Q-L3>mjd+P2-;Xgdlwa<F|W
z%WS|Dy6d2j+Q%y|-9SR1ta@>e#aMEvA6GjxWs;$Gw~^jIEhotS34GIm^@X~Gc2Ync
z)4^<Q6$_LZt<%%cxA1-S+?2U3L2G)Q*ULUNLC-KBMc&4`pO>NU@`8q_IT7#J1*k-k
z1t0DzguYrvj<0xiD81t_YKhHwC52B+z)No>$3(%ilL6V|mz?6?p@xX;z=;{ySgeQ{
zLm#@zqoXsj>M?@vkALxB;8r(R4-@vVfj%`iH#Pk@PD?Y|UT$&^lY?kqO%|M1zLLcr
zHg?Rghz+NXcs2IiyjVm;Ucpo_0EoM-A*S}E6A*GZvB&s;Ma*~~&j7uBo^G)nKA6==
z4rEl<{x+Q<#*T3D@j9bUH*7d}+}Ey5pnO+n=f8RD)yAf+WixNtMZw6k1^9NUPx_r$
zQQI=?3cEIxUD`92s>d=Z*3bLuaf(5K)DwCgLzn1Zpz~Tm5L|bOWjgAYRWpsbgvtKA
zvByN3e5(l-#W!XepKpFtc0>u5D#@&tOj!q4fxrCjqWIV=gLHe24V*5p11+``$3D#D
zsBpZK68U1!1#IuRbZWo(VdT9Ib~sF3rT0=UwOmmUGW1g#7%)z)@GV=~ke9IL%cwkR
z+W1gO-5a#S!2*bT;(J|cJiAe_L;p~}NX^K8*@7vr<*~)fyC;uA=gY*7NR=H+-p7c4
z)ER3yyRrV(?t8V@zZ8?>ajt(*LN)w;ErPOV?>X(@al=-V?oNF#TQOzr=i;E-F|sVz
z@Yk5NKAIH34<(tOww2;K$_>gvB?PaN&q~tx&C^1PvV4Wj#~ufn$IOpQ9<I*q&)DOe
zm<%|dtcjoU^OwkcGr&gV$s;JSu27hjDZaBk>bdQlq4TTA6z4-4g${y`=+qDY^y1IQ
z@KYyJZC3d?xsc~1wvY3Wi6Ec2ZkfAh>hh~g`<~`f<TnmBX8X6#yF2~&{2vT44S5HB
z;|SBTz^&pZqx;e5fSlhxi{OeXc84k9UCfh`=^&;q_ludL&6HB=7S4N|7OE^?`cJ>R
z;_tD)lB}8=;`Rugow94alFrbo>fbYTb`}N?Si&P-s?Tv2w0XYnI(VHv3M>@7&_pD-
zR~413t8k&-^bB0}i@GuO&V8L$b70{m(czTj@3Er}1eldlR8wTwJ~Y2vP;7d8Sd$!S
zc&LG2!z!3)b;xH$^QCn*mpLewTomh<bu^8A#f;=nl!reg-WhcKB>W8}i^<`6qMJIb
z(xlBvo7ALTQ1$xs%%EU@wymP?qg^jarB?7*sTtl#iDSx4hM53+<tSPjZ+pBEZ(dfW
zrt7{mMb{2e&&0~B-u;LA(2|D|g$82n@SMAP&tFyCw7l%p-%W*H5Pdg1ifSqFbVIpR
zPu0<2e?FRqUsQ%A**#{u)v-#WI@MC#<B*&oua;vndp*2QW(h<k!4_Y~RLT_asi1Jw
z!7%g@ukqJ6g*i$Ig}er7`mKba9~I4%#WsJqax@!qGD+#)Eji`UuV)NDQ5_J^l63qU
zXJq)b=iF{~gr)kSGxoZ1#z%r|uX9pC``N>j&kfE@W>5BB|5^(J!;KyKJe-{kk1>VO
zqCYdN{psZmA6jPjr{OW4m%Rh!>vv1~{=_Td7T65sYH7Byeevu5FDQtA?@Lsith-IF
z3Vdp#(QJ(OquiFnF~KXc&HZAaI1nE?^3qVxVamPnmSm4T1*yfHE3kU5IyX7K!frlf
z8v1gq4k;G1RBLbD>V5geL4=+<))Qac;wF6eee@^sw5}2UeyXotq1bU0lLw<?<UXD%
zv$-KtJ;rrVol2Ps%Pd|_=db{p0}A%6#q6PzrjiZCBR&g`V9aRDz?@qSsT!qi{Lv}v
zb4vEu!;=s^hghw0NpHa@JO@1naEVMmIbo`Z>^ba>ul`N`JD}U}i}UV)a*r~B)kW>^
z?<ER@F@}P?yBY&Aenw#mxUAr%bslJ?I~hE2nJ-{L^ZD&6rFCN3lm<>xtspaMv|-qP
z?z+if(HKpRP?0R`U3_z$d^mOXbc<8?j6iX%>X2;tU4qc1It31&+b{!)I2DQKz;4T#
z8k>_|-g8cwyn66JFQeRP$oyl&U+lyhrj|IGA8Ie!{0ms4$&Hi5-dT@Uhjc&MZPFf(
z5n6w{oxk{tQgPiSLCh=5PET>NYCf5?joy#*x9)<^J%+dz*A~F*nM;S5^d=v3ChA^&
z{Ccs@nI>birJm1ej(ZrJh*uCpbMR6f0>kfbgboAjD`yCro;{QQZW@^nQFE*@wdz#g
zt5vevjKP_lBVRfsdY`AS0!iHpQ|Is<HrbW`JPF%9OP;d3x6~;Wo)eu;wZ`cpDFF+V
zI26y}q@~kQH3-`p*%ppIt$lm^3@@8XQicpWyc)5yJ7-*9T3UPMeHuu%_1*<Z-2+#p
z`Lloe$0z@GW;Fb69SpP-4Z_ADr4owm5Trn}qQ}Rpv}nwcH`iY0M{R2gdnpTolE!e%
z*oPU#fdLnXrd}hsWBwc&3~1vlD}-ExdhzfgVJ+ySLe)k!@U(ofKGZB~qbm^>6@C)X
zEBeZfV_KI}w91{LTk9F7W3(5!y+bN9uIQJke%#g}$+ZxXUX6_Gq1|1Tm`q<bNzsR2
zIKAC0lebaJb82Yzvx&cKwoAJ4coQ%r=x)q;AmJV@kkMaW5M<eUV%oT_!iD9rj>BR8
zRX*zLJo_(5Z5Z8o5=MLDU+y>Rj~!=G4|+Z(dOfaDRoY_IU__9GuDv${O=2B$JEIR^
z78>*9^K_B(kq?%6Q6~-W;Cae7s0gc70lj1*z_KAM=48f1AY#dQNqa9L_PkWyI`5ET
zoF6POxs?400st7+8v>2E?kR%u#e|w$W|YYQn9}jJKT=d<k=j2z-+S>fHyaI;<_jk%
zwI9#?HdL@s(w@Kpf7aGXlww=>q~M;nFS-)S-v^#P`1FQ6Mek`9X!Q4eYkVoy(5sV^
zhNkyIJ~RF9BtEV~)EjiJT)hlD*{gSb>(D<rn169MNDg#a>=Z4vFSniZ6HOcjn4vHd
z0$-GT)|QdI*Mew*%aJ^sfttZj__d;xr}F+#E{Xz=&}8JTyAS|0RdV|cfuVR}`tVSs
z>OFhgfQh~vY7(-yo9sN2$rdQnWT!!87Wux3La-FaCSX1X^@tI`JUh8yiNDf}xajS!
zWj`gV7E6ARPYeL)M`YgSP+hYFYDnlEWoEg#%~!*!9lW>f>RemdoCCyyk~Q~<_=4LZ
zB#P#ThW{&;{>gH~X&>yR6LwdY^yFHclAQhy=na$dxL@m~u%|fVG=3|Nl2SlNXo@p&
zE;FI{+NE)7;?|3W`JCR0#<B>Tb@?=zstuJ8KxuEV4BVmV$z5cJO<`^n>o+u&7=~NQ
zDS8;4u=y<gVxZs`wQN%clPYx-Ke;n&Wc6j%Yyl#PhQp*J>U{lG3JF`SjQk0PKRKdR
zL*RfAbDgAHtvPUHor`WL+jfSYx5fJ#bIZ50rIrgV(wX$~PyZVp{J$lc?lI7sdF~ze
zd|Jay4E+pKXi##FJ%JF1zcVX_DUWtryL80mP6@j)m<)-!g>KvSrsVd^dz{5Q7lR&j
zT7Cy?Yk*6vIR*Fm`(7vu(nS*FMpeA&BuQ;dES+v~n^y_}`{quypcdl?%{TuXuxa^P
zv|sa=Zg<9&eER-LK=!a?yYSn^m~&)_lTk5gY?D#(HW%iy4T9s&`;3Fia;DTTlWn$X
zAEo>rGiD#;V3rl6=Rv_&AC8luIog&s%-Zztj@dt=UI(H417m`*w=ImEzD$NFhNqt_
zoMDUcr+G+}-3TA|do^@^QQwZ7A!gUJ{tUAX9m8UW>KpZ0di?+Z?%||F;Cff!cR@9L
z&g>YQDRlWwE&rdLW?fq53=*Kt2-5Tmi@j>wxc-r9V{iD!Y=*+r$(Nuv*4saePSe<{
zTllGdd-)S9VAo?>%E+sw+xk5PNY%fi4H>2vV1F34Q0~gUbna@mSm9-9V3Mr+;o#pL
zqJKp20{RE_p&k6;-wL=_-Uf1K6b$H|LLz(3r7u{E$t12KZF_^l4RL=oa2b`Sp5$K;
z%zn?}1%(<&@sQ5{REYTrjk%;4v;r)Y2p09Co5!K$rEoD>W6`z>`g5Dv5KWr*zvZMR
z?1QOnR0B%sB>iv~@;57?Q+A`va-0ebW~s>~>(J130qL~Rh4rl#X7SG->h&{}_qvp@
zGc={df&9hVd(W1;{x1&we}?u4MkN(Og95@5&LEQ!%$Co?)zPbjl`ilDhc0@byu#37
zizoM)4JRJk26k&jLXLDiY8Fl{*}w2@DW8%F;fn<UCm)OQ5|p}pc~0{sT3`{~Tuu7?
z=|Eq_dSGSB_|MVU(W+itpT3&dzLHKM(QS7d^|J^GzgA3kEeo9YitCf1>zCaDTfsYJ
zd<1ot^71E}H|+BvIUMNykvAFP5&sJ${fiI#uiMYTfGIT})*c8Bbd_CW=`}E8Xwwj^
zq4(9}CP-n0MAG@&ZpDxyF})pn!=PjnsUi;KMIP_Ty(ZjDb}dxEbkeCxve7mK7y7B9
zi4uZUmgn=KiAgw|-Z$^FUfXY!B&gZXRLO%*=+K1S_@#Yu;j|a0M(go-yoQE9$*gB;
zVjdA3{#zgW5AzsiL}Lv}`+(m@&=wyO^Pb@Yzgu1?GV!^AbHVQJ#-sPR0J~m4z9N|2
z1YJq58bvP@SSuLC?Q<05OdL9+#nVC1StD|biMx=EW?K9@$D9E+)h8|Vr7J@)#P6$B
z=52mCj6NiQZ6ihUw3fS9M;zK+!#6h1VK*4MR;;TO_C7M4otgKgI18>p&)^zn0P_DN
zB!4o5<ag+N%VzVYLs5mY96r{#(Hhju=D4#(vOMMsVMr|+(>_!ng9m=-6FSFqoiBj1
zc;66JmhhHdsrg>IT4C}lJ&<MYNKMG@O$#;2*h7~QdV0S2z%|s@E>g`tEr8J~6F#hl
zI?<_*JV>Z6hDc|#PP+{q*sCmLPtr7HuW)hjg6)mGJ_M7K5{OR&h*OA!bVUCzQ2rMi
z7^X%0ar&&EW$Z0pym_-6tiOvlgQ@FlO$;tQSu5<_HU+~)QcVO+TM|bx?9g8XOYkIj
zz5tXu2imh9&lyIK2snAf{JlbvYWhhkGfP(nS_Ep|<n>fPso3@czBw+u0OV$t5$P~V
zlsEqM(7i<pwjIlo)u)ml1l#&d`=PZfW8Q?`Un2BxY*dRFjddJroaGC7>n#+R7BXys
zjf$p3t*F3v^H!gr`D@5QkM)pGRkT;2c3n@3aR!IE^LLokOSKKMkw6GvJQ_o&4i;`@
zoH-gROI_&U<0sy@4oveEY8?a2=T${=F`RyZ0{ZNxD&gEFC9gO5jdP)Tohrm1@V5V>
z<3jycP?FxaYym>)Na98nL+8|pbR=W4@S7t|QBO_WQS0+>^IMF8bjEVT)v3JFfL29=
zi>Fe<N_kV1hc&^;UN<<u=KGB?1o!kEUM8>d^_ye}1TJL%?RnL~gqOm`Keu@5!gOF-
zSl-U%lO%LDZ>0~dsMZ<XpPY}-5t6?!e5Dt`f-*TfwGjbM)Dv|!@Qlh}6(?s(;x`t4
zVW%mwIO`P{WPi%5|76Dhg%flo@mYwF<Z60`TN>*?*Pak-xt>+h$fscGp2FNpL2eg8
z3D&soni2abw1=q!25uKy>glF92NY9t`fj0zBml@f52;9o6TG6Q_ix-MwSNmf3p-Mm
z5Q$aZ)NrHjT$w=)XFYXek#v2VswkH}hc-IM>U}FrXv+?u_j#x)%jI`7X;negSS%??
z=NS=EPHq`}%*259gX{k!h5usfsPAIA(MSftU144RT!ILG7^$@~2Q<{xGLmNuGtiOk
zdmJ@uLQ2qx%#)&grz_2q%>Z}SN2Lj~PsrJWeGjlekpdwA^mb~CXFAU?x>8{!-Nu4B
zRQ;|<TP6mSmf}cb^WVg5DGCCcpV<%D*8sg?;o$rrFmcRx-erp+rK;%5P?-8`M}kXs
z_j4M*1)dPx90-kxM|c73yShWw#s*%eq%xPZZs+_1=I=yOF`ACp%)9uvBb5(t@#_|a
z&Ed3YL^NNr+^I3WuNY16TT9*>N>I;lkj0f=6$tF=G4oX1_YYLO??&+M>@)BGXRBsJ
zyF8fd&umc9Z&1(=H93ueN)!+^QmOJ877A;f=E9^Do*@VI;XHWA!3?vo7?gm=W{kjv
z<_fXcRdA?ElG>>rncUMT-f0WUP%kuIX2LYuMF&bL3yy=ziLgMFXDW>0Rx@M{@S}vd
zFFpfRObrHqxG=Kw<)(P3^>@4Xh7v95=@3qb6TM0RG7zuy8w~2&+uoNj^dj)BGKPo>
zz${sYKA2J=w!4bVtJwW1qxRR!`Fu$^QhQFpvk(Bh=yW296#*=@knQOIJChuWkxGO0
z<6FH&DFZ-AdfU4O!@&hX)4`gfp#wUs7TKg2)btJ$Md{|aM&1LYtLWXv&b$10iX)ZL
zA{S?L5}b7rl)#3M&i@vk{-d%*%Z;AQh}4^avm3H!u!VSPJ6E4>Mqqz=qCqMnNdG>P
z#&ws%HMTWEZEVW@f=R!dT%zqkQrn@;JJ$dZB?OV%gEwsSpFsV8eK+vz;b}6M48c!^
zd<yw-&f+qep~Z&Zg2@?yPa2Lb&up!nN!nP<VIoKiERoXy^z_K9ih(>aY3zk9hFhRY
z+(xP4dVM3qc$|Mkt_!(?zl+$>Qj(Y*BJ?N8jNM&A^iaAa+6Y`OO$>AAyc$?eulkT{
z@cWCf=vu;3y63#Q{Vj*Yz;Arwc9c}DhkE7iuu;q*E!}LQo;Mh{_?(57kLVNi0=RxX
zXqzY!ELoSefQ(_d8^+)&nWu=g0kz5=s3Q0Nqd^O!c`=;SuLHX&3gGM+9ENs7?WF6U
zQMZ_mIlSV53t8t235{eu^a=;LtEy;1{7~OXYkr3}D7nuY+F*w?GA!&cLw(;;0~XZ9
zxUzTtZs|Alu@Oj)WH7dxKnSw87rZ^(UPT6*c0eSx%K6*8er!%qW0p)3nV_T|U5lpR
zH~X_cnG~!aP}&zxpq1uzYwJ6tNE?o~z;3cjqUl^QOad_YJ1_kaedvo+8$3^VxOWh2
z$K41Ue<|q^+56q4%@!E{gN12mDCpI!H0j5+NSXM>pE^9VgQQ@3|JrD;!v%3rnl<)%
zIt}pGBM)0R&&XlrJj|F6E%iU9i71Q8rp63~{IN($GBTvni0?*GKDXa&758aVjsfig
zda;@+ZdHHDq~Sg`eadJUrWIE$gYXxi?A3){h!nnczskK_-iZu|!X9~+vZx@&O+h!`
z;{Klxiof`Og(CR-c43%0Jb4IA+Lw|E(-GD=Ewc--^Y0eM1ol`FMfOtbO93P>r12k{
zj_6nUGVM_Zavs>wfga<F!tn#zp!`-67=BTe>rz96?WRFUxBq-m)Iu%Lhq{4WjtEUS
z+udh#l2;>*-vHxH1GF}}wDda6{x}%si-%qrgtGP&MGEA7?u((@Kc`YEY;S1gDFK9D
zZ=vkL^?wtQ)-X3^O+l~j7up$+gITVp<<By$1?f1xkfLd$y-ioi?^jst*Y4bcFt*(4
z{!<IU3l}bPNbjIwzenWi+>2NC_a1=dxxcd9!FXYY^<sZ#RUc}OI2=4<ylyD+689IH
zw4g^kfP<7b;;S5Gv7AorN3PNRptU5NEe2xz&(r<EG6yyCROYR|fgfIgesHV!`u=sv
z?_Yx-D$ZJ>6kh~VULcixg|)A+LzIV6;0<LSwl8=nIW@eVP}@{)JLh}3p|Bbz^pLV^
zH*HRSmtisTwnQ#8rb5k!L9)xR3FylkVnhj$K;*U24vR%rS=_(&7@dT-2AkmhzPw(n
zIG+8Fz(Ti=fQ5tNVG7nNX1^k!&DlzLjo!8(q?i~fB6dOGu&&q(uF7h=U~OkzNg@S8
zftBiW_NDsHrMA8c8!Egg?CnZHu*ddTjgh=Coi6*q&nJ~~%qU&X3LPE?T^aFFdm6zi
zbDVSPUD>N#9bdPSq|Dn_B!5(5dc%o+^h$3Kp|-vvgZ5|PYbq)}ivcrW`qx@2g9Ora
z{mffVhai$FWC_RB$@70i0#gw=)0GwxLB}%|D&W3mI<H@si+3_e|9|YKqJ-{^E}wLZ
z*$~jK_yjT%fmtZm1GbBDt2xPliU~lXlPuD2XTDD3`9T?a^2%!?3%Z5wGw3nCCi338
zY3^4OWZ0HS@jNhVlMxEvwmI#8D78lpMAPLJ7^l9f3D?<%$qj?h)&CiUNrE3(oa`SQ
z*<MnXZCiW{%Gr<pN1&1V91)3n_W3b3*y&H6LiY=1hkAHS{&?lc86@bAsGbd>W$s+u
zSt3=X*{J(DG;~H<q$^7#u3`Qu^`1sY#hm^qzZH(hJ`ppG3|Dosz@A|(j};EniyEOt
zEfml)LMcjPA=m%gxxeAXjHMVMy9(O?S5z`QS;!Cpzl$`#{)an0iBZT_PNJNxvGlQ@
zw>a`-9ts7l!u!pk5B|p}JD>{L6&C0%^cg4>6Mbdrj(1%WZ0tI42G`xnZYynJ{O#U%
zd_@*|+b0hd*dQZ=0N3!*+eEM>2c*iHGgn}jB)u-wH1X-!&q{*Flk^v?6p_YM1>>Df
z)5cW!Nv*yzvv%jOPM~1T2!RPgM(CDH-FNn%H5`s7=qyD3!W1p!9quXrwV&{Af;D;u
zunGQs>rIFZwCG>@87dF_OX3Nj{I>3>r;HW}>mCt+1enqzX!|YLMCnA{8|QPX<%guo
z4NP0&cu=D!8SPqOTEuni;ve?7DahsE(vz=-cQ?s}n=H$0eKGk*@bH(Dl@bV$;P)i(
zzu5YRL5UFjTqV129kkt4{?|N!?fFC4KsyeS;_7M0*9h<yb=A#k5HY<8odbb>T-W3)
zSZ<yi^G9@ISBD1^`VJNEw0XR-K$}E>i!IG`d6P1jv5YY7|Bon1TNdw;wgc>b-aA~S
z!!&PoUY_Qv&iuwDKJ>zF!XCH(0xR)p9eQ97(_PBVbg)24l5u)Mw0k(6v>vDTXp#`<
z<G(M>{`0^{g<&S9fDISn)*ikv{RZ7JW(IoSf{q87YLpUw1kLz0`U#>8<cvIBzINRi
zp+>&8Y9I>p?i?7a2#1S^ssd0SqVoqTb@=Cj_~-BbpSBYvS`c0mJ1SH1<$8zUXK#bO
zQxn)Sp-`9@wB^u9CMEEHmZJh;U;<4PW6SQ!zkO57q8E~Xy6ejF<UE{PZ2JV#xAWZ(
zQ?Q`#I-Y=l{ht>9=fve-J{8cufxT(uJB<nAN})uik(jh_?I(gcU$QIz%w^;!qt^++
zG>B`ae^0@X@$CWhp(`QWG{Uqv(uAN5jpZ_+w8}qCNA*aFIhOEeZ?8f*4Cel~AT?VS
z{V9Lox`^gVl`tZ~;+=)<31k7z?(^A)1o`8>*b?%#N=cJ+SC$9AlI=^f6w0*{EIcEB
z+^78o=in!=`to$lY<9nPTjhlQ!}PLeQz9FA>KptXe}7rsKQ7zL9-hY$jnra#3=iuz
z)POVlOi6}~ldmKOwDskruj}viyI@yp!XC+l>V)d)N683nVA3!vN)gmuBsCTbz_QgN
z2CO^3?dtN@YSY?}P~LRmotI2JUkFL{DGfVq4gM%q7^zY1L1aH$)jIQIX@u?F<gkuB
z^M~Ikzw?Za2aFKEbKNJW;x~&OO_c=Yc<KC)NBOfMbnyA3ip-cM1SQZ{69sUF+X0zi
z?F=SSbcq(*A#<y8%g9#P+c@W462Qv4Q%%X2wKI~$VjN+oQ@l;zA~U-H<Te45L>UP=
za>8MW*jDDEwzKqAmK+A7yz(}3@T#o&U6<aS{H+Afv%y=!4IiBK&u=Ku`5N4pT1z}y
zx7D7cJQNagM?ZV@`5A|A9W3%x&-LHkUw=zNf0XsCWB0t{B0=yg_{MeAKu!3iBIJ^#
z%^i(59lSN@Lu}LLC?BKo#MSTa4nqVxDQEc$%WD_2|CH4;nV=6~UzM!+PPm9EWcy;C
zP;69h|672JD&tvh0aT#C^><`KNLDUVo^|!GBAL^)h%Q;S#THT<HMNPU{y0U08~lZ5
zrt~g*!zqFRnFB_br&yf^hQ7TluBg*U@P;$s&5N!-k~dNy8bZ$iPVR&LukP!Aa-r-J
zOkzo`GWr{J;kUv+d;7poR-vjW)luiNNP<2Jf(bS`J4OuFw-M0}zg{M!gbe2Nla=E3
z*;+Z1Tg^^byDoC1ca_ib6+&=`n|z@d)w@1rDUlDt;l0%X=lw&RH2!k0I)L^OU$V+k
z(A6Kzh89IBR5`ljbgwSq2Rvqql$!bR&Jh*k+qsh3!WP~4=j)b^Et-E<s)zNpKt3&7
z#@HlWsTgWKOjvUN)%#V@s1Z#(=~u7v>vX+ZyBQZQhe->jgQkr#ksZVTm)>wFp+5z%
zrQjhk)f->ljQehMm%CUn-hqXM2_K>~hIt>L9@V)xtj#(-j~ae8Rf)hAd)%AimP2*F
zo*?6WGvz%y!0Z8&Q4WvEoK-OYr<*ysmjBGX)$7N*6Y<id<>t)TcyHcI%)tK0eYjbC
zrzuKsVfjPr0o{^C^;r_8-us}TI#fSq0rk9LM`nn(M`WBz3O|gVC8E1Y_?|vcKfeG+
z$Du~?AZ63c7--xd9@})ezvLeRAO78N&AS8&F=Feo47y!&o&G-T!F1cQHHLA7R1+_i
zO*c%iFRP8Fae+-V7Uo7@vjl1;vB5v_)oYa-cT>K!N%i5I_~JVHRe)%8@+b>@`p#p$
zV6N}=Nptk77yP&DcTe=$Ra5i3aS^hmc6G72G4X3cvAyZ)61{U$FN{UhWKgO0(V}35
z350M?in_enxcR^De)ORC<-Xq5&@)LQ`_k&NnePVm)LEo{gOYbNW~Fnw{6%@Fom&(=
zD22F=CH>R?cf`wP^T-GT5YD#e5X&ftKLPY5i5e+A$$MOSU1^BOy%QRmjs@=ld3CVU
z#{7gr|2DcAB_35(1W7>S%QiK(Z+U=2;R{D#`5(C!?7tBd?2h4NdDv;8qZ7Ez7=$Of
zsn~q@gUWGgw4P%wZ1&sRsShnj#$w00#Y44i4RRJ@j=!9#>?iYWonJ8Ri+QZfmbI;4
zNg0>gv?F=x7PlvpcJrwdoGx#AR({{@NwY(I>lA!(?B>d<e=f&sQG56BUiJ9^7N}Y=
z7TC+LqXJ(mp|8a+8#q^@6v%%rI?a4<*yGzn9tUdD>j_v6S==3zw-42LD3L>aCX%jJ
z4UPpQb$SQ2X`0aKIl$162zI1TS<x@hc;0NzRNWP9ihD`&4iN7=9u%LTF1B=w4IlDu
zTNuB^z3t;_JPW1|{7^hISAhWlkF5Y;L9I84{@D!_#{osDAA`LqIu~3rxYk*%{?uii
z{Rzo^7-sElp(wV%5#_P*x*n4(r7kq5aiHh8B>-2##n!>HF?#U$uvE;g4&%7>*N5gC
z%I3ZQkFEENhP!RszSD$686t>YLqrRrGek{Dh)DDj3?fF4K3Wh&FCltFi|D-%(fdR%
zqYa5shEYeE_Re{~_jz6K`>bazUwyF-|Kr%VecOK9r4VYy$g;j5UTG+^$yln&({;w5
z8oN0Hb6)RNKB~1^($xCYQC0hXq>r6njCi){Sr$lKmhoF?P5M`cuCAwjFiI;*y3sMF
zNjQOQM~%Knojy)yP4#{IyZO8}j2?!CqQ|Bbw?^grO~sI=Ix+E#0V+@Cubfdl+2pC!
z(&N<Ef#B+-XAl6+^OBitNOio_Xe4>z;ne@CPH+7*zrhU>7G<o0t@DC#)-AfnRh{<p
zr2-swB#VnmYh{OvSsRuhfJ!1qH<sj)$Q?i-8~wSQ+b%gu_&){Co1@p(#nLNzY(#Ex
z&f(7DpDv=?ov)U@$^BZA;}^;fnb*f$I*Gx*h2p`aqN2Kj1Z)$j0AXyu6FYm<Tz(*x
z_+cOdH8({Jj14@VVPe=1#<Kg=p`rL;Q6T!{_L&78O;yLbs#%TxhKeC9YM=4c%c{Yy
zERh=j?i>QBZCZtlwSw!y0)gkYytdx&x%yW9%F=Uuhl5drwz~D{mRpR$05IdQHmU>t
zMA~QEybUu<X*-Ju1SmV(2C=e7K^0JEs{>|8=hnr)Mynv9swJMF*##7ooQ*}4%EFOE
z9A3@!U*|4+Q`WdweY~Ia6v*42n+JJZ&BJ91;tW$}1|bPZKI~D<uZg+ZBL$}<J+Pnx
zR{&&A3DZcl3}|_gB`sB#Wu-+`*JOou3_$xNE_)8V5Wk*F$x&8sKGvVW%6iL|86CW4
zJ?qghvo}ao82UuOr6^r&UDve7as;4VPj_YNlRD$8neu`k9-nFM*233k*#eh_X3si&
zP)Kevrl&9<Q6gY%1rDC<jh+Sn-E72KV&Q6M%SrA7L58<F1rly!FEG1edlwG5v7U)=
zP=<_iW9?zk4gu2i1KEyIICyF1lyi!LZBJD=aP@Rj2V2z@4QapF3kjnE>}J7#=PNH%
z@qU80w|MU1S6mlr5Z`B<lv)R1th=&jh)$|Fw2=gkoEpVheKFA$&>2S4&@kuXM9&{<
zwsqV<xXHRu*@m|DQr$f8Sq*d+i%>cWu=~4NHlMG><}6e>KOclcv>o_dT4yO`Df0eD
zVfv;@7ZR+##)J@%`V_3*o3)cbdu+qqr?1(gYDQw)hQfNAe4m@rTnyxaqpIXC-i|8T
zE<OeZ_4N&lIcpjx-p=Y)5uuT-XFl<`*XsWN>Z0e}|LCGHeul{Zi!4e4tk27XSUq%H
zv!v#tOZ<iy=HLZ-UQHrR`*$U81$0RMj#tE}mzk8MS@<oBV7&A6D&R3ytR`8>!FfUP
z?3gOsikY2?z00h9X%{Bq+=Rfq<nk(o)jF$sUE{9nyR)0GwmTA~&Q%k9)}65tMhP2`
zbZ4LHlH6da%g7r-A}Nh8xNbG?5pw`HNj#g5IHezrJXS{vUfV2q;L4tz0=}G5B%LNK
z8AJA~Pp%&Bw((Wp7x#=oiwB5T6;nWV3tjVbGaeo0vt^PHF|vOUAaGo1-NUdE6t9Gs
z_I3FpWYlPzpxifj1-(o>j&i+hRWIn~OyyaV+QDOXy=RJ$3ud9;{LVw$$~QK5H~GR^
zPQQ8zq@1jeRK=L&1C$OSTrW)LrQv(`tjc__f%eExp5LZJ3Jd4RSaZ$@p;UgDBAJ3!
zdICPLneAi5bJZ2)xp35e7TQ<E#a4$A8<wEN3OjAh+8=G#ih}JDFWWd51Fl2s;rl_o
zT;{cZlLV~lHABG`1!Ja%OAiEJEjc}xyDBj{R2+1=cl8k8<BUq4+_WQap^k@0)2<YN
zb~%ENm?dfq#%1Snw=mkmGu2jI5pYz}x}}fEXhi<zbR~O~U{rx+6%=F@L~!Jr+;2Yh
zCk;1v@SvWux}-}RCvICSX)x?D6pLXk2+DDDCzq34B3RYgizpyt>3J`(+Gj{q`BZ!p
z>4PYmOa52u=bI`Qha4YAz8YQSi+cfwEhVU-0ggwag9oHXk;g6c_DEHW9Ml`<a@DiL
z+aItGMFt)6{Cd%}%xUrRC^UBSYcv~>D6>pZNutuFcmzov8b#lIy8W8#{5+@0VlF2J
zpVJ5RO*m}v-^J^#W3ypdI)@aGoo7c$g(o%!{CcK?@1AnKH7lQ#*tuZW%E(V3r><{W
z^{t3<PDsydn&1s?D9Q7k&kfuWcUmfZ_Q2C4R%veURvT`;&iP>Ni8n5~B=QbTUnk@J
z3TBequ@NIrhISH7d&y%LCp8xzu;%k;Uc4Y?8AdWzjg2-qHzg@ut|@tA$L9K|&ZQ%O
z80D=;SyE1E%WkLlXZL~=dOJO-Ss6uOY8SVH#7=gxxfXugEto!syxz<qNPnXLDa&0!
zef>6Xi!#$3MGnbf)z=k<i3jzrT)D_dSAQAe*~8t7BT9s;diuK_K-A848u{+rU`#OL
z`?!X*0xEj7isHsG+!gcLxALVU85|r_@g2H+lhv%FyK_z-q5SWwI#ffA3vWv;Be?R)
zS>q`09GR$RBdiU9F0I8}4`K+WgdTtZx2Ye2=<oCk+lc%3vsF)R{ZX{gvidF+JFyXy
z@?A{9^qv=PLT_WrD)rpD<$sr*T}QDhVV|g-PiLLWHOE*EA9Lf*yQu_E@n>XB#jko!
zYf3C{hl6;rCn*5lXb%l8bG`~gSNgj6;ul$IL#@0*V3i+N<(x3(=MmUYl|N5v6@6Ft
zFg<6hnnzEYDm-<t)J;qDx57x*)=XwZd8q-xGj~aBx^nhsgA&VN2kC`7x^nBrY~eF{
z-m8IQ)MObJORp3T6IM6mF$Ze03Fh)qA<3A&pkJHcM=I+o6r61(?MI{jFxoMl-1pBP
z`&-(D)(!n3kN89E6@F1`$Sok&e3BWVSbg>kf!X#u-qd(Ll&vP(j#_*=sDHV3I%iqq
zHEW?vTMYZ#uF>hm^@Oe(32FYzX+vD=xlPd~n}G|dw@#p~0Bt6*lUuvZ;S;phFL&K^
zWSEO-7Zvu~waiTxcR$hreJD&?wb;BMC(-*~6N}n4urwI>R+2PiUhD@IF%LlC!(3cV
z($?JBnkWEwpSy>S!u#T7FVAH=&w|JY<~Sve^ReitqN^TX9$mb98Jxvhd%&-kdDoqd
zelX9xO8mx-T7ohsXV)zLqGTh0>W+rgJDn^TSpGv0vpiq!@g@S7NG-D>3{tE#D-1f+
zZ9_4y_IPfN-a_NQNJ^>31S}s;xrDv&uo*Oe*j{xIFn*B^Csim2(E?9-5#ttDdx9?H
zGD%l_lJ{gy<fk(xqKFjyZO;oE?7~`tjZXh&>QIUr<3_dYEI^`}JHV_FY&WJh%Uz@u
zC7?WiD95I>V`O$eF?2iP`ljy-LA9&mdiJ1BXoqu_oAp*2sX0sDk`00PIM*NOoAV#f
z{&*vKq#L_d9gMdcwg2>ipY>!Mn;X?DLqZ#Fi^A=iI&79;%Gl}gj<wHE6U8H6SLyRY
z`Kh~+ZOyAD4h)vz+-9k(&)Q)fz3Nwk`taojP0+D(Pycbp6Nn4faT3XlF9GRS9$D(h
z*GMcqzBck~WFlxpS9+@_NL=!(e|TQdN&br*`TNjK)0E}3`cJS_(IC|;!E`H}&Wm?x
zyPdm{M_AWR(RI-P<xCXkN*U-$3L;jo)}`e^H+s;gN29656G`Ub7fXGM>BX!`RY=IJ
zsp#bMuaAI)ia%#`oybp2L5y|=rXvmxDKBsSB^|HNHx%>!!mif{BhI!-&zCzxUT(X@
zU)aNL{^P{$>9br`Lariau;b8$?!-LyebcXxlpS0Dk#R#cRIUUiZ=kz_H`lEY23{N*
z-_{CWg(hmeGYPLwtcfy_;~in5Yta!>xUd#UzU1PE_I}ui)afrrB#IpOt|yW>vHz?J
zhyKr1;Q>G`L@XAW<LALw2c*&qK!#dQn@7m14t6a)oQ@8EuCuGCI<0heve9^48KBv{
zHxaoXjRDQ7-puh@beDbz3g%9fP5emfqIIL2+-AF1MSGi44lw?G#ZeT&=mUk2UX0Kr
z<F3t}UDue55LTCZ$7Zq%GTxX5znC|uc(clp=E2z~s_FG&BDniYlL5U?0(#-^xsL~B
zIe_3F?9FHK5`so%B`!*E+miUC*Iiecr%6n%$Yo{;*<Y`^FAlCeu7!R8f?AU0<Vdbi
zOr8NjEc2t%LN`cnry&{OvZvJrIVcH3jm-tjy9A(EceX9>Qha3S79jve>YtA65t(ug
z5|eNz$5k30d3U%u$&x>TLA5S$=lbZ5iQO;8{@)7c{>CKcf1bX*u!-G=I`h45q&CT%
zBfkdV1gr)-aEY$e#mOuyu4IY?%&JJgg1&uAgdXPGgZ4i+|49puV%SMjWyG^dSaD-(
z|3ceb#NXQ|;JkcqYDLlW1;znx+e!JN6QAMVCopY5;#7D%u5MJq2~HM`@ciBj@y@u<
zPUqqe*2te|drLNDHLd=%Wiv=gpQKf+{w&-_R3f~!kCSh)^ciD_<Sz7i2wACYS^wyJ
zRTD4~AOsp$HC=WaD@vNy+w;Tg(k#>^4t7`u%H8n=T{#YdF_PM;g5$c$2Vc-IIn+kP
zFeeVT^FI^`8_UJAy#qN~2A|%qF(;E3-Dh(<pc9YD5`R_kUJCA%E}CS%c}yOPGllIR
zwtwYRdJn?kTst>JYeu^m&Ag-jNSKTcmT?Ch)s$F$#-lj<@Z&rRnUrG7gtH${egvM4
z8A*GiTo*<Hv$+le&U0pd9BN0~KS_^?P7%->P32$n8rNcpG(EB+TbKRfzR}++8%&TF
ze&cX?zv9A8#mZ^&Ly=oe{-+9N3Tt4Bd7>#dZmb}D{C8d?2$wp2A;}FDq}CS!9US@5
z1P|I^TwA@>ACM;ve~x2exL|uko^K}A4m<wBz$z7;$DnQTH0a_2Ioj97z$(*dSTP&L
zl=qlu)coz4w+Ade7r?{`s8c!va#?ag{uUv-HEN^1J%5~Kr(OP*cm3B@9_qn!1sT<4
zmh5$9H7Y7nojfx7_s&}?baY4aYg61>iW>AC^N8M-{p=$xs#$R{g+9Q~EiHEg&RU0#
z*_y~$5Pi4s?_$t{$gL@Qx{IGunJFFDYy?<8WK+na9H*29MSpB4R^Y5llqNj<a!;c$
z{AM3|f8He!|K0H)0MtV=+d$Gh%J}m@Ft<A2(nA_<^UfzdJmJ-wb!INl1Y%BO>qLj2
zCyCtr^^E^v6I_)RM=MdmH{C1}PitAV_vw&QY9T5)DD>%{*#j@Q3#~-K?I^7=hPkvx
zv5J6;J_kwlo4wq8)|nj-+maWxGl)FG)!&17neCH9xwA6L#cFvBRE>`vNBnq}yoE#S
zSsC7gE1QCTWuMg3{v1T+MO@Z6;1w`dko|3vXB~K$MzRwkc&Y-pOox6l?)$qwra)ik
zTb+w|E=>ne4qr@*g7iL#=Uh5^zV|%*Y<OP0({2{RT#NhRhkaFbws)+j9B+bJQng@w
zX0_p^RxH(xjef;XfqqkX%HmvJf00VdACn12zL0k26!Qny*bTS^oW+DvDRDt(6Dugx
zeN765?_qW>UX7}*3ei?ahQ}UkhmL-HokPF#$%8fMp+khib>BGGw(ZPOWKwIv^!0JZ
z<@NEt?~Vo~{o5=NO&ukTsac_~a~KCNU!MT~Q6(gI;I2^VrBA`mY@Wy~syViHI0MaV
zCbn@6sD3kaOyKhJZ~r){IJ31R06B!#EXXbLiV4DwE-2FN*WbUEfvCEdy0$7rU=59@
z2?RF<9*C50tm|Rt26cG|s6J$MX?Gk<!*ds`;}a8}=g7<1ryG<Qy()28jt~XCi*GEH
zGM8n!oYF)1%-j^W%~<U;S6^4<VLl-BS-vTQNQk74P`G|*JMAyC_4ahPY*wj#5|yr<
z@+GscP35<~PV;*N+Npo|XR%mlVx?t8>!+HEH*Mek+z2bR76Tb}((SVirHLbaknByC
zOz6Awfv`Z^9P44Tkg)$a;9mZsh-wS>$!4c9rTcXWQ~ARgmMbPyciVYQXl5YSOR#Fl
z^aF+XJzD{N^M<YMI?W0QZ5~jZK?j@Kff-zUKt|k{{?R4K%eY2G@_77~)V-Q0LcDG*
za_!|)e&emWn^!>et>W>J;WWRizixeDwAy9-%qi;euZIhFoo>zBXbAH8?#+DjP`*{M
z<640%_u29cX`5cLjE$To%NRiJ#~<Zy%5-rb^DgnnFy#hFKBLEHv8qy~rg~mb&|jgV
zJ)Iza0V(mJY(CF=haX-UI`iaMGix%!4Y5T3(8m$)^dv`WotzC#^Va~bzziD{duXhV
z-BIc@@d61f26q_2JTTm4Pu+W;k3!0fd&~2gKbDB=KD!dGkt+O3V0BIdaM3f+{-?um
z?eQ6G;p*83v2AP;c!F|Vt`ErkxJ&x>LZ3r+puR9!a@-Ra7}?^9)Tb`>E=}}8f-(zj
zoo_HPP_?|oViIDWjr#_EhQCP-J{D<|b}<O%Rh$M$1g4BF4!mNfy-*Y`6HXTU1WNWy
zx~dvDsJA*$KF14KP)I|rA>2z}3S}R$g7{OIg}6t)q6ScBQBOT2J`A;LX3Dtc+tu7Z
z=B$k|`_qC4GR)knN}c|ui<}Xtd;R?k-&|uWQAN#UI9Odw6}qFidv<l#w`z+!@W{Ya
z2lKf1F|scrw5+miW?Y^)IhpoXYPH5zYr}XYe3h~)BE~M2<6T-ifGetLr};&D%(rsn
z^JnDy>Mz+XS3E_`DsxMNb4IKjouEX*?s+ERT<xmk3z5AX)df~<<v+>H2v_||N}h#A
z^FJ(79-wB{w`IPEk$xPr^R+WO8qc{$TH1=$N}SiPubwM)S<oaa6V8`^^u<qC8VtPN
z*E+5@f4A=XEy_+J*pDM5oP42zbJ*ym9xEdL#y-sxUHQH8^UJlcTCs<Hs<-&HpZ+&5
z!w??QJe*3LW*UwlIm-+@!>!Co+bmV>7?|a`M0)La(~(P_g_hVpekWalxUg<l-HA_r
zPfbI6zCs5r!5IUbS%r4FX)h3Ztk$t2JPMo5$S6bae^$;<S*&({GVVm{SvBVW``sql
zN+Ls^n!5b@g1h4q`4{1wpzIO68L9?CdX!z9Y)^sz3?jsBV=nuKD^ZDxTv|cXN8w(z
z<lN+gcQr@~Fn6Oez$7t(k>Ngx32oIU5;2%5z5(OmYXNIf5${i{T1tVo8)Gu^w~S00
z>>yv6v5deincJtJp+rWLhHZPZ@8gM1?ui%Td2LC&6CnUQw<bW-KqtPxY~nNdHGQq~
z5|zZFaKV&SvRbNq%poseg&nJSP(^yJ+4ehYKk6Uy!2O7t(>O1u9X9?WltpesZ*zgG
z(~HjdZFKXf@>{Rw@l(j=u9o-D3LTSJD7uq%W}2cXwrhS>)8RduQASMpJ^4w1a_W?<
zB!@ZeIY}o(gqmLO4g)mBs5>RNQTiOdI`I-)5j~@_6MgVYWhmwK&rd9ck`A~p`iEVD
z?;{Mf*E5AghqtyNY{M^AgwgHr-2Ur-X;+*SeecwMy<W><!+7WO5iNv<c3376Pwki|
z(#_0jCz1Rla6cj)ZpW1S#hGKElL{}_SfFaLuHf3ijVX<6{X3guyO7X%8|D~ufDNgA
zKoNlS(eS4JBg-5l><be)&uQ56R_KGFr}Tg}UTTi%0(pDZ?4)s1hEY`2XeD--hFyN%
z51Hc-u-{TbvS{kTjYUoOv%gAtrm-{blpEb%Sj4f1__m`fvm{Mc?Bpi$dV02iTgR0-
z?&A@N%EZ+kWSa*caf;GufuL=6jBi>E&-@+fFifA+@|^tyO^G%f#GE0z05+P+0H(hP
z@B2ej#DE7Y?!R)#aJuYwL~*eX%3~_M>eTEB%RWo@YEOI;GKL^7z*|h&sX4e61=sl+
zfm{}CB-lC_C(ez;rk#PC4ptP;4+?B=u|kNnJDgPvgFZJrvR3zy;jl?gdj9$B#0%Wy
zF|1b(=tRzOB9>+47}Tz_R>VYk(zXvx=wKkEL5?Q6-XZ_1KipOgAx@Vl3Iv`%Gp!~2
z8i@>VQeP9l&||i}WTU{9@a04jQ$>z<Hkk7JB2D`oXv|K|dBu$&LamQ2@7ZIXkn#%m
zN+@WIf4nH@F?l%uR&OMG_FZhepLB$nX*e{>0$1QbEf87=ous#af#Imv>I0P<iwB)|
z-t4XZSE}&%*hS27d;bZymg-AuqCt6|;hblwWdtMr7?Kfr?vE)QKxGnFtkW&s!$?wn
z&!ORrPG$SA<~QxI09P%EC^O%xR)S#wKZrm1bQ(yj*f(ULr+D|4H3x@=J(rip*%G$P
zSRsw2?n2uUJN!5DGF9xvS71q#;QnJd0Hw+g^9oQ*n`*}AYVDoA4Er()!*@@u4H=G!
zj=YouX|4LgJ7)0_4&b_%wrTQpitd&m(;ZyffnD%!Jp3M@9=j6*Ti@GFb>Rv~Ld}XP
zbFy*Ndx2wn!WwHM${#}v^3HHERkyvum1{{{;m5$YKbpZvFlSMm(7G3$V9%~eoA<IY
zWn+CaZ6earS3@}XO3U?$7xpEhqN$C*fZQWGa!&8moO85fg|;sR<KNr53dbL-^W?p^
z2yLd0#|s25NDzRz7DPhgKdv3+w(#vpOdi$%b?zq)+0hMW9jH9!7@U)#b&AV;Tq9J~
zu|RsHSG7J;v9RTM{M3+;fC%&$q|+LpO-=Qco-PVnpCDgH#*j}nPyiwevWG0O9QQb$
zzY$XGMb|#PSr@`GHcf!;k~Sy{2Xa45i{3-dSr>*9ls=$U;roY^o^%cz<%1D)6mUsc
zhwL<OrCp-`LqL)!?qnlWe2V$#b0qB%RCz6tmnYxn0II-RME2l%7unU?s3GX))emni
zv;SP?%=p18lgisr-|K9=rLY_MK7)PfR!oD39k$e-!^qS(F3tHNgZmQ&10K(Ar<9I8
zDZMWGT)&u`R6J*#9JQ5BZRalAj18MqyAx&jh3Oe~l&R@cOEi6OQ=OjJV4B@%MEQqU
zQ3h=&gjJirl<gM!__ZZ~nV5WQV_<-iLGgro-H3_xu^wC&a+9?GTd{=fmySlXd5X18
zu22MvC6ZuR^Iy`lSvgvb1M?&I4-?gHdCNq!cDBo0Wa$V~SUf|k2zN3O`j6xb7cR^n
z{ZWB&+@G`Xav#UPUorc4pZ=DPHpD5s;4X2Hlk0<9!q!Cs3(o$MQ+l%|64smR_koh&
zE3)?Lukv#T)E4jgnlf+iD+r2iySH=FCM?RJ?`A;5sE9g6U6h(YsW_!UWbH5J?;+W2
zp7L}H`C5<rIq2@4U*+1|rsvGhi=S|e2YN=W$2{)mU-TP_ib^1o>M7O?XZ^jL7XAoM
zrEk;;ua?S5|Lt)$vGM|Qg&Pb78SBX#tq@`l)>tG$0k^_g00nT@ggsm8mpjy)KI@K$
zzZ{pwU(6ypBCN_UY}&PbzrjfRrT23yz7FNe7w0`^i_Z`U!<O*!u`*EwWqWf=pACy7
zw|jSMn_ZeWYwtwofvu+bMI5abFz##wRn=5|A<6WY9BVrxV%7AzKwf)$o9oPjOg<Fr
zuYY*Tdyl?rThGi|-#fSZ)LN8o@w&da3{`qvN0Yzz4{L{iuke)Txa`C~3X{rDcIQY=
zKlAdk(d(_BdCkY=@i*GGCY`QjG#EitSWLzfrvc%SHE+US_wGuZrzDi41JLT<vqo2!
zeNYxVvzEIPN|x$t*1?Itreixc(soB)xTrin`UdqBZC>&X9?O)IoGpUx6+3NU%jz#s
z)N0dIY`<k@3yX9gACa`Rb!-~y07f31-N7e0e%k85f4udQC!Ab8*Q3A1`-GUoW>mgd
z`-aO8-K53QT(*|)BC|>_Sthue9JJ|c%ozR%y;?v69}uNNvk$&Ob%h99a_~P0od+II
zZ>SE%Q|?Vmj#Hk)V)E>wip`ni28H_x|DXjZMO)-s^W)D=nAp>YGSgif5@Q_lg1+Z4
zQ9NEhShX6g$f|5pOfd;2ED#$<DqF>Y!c^Z;6XfVye@q*E57mMurRUJX)pGZ<dn$aC
z?()38T{Sm=Sf5gJXa2*|v;Y$lE=jo@ZUP8CFFrWZz8$8fExj3|^UPb2**w`o-Y8dU
z+y7KBlJ18ywT`pFHEH<Q=MF)7IhZ_3@QEw0ni5KCBckU7E#4{Vi{9jI?cqxo3Hl7z
z!R&@r{C5xur6>$GUgNw_8|L=-;@4kW5P=N8`)O5uQW;vVwkA4Z%X`gaspQ1^XVhvc
zkxy5?pD`)d@Gv?9Qxn5e)DPCqLh!kLr;cgwOY2$`w*4RG!|dAxTD7e2dG@GvHSc=U
znA}uHRD;&->yr-g#+eT6^10e7Y$)2zym{})u=fyx#zdrQ@50~H0aQ}V2m9S7t3>DO
zr}2za>t&+yORXP-eeaDhBbDEUb)L68Eevo04$WG*HvGtvbZ|M>+u@W(&ADT260TxQ
zY)1C{I|3|IOt5oSb>QB?Lut^KD@MI(McRLqGouBi%M#WiXh5j9(u{3zXbXOezbWcl
zWd|RE)jLXp=dM>qHBoK0MS9Je_Hi`h?_v=p`rb>9KAJ|P%H=xxgq1$;1?#Cq6aBIN
z_$*Ku@Zy){w$xzIrC)tFgJXh%hk(NRnsY%sQ8Iy5Suocpk6>j6n^QK8^5tSZC@K-H
z|3tkLPK<@sECX64AiqSo5?hr#;v0-x^y!G(YazT<2?44`X>-)rLwf#!IZRlH!)kRC
zSa8e=I1g?d%Jd$Q8nADR-%!{`JBqb0DI?7_9(HonyWIq7T)Ivb$5As&6!KVz{?X}_
zWISsTzUzBSkSlKR$8)E;JDH2oTeUhYj|Ny=G>E*@j$=j#S_{$Z(37-2J$LLd<`+<B
zST<Fu=?ia*iwLLexfbhhbfCg+{f2EZ<EhE%H>nEPj4GcS)Da@lu@i3We_&YYRT{sl
zr#MQL&BS!8`bQOI!`o65DwFgoH}04-bD-?zZVF3w-L(sVV788S7ObIIvDLgPzyyE5
z^;DE2`w(qAjBiydHv}+8r(S*Vtc$E$(CQUsz)DPe)A5()^n;e6(~E9$^po1$<7KtV
zRg;;YMgU@HWqo1-3N;Kl%XTK`ey)V*GXdK85zSKKwpZ<*7rTYs6zV6h^O)%SPx!^y
zl6L-GK^%(ITfU)uNW4wXCSWc|zR=;8V1622@VfYs=lqkezdg8U+u25W>&xd%`wucd
zhgO`wArV3|9G+8>Yn!909m;**hdsQsi;JHY743iek@uQ)IgpaJADm3WRh&#Xk^H|s
zoWSZQuR1Qb79Inu?c&yJXxMF&y7IF!1|rv|h6O4v^LLMYw7zMc{+uNdb9&P2<U)Oa
z+=)hjRgICd2L<RJrUR2%|5N)}zum^ekm?TXukTIghkbjeP09_Ir|%a`olQv?8y9=H
zYhAuY!0|E0a`mI>m!phj)z<`Z$IOZrO;7kY=Q6i)7o-*8E1d#EKYdsZXmj*rKjeU4
z1j#Wj>sa;lW-xxwZC7E9)l3Lw+ms{S6mM4HK$J%?W=S;oUb|-FXUtV&Ryo-#z4)!c
znPYGwr*U<j;Q31}>3qggPHgb)qbkFS&&~`7!RWB6^%E=}TKnmAx0leEBTdn?Y$*95
zm|&tJJNkexe&ndtD<HoLPZ+ps<}miAdlx?Lz2ri#aGH%pjktbt)JaR|tbHqqI1|K7
zlqlQdrkJH|%#&&Wgcb@FWBZg}-^9fgtvh6`UziN8P2w1s1k#~}fp+i`5Ex@FFB<<t
z+j&bZ+s?ts4*o8i(qMK|=jH~vM36f@t=%sJWLhJrB<;<4*2^T&qeGozqeX}bEMFE&
zI(+VpecOJ@@tiWnOQ1(VEeFZ4zVzDlSB6*!=GE-kThb}(v!EC}J2qW%;#N|BRCsWd
zEm-b(+W6pFYWmuLqfTiuH_ny)Xq%ti0KQ`5ZRahFY&O{br<st7Kf~)JBV9SEF;?y%
z;hl)><$R6q@kulwI$H>et6?-_&u^>l;xG9qPSdL?IdIc0O=N2!N_warRj3vDwk*z_
zXH;_5w7-`RsG2AB6nZ%Ib;n7WEEk8Ai0l$t7H!ORg@6D`1jEvRFse^fkoAle#4icB
zX-UQ6qVw6w;6)K_mMfH%F3<&Dnq%<+^Thi%GzYZ|w3<ItjvwvKq~}=k#8-&*9^U2_
z+C4AuX;cGj*_7lpmjs@>UoFiRAK&>9P~*zquOI2+I>1&FwzuRp6+wacAZ8-EUac6w
zMcQ$Tvd-s8+An4>0YSmhAR6RvDcZ#>mv;N;aB1dW!~jgky-u&PVsHFkEt9rW(*<Y%
z*cldnoD7~S<zmHdBeC;I2sQ;DV`VjpRpKD4MBNK%bKX1MXG*wB)rA>5zvY!3rTHL&
z-Sd-x#pr-}LV#CwTo^i)R&>nDq~^lze10^5%TslQWc(!MDc90Y=z1dm+U;t_t7vek
zh`gprx1+o&5RqOn*W<JC-^f(Vrz<{t_j!Wu#OpH$oshV6KgAn)Y&8CmYQ3IwjvE9`
z0-a)R(AcWCKM<enctlPtmHI5i+CS=OdHKy$Wv%}S0w9+dAF)N-u=N0~QbzwBwh7|x
z&kR}Q3IyMH-KxndB>GQi1V=k=XQJ`VyMo0~WQjjJ;luWC(aa7OZB_`jr)suYU&+ih
z=Z%hqw&t#<SRm~ljj~&o%^osBNaalF$e+*82y8syy=+})<6I|jlfnLL<x;sd=5<E@
z#eTkh+)u*})0xB;S*4|$<*VZMK1#o*bOA*qqd}1RihCpttCP&igwkSILeSxa_lkcY
ztEBh$q!tB*)V2BdF<v&_-Yer_)_zt^HTl_O5;BRH($vi=o|<PH{;U7EOf}bj9k_jy
zu|n4zggcS;;A@<bA=;YRq#>Nx?0H7-{htU?=wHUr+JgigQWzLHoQrtb*Ye#+`B?SI
zXz|CZ*Ln)&8n*tX`mx=)Qfq`s?Al_WQaYaJKA{^c6AOGsf+~38J_@^bH{){XzNz=l
z?#<m=DCk`H`ckNg7)hqr%P42O*mAmW_Hr}ih^FWny89K~#r%5A==z?#EA283O#l7c
zhBrpF4RhcmIg*?NaSZs%F)Z;C?fchWXtARy8x%>#<1-bvI6wLlnQl7t_BG>$?}1+a
zCc?^4EOp$t^clXney>%8cY6ih<7&%)gd~wrO{K~rkM1}hd0WiRRlFG~t}(w+q<~p*
z*2%g{fv*4L1|$rBeo<jMBUwdVMbE_YpA{l0HHD&hsnZ-x?6V5%L@69I{A-;2$1nXS
zLB)EAqIvXx5(b$^RqGxID-!agSkURCVYqN0m3!AvLAtH!wyKO8W^#a(wJ~@U`t)J_
zrp6sxUWM65uuz%+(y}EXzM<AY`G*bU;+vPrO*+}Va3z~%)5e>>nmp%Tfa~HYpZ3G|
zsr7P*m+2AS9U4E}DVa+n8>#P|RImq6>vCi3E0&L6PPBGWiqL#^r@u`xY5#(i<vyAA
zodsztzrN&A)TjX_{?x<Bs-kqJ%xpvxk7-lF^>!DDjT2!64cv!?(~sG9qOS@d7`F>A
zJ$OqA+JUuvb$HeyV5T{ne7l1%Ug8a3uIi0lnRal*yKe}<cN(0Gk5wd&Ls~`i6>sp2
zVgZ+;vn>2hzFptGdnLyllm5tiwa0*==5?lnH^e}G;EC=q1pkFBt8ur!o*XUvh8tB=
zvf7}P3sI27#Q$qlB#}+xuSkU_v66<(4;yw1Jmy<SPKjVB^!uMqg!UK1>Y3TaaZTJw
z&<`)*fb_O+?VGBZ-#4LNFLVXol+83=*YlrhRjzL$IoqwdvrN4*=lOGVZvmT{WOC)k
zgE-9+@75&d3#C1{);>N6fu@NTQx%T2X465NUN<JJwE0Ennze*&V|LhlLyY`@dVg1R
zX1kYZf|sC#Eq7LeExMeU^MBw2iL9aB3MG9)#kc~-gUAp+_q2Knw)-T4One&A_?wXs
zYuvM1jaQwSY6-5<Q6e8s8q#V$oa@bnBd&#-ztCXim3_is?9XQB`t|f&Kbqod@r!r7
z^SADT|L9<{L!`^-dn}6t=PAE?Ewb8zqw;bAmlv09cP~XpD6a8p#wP$C*eXm{{pGe<
zWlWR(D!m8GZbMDhgk%>ITvHN%$w?_bii-?Q;@06u>nSIUx9Dms;ZO<DQ|n<-=dd^K
zJn&ncdLrX|J0%fH)3@)7afJ<4lcu<V7{$aFF=)RZ>C{B8Uuwg*s~$VbJ7mE)x(-th
zx*GW7cC}P}@m@wTe=a!`T<JJ`rN%ghpXef~41a)sfAdC#3SHX_jv()e<2csp#SL&5
ze20=|Ig$}sNci<Ix2`?@!R~Iq+J$CpHtn<RW!1EUA|(5r72Yva=)g*B?(wM+BiI*R
zXdK7ZaFAY8K6RA;-vhx%p>i{Y{rN&vXB#R2r85g@z#xcnb=R1U`ifs%i~%_hLIUaH
zA%#H&GtN~7xedhSS@GnihFz&TQaFvNEtQxe?b4WA@lp=YQr873pb;?b;dd^do6=f1
z5hR0|7(d$WC<;}HF*I8s2(;UKB1b>-A^#``)wmY`o1S#I)(&+NUs;>|q+e0^(j9Ps
z=7D$z;ajQ#aVsJkjqN)uInFTNwuR;N#s}Z6lEZGs%~rpc!ijd>k8T<8xRFMGqgT26
zg=V~XJ<f(8#J2uGO-53S6KHTl#OZM{fUZy8JvXz2!HT7o8OW$`ShH2b3*7;f1bx-P
zM@#l;2D(>1d6TMQS57~vIk|Rw)O@(u(R0#TfSt8ZKz_`LcWYWeSDvwDB=bY1DT0OK
z?Oq(C@+5-%$=TTjB})?yc7Ax|#A&aa8d)8v==(I<1p4OZ>qeT;aP`VI+~BCG*C0qF
zj&{X2Y<41>Jn9R7ExY08z3T~`%uy?cm_K-jPaf1x_cFSbagX0~pIHSe2p=D`MDWMx
zr#6yH<OsSRIB`XkUR4b0{$p&KuScv>y%n9}+~Zxwv?14&S<6VxO7cNS-#CzWs<at1
zeE1_0w`7ZCFi|&&j$3SK)KlhsrJkqs0Jf`XFA*+GZmfC*U61Eaq8*<jUH$pOeO(Dh
zBfjH6El!1haUY~~>nn+7tInViGPdh0t&2B<-J0H1zFIbPX=&LD>P-pVVtwBe<XbX*
zob?#t&~|oYDD7lF6irqn|M2m<mQ87lNoRob`gt;O^-Gm<Q`x;6n`1f7J{FV0mXFtX
zx_&x+s8u4)i~)B73-AYhF%0y*9siq*5th1foBm>r0l_A>#^T6ri+IS~W5Kh|nUTUS
zUH6r$ThadpC(l>rjq5aTfEg*un|HHL*G=t&{y#B05Pk8Y?31m!5a9P0^!Jhs$W+M%
zh1?1U5+D;cDY?Rd(jrG+{VpdrBEy>J#S;n-r5LSaE7m2EM>3jkQ>f>vTfN>dl3(wv
zSqX%WW<Q(y!ZIH{fU?QC&Yf-VYfp7s!P!)%seopeMN6;qw?IJaVDoMx>w<KSbam;J
zy)jG%_)sF<>5<6%vd7$r_gInEy&~>-g+0*%aL@OrzyM=G5Sf+N1VUPNni9yXsIL2w
zBjd4S>+7OM>YcepPu*3SMWv|@*HPRX{{0kKI}-(xY~jJ4jF}LK+m+>!tJy>D_8(QO
z08Bx<)))(<eC+7dC~3a8i_r7mD60pL+ln93P9iLwNkUd>qQ%pGaWEf`f|YJmcrV+#
zzptRi)JQv@Ra-8{4}Eo+++H<oTOrM;PE2NBeoF2AHdt*!qE}~%^(<uRtcw^~P12XE
z8Z^0ud{KkHq_>ud_BfCaMj7fb$l>CY<I}d-xZ@w%alV$@XfxHI#{4-Lp3VuhVfX3i
zUhzY`W|abet7x7y{e||L{V?;QCum@Cj#Jq>47*GZjTmd%k=lWCmz*@71>`!Ifqmko
z-c8FVrimGM&WSbYwprTkf+63=a;26pPh0DaCF)LF+it*xDs=Ii(*E;Y0lOC|5=f(0
zs8(vj20Q_67l2C>0TbFk5_x4@8;ZQ<FC+p8P>XfJ6n*^ingcklvCVAeeM9-cMr3#-
zTh-evZ{XOXi??rAV<}#G-F6qd6T!XPy2b-6dfd3M+yAt8JX3BA%5m~FaPlnvc`R6%
zY3^$+7ySV7Zi0IOv>KlfEP^_v&ysNWrCRXsu&BU$JD7#_JA>DoIi1%O<`@Odepe4=
z9(tMiHH<lL#tva-v=T&8ty$S4;Fdm1#LAEh*<E5kgMPz4f8>o=UGYa8$GZZvB}g*N
zKr`pMx#;taUWuauKJy1H-2u2ru~zsdJiM0qOIbhc*1`aMFEFNJvbEqv_JM&ffB@&m
zVZ0Q1!Hp}2JZ4T|fg277>FCvJXqCmCM-~U>U*6{{>dfKytEJ$3cEP%=u2vCeqiaDv
z1F$F?`{2sV%3AkxoP}+ik)<-U`1)$=?5Ci!)<e0Ki*MwpQU&>l=Z6{Y00j=Wgg8$8
zm%v%#imXe6w-H=6HP&w%@eyq@LU976CJDcT^#7z!4-#;61v6LC54xEMNf)U^P%JgZ
zExT4DL1{^_qWNXg$dfM!<pxV}#ItSQqi6t4pFIt0{}!F;dM%Jw_G!f1#calnD2>~(
zmaVDT_d`zRxz2e$Npq9B+{vEnZQZbrRi3Q|gc~|V>E)>f^m4Fndi2BeyB~aQ6&9js
zpSKMOycny#)5Pm>6k&9;m%MoBYh(+1v!0gIjK_VamiP3mbhTdh$@k!b$*pCNUBP>^
zW+JJwKfueDTTXf5lQgBTZxsQ?W&QNZ*tL}t5p9N9j5W`@<C=V$qEm{Ciu*9!KUcA9
zLhwcd1%;Ck(SO7*4e-JUCw+{4wBjiWD=iKx=J~tOGq)NSWipUhXk-Ox4#X|!<&UZs
zB)({KKMy8Cbn2>Oz{PIA^YN|u)9OlQE!&^_dp5Y1lqmsmVOKN<TXW@{yziYgcG@2W
z{8aHxwBQR@V@JUEx9MyhMcYJRyR%+dajM?OcbygspYY`zF8FlGOn5;_PipFgiFWc=
z7k*n`+eIk~o!bAC492C<hEQ#Od)|Ab32T+>`j-W8)8OGp)EepTW=Kq(aU#EiUOqoE
zEVCSVKWEi4sAExJuU7WPnDL`nA}Ds9*NkhQ%deA&k_$k8sjKjNp!C}=VYhZnV&g0z
z+o6q}5FUsfGLW_z#3uE=Zyn}uoP5Yi_I<nX=~g^(uT15uG^JP6YONl2$p!sEd3i?)
z>}YY;p>*fh^;M{JD!VcFespGi;!mmf74P8a05h&xd9rTo^?>~q_6<MpW%Ri3h%(6J
zA?<J*$7NK<1?rYGkk&27yX_&H(LiQ@QC}rnl>EUr(K_h#n^G3-N-|+Subrl9nl^Kn
zRZ_Rx)5iSBN0xy(?0XeVx{aL#9Pgd*08aczCGV-?q?2WIb1nwkjNU7X#8C5{4$r!$
z3#q>9w-V1X4NCu@usNq^Yww$~xyR!-@4uYG8;x~2ljO;#PHNfBPgr!)V`p}HK355!
zrjftc`x-~s*CF2eLu_qS;|g@ZOZ7qToxe=lb8W%5gq~Qz{W~Fs(^VZ4grskr2b*6I
zAG;!xWLJ^%`<UJ_Gj$JTreX~?(Y_~+&95s=6(G`$ROmDJ+2f%eTTUL|SA&y8Ve>yB
zw5t%f<aI+I(<X(cIEUK3T$xWX+^pn~@p@(ieiCSYK7Sa}R)M6Cv>X3W#xB;Vx6(NV
zgkW2JpV$xJ(InInh50}K^*dGb!!)w_>47YwkK3p4kDVsoJHap3$WamGnCe@$(CECj
z%`#_Zpk&}WnlfsW^p$-^fneW=_&9pA{T~G&Sc~-Ds`WY7dTMt5bh|I*<{LUugW#jz
zJzk%C3N?Noa*`#9%=b9||HyUcjOm|qz|j$18QM$?3q*qnKFSX^Jf?qdbWm7+D4*cJ
zS9f(xh>Nx7lkfb9!<J?TWS9vvKdH)6Fd(yAJ(I6ARD~kDmYqK$5!=-PID6>s1B&uq
z{8{lL<ESL?a7Ii6j3iq>4!gR#XxY|~aHDwed2HkMyeRN>+~jpmD%`9kq$pT-J%d<}
zZX1}zAY(I<Uh)gwQ%#>FvrB@b1MjEB$sYaQv)%q=&C57VWiPgHw8NSQqCgy>tXJCo
zyb)jY<`1>dV7Si;m;E#PFw;JnmBUx13vG#AyAhG4aqKeUcSZs)1MNCi2#@cyJC(1D
z8ahtM0-uZC5Btlx&VG%9(<)d&5j(x!++GE@CU>EqgVC7GZuINbmgEMkasaBdO#YeL
zzGO}(phHj8eG@H#%<J1MXrd>b?D~(53L-go76F+D&N-cJLU)P`8VU;WP_sOy>fGfY
zkVl#Z%qI~YIH^&t%6MaU0G(-roe<o*WSNu$Q!{)nS6Jw&c=VON92S6{ueJ&jjYLkS
zn|sg1dH3B%rn->&a3;@Gp5-$!V8N?7P1`KN%FtD81*-I~jrk<DRDXk?JFGhS#XaS5
zd6MMuezx3^<Xz4zx&+f|XO1+Ux(`tZ!$6N5Xqbn%{g8bIwj$PXBk<%gIYg7&fEjnG
zjP+=fwAbXIv6WQ1-X?OCFv3q17Y5M>r-_$Zc3A!pgnZzO(syBx5~bKkSnZTrTst01
z{MANuuhOj5r}V34FT8(rEK|kYYo4b<o1%dmI5*q4elQ4O!}P#S@0dLmm57QAI@2t#
zp!&7&W4qPeg)}ZB>D!`u*utznx(<tQfru__?*)`SedbhDf*HI5EjzeC3zgP!hNc4b
z6}-1_qs#Dtz&KXChH+i8Gj!QR=L@ZU!BlZ9O*rnSJB&7w_DDH!nK!<Zh`XppGd9l9
zFlngz)+OTQAA-K^wwLH$N+sqPv6z&WmbVac8&`@W7wXPXw5x#8C%&)Xm%9mhvBimn
zPOi;Xqd|DgR7rto-{XgAT?ugt*`VEs(Z8<;Gxdrdn}e{rzIjQ3I<v=`W|1*;1)cS-
zzzeJFV%<aQl3-fN;Zo`)@46nFn@S5u6bqL``P~g)chGPzoxTiiz~`F%*#NNN7nU?I
zz~UwR>y(YmLHCp(FMX*gMHgQ-lD!Hps7Q!e80!24Gar#^Q&(-);Hnm6>Twz%0|1-K
zDq5V+Ar`b77XZ>teh%lkQt*Iqhd?(@7g|s#7XJ!T1b&AQ<c8Et$h&784UurthJ<&A
z2@im_5DzXEA)xK$r0sRF&mE+?98PKd`L_?B^LVJoe4Fc@&PUZGiDV6E7M6qGO^g7J
z!Ro9IIUh{R(xi^U0CXfBpKjeYfm0p%^3hRVu+9xG;F;q2Pn)x#V+%3n$UlGTZo5oO
zG&iT!(&YHabvAF`Ic>2ysBT>bwAT){ntN+db#tvM9X#p)n@N0iZ9a|gEuXJ;83liu
z7k$P-<&_|(otziUT=%kknsBh;svB7oyrwU6cS0n7u0j|c2C3#YQ)Hdu5kQ35-42x;
zhdxLI!cD(Cd;=~j7J_f-clP6#0|#DUNDh@$zbaCycPbasSQ1AvNVn5U1Yp1cm2mpm
z<G;ue6seW8sgV<k?eC9ec9vQ8?qsheR!U3Jwp~1J*qPZ&oq{!pG@{<72)w8_tbosx
z;&|}oCZY^vJJ%`8wWa}obewqmemJYN`9$N+?-uiLw~EDvm~7q~a8jIs3YSRw-FH@j
z7Z*0X;XW(QRd&g=vjHJ7*X}=q&dWH>Dnj$LkNTD}NjYS5`tJK3d6*USTH?f;nf<n1
z#*Jf=<u>doMagBW*KQxB@Kg!Y(qYQ@mroV2^jH-l0iQlH`Znj3yhAklFXPYGrPd;b
ztMZ^cOAgl&;z7=?-K$FPqD|JtgS-`?TEiR8basMarJ*05*ZCUV=9@mtQ!)e1e0|v%
z;&C%Bvyy&rg>z%6_m-N3^vO_jI92?e#b@-NG;O48U(Z|P>xT;V4kT~(Qmr7APviL>
zO%?U&o@MOGup78Mne_eJC@l#ZA|b^9zch!aKx5RH+ZoMM;I=?U#rAU3(^l?X-!D|m
zOw{S!38oEM^Re5V1A!q*b~LZJvp$SeA|uQ9hG*;h`fEOD$pa9Alk`f)<sAqpMpf45
z3s<PypC@5sM(}QL`5z%`z1}Oh7JWU=XW}Big$a472Iq)lrkEQ%w*F=8x1;nimMo&e
zo8Lcai$5w>@9kA-);_VUWIk}22gRv87;W<2OK3cWbKXyB=Ezp3NMMualGJjT7Q1ef
z<{D>82756?FqblEu^7Zv7~ZfQt{BY&uv;H?N3T~j&SEedMq*}V4L(tTB2ZN#F*V!$
zAHBU(>K{mHZWM_CaSz<<JgkW;IdS_!+gTgY)JxvY=HIXm%rJm7Y|+lzl*HQf_f9VU
z1JpgAAeEi}xE(d~(ejrbzq|S)=Xl^pHR&H$=HDA^%~PmXNHex(P&<0gm)P;Y$~$4;
zbOQ-=K4I8!vie-*J71&R&&-PF6d=Vn{t=&1$#+NgqSH2d*|I!B8mUBENH&02+Xlmm
zy-I9eHU13MI@rdh>=Mgf57V6h^iK5XLEoxH;@+)7I@WX?O+Mn}0$cZ>wvn~MHLNbs
z0q8l3Ug2@#p!w5KE-2=c0;<peR@>$x1g!*Re0=@Q9V55mHllRsbs?YFCCU(Xg%3%o
zv{DmqR&FFtlWrjPPjF#eQs)%pqL&Ap;Rr4adGrkFA?j_nLLuyWpT{HD_xz5y118q^
z;dk8!L)DJRDQEp#))LGbx`O-w0im+d45@;_<e%Kv>t4m*VenMD74dN9v%LeO$-Pd0
zhM7ODZOKYN`dWiIaFdVlMl}|p$Fh*LG;T$h*Vq`(#XD%~H<;$km&8{OHjRR|NKY}L
z*=Gc=r+Kg0YjdqcBrGSdOJtS$P??y>nLmF^B(;&4bS;>eyZYX~Au`_S`|(DJY>~?0
z_rB$vHC^tf?jHl(eFS80=v06ERq^z2T{k?jD>%31tRo}fY-KsXsCMBXmjK1vk7vs{
zKpl$yEH7L<OrUu(&*89inA~Zm_?a(gJ=0?I_b;oysvZt~Ma$|BmM+!<dz_Q|Z^HeV
z75P%vM=~B37obu0S|_41gaylL|7KbfNQQxXnoGgaV2{;jx22vzx*na*!r#X0hkqZ?
z`SnH}p|j3!Y3E<Ey$Q04V}jLfzKg=`#$pbvm5cq*1GXSTbM%StjgeIMl7rg_0;^BV
zz}<LG`~4PkdHIhU#^(_D^R64M{GsbGZhT@IVX)_*hnLCbFyHG=&)0AZ$f(xpv}|CX
zdx>(pZ;76z#{)fZ+NMN&Df9&P(I++c=jAXg=kng^wCJr8N4_8~@n1{gN+EY9VVrEi
ze_fW_AM`z9c+JV_ETS1SW0dFj2e!N0nHl9+6VyQb5q%8ie|wGeV|yzUzRyf+XzthG
z=FmAXwU5|!X_0v@@eIM4qPT8}WoILGB%j*nVFoyZDXbs_ldmlU!h$YoCJq25bAJop
zgBoPdMY=iD)<~K~P?4M3Y7l~S)G6Bb{8T>d5+&4{w=v|Cl^Ql@^T;kYVhFN(?+lnp
zD6}~Cvf6PSDN=Ur#3dhV52#ZSFOY8ir2`SJP=dB~5jLD&_bv@#t_D#_e)E$V8X^mB
z?ei|GnIhdSd&#L`4weXXS&?X)f5MKZX>%1(@{lZBCSn2kRma-S$6H3McFQW+HM`j}
z+9BJ!l~gLt{?#Gd)A9W-a{wo!mHJ~C4pBHYPD#!gWG*<z<~f$Kqj+*oiO7p&dvk=0
zQzp1ix}6-BL<C*WB}MGKgN^N57<76dKqHI5y+563L`hGklj}>C0)400<(}%G^Ju1?
z8iDMj@pyq;j6bW3q1TH?N?X4RdX@n+&&}n&tIaM}T^&QNuwkDGWGNo_*>(h?ITF2%
zNNSlAwqH4vU0G=)a~B*XH0>|l&mV8KJHQs~@4J@t1o7F)mGT(x_he~XmJCYsc682~
z0B(Rvr<+;-J@FGD3~uOBLvnvE@SA~IT{_BwhXc;V1xUSnv@&yw#}PtRoxCTU=N`>}
zhO@3K<kY;7Ugbyqc1rlU3u<pcZltR~mTQX*#@inS!X7z<#Whh-K)>)4m1j+r!Oh!g
z)@6I%G;=E-d~Q$OV^<Gn_g;})a$mLG_Uy##wxz#vFT5S}zSbq{RxFzwPws$%$u)6B
zj+_vcY*wDPN*KHhx@bAcPq<A0{=WU4bDG>pu>P<(Ae*5)y}F_3W{a%Q7mL9&%O<tv
zL)^?YF|rLXBJDkZlVI?0%%n%6<C`9SSV8NCTaf49iCaRw>4RgxZKInvF81oN$xIXO
zir40XEnDwH=o0R3J-_<@@bw)~O)cNoil`t60!mS;bm`Is0*Zii0i{C(r1v5<5Kwwm
zdJlqtbdVyUMOs3S^dh}C={1D#UEh1Z_Wtj4t-G>r0?EC1X3oq$=j?rEi*I+yd9!QD
zlhoKk<Rk?BB<94lViM;Ve6{5mi~vjCm@DD8ozzIZhi=f6ywLmgFRd9mjx>o;eD~8q
zTLj49o2MdMPjC;0zwf(Rimn4+$}ccmY^3Ln;!UU9Y>0fHB(yAfB1ue#HRqfX8ce*%
zezWX}ZQX%ExqsM$Z$#fTrtHw0_v$;I-lS^6ZVulLrbdrm7!ujXH;s<<<NE7kf>JCE
zMBKLFPdvAK&-UFM()<bC1n{t5O{;<rQ1i_0sW?3i=#aE#_u;6iZnNHc+qEv?x23#K
zb?D{qmp#?RP@Ca>qH8?ql;xJ^_N8o<1N-ku_Gh$NM7gquj66*v3J`<olz>iON{iV4
zWz}2();X(Hn|oX#Mjn&*!|Pzd9y2)gN6bkpOQD2q8Tr>h+WWiXA3AA15ph>N^E_>T
zY=Y%LW_WGo&P~@llG>IwxYe$d8py)p(9!i?NL7h=9|m_j$$`1W^6_g$A!HgXy0skH
znwKs|UU=%hYL?5ct$V6#d1&5Z(s)eLnDgEM8xub8=*0D6)Y!VN@@OFjL_BKz#+p+t
z3Q7-o`bggN9Lmk$KIy(t-eqHZ?J1vKsx|HfdG?yRz*790%FBuC^e%1?>#j1B?x;~>
z%M5SG?Ew+gRGZk=Y?(4o8g{?$V&$MXf)_VBw4#3ehW2gdZlo3_@GEZLTWtROdFvWG
zok7=EL&?!2*x4p|&5X;ta<|)!2|2fK-3#rM4IxpLXpDKZ37h-Q98Ef?Ds6USZa=KN
zc8Se4h?!J^k@gnMCp(OtSG7z;WPDNUQ~KFYxS6hHwRzn8^W&Ge56ddz!$WJfSre&%
zM0|&XHil~C40Yq9&g;5PiywjQNxFrq;48U7NO{*yvbzY}dQtgAxN=}6T8s%vpOUxL
zG^o9+(lcj0>WT1iAnld9M=@gTnBzIr*=v%pL`9Tj=;<yd9G*weAG)c`4R;&!%t&ah
zF(|(0zFBRF4eE3gMu=EOp%NH38K6BTCg;LBq0mw(q0Jg9#14mO+mGReYOTfU<_WH#
zPPPn5yRQoloT2E2UQxq4+EKP%hY3_I?u|F@bG7U(8*D#+lfff3BcEnR6D{@{QI1hk
zZp(Q#O_<IcwW|zMWalDq>(sz9UYs9K(KsLukxs3`N%`AU!NT%s3(Sf7-th7tY6gKB
zHREFE#3yGDY(K$h&W=I%Gy4(NW1dq9TC~|!KRuKfagr-4Q&%tQWG8*cq#vJPDn;kv
zpQHw&WoT)y2%JG|N3O0OJ{}D^z4-D5;xz{0%%sbO^58gqjR<Y<ov*E{RPto>rO17I
zLTljnGcNX7ILEm5g8K33<a(D|FdrPr0F8B<Y(q<5yzc|smma-mKs-|b0OnYt^)U;&
z;g#gOYH``nv)Pi6g^1Q8zTr)QmGF<2lFC%Oq`OH|Un6+yb+AE0pPW(lU&{{)Lqg<|
zII%s}ydFL=%|5AXE9&>RCW#zr>EVL(QO~gy!z&DD9?8&(l7-Q(y#j8qsB-ZEnt!#T
z1uW*2`4f=gW%S|9Ev>(Hyy;9J4STZp*$AP6#pbMNO$#p&U1N_z-Fn4G(!kM!I2qZM
zvx)cwQlPP`J9}sHHZ1SixxlHcvf*7L353imojtI&7$e=!7HsBz*&T#MSvbN;L5YL9
zLF^jd0_bA?N1#q-ljLEMuP0|_|D;*;ok2e7F}a@634H@23X5=5M~9fBPuNL>|MA8C
zD;M9Rxk{5R>0X)>?-I!f16PRXWs23i_~8<P{o)1#45yD<EnY^B^_M_3)iLacaF_F!
z8>3PrRK(80qHG_YNsF@<yI87tn6hl`&9cZRv%+qyJP$SDz4m-blfL&O-}|<QA)Z^O
zbwYe~%DY1_M&ren1LB}e=~REhWPifQYWzMx+dYs{^mWQxcFa8H9PgMl(U6VUdu#2)
zav_LLN&Hfvg8L;k+ID2jyk1M=@eFgOD%M%oJLL|ZL@-%AlEx!_=ll6_aEAN1M9*ZS
zg05@E&6aPd>wyZ_Z{u1ozMPoW^nRTHsi#d4^e;q9INUB~BQ0w<c%tiZXr6{WU5M9G
zrD%#-*&Z?5d~L)T{<5f~{3$hk`xAG-&W|{)L-wXTru7A{@=fT!IjnA}v*k`QZfYm0
zrQh^Whai{Idc0g_nN85X-s~6T8khW51AJPuBY4QR;FXTI6_bcZ!LDB8=_VTdi^&lm
zWkcEodlb%TmQ_c=cbd+ZH{7I7+j2fy-fp@sb@sxVcYbS+tCU>C*fD{_DTZKM?!z|R
zGE-&c?s4O3-ECB<wYxI&BEZ7UH_1!!j_=bb6*=k;*$ycY(UWjOW%{j$dD8E17W9VL
z*n0m=NNRadRF;CTXR`~J1}43EgLQ?r6{EUd@D-j4#BLo|i^uMym5ub?&Xu{<1vO=`
zAVz=KcT#M6vQi3Xb+OYksQ$^)*X^6ENvrBKfwH{G#pz>oV57$r$Tw>D%@Oim8QTZw
zYe<s~IL)?ws)KY2s!o1NQF*VF#4^K2Ppkk<#`zUwSJkOKHz}wdW_py=`DUUM73j5M
zz*y}yH{-KQMFcV0QIXhgD$5Jf-+;_lT<!(U-25=e&H#<yGj!@(Tk}b*Og4DfS1qs0
z0K%?((_l}i>BHO$u`R6?gHRx}D}1)r)0%i0)-GhI*>9+7wS!q2a1-piNsqc;p2r<_
zLAGLy@Due9!9lLZ3!^P)SwxJ)IVK3TE%i`paTJCi^ZYnm_hXtG>b&PWaTBvlB%0uU
zOH|=4^G#2tiC~GDJAS8LPLE>WCWZEjb;tIq+B!#OygxRY;o7<{#cLb{{;sjnUr%E1
z>>zbH{fZ=i(|ZyDyA}>H65MX(PFtfwJM=OxF%ywHL3%hPTHG*)XuYpdzVs|WG@HL^
zXXXatS>a2>OjJF-JH8|Qn8I0MQ*=#buD)!X?Ps)k-_In+^uAj-Wyl9wzJ@dI@I2s0
z^0n*SkC~rr`(j6TT~Aye%_L?t>%f{`jCWrLhrZ=QkrV?Av&RbWB#%4vcIBLO@(v-G
zX2H3DG!Ig!!NTf6vDge`cX>wzizyUxFZhxM=`ATE5zRn&dv1LY%=VYm(1nKln0Ht(
zQFL2*M$vX4Fr_~~kb1Z;TsvQvA8daFW%C8Q&>y|~x|!i_$~EH}lTMRpP^6v=Db!ma
zIk3LJaW75kS}@hnVGN)D;zqdv7PC}#W!fhP?8)QD`<kE`h~0R2B5Ln>0>ZX{{rU^B
zQ)1QVkbc@3Rlv)+7BFu?zZO0~lWU(XZ94F97^OhW&c&bPe9+w`x#v1cUB~V^JStVE
zN$)n=0J2{;Yb)$E!f;g!U{2s2amA^OJ&bX+E6u4rMiD(!Dy0w-@z7zsc)_~ZCEwu}
zQhR3WMZL7V$dnxK;v9n!z9lZ)TM?3Rz`X(vq&6P7ZQtKKG)7BR{LQR7PAANCmCo03
z==u2h{t0>Qn^9fR`S>Z8h&w*e7|$Zzdb!HraL-o0v7Ef$HJsx~ucT`XiybFf_TWZY
zQ?bJuu4Nw`yprkr(9pNlXzqt2f&|cQSd)KNzFe_8o_|5)+9##H^`M%JV*D|enJR%3
zd<TQ`*$z&b_fD;(u}ByHnJWJxq48ke_2pHQz>O^_3&na4vZrUXzR$1}=R~odV#f{p
zAyf;3!)EXfRiA7Qixp(*{7C5l+3mYN=hYgtUK$yZB9gC%k-#2tH=v|N#dQ{tg1$0q
z)Pb+FM@jKSD)}HEf><^r^3m75pvOU$lb)3&Kd{2z$<G|7km?E?<@IU8G2MJ*^X(2>
zlltB@q|%;zr0R&tWQSmy)^hgX;KqdyWcz)HSLD<6$H~G!{p28JN5CSAy?eI*mMEWY
zK<Q*qT{<sg#oL+@mr{==pN3u-1+g&E3DB7xdv1H;Uq=h<w#CI0RtS%dx2*8OP>(<{
z(5qQfi@9=D*#ZlI(^TrS$>2WmW_w^0z-;o~kLQ89Yjn|4yFDB`s<)s4E*@fM2NZ*R
zH<SV#B8TxE8a<~dVUDxssNj4Cka)(G2<ns{e61mYf~53^$`Pn7aY+V}ciD_$tNoP=
zV2}zO6xRlR)&?zJ+%<2maP3Wja=A9{Ph<oX4NUu<Z+&Yg(ZCVozS>!`C=kCGd3DUJ
z;~<*;RcV^Xmdg)Ih@;+5x`?fYPp~{rUp6<}EMM%nw0Vj`t9pQ5fS5tiPit2uehzGb
z-TQ3l&8Y96ys<31<%$#VgW?Ry4T*B-&d5HN$68j0Lr5~cPU791A=g{na~ls`X1)O>
ztkPAxBQBX=+2Y2=YM)n~>1KGYBoV3~NU*8!H@{ZI?+q?|*o%_LHrntBq1woBJ&DYX
z<#8@J681YD{t>@C_-fP}CqA1*>0#9P2J4u(J2<Mcbe!9S98*P)QnZvj^#)|&VHdqr
zj!INBItk!+k<h(q3iFL`qsIe>@L%SDB*6pL`?((IryLCzg}65M-dHj0<gQ|6TgaS3
z)p?00nU*-P4Nu!GbkLlRuba*=JFwS{Zi#HQnQm9Y@op|%V}S-%<`SW6PTAt^MJ9gJ
zs{zhDf%PsNpko1;*W`G=GX1ja=#@2kBTlN_E<%EN_^p67SIcy-WK$>??U{xXCg&F@
zNd7ja=ua2+5ZADB)Fc`hB{KEkAl<BQ2QtYtnGR6+Sm(kw9F*&?T$hAECw#lRmrmk#
zl?=>E4hLWhE4WTJnB;bz2(-&vZBnkYpFD!6>9yGI!G0_O%K6q8(d<ig=8~0(%v>(b
z_RT?*H$&*&JQ?G_6(EQOJcDU0l_a8}*txUCOz(B;79FtfhY4DvW}>y%6e|2CHf)dG
zvlSQBjyu`XvWv?|B+SNNcJ0z^rpkw&EpL<!_AQDU`&8RSr4FY0JYo>{i>?{B%Xrvd
zFANt7p+gm?p~unEq(nb9%awcg9fd>Qs7NnFnyZjWut(I_(b#T`$|!H1r9-qacWF*e
z{Hs2pU|vSbT=icM>=NqD#kWrrk}}mz*(IjtdXC%lR*W+DMlchLDch?)TCb=aT#tH1
z!R?hfE6SD*6sYL!_KPns3cXgzd<Qg`VC~=<M&50oZzj1fsz=5L_EpKCaOMSDNM1@^
zNEw26Q!No8?2)+;PZ50s4U#IidsP3J-g`Fl`}VZNfY%RNjS5WaM*9M<!-EJ{%T1Q@
z<6YIO^%eVysOfy~wa$oEe+iP!^6Q39opgiFv~=28@5sTPo3z$c&ewBE8%ca5GR`J7
zPU~H!xzr7^l{Y81x*{9hDOP3hR->$v2Bbq!BKn^Wy2og9rI9tJxvB%G+8o=5F{hgx
z$fS+riZslGoiZ4czg~ovgiI=9Ec+GgZC-`<LrU0hYI2CO38Zj=lVfjjIVbv<Ga>aD
z@p$sG+e{8<x~UWlPCLUmGbO0R53`C>YSwL|ZODqCcNQvB{(zp?K7z?NsFJl@L)x|H
zk{1PR0e~nk7^FaVS553N-OcT?f{GK8hY!3UY1$_(#hl660A!$pEf+NK4IJvVCVqCq
zFnr`OFIL4-ld3KkOJ&Nrl?p!F2p^0qP920}q&s|nz3DcZ%OYtT1k_DbliE#o>!Zuo
zE1NnZ^qBH<rB98f^xO@4Y;qnYLZoBlt^vsd4=OLw`|UK{K3=;3DYgjKL-LbNyAE7x
z+37c6?su3WCDh=$<DDzVth*^xw!;sjJ;zK|q?8m)iNovDJtoY{*idp-pm{f*06l>O
zkLb8p>}>b%DLmad6`zZTh7^_7a%2`@HO)PZ&es;A$4Kuhx4pt|l%qPcJwd0H2}>LU
zi&falWYg^tJ;w!4i+xsWy810Rbd@0mMCFn4_0aYb8AAMM5Y4Y;9fc+Lr|L9;Na1K>
z#FIT^TS$H+W=2u58N19O2Fd6udmb6g+S#~YzVKZVeuD7aB!r09z3zjrsGi#T+JlZd
zWY?}n0=6PIIgC?%WSg9XqVt|Lw$21OeQLS8>l*UDi`TucBC~NNeb*}H;;Q>?=4)oy
z`z&AeHx?temq8vI?UjBE5eij1L`3fXl@h1jd>}LsX}-9H0OhCK45{@>zBdEwo+<N5
zCN+tE4Yj0=p*^*oC7?9!L!CB5E?i5+W;Ql8!9N)`kgj2l&lF4-;gj?}1d9?RsLcGm
zxGMI`_?El|;=pU#A5KaTzRNjTi3TROO8(T-Z7p>`Fjr$h;p<a;i>9Y~kT#A?2_4?s
z%Cy?t`(d3MT-RVoGr{)$q#9*oOzMx<A^ZVKPYj51qc~H@J5jW}VU6C5&4cfj+FwS{
zw(a_#gtA5}ds&%HR`a&oMq;qGO8dzY##oQ{y}!_j%B+X{C4sHD7-?dUDQ9IP^*-mT
zn<Ud_uq&;EC>$4dW7fCT+R}*H?_@6IVC85O?CXWu_vjloUs*W(I!V<&!q*bQ(8Lg<
z=~=261r#ckEUrO5Qq+CYG0#282V!_r9K=RjHRE711Es&~&~zTalE-8P8n|d?dHz7&
z!??*E2pI;w8J!Wz_;J?N%@@eUSI>CURr-80qP5VrnC>F*BFFP+t-CXZx<h$pY^k<g
zTY_!o8#_HA)M(F9$-rIVmOKI7$q92Ox*tzM{_#ntSbpl1d-qL^?;w`q@`1v++MM|a
zxAm&l1?84#$*p)d+}?Z7*R8G^hIS>?DxKFC#=ma*H_mF}FTd9vsf=fiup61N+Gk<g
z_wr$+C-bj9w9R5Y(lPY*`xVBVSKB-u6z@#;h^Y9HAsE9~j~Q`uTpJflOG5KW42$Q@
zx1Ahz>-CGaC)LxDgUP=h)!ma5I7}KC1(%emHi1@>T{E40XZ+TDET2kd&Mhv)DA{&N
z8@l(y=f26t-1rrhjgF9U3mTq<`Q2b>x-hQAASGIXGzz#dA6~rQVWu87fAAV0)UBNw
zM}b#XjNRTOOX9Mxhzz~8mlBzs^ZON5R-Qj_-(?Mf8{L&VcsEaU-?4t>gB$Tx#Ag|-
z{Ni%EXHq+}nONz<*>)3=Wrp9AWZ@<^$1-1^d~o8<e!Io5nEYP{{}DL{?s%DDo+2B%
zE)8-$CsQTo(ORg=%~ukX<F|0|`=Eu#hm*A2OcYW*?QEtcW`GySN@2TH8MI&m^Fm1i
z7}oCVPO*lUs}w&4&5w!&y$F=>Gdd7hwvGfXh%>fVUNa)->S2l|f|_)zeC!nqj=@I8
zT}SX@BKr}hK?$NMtL;gJ7c>^M3}>53F+UDe_WAmYRQILE@l~??@XA0&e(vCN!HtN`
z@k&e2l?;z{A_wz$KMS{mN})Q*KK!lf4Un~tV~*>-=g)y2-zqO_T8T&d`<7g0tFE;8
z^(6aW4Rs<~QLyQ+@iAh?{KwsVt%GWsm@m#q8uq45%j_?%2ExdUj6T_5Vu$0YsD`Y_
zh@>fDo6R~}5j))}Jh1ZVIAIa9uzq+iO7A+#opD-6-vDu~Lnop!`e>HwasqOffZ2~m
z12bX0HeTp^9x2#YYi(I%{5)y&^I>%-$p#^NdU^YTB*53eV*1c^Y|uHqkob`(#}H$m
zwn}XjAyo!cySHpVF|%xBB>>Aq1Dol3V?#pgxoiVQKuE^uxEE;l7OWSK8y5&83ogKe
zyXspv{@r;Qk6(QZqP%f_cFaI->v)gP{dkY`>Xuawx%t|P{een*md+kS>`85M8NA2D
z5Hu0#Y#B+k5RL3i<~8N-WfB$WDv(^wUSyAs5K}p3siQOuiXrA#40@)7M~t{J04Rhb
zD=uLPYN}FXVUpDF#he&$M2>oK;Hzck_4UhQ*Pf8lq~+?CaFwAYn;A#`98)_I_sje9
z48C@!z+|r_A-JCrkdYLHh1?yLlD?<gq<`$)_G)>VFR|N|>BX=<pEFh*sz9wk>r{=j
z33DsyY)>BvZSJvkpsP+EITMz_>2DShHn*9<Zz&>jEsKs0Tlwx6hBYr10WIqgy6nkM
zRdk50&aCF=`qF1S&(3iCM=LU+HHxMt_lM?XO1sbj?X&uUKY=(D|DQ)dMTCrV2>)GH
zq>(<`+p+_Nwah)mNb~3_6-ct1hRa+Wj#DGWd6_>?|3F}vUH<g5s>G;jn3;X@dUrl1
z7h22Iv@Fl~j-`W$EGIivmiTJ?3)j`SclD5-ml7gzWU^9wyX9>~O^~+l7QEsI<rOIq
zZy96)*p&ZRdgxRqXt7cbFI~Bl$nsZOj855qTi5_aHoG|+BaO*gxFJ?am@G4ekC}Gy
zovI)a`u9BpCjotI-@xzXWOdqBtyUa)%O6HFkVQdfbL^Gc68P$3<sY2Kg3JzBZ!GSA
z4uVAhNZT58n1XJXTq~>4>r$3nXfrK*hj@+uA{FxB$z|RY`sl#W>TpZ4<mG}a%HCwk
z!t}|oQA5*sQbeH1FlzMqdCSWCsv2(s;?s&Xnxw-X*GS;b%<!>|Bh+Q`IbM1OQWBo`
zdN(|Q8$%L80F^>O_kT|*ukegQWn?jCkkXn}7+meaQ~QD#wumMr<E_wUt3uYelLsMq
zZtRzn@C~r!mMN{&O;}BCIA`8`Mao3v{_{uyb)pv}r*MiNBN&085@S4=-_DB(Rzt^z
z1z;V!%l>WaRnzESdBuNQ!k;H*ECKxm(3-Ef@R9JmF4l}{l`Fg(ZH!O#@bp3>LC%qL
z`RLpn+IUHrf<d16!EPMU=c+p>BTI+xeH()g%I9KJ+I#^Y-yw*%8wNzN2j}dR!5cx#
zVicd_E<NF&F@VJEHd+Y&ceniOoSK>N+1Jen7)#;vJ5n#v8rM=nx^DJUE%dQOhLOM9
z<xHvJRi0cb6<adlO<c)hi-;dkqc?s6EaB}BOTG8HsX_*L&5#Kp5=nb)7G3RA+U%G6
z6lp{ji*{y4w^bZ{`RG3xt=NSCXj4eRf4dB8!#iU3w<rJeZHD}%UNYIQuLZfinc3(x
z@4eprXuh5uv!&P|0(W6oFLgyagg2uMQ<nK*cYDkXoeLR^tee)C#c!h_z08iC53ZW9
ztzN$KIWU3r{_acHs#onrjLyIp-pw*+`ZQf@m-D#0QVJoD6-Lf=^`NRm+UIi;!4Iy7
zT`TeQbSE!Ow$Z44>`x*Z@Bsh7xBdBaDY;G3A70oWDEXH=_U9q9Lh;@`Z0mE}O%{CR
zcPbb&T7|E)^n9lMT*GYi;8I)db=W~zTtVs9iM8^@Vks>gSEwIZ)GJx?!TpP2Wc$ZO
zugh#E59A+1Se7rZnMEpZ=8|$qahp-Qj@^v3ruX1=(SS+pwrPfdJdD~3K^_=y#&s^~
z!<?NK1%n)Xm*xkKqN%9ee{8>BAAWBqcm{ns*8bp7;kE)q5gO@X9aoVeq$;FQrAkxL
z73LTA;hhM^qO@YUVnAUj;$yCORRJ2?&~z{iA^90Az$AKy{h4V6Te-g^yiIq@Mlhs?
zQW@0C6oaWs&{^nz>FtSR*?d4E<5g_qGFn$O9MdZDues@8qv@}y>W{Zpp)!q_93f@5
zp6CJT>O>oir7=tlGw{M|wjra<ApIfdD92E02R?7CbLSrQ!~>*cd#w5`p%~|RJxMQ`
z{Fqq-J!$Y2XRq@yo{|cS^O-LCB+lPn?{kFzL1!w)tY<(2!!8VLhftJNmC{{jm1JFL
zo?*%eV*UQEkRe3L%<EyGAtlPNca(PPHmW0pGgD-rAAi2f+pFpJZD|fZU!=fN_kvb>
zOeDvpJ%#`O0|wL)2z`=9Mgpmr*spTumAYW(0dT)zZv8sFQ4V>Y8kSKw%~WN10Ds~H
z&L95ylJD|5F)`+p`Yq3XEi+b$5vf3L^Ih8))3cIY0unIPWj-Vl#P<JzcmIgV{Q|!K
zd!({|zk6O$d8octRD31sC7u8}+ueKpi`oJI<0qx`Z>f1PlUyi8C9>XJ7`P&B*_!EY
ztGWR)JK^13FW;w&HA6Z#f5jPrAD#H{tqeiwM=Cb$Nl{~_o&WI9?hC-Xe0~vuyFeQL
z=fYVzgjj7cXbsmotQek(o50u0W#kT^ysRDk+@N=nU16F{yFCHs%)7_DY09nXYOPh7
zvyK}2v!4Qv*meewVV~j$-NE-)8GimWYCZk)m;GS)Cl_~c7gq-_X0RZ|lY&3*3;3fv
zdw_I2Oghar(<_ZN${NF7S9qXPa;G;z`FxB!w7lSh@2f9?dXp-eU=PStxF5dprC0E8
z-8BNH)C!v~ohRC?GxsX_t6#F$DS;+V!shOa9!rvX2`6D9e-TN5<5B3hBpC4xXgUPR
zzjV=?P)hP(q3TbALYU!gk}O|1{@47>pGpWAl-X10Cv*@__r!I)g^r<)4a4DF71kV#
z;({?xX&&Ex5!sw{mJ)(f1ntFY!K>&;KGqd-MkV-xNTCm}7OHEiG*|6YBlV~kSUzS@
znUkHoOcp~P@>dB&74bk_4{2;`{Y;WX&HuXUPt{kevt=zlWiw=cCr9sQrC017>-sEz
zAzp+d9`@qK#YM{ndgns)zf6Ie4nJH$-i`BI(53TG#~Qv`_N5`ieaptb9$#+)Ur7;J
z);3AzeTS<;v`$G$*na+n%B^axWanOHdFLJ`J}S^W>jPkm+T{moKUb9w6W-PT;dJ?Z
z#Rud)8U1^kSmyKAub8MreO}Xl0q=h!Z~zJ@W_i92bZa++zR)|+MCR(bpguuuq9K$0
z;<+9+lH0Z@=S&^fJ;^H86U~^K<$<J_$*Q7Ma;xXfC;M^*y-%LyHQituu<>xRV;iLQ
z*mJ(ju^p%2|59rqk_>GG?CJ*g+f?Xz{f|r6zi`n6{&)6Vg@NU}W{2o`%%>71>6hRM
z8)7c%D{z6!abJ4Hba1n69qLaePHq7kQm5t8HKle_3$!ikY$h(xp+4EIh|^q=JeFTa
zIsM`3{%5xT_q6}ViI6(*q)&4&W|kW;FW<FF$t!+a=JGNQ_=>d&H%b*x$il00sHA<j
z>R3+Xbrcte-`-XyhQB$uQnAP+Eig&LEPrYyIBc)#yFBsdQ2giDEIqtC3i8j;@kgD$
zDnrt)=Pxl2CLY+D7x&x(yAEFABwR>+N`6XaAu#QRqMfhh_*^^2P1w;kn?#1<ooxVt
z0$;flsWn+GnHO(i{0a;|ng6EgJ}3QxIx6A8<JK5U!NdONuIIw;X^%X0iJd6{0D#?N
z>X~1NR-Z4H5x90q#WjpcyZ-HNcSlb8Vpd7IzFX188L^4U(bV7PssB7!77$B)0FT+l
zSQ_TI>5UZLtVzJwu2t+`PM2h1Lu{Q0%bQNz?uydAaew~HS<<d#uy{`bI3g~_tB~oj
zo(J}>t^Ij&%m2c&zb$^f<W?oPv2l#0x$l8~m2PJKYjVgE<0TmVU1@v5dV;FdIQE=m
zV|<h+{V&3pi?xc^8bxa^1}?_!EKZUynF`kNWuUn%@|%vAQN|DFOR#+gjTD!7c~ShC
z&o@D#_fQAZdEm6J9KRH;_)YG6Zf^n+;^YnSQ#&>-jVb4cq}?0+%bGWlFTu`{AEe7J
zhywZnT3J&}<g;RI^KY8#Dqee1m+&WPO07Q_FW@@fEkh_zZ~{@4*mz3B`y%DHC2dAw
z<p%=vFZ?~5(<3F@OxtWwW%%IBUHi9+roKfM<&Av0-f?wR|8Tbm<n<TV<!?>)*W2&h
z0rMm#ZheMdi*uo0^zLjBpI2%^&2L(j4S=itrt~boDD}q^df&ohDOSqLy=5P%tFnui
z)6&)zYC;b}7No88(_-5mhzg`~m7g|<8CHXE4Itm&w4*=a5X<vPCT=5*yXHLSTI`(f
z)$cB^4oK^zjVStJR`U$2hGTkTN0jP2dG+zgj9G6NsdL+7$?e0mE^kQ+0Wd_(wN|jS
z0RY-<8~52@%8{6^A5Ok7CSv*DTvR3lzb+m}15<p&jp6bxBt}%}oOa>srxVmCJZ9;P
z`zYzEh%Zm5qp@uIKm}ZJH_oLuqk($AGo(!4H#+RO+Bzruep<=4U?4No?=I4ae|Lbv
zOw&3cBO9t+5Yrc~h~PO0XCO0m)dEK(iKR)$x0!53+D6~FtTN97n&`@x;}1DKu(ss|
zsq7Z2tC_AU(*os!(@lS4s{Fs;MxnGwJ~X??y$Z+4lNcf^otw!!Y{^Y?1#Z2YnkB&6
zuAcUk+&)3pw9FX8wyO=VqMm2jDpXa&pVmKonKOq0J-n}3{b$_wALqELXIUqj@S`E=
z{-^yi5-Jyw@Z1#5h(`m4Yi0+^Y#(1nOFkoX`AEr7|7Jg<p+SX28eY4R4cq39o*Iyx
z;8u$;*H|1j#8h!To-4}tBUXkhU^)n%kNsyh_+K;we6D~0Ii$c)3d8)!+;SauIHCYv
zdO#D=7xk3fpUj-_+9i9eSA%JFP^vEeD_&Fh0<)T2Co9-453;xz3qBQsiFYZ|o|Z4K
zQ{<m=jxqe^Ix1P>c<pp8hpRCeB~TH4#K9OrK76;Fpn%$pp!wlMB-5BFK`nViiULf0
zYF>`k9>T45Yu~%Ayk1wBx_e{eW46Q+Q*;DY*XYpq_0!9Vf6+Gnu?>MmqE@z+>0H3V
zPW_ysx2kbn8J&Pjr3X=2$;pD+^d=;4B@vTRGn37i&+BpLc|G`K)EueEp{>?D064KR
zl8ZXrW+!(Gx0#v0{j<OJ=c4yH?$^xSGfsJ~HNozoXRw~rsWiCMm!~f@9IFUPkiA?N
z=db*h2L}Nh$8Ns%*fi6&A`*L~7Y8yKMeVor9wt#?U&5gEyUtO`;>F9+y0CLRzf*EY
zH9`4NQPudtj(NuF<9OEhK^?0Uzz<;zPxTOc*7Uw9%imGzyjeDCc6lNwg%?F=Y|Rim
z;?L;q|LOKWdupADaq3IaDs1>b=ir5u!nol6b2w9n>10ZvfQBhQh;?wpJgk0VsT(go
z1g@L;F178MH9MewHzi3jrO}Z(U5Wszj|wbwwPq-LnF=n=JN(voya}?zO;-~)tK=Np
zKFQh~^MI;Uj1F?6T-ZrH_7)#mZsw(*By$bYu4}yWisVu|%qjYmvs}H)m3f+~FdaMB
z6GiAPgZJjcrNP%*+%j(;y6!9yF^b}V^-3~yet&mWZGYFq>!<eUvGURl{`22}_$&uJ
zBl(L+_4ti4t1ngsaGZYL<)k;JjHKZLmz}AY*$^%XdU)lgtVa)Hm>Kz(KJ}XFW<3Q%
zx*p$bf5=NlO$N`!q>g@S0zaTy`zv+-kHdbQ^||Urae*}Q(_Ln$!W!&wy{!1ER5dWY
z+joAVFH$cL)J0lp6>DZil@27DwdqHSg*EoHmeDm&(ya7lcjSj;mC=TqMVhhHa*<Rd
zVcTByn5ew5^58luP&cTkur3PuHjRR6sVAHL<JEtCm^Db4?zQuR4t~uIWw`Q*r`OHX
zPB6MJ%pvTfdbYwqes9pyTW3%-u0VHwh>Z`KL0eY@GHaV>2jd(>AYP4t&-c#V+kc3|
zkC7Akj$b1Jsqkfzh1}Ir#dQd!0HT!R-J%B8_eB(%mL9L$b&0emy-V0Cs!$PJt$FVG
z8o#By<T73o?Pz0wRmh(ttADW8Z>#L(tsfbpqq7q*%=28JDupU#A=Lv_>$Hj#WItEG
zU|15Ukm62u(Wl%8(xCQ!WJf@gQi<V3<W#IWhReg0-@348P#@0TnvzB?NLaMFFqllf
zkdqZlBu|fOeWf2iziTaUsjygqcZr!&%XmT`vA49#*{2}y-}xIz^PD{Zpu8r>okV|^
z?);IB(<?3$TPw3F9WZ(mQ>sCz#qRh1hN=LYt2LfI){t86g+IvEl~s~Kw%nZF<0naU
z?;<m)FtyH~Zl#~?2I}^IIST*no&R}m^+85wNIJJH8<Ab1#JH?Cq(*8y5=PJVtRo>*
znV8CVD`A1$MOY`hWXoA8H9u(4Z{i_k3GGnF2J`)|xlJ}F4*%d0{2Ok(B*appVNoM@
z4%J5tRiXBK=?QPk@%8a_X`a{%$H8d5(sb|W_#xpPG35~z&w6uJd!q{(wEl9`{&{3&
ziTuYs#5YUDg_S-ye`zb{x}+&BLiE<o<~2hyw+W?a+|Vc;1E1|e=JvYW>`P*l!e>VR
zA+})UeIW%RvnH1|ivqtb$4?;f|8n*I%cc420iN>($R8-U_4W-(7sMdDQv0972T^72
zc9f9;lLX(~B(MCGlvku-XS(XC+s=%)pd)~d1nL4uSsU7)rWK)eTMvoq8#v8=J1tH8
za@?}a-D%DRONB?lxl7rIu08jZF=hX!I$PxSUY;spuDjZJ_DtD~^n%d<m?XS!kK_+)
z8|rUQE<Gw%m--DV`2%lBK73M_=ccrl+#~BmM*;LhXlA$~l;_|9NJ$_u?G@WXK97dB
zJtne9JuPA%S}h?a5@#JLaawyTX&>Z;uPZFvN4-1wvTP2sgz{@s`R!2pta`~;)0@S<
zR6zTJyHtIm@IdP@w**=KR^a_T3jUurEYi84PNs|OO!g3h`tYdU#leXAWb}Xhuv<wL
zlI&)S3)9ceseeD2FB9I5iL`nFjd!2W1A<Cm3^&>z=95D9-hg*f>FOwp=|6g6tdtbW
z^m`Po83Ly9(jr<@BSV&@zg?hGS)V(<4m?n?hE1ZLo(lrqQ<h!wMH|^wta)qXKaN<1
z1F$AJ8{U3lXqSlp+H|Ko)Qrl>n1SI5Kl~-Iec9eaZ4Y0>3*Lb*zd>F@%2@zpV3TXz
z6gsa=!B~BU<L=h0(n)d$i$yqFlKY+Bve<P-u{&#LQD3=~2XDJoWYm0OzNn$*@?Bev
zr*8PrH@KYt>^H{v{Q70<gh`YqFwQjUxNV28{ZKluJ{UW_q()C32L?PXW&!&fOY+=T
z$(+Z}y8&m3cDbvpy%Qxl{64E#!Y``2#!toMw?o;2uu2=cX?I@v1?0`6&yCi4NZ90Z
z%U_)|3RV+{C@R4Is}_I}zJ70KoQ4YDTQkWR6O|TTxKLihLD-z;xgl+0Ep3PveQ#M2
z;3{28`%Uj;vHs;LA=5Joq1r=9O<g(57_Rfz-eQNWT`nk=+54*l%UwZW?4xV<MdAuR
zZ;7RZEFD_87F=5>EE7X^z(y~EzFD<Z>CPy~vuNY~ul4`?lka!|^U6yAz>naR02bBH
zd`46rr3lK_uB-a#n>}(J!>rBP^QFHu2&4~W8eXZ%)0+yIRxjwhExWYj6*}zj3i(pY
zcHqh)o?8j#<Rz@(w?<@@_$$Tp$g<R6WI%enIQ&g8POkv*<yw`_TA4m#t5{Gk*QyI&
zir_N2HtToIP!W0VJkJ0P6I1gxeo}^oq27Hf5<k;~H0s_vV-RE7Qhf%fF|6q~?f4Df
zhMZ&TR$?hf)R#nDLEP;Q_M5J5Yp`O~jZYw7H!a?Yb(DpoZSK@-DxLs>GV<_Y_CyiC
zu$s1lOCI!hVavDj#V2WWrpHw5f$H0FXjXaOCHvYY^sQ?-zqx3Z8lI67P(hW2j`CN|
zAs9SS1Tn|sQ45^vVvJqve4Yts!OICO;&2tXlUJr2r3hbEGmbo6Yy}h?sHYt4hw*Wz
zy(7moEg$}(2mB+z%reHixfUZ(P}QZ@FI_aGVA=j@hSIw|hM)poP}Z)T-pimg&+ma0
zRtUPpwoA!izchG1xfOz`5~gCv^BiVp7dT)g88whrtN4xCCd(M%-yLR18<g&UDWQK6
zPubo25vHl0v@VzktPxe7s^61i=krzXht+g3Rp{{f#(5SQ>JvMYdknL&<2jaK3j3Xa
z=mS~7?*c;lEWdmtpLLj3wpA8g9uzq_pi&@5XI**#WUpl#dU;4S@BdshzrPUL3}5Z;
zUJM0<^y0}$T;IK|c>J4eIKEELDuB%vo8!}_S{B&Vn-zSQUykHU4=BjrR($i}$I#%p
zIQN&HX_Mgb#G4CIq9#T~^a7^3Co@onn`miw3qXsYv!1%Z2&BsdLi`cisC0CY&i{!6
zB0PSX<40*F3c0wa(8cI!4mvI0sD4y33ZjBxcm1vi-yw^LsWGK)4e2ih0L}8c62@|q
zi~YC@)1RQSq1;lMK1uUjfKo<N3fS4p#w0wdR47J(GJ>I5n<!tMUWI?x<Rk?ZG&h=P
zx6FL-Fl3i-J~t$?SF?B|Vbqd-KOxEU2esNI4Xa*zhXMnFkp)It514BL%l(-*?bj%S
zt|C1sR`Kw$zB5-ripJUh%H{kkx`&M>xa~opT)!B7)Im3=gUNAIKV{iMzK>1hy!o<@
zLwv_s;o>!~7d7yzQvC^42omT*(N4e}l+xXvTNmsVfc9fMKY{}8_7DlEF(IpplJD!=
z8OxXgJedA>Z5E2ud8)khhNQ9(W0;pdkyq$oE7GEC%Jf&*sj$>!lepAF$Elj#l=lxX
zV)Uzx>-$!^xP<?fQVE#3@+)3*pjs?=pnmZEsE|)e2V?8~S?Mu#J|wiVip&E3TJy7F
zpjfeI*w@tjCz`n_>MEI9rWMQNIgmvrs4)Xr_Luw0G9njgc7MW#XNlS}-TBGxz53$Y
zO*XhMS=S_n3g3JvoKDqJ5r0`<R?@8CTubOi9gx^$xxqPU7`@ztPQ7PaumzBSY1z^s
z;hMT=@nw?6i#LX1+p!x;P2Tsa{nS=1HKjIK6q+)<ZPoXo&>Ix$l8TLUH&MMqjS8#N
zW+MX)oD1km<NBWzyiN0Y{2O*st)Jr5C@FQV`Uh(7{Tn&{b;2Kf%L<6Q**ZkvIDb|)
z9_R?^t(8rZRrkM8&YNm-;qaG;Bkc37VjV+Tgqu{HykXi>;;;ZM^k^8&JA%|BB23JM
z!(RHj4D`*F%b)IJyn3lkH*Vlhe38&ak7`B}@zpa;dhfrP%am{&j(3w@+yTwiZ#Ugs
zN%zuBK~&Q{jk)KDkXF6;`Bgg58AT_G#n{eScFs1-w$v5z-K&|j$lqDHN=0~mt6q8d
zAy*kDh9iCRo`-4-l^^bOWoNQdJ-CRskr9GB&40P@Qz)SHSyt}$xOZj&oYuCq(nQy+
z_pk-120YC&oOyOc!Ym(2u#)-4C9Wco_Ttfco72yiNr69rO*w+LsxO#Kz6+`c7M0bO
z=N6bRbeGjCi5+x+<iK-D&oFws07)mPm2_MbNNEJkojz6%vMp=)WXDVAS7SG08&ke@
zEiDL8T?7Mc9TA}3><6cDpf30a=EE7jr9nW#U@+#8Kh**dneO?~i?FCj^<D%W&zw2d
z&ZZBx5WUOfBy})zEVB0r+C{+_Y2S=p<{Z3s&ymJr3#2Tz4!$4;Ll4b${c>Nnk~AI>
z-z%<ua*xZa?(Y^>#TB4*u2Gk>HNf33WX)x4Pj|gJJDC}9NNp2v;V=<-$<rN^6W5>d
z&ba2J4On5B?nr=j<79$#Sb=rb$>VnqLepv}OFo^DnbK%ohA2hC45>lYyOlB+AO%kM
zJY7mfqD(f;en9`8Et5Pbpl_wWCTa;EbUxd85IA_O>k{cR;D|V9D{j~{wKl3eOcykC
zJB>2wO-NE}agd5I^8C;a>=wU8K_X>UwsQoXCZJFia@KXs>1|<BI3PURs*t^%bXcOT
zE`kC$xw2XP+h-_xFOJRXna3s=8jBk+-1Y)FLEw<NjxH;$`}a&%Fmu$;8eP5{<+1~}
z-N*VQW?(t1a45O>y-vZ|xw9)&HMrokpaktxg|Wub#5eh4E@^bFhOTIanwX8bB)QF#
zDchNMtu+#xcX{DEn`~Zesh;yrduvpIRA30N9b(B_Lk7nSaG~){!dR0CQ5kOTV)t)+
z|3z8tZ1ARyQxoy3UFr*IMQ&iF&fi9fvmc9p+2o_8G{Tn6Ed$aN2Hz7urB1$;Ym!5J
z)ju#M$Bm>ac&B>#bTcC_G9CZ!&RInmuEIjg4EGe{I}a5g>#j+Og<ky$$bM-WW@9hY
z%1=QLsY<jaI1j^GQOTua+`~DlDy4|RCL62Bv4MF_cE9h89)Sj&y$6T<N*!0M11iQ@
z=wXxqM|Qq;#j8Udp?_{D!^Q^FQ9l=J7pWnWxm~xiuG&HrlhMBw6a30$l?)Y9zr{dZ
zil_#^3i)U^>5Pha@^gA_B5nKT*Xdzt?EY-d08G-hp>a#_4U84Cw;M87A_^v@wE(^D
zn04yCLlx5My*+5mnvTM+qYW5=%s{E2;`=RGD|iylt_H6@%C(e#eAk**hDe<(DsIxQ
zJ?Tno%^;N|^H?;#<=ykpfU^PJX_=o<ym<q(^{FxzacqJL&P~(<{VZ(+{xx>hYvfcX
zSg;Q+<hCK=SG%)!uLZKtr`z>-;g|5ZyQJJDrK}_a&@T}2A%s33BwYbYYsgLd`pDD*
z>Z8KEY4hXrY~3@}+LH#sIBFGu*1xmrf4y~F<5`A#9gWida;jyM(=t4Xl?|(DTY%uv
zx%<PrJ_8sVTa-29ek&Y!$Lh4awFh-99ht7X)qsYHNIFe)!mX&hH@ZI0D?h{6Ik{wo
z)?~Digg|G?$?{~dYVfMx>6@M~%fvmkhn)<qxW*U)(W%|%t3Jp6PP0r3*C7uBZ9(eC
zAgoI5Vxd7xO9XFb@Ch6!iD?^>pkpAo#KtF5=Vy^``gg$0FG2=5WKYi)TOP??^lS{u
z1GAgX1nXdH=SRW=!l9s@aO;O2f%-3OROI&N7m+X&|8*w4U4Tc*?sQV#;0|Pxa$T+_
zn_*D%_h>it^PV!jr83SdkePT^YI9Y*E1*)$11Q<=G-B;Lztu9mrk)-)<#X|_bzYg9
zrcZ3C)~O@FCzvxY{UNRAYX9&+Rp)V!mU>{OYhMPwrTdVoSpQSbnHXuv_EfX|{f$mD
z@&NfJogaI?Xp*5jIAdM{KE!<C$BTDC83kM=4e~M^jfZ)*tqu})WYc~dQBDJEE7$$R
z1JBpg2XpDpwh_k;wL<jm{^v8WyqgrLjI$Z&v60y633J@`L0mMT{PKHpvXnHZXk~0W
z6%`939aNJ5>atb1d2Xe&fJNf3O^m(r*kwzzr>L3sOXB~fV{u*}6J%D1CI&X}k{#}8
zBL=qTDKtBt_BE*8I7%C&mMBDvt$f)56g6yYz6<@-A+&ywWY<!!0WoQ2@o+N?KwmeD
zk^D>;5`pFmZHQ9^0YZXs&cSp*O)CJwja$wo-YX+P(K<gr0qFUyClo5w<0?r=ajw%g
zfQgBC{eut3+V=7K)*XvfxR2QEEc4*W3oUhu=yg|{+LdU7`K{%{R)Bd+P9m}QiRH;m
z|8d@q9TqOmvB!FBu*=6)-hU`4acBSf|MDaPDxzeP`lXpq454yy!)*GQmrMTSGd+IG
zk4NSqV7f;n?MtqFNxQghS}Z==f3`HeDy0>V6*I3z;_@KT*;L@^V&b~3aon#Irs)`~
zw4saPaTSpmFazEwsaU%CkvTdd*?O6NZrt)(Fu*|LCyspEdf8_?9Ve9TDx!0Ss+-#!
zRKJ0iJoF@o^qn0SIFC;5nb)uH9oE#GpITlJ`E1u10hDdUmN`^9?bhb8uGms>MC|O~
zM0%zro>72|0%XS3u8q6$NM-&$@h#OPJ%`+#9ob`676bcHt^=M-o<5Chz`nKG6Df$z
zJt!ZO&x6cvpW!7cKtz73-l<^L77A{WaHN84BhR2SUR+T#UO!ZKpM@tV*Bj^<njh|r
z<&Xw7zk@zVn;9WNkF2b|8&orJ-=B8hW?oxz$2JsN2=)lMo@7V6c8HEc(sm}e_<{g_
zw<z7VKY_$f*kzN(o1%QVOSNGXG2+}A5{8{~t)$aj?FGAlG(BWanlwVe0}_kF1c<|V
z8hdV-OsrWFpcs6g6`o>j`B31lj9YopPxvK#*`x8!<(w@ASH8JoQHP_3lu$2GFG-Tu
zNDiS3KBpI?md*P~cbw=mq$~GVoPPXo-ttv3qrb6U0d!=D!K@hRc>-{JHip4^MBX;J
zxUPv<MJa9AE5eG%{yg1WnR`Zr;j`cKc`A~;WSAN5^LQZPl^lEhs8xyx&S-%Q_F}QU
z_b}>6@yG%a`@TDQ>b?`<QK|+y%;g;q&w^JNB&5PxLJ>K##KB||TO{H2eisejS`=4h
zoaUAkBKRs^U@LcKTJ$#@sAE2iWd*vP?96@iiP4K?)NrYhy<!qZB@iXpCuUMJzCvtU
z_EiI;<?fF3J#An4`MjA^<y8;!ce0t|%|vs{EtlOff@otstGV`A&rq4pQ#h8~YTC1*
zwK;@A2k+s-%)#Dn^lQiSl{dm0b%^tkw7K((CJHpZG4o{qG4dPlV&%ftTy!}*{k>bY
zo|KtpX|)C?V-)Bc^;_k7aW2w+7rwK_Gl_Ob;>+QD@9rTYJ0k_%Nf9{Yg*jEErQPeK
zugk-AXyIeX+;9?@L&Ekv<LeBu&(Avh)E2%qU_bh3H=#Ba!9xz*Qd`+Bm1RzJe1|Jq
z<cv1w(9+%bhyC9TFxcNsel5l-dO!uxmiW1;xhWI-l1s&c?0M~mr1QE^{nB@o(<c_&
zYvW`+hAks?u|sC4r~~c4#op!d*lhYwo+aKBX!|qvjuMNwp9G|_$lW_*VB(Vai7Q<U
z$>IsN-|xPRYqH73>~;_Ynix>Al<#~w%X_JOTmBYu;)|eX$M=ucNqS20zO!hUG;Z~L
zaqVK(ckbQsMVk997r&jpUG>i68CMklTp&gJls!V|)OBM8=JROF;*7C-<Y<|@vX8#$
z6wnGI+4<hf-WLD)$*cuNWylhyM|x0S|5Gl#86PQwN4M*XHam(z$vaiyz1`X4ayEQw
z;=!*#>GYx*fW!b*(`ATH|D*{gcGiUR8Y>UBcE+|$Y&en|N5RE)PL`;y3#aG639(<S
zqCEp!>m3mZ?hjlkcK{GfNHF!aO|VZq=Qsi_&7~ahIhAPYbaqo}g=D`+6#7WSH2Y+K
zYszEhhSU3g`iGw7btYrwA9LM(gv9QKpyhZL3@ve*^PPYkd(_yMGxM^P(D~a^ZR{#G
z#mM&N5m4&lzjG6jckluFUYicYD#j|wDs?q&K*UTiYM+$$KxIBRW*PdRv$jgbx;#8W
zwlnlGIG56XtEYJ}4)-7<QNX$|d^Dqi?Ja*8Jo%G|#|>wcP+r@~i|6yayI!<@D)2DW
z!F%o-GLeH8yz&y;3xm`^EO|J|N<}5yc6lbzI$Jt&9N)z`G@(Y0*aCNfJJz5Oz}L7M
zun0&qSy*-kvVlSg-?(_i`HU0}#d$KN>-5PLZ*k-Hk+uPqPt7a)Mg$u_DV`tIy3%t%
z>-@&$R^oH-0ixwv=CYopXu`-h_!DPm^fKy_6VjW|?{g+2wYCS2yH-GL%;^Wt3x-?U
zP3IyR@E_Zm5=z`&@VlscRqcQdX!-!JI>Y0K=p+?-#U4FXRU84PJQQD>2@r&ky){Q*
zHBYvQkX-gM7uQ>&8;_o$z>J@lYko{$4<udSYb_^TK*N4HE{iH`F_xEC_&mE;Y82AU
z*tE}3kJdaxKQI$r&;`Bs!*Z^)QQ2%I81IBp_wb?kqd!o47@k|om|PV%+lwlNjR&pc
zto|1o^HY*_3{&Ce0**S`rK?s2)xgdG<LML?Df9wqj=6q!g4NHIg>mInNEBTJJ^5@r
zt>ZVJpdkJ^<?9^-@)t|*Wt7R;oUEIxc5NTu))*M$mJ+h(W*B@6-=7_7uG0NQ4CK*0
z9Coz#wHdGDxZK7RI9n6mEQ#~=IJ%j>B)$zHV!0dIY+%=DHrY7JBZ*s;?L;Y0){L8s
zz8$-TzAJazYom8`pw#3kmGL7KQ8s@cwNxQ`&18|Fsp<!MtFg#YSEA{?O{v#17pu{m
zsA{dL6<87O$!E>1du;rax2(|HK2F5I#^RahQv91|=++iXnD1TC=}8WG?hgkzFV^hm
zp|YhLni@SWb)0S6!oZ$Ue0wkzSzcRo5^%P4BZ9lebJb&;qXI4rx9No+Z#9_!nt^M^
zwZTkTM-%q2+IL4wJHRX_lrqA1V-W0nD0e#+&70xdN3<t0Wm?a_GP(bWYC|AQFo7z9
z@4KOQ%F<v;_peZb*m9s?%UdFz36^|X{$)cGT+2scWU0NoxZ^!2&ZYROG)#2HJH+!s
zcH*W=A7_4QT~&l9uvA8wVcF%HL1zbX{H`&2gOZZiT+}Ki#mMlj<KIFKW~7&eo)vSg
z!3K253cdpl-9EPs%3_eNMdkfYQ4JeMioaF5<ZTU@vr*)S7}~a1sb!C@IzIMfyIv7l
zkV)?kTCw2|woZo>qK!`Xg>N}-wBS!{EIIQv?HGz(Y!0^cv!~M_?>SC>w{LKmLtOYu
z985!x2jB@`C!OAm`NH0{9QvLG&CHWX;CjwJ)E1FQY;{bVz&JRJ{HA`c<;uYz2am-L
z+j3g?5KeX~3&AJYSu?(PRjkgoZ%f?nRqYj+t3Kr8B&W%IEf>w1ByQ~(0Cow{u^ef$
zfC1(L_i|?Jc};SXkJh_wcMc1MvFX%-eTH*Q-V(ACv%|a|Q-kb0PjF|Bt#^_#lib&m
zuGVC?f+-}0cXoGrN5R#mN1r)En|^Fpp*R%mN*dQ^=D`B#47l<IhL&8NDRMD1B>QB(
znkv(WEmOJ)s#p97fVC=?dq)#*U`~B<Iw;t?hGP5Jlh_^|K*I0ACAH7RC&kbw30EJp
zMaZ^DGpBu&4Q^ZU6q@uv|5O@Y1i7?@I`sl^5ZRbVoDg86X_Jr=`HbpmmfG-ze3&0`
z<M9ukO^;bb3+A5Vho`TiyVoed4@0IP=P&0@w9thAkG=PdYHDq}f0d02TNDAMC`F}r
zB3&>bRXRxT0@9^~4pKx#I*9ZdrHV9>-a#M;q4(Yb2?6On1UM`1s?T$H-!aZP<NxJ+
z+Szf8gd}U-_jO;_oWF@X*xaw4?>lg&I<E^Wz6~$@EMK|1c7D^@+h#J>=XuR(rxxd*
zirBxWjW8p;)&|keU0Lg}r3fs&R8ls!|8ABw-leI>zH1$UR-t{UyH^JQm5VbZ9^#~G
zEb<nOir)eW?zh>i514L|c*kBSy+&B5$K!M3?xj`l^9MYfdb@m)9%0}K@9TjZ@K@{+
zAf)^?m<n{;zv|no$a1&a1NBZgFVSpk{LSZ7swpF`tALlNbgwS*lnGb%3M^W6J*^)r
zUp;oa&dl_zYo|Yjg#JwcTxC{T0`r*t3ct0ZJrBx6s~&CSU#n`p@XZ*JMT5N=Z2VO1
z(VBp71;e|rEjPu>#mI^SF?=cjN2P>+A8}MK?2Db8eT4tIeecU<t{O1S1Ky2I*>QIB
zE>UXq#z3T))^Vby?PCS8ONoNkldN5#hs*pCPD{gfwH`3XmB>l)Q6z=akW(fq3`&o`
zWCQEz1bR#{G<~4^eiqvL(LTT2S2U7O0KF2CC9SAt4U@6ehX4tH2YGm@OKY>A>$;14
zHwuv+?wBWXD)gbp{$Z(7E6ifqHU*UL*lp~Yd>Eu#9sSA!DeutQ78`0*dLua!6c6GW
z|3s4<@EQ;Ve<bRclHjAFd&%z386$96gXl7>&6Hub|Hr&H5R|WVJUR2|SVGH>I)m_b
zi}%(Vy`2%g@G{9O))uJ12<a;-%L+q&Pyz@U&gCB`)=X<y<^kvd!?^HLH+^O%OYW#v
z<WP#vU@yPP%}!zxJsu?MinXgKUT-)mNA~3FN$X*RztzgLJefbN(pCCqo^OP(G%BD*
z3)==YEubtdHU%+RP8r*lZn+<S?Qa^Uiqrp4llB|v^4?@~=hMali%k>dxA1dB#ad?7
z2<^u(xku+)jQ$!glLhv{_zKIhT|<`na~R+A6hSp_u6XT)v6Pnk%2GME<0f=V_wixK
z_2+IgY0gMFe)lhKsXgzsZGPUo04*^cUh5Smt3;d_#TGcK{~;PSB=zBE>5HwA(x;_W
zpEszD71s}93Hla>(55zf`6wBrco*dA0?N*Nu%g~0@P-UG8~C~!UwCWUZ@d1@YZJg-
z#S>2r%(wgtC7(PysYh{aoF|@{aRpNu<^ELT{HS+MwhaClO<$AvWi;(HZEugy8x{EJ
zx-~jl=k^l2u&0aE>lY+>3LSj&_nd>&xLV1YDNjU=WYtxP2SkT*RET!BQB9}%G_vh5
zo{0qU7h-g$$Zc)OhFj$-erx)N%nfD3-$c2lAN5QD%8OoCf`g;_74O2@$3GX%=gAIe
zNZy_V#U=8=JY?M$R3@_2U>4S40$xlMHyND=b2tk$lX75H3f$pc?`RdM@5bAZ$oiy;
zrJzhWdYHRnD9f^{WVEYZ$Qw(SzOAkNotKFuURW>1yQRHNqCHpzp+^8N%Z=V=T)W3i
zHvmUodr>B^wh$F5N?C7kTUptU(wXp4r}Sv+O_JBami11(6~N>v>=1wF!OHp(=+t@f
z#;-z_#&v&jwMYqVsrT~|whIxIp;~futEAB<-xB77<}Nr>BKq0d@AxNzoZf$6V>at(
zOR(WJ*2^=ERp0Dv<-62i<IG(m-=uLlhro`h7glQZyP5naiGyqA7i4|6SSZ|0w*s@e
z(iv%amGynM9M$55V8yld7}7AHqYis!_*y*c<HS1_4p45WXj;5A9+PSSFuBMRFNXho
zOvFin)CsPaWgDEvsD_faw<h2l@5sWOkE6k$mUIXkx!9&v&SX}Ayg@|ayOZ3*Pr=Ia
zx73xL9CHQCT6)_eAvs*z3NkMzS+ZNL?*%7hemz)(x9a}>O@&B?%f^aii>xi+1$%}H
z82R~XSPfDYDiA;XNE8&NS+E}8A$`wql;gl{P9-hg9<P95cKt}}<u>21zd4Wp-rd{B
zQQk|DLFG$PTMEqKh4(n4Ayj%fe2Qz7;L^uZCSe|>O2J=aG0dRBqRu>_wS~Ai`4rRK
zfDefs+D@4=o3AeN``0kF%ii&x+(i2)<OL4i<)aWQ7UhBb7}CS6*mJh#95j9CSZ}qT
zE!(<X@a~AR$PdOZA8%f;^krygWQj|Mt8;$t4(QOetq4Rqzyz^xd3=q8LNodQGr2Ut
z$4zVFVKRv~xT$W0X>rW;<+`e15YfyUi5$@c=H)NC&d@LQlKRgd<>U0Q-O58^?8^$q
zi)zltvA*{nq+m$RtIS9pNnEU*7r%1*()>n}+^(VFp3>R8<yBgx@d`2otTQ+WXV?`}
zy?j6dd6)4FeT#S~e#m;6^&>wHrd2>SkzVg&I0@+Kh}bEtAYXVX?q~xZz2F*B6SSG=
z$8(Uz;{WGj={c;lec6sIpMpT1Y3c_*EkIOvepM5b=c4_STH0ykRUa&<^*XnSPJnJq
z7$tJfET!6$wyQ}c--#@vDts_<;4$ag*)o7AKnC#HMaep*Y)2(EQ{2cpAw%KxshuA4
zE;=L2sZUExKtYdvm8r&xP|71#H6L7Dx~WjgsC<E8a(;k%o-a^DHAYZCJ=w#sWx+XE
z&Dir+As}LIvN}V-0VqlV4h4c&E>PM}S|xTaevi#KQ9P8)q~cx>gXg^%ORnHXmN~W#
z1H}L|yO!DG!m4NrGw|VtW?m17q(kn(;#1!eK!)PTaF$o&Ps0IQ!58(N9=6>+T@bn=
zz-W_R;+g%j?Ix+^cHldq&QwU3+MO42wXFcVqLcve`+@DcS_4^)cH8BMe1e;Iha=U`
z)@@Pv%j~uxcT`-4B8J7XTDKgRas~&oFky^lw*@(k$oR4|53Hjfr589o`aYyE!!XSj
zPcE6#Vp!H5+^C;dZ^LH*T;o!o&iH}+$qBC;vyG%-n3Gs;S_Pt^pb9>98#UP^cAqfc
zc81c9s7tI5xd!LWD(vf{<Kx@sm?_*1ceYboi}jOalUuEeIYMfa6rgU5EZ)0=ktVGB
zkAPwD?`K`>KRgI|vVKxI-xZHbrZG!-28?EXRZ)-dc+xqV&b<#8i`339S0xKQ*D1~6
z?%k5hQne7;6%(0au*D8V^2!Pa)6)$b_{{T(T{wF6pL_8?&+y6O^vkq3n^}*{N<8hY
zIX*#J@;f)oi0<gfB!lqviOy@Ag0`1<bM$M2GQuNU2~CY6DcvaYE}D7zJkW5-5p97)
z(dFR;JS>f8+UEcjmpg$V&Ox`D>zAHbuI+=a>Ng%}M&T7$eG3#)NWL`x?hc+Ag9Npf
zXlN^+N<b-l0*J7+gH<O<A#5uu5F27n^kbxrKYG^X;7W=cAq!8W`^g_IaM>#O@abAt
zPmXDXX6xNs-2;@;lZlFsYZ;tP0s`tpp{+%iA=(n4Z7R!%aZ<l+Pdx)7_B^@#<>+X)
ztFq~(HqMsHM!arzhW?Fw1BwGT;?VrRY|2u2z;QNK_|J|`<EZ@m$9|n<vgpXkKE5pJ
zuM&33((l7rBiyov*^Y0B*@by5Bbql*<E#h*Sk+1HE}KA+l4$%^e1u<6{nMKo4^v86
zLs(hu@bzFC=b)qrW{Ni|c36(LV7pexrNIMfW1~QUiOe#AVToFAyl|CmtBLB{{!Ong
zxi@J(Z~v(T-#EI<)6Ni$t*0GTvHejEZak-dQT{F9B>13%kq$#2w-R|Uh~nbZ+`b-p
z(oVVA(M)M)oo1EVubkUM2_EWMk#fIh3SbX+H6_hh6Edr;-_|faeqB$V-MT5BaNU-$
zF81<mrk)R%qMVdyUq7*NWQ~K^K-#&DU9waFI{6QkcF9igd%H81ARhm?KV;gZR%nI5
z81YbIPIU?&>x}-#Rng2N!oiZwEk6vvGFOnGLZP9^!goeVBd{V5q%Ezd!W&*eCe>^7
zsuYAgO2}?J1{U5+#`Wi%5ItrI&97L%bdhU(baZhe_O5^!ukhRe-QSMGzmI-@KUik!
zHQ(tukg7TfVG4~)S}8KW>8Q(maqB%L*)`nkf?Ye2@f^FBDfjj$UN|eW9r>S=3mcX=
zNN{7&H_oAvTBhCO$5oGd&e$jcc`0CtRRUyxLzIUi@~8RQe&(D@xv>~_TZK2hNw=Cv
zt+F`sD2b!RsGTp!+97+H;zSPl0(EvZ>8s@trP~;4djDLoX_3>Mw$jj@LOmbTv+X_v
z{$9YTHjXCO&xUhor>7PS*~!Y?s`V5J{v>2R9vk{HKUi`0E>%27<c9*&PIZn$20U9@
zL`#Xs);(pqriw4V^%v*2Fva?MW?g`j1n(>{sK3^=w_sg$oMTG<G}EGP*SRlVz*#rm
zWonc|C#&((CH0pb;1a$#X31~n5Ym@aa0E+46tTLf9nyrLC3bhqo0Y{^)d=&qV45I#
z{ilohZ*AU>2d+OvB8Nfi1jo^}oXgNwOi1)e2$F3|bARb(ERXB_rQEUWX7}QOBDW_%
zP3poDZ@gjs7jL4bIL}EE-wOnEo*y6T@1l93q2)laV-h~d-MMjw@Ao{JRhqc%PFpvy
zw-kN3%BMxxA{si5&V}FaYsM$6@**&;Tyid=W@eS<i}&?ywFhL=RzzZURH0f|Z5DP(
zq9z_2^W*5E|0%})^BMn7_`d8ZViW&oWYfkK^E&l;6#m*EYPt_E&pl42<mwur<_tUR
zAV~&%a}80Lh0kY7;s7&LA6*~6i27+J_$IrpjO3y+UBh^>F3&|L`f~%DM1UEV(LCk#
z^;we}kpyAJtsA^t{_z6Ykg`RGLa^DD5$^9>*<oj>2LZ_<84E3yf7}>wlU5EJ_{GMB
zp0L3u%uTt^lNwejlrGMJ7`t2b2}=WlUV3y2`L=?Xf=a2H8A#P-Da@+JOTfEl?H5d{
z(c-`m1K=C6W|`e1ZgK@on7Z^{Y)r>xy?F;LtvdEE6T_h8Qo3bm-a=rS(tSF#Han`A
z4O&}3NEmb<Es#7J8Wb{Xan`PTvl35tM8bPk#jp5Y;QWppI;yk^rgL0U3AWDbR~d>g
zzuEjdOx#|v5!mt|h1jOxDCq0b%{$-O1O%d0xI@eUr^K~nW1yG_q?0s&ZKVLc$mjIC
zW|e1tYe~$iqW99(j@8DkEzv(2SgRb_Zx}=eNwW+`7-4s+R^H9tGGvU>zWi7ev=FDG
z$N>m7h}>a8YA2(LuKMcGsxvAh;O2-EZ;c`W;7~qJbY#0dz|T`3Qr@9Q#a<%+P=`2^
zA<ULkZb3GowYoJ_xCNr73MtkleH+}wO&?*{=;`B4(6peH>fP4?*O~gUg8l;M_-Ppc
zR#2Q(;`)`6ft?<U<%|zVjO}*;*NxAV^Bk~Lxr0T?gw{41Xp64DDbcwEB&lS++XX~?
zl&o<3Lwz9W7_jS5ef|2q=AYu{-*Xt;V{sb%Oid>`#BNWe4EjsH=B;P!yCeN(sNaM<
zA1V4yZQ6#ll(NR$D!wk&V!qFf@Fa3hU~eF2rrXw#eE9`%w+@d36p*uj6vke?AGKBo
zW~t1oSX8B*;h^K;Iq(BMUtq*WV#Uv_A_J-;hyc!dAi(a@pRm=>{6=Bd8KN`qM6K+}
z*HDOCi=UnGivW8nu2y|}Lh0=G381JOW7r~rEo~<nJvSK70;h?75&B*snVrISbA>Vp
zxQ^4S5l?C3Ml!mxZieO6&r{O-8J$w#WsnTu6pK+hhi6oe;+Ow)%5r4mbnIuJ$TnXJ
zQ+Wop1`S0R6V~I!pa5^NKb5vpfgJJM%e`gG2yLIOamDv=vZdhyeU=l|<*lCiOaFbz
z^atTiOaE_+rU5MXlP~Q|#M@mJPjsI4F@D_{=+TLlsIW%_Rw2{46@?cEHQU%zcNg+g
z1|In>Y7P?(HeT}=obays+*2R;`T~U>hs!$1_5f}iXTxAv)6&h`gZ&dVlkuuCzhsYy
zw`(#(julI$Bnlz(lNA}(_Zx`dn#2Bdi39Ny=Kw6MD1e1!u|-4g%lXGDG*cU5m~98{
z=c>?6#Q=L&v2MSfwcwbv!tJkluT6J@v%-zjIU#I~se!N@;TG$w?y%VZauz%|;;Z-9
zHh`3U-sU=bJ@&kt$|9-w`KT$Jra4Z3l@fL<G8~!ltp1RkAla_mP{(e!OjbCr^k%!R
zxtHb$E_(u*>h9l9$)BBOlf-j^PsU&zNm~+-o3859(JmWEVeBEGcyE)gc_CUwH^jk?
zelgW6i99C~H;A7LpdeOP+0Jq4<2rGC1}XdvS9rZI!yh)X%;?P<nKt<p0##qhuYn}&
zsSH#I*fnokB%1H>Ou6vBUYoL1+Sj#6ESRHC`?&~U>Rlvw|4@E~8h5j54YMD|*8FYu
z6@6l^YX09&u)mT2ae|HX%1IeiS4Ilz&sY-3N;IhJJGGlPQ#*H)b%R$<$3!kW)`a9;
z;SM5udC}dS!2ZfjgUi?T3_?qVq(iXcm#<qxSd}61rkoF7=|d{!N%8Or<=*;D3-61h
zK6hG7Nq)_+px;xno~B!3Q84CUe|4e8*^-VzaLU7V(q&+1bA&7+3}9)B{zwtgAUAqi
zd@!;q*ebfsam}#C%}zke4fxW#ZSx+WGovry1%??bRnCW8Hk)Opv!tj=5<7Nz!gt&u
zQF}070*F*ASZbU17yXJKcM79KSG(6Is}vMPAw@dAhc{lK))U96jeoc}{QHz<!v&4P
zT}Q^OT;i>H#l+6(o3#3Zb_WM!X6o}Y>4G*JIDT1F{Gr0Q<+epaZ;`T3O#kB#n{&ZV
zQauowG3GtOg_lqJvYqrPiHWrW<48l82EmiZp&F%~%{s!erk|a%=WGmvn-`v@D9nFe
zc5c%M9qkzI2;nBizz?Kf7#2|1I08D^wu+gnxnR-s<tqS-9{}i@4UJ^9Nr46wOIpq2
z)95a9*6MU7M@V}h(ad=W8@_kW?Jk*;GsgL(WV_#~*6WYlu-n<T?>-*MO{2?O$wgXT
zoOf@%2`F1f44kc>RilS>9j8uT(9fSN_-!;jHybhB4_+y(5zSUIb!-?K?iNX+YB<5L
zr$66c1MM4Zx0a0<#l^$A%Unk$gt8MYswn}gTK8tJ<o;rDRrKxp;qhA*B-oOki;IWr
zwZ~fd71K<**fg`fDznxb+M$R@5z)4a^0ocx=ga{7cZvbuJ=`5o0*$njVOw!6QW<*x
zOKS}x!^WrDpncKpHg@g?9tlP_Vu#W`2U85%BFv;YQ07#`J`{+RVQB-chjN2Mg^>x&
z*-#UhxB;>xp$A@t0>*6ASm_fY-=kGQXVJFJ{OA_cbX`sefcodKuUUn8tPaJ`7gQKU
z#%deUANOuRK@;DdktYO~i<^IL)6Sw~-Vf6C-OMtM!&v4zr0e4TqwmzoRU8DPG+R)s
z-BAG`Pnd%naBqycPwVV}hYeB)(;*GO9g|y!28(X~SG;5Ff5$sMTOAZdy6r`g1b_9g
zQdbt%Bv+eJFa-vRN8NtW9}j0fC2t29doBhXtktZ~k6EUL1(56IOFyifPPxoA${c(t
zugyH(@ET6YI<8q`djFGYpwQ|dB7NX>>K0dtumzO8Tlgr3<Guklvczn~&MkuM)J+4s
zA-Py&P~_t4n4_G!?d6q4Q-%GsHKc7!Is>4Y@7J5;E{!?Q*Pa;FF$L4OO+K)%JlXP?
z3$Qf%l$#x#>OReW@hVnm8sLSEdWWtew&2`h+Qy!sIDOx&(I>Bzw(r~5?P3!6R%3h-
zyV~=`ZEW*$`YUg`3M!_rk!7bsrrzEDaq#trzB~tgAUNY>m|wFd1KG0W&gl_9c96@$
zyt!ph?vO+0WaxN8b$H1~Wc`b~=;_x1&_c4q7V!cy$#%MO_A9TM6{cynXrNg9`I@UL
zrndH8Vf7YW@z>w;U~d{GIh2JDxeqDRRx4&W3+s?yc62d{j*9ru3G5p{wGM4VsEEd#
z)@(@IY&SQJyJD|%82ow><lO1qxi#KTXImx*v^nKU6;J%%?Y6nJMKZB=T_;H_-nyHE
zZ-i|z>ug<$_jTgAq;79&yQ_ssumJ@Mb(t&jTWMcLDPz7$h20+4V{vCR2XW9g2X=HB
zhH4p9sd^_M`<R$PleyY2Z;oMD4KKt19<SB|OKQjl@E0@rmyPW|54|nKHJ`|UZ`Si*
zU*q;|7u)*{6)CC?-R5ztw^T$oA9+W)B|yL%ygi~(?n`%vO@jzeu_%6!Rd0@`Pjet~
zPuoKxI`A|6DF0o0QAf+#Jx_9D(?pNeviSK!6trC!d~(oSx$w?;yKsrl4|_*hcyZL@
zFblO!DXa83lrnDt3$9nd<Mk{qAMUzZt#Zki6zaXD#tV9&vO|G8u2F{L9}pq7Ee{v9
zX+LyaL02%XRd1JL6Ze`ft!L2y->^m<JG2a6>~Mh|#6nZGy*pyuR?>6Ae4s=KMja9@
z1e$m=xh)T}0)G_R<EX)5ajJn#X^{7TW3fU6sl<JYQLBM}Yezj2_1|t#OUd`>IyuD4
z6V?ahBzk&mepkyd?Bnd(Lz%bX5AU)LF-UyAaPE!qJf~0Vr>=w;h}&|%MFe?#l5o8D
z4kLlBT8sRm1z02^w@0W={Lxe8u9SG4g1r15Q6#&A%{Yu1@72XCiZxcxk=rkXWj^rX
z>$;8l9xl#$YczkiuHdpW;s`8Oa0jY^keq%otU{h3>N+~WF{o`j(^xJJLdzqo?tQ$g
z4SM=bFys5TfN8X}Lr`f}-67I;Xw7?@i!zj}{3)r=VU?0}SmD)SzHvQwrH?hZLT4kI
zv=Y#DnT|~D$wA?f{CRLVm*C-$mhRwUpgy4ZfY`HJJ%T*#t&n_!A0O6ZdLkPcAGUS3
zCpSBdseIgq`3mX?AKgIl>sGZHDn4-4gijtYAGx>OKu7jJSd^5Fy~@g|UUPky__EWZ
zO6dWdrN{EBS-%q6?2}5^7AVjyH<?sh-xxe(X;dDEZ*oyimHe)bG=Cr^c}`}Mq%ko)
zo%4`#*Rz(-Ji*nS08kQKmZ)&`!804AH(qDumI4tH><?VgLkE_x2FBhJR9?>E^#`u9
zIg4{~y4emKpJ(qLetUC)VwsG)0qcD~X-;e?;e)j$Xxrw(oR{+#$?yzjTJMc%8)g1c
zMp3o~=CJ_L6%J<>pZXr2=FY<u6R8Lw5=5Z;{<Z_iWvMrTfkqP2=r1b}$|+)3P!s0-
zL!IesgO}2D0%%KNNw#*XoLvr29GOJgHXRkOmao?bYPH?6-Z*TFm{k~X(D{}80CT`o
z0<unSfOceF>+`igeqv57=EY=2P(=z^R4B}MmT$=Hq4YsMSroOIL){f~_fAsrK{|to
zr(y)MYg-1G$kl1Engf}i==m4aNq%<(;5ZCYm71cVjeIH>%B*0es*4NCwKyx%0V7c!
zxc<%Z(Kmv(5q>ZgXZxx{49*NQa5(_keeU4$12{)Xn>^Zk<`P|{;1Rj*(@l?sxg$hY
zd|IB-{`7<x5<t{?PfE%aPN#f-qW^3&%WSJXr*j}jk(*`Qy+Km;Th8Q+_qHp!V~tCn
zWw^|EgY#f3pdZxoffX9oz`Rx*QX*@YhHU$93!3u4E^o^pVe*Ph-(9D-b(u;+{WuI_
zuj8-PAI*R!o;hdt46`~38;!U7A%qbWh(MEQ6}7|3u852E8@l&VDbA?v@x<XO=lD^d
z$lpw}6D{p-hf4m^S@e~`(P0LhBg0N~mop`V?(OzH?bB|D(|{<I%4`S<vsiI9CN7+f
zDcd6Aj<By`Pz`BFV$r;f0+tg6)RwinN~W4nKp@Q=%~CKvnW#Rjk-v_hI^W${x79IM
ztn5Wa0`RS!()VZlnC)xlKDi**1`Zh|zK{AmsM9GZEvm=d14v#434SL5{fE(!agu#T
z$}j1B7W}=RwyXgu0}B#w>vrQ-wyWxE@e7BA3g_FIX~TW?9x%+TS0duZ-)bGv`RqJ2
z@NAVX288RV1j2rW8CuVU6YR?>`>E<2ny>H{U%!I}jiY1__PVEqd~V7P<zvHrmVJ!#
zVFRb*$ZEJJF3&5WG2u4Pv(etl<Gti96d>ZemC&;UNCBlz!r%7vSA943-qa0@+cWVx
zzr?R?e6wN9d&1>eZzOPcHzRUSMagkRR^XQByPuEijY2B#wfs2#?yzt5+N=l>c!y*d
z=9S6&wW{2rPs1GWV6)shgkC~`)@NOaISplTb&QzEmel~oJMBxM=dlUz-VxAU9+;0w
z0f(xJ@jF9Bz~Lm!bChB}-L$YB@xfWsl}sckP@uTeECuYlNT0UX%3f5iyPuQhdxyV`
z?AFQJqX$cAZA2m45lNnzPA)D^>(h1Hp?>%8HxzhMLtotaJ(A6qn_1*tjoWG*{+z=K
zTl-a$I`P6nLjH#-YFNAb+$HGz<YlYKV5Z+Anm+p6NyYQ<Pje$d0GDJ3;>RT!Mu>;C
zz?a=zx{yd;b1@=)wq)>+)^e}F`RNgm<7{L3E78AH9vO*^S1&ctFw<!qa(-3Q`~+lM
zLiVTJ>5<Q3xk^=A81RkO41x-FK)ai)aWz~p>x}0%w0cZ-Tv&h?m@M2cU&S788qIzb
z)V44}?Oh5&_G{64>+*GlXLJ9KG-4WJ@LrrxctfdRLRik$Lg^b;<Mh6hL{bzcDL=_5
zQyi9;hTY2gAQ}l-oa>h6pvcC=rZq%V;LBuP;|N+^lu9VjCSuAl!e(Q`r#&A&RuEW7
zjyn$FY<=P#Ua0T+qcQ3adiZ{?^#kxhL!0OodbfYNp=K=~0-(_7S@r_8`<X2UroD8o
zKy$exRdljleK{pJc~`+Z%QsheFyrDjrFP0PvvyihwfWUnUgPa=`ur(bpohed-gA*Y
zN$O0!piyq9g`6F@`<R!4L7S?XnigMdbJ1fNd04iaJ2i*N*t%fE(R)S*f1`w%r+W#C
zR!JW;?t9+%SmC%V@#18DG@hqw7~$i%VAi6?=5gopb%N^_dWWqSTiSkwxzu5j1SNco
zgwBRU+$Su}^eg`)mYs5w{ulse{VB804YA=`flJuh^ZDG-!7GR{SDH2H2$ak;S2X1W
zrUlGDrUj5)YiE<2Ifla{o?k;GzjK<w0e;M5Tx;dOnx_AF@;wRO?s8;5hiuMCZW-|2
zal648+)A-1&Ix*gum749<cIy&NkO@9)y4S^Os>A6Ssvgx#ZUOT-5R?uK>rsD;O8?u
z&F$MhUo?+Fi?{{{0Pr*psmB34Ggq=LT5T?9JxCxO+)K<VzDFg&6&ii5Q-?|x66T#S
zZ_P_AdAqPc8wr1i4&CY>!NeAY^+3S)Bu39_vwwVrBPeyqVwZ57mBN!TjlcPwX$GeX
z2_opw!Dk_$L<KS{1nMhGI^IqqoXc2O_{|fz=o&!--s?!w!S@B2ox~n#eIL`x&oax}
z76*AhFHS!zyGxbc(_;_`KaC9zbCX@)1rm}v?Otnf>_ZueC_fId;yT`vpAuEM+(-E*
zZiNNFtwbvN3~ii&+5>1>3>#*P*fEIO>C-MwbP>I%Wx-#l&WU&JDiL3l@<Z6g5C#jf
zqpdob$o_2P(kJNSvvDh~cw~HHe&vIrZ~;P?z%iL2Aa@uJL3U*M+Gt6QPO{YV=zis}
zXUZ)SspnGqLF3G7gm03x@I;K}&6frbh%Q>1*yJfYY5J6Ik~K@)ubI<s*>LSrRfGrP
zV|G^rX~AW504=={-}fdS4h3EifZ1CW(c2cO!hMrrJ@^-iD0#qQ_0YdQ`OQ1Gk4eHw
zj-$X77<#ZGhW>9HXI5Sc4#!D7c>Pt;P9FI1n}YIUzt_j2KVY1~#C`%TWBrfhO)d;r
zd|~1-;=1daCrx5?;Wx431rxP}4=T3?z77Jycp{i+ff8{uW&E%#7c7Y0Xm>MO?1;Ul
z7EruRlTc2*Z1uP_Nc;>pK@DzH+5JuMGWm%cZl>w4rqU?pcxzWN^$+~hEK2r08ki$Q
zT7{MN-3rXU%=xYcYZVJbedGYthMT!ND#(GjhC#us8Ykw+9hG_bVN#xm@Qpl72y?tm
zwuJ!flZ?2ve2bynqYyRKb4%>x&@k^75X?{}YzvSW)4IB_GViPDLcM+|eSe-SS;dME
z0L^&*EKT{gr_-aK{JzNSXeeTAv$VI%7#}9IA1DCymv{GYa|}0x{2@@?-b5&axuoX4
zsL-C*QVQpl5p^E|0HxbzVvm{5&?megELHxK{!*-U`b-a6s)^27R?t^6xncI6FZbJc
z7hFjD@E-_ga?;o(mM-%!N>ezyYu@&T*?q6{&UVVfO2Nls0cT&4c6ds%G5`rL!uq%*
zpW7$SvazQwkwo?8LsI*!m$sz7uT58%T2-JmT!i)Qnm0VlZnu(2+6T9`ybHv(I9i5L
zE~<1HRM77x+MYRx79bp?rn>V0fUE5ntDSP}YNPY4^73PgE#4gHCDA^Tqa0y)_brkq
zbn~tt@>-kp!`3VdO>w4+4PioV=i_%b@8C!4yLL#kbDO#1m|&!wXMA_!Kj?w#kNG-5
z*?#3}bXUp-jn&<yE)j>`>BiB}jKQyU0bQ9~$_*CSxfj-4pcWf#9$zZYm}u(KSoP2~
z90QS~v;G$w$-hS#gAc{^825{fP8DrqxZrwaP32mC1z<Pf7tw(&3nMfQut$o?5?Le)
z52Xy;PVX7Pcmk`oY$0196@CVml?Y=qngZzKU(X9a?H})z@MwnU+DcD!_37%!Ipa{d
zN%+RX1dTa?Fctl;TzCb@n0A(IiY5^7+W(f7u>!I(<!0gkm8^``Kl=w7Gdsmh13;VM
zD4d)Cg>&pD3a94pKPa3w7JpDU+5bi1Y{(Z&X?)sJst<^Jo@$-^2g2f?wtMf@Ki^6q
zi`opB(EFgPD}k+@HNQ$cG&;44psJc-RDLp+K!FbN@InwpXZtrGbvEA(E5C8${XOF1
z@hhE`Ha1FLFCM?JF97=vF&CXV0UBrMEtRB9Eg9t0AHWe`!U>N{wEm6ZEY~{=!>Nz_
z2gA8o%QtE2gEjZT{Ev&mRTJDq0eDB(cX)@HCMO!0e@_&0b%*q<0Vr3T_-k##)@3q<
zTMbhB^BONih{IK!g9fPA!hog$Qed+>h!sVeQNJZ%0QAjY^_@{F0aP=H{Hfwk$d|4k
z9L}<b46J8xII}R+WFLMs=PPu9H({1I<D>a|5duW+?96_)wxE+S2_F|NMT}k6$j*&B
z<$Swk9>FDxl5*6@?n>mxYmE%k^BD!+dic%>D$sJ|eDn1p%mTxk`j$Dbm7M<xGcKNi
zG1CXg)XPgh$;-@vrS5-_mrdyT3|Up;IItRa8L{H1Zo_ni_^s5CE_j*XwCH%97lF&_
zFeg)jINjylPDdcQ0N4W`y|*1HgbYG*U<&}5WB&bvf3DOY<r9Jtce#ekACoCvzv5Dg
zhO+)kj5cI*Blg}SAb=f5?S%hB?KEEFP@Y=;H?`CD2etEecvZuG6v_L~{POSjH3nMV
zDR9#PJ*twa++>G3$!9f)b-i#~huWdw49Js?Y4uj81|3#RLA`RPz>xu`*79({a|@oX
z(t!%06LsN=aeLI0I?B5n=L50A-J<(nbgW~C%<3<YhXA2>8##I*E5OIYb`oqP-W%vF
zkwJB1IVS$&60#!x7UhbLT#7M!e41YYCXS&Cxzw!VV$JaGTo{YO=Lp+IV;H-Z{>NbH
zbI7}KBH($A7=x`Wi*8wEuESWB?Zk|fmMCJ|JTN2)`s%n9|K^>I<braQuL!8=qOYyM
zJ-hr!Y3#vn+(a9MIqgO$N3~R^aE~`+W6m#F@~W8IYr}5%iD_%+lbTdLiW=G7-}b)?
zLpW-%zYmq>yH}$vf@mLjJq4@*T+{=~f<E6XcZ=rNL>waJm=Za>RQO%_>oda5<BdUH
zihOFaInUF8Gq8@t6S$pQNI}JnIft&&F`QC+#PF2te*aJHco+??8MD%dTT;iYj+f~q
zR^upXwItZm+0s8N+I2l_l+I_onxUd^%He*<z{M_bW%2$XJ+#GQC_b{Rmx)-oa;N4H
z@E}nfQd!dO6M8?DN`GP-bWWr-&Zyi0i@=tougf3L$0ZlqS)Ghh*G|7lZUL<HWY52U
zQNp$HJae%NE13h_L0tkf0$f!~Da%{hI@V>C8<V{KYp5w;Ktj8@S|Rz#EF;gqvSxzz
zs7;c1GF}0DfFK4;aDkfeE`g(z&8Fw;7k$4+1zudpyV=_WqdlU&?l-zpvAHJb;Lh_Z
z2PbZ~#`Au2Y}%^1t+Gv__jD7mNU0-QQP5yHrc{pdG5h!g?qhNE#2v}`!ky+!{Q(q)
zSWE*f+u^!>*sz(c54#6107hi4;W=p@99%UAwaci*`b#IqlYZ-|#j_Hjt&ibcbgwS?
zk+{!5^e2J9CA4$y)@dj%yX#q1R|M!NWxECNaFg#(?ygtXS$n6aJwOCysDwCoi-LSp
zhmWAlbnu4Y{{CvXYwm-o9p3Cok=7LFo?A2C$F7q@r{xEzE7~X%-#oKqhBw^RE&Yj2
z2tdnEk>)Pry-#zR_ba{?(7p~_oqO!J;DUd0zUg!)<DtA?i%K%6ROz^<!n-||Umn}p
zOqo&S_cmrbsHsQVXYGIw3Zw(Pqg1@5Zd6dTMI3WFq;^cr0TFahs(<@JjxC)~k0ta8
ztxs1@I6+<&5S#+yAf?Z?t&UOOOi~~MhhY{h?a>)v;cq>LW*tqUNS?G4wHEDU!a<cM
zeXa2kg2sM~Cq74F+sY-Z+23hifoXJ<K947@z?hQlZ#?K1`+mB8K)<;d|0>UnZ~T__
zhRZ<DwM#T^ikLR6<|aJcFFI1X60w(zm~4Qiztu5Yy<(c7B%tyVmbnR}WWjWEj`_hJ
zr&Hd~zGe_lLEYO)YYp#zF+JEY(R}ER=qm5LyOtHuIFYNKGkXvqNjzG@X3s-Gg4j`y
z0LEM?$@b;J%xgEcyDP-0ofjS!OOUq4>+MlMW~SV&D#uc52|#)I<!(DE9`islJ8C{m
zJt7i^0cb1RBl0={GDv~T$0S||eIV8bzC=qKtt8-S;E28gIp&XV#pMn&r#LC6U@FY|
z`^cSPaT6y3>rXAPgJh9}Zr8cvS|X!Qy<7_UZ9@)M3!ekM!>*_RI;Tl*1i$CAO~&|O
z8sD1dJ851?wdDiKScTe{VXt{>)TN&1JA{@k&MIPw7p%H(OnDs{Mpu@~yCi*97sbxL
z5L*AP?$m8Tybk#A%<&_@$e7CQ?uq$shU?|#d3*ZoT86F#2Z)EyOK%7$hfl@6*7g0!
zXMz!d&m2X9y~Pf^F$fdcw&&}$G;K7lR*K-m7<2_gdFXmSYH_t<Qt0b;ag9g0Fj84!
z8I3MEhL1kUFm6+>S&bEg5~P`iOc%EbG$<VwMXVH7@zDr^6uy_jjW&;oXWAO<>sWCt
zC!y~uZEan0j^Oq01E!x!(^dyiSKEkjDU%=*OhKS^cA|j5j8|J_&gtr=BBpbWH`{HB
zo`XY}DfwB*L4z3dZ7b?>_k#yOFl^i?WaI%N*`YpI<kUw2yF8-bw!_;+-F9;Lmchb3
zbY`tw1!G{ue&RDBrY~;^{rS8sK7rp$2ilR|k=yN~1EI5nzEUC{-^o%#`tJnjcpHQ~
z>|v;IQCtgA=t@xm4UQx@^;#N~bzl}^$@6L_^O!)ISIMPctO4vl;Wx&FXx=wPwbvEw
zonl{d*}-%(m#+mH3ooFQzkeH6VSUD=D&~JfYmH)mYCtU1PepXk5o;Qt`6+sge{Y4e
zJhEh9tuVEGn&H^&Bv|KpUHCF>(Zy^TV036UJcfKU-{?}@RyYBBcy!FAW$3f&9rGIm
zzHcaexxnwiTF|J)_7x}22zT*WkK>{ESM)Sb+4F1lrm1qkw!Y{9%b_lJw>a0;ettqY
zH{bSv=VBJce0j3NM@;-m&12D%QAxR{v}w9KN;PYGyi((bfXjXF<an=m)j=T0ecG3O
z?-UUwTw7o{duW+vKCDyOV+xtAZ-9UO2EBSD>Al&CDu(YhMChM-8g_#gW7MTlJN@<N
zt+l6b#2a1v?q!C}EiEb3AFmPx)C4FYqu*U!yo9gUES6)3#vv_tj+o{wa>Qq4XCG|z
zW*}acA`V9y3?2kCSHKFNWAF5cJee^><dy1UHpJFwm}yUQzDqXF8T1|Rj|;oac;+Qk
zY8Q?A=FFf#ejxwi#B-)R65KBxY?(j@lg`R^oKI7B{I=R<K|(&h-iM16n@Au(`@_zP
zjwyO^>oNjRT4Z_vrsaW%N!gP3)j-&0<VILf71pAKk>cb*+DQ-DCd{^|Wsw3(5t`NW
zHn+cO>x(7S>uzX1^a_SA&2zcEa(OG%G<8>?yLrX#vz+K@r#i$LLyd8nWkv@o_q2^!
zrd+ozI)y)R|NI?5qI8J_9-5dbtY{f{8VfG^f_w^RJXUXjHlic9EoX;v1=9KUx<wpd
z0jQKTXmrmG^MK_6wRQZLUuyaHlK8!B<{A2@45#0KgcOSK8;FSPj$O0rUIYHPB>vPv
z<`?4RcQSeyU>gG{iBwq5!lLN-y{-?DPy>#4<@1#pA1gGVhxF=VN)?IXKKP@WWi9XE
zFv<OyWM-mAUma&|9BDFd6K~ZFbc?*6{~+1W^>zN1wP1069i$a~a=bs&x)`4V_04kk
zsNKZmZ9<u83)Th=Esw)9{Kj|rHxQ9#^J#TkSEq9O*R<RMAQ}?T*0@e?iTNx?C@{{>
zNx8o&Y8J@Z@FncM+D+3-ZBnH>w*BVRc2ZI2_a_slh>0ozaj-&}2W$-x{7~M)I+X}*
z50cHpck%{!susRF_ZNX?(%jHWly(n(YbOaf^~D5l&RtqxbiH!xKHs_ylget5u;1zN
zzP0wu#%#C8sxuJ0SbaEBMCUa-oq||Bt*4Tu@qL0Rvq?K_b5Vq8ZI03tFMtlZ?yWpK
zJp7oL0s_Vb953iAi>kUWLJ+RnnO-xCQ*Vw>U7ayt9sahXP(nZ`I!YDRJCVd<5Yptp
z(6@uK=k2+te=<kgAYBY!-|rd$g6L!Y=wH!YkA)HYAA|>Mz5_T_R|HR7i4<yrbCeqT
z?mPz_TRgPpZrJgjrs{OKxsgo7ooU7<{~V{C2we9IqOwe>S_Vi!BcE2|Zem~90>rEi
z3R$Tq3%*>zU0GAlM`#YM=)6mr6`{r}_8WP%za`SMdkt=y4&H-K{8FoH;`MX3-8e2`
z{3C12hv%lKhBd(#N_Qp`#Y}D!t@hEyP`N+TwzQD%nW}=?zBM;=Bs6E~z;as|8@$^!
zr|uVsPFBSPQV!+V@%p<Fa#RgE3BRF9*Qr>WGMhf6P;BTHQ5uihRqK3v^03GLbAOsr
z!`4KZZN+yRhuRd`=Z`R&#`wx(vo2VC)UN6GCF$$p@8dRYd&u^a7}EUqa=ir>Yqz<t
zU(TGWqPA}ABM;5m_9qb_i6co=kaSt(=!)z9O{R8nB<j+Yn+XBo0Y@BZ6SdE-n1!e0
zdH1BAvZ*5tom2Z0lh<>ceawT(#-}ERc^%7<+GtPNp|O_FeuAsYT&q=<C+e$QWu4q#
zdU^Rao33T(-#f_{abJ7ajmFxQ%n?uf6-m2wy_^JAkr(GAxYIWxL^Q!|F5WE%Oc%Fh
z`yQm`9UW3Y7kfIlB9WW2bR0ERT~xK+_Hoc#L>r!PRL(Px0m~o^R^`$g$_f5sL9?&Q
zn3<dqXc0AffPXQ5Q+O=S2Rgh7U@aD|xrv%h4Z!)CQ&fk(<c(28)Fk-%2Oy?hYKg@@
ze&=szK<lI$b(v0re(tM%On!0FMmt41Cv(cng$pZ_3p)823a)0}#Ca8R28GoH+h*B!
z6}n8o{0VK9^BQ7RTi!#Q&MZH8@}Gv-?ke{F#->VWOD8p-hqP)6(SA68{Z-_pCRx#a
zrz;@}YogtThd~2LmF{vB+n@ra;)9Qi@f{DpY6+h2hA%FPFG4OyGm*rWJawo<ZXIAt
z9-`^Sq6Oe>iSGdSiTNIIn0#g`LgUNm(O7r9EnLkR0DdPm%NVC8K(6<+SZK3S%=~=f
zc4&hN_cgDBrX!hzuSMMSHhYHFL$mqw{i9>G2KUqF8-3imWHmoW$5Al19}KPB=vPMT
zJ)}IJ*gT9%_4D7^%08u0EA}1d_nzn)Sv0n_U!@vF=g0Hpc7K~ZEVGR$WU(u(LcuNF
z-Q+~hYa81hk2>_Eej$kT@a<a^jQudQXNgYqRpd^-&zPz<In7nS%pj=vgo9p{{r3`4
zw=4A5Pbb|k#zWcHb9!pC`qjktXWZQ}wYgYse34f<srGMnnoCUl2{;hmZWxEmshah=
zZR4tK2Xms6^t&DNDUfX40SD_zV;U%T@Mp<4-qDeHvw?1x_jS|9EWgLp<;bIAR7ls!
zh4Z3AWvbQy!wiZyFm#UN8uu5g?MdvLZym?OonjxQHfFZnCl*hYK@J$SWk_0y{xvSD
zYP+Aj)K^IVl?T^}F}n%m!Nqa?nFp6^JN!=`T(qqF;(M^2%_nk*4OtO?fA^aVzAHRY
zPboo*0Z?$T^@@BK$KE}Pfjuc;Qbc`@<suXrtzN7rgb-DIzROQstXt&_SXZvT2C@xz
z60Fjfq9bG~_c|2j`vU1c8WFSveHeX3JQ;0tZhxg#J@kayxhpzAV_fGsBK9Mue%c4M
zidLL+HBGY4=^+!kIG++)*v<X8dDHR!-ir(xkK&sWzlp?>NKq)iJdgT5eABeK$}*LD
zBHK7sMx&AG5x0=3>{xcP!!1EWck{i1%8q5vK!^6(BzEp@Sq;@ZzHUmS&K3M8Zgghf
z+14sx_YV&O_R>CdN<VkJ@AlGJK)5<X4KaxVN*N(?Ia4B-@=~f_g*$i|z?9{5R*gl4
z-@(T3d5#x|O5e|;lw_zDqls=R3fX=q`fO2iM3LJWV{4CF>e=xbe(w>ONNM5+2Q^`z
zSYdW1Zg`iQ5a-Z89o2wu@;~rWjENi@W2p1C>v9#Oo&zEe-De^I8pVB@S0&cI?YGV=
zaMgK#ubOE>k5ZlNXPL5R^*o{xZuZI29RAj}z|#@Bj8tgQ>=*QbxyV^U>3JOLrnokH
zU+rrKjA!$8*_W-@3ycoVN#_8k5>-r?;hj_R-x`{}Y+C5I0C<!nzaajH0}fu-x>1|=
zSi65|Wb~TgaiXCG%aOSuFczWe9hKqN;qU#JjCG*`UZ42-2lJO}OG|{3Zz&mPGTADo
zI~0h+g-*vwsWGLvC<w@wwJZ-}NB8>S&b1x(Q>VNz1Ztj=uuPp7bw^D2^A|AKbc{a?
zidnomKUkIsRMBy|ZUH-aO)4m7H~1qr_*&V_ox??k@1#gZM<9|{Y5K~Z@3@+q3aP#M
zYB+mgnh3WiVsb{kyPD-P;dgNnRA+SF%5zYvda#GrsgL`j3w7Pbp1#9Exf{pG@Z9%F
zvWUZmQS0~zX75~vH#Qi2>rckv5LkO#>#O~l=tx)s>*}NrMl4b=xuY8u-(QtTKves-
zpp;kn0oZNgm>4qMI)bEW`p$&p+}F|XX@pRg!4#6d`R!fM&fbo8P(qPF4R7_^KrI1I
z)G2)a%0uk<UV)%tyt{%*On0AwPuK4Jq@Tep<D99<9<dQDb@xhPJ>T9*^M}I#k3gDI
zZDjF8+ELqKya64Q_~vz}FGeoKYu;F|U=<K>=@Z`m9avcK<G%}oEpr*>(;#bEkg-<O
zBArgEV<$=RlyZZDSmih$RID35-z|nJb<!*Ik-1OoQ$yn(+JIf{#7^MT`E2;6xDT@)
zUNZQ-`Y_wpG}O*LB6lEhjT*i&>$4Br)i#a`^h~6&{Nzx-8&M3TK|iIl>^8<kI`h}H
zK37;NyyCsPNP$S%ajKnpR&4mJ?zqr1fp_54^H}q+)796}{ToRe?ETKfZOJ!RgSCx)
z?*K>tSJmSNYrk~(2bIL{)4T7;2G>oFT?nH~B|9dQgfc|<=GvzFb#y>>RDgg^0Z+h|
z(r36!MNckvSo%u0*t`w^<T>_ev9)eNwAGZDl#3TrrByXHuWROePqt?WnO<|-B!e4*
zwiHG+Ih+|UvJ?9dIg<JT|KfeBlRINE1@%P+3{tB+JE)=GegB-6m!(_81{u}S*VkV6
zd|%lVHA0g*{miJr_c-0}^rXu><I8|>YBIc=+o*r|9k4C+rwn^jw>NeRydGAw{%+Jf
zx+uaHW{Kojj2j+X;{7a{kip%t9eYccp4)x?xm?5D!m7IdLwG@*PGo#Lgx1No-CzK}
zn^Z=J%co<phA^xMUuGZ0Zg8}>dh54~L`yuTVBW(!x}HS8S#E5Zc8pVKm213iI7+?m
z9`a#EKx}3IBSKlJ?Z6;0GVDnp7gW7q5h2KS@X%=WGLQZzW@CkwVI5BtZ^UF7G>ST~
zFH2!W>vTc`i6h@V!7}iCffg~ArCFPOZS?<5A^xw@ZX=p(bZ)i+vG6LJGRyU72TkTa
z<0Hs@d;FeZP$2=cRm@UyX;rTj+L`$c1nG$Ck0L3BA0B{OAtPAPxAku+22vsDj|U6P
z7wuxf?!$Kt$&H0&A?=1FD$W_`P^MzaGJby%z+A)t)3{cwwP{Z68wLUtm<MIzuMJ>;
zAzG#eh#jF^9mg!FdPi(Wkv#blZi7c~ZpLTi3#DSg9_*Gb@k<$nySDVgdLcBL5}%#4
z(-M0=k`(k=QtF;BFQe%<&W;}~vmjtEo0s<m8N(w7^==*kf(sZPUQkxq-s;;sWrbQt
z*r_5PkfohtfsTR5^f)n*EuzC$VTG%0$bOYKg5II>=L!E4JbEQSlp_USco)$w<kJd~
zMM+7&eZzLlTlMKK7mkdTDf9>)BX)%!uD=W&WIbvz-E!9UA#4pBC`=;#cE?{UTJAkz
z>87(ur{;N#m({qAFq8PCr=uyzDJt-0siyH|EuUQxJ+Z9ve~f72ZG?_e#N4RTf1dg=
zeaC($3=75N>}Ue;Xf1Sozj2<QRZvNmTriWWos!nQ^L;|wtm$AxHKpVrqbw^PyvSfj
zmrppzJYpGre#u$%^=pgpXvy6wcFU?a3qQZzq}%o`4fK2BFC{(#-#<G81>lZv(pS^B
zN$@a1*F=-~l*X6h!b~P(iI2%LdZekdt9Gp8=eZCI@9W)e=M}DXv>6;$R#@T3W;Z@&
z8J2(xjc?gT9mGUl=+}adj$bnQkfe~Dl#%Bvf3|&gm~ewO^DB(;&pAEk2c2WA73s53
zRQ{)LTOc)wg0%w=`Wx;swv5bB(@Y)pYyJt8<1LQXX-F%RPVI=n&h3Th|E0kX=uESA
z#qwuBon)O`i`;Cq!u<OQ8cQD}x>03hhDE={3#to|#fKG{9#F-<Rk$@!Ilfh)2`zrJ
zlCuvv+Yo1n8}PnoiQvUp>H*MOdAPJ+Z0xGVzukRYICo!cP{_aCeM66N?miiFpXIY(
zUK987k49pYS!tp@2@1_JPTFtwse{l(u|{3mtS~3C&ZpQ?#*R-)P@HxKa#G}WDaS$}
z9KuXTG4C|S9C<D;8%9N+R<q1+&~R8x#~S@hN8o2&jUMw0FzbVN0wX$kegXx5g`#AC
z4gsm&{38@4&-<TH6s4~3e}$sNX)kM`=GuTzlzV@MqFg^a6s4SykA|x6;|a^Eiy|6o
z{%1aASJ;bw`8h4NN+yy})qI+|1GMu9W0N3o9~O~kdYFFWEKbnDu{YPkNHVawi7RfI
zVCS=K#7zE4^z@mQfSDdFunf&QVe`3R7h863xYOo>$%D7=cnakhqUcP>SKe{`|ATSG
z|C57pp|2nK$W?B;E8=na1eY?H(>`$lF_}@H*Kyut&v`OGU;q;eP4FD-!veRxi!umO
zU7aPcott6CQfh(Zjavu80;B#i`Zfy5ymy$XM~sHl8T{;9_J{t4n?7D~@FM4v;gc==
zpaiz>+G)!MS2My=0Kw687L!jbWS(cd->M80CuG;D>0<{ozbZ_{T-X_1t!WtVwn|xV
zQ#>hW{OEBK?F$iY)@stWmzp~1T)v!10+$&gAjkpKT{`zL2+ZU2V?{1H#cMXG%}Y}D
zT#3uM>otG1j~j&~o;1EVkN75Er}*n1c*{SV=4)1Wa5sxTWy5&C7?ms{lY29+ey98K
zsp8r)>*brWD-6u;=(GhBYDA&VGMrl}4$NPf5Sh!(Sw3%vVcXSJewpw{BJA~!riQz>
ze2}UF3Ar*DYw+@2l4exAz-3E=svAA2wF}WC8J9RmvM?>IX_)WSOvKriA9t{>we-D3
z#toZmiN}q<>=b|hFAXyw0nn*VcfrL?$p<&}^A6?Q20e2#FLdc17u|9mq4Z45t6yu6
z-F{yaw`<KyN3UhKw(zxA8H72g`W9UPD0v<-LAYP>C)SYbawQlnQU{moy>QC@{LI{#
zUo#S$fB~YsLm|kIv@7C5S`A4(z#N?o@nLs;#!uASM(oR9-{Q}5wS-2N+kn=}UpxJi
zi>h}&M{skGVG?UK1DHrGofC|XD|1GZaX*L_rt}?>b=UM+R5NS^MvmFLxzKgC+stI8
z;)gptlOWocp*pX1$z^C^iJ`1<^``tXbO^3F?a*dGg-EL>oST!fii>gyjyq!+{UgeS
z6^L>HrTdku8mE8WnXu?FWGBeO1-Wq2{Z2v-i4#F2Wk{Th_5fl=wya4yO~5|mNuk8*
zwE((<5<?mY#DQm@tzqH93tx`3LqnH70qxv>N4bRi_x}>*Lh*#u$(sEiYRtdK`hWkb
z|M_5*)XFP&^5Y-*nzG3!iB1Z<S>&#nRsC&C+Da06)aGwVV<b4iZYyyjp2DJ3Kk_yI
z$4UJ!1<${QKc#>KEz1drz5Hu@j$zXt`g?fJbIuCEjkuA=IoNXdoHGfWh7Q6e&vp2i
z7e&t;kL}1g>{L^p{}x!L2^H$<X*x?W^90Y1#A^JGLF9>0HVzx3O?PXql<&V|V-%|Y
z#K!3UiH$J_urW@kf3Pth8@IH7zK8$ad-DhOxz%g-kNgy=WV23!E$)B%BVd!R{`$`W
zn^D~a**&J9F7-P=^q8VVvD5EyNK*A-<_1$LdUsqB%KrizqbMvZa|#488w%h=`&now
zOLfj9n<0k!jt}Ri<Qf^9$o;B>U>mXVrtM0gdCfopgy?m%PBWqgr*A!}qf!5(Y>Ep{
zEbB!0)2?=@7M~^;I=|myyIF9BfjFJRpF>Ip3cU0Hime9&=opsZe1TwJr}LW5k9jME
z!Rc9;PP#<Q0uB-P?;rf9$Knt0Gxa0bF_sFr=-admT*7A7|82r%;vWf{DkCnSK!v|l
z+_mrooQyk5G&j*1@;|*<FEz+T!EHQU(6s+f*%3LNUN#q|U#2QLP{dO{mDkl-*}F5=
z`s(h-CQ;ap98A0BkQ#ja;6{&k7rn!fV;l_s!EOKQM=yY!0P@=p6NL{tF1)?vhf`%s
z0itXt)ZxMBFK&UjoPZk%Cx0p3|MMPWQWf-v$eb#wXe|Fo*vvW^SNzR>Sk7OR1%}^Z
z7?!ZbrfEUg7!o@Q7maw)7!xfJYT{4ov&nji|2n)<>WS3C|Ha-}hDEurZC?=u6iMj@
z0qK%10qGKHX@-#QE>Tio=uYXzp&NyPp}V`gVd!{o*WPPAd#xSMa~$v2{cYyJ!<!lY
zd0prEJI}T)=8=D~2j2cK^p?2O0W~-*Mg_D=rgLT51aMnK6iWaEx)yM`9Y&6O!(go0
z?wWACl)%6PtiN24*)G72U06ogrAh(_vN!Ni<lvYdKyI{oA(|c281499N=ARyMu%bK
ztNX;5@bbYGOLC|I>7ydCmsz2J%~XFTy+We%S|+&#C3dY;2Q>reV-fzz3t6GyA4xEt
zBgVAG&=JYQk`ldA-`aBTZMBI>^Iy?J|4GgH1_@az-BQ&D82<5h(tYkb@tG`E>*dT_
z^#z)c55B7CxrkL>CT7KQ0TDgRFA+J^I+Td1fYhw%-ZqRNi=Eg@`*&BFji*)KYYZz6
zDdC|QTz{pk{-b(un|v_hF5wtcnD12axEeSnkEy2smo@dR(t6s7d#rVZD@x8}L%H=~
z#OaGV*01>wyw=Nm)YZTglkDOAtz{3EfWXU-MM8iZX-F*{pSd{lDwg0s4G>_l!rlz}
zwNfc=6%{`UQ$=7K$aMDJHc4GI`0S@Gh{&dWS~mfXj-gDFZE1YZJuo8rIv~9|RGa~c
zv->KjlS=u2<G0|V+-UInIBNso5C_?-9pnK`24vX`@lUZ7qt!;o(OH(*Ma$g-Jb0Iw
z&TO~^b(ICY_1k%)|3TOWP&HD2AodNUGjR@-%YTN*-@jFly(_HBtg|mjPr?!5;{M7a
z7sncsEWN!0E|VS6sQZ@ym&l~CtDOJi{cea8mVGDf^;&H_G@v_G$h%6p!Von^;z8~T
z!N+(unQk5wx*u)yq?q_EUzbd^5m>C`R?K@A0FxDAsovC@JiwX#(^~ZBWvWu)mo&Pv
z_t!+V092g6(MQYY<aVjwWHPt}R|^Q_LUUXhe5<jPFvAI8KwckWBo`>*t>N~jq1;6N
z|CW1MDf651`VWE&0KES@!DYDUlKx*4Tt<8UPH<uVGr@&h_>9W<KSehtyxBn<q|K2W
zUMIAG59Gq7wPL*sn=8j&sIfhf0U_i9@y-sh=nA1XFSEnY4b&k8iC*qX#3uw)0h55r
ze_P-Nf0<ov-6+&^mZ%`T^*`UexO{V|sDQw^oK!H~pVZGE=>94Al15#1b?oyCMbx@K
z1z&PH%z^*6;LGWk?;L&)zLdDF82vr?GD)+9ycp>{RtIPB%VVluL!IGv;^o>``L(0P
zPdlND@t82?MW7b#r*B`RQ1@}oxOo3pd`G77e^6Tg4G1XnHGsF{bbt#$xWrvqY=bu!
z4cMTXq5RQ@J%Owt;rv3u6$tJ44_N!C12p!YcCb)|+edw=wl^Ol`Gqy~pK|#R=LJ4w
zsiIY(@tt(Duwi4(BCg5t?Xoc#Gm`CbM8Zw|$^?F}nR5PXL%N`#o_)QJ9{hDyb#EpG
zq4k0QL}P&PQk(@>{!e5+K>046k@cIc!(u0EBD4KiKou}2Aw9e}9lS7;ofOX)OJOHy
zKc(aW{_l>LyHT>BZdqWN8e?fU2<|cC*%-R1|K)}J{-3HA(^P|}@9O~gLX1P`b~-0K
zr|dXC=T1gAnN-0mxO|okr53rqvQB0RuLbNY)n`dx$gi+&U@SPTUHG$h8vsrp$HN1$
z6G9W5cdk2wdb{=harynr>uJCO{@bH+V?c7hbk;!HWkCy<Kj*)qYW|twqO$%!43~FL
z2TR6afTp%8@rR<!F9oZxnIPW38wmJrznM>YW#`H{Z=?GPCldyRE#T_opU!}E-<^q6
zCzB!^`NRw)iZ`u=h##K*jjqW`FIW6`xTf(Ra7_fQe%UsrahTqCo(+*AiX3}aHsl9F
z2-Glyg=9pYyX{rp_v!7OC!F8uaue8{=Z(uIK?9FKzm%-K6}`B!OjWb5%BFN%FW0qL
z|EZ|?$6*7G4IFkEb(9E=Ew1tu-e-Jz-J34+JDoH67oC%{2%vL%5{v!vW??Mh7{oPP
z6==%)g(GEWAZkrd*A?-uX7rIL_sf*I>2Y$ZM~s<*fzqbk`p2+hvF@hz)hi(}o=5`4
zu$CVTWsMSy&CuZ^06DOF5T~l9$su%e*i^d=NM;%ix?3vXBHQy#lD$IL+DEO=23Ao<
z6YRgv4^?T^%pQ!GcDZh(-glJLXs2H*D{@-N@olZbscopteIMh3Cv-h{1JFpOB~-3t
zIhXt(os=Px1Hm3^wc>a>>}l@XM<1`Y)RG+p{}O!g$FU>=Mat)`K-3R<k{5af!pj4E
zM)k54(7+{0ZYHPR>AF)OJiD71wPic2q0qY^Fb?t|&^-FfQF%BEKTz3z_V7c-&5I3#
zT9Ck7x+fK^Q5^l+a*$J;BDO1h7nGI{#LaQrCxd^(iYEWUic-E#n=bDu#c=2o)Jt*i
zwzC@vQ-{fO>yY>eE_EhYmUn@2V$}~YVx?(Q8M!8HN4B;7#u-X$S)X_x+nvet&z-W_
z>gR;5wBx0R@$c8>5H1XLuy9|=pPEnm&#Hm@QyZXAX;j_cFe#Gw`@=Z`eK{plr2lTf
zO8v6*DmVUqA*Ez>*(xj0WCPB97$(%6aR@BY)SWWK>k5nxtT+e>FJ9r`pk9T>I=p-m
zt@li&aa>fPqwXbIQS*8}E+lp@>0V3OehRSQ@5ZdX3OpGQ7HqzCmVysq+S=4E6()FJ
z5mcZ*bPD4f4+Ee=uMbMSj{Hqm#<gsM4B7%D(kmOB$2Cm`_S`mfSea`VdndgE7mR;8
z-9G{cT_ernpbNR$?AGrH+08k{=VejEg}be5lCLLt?Q59jjIG2(-$x;Cxq<fU)<Z1H
zniwaNou{`zb8s#&Ao*inBZ+emI34tIv)q5FTUK=zp!xl7w?f1YkO)KhZCY>|ZmnB3
zhd`N=W_g0kecZY|2##7i-Um%C%YZUTUetEN^*pu4K9&9f_g@y7Ki*DLz1t4|7&goz
z3v4soLyS45GFjQ-)?I83P)b73MbPiukt9XNldX6-jxsnef>^TAJ~F;}z1r2tFN#(A
zSxy*TB32iSm^rw~o&4v>m)Q2M0)Gr7RHhgn=CyBOb`$k4%Gm6WXju9{)}{c$>Q!hU
z*KfkO{?rwqK}@=|wIDCaXKP?l(j<a$eO{p;BPoR%4j*55IsU=oOYKodQKptV8*%0#
z$$c~L-Q9WgGN5h*huqsaTQ>Fe+bu7Ezmj?9-@x@ZtO0#sbcCmuT#_?c%h46X(Ig1H
z{cx!*(<0t_sA2<Jr&gvL4Fy6SNV&Cr-1zL5rxMHy%?vkE&%61*0-p7M%@$dyR1Obu
z=ojKe6F5|~Gr-CQ_!3#p6MahfLDSd@tOkxd^Mb#mQ2+Y8_2wEe2|O2br%@!IDV!;t
zX-tV~e9Ja>lqD_0A^z5+xUp07>rW_XSQ04a2=gX<q2q>BxifglRV9d}th475Ru(<B
zr}Z+Rl)$iJifM={$Hxs{5?fm@6=x{bekCM#@)0Pn?2j^tgjwFklp=HkaA?CD4zT>i
z*^Eu}$C=&hCIVz<%!;CO0Cp36&~nergMJYVBLn;6>Q)k-1KOR{qq3Ge`t&w_&x^y{
z>+i4gD3KWwgeZ?(=<p0}OPHFW>|4Z(f5ms8t^W&rM-S(S9%M=SyTq=Q%^Z;TXyVCt
z7|lp3dr_(ra{b5J{g)S1zm;TaGkj#i#WSMfx*v@J*Tyn!)#%TRNWlqjv6vCH9_U|C
z&kw5?PlrkqnC3BCt$(xwZo^%YdY`}JiWjR`uUD)jT!lKI`n_Er?R5(ttM9(*1vMY%
z=304DvVI)=QOQwb>L}mf$(saVHB_DV>~}?habj5IZ4uwbwmIVKM%q8na#1`r+3Dzh
zo>pJqrtSuCW;i)P&5n%ifO;+Qv3^Q%1@#KG699TRbJOZJ_={@xkF)iUAjBkR<SZq_
zVd1(8I<?<|YzLKc#AJG)fzpc<NJ9G`lX|JqS9%TP>gl}X;K52l>x0Zr%FE_EJ$YBX
zJ>ya2z2qp}qKHNL>lkgzF)9w5I|i$u(&>W4F#Ly$28ohnEq=QHmU;mw?SopMu{3H3
zq&eTlRrj)cfqWn11wZQ-<~ZnByIDXN_H04D)Js0-R5H@@ywl{1b_JVEnIssjZ>E8r
z7F|RBHQ+*ZqlX2lrp5a4zs)xXuKYlWck?U0J5?)Fk`di^b}*S>G$5=Gu05t!ALq@{
z8#WCUa`<kqTXH9jD%6)JbW)c<d&|jL<dzdIGxQ!HS5S$RbmdXLSd7|Qk_xgda>eyE
zOM7ZQ6l(UZyDQbTk6PmLP!?a!%k%jd;Eo|DxerZWpS3@MLpqXnV8jl+sSgkF+~ZE8
zYGc)O1xY;@=RHjh9R>t(S}xkVrDOIYK|CC;$&M1X79G5;$hA84n-1TqIx%kt1Wt^4
z0kPv4{JV!+6Pz0i@D#*>HDaCPE9Mu7e^i9dw7Q-bL3B2LXa$%^$0f1nFEL+#RK|R{
zezQKwQDynW@fF~5{uwecy~hxUP|K0HI4r64*~(lE$M&Wk!-e_<hhF<w+(n3<LuKu%
zxmvV_VS=o}bZ@kDj2h{FFP#Pb`1w)jgN;L7x3xnJ)48x?Ow5#)>$~d%Xc)J4Z2yrL
z-$?CJ00XG)Id{k{I*&l})o~C0%^IHFt&@7C%-6X(MWLgQyA=l%m)-!GtddZR|4@l9
z{GywI`D+;WlmNPXgznW@C)N1|Ua!;6xZoa!F3s6>+kFm)e@k%9u<W`_gU=5gNLN{P
zsN!&48(wyN4`=;8`yZY6KTaaQzp%o}A0w09Q@WyZc`a`i`BFs-CbFnZy!W9*^@_oJ
z8vke%7P!PxrQCrTDtoKEqsqARBWNt=W-3xLxjCYdPXl!k78CRKLL&h;Z}n8u@2Vj2
z8ZcFa@}R(gw%HkLE>h+bycssmaNf#bW73t=BL=dgN)}zWs=j(*`029(-n7X>7s+jr
za{-fgDK4YERIyoE(Ev=0M9=5eNiwg7H=K%q_3ctzD2E$wMLb^Z7-$!xwDE0eP7Cv%
z>92h>H@<7DOwm{Y;6Qx+R?-M;LXdv@u&~mG+gRS#KN*CkX@6YvJwYR$^v<CA`(~>D
z8tZ>_2sl@N(;=MK&~2%0iC&1viLx&D`%lt8l=kxcx>g!uH;w!zDKJht`B@84WHbR+
zzTfZ8nOyA_T4uZCL?W{at*eYh(!-ViB|`XI7cb3;qF2Y0OVROO<8#SVwg9q~QsP$*
zP>k@S2rQRiCB~IP+7?f<R|6nzw_2c*>|fxWvr)Ff<U8)C|4?Lht#Cp{sd}E*cs7D!
zA!g3pqm!HI8s%asknFw80sZeRfMeC?3SklxI{i+6NgDj4qnaU(@DU8;M*ufD3hH&N
zFM#B-xl(C=bx9%Z{f69JvEK48$>lfFe<itGVhlrZe}mv8O*dk+&zMoZSI&-<jvJX&
zM_$*BzkW!55zGQp<{l_3QQSlOW!e2<{_oCy00`>iryo37KDnm!aP?E&%F*{eR=E$k
zce3A*z5soWF*fWjQu#X|nzz#F1Md+8ANSP|Ub_7|F-WK^qQqP4vgY-$cMB}BvZsF)
zPW<Ec1jqU)egCTrC(S8wH<aTuUer>Kdpi2zHnz%G>?2c{K1${LIMvWVIx=wG=PWLV
zkJvq_o=IZGSA~(<V|LTVUO=$oRZvs6c=3NLjQ_1L{(n^%G5=Cwj3)ENd!RvgXzz*0
z7D{zi$YZtqTJcgdVY)C{Tb0ZTaN0*Edn5(|AqQR^Rx1>~-nUm_fr@*QTz_m>zzd+2
zb9%7QviBhT4~BlwCxAN#bV0AQH^VPj0o!NNW)^ga<_S?;sXf?HcFy6QGHUZMP*$K~
z;f<Bu`PRH$nEP7oYE9r~3d2;Eiq0QLF1ah|hihHXXbG-(1`g^C;QJSk3~crTF)`NJ
z3#}VM^?OIAPgz6l%)C|&LwS}}$%HQ}TFQI);g%~T5AO%|UC$-=k^b@b{P^V)w|wP8
znAqRv=HT1^avlE5b@(sW;lEsmK14#AA4orb#bpc9B;_yFWqGuABwJ&)Oxa&+1I=gI
z4hl(PE%mPcRDPJ5sUB7nO=2bC0#KSuuso(Kyq%Vibub5Y1MFlud~GVwcbnJf4uGNZ
z7_*yx0{KywQbT{aUZT2pfEv5XIA>-HSIhP`Z+C-Xk9*h+uemqXdAS;InUl}jKt`xl
zLEl0+aCfMA9pkm;a9^ggG(iZWzSi^fT2PFZ<I|MmF}Q~82|8G;e3;0utvS2>HXA0;
zV8~gM!>^s2W-`4woO7e-L|v{eE9+q46;0F6q-jh-bvKuP>tG#ImKH8RQgy$U?<o{}
z%Wj%w!LZ?+ty7v+J@>xZy#=O~6jF9JkXcphe#6nr<Iwy1q<C!bgR?^~ugk8(4+Fbl
z0z4Ja=wL<R!e-M36nn$8z(sd&`gK`380@1*7yhSU2Vs_9b>K^wa)DNLu1~op4%J!S
z_-~cqANPy)L*rLYiltvEN`YSS9jCmgTr0gxha;^-mzyotqX17p3PbT~HZkO(N?nYk
z!=?oqq?aPiqmH>xcHdk8-jEZbosjlz_(UB$Kl;J_;=Ef;69@vhdCQt_*mD&!4*~uz
zK9HYj-U!%foJ<Is3;@`Is^ft!<`VFyH9bT>aku;?jvKPn7SJC5rKQvGeBXoYg+m{Q
zo+o$Xah>ye0WB1ezmG7g^5#vwd6xQ%HAt<#K<MdeeOXima#fzk6`gUsy{uIR{q(<r
z0(W6DJs-I0&3TJW$L;w%LCu0asJkRQO6Kd9X#$;h!;CK5!OgSw@885K7U82lq~Q+z
zJakW<6XFA)0kIVC{v12#&+Cp6MM2#Xe&8Q=7)X+m@!QmB0?x`s#+UP_Wk`kx3sz)h
z&Bun8)$PuZAD=^hrMzpVR`g#H!Q6@N=+S0fYJORVRDEQ_=FTRC)$}ZyOvJEhM0S!X
z7NGqz)`aOkcbeMna3;H96d$l8nKwD%rGsT$CAc3Ucn#vi&#_;3qG#8thi1dIQkIv3
zU2}I*zj=S4m2?>{u%4~qc$8xZ*tJ9B_1v4M@F}~W5ZT~blwJ1#?8T_w{Sn`ED5ts(
zmdl)-7N?q1%YE}D><F+Uv-R_=UEmU^)8=)^*PsV|YYWId_(EnMR<q#F!OVBx>&ka~
z*}Yf|2=zm9;<YFmE<BEaSo;n)({#eJ#?#NOh3E1<74m?np4o1x&J=irt~Pw+<LY(k
z6co)dzv{3xqywFEgV3ts^2yOuhT@L9b9eQ*i}f*GZm5pS0t@a|g)1tl08dD3c+Nr1
zNxu*^;9+lSJU*^75CrU$E7d^Rm8h(V@?M7qnF7<9$g)y1O)R}7{JwVaV5}uN@9viD
zXke%8tIwRXGI%Kd7LAXxS!&_HG~Le7Id<XvtJz-Z!MCNh!1i$A8+<a)L)}Ke!eiH-
zv!On*Fg-i$bJOL6j@UiS=dw-wXn3RBPLeDRb~bsw2owqnKqvC!^lcIr*S#mqAzQiW
z5Y6Y%>v%m+=ChfTnyH1&bJq$Z&eTWfmkypcM}c<p3yLKKW{o}Q)Rzz2*nIeS6iaU%
z)~@%vU}V7zEKT1vkI$M-lOInwUK}9Y&n0<w)2;kMEi^YAboxvr-vu_&)DQb_9MPte
zurwWNrvPb^V+nN|sls5MZJS^2XDBV1j|#lO;7@ia`DCS2bj_{MVJ-#)8F3#YIj<j>
zZ6@mL>}uwT-BiLZV{bO~ORwr_)%(Bfe;Cgz@hr^I2&NhB*u?Hp#R<^D@*^<9I%n62
zuCs_-`&{Lq?$9Zs_3T~$YPZ^%s<J~@ctIJLLoL23c)XJ@d)5NY4tw-Qi@(m2W{}U9
zz%+>$?Ro^oZcjD7gU*MaCIIc0tNwfwv#7M%nb>K!!0v}og9+q292IolS>98Ik1k}Z
zh&yq26R&K4-6?kd43Xb&p>0GMj6Q#V-sfl2SFq6)r(s_A%aokua!>%Q7IDFnq=fGV
zDse%~O`9pd{Km)D>r*D_9QOppjoXBFlVs=pfCeq@gURKjbKu<aaL7Oi2rR&J?*=gb
z%QhR{xA2@nD*)FoTAz=ux{kBKZavKV=z75#2e1qX9H7pxonLoQ7d$bv6|C-<CW2lO
zSra1doi{kQ>mR3jA44wRTi<>8{K~@x%NX;EkNNf448_)f(bgM%kGrY7X~qEs3&fK^
zvRal3#>WPT<ac1t1i!kr=*~O9>1dSZ(9fwjU)3y?PF>!~<hy=-&>Zr7e0#>Esrm`}
ztZB_JRQP8SUxsYq39)bi=IRCeEc~1H4K{%00>hNNXF`bvvbtuND$pUpbK?yMUi!24
zBTjC`y)CWXMeR*4xBSBDCFFA2f(tIj&5>q$o=a1g9*tGRR)P)dm2em9bxo5VA2oGt
zcM;<Bw~F3x+V<z+(fJ-X(x#>qmV<eZ9OwZocHYe=vx8goFlL|~Gp2q+6@E|+BQv~O
zy+2t(>UcIFNTMt^#P8iQ@enfMjRXsZ-AnfnFu61bde@zO9Rf%ajA_g%P^)I7vf9;~
zT5goj@JVlv-BHF+Z9E-s<vWp1`rGlZV-vc<X<pmG8pc)W3aBO`4VL#iCOgYDoC??1
z?RL}Bu?tt5oxoJ`%Yrxzqe$koTr=S<awDxL+Wh3X>J$!WhP{{?KQA`?P(P6F{ieqB
z%DZ8+kz)n0J%{|lzIdnKrLj!7thp{WHxw#kOy(t&yTBd5WcDepvypbkiFoZR;X*I&
z-IgOyAB~Yh7JLIu4Q35(aZ-u?@#^3AtGBiooBt2JH5VB?cj{l-ORECVcz=$f02|c7
z;6jybP8BXISQ$FTr;<z@8t>&fhENyXjFIuUThfj+fWJe`7BeK>KQhH`-SBHpnMT+U
ztd@gpWcjd4B|T70VVlmh0j_lolj%0#@Wn(X_Pl`D0mB`MA0P7zn={3n{YaJF2doR4
zRLk;3WPgrf@W>^uMm}G9YS#7rQKxyjPV|Phqr6b-1H0o-l?+9dde-G`yR|2zQ}Dpo
zHn)1#AJAY)JC^v@yFMCc6xskj$lC5_4mZ>dPY+MaazuM_5ZXQhHW_ys3%mU?ms-`(
zkKrCC-S7(Y(j>)gJb@y3VM51C6HBV4r{O`mv|;Bbk1H78j#Y7tn|j8&W#d%bWuhyy
z&Mvaic@ipQZ~v}_Hj)O#nxT~5<wu^;4-SahTgj<)tpj{5tD1`XG5&@`O`^<^h*ML@
z2y-k+!_AlUl)SXlc*ZB213N`!&7m{H=}Tkk+Ar>1M)fL!9Q$J9S50R()sr_GcV|;=
zTNS8+{Kqmm!&KGv_!F*SFXJk9G@cN7lU!{l?}xUey6fU<bE<jhG3@0Un=&mMYjvDI
zYi*C^p2hUIU5aRYgdTYk>cA4>wyu*gr2^%dG!*nuAokcjfz@7gC$Ah^*bF!vbxjh0
zAJhT9^)6wIh?bn|V}@d^aN%S9s|H)08vvAZeD1qE8P)?k-J&InZ`Z%soi<U2v-w<s
zdRrD-A^T5~UwOvNP0`(TemUP*p>sbg_8cIwhw2@JSBZud)DR6VHQW`PwaKnG#76p$
znv(aPij%K#Kj`P%D`PvkuW%vNfB!;}h{YaDE`iMuoFE>V5yVSQPnm%%^P)?-e3g-0
z$zI|GCP&66@+WV9raa0F(tq<Zugtqiy=`}Xe}4aAz`+7sz+q%WM`!LtLGhq(hLaPP
zPVO2{8})Vt%}Z)b&8mSX1qqFWHs=LPV;@Uhv5J1_?AS!zA)|7dyYz?rz}>Z+ZW(U)
z(|$0N-=!jYGcBvp3YK<!vzuo$&oF>Af3<^?C(VbpZm!$N{fzur{r0da%8X%_64Uud
z*b#q*3!dbYXqeZbMvL|Pv%;tL$8>qou}p4n4mM`?^RZNGoUW~vP6BbtZN(Q3Kl&6a
zs&jWx$YD0B7H!RT&hm*I_)04_FXBGd7!0As({uOVovah<`k7OHno2$V0q<H!1H$-D
z-X+Z^8x*duTX`AD)=Ie&1Q{U-Flh`+BXjMD=6jx0Z_(CD7`2bD=rU`}X><5Q+D1nk
z1pboWT)7%6Qp2$A6msqXoxQmTlD3}T<Ud5I!N64+ep}Ag17GI0>)4$znjJO8$(#9H
z$S5P1&aR8wa+h>HXNX#!K|u3GX}u4;1LuCtSmdoihuwkd@{FYSA^Nr!HABli*GMwv
z5}(i><{`2xq5uNv!|+d%Kd26c!{2<k$;vd=UK4Kh=`bUk$2G9IDe757e`~3+JIQCW
zYI%{(ion~GW?uw){xBi3W;K$_V;p7sT{>u3ZG!LP)wmGX(9&e*lFG~ky{-U)Ce;Io
zv;g!Rjx*ufT6E}&Cz4UBa~-1XYS;DVIeJdd=r!&#8t?f{NKC@?wt&bp+*hvxaRnI%
zsg-J_FnJFbr5a~gPMtgjBHHX#FLypqoKjSgle(!kn@&{QSGo%?(GlU2{x}$&sJmt`
z7<t#EKe5g5(={sq)R5*romlQRLUU=b=E7`*2nV5b^bz*|K*sHEb2==9uEdq-4JerN
zr}uhYKAx&Hqblr=CPY^u9Up2sJ!W_$;M(4>ij(u@4r6|)7F!|e8FS<4*qS0;`(bif
zGctIEdfv^#ZqQWVJ;gni|B<V5u#JEYMaR)o(o9m9*rIV;L<)*W5~y1TqL@$%+7xvO
z>HY5W(RTw|0iqg+*qy@2GXx_vd@L<f6=^Sm7+V>kGD=?0o7}^ux8V~bm?MxiXYJGP
zRN2|OJ9kZd{OIr#mfE){ku!5{%fUo6Qxpm^@kQih-iOUpx}<xT3B>Pezq_+e#P{zd
z@t2=0<y!St&Pa+{ONp{~#~eX*GA3*<J!G98z6?+KHqnE~B8WWU`Wb1vJjbRh(KMB)
zj7Q6@?qt<@Wz&^}Mb$#!71`D$*7gH*D7GS>_;oo?sZLPam~csyve-+$jdq50SAQ1O
zR{l^^Z7PDqB|F&8#@scU-7^V!&Xf)n`1|&ivtkF?&1I>V^E}z!CH3h12wx}ed^Arg
zMy&^-{$|qS3YMCg4%~trZ!$f=m!ab6Yd!O9aDDWxkodJghWTg5tti`Z%pO$%-NAmd
z<hxH1FYBu;TFt?J_o{-S;e1yK`8SSewUU}|p7neq#G);l+;c7ANKaL{d7+LIb#Rqz
z<MP(0h{oyls4R&04!S(tsG9eEi(F@^K6!17*RN&@r#DdK8_jU)2CexfYBCutj4*TJ
z%Jw`L<?ZUVJK31c=<r-#FD-3~YdO_c+g@aVrQq5q$85qf&m3FYek~}Hb*k~F)4`Ze
ztyYA^@S?Zd{#2gdAzAf<H;h-VN7?t<ExH?J`zfDMNe7h!wh%(4%h^H{VhcIPPHKW)
z53{1RJ%Pv8KTo17@NP7WAGsCcKoZMWOgKw9B@&?jno-S#wP$L<6HTUG5<}{Kf1G?(
zd)5~M%*(}poTlU`2wTVDT^EY3W4C=igm^u4KhuZPtj2|m6<#5SIL*^*Boa`kzYbsp
zCp@R}co@pgHEhzu_a!Z|A+Cc4(I)e(B&>4goPz3wDhnNjezwE~TuE2C<?Kr9^K(Td
zqp4x;Ig71qH~6UvJo8GL?DYT-hp1m_Sy}OlLE_gp8KUOIc2FgS)P(d#^9G|MgmVaY
zqdx^p@cmUz2mAg=R#wPEg6ij6q35J!<7Ju^({47RadFQvVbrp*k=*f&j$=VeSHP8m
zXTXT6NOABx>Lwnt+o=Ceu`(7h%e!g^8SRYKL6+m$VgeCvW@YwAWuie;jWgswT{-b7
zo}A={5pin&blb<r3UT0740b>iC9-KhUx`pxpjbgS`mrP_VcXik;aSq^p1p-+fCU!H
zO<=f^YJ2(S36=~(6l2kM6qV0@mgDu&Sc|E1mwaLbKIE|!zK04~dfMp(%Cu6P)ZU;R
z?>5|Rf}3K``#ElixDu=`#uB=NCAixR`RM(LV15SpAkR-(h99G}auuuSbcVH|3lFy=
z1$?@aTL}lh!&=vG$5E8T?qun}^74BVLK`vR>L<E;T*wJYrbv=2Z@tAM@sTvvS4h>K
zzB_SPK;_bfD@q=+rd+m);vo@=x@30*NNC`TM1?)<$k6d|WYR`7dqyO}$AA*f-<TJy
zj5_pqskdlHY)p%9H%v#hX$}@ny4`6W<caIB+|FTw>JMSd?7NEIoGlTU5;UD4ClE3T
z6g>ByQ4q}WNQb3vaAaSP5MmQ9-9amO(u(!&8;FaSsP0fS^Umim2~HmF*^JgaqMTTh
zygW;0$*~Dnkin1ZUPY0w4SB{wSCDP#IJ-OPAZ40n`mJvrwqxBm))&?bLk2CqqE@#V
zkKm{}?TZk3<c>%>GfwkTfb_c<65JUw*rn(an#Z?a+*iE*TuAo{IE&N|^7S$_@}7VL
z9#Vqc*$p1{<DS=|EqI-%W~5p6W;!}TK*ov8-S!I@_CfwUxb*1b?+6<;?aP|QMJGv)
zg+ClM3k-j2=zxK5z=sd{xmvFepM;Ze09;!?xj~Oew_5@){`GX^xfQ<U`+wNoe$Aqr
z9n4N-Uu4O;vI|8XC7ySd`*;9bhR{?-s}hvL07HiP;t!b<7*KOy?7wp3ccemJN?7dL
zg|yFefgggObcq#{n(>*YiX%0sO>9FE#NFukijpdtMgl`0JY^{$Kg`1llA6>idE+bE
ze}Z?QXDD~<&hgoWV!k5c4Rn4D#A#EMw_LZOx7mG!wZ^%sf><6LXx$hZ*)v*!TaG&%
zH(A$6Ln5o|eYXWu%JmsSUoO79%p*sqJctfg&!_!xL|(SKCWFkPi%*QLe6%Qr7ReT!
zX17H2p>P9l3AGifXh}l9QsSf@OW6O2@y54i*tkpyeVZEm(a#cEG%Ub6w6Y>fJ-UM9
zi;>3aT$|!}Y}Rj)kWiLV;YP%t!{dXdV$%xuc^gD0wEaXnLaLT40v_?1#?>Lp)J};>
zcqmQ%D}~7pmnE(%cUH1`Q&zZol<zxS1I@d;_mcZ7;^qj6?#0^*W8wP7)DbS8_ydTB
zll_rL;?q)XJ+iS*^OKv$AGqyw+MHU{Y<A+pc6byeD`065KfD_+8HtYQ_k`PDEL6Y0
zqi|tb@Hl7kMQj&Cx2xT$m3|p$ezVEC4)s~1(y4}zJq~m93%{AuUa~JJ<T^awpRx&Z
zH_)SRG4&h`XG@XN*!|x8LOtBRF;$b*z;oHaeN{=a;V31)c`Xn|LYm^56DS-5LkPkw
zbA3}@do+a9Q&K+zJ1L}*s9tI%J!WJK?w@mvnsZ<bB1eL{E_|4qyhZ05U+@HdbFU`d
zYF)=*AVSwRTIpzU{Pt@3mRKwNM*hQ{BJzAY7uleY1F}Op$}^glyZUj=PjRp`f5CNa
z<XfYtRJUeNf1*^EyKFl}#N3~D7b{+KFqT9-(1ybcl=jw4obxnkK9E4Fo#|Oc61T#r
zzl>oyw#5Y3eC>}Dfrco{Uc>0{8#ZnTkH}_X`YGWNQ6h`*0xGWCS>l#8<`V?(Vt2!`
zLEcGG@FC4pqLBBEkM&_o3pmR^?i;UYB?+<7=l*#MAw_7E&x?9`kF0p9c${8PJ%Cad
zy$p>IECoe^P(`MX-?n#1KYSo66uW2E<48v(pUAf1#xXn!={IA45G{asy`&JSnBI$f
zUos*D6L^l_ndIm^ROPKnV)-t-Ibx%oDgq0^wNW%*WL|`jqLFg0PKP6&Ms2;MMpEbj
zV&sE|&j@;vz~rJWsw}Sr?$(=c8mSC~RP8BM-E^9SApnR?S-V)Nkv;OWjJYW4${tZ%
zD!<EHH*c&oO0|R^z5Frn@Eg4?%RXg=AT72zS-f&{DlY0~I6EIJ-avlAzC7mp!g92@
zq<1{fKEy7VIs4}&p3ZVL(y6K&wiHLJ8pgu84!p4Ww!aV@+D7EwetpnAq35+PpiklV
zla=9TbdtJv<N>+tSTbR_T4^eZ?i|tmRZkN$nl%OzjaIc0)W3gH%R5uB=rfeL!=l_R
zSz)-zfoQ`xj$2W;>svMpsfB^T&1!$_%$k@Sr1p*6JAu$PBdb~ko+jDg6S*izp*W)j
zE<x#_|CfW7>krK1=-cuZJmUpo_9N*k#=Y3#J>Q3vImeHS<y5<0L3|94qMdv*E#Ezf
z{OZEJL`YtssP<mPNKvPh4HPx8tLYa+-Obc&qt6<KIPodW|7oj+b_S%JqV1CP#Zl(g
zv-uDj=Uam7_Lzj*tDXTJ%(pKPk6goK&7)+?aCBkHG~nvu+UvvG6?>?z3;h&)tr-+D
z7VHvkFCT3Xy*pb`zcGGy9OC}XdgS`zBEOxIUqrOla_q<)@#QmQzxGR~y$@!2WcyUi
z6-?|R#m5kiemXfnP>A?bs<xVZTGPgN=zb3_ls4kM=pug3-V5K=ZcNW`2AKz1U>-;1
z?I!J54{KDeWR5PAWb+TKxZS*Ik|1oU*TMKQzq^g$ypr%ZT4PBpoDn)&q)J^F6b{MZ
z>lh($8JAK!d9vnuj>XsE=a`^hb)#~o8K&t?>l*UKpJ$zSnQ@|c?j7k+d+>o{znCi(
zC8O+uH`SpA%}YcCx`8GTEO&s2&h%sGN#KsTD|OhV?pCRJD-vGQUv>#sL_^HQdug0=
zT9C~R06pmt-XDE^83%jRbQIBHJT2BN_#G4tFd&mg+tJoWzx7VD3*qV<53+fTQjo06
z4~1AQ92a|S^FmPhC5E21Jy%i?iy;V>qZ*&GeI(KGo{WSaQ@*~xLh^fi@Jv?*nRUAR
zINolCDQ%IoDSyuy)dYqU3#soavTfUd4}5KLiCyjby%&?PTt1d!t)DxBp6iftKL{To
zL0ze=7OQ+a^%KujvB5L6G4;|m`yea=1B%x_=(g?TZY%nE7yO@Q+?Z0Qq4VDa<)ha`
z0s~5U>apmo9_f4=f~M8#ma)v;p}9v#_PPM|Wj+a6*B4|HG3KF(BBs)hmL%Oa&3kCn
zj_5IF+h#<#qOyl}xnH?sf~UPN-Kw-b&0bm}La~h~pxhU461+3A58XEOb_D{DI%H{}
z6HV*W$+Ji+gJ1H0FvLw{%LkeA8umJFz}*z#AGSrV&235KXov1ttHPmCBoW;@e3gzz
z<`$!c2ae=s<QA@b0*virD{fU$rqE&W!&iFW5TCBDHDlmDB{x5+)GbOIz@SCW=FYBX
zdJqwKuEkAV4uU;4#@JNc2|PRW43J`{u<VYkSFJD59(D2*5neW)pZC;1+O{YS|4O7K
z54s*7(nvRDfQUC52*{tuFWOm>#b&WUiJzytOz3{`<0)}bDP`Unzg=$4w*_Og^brbS
zIO#UMCgpmo%^pnR;!2X{wSTEZy5h;xEBbozdAFB~Qt#yVYjRC3%~<~d!6FZ|vK#6U
z-28as^@;1FG@IE*9hHP<79Q=#E^{zyA}%v4&EqEbH!F71LB8KH82Iv{ptyv-5Fa_n
zN*jHDMdKud7LklRlz#M)&<g^7VbN0)YL^|!RgHI)r=ch(vKogbOofPyOP+G%dXW2$
zof9U8Euk?tQYtv9btwf7Zo?&$<qOIfTMWU5N*sZ)%fn=p^Q|`d>CRduvDEXXwHcu?
zwzO2c__4;H2MD*x+#CM-9+D`N8j8+47HZeU9gJ`kj>^061>@rj+U%cSRCQc)hu69r
z!W&A57O=fpS`n&UF-)m@G2w(<@k3Nk8pIPK#jY)8Z#_o9JE^Mt&9i^Lt}NaoArK67
z9VR2A_h}x77gn%bDqakFjR|SfpG_hmpb#;{)o4AFauBto`SeL2*?#ggtg*^{9OJ5k
zCj-0MOkY!n32oN^>3Zp`OSb41W8#}CFk7RjSlwD*!FdF92se>FxemT{B@fW1?EQJ#
zwbE(-S(4$UX1_Ks$<#v>sg%K)v7J}M!uafuTjM5XF_C?v2tQLYGUt{>B|nE#>8D%V
zsO$DfHeX&bY`AF`DTqN>5gYeCuLw;2i=IJDgXM#f$mWx3REmp@6b<kuaNB#zUKPEZ
z+Yuo#6d=ve_24ugbJ*x=JDyWLQ2%_PubEH!;b_|yZS0_oq3y}J6O`R4G^p*`zH9lh
zua|7&H#b}#Ttz8EOSN%l#*_|wYQG*mkF4EyyP>m{_0_N)G#iNbmo$t{<Yk#84D|SS
zL{4Pp>jL3Nl+?SA>pd~dE*1sJILi4T9zux7*6J3*<V}YGp*XwF<})g#W0M&;r7cr9
z11dJw%d#_)t3UE&;7RPtAZ5x`u|jO&I1KD1Cb?F=wHNmo&JS4Bg}{=#X3-OXn3A;c
z{1q=)ojq;VWlp&*j9~c{EIN^chW|jJBdaUcxVz`Q71j7N$6#g+46e^?L4o9?dvn*Q
zcJoL2FkUg08ufwUAu1%=#<+0>=QCG22lQCRoM+4jO)GL36$EA5%rXerxeu2>X0wv9
z^y=8iddRmU0|GN)npDiGnRlAGA$*eCP9O>zHLNgxT_E8uLo8m%T7jI|u0ky}b2(B0
zpF_KFUR`V9RsQaB@_6Zj##b2QGPF8=muJ2%&wfCjn0wgG`NTjb#I85+g1qB!n;KPG
zfI!eb;(C)Rtr8huh|?=mYw?E`p~1Jp(rGulGdaBXpBs5u1oI$444XHOT!Gfa>}p4Y
zI#K$Oiw!m{_7kz!I23m~OOnJ}!w{c@kS*bfcytReF*~`&s%U(;k*?~UyL#9TETtnQ
z^t=LvELy8_Q58>b_Bd)!Id$WbNngZ|^$8cZy$!kRb1}w>LrF^;A=V%m=X-IyQmz|#
zUUE^JgP&K%>oGQPi6cx0*wEOPk2*~$J~>eI+g<lJ&3#7R%V8)8)m-oMC=^~~&F*V-
zJ2Be~9MDmA&`l}{`OICv@Q%H9!)6d2W!feVj?{Y9NA2N#(AiS*9>-+?D}=;=S?B1k
zoE$Z#=hWwq;@<B?gdybYc470erX}I9>rjEWZ?7QSdu?6oqt88dmyDNG9{Jin525>>
z$KJgpFpSSGg0!+a^Q6w=EgQVVPL}ABsMIu78J^EIRCNZCPI9NIw7Fb5YqLr!UGP9G
zfBPU4sVtjMCL@&iJe#V+^>GsZPbR{#xCL)5yvZNY)t}tgm_7Gm$-`NZnf?3%Bw3em
zJPiGv_vaV9PJ_^k`zF*E`g(>=$*0IO1JSlYnljG2_GM(;)<gYXn`T8=96d2X>mVr!
zj4Zj7b}}_@2C5DrI{(<sxx<b0Vb!J&mmkq6a1M2EY{eZLwG6fAwJN}<Wc)hPtDej+
z9<Z6Z?eXcR1`^iTlclsh;$VEfqoV#f!|!x|o+4#$*!7j#Fe@gsW)<#=TuZ+_1w-nI
zV0jH@u)@ycRzq%4(h(*{)KmyU6j}_(`=CMY{;|cmsS}=Q*<koKR7#35=%CoBcU3b=
z5`_WTOOziP^-Yb;hF4U=ad%pMyjYj1!c-ytMy9#OdP3Ft<44q0GwQyJLo6tct4J$m
z7B7&5(8zz-4Q7&c?qwLmsE*iubnX011toImD3WH{#6nUOi*SVqo+gJ|hUY2qoNU$5
zDT$)9Pg;hu<LNg_`|WK)-Hp(ryCzbnx2SIg*h~rXJQ1J17a(qa#2?{1&=-7mcV{++
z{yxvdcmfsioh2{n6!e3*`;O!TmqKpd5RcHu%fi@kk9~KoweP*_%G7kW#yuhe7+$R&
zw_IMy;=ypVF@o}4b$do(4kQ9C13U-C9VBUcB}wBBcCwdJlQx7|ap;21TbBuz>IcS%
z%jhhyW0`z=ZyP4f?1>fG=ZW^=3^l^zaU>NRNd!M*H)m1eBf14)%N=4>MGOyT<vJ7+
z*8ok#Lfl8jBL%{zwAMk7_a4<gpYTtY=p!BSIAh{I=yNwO+?}qI<#XC8JJLR}aL>Db
zw~W}tBA<YL^yB5KUu33V+}32SbZa$mn@9;s7BX*D?jON!O?9JS<O-;*Q7@=r(Vd1n
zrGeq7sodw{sXi>WWb%HtYhh@u+zD?!#?d>(R@&eMKeoB-IxFZsVFW6{9^Y&u9~m#7
zc1}WRC};y19(wvR8;yEoe6<LGD3#tgy;p?ODu((oeFAXnmzPR&`byuYb+~f{Ito&@
zYbyfElemMN1l|fKbRr<Mi1;A_PRnhOr-^W*qEm0byL;iY3J$dm<N1#U`%CiZtI|3T
z_%dt_mbil;Jv^RjV#%x<0sagAhm;R=?_B0}bUthzXlY2Gk&uf?%G;fPR3m%+eB#9H
zx1#;;^P1H6o&eGCQgVgF$|i+6g~n{8=CvQ9nIB(AUWa{&ZSpE4QeqHB>V|x2upeVj
z`ljtBuga!=sk&sqWPvjS{^+OcJN(uCtxAF_YzSJGc}G_kwzFKK(^mlov4J4aF>ikn
z(PuO-2$P}&sr%?RVjb|%Qi5kipwL$ET4_Ow&*fLe*O$VSGwOR|!Cc!%$)Wqsv$|8A
z)@zyKA%%HU9lL7bh3d_oZi(DBx+=PANat&PbZZV95pMj>Jr`CDek&Fy8<D(PE}gX{
z{Bw4eZhWw+r>l`g_G=NmGtP)-BL(+wzInc9hV3)%uyn_&OIS~?;JB|a#m-vXczHN~
zefAJ)Z%xhGw)(D-@90oE@7_n!t8{`vtGWj<)tPqQGy27?exls1nbZ45yxo2}#SIq5
z8mlX@((xVa=DUKl1-TNR>$vBM9g2l;tH!-&xBk5LJx~(f)&04dySO{X!7Z1}J5<%7
zg-k6pMn<IB51Q7g0!s7;vsX2hWX-x0>m%2y2Q2#&&3HPm;;pA%Wi?+=Zo$zf6d&KC
zqYZ_xtJccf%aInWh|jue+P9jqpIz;&=Alrn`G+MNOU8b%-~AlFR$L|gc*U&S3TJI|
zKsW}X=To709c_MZu{v_esHf{@ymQu+Hej;O|HgXZN_}`oD^E(K&VIu=vBAq!X5(6a
z3E{m7-c`f<;qX*N32mp?l*VnX#KXCBb~kl}f=HJ5n5ibJAHr()E$+QHcThd8HQig5
zykjNF&VXku@!cHh&Mk`PFZd<acUn9JTka_?nz~h&a5e45A0IoUgQd&xT3C!7cBATM
zmi5Y}-Mva@>zJMnY{M)<_d$v=d}V#;)3QziCjP=L@oV<`3OuCS#QCdtXG|hK%XhVx
za==I>XGWO1B;zfm=!4c7%+(9_V+EgjHvduGKBGmbnl6p;wZihT6yUdtf2Ab4K9Jrb
zzN0qrocYBu&gXbRBBLU=j43v^+@5)^Zs|6U4}!IF!<MUB1ee(bAZ<F23gh~uwc|la
z#)a(&Ny2Z;W))&-RLVM(E8%n%fkwt{JTQD(tFS2)tyB#!)#rR~b)bAdg)EVX#?joD
z&L9okd!T_3Npe|4@-GpGX$h$jLXgWT-gN_yiPBW1vk}Onx=0x>(&;vPH@fF|kX5*?
znhIe!jFmvnppnl&d+?H*)S+n;kF@A`TDD({v&h?C=dj}oYX82Q)rG@t%M<htlr*Sj
z>UlFgOHqrSD-p<Mq@%@X?$oZI$Ww1h5r#%qU2zQ$QjD|M{AzQ?i?(rpnH<xw&R5rR
zAx#)kov)&bRcbuLTz(rn^>BYyF&0f&MU0G?+J)3Rq0($YUO}sAxZO)(!?T>9bY%?W
zxx!|1u`4f(ToR>v`<}nL{+g9Rkb$M-1ef%ibIN}61^NQwISU#0s!&j%SiSST)m867
zug&R>df4M;(7ppuWFN0fv6J*P?wGS9eClrpLpm+zLqE*)rWCx^fgI1E3B3!N@`lnf
zd_Fs;p6~7H>Ud;iTPx_Y_}7Z7E8-awg26o2GM6Z!(YmbJ81j@))P1FphR>!=f)6!G
zP-=?tyD0?>@fjXFD1AjBP1`d(h(v1`(NCiBZ(zvmWJX%7#qdM?nP#^2n7p~>`+VZ>
zZqkn*3M5C|vv}}t?1xv|k;Rv<sGJ>b-%Qy49C^OH+A@A{@9uMyFM0QTLqy|?*BrXQ
zAklc8dK`{Wr$6H5K2(|0`sf|O{a(#aH|%l4ahn}ZZ3$-0BC_C{yK5Wc-gv#biTiUW
zpT?%n#->-Mq?fY6+xMITt>-h-dfv_}r9lDD4QDa2{Ou$s!CqlKlH%cx1~w+Q%|iI+
z_p4q9d`ti0OAti3C%98qoV!qURprs7f`s{mEq@C0d@d$Inyku7awgz51@XmlBMf<M
z;x^8jDv};1(9Oh%2uI%g^e%2GkN~4^^TQ@mH^kU|cj{G5rGJFJ4Y}MA(8dXSz3Rhj
z^p=p-P4&<F!Nc$$K4=fg*q4P}x;z5~|JLLse};Gl>I^EGcI2Gf<+K!i`~9bS6jE6i
zuA3KARCwTvwauUYqTNw}q-Nbxk^%*1o2^z!g7SPiXPe65_C-Zq<l$W3#d$wJKOXcq
zT}yB*zRma?$IE6+k6$1|2mwoi&+yyw3Al#G`9cH<CBB1T*?pz4S=iRXa>U9e8Br3&
z@@Hx+y4MO*_ecNOc>ZG#`&%FS_qS%`5%l*TZ`SWtg-ckDE(UC`H|;EE8S;n}Oey^+
z>@h*nO4ZLnmNW(=!{hkRlbFv!5v$!}vJ^KU^1LvNX2_n_hCIt`b0HFK{C6)hc7%k+
ze=79+)A4xf&5w&NzniS-S-l%ttK4a!n*tQG?Idig7kPwE5#OZJ2)<)ifta3lcUD|s
z)H#AdMK(^8BRro4p{LTy=)UA&D;CQEx-GJb9=o``jqkW6)xgR4pPusfhWqayl++jc
z>r`Htc-!t{$Sr%vk>xeQ!S$kl%vF8HVx08L{+oOJWO<N^NyXFbE>p3OP{PH8dfZ1}
zR%{6nS>cmnH-sW`q|P6|R8|eJ!Kb8V*!V1^`1T~tFIxWkpg(`Xzx|Y)7h!6N?B48d
z<U;l8A<P_+ZNt#aWn2j<N$fF|{ocz#gOvm?OI`^x=(aua{ORCW1y}=Ea^*KGr!vB9
zuOm7=Mw+XZ&i^k@Vn%47Ix@WvxuNv}!&*%E1~fz`kv|}7U<XaR8eUE!=M7bL^a-t5
zP6kejZ)T5C%O_tKd2#Nw|GA{_mxk!y-oBI|mvp?DV%;E604*+b__P)g-kW>*I~Z4h
z<Ry?b<B@N_m19;IDR+Ub6m`==%fG9$AeL=m2(=O-lFMebnZS#|PN7#OV$mYkOE-?w
zumHTj&Zb`qi9h~efBPOI=n=LK!w-{yJP+w>+u~CKv{*sds@8{S%x~n3ugG!Jd>u7l
zq3^*Wgo{S<WLOEF7NMTqVT;sZ8g)5L!kX7HIdk67o@A5%!?^r4M2!4GKlR)U9HviC
zu-=<%Gv5?R^N@(2W$I@$cu-mKx<OF`yR@i2QW0VvC)gj$hqFJ5d~F;Q39SSX8CUQ1
zoS6ap+dqAVzkH-cOsSwZ5}n8^oMCydNu%8{O7A7^qJ>)XC_7ptz=n5(Aj_#&%88!C
z65St?K;3%@uZfO)`uH`X6^cUz&nC&^+hCJypGxEz@=(3b#&xInBm-~X$pTssX^h3(
zfk>*nnW+57;+Q%CriNX58J`4%?4yWX7ey4hri0WUd2Bs(K3S#sEL%D0_Oc=|pHa!%
z@tFts<9)^#wE1XE8R~N5%K#)8gvg{=z=&NcDU6(o%D|a@!@-L~ugu5_Iz2hFBDKJN
zPSN1(u+~joGp8heg-*(}#xR?ZlL-1sLJK2x5zUB4ZF@sUWA|~WEnEMmC|eyRq?&^c
zYBcHeb^d_gvbZiTT!21aM|T?S%PmFVi$2GLw;iH4LN6Jfg_=`dd1k^m-NPMsDe$x%
z&1z*@9h*Hb{dr%eL2YQg7eY1#A~{TNF55eNpt|c<M>9)}_EO(Ok!mkXY?mmH>Jwfc
z^fw&D0%{PcLhLeDB_Bg4-UZi{(SB~VbdV)XX5RC1HRB6<a38qHLdJmK<0_dzYecbH
zk!!zo4_X1q+w0x%_oiPv+Kr0mcOmWScjESNCTaDOauhn6?kW^IF@#_5)UL~D+d?XL
zW_yy(JpMX{-_RrfP&`&_w2LIZx42Z?(@IdR5;`IO!8@7T733#ODv5@JL1kEyNg$fe
zPGvX5Y0Johihrdx(aoES<{p=uddRlQ?o@!y+*1S_^}Q``hM;d4AW^WK-DvyXuV6~~
zy_uN*vbO6W(^;y+Zwv#cmYc7+9IuYr9Ruk-riJ$11*TFhKeJX>(Boy3*PpY;YDtu)
z)UEnqhsc)BMlNa8ZQs7%Yeq7*y(c~HmaUMNCnqrxYI$R>+MqLDtVyy;E0f~0l=J?6
zX?@@K?o+G(+8%X?QD??{xz&!Ey75_0h|x}Ui92%xF=pj)gN^Y`f<gK6t&7g(FP&KG
z6Zy4f`kJ?#4-2>rcOB~*3?E<als#86h9I5RdAF_G7erb8>h<8D6U|D-F?sdmD4RWc
zzZo}k@RdDPnN8~+b}(I|m193fXtop!Tw)SmuZS<<gqyp}lh4%Hpj%FqE<iEyfxF1l
zV<~Nqwi5dhrr6bQd}CS1=Wvli5KXG{0Fzzhtg8d{)>Ku=P5oIsW06{c+DK%EV11>N
zhFt39R{__B)bgu5RV62wVlopT78!!H46cdYsgx;cl{TMAOw}7#5ZixLGLQ>%TRzg4
z^S6>D2yw8Dn+I@m=+UYCm(o*IC%SIBPtZ5(XhCGzV7}Z0Vhl>gvX(8b0<|o#<$PsV
zDh!bRbpL3cn{{p3@0iJMg>%bBKjGx4(mwxY!pE{3K^q_#SHPGuWV(n<=Y3qT#MqU}
zP{a7)q7bN*hyYP!8j{%(bWmbjGA`?R1qHs#7u*3py0=*Z<9S7%=X(<h95^@RVh29o
zeH(-eVuXFXFVA*Zj88j%9=DsOBQmkms+Q==I`7VYI}htD`+tm`WmME}+pa}WK%~1t
zq#LATq)R|RN=mxBTco?Yq?PU*I)(=6ZWuad=ppv_*4oeWf7jZ3t@#4;3Dz&}`@D|h
zypR0iHTAPtl>q|U^2u!UW6LgXtpeH{Y6-KIi&IT&aRHC5QhR)QX|kF`5-b*l%%ips
zljgvI-O}e~tD+hI4T@B=fCy{#))k)0s&zkTaug-c7g5+HjppgzUEPH94GdEdl&R|?
zCzq|JBR^(^uQz8HN=c2LSs$;aBqZTxGD-svX_ILq37b9LA7;!~we;?<NzHmrFhzGh
z6LVV@ufRvqPAeDmt&SbOFy6&>>!$L#quW`++@bm*<I5ZvXQ_UEU?h9HZbrlDdvsU7
zd(*LrfUhta?~#mL|Acr6+*q0FExvE_r+T&O{-mOhw-Pr(=h;R-Ow>g^2hbo|>y?lg
zeQR6-ZmO@upwX)3CfmeUa9u!+E-E6!UJ>wTExOH{(%}*9=<WWr6anx)Vx;x1QRs?q
z!;jCLvvbVHs+2>9D*TYUll?1)vetP`u>9$(Q%3fGe-#IO!5Z|K`>r{fUUPvWPVyrl
zlqhDC4SSoCkz2&2QRSDoz#R&&2TG%{O;>z|;_xVi>3+dT2!&~}HSec&ipmO%JDdHQ
z*aWQ}JX)ryFm<YEtrANj&Vo5CPfr(a2Np^pvq%xa%|u$ok^?keMta-31;YZpO9q*q
zljR!hf&H(rB+m<!!l<sD3uOjW;Wf_`_%J+ps@9g!v))(1(|>U}03Dci2v`wc^LT7%
z&M^)!`q8&!FgMuVa5zL7xo0ldI>7C?qXOb*?}bxtLo$@WGhq}R21~?lv_Cdet(Lxb
zha(e(lL*MN2erGeUgj0!jQdwU_kOvyGHBB`mZ@L$pRlc!lIw9+&}ATRy>#r8Dm4Ku
zs7M5{ve*i`q~`iPh@s{VW+h|j6Y4p&(2PY8i0HO+uqQUH>*Db~#unYUjlMs;y(83r
zN6F%^+3^H{N;0Y3#WG$HgX9F|>91d4&f2wVK{g|93iT_PYBwjY>=3rM6sqE4^zP;7
zl`3}N#W5ON3?j=y$-3=V_sqtb%T*xLst%1)AWYO#lF+f^`IHpgVxV(IdJ4s`B^kkK
zr>Dkk0Z|z$p7XZnU#bfderPHWg6&}fh}2&n2>2b^q{HVnzaAu!`(s3uysjzPrs-po
zWrXS{`%}<WArV|J;}<JUd%xo;g{))CP_SmV-K3@(q|su|R_>j85-6M}*(?+`06Dyi
znd?MZ=7Zr-80qhMb31{%r0F8Lk!w{rh>^}=)=X3Tr>$s94^GEg7g_dx)v&D+mPDkH
z!)Z9;)0pCK`q&pzq(0pmv+@?K-D+EsQ>!%88+x>Mgfhdm%OtC=7j(2z*@AN)|0>_W
zUk|)D;#NV?Xr<y^={}zmXfi~Kw!#yN1ONlk3e}pPrW$u8Do^?apAEFHt-@)8s+w!F
z*b-QrZ&0OMl<@5twg=A&V%SnRm9LX669)!+pjO2T|J?;}=UlK9?f!xowzu_as$5;h
za<x1llTf?)`^NEXg)fjv#j_%F-u*H7dzHf@>r~zP=ilD`rgsvAt8wMSy#u8O`IE%v
z*=6r9U)()R$C9Ue_hHKnq4TX*q7@bt*+zz%^o9U>)f0+SJDX;r+dSm|jxqM2r`cae
z;7$t_%dd;J5&N9g%%MY2-2wC;Oa0$eUCS0s4v{E*NIvhqml?Qw2%q919M40Xg8RLW
z8Ekj^&~H6!&7Wyfd6+i<6&($7C9*VTxTH37yr%mOpG13d+*ak{1GEfxER@a1;)si~
zB2r?hk(^R6@<GxC#U*m{RJ%5tA%D1wbrO{Zw}Yx}Pd>+fFme-6YVmzm5eUtGPDDrI
zwO!g54)m<<+{jnRXIXKvrtLmDhE9ma41-^A72Uj`bv7GIu55ojbU{xrQ3!>fsyc`)
z-*xUluB;^V$U-b=B|md?948+eo3?+vjey(&J>fHGJ=Ec~cf;JgySjpS{J1$?Rv<vD
z$|Y1ypjT&fzjB>&-;kXraK+&NS^buRllt6`r4ZziBL14jTH|?VN%nH7N^N)xlbVB#
zRa?Hj>pIR{dlR2GTyx{Wlb!hwmrNy#vuiWM?gu2V?LAx5o=Y%!{QOT9X2#FeKg;|J
zyl|SV=6S07U5W4eOavZB>jHt^Ge=|k>W!n4#;@($*hDB3(bzji7d;{Hk3}p9X$wWp
z4gJ*rXMh*qdVb*-Pfw!<wV3Kc42tNeZsIxvSL3~@1kHq#!u$?tbb*wZnbODV^5;i)
z;u8IoxNel3eU`Ad-oPp{_+yBTeU7(ku?e2JoQqR%9}u_H4Y#BA67VAu`)4#BZuET9
zqPUqk=bX+z4IN)a9;8jxqYkBXEEIA_5l-Zuh1J~{(;RbH8K|}|u6tV7&;&ASRYlU^
zf?}}3TsgqEfx9DI(b>-9?H`*b&dXn&ofCB_^$VTGBOmtB6H<>~bolx&s(#7FoB50u
zRGW5xIdZx(F7*74*=cP=p&@o+EMxP0pf|C<Ah>EQ-rIT(?J|LO$@P@6YRp&8OhklL
z>%~%WPF7rGdut;haM!p!ttJ%tLr%T3zMm4?%&TOV;2Myy>kM4`D9wUlwFAsLswbn*
zpfd#`8eK8owo{4h{IyHsCLA4Aa~ur2!v^3=PBbNLRC`)Hp=%`K(zO#7d9j@i-ZNSm
zK@#GqXmD=!W+mT_tuUk83aV2S4wT#clVjQjbr&3M!i)7W`P1Xch9_q;NU@haPiR8t
zbudy&*^x?^n|T0iCvCDQxf%Z>28{xPLSm9ja&yl(-i8Wvqun~t>Yq({qr4-UIP+^4
zM79s&Fy}<(xK6J-D|IsXHjmTEh$`v};g_k-E$!s2Nl^D3VwOjfbh#O?AnzV+mh>nH
zmTLb?-%!|HhmF)do$Cx3O{q<^(;<e&C<uIcqdy0X|E?))!U2Jw9x0y~YW3QrdgK!n
z^X9b6aC`NP`xd0%_F>G^^<UT40nh7yxA07O4rw;eD9`DIzWg&Hn4@0b`^+3_Wp_Fs
z1}VrPtg*N>u_B(*<0PMx5MCI${t+YWAryfqRvYs&(%AA=OfT92^pyFJlHi%a#}`vq
z<<8^IYo#G5Re9pyq9{dXYJZ6Ae8Ifx=z&(NC$^rt!UW}keTjc)C^c)hUkhv&CUWC%
z&yJK;1_g5nz*eByd=NO>L=D_~yBY3Iw}aR>v<S{(S60k5Ikd|aQnqu)0OdL)e5ttj
z2`!hObtXiNBk@d@<aNp$K)l+8qwaY3-$$qB-4#;X2a<6+8>N<Ic8lQWE%%Ht7GIRC
z@XU`8=K3=MUs9x)c%)NE;vg~Sc*mKi>id~~G|N=d@E)`Y^BIK7%+z624N1(_RjSSV
zRWen1OGJH+$@1G1aLU^97Tf=tteS9;`8H}&j@JwVW~Ykdc4rEh?sO-#)M{%jf7~^{
z$q=x8-}V|y;mpz_<|ehBrhQfo3sYZM$NRTC<Bodb>zfhh3DI5syU;IEZwLiA!pu*&
zRBxRR56p*QXYII}&Zi?2M?AT^!#$1E!`_$C9)8=w0uL8{PFFm9{Or@sA>!#l`OUf_
zMv81xntPGt-oPw3=^&Tb71C6GCxSDTK~NOFt|o162-l{56utk`UCBq)U{g2)sQXA0
z8xiM><%=a_$cX>$?hV{t=u^Q^*nB6o(-pW4`cvt!ItDo;>q%Rf_|@zk;y`9QQvlhH
z)sThGWxsSfWM~g@iw$0;S_#Ci*nC*{5J^a%;}SvBVLZYgl4L?nPr+z$PdnbpKP_Tm
z8h-8Zv+-y~p;(z1Jg7DBNJHLceH(7B#~%t`qp+|pyM}+o>pHq`-d3KxtBqN+j$VEF
z6{?Y~i(9iTgwO7ADitOXrZ6~LlV~p2TWq_cgR|);5fe+nDNFHdnV~tgcen8zTS$Y~
zehn|KIoB5wkCyDb*-sl-`pp6IyJSSivFGh8`HXLz@o}{D_<(*>i7Z@#9~|T!o1KL@
zt1QJ@0%%D=cFi&p-Yy>Xv7>%_a(Aj=xx_3%drn@8@_E^2dg|`&p#$?A+E*?)4+o(A
zyIGgSWC>pXeB<O-10FpBxp`1(qeldoxw%r}63?kq<XfPa>O<1>mU`?k4Ozdz62=W@
z5JXasqf1DL>{+-}{0*`crjWQ6)?t<8J(X|b9{f!8_#^vPk>Cvde+!E?{P7UBnHHaq
z;JaO#mERXt=e1-YNL2=YyaR$j)_bG7M*8*P7XcqadVjE?Pu*gyGGHEk4sA`b&#n_b
z)Fw@${`-CHatHT5Jk+ff{~oG7IM&89cW5jzFl>J`H}nwY5i;ZZ*}yPIz_=FrKB~bL
zmaQJV5GC>Y+O5j9lLKa%F1#78#p4dNJ0ZC_pEx?G`9Z&!(2w^1xIF|+s{ccpsa@1R
z$Ge)&j=2vaPn!q7!axjazR04R!qD?c8WYJ{twa@kZj61<27*WsG#_19Q3joo=vSrg
zT?JINqhV@Q^<vyx7x)Rtej`mau~+JDRQ|qq#D#tO$@gLN4Om^STz$(HGVCb$auF?l
zw)3VyKC2=rdENhLs{;oOk6nN8P?40cHTdPR_(zG+v{3pWEDE2vdb**3w}Mzvh)HkF
zs9)F%4PXZ0Z=xsYA-Z^;WMWapeLH4eRaX~%+>uBx%v0V6n5+nq@CIsSEhZPlG8VtT
z%BU|js4V0!Ja|D{Lj@rsoY;Ta!-~(0>=st02((&0FPC1MP3ypN++(yNN*z4Ue`Ou!
z>Afq$ktV(sEmbAZ69YqqP;O-eV*tsi!SQgMYVg9Vow^9irLwuU94HE?n=et5g@o3)
z<P8*~djkue4p-o#x7T}U!d28Q743npZ#RFFG4GJ)=OogFp9=~0wh1rtY_Dy!W>oKY
z17);OP@1{N1!Z!wc)KI&R&bSpzTh=Gu`sP6l=)caK;RDkb4gAXgVcu<?nnZ<pk6Ao
z4`}MZi^(P#`kRm!H=mDhLz?*xpbN5|ey5psnVc}5k(7MFy?r4xs)cuJ&>{NV;!US}
zB*Bz#F^_WL7eZ&1cG}%fH|u_`IlngycL0&@D~VX8DEhsT2L3$5nZPdxWqNO2QC7-L
zR$Cha+#h{;j#`O;9#qb@w<lBs4~!+*#A(z|Fyz*K=Sk{Ne&zL_R7oCIOOl$gal~|^
z0lGTC9?FBs-hQyD9mi1V$|X^*b~NMKn`&5!*Mr7Za?A}Uxc<DM<@Bb{Cdc!-r5oNQ
z_mRvz=t%Z9p^e9n!%(61w<d%)Iy@E(KvSmkxL)S}HeqD@Zm7r}Tez6BO1paZ<h7r&
z_W9M;|E;3@%@Sq5e{{P8`DZ*w*#b&(D0NxDxU#2I_;NqLzmq@4F8eNq@|DJHj0j{C
z*R@cfuNCUjd?D-=MO1BuD`HIvr@cnmTqoh^Fl>&(OM_znHV(UMkCq%MMqODFi0=6l
z9FP^Q*^iAPw&i{O2UDUyaZ6q}$QZpqBCB7L3pym{G}gdpsXP9Lq|C`MiKOsNjf*Ek
z2p)@esm&zYChFHxKD&_t*DQMKAp9EqWw&F-&9pQhBD92>Fwu|Djg`7}tjAj|*eBm8
zEB?I~wa{HcbGbx<6Fu1GZJh0rdn%k;p}$%6t@ExRQ8uAiptN1@@wH(e_>vM@QijYx
zVJOYeuOS;k*y_RD2^+^@%r~URl9d(ymCB;O5u<h|ktMIMg5e((6G!B6DaLitExfgx
z^7)MGIxZQDAeQ0U;}WMJ`Cb~ul*ep;nq9sT;>dtIIHWA9zbQH=rC)3P&DF*~--~Q-
zC~@91>nlYb*6pt^Zo3m#M+Kt8DG}ttq!-_PWP5GX&JF2BXI^=Raa7)=We&kxGY=Eu
z3gg;?EW2p1of_>Y#@Tj)82*fD?FpL8gb55^z1u;2kAE``J(L=2=EX^gW!%CZTj*X+
z{`|`S;YkOpjW63xTQ=Zl?4t#xek+|v!Bgcm^)yu(FXP3~JF)VQ^|mwpD2bA{hG+s>
z;k_K;R`B`5NB?Fc?KpMGSoS}kS)*Xet`A$$8Bq^tOlI%H6y6>P*+Le6hVgIoDTYJ|
zw=UGgIII@|hJ!!ohM?X=1XEC9lER^RjWh+Lb)0I!W1$Ay;z;gz%<W(RTdFc3tH~8g
zAj4JX@p@br+!2`Lz-gh)k2(@Y{aCdAQ)Ov_uy>J7<Rf7)#lb>vu+Sanwik9{x<Jp4
zE3HG@jps^xc-K1&<JYkZUxKWwpJD+&n)uh|YlsPY^n+e~Qkr`;qUW`)TVbyn1dzA#
zVoB;7PA7p9VtNxqNi&Iccx+m$Fli@ea@}-w3rgdn_6gizccyy2k$DQHS+my?y+8MD
zxw>u(WLbNS;$P^fK9EVRD>Hyfna1tZ=H7(CwR@0y$p@7t97d!8;&&r+DYE#)lZW0!
znZx#(?pCZf4*u<B)kT99`Eh_-x{KASMdWj@UJu}%h7vIut?79JS)B?-r{ykLCWUuQ
zlj*U*02}XU3|(Mr63tx4MQ;3xh)-#Q{q^FssJM5E8&c)S*lnQUn?;(!-(8&a-4w>s
z52^#w>8QJN2*X%)mY^MNy<rchpE-*qqDH1>vBta$NQa5a2IZA>dKp}hTZUFbxCx5F
zGWi+N=L?$#3Z+VwA=*u_a}OUCmTljkV2=Awa+F)ptyuyBqfj~=6eMB0BOV)yU6lw?
z%+@}rFnmvM3f+r7-Mifn+#R2R$FD;=3i_D(%%MbHPQxCaMm=h5<Lp5MJ?{rz|LOPC
z`x(TW6CXF1d6l=iwI#S41pwa1h|qkXaeLP|sum+`B)RolTLz#c3BabP_OwmI{04us
zLF$)&KJm=2?(~QdAt>u>C2UIhY(shGxR()KZ~B~eb*ZeH>{hqn$G+tu@tf1MLU$*?
z@H5ie3Y)A(b!FcmVQK)2sdMgr;^cV4t5sT{yn$G}wOq-Zfg-}|M!{031c;xsR<^!|
zR0Sjl-*~i${}T7fh{G^Y9tjohHtUYM9ZZ?%aM<iYpu_TpUpBa5>(k@>%qXOWf|rOt
z_*O87Q&{xBF=fTkOx&0p%LQ<1{pb#rXR4UQ1Yd0O$*MrwT<z*)1jc6GUitW5+@-6Q
zFI@ac6{386x5wR=hbl=qPb7Xj%(cto0upAHx1LBFkS;$S59=fuZ>lDY%MYb+^JpF{
zy1<~zlBGgD-xf|oRMObuI!3j+B1-K8>D@iLr_cr!>~|2RJ>70I321_)_V5T^VgU~?
zc=vi^f;7JY_57!8#WLUbAnASnX-s(rHmP;o4x!?8(!!jAgi>})=k<5K!8YVXo_Zvr
zEiy(mTr1y*MiOVmI;CUrU<K$lg_OyN?m&D=dWn0Mg8E5h^?){>-W#{L$_egke!UU6
zr__PriLinYyTMGp+?~&7v*k~QhJP@7d`D7PoeX}&CU8yk4+qus>W!{1_y~=|Us`GF
z_N`YKP2YxrhCTKOhVPa5Ydnf$bq4ee20U_Bu;IJiD78pzo9hK<^7Oi>w{)>YlcV$=
zv6<(~iH9<(+iVec{y6CJoj3nFSw^9byRc~#p+Sqmc8h0yI6w7}8ACfe5epLB{2+)$
zzeCz7F91TZ^hOcK^u62=={=DdBpmx97V31_<90cDl`MjzLy&xcafvC-VL_U_j|VDT
zw1_ee;zG2T@W1_&EjF)2aL!*$fz#MqlkL*1c$C<H`Ek?hVyQ&*9zOMgy+tq*hEyxs
z{P}BpqdO(fR|<rX=~hUNJA!iYX7}X!m7@h?M5tmII0H~sunB;BDf`S7z)}o^hk>nE
z2tz6#+mW4jcQjULuo!%_n4A0@*y2C>EXwTq>9@;=cZtU&p&U_GJ%V&*f!7|78S{m0
zZZ@>QDf_Ah38M`?;-@r1H>&fn&4|LK*R5D#K3H}+1D&7XD<UTC(kPr&g`zEV)BHvQ
zKYdn0>$hJ`8giV|K2^K%o69QicwcF8zndDq<J=Gwr=a$DE#bGZsAz#wy+soMwp>vc
z4o&SKztC4S9sL%Isi58bGA7=6yp8HS?vo4pyNo~n)D^d%adOfd#Xc`0qx3F$1d7{{
z<4RoDP6njbcsAf95*u+h#x8hO>l+hR@!F(*c%(7|m)#q3A0c1Fg-4Sr;PlV!dMpar
zTSZMo&LYCNLg`&QRL{n(t2(7X9{Pk_FGZjz@4tkiO6t7Z%-E=T6JYA7JG9O7$Rnun
zNo(Qz#~ndjX%j;R-99r~Uep?_6bA<65x`Lv&gqla_SIcV@)X4sGa1_e(;sE=*M;wZ
zIR-^mW51+cmAS7*<0tn$=nXZ97%G;tw87wMBSXtwV7<laV(?ZMhNI5~ymzNY-|lU7
zSTeWS+ROE7j_bdHvESDQu0f2%STVC7NO?wD)oAR+SmuJc@W-4*7=6$c^|dWOfrA|_
z>z(XI05bW`0M|BgcVtF?Yjtzl^dYfs>8LtMj;W*kcII7<)O!?DSrwGYg>&90S5c#I
zT{v+JE{f%Yk@;E&*L+nZ<a|;xREdxEgXAgTiU!TMPhh!Mtrr?vhS^f4EX0=Pl%Zvn
zX-HMSJ?by+e7+{Vftl1yRAdEr8sO^6OkezCD%iF5F7D#(%a#QEXB2bGowu$2e9v;;
z0<IDkx#*{}x0*+tCk+hmG=^e+f1?-A!7e-g{Yjz_+XZ`?&uETBdLD`VkeH*Mw9(jg
zP-fnyz}R)#(x9xRal!in<ro(!jBjD1yHsU)ngkMn>;<_nd8f4R%C~~!!+^nFZFM7(
zW(uPT!HBcAZ{|s)&<{`j-NagWz7^G+#n9ehk_YV(sp^xe#Gt75;P<;ekcrU><3Vca
zMm|IlGNeTAg`rO<bZEqas9q8~gH~tt%4K4x2}pUYnF~VDUG)933}_xBgpn9Ic`Y%O
zc_N8X5!})f%&`EnOt$<|k81J&wpWahcrOBT+Kcmdx_$6n8JBvnY!hZsdy7Y&H|ui<
zTqp;B=h{TBWYAN({f_@KFCY}seu#>4*WIGgQ4)fqE$|XXP}fvD(4?Dz-TJKsr)T#{
zeUDte7RQ}P&UEyrjLpbbc~P-yXV&mKonM~~36HoJd4AfJ3-eirK#@9+AyeZNg@78p
zu`&@2|8a$h7NSz=U-_}2JoA%bgu)EeF+y%fVB!24l`kS%XTNk;`?qPOZOYG80KydT
zAIGqTuw1@<y%=YzDRqpcmO|xrXo-0=J!FmA2=`6ZM;kPvK_w2=jeUdFFF4);PUu(A
zFIp>TApL;dljvZpz40rL(lp2d%{zH3Th=4)H3{Tpl|K#W0CXcSD898ULm4g<qv=zQ
zh3Wn0hbH2bV59J#ixGC=qpd<njqIu7z^gtg${TMnSbD^0nqYS@>OnrGY`qi~itq84
z&dx?Grfy-FT1{$Ej91k4bgV0R9_3!IpQKwG3_S}Qs34FEcV9?qajDn1IE_1Rj}tde
zkO@jq+&==rUxK`2=FU&e^z+x+NpcCR4%lbZ_;afHISh}(zWYca+s`0gjs=hic8ZB}
z`5i0=2zK;DBJShd+!)bHqi%QQ%e>pv-!u02v8c#mtBr<p`$V7#QSQ}XOhFy+=O8{z
zs%UMN_bxA?m(|_AtIMQOk9mQx!K?esfY7IP+7)x-OXFWxqzw)x0O#4MrgfJbpoFwi
zQtZ`D5av>FaO}pS@EgxhVdO9rQ!RGhF%i(?_!+h{dQX=0=w`oH^gmrPIN3-%!7*S>
zB4dfkUGreRU_H-2+8Oy=Xg{Y+wMoR599>UtJyo<Q#OZD#B<<K_C+u0%WUTl)WN;hF
zauP*nYOlrGwOVW`XKS?BOaPTqCsSkoW1}%s8tb8o68RC$Bgfv_;m=f>ON{~wFZeBI
zfOM`O+;=!@|7%04S>51-9N?7}f)ggZLvKYsp=P88K`5v`5BLC7hW_GXv&0Q6&6CIY
zU_09#-x$QzrN(oee71%dGNM$0Nr~t<PzKpVzV;(Yy~-P?Fj@LUE7s5{kX#<H5=bU-
zj`HMrrF^f_p1OK*%h_wPu>U)TU#!HtgqO|jB8iy21seR8{K*3#Q`qw6p1zFtQx$yH
zY<_>9lH7l4eDMQG7`B3Qx@}+6szAURCr`YCWk?-nzw%Q>;kP!7TBh=$!7wmVITFnD
zl6a-Vm4=$`Fgh{Uam{c2;ObzqI2<;axfq(X6X>UlhE$6>VIiuKRC#X59F`luo#Uea
zo%HEJt<}xqU~6BznZE6HjV*R*VC)ojNTFk-o0n+jicGc<z{>0@XNnVHQ))S=zY7Y}
zyJDayp8pfXxsb0yE+c<MDm?6&CqY(6HJPVq3>LHeE9lg0(<rXq{^(mR-A2o|KQ|Up
zq&=VzhhN@+FT!t-tD<pv^S?$fiOFJccgYO#&o48n$MYN(0h9p?Zkc}j968mpoL+t3
zZUQQdK;&med*b;MUS3vou3;SnvBHO!y}>|1Wv%q_RajZc#cM*QZyh)rd%m%3w;P;G
z9qI)Rvq@7ckz<s8U91D2{35*Vn|jmIHh=rcVv<H5tyiJ(y7JicQlamD9`uCb8aKid
zVn}pI*us2I`*ee`!ol+`(Ut78JZCmtcI#DY_;l|4IcKKs@sie=L*;A>Et|u9GSP6~
ztJB#Ay-6N|el3;^L8vKu758B9abES!ckF-|+S4`|0pT>zweIy)p{e)p!bt4CWm*Eq
zR1DVqQ-d;N7<`ytvB|<@^(*OJ3T@(mNS=ukIdLVW(DvG1t24UM1Okh;a5qg(6S7fo
z6JJhdon)hR7?shE6Z+xNyL{H>p8)94P=fMVJBA*tbsZf-r%Xgk$zrfKzyxy;)+cy(
z0R$Hm!o35DM|<oof^Ad`mGO6TZ0O;VviShl@d!fa4DYhgCkpXG@Z5Up5U#X&t3R%5
zmg8ihDe~i3`rejR-S<Cb*02pl^uwB;$c=`EVy1&#`kO4d*Z;a?JV!A>M%bpL_KE(+
zLy-jJc$V$hrgnu>^>BFpyx5R}yO9mFPYRGH5Aw05T$^3OgytFQ9fdYTqYw9jb_9Ca
zu<s>|4L27c7Lz2HXPo1xiG-(Nv&Q!CtLP9NAeI?|hFqz*l7vDwZZ@8m2=3Cuzd~)V
zceIxd6<ORBcOOPHee$KAX=;6E^|LJsC_0Ds?La5V(Z?EWU+XPqkP~aIL%nuKQd2#l
zdqt*O9YBF1pHng}dypM*r)}!-*hSDuTai-y52ya?3M>10{bhx@+<s5U$bR&4q1AZy
z;_35_-eKNXhTNp34q6>Bz*Cd0BA3tdG2_lz;SSiclgzq&!%Xp8zZ3b=XJmJU)w%Ih
zb|LqTr}K!lphWaqy=~QiMD5Ydm1F;I7(w=Kg_ru({ce&}3uJH*J@ZD+dwy?(rphLI
zz<b)%)MW7hJT#|*STLXv?IW<e<l~wB1PA;R8v)$@hAqy^bp7_4^4q&ZD|bc1m9`jX
zU#gT_Zw#V+T7r)7y*q}MB>cx4`{n^<cN-++6KHPWBo)#ox_;)xE9E)BQf}3C$?-UA
zvb$|`tNy{3TAKqxi_^SYdXw+-xXi^kIQ^wm;nW;_&Hcm$Vn(Li3oUbfpl_wXq=+++
zKU<2Q^J%R*T@SxMn}1yDti1>5=0BBqi{Kn|wmLVBjv7cZ**!T|Rl2`}!RntqoraGD
zAcMI6wkfU11PL%@Ha6v|M|H2N2bDuSHioNlQH2nHNcdZWPL-A0<=@-vq@AIOZhLWG
zUqOeHg_=(I9;WZjyP3U_p0-hvCI+4d!<Ev5CtZ)O`_`2U!O;JLbGvA&0ocE0-HP7Y
zB;Ia=7A@N(!*RI$pL{y@^(6R2A3~}_drj&-NU{g9dMotmB=9O54R10FG>YsNE*98l
z(&;VPblWF1inx|jcpp-0<chSq*$6t6E}$Y6RWCS}i!nL&>=+{j9#>E+wmMzA<)@fO
zFLPd5go^OW)yWJ>7%hW}8!*MPlwb?cE$l%Ygh4_RgJaL4n>VzY#KW*2{aQb<Er=I%
ztv(Qp@0QSzI4XK#u1*O_CK?zzHfef1o?))@4uw*Dn#<K|bCX|;65vkPcU$7~23I{N
z9}+hoyA^_Rj7KKc{7Ssew1ti_Kc9ino*oq2iPj^AOWMnvcOAC(52LjCb=eyMK0nd8
z_;~?;I4Oy@@9CM=3GXh2u6^oiN3Imza<pf`y$(?Y<(JpRK;0O<ac_V7dpTH~B}wkL
zs&T$Hu-Gqz!3~ouV#=XP8B5x_>1^ej*~iGxho>Cm<9jE{AF1TeWjBI3@<-yBJ!j-O
z6X5blpUdh`13+yv_Z@#FzNgwd@4-+pnyWfK%&E?D2T9OBz)7mt0WNnSlZTS{R#@V5
zRNUA2M2?OWdQM(z0Dpg!O#KGDE(^cBD=I;mL_&Hg16}D26G9h*F^z3wIrn~zqm8AF
zDxV5$PI~DC7Ka^Cnwo^w<@^S|H1Ay(z#!Pi6F5r-Kc_g#kj<DsYgHMttv%^1!Gs(y
zZz?+NA3b2^{+%cjhBwqX<JLTtqOj*4SI6xC#q}dbG4ZK0Gl1ki7{5hsUB6Xsu+3t$
z{S)I@8Sg(#1Ii%B#_JI`Wuhwljih2NT`v6TK3}54b`I;R{8M6Ome&H8-t}cSFB*9O
z1?gSTkB_oyF>&TdT)cx#(Z<946jjtTZ{UG#gk%JylZ@+~R2VSh-|^B7K=^k|;)`6M
zO~>?qQAu$~0gpsnMv1&S5`6laJF}nR9zFk1Eto$m1d)fFf3%`C9%L4eIcZ+70+BV2
zZHLqUMVtJLb?D@MheT&qyki(ZhU-7Z5|}mZG-fo~@tt_^$`<MJz@2Gq+-aVzl-K3k
z`(Mo`3*Od@Yav&gXSz-vYx^F?HC|WP)n3<FUh(`hbo&Padyev6hN@SBAOGnhcMmXa
z3*f)t=vJVkM~jd6{F>25JcA2G2kGVfpb^}&Cl_}9L!(HM&5hN2l4m^HLYM8=>?_1L
zTrB~!S&&h+S`Up1`@Z|^_5Xyxhp-3Z5r;WNo>Z=GXrEEdGYI}pk++=}k#XoOSf?RW
z=5l{6>9{VG5UNnc-0^oB6C_+!--e?Ycr#z8%u0d&YSP6D#GaN7lr14&{u$N(OV`_f
z{>`<LRIE=b6({J=mMiq$iS3q@N^|^r*BmPjr2#~DR>Z~Myx&$68!GrUJ14~xu6-h0
z{t(j9Ad%su6v1_<BHgiA?Q^|<Y74XK`Ns|NzktTFr~#dc&nxo}%(~23Oqmzu17od;
zv4WFivf6kDVW^;e6=_kB&8Ajoiun~kZ;c>XVl3;&2Ehy$%O06N>)d<qY0>L{uCM<=
z+)%)IH;y$(C%nRL+h9}eL^yvuJ@E}%5KB*vJPLmFTe^v;^rPDNw!K{i<WUUQ_-gbe
zNl=>G@y=|tpiQwtON04cN{Q6?NSae!Z_e1U#nhtF**}8X|K*w~{P7}-=B0gj39Ao{
zk#M2sdIEB)B`Ihix)y}teH`SeB;vw5R8Sc{n<ujLlVZ2n{KQ(Ls~}{VZvFDN{Z%z7
zO1fd*k8G-lM#C31!^a2Tv4>}<*;f#35-I2MFzAi$H=V}Zu7)IfY|Y!?WKRo9+EdlP
z-*5l;r^j*qhj%i;0B>F$>M07jn`gk_Km3R<pc3>Zt_?+SlXaAf6v3ud`dT#>3oC5#
zy`uU4&-jj=bo3<-z2Ru25XtdU-?G%-e^DZ-{||f|PQ=4S4Y)r+(!h0m#{R^u{*>I&
zRWbmnx*S85wAT8}`(rN6)H*5=HJ8j4olHS3^h4`$jX8V<WNa-__rqyw^BR>VKnoVv
zZWifdJ-s9bw?+2hyPE&ExN-0wvPjnMzsMq4Okh$aA=TthxX|HXvBrom-+GBM<+MWU
zd89?A`*Y&EG-91D4}{$q!9+cLjgJnLlW0v<p<<M{jb{?lFA`I~U=QZ8?Fu;UjMme_
zMUSn6ZzJz*<{>@ab+~hA^O#2oG5egCYN@iM=|@4!s7;jCi}ysC6E%w{^AlOG*GEre
z4nge9y3Ju^E|cBq8GYAMsYyw?EomfA6hoQpxp-_&-x^7{eST#Tr-~S}sc##4ZwiK2
zI%?5p4UBh(l9A|kF4T_tM*BbZTusTz9Gf?$+mssubnOn{zg+PL;Rz|lh@2wLS4iH*
zQ8F(?(j$}mg#D%IFCu;jA1TDuVB)@dLy+Wi2RUo#&k}H^Bbx{x7je?ZF2^w@rff1H
zA5WxLUV#Z~XS<AavDoYDSdZ(%U$QucaV>i}S>nMMSmU(Ja$pj=48&erygwIdLhgHR
z#AP>t+qnPW_WgV0#PBOcOfLp}f7Vmtwm5@RXkz%8>~e36>$-v16rk`W;|^pRc$>-d
zo0t7c{OUc+{zdB@x&Onb-o{dWdw7p2A$;yIDxG2L56P`hw}PFQ(-r<kvlP$pd;JpL
z@QAlqo<Kg$Vc9p_Gr;dS9KC|>jwfPlGunvVxkLK>GT2E_mb~wKgE6GXQi#}koyf^0
zOFzrp$HwCVrBCXo^;x&mX$yFyGA%ji>#TjMtF?c)4tO#@bO_6Lfnu_x4A`)9^%2}C
z@2-$u#v}_bL{5U&4GkZs5)RGT>X^<~>h<*A4xe=-Ul@lBMck~rx-x0D8<eiWzB6M+
zS>)SKDAihY107PboDPYn?9UnQZhLp9iai5=)tVq@tw-FX3@56Agm~`%0A1;2O0VGz
zwGseIb};LoX0ufPM}&WRJ{F+G_BR3J0X)C|on>8x&|7pnR3hz4<6gN^Yq9xv2Y#jy
zd}N<Ohi)aE?ED$dY1bNqFg%SGj4O{zA@d_55y+Ukas11TcF6~714C$axo*2M<i1gG
z`COTzR8R3QU7Fg|`Sfw{gUymOTgRo-Jjh_aA{lh)<qwb47<oLia5yD$(^%YBoRV!8
zf!ZO_Iqzi1^;k;T=C_<1=7B0FzaBi0;o`q|>rn#`4zP0L-yHLOfwy4R2tV%Zd@`*e
z{;OJ?{?gUsJ-P}R^tvCC6BAkb#=_y&%LQM^n4W*n*(|pynczPn`#Ut(ZoFhYxRp(0
z5L&^UJ@x(^^7fdOUF7-G7h<jGY+(fq;eD!>llv*v0uA4m-Rm|Z7pI|nfL|)CbcIR1
zbk^m)UM!n!k#<>3t?N<BFX!glDQ1@kp5(8y%&&NfoTqcrnXf3DW&Ge!dYjDtG(2lO
z<Pd<%)pyR1Ug?64^`n_k@z1eHuJmIbDsD%@swd;5CNQ_ipLj(na|lRt70FB^=zQvU
z12jY&7`ao{*Gns@Q?;*%?>-l3I34V2w!*C76AUi1op0I?_txVWjj*?5jBsW~#Q~t|
z0H==R!FG?kn_f3VaDo}$RwQ@45I!$=dUlVVX>A}sGSK<t!~}=V9gW}R__;wMDBPMq
z*e;4G37oujfA(wM67hs*%U+L9VO*N(Af1au<wQ8~EO#tIT0{i?E^wDeSFyWq9Ftt3
z!`s$kI5$1LLz4~tG}RuWJr=OgP%|Q~-T}Nb>9%(MYek&4s`^>?533$8Y!{lR%IwS=
z%(r;9!}AH%8ddxo@1XI0?7(2y{aGBYlA!kCfv$f~c)w|H2)fh4rp#c16x4JkOw3OB
z>`b(Ieetlt1T;?W<sb3Tu&JyK84yqBH*2<8AtLs_{B4-X8-J1Dc!oi`q6wdRRd=?5
zPyWq$duYQ7+okm6H{+&Abc#`o6%nS#s5;M-y$#6lLRq1`+y5EaWuGBZM%t(#V0023
zOG6ufZw9iNG~>5zt;FpPpex_rNq0Qrc->=ZjilFim=PJlBTGy!o%?rrn9Xuk9{AnJ
zmPpJ7w1D^)5y^X#7v8@_y;&<8^L&IYix3dLE&V#k^37okLkNej7HTiMC`{51W}EH3
z5FGSl1ugMiMdn;8{Ah<yZ^#|KC$Z`1F9DWxtTft0sOVCdwU;|w3kt`?nP&W(gMk<K
z*514ALD>Ui%W@R7RbEUgW{)f7LA!cQDek@uUJKYx?z1FQrM85YOVt|k;5P^q1i~I5
z<?IvLx~k5H73@wK3fCx_#ZQ<o4<n{DhYC(I+sa$zu{K5Ke%q>PU-jO|8|}=5LZ^#d
z+w8_OT@&;R{^IFO>u%9BRb%5%OMLdz+TkmTPG_r4&Azm>D$55AZO=J6byC-}6`t;2
zG%v)xeflJ2RHg8bL4mccT8`Ue$%O|JJiDnp03l%8mFG&lG@8C|e*;hr_1>cp+Ht6H
zP&+>;PFpR1&=5MgbPm2}m?nK*qMBz$AW=XuaQI`I(D^aoqx<nM>K=j=Uh>v9&RXvq
zHqUZ<K5~ipsomBW&YH>Iy`?ex>|ZY(z)}yr!)Ln0ku>nZLm6p_N6Oz~hy))>g@St?
zUD56PW9RWy8NsVKpF1cr8vd7#{e+QSc<Ty*&D1;`W!teayTPO=fkXPPz6Udn=|b$M
z;fcxuWAUrt<Yw84nlhT7bykQk8_n1AVyb<bPkqPdhDx&7SY4vP?4KvG16h#J_aA?~
zCF9j!^93vZRSOaT{s>JTNS-LfWX$1viCXOo+e=p@BM9;i>;GW|gwMdOfM4Jx8Irl*
zY-RrUoEjo0#slhAPrbW~>C;8tVBQ#%a@C5IFRf)6QNCLj^(Xyh4qXVrMQS%sTu!q7
zp2mM(sxPt<>g%dr9R9kQM?B@DUbRjeCPNWhuUAJtSgmN+(dwJdZ8=<n9S#55MAXw%
z(DkShF6+B2rPOFOCio5~og0LA&h==)1|H!qGc{Lmw)zbe`h<51ZM$-h???7KA~Fvp
zQ~h#Up)KQuNkolqrRj=h2CKtdFvF-`*M_IR@^Nq+T3xW-@|fUj>or;7dw4Occi-8T
z09cPI+l9K&b|iEMo>8u>uR^c?Cu{i673`A;N)Ws>g6@F)VVhtz%DrC1RC*yF6EIY>
z+ifiV!kCcM10zp{gmhoKUF#{)=O}g-9h$2VLh*z3aumaRsR{D^a#ooBOEoU4dzw61
zT`VhzAzEwI!MG6nFt2xQn1?v)t)-wT?^_g?-^NsCO};#v@OnUBq;ZX^P5J>qvSn{C
zcDDq);1Uo=$GR*OI|mO!nc&rQ1T?8eIs>?;aKUTU8eU_DAHk~R<uhH8e7X6^eD_cn
z%YAV1Rk&~VQrp?|HqBD?BE~yQMyvc?6)N8s`^FzjZdH{hFS+<N>{pj~YK`u=1PU$w
z{A5^l?hiz_FTY7;O};vezX@0hj6)d_0PAmry+FB|+O3R-S5+qKuPzC25sAo(4Bubx
z?}sr$s1B&gsqpNY@7!d*CffJ#^!Co`hj+C0pmRyKyO@vqskdH}ya$o{=l?$J^#d>#
zoHWiH@m?LIlDmPk{o|QKZ?^@-?<KUhPQqoD1LQx5C5WAJ^Zw=P4~q5Mlttie^kjlc
z;av)dFm2ky4;D<$vl5s%e|EU8(tK?8wdU8K0%b}}Cv1eLYGjHz(OP2hzQk^HKHX2p
zcauFsMkZoDDDvPTP~(1WI@>$n@}c$?6kd{HYbnRuBQqTF<uJas=CV7ilRsYDgPdR@
zy>l&Aq+m8Ud^fbKnN*Yi?Rl-up82;|8uSx77mwo!dK3RUfh<C$=_Un*6jdkgtri^>
zk-Up1Nl~q*O6XSKGMu-FWKY!8&o~J)91+r#qk^tgsh8w=;n+Dy61?YpsZuX)>uR|U
zKY87I;2h5KkM!I*b49xjyt=Wtv$jvbHZB?259coW+lX26zHoXJOgQ*+6L+UCQ3>^U
z^_j{Z;n;0$iY16@1=qmu;`im}i3#orQB6BI7?A2;#P&hVE;!h8BR~+dt=zg^?-aHf
zd*g1xk<Owj_G{j<8l*t_((#9vB3B7^%trTpwCV26x)~&-*su1k@NaXx!z*}m{80S(
z%JK?5U2xJTy~k-Lcn5rw*_HC?nwd}92IEM3=HP3JY8Er$#|NKujuU~FqAd#h3-1}y
zBtAwn0Jk0p_L^_vBT|XPYiD~*avoYHJS6DLNdCBkxQJISY#!D_@2)<sodV;uk$#n|
z?UM3J5(rGSg!~>405<e26P&SogW}6PqN=7^-e5WuhIX(z<a_Oier}4-MAq6^ZnVvO
zduSd>+ZOD7%zhOm@@d4QE)Z&>&)rSXN$W8NA&?1_X04F*i2T;IZM@Q+GuvEnVkRF4
zHG5?X7b{qPZdE)&BI|T12aP$Cn-I@U{^|+o{EwcS(WHqcP!jNPCZ?fbPQ>F_4Fur#
zJf_Fz#~x>NPwEvFQ<BbI+<X+43h2}Z7WKZ&AdKzmBo0tt_od!ESzpmy=ldVp{b3p2
zjrcM7`Q5Wz?)F7hI@LO~51-M=yj;#WeJJ{2o`MncxxvRKXnJ33+bq|K_gLcooy*i=
zLh;z+Y)8g5JXjQcx$bin4DIQ`jXVLVGw*uSp7pGW#~xW<3V()vA1xcK%k|_^3;bJ4
zUX_SDQezd3yn57k;L$DSCw>aY;6EguNMNus`67!@Q|=#42C4i6%&&S_e+<%oHJIsj
z7=RZ3r%plWX42ZU5uEHE)?IfM@VvKtngs9sGMBQ;9d7v={APZYrD}Zh>Td8ujm4&L
zfG~;zBW;+00mr;)HoQ9izVtrSQKX-0bqpE}rLvJ!qBTQ_ceqR5MVc^9gvh_}hx|bv
zx5lww_}V}^Y;%PZ^zrU%m3e9oA|kumU<6#dNaVYk-Q;DZNQeb|-2_r!90uMNjICd~
zTH^{2bg0_5qTjbVD$!Q%BU97nWD6)-%{MFT0UxrUPAruaS=vKIv{f$DAB&YpaDR!H
z^4k4TGW(Rt;DI}lb5%%VaIvQ#Ll;Ai9kuKze@pImyD27%(u24&nyx^?<K3r+DU3!f
zMA-Rcm7@4@POPgY?N5c8b<=G(zrfK7jw(lBRH<r1F&?9;B#EU*fMMXh{Oaqm%h{`K
z#AU3?PD}5&6Ax5S3@RS=I{09r<upXZgzKVk;`7-m-@1oLHGU?8``8r(?gzEPlDL49
ztb6QhlPk{P9QVAkf%ZX9_AJ1ByPtjI`Ilf}X(gd;8&BnSlkFiHdET!?xWgB^A(yWV
z#v`lWt|-&R*_!A0=6Ln!Z&YV;+Wz=pu`(5Gq*d$D@xk{N;ZCJ}i<HmaT0QGY$i5w$
zEEM;f<X|-Sgy6g>;TQIGjzvW?!*&d03ZH6bfc#m!ea915Go@bf)13zNjm4@1&~A@o
zua&|#6a@`$<)$XVMszb{t`t^Hlj5oK^4OaB;BAWq*U|6a_l<o#hYh~DGy^*IzB8Ud
zq!(lP2qu?5=Jn&}#tug^c*=?zDMD?}_qx97O<HJy^_v_J87+bY^C+7&fA{vF2Z6KQ
z*UR2FK6)F8$N@t+kW-=TD|Lg20fS`2y5a_!j7nIKz=MyX@S_NdH_%^JdX~;}%nHN_
zggelofQRy5P#iexXPrQ#h1VuLodIPg{GB>+xmep#+PH_Co1ci#$7xf?QAa^^w61v}
z)o(n4C$c!Thm$*%v{-0fJ0SY11=lDOWx?CHI-~akOv|yDECyy!yI(S)VeuWd*l0pX
zs`O5=_s$X{a<@w9GUuC>g1(@R<b_fY#O-YQOl2W=;u{=ny)m+9tVY2~8M_Y|gu8;|
z<B)&!N`X+$vv3no(rZF{3kN9}o@^iJfu$E!bM{IhV=+9$iVv-CA0<p_%!UdQ$d_|~
z!o+u2z!%?xQ1w@S{>dY&ohPA>&Y9(gxr|QD#hAVFEF6*vMPEMdb*r{^waj&b#{>0P
zUAU<Bs<>fqDR3?ZB&hVq`JpzypTDWAIl=%R^cgv6&MLGuGkAQuu;W$Ucul%*;EEAo
zrm>RFqsPd7ycGf5j8VnT!yg+~@(yn~dn5#M8f#t-)#!@!dsIt%e5agji}VUdcjRRe
z1-tUC6;ph>+kGm<&*sx9&weRyG3H}v7>Dk832&Y6<_!NbjxU08jCR#)uWSPB__UTF
zg_b01aRB^4t$JSHwl!P}3B#!w{6nJSesxHxCpZi67-pT;Tn<-`(xgEmla$_$(&`5m
z3+qfEuzxmL`ISeqen-OSx~m=l+Aec8aB+;O0RHe&#lif*E6UktgnuPSmRA)T8hm6F
zg!vw|aQwtwBUzLrQy?CXMQbqlnP{O(2Mda;H-J@$Y$%2$&cD$e3L;zkF3U#Cb<Pou
ze@QhMUmYq~W$H{G9cTE7UA;ZReQg`%fF_9{>-U8PpX~}!T9hr~l*@3C%3-(OKtC<5
zFiO=OO)gV7z;3usY_%YgoOxshH_m!=uF+J&a5OWCO;aCrTGrytmco4bV;qgGG3c6^
zU9>D`YMYEv*~a=*@v_N&*{Yc9L^}v&ov-E%^P0gS%HmyB$FXq6y1IDs?N}clZ3<W9
z3t)`$sNv4OaYPG@(Wc~hcD^;OBIRZ;VSZJ7(p3K3A8se`nSbYe&p`eDFDzMV2Wa-k
zlp)x1^^Qz9fS-abRejE-2X8X+edGDIBdXWKkYsd&T|ObF(pi<sshW+fe_*^QXVb5G
zt!`x<rEClL!?=KBPK!CqI=<P19B(cbZgxL2X>8vo5G>)ghK^a&@2CfVr4-5*L@Rk#
zKe>f+LqaWKqrd%RmKPF?7lip+tfTXM<x{AD@rh10T8m$hSXb}E+%j`p9QHG4P5b+Z
zc9yLN&bzn`q>^s(h$K~AL{`<6B7`5kn6KpHw^-Ly3!8N&srq>WUi3Hc_h)~kqQ;s4
z+#HK$3V6HS9OvxI<=nJ(JW8*5uHT&|?+6PCtvkw)XG!{tGA{~l-<N^>D6B=3$AJ_c
zPa3fXf(Ku<4jxP%ie4DF)Oc((H_uME37rsJN4(@W;J5&;t-wm_OV~L{Ju!5k#2(jo
zn#B|CZQJItPZe8)$h})@M+O7x^Hw8OvClh@BcwHBi7h6><Bn$4n<i3QjU_dY)muR@
z8e7yn#5JB+hu|tYSI#F-t;65Vsr<Yv)yyE(mZt~4os*J|poA^vAQ_(?6UWxrVx3t^
zx;}}NUbUpWu0OB-hL`dTFEcx6sQdDeJP~)B4(j+rWPowePg6GP`B;6JG4X2c3~_jG
zU7W-{^E+zVe}6s^BNYPjIr9Ok;E(===!s8ZmEochl%_t_n-_y1*`^r*0eoMJk>%uE
zk3QOBBTLa8P5s?Iz|A!OQX=*EUI=%1au8SGhwo25I5l78BR(<{)o&}1(MgdVCUGi$
zG956w{T4O7;=+09XyMlf-^x5B=eli`T=y`YY1O5F%tp%b$~Q>N{NUKjN-VzJ9r{SC
z>v|VFX7@d?>wMXxm+|S=tYK%lq`lIxh`US;d&ew_nE=~gInwCF(qE|YQih|f{=GP-
ztP!cH-`u!zK^baPBwM4T$A_m+B7AmUA!(e?4`@XIrvr&kFh$*fh!^hNE#`ZtzjYTR
zJRZO74Vc>$ISi@uh5EX!cf5Z;>s*2K5h%g1L%+%8*Z2rO0<Jjs9D)pB=EVL{uh;YQ
z7WW8(uTP?L<YSK)y#Pvo3|=gLx%nM9>biE<TB2UG@==-BYi9qw((jmkDv3c-B5<F4
zr!JN>P?TlBL$LBaTjw7GKPbc2!%ahKJ{Hfl`FKQj?j5l}+0`v-L)6_kWmDaT`EW}+
znbc_Z(<JkWqnyx$brIOUs+r!prG^&a$IN;RpmwHTKfhdmHxdC!Tmu!N=I1xeN*zK5
z?t64MMMNfORQR^bUA7IKr{}EyitVp&9@?iqt{{UQT0!VxV42KQ2Em%a3fD%L9dFuB
zp(=;4t+S`$m!84z1ss#p==}B9Dnx>;cFtVBcy`Q-IF3ALWX|L2I5*69)#&mQ&F{#z
zr2~8nyP5j=wuaAlw_!Lc4{&o?aSKaSSLe>!si;|oWtsfEpYsR1PV)xHY95^H%cMtW
zjE!~IA~?@3u`*`=0dzPuA^Iq}Y8lLtoW5lR$}@P%TBEER{i@~q)oJ)mU4MH7_R(QY
zZvHt)e#2=xXY>->xJa;EH1R=nSqmX|g0#~rm%eY?_h#KgZFuE&>OEmltl)K0z3s;d
za=+XhL=Br<$LoH_=egc(Ue2n}(^W#0l}YBNrfvOkoS?=0&AH4<MP}ngwe-x#8v2^X
zEkl2Ejn8#l1je)6oqh{;B{>Hp(Ob&hkaPSIU3!=*bZOVO#>(e$FSkEzH?_~!lwV73
zI8_(9-=EnpqAbW0{hV0y%y}VWqN{>eTWA%@wyIe$<K+8z__BDt$+8SWruqZDnZbex
zPLsAFrcvVzF&+T<&gf{T`KC6?K>Iv0@+AM4{!`H}AExYZ^(TrS(@YnULN;r+uW+7U
z%VIrUZr9|3E};VD$@4Qc^10T*IZLsDTh9GeVspA}GG4Zn1e&|hr_>sM-euKly;o&d
zHL$Z58ec~`%3Q@Rq)-3-DYkjp---M8PFIz-H!;Qe`rf<&)cHo?9vr4MaJ~yjznz@$
z7`D>P{6B<!XH-+&7Oe#Z0qGqi3er1BheSm{I*N3VCelmj9Z`B!dhbP~OYc2M4IKnT
zNeH1Tp@tB`i}&6BzUv!<A1C?2898U~wdR~_?zN8eF_CIHK(eI+6jOzm2x3%f38BT0
zh#h=&ltLP@Li03Anwo~a_KJ3zkdr8EO&MUr2#i($l!DtHY8Zia7h0}%4h8?C7XWzJ
z?8~My^~ZNt`iS{LJ=TM{KO5~u0B)9o$VL@Vgra=WEh0?UD9-s(nE|{kl@Pe|KJ-b!
z6$^DG!6zJd`r+Gxr1$)~FX2jVf!9I0N>3Ck72g-CgZc>HTDPL=jWMsV*waueGL7@*
z&u-O;cDa>JRtfq++wIusZo$@h_bMru{dSFhg~2)NlHR&~pOu7X#svGy(w<+D&lpCV
z>9l2SPIj!dwDpKmnG4CW6i9>d5+_0Y0MG0bsX#Gc*~*uvgnXurO9=*6(f&po;L#w?
z#85iDaW+hHRxV$oSd*1Wr@^>S;Qq|6nvh(3lv-JQ&f|8Uq|O6mBKl70mT;4NS3HH$
zD7o`MDsx4{>B_Gk4O+-r3k5aPimFyksv(~$3!>x7yGqFdhGPY%S8beJ`f&YNkM0$v
z!OlYKgrT{C2$n^@D7h7epPwBt1OrBnXSDj7*N#9F?fk2*`x74gjOQ&=mK^Ou(IUH#
z#_S*KF$Oc7PFBC}*f0<oacIiyWNICkURc@U+U!VJ^+)clM++xB>{uc0=G_CR6I$*G
zeU>k?J3qJMD%K4{LQ=Xq%+PE^&jQ0z^y2-SSYNaW27&i?boI2@?!$$#S%zT}oj8hq
zIzz`{P6Y~aN-hzCc|RATa9hywuKR;1MeBJV1<}>(*KY=xZd*CL;eg`?R<sjaUD=!5
zDo%Xgf|TnQz)hdCPQ|31JARHN-W_VhpIL<4g<X1pZ^-|;q4yA(+C5>Q7>EH0MVs|G
zQFjkSRmkEuaYw2(Q5|3?y;c5nEJ=k1$?15^WHygF`|P-4{|d#Crg=I1VR1bAM}TYy
zUN@H8dvxx)LLV?Ux1h?y<V&`5LHY{kcl-VNw-ycJ?&psxH<WT3V}*8t=)da(s0?)V
zi8l56e!eWSQxyC)#C3k^aPks%Jc`V3vY1*lvZ*dN4)|slY!z?@3r%Td*`Gs_1TI-d
zevVy8s$4>5VjOb1<BXkZ>2Y6eaN>c!176&%A_?zKz6r2U1mEx&QBmev^B>z3L4{|1
zUw0P#kIdUk5Pf-?+{2b5da2;-HV4XpZ^CrMPC%2ixfKW946d(*_mXcFl9Y`->c()p
z@9XoZzDa~w+UtW*QWV~HIyq9;DzmrC$S=Voc^4NH3SZUpj|p0QDfogpt{^^8q-?ey
zy{(_o3j2EK`TaV%6Dr~0*)#J=)h4-@z8SPNk-m{1u>)z>?`7nD)_I+R7y<;n|LK^Q
zfIu$n=0!7nU=H5L?V;JH=Lz_f>prEThCq)aHw=F@viYzX+_g+&eoM~RNAa0LeKGps
z$t?9nA-eHNJ#*Al_gU&P*G)tP&6dJLA7STPy>vvoBIoPWVI4#)c;a&ATOaRs^({kV
zY!=JC7w*(`CJ(35&)|*g5Z1=LAk4GX7rgAY0FN)v!t&OXdwC@X`1Phg&nY>R2z~Zh
zQZ1TpL<S)c7i1V6pA(Q)a#N;uaN1T|seGs|GWN@ibhWnga95-mP3^XvWT>>>y-|vd
z;7C3c+7Q?`LIS<uS{1Ini+1aRO&|8BGS`^O`2B3~r3&DS^1#pZtP^%vAxvIq3k^aH
zL&rjx-Q@8@r+nS(MQaFGsoVE_A5sNz0PhjiAJBhzeoiQco@&YY68_AVGpO|*CyLrj
zPpyWjdHTmj)S2fq9A;D~anc0Xv?^o#z7lY%xM6ep+0<*9??8%w@6dEn=d5n_*gbp5
z5o{c}Lg8;Mq%4vx;6gF$1{d2n=El@xXccT<)qtC-*3{mq2}<$dXKw;BcfVDjQh-{E
zptQMfd?}srlq=RburzTZ2m;2@>U$?Kt%|fQt#h8v#789TX?MfJNYKxZ3b5@1+3B>a
zXY=<1d}~*Tt-8l7@8SYZwnr&$ShdqOag@KRv_!s6ti+l+#d*S!YTb#p!?#JvWnnF^
z`_b79rZgBlrp50cxvkmYRA<=7b*$`^IPumUIKA3jtbDcMz2LDta^lDZ#Lb~&*pAZ$
zdh{Al$K8sVrK!MNE$bZ|xPWo1E?M{{3r+#mM5s!>X203}W-aZ?u~8#bJZSAX4pVcK
z@t74zC>VA5`WLeq(x`Kc?*7UfaA}5(rm^m38av+*GCf$#@!tom>d;<2QhA`#pgF>l
zRE0Cl&TG&eH}tftn5r`OSchDx+^1hNSd-{>4PYqC&$d%oEQu9TV$Oe%3JkD?CKw3B
z72TN;t(Pl>fjQ|2=?5~JRwVV*&Ulv9&9jN_YO`R=imppOv<$oBN%k#0vc0BWRIP&3
z-^||^`_65?7WJ$7Q+gUmru7jeU+W^UfWxXr^+_Xklls)(T9LtNw?GYNjUR1&6zTu{
zfKUQ97et8TiK@bs2jxc4=3y(*`$by3-`?>2DvNdfJp9^NnbI~MJ+!Y@-oEN!4IRQ=
zu-bjDdIMu`t1Ucz^Dg1(*nt2C`g-;rAU+-heGPreP`@BpQ7sw6m+A5|u(9ufEIZxj
zXquO2(WZJ`ZtvtzXa^}8p)!}z9)aU;U)Y-G&6*84NyJ}{7SPs2+^aNsJ;?I?KHF#Z
zw!4)tMD;SsabWEw=5zrzRb`W{xNmf)ajyYd-=4(JMaceaQ#SH6;Cb07kq)-%;e+2s
z9A(Z$kC)}{(w|DL@{CC%SL~!JSPaKUw91V|^?rDnnfKmjT2ph>8|0O68Vf8lJyj2E
zV8_)_rOoX|e$<kmB5zKtOFSHJ8N7AgkjlJ#O^zja1ZZ}8cAYPwf>H7=yJpZ#rF~ar
zC4O#<CpX+PGCv$WG0tcmU=gzEKW%4Iwm`PmA=r8bIF~nL9CV7^V;iZ7@fuL5iY#0G
zSobMM_oyt}HwdG6Mb4$Y#M@-NQ&Z}sSga3`mYvoW$tEb-zJ6TDoL|>Tcy2dppn`?D
zLkFs~;)SaA*YydF9qX-H#8(Hjn+E4)ONBTa#EFgNI}WBvP`*F|L5+#u+wPY)GS|OM
zJ|N9FsKmpnIZR9>?ZW8me5p;%g{q{_dQ7n{EbWOF=-4M3dYi}lXR8gyGUleUCgdDk
z8K+|W#Dl-fdr{371v_WSBZQ}2$F^PVWnRmGCg#A?WVHsML|vP(<46?ZD>3R=+pgx@
zIt9RoY!P<l89J&ZEHoC%>^uRnsUiItiC!Y?_<*ckh4yrTW9|aI4SZw3IvP#o7HY}Z
zg)5oVHXDQUGF$^t(Wo3>kad&hTHvfmSB-DbD@VhIakBPscX&7R?$mA2iOrCa-?w`o
z4-tK2?Yp^p=P|No2A^+3y}t)#0h{r2Gh648OA&yMw3p{?z1+q*wPEVwRsirS^)564
zWhfT7qGZ*K&RqWv0xo+k`kvxjhv5dT8-1K5uTl&D<1by5h$eXM>qnea`7u;3_#CaS
zjb!q0K3KoIxDihMj>1U%ji{3BW05|-(tOp&%-spBlnEx;9PyT5NJKhXyG-3=<FPu1
zry>W<f`%)DQjz*O-MhBX!x<Z~5HMTMC+?p{&;rn#TVJ4%h}(BEPe$a<LfKWN4eodk
z4kAlwy@+@#pY%;cf}B`sFNI$tWGsoiwSu{g$0H-X7T#&4z_eQ~b7lL_klCxnRnKqS
zga0aH1>DF2l`=E0y=(E_3PZkd({hS*Sn1hBCtb3V$>;0a!%N+ovFB5;bP<&YQXD_;
zMftp`9q7szFy$*8Wpb#YkC!j}?DNF6<*pJtRr2!SB}RFv9reCHA?{phB9Y)HUK*8g
zs_6mj&&37?TbOoz+MEB9K^w9AVf2%Hl}Qz6<T{EnsU?caayqVAKHWR4AAXzA@HqUQ
zOdckIB++&99<kSgnY%AW#Utrz-CNfItzVSKn3ZqMDw1qtg3C@+i)HRhEgU@`hOh#$
z{MC!Q)Tb(l4XtA)O9&7ZLrjq7;KI~yNjK$Qle=8nnMx^(^W5^>5+7?~BVRfHHM{zp
z%(-E}!Sd3_y+{5;MtJY)7(ERj_{hR;^G=}iQ$D|%4qSYL;x&JM5DLw1r$*kS|FJ<7
zRgSxuZld(Y_fO)9CpI}B18bS;#p;PU^G3RwB!I1?omq}yhgLT%Af0GzeMqORC$-WN
z8rm}zacTC0)2<`jC&44qtSx}LIZb-!DCwFpg>bWVP-}oxQJ)4uYjqXeCh}y9<8_e|
zYnM5UB;zYGov%vMT8)0dtcxPC?%-_0N2iTiOPcRx|Bro5?DR*Mm0Tr0EJ}87-Kr0G
z4xkcj#iSnHfc$v$uI~mi`<Y+o0ivhr8Cn*baL(;0Q?EO6BkfqzvfJ4?T{by5_ipmR
z%N<I6{ll*(M>-e%_@*^kU6GS5I+{N`J$yC;M*~B2OWBoUiRcGUyF)P!HEmLXb%R0G
zyDr#4`aH!oOlIxY#&R(QRQ~XVkC-#{)cO25RYU{wNY;fXfJzc7zmt4qIOdSOfIURr
zOs1zj<#;Vi?R;~H_}P<9f8LH0n%JxxY>r;BX3pBFs4n@nP4s9Sy5fCjQLWSiT$Zrk
z(Z{2&slUiy{&Ii1;s?C$(tQl+IT1jbxtT64XPnBMXPLe5>Q@_2O8Lx{8=$uobDB+3
zqvtNezIyoU!){Rm@TsKHiyWbcWWe3@_5K|)I3&_>A!KtrcTb@6=OP>IV?WtbGuAy;
zkR-a9+JXU$Ll=>&{1QV{csXym#|cF1Mfn$*d5u@u<prMvy%yRwI;pAGimBOQhVdc@
zXLf$JRS3qJ9qm#JMoaFkf4{w|6CD35466n)Lao?b`&SO1Jh_$Z#27LW$vSLE*j9A%
zQlY*W5SOHYLu)I+lZArNMLBM%bf3cN>dK3Q?K|8Glb%Cpk{DP<GyuR^yCJEhG!%!!
z^Qfx(GwTeMud-<$QWwVEGQVF0I!yxrGYNu-+6ExRYVO4F{Q`2pQj{WT&Q||{82*4}
zj>$pUuTP$Sj^7a}`a745mMk+(P6K7|2bb@(E(A@2+)lyKQ%k+y+C0^~&z<+s0VWBo
z@_qQJqS=y-20y=+2X0OknELpvr@J2SPZbC(oO^6DH8G-e3_xA7OPFK1`D%q0XOHvR
zi;or>xp{%FH>plcUvIfi?bJlX5MCtb)(F_-a5NYP7uB8}FX;N>mLi7AwipEOVBJ%2
zki1K-(k+&t;AQr;pH6<EbIPQ*FUq!P1TVn0XoVp!jg94{g&FEQGHKN=k2`>Xs64c{
zx}?=24Ed<auT!{tG?<Ci%NZoI+dlhzZH=<1udb%s5Vq{1e(ri4DN-K%c&s~j;k3d3
zLZlMCp;j<DlaP>h+AnaYlteb3k#*iq(ywE{;plJ!;+4}UxTjo#t?|s_;}67y6<p>n
zhc^zz@{gA-c--mtn`s~+Cj%J54;``HfCHpe+1bYJK={s1LjsVeleP4#YyJMnG+($7
zRIY3I+$zCNHk=hDh7KuU=biAze+p&2Q+A7-l$mn%rCprsiX};ei%VCjN2k9A$jLw!
zcZw)jE8>kuUYssZ-04?fR|@Bgi02)TI9vT{U3%o3ap<sj-spm@Y%9@8tDT$d)u^tK
zds!ox)7Q2)RD1?(-<)3C)z!a!-MQlv?9fvO8~c@`tJ{9u<$Fe3_?$9X%&+b#-J0&z
zQ$QY}_il$88rG&(0R$ixie!GB?!bcwM?f`mH48(|Ic2w)y?#!*2E+*^=)e5#5Wdy7
zRHQtB^k?z$a0Ill0>3+Q3Ug4}j$eMLFa?=OkTD478#OQgU2`!nq}V)8OX!zY*6qIK
z?Z8=wJs6F^w=E@$vGR_N7<lo-80Y>p=bb1MC!zJx(<PL`{vh{ExE%`)JrW@kE>sHi
zc-~kLSXjcV$DcZK&`;Q(klw&2VZBr`lp4CUn5uq<DgO#_I5jmpg$+iWF@SrfOojX2
z9-3_trraJY6|DlW9(>WEhdgEN>)Ul#BS2d*W>HP-D#S3zahQ;^5lIq_=FvNUZ0whF
zzoBPYL#aq%igZM&g^^tV1n1^}Cvu#X;?dA8)Ttc%V+)4_p6rEKl;N{XXc}&Q{%{B1
zi)-%SQ05F+4RhSv2|Gj0fCtTR=Y4?iPwbf+7xsAuNP*WGJbTUZNairw95}m>ajvT=
zHSFx8O^_pDK6aE0ExNnlFm#`8<FFu4_fsQ0?($S2Hz8}*Nq)$2OP_XmLd4(bPB)q!
z5Rv6)Hs|<qN2xa{Fz^s{c6>M2O-%Y2da_NTfv%w)1Ra!jPiLTZXfIDcoE~D3?wruH
zQ_1NGPg2$+g>hdBmmG9!!5My_n1e-+hQ4lK7aHqe7Zkuq3-U1<GlqIPwV+-X1a=eJ
z0|9fe{WiYKj_QE~XqFMwyAgfdbSMp)$m{>W1x*_Nmy)J#{)yvmRpQ~RnqY{uYMOO5
z_v4hKg+-HElk}33{Kz<3$2qNb43T<9PwSf6W8CSOncfi+7;90vBre@3qA9)E?@?+R
zST&w^4bw~TiP9WFxpBA-4ap0_Hy5kiD(mp;G8i7zYW&53?tc=<3SboH+$$UQwGX}s
z0PQa~6gs=X_P@8hO%=G#d9w4kW;6<{l%LDs%M|z$KObn+b;uhO$_US`{LbJ0cq#Zi
z+WR{R0D|xDZrznP<fN6mE44>+9OUn6@aR1&y<i*=G>84lv{ntcsr4*iD8=FJ8sWd-
zn{Y^Z+(U=sA(g7&RHSl^V(kw<Rn8B(x2fKMM@ElyhRm$)|9D=OAYyctA4D~+1hOV`
zI-`hD*;hPD=?>WH*Mi$Fq*9<A1e52KV<!fIjb?iS>}(%yI@+&_7G72N68{HG{EZhw
zB$RuMl^R;h#;7I!_PuRLPw1kkWh)|;<N|XHM-H|RyvyS#@-2MlCWuvUtwmh-)bp;r
zxZZXjm`uV4B=%gAs_lqXQYEv?Tk?7<bz~83_L0_&g85q#kP&RxZ)?*5<E1;EX5ek*
z;jtlA4oHq{6I9(J`b^9kqmjtlMfE8jU`>X|*EmBc15k(9C9CUzC5MgERLT$U|NY(n
zLr(p>u9~lSZ7^#@yck6HPE+)vp1<3}G}HZ}aZ}HhU)S=gA|qHog1~s2_ze-?)pQct
z`~ZXycz<ZWWa8C*G_f`-mseU-X1<xUI2QtX<A?p3oqiB(>7R=2UtHvKUj3;|c{@jJ
zL7-wQZ?l-8i`w{-f59w6p}N~1CnE-Zg(&2C=W$Q!sX@v^HMS9ku5|1Tr6^R&TEA4t
zJr`DGE88LcI@FXw$oSCU&*(Ed=%G$?#y=`S|11gp>*AsAwL#jxY1)!!dNZKLq-&^R
z3r+ruq*lA!^|E;9kw=Ed2K;ta$yrr}gOqE!kL$M4&r3}U1%gz2GGa<KtoCOZCXV==
z`AbD{GW)|ru%b4YM0WSxZR(NN|Aq$4|NB~i%2o$s)4{Y=yIHeYF1l3G`Kc=Ep&EOi
zb1U_u19NUD3suOozLey;bSj;+8ceZ?JEtJT2R5b016qE<&3Q(Xgc3jWCtrK|<qx;f
z777VJ8e({1gt$Ki;#*g?87%%zXFsSMy14RUVVz@QgPsGNE_T6G^yEsCj~cV};LLr7
zexL1R@l*+Q+=!NXz(+NfYRO<0OR;}n$NzO5(nj>)6KH-KG^NYcfa4KJjZpw`<dGrD
zgc$F%+8r?E18<b%h=$x>;td~o`RzypR%K}?idI?C%}6Kem^<K8?mz3aeo}1zhkMw5
zc!(->gX>&Ap;o+}V~(+j6&O!8S^u!1dZ*~6=&dUIFF7=K>Fw>T8lAfm)3S!AH2EiF
zJ|g*ItQsH0izdyy%Af&@r^+DQv>WD<Ky4+9MIF`z-2WlC{0q4K?Ntd-a<9IqX1$=y
zaeKa<cf6r&hTvvQnuvQy^@h?KeDjL+l6&x({Vnk>q8=8sTj^~O2S@6XrN|&VXT%b%
z7M!st9ZgAIkpck4X-x$ElPvzlMTikWG+*e>6o9J{_th3RZOxv&0U2Z~wmiB=Fv>j>
zVIFhuhbsST7Eg#rEMZWxot4|$bYy?T+~CL~vs^QJ+AJLwtW;#eT*`N2B^vXyI^Z>B
zK(M_5xa9jRQjYAU*qE?Y{Zzp9xoXq%*AXlvfgQVi#%dQS%5w`c#?4<9(gaPjq@l8A
zr~5HKNgg=l`KB5wM37-V+Ro=NjUe0i$byNMe>E6eBNwBCTWQn9ZJz(kS{Q7VOWj5s
z^426A!_Vw<jW6PI52bNun@N4V6;-<4M5a2dMN8(nL#j|~@zgok3kSUF$;b;lZ4j#8
zJ+LzXe!un|>uGitc(>c$*Vw)WQabIa?|)I<hA~>JDa*NY0@~cq++rHm<(ce@;in^$
zhqbt#+|bwCu3psJlHrw+m^5H@FSkx55gU`z86=tmvh&I$L_q9gZ&h_2oFVNHNzDiZ
z_E^<lJa{RkOnbs?ly?D_%^mB4H|y}Z02gi<PSlj=%FTFgQOS7cHYqM>NG!|juDI9G
zUF`nnK23Ui<x)9e{ymQ2VyFxk^;)Lups0i@!F`zbB8AO@jthe*3W;pumM2JpDFA|E
z=NOhYk)$+BjLYQ)@n!4K44^5uRb>C8jJoIwspwuqCp49URpeLyZ?~I%VGsCR24F8N
z*@1V;NaWG8zxohd-heWOsyi!H#?8X7zPz6&a}ljpPGHs8uKriB`db_e-QVvgPoO8o
zpLxA~{U#}cP#w#_-*dN-TK<9=kPOKp?%)ui&(i#NNQR@4^^O^;^~o3c%<biaik;{A
zkP@UG^U`i8P2`|RQ#QhKD^@QWyrFFZDU1-M+tUfmX5{M!fCfwN03hbcp2as=DYV?#
z^RFctSm$hUMUet-eLeyUUxmSjq%en~7Y4xiAc*D2pdr0NMml=)t))nau755F8kOh7
z%P!o7E0RsII7DRrk0|_L0Z<~l%|A}1k@WdUHH9*g$11j$eAH8Gsib>ald&krr@^8D
zxx{lp6>T@9b%w}7Ld;q%!Mm@Xa{wnZwBC4at7d9Ff6RXiAAg^v+L3w=PAd*4h~@Jl
z7Q$>{Xt&ucP}`q#j^MSp?Sv$w%gSUkOOb`?0SaAr1&=`~F(Rw?0|rYpq#R61Eu)4(
z(M6%Yq;8@rJPQL;bQG~kLKh=tUX6p*#i27bQrXh`0#HEKpP~xqB-_;o%B0^C2WzL9
zN)+rv_<^<=G9QclVbBbz?5L!j?7GYVTdPWSD+Vnx$dnKWk)UDMaj+q>4)uv+cOJGK
zi@VzPkj0bY%8dDh`op)M1)nGNq%Ah!q1W2u^}N%e4Udop3*Vo3P^^I<7QV3k@2vB$
zD5otMB2g3!;Tt*De_+@!YZB~KcvZ6eiSn&3()XWZwSv}p>j})yRCnVPrs*iMX_G{g
zEZ$ND+UbzGeMt+7>WTa!fLLgGeMTaAGnVqtKUp+H6=S1&Arh_w_`sEnGpxalm`v)7
z9_w$Uk`{<dW^+uc8tRD(a&}8Wh~r0M3u1+AV0NTkpZJs=d5?7_4(sCxO0kih(TeSE
zyyQVC2XKc!WD4OBC8F61kZOJQdraBJbCt`nL%6bOChtO4TGB_=BJ~QlXYa+|Uu7YH
zzefO*Q)0mf9Jx=-<B9;moLVNBa&~ko5{i6dmJ8BTbFa+A$J95&f5@+s#Mh>|Dz+0u
zHbSRC!-g(6lcSO`gAEQ-Njefe!P@OUn*5Fl?qftRg<D2;s5!<BlxQ{3zpj-5X1E6S
z?UH-x7EK<lW_qaKu>v~t9VN0j{Q7Sg{J(J+*|pnS2_mdG>c^M&ontWgc?{U%?!s18
z?>T9SxZCNxs7Lk^!wh2uSCj3KJx>b>W*J9$%?wu~%txgrh`O&mVFrJBWO!CCmizAW
zHrmxZZe1vLzvy2kng0qh_>Z%klS~)j=R0}R`Wb{w6$F;miU^N64c@x2t5j~DlxSCN
zq{*t5cA_o+F*b7UfhP4cz+SSox{=724@l)FtZCShwfaB({}=a#OKUG3jb}j_?i?45
zUp-Sv`lxIv&8>+VQ`GkczKo)ITVXTMM**Rxu`2fb)^3^~u_6tBfT}$NpQvpYJTAYQ
z9FC0=q^}%ldFXD{Wb$S5MQqm@P`uK)=WkvcYM9Ab+&0nR$$x^V@T2rW^q)|w65UNf
ztxZbBO${*AFw_~0<TXns<}pb88&UW#)N_^kW7<P@413!~@hoUK0Wy+3r7f*fW{NQ2
zXSmb4_QuZt=16P8+i9(bRIYUg$^@mR!?tB+*MzLqFL*0D^@1==6J`bo4W_I=J|Hgb
z713(~_2Zj);ObT!uK@jpZfaUqWT(_q4+Q^IYRnLg6uk?_B%K^FOyr_rGy(XiSRKIm
zAze;pb4CPsm<0X9;x)gfdyA$y_I))^&T|<~IE4w9@<oz#VVUK$8A;=3Wgdt<B%`-M
zCzZQG)DxpyHr9*lHoC(SGdw$#;lmO+>idt<Z1BX$f-A0cIcVVNpP!fJmB8nI_pRfH
z^)C4*w3a>{>CBZ>DK)>H`oMf$xQe(mj~!pnn$>(b(r|BgM3PP?%b8}#2eaQR39`h)
zI4@E#<EYiNvfM=6dcw~?-$^6C#rjDRrl?^?r6hRctOV+IyTRSrQffVwr1^QTIFVVX
zWz}X$j*QJ6ssJk;mG!yM^#t-d4m!N43kL7c00z*2=yX=+*KI2QxY+EexR*sA`;|6m
zO(YfJGInaF^{4bQ_yRR5O(^DX@DN=vJ)vl1AG5pz?`6PBJ>~8;;J@_+Jt^3qpxfgc
zv_$bXs!Hyxm^Q7e?eM(R?L+DxZkGS@Z=0W+Y2*G3$YEVsVf=W(z-hH-&@!@~!RF>v
zwM3}llGF?*STBF``jyf;^p6VN-iFc0qV$3M%JfW+3OrY^usHd1c$wyv);hu1WEXiD
zZhX4Ygupm#eLf^(YJIA{Co@wGyr#qX%o&|XL76t!{U2=qKKG7#JH{vr6khvBqNQ=I
zYVJ4AHOvKc(g~#Q@G$aux%XdH&c1)s;mTD?TaGba22Zjl<}eY#(}HX+o2*;v=Csrx
zgfdHN9!&J6*|^$S3OVRFEdY<+7nkBa_m&#>)aS+igJl2PHcc-iqH*EXpQeKkB9^!@
z?4?1NN$x4}DUNdY$%L-*pzVVsoOH*ga!$*DcD4b3TnV5^XaS^S6`(DL(9aP&6FI2J
zCRmv@3b-qrlPxkrnqN)ZL6Ees1|SR+#fV?U2oJu<k%%iHN2P(+r_cuK@CGfBAQ_n<
zQTT9?6ZZof$V}SAswi8cExUwy&l?F*9j%%F5#7yI?`wCIuSCKc3q%T~-AMVG!1je8
zx}D8b2CD<nE~3^3HM5dD870FQFBBe?c|herfuaGMLqZ7(-4C9RAOagwm~=RR6rpcq
z7zT<z>TKL)^o#{wosNFFbU6G&&2;~x7}+RXdqENTn}?@ei4AVVHo#r}m`B@)X!MC3
zP`p;3wi0YpH;WgGCqciH_Ivy?H}%w{MiiJluzoKX8g#27+tVUhq<s7!O}KJET{WB>
zZd;Vs;mZ<NaK~&AqHM)H42UQ($#(h|`1nth{rme#wh$Px#a8AtH=gvLeKNI6r&has
z<($d2pm;|h1)s3$45p2E^l3sVUvkihY4eI&FL5kQR})Y<+s!awAB2l()8HcpWAGjH
zx)th~DVTZUmwafi?H_*O$E1f@(;&FGN`zvtqE^b3;GV9N27wV1rPpW<Q6iy&@5Xzg
zSgPvc*umuVwtzV<M5Y*61VWwAq<Z$1^RdWqS$b?u#&>@r<;Q=BMInB-9u$Kh`O~~y
zQ8>eUAQ?W+izaP8Altx3X&a{ySfZOdsy};cfq~;%`hf8gH(xGiF9SrUtg^1b;y^#h
z5~g4ZbL~8XQ~WVa%qr$TyQoXWMODib9BbLtnXq7Z&OEq5fy0|$G?Ess9P@DFO*Z$Z
z^hEBTY?r!FxzMU5^=iSYM+Tn!s7f`HW}5hgSFLpaaF2&E1ksWy%y}5DOm3!4f*FvN
zqh0AbTfzhVZHD7S6<b|}pT$>Nwbhs_JP%VkR@CFYEWz`S<jo9ODoVh~8QGkp#gP?t
zvpi|<3afIlQv!pm2m$to7Jqm>wo$(+|M6zRW^&T=%SuTQhF5tw-NTt6@k%UrjMx?K
zncVYHeYKA$#VZ><X<|-j9-g{cx)>f-5$V}#A0{Zn;6Q?pK@}El7vOgC?oUZ}mQCB_
zo=L*r3b;y#X@bma4<rTY?$H*J-!o9k01_CJUe&i0fqxV$wUXN}QfE%09*_e7D+Tq)
zFbCMSkBix`A487<Dyy-0$?wW&!XH+7<1PG_lEklv$lp?i*d4R85~OOd27Mk$Lt%l$
zfZ>P<MFc4&13Lw*7MsCe3RW%F?LAWA)>H4DHVB|ekQzu63TzNh{*6k<|B%?Vx&Eg5
zxSJel+2v(h!xI4-dYOVYbaRE}sp_x_ruBTWt5WwDr*pO9flCJpT?3qqxDkbnAi-!L
zWJ<Z+@?(xz7d-R-7tBowI7@NTUB~(jdJlBTwkoGz&kRbI570d^WXXt(l?ghU(#&E1
zzN7ENq-<I$GHb_0r!CG&r<1YA&Wo_Ywybk?{UP1;5NzMO`|WepW?ssX{?Q9l<s^rV
zLN|r?f1_mi1LjLK>S}2mKkZY5sI^%jmUvPIV=u{(%7OJVkeyA}1la2v@2XbBZt1g3
zutZbG@X+CN$^VOQ|M|_V!j*AKh2~c!0)FhAcb-?c*eQ(8J~Cb6wt=~FYF4{L?4wnf
zt*n_8fNsL^L1#R{j=WnReVvyOe@)9ot!ziR9y%_$10b&V4xr~&?o3+DsYqwfpzklL
zugv^uiFi`mis5C!LX%*{Bt<oRlILV{O;Yt(e=KtI?oUhfx^lIs+LhFrftQfF8w924
z$r+^7$(w3fmhTn1j?@U0o;dS#L&QgaWsNBM{W&bXm<IhOE*~+Gpn@Z)A3m_Z%{8j-
z7Hxh-RMoo1AEGz%IT0*!HYlR!`r<XIb$~RrmeszlskEg|d7fKtp3{9{gz~N~|5A#M
z?|wxx!0eCD_rc@*mlw}65uvjn@iaUe%msk9r(d+Lc4R-%WwJI(iFsQYLi*z_Lj?b6
zLFFqvuSVU!=D>1+7W0KoYu)K>mJ0?FVh^x&`1zl6_-%Gg{ZGG5kK#ShP&YVM1Wz_q
zCj1VOg+kU4QK7B2I)hrb5MBDxD+o`eav}2Y_oM6g31-sHKd`W~at4pY_ESWT9wJbQ
zIsw`y+nL=k1a25=tVEOr{lk{_q_BM&9E;k|qrh;1@kA!(48e6lJFeSSF;Qpd*z+Qa
z{CT|!#GLGQzPc=-5*0`Ogn{1K$N@g8K)_09+Ph1U3S=WAS~)0|WZj{N>kjvWEkXhR
z?rHvSg*;y(WPbCvRFT{@A~$KkLE$dITUO!xJW7D{{rifTo``oc$b+D_iBGJ`k;;{&
z;LJ#jZ5hASbo8TmIS|`H%ep?<e|V<<pa0JmA`*6Cvs{Q9&gR>y8LzH4p-6ogbA?ag
zW7R8rE~S?c{bAa?ATk*HuBG~OE1o3x$B2Z2KjwDroQLhD=g^Hzo0ptD>!rbk6{^8=
zCQ~NTFA@gd-pwNZdi@>8*!0-lInUB6t2!aGxtJb4KvRPD<16K{<Pi|NSWbw~VC3L)
zTu0{z?7*KPW+wsD6ktl6s|2SK^gwSTHhd&QW{-EsviBgRr@{7plg-^XH!JcUZkNTy
zl*B(Y>535EJ91#dpW;x$pW;{_Vkm3<fJcFOfV$0oA*hxtO2^+K#k=zB5<$q<4I_!l
zmW^JE+^~7#J2L9V3)#x?EKI=QOVqyQrF&nqS(n}dgY5qT!0NdKbOx`=IjPV0J0&w`
zxn7mDSQ8j=`mr;yTOUCzP!D6)E4><2xANF68T;wuUSPQ3JQeZ_k|phKobg9mcq;`{
zMSa7(TsJnVB)cv>wkvV%eO98I9tG#S5878gj;2X4qV|gt>PZ2E1>`eQ2b<dJ6L2xm
znPZal)qx)x{wKG-(J$9Ji=?YPmU>NU74^S!Z^%3aw=?5CQyrrc5B0~I)fg`KCt8EW
z-E{WW2`K~?H)nEVKJ!v12hH)g*D~pkc=L1W0Bm63yTnLO7*Va;r@SuJ5vdDLq)XeL
zGK*c7<E>iJmQ~%}6v4N3e|UL4Qh(b?zQs10R2O2Sc@Cx1Ms{#+d<j8Cao+wVM!JQY
zEYu874~73h51DaHY5*X5L%A{)G8J#P6D7wPST&5VI9eQV^+-^{?F9yZ80VhsEtgrD
zxHo!XMY~PzjY-XnRo!`cDrIU@BKFAqS<^GW`o&nMaTA+#aH;U&Sp9>T1$<K>*RONU
zq0aTt4;W6mnAg-%w@r-I7R>BSN}8xOamwgp7rlyE@!qA49boV#@bWG7eW0V>OY1mc
z4ML#XUu^~9<KK@ogzRhT5!56&1vn}`Inf%Ga@m-GcZm6kKO`32BN{ZCs>oNRYM%!7
z?WTPoY0Z3(^%Ro{*klKSIZmdv4EF|*Jpj<2WTnrM#jGqX6mJA{bb8a%Qb{(CXrzIU
z)eGGkt*U*@Aa3s=b2H$=x@G5k;N!fkYLY?8j>j6chjm=JtbTZlXUkzz7N<eH;p+_X
zl>p>B9$dP}Uf+Wmb!w#q!2qb}t1ns>F>&+6?MEwo{Ov2zYtV?@Wk*)@ue#F^i<l~J
zQqU#Vo#CjzXMZ*+A&gH*8ss)}Dn1?_b~~tDW%H{;_hjo~LxEM9rUkmzVh!UU$Y<)%
z&iz2JWxo*2;j`u>Ct~m*&zeY0sNO{Cw6LPTUJJw+kD0leV!~vf<<j-Dz+qvFnMtgA
zqWx!+_vUQ5yA&!N6zA~qH5{4Y-Q_xxfeh>Pb7ltmTz0;`aQ>@;3Qx*IFp6P`EqwKF
z)|<e7cu0ZTbly(hEUFg}r_<E{Pw*NsG_n<J5EcZ~WN#KHiwxes8R0e)LGHOEGBJ?U
zrDjb0o_LUuLsxi$!16s6^$Vv~sjPF@yASVGrX$Mnv6`qwbbDY%ab_amK{z&9djB3L
z4n3(a((S@aKdfGGGN^p1qAziZt&s2t(|_q@u^Bjyu=Csu=uQW*pwha-<DcbsthMnm
zMb8)^zj?2UMpuFwy?jjJH_5Pqj<xfu!`=mobR=mnJ>3^Q-p%#ba!<}%;opZCf7gJh
zMS|2qO&5l(YEypmeNmtDv)xW?;vsLi)aGPSU$*=Bog4Gl`|(pE)AfD`HVr&qTTGfD
zt)G||F!9|w8;8Vc(N(JcbYCd4Xdm|v{nZUv<kw%Vbx!ymrp($VSy{gtZg=A-AJ7GD
zcSv0@aOkW(e@PhnvfbHq#wEZ@Z^U<lhby+3b|THh(<(sAgc2ifgr-`X(E^fXU3kUq
z&uA$?kk(SEe*v``Xs=BJGK4Vfg#v!XOC?E=Qcfez3(*EmyYy_4rAbxK>oV9W2@c}4
zoxD0egirz>Xkvi#W_Vt}a9Bacr>fcC@59snip}lk%u%**^(?{2y0)hpkFD?p3=&9!
z7bBP^2{;m6?$glB+kHwAzh3%Kfwb$iZLeSL0_uD`SI5S%cF?GA7F!Wc0^{kWGjrQ=
zow%VN-p=YLdaJyms?IBkrSfg(Zl-a+llSRud<jj}z<uwy|2wp`c)fpQrX<a@>jl#0
zbYay)Kiz$zRcHCP{jjoWL#BL8;(A%0r-eaam1n=W<Z6oE?({PUvhK~Uhne3y6XcSb
z%*>a=P)^^FX51Z^5fT+r&XYGTU1VIW=Vh*kxApba!+MA#x^rA#Sw_!nP8IbVyI>`=
z-C)lwmh8$Zqy%k36smS`{Xfq`zn!drqUsjD`<b;Mz9)n_HGSt8%&A)5U4!xAeTxOq
z?n-Z|t=a7wk|qTMS>oOWQ%^ge^D4<}mJZI1xu9xPLIi+1h_cz?hx9k_g1o9iyE;fg
zY9n-}Z}0SoME|&py>h=IMJ<p<VrBDm%d>xH8y`~04uxv9%k$=1cARRT4Wj1UoZI`W
z3y`_zDVF<fQhNaU(00}U(WCePFN{LXb3oV~@2~7D9_Q~u7RK?9uHnc}Zl_}uW<rNQ
zIPdnVt<<h8M*?Uz6CP93A#&?1HjEKf{WH*}1>QB(KWvlDypi*Z-h*Ri$0z4FI16%d
z9>Ud^hxc1~?4}1Jxm^AVwwQnB`ln4LJ}Tl!-@|YlFIzeC8mvAdp^qvzwON`YBp4x>
zxNSz2$fBEtTZs^f)otf2lYsCL2BuFmRMa${={yACvoq7z>PMEs`k(tUgB`sd#SLsv
zmpGVkV3xT_yYPL`<)Hy<yN5NTLY-)n#qNcPwUd^r{;8oHCOYGQ;o0t!Hs;XlWH@&t
zQ@<}EoqhUd0hGV1n8N2Q?kO7~`=c*gIbv$iz8e>ccA$B@yHm^~qgriSiQ81Jy71fU
zcGEr%daM{0-(g8X&Hdq%z`e$_>lF@w;N1_dD=Idz%_)VMVtk6t-|KA9{jBHV9H~Z}
z<AJjupIPkxc;sg1_R@0Lx^L$)kOPa=IZT1p47I-WS^b`cu1Ku6-D>+f>JwAdMBX1k
zPJ-X$W-a%e73-i^Bf`Vz4cV~!7pH4uI$BRHE`1>?YoB8#o<+Y#BJ|L@=%33jeM5ji
z3f92Qu3Bdr5%-E?Z0ErN$yzFNwaT?Kvjh;E9JWWkq@evt?@`nc;C95F4sV(nvsg2_
zY$K{C3*XJ*wJzB^PR&P}H5GW{tXMV*8q?=tN?h|!8n$Bt4aC*J(Du?c*>=0Y@yZ_H
z<@C<A%F`9kEY}H;<}G8FcC|&hgFcE*O1#>2jIK4SxdT^4<@MtT0lAn7+4H0QxiqtI
zprjdnOX*raT*we6Y1i>umgbaV)#g&6&u`~aFdIAqw#fU|ME<MmP*3VIai?z#>_8Q}
zAhPUQS+~))*3ivLjbqJ=F}v_f**_O(Qn~o6N_~igQhp-_UOW#PJuF%%9CVZCNcvH6
zlf@Pv|1~qbNJI3j4$SY*Ouxps12Fe@sni0a)$Rbu5YR!3sL{H1)Nj7x=rkh;YV|j|
zkqrgXzmr@=lumAXQ4Va^t#Pgm=u8j?gHESgmQZ#3XUM$ptm^LQ>e>rU`J#^}sx8}}
zNv2g7{NcDhE%~oPj;-UG<-rRrs>ju`&bK8^{1wrg{iic0w-Sy8uwy{!23UdGihpXL
zIVJU3RFIl``YHXleyapI3dIiS46fr+?$D(~-q-j;7wkRmnJo}eT!cTfh?A*O3ZMBf
zl*?ieWjt&kfH~GT)7$>kURAQgIeC8RFKH5dY`xXmx;M|<7Xc1l#vlFw#<EDWb<hub
zkUqOp*PL0!95$}Z+9Bk58pD!i>Kv9>Yv>fa^wkK4KQ^mUxFrkrL`j+jmsGo6c3x^4
z3wB(t%07D!l>GL>r3-Ch(f+f`yG4HDbhX`C&Alv7NO0b$OgRSbfS5JcyX?Zk4%e0{
z1XU{9^3Jp_UC#!Q;Wy}w?zir@$y~S$g(LGWwEVuU2HND+u0J0w?ILHJS?doE7Xn`L
zyK3ME7{y(DY+msia&^O>{@8@lv2}n}{SJ?7HB3tQ9RQ~}O0KV=YeVPq+3{u&`A>g^
z-6m6sXy}<#yB(=9HtSixHU8e*otl!e5CIl9E8%#&FihphF-?^WZrI7!QUYD8g-lnc
zzg5YCOb@+eiB00pCi!y2!`j8d-~CE%Z%on3s_s7T%={`|!zp%JigsY7dbxWEy-&=J
zizgRhpdxC;A0rW}z0uq4(#?V8tA3v>(6I?aDVgT<JsZlYEEWFM@vVPTq-e%oD`+El
z6{N*?{LJU@c%ko8Ma@ic)rS#Duxxk$blJ%LuJiYZUs}dwN5R;seN~#Pc|O<=!j?}=
z=A?7?hH)3y2rF{ZqANiDkh#8K*^8Biz6QCud_WM97(_l`Xwaz5*|L66*%=V9|1#Zr
z{_8<$Cc>_C>wQxbdZzb0JmYmP2e8I!`f#X;)cYG)ZM;svbHiO>;0_w^)3*%=`0Mry
z2b;!4_wg;uefbopA6zA7>?C*aqf^7=XXp7zPYB*7FJ@8Qio9*?RByFOr~k2@xNSA-
z2daaV=|Riaal}i%wXe0)BNeG`LDXTefP`&wAll5%I&gUS#$VLr(#LM$mHsmMAUyZu
zlMc7m(Q31*MA|%1ixu%@1kiO%3kIeHZ8KQgH5f6(0NQMF&0@e-?jvfTAYT?t@y>I>
zUqw~P{JJm&!QE-dT@7vO{2Y?rO&wT#U8R=>6JTk-$n33<(?AmF;s|U(6}$x%Ql}Uh
zLJ?4ADU=3$I$ybYtFm_fp4~iE7-eYPd^M@&JNR|bLhvT89S+5H69>y5XS?obEQASl
zqxn6x=z}r1?#s?3f(K{pr56ugJ>8scbXZb59&Je!ZT?VnaB8)xW0o<O(K?rT9q%RG
z|9$e1sMBi^*`ol@Z99($JYB5Y_9FA$^&8oxZ?|1xg9rcWO43_pJGh6dOKi|uk@St1
zM%p(qp=Y!}#1%Dl&V&0iL!F+@tIlPU=SzHiClz%iJCK@yV_v7d%z%lh=iexV%knHB
zEuDSh99-4(7Ct67)<mrN98`KhY&kMoSrd-PeT{(eVIR{#3`+S^xIJ8rOq{qDF7t`e
zUk>22Pq|ht>vHQ?_o*|3oUOKjbz|eFR!O^GET`1Y08kEf*)CJW;DSJ)C_}0-3NUr>
zdf_h=4)f0(cpWx&;v>joijjk2ruy@d76w%k-!=Rw$1BB3WKLS`>2px<Bz2M)p%tSt
z2x8c^uHXK^a65MGy;QzmF35{seY<{JO62_;hO6a#<r57&cOMI=q)VY}krc@W{81gr
z_{LPx0>Kjl9J!<bQ(K@AVn_?OZi5g83!5qwYz#@L+@%j|eFLU_=T0Qlxo@(0zIlDE
zmOY*%;u4%UdyE<aKxq4N`mdvqm!f)!pED04ei4S>QwSm@8OU2ZtoQwjcPmv}%8*~2
zm2n#Lc~pEJf1LEluw<UaptEC%X{R_34musv0lTaQhpq<xB<YSlhXK!gzVoZ@#6(t?
zW#b3MHdDtxeO${H$M6i@QE`9d<k#ub#i|9IUAKkv{WNCFeHn08ctuT%)K5h@)780R
zlbyCKsd$AO7DtIB6J*URJ{mm4#%wDdL+>o+Tc*+NEuWfmku@IzKM|5+?gfBc&8c<|
z7v}IJA*sopTcbGaaaFeChq?n^hhirln%8wLlE<Z4F4Pk;7sa(YE6-tX-J$CKW;0N|
zyW^E_^JAdO;1Z!<S78X~9$SpSho)Uyx}n>DA&pIj-=d+HRMAhKh{Q!|8d4}jw(~x@
z52Ej$i0aAM__8#*>jA)w6>SrBJcEzC#}9SpJN9)m#Oj0_bYf-pSO!!|HRtBaz2>&c
z@RC{7t-}0FDJQ0Pc@Wpvu`q}wFTCb@UI0Jv6Q6VcS%odjKvN^-wa7lAUbqhFe2E#h
zroQhQi6D!_(yN%+0bmW^#p}6ROy*88b2)gXwL90#%fR`}tR#q_^PArueM>K6)0aZE
z(C^Aq0?nsz)=w)R9m89w8WkeqEz(+o9oh99$X50phD=Y1c3f(o5l1~-=`uavUtM+)
zPb^gYe*Uvn{%9$sf>Qk-y#UTHuSxRt%Xsb5oUC3ZfXTn=&)l9HxnBFN7tiyU@V!C5
z_y3k5syGE!YF+wUE_WviygRO%sOjyr88fMY&euQdUWeLnyrYHkowFk)Tz`1mecx<^
z-M(IznhQEvLU6j8n00z7=P~zjW;vx0xI=1@2RG7Q=IQY*P#2YCuT(m>(&`cK3@+TL
zk#^Q=KF=jg&aDtZSxE#726rR8G^T?n^}j&P!j{YO0$6Z|>sEH76iw>AdL~<v7T<it
zln(yNCS^{1|IN*>uaBTo`Wt)~DfO{lb~W}6P1d0VtBDHy6rsHgSBszH#pg4<=W+U$
zXFB@K@T(&kw4JdQayD4hj5J-AY3zYW_+0<2w1WwMs#_e2weN@R`Fv*9(46}m2qz_#
z?LS|>rlp)ik?V_z+F#-m3U{B7<6!aFoLbvQyQA}hF+6e?vv5?ng?Fi|{!720U0L3v
zF2rhsQ95(%H`hIc#bK2<e@Qzmv87GoXQTg)X+m*UJh-SPPV(F5+3(K_N~BF_6dj*z
zb&^XxAZ5n5uMnO=IQdeIqw`KLw-+ixBhI^%CBv)|uvRUYgP6zd^2=d-)q6?K`Qbh2
z=|d<a>-(Mg0m+)$X3@TV%3x`pF}a<}0v(zUty3&~Ism^Pxhsv9ttC6vQrr$K;%={6
zfI#|SX;f@W=6U<1!$MX4Dn(HJb|wm9mzUf`I4nyUMTz>g>277ab>@!;{fQ4pMjY{T
z@`zVbD^DBsi}z?J<d87ofX&}Nzw7YmEt0IgC=&rqHR;x`%Zz0#^e100-ydP_PZW`V
zOLOi~KEva7Jhnevs6EqL9(0m~4ETbcxDQi!kzX9v;YFJ!a>AeW4(OBRt0h2U{F^sH
zcPqpb(VK#;{JxQ&p@v*xbrBKd@NJ8~67khT2qu}Q1WSV54ogkC*Aq)TRWFm9Q~*{Y
z6Px+dAj4<s#?@93`%m?U*Xo3~@<wW8;I{B=q`vb;<ghYaJa4u<q?`)C@Wk@gXMEjf
ze@g0jrdopP-lXM`ng+6Pwrm)zCkJsDy|u(p)?}bAV%M*1b6im^LNuOS^V0j>UV8_2
zgt<;CWie7~XzMXK@VMReZ1~#{kCMa9LwEGI_yEajXO?y@I|mpZl0Go;Tq?AK&d<j}
zhid!0@$AS~r+jRDcu^;P?}~wE+bJ$0JXh9PZ@a9A*HW)CJ_es**#zDmhe|Y&puzh;
zgg=FJCT1|tFP+V`{Y<S+Lzd#(UR!KVmimh|KdA2L#<!_iLWlK6QnE9{`k<PNL7_ry
zMpnn`+4ojg66U6f)>}2i#vg=q{enkt+Cx?r=}Iy+W(pL{yJ7Pa-9{$O|K1tl@5QHw
zn&u&jsUsC@{inPR{++l3uoUv6VHP^x!TJo5Mjm*6g1G6{4tWQvmZo^2yTKpA5Td`V
zG#OqVFE}EFmtf6piwAnSN9n7QWNenCK3aVm#f!(*4KJ_<^_J^<Qzbu=@ydy`Xu5)u
ztP-;|r`BWjAc8dEid&*0gN1RTK`gVnoTURMXFSfkyomg&g5PW<AgTLaa^Ok#5X84|
z;O;!S*4|RMj#8QOox|6b=-z>9@re28s>ThI@`TPLX3BR_y(<vwpvLO<X_iBY4Vh|7
zVU&>{?#mQ6eHWU6UZgQMyF+kv(7f6PPgunV%>(SCdU=#+GKQ>ie<=s|tgGkykmuoj
z>pt?0_zGtJK=xg{*A0Xk9yHA4^NjTycAH9ptf*W)h?)-f(_mJ*laeJ?C$*Cw@5+yo
zq*H@)i%ADOP=VQ3LM9h7v0#H}d3!m#cLVhr=GTPeg1pSbTpZ%+2GSQ#zLw>Mp8xC$
zv@G)k{spM~+mQ{FdVb4ft-xm9w3YF+*_6Jts-6l(>Xn#(l%SK6CG@WH2~+>b&k@`E
zR}Gqj6khRvi_qkNO1&WL1EBOdUY6e9OREW!tyyFXK+j*?zSU3E8*9NY!r4@pupPHx
zCS5lpllK?e+3%Io<HPwMRqChry6`q})u)Ot6p2#HD@BOfBOB2cvpj0Ch)Rj5(StZs
z9`duup&OHBSbHnM<R}GFvOTRzY_=!GyC4YI8Hum=he=olTtED#e|ejHr9t_}xPHL(
zCMkaixWVOnP=^!!l;v~Te-=pp>p~s;+qCX}@!=cg<ozjusk<ehY0V5^gNDa*b*JPh
z?#73yGJ&&<?-1}v4Ozl7>6ud0x{X}KfcZ!|%svQhIilb{eE(-ElV!*i(&tpSwXbmY
zN^LV~WsuAoOf=Yus#Eos>B!OO;Fw~_ofyudpo<-G*nzu1n`54va0Z278Y16@#v9iL
zB~7TjGF;f-3gf84@x2ZH%P;xQkNGJClK_z;#UquuDS*gUX`2Ph#q)b5&p3w)g`8Lp
z9zpLnd8p&-#9DG^@67_EALRsXXCGn*Qs^pLveh^r>EBi-CY;E8v8t4DUz8)?l#u$K
zV9-Efe#K|OSg*L=G|^Ig8_k&eoWQnx1Acj)=>7~5Urnr|Q|QCikIRYN{FJS6Cb?yH
z|HFzad`8W^0C3-XhGDmPpkepHBxQtXFj?g6*~Gu>&)C1)pNV=}aph+tlF+zrw?Wt<
zZ5KYU&X$KZ=y39s<|n&*X3CUCiG>?5IPuO*5R~hr0&E`E!P4AvBixp7_Z)_lov!61
z6gfIr5wv;k%tK!9ZvBTLyJuDnZ&SLe^K0;Y<p1LHQjcr4F)W*Tku@y#qsP$2>{yAd
z57{Lp_AHtW$YphIvcP1<cjQK84LS!i%FKZ>mLe(AR_Jw1#Q|RgCQ<B>yAGGl?faCT
z8tO^#x57O0RDPpeZ?sqy=-CjN|A)0V4~Met<A+O>N`&l0*>_{hJ{6HYWM3vb*^(uS
znMBq>+1ExGvS-T{3PbjNCo$RgEoRJ&_tO2`_wVWXJ&*VO<2{c4nABnBy5>C3>-+tF
zHmM2aS8_W@gc&n{)jO+c6Z-=<?i_?1ZuCh~>Cv}0H(VS(z03b&H)y02*LttZcv)1J
zO#CKNJ$iiO<wEFtQ?(4F5Q{F6pvzLU%m;O*_=JvRshXZJRxGDW4Kxq5_cqXduTvWX
zF#UwPJqCqftxnAD>dMxxWN(tfv&e}aF?J<iy#K(C%mqUns`+B0nO;bV;0trsLOV9^
zOcnJ2XgbX!Z2$k@ZUM_I!<EQI`50~(w_4&*=8#uIm{2+gAhJ<rJgsM1%*hbAZ~Ar@
zzwE@1bxOJ97baDJ7`S-)6D3h>A%4q=r0~!wU1+3J!pyDsh`rOO)caH)vS9|ptkw_q
zDPeb)5&J78T_p0AW-wdV_Nyiy&BjDUakiXjtDOkz!XF>H=sOOda=mN)QBeD|B}W%L
zF9)8y|EME+tiY&(KX>PcAuqV$6d3(1wL{SDdTf?>=fynOW1;vxfO7^NLgqcK_mvLI
z7w@Rxqa!gs$MEHj2)XfwqH#MtH)Kwgcti@jZNJk3aMfP9`4ard59cv}1g9+@Q1}oh
zopx<SY;68z`2>1vEgpPq+WtcCJxB-K)?&cRy7bXJQGt-g*^X7XF627djl_0U(j4If
zc4=if4MH44$c?Lsi=AlB+{29OAqg0&6CaDHf?t*VZ`0zxPlOe=K0wleo(137)1LeE
z0Y<yqsg31NDeyE*w;mjO3GAwDyIA;FX2#pe-sEr&wcF{Xg*)-{{-mGaX!sWY?Fz~e
z=D2u-3|g9}Ad2F`$bCW+Dfo}Q^dCZp+b%>!zZE{b{_(yUrD|*oCJ(g?r?aU{>Dg`=
z(gjdl@ambz6LW^O>H_X9nrLy#{eCUu)@+(UW?!h%Pxtl`W`+M!JN)x5x9<^IUpngj
zbPpi#8V*2G&FyR01OjN!8U#NuZ6DHte}<RD@GIb%TU5qSN!hKsT#G>+tcw5p#5`Hk
zG6CM22Z(No-p?8@+cl4s4C4v;HJLR}KU|L>xg$wacHz8w5;FNt{;Gy)n-!!XpDw^q
z!I|}a&>39@R`SR}dQJFtIAsJ9=lg;ka|+rF@HJ0Ja+%;vCoMI6EY6{@i{VPVnAe1U
z6zYT-OrG?~J|pdjhX+s0ah8rBru1kc9`23h+|q3wDk+<An$Inn#l6=5o?ZICkoS{k
z*KIE%lpuSb=p>xLu$Tf2@t*cWY<+9O#v%fh411_tYJ4;TJhlypT)t+pT_4o01I%ue
zI`%B7!rHR}6<B`b=>MhD{fEZ*0Dv4jNdfjEFVb3+{HxbffYHwWoR14%`GEgLoK>M+
z8iR(cZCDwfUM|F|gL&<^VEAikl7@d;SX)4K+GrU2mySFrc5AWF@5*o39By+8GfpI6
zg}9F!siM1(<h<WIhs!Qf1M8blJoe-Vi07a)gZYoJ(mR*iRMv^JHJF-;{j5Qi%gXNX
zTnbjdU3LR?v_sp~#8Ln&Z$VGpCoH+1`c4zX;ik%fx=&3u{UJcxfnWtjZ_6%n1uMGN
zJmIG?3*5TLGXjuI^E^gwe7z+ZuVkTlpKy59)C$zlazjBOZMj)x+Zr_Qq6uyNZ;j>O
z`%xo<E1*n}J=<RG=%<|Y3Ibrd`_s6@*9?rdbdXq@zj@VHa)($)wn<<FbRGURIxuJ_
z0u}QTPO&bEGa^Y_%)N3WX{;kw+r)jjK=uTKbsYbnwE#dY<2>2?fti*kVpe6SI3RtA
z9A3C$CJ-zY;cj<z{jp*aGE&Ti%AO=#;mjkT0%<Uz(fF-5Cj$UR)hZbPU!=7={doBY
zlRA-3n>;ctZcGr8-OP9!(K1vlw!XqHVoNn2EPRpD-59S91D-dn`R1{DOz1epS7m=e
zQr4vZtrh#H3LE0+Gx;sdn8)-x^;^}vi&5RuKSy4%oavY=U`h8cNFwsbQm_9~>_>Hh
zeO@6iKdCq{T?nU8+r~8&^lAsd`21pb%6I=4|MEm|vcNG6?%Yv_%<FpK<DZL~r>#)g
zN?TJsq4ebS_}L`9K5_mgZ7gqIkGLp#=dRAe19EIU1iD8F?gbOIIUH6b0dz$Uga3xC
z{7uz%2soj70&j(S6RUA7&?#)5xL^hotd*c~aI~=%x?4<s@e|cE&L-Wq>IY}%&U=W?
z{fL+?plPJ?BjJe-EHOAYSdx|!E5t^ZQ81rtjtM(mACz)Zy7o(ZOqZn)+O71Rb(awH
zSbmS&FM#t6v)UyW8y}HF*7y1co25RHU>J|}q16r@J!h-o|3zyikz}Q-<6p>?@712R
zBkCsgT<W`_Ar@)T)LolfeZJW1aqV~Bjf;CE|Mgtbc<{IASWS*^^h9>-5fdz3x~IL6
z;~RsJspY+3J8WH=U8(E(DV$a%$nYX6AFZD39ro#v_pH58ie%(hZELB)lIqf=j>FY2
z+^iANE8&w*pqn?yTJt9D(%f@C?hSOlrh)CJiX2SsN(Pk9C&&g38$h@#y%4akA9p$m
zB$g3xXoAKeo)9)1cC;XvGto@ab7jc)bB?JaQorfdWg*@0nqM+ZL5k$^T+S8Sw0SOp
zS8iSTn4BcJ>O9>v;dGFc#GBp;JSifne(X9mK)Pm}e^qFYBGt<QuF=PN16hrwYf)~0
zmc1gFt0%JO7A_WAJdM1*a$SXCr39seqtck*vzzy?lg%e9-V{*-=HRq?Rx3ODh&ZR7
z78Jd<+yuZGO(jKfAgn|i?0~CezNm?8y(P0+bWr!Pw*f{5SmzlfxqaWTTr~ehR<~Ab
z|H$@9jn}%Uf0AR4aYw4DKIHi_B)BKN;PPjWE|B5a@k{XQ{SmxNl5N5`AX+V?B$r=H
z`ZzYHUdhKAxPXAYfBAzi6)<R194#KqeH=p0(mdg`Pr8VJ*;OAEE1Z=q@179!%m=BU
z^1R*w5d7I2_16{S5Vi}(&7Ze@jXX;^(O$hKy&^}zj@3XCOHTStemwYo;TFd19BRST
znQkG?dLvBPHh_ed+@o7Ud+EFXS5J#a0k64CT)9R6-WGpxTas*u83$O=0!V#;7gc^2
z>S>^Xb$M^#Ct!$rI!u4ofbQ#~i)B<H(u2M98ewO0@Imq7(TWg-;IcV&wgj*}xm658
zaqi=e6a48cKc|*QIAEg{`6a)gI6kOtw@03xj0Nja>lf5_jvS|FWIuhSxtU^mlDHjU
z;?PR9hPc!WN6ltN5Ez2}cfHD=6cT@TIlwphAAF~@c(IPu1s4Q8n{bSNvclUIWZ4{?
zFtI9F*w897TYvDKyca6V1~{C*JyKV+kGQ)X`j)+^7mSaa7^7HhWh&v@uln?HEK{B9
z1{NKy-~b|?+huerP9>f#X~c;79j)IIj4B04+h2w>f8Y;huB5t_=~pkLsB<xp5~hv#
z31tDoJ0oTu^;@`IZSAresnS3CgrqM@>~B`19U=#WkrMfl7yAv0vlePOCpAQ__tR%Z
zgXXc^_;5uicD~bR#TSa{%OMzPK!<1|fcjA~tf16Fl$j=|j7yC{PlQC5$yy5F%)cUz
zmQi_UR%7Lna)IuCDsD@kxx?rkgs{R6%gv15@!CqDe3XhU1co&Mf|SM8bGR6KGLoP^
z*^O%HF0o#}?hJvWP8uR2dxS#09xFfOR@hyos_IL>jsX1NXroT-^TCE`-sa156ci^I
zZy_#KVlKS2ra6QaCp_i1TR97?J2ie-Zfddmm{Un$(}m5(Q4Jq++jxm)0974VBIDw*
z@@#CN2wKiX+_=~zIKMe_{I(k3bbfX@_b8-hA&pz0;c&om_BE|KkbvNRH|;24b~R}c
z_?9ld*pp#H;dd#ygXt`MWaM_X{4E>t<X5Vuy%i5v3WVp>=87%RK1G*>KRZlWS1TTF
zIthoo*r*W%W^JOyIUDq!#-1L1Y@t%mjYpMy#@(%6EjDcyPCU|ID*f8(SSjKD;-KNC
zAGTe^5%q-A6@cOGjO1N=zxt_=v0iWBzchOB1MA6?I)f;H8?nSBIq5vPw;J~BJ2Wf#
zLSy(CAN1_4-l^T!v+ThrVeCf4t94imD;j!e`3PrbD%T~p>37y0Qw*D7l*HplEK5-d
zmjW-~ue#RnW48dThU54#qJ|ZE*!a;EC((B9V1|a)4Db;Ej_N-uIgxoPK<Tel>rf*Z
zMhN8!TL@E71KUpY^B|LN(yJqel9S-5#7|~}@ZpEOlVM-!HA)#wi>q|ocH|Bn1^kE9
zbIv|~#1>2)227)r!E~)soNqfK8v!Q(^9;5Jz1Dff%;80{hw+PTkkWvFt%!bQf>~(J
z74?j{rt6ar??3u9Zl`^B-W~y+T3ewMl<p|fYwJM@(vHbkMa%!9@ONEj`R;=r{-PcH
z>^su%QRViRfSJ}JPCN2WfjU34N^kcidXmBQXG;u*jm31=pKonES>{{}Vvoi-Rj+hh
zZoW0+r~i)YA~h=wN$5@w6n|Y!bN}bD=Cv%hh`Iel2-JdJY*%0we_T)f?nN<Mu;=oC
zgsUmY<yv{;<<Zt*FW6Fz_Ti#2cSwJhuW7J|;uM&EJ8{?zI9{JoN%zR1TV5vBqqXWn
z_D5!T<PN`>TXt8DsE-~Uh-qJ9k@Y4!+IV)~=V02l$*H7)-Y#@b0-V(_pRk(gBX`rK
zMkkU9f1sj+Z>E@`P#3DyND2IFCD5L2h^v)_N>?uDn7;Oy6J}G6<nx0%cF~$Tvyx0x
zG{+m7y=hpQw4YIIT6Oyz1HIDE3GJ_30x%r@l3Ee6h(@Y$%eLv}uP`~jDfc7I*@e{N
zi%vzAP;A-il!sOUW?aId?_d@~N1(RwpGR#e3hchN#>k2P=_3uS$q9wCo-qzf(KS91
zgwTc1?>sDeUi+%CHq2<yD@QU|-;=&zVRxR+5QPbmj(N;{n-PoZG29FF)9f8sl5-F@
z5H$2HnfyG+D0YsBXHbhO*$=5Erc4*?1`XJ=Y{@LVcvbr^p9pr+!^h6QRVo4#Ig&($
zWh^qD4%fi@3XkDmN(``?hk!X*?EUbM9cq)>S=C*9#>U5Otg4yK8Py$Y@rD+m{6h<x
z=IqMwP~icPW5oFu_)}|FFkU?SbB${KI~=fxo*b@~YsZKLNCouCJ{|fdV%4(6ReEU0
z-_4sIa*JBDx^%irM?<-bt0x*v9(8y3$}B+0RC9k9O$3k%%-<Q9h`AXk_DV0Bg}L0=
z1f)1}l?(DdTNxEdlBO-ElBj9Etacl7&`A>~N(30SJwNpRa%-FJ{A$8}5YNVU`s@Bb
z8}`Qc0oynf&DWWb@w#r~ofq3E`+*Y5U^0dnXgmmjxMmxV{iQLx^W$kAJuHp%sW}Vw
zbO?{ouVehe;F&eCiny--!2APvU)^?p{Y3sZD~G8Y@*K)nbT#2k_=l7NM?NPqBB950
zP<pQpDr@P2$Wnm(ExL0i(T6HE4*(wG8Pv(h4bE9ts6NUmJlqqD@~HcuGoEvoXvY5*
zn@eC{o?fnqoU8U5rh>ZaaYiCr33RYic`wL*%xknhrMe=*+7^6lHkO!#)z)!dqW2iK
z?utw;&=)mWj0(?mmB+wBCyn3~t0OK^6$m$>cjb*GzYgbX0gs<n2Ky+15E26jjH%>(
z%&^#|8hYyYNmNNX<$vG;oVpZOgd1^Y)K%kii=&d08!1ZW4P>cM?6RJ*7MSiJI#)p)
zYUlB7Y%au&P}BYaT&IMx|8r;!2<T?bU^XNoDI9#(#o&Rc2TH6HIR+&8f|8t(x>!yx
z><6*)oo$q<-sC$TIhyG9ULW$XuK@XV7?&N&N3qTsTW$I{l!Qp+zN+}`vq{A04^DEn
zN=A|M8mU~(93a03-TzEvIms4XesZ7RmM+i+(W@w6(X21zelOpNdp`JiVMAx{b8Nr1
z%%3OE&yA2T8lal^#0-cbuxVR;f0N0t4Na>DV^VTPW^W6moZG(iCS!PagStxmWY`6I
zW!(-q!X5636(rG_`sHoSUG5EH@g5VD+ufsf+_Y?Ut{En0oLG|sElvy6Fai5C$B4-9
z&i+)n_Ujp!3g2bM+;s2SkGnnfO^rRW>}2#0ssk1+Ls(2#+_Hc47Arf9kNz>m%eh3f
z6itu4iOpVFica#>Q?i6Z^WF^b=&AU9Nt7hVWY|-g%5d3ZP*&mGtUJKPei$q<^M%f-
zMd+LLaK<L(pXYiV*hBn-O-i|r2(XFzgnJ`g8uq$z=Rpoam5;)|f<Jgd8ZBFlu_m1y
zQhqs)KbZ1=ak#!I8FA~HiGaDn%vKlp_^xHT*Dd(1pcjQ)F@|VDb%a2f(F7}<ifiF7
z*aa5KF^l)tttVeI*eB&>u6Ay7w}IP==srz6&jr@%;?KY{on|l`U~!w1DS-*W9a;~k
z(QxZJ{|r`B3?|dM<!6m#P8+eX4-|Rkei_bS2XMVp;YXh4wMs$}iA{L=wr&wL9QoX7
z!JKjJ)kzUG#MW1}8EE;HgzjQ_m+s+fk{86gNZ}VaE5A~S&cgEH&<FLM2=n3b>b5^`
zq%IM)-ZAqGmfwUwg)hX@z_EOJdFav%pnnN1(;%{Eu)UJ0J#UttAdF9n(aDLdreCLm
z@peXwh0E|mc^7?oa@SeQy#0n+QIuk=D&vyz)IPi2qfMH(B1uzQQYlOC5f?xJ;(6?o
zMV4D3qX3nRi^X-wdsT3>Ewx~s_Mn3$)-~zZj(YEFZ3V)|1t~9u{^R~bu?6#{Tke~)
z{OIoar;3FQYh}Al%1mwy<VS<0jxfk4D<A%iSl@kpy4-qS)7WFoB7%I<?KtEk?h^m&
z%RR>`@5=0e^ox=jYz)tX%_LWN8!eNWJ;JA1X6=2*hHAl<(fhXRs2M*!qcD}3Ngy-I
zz|>{^$st0U^cntW#OKN}3%6@a#Yy*fo0G^->pSeYad43tKjSaU_W5wGe0z7XWiR4Q
zz>Gf=%)Gz0$kSvu+0-%WKj$$?R-_q%PaV8I(pIU#e%|%KQ{r{KdIq#5v<MhUYWQ2#
z%eDe0+$MasJA>Trz?#*t@A!KHza=Q0qvm(pNMH8~hg9ITB=3o953B^J;}ET_IW{$<
z@TE>8fZ3$M6#Pxy*~-1I_x<)`?r1E%dNML0<(z%1+3xXLI!RL6FikK8)m<v0Yj;a&
zpItFA3#^l^sHPd6+qid`B)qQf+TFK5NW%4aQ0b3u+^5PusIQxOVlP@JOYKN{l)i{L
zn5bEtI!+%S|CuWLEWyGx&{Z3}YnAU!#kAA&WO}K%&5v=BMPm2~ihiWM{`tO|tp4P2
zS*2xUcaNcl%1v?VkZ4YrX`15rl35SmLTC6@v&r(Pxo6@QOm$A9#UO{ijERlliL{z7
z<EF~A>S!VJR>xSy`n2xiy7wd#?I&yWG3iz<>VRYj`ra<mv{|#!TLRt@1(bm4X}6>I
zR3i!aRal7<w+edlFIQjsv&1>cmY?!@+&-H?CMQ>3R?Q6o|3zC*|0Ne={fmRB7n}8o
z!r2oX=5bWkls<iej)U6i3Q7=cpA@fSmbu#1OidQNu65iYIyWiLr2QVaw3^;th!97Q
zPf-UeRDf2NG7o=frxsWV@);wIC6XT{ab0~F#>+V%Y7x~Axwsum;XftfAFfk;2kIyl
zt;csAYC_F92XYsg2gIL0cM?19G)cyN87GUe1d!M0k0wwZQ&VZ#@R@!emnln{z%acd
z62EXf&@|-=*Bvc)CILfIiyphtBEaMMq|#;}a;bNfpw8OccQRCM_WI)qvNS}TZJsH6
zb4gb%BmR8ye%nyAYuJ4_#dG8em8-gWxxsOEBtpYie?Z$D%Z;>(!xlVsOy3!040{_H
zH6Whx1wN~1!I5oFltB^Op=r)nZ8gxweC8^o)eIF^LK{VKRkowVS8@Izu_K`GKZ@{w
z2B{}XaJI9K@kqjW4k5|vF?@?%{n+^-%vNwIuM*4e)EV4o!q@|Ngt&q@(RLlF*2O<Q
z^e_XCY*gAFTl%Kbx`wuC&yyi-fY-t&U33WV3C<x5^ZrHg$A$ifYQ*8y?JO+%Sn+ts
zWMvs)3&lC8>&<(2KBv`Rj=S;GisxI(H)5ez?(J%<D{8HB7%J_X9~VGT;0SIZbOoiK
z({7^Emy#|-O1#9UWP}IFf8&t;bA2LY#M#=P^1wMsz;$uhXJOQ7;$%FG>Gt_FEA#tT
z?jwknl!vtx<4Z;9?+Qg&7cV%GbGC!#EO&By<j4Z5B_RyLvPjl&^;CC_ZMEaIMRs<R
zGnm{zyWf9Mfs>O*kvL_5Rj=hO5=K>}h%cA;+cHK!xfXgUiD@}x$T<d-tWN!5u=n*_
zrHc+?fY71rDcRQq-#F4ns?cS2a_JBJV3!3C9YZEop~7UGpcw9dxfuK&=T2~o2w>44
zM!?9DGIDW)i!D<TE12Q}#=MY=fM*Q#;gkNHLKbcwRq;e`U!>i;+}93p=!z(95&ch|
zUG|$4+R*tY{|hSpeHXnh;>Mm5)|NiN$`+nuS05Z0^OLG)+<O^+V`xNdpE|1$UGOu!
zSBh?%(i=pZS2NTuUAB|kcRJ9O`h|XYu{R;b-kAGK@4ujqN&xD}OV1a4<y?FXoFrhG
z;L4R(6w@G7WIbPOL2Q9};ul0kbl=ObT3p+sLS%toIp1I>5#RljJNQ&tGb3jo97vy%
z=G)ia$to?g6Mv{Su~+aeU(jHKI7cPcQ|{bZabq;`fRz7~fD7^5gjmqBz1ijWQI4Q|
zF*<f|t6Whej^2768;YWb+Cs5mh$B;P-`s>EJ<6rQT<zRi$V}nMYQTXn?yXNg%g!<N
z+eWE8_PcO$xCQiRWI!6B>6l;soB!&8`)&k`umiYAKT|(_Ue+ygHGo--#P;)TTl?Lw
z6<Kk}9snn6o8yrUywmY9QUl;^;YFunHOC@bD27^HT2F$>nkIHBpZwLgCjxYechB|_
zZ6mdV8?Ann*c^(4_%V*k`TcBTZmn7B%yi{jHiTl6_`$<^h887O4<=+l0dED3Jgq7k
zfKw<yOXJ7!esC&Dgcgotw+O(x;NnEkW|!>uUXOln-2lkdlTVt>pMcHUpu)$xU;G-E
zw5Q#z!^$a>yQdYI=;Bf)h<>ca5F!KkcIb?nO{}m>?$_p=VT=>Q&u2cgzd@{L8g|tY
z>6iOhGE#>s`toht)RSxxMtd@t+PsqtY`>J1H|EsuZi4Hj0<V0G%xJH{v9mdl$grII
zSlv|9Rj~E8qsEtPXR#jr?@|gY+-zRhtKRde`SC0bDV_8RhY5y{4Ho*NRmX*_MbG<m
z*zIsXJ9WBWp`Ee+E!1wmO$RU~Ju$DL*wZs$AV<z}%o^}jbM;3*C}gSM8_XHv{Cdkv
zU&%u7H|C-O{&C`7qu5Tb5RS-~-u(E}zWDUZ;e6m>6SSuRaMHjk`0^nLvLv&p%%C-&
zY`ao?`pqkmVpU=taFal5;#bfGun<*;us%PLsKQ?7mNngzWQ0P{BP)LG8V8hZ;Vh1z
zTcgx@+M&)9kh9lz?b;QOxMjpTU|%D+KRU!*8<>i^Y7bK5>Mv0UGRE>O$4c=(fS)}x
zXy&&yT>J=Y+oGdk^}tX=5C{uCBD1vgKILTSI|Dp6;=nKPVnsT&0#3u{Cr$8`PbcTk
zq)&0=K;!qE;9rJRA2K#@D7Dxg2&0h{9!UjIK`s9-J@Shke9NO_9~ZQ5oQ6<y^$7)7
z4zsEN_BE-$?Q4$ml87N*KW-yjQ=ltU-jog!xn#<s{*=tXFSn-h4nu-a$ViIBoy571
zE%V}OXa}ew#@~i`?6fywp>)9O)|}ibkGK_t1O{31v;av^lTCHiatSMoOCmNSHeWGA
zZmBm$1>7HYR?CmkTClWLSTXDPTD{X54Vp{Dg#1V%Ly+$teGBdC0G~|P{>L8~wmvNK
zspfKY(G8Vkf^jUQR%jYYm{>6o>>FtBF$*#?2XqY^YC*_I_bj3ox~}%nK;hsLZ=Bi|
zO@=6W!^D-Y>Zgx2YXfv&y7GhZ9olB6uW9uRuMiO#`#jT6NLZOM4HFI4zKGDl*k^%k
ze2nKaw*O?(A9t~ql9{7WErXNNiwvScAj)bv?AWrr?hlWxf@ewZp$o<i9g4ps><&Dc
z#_c6y98U+Z0k<L9ASAz9mb3ctkm{wD*kH^tz*kHiQH4${<(Lf(YYm5wsQG^|uaLU=
zS&hel39_=MUV+lS$W!Bp6~6%Pes5#ut|u|NJ^ET(nvS)SrfM0dphyot<yjJN{vzA}
zYhTO#FIQJA;Obfeuv4flt46}uY(?Vig~Gn@%&K*mX@og;8d~cX^M*x$5I%duoxLE+
za8(7A4YUs9AN=IzX#lW8+-*Iq^(DTdr*TUNubr%Ns{uDtlOiysmAam3M52`G_qY~I
zwN?q0urplS2?{IWx%WguFco=DLjFlWGGWqTUxL(>13?^h%7%SJbcNEv0OqU>0RJrG
z*xU*uS8{xuUu_(s)R`<U2j%pt^;#Tsg*e8cfS&5bKJvGzOvH()%nD#C<HFzgR6Kn~
zMVTZ2w7W%qu>uOX9u0x}mHKb1q!5y=)WtaIe6wo?S{)2E?iR?Xag*@8Ho=Y+nQr`?
z@BF#MO^XzonD3bzD(uSYnX53Oy=T^q)U2ny<{$Y}+g1A4fr2Q}wNGzVAFY+vDJ2T|
zVQl<Y9X=BZAzGW&Xz!!>DflK}l=-NFQv~Q`+Z13j0wsV?L@T^zF<H2kQT;fLVZW*p
zE%c)8^RBS?3f&ydKZxtei`(4XCtD`+#FHjV_t;q+@T4(B8F@PX?Md@t5Q6PAH2v*K
z)07yafQySWT2UWnj!rULF_i1JkFuImkt?hRJZYdOC8<O3?Gjb4ND^q3gXiY=tY$|h
zw+4M2bTxfq5BSvGVOg_Z>|kR;TpJRq78sjYZH6|)Q|~nBFHR6Dt})Ws9wBC6X4~Dr
zRs7ioc!ENR0^IAoqT6#1T^iyc+A_v#rM)-u@TrLIBK-5R_N+D^G~Rgx{rb;Kvghop
zRjj7OyFXk-bT5?1Ws~M2-OEYy=&eb=imt$Kj9HOZQ$-}Jq)I!-w?xbM3us;K^gH}m
zXCzI}zq^{F`z$JuHSv>`WE}8izw8|m2#A!N6#XT?6>3!58{Vz8E>4ht4yU^;T&pw>
z9e2OwOBGP(<up$Dd8mxPg<rV->ZEh2D*%5?f(VDy$|b5$^KI6Vj;079hUwa8tRu_s
zekUqy&tBL>{W5i>-~5bUxc?sX-A5kX)aj;H@`4&3cgW7av{bwC7S-(j7i;aW15buK
zV1%U!INrjBP8OJk%0p<y!#N!TjX75&yFN$P%^tNOTQh3PfMgZZT^chF-sP+oRv!Ax
z^xWp5HA%ST+^9Sb@OHB4FUn~8mfWEvE0Jhvct|w-<*OnFBI{^*Z=CBa3O%=b%org&
z%<Wo-skO^_#t3Pd1|+cD*L{}){CdHJLq%rT-q-jegm*2&+;Z;qk_y%r*^nn!O4iHT
z2&D(EldZClMv2ew<z|RAe$XjD+TqQC3x1ja*(JFz9AXPf=0;LWBI`D)Z9mj8+ou(~
zAC~5}>V&K@Az%c@>j?YrBv#$~l2N>a+>8piANcBxmCm_5?(0Qe=FaW5*7N$K9d6F}
z1F&!#k}jQTvq5YRh%RqT;USm79nu3ZD7r6;!0gt5F-dzqrz5SE1$y$%8_QrF+x;mj
zFDF@2fw0tEy^*hu&f{k7bYDn&@!bfB)|~5^bPJD^92ezMLv;D<$HNvIO#zez`fFCR
zR)5rpn^t>uBROdKID5NONRC^)VL^te)yO)E2An;*VQXl_Nj_ztC^?#b4jb}E*WxMk
z_atuO_asiT&I+!+8K<0lVSvJK8689MoU0URtqas39w#hK>+n0N?(=-R)P^R7bGiob
zFk~qY^Fyka5kKhhm+q&6upR1vtr0C?Yn1Lzn<oeFFQH$_ZF%Oin|oD~+9B<W+%8_o
z;&_waeKftwM#nNU?1jFjg)2%Q4QPDBBT8x|yl0LwZX59wWw~Q+nx*|3jW~BK)>|)7
zTsvDl_PowqJgt+)z=D0TcCJ<y{V_|s*zdFN%(-YdG7;~1u){j=mL}D;RMU1thRK;R
z^_t5SIQVN&X<NgEwtI$CfI{+x3YF(UvCMIGk)H{_wD4zK>ymsg&b`Gw7ZpTJ;1jA|
zYX$V=`yS!c+OoHD-r3axiJkIR0VH%`-BnXJqRUh1b*x6^kF$|2;;JGF*dVbTnV!0z
zSPrv7Q-)NxfY+k21#T-$_GuoDU81YZzH2|ldMLa<viQ#>FAMZFd(23o;nb#XjZS7h
zC{1_O=NjG<UNiJnUWrdRGx)jsR7siryBtfM5%DsgP5rj;$nl=Kbvne}F%S9uxdl$T
zbZRE{4_fl;531T_39&iW?5)o7iq+4k0;?u{d#mvYtJaP3&)~4VdND%vWW(})q3y=a
z<=Bf%F4zzbp&8~7oMW^PI&yT!>A|Rb8w=mBFT#!R-5v$`0|aaXGMB<H)U$7A^&}g0
zHsm@Jpu=+RsCqGlKQOgE0&ma^YRD=^4OgyKgQm&E+VY)>S?v+NYP23;%ulqO3M|%W
z^KOIy<zkwb8gs==@%DmKN$U-j^f+(9XoU6Nnlx0PrfcV`4vqc0=XWbAH`dlz{{RE~
zFr+x}elKNFV`gP$-cwb3WQmo2<PgC2X21Nlzcm_!b@X_zHJJNjUT#IS`@JT(^rf0P
zG>&Iwe@6`Fvy;30dvQ^zAB0`lSY?`l?rO?mdR44TITP|U7QmxSInzeKM|<jAj;Y;V
z6Vq<(C@7lV@<D<0TN$0!_7F$Qu{<E(wX)_->*IRwaN9(Pw10m;Zrr6Gl^AtJlHi}_
zi34!XR;Qn4q{My~sp<x4Eu7ocsyP!ZgvNZith<k)+tLyqVP~H9S+=$1BKD$-Bu!<#
zC!V7#cAaYll794AD2&Jq4-K}M)h}vVwQD&FYNIGGY_dT7wtWd>5;reNZnwm?j4faO
zbyab!-5bTZIKN%ez({XCnAoW)^0lOFri3d+DoTN{S3TeAWHq>N5Y<dRC3bl%ber_^
z5sRm%*;bX9b#rAx^oxyJdGGs85}!8T$+mpCw%W(>Ce5#jvc|2`<(R%P{c*~eebxG0
z^rQ<ddVh_<)V18>`Yr|ak~8r}&0>_1_jvpS&1=fQZOmkiVCKB=Yf8uu41k2S(j;2E
zi4Hnk%%VV<x;4BD8cde?jM|r+l5?&8wd1ok3++EfM-Qy_xVX>MKSP?=3VMv*uXEh2
z-5sgkWPOGLl8&eiAy6Icg|6t*M>0+gBMnEc_dmxITdx(}f^@1ZJaFSW4>KIwelabP
zi1gcR^*_ML6XGrO61CmfI%<)lLms_y(%*gX!-t1x3Ut$6inPzSH%2zw$XB<H6HG0K
zrB?T-J(xGbj7p9Vz@=6b^8!aZooC&9AX-s$2pHFdNtK`ZA4JjH-0Uw6+9hh25c?-a
zXVWUf&25_T!E6yaq8F`ix?C*3lv6Z7^^A8uSE>uuLI0D3mO$?=g$<B4+p$eE1Ih}>
zO1^Wt0kfJA>Z=MSZ&D*ekqGU%&ItH6JW2C!MU=ZWa*&mj{t9*nye1YU>x?$nU#QTA
zFW)XS%RB7#Qb9}K-$oy8Hmc8|Fx$Y?u+3>1ymI_}XFEwDjII~A8fIj>@0ICB#fgRO
z>A**`?B$+pPL~ptO<UZcvR(?$E%A|6q)}Ce>kkJPSlrRbX^S;JCO`v9psKPb?AyHM
zwMrOY2vy}u7Z>`DF4+cBhO(noVF}<?I8S6{V)XuvONjKKK(|Ib*HLUp;K+q5SjnnR
zR?^E|45Btqrrm?W0qtzB=Tr;cmoc+jCuD<8@jQi=(-Fvf99k~$ip|QStA*Co1=5}z
z)B59UpzhiYV`d1*-x<3V_$z8N*e_8bQ{G@tQ+D~+#Act=ZUuD*XN@aS`l~PU%lpgw
z71W-qE`+4bL~lnVJ#ND3m^VcENTx)Vd0TAJY&S=nO@q}>G(gyK^<9HTu{>Jy!wk+Y
z--l3RpFbrevspN0mnPf}P_2xujw&LIel;I}TWpqNuYdkpxlB8`u+giqj);zV6WtMI
z^-Y_zE~RZlR7+psyWCHo3&zJ4>`7T1HlK?d0Y`=H$-P^d0Ib{grKFK@1#S~GBfXHK
zqBqw)dYlSr<7fF#`}fe7o;sfDlFga7tOjmW-bql{Q!%f=gvb&Gba}({R?_m4{g?Rn
z)w?Yfq?6jJadBX;c}$0C>l^T{M07Px0ZmYH22)%X(a87E7Q^oTSMw!7hwUK>u0aYo
z-cE^c!d{E+YN*&Zg&=Z6JB6Ie_C$rJk+Z__=Ux}-5HWkaEM2{ZMt>pAtLI7<$6q*V
zP7)0}ZwPVMxjq=ZIN)mRuT+)g-mQb_9);M?K3qTRST$1ZI7%mpxz^Zz_Z(5>+H}>7
zn(U*tXu5YVWE$?j+7Kx3W&jY@XL8sljXxYBd;y=72qbA|C_7S9dj8?|cUd=kkP&{(
z6Wuh?sZt!^=t31J0W(sUs^1-9(jNpex*+ktUR@TX?aVfZ2gYng+)y4ByH4j#q6U9U
zA-nQJDs!ZuT1fMeC)>-u&W#xpox?<d^Sjkg;7!mAEDSRoH%`1O+82*{hMrGpyofeU
z<oF!*w&#dNtp2QiuaEy?ci!=5oGu~gwVw|Qfz4lf`e3;-LAa--0k?DcieWqp>cdm5
zD;x9cdyJ~&4Et^a+=e!v0}PxBJqq`fEk}#d*+;6!q-u+#9u0NQ4^pxk4fmEM4A8%a
z@&DGC=ab&A`w6}*Gk*K-NAYik;2ig$%Y?U4!ocYLaL{lir4q~Sg0tx;h=H!O=;YBO
z3HfG+c~Olc_vKBCIx;hCiMTBH-ohgkh&%!-K&^mZ)cH8q1Q1+$?R=}aHYn^KR1LSy
zN#UYq4$KT4R)fEl92#G7LLWbC2Ye(Isf}*>hfT3mO&fVlH4!goRYeHaXiWL6(`;kx
z5eveLy!Kk+IwkZ{Tb)zG{XWtqSu(8K>(5{_9UDJQU<wm*$FDA5fCzc+Y^&JZN!$%>
zJl?3|xC(x-`VOos2l!Gghy{+DN4THg!l@GX%D$a!Z!5O(J{Qe{Mt7HU-l(f!uuqYw
zeYQzyKH&O!-q1w;*MwIp$C_XIYu6sRV*9n$BhY&INzmO~WCi~K(6aX3%`mu@W7wvI
z8}L5A3bJ41uX}}Qd1+CCEv!xno)nNC2u8atY{<iCE$6Er%0QkK?gdk~sgT{jyZI&H
z+@RBrJY$sV0Fy3hK9HSoA9DMdBeK!rbtC0E>O*>Ss)@PohA5=h^OsxAWX)&^cXyLJ
zhBwl9Fg55|PNU^!_AQDRztY%Pd_jtzf35JxZw+Q!zxwWfP^30V^C!j-AbIgV4B+0I
z;B{miBfjj!N~+!#*A&-LW7wsk##6;6gf|#JE<~2>>Fk4|F<oE3X#;+f{sV@c(nI_?
z?JEzSrg6|Z5nbj96iWoD4JRv_M{vGd_)#F~g&Ou*$)Az~MojZ<-3bjHs(D_corqu;
zu0BwJ>vWyUCWf|a<|n~N=7laD(KeO(ulBRop-T-${OO!|!h)#^{;~L*%Y_hQ74(i%
z_UD6lvV+M@1ufaJns29b@6Y(bHtvnud<~3J8PvI?E>LOa+PM2G^{bYx(n!q!LyNZD
zudN5X7HamFU_cl&h7>NeoCfiZDN2mW_>sC+8nrWgo>}Ba#M1XHl_y=w<*f|e<=r4d
z+DA#9uHV<aC**y|xKe!PI6nHlMLlZ0x~z`=5D_+Dj2in<F}eN~deEA(44TcFrHA-E
z`}UT5z802r+n$R}$7jOPo>a*D%CRo$M?xE>ZRwrG1t0%ryZb6~fQeD(s%fXsB>4DU
zgFw`1im_d~yzGr%PtD$V6TYYSP*~LVUW(rhm2Q}Qlck;i`TD3bVIj37_N5#fEMLjG
zyQTVQv#KR+xyxH&|7*?m^gt;c5QO}wD@~#FCKLZUVcMa*Xh*6J>dRjA;$VAj7J4u*
z7Kh3HX0qyPX575y@hfUZu*?UCk21Yx^`Y#0ZOGH7|5s-NWJ?SP^n+9q2zix5gWyiw
zVShqS2fM)tf2Q!cq&TN*D-&VF{8w0UybOcPmCM#<S9w5lWlttvwJ_(QZ3S8#^;Yck
zDy>Yio(?SB^zK1ON_@igeiTK~P=C;V^!|0?eb!!ot}#J_2{7vm9`DK3FSvQPH7aG&
z!^wN2tuHIG*6KZ{n*3F(<GsX%8kIX_UF$(yxM3yt35alqY%C@kTVtPYV$3?D5Y2Y<
z<J|GLS*h!HAU4@7ownC|aPtvAyvMDN0W+}3-Nc1@+`z8;imHlz)vq0QWxFE(U(4JW
zvUv}oYQA-m26>_Stu&KF$;raqpe%|o^8*>SBe?WPlKWBj=wf>J8kL2@`pVHHY7}MY
zXgGbj_jvEEV_Jze1YU9U{la{@AHZxhP4ivZE=3m~wO|szUj>xkj(#yc!*cka){|Z9
zXQ`Joh_Akcjo;kTj^?s2IbNI*MnQV&1z6X&2uGVa!a7Hr+T`m)8}}jbaS0Zd(j$cn
ziymX{^@Nnpz)|D1PpQQ&n5NEi(Hf8`Nh!cuCZc+FrITM}!zOp`g8he?v<C6m(VT!~
zHx%K;=F~%YBINlEnCcX*sVm~U=cL4W<mj^=^UY^7^6>&EJuhuxG<beZK%+bm6Gt7@
z<@RBAqDAE1-(CQo8^*aUCj%UE*@d6D^Gq<s9;x{;pIh|-V+q5i&rBOO{yj$)fIyTo
z3}7~fLjJ&75%0f=bjf*qU8O{+w*>*@vLu4E5OagV;1zm>rGf!<-tD#_ZhSlyOd};9
zr@wGVdR`fOCpALVR`n)VM~5$xH6lk4wqll2keV4SL&sHWh(F|~wWe<p@@E`OE3+|l
zUxu|0bh?Oa4EBCbs+A49;%g6NI*wW^MD9kVJg&APTm5NK|D3aQx4<&pLZU<)q0nFD
zHk02#IsT(_N(x<SAZHL2)jB_Vzg^41JH$V|2gR(@8fDhdr=_A2=bqXPsHUUxZr`V;
zWpexc4&yG|Tf?E%>uDhBhsn$~v2J5tw7L1TQ%arQvSw{CNgbG8QK~$$X>2GPK+!?u
zu=}gGG$I!EV@BB<{K|~c`@rvzM|XOXDam)1L@&pZL4f4W@J159aod^%JL@N8%Ih<X
zQCQ<=ftn|sXBXnvkH`uW)*{5HdQY>PXLnaYl`F~vzz#&7Q`5g29i5Qfd@ISdw>i`J
zY0~9ihc^9<zhHl<e~10K^LJRjD{p?UM}L2@iI+r;3z&y~CcSPJT2s-lIXpr?N8%OM
zgbPu673`;LxRDjvP6tLQG3lo&nCF=+C-$f@<F?=G*qceyx2Yk*eI`VQZdN}AT`ER7
z-8s~?|4bHa)M>W<O}}X<p6)%$Aq~197R`LfzQD)2KaqCG&%NEj+#!6YnpwSAlA7L~
zxIvw0>Di3_CWlZKK!3n`KU@^(qU1dvTT(A<>LfX{b?M{2w^(_r@L=LtrEREuC6OnA
zO1}Pir9?j-=y4l;h}MEw4AA=}f}o@%%zo(|5Iu}Qi`#RPd!7>ApU^i+Rm5rWLgBN4
zB>Q>ls_(V&y~sZYG*m=L0#8wlsR~R<AYtP}3`ognVK!Pp)zp6}33nmD-O3>m<Yo0E
z*Y|K}!O+x09j|9?!d<$h$E>#FBzH@<&Pt;%GVXFhl4<xy#uNOvN<*2&`np0KqxNt|
zw~oC|_>HTFqAFKIBw&~R&6_l!AMxcRp*bpgNftX3y7_N46ENq41{05w#uOT`B6k;y
ze*?n&2YR-;vBT}%pk(NJrQ(Nsp+yqdc%@6_xS<khICbLX{zUhcLw<5;vF(Sth8k)p
z&EarI3kF4KM~Sy>4FCU`28hT|pSb7kNUvn=%KNPUpML;Q=q(S<FCe$qst6_PAxz^C
z(rqqZvcVzM3~oIDuDnRwt>@k$<555*Ce46vS>zjyNulwNuifbgk=(wfhd&&lF`;3T
z&1TierqEMmRRKR(3I0$ng<<0vRJnWc%a9j!O0KktktwE=V7HSScgp-6kZ2~|7W)fq
zulWrnhkeU8bWIBwc=F|{lSEDol*BeoiR1QKJou&v-t2IoR|=p-YM}EA8tZXziS$O>
z#9NN1p;26YfZ6Z~JgmY5z-pBMLO7q<*wOL)-rjJAlA&7IrzyFdFGwH$fKRBbdrEd`
zPz;DGbcmsugDO^q&bn6F2D)>a5=$ckfM`^d?~lf5@v_AFk`@CnWUR#R01{IZ2{4kr
zfXSX~P}@ASaHWF5Fja=m-ooM8lYF~Ddd}_YtBIYG?!-pY5<T>UxQ<az!iqImm*aE{
zO7nLBiB~bAh%jEO;8-xAJ)H0<Wy%B|Fp%`p(NF|!HXn)3f&xrF3QNO=yp*Fe$Qt-;
zpc_C`u)U5?YUnG5x6^O)q_!ibPGx!YDV*H4l)u2jg+zr;`95u9TdBC<*dWuqA1O-U
zyQSWH1KO#&iNrHQ`jozvY#6kna~SH7D&+9+foO2_T<+r@SpiJ)=}IQ=i$lx|H{|su
zfM`XXV}X6c<pPI-!uV1?ML$8!TiI-IC#pL`(IOFEs&pP(=$r3xx|KKC(29*@VDGbu
zm}Ny$u1`C05e8<hfd9X6yn4lHOCgfVK@FyHr(XoX3dgko)toL&v-`blwK17HZI%rc
zeg#m?MaL+Fl@p=p&xmxRE<n~V<v^5~0cTY&)KF%KbYm}|noIm+8~wwI`TgR`)i(yJ
znDSBZAS1G~%)sSi(J+L+%ACBfUDImCP_?m@R3lvp38alGnRy?JT3|&&YF0+)hT7!j
z-((cVKqId>5w10zifFA<(Hr~*Ix7EC%^|`8)!YU0z2%(cT%i-yoJR*><VW`v1pIO?
z%S0naJ+q0!C%iCTa&<GUX6dMfTfb3`)2#RVC<8`><DGz81yad70adYlRVFJX73Iqd
zLkT?UVX9y5^&xxoFE#G1(uY3m&dKImwz+Pwkkx}^hVwV#=-HvkFw&^@t!0tMX!y56
zT=V~gZ#6Q`5fwrBM&k%$j86ej9l(lL2h3MWid+S)oRDw%*180Xt~uxNvsnqZMv8`j
z8Xjrk_il_>?aj7T6GOsKJN9Xy7Q3*<mh9rgp=C7R;`SNJRP`Lc$93X=3y|m|Nde)=
zTvq?%`iK9~+dwXzpex9pupXX(B<L^_CK_d+%H*$y&E4zKZPRFu@BYN7vdUqX_kt?W
z9j*&Fbv26XP5k_E^L);yk%56pZ0vLua<)Z@$ci|-2)GG)w}VV#K0cZ2@8#slGokd&
zD}T~TV@inoZPhjHP$Tr)s%tYvXzo#MNJ0YapBWmQmiVMxFex02_~&!~MejPCr*xRU
zAz-c}1Ee&`AX^?SCqF(%#41@QYA9px!o08d7+&3_Z)&^J;ofK7i5p6eo-L5!{Ov*|
zi8pI$H_*On_eM1iS<a>R`0f0wF#Vpl4h1AUc27GEKE>-{LZkDFWIO<FU(`-1d60D_
z|F&Q7lgt6tBA`}E-|O+8{9jAG`Oa-DJ5h;}{&L2iYI#dERLwDGDQ3@dk9}f*d%Db9
z$OVVA7rl@L!StKQL)_yG8y@R*R47z>07NIT02^fg$ld!q@r;llW7^hgTJ1dg9pR%S
z;XBDJ_48I<ihP4lqFy&z@v%x%1~@v6f_6nPge9>c)0du~5P&>s-MMP*=zrzq(1T8#
zengNkaxJg00>$O%*Cnml2(=6Gg!U*aY@ZN7X{jmd{#1d4@ik6#Wkr`|!an_?)MhO9
z6Njv-3W0$lw14CkPfe22nH4H~UdO~RT`^&!%eqf-B7(1^yK)7SfFqS>Ub`Ko$q#-K
zI^#h2d0ObFNI)>DcmX(5U#+)r7zh_t`E(L4nrhARa}bGx+gfLc3tCW%=Va{ZaldiZ
z1$mb1mNVoQ8<~(nsh;U`=LFdSrZ$Wnpofz2C)niw$6Y%)2=15p4MvZrAP#?K#x1BZ
zWto@idLqj`bzka!Kt@m3?paohuV|<WsF_!ErlazVlU34Dvsw433_XlFyjp`fVJQjL
zuub;U^G%jQZ?7hHM3Q5<Cmh+a{3l3q(nH1ojxTC8BkouB5(zuQw2z6{&v?wLt0ID?
z9~Lol-(gjjGvCpd>*j8>nk%ST2lm9S-tg&19yPEBra}o)`TM<gyN0gJvlZg5K(>i>
z;gps}I_O{7Cc6$|A;Lb*{{!Bo+b#{>0q7*OMugM&H^4LRH{QxS_cz|UTr&XK?M@^r
za`-^uo*;9pg;SBZl{8!Im1DV)#%>%bti@F0ZmHF!goQc11?~nv26k_~|5t|0mER8{
zP>9NL+%HvLrgu1pvH?%te%t<s{9N1mEKeV(o)NnEX)iIt8s4xIBV4K)46yO-(^9SA
zzJH>C|3L!%_rE%XemMr%?EQbS*%MFL?3e|B!gxW4R)zLvRwS$S-rxdXFIFG1(4XK)
z?t%>?dDyKwY_@n9`W%xCmcxXd9<8KIdcTU<97x^3@;}et$Xa<<lQ(eH2H-(iYQ)iN
zAYM7HmbI9#@7SIVZ#FB0-_i2RuAsJ0^8|&cH^BK3*x|(B9U<#hnvfWEcU_6L%-<aI
ze`kIE`|I26#C^;lPj&B!zsAK!2?`Y&<`u|DU8;~6DP&J_iZqvhSG*%R=G#}f*7;mq
zUO{G7Ld|mGU(@2Oa&fMu^X^0U&S=E)8owmAUFb6udO5b2sL(a5{1XzDyCH{ADD0B&
z!r+ll1x4_ua6>aJiLxRI$r~SrApJJ|y6X5!wR6RfIaFM)Srg3(1#A1p|0{CR_PWaL
zN8zgJsE@b98uob4OaJVwR(hoLGit}_`-7AB343=6u`NS~Xn(I)a=-1`L+ch+W2}7^
zz#G1!4OA1xrjkJ;15Xle^V=G?S10c*B=Jk-i-pKE#I+1E`wbgJ4e2xFS}ZKmU(~=*
zzMzSK&Of}4TbXYgJ#~w9Uv+p0i?fp!-PbNcz9Sefv_*ds*WairwAYCT{DJ2)*_>`t
zSCh7K^80__XW0FzE*JJCrA>+;@U9v@sJvCw4Jkg`C<=RQFfwKbWo0<abxIBUMFhw;
z`OS=u0urjzA{T`3K~}nK%?G^nDp8L~45pKahCU@D|6&ivUhOhkR(T5dNy6ocQ7Ez%
zcN?~LYAuJ%4UAxEO7?o83Zi$%%>H?j{=p0Ry@JGVXYk@dsAibW5~5}O!Lf6<FnGDd
zp?JVtKc^T$w4jW=A(3jMu`ocqvgcvRp+hv$Wt&)1$gKF$_Bv-%$(eo?=BEz~p%Yz;
znZ=R{W=3KdQ@g`c$jUD-R%kym+B=~=szGd7915vIYv_h|%?%}VDX2Mqu5fM5W@;MC
zY5{?hLhCzf-E!KO`|0sRfc^pWO=kfJoO}laP7eI<iV5(3pgJs_$Bp;v9NTp7?~T6S
zC^z^g+{Au`TiLknB;3SZ=p@`kK-VKL*289A`}A-VphW`Z_aX!(ddsw4B2s}2E<U`z
z(>;%QU0Hoo;&C%xsEBcsz_f<0DW|`=Nn3|`J?ZD2*+WuJ;x|ADr{lW?2g@!)_`{-~
z!bhp?+GMAE`7bYut7S0YDa}0|t{{G@Slf0xe2A-9Hk8*l1sa$qUjXj#{(#CI25z>C
z)y5chqQMfIJu#txM424-;o%tzXlqK(Oj&2D_~{*G>h0CHln%)!J9Px8Tz?y-*w(A9
zq3&ezBb7{Duj~EL{TzRLa<2d8bulfVWTjSGf&Vs2i2#|iivoco|Eush`FS7LZx*kU
zT5eoayBzT-B8$+@*slj#E)gtBLFmGVBgJBYVqC|-YXV-NnI5qVtCW?}FL#8;_?U%u
z{{PI_t>8~`FWzb0)&ZZ*8w~l#Kl8BLADbz)AQnu~Fdv^1@4IIm+G)fP3!2lBj0M-6
z&NlQvX=Q<OMNO7PA8VfsIHeri2HVEZJ}}{(QX?7V@S_Z`%u0k##MN>f<`jp2D<ElS
zWwlZV*tJqEZ6PrrAaYXQ<GW>h@Bb^0a^V~4a`J!zFDwdcpVz1cxo2uy1lKn%Vk>0Q
zz1k`f#<rr8gsRPskUn&O`v3}5({HxlLxNfBUUuSuOmS*c-;R6yLe^In0U-vb$tjB=
zK>4CL5}cFakd&oy?92^je4N*qv(U#fb>ftwBN_(XztJ_IqKarS4zMCSle91wSmI4G
zD9j#ZMHN_U^|-$|ZN{GTayc;F`@5m|&ldsbN$(eA<HlDJj*$bl#s!jNBP%8GlR_7k
zesY2K3$h{B#5r1-16!OoZVJ`G7=-<kn$7l|+*hpMJ-z?H0B8w={~Q+m-|rLPeUYr-
zcl9%YTdH&@ozg~e9Oj?9fb|^Q(@Xpqal1g;RwQN_pbZK8)1Nq{MDhx`_*KU>UIUy`
za%Y)Uc9}YWO72vrl)oxD3E);GWj#DDY!~*AHx=ABoEZ1?c&r|WY~lC;C~6k@UPG{6
zWJ>vVdb;tRq7?kQI*YpGt$<SsoU*YCOx$L3=$Qo6sWt`#%RdF`|K26{o&8sP>3l`H
zW3M*_H{i7_v_EQ4^*A6w%X{JG&y|=*{O*P~1zg}vG;Bc2r_AgJ@~cD}zA8Br@4hwc
z`lvNt&uQRF9FeCf2H@k*o$ktGe!`&bmsX!H6U4`M=Z}5p13T>-j=cN@9C53L?K0)V
z;W@xm?_X9aAO6iMWp~Ls?XxX&_j}fp1V|5(Picw4s|&e}UD}g&M8~&?&~UMyW5Gn~
z|LTnbJc;1+f0B1O68|fCSDv-)4Sx~%iIUH~B;-R`eg1$Y^m$dDuL-r@8;{9BAM~uk
z#|QFV`EwU8l}&W%2+WD}Fc-b`x?eMzcCt9RMboERSz)gZ*WGf%iqTO_fP=Nx=VL-0
zd)&9Doh6LX@)N@6$qsLFr8vwPx#7Dr?R&S;uP*n5Uzcx<Xy;0oyAH$6Ql^w=Ju2^!
zQStU&MlQ-e-LL**Zu);7tG6Z2E=Q9#P#GZu2MkxD_v~3j;|Bzmo0n8>33_!+)KqLI
zDs(Wzq4O%w^a;8Yg8r4{^IYfAwy6#8i7lD$8!)<%aKDeU_p4F;x5lqmuA_MQW)y8M
zlWubGQvn=}9wsS}R3kOUeZg`E-)~P^b!Hh3_EoW8MjD1<7LLt7<8~r2<E34q{H+&Q
zKQkFxxLf)iuxO_*IR8Jiy=OpE`?~GDL=+IEs&o)(B29WPibw|qY0{*F2uN>%h@f<k
z8hTWk^xjL95;{olHH6+mPYB67U3;H>_B!XTbMA-xeuOVc=KR;^8RIwRT$?&QMh9pG
zTF>8Rsl<eHZQVh5APX3Wo6ZPOr?W2b-MabDv#>1d%9Ph1%#oM_Y)Zgs!^*gUdCcSB
z>op9v{eoS9k~T}gFKSZwVnBF^0Cha7{dBvFX(n^~@!zZhK^lJy6YuI^)|XxioTz6!
z!~g(OgBf<GC@NE33>O#gFN3X=g4EfWx9Y~2{KKLF8O#G<8H-C7wLBaKm2i>wa*L0U
z*VOo^@pE#Q0||;VPYZbdymNMr-tX3J`@#a)=jAzQ#7nS0SOc@s2}LEsRE9pw9G37@
z+vrhkX*uWC&9r*-n&V0iHF+!v7gmqA=J>EZ#QFmXXO!rK2~3FQ>q#$<KopJzoOr>R
z4vN@Vgym{=sSC)`crOMRcY+Oh97|eW9BW8tN>^5N?NK2(1bv2;AUF3|Eb7&176ks5
zOD3Z7#psf<M90sz1UNNB+?4`OkPa1d%-i>%{75@q25|%W1S3Z3@9MJpzbb+7*B(ax
zM6MZvdp^}QwDZkwxnG-g>4G3~=p@%(lUER|=ra>C=W&^ps9iQTs*hUsJBi2#p+`e_
z_1`#^I|Rh_;tM{W8iJiJZY%^_H+YKa-TNiAAFb!oKqF^eV1n1lnQym@?#(#lW${ni
zrP{=R2s@IEcN4Eo2As<BGVh$l`kXIcScNj3hHaO@?%y?eH=N?THf@F3w2jD3ekG?R
zeKN(aGDIajAmM1@J&%-Jv`)~ZEGn(l(nyPmqm}V_7lZ0%BVVmZjrVC8>2<XIiK!Zr
zi)L`H7g`A1j-GPOZ~10iw^uPB*3_|G){=H@<8<P3ugRs$f73n+uyy{%g0QU@{PC{y
zZw`3Bi^<T+WL#KlSQ3UUjXjO4(P4r`H=I8_w!=WIPDtOZ!<xVK7$T@!_06FWO56YQ
zc6vjNACHqpLrO4oP3T#ZW!e`qPD_cn?<NldqTH?eb*XBl5Pi9=F9*aQ5LfpZzTpYA
zWP3oJEhdkPxOFqcJWB2m@<b$nwgPq*N13XWe<Ap%dd@1A2_T(JJU_!}NsR=N8ap6G
z2^OpHeri%rELDnYF^v@?YK|S6;-*ZdqcrWTHx>gXOI!gMZ3p0Mz5_7<X}xXj^m09f
z#zwFNE^RXTuJ0LIMQ4VrGFX17zBsSJw^HG;>uiG7-AlCj>XV?Dcc<#>H(Y8?SP*cA
zQWa$_8JYwQA&0kh^Ul7?sO>VmxY&YqU;Ro1DMG%i`F134<ICa-IK~ye+11sso<V=H
z>;2RuWsn^QDB9cyPbUUm(1y)e#R%HUiA!o9{GD+!=uhoFBgTq*0YLXjeiK*gdTDGm
z!k*d%x+(k8og%(|qa7kKhHR$|pgozv9$J<1TS5d;1q0B=N{0a7$6Gnp?^QJ>zSUpZ
zI!<`XX<jhWZ*k?-yIso^WnOIcA1j+WuoVY6_uJIw15N_+foagf+QDb<t*BcsPiNU@
zw$AMB33iBW4fYku=V=zfc+&$?{3>-U9AMk)x&pf8v!inZ^IQGv2V`_YIW>$KYX`S4
zdhFS#zz|E;>ytB}BZ0)hD>(1wgSIM3xH6D(12MzYH3y@+SioVUTGISxxHD4UsBF$D
zr6^>^rh_~?$wXKSQ^`e1oms3l2At7pMY34q=sNp1WAU~9@9m2LNTX28m0yXi4ZnmP
z1NE1>V*bnGIz>bA58q!EIutsRiTB)E2_4Sk7fjX(=+~3gtBNBs>`0i>NDn+I7&Nhb
zSHVD=t^K}$M-I`S&DajuDQ;x`lDn)1&!o<>!Bv|;l4)N>2*-ilNL@OtsRI}$clu6@
z8W>}=<u{@0!)P=OR4@9LcD6y8xq;XD!$Dx;7QX3Ei^)v^q~n!;XmD*8+ksR~{kKb7
z7X1Y0{?yw4A5QO&ME)%H;=0LRi>QXT5{pFvmS;f#_N%55Fb05f%tvga#N5l>%z$-F
zy8s*yMVn9s7g$B`1l%^)@ZBg&>6lkjE~I#`s`icK#*c5m1@{H+!D&EU>u&pfL6F4W
zV?ktD!}+h!IP<o5)5?LC6i^+jh@Uctf>~YxhockI#5ZXVl<wUa5}j;DJ)Jo*o_Rvb
z$NXC}X7Uba<SWj<jt@Ne>7U!D?U|*?*4=uJt@7YR9qSF}Ww;g6de6BYq3-_HLt;;g
z<-5K-4z|P|UvmTKG(JgX^yYz*Ul5*s(|>Jt{@bQq^&jlunm^gWVQsXC-|XPEpyR9N
znEKV=EY-K0DT#-G%R^gkbuz{Bm#s-d??2$diFd3l9e8gLB@r&&mv{yv03OqyC8<9F
z5q23$56P{Lc|KvdQA`V1?vRoy%GdsQr@93Sp5l5x4f#tA^r>&C-PSROt2$o`NCx}s
z65YQ9prE7x7S1MnuUDU323@m~6k9zXg3*F-j^Fh7*$d+=#WVSf9bLf_kx~7L_C4fp
z<Qo9ZrI+>B`aJaD*-iMG#uG1xt3-ix2ribWs+e?BZ@Rv}+Q9$wln$Jp|0;)05=(b^
zB@J?CyHrTDp_J(R?nq@-2-&Iz(RC$8Nd<ItZa~h}{}e>;oadUYea(smKfs_~u!t-7
zyD@tjb8-EUY&I|zW!E?I+yy-)T;Fd!TbOknjW)=42SIy0oSRXFhVBEmETIA9(Lv^c
zbXQxk_nqr;y<$BT(r17T0pQulJc9h*chg&IuCnAEg_SiPegn8=(MP{%H`N!J{daz1
zueqBx#W4I1F59U&W8KtPE<;2gbGYZqPVKW)?D?g`yEf;RNk<@kqD^~3$=m;j0srTb
zdzVVVcy(m&wUcuau6tDn{1o;wT?bRJ)&rBV{U9mi@U>rQ`>A@aRv?^xZ=~yEK~9Wz
z0qh~n&Hm<Mgq3p+3vrQJVK|{(Ji(|olt3-YCg^Z<ZY-(fb`WJisya*H*k(J0Z@4Be
zKfFQ2{Bm`e*1f=66EdODlMxB|UnvO@Kmy<!!~8mFmz@e<weqIq#rCh!!oHGK5P^4&
z9aF4xha7GgQG4qNZMpeIPnS!fhC^@hZ^mbPg5RSB+N}bLt4yq_ws8*EO8;^I|4~l8
zbRmT~+n3+DBJ&@WycyO<12?PmqFYgK0-Rimt}aCAo<YC&diyZ^HyT1Tg`53v8bSvr
zh9dmIZyJL2|Nk_Ei98Bkk+3F{=vUmmVt^O;0#JAL+2-N~CQmM0&zD144)t8Ml58hU
z2R-NiX1NBA4kP@-OaRc5<Cj`+KgMcHx$Y@DoTx>|lcX-U)TjtN!mq@Q)Jy$T#rg0u
zK}S&SQm>&}3+)))(f3T*f&Tex_yM;7)d>HUU!khVJpMZ-f}2)ke}oBGm0I>1kaiJ;
zF(D_LzaCzwBNhIqNP7Fv@2h(OW0@|{J`{a+4w&}E3SpIZkH=nJCe_#|+VkDABdI2?
zONn<CMgpq3cQ5V8JVD&y`I6^_C5#0{LRu~TWmfEo=Eeo6_Qc=0%n*6$i@&PT{&Qvf
zM~Uw-kQ|S~e+9qc1B#|X@`2R=;kn61HnPy8m%>f(wzZ};0nN{P>s)eA4y!CsI2Wbi
z5p5T=lN#bWL)=<}?h{=ySkoTprJwD`TaE7u{co1Se^f8OMg6mSsrUSM^>VC8WW4ZM
z5nI5GFARFpxAfq>uZbIYV;a)RBoo=Y!a{qXQb&&fFFeSmc_%UO0lyPmu#@Mq3K|<_
ze`OW=ck>tcKVV@5I<b_1?oM@%>||&HdzgTWSbI3HXS0Rjehtjg-`UL8{F+|?!qV?-
z<^dBgbZ;-v6<K?6AFFmRFIHmpODVQGbx6q+C<>I@9@h0AX#dSc=Fi%LJ@iNUMr`(<
z;mlHhhBFHkt~Zsw$zkSH=^ocyYFA3H^vd|cK5Q}r6qtOo?tT-*6!aNZTYk>&j}4QN
zK_|8U-A451>l))Yu<AosWdl{SwC&9@#d*7ue{r6N#<Zg<V}5g<5hlMm&xSc`I$Z1B
zz0fEBbK%N~!0IJb-uO+HP39l+;+NE>dYGb#h_&8aufkg5$_5?m>&g(L#?+izHB4i5
zOj45{r4O<lMX5%7ZydEeA~P`DmQqFwkWS1`#S@^k|3f_qkgFsDauv45weMr{J+biK
zwBhI64x?p$g|&ta)G5rGBdD8%zpSIFRS?InRn?SXjzbiAP*=VXsl3kbgC<c}+M{Z*
zL#wEyZMM5s=Sk>IuE0H)X=LWBS}mn7zq_tmfdN&284bUPgIWVF#8zxs{`t~2stI4k
zMk(|?b$M!)6SE-kz|=l2aZ9-<5huw$E(jV{0UFuRMvQuZZX*weYYuqDd~nhvY2;NO
z_K+*tE$@vO{2}MC9ur~QvLXMc5P~n)R@9+4!JR+Mdk!qf&?2S2=iPuy(0v%9H2-p>
z40|kS5LlRB+HBVOrP|Yy0N3Tr6?hQvmmNou@*pq#>*xCaX!L)&|I5!h#G_LOoG1W9
zKvR9-7TkoUWy`5~Xl-WF3(U?~8^gylgvdM(tyZ&38>+{Z-)?zoUJ-d<hv`!)7<@vU
zS4+h@qK4KQe@mau&P?;Z_y4U*Ms?aYqo~;xG^VYvb<DccE3U^Q4HAV2f)4n~e!Fs6
z5-LsM);A9l2UfNB{^!8}{atAu*!n$Pc#qVfNal_FVj)JgcGb3$m+v&cv3xa@_S?+Y
zEKvX8vQ-$?{OU6n#abH^_~ZXk!IW;r(V>y`nuSRM@wdPbqbPx3E3!ZnVD&82C$t7_
zK$g4smxSa4h<|qIXSoeW^clAQ*?LMYu^_;X)ZtbP2I#D!4hvq1zN{P8XUw=$)M?j0
zR|?T>J$KZaw^p*N+ndjJoOF%M+InN`+KYQOVa8O0%<84BK}1*2_RS81-0Dn_eHyb>
zZzgBVoYA%C)p*11I<qymsK!#iR+~j1#7R^|*II7Hj0nuk$nQ<_PLTmnt0J-L7u=Q~
zVp!H?aE}cji$T+vNO(KmN@Pj}ZKFknU<=KaW!dL^2qyX1W6%SuBDv)<&ItLpRqh$C
zgSo$tg-B;4Q<lHIqZ1M_YKDD=Rb!baw~1v&C_(r!xJkFCF#JjCxSLMX>hMGwDsy!*
z;d+_l$xc4)i95tSv2G{ZOhCN#q__n4${hK|$o$d}$%y63I54m=$X%dv+@L*~(AhV;
zZC|=@1Q?PszONDU`JXa^zx!A|8dKQ%UZ;f#6dmqRj2=JI>#v=%Z?1joqItNx(4zcq
zd?sz%`F8rHMbpgQT-Lo7uZb#oCO3_KY5e}ytxi7%XJ&@C*o#K1tzz$er0k=GiCo&h
zxF|kF{&vOphJ5;68TC5M{z`TNMZHQ2O7CRf(Gd!dCq;lcZ#-pj-^k7x7;wzc`2)qu
z;?$`zE@L2gC$dwGk(q1!PP*^;)=1iIi0^sT^|$?EIP*!NEhy)6#iee9cC1|%#?B<5
zQ^}Vw=xy00S#$-Qo+m~gvviL0Z=rc1T#?r>CdAWGE4|A+dub6&d(gR_H0&up#k*$w
z`s)<9EYmVr6Gy?|)M#^){@Cg6O6%oXy3hB;7E~Q9i(c_lHAoOS;C&kTIGCuDTps&5
zV8IV@Qon(%T1f@Vz6kFD6Hgl21snQ~*L=XIRILG*P{v8K00%5$Px@hCBya7@w{@e;
z6`jwD3^3m{(CGy$JEWx%w<cf70in`DZ|J&x_ZE)2ekx~CY!^3HH@Zm<N+3FNC+C<!
zIlpaurNu411wrsYB4#?4faAv*-lv<ld<>d?kUW#eo-2Yds`%d_lPh`KWf68+xbOtq
zV%YHA3Uu;p*GI6laB0g{{M`HoqNc~zxYK(P4B1ER)-8msXZb!XZN#>nuWgqdf%^p-
zSMnqP9XA3RE1Tod@N`20h<vpIY-zCtd0ApH7e_|i@Ff{I0@vm~wAz)FQVGO-iqy`#
z#%@UB&bd!%Q67F~SzaT<Xu&7%nl~cSt9Yzr*8H3U0Z<&e!n!=W>-sW+e0JwH%-A}d
z(Q(eTD|!-t0hQR#7)2z3VJR2qKixe~CD&qtPiJdJls~R7@OjJLZrX3Q!LB1A53PuO
zNb}ccr|oc(XQGEP@QRibEztoF*R=*nXJe57^&^J6jsiG9?_VmzFONI0`dubQZSmk^
zcm$;77r^`TUq_e%`?&>&K&0?2@SN1|3W6TOvAE_jcCAjgvqBlmEvGu9+=;_%mmOO5
zxSxEqgKB}aV#wuv%HBBp-;w~Xuoo2wz|(Y@bs1R16ujQi!^KE>f!!<zyoRwW*kjs>
z8FMOF<PhFb26J%radE)ulpGL~+3>JVQ*2SnHpL-X;`qI+J3dNyfL?mP)m%dm>0<S(
zZm|Pq?kDHmyw~f4n+79Y=Z#?(7`Ur4)5|-N@P!MOyXw3xCOb9TVyJx@=+F>{+mA2R
z)UmQ6VL_<14ln6F=A*pH-rtuonAW!go=vnTt|8xGqNo|md}|va3fQ{B-31ysFU?Am
z&Bd#;<e{!+bAF>Wu0y7EMLc3!u!{suK^rW(zMUt)Nsr#w$&O#6Zr-&n#imx$>fp;`
zqjzAbmRhL)8aHY)|I+<j_Dq%?AHC$MRQqH9ZuGAA0$c6OTP9EBVkVDEy|k>jSPc1y
zd)>sj>AIxkeWx1H$-Y=Fm)oHDEcZ!sf2HHgixSCeH^t^H(<Ls4x;hs3?R`ruUuTq>
zA~44LktJfL(sDrL@lNDa?;_k~WS_`I#sq@%GW9;O@hu)+clX*`Quc>cC1}do>@-eZ
zLGQETe}I61Hbf$ItQzcMfAu@H=2($h^|~hn#^G4p@|Zb4VBJZ)vy&zx6L+^(rp_1C
z0QD0a?r1rL@oYsGl%0CtUPh--<Kuk~&vuKC_{p={b5V6m$Ybfo$<o>6`O<$+^|;A!
z1?TYKG9J9DN)bQE9UU)-URGqtq_PMN9AGn}OOQ&p;YP&?pajus)K2KowO{nyi2fuN
z_hF?z&tYYm&Oz#pM8PmhV%^_jNy9t8drI-2)0aM}=%^-c^;?tzX_}>SYurRuDQXx|
zv0}8l0{#)u<h$p!TRRyv%t4Yh5cabJ1{i`6KvH@*U&0h8LjL`>Q@v5fCFE{g6pjmz
zwl9V~gBrS=*dVkou!0okV)NfH@@^Nq6;`K@yIX!cX&#5NK(A4+9kHO=V<jc?H1MdW
zKc?+7?*Oh~1C6#{aTQZ5eI0xLEQ!}1fRvL5U`zK=@NIl_*>y6FrmuJDjU1$+nikEZ
z;WI_NcP@4ttmfR$b}LY8#x@nXUiSeMAHJUFu6d!h&G+Fh(hA#>BuLbNxFO%5)NTiF
zZ>Hbc#~{OS;se0MqT&iE>Cm$QoYPwOaS15odjYq}v&8@if@1rOp^Q#j4yD4F{?u|e
z#6+lsQt-SDcF7@T<c*wqd#Q&Q5I2iNXyY8CW=o7gxas@~ctj-95yDj4EjVdxH9hxi
z3Q}`6r6DzaJLuqKPuit(aMn3(&taT*gAI-qBzezMTA9}-Vmb)>(WZ*^7nA1_X=qum
z0L>Vefj;H$JZNR6F=Pf(4J&{3m8vnvj!X?m_PurQ$R?M4ej*dE4fwaZSJtFmU`dO-
zU-0SdmfPL|`A%X39~N7Q7{7Agf;3Ck3}Vu2H}MKodNk&4(_aJkrwe3U{cicKpp<7a
zjHQ3<9V^D-+)bca)C?spPy9+tDS-fPN56!f&kFYvTwP$sKB({W+&v60-3NqWa}POO
zoHx)#I+l;VA;a^tsE6{zjRRrB^c4elx8c_v1z6555&N!VuKDYeD%a>2fakssK-;4l
z*0Ky(kNC$O^3z#&oy~KAHTB}bVptJ<@#w}zO{O@AOy+p%I4#ilZQR0xCy5KTktZua
z<XRMBWM2|Y`pC?EjdwzMkpO1Q?stOm#CjDv*xM?;#O;h~Z$<n(q>DrTh9^YkOx6G?
zhXP`T?hRORyQJ|6vJgGGx8jR$LYI8UlKE=-4=Z}#Y<DnkYI5v>&oXPHlJrfblV5p#
z1lYB*(AkSjq|4=3<;>f7zm<w(!{TI?$b6m4Uu@dFE`H<27coscnNVuwyo*Jj`J@kv
z4uM@>>fa8#9|b~UWN_73(Bqr%+C{ha!bLV*G_avVJAw2?aiQd;l>fYE{G$8M7ITfI
zYalPj`Bsq9mt1XeO&Fo^7IAeNn;;}Go|V8V3L+P!I>nI;zYPK8Fumpx?NpG_cSrw_
zybVyjt|R|uc*ZQdQqM---y~pQ6p%S3zH6Dp+Fx!(X`xc<I)l!OO~N6^5LV&2$&u5x
zP#$uZnq3wIOTd2rN&!}{vgx#h{rvK59Afp&OrC^~KL6>vfSqNcqc{rLk;X?}-iMBg
z{9Ym!#0hv`WUd6~u2zOqOoQdP=)}M!+cpuwcFSh#9!xyEST!tOv`_u$!P(T=((B2T
zx1Z?j!eLopn{nj{a%s$}!b|R3F<}%t)p9#OT7<xaM08E=(*fs`!dhz5p7}k}$08H`
zh!dw7ZuAxy#{@C;aGvw*;xn3J1$KiA_!EaZr(Nak<-;EV-aLAGJ!Gg0ysP)ZyzI%?
zD6+z7RBNwK0B3wR1qL|t7g$wFSyffc9Fl4Z*Xkziw<|0LgF>0oy+2pY>NZUgkux*K
z%444U4YDK>Zq8d_=xpBzfYPl1+>EtMe8-5N{=P3S>~w;MMJ<cm4hq&=xKj`q^Zl2z
zEJmVqr5m9&`i`F=ddPVj=q(95!;lyWj+TbX*#)BO1dVTpIg-P<nEfT3VJ8?vfTvQ}
zF=?eGB}{R<ZXs~8`r>$IL$oI+O`rP$jJ23)!C8;*OO<gMv!iyf>MmhN{0(wqs!crN
z8cn<>e&2d%vb=4JTX3A{2iH!LkO_DYJA8Xu*fz`Nv{D-HEO+?p^5;>(3#&=jI@hLL
zrq0X5=KYbQ{R(AFCz%7y7R0=^x#4kfkU3em^wdRh{TscF+>2t`SQ#HM?pR@5K|1;>
znJm9+3o9=0LKE#9%Ol<90sv_w5Mv0-4<w;DAKZbA8DQpz3ff6&Jr*<f6V7&_a-g*E
z)p+DpGbq#d7OlxNL%bM<HZbwFJNWd=aufaTV3{jtGP{$uw9>C^w^_1#F@98AQjA&6
z<vxo3J&Gh+dZfkN9jWB1LiL~r{}z*YRa%n^02OiYLxn6R`P#~FzG%8#4B4#GDQCkT
zI_`HjRrgs@oZ?28D=@FN9pCW#UJYAhz3G}bS!{ZGu4@vYyVxA*w|gR1Dl>%cXt#we
zis7A`&)cee$-wUCISLKZ=p=}FlwHD?7KcNpzQ%l}>Z?R#VX<=9drb%2amVX*ZpSa!
zhSpt2-4n%uKG$+-{T95*3V@`Dj0sBbUJf3L-yX&QA&Ub;ddyY0OZkY>d5OSqaI!uF
zSXo~U+AWDbXIlYgcu(-oh8!{{`vXk8S#F#jr7g2Nw^UP6T{AH+!QZ+yQGdKOdkB;C
zX)l}bixM{r<ZBXWiSuo*flQJa%zy|s_No=r#qIxM4{29^52of!2vog#i(0V>YqSL|
zaZJGVrq$p86U97V-s2jMUL8w~w$S%u4ZRHcP^Vw1FCPkW=&7<Cl?$<W@*`iH0EBs3
zR38?z$ScRRwl04c;Ea6w!}5R(JjVkjyqIDm(|DrNr<)ZUE6}__m4yFZ$rhRU^=R;{
zN$tFIB!=7Tx)pJ?fw`~iPW`r=k;z7;oLS6wgP9bom^dXqTzePz_H@#x`d2ekrtm?z
z9l4p+v)R?yH`{DGRk^V!wxx05n9SFZG{Q|kx%SyEu$d%VTxP{i<K_JQNQ0-1w!TS@
z%l1)95qOCqXh`fL)@v)pcj7K8bKVSO0+X5elA)a$yAC^;8x_=LjpB>*x+V`WBvkw9
zKgW3b)T{k)UPToSJib7A$Pj+Gg<oE0LlI|%sR?zk$bA@c9;toXz@BqUjfHN#o7jtl
zO#-#1P||{$DcWRf)1B~|bgDa>`fN3`X{#}mNwhtvbkpX{x~H_%DsvF%#mC1gEgOCq
znek^vOfLBKNsLiC`yi|*Cd7>?mS{{ZH+kWG-niomzdgkX4bZ^XRSDu4!c=Dr9nZW>
zEQQ_FX7A--ni;9JUA{PjkM2qyLumwJl=8;TTC%J4H9OEyTulBF;<P#S-fZByZ1$N9
z>1t+A7jvpyV^)@Km{*NmUu$XybBxfRyr7!Gr(>Z34Of{%J0Uv>3)Kxxy>;2wVbuFM
zOsmR_{%R{t8iAVDWHKJb(Ux<rv(XhRy^b%RDq<k!t~K@BgXzc-i*Wm%QUk9y6T&e+
zHtj>*t72)S&(_l}xE|BSoqPps$xLX!K-BqR%Kg=&IBfQ4*D0mznM&736W2|2g`bqz
z>(d6m{3<)J)OLN#<SCtPhNMr%o7nANvPZTzVx_yT+)F(4D-%8RexLb6CYh0m6%qBi
z!|G;`U%JQbYfXjd4nk$&x2;I+^~KistkFLHy2`vYw^a6p?G5UMjw#L-){gyYGGnL2
zMFqwB#IXMD`5(tpXWOb=k=Y}H>JawFM*wWfq{hnV=aBSzl%W?o$tvxbQ&kq>(glpd
zBqfuqD*s%zXZ0{5mU^xx@k7uW@t5BaDl!#l<#O~7$x%du+f0ecE8ujFwZe}a*U>%p
z{FtO4D>^y-2u9~Vyf|2RVSByl3%Z(UD0IZfDw@smjd?cZ>6!fb#xdtg-)3~>1&{7|
z=1O!=fcGLlQ&*L-hV1Tf#bj%!KD^*S`sWLp<{sa9J&1mE(k-uzs-leb?0**-zdk4V
zLdwA~LSMjoSusw-L~RulB}HSk#r3$vS;_=s7ZJ)0ZVgH<&Co>~H@)hZP-D}ZN;OX7
zeD215FA}cO!3b~6QU8|#$JtPv4-BVM^i4Qd*Vu~CHr;;kZ~mL0PbB5K5mhho<vp+T
znl>fc54X!&)z*UsnLru0SrgrL*R@zUTCwp*1k15UKKPSWM3Tv*nXl@Cpa)=@hXZEr
zH1GF%*LAO5ImgWIm3hnutn=wLHPcF<#@u-j8RShv&a(zH*e=Ge-}o*bkX%8Mt<_@R
zT%gGX@!<j`j+Q!(q`CMIHyj^ca_vd;QWkUIK`Us@uB!PqKD@dwj>$gEXNT<e_CmO*
z9i)x%C;I3ZHFa7HmQwev>;cbA_mB-!$H=j3KmM`sAd|G0?nh+|vj94Y!_Lk!K}*b+
z%GJE*$@Qjf_Avh1j!L5x<uA$6se~V{j&ya78qmT$9BBBPm?g^&i^{IAty2V=-?r0s
zWDd|B%b+W$n5k^(dL}pn-UEFO*;{<sRymtdl_y>K8{ZchmVpF@$B-3v#@Gd*z`Bgw
zgP&%32VpPTd@I8s!t9Sj<})(7q_pX!&x&;)>ZXUAr;fc^_U%AKo}{f#q8aTM-YzrF
z0S<Jo$g&yko;{h4OY#M<!2X!aEz0>3;Phz<=F1!h^+ivvT6lr^p&{RQ>*l_=nW0F!
z80jIV?&*03NzD}=gC7mn7lYjlzGp}T28n-@h-IuGMZuJ3L`}B)_zfmr&732&pHp6M
zfCY~>3~#$&FQ#lSOb?yc>lQ$=rCKmy;+0(1vAt?X3~c}vXOHl2e#Y|QTL<)!?O=&F
z-oxYC`lqU+7f)WHn^y;fVqkHupS*o*%P@VFsa=uo@G}kN*Y`dI;-<OK#XAWxvLgF2
zKxGY(*RZaj&Vqykrc?VFxOO6tq=f2@`!y}ulTK#p=-UJ^aC5;={<Q|bq4e1MmNbXd
zn+;u(6=B60FZ!fx)udBmC0E`z6PisPY9RnRm(yVMnkMyA#haAL;<q_7Jq~&ARv{qb
zvp|YU{)pqjfVhdKC{z_Z>}!Xtnv^X4V&K<$s07)0&2>t<89h)lIm;dc*yg8B&$bO>
z;1>MfxYw^7ed-GI-%&6~axKGaxM-9ldEH~P*GlWqk9n}{5?Y+SF5D*CMR+MrQaY8b
z>cQvT?R_lW#~8D<#E3W%U$~DqJMw1>%0P{r8=LQ+&_MwS8!wZz&Lub02?&pnf3|+R
zOKJH+Z-#R4NM+ptni9A^qzRkEN`J@(m1la-3LNg6Y@gAu4yLh$!5J-F-^_gNcZB|z
z>0iA^!SAW%@r<P7xQHJB5Lc_sY^0CK=Xxhg+0vK3tsOs4DTqx;G&!gKr{itoweIA9
zumFC$-};v=<^Jh@)79GQaNrfyQB?rlPI;;pA;1a#`2|X9PAAt-P1|X0f=fI`s54o`
zthup8uh}`LLTd*I>F@s%Ad$J+dVarl&TIW4IL1<ecu#i!Ljz0P;R-1(jj$#4s8qg#
z`{`Gma|B{~GRL$nj34Q&aLv|x|4p9&RZ&^F{ftws-VD<WTa485&0Fj7!go;9?3udf
z5D&4X3a(3z-596or2f5ja{yD41fEWj$P_M!T}i%V8b=$Rr{-rq_ne>ebGDF#unA`Q
zV3$ERuPO_cBVKkr1M=58ZMk?Y_W}J)`nA}CQDqOxc~55U4^+O=LSEAWDBnH^Mic6V
ztVmCocPmc9@37siIx?IXMsUC?GwvaOuv5HSLw+C?(4XecjE($0o!Y}f;}y{Y>0s|z
z+QpSyAW3T|K2|u-H?CJ=gT8-9Rl>|#TDsP%CQOTV<-Iuz{PxQI8%`yE4l~r${<^<e
zALgN<P*QUy1Fvg2nSg&Ah`WUyw8$`>-*5F_Ihn*Icz0;Ww}!lpXFqTyD=D5nPg6FM
zi@mFEDPMM#k*ob^1E44lG}%dpR?8wXOao&ZC<d5)4_bM*sH_?{?RurdYmT52SX^}t
zLvr>t{)U5{=Ij?;^oc<2X9Wcs3-;o7FBMg$R`H47KbbU<8?)+77tBTZ`)FYfr3V|=
z)cemz%1uvYUVleW8tyN;z#806j}LiDv%HA#)mIy%dLV*sdxfR5&JFzJ<SHxo;JyWw
z&hvg9Pc}yhO!~^2{p2DPt(=kuWXzgfgEo5ONSiBuym+*ub~%|4+exrFMOiEpb7eR_
zvn8xtXo2v7(p$`|ztd3J?50Fa?aerd6~*z)0P6mZU+2`%e!&~f+-<JcK!+ij{rfE!
zS_?*z2h!s&M_1SF>F`L1*>@52$S}kV#1Flqu@0d1vhZFN!Um@%+mP#pmmo~_wI>f^
zZ@G|FK5OmxJo!S7&K3KDXq}B8V4>a7EJ!47#>ypko!L`RCTk}jT;CZ4cyC~p^_T8D
zWad+x+Z*WqMg2hXiP?8YSZs>J#PsO?x=&hGjHd(MJ2~@$EB|N=Z9L$fQ599zyz@Z<
zEwFANNBNQ@`C;?*N&f(ND6Y)dyxl<nHu45N%G<?R(Rz9o3l>NWXs$Tu;bK{@3QLVd
zJtJ{>GP!r|Lg$3;8Ga!n*UbMHOZu~$zqL&mWtd2B?Xh-dj)I#*N`KOz(bo6l0`OD7
z_c9`-E84}$0&z=1qk7<8t0V88`5?iyiEr}Xa8LyBriBpdWdc1A%cUYb2aoMm??23;
z;s0h1<vvRbUZhp^u1HnTC6pjP`gQdzEJ5qScp*1i;2kTmC5iM`3fC#q&Qd|SnIZ5L
zMgCTJ;$q;1(@i>=2c$A5cRxsUccO@Ba*rMlH5{a2KWbu<eWTeVDtTNMJOWqmNAe|I
zBW<;hGL54Y*MD*pcf3E!FGU#ake4a953;0qtY-d79}qxfA!4DO(K_AFQbuCxBU}dd
zsg&9Kh4CNIGg7<EiL8m`*X49%d7E#CHaxQ7qF*7DMxUxm(@%?P;9rF93QUTr54yGF
z?=$%_KK`7ULSyQx+X)6_gj!Fmp}b;6RoPwYfe$6s-p_-=cxk2YQ+}Oh?Jhkm$j{_w
z;b8^$vWyO@%i#uD=)80eZG!DG11-HC^WJA}nwbhPq?blh^hpC}1cs-No+@QYgHWka
z^C{-Ju^-y8;tr5BuQ@>+^8FP>S*|xq&-aL29q`B3z%>&KNA=k!TT$aeYYD1h^S*Tf
zRSKdmRGl~wb{S22Z(26y9u^=h>U;IwQU@WQn1oz3?bp7;u=uZE;Z#CZqo^J$+@`ke
zU=(~!_T~M1qZg0E)ySv_dnDI+38<bbJXWF*yn6o&!CD5}hkM^s6cYOlU<*aL-p*&v
z`wH@xvnMj{!t<s~YnfRK>2*a#>W=bKr{~m(8a!4HoxcSM{^2-MOn8%`IF&V{{6?OD
z%ga8zbq7DSYCW?Gr+b#~h*Rsw?eOo9Dt?AsWv9xaPM~@#LU#w-`fUDghU?n2>yx`h
zMl&auY5OMngP*&3Q@aAR#*oB>2ZTU47Q@ec*G&Ixy~amY3Fwm3I}?R9vUg*YHwh`I
z#fk6c$u?DcO;SYMaVgy@)xGQ)II={D@xF5nevcIYaLwBy;I!WU2QpHVzub*?x=PJ9
z)geGmsurA$5DSR#&hQtjI3u6D@_9s~?cVuv=abBe>*7@Afy`AQAO8rsXWL(nN>lBW
z9V@w3qzGCT|4GAH`h&VHZjqXIJ|KKS`)y~&LQ~AGv9A4(i(VK;{R_joXCM84zG5=a
zz}=uf-rzF4Zw!8I(&mQq^MqIyiC1n9Mc2$#jR`SX(!x45DtD`f230@qEKFC8>5&$>
z92h&bo%dfaYldok#t^thf}Joy@`CRNuh0X8pJJnynT7?)r%-c`ofylVt><5UPK9{i
zj`TEfz<%d>C#To<&OD{#{Q<m2`SW`Pg?slXD2Ry(2?+?U1kK01N5x`=Z|!$?(b-9;
zu7GfHK3$5oIY%gE#wRk24_z5oBiCvwRh6MvSr@j}S(J(vdn^1jC)@PJQHjXV@JNFt
z0u0eL$1j~PB*pvamN`K}DW6_QY_2M4K*~2?(OZNFBkxa0ti+EGX&R@F+1bn}su;ln
zI_$IVT?wkDd{41E+R|ctf7`_bP9(w3!!iPzvYc=4l440TBtt;F3<$pwPB%Tb-G0vF
zoxU}d=k~VxWog?uDtBUItax65kH}bBKG%>qZKzGO$Uq7lLP6PD9!K{y)}>%IKfkfH
z{-s0b(yay{iJGK~+)=+vTzckC^TG(n2Jb}|hS~(}gVT|ZL7`H_7tIE3o)*?pn(JIj
zvJ~F^K?;Q;!VJO|C$^48UG^1DP`zCq&K$8+0=)Uqqkig`u{yUY6EdopTU};g8`q4K
zY7c2e+Iit(SfW9Zl-!QyJ#TxMK>d?<flp+M4CLowTI<ulybH&_Z+Dyb^>Mz<?bCm!
zo<IGP#IYx%yXQ?R(N{!5f5G9!r9|fGv%a9HSFNDbL~id~tv5UC#4_)si#mK~T&Na1
z=Mr5`^h%5-H8Bduh>@j7vJXuS#J;k~W~UFO+B75k_WG;V1J+HwR<pH)(COzE12G(+
zhd=LoXYfDnlKo@#<;#26cP{Uhc=WTO4+JxG8=mvc8*g8aeG#-YoAucF!a*aV`RH_e
zq`)66&c9M5%|*aTYMz3?@^JNee|;76<lKg%!PhKm*>LGeX_}sxldnP7`OHbWl;s4m
zy2*G(X^v!q8K+Y0L(WhZqp=UFL%1n2!7xvkTk|1fgs|neiQN$&w=f#0ua4Gi2|*gT
z;ky`#A!ZAZtoCJ+Fo`8D*n#VAai@^j_v*t~JsuD916BW(o_xu+rgJ(wX_lHmshnzo
z^GBZuKixEI-EllKrka<D4yQ?{Jvwq5*ry;AAL@d%j1w@jw6!XPtxci^Aulgez45Q+
zmu}&Iex5xK>oSd0mD=Z}&K(x}3=J2A&wpR)N^gzks1i5_Tp6F`oexd&G#j)VPZ?J^
z;{yV4kb`TLu&~lCG=IBkNba((-_|P0Nbcl4@o7s`^Q8B}_zTWOakwl^B>DP(omHO{
zV$PLI#_N0WG&o_^%L?+)Om;VdM-&CEhEwz|tHoel>^hlbU#dr+)txITadjQ8PDn~l
z7GDYKwV6Yz(3IA3?bHnlF*k{MjHo&=X9p>NRPOD4y$oTRM*R#wsEF>=x^t3w{_Im9
zL2=)`<Jv7w=W|S7$!oo?E}^~<BOF5#?PHIxCMIen!ATyE%ez+;8y1&_V|Y6(Nl4|2
zOB=Vk5FMzq4j|e#I+w3c-ROSg!If7=CAzFc?hg$C?QHV{-C7QMyFO#@YXW<_Vc(P+
z{4K&o2<Ql|kQ&{zpuWSa-@qlN@Fw@^U6x+MR|sXg0K8&mbE5l{g)%$uaCCAiZ@-%Z
z@mx?lT#9!fe!v6e>x)z3U^2pwd|T&}+N5(F1}H}6dvC`DaVF)=x!OT&XCZnb6XiSx
zys^e0E<Rp1p-ekr#mh)%1IvQC_#d|8q0nDzGcjs<Z*Evic9?6euEg6^&dJ19#-AWO
zX3~q93|Ef^Q_`;{m$G;s3j&rT2o<L!AIrCo-pstc50_;EkKav#r&4xrc^+9l%}j#5
z>=ErY;3OWQ46AZ<`JR*9AKFc{--6)fg9cjWvFZ4(trrv#ESU4MRZ)p)hWy|yV)&r+
z(VL?zhUk{3`=hxfc7OA4zTYfV6vYO4!AMUOyGhw2l8>Yj)`xSWRo60K?%j_^q7Zqq
z@1RxPPK9!xf08WwF1`9gTy`{Hlk?$YuM^+pwiSw+hoQHROAZ&|P9gCf`z@EY&2r@(
zZLP-pKTBoLIb7yj0j*wtLiFxuG-M-(yw%glm0(j^S$vH_%I!nd4`%<NUp|>82Qm%d
zs@I$`wU)Br=0-jtQri_&g-N!4fcT3iDdE>ah>H*Y#3~LL30xSfUx3BRfSArIDA$>`
zyGp5iAx{?T^%@za5VK+jsyI!3DWqi@`#eTK9l|@JCq9mN%B8<~US1cjF{(KZHF644
zIu0U&V^4)7+j5eB&!r(2f;2g}PoG*S1CN2bYfmwbj>b+4{Hr1VQIuiQ``p7S?ZMvF
ziS?eY{HF1%Z+VG&-hO~0`ufawKUA|o`wbHik#Y||&zEhu@LW(X3Da5#*<bE&TMv`E
zGr8XK-HnM_JhP``W&GE6_2)eMY(?nSD{tEgZYw(cNn96>y@Snntw<!dcoN`cc$p(P
zjfOh#YS_{%UoY)>Z}>G(W|G+M@ZD-3F@vtv5@juXYQWeuZB@nW$GySh2a~<1?MkoI
z*4!8TybvUt%L02w+%qB);+)VwCZ4_hG2XII;V@pE#YV$QS;S3Z!?LzBHP~hS@B@2M
z+Py$qnT8()3b+G{!9)ASSKhx4Dk`I6&34hC4#fHaT2i|!l1Z!_GW&wba(PLSOn1eu
z$v8gnJ5?qw-c0Bw)2~s=$k_h0^*O57108Or-QP2a`zp2Nt3qyWP4em1<_ZYJt8MAG
zi-q*@nHgqRWCXCx-|XAFT1P4BS=C@&DtY}D%esm{@{y%xXeTWpD*-Dl2W?oF=v95M
z&+q!UV!0lw|Fk?R@Kw)@RVmh;-r0OHzr&@LVTlUQWn8_EwBrKpjDFgBBS;(`E&8Uc
z)QQQ6@J0Wx^HMDWkL@X;rf(UrSr4dYAE#%IehYlW`<Kc(EUnE!I^Aqp>VEzQhM=F9
zO<V)Xg)I5AkoY?{=x&4`tvRZj2<=l0F~;|rkgeu`c&U9`jS~-y3iSO9gT)-4vpJs-
zqs2v4<%2|evjsNjwnFc&JWO4}PcL`|&KwxeYR_lAdv-8NdYUW5+io|Ivev!9M^|(`
zK1p>hha}shs$3^Ep0xzRZ?+ny(A_mh%x)2@Rg&|fN?(n)ZtTn^J4SOhL~}{!#1XE9
zO%?i@ptd7>I9gH35^$!VTq~y6&%hlw0Qa3Ex|<<0S<6S?C^&VvTe|+SX5GL%ptKL=
zjhW7k@%FqHBJDqvSkchp9CO{m2LL+1@dtYZw4S}ET#+x@fqSXI*0zM}mI0b#4l{;n
zq9lrIxaSXe8pBvLfm~6*PuL!b+K-EU9$fCe{lv39D5jpFNPjy;LKiGvT4Xpqw8cry
zx`4XHe1~}Glcuqx{I;QhK!&^lvrgrL^=l}<n?aMa+kS_#36r4$`Oc`G{>D_gno98T
znw*9Y^q#7+X3E3#YVb0Y)_iREj8_lrg{$U@riRm)h+-R1<m;R^uuIF<`OyHoCU0jX
z+*mBh>d-n`>&xk{Ma#vq%9_-pomBF^Q>WQn<wc9qf!P}9NGQv%TK0q&Y}e~aI-W&r
zZZr`|CZQWCnM>8qHG{k17$y^461mx?GrEUNO(#hgU9s_MbrT-WJk0)n7EkUj%%;_u
zrBl!VXUV^8f|82&+P}chyB>&>;EB0N)=6Bp&Xr}U$+;X>dEg~EXd;_<8q<{kE!|*O
zt<e?kV41Ka&4mYxZ?L7~O3cT+WoC_!?6?96C~s?B4{^Lv`H9M9^QCpt)UD69zQ-fT
zDv`FFxS?LbfSK1sAws^t5clM4duf|EnOFz8Lc;5U-Bj6Ra^HS@cx^F2V4EYa@C?Rg
ztiLzXQoVt%(%3P63+e54TDz|l@!e+N)10k#w?Qk&H&q@S_+$>u`a{T;*n;?@ZX}eI
zsqr}JnP<`W*b#YZXDInQvH1#{UnJqI2eD87aC}t!N49=JQ&XIw)gf*e{BXgf6Rof}
z^HphP{I%*#5&qr$?X73Z-wolf{E=~ozGt7&#@^kD1G5|<!U$Iz9O&@kT5e9e^nT9?
z48L>ms$MqsrO$?g(Lz%uBYHX%zkfcQMd!cEC+=c`uag^kc5x?O$5^}v%QuUsyv%nR
zZqNN7R~D*Y8sC#%+kgWFEC;NX)1TyQ6&va7UAVY^99n5c+srk}=Xl{{a|cmfJ<=b^
z6O+qYYt{GrL;`G2ZtQX7)^Z0*`r!8-1g7=R*DE!G4^zhk63u&ohcuM`1Ev)uoBO1-
zS;%`d+0;)?U<1})MS3@x0dK;EJeIG|sD_|yhGS%e0)_~59F9JjEW4bHFLJ>W=dD8f
zXRAebFP1OolP=0W3&iq{fQ|QO%N-zD;s{6JG$Td4Gl-9K^{@8Yo$)BVCH1eN(=ABQ
zmGSP?lPs53jltdV?dB(Ydnwb=W>3}_ud5|KU?rvD$0}BhPXy<tQ&eT3^GVwv!WMXX
zxlxZLVe!q!j6`TY0bi9miBeUB20c+5T}*<A^smRf<Tlw>Hm@WPz9q&o6ZwT@n&uh4
z+z}wLuKXZrd^J3uih5LZ<*uotMB@bQv5I1`;KU!jRaco-N@V)9nM+Fo`}$HPM$fj-
zem+kEE-m=$1QemRB@v!{3<FPlUVr|P#`F0nK1MDm_t;$XdN5(K*IIgF^zDnYtwgr>
z{M<&b%uF$E1aul#K8r4Ah?2cM_uM+;$u)-l)IpXjBJb6_EA<`;Z<JgXa2un6V%ZLO
z((Rg@dCzATaWd*o)8FxQJLj|8n&U1*W@lBi5;sRqBZ|r(^h&WF&T6&&0V78K`MnTR
znH+Hfx`?v*`z*~ZeM6b9%tEw1r8s-cH0*NqFlnJ;yk&IQgVekf?=%eN%a|2DyDU2O
z9#qll<F4xR690r0F@Fg=J}r5JZsJou+26Xf3LqG4XxO*EFlAlV{>z2&{SSV&&lap1
zWcY4yIo$jk-unnDSt1{EtD`_bB#Ys(O0bdGa+(OSVMw}2<&<-pjN#h1E>S6wL51UO
z#jX_h77t9|rI&8bi<pY##Mm4?7!JzBe(wOP^oNk3io!i{;??T?{;ZQQ4Mu<Oyu$Kk
z#WqPtM$Q0qO{24~hJL0;<Lw8}pC_;J+^auMsgrzm`x>?qzQ5l_)Mte4hSlujbg;)%
zhXWN{J!e~M7QK}=O(jqS%^8}n0^Er!y*S)PBiEthE6L!WZT{PcLzf@zvegG%|8^k;
z7O~e5%Gc&3NsOr2LYOpKTaMVv;1a%$VJu_QYfv@6=VWDWCO9(w^^0qAoQR4Az1`{~
zhYdQCeo@yP_v^P;x+9y2ct(jW+q|+@S+jy24_`It$0RK`#VA08fRQMd!_Rg|1fh(0
znnq>vEQjRfbJBla#s9T@V*4nF`Ppzb<h&x{e||G;DCId(L)7bOCPuaishwtLc*ViD
zcUcuSzS7ZV;mV;hImRi%p-DD&h}V+tUlirY&Y$-RRi=t~bUQv_^wSqZZG0xGaFgu%
zc(e8SmplE_^a@{zH}&sXjD#PNkLJGZRao3wPV;bvZ?Q)E@U*W;W~(#l+d6Me?mYfo
zBKX($`bWj!zy0}&7@LV*-&-?ZezmM48D%HxJTVV?qF{B;<V6lEXUH&Hv`-tO;R==A
z#|w15ScObTcs{QJa^_e9A$Q;Ca&<8YBkKQO%M$<XLx3^(`7Qz67-xJwWR2wk70xTS
zX}asSDs<n^=n458S58@_PpjV=7T08pjLb?>H0uxumKqk!%XI6%Mu^sccx<hd`$UdD
zu(Q!fOKMNOI&XhTe~10A@BQEFBLDgV){%c?uo1X~3l_UZ!xhtlc%|N@dQpfukJY~%
zOhg=IY`oxfT@|g6$$3G9RuPviGS4;%ESeN(KkjisKM?1CiUFE?k8kgO`J+R~J@3l1
z2MM7Pjv;1^H^R?6yW68vTA`)G{PM10=H8{-<mtVgKW>7r{;$uxn(}<|0P3eKhrh8%
z3fVd;BVl~^MBz@ui;$ae-fRSmT;E&5@=f|_b-McZ3dI_w4mWR!j6fuKf~9~5!4||C
zS5>rlXj3R(EBGau;{WO)#3~5kggNlvJB{c$@OoIgMl6q0kaqN8S@i(P(;|Tf438cA
zEA`+5=i<s{SG!7k+C>{PxQ7nEI9e1bX0L3TT$~`D5maDU{Y!XPO0<fITC7j98UAlR
zd6h881FekU#jD{)XX2yq$J@%W<*tQuW#C;Ez5AN|4{5GX3&jTow@GM#m`Y284paG&
zbR=)lD#}o}F8^i-D=7Qq!bxGM%sdz+mRBraAN5Bbu!#Tb_5RJ6=BIcRC<Odo8=M}N
z%QMdyrj2paG@G$$E;WO*tCi108(kTG)WAC+aPvL{PDiPcR;G+3MzZD&iJ~cpSL_1<
zeYI5ah7BPlm-<;{`^O*ph=chu{`VIvLeWi$|Bn2MH#mSMrt{%bU%)o$@Hf`qG#6!x
zzOf79{{oI0$P*HBH@sdNzOL}S<KaCGvtp1YR)pC2(Dl=~==-p2#;v89EiR2fvQoY%
zGNSkdjFn{D;{W!0e@`z_f`(-lJPfUkFmNDZETROWYE7G(w219*(nWRGq$`95KU%k!
z`lu6*<k(@M_dpl3CO?yz<P@3d{Xzx{R9Q7GSll9BfB$1K=7$;jNIfo?JW2Lc1vG!-
z&W!T2Xz0U>J!6SJF(z=E>PTULIGv!aPO{(dQ<z+-F4Hi`_i!~XfOMZGT1&b)G!1#-
zc|m98RL*K`r^Y)p=mRT}u5t4k2kKIi>&>L@$=r%f9g^$nkgTh^YXf`JnO+zpZoxVH
z`>Vj|_f*?RjO3W^*b8EPqT&9bX47`Ew9OAZma1EEm~98kD8?9kGdn$5A4nINJsaxP
zIAJz!%yjVgiZ^W;zKH$k-O8fhx@jcAwQgLvz^_+0IVePGI7(jC#04)0!o%+A8W|zg
zlaux22VU0GP%_CkvwJ&8aAXN1!re5u1fA?!JA8_WqP9fr*WgFlv65Pq4D!6@jdpO-
zJ;8@PGZ9)|KIh1t=DM*<F)k$9#@t_#qu@nRP-H|>9NN44*g@I36Gnue5r{pvhB;10
zBg1VDW|Ps9=Tgg3e_gDWz*mEq1o2g;Lr_%0yA-?!E<ub7VJ<978>VkwFDXRrGSNy=
z(}UCHT6nljFDM%s+qqYLko)#Md#2-Y3FDT?hZIMigsP+>h-(EXkS@>e#8@JW+k}u1
z$4{swgMQhNZNwn?ZR15HYDj*rYa_!h>oXBobV4)(-XmmMu!~v1e^1q0lh0ekh0O(q
zPSb#jN!IAFU$aE^G^nqZ=6NC`hveh@x#ZYGSzd@dCe0j@LqDIXw%=GG-D{~6aU3?|
zZ(h}zZgxnhb<LiW$1xjWM?Qprrmy*(u&~-e{e!BV&CKO4j<X3*xYnC_9Vd#DIZuju
zlKG5R9BQ^jT{}h(ezur0`lXAx#P815NoVMTsx<QEz-7&6gXt)lX;Vhm)fa7DfzH<Z
zEu=khN|Cw!H@u8wn@%(R`?ATk<Lt6P{YgKCOLekiOguG}rfZ$jcdGVVEBERaSC@&n
zda=Gk9ov%UpA~b_rc57Ot3<Ct{rBnatJ4TXY_G1~&$LV9pYY$UfoNo+iVxZikCGj!
zvRIr5s-$kEy}>v1i&iKE5mfFJ30QwS{W>InDN$lOdN+_zC=g_t1yrh4v!(P_&{bRJ
zc^-~6uiX6S;X>$EK_Pcc@LeW(;TP|WGoL+S`O4xv-E4H1FNKF(_MLg&Mem+$3{4?T
zQ})7&UE=4U_C3$b4&W_RX?Lf@1tVTe%f{AQMnqmEe;ALP(rxH<a&tU+RT=F4{9+%7
zwmj_*rB-Wd#*XV;o?@H{f=?egYk=)5x6dfv=`sgC*`t$FSnzRDebRcBOh#o7Dy8mR
z<`-OSewLmys!e?(jL@epVw+uKl8o;@_x*x{4EZyMNiq5MaIVaUiu(=Pa+oF4&8fTs
z^-8R9?OU(q#mO>=0i>0eT!VglM$5W0y-;O1JEG_PLgs2dbfU3>tq9eAClL;<M3%-&
z-AY$&ZT6k_Igi1S$;g}pqL(j3`Ojn#%%Ag_!7tb3&a9s}I7yuXO~6Yfcr0Dk|Hs%{
z#kKi$>E9Jvpg0tFFJ7RyyF;<y4yCv|1S?kD9a`MAxD|J4aM$1vTmpoD`pmq~JM)`4
zn8O_9liYjXd+lp|uWMoEGXEAB<ZbgCbYCo(ge1laJDQ#F82KN}u(22@6LHzFkas-C
zTtQa(bg&q<NA!V(M;ITj2wh{d-~lbVu}_)!qkuMVslSEbH}_vQvkSAib-&*u>qHYr
z%{CmaQO>Vw>%bl_RY*Pjljn^LnAPcHQ!DkFik<`%XXBO!a~<ohjzRoV3gWK+D2$)q
zy~2`saVLWi^Cuj&Dti6br=I=R$)zY)P}DQcDz6q3B5b;9SixH(yjU2$i)CNzgAQ5w
zyem@Tmjk?NRralU15f{o7m-xdPT|=Rqp4UiuSDMzNPNhb;OCJgvC@C|t#hBk)&~8v
z_rrDqATpn1V^;v&3WD!gcLe#=${*(Pc7!6{&F#-?%kqwP9^Y(x={)2nfxQKO<pLmU
z9LeF~;vCi|Z?}Zp<gY`OpQ`k@D4Fo=@&|-I<V*Ke7}o+xKAK1QmLZ&HN81d0ly@fM
zC<{t0G1h+mv9b2bD<Q_1)^o(Fc(h!>FhOB7X;KnN{q4@zLOq)i>S;O)9rG}N(#|NG
zaI*NrF?Fhyj)4zaLMxYpJNcE)mq$bz?kX)!`j;?Qmf_s4fGe_(;<Zn*x}Qo<hA=+z
zK1J0Rs>i|-j3U&-&B7yvUrUdGXd?@>=DA}q1-C0)3gA)&sKub31c#Q-tLVVkZ|zO$
z5YK350+kfH>gZAAPJ@<V47K0BiA*z4XfJ&cRAHiY8%2Rsn`8^rLhR_$5!dAh38Sce
z$c9OgrXD=pZUuQ&VMrryW;76wl=e@$nlD;H6)Aerg{~Z1cA=Tcs97Jfm$?(KkLFv7
zcCUoi46g0f^UAhnQ@<c<0Vb(OqpWDwv|BQI<A(Ea*L^E#7UV!SzgO$LXGiW_94c@$
zH|FwPm~`$>oGo?!b}(eaSpDAg;P*ri7r_6xQAwoK_Fomsr|n>**{rMSPZ>EHw4{QR
zHJK}mfRwM9`E&O>UGR?81plvnRhhQoZ}uH;6_!(Khks$i!=&H?XTrB?sH~n^A_VLE
zTI_=gJ?0zjNtjEv&;F7>cKlaU>#=mFJhVJuy3y&MN;o{7ALShTXL*JKewr23D)(r#
zRp!+Hc-D~H%6jMbV}X6}&;>}Hb1im)qnPxBn_#_CQkM9J{v)4Wbp|yEgVDJrv&4dG
zJMdu;hO2~Z@%CR$!+%#3j}DYCs*#?N29cg+(_X{kdHe2UJe81iubQP1yIcDv&DsmI
zv(-Y;oq+ALDqcwn>421mFleP=`7|$}2PnLiot78E@SfeG%8wLeMR4%Gr@@FJnqrMn
zI@Yy~unJ3|$tH5L3<z@8_wOSJfx?%%8r4)j<g*Nw$>w6^EoQL{Ns1$8Lad;$O3mlK
zizIMOB6$YOG*^{j{_Z(P?L~XJffk`~NfUgcYUVk{?d*DG5|;JLHfQiVzO&y{PEWnD
z%#41s-qyS7C_AU@iQD$*cf90W_GQ$Rp({e&I%qk*@=k;<>k<iU<lCx>6!?@Ll#bKM
z(n@;6m+}|lXOy^A?aDW-8nOd1M7u-ATNGyWt30|yTpf`=va03`aEivpT(fi^QBx;!
z6H*OW9XcB|a{Rngk{JEGK;VW%`k44khf2zgq!`<~Cl4>X1JgilmIAv^e6YSmivV3U
z<=m(CD?(m1xlT^~<pdUkb<12oi=iQ8XQyEht3cXp)w(2|QYH%yc@~(tivk@k{=89p
zIQ1!R=GSdJNeF1G4#Q=b+&H6-as5-d?3Nli10wqAV5}M5z?I^N1n9X!8zM{0>yL@2
zo*i+ViwesE69MWVT@NYk?O!|fef(&L%K<@Vbc!ywR$lwTC;ZoSKd2o%rH$hzIHN7c
znq@<{hU2nP_9o-;@frV=0fIYS5BNm!1fR3U0BWcxg68$QtDUezY{G@&@{d@rO2b7<
z(1?TqUxYe_SZW75q+1h|pBde+YJ*0<*XD=H*XGAM0e%Bu{j_X}<y9T3(Cgz3q>n?!
zI}Z@8w$9GS%<7$qxomxX<@N1V&FXT&Xb~MDj5<!T02h7;V*R>D!^z<q@<nGUUWdWb
z`oWNKkCETK*GfX_M>iw2vMAK!<^K5YKK6qU+PgT|YN2RgkmT?v+r<3sMx7!A?P;%2
zYEmHE70O^PWLC!(C8Mn-^X1epnZ&?It2TjIy?kN6>}?n3+OUI`?{>ump+j2DQT5J2
z?O-;=HF1;UHpXe7;)KvM)$N2Zw9ogpZL=B_5HOJEyHap)>QU&E`xCjGx8@^E*`HH;
zQ>?@Pv9?=h`Q~(P;``*ySOIDm{-gaJs7}f9_5nQTG+wZMWtHd#Vy(_9@G4SHrwE3+
zCC-*>4QSq<{4`4L+FJ5l8E?|SACNI3c-CIrszx}Uc5xnG&?*M1^B9VJy5#%$6m@Vg
zq{?4qdTs}p6{&nurPmf1sgNnAH5Y+n8LN=9D0-tfn1u8wWf)mX9N9mwo6jr=9DvFm
z3z*HFiXGDmqn&irXtdwez}DkYvp6$@bTiTUcdGdnLDM%b(u$Le)G_bm=*O?FIFzYe
zl!#34O9s)I5-(3Ha{unvI;ntIFJZw{HltmAfw(~4ig&dMCv&xhJJYepflx7h`QgbN
zgQZrBL9H^T02Ee6@QBFiUE&Hz18KJ8vB-Q;s24gqDFXR*V^?NRl#_NH{;9&Rd@S=a
z3Hwj*n>w7-SJYwGE>bneP(#}04>)y@V;8n4d^GkTDdGYpe&@~p)OQN`I^MR<cbhUJ
z^R4aVYJ>PGk7nu8*+w?^!BF>T^75nw!>Vr_3Q<ZmI|c<Q>5$H+Q0%n(otbI(g#IFl
z9Q<7&rfcF=D^<BkuS+m45}L2`T*<1a@C@x}d6yp8wN|$O`$=+t<j#b2(<qaIVUj>b
zliN4u(Ph8D$CHK1T+`e1X==0}?7Vk8?_Wb*Q>bUM2hey{Gd2*D_kgvBsKg8Exf1?-
z4_PQXhe!4|k#Jn)*1#Lp)jYZZ@*@}nuwuHyg}3I=b*)?EE9qMz8Pbw$d?1KT>j2a6
zpk84c&GdgfN94PGjLatUXH``gjZE5kOTRN#KdDaTp7>Zc+CS}8#F_{jerMzQ?mhE9
z9b?U1-vwS16@b2A0lt3sQ%v-{V1!4ibP^P4ae$N7;X(2a2=h(K;pNd(p~_N$A^#If
zb}F7Qq{4T7Y8W}UJ=7O=*L#bwC6I2sXz#~e3^_k7<I!o$bAs<jSIT+{#?*2*hle(z
zHsE@*)lmTi5vm;|{#E2^Lo#RrglkHEWH9hu_xf~-{8VTwrIS9}H^Uctj_AbXnaZ$@
zF?rKj>(Mq<Ozyv5bMwFq8AYbg-U49#NKzKDh!F96`bb)=IAY`!Ej)Tls$=ccBE%`?
zp$<OekfJXK#baCMLg+kTkJ}i8#oHILBEIm$Qg}5wx(jwu&lL2~E`_{q!q2|YzG+uh
zKY+EMXiIrLgNx9|Z|{6+>)YmAX!cN}in9&tUk7e$@+r&752@&%5e&y%d%I@2zoEPD
zEkG?7dh`hBbkSL4+IdZ?k~qvzj5}Xj{$p1U%Ohg*NbF4br#<5#SLbv?vSkq4VS23K
zM)|>=F2C>^9nB6^z;Z$TWZP%yb)nDRC2gTS52PD(2Gb0OV0<G?Bpc=+6@KuiCh?Gn
zAM5@`xpAaT)K|}B*?I!mp&os7;y6j-|4^qkM1n;_HzVRv1~iFck<p(u;P*eGTC+zR
z&|c`nTcfCOa1ld5uYH!yyPIABFW8t=ap8r;JbHjQMXJ)^2#24mEcM#_;QIv6Hp)>;
zJL)L(>xWy3$C#Suuslo}86;6*!L9g0^UxAMsbQ*}1NtxWgH?WoVwEE?KlE>|@ztOg
zOj*_P7pCVZVsTYt8SLXaYIzuZNQ=&wEL`R_x?jY4sAfzgU(*mNRF$H1t2qphqD)gE
zpIwgB?YD*9xWR-CUPAX?(6WuyO>gl^7*ivDFcBxN0Z1rM)7}=B*@V-fSvP<5|4!l?
zPMy4_Miq>4+7G3S31LA{)hH?jFWwEuj_Al67hRx4Y5qbk_}Z2d&GI3+e8$zh7pK0c
zjn}0m0PLbcwDJd}vlBxuG)60yV+MB>-FmEfulAz>$_Ms~{Cvt#!mtQ=#VR)Qf58cp
z;Y9hzG|@D-<0X|GAE;A9sBd>3&V&rj0fxnh0mJ?62>HB^#eqVM@hhfqtD1p?6M_ao
zNe??|fA6DcEs}^nXJ4ee#2Joz0oq*^p%X<*C*Q`_ufN5K<@VCWNvL&9l%P`l5odo8
zA$&ndTSPVj`gl|Ll+*DQP(kQMz=pcd)sWZ(qX+bt+y(q%!hd90Pt%9}-lzx(L0}SD
zuE}4l4()V)6&%<edfZpd5;VENRo>+?KMb2vh9VZ|{Oed`J6Td^p~?lql09*1e+@*3
z%K;`|lMZ0`{*LMNi5u;ae}N>YcWn%I95^ImGVld%zh1x}+UN|HZXG6NmWr0$ORqL0
z&CEK#&YvGEV*|<!zHC4OYCiC)9o9Mb5Crx!B`Ax4{XCDZwPv!rukF)C60x)&nl#7{
z4v;)eBWy16lnFN2mI}lYQ>@cPScKPf+Ouz`YF|WZ)1?yBr(qI`eEFvERu9VbG%_HA
zeKQyF2@v7iMK`zZiMLHZ=?LLG1voxC?vXZ-Sj7s@H7jPU6ztG;R@dq}6q^INXc^N#
zb-Q7tR8`c-&eQXN>v}fauYdZiH^(D@1+zc*u<=xhDte~I3f85O6ayXw%ca=H#z9YS
z?72n`%F@00OT)Ne+lP8f9;w|B)I_$|53aS0D}-HZBy=p9Gfs(Fc*^df+SQJ;*AvB@
zx3P*dKAT=!bqHB;8ryHp-gn6~i?uW?olKafBTIg~S^apPX%2P~@n}5UA3^i~he!^a
zMk07dN<H9}7U~tSpXue5?}&m^iuBtH8CVV`7sT`OB;q9VS<!5>3R>LYL_DxWsedF{
zxKT{Q<OsEh7xHq0Qx#FN><{cl;=0hgWOZKL#4j{(-I3VRX<sM!PqE?_^D2>emVpd0
zs^boAY;Gtai5EpcrCrt&?}$`*eiU5ZB%ypEhKmco1_4U@sfk(Axjvk0i;=lbbt}K=
zv0e8=$@FftWQJErXTcr?TjQEfCEskqWta_hq$7_4BNdXJcASFLzQ4!>nk0{?85+SB
z&f4k`Znm342_$5B0;8<{wAN$e-137!TM7*EqAkriqHDlQO{*f}0<kPfmZh2rZ^sK>
zH<>^389c4y-(`90Dar8ugrGq7n0MZyl2*>O8zlGnjq4ChczL@A2^Z)jVTOwGOUk_-
z;kbRl40+4*aMvV$MvqcNhnXcT_LjjnNZ0-$$X|abx#E#h;+M?B>jFhegNw0mxaO#%
zGk=JMOW^YUni0>6xBk8*Ql|&yE++i9WW<bOBjGcD6nQ>2Yd{s|kwz+~-8}2|%d%I_
zu>xqTFIZSG4rNxex$R(>&{0#wq_7&&beU^Qk~wY!)^#7z@277xCBg!XJ0c@vweY%1
zU=8cemej#=xv;7CmR=KF#3&gB(_J+cgB+v@NO|w{F$5lw_KJc$lH`(KC!HzLK9tf5
z606vO&~RNY$RO4o8^Pe>`|JVB6Fbf7Se|Kaf?wekIf(qWzWqL1C{F^6ioBxc9=5BW
zOlE@)&SNw>Vb0fY`~vGWz)!!qhFY%=Vx8C+C>I^hK3J;8^fNw%;$qPq+)P`#f!-v<
z498uvF&_Xv8GGf#oOP}X6*%Z$ry7}7>4pEUd`;ZL{xVg*2EBP>OU)kDB(KP&ZTECl
zp-|-!gC9shsF-%Xw;j8N!<}!wWzrE77{$=J;V^IX^s;nP+P*oJ_w)`YE7xW%8!o?%
z>Kd@b#k3be7`M4tB?(m0MWgKBk06j&=@SGGtP6<KU*ehTT@kDvCydLtqzbR%tZHX@
zY|>6(ugm%~p+0vvC$leN)`A*5pHU4Jne|;(m7E)tchaX)9c#_LIhHxS_M@ZbP5W*3
zM$|2v#*`NQ+b`tpVB|>)qo>vG>b56)ZCzf(e_TL$FozroYYiZH6Y;OB;yKNk^=aWb
z!w5n{2p~laQeQ;s0%9#W!m~2GB2<gFTNVjl!0}()@?*)Y0A0x@&>bmejB}EGC*`>8
zV;N>5S`M`ciw&Y$X?1qf5M8N0u^A#>JQY3wo~7$!COAWS8gB%yo<<gvpdZ5fuYJ|)
zJ<<gEHrI)GG!${%uQIvW7jdwjD6VPQlj0N3i)tkCgTe~0m>FW^`!mZ+LROesQ68&V
zhv`Wp0(^&x3jmDwqCBO&e!mGVv&(m8-`?i=-T}v)88ykaB6C&6pP(r&3fKAGaT$9I
z!`R8M-OMP4APqJi2^iY?u$yJJbZ%s(%7V>Wd0l;Ht8`EHI2Y|%X*q}YyMmVmF5Llz
z`Wz-Nc7Mwg^1R>s;Pg8E<)1gws`Hr5^5G*Hv*p>dtCV4+r_6M6>w3c)zW3rE?&|E8
z=Mcm_efs=Dr$f50&1cJ!or_wJWv?q#4H_==_~cW!A2`fKG4T7Kb|bwi1C@Yu^X7Ud
zJ3h6_uUN9*b*)!#r&UB+KOzv&;AD>19=xYv0jkut`T!@U>tdB9eG^RLvlA^daOdt0
z1s~c`R#c5rBQiznY9C3N1dw1jNxyC?5f)J~Bh_U4@(wYsncNlwqX_vH;yLk4W}P}h
z$HClggP^ULrE}Vqb>;_-ZnTKmRORQO58&0zi!+=QrAq$GRwZN|bo4(i2K^&d&*qQ6
z2d|rdJXh(TM<00{bPle#*dK94QFNe^+kEDT^aIuTkVP5YEpg|KjVzbJH{g*g>XPpQ
zou50sK)EZZHfU8PbthAgcz_5>h@)D_+OdMwvu>3;0G8+2%wb&9kor=B@-iI8Cj8JB
z?WXAKTQx63?vvGCCH!3pbW*I13tueV*1$Cv6&<X_TsIQAMzz3U7X9%JbfkF!Bp@)o
zV)Lno<!zn8gLhXBUp;{mHyOMAx$yfBaYh&WT$0ryI-!NNElD4Ws+<Xm)6zr{Q$?H6
zO{w-3NgwdX{FUi3VUA|8HU+oEj+;H_$h35XYg2oJW!S#vx&EqhUIq6wDtbGCa%PF0
zF39q7ui^@?WR}|9jwa+JDw>Q8pr%D6zi2hPCJM5!y5+-J^tcDLT++zwBM9`A5~7JW
zj-WSMM%E9F&B(%lf{n(nhf$W<0wqdt?O*Cl03SC;>!1DFXS!E}&nVDGdS9C7PfKDM
z@$b%J3nXxzen=3IR&DYsrFvd%D)SNJANtqCPfj|xU0^WIhbPMsk^p$D_A%+mHWj^)
zpEq==-i33`y{i+Kqt5SF$9!c2CxLiNX5e>A;OqT6+<Z$#9&aS46-)~~p`C4_T4&^9
z1OIP>E^k6aUIuny2f`o449nyf>Vgtce&fv+6A9avPX{tgggYqY4@_FDxB1vr_ee%%
ztW@%by3)v?x;pdoJOs6u;NaP37E?T3TLjl)-J?3iIeiu0kSGzzp$rEr#pC#?Y!5bs
znwEg_8M9)H!tuQH2*=vC$UTiLxr&L2$3UGQD0n%;Y>BncAp;Y2j#B4A#~fpxo>Z>M
z_@xA{*%F2XMdH+DRRgS4y^MJ5Gr7US2TLxWS6bbo6UuA}2I{^T#b~Zi^5N=7R)CNL
z8cDtRo#}O8Zze^UwDjE!RuD_7UzgrgV#g6DCj|%&R$l-gAdqn5dhK40c)1seJZ=ZR
z$PEa>x9yQx{T~rN0#gn!nt#_=CZBRPI6u|LUiTNu+q5|J<(3Mqlh0Mm!LWKsQb}j6
zXOt*rYR#D|=ZcfdS9a;%*C>Ar=oL@87$^%dS<T?F(g)Huo0(^=zkTM<hV^4`1AU$R
zjO}&=KR+3AVg-Gyt;y9zPi65)HfnDh@IHeQJ48RYD&GoC*mdB4V4rt5`zj-EPz-sW
zd0j|-AQ(H#->rVUzm5I9m)==}!tdegD_gT>?KtH*A^OjlkODT$@sI`wDh0Q(Zj6t@
zI{B{%qsj@^4>QNXo~O2-?x9SPILwgglj11+%N!q2i^lH}m*K6DKV>c?UwpSazp|C1
z@TR%;bRf@br|$vI9_)brm8f*iS&(aol$JUb!Ta|L&X(MU`n8WX9?`f=iD9ZHRHJm|
zo)a>7Li}QHu;DuEU>^@6E!M4&;*80`Q@-w1m3AjHrHcKliWpDp8&n?3kRv1<pv{D;
ze^)iD-(sHo!5G{epIhFRcYm1^LEgM~$I=T{DtoujDFj7#NlfUBxmE(XP(4;HIan)S
zyjlIXVEP~JW`CAf0>8jkm$C30$ng1dkN+1{k=qxRnG}DJ?D1-!6ZrBa+WVc%`kd${
zezX6Oef^^EA}^Tr8=H4u=I5AXIih($5f}gbHR5ZGV7{zpR)iYKAWv{`XApLvFGVIq
zj+yyfCJLO2>>a0psSqdWt0;o+6lUD&{)Lb`GeYduMXkfDO=$ygRr?%^*dP==(AD7i
zfq#z}dy5HJA{^wlwd~MNS1I7?VMmF6LDUt=N$wT*gZe@D*8xraY!?;S^kCrSODC&?
zi;K`!+m9R|iz$(qX86om<_;w~X1TBpW<6m}F-s_BA#;9ba}surL)U4ZjyGxxs9DFx
zav0I6X8<^iklUsGAu}_&dR7;;e91dHV{lnhnWuywJhL@iXGvPjsVw0(-6Ao|(rxEP
zL^s=S#8BW+{gOKCno{0)fbN_2jdI4vC2;=waej(lgWGGiiqqeXWl)U%=$960#+Aq|
zDVCFhF;{^rzl-<Bo93b(Fr<01Ev+q<_z35;yWn{Hkj9oJ9Tf#Aju1m+L$+*9{uO!Y
z-0z|HZVVv()H^LT|H-&IOdXQs^0lgO$H~fw9K5kN^T*thipBofc{oIhYNCP<L6F7X
zq^#gigZ$^P^ZWw2$i|7-Upi)W`km`Pd`NU|gIXm;L4L6=dJy93j;*1>KilL<vA_IH
zH?w03E(Lcd{iLf}ci(o?BJ>o+aoKRm>I(W<KJIUVS{`1=D4U%;73pqsgQD>X=?PLP
zfVCrFQW=T^$IU4@gL&gxdH*j#AwaL-&dAuZWelS;vq%f;mUmjC3X$$N7Ou`9mD+a$
z9WRBa^O=|)p`ebUtRggP8j@Hc{#hL^oZKqCQ1k1}V3NF~^E9A)Fg7^k-O15_am6I%
zK>0dg{oa7yANl%u{Gl(@4r%AMfxpx<4~opw9m`JqHe=oG?1TF0JJL2~4@SW-MlNds
z@)?C$l`7;@*P1MPmP6JaS7+xh?dEDH@ui6~TmEr2JjCmimIt9e>x`Sn&ja9s;}X^#
zu3NnZZ#xf2f!WDQ;hyMI$9eRJJU%lMNAs+PVP#;f&Cx)uw*NMaT40k0cN4g{Fma2M
zZLk(c_TNeHvuc^&&GHk^o-p-gBoFIHrgmnN+^9|Atyf}4k+ccjld^({PH^7Pa(aH$
zlNJc>%S5*vmEfD>Ef4d>8zijd^r|Eo`DjW=inH`h7);@gQTzFh81s%8%h>C>bsd=4
z+L|bs@&!{fu5eQ5y7|-`Xe6#sQ+Ft0{_D6HQ0J8_n0E79vPn`vi~-v?n2kB)lHun-
z!|>Dem-4oV_6dH6{eYY*<rFe4wK`1Gt=eMzj4}Z;7X8aPo7L-pP6HC;PrwmW8Tj1N
zCgp*BX<5uTBw|fcpOuKy65aZ$NVu$waVGKIVX{QDukI7k#hh$Z$poB(-VtvIiXQo~
zX=ahRMxDqXhr%qz148Xe9w(YhB4*Nb!7K4Ch$UH4kyc6DO-Ys+CE_v-KqcXx6GGwk
zFs;u|v1=RZjU87NX~=ZzEh}ubeN5*SBN@-tOtYA}n<C*p1j>Ap0N(f1LuMLVW~K~I
z9~cj`KR<EoX{x<a=rDQhQ=04$WllXgGmMke{*}het+(J&eqeL!hry^c@(%u7&zo7(
z)BZOu+p__cE|fp3WPOKE(=+TDD=4x5vh6iLwKY;Y+hrN8a(_>LBG`znhtuWuICVjU
zbMS!=*CES8<J{EwQ4fRb+cm#)xfFJC|0of8<><)4g-9D4?#S=&=H~AjLv8h{{9LQB
zCAHlo+9eiDXou<^LoWA*dach-^w5ef$t0$Bi`Gu$zigsgWOrKrLAzf-I4Sk2y`4Bk
z<Uu>p<5E8Inj+(d5c9f5J(k|as+c2ruME)OFtaUwt|(8iwS!pGP`|x(Ph^>P)e(Y4
z9#m@wUZQ725p&J7&^DLbX*HaQ{8sXPy6eT@5c8X2^@Y!OZ{d7;aZwqrt1bPMnjdE`
z(r?6-CUzn9Mx5ij4#XZl)TJS2cYSpe;!4}o#FTQdYZ+VC;AV1Sc2p4CILPfxk`s6y
z&YqYZ>&~o#Skh&@e2kVw7t=Oqr#qY$c$V|G=d9ewf%jv&aQ?>~0%_)o8^lwqCoK^7
zlesV?0HVOhbL$(>ie*YGG0AEN=jH7(%3vFr4aXEp#B)>Qu!OF#nK$e{aIye-7X1&J
zkX?_>)R_~qm2KHlo}8V@^kfms((uAVu|NgI3}o(njoA-}L+X_+S(;45#h+WHL>B%z
zPQ#Ap2|ZA?R&n^3i;daCwmSfA{`u=za?^qGe==3igb2Rq(_L2E<UCe1{AU>?bZ4nR
zL4DdeR6Ilnxmi(k^#3mlfDp;5Z+Wp<1r**?_vm?nU8MN!<8@{XxRzU|HDnk^%l+k(
z8Css&bB1frduv?B*LZZ%g3>d(g2`Ai{PQIDS06V+`4rb(<zyx=uvF4Gp>uduEYTbn
zmIXSGNgUwv<0p8iqs^7SWMjojA+g<`XUp`3rUlmI_~kLF@9*Ut3*(lZ{}cZfiBB7?
zYS;BSQ2sBpwuMIszWutymt##?`?Y4_(F@{Jz0a(xjZ#PJIY&^Y<A!49iA<w`r$#aR
z$tIbU>%!J9{HyVt`05`TYmYKj7ZCf$gyg12&^u@F5~N@spL{TPehOtG5hTz!EClID
z<pydUCu`xIE=Zg%*T@Z|urSeALZyp*>jh69TMpRRz{7hZ)kS6=Wsew#HHO8ah79?a
zdc&t8#ZQ+nua!0Yb03`-8^_xU+m8?Z6(4-SEdH{5q!C>rmERt9?%nU}mJN_^^}0R-
z{S5V<Q*H`u9XbVjF4JmYleX)(tx&;{qX#aJ?G%Gka`mPYN;i~K+ElxBW`zsfI2Re^
z6t>pJB+j|2#c|J_KNoI-+P7gdY#O2&IZmxn4_E3fx2e~QYt_W$?{jJSbE0O?X=Xje
zp0heFfu-q|5B8opP{A9;CqaAuvlol`E3;}&OEb*Ni5FhaZ?=8-A@mT5!f|43XxC<o
z=(CIWCx^N1lYB1}*=V6giwKAO9-p@L*u5s(WiTwA`0>uKU;MuNKt-;tjflRvV(7Gq
zXVn$(ac4Z0r}N&l^<EJJpTgEOob50R3CE1sO)X@&@Gq+U2EqAK#JTKYAbEbN!A6}n
z?C#%{*fBO7HILiRJI!QEbn&_7ua0XI_yP&#ppWJ|s;D>rlP8tQrJ^Jhbr*sd@<0={
zftdF3+1MG4EdqW1Mupx);EH3DC?<(N>S1T;P8Ed7B!c(7P@TJ--imHU4DOu0uheIX
zbQHvRX;eZWHG%YfUt8+iNf9%d_}shs(QopVzU5Or`%dE~ZkU$WnPgVduUy7o)*$i!
zVj6|kvZ7*R$|AlT;xqTi9o=2rWX7y#x>ch+^7N~l9%amqc9OS;P3zED7N*YniEo+w
zNnd{Sml0-WtY%JIZ!s?Mb;Pn10!W92!4=|B)wU*w*m&j*r=BJwml0Li%Dz#f0S}Lw
zLPLdP50sdLmj_JGgkP>Tw6Usb=nmd+4*-56fu6U4j4IFbPJ&RS^UnQkv@4sY`$KLC
z)<@d%{VMPRP^IPV7x%emgHfg3W$pz=7dJ-+;UXvYccdo_xpJ~`nTNXRL2=((!O4o;
zK{0--v|I4~Vk3Rq4Q%zG9i#NDQ~x<}*uLGu1$2DI(%_a@Z?B>`X+(-qboX<B1qH9&
zKV)Mdq%%eDryU<{a4Aapsp#81yz4l&|4P99?!tMgzgM~w?myP7?y1n{snkZNn9&b$
zhb4a3r~u}o6)KmnGn@|+nPT~}i=Qr;5F+Wl^xY+XsVMa}&f#8x55V2}%_?fOhHHvV
zCXsYek>ntYp?Asr`T@bQ3>wh{z2<=9=spNFSK>YQxv{T1!^pL7qM?<mlp@()RS(+!
zJ8fL8N#1r<x#TH%N6F2|lm53N{wckP`s&+IkBxfK!6tJ5M=`v!NGKc09^T2&cEu;l
z=Zod8x~J!(r`)iMeoJzNa)G0^JsjBofKXxMNX8oZuO<l};v&zJO7A97T|N{)z)AZV
z%SU=U@Y%hVO;<J-ADyt7BB}|sNpw3cYPYq?bnV9jKxuqK%G(e6E@^jt?9hUAG7GFQ
z?W_YF75;O592LWfK9@UIY9tjVy`S=d9_tGBfU1LMA2^8KY}qQ1+WQ1?OK_C=2Oj$@
zh2XyTJk)K`=U<B$;)DJ#T-~4i)pIT@^?#Z&%)ORQyhU5<`evil%tnRG-q!W?r}zwl
z{%j9@?02%P`m-G%((o~>C|QbVYcI0D50(%kZ0Wio%@SK^rID2jCNiA4)4iZ_GEI{-
z`b_a>3r?=i_qlv#_XaRnM%D}N>yS+p=(TtsR8^W}{W-tPGc!?`bb4Y}%guxLnExTa
z|1TeHvF^0abG>;6dV9KhiZd`B9?Sb_F@H&lA4?~H=wm~rTUxN)GU=>TyPyKFn@l%+
z>VX>usdtL);kI>$l)elS%cbaV6Lqi+34)>j!xvgn8K-nwoyY3#J~KV17XX){wI9rW
zMs;D<!ri|^deoLrnH<h(oChg`jITaYe~Z{&8mX6#3w!+5(%3GInfXue?|-Mv{=0qu
zU#~Mb7|#bLuip~c)O@yvO*d=Xqr;M*$2Cwn7x5srInPmJE5L_yef7BbMnGtM$BQqL
ztn+{ruD3$e9w!+bl%DFd4sJWmuni7zRW$7XUSR+KK>`1MahgYp4iq`JB|d+{33>fA
zdZ)s&%&UHwN4BkxO#N-!RI*&^P96}TGJ_q~Pz7)MvHJ9><5>zIJ*4y#MeS{84Ct6y
zy$9<W_UOw5Qn6-3HOG@XSm0Fl_kUIp|5$~8Ke{6wV^QNwZ<22^Jd4~<x*mlYfx}Uv
zZ$g5iUW6t|5x!`qTbt)G;QT3#|0?aZ!9?Fr%Vf2b{)0lMSPnkswUPSAom!4R`GPd%
z&_DH$%6yN=|FmBGFRMw1@;~e@chBSgyT4#}b`n|8o^kO4ssb^DOh+Z6Z!E6@ZOqy4
zkrL^1$@ZO;NTNA0pP*CStqX?~<JIf-^7#gQ`%a&Q697-$7LuqHXaC{p_+P&1-@kZ>
zC=eB86Yf9J-8$V7*;MrS>pvlSKD1w>|B8kd8Jq>qAl~{Ih#>u8$QJ>ps5Ts2|9y-x
z?GyF)O2yZs7kS(BD)&VSL>7A`@Q3<p;s3N`<EUY(qbs=Z<)bn|*QO?tRpHc{#a<So
z9vvB9jc4-Cz32rxwQa;Lu?&$D%%n9*$zoqmNI!8xDPCF_Ub=BG=Ww>R>2~2^{a>j5
zf{@?q!~UoCFx)C!<>X#Z!1kBbae9PLZ`JUmh)l%^gh1i+W1A1q2HsJbg}w_+x}3Tf
zvlsh?Z3BLib<p81rfYRzT)=Om7`O*|2TLG9Q(9L;I}|f|oyi}#*mMR|oh1qT%Nf6i
z6TFIG_0JWChD~D$j4Vrlw)y>Z?At|4Bfh67?DTh&scgB&UC%Gmw^*oDas-_}#|Nwb
z;^PFSuq|;%?veD*tBel2S?hB&F(upo>ioK#XJYhR-8}djgPBS&QA2!b%?E!ZNxx)D
zn8W%}W6@*1CmjTeID1g!hYq{mh-`>1I&?iH($YqkyV{_Y0_v+26hi8Sc)I-l92JDv
z6bR*NSQL-!4Hm0QR|pNS8;pD}g4p^W3N~qU7?f#LpYYJi%>Utk8go|xlFaY$ZTt>S
z=*%r0soyiRIB9RnHgl+Jze;ZR8edKZD?g73#2pKrDahWiN-iHAxnx&Vb}G9cblO+6
zFF@qpr<RaynxAlW91mDcE8N(Y3Zxf&k3E!LCPNv7+5<dKb?>io#~_GZ{Zi<{pRCBE
z8wI}o!>$0M$NIQ-vEJiPw{3KfxOz&xNh#G8cPwH$abqMzh)m3G6Ow*V_doqNH=tla
zk|G6uHz)1(eygN<4!ZG?%`p@3ej!t&%YQt?L>I#pIK(}AL%M7+U8Hm|EJHq&^Z-eA
z=!Ai0mAu;k(FTH8aXL?7Q7J8xLJTTn8K=TinN5cu_KZ9uY*$+~fw~X*Q3NY8!cRNB
zBn=%q7OA6l4aD*$w8>5O%XDwvy^piZ&7f7MSDA87_rN;f+$Zybobc@Y2`e^dY%@u0
z)7J|{-H(rR2Xo<qTZtLv>ZO}nJWs<?xq25{BlQ}bLq3%n8NgLzfPJ+`*i4CUL*!m>
ztK22G^CoTTaOk?fhtusEr#5^<!K^ma&_^!&?Rdco?)(tct!o%4Pc#WU#!83lzAU+$
z;xylLBggJ~pR#~ZohrNasyn(I*R?nJ3W);Ca&X<Xf7{u|sb6zmp^%ZQ(BwpKTk8Fi
zCArtvT@tI$<#q6^_6$$ouI_yE?#I2Izy9*=1Ovs)^Qb5Skc^?fTf}><R~@-)GX3Rj
zN=1h`i>IxF<<)Jf)^qkW{;=~f63@?Ae(2Rhs}j%=NLRIoo5T{2&7#;u+nH(fg8{&=
zP5&>xcU1mCbcNjI_`Gf}hx?Jv&Ur-k+2Ch2o6$`&oEZP!e!i5D<R$x~lacFiNOK9l
z$!dMga^25j)uC&+7ehG-E{G0uKmrj-kJm!ly)K9Ua@_rFEK@Kp${fTVhsPZm3*+@F
zHHC-MbNa0JD%(_$94|1Ofr%4)YNhSd`+Y6u7rNZ!;Ns_de_>IleZ41mDcO#ZX<t@v
z^ww;6i5wWWmy^w+vfpM5AzXNZW7=xP1JUqFX`@>$+;)G~q6Ij~fWNOx;dp#9ysa@B
zb0T1VeW>}Dsep6Jr>SrT^t)vt#?Fln$f0x_EOklhelE_*y5xS$keXacVW;~kPDLap
z+JXmAMF&^Li=G^UKen7L<f~t&;Z2SRRq5304klPH-7KU@nVxtnAvk;7ZLF#3j@r(4
z`Uqm+$9Z3kSCQ(D2sm`m6}mFp&iqQ=nLelGMi*wijqVV@u}2Q^4D3Z0QG=_g%rbZ^
zyRh0j``IRF=Z)quV4$I@>l|;Mo>J8xjzpz%U7Dne@Z79TYegP4&ooFxHh22RCt4ot
zDYz;5aoJbr9>9Lvz>^XT8Y`AES9wq1_loTf9P$)66&-)XsDGS5kxrh&r8U^Ahy9Vt
zX#}3}-9e4`mr=Wllxt@F{Nu-%ueF#sNnmlVuj0TOr{rH!{*$eD>ZdYwsr3h=ZSSi>
zm&q<!{zfaJSOs@6k=##q?nN|EVF*gs{7?jaE~CdM8)}*NLh{_O`>@O(U?HF*h<CC1
zd{XgVLh`>CEx(_cUpdAgwbQ0Fo<)cIA!S~(IK_|+^WuaKiRN;G9g9e+_$rtuz70E=
zddcRaU&Pyc1G=PJob%jp9H2W*zDdNXA1D>y+9WYxhhaKIZ`tmYgKIxcH@*AANxIdH
zwN-)Ig;rEN%$i-FY$;h+2%biH-M#dsb^r4`nTa~z52OnZ$|*PtEpvCV>Gf|G8rTjW
zKEZ|zA4AnL`6K?~amA8^P|=i_R{8F(z2gw=R9{ZSx$TOG#;r_CkwOal-FJjT9(ziu
zSbp8NSEtPDABICoG>-|arhkT!RP9LnN3Umt)~K7GoGDw3yq$o8Wt*fd$?Z%Px6b(w
zKZN0|HmLH}*s5xWqfaCMOC>l?0zDbpq~%TyU6B~He=?sQi00UiN8AFNyPZ#~*pS{&
z7d~a{l!EzBRz23<Bl$3=Q69y+OmuvfDIs-+1Ms|{?B<RnUw-hfX;LdGPmht)=0Of{
zRgzxWT!ONE4)gP_4G;UD&vNzd***$QF)Riy%N_^RM!@sZnPxDNj6Ipl3NlD8cMwCw
z7ZMI1E245!B|0F=sOH~AM!Ey%0X%T9r@si(H)*x7!cKQ4jYPdM2!7(wkjq8VHGuJH
zrG|Z=gq8}$WKXnR%D#g6eX8y~1w$oRuNx}bEH)qcUJZw7Xi=R6->%1Ftoi6Itt?Xf
zBsfgJI7?hin7|xUtTW#9uP_Bv^>C>H&QIqKSpABpsS_$thm^vH+LqjsedSFbATM`z
z-{2=Fz?~#XQxi;8tzz7^;Y!WgJ>0Y_4y{GMdJoU2zsn!55>v%0b{HAz-?f*XfbLZ~
zno!s}XRZs^1@mH@;E70+3Lo0Wz*<8M^I8dj@xxZRBnb>5edr;=JHKUF1&#nOxQBt!
zONfE8>&;i6Ur$Z*cE<yJLmP1a|0dFQj)Csz1EiBSuFcP_2mHXb-an|%#I#5lIZfsl
z)*6AihPyLo-B2Kt`xDe`$R%^ZDc0BK@O0Ccs62~Y(s=RnCZ9{bvzVICE9D^Rwo3V`
zkm?6KaK?T6my!RtE*dx=W6h<noxH1jKGTh(LAS6R`}<;Jv_G*FUgt-d5hJh48M~<&
ztjoT0Js*YH<-bl2q%RC2Hss}=nxzQY^^+aHmGZPj%<?t?4JqV*%^%ffFL4suc@&dw
zj(M0Xy|EdQ{^@n}7kD*b&?8`4*|QjKyiGy+TylPvlF8}1!E{38cX8iN=M^DQ68zDd
z4p5yPv6ms}-pEmsYjgOkwIaL7!H%XHhsw7Wf#WklP>esO$^znV*Zb=1_VDy;?exBQ
z#21QTycfFZMGCDiyU{GPy1=6v{t21^y87^ju`>b%*ML$6YphVm6qYn|sSGQNx*^4|
zZ%e7OTj}}-zWbrDJvjQDJTt^ZpRKksNvEBB1IORt1}OU2N#CJDF`)4xzx|k_C1s@M
z3MdtS1SrpJ!WCkyx?(6-A4Z-@?Gc-PT(RDIO>`Vi34(ipCUmyY_UjW->2jR^b{w^t
zO<&%4gi~k#vZD)`2|)n3eKELxI)oquO{Ux%R;2W58>i3C%QwjS`3^`p!x;jAWaD0O
zZrY~sO0BZ;-(0KR96LCt9!>9Yyrfmt$@)boN+2+!fe2~xI`BYcbVepOe%He-?$sN!
zI|&-6ET=iX^T$0SZM7UfI8J!TN*F6}{fpD$BvxdAB~&K{Bc1o?Kq}^re`l(9tCg=~
z=#-2hwo{`Gh+~P&bKb3^CIKle(?wqc6vvmNR~Y%b)lvsX1pMy3Kr=<ydToNe89kpe
zP}x%J>@ZhT<a=@cz$yeqjBHiiCYyPbX{EW4So>=ri0XL83bU%CUHo8nfMRmHjbTH=
zj@r#B{=k!x(<{BoX5fwPYB6UsqYpIdGCU>skEIS~f%rf=89Le;-S}_l3E!p++{0I?
z+s-zrbwkY5+B+=+dYr-4?Vdj(g6oy?@*S6R#H`49Q_;wA`yFADv#SDQLMG|RI!mJT
z)^Uy5-ot1-C%-<@pO)D;B*FP&r*sN!giA8f)_Xtn!Vv2dIbkD;liH=n!^p|U{W~sR
zb+Ym|+Fnz2cKCc(HPl-Ng1H&3bsMnK*wNsnXNL-n*+LTrq211~t!>QsnO+wmZF;9T
zxZ4aTeCXo)Pd1BDBid?aAiMpl;?kNm*5d=@XbUok0bRMz{vvp0anZ-_T;F<M!~gip
ze11iwoB$3j_0U4<RZIv4ti#)jarlgf?=J5x$ww*WMX48K4+OG~G96O<4ldLOmKsE4
zVL`uK!dyJM<xy+Qv0vYBU8?M`(zZ_11`j7DT6#T3(2u@o7})LD;z0oU^dzP0v~K=H
zN4O<fY~X2g;s+$~9^GT_WmWe<sqx?|TfusXM5v-mb*e~-I9pR7<wU>!`)~8B)!>~v
z4&0qzTb8XQ-e{Re)=_-t$W!pdB$j-7#pz_?N#wbM)Fj4jx>w9y{&2ss&7z@prMS=)
z7oBk^#vw}-QzL&!C#U#2IJxyz=rb}wua$^d(y)~^vhdeFUX)Ome;&+lUkzwNA1&o!
zst${w=7+BD&jm`dbTIYpM`%l^N{A6xZ98lGW!IuM$H)gq(G{wcz|3<LdNwQRIbE`z
zedi*<QHj=&mR(WiY@06NiY!IZ;5f7u_>>aMEpt@-mqoP23MdJ=@)I4d{etF@IG)KP
z*D=7};{gfs5g7g473YV7pYnt*dxCMBH2qycj25R$uYoEj+Tx%C8XHF|e<RH8XDvup
z7g{)mIZPKPYQ)%5Z#ax6Ecj6BgDkA8$5qXSQSP>m#-kO#WtsAMJ;kSunLgLMRhPai
zcLw`hrs3FkKkxzJsJu(!Zc6wrF1v5f)<Ak(Mi9>(T-^*<azCY=WQez(OFx>g9F@#^
zE}a9#1!E!|4DF6*CQlJFXv@hA(_U0Rx`(vq7icEpoveVInY&~7Zob`Joc72!8~Htr
zs~zu~6+9V4uhhXEze0vfzaUuEunv#41kOqR`4GzbNwp)HoPLI4yx7DO%OqYI<O!ba
ziGEszQI=VIk2zbG%sHn!p3gQ1EAsBQvMt(m1_cFdqq*rMyy9|(va*+}?aH;nd>nFt
znhf7IOu`0{#Pz9v*-rPzgSAVkX0pddk}YQn2SwfPKQ8L{;E-{^qrs|zCCRva0}@hk
zN!d@{$zLFXu#V)B1oTCtNaiN3R`b1z72D?xrn}Ywqm$+rKe5|8-5fbkYi6!3K;KlI
zv*u9P!}VU$QOv>aI;yd|1`LK!E_0%BB=2x5)s0vxQrTS0z4h6L-|Vz)KHV3S^Oc(z
zojB7fiA>*__jo$#q&uVIi)1&#Ux14-X?31UcaK@c%xU0ss3X4f$~pbOwfw<15T4(F
zc7$0p>K|#SmJyKEXLnIumglFD#4FCKG{M_3+r5!qdYIL8JD*C%cY*CP>e!U|JU99<
zAtvgY8^cEs3bJ=I)~2w!QtSOlRBRHD+eP!8`O8z8U7;o%3_4`T^|J}R>b8o-=mX5(
z>a$y!olb>SHvu)~rWPZ9xBNkO;ncCtry3N9wSu9NkUt)2nfh>_^{QLzB=$uPE`2q#
zA&m!j>uQT(bH0}z4|1XmghfEExMMMTdZxQMOfLahzTM0(M?G+bw7_2H*wblKkaYX<
z)K#Y5l8on^@3J)HVjt&n)ulmB^>B-4TlEA!=I2p5Wh#Q%<tZpK?yZvUq4|;i!BlI6
z@AH#2DTZEAmWFY{F{go(aaClD0E~twu=g;$<fD`OWDV@F%AzuJ-{N8va&+%j=cYyX
zkar#8_>X-o^6r1lNqBK+Byf==ixaMo@IP}B&I?VWK?)wx!qLV0AmmF6tjcwV*WSP<
zqNpZzizlcOJ{)Vrdxe>nIU}-RqhRDdXC9||nWIF*S;rI(?#0Z(RLgF?_5g%q#?#$d
z^pCKoLky=kqqrO!mJdrsM$+D}0|Rw*6*Fr9rlofT4M{!EMabkO!eSDSI<ylm=5N2f
zMFbjo6r+-{8|DCExE^Dk&SE2ZS{2%Kqn$8uM#fU-X_nb!SD`tbQr*ygHnz`O<?Y5V
z!)kVNz+1kK^wb_KMpx~w=T!H~=O)Nb9O-$0u;z(o*nnPPj;=>6$(l$v>EPSzpTxbM
z$u^KUn2;-jFGG`S?!}tV9$M2*&QYQY-?&bc$?W63Wo}=D>Bqqigjc1}4TK5{TFgef
zvX0b<+2X7)bGO(#t$t_Mm3@;ch~Li>qLr?;R&Q;bYO4rSzaF__-ci0G()yx)%StRZ
z?Ga(V2h|pUpR^hB_x?{Q1FFtsk(X6Mh%FC6lF~KdKrJ~QUuO_GrA>E$(rTJ3dubue
zSm2g`!ed>aUk72ElgLI{pC4{0r4i5V?jhyd8p=zD@|?0&IJkt)s35)`G0U^qT8NKv
z?8*LJK{y>gL8Fb3Q{Gv!SMGyvMB(k!CQ4k7y%I^{tUbnv%ke$|mj@XMkcqh}sE%`r
ztbZmkZv8^PY{P6m)$P!dcvNo%L?MX3mWw|#>C##USa$m=-8K{)Nhs@A5uWS&sA?$|
zGfN#rZg$2MsGo~ZnY-@$ggcK8K%~%)roIw0I>Um6nuZx|GV+UkJ3>Kf5#hEyn_c0O
zBrhPxVbeiQG^;2xP8MS{;egNU0lGsR8MD6%0@fZeoZz<fQ-c5+?u*Xw))<p~e%UR=
zQ*tIhA9u&ZaP5d)bM-0LTnh^~mB43%$8iZ)j+Y6xuQq;7Pr5QuY9I6jlDpAl-+bXw
zR!0Yx`Oie)F!#7n8;8?!A$D0@m9rn}r6IrDNzL`213p%`;B)F%R!`2Hzt3Ik9P`}~
z3-h}bmLR#=eaKo@q$48qA#m_w<z~IVZz=LmDR*>R$;)c)O^jmigXjPKL!bTdYCxrE
zhg=hJ?V@@^q?B_N>W7zPa{*$l!r`6$CK^iR1PE9y3E^VM*~NbwudqF2bI*cd$td#y
zgWazRjrl(^LH4Nttn&rb|B3|B{!RqnUg)owl08l3&e9%=7<3l&{Q`1I05J}QiCk5^
z9CMd!j0fRZDXbWz3rsl!Z&<0m=Q^d-M=8jjy~1>@6u64hy57!>&cLjoUo1dZFvUS4
z$$b&}HR6<HQU)SrJwB+a_rxllnxm)FB6PdIqFZ(};6$Qhw=!32BeI9m2$(%8v<fBy
zHA+b|`I4>I4&}H0B#=a@`ba?`6PtUeZ*3eHdTp(Y!12qp(0ao1>nHMp*P}zVM8Q+N
zZUJn}PoV@{CI`1FB2OP=$X&7`dx~iQzqG@1iZh=(Dl=;-F+0CeYW!vI?nNVL5I{Td
znH`RJt+pA6@r@oo#aZpNU<Iu*k8>cIyxS1mEM&W&58XsCSZRHh4YIzcXk5m#maI<2
zo7yw*qO!)38y&y(tP;%^$I_S5yZ(v%${Ka|9Z?TW{EGzf?xcRMs4`pU_1_zI*}vO8
z8)j#Pv>(t5NVLm5+<NU99Yb&645YyG1R`U12KrloF!A$K5v)T88uP}L!z8~~MHu!w
zUJJ;dSzkzP8+W%{-NmmtWHQo9(_1+#m8yTZf@Vx<b8&KE5p!o2^v;9EHp#*~{lGCN
zAFoAwgTqi?zbuOBR*P0}8kc#X(qKoY#nek2@TeeBMa}ksaKao7hp!Jl6T<33ZD7GX
zUE5GZi+*Y>`3)>8zkt2f_J#Y;HIHl}o)#sF^Y|Dkfp2yi6i_maa-#~@mPzv<uq_v@
z#W@PvVwxgFX?hgVLa{;*!e<VH$X@)rGgTb3IZ%_PGjZXc$*|bYbtSdU`V3^gm7tIA
zwI*vnI#=}tm`ZY&vt;=v6XddD*HlQV7os>AnL2fLxx>v9Wzp%%<KWS$tGwg&VJ|GX
zMo%#T3LnuI{5I6W(fHH#Hx}8vtO5m}`V_B;eGSCjqExhN>%Gc#0y!DfDi+u;ZZfNB
z_n~IFw4ysrUsrXsRHJa8v*m7xt-X5q{%fOFRCGfmBH%gj<$8F*4mlT^--9DNH|T2E
z##}=AUS&k72{>I3EuB7W;Ixat-+u)S3(Xg`FyE~~)yJ6({2ZYvng-Wt#6-|u3=O6e
z^ZX6CDWCq&e4DIgXhS%>#H_$FX0SQhy`DXENLc3UsJGV$DKu36i$9aLgyc#L>0gR{
zwJ^rzauvleh*{TJMa{DRgKR0=D0Cg{)(*wtHZi3pq}*x?(1vsFG7H*d6P(2&A8gC|
zx(83K8@R`m9Z>>er%E=cUW2Am(TL{+y1L@rl5!Pm-u3rj=#S&mm`}q)5wKHosGEC?
zsoQmD?J+Byk7k<x=!C*9MpYQ(a?IVZn#4y3oU6J?*}E!Lg?OpM^Mk*WU@OU=s!4S3
zc~M|`B>8`daLHOX*0X+W#LnC+cjGk|!P{(%pa8`6CTTEM;7w{Lh@(T$<>2R$Wnr|c
z^E9_bT`Q$}nO5hB$y$j$Zu-+gZ&h?N^QPBk?CiI_kzIqkQw!7XRLyb#f87d%4O3+p
z%6N(-%ju;s?E1J^_t>^%=a$`{TSzM~-4%QBD3Z@9xlRkcku?|@=QPOgb8jWkCbiZ7
z+F8jmA+oK<n@&sT$4%Nz<(Uj6;|i2z@v<Vs@9R3)LLIeM7?kRL)o|56`&KdyvN!L_
zYv%PdNKQP{(^x<q8clHNre+}V)-1c-dUnEHYLM|_DZz8ihk2CpN3Epc#YJAhsRTs;
zn?|G&^AEN^KIYS%C77{q>h4j(?tH9oqIl)VX5pFJiS{dh&-Oey)-lifs2l3F2y=0x
z(;tcC5{Ordp6J7_PtElc!s|MBlYZ{Sv+R==y^t;xm<uI#w?F*G-B&NB@&6cm>$s-h
z{eRd%Km|r94Wk4>0TJn#lz<2rNOwwi$0SFOkdl~+h|)-RZy+&3y1QeH*kG`Gp5Hm=
z{(ipqeLm;+=X-lRcI~>}uYA6q*X#9o(cDRU>E@*2SM)<)+CO(8M51r`JTA9_EM^(`
zk1*t;!s84$rn3$dv+19*&6Iy#msyf|BK9n3`efF7K5QQP2MrY%9Ho2Vgf(xWqCH(C
z*%u#I8|wKKcQ)rVbY2r=@N%|r=W~fd(93OGlP?xP+alS;Nh~teXXaIz?RQWPmGkRY
z{6i=u;Qy+T5$<xf#>Yxsh@oHy`IStUcjHs4IXfq-VpRT5^Cb~#Iu?rdtlZ5z&+nzC
zm4V+4u2w|oGNKGK2j3Bzdg0E@EWGl93ONZKrg*7L6*At8w$l~11#c~vImSF2aEk-1
zf{qnV*^cA3ZjVLQCF*=2&6e~H@z@l(-|R8-%j`|X7iE@R(Vjz9nIbAp5PFB`^kzUh
zp_otfWpiR#GxGdFmCt}~ts8if-&xuFcq>KqCV7!m|GJ>x<}YLaRd1rtEmr})<-_g!
z9Bv)zZ)dpWbYCvDP}#pW6fsTAWXd>cC6XW@A1j7cY{yo>*_o1_Y)2NV=q`&%HyvzG
zhM^r{?8~bqj1+XR<Ls{5{Kd&Us5z0!^3EyYB8S1!WhgI3+Y|OkE-Ek}QD8W()uGN;
zKCh09s{tWWPn5YHyRY|$L7&d;kPuNN*h#zFcJ`qb*ld!UxmG+D6jT=5T^3R)owW&l
z)~qWnK%>nYHC(Nrxo+^m=i!~)+7a&5Az>=Yl+6)tdwln{%ExyffySSDyGviXjm_v|
zY<1I@^smYDv5?^!^^7dqC|v7T^1}6g<h|%fY79xLe`q1r1{POj+_yvt4|rX6^7n%(
ze%wudPMPzAsCU?|W;Bh^VL`j*wvhd?R((*w+u5h6LP1dP%0SzAlriY^$f3?KZ6a-?
zS$My0rNqMrJnwt%x%s=PrLlAm^o2&{L!Eb<`~alPM3zQCloo?B99d^0cO@~U?fs?z
zig=U{<fb{;FUh=IOu7PVZ?+Wsrf_R%Tb!?Pz4p0YGoeL#PPWSu?@hi~p@oDuJ$rhG
zOs0Flq8+s7TlxAVBmWAfd|wFrcnqx+T+hLxio879CGhY^SN5^U1HSm*^N&pEmC>uy
z51gz3)wP=KB5~?DpP>c}LDvJ@x+qG#*$9^aBb~LA@1V8WKkY*U!?1zHhR32}i_}&3
z@k<q&o}>MYb<YBOl*8vua3jty$GJs=!&*FO;8A~=S<Xb!tnNt|1m4?U{^H+-Z;Tjc
z0;*-HB@zF%zXvn^0?PTElu3?B7!vbC;Wsx;Og<T&(Wr3d7f*KRA-fk9qpfe<w}F;|
zAbv>#SI3^H%(Rmuz2BQsG^_)`-poI_K)SR@=m_9pn-FC^yT###AsMIoliFdPJ~@of
z8zUH5qtk)nC195J!ywA?xt%fpvMl$x@BzH__K6I&?6(#ZboQBCVE62GS_2G3DVi7c
zyZVh_ReNRz?W<tt*O7Fx(f#rV4zsoSD^^z7O8Hg1v%<86wPdXT%d1^?g5NcKU$GjX
zdu;YFj!Dd!rY0inQ<zV?+as}SlRaziF|EgW&HCgO%nYxcX1;$OF55J^$wjkrz2P^f
zZezLh8CnzM#bmE1fvL*_HeNhi8n&Ey_H?lE{3P>R!SyMMdv`3pURC>;OhxXx%4|$f
zhSHX^*Q$8I>|Pqq1y|qJZ{FMwS}x$TVzgV*CTISRvutsBlL^k0g_NASx)lzrpFs=C
zo~W4HMd=fI#aAH|JG_trrnu>?CmybtYt|jYMFw>?q%%?<t6a6=m*1kaDYa7^ICS#-
zb}<o#y8C7su`$<ZiayvH{9)yXbD)k~0|w`eYsy~`c=<oRg$Ac&%reAGq|r4cYzFoT
z00Z;C)`!y<WNtT=D6ZI-HZmjI&ks<LeF-``*rxxYpdR#rmEj9!&~Q_WE-w#_D3{dp
z9@B?9fjT@r9=^1-ZMJg-xtW9X1cY1G`MgIxl~X8QbYv{xdE}vNK6Ru89AUY~(Ou!u
z!%?Sq5t#|JQZW#9=m0tKwcWV2@2EHX9vLRv^9?o-7<^)(qA#^^PFW#yPVUYWzt|wb
zN5BYx8<uytL<9sjY#JXBDt~KBF7EGvCh%+BT^u9`ZKg*;!GQTL$>tTUpZ=+sY{aVO
zvUPE`lE7Gjj`16zUAv!u5d9~6Q7)&;!0UeAZpSn>NPwDWKrNHruYH5SKn+Zj*q1DF
z23L^|E(Rhg5+vES&%?I<TWLWat0H2xm)RO7H#!)rwh)2h6?%Dfk3N5v?vSd&k0_6C
z?B^ZR4fvwh+%J21=Ea^BY_DA3XWl0(WYJx0ml@1&i@JV|5jeNfu_T*v!+#2J|Nj5(
z(34B~NPsK%)j>w2Yr0oI76u0&CfeW%tC$8-I@<jhIL&6mPa%DmIvg1f9c-2ktvVGB
zu3a%-NQgft^-zKARQ;-ZhCI~6KItndW{rzRxT;G_GJoiw6ok0(3mzx4{sSV=<&*i&
zWv){-6aE6D2RdWRz)*JmOa!=*5{t5S2rjqZK>vnVez|9@f7j}M+*|pdgpMe~<pw6l
z{J63T!_{0&q8^$$x@}&7=*79Vx43)=`B0GdgNLHGw~JRMXgxj6LYya@)4-f@qvnN?
z`W}m+Y5l1#H(RY0o1cCu@2wYn>r}K*bmr&jSSZy~lUz@pDPeCU+RpSvtpsa&YDHi<
z2MrpH7u36>dDV8tb8{P7AlB0BMa4CCnYCc|y4GPg(Z+3Im#;}slKZHm7_z-_k>nc|
zm9nBh`=PJZZ<Af%u+7o&**m9Fz0|AjAG(`zgGBO4c*)v4Ak+^pMvZPfHYtATO7g10
zOF{Y1tU1KM{&%%L47%;yS?X}NSj^-&_eKp>nocbo+gTaLOS7Lsz`?B?RH}@UsNQ_*
zWl-zMU*kW{UAcKrcb`e@G5f%^A^)(!E={}MYNMG5%S?}?<>K+Qdh(%IHn<~cs;@&p
zq!sVQ^`&gtkimJ9qs^V7%WwU^?;YBC>bz8)t$TiCn!<e7F!pG3PQ%EetZgc7pujWo
zr2j0=;Q94?uPD2}+&ukuA{C7vt+Vr-B4BE^(?83%-A9fC?Z@kCibhU<Mp0{27QUHY
zd%b*eM(F!4<J8VwN-YX1utGmN9(APsv}sD&1hF)WEP9<Mm{zijhc;DQsVLZ*!+d$=
zP)<q3R9@Cl4%&9E3E`;z4vRL544zG&nC0j53iPU(2oC=8VF7$`(pSIZzdn~C6-K}B
zmm_SmU!}8yo^v1QYqZG@>=l%GJ-}1KOPbpT3rOGNxejd1kLMl58JcL7jPWE~(&dZ@
zE*>tSk!LctDv1(zYo#CZ)qGW=hf8!_FGV&DXFq>)K;|Z}Q!oi&#g)sMkMkIgJPdxh
zsfH+N{sQK>f^5Rr;i-{SwhUAQ7DvZDt8}o;IYv^ZF_;y@)xGh&_9U5y<MMY;f|{iP
z2Bh|Vtbw|v#QU285z<+N$w6kM>+|D5yUfdKA09=x6dxaMpNFWGo{~U1hKFf+U@n$J
zhj*o4JZSm`1#K;S5gg^xR)F2Ri!0h}iYkRtsP-Q!*ucELWP77T!t;D0-@u+cnUB~T
zIqr%t&kVdt9|S&WS%O!>1yc}sG=zf=bHTb8bE{4eO>(k(D#Pluc?LqH1=X$nQi~IO
zu*y$0HxRrM2a&n4e2aW6b8T_NN@qS*7FwF+VJ(ZF^g*v&4b})Ej457`7m;-)c9pr1
z_IP(TtGp@<lX9=yFPYw%Diq+YJy^}1vB63=qoi?r3vCgKq@-8b*@(j4Q&L`&UjRa$
z9zZDt51>br3&7A=Gbn{IP0$^wsR_2+fZo86n%Ka{1yyos+o(`H7prR&L%F%^3bZj%
zSX}$84tT~z)Ds@W1&<Q-XMUH=mc^+`1UMX5zeU4ktU)^hC6@|_>}6%w#t=niK}SCn
zj!q20W#I<?OzgmB2c6<E&q7|~z+HalOEt@*bsCRP=f@Xq0=pw-A?C5A?$gzdBirfA
z+pu%b-KkMx3g+}eMu+|1KYw^S&UF%BUP5Lk8mk<!=aKT@*6-zTj6Q$n<R{R_se3K)
zFD}ZUDAiH0^`1uc{0rf!CxWueXeRp=sdp!n4(AlRyN3YK&x+=Y=7E5E^`Z8$qh(*0
zmHi%BP_x~7gIDj`$#;{aG_p)_M1yvW^@$=n)oW<bWV=sn?Nm2;4J_Hb;5x);KhX#~
z7aIXTo+x3M{_W*7+NXW7eCi>q6{Ay!#GADo&yD%nO<Q7+o&))ACs|;cBte|F<H#><
z=R=5$_?EZ*WT1(`NvK%y=o{!A7643eIR!0Jm9Jm<GbZS=-^*d>>k!%`|82}2d~~7(
zU(lS;JO+op)aU;=l^fJ#bT<86^0GmFbV~bp-X0Lg_{Q~e6L-;poCjh3ieqj1FIM-(
z=iH}6s}1rs#_-wRTTMY|WN9-xb2|pT9GsZz7=VPHEu~4peoeZATHtuY3A?`T=ykCc
zK()OjT${z<GRWmPoqH_sS8DZP`YWYzow|V0r8koJWx73w82nMw?9r}wI6829(z<HR
z-ua!qQNXM0?cCp>eX%F=_HfaPJxBei=ef$Ur>LEof*;^!e#AL?HNXIMnkeex(ZAmi
za7k_iB4DkWi|AA2QK-aP^`!r4dA^^65ei*=2YQaA>BpU>%;SHp*)-bT-p2PH5aXK@
zf+;Z%*dNJ)IdwjQ!l@J@?tqGlEFU!e5#*<&q``2GLD#vD`$eQJnzHwiyPhE28>zxm
zGBeRvCo%lh>Ew)0B0)#hr{t`6UZ-5B%u}9Fmb-l1VNiZ{9>KzNc0evAjvPeLOHQe*
z$febw046@j?l=lF=J*fdbps7b7DvgZS+_OHl@i47Qzx;J&Xp<9$xFi-ZcD+-qQqm_
z7nO4+IJnQFGGGDJ>@Nkc;n4AAHb$e3z%vj$UY*PA2w!v|c4?*8ONQ?<0m6E#(|x~b
zwbgeO2~R>VZ=JsG2r_5%Tx;-4E*Bkpkok*6S>oKy%K|Z$z&1K1W~qG4&7~0Nl~8sZ
zmzKHSSq59LfZp=On&(D|Kt(Pz#DALz=4hcy?xbPS*e=XWDCj=3$wCSgVuZQ`7z}{~
z3s$0!J&`qT%K@Kh5I`(r1JAx)Rg2{F<<iGqm98>`j!;38V4e}|2V`zJ;zFl#-tuhI
zAzg<{%;Q4ae<q9WA>Cv4bwp>Ytw@XJ>s90VMr_~}218!p-LDC4DR7>MX0(`zZo`TD
z1O>~QioL}CgsVoTZ>pZ-N??tcq_YBg)jeYn>DzCu&b@(NZC)13@dKqjuXV#mkUdMq
zU?G*I`{=GuGvcSPl&lXWPX=&H?wZfe*#Bvz2ru_4VJd^%C$FB!1(DD~GS=i}T;U<C
zk4pCL5B55{DbJu(&M?<!u;iaZ-1nD<^825O2;ljZUORIK#?nB^U(*{MMbTVQ9-y}&
z^FK)}9l~A|D@IX%zjc+bCZT1CRUVaeI;S=tdpX-4ldqGvk9YhUc)7XIvJ!wV5FZm0
z<ZEJUyo`o{1JNbc&81knMVY-6CmKfOOK|^r2Mkr$IOH`}DXlEBJ`EFsfv2VSn9pJa
zPf^uPQU)X@9RUpfrAClS#oKo~+8Yi%dzgre?4^Go(~j6TApaEIe;DLe5cyS=FAJQu
z6&F@m<P`Qs4I|F>DAd5Sf{`~*ZF9WLd^vIgw;<u7GR5W^MJ>y9Gpcq%_$Is^f~lOW
zn7Lj(5uPJ^vQcIM{bZvTd7uFF+KCDeY&L2*(>JIJSRFmIT6H2Q7C%Fx>_`+=at5@|
zHAHpuA4~tk7d$1!F;S(bgE{ScBEicHUoB|=s1?qa6sMFLJJAD8zouLJQZzNp6e@7b
zVu)Rc*f~nQ-#$#lYvW5KZNml)r}*!K4mu}c_+SM)73cU+1YH;4a~y?%`N)8~PYwLO
zh#gpwlG-BHohxP`mVHB&R&<A<cQ=a8U_yC^EqIozi(QuR2`9Mo)H<5w(;(Dm$KpX6
z&>-r6p3y)5=>PCwpNxr~r^bFy1!v9RY;s@{9i{EX?J1A7xyaV2!|aI6q_aq=&rGv(
z`RJrXsUxz*Xg;gG5Itg_X!BUd4#^SGNFA;u$JfTb&7M#5N&X+d`wyA>mz(_OLxIw#
zSGZh~>>`|v40iFQ`=tmA_y@<vn{K@@8PN>|5}}xQnR+&x>-XVTuHH0pD2ppFJ!0>S
zO7Hx{B4jbVOlV6-O42uV`+pw!|6cLsjcaXhf8u-5Fj>TcRfheYiPXc=@QwkJmu?9v
z8x~MmIO&T_#X3_pc@@I~Fay%@piS&ZsBUnPP9o%Gyv!Lr(>#t<o`dNBxcC3RO%T5M
zP8W<?1@egD^*#cdX$4Z3c~vNzKet{nVt(Q`CAT9#7@^4;YnjkWx?D$YA-6;Q0L~#0
z=rF+n)}SD%+v(ud!04oys6D%q`IlJYe=imsL5azYc;Rpdzahl)0I!z>!n~yrSvT3_
zi3*JgO8B{x$mYWCVOz1<DR`z!+@7h*VY~Bc39^EHSD{1!=LAm(J;O<Z1N?!a<ZI(e
zRPjlFzZx;s_lwtc&rr}RIUc4ztN9rHmcZ-VYrh!$^7Szthgdb6L+A`Sb*gN8F!9rX
zHbYX^GNrP(=y|q)>z|}4s$Y@!`K-iBbX{E`^2oz&aDrU#{qZXQ`DF$BQGG9_j9BmU
z?R}2p=_=@6SpcbFb=Iz&GUDv}Kqq~|s=T(*3e2R$az(^)Y8+Ff)hZJtj}qypDIE?J
z5aPaQ@x@Tq>Bu;B3~^Z<43O3jl|^cr{I_=(`P4Do<siE4mG%<I;@*v=8xX7w3f9NJ
zrW$m1@XetzcfbGI`11yhyZjN9rE+(afd*3>p_N?%)Me|RhQa|}iyb+r$nE~$a9L3Y
zHxq|1Kv$+ef_Xjn?~j*{3S)qR1-)qd$1R(PPk=oU4<#c0=aI9oIYU<3Omikfh$3!6
zzhXEN(}O19x{t<pqGA>_r9D;;D_$sea+!2?w#?!56(*>Xo-hUz_!rZaBN{qGrM4sA
zL@lN>id1PdW?ki5PE?1*^J)fDrf3;neADP}TpH%f>BJ1s?F{UKtJG!sE4!{DD#op%
z@^&LFG)u-ChFw1_8KbcW40pj!t08CxO$n<^Nre=*Q6Z16CqWcc`LaFhNyyUL+0LoT
zi~{2EANfD%_sVk5r>NEV4O|0WlfMvJ{V-PWb{j=8KjEvnOaDS__9*U`nEyG2s4^t}
z28{VMWSA)q8{ppJw(ANr!`eSQz1mSN+;6x(Q}hJphAy?tT+h(mbwy~q%fxMu%Z!P>
zQBQH<Ps`l?Gd=mcxbZ-~7DC1*RnNL&tsk9I_`LYn=>xMd`hcEZ2|ZP~S+d1jx_k!f
zclP}Hzrkc8<y&XZ_MW$7nm2lYHxdIKepqSW|K7_Y7MkM1C$3?-{5}+V==;!QG%#Lk
zH3+Ho(ZA|VVc70h*%P~U9;tta^#r*M2C)PaltH#(fsf}lUXL3j{eT+hs9t))qi8Si
zh)%Bi5U9*dG=KuCBy{XB0IE5uuj=BIX;jhTv8%F`oI#YGX2_hl^c9=iZsLa!&6W1*
z6laybAK&s}@}I5}v0d?=-@amCbzCCqcl7R@z`x#|5!U>fW)dLlTkSA8>^14=Y~a3o
z9O&>}ef#V0-5NvZakARZON>R)?#TAbOvjUxvGZ1$n8z$5>mL56yJCM*75-t(y#ej%
zUGv-gjp;1D8$n8M7J<tRtO39Lc4zzNz^A)k$|EFW9#)6Nv5N35jwCpWEC+BW_#Uf5
zW&H2Sf16iD+{q}exP+g;;zTQ&yyw|B_Z#synWVgm;*OD9r}N;NHX!(&n4wgwvCrO*
z5MbB~WE0@X-ISk6*g7^4H$)=3kc8f4!Q&EWG$atlftxoPQ1w@Dz#7{EyeAz64ZOnN
zCe?dxkDU;(t?9fAWclfwZ=va}&vgy!dcLC~j>y^S3PQX5UnLEzm+d}J^ef-lu4j8j
z%U~xu##~E$i}WgLSHrt%0~;pSRl<IW_kXo_jdy6A)ULh+i>gm3C<cO7q#CgB!res3
zp1szR-Fnlr@neT+7VoOmVtt13rSFNH7wCrey*hL%G1{>rutu@^SmyG;vbWCV;Hu0n
zp-sBr;q1UNQVPr?wRUhl<|uCWVWkS46!z#gPWCZh9mV-7o&U)u&(5!2!H4yt+J;u-
z(`M_eqH&<7*jc35K$`!4{b)(^k~v6Od3tKw>0PE{Rnzf=Z*Th@Hr>)DY|yl0e*Z-y
zw*C_c_1k?nG5B;+;dI_;P(2z>CR|<BTUyto@ou0$v!r2|*w9Ok(O^PoB45WjGYHP$
z*m<ycg2@HsZNERRWt*%%U7qu(aCBJtp4f9a95YZJ4A26d#=9f!{V^h)1mtpAYNW4X
zVnkEgF3r%xOOkH;MOm!5{K4vCFGa(SQ&tPEd7)WsBavih>VcqY;Bc33YZF%*$zD^(
z0O<VpSN(lZrZ{cG^uc_Pa9JQK+-9dJh~U7=Ox)-UTs|x9{1!ex$5eP7nKeZd8bHlz
zS!Q{rpKArlviBV;wzN1l&i%?zQb&Is8K_x@1r9sap*~7l&=f3~bss(`wx-Jl`}w^e
z8w`vO!0u-Z`)?8`_D_u8Y>in68u%o3?Y5kss<Z$}sR2u8=QBCJTPRfY1D?OAW()r{
z2|VdIJ#KYkit`qWk%voao6RuNS1on23v?-DN|sp$xJ*VxDg+&w#egoP!4sciT%Eb4
z&ZuH)k2=H>3+Dt$BdEf>UVIRxZsT~labR})rx?Zk)|l(P$;txeriiOwI%uV;BNdp;
zfaqK2^qk;c{mkxhL$zn(97zRK;v0h&4ilv<x&*ze_^be~Ovx&e*x5*SI5n!S1U3Vc
zNE<V<JtjO6{k!X*L3-yBYn5}#+3z@&W6Ls2T80H$Foq2WhfEG}Rbvkl%zFh|+zMXo
zxbJ*^i(KA!sKrGWPK{`ipY^h~e<s<@UuF0IS1*7Jm8abgNE1Q<pg9fcwU_?e{o}(~
z0MHs2)8TAQwKI~1X0m!~%YNERYS$XU>iUvnV@s+`&)U%jk>gW83r6l%dqa0eB(A+u
zND&6yCTPLfld;dsGhUx`I?4T3+7wA?Xxbe{j&=BNf%2!bUFTL$FrOerKWNHm_yR-|
zpp=6&90_a6Eb~Z0=js^6tRQTcjmCjUmG8PiE1NOh_RkO5llw$q73!LUn?2gg)9$d)
z*LOFBAV5<XSX6v9(>YkfYlAA#;f%rB<60HCNp-*@WEUA^VHpb|3@8i7tr%bR_4)0Z
z&)pu?vp415@)gvhx}}L*B$B@?eENCPI&+q-)WjDHu0~#M8ezIgxz|mt=6AQ&Ld}Y2
zMX23(><7Bt3;qL<fB6;H*5tD6sl)fY9Fx>LVSLVFK5pXfJM4WzqJGZeQA=KXbd9GS
z=-uuwIXzt(d{^6eHpdS~HSN&5J5q=2_*mMEn>heYA%8$Ye)F;c_}MQLtCBOBH7D-7
zkHLe7(V$O@a)7(lQeM-u8WPJK(}f7H&5wNRncHwWlkS}xbo#%~VBiSQj=%6~{&U|8
zay(K)YW=kouEk$U^}_vmm+#AXODmTuk@0f=>bV{Ysds`*JBr-S-;NF-Ni%8jTTNiu
zw+2>KRXaj0HZD7j!EFjXl&k`yrwzP2+{ev`obz*q!ZoipiHib_s^7!C(}e3Z)-4oF
z+Rk~NtdD|_9~#ouyy9$4Jh4h%V>hl3E95^AY<N_+S2y2wLeTbTGAFWxpLhS{CjTcm
zYXw~ip2Ay&f@8rB%P=>LvbbvP3(PCHZ7zaa{0*rE{4g#ZV;&<5-JJc6Jnn2IiJHKq
z9u^-ZcK?Zndg(7h6qjBuM0R$Xf7#)@pKNwWDyi#q(s?U$<GOt3p>-QnR0w4TRj1Ix
z#5xB7bgut~sb5LZJv>!fsJ9oWsL<TD2jL!Zy@e2@s&{OvkZQRKzuL5gzVzQyQ3NXA
z6!M%_AD;q?&PlU8A!@xxmt{5Uw_~A&lFQnyMqGOJgxloVJyWURubJ!-a2v*)O|w?!
zYKr$;+mAP2p}%W`fO&l5Z&~8=LcPzVHtSh%%Q@{s3)W=r1x#po|716zeLub{$m-%g
z<Q18GlXTQFJG+uJn5ZlDc|H8rXvVrxK%5TuoDF_Au&B6f*lr9_*y9$AF)u;--5Vt~
z&hYQ1;<*#i6WDyNpdbEn_oiy~!Iv1ieo#Clx;Einny~<O-Usnis$@SysWx2Q;zVl)
z1-<m14>D@au&@IuBed#HN7GEcy1$QB<NN+&%t0ky{N(Eq+xr4nR(iJFM!N$7`|fA5
zrugu8%N(0I?5;mg7GNU3Vb&YzcpPEq-xQY>>GP24o|*W#H2U6*1l`$*6w*4!YK;E*
zId7nCR4717;4PDh&*X9S#FE-Q8ANqjGLx1;=sxZAPWk|{RdU|>=j2$AjeRLw3mml1
z<OJ?MnK^9<-+q7Voztn7fC4e6R(A_wWQK-0t93S=aixp;BjTPOUv=iS%FVTD?xYXp
z31e?wn4Pn_q@%EId-!?UWry!$)|Wh|5*$YEm;`9_c2FSnq+p7dBlhh_^tVjs<j9K<
zv%BOaW-h@CYleal2|z$?j&t4lD-gVbnpcnUBZ!+Y*oLM78&UW=h39UfR)o7DPxhmD
zGB}`tCSIbG7;q{6RvwH#PJ=&Fvg{u2EqQl37noTN&?`fKxnx^zkncL!vM<R@rT^j4
z<R&;}zRgmMzbkg;Dr3%*6;Lf#!k+bp*?Z=6Q0^edZB6OPHfeA8P7|J8<64d#r*gc?
za+aVL0S3fy{+LSg-*Q!E{m^YnRx2<dyW8n;`5vi;_a6Yl$tyCf3+lvB87F7^iJP)L
zz7_MqkUXnv2aemKB&>dw*}hvhdjOB=*%5U%IS!}u{{HL~XJ>mx%b|j&>z-m0of=1w
z0IhW8OXtR4_(Qb;ck@$)>G5@gxC5#1Uk2T#mfz>a*tprd(eva1#*}T8d;2Z;_~HeC
zx0~&TH%)ay|3j*_Oj4U{uu^my;(K*})tN~P!e!3Tb(ZB>xbV;35`XNpFw?}A(YX3L
z@{3XGi?fIls_xn6qcv#$vQOFmLvQ1|c6ez)hx5WIdwH(AKgpC@D$erf4Q9Z;F6|xn
z27X)}pS3MK6QOUH@IC86U@vT$O7H9?b^8T@<<Hdqk{n+eksgTU_s$37i&DX>?}z2O
zc=X~aBX+tX@nsX&uQ(pn$*2z9co4@=^oYstAMgt01CJvDY_Y*<j9I1;D!<42+9YVF
z9mKE=q5MvKHC6dNCim<Xha)r)@H~w8ZZ4^sO5eQg=PxfiAmfc|O!gqzvx5s;-jMA2
z-NmnCUQvC7e<;_J?+<OFxv6*;c=tO2F+9nK`P-T`nX4oaIBtU`UGwk<^8-~-*#Km!
zp3}W)e2cQrjl;KN71Lv0>$_s#z+3EOl-;3k&X_Z*A7sU*+pcBYE<KjtIq(Z46%)BE
zx4!6tlPY#P8DqP)2O(!}^prrYkQC}(wBVpb(+Sy+<2L_&E_11|)ZO2{iHhQRTkxrs
z2fkGc%D~37YH{KdlYmRx_D9C+>mpnHSt_8556g})Rw*v(v~d)tmqq-&n((Y_Br0fs
z_G2D1TPK?cyFc54FMrO~i|+6Uq9o^%x^=Y`4G9BQ)|WSXu;@Y>lf2S|w6ijS%`IaY
z%;1IhUGnli5;bVq*Q;FqP?=~Gmi6H4TyD;#F9XnVI&Z3Y*Vnd7n;dFp1B%H}d~Y5F
zc`RH+eeZPz?+lS-b2&KyX1s0mk?t}k6iXX(O*@aERh_SU8Hhx#Ns#s!Y4~{N=u9ok
z5y6aFDg>*?jRSe#s>A%@s`2}9&+bVUug%T3KY<ghvo+<nkuv;=a3)9niWk?`M+t7p
zxOyr1mlJC(TLLI$txv>gzJ6gfKD@x8B+b!l$C%cA;5MtD;pX_lT##}6VIH9Vbf(7e
z``7KCnBkLUz<j>FW$+C;ug9pWpNON`n)$C*B)ZhseUDe^9EZB>x<w-8_SDCX0y8}I
zT|T!TH>srE!(Bz-lP-Q0da9#8{X%`Z@Z(CVMHn|lmyBn7&k9p{&&2rcR=F3P$d>Fg
zY_eayo5SqA3zXxve$WE_ARC}^{W26Hsnv5>$Jv(%xuW&t)a%;eukHQAf=M+p^G7QK
z(@te##^8JPn{$swwcbo`2j#Fyd2Mgj*X<mHo~n*wV=$;UfiW(#uV3MV=Rs=Wd8WG6
zA^w!F`<n{OF>aSFtK+nHi&w))%x|AvlrUl^!TAqg9!iCuU!Ooq8Z^j9DqRG(0)qBj
z47F~e8P<mf_qk=0Wt+dMWQsZ#L0hQWWGp+>s|gWZHb3CaTmQ`6df%?oC)M+;Qj<4q
zPAhW!S<?Ate`teykXKW6mzw4CycNbtPbFASUMU&#%}B+IudP%*Bm->7|4Z$i_5d;h
zCy+|qp6(EMJ}YR?N^}fJ%v!ncWcwrIf-r8X*o>vT4nObKG3xbl-(uK}OWK1C@)w+A
zVLtp1o+5%<UReV%Wwsp1rT&y>cA)%`P#|I@CbBj}0VFl-*59E#tDKB%ll71jfD{An
zF&$DtubVzRgv5(iMk$b0(>Ajw!U7#SO_@O_>fB3Ay{sCC&T^(QJVd_t(!oRkLhjmb
z2Euj{jB>0F25Uo?6r}^huCusNKPLO^c9<1Y@*>58WUs=07}ceUyWU)ir(qd2)dAFs
zQ-x*viLBgh*5Ggd7|z4uoqlmN0{sCHy0+PCKi2&T0#q4w?t_9GLoueY<9Yk_7vFv=
z-dtV{v(w;X-cEM(I<V6&RSA11$M%tp!99fJ;_!iQ-uMV~$Rp|4@qBmOr0LA7T&qj@
zt#Fu>C9Ne9e&<c`FCpB?bZJy%7l6Z6u9RaSO(fkdns=8B56Q8UB?>q<aeY&;V9q}P
z@79<-eNn29+$r@&?v7S#p_{i#S2-OoVy^voZq1J*IL>kk_W>&d$A$`)%~CATua))q
zo2`z)CV7UAs_uT(?9T23a=Ohl12Ze8MYY7I+N*AHFk$C0YFmP)XX}if3_x}lA$wIk
z0ZnFM?smJLm&s$|t68C1X6gni(1dpi@Z#mLeF>W*bp&$iOV+Yn{j1r@-#6cdm7hV;
zh4S~r-+nK}*f6hC1O=o9YDx)G{gx|eTG{?K=Q|z8E33$%M((mV@48J+Tx}945>NU3
znN`qlvGvDm&+c7x>ko^-^?FYUw{v5irgYi^zGc`PubM|pyK90HS-G;8El;!D2aFCJ
zm$v!5kE2y1{RhsiE`)c%ml?Lq?IJvNFJDJxCBN?r&Eql-#NOaB^5<^3A?aC-ya>K|
zcf-(vvJ3Bjxw+EY!4c+}Kw_w0vGyQv>?k`ho&r8qL~38+bO<)c6KMw>9v3HG(q(0o
zD6>Yp%xXW-aw*wVTiGe!uD+4Bd0~tY+TTzVvX^#;U59i8_-5zgu67hwb$W`s;4OE(
zN><tCeZ*Vqn0u9_w*e9%;x`(c)k=g(H+)Ft4B>>!!V-mRbECQe5`=`PV9odrB4NL7
zpl<$+YRnTfiHkSr=tWx?gx65B`^}|PI0=_l>zjMim9{jYMfqFer2#fZ=LlRdbNlgZ
zKTzQCeQ31#*U$6ny$@?XBv-RgQ%SZX^;R6g-ELh~U8kCB`g^BWQ>L{ZbM8(d%>@0F
z#GFaW<fhQ3AGTBH4WwOS&u?u@k9)^Gti~j523RvB8Tuqlo_EuX>}S`)x_mDExjj-&
zaC@=a*o=H&jn&1~?XI8_G>I%=^E+{lceBPOV>EqM1=G0!wR00nKigfzp_1<Z%@E#G
zVr)2D@%IG?S@-01o}11+rU%dsTVXh;@8GM-#=DMJUo_<ck@SH92{QnuBZn0mr~s}9
z3StWC{1&G;lMbv_S&71_-kj9uBWmSM3R565rN#^az*9m|2MTn_W=W)?MQA1=P92PS
zC<QwO3f1qq!b6OjMCf+50)X)B@5}j$q)#ZWHb2_QX>d}t7ybE-ZM*Fdx*vCW>j@Wk
z>GUCz%Y@CVLWky6IjtgbM%gM%7Y<^<xjxr8-VnUJCnraYh-KrXwNW3`|I8@SZF<R@
zGoq@RD%!nz_jGcskk&U(%2+4DCHTAe;)a6z2=O%KF9H;2oXFzpd%+Tn*&Y0BkuAdh
zgS1G2w6v^1$DAb%=aUB;Z*6#3{vwz%Ld9C$y4!thG_RiKv3S_H?~jT4_MTQ<!4#qH
zY_`x%_de$)tX=SeyiRfBV#-fjnRnp8+ESW*O_0R*g{faHgZ3*2R2tDaA5ys%gyE^T
zboin|SMG~j#t~X%u^)efnMHhYXBSpgoY^j=1*c+t=Dsn~$&)d=n`y9TsY!q6MurAt
zi9E}oThZF|r4uqo4s)B*q_hZ1pL+P+cl*Ua_YJu}X_Hf?iMxH00F&lM=&4#eNV%JB
zhG22Gr&v*TD~6a5S-!9Anijj(eCh6={XRg5-)PFjUEq2L3&v=Rod<k(-pz0IHhowc
z_RJ>VTKOf^FNB{d&1P3<u0jje!E@XLjL+uL%{jYhDp{HP`qtQ#VeBs~nd`}bf%8{a
zS*Cb?y6(4QRnK(w!v%RlDZkY-eo4=xPSy9iQQBU_PRB02iLNWpIou9{y$@SqJ%-ya
z7dS^D))~Vd^~Srj+<KhuT9D{}E?KS8tR?qa3v(5PIF@WJwI7H|&@Q&0dtTd7_&)bA
zIqyz)LllimUf3gm(RXo~>gwT4alo8+8tCD6R%+EkuaqsKBNWzaia49?9TmuZ)IgKE
za00g%eCxSyN7mfOpN$Vve@ne4HS-`{&w$m8e37MkuFUk(e>YU&P7$~-F!8zjo(Scp
z_q?mSK3Kfl*d^l88ZHB_YPtvBKXc<PLiB}7{?TDH=4`IfmCEvwthAOX%Yk97z;f@N
zo6ISMGN|VGutpmr|C;riD}eu=M@RK%drJv?HmWZf8t!X`{J7o6KlW9C%*O(|bNZr0
zaD2@%IYAINht0za6c(SToD)b8BBuz$`ZI;f&!7uSBOE&gfbkGgQkOmT?|lAGjSufb
zv;d^K<b}XuWpSK`5NGwk!XISJ%2SVNneRCg8F)CfX)UQaz!!ujA=zSYn#<V1u}WlT
zvC0B#bmdV@h7O%pCJB$ol#V8sV+Y|;fz3+oY$gmbQADqpC69z&IdiuG8p@)g%$Y8S
z;KVFUUJjpchhzv%xD&C6>J&GRX&0OLR;_uu5MQDmpP_F`c3zxanx>s>K9UoHkJmX)
zS8KeE<s?CfQ3M$^cx6+1V{iSXOcV^}x^|s}BI`b)>+ur;O+g2v`JwgJzY068R2$;X
z>m1Co*iX_m;}-{-yG3(d0Bj61B6lQDjn4mQNLjglo1(cK@Y?f34ZHE;i=hs6dD4zV
z^Nt+Z-9dlh$>k0>z0kx6V1A>4FRn{Aa&Ez}oKw)RR`cvL+B&*Nyqs#vL1p7sr+r*K
zoQ<1KG9>Aa*~2NyvRENh0;!=B$HXVV<20{{a+3RzhEu+*Q<P1vk5&-e9xH$=?NHaA
z7W&|*W5`|$y*x|(e=5FS7L&H}|7-)xHxoz22&{veGKq{15_dvD<e=EW4)EiMz)qBP
z@a-<*5*pSIqS*4@D2pSN9a{?;Lb0zKC}B=E{WI*5Uu=6K+tJPU@#HKdVMGi}iq4xv
zWjz+1!KP43o`QfLn(A2P=0V5+Bnh}o1(9K@b|5Y1`iq?We;$JEsNTCPF7Stb$^%MU
zQdVv(04;KXGw)n}>_jD_vnJY1zVu>y56ohjF+!|fiSuuJK!<BW?X36%PA9pSYat2=
zKj`7lu5e{d3SaFuA_95{-Sp^u2Af{!2o4LB-P>A$QuMe(y@LXO7?P)-@e=(dmHg|&
z(@|2KBSsVSB?}y$9In=n9p|8^{k|N*d_P3tQSZcx!N6mZtIXAMC)A<T@3_o|tslR5
zq+;Sh70PVZ>yyx$&`rJyXpzJo=efn_{3T}n7x4A3VmM*X_Yq+26`;(!SSs*q6m0ac
zwC{#&)d#SZlPa6Odz(1vlxZp_14%NFx%sL_CF*k=zyDG=pn3?(T*4PSGJvj#C8EZ%
z`*YHsbu;*u{ohpGg-Eq}LBuu^yjWzqn#83r63TM1pd~Tan62{m1N*C#+o8<y;$>8^
z{9HAkS$Ym`8!X+p$s81Gfn15|6%QnxAI4#s%X-oNHIER{*eXk+N2-54ynpTOpL#_P
zAPRvMb%Xr+RJ*`Q6;n8gO*JNywY!ZaV)kD@n8sa?xsn&yX#NmDoY=b(LTdf6hEqab
znrp{)8S<1eZLN3t9w(m4brXT(G<JgRR9Y&we)|_~=r5Z4?}xW+gZD3omd!xC7|kWo
zZt&O|pkcve(J<6IuBi}y;{^+z%0aZp#rihM)W#%blH#>9%<EOAB&giP5`uL}?25cH
zv)f=i?g(X*%R;C;B*0fnQG=TQvkLI<rT#6$PcKMg0eJB`EOJ37gM`_hvXfb@a^w}A
zr(vi9Wt}VKMA?vyiKNEMq%gsY0JPI#OjIYm-xT``N%I6wBp^zf9m@$h`S-8=uM_+y
zN9rdj?p4L*&U_-?a$prRE{V{4PD&zo`zq75R|XpLnz4;>j$BYoYy}n2oX#w1Q7tno
znXd(s`Zs0pKl|Y09Q^8YF`0$#n<l~(67IPaw6(wu7Y!%B?DsRui;DaNiWA5YjQJY~
zR->4y^2P$X5HSZ`Sq|!JFDuK<ZnqpnMJ)n_8uhwi+f2zYdg}jjPF18&BEVteSy?z9
z?4oXlFf*V3*+%YeKcg8N9a(~IPOz5~jT{3H+fDI_G6>N#V9%g1E0Lfh7d)5c?Cel@
zYy&6qcJ6E9f8Er}21_EtwfPAAQQaEO-lguKl-;)>a;J+;Mdw6r%I!dfXrO1B?VbHY
zyKW2k5QN3zDu*LHfi0?shRLE_y$`qY-v}jq9E2ql4?ecNA%;c)!?sNbuO<HAhsr^z
zNK+E5jUK{iku@|z@mh51hyg0=C_09Z+cI_LjuJZQv<NjEIPbjqp3^2)I6~&Udwc`e
z)f?o)_21|+kFOmhw<!->pZ6ZZs?fKcL@*;8BsE*sBJEEF#Mxfm?GrZ$T9^pSd0#ms
zw-Zq;mMqYGp8^aoYZIMsG&oRzJ{92feF2X|Gz(#84gclR{<lT?r)+-*22b7NWF#00
zZ^=3gQW|_v!F=8CL@7j0K*E*jp^v!P?N`iqn>IEpp!}pJI(Jp((qB$kDD1Gsl;5L3
zm75{yMXBa9dG|3Z2%Z176kTxAJ<bp$*<SJm;S~F@;|n^A+8GZllwLn4MO;;)gm*--
zeTJkf>0=@QUJhJjQqHubmJWjuQ{}rZIY1W0N9CNFvYU~;x}*QFxT*im;=Uu$TI3cV
z{h^v@28sX90v|gW-5`m1I>52xDi4&5)brRGx*@^zREYSB3L!0U)Vh%iVAts6BHoQ;
zNM_w9Fd@WE$Bh4$U&2R8T9R~Ol7l~zAQtR3%x$gy0On`*l6{{PswfZiKN5OoI>q(t
zh5@zw((8*}AE!`2^Ji#JI7Lf0RhZk(5Mlzec1ro*bg79nR`4G-XBc--<x<Y9DHn1;
zeuH>p=@UWl%;`cz0}f5OVgy4hq-)F`MjDxS>2~Hp$qiPJJ&SB<f#O{^@dbzWJ*1|8
zFY1Go*Q!kT#tA0XLPPtqf(v|5$ZR*zGOS5WLU+MtHOVQrAipte-5X_cR8AHqmaI5D
zk=qIAK@VBSFvluimRZDNd@qOS>rF>Yg9rq+vSGmAnh3_HpH9?P8M{DZ5m^p68`aAN
z&sXa>`(iyIxtOG1hLJN9A!X!lVk)|4q$G@2P&eG!JKJd6MEQb356IsiicdTfd9<7;
zymp5qfo3q}Fc*sJO!+UyVoT{$wLE=}@H+nk6zonRM{+3s;i^f-^%?tvQX%|=Fp?|p
zD=&pB8$D4uBN2bpJI)CXGhnNtxr0Jk8-QhbrGGgL;OD?8D!Rzjx)vmBC<;201_k~%
zW#+h6b+^6k0kN`P6h1cPP9z=k8mtTaxF($kyV;TXb11%9?6%>9UCFnV^zx0wub2ZJ
zY;ys_v<)h)Iib(!WGBJ_{&3C`u{TWT6J<St<xxSMjvhh9>}0WjFEs^<3(j5OGoc%R
z+xS~B#t_-s@xi-PmG{}b)Z$2!NJ4$BZ&TBAOD8SGD4L&{F<G=3R`3XffKY=ey~xK@
zRLKEUG<ZL>J-L~(%HOK>Q-Yz71|NNDd#gcvS@9ysN1F>X{n2<=GjhW43oserCJOq_
z2ALFQl}#jV4QW(TmRjoKI%tE*?j9&X!U9)#xJ8dbnM*`l8dUx^x}d!FmVHq7vRw9(
z#@O>U8rIh3=5mm~62pHeoEjEvXnwdzX+d>I#_`$>TPC59ojAe3+lQj&U6y6H-NdFk
z!xoA^fZU!)wxq_oX#G8B>`CO)-LzloFD_{`?ofCnp$H(l_#3xG9&w#B(u)wHA;##L
z``1<!`6UZH(a(*WUr@-DPavLwN*|s$5z3IsF+GoYmm&lMr}CbDF63^>%$u;Nv?O}@
z_nUi18aySKQb=%^`2>e)Q-xjBnY`8h)t&t%WoyDu`hQe70w<o`6se|cb(r|63^C%m
zr@hgbu|$>3e?%pSLq(-ePyv1jg1i=CvBwI3XR)rbzXbk~$k796awguv;j-OKA#1I@
zjnGavR*ncVXie5m8{A6%lOA-2sU+~Nr#8|J->0v4L~Jc}x9R49D1MFdQg}IZDi{1J
zy~k<SI{fzm)0Q$p=V}RzOy#U}98cC}=PzJ@(?RLxf_sSQASuhrLr028ej;jmcFGl(
z31K}h9LFoI8^W}TuAO9M?R1%u%FIg;ev1vp{~InNAJrd&FT@juCwQ2^?ywa|GPy>Y
zj8c_L!Ht`TB6rLv{jZhXFpH6eF<WdL@;gMSKi=U4IKn0F!w)RT0y{}%{2h3nv_KO6
ziybMDUqG&actr8H#&6~SqLsFHsn}eIkt_-R(3KDsHi(E9Iy#y>tO`<~3p!G0hsgSw
zU$w*d2v_OJelZNf@o<4qe=mWg!FH6SbBFuw;M8T4#W&01(eW9<hHREpCkfRKa&Y1d
zCRr_P`xA)fk0!uff&xF1*a=-xqPsVmNMe)&t35)9flyp{c_M44mddJ3e-V4J@dDB1
zq8I{#S-hoWmJ==}9KfBH&~W@gm^KggW0qQU)Pp73BW`zL-gk4Bahu!!KN)VE0TreJ
z1(QIjHGBYv$MCB#8{TgZmW?Qv!*MM3v3{XVWsc(VJ!JE7X9@_p!c80`wAZhA_C?`v
zhCr+};nTUk)`D6ewr6$BPMzpkOLt~5a69gB%yqi%m@1K4OxktlO}}07xAf0TJ|fp?
z<QE>#GuRjvC0G;waZTQs`0z6deEBDP2a9;@SheU#Wd(z^UZ?eTZBmVmvjgemf8y*e
z%tyBVi4Orhn72M}#V7ACkzZCtUZ+^byzID7I!D?rzRMQC`G`nRGR(Ex*n?E<DJ97K
zi^XGp+uAS!BU11^H*NKb9FjnM<^=hlVc1uom=&?WAI$f0{;RWTB|ima{kX0^0;lad
zOjeywWT$!Y-|l8Y=ICh8(_7`=^R6x>1~~$8N46F-TNBl=nnF+gf=ro!WeQQh6+usU
z;oB$9LV2G0ZgiQhso}fpK-o$YZWrUxwUq4tnAgKeiSXhDC-l#;hy_&|{Dx?ox;aJu
zO`cz}MEJ;?;3%TBTP+#xMRkq`xt}`#-~h@)LjE`s?}K44*UWa&V8JIck?1i~ykG;w
z3tH^t#sPNIAEMexrZ-07YlZd-zTgN^B@0RB^fQeUp?x=O)B~z(C;c|ayjzps)H4kb
zH^hEg)w9~il=?+p*rc7)NU9Z$O|R)$-p;f=x#yVe=<LQaZWZUTQ~8;{W>58pumK{)
zF*JLxn*StdXlx!OU@v8m_SMAhm~;5>j*+%xtLWTuqP}K@FWuzh)d>gWy2CNPq4Qgg
z(?Gj!9lUQht-MP|VuE<KzAz56dmf^iC;p&l9=W#FsM=OyTR|&Z+Ti%>hfP(ftnctg
zF=xm9Cbzf?*)uUFZu#2x$&CLg*Lrs)*p6^~4;O`a?&2BTc@f|>Y<Vs)iw}}sL*pCs
zm@C~rz09REIL_38y^efWCBkHaTJR|;2wrY;*lCp|8|G|#89*_yifuATx9Gy@KfadE
zrT+1W=dj0{b5ui(<Ico<u~Lkv#w}-u4ls6#wLWN?=w;#9h+a(Uo5_SyW7SUAX|Lr}
z=XCqe>O0fO9L;UY(#FNflS7(|oi%i7Ids0UUw7-O?<Oj_NfN{Bf05z7oAW?aMKZNe
z_uZt-PR2P!_4Ik^*4Lwo>ceO2`pMt220X3KGNdNmwzJ+rXPY4xXXvyWp=V10mu*i=
zug%q&P6y?P1ZG4L`Ywa2xs5sShs*g>g__xB9T7psWv~9T*Z9Qu&&2-2KNI_dBKAs@
zm2qW^_~;jnV)lAcN)pCEAYbfi8=G4ObMqolb|>_LgO&QE5~aWvsfJ!fB_-k`YmXR|
zIsTd2lRw3e!D32kON+~~t0!O?*iSFx$@85H$emC0XBX!u18Uc^q%S^y%0(e2gibaa
zPW2HtE|ZUn9`sGM!kX}(E>H;FhSP$$-Cihh-pM*p#$jYY+~g;dly&9#rIQ6b_UAkp
znB(#A4QeQ}MpEKDrOH91iacoD*k1V9L3EeQJs&j;boV-g#$h}olWSmi$w%qdD^7ur
zyB*dd`<e#vljo(zX;U5Gi-G3LBU>i)xyt!b(>Y=M@_!Ce2;t=)Klf1!$K%Sh0<uR#
zj1Ed&O4=IWb8khs9PEByzORk*e8{09PWjMTI46{*ncvPr$*rEUdZGgA>P*|pA#jq=
zp2$hMv>~j~+^yOut-OK&^dRh>oMB597COY7P`~EZ9m0~EDU0i#4r?bt=bJ~gXIHNI
zyS_BpeuS4iSw%pnH(qrl`JUJ5)Wm0tX>dJ={?@<rp^(Y3U~{c(%yH`MHFe<~VnQow
z3m!;5{}CE)ubE@!F4&k+TsFsh@>_<4Yd8aSwuD0=(kr<-aWT%$9YL2f-!gwBzY=*!
zb?rYX6TKjj+oe#g>a{jd`~klYVnUdBKMHt~pmd}_0=>EZOI%3zoK9-0vsD0B#@i3P
zI3Ry~Yo0#Fm-==?WJeB8D2IFfB4mLw_)FaNB$AjQ<|nG{vYHVrqMfb8QL4{!7#;h+
zMh5d+BmzJlM|wKqZg6oF2k1N!h;~U?nU8KQRcI-LMKtQ19BdnCtelscpatETtSdZp
z2i6Qtuluie^}dPqaxdNr+of&p>(thu#M`}jAyVNuwT$|SdPRX>Wn$VHh3_{9SSe)&
zm=@{qfP7CctJi3C=<OL>Fz;YbW?p6ij9Z38_by%Z-P5fe>e4Fw=b(5{oapj9do1BV
z#Gm;f5}R-2Gx(jTxO}W!<X1q-F5Tc&gON*d1#FJMDO%|B)q_Z3Zdgv%<_Y*(e|^X+
z0ea51$0PAk!vpt@gjC@itTbN<;FKC5EGk0K(M_WO$Ewdk#0a_aw*9uiWdAouDOe!3
zXSv5WT2y%QI~9ogF@0Co?IM#q9-Yphi4PjokO15XOLJJqH__3`-DJD1&Gkz12AOyK
z0ocgrkJnDAL^rBu9mgbeDhJf|Q~MaBh3z_DGVQ3z_sv`Rhcf>SsPu&OYBQ8KxrGLQ
zv-Hnp3aQAYjeLdPsCn_R*Tf76HaiPwd>(M4LrdWbr$pOri#YP-l{UyqW%=!vNThBh
zC$#XE<kUvF8K>yEG=*!27`?lWYS`0dD$GiDgTv6>lPZ95Lz^y;9!t<W#~dZmnz(vE
z<tt8b^}Z~){Qd#NdB)+7ACUB#8f2|?idmWV`&C^%cT$tTWmFJt!swBt1H`{x(U}Tf
z2s}#Nt3DYUXV|_X42f7G!yew{$+bZV=AM6fl6Cf<WSa6?oB|txsQ3(nSm0U&4zag^
z+U?t+=E_V=mLHrk;hG1j<p|<7Vxtm5>d7e}#G%~>!6k~h5hI?1P8DEbY;}rm9^yhb
zPs9hg<;0bfNLg1(Gw*P#G-f^g24wQWP^QVq7aiQBmH=Ax5Jt>T?N~Hc)leNS_Ii!l
z8P$AT8XccITx(H$29}j0sW+Ji?hMPaaNmbxBx?v`f`cxO$5Ed6Hy8TVIimc$ZD&oZ
zUzK`A!}*pzqPVql3-utiS(={pzg)+rw)FkC!_{_TpsYUxJ{0}ce6{*;{Aqs5^!O`A
zN)j&oVdh_7|Cal-+?XBX0SkDUL*Srb^1Zb88KNC{Dk~<;V<tcSKkU6_RGWX7_ge*8
zinqnxiWG`_LZL;96^9}z1S!Q`g0#hpd-3AM-L1HLaS0wQNYFq+PX04<&)hOI&$HHf
zb=EpBuf<yAlArDG-k<M&?H>e5gZud72BJ*HoJjB>A$p=J7q1C>ntsn^6G1EdPoMaN
zXXQk^p>y%1#vBJ;hA-_9_pT{~#_hKl2+9E;^){|PHFyx}&&2rX+bV&C3u8Apt+E3A
zBsHXqg4B02^rdN4<`3imJIOsVg1ej^TrnLiS)>hmw+_nzu^n%?=`Fo5OpVwh;3;oA
zq(rpT>wo@;+RXnU-)ZASDW<h^Vg_i|G)cCN)CWmAMRUd!=Rc9fpX^Lo<WPxF*!@km
zd-^}fc2~Gecf`<}Qa7_o8kqY;2Ei;3{`SWHF=qIx`1KCT>^P=o{<aEb2}gZ1Ah;F0
z?kH{2k8ogUd=N(S#zs_*;eZmKlpK18-9_x<T(EukR3C2hr#Ng^E}o4rH9#*v$yJ5&
zo8btbGG@YWWoK8DUwrYt`cd5j5_n=V-4w*>{>M}LE*|PcKKuFFvo#w3B(t$tVuu8Z
z-$qOwK>i>)2^&2L3KPkOcfHwqiF~HNW8{>viwro18k6RiN6*(q2V(Iam$$<Tfa*LC
zWc%JQsf%Wf4Sd8V<Q8nMwl4TyUzpHWGFpQX-G7GyN&%23{}<|u85Ru{nD4vL-30pk
zM~HQnZ<{$!@Cp1-qIr*n02K_r1<;v3&(a{LKbTXXa$Dgh?tgtRN45e#UxMSaD{)76
zq~w*#`&%jvXwLs0P7~iFV7^0-tX~8AlsWv`y3&ozipP}Z;31xMJ~yGyb=YC>o~V>3
zUw!aCobN7+cV&lg(YJ|UVs=wff4A;%#T@$bzaXfX|6MM7|MI`10KsGb-=qNlgUh3H
zu0mw8BK<*ISaLGKH&(P^2bW`r?$JGRnIvHYRaADAIYUb_OKdM4tFJ;vl(50(M@a-$
zRPP=;JuUUY`*#ZP5f}R3Ga3IOG5_-gmQDKHu2rUv0^9Zv^!g=k5*d@bj<(OFOh=an
zMvD9z9${s-v67eWHx9Vp6U^84k>_lO!J5Qnj*l+DKDx(bOcWeF^7@uE&aJy3BJ$<s
z#(gGX1BK17whIjZgC;llHLrvzZP`CYPoF5he!Y(?Y{P>8w^@TReejtpz&V2~gAdR2
zY=ZDM&avU$^>J#49}YD6^asH3MO}nrgR1Fv3p*c${9N!$q%3_JhmTVQ$^B5@;XFBm
zo4CD2!&jX#U-0hk%44<AurI{5EGFySvSZJGdQ?jzCN0*(<qs+>)eP4IKa%05jBz2r
z<QJRvThxxxqCqKG$JKq}ar$OVQ<Nbt_usE0?}_elru@RCA^02k`|B^^Qq-eomGZB~
zOa4y?0Rq<^VA)EpwhrgS-bYecdW5HKBC54mgT`Z45@?GevB??9(8F8ekfE2Nc8u-*
zcm{rTHes12>?KS}#`3MV``;l$y3GGqkm0r&U+{N8gYLEB`|W#`2A`jr@jxDIC%;tq
z_~S_7J1=S7S(k9{4)Z}W%fIW2^a*_c!;cHagXKa2UzPvo0~Eu90O<t0H+lBjsGPnu
zEXbRT8m10K&YpetOC;@_AVLWD&!c{Rv$7cTxO&5M2VaJQ79K(#_Z!#mx~5A6Z@mJ$
zA$JG)Mt4nbyOaN)<XO%K*xbiVpI>LO>gQX520cP-=PvKcx4ylxucDQd0W_xE-?9r-
zelplH%SE@|dH#k69`Y=%gQtJ_6B*gJdX3xui5+b4*Qx%$FMs0<e`)I?d`LA>b<uIf
zUO%scRpo)V8LNi7%xCzdZ>(Q9<={n=)$aV78R7EOm!$mvMa93L5!ey&_o>qVYf<ri
z35jy%0Mi<IXg24MN`~*u7GIvV&21t>>FdHtn$`bGYFGU4N$p>xe-WB=&N5eHtAP1n
zWd&c+`Bj&BO)dO_577)DSrVK|_B#f|bvvg6d_g?W&cr#EE&yWOBF*3Q39xruK772o
z&rRkOg7<$OhqubN&Zej34y6u7HXYSCBB_LJzc#28^q(Xv;Q1U-$f{+&1nrBstjPme
zymxZgpZ^Ss646ZEVjkS;^OHf4VWH$AnV(oxSLf!lbc|G!VU&^B0K7uqX?LsCsv1SN
zE`)jcVZmie1vDzPdz|WfO<7_X=_H=Uxm$29xk*i*{JE&GRC|ABW8=d_!DOWXh6aik
zy+PS@ebF6S3TSo$pKm?(mf&sq@fYFiy42CQgi<0XNOlvq)^P&FFNE7?juq=y>rE6m
z#ZxYhnrW)e=U2TBjQM=r!FF68fD60eX@;A_&f6EZ4@BM7g)1mC8-?QISk6b<KatjA
zE0{bcdhlg8U$`shIl_|N?@Fvj=fH<g%N5$f`%nm<2RsE~m6KAHd(G|vKB>Z*LLSR;
z^;%9wyC+EtI?g<>lXqyP8!^>9uqUvOYvD?VIbr+0aaxq7ij<0w$>4(4ccYnxH<W$q
zb|BLa1qP$+E)=+Bt~A!q&Ld{s)fnXq<EH`%JWa!p35S&OPCi%Gy#F}j*zVu!Ft|0k
z8goK%`8D)8K7Fk>NZ0MBeXvpPL$iy^N8OR_BGzwoVM6YB{1!p6$)ZzX*8R1zGx((q
zB|8>FkcAa#nGfq>dEMuZEy<>pNqAq2h(%$YT=2+6yBgf1=IZ|2pR!SvSkkZR7M5v(
z|8lZNRq~u>(PKFw%w{LeWdV7Cs#cqSDPn9}JvuWQx$B$)Uj{>{Q3LW=GMa0@@$z*Y
zmg<|UFllFj;*aiH^0pn@FpjdN+JjT=YyHs|`{lyedUDS+YYpxv{Sd@1`P@%=x(aOl
zFUQsRj{8iH+tG6U!f)I|#cS5Y55ilY7ivOllf6D;D`45-*k7)UVU~Z6OxSlxgBb6h
zLzzpK51d5{|8!#ACs`#n;x`WZ=>1+;8Yh%xfrA+g|3WOWmGN^w_=M`8E2KE{G%Z|%
z9GawV{%mM(HKN<t53nsb7Un9!@V|gxtpD%0U5ne7*5f5jg6s0S-i5jwV_dx`qq?e0
zbT#4Hsh(5vR_Wze$O2<9y}gLB$nU@CTEUj<lzqK=x*NUI?Gds%-uAN=BloSm3wS*!
z7{Vm#zT&EeS<+PzSGb4*dP8~Oevz%0qXt-7*p|C`>D>%?3{9p^kcAjj;+>l>NY@kX
z3t4RO#9uT?qO03ppq}d|>9P%?TwGY~pkLfVkJajeZb90G#T}N#w(fPd?gw_va^V#g
zDyj4KUBQc32G%sm(4#JbPKtAD{?k-x37W=vA+(Ry0_Y87+4Xoo?tFCLCSiKE3W`3(
zY<3aZ{LUkvldx}}SY29g3c2bEA~-$W;%i1A!VZ!$gY&^qr&L<oAzSyVFkaE(<9VT{
z9)StE^;jCkWYM<Ln7?#;<%`Lf4`EFb<}%I5Z^V3nNV#s&s@}zz?JYcNN(}%o8bXRm
zm~P@hU?a1(zs<=P*y(-Vzp@vBKrrEu`FrW)bra0;dHaZGn571KY!mIvhs~a_BeR<`
z@jn)st^Nd;W2;7eN0A2Q^|K(K!jH1x%ATaEoJfgj;YEk@+~Dq&%ik-)Q_9tIb*Zy7
z_PZxwJblne;}fgan-$!J!QwJ22)xdy36uBc9JS*-D5m<`{bb)SJhQod!O|aC#ZC{I
zJ8Zv<bdlPi$~>Q|l-#6aCtCKaPj~KB+<0pK;e5G1RkTqIW_YT1`p84C3+ACvo^f$u
zP@Xhk+`bntz+2_Ho!;Ib5-dT3;b5oJ&K;AGG^BJuH$b&j&?)#fzG%4aqQ#VJ_^JI(
zI%E!MnZDl6Y&Wz#)m1oD);5x#ZYREI)~fv&Ot7rUX@Z2V^ewnUeZWabpFFM6<}0dZ
zL>0cx32RdA`E9i#mEB|ja1BKy)NaX~Wb6`|SuR4M7fB~H*n0&V_6dMy-e0O;fM`F?
zr~k(&^kXN<FQk8Mkl$t|@s%8lNB^(3x421^)IPWUJsDDtbFyyZ7GZh^yBpM`fbf|6
zz}_w%L^EekXp3ifMIR6qVi2t%LlOK#i$YHNjF02ubz6{Hc%TnUH;>J@Bf}1p93Z&j
zbWLy+t0=|LfVs=CP|s55b807{iKM~1fo4t&$5>ajMV-_V^L8X~yWbA-C)!QIwz)FS
ziP>hNC$S<&&7srdlJ)@WhFU*8qt_=qcZ@ms(%Qr-<G8JFq11hPDch#hO~Q9<(22>~
zrbmc?{2pr4CcD<n!z*&G7b>yTTFB48z&upWO4q=sv+9w7S^FfXHH(bb)iE@dt`l|@
zH(DoQ*T{ng6M8-pYni<bUU(!=Z@9VmLshoVHzCg5(&*Lix<yA_b_9=d)+H7S1YpRE
z+5EwPV7dxRCi7pz#&cX=M1b`N`_98z7g)RNK*f1<4iWI9(JV3wUbS!RHe=-zOVGW$
zZE*B4n5II0@A9CoHZHwOGj+^9Y577`)bHxHSs0sES_n$DGr>Iv^b)!vC^Wnh^%v(W
z*)!}eq0Y_lEg~F-6oWb&E2Bg`HWK&CB~NQAE{QD8_+s(UR{uCDT|=ifDJ(9CwQ;K+
zN&5{zhU3G3`?%MVsP-d}mtsg72)Z`OChBmJCHCnz-(7Rvnw-cZ*c^>1uh`f5Xf1yt
zzS~QbfZI|GMrHa7?RMJGg~YJ~d#+pc5HEl?PtSY6{NTc%tezKusfk7$gRd8&kJ@T|
zActm9@6&|R?e14BdzJDuo8183s6V`tZ{}Rk+M25U+q7=;%Te$@XN~7l@D`U+@6&VL
zb6gI}t*mh}f1Jcm`$tZME*~6B_ETe)J)|e;u~rSw(l^qu249e6f(Wsr%AuKyDK#L~
z<`R|=sn{=T`lBj-d;F$Ov$1jTvl09$CQa?oIoIcSMdJ33)n|#iG0NLJTTdW+C-UiL
zH(iMzEW{*MS91=&_%xA|^daBO>@<~?wywxsGy$*l!KGCEKTak$$}bG__nK!J<>$df
zz#n*PlDe|+VqC*Cy4ClAz*)o7TwID`q-;_S;eNuXISN@aBo%J`;sWG}`sw4&l|pw}
zh9v~e@6(rf{?--z;p(AKKOxS=N<f4dZQbEqG|ds(m%Q4zyV<1Li46;)tC#4V3b!+2
z7h&)|wAZ|Cl=1F|a<tC2;ILRnBf1@ysdC9d7r+!u?;PucrOE>#vKlkDqMKhbF1|u_
z#maRroYQeBnr+&xCc2uIjBWoGCjR@JeicfLcSyRzrz4EVBr4k94ZId@VNG~H*QqN<
z4RH}G*B|to?BiiU^wLSeSAp~LPY_dVmYb%M3s*ffR_w21l%Bl#*jq6m5<AZR3O?78
z+;8k1bHxiV&F;dz(}`nrMJ8YaUJrMc#+H);`?o{V5xPh=4o?=DkJ(J)3j=?uc^W#g
zHTu0z>mxAWo9U!XRt@r=S=INoE~Y%A6C8^*m7vxpz9OaeQ%+4zz^OU4Tm+SsE@%R%
zt*P_D>r2rJ)|(=qQwt&e_!e<GRw$F~%d_kT?SqNPzV0!kcVar2Ni9=+mfq!y^omj5
z{+k!T{6MFrEp{#7n6rUDvz%RW$y|20k;SnZlKget;_+L>wN6ENQ5-4ca*)$Pbx;!*
zRjX1z$JUxpB-XYn6PEY5U*U<OjO#kq5b<!aH1w4jkHkR><i}HZpI6?RwK1jG=AwPe
zb%T<L%}DL6NYS)i)2WHX+GaJuB>!ehwW_Li5k61NCk@yA%6cjBV_)ingx>zIZBKt!
zah0Sk5JyE*Mmt8+6JtaSodapz|A?-mux>L|@;EC=c;mmsxAijpE)*q@0nD1y?9<8p
z!i(-o3Eqo`<5Fv3k({rK3dFFUcx}8f#l$R(Qfc0e7lTR%1AX+0-5d#xv!aDKp-n3|
zschAU#vLf^EMb}a@m)XQoufC8iz!Yvuh|Onxq|kgciqS8kFd9smQ+Je1q0N&O^DdE
zE_{w}B~)=n;)DLeq{T<2qFj#}LErz)DdRC$X(DG3W2ncgPS`~VnD8r=+3^8f;;Jjg
z8J^foU&~eAJ|w*0G9;;;r7}7OKzG}<trZDga(qxT>7(=gD1Nc#OS{>Ld@$iPFI1l(
zmC1mL63+^17({c{GPYp1tv#2K3yGU`tr5^bU2Mj8E6#BPL2DCy(MsiE*+|iq(epiB
z051Ua;2V+CQT~3}Sv|3;+R&sjY&ts{GA4!g=p<M_!?MIRQtrz$L1>LrIhn>5UeT{(
z_n(v{7`}^YUvQ>0#e8XPUi7(qs+)s&Uv%bd;O?(NYLX7i8}S_U9u+<J*l=DP8B6*c
z@O}O-JBnH8we+=N{qf-OyUPKmlkF5sK#oQ-L>A<?2;NS%eECDj<>m7yLxSrID=w$D
z@FMENx?;N)5h-F$R&bYVvbk;rpD)2F!`;FQ6cJ`p>e;^S;;7B3`<|g-&FD4tJUB{H
zFSmF*Lt``A)!2KD(ofUmv%$|PndBMLtQ#!u@T?4$-GL*Xwm)_)HgfcCg=)>$^Okk?
zIof#h^>AR45$McQh*+oVAGhtFR1XGEGM^#ki73F`8Q5f=v&`OcX4%l`RFE1$<e$_~
zKl987*+S&u{yzg7-ZEh;wy}`G?@(btO{KY7%W;SBbxfCbpyPt)t=^R&!nuM3fAPNx
zwy&m0Rs+&Xjc#hv?hM#p7A<P)7;v>VtzeOtgVnC6>YKDbS+NvfkFC~~BoExj*LLYY
zB^F+FfN=c=&l`^)3w4v5y%YONOnufbTPPE&TQ}wO<d*Z|rHG;CXp4gUG~2T#t@<GD
z1#=DvvInM_Bos4y%DJ6Gv<M}{9If<DKDG9I%iK+y@V!#%Vn=pY8;yHd>Y3h{1!foR
z=2SA1ZbB@elhKj&AV1pYQx(hT1mu>E9&4-H(kvINrL{=2?U|p!yvvlXaTF!u%j^ym
za#{KmH=FWX{A?`5ll3B)zGeT}gyplM%`0v@CmFjVG-2IaZ}ePGlAbV0312AIlF3F>
z9Qg$`mUR7N5p<e=FR^Hr;gE5ngDBSYF912$@CtS_2Bc2I8-Ms&k!r>)PuxWqRJ0LK
z7NwjIIfT6bPCx<~Cc(|uZHCYq3dngIpWkA!SVTo3dO)6@&3i}s-or|*&sXF3-3y$F
zrLbG)oIu-BC!qQ0#|6a0chsa`Gndi3!UU~W^pmknpAC$)ZgSB;1A-1ZPgU!&wm`jy
zE%0lXGSpQUQE0Ru6nNu00~IZ8#z(ed4MF1koDlS_Q3o5opqmyq1)@i8@J9Pi;a;Un
z?8!m=rDG?OY^XYZ;q2@?k|&JUmYr^KQ8d%Sed+YHFd=S000}cHMM=8+(oM|#G0f<|
zD|%V;*(mIQVT$3g7;rniT+_?7ZIb`Nn5a6AK6Dhw+<(RkpttEemzw&83Z{Ac>o#gj
z@H^?W+dAXxT|Hk^gjiAsjYhjx1J3MmFkj>Qbkw1Q{dSSKEnP-DX}D{+VTYJkHqb#j
zQq&C8yt6cAJ5oDSParbSv|EJiKs=r`b}gjcAR<XYdJgl`GM*cSnP^&#)sEaxA*6*>
z`TOXH=AcY)m9%JF`uWU_8VUfY)z-ip2k;nX@@I~Gl<IUZ^61HEs%kp9ikbDCE=29o
z&7>4jvxnx_?<<B^QfF9O7bk6h_}Ry)BW5k~>dhYNTe&AN(MuZzU(QY0M39yCP0vyD
z$t$6=e=^(q8X6#7ivkmKjK7ZijtOs!-vFMX<|c?#pS?i1F}+t0>h^Pd)t?vnVCW(B
z!Mwn8z=V9C#}{lV&!2Ad^|Sjd-VEL`lFv8J=KDIlsu}qD`V})H<~Z6<EnYsJ`HYAC
z?{}t6(Y)=Isx_49(xwD!PKaH0`o%u_R(opu!QxdQ#dOT9k*j{kQ`7B0SVo<S5A7N<
z4bOBJcZO+HQ9YcInpgbji3DOU4*m!P=I2zy|JriWKvvZnwFfqUOz#R#sUBHRx0!(a
z&foIukIud_Hp!dTge+L)p9(o#s!W%H#P7PIYjs(CP+y(~8t&K5A{B)oH)0w+?Bxh1
zZh|``_g@oag-Jh<Ijod?%l&p@ypmlW^EwdTtBPpDQfqB)Ct+Eto6q-E>3rtyK6FZP
zjo%1sejK#&bC1mFBX+m0ZG<HQwPC#raR&D7VR11VGa(k~3);FM36f8hw}=rDL)(^o
z)h%-j{%DE93*UVuYU#uGX!j6aC9KPurnuEfk#0^#(hQCTfknXMt#>lv^WHvl#G_xQ
zS~aL73ki*^moa)r{ueylL{0;5EelQ~x89`GuO@yn2V$`5g-dJ&8}Rh!LJQ+O*6Jqh
zfv;rD)?Ae;|0d5qCv1`!p!Bl(+p^af_#wH1<xKP2Uo~`a?L+LlGGFulYF0p+?3@RJ
z=8(N^*>aOuB=PmtY#hAqE6MYU0!rScSJ)kCMUZ8u?mx<k%?Rc$$y(@{?aTY#j6quF
zS2_W&Ok1(G7jtfx=9CP{(Z1}oU|pz(n%HTPi{#TsP8mYkr$Y5u{p!;MdYuV$lk|Cz
z_*E(v=H2xUR0gLz(2a7#6SB`^3|Bk&`MrCI`{iky+JO!W^G!!>_D${H;#V6r5AL6^
zz3GJ+@{IJ|=iTmU9P%VGSss{uW8oQby?Mh3T^Oz&)p^CydP(SY)}h7Po?VU{hAmhh
z+3l9%9ja@o*l)o|mEyISwPyP?B>&>4;rm2v(LrTzBMTVUIvx-`)?=nzyPd{-r!Gy0
zYPO?L)!!uSt&ST(d$ZyiBS?@#SwV+?cl8+k$D}Lqg_e=uUh8TA;c*5>+5F7PZQDer
zc1;B2-CWXQ_3&f+NJFPJ{arw>EZ++8z!7W<_0F~6y6K8>iJEYw-O{D?8g)@K{K#6K
zS#k%m)7JcW<MThKFuzE1VET(5?0l;Zn6lY6a7bNI-Z)Ocdge-PT#aK*ca6H`>D_8b
zY_8;)t~4&@n6toGw0@4cqcF(lVCo}5PISsHuBwgb+f=F0IcC1+Unkzm#0LA=1=E>4
zk-AWzVTm*437_i4$x6SR=%K(u8U1SE6>4rL;=Wbb((zX@#H(SD(NkV4t^~R^RR`8J
zZ42W^f1%)0;y<(iC+0HIMbX6Gp7T{h<z~$`y49*o-FuI2w_L$!e0PR-&K()9AosnQ
z>d_>Qmpd%@(|xG>Dnic!;KsK^;`>4xVtq6Kk0ba~yWK6FV_xGMhM4as4?!`wq?>oj
zXQZ%*J-+tvU--9HY0p9)uV>&vwQ*~bAM#mS2{|gL{ZPdmq#)Zz=VmQdDDr1k1zy#y
z@s}0h?zvyD9{uShwC`zuN(D@*`bq|CHo>x?=LRj-WlGKPb$U-_v21AEY9WR<gCw{M
zI%6b;h#2|hxh~q$Lw0Vj6>%bIW$@RZu7lA8A}UHRk5g`=fHU6n<hfcLh4hX2sdhLZ
zcI4JhzK{T;e@vwFNZbYS+6k-j3kHV;2~WJ;5aqQuE~<cRYxs0&4B2F~kUn)Rl6=R|
zGD4lsE}pcLV66-0+rpcAm+kb5^eLvk$IUIfJ&35$K=s!f+FejSj(%?!VTcL<m}vB~
zDHWGML`<>$5C0G~s6}X6YidqVQ!UPzKFY&e?3p!ueJo{Bo~9+LoY@G8kJY%OU7eyk
zx;v82qu2wFr2~TT8IjimJL0@mKWdL&S&CmGvl~3PRtxC;&RC5Wf(+87%EvX6N1KN5
ztO+;9<a$I{cH40268kS;8J^jZezo5}kDB+-UC(51JA3xEJ4A>ryPek7rRhesBd?2H
zN0%qXRQ9pf69L4Bt(IpJj7=As@Fb&A_>j~S3|wRpf{}d;)@nh#^)$Sh#)BF6uc`r*
zX9=c%5g3I{6L*%F(3!mw^N_}6qm>xde1qrinw^MiDtRS6c|P+SnfZkJ>h3No1A6H>
z=XzvRpC7Ekp6>8Qo%PlM!>^f}1$pOFD2n^b;b@b{Q`Dl!Uo7(!Ts{Wuy?|PigKgc4
zipej9X7zP%p8DYjUP-nrIwoc8u8~}d&=ID47!r8W-~P*%_t#XzyX?o2r&?l0SAdDe
z9&tQr4}C>P%EH5f<7M+rdUPYuo-WCe1+j%riAnK%lNJ(l+86_zCl}z@U>p7TfC%^7
z7F;3r9x_UF=U0EkX1IXK!F*qX2-&Bro(IWln?H?G$X?weUf&X9@}toNZ0D0Qj=#Fs
z?#W7;kdb#UD=|(q+D+XxWl_gViq?rdwz_ZBfR&$uen!`4hKt{`l<pgO_9hmz=GO8i
z-9KEke^)M<MA~@;ayw~s>&TmZW{i{%=5C+-yjyG3|1n^;-o9amtE;Sq1FLqfNZ98+
z*69_-GT`!bP4&`%pR!j@Vr@?%&Ye$%*cdt7pq@i#?_Ldw*fdX-?NV>$+_N9ZOH#@e
z2DLrc7^wsg0dHHVytR(dQ!NZkj1?py<(X+8M~dgiqa0%!;)#7H6s3$S3nuMSX`Av`
zsrA%q-zv>m+nL(8pA-=wZzY!ED$+X1GkvI*YYO&a&r=v5aXktED0xXMe8gRWi5AY!
zxA#Y$>+0iPCYb;iy-#`dTn^tzCTjoWjOQFB4w)cUSf0q~EoG*<76h@oGki^kg|`9h
zqvcJyQd)`8{p5B-UVU2+OkJ=pGDTv+G^yLFzFYj9scL2Rc=TmNcnqULMHPhso2OS3
zC!Eg!vts~S!vLWnyf4-_7tZ;?_t-O>?3fz#NAI;f|KL)Y{VF<u8~wi2fllz86Qgn0
zFXX^U1KygI#yjie1N!Wd2iCIF4^c~t&y7vw{5-Qwu$IEaHbm&4Qlb3Bp5{FxdSn*F
zCU8;m5U_6pPxChFDfegZY@LAMT|2>?hW(3{=h4;QMQ}M;SC#s%Ci(G94k1|a-GO!L
z8(nr%ZIi5M{h-Ofd8d$iljLKVaxEzl*a>pG`f2CGFr2HlF*E)#%%nON_k(xkR>Z84
z`m4ZW`yCW7g~<5F(CnA3O}Ajb=$-|H<oJg<=)FgU7a61%TNlK0CFH}ggx;!LVvODv
za;r(F9L1+&$z%S(ceNUL*V+w4Eg1sz6JdqybSg>*?_ZC}0wd-BDL2f<kM&~w5qBT8
zF$_HFkm$`gdp&15224Mb?E|I~|L$g$)1sVW!*N>+R<XL>3ARURhS`VrNQMR)b(^T&
zQt(E%l_`CbrBMKwr0rDm(z3r$>=aRxqwXN0zQ7i!cLrDq6o!yUe+*OmBHD(O3c&h6
zgx@Kz!p6lO(!{lyIbhn!(zQ<;+<HVLRr!VGBxy=mo7hRO;+<cE*(oCAA&EMrA7Di?
z)Zcaz_sbFIZba|iSU!3GOgE*V5yl8S{iNXWHu>|qh%tn<ls#=xvr?>-OpCkO;YT^6
zH`ZD1rnqmPoeXhU3(az~!Z>T>nO<o-AIw$F@RcXXavFI}h=u+#d#SZq%-gPzOYz2)
z$9Y7+e&yw7*=&F4wt;=-Su~!k-}OLfDM%xbQrp6&ycMBgA{LQ-hrp%ogx3%38KzOl
z7;A0kbGhPZ&6JlcUs#dB{_JNZz<F16`g`>2qxKuO3GdzNO*{nFa&+!{Ekz)3Iy%fv
zztgzbDF3eVtWzw<j3}YRMKipyT~~Paqr&u6tZ`uK5Y`s$hkIYK)V8}XbXwBv1^Fr&
zNbcS@k-it{m#W7;N8M;rB_3-{$lK$I;PZFgLVdEVI|2Rj^lg??suB^pG`#Qex;)1|
zj3=0BEK_rC$r71dCIWxY*%d55wwStJC?_{`lVw68@5vmmW{vR=mG11@(`#3R;RHDD
z`V;hT{9+(#4!YPHHE;7E{^lN5TBjCp9(?=o+xeq}?2_b>uBRdW1(_6DnVw9Ij0%OH
zY!v{QgE*HckIk%`$FulKFz>5d$ga{;YDBqxONw<Rz^^xZQ1oB{sli8#Mmmw;Ba=X*
zuQtMW1qhl$J#S_IjK1npuES<G=KOEBvbJ(lAn(N54KD+D-*&X7LdlmfLnK#?K0<Je
z<&pBLJ$D<>_rPExTl?LO@q$Rgcj3G@{cT6qGBeSv0gufG+JZH{$IIjzS<RNk))bh{
zVp?FnW8g#Aqf1Ep4hWsH;o3eXDPTD|eCoOFS$2~wVEN+@*mV4X)6HPjY~xX;<u+^k
z^C^P9FVg?mgjm{*q~GB=-@U#ob>AJ#6jJRvE!=PU;XOPZkSVuZ_?KE#h*Vv8c+M8M
zOHI=zBGqRQ`H`N1MBK_%vFis)8(zHoZ@nBn<TkjgaxZe@)SL&gtpn_fOM#!At-Ysv
z^r;oHzQU%1saAfvp)DqGEKpZ{8v~M;iM$5f&s;sF_=HImQd7BfTvH)=uehR$3TWv9
z`sn;*ayugr$c;2UD0Vm-8vC+7v))5|SSX-x8}_luF9Ed!20Ou}DmOfK_jwc3+25&~
zy3`#}p<e}e3ztjdExYcwsh6)mj9l{n18#H`pCw#@f!@D+v=dXND5+SWO0!`aIq7HG
zvp%iU?x<u*#v1a;G&-MDayp3cu=uh(5+C?=Wl1cmVXl&!PmaMn=n3_{sbN#N4eINA
zjsoffTEF!H^_S~&blI2od8D=d%v0>5{AKQ#8>5o<2nLIxg!Z>bir|QcQlbcof?;w=
zlM@-soML|>z@KMpZ&&i<{aEjS%a?XFd&R1f8mhy!6F-aCI~RDD($(8r&k>qs^&SW6
z!6zW^1?w2H@vxn}gIvBW$<wLxBBrLR8x_OcM!P7hQuW3mOyOIcLVHaVz0bSEC+ISK
z#m+!IoYO{_#>fxn*iI%PM}g4{d+a-hM0C@5jOxdqSIA8Gw+8wwm0-=+;`Z*sN(VF6
zUwFo%VrB<yFxp2!X0}MrZv6HJEh~4>adscrsiQ@VCl_a>ojGV_{|}>XSd!>M;Ju3L
zC1`QHpnpi<F^&P7wq7sBQErZ6YGm(+4R;j%>Cc+ai;A2&r5yKNnY-T*-M&d}!C#qj
zz_XzWA@^9n=|4MRvn+uYJDPzYTRrjA0x5t#)-fQL*g0Ce(uu%5qQ&p?v^D25yVC7q
zxQ=+bB_CH;xW4d&Y(pF8^qx48m%+emK<YbEaylaKxK^=SPj(*fZAFeUE}Xe5f#lp%
zRYje#F=h+VBVQfQ)rT3wrwg-V+#?O<ry4Cw=m7z?cND<*)8*&?)XR~9p+bb@3-t-h
z#eHw~V8xh|bc`St8l1k;-4`M6>KhfJR6{jALCcymTMXpHrZ2`w8WM;FuRgrf&F+CT
zk09KNZk-XeIxESTF90Xjxe0O&GOGZ@y(>m0>ivz1m2Tp(y@_)peq*z@yDgf{oMM|T
z?#{4;G1pz6OI6#;xuFuZC<&oNd)#Dx=Qe|t!KhObS=`-i4c_Kk6)NChAdmv!Rb{hK
zqo2e9(_Du=Vgx2g|6a`tlP`aCA@`(NxAozX(~3TEw0+yjhe_6R?&XVz<+{Q<Yq*k|
z`H!0aKs64X>P_gVKN8SO^`KYT4|+aDM7;YEuy6NkRWboK?AK8=aF11G-jJu-I#~46
z!X6<kBAmQ@U?Xb8Ve@&wVYef5ZhLRD&0<@sa<ULemcu4y)>V^7_*u3uCu1ac_e)1D
zi9H+#f$1D7$?H$bi!W2_@u*o<l0_GKN>$96wE;>=CqZlgr@QACZ)bK9TNy@+Z{Lu2
zs~SWE>KEH-?oRprddjWUALA6gL%S&aOj28bOjzG~rpZ5?LPS<dT%><N2=rO+yKj~2
z{&QUddy|DOr8I&H1|6v3NfCatiQA)P2l;(DDze7FCsg8cA~{2>f$>ibvF3+%Wc*>N
zgOmHu39K6&XcLNNoH7Q8USy57j)uRebvsZff$FPC9;s4pL<>nZ)hJQQ#^<f1F9;>o
z(Kd<m6WPy}yUGf!6AQF~AfAn<uhPW#t&q1jt~{t9+mD}Y4@YAj5wTGX<EI}#4o7Rv
zUhB3|^X~%#Oorry^3<#A_?=MU6lDhW1NBs--(YvbN%|`@(p|Y<WU0~E_tITv@D1t(
z(i{pn{9qoR@oxP92Dv+)Pom>&xHXgbynonzzPveVFEIaHNE#DvWg5r+*wMs##_B*O
zY*h?kg;IdQQ-38Lq!CjsPlvU<U6fd68I)`F6`o=du6@LEvSgXKSSSGiK(2XGt$I1k
z(#+1ev*naMKmcu<1;Nsds^<U!HFm?%7%Fj+HwVX2@x<&w<&WO@6b_aDc_mi*a)|cw
z;tKRLE~6%MP*yVC{V}alAS*Qp@q`ytr^gPpON{Bl=`m7kVn+vu#{-3)5@AR%>avN$
zDZ+|#KPSmUyx1bX{ZlXQ2M=y#9)$Y^fCKzC(}+;ao*^eu$0@{5cVgsl*Kk`veI7~@
z;(1SK5h!nKY^uK}f4=H=ysg&SHv4E_UkZ`_eg_{m^J*|xOyjE{fu6Z_0CV~)gl?QV
zZl$FSfmhn1d>l!kvQf9oFEC3L=(#gV*lvs*bnw)gs<P=%rdE@3!aXjiFZ3CT{niHU
z6~$BS+Ma2qoXLFI-+QRT^P%P!bE{i@8>n14nZL?mO$NxdXtj=0Ex3%AbU-yHpVX+9
zimuTrc1aHl{(OG&=^KS|U7Uot$H}vqx>?Ka{93PO=kA<iB39C=)}TR8=fMb1r@_ur
z3A4^bS`CA-Ar>(|)uDo|VJ>ZV8^sS9MZT@~JhgyH+;cUonm2`eQ<+ts&O=N-_z_5O
zn50%yO<Kc+Qt~m9e7;H^W4ZN`<ypN=zYYdAQ^G3od^Aqp55-Z|%6h$!+`?R-HQy$t
z35mFP$&h3RWx}sVQ|bb%_a9>3N;vgv`LJ48VEbj=(=hL|Xw-myNuF<J^P|%RxNXcd
z+%z|7={Iio*>8rZ3BGyTi>7zE^>jjJE}HEOCd}`ZPpb*}Y9!3^{?IM!M;1sno8R!j
z9ewJpLh>fX+}@yv%6z6kDFRWOMN@|DjB@=w1|nh*O}Cwf5~#HBh@UbY@<IZ6g~E1C
zCGFXo?aPNxu2dN!m#&I4oFVy_iwjDwt<9RFXoCu?V&%zlRH(=j!&|7QY<{Uebujsc
zxkbh|r=fi4`t__sCW;WWXL;d01syKSM9g2Kv=**|4HG1SOC*rW^LmAe-jl7ihLC1w
zpMe#T`JO14<5E6cgLyU*Yt=pH=h3y@0Am-B#5An(>w7MURhe`%%w`_Uz^*U1uhhuZ
zdWX!fQ3b^qjAuLSDL0dIk#<sT9DQV)+T$0VE$Zw7{(p_*WabKy+bEltPbV>Bx5r&X
zZd8%~+5U8{7%yIwr><%?-1kJ$$*$ZtiFfN(75B%2u~>%Zc5;=+iK%eWuPl0x_spIm
zmV&=Ym=ZBxoN{S8z_>nuO#`DTf3jL{F6JmfQ+PD2pwQlRO{&xuK|HvoP`LrywKAlH
zslLAme0Rae?4~ZLaG!=`ih1k-Bwo|PD?SVC_CmIV4nEgs<Fu3tpE8dAB3(!PQM1@3
z^v|2F0I^Tw4GE`J-I2U=%5QOU<Xgr-F8Us(OKMQLCaZ;kQ6a+=t_u&DL59LeT`Ms<
z|H47dE!hhae12_DairgEV^_?#v!knWAS~Jzaz-E3>9QbjBeJBW_}%9$W5%Fesdec5
zJgC50=YnTB3rg_rgIQjZ9-*E7JZ2+`Ao5AwZNB)r(D&AErxyG2flOTyMlQAlLQc++
z54A~?UPd0-Y!|R{@!$j3m0iVN`dN8T({^`Q+Kt29n!G|OseGdfvWUhj<cwO-@NsLC
za;v6a>^}aMdln9&y@tgKk{5pkYrHOY=pW{}jB>j4^{~qb+R&?40yea_xRb)A5B1T*
z4nup_l|!fZDZ^<H9q-OX4_lNVp>T{}`l;mME`&|MyCPHHbKRBhX4=y6dcHKO6?>i_
zyGhzhJBdx-S2l;0_qSg+QM1CbA39!&*`Gn*&BBk_8HkDT@cwRXt60P{3kZK@97hlE
z4)5ze1SVi|qblh~D*;opxujqpx99T@W7QTE^p%_=9VOUDaP1Aj4MJF`UDPy+s689y
zd_eJgCO<(l2q16Gy9npHBxPYZ#zaaRFXKgSmH2qAATcW!8G;Qi5>cSxt~01Z_Y~PW
zK2cqJQ#-c9XxsqE7ar1piMqJm+gGf?Dkn{$tK`MY{BZg)Z0SU<P3*39yX(*;hP=F9
zxBg=EG-V*QmOYb4iJUinqF9H6u~l|u&eE^`>oPO6>}IG>d)=ph6j|*z(Ev@~53WFg
zXxQf)=?lyJtjZ)2Gv8<L0U(YocJnRz+hv%ShsdS%+v1(7&dh%fDt@m>-}%;kr7-Dz
zTZyui!-N|M-ToPkFwn03!7`bb)<=<*{-(t5#88x_G^RnXQe4o~)NP`GEMA}XAZ}Zs
z0oP@s+Iw_@ok%JY4;c_x;kB7cCvTH=<d<)(UiWULUWd({OLrL~^@x#qNoqNDXzlhA
zN3kLMpY8&~bPsZh>1Q;<W`7<8S`+@;SHt+>p=4#`{>*Uo-hIv!PsGS58fzI@xyh)5
z?R%wabDH^s&XZ5A?ng#CxJy*4Sl*~Xg^M|p$W$05IeDD@M^+&&n5Rzh#&*X_d4QGw
z_6G@-T=L+|56XfkjG4X4!OZ4ufQtk0wZ)>sM{P&9iYP+)!B5Zw>&bcH_o5;Y8hBiZ
zkITO;DgU{C{KIJaufe5EqJT#k!-KhUKh5;LIivJ_X7{WtzDhJ}oSa!}1aC{{5p$w_
zNww!zc3&`#idtOccn=#rLS@{4_hONqh>2oxCK75@t)#yI4@SRzT8a(Q{^|An%ViUu
zS(u+zjvp5$S@Fi<7XY(Y2ITV(d&^)+61fv??@3&}>ButHuYdnLzqE7-kN8fC?kgnQ
z9AD}jgROAsRP(ZL2&2ubVDLZ1m;ZVhjdQP8+X>Zonz<mqVZK`|Hphl2pD@39Xyz0X
zvb7lF&DHhFiVE@2h$^7F=O)Ps6fFLy)_Xr~OMPtNmCStProsGST{+voo-pp+`<JIw
zCYdw3JvrJ2k}U?82Zn8VG4XZI^1o*o<4N(Jl*9JK`alb%h<JUEIsQgGp0YCRC6_>R
zT25Er!sUPob5iZxeC4%OExnA~9Ruvz`mc}jU*GGmzj8ge4UY+(U#Fkmh7S6%)!3sr
zllD%_(<Caxs-2n5#hB!<b~v%y8)WU91{8QI;+1l61-5hIcBx745`w`}pQ)TDH@-J@
z5PEU_I_z)0c=!6hd7^*14Q`VDIV~Oo6gX(2Jp!Zr3F=`~<#Q_}`!eGvE7_P~h~W)|
ziS=e#Ohp>A;jg>hIL>TyugPD}O8Q0|3w`mH*hvw2wKbD}KEU&v{ikNFT3c<@^8dwH
zk!H|*z%LoFCg!uk{|pma&53Y7&J0Cy`Fw#0-A-TI%U|!Z#0chnGs1f;S3>n#Nj8_n
zg=9+PV~L52%6Jx?XZ%!|ecxVmRN1^--yT(kuhdJ`1pw0bCJh@X{oUgFkFWPXmtGE%
z{$pZc;|bA0EmXl<jo%rLKQJH^yHB<6Bmj1t@2#-d$i`fjaK>X?^FpSDO5Fyw6Uzow
zFgPo@8)+!$se>z3+!f<gU96ZS2L<e0xlU9%SEs@+WS^LPd_ww<%lm(G2f3lY+rMM}
zSo708zkLRn4)ESEe#sk&ecPrY>W`S)_<mRd<nDC^807qUTVgV*GCLUFxE*2?a6QM&
ztA7&^`YN@?Qn)bF>V`3>g6S#CBHlsuSX(Tw->uE;qQSFIK(HL=sM%<mB&R<9x%1X~
zWhl9gslOWk&B?;Rm^Zb>&{5JBybQfr+6$ZP6@wYEh&lHdGx}z(3%O??eU_4od7t;N
z=!5W|zIgEv|2aZ?N|l_mCTepaPDB&UbOX=KQ_aV@&F(x{ufg2KWowOeIaFL{-5g3%
zBNV?P76FhA@k^+=62%#Xl`DBxsjYkTANb}^$yK%8oD%}G8=eBI-tgD9zvOj4l&l(S
z3v{=F9`5rzOj!eIVnv04d6;pu^2k<ly4jThD>P%vQ90pg|H`WUB@oD$Ucws+W~_`%
zx4fXqty%-&9#y4sEwlLtN5=5a#tT#*_WSf77<D^W+pjS>x}wP1@PndK4qP-MYCGRv
zkR5uuvC<AV_|p4#J6p$j(~}KdM!CD~Gs80c9OJj@>CG)zhBL~+R_(yh^G?rynW*=_
z+MGmv=xZ2k55y=>0wlRiQML!%8}>}#&FWs_3O5ohVVRkJlgM~#S#yHBKhQ-Lay}CA
zNLPhaG(~fDwb9;52OIp9&uMO<UVP?x6Y|VoFVoa=&0d-T|G_&N=d>DIs5T+5j-euU
zo4hdKGVA|hjIEjjnyWh>J<W9M)t{__r{8O=u-cIGG?}R8xA^m((RZY<ASu4>e(<2m
ztZ_<J<tZ;WYXr7)I}nBJxWR6<n_pl1Y+-BNon4ExikYWB3q`{h>kCz4pne9tysZsy
z*dl2esfAG)lVzZB%ir&_G9~Dz^sHK`>iZdk>3Gn%Ko)~~JICa9%x!Z^INFhUtNy(G
z+T!Ac&yGp3QWU^H_iYYU)pghy%S=J6m(ikmUnDJ}>k>MED%kGds4kE=_+&GR%A2gT
zB}1;F-Pae&jGMD)+)<&EIZ6^qpo0+RJlEz?r-KuAG185=C_r?_{li52*|N~$q=U@{
zGF7L`a=l7s^NoC!sy%=AtrPizAqg(sH+#`$Dj$}zy5$KuYL40vdkAyH>izp>*n0e!
zQD{QHP583F&g;Lt^vy4r<BTrLnzO$B`L(PdY`4UKOXCsUa<ZW0glYB3uH1&kLH(c%
zpwe6A#Fw6`85x%i&GNTGbXaX}Qj1Rvdw*tA^wfC{F-(Xv&8YnbO2*V@eI>aEwIc6&
z28D7Rmj`1w<Crup$C7Y_xCXGL+|*l_t?mtym|@BJY;cWH-=TUNtJC%{>#{^`%(L=#
zCjI3xGmmr+MB!wuyx;C(akV%0F8R?D4<~<(mLf({%1a-)r@ewdYCXEYe5zY&;Uiyk
zIVJ8_{|aC|ZOat=OhP7eqqNHW^tpc3r?1NCqP<eHxX+~&f;bvIpud~9wziaV4p$5-
zi{jf5RE@3L_vf?5O!$0)WpWE*ElL-Lgl3b}UW{gK>=IcS7F5}2Qty6D`pB?rB@T{(
z3^ZH!5#AEjYf=O+6==ndIv>xZmJcv%vUewo=4^^N=^jDy)(LbQP_dTjTw8W6Z?7*8
z_f|k=lLgOh#l`s>q&vPH(hBZmWE`f;i@k9yUX&Q{Bsb*7_G*r!_q#GaQnE+Bhf1`i
zsUvLWtIWe7xFU8d!geL;?j5YxfTm?1OKEOi-^1h@sJwE@Xhw6t{a{|Emua1(;F)n!
z+Zm!b*D=fuflca#MjXkFEPRFpZmsxAt?wB-qg9+_k>4k?9Y-3xF`EvwNs@~p%K|rT
zYZ9le?mB}3l|+q}<)L-h@?#N+Wg0P43><YjHs^=m7fw@jv`tyYjry1EB3Jr1jDC$O
zqFu0T0`W_gE{&Cjt+R2=fYc)C`oiCz-vt}=(+`di!s9HP{=k;(p)UQ^PAcM3qa)AV
z#Oj+O4W~~P-U~A4mgeM=2v`JhM~QofALRLmeC-pXZ+EmFI%|+dC=(e~%Tk>ziuiEl
z_!uHe=v<wHqe;HYMAs1izQ2D6p?gp2m~xZVA7#|PwrzVDzvAwyFw~pzBHd{r`Ff+R
zI<}gKL-Fhza}Pr>Z{yix{fo|1{ggJ;U~!&Bx*Y%Q8ZNDRoP;}1p<Z7889l$u0*7K(
zl)2efYPnLqghBJ!?F~JHP>pI|Su5?MZT_h%0ng4~MtFopukmDsbsKJ-<n!s&Q7;Ph
z>nmN_AwO&EmtPPJH5W<WIq;KKmw%zhvH2k(b!d>@&!&PqS<<9tpX`ljuHE9rGE0<K
z%Sal4Z*qV$rd|5(Zb86W31wVvYV0?$gg19GRhMrR_VZo&O9>Sxs>g^a&&P>9PXgaY
zh5#;6_*)l*%Uc(T=h&8kzVWg|Tx{vhmvI@(hYl=!@Y<t4np8sVMp$({snDlA+6z_`
z>>|F=Szcd1N$gj@qN5~UZ-3a&(UMLrWXnw3v_vZsd62Q%>Tx#FH>j<f6gR1B#Jns~
zAJNOaQHQXtHQzk$KwvY<;#EH&EAQdwdlGNNS5^dv>;&=|dl|SGd!nmH#ei-^@!Y8*
zm+DDLBKF2&ijNi<(Gam%kAc&%2Jf4VknyfCF@DkX8>{n!{_cC1^?sRlhz^K7`+0?s
z5e7RW0giO>zVjH%luBQ$RZs)uWTNPD`N2>}Fb&(*Ae6~JD01dzc`_y;hmK}_MY|YK
zvetX9?qy#*^9z>Y*uUyxc7?tl5cO#6Wx&BY?0G+LJ1R}sO$S&E#!gswT?;b1P}|%a
z8kQL)H)F)XsmnbC0djLgyNp6@#jX{n;j%MKiTsfn{9HsQe&v3U;*^*6QaAolq)Mvr
zyV9bq<x{OnC)eE~*FBwPv6T3(xwlD%JVPMEgM(`@JRnZhF^(x*cVR`Xo#?QkI=HPm
zwZDt`(EVB;ZNgOSm1n*2r_OE*)5D}<u)=u5X@y>coWwae4njOkp&~y9%AxbR@r|m7
zlxNX`zqBV}CgqgfcO9ct2fbN0<cOeM&t=d5=?sdwcaJi4kdim0U!@b+so3d>xZi&g
z<;6m;Iw`7o3sz3Xbg;QjutH&i=Ys2kFX^fOydD;IB}3|rl30g{@8}y1ibi!)RXpKj
zn&I1jAusUGaz|2zj$1_DCOI<w{<rx_Gp#5=;leHwTKX5o)y?qYMvC{>)B+093@;xX
z5Bj*>k|B16IS%^-SE{*;{qzX|o6)~+OSP>ZW%yKQ8kVdyb#1Qt6GaT_B^uP5I8#b^
zMk=QZfm)TD-()C9E9I~cKW*te)=5QnJ5Q=f@u06qrondGXOAK`H{^L9n3mhYr`XU`
zLbk=m-b4~;tW7wldWB;C3&nTWO-@)1{Q8k(<_RLq6ZL(c2tAxY^8Kz+$llk>h_m9n
zgzbmlgIPBB1`5&+E3hK|ccs+3A^C*qkoiL9ub=#YtQ0Drpe-%fyvgk)P;kXl!ytp!
z>T<taX9#lC##)f+S!Z70(^7m2M|6XuM8~vRo}JWjy=QnXeh+fSd(w6OI$!!vTNUbI
zu-N5sLQ<k)HO}-OGKuZ1h*{4SZ_lk$HJ}^%Yc9qX?InMqhs(Gt;d->+!rZ6oIZRT1
zi<T~TSVPm8e0DwPuR2{gPknsetLm$D>|0i3ye70SDE#be?$PuSz;p8?(5^(MOh<xK
zNyJgTaA-@rRk)=(29)qSRnRw{*@V%V?BUUI{j`!-h*yH$A8Wfg7GcJYE6d4;yxw>m
zEzKl&n43R~SNrAd;fH)<#AAPQDb<=RD?IlJy+Dt}(XLQmW^Yv>7>4dWbzE8MOS{a~
zoCLD(`gB5;E-C8xb#Pa+@a98voq?r1eK}EL#!VMAKaHc@#Y`7@hd7O1%Rba9U;bUV
zwwor}78IHGBKnXBAgO&UeeqD)Ba*l*+45kbAhCh@h?*>M(79Yb0`ewbs_wUE!S&@{
zrxH(`_0Tf655&#M_{?LG8Cq(vuTV1$@;;P=4M1+^k%+cfZ)G=WEyNSGRKZ@UqxjU#
zF_83!!g?vN?Vqb;r=ikmO;V`G!uB{|eLj=6Q6=<K$id@;qQ*+T-5AeNrA$k{<Xoz-
z0T;BSHLm?3hXAZO`v8F3CIuY1!~q{oPMR;Z^199^IL*w%ng<B_KR#Gbn8q;>wvP{U
zjg7WUzvLq0FeEds8cKRO<1QQ1;2=*7CpY#^F8kxrF@MrWH71j~eZDy&V(hvJjN_Q=
zrk-c1J`$Q*YsRs60_1vLGDaWYzjjNiwQd)lwxOjw4G8%md}Gz92EAO3O&%AHle~Gp
zq8rKSsBBSG7Ou_qaU~{{JH6&#qo7w0uKa2S+rMIzll->6ty4^<xm8liKY4wT-OcM9
zc}F_M8w7QUNRUecMSG8LDbRV*kl5(c!LT+}Td7jTYP8j%Sf{Gt1^KZ(i7l*%7X9p=
zb-cG}Xj6>FPNq7-@DiLXXsqM$b_Mt=s>aq>*YBr&Y!FpON3MRc1P!Aw>h^Xr$6A8b
z;R4%)q^aloxw#WoCd4!A{G$jq^!R4@&bPwl`PUK-U#&;-ccgJt(*U|SQpXjB4(f$^
zXzp8?@QD>{H_w`|ZERIfkuCWmYvvQ*1G4hi3Ot2F$wng}oROKR6UGpA#l|b~4MyE9
zV8X?~Fe--0{&kJ*md8QPS>|EK#GPtkB|!Hr`4Rg5*ixgX(E+Ci1mxvO*)hZ?aqsmF
z(vq(#QLm2My{-1M3ae?pm_TOHCEbe4MaPECIV@A`o-MYK>rhI$u0++d^?Rn|U$yF3
zN1|VbW%|v;5X}YQiNnKV`60be3-AYI74GL+_v!FE&3$YvIyiUQ7^!b+DY+F?SKGjz
z;9v@^zV7ahLl;9(jkg0M6dj|veLu5^hHj3^;<1^oU%1QCjfFDWtWUWt%*D&R(dF&^
zq3k_maRD@IN@Tnz!<*AdNpD@F02iXL`A^0%zETPnE&0h5Ysj5t%w5=B56fnY(Ju6t
z`(aHLj5?Niq=S}e&zPkrfSP@iH3Q&j=Bt_zhyRDMw{U9nUE8%Q6e$jEafblKiaViL
za7uA64#hn|3xonif=jVd+}*9Xlj06VgS+ca*X;M3wSH@VGw)x(gvpcVzR&A8&MTNY
z2(0`H{gO|<c=g(T#dxeC!vgK3K(EX{^2is|l3K;Wnh|^_k-+K+AT@%b^(At&iQJyW
zM!E(wwVhQK(Vj-7gSFdkFZ3b>4!yOEbbinXCPBZHAI{`>@HD8E8DlmyyXx$la#%0c
z*LrE;l}*iwYA_lS6TLA6e5R*+zm*uPEJ!y%$(Nl$?zMoy1)kB?DTC6-GKGFDG9<iS
zty0OhzMqe)C#Odak^vhmdsw^1H`2I5GbQ%KeCz2<U19O&ZuA#ygodC50bL<0*`$NU
zo2Rf1VWEq@!osiOvx0A`KIWzs@$&Q=lfE<+U!L*uQAvN^){>VFR@ZF4sJtz8T51%6
zoTMnrBF|cV_2p#V{O>&}3*p4+GvMQgvo+jkW<W6*#F=azK=kgAdPy_{IF)ac=}6r9
zH$h)JHKd1cb>++DF548wv1loS@<+T^ArP|>32PrvVo20d?7R0Oojz_SaUKw=wCtqZ
z*tBM}D$lmKmJ3v(&92hvQo7mWAAvYdho1nofC#d9MTYek$U()w<zIK8f2Aa!>AC-v
ze^t%<x`GI2U$KvcsLM_!HEAj?j%lJjBdUBO3UwKi>2a<W+0oUFRkjMgDDQpo!(m^K
zQYgD13|kCx78qrT!fjopB6u#a`N6Us84oQ={Bezl#Y~>9y$&oD0~Q8bvFezF(RL+t
zDd793t_EA>3F}H_VpCFHe>v?j?XL;q`(>J_{jJZmD!0M>Ae+WK#NZnvBD`SDtkP3Y
zVxp2$txkBJo}nV&vhvX%t&tu@`sdxvF5LNQr8{dc3npr)EryxwS;>x@=OD_xija}l
zp|@|%DU4&*V;}oG-Dv!Zj`(9#tBWXJGm*Y`fv3R|!ZnoJYxcGI;yHdy;7r9b6Fv+9
zkfH#$J?uE=d3p6VE#PzAK4IY6_fGiwMLW+hEVScfe@#U|=Vbxoc0pd+iU_eKJc&F{
zMmDfSUf}lG`^ufp%RAOY``Oyq`Bz~{oeFVX(!X|)_g+`)a$(i}o=xncCKr*nO}j0H
z#gq-_WOdFdSw0OnE<`;h$ETR7IDR3RO6V^WW{B7;+q}<Kn(&z=!FU~%)pn{JwDQO5
zB_CTNhmu7Xm1JK5Ppr<v+5R*aU=udS9GkV)E+~<L>I%gzXfKz>B>}*bIE7O*+)EG5
zR_5`%a2E)8K$-aTM_9a#yduFL>F-QvZ>>RC#wcad&2k*<8oHuGM!)&(a0<qMBrE6I
zYK`$VSmw^&A~#*H|B=LX$&0e-Z+26fjsy!xSkyU;3(!s<i;x4&BkkG2nLQl7vq2Ix
zW-pyPLi3meA9IdGysLMfpT7e3MzF}PnsseN$bXcW1MWlea=m~ghhTkp8u$2l`%QBb
z2%vODttcMtdvdIE;JqCa^ifYvbBPVzSd#jTy87sXK|kDpsv@05vmg^?&baaz23+rX
zStnlvsG%#fU*h}&?PWR-NqN|xb4Xn@^8;^QOozUZwE`$7RVQar7C~pJ>6Lo?l2!|m
z%UKmv{f@-Ui!(Ebo8o^zYgQRv6B&^uWsI7M>ffAHw4GC3qr&fC|LeLkvt60uGxR*f
z!dqW$OA=SfccKKiI6kJ2*5o2j;;kGNiCT<vibox&DgeOVy~LeI^ESzIMO!?Dl*`Y@
zbTE0Lkt>`AB}VdN;)|eA#nmoL2Fb557ebe=#~LxS^OhcuK^5QwJti-Je+3Bko3@#d
z*qLysRRC6g23Dl{5~)d~CQZBn-34AQ#~-Uv!PGXqz8-Qf)+$E|KA<rF>=G@)9E%8r
zcZIg#u3-ho{_~8@^NfVDL+r6$<Eeiv)coukbh5(D95@fnlVXMOkmnpHrXqnNH@r5=
z+J1!OEqQ;{O|^=T*hD9vb=RKm<8SF=iW542TcuZ6ANolvURr!n{s40+QkfGnKJTj<
z`7MV+q5pI^x5nIUlm@pQ=b~U2F)GGa4j&yDLOsuy6cmyEJ6pv66a3DMECpjFKKST4
z#UZ`O0`<Q3fqe=fUf@PMPtxi+u=(jyDH!rzo(9VGPUpTm&z_D-_6gl6wY+T>z=Wa_
zi=qRNtd%vpQt#A>>M`)q=+v>=+4dF~dE5-8{v~;?XJD~hDs3ApIIe=I_ntL@C?`gw
z+(nOyA#9gAH{HQi@1MEt|NbayWtu|%{({eHY+yx(DFm1IF$;G&k$aLb#fJWX1-OZS
zs%vptBLYFToXV66GaTYl8kaR!t833G<$sYfL7D8eP+AOfed{ueO^V>Em5a6<>Fx*`
z>Xiid9aS`PYHx&~cVsn0cy=g}pGGyw6rmMJ_B|B~e~oUKFvOiKzN{>^!4pw6uOL)y
z{gd*0(L$wzM3A`EAAIldnDZzPTYB?=Oa63Q@aMAY9R*M%UM!J=RwsHYOz;BbJolcN
zHn0FL`X!Fr{|lo`5eHmERO>29d<SP*>3|@JxE&yZX)6V`tXq=Te)tiK*|6TvXtACB
z%i+W(Mh>H>x1!G%O~65G4A1s<PYr68`)u^FwP&4I#U_p>l=@`$3R~jJE`rWGzel~h
z>Q+C3Op)?rldP=19RIMnMS>AaImUxP1lpjYQ8evFh69NCuCu7Jr-q2OUd#E~GqBkZ
z5VAxjVFi0zH;E6>vz>fq8X~aP^|q&oRAOmW_B7p7IaE+q67a=@hVUUSps|9iqR4N&
zoFNp-QjrMRj53-CTW+3<J@*5)IN-I*jBrwxO}<0J8w1;y-h7&ti}zR#y-etdP4-|(
z$xJ3<QMiDK>{yZfNWW}i>9XPDA|^Wvwfrd+YRb(3y|0iJm7tg?cBYeKoaaFa;P`X^
zi+0Tj)QZzq_CAOdJ?LUm3|an~lRQM6A4}PFW`1IhJm|b6R4i+$)Sue*>LJp6Q$2pj
z(p;a&Zn#C%5YHCKORu2mtk5vHh(fWVuWPmE$rm!T<AqJzWV|o08iL+KTO?Pw+mqA3
z)TVRZ&VfeN%5U4OiVD~qwQaN|=yd@Z!G$iptv{9(B3Ew<v5cHt_4ig_w6eYql=#oM
z`IjI5(<=~)FTU^C$O;wy8gM`O`9_ZfDQNo@w`>2JsgNLVgxwma;0fpL3^&DG9amMm
z;6|#;*?e!QQ-wvMDLwI7kaFg)QK1b)bS^%j%@^<6-}rk!gW2d@+3bj9S|{HpB3S{K
zGY*23t(h0rT#d{Y!E|nSe505Ic(P<q6Y?+igtgzWdCzszReuB5^4YsL_0)SSn*Q=#
zUG0$Yrj0^ENw#j;727V*ciL-^{A;s-ZO-3*57!`%0bE}rWIc<tL628aMm!HT#t<&z
zIj#s3ZMo9%li}OdQ<c35HckL46LdC&b3E={Ju7WIZ4N5|*iE8?o)BGnH3~o|TZBx3
zHDJS4`T{uUCac?1WA$}#cJLU!^x<};TbBq0P5qtA7?_ChB?`-Q5XjuapcMvUb29h2
z)((Y;`1%+ppSRwoZ&gwkQd2}gzZ_BHY$CHyqJ&;OtLGxe)KmB1JiKUdkxmMEDClpN
zZKEANNKWIe$}I9ZQHU!ERp&y~bO!|jUR5MAO?K*PF<ZDYq4Y)GpWJ8hCRvU6!~4uw
zH`Q@_rD&=#2Fs$KeO?|5^>iO04q{S_>-zA_c8dS8zc-a=Ig!+8D%yHy<$%LjrMg`(
zn?I8eubDrLQhlQP*;gKwxD=j+7f?Q9!XyE?SF44agJfiwe^6KY??qHFR@!%lVR%&W
za^%gTG!rxsALF$iNTV4rnpFwm`<)`;jw+X)l~c~aVV3$N!IIoRulom|Pvq?uy%cS(
z=7^}twkV-g5%6)Ml7eQCTQdK($xXV)3IkWmhJY4M0di*gJ*7@yy+lcQCE~l9C8)w?
zohzQ0?1I(leq%t(*%%npl81iSo*fpySV;ENH}~*8Upsxz@f{;Vs)(w%Q}68IDu#2g
zG)1(hhZ(MCitQ3G&2~AKxc8~fT*2F5@3&^@D;o1+3O`m|!%B@eny7}M$VB-|ukR|i
zxd3496b=DZ884_ZL?%%2Ha}lcLtO$6<oL8CG#)dvh&>#<+WDU@0M>_^_}9Qns8?;0
zs{%mrN%1uC=9|;ROS;41gnc1F*sg2qbaCmdCBc_|^o+AQE@3V{T(R{J!V!_hQ&&nY
zEzuIUdvv=o;9|yFw8-YmhGj)^jj;%IJGzEGM*xP`wB=8NZ~t-PMIvTR=vP1qWQXIy
z=oKjP?hhY3K{YG3sv;?;=-6-Z)cMgXtr0o8xN$KE`n8ycydcUuq4g}wdtQS!yR+*g
zA1ygJUFPq@CofX<veeg8VffWNpCA@VE`&v$g4Z*ZVO*k-PvVPxb`Irkbw!cslPHQa
zVq~qE_t=asy__T7t>Jzv_`qca2mNWeeBxHhpKHvD4&0p}%=B+!sgEavD!B<KeYj?Q
zpoHq%4jEnGeKogCwoyWo@9yyQdJI&_<7iblYkhXai%XSCg78^pDEstguW*3J+mGsU
zW`qelhe|ZIT{;N;KM6OI;I$Vrck<2FG>6o3mr_SOzV8#KB+tyX3Mcaq6NGQij|jSM
zqlkZ^FC}j{l(OPldFy3N2paV_xKlLUY8a4mIMJ;fU39O_5;fb<#LPM#?3T5D2srx$
za-0#M?dn1rSJjxtoAcE7vw2k8&f6XG`n`R2C&cj0rvrk}r3QqNA{T*(t=>|4>MvLv
z0fDU{sw!?~s3nsbJ7jrR>gk$5ym;kmw5Y>Dmhy%vcAG!{@;U!frNZlwMbw>=tKc4h
zVapA79eEnVJpfM}&+~!)<z@PB8fl(a!T1GuX%lo}I|KY{YiKUmQ1v9_;VwBMa(e+T
zt3zlC!giy#(;|vwfU%f3KUL94XuXvHqctx@5MK_;j!)AzI(@3l*&9p{L8QM<K={=i
z%x~Qs)B0$Lh6FE8FSqy^dL9RbNIib!{B-AB<|C-t%VpkYvKSsFu&$-=7E!i3)(j#(
zRT)m(AK3=_tlvL<P*mixcJi7?C!tO#<5*A=xwCuyd@0|d1kC%gb8XiGP59KT=H?8B
z2*C(ej}dsIwr!r!)&zfV!B-OQNMxIUhNCF;9#!&B`VYeg+a&9N5hO73)3Q!j|ITd?
z(I@qa#^CNU&S+^j{nkBH4R_lh|Bo2SVb)OF^vsj!3m=+Vfx|#-lCDxC3v2Wf6Hpfr
z**q&Mj!px$40JKNie#vk<60pN{;Y44zOAOhk^JAcKope9uqXNq8Ge|L4Rl#;`i%Eq
z6*f$#GyBsd{5g8m9ii15fsyz%7K&BmgxD^oZUpC}6*7Xft~frCQ?(5|dcwNvu0xc)
zqSjPiNEktf_DTCht`8BYlHOBS^;+fLa-GR+<a|j+KZ+LoMWaBoHz-D&DxgXM_8{-b
zwNRDtqA?m5XhB1ckN$M-)AX4u%1M54j2&xx4<Q~$$>xsW#d%`UhTUQ|Q!?w=(NkLq
zvy}Pw6Mty5E*i-wlIt^ia-isQDFMNz%!|ZfzX`xtlHfn>?#Rq7>#E(?3vAj}ysqhP
zw%3;#srUr8*B8?b?~6AtbIGL0M^jbCQVDUsL9YlwY?@Z(SzCSOJxCQfGHi9Nc%`M%
zT1l!f2lax)&v_jOAq?KE4@oD+xvx<6^_8K3lp+e`?~KYBH96B$@z}tHrcIhHx%S-b
zRsHxe6PGvujyE>$wLNJEyFI@INsVgt%AQu*k(JFPeL(O;L=4NAMRkYcuWCx_T7Z(C
z7!Q>jlfki3$T^{ik>uCW%dMj6Wa+_Phg2mBOGfGr+vcU<`Pve8U%MJ)h1JYPgUPip
zAzha-ATFp=nqSv+EZhAaz`n$1r>Tmo5qw)It*XZ2_HljBg(K=UDWHRB)mL(<#M>qh
z!M(2g+%7Ppp&V`7nyNW^ydlGvEb8I;t=n{H<}-H1ka#C-C<TrBvksq)xuaJqUxjH{
zL#l3n*k1)J^*o^>JfbthcFM8SZ{WI5U|8ar4p;!YFz}Cxe@BEn60&ae#uEE~XjSAl
ztaj>h0lH7TiwIj94PyFaOA9UCDoOEjf**HDk@7n*!r<wY(T{43k@ynw`W})mwCw##
zN23U!T<--4OrDiFLqlJpBbP?XNY#@)xMOddc&zs44aA$5y1A3sXcSJm!C8t>2^c1|
z6(<xBBFN`Rh))UaaAr_GF@E>8S~_M2A*WN|^t($!V}d6RV3S{rr>-s9%e?G8btFmx
z?7H>8>|9?$BJp(B0TH<Hu9qp(=I1S_t%_L04THClldr;K)#-WmS*P)ErFkfM3E#Vy
zk>EDdp<f2#`36KhgHX|lJXfTq*JJ+k>I}DDF@;A{*GBvGeE!5h2j~9>pZwp5rJM}?
zs(Aw$i1OehC@`e;we>`+3HzD%L{+>@O{Rr}ID~Lz<ev{JQvH$5vUKm~PPC|6xokgE
zw@bVjtrBzUdVx6~QsZD33(_-I6O2NSdGieV^jA|9RV7{(KyOkq?&{kbm2V&9O9G2u
z7y+-}PLD1;<(u%*{2{w_Zpu&ul8iUKu#c*-X?3Mkz)P=X6)u(N=pV8sG?@9abWi2D
z^aFB=h-I{ZN4+?8xBuA*TWx@|!iq3BI{|87y34(}5y)Nb$JH-N?n~;2O$TZ2J-!h|
zNlsk)qA#hu!G)~-GpRQD_9MuLU8~^3F&|Nx(@NDTR4Mu*p*d@vM=D#zRdNEK@DiJ2
zsiX#NJ1Tsp;=~LjqNT&9c(*h?Nk?+n=!)W?#h3TFECs$XoC5ED(<59Ly!vf;VDfWQ
z{YaNP;Gh^IMSF#Jsj6yq`DYr>1h@&02mA)63Rj&E`5m-P>|Pdj847y0wu%h5!z65f
z%Uq7w8DOaZi1-Sz`O>mfT7UHB8i#fu<@yYtV(4vrX-L%TaBI3Cj6|p9mX;jD&No8J
zbAo9^anN*5^Jay-TQuA@PWeX3muqRV^>Ga@l%pG)<Ex6|wh{t?k3^(5pT@4DN4zGr
zbPFlVx+qGg>vKBogL_aGb1U>S(uF~}%A{-RG=WWvBw=<!?#|LQuby5sZqM{QpGSfF
zN+cA27#ku=4=gHeRpy_V7vv1M<b?Y1V{^nX;qIX7oW|7;?f3$w*3wV0a43a(B5(oL
zGbs2fkE3grLNVB5gdZ<6jROgg5z;E?)cc6?DCfd%gTfz66?BCO@C`Zr{Om%MXJWXE
zL}eSL2Nm?@)|mJ!*4}<I_|VI-*$c>7@Vib6QU8GizLovzvNpk9A5CYZg?faW5VU}a
z{<&^8QCahRyMlX!mohUPttYN2gTz>{{^F~Wo{c~RUFs#Ldu{;*x^gLDjLTje@l&hm
z_Gp3fsFH1y-dqb?a#?cAkZl-G?U`sx(+z;4KOOmWUifya)i^D_b*kN?Uqt*mt8!Ui
z^zXIl9+=F@RfevQX`qzZ-2Fl0!S(;`FtvjNx>50ReV@90Q9{;_+Xz|9?EbdD`udQC
z%i`smxAdJdN>iZ?cJ@I}(>LhO7Oi7uFG(})a+STc89imTxtk<=Av8q2o_kxynxfm$
zSEC*tyMOr1OP2F<yq1ocC|y<HTLy45jLhJf`WpMrgp)k6>E_eB*H8PyfrU=19Be-E
z>f`;md<y?P)tHe)32%aWRQI7qbsoWb-U~gb!dKX?{lBq$=j22vUO<MW9%5b26pIan
zkqqyZN~A^Lh1_^<jdVj!fu#@qK1z@j4GhL>CPZGsx${BUbe)E{PGpQ{sQbGp3%m$|
zer~e++0?Bf$dM<CiBZWw_~VEm)c{+B!Q5&HJJ<QQN{y4Ynv?sPS-+LTsj|zhw|bYi
zay@5)&M@0O`;DK{VM0GmJa%u-2jZCNFp1dDswx$yM^e-V*87<;>kgtY^xS2~P8S5%
zyG34@b(OU-a!lWZxvxhR2%!|&E~nPCyxJGl{86qxQ}0{13m-BNFWj49)!G@4**?#<
z@;kXeR>6ESY;f(JS}e>UXnVEKFb+TYdf)vr3LJGUR*+yH3tp~lr!v!hYm5O*IbLB%
zQAFo>I-5+)&7I5+iMW{b^4+50Qs9SpZ6&6yogR^5oB#gqu<^r^5=N#H@scP`q0V7;
z?Y2qEXcpIDCiMi;cW|Ybz>*P;^aXNSy8Sj^^;k{<>v{}S#t^(@Yiw0FYVPaKa7kvL
z+$t~8TqDpj$Mia!1(UBx>uhtMxeR{By{l4*=sq(VN>h=!Z<YJJITl(%k2E2Dxleub
z>&+#{oNe0d9~N}e71Bo^ET+=8^=|t|EVo2kln$p4T44bDd$sSc*y)KJ=BqIu{PZ1@
zi$(UyXWyAbHKn(RQpOsnaEXw<8emM^_468=gkzOS-HyAgM}HPd^v&^o%(iJuEoB$H
zo){16e;fN!i1K@)z(+AQ-)bITU)2R-@8(bV1?AgyahD;MKa^Wjnai9ar`n|3sw&4p
z@0e2f>sTMSLAi%`OBl_jpV#N2x08l(azlw-47DH88kQbFHa~()#sB!>`7d4ro!=6_
z+|C}u1>Qv!3aq33Pp*$#pUmX6!0dG1c115(r`0x?=<JvGeAV^xEZeL<rqXKk=kVve
zuf9W=p;U+7f5iIN{9xXE+h{aYjM|Z65JgJQqwKh704^tzX|4i^HKK21GuJhK4?p?y
zzCv0s0Q=;35O5>a_2+$lK!PBr`CH-wdD4o=-Vt}w&U_NSu_>W2QBs+5Q$+S~X?)gN
z-63Ib97%pQzD;b_q{39I8jc_Gd`R;I5@6;zu`!d##2lTx^jh%Ib#R`$CRSRQb$KcF
zrfVDO-CvxMJliXb%?0+@J&f=yJ#IV3HLP!vL>)JmT^j29<XYcb(D!NJxKS|?OD5ws
zUW?zTNMn_$E|hfr-QXD}(gjHOJJ>epAvAjzGb<pQM^3;>(c(Jq?>anWxJ@p+;3GG^
zwDfyT%zUz}c&<TynFB0ll#^{}F`XEnRy@ElTRYpmqMXy~<zJCjxNtJsIX^dYxgHXH
zncfW3u6at5idARYcEif<=K$+<ExRqVO}xaDvZ>rvnQRMFu&xh*eh{9f(pPW!av3YR
z1hZS%o;I)Q9y-8>i(5>~D&Fi}L|;6rbDRzBIS-3?HDlgCSfGWu?(WCp+rOCqZ=9F%
z+4c#n$KfIVF7KRy<Z-(WMv3TYaTfITB$5!g81!XK39s~d*VEfYY&jsOXUb#MI1`vq
zscb!#Gn#igk(26zzT9<Da+-^%E87|E&apM}1EC^S!=NYWTCxHU+>S_K=S2?s)1G~z
z48K*8i7+Z1iK%q&#=Al?(n!Oa0i_R6r+YZ@^orQt;%zyP7Ug2nLCw*U^3}sm-ikO<
z(Is!8lJ)ldLsPlA%V9nOuZYJqX6=D>FL(M8uk|Ph{DZy<k^J%~((x{LovLQ9Y!ztD
zy?EjCX5vPnO}5vmkoY{vMNG3ll4norZ1?&`=HPqlY*iyF&UN-Rb&su{*o{RP7xV~k
zT_<_+80K4#e#V&dlEi6lcG~8+O>4=3lLLZ~>_ZP8T++u$B;Sf6`zNP+<v~-<{|F<O
zkhyC*@Y%BaS15N?M{|UWPSVcR{r!d$O*2(nM}An)yCBVF{W;M<v@>+0Y@H@oa_&qv
zg&l%qawbOlt6+dE?=_u@Ffk!OHgg_UCi$`3&vLwqpTsMl(>T|rAiH>t+02&_@25Tz
z(Y~obl^e&{4Udmi@!1(gy@_g?qTKG{8?EE3K-3xUtKl9Gng}i}$3YA82xI<jHuwKV
zoPYV@Jk9XqDJ8)BLq!u7;ZaRzev~mGN#z^kG8otk<<B7}djm`2;rm_XxkX>=fY6*q
z0855$LfOuSa6of)&K^Gz(I48`yAI2v8^kbdHi&cZi+1^CNHZys?<f7((eCJ6HH*$K
z;)z12tN&|&egeH57Aj8*l-~rVJ!ZrEue3@Tm8rFToV1EbdbrfyRP?s~OoU;Nb9znH
zr>Tvg-A1*dr&Tv*Tc4JFHd6Xu;oJrIefVuF<#5Q2HP+qul?qs6&8P&q2FrU-KbBKs
zilG^(&S#Qf`*ya0qMz>UIcT|vC}7&vF|Zc(Y2Vn^QH7^wuaJySRc3#_4-hE4Z%T)Z
zX8w6x|1XYPmdGC|J|2DdV|+x~4#j6AIPr9dbv@l!&dgs#ukiYGS*qx+E#jQ9#-0$_
z+(i9a*E3yLvq#~u?iygTyH2iA(W#xsO_6!-^uO`~xFlqLnLpTEsq7cQ+ei~JA3v|=
z(Tz>NjBwqs%4Q>iB^hTl^9Jzc;?qSlGcKPoapTFUeI=Gt6u!tD67#C^nL}o~|39M0
zzs-q0(njHPb%2%Dm?L_#DWSW-XrzmDR1k7pR#63Q>mk<T8&C&iR7Y1PY^FLRU8LZv
zwoQs+IY!MMd@pb6#QT4^NWH=L9~A!kH|ziLJ^qaHhcN<1Ka8Ln^s_jF*K4e)>@U=7
zXoO+BX#Mb%v+UEr^%YTM<c4V!4+O6%7YW{5l69+QaJl|I2YQlD(oy;A%Xp{68N*E7
z=d{lMSN?$u3i5wymgvWGaCW!~yuXOZ*dXmg5Hm7etrFJt1n4oi(tI1vO7tEPoa;q5
z8vZ70xEr;d6=+8nHrkDIF}fm4B4l9{Te`StozeKe`i!~g^hnQ3Y`k72@=@wx9AOk;
z6r`6^7S}CDOJhr9Cc{)GPh8<0qC*e!%@3rcBIOZPl0o4TT2J{AOjN!s2El8esdc|o
zPB9o5vj^I~&9izTNA{HRCRNa-QDrWk>s3MG@mNTaeELRKER$w}hHttEB<EARMCfNH
zg!IL{(QgHY+dVx2HL_j`zn^D29!7;b%%|8@U0DWRg*H4Qdr8IqLjwfo<LyjH#D2W@
z{t`&N-J&vy)+A>8!({|QBsZepTzeLTh+r7lTYGs9OJfxN9_h!bZwBm-H=c*9By0*1
zV<uzlf4`bGhPa=dv%=QIZuiI{Y=Fxuh><i9v5StJ<{DSgP5(gbio9Xrt;tPj?XNo|
zSGTy)FfgS2GeR8^K7C(VuTrp+o05^{<nn1WFs7AiPq#!#ScR8Q5gxg)EZU;H<fGH_
zSlprxN)OX-xN_)GHYWcI$P05nFfboHrHWO*q}6DhRB%U$^}ar3WSL`u)Ol<jEX5Nm
zOty(Ow01R4ZJXI`Oz#dE{rFM<HT~z4{tHB{cbBCJ#k!imf-BAiOD@Vi*}@=r9JFG*
zw&`LAy>(g-Ji_e4ibfNcnQ|WK))NFh$D^2ATd@5+Hp!b}5jH|9h}9%5R$CBU>Qk&@
zk?6VAOH49(>C0j5j(pNL(a%WUsrUQGRQlYy&$ik%{R;v&odZLzyNS5U@^jqC_!7sJ
zfeHs!i?X}DKhs|!<qIqdK^+-U9_`k<Rc;bq-`t5p&#b$@h)4@fXV1VwujPOXd?@Us
zaI%;qn9>)Db+9~+&&)Qrz>F|-jJ|ugJ*?a;nmk#kI^9UVR*|}~%<%F@W|F}V^&>Pv
z7mHek2Ca&e-k-kME;Y|?r+RwIS&!ys(W$?D#mcl?YCsowu+3bA6npgbcV1rKRl)9y
zS;rHNAT`yyGd@Hu$giIqvV$NygdjO0Wtlx<M>G1o?SWuhqwu2|5`dy5@ip=zLADR5
zm$|kWE<30ShJH*mV2&@EOwd&N+`GY;F3x8jq-sL(nA-Y#B$7gyd|SwTwUf(oiYM=x
zyAK*pd`fA{1Tt2=#Pa-L=yNTdeBWm#cvjw-1Il<m_EQx*m}PAxL9giWW1eo#E;-I$
zau0{YT}mGkNiMk2iMtekA@mgwy<7<Udq0wKJs6>}7JEE1CE@;@kEAGW+2If3Qd%X3
zTBR)yfZ1GAkL8Zr0f$|`_=4D;zK$0v$=`+3AyW-wEz{x!;I-EWsZNjoL&k5Xsh*HG
z6kWD_JpP(Q85Cv7HowGtOXc{(cCKF4Q2VTSSEVP0R4e0HyU3nUP_fKmck18ieHnP2
zlwGzkd)7;905v#w7<pi`L!UuAq@va`^lAAEB{^;21tD{2#^*OZJzVR?<C^;~uznp!
zN#e$88F`Kx?9Mr~x?kpa2Mu8GIrnn_A6eZB7uS0}>Subya2SbQHXFM3n~x^>S#7nP
z^w@BC={98yjnw;Bm+90+>$|xL&Nf?Tkvo1;)oHnLA>sd=RP23<jQVyRnxzK}y|SvU
zHG9);59QL6sahYEH-Wq$$_!D1J10l;WSbn_5>(`$@a<3IhuKa#y))ebLv})Et&J8k
zgI~u^?F$X!cf-aU9>`CS)ldWXfj52pHm%C@sE5%#Y;$r*UM@%c;Tf01fhm{8`tt)(
zzvCP&*?mu?oSTyA9J|AeAKESMlKfx2+*>-88WsIq{do#qcG>F{lP;jXL|Ac&hWat)
zbqfF2nORooc6&w-Yrda)Ny7Cb@$T+aMQ2J$D^uJ*z}cx_jBBTzrgR|nS|P`D9&plr
zd)Sry=O*dL-e`_NuBRy@5P;0cKD+_8Q5V9S>X0z&daIWg2=bSkHPrJc&|0%d^ti(B
zK5tGTciB6xlwOwGohpr|d48BMnc+t|i4pp5@6NxIq(_lwg0G&gad=pfj^O)e(c6(T
znCF6!N?Dv9_elxmg?CCe4NTy>Xygn?G10~L<o({l93r)PBkMWG&SjX$UgjDU=SG6Y
z<f{Pfx}Nm%kL@heM)zZxf$un=o$nL_+aYeLo(Yz2`?3^Of!H?`2GCsmIS`d_h=JrD
z>m4>aQY>4?$fDpxEpYD9LCE&9dkiiv3io}RHtL_~$VM7G55WLgHwJM)B-x5<3UlV!
z$N)dB#C4O~F0#7~9_rgHArvpLsV#VU7q*6OESqmhB(iPmx;F(9yWV<U;AA5RqCC!O
zQLAf}?<jWh33#`?(2{Ys=N?>J(*Y6w7o^XOA?)f1TnTolGkmUp)14C*m)g%by{xV3
ziAxMn+SLd}XC`gRpV&D062mqdjqGiq^Y(T!`?JzbJ2as05;$S^djVf?>%EXhp{^Pd
z$yaaH47e?tG!hsaFP*hD&}|H#^PN&wqpa#+GM8qnZy2+4MlxFD7?|&U_nbI6wvlOO
zjFzEpg3e?;7kc4a{=|6T!wlYr3Mp_b+D!E;fX{AjT{&f<Xvb3ca2?I{<WmyC`oC-^
z(OaB^ym%{{QhIJP&!uKa&iX7uSmFX%5awpSwYu@ulHbgEH@Aku|M`3G?=iCmo(pT}
z4SP|JGm3z`RQKHK#+E8Y^4ll^MGn~&T4{YFcGZt|vzYKEWW5egjGD5jqzn!fD^-c-
za<n}fm2*-YGLuDCjp!n^1?INLS~0yfE*&GT!NB}d$NLSZx1e|dnXgz>j2x_nOsDDI
ztfg4R0L2s*%#2Wc1c=hD`mdEi$ANayG8jDr)=z9}sKlywh%?bw=!u{_5NpjuiWYBa
zE;Vw^-rZoQ)T(y0hD>O#f~z8fx#Nl(i|UjCJf+N0!(Ozrr2O)!m)k(~C5TrLPl;a&
zT`L5bij;CZ?=R&uC@Hcm1u9f7(!0p2X7E8m&TO!lLGC;i*TTQpKk{Sb)185Pjz>fe
zpt0-9J{g?J?;v;iQn5{`YQb^|2%?c`r}2(>Zl~v(XGB~=EP~f@;~N)|9&+%~{kT8g
zk~rg+A05)3=v?mepIl{eFLcd)q#*RtONtZF(!!c?si@mOwDa;_Ui5)KziIux>1cd{
z;auOKEOXIX)M;pQpr3}~{n%2s*6MN5C2)Cm#tr}0s#ei`$sAh|u9WiQkMQ|^oe3d%
z`1FIMOkX(jS~k*NKk5CtywMTHK?o3PbhRRpT@h`d$+Z8E6Tl-IiZ{-98`m1u@h{2V
zdZlsBhw+n@w=}*=L`wu@=;rJ5qxC8S#XiC@!5@f3ZD~`-6DH5+F9%0MyM#WGyoy2a
z%gntUeP1L=X)bF5@}?Nb5B}j`ZjtEXdZm5)rBkru#ew@RjTyA_-Q6rU3iZVi)+QQ4
z2a$TndL&tS_{*5<wqKgd=|=xp6s68~mNsxAtFEJ@PLN|@Ov{jtF~ieh9V5s;ekTax
z*<Y2ll<L*qJ>o@p$biZFgvJFq32Ag!75NFqfGD+m81}jdgNsEcMA+0*O~$SD$MYK*
zA_NBn&1M{Sr-fG&Ppjg@?~oYZ3ohbzn=7PVS2VpT(=I#$wK286e0weuB<|0|+pcEQ
zHM8wBxaoC4L5ncb9#H>D2R-NA$@xtA=@nL6TU$)2`D++=s$q)^o7rebUKZ672dfTK
zR9mZngmnM&K2nhed!&-`L$g?4a);l3yU;8MUtXhVG8)OT4~7fEUrMzE89kXVrO*Q{
zjb->&%KP5#YcYSIK0PA$HIkDYSbF>o2D$6Z)|SkZKMn6?mnx5L*F2!2IU-_DA~PPV
zK_CVHlq|!<O`Tz4uk#J_u{IBW>xtqLy0Qw@GF65BQ%{m2!?exeI?0v=k|srqJ@23!
zHVfdQzEg^zPXJxRQNZJM9u-BVN%nNm&atOmLrRVVTzO;-SH)|+$<2lW(ufos)9M%@
z+u;h$5@<|L+_(MRT;3CA{!x7XOwE7Qw0KXL*vXXy!UqQ8qyNCwaMO5lGFI6=>axC@
zS_WUau+!Tpd0p0ED|^N`8FoIKmk}=V-S2+G5@}AwHG#S(0=ZPF!#V2n<5K$C2_a|D
z<R))hETS=nYn!&~f#~*`>x=oC8!SZU(<vlf1aN)fZnyUn3-J7qjHD>vuZr7#XSe=(
zBQYa2n8ENj`XSl@0{vY3tNw^Q^#ZjwvMimAVbkQ0FWs$K{PuEtbD;bwBuq;f#mo16
zO!|o4k~YvX!!p>iYM8<x>k_LLb6-un^=eNIwC5Db&qdiQb7qXDvc8g)*EgYax)G@?
zsy`p)g?`9W`oh6-=be)zFezJ{dabF5s2PKvC;K$t3D#HL`$howT1w>slcQDr06AS4
z@?I4r5pfM~!YOh9iKx>&5C&a}7(SXZ!bjm*0gSANx!>JLL4|diB{_tzRO+4Jm)Ms+
z4*eQC6u6paEgp|((0*K$m<JsLx4({#{SXo)UOi8IohSJ-H<{_jL6!=e6G&Dw*40rm
zaT14v1KCBje;gf;owrM0gh7~HEb%AJrP$XY*)ik#LHhHQ9V@b{@aGT`GgS&WN?*N=
z4jrC5|E?V$w@eZ(A^VS5<ql38b?nu7HR$)^v4B6&D6XfCv~582<XUSaZKiuxFuow}
zxQd6?F`}R+1TG$%u~lLdF{i4LN)hSnm3{qb{G`N3IPb5KU$0NMWj5P-|I3~CZ`TDM
z{x3Shju!+^x3ib*mP>9mF=oF<9@+lRjwkmSI*y)H5xe=&iKaM;_tHZyHeuhje`m4s
zeG5$S=)-Do0Y<vwUlwVFUU`_hN%<p;Pb9SM(LPO0FW1aE1!r;nhU~3CnLHN_Dvd9G
zhc2rohpq@IO`rbOOKdMrq#dAzqY9Qfrc3LM8~hE7;*N?9_JqQ2GfM}*G1E17cas>u
z%$Eex6etUA@K^@mVOyrTq!X|lHn`kASDnl?AOfY5aLSQf4X5(G*R4LF&a>(BuNr9;
z&&_A7?H}ug_b2Z}L`-L6n4MaZQm!-|w#L79XkP8}$k=N-_?oiuS2NksF_yAj-gTY5
zHAtJ6B|7JUhL~W8RLUg&kgS*JT5H#C@>K)9MRK{$TImN=hTvf9BpA|`Fz?PrzLWct
z<f_a^?uf|SyC7WtvLc4_>0*##77HETwYTxXTqxw}*^KF~-^MMUwU^6QKO!B!9fErh
zVO5n6&WhSyK7l<F`OpSP{dGI&-VYO-Ufp|W0T>KMAv(R&a(P{V7h@!eU8LP9cn-gb
z&IKE)Yz{+?M7MrOk~5E>U~JF@<Bs(weRhiFnd0c6)pwdi?mB2e_DxiX_r2*6OOH{E
zr0<M<e5FWy8s$0BYORsA_F7)vw|VC|w)Ii`*S(pYz7OcCVhTLPs6N{74l(k8pq6(W
zECy5fF!NGoMvBI>nCqPy+rwn_X{EmBJ;bKNP$#bssK!Z)PA&nFRCMjb=@iFPc`DoJ
zNd`!51c4v<fWer)3P9PT*qFZ(KSca>^mOn#!Ldf!OUZ$^m(E4RN#1L-GQYgO#T-SX
z)V)UcK|e>f;O&Tl-_b%b(AwA0X`Ub0PAj$|MG8>Yo5^E;@jKDeGyTL(TqtX%{NBUn
zxEQ(X?{-y4%U8B_=N5iR)Qgy@2%ABq46`n46xQ$4E}bZEbDo-(ll~ig4LqKq8`+%&
zVADx56GYUMfwNZ4mk$rvM@$>;*fh-A?oBz{Ah^q(dTe#yf7+ck%Kt`6I>YV^32I4j
zo)kHGz|*5}`}yW{!}+)8FI$&O-mZxD4ZKNz8p|!8PPT$#yl`FGD)f~q(E_{B`YO)6
z(KFYBM=<)e{meRvz-=?;<y)GeY$B-7Xt-Ah+R3+RL#Gw35v^xr#+8vC>++M*I2s(s
zDnP@Hu?MOShGTD<WFN~bHwmHtO#1%#5&B~t&>;ITPzf%mKCkii1BQdS2A6m5^5$fU
zeb(IiPv;Q}{mPrP?vyTw0j7z-W#ci6-@dRhJU6DnEUH09+{!mJxS|950sUE#+iJ=r
zW>wK`aj|^2+5HN|z1SUmRD?G0kxowPD86S<tS{Njx@Vsd4KmHk(s0pz-ys6iGiC<4
zqujvef^6UdjmBMl6L)TSV#*mB@*dwx0lC&)yQ8-Au*79>#2FRn0KT2o|7d!B@mt_4
zBh$8LH0HHq?gKi%3ScLKq+l>*a=t+S`Wt)hHU}yE*!o^oxmhc$SDt+OuZlZKdhSZ{
z_#i*gy1R;^M%7`N71JAqH6G_^7AiEYb=Q}bI!!KwF4Z+5hud_vTh_9^`fW7_v%n?t
zAtZQ@_JY-zc|_ghG!~{=;IRT%UVd1}=hWCHG{zw?p9=3s_HH&%`k>k<ZrrZQO7;!I
zCozv!Kju)Zh%XMteOhgdA~MpZ$79AT#1mv>;l!>mHPh52em#!d(CB@a>1#s&WDr_#
zIOxQfTCDJu%JDK;pmH-h0_WKLm{>9Hc|4T*tK(b$Vn3^ymVi9RoVUFCTai7a3M3pL
z!oF&Y5+Q+SeI{arorKpkrXPQ~-qTS!c5O-jel!eqF{1W665?%Vfr~`2!GTNO3L4C6
zwW%4ewWuV*>wkl}Mv{a^*sd+f-CBz>T$`#Q$ac@x=4+O_W{*^edv95eyX)mG^(o!E
z@Y&z+O$!+$dPuH{zn!i3yPr%XrvZ_H+a+HSl%jMD5{U@$GgqKO;+XIZ5Cy^SIL+}-
zQHQZ^rN~l^O0rK(x$_!nLlgnQczjzOrs+p)Wc&{+C#~u#)=MP(8u>dSt`I6DJ~9=5
z%sA-=ddW=SWxA04u0?@wZ5QlgapW#`Ud<g>?+0Sc1PF_EaGCMpc$*5k{`61!749QZ
z`|c^4G3MyEccDF1YSPGBI)~+zkUttrQWJKh4rxihxbu`;Z=$|KcnpuPi41o}2p`oO
zlq3u9&LkI_;I8N^E~Y_x21CwaWy)5V=m#$wO#-xQY9^XoPwG`wnb1S54vZq^A{LrL
zFKv-h!_;fk7pWdxMQl-8XV<2cC`hwuqz)vt+j8$I;9$D@+!R@5(UkRpLIrqU&odob
z-9n>bGvQXRdj|pVv$w5&CMpu;91$S&Xm*(A^ZU&^eC~MfZWNMYsCtN5QN#am3`(ds
zhRU_^8u^eANg|uvNE57!l$~!X9gH=Lx>N*iHWD@s2I#Q}OW?bOgaCq2wc%{V*v)-?
zEH};Eca&`INFC@^yip7I!eV#Y$Tw6IoPC;ReEv@y=Z_z*KNhYrSSF*6Cm_jNf$R|j
zH<TT5l+xoD<6x~M17*8oG}&-Wn>mB1?5IXM@)*q3dCz6xAgbZPE?pz{7p4q1{Ly$a
zq2Gw5-dTMuq02QzHP*0#Mw-IB#ZbQi=wcFiDDoC;Q^Y`XCpx6AdlL7)(K1w=K6AnM
z<=#!GuE;K;F_|YS+7^KiGv)2wiTXbVt%k?#atSE$>TG3eVC?4X#e>nI8e0lF4E@@M
zNafolo|tJx1YD9zl@0bdF}(#T`Q03&jm#6poVqV2Mbu|Q<370n2z_TN+exTItd8wV
z49b${$+wLeDyTun@AiJ@hMrypY?)aD2bY@MZ8v0p`O7;lWlHf3UQa*X6nP`vqw`cf
z_FZmt1CyIKY8<Qa4n64H&Fr(}yJy@Z?({NF2AV?v*ZBCoFDJ~9DM-xL`@s`uK3>zn
zAK{641_8p(6kS9m)8#qr-OJk*mh#ZAzdA{9c|<6V>**#?Bn(8}921}v4aSG-<_}&E
zr?9bvZ?RO^VF1e|_zygFI@ui~TAPu}GaDgu@uiDXjkXjj%LunqF|*#teJ*|eZG|`)
zxddp+NLK}&LEFAJv}eMcSu{NkHvA1gIIhB*oWl?(a}EbSZWZq5p~N2=+t&&l)Ga@i
zAL$j*pz-uM{5&uV{k>|nx`N#hLqc=+&7|_G;e~nxv_E>MhOFL2ZxeU+=Hw)Y9d`VU
zk=u;Kj3xGU)aL@I*eNR~b312|Q-kZML|w5@gXf#J64O&;`35al65o;!<C5CtV%@Uy
zaRCP5uNV))o(RYjq?0|kW${^YDanH!jusH1KBH$KobGyJ?HuxzTKlHMCE+y%2H8=m
z@=v^-P83|5r5CpE<hHO^$#8#{<0`7Z!>MYtuZjgLS}u@lpZ%~Z=B$VpuqUv~6|$^c
zLrU8Nc0w30XcUI52qmWWimr0#x+LmC@y=*WFjND}B}~ih8~X*;TE6J(TnG_iHr67c
zB(L5`V!pok*$fS;=EOL>uRN?q72m3DW~uGTby~9A0xOn%Z`oc_nO;Lv{`f%o`3^g}
zLSJ;eQ7_V1h73x8xmw%fqh5CTfs)FpQ*l;I>w8;^$7YsmE5C#iEagDyRt@plX^(|_
z%2MpVx2|2|2+C_?$5QwmI9|JtL?1p6vE|FELIlvk@nXe;sSFpCc8-kN0&ea>NneK?
zx#z($jPnbTmznrSxe5!{K5l^%u3bS9ABuIP9jlc~E8kN*;+tiuXjb9XE%V8CQNnqb
zIgt=oeD@a>gfLx&uK@0U_CH-Mzo+h$oB>O({cDkV1Qs9zmS!{N6c^Ppku!wg8jjp>
zspcyW^AWDgLhctlD)qh19!{?@Z=8{^B3mIh5Swu_339g&N^n5L#R4*Lu}!<eb$k1(
zkgWq0krSLv-(9WG_5&l0h$w{ln`Z5eC~A<8a%Ir37-@JtasJ*1oNIHlcPV?~OsfS7
z0?^B4z3tW7n;uM}SvWrIa_i%toE@bF?X?cTOQ2#XL{_ASKQ2{D?DmYV{W+mY$nU2P
zEdJ0x2I!%mp7~3rb~<GRzdY8B4wH{}N1+(>!#C+2`Ea<x9jBcuCLvr?n2=c7Xsp~j
zpHi<Bu*H(i(}C+2@-ak%uo-%c7dY|7s#6X31V%Ny-j;y(G1Gir*gX9!K=#hq;X*(n
z4q411Nb7u$?B~D1!U4NhzW+|;{!Ajo8@*S-HMt&AofC*}CbK3KpQg1;va@mbOLA@T
z#HG(gL`sPoLH!K<eY=b`0B>QTt_yZ3ZQJO6RzVNDJ;@|^ZCh;~z_@OnGbp97#YR<m
zRJS}WjH@_!3d1wUyTZHeBR!8YJ!vNr!A0i1l9V6d>Nk)3bG*LC?AFcIgk`v8p9$&6
zN|XjI<sMeLBVF?rZcSl8=9jylgxp1LX4V!^LY0Wkc-d*PkEVLO%6(%s+3gD=tZnU8
z%RU;hX3J7?*rF|^D2^bV+H*Nck?Rx^Wc#K^B&(STQ}WRQC-a)Ztc`;sys3qy7z^&%
z;eTbue4hsdi*PUDIno&l8s5liPVdLX+{y9UV{wZthEX`FuQS8z<=oPWb?cQoC$b5a
z_!X0|D4bz&8d&$>&Sfj_b#?b`1>W-=h7m54SRr3wcPjWqC}Xoq1eQ!NAI+I|$%h}G
z-q-0YHlmcB*^$)W@IhdenTvnCJOyDN+lI!#6Nrg^@s6x3i5b+T$FpRvC9>9cIPGt6
zZ#D+s2y^JJs&G>t<!^M}VwqeLrR~wI!#L*S>G_PuLh8GkGk}k0ghYJ310N|MWhaUZ
zVP37Un8N0~lXV6eH=JwnmN=TUeQvkaPWHRNS&QyxDLMpei_5HW+MT%8<PZR|`w}dy
z7k*Ui*vV&Sl)olSLNl}z+vS0q@{q%VcNTTe;HK#PV|lRIW}9p|3$ca5zHB_hzhYoT
z13*sup57Q7wS0w2eDtxb@AzlW<)5~ICqS$R-n+bu_=k?HG0RB6`eX8OMYBLaf?~*`
zRF0JCo%2c{d&E)L6lo5-3AT%Uqozfhx4>N4+Z|I_v)Mjk%Dc*1(MxxK*C7fy;B5)`
zHH$PEnwJiC7N)wV%+?tCUK)igD~M%cpqq*>NSNr~bl|Ebj1VjzVKW%u`wq3$tZE?G
zz9G^e&Z`A(%SRRLs6QR(WD0vInMKl^H^Zs68e9<0>nLO+6s0Q!N0H{qqW30r?_?(l
zl|^RlP=XfC()Ap+oV`Pg`Z#2P%~xWY0Y{|gwL@9ZY_`xmF+)>UigYn^*1RT$u9pw8
zq5cZ;@d+Pym=zZ^jIR7687=i9SZ=TLDrP$3@&fTI{KK|*C5K$6h&ym$VDTCKf*&Tm
zn@XXEF?ix{xF-%J8?9ws_>4|k%xPlK72acgMsY5f+)p!0W$(NQb+9pAT7wPP@$L%#
z>_6EH$>XP7c!TyjCOqmzlxAp0i@D-^(q!?N+}-=nZq#+?i%;+om?+CCz;3{sH@jxi
z(f1dGtLK21l;8fE9e-7YZ<VBpQA^-(Nqy1mlz_=1!}pTf>xttdA}m}!6QjK{)&#bn
zzXoT(5E|xXS}LpYG2x#AqJV#XJ<r;BocZ#@EU@6@wfzQ<GWFTa+0f+-ii>P>5M1PS
z-k{5D^LZMwtn7FF@3$hcc)_7?TXr9dhRvbU`6Yg7q!;#iFyl8h_iVlKY58DTv#$Ll
z!vkx@BTwKK!r(=6itPek-Gvo{Y864B0AG-qM4#F9ShvuWitCCiD?Ae1S{a%ebYFgF
z20}OTdoDWOU$V|(>VHYUb|sr8d-{TFo~Xy`((qE~XPSr3TN-yEDb_<wqnXrjt`H5`
zOBY^114l8j&h7Ab)-nu=5LsC*qa-HI0{xnV@Tn*vXdyNE3*?SrDDhme$@^afxMqM*
zZ<;%d!(@jk?+uYnjL@SL!{@Pd7m(YM*P~|mE85yR9Vpb9{N5{Rr-hzS+@`X&qT3kd
zPctq3FZuUUvzLRw`-DYc2h7Z*8TxYlYk8qeqFd!0Y(Oe{s1vdTO)9o{{Z#pw@vcuY
zDZ8eBMtzxtbNGn=AD2^LfOzc{sC(UE0~lM4>+sEy=V8+P2#t1%NSOa*s!!+f=euXO
zUD3`(rpOYy3bplUKCdZ^oevo<W17=KRyR{(e4{H1eJif>({GW?f>-3P457P_L=59V
zyuzm)(<tzQQx2vaU^b|cHDtPguvhlJr(_k~z}K;IMHPp^iAGQfo#YqpSUiinC)fLR
zpW+HxG9GJ+8q9v}>sldFtxJej{7gA=>B1c3eKc|jCNFPfA!KG%v=>#=Rvu08N%G{!
zP+4EraWN<*nea6*yP^|jvC3qqzw<4m-mqYW)QYTfrdecL<#~$?-?t7-tW~&}4Dlxp
zigtyhjr%TD!_sX1pXL3pQEIw>Ws6XRf7=<`t!>1Q!-wE0MXlk9M4i~`N@r{XIWt3H
z-$|U}X3Dx;`o@8A`Lwy*#NzcD`Rc<#*I#U<v_HdpJ}bnXaW)IgU3r?_pn#Mw4*dM8
zld0VY{;pndFh#h1rpyJ`1WGzAQV*E?kr1zXsyXZ#u^8jkM|omG_QfD)?QLzGXvJZ2
z8ll*WljVdn$sNNo%F|6b^!NNoxq(4KxbcWSTpGn;6j{F1=*ax$D_xOOD3N(iA@8}N
z{=V%Og%RX<x(Wt#M%>Zxl|}oJmrc6((eWHGE;YeFx5Z-63#H$Q=|nEAA7>e`>hZBu
zaRz#Lk866=*N^yKp~>!MAlI)1-5<?=a<*D*beI@-_NO~PrZ#64*F3eIDqUtZoo%U4
zY5=1V2GCUP=CTtfwj9V1DI{+kMeViHlku<d);br}re*(J6)bnC>yvcL{AzrC+<TY<
zI(#4bp%Vvcj=WSaiq?WFTJO!aD}=7QcToGxq2&Un8L3$*ju&nMH){tydT(v+PLGv2
zihzeqqrsQV_wA^crxw^M5|qXQcpb#Z-o1C<CuoNH-Q*3wANkVRUr)$ot%dlpT*8`h
z8_*_gc=1F`@B!T+miF2rg)7)#&@8~2U0pfi#>x0oe($M+n*b<;?7rb^VZm~}xl}IK
z|6%N{gWCT3^!*B@P#jt)?rsH&YoSGowYUa{QrsPiyL*uohvFKX;!bcUxCFNV3HD8Y
zyU%a-`RvZ@{`sC^hD<UiIj?i>>$<tjGF)=IucPAcS}Q%;6%JP<-l9VS6~@!693bVM
ze(6+F?ql#{>Q)R>E^fCmT7(|tH6E;$HRPKtcKh6)hQDneUEikzr80e&DeqT_sIAAP
zY+IWWkp9^$Y+Lu2n=c+U(O5115GrW2J~&SI=puYRL5Sku0JL;C$!2?1$mJTb%gGxb
z4sCdM%VSBuMH8Z=orh+V8t>nuRi_3LR4sQV=68&(`v#+aeGj!1Ej*`1brzIX;u^pG
zngk4rt?Ae;S*XlkOQk52tjm&%d2o+ezU4X<0FC_$)zZzM2wbBFUshSU-Zhl@Oo6x$
zyQZ~8_jfe<hyUZ3&x(_CZoAlScv@R|_?qMzUzzbDA$ZT9t*dnCaUFhR!b3*=BK$jr
zW|ChaMMZeF!Ojsp1yuKDGWnDsC_9Z?KJ_zF>PQ<;^^sBe?NJ4Wv0IR>-mH>|*oF_9
z<qZ<|ZmJ?;s&aPSi}O`MYQjpiJHoeAPI~5eeNUhN48=7_(JE_LPad8Ych~VfeQ5do
z_JqJDAcRo^i=OuWrZaA)NB3yf>X&+S3=TwGVuv|AqhhT(Omtx0bp5TC4i2?Bmvwap
zwzTzKpUX!5a9bBPz<t2y`f6e{)HZdHXBWC-r%MkqzL_SdHJiPZtMGPvTrTBGU1CBP
zb-9|tb`rrjX)g`Ds0kJ+RjUu7RWl#ee?8X&-iPbfp2K4Dt(RIWY>j8s5SNs{tA#KG
zRWNB<OqL2cM#9ul0>_SYg=jD~>X8A2W1&;&b~_2XP)0gipno@6eB;i+%w(k|QEB#7
zd~^%d{HZ{%iHO~U_j%7Dv4cE<I3oyHtX>(O!9*nueXMpPJk?OsCpCB<#!l!O7!F_j
z6_D2YjD>~j*CZ7?{%2WvW~zVyXW7L`8=?qfHzR7T_p68#uenC>veOtAN8jy{i=UHu
zKeDLN!`vL`mEC5J6*Ni{tt?`BSIqQL!gY>5FhDOPvvlrP)5ck7b}BT0v1!mbT5d%`
zR6E=#!h+jJVOC7RU5)JIWH*JgA@>`Ok*hB}l6TBCvUmhvL<Lgz!NzjAHClw*vcY=h
z?PTu^?Hll1Mb;8sPiwFm;2r0La2in_p6%0f>nk4l(K3nR3&*Bx{gY{dRkwj2OK@Y=
zvmhc5`++AQ*+9qUO@@!p=hSER`Gvq^@QZ9h0NS@_P2?T6#k6dr{x8XMuV*R?_jf`X
z*h#+WotSe=biaPhp(6X4g`;P!P1oQxT6G4&I-oc5_KJ@@_zMqP2;N-k6<d!49XG#E
zC8wOX`;E`B$aW70iaSWDyuhfo!SP<vWx4GkIy=KQYw;ssZPVpxg~LU|`9P5Nm~NU?
ztk$-BB#nEkV@LhBsX?1rP7HgIBfQiP*H>}UqdF}_ZTE!~jkqms&2CYW>moVI#INU0
zF^+_<aWP<jFlO(n2<K4<hI~42TkT@UA_nzs#TZ||a>oM%c%TzsoZ4p%pSWU(Bi)sn
zcCg@h^a|#7dDkT$e*TwY$cr_Q=&NOn<qVwYbOzE(5<`b@59dZA1CO6$mfqr*(}KoR
zeToR<`g(4MWvOG4mHcaB45JZxHbk2BtYGzG^0wJk)ZnDLlw4E>B1w$+B11Rs(nQ=M
zbZKEXCH29lIc-7YD7^M)SjJNkWUV*%=4=ZqlH&nGIGyz-8&DFN(QY4$E7SaGN$L2O
z3_p7we5At{)e4_No?|!s59ioVA2>C*9wyR00sXcp-5V9$Rrlq(<#SE8SjWnz;iP<)
zksRCYilfq*g~_){AoGld%TV@OMT%+>m%VC!YRYhf57d2%{_jJqe<kUPl4~;_GJ~Q;
zB!x?9mD_OQpggEcR7sYB6r|h4$7#ft`*=fD%A&4J$Ukw}>IbNmNQd)lwC4>zGS<L{
z$%V!V+x!x~isGzLlX}?b{Z?bX{{TEgvj*5`wM4vO9lC>GuxC_yh0y`H`(lqfR8Hf%
zOT$5V7D`Im&ASd36tpq@mAs#11K4#NK2}pQ@4nEC8)~1k$;y3EU>qO7?RUXP++vw=
zr+VIz?a|(<v-5gE#8Y<ijD5aF-#m3*zXI-)rI%oOhjHo7K*YwvZ@rXMcOTK!yWQ#1
zu>*ByCE}zBowcD!jU{HE;k(0M0G6q0uNVh!1=wV`p@D~bBL-R(b+_W9b!*8D?)4+(
z;YYfrfWtd>_Agq6uh~-GwYO%k4)sP3WnyJa0w^(HR`xpU_$oeAc6bznh!&UBT$K+U
zJi7;Qc@00^L1UF{&l7hNpnbr|%)<%bKAWx-TzTNOymK`9?K;8nI0Xy+ei!LnUwSog
znM+@=PkE5IQTwrDh~mM<B;`V1xw7c<Cye3D=#0dT?bS-2>4*9Zzf}2GL~*=k%JJeA
zZQ5e3E$WjGDMTy`dA_T3yco8MIwzaJjLqFUHKwW+{f@!0N^yu9EOq~kV-Y~bOfl=L
zos-M$cz-gv-I%u>k<c>myi~(168zFapUI8FH>@m!S8y1vuTd2ib+;YMcBAXJ#%t^|
z)=^tVE}%5iz>8t6uGfHmu_#=W&3+IHb86(AzBM%85h3h{bGM!B*e&dgCE9`ej|8*&
zrSHyLre_~>H;x8*a2!|6+zc3M!9FKDIas<X8^(<b*VsYcAV6R~VAM**_agf4<G)-0
zZt2GcZT%Q6hB*P++4xlsRmFiao_Ea8N^x#~{OQ2+zq_Ms%IDB{Je883FZQD)G#dHO
zl<_H8dhIkXR{1Tm1(ad;%J%58X?f1*1Z9PM^shIIkX`3v)Od6ASq*)d_LY4eZu{Zj
zt>ulvlz-)NF{zn#9jKu$2Qnn9+Mg}N7bHr?=+clAs6}d>XTmp%-O6+|VIqZ7-DZ{a
zHR(()7_Z#C2US)uD=n=859Dn4TxJe6kisPls}J>u=#uphbMWF+NFB`1W(sx^n4^fa
z_@CoE6|s2y&Yd=~seg3=wwikQ)#t_chByjKr1|iZ#FmF%iVQFu3yP8d^jvxIqWg}G
zeryMtH&N2}0{TKau5++YSy22?wO(9VuEX?51*+>&kQ==9XY!?dC%sb^e_3)ZBgzv~
zd%z*W^;D%zE0&Ydl|zj?4Smv1S$ODdHac~eUb!*ia8bXkmM=SD0s0}LMA+uD=zt-e
zZP9WwrM|~+M58a@oUL5~mGMBF^U7P8=*{x62t;*3&P7k}r5;YnB7A!d?Bjpf;aT7r
z;-;{0d{<7oa<>k;?$4NWj4^5PjM%LgJvx1_92~mPW_ZBhmRVG8aB!uO{oU`A9M-nu
zilWLLoL&xA+hW(r%D)jCSjBzZtogj(8!jjLn7QgA6bnZ%#q9=r%yMXpdg@hr8|44C
zpconSNiP$<7QN<8D9d*2j(+bL)5pd5TIP4~2xfW5ZsN@_bO6woS@Cc}?6SxE?=zI4
z1#KL>!%FE!=0TY60slUV64^Zen7;HtyT`4S$aEkO6lDPMs~Ok8_@F=@#NPFRMBDmh
zw5W*F1Z^~SAP?^S!#LNDUZN7E=)o#>gwWx*IO$b984S3-oi#z_jf!Ng!qL{)M~0iJ
zzWQ_qV!;`YBKMK`-bVc6b>Mprd!35xa9j}rvB!Wzaa-@l_pRq9B0=<8b)uWB^x}v2
zeu8#v-|j0n>$NH|Dq;^~E@t$v9l44q?_Ec+S3ngG*kUTtFJpBiQ44-Qf>KE7YI&XU
zInVz)n0N!Cii00V=^-tu*6=~UuIL@j$G%;2T+wvKrz*T0cU^qXQaz`tL#98x;t`+?
zEs+At8crsC1yg)s%41)r7%9Z-**cQ2loBMhT>PnDYr=Ooj<;vry=dr^5E8{ii0l@?
z7fizCrU{jJQU8w+Byv4s`r~qM7`S$I*+2hJqns|vLqHs!2nkw$m?~Q={ZA*hR;J7%
zQK4^2l}UM0r2FjP>{06lh=A6W_1<_4me^}uX+G6ZY#T);DX_I_47Lq!?XVa=$xXlq
zo)HM@kFP<VJhIuILwBRj)zMg&<&=}tPVZ)MT#_=dSS?~Xe9}f+FDpm?PdyoA)Tf%~
zK=^1!SAADO4Keupa+&Z=P*jRUWA1>2!a$x3`S#YrX-~mO)a{XMh8F30k_pBaxeN-g
zv`f?bDPI}H+|K_g{vU(;4syQQ<;SpTu&#O}fRFt%@ce}&p^-9eP{>wv8n1~voCe7>
zrE+?jhc<-S1&U2@6_N`RJ_~Rylo$1>)^19+jKAP696PMCkm84Q5We^aJM}-(9Sby1
zcEkSYZeUvJ<(<XtP(@<v720e?lk##Ti@JJe6Np-?Nb3?<Ns;@E$9PWFKGYA?gM58R
z3zfaBLRVy&E`w2Be=seEJnbQ=wRj@UG!?>48pNO<itM_mTbEE+t(-HS%jWJm5eDCf
zrVg3?AQt=A=l$<%?!VGBWVEN1>*BC5?}s<-L>x1_1_T0YK~XG@ztFIvw59u3y;By@
z45xT&h)9EeNQ^L8qIN%tzAPBA9uI}8*wMYCb9BAeZDG47I`vYK`aiw#Bq#}IKxVj1
zy@^ZOvi6;Y5?r(I8F0TgcQ)nh(_!`S-pe8B9?9i|!Vj6hW^xC%-_{U*01p5bzuHoC
z9+p^ue^psLr?%r$h!yIRt>PCQ037B8j)w>xggVEMh}<Xg=_?-VG3#Erm*|xLKFGIT
z;Qne+Yd-1-P3JL}Hv8vn_}?%hG_<=-ydQ3t9!isa>9&*aVW*j=DQI_e-gF+5)?vzT
zktP;kVPtkeb!1h4$Wgi9{&)eI*F(z!)5YzS^?U3|Z8W1O8ZtC2oAD&05hB{~1yu_h
zHf7?gx33%KY4fA!d&Rcv)~Rq;Q~dtag~xXGee+2Gwd*~Sa6dD4FAB%&lzvtTxUZ;c
zyFLEStXf#6R{rw?KF<${S0{B-xS0PxIr?8e!2hz`T~VJoJm8%tb2rK~$_psoC~orc
zLig8M*Lf!ReWz(yzJ2W}_~|pG5c@s=>qZ@U*q#@wm3~%vI3W|I%ImY#@)>m-BYOUu
zspXY(4@I>Qk3zc3x2+2Du!UT*Y7s;jIbEPJ+jL?dpX4G~)!Ze&M5@e>HhRLrQ<%pT
z#nirEiG2CVDT>mk8;w%HC|-A5cbn&xM%NAb9E0~il3f48<D&q|#vSc4Eoo+vL-Lkl
ztf&ZMew9P<bjI6o3^zGJA!(}HtFm%CBqGOreeu)9c>8cP1iY*BsI-7-`u;xgSAE~x
zD%5;t3#o5b<Z+-thUgm?R9r9YWi(@Jqfjwf(ht_p8y?t!a}P7l4;ZHJAb;Xo#fUM#
zVxn71>Z9V_RnW$j;Qa4Q)*UV04gWc?ud=J7tD5A*>dp$KPF>5NYkDiX=Tm63h!?GA
zIV4Qa$|}G7s6O1v;`!OIT*kX^wI3+Wfnw33V5`Sjnf9aT(=1*mjjc2Jg&Xuua%d#~
zJIkqV*0=gS##p;ch5<R=GQVWwb8Ch<=xgWMwW@yQFDj%Xo-yl9F&9C$dJ>hBkK11A
z@|7H^HRMV&<JZa0&LTk7`J{HQrqFxMIdi`7lpy%q+&lOvO2M|kG2h=@1uWo-N;Q~+
z*Ve*YT_rk*7^972UZSdkeA4`<2qMnx={j;%Z@d1qefOy>pmA@+U^}u|#GaGxNJJxT
z%v?czl3Y~}na8K8Ik0W%k4)UTo_DHb+lKa;?ap8MZmJz6Ky_LsUsBS9l6f|o<%w<@
zLn1JI3^}tD_s8WKW+D43(dnKYvHET+ifOBktn~87EZx#d184Ao==+=Mo+Wcl$~iE{
z$!2`k@mO(@-_rR~`+{Nv_@sS=Vot4kUL@II4x>MwK+Y|CYg$?ffiCn9WX+HB*%I$V
zS;W08w{L=Eqv9sV;BAKaqw7N=7vrV@v2H-m<8xP;G7{V>2Hg6=o}udXqKW#kQ8AeH
z{7ZqL4?4P&mrb<@%_%rzTq|ySQ21%LxK^uStH0IU@1xex@+b&7bD2#TKUr(g#fkS;
zQGsZ(8g#k7Qo+l+J&H_N5rIv{kqQ9N?{D~rG7cVEq%c^=iniz>usz42nf5Az9^PZG
zn(|Dpi=%<x=5jJhIlb<}E8b4-uSsFMS^Dlx^0o7RpY7w1-*g81N^Lch+QnRAykXhu
zn`w8#VJ?P}@XxsPbD7QRr9a$A5<l)uO*VQg<>#xI(xt4qTZp#NY5a^o;#qrI;;KKI
z?=q*>(Mi4=U2hw{U)k9F6O&9xXviYf@J=k<7IDY)vfCtv)#{V2AJT#UHycWqbo9-<
zD^Gb)+X8qpGT#I|+oDN-=%FFL8vkfHbIc)Fb=fJ`(uAyjv(22FEzYVF6MxnDk}ZbS
zOOnuO&3Uw*e<)0bB6)(qd?;-&wuQ?;4|*;Oau3JvI_u%L2Ka9CD%oA}44ZDH$<*rc
zyVzOLurImBSjVqrVv=!x?o;s4Ltv5QTrWKPd!$I1z?c)CD(5n$NYB`B+I*-iyeW=U
z0n;J_*i+|gd(08t)+J6>n{55h(ADzH_0!+q6BAcB{n;W0f6me+kwN(u9Leco)^bu^
zWCsuciJp+}4@oPh(ZAuS$oyhZ>8pz5s8l5v<ccyGaAM`}@h3CBud>wd^Mx(iW7763
zBtE?sr`x3P>C$(?J!Tkrt{1z!n<?X5*}fxGO4wrSBxF$_^z!WXco~Bu0ox50ff%&R
z{Q*b~C3i@AJuAr45nSzb1aO!ER^ON7?DTUbQY5A;vp3|DFPg-*$B12lQ%8>DI`#M(
zF1}xL%(1Q73=$GJS}vC05OawkD7FOdPkQrW#5gz^R2u}5VXy7>b(5`lWV-S<pnt^5
z>!=<y1&%$S=U>ITO<L4sU`|0&V;{QQ;Yud9n=QQm0A&AkP(Jm2?)eND{x;Oo^6FpR
zx1{_pyUjfm8SpzQB*ed2_pq70uW3DE-ZZn>qIN$LH+&w7U~kTm5;d)KQ6dqwvbZ8n
zD=4RAk3f!FG1#OH3%9OSRyI%|B8%bd9o`kUAZ@rub!MCO80rU7S>x6q&1=l+Agols
zq4s-y(e3VQP5JVJiX;QS`%gF2uS(9kudTM~H33P|pyjxCYQ9MjapM3?@@0OO)zf}T
z$5}xlGzzZ+UjS+HroVelLITuuvoBiZVsRK>jn8gJ1;XWD=I_p;QdfN0UX*CPG-N}2
zJ|qv8ziwF+JozJqBisd@{;g|3;qh%g#wD%LrNrktak%m~gIycklce0wVrI5nH-G=l
zHaYVbo$$59;VcffRVQRS=uH@#wgCV7uOZE1x=5n2cnlUjnyI1~<zm|B#9n>ry94J1
z7`4;e`9FH2xtmW<yCMo4Kfoi-A^XU9f_nmYg<boDO0$bCyMZ69fR;a21fk`hFJ7=r
z%-!gRv#zt_?k#wDN^2IEP%KXbj*Y;0!@)LF*&<h{Kthn*OR$~%zU`q;h}(ExLc3ts
z7kS2|g7_6kPQBbVM`gL%?9eJ#aV{uYIFbyI`Ay;1HE1hx(s3PQJ>zBEagUS4TB?@#
zREi=Y=IG~eWk;EtiD3@X0gRnUp?{L(rcsVmOG9LSBJ-=q$dfn-Z6x7Hd_;0(f+vVK
z`4;uk+2#sTl%(e+b+p$A@!nJygeIx32!fsqZ<aZ|z>#@asB&-^ZH4!-Ds5+847E7$
zl|Sxw4Xt^3Nkdxy7WX)}wt$>lO3Pd8&w1TOtM;aUSy~ZuSAkq;Hz|p!YYUYfKe`d?
zlkH8HR|@Y|w%@f*EyN45?$f2D-HvS5jI>A_&-m%4c-+^NR>T(pN8FA3Q62Z8j}AB5
z**<}N<@sOMCAqz2{W@+aQ+LFW$FeHO8YVlssL>tTS02ySawAgZfls@)8!}3VDgExU
ze`PF1`6()8^U5Gg09af_w`Vnke6pvTioo~h^HGE6^CKm;XT|C*W0Q5;S(ACg<j|kT
zNzH#zI%%<YvbJ_BUm;$gl(KuM4CseL;8@0y&ik--UAND>o!|ZqNBQw*)&Iv?EG`c&
z^VY%|WptU5GI1-z9g}DN#0Ng;4u}gfd8Ndx8p_>~>3RyB@8;keO^FVDK#tf1J_g{$
zug5*F*<-nlv*NB?iY*LX?ep)Ih*A2=O)iT;fz;7jZ3X2b`j6Aw&5xLzcFlw0{^P-S
zuow7^n&9lOY(^qKhLhwjzr4S9*JZ`IMK1AH7Xx3TVA??9QKa9GX_Ry}!42Ze16`v6
z?0`Ka#csFqihb`9u)nyWT(5j()R3&6-Wj)tFMK2HMy~jho0QKwZZw0xCHlSiK3*70
ztC!;G$1aSS)@bGq=+08U>q<!B##Nl+sLl#=3)9*3ZuXd*UzMb^&lR-)eEsFg5Cq8+
z*B9Z4FvuupZnw%>&6aTT7pLmC#uk6T#>e_um%vOQJ$TY_|5Jk$pOkYke!uh8`Z%&K
zU52XACMj~LLi8omSI_WeNMW7`BF!_XbeE1|v;n_y)%WFq)INPo5peK~F`MQZo5E-z
z$qVh8v*Sh~+t;{|RztVpi0+p1i_m1KcYnrZXU_BB_d!Z}uB$%EGAVt-wWJ^@&~5$G
z`A{U7`HWX}tmAZJudz6^aVt~Y{;@6QZ9Zne6|x!2WlmO`{&OYbr2e%9p2$v94E3x+
zpGX;GjrTix8a=@fwF4^bpu%*ww1V@JD);5}3A2GOyopwuS$J<vsvy;KW@ACXc8EZw
zU?29{g0)Gouom3%g+mo*7qIdk`%c(SkUI^#UH2kd7ZZLsrJQtlw1?QbTWiBU!yt~5
zc(%g-D^;y=OGOZohG{oobPY?!;QUQz7`i<9E1m7<qxF0K)-%NLXEfmP{>_h(l~#|$
zgNtGX(j;IRMHj33_3{O)Y$D-Na+uh(e(27TfqGlB)oc@%I=y?O?1b^BZKTQE-Xm<q
z!1>`!G)Vu`&dd91+-}JkvCmo=hkKc3u6LsS4j@Ra?7@|OCV%rxATh;)Z&;*lGm|0Y
zYHwXT*6jilW=l~9$#IvYt%DXRo2r%F?cNRfSV8v4TP|JQ9ZnW!+owb;*eNRyx&S3A
zw}aJY_$F}8_T0~1xmb{;RJC?Vx#?jfdl4G<V!mfnY+*iENrjH1Ill%Y)W67M30r?f
zun*g~L3!@eFRv3)XzN5eYveu+1qME{!z;0RzZZ;@RHmhJXeJ0}o$7bxPTRJeFtF`Y
zjhwijZxVx5pAGJ~5wfMx_8&~)x)TTTm_hRquzH%qBQi{4uCZXF4Uvs?U1&||^0HD#
zru<GAvV~{gr$g)5&%TVzVT-E*gV10Hy3vI+tgYO4(TrMEw*HFbzhxwUrc8~geq!du
z9Vjw~p-lVb0q8WQyg0_mrdC{K|Iiui)N9PL+i$wwYH{fo0Lq7vyR~>>ogfA`Wd@N>
zmhUV^l>fMW<dmVBGTJrh^<&wJBSI1@{~?PY7y!JEayGNeXV2#_4v8k`(m%i?7s}5T
znwm2GNRwEIUF~{llCfY41l~^>w7-IMl%Q~@5sj^rE8K*c;$M>~6%q_Rc%r0mrgO5N
zG!BcZD3mFgP8BMSsd9^v_-aw)#XeU~e<uW>2aCbd)Y>;X(CL;7QuW!LfIc*l6$W35
zzkKj-O)I1(qsS69&|!-I#zi20w<anm6V4{m7FW{`-142@TrhXc7Aw3zlR43yh2f<C
z0DYr`Ve&aHyr$BpCcCMQ<li8+$SR_n<<Ve|PCDgq+fR=X=&rp%_87#o%zPin_A-mk
zBjNp=C~zUZ+f=>wH9c!tr6Yaqlkgtocrw?B9KP3my+YeGXxwOS!K!`VetXP`%Mtew
zZ8tNH-i<1&4s+yvR%0LE6{A)a{)&{i+Ac9Mdl2yp6TB?$`=}oy!V<Xl3v<JMFxO-3
zIn0dShO_uf{05nv>n0y9k+~;TrT6_C=CU3m;x>Rnj5zc)lIeewqBt)_BH6emN=jsW
zB>8<b<HA((4F(Oyju<<LuURx_nOla;rLHBkF=X?ZU^qW39qZ(Ww#yFPi*k;hY1eFb
zWMdy~=!VU`w`~j*g?^mM%|~Sk1nY{RkI?KplVZEC@y$Z&q)7}u%~sxO`yzq9F!zAv
zY(9^&_f`&}nfcXD%A!Z&+zy9QUrEF4!~8_H;(5k|WB^|9Pq5$KAI2tcpRGeeto2Ho
zaY3~+rPuwG?WygeCyra(LM=z_EnbKp?@^{Vf-f>b{E?(_T8!CxO6Ce#vMzLN-|c}@
z{OdHxX^y%Q>EWcWbV{-7RwkMfyBZal1-n#3^|A~UPNVuZNpM_);LzzQaMJba{Zu45
zj<ty7!Cc!IUVwX@6rGcgnApMBrt<Y8?3ZCKgfWGR#Jkq(SXcmSHZ|N*&%QhYJ#tF6
zhEd>ck}hsl7p5H|aXWZ7MJHYacB3FF&N+Y-&u&?BJ?;hVk6j;?3(=A5P7BBdc-_q+
ziNws9N}EW;`Tb8`+Xv=?i?~FErMVJKI8qD1`22Q-c4Rm3eH1q2z{akUQ(2U&+oMpY
zF^Fy@pFJRGrOrY1qaNQh`~+#rOhV=^TNq`q*?hiq-HmO$-C|$Gar^z!4>V@u(z$~x
zgIjd)Z7{cKLh$W)QN~zCuNkCPdFZ6$ai^k<!1=+*Azx<h>U?j@VN&fRougR-WDKRT
zbh@=UpCJOuN4jR|5g9;@CmLlaq6p)eM6`j1Ypp#mD!sdm6|#_xLHB>^C*0No&kH@l
zAZr!nY<KJCx`T01ot|(I$UAXqX&>gEQZ+DD??l=*c9o=o@bl-CdI?L(y9|HTMOHos
z_qXEy=WhKG`&oL7ai0~5CUolgqZ)E*?JA<_>oDIk1_qmW&>9Qw3CPJ)bfcnp@WhZW
zza1ns+*?Hbg0@uyO=F*u2^AXhxu;3rc9obNLomi--{1C2!Cmh~YgOrzuQ{_8<Tt};
zGZhko6J!gC{(fahN57@9nwCEuVwov8J389htrs7xRTgK6RU$bELnFnDt>$aG$G&zK
zFrwJ#%BxkZ6OHwg8qgM5!hy)Q#r=o|`rgS6Mijw9zlk%uEvAnRR~?rtE}I<H-QR;&
zQS9DzX=WCFd}r1po|zAkyL;Q0G5(mN2S2yE+}7zWupPBB9ZnfNGh$(OspuQg!%vpF
zY|GjF6qfA1ko=e&0<*OjuV6k{Eh@$3pCf85Io*gJ7W<6amJgX_h|@>zDbySVyDuh(
z5|5}wDk?m)mLbJ47kbhbU1{--hYtN16bZPZ1IS%NW}Tg8dLWLZ`8<wC7^pgrA}-^A
z*U?lN`{%CKb|_`LD$e?IS|3S)<)vHO)PAej#ww)Z)WJjK1CHP&ny4N9a%BB!#Yccz
z&G+7#PaIh*jnogP);{X!G6VVB@`MAypJmI(E}cWu?jBm~vdT><acji<t%Z6<m#Z8C
zFV5?^m!y30<<k!0tstq-U8vVv-ruKl1o4>oe5TwD4GK1G(>VK+fn;^W-__^eE|aNR
zl7m63-dWSw!6Q$-pt&!NgipWd6>ZsZYd>Cq<1Kh#Q$<Q&D%XdQgslXzptt?A^^v?C
z13!51#S=hrcDH-Cq@IHT-}lA7m2P(;o(f>nH)%9zXTa<1r4rK;4mRh;mZH-E#Ie_5
zLH<5V{h4}z5a5?J!*z)!-&_l4Q+lnV*J@kth0&2G7Fo7C7tnWSVPg4Haipqq#qH_+
z^_GP`Syk%o=$F{>RDjlT2%4bRp#$Syn_nV?UtjO-8xc1<q$nWXrM5^BKTN9UdU6Zk
zYkc+I=bYMsIzaIL;bq@YclU`C-8Mbq{mV#yLz@7Qz^1<f|D6*zpB3fm+;kCt-+n7>
z<6>BEMvLAEXA+L6>W=;Vg}m}2GuX}lml*QrV_3?QeLd%NdkdWZ9Y(rcY%=t%5xASV
z%NtGYcs+YCy%PaV-*WE^2+miX6GOzRKNUPrGcm*QVR;&Rw|WW1+|g={XmPeC_p!J<
zSy4w7f5$+AV|wN*WanZ%r*`NSQ$#|-YgOL(daUNpH>{@F1>7B;No5w|1B^(CxLcs#
zRk&{cjaJ*TO{ep3j<U7UVdFh%nDtd~FJU{WF7N0Kc2zS{?+Eo7N16(YxKp5H0cuk(
z+TCF2PuhiXEAYA+^n6BPW1FjQ`owN1f(1^-8?;{sY_8*7x11154%zEd>5<l2C^@VW
z#m%Qv&~aH&|3im%$|>^%fTw}SG35}|9O||ORNG|YC7y{70h<Qq<wtMJ5lu$BCQ)mE
zAvY>R6I`MQQ2ThEAFZ3W@HG7Do0P6In<51{qnQ6^e;4EDIXN!2<f{E2(zM!=b1cl}
z`x(qM?4IY0OkQs8MlTmc8)&|-#X_lyjuv$-!xTm{JKJ=6BaDdGA9&g7=drHGA}7O8
z^qpYnkpzXx!dw}6*s$Wd+AUhBx0}MCBH6Zb^A(v!kt9<KTQKd~yzUv_s&*cz&UAly
z(GBv=vdW`e=!sd;q|6JJr8;KeGw_0ax;9DkrB<hUBjf_z6v2SUkC>FX8>O=u2pLeu
zxBbCm40;)c5i~67wz|I2e?Bi13%H(?NjtHg`Y5Ust6n(@M4}!IQBS!iQ;}7ELshr8
z@J}2o5(b1j^3gwGnf#`%Jrp)EU+fl<yLWn;z)@_ijV816-d!M+_CbpM;L2Teb!xXg
zs75Va-HyJG3jo_8jnU%YU{r5ePC04Xg?tsUY$c0)&A!oUh)#Nz?fGeAFr=T(h~YG5
zQ)dlf^1(lCHcWY~fRsO04Oj`ub^md!Qj>2r44c&J4v}DUz!t3RAycGx?<v1$4otdq
zK_l{Ke8;yD0Ae@Qkb<$;6++tDC614q4=8-UPQJfheNV4`mfd@6JE!lKy25+q>Ka>Y
z!q#G9>`zPM<ebBpl}f*hv5|1`#G`MRG7&wf+OMPOjFs3;{(fg4FCAw2gosZP42{^1
zgpr8P2A8f4pZ|C+FU+}+IAg`FRLFQRH-tvyBvW+kC^Ia*|KTwk<LS5>Q7+X}VbJ50
zZbop$0!iQ-95(=;v^!Rq*lJ+9)6XeER?sy$;6}VszchQQNDzD|<y`#?JaLfBmig;t
zw<;QLW_y_qaR<Kv5nvhF{yYA(OI}R7b?s+3h7sDS`O(bLn0qqq&g$IltMlwC4%{C;
zp3bh>RoY33uTA+I+zBcOBy(EZSh)H)0SE`ln*#-7Qqqx^ttevy(pLsPuwY1wR||)=
zEt6K&4~zmMj|#b+SY&bX;Klxt?+u>JV2MTMw((j<k?`3W($GK>pUt;(tx=iKMM6L(
zxHDgK>`hFpKs=}2l7b~?&N^brYg@)@Gfle)<azttv<m&>k)~%E!-zlH_4-e{N4-Y>
zvf#@rsTD2KE}ClGjeagh1|cJLG_a9M^CfkSqJtd0VX#EXt&xBhn_=h74(@Tm@Fg=9
zqUQi2d#C0q^^czFKOGqUBafZ%e!Q`GtcrM1Q#L(%k4E{P8<~9t9P-<uRL>zi>p!JB
z6r^`-?=z;;Mfc0>E~Bk@^=pj~b)U+xwrBZoQNjrd-{w(g#T7oa>_JuR4<oLRVG2y*
zMNToo=8>X851k3-<54d%rV|?+5343PJ*R1XA5-|d-s&F!o4tu-SJe`Rc;+u_X`>W5
z4<B_<+}RqE!~mEc{u0LPZE_-78+#<wm^lF;dLz_Hbcj+<L2v2a@&#u?2xwZi=y-pF
znw;u^ihzoV8UgS)^C)q>SLAp&^u48A6X6ZNjhwS@ni_NDGPzfxf;PK;r+t3xH{c<2
zhUTi5ws%V7^SI(RE#=yHao)q4AVc@+H<6Ye-|tYS{8IFz#CWZT&6}RGvRr^Rve3|p
zBB3rAlfHr@hcj#wSpjultsnPLPYIO$g-mGsi|sN&K;nF><~5gvX>M*iCe$i)iMVpJ
z3?MU+80>6ZLA2PIR24_Z!>xWARd;Gf#dYZY@_BDX=0Qj>%7tM}5^wxUBYORZG*k*f
z{?6MJE27vDu=uT3%&a|QNf0iU!$!8u$#9ly$OS-o#x}+iAepQ7HK2z`#6<o`cL=X^
z5MT~7z>?~ce4ahshCntJuze(i1TtoNN7%8L2`zA~Cy&V!H&s%3LiFIjt(032SxfZ}
zD$YhY5hyK&p+(FtxMH~WJ-YR&TtCmV_s!6$p%`@Mg^HvE6}qL2)+k2gLnTD8eUPT~
zm3#iZGkvG_lhbZetroRgr?JXkM%XEW3E1R){OUk+clYJ@GPa0os(wi_ZArDm^2n#H
zr(=vkmO$hx<wUO1E;gMHd^M+Ckr!yO-FMO+mB-|7CFu<JFs>PLl)a5?4Iw)sQp*|k
z9eC~e2C*&6T)Isie$s8@)cN8QaEf!F$Kyws*l75csdYQKi1Ui~Z;F=on~$Z*{gwUh
z5a<~&DPk0hP<i2enhP|U;tsmRYVxv)UYx)<*D{5B9L1soChC@c(^cbjWs)xLd`b&N
z_vmpOvj9Z-SksFajs%_yUEJ=JkQrkVqzXR-DE(Yh1j9|v`gYzDI*P-$q@tmZj;6`)
zl^65zyGpDfb%Hrq&2_h*cexS|E?=Zm`d#K=fIfI{S!8Es1?%yzRQ;1JL$+hWJBsh0
z<2-)*$ZpBEA9Wf`m6PrFeL;bed=i(nFp>gcUvwCa!Rx3UN%JtZs0+MvQX=8Xm^Z9#
zFOdor*+%n1DBkQsSiVY>@$i^Rm*nLno1m@F5!;NL<f%?g<sZa(@^zS8MnPxu35Eoy
zC_gSvFdDlK?jnI>(WDb@s~t9rS{>MTIU540H1_oT?}-ZhN%!?=Yd-JY=fBBt+=yDl
z2@@0HbG~nGb9w3Uk@8-@6c7SMiB$q{%vD?2$@og_6%qh?R7-6GQIa=@GS_^U9}0Uo
z0z%*QXuR;L#<dL7lVzZo5?7Z?Hgzz9=XfipUO8T{N8<w)lg7WAn;)b^35HRw_Rv5~
zVpnEVFB)avs7zdsN3+z(ow{Fx_MyG<ktBRpn|v|P@uO-Qah+aw2`K4o^eX5BP$Z`q
zqpKX!Vmeb3FMGeb&pFs47kJX5#j5O!TxL*L-dztRed|jD7NVp|y7G(_7WGOdN@Ni&
z<fzrt>AUbsW4OmK?bb|1GgFPSfxG0nqu>@Yl0875%n`e>inw=dSLSg0Ir0_9&48oC
zIk?Qz$}FHi+d!Elz_zFAgJWLEpFb_&t>;)CKQyU0Eg~_}Rtu}uJqD?azPL{H#&VGB
zGIw$h2cuS9;Mx&^8HE`t*eUEnnP^b@E{0PZ%_CiMUUGihpzePG7ANEkn~RVzKbx#~
zx;*nRKs$L7|M-=S%)gRAnSk_dE+zNkbzNvayWd0s$*VOjqLXR6)FhE%wI6p~!qcf;
z!5Eg>)Vsvc)LTn5M*uf*>hhTO*%kD>l4Tt!f0ge|E25GTAMY(2+IInb+$7c2LaoK?
z=u;MhIqz~=!A5l;(5?^Ozk>`!TzS_$0lvPUUcc&Gyz#0CZo7tP?&i*p@hnyjBL|B4
zZymAijo3zF{=ZDWqJZ5D!b%=A(dNc+qdhPjMsjigy4sr3CP!fHRd0=v+-rpW7#faI
zmm3wQ&n3}L+1ToZ%8;n*s%oKvcMs>7>dzDMR*1GNRkl4hb;{#h^Iiyl75gjS96*1R
z+e2niZuC28wr4jRe*A06qt#pnw?_kycTRn7V(XRy?eRF6j*%L;XT(PDZ&Lr;RnjBw
zv!)G7SR*_%ZuBw!D)kI#i3pVnu2qb4_n#=jd}|boy{*yb|Ftiho7Mu0Y5%ap*eVhm
zX(X12btE`UQ{0!$P$YHEz6IwwMMkqjePR1<K~;F_r5dA>cak^fl7f-6honE~3bEGd
z%*WE8n!%UiPo9cAqpqMTa(_zDWwMRbm1!Ed){bx6sX3ky(YvOyWo}Y*goqgP_!MpV
ztnoV6;ad}uPLvKMY<<=9H9h~vCHd_s#5*=LHD0oHU_bC0l8n4Tb%J#5;az|>3N#1J
zeU>R=hfF08=aKgy3CIGS0`Ct*AJwCEV0zZttu#CvVq<YJ`ksQ7vr}LZnd5zkG9}Ly
zQAGkQr9LXHL-AlvVV<f6s9`+mSGS^rFPx&45j0Fi$nlKJA*T-lYg<zgpP`_6>iA?b
zFxA#4j@Y;J(&LOWhYR;g<QXPjxWubKw}RnHjo2od<9Oe&u1qvK6hOnM%h`|qNpyIp
zAe-vd$E@`Ri*QRsjTlF)3}yB-18#mv4DU)KXR&>F<O<of`8J7|GP;qhLhDKj2Y^a+
zhV<H$9y!dIJ>RTAI5HZqOB$w2m|kezx4xCLhCMtSfgtwT`$Xz@iPrQ<&*uIp@~^Ta
zvlwj4k|0c|H#K|&-(J6Tx0~xo*gvzpCZNW1AJkEzTi_b?cFw&RJ6SHTjG_>vYZe!%
z%#*>MN!6}*GtxhO_sPAdEi^>I|Mf<@l)IWYV){&IjBuj91{mV_H|S2guo;P2@ihWR
z#Okay<n?y14};wvMh(-g8j<i_a31ffFYRSAi|Gq4bFg4#zy(_$VgFa%&7Jnr*n39Z
zstpnDO1&Je$$PC$KI|*xfO_Y;P#`ECWWQ#KzVU{Z71o$;Kpkll!z0`?v-2V$D&2jU
zjqn}cR)Tz`J!fPF_c|UiUn4Ms$T}zD_U<FSC_4S~_`$w<LZXU6xDzl*>N4{ppx;!o
zF(42}RD|ZOBIC+@qbn5WJlV;z`ZxNCYN^umPErcxQ`Bf(D9kx3eL3fzalZtCy#2GZ
zc~_)FA+Ce8?d%<MR!D_S=#uieIX#Q+oB>?Q_(C_}pO@_%FWxDayh}ZQCO(FqeOeOK
z6m>I-gV{94j=$g`TL7%cY}eVx*g5S9{h>&&CobYIc|&e59Y#6o^XbrO41M*vcc_C;
zKEifQIH^eK`?A{Hir4(QT%;1BrrAap&ad&FO^MXQx-W^zyC>fvZ~58$wx+rZY@PPs
zLtblss82Up7B0ZQ9Fpym`ZO0~qdT%5r@0my-?DDfQ0^MkGf6!--wq5o#f6cF@#be@
znY=B`Y=c^H@1uMva~e_%ZL9B$!5TxA6=vm;uu;}UIu2=5c!|+XBv+N<$ffe*fatA3
z!z5>=%N%rEHHa*?0)=$9V4{Bb#=zQlVsXM}#D}yOV7ZIH8n9@V9_DoT6fl0(_kKon
zOhIoH9nr-$&}?N_Tp%8SF?h*HNRR1V-q&B|bN>e2%#_L}j2DwQA?p{9<#PArV|#qf
zCqMV&W-B?ON*8A~X%5p@fTEtTPht9Kcy-1LU3L1W=OvQ}lO|+O(d6$1b|s?NdT6Xg
zT_BaeEKLtec0Zc<A8PE8TIa&{y^^lp<cp85gaeyy-a6ai?7H;I$M{akcvH)IxtyfY
zSJ(?BhEh7@U#i*h`QG`#wk;-Gyoyj<0PQ`I$5eQyZ}sa8V-gthXtJmS5lqAr3vC1F
z3EmH_McY5W`}J`}zvdyprBojA8H*3Q>>n<p>SBL52_{mHXjQv!h-0m^$~5Sb^G<<3
zqocT1ej`SO+?En?`HrBiw#s+3eJ{Z1_6M;A^-ItzpU&G%x7vL4wvTGXv`NSR&@N$!
zmw4H<9eKZz1eKwnD5M(+Mu)ZTg{Ri8<f5q2!tfbmb_ro>K3Cxj9BQaToE@i`US})$
zQ1H<8YNdmb(nfY3uAkwdJPz!K#Zziuh0CXSu794s+<(?j(h+{~s@IDG3|~r0k|yd(
zvHCGi?put%5g}D2m9i-+i&!Y4kdJVZWR&AJ1iKh>u1E$G9plNkm|15V#)oZ^h+3wI
zfUK)eX*di{*?jH4`B~;UsD~#H%>(>kX3-f-otjf|{Ly43ni6f{>2qP^ww&e)U#1mo
zcgozCoIOO$G&^cP@7C+*ne>}9YqW)EZ@e^l$&I6|CNhdqGRNaY>ky)yzv=CAusquq
zhjZ8n36J-YDV08kKChTLgA8*vp^{81Vwy-&1_^ZfvZzo>CVff@=gE$rAPI%T6(*Cb
zVaMVMz+dyMM%MFWq7DrhO%lZk4<w8Wgy!zlbaQ^6eEiAh-sOmiJ>2+Q=ZY*Ih1q9S
znK2^Oij#sn`1)y0qgjvbB>YY4EiFMOEu+n+AGBgUz+%LBJsewco(KF^3xEgRwvdq7
z`8CA)b}kgfr%Um2&&w}BCyTU{Zp$fQ-ST<6(~WP#_}jXrR*zb>mKyH>bV<K=L`di4
zP;i7Hg-PcxhYQ!qTz#&E(_6|hVV{TPqM*0iCGDh$gGh{wx<)AqZ`0qm$MBs}a8@X<
zLoD(;vsHI~Z=v32nxA5=2Wp!i`O!9eifHVgDbyRF#FGa+4t&TY(IzGTcWR;OTcJKb
z9YH<%Y?nfe^#H6Op&=W)Wk#3Tjw5ENZ;{y^2k}LmRtMLWy-KTnl8|s_T?pz&3*Vof
z2jh$OPx2Rv^P=(UHIzb=zS?CGP1K>k95F{A1F@d7F^=bl6QJt21|jR$!)3MS)o)m4
z=gqb=h)v69w@W3?H?X4eFA%*}Z^4H7nqUZ?$Kk8<Ta$}aVbkhQCqPp*u$0??G=Maf
zMSbZ0X2{B`L%%oTjoHK9N0s49<&+B5x?gH+DqnW&APk$ZhVP9_9Dm6S4sq8hzOw^2
zSKliRFWGwW+2P(`j63#wCvPlQR%%}Cd4oc~$3V<S_}t!&{M>KO=j{lMtE^kCpt-Rg
zlbo^lQ?F9v_A`8kRsG~KUZ*g>h?J|x>Y%Ih%e@+{@#&o6-V6nre$O#>+`JlftR5rF
z^m}wCv|Zqsia1Qzeb~HG*-q3?JmaqD>|@NNa^km6XwmFo1SPXEY`b8wC68tTY9m2J
zN$9#516UFME6>GHg};kKvYmw5z74YN_Vf)4Zc>z0+o)#u^VA!DEz!0wRr?Zq2)cq8
zDDCm<rL4H>tF$^gMXPfFKJHl0XWB>i#Bz3AWCFQJL2~7iOZitup+hpEWYkzh91+KI
zhzxaOw<e8~_{dkbtLq2U9sM1&S1d%VG*0}#L*WJ@FK_3>=Qg`LY?2T{jC>Qfc0IzS
zW;e|SD`Xy>e6aUdJ5iqz<Tb7KT*TE6ZcR<H{(FcO$IWubfdq@~pp%a9OGbUC=p<je
zWRdfUevjttjf+4a$ZL>N_qSIDywd#Xak9<%LHh3Se_|(*eb|H}ywl*NI$mXy(NTBr
zLnrQs%)JXALUGMhLRL298$RI#)9q^8TGGvZbaXs+683%63v!lN1BOTd9%PhUFzI32
z^~lN;7=2yI<$pO_L8e?mt_Z#3gHwxvuDiX>BvqyO-bf;XYfy@<^j%kAmrsIB*mDJd
zUt9D0Ryv_1)sQ&QC^#{Mu>faNOpa9iGr92<k0UW`KIA%oEJ%z=im9k=fme4ckI&RQ
z$K>?_EmN)uc|0hv#t}`Mr(!TjX|&zto5!VWtu|$n_G6(;R{Wp*g(rj`LLCZ@41j#g
zmI0dYIO75_Lr%%Xjau=0vgl~7KQg8kMhQtO96EEm7m-6Bak}rcq~|xu(TJ_#9iAOZ
zqES?VkNdv&4>xCeby^Nh@YC-6&oc+)f(lx}37qVy$c{-D0XRa;7p{#h7g?kOI5KGT
ziM+Ur0<F5u9AHi@^wviCvYng=;s{UrwXUkcqaag$I!lfRzRnSGongtlE;tiX3UjRu
zU>o78K2m;l;W1)P33+v3qT`|zDlOxEU0)jt_ZvV{Q{QPeSnlyM!@x6>a^nF|J4dmf
z{F~Fn+k$?F;E(|IIky1d!47P<(xA?9wzJc*>E1|j_N6?|qa$7>jTY}w#0hn5sfMdN
zZ-$hgGoY-3Q-cm=z~%OcmHhaa-mLv$Ie71EssE^8ST*&tqe&t>)(TT_XIObz43h2D
z?*aAf4>Hy}0sd5Wt+>e+_p|DIJTK|X`aULGV7HCkbNWw`xAN1EaWfX=Ji>#+w@G<`
zIW`$XSrZ=JjJaXScnVC<(tZ>p-M<EwT<uDfJ#qD4<!M;>F_`i68^JjmIk80hE~o1u
z)dW4*aDHIviI1?(;edImMJyI+BJ70VPYI%E88Npt_C``d;#F-jyKW!epF=#_058~K
zlapwm+cEV+M^y|XKK_;8#vhCfLK{}9zj0S@)hjyfBF-6)y|(MiiFNS@m_Rv`-g5k}
z$E1s_#Ehuw3S_ECJD(zNU1xNq?ejo@-%!)ofq+J`(0Fi4TAQoBz+;32z+uFy<prYd
zNsa=c_2|tUJ-=(ArTfnX@p6~-x9#H4_e2Qu=}^k1;MnE)vlA~jy!@Mi(owS)k&QQ#
z9yXMVX5M~<0_-^g|JVT<1UwnTWjW0xe!MH%73WzQ&OH7LKqCY92N#umzDrJeO5S~G
z&(5X0NIc}TAMM%ggi?wqx~-*Wb;y6kne&{5n_QOgh+2OQ(Mm_E^F)yaLq+UfLko9t
zcw3BrnZh%EjpNKXyzh@dMx;bnm=O*aSQbB_3&nf!ua2XCCDk2cC43+Lmbq+EJdV@+
z=j%MD^v}ZM&edyj{9AS;?p()zfC?Ql39!!-=*3@rO07ujA@Fr_uX+O22rNxb>X{Nc
z^<H<H+P5VtAxe3F!Xg%XxwyVsh&|#)d-625Z*G#1`XuPH!Ixi?L+r8GmO~4BZ$%H1
z+LE<NFUzpJ_D3ri^cPY4D9Ah5g;GEWy=&lyeG`^{+{Q}$d*JIo9tQ~h{oXv5$e4(*
z-LZQAM&Iu1(9wSOL7uwDRu7%Foh$8|NiB0Iyg|t_QmcPUac+Nr_RunRJiDD)ezwB{
z-^!(@jubts;W3L?Dy<Xce<wvAig4d4uaY5Yp)Ehw$Mk%^zUcWI9>;VbZgsmBWI&hJ
z;y#euF-;UU+b8tw9c>UZt<9A+Ze5P3$K>oRn(-9qp*kGfgErJ@v4ao&e^0fepg0Ce
z*uwjr|042ZJL1ui+iPpeP%z&CP>50O#yAj!s$n6`%ot5gYcm=W-}c1(BZp<JSs;?j
z(3dwM2;f&o#@Z`xaj0ou&-@?CJ{r(W+toP4;mQJE1;(@b{C?YPDnKKBqnzkt<6?Wl
zG+0lQM}8<ztAv0mP6p+1&4#LbA$;fU7S-l?uKC27SScTj<`xqe$zMj)WL{Q&AG?~x
z<$lJ5^gR8eJ@~&pE>M4=3RD<De?(J;yPX3Ck0^bU+3``2FhZi9gd}|;ej=-Se2`Jm
z^d%4D=|~8N*U)&aQni`cPv@(uLG$guykMVoZm1}o{^OpuR}q=mfBOgj$ff^%6hh$^
z4RY!de^|M*u)U4NCf%4O!X~77lY>n&AN1Y@w*d{MBEGkdRyl*FIY;IvH>w2{;yx$P
zts3?rYqf(siBMR0uiA)m@arSB=|@zpb)J7;<NsP;|K+8~#!3{1+E?7j)TaUO7&9$>
zVRqgXXO+imJ^{1iRonyGlVrFV=ydM_s3Y+dvO8&J$Aq{m4fms%_%cva>Ob|LP~H~G
zlQ%fc_@NO$wf;XaJ!CX-tPfvpj?o@1ml?eh$)S`=vjX~80yAAD(#Bh*Z_)yexc-<2
zv2Q=D73YntDiAF>hqS|_etIH#y~VFGO$$|yS9{0b9>3H4pVlJYGe7#r^wm37J=RQ?
zjI*-7(dIzqfp6&fY!R3}K_Z^hUzM^)V_{ZivoWpV_0-CO4NqnkzfBgPQ^uG1EuP3e
z&LcsO0m7#g=*T-I!%6m~K0!4Bqz!%R*y}jD4$7IH&msf*7_Of`-G1BTz+jb;!EOD9
z6Cl#B7?H|EjRY6sM6Z^I>*Yc<k(VDyV=IUP<TiYwUk(|iGd+E7l9}y?%}qHWyU_k6
zr)xsMyWn471S^ZSqb5H@-)(6{)4{UO7m>az+bQ`#2K>aHV_4aCMTi(x+7L*8sAxH6
z=&k7_y}dp1`}LZ`S~*nf;PO^&x658Z!_MW9{peaUqcMLn`e55FyZXjNfj`D{lOuoE
z1GI8Iz+GnAT$ogbQ&FJr%52FZ2w|-Kw0YyOJ#Sb@<Elz7_50lPTFUlTu?TpqW%;+O
z_473(a4J1+e{L>;)M_Q+SK?3w^HF<$wx^$Y8*r+=R_JOi*}B`e#<81UU6(Yq!=jyC
zr>@u_iQDGt>*>@PDs+FNSvUbac$cht8=}p9-%6njSfVGDV#4@$?;9E#)3ZL^2i+U6
z=^d;1J`%W7`kuM)Bkt2YDS?C(Z6Gs`$xgHN7Khgqk8s^5Z_>*_sv}KO*Bh6Qq<m8a
z5Jasb>lDkbnL^uw5!l@IJ=D7T|N9XAn?bzs$fIcG@j$&Bk0YHDuPHyXB|eTN@<jd5
zDM^9YVk5-<N$K29G4G4Lvb>R6Q1p;~C0{*?#z%mMZ*M~J-5myJijE8E!13qrHY?3D
zc#+EDT&fIF9<mMAMxyi<U9mfVqioxn8tS?&@=r$}Z@RC!Hz&|*>>)gs(XUywWU+-e
zm}HtW9gwvoB~~Z@kFT!|i?UnSS42XjL}><)R0%<8hE%#yx>KZkhye)+iJ?JKLJ$##
zknS9M2<grNhK3=A`VD*U?|07G-#+Jh{~EZi;pJItJ?n}4z8`F`->S3)f8836Y${#e
zs-3XSpN6Q0>)r@n%jFLRS}XZ=E~5k0n+Nu!%l<d$KJU=hnqlHz$L6aoH-;5zetS*|
zqj&23j`Q1YArH5hpv~yGqUOSrVvRgG_074)ToL{*eL;MAx0ZnK-)-S{M}A3iV!)-4
zQ9{j@CesRjjT$-AXX*{XqE{UpRD8>Ro`5*MW9OXfeI`hf){d~^W)RVE*^^j-1&}fZ
z+sb7-as8N2wxH~!6(qEKbs{dI#bL-yY%89g<%V?^=+#xB`>tgv-~!zfcn<H5WFxmM
z^xrz5y2WJ|x=oEmf3nrtgCpq=tw$oQSF5HcdOa7wG?hDJ{wW;k7r*;4(7Jb36=bsX
z`Z72~UOMwesC>5%qaE&^>;8lB{GJ}M>x3WKBKJymuPg=x7P`Bag3<vIfZJgPh;)4;
zeur5G8aEoCSr~_L-OyMya!9%9#xDv}ihSK?`q1Y?P9zP`zzF2<^_F2{GhW_UU!u5O
z9^rd2pw0VDwb~9!_o}xtDyn|h&h)K|W#X0#if^LU{1EzCjuAH;tg!P!+CA24zwxxj
zSufu9=K=$UCBjkc*sNT&=^HSljX@5~@?n;Gp=X;a9)lk{_Xqf#&^&c)xGonJw)urj
z_WB*gb@}+Yfe!klp^x(;op1M23D+2G{vts^=U3ggOO{=L??th|Y@_{73UNyPZNmP-
zto0U_8>7w?+Ktf;Ug_m(KBTTaK72k>ZUeL>-=WzAR$KOw3xwvU-h>kEGGQX<CzXs#
zaQA*<KIESXp%(`t%k%SwmQ%~;C3F!W4nMlwi9@ZOy@5n%&rmDa@~SS2Y#aR*A0ozr
z5t~lXHu6^KQu0<xK^XZte}+Eg(1^+uRCH*{{&HFFXDDUpXX(Q0zg7jEHK-OU8vx&A
zxpKu2*{AjDf3g4j2sAN<e-Kv>b00L3@&HB}C`XSi{?Y<)e5Q%RG~Io)atC}eX$qms
zLj3tPnjLw<Iv#RzEGe?33`b8qoe-NBSo;@`bvgJY;r1QnSYBp72AL*38k*8g{m_lC
zM3%I8mKznPFcWXR?X9UaAX8j1(W%fh6F<fSL^eGLPVT+?HYS~6zgxOJcz{Cg6XtY0
z4R|Pa-JzMle9aTk@j3F-FMGY_`~}g4k!rq=*+$S%`8^-u9&3y`_V)7qnS5#OTRsy$
zwtSrmBi@19HD(CncYVb8E+s?QEpr1A<*88nD&f;cc1MW+3zlj;d3Ds6L;OVTt5dx~
zCwa^B!wC55P<yo8j|gjqt=<ISaMTqBc^~#uyXjitO{%2FC)<lb;OZ_BX9f}TBIZo9
zR{#0QicC-nVBh-l9r9X@mrNvRZ|CcxJT+A`3&WDFfu_9Q%~iFIvRM^Ia!lxHfj)v?
zVYTTeh@Kgku&;NtGjYpY2=A45A<;TLt~CZ|9uk7_UUV<zbM7So40oM484~tGf;*Pa
z7%xw!edudzjhJdZ_wj6UCdNX<ufu*Ni*1+`bF;*l<GCNWI!`Xi_I@*kbdM-Wef$@>
z<|z#`zoV5f`2=F8SOkwbDi&Ul>6cVbG<XKDRrmyV^9J!JJ@W~CxHU7kcJqa}1fE~L
zu+)73d_oqFfr4?tIrX>YOywBJ?YK0T_r3)YC;BM}KgASo;^*(t$DGdVvJB9Sc}!dk
z!)V!dggq$a47=6#F;uU_`qL{U;F5vG*lY8CE0VU&rn_an+-&Np_34+QBBcAvchn0S
z(tcMc3L35G(?sYQRR2?*CjM?iT&o*SnaE*)q>B$S`f$F!(qczdyzcF1nq%*e6FHJ^
za8{gsZfEVlOFVnGsuv#1c{qV>*O1Y(g9k0Hh27`2!};-#hiya8`?@!0Q!tH+;_ZBb
z4|`2lT2d8P#O$1N-h>I(S*e`L?xwgdiMGFIZLH;wv^;w?A#gYM7fIaY<XJ?5``?1i
zKmQO@-D}+StaM*>{&{}$okGi^w)wI)TC(wAx^K84@ul3r;@5e{p&*48)mWo1H{^!<
z%YINl@Bqhx&_UH|ZIy0I%{Qq|j^LLo)<)C17EUVb++CDe@$8ChLX8fiQ>Aqk@WvKS
z4J(1<G{4Ee5r16*J~=1vN0U$8iF-2A5k>|R{|K0OiFep&)7GN~_xc*eS0ykWO9Fso
z$cdAL`247y0i3J&d{ra?P%+ohoOvf0%lKDd2&MGUfk1DMdCG75R5uGKT}&-Us`8f2
zy*v5RUn^nxo6{|Yh)?Cnh3Qs@6#I#0VGhhN(pCJsZBH)|=|>eHDJ?D43NlqO&T_Ba
z^Cx-o5hpJDjG?{K<^?_O0`s(Eh8Vg@YoF7|v2~t(Xo;8iAKJEx%eRS-x=n=7mXB1w
zYbT3jgg)({z&gKG7_wMpg7mKHy5?c3_`9KXMSma|u97=5{XA?v@!{0|(#4)amXEOF
z6qyQn7!g_btFXwz3WPkQ=~N`AXDe=pyYcelS8+sP@N>Dyix7x2zh2eOc7rG5bO`Wu
zD{1xBp1&N1sF^v`#Y<udvOWx}?MVoSbYI=`7Fs57!RO8U0T72pziT{^L5<fB{2@Dm
z(Q0djL{sj`xdG;^3`n3PYw7i8A;~P6v&26sINxvvGuAA5$?4$6y9t{5&%c87VW<R&
zpXOE@{EdCq?%Ovv+cxd_U5IG7#(0C8^5;ilTJbsnfM7WLROMb1Rb7dcxK2XN<xg9V
zG&hLs>QNsBTTCK`k>g}E2GWY}BBKeIwG!#6FF9!GBtt8)1S|Kl3lYTz!S-#eFJZtF
z<6CM2ir>3UsZi%!Val=j9<98<N>8WDO_2Fo7!$;K0QyT~fb_yDLXB>g#u6ev{3YEJ
zv{OfzD~jLn;TCMcBC?>u&UQ4k-&(%shg;`EG*V@BmCyUlQ2>QKzu`s&=VDRl4Kux$
zi@d@Bv^5_&{CNFgq<6CceR!lWxx)%e6lz`D2|}KnuPLS@HVPG9N+n<_OOyU~7`30@
z2gE|Bff2vLoxsk`7@BNA{a}iCTn|gK5#t!N=o#G%pDW^AkY$P<1d6LCQl|H<(dq;E
z2V$5TDyM9^i8G$tBQstl@vRj%bS#Sc3(nO{MSE&(K8I)O4$<E-KPOJ3s0AH0yG??9
zn%-CFKf)V%w*p7jwntQbeN<8ZVS{`<`JKf}*q7wJ4g3oCw9N+lIfhr_tdU?jG^$R&
z>3m(WSx0*0IQH|_718j=%&Ihg`$yyi=#!eh4D+^;Ul(4*^Uct@PNs!BfEk+WGvFcf
z2~uO=CO_V;q@wODvw&Qy@jOHngOm3ZFaNZ{EwLO0pKS+&_rOeZw1Db>0-g>w*F<h#
zaSq+rsw0Nd{i@yW0<#>V;I_so<b3w7(RW(z^BT|B5ibl>rv{9F%f=1JgNy}g8x2DO
z{Q^(FW#@ioqmJ1w(I@9wcI7?AVy?s|utRMLct$+c>bhnogg<sv6!W7$xBqvMDNHgb
zeW&SBPAfuO^APgW+C61T_ma(As(e37Z~au2T5QbvZE-QVHEoKbh2OVGESe5ZGeSYi
z1;KA>u=$bSJf)N7@ab>1UL#f$Tb12o`WaVSJV2uHiAu3z`r|khWDb+u8!$P=#?{g{
zRO>ZeA4dGPU+_M1{|W@hF-3xCy@xL&Wls;#!ESmDPSK0^&oI*4&!3I57Z+P3!U`#N
zL==|K06F=%JOY@u9_d{V#Vad~CMgywH%CvK;nL{a34rJyS3lUtcMsSy;yT;=?Ig9N
z-T|O_FR{udtXrJU-vQ(HK8(pp3veXiD8G_>ZM(9^NVh*|@N+d7|INA(!ifFeSnlIJ
zg$5Ny-U+Ba+v&5yh=*gaZ=u9=Cd!XaIz~VL!2p`a)P)eiBvhce43{mcXeXUAw``{8
z>eI^YCOVNTKVn%KvPC?1UTCsKIRi$NC_&m3<FLsxSZxJi;O8L<*G#|JCBD-swx^mg
z+9WjOIZs8>o6v`@RHxlR_(tn&MQl}-;)g%XXKO$Ih$IN!`Q5Yf)QsCG>p6UqTSL`e
z{FijL)cx<^0-uCm2JDc*Om5C;4}~!6290o3yee?+Yp?<COb?li2)Bd2lVI)aX7nf7
z!kUmlK}l#qyo!*ax0^jTWJ@rusz$o*10|7^;qPI!`^Mmd+TR~0dZt#-28H(8*dN~M
zcxY5pka<n74TpItl=xi^U#J6ke{Q)8^h~O^=kkgN$S#8KdE*7^C;Om9+M<x{t1b74
zlT^j78SeUQiCu3<Q&gF#8XgBoSPb9AnxqJ;`X2GBWX<?>FfM^uM;^Z^<9&^*J1C8}
z`(isH`;rt7zFEe5A9k3JCVoJ2$#m(~A5s`UzXfgx&ku7Pc3n&K=yqZCIJm@d1#Xv3
zh$#d^lTNjoi%*r`7rC6SZ(3*48A`u<NcTrST0`|FK%u61V(4xRg!MbB=@K<zTse0w
zB^Y`@{pAi^FQPKasO|u<HY<s<GS%mdQiq%9`<C*YUxWy&W)>e|FA42G?IOrRPB4Ex
zeW6NOI=PR5l`C_a!Zja=;yW9BT`?32-n##UOMb{10UEvx=IzT%yNMrgALp9NL|)zw
zsKnU{Cwhi|PAp^_p;O1ZzMg{t0SH4;7TG@YhK&jo@qS}92!A7{ejAW?bE#QjUVVtz
zI0?0AXPem?#-s`_2s0$l641)LnRTF>M$c6<!@T{^ol4}U<!Q~A{0GPVvTVI9i6u_1
z_^v{$`<kl#a%WtMo^xEfuLV-$@!=Z3beuyWd-w*L(hoU}%Ng|c%XobAj-mz-+g>Ax
z3RSVBu{~z*um33~7-5LfydD-*+z64Xi)9-K(E-|Q6>|w(7DQntk=vY<MP#C&@@)J>
z$&#(f4<~+$8^+i>S@lnZTJo>t6~F40t1yL24CRqw>Z<#b-!nyn9UJ^B9KHQ+erAGi
zgg}RMBA8N;E=kS1m7jxP)*w95vzT^+$vb8eQh`f!GO1A@C<!r%B4}<&GJN(2^AkW4
ziT5pTp6Pxvw_(iptnCL3vQ0M*%7N4!w196_q@Lv5Ek#8}2+>U~B-3F`Cs|iy!f7Hy
zyDj-r+5BE3s1#p@?`SU7aZMu1HR9bU?CU{)M_S6uC!&5po9*@zt|?sS584|{m)8*Y
zWin|AlH6q3%!ATkrO%%}|B?wiJ>P`U%dkS!0)J!p0E6{j%f|&76KgM{f@mnh)_l+p
zwV>mgmLq5C2V23u!#SO+T;SHZSJY^euW`7}tw+hOu#=q$V|>UFnf@s;3J|G?nLP4C
z8$mp1o>Div+yU}hnolpFcg<(~enr{%SnAJIt)=6eY(v*bxRkCMIWatdjj_z-Ad?^S
z8d(-iUDu7ZUGM8moFM5r6KZq%X*!i603+`(%vjNbXuLLL91?egB7oUX8u%R?uz^6Y
zmw_7!7_%6LgbFm-Ac?tS(q!CXVbcqIe{eH{yKNM(HA9rKT?j_T!d!ZF)B@hMwZBSS
ztW{Q82cpnf!p=&8)WI(0RmgG6Nv3TaEL}V*!tij3*Gcc7%Iy%RJN`ek*@CHIfu(Aa
zloUrEzw$d!^$PsXaLF8JKVy(zVb{*pE3Q`^CTS<0eJy@-IbK-$ph2-}-?DTczx(AX
za^lr?*-RC!NkeyJ<dU0LHO7n|b&ln?!oLjLq4e@0JjBF`co$Na(^8)a@J*R@(l@?i
zix~|DGnG;7e5dg@8Z=z%gE|9hW1Kh5(qB0`bFXv`EK`9|7+S_&c!v=8y+m>Ga9Gr3
zjLcp=-@=BkN9pK2<5E+iH#(C`>D)ccSBBZAOYj?`GDX%jq|Uat%ly%>7HT>z$LhPn
z4x6a`{!X>A%|@Emt`TFj$O37TQW~#HvnxQghW}Tl5Qffk-=&G`T}tW3*;XHSjgUaS
zZCI_HT61Ip3GeO%>?stqzRrY7tu6ovvRVFdy{T1#fRGTd@3n#e8xJ&!US#AmYwd2x
z^dODcH71WlChcjYC96L7Ol@D2H~hfESjBVN^ZS{3G5hop(8B)Ur<JMu+0eB*_}^!l
zVM^}dpAO<LKLn>S!(~$KiyZdT628XB_{*NF+L;hIysp0<=HUT%y-jtNiHjN5cx8vP
z>_x4Y;TU=EG~nCdM6N5gPuONWf9W0e`K-IPRYRwv{C*V(q)21`!s&0!bn$K;td6QV
zV`(goK4zzLo~Y#KH1ov^;0xshRjUO0Z!zA`<`WGmzD&Q`Cuk<Wd~OmCkbe1G4x~qV
zRWk4Tu#a2U$mPDN$1#tk!BM67)v6gBU3Ga3@Y&t$R_Tq_fEXK{tt*zpFf%zF*fJqU
zKvlh7|Dj~}sg;XW#t=rD5q#{-Mx{M{LUXm7b!0g$*^Za#nDQ96Hna_w@3?(3Y(w5E
z4L0tDKbatJ9`~LtVN9F5@jY7ODL@25AgEnvB#l1a*lrV7%c4nV05Ymw#?XOWsh?S2
zk<yF}azm7l&iKtH7?$V+Cz4L(LB|ZS6zt~_6fervfx5_vTCJX3#2gcnL_)Pclj|1h
zwsj8DgpxJ9!8ethH3?%~MQIzmnKCg*c`=Ub1A6+U?q{yCl4KhfTIb^f+Aze`-JPz(
z)ak&7vinY-(^q5t+C0@%Chv)mZ!v~tdATHws-o`pgu+;ZCp#0lRMl4A2G=KGq?cWa
zX5Tg{lKQAKW(zZT;D-k+3VoTV{k->yvRPZ2oP;Yxc2_p~Yd)ZOZOrFVNH<Gfi!8K$
zwWPjo=w)!I=?g<NiI5zm75gdC-e%Xpv`prR7EG#B7m*1qQzH;Dqs}3K%VHDH!BO)|
z0BMjeZAUgY$k{lb;JyK(L3A+Ltd61Fwr6fu>W(W3fy^y3S5CbiXCx{M$u5A1Zc66P
z*b_~>WopqYB)!g?PvX?i1x@DfXL@(!$5&Fr=u8<I5}oFF5R4sOR%NZCt-2(P%!Cn!
z&f)MIKk(1mXtuWwbti`(eDr{(%6K+MbzILED+iVtFJOF`g3M){Qr{wy9fcX^`M6cg
zAL7B5#baZ4sm;`bI;o|kN%X!48Yxz_NC-YAf5p%pTQQb)wo|QT6>gtlcU>;TK9+tQ
z3_$Loue>t2@<_4RxHe1lM=d3*LcGTo1WL7E7X;9#GLv}UQ@whJrNxP|33Em#1a!)(
zey8dEo5C3nwo9k@NBv_@oSX1DyK{K|wKDunTQ1<C*&@7={K{s?@;E3USI+viRYl0H
zUerd1FoWt0Co^v+bmph!Z*$@U+dJwZbjVROo2n20ND@Y~=^u>=1m3%mnje=nRWAuI
zW8B1-Q83OjpM$vH4L47pBLgV34g~j89h<72RwFE>SYzCNb7u3XtlSDF31J1f0NkT|
zKB;608yP>C7`I0zyu6la)H9?tyo#j-hNRmh$Oa7*9UQ^MJRq2{Ru!U|u`ybB&eRh>
zLNmDat1pH8nlEoj84C$c0gn$l@#LHP*(5Gq6pzdV0bc>L%>~;~(-#af%7R2@=v0YA
z(c<7GfiJ_l3JH0S<Wi&)1y^~F+_3QFXSExitYA62BMgC-CRw}qrf*!nka>&dtIEZ)
z5FljM@#QrXjMvv8Q4}Xr=Z2_t+vqnr0fw$IBF26PHVFbyH#Y`13`;^LNoVjt_C&i8
zRmUVrs45%%Y*TJqc^RiUXO#ylT;}=>YCB}HGZ)T0RSBi2d@t*R5ddj8Yhd#8TrgKf
z$%wXiEgrH1joKUVwx6)*kjl}v5&qICS5p}h4g-l6Dn74OoW|pE^Lm(3Gh&{wU+80N
z&Il;#p*F0Uvd#i?((D{OT%W#N3f(iH0{rSAXnOg|4%;XtnDF3!;N?2aPdS80s^Z0X
z)GWbWp=f%P_gjSzc!UB18?{T9rNFCICB%}QM+?E;_Q14pnn*osOhD1`{M65mjc3$V
zK@_Jp-y1M6JU;i1v+vsPNK2%p0>AAM1k+@{tXmixB%KB=r#THWOkW{`&8;GFZMH3$
z>kkmev$|QcX@(+|&d$*{Mf0VF*cx%kZim62xlLkKQrP^?-5a?y5|n>-@nKOp9#JWf
z{G>>NZX7deCU*{&QGJ2mXbp;u8C1Vraj9@JNoyv-xh6q3H5@NL@Pw~)I+V*Jw%h_w
zUlUkar@NQb!*w5e>F%UpqE4=cA8`cq9efwzMr<+dO`is8Dc(7~4NeXdABg*S-P@Di
zk*<~}XG*wMQLyk`v7p{Teeoi4pT8kylx<J<7^6zmINNueLN@u}2?ulVqAAZfHn-hN
zCUT#@7k{}(OX;g`Sg*;h6P%BN9z>7fne}oM_vpwRy?*&L`8VG;QZIV!BH2)tUz}e4
zqrWh!XJx{@|ByXvrR*02OFfOpoT2I0nC6}}o`mq>iWdgn<}%Kp*~bQBxW6wJ9DKai
zof{oh4$_i(eE|r5cPRG?&_&XUC;kT_xb@+5gh6`|EP=Q0!n>R&CAe>%l@iyq*!t0;
z15=b6N{LPuaT%Ckj4D{~LF??ME5W5j30K}6lPbutkomO6K_qz_XA=&X{8sM;<;6Y<
zlF>WV@mRP^Y{3&0ItlRJF0}a4g&8d0z`qh)TNw~zKfSC%#pfc2wJ8r|M$XM$h`^1q
zK4o*U2}&-K;sjABE<Hi^;cmHKC&slkh;nin;1*;!SNTMW86`hg?H_!<H5UrY#5d}~
z$V!#|nmKyJC%V9RsEil;>Gau~h*)lr`$}bRAC4E#L^PgJJ_cu+aN=BeB-nW`Sqz`X
z`KLD?O;y7Xk<<=WBQecZMByaJYeo{6ZfnE<f#<AJ%O5ro0pq}S!q9Yc8B2VxEWzr_
z^1Gcn>e;M=q8A2UvOQWiEY^KV{hq5Vr>e0}-*y-^$%q)~;QGy0fRKl6;-YhqvE=T?
z#w|i?Gyy7d-S<GQ!JfOZRBCU4*su{S;d`<%V$`ld%h@0|fXxAVLl0kcbz|D${y_q-
z`5m|1fuALg=n0M?>8DDk-=)A)ldHq%dn3J8Y_$z&o$wk#qUNQqpgr4NS);Dju=dQ)
zDL%(Kj!oZV)7?+b{oW^7@kGRsN5U!A8@5+BVOAd}KkLt;s3tm#t`U{CWKuCCw#lyY
zVRU9`++(hQ<n8sFhJN?p&axr)ae7s7sa(Y_BCD8P)`$H0feBkMo+{5-hijefhIf>1
zzak~Rjns$e8eD$BL5Kdj$me8`SizFN(#U{ue*8z(jYvY8>lo);S-A-Qj9H*r-IQVV
zhO^;b*+r(qFl@RE@wR9d!Y^LRofB~fBw=j8vm$@D<n%dp`I;Z0ZG6^(^0nZ<ms)P;
zQug1_uUxXzu8U{fSoHUtO>nS12ppqe`oL(S%<wTjJkh*eHP<#H4ZJl~N?aE4QqEQ}
zRm@ZC=A-aGPQt!<8Z2@J02)VkB9ePx^sG&H9zOk&9C2=xDOzq^q;kbhdnXvV_7!rS
z#%WgkNIzEAnN%)TpJsm7$i?yvVaGfslaw#u0;f|XkfvTbHRqapf{*=EncTw`dM80W
z(WJGaArM(wY|=p4#gR^e<4z6fS9Z@#-*6}&*KPH+<f~?ocr{CXBrPI`ya`U0?v#Jq
zi|^>P+_Pp7hIM%U45JrCYDDygLwA)k>WL!gz8n@dRx~UfqHeaEn9M7xXZUtIsK-}g
z!GVies#rL@<455kB`THAxCnQTR`#W2pwy2g=V=UGJxcR3CL+iVT?Hp%YcSW}iWm!n
zKQyJFkV{u*3h9obUPz<}#iZ&mj4Cx(v@i2XIXCD`(xLNn)4oGG1p(WBtP#|tOYw#z
zEUtIU{tH``YJ$YKM^MT`IEB=6iIEcDl_$-D6E@@uVxT?4LT61N3TIHz7&N2ZaQqy>
zXFH!x>o|($Bdem?dUDeghe%l2{9<hbB$VC%))Yfxmb?No>29PpT4~;5Nh#aM@`|u_
z)JJtyQV=fRHLOHO?dqKpe{yzeqT#pSX<z~y>>oFmO0m>R!HFkm!2*tRtyAkw(lx}b
z(Psm*nzMbL?t2K)qANeSiphXe4nT9qPriWd6=!gXO`G>wTMq90+TevqmCjhH%`JZa
zabs7LvodQG&03q=WW)wLn_GXS!UL(Mr;$e>mcE_oUWZE|pyy!C>D{tH0_GX_?RB$P
zKJU4D%*gZ3iwV<2E}u2LF?N!9IJ3Q~9z{oBGoQN$j^21nFLjEMc9?CulX=}_EowA^
z5#P#rjln4Ip&SkSks$g_%()tLZ<r+|2JJGI@RUTQqUTBtfQwfLov=8LW+jAUw>$Ys
z5?8Onhl0A0DrB?vdQ?B3?_0aOU)Zp3o4EBQ_=Il&Jr399JgjN)DULrE)D-cjjCeJT
z8@_0x3Hgw^WQ`Le#?_19il(r{i`1iZ9yaSspXoBgis17Aue-}%*%Z6B`tXN4D?pgh
zq`Uakwzdmd!wgb?!NUGOmL&%J?ltiVwip=?(dfwbjSU8#^z#79??4nXaG2W9U~1TQ
z@vV%s;_+zrVO7B|IV&M-?mG-PL@0eX=}_<Mpz1;ST<e{Fv3nK2QMqr`scd?OP22f>
z7Kl8GIj=P7nHgeUU^9Fm?^oQRyTs5%b+;vJB)g(BU-x-w9pn@rKq8$WjpDqfNk`;e
z`q9ZahPo_4{T<zI1JZ(Gc|7urzF`Gn$*WE*wZ5%I#}ROG=Xo_y(W5%k3b7nfeR&2W
zW=r0UdBET+Ck!a$H+<ok#i&^U!^b2u+b4Qwc8uwB3BmQ{?6A2fVz+=@eU(aKD}51Z
z=pV9N*{}EuVe2XC#5KunUx|G1<czkS`17PfE0{J-sXY&GMJ68+BJR}6vfppRmQbM>
zr@ul@K$Bb1l-DzkmY|RMTM_0huUv<Q)ORht{31=H$R#p)HsO9&HWpZpHVwRt3kMG7
zuL78NM#>T+JkyET0J>dB^1xV%*so64KMi%~E%8Z*o0QE97k+$>*bASaH~Jal?rBRe
zCM18aM4+l>zg#kG^^C7qswK~vSn=jUrZ=g0<~a4mCf?;RF`@Fy0NkT0%$W7c{<Bss
zd5&#Gu116Tk;z_>=N&xjYgW*vIMUpdl&TIAqcS_w5+&&$k|r1C%dy^g-VNq6)ehTE
z$O3LYb4gQ-X5`%Y8cR$=9!WpAEZJpASNN&NjpQ^j)gS$z$Ov-Vh3Rf!stPFLqOw02
z={ULQhmmB#XkvZo30b&tI(7NUM%eTYvOI4nB1d5u#;C=gIWjp}(m}y3spJ7%!DyD4
zi6$t68nQ}>fvC66tRTON?x7!EG!$qYtkjx`;=LM004-nVfGkNY*k|_10HF|-zY(0y
z*+J3PcZ&;%RxGlro_sk6$bmwmi!s~)i{)c$iwbWwvJwl7-i!>kv(!Cq>B$T&W#luP
zNgeMKy5;4!(r0BPLrw3^2_yEK3Nm6l$Qleo9f-0x67^ynu2lsl4vyQ%T*;u%jBvUu
zLj=%Q3SR`88jByl&@*^odxl+-btal+Cwjme9p2dnKAl?_2t7c*n;1$74Xvl3mP&G*
z=_1%FpLYx%`jF%774Ga17k^GLcb4Aa^<k={LMcmB?CJc$pB({A&0*pMGcU{zsvqWK
z=5xB?(@Y54LC)%Qn#QP6_Pv9uk8(<o;PkL%dzmr<M*fZf6MEBfCMzg&CVObN4@qF`
z5^u9@gXG9k(*>V_{AgA<?e`LR-Pw=&iv71uDblR^x}<N$p{VdCsPzuJr_^`u)nfAm
z`HF(OHo~P{<M=)}rmIla+`DEFemw70``msx%agFpp)NU#=8_+yy+ce<O=A@BUlmoq
z>5a3^q8`0i@MWvmx@mR5kO$miIK6L}bG-p|()@?hHSY>FqB}5hnSYT7&i#f}6t&q6
zBpf)k<ZihGngryDH11qAI#8)Ya{>E!?@j_mj7Go3V8{TMalr@4LY+L5caG<X2NcPq
z&6ix2s9t3)#}kKV>TkG)#Sjj&apUvlfp0BVx&6bYs!#kf55_ral%GGIOtKWsH`a#v
z*c{~WdbYDt<-%5~5ogyWm&-f%pX`}wU}jI?gQ9BA%!IZgAeNWbSp}W2Xzu2&W(oM|
zFT<0VpUu#C#kll^^b>7u=y%14C&Ng~c$yp2`vl$A3X2wOLcr)J-WkASB)vva%%eXd
zF9*|4l1EqOr%qZbHHO=~7xJ2kD`>bUFq3BWN0$Y1F$9ANOF!C$o3c~De$xB3xtkoq
z$YY~7q(gXeRO)Xe)wdgIe({8_^Q|k-r{s7&$>sTSuvZj5{2{XJG?3DVqT|aKtmis0
ztQvWqA=#G`o*5TF&w;N#*1L_ayZsqUr~A5|KxCoq%^*ga@u=S_OMJnx`S3f^kpqez
z`|2vT*Q5>|&%#W3R6qzA9~qB%uN(<A&6_qL(P`^$zK|b?0d2>++J*u@v6U8|_eU8K
znc(vb)LCW)|6sHC+}R*&MBfaw&ZF``cg*iGm;?`tfFi(op6STpMv<GYLD7E+;A};X
z9VmhM4N?RPE`n}2+~dx;hUFt%E^+DH)P$CT$sB$(!Aqiq+1*t!06od$$7bi{DiDC4
z7LCX2RrE($<#)Bh7W*+?F(}b%w8rUc0bV>HpT_cWxv+r>tcJ7;xMcAv4EL?nqao>O
z#`v&MK!(RgDG!mboH#~NQeJ%Ua+TnIfS2Urrzjl7)a5&>=Nb<&?es{mwxI*JD^r1m
z$?NLL&EsCk?0yy16mU`NB)i9JW8t(v*=)aeo895?HRDz9HoC^PE!yj-{XN(yb3_DF
zkt9$JI636wq2FJU?;q<7Hxmbm++@glZk{~*btZf99u+#_&L5Ae`6-A@1sHgtz1$H4
zb^1^Ia*-~y$USF$`{7KEM&#b04gIwNB<SkH`y>5CKU&zUu}jB#`+bO}Ym~p@l`p*k
zMve^)#TP%Z%#_L6Izs^cuf!PyZ(y+n_j|G!Nd9S9Nd`RZ0EW`cr!NnB@sO$G&x_4n
z{`hLjLR9K|OHgPwSK7y3IIiX@nj;?y1Mam_2{pXc_3GN7YaazsPdxCnq$$j014QLG
ziL*wxeANUBZ*L9=ATRrxPjY1*+z;Sk+8@=|DGy=`9EBRvp7H!vHTHU6n@=9>HR1|B
z6XgQX%7`Q-Ug;V~3&40#bwK<2jNZ>EaA&LaN8iA{)J{uFA9c5XzT#i+YXX$~WClUW
zfu;kC{Z;zm)6b1bQlRFxMekoTU;}x&?vA9)OVA3w)r+V}wD({&eMm*&<NNiK*ks%2
zQ5~*bndTs+kHzG$bhj60uwQp&E*tp?_+menSmfjIvx4<R(kIDO>PA#NOetoM|GR}q
zu*Ze44|~JhcbWQvgKoE^q{$P!{-YO6nfjwgcQ`85sBd2I19|Bq=`Q!C;)S=8Ciizu
z@I)+v3IuUHqK9>*$B2zTrftQHGMFFpg0^zbB=@^ZS@?aka*1$dqQ0J)lRPqytmt_d
zO(dnlYrip!I_apeakPtQ8O!Tr6yrbM=yts9t(pvMn*<$K6&{+?Jiz*&hWW=r{$(Ww
zykCz4Vzp)Ze_z*BA+x}K>q_9n>F1RiZhfS^nH)c;u^Uye)g8vB3S7!^W7X<=s{*-r
zY`R&tf4H5V$ExG8R(YZ2X(;9*j~3Rqi!|A9H_3l}_rHHAeSmHC-v3wG_{S?(mh-~w
z6V!yqWG+@;!DDMiZ@ZWmxi2Fk0be_H1Eg^AVwxsRkeaRCEX$Pfl>1$7Bd&v4o_GYV
z=>OyUNwBRxeX3MI-#5Pb<@%ee&j8%w@%vg>blWH(CMY;zhDlr21oQ|M%!&VO8SNK2
zk3;VpJDi@*d)aR)IR&V#t6hgOO8uYK!VXA$`f>ujGF{>yy<T9XNSCxi^+<L5B=~L!
zrS8M=fKQJ<aQ0J2@<d_I$v)D4@nW^X3hR-MxtX=!m-cBY3VOSY<nw{h40N`#5e80O
z!DQ6kC^qzp*nmFzDeT`2*A*(U8w(4ye0u*MHf=$Nx7Y`nEtgj5K+2&}8ven5a&u+m
z4dd&W&8fY&(zd8<t*_$gGc{EV%qR=WrH!{4-N08B_(=MduM0fDbH>B&YAlC%l}pB#
z3f_1C+%B<J#g_!l8y_~9k5%r_St!A}kKf83P>3IH7*DMue7=-b*z0*+_N>^lr@y-1
z(96=6dB<!e>F76gQc)UhbGx(uZ7cn?+&VsZN|$)EE@Ua}TU=~un<h`^%kh0aM*g9-
zQDn1l>l>qI>-xjV=<5y8e^A?949&5A*m^O<<uPe4J68dRsI=h#J;1cb<8n)~?%g3h
z)8DQ)3F^C@Tmn_@2+1?Lu~z+vn3ZogkD&8r?MRVn5F-*UnqA)}Rw9wPI{Or+9N&)+
zyn0BglR;(`^33dC7sG#iS8`@7vdXfiLHUefEFKpxWY$KZGjD#A%@tX#ucbaXVZN=z
z`(s8&UiEG`y?2<A{^5&i*1j5O_4tz0EJAj^d#l1cQcg)C>{F!jM@avt#~<Z;JHkWL
zS=kfm#CRUUJBDfWeY}?+skU|9+d)|RZU1HyS0y6DJ*33Rz04rR(!46_jifdIH~;aE
zd+e{*CBK7Jbkwr)#=gHU$6aO%^5+>Rjy~M2U)@}~jKUb1p6i@2TExWF6undQqceMV
z8W9SkZ_~=m)FG+V4C8U3cBU?L`=wE9e!Smp!^|2cnIXsvE*%X8(64A!9Zb%YZi364
z?PhfmaFO5u=k-<m_)HdU3PcB%0=;NCz(vf0zFRB?%y1!b60m)53b&m2zx}}7oPN>3
zP+6~FD+{Gl+<ww&#vm~m%73;P^DbvmSRt3UtJkUOZ00mD_#t5HYVm7~h2&Q@?}Mdh
zCT8X^%`S3C_?ixtN5n^I#Aw%X_kQTa-aT2d?H>awLa5{Cbs0nDN7_h<qu~9ItrUp=
z{mfTJe)@b-t7P62$Fg>|0%<NmUpw1h?$f+cC5&f<kJgHja;VNdnr90g)`VKv?P)e1
zPtH7_0hy~W1Xshd^2PmPu8${$yT~(BpNmPi{a}MpO5?PI-{Z%-i{GU~e;kAR0Mfr2
z&AC023o|yh82aF6W)?I%q0#@^-yMJ8@m<xF;~*AF+Q54Vm2t`2XE5k*hWh6Zeu-S%
z$r}4OVuyshDDv0)lL1GwowKNDZ58t$6*+cJFMZ>EtjqV5#FsusqIZdrpq}|iej)#d
zKQ=L)AOFhB5LmR}eplII1d)*W@{7}FrdbcWtSY8ADsT3K0N#IcG*$b^+MdKysb`X8
zk}C21?@nLm8{QeQpzGIpOeyi5ir^A<CYGO!{bT1shz9hHOm1cmS#vk|5v7P*_o7$L
z6MB%{BBSM2Y)|eeQLX9|rrdFPJL*b}<&O{|DYk6$Of~une76rlgDu|#H9mb8z>j}}
z!+7*9>^os28K2e@!mGvba6%yeRV(t<#3kP>!wt?GynlMLf831!$$w}Cv~;w`A*HTd
z^HJJAbNk-Q6+Fk&zmv}%!E>jDX>UjVOMk(qvPz98S^$*?D@#&&ZxyKH_shuQgJT%(
z{N<#?i#}D+t2F29zr4}^;-|DiS~^BMUlod%?4S{LN5sVS-1|>gO`hdRZLni2?r*S9
zN<H@ABwvA1(i<T^(TVc1vW0=g>_Bysv>WJ4z`G~af|J8x!~^U%_EvziRmcCsAKu0Q
z3fQcem3e<vhC_|<(y5y@hx+i!>*?rP?x6>Pyb6W;v?R(ocn?X#mP=2R$VcFB#GXVB
zN|o{4S2VVZl%-w9sHjZ+Iz%LrwvhktYkT{LLh$;3Uh9~bs9cRsvo-z}J}>Oi8~u*R
z*8BKV`q0MsKK0N_q%(I=wTb?eRl7y(4EwGgdlx-W?2z2wN1RQ2AgM3B_&gkcA;?^P
zdiMD2SP1DfFdUzCm~gntCSJ%Qx?7`~xFUAm!<Q`j^?$gkfB&Fkh%JNZmG2CrnSgxC
zwy~=Th+@3`7?1tjN-ZR`dx>$o2l7yAenMqf^W`owYfyVeOyK183b*!b@nQZp+o#Af
zd1niy3JFClOB^eX&2~zmGEw%OjSJ(!S1M1qJ%_s5{PNGk%eunM_NlDXhf_Z<@g?~x
zg|h;pxHpBgx8!*aQoPWMv8b3M#{cNQ{&g&AF76<<K9W?zrvA_u>&885<}<uWe=hF2
zFPJhB^9%4|C`NVs`76<ZpjMo6lI_WYz~N^>p=ioU9{FV^w&+engft{F(@GRJSnxBX
zsX@P8XyYgkcslPNAHmgxU0+6~dXN6<Fn0=nCbnVmJ~z9_ZjJf*cy*KEOgILZ8U3LS
zd^!W&TsY1bsN}i7;+3lpH7Xu*_*nFWdGN10;NJ~<yUKKLOp-C29z?n;QDxuCM`YIV
zTN&j?fuS4r<i>^WdPjM(aI(ff0%hu2Q>?G@UA*nXKR27(X1;%&9^n-$Iqrng98b7p
zlv7o?^R;z*7<HF((5%SV(VR5-DQ8E@x<#1f!>i$Tr2bS=yb+byncki8d4RrM_eEa)
zcI8bM1zcKkQd?SW7PuUS`+J$Y)5Ms}d6Ol1oN4M?qnOzO_|)FpJ{GR84tjXsG@@-2
zw~tp48<#)vSJ3T~j{9#H$zKjrN8lu2#v#{DP#~2ZPcsZy#ZL~5@@AEcozbp}tyFO%
zIcdVbOBei59M(-a6B*F}k&TK^W%q~y@^`$mZhTCo3_O`kX)X_vG_MoSjgDlbqa&NN
z*uXD&n0YUo-BuJ8@$;dX)U_Ev*i7>HjI=L@+uLG#cyy?bEZN|AQi@*e&{Wpmqqnet
zSjPPFqLmn2`otaLHNf+E`F4L94GMy{*!+Efs*g1p{7xz|fn8H>*-04-gjR5G=d?y^
z(f_ne_Kc-dbRO&?JAO`6W<_&-I5cRKxBY<CRiDpHadm<%RIK^(`jS4G1_~wqG;r^L
zYPSvs?px;cC?U>M+rqd?6fVXj^_8<uJDqE7uFc|(2sOy~*5lx04qc6C@$0kie1OjS
zG}dK}#qa7E_iY&OVQx?2l8KdHO{rx6n95^+V=-28+NF(#Sg4A`8+44;@?g&;Qs5AH
zXvWY!p2~Uo;nH;J_ZGFOoyM1+`#74riJc~34PUu!i!w_ymB7q!6KR9)@K)Q<=r*oK
zj}A<Np_XMVPSCL$IzfI>Ho^m=)r=OaBlkR=@vNnfHh;KNzvtKfv`m~s)-=WJr79`+
zI|WHlwjb|T?Z5d)laJW!%)7OFE4^=<ul&yEblDR09ka<vsoAh-9Dd7Bd0*5gHJ<qR
z3SC6PqZ_}CiM3OUd|q_+`xsssLt<jTVA^NcXLJgZ61q5sM_$oV1INdn;Xyibt|upi
zmWsb>P|7%(R+Se=%LC(tt&At~uAia2x3Z>llB?&ZC&a_8{p^Ry;7?!kccXpX1%E-?
zplT$n>=t}eW*oe1Sj4(#-(?FR<`y018cKnH!0J*(-_<jx7B%|5pl>j1H=+(HYn86`
zkLO6T<;Nk2D7_^Nea<B7Iz#CsZ|Mbd%)w)4a75=DahuAR8lKFT1e>M2$$txCTD&7#
zqCFd|U*KR`>Ss55lPL1vx`0VefrWP+6b<l;F>Na<)3tSxg-x+%I8fT04-;hA><=sE
z;pd%*iSJC*#p39^mzA<xaerPHI_k~*vMW;6faYa}H=>5GjkkyN`<RLH=1gAe`d1n$
zK#24D(Jz2JjLX>*^MJVr_f6A3kn7UL{~-QB*vderH@g$?l-xy5e4CLtPVi1Jz=&k=
z!kLc9eSd@DNdI+LbLZme{CW^OwsfxQ&EaY(G<qM{ez9Axx-|Ak`aC|%AX?}u<veBl
zBdnjSt%%SR>+iSkI6GDYYam<D5!m6{w0W!iRUemU-QHwbQ+rZ<|IKPVBOV6{w$9#B
zqjA(yfUIr&H<_#0X{M;uf=Y$1>0wPo9=jdiqectT<Y^WcI}V1^gX5i*6O`)eRSgl%
zvjPDbV>qAxEB=-i_i~A%S9je$$*KhH^W8NkrUq=eW4(a~=rgdAJ9po844A}ETR1Q{
zniyJP{L;`Me%7N35WP}-XGFF%nZxb!rSox^mvS&PZqc1IQa_T~HanJ03Ej#|Ow=0S
z`Wne_`yeF$dpukkb9#54s^9i$xeCHRBd}uc1AuMb>pix$&c;dL9V9p%L0l8nMRPAH
zh|qHGr@x-@_iKfyu{v(p(}i!@f-~_?K0aJ?f0^>>2P}&@dU$3?{SS+bF}9WiN0(A6
z<>a!t81bhvaa!%E>`cn_0s$*=+-;cDV?VgyN+kMu*h+}%WwaRQEZY`AM>jYpr65F~
zw3a-I;?X(x>rLF7Ow!xf)cQZgrY4Mg_xcHYg$-XJ-9DY19q>D#8Jv71Oqx!M##)_n
zYD6d1a8R<gk$>pU%Y@u|x8-e=$ufmmg~R4Sf5aKPUT-sisoGCF4Uan*npGLnCgwqB
z&vUclUSh@=H>qvE@eu*7sXY36kiyVlZYN6|9KJ=MI(Xh|EDcHKz#?<scUVk>Wffob
z<_=_e92>vm1#t8%lF$kw%ZY9u7r=kZG`8;%IMbV`sEs31b+hjMhC!;GM=^f!9u{V=
z6cdGz7qOZBQbeipOCq6zGg4(M9y;J9?O#rS?VNk~(a}4x2j=#Xg$9~;LeN;;Pi*am
z;&JKY+RY2H4u*Tu3ciH!f>tMo!ju<aj3rH4{Y4*qJ6_O(%9AI=B*YE~;I@o1S$OMD
z$YS1_FT9A1)FFs6INsFNa}Q8%2o?tKcYAlA|1Co*RXe>q&iY#oQQb6P`#){_na8wy
zfEXo<$%g5vMt_Ju4f-XnF_9<sg-(=zNVyUvHqN<|HXKY?Zsg#%Oq!h1<s!B!02L}O
z<K4ZA5f~Zbkz|Zo@}W6adI*$UyvS3+stqrb-fL}<-dan9a){UIBAN&KEvWCQ-?_b{
z=8R}0O(}Em`fZt`#n2mOcPY=`?U6e`!+(4>F+1+G*p~i3f(%S;2#ASVjf^lE-jm{{
z>yMnt=%PPIeNTLNN;ec7hm&%+EEbzUwgDa{JnVp6*%CTo$zWMr-JdKF!VLTL^Bw`M
zWxBQ)adOXo+h`lrOO5?C+?5ZH!)7i**yhRX$|egw!-TWF@Yb8hl_-S0lMnyk-OpNl
zh3ci0s}L*4Jo&N=2-!i%rnYROdiq(jXMRPv7}C0~GC&l`gn7)pv0eOr%^jJeRasLR
zO0St-E?mIvNYhgw?#leQsqRW`>Q07XDAjd2;1j*ge13E<UZnHtH<^gvk@y@Wk%TI=
z^s(eG?d-MkpK+}OMV0-A;m{q<&udG^5RbqwBf-A);(*oa;$@M02kUQ|$WrDf-t2d9
zch0jG0rN@@l=(qFYo1Y@(Jvr)=U(SphbybLvYjb43vaFe{&E9mME}bAm9<IQeIAQ>
z!LisYzT1B#oqm)l=7<RaJ1#QcF&5Y2uigl3K}Wav?!jF<Aj<K=ER{+iYIhioZH0{P
zR5nqjH)|C2vy<qh;!3@vcdCw!zsuXbIXqScC_Gk;wP^mpBqv}MR$rnT__TdP2kq5v
zQaTC(o%5(tIwslKQd)&x+P|3DE}fvrz*T*yZyD;hjw|>B67IltuK&&XW=S4%VcA1N
z_6=K6DAMAWm`(CA=+7xMiSpF<5jWo7J@|h`IAhW#ITFfrE`~q-Pf*&(3fg-v$YN;|
z_R^DJQWdQz=TD(An(X;<1XO>RyFnVs3hu_;?o!hi9o+mIVX6iZjT=jeWLY6Vj}69^
z>>x_+)QyYFjV_hzn%QA)aqqKxu1)llp7&108DQ8abDmjN^(6jE4%>HFO#T)`{8t94
z10$jIvcyKoY{ee)Z$)3~(7rKz1UA00h$KAuBUt%18d$06ZJRAdssFYeU2wggr}BW9
zDxUJSYi@f8k4so)!?<TGVdAX``z3JRLULWOBp+KJv_{Kl>^z@&lv98TFIzD=h>dZU
z=-?;z+mCUkQcYgC_Xm;m{?d4gbKl@v?f83X{a({Wl6kaHK3_zK80ofV$42G%Y7^1q
z2HQ56XLTMu$JDKl+xw3`?lvm!pAc)A#?-@SXt0jl#i%^_4rq(T^)3wXQ1Gcg#)XNP
zf+<el;uo>-7~Id;bhyxdp11l0CA}MKoFv-nOsgcorWhWt9PNd9;;*V$=J%E&vcw`$
z0R>Cd7**NbtACYO-1o&6gfl&tVXL4->^Eg+Q*iH-2801uYxz+!&7eo=QiufYf66i4
z?+08FdHD%lVZe6U`SpWvSFwFoD|WouOp=s6AaY#4@atey(mw-JQ05j`%U*Oy;bqq`
zrVElh%}!`U1ESX&!x7&~Jj-d91&F($hoq1H@Kwr&5a)^C7xksf9mO#Q9qDarigOGt
zW1Hfc%1O}0oXW@0)Rag4wk+R}Bch5oqBqMe5P;womHbSKFr_t9yX-7sI~)zW*9w__
z-RXOM@XXYu1sd_^M)AR(a?j*<ZHjjo7ro(E$ctpWkUoKJLyQm=^cLdXelb@J7p->!
zwnJ?l#VzRd$j<f}`bySPZA-WW4E(RCdjyiN+-K~oU)-F*q1@skJ8YP)*_D<myll`@
zY#*TFc9$3KJ$<h)?%pYvBdE`LZF#|1XziirtY6V#90jm49bHk;hb!)JnZSSa%(qi9
z(};i4Dd_O$1UT<|Eke>KnGosaeE7_I(0bY{;!5@A^y^xZzT-2f-xX|~6E;mGntU`P
z1pU}N>cEF?3YiMco|jX0wXvU6^Vvp1W*?(m?1~f3FsB-iuIeOS;9Wf5J4665nA_uV
zJR>p-eRA#t7Kc4~(8iAchL;VOm^21I^^QK<=g4riAMR#}_Mg7Fx=dcILYule1~17&
zi#||N0Q4~x%A?q<f>0`A`*ma@DIYB1j}eQyF<TiI8QXhRDqP5~P<d?3b>y33K#0mo
zyebc60$BhpfNppe{@th?eWEG)3h|RZ)A{kBi|9sq7|*;ZETea!;cRU!Mw<AAzC-PM
z0`RVob)skUO7YqYWAv{=J@IH?a7%5+jN9lyFPPXzqINSsZCt3~!aR#O^XA2wCcU@r
zlt&upb1{Kr7yt!d>!JZSZXQ#e&f8YIY&70{<CyQi3HNzBGw_or4e9tzrRwR`lq<b@
z=Fu@z=ocD?nnDB6!P;7cu}CfLh4{j=>RGdMn-9D%La_E_Xb5{H9|szr_9Bu91*X4=
z9`-=f-M6b74?bJoT%CM4cWgROa%ugXob2j%adFrK_pQEM{j<>j(a4prX##l4)t96W
z(D%3DLU=;DeqQ>_Ozo37hgNoOA(ww&%L}45Y7Qi=O)03n#UxOXmATgaJq77?tUQsL
zQ`y`nG3OU(c9+|_e4{HH<PsB&W98<BE;^g^OAe9sw{Z*WHA@YP+;xlLp<^1QpnGd}
z841l0Ug60<(8IHfx%ge`%1Tr>?n!*~Uj4&+yyF|;isv&M|LivXmq)y<6PPl*G+tQS
zEl13+?d)C4O?@mX?o(A2`F?p8y1<RgAyhMav?$$MWOUJW!g*a}jK%<kOwGuF<UsL3
z`9bYj=RxP6I=J&IT*Z_Pc2fhE!#PoXS46cwLf87@8NF`v76mtl)oaPkV$Iv-qg88*
zEI!GBmz`F3?nvB`e<S(s=IRobU|&6-Q&Pbl&50;R(dS&Fif=|AbQEcRxSl8WQ)f5W
zt3+_Eg|+VvPs5@ww7ii1{(fDq;Fhahb))?P2nRj-3?H+882Jf5Wc`wqSSagy*9&@v
zkCEfF7ydxql4~7%O3jMk{Y@{6$G)-p#&6-2fdx(Yrm`H{KYUWNguca>N<s|jaT||5
z(~mLIu-XQp3%IwRw)bGh#;!7d9{M_&!{x$8$jz|vmBgI-04)ee=`?n`3czpsK~GOo
zX7lK13)VXd#R?eqH`M*?_2)mtOQm-(jm13|{{#Q)rYAw-7n|mNNTaL6Wgj8>)8K-n
z<i^9wHSQZU3uen3Tt8c?B$S1`g+pA8j-Gg?yQV)M4+50>llh;KEpWiW>(afXp?l3;
z1Z@k~^PBD33bbx5nQNR-e@U<7_C4Tu;7i=|HRuiKIi3}Z&y8%ex}RT{*8rj$msTzM
z`XaYiUDZ$G94(;A*?cy3{_2Z+sED23Zo@^iWgjOwy!-mZ>~{=2JG@q1dmEWV9v0iD
zf0IWP&S}1tHZC434W{iP_ZT);ERIh(9tXxERiT{ciTd%DN<`GxG3E%~7?sOP^sga#
z5|XD30ZRYsc(nbi<6-~V(3g=ldVX?xlxzZ&XwMH|7shxLyVB6^J>o&0adNTO(%9sO
z%|reBB>$l)Q!~f-l73<BWENSnb}cJf)A;I)^9Egag1&#`TT330brOk4;H;V~->yT_
z^}VGqRP&g%L1;0EVH6nptRg6qD+Vv$d(EWX7@r^Xh=0g}8Q;wH^@4YOKwek2#=4p3
z>EfKYb4T-QKVOuvJA#jpec^1r;Ipqgbu+tb+{VXoE{kzKiOK?VztgWPMteoBkCcmH
zVG{t+olW>Nh)<hluY+fUYwcp-|D)_pz@hxx{^3edKcP}0%#fl@vad4}!mo&SijX0d
zEmZcIA|%U@WC@cL$}%XVn6Zz2$THR$%h;E(%)+eyOZR=h&-*<0{rr#jJ?7w;V-DuH
zuJ3i8=l486=jU^N*W2(=4tA~b&i9=7Ntu$RfTqcho3HhYHZLEF)CGGF@TNXS1EbJ&
z84YXgu;43|<PgTm_wJ?MA(}7fU#|HdUU9&!th%&p4@x>+^s_v8xeb<n$}V6;fqFfY
z)lmPQOL){x8?ZvUUiy`^2g&;8J9PSV`C#CB-DxHNkjCk<=PXww=M{^#2Bm`)v{Z1q
z3w3L8%#h0TTja}UWUn~Ptklgwel7+i-)#l-uXZH%IOfX{2A?%FbNF=$lJ~JT=#y^$
z48Oa+4dgfU#qKHn>6Ea;=G6eE5U#w=%_L&GsbuCS>@ew9k}LSBbHKC4<tfaj<F~QC
z1687v%YMJ$m1S5)sNV@b8;QuVyFo7FbOCJy`xPaW`!hoDP*^Mc^nI0(K6Weh?2m%#
zH%@vuD7}_`Qxdt#F{}8vHb}Q2uaZ<$nD!Ji$fEt!oE7xrh<C+OTN!b*>o1O1zSTLE
ze9X`1nYYP&P6K|V!W}pIZi<t}tOoM}b$Jav5hq1;H$10MXnK4pGxOKGd<+&FoIPKh
z+LC`E!f?9g48`|>lV|^-FV;rAVBM={wwh%l!((n4J&A2Pt#ciQv2Qp2*(-Yu(qF5U
zCfME7D5$8rt{=Wq`_44o^ptG=jb%xQfzOesJx*7Y;w-?6v@ARx;0PEnwA=$7+-0Pb
zR}0oqRYk8;vXbP+a9y8VTlyMxOP>GU+91=#{tes|ehPN<Fq+IHk20&xqS=XwNSmT+
zM%vVbitV%Oo7uUrEQ2X;v6F}GH-6n`vXDVRx@%de6KHmO$&>;(*srn&<aZLoCRUVv
zR24iJb5adA{nYDg$tB$>JnR&33S7`;F0ra)#rSbMGB?BTB$eIFe_OxI|F9N|L6ih<
z3ZqZ57b}pP%!=yVD<>lCX-u=juiJ2JfJ>+B#p1V`X!6bZtC~|6twI8OqK&0{VR86A
zf}h<a>K6`=^*gKI>qM=<Ap?U5)RVaxH<ye3dwiN}{bX|{G!J+cQVCNn<Guub$avD8
zgVI!6vdBo!Bsk<jz^VhR@=zGAA@K)LxV%P6j**88U&A<9cA3#R*bTGoZ~V65Dxs>J
z0ke_Z^e1bW)?d(-q|(jl_wTg1ZR>4!nL}ma!wYBiwcm$O5xG9U#gMlFE%U@0N(B)(
z_^53PT{BuO@i#NiYTD@6a_L>&X)yXa`Z2DMGdv8v+nHy@Tzg4V00%zqA<zigmNHfL
zVRh#&B+z3q0rrF3IQ_R`!L*IF*gG22DRGF^tCx}ECf08qG6D=I2~g(8HQ8buV(t_-
z&6xYm1(IWp;|xv}_?~@4Rl)iy-{&v5p{*I4VYQWyH?r98l6gx#ts>@LU&AL<4*k_+
z6~MVSrAzRCEWBE*ko*?L?=eeKpLf&K@w7*;wz71u8bpAe@C90>QNWeB_n1uK+_E-5
zfw^Bf<B7{;C#|pmj(X9$_fH*o3aelqr3uzFAJUmeQ!+geiyc-f@-vE_j}^4#WkZYx
zc3>=NJ8Pxt22YilIG!3+>?1b}so#o#jdiV`bqrp~#e?(%k2FXIaXTW#ti;rFh?r92
z;o&vWdt)iOf6$>eWdN4%%=}NVe2o!FC`DRh`DtMCuf@>`dpk7m?oE#V$h~#ePU@Gb
zb@ZmQE(0E>q*Ot^hhN)Jf)<X1pt-FrFujL5I4cClc&eJpB1o+FmFaNeBOza}1oL=)
zxSPC1f<y0L%_>2w4oTwJ)uj8rO>;1hU1MypxAP{+4|_XvEs}5wr!zS-1?DkS(s=6p
z^{BN}m5_W+3!3YqyDSctnts^Iavk~6{>Mg<j>>CBRi)cmoflnuomNJNuGf<xbB8Z8
znj=a1i>2%3OHYOIRpXPF86>fg>R`qs=0O#bM;jFLSX}4LD^Jx$pY<}Zs)Oc3b$^`-
z98nNE$*d%f4(Y#aY19uSue_T~lioa8j-VxyPk9B+j6te7uZDw2jE@rRn;7=r+<QNT
zD(Y4jcuNC}w<>W4)$9l&=iyWi&+u3Ed}4#NSJl<cem|r=)B){3og_Bq&7+?62ykW1
zFq7>EEmF0uzFv3aw`wD<Vd>TAWN_~ettS}P1uBodd{yhqCW05eK0ji4I#Twh)#)N6
z=Q`O_%iwaA8VtQW`lMSi9L`YJFN0p?vXH>=;kRpT4%`=|{;MC?<_PE;(BMVw;hCC5
z9GWxM)(R0DaXU)*@R$?DqA>`TunNw`Tk>0h`JhiHV~mmXQ2e{k+RCSqezae$N!E9X
z&Opn-WSlNZ{n|)d@5Fs-nVuy4AhdP+!&B7hrjL?)Pk%8l{lQ|n$XfP;Ph$${7ELR(
z4O>2CkAt(FO<AG4^!41E_qjcsxK(3QtFRSAQ-X}V2Tf@v{_kFKOPwB8l+;e!=x?;_
zs4jKGzrM#`ED4j$UQkj>p(rSRf<R(ZW=qO87VPNqT59emHH@2$zMX%Lygh#G5?JQn
zkimb1TcCBc9k&+CUjI4qy6w(vVL9n1{d6>vOD87r{d*RM#p{sk6UoVi6@xh=bWgSh
zu4BRNxEv=-+-l>_f)sy(hAs;&w%Scaju}o(zfVru$`I<QpV9nw?<rw4_l7i#a~0)A
zzFkq|8@P_dRy2+i1nIb?3UZda`s%0ED_2vKI)cu!(@XGD#FX_x*b0wbk^5LBZ<n3D
z@M^v~lK6WR2kmZ6tTcekU;jZaY;>AqNxv&6YL2+I+<pIG*rWW!u*WZ#5H%*V-s#+5
znTnYg4L6#klaoH1dwGV>oGz*==d?IfeX&C{mMLplagBt)->o+*ST~9rMo!EdwI_V0
zalxXm2bvMr(9i4#PmB5+F^1f{P7sjG^=%6C*K2c$MoY|vo<@U{2GSFFs@!xN`#W-T
zfed6J98={FAe)U<9g=vv+o_sFYsWMBy15@yS))Im+}<2VAt8GWyEmr+thpMfJPjT6
z$9wO5ul^31tLljxe%naD=<p!AL)(ojhBWY>NM>sASp~vFiFFS8ytj<X)hFw5`tGBT
z1E%;Prr%}=otmOMN$a=wfo3+<`vOKpo#?zP>Sebs7AB-AnA~)W?LU>D*J8Sm*L%9;
zGnKpW*hUWI{yJ<(DcIqJB1~=4Mrdi>EzBasC6az;=7JrKRkV`rBY9*eNN6{x?zXOh
z^Lfr0M&S8Sd`gaoOQiQ$$>g@ErP?F7*J;2*-0V(8>r4;(PXvZRH3W9*M17#u%KuL=
z|DRayA97206QDp1>b$MIj9|+SWJb`0rrM3ildaER*^Q;WiC#d3hJ3GH8y_x930kgn
zO<pP=&RQ&Ej^0W+jCubU+w`Pr@IJ?jUy)=&AFZtzQ9E%l1%>D_37f&4&BH`*bc^AL
z6Dww<qdkE6kieVsak14uy-m5X`d}{9Z@3zgV7`dLF~RT5OZsm4J)jChH{YtaP26dC
z>Hnxg32kFynkD`-OX79Vyhq^X34Wir<wMvhCd-<CG2~F=Xj>TA|B5aHiS23ED#R2#
zM{wT@{}t{who_$$m!3a;T+ZIBX2|AF^ydR;eUr(#*|pO}Cy{o-gsOVx2QKrB*cV;!
zYJ8aRu35f6ekRA))^ItoqAG2>UNO|8EwP1Y=LZim+9+V%c@?sZ4H|s5i!ilIojy6*
zdGPsh`?>8`A4m9C*E{eq_;>0HLGP^Cn}buK!YcXxpn)fx@k9HNJZ&I(P_zFHom7G_
z5aEncBm$|suo#^-TK05#O#c#um;KW_#*E1SfzMYr>%V^d?6&7*!7`yIO=mP7p@Jn3
z26oqH_e6kX%ll8vMLm3RcyugGW}xq$G(5LTMNe89wzj`*AS_%}*ECYLy21Z%y%Tc#
zD4$G~US|q45I&{9uy~zQP`b2jSC}`rO;zp4=E~;}7G4Oa9S5D=Ya|z;0#ci7BaLTQ
z1WsXMB%deX{zKIVa1Fz1T3`lWILn;%p<mB8_iH15T-F<_33>+$ZUXmx9Qo}-s&q|?
zgw3x`S^AN(tJasi&Qf{QT9m&mx0U!1I?2;^<&`d0wS~22F{}A2N&Bm!H)N@sHk-4N
zr0bTf<%&B6Ceac}OdJ~*;Vp)&NhsTP7kOhLEq@`%n|khTq?BAuPwhTx<y6S`-&yq0
znyQ@fSM}6xL|(g+5!KqkdxZ<;mZq*MctK@j#wJ+VPqas$_=cdCGUgNOZ1<v<Arr;5
z`nj>yUwI;4(4s0nj#tjXu)^HQn>?wdFMa9+Y_Y*dJ^Ne2KiUrs6-zwZ7}s!kxH8N-
z5|-gNl!JXXAvTnMw0Jy{sD-g=d=yrolzFNthZ{d4gdHM{vlINPe~d8We-VDj1rw{E
z<-@RyE{S*68t1M2+p`MK^CqmTa?@Eo--hkL+?62h(OIzlZTXH~lv3PD(E3h|hQywR
z@j3U|yj+>?%oT2aGRL~INaC5_mme#}PY=L8Rj@tvdx>7bS%=;Q%&g!zJ-)W`p!NXP
zd+Q6qYdvHS0|fFhQU6`Y{AuMAAIbI)Kk8iOc26jm0VFzFuXG{&R(WhUU5&F6nHMx~
zobfgy#zw>6qierVD7XWYf$hviMRhztOc)Mmr+t-kS5vHc3E4*3`P6Brp<rz`e8<W`
z_Y58Q#QD&uy+)SxhmDrg0rnAuzxUPB1H??<Oz!yt2Nz>s!{_3T6AmV6K~1#^3$=y$
zo|klCrLZS_;Y<C0u*gAhHL>*%5^2Z?qd$a=T_kB&E#I7?^BLs~Q8HVWSHoH+q5J%H
zkh4b?0Nlrzi(+Ma9t`*TDl+877iilq)TgAfAXW>R=tezM;}ydg8b2Mr22u6N_RB#7
z`=_Y9@k2{<livt>-wc=mDg}*L{kL9d|KQCI404d95Yu7q;BBGHb93-~_6NQQX8k}V
z5fCgJV`U<0+V;WZl%l?v04cfcmlJHI+v}jcvD~Wj!_&LL<;Z}ZVd!-%tqhzzBLh^5
z?e$_`tg<|NU*l0B4f0F$-S3`z7BXwmn{^kbzE~Ml@oEOw7xdk64rF!^o^^I&@X$*n
zvgPI!j>K(T)8@0IrjFBv=6TbfsRdLf_p0vvMX?7~CD-Kj=&r8GLj7Q95GQ;2y8WgK
z*t3V%JA-vtzDo|_5LJSW2D5q1LlN|cgZSQ~i>;Yga;|VfS(A^L5N9+4J9^h|sNDSy
zTEo8Yda)T~bNf^pYe?wzSE0oUvwDgGKGO!Fv3f+P#NfL`?q=Z1n1bkuUwz=>g}Gc9
zELQ}~8w+~3P=qU4!A_@cj5qYus&IehCaK)8v-x)LjXXNf{th~ggq3&_@S8QX;Q3%c
zGb{>baJ4-s)NlCdFP{lN#I5D0gkM@B_zwDf2vEWXjIV?4+Ou0>kI<7JS)ERQwKlLg
z)`;H7G;0L36W^D*(omKzoE95+jDE>2w)f1#X5FlTvEruy`%dbmY(vUV#p>0VFfqOP
z^jRrm;0)ii6VL&m2fmooifZR<XqJ9hNFi+tIZB^BGjLQ|@M~50ZJNbj$TXpeo#`?q
zf%;0;jcuD!La-x3ZUu;<&@hnhWbTLyhO3R;nAi;3^Q@z!c(y;^+6`KD5b~c`sSBbz
z^p~GKuB3#532iR}j5c0kke?S3xsX<#(AkrbBQwQ5_)+Q&L=dTR>av%=$L7d|?eB=@
zz@~V&O#rkJzxG4Pplq>t(sJq-S-0d63dc)QdF$KByBuVF4wIt8fP+t1-__jkKAWil
zr6HIqN+5op&wXVEkH<Wm)Pv;p+<6TBZm^MsIwKaak=+)nJ#xi<-AY9{H^awAzln-i
zcv(vCAMOoZ7jK1wn4cJTUIPhU;2&7%w53<&)UByJS7=3gQ0L&3n}ZbR+@MZvs#sN&
zu0sR+K7Uq9>@1mItJ0RdAohX&q_2-yMpRn-*;c-Ew```@T0Y&LToHsh9#oMVdQvX)
z3i9C6Z*$DaAd<_>+806y1`;0hNZDuY$vG=guszujXr__uqkkRr3J9dXWGQ%Mzf{J!
z=~VKH2Oo-?TqAvsPPbO&@P6mF5(qjK5*CC9yQa+yD4B&e)ejP5+gx!QVLl_S*kPl!
zgX$RFvB)|9ODTS%yqRBE8{u-lFBq-C4_AuAGZ_tRqIHb>H7IRWe5eO=Fr0}o8Fhuy
zUrg2LiLI?r7Bz_l8<}LlGjynw>b49&&((mVX}Y*oW%MK1CE|fzm}{R>8a0IQt8bEo
ztHv{dBeTw0JA{M;g>KfPH|__$Nef+*uywz+98hB~f)>Yedsw$QPDuy=>k(+96IGO{
z!F=llR5K)xcWxBBR3_=g!w{0Zdcml$PTbgUp9ji<uu|;d%~yA5Gx)XT5<*5>AJLAC
za9^&#Rezec9|;bq-bqF99)(1%u%T;oi3OT^r<)BlkM~N3f3C*Wo2Am}VRhN}%=*P-
z`(n-=8NVVP_<^f*5O5%_@)rBelQSf*X^P&KBYNrb@4y_B;Zu)%X#J;3vg8+*=8Idp
z4G&JRSf_Zid6+umc`4f;*~?MsB~Pz$D5r;agC{Ls37Xc|?lhJY*<%!zenL;t<XT{!
zRURra*Y!>F>eSpl_#<;G`NKyQ;nOeLjWBAIhUdYLB&D7WOj4_$K9u^nA==yPLbwmN
zrxsw!`pB}l1myO&ru=Zz$`D!`Y`el)2GA2OSlscJo&dbY3nP9_JEMXA@1It1qJG_)
z9V2p4Y!IA70yC<a>#Zu52&NBTh`8oz#eD-=L;mQvX_b{sR2%W1jBN`)2W=b>nGZ9y
zwmKNBd5!A-9ev5FKxDzMH@~RLsdaPxyg1C%Z_p*#@(b11;t;YZa0NPPMx7tE)`zJc
zK5})X8jCgecY*bnUknMU?YH%^Kl_W5mQ;kRlo?hm+gAnDj<*~$TG50jk*xX$*1bkv
z{LIlW?m<$Rdq0XK?y#BGOjhN}!8-x03M6LrflTp{kitd_PE43GtWNu<m=9>>?TU*y
z>`5;70gis_{bAmAN4<%4>{p3z){L{$bHOu5se~-=Omt_XU%Y<iWt?-%8z0UpK&uYP
zw0*DAo0BJO1$k>)ooEk%yw^~3{{nwB%xqTPr{D+AC87s3<}(Ja6<jy7+8ZS~(0v-;
zv;$mKSSnEZcwW*>Akl^df?Pc2{`d2drk$^%Wf8MMAjl^fSrO!J@DfDQxuKy+;H$fU
z>&?v);g0Pux-Z|?xIjD8Hg|GkCmNs^jLvTGqiz{>3!#(FpbF6Gu+z4n+u*I&X+t?8
z(ayoT)SwjE`IuitdsF+%+^mGg`I#dToqLpieJ=j;XDa;i=iCows{VTXoRkgqB)-va
zrtj?&oT;*!AEzcXMUw5c=&smP<ePJwhMGf98e9WgWPH{emVZ1{qz>=O@Ai`+G!QB+
zUE2cAiObx&wO0{u0ri?uTSj0B1l>-*@4N@2JtUT*riK6Fm&Dff8zsV$;6=H!O)({9
zW~Ro1@=BS9Jt-ke2dl%K-10iDZD%42J2vWDZroMa%i1I7?0!u~s^?7CoAaqJq|908
zOf5ylF6py)8PZK(CIp)vAZVxC$ZT;14dI;|$x_muE7>75ff!S7Z<*jw!i|~B{dh-M
z3&3IkSPQR-eOuN#BJGQya2~@Xm+mTL`{29DSPZ5pY>ric3dcb=7L5$Y7!l8d#335M
zaolz^<=GMbmHbav>zzY;`e20~as99_E}cM+Y%j-b0o`nUi?89Q>Bftji!uqbwjbPn
z8#rfNUg&ja)Vbxbdn)?|&Rbj|VNcG3IkEDRv}V>s(RwY~KjvXfix^5~%`tv|F0%S1
z)N06=%GItsLER^ak-AEfH~4p57QkMxIk&qVukUfVy;iv<s$Gb*z9~AsYxljJgF9P|
z5Rofqe=XMOzx-m2DAfWvmI=O&IdaVT?t$CncsNSdYW255SOqp}FL<{U{Jrk?;}UB4
zeuMnH%`S2BrcRSR%!L+vrbw?Tb<cUr_UD%U&n2Ab-gQGv@jgMRZSjYLqOnOHpJW9l
zb;Z_d;l|&#*$ryBKAFBCh^sxt!yH~TQrNwrqV_7l9R|0G`X_1GkRhNVH7Hj4&vv!r
z^Ye`Q#YkZnm^0`$%FPqfDMVV%p9`y5+Vx^{1crYpUuL?1u2M*muEFY99GOQo=XpO0
zYuA>yktvtBbF;AM;+gsPln?imQi-5S@Ax@$FXguZk0uS~O1w0G@4-Gxv>Glq<ifAW
z?u`MFoC<`@)tvVQMpwt^J{FUZZD=?_IU<~@s=V=+M)^uy%bZ~vxx`lv2h%a*-D#(I
zJ<!_ySiJlCR-SwBz>9P-U9h6HarJW-+~W9d&~35XVzN61!9LZq@BZYyT%VK*`WP1O
z^*d(96?VXy?LF?1P6N#5dCd<3y4ycLO8$LhnI*u4x&DfkUDk06Spa`JaJA=?;_D3O
zy^m5`W38;X;?j8)$KTNjIR(fSGr<HfiPJn5OT=FwzG|VrRE?5*vZAA=IyG?KvT2WF
zq!?T&S~>B_0h+}na;vDvc$vbx@ViQ$GVXFOlq3KpZVI~cf$d<I#lBho)BB2yl07^A
zz2qxHoyWEn4ie=2F}JG{J-Eh>vU-tu>UW+mxyAKDllvoLj(iTkH=ok0Q20g7lziAd
z77!AVvAjJfkqcy0lpBN?kbsg5Df~{bzFEJqQoju#o9sL2^U+c;Rs2O{acw3j1DYfo
z*R6h1@t*gsOx4vSVLPxe#CuLz3m`ymzRDFPZ8TJV=D{_rjz!*oRg=QkbcwhP|4#y^
z{IIP{6%G8x6d`@Xp8*+uFmsgEkId7&ll_U*oG%|=YYc68ZC85#QpYuj+5&ojUUs=D
z{^<>1s9JQehL7<|Lox5GtX^;so8%Q9dd~2H;uDLb{(on@NJuTVdMN`AR%RU$2x@NW
zvK?)T7>Hk$QAo_yE?SkG3@aL(0<@7)x4ZOcDjMH(zNQGi_@BJjey^QtcRf20*xI0u
zi46Az@Q#HV-CiR2i{`c7&pe$wyO)>p%$>CF@Ee+jj?=CD-QVs9U-PtZUg_8C);G<C
zRrv(2GwF64@~Kz0i{sC`?wH+%N*5e=+tCElFz8)Kk@KF_ee5ppv>%^7&3xXD!V)lO
zUCH<4O`us`4!9Y>i)=fwg?wlI@5uMtr$6ua&uv>;o%9&_hhYX&t>HECBH>zh^j$2v
z{Z5r;0#A1s+WCOn6PQc4;;>jsy07kW6H9<A&Lc{pbp~{qhvJNPZI=^o1N0+55eH%*
zC*I8Fw`0Gip~Ve5cgp+kNmbR6oJ{P&=d(9IGSBbI7AhoMzig~-ScA;E2-87_8b2PZ
zYSC-ndIkJ9lHnOj$n#3W+qrJ{Geo;UFjCWH@J>&$-R(?7nV#gGg3MR<Lf+_Q)30ht
zyS)kF?$_1QplCFM5J1rNmV!W`kiD>hF2#lHfr78R*H#Y5rS)5V#}Ym$iKISnxR85v
zs$n+3{jz5;O=Cjf*s;Hx$6IvYb3$a+g(U(!l0-TH!Kevr33pD~iro!mZQqgoLq`-^
zE40&2EIXv%Z0psD>JF*({zqz43i|<$VGM#j$?ST73UEzp<U!(yLqB+b+9R~g%x3rF
zB7bH;(|&&W@EJEr<&b?g$o-DhL9**7WKj&?z6I@Mk`w(U)qNh7-u(S$A1tH)#{!0;
ziF^N7*|oIEcf+9`(iWWBfZ}M;ojSVZW=*KFZh^g!SpT7o&b<e&$(f3IW!-{>q)YOe
z^4t}kG=G=Bg$66EyG>#ivV=SK{p(IF|Nq`enKjy>e8`hJ;$X>n)fJox9@|UeA`Ifz
zsS$1}S{5w1Vv<5lAk%>E_|Myj$Yd!v%ZiikC|1#}XaIqBBMI0HLxAFKJ}rB#o23K?
zXgg`>z!SQ$*|I*Ht)jc@GtWIw*9rE5U!m<hrYn>WNj&eVMw!j{RFjAKdOtr{1BSRh
zMO{w;J4{hrg4-Hk`)+Cdr=rc!k!w8mTiEiXJ{9p`@IF2S0B0A-`-`{=0Aqb+m+J~h
z`|cCcMS9f5OUJY1iV+Gmdal(f&T0OaQqzvnP11lXjO#r)mk{*34%H7^O?}AymL|G@
z?p1#{trW4@0!L7qz#U%7hpKzmmo!CA&0ail@9%A)N0~LO9qxz3qN`U1-oMS<W2|^Q
zF3>qNJ9A*5D}HtMyU^6><LPEMMV4ab4A=$(;rCx`;~%M?s37*OJ^*vKy|`*8BZM9k
z*ijVO4gJIR1k#UL?3fNf;`);@kBFJFw{j6vW~4L*_dR_*nvf*>%=Y(R@1)(EiPK#=
z`^U;;45We?QfOs!uO9{OKgJ{4LcACTnz@tR2tDp)ZF~Dp)@Ck1LWh1I0kj13OrbWJ
zz)xa37PNL848`E4Ki=AFUru}d?3_9T_Fa5CK05@Hj5fC#xzrDq>MFSV5gwCScMei!
z-h8wO+DfCcr-5jGShqyZ65*EB@0`Hg9F=Pp!l=Mq8eXE`TwzcQyApSsx$mu$%-BvR
zV!lS0+<($=o@n*9u1IxEo;F}hqkFqMuME_~XY!B6-$S`y_1LH8zXbK)sxmlluUnb<
zu|K%XVEVm1t4hEvkHVvT{{tJcKz^tHhg>hW6H7~HMNB?oW5u8I*2BaAA<6z1JWlF~
zpPj?^NWtGUe-Gx`lsaG3<!wxQ6=a(Anaa(-7rfxP-DdRiO+oow`I!qjbGd~|KQKT0
za?`Yq9#(twp7uub7DtZO@X`K~dsBQsVfI919BHI}!Xru3Xivfwv%riziI3SUr@olo
zzxHHhU?E=&9^BQ2iqqW}ys8R?G&%-%1$+P<RGYj}-XVVbLEP@gK8(X3W5Ue(>mO5P
zpsNdWN&l*h2E_z-JHy%$Dcp1HdyINb9JrMElOHIm*Eyq#C1m4$MmE+ORtqagdK?+N
zENs;$<e8VFEYOHLZ{Mu6IQ)T^irSP6I?LU8tN+XweIIYvwcgW($U5WRi(g>Z4)%+J
z|Eh?IQlR@dH^>#KM!AfNXH=fnKQsSmK_rr~VZ@TljqTk2UTeGwh%CF!g!6&$R`{Yy
zMNqo;!p61Yr*+jM6q<x5WZQ%=NR_P=x+}tF03HbnRm${j6qNPxU$@rMIJ}e9v4bCT
z+cWW?K`5T`Xp06cKV#haUktiRfJg^W$Jc>$X%h-=zHqfMG<vc{YA;R7>Sz~SQ@lzM
zGUJN$gJxF;B)J-#m-DwNvSqHMP`Qsauruuz?5Hvm*#jRt{|<SRcD&;!+~IJUX-hb=
zH$pGZiay_#^7A<OC?ke@z7Y94Tiwb<8kMnY7R#Hv9LboK3tT$_9t1dNiB1-Bfjh=8
zsOPCge~Vkn*tsY5Q{t64*~|P^QG94v%;s#pB)F-`#L5@Ja_U*!fGKN{{Ih-5JMxUw
z4L^`?=tik!8n}j<^#k{nF1DQgZ@KEA*f;Qf;5qKzQ3;|17RMI}Et`K^`eps)n)RoB
zd#~cYKX7|-NLMQ!n9|^~(yQ8cJLSUtgcRZ3jDGm(;YaDs4_NVF*lw_Y$Xtnn;3t(T
zXn#P0=I?=$+Q;v}Pk#$RD90$>w%ht6{Pzj%Ma4q2G@REOG%)4!uePJ?-)EY66)5=O
zdhE6D224GDPxgtHytTx#sIafTV}^&bv;JpV0@McpW9|=quDIxE&1suyBY?Pbaq#|o
z4+N4FFmv}h7v>;MHxIok6OmgpD=l(L|IAOPusBoiSXH`t6Kx-Fh1T@j6#O)Mm)^wR
z4W?G=ih7io!q1Grb*G9t@jA;ZLV>$0<3Rf$dyaWze9(jco)nmKI}^M;5&RN9aqwvt
zG{XCp*S$*E16q@zWr6v-v(<?AmnA$(Cx5>W#`z{i<d}Tm6Vo5Ye*D*E{*QS9e{Ntw
zY6qYWJA3z%>c-ch0+(y9->(LJvakHEHJ{d8=y&UxE*J>iY7b)`Hq@YWn&+f!*#++3
z)R8Lq<dR*F;19FKR^{k%@4M>U04B%@)h9lHPIHHvVc_C}S;?N1-K#6f#fGjviybZ7
z6_ga6?VM-*WsV>x>)>t$P~@Qsvx<{Dm|D2XwN~@x693g_Q$uc;dd2StcAgMi$NB&L
zhe8T4Wd6H%FGkA6FBldHZJEeF-<;trWX;Ukv4C@2lTTx+)|%#nEIr%<HRe-2pJT-a
zSk4&ZrWDf*@oN}}nv*KyZe7e5<b?6JTVGWmFGYW08Brtt&2&{Xwo`;XP65UTbYGRV
z)QOKjstmbU{LKs{YWuo61Qn-9hX+j9a6U)&CZJL%VT;;@23oUc&Z+0f#fU+kY?Kds
zGTW=E2pojKUfSg{sCLel@NjT5|LJpSkMCF6W%$0o4*Xw)>2k#q`v3`%Z@|+tRzl>>
zPQSCb%?__lph0~aYLm+g8#<wQ?bjz#%Ysnwt{2pU_hUq*-3t@+iazF;nRQ%)Ep;(9
zt^I@N3VSBZ6a*{dvvVcBssuhc0H5eGuJ*LCkj)b`q|EJ!5rA~a?R?p#yFL16bB2b2
z)`0Dg@Z9|vl(D<0g)ZEG@;y!{Y+&0(&k1Ri&cSeGP~)Lwa_NIapDp~SZ1{7sy}e0R
zl6=j@`b4p=S@C_@h;9}B%L^;FK`#nW1t{L0v?*&dMshk>7v_WTZ`1mz4{&{X@!Tyk
zb>tzxrWeQlwIP?nEMm{&U_P1cbZ)J!SM}4|-yd}EDwDMMDD3tv=c30OmO^y=kz)ox
z5~QC72L@Qlh2=&rmW1_QUq7Y@5z&2WxinXH9OvVf)7};Vqoi<F+PXiiX`gh8QP}?U
z@zJ<Bk0e=%sMHvf+a4hwlS>*Jj?-qpD<rG-sz%I~h5K2cz<RH1R#<9?J0X`gctK=t
zaWw+j;<Cl)F8oMOxwXFMUi|ol3H;QWfbYVpUQ5>hrbFKv9Ai}6IF`hnY<Uv-3!r7c
z%Xl`_k{f1K@C@I7|7!A%v%nA`tYl2Pk*Wb>z{dJ>?$vk`FEK0G9-A0>cX_T*c8k-w
zXBv;t62Y?Y{Jq!;`NJ=<`x|>R&z=902zMXzn1#qW)m(qsXbtw5lZQX5AGp|K+i;Ui
z5J0}N*_exN=Nv?`{hOn_uZ3Ll|8-hLf1#<cVkiW5foPY=++%H*bKFt}RETbyr1uEM
z9{s=QG|rsca=a&xL;O|<^F6gQy>l5FswVTO>|ORQDOV!DFF*7Od7Ji0({fS9x_pzS
zY2iFy7<2@ccDlS*cP`2bMUq_MN>=s~uOyYp)f>9}4ZXCpAr+){qPo#WY2n4A=xWuZ
zaUm;0Pu;9CiNOOjR2{W?Liv;dR*FX8cA_Oezxys?^Z0v@vZ?!R<>c`=eGfZw;xG5X
zQeBvl{iL$p&!l>h|LrOKiNoh)cT}nSvzIDV04Dz3N`TUUL`<i;X4-mK<uB2O`~v|k
z;I4a*VxS$igX4)+fcV+-i}if2a@i$k+CaCQ^MG;x`SFB=!*vm9O3;3TgnQ(~lDFal
znWVJ2E>P`>hwiA%4+o&LDLZ$P#l<zwUM%^hB--fU+*(%naoW`&&=&cj8U}3&#gk-K
zK(t*+4mYCf-j6&U{rrBp1WzJ*0eyK}&(hT<moV0&mm-Ry_s*i;5`PFsU)yJIgEqS_
zzVrXJrTn*8UEIHaAP*{chrHiTLdAY0b2qTPWSEEOZPYn%=dF|NAJ^`}eHG_i1kMME
z9m;vy*jlctY5FKm>#v3(o2ov-gooxst&Q`|g$YN*bPZmDoZPE>Stlz$kR)U;a7d!k
z3!gVqais!kDe$25t^m1gAJH4qfjbgooC+x^IxDp4p2N2OqHhFIh44*MgbZbJ&XGcE
zV#wAtKa7bA&*WK_$=(^}mJi+^j(s-b!gQ+`49snemhi&T6{S^3*wzKMuTp$rsuIFh
z#5<d%7;aiElR9~oJL^9Np_57FpXVm#yN79|Q)}d4?;xRbfx;tI;{G>#hZ(_C?IfAh
zRWo|_B((no8Th~p_~7=M7?gZ9*c1<WmmTaiyk0$e!^gQ6w(-r<l!%}G;b8t>pWa5^
zMiwM?(^d7BiNF8r3;Ka_a>4mYNK72NOrw=q4j~U;K5q7oo=nH<N!<l!Pa>3K*Qz}T
z%xBkI5?r`0+>-zAUrqjr<9Ys^%V~S`>n9d85n+C|(s_O8dIa0jqe^k2qU@^h=jFd`
z???wa(|V1Sch)Q93P}cV>GE;F02vv$YQ(GU^0^l&AF)v}GEE<~UdO0HG_774yn)7y
zCui3xRi;1CIVW#;@w~Aqs@<`*TZ+)qr4ZS5yWOO}t@{h{uq{ApKkgjg=*X4KhTAuM
zCgP|k_lYB!LyWwoqOzsi(v4$<ZtFHt<}x!As|w7G)5Em5Zo`f9L%$WWm9WAl0f#iJ
zD>qiUE+;$a2M(omdSNMIyxT}!{)pJXH@W_u4U!pb8Lkckw(i1j;U#jF*eJFk1O2o1
zRx3}xMxKbaL;CU)*q9NdXwjZZekT)EwhCz1-)L6zn)MU8WNL!-ji8}a@g>eskKA9y
z8t!xQ^Zpu5GSW}=*W|x-38PSuXWEyW;}^ovPhsxz?isje&EsE0KB^1CcY~d0zt2rt
z&^O_*V==i$1*8v3hswLwtsMJ2aOwP!atn!%=Y>(Sl$SxE4Al<&K+3?Ky{6P2Y(u!&
z{d*}JtXi*I(!NGHoxw2=L-wcIXt=lE9+dY&aGEi(kiaL7J5+IVabVkKI5<WS+jMWa
zq0Tf|SK`&K-LS9t<n#e`6{ym5!$A5PZ8lJMwO!0BIB+o$7kcI7hAVf9^L_+8AU$GT
z%6I0wC{tL83tr1GAAS;>(Bh`RjI&po^W|qy!JE9s+p0P$Yg~0Q?mAM^?r{GMD|$vB
z(3UUA<M+x(&iwjh0LS{m%?y)%4&-59-|-N%r45v1ax7nuMC?5ZGUzbE=*swl&DHy3
zlU(hqK}e@Waoe@^gQ}lIAyvBFhOK=Gk&-bj+58)LD-b7YkCcF|(-@|xG*$_!R$>A@
z_V)UIpCc{DJW_XV_h@AwjS@1xHd)gXXcXyyF*e--IkRWl6!rXfBi&Eb8A&`$$jUa1
z>j;Nch2N*`tB!@g#K)01Ngh>!l<8WD%2lZ_1qd+p?gEOOCnL+4XqJ>-SB+3A!nP9(
zHsmYla1LwQ`{wG(I*4u@+0J1pAy-`Qp5L;iQohCV@NyPy5UGSQvDaVp<)&6eJm#G*
zk|oBL+98FAQbfyTm?F^<=rr-BS??DxWa;V%3QvLQKr$<qsCqUu!*g3ZlEzk9*1-Gm
z9~L0EFG}1{nRKNu@I~zBIMTxVXAR+R^>ZXIxxdPsDAX;Pvz677RTD00%B>Mbi6Uw7
z&l*gu!rI|pGE2p(C`4vrOvmI%$Bd*jb)BZ9*h`dJRVXS1M+-nt?-T7wsQrF#$G+{U
z2NQEQS|u|W7JH3MOT_iHW!+a*@4G}+m9XkgAvE9<LYSqTB<lKvc~7PjMmHmDmm@HU
zg?#vJl60GYUqPd3=jvRT9e9#~M?o6w#!A9-4QX3gW4Nry(M-lb=;@O9tgyf!?_BL1
z-#Q5#cE32Je0pv&6?}J1h+lw9M-C!O`96?ldT!{IFF5;YmVN*_o{g$yHFJq$X?u=v
zt8<xeEBWnQKP-~MKFr?U>tMCc_4OgNGl8C~y)_njJtlpbNAOJ}vBYPpW`KikK{b-n
zaZ;K74Si;nh=DYsQg~2m$x3}3P?`$Dk35SzInO9>cnXpTHe1q_Sp4v1O<yd~JtNY4
zB`iJ6XMK$;o$A9hUm8`4H*QWaoIVnx$b0l7{ju|Nkr&@T=kAY>+RQrP>Z4fb{;f7n
zlF?jpF9r+|af-1F0*W_QR_;0X7l)9-2M<1qjfxR`Xl@Y9_8&S?pD7u`*40yl0RgY<
zDyi+2z*$=J!=^9p>y2RPzuC19Rt^KihGV>HWj#vg9)0JgawQld=J?YXvjCKdY{;6}
zxxKu^g?CRA>B;LVY=R@o5BCICM&P|)umY@!?+A+@k(NZQRr1s9PCLD06Go7wk<&bV
zCK=&%->aF43g!d9!kOH#_229xIR1_9cmu!vG=p*y9}pil!S`a~J{Izt-G^u<cPERH
zUA^*=W)Waco^rUo^A(4E5s@qPU}?DYVOd}20&Ho$!Aj?05OTL|l<uZ%ok7EeWfmSJ
zB_hpkwY)6Z{_^j=QU`(F%s#!{x@w9$rO12ciNjLTu-D(?pMlPWTQ5<TN|d01fx%Jg
zeUhn&f!c-ZgX7}3rurNdUS`!W2dp;n$QIE2-bM-Oxyw^nHPU9fS_dlSB%*)`RX=S`
z4L9p#!zuf8<>9J|g0TieH_P`=QoxS#_hUkl{oonXPF!u}xWhSbl+knwsFkN)Q(JwE
z?NtN=d~VCt{%K17XpJA{l4A)}hc>dhYAX{H%%8ApVPdxa7v~ilH)`F_V5-bCGQram
zz>g5sV2RB>8vSADqk<^>2%H$EM%xF`n`-chDMC&pmoNrYRXl)sT7geAJm?EEp)n=Z
zdK@|Y!8e05vEg<Z<lGElA7_vXd`~K)=`p4ur=rhwASg@fuN=qS(?TX*YGPfgC6pzR
zNN|I5G5q(mqNvHO-BMZ`(qbh4R$!vp2W#Ttz?PZxk~w^c=o5-rgh)xV3gHK{u>O8M
zhdb7#?;5ZezxhJ9DKZ67+*B(Dl7+l1Pzsj!xcjP^c3ersNDzhg@#nBPYXct^)_cd}
z19eLhkq7d}U;)d{ToKFEf4JfFze2obfO0d}bs5L)9B1zCzp&+bfTLL=a(6~&u5p8&
z3;y`w_39!PiFr>3W|mM~FLB!ly>yfaB}Bu=|F68EwM_-Q1jxwsdYsrZXk&C?DM>77
z@@9GCRNC=5vtT$}O!ZbohIayREN)2wJwUnOV@^Ftnnu&&BuNX~E=t;}0M3<dM(UaU
zLDbCLseau3a{G(h7nTzJ<EuqUQQ`t1sZSZ}v-pO2v0Gq!A;Y~6o6l9A&C;o8&Judo
zgb=*iNFWVx2Y!Hjy^ImQAMnq5NtMhHO=+j?DA79W7@24{FuCf?QPiQ-Ui@5uyQFdO
zvus}@PsDnvgTtivNDG+rji*Sk?F2XbzFg0rfkYO!Y$gL)0d-7ok&aqFN<_D;hgK^P
z9d0!`-hCd)e)!LQaRfQd^YyWEmv*Tz1Ku5wE^g*Bw~6%wOJzZFo#G`PQvIO$l;2S%
zJyMA)a}~_YCNYP;*;g{d#wz*QuNGV*_YRY=qS6V%4uLev^T?I3_*$lqORLnR7wL17
zQjyw{to6+vDc_$QQqM%>Wtgd{Z)TE*@6=Dc!L0m@APUBC>{%Z;7crK5Jj~MV${|6f
zKuv#CkNU$r^fm*bS7L!p8j8l<hm1)0MUQdFITcQG47`AZOK#~g2ae2I=`@Fw>=dmA
zUqM^j22Q(LsCEfK3@)_W6IRbL!sh4=z3;^CUNiMlheDfb@bCqP`=e}&Bywd6IA~qm
zN=+09Q&;x<Nvj0e*BIzUV4K_98NRjinK4bNQa*fD8!*YYyKQTm<7qL`Ve3jvvVhFS
zdn!0llENlB-u+`{0jLBjSa_Xn#^0ndk&822u2|3!wdMuBqsE4t3>B~-0`g4BIxpyk
zR|dg`@-mVVWsaEn&18L1f?h_qYLPfY+4#;$aBRy{QUCz5hF3D^W+7eh1wUoVN&^vO
zAL1fS#+#Mz7%x6m7jggG0R{ySI*B;Wo#gG1kpo6X)<<1SZ$#NUh>C(z4d4Oji9UPs
zqu;?X7dtPz2}n8vO7h4vmicCupui_9?Y6pA(3PezqF5?;uXpVZq`O?uQprt}r2{ZV
z*T>&!;<S_%M=CK9WV_;Oxlb*mL|X`m5k9~3^B1p(qDCZRO2XeDpR4=t<k$XeX0`pX
zG9Xwj9T+T1ve)<JW>n#ux%jcb)UD)mniur=EQO8lCG*#~r^&GD$g!fMWSkK5))&~B
zc9uYR_uMi+!ItVH8^pbizf+O3gTTYPicka2V;o!}8y($4(yYOOX_`l{Xrm@Lc7^hi
zXho`&#Ao{NgTo*1r9{RXw~Lb|6>)e=`^hn3svU(riJ6z*FAm;q>*RFWVNlT*6k{!?
zR2u4Z;kj%_OV<5G!vx8@u#-xW89vS{2Vak^W@$_K_)pLS@y*}0m7o$)r}b$|aCz4P
zF-*qu$e0ehv4<>%+L{qd7Z%b*$7fgLQKPfop}W+MfbGD)L?bsI83+3Z=HU;eu68{%
zqs|<o+7(B}Cz5rCCnG!GaT0&rvI#{tJ})zB`?FTA#jxHUc{a5nb4)W5Vgx0kw@Xy=
zd~)^zerL9ftD=4<aA(Fwwwy3B7#IriA|!D^Xyz|vCK*WLxy&(6Uas*nPKmLTS~;jd
zAx?8Eo}Qha;CcbPdL@P`hCdLvRNq7|bikN3ad%wU%QOyL8e{J`;}c>kT+#5Y*v(*Z
zeAUoPwX*bblO#kB7?3dWSf-g(nKEoMGyp#>U*8GR<;9Hh0ZD%mb*kIyqGZAAznd;t
zyyoVCg<kKKJ|dnS`4(Pp^yK%D)8vk%Tr;3e68#-$qAZ=*E8b=|D=CeZlo5vehXmQ%
z2If&)JbIE<FQAltR=+N;NTw$W@6i7;6Qz(z3o&TAp5WuYdKm5z8$~j?Z|UnOjPW1`
z8BEufD^2~0W<ER@zSN??a>DZGL8LFYh3@zG7KI0Y4&1&V^T&sTt&}0CaFHF%mrPec
z5RNR$BqEb$wxa&j)-PoW)j{Gan+@wfLxE0*Y-3{=q=K5NMGP)idjG)Raz%+aCmaSz
z*%+=3C}eBLF&CR34lqO@@ZGrXx?<H-2mU8-l}K$t-Qp$uby=k5?PVP^Ceq2MA=J!j
z@nMV8%y+??_pT@b18F6h7p@+1d=(|8wXa&}l}xps(%cJi0b9z-K7+ufm3_Pr8RzUx
zHe4O+ouNO;`>`SqV+_&Yl+Nvts#sOwEL3i1xXBrx6Mps}b-c-5%F4jFIow@_GGFpJ
zA-ORk-G84C{G4f=>?bs1AWK2$SyLntMM{~EP2|+V7F1@??2DtPB7$}W{Y8Q9pklK^
z{t?9}toLlx2+})ag?E6oAQ-X?6JpXPCZB5j!;buxan<M|+o{KxcCPjV3wyJ%QSC;+
zJ*Q{bLOS1g1;*YPq4B<u$l31o+x~oDfRR`rESKk-m}^F+A{(xIU5*`~n9WpQaIv+7
zJGw!gH@ecL)j0B#J%nkN`I(T_^^NfsmnxoQm%O$%yt$;zoYK4)B<+!K`J#pUP3H;3
z8`hZB0mVt@DSCaxefi#W79-r={d=xbL}{yNbVGA@{sI{|_0!Iy*snkZ(y*YQBj{c-
zM_-xFbDx|m`79*>ivx$w2sDZPepeE}aa`%PmRY?@o{?<Cp-kKlCmHzmM5M%x$68q|
z&LspG%x47M)O_D9Ia{LXN^px7p-7T8{vQi#;k9YX6TwAsi9|dQ_nB6Xbs*J1v4pMF
zqchVX)H^L)C0D}h8PU=a<jhuny5)z!`Vo7%+5r#ZiC{Nt`)_?gOHC5eRA$#?TM7t=
zjsHt5D=Y^8!z(0<xIxocTv1O}?d#6Yb_IpVOM#4pbWu=kY=iT16K$jY?oDGgl<&vL
z*}?j#<K*E3;s<O2y>=Yuc-Plg$1HotHcn{oSMztDojN@X)aZ(zicoEKF%J_C>boR)
zAZQzO@8TCR<|?Qvq3s~#d$>wW^Ar%kG=(6SyE25;{Db^oZ6L;G?QCXa1PH-qup9Ic
zF{_11N!;uAaiF?R&RR8CEm(f7UST1C-tc0!WNz{p|MkMof=l(ptZm!0o^8znXt1-Z
zEy61U^>qM(K4VA7Cv4)Sl7QUePl|dLDcb==E*QY7^!&S$f21IK1Zhc%p5YCDgFlaA
zCUYUKgnTBab?a|@07L?X0N)+t9@cXo)P7J6hBFT{WS$f#Gr@Fw{8DVaWZEg1-V&R0
z(5<g~(%h=Lh@gTYWsXc^+_RxLwZQdRH!LZ_CLX^Rc9+|oc2sLawTWP`()`v9g)se8
z-x^aUpJz~QAk?<~yv3`iz{duK!o>&u<(~|EHM5j)QV5e&ux^r+g)c?jv!qbEF{PIy
z({qujU=~!+JH=c@DYKHr*^rM6lwKDX3Tl?2O&<a~HRn^|DPcOzB_=s`cKHuZ%t*%W
zv9eoiZ>*{z8w@xZFHEua3CypH9ZN)?hR-Bzd8OB5EQQksfHK-dFy`}ObS3XB68*=b
zrg-X1K%-H@!Om(bka2=!Eub)5WAnEq1oNk5?vbBgLrOXppY3<pSTtoKmxU9IWyEJ-
z^pnoZQ6zmmQ+!%++!W}w?1k}U9U7&lyj1xtCV6(Mp|MFvA}%RGsIJrW>|#oEK$$uw
zFql%J4f6?UX|xG8Ksa~im&O_(f^{uvAThz1QL_Z&=3AF`-aVAs9(ClPgLL9V8%iiA
zePClDS|$^uriC4n1DY+@i0iWnZjqQq2T_ni;E`wXYQgc+0uF!G?^B}>)a#>KwLn3C
zLrQ91O3DCy@VhU}B5@FGOw{qB`93KyFo#*%%IeIjpX$-XnCuvxD_}1TSRl83aJUVg
z{AZPl2^0?8OmcCLfTs_*g{OZ07@K-b)ZW&Idz;4+Gum1;)C5F`d2wy*?Up-k;SS(n
zLL2w6z7w!h5_bw?vRi%lyG|t%uN380@>{vq4oIgEf093H8A5bl#?i9S^BiNXpS<+Q
zfVoPnG|+L`y!p)LV9pq@gk-i{4-q6q-0ReRIybUeI4jH*yO!j^pqvvlu@8w2M|l_1
zZMyQm`E_!uAc)1OKI`tsmR!16<uOaj^K`PK##(Z$<4tED_wl8R7Y;aU;AvO9azz;2
zhT=n#@G-X$d#@_2_B(7$xABma`S~EQKkPx^OdL$LPyN|h8cR;e6S;RIMOgn;Nfq2V
zK03uD9Aop)icHug4OEb`WtxiBzQi2n+)U35#?zySb*@QeQ)zWCkg9Sk-vaft6~m$E
zV3=EEND(Y-z0U0+&XvN_uXF|W$H&MimZQgy`#Q;gaIdYPHN5a}s~(CZ{)G{*<WnxC
zvaOb7<pP<)#J_R(`zc(dbt!J#$c(Ff40}`66;A>O8r;+@@C$HPzsn!!VFfo(X9T=P
zT1BZi)=#vrF_}GqH(1I@#$!5l&uIaZ`Cf?5!yR+u?1!NspJsrn^w3~ZtiX(S;PK6u
z9S@uocj{hz<Lfw}yZ^~HLyT;qA=SoqrZ!~&+BZCG?XB>1+Nimwazj4M+V#xDrH!6f
zqj)FFPP58QIx#X+X5;*TZ^5*QpcNu`T)t^KA=erer_*3uBogSOrnp5EP8Aj=ZARgq
zH7TH~O1|cGh=6?`^sw{m?E|*J8d&G67RXCqg&DG=l{fk^YzrwRmc=hv4Qma7F?@S?
zV;&6IJO06dNCxmyu57wlx^N|5c2T5~-^>*v9>j>-TWu|)3egD2I*1}bLGHGa(HCR^
ztQ;~=KxN9en%{tPK*q3H*OA=1&P}=GAN}i<w{@O*8GBtm0CK=n5^^ibBhqy`1!O<j
zgV)5xDt&2lj>IcBMc{KN<q|fhxy!gU)=<<rzOn(Wsu#GJkstVk<>s3CH7(6TtL&Ma
z=JwjLUFX4xbl~I#<+p10j=Y3<$3(Wv44vp92$Zat+pT5gQa9~$Agd2M_k+~pcG*k~
z)QU%Ea=t?|1Lox2ORkE-0y)ha@!vm3&Nd#BKB5L6H&(zsOOidn82D|z(k>hHWV)9e
zaHH=WPBo{E3>HINTN6SOEpdvaysaFp<zJAE<Oq6-=LV$nJm2R6Omh-HNGyp>-L5!h
zxX!lPGB7k-X(sk96}`!uBMoArg86omWZ0&~t!I3^>kRWkrwhTA63<5R1CA2kf$A(%
znTI7VRmahGIRw)hMM1FXqw>ZxSh#^NoiQLOpsQPkagXlsr}+ozbAd^y2fSz--EgaV
zOKfQ@b*T}p)AQzHu4dj}9<v#56PpN8UB0!`&o6eSD8>(|UVPe6FX6M+a3vyBl>v%}
zPj4F+>Rt!kTay+5&%}VhufI0H3yMlRB2`&8r|>}abwJz!<)EvYf!mbqX#hwe>i6we
zntQFw2NzJHnVC8a8Es(@lCn>=Ju+im4aegn^_k^&D+?7KZG0v31N@jB{o1MI(6aj(
zZ*E*`+0higXX0<8W4l{HnY`>mK4Eoe15K}7@M4mu(fU+R9>ldh6Bfkt<d)Eh{b*a{
zFXQLc$VDz7f3~b-5{TvgjoH=R)pleq&Sr@lL?!#;IKx;N&HG6a|B=vl?B@(w-{p}F
ze@2AFt7r(Ex?z4-r@3iv)b(oMV*OlLlYpxOIKD-K?+-c5QkCHG$#e>O)ZK2@yr{Ym
zjPiKGB{6A-(N@p_`iHQMQQSZpTuz-kkK5IR6OvposS*A^?S1)M6IUNEh=`U7^`#mW
zB~~k`Rg8*&tN|&dtwLJ$bzzGY6p$du4halM6%_$Bt*AhPqNWxB*+mEe*+mG51QM2r
zEFmTkvOw0ExfAVO{)PM8%MbGa4^P55Ip_P?zH{a@I)HPPw}mokQ0CIGYGQlYS=OVj
zRHcfZyLnEVkOw3Y1(h}(KLKi%X`)kwZ2NZ7EkX*%pldyE6JB<P<!*x8Ku+ytKeDq$
zeg9JR_G7yCe8192BEx}q4RH9pEUV4r3avp*k`T@oxAR^f5JnF1=9xXXU>p&0zBs#!
zBjdNWB$o5VY_u;B4%RIy_>Mi}I2Rtg1XU|o3_z^N07ew3YST!}T^{}%q{w<I_Ub{G
zi1A~X524+;DD~Sx%uo^jf;!kNWbzgZ9t8$)zIv-Kh<td))e^cmQ+qpa5!Wc0GQ%eC
zR|vEpC+U=cz5UWM!+|>~(pihX19)){>jvX@(CFH(^cCSZPdf}o9Epw;OrV<N!<W+e
zg%af<OrFa!gCs#nr91V)p0f+CHFCk(o#sJ}GrSjX1#JQpO;l<9O<oWq0hCu24p;o<
zRIT(0^tR-_E3nNndiSCK?8rm5QIAn}856?qx_+vBTq#zMfS9AB_MtM?wT#$umBMAf
zA^v>#V-h4%)h~9i3BCX|I#4K%K6kZ!9QS`r2COg=uYV&e%PD2RKJka0c!Vmq_=~pc
zCs#7YPaWw#{_-P>80?-&KvQ|5V0Rq1mG6JoWqe3WCtXXf=rCbu2gN2H7B}y?bO~{D
z0gocwuQXaE9_o|qA6^kuxZ<}aq4}1iq=gm94`@vt<DxT%?GI25Z}pHvoVO6v<lBae
zMP4IWRxsxmOBdvxePGgq?~8tiKW;puouC%BQB9bsU-}U_m-#1(Y2K2uoLuN~%KLs<
z8E65EO5rTHlv&A-gTo<?ww{mY&rzBG+#oq03l4Fs{z+bfn}0zBW6zH+y^Zb}_VooW
zfZ_f`WKGcho-ZocJgHl7JDYG~&yP<3R8oUO<urd_!yy}9D-D{P3<ljT_WvlpL#6wi
zemmU9qPcwM8B*jigu%0FZP3@<q69aa!$wtJje7-nc!B7p-O8Mjmf669^e>yb8*Rxm
zxT;WQ%3K>{`xUh2@AY}v0=wrfmmZdfZw-+MoX;*?5}`KPF1K)Y?4tbalDF)O*$GL;
zIs%iqr?JnpKJsP`9f&clx3~!$pf=iWv72k+YbT=f)zKF?6|Q}g{ojmSYUo3i8D^pO
zKWRTgI~>*aGY-u;6AVUZ<H0dfAW|&Qbx|^L^19ci1se)>_Gb6yIRoCiu4k-YOLqqF
zyIKQ<ru8%9hZahhH4s-V>|L$fEz{42)nP(xogNWP9QtzbuMbBUs$w>8kj#yoJT7}9
zCbSd6uj20<4%QEdJyKIO_VaG}Wg%rP%5=l8NJ%PKZm)$f7xy;&giYL+`elFvrw52r
zwv*H>jK!w?xsh_ww>)jvdz;#sKTKFO$nHTQaCE^=-^6Kkeq%?FYkKw*-tvVBf%o{k
zZWsGFx@m)DHaz9!Xn4ReSD68m3vU(K`Nr%?UOY&{UIG(hq?s#}2M3Z;UHUM&S==Ds
z^|O&lpxA8RtRN_wTR)5(>|Nru4tO1GT(BuX9QtWy=AaR6bkzI|&ly<Kj;V|8KfQmR
zeY7&0t3I^f+yB%vd2qw^vr)Qr!cgQ;0u@NbC}RL~ppcdVS6pGnLEX`XV*KFn?8h{0
z58Ct?{w6(dv&#fk+fh8<m(qh{XbH2zk-M^MCKkz7K9eu{Oo7NIEN2HTAg<FR(A1^l
zkU|BTWgX@bWNAzOt`nY3O-(U+5s{GwMqRHA>C89VC-;Wv;p0ApSS)G(ilBtOS*-L}
zLCq3T+*@cVas#=@(j9$4goj1bJZ0x?!Q;02pRika317W+Q!JQ`CzzYTN9`bw6n)>I
zt|sR~mj?SLRic_@8KBJ72D=-x;dWq%$Kb`m1r5(t{NA=afTapKD^gYJ$|b)cfldCm
zW+r3)lgS6^);}08LFI}Z9l#W6+Q*sR0lO@c06ysMC1XI0dcKMuSX`%9<0@X?TLX&I
zCVL#dhm{K)OkPP0_HE|5O{Y^%dgIVONkOtQyopuaOe)n|?1|%Ct27$kcF1lE>XG%_
zgbhLYZV=wOUx59BoaV+FXsxE&M;Z*8ZalUhv>bcSX+`~k!EOj=T~6sNAMzY;Z(rx+
zi&B4M;7QYJ%}EZ#{p?wR|Fhgpjr6()ER`K~hk>V&q?%aU**RNz`GhgeVM=Obr0#J;
zj}4ID6H|%JL!YMs69<na2FqBdP<enD?B|s8S;;jHo(g1P1PZZ^6HPjF6@!y5+m@i%
z^D8+IHZE(_0mwWk8#jYjEAW~Cm*vs$3HNw0(f?+iefn-{gm2K|Kv!uaJ>gaJR10TO
z9~G1y{uL-UL3?K(uHl3}i!|MU4}4>5@l$q|%Rx$FdyCRlHgvlPAICjp%WZ=k-k9Dc
z<U0A890)(M`eE8onHSa8IT=q*(ogAY?Ytxk#=^4;>kR4#Qlu!=G{N|Gk*SgDI;!9X
z#^uzcd)S(UwEo@lz`ae)RjXLGp#6#p^_HZR`zVY2QX{Ar_JC69Fxd&DWY$6~5?9F+
zK8vmYOe{zQA_THz;>m@&o6bP5y_JdV#+Xb|8vQJHLmpB_6OQq(nGVb1S;)>&XsxhB
zgne|#G%fZ!dhz@#*6xn1;SyX8^mlK?ks0n)=mZ&lZ$K^s!u)&lR4g?$u<<39)W0Y@
zs<{9brG@Uq&59&BGoibp;r{JLRWtuZd*Koj_MD}gkftQgGEHz?mEhg&tds}56<;uo
zW-oG2N9}T5k%`*>VukIZ)_j!%RB^(1Hog5vRuOiOg;XSu*f^UY1s<TAjaj>$U)+I3
zq52jCJe&~I`Iz@&G1EhKm}cUXq*jH$;kL&;K=0`|h*61VE9X`PV^-3j34%1o?st$E
z_WLALHyvF-9^k#{bzL4Z)KIIK83)f6g_a?t>qf{`%Ni9gaGjf@+St4kU#$><fnqdU
zZ&))l&Rl{P#V-NXbIoHJEAfDg8PC(utTymxv~4G2YxDc-e4s6PDGom5nofn^tg&41
zttrh#FcB*I*~sJ}oxTW0a<_F`GFHXt7X($ct!COgFVbpu_ha3&8+S>lEjtn%iX#da
zR+vUCTx!DJ59a<N-pUNBQhGJIfb9^GlMk02$V+x&ud8Zr+r7m+NO1_F3|Jc59fvp<
zMysusNtM)VcI=-!=)Akt`gN<+K|OoP*)+iA3F{g^5ajLUeqs={D*EUPmBPU_CEXdg
z-Wuu{t=kVp)z24){EZ@XbZQ(oU*Fac++4iZGFgl!!NZykhFuNR80MXL<`RUHXma)f
zJK%dfKUn&Es>${AM!GoU<7(kFC*V=8Ns{WXamReopW9jp<tAm@yKy8ua}mqVfIqsc
zITv<?xZ>*SpnlA^_$QLXkljTCCFAA=1Dn)<<#~$}UVD-#=O3!YA=atd?fl}T%O1`A
zGSg<1dKt<()f33xU{SETrhn${#`u>$Q7UF%PA-crx6_DH1xIn39^(>w%H=SF7j)kD
zg#%|h20Z?Z$Vp7ow)9upgPy*y!e>~?3v1(Y7Hc&TGL{Y@dN+K7ng5^E=@TL_fCA0*
zI8FgEc<3cfcMcgiawt8XM|-xtPmuxFN5<N@MlZdk025Qy+Ke#LZh5*%u)%v)gv-4B
z>5sRj37MsjtwEVHIC;x(R`AL#IxW6-tHIDEvIjk#4H}G-C#dKv0mC`p+olN;Od6VP
zCRPj?Pv&Gj-4^0yf_`t;PF$-b3)A^`XWO^sm4v9+6<HSJ3D~#Yr71~1jeWDHHktKF
z`IkSE^qke4vbG4xM6dz#?jz4q6mIcGfzy3Y+~(w)@IXEAfnq3VlF|IF;Akj|gdn3Y
zrXJFfsJdvu41wOI(--5h?Wfl8`D}E&Uk#-8L$iFMg{%^$0)d0FduB^eVs9V9r9sV!
zdSE2)ykk!Jf8keY?4lWg=BR^&D;)HghD9GK)lgArJ@Bd$lmq21+DhwKDUMnFU>e<9
z<5Fn6u|+<Z(D!~zVz|SsWMT`f)sMbcHOm=Ld|hh{rkqwP^!WL2Ber<maE>vE__gcn
z^)Ew|TqQ~^IZ+y9yk)c_2oyb(q^}rm%B1==R)tKx-@>D`pQ|8}COF>?T{>NifYa-x
z2L}k;b@=^DsV->l%;-tMl<*+IcJ_gdLgdBKRvLFs;kcO+bFqL%lod2S#B<fSTcgNI
zh#lgcGMlR&LrQ@yoHA}kS3p`}{tkK^+k+<yX2I-MoxZs0T6fUDak1l+nJ<ukfCyGE
z=4$o0X7t*{3`V&EX7LFBSUVp5$L3)KsG3s`D2kTu+gP3}td2{9>)<CuN&FK7eo`C>
zGv(a%u%%fJKPoqPJM{K(;4_)#1jKRepz+|+`OJ0B_O@MN{F9~g9g6z)G-QbFuPmH-
zxUS~PTsTwSoL<B~1lRv=GFAUq<Cftq_m_`EhBx=nR*_sOufqN#ut{u)=`vDwJ*<2>
zZR#8lrB*TeP&Yk|5>y8@_kjuyqb~>bGZyCDPfn8EgE$69%M!x`HY{z2XM~gWxUv$L
z9E>#=!e6irKkS`cSCX*SUGjaLIqVPA!`{0KROjZmC6MUs#!%C6=vJsLe9|;}>}yI7
zlLSS8(fmFHJSqc)WuIwgu_oT8_1U)fg9X*Tz_@*kFygNnHgB$A{$kry@DNWs9X3D0
z>!dXTr-}!0S;bKFXmbA94B|_*cDa0^=yAr1+5ZL~HdnDCWQ8rq<K!}eFZ2|@Vn00K
z2x=ErE0$*!Yf)f^&yUc`H(l%f(%!LAo6?sX9-|$W&Q2tFeND|VPVT1+E)C|BW1@(H
z0mZ(mrjx_P`0NXThxuC>v#Q>J3MJ>#fGo9reCyvH5xaW+a&oTGb0SQ%Z$wTd<w<i8
zRp{A0ez|cAtm>0arYUav!kGCp6%rgt@I~9mq7FW2$rUR8v-Bwb4A0Co(Lkh%rtK(D
z{VUl0Ne-Sh(5SlJIz}kgv8pgJp^>E*oNm;)=Cqi`oB@x{Q{OWZPv~V6z|1>N0V*`;
zt6`Gp>-sL^m|(e3KS<e)YQXpie-Uc7B?KGL%E%R7CUf>zf@Hw8hE(yCM9+LyolN@!
zKNf_Q=IFNo%QrrETZRy+!o%MsS#f3~<q6`29cF~DG%p;JC4`5CCtUe2I#F*#p|rT!
z6-Q01NI`G6QQ(jsGiR58$(Mbo)`7$iQ~j>tnO8U0=m%Wv!rkW=z(jwM>AiTRnmHNp
z#uid+9A69`5<!)Aws3ysS(!NOP($xupE>qqY5CNZkFP2ZU7)6Dwv&ZrW|R*P#t@ZJ
zHvg+Hz+DrZ^J&{enEL{aHLYwKbNVuH1f1^a$#)UbWXHuafc;CtH1jEvPYW-`E$7f3
zCCVvPDE@)s0jeNCFF21_voNlr+0r*3P|3qMt2UYuINsQM=nET^8}`iIe`D<?;e6Zm
z%Ih^sVVU#*-PbV^VEZF>ze->hu_Vi3yXWKwt25H+E<O$m#2K_z2vIHCUQ8R4f6Vih
zVNj3CcxTdC7llSsG>EdD!W7VY)jR|!>nX*IWeAPdZeN!N%#Zqb|K*7xLX5y~celA4
zFKO*B4$BnJ428|yVT4QO=!io?JoP0mO}86jg*nj|8ho)N*jdwtl+<1-M=g7HjZg>O
z;q&JBQULvX&m%4W@XCfse$r4``(f`xWhZa`?hB@snpRPztM0{A+=GLvyZmN5>{|E@
zAA>P)KS!TCgX<X8Qh-%(KiXcsE$+UPui<VV${BRe`>s%mO;`H^t3pnZr)|N8t09I~
z%<9?bFS~{UL_-HVBT}SK3u-!rl>)<ap0o=UDD~}Th2FlIUrJHtR(UGs4^RstUtY;@
zu`Pm1&>7-P<dSQ!F(ACov|P^|Hp^glA|l+98$AbTR*DdXRjE?+<}J0<%OY4bXP_3+
zX-Z_A#a4s(!K0Cg^1kN2m#ZcTBS>e&XufC{K?Dk?t^sesN*lim*6HK?dp)@_Tw|Rj
zT%urkD!$TqT6h?UwH?B|0vEJcTDJH7c7q5flv*nE4b<3fbiV0APJxMj+@Rskp+9L*
zAF%R((t3;I>d`_>fL>qHh85KOy*K-5H&<I(+-v-RdQKeJmOC~@(&tc9`esw*-eT<=
zASwptC+%7hCyRf8{TnwuLFDu8;UeTL#)O`-^1HA+2mP%~PFo$tlSVu<d)u@0c@-$&
zd8VW9pWBdSPmTz`>S2HEku6NU>%<y4Q_au$Z<Ko&ol(sfQ;}jguNnc}Q&zrSqx;rz
z=wR^G*b2mzK}%cMgy7A8I@UrB3Xi@0cN|}1fH?3J19q0=)>EPWWr4exHsc)W<s7z}
z1thiWTNXGqMbH1kbO@xwnc5uz_&g;+%G1j5>)u7Y(FWJnF_xF1v+5wz+8gkxzSQc~
z`!}Nd8-6{#K;gA*Fb#PBJ-IV!S=#G!RU7_>HCcq4ogbJo-pO+dj2MUZWzqtM0Ou2E
zi32;zZVs_>kHhx4TK<VcyM4)N@(F}Az*CugL`zaqYS_$>d_|>%hY%*QC?l%Pn)xTz
z79O={*vLw>gu@;QGVwKnFqFk~h7k%WtM&6K9hLC|%nCO2=IBI3>^T=j$2i=ZvIg}l
zx%Hp?OXC4twfp`hsD6>pdWtLHFTGcYaKeQ#6)&JBSQDUNGC5@Sjbz!IUO8=Z;5`k2
zXYlq=9G8VV#V;#w^`sESRZIjs5^q~sM&e~i<$9huo?x<Q3K1iLzBd^!-AG^D$tm-?
z@vHu&yq_wf-wM=+Mlbywu*djPO7rP$qvZEN)u64uiIg_B!<+_?p_Z;hPW0{*ia;l2
zLKbp|zf)x2aOJ%cpM6;w#PalXWS(p#G>D_NfMs9#!3u{FL{Rb6+{Jh?JO&(ZEf{#8
z2e|NI9TJLEnmKi_(3B%<()n<)ERH%_h`0G~HG+P=fTE<(24M@bo>oDfA_viz?qddI
zoW_}t2IIvv=R`9m<B0b(JqckhH#Zl=^Red1?)kO@2msKg{(&i8iZjVKYMryLl$k2|
z5!vPiR=+xiTlAupp-q70dZ#_ZmP4uiPK*PM#(UHa>mMDB+`ZHtVEZ-`Z}ASlo8Ytm
zt1LLu341Xc%`)h#JVh|ajr4rOiO<|kYs2_6e|wK1OwHoCgUR|E??N9t0u=>th!AdI
zW-<SYPARe(;+8T$lce7K$bD_sR*_jWvs=A4myADBnZCfWuxk9X%n+Tc@VNc^cp?a^
zo{b@6XZ0Sn`APGG$y~N?Ko;^uL1#c*`Q*SgV?W}O7IAP-I04Uo6AoBJ;Fu%uoVd%H
z7G==b7&|`_u<&>hp4Si{L50~ACAsOu<ULT!uiP8TSKuA+1ac4>2gjt<)HSXI+H-K4
z^yhmQAH-&tb%l7H@m_u*3V)B^O4I+z)c?I)RZ4S7N}23&ZRwYp(#;An)`AJHmhu=!
z*bT{Za>*}Ig2!~;`s&k566Y<a5|*T8=$m<v#1h?Wv_X&M2?q5|hMI3{gw#yl(AsR&
z*SR0IAEy=$U(n)zh(jE>!#}hZ*_>IO=qg-=c(fXEcJ7PR4@VkWUz>eBG6rC_*2DA8
zmdMo>{u6nAhv|2;Cdr~5Jg)KZbG^7D;LP-@>vITyxYff{Sm>^KK=+!ct44p~-z(KR
zw_@w=!WUm-%caZP;*f3DIm096T<c`LX0nUu)h9<~9d>`Can9jQS6uE*VOZR3p2Ch?
zRR>Y}S8$Lq+`g<}h{IGFel<@(0qt<$<#crnt?w>X&KrX_p#R8wc5QioRdQ9<kEI@I
zCnC+wseBb?RKk(GXTc-CJ+C5O5-_1$tsS)PE1<o3MV>@f#-m-QbmLN@&s$Iwy*PV$
zj6fL7KZxUCGI(0%4A5>>C#v|}L<oG=*E2Lqv>iPE*>xKH`NXxV#i6wZe0SErhD$zW
zte9&)y;{xy{M}x-60aYXa5VgJrb5#KuoNi!CTgxx>gac<*&>7FoRq{52XV^jHCn!k
z;-BQ&?aAXwDSj>w2h!+9eAAnkSuU`sXnGPM{kInj{$o1jX?!1dYRSzBj8s?R=kfXm
z%6q?_K3s@uMmvOj;D%VA^ctNa?U1`Rr=fn5QoC9_!%7EG_D=f~0ueXQT&WtmG}R)b
zr9i^qZ7T9K!8~hMpON4`0QFDGZUHe;3d+h~nw7aJF*!kQ3_dT1U>V3#UgfmIBK$=T
zQX2}Ej*@;N_dOJU0?K$6T6LPmbHu);e9(Vg;0qJM6RX4gt6W3{I>vk(jhIk0#gBVK
z#fT$Iv-SldK*pj1sTtk)r3ZA9<XHyuIJ{jkucamKHYa<j#bdClhdRntrQ6O)SKrvX
z3H{tXK6};XLVa>l%<Bo1`ePV;Y)>a`l~-Yx#L%vJ!=?m4-$|0G{e~70uD_KA5~YsG
z9Yb;DKh@-7)-nEWkGka&qUvE+xno^6*Ho6##<Y0I5spry`*ybvn2hIYF^-Ejc662|
zRR28$Z_fO1)Nyi{H2TR(i03yfUEWlw;!oYaXZM=HmA;<gIr8UK(H##Le{&rAO+(bt
z1Koc2bkUnORO(Rj<xo#_%gdDxCu*P<tWkt5ovd;>&v*Eq^~rETKgB)UMk=+jy|`a1
zs%1}AVM~~qixMy^z+vI3=Wb0j3+Tcn+PWrXtuB#tKDI!_u119Ow^9+8z>88&zfsnN
z9BQRmLe>v{KF^;T@8^F@Cr;++H`~RPpx#)xcK2!(t9vNB^2yrvgINDKM*gZw8Xz42
zYG%(e<FaGbtP@am|FC|DSUZ{A4MbBbgm4P3Eol;9b97~JZk4?O@lz7P;uxoJ(Ungk
zsh8sUFqH{!DAtj{yRqe?6^lcg5pM-YtMvuQ*&S3IocQG5geIOkO9pG-(Pq|=t&mSO
zAGg^lEQn1b9tWEE3R8zdnI{f<22%o2=mq=}B@VP(Cr_+>`I6T7*Ew^L?oLsk%3e<2
za_=N%XNY0TfrlFoB`wGi3e?q8NLt1D-O<qpByKNa9ft<o4%IAeWf0$c!Agc)8w_xN
zCYZxxTFH}f+8hmB6kCmoD-}64pTV6!&FsPHys(RJ5vO>O#a9p9|6jCrcKn1R%UEd8
zxfYiMkLqZB2{T}XKS}BxhsDm4;z9J_)$x<cAt~}ST@tlO!0ZOBJ8tJCNoFMkawl?5
zWNrEOuyBuU#<TkSk{#c;B*jgrfDdZGVZDfT#gg}j;WyufsI6D_8@lgVG$!i5we+m5
zD@>1}uzDvf06F8UJ)jVSBUqBT1rVK}?z;6Lml5-kj~j_;rqCFi+t%~;OZM5skd}d`
zOvq!Zl|DR369%^Xi*Ap7UZdiSB@fN?Jy>KV;cBB%%g^kK{srv8DO96L_e&0hLu1-{
zRlH2>6hC!Y+DgUoiGl{JU^Y)p_(2ySO!ht~$<S@o?{RU|H*5!l$PX3cij5p6tE`z5
z9kP@W{@_>YpofIn4s=$pg63B-Rnf0_9V9I?ecQh*{H0*(5RMcCY?QBAq}#8*lK1Tq
zvoenste%hleYa=0Ilrw~dpNp?+1qA1Yp@@mxrNzJ+b5ymYg4edEc`anVdVghqvizL
zh3pEt4`ePDz+~-J_}-|}ANGJ{8#zi^EJG-ky}YXd6g-Y&9?*z`BOvFnb1bG=#wR0p
znJ+wMqt<bfr#p4JG<v43gvm;JZnp$o^zLN<+Ilg1Y^?}H>dNsev2GT}g5#;j2tVLg
z6dWe2Bclf3!DLPZx>pQLxj_PNbG6Fr4mnCI_rH@hm1oSMt+0neO)Rb$Hht@6wJF*A
zg=--_orm-NG0$x~F7$-rEH)8TT3r{I;+cD!Np3#L_@#>2TLDoCA*Z=t@#t2Ne$pOr
zAmWDV8{q`ga71g)8`2Wa(`Jy+(_^Bk9e!pM7V$a#CG^4wELQ%ogiy?>UT1)HN?i&y
zKfO~9G_lbblN4QAo&h2zrVe60)lfF?<Hz%s!N{r1i<+GL5U7!!ECw^ZB`^DOPPz#3
zQI*iv?p&qfjS`m_RIw)IRzOuF>LV+D1Ho7dBzfjq$uZb_w71Y8`VT{sH`ngJ*iy9i
z<N;SaJ*POUF82>pBdgR)_KC`=x3sigY)arZ-iNLLHD}OtsA3L#nZA0T9*q$X$wtmZ
zKq`99ofH@56feQK%YRnQM4oNc>h46cGlxmZJ=OI>)-U$YHR5sH^j|%=`0TY5Df~IU
zVkoYBc^=SJ4j!8s*YX)V1H}XkN(4rWX=7Lgl+3<VAkjjnX~%F)lKRXPAryP9u>?0L
z;8nt%J?g)*jTQ=keL)P*J!hq61V9}e*a(oTm|uP|PncP-^E7;3_zkM>(y_>@OUK_=
z8G=Ac5uqoOHl}7YX%CMq%+RPQ=omU2iiJa5T!VcN8HG>+t?y~WvaAZ|z)KazxZ*@+
zJJaPSjBi)T=cLvXk<3ozs$iK|XE9y?FMfP>{>ew?`5h9DT9{ujNU8q&Q%LKax^$TI
zG`8Y%@-!*BrL#)h14cDNv}pJ~52jX&>Se(xM`b2d2bt+FT}!2+@$=21^T;E%ttz(I
z$C%!=HSeC-M6HaPxtai+3ey8HEAJb<DO~&F(v#K5S(kbrT6Vfttnud=-=GG>RpdD(
z<({j^dT{r#=Zg0j)^RCUPQ&JBi5g@)@{<xeJah4$dOrXX`An6aOZYw^q1EK;fh?GV
zuZMbHewBgnxpmW7OJAJVJoejnw)KLHWskCj$1jFtRh{$koGqdE;2uVusZsG;AI2hZ
zSUSPQ&OP2x^jR2?XpT$i$!{$}S)IG5|6CfN;vQD;b7G(K#bG<hqP$P9%6K<^Q0F?*
z#P-O2u<T>J0UumKNr^G2oUy&AvA)MfJI;*}!@9Opdgb^l&iij>sY5u%EcocTkJ861
zg(G}4cZ~VvFBgD&Eg9R)BBb19gWXRbTSj)h;%D|@iWjAm+i~HZ-KbOht?t*nZ~`aO
z1ORs%EXS`4>GD=-*)xR9r6P#0#V(o>h{#9DjD4?PQXVhFjh8abcH-t}5p#&-iHFQ8
z+1wf0=W!v2z89D|1}e19d)FB4eOi4SLG()t<~kflHes-J73!ZIzfOMv&hrp;aQ)Ra
z_ww&8Nzf=i`)<tqyLpvNk<a`9Jr+lljIpCiY@li|heovRBn??qsm6JTDG{)bOYB)X
z1a+kb(SZc;8uM!?8||ePFMz%D!o(!|p!Zv-P3aq4os8VD9_X8HvZhMM*vj~F9689i
zhj~+v^K;|Hwjv6Tt7XV?hLpoAXZ-r4IpYI<ReA;a>)w^Z8phg6)oxn|;}SfWPh<Di
zFXoIN-G!v<dq=={egV>P;!i~2!FTM}UZm)hwjp>R8%nwR{Bx_tc;fG30OJ^==!?5E
z4^CzyEhtM+KcjewISoCyGW+H`{P2dsT;-YHoL-}Y&Vje)wRen+5`rkfJ6-b}+R(Vo
zF6O2Vn}Wo0Xokjoce?cC$_m%DeF250Ly;`9+bp<2eYr8lILXSvc@JMRKV9U!ILyx=
zu;2iEU{G24gT+DwJs#nqu7vyBpdqat3~x(tYvgPDWxkn97oh*m#2v8_5QCM|o7Kxi
z`U6UbWkauZ*j}bf>Jp=7IBVk(RM5DbP(T-tXXLN>WLT15t}gDHkN%(-Wm0*(R!V^n
zKa%$)^A6CJCV$0Y83iy41H+`9>AlG%7xj_~UC1*qxd<-VW2CG#naYX|l&zd0-})g~
z&sa+i4SHf?u1qB-C#dlasB?QClOABVnD1|lhbV#W6JPc<4lz|_y6S;*<X>4@`+A;9
z5h8X=^=W54RefxQDqcq-2_t8OIXl1f1q$x}k|O`xn)X6lx5#JnKBZIRxYD2lg)jdT
zs!OXPkI#cbq=<YxOkz7#u2cJf1DgjRJU>iK`;xSUrXJ|cRK>#ymTD%+2@e}qG_5^+
z`5&XNL-zGo1sNo3MQuY%H!o+dvOiFu`mpPfXr^`@*2&+>m7eP?CpS?Byx}095R|$+
z^@+C&5;HTaPba?tpMTC+b^9XU`e4c^lB*`S8idqBFNToz6J5be<~io0U8&y%AB&#X
z1&SqxVaS!H=+xN*5g<4;$m=cY{ae~E&cgYoLJf9>f62}@PGar%E%vL|8Nk!7<+5V;
zw4Dpw>s8A}Guc?B59?k1OYGgK{@X(t>0E6P7FJcC?yDI2fK*1K`mWIQ9eF%%nToFv
zz&lu;P^FF@%^;8(ATGJZ<tN=2B8>vNwknzoj%If5LBQ3?*9kE;_e!F56YdZ}o3o~g
zRHWU(A4NK5t6MatiLTT?9ce1*)^Kq9N>ogZ2n3jb_MgStSnhCDa<F@CN{N5fEK7@a
z<{Xk|Ea6lF;G@hR^mtNUMSG3o(g7(FMi5L7i)hQ1oqBFe#1=LAu3T6ZB6x_TY2~7m
z$0WPu2E*HOBbHLv6<C1wcZxOocvww*T-JlzwBFNo9lFr2R}SLMw8ZlU(y5AEmwUGT
zpPV{J&F@IAyJ^~(@tMljDcYz^I(1k*`40HE<w3VWW9RRaV5jO!G!i^6Hr0UB9ZcMq
z<81y;oKTYoY_nqmJ*0@hS*W;;mJ>}&**Ad_7$m`BBCrzt{;Df{w7L7MDU-rwr3I*A
zCF578oRrLO#)#~)xyJ$DqtO|Z9_Y_Dg8`TOjdxpkDsl4j!33;)QF1(UeC8x9<^g+A
zWsw(0{*7V(7e*rWlCS=WQME|_ZZ!6+4TG>O?cW$KI!*-2dd;R+gva+@6C<F{(|{9V
z5ZWVje$i1EU{Oh!Xi8}lYisFlngig}he7YW5P1FHdfJXJ6TYm<z5K3Q_`F^A4r6fJ
zks+hxqh_124-`j8DwMEosLb_;Ll@NDOrGma)AtE(N`*S&hBnv^ZZBXi0w4UGt}BpM
z5(26B{z@LGNLC?{X;-~YBXE$y{SOj`MF$~D09R~R3yrHsHikIoA5QFjbKbjZp#)b8
zJwtMIMMjX0aLSkrXczrB@cMDGIGvSJ!4l(Ur&9LA+@fYVI;-b0;oD`=MeC0wml$kp
zI#ep@@4uvsd5AH`o|>zA3cqV6z*}YZ$J@SU+`Wvdob9@x6~|f~cO{<lqwd{#2hTZk
zo$8(7&`&8y>0H+EGw?A;xFgR?9`kD88dW5BU-#ZieH7!1=MW##&8Xh;AUe82FXAoD
zfs^$5oSAdM0`g9d;7!8>3iPgvebhE@R`3Vi%$Xy|*wvILr+e2>D>y&kF-`@uUEa7L
z{qaXQ#M1q<$1=%bLhu7VPW_GXf+hHrQbH%%_7AMWW0EQcOi!iS3Gf9(=d+d9{{O%B
z|M;vK!_QYH++w`(!45`z?IgRb@V%0$b<4mw3IrARvVy8rZ@o7~Ae|Xjac8O|%%NW{
zmIuUv1?#VRT;zc9XMX2>Z6;ZR+7sQ|D(S3!@^%dQ-H~V4GZWVCOpqhtEQI7wk8OTW
z7C~m0dvMch=8zjbl6KIm;yMern}b`EJ6{z=AYMhF)k$p0Dq)~3=etqOPh{@V>JQb(
z4Tgo)+ia0!tNMsv>2vb4wFz>a2U%jMd4jwm5n6khguaGPtUcZUJyi{ju7e)039)9a
z-W={-ciG7_t;-W*O>sj~dE3hL6%Wf`vz!f-yeQ0{S#a`7mQsW?s@8ti0GOR|r7n|5
zv#yg(4HQy<^lFx6o{2h&=;?^hZJPZ_AxJ*RSgf^?JhP*M{FnW;)Fo{wX3VC`t4=X8
z!|P!Jo=`!Ugpis045~KM_Fh}Wd0u6;`aNVX0d7^dUmVxIDk3~G-AIM)9vTYX7-rom
zjRP~^rDegVOm$5UU8_&eTt}2usnzZ?$GpdpE>f1xxF&+zcU}MmHxg2Qbrp*G5QsLM
zup34~D=|Bjp+6IVDE(5K%*^%SU}70X=K!cN?+DX&8kCbJLyd)ZJiwB(oBUQTP<Pmz
z{eFv866<hk%uL!B9e7-UkJJ@VBUJ*b_zh>?Rbjw}ucak~BYm5??!=?>yMoz`|Cw2I
z2V`P~x5Lra$Fe8u+1M*x>$-JjS@{Z`@6h6a<cqz<({H#@ParBTKL69-onz4|eXe_k
z{e80f&Vq9uU<dmcA;8`6mijcDHH+}P$z$GYa-}_GRDiD$GR_y-L0!J&ZO_*XuOu$F
pU1pw^)%4@(|Eqrl2+JXy!S<5mjvn7SJ>=_W5APpJ51zjCKLFlCqs{;T

literal 0
HcmV?d00001

diff --git a/docs/pages/access-controls/getting-started.mdx b/docs/pages/access-controls/getting-started.mdx
index 41c19b7bc496a..1b3ecb7b07dfd 100644
--- a/docs/pages/access-controls/getting-started.mdx
+++ b/docs/pages/access-controls/getting-started.mdx
@@ -90,7 +90,7 @@ We're now going to set up a GitHub connector for Teleport Open Source Edition an
     ```
   </TabItem>
 
-  <TabItem label="Enterprise">
+  <TabItem label="Enterprise" scope={["enterprise"]}>
     Follow [SAML Okta Guide](../enterprise/sso/okta.mdx#configure-okta) to create a SAML app.
     Check out [OIDC guides](../enterprise/sso/oidc.mdx#identity-providers) for OpenID Connect apps.
     Save the file below as `okta.yaml` and update the `acs` field.
diff --git a/docs/pages/access-controls/guides/dual-authz.mdx b/docs/pages/access-controls/guides/dual-authz.mdx
index 92b640334b37a..8aa899de8d0bc 100644
--- a/docs/pages/access-controls/guides/dual-authz.mdx
+++ b/docs/pages/access-controls/guides/dual-authz.mdx
@@ -4,8 +4,6 @@ description: Dual Authorization for SSH and Kubernetes.
 videoBanner: b_iqJm_o15I
 ---
 
-# Dual Authorization
-
 You can set up Teleport to require require the approval of multiple team members to perform some critical actions.
 Here are the most common scenarios:
 
@@ -30,8 +28,8 @@ two team members for a privileged role `dbadmin`.
 
 ## Prerequisites
 
-- Installed [Teleport Enterprise](../../enterprise/introduction.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
-- [Tctl enterprise admin tool](https://goteleport.com/teleport/download) >= (=teleport.version=)
+- Installed [Teleport Enterprise](../../enterprise/introduction.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= 7.0.0
+- [Tctl enterprise admin tool](https://goteleport.com/teleport/download) >= 7.0.0
 - Mattermost installed.
 
 <Admonition
@@ -41,84 +39,42 @@ two team members for a privileged role `dbadmin`.
   ```code
   $ docker run --name mattermost-preview -d --publish 8065:8065 --add-host dockerhost:127.0.0.1 mattermost/mattermost-preview
   ```
+
 </Admonition>
 
 (!docs/pages/includes/tctl.mdx!)
 
 ## Set up Teleport bot
 
-<Tabs>
- <TabItem label="Mattermost">
-
-  Enable bot account creation in "System Console -> Integrations".
-
-  Toggle `Enable Bot Account Creation`.
+### Create a bot within Mattermost
 
-  ![Enable bots](../../../img/access-controls/dual-authz/mattermost-0-enable.png)
+Enable bot account creation in "System Console -> Integrations".
 
-  Go back to your team settings, navigate to "Integrations -> Bot Accounts". Press "Add Bot Account".
+Toggle `Enable Bot Account Creation`.
 
-  ![Enable bots](../../../img/access-controls/dual-authz/mattermost-1-bot.png)
+![Enable bots](../../../img/access-controls/dual-authz/mattermost-0-enable.png)
 
-  Add the "Post All" permission on the new account.
+Go back to your team settings, navigate to "Integrations -> Bot Accounts". Press "Add Bot Account".
 
-  ![Enable bots](../../../img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png)
-
-  Create the bot and save the access token.
-
-  </TabItem>
-</Tabs>
+![Enable bots](../../../img/access-controls/dual-authz/mattermost-1-bot.png)
 
-Create a non-interactive bot `access-plugin` user and role.
-
-```yaml
-kind: user
-metadata:
-  name: access-plugin
-spec:
-  roles: ['access-plugin']
-version: v2
----
-kind: role
-version: v5
-metadata:
-  name: access-plugin
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list', 'read']
-      - resources: ['access_plugin_data']
-        verbs: ['update']
-    # teleport currently refuses to issue certs for a user with 0 logins,
-    # this restriction may be lifted in future versions.
-    logins: ['access-plugin-not-used']
-```
+Add the "Post All" permission on the new account.
 
-<Admonition
-  type="note"
-  title="Creating resources"
->
-  Here and below follow along and create yaml resources using `tctl create -f`:
+![Enable bots](../../../img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png)
 
-  ```code
-  $ tctl create -f access.yaml
-  ```
-</Admonition>
+Create the bot and save the access token.
 
+### Set up RBAC for the plugin
 
-**Export access-plugin cert**
+(!docs/pages/includes/plugins/rbac.mdx!)
 
-Teleport Plugin uses the `access-plugin` role and user to perform the approval.
-We export the identify files, using `tctl auth sign`.
+### Export the access-plugin identity files
 
-```code
-$ tctl auth sign --format=tls --user=access-plugin --out=auth --ttl=720h
-```
+(!docs/pages/includes/plugins/identity-export.mdx!)
 
-Teleport will generate `auth.crt`, `auth.key`, and `auth.cas` - a certificate, a private key, and a set of CA certs respectively.
+We'll reference the exported file(s) later when configuring the plugin.
 
-**Install the plugin**
+### Install the plugin
 
 <Tabs>
 <TabItem label="Download">
@@ -146,11 +102,20 @@ Teleport will generate `auth.crt`, `auth.key`, and `auth.cas` - a certificate, a
 $ teleport-mattermost configure > /etc/teleport-mattermost.toml
 ```
 
-Update the config with Teleport address, Mattermost URL, and a bot token.
+Update the config with the Teleport address, Mattermost URL, and a bot token.
 
-```toml
-(!examples/resources/plugins/teleport-mattermost.toml!)
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+```yaml
+(!examples/resources/plugins/teleport-mattermost-self.toml!)
+```
+</TabItem>
+<TabItem scope={["cloud"]} label="Cloud">
+```yaml
+(!examples/resources/plugins/teleport-mattermost-cloud.toml!)
 ```
+</TabItem>
+</Tabs>
 
 ## Dual authorization
 
@@ -252,7 +217,7 @@ Bob can also assume granted access request roles using Web UI:
 
 ## Troubleshooting
 
-**Cert errors**
+### Cert errors in self-hosted deployments
 
 You may be getting certificate errors if Teleport's auth server is missing an address in the server certificate:
 
diff --git a/docs/pages/access-controls/guides/impersonation.mdx b/docs/pages/access-controls/guides/impersonation.mdx
index 38c4117fc9703..cc722ffa3a437 100644
--- a/docs/pages/access-controls/guides/impersonation.mdx
+++ b/docs/pages/access-controls/guides/impersonation.mdx
@@ -312,23 +312,15 @@ $ tsh login --proxy=teleport.example.com --user=alice --auth=local
 $ tctl auth sign --user=security-scanner --format=openssh --out=security-scanner --ttl=10h
 ```
 
-Here is a summary of variables and functions we used in this guide:
-
-<table>
-<tr>
-  <th>Variable or Function</th>
-  <th>Description</th>
-</tr>
-<tr>
-  <td>`user.spec.traits`</td>
-  <td>Access traits of local or SSO user.</td>
-</tr>
-<tr>
-  <td>`contains(list, var)`</td>
-  <td>Checks whether list contains variable</td>
-</tr>
-<tr>
-  <td>`equals(var, var)`</td>
-  <td>Checks whether one variable is equal another</td>
-</tr>
-</table>
+### Filter fields
+
+Here is an explanation of the fields used in the `where` conditions within this guide.
+
+| Field                                             | Description                                                                                                            |
+|---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|
+| `user.spec.traits["group"]`                       | The list of traits from a local or SSO user where the `group` trait typically comes from an external identity provider |
+| `impersonate_role.metadata.labels["<label key>"]` | The label value given the label `key` from a role to impersonate                                                       |
+| `impersonate_user.metadata.labels["<label key>"]` | The label value given the label `key` from a user to impersonate                                                       |
+
+Check out our [predicate language](../../setup/reference/predicate-language.mdx#scoping-allowdeny-rules-in-role-resources) 
+guide for a more in depth explanation of the language.
diff --git a/docs/pages/access-controls/guides/per-session-mfa.mdx b/docs/pages/access-controls/guides/per-session-mfa.mdx
index f32a44570934d..0b1a798ed1a5e 100644
--- a/docs/pages/access-controls/guides/per-session-mfa.mdx
+++ b/docs/pages/access-controls/guides/per-session-mfa.mdx
@@ -1,20 +1,27 @@
 ---
 title: Per-session MFA
-description: Require MFA checks for user SSH and Kubernetes sessions.
+description: Require MFA checks to initiate sessions.
 videoBanner: j8Ze7HhjFGw
 ---
 
 # Per-session MFA
 
-Teleport supports multi-factor authentication on every SSH and Kubernetes
-"connection" (a single `tsh ssh` or `kubectl` call). This is an advanced
-security feature that protects users against compromises of their on-disk
-Teleport certificates.
+Teleport supports requiring additional multi-factor authentication checks
+when starting new:
 
-<Admonition type="note">
-  In addition to per-session MFA, enable login MFA in your SSO provider and/or for all [local Teleport
-  users](../../setup/reference/authentication.mdx#local) to improve security.
-</Admonition>
+- SSH connections (a single `tsh` call)
+- Kubernetes sessions (a single `kubectl` call)
+- Desktop sessions
+
+This is an advanced security feature that protects users against compromises of
+their on-disk Teleport certificates.
+
+<Notice type="note">
+  In addition to per-session MFA, enable login MFA in your SSO provider and/or
+  for all [local Teleport
+  users](../../setup/reference/authentication.mdx#local-no-authentication-connector)
+  to improve security.
+</Notice>
 
 <Details
   title="Version warning"
@@ -28,6 +35,8 @@ Teleport certificates.
   only Auth and Proxy services are updated, these checks will *not* be properly
   enforced. Additionally, only v6.1 or newer `tsh` binaries implement
   per-session MFA checks.
+
+  Per-session MFA for Desktop Access was introduced in Teleport 9.
 </Details>
 
 
@@ -40,6 +49,20 @@ Teleport certificates.
   https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) (if using
   SSH from the Teleport Web UI)
 
+<Admonition type="note" title="Per-session MFA with FIPS">
+Teleport FIPS builds disable local users. To configure WebAuthn in order to use
+per-session MFA with FIPS builds, provide the following in your `teleport.yaml`:
+
+```yaml
+teleport:
+  auth_service:
+    local_auth: false
+    second_factor: optional
+    webauthn:
+      rp_id: teleport.example.com
+```
+</Admonition>
+
 ## Configuration
 
 Per-session MFA can be enforced cluster-wide or only for some specific roles.
@@ -75,8 +98,8 @@ spec:
     ...
 ```
 
-Role-specific enforcement only applies when accessing SSH nodes or Kubernetes
-clusters matching that role's `allow` section.
+Role-specific enforcement only applies when accessing resources matching a
+role's `allow` section.
 
 #### Roles example
 
@@ -156,7 +179,6 @@ $ tsh ssh prod3.example.com
 If per-session MFA was enabled cluster-wide, Jerry would be prompted for MFA
 even when logging into `dev1.example.com`.
 
-
 ## Database access MFA
 
 Database access supports per-connection MFA. When Jerry connects to the database
@@ -195,3 +217,5 @@ Current limitations for this feature are:
   If you enable per-session MFA checks cluster-wide, you will not be able to
   use Application access. We're working on integrating per-session
   MFA checks for these clients.
+- For Desktop Access, only WebAuthn devices are supported. Teleport does not
+  support U2F devices for Desktop Access MFA.
diff --git a/docs/pages/access-controls/guides/u2f.mdx b/docs/pages/access-controls/guides/u2f.mdx
index 4412c796fd36a..243f4a6e17602 100644
--- a/docs/pages/access-controls/guides/u2f.mdx
+++ b/docs/pages/access-controls/guides/u2f.mdx
@@ -128,7 +128,7 @@ $ tsh login --proxy=example.com
 
 <Admonition type="note">
 U2F for logging into Teleport is only required for [local
-users](../../setup/reference/authentication.mdx#local). SSO users should configure
+users](../../setup/reference/authentication.mdx#local-no-authentication-connector). SSO users should configure
 multi-factor authentication in their SSO provider.
 </Admonition>
 
diff --git a/docs/pages/access-controls/guides/webauthn.mdx b/docs/pages/access-controls/guides/webauthn.mdx
index 014b15e05a362..01bf5ed02f2b0 100644
--- a/docs/pages/access-controls/guides/webauthn.mdx
+++ b/docs/pages/access-controls/guides/webauthn.mdx
@@ -142,7 +142,7 @@ $ tsh login --proxy=example.com
 
 <Admonition type="note">
   WebAuthn for logging into Teleport is only required for [local users](
-  ../../setup/reference/authentication.mdx#local). SSO users should configure
+  ../../setup/reference/authentication.mdx#local-no-authentication-connector). SSO users should configure
   multi-factor authentication in their SSO provider.
 </Admonition>
 
diff --git a/docs/pages/access-controls/reference.mdx b/docs/pages/access-controls/reference.mdx
index b8b00518c920a..e45a1c4b63ad7 100644
--- a/docs/pages/access-controls/reference.mdx
+++ b/docs/pages/access-controls/reference.mdx
@@ -243,12 +243,12 @@ that are more appropriately scoped.
 
 ### Role versions
 
-There are currently two supported role versions: `v3` and `v5`. `v5` roles are
+There are currently three supported role versions: `v3`, `v4` and `v5`. `v4` and `v5` roles are
 completely backwards-compatible with `v3`, the only difference lies in the
 default allow labels which will be applied to the role if they are not
-explicitly set.
+explicitly set. Additionally, `v5` is required to use [Moderated Sessions](./guides/moderated-sessions.mdx).
 
-Label              | `v3` Default   | `v5` Default
+Label              | `v3` Default   | `v4` and `v5` Default
 ------------------ | -------------- | ---------------
 `node_labels`       | `[{"*": "*"}]` if the role has any logins, else `[]` | `[]`
 `app_labels`        | `[{"*": "*"}]` | `[]`
@@ -435,3 +435,17 @@ spec:
 
 Refer to the [Second Factor - U2F guide](./guides/u2f.mdx) if you have a cluster
 using the legacy U2F support.
+
+## Filter fields
+
+Here is an explanation of the fields used in the `where` and `filter` conditions within this guide.
+
+| Field                      | Description                                         |
+|----------------------------|-----------------------------------------------------|
+| `user.roles`               | The list of roles assigned to a user              |
+| `session.participants`     | The list of participants from a session recording |
+| `ssh_session.participants` | The list of participants from an SSH session       |
+| `user.metadata.name`       | The user's name                                     |
+
+Check out our [predicate language](../setup/reference/predicate-language.mdx#scoping-allowdeny-rules-in-role-resources) 
+guide for a more in depth explanation of the language.
diff --git a/docs/pages/api/getting-started.mdx b/docs/pages/api/getting-started.mdx
index 57fdeed48436b..9ba9a4d7a162a 100644
--- a/docs/pages/api/getting-started.mdx
+++ b/docs/pages/api/getting-started.mdx
@@ -16,7 +16,7 @@ Here are the steps we'll walkthrough:
 ## Prerequisites
 
 - Install [Go](https://golang.org/doc/install) (=teleport.golang=)+ and Go development environment.
-- Set up Teleport through the [Getting Started Guide](../getting-started.mdx)
+- Set up Teleport through one of our [getting started guides](../getting-started.mdx). You can also begin a [free trial](https://goteleport.com/signup/) of Teleport Cloud.
 
 ## Step 1/3. Create a user
 
@@ -29,8 +29,8 @@ Here are the steps we'll walkthrough:
 Create a user `api-admin` with the built-in role `editor`:
 
 ```code
-# Run this directly on your auth server
-# Add user and login via web proxy
+# Run this directly on your Auth Server unless you are using Teleport Cloud
+# Add a user and login via the Proxy Service
 $ sudo tctl users add api-admin --roles=editor
 ```
 
@@ -56,10 +56,9 @@ $ go mod init client-demo
 $ go get github.com/gravitational/teleport/api/client
 ```
 
-Create a file `main.go` with the following command, modifying the `Addrs` strings as needed:
+Create a file called `main.go`, modifying the `Addrs` strings as needed:
 
-```bash
-cat > main.go << 'EOF'
+```go
 package main
 
 import (
@@ -74,6 +73,7 @@ func main() {
 
 	clt, err := client.New(ctx, client.Config{
 		Addrs: []string{
+			// Teleport Cloud customers should use <tenantname>.teleport.sh
 			"tele.example.com:443",
 			"tele.example.com:3025",
 			"tele.example.com:3024",
@@ -101,7 +101,7 @@ func main() {
 EOF
 ```
 
-Now you can run the program and connect the client to the Teleport Auth server to fetch the server version.
+Now you can run the program and connect the client to the Teleport Auth Server to fetch the server version.
 
 ```code
 $ go run main.go
diff --git a/docs/pages/application-access/controls.mdx b/docs/pages/application-access/controls.mdx
index b94f9ab26ff2c..5691249eef7f9 100644
--- a/docs/pages/application-access/controls.mdx
+++ b/docs/pages/application-access/controls.mdx
@@ -79,6 +79,6 @@ allow:
   - [OIDC](../enterprise/sso/oidc.mdx)
   - [ADFS](../enterprise/sso/adfs.mdx)
   - [Azure AD](../enterprise/sso/azuread.mdx)
-  - [GSuite](../enterprise/sso/azuread.mdx)
+  - [Google Workspace](../enterprise/sso/google-workspace.mdx)
   - [Onelogin](../enterprise/sso/one-login.mdx)
   - [Okta](../enterprise/sso/okta.mdx)
diff --git a/docs/pages/application-access/getting-started.mdx b/docs/pages/application-access/getting-started.mdx
index 9b107f121a734..64f5f84ab118d 100644
--- a/docs/pages/application-access/getting-started.mdx
+++ b/docs/pages/application-access/getting-started.mdx
@@ -9,13 +9,24 @@ videoBanner: 5Uwhp3IQMHY
 Let's connect to Grafana using Teleport Application Access in three steps:
 
 - Launch Grafana in a Docker container.
-- Install Teleport and configure it to proxy Grafana.
+- Install the Teleport Application Service on a node and configure it to proxy Grafana.
 - Access Grafana through Teleport.
 
 ## Prerequisites
 
-- We will use Docker to launch Grafana in a container. Alternatively, if you have another web application you'd like to protect with App Access, you can use that instead.
-- We will assume your Teleport cluster is accessible at `teleport.example.com` and `*.teleport.example.com`. Configured DNS records are required to automatically fetch a [Let's Encrypt](https://letsencrypt.org) certificate.
+- The Teleport Auth Service and Proxy Service, deployed on your own infrastructure or via Teleport Cloud.
+- A Docker installation, which we will use to launch Grafana in a container. Alternatively, if you have another web application you'd like to protect with Application Access, you can use that instead.
+- A host where you will run the Teleport Application Service.
+
+<Admonition type="tip" title="Not yet a Teleport user?">
+If you have not yet deployed the Auth Service and Proxy Service, you should follow one of our [getting started guides](../getting-started.mdx).
+</Admonition>
+
+We will assume your Teleport cluster is accessible at `teleport.example.com` and `*.teleport.example.com`. You can substitute the address of your Teleport Proxy Service. (For Teleport Cloud customers, this will be similar to `mytenant.teleport.sh`.)
+
+<Admonition type="note" title="Application Access and DNS">
+(!docs/pages/includes/dns-app-access.mdx!)
+</Admonition>
 
 ## Step 1/3. Start Grafana
 
@@ -23,51 +34,54 @@ We've picked Grafana for this tutorial since it's very easy to run with zero
 configuration required. If you have another web application you'd like to
 expose, skip over to **Step 2**.
 
-Grafana can be launched in a [Docker container](https://grafana.com/docs/grafana/latest/installation/docker/)
-with a single command:
+Grafana can be launched in a Docker container with a single command:
 
 ```code
 $ docker run -d -p 3000:3000 grafana/grafana
 ```
 
 ## Step 2/3. Install and configure Teleport
+(!docs/pages/includes/permission-warning.mdx!)
 
-Download the latest version of Teleport for your platform from our
+On your Application Service host, download the latest version of Teleport for
+your platform from our
 [downloads page](https://goteleport.com/teleport/download).
 
-Teleport requires a valid TLS certificate to operate and can fetch one automatically
-using Let's Encrypt [ACME](https://letsencrypt.org/how-it-works/) protocol.
-
-We will assume that you have configured DNS records for `teleport.example.com`
-and `*.teleport.example.com` to point to the Teleport node.
-
-(!docs/pages/includes/permission-warning.mdx!)
+### Generate a token
 
-Let's generate a Teleport config with ACME enabled:
+A join token is required to authorize a Teleport Application Service agent to
+join the cluster. Generate a short-lived join token and save it, for example,
+in `/tmp/token` on your Teleport Application Service host:
 
 ```code
-$ sudo teleport configure --cluster-name=teleport.example.com --acme --acme-email=alice@example.com -o file
+$ tctl tokens add \
+    --type=app \
+    --app-name=grafana \
+    --app-uri=http://localhost:3000
 ```
 
-<Admonition
-  type="note"
-  title="Web Proxy Port"
->
-  Teleport uses [TLS-ALPN-01](https://letsencrypt.org/docs/challenge-types/#tls-alpn-01)
-  ACME challenge to validate certificate requests which only works on port `443`. Make sure your Teleport proxy is accessible on port `443` when using ACME for certificate management.
-</Admonition>
+### Start Teleport
+
+On the host where you will run the Teleport Application Service, download the latest version of Teleport for your platform from our
+[downloads page](https://goteleport.com/teleport/download).
 
 Now start Teleport and point it to the application endpoint:
 
 ```code
-$ sudo teleport start \
-  --roles=proxy,auth,app \
-  --app-name=grafana \
-  --app-uri=http://localhost:3000
+$ sudo teleport app start \
+  --name=grafana \
+  --token=/tmp/token \
+  --uri=http://localhost:3000 \
+  --auth-server=https://teleport.example.com:3080
 ```
 
-Make sure to update `--app-name` and `--app-uri` accordingly if you're using
-your own web application.
+Change `https://teleport.example.com:3080` to the address and port of your Teleport Proxy Server. If you are a Teleport Cloud cluster, use your tenant's subdomain, e.g., `mytenant.teleport.sh`. 
+
+Make sure to update `--app-name` and `--app-uri` accordingly if you're using your own web application.
+
+The `--token` flag points to the file on the Application Service host where we stored the token that we generated earlier.
+
+### Create a user
 
 Next, let's create a user to access the application we've just connected. Teleport has a built-in role called `access` that allows users to access cluster resources. Create a local user assigned this role:
 
@@ -75,19 +89,23 @@ Next, let's create a user to access the application we've just connected. Telepo
 $ tctl users add --roles=access alice
 ```
 
-The command will output a signup link. Use it to choose a password and set up a second factor. After that, it will take you to the Teleport web UI.
+The command will output a signup link. Use it to choose a password and set up a second factor. After that, it will take you to the Teleport Web UI.
 
 ## Step 3/3. Access the application
 
 There are a couple of ways to access the proxied application.
 
-Every application is assigned a public address which you use to navigate to
+Every application is assigned a public address that you can use to navigate to
 the application directly. In our sample Grafana application we have provided a public address with
 the `--app-public-addr` flag, so go to `https://grafana.teleport.example.com`
-(replace with your app public address) to access the app. If you're not logged into Teleport,
+to access the app. 
+
+Replace `grafana` with the value of the `--app-name` flag you used when starting the Teleport Application Service and `teleport.example.com` with the address of your Proxy Service.
+
+If you're not logged into Teleport,
 you will need to authenticate before the application will show.
 
-Alternatively, log into the Teleport Web Interface at `https://teleport.example.com` (replace with your proxy public address). All available applications are displayed on the Applications tab. Click on the Grafana application tile to access it.
+Alternatively, log in to the Teleport Web Interface at `https://teleport.example.com` (replace with your Proxy Service's public address). All available applications are displayed on the Applications tab. Click on the Grafana application tile to access it.
 
 ## Next steps
 
@@ -97,3 +115,4 @@ Dive deeper into the topics relevant to your Application Access use-case:
 - Learn about integrating with [JWT tokens](./guides/jwt.mdx) for auth.
 - Learn how to use Application Access with [RESTful APIs](./guides/api-access.mdx).
 - See full configuration and CLI [reference](./reference.mdx).
+- Read about how Let's Encrypt uses the [ACME protocol](https://letsencrypt.org/how-it-works/).
\ No newline at end of file
diff --git a/docs/pages/application-access/guides/api-access.mdx b/docs/pages/application-access/guides/api-access.mdx
index 489030739557b..7d45468932a50 100644
--- a/docs/pages/application-access/guides/api-access.mdx
+++ b/docs/pages/application-access/guides/api-access.mdx
@@ -10,6 +10,7 @@ tools like [curl](https://man7.org/linux/man-pages/man1/curl.1.html) or Postman.
 
 ## Prerequisites
 
+You will need a running Teleport cluster, either self hosted or in Teleport Cloud.
 We'll assume that you followed the [Getting Started](../getting-started.mdx)
 guide or the general [App Access Usage](./connecting-apps.mdx) guide to connect the web application providing an API to Teleport.
 
diff --git a/docs/pages/application-access/guides/aws-console.mdx b/docs/pages/application-access/guides/aws-console.mdx
index 8ffa0ee598a93..a5f81b35aad81 100644
--- a/docs/pages/application-access/guides/aws-console.mdx
+++ b/docs/pages/application-access/guides/aws-console.mdx
@@ -6,19 +6,21 @@ videoBanner: GVcy_rffxQw
 
 # AWS Management Console Access
 
-Teleport can automatically sign your users into AWS management console with
+Teleport can automatically sign your users into the AWS management console with
 appropriate IAM roles.
 
 This guide will explain how to:
 
-- Connect your AWS account(-s) to Teleport.
-- Setup example AWS IAM Read Only and Power User roles.
+- Connect your AWS account(s) to Teleport.
+- Set up example AWS IAM Read Only and Power User roles.
 - Use Teleport's role-based access control with AWS IAM roles.
 - View Teleport users' AWS console activity in CloudTrail.
 - Access the AWS Command Line Interface (CLI) through Teleport. 
+
 ## Prerequisites
 
-- Teleport with Application Access. Follow [Getting Started](../getting-started.mdx)
+- A running Teleport cluster, either self hosted or in Teleport Cloud.
+- A Teleport Node with Application Access enabled. Follow the [Getting Started](../getting-started.mdx)
   or [Connecting Apps](./connecting-apps.mdx) guides to get it running.
 - IAM permissions in the AWS account you want to connect.
 - AWS EC2 or other instance where you can assign a IAM Security Role for the Teleport Agent.
@@ -34,7 +36,7 @@ Otherwise, you will receive "400 Bad Request" errors from AWS.
 
 ## Step 1. [Optional] Configure Read Only and Power User roles
 
-AWS provides the `ReadOnlyAccess` and `PowerUserAccess` IAM policies that can be incorporated into roles.  <b>Skip this step</b> if you already have the roles you want to provide access to.
+AWS provides the `ReadOnlyAccess` and `PowerUserAccess` IAM policies that can be incorporated into roles. **Skip this step** if you already have the roles you want to provide access to.
 
 <Admonition type="note">
 These policies may provide too much or not enough access for your intentions. Validate these meet your expectations if you plan on using them.
@@ -67,16 +69,15 @@ Enter a role name and press create role.
 Follow the same steps and select `PowerUserAccess` IAM Policy to create a `ExamplePowerUser` role.
 
 
-## Step 2. Update IAM roles trust relationships
+## Step 2. Update IAM role trust relationships
 
 <Admonition type="note">
-This step is only required if you are allowing access from another account.  The trust relationship will already exist for the same account.
+This step is only required if you are allowing access from another account. The trust relationship will already exist for the same account.
 </Admonition>
 
-Teleport uses AWS [Federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html)
-service to generate sign-in URLs for users, which relies on the `AssumeRole` API
-for getting temporary security credentials. As such, you would first need to
-update your IAM roles' "Trusted entities" to include AWS account ID.
+Teleport uses AWS [federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html) to generate sign-in URLs for users, which relies on the `AssumeRole` API
+for getting temporary security credentials. 
+You will need to update your IAM roles' "Trusted entities" to include your AWS account ID.
 
 Go to the [Roles](https://console.aws.amazon.com/iamv2/home#/roles) list, pick
 a role and create the following trust policy for it by clicking on "Edit trust
@@ -99,8 +100,9 @@ relationship" button on the "Trust relationships" tab:
 
 See [How to use trust policies with IAM roles](https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/)
 for more details. After saving the trust policy, the account will show as a
-trusted entity:
-From the EC2 dashboard select Actions -> Security -> Modify IAM Role
+trusted entity.
+
+From the EC2 dashboard select Actions -> Security -> Modify IAM Role.
 ![AWS trusted entities](../../../img/application-access/aws-trusted-entities@2x.png)
 
 Do this for each IAM role your Teleport users will need to assume.
@@ -136,7 +138,7 @@ is using.
 
 The next step is to give your Teleport users permissions to assume IAM roles.
 
-You can do this by creating a role with `aws_role_arns` field listing all IAM
+You can do this by creating a role with the `aws_role_arns` field listing all IAM
 role ARNs this particular role permits its users to assume:
 
 ```yaml
@@ -232,8 +234,8 @@ an IAM role selector:
 
 ![IAM role selector](../../../img/application-access/iam-role-selector.png)
 
-Click on the role you want to assume and you will get redirected to AWS
-management console signed in with the selected role.
+Click on the role you want to assume and you will get redirected to the AWS
+management console, signed in with the selected role.
 
 In the console's top-right corner you should see that you're logged in through
 federated login and the name of your assumed IAM role:
@@ -252,7 +254,7 @@ Note that your federated login session is marked with your Teleport username.
 To view CloudTrail events for your federated sessions, navigate to the CloudTrail
 [dashboard](https://console.aws.amazon.com/cloudtrail/home) and go to "Event history".
 
-Each Teleport federated login session uses Teleport username as the federated
+Each Teleport federated login session uses a Teleport username as the federated
 username which you can search for to get the events history:
 
 ![CloudTrail](../../../img/application-access/cloud-trail.png)
@@ -270,7 +272,7 @@ Logged into AWS app awsconsole-test. Example AWS CLI command:
 $ tsh aws s3 ls
 ```
 
-The `--aws-role` flag allows to specify the AWS IAM role to assume when accessing AWS API. You can either
+The `--aws-role` flag allows you to specify the AWS IAM role to assume when accessing AWS API. You can either
 provide a role name like `--aws-role ExamplePowerUser` or a full role ARN `arn:aws:iam::1234567890:role/ExamplePowerUser`
 
 Now you can use the `tsh aws` command like the native `aws` command-line tool:
diff --git a/docs/pages/application-access/guides/connecting-apps.mdx b/docs/pages/application-access/guides/connecting-apps.mdx
index 4468d6544d894..d3c74ae36b496 100644
--- a/docs/pages/application-access/guides/connecting-apps.mdx
+++ b/docs/pages/application-access/guides/connecting-apps.mdx
@@ -54,36 +54,22 @@ applications. When setting up Teleport, the minimum requirement is a certificate
 for the proxy and a wildcard certificate for its sub-domain. This is where
 everyone will log into Teleport.
 
+<Admonition type="tip" title="Application Access and DNS">
+(!docs/pages/includes/dns-app-access.mdx!)
+</Admonition>
+
 In our example:
 
 - `teleport.example.com` will host the Access Plane.
 - `*.teleport.example.com` will host all of the applications e.g. `grafana.teleport.example.com`.
 
-Teleport can obtain a certificate automatically from Let's Encrypt using
-[ACME](https://letsencrypt.org/how-it-works/) protocol.
-
-Enable ACME in your proxy config:
-
-```yaml
-proxy_service:
-  enabled: "yes"
-  web_listen_addr: "0.0.0.0:443"
-  public_addr: "teleport.example.com:443"
-  acme:
-    enabled: "yes"
-    email: alice@example.com
-```
-
-<Admonition
-  type="note"
-  title="Web Proxy Port"
->
-  Teleport uses [TLS-ALPN-01](https://letsencrypt.org/docs/challenge-types/#tls-alpn-01)
-  ACME challenge to validate certificate requests which only works on port `443`.  Make sure your Teleport proxy is accessible on port `443` when using ACME for certificate management.
-</Admonition>
-
-Alternatively, if you have obtained certificate/key pairs for your domain
-(e.g. using [certbot](https://certbot.eff.org/)), they can be provided directly
+You can either configure Teleport to obtain a TLS certificate via Let's Encrypt or use an existing certificate and private key (e.g. using [certbot](https://certbot.eff.org/)).
+<Tabs>
+<TabItem label="Let's Encrypt">
+(!docs/pages/includes/acme.mdx!)
+</TabItem>
+<TabItem label="Existing Credentials">
+If you have obtained certificate/key pairs for your domain they can be provided directly
 to the proxy service:
 
 ```yaml
@@ -97,6 +83,8 @@ proxy_service:
   - key_file: "/etc/letsencrypt/live/*.teleport.example.com/privkey.pem"
     cert_file: "/etc/letsencrypt/live/*.teleport.example.com/fullchain.pem"
 ```
+</TabItem>
+</Tabs>
 
 ### Create a user
 
diff --git a/docs/pages/cloud/faq.mdx b/docs/pages/cloud/faq.mdx
index 327a5199c7172..fc28f895a16cc 100644
--- a/docs/pages/cloud/faq.mdx
+++ b/docs/pages/cloud/faq.mdx
@@ -29,7 +29,7 @@ Currently there is no way to provide your own bucket.
 ## How do I add nodes to Teleport Cloud?
 
 You can connect servers, kubernetes clusters, databases and applications
-using [reverse tunnels](../setup/admin/adding-nodes.mdx#adding-a-node-located-behind-nat).
+using [reverse tunnels](../setup/admin/adding-nodes.mdx).
 
 There is no need to open any ports on your infrastructure for inbound traffic.
 
@@ -56,7 +56,7 @@ $ tctl tokens add --type=node
 ## Are dynamic node tokens available?
 
 After [connecting](#how-can-i-access-the-tctl-admin-tool) `tctl` to Teleport Cloud, users can generate
-[dynamic tokens](../setup/admin/adding-nodes.mdx#short-lived-dynamic-tokens):
+[dynamic tokens](../setup/admin/adding-nodes.mdx):
 
 ```code
 $ tctl nodes add --ttl=5m --roles=node,proxy --token=$(uuid)
diff --git a/docs/pages/database-access/getting-started.mdx b/docs/pages/database-access/getting-started.mdx
index 51e4f6ff3cc42..736f67050c1a5 100644
--- a/docs/pages/database-access/getting-started.mdx
+++ b/docs/pages/database-access/getting-started.mdx
@@ -14,7 +14,7 @@ Here's an overview of what we will do:
 2. Download and install Teleport (=teleport.version=) and connect it to the Aurora database.
 3. Connect to the Aurora database via Teleport.
 
-## Step 1/3. Setup Aurora
+## Step 1/3. Set up Aurora
 
 In order to allow Teleport connections to an Aurora instance, it needs to support
 IAM authentication.
@@ -73,33 +73,28 @@ GRANT rds_iam TO alice;
 For more information about connecting to the PostgreSQL instance directly,
 see Amazon [documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ConnectToPostgreSQLInstance.html).
 
-## Step 2/3. Setup Teleport
+## Step 2/3. Set up Teleport
 
 Teleport Database Access is available starting from `6.0.0` release.
 
 Download the appropriate version of Teleport for your platform from
 our [downloads page](https://goteleport.com/teleport/download).
 
+
+### Configure TLS
+
 Teleport requires a valid TLS certificate to operate and can fetch one automatically
-using Let's Encrypt [ACME](https://letsencrypt.org/how-it-works/) protocol.
+using Let's Encrypt.
 
-We will assume that you have configured DNS records for `teleport.example.com` and
-`*.teleport.example.com` to point to the node where you're launching Teleport.
+(!docs/pages/includes/acme.mdx!)
 
-Let's generate a Teleport config with ACME enabled:
+We will assume that you have configured a DNS record for `teleport.example.com` to point to the node where you're launching Teleport.
 
-```code
-$ teleport configure --cluster-name=teleport.example.com --acme --acme-email=alice@example.com > /tmp/teleport.yaml
-```
+<Details title="Using Application Access?">
+(!docs/pages/includes/dns-app-access.mdx!)
+</Details>
 
-<Admonition
-  type="warning"
-  title="Web Proxy Port"
->
-  Teleport's ACME protocol integration currently requires web proxy to run on
-  port 443 so open /tmp/teleport.yaml and update `proxy_service.web_listen_addr`
-  and `proxy_service.public_addr` to use port 443 instead of the default 3080.
-</Admonition>
+### Start Teleport
 
 Now start Teleport and point it to your Aurora database instance. Make sure to
 update the database endpoint and region appropriately.
@@ -118,9 +113,11 @@ $ sudo teleport start --config=/tmp/teleport.yaml \
   title="AWS Credentials"
 >
   The node that connects to the database should have AWS credentials configured
-  with the policy from [step 1](#step-13-setup-aurora).
+  with the policy from [step 1](#step-13-set-up-aurora).
 </Admonition>
 
+### Create a user and role
+
 Create the role that will allow a user to connect to any database using any
 database account:
 
diff --git a/docs/pages/database-access/guides/cockroachdb-self-hosted.mdx b/docs/pages/database-access/guides/cockroachdb-self-hosted.mdx
index 45bd48fa4fd67..fd06d0620a521 100644
--- a/docs/pages/database-access/guides/cockroachdb-self-hosted.mdx
+++ b/docs/pages/database-access/guides/cockroachdb-self-hosted.mdx
@@ -36,7 +36,7 @@ This guide will help you to:
 
 (!docs/pages/includes/database-access/token.mdx!)
 <Tabs>
-<TabItem label="Self Hosted" scope={["enterprise","oss"]}>
+<TabItem label="Self-Hosted" scope={["enterprise","oss"]}>
 Start the Teleport Database Service, pointing the `--auth-server` flag to the address of your Teleport Proxy Service:
 
 ```code
@@ -142,7 +142,7 @@ Log into your Teleport cluster. Your CockroachDB cluster should appear in the
 list of available databases:
 
 <Tabs>
-<TabItem scope={["enterprise", "oss"]} label="Self Hosted">
+<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
 ```code
 $ tsh login --proxy=teleport.example.com --user=alice
 $ tsh db ls
diff --git a/docs/pages/database-access/guides/gui-clients.mdx b/docs/pages/database-access/guides/gui-clients.mdx
index eae7b53cd1831..9e881f6b6bb51 100644
--- a/docs/pages/database-access/guides/gui-clients.mdx
+++ b/docs/pages/database-access/guides/gui-clients.mdx
@@ -192,3 +192,34 @@ keep the Password field empty:
 ![DataGrip connection options](../../../img/database-access/guides/sqlserver/datagrip-connection@2x.png)
 
 Click OK to connect.
+
+## Redis Insight
+
+<Admonition type="note">
+  Teleport's Redis Insight integration only supports Redis standalone instances.
+</Admonition>
+
+After opening Redis Insight click `ADD REDIS DATABASE`.
+
+![Redis Insight Startup Screen](../../../img/database-access/guides/redis/redisinsight-startup.png)
+
+Log in to your Redis instance with a Redis user first by using:
+
+`tsh db login --db-user=alice redis-db-name`.
+
+Click `Add Database Manually`. Use `127.0.0.1` as the `Host` and port printed by `tsh proxy db` as described [here](#get-connection-information).
+
+Provide your Redis username as `Username` and password as `Password`.
+
+![Redis Insight Configuration](../../../img/database-access/guides/redis/redisinsight-add-config.png)
+
+Next, check the `Use TLS` and `Verify TLS Certificates` boxes and copy the CA certificate returned by `tsh proxy db`.
+Copy the private key and certificate to corresponding fields.
+
+Click `Add Redis Database`.
+
+![Redis Insight TLS Configuration](../../../img/database-access/guides/redis/redisinsight-tls-config.png)
+
+Congratulations! You have just connected to your Redis instance.
+
+![Redis Insight Connected](../../../img/database-access/guides/redis/redisinsight-connected.png)
diff --git a/docs/pages/database-access/guides/mongodb-atlas.mdx b/docs/pages/database-access/guides/mongodb-atlas.mdx
index 96f900cc33837..d674516142244 100644
--- a/docs/pages/database-access/guides/mongodb-atlas.mdx
+++ b/docs/pages/database-access/guides/mongodb-atlas.mdx
@@ -28,7 +28,7 @@ In this guide you will:
 (!docs/pages/includes/database-access/token.mdx!)
 
 <Tabs>
-<TabItem label="Self Hosted" scope={["enterprise","oss"]}>
+<TabItem label="Self-Hosted" scope={["enterprise","oss"]}>
 Start the Teleport Database Service, pointing the `--auth-server` flag at the address of your Teleport Proxy Service:
 
 ```code
@@ -74,7 +74,7 @@ If you're starting the Database Agent with a YAML configuration instead of CLI f
 the following config is equivalent to the `teleport db start` command shown earlier:
 
 <Tabs>
-<TabItem label="Self Hosted" scope={["enterprise","oss"]}>
+<TabItem label="Self-Hosted" scope={["enterprise","oss"]}>
 ```yaml
 teleport:
   auth_token: "/tmp/token"
@@ -193,7 +193,7 @@ certificate with `CN=alice` subject.
 Log into your Teleport cluster and see available databases:
 
 <Tabs>
-<TabItem scope={["enterprise", "oss"]} label="Self Hosted">
+<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
 
 ```code
 $ tsh login --proxy=teleport.example.com --user=alice
diff --git a/docs/pages/database-access/guides/mysql-self-hosted.mdx b/docs/pages/database-access/guides/mysql-self-hosted.mdx
index d4a9788beb88b..63b4eda176abe 100644
--- a/docs/pages/database-access/guides/mysql-self-hosted.mdx
+++ b/docs/pages/database-access/guides/mysql-self-hosted.mdx
@@ -131,48 +131,17 @@ tunnel.
 
 ### Start Database Service with Config File
 
-Below is an example of a database service configuration file that proxies
-a single self-hosted MySQL database:
-
-```yaml
-teleport:
-  # The data_dir should be a different location if running on the same
-  # machine as Teleport auth and proxy.
-  data_dir: /var/lib/teleport-db
-  nodename: teleport-db-instance
-  # Teleport invitation token used to join a cluster.
-  # can also be passed on start using --token flag
-  auth_token: /tmp/token
-  # Proxy address to connect to. Note that it has to be the proxy address
-  # because database service always connects to the cluster over reverse
-  # tunnel.
-  auth_servers:
-  - teleport.example.com:3080
-db_service:
-  enabled: "yes"
-  # This section contains definitions of all databases proxied by this
-  # service, can contain multiple items.
-  databases:
-    # Name of the database proxy instance, used to reference in CLI.
-  - name: "example"
-    # Free-form description of the database proxy instance.
-    description: "Example MySQL"
-    # Database protocol.
-    protocol: "mysql"
-    # Database address, MySQL/MariaDB server endpoint in this case.
-    #
-    # Note: this URI's hostname must match the host name specified via --host
-    # flag to tctl auth sign command.
-    uri: "mysql.example.com:3306"
-    # Labels to assign to the database, used in RBAC.
-    static_labels:
-      env: dev
-auth_service:
-  enabled: "no"
-ssh_service:
-  enabled: "no"
-proxy_service:
-  enabled: "no"
+Generate a configuration file at `/etc/teleport.yaml` for the Database Service:
+
+```code
+$ teleport db configure create \
+   -o file \
+   --token=/tmp/token \
+   --proxy=teleport.example.com:3080 \
+   --name=test \
+   --protocol=mysql \
+   --uri=mysql.example.com:3306 \
+   --labels=env=dev
 ```
 
 <Admonition
diff --git a/docs/pages/database-access/guides/postgres-redshift.mdx b/docs/pages/database-access/guides/postgres-redshift.mdx
index cd4b2783f111d..1f1e84302fa91 100644
--- a/docs/pages/database-access/guides/postgres-redshift.mdx
+++ b/docs/pages/database-access/guides/postgres-redshift.mdx
@@ -12,173 +12,42 @@ videoBanner: UFhT52d5bYg
 - AWS account with a Redshift cluster and permissions to create and attach IAM
   policies.
 
-## Step 1/5. Install Teleport
+## Step 1/6. Install Teleport
 
 (!docs/pages/includes/database-access/start-auth-proxy.mdx!)
 
-## Step 2/5. Create Teleport user
+## Step 2/6. Create Teleport user
 
 (!docs/pages/includes/database-access/create-user.mdx!)
 
-## Step 3/5. Configure IAM
+## Step 3/6. Create database agent configuration
 
-### Create an IAM policy for Teleport
+(!docs/pages/includes/database-access/token.mdx!)
+
+Create the Database Service configuration file:
+
+```code
+$ teleport db configure create \
+   -o file \
+   --proxy=teleport.example.com:3080 \
+   --token=/tmp/token \
+   --redshift-discovery=us-west-1
+```
+
+The command will generate a Database Service configuration with Redshift
+database auto-discovery enabled on the `us-west-1` region and place it at the
+`/etc/teleport.yaml` location.
+
+## Step 4/6. Create an IAM policy for Teleport
 
 Teleport needs AWS IAM permissions to be able to:
 
 - Discover and register Redshift databases.
 - Manage IAM user or IAM role policies.
 
-Go to the [Policies](https://console.aws.amazon.com/iamv2/home#/policies) page
-in the AWS Management Console and create a managed IAM policy for the database
-agent.
-
-The exact set of required permissions depends on the IAM identity your Teleport
-database agent will be using (IAM user or IAM role).
-
-<Tabs>
-  <TabItem label="IAM user">
-  Use this policy if your Teleport database agent runs as an IAM user (for
-  example, uses AWS credentials file).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "redshift:DescribeClusters",
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="IAM role">
-  Use this policy if your Teleport database agent runs as an IAM role (for
-  example, on an EC2 instance with attached IAM role).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "redshift:DescribeClusters",
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-</Tabs>
-
-### Create an IAM permission boundary for Teleport
-Since Teleport will be managing its own IAM policies for access to Redshift
-databases, you need to create a permission boundary to limit its effective
-range of permissions.
-
-Create another managed policy that will serve as a permission boundary on the
-same [Policies](https://console.aws.amazon.com/iamv2/home#/policies) page of
-the AWS Management Console.
-
-In addition to the set of permissions you created above, the boundary should
-also include `redshift:GetClusterCredentials`, which will grant your Teleport
-agent the permission to generate temporary credentials to authenticate with
-Redshift databases.
-
-Similar to the permission polices you created above, the exact set of required
-permissions for the permission boundary depends on the IAM identity your
-Teleport database agent will be using (IAM user or IAM role).
-
-<Tabs>
-  <TabItem label="IAM user">
-  Use this permission boundary if your Teleport database agent runs as an IAM
-  user (for example, uses AWS credentials file).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "redshift:DescribeClusters",
-                  "redshift:GetClusterCredentials",
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="IAM role">
-  Use this permission boundary if your Teleport database agent runs as an IAM
-  role (for example, on an EC2 instance with attached IAM role).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "redshift:DescribeClusters",
-                  "redshift:GetClusterCredentials",
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-</Tabs>
-
-### Attach the policy and boundary to an IAM identity
-(!docs/pages/includes/database-access/attach-iam-policies.mdx!)
-
-<Admonition type="note" title="Self-managed IAM">
-  If you prefer to self-manage IAM for your Redshift databases, see [AWS
-  reference](../reference/aws.mdx) for details.
-</Admonition>
-
-## Step 4/5. Start the database agent
-(!docs/pages/includes/database-access/token.mdx!)
-
-Create the database agent configuration e.g. in `/etc/teleport.yaml`:
-
-```yaml
-teleport:
-  data_dir: /var/lib/teleport
-  auth_token: /tmp/token
-  auth_servers:
-  - teleport.example.com:443 # Teleport proxy address to connect to
-auth_service:
-  enabled: "no"
-proxy_service:
-  enabled: "no"
-db_service:
-  enabled: "yes"
-  aws: # Matchers for registering AWS-hosted databases.
-  - types: ["redshift"]
-    regions: ["us-west-1"] # AWS regions to fetch databases from
-    tags: # AWS database resource tags to match
-      "*": "*"
-```
+(!docs/pages/includes/database-access/aws-bootstrap.mdx!)
 
-Start the database agent:
+## Step 5/6. Start the database agent
 
 ```code
 $ teleport start --config=/etc/teleport.yaml
@@ -195,7 +64,7 @@ may not propagate immediately and can take a few minutes to come into effect.
   for more information.
 </Admonition>
 
-## Step 5/5. Connect
+## Step 6/6. Connect
 
 Once the database agent has started and joined the cluster, log in to see the
 registered databases. Replace `--proxy` with the address of your Teleport Proxy Service,
diff --git a/docs/pages/database-access/guides/postgres-self-hosted.mdx b/docs/pages/database-access/guides/postgres-self-hosted.mdx
index 162873d4190aa..e7c2a818ae1ca 100644
--- a/docs/pages/database-access/guides/postgres-self-hosted.mdx
+++ b/docs/pages/database-access/guides/postgres-self-hosted.mdx
@@ -111,43 +111,17 @@ tunnel.
 
 ### Start Database service with config file
 
-Below is an example of a database service configuration file that proxies
-a single self-hosted PostgreSQL database:
-
-```yaml
-teleport:
-  data_dir: /var/lib/teleport-db
-  nodename: test
-  # Proxy address to connect to. Note that it has to be the proxy address
-  # because database service always connects to the cluster over reverse
-  # tunnel.
-  auth_servers:
-  - teleport.example.com:3080
-db_service:
-  enabled: "yes"
-  # This section contains definitions of all databases proxied by this
-  # service, can contain multiple items.
-  databases:
-    # Name of the database proxy instance, used to reference in CLI.
-  - name: "example"
-    # Free-form description of the database proxy instance.
-    description: "Example PostgreSQL"
-    # Database protocol.
-    protocol: "postgres"
-    # Database address, PostgreSQL server endpoint in this case.
-    #
-    # Note: this URI's hostname must match the host name specified via --host
-    # flag to tctl auth sign command.
-    uri: "postgres.example.com:5432"
-    # Labels to assign to the database, used in RBAC.
-    static_labels:
-      env: dev
-auth_service:
-  enabled: "no"
-ssh_service:
-  enabled: "no"
-proxy_service:
-  enabled: "no"
+Generate a configuration file at `/etc/teleport.yaml` for the Database Service:
+
+```code
+$ teleport db configure create \
+   -o file \
+   --token=/tmp/token \
+   --proxy=teleport.example.com:3080 \
+   --name=test \
+   --protocol=postgres \
+   --uri=postgres.example.com:5432 \
+   --labels=env=dev
 ```
 
 <Admonition
@@ -205,7 +179,7 @@ $ tsh db login --db-user=postgres --db-name=postgres example
 Once logged in, connect to the database:
 
 ```code
-$ tsh db connect aurora
+$ tsh db connect example
 ```
 
 <Admonition type="note" title="Note">
diff --git a/docs/pages/database-access/guides/rds.mdx b/docs/pages/database-access/guides/rds.mdx
index fba667601e2d2..8b64256228a8c 100644
--- a/docs/pages/database-access/guides/rds.mdx
+++ b/docs/pages/database-access/guides/rds.mdx
@@ -1,6 +1,7 @@
 ---
-title: Database Access with AWS RDS and Aurora for PostgreSQL and MySQL
-description: How to configure Teleport Database Access with AWS RDS and Aurora for PostgreSQL and MySQL.
+title: Database Access with AWS RDS and Aurora
+h1: Database Access with AWS RDS and Aurora for PostgreSQL, MySQL and MariaDB
+description: How to configure Teleport Database Access with AWS RDS and Aurora for PostgreSQL, MySQL and MariaDB.
 ---
 
 This guide will help you to:
@@ -9,9 +10,10 @@ This guide will help you to:
 - Set up Teleport to access your RDS instances and Aurora clusters.
 - Connect to your databases through Teleport.
 
-<Admonition type="note" title="Aurora Serverless">
-  Aurora Serverless does not support IAM authentication at the time of this
-  writing so it can't be used with Database Access.
+<Admonition type="note" title="Supported versions">
+    The following products are not compatible with Database Access as they don't support IAM authentication:
+    - Aurora Serverless.
+    - RDS MariaDB versions lower than 10.6.
 </Admonition>
 
 ## Prerequisites
@@ -20,268 +22,42 @@ This guide will help you to:
 - AWS account with RDS and Aurora databases and permissions to create and attach
   IAM policies.
 
-## Step 1/6. Install Teleport
+## Step 1/7. Install Teleport
 
 (!docs/pages/includes/database-access/start-auth-proxy.mdx!)
 
-## Step 2/6. Create Teleport user
+## Step 2/7. Create a Teleport user
 
 (!docs/pages/includes/database-access/create-user.mdx!)
 
-## Step 3/6. Configure IAM
+## Step 3/7. Create a database agent configuration
 
-### Create IAM policy for Teleport
-
-Teleport needs AWS IAM permissions to be able to:
-
-- Discover and register RDS instances and Aurora clusters.
-- Configure IAM authentication for them.
-
-Go to the [Policies](https://console.aws.amazon.com/iamv2/home#/policies) page
-and create a managed IAM policy for the database agent.
-
-The exact set of required permissions depends on whether you're connecting to
-RDS instances or Aurora clusters (or both), as well as the IAM identity your
-Teleport database agent will be using (user or role).
-
-<Tabs>
-  <TabItem label="RDS / IAM user">
-  Use this policy if you're connecting to RDS instances and your Teleport
-  database agent runs as IAM user (for example, uses AWS credentials file).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBInstances",
-                  "rds:ModifyDBInstance",
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="RDS / IAM role">
-  Use this policy if you're connecting to RDS instances and your Teleport
-  database agent runs as IAM role (for example, on an EC2 instance with
-  attached IAM role).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBInstances",
-                  "rds:ModifyDBInstance",
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="Aurora / IAM user">
-  Use this policy if you're connecting to Aurora clusters and your Teleport
-  database agent runs as IAM user (for example, uses AWS credentials file).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBClusters",
-                  "rds:ModifyDBCluster",
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="Aurora / IAM role">
-  Use this policy if you're connecting to Aurora clusters and your Teleport
-  database agent runs as IAM role (for example, on an EC2 instance with
-  attached IAM role).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBClusters",
-                  "rds:ModifyDBCluster",
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-</Tabs>
-
-### Create IAM permission boundary for Teleport
-
-Since Teleport will be managing its own IAM policies for access to RDS and
-Aurora databases, you need to create a permission boundary to limit its
-effective range of permissions.
+(!docs/pages/includes/database-access/token.mdx!)
 
-Create another managed policy that will serve as a permission boundary on the
-same [Policies](https://console.aws.amazon.com/iamv2/home#/policies) page.
+Create the Database Service configuration:
 
-The boundary should have the same set of permissions as the IAM policy you
-created above, plus `rds-db:connect`.
+```code
+$ teleport db configure create \
+   -o file \
+   --proxy=teleport.example.com:3080 \
+   --token=/tmp/token \
+   --rds-discovery=us-west-1
+```
 
-<Tabs>
-  <TabItem label="RDS / IAM user">
-  Use this permission boundary policy if you're connecting to RDS instances and
-  your Teleport database agent runs as IAM user (for example, uses AWS
-  credentials file).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBInstances",
-                  "rds:ModifyDBInstance",
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy",
-                  "rds-db:connect"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="RDS / IAM role">
-  Use this permission boundary policy if you're connecting to RDS instances and
-  your Teleport database agent runs as IAM role (for example, on an EC2 instance
-  with attached IAM role).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBInstances",
-                  "rds:ModifyDBInstance",
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy",
-                  "rds-db:connect"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="Aurora / IAM user">
-  Use this permission boundary policy if you're connecting to Aurora clusters
-  and your Teleport database agent runs as IAM user (for example, uses AWS
-  credentials file).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBClusters",
-                  "rds:ModifyDBCluster",
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy",
-                  "rds-db:connect"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="Aurora / IAM role">
-  Use this permission boundary policy if you're connecting to Aurora clusters
-  and your Teleport database agent runs as IAM role (for example, on an EC2
-  instance with attached IAM role).
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBClusters",
-                  "rds:ModifyDBCluster",
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy",
-                  "rds-db:connect"
-              ],
-              "Resource": "*"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-</Tabs>
+The command will generate a database agent configuration with RDS/Aurora
+database auto-discovery enabled on the `us-west-1` region and place it at the
+`/etc/teleport.yaml` location.
 
-### Attach the policy and boundary to an IAM identity
-(!docs/pages/includes/database-access/attach-iam-policies.mdx!)
+## Step 4/7. Create an IAM policy for Teleport
 
-<Admonition type="note" title="Self-managed IAM">
-  If you prefer to self-manage IAM for your RDS databases, take a look at
-  [AWS reference](../reference/aws.mdx) for details.
-</Admonition>
+Teleport needs AWS IAM permissions to be able to:
 
-## Step 4/6. Start the database agent
+- Discover and register RDS instances and Aurora clusters.
+- Configure IAM authentication for them.
 
-(!docs/pages/includes/database-access/token.mdx!)
+(!docs/pages/includes/database-access/aws-bootstrap.mdx!)
 
-Create the database agent configuration e.g. in `/etc/teleport.yaml`:
-
-```yaml
-teleport:
-  data_dir: /var/lib/teleport
-  auth_token: /tmp/token
-  auth_servers:
-  # Teleport proxy address to connect to.
-  # For Teleport Cloud users, this will resemble mytenant.teleport.sh
-  - teleport.example.com:3080
-auth_service:
-  enabled: "no"
-proxy_service:
-  enabled: "no"
-db_service:
-  enabled: "yes"
-  aws:
-  - types: ["rds"]
-    regions: ["us-west-1"] # AWS regions to fetch databases from
-    tags: # AWS database resource tags to match
-      "*": "*"
-```
+## Step 5/7. Start the database agent
 
 Start the database agent:
 
@@ -299,12 +75,11 @@ policies for the discovered databases. Keep in mind that AWS IAM changes may
 not propagate immediately and can take a few minutes to come into effect.
 
 <Admonition type="note" title="AWS credentials">
-  The Teleport database agent uses the default credential provider chain to find AWS
-  credentials. See [Specifying Credentials](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials)
-  for more information.
+  The Teleport Database Service uses the default
+  credential provider chain to find AWS credentials. See [Specifying Credentials](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials) for more information.
 </Admonition>
 
-## Step 5/6. Create database IAM user
+## Step 6/7. Create a database IAM user
 
 Database users must allow IAM authentication in order to be used with Database
 Access for RDS. See below how to enable it for your database engine.
@@ -318,8 +93,8 @@ Access for RDS. See below how to enable it for your database engine.
   GRANT rds_iam TO alice;
   ```
   </TabItem>
-  <TabItem label="MySQL">
-  MySQL users must have RDS authentication plugin enabled:
+  <TabItem label="MySQL/MariaDB">
+  MySQL and MariaDB users must have the RDS authentication plugin enabled:
 
   ```sql
   CREATE USER alice IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';
@@ -337,7 +112,7 @@ Access for RDS. See below how to enable it for your database engine.
 See [Creating a database account using IAM authentication](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html)
 for more information.
 
-## Step 6/6. Connect
+## Step 7/7. Connect
 
 Once the database agent has started and joined the cluster, login to see the
 registered databases:
diff --git a/docs/pages/database-access/guides/redis.mdx b/docs/pages/database-access/guides/redis.mdx
new file mode 100644
index 0000000000000..c062781a4520e
--- /dev/null
+++ b/docs/pages/database-access/guides/redis.mdx
@@ -0,0 +1,375 @@
+---
+title: Database Access with Redis
+description: How to configure Teleport Database Access with Redis.
+---
+
+<Details
+  title="Version warning"
+  opened={true}
+  scope={["oss", "enterprise"]}
+  scopeOnly={true}
+  min="9.0"
+>
+  Database access for Redis is available starting from Teleport `9.0`.
+</Details>
+
+This guide will help you to:
+
+- Install and configure Teleport.
+- Configure mutual TLS authentication between Teleport and Redis.
+- Connect to Redis through Teleport.
+
+## Prerequisites
+
+- Teleport version `9.0` or newer.
+- Redis (standalone or cluster) version `6.0` or newer.
+- `redis-cli` installed and added to your system's `PATH` environment variable.
+
+<Admonition type="note" title="Note">
+  Redis `7.0` and RESP3 (REdis Serialization Protocol) are currently not supported.
+</Admonition>
+
+## Step 1/5. Set up Teleport Auth and Proxy
+
+(!docs/pages/includes/database-access/start-auth-proxy.mdx!)
+
+## Step 2/5. Create a Teleport user
+
+(!docs/pages/includes/database-access/create-user.mdx!)
+
+## Step 3/5. Create Redis users
+
+Each Redis user must be protected by a strong password. We recommend using OpenSSL to generate passwords:
+
+```shell
+openssl rand -hex 32
+```
+
+  <Admonition type="note">
+If you have access to Redis you can also generate a password by using the below command from the Redis console:
+
+```
+ACL GENPASS
+```
+  </Admonition>
+
+Create a `users.acl` file, which defines users for your Redis deployment, passwords required to log in as a given user,
+ and sets of ACL rules. Redis allows you to provide passwords in plaintext or an SHA256 hash.
+We strongly recommend using an SHA256 hash instead of plaintext passwords.
+
+You can use the command below to generate an SHA256 hash from a password.
+```shell
+echo -n STRONG_GENERATED_PASSWORD | sha256sum
+```
+
+<Tabs>
+  <TabItem label="Standalone">
+    ```text
+    user alice on #57639ed88a85996453555f22f5aa4147b4c9614056585d931e5d976f610651e9 allcommands allkeys
+    user default off
+    ```
+
+    For more ACL examples refer to the [Redis documentation](https://redis.io/docs/manual/security/acl/).
+  </TabItem>
+  <TabItem label="Cluster">
+Redis in cluster mode requires a special user created on leader nodes to enable leader-follower communication.
+    ```text
+    user alice on #57639ed88a85996453555f22f5aa4147b4c9614056585d931e5d976f610651e9 allcommands allkeys
+    user replica-user on #42a9798b99d4afcec9995e47a1d246b98ebc96be7a732323eee39d924006ee1d &* -@all +replconf +ping +psync
+    user default off
+    ```
+
+    For more ACL examples refer to the Redis documentation: [ACL](https://redis.io/docs/manual/security/acl/), [ACL rules for replicas](https://redis.io/docs/manual/security/acl/#acl-rules-for-sentinel-and-replicas).
+  </TabItem>
+</Tabs>
+
+<Admonition type="warning">
+  It's very important to either disable or protect with a password the `default` user. Otherwise, everyone with access
+  to the database can log in as the `default` user, which by default has administrator privileges.
+</Admonition>
+
+## Step 4/5. Set up mutual TLS
+
+(!docs/pages/includes/database-access/tctl-auth-sign.mdx!)
+
+Create the secrets:
+
+<Tabs>
+  <TabItem label="Standalone">
+    When connecting to standalone Redis, sign the certificate for the hostname over
+    which Teleport will be connecting to it.
+
+    For example, if your Redis server is accessible at `redis.example.com`,
+ run:
+
+    ```code
+    $ tctl auth sign --format=redis --host=redis.example.com --out=server --ttl=2190h
+    ```
+
+    (!docs/pages/includes/database-access/ttl-note.mdx!)
+
+    The command will create three files:
+    - `server.cas` with Teleport's certificate authority
+    - `server.key` with a generated private key
+    - `server.crt` with a generated user certificate
+
+You will need these files to enable mutual TLS on your Redis server.
+  </TabItem>
+  <TabItem label="Cluster">
+    When connecting to Redis Cluster, sign certificates for each member
+    using their hostnames and IP addresses.
+
+    For example, if the first member is accessible at `redis1.example.com` with IP `10.0.0.1` and
+    the second at `redis2.example.com` with IP `10.0.0.2`, run:
+
+    ```code
+    $ tctl auth sign --format=redis --host=redis1.example.com,10.0.0.1 --out=redis1 --ttl=2190h
+    $ tctl auth sign --format=redis --host=redis2.example.com,10.0.0.2 --out=redis2 --ttl=2190h
+    ```
+
+    (!docs/pages/includes/database-access/ttl-note.mdx!)
+
+    The command will create three files:
+    - `server.cas` with Teleport's certificate authority
+    - `server.key` with a generated private key
+    - `server.crt` with a generated user certificate
+
+You will need these files to enable mutual TLS on your Redis server.
+  </TabItem>
+</Tabs>
+
+(!docs/pages/includes/database-access/rotation-note.mdx!)
+
+Use the generated secrets to enable mutual TLS in your `redis.conf` configuration
+file and restart the database:
+
+<Tabs>
+  <TabItem label="Standalone">
+    ```ini
+    tls-port 6379
+    port 0
+
+    aclfile /path/to/users.acl
+
+    tls-ca-cert-file /path/to/server.cas
+    tls-cert-file /path/to/server.crt
+    tls-key-file /path/to/server.key
+    tls-protocols "TLSv1.2 TLSv1.3"
+    ```
+  </TabItem>
+  <TabItem label="Cluster">
+    ```ini
+    tls-port 7001
+    port 0
+
+    cluster-enabled yes
+
+    tls-replication yes
+    tls-cluster yes
+
+    aclfile /path/to/users.acl
+
+    masterauth GENERATED_STRONG_PASSWORD
+    masteruser replica-user
+
+    tls-cert-file /usr/local/etc/redis/certs/server.crt
+    tls-key-file /usr/local/etc/redis/certs/server.key
+    tls-ca-cert-file /usr/local/etc/redis/certs/server.cas
+    tls-protocols "TLSv1.2 TLSv1.3"
+    ```
+  </TabItem>
+</Tabs>
+
+Once mutual TLS has been enabled, you will no longer be able to connect to
+the cluster without providing a valid client certificate. You can use the
+`tls-auth-clients optional` setting to allow connections
+from clients that do not present a certificate.
+
+See [TLS Support](https://redis.io/topics/encryption)
+in the Redis documentation for more details.
+
+<Admonition type="note" title="Create Redis Cluster">
+  When you're configuring Redis Cluster you need to create the cluster using `redis-cli`.
+
+  Use the following command to create the cluster. Please note `redis-cli --cluster create` accepts only IP addresses.
+
+  ```shell
+  export REDISCLI_AUTH=STRONG_GENERATED_PASSWORD
+  export CERTS_DIR=/path/to/certs/
+  export IP1=10.0.0.1 # update with the real node 1 IP
+  export IP2=10.0.0.2 # update with the real node 2 IP
+  export IP3=10.0.0.3 # update with the real node 3 IP
+  export IP4=10.0.0.4 # update with the real node 4 IP
+  export IP5=10.0.0.5 # update with the real node 5 IP
+  export IP6=10.0.0.6 # update with the real node 6 IP
+
+  redis-cli --user alice --cluster-replicas 1 --tls --cluster-yes \
+  --cluster create ${IP1}:7001 ${IP2}:7002 ${IP3}:7003 ${IP4}:7004 ${IP5}:7005 ${IP6}:7006 \
+  --cacert ${CERTS_DIR}/server.cas --key ${CERTS_DIR}/server.key --cert ${CERTS_DIR}/server.crt
+  ```
+
+</Admonition>
+
+<Admonition type="note" title="Redis Cluster Only">
+
+  To enable Redis cluster mode in Teleport, add the `mode=cluster` parameter to the connection URI in
+  your Teleport Database Service config file.
+
+  ```yaml
+  databases:
+    - name: "redis-cluster"
+      uri: "rediss://redis.example.com:6379?mode=cluster"
+  ```
+
+</Admonition>
+
+## Step 5/5. Connect
+
+Log into your Teleport cluster and see available databases:
+
+<Tabs>
+  <TabItem scope={["enterprise", "oss"]} label="Self Hosted">
+    ```code
+    $ tsh login --proxy=teleport.example.com --user=alice
+    $ tsh db ls
+    # Name          Description     Labels
+    # ------------- --------------- --------
+    # example-redis Example Redis   env=dev
+    ```
+  </TabItem>
+  <TabItem scope={["cloud"]} label="Cloud">
+    ```code
+    $ tsh login --proxy=mytenant.teleport.sh --user=alice
+    $ tsh db ls
+    # Name          Description     Labels
+    # ------------- --------------- --------
+    # example-redis Example Redis   env=dev
+    ```
+  </TabItem>
+</Tabs>
+
+To connect to a particular database instance, first retrieve its certificate
+using the `tsh db login` command:
+
+```code
+$ tsh db login example-redis
+```
+
+<Admonition type="tip" title="Tip">
+  You can be logged into multiple databases simultaneously.
+</Admonition>
+
+You can optionally specify the database name and the user to use by default
+when connecting to the database instance:
+
+```code
+$ tsh db login --db-user=alice example-redis
+```
+
+<Admonition type="note" title="Note">
+  If flag `--db-user` is not provided, Teleport logs in as the `default` user.
+</Admonition>
+
+Once logged in, connect to the database:
+
+```code
+$ tsh db connect example-redis
+```
+
+<Admonition type="note" title="Note">
+  The `redis-cli` command-line client should be available in the system `PATH` in order to be
+  able to connect.
+</Admonition>
+
+Now you can log in as the previously created user using the below command:
+
+```
+AUTH alice STRONG_GENERATED_PASSWORD
+```
+
+To log out of the database and remove credentials:
+
+```code
+# Remove credentials for a particular database instance.
+$ tsh db logout example-redis
+# Remove credentials for all database instances.
+$ tsh db logout
+```
+
+### Supported Redis commands
+
+  <Tabs>
+    <TabItem label="Standalone">
+
+      Redis in standalone mode doesn't support the commands below. If one of the listed commands is called Teleport
+      returns the `ERR Teleport: not supported by Teleport` error.
+
+      - `HELLO`
+      - `PUNSUBSCRIBE`
+      - `SSUBSCRIBE`
+      - `SUNSUBSCRIBE`
+
+    </TabItem>
+    <TabItem label="Cluster">
+
+      Redis in cluster mode doesn't support below commands. If one of the listed commands above is called Teleport
+      returns the `ERR Teleport: command not supported` error.
+
+      - `ACL`
+      - `ASKING`
+      - `CLIENT`
+      - `CLUSTER`
+      - `CONFIG`
+      - `DEBUG`
+      - `EXEC`
+      - `HELLO`
+      - `INFO`
+      - `LATENCY`
+      - `MEMORY`
+      - `MIGRATE`
+      - `MODULE`
+      - `MONITOR`
+      - `MULTI`
+      - `PFDEBUG`
+      - `PFSELFTEST`
+      - `PSUBSCRIBE`
+      - `PSYNC`
+      - `PUNSUBSCRIBE`
+      - `PUNSUBSCRIBE`
+      - `READONLY`
+      - `READWRITE`
+      - `REPLCONF`
+      - `REPLICAOF`
+      - `ROLE`
+      - `SCAN`
+      - `SCRIPT DEBUG`
+      - `SCRIPT KILL`
+      - `SHUTDOWN`
+      - `SLAVEOF`
+      - `SLOWLOG`
+      - `SSUBSCRIBE`
+      - `SUNSUBSCRIBE`
+      - `SYNC`
+      - `TIME`
+      - `WAIT`
+      - `WATCH`
+
+      Teleport also adds additional processing to:
+
+| Command         | Description                                                                                                                                                                                                  |
+|-----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `DBSIZE`        | Sends the query to all nodes and returns the number of keys in the whole cluster.                                                                                                                            |
+| `KEYS`          | Sends the query to all nodes and returns a list of all keys in the whole cluster.                                                                                                                            |
+| `MGET`          | Translates the commands to multiple `GET`s and sends them to multiple nodes. Result is merged in Teleport and returned back to the client. If Teleport fails to fetch at least one key an error is returned. |
+| `FLUSHDB`       | Sends the query to all nodes.                                                                                                                                                                                |
+| `FLUSHALL`      | Works the same as `FLUSHDB`.                                                                                                                                                                                 |
+| `SCRIPT EXISTS` | Sends the query to all nodes. `1` is returned only if script exists on all nodes.                                                                                                                            |
+| `SCRIPT LOAD`   | Sends the script to all nodes.                                                                                                                                                                               |
+| `SCRIPT FLUSH`  | Sends the query to all nodes. `ASYNC` parameter is ignored.                                                                                                                                                  |
+
+    </TabItem>
+  </Tabs>
+
+## Next steps
+
+(!docs/pages/includes/database-access/guides-next-steps.mdx!)
diff --git a/docs/pages/database-access/reference/aws.mdx b/docs/pages/database-access/reference/aws.mdx
index 6d862d2774300..9bf906be356eb 100644
--- a/docs/pages/database-access/reference/aws.mdx
+++ b/docs/pages/database-access/reference/aws.mdx
@@ -3,17 +3,224 @@ title: Database Access AWS IAM Reference
 description: AWS IAM policies for Teleport database access.
 ---
 
-Teleport automatically discovers and configures IAM for RDS and Redshift given
-proper IAM permissions as described in the [AWS RDS & Aurora
-guide](../guides/rds.mdx) and the [AWS Redshift
-guide](../guides/postgres-redshift.mdx).
+## Auto-discovery
+With the appropriate IAM permissions, Teleport automatically discovers and
+configures IAM policies for Amazon RDS and Redshift.
 
+Teleport also requires permission to update database configurations, for example, to
+enable IAM authentication on RDS databases.
+
+You can generate and manage the permissions with the [`teleport db configure
+bootstrap`](../../database-access/reference/cli.mdx#teleport-db-configure-bootstrap)
+command. For example, the following command would generate and print the
+IAM policies:
+
+```code
+$ teleport db configure bootstrap --manual
+```
+
+Or if you prefer, you manage the IAM permissions yourself. Examples of policies
+for each discovery type are shown below.
+
+### Aurora/RDS
+
+<Tabs>
+  <TabItem label="RDS / IAM user">
+  Use this policy if you're connecting to RDS instances and your Teleport
+  database agent runs as an IAM user (for example, uses an AWS credentials file).
+
+  Replace `{account-id}` with your AWS Account ID.
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBInstances",
+                  "rds:ModifyDBInstance"
+              ],
+              "Resource": "*"
+          },
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy"
+              ],
+              "Resource": "arn:aws:iam::{account-id}:user/sample-user"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="RDS / IAM role">
+  Use this policy if you're connecting to RDS instances and your Teleport
+  database agent runs as an IAM role (for example, on an EC2 instance with
+  an attached IAM role).
+
+  Replace `{account-id}` with your AWS Account ID.
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBInstances",
+                  "rds:ModifyDBInstance"
+              ],
+              "Resource": "*"
+          },
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy"
+              ],
+              "Resource": "arn:aws:iam::{account-id}:role/sample-role"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="Aurora / IAM user">
+  Use this policy if you're connecting to Aurora clusters and your Teleport
+  database agent runs as an IAM user (for example, uses an AWS credentials file).
+
+  Replace `{account-id}` with your AWS Account ID.
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBClusters",
+                  "rds:ModifyDBCluster"
+              ],
+              "Resource": "*"
+          },
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy"
+              ],
+              "Resource": "arn:aws:iam::{account-id}:user/sample-user"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="Aurora / IAM role">
+  Use this policy if you're connecting to Aurora clusters and your Teleport
+  database agent runs as an IAM role (for example, on an EC2 instance with
+  an attached IAM role).
+
+  Replace `{account-id}` with your AWS Account ID.
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBClusters",
+                  "rds:ModifyDBCluster"
+              ],
+              "Resource": "*"
+          },
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy"
+              ],
+              "Resource": "arn:aws:iam::{account-id}:role/sample-role"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+</Tabs>
+
+### Redshift
+
+<Tabs>
+  <TabItem label="IAM user">
+  Use this permission boundary if your Teleport database agent runs as an IAM
+  user (for example, it uses an AWS credentials file).
+
+  Replace `{account-id}` with your AWS Account ID.
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "redshift:DescribeClusters",
+                  "redshift:GetClusterCredentials"
+              ],
+              "Resource": "*"
+          },
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy"
+              ],
+              "Resource": "arn:aws:iam::{account-id}:user/sample-user"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="IAM role">
+  Use this permission boundary if your Teleport database agent runs as an IAM
+  role (for example, on an EC2 instance with an attached IAM role).
+
+  Replace `{account-id}` with your AWS Account ID.
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "redshift:DescribeClusters",
+                  "redshift:GetClusterCredentials",
+              ],
+              "Resource": "*"
+          },
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy"
+              ],
+              "Resource": "arn:aws:iam::{account-id}:role/sample-role"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+</Tabs>
+
+## Manual registration
 If you prefer to register RDS or Redshift databases manually using a [static
 configuration](./configuration.mdx) or
 [`tctl`](../guides/dynamic-registration.mdx) and manage IAM yourself, example
 IAM policies with the required permissions are shown below.
 
-## RDS or Aurora policy
+### RDS or Aurora policy
 
 To connect to an RDS database, the database agent's IAM identity needs to have
 `rds-db:connect` permissions for it:
@@ -56,7 +263,7 @@ arn:aws:rds-db:<region>:<account-id>:dbuser:<resource-id>/<db-user>
 See [Creating and using an IAM policy for IAM database access](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html)
 for more information.
 
-## Redshift policy
+### Redshift policy
 Teleport uses temporary credentials generated by AWS to authenticate with
 Redshift databases.
 
diff --git a/docs/pages/database-access/reference/cli.mdx b/docs/pages/database-access/reference/cli.mdx
index dc77a23ce3721..d66839001b05a 100644
--- a/docs/pages/database-access/reference/cli.mdx
+++ b/docs/pages/database-access/reference/cli.mdx
@@ -38,6 +38,53 @@ $ teleport db start \
 | `--gcp-project-id` | (Only for Cloud SQL) GCP Cloud SQL project identifier. |
 | `--gcp-instance-id` | (Only for Cloud SQL) GCP Cloud SQL instance identifier.|
 
+## teleport db configure create
+
+Creates a sample Database Service configuration.
+
+```code
+$ teleport db configure create --rds-discovery=us-west-1 --rds-discovery=us-west-2
+$ teleport db configure create \
+  --token=/tmp/token \
+  --proxy=proxy.example.com:3080 \
+  --name=example \
+  --protocol=postgres \
+  --uri=postgres://postgres.example.com:5432 \
+  --labels=env=prod
+```
+
+| Flag | Description |
+| - | - |
+| `--proxy` | Teleport Proxy Service address to connect to. Default: `0.0.0.0:3080`. |
+| `--token` | Invitation token to register with the Auth Service. Default: none. |
+| `--rds-discovery` | List of AWS regions the agent will discover for RDS/Aurora instances. |
+| `--redshift-discovery` | List of AWS regions the agent will discover for Redshift instances. |
+| `--ca-pin` | CA pin to validate the Auth Service (can be repeated for multiple pins). |
+| `--name` | Name of the proxied database. |
+| `--protocol` | Proxied database protocol. Supported are: [postgres mysql mongodb cockroachdb redis sqlserver]. |
+| `--uri` | Address the proxied database is reachable at. |
+| `--labels` | Comma-separated list of labels for the database, for example env=dev,dept=it |
+| `-o/--output` | Write to stdout with `-o=stdout`, the default config file with `-o=file`, or a custom path with `-o=file:///path` |
+
+## teleport db configure bootstrap
+
+Bootstrap the necessary configuration for the database agent. It reads the provided agent configuration to determine what will be bootstrapped.
+
+```code
+$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-user TeleportUser
+$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-role TeleportRole
+$ teleport db configure bootstrap -c /etc/teleport.yaml --manual
+```
+
+| Flag | Description |
+| - | - |
+| `-c/--config` | Path to a configuration file. Default: `/etc/teleport.yaml`. |
+| `--manual` | When executed in "manual" mode, this command will print the instructions to complete the configuration instead of applying them directly. |
+| `--policy-name` | Name of the Teleport Database Service policy. Default: "DatabaseAccess" |
+| `--confirm` | Do not prompt the user and auto-confirm all actions. |
+| `--attach-to-role` | Role name to attach the policy to. Mutually exclusive with `--attach-to-user`. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
+| `--attach-to-user` | User name to attach the policy to. Mutually exclusive with `--attach-to-role`. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
+
 ## tctl auth sign
 
 When invoked with a `--format=db` (or `--format=mongodb` for MongoDB) flag,
diff --git a/docs/pages/desktop-access/getting-started.mdx b/docs/pages/desktop-access/getting-started.mdx
index 17191b3b721c4..caa1df9757a00 100644
--- a/docs/pages/desktop-access/getting-started.mdx
+++ b/docs/pages/desktop-access/getting-started.mdx
@@ -156,7 +156,7 @@ certificate-based smart card authentication, and ensuring RDP is enabled.
 
 1. Get the Teleport user CA certificate by running:
 
-```
+```code
 $ tctl auth export --type=windows > user-ca.cer
 ```
 
@@ -237,16 +237,16 @@ access.
 
 1. Publish the CA to LDAP:
 
-```
-$ certutil –dspublish –f <PathToCertFile.cer> NTAuthCA
+```powershell
+certutil –dspublish –f <PathToCertFile.cer> NTAuthCA
 ```
 
 2. Force the retrieval of the CA from LDAP. While this step is not required, it
    speeds up the process and allows you to proceed to the next steps without
    waiting for the certificate to propagate.
 
-```
-$ certutil -pulse
+```powershell
+certutil -pulse
 ```
 
 ### Enable the Smart Card service
@@ -384,7 +384,7 @@ providing a join token.
 
 First, generate a join token with the following command:
 
-```
+```code
 $ tctl tokens add --type=windowsdesktop
 ```
 
diff --git a/docs/pages/desktop-access/reference.mdx b/docs/pages/desktop-access/reference.mdx
new file mode 100644
index 0000000000000..156ff29aeecd6
--- /dev/null
+++ b/docs/pages/desktop-access/reference.mdx
@@ -0,0 +1,19 @@
+---
+title: Desktop Access Reference
+layout: tocless-doc
+---
+
+<TileSet>
+  <Tile icon="wrench" title="Configuration" href="./reference/configuration.mdx">
+    Configure Teleport Desktop Access.
+  </Tile>
+  <Tile icon="list" title="Audit" href="./reference/audit.mdx">
+    Desktop Access audit events.
+  </Tile>
+  <Tile icon="copy" title="Clipboard" href="./reference/clipboard.mdx">
+    Share your clipboard with a remote desktop.
+  </Tile>
+  <Tile icon="play" title="Session Recording" href="./reference/sessions.mdx">
+    Desktop session recording and playback
+  </Tile>
+</TileSet>
\ No newline at end of file
diff --git a/docs/pages/desktop-access/reference/clipboard.mdx b/docs/pages/desktop-access/reference/clipboard.mdx
new file mode 100644
index 0000000000000..96f284d94d73d
--- /dev/null
+++ b/docs/pages/desktop-access/reference/clipboard.mdx
@@ -0,0 +1,46 @@
+---
+title: Clipboard Sharing
+description: Using Clipboard Sharing with Teleport Desktop Access.
+---
+
+Teleport Desktop Access supports copying and pasting text between your browser
+and a remote Windows Desktop.
+
+<Admonition type="note">
+This feature requires a Chromium-based browser such as Google Chrome, Brave,
+or Microsoft Edge. To use Desktop Access on other browsers, disable clipboard
+sharing.
+</Admonition>
+
+Clipboard sharing is configured via Teleport's RBAC system. It is enabled by default,
+but can be disabled by setting the following role option on one or more of a user's
+roles:
+
+```yaml
+kind: role
+version: v4
+metadata:
+  name: no_clipboard
+spec:
+  options:
+    desktop_clipboard: false
+```
+
+If a clipboard sharing is enabled for a user, the browser will prompt for access
+to the system clipboard when a desktop session is started. Grant this access to
+proceed.
+
+{
+    /* screenshot of prompt */
+}
+
+If you mistakenly deny clipboard permissions, you can change this setting by
+clicking the lock on the left side of your address bar, toggling the clipboard
+permission, and refreshing the page.
+
+When a desktop session is active, Teleport will indicate whether clipboard sharing
+is enabled in the menu bar at the top of the screen.
+
+{
+    /* screenshots for enabled / disabled */
+}
\ No newline at end of file
diff --git a/docs/pages/desktop-access/reference/sessions.mdx b/docs/pages/desktop-access/reference/sessions.mdx
new file mode 100644
index 0000000000000..0afbb767fae91
--- /dev/null
+++ b/docs/pages/desktop-access/reference/sessions.mdx
@@ -0,0 +1,86 @@
+---
+title: Session Recording and Playback
+description: Recording and Playing Back Teleport Desktop Access Sessions.
+---
+
+Teleport Desktop Access supports recording and playback of desktop sessions.
+
+## Disabling session recording
+
+Session recording is enabled by default, and can be disabled in one of two ways:
+
+### Disable session recording at the cluster level
+
+To disable session recording at the cluster level, edit your `teleport.yaml`
+configuration file.
+
+```yaml
+teleport:
+  auth_service:
+    session_recording: off
+```
+
+<Admonition type="warning">
+Disabling session recording at the cluster level applies to all types of
+recordings. For example, this configuration would prevent Teleport from
+recording SSH sessions as well as desktop sessions.
+</Admonition>
+
+The `session_recording` property can also be configured dynamically by using
+`tctl` to edit the cluster's `session_recording_config` resource. This is the
+required approach for Teleport Cloud users.
+
+### Disable session recording via RBAC
+
+Teleport's RBAC system allows more fine-grained control over which sessions are
+recorded. By default, desktop session recording is enabled. To disable desktop
+session recording for a particular user, add the following role option to all of
+the user's roles:
+
+```yaml
+kind: role
+version: v4
+metadata:
+  name: no_desktop_recording
+spec:
+  options:
+    record_session:
+      desktop: false
+```
+
+Because recording can be important for auditing and compliance concerns, the
+presence of a single role with recording enabled will result in the session
+being recorded. In other words, *all* of the roles applied to a user must
+explicitly disable recording to prevent the session from being recorded.
+
+## Recording
+
+When a desktop session is active, Teleport will indicate whether the session is
+being recorded in the menu bar at the top of the screen.
+
+{
+    /* screenshots for recording, not recording */
+}
+
+## Playback
+
+Recorded sessions can be viewed in the *Session Recordings* page. Desktop
+recordings show a desktop icon in the first column to distinguish them from
+SSH recordings.
+
+{
+    /* screenshot of recordings table */
+}
+
+<Admonition type="note" title="RBAC for sessions">
+Since Teleport 8.1, sessions can be protected via RBAC. In order for a user to
+see desktop sessions in this list, their roles must permit access to the
+sessions resource.
+</Admonition>
+
+Click the play button to open the player in a new tab. The desktop session
+player supports toggling between play and pause, but does not support seeking to
+a specific point in the stream, rewinding, or restarting playback when the end
+of the stream is reached. To replay a session, refresh the page.
+
+
diff --git a/docs/pages/enterprise/hsm.mdx b/docs/pages/enterprise/hsm.mdx
index b1edac7522235..f018bc6f26c5f 100644
--- a/docs/pages/enterprise/hsm.mdx
+++ b/docs/pages/enterprise/hsm.mdx
@@ -12,7 +12,7 @@ This guide will show you how to set up the Teleport Auth Server to use a hardwar
 - An HSM reachable from your Teleport auth server.
 - The PKCS#11 module for your HSM.
 
-<Details scope={["cloud", "oss"]} opened={true} scopeOnly={true} title="Compabitility Warning">
+<Details scope={["cloud", "oss"]} opened={true} scopeOnly={true} title="Compatibility Warning">
 Teleport Cloud and Teleport Open Source do not currently support HSM.
 </Details>
 
diff --git a/docs/pages/enterprise/sso/adfs.mdx b/docs/pages/enterprise/sso/adfs.mdx
index 6bc68d1378f6d..0e08fd0ea8fbc 100644
--- a/docs/pages/enterprise/sso/adfs.mdx
+++ b/docs/pages/enterprise/sso/adfs.mdx
@@ -1,16 +1,14 @@
 ---
-title: SSH Authentication With ADFS How To
-description: How to configure SSH access with Active Directory (ADFS) using Teleport
-h1: SSH Authentication with ADFS
+title: SSO with Active Directory Federation Services
+description: How to configure SSH access with Active Directory Federation Services using Teleport
+h1: Single Sign-On with Active Directory Federation Services
 ---
 
-## Active Directory as an SSO provider for SSH authentication
-
 This guide will cover how to configure Active Directory Federation Services
-[ADFS](https://en.wikipedia.org/wiki/Active_Directory_Federation_Services) to be
+([ADFS](https://en.wikipedia.org/wiki/Active_Directory_Federation_Services)) to be
 a single sign-on (SSO) provider to issue
 SSH credentials to specific groups of users. When used in combination with role
-based access control (RBAC) it allows SSH administrators to define policies
+based access control (RBAC), it allows SSH administrators to define policies
 like:
 
 - Only members of "DBA" group can SSH into machines running PostgreSQL.
@@ -24,25 +22,15 @@ like:
   This guide requires a commercial edition of Teleport.
 </Admonition>
 
-## Enable ADFS Authentication
-
-First, configure Teleport auth server to use ADFS authentication instead of the local
-user database. Update `/etc/teleport.yaml` as shown below and restart the
-teleport daemon.
-
-```yaml
-auth_service:
-    authentication:
-        type: saml
-```
+(!docs/pages/includes/enterprise/samlauthentication.mdx!)
 
 ## Configure ADFS
 
 You'll need to configure ADFS to export claims about a user (Claims Provider
-Trust in ADFS terminology) and you'll need to configure AD FS to trust
+Trust in ADFS terminology) and you'll need to configure ADFS to trust
 Teleport (a Relying Party Trust in ADFS terminology).
 
-For Claims Provider Trust configuration you'll need to specify at least the
+For Claims Provider Trust configuration, you'll need to specify at least the
 following two incoming claims: `Name ID` and `Group`. `Name ID` should be a
 mapping of the LDAP Attribute `E-Mail-Addresses` to `Name ID`. A group
 membership claim should be used to map users to roles (for example to
@@ -51,29 +39,29 @@ separate normal users and admins).
 ![Name ID Configuration](../../../img/adfs-1.png)
 ![Group Configuration](../../../img/adfs-2.png)
 
-In addition if you are using dynamic roles (see below), it may be useful to map
+In addition, if you are using dynamic roles (see below), it may be useful to map
 the LDAP Attribute `SAM-Account-Name` to `Windows account name` and create
 another mapping of `E-Mail-Addresses` to `UPN`.
 
 ![WAN Configuration](../../../img/adfs-3.png)
 ![UPN Configuration](../../../img/adfs-4.png)
 
-You'll also need to create a Relying Party Trust, use the below information to
-help guide you through the Wizard. Note, for development purposes we recommend
+You'll also need to create a Relying Party Trust. Use the below information to
+help guide you through the Wizard. Note that for development purposes we recommend
 using `https://localhost:3080/v1/webapi/saml/acs` as the Assertion Consumer
 Service (ACS) URL, but for production you'll want to change this to a domain
 that can be accessed by other users as well.
 
 - Create a claims aware trust.
 - Enter data about the relying party manually.
-- Set the display name to something along the lines of "Teleport".
+- Set the display name to something along the lines of `Teleport`.
 - Skip the token encryption certificate.
 - Select *"Enable support for SAML 2.0 Web SSO protocol"* and set the URL to `https://localhost:3080/v1/webapi/saml/acs`.
 - Set the relying party trust identifier to `https://localhost:3080/v1/webapi/saml/acs` as well.
 - For access control policy select *"Permit everyone"*.
 
 Once the Relying Party Trust has been created, update the Claim Issuance Policy
-for it. Like before make sure you send at least `Name ID` and `Group` claims to the
+for it. Like before, make sure you send at least `Name ID` and `Group` claims to the
 relying party (Teleport). If you are using dynamic roles, it may be useful to
 map the LDAP Attribute `SAM-Account-Name` to *"Windows account name"* and create
 another mapping of `E-Mail-Addresses` to *"UPN"*.
@@ -83,10 +71,10 @@ associated with it. To check this open Server Manager then
 *"Tools -> Active Directory Users and Computers"* and select the user and right
 click and open properties. Make sure the email address field is filled out.
 
-## Create Teleport Roles
+## Create Teleport roles
 
-Lets create two Teleport roles: one for administrators and the other is for
-normal users. You can create them using `tctl create {file name}` CLI command
+Let's create two Teleport roles: one for administrators and the other for
+normal users. You can create them using the `tctl create {file name}` CLI command
 or via the Web UI.
 
 ```yaml
@@ -126,13 +114,18 @@ spec:
 
 This role declares:
 
-- Devs are only allowed to login to nodes labelled with `access: relaxed` label.
-- Developers can log in as `ubuntu` user
-- Notice `{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}` login. It configures Teleport to look at
-  *"[http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"](http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname")* ADFS claim and use that field as an allowed login for each user.
-  Also note the double quotes (`"`) and square brackets (`[]`) around the claim name - these are important.
-- Developers also do not have any "allow rules" i.e. they will not be able to
-  see/replay past sessions or re-configure the Teleport cluster.
+- Devs are only allowed to log in to nodes labeled `access: relaxed`.
+- Developers can log in as the `ubuntu` user.
+- Developers will not be able to see or replay past sessions or
+  re-configure the Teleport cluster.
+
+The login
+`{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}`
+configures Teleport to look at the
+`http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname`
+ADFS claim and use that field as an allowed login for each user. Note the
+double quotes (`"`) and square brackets (`[]`) around the claim name—these are
+important.
 
 Next, create a SAML connector [resource](../../setup/reference/resources.mdx):
 
@@ -149,7 +142,7 @@ name is `http://schemas.xmlsoap.org/claims/Group` with a value of *"admins"*
 to the *"admin"* role. Groups with the value *"users"* is being mapped to the
 *"users"* role.
 
-## Export the Signing Key
+## Export the signing key
 
 For the last step, you'll need to export the signing key:
 
@@ -170,8 +163,8 @@ the same as before:
 $ tsh --proxy=proxy.example.com login
 ```
 
-This command will print the SSO login URL (and will try to open it
-automatically in a browser).
+This command will print the SSO login URL and try to open it
+automatically in a browser.
 
 <Admonition
   type="tip"
@@ -185,15 +178,15 @@ automatically in a browser).
   type="note"
   title="IMPORTANT"
 >
-  Teleport only supports sending party initiated flows for SAML 2.0. This
-  means you can not initiate login from your identity provider, you have to
-  initiate login from either the Teleport Web UI or CLI.
-</Admonition>
+  Teleport only supports sending party-initiated flows for SAML 2.0. This means
+  that you cannot initiate login from your identity provider, and must do so
+  from either the Teleport Web UI or CLI.
+  </Admonition>
 
 ## Troubleshooting
 
-If you get "access denied errors" the number one place to check is the audit
-log on the Teleport auth server. It is located in `/var/lib/teleport/log` by
+If you get "access denied" errors, the number one place to check is the audit
+log on the Teleport Auth Server. It is located in `/var/lib/teleport/log` by
 default and it will contain the detailed reason why a user's login was denied.
 
 Some errors (like filesystem permissions or misconfigured network) can be
@@ -204,4 +197,4 @@ $ sudo journalctl -fu teleport
 ```
 
 If you wish to increase the verbosity of Teleport's syslog, you can pass
-`--debug` flag to `teleport start` command.
+`--debug` flag to the `teleport start` command.
diff --git a/docs/pages/enterprise/sso/azuread.mdx b/docs/pages/enterprise/sso/azuread.mdx
index c50e0dd4f49e7..7a4a56330b187 100644
--- a/docs/pages/enterprise/sso/azuread.mdx
+++ b/docs/pages/enterprise/sso/azuread.mdx
@@ -28,6 +28,8 @@ Before you get started you’ll need:
 - To register one or more users in the directory
 - To create at least two security groups in Azure AD and assign one or more users to each group
 
+(!docs/pages/includes/enterprise/samlauthentication.mdx!)
+
 ## Configure Azure AD
 
 1. Select **Azure AD -> Enterprise Applications**
@@ -168,34 +170,6 @@ $ tctl create dev.yaml
 
 ## Testing
 
-Update your Teleport configuration to make SAML the default authentication method.
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self Hosted">
-In your Teleport configuration file, include the following:
-
-```yaml
-auth_service:
-  authentication:
-    type: saml
-```
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
-Apply the following `cluster_auth_preference` resource via `tctl create`.
-
-```yaml
-    kind: cluster_auth_preference
-    version: v2
-    metadata:
-      name: cluster-auth-preference
-    spec:
-      type: "saml"
-```
-</TabItem>
-</Tabs>
-
-The Web UI will now present the option to log in via Microsoft.
-
 ![Login with Microsoft](../../../img/azuread/azure-11-loginwithmsft.png)
 
 
diff --git a/docs/pages/enterprise/sso/gitlab.mdx b/docs/pages/enterprise/sso/gitlab.mdx
index 9ffd4523b7463..c3b74696f4174 100644
--- a/docs/pages/enterprise/sso/gitlab.mdx
+++ b/docs/pages/enterprise/sso/gitlab.mdx
@@ -22,17 +22,7 @@ like:
   This guide requires a commercial edition of Teleport.
 </Admonition>
 
-## Enable OIDC Authentication
-
-First, configure Teleport auth server to use OIDC authentication instead of the local
-user database. Update `/etc/teleport.yaml` as shown below and restart the
-teleport daemon.
-
-```yaml
-auth_service:
-    authentication:
-        type: oidc
-```
+(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
 
 ## Configure GitLab
 
diff --git a/docs/pages/enterprise/sso/google-workspace.mdx b/docs/pages/enterprise/sso/google-workspace.mdx
index 86b977b3ff770..f2325d9569da9 100644
--- a/docs/pages/enterprise/sso/google-workspace.mdx
+++ b/docs/pages/enterprise/sso/google-workspace.mdx
@@ -32,6 +32,8 @@ Before you get started you’ll need:
 - Ability to create a Google Cloud project, which requires signing up for Google Cloud. Note that this guide will not require using any paid Google Cloud services.
 - Ability to set up Google Workspace groups.
 
+(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
+
 ## Configuring Google Workspace
 
 The setup will consist of creating a new project on Google Cloud Platform,
diff --git a/docs/pages/enterprise/sso/oidc.mdx b/docs/pages/enterprise/sso/oidc.mdx
index ff77208d90b84..59ab7f1426193 100644
--- a/docs/pages/enterprise/sso/oidc.mdx
+++ b/docs/pages/enterprise/sso/oidc.mdx
@@ -20,17 +20,7 @@ administrators to define policies like:
   This guide requires an Enterprise edition of Teleport.
 </Admonition>
 
-## Enable OIDC Authentication
-
-First, configure Teleport auth server to use OIDC authentication instead of the local
-user database. Update `/etc/teleport.yaml` as show below and restart the
-teleport daemon.
-
-```yaml
-auth_service:
-    authentication:
-        type: oidc
-```
+(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
 
 ## Identity Providers
 
diff --git a/docs/pages/enterprise/sso/okta.mdx b/docs/pages/enterprise/sso/okta.mdx
index f5d374e9ea70a..318891f41f802 100644
--- a/docs/pages/enterprise/sso/okta.mdx
+++ b/docs/pages/enterprise/sso/okta.mdx
@@ -22,17 +22,7 @@ like:
   This guide requires a commercial edition of Teleport.
 </Admonition>
 
-## Enable SAML Authentication
-
-First, configure Teleport auth server to use SAML authentication instead of the local
-user database. Update `/etc/teleport.yaml` as shown below and restart the
-teleport daemon.
-
-```yaml
-auth_service:
-    authentication:
-        type: saml
-```
+(!docs/pages/includes/enterprise/samlauthentication.mdx!)
 
 ## Configure Okta
 
diff --git a/docs/pages/enterprise/sso/one-login.mdx b/docs/pages/enterprise/sso/one-login.mdx
index a0222e3709c3a..37e0f863148c6 100644
--- a/docs/pages/enterprise/sso/one-login.mdx
+++ b/docs/pages/enterprise/sso/one-login.mdx
@@ -22,17 +22,7 @@ like:
   This guide requires an Enterprise edition of Teleport.
 </Admonition>
 
-## Enable SAML Authentication
-
-Configure Teleport auth server to use SAML authentication instead of the local
-user database. Update `/etc/teleport.yaml` as shown below and restart the
-teleport daemon.
-
-```yaml
-auth_service:
-    authentication:
-        type: saml
-```
+(!docs/pages/includes/enterprise/samlauthentication.mdx!)
 
 ## Configure Application
 
diff --git a/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx b/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx
index fe5ce015141c2..fbdaa0e959ecc 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx
@@ -4,9 +4,7 @@ description: How to configure SSH login approval using Jira and Teleport
 h1: SSH login approvals using Jira
 ---
 
-## Teleport Jira Plugin Setup
-
-This guide will talk through how to setup Teleport with Jira. Teleport to Jira integration allows you to treat Teleport access and permission requests using Jira tickets.
+This guide will talk through how to setup Teleport with Jira. Teleport's Jira integration allows you to treat Teleport access and permission requests using Jira tickets.
 
 ## Setup
 
@@ -16,62 +14,20 @@ This guide assumes that you have:
 - Admin privileges with access to `tctl`
 - Jira Server or Jira Cloud installation with an owner privileges, specifically to setup webhooks, issue types, and workflows
 
-### Create an access-plugin role and user within Teleport
+Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
 
-First off, using an existing Teleport Cluster, we are going to create a new Teleport User and Role to access Teleport.
 
-#### Create User and Role for access
+### Create a user and role for access
 
-Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
-new user and role that only has API access to the `access_request` API. The below script
-will create a yaml resource file for a new user and role.
+(!docs/pages/includes/plugins/rbac.mdx!)
 
-```bash
-cat > rscs.yaml <<EOF
-kind: user
-metadata:
-  name: access-plugin-jira
-spec:
-  roles: ['access-plugin-jira']
-version: v2
----
-kind: role
-metadata:
-  name: access-plugin-jira
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list','read','update']
-    # teleport currently refuses to issue certs for a user with 0 logins,
-    # this restriction may be lifted in future versions.
-    logins: ['access-plugin-jira']
-version: v5
-EOF
-
-# ...
-$ tctl create -f rscs.yaml
-```
+### Export the access-plugin certificate
 
-#### Export access-plugin Certificate
+(!docs/pages/includes/plugins/identity-export.mdx!)
 
-Teleport Plugin use the `access-plugin-jira` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
+We'll reference these files later when [configuring the plugins](#configuration-file).
 
-```bash
-tctl auth sign --format=tls --user=access-plugin-jira --out=auth --ttl=2190h
-# ...
-```
-
-The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#configuration-file).
-
-<Admonition
-  type="note"
-  title="Certificate Lifetime"
->
-  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
-</Admonition>
-
-## Setting up your Jira Project
+## Setting up your Jira project
 
 ### Creating the permission management project
 
@@ -87,11 +43,11 @@ Create a new board for tasks in the permission management project. The board has
 2. Approved
 3. Denied
 
-Teleport Jira Plugin will create a new issue for each new permission request in the first available column on the board. When you drag the request task to Approved column on Jira, the request will be approved. If you drag the request task to the Denied column in Jira, the request will be denied.
+Teleport's Jira plugin will create a new issue for each new permission request in the first available column on the board. When you drag the request task to the Approved column in Jira, the request will be approved. If you drag the request task to the Denied column in Jira, the request will be denied.
 
-### Setting up Request ID field on Jira
+### Setting up a request ID field on Jira
 
-Teleport Jira Plugin requires a custom issue field to be created.
+The Teleport Jira plugin requires a custom issue field to be created.
 
 Go to your Jira Project settings → Issue Types → Select type `Task` → add a new Short Text field named `TeleportAccessRequestId`.
 
@@ -103,30 +59,30 @@ If you're using Jira Cloud, navigate to [Account Settings → Security → API T
 
 For Jira Server, the URL of the API tokens page will be different depending on your installation.
 
-### Setting up Jira Webhooks
+### Setting up Jira webhooks
 
-Go to Settings → General → System → Webhooks and create a new Webhook for Jira to tell the Teleport Plugin about updates.
+Go to Settings → General → System → Webhooks and create a new webhook for Jira to tell the Teleport plugin about updates.
 
-For the webhook URL, use the URL that you'll run the plugin on. It needs to be a publicly accessible URL that we'll set up later. Jira requires the webhook listener to run over HTTPS.
+For the webhook URL, use the URL that you'll run the plugin on. It needs to be a publicly accessible URL (we will show you how to set this up later). Jira requires the webhook listener to run over HTTPS.
 
-The Teleport Jira plugin webhook needs to be notified only about new issues being created, issues being updated, or deleted. You can leave all the other boxes empty.
+The webhook needs to be notified only about new issues being created, issues being updated, or deleted. You can leave all the other boxes empty.
 
 <Admonition
   type="note"
   title="Plugin Defaults"
 >
-  Jira Webhook will send updates about any issues in any projects in your Jira installation to the webhook.  We suggest that you use JQL filters to limit which issues are being sent to the plugin.
+  Jira will send updates about any issues in any projects in your Jira installation to the webhook. We suggest that you use JQL filters to limit which issues are being sent to the plugin.
 
-  The Plugin's web server will run with TLS, but you can disable it with `--insecure-no-tls` to test things out in a dev environment.
+  The plugin's web server will run with TLS, but you can disable it with `--insecure-no-tls` to test things out in a dev environment.
 </Admonition>
 
-In the webhook settings page, make sure that the webhook will only send Issue Updated updates. It's not critical if anything else gets sent, the plugin will just ignore everything else.
+In the webhook settings page, make sure that the webhook will only send Issue Updated updates. It's not critical if anything else gets sent, since the plugin will just ignore everything else.
 
 ## Installing
 
-We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
+We recommend installing Teleport plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
-and Teleport Auth access.  We currently only provide linux-amd64 binaries, you can also
+and Teleport Auth access. We currently only provide linux-amd64 binaries, you can also
 compile these plugins from [source](https://github.com/gravitational/teleport-plugins/tree/master/access/jira).
 
 ```code
@@ -142,7 +98,7 @@ Run `./install` in from 'teleport-jira' or place the executable in the appropria
 
 ### Configuration file
 
-Teleport Jira Plugin uses a config file in TOML format. Generate a boilerplate config by
+The Teleport Jira plugin uses a config file in TOML format. Generate a boilerplate config by
 running the following command:
 
 ```code
@@ -150,11 +106,20 @@ $ teleport-jira configure > teleport-jira.toml
 $ sudo mv teleport-jira.toml /etc
 ```
 
-By default, Jira Teleport Plugin will use a config in `/etc/teleport-jira.toml`, and you can override it with `-c config/file/path.toml` flag.
+By default, the Jira Teleport plugin will use a config in `/etc/teleport-jira.toml`, and you can override it with `-c config/file/path.toml` flag.
 
+<Tabs>
+<TabItem label="Self-Hosted" scopes={["oss", "enterprise"]}>
+```toml
+(!examples/resources/plugins/teleport-jira-self-hosted.toml!)
+```
+</TabItem>
+<TabItem label="Cloud" scopes={["cloud"]}>
 ```toml
-(!examples/resources/plugins/teleport-jira.toml!)
+(!examples/resources/plugins/teleport-jira-cloud.toml!)
 ```
+</TabItem>
+</Tabs>
 
 The `[teleport]` section describes where the teleport service running, and what keys should the plugin use to authenticate itself. Use the keys that you've generated.
 
@@ -165,10 +130,10 @@ The `[jira]` section requires a few things:
 3. Your Jira API token that you've created above.
 4. A Jira Project key, available in Project settings.
 
-`[http]` setting block describes how the Plugin's HTTP server works. The HTTP server is responsible for listening for updates from Jira, and processing updates, like when someone drags a task from Inbox to Approved column.
+The `[http]` setting block describes how the plugin's HTTP server works. The HTTP server is responsible for listening for updates from Jira, and processing updates, like when someone drags a task from Inbox to Approved column.
 
 You must provide an address the server should listen on, and a certificate to use. It's possible to
-setup on the same server as the Teleport Proxy, so you can use the same TLS certificate.
+run the Jira plugin on the same server as the Teleport Proxy, so you can use the same TLS certificate.
 
 ## Testing
 
@@ -186,20 +151,20 @@ Go ahead and test it:
 $ tsh login --request-roles=admin
 ```
 
-That should create a new permission request on Teleport (you can test if it did with `tctl request ls` ), and you should see a new task on your Jira project board.
+That should create a new permission request on Teleport (you can test if it did with `tctl request ls`), and you should see a new task on your Jira project board.
 
-### Setup with SystemD
+### Set up systemd
 
-In production, we recommend starting teleport plugin daemon via an init system like systemd .
-Here's the recommended Teleport Plugin service unit file for systemd:
+In production, we recommend starting the Teleport plugin daemon via an init system like systemd.
+Here's the recommended Teleport plugin service unit file for systemd:
 
 ```txt
 (!examples/systemd/plugins/teleport-jira.service!)
 ```
 
-Save this as `teleport-jira.service`.
+Save this as `teleport-jira.service`. Make sure the `teleport-jira start` command includes a `--config` flag that refers to the configuration file you created earlier.
 
-## Audit Log
+## Audit log
 
 The plugin will let anyone with access to the Jira board approve/deny requests so it's
 important to review Teleport's audit log.
diff --git a/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx b/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx
index 1357bd2971e90..5bf61b69dee15 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx
@@ -4,9 +4,7 @@ description: How to configure SSH login approval using Jira Server and Teleport
 h1: SSH login approvals using Jira Server
 ---
 
-## Teleport Jira Server Plugin Setup
-
-This guide will talk through how to setup Teleport with Jira Server. Teleport to Jira Server integration allows you to treat Teleport access and permission requests as Jira Tasks.
+This guide will talk through how to set up Teleport with Jira Server. Teleport's integration with Jira Server allows you to treat Teleport access and permission requests as Jira tasks.
 
 <Admonition type="note">
   Teleport's tsh request workflow is synchronous and needs to be approved within 1 hour of the request.
@@ -32,114 +30,71 @@ This guide will talk through how to setup Teleport with Jira Server. Teleport to
 
 - A running Teleport Cluster
 - Admin Privileges with access and control of [`tctl`](../../setup/reference/cli.mdx#tctl)
-- Jira Server installation with owner privileges, specifically to setup webhooks, issue types, and workflows. This plugin has been tested with Jira Software 8.8.0
-
-### Create an access-plugin role and user within Teleport
-
-First off, using an existing Teleport Cluster, we are going to create a new Teleport User and Role to access Teleport.
-
-#### Create User and Role for access
+- A Jira Server installation with owner privileges, specifically to set up webhooks, issue types, and workflows. This plugin has been tested with Jira Software 8.8.0
 
-Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
-new user and role that only has API access to the `access_request` API. The below script
-will create a yaml resource file for a new user and role.
-
-```bash
-cat > rscs.yaml <<EOF
-kind: user
-metadata:
-  name: access-plugin-jira
-spec:
-  roles: ['access-plugin-jira']
-version: v2
----
-kind: role
-metadata:
-  name: access-plugin-jira
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list','read','update']
-    # teleport currently refuses to issue certs for a user with 0 logins,
-    # this restriction may be lifted in future versions.
-    logins: ['access-plugin-jira']
-version: v5
-EOF
-
-# ...
-$ tctl create -f rscs.yaml
-```
+Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
 
-#### Export access-plugin Certificate
+### Create a user and role for access
 
-Teleport Plugin uses the `access-plugin-jira` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
+(!docs/pages/includes/plugins/rbac.mdx!)
 
-```code
-$ tctl auth sign --format=tls --user=access-plugin-jira --out=auth --ttl=2190h
-# ...
-```
+### Export access-plugin certificate
 
-The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#configuration-file).
+(!docs/pages/includes/plugins/identity-export.mdx!)
 
-<Admonition
-  type="note"
-  title="Certificate Lifetime"
->
-  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
-</Admonition>
+We'll reference these files later when [configuring the plugins](#configuration-file).
 
 ### Setting up your Jira Server instance
 
-#### Creating a Project
+#### Creating a project
 
-Teleport Jira Plugin relies on your Jira project having a board with at least three statuses (columns): Pending, Approved, and Denied. It's therefore the easiest scenario to create a new Jira project for Teleport to use.
+The Teleport Jira plugin relies on your Jira project having a board with at least three statuses (columns): Pending, Approved, and Denied. It's therefore the easiest scenario to create a new Jira project for Teleport to use.
 
-The specific type of project you choose when you create it doesn't matter, as long as you can setup a Kanban Board for it, but we recommend that you go with Kanban Software Development — this will reduce the amount of setup work you'll have to do and provide the board out of the box.
+The specific type of project you choose when you create it doesn't matter, as long as you can setup a Kanban Board for it, but we recommend that you go with Kanban Software Development. This will reduce the amount of setup work you'll have to do and provide the board out of the box.
 
 You'll need the project key for the Teleport plugin settings later on. It's usually a 3 character code for the project.
 
-#### Setting up Request ID field on Jira
+#### Setting up a request ID field on Jira
 
-Teleport stores the request metadata in a special Jira custom field that must be named teleportAccessRequestId. To create that field, go to Administration -> Issues -> Custom Fields -> Add Custom Field.
+Teleport stores the request metadata in a special Jira custom field that must be named `teleportAccessRequestId`. To create that field, go to Administration -> Issues -> Custom Fields -> Add Custom Field.
 
-Name the field `teleportAccessRequestId`, and choose Text Field (single line) as the field type. Assign the field to your project, or make it global. Teleport Access Request ID is an internal field and it's not supposed to be edited by users, so you can leave the Screens section blank. That means that the field won't show up in Jira UI.
+Name the field `teleportAccessRequestId`, and choose Text Field (single line) as the field type. Assign the field to your project, or make it global. Teleport Access Request ID is an internal field and it's not supposed to be edited by users, so you can leave the Screens section blank. That means that the field won't show up in Jira's UI.
 
 Go to Project Settings -> Fields and make sure that the `teleportAccessRequestId` field shows up on the list of fields available in this project.
 
 #### Setting up the status board
 
-The default Jira Software workflow has a different board setup from what Teleport needs, so we'll setup another workflow and assign that workflow to the project board.
+The default Jira Software workflow has a different board setup than what Teleport needs, so we'll set up another workflow and assign that workflow to the project board.
 
-Go to Administration -> Workflows. You can choose to add a new workflow (recommended), or edit the existing workflow, it'll be called Software Simplified Workflow for Project NAME by default. It's only used in your single project, so it's safe to edit it.
+Go to Administration -> Workflows. You can choose to add a new workflow (recommended), or edit the existing workflow. It will be called Software Simplified Workflow for Project NAME by default. It's only used in your single project, so it's safe to edit it.
 
 Edit the workflow to have these three states:
 
 1. Pending
 2. Approved
 3. Denied
-   The rules of the workflow must meet these requirements:
+
+The rules of the workflow must meet these requirements:
 
 - New created issues should be in Pending state.
 - It should be possible to move from Pending to Approved
 - It should be possible to move from Pending to Declined.
 - You can choose to make the workflow strict and restrict moving requests from Approved state to Declined state and vice versa, or leave that flexible. Teleport will only change the request status once, i.e. the first time the request is approved or denied on your Jira board.
 
-With Workflow editor you can setup who can approve or deny the request based on their Jira user permissions. We won't cover that in this guide as it mostly relates to Jira settings. By default Teleport will allow anyone who can use the workflow to approve or deny the request.
+With the Jira workflow editor, you can set up who can approve or deny an access reuqest based on their Jira user permissions. We won't cover that in this guide as it mostly relates to Jira settings. By default Teleport will allow anyone who can use the workflow to approve or deny the request.
 
-Go to your Project Settings -> Workflows, and make sure that your workflow that you just created or edited is applied to the project you'll use for Teleport integration.
+Go to your Project Settings -> Workflows, and make sure that the workflow that you just created or edited is applied to the project you'll use for Teleport integration.
 
 ### Setting up the webhook
 
-Teleport Jira Plugin will listen for a webhook that Jira Server sends when a request is approved or denied. Go to Settings -> System -> Webhooks to setup the webhook. The webhook needs to be sent when issues are updated or deleted.
+Teleport Jira Plugin will listen for a webhook that Jira Server sends when a request is approved or denied. Go to Settings -> System -> Webhooks to set up the webhook. The webhook needs to be sent when issues are updated or deleted.
 
-#### Configuring the Teleport Jira Plugin for Jira Server
 
 ## Installing
 
-We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
+We recommend installing Teleport plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
-and Teleport Auth access.  We currently only provide linux-amd64 binaries, you can also
+and Teleport Auth access. We currently only provide linux-amd64 binaries, you can also
 compile these plugins from [source](https://github.com/gravitational/teleport-plugins/tree/master/access/jira).
 
 ```code
@@ -153,9 +108,10 @@ $ which teleport-jira
 # /usr/local/bin/teleport-jira
 ```
 
-Run `sudo ./install` in from 'teleport-jira' or place the executable in the appropriate `/usr/bin` or `/usr/local/bin` on the server installation.
+Run `sudo ./install` from 'teleport-jira' or place the executable in the appropriate `/usr/bin` or `/usr/local/bin` on the server installation.
 
-### Configuration file
+
+## Configuration file
 
 Teleport Jira Plugin uses a config file in TOML format. Generate a boilerplate config by
 running the following command:
@@ -165,22 +121,31 @@ $ teleport-jira configure > teleport-jira.toml
 $ sudo mv teleport-jira.toml /etc
 ```
 
-By default, Jira Teleport Plugin will use a config in `/etc/teleport-jira.toml`, and you can override it with `-c config/file/path.toml` flag.
+By default, the Jira Teleport plugin will use a config in `/etc/teleport-jira.toml`, and you can override it with `-c config/file/path.toml` flag.
 
+<Tabs>
+<TabItem label="Self-Hosted" scope={["oss", "enterprise"]}>
+```toml
+(!examples/resources/plugins/teleport-jira-self-hosted.toml!)
+```
+</TabItem>
+<TabItem label="Cloud" scope={["cloud"]}>
 ```toml
-(!examples/resources/plugins/teleport-jira.toml!)
+(!examples/resources/plugins/teleport-jira-cloud.toml!)
 ```
+</TabItem>
+</Tabs>
 
-The `[teleport]` section describes where is the teleport service running, and what keys should the plugin use to authenticate itself. Use the keys that you've generated [above in exporting your Certificate section](#export-access-plugin-certificate).
+The `[teleport]` section describes where the Teleport service is running, and what keys the plugin should use to authenticate itself. Use the keys that you've generated [above](#export-access-plugin-certificate).
 
 The `[jira]` section requires a few things:
 
-1. Your Jira Cloud or Jira Server URL. For Jira Cloud, it looks something like yourcompany.atlassian.net.
+1. Your Jira Cloud or Jira Server URL. For Jira Cloud, it looks something like `yourcompany.atlassian.net`.
 2. Your username on Jira, i.e. benarent **Note: Not your email address.**
-3. Your Jira API token. **For Jira Server, this is a password.  it's a good idea to create a separate user record with permissions limited to accessing this particular project board, and use this with the bot.**
+3. Your Jira API token. **For Jira Server, this is a password. It's a good idea to create a separate user record with permissions limited to accessing this particular project board, and use this with the bot.**
 4. And the Jira Project key, available in Project settings.
 
-`[http]` setting block describes how the Plugin's HTTP server works. The HTTP server is responsible for listening for updates from Jira, and processing updates, like when someone drags a task from Inbox to Approved column.
+The `[http]` setting block describes how the Plugin's HTTP server works. The HTTP server is responsible for listening for updates from Jira, and processing updates, like when someone drags a task from Inbox to Approved column.
 
 You must provide an address the server should listen on, and a certificate to use, unless you plan on running with `--insecure-no-tls`, which we don't recommend in production.
 
@@ -201,7 +166,7 @@ $ teleport-jira start
 # DEBU   Watcher connected access/service_job.go:62
 ```
 
-The log output should look familiar to what Teleport service logs. You should see that it connected to Teleport, and is listening for new Teleport requests and Jira webhooks.
+The log output should look familiar to what the Teleport service logs. You should see that it connected to Teleport and is listening for new Teleport requests and Jira webhooks.
 
 Go ahead and test it:
 
@@ -211,10 +176,10 @@ $ tsh login --request-roles=admin
 
 That should create a new permission request on Teleport (you can test if it did with `tctl request ls` ), and you should see a new task on your Jira project board.
 
-### Setup with SystemD
+### Set up systemd
 
-In production, we recommend starting teleport plugin daemon via an init system like systemd .
-Here's the recommended Teleport Plugin service unit file for systemd:
+In production, we recommend starting the Teleport plugin daemon via an init system like systemd.
+Here's the recommended Teleport plugin service unit file for systemd:
 
 ```ini
 (!examples/systemd/plugins/teleport-jira.service!)
@@ -222,7 +187,7 @@ Here's the recommended Teleport Plugin service unit file for systemd:
 
 Save this as `teleport-jira.service`.
 
-## Audit Log
+## Audit log
 
 The plugin will let anyone with access to the Jira board approve or deny requests, so it's important to review Teleport's audit log.
 
diff --git a/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx b/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx
index cc2ceff979154..48439b8c0f9f6 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx
@@ -4,11 +4,9 @@ description: This guide explains how to setup a Mattermost plugin for Teleport f
 h1: Teleport Mattermost Plugin Setup
 ---
 
-This guide will talk through how to setup Teleport with Mattermost. Teleport to
-Mattermost integration allows teams to approve or deny Teleport access requests
-using [Mattermost](https://mattermost.com/) an open source messaging platform.
+This guide will explain how to set up Teleport with Mattermost, an open source messaging platform. Teleport's Mattermost integration allows teams to approve or deny Teleport Access Requests using Mattermost.
 
-#### Example Mattermost Request
+#### Example Mattermost request
 
 <video controls>
   <source
@@ -32,14 +30,17 @@ This guide assumes that you have:
 
 - A running Teleport Cluster
 - Admin privileges with access to `tctl`
-- Mattermost account with admin privileges. This plugin has been tested with Mattermost 5.x
+- A Mattermost account with admin privileges. This plugin has been tested with Mattermost 5.x
 
-#### Setting up Mattermost to work with the bot
+Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
+
+
+### Setting up Mattermost to work with the bot
 
 ![Enable Mattermost bots](../../../img/enterprise/plugins/mattermost/mattermost_admin_console_integrations_bot_accounts.png)
 
 In Mattermost, go to System Console → Integrations → Enable Bot Account Creation → Set to True.
-This will allow us to create a new bot account that the Teleport bot will use.
+This will allow you to create a new bot account that the Teleport bot will use.
 
 Go back to your team, then Integrations → Bot Accounts → Add Bot Account.
 
@@ -49,7 +50,7 @@ The new bot account will need Post All permission.
 
 ![Enable Mattermost Bots](../../../img/enterprise/plugins/mattermost/mattermost_bot.png)
 
-##### Create an OAuth 2.0 Application
+### Create an OAuth 2.0 application
 
 In Mattermost, go to System Console → Integrations → OAuth 2.0 Applications.
 
@@ -60,64 +61,19 @@ In Mattermost, go to System Console → Integrations → OAuth 2.0 Applications.
 The confirmation screen after you've created the bot will give you the access token.
 We'll use this in the config later.
 
-#### Create User and Role for access
-
-Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
-new user and role that only has API access to the `access_request` API. The below script
-will create a yaml resource file for a new user and role.
-
-```yaml
-# This command will create two Teleport Yaml resources, a new Teleport user and a
-# Role for that users that can only approve / list requests.
-$ cat > rscs.yaml <<EOF
-kind: user
-metadata:
-  name: access-plugin-mattermost
-spec:
-  roles: ['access-plugin-mattermost']
-version: v2
----
-kind: role
-metadata:
-  name: access-plugin-mattermost
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list','read','update']
-    # teleport currently refuses to issue certs for a user with 0 logins,
-    # this restriction may be lifted in future versions.
-    logins: ['access-plugin-mattermost']
-version: v5
-EOF
-
-# Run this to create the user and role in Teleport.
-$ tctl create -f rscs.yaml
-```
-
-#### Export access-plugin Certificate
-
-Teleport Plugin use the `access-plugin-mattermost` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
+### Create User and Role resources for access
+(!docs/pages/includes/plugins/rbac.mdx!)
 
-```code
-$ tctl auth sign --format=tls --user=access-plugin-mattermost --out=auth --ttl=2190h
-# ...
-```
+### Export access-plugin Certificate
+(!docs/pages/includes/plugins/identity-export.mdx!)
 
-The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#configuring-mattermost-bot).
-
-<Admonition
-  type="note"
-  title="Certificate Lifetime"
->
-  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
-</Admonition>
+We'll reference these files later when [configuring the plugins](#configuring-mattermost-bot).
 
 ## Downloading and installing the plugin
 
 We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
-and Teleport Auth access.  We currently only provide linux-amd64 binaries, you can also
+and Teleport Auth access. We currently only provide linux-amd64 binaries, you can also
 compile these plugins from [source](https://github.com/gravitational/teleport-plugins/tree/master/access/mattermost).
 
 ```code
@@ -143,11 +99,20 @@ $ sudo mv teleport-mattermost.toml /etc
 
 Then, edit the config as needed.
 
+<Tabs>
+<TabItem scopes={["oss", "enterprise"]} label="Self-Hosted">
+```yaml
+(!examples/resources/plugins/teleport-mattermost-self.toml!)
+```
+</TabItem>
+<TabItem scopes={["cloud"]} label="Cloud">
 ```yaml
-(!examples/resources/plugins/teleport-mattermost.toml!)
+(!examples/resources/plugins/teleport-mattermost-cloud.toml!)
 ```
+</TabItem>
+</Tabs>
 
-### Testing the Plugin
+### Testing the plugin
 
 With the config above, you should be able to run the bot invoking
 `teleport-mattermost start -d`. The will provide some debug information to make sure
@@ -165,9 +130,9 @@ $ teleport-mattermost start -d
 # DEBU   Mattermost API health check finished ok mattermost/main.go:19
 ```
 
-### Setup with SystemD
+### Set up with SystemD
 
-In production, we recommend starting teleport plugin daemon via an init system like systemd . Here's the recommended Teleport Plugin service unit file for systemd:
+In production, we recommend starting the Teleport plugin daemon via an init system like systemd. Here's the recommended Teleport plugin service unit file for systemd:
 
 ```ini
 (!examples/systemd/plugins/teleport-mattermost.service!)
@@ -175,7 +140,7 @@ In production, we recommend starting teleport plugin daemon via an init system l
 
 Save this as `teleport-mattermost.service`.
 
-## Audit Log
+## Audit log
 
 The plugin will let anyone with access to the Mattermost channel requests so it's
 important to review Teleport's audit log.
diff --git a/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx b/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx
index 824a7ca7913c6..5a9aa8336fbca 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx
@@ -5,11 +5,9 @@ h1: SSH Login Approval using PagerDuty
 videoBanner: RzTB4Lsm09M
 ---
 
-## Teleport PagerDuty Plugin Setup
-
-This guide will talk through how to setup Teleport with PagerDuty. Teleport to
-PagerDuty integration  allows you to treat Teleport access and permission
-requests as PagerDuty incidents — notifying the appropriate team, and approve
+This guide will talk through how to setup Teleport with PagerDuty. Teleport's
+PagerDuty integration allows you to treat Teleport access and permission
+requests as PagerDuty incidents, notify the appropriate team, and approve
 or deny the requests via PagerDuty special action.
 
 ## Setup
@@ -21,76 +19,37 @@ This guide assumes that you have:
 - A running Teleport Cluster
 - Admin privileges with access to `tctl`
 - A PagerDuty account, with access to creating a new API token
-- A node to run the plugin, we recommend running it alongside the Teleport Proxy for convenience
+- A node to run the plugin. We recommend running it alongside the Teleport Proxy for convenience
 
-#### Create User and Role for access
+Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
 
-Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
-new user and role that only has API access to the `access_request` API. The below script
-will create a yaml resource file for a new user and role.
 
-```yaml
-# This command will create two Teleport Yaml resources, a new Teleport user and a
-# Role for that users that can only approve / list requests.
-$ cat > rscs.yaml <<EOF
-kind: user
-metadata:
-  name: access-plugin-pagerduty
-spec:
-  roles: ['access-plugin-pagerduty']
-version: v2
----
-kind: role
-metadata:
-  name: access-plugin-pagerduty
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list','read','update']
-    # teleport currently refuses to issue certs for a user with 0 logins,
-    # this restriction may be lifted in future versions.
-    logins: ['access-plugin-pagerduty']
-version: v5
-EOF
-
-# Run this to create the user and role in Teleport.
-$ tctl create -f rscs.yaml
-```
+### Create a user and role for access
 
-#### Export access-plugin Certificate
+(!docs/pages/includes/plugins/rbac.mdx!)
 
-Teleport Plugin use the `access-plugin-pagerduty` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
+### Export the access-plugin certificate
 
-```code
-$ tctl auth sign --format=tls --user=access-plugin-pagerduty --out=auth --ttl=2190h
-# ...
-```
+(!docs/pages/includes/plugins/identity-export.mdx!)
 
-The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#editing-the-config-file).
+We'll reference these files later when [configuring the plugins](#config-file).
 
-<Admonition
-  type="note"
-  title="Certificate Lifetime"
->
-  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
-</Admonition>
 
-### Setting up PagerDuty API key
+### Setting up a PagerDuty API key
 
 In your PagerDuty dashboard, go to **Configuration → API Access → Create New API Key**, add a key description, and save the key. We'll use the key in the plugin config file later.
 
-**Create PagerDuty API Key**
+**Create a PagerDuty API key**
 ![Create a service account](../../../img/enterprise/plugins/pagerduty/pagerduty-api-key.png)
 
-**Create Service Account**
+**Create a service account**
 ![Create a service account](../../../img/enterprise/plugins/pagerduty/create-new-service-pd.png)
 
 ## Downloading and installing the plugin
 
-We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
+We recommend installing Teleport plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
-and Teleport Auth access.  We currently only provide linux-amd64 binaries, you can also
+and Teleport Auth access. We currently only provide linux-amd64 binaries, you can also
 compile these plugins from [source](https://github.com/gravitational/teleport-plugins/tree/master/access/pagerduty).
 
 ```bash
@@ -106,7 +65,7 @@ Run `./install` in from 'teleport-pagerduty' or place the executable in the appr
 
 ### Config file
 
-Teleport PagerDuty plugin has its own configuration file in TOML format. Before starting the plugin for the first time, you'll need to generate and edit that config file.
+Teleport's PagerDuty plugin has its own configuration file in TOML format. Before starting the plugin for the first time, you'll need to generate and edit that config file.
 
 ```code
 $ teleport-pagerduty configure > teleport-pagerduty.toml
@@ -117,12 +76,20 @@ $ sudo mv teleport-pagerduty.toml /etc
 
 After generating the config, edit it as follows:
 
-```toml
-# Example PagerDuty config file
-(!examples/resources/plugins/teleport-pagerduty.toml!)
+<Tabs>
+<TabItem scopes={["oss", "enterprise"]} label="Self-Hosted">
+```yaml
+(!examples/resources/plugins/teleport-pagerduty-self.toml!)
+```
+</TabItem>
+<TabItem scopes={["cloud"]} label="Cloud">
+```yaml
+(!examples/resources/plugins/teleport-pagerduty-cloud.toml!)
 ```
+</TabItem>
+</Tabs>
 
-### Testing the Plugin
+### Testing the plugin
 
 With the config above, you should be able to run the plugin invoking
 `teleport-pagerduty start -d`. The will provide some debug information to make sure
@@ -143,9 +110,9 @@ $ teleport-pagerduty start -d
 
 By default, `teleport-pagerduty` will assume its config is in `/etc/teleport-pagerduty.toml`, but you can override it with `--config` option.
 
-### Setup with SystemD
+### Set up systemd
 
-In production, we recommend starting teleport plugin daemon via an init system like systemd . Here's the recommended Teleport Plugin service unit file for systemd:
+In production, we recommend starting the Teleport plugin daemon via an init system like systemd. Here's the recommended Teleport plugin service unit file for systemd:
 
 ```bash
 (!examples/systemd/plugins/teleport-pagerduty.service!)
@@ -153,7 +120,7 @@ In production, we recommend starting teleport plugin daemon via an init system l
 
 Save this as `teleport-pagerduty.service`.
 
-#### Example PagerDuty Request
+#### Example PagerDuty request
 
 <video controls>
   <source
@@ -169,10 +136,10 @@ Save this as `teleport-pagerduty.service`.
   Your browser does not support the video tag.
 </video>
 
-## On-call Auto Approval
+## On-call auto-approval
 
 The PagerDuty plugin has an option to auto-approve access requests. This
-feature will map external SSO identity to PagerDuty on call email addresses.
+feature will map an external SSO identity to a PagerDuty on-call email address.
 If the user requesting matches the person on call the request will be
 automatically approved.
 
@@ -188,7 +155,7 @@ service_id = "PIJ90N7"        # PagerDuty service id
 auto_approve = true           # Auto approve
 ```
 
-## Audit Log
+## Audit log
 
 The plugin will let anyone with access to the PagerDuty account so it's
 important to review Teleport's audit log.
diff --git a/docs/pages/enterprise/workflow/ssh-approval-slack.mdx b/docs/pages/enterprise/workflow/ssh-approval-slack.mdx
index 14e3e90e21fb3..0b17ea53f6d14 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-slack.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-slack.mdx
@@ -1,10 +1,10 @@
 ---
-title: Teleport integration with Slack
+title: Teleport's integration with Slack
 description: This guide explains how to setup a Slack plugin for Teleport for privilege elevation approvals.
 h1: Teleport Slack Plugin Setup
 ---
 
-This guide will talk through how to setup Teleport with Slack. Teleport to Slack integration notifies individuals and channels of Access Requests.
+This guide will talk through how to set up Teleport with Slack. Teleport's Slack integration notifies individuals and channels of Access Requests.
 
 #### Example Slack Request
 
@@ -30,126 +30,31 @@ This guide assumes that you have:
 
 - A running Teleport Cluster
 - Admin privileges with access to `tctl`
-- Slack Admin Privileges to create an app and install it to your workspace.
+- Slack admin privileges to create an app and install it to your workspace
 
-Teleport Cloud requires connecting through the proxy service (`mytenant.teleport.sh:443`).
-If you want the Slack plugin to connect through the web port (`teleport.example.com:443`) follow the Teleport Cloud instructions.
-OpenSource and Enterprise installations can connect to the auth service (`auth.example.com:3025`) directly.
+Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
 
-#### Create User and Role for access
+### Create a user and role for access
 
-<Tabs>
-  <TabItem label="OpenSource, Enterprise" scope={["oss","enterprise"]}>
-Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
-new user and role that only has API access to the `access_request` API. The below script
-will create a yaml resource file for a new user and role.
-</TabItem>
-  <TabItem label="Cloud" scope={["cloud"]}>
-
-The Teleport Cloud requires authenticating with a role that has [`impersonation`](https://goteleport.com/docs/access-controls/guides/impersonation/) rights and can create the `access-plugin` role and user.
-Login in with `tsh` with a user that has this role or has a role with these allows.
-```
-kind: role
-version: v5
-metadata:
-  name: plugin-admin
-spec:
-  allow:
-    impersonate:
-      roles:
-      - access-plugin
-      users:
-      - access-plugin
-    rules:
-      - resources: ['roles']
-        verbs: ['create','update','read','list','delete']
-      - resources: ['user']
-        verbs: ['create','update','read','list','delete']
-
-```
-  </TabItem>
-
-</Tabs>
+(!docs/pages/includes/plugins/rbac.mdx!)
 
+### Export the access-plugin certificate
 
-Create a non-interactive bot `access-plugin` user and role.
+(!docs/pages/includes/plugins/identity-export.mdx!)
 
-```yaml
-kind: user
-metadata:
-  name: access-plugin
-spec:
-  roles: ['access-plugin']
-version: v2
----
-kind: role
-version: v5
-metadata:
-  name: access-plugin
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list', 'read']
-      - resources: ['access_plugin_data']
-        verbs: ['update']
-```
-
-Here and below follow along and create yaml resources using `tctl create -f`:
-
-```
-$ tctl create -f access.yaml
-```
-
-<Admonition type="tip">
-  If you're using other plugins, you might want to create different users and roles for different plugins
-</Admonition>
+We'll reference these files later when [configuring the plugins](#configuring-the-teleport-slack-plugin).
 
-#### Export access-plugin Certificate
+### Create a Slack app
 
-Teleport Plugin use the `access-plugin` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign). You have the option of connecting through the proxy or auth server.  Teleport Cloud must use the proxy server.
-
-<Tabs>
-  <TabItem label="OpenSource, Enterprise" scope={["oss","enterprise"]}>
-```code
-$ tctl auth sign --format=tls --user=access-plugin --out=auth --ttl=2190h
-# ...
-```
-
-The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#configuring-teleport-slack).
-</TabItem>
-  <TabItem label="Cloud" scope={["cloud"]}>
-```code
-$ tctl auth sign --user=access-plugin --out=auth.pem --ttl=2190h
-# ...
-```
-
-The above sequence should result in one PEM encoded file being generated: auth.pem.  We'll reference the auth.pem file later when [configuring the plugins](#configuring-teleport-slack).
-
-  </TabItem>
-
-</Tabs>
-
-
-
-<Admonition
-  type="note"
-  title="Certificate Lifetime"
->
-  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
-</Admonition>
-
-### Create Slack App
-
-We'll create a new Slack app and setup auth tokens and callback URLs, so that Slack knows how to notify the Teleport plugin when Approve / Deny buttons are clicked.
+We'll create a new Slack app and set up auth tokens and callback URLs, so that Slack knows how to notify the Teleport plugin when Approve / Deny buttons are clicked.
 
 You'll need to:
 
 1. Create a new app, pick a name and select a workspace it belongs to.
-2. Add OAuth Scopes. This is required by Slack for the app to be installed — we'll only need a single scope to post messages to your Slack account.
-3. Obtain OAuth token
+2. Add an OAuth Scope, which is required by Slack for the app to be installed.
+3. Obtain an OAuth token.
 
-#### Creating a New Slack app
+#### Creating a new Slack app
 
 Visit [https://api.slack.com/apps](https://api.slack.com/apps) to create a new Slack App.
 
@@ -159,24 +64,24 @@ Visit [https://api.slack.com/apps](https://api.slack.com/apps) to create a new S
 
 ![Create Slack App](../../../img/enterprise/plugins/slack/Create-a-Slack-App.png)
 
-#### Selecting OAuth Scopes
+#### Selecting OAuth scopes
 
 On the App screen, go to “OAuth and Permissions” under Features in the sidebar menu. Then scroll to Scopes, and add `chat:write, incoming-webhook, users:read, users:read.email` scopes so that our plugin can post messages to your Slack channels.
 
 ![API Scopes](../../../img/enterprise/plugins/slack/api-scopes.png)
 
-#### Obtain OAuth Token
+#### Obtain an OAuth token
 
 ![OAuth Tokens](../../../img/enterprise/plugins/slack/OAuth.png)
 
-#### Add to Workspace
+#### Add to workspace
 
 ![OAuth Tokens](../../../img/enterprise/plugins/slack/Slackbot-Permissions.png)
 After adding to the workspace, you still need to invite the bot to the channel. Do this by using the @ command,
 and inviting them to the channel.
 ![Invite bot to channel](../../../img/enterprise/plugins/slack/invite-user-to-team.png)
 
-## Installing the Teleport Slack Plugin
+## Installing the Teleport Slack plugin
 
 We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
@@ -207,9 +112,9 @@ compile these plugins from [source](https://github.com/gravitational/teleport-pl
 </Tabs>
 
 
-Run `./install` in from `teleport-slack` or place the executable in the appropriate `/usr/bin` or `/usr/local/bin` on the server installation.
+Run `./install` from `teleport-slack` or place the executable in the appropriate `/usr/bin` or `/usr/local/bin` on the server installation.
 
-### Configuring Teleport Slack
+### Configuring the Teleport Slack plugin
 
 Teleport Slack uses a config file in TOML format. Generate a boilerplate config by
 running the following command:
@@ -219,17 +124,11 @@ $ teleport-slack configure > teleport-slack.toml
 $ sudo mv teleport-slack.toml /etc
 ```
 
-Then, edit the config as needed.
-
-```yaml
-(!examples/resources/plugins/teleport-slack-configure.toml!)
-```
-
 #### Editing the config file
 
-In the Teleport section, use the certificates you've generated with `tctl auth sign` before. The plugin installer creates a folder for those certificates in `/var/lib/teleport/plugins/slack/` — so just move the certificates there and make sure the config points to them.
+In the Teleport section, use the identity file(s) you generated with `tctl auth sign`. The plugin installer creates a folder for those files in `/var/lib/teleport/plugins/slack/`. 
 
-In Slack section, use the OAuth token, signing token, setup the desired channel name.
+Move the certificates to this folder, then edit the configuration file (`teleport-slack.toml`) based on the reference below to ensure that the appropriate settings point to your identity file(s). 
 
 <Tabs>
   <TabItem label="OpenSource, Enterprise" scope={["oss","enterprise"]}>
@@ -246,7 +145,7 @@ In Slack section, use the OAuth token, signing token, setup the desired channel
 </TabItem>
 </Tabs>
 
-## Test Run
+## Test run
 
 Assuming that Teleport is running, and you've created the Slack app, the plugin config,
 and provided all the certificates — you can now run the plugin and test the workflow!
@@ -289,7 +188,7 @@ The messages should automatically get updated to reflect the action you just cli
 $ tctl request ls
 ```
 
-### TSH User Login and Request Role
+### Log in and request a role
 
 You can also test the full workflow from the user's perspective using `tsh`:
 
@@ -300,10 +199,10 @@ Seeking request approval... (id: 8f77d2d1-2bbf-4031-a300-58926237a807)
 
 You should now see a new request in Teleport, and a message about the request on Slack with instructions.
 
-### Setup with SystemD
+### Set up systemd
 
-In production, we recommend starting teleport plugin daemon via an init system like systemd .
-Here's the recommended Teleport Plugin service unit file for systemd:
+In production, we recommend starting the Teleport plugin daemon via an init system like systemd.
+Here's the recommended Teleport plugin service unit file for systemd:
 
 ```ini
 (!examples/systemd/plugins/teleport-slack.service!)
@@ -311,7 +210,7 @@ Here's the recommended Teleport Plugin service unit file for systemd:
 
 Save this as `teleport-slack.service`.
 
-## Audit Log
+## Audit log
 
 The plugin will let anyone with access to the Slack Channel so it's
 important to review Teleport' audit log.
diff --git a/docs/pages/faq.mdx b/docs/pages/faq.mdx
index 3f5e846b010df..482052284e516 100644
--- a/docs/pages/faq.mdx
+++ b/docs/pages/faq.mdx
@@ -35,7 +35,7 @@ section of the Admin Manual.
 
 This was a popular customer [request](https://github.com/gravitational/teleport/issues/803) that was added in Teleport version 4.0.
 Once you've upgraded your Teleport Cluster, change the node config option `--auth-server` to point to web proxy address (this would be `public_addr` and `web_listen_addr`
-in file configuration). As defined in [Adding a node located behind NAT - Teleport Node Tunneling](./setup/admin/adding-nodes.mdx#adding-a-node-located-behind-nat)
+in file configuration). For more information, see [Adding Nodes to the Cluster](./setup/admin/adding-nodes.mdx).
 
 ### Can nodes use a single port for reverse tunnels?
 
diff --git a/docs/pages/getting-started/docker-compose.mdx b/docs/pages/getting-started/docker-compose.mdx
index 433dd6189a1af..9f11da2ba215f 100644
--- a/docs/pages/getting-started/docker-compose.mdx
+++ b/docs/pages/getting-started/docker-compose.mdx
@@ -4,10 +4,8 @@ description: How to get started with Teleport Open Source Edition using Docker C
 h1: Get started with Docker Compose
 ---
 
-This section will cover:
-
-- Getting started with a local Teleport cluster using docker compose.
-- Using Teleport with OpenSSH, ansible and Teleport's native client, `tsh`.
+This guide will help you understand how Teleport works by spinning up a demo cluster on your local machine using Docker Compose.
+It will also show you how to use Teleport with OpenSSH, Ansible, and Teleport's native client, `tsh`. 
 
 ## Prerequisites
 
diff --git a/docs/pages/getting-started/linux-server.mdx b/docs/pages/getting-started/linux-server.mdx
index f6a450cbd9872..a8f598e171d18 100644
--- a/docs/pages/getting-started/linux-server.mdx
+++ b/docs/pages/getting-started/linux-server.mdx
@@ -7,6 +7,14 @@ videoBanner: jvaCmQyHghY
 This tutorial will guide you through the steps needed to install and run
 Teleport (=teleport.version=) on Linux machines.
 
+<Details scopeOnly={true} scope={["cloud"]} title="Teleport Cloud">
+This guide deploys the Teleport Auth Service and Proxy Service, which are fully managed in Teleport Cloud. If you are a Teleport Cloud customer, we recommend following our guides for deploying specific services on your Teleport Nodes. Here are some examples:
+
+- [Application Access](../application-access/getting-started.mdx)
+- [Database Access](../database-access/getting-started.mdx)
+- [Server Access](../server-access/getting-started.mdx)
+</Details>
+
 ## Prerequisites
 
 - A Linux machine with a port `443` open
@@ -29,38 +37,21 @@ Take a look at the [Installation Guide](../installation.mdx) for more options.
 (!docs/pages/includes/permission-warning.mdx!)
 
 ### Configure DNS
+Teleport uses TLS to provide secure access to its Proxy Service and Auth Service, and this requires a domain name that clients can use to verify Teleport's certificate.
 
-Teleport uses TLS to provide secure access to its Proxy Service and Auth Service, and this requires a domain name that clients can use to verify Teleport's certificate. To get started, set up two `A` records for `tele.example.com` and `*.tele.example.com` pointing to the IP/FQDN of the machine with Teleport installed.
-
-<Admonition
-  type="tip"
-  title="Tip"
->
-  You can use `dig` to make sure that DNS records are propagated:
-
-  ```code
-  $ dig @$DNS_SERVER_ADDRESS tele.example.com
-  ```
-</Admonition>
+(!docs/pages/includes/dns.mdx!)
 
 ### Configure Teleport
 
-Next, generate a configuration file for Teleport using the `teleport configure` command. This command requires information about a TLS certificate and private key. If your environment allows your Teleport Auth Server to be reachable via the public internet, we recommend using Let's Encrypt to generate your key and certificate automatically. Otherwise, you can use a key and certificate provided via your organization's internal public key infrastructure.
+Generate a configuration file for Teleport using the `teleport configure` command.
+This command requires information about a TLS certificate and private key.
+
+If you are running Teleport on the internet, we recommend using Let's Encrypt to receive your key and certificate automatically.
+For private net or custom deployments, use your own private key and certificate.
 
 <Tabs>
   <TabItem label="Public internet deployment with Let's Encrypt">
-  Teleport uses the ACME protocol to request automatic TLS certificates from Let's Encrypt, which accesses an HTTP endpoint on your Teleport host in order to complete authentication challenges.
-
-  Use the following command to configure Teleport:
-
-  ```code
-  $ sudo teleport configure --acme --acme-email=your-email@example.com --cluster-name=tele.example.com -o file
-  # Wrote config to file "/etc/teleport.yaml". Now you can start the server. Happy Teleporting!
-  ```
-
-  The `--acme-email` flag indicates an email address that Let's Encrypt can use for notifications, and does *not* require the same domain name as your Teleport host. 
-  
-  For the `--cluster-name` flag, enter the domain name you used when creating a DNS A record earlier.
+  (!docs/pages/includes/acme.mdx!)
 
   </TabItem>
 
@@ -196,7 +187,7 @@ Here are several common commands and operations you'll likely find useful:
 $ tsh status
 ```
 
-### SSH into a node
+### SSH into a Node
 
 ```code
 # list all SSH servers connected to Teleport
@@ -206,7 +197,7 @@ $ tsh ls
 $ tsh ssh root@node-name
 ```
 
-### Add a node to the cluster
+### Add a Node to the cluster
 
 Generate a short-lived dynamic join token using `tctl`:
 
@@ -214,7 +205,7 @@ Generate a short-lived dynamic join token using `tctl`:
 $ tctl tokens add --type=node
 ```
 
-Bootstrap a new node:
+Bootstrap a new Node:
 
 <Tabs>
   <TabItem label="teleport start">
@@ -277,7 +268,7 @@ Add a new application:
 
 <Tabs>
   <TabItem label="teleport start">
-    Install Teleport on the target node, then start it using a command as shown below.
+    Install Teleport on the target Node, then start it using a command as shown below.
     Review and update `auth-server`, `token`, `app-name`, and `app-uri` before running this command.
 
     ```code
diff --git a/docs/pages/includes/acme.mdx b/docs/pages/includes/acme.mdx
new file mode 100644
index 0000000000000..1f797f8594660
--- /dev/null
+++ b/docs/pages/includes/acme.mdx
@@ -0,0 +1,29 @@
+Let's Encrypt verifies that you control the domain name of your Teleport cluster
+by communicating with the HTTPS server listening on port 443 of your Teleport
+Proxy Service.
+
+You can configure the Teleport Proxy Service to complete the Let's Encrypt
+verification process when it starts up.
+
+Run the following `teleport configure` command, where `tele.example.com` is the
+domain name of your Teleport cluster and `user@example.com` is an email address
+used for notifications (you can use any domain):
+
+```code
+teleport configure --acme --acme-email=user@example.com --cluster-name=tele.example.com > /etc/teleport.yaml
+```
+
+The `--acme`, `--acme-email`, and `--cluster-name` flags will add the following
+settings to your Teleport configuration file:
+
+```yaml
+proxy_service:
+  enabled: "yes"
+  web_listen_addr: :443
+  public_addr: tele.example.com:443
+  acme:
+    enabled: "yes"
+    email: user@example.com
+```
+
+Port 443 on your Teleport Proxy Service host must allow traffic from all sources.
diff --git a/docs/pages/includes/database-access/aws-bootstrap.mdx b/docs/pages/includes/database-access/aws-bootstrap.mdx
new file mode 100644
index 0000000000000..d055f3abc1648
--- /dev/null
+++ b/docs/pages/includes/database-access/aws-bootstrap.mdx
@@ -0,0 +1,47 @@
+Teleport can bootstrap IAM permissions for the Database Service based on its
+configuration using the `teleport db configure bootstrap` command. You can use
+this command in automatic or manual mode:
+- In automatic mode, Teleport will attempt to create appropriate IAM policies
+  and attach them to the specified IAM identity (user or role). This requires
+  IAM permissions to create and attach IAM policies.
+- In manual mode, Teleport will print required IAM policies. You can then create
+  and attach them manually using the AWS management console.
+
+<Admonition type="note" title="AWS credentials">
+  AWS Credentials are only required if you’re running the command in "automatic"
+  mode. The command uses the default credential provider chain to find AWS
+  credentials. See [Specifying Credentials](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials) for more information.
+</Admonition>
+
+<Tabs>
+  <TabItem label="Automatic / IAM User">
+  Use this command to bootstrap the permissions automatically when
+  your Teleport database agent runs as an IAM user (for example, uses an AWS
+  credentials file).
+
+  ```code
+  $ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-user TeleportUser
+  ```
+  </TabItem>
+
+  <TabItem label="Automatic / IAM Role">
+  Use this command to bootstrap the permissions automatically when
+  your Teleport database agent runs as an IAM role (for example, on an EC2
+  instance with an attached IAM role).
+
+  ```code
+  $ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-role TeleportRole
+  ```
+  </TabItem>
+
+  <TabItem label="Manual">
+  Use this command to display required IAM policies which you will then create in your AWS console:
+
+  ```code
+  $ teleport db configure bootstrap -c /etc/teleport.yaml --manual
+  ```
+  </TabItem>
+</Tabs>
+
+See the full `bootstrap` command
+[reference](../../database-access/reference/cli.mdx#teleport-db-configure-bootstrap).
diff --git a/docs/pages/includes/database-access/database-config.yaml b/docs/pages/includes/database-access/database-config.yaml
index 65587c4d0ea53..b913fa2f0d22a 100644
--- a/docs/pages/includes/database-access/database-config.yaml
+++ b/docs/pages/includes/database-access/database-config.yaml
@@ -27,7 +27,7 @@ db_service:
     # Free-form description of the database proxy instance.
     description: "Production database"
 
-    # Database protocol. Can be: "postgres", "mysql", "mongodb", "cockroachdb", "sqlserver".
+    # Database protocol. Can be: "postgres", "mysql", "mongodb", "cockroachdb", "sqlserver", or "redis".
     protocol: "postgres"
 
     # Database connection endpoint. Must be reachable from Database Service.
diff --git a/docs/pages/includes/database-access/guides-next-steps.mdx b/docs/pages/includes/database-access/guides-next-steps.mdx
index 08a15db2a8e8a..d6c61171bb83b 100644
--- a/docs/pages/includes/database-access/guides-next-steps.mdx
+++ b/docs/pages/includes/database-access/guides-next-steps.mdx
@@ -1,3 +1,4 @@
 - Learn how to [restrict access](../../database-access/rbac.mdx) to certain users and databases.
 - View [High Availability (HA)](../../database-access/guides/ha.mdx) guide.
 - Take a look at YAML configuration [reference](../../database-access/reference/configuration.mdx).
+- See the full CLI [reference](../../database-access/reference/cli.mdx).
diff --git a/docs/pages/includes/database-access/guides.mdx b/docs/pages/includes/database-access/guides.mdx
index cdb6296b8bec5..f864801411333 100644
--- a/docs/pages/includes/database-access/guides.mdx
+++ b/docs/pages/includes/database-access/guides.mdx
@@ -31,6 +31,9 @@
   <Tile icon="database" title="Self-hosted CockroachDB" href="./guides/cockroachdb-self-hosted.mdx">
     Connect self-hosted CockroachDB database.
   </Tile>
+  <Tile icon="database" title="Self-hosted Redis" href="./guides/redis.mdx">
+    Connect self-hosted Redis.
+  </Tile>
   <Tile icon="database" title="Active Directory SQL Server (Preview)" href="./guides/sql-server-ad.mdx">
     Connect Microsoft SQL Server with Active Directory authentication.
   </Tile>
diff --git a/docs/pages/includes/database-access/start-auth-proxy.mdx b/docs/pages/includes/database-access/start-auth-proxy.mdx
index c9492a4a29472..ef35caca0f0bb 100644
--- a/docs/pages/includes/database-access/start-auth-proxy.mdx
+++ b/docs/pages/includes/database-access/start-auth-proxy.mdx
@@ -1,29 +1,41 @@
 <Tabs> 
-<TabItem scope={["oss","enterprise"]} label="Self Hosted">
+<TabItem scope={["oss","enterprise"]} label="Self-Hosted">
+Download the latest version of Teleport for your platform from our
+[downloads page](https://goteleport.com/teleport/download) and follow the
+installation [instructions](../../installation.mdx).
+
 Teleport requires a valid TLS certificate to operate and can fetch one
 automatically using Let's Encrypt's ACME protocol. Before Let's Encrypt can
 issue a TLS certificate for the Teleport Proxy host's domain, the ACME protocol
 must verify that an HTTPS server is reachable on port 443 of the host.  
 
-We will assume that you have configured DNS records for `teleport.example.com`
-and `*.teleport.example.com` to point to your Teleport node.
-
-<Admonition type="note" title="Web Proxy Port">
-To support the ACME protocol, Teleport Proxy must listen on port 443, rather
-than the default port 3080.
-</Admonition>
-
-Download the latest version of Teleport for your platform from our
-[downloads page](https://goteleport.com/teleport/download) and follow the
-installation [instructions](../../installation.mdx).
+You can configure the Teleport Proxy service to complete the Let's Encrypt
+verification process when it starts up.
 
-Generate a Teleport configuration file with ACME enabled:
+Run the following `teleport configure` command, where `tele.example.com` is the
+domain name of your Teleport cluster and `user@example.com` is an email address
+used for notifications (you can use any domain):
 
 ```code
-$ teleport configure --cluster-name=teleport.example.com --acme --acme-email=alice@example.com -o file
+teleport configure --acme --acme-email=user@example.com --cluster-name=tele.example.com > /etc/teleport.yaml
 ```
 
-Start the Teleport Auth and Proxy services:
+The `--acme`, `--acme-email`, and `--cluster-name` flags will add the following
+settings to your Teleport configuration file:
+
+```yaml
+proxy_service:
+  enabled: "yes"
+  web_listen_addr: :443
+  public_addr: tele.example.com:443
+  acme:
+    enabled: "yes"
+    email: user@example.com
+```
+
+Port 443 on your Teleport Proxy Service host must allow traffic from all sources.
+
+Next, start the Teleport Auth and Proxy Services:
 
 ```code
 $ sudo teleport start
diff --git a/docs/pages/includes/dns-app-access.mdx b/docs/pages/includes/dns-app-access.mdx
new file mode 100644
index 0000000000000..2e82bf6d8f64b
--- /dev/null
+++ b/docs/pages/includes/dns-app-access.mdx
@@ -0,0 +1,4 @@
+Teleport assigns a subdomain to each application you have configured for Application
+Access (e.g., `grafana.teleport.example.com`), so you will need to ensure that a DNS A record exists for each application-specific subdomain so clients can access your applications via Teleport. 
+
+You should create either a separate DNS A record for each subdomain or a single record with a wildcard subdomain such as `*.teleport.example.com`. This way, your certificate authority (e.g., Let's Encrypt) can issue a certificate for each subdomain, enabling clients to verify your Teleport hosts regardless of the application they are accessing.
diff --git a/docs/pages/includes/dns.mdx b/docs/pages/includes/dns.mdx
new file mode 100644
index 0000000000000..cc2ebd938b822
--- /dev/null
+++ b/docs/pages/includes/dns.mdx
@@ -0,0 +1,59 @@
+Set up two `A` DNS records: `tele.example.com` for all traffic and `*.tele.example.com`
+for web apps using Application Access.
+
+<Details opened={false} title="Why are we using wildcard subdomains for Application Access?">
+(!docs/pages/includes/dns-app-access.mdx!)
+</Details>
+
+<Details title="DNS instructions for cloud providers" opened={false}>
+
+<Tabs>
+    <TabItem label="AWS Route 53">
+    ```code
+    # Tip for finding AWS zone id by the domain name.
+    $ MYZONE_DNS="example.com"
+    $ MYZONE=$(aws route53 list-hosted-zones-by-name --dns-name=${MYZONE_DNS?} | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)
+
+    $ MYDNS="tele.example.com"
+
+    # Create a JSON file changeset for AWS.
+    $ jq -n --arg ip ${MYIP?} --arg dns ${MYDNS?} '{"Comment": "Create records", "Changes": [{"Action": "CREATE","ResourceRecordSet": {"Name": $dns, "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}},{"Action": "CREATE", "ResourceRecordSet": {"Name": ("*." + $dns), "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}}]}' > myrecords.json
+
+    # Review records before applying.
+    $ cat myrecords.json | jq
+    # Apply the records and capture change id
+    $ CHANGEID=$(aws route53 change-resource-record-sets --hosted-zone-id ${MYZONE?} --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')
+
+    # Verify that change has been applied
+    $ aws route53 get-change --id ${CHANGEID?} | jq '.ChangeInfo.Status'
+    # "INSYNC"
+    ```
+  </TabItem>
+  <TabItem label="GCP Cloud DNS">
+    ```code
+    $ MYZONE="myzone"
+    $ MYDNS="tele.example.com"
+
+    $ gcloud dns record-sets transaction start --zone="${MYZONE?}"
+    $ gcloud dns record-sets transaction add ${MYIP?} --name="${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
+    $ gcloud dns record-sets transaction add ${MYIP?} --name="*.${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
+    $ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
+    $ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
+    ```
+  </TabItem>
+
+
+</Tabs>
+
+</Details>
+
+<Admonition
+  type="tip"
+  title="Tip"
+>
+  You can use `dig` to make sure that DNS records are propagated:
+
+  ```code
+  $ dig tele.example.com
+  ```
+</Admonition>
diff --git a/docs/pages/includes/enterprise/oidcauthentication.mdx b/docs/pages/includes/enterprise/oidcauthentication.mdx
new file mode 100644
index 0000000000000..282b8e214d7e5
--- /dev/null
+++ b/docs/pages/includes/enterprise/oidcauthentication.mdx
@@ -0,0 +1,34 @@
+## Enable default OIDC authentication
+
+Configure Teleport to use OIDC authentication as the default instead of the local
+user database. You can use Dynamic Resources for Teleport Cloud as well as self-hosted deployments.
+
+<Tabs>
+  <TabItem label="Static Config (Self-Hosted)">
+ Update `/etc/teleport.yaml` in the `auth_service` section and restart the `teleport` daemon.
+  ```yaml
+  auth_service:
+    authentication:
+      type: oidc
+
+  ```
+  </TabItem>
+  <TabItem scope={["cloud"]} label="Dynamic Resources (All Editions)">
+  Create a file called `cap.yaml`:
+  ```yaml
+  kind: cluster_auth_preference
+  metadata:
+    name: cluster-auth-preference
+  spec:
+    authentication:
+      type: oidc
+  version: v2
+  ```
+
+  Create a resource:
+
+  ```bash
+  $ tctl create -f cap.yaml
+  ```
+  </TabItem>
+</Tabs>
diff --git a/docs/pages/includes/enterprise/samlauthentication.mdx b/docs/pages/includes/enterprise/samlauthentication.mdx
new file mode 100644
index 0000000000000..eef0f8775e3ea
--- /dev/null
+++ b/docs/pages/includes/enterprise/samlauthentication.mdx
@@ -0,0 +1,33 @@
+## Enable default SAML authentication
+
+Configure Teleport to use SAML authentication as the default instead of the local
+user database. You can use Dynamic Resources for Teleport Cloud as well as self-hosted deployments.
+
+<Tabs>
+  <TabItem label="Static Config (Self-Hosted)">
+ Update `/etc/teleport.yaml` in the `auth_service` section and restart the `teleport` daemon.
+  ```yaml
+  auth_service:
+    authentication:
+      type: saml
+  ```
+  </TabItem>
+  <TabItem scope={["cloud"]} label="Dynamic Resources (All Editions)">
+  Create a file called `cap.yaml`:
+  ```yaml
+  kind: cluster_auth_preference
+  metadata:
+    name: cluster-auth-preference
+  spec:
+    authentication:
+      type: saml
+  version: v2
+  ```
+
+  Create a resource:
+
+  ```bash
+  $ tctl create -f cap.yaml
+  ```
+  </TabItem>
+</Tabs>
diff --git a/docs/pages/includes/helm.mdx b/docs/pages/includes/helm.mdx
index 6c103c579d020..aeed999ef7ed8 100644
--- a/docs/pages/includes/helm.mdx
+++ b/docs/pages/includes/helm.mdx
@@ -1,4 +1,4 @@
-Verify that helm and kubernetes are installed and up to date.
+Verify that Helm and Kubernetes are installed and up to date.
 
 ```code
 $ helm version
diff --git a/docs/pages/includes/kubernetes-access/helm-k8s.mdx b/docs/pages/includes/kubernetes-access/helm-k8s.mdx
index 4a46640ed007c..cae613839c75f 100644
--- a/docs/pages/includes/kubernetes-access/helm-k8s.mdx
+++ b/docs/pages/includes/kubernetes-access/helm-k8s.mdx
@@ -1,7 +1,7 @@
 - [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
 - [Helm](https://helm.sh) >= (=helm.version=)
 
-Verify that helm and kubernetes are installed and up to date.
+Verify that Helm and Kubernetes are installed and up to date.
 
 ```code
 $ helm version
diff --git a/docs/pages/includes/plugins/identity-export.mdx b/docs/pages/includes/plugins/identity-export.mdx
new file mode 100644
index 0000000000000..4e4aa5a6035f3
--- /dev/null
+++ b/docs/pages/includes/plugins/identity-export.mdx
@@ -0,0 +1,29 @@
+Teleport's plugins use the `access-plugin` role and user to approve access requests. We export the identity files to this plugin using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
+
+<Tabs>
+  <TabItem label="Self-Hosted" scope={["oss","enterprise"]}>
+```code
+$ tctl auth sign --format=tls --user=access-plugin --out=auth --ttl=2190h
+# ...
+```
+
+The above sequence should result in three PEM encoded files being generated: `auth.crt`, `auth.key`, and `auth.cas` (certificate, private key, and CA certs respectively).
+</TabItem>
+  <TabItem label="Cloud" scope={["cloud"]}>
+```code
+$ tctl auth sign --user=access-plugin --out=auth.pem --ttl=2190h
+# ...
+```
+
+The above sequence should result in one PEM encoded file: `auth.pem`.
+
+  </TabItem>
+
+</Tabs>
+
+<Admonition
+  type="note"
+  title="Certificate Lifetime"
+>
+  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
+</Admonition>
\ No newline at end of file
diff --git a/docs/pages/includes/plugins/rbac.mdx b/docs/pages/includes/plugins/rbac.mdx
new file mode 100644
index 0000000000000..a620900449241
--- /dev/null
+++ b/docs/pages/includes/plugins/rbac.mdx
@@ -0,0 +1,60 @@
+Using an existing Teleport cluster, create the following `user` and `role` resources with the command below, replacing `YAML_PATH` with the path to each resource spec.
+
+```
+$ tctl create -f YAML_PATH.yaml
+```
+
+<Details opened={true} 
+  scopeOnly={true}
+  scope={["cloud"]}
+>
+Teleport Cloud requires authenticating with a role that has [`impersonation`](https://goteleport.com/docs/access-controls/guides/impersonation/) rights and can create the `access-plugin` role and user. Log in with `tsh` with a user that has this role or has a role with these `allow` rules.
+
+```
+kind: role
+version: v4
+metadata:
+  name: plugin-admin
+spec:
+  allow:
+    impersonate:
+      roles:
+      - access-plugin
+      users:
+      - access-plugin
+    rules:
+      - resources: ['roles']
+        verbs: ['create','update','read','list','delete']
+      - resources: ['user']
+        verbs: ['create','update','read','list','delete']
+
+```
+</Details>
+
+
+Create a non-interactive bot `access-plugin` user and role.
+
+```yaml
+kind: user
+metadata:
+  name: access-plugin
+spec:
+  roles: ['access-plugin']
+version: v2
+---
+kind: role
+version: v4
+metadata:
+  name: access-plugin
+spec:
+  allow:
+    rules:
+      - resources: ['access_request']
+        verbs: ['list', 'read']
+      - resources: ['access_plugin_data']
+        verbs: ['update']
+```
+
+<Admonition type="tip">
+  If you're using other plugins, you might want to create different users and roles for different plugins
+</Admonition>
\ No newline at end of file
diff --git a/docs/pages/includes/tctl.mdx b/docs/pages/includes/tctl.mdx
index 8c8453205c755..ba0441b0d38ef 100644
--- a/docs/pages/includes/tctl.mdx
+++ b/docs/pages/includes/tctl.mdx
@@ -1,22 +1,35 @@
-<Details title="Before you begin: verify connectivity" opened={false}>
+<Details 
+title="Make sure you can connect to Teleport" 
+scope={["oss", "enterprise"]} 
+scopeOnly={true}
+opened={true}
+>
 
-Verify that your Teleport client is connected:
+Verify that your Teleport client is connected by running the following on your
+Auth Service host:
 
 ```code
 $ tctl status
-
 # Cluster  tele.example.com
 # Version  (=teleport.version=)
 # CA pin   sha256:sha-hash-here
 ```
+</Details>
+<Details 
+title="Make sure you can connect to Teleport" 
+scope={["cloud"]}
+scopeOnly={true}
+opened={true}
+>
 
-<Notice title="Connecting to the cloud" type="note" scope={["cloud"]}>
-To try this flow in the cloud, login into your cluster using `tsh`, then use `tctl` remotely:
+To connect to Teleport, log in to your cluster using `tsh`, then use `tctl`
+remotely:
 
 ```code
-$ tsh login --proxy=myinstance.teleport.sh
+$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
 $ tctl status
+# Cluster  myinstance.teleport.sh
+# Version  (=teleport.version=)
+# CA pin   sha256:sha-hash-here
 ```
-</Notice>
-
 </Details>
diff --git a/docs/pages/index.mdx b/docs/pages/index.mdx
index e579c391413ab..629dee1ca40ce 100644
--- a/docs/pages/index.mdx
+++ b/docs/pages/index.mdx
@@ -10,7 +10,7 @@ videoBanner: 0HlyGk8dihM
 
 Teleport is a Certificate Authority and an Access Plane for your infrastructure. With Teleport you can:
 
-- Set up Single Sign-On and have one place to access your SSH servers, Kubernetes, Databases, and Web Apps.
+- Set up Single Sign-On and have one place to access your SSH servers, Kubernetes, Databases, Desktops, and Web Apps.
 - Use your favorite programming language to define access policies to your infrastructure.
 - Share and record interactive sessions across all environments.
 
@@ -61,7 +61,7 @@ Teleport is a Certificate Authority and an Access Plane for your infrastructure.
       Replace static keys and passwords with short-lived certificates.
     </TileListItem>
     <TileListItem href="./setup/reference/cli.mdx#tsh-play">
-     Gather structured events and session recording/replay for `ssh` and `kubectl`.
+     Gather structured events and session recording/replay for `ssh`, `kubectl` and desktop interactions.
      </TileListItem>
     <TileListItem href="./access-controls/guides/webauthn.mdx">
      Enforce two-factor auth with WebAuthn or TOTP.
diff --git a/docs/pages/installation.mdx b/docs/pages/installation.mdx
index e8af47936d980..ffb1799e12da0 100644
--- a/docs/pages/installation.mdx
+++ b/docs/pages/installation.mdx
@@ -6,6 +6,11 @@ h1: Installation
 
 Teleport core service [`teleport`](./setup/reference/cli.mdx#teleport) and admin tool [`tctl`](./setup/reference/cli.mdx#tctl) have been designed to run on **Linux** and **Mac** operating systems. The Teleport user client [`tsh`](./setup/reference/cli.mdx#tsh) and UI are available for **Linux, Mac**, and **Windows** operating systems.
 
+<Admonition type="tip" title="First time trying Teleport?">
+If you are new to Teleport, we recommend following our [getting started guides](getting-started.mdx).
+</Admonition>
+
+
 ## Linux
 
 The following examples install the 64-bit version of Teleport binaries, but
@@ -176,3 +181,11 @@ any OS supported by the [Golang toolchain](https://github.com/golang/go/wiki/Min
 
 \[2] *Teleport server does not run on Windows yet, but `tsh` (the Teleport client)
 supports most features on Windows 10 and later.*
+
+## Next steps
+
+Now that you know how to install Teleport, you can enable access to all of your infrastructure. Get started with:
+- [Server Access](server-access/introduction.mdx)
+- [Kubernetes Access](kubernetes-access/introduction.mdx)
+- [Database Access](database-access/introduction.mdx)
+- [Desktop Access](desktop-access/introduction.mdx)
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/controls.mdx b/docs/pages/kubernetes-access/controls.mdx
index e54f38de256d3..25655b2f53a2a 100644
--- a/docs/pages/kubernetes-access/controls.mdx
+++ b/docs/pages/kubernetes-access/controls.mdx
@@ -88,7 +88,7 @@ Enterprise Edition:
 Identity provider admins can assign metadata to a user, such as
 group membership or access permissions. Administrators configure what metadata
 is shared with Teleport. Teleport receives user metadata keys and values as OIDC claims or SAML
-attributes during [signle sign-on redirect flow](https://goteleport.com/blog/how-oidc-authentication-works/):
+attributes during [single sign-on redirect flow](https://goteleport.com/blog/how-oidc-authentication-works/):
 
 ```yaml
 # Alice has an email alice@example.com. Email is a standard OIDC claim.
diff --git a/docs/pages/kubernetes-access/getting-started/agent.mdx b/docs/pages/kubernetes-access/getting-started/agent.mdx
index d517cffbc1c74..f76f99cc6b20f 100644
--- a/docs/pages/kubernetes-access/getting-started/agent.mdx
+++ b/docs/pages/kubernetes-access/getting-started/agent.mdx
@@ -3,35 +3,86 @@ title: Connect a Kubernetes Cluster to Teleport
 description: Connecting a Kubernetes cluster to Teleport
 ---
 
-<Admonition type="notice" title="Editions">
-You can use this guide with Teleport Open Source, Teleport Enterprise, and Teleport Cloud.
-</Admonition>
-
 ## Prerequisites
 
-- Installed and running Teleport cluster, self-hosted or cloud-hosted.
-- Tool `jq` to process `JSON` output.
+<Tabs>
+<TabItem scope={["oss"]} label="Open Source">
+
+- A running Teleport cluster. For details on how to set this up, see one of our
+  [Getting Started](../../getting-started.mdx) guides. 
+
+- The `jq` tool to process `JSON` output. This is available via common package managers.
+
+- The `tctl` admin tool version >= (=teleport.version=).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  See [Installation](../../installation.mdx) for details.
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+
+- A running Teleport cluster. For details on how to set this up, see one of our
+  [Getting Started](../../getting-started.mdx) guides.
+
+- The `jq` tool to process `JSON` output. This is available via common package managers.
+
+- The `tctl` admin tool version >= (=teleport.version=), which you can download
+  by visiting the
+  [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport Enterprise v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+<TabItem scope={["cloud"]}
+  label="Teleport Cloud">
+
+- A Teleport Cloud account. If you do not have one, visit the
+  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+
+- The `jq` tool to process `JSON` output. This is available via common package
+  managers.
+
+- The Enterprise version of the `tctl` admin tool. To download this, visit
+the [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+</Tabs>
 
 
 (!docs/pages/includes/kubernetes-access/helm-k8s.mdx!)
 
 (!docs/pages/includes/tctl.mdx!)
 
-<Admonition type="notice" title="Enable Kubernetes for Self-Hosted">
-For self-hosted Teleport instances the `kube_listen_addr` setting in the `proxy_service` is required to enable Kubernetes Access.  This is already enabled for Cloud and the Teleport `teleport-cluster` helm chart.
-```yaml
-proxy_service:
-  # ...
-  public_addr: proxy.example.com:3080
+## Deployment overview
 
-  kube_listen_addr: 0.0.0.0:3026  
-  ```  
-</Admonition>
+In this guide, we deploy the Teleport Kubernetes Service, which connects
+Kubernetes cluster `cookie` to Teleport cluster `tele.example.com`:
 
-## Deployment overview
+<Notice type="tip" scope={["cloud"]}>
 
-In this guide, we deploy a Teleport agent that connects kubernetes cluster `cookie` to
-Teleport cluster `tele.example.com`:
+In your Teleport Cloud account, the name of your cluster will be your tenant
+domain name, e.g., `mytenant.teleport.sh`, rather than `teleport.example.com`.
+
+</Notice>
 
 <Figure align="left" bordered caption="Kubernetes agent dialing back to Teleport cluster">
   ![Kubernetes agent](../../../img/k8s/agent.svg)
@@ -39,31 +90,58 @@ Teleport cluster `tele.example.com`:
 
 ## Step 1/2. Get a join token
 
-Start a lightweight agent in your Kubernetes cluster `cookie` and connect it to `tele.example.com`.
-We would need a join token from `tele.example.com`:
+In order to start the Teleport Kubernetes Service, we will need to request a
+join token from the Teleport Auth Service:
 
 ```code
-# Create a join token for the cluster cookie to authenticate
+# Create a join token for the Teleport Kubernetes Service to authenticate
 $ TOKEN=$(tctl nodes add --roles=kube --ttl=10000h --format=json | jq -r '.[0]')
 $ echo $TOKEN
 ```
 
 ## Step 2/2. Deploy teleport-kube-agent
 
-Switch `kubectl` to the Kubernetes cluster `cookie` and run:
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+Switch `kubectl` to the Kubernetes cluster `cookie` and run the following
+commands, assigning `PROXY_ADDR` to the address of your Auth Service or Proxy
+Service.
+
+```code
+# Add teleport-agent chart to charts repository
+$ PROXY_ADDR=tele.example.com:443
+$ helm repo add teleport https://charts.releases.teleport.dev
+$ helm repo update
+
+# Install Kubernetes agent. It dials back to the Teleport cluster at $PROXY_ADDR
+$ CLUSTER='cookie'
+$ helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=${CLUSTER?} \
+  --set proxyAddr=${PROXY_ADDR?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
+```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
+
+Switch `kubectl` to the Kubernetes cluster `cookie` and run the following
+commands, assigning `PROXY_ADDR` to the address of your Teleport Cloud tenant.
 
 ```code
 # Add teleport-agent chart to charts repository
+$ PROXY_ADDR=mytenant.teleport.sh
 $ helm repo add teleport https://charts.releases.teleport.dev
 $ helm repo update
 
-# Install Kubernetes agent. It dials back to the Teleport cluster tele.example.com.
+# Install Kubernetes agent. It dials back to the Teleport cluster at $PROXY_ADDR
 $ CLUSTER='cookie'
-$ PROXY='tele.example.com:443 - replace me with your cluster'
 $ helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=${CLUSTER?} \
-  --set proxyAddr=${PROXY?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
+  --set proxyAddr=${PROXY_ADDR?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
 ```
 
+</TabItem>
+</Tabs>
+
 List connected clusters using `tsh kube ls` and switch between
 them using `tsh kube login`:
 
@@ -78,10 +156,10 @@ $ tsh kube ls
 $ tsh kube login cookie
 # Logged into kubernetes cluster "cookie"
 
-# kubectl command executed on `cookie` but is routed through `tele.example.com` cluster.
+# kubectl command executed on `cookie` but is routed through the Teleport cluster.
 $ kubectl get pods
 ```
 
 ## Next Steps
 
-- Take a look at a [kube-agent helm chart reference](../helm/reference.mdx#teleport-kube-agent) for a full list of parameters.
+- Take a look at a [kube-agent helm chart reference](../helm/reference/teleport-kube-agent.mdx) for a full list of parameters.
diff --git a/docs/pages/kubernetes-access/getting-started/cluster.mdx b/docs/pages/kubernetes-access/getting-started/cluster.mdx
index b73d91f7f236d..f75e7e9764118 100644
--- a/docs/pages/kubernetes-access/getting-started/cluster.mdx
+++ b/docs/pages/kubernetes-access/getting-started/cluster.mdx
@@ -66,7 +66,7 @@ Let's start with a single-pod Teleport deployment using a persistent volume as a
     ```
   </TabItem>
 
-  <TabItem label="Enterprise">
+  <TabItem label="Enterprise" scope={["enterprise"]}>
     ```code
     $ CLUSTER_NAME="tele.example.com"
     $ EMAIL="mail@example.com"
@@ -115,7 +115,7 @@ to create a public IP for Teleport.
     ```
   </TabItem>
 
-  <TabItem label="Enterprise">
+  <TabItem label="Enterprise" scope={["enterprise"]}>
     ```code
     # Set kubectl context to the namespace to set some typing
     $ kubectl config set-context --current --namespace=teleport-cluster-ent
@@ -139,45 +139,7 @@ to create a public IP for Teleport.
   </TabItem>
 </Tabs>
 
-Set up two `A` DNS records - `tele.example.com` for UI and `*.tele.example.com`
-for web apps using [application access](../../application-access/introduction.mdx).
-
-<Tabs>
-  <TabItem label="GCP Cloud DNS">
-    ```code
-    $ MYZONE="myzone"
-    $ MYDNS="tele.example.com"
-
-    $ gcloud dns record-sets transaction start --zone="${MYZONE?}"
-    $ gcloud dns record-sets transaction add ${MYIP?} --name="${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
-    $ gcloud dns record-sets transaction add ${MYIP?} --name="*.${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
-    $ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
-    $ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
-    ```
-  </TabItem>
-
-  <TabItem label="AWS Route 53">
-    ```code
-    # Tip for finding AWS zone id by the domain name.
-    $ MYZONE_DNS="example.com"
-    $ MYZONE=$(aws route53 list-hosted-zones-by-name --dns-name=${MYZONE_DNS?} | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)
-
-    $ MYDNS="tele.example.com"
-
-    # Create a JSON file changeset for AWS.
-    $ jq -n --arg ip ${MYIP?} --arg dns ${MYDNS?} '{"Comment": "Create records", "Changes": [{"Action": "CREATE","ResourceRecordSet": {"Name": $dns, "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}},{"Action": "CREATE", "ResourceRecordSet": {"Name": ("*." + $dns), "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}}]}' > myrecords.json
-
-    # Review records before applying.
-    $ cat myrecords.json | jq
-    # Apply the records and capture change id
-    $ CHANGEID=$(aws route53 change-resource-record-sets --hosted-zone-id ${MYZONE?} --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')
-
-    # Verify that change has been applied
-    $ aws route53 get-change --id ${CHANGEID?} | jq '.ChangeInfo.Status'
-    # "INSYNC"
-    ```
-  </TabItem>
-</Tabs>
+(!docs/pages/includes/dns.mdx!)
 
 Use the following command to confirm that Teleport is running:
 
@@ -202,6 +164,8 @@ metadata:
 spec:
   allow:
     kubernetes_groups: ["system:masters"]
+    kubernetes_labels:
+      '*': '*'
 ```
 
 Create the role and add a user:
@@ -237,7 +201,7 @@ For other install options, check out [install guide](../../installation.mdx)
     ```
   </TabItem>
 
-  <TabItem label="Enterprise">
+  <TabItem label="Enterprise" scope={["enterprise"]}>
     ```code
     $ curl -L -O https://get.gravitational.com/teleport-ent-v(=teleport.version=)-linux-amd64-bin.tar.gz
     $ tar -xzf teleport-ent-v(=teleport.version=)-linux-amd64-bin.tar.gz
@@ -306,7 +270,7 @@ In this step, we will set up the GitHub Single Sign-On connector for the OSS ver
     ```
   </TabItem>
 
-  <TabItem label="Enterprise">
+  <TabItem label="Enterprise" scope={["enterprise"]}>
     Follow the [SAML Okta Guide](../../enterprise/sso/okta.mdx#configure-okta) to create a SAML app.
     Check out [OIDC guides](../../enterprise/sso/oidc.mdx#identity-providers) for OpenID Connect apps.
     Save the file below as `okta.yaml` and update the `acs` field.
@@ -341,7 +305,7 @@ To create a connector, we are going to run Teleport's admin tool `tctl` from the
     ```
   </TabItem>
 
-  <TabItem label="Enterprise">
+  <TabItem label="Enterprise"  scope={["enterprise"]}>
     ```code
     # To create an Okta connector, we are going to run Teleport's admin tool tctl from the pod.
     $ POD=$(kubectl get po -l app=teleport-cluster-ent -o jsonpath='{.items[0].metadata.name}')
@@ -362,7 +326,7 @@ the default one in case there is a problem.
     ```
   </TabItem>
 
-  <TabItem label="Enterprise">
+  <TabItem label="Enterprise" scope={["enterprise"]}>
     ```code
     $ KUBECONFIG=${HOME?}/teleport.yaml tsh login --proxy=tele.example.com --auth=okta
     ```
diff --git a/docs/pages/kubernetes-access/guides.mdx b/docs/pages/kubernetes-access/guides.mdx
index 6c47b0cced1db..c28ec8d4ef363 100644
--- a/docs/pages/kubernetes-access/guides.mdx
+++ b/docs/pages/kubernetes-access/guides.mdx
@@ -11,9 +11,6 @@ layout: tocless-doc
   <Tile icon="kubernetes" title="Teleport Kubernetes Access and Trusted Clusters" href="./guides/federation.mdx">
     Federated Access using Teleport Trusted Clusters.
   </Tile>
-  <Tile icon="kubernetes" title="Kubernetes Migration Guide" href="./guides/migration.mdx">
-    Kubernetes Pre-5.0 Teleport Migration Guide.
-  </Tile>
   <Tile icon="kubernetes" title="Kubernetes Access Multiple Clusters" href="./guides/multiple-clusters.mdx">
     Connecting Multiple Clusters with Teleport Kubernetes Access.
   </Tile>
diff --git a/docs/pages/kubernetes-access/guides/federation.mdx b/docs/pages/kubernetes-access/guides/federation.mdx
index f28e5d63019c4..48b7bd010723d 100644
--- a/docs/pages/kubernetes-access/guides/federation.mdx
+++ b/docs/pages/kubernetes-access/guides/federation.mdx
@@ -1,17 +1,18 @@
 ---
-title: Teleport Kubernetes Access and Trusted Clusters
+title: Federated Kubernetes access with Trusted Clusters
 description: Federated Access using Teleport Trusted Clusters.
 ---
 
-## Federated Kubernetes access with Trusted Clusters
-
 There are cases when you have Kubernetes clusters that have to operate independently,
 for example, they are part of a different organization or have intermittent connectivity.
 
 You can take advantage of [Trusted Clusters](../../setup/admin/trustedclusters.mdx)
 to federate trust across Kubernetes clusters.
 
-When multiple trusted clusters are present behind a Teleport proxy, the
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+When multiple Trusted Clusters are present behind the Teleport Proxy Service, the
 `kubeconfig` generated by [tsh login](../../setup/reference/cli.mdx#tsh-login) will contain the
 Kubernetes API endpoint determined by the `<cluster>` argument to [tsh
 login](../../setup/reference/cli.mdx#tsh-login).
@@ -19,10 +20,10 @@ login](../../setup/reference/cli.mdx#tsh-login).
 For example, consider the following setup:
 
 - There are three Teleport/Kubernetes clusters: `main`, `east`, and `west`. These are the names set in `cluster_name` setting in their configuration files.
-- The clusters `east` and `west` are trusted clusters for `main`.
+- The clusters `east` and `west` are Trusted Clusters for `main`.
 - Users always authenticate against `main` but use their certificates to access
-  SSH nodes and Kubernetes API in all three clusters.
-- The DNS name of the main proxy server is `main.example.com`
+  SSH nodes and the Kubernetes API in all three clusters.
+- The DNS name of the main Proxy Service is `main.example.com`.
 
 In this scenario, users usually log in using this command:
 
@@ -39,3 +40,37 @@ $ tsh --proxy=main.example.com login east
 # User's `kubeconfig` now contains the entry for the "east" Kubernetes
 # endpoint, i.e. `east.main.example.com`.
 ```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
+
+When multiple Trusted Clusters are present behind the Teleport Proxy Service, the
+`kubeconfig` generated by [tsh login](../../setup/reference/cli.mdx#tsh-login) will contain the
+Kubernetes API endpoint determined by the `<cluster>` argument to [tsh
+login](../../setup/reference/cli.mdx#tsh-login).
+
+For example, consider the following setup:
+
+- There are two Teleport/Kubernetes clusters, `east` and `west`. These are the names set in `cluster_name` setting in their configuration files.
+- The clusters `east` and `west` are Trusted Clusters for a Teleport Cloud tenant, `mytenant.teleport.sh`.
+- Users always authenticate against `mytenant.teleport.sh` but use their certificates to access
+  SSH nodes and the Kubernetes API in all three clusters.
+
+In this scenario, users usually log in using this command:
+
+```code
+# Using login without arguments
+$ tsh --proxy=mytenant.teleport.sh login
+
+# User's `kubeconfig` now contains one entry for the main Kubernetes
+# endpoint, i.e. `mytenant.teleport.sh`.
+
+# Receive a certificate for "east":
+$ tsh --proxy=mytenant.teleport.sh login east
+
+# User's `kubeconfig` now contains the entry for the "east" Kubernetes
+# endpoint, i.e. `east.mytenant.teleport.sh`.
+```
+
+</TabItem>
+</Tabs>
diff --git a/docs/pages/kubernetes-access/guides/migration.mdx b/docs/pages/kubernetes-access/guides/migration.mdx
deleted file mode 100644
index a0d41459e167f..0000000000000
--- a/docs/pages/kubernetes-access/guides/migration.mdx
+++ /dev/null
@@ -1,392 +0,0 @@
----
-title: Kubernetes 5.0 Migration Guide
-description: How to migrate pre-5.0 Teleport clusters to new configuration.
-h1: Migrating to Teleport Kubernetes Access 5.0
----
-
-In release 5.0, Teleport has changed the [Kubernetes integration](../../kubernetes-access/introduction.mdx) to improve configuration and user experience.
-These changes are backward compatible and there is no *required* migration.
-However, to get the most out of Teleport, you should consider migrating as
-described below.
-
-The main changes in 5.0 are:
-
-- New `kubernetes_service` configuration section in `teleport.yaml`, decoupled
-  from `proxy_service`
-- Support for multiple Kubernetes clusters per Teleport cluster (replaces the
-  need to use [Trusted Clusters](../../setup/admin/trustedclusters.mdx) to achieve this)
-- Role-Based Access Control (RBAC) support for Kubernetes clusters
-
-Important note: `proxy_service` with an open port for Kubernetes requests is
-still required. A proxy is always the public-facing gateway into the Teleport
-cluster, acting as an authentication point and a connection router.
-
-## Example scenarios
-
-We'll describe the migration for several common Teleport configurations.
-
-### Standalone proxy for a single cluster
-
-In this scenario, we're running a Teleport proxy outside of the Kubernetes
-cluster and connecting to it using a `kubeconfig_file`.
-
-Before 5.0:
-
-```yaml
-# teleport.yaml
-proxy_service:
-  kubernetes:
-    enabled: yes
-    listen_addr: 0.0.0.0:3026
-    kubeconfig_file: /path/to/kubeconfig
-```
-
-After 5.0:
-
-```yaml
-# teleport.yaml
-proxy_service:
-  kube_listen_addr: 0.0.0.0:3026
-
-kubernetes_service:
-  enabled: yes
-  listen_addr: 0.0.0.0:3027
-  kubeconfig_file: /path/to/kubeconfig
-```
-
-The `listen_port` for `kubernetes_service` only needs to be exposed to the
-Proxies within your cluster. This port will not be directly used by the
-clients.
-
-### Proxy in a Kubernetes pod of a single cluster
-
-In this scenario, we're running a Teleport proxy inside of the Kubernetes
-cluster and connecting to it using the pod service account credentials.
-
-Before 5.0:
-
-```yaml
-# teleport.yaml
-proxy_service:
-  kubernetes:
-    enabled: yes
-    listen_addr: 0.0.0.0:3026
-```
-
-After 5.0:
-
-```yaml
-# teleport.yaml
-proxy_service:
-  kube_listen_addr: 0.0.0.0:3026
-
-kubernetes_service:
-  enabled: yes
-  listen_addr: 0.0.0.0:3027
-```
-
-### Multiple Kubernetes clusters
-
-In this scenario, we're running multiple Trusted Teleport clusters, one for
-each Kubernetes cluster.
-
-#### Recommend Option 1: Teleport Kubernetes agents in each Kubernetes cluster
-
-This is the recommended approach for handling multiple Kubernetes clusters.
-
-Instead of running multiple Teleport clusters (auth and proxy for each
-Kubernetes cluster), we will connect multiple `kubernetes_service` agents to
-the same root Teleport cluster.
-
-Each `kubernetes_service` will create its own reverse tunnel back to a Teleport
-proxy to join the cluster.
-
-Before 5.0:
-
-```yaml
-# teleport-root.yaml
-auth_service:
-  enabled: yes
-
-proxy_service:
-  kubernetes:
-    enabled: yes
-    public_addr: [root.example.com:3026]
-    listen_addr: 0.0.0.0:3026
-
----
-# teleport-leaf-1.yaml
-auth_service:
-  enabled: yes
-
-proxy_service:
-  kubernetes:
-    enabled: yes
-    public_addr: [leaf-1.example.com:3026]
-    listen_addr: 0.0.0.0:3026
-    # Not specifying kubeconfig_file, we'll assume that this process runs in a
-    # Kubernetes pod
-
----
-# teleport-leaf-2.yaml
-auth_service:
-  enabled: yes
-
-proxy_service:
-  kubernetes:
-    enabled: yes
-    public_addr: [leaf-2.example.com:3026]
-    listen_addr: 0.0.0.0:3026
-    # Not specifying kubeconfig_file, we'll assume that this process runs in a
-    # Kubernetes pod
-```
-
-After 5.0:
-
-```yaml
-# teleport-root.yaml
-auth_service:
-  enabled: yes
-  tokens:
-  # This is a static token, you can also use dynamic join tokens
-  - kube:secret_static_join_token
-
-proxy_service:
-  kube_public_addr: [root.example.com]
-  kube_listen_addr: 0.0.0.0:3026
-
----
-# teleport-kube-1.yaml
-teleport:
-  # Note: auth_servers points at the default proxy listening port.
-  auth_servers: ["https://root.example.com:3080"]
-  auth_token: secret_static_join_token
-
-auth_service:
-  enabled: no
-
-proxy_service:
-  enabled: no
-
-kubernetes_service:
-  enabled: yes
-  kube_cluster_name: kube-1
-  # Not specifying kubeconfig_file, we'll assume that this process runs in a
-  # Kubernetes pod
-
----
-# teleport-kube-2.yaml
-teleport:
-  # Note: auth_servers points at the default proxy listening port.
-  auth_servers: ["https://root.example.com:3080"]
-  auth_token: secret_static_join_token
-
-auth_service:
-  enabled: no
-
-proxy_service:
-  enabled: no
-
-kubernetes_service:
-  enabled: yes
-  kube_cluster_name: kube-2
-  # Not specifying kubeconfig_file, we'll assume that this process runs in a
-  # Kubernetes pod
-```
-
-After all the Teleport agents are running, you can view the list of Kubernetes
-clusters using `tsh kube ls` and switch between them using `tsh kube login <kube_cluster_name>`:
-
-```code
-$ tsh kube ls
-
-# Kube Cluster Name Selected
-# ----------------- --------
-# kube-1            *
-# kube-2
-
-$ tsh kube login kube-2
-# Logged into kubernetes cluster "kube-2"
-```
-
-#### Option 2: One Teleport agent connected to multiple clusters
-
-This approach requires you to manually craft a `kubeconfig` file that contains
-the exact set of Kubernetes cluster entries you wish to connect. Updates to the
-set of clusters require a restart.
-
-Instead of running multiple Teleport clusters (auth and proxy for each
-Kubernetes cluster), we will connect multiple Kubernetes clusters to a single
-`kubernetes_service` using `kubeconfig_file`.
-
-Before 5.0:
-
-```yaml
-# teleport-root.yaml
-auth_service:
-  enabled: yes
-
-proxy_service:
-  kubernetes:
-    enabled: yes
-    public_addr: [root.example.com:3026]
-    listen_addr: 0.0.0.0:3026
-
----
-# teleport-leaf-1.yaml
-auth_service:
-  enabled: yes
-
-proxy_service:
-  kubernetes:
-    enabled: yes
-    public_addr: [leaf-1.example.com:3026]
-    listen_addr: 0.0.0.0:3026
-    kubeconfig_file: kubeconfig-leaf-1.yaml
-
----
-# teleport-leaf-2.yaml
-auth_service:
-  enabled: yes
-
-proxy_service:
-  kubernetes:
-    enabled: yes
-    public_addr: [leaf-2.example.com:3026]
-    listen_addr: 0.0.0.0:3026
-    kubeconfig_file: kubeconfig-leaf-2.yaml
-```
-
-After 5.0:
-
-```yaml
-# teleport.yaml
-proxy_service:
-  kube_public_addr: [root.example.com]
-  kube_listen_addr: 0.0.0.0:3026
-
-kubernetes_service:
-  enabled: yes
-  listen_addr: 0.0.0.0:3027
-  kubeconfig_file: kubeconfig-all.yaml
-
----
-# kubeconfig-all.yaml
-apiVersion: v1
-kind: Config
-clusters:
-- cluster:
-    certificate-authority-data: ...
-    server: https://10.0.0.1
-  name: kube-1-server
-- cluster:
-    certificate-authority-data: ...
-    server: https://10.0.0.2
-  name: kube-2-server
-contexts:
-- context:
-    cluster: kube-1-server
-    user: kube-1-creds
-  name: kube-1
-- context:
-    cluster: kube-2-server
-    user: kube-2-creds
-  name: kube-2
-current-context: kube-1
-users:
-- name: kube-1-creds
-  user:
-    ...cluster-specific credentials...
-- name: kube-2-creds
-  user:
-    ...cluster-specific credentials...
-```
-
-You can view the list of Kubernetes clusters using `tsh kube ls` and switch
-between them using `tsh kube login <kube_cluster_name>`:
-
-```code
-$ tsh kube ls
-
-# Kube Cluster Name Selected
-# ----------------- --------
-# kube-1            *
-# kube-2
-
-$ tsh kube login kube-2
-```
-
-#### Option 3: Keep using Trusted Clusters
-
-You may keep using the Trusted Clusters as before and migrate them internally
-to `kubernetes_service`, as described in the first two scenarios.
-
-Note that `tsh kube ls` will **not** show all Kubernetes clusters across all
-Trusted Clusters. It only shows the Kubernetes clusters from the Teleport
-cluster you are currently logged into.
-
-## RBAC
-
-<Admonition type="note">
-  Kubernetes RBAC integration only works with `kubernetes_service`. Make sure you've migrated all the clusters as described above before proceeding.
-</Admonition>
-
-By default, all users have access to all Kubernetes clusters (as a limited set
-of Kubernetes user/group identities). In 5.0, you can restrict user access to a
-subset of Kubernetes clusters using Kubernetes cluster labels and Teleport
-roles.
-
-This RBAC integration works exactly like the [integration for SSH nodes](../../access-controls/reference.mdx).
-
-First, set the set of Kubernetes labels a user can access on their roles:
-
-```yaml
-# role-admin.yaml
-kind: role
-version: v5
-metadata:
-  name: admin
-spec:
-  allow:
-    logins: ['{{internal.logins}}']
-    # Define the Kubernetes users and groups mapped to users with this role.
-    kubernetes_users: ["{{internal.kubernetes_users}}"]
-    kubernetes_groups: ["some-group", "{{internal.kubernetes_groups}}"]
-
-    # List of kubernetes labels a user will be allowed to connect to:
-    kubernetes_labels:
-      # A user can only connect to clusters marked with 'test' label:
-      'environment': 'test'
-      # The wildcard ('*') means "any cluster"
-      '*': '*'
-      # Labels can be specified as a list:
-      'environment': ['test', 'staging']
-      # Regular expressions are also supported, for example the equivalent
-      # of the list example above can be expressed as:
-      'environment': '^test|staging$'
-  # You can also strictly restrict access using deny kubernetes_labels.
-  deny: {}
-```
-
-Next, define Kubernetes labels on the cluster side:
-
-```yaml
-# teleport.yaml
-kubernetes_service:
-  enabled: yes
-  listen_addr: 0.0.0.0:3027
-  kube_cluster_name: staging
-  # Note: if you use kubeconfig_file, the below labels apply to all Kubernetes
-  # clusters in that kubeconfig. To get different sets of labels, you need to
-  # run separate kubernetes_service instances.
-  labels:
-    environment: staging
-  commands:
-  - name: project
-    command: [fetch-project-name.sh]
-    period: 1h
-```
-
-Users with a role that matches a specific Kubernetes cluster label will be
-able to see and connect to that cluster. Other users will neither see nor
-be able to connect to it.
diff --git a/docs/pages/kubernetes-access/guides/multiple-clusters.mdx b/docs/pages/kubernetes-access/guides/multiple-clusters.mdx
index 37e15817bc992..f4e71cb4aed1a 100644
--- a/docs/pages/kubernetes-access/guides/multiple-clusters.mdx
+++ b/docs/pages/kubernetes-access/guides/multiple-clusters.mdx
@@ -7,18 +7,84 @@ This guide will show you how to use Teleport as an access plane for multiple Kub
 
 ## Prerequisites
 
-- [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
-- [Helm](https://helm.sh) >= (=helm.version=)
-- Installed and running Teleport cluster (Open Source, Enterprise, or Teleport Cloud)
+<Tabs>
+<TabItem scope={["oss"]} label="Open Source">
+
+- A Teleport cluster running on Kubernetes, version >=
+  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0. We will assume
+  that you have followed the
+  [Kubernetes with SSO](../getting-started/cluster.mdx) guide
+- The `jq` tool to process `JSON` output. This is available via common package managers
+- An additional Kubernetes cluster version >=
+  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
+- Helm >= (=helm.version=)
 
 (!docs/pages/includes/helm.mdx!)
 
+
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+
+- A Teleport cluster running on Kubernetes, version >=
+  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0. We will assume
+  that you have followed the
+  [Kubernetes with SSO](../getting-started/cluster.mdx) guide
+- The `jq` tool to process `JSON` output. This is available via common package managers
+- An additional Kubernetes cluster version >=
+  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
+- Helm >= (=helm.version=)
+
+(!docs/pages/includes/helm.mdx!)
+
+
+</TabItem>
+<TabItem scope={["cloud"]}
+  label="Teleport Cloud">
+
+- A Teleport Cloud account. If you do not have one, visit the
+  [sign up page](https://goteleport.com/signup/) to begin your free trial
+
+- The Teleport Kubernetes Service running in a Kubernetes cluster, version >=
+  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0. We will assume
+  that you have already followed
+  [Connect a Kubernetes Cluster to Teleport](../getting-started/agent.mdx)
+
+- The `jq` tool to process `JSON` output. This is available via common package
+  managers
+
+- The Enterprise version of the `tctl` admin tool. To download this, visit
+the [customer portal](https://dashboard.gravitational.com/web/login)
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+- An additional Kubernetes cluster version >=
+  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
+
+- Helm >= (=helm.version=)
+
+(!docs/pages/includes/helm.mdx!)
+
+
+</TabItem>
+</Tabs>
+
 ## Connecting clusters
 
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
 Teleport can act as an access plane for multiple Kubernetes clusters. 
-We have set up the Teleport cluster `tele.example.com` in [SSO and Kubernetes](../getting-started.mdx).
 
-Let's start a lightweight agent in another Kubernetes cluster `cookie` and connect it to `tele.example.com`.
+We will assume that the domain of your Teleport cluster is `tele.example.com`.
+
+Let's start a lightweight agent in another Kubernetes cluster `cookie` and
+connect it to `tele.example.com`.
 
 We will need a join token from `tele.example.com`:
 
@@ -33,12 +99,11 @@ $ echo $TOKEN
 Switch `kubectl` to the Kubernetes cluster `cookie` and run:
 
 ```code
-# Add teleport chart repository
+# Add Teleport chart repository
 $ helm repo add teleport https://charts.releases.teleport.dev
 
 # Deploy a Kubernetes agent. It dials back to the Teleport cluster tele.example.com.
 $ CLUSTER='cookie'
-# For Cloud users this will be similar to mytenant.teleport.sh
 $ PROXY='tele.example.com:443'
 $ helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=${CLUSTER?} \
   --set proxyAddr=${PROXY?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
@@ -57,8 +122,61 @@ $ tsh kube ls
 
 # kubeconfig now points to the cookie cluster
 $ tsh kube login cookie
-# Logged into kubernetes cluster "cookie"
+# Logged into Kubernetes cluster "cookie"
 
-# kubectl command executed on `cookie` but is routed through `tele.example.com` cluster.
+# kubectl command executed on `cookie` but is routed through the `tele.example.com` cluster.
 $ kubectl get pods
 ```
+
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
+
+Teleport can act as an access plane for multiple Kubernetes clusters. 
+
+We will assume that the domain of your Teleport cluster is `mytenant.teleport.sh`.
+
+Let's start a lightweight agent in another Kubernetes cluster `cookie` and
+connect it to `mytenant.teleport.sh`.
+
+We will need a join token from `mytenant.teleport.sh`:
+
+```code
+# Create a join token for the cluster cookie to authenticate
+$ TOKEN=$(tctl nodes add --roles=kube --ttl=10000h --format=json | jq -r '.[0]')
+$ echo $TOKEN
+```
+
+Switch `kubectl` to the Kubernetes cluster `cookie` and run:
+
+```code
+# Add Teleport chart repository
+$ helm repo add teleport https://charts.releases.teleport.dev
+
+# Deploy a Kubernetes agent. It dials back to the Teleport cluster mytenant.teleport.sh.
+$ CLUSTER='cookie'
+$ PROXY='mytenant.teleport.sh'
+$ helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=${CLUSTER?} \
+  --set proxyAddr=${PROXY?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
+```
+
+List connected clusters using `tsh kube ls` and switch between
+them using `tsh kube login`:
+
+```code
+$ tsh kube ls
+
+# Kube Cluster Name Selected 
+# ----------------- -------- 
+# cookie
+# mytenant.teleport.sh    *
+
+# kubeconfig now points to the cookie cluster
+$ tsh kube login cookie
+# Logged into Kubernetes cluster "cookie"
+
+# kubectl command executed on `cookie` but is routed through the `mytenant.teleport.sh` cluster.
+$ kubectl get pods
+```
+
+</TabItem>
+</Tabs>
diff --git a/docs/pages/kubernetes-access/guides/standalone-teleport.mdx b/docs/pages/kubernetes-access/guides/standalone-teleport.mdx
index 0e709cb571363..ee6d462dd00e7 100644
--- a/docs/pages/kubernetes-access/guides/standalone-teleport.mdx
+++ b/docs/pages/kubernetes-access/guides/standalone-teleport.mdx
@@ -1,30 +1,102 @@
 ---
-title: Kubernetes Access from standalone Teleport
+title: Kubernetes Access from a Standalone Teleport Cluster
 description: Connecting standalone Teleport installations to Kubernetes clusters.
 ---
 
-## Standalone Teleport installation
-
-Teleport can connect to external Kubernetes clusters without using the Teleport Helm chart or running a pod inside of the Kubernetes cluster. To do this, Teleport needs a `kubeconfig` file to authenticate against the Kubernetes API.
+Teleport can connect to external Kubernetes clusters without using the Teleport
+Helm chart or running a pod inside of the Kubernetes cluster. To do this,
+Teleport needs a `kubeconfig` file to authenticate against the Kubernetes API.
 
 (!docs/pages/includes/permission-warning.mdx!)
 
-## Generating kubeconfig
+## Prerequisites
+
+<Tabs>
+<TabItem scope={["oss"]} label="Open Source">
+
+- A running Teleport cluster. For details on how to set this up, see one of our
+  [Getting Started](../../getting-started.mdx) guides.
+
+- **Optional:** the `tctl` admin tool version >= (=teleport.version=).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  See [Installation](../../installation.mdx) for details.
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+
+- A running Teleport cluster. For details on how to set this up, see one of our
+  [Getting Started](../../getting-started.mdx) guides.
+
+- **Optional:** the `tctl` admin tool version >= (=teleport.version=), which you can download
+  by visiting the
+  [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+<TabItem scope={["cloud"]}
+  label="Teleport Cloud">
+
+- A Teleport Cloud account. If you do not have one, visit the
+  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+
+- A host deployed on your own infrastructure to run the Teleport Kubernetes
+  Service. See [Installing Teleport](../../installation.mdx) for more details.
+
+- **Optional:** the Enterprise version of the `tctl` admin tool. To download this, visit
+the [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+</Tabs>
+
+## Step 1/2. Generate a kubeconfig
 
-First, configure your local `kubectl` command to point at the Kubernetes
-cluster you want to register. You can use `kubectl config get-contexts` to
-verify that the correct cluster is selected, or `kubectl config use-context
-${CONTEXT_NAME?}` to switch to cluster `CONTEXT_NAME`.
+First, configure your local `kubectl` command to point at the Kubernetes cluster
+you want to register. You can use the following command to verify that
+the correct cluster is selected:
+
+```code
+$ kubectl config get-contexts
+```
+
+Use this command to switch to the cluster assigned to `CONTEXT_NAME`:
+
+```code
+$ kubectl config use-context ${CONTEXT_NAME?}
+```
 
 Next, use [get-kubeconfig.sh](https://github.com/gravitational/teleport/blob/master/examples/k8s-auth/get-kubeconfig.sh) to create a `kubeconfig` for Teleport to use.
 
 You can connect multiple Kubernetes clusters to Teleport from one `kubeconfig` if it contains multiple entries. Use
 [merge-kubeconfigs.sh](https://github.com/gravitational/teleport/blob/master/examples/k8s-auth/merge-kubeconfigs.sh) to combine multiple `kubeconfigs` generated by `get-kubeconfig.sh`.
 
-## Adding kubeconfig to Teleport
+## Step 2/2. Add your kubeconfig to Teleport
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
 
-In your Teleport Proxy or a new separate instance, add the following to
-`teleport.yaml`:
+In your Teleport Proxy, add the following to `teleport.yaml`, replacing
+`example.com` with the domain name of your Teleport cluster:
 
 ```yaml
 # ...
@@ -43,6 +115,24 @@ kubernetes_service:
   kubeconfig_file: "path/to/kubeconfig"
 ```
 
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
+
+On the host you will use to run the Teleport Kubernetes Service, add the
+following to `teleport.yaml`.
+
+```yaml
+# ...
+kubernetes_service:
+  enabled: yes
+  listen_addr: 0.0.0.0:3027
+  # Replace this path with the actual path for your generated kubeconfig
+  kubeconfig_file: "path/to/kubeconfig"
+```
+
+</TabItem>
+</Tabs>
+
 <Admonition type="warning" title="Warning" >
   When using `kubeconfig_file`, EKS users may need to replace illegal characters in the `context` names.
   Supported characters are alphanumeric characters, `.`, `_`, and `-`. EKS typically includes `:` and `@`
diff --git a/docs/pages/kubernetes-access/helm/guides/aws.mdx b/docs/pages/kubernetes-access/helm/guides/aws.mdx
index 1e54b39653183..83c28a54e079b 100644
--- a/docs/pages/kubernetes-access/helm/guides/aws.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/aws.mdx
@@ -6,9 +6,21 @@ description: Install and configure an HA Teleport cluster using an AWS EKS clust
 In this guide, we'll go through how to set up a High Availability Teleport cluster with multiple replicas in Kubernetes
 using Teleport Helm charts and AWS products (DynamoDB and S3).
 
-(!docs/pages/kubernetes-access/helm/includes/helm-install.mdx!)
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
 
-## Step 3. Set up AWS IAM configuration
+## Prerequisites
+
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
+
+## Step 1/7. Install Helm
+
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
+
+## Step 2/7. Add the Teleport Helm chart repository
+
+(!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
+
+## Step 3/7. Set up AWS IAM configuration
 
 For Teleport to be able to create the DynamoDB tables, indexes, and the S3 storage bucket it needs,
 you'll need to configure AWS IAM policies to allow access.
@@ -153,7 +165,7 @@ You'll need to replace these values in the policy example below:
 }
 ```
 
-## Step 4. Install and configure cert-manager
+## Step 4/7. Install and configure cert-manager
 
 Reference: [`cert-manager` docs](https://cert-manager.io/docs/)
 
@@ -216,7 +228,7 @@ $ kubectl create namespace teleport
 $ kubectl --namespace teleport create -f aws-issuer.yaml
 ```
 
-## Step 5. Set values to configure the cluster
+## Step 5/7. Set values to configure the cluster
 
 There are two different ways to configure the `teleport-cluster` Helm chart to use `aws` mode - using a `values.yaml` file, or using `--set`
 on the command line.
@@ -300,11 +312,13 @@ $ kubectl --namespace teleport get all
 # replicaset.apps/teleport-5cf46ddf5f   2         2         2       4m21s
 ```
 
-## Step 6. Set up DNS
+## Step 6/7. Set up DNS
+
+You'll need to set up a DNS `A` record for `teleport.example.com`. In our example, this record is an alias to an ELB.
 
-You'll need to set up two DNS `A` records: `teleport.example.com` for the web UI, and `*.teleport.example.com`
-for web apps using [application access](../../../application-access/introduction.mdx). In our example, both records are
-aliases to an ELB.
+<Details title="Using Application Access?">
+(!docs/pages/includes/dns-app-access.mdx!)
+</Details>
 
 Here's how to do this in a hosted zone with AWS Route 53:
 
@@ -322,7 +336,7 @@ $ MY_CLUSTER_REGION='us-west-2'
 $ MYZONE="$(aws route53 list-hosted-zones-by-name --dns-name="${MYZONE_DNS?}" | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)"
 $ MYELB="$(kubectl --namespace "${NAMESPACE?}" get "service/${RELEASE_NAME?}" -o jsonpath='{.status.loadBalancer.ingress[*].hostname}')"
 $ MYELB_NAME="${MYELB%%-*}"
-$ MYELB_ZONE="$(aws elb describe-load-balancers --region "${MY_CLUSTER_REGION?}" --load-balancer-names "${MYELB_NAME?}" | jq -r '.LoadBalancerDescriptions[0].CanonicalHostedZoneNameID')"
+$ MYELB_ZONE="$(aws elbv2 describe-load-balancers --region "${MY_CLUSTER_REGION?}" --names "${MYELB_NAME?}" | jq -r '.LoadBalancers[0].CanonicalHostedZoneId')"
 
 # Create a JSON file changeset for AWS.
 $ jq -n --arg dns "${MYDNS?}" --arg elb "${MYELB?}" --arg elbz "${MYELB_ZONE?}" \
@@ -366,7 +380,7 @@ $ aws route53 get-change --id "${CHANGEID?}" | jq '.ChangeInfo.Status'
 # "INSYNC"
 ```
 
-## Step 7. Create a Teleport user
+## Step 7/7. Create a Teleport user
 
 Create a user to be able to log into Teleport. This needs to be done on the Teleport auth server,
 so we can run the command using `kubectl`:
@@ -444,4 +458,4 @@ $ helm --namespace cert-manager uninstall cert-manager
 You can follow our [Getting Started with Teleport guide](../../../setup/guides/docker.mdx#step-34-creating-a-teleport-user) to finish setting up your
 Teleport cluster.
 
-See the [high availability section of our Helm chart reference](../reference.mdx#highavailability) for more details on high availability.
+See the [high availability section of our Helm chart reference](../reference/teleport-cluster.mdx#highavailability) for more details on high availability.
diff --git a/docs/pages/kubernetes-access/helm/guides/custom.mdx b/docs/pages/kubernetes-access/helm/guides/custom.mdx
index dc678ace25919..a5a126b170b85 100644
--- a/docs/pages/kubernetes-access/helm/guides/custom.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/custom.mdx
@@ -9,14 +9,26 @@ config file using Teleport Helm charts.
 This setup can be useful when you already have an existing Teleport cluster and would like to start running it in Kubernetes, or when
 migrating your setup from a legacy version of the Helm charts.
 
-(!docs/pages/kubernetes-access/helm/includes/helm-install.mdx!)
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
 
-## Step 3. Setting up a Teleport cluster with Helm using a custom config
+## Prerequisites
+
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
+
+## Step 1/4. Install Helm
+
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
+
+## Step 2/4. Add the Teleport Helm chart repository
+
+(!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
+
+## Step 3/4. Setting up a Teleport cluster with Helm using a custom config
 
 In `custom` mode, the `teleport-cluster` Helm chart does not create a `ConfigMap` containing a `teleport.yaml` file for you, but
 expects that you will provide this yourself.
 
-For this example, we'll be using this `teleport.yaml` configuration file (with appropriately complex [static tokens](../../../setup/admin/adding-nodes.mdx#insecure-static-tokens)):
+For this example, we'll be using this `teleport.yaml` configuration file with a static join token (for more information on join tokens, see [Adding Nodes to the Cluster](../../../setup/admin/adding-nodes.mdx)):
 
 ```bash
 $ cat << EOF > teleport.yaml
@@ -130,7 +142,7 @@ $ kubectl --namespace teleport get all
 # replicaset.apps/teleport-5c56b4d869   1         1         1       5h8m
 ```
 
-## Step 4. Create a Teleport user (optional)
+## Step 4/4. Create a Teleport user (optional)
 
 If you're not migrating an existing Teleport cluster, you'll need to create a user to be able to log into Teleport. This needs to be done on the
 Teleport auth server, so we can run the command using `kubectl`:
diff --git a/docs/pages/kubernetes-access/helm/guides/digitalocean.mdx b/docs/pages/kubernetes-access/helm/guides/digitalocean.mdx
index 1e8da7e44a7f2..0f6e816742a16 100644
--- a/docs/pages/kubernetes-access/helm/guides/digitalocean.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/digitalocean.mdx
@@ -5,6 +5,8 @@ description: How to get started with Teleport on DigitalOcean Kubernetes
 
 This guide will show you how to get started with Teleport on DigitalOcean Kubernetes. 
 
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
+
 ## Prerequisites
 - DigitalOcean account.
 - Your workstation configured with [kubectl](https://kubernetes.io/docs/tasks/tools/), [Helm](https://helm.sh/docs/intro/install/), [doctl](https://docs.digitalocean.com/reference/doctl/how-to/install/), and the Teleport [tsh](https://goteleport.com/docs/installation/) client.
diff --git a/docs/pages/kubernetes-access/helm/guides/gcp.mdx b/docs/pages/kubernetes-access/helm/guides/gcp.mdx
index 74b02029d3c48..73554e7f73d92 100644
--- a/docs/pages/kubernetes-access/helm/guides/gcp.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/gcp.mdx
@@ -6,7 +6,19 @@ description: Install and configure an HA Teleport cluster using a Google Cloud G
 In this guide, we'll go through how to set up a High Availability Teleport cluster with multiple replicas in Kubernetes
 using Teleport Helm charts and Google Cloud Platform products (Firestore and Google Cloud Storage).
 
-(!docs/pages/kubernetes-access/helm/includes/helm-install.mdx!)
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
+
+## Prerequisites
+
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
+
+## Step 1/7. Install Helm
+
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
+
+## Step 2/7. Add the Teleport Helm chart repository
+
+(!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
 
 <Admonition
   type="note"
@@ -15,7 +27,7 @@ using Teleport Helm charts and Google Cloud Platform products (Firestore and Goo
   The steps below apply to Google Cloud Google Kubernetes Engine (GKE) Standard deployments.
 </Admonition>
 
-## Step 3: Google Cloud IAM configuration
+## Step 3/7. Google Cloud IAM configuration
 
 For Teleport to be able to create the Firestore collections, indexes, and the Google Cloud Storage bucket it needs,
 you'll need to configure a Google Cloud service account with permissions to use these services.
@@ -187,7 +199,7 @@ $ kubectl --namespace teleport create secret generic teleport-gcp-credentials --
  The credentials file stored in any secret used must have the key name `gcp-credentials.json`.
 </Admonition>
 
-## Step 4: Install and configure cert-manager
+## Step 4/7. Install and configure cert-manager
 
 Reference the [cert-manager docs](https://cert-manager.io/docs/).
 
@@ -255,7 +267,7 @@ After you have created the `Issuer` and updated the values, add it to your clust
 $ kubectl --namespace teleport create -f gcp-issuer.yaml
 ```
 
-## Step 5: Set values to configure the cluster
+## Step 5/7. Set values to configure the cluster
 
 <Admonition type="note">
   If you are installing Teleport in a brand new GCP project, make sure you have enabled the
@@ -344,10 +356,13 @@ $ kubectl --namespace teleport get all
 # replicaset.apps/teleport-b64dd8849    2         2         2       7m16s
 ```
 
-## Step 6. Set up DNS
+## Step 6/7. Set up DNS
+
+You'll need to set up a DNS `A` record for `teleport.example.com`.
 
-You'll need to set up two DNS `A` records: `teleport.example.com` for the web UI, and `*.teleport.example.com`
-for web apps using [application access](../../../application-access/introduction.mdx).
+<Details title="Using Application Access?">
+(!docs/pages/includes/dns-app-access.mdx!)
+</Details>
 
 Here's how to do this using Google Cloud DNS:
 
@@ -367,7 +382,7 @@ $ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
 $ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
 ```
 
-## Step 7. Create a Teleport user
+## Step 7/7. Create a Teleport user
 
 Create a user to be able to log into Teleport. This needs to be done on the Teleport auth server,
 so we can run the command using `kubectl`:
@@ -394,7 +409,7 @@ To make changes to your Teleport cluster after deployment, you can use `helm upg
 Helm defaults to using the latest version of the chart available in the repo, which will also correspond to the latest
 version of Teleport. You can make sure that the repo is up to date by running `helm repo update`.
 
-If you want to use a different version of Teleport, set the [`teleportVersionOverride`](../reference.mdx#teleportversionoverride) value.
+If you want to use a different version of Teleport, set the [`teleportVersionOverride`](../reference/teleport-cluster.mdx#teleportversionoverride) value.
 
 Here's an example where we set the chart to use 3 replicas:
 
@@ -448,4 +463,4 @@ $ helm --namespace cert-manager uninstall cert-manager
 You can follow our [Getting Started with Teleport guide](../../../setup/guides/docker.mdx#step-34-creating-a-teleport-user) to finish setting up your
 Teleport cluster.
 
-See the [high availability section of our Helm chart reference](../reference.mdx#highavailability) for more details on high availability.
+See the [high availability section of our Helm chart reference](../reference/teleport-cluster.mdx#highavailability) for more details on high availability.
diff --git a/docs/pages/kubernetes-access/helm/guides/migration.mdx b/docs/pages/kubernetes-access/helm/guides/migration.mdx
index 1810fb80562bb..f35f5cacc3270 100644
--- a/docs/pages/kubernetes-access/helm/guides/migration.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/migration.mdx
@@ -13,9 +13,21 @@ to use the newer `teleport-cluster` Helm chart instead.
   consider [following a different guide](../guides.mdx) and storing your cluster's data in AWS DynamoDB or Google Cloud Firestore.
 </Admonition>
 
-(!docs/pages/kubernetes-access/helm/includes/helm-install.mdx!)
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
 
-## Step 3. Get the Teleport configuration file from your existing cluster
+## Prerequisites
+
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
+
+## Step 1/6. Install Helm
+
+(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
+
+## Step 2/6. Add the Teleport Helm chart repository
+
+(!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
+
+## Step 3/6. Get the Teleport configuration file from your existing cluster
 
 <Admonition type="tip" title="Teleport storage in AWS or GCP">
   If your Teleport cluster's database is currently stored in AWS DynamoDB or Google Cloud Firestore rather than
@@ -81,7 +93,7 @@ $ kubectl --namespace teleport-cluster create configmap teleport --from-file=tel
 # configmap/teleport created
 ```
 
-## Step 4. Extracting the contents of Teleport's database
+## Step 4/6. Extracting the contents of Teleport's database
 
 <Admonition type="note" title="Note on namespacing">
   If you migrate your existing data, the `cluster_name` which is configured in `teleport.yaml` must stay the same.
@@ -112,7 +124,7 @@ Add the backup to your new `teleport-cluster` namespace as a secret:
 $ kubectl --namespace teleport-cluster create secret generic bootstrap --from-file=backup.yaml
 ```
 
-## Step 5. Start the new cluster with your old config file and backup
+## Step 5/6. Start the new cluster with your old config file and backup
 
 We will start the new cluster and bootstrap it using the backup of your cluster's data. Once this step is complete and the cluster is working,
 we'll modify the deployment to remove references to the backup data, and remove it from Kubernetes for security.
@@ -185,7 +197,7 @@ $ kubectl --namespace teleport-cluster get all
   browser to view the page successfully.
 </Admonition>
 
-## Step 6. Remove the bootstrap data and update the chart deployment
+## Step 6/6. Remove the bootstrap data and update the chart deployment
 
 Once you've tested your new Teleport cluster and you're confident that your data has been migrated successfully,
 you should redeploy the chart without your backup data mounted for security.
diff --git a/docs/pages/kubernetes-access/helm/includes/helm-install.mdx b/docs/pages/kubernetes-access/helm/includes/helm-install.mdx
deleted file mode 100644
index 9f2afc4f8aaf4..0000000000000
--- a/docs/pages/kubernetes-access/helm/includes/helm-install.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
-## Prerequisites
-
-- [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
-- [Helm](https://helm.sh) >= v(=helm.version=)
-
-<Details scopeOnly={true} scope={["cloud"]} title="Teleport Cloud warning">
-This guide shows you how to install the `teleport-cluster` Helm chart, which is intended to help you get started with Teleport by deploying the Auth Service and 
-Proxy Service in a Kubernetes cluster so you can access that cluster via the Kubernetes Service.
-
-Since the Auth and Proxy Services are fully managed in Teleport Cloud, you should install our `teleport-kube-agent` chart, which is intended for deployments where the Auth Service and Proxy Service run outside your Kubernetes cluster.
-
-You can use the `teleport-kube-agent` chart to enable the Application Service and Database Service in addition to the Kubernetes Service.
-
-For more information, see our [Helm chart reference](../reference.mdx#teleport-kube-agent).
-</Details>
-
-Verify that Helm and Kubernetes are installed and up to date.
-
-(!docs/pages/includes/permission-warning.mdx!)
-
-## Step 1. Install Helm
-
-Teleport's charts require the use of Helm version 3. You can [install Helm 3 by following these instructions](https://helm.sh/docs/intro/install/).
-
-Throughout this guide, we will assume that you have the `helm` and `kubectl` binaries available in your `PATH`:
-
-```code
-$ helm version
-# version.BuildInfo{Version:"v(=helm.version=)"}
-
-$ kubectl version
-# Client Version: version.Info{Major:"(=kubernetes.major_version=)", Minor:"(=kubernetes.minor_version=)+"}
-# Server Version: version.Info{Major:"(=kubernetes.major_version=)", Minor:"(=kubernetes.minor_version=)+"}
-```
-
-## Step 2. Add the Teleport Helm chart repository
-
-To allow Helm to install charts that are hosted in the Teleport Helm repository, use `helm repo add`:
-
-```code
-$ helm repo add teleport (=teleport.helm_repo_url=)
-```
-
-To update the cache of charts from the remote repository, run `helm repo update`:
-
-```code
-$ helm repo update
-```
diff --git a/docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx b/docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx
new file mode 100644
index 0000000000000..ecfd2bd53e642
--- /dev/null
+++ b/docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx
@@ -0,0 +1,11 @@
+To allow Helm to install charts that are hosted in the Teleport Helm repository, use `helm repo add`:
+
+```code
+$ helm repo add teleport (=teleport.helm_repo_url=)
+```
+
+To update the cache of charts from the remote repository, run `helm repo update`:
+
+```code
+$ helm repo update
+```
diff --git a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx
new file mode 100644
index 0000000000000..552769882816d
--- /dev/null
+++ b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx
@@ -0,0 +1,10 @@
+<Details scopeOnly={true} scope={["cloud"]} title="Teleport Cloud warning">
+This guide shows you how to install the `teleport-cluster` Helm chart, which is intended to help you get started with Teleport by deploying the Auth Service and 
+Proxy Service in a Kubernetes cluster so you can access that cluster via the Kubernetes Service.
+
+Since the Auth and Proxy Services are fully managed in Teleport Cloud, you should install our `teleport-kube-agent` chart, which is intended for deployments where the Auth Service and Proxy Service run outside your Kubernetes cluster.
+
+You can use the `teleport-kube-agent` chart to enable the Application Service and Database Service in addition to the Kubernetes Service.
+
+For more information, see our [Helm chart reference](../reference/teleport-kube-agent.mdx).
+</Details>
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx
new file mode 100644
index 0000000000000..f7739d9c3408f
--- /dev/null
+++ b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx
@@ -0,0 +1,12 @@
+Teleport's charts require the use of Helm version 3. You can [install Helm 3 by following these instructions](https://helm.sh/docs/intro/install/).
+
+Throughout this guide, we will assume that you have the `helm` and `kubectl` binaries available in your `PATH`:
+
+```code
+$ helm version
+# version.BuildInfo{Version:"v(=helm.version=)"}
+
+$ kubectl version
+# Client Version: version.Info{Major:"(=kubernetes.major_version=)", Minor:"(=kubernetes.minor_version=)+"}
+# Server Version: version.Info{Major:"(=kubernetes.major_version=)", Minor:"(=kubernetes.minor_version=)+"}
+```
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
new file mode 100644
index 0000000000000..0c49b5efbf7d0
--- /dev/null
+++ b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
@@ -0,0 +1,6 @@
+- [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
+- [Helm](https://helm.sh) >= v(=helm.version=)
+
+Verify that Helm and Kubernetes are installed and up to date.
+
+(!docs/pages/includes/permission-warning.mdx!)
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/helm/reference.mdx b/docs/pages/kubernetes-access/helm/reference.mdx
index bd695b85f7459..1fdeef7a6768d 100644
--- a/docs/pages/kubernetes-access/helm/reference.mdx
+++ b/docs/pages/kubernetes-access/helm/reference.mdx
@@ -3,2572 +3,17 @@ title: Helm chart reference
 description: A list of values that can be set using Teleport Helm charts and their purpose
 ---
 
-The Teleport Helm repository hosts two Helm charts:
+<TileSet>
+<Tile href="./reference/teleport-cluster.mdx" icon="kubernetes" title="teleport-cluster">
+![Teleport ](../../../img/k8s/mini-diagrams/teleport-in-k8s-mono.svg)
 
-- [`teleport-cluster`](#teleport-cluster) [(source on Github)](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-cluster)
-- [`teleport-kube-agent`](#teleport-kube-agent) [(source on Github)](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-kube-agent)
+Deploy the Teleport Auth Service and Proxy Service on Kubernetes.
 
-(!docs/pages/includes/backup-warning.mdx!)
+</Tile>
+<Tile href="./reference/teleport-kube-agent.mdx" icon="kubernetes" title="teleport-kube-agent">
+![Kubernetes agent](../../../img/k8s/mini-diagrams/k8s-to-teleport-mono.svg)
 
-## `teleport-cluster`
+Deploy the Teleport Kubernetes Service, Application Service, or Database Service on Kubernetes.
 
-The `teleport-cluster` Helm chart is used to configure a Teleport cluster. It runs two Teleport services:
-
-| Teleport service | Purpose | Documentation |
-| - | - | - |
-| `auth_service` | Authenticates users and hosts, and issues certificates | [Auth documentation](../../architecture/authentication.mdx)
-| `proxy_service`| Runs the externally-facing parts of a Teleport cluster, such as the web UI, SSH proxy and reverse tunnel service | [Proxy documentation](../../architecture/proxy.mdx) |
-
-The `teleport-cluster` chart can be deployed in four different modes. Get started with a guide for each mode:
-
-| `chartMode` | Guide |
-| - | - |
-| `standalone` | [Getting started with Kubernetes Access](../getting-started.mdx) |
-| `aws` | [Running an HA Teleport cluster using an AWS EKS Cluster](./guides/aws.mdx) |
-| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](./guides/gcp.mdx) |
-| `custom` | [Running a Teleport cluster with a custom config](./guides/custom.mdx) |
-
-This reference details available values for the `teleport-cluster` chart.
-
-## `clusterName`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `nil` | When `chartMode` is `aws`, `gcp` or `standalone` | `auth_service.cluster_name`, `proxy_service.public_addr` | ✅ |
-
-`clusterName` controls the name used to refer to the Teleport cluster, along with the externally-facing public address to use to access it.
-
-<Admonition type="note">
-  If using a fully qualified domain name as your `clusterName`, you will also need to configure the DNS provider for this domain to point
-  to the external load balancer address of your Teleport cluster.
-
-  (!docs/pages/kubernetes-access/helm/includes/kubernetes-externaladdress.mdx!)
-
-  You will need to manually add DNS records pointing `teleport.example.com` and `*.teleport.example.com` to either the IP or hostname
-  of the Kubernetes load balancer.
-
-  If you are not using ACME certificates, you may also need to accept insecure warnings in your browser to view the page successfully.
-</Admonition>
-
-
-## `kubeClusterName`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `clusterName` value | no | `kubernetes_service.kube_cluster_name` |  ✅ |
-
-`kubeClusterName` sets the name used for the Kubernetes cluster. This name will be shown to Teleport users connecting to the cluster.
-
-## `authenticationType`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `local` | Yes | `auth_service.authentication.type` | ❌ |
-
-`authenticationType` controls the authentication scheme used by Teleport. Possible values are `local` and `github` for OSS, plus `oidc`, `saml`, and `false` for Enterprise.
-
-## `proxyListenerMode`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `nil` | no | `auth_service.proxy_listener_mode` | ❌ |
-
-`proxyListenerMode` controls proxy TLS routing used by Teleport. Possible values are `multiplex`.
-
-## `enterprise`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `bool` | `false`| ✅ |
-
-`enterprise` controls whether to use Teleport Community Edition or Teleport Enterprise.
-
-Setting `enterprise` to `true` will use the Teleport Enterprise image.
-
-You will also need to download your Enterprise license from the Teleport dashboard and add it as a Kubernetes secret to use this:
-
-```code
-$ kubectl --namespace teleport create secret generic license --from-file=/path/to/downloaded/license.pem
-```
-
-<Admonition type="tip">
-  If you installed the Teleport chart into a specific namespace, the `license` secret you create must also be added to the same namespace.
-</Admonition>
-
-<Admonition type="note">
-  The file added to the secret must be called `license.pem`. If you have renamed it, you can specify the filename to use in the secret creation command:
-
-  ```code
-  $ kubectl --namespace teleport create secret generic license --from-file=license.pem=/path/to/downloaded/this-is-my-teleport-license.pem
-  ```
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  enterprise: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set enterprise=true
-  ```
-  </TabItem>
-</Tabs>
-
-## `teleportVersionOverride`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `nil` | ✅ |
-
-Normally the version of Teleport being used will match the version of the chart being installed. If you install chart version
-7.0.0, you'll be using Teleport 7.0.0. Upgrading the Helm chart will use the latest version from the repo.
-
-You can optionally override this to use a different published Teleport Docker image tag like `6.0.2` or `7`.
-
-See these links for information on Docker image versions:
-
-- [Community Docker image information](../../setup/guides/docker.mdx#step-14-pick-your-image)
-- [Enterprise Docker image information](../../enterprise/getting-started.mdx#run-teleport-enterprise-using-docker)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  teleportVersionOverride: "7"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set teleportVersionOverride="7"
-  ```
-  </TabItem>
-</Tabs>
-
-## `acme`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `bool` | `false` | ❌ | `proxy_service.acme.enabled` |
-
-ACME is a protocol for getting Web X.509 certificates.
-
-Setting acme to `true` enables the ACME protocol and will attempt to get a free TLS certificate from Let's Encrypt.
-Setting acme to `false` (the default) will cause Teleport to generate and use self-signed certificates for its web UI.
-
-<Admonition type="note">
-  ACME can only be used for single-pod clusters. It is not suitable for use in HA configurations.
-</Admonition>
-
-<Admonition type="warning">
-  Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
-  cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
-
-  One option might be to use Teleport's built-in ACME support or enable [cert-manager support](#highavailabilitycertmanager).
-</Admonition>
-
-## `acmeEmail`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `nil`  | ❌ | `proxy_service.acme.email` |
-
-`acmeEmail` is the email address to provide during certificate registration (this is a Let's Encrypt requirement).
-
-## `acmeURI`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | Let's Encrypt production server | ❌ | `proxy_service.acme.uri` |
-
-`acmeURI` is the ACME server to use for getting certificates.
-
-As an example, this can be overridden to use the [Let's Encrypt staging server](https://letsencrypt.org/docs/staging-environment/) for testing.
-
-You can also use any other ACME-compatible server.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  acme: true
-  acmeEmail: user@email.com
-  acmeURI: https://acme-staging-v02.api.letsencrypt.org/directory
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set acme=true \
-  --set acmeEmail=user@email.com \
-  --set acmeURI=https://acme-staging-v02.api.letsencrypt.org/directory
-  ```
-  </TabItem>
-</Tabs>
-
-## `podSecurityPolicy`
-
-### `podSecurityPolicy.enabled`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `bool` | `true` | ✅ |
-
-By default, Teleport charts also install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-cluster/templates/psp.yaml).
-
-To disable this, you can set `enabled` to `false`.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  podSecurityPolicy:
-    enabled: false
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set podSecurityPolicy.enabled=false
-  ```
-  </TabItem>
-</Tabs>
-
-## `labels`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `object` | `{}` | ❌ | `kubernetes_service.labels` |
-
-`labels` can be used to add a map of key-value pairs relating to the Teleport cluster being deployed. These labels can then be used with
-Teleport's RBAC policies to define access rules for the cluster.
-
-<Admonition type="note">
-  These are Teleport-specific RBAC labels, not Kubernetes labels.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  labels:
-    environment: production
-    region: us-east
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set labels.environment=production \
-  --set labels.region=us-east
-  ```
-  </TabItem>
-</Tabs>
-
-## `chartMode`
-
-| Type | Default value |
-| - | - |
-| `string` | `standalone` |
-
-`chartMode` is used to configure the chart's operation mode. You can find more information about each mode on its specific guide page:
-
-| `chartMode` | Guide |
-| - | - |
-| `standalone` | [Getting started with Kubernetes Access](../getting-started.mdx) |
-| `aws` | [Running an HA Teleport cluster using an AWS EKS Cluster](./guides/aws.mdx) |
-| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](./guides/gcp.mdx) |
-| `custom` | [Running a Teleport cluster with a custom config](./guides/custom.mdx) |
-
-## `standalone`
-
-### `standalone.existingClaimName`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `nil` | ✅ |
-
-`standalone.existingClaimName` can be used to provide the name of a pre-existing `PersistentVolumeClaim` to use if desired.
-
-The default is left blank, which will automatically create a `PersistentVolumeClaim` to use for Teleport storage in `standalone` mode.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  standalone:
-    existingClaimName: my-existing-pvc-name
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set standalone.existingClaimName=my-existing-pvc-name
-  ```
-  </TabItem>
-</Tabs>
-
-### `standalone.volumeSize`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string`  | `10Gi` | ✅ |
-
-You can set `volumeSize` to request a different size of persistent volume when installing the Teleport chart in `standalone` mode.
-
-<Admonition type="note">
-  `volumeSize` will be ignored if `existingClaimName` is set.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  standalone:
-    volumeSize: 50Gi
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set standalone.volumeSize=50Gi
-  ```
-  </TabItem>
-</Tabs>
-
-## `aws`
-
-| Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - |
-| ❌ | See [Using DynamoDB](../../setup/reference/backends.mdx#dynamodb) and [Using Amazon S3](../../setup/reference/backends.mdx#s3) for details |
-
-`aws` settings are described in the AWS guide: [Running an HA Teleport cluster using an AWS EKS Cluster](./guides/aws.mdx)
-
-## `gcp`
-
-| Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - |
-| ❌ | See [Using Firestore](../../setup/reference/backends.mdx#dynamodb) and [Using GCS](../../setup/reference/backends.mdx#gcs) for details |
-
-`gcp` settings are described in the GCP guide: [Running an HA Teleport cluster using a Google Cloud GKE cluster](./guides/gcp.mdx)
-
-### `highAvailability`
-
-## `highAvailability.replicaCount`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `int` | `1` | ✅ (when using HA storage) |
-
-`highAvailability.replicaCount` can be used to set the number of replicas used in the deployment.
-
-Set to a number higher than `1` for a high availability mode where multiple Teleport pods will be deployed and connections will be load balanced between them.
-
-<Admonition type="note">
-  Setting `highAvailability.replicaCount` to a value higher than `1` will disable the use of ACME certs.
-</Admonition>
-
-<Admonition type="tip" title="Sizing guidelines">
-  As a rough guide, we recommend configuring one replica per distinct availability zone where your cluster has worker nodes.
-
-  2 replicas/availability zones will be fine for smaller workloads. 3-5 replicas/availability zones will be more appropriate for bigger
-  clusters with more traffic.
-</Admonition>
-
-<Admonition type="warning">
-  When using `custom` mode, you **must** use highly-available storage (e.g. etcd, DynamoDB or Firestore) for multiple replicas to be supported.
-
-  [Information on supported Teleport storage backends](../../architecture/authentication.mdx#storage-back-ends)
-
-  Manually configuring NFS-based storage or `ReadWriteMany` volume claims is **NOT** supported for an HA deployment and will result in errors.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    replicaCount: 3
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set highAvailability.replicaCount=3
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.requireAntiAffinity`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `bool` | `false` | ✅ (when using HA storage) |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
-
-Setting `highAvailability.requireAntiAffinity` to `true` will use `requiredDuringSchedulingIgnoredDuringExecution` to require that multiple
-Teleport pods must not be scheduled on the same physical host.
-
-<Admonition type="warning">
-  This can result in Teleport pods failing to be scheduled in very small clusters or during node downtime, so should be used with caution.
-</Admonition>
-
- Setting `highAvailability.requireAntiAffinity` to `false` (the default) uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
- anti-affinity a soft requirement.
-
-<Admonition type="note">
-  This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    requireAntiAffinity: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set highAvailability.requireAntiAffinity=true
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.podDisruptionBudget`
-
-### `highAvailability.podDisruptionBudget.enabled`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `bool` | `false` | ✅ (when using HA storage) |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
-
-Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    podDisruptionBudget:
-      enabled: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.podDisruptionBudget.enabled=true
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.podDisruptionBudget.minAvailable`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `int` | `1` | ✅ (when using HA storage) |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
-
-Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    podDisruptionBudget:
-      minAvailable: 1
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.podDisruptionBudget.minAvailable=1
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.certManager`
-
-See the [cert-manager](https://cert-manager.io/docs/) docs for more information.
-
-### `highAvailability.certManager.enabled`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `bool` | `false` | ❌ | `proxy_service.https_keypairs` (to provide your own certificates) |
-
-Setting `highAvailability.certManager.enabled` to `true` will use `cert-manager` to provision a TLS certificate for a Teleport
-cluster deployed in HA mode.
-
-<Admonition type="note" title="Installing cert-manager">
-  You must install and configure `cert-manager` in your Kubernetes cluster yourself.
-
-  See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
-  and the relevant sections of the [AWS](./guides/aws.mdx#step-4-install-and-configure-cert-manager) and [GCP](./guides/gcp.mdx#step-4-install-and-configure-cert-manager) guides for more information.
-</Admonition>
-
-### `highAvailability.certManager.addCommonName`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `bool` | `false` | ❌ | `proxy_service.https_keypairs` (to provide your own certificates) |
-
-Setting `highAvailability.certManager.addCommonName` to `true` will instruct `cert-manager` to set the commonName field in its certificate signing request to the issuing CA.
-
-<Admonition type="note" title="Enabling common name field">
-  You must install and configure `cert-manager` in your Kubernetes cluster yourself.
-
-  See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
-  and the relevant sections of the [AWS](./guides/aws.mdx#step-4-install-and-configure-cert-manager) and [GCP](./guides/gcp.mdx#step-4-install-and-configure-cert-manager) guides for more information.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    certManager:
-      enabled: true
-      addCommonName: true
-      issuerName: letsencrypt-production
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set highAvailability.certManager.enabled=true \
-  --set highAvailability.certManager.addCommonName=true \
-  --set highAvailability.certManager.issuerName=letsencrypt-production
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.certManager.issuerName`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `nil` | ❌ | None |
-
-Sets the name of the `cert-manager` `Issuer` or `ClusterIssuer` to use for issuing certificates.
-
-<Admonition type="note" title="Configuring an Issuer">
-  You must install configure an appropriate `Issuer` supporting a DNS01 challenge yourself.
-
-  Please see the [cert-manager DNS01 docs](https://cert-manager.io/docs/configuration/acme/dns01/#supported-dns01-providers) and the relevant sections
-  of the [AWS](./guides/aws.mdx#step-4-install-and-configure-cert-manager) and [GCP](./guides/gcp.mdx#step-4-install-and-configure-cert-manager) guides for more information.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    certManager:
-      enabled: true
-      issuerName: letsencrypt-production
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set highAvailability.certManager.enabled=true \
-  --set highAvailability.certManager.issuerName=letsencrypt-production
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.certManager.issuerKind`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `Issuer` | ❌ | None |
-
-Sets the `Kind` of `Issuer` to be used when issuing certificates with `cert-manager`. Defaults to `Issuer` to keep permissions
-scoped to a single namespace.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    certManager:
-      issuerKind: ClusterIssuer
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set highAvailability.certManager.issuerKind=ClusterIssuer
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.certManager.issuerGroup`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `cert-manager.io` | ❌ | None |
-
-Sets the `Group` of `Issuer` to be used when issuing certificates with `cert-manager`. Defaults to `cert-manager.io` to use built-in issuers.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    certManager:
-      issuerGroup: cert-manager.io
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set highAvailability.certManager.issuerGroup=cert-manager.io
-  ```
-  </TabItem>
-</Tabs>
-
-## `image`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `quay.io/gravitational/teleport` | ✅ |
-
-`image` sets the container image used for Teleport Community pods in the cluster.
-
-You can override this to use your own Teleport Community image rather than a Teleport-published image.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  image: my.docker.registry/teleport-community-image-name
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set image=my.docker.registry/teleport-community-image-name
-  ```
-  </TabItem>
-</Tabs>
-
-## `enterpriseImage`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `quay.io/gravitational/teleport-ent` | ✅ |
-
-`enterpriseImage` sets the container image used for Teleport Enterprise pods in the cluster.
-
-You can override this to use your own Teleport Enterprise image rather than a Teleport-published image.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  enterpriseImage: my.docker.registry/teleport-enterprise-image-name
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set enterpriseImage=my.docker.registry/teleport-enterprise-image
-  ```
-  </TabItem>
-</Tabs>
-
-## `log`
-
-### `log.level`
-
-<Admonition type="note">
-  This field used to be called `logLevel`. For backwards compatibility this name can still be used, but we recommend changing your values file to use `log.level`.
-</Admonition>
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `INFO` | ❌ | `teleport.log.severity` |
-
-`log.level` sets the log level used for the Teleport process.
-
-Available log levels (in order of most to least verbose) are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
-
-The default is `INFO`, which is recommended in production.
-
-`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    level: DEBUG
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.level=DEBUG
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.output`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `stderr` | ❌ | `teleport.log.output` |
-
-`log.output` sets the output destination for the Teleport process.
-
-This can be set to any of the built-in values: `stdout`, `stderr` or `syslog` to use that destination.
-
-The value can also be set to a file path (such as `/var/log/teleport.log`) to write logs to a file. Bear in mind that a few service startup messages will still go to `stderr` for resilience.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    output: stderr
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.output=stderr
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.format`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `text` | ❌ | `teleport.log.format.output` |
-
-`log.format` sets the output type for the Teleport process.
-
-Possible values are `text` (default) or `json`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    format: json
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.format=json
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.extraFields`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `list` | `["timestamp", "level", "component", "caller"]` | ❌ | `teleport.log.format.extra_fields` |
-
-`log.extraFields` sets the fields used in logging for the Teleport process.
-
-See the [Teleport config file reference](../../setup/reference/config.mdx) for more details on possible values for `extra_fields`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    extraFields: ["timestamp", "level"]
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set "log.extraFields[0]=timestamp" \
-  --set "log.extraFields[1]=level"
-  ```
-  </TabItem>
-</Tabs>
-
-## `affinity`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅ |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
-
-Kubernetes affinity to set for pod assignments.
-
-<Admonition type="note">
-  You cannot set both `affinity` and `highAvailability.requireAntiAffinity` as they conflict with each other. Only set one or the other.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: gravitational.io/dedicated
-            operator: In
-            values:
-            - teleport
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key=gravitational.io/dedicated \
-  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
-  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=teleport
-  ```
-  </TabItem>
-</Tabs>
-
-## `annotations.config`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `object` | `{}` | ❌ | None |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
-
-<Admonition type="note">
-  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
-  In this instance, you should apply annotations manually to your created `ConfigMap`.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    config:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.config."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.deployment`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `Deployment` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    deployment:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.deployment."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.pod`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to each `Pod` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    pod:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.pod."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.service`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `Service` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    service:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.service."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.serviceAccount`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `serviceAccount` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    serviceAccount:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.serviceAccount."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.certSecret`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `secret` generated by
-`cert-manager` from the `certificate` created by the chart.  Only valid when
-`highAvailability.certManager.enabled` is set to `true` and requires
-`cert-manager` v1.5.0+.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    certSecret:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.certSecret."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `service.type`
-
-| Type | Default value | Required? | Can be used in `custom` mode? |
-| - | - | - | - |
-| `string` | `LoadBalancer` | Yes | ✅ |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/services-networking/service/)
-
-Allows to specify the service type.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  service:
-    type: LoadBalancer
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set service.type=LoadBalancer
-  ```
-  </TabItem>
-</Tabs>
-
-## `service.spec.loadBalancerIP`
-
-| Type | Default value | Required? | Can be used in `custom` mode? |
-| - | - | - | - |
-| `string` | `nil` | No | ✅ |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer)
-
-Allows to specify the `loadBalancerIP`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  service:
-    spec:
-      loadBalancerIP: 1.2.3.4
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set service.spec.loadBalancerIP=1.2.3.4
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraArgs`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-A list of extra arguments to pass to the `teleport start` command when running a Teleport Pod.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraArgs:
-  - "--bootstrap=/etc/teleport-bootstrap/roles.yaml"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraArgs={--bootstrap=/etc/teleport-bootstrap/roles.yaml}"
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraEnv`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
-
-A list of extra environment variables to be set on the main Teleport container.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraEnv:
-  - name: MY_ENV
-    value: my-value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraEnv[0].name=MY_ENV" \
-  --set "extraEnv[0].value=my-value"
-  ```
-  </TabItem>
-</Tabs>
-
-
-## `extraVolumes`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-A list of extra Kubernetes `Volumes` which should be available to any `Pod` created by the chart. These volumes
-will also be available to any `initContainers` configured by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraVolumes:
-  - name: myvolume
-    secret:
-      secretName: mysecret
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraVolumes[0].name=myvolume" \
-  --set "extraVolumes[0].secret.secretName=mysecret"
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraVolumeMounts`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-A list of extra Kubernetes volume mounts which should be mounted into any `Pod` created by the chart. These volume
-mounts will also be mounted into any `initContainers` configured by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraVolumeMounts:
-  - name: myvolume
-    mountPath: /path/to/mount/volume
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraVolumeMounts[0].name=myvolume" \
-  --set "extraVolumeMounts[0].path=/path/to/mount/volume"
-  ```
-  </TabItem>
-</Tabs>
-
-## `imagePullPolicy`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `IfNotPresent` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
-
-Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  imagePullPolicy: Always
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set imagePullPolicy=Always
-  ```
-  </TabItem>
-</Tabs>
-
-## `initContainers`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
-
-A list of `initContainers` which will be run before the main Teleport container in any pod created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  initContainers:
-  - name: teleport-init
-    image: alpine
-    args: ['echo test']
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "initContainers[0].name=teleport-init" \
-  --set "initContainers[0].image=alpine" \
-  --set "initContainers[0].args={echo test}"
-  ```
-  </TabItem>
-</Tabs>
-
-## `postStart`
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/)
-
-A `postStart` lifecycle handler to be configured on the main Teleport container.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  postStart:
-    command:
-    - echo
-    - foo
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set "postStart.command[0]=echo" \
-  --set "postStart.command[1]=foo"
-  ```
-  </TabItem>
-</Tabs>
-
-## `resources`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
-
-Resource requests/limits which should be configured for each container inside the pod. These resource limits
-will also be applied to `initContainers`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  resources:
-    requests:
-      cpu: 1
-      memory: 2Gi
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set resources.requests.cpu=1 \
-  --set resources.requests.memory=2Gi
-  ```
-  </TabItem>
-</Tabs>
-
-## `tolerations`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
-
-Kubernetes Tolerations to set for pod assignment.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  tolerations:
-  - key: "dedicated"
-    operator: "Equal"
-    value: "teleport"
-    effect: "NoSchedule"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set tolerations[0].key=dedicated \
-  --set tolerations[0].operator=Equal \
-  --set tolerations[0].value=teleport \
-  --set tolerations[0].effect=NoSchedule
-  ```
-  </TabItem>
-</Tabs>
-
-## `priorityClassName`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `""` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
-
-Kubernetes PriorityClass to set for pod.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  priorityClassName: "system-cluster-critical"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set priorityClassName=system-cluster-critical
-  ```
-  </TabItem>
-</Tabs>
-
-## ---
-
-## `teleport-kube-agent`
-
-The `teleport-kube-agent` Helm chart is used to configure a Teleport agent which runs in a remote Kubernetes cluster and joins back to a
-Teleport cluster to provide access to services running there.
-
-The `teleport-kube-agent` chart can run any or all of three Teleport services:
-
-| Teleport service | Name for `roles` and `tctl tokens add` | Purpose |
-| - | - | - |
-| [`kubernetes_service`](../../kubernetes-access/guides.mdx) | `kube` | Uses Teleport to handle authentication with and proxy access to a Kubernetes cluster |
-| [`application_service`](../../application-access/guides.mdx) | `app` | Uses Teleport to handle authentication with and proxy access to web-based applications |
-| [`database_service`](../../database-access/guides.mdx) | `db` | Uses Teleport to handle authentication with and proxy access to databases |
-
-This reference details available values for the `teleport-kube-agent` chart.
-
-## `roles`
-
-This parameter is not mandatory to preserve backwards compatibility with older chart versions, but we recommend it is set.
-
-| Type | Default value |
-| - | - |
-| `string` | `kube` |
-
-`roles` is a comma-separated list of services which should be enabled when running the `teleport-kube-agent` chart.
-
-| Services | Value for `roles` | Mandatory additional settings for this role |
-| - | - | - |
-| Teleport Kubernetes service | `kube` | [`kubeClusterName`](#kubeclustername) |
-| Teleport Application service | `app` | [`apps`](#apps) |
-| Teleport Database service | `db` | [`databases`](#databases) |
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  roles: kube,app,db
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set roles=kube\,app\,db
-  ```
-
-  <Admonition type="note">
-    When specifying multiple roles using `--set` syntax, you must escape the commas using a backslash (`\`).
-
-    This is a quirk of Helm's CLI parser.
-  </Admonition>
-
-  </TabItem>
-</Tabs>
-
-If you specify a role here, you may also need to specify some other settings which are detailed in this reference.
-
-## `authToken`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `nil` | Yes |
-
-`authToken` provides a Teleport join token which will be used to join the Teleport agent to a Teleport cluster.
-
-This value **must** be provided for the chart to work. The token that you use must also be valid for every Teleport service that you
-are trying to add with the `teleport-kube-agent` chart. Here are a few examples:
-
-| Services | Service Name | `tctl tokens add` example | `teleport.yaml` static token example |
-| - | - | - | - |
-| Kubernetes | `kube` | `tctl tokens add --type=kube` | `"kube:<replace-with-actual-token>"` |
-| Kubernetes, Application | `kube,app` | `tctl tokens add --type=kube,app` | `"kube,app:<replace-with-actual-token>"` |
-| Kubernetes, Application, Database | `kube,app,db` | `tctl tokens add --type=kube,app,db` | `"kube,app,db:<replace-with-actual-token>"` |
-
-<Admonition type="note">
-  When you use a token, all of the services that it provides **must** be used.
-
-  For example, you cannot use a token of type `app,db` to only join a Teleport `app` service by itself. It must join both `app` and `db` services at once.
-
-  Also, each static token you configure must be unique, as the token itself is used to define which services will be supported.
-
-  You cannot reuse the same static token and specify a different set of services.
-</Admonition>
-
-If you do not have the correct services (Teleport refers to these internally as `Roles`) assigned to your join token, the Teleport agent will
-fail to join the Teleport cluster.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  authToken: <replace-with-actual-token>
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set authToken=<replace-with-actual-token>
-  ```
-  </TabItem>
-</Tabs>
-
-## `proxyAddr`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `nil` | Yes |
-
-`proxyAddr` provides the public-facing Teleport proxy endpoint which should be used to join the cluster. This is the same URL that is used
-to access the web UI of your Teleport cluster. It is the same as the value configured for `proxy_service.public_addr` in a traditional
-Teleport cluster. The port used is usually either 3080 or 443.
-
-Here are a few examples:
-
-| Deployment method | Example `proxy_service.public_addr` |
-| - | - |
-| On-prem Teleport cluster | `teleport.example.com:3080` |
-| Teleport Cloud cluster | `example.teleport.sh:443` |
-| `teleport-cluster` Helm chart | `teleport.example.com:443` |
-
-## `kubeClusterName`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `nil` | When `kube` chart role is used |
-
-`kubeClusterName` sets the name used for the Kubernetes cluster proxied by the Teleport agent. This name will be shown to Teleport users
-connecting to the cluster.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  kubeClusterName: my-gke-cluster
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set kubeClusterName=my-gke-cluster
-  ```
-  </TabItem>
-</Tabs>
-
-## `apps`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `list` | `[]` | When `app` chart role is used? |
-
-`apps` is a YAML list object detailing the applications that should be proxied by Teleport Application access.
-
-You can specify multiple apps by adding additional list elements.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  apps:
-  - name: grafana
-    uri: http://localhost:3000
-    labels:
-      purpose: monitoring
-  - name: jenkins
-    uri: http://jenkins:8080
-    labels:
-      purpose: ci
-  ```
-
-  <Admonition type="note" title="YAML formatting">
-    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
-    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
-  </Admonition>
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "apps[0].name=grafana" \
-  --set "apps[0].uri=http://localhost:3000" \
-  --set "apps[0].purpose=monitoring" \
-  --set "apps[1].name=grafana" \
-  --set "apps[1].uri=http://jenkins:8080" \
-  --set "apps[1].purpose=ci"
-  ```
-
-  <Admonition type="note">
-    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
-  </Admonition>
-
-  </TabItem>
-</Tabs>
-
-<Admonition type="tip" title="Supported values">
-  You can see a list of all the supported [values which can be used in a Teleport application access configuration here](../../application-access/reference.mdx#configuration).
-</Admonition>
-
-## `awsDatabases`
-
-<Admonition type="tip" title="Database auto-discovery">
-  This section configures database auto-discovery, which is only currently supported on AWS. You can configure databases for other platforms using the [`databases`](#databases) section below this.
-</Admonition>
-
-<Admonition type="note" title="IAM roles">
-  For AWS database auto-discovery to work, your agent pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../database-access/guides/rds.mdx#step-36-configure-iam).
-
-  After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions:
-
-  ```
-  annotations:
-    serviceAccount:
-      eks.amazonaws.com/role-arn: arn:aws:iam::1234567890:role/my-rds-autodiscovery-role
-  ```
-</Admonition>
-
-| Type | Default value | Required? |
-| - | - | - |
-| `list` | `[]` | No |
-
-`awsDatabases` is a YAML list object detailing the filters for the AWS databases that should be discovered and proxied by Teleport Database access.
-
-You can specify multiple database filters by adding additional list elements.
-
-- `types` is a list containing the types of AWS databases that should be discovered.
-- `regions` is a list of AWS regions which should be scanned for databases.
-- `tags` can be used to set AWS tags that must be matched for databases to be discovered.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  awsDatabases:
-    - types: ["rds"]
-      regions: ["us-east-1", "us-west-2"]
-      tags:
-        "environment": "production"
-    - types: ["rds"]
-      regions: ["us-east-1"]
-      tags:
-        "environment": "dev"
-    - types: ["rds"]
-      regions: ["eu-west-1"]
-      tags:
-        "*": "*"
-  ```
-
-  <Admonition type="note" title="YAML formatting">
-    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
-    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
-  </Admonition>
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set "awsDatabases[0].types[0]=rds" \
-  --set "awsDatabases[0].regions[0]=us-east-1" \
-  --set "awsDatabases[0].regions[1]=us-west-2" \
-  --set "awsDatabases[0].tags[0].environment=production" \
-  --set "awsDatabases[1].types[0]=rds" \
-  --set "awsDatabases[1].regions[0]=us-east-1" \
-  --set "awsDatabases[1].tags[0].environment=dev" \
-  --set "awsDatabases[2].types[0]=rds" \
-  --set "awsDatabases[2].regions[0]=eu-west-1" \
-  --set "awsDatabases[2].tags[0].*=*"
-  ```
-
-  <Admonition type="note">
-    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
-  </Admonition>
-
-  </TabItem>
-</Tabs>
-
-## `databases`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `list` | `[]` | When `db` chart role is used |
-
-`databases` is a YAML list object detailing the databases that should be proxied by Teleport Database access.
-
-You can specify multiple databases by adding additional list elements.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  databases:
-  - name: aurora-postgres
-    uri: postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432
-    protocol: postgres
-    aws:
-      region: us-east-1
-    static_labels:
-      env: staging
-  - name: mysql
-    uri: mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306
-    protocol: mysql
-    aws:
-      region: us-east-1
-    static_labels:
-      env: staging
-  ```
-
-  <Admonition type="note" title="YAML formatting">
-    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
-    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
-  </Admonition>
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "databases[0].name=aurora" \
-  --set "databases[0].uri=postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432" \
-  --set "databases[0].protocol=postgres" \
-  --set "databases[0].aws.region=us-east-1" \
-  --set "databases[0].static_labels.env=staging" \
-  --set "databases[1].name=mysql" \
-  --set "databases[1].uri=mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306" \
-  --set "databases[1].protocol=mysql" \
-  --set "databases[1].aws.region=us-east-1" \
-  --set "databases[1].static_labels.env=staging"
-  ```
-
-  <Admonition type="note">
-    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
-  </Admonition>
-
-  </TabItem>
-</Tabs>
-
-<Admonition type="tip" title="Supported values">
-  You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../database-access/reference/configuration.mdx).
-</Admonition>
-
-## `teleportVersionOverride`
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-Normally the version of Teleport being used will match the version of the chart being installed. If you install chart version
-7.0.0, you'll be using Teleport 7.0.0.
-
-You can optionally override this to use a different published Teleport Docker image tag like `6.0.2` or `7`.
-
-See [this link for information on Community Docker image versions](../../setup/guides/docker.mdx#step-14-pick-your-image).
-
-<Admonition type="note">
-  The `teleport-kube-agent` chart always runs using Teleport Community edition as it does not require any Enterprise features, so it does
-  not require a Teleport license file to be provided.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  teleportVersionOverride: "7"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set teleportVersionOverride="7"
-  ```
-  </TabItem>
-</Tabs>
-
-## `insecureSkipProxyTLSVerify`
-
-| Type | Default value |
-| - | - |
-| `bool` | `false` |
-
-When `insecureSkipProxyTLSVerify` is set to `true`, the agent will skip the verification of the TLS certificate presented by the Teleport
-proxy server specified using [`proxyAddr`](#proxyaddr).
-
-This can be used for joining a Teleport agent to a Teleport cluster which does not have valid TLS certificates for testing.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  insecureSkipProxyTLSVerify: false
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set insecureSkipProxyTLSVerify=false
-  ```
-  </TabItem>
-</Tabs>
-
-<Admonition type="warning">
-  Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
-  cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
-
-  One option might be to use Teleport's built-in [ACME support](#acme) enable [cert-manager support](#highavailabilitycertmanager).
-</Admonition>
-
-## `existingDataVolume`
-
-| Type | Default value |
-| - | - |
-| `string` | `""` |
-
-When `existingDataVolume` is set to the name of an existing volume, the `/var/lib/teleport` mount will use this volume instead of creating a new `emptyDir` volume.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  existingDataVolume: my-volume
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set existingDataVolume=my-volume
-  ```
-  </TabItem>
-</Tabs>
-
-## `podSecurityPolicy`
-
-### `podSecurityPolicy.enabled`
-
-| Type | Default value |
-| - | - |
-| `bool` | `true` |
-
-By default, Teleport charts also install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-kube-agent/templates/psp.yaml).
-
-To disable this, you can set `enabled` to `false`.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  podSecurityPolicy:
-    enabled: false
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set podSecurityPolicy.enabled=false
-  ```
-  </TabItem>
-</Tabs>
-
-## `labels`
-
-| Type | Default value |
-| - | - |
-| `object` | `{}` |
-
-`labels` can be used to add a map of key-value pairs for the `kubernetes_service` which is deployed using the `teleport-kube-agent` chart.
-These labels can then be used with Teleport's RBAC policies to define access rules for the cluster.
-
-<Admonition type="note">
-  These are Teleport-specific RBAC labels, not Kubernetes labels.
-</Admonition>
-
-<Admonition type="note">
-  For historical/backwards compatibility reasons, these labels will only be applied to the Kubernetes cluster being joined via the
-  Teleport Kubernetes service.
-
-  To set labels for applications, add a `labels` element to the [`apps`](#apps) section.
-  To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section.
-
-  For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../setup/admin/labels.mdx).
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  labels:
-    environment: production
-    region: us-east
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set labels.environment=production \
-  --set labels.region=us-east
-  ```
-  </TabItem>
-</Tabs>
-
-## `storage`
-
-### `storage.enabled`
-
-| Type | Default value |
-| - | - |
-| `bool` | `false` |
-
-Enables the creation of a Kubernetes persistent volume to hold Teleport agent state.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  storage:
-    enabled: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set storage.enabled=true
-  ```
-  </TabItem>
-</Tabs>
-
-### `storage.storageClassName`
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-The storage class name the persistent volume should use when creating persistent volume claims. The provided storage class
-name needs to exist on the Kubernetes cluster for Teleport to use.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/storage-classes/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  storage:
-    storageClassName: teleport-storage-class
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set storage.storageClassName=teleport-storage-class
-  ```
-  </TabItem>
-</Tabs>
-
-### `storage.requests`
-
-| Type | Default value |
-| - | - |
-| `string` | `128Mi` |
-
-The size of persistent volume to create.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  storage:
-    requests: 128Mi
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set storage.requests=128Mi
-  ```
-  </TabItem>
-</Tabs>
-
-## `image`
-
-| Type | Default value |
-| - | - |
-| `string` | `quay.io/gravitational/teleport` |
-
-`image` sets the container image used for Teleport pods run by the `teleport-kube-agent` chart.
-
-You can override this to use your own Teleport image rather than a Teleport-published image.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  image: my.docker.registry/teleport-image-name
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set image=my.docker.registry/teleport-image-name
-  ```
-  </TabItem>
-</Tabs>
-
-## `imagePullSecrets`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
-
-A list of secrets containing authorization tokens which can be optionally used to access a private Docker registry.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  imagePullSecrets:
-  - name: my-docker-registry-key
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set "imagePullSecrets[0].name=my-docker-registry-key"
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability`
-
-## `highAvailability.replicaCount`
-
-| Type | Default value |
-| - | - |
-| `int` | `1` |
-
-`highAvailability.replicaCount` can be used to set the number of replicas used in the deployment.
-
-Set to a number higher than `1` for a high availability mode where multiple Teleport agent pods will be deployed.
-
-<Admonition type="tip" title="Sizing guidelines">
-  As a rough guide, we recommend configuring one replica per distinct availability zone where your cluster has worker nodes.
-
-  2 replicas/availability zones will be fine for smaller workloads. 3-5 replicas/availability zones will be more appropriate for bigger
-  clusters with more traffic.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    replicaCount: 3
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.replicaCount=3
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.requireAntiAffinity`
-
-| Type | Default value |
-| - | - |
-| `bool` | `false` |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
-
-Setting `highAvailability.requireAntiAffinity` to `true` will use `requiredDuringSchedulingIgnoredDuringExecution` to require that multiple
-Teleport pods must not be scheduled on the same physical host.
-
-<Admonition type="warning">
-  This can result in Teleport pods failing to be scheduled in very small clusters or during node downtime, so should be used with caution.
-</Admonition>
-
- Setting `highAvailability.requireAntiAffinity` to `false` (the default) uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
- anti-affinity a soft requirement.
-
-<Admonition type="note">
-  This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    requireAntiAffinity: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.requireAntiAffinity=true
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.podDisruptionBudget`
-
-### `highAvailability.podDisruptionBudget.enabled`
-
-| Type | Default value |
-| - | - |
-| `bool` | `false` |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
-
-Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    podDisruptionBudget:
-      enabled: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.podDisruptionBudget.enabled=true
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.podDisruptionBudget.minAvailable`
-
-| Type | Default value |
-| - | - |
-| `int` | `1` |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
-
-Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    podDisruptionBudget:
-      minAvailable: 1
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.podDisruptionBudget.minAvailable=1
-  ```
-  </TabItem>
-</Tabs>
-
-## `clusterRoleName`
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-`clusterRoleName` can be optionally used to override the name of the Kubernetes `ClusterRole` used by the `teleport-kube-agent` chart's `ServiceAccount`.
-
-<Admonition type="note">
-  Most users will not need to change this.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  clusterRoleName: kubernetes-clusterrole
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set clusterRoleName=kubernetes-clusterrole
-  ```
-  </TabItem>
-</Tabs>
-
-## `clusterRoleBindingName`
-
-<Admonition type="note">
-  Most users will not need to change this.
-</Admonition>
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-
-`clusterRoleBindingName` can be optionally used to override the name of the Kubernetes `ClusterRoleBinding` used by the `teleport-kube-agent` chart's `ServiceAccount`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  clusterRoleBindingName: kubernetes-clusterrolebinding
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set clusterRoleBindingName=kubernetes-clusterrolebinding
-  ```
-  </TabItem>
-</Tabs>
-
-## `serviceAccountName`
-
-<Admonition type="note">
-  Most users will not need to change this.
-</Admonition>
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-`serviceAccountName` can be optionally used to override the name of the Kubernetes `ServiceAccount` used by the `teleport-kube-agent` chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  serviceAccountName: kubernetes-serviceaccount
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set serviceAccountName=kubernetes-serviceaccount
-  ```
-  </TabItem>
-</Tabs>
-
-## `secretName`
-
-| Type | Default value |
-| - | - |
-| `string` | `teleport-kube-agent-join-token` |
-
-`secretName` is the name of the Kubernetes `Secret` used to store the Teleport join token which is used by the `teleport-kube-agent` chart.
-
-If you set this to a blank value, the chart will not attempt to create the secret itself and will instead read the value of the
-existing `teleport-kube-agent-join-token` secret. This allows you to configure this secret externally and avoid having a plaintext
-join token stored in your Teleport chart values.
-
-To create your own join token secret, you can use a command like this:
-
-```code
-$ kubectl --namespace teleport create secret generic teleport-kube-agent-join-token --from-literal=auth-token=<replace-with-actual-token>
-```
-
-<Admonition type="note">
-  The key used for the auth token inside the secret must be `auth-token`, as in the command above.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  serviceAccountName:
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set serviceAccountName=""
-  ```
-  </TabItem>
-</Tabs>
-
-## `log`
-
-### `log.level`
-
-<Admonition type="note">
-  This field used to be called `logLevel`. For backwards compatibility this name can still be used, but we recommend changing your values file to use `log.level`.
-</Admonition>
-
-| Type | Default value |
-| - | - |
-| `string` | `INFO` |
-
-`log.level` sets the log level used for the Teleport process.
-
-Available log levels (in order of most to least verbose) are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
-
-The default is `INFO`, which is recommended in production.
-
-`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    level: DEBUG
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.level=DEBUG
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.output`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `stderr` | ❌ | `teleport.log.output` |
-
-`log.output` sets the output destination for the Teleport process.
-
-This can be set to any of the built-in values: `stdout`, `stderr` or `syslog` to use that destination.
-
-The value can also be set to a file path (such as `/var/log/teleport.log`) to write logs to a file. Bear in mind that a few service startup messages will still go to `stderr` for resilience.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    output: stderr
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.output=stderr
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.format`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `text` | ❌ | `teleport.log.format.output` |
-
-`log.format` sets the output type for the Teleport process.
-
-Possible values are `text` (default) or `json`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    format: json
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.format=json
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.extraFields`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `list` | `["timestamp", "level", "component", "caller"]` | ❌ | `teleport.log.format.extra_fields` |
-
-`log.extraFields` sets the fields used in logging for the Teleport process.
-
-See the [Teleport config file reference](../../setup/reference/config.mdx) for more details on possible values for `extra_fields`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    extraFields: ["timestamp", "level"]
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set "log.extraFields[0]=timestamp" \
-  --set "log.extraFields[1]=level"
-  ```
-  </TabItem>
-</Tabs>
-
-## `affinity`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅ |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
-
-Kubernetes affinity to set for pod assignments.
-
-<Admonition type="note">
-  You cannot set both `affinity` and `highAvailability.requireAntiAffinity` as they conflict with each other.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: gravitational.io/dedicated
-            operator: In
-            values:
-            - teleport
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key=gravitational.io/dedicated \
-  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
-  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=teleport
-  ```
-  </TabItem>
-</Tabs>
-
-## `nodeSelector`
-
-| Type | Default value |
-| - | - |
-| `object` | `{}` |
-
-`nodeSelector` can be used to add a map of key-value pairs to constrain the nodes the agent pods will run on.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  nodeSelector:
-    role: node
-    region: us-east
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set nodeSelector.role=node \
-  --set nodeSelector.region=us-east
-  ```
-  </TabItem>
-</Tabs>
-
-## `annotations.config`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `object` | `{}` | ❌ | None |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
-
-<Admonition type="note">
-  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
-  In this instance, you should apply annotations manually to your created `ConfigMap`.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    config:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.config."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.deployment`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `Deployment` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    deployment:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.deployment."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.pod`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to each `Pod` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    pod:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.pod."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.serviceAccount`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `ServiceAccount` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    serviceAccount:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.serviceAccount."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `extraVolumes`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-A list of extra Kubernetes `Volumes` which should be available to any `Pod` created by the chart. These volumes
-will also be available to any `initContainers` configured by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraVolumes:
-  - name: myvolume
-    secret:
-      secretName: mysecret
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraVolumes[0].name=myvolume" \
-  --set "extraVolumes[0].secret.secretName=mysecret"
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraVolumeMounts`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-A list of extra Kubernetes volume mounts which should be mounted into any `Pod` created by the chart. These volume
-mounts will also be mounted into any `initContainers` configured by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraVolumeMounts:
-  - name: myvolume
-    mountPath: /path/to/mount/volume
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraVolumeMounts[0].name=myvolume" \
-  --set "extraVolumeMounts[0].path=/path/to/mount/volume"
-  ```
-  </TabItem>
-</Tabs>
-
-## `imagePullPolicy`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `IfNotPresent` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
-
-Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  imagePullPolicy: Always
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set imagePullPolicy=Always
-  ```
-  </TabItem>
-</Tabs>
-
-## `initContainers`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
-
-A list of `initContainers` which will be run before the main Teleport container in any pod created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  initContainers:
-  - name: teleport-init
-    image: alpine
-    args: ['echo test']
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "initContainers[0].name=teleport-init" \
-  --set "initContainers[0].image=alpine" \
-  --set "initContainers[0].args={echo test}"
-  ```
-  </TabItem>
-</Tabs>
-
-## `resources`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
-
-Resource requests/limits which should be configured for each container inside the pod. These resource limits
-will also be applied to `initContainers`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  resources:
-    requests:
-      cpu: 1
-      memory: 2Gi
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set resources.requests.cpu=1 \
-  --set resources.requests.memory=2Gi
-  ```
-  </TabItem>
-</Tabs>
-
-## `tolerations`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
-
-Kubernetes Tolerations to set for pod assignment.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  tolerations:
-  - key: "dedicated"
-    operator: "Equal"
-    value: "teleport"
-    effect: "NoSchedule"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set tolerations[0].key=dedicated \
-  --set tolerations[0].operator=Equal \
-  --set tolerations[0].value=teleport \
-  --set tolerations[0].effect=NoSchedule
-  ```
-  </TabItem>
-</Tabs>
+</Tile>
+</TileSet>
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx b/docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx
new file mode 100644
index 0000000000000..d4205880d4cf9
--- /dev/null
+++ b/docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx
@@ -0,0 +1,1348 @@
+---
+title: teleport-cluster Chart Reference
+description: Values that can be set using the teleport-cluster Helm chart
+---
+
+The `teleport-cluster` Helm chart is used to deploy the Teleport Auth Service
+and Proxy Service, which is ideal for getting started with a self-hosted Teleport
+cluster on Kubernetes.
+
+<Notice scope={["cloud"]} type="warning">
+
+Teleport Cloud manages the Auth Service and Proxy Service for you. Use the
+`teleport-cluster` chart if you are interested in hosting Teleport yourself, or
+use the [`teleport-kube-agent`](./teleport-kube-agent.mdx) chart to deploy the
+Kubernetes Service, Application Service, or Database Service.
+
+</Notice>
+
+You can
+[browse the source on GitHub](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-cluster).
+
+The `teleport-cluster` chart runs two Teleport services:
+
+| Teleport service | Purpose | Documentation |
+| - | - | - |
+| `auth_service` | Authenticates users and hosts, and issues certificates | [Auth documentation](../../../architecture/authentication.mdx)
+| `proxy_service`| Runs the externally-facing parts of a Teleport cluster, such as the web UI, SSH proxy and reverse tunnel service | [Proxy documentation](../../../architecture/proxy.mdx) |
+
+The `teleport-cluster` chart can be deployed in four different modes. Get started with a guide for each mode:
+
+| `chartMode` | Guide |
+| - | - |
+| `standalone` | [Getting started with Kubernetes Access](../../../getting-started.mdx) |
+| `aws` | [Running an HA Teleport cluster using an AWS EKS Cluster](../guides/aws.mdx) |
+| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../guides/gcp.mdx) |
+| `custom` | [Running a Teleport cluster with a custom config](../guides/custom.mdx) |
+
+This reference details available values for the `teleport-cluster` chart.
+
+(!docs/pages/includes/backup-warning.mdx!)
+
+## `clusterName`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `nil` | When `chartMode` is `aws`, `gcp` or `standalone` | `auth_service.cluster_name`, `proxy_service.public_addr` | ✅ |
+
+`clusterName` controls the name used to refer to the Teleport cluster, along with the externally-facing public address to use to access it.
+
+<Admonition type="note">
+  If using a fully qualified domain name as your `clusterName`, you will also need to configure the DNS provider for this domain to point
+  to the external load balancer address of your Teleport cluster.
+
+  (!docs/pages/kubernetes-access/helm/includes/kubernetes-externaladdress.mdx!)
+
+  You will need to manually add a DNS A record pointing `teleport.example.com` to either the IP or hostname of the Kubernetes load balancer.
+
+<Details title="Using Application Access?">
+(!docs/pages/includes/dns-app-access.mdx!)
+</Details>
+
+  If you are not using ACME certificates, you may also need to accept insecure warnings in your browser to view the page successfully.
+</Admonition>
+
+
+## `kubeClusterName`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `clusterName` value | no | `kubernetes_service.kube_cluster_name` |  ✅ |
+
+`kubeClusterName` sets the name used for the Kubernetes cluster. This name will be shown to Teleport users connecting to the cluster.
+
+## `authenticationType`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `local` | Yes | `auth_service.authentication.type` | ❌ |
+
+`authenticationType` controls the authentication scheme used by Teleport. Possible values are `local` and `github` for OSS, plus `oidc`, `saml`, and `false` for Enterprise.
+
+## `authenticationSecondFactor`
+
+### `authenticationSecondFactor.secondFactor`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `otp` | Yes | `auth_service.authentication.second_factor` | ❌ |
+
+`authenticationSecondFactor.secondFactor` controls the second factor used for local user authentication. Possible values supported by this chart
+are `off` (not recommended), `on`, `otp`, `optional` and `webauthn`.
+
+When set to `on`, `optional` or `webauthn`, the `authenticationSecondFactor.webauthn` section can also be used. The configured `rp_id` defaults to
+the FQDN which is used to access the Teleport cluster.
+
+### `authenticationSecondFactor.webauthn`
+
+See [Second Factor - WebAuthn](../../../access-controls/guides/webauthn.mdx) for more details.
+
+#### `authenticationSecondFactor.webauthn.attestationAllowedCas`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `array` | `[]` | No | `auth_service.authentication.webauthn.attestation_allowed_cas` | ❌ |
+
+`authenticationSecondFactor.webauthn.attestationAllowedCas` is an optional allow list of certificate authorities (as local file paths or in-line PEM certificate string) for
+[device verification](https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html).
+This field allows you to restrict which device models and vendors you trust.
+Devices outside of the list will be rejected during registration.
+By default all devices are allowed.
+
+#### `authenticationSecondFactor.webauthn.attestationDeniedCas`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `array` | `[]` | No | `auth_service.authentication.webauthn.attestation_denied_cas` | ❌ |
+
+`authenticationSecondFactor.webauthn.attestationDeniedCas` is optional deny list of certificate authorities (as local file paths or in-line PEM certificate string) for
+[device verification](https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html).
+This field allows you to forbid specific device models and vendors, while allowing all others (provided they clear attestation_allowed_cas as well).
+Devices within this list will be rejected during registration.
+By default no devices are forbidden.
+
+## `proxyListenerMode`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `nil` | no | `auth_service.proxy_listener_mode` | ❌ |
+
+`proxyListenerMode` controls proxy TLS routing used by Teleport. Possible values are `multiplex`.
+
+## `enterprise`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `false`| ✅ |
+
+`enterprise` controls whether to use Teleport Community Edition or Teleport Enterprise.
+
+Setting `enterprise` to `true` will use the Teleport Enterprise image.
+
+You will also need to download your Enterprise license from the Teleport dashboard and add it as a Kubernetes secret to use this:
+
+```code
+$ kubectl --namespace teleport create secret generic license --from-file=/path/to/downloaded/license.pem
+```
+
+<Admonition type="tip">
+  If you installed the Teleport chart into a specific namespace, the `license` secret you create must also be added to the same namespace.
+</Admonition>
+
+<Admonition type="note">
+  The file added to the secret must be called `license.pem`. If you have renamed it, you can specify the filename to use in the secret creation command:
+
+  ```code
+  $ kubectl --namespace teleport create secret generic license --from-file=license.pem=/path/to/downloaded/this-is-my-teleport-license.pem
+  ```
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  enterprise: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set enterprise=true
+  ```
+  </TabItem>
+</Tabs>
+
+## `teleportVersionOverride`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `nil` | ✅ |
+
+Normally the version of Teleport being used will match the version of the chart being installed. If you install chart version
+7.0.0, you'll be using Teleport 7.0.0. Upgrading the Helm chart will use the latest version from the repo.
+
+You can optionally override this to use a different published Teleport Docker image tag like `6.0.2` or `7`.
+
+See these links for information on Docker image versions:
+
+- [Community Docker image information](../../../setup/guides/docker.mdx#step-14-pick-your-image)
+- [Enterprise Docker image information](../../../enterprise/getting-started.mdx#run-teleport-enterprise-using-docker)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  teleportVersionOverride: "7"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set teleportVersionOverride="7"
+  ```
+  </TabItem>
+</Tabs>
+
+## `acme`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `bool` | `false` | ❌ | `proxy_service.acme.enabled` |
+
+ACME is a protocol for getting Web X.509 certificates.
+
+Setting acme to `true` enables the ACME protocol and will attempt to get a free TLS certificate from Let's Encrypt.
+Setting acme to `false` (the default) will cause Teleport to generate and use self-signed certificates for its web UI.
+
+<Admonition type="note">
+  ACME can only be used for single-pod clusters. It is not suitable for use in HA configurations.
+</Admonition>
+
+<Admonition type="warning">
+  Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
+  cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
+
+  One option might be to use Teleport's built-in ACME support or enable [cert-manager support](#highavailabilitycertmanager).
+</Admonition>
+
+## `acmeEmail`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `nil`  | ❌ | `proxy_service.acme.email` |
+
+`acmeEmail` is the email address to provide during certificate registration (this is a Let's Encrypt requirement).
+
+## `acmeURI`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | Let's Encrypt production server | ❌ | `proxy_service.acme.uri` |
+
+`acmeURI` is the ACME server to use for getting certificates.
+
+As an example, this can be overridden to use the [Let's Encrypt staging server](https://letsencrypt.org/docs/staging-environment/) for testing.
+
+You can also use any other ACME-compatible server.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  acme: true
+  acmeEmail: user@email.com
+  acmeURI: https://acme-staging-v02.api.letsencrypt.org/directory
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set acme=true \
+  --set acmeEmail=user@email.com \
+  --set acmeURI=https://acme-staging-v02.api.letsencrypt.org/directory
+  ```
+  </TabItem>
+</Tabs>
+
+## `podSecurityPolicy`
+
+### `podSecurityPolicy.enabled`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `true` | ✅ |
+
+By default, Teleport charts also install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-cluster/templates/psp.yaml).
+
+To disable this, you can set `enabled` to `false`.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  podSecurityPolicy:
+    enabled: false
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set podSecurityPolicy.enabled=false
+  ```
+  </TabItem>
+</Tabs>
+
+## `labels`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `object` | `{}` | ❌ | `kubernetes_service.labels` |
+
+`labels` can be used to add a map of key-value pairs relating to the Teleport cluster being deployed. These labels can then be used with
+Teleport's RBAC policies to define access rules for the cluster.
+
+<Admonition type="note">
+  These are Teleport-specific RBAC labels, not Kubernetes labels.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  labels:
+    environment: production
+    region: us-east
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set labels.environment=production \
+  --set labels.region=us-east
+  ```
+  </TabItem>
+</Tabs>
+
+## `chartMode`
+
+| Type | Default value |
+| - | - |
+| `string` | `standalone` |
+
+`chartMode` is used to configure the chart's operation mode. You can find more information about each mode on its specific guide page:
+
+| `chartMode` | Guide |
+| - | - |
+| `standalone` | [Getting started with Kubernetes Access](../../../getting-started.mdx) |
+| `aws` | [Running an HA Teleport cluster using an AWS EKS Cluster](../guides/aws.mdx) |
+| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../guides/gcp.mdx) |
+| `custom` | [Running a Teleport cluster with a custom config](../guides/custom.mdx) |
+
+## `standalone`
+
+### `standalone.existingClaimName`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `nil` | ✅ |
+
+`standalone.existingClaimName` can be used to provide the name of a pre-existing `PersistentVolumeClaim` to use if desired.
+
+The default is left blank, which will automatically create a `PersistentVolumeClaim` to use for Teleport storage in `standalone` mode.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  standalone:
+    existingClaimName: my-existing-pvc-name
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set standalone.existingClaimName=my-existing-pvc-name
+  ```
+  </TabItem>
+</Tabs>
+
+### `standalone.volumeSize`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string`  | `10Gi` | ✅ |
+
+You can set `volumeSize` to request a different size of persistent volume when installing the Teleport chart in `standalone` mode.
+
+<Admonition type="note">
+  `volumeSize` will be ignored if `existingClaimName` is set.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  standalone:
+    volumeSize: 50Gi
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set standalone.volumeSize=50Gi
+  ```
+  </TabItem>
+</Tabs>
+
+## `aws`
+
+| Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - |
+| ❌ | See [Using DynamoDB](../../../setup/reference/backends.mdx#dynamodb) and [Using Amazon S3](../../../setup/reference/backends.mdx#s3) for details |
+
+`aws` settings are described in the AWS guide: [Running an HA Teleport cluster using an AWS EKS Cluster](../guides/aws.mdx)
+
+## `gcp`
+
+| Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - |
+| ❌ | See [Using Firestore](../../../setup/reference/backends.mdx#dynamodb) and [Using GCS](../../../setup/reference/backends.mdx#gcs) for details |
+
+`gcp` settings are described in the GCP guide: [Running an HA Teleport cluster using a Google Cloud GKE cluster](../guides/gcp.mdx)
+
+### `highAvailability`
+
+## `highAvailability.replicaCount`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `int` | `1` | ✅ (when using HA storage) |
+
+`highAvailability.replicaCount` can be used to set the number of replicas used in the deployment.
+
+Set to a number higher than `1` for a high availability mode where multiple Teleport pods will be deployed and connections will be load balanced between them.
+
+<Admonition type="note">
+  Setting `highAvailability.replicaCount` to a value higher than `1` will disable the use of ACME certs.
+</Admonition>
+
+<Admonition type="tip" title="Sizing guidelines">
+  As a rough guide, we recommend configuring one replica per distinct availability zone where your cluster has worker nodes.
+
+  2 replicas/availability zones will be fine for smaller workloads. 3-5 replicas/availability zones will be more appropriate for bigger
+  clusters with more traffic.
+</Admonition>
+
+<Admonition type="warning">
+  When using `custom` mode, you **must** use highly-available storage (e.g. etcd, DynamoDB or Firestore) for multiple replicas to be supported.
+
+  [Information on supported Teleport storage backends](../../../architecture/authentication.mdx#storage-back-ends)
+
+  Manually configuring NFS-based storage or `ReadWriteMany` volume claims is **NOT** supported for an HA deployment and will result in errors.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    replicaCount: 3
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set highAvailability.replicaCount=3
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.requireAntiAffinity`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `false` | ✅ (when using HA storage) |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
+
+Setting `highAvailability.requireAntiAffinity` to `true` will use `requiredDuringSchedulingIgnoredDuringExecution` to require that multiple
+Teleport pods must not be scheduled on the same physical host.
+
+<Admonition type="warning">
+  This can result in Teleport pods failing to be scheduled in very small clusters or during node downtime, so should be used with caution.
+</Admonition>
+
+ Setting `highAvailability.requireAntiAffinity` to `false` (the default) uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
+ anti-affinity a soft requirement.
+
+<Admonition type="note">
+  This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    requireAntiAffinity: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set highAvailability.requireAntiAffinity=true
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.podDisruptionBudget`
+
+### `highAvailability.podDisruptionBudget.enabled`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `false` | ✅ (when using HA storage) |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      enabled: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.enabled=true
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.podDisruptionBudget.minAvailable`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `int` | `1` | ✅ (when using HA storage) |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      minAvailable: 1
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.minAvailable=1
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.certManager`
+
+See the [cert-manager](https://cert-manager.io/docs/) docs for more information.
+
+### `highAvailability.certManager.enabled`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `bool` | `false` | ❌ | `proxy_service.https_keypairs` (to provide your own certificates) |
+
+Setting `highAvailability.certManager.enabled` to `true` will use `cert-manager` to provision a TLS certificate for a Teleport
+cluster deployed in HA mode.
+
+<Admonition type="note" title="Installing cert-manager">
+  You must install and configure `cert-manager` in your Kubernetes cluster yourself.
+
+  See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
+  and the relevant sections of the [AWS](../guides/aws.mdx#step-47-install-and-configure-cert-manager) and [GCP](../guides/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
+</Admonition>
+
+### `highAvailability.certManager.addCommonName`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `bool` | `false` | ❌ | `proxy_service.https_keypairs` (to provide your own certificates) |
+
+Setting `highAvailability.certManager.addCommonName` to `true` will instruct `cert-manager` to set the commonName field in its certificate signing request to the issuing CA.
+
+<Admonition type="note" title="Enabling common name field">
+  You must install and configure `cert-manager` in your Kubernetes cluster yourself.
+
+  See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
+  and the relevant sections of the [AWS](../guides/aws.mdx#step-47-install-and-configure-cert-manager) and [GCP](../guides/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    certManager:
+      enabled: true
+      addCommonName: true
+      issuerName: letsencrypt-production
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set highAvailability.certManager.enabled=true \
+  --set highAvailability.certManager.addCommonName=true \
+  --set highAvailability.certManager.issuerName=letsencrypt-production
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.certManager.issuerName`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `nil` | ❌ | None |
+
+Sets the name of the `cert-manager` `Issuer` or `ClusterIssuer` to use for issuing certificates.
+
+<Admonition type="note" title="Configuring an Issuer">
+  You must install configure an appropriate `Issuer` supporting a DNS01 challenge yourself.
+
+  Please see the [cert-manager DNS01 docs](https://cert-manager.io/docs/configuration/acme/dns01/#supported-dns01-providers) and the relevant sections
+  of the [AWS](../guides/aws.mdx#step-47-install-and-configure-cert-manager) and [GCP](../guides/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    certManager:
+      enabled: true
+      issuerName: letsencrypt-production
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set highAvailability.certManager.enabled=true \
+  --set highAvailability.certManager.issuerName=letsencrypt-production
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.certManager.issuerKind`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `Issuer` | ❌ | None |
+
+Sets the `Kind` of `Issuer` to be used when issuing certificates with `cert-manager`. Defaults to `Issuer` to keep permissions
+scoped to a single namespace.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    certManager:
+      issuerKind: ClusterIssuer
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set highAvailability.certManager.issuerKind=ClusterIssuer
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.certManager.issuerGroup`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `cert-manager.io` | ❌ | None |
+
+Sets the `Group` of `Issuer` to be used when issuing certificates with `cert-manager`. Defaults to `cert-manager.io` to use built-in issuers.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    certManager:
+      issuerGroup: cert-manager.io
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set highAvailability.certManager.issuerGroup=cert-manager.io
+  ```
+  </TabItem>
+</Tabs>
+
+## `image`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `quay.io/gravitational/teleport` | ✅ |
+
+`image` sets the container image used for Teleport Community pods in the cluster.
+
+You can override this to use your own Teleport Community image rather than a Teleport-published image.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  image: my.docker.registry/teleport-community-image-name
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set image=my.docker.registry/teleport-community-image-name
+  ```
+  </TabItem>
+</Tabs>
+
+## `enterpriseImage`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `quay.io/gravitational/teleport-ent` | ✅ |
+
+`enterpriseImage` sets the container image used for Teleport Enterprise pods in the cluster.
+
+You can override this to use your own Teleport Enterprise image rather than a Teleport-published image.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  enterpriseImage: my.docker.registry/teleport-enterprise-image-name
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set enterpriseImage=my.docker.registry/teleport-enterprise-image
+  ```
+  </TabItem>
+</Tabs>
+
+## `log`
+
+### `log.level`
+
+<Admonition type="note">
+  This field used to be called `logLevel`. For backwards compatibility this name can still be used, but we recommend changing your values file to use `log.level`.
+</Admonition>
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `INFO` | ❌ | `teleport.log.severity` |
+
+`log.level` sets the log level used for the Teleport process.
+
+Available log levels (in order of most to least verbose) are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
+
+The default is `INFO`, which is recommended in production.
+
+`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    level: DEBUG
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.level=DEBUG
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.output`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `stderr` | ❌ | `teleport.log.output` |
+
+`log.output` sets the output destination for the Teleport process.
+
+This can be set to any of the built-in values: `stdout`, `stderr` or `syslog` to use that destination.
+
+The value can also be set to a file path (such as `/var/log/teleport.log`) to write logs to a file. Bear in mind that a few service startup messages will still go to `stderr` for resilience.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    output: stderr
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.output=stderr
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.format`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `text` | ❌ | `teleport.log.format.output` |
+
+`log.format` sets the output type for the Teleport process.
+
+Possible values are `text` (default) or `json`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    format: json
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.format=json
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.extraFields`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `list` | `["timestamp", "level", "component", "caller"]` | ❌ | `teleport.log.format.extra_fields` |
+
+`log.extraFields` sets the fields used in logging for the Teleport process.
+
+See the [Teleport config file reference](../../../setup/reference/config.mdx) for more details on possible values for `extra_fields`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    extraFields: ["timestamp", "level"]
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set "log.extraFields[0]=timestamp" \
+  --set "log.extraFields[1]=level"
+  ```
+  </TabItem>
+</Tabs>
+
+## `affinity`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅ |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
+
+Kubernetes affinity to set for pod assignments.
+
+<Admonition type="note">
+  You cannot set both `affinity` and `highAvailability.requireAntiAffinity` as they conflict with each other. Only set one or the other.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: gravitational.io/dedicated
+            operator: In
+            values:
+            - teleport
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key=gravitational.io/dedicated \
+  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
+  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=teleport
+  ```
+  </TabItem>
+</Tabs>
+
+## `annotations.config`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `object` | `{}` | ❌ | None |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
+
+<Admonition type="note">
+  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
+  In this instance, you should apply annotations manually to your created `ConfigMap`.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    config:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.config."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.deployment`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `Deployment` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    deployment:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.deployment."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.pod`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to each `Pod` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    pod:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.pod."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.service`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `Service` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    service:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.service."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.serviceAccount`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `serviceAccount` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    serviceAccount:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.serviceAccount."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.certSecret`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `secret` generated by
+`cert-manager` from the `certificate` created by the chart.  Only valid when
+`highAvailability.certManager.enabled` is set to `true` and requires
+`cert-manager` v1.5.0+.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    certSecret:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.certSecret."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `service.type`
+
+| Type | Default value | Required? | Can be used in `custom` mode? |
+| - | - | - | - |
+| `string` | `LoadBalancer` | Yes | ✅ |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/services-networking/service/)
+
+Allows to specify the service type.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  service:
+    type: LoadBalancer
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set service.type=LoadBalancer
+  ```
+  </TabItem>
+</Tabs>
+
+## `service.spec.loadBalancerIP`
+
+| Type | Default value | Required? | Can be used in `custom` mode? |
+| - | - | - | - |
+| `string` | `nil` | No | ✅ |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer)
+
+Allows to specify the `loadBalancerIP`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  service:
+    spec:
+      loadBalancerIP: 1.2.3.4
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set service.spec.loadBalancerIP=1.2.3.4
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraArgs`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+A list of extra arguments to pass to the `teleport start` command when running a Teleport Pod.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraArgs:
+  - "--bootstrap=/etc/teleport-bootstrap/roles.yaml"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraArgs={--bootstrap=/etc/teleport-bootstrap/roles.yaml}"
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraEnv`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
+
+A list of extra environment variables to be set on the main Teleport container.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraEnv:
+  - name: MY_ENV
+    value: my-value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraEnv[0].name=MY_ENV" \
+  --set "extraEnv[0].value=my-value"
+  ```
+  </TabItem>
+</Tabs>
+
+
+## `extraVolumes`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+A list of extra Kubernetes `Volumes` which should be available to any `Pod` created by the chart. These volumes
+will also be available to any `initContainers` configured by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraVolumes:
+  - name: myvolume
+    secret:
+      secretName: mysecret
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraVolumes[0].name=myvolume" \
+  --set "extraVolumes[0].secret.secretName=mysecret"
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraVolumeMounts`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+A list of extra Kubernetes volume mounts which should be mounted into any `Pod` created by the chart. These volume
+mounts will also be mounted into any `initContainers` configured by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraVolumeMounts:
+  - name: myvolume
+    mountPath: /path/to/mount/volume
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraVolumeMounts[0].name=myvolume" \
+  --set "extraVolumeMounts[0].path=/path/to/mount/volume"
+  ```
+  </TabItem>
+</Tabs>
+
+## `imagePullPolicy`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `IfNotPresent` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
+
+Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  imagePullPolicy: Always
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set imagePullPolicy=Always
+  ```
+  </TabItem>
+</Tabs>
+
+## `initContainers`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
+
+A list of `initContainers` which will be run before the main Teleport container in any pod created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  initContainers:
+  - name: teleport-init
+    image: alpine
+    args: ['echo test']
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "initContainers[0].name=teleport-init" \
+  --set "initContainers[0].image=alpine" \
+  --set "initContainers[0].args={echo test}"
+  ```
+  </TabItem>
+</Tabs>
+
+## `postStart`
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/)
+
+A `postStart` lifecycle handler to be configured on the main Teleport container.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  postStart:
+    command:
+    - echo
+    - foo
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set "postStart.command[0]=echo" \
+  --set "postStart.command[1]=foo"
+  ```
+  </TabItem>
+</Tabs>
+
+## `resources`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
+
+Resource requests/limits which should be configured for each container inside the pod. These resource limits
+will also be applied to `initContainers`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  resources:
+    requests:
+      cpu: 1
+      memory: 2Gi
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set resources.requests.cpu=1 \
+  --set resources.requests.memory=2Gi
+  ```
+  </TabItem>
+</Tabs>
+
+## `tolerations`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+
+Kubernetes Tolerations to set for pod assignment.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  tolerations:
+  - key: "dedicated"
+    operator: "Equal"
+    value: "teleport"
+    effect: "NoSchedule"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set tolerations[0].key=dedicated \
+  --set tolerations[0].operator=Equal \
+  --set tolerations[0].value=teleport \
+  --set tolerations[0].effect=NoSchedule
+  ```
+  </TabItem>
+</Tabs>
+
+## `priorityClassName`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `""` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
+
+Kubernetes PriorityClass to set for pod.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  priorityClassName: "system-cluster-critical"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set priorityClassName=system-cluster-critical
+  ```
+  </TabItem>
+</Tabs>
+
diff --git a/docs/pages/kubernetes-access/helm/reference/teleport-kube-agent.mdx b/docs/pages/kubernetes-access/helm/reference/teleport-kube-agent.mdx
new file mode 100644
index 0000000000000..ef76f14e59562
--- /dev/null
+++ b/docs/pages/kubernetes-access/helm/reference/teleport-kube-agent.mdx
@@ -0,0 +1,1334 @@
+---
+title: teleport-kube-agent Chart Reference
+description: Values that can be set using the teleport-cluster Helm chart
+---
+
+The `teleport-kube-agent` Helm chart is used to configure a Teleport agent that
+runs in a remote Kubernetes cluster and joins back to a Teleport cluster to
+provide access to services running there.
+
+You can [browse the source on GitHub](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-kube-agent).
+
+The `teleport-kube-agent` chart can run any or all of three Teleport services:
+
+| Teleport service | Name for `roles` and `tctl tokens add` | Purpose |
+| - | - | - |
+| [`kubernetes_service`](../../../kubernetes-access/guides.mdx) | `kube` | Uses Teleport to handle authentication with and proxy access to a Kubernetes cluster |
+| [`application_service`](../../../application-access/guides.mdx) | `app` | Uses Teleport to handle authentication with and proxy access to web-based applications |
+| [`database_service`](../../../database-access/guides.mdx) | `db` | Uses Teleport to handle authentication with and proxy access to databases |
+
+This reference details available values for the `teleport-kube-agent` chart.
+
+(!docs/pages/includes/backup-warning.mdx!)
+
+## `roles`
+
+This parameter is not mandatory to preserve backwards compatibility with older chart versions, but we recommend it is set.
+
+| Type | Default value |
+| - | - |
+| `string` | `kube` |
+
+`roles` is a comma-separated list of services which should be enabled when running the `teleport-kube-agent` chart.
+
+| Services | Value for `roles` | Mandatory additional settings for this role |
+| - | - | - |
+| Teleport Kubernetes service | `kube` | [`kubeClusterName`](#kubeclustername) |
+| Teleport Application service | `app` | [`apps`](#apps) |
+| Teleport Database service | `db` | [`databases`](#databases) |
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  roles: kube,app,db
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set roles=kube\,app\,db
+  ```
+
+  <Admonition type="note">
+    When specifying multiple roles using `--set` syntax, you must escape the commas using a backslash (`\`).
+
+    This is a quirk of Helm's CLI parser.
+  </Admonition>
+
+  </TabItem>
+</Tabs>
+
+If you specify a role here, you may also need to specify some other settings which are detailed in this reference.
+
+## `authToken`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `string` | `nil` | Yes |
+
+`authToken` provides a Teleport join token which will be used to join the Teleport agent to a Teleport cluster.
+
+This value **must** be provided for the chart to work. The token that you use must also be valid for every Teleport service that you
+are trying to add with the `teleport-kube-agent` chart. Here are a few examples:
+
+| Services | Service Name | `tctl tokens add` example | `teleport.yaml` static token example |
+| - | - | - | - |
+| Kubernetes | `kube` | `tctl tokens add --type=kube` | `"kube:<replace-with-actual-token>"` |
+| Kubernetes, Application | `kube,app` | `tctl tokens add --type=kube,app` | `"kube,app:<replace-with-actual-token>"` |
+| Kubernetes, Application, Database | `kube,app,db` | `tctl tokens add --type=kube,app,db` | `"kube,app,db:<replace-with-actual-token>"` |
+
+<Admonition type="note">
+  When you use a token, all of the services that it provides **must** be used.
+
+  For example, you cannot use a token of type `app,db` to only join a Teleport `app` service by itself. It must join both `app` and `db` services at once.
+
+  Also, each static token you configure must be unique, as the token itself is used to define which services will be supported.
+
+  You cannot reuse the same static token and specify a different set of services.
+</Admonition>
+
+If you do not have the correct services (Teleport refers to these internally as `Roles`) assigned to your join token, the Teleport agent will
+fail to join the Teleport cluster.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  authToken: <replace-with-actual-token>
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set authToken=<replace-with-actual-token>
+  ```
+  </TabItem>
+</Tabs>
+
+## `proxyAddr`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `string` | `nil` | Yes |
+
+`proxyAddr` provides the public-facing Teleport proxy endpoint which should be used to join the cluster. This is the same URL that is used
+to access the web UI of your Teleport cluster. It is the same as the value configured for `proxy_service.public_addr` in a traditional
+Teleport cluster. The port used is usually either 3080 or 443.
+
+Here are a few examples:
+
+| Deployment method | Example `proxy_service.public_addr` |
+| - | - |
+| On-prem Teleport cluster | `teleport.example.com:3080` |
+| Teleport Cloud cluster | `example.teleport.sh:443` |
+| `teleport-cluster` Helm chart | `teleport.example.com:443` |
+
+## `kubeClusterName`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `string` | `nil` | When `kube` chart role is used |
+
+`kubeClusterName` sets the name used for the Kubernetes cluster proxied by the Teleport agent. This name will be shown to Teleport users
+connecting to the cluster.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  kubeClusterName: my-gke-cluster
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set kubeClusterName=my-gke-cluster
+  ```
+  </TabItem>
+</Tabs>
+
+## `apps`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `list` | `[]` | When `app` chart role is used? |
+
+`apps` is a YAML list object detailing the applications that should be proxied by Teleport Application access.
+
+You can specify multiple apps by adding additional list elements.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  apps:
+  - name: grafana
+    uri: http://localhost:3000
+    labels:
+      purpose: monitoring
+  - name: jenkins
+    uri: http://jenkins:8080
+    labels:
+      purpose: ci
+  ```
+
+  <Admonition type="note" title="YAML formatting">
+    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
+    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
+  </Admonition>
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "apps[0].name=grafana" \
+  --set "apps[0].uri=http://localhost:3000" \
+  --set "apps[0].purpose=monitoring" \
+  --set "apps[1].name=grafana" \
+  --set "apps[1].uri=http://jenkins:8080" \
+  --set "apps[1].purpose=ci"
+  ```
+
+  <Admonition type="note">
+    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
+  </Admonition>
+
+  </TabItem>
+</Tabs>
+
+<Admonition type="tip" title="Supported values">
+  You can see a list of all the supported [values which can be used in a Teleport application access configuration here](../../../application-access/reference.mdx#configuration).
+</Admonition>
+
+## `awsDatabases`
+
+<Admonition type="tip" title="Database auto-discovery">
+  This section configures database auto-discovery, which is only currently supported on AWS. You can configure databases for other platforms using the [`databases`](#databases) section below this.
+</Admonition>
+
+<Admonition type="note" title="IAM roles">
+  For AWS database auto-discovery to work, your agent pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../../database-access/guides/rds.mdx#step-47-create-an-iam-policy-for-teleport).
+
+  After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions:
+
+  ```
+  annotations:
+    serviceAccount:
+      eks.amazonaws.com/role-arn: arn:aws:iam::1234567890:role/my-rds-autodiscovery-role
+  ```
+</Admonition>
+
+| Type | Default value | Required? |
+| - | - | - |
+| `list` | `[]` | No |
+
+`awsDatabases` is a YAML list object detailing the filters for the AWS databases that should be discovered and proxied by Teleport Database access.
+
+You can specify multiple database filters by adding additional list elements.
+
+- `types` is a list containing the types of AWS databases that should be discovered.
+- `regions` is a list of AWS regions which should be scanned for databases.
+- `tags` can be used to set AWS tags that must be matched for databases to be discovered.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  awsDatabases:
+    - types: ["rds"]
+      regions: ["us-east-1", "us-west-2"]
+      tags:
+        "environment": "production"
+    - types: ["rds"]
+      regions: ["us-east-1"]
+      tags:
+        "environment": "dev"
+    - types: ["rds"]
+      regions: ["eu-west-1"]
+      tags:
+        "*": "*"
+  ```
+
+  <Admonition type="note" title="YAML formatting">
+    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
+    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
+  </Admonition>
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set "awsDatabases[0].types[0]=rds" \
+  --set "awsDatabases[0].regions[0]=us-east-1" \
+  --set "awsDatabases[0].regions[1]=us-west-2" \
+  --set "awsDatabases[0].tags[0].environment=production" \
+  --set "awsDatabases[1].types[0]=rds" \
+  --set "awsDatabases[1].regions[0]=us-east-1" \
+  --set "awsDatabases[1].tags[0].environment=dev" \
+  --set "awsDatabases[2].types[0]=rds" \
+  --set "awsDatabases[2].regions[0]=eu-west-1" \
+  --set "awsDatabases[2].tags[0].*=*"
+  ```
+
+  <Admonition type="note">
+    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
+  </Admonition>
+
+  </TabItem>
+</Tabs>
+
+## `databases`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `list` | `[]` | When `db` chart role is used |
+
+`databases` is a YAML list object detailing the databases that should be proxied by Teleport Database access.
+
+You can specify multiple databases by adding additional list elements.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  databases:
+  - name: aurora-postgres
+    uri: postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432
+    protocol: postgres
+    aws:
+      region: us-east-1
+    static_labels:
+      env: staging
+  - name: mysql
+    uri: mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306
+    protocol: mysql
+    aws:
+      region: us-east-1
+    static_labels:
+      env: staging
+  ```
+
+  <Admonition type="note" title="YAML formatting">
+    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
+    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
+  </Admonition>
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "databases[0].name=aurora" \
+  --set "databases[0].uri=postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432" \
+  --set "databases[0].protocol=postgres" \
+  --set "databases[0].aws.region=us-east-1" \
+  --set "databases[0].static_labels.env=staging" \
+  --set "databases[1].name=mysql" \
+  --set "databases[1].uri=mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306" \
+  --set "databases[1].protocol=mysql" \
+  --set "databases[1].aws.region=us-east-1" \
+  --set "databases[1].static_labels.env=staging"
+  ```
+
+  <Admonition type="note">
+    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
+  </Admonition>
+
+  </TabItem>
+</Tabs>
+
+<Admonition type="tip" title="Supported values">
+  You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../../database-access/reference/configuration.mdx).
+</Admonition>
+
+## `teleportVersionOverride`
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+Normally the version of Teleport being used will match the version of the chart being installed. If you install chart version
+7.0.0, you'll be using Teleport 7.0.0.
+
+You can optionally override this to use a different published Teleport Docker image tag like `6.0.2` or `7`.
+
+See [this link for information on Community Docker image versions](../../../setup/guides/docker.mdx#step-14-pick-your-image).
+
+<Admonition type="note">
+  The `teleport-kube-agent` chart always runs using Teleport Community edition as it does not require any Enterprise features, so it does
+  not require a Teleport license file to be provided.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  teleportVersionOverride: "7"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set teleportVersionOverride="7"
+  ```
+  </TabItem>
+</Tabs>
+
+## `insecureSkipProxyTLSVerify`
+
+| Type | Default value |
+| - | - |
+| `bool` | `false` |
+
+When `insecureSkipProxyTLSVerify` is set to `true`, the agent will skip the verification of the TLS certificate presented by the Teleport
+proxy server specified using [`proxyAddr`](#proxyaddr).
+
+This can be used for joining a Teleport agent to a Teleport cluster which does not have valid TLS certificates for testing.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  insecureSkipProxyTLSVerify: false
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set insecureSkipProxyTLSVerify=false
+  ```
+  </TabItem>
+</Tabs>
+
+<Admonition type="warning">
+  Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
+  cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
+
+  One option might be to use Teleport's built-in [ACME support](./teleport-cluster.mdx#acme) or enable [cert-manager support](./teleport-cluster.mdx#highavailabilitycertmanager).
+</Admonition>
+
+## `existingDataVolume`
+
+| Type | Default value |
+| - | - |
+| `string` | `""` |
+
+When `existingDataVolume` is set to the name of an existing volume, the `/var/lib/teleport` mount will use this volume instead of creating a new `emptyDir` volume.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  existingDataVolume: my-volume
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set existingDataVolume=my-volume
+  ```
+  </TabItem>
+</Tabs>
+
+## `podSecurityPolicy`
+
+### `podSecurityPolicy.enabled`
+
+| Type | Default value |
+| - | - |
+| `bool` | `true` |
+
+By default, Teleport charts also install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-kube-agent/templates/psp.yaml).
+
+To disable this, you can set `enabled` to `false`.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  podSecurityPolicy:
+    enabled: false
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set podSecurityPolicy.enabled=false
+  ```
+  </TabItem>
+</Tabs>
+
+## `labels`
+
+| Type | Default value |
+| - | - |
+| `object` | `{}` |
+
+`labels` can be used to add a map of key-value pairs for the `kubernetes_service` which is deployed using the `teleport-kube-agent` chart.
+These labels can then be used with Teleport's RBAC policies to define access rules for the cluster.
+
+<Admonition type="note">
+  These are Teleport-specific RBAC labels, not Kubernetes labels.
+</Admonition>
+
+<Admonition type="note">
+  For historical/backwards compatibility reasons, these labels will only be applied to the Kubernetes cluster being joined via the
+  Teleport Kubernetes service.
+
+  To set labels for applications, add a `labels` element to the [`apps`](#apps) section.
+  To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section.
+
+  For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../../setup/admin/labels.mdx).
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  labels:
+    environment: production
+    region: us-east
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set labels.environment=production \
+  --set labels.region=us-east
+  ```
+  </TabItem>
+</Tabs>
+
+## `storage`
+
+### `storage.enabled`
+
+| Type | Default value |
+| - | - |
+| `bool` | `false` |
+
+Enables the creation of a Kubernetes persistent volume to hold Teleport agent state.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  storage:
+    enabled: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set storage.enabled=true
+  ```
+  </TabItem>
+</Tabs>
+
+### `storage.storageClassName`
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+The storage class name the persistent volume should use when creating persistent volume claims. The provided storage class
+name needs to exist on the Kubernetes cluster for Teleport to use.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/storage-classes/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  storage:
+    storageClassName: teleport-storage-class
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set storage.storageClassName=teleport-storage-class
+  ```
+  </TabItem>
+</Tabs>
+
+### `storage.requests`
+
+| Type | Default value |
+| - | - |
+| `string` | `128Mi` |
+
+The size of persistent volume to create.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  storage:
+    requests: 128Mi
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set storage.requests=128Mi
+  ```
+  </TabItem>
+</Tabs>
+
+## `image`
+
+| Type | Default value |
+| - | - |
+| `string` | `quay.io/gravitational/teleport` |
+
+`image` sets the container image used for Teleport pods run by the `teleport-kube-agent` chart.
+
+You can override this to use your own Teleport image rather than a Teleport-published image.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  image: my.docker.registry/teleport-image-name
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set image=my.docker.registry/teleport-image-name
+  ```
+  </TabItem>
+</Tabs>
+
+## `imagePullSecrets`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
+
+A list of secrets containing authorization tokens which can be optionally used to access a private Docker registry.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  imagePullSecrets:
+  - name: my-docker-registry-key
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set "imagePullSecrets[0].name=my-docker-registry-key"
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability`
+
+## `highAvailability.replicaCount`
+
+| Type | Default value |
+| - | - |
+| `int` | `1` |
+
+`highAvailability.replicaCount` can be used to set the number of replicas used in the deployment.
+
+Set to a number higher than `1` for a high availability mode where multiple Teleport agent pods will be deployed.
+
+<Admonition type="tip" title="Sizing guidelines">
+  As a rough guide, we recommend configuring one replica per distinct availability zone where your cluster has worker nodes.
+
+  2 replicas/availability zones will be fine for smaller workloads. 3-5 replicas/availability zones will be more appropriate for bigger
+  clusters with more traffic.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    replicaCount: 3
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.replicaCount=3
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.requireAntiAffinity`
+
+| Type | Default value |
+| - | - |
+| `bool` | `false` |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
+
+Setting `highAvailability.requireAntiAffinity` to `true` will use `requiredDuringSchedulingIgnoredDuringExecution` to require that multiple
+Teleport pods must not be scheduled on the same physical host.
+
+<Admonition type="warning">
+  This can result in Teleport pods failing to be scheduled in very small clusters or during node downtime, so should be used with caution.
+</Admonition>
+
+ Setting `highAvailability.requireAntiAffinity` to `false` (the default) uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
+ anti-affinity a soft requirement.
+
+<Admonition type="note">
+  This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    requireAntiAffinity: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.requireAntiAffinity=true
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.podDisruptionBudget`
+
+### `highAvailability.podDisruptionBudget.enabled`
+
+| Type | Default value |
+| - | - |
+| `bool` | `false` |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      enabled: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.enabled=true
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.podDisruptionBudget.minAvailable`
+
+| Type | Default value |
+| - | - |
+| `int` | `1` |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      minAvailable: 1
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.minAvailable=1
+  ```
+  </TabItem>
+</Tabs>
+
+## `clusterRoleName`
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+`clusterRoleName` can be optionally used to override the name of the Kubernetes `ClusterRole` used by the `teleport-kube-agent` chart's `ServiceAccount`.
+
+<Admonition type="note">
+  Most users will not need to change this.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  clusterRoleName: kubernetes-clusterrole
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set clusterRoleName=kubernetes-clusterrole
+  ```
+  </TabItem>
+</Tabs>
+
+## `clusterRoleBindingName`
+
+<Admonition type="note">
+  Most users will not need to change this.
+</Admonition>
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+
+`clusterRoleBindingName` can be optionally used to override the name of the Kubernetes `ClusterRoleBinding` used by the `teleport-kube-agent` chart's `ServiceAccount`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  clusterRoleBindingName: kubernetes-clusterrolebinding
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set clusterRoleBindingName=kubernetes-clusterrolebinding
+  ```
+  </TabItem>
+</Tabs>
+
+## `serviceAccountName`
+
+<Admonition type="note">
+  Most users will not need to change this.
+</Admonition>
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+`serviceAccountName` can be optionally used to override the name of the Kubernetes `ServiceAccount` used by the `teleport-kube-agent` chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  serviceAccountName: kubernetes-serviceaccount
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set serviceAccountName=kubernetes-serviceaccount
+  ```
+  </TabItem>
+</Tabs>
+
+## `secretName`
+
+| Type | Default value |
+| - | - |
+| `string` | `teleport-kube-agent-join-token` |
+
+`secretName` is the name of the Kubernetes `Secret` used to store the Teleport join token which is used by the `teleport-kube-agent` chart.
+
+If you set this to a blank value, the chart will not attempt to create the secret itself and will instead read the value of the
+existing `teleport-kube-agent-join-token` secret. This allows you to configure this secret externally and avoid having a plaintext
+join token stored in your Teleport chart values.
+
+To create your own join token secret, you can use a command like this:
+
+```code
+$ kubectl --namespace teleport create secret generic teleport-kube-agent-join-token --from-literal=auth-token=<replace-with-actual-token>
+```
+
+<Admonition type="note">
+  The key used for the auth token inside the secret must be `auth-token`, as in the command above.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  serviceAccountName:
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set serviceAccountName=""
+  ```
+  </TabItem>
+</Tabs>
+
+## `log`
+
+### `log.level`
+
+<Admonition type="note">
+  This field used to be called `logLevel`. For backwards compatibility this name can still be used, but we recommend changing your values file to use `log.level`.
+</Admonition>
+
+| Type | Default value |
+| - | - |
+| `string` | `INFO` |
+
+`log.level` sets the log level used for the Teleport process.
+
+Available log levels (in order of most to least verbose) are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
+
+The default is `INFO`, which is recommended in production.
+
+`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    level: DEBUG
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.level=DEBUG
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.output`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `stderr` | ❌ | `teleport.log.output` |
+
+`log.output` sets the output destination for the Teleport process.
+
+This can be set to any of the built-in values: `stdout`, `stderr` or `syslog` to use that destination.
+
+The value can also be set to a file path (such as `/var/log/teleport.log`) to write logs to a file. Bear in mind that a few service startup messages will still go to `stderr` for resilience.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    output: stderr
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.output=stderr
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.format`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `text` | ❌ | `teleport.log.format.output` |
+
+`log.format` sets the output type for the Teleport process.
+
+Possible values are `text` (default) or `json`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    format: json
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.format=json
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.extraFields`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `list` | `["timestamp", "level", "component", "caller"]` | ❌ | `teleport.log.format.extra_fields` |
+
+`log.extraFields` sets the fields used in logging for the Teleport process.
+
+See the [Teleport config file reference](../../../setup/reference/config.mdx) for more details on possible values for `extra_fields`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    extraFields: ["timestamp", "level"]
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set "log.extraFields[0]=timestamp" \
+  --set "log.extraFields[1]=level"
+  ```
+  </TabItem>
+</Tabs>
+
+## `affinity`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅ |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
+
+Kubernetes affinity to set for pod assignments.
+
+<Admonition type="note">
+  You cannot set both `affinity` and `highAvailability.requireAntiAffinity` as they conflict with each other.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: gravitational.io/dedicated
+            operator: In
+            values:
+            - teleport
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key=gravitational.io/dedicated \
+  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
+  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=teleport
+  ```
+  </TabItem>
+</Tabs>
+
+## `nodeSelector`
+
+| Type | Default value |
+| - | - |
+| `object` | `{}` |
+
+`nodeSelector` can be used to add a map of key-value pairs to constrain the nodes the agent pods will run on.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  nodeSelector:
+    role: node
+    region: us-east
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set nodeSelector.role=node \
+  --set nodeSelector.region=us-east
+  ```
+  </TabItem>
+</Tabs>
+
+## `annotations.config`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `object` | `{}` | ❌ | None |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
+
+<Admonition type="note">
+  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
+  In this instance, you should apply annotations manually to your created `ConfigMap`.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    config:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.config."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.deployment`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `Deployment` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    deployment:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.deployment."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.pod`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to each `Pod` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    pod:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.pod."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.serviceAccount`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `ServiceAccount` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    serviceAccount:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.serviceAccount."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `extraVolumes`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+A list of extra Kubernetes `Volumes` which should be available to any `Pod` created by the chart. These volumes
+will also be available to any `initContainers` configured by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraVolumes:
+  - name: myvolume
+    secret:
+      secretName: mysecret
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraVolumes[0].name=myvolume" \
+  --set "extraVolumes[0].secret.secretName=mysecret"
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraArgs`
+
+| Type | Default value |
+| - | - |
+| `list` | `[]` |
+
+A list of extra arguments to pass to the `teleport start` command when running a Teleport Pod.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraArgs:
+  - "--debug"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraArgs={--debug}"
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraEnv`
+
+| Type | Default value |
+| - | - |
+| `list` | `[]` |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
+
+A list of extra environment variables to be set on the main Teleport container.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraEnv:
+  - name: HTTPS_PROXY
+    value: "http://username:password@my.proxy.host:3128"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraEnv[0].name=HTTPS_PROXY" \
+  --set "extraEnv[0].value=\"http://username:password@my.proxy.host:3128\""
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraVolumeMounts`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+A list of extra Kubernetes volume mounts which should be mounted into any `Pod` created by the chart. These volume
+mounts will also be mounted into any `initContainers` configured by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraVolumeMounts:
+  - name: myvolume
+    mountPath: /path/to/mount/volume
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraVolumeMounts[0].name=myvolume" \
+  --set "extraVolumeMounts[0].path=/path/to/mount/volume"
+  ```
+  </TabItem>
+</Tabs>
+
+## `imagePullPolicy`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `IfNotPresent` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
+
+Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  imagePullPolicy: Always
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set imagePullPolicy=Always
+  ```
+  </TabItem>
+</Tabs>
+
+## `initContainers`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
+
+A list of `initContainers` which will be run before the main Teleport container in any pod created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  initContainers:
+  - name: teleport-init
+    image: alpine
+    args: ['echo test']
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "initContainers[0].name=teleport-init" \
+  --set "initContainers[0].image=alpine" \
+  --set "initContainers[0].args={echo test}"
+  ```
+  </TabItem>
+</Tabs>
+
+## `resources`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
+
+Resource requests/limits which should be configured for each container inside the pod. These resource limits
+will also be applied to `initContainers`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  resources:
+    requests:
+      cpu: 1
+      memory: 2Gi
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set resources.requests.cpu=1 \
+  --set resources.requests.memory=2Gi
+  ```
+  </TabItem>
+</Tabs>
+
+## `tolerations`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+
+Kubernetes Tolerations to set for pod assignment.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  tolerations:
+  - key: "dedicated"
+    operator: "Equal"
+    value: "teleport"
+    effect: "NoSchedule"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set tolerations[0].key=dedicated \
+  --set tolerations[0].operator=Equal \
+  --set tolerations[0].value=teleport \
+  --set tolerations[0].effect=NoSchedule
+  ```
+  </TabItem>
+</Tabs>
diff --git a/docs/pages/kubernetes-access/introduction.mdx b/docs/pages/kubernetes-access/introduction.mdx
index 792a420eccbb3..10b0b25971ce4 100644
--- a/docs/pages/kubernetes-access/introduction.mdx
+++ b/docs/pages/kubernetes-access/introduction.mdx
@@ -5,8 +5,8 @@ description: Teleport Kubernetes Access introduction, demo, and resources.
 
 Teleport provides secure access for Kubernetes clusters.
 
-- Users can receive short-lived kubeconfigs (and certificates) using Single Sign-On (SSO) and switch between clusters without logging in twice.
-- Admins can use *roles* to implement policies like the best practice that *developers must not access production* and enforce dual authorization using [access requests](../enterprise/workflow/index.mdx) for privileged operations.
+- Users can receive short-lived kubeconfig files (and certificates) using Single Sign-On (SSO) and switch between clusters without logging in twice.
+- Admins can use roles to implement policies, such as the best practice that developers must not access production.
 - Organizations can achieve compliance by capturing `kubectl` events and session recordings for `kubectl`.
 
 ## SSO and Audit for Kubernetes Clusters
@@ -33,7 +33,7 @@ Set up SSO, capture audit events, and sessions with Teleport running in a Kubern
 
 ## Getting started
 
-Configure Kubernetes Access in a 10 minute [Getting Started](./getting-started.mdx) guide.
+Configure Kubernetes Access in a ten-minute [Getting Started](./getting-started.mdx) guide.
 
 ## Guides
 
@@ -44,9 +44,6 @@ Configure Kubernetes Access in a 10 minute [Getting Started](./getting-started.m
   <Tile icon="kubernetes" title="Teleport Kubernetes Access and Trusted Clusters" href="./guides/federation.mdx">
     Federated Access using Teleport Trusted Clusters.
   </Tile>
-  <Tile icon="kubernetes" title="Kubernetes Migration Guide" href="./guides/migration.mdx">
-    Kubernetes Pre-5.0 Migration Guide.
-  </Tile>
   <Tile icon="kubernetes" title="Kubernetes Access Multiple Clusters" href="./guides/multiple-clusters.mdx">
     Connecting Multiple Clusters with Teleport Kubernetes Access.
   </Tile>
diff --git a/docs/pages/machine-id/getting-started.mdx b/docs/pages/machine-id/getting-started.mdx
new file mode 100644
index 0000000000000..a88bdc0fb73b2
--- /dev/null
+++ b/docs/pages/machine-id/getting-started.mdx
@@ -0,0 +1,236 @@
+---
+title: Machine ID Getting Started Guide
+description: Getting started with Teleport Machine ID
+---
+
+In this getting started guide, you will use Machine ID to create a bot user for
+a machine and use that identity to connect to said machine.
+
+Here's an overview of what you will do:
+
+1. Download and install Teleport (=teleport.version=)
+2. Create a bot user
+3. Start Machine ID
+4. Use certificates issued by Machine ID to connect to a remote machine
+
+## Prerequisites
+
+Before using Machine ID, you will need an existing Teleport cluster or a
+Teleport Cloud account.
+
+If you have not set up a Teleport cluster before, follow the
+[Getting started](https://goteleport.com/docs/getting-started) guide.
+
+## Step 1/4. Download and install Teleport (=teleport.version=)
+
+In this step, you will be downloading and installing Teleport binaries onto the
+machine you wish to assign an identity to. 
+
+Each Teleport package hosted on our
+downloads page ships with several useful binaries, including `teleport`,
+`tctl`, `tsh`, and `tbot`:
+
+- `teleport` is the daemon used to initialize a Teleport cluster; this binary is not used in this guide
+- `tctl` is the administrative tool you will use to create the bot user (step 1/4)
+- `tsh` is the client tool you will use to log in to the Teleport Cluster (steps 2/4 and 4/4)
+- `tbot` is the Machine ID tool you will use to associate a bot user with a machine (step 3/4)
+
+Machine ID is available starting from the Teleport `9.0.0` release. Download
+the appropriate Teleport package for your platform from our
+[downloads page](https://goteleport.com/teleport/download).
+
+## Step 2/4. Create a bot user
+
+Before you create a bot user, you need to determine which role(s) you want to
+assign to it. You can use the `tctl` command below to examine what roles exist
+on your system.
+
+<Details scope={["cloud"]} scopeOnly={true}>
+On your client machine, log in to Teleport using `tsh`, then use `tctl` to examine
+what roles exist on your system.
+</Details>
+<Details scope={["oss","enterprise"]} scopeOnly={true}>
+Connect to the Teleport Auth Server and use `tctl` to examine what roles exist on
+your system.
+</Details>
+
+```code
+$ tctl get roles --format=text
+```
+
+You will see something like the output below on a fresh install of Teleport with the
+default roles—your cluster may have different roles. In this example, let's
+assume you want to give the bot the `access` role to allow it to connect to
+machines within your cluster.
+
+```
+Role    Allowed to login as                           Node Labels Access to resources
+------- --------------------------------------------- ----------- ----------------------------------------
+access  {{internal.logins}}                           <all nodes> event:list,read,session:read,list
+auditor no-login-6566121f-b602-47f1-a118-c9c618ee5aec             session:list,read,event:list,read
+editor                                                            user:list,create,read,update,delete,...
+```
+
+Machine ID can join with a token or the [IAM Method](https://goteleport.com/docs/setup/guides/joining-nodes-aws) on AWS.
+
+<Tabs>
+  <TabItem label="Token-based Joining">
+  ```code
+  $ tctl bots add robot --roles=access
+  ```
+  </TabItem>
+  <TabItem label="IAM Method">
+  First, create an IAM method token that specifies the AWS account from which
+  the bot can join.
+
+  ```
+  kind: token
+  version: v2
+  metadata:
+    # The token name is not a secret because instances must prove that they are
+    # running in your AWS account to use this token.
+    name: iam-token
+    # Set a long expiry time for how long you want to support IAM method for
+    # joining. It is safe to set this value to a very long time.
+    expires: "3000-01-01T00:00:00Z"
+  spec:
+    # Only allow bots to join using this token.
+    roles: [Bot]
+  
+    # Set the join method to be IAM.
+    join_method: iam
+
+    # Define the name of the bot that will be allowed to use this token.
+    bot_name: robot
+  
+    allow:
+    # Restrict the AWS account and (optionally) ARN that can use this token.
+    # This information can be obtained from running the
+    # "aws sts get-caller-identity" command from the CLI.
+    - aws_account: "111111111111"
+      aws_arn: "arn:aws:sts::111111111111:assumed-role/teleport-bot-role/i-*"
+  ```
+
+  Next, create the bot user.
+
+  ```
+  $ tctl bots add robot --token=iam-token --roles=access
+  ```
+  </TabItem>
+</Tabs>
+
+## Step 3/4. Start Machine ID
+
+Now start Machine ID using the `tbot` binary. The `tbot start` command will
+start running Machine ID in a loop, writing renewable certificates to
+`/var/lib/teleport/bot` and the short-lived certificates your application will
+use to `/opt/machine-id`.
+
+In a production environment you will want to run Machine ID in the background
+using a service manager like systemd. However, in this guide you will run it in
+the foreground to better understand how it works.
+
+<Tabs>
+  <TabItem label="Token-based Joining">
+  ```code
+  $ tbot start \
+     --data-dir=/var/lib/teleport/bot \
+     --destination-dir=/opt/machine-id \
+     --token=00000000000000000000000000000000 \
+     --join-method=token \
+     --ca-pin=sha256:1111111111111111111111111111111111111111111111111111111111111111 \
+     --auth-server=auth.example.com:3025
+  ```
+  </TabItem>
+  <TabItem label="IAM Method">
+  ```code
+  $ tbot start \
+     --data-dir=/var/lib/teleport/bot \
+     --destination-dir=/opt/machine-id \
+     --token=iam-token \
+     --join-method=iam \
+     --ca-pin=sha256:1111111111111111111111111111111111111111111111111111111111111111 \
+     --auth-server=auth.example.com:3025
+  ```
+  </TabItem>
+</Tabs>
+
+Replace the following fields with values from your own cluster.
+
+<Details scope={["cloud"]} scopeOnly={true}>
+- `token` is the token output by the `tctl bots add` command or the name of your IAM method token
+- `ca-pin` is the CA Pin for your Teleport cluster, and is output by the `tctl bots add` command
+- `destination-dir` is where Machine ID writes renewable certificates, which are only used by Machine ID and should not be used by applications and tools
+- `data-dir` is where Machine ID writes the short-lived certificate. This certificate should be used by applications and tools
+- `auth-server` is the address of your Teleport Cloud Proxy Server, for example `example.teleport.sh:443`
+</Details>
+<Details scope={["oss","enterprise"]} scopeOnly={true}>
+- `token` is the token output by the `tctl bots add` command or the name of your IAM method token
+- `ca-pin` is the CA Pin for your Teleport cluster, and is output by the `tctl bots add` command
+- `destination-dir` is where Machine ID writes renewable certificates, which are only used by Machine ID and should not be used by applications and tools
+- `data-dir` is where Machine ID writes the short-lived certificate. This certificate should be used by applications and tools
+- `auth-server` is the address of your Teleport Auth Server, for example `auth.example.com:3025`
+</Details>
+
+Now that Machine ID has successfully started, let's investigate the
+`/opt/machine-id` directory to see what was written to disk.
+
+```code
+$ tree /opt/machine-id
+machine-id
+├── key
+├── key.pub
+├── known_hosts
+├── ssh_config
+├── sshcacerts
+├── sshcert
+├── tlscacerts
+└── tlscert
+
+0 directories, 8 files
+```
+
+This directory contains private key material in the `key.*` files, SSH
+certificates in the `ssh*` files, X.509 certificates in the `tls*` files, and
+OpenSSH configuration in the `ssh_config` and `known_hosts` files to make it easy
+to integrate Machine ID with external applications and tools.
+
+## Step 4/4. Use certificates issued by Machine ID
+
+To use Machine ID, find a host that you want to connect to within your cluster
+using `tsh ls`. You might see output like the following on your system.
+
+```code
+$ tsh ls
+Node Name Address        Labels                        
+--------- -------------- ----------------------------- 
+node-name  127.0.0.1:3022 arch=x86_64,group=api-servers 
+```
+
+To use Machine ID with the OpenSSH integration, run the following command to
+connect to `node-name` within cluster `example.com`.
+
+```
+ssh -F /opt/machine-id/ssh_config root@node-name.example.com
+```
+
+<Admonition type="note" title="Roles must have logins defined">
+  If you see the below error, it means the user you are trying to log in as is
+  not specified under `logins` in the role you are using.
+
+  ```code
+  $ ssh -F /opt/machine-id/ssh_config root@node-name.example.com
+  root@node-name: Permission denied (publickey).
+  kex_exchange_identification: Connection closed by remote host
+  ```
+
+  If you have been following along with the `access` role, do the following.
+
+  - Export the role by running `tctl get roles/access > access.yaml`
+  - Edit the `logins` field in `access.yaml`
+  - Update the role by running `tctl create -f access.yaml`
+</Admonition>
+
+Now you can replace any invocations of `ssh` with the above command to provide
+your applications and tools a machine identity that can be rotated, audited,
+and controlled with all the familiar Teleport access controls.
diff --git a/docs/pages/machine-id/guides.mdx b/docs/pages/machine-id/guides.mdx
new file mode 100644
index 0000000000000..c9d0d52ba76aa
--- /dev/null
+++ b/docs/pages/machine-id/guides.mdx
@@ -0,0 +1,11 @@
+---
+title: Machine ID Guides
+description: Teleport Machine ID guides.
+layout: tocless-doc
+---
+
+<TileSet>
+  <Tile icon="server" title="Using Teleport Machine ID with Ansible" href="./guides/ansible.mdx">
+    How to integrate Teleport Machine ID with Ansible.
+  </Tile>
+</TileSet>
diff --git a/docs/pages/machine-id/guides/ansible.mdx b/docs/pages/machine-id/guides/ansible.mdx
new file mode 100644
index 0000000000000..b69462fd2766d
--- /dev/null
+++ b/docs/pages/machine-id/guides/ansible.mdx
@@ -0,0 +1,122 @@
+---
+title: Using Teleport Machine ID with Ansible
+description: Using Teleport Machine ID with Ansible
+---
+
+In this guide, you will set up an Ansible playbook to run the OpenSSH client
+with a configuration file that is automatically managed by Machine ID.
+
+## Prerequisites
+
+You will need the following tools to use Teleport with Ansible.
+
+- [Teleport Enterprise](../../enterprise/introduction.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= 9.0.0
+- `ssh` OpenSSH tool
+- `ansible` >= (=ansible.min_version=)
+- Optional tool `jq` to process `JSON` output
+
+In addition, if you already have not done so, follow the
+[Machine ID Getting Started Guide](../getting-started.mdx) to create a bot
+user and start Machine ID.
+
+If you followed the above guide, you are interested in the
+`--destination-dir=/opt/machine-id` flag, which defines the directory where
+SSH certificates and OpenSSH configuration used by Ansible will be written.
+
+In particular, you will be using the `/opt/machine-id/ssh_config` file in your
+Ansible configuration to define how Ansible should connect to Teleport Nodes.
+
+## Step 1/2. Configure Ansible
+
+Create a folder named `ansible` where all Ansible files will be collected.
+
+```code
+$ mkdir -p ansible
+$ cd ansible
+```
+
+Create a file called `ansible.cfg`. We will configure Ansible 
+to run the OpenSSH client with the configuration file generated 
+by Machine ID, `/opt/machine-id/ssh_config`.
+
+```
+[defaults]
+host_key_checking = True
+inventory=./hosts
+remote_tmp=/tmp
+
+[ssh_connection]
+scp_if_ssh = True
+ssh_args = -F /opt/machine-id/ssh_config
+```
+
+You can create an inventory file called `hosts` manually or use a script like the one
+below to generate it from your environment. Note, `example.com` here is the
+name of your Teleport cluster.
+
+```code
+$ tsh ls --format=json | jq -r '.[].spec.hostname + ".example.com"' > hosts
+```
+
+## Step 2/2. Run a playbook
+
+Finally, let's create a simple Ansible playbook, `playbook.yaml`.
+
+The playbook below runs `hostname` on all hosts. Make sure to set the
+`remote_user` parameter to a valid SSH username that works with the target host
+and is allowed by Teleport RBAC.
+
+```yaml
+- hosts: all
+  remote_user: ubuntu
+  tasks:
+    - name: "hostname"
+      command: "hostname"
+```
+
+From the folder `ansible`, run the Ansible playbook:
+
+```code
+$ ansible-playbook playbook.yaml 
+
+# PLAY [all] *****************************************************************************************************************************************
+# TASK [Gathering Facts] *****************************************************************************************************************************
+#
+# ok: [terminal]
+#
+# TASK [hostname] ************************************************************************************************************************************
+# changed: [terminal]
+#
+# PLAY RECAP *****************************************************************************************************************************************
+# terminal                   : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+```
+
+You are all set. You have provided your machine with short-lived certificates
+tied to a machine identity that can be rotated, audited, and controlled with
+all the familiar Teleport access controls.
+
+## Troubleshooting
+
+In case if Ansible cannot connect, you may see error like this one:
+
+```txt
+example.host | UNREACHABLE! => {
+    "changed": false,
+    "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname node-name: Name or service not known",
+    "unreachable": true
+}
+```
+
+You can examine and tweak patterns matching the inventory hosts in `ssh_config`.
+
+Try the SSH connection using `ssh_config` with verbose mode to inspect the error:
+
+```code
+$ ssh -vvv -F /opt/machine-id/ssh_config root@node-name.example.com
+```
+
+If `ssh` works, try running the playbook with verbose mode on:
+
+```code
+$ ansible-playbook -vvv playbook.yaml
+```
diff --git a/docs/pages/machine-id/introduction.mdx b/docs/pages/machine-id/introduction.mdx
new file mode 100644
index 0000000000000..51f0b4dbf0fa2
--- /dev/null
+++ b/docs/pages/machine-id/introduction.mdx
@@ -0,0 +1,56 @@
+---
+title: Machine ID
+description: Teleport Machine ID introduction, demo and resources.
+---
+
+# Machine ID
+
+Machine ID is a service that programmatically issues and renews short-lived
+certificates to any service account (e.g., a CI/CD server) by retrieving
+credentials from the Teleport Auth Service. This enables fine-grained
+role-based access controls and audit.
+
+Some of the things you can do with Machine ID:
+
+- Machines can retrieve short-lived SSH certificates for CI/CD pipelines.
+- Machines can retrieve short-lived X.509 certificates for use with databases or applications.
+- Configure role-based access controls and locking for machines.
+- Capture access events in the audit log.
+
+{
+/*
+TODO(russjones): Once we have a demo video for Machine ID, include it here.
+
+## Demo
+
+Let's create a bot and use the machine identity to connect to a server.
+
+<video
+  autoPlay
+  loop
+  muted
+  playsInline
+  controls
+>
+  <source
+    src="https://goteleport.com/teleport/videos/database-access-preview/dbaccessdemo.mp4"
+    type="video/mp4"
+  />
+
+  <source
+    src="https://goteleport.com/teleport/videos/database-access-preview/dbaccessdemo.webm"
+    type="video/webm"
+  />
+
+  Your browser does not support the video tag.
+</video>
+*/
+}
+
+## Getting started
+
+<TileSet>
+  <Tile icon="wand" title="Getting started" href="./getting-started.mdx">
+    Getting started with Teleport Machine ID
+  </Tile>
+</TileSet>
diff --git a/docs/pages/machine-id/reference.mdx b/docs/pages/machine-id/reference.mdx
new file mode 100644
index 0000000000000..e309faec20f4e
--- /dev/null
+++ b/docs/pages/machine-id/reference.mdx
@@ -0,0 +1,8 @@
+---
+title: Machine ID Reference
+description: Configuration and CLI reference for Teleport Machine ID.
+---
+
+
+- [Configuration](./reference/configuration.mdx)
+- [CLI](./reference/cli.mdx)
diff --git a/docs/pages/machine-id/reference/cli.mdx b/docs/pages/machine-id/reference/cli.mdx
new file mode 100644
index 0000000000000..bc5276be2a147
--- /dev/null
+++ b/docs/pages/machine-id/reference/cli.mdx
@@ -0,0 +1,90 @@
+---
+title: Machine ID CLI Reference
+description: CLI reference for Teleport Machine ID.
+---
+
+## `tbot start`
+
+Starts the Machine ID client `tbot`, fetching and writing certificates to disk
+at a set interval.
+
+<Details scope={["cloud"]} scopeOnly={true}>
+```code
+$ tbot start \
+   --data-dir=/var/lib/teleport/bot \
+   --destination-dir=/opt/machine-id \
+   --token=00000000000000000000000000000000 \
+   --join-method=token \
+   --ca-pin=sha256:1111111111111111111111111111111111111111111111111111111111111111 \
+   --auth-server=example.teleport.sh:443
+```
+</Details>
+<Details scope={["oss","enterprise"]} scopeOnly={true}>
+```code
+$ tbot start \
+   --data-dir=/var/lib/teleport/bot \
+   --destination-dir=/opt/machine-id \
+   --token=00000000000000000000000000000000 \
+   --join-method=token \
+   --ca-pin=sha256:1111111111111111111111111111111111111111111111111111111111111111 \
+   --auth-server=auth.example.com:3025
+```
+</Details>
+
+| Flag                 | Description                                                                                    |
+|----------------------|------------------------------------------------------------------------------------------------|
+| `-d/--debug`         | Enable verbose logging to stderr.                                                              |
+| `-c/--config`        | Path to a configuration file. Defaults to `/etc/tbot.yaml` if unspecified.                     |
+| `-a/--auth-server`   | Address of the Teleport Auth Server (On-Prem installs) or Teleport Cloud tenant.       |
+| `--token`            | A bot join token, if attempting to onboard a new bot; used on first connect.                   |
+| `--ca-pin`           | CA pin to validate the Teleport Auth Server; used on first connect.                            |
+| `--data-dir`         | Directory to store internal bot data. Access to this directory should be limited.              | 
+| `--destination-dir`  | Directory to write short-lived machine certificates.                                           |
+| `--certificate-ttl`  | TTL of short-lived machine certificates.                                                       |
+| `--renewal-interval` | Interval at which short-lived certificates are renewed; must be less than the certificate TTL. |
+| `--join-method`      | Method to use to join the cluster. Can be `token` or `iam`.                                    |
+| `--one-shot`         | If set, quit after the first renewal.                                                          |
+
+## `tbot init`
+
+If you want to write certificates to disk as a different user than the Machine
+ID client, you can use `tbot init` to configure either file or POSIX ACLs
+permissions. This allows you to lock down access to Machine ID's short-lived
+certificates from other users or applications on the system.
+
+| Flag                | Description                                                                                                        |
+|---------------------|--------------------------------------------------------------------------------------------------------------------|
+| `-d/--debug`        | Enable verbose logging to stderr.                                                                                  |
+| `-c/--config`       | Path to a configuration file. Defaults to `/etc/tbot.yaml` if unspecified.                                         |
+| `--destination-dir` | Directory to write short-lived machine certificates to.                                                            |
+| `--owner`           | Defines the Linux `user:group` owner of `--destination-dir`. Defaults to the Linux user running `tbot` if unspecified. |
+| `--bot-user`        | Enables POSIX ACLs and defines the Linux user that can read/write short-lived certificates to `--destination-dir`.     |
+| `--reader-user`     | Enables POSIX ACLs and defines the Linux user that will read short-lived certificates from `--destination-dir`.        |
+| `--init-dir`        | If using a config file and multiple destinations are configured, controls which destination dir to configure.      |
+| `--clean`           | If set, remove unexpected files and directories from the destination.                                              |
+
+### `tbot init` with file permissions
+
+If running `tbot` as the Linux user `root`, use the following invocation of
+`tbot init` to initialize the short-lived certificate directory
+`/opt/machine-id` with owner `jenkins:jenkins`.
+
+```code
+$ tbot init \
+    --destination-dir=/opt/machine-id \
+    --owner=jenkins:jenkins
+```
+
+### `tbot init` with POSIX ACLs
+
+If running `tbot` as the Linux user `teleport`, use the following invocation of
+`tbot init` to initialize the short-lived certificate directory
+`/opt/machine-id` with owner `teleport:teleport` but allow `jenkins` to read
+from `/opt/machine-id`.
+
+```code
+$ tbot init \
+    --destination-dir=/opt/machine-id \
+    --bot-user=teleport \
+    --reader-user=jenkins
+```
diff --git a/docs/pages/machine-id/reference/configuration.mdx b/docs/pages/machine-id/reference/configuration.mdx
new file mode 100644
index 0000000000000..2ed552960e6ac
--- /dev/null
+++ b/docs/pages/machine-id/reference/configuration.mdx
@@ -0,0 +1,99 @@
+---
+title: Machine ID Configuration Reference
+description: Configuration reference for Teleport Machine ID.
+---
+
+The following snippet shows full YAML configuration of the Machine ID client
+`tbot` which by default is loaded from `/etc/tbot.yaml`.
+
+```yaml
+# Debug enables verbose logging to stderr.
+debug: true
+
+# Address of the Teleport Auth Server (on-prem installs) or Teleport Cloud tenant.
+auth_server: "auth.example.com:3025" # or "example.teleport.sh:443" for Teleport Cloud
+
+# TTL of short-lived machine certificates.
+certificate_ttl: "5m"
+
+# Interval at which short-lived certificates are renewed; must be less than
+# the certificate TTL.
+renewal_interval: "1m"
+
+# If set, quit after the first renewal.
+oneshot: true
+
+# Onboarding values are only used on first connect.
+onboarding:
+    # Cluster join method. Can be "token" or "iam".
+    join_method: "token"
+
+    # Token used to join the cluster. (only required for join_method: token)
+    token: "00000000000000000000000000000000"
+
+    # CA Path used to validate the identity of the Teleport Auth Server on first connect.
+    ca_path: "/path/to/ca.pem"
+
+    # CA Pins used to validate the identity of the Teleport Auth Server on first connect.
+    ca_pins:
+    - "sha256:1111111111111111111111111111111111111111111111111111111111111111"
+    - "sha256:2222222222222222222222222222222222222222222222222222222222222222"
+
+# Storage defines where Machine ID internal data is stored.
+storage:
+    # Directory to store internal bot data. Access to this directory should be
+    # limited.
+    directory: /var/lib/teleport/bot
+    
+    # Alternatively, internal data can be stored in memory. "directory" and
+    # "memory" are mutually exclusive.
+    memory: true
+
+# Destinations specifies where short-lived certificates are stored.
+destinations:
+    # Directory specifies where short-lived certificates are stored.
+    - directory: /opt/machine-id
+        # Configure symlink attack prevention. Requires Linux 5.6+.
+        # Possible values:
+        #   * try-secure (default): Attempt to securely read and write certificates
+        #     without symlinks, but fall back (with a warning) to insecure read
+        #     and write if the host doesn't support this.
+        #   * secure: Attempt to securely read and write certificates, with a hard error
+        #     if unsupported.
+        #   * insecure: Quietly allow symlinks in paths.
+        symlinks: try-secure
+        
+        # Configure ACL use. Requires Linux with a file system that supports ACLs.
+        # Possible values:
+        #   * try (default on Linux): Attempt to use ACLs, warn at runtime if ACLs
+        #     are configured but invalid.
+        #   * off (default on non-Linux): Do not attempt to use ACLs.
+        #   * required: Always use ACLs, produce a hard error at runtime if ACLs
+        #     are invalid.
+        acls: try
+        
+        # One of more roles to grant to the bot. It must have been granted (at
+        # least) these roles with `tctl bots add --roles=...`
+        # By default, all possible roles are included.
+        
+        # Subset of roles allowed during creation via `tctl bots add --roles=...`. Can
+        # be used to write short-lived certificates with different roles to
+        # different directories.
+        roles: [a, b, c]
+        
+        # Which types of certificates to generate. `[ssh]` is the default.
+        kinds: [ssh, tls]
+        
+        # A list of configuration templates to generate and write to the
+        # destination directory.
+        configs:
+            # ssh_client generates known_hosts and an ssh_config that can be
+            # included. We can ensure the correct certificate kinds are generated
+            # while generating the config templates.
+            - ssh_client
+            
+            # Alternatively, proxy port can be set on ssh_client to override the
+            # defaults. Useful for Telport Cloud.
+            - ssh_client:
+                proxy_port: 443
+```
diff --git a/docs/pages/server-access/getting-started.mdx b/docs/pages/server-access/getting-started.mdx
index db77a4a1b656e..ab1458ae07ab8 100644
--- a/docs/pages/server-access/getting-started.mdx
+++ b/docs/pages/server-access/getting-started.mdx
@@ -6,16 +6,15 @@ videoBanner: EsEvO5ndNDI
 
 # Getting Started
 
-Server Access often involves managing your resources, configuring new clusters, and issuing commands through a CLI or programmatically to an API.
+Server Access involves managing your resources, configuring new clusters, and issuing commands through a CLI or programmatically to an API.
 
 This guide introduces some of these common scenarios and how to interact with Teleport to accomplish them:
 
-1. Creating a Teleport Auth Node cluster we'll add a Teleport SSH Node to.
-2. SSH into the cluster using Teleport.
-3. Introspecting the cluster using Teleport features.
+1. SSH into a cluster using Teleport.
+2. Introspect the cluster using Teleport features.
 
 <Admonition type="tip" title="Tip">
-  This guide also demonstrates how to configure Teleport Nodes into the *Bastion* pattern so that [only a single Node can be accessed publicly](https://goteleport.com/blog/ssh-bastion-host/).
+  This guide also demonstrates how to configure Teleport Nodes using the **bastion pattern** so that only a single Node can be accessed publicly.
 </Admonition>
 
 <Figure
@@ -28,89 +27,61 @@ This guide introduces some of these common scenarios and how to interact with Te
 
 ## Prerequisites
 
-- Two instances of your favorite Linux environment (such as Ubuntu 20.05, CentOS 8.0-1905, or Debian 10).
-- A registered Domain Name with an available subdomain like `tele.example.com`.
-- A Two-Factor Authentication app (such as Authy or Google Authenticator).
+- The Teleport Auth Service and Proxy Service, deployed on your own infrastructure or managed via Teleport Cloud.
+- One host running your favorite Linux environment (such as Ubuntu 20.04, CentOS 8.0-1905, or Debian 10). This will serve as a Teleport Server Access Node.
 - Teleport (=teleport.version=) installed locally.
 
-(!docs/pages/includes/permission-warning.mdx!)
-
-## Step 1/4. Create a cluster
-
-1. Create two new instances of your desired Linux distribution (such as Ubuntu 20.05, CentOS 8.0-1905, or Debian 10).
-
-   The first instance will host a public-facing Auth Node `tele.example.com` that will serve as the *Bastion Host* (following the recommended *Bastion*-pattern). As such, leave the following ports open:
-
-   | Port | Service | Description |
-   | - | - | - |
-   | 3023 | Proxy | SSH port clients connect to. A proxy will forward this connection to port `#3022` on the destination Node. |
-   | 3024 | Proxy	SSH port used to create "reverse SSH tunnels" from behind-firewall environments into a trusted proxy server. |
-   | 443 | Browser | Used to access the Teleport Web UI through a browser with HTTPS. Also used to obtain an ACME TLS (SSL) certificate. |
-   | 22 | Cloud Provider | Used to initially access, configure, and provision your cloud instances. We'll configure and launch our instances then demonstrate how to use the `tsh` tool and Teleport in SSH mode thereafter. |
+<Admonition type="tip" title="New Teleport users">
+If you have not yet deployed the Teleport Auth Service and Proxy Service, learn how to do so by following one of our [getting started guides](../getting-started.mdx).
+</Admonition>
 
-   Add an `A` record in your domain registrar entry for the `tele` subdomain and map the first IP address to the `tele` subdomain.
+(!docs/pages/includes/permission-warning.mdx!)
 
-   <Figure
-     align="center"
-     bordered
-     caption="Subdomain and IP mapping"
-   >
-     ![Subdomain and IP mapping](../../img/server-access/subdomains.png)
-   </Figure>
+## Step 1/4. Install Teleport 
 
-   Your second instance will be a private resource. These are the ports you'll want to initially open:
+1. Create a new instance of your desired Linux distribution (such as Ubuntu 20.04, CentOS 8.0-1905, or Debian 10).
 
-   | Port | Service | Description |
-   | - | - | - |
-   | 22 | Cloud Provider | Used to initially access, configure, and provision your cloud instances. We'll configure and launch our instances then demonstrate how to use the `tsh` tool and Teleport in SSH mode thereafter. |
+   This instance will be a private resource. Open port 22 so you can initially access, configure, and provision your instance. We'll configure and launch our instance, then demonstrate how to use the `tsh` tool and Teleport in SSH mode thereafter.
 
-2. Install Teleport on each instance.
+2. Install Teleport on your instance.
 
    (!docs/pages/includes/install-linux.mdx!)
 
-3. Configure Teleport on the *Bastion Host*.
+   Next, we'll create a **join token** to add and start Teleport Server Access on the Node.
 
-   Teleport will now automatically acquire an X.509 certificate using the ACME protocol.
+## Step 2/4. Add a Node to the cluster
 
-   ```code
-   # Configure Teleport with TLS certs
-   $ sudo teleport configure \
-     --acme --acme-email=your_email@example.com \
-     --cluster-name=tele.example.com \
-     -o file
-   ```
+1. Create a join token to add the Node to your Teleport cluster. In run the following command, either on your Auth Service host (for self-hosted deployments) or on your local machine (for Teleport Cloud).
 
-   Run the command above on `tele.example.com`.
+<Details scope={["cloud"]} scopeOnly={true} title="Teleport Cloud and tctl">
+Teleport Cloud users must download the Enterprise version of Teleport to their local machines in order to use `tctl`. To do so, visit the [Teleport Customer Portal](https://dashboard.gravitational.com/web/login).
 
-4. Launch your *Bastion Host* by running:
+Once this is done, log in to Teleport:
 
-   ```code
-   # Launch Teleport
-   $ sudo teleport start
-   ```
+```code
+$ tsh login --proxy=myinstance.teleport.sh
+```
 
-   Next, we'll create a *join token* to add and start the second Node.
-
-## Step 2/4. Add a Node to the cluster
-
-1. Create a *join token* to add the second Node to the `tele.example.com` cluster. In a *Bastion Host* terminal run the following command:
+If you have installed `tctl` as your local user, you will not need to run `tctl` commands via `sudo`.
+</Details>
 
    ```code
    # Let's save the token to a file
    $ sudo tctl tokens add --type=node | grep -oP '(?<=token:\s).*' > token.file
    ```
 
-   Each Teleport Node can be configured into SSH mode (Teleport Node) and run as an enhanced SSH server. "Node" mode specifies that the Teleport Node will act and join as an SSH server.
+   Each Teleport Node can be configured into SSH mode and run as an enhanced SSH server. `--type=node` specifies that the Teleport Node will act and join as an SSH server.
 
    `> token.file` indicates that you'd like to save the output to a file name `token.file`.
 
    <Admonition type="tip" title="Tip">
-     This helps to minimize the direct sharing of tokens even when they are *dynamically* generated.
+     This helps to minimize the direct sharing of tokens even when they are dynamically generated.
    </Admonition>
 
-2. Now, in another terminal connect to the second instance.
+2. Now, open a new terminal and connect to the Teleport Auth Service.
 
-   - Copy `token.file` to an appropriate, secure directory on the second instance.
+   - On your Node, save `token.file` to an appropriate, secure, directory you have the rights and access to read.
+   - Start the Node. Change `tele.example.com` to the address of your Teleport Proxy Service. For Teleport Cloud customers, use a tenant address such as `mytenant.teleport.sh`. Assign the `--token` flag to the path where you saved `token.file`.
 
    ```code
    # Join cluster
@@ -120,10 +91,7 @@ This guide introduces some of these common scenarios and how to interact with Te
      --auth-server=tele.example.com:443
    ```
 
-   - Replace the `auth-server` value with the public proxy address of the machine you wish to connect to. By default, the subdomain `tele.example.com` will be available on port `443`.
-   - Assign `--token` to the path of the token file you created earlier.
-
-3. Create a user to access the `tele.example.com` Web UI through the following command:
+3. Create a user to access the Web UI through the following command:
 
    ```code
    $ sudo tctl users add tele-admin --roles=editor,access --logins=root,ubuntu,ec2-user
@@ -135,7 +103,7 @@ This guide introduces some of these common scenarios and how to interact with Te
      We've only given `tele-admin` the roles `editor` and `access` according to the *Principle of Least Privilege* (POLP).
    </Admonition>
 
-4. You should now be able to view both Nodes in the Teleport Web interface after logging in as `tele-admin`:
+4. You should now be able to view your Teleport Node in Teleport Web interface after logging in as `tele-admin`:
 
    <Figure
      align="center"
@@ -147,20 +115,20 @@ This guide introduces some of these common scenarios and how to interact with Te
 
 ## Step 3/4. SSH into the server
 
-Now, that we've got our cluster up and running, let's see how easy it is to connect to our two Nodes.
+Now, that we've got our cluster up and running, let's see how easy it is to connect to our Node.
 
 We can use `tsh` to SSH into the cluster:
 
-1. On your local machine, log in through `tsh`:
+1. On your local machine, log in through `tsh`, assigning the `--proxy` flag to the address of your Teleport Proxy Service:
 
    ```code
    # Log in through tsh
    $ tsh login --proxy=tele.example.com --user=tele-admin
    ```
 
-   You'll be prompted to supply the password and One Time Passcode we set up previously.
+   You'll be prompted to supply the password and second factor we set up previously.
 
-2. `tele-admin` will now see:
+2. `tele-admin` will now see something similar to:
 
    ```txt
    Profile URL:        https://tele.example.com:443
@@ -173,7 +141,7 @@ We can use `tsh` to SSH into the cluster:
      Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
    ```
 
-   `tele-admin` is now logged into the `tele.example.com` cluster and *Bastion Host* Node through Teleport SSH.
+   In this example, `tele-admin` is now logged into the `tele.example.com` cluster through Teleport SSH.
 
 3. `tele-admin` can now execute the following to find the cluster's `nodenames`. `nodenames` are used for establishing SSH connections:
 
@@ -182,7 +150,7 @@ We can use `tsh` to SSH into the cluster:
    $ tsh ls
    ```
 
-   The *Bastion Host* Node is located on the bottom line below:
+   In this example, the bastion host Node is located on the bottom line below:
 
    ```txt
    Node Name        Address        Labels
@@ -191,7 +159,7 @@ We can use `tsh` to SSH into the cluster:
    ip-172-31-41-144 127.0.0.1:3022 env=example, hostname=ip-172-31-41-144
    ```
 
-4. `tele-admin` can SSH into the *Bastion Host* Node by running the following command locally:
+4. `tele-admin` can SSH into the bastion host Node by running the following command locally:
 
    ```code
    # Use tsh to ssh into a Node
@@ -204,7 +172,7 @@ We can use `tsh` to SSH into the cluster:
    - Traverse the Linux file system.
    - Execute desired commands.
 
-   All commands executed by `tele-admin` are recorded and can be replayed in the Teleport Web interface.
+   All commands executed by `tele-admin` are recorded and can be replayed in the Teleport Web UI.
 
    The `tsh ssh` command allows one to do anything they would if they were to SSH into a server using a third-party tool. Compare the two equivalent commands:
 
@@ -226,9 +194,9 @@ We can use `tsh` to SSH into the cluster:
 1. Now, `tele-admin` has the ability to SSH into other Nodes within the cluster, traverse the Linux file system, and execute commands.
 
    - They have visibility into all resources within the cluster due to their defined and assigned roles.
-   - They can also quickly view any Node or grouping of Nodes that've been assigned a `label`.
+   - They can also quickly view any Node or grouping of Nodes that have been assigned a particular label.
 
-2. Execute the following command within your *Bastion Host* console:
+2. Execute the following command within your bastion host console:
 
    ```code
    # List Nodes
@@ -244,44 +212,44 @@ We can use `tsh` to SSH into the cluster:
    ip-172-31-41-144 f3d2a65f-3fa7-451d-b516-68d189ff9ae5 127.0.0.1:3022 env=example,hostname=ip-172-31-41-144
    ```
 
-3. Note the "Labels" column on the farthest side. `tele-admin` can query all resources with a shared [label](../setup/admin/labels.mdx) using the command:
+3. Note the "Labels" column on the farthest side. `tele-admin` can query all resources with a shared label using the command:
 
    ```code
    # Query all Nodes with a label
    $ tsh ls env=example
    ```
 
-   - Customized labels can be defined in your `teleport.yaml` configuration file or during Node creation.
-   - This is a convenient feature that allows for more advanced queries.
-   - Suppose an IP address changes, an admin can quickly find the current Node with that label since it remains unchanged.
+   Customized labels can be defined in your `teleport.yaml` configuration file or during Node creation.
 
-4. `tele-admin` can also execute commands on all Nodes that share a label vastly simplifying repeated operations. For example, the command:
+   This is a convenient feature that allows for more advanced queries. If an IP address changes, for example, an admin can quickly find the current Node with that label since it remains unchanged.
+
+4. `tele-admin` can also execute commands on all Nodes that share a label, vastly simplifying repeated operations. For example, the command:
 
    ```code
    # Run the ls command on all Nodes with a label
    $ tsh ssh root@env=example ls
    ```
 
-   will execute the `ls` command on each Node displaying the contents of each to the screen.
+   will execute the `ls` command on each Node and display the results in your terminal.
 
 ## Conclusion
 
 <Admonition type="tip" title="Note">
-   We previously configured our Linux instances to leave port `22` open to easily configure and install Teleport. Feel free to compare Teleport SSH to your usual `ssh` commands.
+   We previously configured our Linux instance to leave port `22` open to easily configure and install Teleport. Feel free to compare Teleport SSH to your usual `ssh` commands.
 
-   If you'd like to further experiment with using Teleport according to the *Bastion* pattern:
+   If you'd like to further experiment with using Teleport according to the bastion pattern:
 
-   - Close port `22` on your second, private, Linux instance now that your Node is configured and running.
-   - Optionally close port `22` on your *Bastion Host*.
-   - You'll be able to fully connect to both the *Bastion Host* and the private instance using `tsh ssh`.
+   - Close port `22` on your private Linux instance now that your Teleport Node is configured and running.
+   - For self-hosted deployments, optionally close port `22` on your bastion host.
+   - You'll be able to fully connect to the private instance and, for self-hosted deployments, the bastion host, using `tsh ssh`.
 </Admonition>
 
-To recap, this Getting Started Guide described:
+To recap, this guide described:
 
 1. How to set up and add an SSH Node to a cluster.
 2. Connect to the cluster using `tsh` to manage and introspect resources.
 
-Feel free to shut down, clean up, and delete your resources or use them in further Getting Started exercises.
+Feel free to shut down, clean up, and delete your resources, or use them in further Getting Started exercises.
 
 ## Next steps
 
@@ -290,7 +258,8 @@ Feel free to shut down, clean up, and delete your resources or use them in furth
 - For a complete list of ports used by Teleport, read [The Admin Guide](../setup/reference/networking.mdx).
 
 ## Resources
-
+- [Setting Up an SSH Bastion Host](https://goteleport.com/blog/ssh-bastion-host/)
 - [Announcing Teleport SSH Server](https://goteleport.com/blog/announcing-teleport-ssh-server/)
 - [How to SSH properly](https://goteleport.com/blog/how-to-ssh-properly/)
 - Consider whether [OpenSSH or Teleport SSH](https://goteleport.com/blog/openssh-vs-teleport/) is right for you.
+- [Labels](../setup/admin/labels.mdx)
diff --git a/docs/pages/server-access/guides/ansible.mdx b/docs/pages/server-access/guides/ansible.mdx
deleted file mode 100644
index 56fe0cc2f4033..0000000000000
--- a/docs/pages/server-access/guides/ansible.mdx
+++ /dev/null
@@ -1,126 +0,0 @@
----
-title: Ansible
-description: Using Teleport with Ansible
----
-
-Ansible uses the OpenSSH client by default. Teleport supports SSH protocol and
-works as SSH jumphost.
-
-In this guide we will configure OpenSSH client to work with Teleport Proxy
-and run a sample ansible playbook.
-
-## Prerequisites
-
-- Installed [Teleport Enterprise](../../enterprise/introduction.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
-- `tsh` client tool  >= (=teleport.version=)
-- `ssh` openssh tool
-- `ansible` >= (=ansible.min_version=)
-- Optional tool `jq` to process `JSON` output.
-
-## Step 1/3. Login and configure SSH
-
-Log into Teleport with `tsh`:
-
-```code
-$ tsh login --proxy=example.com
-```
-
-Generate `openssh` configuration using `tsh config` shortcut:
-
-```code
-$ tsh config > ssh.cfg
-```
-
-<Admonition type="tip">
-You can edit matching patterns used in `ssh.cfg` if something
-is not working out of the box.
-</Admonition>
-
-## Step 2/3. Configure Ansible
-
-Create a folder `ansible` where we will collect all generated files:
-
-```code
-$ mkdir -p ansible
-$ cd ansible
-```
-
-Create a file `ansible.cfg`:
-
-```
-[defaults]
-host_key_checking = True
-inventory=./hosts
-remote_tmp=/tmp
-
-[ssh_connection]
-scp_if_ssh = True
-ssh_args = -F ./ssh.cfg
-```
-
-You can create an inventory file `hosts` manually or use a script below to generate it from your environment:
-
-```code
-$ tsh ls --format=json | jq -r '.[].spec.hostname' > hosts
-```
-
-## Step 3/3. Run a playbook
-
-Finally, let's create a simple ansible playbook `playbook.yaml`.
-
-The playbook below runs `hostname` on all hosts. Make sure to set the `remote_user` parameter
-to a valid SSH username that works with the target host and is allowed by Teleport:
-
-```yaml
-- hosts: all
-  remote_user: ubuntu
-  tasks:
-    - name: "hostname"
-      command: "hostname"
-```
-
-From the folder `ansible`, run the ansible playbook:
-
-```code
-$ ansible-playbook playbook.yaml 
-
-# PLAY [all] *****************************************************************************************************************************************
-# TASK [Gathering Facts] *****************************************************************************************************************************
-#
-# ok: [terminal]
-#
-# TASK [hostname] ************************************************************************************************************************************
-# changed: [terminal]
-#
-# PLAY RECAP *****************************************************************************************************************************************
-# terminal                   : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-```
-
-You are all set. You are now using short-lived SSH certificates and Teleport can now record
-all ansible commands in the audit log.
-
-## Troubleshooting
-
-In case if ansible can not connect, you may see error like this one:
-
-```txt
-example.host | UNREACHABLE! => {
-    "changed": false,
-    "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname example.host: Name or service not known",
-    "unreachable": true
-}
-```
-
-You can examine and tweak patterns matching the inventory hosts in `ssh.cfg`.
-
-Try the SSH connection using `ssh.cfg` with verbose mode to inspect the error:
-
-```code
-$ ssh -vvv -F ./ssh.cfg root@example.host
-```
-
-If `ssh` works, try running the playbook with verbose mode on:
-
-```code
-$ ansible-playbook -vvvv playbook.yaml
-```
diff --git a/docs/pages/server-access/guides/vscode.mdx b/docs/pages/server-access/guides/vscode.mdx
index 8033e245efe12..609d2b17abc3b 100644
--- a/docs/pages/server-access/guides/vscode.mdx
+++ b/docs/pages/server-access/guides/vscode.mdx
@@ -11,6 +11,25 @@ This guide explains how to use Teleport and Visual Studio Code's remote SSH exte
 - [tsh client tool](https://goteleport.com/teleport/download) >= (=teleport.version=).
 - OpenSSH client.
 - Visual Studio Code with the [Remote - SSH extension](https://code.visualstudio.com/docs/remote/ssh#_system-requirements)
+for the Remote - SSH extension.
+- The Teleport Auth Service and Proxy Service, deployed on your own infrastructure or managed via Teleport Cloud.
+- One or more Teleport Nodes with Server Access enabled. If you have not yet done this, read the [Server Access Getting Started Guide](../getting-started.mdx) to learn how.
+
+<Details 
+scopeOnly={true}
+scope={["oss", "enterprise"]}
+opened={false}
+title="Haven't deployed the Auth and Proxy Services?" >
+Follow one of our [getting started](../getting-started.mdx) guides to learn how to deploy the Teleport Auth Service and Proxy Service in your environment.
+</Details>
+
+<Details 
+scopeOnly={true}
+scope={["cloud"]}
+opened={false}
+title="Not yet a Teleport customer?" >
+Sign up for a [free trial](/signup/) of Teleport Cloud to get started.
+</Details>
 
 <Admonition type="note">
 Linux and MacOS clients should rely on their operating system-provided OpenSSH
@@ -19,9 +38,10 @@ older clients can use `ssh.exe` from either [Git for Windows][git] or
 Microsoft's [Win32-OpenSSH project][win32-openssh].
 </Admonition>
 
-## Step 1/3. First-time Setup
 
-Configure your local SSH client to access Teleport nodes:
+## Step 1/3. First-time setup
+
+Configure your local SSH client to access Teleport Nodes, assigning the `--proxy` flag to the address of your Teleport Proxy Service (e.g., `mytenant.teleport.sh` for Teleport Cloud users).
 
 ```code
 # log in to your proxy:
@@ -31,6 +51,7 @@ $ tsh login --proxy proxy.foo.example.com --user alice
 $ tsh config --proxy proxy.foo.example.com
 ```
 
+
 Append the resulting configuration snippet into your SSH config file located
 in the path below:
 
@@ -53,17 +74,15 @@ in the path below:
   </TabItem>
 </Tabs>
 
-You should be able to connect to the desired node using following command:
+You should be able to connect to the desired node using following command, replacing `user` with the username you would like to assume on the node.
 
 ```code
-ssh user@[node name].[cluster name]
+$ ssh user@[node name].[cluster name]
 ```
 
-For example, this should work:
-
-```code
-$ ssh alice@node000.foo.example.com
-```
+<Details scopeOnly={true} scope={["cloud"]} title="Teleport Cloud">
+The SSH config you generated earlier instructs your SSH client to run `tsh proxy ssh` to access a Node in your Teleport cluster. However, running an `ssh` command against the Teleport Proxy Service at `yourtenant.teleport.sh` will result in an error.
+</Details>
 
 <Admonition type="note">
 Teleport's certificates expire fairly quickly, after which SSH
@@ -101,12 +120,12 @@ gear icon:
   ![VS Code sidebar with the Remote Explorer pane open and Configure highlighted](../../../img/vscode/remote-configure.png)
 </Figure>
 
-VS code will prompt you SSH config file.
+VS code will prompt you for your SSH config file.
 
-Select the one we generated during step 1 and open it in the editor.
+Select the one we generated during Step 1 and open it in the editor.
 
 <Admonition type="warning">
-Do not use VS Code's SSH config helper; if prompted for an SSH command,
+Do not use VS Code's SSH config helper. If prompted for an SSH command,
 close the dialog and select the "Configure" icon instead.
 </Admonition>
 
@@ -120,21 +139,20 @@ Host node000.foo.example.com
 When finished, save the file. If the added host doesn't automatically appear in
 the list, select the Refresh button.
 
-## Step 3/3. Start a Remote Development Session
+## Step 3/3. Start a Remote Development session
 
-Start a remote development session by right
-clicking on any host added above and selecting either "Connect to..." option:
+Start a Remote Development session by right-clicking on any host added above and selecting either "Connect to..." option:
 
-<Figure align="left" bordered caption="Connect to a node">
+<Figure align="left" bordered caption="Connect to a Node">
 ![Connecting to a Teleport host in VS Code](../../../img/vscode/connect.png)
 </Figure>
 
-On first connect, you'll be prompted to configure the remote OS; select the
+On first connect, you'll be prompted to configure the remote OS. Select the
 proper platform and VS Code will install its server-side component. When it
 completes, you should be left with a working editor:
 
 <Figure align="left" bordered caption="Connected VS Code">
-![VS Code connected to a Teleport node](../../../img/vscode/connected-editor.png)
+![VS Code connected to a Teleport Node](../../../img/vscode/connected-editor.png)
 </Figure>
 
 The status indicator in the bottom left highlights the currently connected remote host.
@@ -157,8 +175,11 @@ This guide makes use of `tsh config`, added in Teleport 7.0; refer to the
 [Manually configure an OpenSSH client](./openssh.mdx#manual-setup)
 to use the VS Code's remote SSH extension with older Teleport clients.
 
+## Further reading
+- [VS Code Remote Development](https://code.visualstudio.com/docs/remote/remote-overview)
+
 [remote-ssh]: https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-ssh
 [win10]: https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
 [git]: https://git-scm.com/downloads
 [remote-ssh-docs]: https://code.visualstudio.com/docs/remote/ssh
-[win32-openssh]: https://github.com/powershell/Win32-OpenSSH
+[win32-openssh]: https://github.com/powershell/Win32-OpenSSH
\ No newline at end of file
diff --git a/docs/pages/setup/admin/adding-nodes.mdx b/docs/pages/setup/admin/adding-nodes.mdx
index c43c48ee28fa7..792bfafa44433 100644
--- a/docs/pages/setup/admin/adding-nodes.mdx
+++ b/docs/pages/setup/admin/adding-nodes.mdx
@@ -1,65 +1,59 @@
 ---
-title: Adding Nodes to the cluster
-description: Adding Nodes to the cluster
+title: Adding Nodes to the Cluster
+description: How to add Nodes to your Teleport cluster
 ---
 
-This guide explains how to add nodes to Open Source, Enterprise Teleport,
-self-hosted or cloud editions.
+This guide explains how to add Teleport Nodes to your cluster.
 
 ## Prerequisites
 
-- Installed [Teleport](../../getting-started.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
-- [Tctl admin tool](https://goteleport.com/teleport/download) >= (=teleport.version=)
+<Tabs>
+<TabItem scope={["oss"]} label="Self-Hosted">
+Install Teleport and the `tctl` admin tool version >= (=teleport.version=).
 
-(!docs/pages/includes/tctl.mdx!)
-
-<Admonition type="note">
-For cloud, login with a teleport user with editor privileges:
-```code
-# tsh logs you in and receives short-lived certificates
-$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
-# try out the connection
-$ tctl get nodes
-```
-</Admonition>
-
-## Adding Nodes to the cluster
+See [Installation](../../installation.mdx) for details.
 
-Teleport only allows access to nodes that have joined the cluster.
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+Install Teleport and the `tctl` admin tool version >= (=teleport.version=).
 
-Once a node joins, it receives its own host certificate signed by the cluster's auth server.
+To download Teleport Enterprise, visit the
+  [customer portal](https://dashboard.gravitational.com/web/login).
+</TabItem>
+<TabItem scope={["cloud"]}
+  label="Cloud">
 
-To receive a host certificate upon joining a cluster, a new Teleport host must present an *invite token*.
+Sign up for a Teleport Cloud account. If you do not have one, visit the
+  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+</TabItem>
+</Tabs>
 
-An invite token also defines which role a new host can assume within a cluster: `auth`, `proxy`, `node`, `app`, `kube`, or `db`.
-
-There are two ways to create invitation tokens:
+(!docs/pages/includes/tctl.mdx!)
 
-- **Short-lived Dynamic Tokens** are more secure but require more planning.
-- **Static Tokens** are easy to use, but less secure.
+## Adding Nodes to the cluster
 
-### Short-lived dynamic tokens
+Teleport only allows access to Nodes that have joined the cluster.
 
-Administrators can generate tokens as they are needed.
+Once a Node joins, it receives its own host certificate signed by the cluster's
+Auth Service. To receive a host certificate upon joining a cluster, a new
+Teleport host must present an **invite token**.
 
-Such token can be used multiple times until its time to live (TTL)
-expires.
+An invite token also defines which role a new host can assume within a cluster:
+`auth`, `proxy`, `node`, `app`, `kube`, or `db`.
 
-Use the [`tctl`](../reference/cli.mdx#tctl) tool to register a new invitation token (or
-it can also generate a new token for you). In the following example a new token
-is created with a TTL of 5 minutes:
+### Generate a token
 
-```code
-$ tctl nodes add --ttl=5m --roles=node,proxy --token=secret-value
-# The invite token: secret-value
-```
+Administrators can generate tokens as they are needed. A token can be used
+multiple times until its time to live (TTL) expires.
 
-If `--token` is not provided, [`tctl`](../reference/cli.mdx#tctl) will generate one:
+Use the `tctl` tool to generate a new token. In the following example, a new
+token is created with a TTL of five minutes:
 
 ```code
 # Generate a short-lived invitation token for a new node:
-$ tctl nodes add --ttl=5m --roles=node,app
-# The invite token: abcdefgh-do-not-use-this-token-123
+$ tctl nodes add --ttl=5m --roles=node
+# The invite token: (=presets.tokens.first=)
 
 # You can also list all generated non-expired tokens:
 $ tctl tokens ls
@@ -67,88 +61,100 @@ $ tctl tokens ls
 # ------------------------         -----------     ---------------
 # (=presets.tokens.first=)         Node            25 Sep 18 00:21 UTC
 
-# ... or revoke an invitation before it's used:
+# ... or revoke an invitation token before it's used:
 $ tctl tokens rm (=presets.tokens.first=)
 ```
 
+If you want to provide your own token, you can do so using the `--token` flag:
+
+```code
+$ tctl nodes add --ttl=5m --roles=node,proxy --token=secret-value
+# The invite token: secret-value
+```
+
+<Details scope={["oss","enterprise"]} title="An insecure alternative: static tokens" scopeOnly={true} opened>
+<Admonition type="warning">
+Use short-lived tokens instead of long-lived static tokens.
+Static tokens are easier to steal, guess, and leak.
+</Admonition>
+
+Static tokens are defined ahead of time by an administrator and stored in the
+auth server's config file:
+
+```yaml
+# Config section in `/etc/teleport.yaml` file for the auth server
+auth_service:
+    enabled: true
+    tokens:
+    # This static token allows new hosts to join the cluster as "proxy" or "node"
+    - "proxy,node:secret-token-value"
+    # A token can also be stored in a file. In this example the token for adding
+    # new auth servers are stored in /path/to/tokenfile
+    - "auth:/path/to/tokenfile"
+```
+</Details>
+
 ### Using Node invitation tokens
 
-Both static and short-lived dynamic tokens are used the same way. Execute the following
-command on a new node to add it to a cluster:
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} scopeOnly={true} label="Self Hosted">
+Execute one of the following commands on a new Node to add it to a cluster:
 
 ```code
-# Adding a new regular SSH node to the cluster:
+# Adding an SSH Node to the cluster:
 $ sudo teleport start --roles=node --token=(=presets.tokens.first=) --auth-server=10.0.10.5
 
-# Adding a new regular SSH node using Teleport Node Tunneling:
+# Adding a new regular SSH Node using Teleport Node Tunneling:
 $ sudo teleport start --roles=node --token=(=presets.tokens.first=) --auth-server=teleport-proxy.example.com:3080
 
-# Adding a new proxy service on the cluster:
+# Adding a new Proxy Service to the cluster:
 $ sudo teleport start --roles=proxy --token=(=presets.tokens.first=) --auth-server=10.0.10.5
 ```
-
-As new nodes come online, they start sending ping requests every few seconds to
-the CA of the cluster. This allows users to explore cluster membership and size:
+</TabItem>
+<TabItem scope={["cloud"]} scopeOnly={true} label="Teleport Cloud">
+Execute the following command on a new Node to add it to a cluster. Replace
+`mytenant.teleport.sh` with the domain name of your Teleport Cloud tenant.
 
 ```code
-$ tctl nodes ls
-
-Node Name     Node ID                                  Address            Labels
----------     -------                                  -------            ------
-turing        d52527f9-b260-41d0-bb5a-e23b0cfe0f8f     10.1.0.5:3022      distro:ubuntu
-dijkstra      c9s93fd9-3333-91d3-9999-c9s93fd98f43     10.1.0.6:3022      distro:debian
+# Adding an SSH Node to the cluster:
+$ sudo teleport start --roles=node --token=(=presets.tokens.first=) --auth-server=mytenant.teleport.sh
 ```
 
-## Revoking invitations
+</TabItem>
+</Tabs>
 
-As you have seen above, Teleport uses tokens to invite users to a cluster
-(sign-up tokens) or to add new nodes to it (provisioning tokens).
 
-Both types of tokens can be revoked before they can be used. To see a list of
-outstanding tokens, run this command:
+As new Nodes come online, they start sending ping requests every few seconds to
+the Auth Service. This allows users to explore cluster membership and size:
 
 ```code
-$ tctl tokens ls
+$ tctl nodes ls
 
-# Token                                Role       Expiry Time (UTC)
-# -----                                ----       -----------------
-# (=presets.tokens.first=)     Proxy      never
-# (=presets.tokens.second=)     Node       17 May 16 03:51 UTC
-# (=presets.tokens.third=)     Signup     17 May 16 04:24 UTC
+Node Name     Node ID                                  Address            Labels
+---------     -------                                  -------            ------
+turing        d52527f9-b260-41d0-bb5a-e23b0cfe0f8f     10.1.0.5:3022      distro:ubuntu
+dijkstra      c9s93fd9-3333-91d3-9999-c9s93fd98f43     10.1.0.6:3022      distro:debian
 ```
 
-In this example, the first token has a "never" expiry date because it is a
-static token configured via a config file.
-
-The 2nd token with the "Node" role was generated to invite a new node to this
-cluster. And the 3rd token was generated to invite a new user.
+{/* TODO: This lengthy Details box should be a subsection. Using the Details box
+as a workaround until we have a way to control the visibility of subsections
+using the scope switcher */}
 
-The latter two tokens can be deleted (revoked) via [`tctl tokens
-del`](../reference/cli.mdx#tctl-tokens-rm) command:
-
-```code
-$ tctl tokens del (=presets.tokens.first=)
-# Token (=presets.tokens.first=) has been deleted
-```
-
-## Adding a Node located behind NAT
+<Details scope={["oss", "enterprise"]} scopeOnly={true} title="Node Tunneling" opened>
+Teleport Node Tunneling lets you add a remote Node to an existing Teleport Cluster through a tunnel.
+This can be useful for IoT applications or for managing a couple of servers in a different network.
 
 <Admonition type="note">
-  This feature is sometimes called "Teleport IoT" or node tunneling.
+We recommend setting up a [Trusted Cluster](../admin/trustedclusters.mdx) if you
+have workloads split across different networks or clouds.
 </Admonition>
 
-With the current setup, you've only been able to add nodes that have direct access to the
-auth server and within the internal IP range of the cluster. We recommend
-setting up a [Trusted Cluster](../admin/trustedclusters.mdx) if you have workloads split
-across different networks/clouds.
+To connect a Node to your cluster via Node Tunneling, use `tctl` to create a
+single-use token for a Node. Instead of supplying the IP of the Auth Service for
+the `--auth-server` flag, you will use the URL of the Proxy Service.
 
-Teleport Node Tunneling lets you add a remote node to an existing Teleport Cluster through a tunnel.
-This can be useful for IoT applications, or for managing a couple of servers in a different network.
-
-Similar to [Adding Nodes to the Cluster](#adding-nodes-to-the-cluster), use `tctl` to
-create a single-use token for a node, but this time you'll replace the auth
-server IP with the URL of the proxy server. In the example below, we've
-replaced the auth server IP with the proxy web endpoint `teleport-proxy.example.com:3080`.
+In the example below, we've replaced the auth server IP with the Proxy's web
+endpoint `teleport-proxy.example.com:3080`.
 
 ```code
 $ tctl tokens add --type=node | grep -oP '(?<=token:\s).*' > token.file
@@ -158,10 +164,22 @@ $ tctl tokens add --type=node | grep -oP '(?<=token:\s).*' > token.file
 $ sudo teleport start --roles=node --token=/path/to/token.file --auth-server=teleport-proxy.example.com:3080
 ```
 
-Using the ports in the default configuration, the node needs to be able to talk to ports `3080` and `3024` on the proxy. Port `3080` is used to initially fetch the credentials (SSH and TLS certificates) and for discovery (where is the reverse tunnel running, in this case, `3024`). For those using ACME, port `443` is also required. Port `3024 `is used to establish a connection to the auth server through the proxy.
+Using the ports in Teleport's default configuration, the Node needs to be able
+to talk to ports `3080` and `3024` on the Proxy Service. Port `3080` is used to
+initially fetch the credentials (SSH and TLS certificates) and for discovering
+the reverse tunnel. Port `3024 `is used to establish a connection to the Auth
+Service through the Proxy.
+
+For those using ACME, port `443` is also required. 
 
-To enable multiplexing so only one port is used, simply set the `tunnel_listen_addr` the same as the
-`web_listen_addr` respectively within the `proxy_service`.  Teleport will automatically recognize using the same port and enable multiplexing. If the log setting is set to DEBUG you will see multiplexing enabled in the server log.
+To enable multiplexing so only one port is used, simply set the
+`tunnel_listen_addr` to the same value as `web_listen_addr` within the
+`proxy_service` section of your configuration file. Teleport will automatically
+recognize that the Proxy Service is using the same port for both addresses and
+enable multiplexing.
+
+If your log setting is set to DEBUG, you will see multiplexing enabled in the
+server log.
 
 ```txt
 DEBU [PROC:1]    Setup Proxy: Reverse tunnel proxy and web proxy listen on the same port, multiplexing is on. service/service.go:1944
@@ -171,26 +189,66 @@ DEBU [PROC:1]    Setup Proxy: Reverse tunnel proxy and web proxy listen on the s
   type="tip"
   title="Load Balancers"
 >
-  The setup above also works even if the cluster uses multiple proxies behind a load balancer (LB) or a DNS entry with multiple values.  This works by the node establishing a tunnel to *every* proxy. This requires that an LB
-  uses a round-robin or a similar balancing algorithm. Do not use sticky load balancing algorithms (a.k.a. "session affinity") with Teleport proxies.
+
+  The setup above also works even if the cluster uses multiple Proxy Service
+  instances behind a load balancer (LB) or a DNS entry with multiple values. In
+  this case, the Node establishes a tunnel to every proxy.
+  
+  This requires that an LB
+  uses a round-robin or a similar balancing algorithm. Do not use sticky load balancing algorithms (a.k.a. "session affinity") with Teleport Proxy Service instances.
 </Admonition>
 
-## Next Steps
+</Details>
 
-### Untrusted auth servers
+## Revoking invitations
 
-Teleport nodes use the HTTPS protocol to offer the join tokens to the auth
-server running on `10.0.10.5` in the example above. In a zero-trust environment,
-you must assume that an attacker can hijack the IP address of the auth server
-e.g. `10.0.10.5`.
+Tokens used for joining Nodes to a cluster can be revoked before they are used.
+To see a list of outstanding tokens, run this command:
 
-To prevent this from happening, you need to supply every new node with an
-additional bit of information about the auth server. This technique is called
-"CA Pinning". It works by asking the auth server to produce a "CA Pin". 
-CA Pin is a hash value of the SPKI header in a certificate. An attacker can't
-easilly forge a matching private key.
+```code
+$ tctl tokens ls
 
-On the auth server:
+# Token                                Role       Expiry Time (UTC)
+# -----                                ----       -----------------
+# (=presets.tokens.first=)     Proxy      never
+# (=presets.tokens.second=)     Node       17 May 16 03:51 UTC
+# (=presets.tokens.third=)     Signup     17 May 16 04:24 UTC
+```
+
+<Admonition type="tip" title="Signup tokens">
+
+The output of `tctl tokens ls` includes tokens used for adding users alongside
+tokens used for adding Nodes to your cluster.
+
+</Admonition>
+
+In this example, the first token has a `never` expiry date because it is a
+static token configured via a config file.
+
+The token with the `Node` role was generated to invite a new Node to this
+cluster. And the third token was generated to invite a new user to sign up.
+
+The latter two tokens can be deleted (revoked) via the `tctl tokens
+del` command:
+
+```code
+$ tctl tokens del (=presets.tokens.first=)
+# Token (=presets.tokens.first=) has been deleted
+```
+
+## Untrusted Auth Servers
+
+Teleport Nodes use the HTTPS protocol to offer an invite token to the Auth Service.
+In a zero-trust environment, you must assume that an attacker can hijack the IP
+address of the Auth Service.
+
+To prevent this from happening, you need to supply every new Node with an
+additional bit of information about the Auth Service. This technique is called
+**CA pinning**. It works by asking the Auth Service to produce a CA pin, a hash
+value of the SPKI header in a certificate. This way, an attacker cannot easily
+forge a matching private key.
+
+Retrieve the CA pin of the Auth Service:
 
 ```code
 $ tctl status
@@ -201,10 +259,9 @@ $ tctl status
 # CA pin   sha256:7e12c17c20d9cb504bbcb3f0236be3f446861f1396dcbb44425fe28ec1c108f1
 ```
 
-The CA pin at the bottom needs to be passed to the new nodes when they're
-starting for the first time, i.e. when they join a cluster:
-
-Via CLI:
+The CA pin at the bottom needs to be passed to new Nodes when they're
+starting for the first time, i.e. when they join a cluster. Here is an
+example of running `teleport start` on a Node with a CA pin:
 
 ```code
 $ sudo teleport start \
@@ -214,7 +271,7 @@ $ sudo teleport start \
    --auth-server=10.12.0.6:3025
 ```
 
-or via `/etc/teleport.yaml` on a node:
+You can also supply a CA pin by modifying `/etc/teleport.yaml` on a Node:
 
 ```yaml
 teleport:
@@ -226,39 +283,12 @@ teleport:
 
 <Admonition
   type="warning"
-  title="Warning"
+  title="Warnings"
 >
-  If a CA pin is not provided, the Teleport Node will join a
-  cluster but it will print a `WARN` message (warning) into its standard error output.
-</Admonition>
-
-<Admonition
-  type="warning"
-  title="Warning"
->
-  The CA pin becomes invalid if a Teleport administrator
+  - If a CA pin is not provided, the Teleport Node will join a cluster but it will
+  print a `WARN` message (warning).
+  - The CA pin becomes invalid if a Teleport administrator
   performs the CA rotation by executing
   [`tctl auth rotate`](../reference/cli.mdx#tctl-auth-rotate) .
 </Admonition>
 
-### Insecure: Static tokens
-
-<Admonition type="warning">
-Use short-lived tokens instead of long-lived static tokens.
-Static tokens are easier to steal, guess or leak.
-</Admonition>
-
-Static tokens are defined ahead of time by an administrator and stored in the
-auth server's config file:
-
-```yaml
-# Config section in `/etc/teleport.yaml` file for the auth server
-auth_service:
-    enabled: true
-    tokens:
-    # This static token allows new hosts to join the cluster as "proxy" or "node"
-    - "proxy,node:secret-token-value"
-    # A token can also be stored in a file. In this example the token for adding
-    # new auth servers are stored in /path/to/tokenfile
-    - "auth:/path/to/tokenfile"
-```
diff --git a/docs/pages/setup/admin/daemon.mdx b/docs/pages/setup/admin/daemon.mdx
index 718288ae09cfe..8be2c3b565482 100644
--- a/docs/pages/setup/admin/daemon.mdx
+++ b/docs/pages/setup/admin/daemon.mdx
@@ -53,6 +53,6 @@ administrator must:
 
 1. Replace the Teleport binaries, usually [`teleport`](../reference/cli.mdx#teleport)
    and [`tctl`](../reference/cli.mdx#tctl)
-2. Execute `systemctl restart teleport`
+2. Execute `systemctl reload teleport`
 
 This will perform a graceful restart, i.e. the Teleport daemon will fork a new process to handle new incoming requests, leaving the old daemon process running until existing clients disconnect.
diff --git a/docs/pages/setup/admin/github-sso.mdx b/docs/pages/setup/admin/github-sso.mdx
index 5bc4abdc92dbb..ef0d68de25c10 100644
--- a/docs/pages/setup/admin/github-sso.mdx
+++ b/docs/pages/setup/admin/github-sso.mdx
@@ -1,112 +1,146 @@
 ---
-title: GitHub SSO
+title: Set up Single Sign-On with GitHub
 description: Setting up Github SSO
 videoBanner: XjgN2WWFCX8
 ---
 
-This guide explains how to set up Github SSO with Open Source, Enterprise Teleport,
-self-hosted or cloud.
+This guide explains how to set up Github Single Sign On (SSO) for Teleport.
 
 ## Prerequisites
 
-- Installed [Teleport](../../getting-started.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
-- [Tctl admin tool](https://goteleport.com/teleport/download) >= (=teleport.version=)
+<Tabs>
+<TabItem scope={["oss"]} label="Self-Hosted">
+- Install Teleport and the `tctl` admin tool version >= (=teleport.version=).
 
-(!docs/pages/includes/tctl.mdx!)
+  See [Installation](../../installation.mdx) for details.
 
-<Admonition type="note">
-For cloud, login with a teleport user with editor privileges:
-```code
-# tsh logs you in and receives short-lived certificates
-$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
-# try out the connection
-$ tctl get nodes
-```
-</Admonition>
+- Create and register a GitHub OAuth App. To do so, follow the instructions in
+  GitHub's documentation.
+
+  [Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
+
+  Ensure that your OAuth App's "Authentication callback URL" is
+  `https://PROXY_ADDRESS/v1/webapi/github/`, where `PROXY_ADDRESS` is the public
+  address of the Teleport Proxy Service. 
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+- Install Teleport and the `tctl` admin tool version >= (=teleport.version=).
+
+  To download Teleport Enterprise, visit the
+  [customer portal](https://dashboard.gravitational.com/web/login).
+  
+- Create and register a GitHub OAuth App. To do so, follow the instructions in
+  GitHub's documentation.
+
+  [Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
+
+  Ensure that your OAuth App's "Authentication callback URL" is
+  `https://PROXY_ADDRESS/v1/webapi/github/`, where `PROXY_ADDRESS` is the public
+  address of the Teleport Proxy Service. 
+</TabItem>
+<TabItem scope={["cloud"]}
+  label="Cloud">
+
+- Sign up for a Teleport Cloud account. If you do not have one, visit the
+  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+
+- Create and register a GitHub OAuth App. To do so, follow the instructions in GitHub's documentation. 
+
+  [Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
+
+  Ensure that your OAuth App's "Authentication callback URL" is
+  `https://PROXY_ADDRESS/v1/webapi/github/`, where `PROXY_ADDRESS` is the domain
+  name of your Teleport Cloud tenant (e.g., mytenant.teleport.sh).
+
+</TabItem>
+</Tabs>
+
+(!docs/pages/includes/tctl.mdx!)
 
-## Step 1/2. Create Github connector
+## Step 1/2. Create a GitHub authentication connector
 
-Define a Github connector:
+Define a GitHub authentication connector by creating a file called `github.yaml`
+with the following content:
 
 ```yaml
-# Create a file called github.yaml:
 kind: github
 version: v3
 metadata:
-  # connector name that will be used with `tsh --auth=github login`
+  # Connector name that will be used with `tsh --auth=github login`
   name: github
 spec:
-  # Client ID of Github OAuth app
+  # Client ID of your GitHub OAuth App
   client_id: <client-id>
-  # Client secret of Github OAuth app
+  # Client secret of your GitHub OAuth App
   client_secret: <client-secret>
-  # Connector display name that will be shown on web UI login screen
-  display: Github
+  # Connector display name that will be shown on the Web UI login screen
+  display: GitHub
   # Callback URL that will be called after successful authentication
   redirect_url: https://<proxy-address>/v1/webapi/github/callback
   # Mapping of org/team memberships onto allowed logins and roles
   teams_to_logins:
-    - organization: octocats # Github organization name
-      team: admins # Github team name within that organization
-      # maps octocats/admins to teleport role access
+    - organization: octocats # GitHub organization name
+      team: admins # GitHub team name within that organization
+      # Maps octocats/admins to the "access" Teleport role
       logins:
         - access
 ```
 
-To obtain a client ID and client secret, please follow Github documentation on
-how to [create and register an OAuth app](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/).
+The values of `client_id`, `client_secret`, and `redirect_url` come from the
+GitHub OAuth App you created earlier.
 
-Be sure to set the "Authorization callback URL" to the same value as `redirect_url` in the resource spec.
+Teleport will request only the `read:org` OAuth scope. Read more about OAuth scopes in GitHub's documentation:
 
-Teleport will request only the `read:org` OAuth scope, you can read more about
-[Github OAuth scopes](https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/).
+[Github OAuth scopes](https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/)
 
-Finally, create the connector using [`tctl`](../reference/cli.mdx#tctl)
-[resource](../reference/resources.mdx) management command:
+Finally, create the connector using `tctl`:
 
 ```code
 $ tctl create github.yaml
 ```
 
 <Admonition type="tip">
-  When going through the Github authentication flow for the first time,
+  When going through the GitHub authentication flow for the first time,
   the application must be granted access to all organizations that are
   present in the "teams to logins" mapping, otherwise Teleport will not be
-  able to determine team memberships for these orgs.
+  able to determine team memberships for these organizations.
 </Admonition>
 
 ## Step 2/2. Configure authentication preference
 
-Configure Teleport Auth Service Github for authentication:
+Configure the Teleport Auth Service to enable the GitHub authentication
+connector.
 
-<Tabs>
-  <TabItem label="Static Config (self-hosted)">
-  ```yaml
-  # Snippet from /etc/teleport.yaml
-  auth_service:
-    authentication:
-      type: github
-  ```
-  </TabItem>
-  <TabItem label="Dynamic resources (all editions)">
-  Create a file `cap.yaml`:
-  ```yaml
-  kind: cluster_auth_preference
-  metadata:
-    name: cluster-auth-preference
-  spec:
-    type: github
-    webauthn:
-      rp_id: 'example.teleport.sh'
-  version: v2
-  ```
+Create a file called `cap.yaml` with the following content:
 
-  Create a resource:
+```yaml
+kind: cluster_auth_preference
+metadata:
+  name: cluster-auth-preference
+spec:
+  type: github
+  webauthn:
+    rp_id: 'example.teleport.sh'
+version: v2
+```
 
-  ```code
-  $ tctl create -f cap.yaml
-  ```
-  </TabItem>
-</Tabs>
+Create the resource:
+
+```code
+$ tctl create -f cap.yaml
+```
+
+<Details scope={["enterprise", "oss"]} scopeOnly={true} opened title="Static configuration file">
+
+You can also edit your Teleport configuration file to include the following:
+
+```yaml
+# Snippet from /etc/teleport.yaml
+auth_service:
+  authentication:
+    type: github
+```
+</Details>
 
-You can now login with Teleport using `github` SSO.
+You can now log in with Teleport using GitHub SSO.
diff --git a/docs/pages/setup/admin/troubleshooting.mdx b/docs/pages/setup/admin/troubleshooting.mdx
index a34e70d1f31e5..a25257ebdedf4 100644
--- a/docs/pages/setup/admin/troubleshooting.mdx
+++ b/docs/pages/setup/admin/troubleshooting.mdx
@@ -15,27 +15,9 @@ run with verbose logging enabled by passing it `-d` flag.
   It is not recommended to run Teleport in production with verbose logging as it generates a substantial amount of data.
 </Admonition>
 
-Sometimes you may want to reset [`teleport`](../reference/cli.mdx#teleport) to a clean
-state. This can be accomplished by erasing everything under `"data_dir"`
-directory. Assuming the default location, `rm -rf /var/lib/teleport/*` will do.
-
-Teleport also supports HTTP endpoints for monitoring purposes. They are disabled
-by default, but you can enable them:
-
-```code
-$ sudo teleport start --diag-addr=127.0.0.1:3000
-```
-
-Now you can see the monitoring information by visiting several endpoints:
-
-- `http://127.0.0.1:3000/metrics` is the list of internal metrics Teleport is tracking. It is compatible with [Prometheus](https://prometheus.io/)
-  collectors. For a full list of metrics review our [metrics reference](../reference/metrics.mdx).
-- `http://127.0.0.1:3000/healthz` returns "OK" if the process is healthy or
-  `503` otherwise.
-- `http://127.0.0.1:3000/readyz` is similar to `/healthz`, but it returns "OK"
-  *only after* the node successfully joined the cluster, i.e.it draws the difference between "healthy" and "ready".
-- `http://127.0.0.1:3000/debug/pprof/` is Golang's standard profiler. It's only
-  available when `-d` flag is given in addition to `--diag-addr`
+Sometimes you may want to reset [`teleport`](../reference/cli.mdx#teleport) to a
+clean state. This can be accomplished by erasing everything under the `data_dir`
+directory, which defaults to `/var/lib/teleport/`.
 
 ## Debug dump
 
diff --git a/docs/pages/setup/admin/trustedclusters.mdx b/docs/pages/setup/admin/trustedclusters.mdx
index 7873dbeb884ed..f8432db18ec0f 100644
--- a/docs/pages/setup/admin/trustedclusters.mdx
+++ b/docs/pages/setup/admin/trustedclusters.mdx
@@ -31,7 +31,7 @@ This guide's focus is on more in-depth coverage of trusted clusters features and
   type="tip"
   title="Teleport Node Tunneling"
 >
-  If you have a large number of devices on different networks, such as managed IoT devices or a couple of nodes on a different network you can utilize the [Teleport Node Tunneling](./adding-nodes.mdx#adding-a-node-located-behind-nat).
+  If you have a large number of devices on different networks, such as managed IoT devices or a couple of nodes on a different network you can utilize [Teleport Node Tunneling](./adding-nodes.mdx).
 </Admonition>
 
 ## Introduction
diff --git a/docs/pages/setup/deployments/aws-terraform.mdx b/docs/pages/setup/deployments/aws-terraform.mdx
index 655746343b030..9aed641328ee5 100644
--- a/docs/pages/setup/deployments/aws-terraform.mdx
+++ b/docs/pages/setup/deployments/aws-terraform.mdx
@@ -758,7 +758,7 @@ auth_servers:
 ### Joining nodes via Teleport IoT/node tunneling
 
 To join Teleport nodes from outside the same VPC, you will either need to investigate VPC peering/gateways (out of scope
-for this document) or join your nodes using [Teleport's node tunneling](../admin/adding-nodes.mdx#adding-a-node-located-behind-nat) functionality.
+for this document) or join your nodes using [Teleport's node tunneling](../admin/adding-nodes.mdx) functionality.
 
 With this method, you can join the nodes using the public facing proxy address - `teleport.example.com:443` for our
 example.
diff --git a/docs/pages/setup/guides/fluentd.mdx b/docs/pages/setup/guides/fluentd.mdx
index 28ce9f79370bf..a78eb48a2f0c9 100644
--- a/docs/pages/setup/guides/fluentd.mdx
+++ b/docs/pages/setup/guides/fluentd.mdx
@@ -4,37 +4,82 @@ description: Forwarding events with Fluentd and Teleport event handler
 videoBanner: HAqxs4rBv2c
 ---
 
-This section will cover:
+In this guide, we will explain how to:
 
-- Setting up Teleport's event handler.
-- Forwarding events with Fluentd for Cloud, Enterprise and Open Source editions.
+- Set up Teleport's event handler.
+- Forward events with Fluentd.
 
 ## Prerequisites
 
-- Teleport v(=teleport.version=) Cloud, Open Source or Enterprise
-- Teleport admin tool `tctl` configured to access the cluster.
+<Tabs>
+<TabItem scope={["oss"]} label="Self-Hosted">
+
+- A running Teleport cluster. For details on how to set this up, see [Getting
+  Started on a Linux Server](../../getting-started/linux-server.mdx).
+
+- The `tctl` admin tool version >= (=teleport.version=).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  See [Installation](../../installation.mdx) for details.
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+
+- A running Teleport cluster. For details on setting this up, see our
+  [Enterprise getting started guide](../../enterprise/getting-started.mdx).
+
+- The `tctl` admin tool version >= (=teleport.version=), which you can download
+  by visiting the
+  [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+<TabItem scope={["cloud"]}
+  label="Teleport Cloud">
+
+- A Teleport Cloud account. If you do not have one, visit the
+  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+
+- The Enterprise version of the `tctl` admin tool. To download this, visit
+the [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+</TabItem>
+</Tabs>
+
 - Fluentd version v(=fluentd.version=).
 - Docker version v(=docker.version=).
 
-```code
-$ tctl version
-# Teleport v(=teleport.version=) go(teleport.golang)
-#
-# Test connectivity and admin permissions
-$ tctl get roles
-```
-
-Create a folder `fluentd` to hold configuration and plugin state:
+Create a folder called `fluentd` to hold configuration and plugin state:
 
 ```code
 $ mkdir -p event-handler
 $ cd event-handler
 ```
 
-## Step 1/6. Install event handler plugin
+## Step 1/6. Install the event handler plugin
 
-Teleport event handler runs alongside fluentd forwarder, receives events from Teleport's events API
-and forwards them to fluentd.
+The Teleport event handler runs alongside the Fluentd forwarder, receives events
+from Teleport's events API, and forwards them to Fluentd.
 
 <Tabs>
   <TabItem label="Linux">
@@ -54,13 +99,30 @@ and forwards them to fluentd.
 
 ## Step 2/6. Generate configuration
 
-Run `configure` command to generate sample configuration. Replace `teleport.example.com:443`
-with the DNS name and web proxy port of Teleport's proxy:
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+Run the `configure` command to generate a sample configuration. Replace
+`teleport.example.com:443` with the DNS name and HTTPS port of Teleport's Proxy
+Service:
 
 ```code
 $ ./teleport-event-handler configure . teleport.example.com:443
 ```
 
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
+
+Run the `configure` command to generate a sample configuration. Replace
+`mytenant.teleport.sh` with the DNS name of your Teleport Cloud tenant:
+
+```code
+$ ./teleport-event-handler configure . mytenant.teleport.sh
+```
+
+</TabItem>
+</Tabs>
+
 You'll see the following output:
 
 ```txt
@@ -76,7 +138,7 @@ Follow-along with our getting started guide:
 https://goteleport.com/setup/guides/fluentd
 ```
 
-Plugin has generated several setup files:
+The plugin generates several setup files:
 
 ```code
 $ ls -l
@@ -91,15 +153,19 @@ $ ls -l
 # -rw------- 1 bob bob      343 Jul  1 11:14 teleport-event-handler.toml
 ```
 
-- `ca.crt` and `ca.key` is a fluentd self-signed CA certificate and a private key.
-- `server.crt` and `server.key` is a fluentd server certificate and key.
-- `client.crt` and `client.key` is a fluentd client certificate and key, all signed by the generated CA.
-- `teleport-event-handler-role.yaml` is a Teleport's event handler client user and role.
-- `fluent.conf` is a fluentd plugin configuration.
+|File(s)|Purpose|
+|---|---|
+| `ca.crt` and `ca.key`| Self-signed CA certificate and private key for Fluentd|
+| `server.crt` and `server.key`| Fluentd server certificate and key|
+| `client.crt` and `client.key`| Fluentd client certificate and key, all signed by the generated CA|
+| `teleport-event-handler-role.yaml`| `user` and `role` resource definitions for Teleport's event handler |client.
+| `fluent.conf`| Fluentd plugin configuration|
 
-## Step 3/6. Create user and role for reading audit events
+## Step 3/6. Create a user and role for reading audit events
 
-`configure` command generated `teleport-event-handler-role.yaml` that defines a `teleport-event-handler` role and a user with read-only access to the `event` API:
+The `configure` command generates a file called
+`teleport-event-handler-role.yaml` that defines a `teleport-event-handler` role
+and a user with read-only access to the `event` API:
 
 ```yaml
 kind: user
@@ -130,24 +196,16 @@ $ tctl create -f teleport-event-handler-role.yaml
 
 ## Step 4/6. Create teleport-event-handler credentials
 
-Teleport Plugin use the fluentd role and user to read the events. We export the identity files, using tctl auth sign.
-
-```code
-$ tctl auth sign --out identity --user teleport-event-handler
-# The credentials have been written to identity
-```
-
-This will generate `identity` which contains TLS certificates and will be used to connect plugin to your Teleport instance.
-
-<Admonition type="note">
-Clients, for example cloud interactive users, could be missing impersonation privileges when trying to use `tctl auth sign`,
-will get the following error:
+### Enable impersonation of the Fluentd plugin user
 
-```txt
-ERROR: access denied: impersonation is not allowed
-```
+In order for the Fluentd plugin to forward events from your Teleport cluster, it
+needs a signed identity file from the cluster's certificate authority. The
+Fluentd user cannot request this itself, and requires another user to
+**impersonate** this account in order to request a certificate.
 
-Create the following file with role: `teleport-event-handler-impersonator.yaml`:
+Create a role that enables your user to impersonate the Fluentd user. First,
+paste the following YAML document into a file called
+`teleport-event-handler-impersonator.yaml`:
 
 ```yaml
 kind: role
@@ -169,28 +227,61 @@ spec:
       roles: ["teleport-event-handler"]
 ```
 
+Next, create the role:
+
 ```code
 $ tctl create teleport-event-handler-impersonator.yaml
 ```
 
-Assign this role to the current user by running the below command, subsituing the user as appropriate:
+Assign this role to the current user by running the following command, substituting
+the user as appropriate:
+
 ```code
 $ tctl get users/<USER> > out.yaml
 ```
 
-Now edit `out.yaml` with your favourite editor, adding `teleport-event-handler-impersonator` to the list of existing roles and update via `tctl` again:
+Now edit `out.yaml`, adding `teleport-event-handler-impersonator` to the list of
+existing roles and update via `tctl` again:
+
 ```
 $ tctl create -f out.yaml
 ```
 
-Re-login to assume the new role and try to issue certificate for the teleport-event-handle user again.
-</Admonition>
+Log in to your Teleport cluster again to assume the new role.
+
+### Export an identity file for the Fluentd plugin user
 
-## Step 5/6. Start fluentd forwarder
+The Fluentd Teleport plugin uses the `teleport-event-handler` role and user to
+read events. We export an identity file for the user with the `tctl auth sign`
+command.
 
-The plugin will send events to the fluentd instance using keys generated on the previous step.
+<Tabs>
+<TabItem label="Self-Hosted" scope={["oss","enterprise"]}>
+```code
+$ tctl auth sign --format=tls --user=teleport-event-handler --out=auth
+```
 
-Generated sample `fluent.conf` file sets accepts events using `TLS` and prints them:
+This command should result in three PEM-encoded files: `auth.crt`, `auth.key`,
+and `auth.cas` (certificate, private key, and CA certs, respectively).
+
+</TabItem>
+<TabItem label="Teleport Cloud" scope={["cloud"]}>
+```code
+$ tctl auth sign --user=teleport-event-handler --out=identity
+```
+
+The above sequence should result in one PEM-encoded file: `terraform-identity`.
+
+</TabItem>
+</Tabs>
+
+## Step 5/6. Start the Fluentd forwarder
+
+The Fluentd plugin will send events to your Fluentd instance using keys
+generated on the previous step.
+
+The `fluent.conf` file generated earlier configures your Fluentd instance to
+accept events using TLS and print them:
 
 ```
 <source>
@@ -223,7 +314,7 @@ Generated sample `fluent.conf` file sets accepts events using `TLS` and prints t
 </match>
 ```
 
-To try it out, start fluentd instance:
+To try out this Fluentd configuration, start your fluentd instance:
 
 ```code
 $ docker run -u $(id -u ${USER}):$(id -g ${USER}) -p 8888:8888 -v $(pwd):/keys -v $(pwd)/fluent.conf:/fluentd/etc/fluent.conf fluent/fluentd:edge
@@ -231,8 +322,11 @@ $ docker run -u $(id -u ${USER}):$(id -g ${USER}) -p 8888:8888 -v $(pwd):/keys -
 
 ## Step 6/6. Start the event handler plugin
 
-`configure` command generated `teleport-event-handler.toml` configuration file
-for the event handler:
+Earlier, we generated a file called `teleport-event-handler.toml` to configure
+the Fluentd event handler. This file includes setting similar to the following:
+
+<Tabs>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
 
 ```toml
 storage = "./storage"
@@ -251,27 +345,53 @@ addr = "example.teleport.com:443"
 identity = "identity"
 ```
 
-Start an export from the current moment:
+</TabItem>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```toml
+storage = "./storage"
+timeout = "10s"
+batch = 20
+namespace = "default"
+
+[forward.fluentd]
+ca = "/home/sasha/scripts/event-handler/ca.crt"
+cert = "/home/sasha/scripts/event-handler/client.crt"
+key = "/home/sasha/scripts/event-handler/client.key"
+url = "https://localhost:8888/test.log"
+
+[teleport]
+addr = "example.teleport.com:443"
+client_key = "auth.key"
+client_crt = "auth.crt"
+root_cas = "auth.cas"
+```
+
+</TabItem>
+</Tabs>
+
+To start the event handler, run the following command:
 
 ```code
 $ ./teleport-event-handler start --config teleport-event-handler.toml
 ```
 
 <Admonition type="note">
-This example will start export from `May 5th 2021`:
+
+This example will start exporting from `May 5th 2021`:
 
 ```code
 $ ./teleport-event-handler start --config teleport-event-handler.toml --start-time "2021-05-05T00:00:00Z"
 ```
 
-Start time can be set only once, on the first run of the tool.
+The start time can be set only once, on the first run of the tool.
 
-If you want to change the time frame later, remove plugin state dir
-which you had specified in `storage-dir` argument.
+If you want to change the time frame later, remove the plugin state directory
+that you specified in the `storage` field of the handler's configuration file.
 
 </Admonition>
 
-Once handler starts, you will see notifications about scanned and forwarded events:
+Once the handler starts, you will see notifications about scanned and forwarded events:
 
 ```txt
 INFO[0046] Event sent id=0b5f2a3e-faa5-4d77-ab6e-362bca0994fc ts="2021-06-08 11:00:56.034 +0000 UTC" type=user.login
diff --git a/docs/pages/setup/guides/joining-nodes-aws.mdx b/docs/pages/setup/guides/joining-nodes-aws.mdx
index 5d1423afb3707..96c0a62af6d6d 100644
--- a/docs/pages/setup/guides/joining-nodes-aws.mdx
+++ b/docs/pages/setup/guides/joining-nodes-aws.mdx
@@ -1,6 +1,6 @@
 ---
 title: Joining Nodes in AWS
-description: How to join nodes and proxies running on AWS
+description: How to join Nodes and Proxies running on AWS
 h1: Joining Nodes and Proxies in AWS
 ---
 
@@ -23,7 +23,11 @@ IAM credentials with `ec2:DescribeInstances` permissions are required on your
 Teleport Auth server.
 No IAM credentials are required on the Nodes or Proxies.
 
-The **IAM join method** is available in Teleport 8.3+ cloud or self-hosted.
+<Notice scope={["cloud"]} type="warning">
+Teleport Cloud does not support the EC2 join method.
+</Notice>
+
+The **IAM join method** is available in Teleport 8.3+ Cloud or self-hosted.
 It is available to any Teleport Node or Proxy running anywhere with access to
 IAM credentials, such as an EC2 instance with an attached IAM role.
 No specific permissions or IAM policy is required: an IAM role with no attached
@@ -102,7 +106,7 @@ for details.
 ## Step 2/4. Create the AWS Node Joining token
 
 Configure your Teleport auth server with a special dynamic token which will
-allow nodes from your AWS account to join your Teleport cluster.
+allow Nodes from your AWS account to join your Teleport cluster.
 
 <Tabs>
   <TabItem label="IAM Method">
@@ -132,11 +136,11 @@ spec:
   join_method: iam
 
   allow:
-  # specify the AWS account which nodes may join from
+  # Specify the AWS account that Nodes may join from
   - aws_account: "111111111111"
   # multiple allow rules are supported
   - aws_account: "222222222222"
-  # aws_arn is optional and allows you to restrict the IAM role of joining nodes
+  # aws_arn is optional and allows you to restrict the IAM role of joining Nodes
   - aws_account: "333333333333"
     aws_arn: "arn:aws:sts::111111111111:assumed-role/teleport-node-role/i-*"
 ```
@@ -228,7 +232,7 @@ Kubernetes, Application, or Database roles. The service should be run directly
 on an AWS EC2 instance and must have network access to the AWS EC2 IMDSv2
 (enabled by default for most EC2 instances).
 
-Configure your Teleport node with a custom `teleport.yaml` file. Use the
+Configure your Teleport Node with a custom `teleport.yaml` file. Use the
 `join_params` section with `token_name` matching your token created in Step 2
 and `method: ec2` as shown in the following example config:
 
@@ -252,7 +256,7 @@ proxy_service:
 
 ## Step 4/4. Launch your Teleport Node
 
-Start Teleport on the node and confirm that it is able to connect to and join
+Start Teleport on the Node and confirm that it is able to connect to and join
 your cluster. You're all set!
 
 <Admonition type="note">
@@ -269,11 +273,11 @@ re-running `tctl create -f token.yaml`.
 ### Configuring the EC2 join method for Multiple AWS Accounts
 
 <Admonition type="note">
-This section is not necessary when using the IAM join method, multiple accounts
+This section is not necessary when using the IAM join method. Multiple accounts
 are support by default.
 </Admonition>
 
-In order for Teleport nodes to join from EC2 instances in AWS accounts other
+In order for Teleport Nodes to join from EC2 instances in AWS accounts other
 than the account in which your Teleport auth server is running, Teleport must
 have permissions to assume an IAM role in each of those accounts and call
 `ec2:DescribeInstances` in the foreign account.
@@ -317,7 +321,7 @@ In the AWS account where your Teleport auth server is running:
 2. Attach this `teleport-AssumeRole-policy` to the IAM role your Teleport auth
    server has credentials for, see [Step 1.2](#step-12-attach-the-iam-policy).
 
-When creating the AWS Node Joining token, include an allow rule for each foreign
+When creating the AWS Node joining token, include an allow rule for each foreign
 account and specify the AWS ARN for the foreign
 `teleport-DescribeInstances-role`.
 
diff --git a/docs/pages/setup/guides/terraform-provider.mdx b/docs/pages/setup/guides/terraform-provider.mdx
index 33a5dd4441784..35256435a8648 100644
--- a/docs/pages/setup/guides/terraform-provider.mdx
+++ b/docs/pages/setup/guides/terraform-provider.mdx
@@ -4,25 +4,89 @@ description: Configuration as a code with Terraform Provider
 videoBanner: YgNHD4SS8dg
 ---
 
-This section will cover:
+This guide will explain how to:
 
-- Setting up Teleport's terraform provider on Linux and Mac.
-- Configuring users and roles using terraform provider for Cloud, Enterprise and Open Source editions.
+- Set up Teleport's Terraform provider on Linux and Mac.
+- Configure Teleport users and roles using the Terraform provider.
 
 ## Prerequisites
 
+<Tabs>
+<TabItem scope={["oss"]} label="Self-Hosted">
+
+- A running Teleport cluster. For details on how to set this up, see [Getting
+  Started on a Linux Server](../../getting-started/linux-server.mdx).
+
+- The `tctl` admin tool version >= (=teleport.version=).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  See [Installation](../../installation.mdx) for details.
+
+  (!docs/pages/includes/tctl.mdx!)
+
 - [Terraform >= (=terraform.version=)+](https://learn.hashicorp.com/tutorials/terraform/install-cli)
-- Teleport (=teleport.version=) Cloud, Open Source or Enterprise
 
-```code
-$ terraform version
-# Terraform v(=terraform.version=)
-```
+  ```code
+  $ terraform version
+  # Terraform v(=terraform.version=)
+  ```
+
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+
+- A running Teleport cluster. For details on setting this up, see our
+  [Enterprise getting started guide](../../enterprise/getting-started.mdx).
+
+- The `tctl` admin tool version >= (=teleport.version=), which you can download
+  by visiting the
+  [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+- [Terraform >= (=terraform.version=)+](https://learn.hashicorp.com/tutorials/terraform/install-cli)
+
+  ```code
+  $ terraform version
+  # Terraform v(=terraform.version=)
+  ```
+
+</TabItem>
+<TabItem scope={["cloud"]}
+  label="Cloud">
+
+- A Teleport Cloud account. If you do not have one, visit the
+  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+
+- The Enterprise version of the `tctl` admin tool. To download this, visit
+the [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  (!docs/pages/includes/tctl.mdx!)
+
+- [Terraform >= (=terraform.version=)+](https://learn.hashicorp.com/tutorials/terraform/install-cli)
+
+  ```code
+  $ terraform version
+  # Terraform v(=terraform.version=)
+  ```
+
+</TabItem>
+</Tabs>
 
-```code
-$ tctl version
-# Teleport v(=teleport.version=) go(teleport.golang)
-```
 
 Create a folder `teleport-terraform` to hold some temporary files:
 
@@ -31,7 +95,7 @@ $ mkdir -p teleport-terraform
 $ cd teleport-terraform
 ```
 
-## Step 1/4. Install terraform provider
+## Step 1/4. Install the Terraform provider
 
 <Tabs>
   <TabItem label="Linux">
@@ -51,7 +115,54 @@ $ cd teleport-terraform
   </TabItem>
 </Tabs>
 
-## Step 2/4. Create a terraform user
+## Step 2/4. Create a Terraform user
+
+### Enable impersonation
+
+In order for Terraform to manage resources in your Teleport cluster, it needs a
+signed identity file from the cluster's certificate authority. The Terraform user
+cannot request this itself, and requires another user to **impersonate** this
+account in order to request a certificate.
+
+Create a role that enables your user to impersonate the Terraform user. First, paste
+the following YAML document into a file called `terraform-impersonator.yaml`:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: terraform-impersonator
+spec:
+  # SSH options used for user sessions
+  options:
+    # max_session_ttl defines the TTL (time to live) of SSH certificates
+    # issued to the users with this role.
+    max_session_ttl: 10h
+
+  # The allow section declares a list of resource/verb combinations that are
+  # allowed for the users of this role. By default, nothing is allowed.
+  allow:
+    impersonate:
+      users: ['terraform']
+      roles: ['terraform']
+
+  # The deny section uses the identical format as the 'allow' section.
+  # Deny rules always override allow rules.
+  deny:
+    node_labels:
+      '*': '*'
+```
+
+Next, create the role:
+
+```code
+$ tctl create terraform-impersonator.yaml
+```
+
+Assign this role to the current user. Log in to your Teleport cluster to assume
+the new role.
+
+### Create the Terraform user
 
 Put the following content into `terraform.yaml`:
 
@@ -74,79 +185,75 @@ spec:
 version: v2
 ```
 
-Run:
+Create the `terraform` user and role.
 
 ```code
 $ tctl create terraform.yaml
-$ tctl auth sign --format=file --user=terraform --out=terraform-identity --ttl=10h
 ```
 
-<Admonition type="note">
-Clients missing impersonation privileges when trying to use `tctl auth sign`,
-will get the following error:
+Next, request a signed certificate for the Terraform user:
 
-```txt
-ERROR: access denied: impersonation is not allowed
+<Tabs>
+  <TabItem label="Self-Hosted" scope={["oss","enterprise"]}>
+```code
+$ tctl auth sign --format=tls --user=terraform --out=auth
 ```
 
-Create the following file with role: `terraform-impersonator.yaml`:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: terraform-impersonator
-spec:
-  # SSH options used for user sessions
-  options:
-    # max_session_ttl defines the TTL (time to live) of SSH certificates
-    # issued to the users with this role.
-    max_session_ttl: 10h
-
-  # allow section declares a list of resource/verb combinations that are
-  # allowed for the users of this role. by default nothing is allowed.
-  allow:
-    impersonate:
-      users: ['terraform']
-      roles: ['terraform']
-
-  # the deny section uses the identical format as the 'allow' section.
-  # the deny rules always override allow rules.
-  deny:
-    node_labels:
-      '*': '*'
-```
+This command should result in three PEM-encoded files: `auth.crt`, `auth.key`,
+and `auth.cas` (certificate, private key, and CA certs, respectively).
 
+</TabItem>
+<TabItem label="Teleport Cloud" scope={["cloud"]}>
 ```code
-tctl create terraform-impersonator.yaml
+$ tctl auth sign --user=terraform --out=terraform-identity
 ```
 
-Assign this role to the current user. Re-login to assume the new role and try
-to issue certificate for terraform user again.
+The above sequence should result in one PEM-encoded file: `terraform-identity`.
 
-</Admonition>
+</TabItem>
+</Tabs>
 
-## Step 3/4. Create Terraform configuration
+## Step 3/4. Create a Terraform configuration
 
-Create a `main.tf` terraform file:
+Paste the following into a file called `main.tf` to define an example user and
+role using Terraform.
 
+<Tabs>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
 ```
-(!examples/resources/terraform/terraform-user-role.tf!)
+(!examples/resources/terraform/terraform-user-role-cloud.tf!)
 ```
-
-<Admonition type="note">
-Update `teleport.example.com:443` with the address of your Teleport cluster.
-</Admonition>
+</TabItem>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+```
+(!examples/resources/terraform/terraform-user-role-self-hosted.tf!)
+```
+</TabItem>
+</Tabs>
 
 ## Step 4/4. Apply the configuration
 
-Check the contents of `teleport-terraform` folder:
+Check the contents of the `teleport-terraform` folder:
+
+<Tabs>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
 
 ```code
 $ ls
 # main.tf  terraform-identity  terraform-impersonator.yaml  terraform.yaml
 ```
 
+</TabItem>
+<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+
+```code
+$ ls
+# main.tf  auth.crt  auth.key  auth.cas  terraform-impersonator.yaml  terraform.yaml
+```
+
+</TabItem>
+</Tabs>
+
 Init terraform and apply the spec:
 
 ```code
@@ -156,5 +263,5 @@ $ terraform apply
 
 ## Next Steps
 
-- Find the full list of [supported terraform provider resources](../reference/terraform-provider.mdx).
+- Find the full list of [supported Terraform provider resources](../reference/terraform-provider.mdx).
 - Read more about [impersonation](../../access-controls/guides/impersonation.mdx).
diff --git a/docs/pages/setup/operations/ca-rotation.mdx b/docs/pages/setup/operations/ca-rotation.mdx
index 6be371fca1769..dfeabee9a2388 100644
--- a/docs/pages/setup/operations/ca-rotation.mdx
+++ b/docs/pages/setup/operations/ca-rotation.mdx
@@ -5,63 +5,125 @@ description: How to rotate Teleport's certificate authority
 
 ## Prerequisites
 
-- Installed [Teleport](../../getting-started.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
-- [Tctl admin tool](https://goteleport.com/teleport/download) >= (=teleport.version=)
+<Tabs>
+<TabItem scope={["oss"]} label="Self-Hosted">
+
+- A running Teleport cluster. For details on how to set this up, see [Getting
+  Started on a Linux Server](../../getting-started/linux-server.mdx).
+
+- The `tctl` admin tool version >= (=teleport.version=).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+  See [Installation](../../installation.mdx) for details.
+
+</TabItem>
+<TabItem
+  scope={["enterprise"]} label="Enterprise">
+
+- A running Teleport cluster. For details on setting this up, see our
+  [Enterprise getting started guide](../../enterprise/getting-started.mdx).
+
+- The `tctl` admin tool version >= (=teleport.version=), which you can download
+  by visiting the
+  [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+</TabItem>
+<TabItem scope={["cloud"]}
+  label="Cloud">
+
+- A Teleport Cloud account. If you do not have one, visit the
+  [sign up page](https://goteleport.com/signup/) to begin your free trial.
+
+- The Enterprise version of the `tctl` admin tool. To download this, visit
+the [customer portal](https://dashboard.gravitational.com/web/login).
+
+  ```code
+  $ tctl version
+  # Teleport v(=teleport.version=) go(=teleport.golang=)
+  ```
+
+</TabItem>
+</Tabs>
 
 (!docs/pages/includes/tctl.mdx!)
 
-<Admonition type="note">
-For cloud, login with a teleport user with editor privileges:
-```code
-# tsh logs you in and receives short-lived certificates
-$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
-# try out the connection
-$ tctl get nodes
-```
+
+## Certificate Authority rotation
+
+This section will show you how to implement certificate rotation in practice.
+
+<Admonition type="warning" title="CA Pinning Warning">
+  If you are using [CA
+  Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new
+  nodes, the CA pin will change after the rotation. Make sure you use the *new*
+  CA pin when adding nodes after rotation.
 </Admonition>
 
-## Certificate Authority Rotation
+### Rotation phases
 
-Take a look at the [Certificates chapter](../../architecture/authentication.mdx#authentication-in-teleport) in the
-architecture document to learn how the certificate authority rotation works.
+The rotation consists of several phases:
 
-This section will show you how to implement certificate rotation in practice.
+- `standby`: All operations have completed or haven't started yet.
+- `init`: All components are notified of the rotation. A new certificate
+  authority is issued, but not used. It is necessary for remote trusted clusters
+  to fetch the new certificate authority, otherwise new clients will reject it.
+- `update_clients`: Internal clients certs are updated and reloaded. Servers
+  will use and respond with old credentials because clients have no idea about
+  new certificates at first.
+- `update_servers`: Servers reload and start serving TLS and SSH certificates
+  signed by the new certificate authority, but will still accept certificates
+  issued by the old certificate authority.
+- `rollback`: The rotation was aborted and is rolling back to the old
+  certificate authority.
 
-During manual and semi-automatic certificate authority rotation, Teleport generates a new certificate
-authority and issues certificates for auth servers, proxies, nodes and users.
+### Rotation types
 
-Rotation consists of several phases:
+There are two kinds of certificate rotations:
 
-- `standby` All operations have completed or haven't started yet.
-- `init` - All components are notified of the rotation. A new certificate authority is issued, but not used.
-  It is necessary for remote trusted clusters to fetch the new certificate authority, otherwise the new clients
-  will reject it.
-- `update_clients` - internal clients certs are updated and reloaded.
-  Servers will use and respond with old credentials because clients have no idea about new certificates at first.
-- `update_servers` Servers will reload and would start serving
-TLS and SSH certificates signed by the new certificate authority, but will still accept certificates
-issued by old certificate authority.
-- `rollback` rotation is rolling back to the old certificate authority.
+- **Manual:** it is the cluster administrator's reponsibility to transition
+  between each phase of the rotation while monitoring the state of the cluster.
+  Manual rotations provide the greatest level of control, and are performed by
+  providing the desired phase using the `--phase` flag with the
+  `tctl auth rotate` command.
+- **Semi-automatic:** Teleport automatically transitions between phases of the
+  rotation after some amount of time (known as a *grace period*) elapses.
 
-Both in manual and semi-automatic rotation, cluster goes through the states above in sequence:
+For both types of rotations, the cluster goes through the phases in the
+following order:
 
 - `standby` -> `init` -> `update_clients` -> `update_servers` -> `standby`
 
-Administrators can rollback all the changes before rotation is completed by entering `standby`.
+Administrators can abort the rotation and revert all changes any time before
+the rotation is completed by entering the `rollback` phase.
 
-For example, if admin has detected that some nodes failed to upgrade during `update_servers`,
-they can rollback to the previous certificate authority:
+```sh
+$ tctl auth rotate --phase=rollback --manual
+```
+
+For example, if an admin has detected that some nodes failed to upgrade during
+`update_servers`, they can roll back to the previous certificate authority, and
+the phase transitions look like this:
 
 - `update_servers` -> `rollback` -> `standby`.
 
 <Admonition>
-Try rotation/rollback in manual mode first to understand all the edge-cases
-and gotchas before going with semi-automatic version.
+  Try rotation/rollback in manual mode first to understand all the edge-cases
+  and gotchas before going with semi-automatic version.
 </Admonition>
 
 ## Manual rotation
 
-In manual mode, we would transition between phases while monitoring the state of the cluster.
+In manual mode, we manually transition between phases while monitoring the state
+of the cluster.
 
 **Start the rotation**
 
@@ -72,7 +134,7 @@ $ tctl auth rotate --phase=init --manual --type=host
 Updated rotation phase to "init". To check status use 'tctl status'
 ```
 
-Cluster status will reflect active rotation in progress:
+Use `tctl` to confirm that there is an active rotation in progress:
 
 ```code
 $ tctl status
@@ -96,23 +158,24 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 }
 ```
 
-Host `terminal` has updated it status to phase `init`. It has downloaded a new CA public key and is ready
-for state transitions.
+In this example, the node named `terminal` has updated its status to phase
+`init`. This means it has downloaded a new CA public key and is ready for state
+transitions.
 
-<Admonition type="warning" title="Rotation warning"
->
-If some nodes are offline during rotation or have failed to update the status,
-you will lose connectivity after the transition `update_servers` -> `standby`. Make sure that all
-nodes are up to date with the transitions.
+<Admonition type="warning" title="Rotation warning">
+  If some nodes are offline during rotation or have failed to update the status,
+  you will lose connectivity after the transition `update_servers` -> `standby`.
+  Make sure that all nodes are up to date with the transitions before
+  proceeding.
 </Admonition>
 
 **Update clients**
 
-Execute transition `init` -> `update_clients`:
+Execute the transition from `init` to `update_clients`:
 
 ```code
 $ tctl auth rotate --phase=update_clients --manual
-# Updated rotation phase to "init". To check status use 'tctl status'
+# Updated rotation phase to "update_clients". To check status use 'tctl status'
 $ tctl status
 # Cluster  acme.cluster
 # Version  (=teleport.version=)
@@ -120,7 +183,8 @@ $ tctl status
 ```
 
 <Admonition type="note">
-Clients will temporarily lose connectivity during proxy and auth servers restarts.
+  Clients will temporarily lose connectivity during Proxy and Auth Server
+  restarts.
 </Admonition>
 
 Verify that nodes have caught up and now see the current cluster state:
@@ -136,11 +200,12 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 
 **Update servers**
 
-All nodes have caught up. Execute the transition `update_clients` -> `update_servers`:
+Now that all nodes have caught up, execute the transition from `update_clients`
+to `update_servers`:
 
 ```code
 $ tctl auth rotate --phase=update_servers --manual
-# Updated rotation phase to "init". To check status use 'tctl status'
+# Updated rotation phase to "update_servers". To check status use 'tctl status'
 
 $ tctl status
 # Cluster  acme.cluster
@@ -149,8 +214,9 @@ $ tctl status
 ```
 
 <Admonition type="note">
-Usually if things go wrong, they go wrong at this transition. If you have lost connectivity to nodes,
-[rollback](#rollback) to the old certificate authority.
+  Usually if things go wrong, they go wrong at this transition. If you have lost
+  connectivity to nodes, [roll back](#rollback) to the old certificate
+  authority.
 </Admonition>
 
 Verify that nodes have caught up:
@@ -169,28 +235,23 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 Before wrapping up, verify that you have not lost any nodes and can connect to them, for example:
 
 ```code
-$ tsh ssh hello@terminal hostname
+$ tsh ssh hello@terminal
 ```
 
 <Admonition type="warning">
-This is the last stage when you can rollback. If you have lost connectivity to nodes,
-[rollback](#rollback) to the old certificate authority.
+  This is the last stage where you have the opportunity to roll back. If you
+  have lost connectivity to nodes, [roll back](#rollback) to the old certificate
+  authority.
 </Admonition>
 
 ```code
 $ tctl auth rotate --phase=standby --manual
-# Updated rotation phase to "init". To check status use 'tctl status'
-
-$ tctl status
-# Cluster  acme.cluster
-# Version  (=teleport.version=)
-# Host CA  rotating servers (mode: manual, started: Sep 20 01:44:36 UTC, ending: Sep 21 07:44:36 UTC)
 ```
 
-Cluster status should indicate succesffully completed rotation.
+Verify that the rotation has completed with `tctl`:
 
 ```code
-tctl status
+$ tctl status
 Cluster  acme.cluster
 Version  (=teleport.version=)
 Host CA  rotated Sep 20 02:11:25 UTC
@@ -210,31 +271,26 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 }
 ```
 
-<Admonition
-  type="warning"
-  title="CA Pinning Warning"
->
-If you are using [CA Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new nodes, the CA pin will change after the rotation.
-Make sure you use the *new* CA pin when adding nodes after rotation.
-</Admonition>
-
 ## Semi-Automatic rotation
 
 <Admonition type="warning">
-Semi-automatic rotation executes the same steps as the manual rotation, but with a grace period between them.
-It currently does not track the states of the nodes and you can lose connectivity if things go wrong.
+  Semi-automatic rotation executes the same steps as the manual rotation, but
+  with a grace period between them. It currently does not track the states of
+  the nodes and you can lose connectivity if things go wrong.
 </Admonition>
 
-You can trigger semi-automatic rotation:
+You can trigger semi-automatic rotation by omitting the `--manual` and `--phase`
+flags.
 
 ```code
 $ tctl auth rotate
 ```
 
-This will trigger a rotation process for both hosts and users with a *grace period* of 48 hours.
-During the grace period, certificates issued both by old and new certificate authority work.
+This will trigger a rotation process for both hosts and users with a default
+grace period of 48 hours. During the grace period, certificates issued both by
+old and new certificate authority work.
 
-You can customize grace period:
+You can customize grace period and CA type with additional flags:
 
 ```code
 # Rotate only user certificates with a grace period of 200 hours:
@@ -248,33 +304,29 @@ The rotation takes time, especially for hosts, because each node in a cluster
 needs to be notified that a rotation is taking place and request a new
 certificate for itself before the grace period ends.
 
-<Admonition
-  type="warning"
-  title="Warning"
->
-  Be careful when choosing a grace period when rotating host certificates. The grace period needs to be long enough for all nodes in a cluster to request a new certificate. If some nodes go offline during the
-  rotation and come back only after the grace period has ended, they will be
-  forced to leave the cluster, i.e. users will no longer be allowed to SSH
-  into them.
-</Admonition>
+During semi-automatic rotations, Teleport will attempt to divide the grace
+period so that it spends an equal amount of time in each phase before
+transitioning to the next phase. This means that using a shorter grace period
+will result in faster state transitions.
+
+<Notice type="warning">
+  Be careful when choosing a grace period when rotating host certificates.
+</Notice>
+
+The grace period needs to be long enough for all nodes in a cluster to request a
+new certificate. If some nodes go offline during the rotation and come back only
+after the grace period has ended, they will be forced to leave the cluster, i.e.
+users will no longer be allowed to SSH into them.
 
-Check the cluster status of rotation:
+Check the cluster status:
 
 ```code
-tctl status
+$ tctl status
 Cluster  acme.cluster
 Version  (=teleport.version=)
 Host CA  initialized (mode: manual, started: Sep 20 01:44:36 UTC, ending: Sep 21 07:44:36 UTC)
 ```
 
-<Admonition
-  type="warning"
-  title="CA Pinning Warning"
->
-  If you are using [CA Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new nodes, the CA pin will change after the rotation. Make sure you use the
-  *new* CA pin when adding nodes after rotation.
-</Admonition>
-
 Check the status of individual nodes:
 
 ```code
@@ -287,21 +339,22 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 }
 ```
 
-Host `terminal` has updated it status to phase `init`. It has downloaded a new CA public key and is ready
-for state transitions.
+The node named `terminal` has updated its status to phase `init`. This means it
+has downloaded a new CA public key and is ready for state transitions.
 
 ## Rollback
 
-Rollback is only possible before rotation enters `standby` state.
+Rollback must be performed before the rotation enters `standby` state.
 
-First, override the rotation to the manual rollback:
+First, enter the rollback phase with a manual phase transition:
 
 ```code
 $ tctl auth rotate --phase=rollback --manual
 # Updated rotation phase to "rollback". To check status use 'tctl status'
 ```
 
-Make sure that nodes that have updated have caught up:
+Make sure that any nodes which have already updated have caught up and entered
+the `rollback` phase.
 
 ```code
 # Check rotation status of the nodes
@@ -313,5 +366,11 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 }
 ```
 
-If any of the nodes were lost and using the old cert authority, they should reconnect
-once you switch the control plane to the old cert authority.
+If connectivity to any of the nodes was lost during the rotation, this is likely
+because they were still using the old cert authority. Connectivity to these
+nodes should be restored when the rollback completes and the old certificate
+authority is made active.
+
+## Further reading
+
+How the [Teleport Certificate Authority](../../architecture/authentication.mdx#authentication-in-teleport) works.
diff --git a/docs/pages/setup/reference/authentication.mdx b/docs/pages/setup/reference/authentication.mdx
index f6b2ba7e99ebd..134e980fd7e6c 100644
--- a/docs/pages/setup/reference/authentication.mdx
+++ b/docs/pages/setup/reference/authentication.mdx
@@ -1,22 +1,20 @@
 ---
 title: Authentication options
-description: Teleport enterprise license file configuration parameters and requirements
+description: A reference for Teleport's authentication connectors
 ---
 
-Teleport uses the concept of "authentication connectors" to authenticate users
-when they execute [`tsh login`](./cli.mdx#tsh-login) command. There are three
-types of authentication connectors:
+Teleport authenticates users with an identity provider via **authentication
+connectors**. There are three types of authentication connectors.
 
-## Local
+## Local (no authentication connector)
 
 Local authentication is used to authenticate against a local Teleport user
-database. This database is managed by [`tctl users`](./cli.mdx#tctl-users-add)
+database. This database is managed by the [`tctl users`](./cli.mdx#tctl-users-add)
 command. Teleport also supports second-factor authentication (2FA) for the local
 connector. There are several possible values (types) of 2FA:
 
-- `otp` is the default. It implements [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm)
-  standard. You can use [Google Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator)
-  or [Authy](https://www.authy.com/) or any other TOTP client.
+- `otp` is the default. It implements the [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm)
+  standard. You can use [Google Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator), [Authy],(https://www.authy.com/) or any other TOTP client.
 - `webauthn` implements the [Web Authentication standard](https://webauthn.guide) for utilizing
   second factor authenticators and hardware devices.
   You can use [YubiKeys](https://www.yubico.com/), [SoloKeys](https://solokeys.com/) or any other authenticator that
@@ -63,13 +61,12 @@ You can modify these settings in the static config `teleport.yaml` or using dyna
 </Tabs>
   
 <Admonition type="note">
-  SSO users can also register 2FA devices, but Teleport will not prompt them for 2FA during login. Login 2FA for SSO users should be handled by the SSO
-  provider.
+  SSO users can also register 2FA devices, but Teleport will not prompt them for 2FA during login. Login 2FA for SSO users should be handled by the SSO provider.
 </Admonition>
 
 ## GitHub
 
-This connector implements Github OAuth 2.0 authentication flow. Please refer to GitHub documentation on [Creating an OAuth App](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/)
+This connector implements GitHub's OAuth 2.0 authentication flow. Please refer to GitHub's documentation on [Creating an OAuth App](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/)
 to learn how to create and register an OAuth app.
 
 Here is an example of this setting in the `teleport.yaml` :
@@ -84,9 +81,9 @@ See [Github OAuth 2.0](../admin/github-sso.mdx) for details on how to configure
 
 ## SAML
 
-<Admonition type="note">
-You need Enterprise edition of Teleport for this option.
-</Admonition>
+<Notice type="note">
+You need the Enterprise edition of Teleport for this option.
+</Notice>
 
 This connector type implements SAML authentication. It can be configured against any external identity manager like Okta or Auth0. This feature is only available for Teleport Enterprise.
 
@@ -100,9 +97,9 @@ auth_service:
 
 ### OIDC
 
-<Admonition type="note">
-You need Enterprise edition of Teleport for this option.
-</Admonition>
+<Notice type="note">
+You need the Enterprise edition of Teleport for this option.
+</Notice>
 
 Teleport implements OpenID Connect (OIDC) authentication, which is similar to SAML in principle.
 
diff --git a/docs/pages/setup/reference/cli.mdx b/docs/pages/setup/reference/cli.mdx
index f1d572a5a7fc7..0339c46a3c02c 100644
--- a/docs/pages/setup/reference/cli.mdx
+++ b/docs/pages/setup/reference/cli.mdx
@@ -38,7 +38,7 @@ the following services.
 | - | - | - | - |
 | `-d, --debug` | none | none | enable verbose logging to stderr |
 | `--insecure-no-tls` | `false` | `true` or `false` | Tells proxy to not generate default self-signed TLS certificates. This is useful when running Teleport on kubernetes (behind reverse proxy) or behind things like AWS ELBs, GCP LBs or Azure Load Balancers where SSL termination is provided externally. |
-| `-r, --roles` | `proxy,node,auth` | **string** comma-separated list of `proxy, node` or `auth` | start listed services/roles. These roles are explained in the [Teleport Architecture](../../architecture/overview.mdx) document. |
+| `-r, --roles` | `proxy,node,auth` | **string** comma-separated list of `proxy, auth, node, db, app` or `windowsdesktop` | start listed services/roles. These roles are explained in the [Teleport Architecture](../../architecture/overview.mdx) document. |
 | `--pid-file` | none | **string** filepath | create a PID file at the path |
 | `--advertise-ip` | none | **string** IP | advertise IP to clients, often used behind NAT |
 | `-l, --listen-ip` | `0.0.0.0` | [**net. IP**](https://golang.org/pkg/net/#IP) | binds services to IP |
@@ -311,6 +311,42 @@ $ tsh play --format=pty 1fe153d1-ce8b-4ef4-9908-6539457ba4ad.tar
 $ tsh play --format=json ~/play/0c0b81ed-91a9-4a2a-8d7c-7495891a6ca0.tar | jq '.event
 ```
 
+### tsh proxy app
+
+Starts a local TLS proxy for Application Access connections.
+You can use this proxy to connect to an application repeatedly after a single login to your Teleport cluster,
+which is especially useful for interacting with an application via a CLI.
+
+```code
+$ tsh proxy app [<flags>] <app>
+```
+
+#### Arguments
+`<app>`
+
+- `app` The name of the application to start the local proxy for. To see a list of available applications, run `tsh apps ls`.
+
+#### Flags
+
+| Name | Default Value(s) | Allowed Value(s) | Description |
+| - | - | - | - |
+| `--port` | none | port number | Specify the source port for the local proxy |
+
+#### [Global Flags](#tsh-global-flags)
+
+These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
+Run `tsh help <subcommand>` or see the [Global Flags Section](#tsh-global-flags)
+
+#### Examples
+```code
+$ tsh proxy app <app>
+
+# Proxy a connection to grafana on local port 10700
+$ tsh proxy --port 10700 app grafana &
+# Proxying connections to grafana on 127.0.0.1:10700
+$ curl http://127.0.0.1:10700/api/users
+```
+
 ### tsh scp
 
 Copies files from source to dest:
@@ -902,7 +938,7 @@ $ tctl nodes add [<flags>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `--roles` | `node` | `node,auth` or `proxy` | Comma-separated list of roles for the new node to assume |
+| `--roles` | `node` | `proxy, auth, node, db, app` or `windowsdesktop` | Comma-separated list of roles for the new node to assume |
 | `--ttl` | 30m | relative duration like 5s, 2m, or 3h | Time to live for a generated token |
 | `--token` | none | **string** token value | A custom token to use, auto-generated if not provided. Should match token set with `teleport start --token` |
 
@@ -953,9 +989,9 @@ $ tctl tokens add --type=TYPE [<flags>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `--type` | none | `trusted_cluster`, `node`, `proxy` | Type of token to add |
+| `--type` | none | `proxy`, `auth`, `trusted_cluster`, `node`,  `db`, `kube`, `app`, `windowsdesktop` | Type of token to add |
 | `--value` | none | **string** token value | Value of token to add |
-| `--ttl` | 1h | relative duration like 5s, 2m, or 3h, **maximum 48h** | Set expiration time for token |
+| `--ttl` | 1h | relative duration like 5s, 2m, or 3h | Set expiration time for token |
 
 #### [Global Flags](#tctl-global-flags)
 
@@ -1289,6 +1325,37 @@ Print cluster version:
 tctl version
 ```
 
+## Resource filtering
+
+Both `tsh` and `tctl` allow you to filter `nodes`, `apps`, `db`, and `kube` resources using the `--search` and `--query` flags.
+
+The `--search` flag performs a simple fuzzy search on resource fields. For example, `--search=mac` searches for resources containing `mac`.
+
+The `--query` flag allows you to perform more sophisticated searches using a [predicate language](predicate-language.mdx#resource-filtering).
+
+In both cases, you can further refine the results by appending a list of comma-separated labels to the command. For example:
+
+```bash
+$ tsh ls --search=foo,bar labelKey1=labelValue1,labelKey2=labelValue2
+```
+
+### Filter Examples
+
+```bash
+# List all nodes
+$ tsh ls
+
+# List nodes using label argument
+$ tsh ls env=staging,os=mac
+
+# List nodes using search keywords
+$ tsh ls --search=staging,mac
+
+# List nodes using predicate language. This query searches for nodes with labels
+# with key `env` equal to `staging` and key `os` equal to `mac`.
+$ tsh ls --query='labels.env == "staging" && equals(labels.os, "mac")'
+```
+
 ## Experimental features
 
 ### tctl access ls
diff --git a/docs/pages/setup/reference/license.mdx b/docs/pages/setup/reference/license.mdx
index 273c4e4663fbc..6532a9f385d4c 100644
--- a/docs/pages/setup/reference/license.mdx
+++ b/docs/pages/setup/reference/license.mdx
@@ -3,11 +3,18 @@ title: Enterprise License File
 description: Teleport enterprise license file configuration parameters and requirements
 ---
 
-Commercial Teleport subscriptions require a valid license. The license file can
+Commercial self-hosted Teleport subscriptions require a valid license. The license file can
 be downloaded from the [Teleport Customer
-Portal](https://dashboard.gravitational.com/web/login).
+Portal](https://dashboard.gravitational.com/web/login). When downloading the file, the products you are licensed to use will be listed in the browser. 
 
-The Teleport license file contains a X.509 certificate and the corresponding private key in PEM format. Place the downloaded file on Auth servers and set the `license_file` configuration parameter of your `teleport.yaml` to point to the file location:
+<Admonition type="tip" >
+Teleport Cloud manages licensing for customers, and there is no need to manage license files yourself. 
+</Admonition>
+
+The Teleport license file contains an X.509 certificate and the corresponding
+private key in PEM format. Place the downloaded file on your Teleport Auth
+Servers and set the `license_file` configuration parameter of your
+`teleport.yaml` to point to the file location:
 
 ```yaml
 auth_service:
@@ -18,9 +25,9 @@ The `license_file` path can be either absolute or relative to the configured
 `data_dir`. If the license file path is not set, Teleport will look for the
 `license.pem` file in the configured `data_dir`.
 
-<Admonition
-  type="tip"
-  title="NOTE"
->
-  Only Auth servers require the license. Proxies and Nodes that do not also have Auth role enabled do not need the license.
-</Admonition>
+Only Auth Servers require the license. Proxies and Nodes that do not also run the Auth Service do not need the license.  
+    
+Attempts to use unlicensed products will result in an error message and users will be unable to use those products. For example, if you attempt to use Database Access without it being included in the license, you will get a message similar to:
+```code
+this Teleport cluster is not licensed for database access, please contact the cluster administrator
+```
diff --git a/docs/pages/setup/reference/metrics.mdx b/docs/pages/setup/reference/metrics.mdx
index ae574253ff76f..69c8ff0cf30bb 100644
--- a/docs/pages/setup/reference/metrics.mdx
+++ b/docs/pages/setup/reference/metrics.mdx
@@ -1,30 +1,79 @@
 ---
-title: Teleport Metrics
-description: How to set up Prometheus to monitor Teleport for SSH and Kubernetes access
-h1: Metrics
+title: Teleport Diagnostics
+description: How to use Teleport's health, readiness, profiling, and monitoring endpoints.
 ---
 
-## Teleport Prometheus endpoint
-
-Teleport provides HTTP endpoints for monitoring purposes. They are disabled
-by default, but you can enable them using the `--diag-addr` flag to `teleport start`:
+Teleport provides HTTP endpoints for monitoring purposes. They are disabled by
+default, but you can enable them using the `--diag-addr` flag when running
+`teleport start`:
 
 ```code
 $ sudo teleport start --diag-addr=127.0.0.1:3000
 ```
 
-Now you can see the monitoring information by visiting several endpoints:
-
-- `http://127.0.0.1:3000/metrics` is the list of internal metrics Teleport is
-  tracking. It is compatible with [Prometheus](https://prometheus.io/)
-  collectors.
-- `http://127.0.0.1:3000/healthz` returns "OK" if the process is healthy or
-  `503` otherwise.
-- `http://127.0.0.1:3000/readyz` is similar to `/healthz`, but it returns "OK"
-  *only after* the node successfully joined the cluster, i.e.it draws the
-  difference between "healthy" and "ready".
-- `http://127.0.0.1:3000/debug/pprof/` is Golang's standard profiler. It's only
-  available when `-d` flag is given in addition to `--diag-addr`
+Now you can collect monitoring information from several endpoints.
+
+## `/healthz`
+
+The `http://127.0.0.1:3000/healthz` endpoint responds with a body of
+`{"status":"ok"}` and an HTTP 200 OK status code if the process is running.
+
+This is a simple check, suitable for determining if the Teleport process is
+still running.
+
+## `/readyz`
+
+The `http://127.0.0.1:3000/readyz` endpoint is similar to `/healthz`, but its
+response includes information about the state of the process.
+
+The response body is a JSON object of the form:
+
+```
+{ "status": "a status message here"}
+```
+
+### `/readyz` and heartbeats
+
+If a Teleport component fails to execute its heartbeat procedure, it will enter
+a degraded state. Teleport will begin recovering from this state when a
+heartbeat completes successfully.
+
+The first successful heartbeat will transition Teleport into a recovering state.
+
+A second consecutive successful heartbeat will cause Teleport to transition to
+the OK state, so long as at least 10 seconds have elapsed since the
+first successful heartbeat.
+
+Teleport heartbeats run every 5 seconds. This means that depending on the timing
+of heartbeats, it can take 10-20 seconds after connectivity is restored for
+`/readyz` to start reporting healthy again.
+
+### Status codes
+
+The status code of the response can be one of:
+
+- HTTP 200 OK: Teleport is operating normally
+- HTTP 503 Service Unavailable: Teleport has encountered a connection error and
+  is running in a degraded state. This happens when a Teleport heartbeat fails.
+- HTTP 400 Bad Request: Teleport is either entering its initial startup phase or
+  has begun recovering from a degraded state.
+
+The same state information is also available via the `process_state` metric
+under the `/metrics` endpoint.
+
+## `/debug/pprof`
+
+The `http://127.0.0.1:3000/debug/pprof/` endpoint is Go's standard pprof
+profiler. This endpoint is only available if the `--debug` (or `-d`) flag is
+supplied (in addition to `--diag-addr`).
+
+## `/metrics`
+
+The `http://127.0.0.1:3000/metrics` endpoint serves the internal metrics
+Teleport is tracking. It is compatible with
+[Prometheus](https://prometheus.io/) collectors.
+
+The following metrics are available:
 
 | Name | Type | Component | Description |
 | - | - | - | - |
diff --git a/docs/pages/setup/reference/predicate-language.mdx b/docs/pages/setup/reference/predicate-language.mdx
new file mode 100644
index 0000000000000..946e3e71bdd8d
--- /dev/null
+++ b/docs/pages/setup/reference/predicate-language.mdx
@@ -0,0 +1,71 @@
+---
+title: Predicate Language
+description: How to use Teleport's predicate language to define filter conditions.
+---
+
+Teleport's predicate language is used to define conditions for filtering in dynamic configuration resources.
+It is also used as a query language to filter and search through a [list of select resources](#resource-filtering).
+
+The predicate language uses a slightly different syntax depending on whether it is used in:
+
+- [Role resources](#scoping-allowdeny-rules-in-role-resources)
+- [Resource filtering](#resource-filtering)
+
+## Scoping allow/deny rules in role resources
+
+Some fields in Teleport's role resources use the predicate language to define the scope of a role's permissions:
+
+- [Dynamic Impersonation](../../access-controls/guides/impersonation.mdx#filter-fields)
+- [RBAC for sessions](../../access-controls/reference.mdx#filter-fields)
+
+When used in role resources, the predicate language supports the following operators:
+
+| Operator | Meaning                                          | Example                                                  |
+|----------|--------------------------------------------------|----------------------------------------------------------|
+| &&       | and (all conditions must match)                  | `contains(field1, field2) && equals(field2, "val")`      |
+| \|\|     | or  (any one condition should match)             | `contains(field1, field2) \|\| contains(field1, "val2")` |
+| !        | not (used with functions, more about this below) | `!equals(field1, field2)`                                |
+
+The language also supports the following functions:
+
+| Functions                      | Description                                                                           |
+|--------------------------------|---------------------------------------------------------------------------------------|
+| `contains(<field>, <field2>)`  | checks if the value from `<field2>` is included in the list of strings from `<field>` |
+| `contains(<field>, "<value>")` | checks if `<value>` is included in the list of strings from `<field>`                 |
+| `equals(<field>, <field2>)`    | checks if the value from `<field2>` is equal to the value from `<field>`              |
+| `equals(<field>, "<value>")`   | checks if `<value>` is equal to the value from `<field>`                              |
+
+
+## Resource filtering
+
+Both the [`tsh`](cli.mdx#tsh) and [`tctl`](cli.mdx#tctl) CLI tools allow you to filter nodes, 
+applications, databases, and Kubernetes resources using the `--query` flag. The `--query` flag allows you to 
+perform more sophisticated searches using the predicate language.
+
+For common resource fields, we defined shortened field names that can easily be accessed by:
+
+| Short Field    | Actual Field Equivalent                                     | Example                   |
+|----------------|-------------------------------------------------------------|---------------------------|
+| `labels.<key>` | `resource.metadata.labels` + `resource.spec.dynamic_labels` | `labels.env == "staging"` |
+| `name`         | `resource.metadata.name`                                    | `name == "jenkins"`       |
+
+The language supports the following operators:
+
+| Operator | Meaning                              | Example                                             |
+|----------|--------------------------------------|-----------------------------------------------------|
+| ==       | equal to                             | `labels.env == "prod"` or `labels["env"] == "prod"` |
+| !=       | not equal to                         | `labels.env != "prod"`                              |
+| &&       | and (all conditions must match)      | `labels.env == "prod" && labels.os == "mac"`        |
+| \|\|     | or  (any one condition should match) | `labels.env == "dev" \|\| labels.env == "qa"`       |
+| !        | not (used with functions)            | `!equals(labels.env, "prod")`                       |
+
+The language also supports the following functions:
+
+| Functions (with examples)             | Description                                                |
+|---------------------------------------|------------------------------------------------------------|
+| `equals(labels.env, "prod")`          | resources with label key `env` equal to label value `prod` |
+| `exists(labels.env)`                  | resources with a label key `env`; label value unchecked    |
+| `!exists(labels.env)`                 | resources without a label key `env`; label value unchecked |
+| `search("foo", "bar", "some phrase")` | fuzzy match against common resource fields                 |
+
+See some [examples](cli.mdx#filter-examples) of the different ways you can filter resources.
diff --git a/docs/postrelease.md b/docs/postrelease.md
index 3257156b7599e..8a04ea1a3a3fd 100644
--- a/docs/postrelease.md
+++ b/docs/postrelease.md
@@ -16,4 +16,9 @@ This checklist is to be run after cutting a release.
   - Example: https://github.com/gravitational/teleport/pull/4602
 - [ ] Create PR to update default Teleport image referenced in docker/teleport-quickstart.yml and docker/teleport-ent-quickstart.yml
   - Example: https://github.com/gravitational/teleport/pull/4655
-- [ ] Create PR to update default Teleport image referenced in docker/teleport-lab.yml
\ No newline at end of file
+- [ ] Create PR to update default Teleport image referenced in docker/teleport-lab.yml
+- [ ] Update the CI buildbox image
+  - [ ] Update the `BUILDBOX_VERSION` in `build.assets/Makefile`
+  - [ ] Run `make dronegen` and ensure _all_ buildbox references in the resulting yaml refer to the new image
+  - [ ] Commit and merge. Drone should build new buildbox images and push to `quay.io`
+  - [ ] Once the new images are confirmed in `quay.io`, update the build yaml files under `.cloudbuild` to refer to the new image
diff --git a/dronegen/mac_pkg.go b/dronegen/mac_pkg.go
index 4b01ff2567883..4cecacf430746 100644
--- a/dronegen/mac_pkg.go
+++ b/dronegen/mac_pkg.go
@@ -16,6 +16,7 @@ package main
 
 import (
 	"fmt"
+	"path/filepath"
 	"strings"
 )
 
@@ -56,8 +57,8 @@ func darwinPkgPipeline(name, makeTarget string, pkgGlobs []string) pipeline {
 				"APPLE_USERNAME":    {fromSecret: "APPLE_USERNAME"},
 				"APPLE_PASSWORD":    {fromSecret: "APPLE_PASSWORD"},
 				"BUILDBOX_PASSWORD": {fromSecret: "BUILDBOX_PASSWORD"},
-				"OSS_TARBALL_PATH":  {raw: "/tmp/build-darwin-amd64-pkg/go/artifacts"},
-				"ENT_TARBALL_PATH":  {raw: "/tmp/build-darwin-amd64-pkg/go/artifacts"},
+				"OSS_TARBALL_PATH":  {raw: filepath.Join(p.Workspace.Path, "go/artifacts")},
+				"ENT_TARBALL_PATH":  {raw: filepath.Join(p.Workspace.Path, "go/artifacts")},
 				"OS":                {raw: b.os},
 				"ARCH":              {raw: b.arch},
 			},
diff --git a/dronegen/main.go b/dronegen/main.go
index 9fde790cb6088..b3bb1ccc41b64 100644
--- a/dronegen/main.go
+++ b/dronegen/main.go
@@ -17,7 +17,6 @@ package main
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 
 	"gopkg.in/yaml.v2"
@@ -55,7 +54,7 @@ func writePipelines(path string, newPipelines []pipeline) error {
 	// TODO: When all pipelines are migrated, remove this merging logic and
 	// write the file directly. This will be simpler and allow cleanup of
 	// pipelines when they are removed from this generator.
-	existingConfig, err := ioutil.ReadFile(path)
+	existingConfig, err := os.ReadFile(path)
 	if err != nil {
 		return fmt.Errorf("failed to read existing config: %w", err)
 	}
@@ -104,7 +103,7 @@ func writePipelines(path string, newPipelines []pipeline) error {
 	}
 	configData := bytes.Join(pipelinesEnc, []byte("\n---\n"))
 
-	return ioutil.WriteFile(path, configData, 0664)
+	return os.WriteFile(path, configData, 0664)
 }
 
 // parsedPipeline is a single pipeline parsed from .drone.yml along with its
diff --git a/e b/e
index ad8fd4aa9128b..9956b32428b41 160000
--- a/e
+++ b/e
@@ -1 +1 @@
-Subproject commit ad8fd4aa9128b3dd5e80e84804be9850004f58b1
+Subproject commit 9956b32428b41caa3f29c5ba8ccc0fe458c8e957
diff --git a/examples/aws/cloudformation/ent.yaml b/examples/aws/cloudformation/ent.yaml
index 78cef76d49d2e..040df910cdf38 100644
--- a/examples/aws/cloudformation/ent.yaml
+++ b/examples/aws/cloudformation/ent.yaml
@@ -97,24 +97,24 @@ Mappings:
     t2.xlarge: {Arch: HVM64}
 
   AWSRegionArch2AMI:
-    # All AMIs from AWS - gravitational-teleport-ami-ent-8.3.1
+    # All AMIs from AWS - gravitational-teleport-ami-ent-9.0.1
     eu-north-1: {HVM64: ami-05ff5c0be3d4b8da4}
-    ap-south-1: {HVM64 : ami-0cf5de7e380590bd1}
-    eu-west-1: {HVM64 : ami-015d16a97a12e9f3e}
-    eu-west-2: {HVM64 : ami-0a1399d687e79f230}
+    ap-south-1: {HVM64 : ami-0cfab1c56ef76e56d}
+    eu-west-1: {HVM64 : ami-06d4f4a9c05b825e5}
+    eu-west-2: {HVM64 : ami-0dad9a7e8019828b4}
     eu-west-3: {HVM64: ami-087bdce4ab6a2964d}
-    ap-northeast-1: {HVM64 : ami-06238708fc042e0fb}
-    ap-northeast-2: {HVM64 : ami-0a8e2d7d4adede112}
+    ap-northeast-1: {HVM64 : ami-058897779d3b609da}
+    ap-northeast-2: {HVM64 : ami-008d7f1530778b283}
     ap-northeast-3: {HVM64: ami-0a36f2dfdca83ea7d}
-    sa-east-1: {HVM64 : ami-04a865841550cf519}
-    ca-central-1: {HVM64 : ami-0e964a19a5eef1633}
-    ap-southeast-1: {HVM64 : ami-0b8ea0f231fa1f5a1}
-    ap-southeast-2: {HVM64 : ami-03a3137350321d957}
-    eu-central-1: {HVM64 : ami-04f8ff95544fd0431}
-    us-east-1: {HVM64 : ami-0adc14e4ffaaad880}
-    us-east-2: {HVM64 : ami-0718beffe1e13c0a1}
-    us-west-1: {HVM64 : ami-044f8952623e0c010}
-    us-west-2: {HVM64 : ami-04cea237af09e9143}
+    sa-east-1: {HVM64 : ami-014b64ac9c28e9a8d}
+    ca-central-1: {HVM64 : ami-0230b681466dd1cbd}
+    ap-southeast-1: {HVM64 : ami-0676627a7acfa18f8}
+    ap-southeast-2: {HVM64 : ami-07f605ef28b14a8c5}
+    eu-central-1: {HVM64 : ami-0220eec85a7bd0bca}
+    us-east-1: {HVM64 : ami-07ffa5186f4446e88}
+    us-east-2: {HVM64 : ami-046f6cfab972281dd}
+    us-west-1: {HVM64 : ami-080f35de39e3c0a43}
+    us-west-2: {HVM64 : ami-0d46e313ef984eb11}
 
 Resources:
 # Auth server setup
diff --git a/examples/aws/cloudformation/oss.yaml b/examples/aws/cloudformation/oss.yaml
index e98725a5ca13a..2a8ac999d6f1a 100644
--- a/examples/aws/cloudformation/oss.yaml
+++ b/examples/aws/cloudformation/oss.yaml
@@ -97,24 +97,24 @@ Mappings:
     t2.xlarge: {Arch: HVM64}
 
   AWSRegionArch2AMI:
-    # All AMIs from AWS - gravitational-teleport-ami-oss-8.3.1
+    # All AMIs from AWS - gravitational-teleport-ami-oss-9.0.1
     eu-north-1: {HVM64: ami-0eef7480d85b07d78}
-    ap-south-1: {HVM64 : ami-0e71fa13d0a5e33f2}
-    eu-west-1: {HVM64 : ami-05a0e7906f76be419}
-    eu-west-2: {HVM64 : ami-06ac2f9f8b32cc9cf}
+    ap-south-1: {HVM64 : ami-04a5baf8089868310}
+    eu-west-1: {HVM64 : ami-024a59feb00e6f9d3}
+    eu-west-2: {HVM64 : ami-0304ace50865a0248}
     eu-west-3: {HVM64: ami-0211c6e2e821dd249}
-    ap-northeast-1: {HVM64 : ami-0a80043fecc73a945}
-    ap-northeast-2: {HVM64 : ami-00366bfff7fb938e3}
+    ap-northeast-1: {HVM64 : ami-02192f3f6b37326be}
+    ap-northeast-2: {HVM64 : ami-0c305fdb520cd2d03}
     ap-northeast-3: {HVM64: ami-02bb8618b75d025aa}
-    sa-east-1: {HVM64 : ami-016fc226c84d65aa0}
-    ca-central-1: {HVM64 : ami-03a5d00511ccae664}
-    ap-southeast-1: {HVM64 : ami-047dd4f4aca8ce448}
-    ap-southeast-2: {HVM64 : ami-0ed11afe3b8b432a5}
-    eu-central-1: {HVM64 : ami-0be730bb45d2696cc}
-    us-east-1: {HVM64 : ami-0301399a479b2fd45}
-    us-east-2: {HVM64 : ami-02da5e6cdbc0eeea0}
-    us-west-1: {HVM64 : ami-07556dfe74d1ce75b}
-    us-west-2: {HVM64 : ami-0b0d4a5a84433577a}
+    sa-east-1: {HVM64 : ami-0357206209e0e1ac8}
+    ca-central-1: {HVM64 : ami-02cacc908a9ecaed0}
+    ap-southeast-1: {HVM64 : ami-0c7d9089b8fb98d49}
+    ap-southeast-2: {HVM64 : ami-0735924e3c026e00e}
+    eu-central-1: {HVM64 : ami-0a8a74865d820373c}
+    us-east-1: {HVM64 : ami-050e1228432bc017e}
+    us-east-2: {HVM64 : ami-06ad7d932122afd7b}
+    us-west-1: {HVM64 : ami-07b0c77d68a2e98cf}
+    us-west-2: {HVM64 : ami-0c2505a13d6e118e7}
 
 Resources:
 # Auth server setup
diff --git a/examples/aws/terraform/AMIS.md b/examples/aws/terraform/AMIS.md
index 876c68e0687bc..54ef0aed0a837 100644
--- a/examples/aws/terraform/AMIS.md
+++ b/examples/aws/terraform/AMIS.md
@@ -6,65 +6,65 @@ is updated when new AMI versions are released.
 ### OSS
 
 ```
-# eu-north-1 v8.3.1 OSS: ami-05d4fa4c08dea86be
-# ap-south-1 v8.3.1 OSS: ami-0e71fa13d0a5e33f2
-# eu-west-1 v8.3.1 OSS: ami-05a0e7906f76be419
-# eu-west-2 v8.3.1 OSS: ami-06ac2f9f8b32cc9cf
-# eu-west-3 v8.3.1 OSS: ami-0246af46b3d1a44d8
-# ap-northeast-1 v8.3.1 OSS: ami-0a80043fecc73a945
-# ap-northeast-2 v8.3.1 OSS: ami-00366bfff7fb938e3
-# ap-northeast-3 v8.3.1 OSS: ami-098b67353e16bc627
-# sa-east-1 v8.3.1 OSS: ami-016fc226c84d65aa0
-# ca-central-1 v8.3.1 OSS: ami-03a5d00511ccae664
-# ap-southeast-1 v8.3.1 OSS: ami-047dd4f4aca8ce448
-# ap-southeast-2 v8.3.1 OSS: ami-0ed11afe3b8b432a5
-# eu-central-1 v8.3.1 OSS: ami-0be730bb45d2696cc
-# us-east-1 v8.3.1 OSS: ami-0301399a479b2fd45
-# us-east-2 v8.3.1 OSS: ami-02da5e6cdbc0eeea0
-# us-west-1 v8.3.1 OSS: ami-07556dfe74d1ce75b
-# us-west-2 v8.3.1 OSS: ami-0b0d4a5a84433577a
+# eu-north-1 v9.0.1 OSS: ami-06c7f71980ff71b25
+# ap-south-1 v9.0.1 OSS: ami-04a5baf8089868310
+# eu-west-1 v9.0.1 OSS: ami-024a59feb00e6f9d3
+# eu-west-2 v9.0.1 OSS: ami-0304ace50865a0248
+# eu-west-3 v9.0.1 OSS: ami-076a360cd048e6a71
+# ap-northeast-1 v9.0.1 OSS: ami-02192f3f6b37326be
+# ap-northeast-2 v9.0.1 OSS: ami-0c305fdb520cd2d03
+# ap-northeast-3 v9.0.1 OSS: ami-027f0e95d0c6981b0
+# sa-east-1 v9.0.1 OSS: ami-0357206209e0e1ac8
+# ca-central-1 v9.0.1 OSS: ami-02cacc908a9ecaed0
+# ap-southeast-1 v9.0.1 OSS: ami-0c7d9089b8fb98d49
+# ap-southeast-2 v9.0.1 OSS: ami-0735924e3c026e00e
+# eu-central-1 v9.0.1 OSS: ami-0a8a74865d820373c
+# us-east-1 v9.0.1 OSS: ami-050e1228432bc017e
+# us-east-2 v9.0.1 OSS: ami-06ad7d932122afd7b
+# us-west-1 v9.0.1 OSS: ami-07b0c77d68a2e98cf
+# us-west-2 v9.0.1 OSS: ami-0c2505a13d6e118e7
 ```
 
 ### Enterprise
 
 ```
-# eu-north-1 v8.3.1 Enterprise: ami-0025aaaa97b15e900
-# ap-south-1 v8.3.1 Enterprise: ami-0cf5de7e380590bd1
-# eu-west-1 v8.3.1 Enterprise: ami-015d16a97a12e9f3e
-# eu-west-2 v8.3.1 Enterprise: ami-0a1399d687e79f230
-# eu-west-3 v8.3.1 Enterprise: ami-03bfb7db0eb4089cf
-# ap-northeast-1 v8.3.1 Enterprise: ami-06238708fc042e0fb
-# ap-northeast-2 v8.3.1 Enterprise: ami-0a8e2d7d4adede112
-# ap-northeast-3 v8.3.1 Enterprise: ami-022c50efe794001ac
-# sa-east-1 v8.3.1 Enterprise: ami-04a865841550cf519
-# ca-central-1 v8.3.1 Enterprise: ami-0e964a19a5eef1633
-# ap-southeast-1 v8.3.1 Enterprise: ami-0b8ea0f231fa1f5a1
-# ap-southeast-2 v8.3.1 Enterprise: ami-03a3137350321d957
-# eu-central-1 v8.3.1 Enterprise: ami-04f8ff95544fd0431
-# us-east-1 v8.3.1 Enterprise: ami-0adc14e4ffaaad880
-# us-east-2 v8.3.1 Enterprise: ami-0718beffe1e13c0a1
-# us-west-1 v8.3.1 Enterprise: ami-044f8952623e0c010
-# us-west-2 v8.3.1 Enterprise: ami-04cea237af09e9143
+# eu-north-1 v9.0.1 Enterprise: ami-0acc68f7755c2eb98
+# ap-south-1 v9.0.1 Enterprise: ami-0cfab1c56ef76e56d
+# eu-west-1 v9.0.1 Enterprise: ami-06d4f4a9c05b825e5
+# eu-west-2 v9.0.1 Enterprise: ami-0dad9a7e8019828b4
+# eu-west-3 v9.0.1 Enterprise: ami-06c32606e0b2c4181
+# ap-northeast-1 v9.0.1 Enterprise: ami-058897779d3b609da
+# ap-northeast-2 v9.0.1 Enterprise: ami-008d7f1530778b283
+# ap-northeast-3 v9.0.1 Enterprise: ami-08b94d30fec7bca1f
+# sa-east-1 v9.0.1 Enterprise: ami-014b64ac9c28e9a8d
+# ca-central-1 v9.0.1 Enterprise: ami-0230b681466dd1cbd
+# ap-southeast-1 v9.0.1 Enterprise: ami-0676627a7acfa18f8
+# ap-southeast-2 v9.0.1 Enterprise: ami-07f605ef28b14a8c5
+# eu-central-1 v9.0.1 Enterprise: ami-0220eec85a7bd0bca
+# us-east-1 v9.0.1 Enterprise: ami-07ffa5186f4446e88
+# us-east-2 v9.0.1 Enterprise: ami-046f6cfab972281dd
+# us-west-1 v9.0.1 Enterprise: ami-080f35de39e3c0a43
+# us-west-2 v9.0.1 Enterprise: ami-0d46e313ef984eb11
 ```
 
 ### Enterprise FIPS
 
 ```
-# eu-north-1 v8.3.1 Enterprise FIPS: ami-010a0dafec42cc34c
-# ap-south-1 v8.3.1 Enterprise FIPS: ami-07b3523d3ac90e210
-# eu-west-1 v8.3.1 Enterprise FIPS: ami-0c14d8258e109934f
-# eu-west-2 v8.3.1 Enterprise FIPS: ami-07ffb24ab2607f0a8
-# eu-west-3 v8.3.1 Enterprise FIPS: ami-00d5e3a93c5f64518
-# ap-northeast-1 v8.3.1 Enterprise FIPS: ami-08b3f1339c51e51d7
-# ap-northeast-2 v8.3.1 Enterprise FIPS: ami-022aab582835216f0
-# ap-northeast-3 v8.3.1 Enterprise FIPS: ami-025a9b33d02b84a33
-# sa-east-1 v8.3.1 Enterprise FIPS: ami-0c273078373811da1
-# ca-central-1 v8.3.1 Enterprise FIPS: ami-0305991f60af08149
-# ap-southeast-1 v8.3.1 Enterprise FIPS: ami-013268de76ec30b64
-# ap-southeast-2 v8.3.1 Enterprise FIPS: ami-07923d4c379e64eea
-# eu-central-1 v8.3.1 Enterprise FIPS: ami-0309e5091ab89a293
-# us-east-1 v8.3.1 Enterprise FIPS: ami-0a2064984c331ff46
-# us-east-2 v8.3.1 Enterprise FIPS: ami-08ac544666b38afee
-# us-west-1 v8.3.1 Enterprise FIPS: ami-00839fecaafaad134
-# us-west-2 v8.3.1 Enterprise FIPS: ami-03c8665e782623436
+# eu-north-1 v9.0.1 Enterprise FIPS: ami-0ae03293e8f7c270e
+# ap-south-1 v9.0.1 Enterprise FIPS: ami-0e3554edf5b4d7f43
+# eu-west-1 v9.0.1 Enterprise FIPS: ami-0a38a70f423c2af6c
+# eu-west-2 v9.0.1 Enterprise FIPS: ami-0f1d2195cd6ba552a
+# eu-west-3 v9.0.1 Enterprise FIPS: ami-024c90f6d18f964b8
+# ap-northeast-1 v9.0.1 Enterprise FIPS: ami-0bf0dfc5903e8d744
+# ap-northeast-2 v9.0.1 Enterprise FIPS: ami-071ab1359b4c6d0ab
+# ap-northeast-3 v9.0.1 Enterprise FIPS: ami-04cfbca2410bc966e
+# sa-east-1 v9.0.1 Enterprise FIPS: ami-0543fee3b7e20a557
+# ca-central-1 v9.0.1 Enterprise FIPS: ami-0b4c828432b359cb6
+# ap-southeast-1 v9.0.1 Enterprise FIPS: ami-01b4d5889fe2ab815
+# ap-southeast-2 v9.0.1 Enterprise FIPS: ami-01db9009d4853caf5
+# eu-central-1 v9.0.1 Enterprise FIPS: ami-01bd770a772f1a3ac
+# us-east-1 v9.0.1 Enterprise FIPS: ami-071fe9f049c218551
+# us-east-2 v9.0.1 Enterprise FIPS: ami-0dcbda64b7ef1ded6
+# us-west-1 v9.0.1 Enterprise FIPS: ami-05ca0f53382e0b713
+# us-west-2 v9.0.1 Enterprise FIPS: ami-00defc5ca4ef52823
 ```
diff --git a/examples/aws/terraform/ha-autoscale-cluster/README.md b/examples/aws/terraform/ha-autoscale-cluster/README.md
index 11b3de2296baf..f4e9704cdc2c1 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/README.md
+++ b/examples/aws/terraform/ha-autoscale-cluster/README.md
@@ -45,7 +45,7 @@ export TF_VAR_cluster_name="teleport.example.com"
 # OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
 # Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
 # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
-export TF_VAR_ami_name="gravitational-teleport-ami-ent-8.3.1"
+export TF_VAR_ami_name="gravitational-teleport-ami-ent-9.0.1"
 
 # AWS SSH key name to provision in installed instances, should be available in the region
 export TF_VAR_key_name="example"
diff --git a/examples/aws/terraform/starter-cluster/README.md b/examples/aws/terraform/starter-cluster/README.md
index 8607428e256d9..4d4fb08fcb162 100644
--- a/examples/aws/terraform/starter-cluster/README.md
+++ b/examples/aws/terraform/starter-cluster/README.md
@@ -86,7 +86,7 @@ TF_VAR_license_path ?="/path/to/license"
 # OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
 # Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
 # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
-TF_VAR_ami_name ?="gravitational-teleport-ami-ent-8.3.1"
+TF_VAR_ami_name ?="gravitational-teleport-ami-ent-9.0.1"
 
 # Route 53 hosted zone to use, must be a root zone registered in AWS, e.g. example.com
 TF_VAR_route53_zone ?="example.com"
diff --git a/examples/aws/terraform/starter-cluster/vars.tf b/examples/aws/terraform/starter-cluster/vars.tf
index e0f85794a0c73..318ff7f4d3c47 100644
--- a/examples/aws/terraform/starter-cluster/vars.tf
+++ b/examples/aws/terraform/starter-cluster/vars.tf
@@ -42,7 +42,7 @@ variable "email" {
 }
 
 
-// SSH key name to provision instances withx
+// SSH key name to provision instances with
 variable "key_name" {
   type = string
 }
diff --git a/examples/chart/CONTRIBUTING.md b/examples/chart/CONTRIBUTING.md
new file mode 100644
index 0000000000000..af2a5d9e3abda
--- /dev/null
+++ b/examples/chart/CONTRIBUTING.md
@@ -0,0 +1,51 @@
+# Contributing to Teleport Helm charts
+
+Firstly, thanks for considering a contribution to Teleport's Helm charts.
+
+## A couple of brief warnings
+
+Please note that we won't accept contributions that are particularly esoteric, difficult to use or poorly implemented.
+Our goal is to:
+
+- keep the charts easy to use
+- keep all functionality relevant to a broad audience
+- always use sane defaults which are right for most deployments
+- require as few values changes as possible for everyday usage
+
+If your functionality is only really useful to you, it's best to keep it on your own fork and deploy from there.
+
+Sometimes Teleport staff may take over your PR and make changes, implement it in a slightly different way, or just merge it
+as part of a bigger merge of multiple PRs at once. We will make sure that you still get credit in the final commit if this
+happens.
+
+## Guidelines
+
+Here is a list of things that you should do to make sure to do in order to get a smooth PR review process with minimal
+changes required:
+
+1) Add a linter file which includes examples for any new values you add under the `.lint/` directory for the
+appropriate chart. The linter will check this during CI and make sure the values are correctly formatted, along
+with your chart changes. The file should contain all necessary values to deploy a reference install.
+
+2) Add unit tests for your functionality under the `tests/` directory for the appropriate chart, particularly if you're
+adding new values. Make sure that all functionality is tested, so we can be sure that it works as intended for every use
+case. A good tip is to use your newly added linter file to set values appropriate for your test.
+
+3) Add any new values at the correct location in the `values.schema.json` file for the appropriate chart. This
+will ensure that Helm is able to validate values at install-time and can prevent users from making easy mistakes.
+
+4) Document any new values or changes to existing behaviour in the [chart reference](../../docs/pages/kubernetes-access/helm/reference.mdx).
+
+5) Run `make lint-helm test-helm` from the root of the repo before raising your PR.
+You will need `yamllint`, `helm` and [helm3-unittest](https://github.com/vbehar/helm3-unittest) installed locally.
+
+`make -C build.assets lint-helm test-helm` will run these via Docker if you'd prefer not to install locally.
+
+6) If you get a snapshot error during your testing, you should verify that your changes intended to alter the output,
+then run `make test-helm-update-snapshots` to update the snapshots and commit these changes along with your PR.
+
+Again, `make -C build.assets test-helm-update-snapshots` will run this via Docker.
+
+7) Document the changes you've made in the PR summary.
+
+Thanks!
diff --git a/examples/chart/teleport-auto-trustedcluster/README.md b/examples/chart/teleport-auto-trustedcluster/README.md
index 12dd081fc08dd..0ffaa7a090dd1 100644
--- a/examples/chart/teleport-auto-trustedcluster/README.md
+++ b/examples/chart/teleport-auto-trustedcluster/README.md
@@ -1,3 +1,8 @@
+# WARNING
+
+This chart is **deprecated** and no longer actively maintained or supported by Teleport.
+We recommend the use of the [teleport-cluster](../teleport-cluster/README.md) chart instead.
+
 # Teleport
 
 [Gravitational Teleport](https://github.com/gravitational/teleport) is a modern SSH/Kubernetes API proxy server for
diff --git a/examples/chart/teleport-cluster/.lint/service.yml b/examples/chart/teleport-cluster/.lint/service.yaml
similarity index 100%
rename from examples/chart/teleport-cluster/.lint/service.yml
rename to examples/chart/teleport-cluster/.lint/service.yaml
diff --git a/examples/chart/teleport-cluster/.lint/standalone-customsize.yaml b/examples/chart/teleport-cluster/.lint/standalone-customsize.yaml
index 345999323a716..e8acbe8cf9848 100644
--- a/examples/chart/teleport-cluster/.lint/standalone-customsize.yaml
+++ b/examples/chart/teleport-cluster/.lint/standalone-customsize.yaml
@@ -1,7 +1,7 @@
 clusterName: test-standalone-cluster
 chartMode: standalone
 standalone:
-  existingClaimName: teleport-storage
+  volumeSize: 50Gi
 acme: true
 acmeEmail: test@email.com
 labels:
diff --git a/examples/chart/teleport-cluster/.lint/standalone-existingpvc.yaml b/examples/chart/teleport-cluster/.lint/standalone-existingpvc.yaml
index e8acbe8cf9848..345999323a716 100644
--- a/examples/chart/teleport-cluster/.lint/standalone-existingpvc.yaml
+++ b/examples/chart/teleport-cluster/.lint/standalone-existingpvc.yaml
@@ -1,7 +1,7 @@
 clusterName: test-standalone-cluster
 chartMode: standalone
 standalone:
-  volumeSize: 50Gi
+  existingClaimName: teleport-storage
 acme: true
 acmeEmail: test@email.com
 labels:
diff --git a/examples/chart/teleport-cluster/.lint/volumes.yaml b/examples/chart/teleport-cluster/.lint/volumes.yaml
index 83bb8b8dbe95c..a1ce300828a45 100644
--- a/examples/chart/teleport-cluster/.lint/volumes.yaml
+++ b/examples/chart/teleport-cluster/.lint/volumes.yaml
@@ -1,7 +1,7 @@
 clusterName: helm-lint
 extraVolumeMounts:
 - name: "my-mount"
-  path: "/path/to/mount"
+  mountPath: "/path/to/mount"
 extraVolumes:
 - name: "my-mount"
   secret:
diff --git a/examples/chart/teleport-cluster/.lint/webauthn.yaml b/examples/chart/teleport-cluster/.lint/webauthn.yaml
new file mode 100644
index 0000000000000..0415cc7c7f512
--- /dev/null
+++ b/examples/chart/teleport-cluster/.lint/webauthn.yaml
@@ -0,0 +1,8 @@
+clusterName: helm-lint
+authenticationSecondFactor:
+  secondFactor: "on"
+  webauthn:
+    attestationAllowedCas:
+      - "/etc/ssl/certs/ca-certificates.crt"
+    attestationDeniedCas:
+      - "/etc/ssl/certs/ca-certificates.crt"
diff --git a/examples/chart/teleport-cluster/README.md b/examples/chart/teleport-cluster/README.md
index 45504877ba6e2..51ffdf73bcbab 100644
--- a/examples/chart/teleport-cluster/README.md
+++ b/examples/chart/teleport-cluster/README.md
@@ -47,3 +47,7 @@ secret `license` in the chart namespace.
 
 See https://goteleport.com/docs/kubernetes-access/helm/guides/ for guides on setting up HA Teleport clusters
 in EKS or GKE, plus a more comprehensive chart reference.
+
+## Contributing to the chart
+
+Please read [CONTRIBUTING.md](../CONTRIBUTING.md) before raising a pull request to this chart.
diff --git a/examples/chart/teleport-cluster/templates/config.yaml b/examples/chart/teleport-cluster/templates/config.yaml
index d86d63e4901e4..54369e4161af5 100644
--- a/examples/chart/teleport-cluster/templates/config.yaml
+++ b/examples/chart/teleport-cluster/templates/config.yaml
@@ -4,6 +4,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
   {{- if .Values.annotations.config }}
   annotations:
     {{- toYaml .Values.annotations.config | nindent 4 }}
@@ -55,12 +56,33 @@ data:
   {{- end }}
       authentication:
         type: {{ required "authenticationType is required in chart values" .Values.authenticationType }}
+  {{- if .Values.authenticationSecondFactor }}
+    {{- if .Values.authenticationSecondFactor.secondFactor }}
+        second_factor: {{ .Values.authenticationSecondFactor.secondFactor }}
+    {{- end }}
+    {{- if not (or (eq .Values.authenticationSecondFactor.secondFactor "off") (eq .Values.authenticationSecondFactor.secondFactor "otp")) }}
+        webauthn:
+          rp_id: {{ required "clusterName is required in chart values" .Values.clusterName }}
+      {{- if .Values.authenticationSecondFactor.webauthn }}
+        {{- if .Values.authenticationSecondFactor.webauthn.attestationAllowedCas }}
+          attestation_allowed_cas:
+          {{- toYaml .Values.authenticationSecondFactor.webauthn.attestationAllowedCas | nindent 12 }}
+        {{- end }}
+        {{- if .Values.authenticationSecondFactor.webauthn.attestationDeniedCas }}
+          attestation_denied_cas:
+          {{- toYaml .Values.authenticationSecondFactor.webauthn.attestationDeniedCas | nindent 12 }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
   {{- if eq .Values.proxyListenerMode "multiplex" }}
       proxy_listener_mode: multiplex
   {{- end }}
     kubernetes_service:
       enabled: true
-  {{- if not .Values.proxyListenerMode }}
+  {{- if eq .Values.proxyListenerMode "multiplex" }}
+      listen_addr: 0.0.0.0:443
+  {{- else if not .Values.proxyListenerMode }}
       listen_addr: 0.0.0.0:3027
   {{- end }}
   {{- if .Values.kubeClusterName }}
diff --git a/examples/chart/teleport-cluster/tests/README.md b/examples/chart/teleport-cluster/tests/README.md
new file mode 100644
index 0000000000000..3cd0f8783d4e6
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/README.md
@@ -0,0 +1,18 @@
+## Unit tests for Helm charts
+
+Helm chart unit tests run here using the [helm3-unittest](https://github.com/vbehar/helm3-unittest) Helm plugin.
+
+If you get a snapshot error during your testing, you should verify that your changes intended to alter the output, then run
+this command from the root of your Teleport checkout to update the snapshots:
+
+```bash
+make -C build.assets test-helm-update-snapshots
+```
+
+After this, re-run the tests to make sure everything is fine:
+
+```bash
+make -C build.assets test-helm
+```
+
+Commit the updated snapshots along with your changes.
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/certificate_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/certificate_test.yaml.snap
new file mode 100644
index 0000000000000..319cbd80eb8c0
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/certificate_test.yaml.snap
@@ -0,0 +1,16 @@
+should request a certificate for cluster name when cert-manager is enabled (cert-manager.yaml):
+  1: |
+    - test-cluster
+    - '*.test-cluster'
+  2: |
+    group: custom.cert-manager.io
+    kind: CustomClusterIssuer
+    name: custom
+should request a certificate for cluster name when cert-manager is enabled (cert-secret.yaml):
+  1: |
+    - test-cluster
+    - '*.test-cluster'
+  2: |
+    group: cert-manager.io
+    kind: Issuer
+    name: letsencrypt
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/clusterrole_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/clusterrole_test.yaml.snap
new file mode 100644
index 0000000000000..73d2b30742ace
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/clusterrole_test.yaml.snap
@@ -0,0 +1,27 @@
+creates a ClusterRole:
+  1: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRole
+    metadata:
+      name: RELEASE-NAME
+    rules:
+    - apiGroups:
+      - ""
+      resources:
+      - users
+      - groups
+      - serviceaccounts
+      verbs:
+      - impersonate
+    - apiGroups:
+      - ""
+      resources:
+      - pods
+      verbs:
+      - get
+    - apiGroups:
+      - authorization.k8s.io
+      resources:
+      - selfsubjectaccessreviews
+      verbs:
+      - create
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/clusterrolebinding_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/clusterrolebinding_test.yaml.snap
new file mode 100644
index 0000000000000..408ec5f4556e2
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/clusterrolebinding_test.yaml.snap
@@ -0,0 +1,14 @@
+creates a ClusterRoleBinding:
+  1: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    metadata:
+      name: RELEASE-NAME
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: ClusterRole
+      name: RELEASE-NAME
+    subjects:
+    - kind: ServiceAccount
+      name: RELEASE-NAME
+      namespace: NAMESPACE
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/config_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/config_test.yaml.snap
new file mode 100644
index 0000000000000..30d3cf75b5626
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/config_test.yaml.snap
@@ -0,0 +1,1098 @@
+matches snapshot and tests for annotations.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: helm-lint
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: helm-lint
+        proxy_service:
+          public_addr: 'helm-lint:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        kubernetes.io/config: test-annotation
+        kubernetes.io/config-different: 2
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for acme-off.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-cluster-name
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-cluster-name
+        proxy_service:
+          public_addr: 'test-cluster-name:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for acme-on.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-acme-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-acme-cluster
+        proxy_service:
+          public_addr: 'test-acme-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          acme:
+            enabled: true
+            email: test@email.com
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for acme-uri-staging.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-acme-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-acme-cluster
+        proxy_service:
+          public_addr: 'test-acme-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          acme:
+            enabled: true
+            email: test@email.com
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for affinity.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: firestore
+            project_id: gcpproj-123456
+            collection_name: test-teleport-firestore-storage-collection
+            credentials_path: /etc/teleport-secrets/gcp-credentials.json
+            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json']
+            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
+        auth_service:
+          enabled: true
+          cluster_name: test-gcp-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-gcp-cluster
+        proxy_service:
+          public_addr: 'test-gcp-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for aws-ha-acme.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: dynamodb
+            region: us-west-2
+            table_name: test-dynamodb-backend-table
+            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
+            audit_sessions_uri: s3://test-s3-session-storage-bucket
+            continuous_backups: false
+        auth_service:
+          enabled: true
+          cluster_name: test-aws-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-aws-cluster
+          labels:
+            env: aws
+        proxy_service:
+          public_addr: 'test-aws-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          https_keypairs:
+          - key_file: /etc/teleport-tls/tls.key
+            cert_file: /etc/teleport-tls/tls.crt
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for aws-ha-antiaffinity.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: dynamodb
+            region: us-west-2
+            table_name: test-dynamodb-backend-table
+            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
+            audit_sessions_uri: s3://test-s3-session-storage-bucket
+            continuous_backups: false
+        auth_service:
+          enabled: true
+          cluster_name: test-aws-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-aws-cluster
+          labels:
+            env: aws
+        proxy_service:
+          public_addr: 'test-aws-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for aws-ha-log.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: DEBUG
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: dynamodb
+            region: us-west-2
+            table_name: test-dynamodb-backend-table
+            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table', 'stdout://']
+            audit_sessions_uri: s3://test-s3-session-storage-bucket
+            continuous_backups: false
+        auth_service:
+          enabled: true
+          cluster_name: test-aws-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-aws-cluster
+          labels:
+            env: aws
+        proxy_service:
+          public_addr: 'test-aws-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          https_keypairs:
+          - key_file: /etc/teleport-tls/tls.key
+            cert_file: /etc/teleport-tls/tls.crt
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for aws-ha.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: dynamodb
+            region: us-west-2
+            table_name: test-dynamodb-backend-table
+            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
+            audit_sessions_uri: s3://test-s3-session-storage-bucket
+            continuous_backups: false
+        auth_service:
+          enabled: true
+          cluster_name: test-aws-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-aws-cluster
+          labels:
+            env: aws
+        proxy_service:
+          public_addr: 'test-aws-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for aws.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: dynamodb
+            region: us-west-2
+            table_name: test-dynamodb-backend-table
+            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
+            audit_sessions_uri: s3://test-s3-session-storage-bucket
+            continuous_backups: false
+        auth_service:
+          enabled: true
+          cluster_name: test-aws-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-aws-cluster
+          labels:
+            env: aws
+        proxy_service:
+          public_addr: 'test-aws-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          acme:
+            enabled: true
+            email: test@email.com
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for gcp-ha-acme.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: firestore
+            project_id: gcpproj-123456
+            collection_name: test-teleport-firestore-storage-collection
+            credentials_path: /etc/teleport-secrets/gcp-credentials.json
+            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json']
+            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
+        auth_service:
+          enabled: true
+          cluster_name: test-gcp-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-gcp-cluster
+          labels:
+            env: gcp
+        proxy_service:
+          public_addr: 'test-gcp-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          https_keypairs:
+          - key_file: /etc/teleport-tls/tls.key
+            cert_file: /etc/teleport-tls/tls.crt
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for gcp-ha-antiaffinity.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: firestore
+            project_id: gcpproj-123456
+            collection_name: test-teleport-firestore-storage-collection
+            credentials_path: /etc/teleport-secrets/gcp-credentials.json
+            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json']
+            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
+        auth_service:
+          enabled: true
+          cluster_name: test-gcp-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-gcp-cluster
+          labels:
+            env: gcp
+        proxy_service:
+          public_addr: 'test-gcp-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for gcp-ha-log.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: DEBUG
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: firestore
+            project_id: gcpproj-123456
+            collection_name: test-teleport-firestore-storage-collection
+            credentials_path: /etc/teleport-secrets/gcp-credentials.json
+            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json', 'stdout://']
+            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
+        auth_service:
+          enabled: true
+          cluster_name: test-gcp-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-gcp-cluster
+          labels:
+            env: gcp
+        proxy_service:
+          public_addr: 'test-gcp-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          https_keypairs:
+          - key_file: /etc/teleport-tls/tls.key
+            cert_file: /etc/teleport-tls/tls.crt
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for gcp.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: firestore
+            project_id: gcpproj-123456
+            collection_name: test-teleport-firestore-storage-collection
+            credentials_path: /etc/teleport-secrets/gcp-credentials.json
+            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json']
+            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
+        auth_service:
+          enabled: true
+          cluster_name: test-gcp-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-gcp-cluster
+          labels:
+            env: gcp
+        proxy_service:
+          public_addr: 'test-gcp-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          acme:
+            enabled: true
+            email: test@email.com
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for initcontainers.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: helm-lint
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: helm-lint
+        proxy_service:
+          public_addr: 'helm-lint:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for kube-cluster-name.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-aws-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-kube-cluster
+        proxy_service:
+          public_addr: 'test-aws-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for log-basic.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: json
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-log-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-log-cluster
+        proxy_service:
+          public_addr: 'test-log-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for log-extra.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: DEBUG
+            output: /var/lib/teleport/test.log
+            format:
+              output: json
+              extra_fields: ["level","timestamp","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-log-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-log-cluster
+        proxy_service:
+          public_addr: 'test-log-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for log-legacy.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: DEBUG
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-log-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-log-cluster
+        proxy_service:
+          public_addr: 'test-log-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for priority-class-name.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: helm-lint
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: helm-lint
+        proxy_service:
+          public_addr: 'helm-lint:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for proxy-listener-mode.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        version: v2
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-proxy-listener-mode
+          authentication:
+            type: local
+            second_factor: otp
+          proxy_listener_mode: multiplex
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:443
+          kube_cluster_name: test-proxy-listener-mode
+        proxy_service:
+          public_addr: 'test-proxy-listener-mode:443'
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for resources.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: helm-lint
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: helm-lint
+        proxy_service:
+          public_addr: 'helm-lint:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for service.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: helm-lint
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: helm-lint
+        proxy_service:
+          public_addr: 'helm-lint:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for standalone-customsize.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-standalone-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-standalone-cluster
+          labels:
+            env: standalone
+        proxy_service:
+          public_addr: 'test-standalone-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          acme:
+            enabled: true
+            email: test@email.com
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for standalone-existingpvc.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-standalone-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-standalone-cluster
+          labels:
+            env: standalone
+        proxy_service:
+          public_addr: 'test-standalone-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+          acme:
+            enabled: true
+            email: test@email.com
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for tolerations.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+          storage:
+            type: dynamodb
+            region: us-west-2
+            table_name: test-dynamodb-backend-table
+            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
+            audit_sessions_uri: s3://test-s3-session-storage-bucket
+            continuous_backups: false
+        auth_service:
+          enabled: true
+          cluster_name: test-aws-cluster
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-aws-cluster
+        proxy_service:
+          public_addr: 'test-aws-cluster:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for version-override.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: test-cluster-name
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: test-cluster-name
+          labels:
+            env: test
+            version: 5.2.1
+        proxy_service:
+          public_addr: 'test-cluster-name:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for volumes.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: helm-lint
+          authentication:
+            type: local
+            second_factor: otp
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: helm-lint
+        proxy_service:
+          public_addr: 'helm-lint:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for webauthn.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |-
+        teleport:
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+        auth_service:
+          enabled: true
+          cluster_name: helm-lint
+          authentication:
+            type: local
+            second_factor: on
+            webauthn:
+              rp_id: helm-lint
+              attestation_allowed_cas:
+                - /etc/ssl/certs/ca-certificates.crt
+              attestation_denied_cas:
+                - /etc/ssl/certs/ca-certificates.crt
+        kubernetes_service:
+          enabled: true
+          listen_addr: 0.0.0.0:3027
+          kube_cluster_name: helm-lint
+        proxy_service:
+          public_addr: 'helm-lint:443'
+          kube_listen_addr: 0.0.0.0:3026
+          mysql_listen_addr: 0.0.0.0:3036
+          enabled: true
+        ssh_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap
new file mode 100644
index 0000000000000..98991aec2640e
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap
@@ -0,0 +1,1585 @@
+sets Deployment annotations when specified:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+sets Pod annotations when specified:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should add PersistentVolumeClaim as volume when in standalone mode:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should add emptyDir for data in AWS mode:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should add emptyDir for data in GCP mode:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport-secrets
+        name: gcp-credentials
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should add emptyDir for data in custom mode:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should add insecureSkipProxyTLSVerify to args when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      - --insecure
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should add named PersistentVolumeClaim as volume when in standalone mode and standalone.existingClaimName is set:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: teleport-storage
+should do enterprise things when when enterprise is set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport-ent:8.3.4
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /var/lib/license
+        name: license
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: license
+      secret:
+        secretName: license
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should expose diag port:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should have multiple replicas when replicaCount is set:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should mount ConfigMap for config in AWS mode:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should mount ConfigMap for config in GCP mode:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport-secrets
+        name: gcp-credentials
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should mount ConfigMap for config in custom mode:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should mount ConfigMap for config in standalone mode:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should mount GCP credentials for initContainer in GCP mode:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport-secrets
+        name: gcp-credentials
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    initContainers:
+    - args:
+      - echo test
+      image: alpine
+      name: teleport-init
+      volumeMounts:
+      - mountPath: /etc/teleport-secrets
+        name: gcp-credentials
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should mount GCP credentials in GCP mode:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport-secrets
+        name: gcp-credentials
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should mount TLS certs for initContainer when cert-manager is enabled:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport-secrets
+        name: gcp-credentials
+        readOnly: true
+      - mountPath: /etc/teleport-tls
+        name: teleport-tls
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    initContainers:
+    - args:
+      - echo test
+      image: alpine
+      name: teleport-init
+      volumeMounts:
+      - mountPath: /etc/teleport-secrets
+        name: gcp-credentials
+        readOnly: true
+      - mountPath: /etc/teleport-tls
+        name: teleport-tls
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - name: teleport-tls
+      secret:
+        secretName: teleport-tls
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should mount TLS certs when cert-manager is enabled:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport-secrets
+        name: gcp-credentials
+        readOnly: true
+      - mountPath: /etc/teleport-tls
+        name: teleport-tls
+        readOnly: true
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - name: teleport-tls
+      secret:
+        secretName: teleport-tls
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should mount extraVolumes and extraVolumeMounts:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+      - mountPath: /path/to/mount
+        name: my-mount
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+    - name: my-mount
+      secret:
+        secretName: mySecret
+should not do enterprise things when when enterprise is not set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:8.3.4
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should not have more than one replica in standalone mode:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should provision initContainer correctly when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      env:
+      - name: SSL_CERT_FILE
+        value: /etc/tls/some-cert-file.pem
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    initContainers:
+    - args:
+      - echo test
+      image: alpine
+      name: teleport-init
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should set affinity when set in values:
+  1: |
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+          - matchExpressions:
+            - key: gravitational.io/dedicated
+              operator: In
+              values:
+              - teleport
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should set environment when extraEnv set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      env:
+      - name: SSL_CERT_FILE
+        value: /etc/tls/some-cert-file.pem
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should set imagePullPolicy when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: Always
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should set postStart command if set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      lifecycle:
+        postStart:
+          exec:
+            command:
+            - /bin/echo
+            - test
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should set priorityClassName when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    priorityClassName: system-cluster-critical
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should set required affinity when highAvailability.requireAntiAffinity is set:
+  1: |
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchExpressions:
+            - key: app
+              operator: In
+              values:
+              - RELEASE-NAME
+          topologyKey: kubernetes.io/hostname
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
+should set resources when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: data
+      persistentVolumeClaim:
+        claimName: RELEASE-NAME
+should set tolerations when set in values:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    tolerations:
+    - effect: NoExecute
+      key: dedicated
+      operator: Equal
+      value: teleport
+    - effect: NoSchedule
+      key: dedicated
+      operator: Equal
+      value: teleport
+    volumes:
+    - name: gcp-credentials
+      secret:
+        secretName: teleport-gcp-credentials
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - emptyDir: {}
+      name: data
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/pdb_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/pdb_test.yaml.snap
new file mode 100644
index 0000000000000..a8d3bf87b8092
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/pdb_test.yaml.snap
@@ -0,0 +1,14 @@
+should create a PDB when enabled in values (pdb.yaml):
+  1: |
+    apiVersion: policy/v1beta1
+    kind: PodDisruptionBudget
+    metadata:
+      labels:
+        app: RELEASE-NAME
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      minAvailable: 2
+      selector:
+        matchLabels:
+          app: RELEASE-NAME
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/psp_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/psp_test.yaml.snap
new file mode 100644
index 0000000000000..5536920844cf3
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/psp_test.yaml.snap
@@ -0,0 +1,34 @@
+creates a PodSecurityPolicy when enabled in values:
+  1: |
+    apiVersion: policy/v1beta1
+    kind: PodSecurityPolicy
+    metadata:
+      annotations:
+        seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
+        seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
+      name: RELEASE-NAME
+    spec:
+      allowPrivilegeEscalation: false
+      fsGroup:
+        ranges:
+        - max: 65535
+          min: 1
+        rule: MustRunAs
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      privileged: false
+      readOnlyRootFilesystem: true
+      requiredDropCapabilities:
+      - ALL
+      runAsUser:
+        rule: MustRunAsNonRoot
+      seLinux:
+        rule: RunAsAny
+      supplementalGroups:
+        ranges:
+        - max: 65535
+          min: 1
+        rule: MustRunAs
+      volumes:
+      - '*'
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/pvc_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/pvc_test.yaml.snap
new file mode 100644
index 0000000000000..8a174f4e892af
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/pvc_test.yaml.snap
@@ -0,0 +1,30 @@
+creates a PersistentVolumeClaim when chartMode=standalone:
+  1: |
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      labels:
+        app: RELEASE-NAME
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi
+creates a PersistentVolumeClaim with values from standalone-customsize.yaml:
+  1: |
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      labels:
+        app: RELEASE-NAME
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 50Gi
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/service_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/service_test.yaml.snap
new file mode 100644
index 0000000000000..4386f1f3555d3
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/service_test.yaml.snap
@@ -0,0 +1,143 @@
+sets AWS annotations when chartMode=aws:
+  1: |
+    apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
+        service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
+        service.beta.kubernetes.io/aws-load-balancer-type: nlb
+      labels:
+        app: RELEASE-NAME
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      ports:
+      - name: https
+        port: 443
+        protocol: TCP
+        targetPort: 3080
+      - name: sshproxy
+        port: 3023
+        protocol: TCP
+        targetPort: 3023
+      - name: k8s
+        port: 3026
+        protocol: TCP
+        targetPort: 3026
+      - name: sshtun
+        port: 3024
+        protocol: TCP
+        targetPort: 3024
+      - name: mysql
+        port: 3036
+        protocol: TCP
+        targetPort: 3036
+      selector:
+        app: RELEASE-NAME
+      type: LoadBalancer
+sets service annotations when specified:
+  1: |
+    apiVersion: v1
+    kind: Service
+    metadata:
+      annotations:
+        kubernetes.io/service: test-annotation
+        kubernetes.io/service-different: 5
+      labels:
+        app: RELEASE-NAME
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      ports:
+      - name: https
+        port: 443
+        protocol: TCP
+        targetPort: 3080
+      - name: sshproxy
+        port: 3023
+        protocol: TCP
+        targetPort: 3023
+      - name: k8s
+        port: 3026
+        protocol: TCP
+        targetPort: 3026
+      - name: sshtun
+        port: 3024
+        protocol: TCP
+        targetPort: 3024
+      - name: mysql
+        port: 3036
+        protocol: TCP
+        targetPort: 3036
+      selector:
+        app: RELEASE-NAME
+      type: LoadBalancer
+uses a ClusterIP when service.type=ClusterIP:
+  1: |
+    apiVersion: v1
+    kind: Service
+    metadata:
+      labels:
+        app: RELEASE-NAME
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      ports:
+      - name: https
+        port: 443
+        protocol: TCP
+        targetPort: 3080
+      - name: sshproxy
+        port: 3023
+        protocol: TCP
+        targetPort: 3023
+      - name: k8s
+        port: 3026
+        protocol: TCP
+        targetPort: 3026
+      - name: sshtun
+        port: 3024
+        protocol: TCP
+        targetPort: 3024
+      - name: mysql
+        port: 3036
+        protocol: TCP
+        targetPort: 3036
+      selector:
+        app: RELEASE-NAME
+      type: ClusterIP
+uses a LoadBalancer by default:
+  1: |
+    apiVersion: v1
+    kind: Service
+    metadata:
+      labels:
+        app: RELEASE-NAME
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      ports:
+      - name: https
+        port: 443
+        protocol: TCP
+        targetPort: 3080
+      - name: sshproxy
+        port: 3023
+        protocol: TCP
+        targetPort: 3023
+      - name: k8s
+        port: 3026
+        protocol: TCP
+        targetPort: 3026
+      - name: sshtun
+        port: 3024
+        protocol: TCP
+        targetPort: 3024
+      - name: mysql
+        port: 3036
+        protocol: TCP
+        targetPort: 3036
+      selector:
+        app: RELEASE-NAME
+      type: LoadBalancer
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/serviceaccount_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/serviceaccount_test.yaml.snap
new file mode 100644
index 0000000000000..6d6ccbeadb27e
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/__snapshot__/serviceaccount_test.yaml.snap
@@ -0,0 +1,10 @@
+sets ServiceAccount annotations when specified:
+  1: |
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        kubernetes.io/serviceaccount: test-annotation
+        kubernetes.io/serviceaccount-different: 6
+      name: RELEASE-NAME
+      namespace: NAMESPACE
diff --git a/examples/chart/teleport-cluster/tests/certificate_test.yaml b/examples/chart/teleport-cluster/tests/certificate_test.yaml
new file mode 100644
index 0000000000000..b2cb8cc737301
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/certificate_test.yaml
@@ -0,0 +1,29 @@
+suite: Certificate
+templates:
+  - certificate.yaml
+tests:
+  - it: should request a certificate for cluster name when cert-manager is enabled (cert-manager.yaml)
+    values:
+      - ../.lint/cert-manager.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Certificate
+      - matchSnapshot:
+          path: spec.dnsNames
+      - matchSnapshot:
+          path: spec.issuerRef
+
+  - it: should request a certificate for cluster name when cert-manager is enabled (cert-secret.yaml)
+    values:
+      - ../.lint/cert-secret.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Certificate
+      - matchSnapshot:
+          path: spec.dnsNames
+      - matchSnapshot:
+          path: spec.issuerRef
diff --git a/examples/chart/teleport-cluster/tests/clusterrole_test.yaml b/examples/chart/teleport-cluster/tests/clusterrole_test.yaml
new file mode 100644
index 0000000000000..337947d13ad2b
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/clusterrole_test.yaml
@@ -0,0 +1,11 @@
+suite: ClusterRole
+templates:
+  - clusterrole.yaml
+tests:
+  - it: creates a ClusterRole
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ClusterRole
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/clusterrolebinding_test.yaml b/examples/chart/teleport-cluster/tests/clusterrolebinding_test.yaml
new file mode 100644
index 0000000000000..b8f30d8cf4fc2
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/clusterrolebinding_test.yaml
@@ -0,0 +1,11 @@
+suite: ClusterRoleBinding
+templates:
+  - clusterrolebinding.yaml
+tests:
+  - it: creates a ClusterRoleBinding
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ClusterRoleBinding
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/config_test.yaml b/examples/chart/teleport-cluster/tests/config_test.yaml
new file mode 100644
index 0000000000000..1a56648cc47ea
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/config_test.yaml
@@ -0,0 +1,330 @@
+suite: ConfigMap
+templates:
+  - config.yaml
+tests:
+  - it: matches snapshot for acme-off.yaml
+    values:
+      - ../.lint/acme-off.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for acme-off.yaml
+    values:
+      - ../.lint/acme-off.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for acme-on.yaml
+    values:
+      - ../.lint/acme-on.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for acme-uri-staging.yaml
+    values:
+      - ../.lint/acme-on.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for affinity.yaml
+    values:
+      - ../.lint/affinity.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot and tests for annotations.yaml
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - equal:
+          path: metadata.annotations.kubernetes\.io/config
+          value: test-annotation
+      - equal:
+          path: metadata.annotations.kubernetes\.io/config-different
+          value: 2
+      - matchSnapshot: {}
+
+  - it: matches snapshot for aws-ha-acme.yaml
+    values:
+      - ../.lint/aws-ha-acme.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for aws-ha-antiaffinity.yaml
+    values:
+      - ../.lint/aws-ha-antiaffinity.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for aws-ha-log.yaml
+    values:
+      - ../.lint/aws-ha-log.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for aws-ha.yaml
+    values:
+      - ../.lint/aws-ha.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for aws.yaml
+    values:
+      - ../.lint/aws.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: does not generate a config for cert-manager.yaml
+    values:
+      - ../.lint/cert-manager.yaml
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: does not generate a config for cert-secret.yaml
+    values:
+      - ../.lint/cert-secret.yaml
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: matches snapshot for gcp-ha-acme.yaml
+    values:
+      - ../.lint/gcp-ha-acme.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for gcp-ha-antiaffinity.yaml
+    values:
+      - ../.lint/gcp-ha-antiaffinity.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for gcp-ha-log.yaml
+    values:
+      - ../.lint/gcp-ha-log.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for gcp.yaml
+    values:
+      - ../.lint/gcp.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for initcontainers.yaml
+    values:
+      - ../.lint/initcontainers.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for kube-cluster-name.yaml
+    values:
+      - ../.lint/kube-cluster-name.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for log-basic.yaml
+    values:
+      - ../.lint/log-basic.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for log-extra.yaml
+    values:
+      - ../.lint/log-extra.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for log-legacy.yaml
+    values:
+      - ../.lint/log-legacy.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: does not generate a config for pdb.yaml
+    values:
+      - ../.lint/pdb.yaml
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: matches snapshot for priority-class-name.yaml
+    values:
+      - ../.lint/priority-class-name.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for proxy-listener-mode.yaml
+    values:
+      - ../.lint/proxy-listener-mode.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for resources.yaml
+    values:
+      - ../.lint/resources.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for service.yaml
+    values:
+      - ../.lint/service.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for standalone-customsize.yaml
+    values:
+      - ../.lint/standalone-customsize.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for standalone-existingpvc.yaml
+    values:
+      - ../.lint/standalone-existingpvc.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for tolerations.yaml
+    values:
+      - ../.lint/tolerations.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for version-override.yaml
+    values:
+      - ../.lint/version-override.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for volumes.yaml
+    values:
+      - ../.lint/volumes.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for webauthn.yaml
+    values:
+      - ../.lint/webauthn.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/deployment_test.yaml b/examples/chart/teleport-cluster/tests/deployment_test.yaml
new file mode 100644
index 0000000000000..930925c9cc5d2
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/deployment_test.yaml
@@ -0,0 +1,533 @@
+suite: Deployment
+templates:
+  - deployment.yaml
+  - config.yaml
+tests:
+  - it: sets Deployment annotations when specified
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - equal:
+          path: metadata.annotations.kubernetes\.io/deployment
+          value: test-annotation
+      - equal:
+          path: metadata.annotations.kubernetes\.io/deployment-different
+          value: 3
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: sets Pod annotations when specified
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.kubernetes\.io/pod
+          value: test-annotation
+      - equal:
+          path: spec.template.metadata.annotations.kubernetes\.io/pod-different
+          value: 4
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should not have more than one replica in standalone mode
+    set:
+      chartMode: standalone
+      clusterName: helm-lint.example.com
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 1
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should have multiple replicas when replicaCount is set
+    set:
+      chartMode: custom
+      clusterName: helm-lint.example.com
+      highAvailability:
+        replicaCount: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set affinity when set in values
+    set:
+      chartMode: custom
+      clusterName: helm-lint.example.com
+      highAvailability:
+        replicaCount: 3
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: gravitational.io/dedicated
+                operator: In
+                values:
+                - teleport
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.affinity
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set required affinity when highAvailability.requireAntiAffinity is set
+    values:
+      - ../.lint/aws-ha-antiaffinity.yaml
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.affinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set tolerations when set in values
+    values:
+      - ../.lint/tolerations.yaml
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.tolerations
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set resources when set in values
+    values:
+      - ../.lint/resources.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 2
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.memory
+          value: 4Gi
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.cpu
+          value: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.memory
+          value: 2Gi
+      - matchSnapshot:
+          path: spec.template.spec
+
+  # we can't use the dynamic chart version or appVersion as a variable in the tests,
+  # so we override it manually and check that gets set instead
+  # this saves us having to update the test every time we cut a new release
+  - it: should do enterprise things when when enterprise is set in values
+    set:
+      clusterName: helm-lint.example.com
+      enterprise: true
+      teleportVersionOverride: 8.3.4
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: quay.io/gravitational/teleport-ent:8.3.4
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /var/lib/license
+            name: "license"
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: license
+            secret:
+              secretName: license
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should not do enterprise things when when enterprise is not set in values
+    set:
+      clusterName: helm-lint
+      teleportVersionOverride: 8.3.4
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: quay.io/gravitational/teleport:8.3.4
+      - notContains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /var/lib/license
+            name: "license"
+            readOnly: true
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: license
+            secret:
+              secretName: license
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount GCP credentials in GCP mode
+    values:
+      - ../.lint/gcp-ha.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport-secrets
+            name: "gcp-credentials"
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: gcp-credentials
+            secret:
+              secretName: teleport-gcp-credentials
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount GCP credentials for initContainer in GCP mode
+    values:
+      - ../.lint/gcp-ha.yaml
+      - ../.lint/initcontainers.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport-secrets
+            name: "gcp-credentials"
+            readOnly: true
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount TLS certs when cert-manager is enabled
+    values:
+      - ../.lint/gcp-ha-acme.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport-tls
+            name: "teleport-tls"
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: teleport-tls
+            secret:
+              secretName: teleport-tls
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount TLS certs for initContainer when cert-manager is enabled
+    values:
+      - ../.lint/gcp-ha-acme.yaml
+      - ../.lint/initcontainers.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport-tls
+            name: "teleport-tls"
+            readOnly: true
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount ConfigMap for config in AWS mode
+    values:
+      - ../.lint/aws-ha.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport
+            name: "config"
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: config
+            configMap:
+              name: RELEASE-NAME
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount ConfigMap for config in GCP mode
+    values:
+      - ../.lint/gcp-ha.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport
+            name: "config"
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: config
+            configMap:
+              name: RELEASE-NAME
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount ConfigMap for config in standalone mode
+    set:
+      chartMode: standalone
+      clusterName: helm-lint.example.com
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport
+            name: "config"
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: config
+            configMap:
+              name: RELEASE-NAME
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount ConfigMap for config in custom mode
+    set:
+      chartMode: custom
+      clusterName: helm-lint.example.com
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /etc/teleport
+            name: "config"
+            readOnly: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: config
+            configMap:
+              name: RELEASE-NAME
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount extraVolumes and extraVolumeMounts
+    values:
+      - ../.lint/volumes.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /path/to/mount
+            name: my-mount
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: my-mount
+            secret:
+              secretName: mySecret
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount extraVolumes and extraVolumeMounts
+    values:
+      - ../.lint/volumes.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /path/to/mount
+            name: my-mount
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: my-mount
+            secret:
+              secretName: mySecret
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount extraVolumes and extraVolumeMounts
+    values:
+      - ../.lint/volumes.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /path/to/mount
+            name: my-mount
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: my-mount
+            secret:
+              secretName: mySecret
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set imagePullPolicy when set in values
+    set:
+      clusterName: helm-lint.example.com
+      imagePullPolicy: Always
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set environment when extraEnv set in values
+    set:
+      clusterName: helm-lint.example.com
+      extraEnv:
+        - name: SSL_CERT_FILE
+          value: "/etc/tls/some-cert-file.pem"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SSL_CERT_FILE
+            value: "/etc/tls/some-cert-file.pem"
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should provision initContainer correctly when set in values
+    values:
+      - ../.lint/initcontainers.yaml
+      - ../.lint/resources.yaml
+    set:
+      extraEnv:
+        - name: SSL_CERT_FILE
+          value: "/etc/tls/some-cert-file.pem"
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[0].args
+          content: "echo test"
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: "teleport-init"
+      - equal:
+          path: spec.template.spec.initContainers[0].image
+          value: "alpine"
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.limits.cpu
+          value: 2
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.limits.memory
+          value: 4Gi
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.requests.cpu
+          value: 1
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.requests.memory
+          value: 2Gi
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add insecureSkipProxyTLSVerify to args when set in values
+    set:
+      clusterName: helm-lint.example.com
+      insecureSkipProxyTLSVerify: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--insecure"
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should expose diag port
+    set:
+      clusterName: helm-lint.example.com
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            name: diag
+            containerPort: 3000
+            protocol: TCP
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set postStart command if set in values
+    set:
+      clusterName: helm-lint.example.com
+      postStart:
+        command: ["/bin/echo", "test"]
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].lifecycle.postStart.exec.command
+          value: ["/bin/echo", "test"]
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add PersistentVolumeClaim as volume when in standalone mode
+    set:
+      chartMode: standalone
+      clusterName: helm-lint.example.com
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: data
+            persistentVolumeClaim:
+              claimName: RELEASE-NAME
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add named PersistentVolumeClaim as volume when in standalone mode and standalone.existingClaimName is set
+    values:
+      - ../.lint/standalone-existingpvc.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: data
+            persistentVolumeClaim:
+              claimName: teleport-storage
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add emptyDir for data in AWS mode
+    values:
+      - ../.lint/aws-ha.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: data
+            emptyDir: {}
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add emptyDir for data in GCP mode
+    values:
+      - ../.lint/gcp-ha.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: data
+            emptyDir: {}
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add emptyDir for data in custom mode
+    set:
+      chartMode: custom
+      clusterName: helm-lint.example.com
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: data
+            emptyDir: {}
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set priorityClassName when set in values
+    values:
+      - ../.lint/priority-class-name.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.priorityClassName
+          value: system-cluster-critical
+      - matchSnapshot:
+          path: spec.template.spec
diff --git a/examples/chart/teleport-cluster/tests/pdb_test.yaml b/examples/chart/teleport-cluster/tests/pdb_test.yaml
new file mode 100644
index 0000000000000..b673ce8400ce3
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/pdb_test.yaml
@@ -0,0 +1,13 @@
+suite: PodDisruptionBudget
+templates:
+  - pdb.yaml
+tests:
+  - it: should create a PDB when enabled in values (pdb.yaml)
+    values:
+      - ../.lint/pdb.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: PodDisruptionBudget
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/psp_test.yaml b/examples/chart/teleport-cluster/tests/psp_test.yaml
new file mode 100644
index 0000000000000..0faad123c1dc1
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/psp_test.yaml
@@ -0,0 +1,21 @@
+suite: PodSecurityPolicy
+templates:
+  - psp.yaml
+tests:
+  - it: creates a PodSecurityPolicy when enabled in values
+    set:
+      podSecurityPolicy:
+        enabled: true
+    asserts:
+      - hasDocuments:
+          count: 3
+      - documentIndex: 0
+        isKind:
+          of: PodSecurityPolicy
+      - documentIndex: 1
+        isKind:
+          of: Role
+      - documentIndex: 2
+        isKind:
+          of: RoleBinding
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/pvc_test.yaml b/examples/chart/teleport-cluster/tests/pvc_test.yaml
new file mode 100644
index 0000000000000..9dbdc05448e48
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/pvc_test.yaml
@@ -0,0 +1,65 @@
+suite: PersistentVolumeClaim
+templates:
+  - pvc.yaml
+tests:
+  - it: creates a PersistentVolumeClaim when chartMode=standalone
+    set:
+      chartMode: standalone
+    asserts:
+      - template: pvc.yaml
+        hasDocuments:
+          count: 1
+      - template: pvc.yaml
+        isKind:
+          of: PersistentVolumeClaim
+      - matchSnapshot: {}
+
+  - it: creates a PersistentVolumeClaim with values from standalone-customsize.yaml
+    values:
+      - ../.lint/standalone-customsize.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: PersistentVolumeClaim
+      - equal:
+          path: spec.resources.requests.storage
+          value: 50Gi
+      - matchSnapshot: {}
+
+  - it: does not create a PersistentVolumeClaim when chartMode=standalone and existingClaimName is not blank
+    set:
+      chartMode: standalone
+      standalone:
+        existingClaimName: test-claim
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: does not create a PersistentVolumeClaim with values from standalone-existingpvc.yaml
+    values:
+      - ../.lint/standalone-existingpvc.yaml
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: does not create a PersistentVolumeClaim when chartMode=aws
+    set:
+      chartMode: aws
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: does not create a PersistentVolumeClaim when chartMode=gcp
+    set:
+      chartMode: gcp
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: does not create a PersistentVolumeClaim when chartMode=custom
+    set:
+      chartMode: custom
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/examples/chart/teleport-cluster/tests/service_test.yaml b/examples/chart/teleport-cluster/tests/service_test.yaml
new file mode 100644
index 0000000000000..c8cc66f050182
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/service_test.yaml
@@ -0,0 +1,66 @@
+suite: Service
+templates:
+  - service.yaml
+tests:
+  - it: uses a LoadBalancer by default
+    set:
+      clusterName: teleport.example.com
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Service
+      - equal:
+          path: spec.type
+          value: LoadBalancer
+      - matchSnapshot: {}
+
+  - it: uses a ClusterIP when service.type=ClusterIP
+    set:
+      clusterName: teleport.example.com
+      service:
+        type: ClusterIP
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Service
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - matchSnapshot: {}
+
+  - it: sets AWS annotations when chartMode=aws
+    set:
+      clusterName: teleport.example.com
+      chartMode: aws
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Service
+      - equal:
+          path: spec.type
+          value: LoadBalancer
+      - equal:
+          path: metadata.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-type
+          value: nlb
+      - equal:
+          path: metadata.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-backend-protocol
+          value: tcp
+      - equal:
+          path: metadata.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-cross-zone-load-balancing-enabled
+          value: "true"
+      - matchSnapshot: {}
+
+  - it: sets service annotations when specified
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - equal:
+          path: metadata.annotations.kubernetes\.io/service
+          value: test-annotation
+      - equal:
+          path: metadata.annotations.kubernetes\.io/service-different
+          value: 5
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/serviceaccount_test.yaml b/examples/chart/teleport-cluster/tests/serviceaccount_test.yaml
new file mode 100644
index 0000000000000..ec5d98884a2b5
--- /dev/null
+++ b/examples/chart/teleport-cluster/tests/serviceaccount_test.yaml
@@ -0,0 +1,15 @@
+suite: ServiceAccount
+templates:
+  - serviceaccount.yaml
+tests:
+  - it: sets ServiceAccount annotations when specified
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - equal:
+          path: metadata.annotations.kubernetes\.io/serviceaccount
+          value: test-annotation
+      - equal:
+          path: metadata.annotations.kubernetes\.io/serviceaccount-different
+          value: 6
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/values.schema.json b/examples/chart/teleport-cluster/values.schema.json
index 1aff511629094..a81b67fa3cfe4 100644
--- a/examples/chart/teleport-cluster/values.schema.json
+++ b/examples/chart/teleport-cluster/values.schema.json
@@ -32,6 +32,36 @@
             "type": "string",
             "default": "local"
         },
+        "authenticationSecondFactor": {
+            "$id": "#/properties/authenticationSecondFactor",
+            "type": "object",
+            "required": [],
+            "properties": {
+                "secondFactor": {
+                    "$id": "#/properties/authenticationSecondFactor/properties/secondFactor",
+                    "type": "string",
+                    "enum": ["off", "on", "otp", "optional", "webauthn"],
+                    "default": "otp"
+                },
+                "webauthn": {
+                    "$id": "#/properties/authenticationSecondFactor/properties/webauthn",
+                    "type": "object",
+                    "required": [],
+                    "properties": {
+                        "attestationAllowedCas": {
+                            "$id": "#/properties/authenticationSecondFactor/properties/webauthn/properties/attestationAllowedCas",
+                            "type": "array",
+                            "default": []
+                        },
+                        "attestationDeniedCas": {
+                            "$id": "#/properties/authenticationSecondFactor/properties/webauthn/properties/attestationDeniedCas",
+                            "type": "array",
+                            "default": []
+                        }
+                    }
+                }
+            }
+        },
         "proxyListenerMode": {
             "$id": "#/properties/proxyListenerMode",
             "type": "string",
diff --git a/examples/chart/teleport-cluster/values.yaml b/examples/chart/teleport-cluster/values.yaml
index 841b1cc3e0280..20d09470d065f 100644
--- a/examples/chart/teleport-cluster/values.yaml
+++ b/examples/chart/teleport-cluster/values.yaml
@@ -22,6 +22,9 @@ teleportVersionOverride: ""
 # 'false' is required for FedRAMP / FIPS; see https://gravitational.com/teleport/docs/enterprise/ssh-kubernetes-fedramp/
 authenticationType: local
 
+authenticationSecondFactor:
+  secondFactor: "otp"
+
 # Teleport supports TLS routing. In this mode, all client connections are wrapped in TLS and multiplexed on one Teleport proxy port.
 # Default mode will not utilize TLS routing and operate in backwards-compatibility mode.
 # Possible values are 'multiplex'
diff --git a/examples/chart/teleport-daemonset/README.md b/examples/chart/teleport-daemonset/README.md
index 83d46ae567411..247176c44664a 100644
--- a/examples/chart/teleport-daemonset/README.md
+++ b/examples/chart/teleport-daemonset/README.md
@@ -1,3 +1,8 @@
+# WARNING
+
+This chart is **deprecated** and no longer actively maintained or supported by Teleport.
+We recommend the use of the [teleport-cluster](../teleport-cluster/README.md) chart instead.
+
 # Teleport
 
 [Gravitational Teleport](https://github.com/gravitational/teleport) is a modern SSH/Kubernetes API proxy server for
diff --git a/examples/chart/teleport-kube-agent/.lint/existing-data-volume.yaml b/examples/chart/teleport-kube-agent/.lint/existing-data-volume.yaml
new file mode 100644
index 0000000000000..511aa2f4676ea
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/.lint/existing-data-volume.yaml
@@ -0,0 +1,5 @@
+authToken: auth-token
+proxyAddr: proxy.example.com:3080
+roles: kube
+kubeClusterName: test-kube-cluster
+existingDataVolume: teleport-kube-agent-data
diff --git a/examples/chart/teleport-kube-agent/.lint/extra-args.yaml b/examples/chart/teleport-kube-agent/.lint/extra-args.yaml
new file mode 100644
index 0000000000000..8353439d2484a
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/.lint/extra-args.yaml
@@ -0,0 +1,5 @@
+authToken: auth-token
+proxyAddr: proxy.example.com:3080
+roles: kube
+kubeClusterName: test-kube-cluster
+extraArgs: ['--debug']
diff --git a/examples/chart/teleport-kube-agent/.lint/extra-env.yaml b/examples/chart/teleport-kube-agent/.lint/extra-env.yaml
new file mode 100644
index 0000000000000..7f3ee92e73665
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/.lint/extra-env.yaml
@@ -0,0 +1,7 @@
+authToken: auth-token
+proxyAddr: proxy.example.com:3080
+roles: kube
+kubeClusterName: test-kube-cluster
+extraEnv:
+- name: HTTPS_PROXY
+  value: "http://username:password@my.proxy.host:3128"
diff --git a/examples/chart/teleport-kube-agent/.lint/image-pull-policy-stateful.yaml b/examples/chart/teleport-kube-agent/.lint/image-pull-policy-stateful.yaml
new file mode 100644
index 0000000000000..83995f0c62147
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/.lint/image-pull-policy-stateful.yaml
@@ -0,0 +1,7 @@
+authToken: auth-token
+proxyAddr: proxy.example.com:3080
+kubeClusterName: test-kube-cluster-name
+storage:
+  enabled: true
+  storageClassName: "aws-gp2"
+imagePullPolicy: Always
diff --git a/examples/chart/teleport-kube-agent/.lint/image-pull-policy.yaml b/examples/chart/teleport-kube-agent/.lint/image-pull-policy.yaml
new file mode 100644
index 0000000000000..c5e389ca10a77
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/.lint/image-pull-policy.yaml
@@ -0,0 +1,5 @@
+authToken: auth-token
+proxyAddr: proxy.example.com:3080
+roles: kube
+kubeClusterName: test-kube-cluster
+imagePullPolicy: Always
diff --git a/examples/chart/teleport-kube-agent/.lint/service-account-name.yaml b/examples/chart/teleport-kube-agent/.lint/service-account-name.yaml
new file mode 100644
index 0000000000000..fbc76f97fb727
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/.lint/service-account-name.yaml
@@ -0,0 +1,5 @@
+authToken: auth-token
+proxyAddr: proxy.example.com:3080
+roles: kube
+kubeClusterName: test-kube-cluster
+serviceAccountName: teleport-kube-agent-sa
diff --git a/examples/chart/teleport-kube-agent/.lint/volumes.yaml b/examples/chart/teleport-kube-agent/.lint/volumes.yaml
index 14bdc49390f50..1f55235396f2f 100644
--- a/examples/chart/teleport-kube-agent/.lint/volumes.yaml
+++ b/examples/chart/teleport-kube-agent/.lint/volumes.yaml
@@ -4,7 +4,7 @@ roles: kube
 kubeClusterName: test-kube-cluster
 extraVolumeMounts:
 - name: "my-mount"
-  path: "/path/to/mount"
+  mountPath: "/path/to/mount"
 extraVolumes:
 - name: "my-mount"
   secret:
diff --git a/examples/chart/teleport-kube-agent/README.md b/examples/chart/teleport-kube-agent/README.md
index 74776fc848019..eb89bd447ba1b 100644
--- a/examples/chart/teleport-kube-agent/README.md
+++ b/examples/chart/teleport-kube-agent/README.md
@@ -194,3 +194,7 @@ If the service for a given role doesn't show up, look into the agent logs with:
 ```sh
 $ kubectl logs -n teleport deployment/teleport-kube-agent
 ```
+
+## Contributing to the chart
+
+Please read [CONTRIBUTING.md](../CONTRIBUTING.md) before raising a pull request to this chart.
\ No newline at end of file
diff --git a/examples/chart/teleport-kube-agent/templates/config.yaml b/examples/chart/teleport-kube-agent/templates/config.yaml
index c5aed3dad9ffa..bc7453847097f 100644
--- a/examples/chart/teleport-kube-agent/templates/config.yaml
+++ b/examples/chart/teleport-kube-agent/templates/config.yaml
@@ -1,8 +1,14 @@
 {{- $logLevel := (coalesce .Values.logLevel .Values.log.level "INFO") -}}
+{{- if .Values.teleportVersionOverride -}}
+  {{- $_ := set . "teleportVersion" .Values.teleportVersionOverride -}}
+{{- else -}}
+  {{- $_ := set . "teleportVersion" .Chart.Version -}}
+{{- end -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
   {{- if .Values.annotations.config }}
   annotations:
     {{- toYaml .Values.annotations.config | nindent 4 }}
diff --git a/examples/chart/teleport-kube-agent/templates/deployment.yaml b/examples/chart/teleport-kube-agent/templates/deployment.yaml
index 4223207eeab16..0b6dc0aab2f4c 100644
--- a/examples/chart/teleport-kube-agent/templates/deployment.yaml
+++ b/examples/chart/teleport-kube-agent/templates/deployment.yaml
@@ -3,16 +3,7 @@
 # in the statefulset.yaml file.
 #
 {{- if not .Values.storage.enabled }}
-{{- if .Values.teleportVersionOverride }}
-  {{- $_ := set . "teleportVersion" .Values.teleportVersionOverride }}
-{{- else }}
-  {{- $_ := set . "teleportVersion" .Chart.Version }}
-{{- end }}
-{{- if .Values.replicaCount }}
-  {{- $_ := set . "replicaCount" .Values.replicaCount }}
-{{- else }}
-  {{- $_ := set . "replicaCount" .Values.highAvailability.replicaCount }}
-{{- end }}
+{{- $replicaCount := (coalesce .Values.replicaCount .Values.highAvailability.replicaCount "1") }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -25,7 +16,7 @@ metadata:
     {{- toYaml .Values.annotations.deployment | nindent 4 }}
   {{- end }}
 spec:
-  replicas: {{ .replicaCount }}
+  replicas: {{ $replicaCount }}
   selector:
     matchLabels:
       app: {{ .Release.Name }}
@@ -40,7 +31,7 @@ spec:
       labels:
         app: {{ .Release.Name }}
     spec:
-      {{- if or .Values.affinity (gt (int .replicaCount) 1) }}
+      {{- if or .Values.affinity (gt (int $replicaCount) 1) }}
       affinity:
         {{- if .Values.affinity }}
           {{- if .Values.highAvailability.requireAntiAffinity }}
@@ -58,7 +49,7 @@ spec:
                 values:
                 - {{ .Release.Name }}
             topologyKey: "kubernetes.io/hostname"
-        {{- else if gt (int .replicaCount) 1 }}
+        {{- else if gt (int $replicaCount) 1 }}
           preferredDuringSchedulingIgnoredDuringExecution:
           - weight: 50
             podAffinityTerm:
@@ -114,11 +105,21 @@ spec:
       containers:
       - name: "teleport"
         image: "{{ if .Values.enterprise }}{{ .Values.enterpriseImage }}{{ else }}{{ .Values.image }}{{ end }}:{{ .teleportVersion }}"
+        {{- if .Values.imagePullPolicy }}
+        imagePullPolicy: {{ toYaml .Values.imagePullPolicy }}
+        {{- end }}
+        {{- if .Values.extraEnv }}
+        env:
+          {{- toYaml .Values.extraEnv | nindent 10 }}
+        {{- end }}
         args:
         - "--diag-addr=0.0.0.0:3000"
         {{- if .Values.insecureSkipProxyTLSVerify }}
         - "--insecure"
         {{- end }}
+        {{- if .Values.extraArgs }}
+          {{- toYaml .Values.extraArgs | nindent 8 }}
+        {{- end }}
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
diff --git a/examples/chart/teleport-kube-agent/templates/statefulset.yaml b/examples/chart/teleport-kube-agent/templates/statefulset.yaml
index 88ef070f13a37..2a34bca3b23ce 100644
--- a/examples/chart/teleport-kube-agent/templates/statefulset.yaml
+++ b/examples/chart/teleport-kube-agent/templates/statefulset.yaml
@@ -3,16 +3,7 @@
 # in the deployment.yaml file.
 #
 {{- if .Values.storage.enabled }}
-{{- if .Values.teleportVersionOverride }}
-  {{- $_ := set . "teleportVersion" .Values.teleportVersionOverride }}
-{{- else }}
-  {{- $_ := set . "teleportVersion" .Chart.Version }}
-{{- end }}
-{{- if .Values.replicaCount }}
-  {{- $_ := set . "replicaCount" .Values.replicaCount }}
-{{- else }}
-  {{- $_ := set . "replicaCount" .Values.highAvailability.replicaCount }}
-{{- end }}
+{{- $replicaCount := (coalesce .Values.replicaCount .Values.highAvailability.replicaCount "1") }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -22,7 +13,7 @@ metadata:
     app: {{ .Release.Name }}
 spec:
   serviceName: {{ .Release.Name }}
-  replicas: {{ .replicaCount }}
+  replicas: {{ $replicaCount }}
   selector:
     matchLabels:
       app: {{ .Release.Name }}
@@ -39,7 +30,7 @@ spec:
     spec:
       securityContext:
         fsGroup: 9807
-      {{- if or .Values.affinity (gt (int .replicaCount) 1) }}
+      {{- if or .Values.affinity (gt (int $replicaCount) 1) }}
       affinity:
         {{- if .Values.affinity }}
           {{- if .Values.highAvailability.requireAntiAffinity }}
@@ -57,7 +48,7 @@ spec:
                 values:
                 - {{ .Release.Name }}
             topologyKey: "kubernetes.io/hostname"
-        {{- else if gt (int .replicaCount) 1 }}
+        {{- else if gt (int $replicaCount) 1 }}
           preferredDuringSchedulingIgnoredDuringExecution:
           - weight: 50
             podAffinityTerm:
@@ -110,11 +101,21 @@ spec:
       containers:
       - name: "teleport"
         image: "{{ if .Values.enterprise }}{{ .Values.enterpriseImage }}{{ else }}{{ .Values.image }}{{ end }}:{{ .teleportVersion }}"
+        {{- if .Values.imagePullPolicy }}
+        imagePullPolicy: {{ toYaml .Values.imagePullPolicy }}
+        {{- end }}
+        {{- if .Values.extraEnv }}
+        env:
+          {{- toYaml .Values.extraEnv | nindent 10 }}
+        {{- end }}
         args:
         - "--diag-addr=0.0.0.0:3000"
         {{- if .Values.insecureSkipProxyTLSVerify }}
         - "--insecure"
         {{- end }}
+        {{- if .Values.extraArgs }}
+          {{- toYaml .Values.extraArgs | nindent 8 }}
+        {{- end }}
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
diff --git a/examples/chart/teleport-kube-agent/tests/README.md b/examples/chart/teleport-kube-agent/tests/README.md
new file mode 100644
index 0000000000000..3cd0f8783d4e6
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/README.md
@@ -0,0 +1,18 @@
+## Unit tests for Helm charts
+
+Helm chart unit tests run here using the [helm3-unittest](https://github.com/vbehar/helm3-unittest) Helm plugin.
+
+If you get a snapshot error during your testing, you should verify that your changes intended to alter the output, then run
+this command from the root of your Teleport checkout to update the snapshots:
+
+```bash
+make -C build.assets test-helm-update-snapshots
+```
+
+After this, re-run the tests to make sure everything is fine:
+
+```bash
+make -C build.assets test-helm
+```
+
+Commit the updated snapshots along with your changes.
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrole_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrole_test.yaml.snap
new file mode 100644
index 0000000000000..73d2b30742ace
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrole_test.yaml.snap
@@ -0,0 +1,27 @@
+creates a ClusterRole:
+  1: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRole
+    metadata:
+      name: RELEASE-NAME
+    rules:
+    - apiGroups:
+      - ""
+      resources:
+      - users
+      - groups
+      - serviceaccounts
+      verbs:
+      - impersonate
+    - apiGroups:
+      - ""
+      resources:
+      - pods
+      verbs:
+      - get
+    - apiGroups:
+      - authorization.k8s.io
+      resources:
+      - selfsubjectaccessreviews
+      verbs:
+      - create
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrolebinding_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrolebinding_test.yaml.snap
new file mode 100644
index 0000000000000..408ec5f4556e2
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrolebinding_test.yaml.snap
@@ -0,0 +1,14 @@
+creates a ClusterRoleBinding:
+  1: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    metadata:
+      name: RELEASE-NAME
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: ClusterRole
+      name: RELEASE-NAME
+    subjects:
+    - kind: ServiceAccount
+      name: RELEASE-NAME
+      namespace: NAMESPACE
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
new file mode 100644
index 0000000000000..4c73bbfb71cf9
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
@@ -0,0 +1,658 @@
+does not generate a config for clusterrole.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+does not generate a config for pdb.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot and tests for annotations.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        kubernetes.io/config: test-annotation
+        kubernetes.io/config-different: 2
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for affinity.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for all-v5.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+          labels:
+            cluster: testing
+
+        app_service:
+          enabled: true
+          apps:
+            - labels:
+                environment: test
+              name: grafana
+              uri: http://localhost:3000
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for all-v6.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+          labels:
+            cluster: testing
+
+        app_service:
+          enabled: true
+          apps:
+            - labels:
+                environment: test
+              name: grafana
+              uri: http://localhost:3000
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      annotations:
+        kubernetes.io/config: test-annotation
+        kubernetes.io/config-different: 2
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for aws-databases.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: false
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for backwards-compatibility.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for db.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: false
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for imagepullsecrets.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for initcontainers.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for log-basic.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: json
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for log-extra.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: DEBUG
+            output: /var/lib/teleport/test.log
+            format:
+              output: json
+              extra_fields: ["level","timestamp","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for log-legacy.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: DEBUG
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for node-selector.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for pdb.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: DEBUG
+            output: /var/lib/teleport/test.log
+            format:
+              output: json
+              extra_fields: ["level","timestamp","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for resources.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for stateful.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster-name
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for tolerations.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+matches snapshot for volumes.yaml:
+  1: |
+    apiVersion: v1
+    data:
+      teleport.yaml: |
+        teleport:
+          auth_token: "/etc/teleport-secrets/auth-token"
+          auth_servers: ["proxy.example.com:3080"]
+          log:
+            severity: INFO
+            output: stderr
+            format:
+              output: text
+              extra_fields: ["timestamp","level","component","caller"]
+
+        kubernetes_service:
+          enabled: true
+          kube_cluster_name: test-kube-cluster
+
+        app_service:
+          enabled: false
+
+        auth_service:
+          enabled: false
+        ssh_service:
+          enabled: false
+        proxy_service:
+          enabled: false
+    kind: ConfigMap
+    metadata:
+      name: RELEASE-NAME
+      namespace: NAMESPACE
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
new file mode 100644
index 0000000000000..980b420d739b2
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
@@ -0,0 +1,1346 @@
+sets Deployment annotations when specified:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+sets Pod annotations when specified:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should add emptyDir for data when existingDataVolume is not set:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should add insecureSkipProxyTLSVerify to args when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      - --insecure
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should correctly configure existingDataVolume when set:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: teleport-kube-agent-data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should expose diag port:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should have multiple replicas when replicaCount is set (using .replicaCount, deprecated):
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should have multiple replicas when replicaCount is set (using highAvailability.replicaCount):
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should have one replica when replicaCount is not set:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should mount extraVolumes and extraVolumeMounts:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+      - mountPath: /path/to/mount
+        name: my-mount
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+    - name: my-mount
+      secret:
+        secretName: mySecret
+should provision initContainer correctly when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    initContainers:
+    - args:
+      - echo test
+      image: alpine
+      name: teleport-init
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set SecurityContext:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set affinity when set in values:
+  1: |
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+          - matchExpressions:
+            - key: gravitational.io/dedicated
+              operator: In
+              values:
+              - teleport
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - teleport
+            topologyKey: kubernetes.io/hostname
+          weight: 1
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set default serviceAccountName when not set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set environment when extraEnv set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      env:
+      - name: HTTPS_PROXY
+        value: http://username:password@my.proxy.host:3128
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set image and tag correctly:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:8.3.4
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set imagePullPolicy when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: Always
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set nodeSelector if set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    nodeSelector:
+      gravitational.io/k8s-role: node
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set preferred affinity when more than one replica is used:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set required affinity when highAvailability.requireAntiAffinity is set:
+  1: |
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchExpressions:
+            - key: app
+              operator: In
+              values:
+              - RELEASE-NAME
+          topologyKey: kubernetes.io/hostname
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set resources when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set serviceAccountName when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: teleport-kube-agent-sa
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
+should set tolerations when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /healthz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: data
+    serviceAccountName: RELEASE-NAME
+    tolerations:
+    - effect: NoExecute
+      key: dedicated
+      operator: Equal
+      value: teleport
+    - effect: NoSchedule
+      key: dedicated
+      operator: Equal
+      value: teleport
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - emptyDir: {}
+      name: data
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/pdb_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/pdb_test.yaml.snap
new file mode 100644
index 0000000000000..a8d3bf87b8092
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/pdb_test.yaml.snap
@@ -0,0 +1,14 @@
+should create a PDB when enabled in values (pdb.yaml):
+  1: |
+    apiVersion: policy/v1beta1
+    kind: PodDisruptionBudget
+    metadata:
+      labels:
+        app: RELEASE-NAME
+      name: RELEASE-NAME
+      namespace: NAMESPACE
+    spec:
+      minAvailable: 2
+      selector:
+        matchLabels:
+          app: RELEASE-NAME
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/psp_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/psp_test.yaml.snap
new file mode 100644
index 0000000000000..5536920844cf3
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/psp_test.yaml.snap
@@ -0,0 +1,34 @@
+creates a PodSecurityPolicy when enabled in values:
+  1: |
+    apiVersion: policy/v1beta1
+    kind: PodSecurityPolicy
+    metadata:
+      annotations:
+        seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
+        seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
+      name: RELEASE-NAME
+    spec:
+      allowPrivilegeEscalation: false
+      fsGroup:
+        ranges:
+        - max: 65535
+          min: 1
+        rule: MustRunAs
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      privileged: false
+      readOnlyRootFilesystem: true
+      requiredDropCapabilities:
+      - ALL
+      runAsUser:
+        rule: MustRunAsNonRoot
+      seLinux:
+        rule: RunAsAny
+      supplementalGroups:
+        ranges:
+        - max: 65535
+          min: 1
+        rule: MustRunAs
+      volumes:
+      - '*'
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/secret_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/secret_test.yaml.snap
new file mode 100644
index 0000000000000..a1176d268f494
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/secret_test.yaml.snap
@@ -0,0 +1,22 @@
+generates a secret when authToken is provided:
+  1: |
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: teleport-kube-agent-join-token
+      namespace: NAMESPACE
+    stringData:
+      auth-token: |
+        sample-auth-token-dont-use-this
+    type: Opaque
+generates a secret with a custom name when authToken and secretName are provided:
+  1: |
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: some-other-secret-name
+      namespace: NAMESPACE
+    stringData:
+      auth-token: |
+        sample-auth-token-dont-use-this
+    type: Opaque
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/serviceaccount_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/serviceaccount_test.yaml.snap
new file mode 100644
index 0000000000000..fa132fe5d7c65
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/serviceaccount_test.yaml.snap
@@ -0,0 +1,10 @@
+sets ServiceAccount annotations when specified:
+  1: |
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      annotations:
+        kubernetes.io/serviceaccount: test-annotation
+        kubernetes.io/serviceaccount-different: 5
+      name: RELEASE-NAME
+      namespace: NAMESPACE
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
new file mode 100644
index 0000000000000..c824d810abfa9
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
@@ -0,0 +1,1454 @@
+sets Pod annotations when specified:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should add insecureSkipProxyTLSVerify to args when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      - --insecure
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should add volumeClaimTemplate for data volume when using StatefulSet:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should add volumeMount for data volume when using StatefulSet:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should expose diag port:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should have multiple replicas when replicaCount is set (using .replicaCount, deprecated):
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should have multiple replicas when replicaCount is set (using highAvailability.replicaCount):
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should have one replica when replicaCount is not set:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should mount extraVolumes and extraVolumeMounts:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+      - mountPath: /path/to/mount
+        name: my-mount
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+    - name: my-mount
+      secret:
+        secretName: mySecret
+should not add emptyDir for data when using StatefulSet:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should provision initContainer correctly when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    initContainers:
+    - args:
+      - echo test
+      image: alpine
+      name: teleport-init
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set SecurityContext:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set affinity when set in values:
+  1: |
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+          - matchExpressions:
+            - key: gravitational.io/dedicated
+              operator: In
+              values:
+              - teleport
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - teleport
+            topologyKey: kubernetes.io/hostname
+          weight: 1
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set default serviceAccountName when not set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set environment when extraEnv set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      env:
+      - name: HTTPS_PROXY
+        value: http://username:password@my.proxy.host:3128
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set image and tag correctly:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:8.3.4
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set imagePullPolicy when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: Always
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set nodeSelector if set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    nodeSelector:
+      gravitational.io/k8s-role: node
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set preferred affinity when more than one replica is used:
+  1: |
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - RELEASE-NAME
+            topologyKey: kubernetes.io/hostname
+          weight: 50
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set required affinity when highAvailability.requireAntiAffinity is set:
+  1: |
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchExpressions:
+            - key: app
+              operator: In
+              values:
+              - RELEASE-NAME
+          topologyKey: kubernetes.io/hostname
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set resources when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      resources:
+        limits:
+          cpu: 2
+          memory: 4Gi
+        requests:
+          cpu: 1
+          memory: 2Gi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set serviceAccountName when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: teleport-kube-agent-sa
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set storage.requests when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set storage.storageClassName when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
+should set tolerations when set in values:
+  1: |
+    containers:
+    - args:
+      - --diag-addr=0.0.0.0:3000
+      image: quay.io/gravitational/teleport:10.0.0-dev
+      imagePullPolicy: IfNotPresent
+      livenessProbe:
+        failureThreshold: 6
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      name: teleport
+      ports:
+      - containerPort: 3000
+        name: diag
+        protocol: TCP
+      readinessProbe:
+        failureThreshold: 12
+        httpGet:
+          path: /readyz
+          port: diag
+        initialDelaySeconds: 5
+        periodSeconds: 5
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - all
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 9807
+      volumeMounts:
+      - mountPath: /etc/teleport
+        name: config
+        readOnly: true
+      - mountPath: /etc/teleport-secrets
+        name: auth-token
+        readOnly: true
+      - mountPath: /var/lib/teleport
+        name: RELEASE-NAME-teleport-data
+    securityContext:
+      fsGroup: 9807
+    serviceAccountName: RELEASE-NAME
+    tolerations:
+    - effect: NoExecute
+      key: dedicated
+      operator: Equal
+      value: teleport
+    - effect: NoSchedule
+      key: dedicated
+      operator: Equal
+      value: teleport
+    volumes:
+    - configMap:
+        name: RELEASE-NAME
+      name: config
+    - name: auth-token
+      secret:
+        secretName: teleport-kube-agent-join-token
diff --git a/examples/chart/teleport-kube-agent/tests/clusterrole_test.yaml b/examples/chart/teleport-kube-agent/tests/clusterrole_test.yaml
new file mode 100644
index 0000000000000..337947d13ad2b
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/clusterrole_test.yaml
@@ -0,0 +1,11 @@
+suite: ClusterRole
+templates:
+  - clusterrole.yaml
+tests:
+  - it: creates a ClusterRole
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ClusterRole
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/clusterrolebinding_test.yaml b/examples/chart/teleport-kube-agent/tests/clusterrolebinding_test.yaml
new file mode 100644
index 0000000000000..b8f30d8cf4fc2
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/clusterrolebinding_test.yaml
@@ -0,0 +1,11 @@
+suite: ClusterRoleBinding
+templates:
+  - clusterrolebinding.yaml
+tests:
+  - it: creates a ClusterRoleBinding
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ClusterRoleBinding
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/config_test.yaml b/examples/chart/teleport-kube-agent/tests/config_test.yaml
new file mode 100644
index 0000000000000..b3115d6b31352
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/config_test.yaml
@@ -0,0 +1,209 @@
+suite: ConfigMap
+templates:
+  - config.yaml
+tests:
+  - it: matches snapshot for affinity.yaml
+    values:
+      - ../.lint/affinity.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for all-v5.yaml
+    values:
+      - ../.lint/all-v5.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for all-v6.yaml
+    values:
+      - ../.lint/all-v6.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot and tests for annotations.yaml
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - equal:
+          path: metadata.annotations.kubernetes\.io/config
+          value: test-annotation
+      - equal:
+          path: metadata.annotations.kubernetes\.io/config-different
+          value: 2
+      - matchSnapshot: {}
+
+  - it: matches snapshot for aws-databases.yaml
+    values:
+      - ../.lint/aws-databases.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for backwards-compatibility.yaml
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: does not generate a config for clusterrole.yaml
+    values:
+      - ../.lint/clusterrole.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for db.yaml
+    values:
+      - ../.lint/db.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for imagepullsecrets.yaml
+    values:
+      - ../.lint/imagepullsecrets.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for initcontainers.yaml
+    values:
+      - ../.lint/initcontainers.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for log-basic.yaml
+    values:
+      - ../.lint/log-basic.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for log-extra.yaml
+    values:
+      - ../.lint/log-extra.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for log-legacy.yaml
+    values:
+      - ../.lint/log-legacy.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for node-selector.yaml
+    values:
+      - ../.lint/node-selector.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for pdb.yaml
+    values:
+      - ../.lint/log-extra.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: does not generate a config for pdb.yaml
+    values:
+      - ../.lint/pdb.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for resources.yaml
+    values:
+      - ../.lint/resources.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for stateful.yaml
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for tolerations.yaml
+    values:
+      - ../.lint/tolerations.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
+
+  - it: matches snapshot for volumes.yaml
+    values:
+      - ../.lint/volumes.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/deployment_test.yaml b/examples/chart/teleport-kube-agent/tests/deployment_test.yaml
new file mode 100644
index 0000000000000..0e3011e5950cb
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/deployment_test.yaml
@@ -0,0 +1,349 @@
+suite: Deployment
+templates:
+  - deployment.yaml
+  - config.yaml
+tests:
+  - it: creates a Deployment
+    values:
+      - ../.lint/all-v6.yaml
+    asserts:
+      - isKind:
+          of: Deployment
+      - hasDocuments:
+          count: 1
+
+  - it: sets Deployment annotations when specified
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - equal:
+          path: metadata.annotations.kubernetes\.io/deployment
+          value: test-annotation
+      - equal:
+          path: metadata.annotations.kubernetes\.io/deployment-different
+          value: 3
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: sets Pod annotations when specified
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.kubernetes\.io/pod
+          value: test-annotation
+      - equal:
+          path: spec.template.metadata.annotations.kubernetes\.io/pod-different
+          value: 4
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should have one replica when replicaCount is not set
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 1
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should have multiple replicas when replicaCount is set (using .replicaCount, deprecated)
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      replicaCount: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should have multiple replicas when replicaCount is set (using highAvailability.replicaCount)
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      highAvailability:
+        replicaCount: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set affinity when set in values
+    values:
+      - ../.lint/affinity.yaml
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.affinity
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set required affinity when highAvailability.requireAntiAffinity is set
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      highAvailability:
+        replicaCount: 2
+        requireAntiAffinity: true
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.affinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
+      - isNull:
+          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set preferred affinity when more than one replica is used
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      highAvailability:
+        replicaCount: 3
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.affinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution
+      - isNull:
+          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set tolerations when set in values
+    values:
+      - ../.lint/tolerations.yaml
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.tolerations
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set resources when set in values
+    values:
+      - ../.lint/resources.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 2
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.memory
+          value: 4Gi
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.cpu
+          value: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.memory
+          value: 2Gi
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set SecurityContext
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.capabilities
+          value:
+            drop:
+              - all
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.runAsUser
+          value: 9807
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set image and tag correctly
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      teleportVersionOverride: 8.3.4
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: quay.io/gravitational/teleport:8.3.4
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount extraVolumes and extraVolumeMounts
+    values:
+      - ../.lint/volumes.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /path/to/mount
+            name: my-mount
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: my-mount
+            secret:
+              secretName: mySecret
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set imagePullPolicy when set in values
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      imagePullPolicy: Always
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set environment when extraEnv set in values
+    set:
+      proxyAddr: helm-lint.example.com
+      authToken: sample-auth-token-dont-use-this
+      kubeClusterName: helm-lint.example.com
+      extraEnv:
+        - name: HTTPS_PROXY
+          value: "http://username:password@my.proxy.host:3128"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: HTTPS_PROXY
+            value: "http://username:password@my.proxy.host:3128"
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should provision initContainer correctly when set in values
+    values:
+      - ../.lint/initcontainers.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[0].args
+          content: "echo test"
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: "teleport-init"
+      - equal:
+          path: spec.template.spec.initContainers[0].image
+          value: "alpine"
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.limits.cpu
+          value: 2
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.limits.memory
+          value: 4Gi
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.requests.cpu
+          value: 1
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.requests.memory
+          value: 2Gi
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add insecureSkipProxyTLSVerify to args when set in values
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    set:
+      insecureSkipProxyTLSVerify: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--insecure"
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should expose diag port
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            name: diag
+            containerPort: 3000
+            protocol: TCP
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set nodeSelector if set in values
+    values:
+      - ../.lint/node-selector.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            gravitational.io/k8s-role: node
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add emptyDir for data when existingDataVolume is not set
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: data
+            emptyDir: {}
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /var/lib/teleport
+            name: data
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should correctly configure existingDataVolume when set
+    values:
+      - ../.lint/existing-data-volume.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: data
+            emptyDir: {}
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /var/lib/teleport
+            name: teleport-kube-agent-data
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set serviceAccountName when set in values
+    values:
+      - ../.lint/service-account-name.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: teleport-kube-agent-sa
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set default serviceAccountName when not set in values
+    values:
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: RELEASE-NAME
+      - matchSnapshot:
+          path: spec.template.spec
diff --git a/examples/chart/teleport-kube-agent/tests/pdb_test.yaml b/examples/chart/teleport-kube-agent/tests/pdb_test.yaml
new file mode 100644
index 0000000000000..b673ce8400ce3
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/pdb_test.yaml
@@ -0,0 +1,13 @@
+suite: PodDisruptionBudget
+templates:
+  - pdb.yaml
+tests:
+  - it: should create a PDB when enabled in values (pdb.yaml)
+    values:
+      - ../.lint/pdb.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: PodDisruptionBudget
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/psp_test.yaml b/examples/chart/teleport-kube-agent/tests/psp_test.yaml
new file mode 100644
index 0000000000000..0faad123c1dc1
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/psp_test.yaml
@@ -0,0 +1,21 @@
+suite: PodSecurityPolicy
+templates:
+  - psp.yaml
+tests:
+  - it: creates a PodSecurityPolicy when enabled in values
+    set:
+      podSecurityPolicy:
+        enabled: true
+    asserts:
+      - hasDocuments:
+          count: 3
+      - documentIndex: 0
+        isKind:
+          of: PodSecurityPolicy
+      - documentIndex: 1
+        isKind:
+          of: Role
+      - documentIndex: 2
+        isKind:
+          of: RoleBinding
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/secret_test.yaml b/examples/chart/teleport-kube-agent/tests/secret_test.yaml
new file mode 100644
index 0000000000000..d2d7963b8e213
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/secret_test.yaml
@@ -0,0 +1,30 @@
+suite: Secret
+templates:
+  - secret.yaml
+tests:
+  - it: generates a secret when authToken is provided
+    set:
+      authToken: sample-auth-token-dont-use-this
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: teleport-kube-agent-join-token
+      - matchSnapshot: {}
+
+  - it: generates a secret with a custom name when authToken and secretName are provided
+    set:
+      authToken: sample-auth-token-dont-use-this
+      secretName: some-other-secret-name
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: some-other-secret-name
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/serviceaccount_test.yaml b/examples/chart/teleport-kube-agent/tests/serviceaccount_test.yaml
new file mode 100644
index 0000000000000..fe5d1ebede622
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/serviceaccount_test.yaml
@@ -0,0 +1,15 @@
+suite: ServiceAccount
+templates:
+  - serviceaccount.yaml
+tests:
+  - it: sets ServiceAccount annotations when specified
+    values:
+      - ../.lint/annotations.yaml
+    asserts:
+      - equal:
+          path: metadata.annotations.kubernetes\.io/serviceaccount
+          value: test-annotation
+      - equal:
+          path: metadata.annotations.kubernetes\.io/serviceaccount-different
+          value: 5
+      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml b/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
new file mode 100644
index 0000000000000..6da67d49eebb7
--- /dev/null
+++ b/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
@@ -0,0 +1,369 @@
+suite: StatefulSet
+templates:
+  - statefulset.yaml
+  - config.yaml
+tests:
+  - it: creates a StatefulSet
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - isKind:
+          of: StatefulSet
+      - hasDocuments:
+          count: 1
+
+  - it: sets Pod annotations when specified
+    values:
+      - ../.lint/annotations.yaml
+      - ../.lint/stateful.yaml
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.kubernetes\.io/pod
+          value: test-annotation
+      - equal:
+          path: spec.template.metadata.annotations.kubernetes\.io/pod-different
+          value: 4
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should have one replica when replicaCount is not set
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 1
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should have multiple replicas when replicaCount is set (using .replicaCount, deprecated)
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      replicaCount: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should have multiple replicas when replicaCount is set (using highAvailability.replicaCount)
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      highAvailability:
+        replicaCount: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set affinity when set in values
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/affinity.yaml
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.affinity
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set required affinity when highAvailability.requireAntiAffinity is set
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      highAvailability:
+        replicaCount: 2
+        requireAntiAffinity: true
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.affinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
+      - isNull:
+          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set preferred affinity when more than one replica is used
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      highAvailability:
+        replicaCount: 3
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.affinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity
+      - isNotNull:
+          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution
+      - isNull:
+          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set tolerations when set in values
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/tolerations.yaml
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.tolerations
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set resources when set in values
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/resources.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 2
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.memory
+          value: 4Gi
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.cpu
+          value: 1
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.memory
+          value: 2Gi
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set SecurityContext
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
+          value: false
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.capabilities
+          value:
+            drop:
+              - all
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.runAsNonRoot
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.runAsUser
+          value: 9807
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set image and tag correctly
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      teleportVersionOverride: 8.3.4
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: quay.io/gravitational/teleport:8.3.4
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should mount extraVolumes and extraVolumeMounts
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/volumes.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /path/to/mount
+            name: my-mount
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: my-mount
+            secret:
+              secretName: mySecret
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set imagePullPolicy when set in values
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      imagePullPolicy: Always
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set environment when extraEnv set in values
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      extraEnv:
+        - name: HTTPS_PROXY
+          value: "http://username:password@my.proxy.host:3128"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: HTTPS_PROXY
+            value: "http://username:password@my.proxy.host:3128"
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should provision initContainer correctly when set in values
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/initcontainers.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[0].args
+          content: "echo test"
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: "teleport-init"
+      - equal:
+          path: spec.template.spec.initContainers[0].image
+          value: "alpine"
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.limits.cpu
+          value: 2
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.limits.memory
+          value: 4Gi
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.requests.cpu
+          value: 1
+      - equal:
+          path: spec.template.spec.initContainers[0].resources.requests.memory
+          value: 2Gi
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add insecureSkipProxyTLSVerify to args when set in values
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      insecureSkipProxyTLSVerify: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--insecure"
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should expose diag port
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            name: diag
+            containerPort: 3000
+            protocol: TCP
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set nodeSelector if set in values
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/node-selector.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector
+          value:
+            gravitational.io/k8s-role: node
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should not add emptyDir for data when using StatefulSet
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: data
+            emptyDir: {}
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add volumeMount for data volume when using StatefulSet
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: data
+            mountPath: RELEASE-NAME-teleport-data
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should add volumeClaimTemplate for data volume when using StatefulSet
+    values:
+      - ../.lint/stateful.yaml
+    asserts:
+      - isNotNull:
+          path: spec.volumeClaimTemplates[0].spec
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set storage.storageClassName when set in values
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      storage:
+        storageClassName: helm-lint-storage-class
+    asserts:
+      - equal:
+          path: spec.volumeClaimTemplates[0].spec.storageClassName
+          value: helm-lint-storage-class
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set storage.requests when set in values
+    values:
+      - ../.lint/stateful.yaml
+    set:
+      storage:
+        requests: 256Mi
+    asserts:
+      - equal:
+          path: spec.volumeClaimTemplates[0].spec.resources.requests.storage
+          value: 256Mi
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set serviceAccountName when set in values
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/service-account-name.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: teleport-kube-agent-sa
+      - matchSnapshot:
+          path: spec.template.spec
+
+  - it: should set default serviceAccountName when not set in values
+    values:
+      - ../.lint/stateful.yaml
+      - ../.lint/backwards-compatibility.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: RELEASE-NAME
+      - matchSnapshot:
+          path: spec.template.spec
diff --git a/examples/chart/teleport-kube-agent/values.schema.json b/examples/chart/teleport-kube-agent/values.schema.json
index 46aa080fa3e49..acda282522d5a 100644
--- a/examples/chart/teleport-kube-agent/values.schema.json
+++ b/examples/chart/teleport-kube-agent/values.schema.json
@@ -284,6 +284,16 @@
                 }
             }
         },
+        "extraArgs": {
+            "$id": "#/properties/extraArgs",
+            "type": "array",
+            "default": []
+        },
+        "extraEnv": {
+            "$id": "#/properties/extraEnv",
+            "type": "array",
+            "default": []
+        },
         "extraVolumes": {
             "$id": "#/properties/extraVolumes",
             "type": "array",
diff --git a/examples/chart/teleport-kube-agent/values.yaml b/examples/chart/teleport-kube-agent/values.yaml
index 069258679072b..2e404f0a33ded 100644
--- a/examples/chart/teleport-kube-agent/values.yaml
+++ b/examples/chart/teleport-kube-agent/values.yaml
@@ -51,6 +51,8 @@ awsDatabases: []
 #  - name: aurora
 #    uri: "postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432"
 #    protocol: "postgres"
+#    static_labels:
+#      env: "prod"
 databases: []
 
 ################################################################
@@ -65,6 +67,7 @@ insecureSkipProxyTLSVerify: false
 
 # If set, will use an existing volume mounted via extraVolumes
 # as the Teleport data directory.
+# If anything is set under the "storage" key, this will be ignored.
 existingDataVolume: ""
 
 # If true, create & use Pod Security Policy resources
@@ -176,6 +179,12 @@ annotations:
   # Annotations for the ServiceAccount object
   serviceAccount: {}
 
+# Extra arguments to pass to 'teleport start' for the main Teleport pod
+extraArgs: []
+
+# Extra environment to be configured on the Teleport pod
+extraEnv: []
+
 # Extra volumes to mount into the Teleport pods
 # https://kubernetes.io/docs/concepts/storage/volumes/
 extraVolumes: []
diff --git a/examples/chart/teleport/.helmignore b/examples/chart/teleport/.helmignore
index 2a1a7a2420771..59ffd343fe67c 100644
--- a/examples/chart/teleport/.helmignore
+++ b/examples/chart/teleport/.helmignore
@@ -2,3 +2,4 @@
 *.pem
 scripts
 pki
+tests
\ No newline at end of file
diff --git a/examples/chart/teleport/README.md b/examples/chart/teleport/README.md
index d5d3bad3b9eec..9c3273927bf9d 100644
--- a/examples/chart/teleport/README.md
+++ b/examples/chart/teleport/README.md
@@ -1,3 +1,8 @@
+# WARNING
+
+This chart is **deprecated** and no longer actively maintained or supported by Teleport.
+We recommend the use of the [teleport-cluster](../teleport-cluster/README.md) chart instead.
+
 # Teleport
 
 [Gravitational Teleport](https://github.com/gravitational/teleport) is a modern SSH/Kubernetes API proxy server for remotely accessing clusters of Linux containers and servers via SSH, HTTPS, or Kubernetes API.  Community and Enterprise versions of Teleport are available.  You can start with the Community edition with this Chart and in the future update to an Enterprise version for the same deployment.
diff --git a/examples/resources/plugins/teleport-jira-cloud.toml b/examples/resources/plugins/teleport-jira-cloud.toml
new file mode 100644
index 0000000000000..d8b6cde9b242c
--- /dev/null
+++ b/examples/resources/plugins/teleport-jira-cloud.toml
@@ -0,0 +1,20 @@
+# example jira plugin configuration TOML file
+[teleport]
+auth_server = "myinstance.teleport.sh:443"             # Teleport Cloud proxy HTTPS address
+identity = "/var/lib/teleport/plugins/jira/auth.pem"   # Teleport identity file location
+
+[jira]
+url = "https://example.com/jira"    # JIRA URL. For JIRA Cloud, https://[my-jira].atlassian.net
+username = "bot@example.com"        # JIRA username
+api_token = "token"                 # JIRA API Basic Auth token
+project = "MYPROJ"                  # JIRA Project key
+
+[http]
+# listen_addr = ":8081" # Network address in format [addr]:port on which webhook server listens, e.g. 0.0.0.0:443
+# public_addr = "example.com" # URL on which webhook server is accessible externally, e.g. [https://]teleport-jira.example.com
+https_key_file = "/var/lib/teleport/plugins/jira/server.key"  # TLS private key
+https_cert_file = "/var/lib/teleport/plugins/jira/server.crt" # TLS certificate
+
+[log]
+output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/jira.log"
+severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
\ No newline at end of file
diff --git a/examples/resources/plugins/teleport-jira.toml b/examples/resources/plugins/teleport-jira-self-hosted.toml
similarity index 100%
rename from examples/resources/plugins/teleport-jira.toml
rename to examples/resources/plugins/teleport-jira-self-hosted.toml
diff --git a/examples/resources/plugins/teleport-mattermost-cloud.toml b/examples/resources/plugins/teleport-mattermost-cloud.toml
new file mode 100644
index 0000000000000..e341be450afd5
--- /dev/null
+++ b/examples/resources/plugins/teleport-mattermost-cloud.toml
@@ -0,0 +1,21 @@
+# example mattermost configuration TOML file
+[teleport]
+auth_server = "myinstance.teleport.sh:443"                   # Teleport Cloud proxy HTTPS address
+identity = "/var/lib/teleport/plugins/mattermost/auth.pem"   # Identity file path
+
+[mattermost]
+url = "https://mattermost.example.com" # Mattermost Server URL
+team = "team-name"                     # Mattermsot team in which the channel resides.
+channel = "channel-name"               # Mattermost Channel name to post requests to
+token = "api-token"                    # Mattermost Bot OAuth token
+secret = "signing-secret-value"        # Mattermost API signing Secret
+
+[http]
+public_addr = "example.com" # URL on which callback server is accessible externally, e.g. [https://]teleport-mattermost.example.com
+# listen_addr = ":8081" # Network address in format [addr]:port on which callback server listens, e.g. 0.0.0.0:443
+https_key_file = "/var/lib/teleport/plugins/mattermost/server.key"  # TLS private key
+https_cert_file = "/var/lib/teleport/plugins/mattermost/server.crt" # TLS certificate
+
+[log]
+output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/mattermost.log"
+severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
diff --git a/examples/resources/plugins/teleport-mattermost.toml b/examples/resources/plugins/teleport-mattermost-self.toml
similarity index 100%
rename from examples/resources/plugins/teleport-mattermost.toml
rename to examples/resources/plugins/teleport-mattermost-self.toml
diff --git a/examples/resources/plugins/teleport-pagerduty-cloud.toml b/examples/resources/plugins/teleport-pagerduty-cloud.toml
new file mode 100644
index 0000000000000..1331624d4140a
--- /dev/null
+++ b/examples/resources/plugins/teleport-pagerduty-cloud.toml
@@ -0,0 +1,26 @@
+# example teleport-pagerduty configuration TOML file
+[teleport]
+auth_server = "myinstance.teleport.sh:443"                  # Teleport Cloud proxy HTTPS address
+identity = "/var/lib/teleport/plugins/pagerduty/auth.pem"   # Identity file path
+
+[pagerduty]
+api_key = "key"               # PagerDuty API Key
+user_email = "me@example.com" # PagerDuty bot user email (Could be admin email)
+service_id = "PIJ90N7"        # PagerDuty service id
+
+[http]
+public_addr = "example.com" # URL on which callback server is accessible externally, e.g. [https://]teleport-pagerduty.example.com
+# listen_addr = ":8081" # Network address in format [addr]:port on which callback server listens, e.g. 0.0.0.0:443
+https_key_file = "/var/lib/teleport/plugins/pagerduty/server.key"  # TLS private key
+https_cert_file = "/var/lib/teleport/plugins/pagerduty/server.crt" # TLS certificate
+
+[http.tls]
+verify_client_cert = true # The preferred way to authenticate webhooks on Pagerduty. See more: https://developer.pagerduty.com/docs/webhooks/webhooks-mutual-tls
+
+[http.basic_auth]
+user = "user"
+password = "password" # If you prefer to use basic auth for Pagerduty Webhooks authentication, use this section to store user and password
+
+[log]
+output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/pagerduty.log"
+severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
\ No newline at end of file
diff --git a/examples/resources/plugins/teleport-pagerduty.toml b/examples/resources/plugins/teleport-pagerduty-self.toml
similarity index 100%
rename from examples/resources/plugins/teleport-pagerduty.toml
rename to examples/resources/plugins/teleport-pagerduty-self.toml
diff --git a/examples/resources/terraform/terraform-user-role-cloud.tf b/examples/resources/terraform/terraform-user-role-cloud.tf
new file mode 100644
index 0000000000000..cec5b0e38ce74
--- /dev/null
+++ b/examples/resources/terraform/terraform-user-role-cloud.tf
@@ -0,0 +1,79 @@
+terraform {
+  required_providers {
+    teleport = {
+      version = ">= (=teleport.version=)"
+      source  = "gravitational.com/teleport/teleport"
+    }
+  }
+}
+
+provider "teleport" {
+  # Update addr to point to your Teleport Cloud tenant URL
+  addr               = "mytenant.teleport.sh"
+  identity_file_path = "terraform-identity"
+}
+
+resource "teleport_role" "terraform-test" {
+  metadata {
+    name        = "terraform-test"
+    description = "Terraform test role"
+    labels = {
+      example  = "yes"
+    }
+  }
+  
+  spec {
+    options {
+      forward_agent           = false
+      max_session_ttl         = "30m"
+      port_forwarding         = false
+      client_idle_timeout     = "1h"
+      disconnect_expired_cert = true
+      permit_x11_forwarding    = false
+      request_access          = "denied"
+    }
+
+    allow {
+      logins = ["this-user-does-not-exist"]
+
+      rules {
+        resources = ["user", "role"]
+        verbs = ["list"]
+      }
+
+      request {
+        roles = ["example"]
+        claims_to_roles {
+          claim = "example"
+          value = "example"
+          roles = ["example"]
+        }
+      }
+
+      node_labels {
+         key = "example"
+         value = ["yes"]
+      }
+    }
+
+    deny {
+      logins = ["anonymous"]
+    }
+  }
+}
+
+resource "teleport_user" "terraform-test" {
+  metadata {
+    name        = "terraform-test"
+    description = "Test terraform user"
+    expires     = "2022-10-12T07:20:50.52Z"
+
+    labels = {
+      test      = "true"
+    }
+  }
+
+  spec {
+    roles = ["terraform-test"]
+  }
+}
diff --git a/examples/resources/terraform/terraform-user-role.tf b/examples/resources/terraform/terraform-user-role-self-hosted.tf
similarity index 93%
rename from examples/resources/terraform/terraform-user-role.tf
rename to examples/resources/terraform/terraform-user-role-self-hosted.tf
index ac8204e31e550..893f977ca352d 100644
--- a/examples/resources/terraform/terraform-user-role.tf
+++ b/examples/resources/terraform/terraform-user-role-self-hosted.tf
@@ -11,7 +11,9 @@ provider "teleport" {
   # Update addr to point to Teleport Auth/Proxy
   # addr               = "auth.example.com:3025"
   addr               = "proxy.example.com:443"
-  identity_file_path = "terraform-identity"
+  cert_path          = "auth.crt"
+  key_path           = "auth.key"
+  root_ca_path       = "auth.cas"
 }
 
 resource "teleport_role" "terraform-test" {
diff --git a/go.mod b/go.mod
index 7958409373ff5..12bffeab8bc36 100644
--- a/go.mod
+++ b/go.mod
@@ -15,7 +15,7 @@ require (
 	github.com/alicebob/miniredis/v2 v2.17.0
 	github.com/aquasecurity/libbpfgo v0.1.0
 	github.com/armon/go-radix v1.0.0
-	github.com/aws/aws-sdk-go v1.37.17
+	github.com/aws/aws-sdk-go v1.43.15
 	github.com/aws/aws-sdk-go-v2 v1.9.0
 	github.com/aws/aws-sdk-go-v2/config v1.8.0
 	github.com/aws/aws-sdk-go-v2/credentials v1.4.0
@@ -62,9 +62,11 @@ require (
 	github.com/jcmturner/gokrb5/v8 v8.4.2
 	github.com/johannesboyne/gofakes3 v0.0.0-20210217223559-02ffa763be97
 	github.com/jonboulle/clockwork v0.2.2
+	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531
 	github.com/json-iterator/go v1.1.12
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0
+	github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27
 	github.com/kr/pretty v0.3.0
 	github.com/kr/pty v1.1.8
 	github.com/kylelemons/godebug v1.1.0
@@ -189,6 +191,7 @@ require (
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d // indirect
 	github.com/klauspost/compress v1.9.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
@@ -265,6 +268,8 @@ replace (
 	github.com/go-redis/redis/v8 => github.com/gravitational/redis/v8 v8.11.5-0.20220211010318-7af711b76a91
 	github.com/gogo/protobuf => github.com/gravitational/protobuf v1.3.2-0.20201123192827-2b9fcfaffcbf
 	github.com/gravitational/teleport/api => ./api
-	github.com/siddontang/go-mysql v1.1.0 => github.com/gravitational/go-mysql v1.1.1-teleport.1
+	github.com/russellhaering/gosaml2 => github.com/gravitational/gosaml2 v0.0.0-20220318224559-f06932032ae2
+	github.com/siddontang/go-mysql v1.1.0 => github.com/gravitational/go-mysql v1.1.1-teleport.2
 	github.com/sirupsen/logrus => github.com/gravitational/logrus v1.4.4-0.20210817004754-047e20245621
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.2.1
 )
diff --git a/go.sum b/go.sum
index 8787503ddf734..73530e6c2d1d3 100644
--- a/go.sum
+++ b/go.sum
@@ -128,8 +128,8 @@ github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgI
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/aws/aws-sdk-go v1.17.4/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.34.28/go.mod h1:H7NKnBqNVzoTJpGfLrQkkD+ytBA93eiDYi/+8rV9s48=
-github.com/aws/aws-sdk-go v1.37.17 h1:Ga33kM38f58l7X+Z2B6JNdz9dFqxjR8AXHBbK3bXYc0=
-github.com/aws/aws-sdk-go v1.37.17/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
+github.com/aws/aws-sdk-go v1.43.15 h1:zAOUdqgNgJrkivRZi93NTjPNvuIQ5EcqNHSk0A1jrk8=
+github.com/aws/aws-sdk-go v1.43.15/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go-v2 v1.9.0 h1:+S+dSqQCN3MSU5vJRu1HqHrq00cJn6heIMU7X9hcsoo=
 github.com/aws/aws-sdk-go-v2 v1.9.0/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
 github.com/aws/aws-sdk-go-v2/config v1.8.0 h1:O8EMFBOl6tue5gdJJV6U3Ikyl3lqgx6WrulCYrcy2SQ=
@@ -441,23 +441,25 @@ github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv
 github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
-github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gravitational/configure v0.0.0-20180808141939-c3428bd84c23 h1:havbccuFO5fRj0O67oHXI7doShLig3rSIXfMrd/UnkA=
 github.com/gravitational/configure v0.0.0-20180808141939-c3428bd84c23/go.mod h1:XL9nebvlfNVvRzRPWdDcWootcyA0l7THiH/A+W1233g=
 github.com/gravitational/form v0.0.0-20151109031454-c4048f792f70 h1:To76nCJtM3DI0mdq3nGLzXqTV1wNOJByxv01+u9/BxM=
 github.com/gravitational/form v0.0.0-20151109031454-c4048f792f70/go.mod h1:88hFR45MpUd23d2vNWE/dYtesU50jKsbz0I9kH7UaBY=
 github.com/gravitational/go-mssqldb v0.11.1-0.20220202000043-bec708e9bfd0 h1:DC+S+j/tBs/0MnQCC5j7GWWbMGcR3ca5v75ksAU1LJM=
 github.com/gravitational/go-mssqldb v0.11.1-0.20220202000043-bec708e9bfd0/go.mod h1:iiK0YP1ZeepvmBQk/QpLEhhTNJgfzrpArPY/aFvc9yU=
-github.com/gravitational/go-mysql v1.1.1-teleport.1 h1:062V8u0juCyUvpYMdkYch8JDDw7wf5rdhKaIfhnojDg=
-github.com/gravitational/go-mysql v1.1.1-teleport.1/go.mod h1:re0JQZ1Cy5dVlIDGq0YksfDIla/GRZlxqOoC0XPSSGE=
+github.com/gravitational/go-mysql v1.1.1-teleport.2 h1:XZ36BZ7BgslA5ZCyCHjpc1wilFITThIH7cLcbLWKWzM=
+github.com/gravitational/go-mysql v1.1.1-teleport.2/go.mod h1:re0JQZ1Cy5dVlIDGq0YksfDIla/GRZlxqOoC0XPSSGE=
 github.com/gravitational/go-oidc v0.0.5 h1:kxsCknoOZ+KqIAoYLLdHuQcvcc+SrQlnT7xxIM8oo6o=
 github.com/gravitational/go-oidc v0.0.5/go.mod h1:SevmOUNdOB0aD9BAIgjptZ6oHkKxMZZgA70nwPfgU/w=
+github.com/gravitational/gosaml2 v0.0.0-20220318224559-f06932032ae2 h1:8z1D1fehTDV20wkiGX+JTnlevvEUeVEh4LCygvOrFBs=
+github.com/gravitational/gosaml2 v0.0.0-20220318224559-f06932032ae2/go.mod h1:PiLt5KX4EMjlMIq3WLRR/xb5yqhiwtQhGr8wmU0b08M=
 github.com/gravitational/kingpin v2.1.11-0.20190130013101-742f2714c145+incompatible h1:CfyZl3nyo9K5lLqOmqvl9/IElY1UCnOWKZiQxJ8HKdA=
 github.com/gravitational/kingpin v2.1.11-0.20190130013101-742f2714c145+incompatible/go.mod h1:LWxG30M3FcrjhOn3T4zz7JmBoQJ45MWZmOXgy9Ganoc=
 github.com/gravitational/license v0.0.0-20210218173955-6d8fb49b117a h1:PN5vAN1ZA0zqdpM6wNdx6+bkdlQ5fImd75oaIHSbOhY=
@@ -466,6 +468,8 @@ github.com/gravitational/logrus v1.4.4-0.20210817004754-047e20245621 h1:ivU//THq
 github.com/gravitational/logrus v1.4.4-0.20210817004754-047e20245621/go.mod h1:IIxugQsS57BiOTe+8zDv3sfnvM2BQ3smcF1xJdj3Has=
 github.com/gravitational/oxy v0.0.0-20211213172937-a1ba0900a4c9 h1:7NyppZS8QFt28nn2QjDI44vDTJs0kTRdUS7po/AxWOY=
 github.com/gravitational/oxy v0.0.0-20211213172937-a1ba0900a4c9/go.mod h1:ESOxlf8BB2yG3zJ0SfZe9U6wpYu3YF3znxIICg73FYA=
+github.com/gravitational/predicate v1.2.1 h1:CXgXyZ90F2x4VHzOab1bBsBlpY2l+MGvb5RX3avrJ5U=
+github.com/gravitational/predicate v1.2.1/go.mod h1:VipoNYXny6c8N381zGUWkjuuNHiRbeAZhE7Qm9c+2GA=
 github.com/gravitational/protobuf v1.3.2-0.20201123192827-2b9fcfaffcbf h1:MQ4e8XcxvZTeuOmRl7yE519vcWc2h/lyvYzsvt41cdY=
 github.com/gravitational/protobuf v1.3.2-0.20201123192827-2b9fcfaffcbf/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gravitational/redis/v8 v8.11.5-0.20220211010318-7af711b76a91 h1:LWtt0fv7KDZt6ykJGBXd/04sONaHIMXFzHvmUAqhG8c=
@@ -497,9 +501,9 @@ github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerX
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
@@ -578,6 +582,10 @@ github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9q
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 h1:hgVxRoDDPtQE68PT4LFvNlPz2nBKd3OMlGKIQ69OmR4=
+github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531/go.mod h1:fqTUQpVYBvhCNIsMXGl2GE9q6z94DIP6NtFKXCSTVbg=
+github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d h1:J8tJzRyiddAFF65YVgxli+TyWBi0f79Sld6rJP6CBcY=
+github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d/go.mod h1:b+Q3v8Yrg5o15d71PSUraUzYb+jWl6wQMSBXSGS/hv0=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -596,6 +604,8 @@ github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALr
 github.com/karrick/godirwalk v1.8.0/go.mod h1:H5KPZjojv4lE+QYImBI8xVtrBRgYrIVsaRPx4tDPEn4=
 github.com/karrick/godirwalk v1.10.3/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA=
 github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19/go.mod h1:hY+WOq6m2FpbvyrI93sMaypsttvaIL5nhVR92dTMUcQ=
+github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27 h1:10nfvqVK4/KINnLT8bDICrRnfguTJ300dNGpW8D2bQo=
+github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27/go.mod h1:P0V19qHwJNY0htZwZDe9Ilvs/nokGhdFX7faKFyZ6+U=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.9.5 h1:U+CaK85mrNNb4k8BNOfgJtJ/gr6kswUCFj6miSzVC6M=
@@ -788,8 +798,6 @@ github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6po
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
-github.com/russellhaering/gosaml2 v0.6.1-0.20210916051624-757d23f1bc28 h1:659ZmS9riGgajUnT9ym74yQSug2KZyvVHi3EmIqASnQ=
-github.com/russellhaering/gosaml2 v0.6.1-0.20210916051624-757d23f1bc28/go.mod h1:PiLt5KX4EMjlMIq3WLRR/xb5yqhiwtQhGr8wmU0b08M=
 github.com/russellhaering/goxmldsig v1.1.1 h1:vI0r2osGF1A9PLvsGdPUAGwEIrKa4Pj5sesSBsebIxM=
 github.com/russellhaering/goxmldsig v1.1.1/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
 github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
@@ -861,8 +869,6 @@ github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1
 github.com/tstranex/u2f v0.0.0-20160508205855-eb799ce68da4 h1:aR+lGR8m0zBjvDlHkHOCmdsk79ipIPeiP75GqUlywKM=
 github.com/tstranex/u2f v0.0.0-20160508205855-eb799ce68da4/go.mod h1:eahSLaqAS0zsIEv80+vXT7WanXs7MQQDg3j3wGBSayo=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
-github.com/vulcand/predicate v1.2.0 h1:uFsW1gcnnR7R+QTID+FVcs0sSYlIGntoGOTb3rQJt50=
-github.com/vulcand/predicate v1.2.0/go.mod h1:VipoNYXny6c8N381zGUWkjuuNHiRbeAZhE7Qm9c+2GA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
@@ -956,8 +962,8 @@ golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8 h1:kACShD3qhmr/3rLmg1yXyt+N4HcwutKyPRB93s54TIU=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
diff --git a/integration/app_integration_test.go b/integration/app_integration_test.go
index 8ec91f3866f8a..b43c52ef5c396 100644
--- a/integration/app_integration_test.go
+++ b/integration/app_integration_test.go
@@ -635,18 +635,53 @@ func TestAppAuditEvents(t *testing.T) {
 
 func TestAppServersHA(t *testing.T) {
 	testCases := map[string]struct {
-		publicAddr  func(pack *pack) string
-		makeRequest func(pack *pack, inCookie string) (status int, err error)
+		packInfo        func(pack *pack) (cluterName, publicAddr string, appServers []*service.TeleportProcess)
+		startAppServers func(pack *pack, count int) []*service.TeleportProcess
+		makeRequest     func(pack *pack, inCookie string) (status int, err error)
 	}{
-		"HTTPApp": {
-			publicAddr: func(pack *pack) string { return pack.rootAppPublicAddr },
+		"RootHTTPApp": {
+			packInfo: func(pack *pack) (string, string, []*service.TeleportProcess) {
+				return pack.rootAppClusterName, pack.rootAppPublicAddr, pack.rootAppServers
+			},
+			startAppServers: func(pack *pack, count int) []*service.TeleportProcess {
+				return pack.startRootAppServers(t, count, []service.App{})
+			},
+			makeRequest: func(pack *pack, inCookie string) (int, error) {
+				status, _, err := pack.makeRequest(inCookie, http.MethodGet, "/")
+				return status, err
+			},
+		},
+		"RootWebSocketApp": {
+			packInfo: func(pack *pack) (string, string, []*service.TeleportProcess) {
+				return pack.rootAppClusterName, pack.rootWSPublicAddr, pack.rootAppServers
+			},
+			startAppServers: func(pack *pack, count int) []*service.TeleportProcess {
+				return pack.startRootAppServers(t, count, []service.App{})
+			},
+			makeRequest: func(pack *pack, inCookie string) (int, error) {
+				_, err := pack.makeWebsocketRequest(inCookie, "/")
+				return 0, err
+			},
+		},
+		"LeafHTTPApp": {
+			packInfo: func(pack *pack) (string, string, []*service.TeleportProcess) {
+				return pack.leafAppClusterName, pack.leafAppPublicAddr, pack.leafAppServers
+			},
+			startAppServers: func(pack *pack, count int) []*service.TeleportProcess {
+				return pack.startLeafAppServers(t, count, []service.App{})
+			},
 			makeRequest: func(pack *pack, inCookie string) (int, error) {
 				status, _, err := pack.makeRequest(inCookie, http.MethodGet, "/")
 				return status, err
 			},
 		},
-		"WebSocketApp": {
-			publicAddr: func(pack *pack) string { return pack.rootWSPublicAddr },
+		"LeafWebSocketApp": {
+			packInfo: func(pack *pack) (string, string, []*service.TeleportProcess) {
+				return pack.leafAppClusterName, pack.leafWSPublicAddr, pack.leafAppServers
+			},
+			startAppServers: func(pack *pack, count int) []*service.TeleportProcess {
+				return pack.startLeafAppServers(t, count, []service.App{})
+			},
 			makeRequest: func(pack *pack, inCookie string) (int, error) {
 				_, err := pack.makeWebsocketRequest(inCookie, "/")
 				return 0, err
@@ -678,18 +713,19 @@ func TestAppServersHA(t *testing.T) {
 	for name, test := range testCases {
 		t.Run(name, func(t *testing.T) {
 			pack := setupWithOptions(t, appTestOptions{rootAppServersCount: 3})
-			inCookie := pack.createAppSession(t, test.publicAddr(pack), pack.rootAppClusterName)
+			clusterName, publicAddr, appServers := test.packInfo(pack)
 
+			inCookie := pack.createAppSession(t, publicAddr, clusterName)
 			status, err := test.makeRequest(pack, inCookie)
 			responseWithoutError(t, status, err)
 
 			// Stop all root app servers.
-			for i, appServer := range pack.rootAppServers {
+			for i, appServer := range appServers {
 				appServer.Close()
 
 				// issue a request right after a server is gone.
 				status, err = test.makeRequest(pack, inCookie)
-				if i == len(pack.rootAppServers)-1 {
+				if i == len(appServers)-1 {
 					// fails only when the last one is closed.
 					responseWithError(t, status, err)
 				} else {
@@ -699,13 +735,13 @@ func TestAppServersHA(t *testing.T) {
 				}
 			}
 
-			servers := pack.startRootAppServers(t, 3, []service.App{})
+			servers := test.startAppServers(pack, 3)
 			status, err = test.makeRequest(pack, inCookie)
 			responseWithoutError(t, status, err)
 
 			// Start an additional app server and stop all current running
 			// ones.
-			pack.startRootAppServers(t, 1, []service.App{})
+			test.startAppServers(pack, 1)
 			for _, appServer := range servers {
 				appServer.Close()
 
@@ -756,8 +792,8 @@ type pack struct {
 	jwtAppClusterName string
 	jwtAppURI         string
 
-	leafCluster   *TeleInstance
-	leafAppServer *service.TeleportProcess
+	leafCluster    *TeleInstance
+	leafAppServers []*service.TeleportProcess
 
 	leafAppName        string
 	leafAppPublicAddr  string
@@ -794,6 +830,7 @@ type appTestOptions struct {
 	rootClusterPorts    *InstancePorts
 	leafClusterPorts    *InstancePorts
 	rootAppServersCount int
+	leafAppServersCount int
 
 	rootConfig func(config *service.Config)
 	leafConfig func(config *service.Config)
@@ -1023,42 +1060,12 @@ func setupWithOptions(t *testing.T, opts appTestOptions) *pack {
 	}
 	p.rootAppServers = p.startRootAppServers(t, rootAppServersCount, opts.extraRootApps)
 
-	laConf := service.MakeDefaultConfig()
-	laConf.Console = nil
-	laConf.Log = log
-	laConf.DataDir = t.TempDir()
-	t.Cleanup(func() { os.RemoveAll(laConf.DataDir) })
-	laConf.Token = "static-token-value"
-	laConf.AuthServers = []utils.NetAddr{
-		{
-			AddrNetwork: "tcp",
-			Addr:        net.JoinHostPort(Loopback, p.leafCluster.GetPortWeb()),
-		},
+	// At least one leafAppServer should start during the setup
+	leafAppServersCount := 1
+	if opts.leafAppServersCount > 0 {
+		leafAppServersCount = opts.leafAppServersCount
 	}
-	laConf.Auth.Enabled = false
-	laConf.Proxy.Enabled = false
-	laConf.SSH.Enabled = false
-	laConf.Apps.Enabled = true
-	laConf.Apps.Apps = append([]service.App{
-		{
-			Name:       p.leafAppName,
-			URI:        leafServer.URL,
-			PublicAddr: p.leafAppPublicAddr,
-		},
-		{
-			Name:       p.leafWSAppName,
-			URI:        leafWSServer.URL,
-			PublicAddr: p.leafWSPublicAddr,
-		},
-		{
-			Name:       p.leafWSSAppName,
-			URI:        leafWSSServer.URL,
-			PublicAddr: p.leafWSSPublicAddr,
-		},
-	}, opts.extraLeafApps...)
-	p.leafAppServer, err = p.leafCluster.StartApp(laConf)
-	require.NoError(t, err)
-	t.Cleanup(func() { p.leafAppServer.Close() })
+	p.leafAppServers = p.startLeafAppServers(t, leafAppServersCount, opts.extraLeafApps)
 
 	// Create user for tests.
 	p.initUser(t, opts)
@@ -1247,7 +1254,7 @@ func (p *pack) ensureAuditEvent(t *testing.T, eventType string, checkEvent func(
 // initCertPool initializes root cluster CA pool.
 func (p *pack) initCertPool(t *testing.T) {
 	authClient := p.rootCluster.GetSiteAPI(p.rootCluster.Secrets.SiteName)
-	ca, err := authClient.GetCertAuthority(types.CertAuthID{
+	ca, err := authClient.GetCertAuthority(context.Background(), types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: p.rootCluster.Secrets.SiteName,
 	}, false)
@@ -1511,6 +1518,55 @@ func (p *pack) startRootAppServers(t *testing.T, count int, extraApps []service.
 	return servers
 }
 
+func (p *pack) startLeafAppServers(t *testing.T, count int, extraApps []service.App) []*service.TeleportProcess {
+	log := utils.NewLoggerForTests()
+	servers := make([]*service.TeleportProcess, count)
+
+	for i := 0; i < count; i++ {
+		laConf := service.MakeDefaultConfig()
+		laConf.Console = nil
+		laConf.Log = log
+		laConf.DataDir = t.TempDir()
+		t.Cleanup(func() { os.RemoveAll(laConf.DataDir) })
+		laConf.Token = "static-token-value"
+		laConf.AuthServers = []utils.NetAddr{
+			{
+				AddrNetwork: "tcp",
+				Addr:        net.JoinHostPort(Loopback, p.leafCluster.GetPortWeb()),
+			},
+		}
+		laConf.Auth.Enabled = false
+		laConf.Proxy.Enabled = false
+		laConf.SSH.Enabled = false
+		laConf.Apps.Enabled = true
+		laConf.Apps.Apps = append([]service.App{
+			{
+				Name:       p.leafAppName,
+				URI:        p.leafAppURI,
+				PublicAddr: p.leafAppPublicAddr,
+			},
+			{
+				Name:       p.leafWSAppName,
+				URI:        p.leafWSAppURI,
+				PublicAddr: p.leafWSPublicAddr,
+			},
+			{
+				Name:       p.leafWSSAppName,
+				URI:        p.leafWSSAppURI,
+				PublicAddr: p.leafWSSPublicAddr,
+			},
+		}, extraApps...)
+
+		appServer, err := p.leafCluster.StartApp(laConf)
+		require.NoError(t, err)
+		t.Cleanup(func() { appServer.Close() })
+
+		servers[i] = appServer
+	}
+
+	return servers
+}
+
 var forwardedHeaderNames = []string{
 	teleport.AppJWTHeader,
 	teleport.AppCFHeader,
diff --git a/integration/db_integration_test.go b/integration/db_integration_test.go
index 0c4b6c0133ee5..65c721c7f477e 100644
--- a/integration/db_integration_test.go
+++ b/integration/db_integration_test.go
@@ -31,6 +31,7 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/srv/db"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/mongodb"
 	"github.com/gravitational/teleport/lib/srv/db/mysql"
@@ -210,6 +211,61 @@ func TestDatabaseAccessMongoRootCluster(t *testing.T) {
 	require.NoError(t, err)
 }
 
+// TestDatabaseAccessMongoConnectionCount tests if mongo service releases
+// resource after a mongo client disconnect.
+func TestDatabaseAccessMongoConnectionCount(t *testing.T) {
+	pack := setupDatabaseTest(t)
+
+	connectMongoClient := func(t *testing.T) (serverConnectionCount int32) {
+		// Connect to the database service in root cluster.
+		client, err := mongodb.MakeTestClient(context.Background(), common.TestClientConfig{
+			AuthClient: pack.root.cluster.GetSiteAPI(pack.root.cluster.Secrets.SiteName),
+			AuthServer: pack.root.cluster.Process.GetAuthServer(),
+			Address:    net.JoinHostPort(Loopback, pack.root.cluster.GetPortWeb()),
+			Cluster:    pack.root.cluster.Secrets.SiteName,
+			Username:   pack.root.user.GetName(),
+			RouteToDatabase: tlsca.RouteToDatabase{
+				ServiceName: pack.root.mongoService.Name,
+				Protocol:    pack.root.mongoService.Protocol,
+				Username:    "admin",
+			},
+		})
+		require.NoError(t, err)
+
+		// Execute a query.
+		_, err = client.Database("test").Collection("test").Find(context.Background(), bson.M{})
+		require.NoError(t, err)
+
+		// Get a server connection count before disconnect.
+		serverConnectionCount = pack.root.mongo.GetActiveConnectionsCount()
+
+		// Disconnect.
+		err = client.Disconnect(context.Background())
+		require.NoError(t, err)
+
+		return serverConnectionCount
+	}
+
+	// Get connection count while the first client is connected.
+	initialConnectionCount := connectMongoClient(t)
+
+	// Check if active connections count is not growing over time when new
+	// clients connect to the mongo server.
+	clientCount := 8
+	for i := 0; i < clientCount; i++ {
+		// Note that connection count per client fluctuates between 6 and 9.
+		// Use InDelta to avoid flaky test.
+		require.InDelta(t, initialConnectionCount, connectMongoClient(t), 3)
+	}
+
+	// Wait until the server reports no more connections. This usually happens
+	// really quick but wait a little longer just in case.
+	waitUntilNoConnections := func() bool {
+		return 0 == pack.root.mongo.GetActiveConnectionsCount()
+	}
+	require.Eventually(t, waitUntilNoConnections, 5*time.Second, 100*time.Millisecond)
+}
+
 // TestDatabaseAccessMongoLeafCluster tests a scenario where a user connects
 // to a Mongo database running in a leaf cluster.
 func TestDatabaseAccessMongoLeafCluster(t *testing.T) {
@@ -387,6 +443,121 @@ func TestDatabaseAccessPostgresSeparateListener(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func init() {
+	// Override database agents shuffle behavior to ensure they're always
+	// tried in the same order during tests. Used for HA tests.
+	db.SetShuffleFunc(db.ShuffleSort)
+}
+
+// TestDatabaseAccessHARootCluster verifies that proxy falls back to a healthy
+// database agent when multiple agents are serving the same database and one
+// of them is down in a root cluster.
+func TestDatabaseAccessHARootCluster(t *testing.T) {
+	pack := setupDatabaseTest(t)
+
+	// Insert a database server entry not backed by an actual running agent
+	// to simulate a scenario when an agent is down but the resource hasn't
+	// expired from the backend yet.
+	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+		Name: pack.root.postgresService.Name,
+	}, types.DatabaseServerSpecV3{
+		Protocol: defaults.ProtocolPostgres,
+		URI:      pack.root.postgresAddr,
+		// To make sure unhealthy server is always picked in tests first, make
+		// sure its host ID always compares as "smaller" as the tests sort
+		// agents.
+		HostID:   "0000",
+		Hostname: "test",
+	})
+	require.NoError(t, err)
+
+	_, err = pack.root.cluster.Process.GetAuthServer().UpsertDatabaseServer(
+		context.Background(), dbServer)
+	require.NoError(t, err)
+
+	// Connect to the database service in root cluster.
+	client, err := postgres.MakeTestClient(context.Background(), common.TestClientConfig{
+		AuthClient: pack.root.cluster.GetSiteAPI(pack.root.cluster.Secrets.SiteName),
+		AuthServer: pack.root.cluster.Process.GetAuthServer(),
+		Address:    net.JoinHostPort(Loopback, pack.root.cluster.GetPortWeb()),
+		Cluster:    pack.root.cluster.Secrets.SiteName,
+		Username:   pack.root.user.GetName(),
+		RouteToDatabase: tlsca.RouteToDatabase{
+			ServiceName: pack.root.postgresService.Name,
+			Protocol:    pack.root.postgresService.Protocol,
+			Username:    "postgres",
+			Database:    "test",
+		},
+	})
+	require.NoError(t, err)
+
+	// Execute a query.
+	result, err := client.Exec(context.Background(), "select 1").ReadAll()
+	require.NoError(t, err)
+	require.Equal(t, []*pgconn.Result{postgres.TestQueryResponse}, result)
+	require.Equal(t, uint32(1), pack.root.postgres.QueryCount())
+	require.Equal(t, uint32(0), pack.leaf.postgres.QueryCount())
+
+	// Disconnect.
+	err = client.Close(context.Background())
+	require.NoError(t, err)
+}
+
+// TestDatabaseAccessHALeafCluster verifies that proxy falls back to a healthy
+// database agent when multiple agents are serving the same database and one
+// of them is down in a leaf cluster.
+func TestDatabaseAccessHALeafCluster(t *testing.T) {
+	pack := setupDatabaseTest(t)
+	pack.waitForLeaf(t)
+
+	// Insert a database server entry not backed by an actual running agent
+	// to simulate a scenario when an agent is down but the resource hasn't
+	// expired from the backend yet.
+	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
+		Name: pack.leaf.postgresService.Name,
+	}, types.DatabaseServerSpecV3{
+		Protocol: defaults.ProtocolPostgres,
+		URI:      pack.leaf.postgresAddr,
+		// To make sure unhealthy server is always picked in tests first, make
+		// sure its host ID always compares as "smaller" as the tests sort
+		// agents.
+		HostID:   "0000",
+		Hostname: "test",
+	})
+	require.NoError(t, err)
+
+	_, err = pack.leaf.cluster.Process.GetAuthServer().UpsertDatabaseServer(
+		context.Background(), dbServer)
+	require.NoError(t, err)
+
+	// Connect to the database service in leaf cluster via root cluster.
+	client, err := postgres.MakeTestClient(context.Background(), common.TestClientConfig{
+		AuthClient: pack.root.cluster.GetSiteAPI(pack.root.cluster.Secrets.SiteName),
+		AuthServer: pack.root.cluster.Process.GetAuthServer(),
+		Address:    net.JoinHostPort(Loopback, pack.root.cluster.GetPortWeb()), // Connecting via root cluster.
+		Cluster:    pack.leaf.cluster.Secrets.SiteName,
+		Username:   pack.root.user.GetName(),
+		RouteToDatabase: tlsca.RouteToDatabase{
+			ServiceName: pack.leaf.postgresService.Name,
+			Protocol:    pack.leaf.postgresService.Protocol,
+			Username:    "postgres",
+			Database:    "test",
+		},
+	})
+	require.NoError(t, err)
+
+	// Execute a query.
+	result, err := client.Exec(context.Background(), "select 1").ReadAll()
+	require.NoError(t, err)
+	require.Equal(t, []*pgconn.Result{postgres.TestQueryResponse}, result)
+	require.Equal(t, uint32(1), pack.leaf.postgres.QueryCount())
+	require.Equal(t, uint32(0), pack.root.postgres.QueryCount())
+
+	// Disconnect.
+	err = client.Close(context.Background())
+	require.NoError(t, err)
+}
+
 // TestDatabaseAccessMongoSeparateListener tests mongo proxy listener running on separate port.
 func TestDatabaseAccessMongoSeparateListener(t *testing.T) {
 	pack := setupDatabaseTest(t,
@@ -627,7 +798,7 @@ func setupDatabaseTest(t *testing.T, options ...testOptionFunc) *databasePack {
 	p.setupUsersAndRoles(t)
 
 	// Update root's certificate authority on leaf to configure role mapping.
-	ca, err := p.leaf.cluster.Process.GetAuthServer().GetCertAuthority(types.CertAuthID{
+	ca, err := p.leaf.cluster.Process.GetAuthServer().GetCertAuthority(context.Background(), types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: p.root.cluster.Secrets.SiteName,
 	}, false)
diff --git a/integration/helpers.go b/integration/helpers.go
index da8f2ec80980d..e7d237cc4fd6a 100644
--- a/integration/helpers.go
+++ b/integration/helpers.go
@@ -23,7 +23,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"os"
@@ -486,7 +485,7 @@ func GenerateUserCreds(req UserCredsRequest) (*UserCreds, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ca, err := a.GetCertAuthority(types.CertAuthID{
+	ca, err := a.GetCertAuthority(context.Background(), types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, false)
@@ -507,7 +506,7 @@ func GenerateUserCreds(req UserCredsRequest) (*UserCreds, error) {
 // GenerateConfig generates instance config
 func (i *TeleInstance) GenerateConfig(t *testing.T, trustedSecrets []*InstanceSecrets, tconf *service.Config) (*service.Config, error) {
 	var err error
-	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -722,7 +721,7 @@ func (i *TeleInstance) StartReverseTunnelNode(tconf *service.Config) (*service.T
 
 // startNode starts a node and connects it to the cluster.
 func (i *TeleInstance) startNode(tconf *service.Config, authPort string) (*service.TeleportProcess, error) {
-	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -776,7 +775,7 @@ func (i *TeleInstance) startNode(tconf *service.Config, authPort string) (*servi
 }
 
 func (i *TeleInstance) StartApp(conf *service.Config) (*service.TeleportProcess, error) {
-	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -821,7 +820,7 @@ func (i *TeleInstance) StartApp(conf *service.Config) (*service.TeleportProcess,
 
 // StartDatabase starts the database access service with the provided config.
 func (i *TeleInstance) StartDatabase(conf *service.Config) (*service.TeleportProcess, *auth.Client, error) {
-	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -886,7 +885,7 @@ func (i *TeleInstance) StartDatabase(conf *service.Config) (*service.TeleportPro
 // StartNodeAndProxy starts a SSH node and a Proxy Server and connects it to
 // the cluster.
 func (i *TeleInstance) StartNodeAndProxy(name string, sshPort, proxyWebPort, proxySSHPort int) error {
-	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -973,7 +972,7 @@ type ProxyConfig struct {
 
 // StartProxy starts another Proxy Server and connects it to the cluster.
 func (i *TeleInstance) StartProxy(cfg ProxyConfig) (reversetunnel.Server, error) {
-	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName+"-"+cfg.Name)
+	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName+"-"+cfg.Name)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1192,7 +1191,7 @@ func (i *TeleInstance) NewClientWithCreds(cfg ClientConfig, creds UserCreds) (tc
 // NewUnauthenticatedClient returns a fully configured and pre-authenticated client
 // (pre-authenticated with server CAs and signed session key)
 func (i *TeleInstance) NewUnauthenticatedClient(cfg ClientConfig) (tc *client.TeleportClient, err error) {
-	keyDir, err := ioutil.TempDir(i.Config.DataDir, "tsh")
+	keyDir, err := os.MkdirTemp(i.Config.DataDir, "tsh")
 	if err != nil {
 		return nil, err
 	}
@@ -1624,7 +1623,7 @@ func externalSSHCommand(o commandOptions) (*exec.Cmd, error) {
 // clobber your system agent.
 func createAgent(me *user.User, privateKeyByte []byte, certificateBytes []byte) (*teleagent.AgentServer, string, string, error) {
 	// create a path to the unix socket
-	sockDir, err := ioutil.TempDir("", "int-test")
+	sockDir, err := os.MkdirTemp("", "int-test")
 	if err != nil {
 		return nil, "", "", trace.Wrap(err)
 	}
diff --git a/integration/hsm/hsm_test.go b/integration/hsm/hsm_test.go
index f4695597ab9ae..d6b79b765c273 100644
--- a/integration/hsm/hsm_test.go
+++ b/integration/hsm/hsm_test.go
@@ -167,7 +167,7 @@ func (t *teleportService) waitForLocalAdditionalKeys(ctx context.Context) error
 			return trace.Wrap(ctx.Err(), "timed out waiting for %s to have local additional keys", t.name)
 		case <-time.After(250 * time.Millisecond):
 		}
-		ca, err := t.process.GetAuthServer().GetCertAuthority(hostCAID, true)
+		ca, err := t.process.GetAuthServer().GetCertAuthority(ctx, hostCAID, true)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -357,7 +357,7 @@ func TestHSMRotation(t *testing.T) {
 	teleportServices = append(teleportServices, proxy)
 
 	log.Debug("TestHSMRotation: sending rotation request init")
-	err = auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		Type:        types.HostCA,
 		TargetPhase: types.RotationPhaseInit,
 		Mode:        types.RotationModeManual,
@@ -366,7 +366,7 @@ func TestHSMRotation(t *testing.T) {
 	require.NoError(t, teleportServices.waitForPhaseChange(ctx))
 
 	log.Debug("TestHSMRotation: sending rotation request update_clients")
-	err = auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		Type:        types.HostCA,
 		TargetPhase: types.RotationPhaseUpdateClients,
 		Mode:        types.RotationModeManual,
@@ -375,7 +375,7 @@ func TestHSMRotation(t *testing.T) {
 	require.NoError(t, teleportServices.waitForRestart(ctx))
 
 	log.Debug("TestHSMRotation: sending rotation request update_servers")
-	err = auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		Type:        types.HostCA,
 		TargetPhase: types.RotationPhaseUpdateServers,
 		Mode:        types.RotationModeManual,
@@ -384,7 +384,7 @@ func TestHSMRotation(t *testing.T) {
 	require.NoError(t, teleportServices.waitForRestart(ctx))
 
 	log.Debug("TestHSMRotation: sending rotation request standby")
-	err = auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		Type:        types.HostCA,
 		TargetPhase: types.RotationPhaseStandby,
 		Mode:        types.RotationModeManual,
@@ -542,7 +542,7 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	// do a full rotation
 	for _, stage := range stages {
 		log.Debugf("TestHSMDualAuthRotation: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
@@ -582,7 +582,7 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	// Do another full rotation from the new auth server
 	for _, stage := range stages {
 		log.Debugf("TestHSMDualAuthRotation: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth2.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		require.NoError(t, auth2.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
@@ -697,7 +697,7 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	}
 	for _, stage := range stages {
 		log.Debugf("TestHSMDualAuthRotation: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
@@ -862,7 +862,7 @@ func TestHSMMigrate(t *testing.T) {
 	// do a full rotation
 	for _, stage := range stages {
 		log.Debugf("TestHSMMigrate: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
@@ -890,7 +890,7 @@ func TestHSMMigrate(t *testing.T) {
 	// do a full rotation
 	for _, stage := range stages {
 		log.Debugf("TestHSMMigrate: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
diff --git a/integration/integration_test.go b/integration/integration_test.go
index 0937fb7972d1e..b41c329b1138d 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -25,7 +25,6 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -205,6 +204,7 @@ func TestIntegrations(t *testing.T) {
 	t.Run("TwoClustersTunnel", suite.bind(testTwoClustersTunnel))
 	t.Run("UUIDBasedProxy", suite.bind(testUUIDBasedProxy))
 	t.Run("WindowChange", suite.bind(testWindowChange))
+	t.Run("SSHTracker", suite.bind(testSSHTracker))
 }
 
 // testAuditOn creates a live session, records a bunch of data through it
@@ -607,7 +607,7 @@ func testInteroperability(t *testing.T, suite *integrationTestSuite) {
 			// if we are looking for the output in a file, look in the file
 			// otherwise check stdout and stderr for the expected output
 			if tt.outFile {
-				bytes, err := ioutil.ReadFile(tempfile)
+				bytes, err := os.ReadFile(tempfile)
 				require.NoError(t, err)
 				require.Contains(t, string(bytes), tt.outContains)
 			} else {
@@ -789,6 +789,38 @@ func testUUIDBasedProxy(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 }
 
+// testSSHTracker verifies that an SSH session creates a tracker for sessions.
+func testSSHTracker(t *testing.T, suite *integrationTestSuite) {
+	ctx := context.Background()
+	teleport := suite.newTeleport(t, nil, true)
+	defer teleport.StopAll()
+
+	site := teleport.GetSiteAPI(Site)
+	require.NotNil(t, site)
+
+	personA := NewTerminal(250)
+	cl, err := teleport.NewClient(ClientConfig{
+		Login:   suite.me.Username,
+		Cluster: Site,
+		Host:    Host,
+	})
+	require.NoError(t, err)
+	cl.Stdout = personA
+	cl.Stdin = personA
+	personA.Type("\aecho hi\n\r")
+	go cl.SSH(ctx, []string{}, false)
+
+	condition := func() bool {
+		// verify that the tracker was created
+		trackers, err := site.GetActiveSessionTrackers(ctx)
+		require.NoError(t, err)
+		return len(trackers) == 1
+	}
+
+	// wait for the tracker to be created
+	require.Eventually(t, condition, time.Minute, time.Millisecond*100)
+}
+
 // testInteractive covers SSH into shell and joining the same session from another client
 // against a standard teleport node.
 func testInteractiveRegular(t *testing.T, suite *integrationTestSuite) {
@@ -1179,7 +1211,7 @@ func runDisconnectTest(t *testing.T, suite *integrationTestSuite, tc disconnectT
 	teleport := suite.newTeleportInstance()
 
 	username := suite.me.Username
-	role, err := types.NewRole("devs", types.RoleSpecV5{
+	role, err := types.NewRoleV3("devs", types.RoleSpecV5{
 		Options: tc.options,
 		Allow: types.RoleConditions{
 			Logins: []string{username},
@@ -1510,7 +1542,7 @@ func twoClustersTunnel(t *testing.T, suite *integrationTestSuite, now time.Time,
 
 	// The known_hosts file should have two certificates, the way bytes.Split
 	// works that means the output will be 3 (2 certs + 1 empty).
-	buffer, err := ioutil.ReadFile(keypaths.KnownHostsPath(tc.KeysDir))
+	buffer, err := os.ReadFile(keypaths.KnownHostsPath(tc.KeysDir))
 	require.NoError(t, err)
 	parts := bytes.Split(buffer, []byte("\n"))
 	require.Len(t, parts, 3)
@@ -1521,7 +1553,7 @@ func twoClustersTunnel(t *testing.T, suite *integrationTestSuite, now time.Time,
 		if info.IsDir() {
 			return nil
 		}
-		buffer, err = ioutil.ReadFile(path)
+		buffer, err = os.ReadFile(path)
 		require.NoError(t, err)
 		ok := roots.AppendCertsFromPEM(buffer)
 		require.True(t, ok)
@@ -1741,7 +1773,7 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) {
 
 	// main cluster has a local user and belongs to role "main-devs"
 	mainDevs := "main-devs"
-	role, err := types.NewRole(mainDevs, types.RoleSpecV5{
+	role, err := types.NewRoleV3(mainDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -1769,7 +1801,7 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "devs" to local role "local-devs"
 	auxDevs := "aux-devs"
-	role, err = types.NewRole(auxDevs, types.RoleSpecV5{
+	role, err = types.NewRoleV3(auxDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -1905,28 +1937,28 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			cid := types.CertAuthID{Type: types.UserCA, DomainName: tt.mainClusterName}
-			mainUserCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(cid, true)
+			mainUserCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(ctx, cid, true)
 			tt.outChkMainUserCA(t, err)
 			if err == nil {
 				tt.outChkMainUserCAPrivateKey(t, mainUserCAs.GetActiveKeys().SSH[0].PrivateKey)
 			}
 
 			cid = types.CertAuthID{Type: types.HostCA, DomainName: tt.mainClusterName}
-			mainHostCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(cid, true)
+			mainHostCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(ctx, cid, true)
 			tt.outChkMainHostCA(t, err)
 			if err == nil {
 				tt.outChkMainHostCAPrivateKey(t, mainHostCAs.GetActiveKeys().SSH[0].PrivateKey)
 			}
 
 			cid = types.CertAuthID{Type: types.UserCA, DomainName: tt.auxClusterName}
-			auxUserCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(cid, true)
+			auxUserCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(ctx, cid, true)
 			tt.outChkAuxUserCA(t, err)
 			if err == nil {
 				tt.outChkAuxUserCAPrivateKey(t, auxUserCAs.GetActiveKeys().SSH[0].PrivateKey)
 			}
 
 			cid = types.CertAuthID{Type: types.HostCA, DomainName: tt.auxClusterName}
-			auxHostCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(cid, true)
+			auxHostCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(ctx, cid, true)
 			tt.outChkAuxHostCA(t, err)
 			if err == nil {
 				tt.outChkAuxHostCAPrivateKey(t, auxHostCAs.GetActiveKeys().SSH[0].PrivateKey)
@@ -2051,7 +2083,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 
 	// main cluster has a local user and belongs to role "main-devs" and "main-admins"
 	mainDevs := "main-devs"
-	devsRole, err := types.NewRole(mainDevs, types.RoleSpecV5{
+	devsRole, err := types.NewRoleV3(mainDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -2066,7 +2098,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 	require.NoError(t, err)
 
 	mainAdmins := "main-admins"
-	adminsRole, err := types.NewRole(mainAdmins, types.RoleSpecV5{
+	adminsRole, err := types.NewRoleV3(mainAdmins, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{"superuser"},
 		},
@@ -2077,7 +2109,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 
 	// Ops users can only access remote clusters with label 'access': 'ops'
 	mainOps := "main-ops"
-	mainOpsRole, err := types.NewRole(mainOps, types.RoleSpecV5{
+	mainOpsRole, err := types.NewRoleV3(mainOps, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:        []string{username},
 			ClusterLabels: types.Labels{"access": []string{"ops"}},
@@ -2106,7 +2138,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "devs" to local role "local-devs"
 	auxDevs := "aux-devs"
-	auxRole, err := types.NewRole(auxDevs, types.RoleSpecV5{
+	auxRole, err := types.NewRoleV3(auxDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -2208,7 +2240,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 
 	// ListNodes expect labels as a value of host
 	tc.Host = ""
-	servers, err := tc.ListNodes(ctx)
+	servers, err := tc.ListNodesWithFilters(ctx)
 	require.NoError(t, err)
 	require.Len(t, servers, 2)
 	tc.Host = Loopback
@@ -2298,7 +2330,7 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 
 	// main cluster has a local user and belongs to role "main-devs"
 	mainDevs := "main-devs"
-	role, err := types.NewRole(mainDevs, types.RoleSpecV5{
+	role, err := types.NewRoleV3(mainDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -2326,7 +2358,7 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "devs" to local role "local-devs"
 	auxDevs := "aux-devs"
-	role, err = types.NewRole(auxDevs, types.RoleSpecV5{
+	role, err = types.NewRoleV3(auxDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -3043,7 +3075,6 @@ func waitForNodeCount(ctx context.Context, t *TeleInstance, clusterName string,
 			return nil
 		}
 		return trace.BadParameter("did not find %v nodes", count)
-
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -3221,7 +3252,7 @@ func testControlMaster(t *testing.T, suite *integrationTestSuite) {
 	}
 
 	for _, tt := range tests {
-		controlDir, err := ioutil.TempDir("", "teleport-")
+		controlDir, err := os.MkdirTemp("", "teleport-")
 		require.NoError(t, err)
 		defer os.RemoveAll(controlDir)
 		controlPath := filepath.Join(controlDir, "control-path")
@@ -3679,13 +3710,13 @@ func testRotateSuccess(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service started. Setting rotation state to %v", types.RotationPhaseUpdateClients)
 
 	// start rotation
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseInit,
 		Mode:        types.RotationModeManual,
 	})
 	require.NoError(t, err)
 
-	hostCA, err := svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
+	hostCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
 	require.NoError(t, err)
 	t.Logf("Cert authority: %v", auth.CertAuthorityInfo(hostCA))
 
@@ -3694,7 +3725,7 @@ func testRotateSuccess(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 
 	// update clients
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateClients,
 		Mode:        types.RotationModeManual,
 	})
@@ -3721,13 +3752,13 @@ func testRotateSuccess(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %v", types.RotationPhaseUpdateServers)
 
 	// move to the next phase
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateServers,
 		Mode:        types.RotationModeManual,
 	})
 	require.NoError(t, err)
 
-	hostCA, err = svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
+	hostCA, err = svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
 	require.NoError(t, err)
 	t.Logf("Cert authority: %v", auth.CertAuthorityInfo(hostCA))
 
@@ -3750,13 +3781,13 @@ func testRotateSuccess(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %v.", types.RotationPhaseStandby)
 
 	// complete rotation
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseStandby,
 		Mode:        types.RotationModeManual,
 	})
 	require.NoError(t, err)
 
-	hostCA, err = svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
+	hostCA, err = svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
 	require.NoError(t, err)
 	t.Logf("Cert authority: %v", auth.CertAuthorityInfo(hostCA))
 
@@ -3828,7 +3859,7 @@ func testRotateRollback(t *testing.T, s *integrationTestSuite) {
 	t.Logf("Service started. Setting rotation state to %q.", types.RotationPhaseInit)
 
 	// start rotation
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseInit,
 		Mode:        types.RotationModeManual,
 	})
@@ -3840,7 +3871,7 @@ func testRotateRollback(t *testing.T, s *integrationTestSuite) {
 	t.Logf("Setting rotation state to %q.", types.RotationPhaseUpdateClients)
 
 	// start rotation
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateClients,
 		Mode:        types.RotationModeManual,
 	})
@@ -3866,7 +3897,7 @@ func testRotateRollback(t *testing.T, s *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %q.", types.RotationPhaseUpdateServers)
 
 	// move to the next phase
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateServers,
 		Mode:        types.RotationModeManual,
 	})
@@ -3879,7 +3910,7 @@ func testRotateRollback(t *testing.T, s *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %q.", types.RotationPhaseRollback)
 
 	// complete rotation
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseRollback,
 		Mode:        types.RotationModeManual,
 	})
@@ -3947,7 +3978,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 
 	// main cluster has a local user and belongs to role "main-devs"
 	mainDevs := "main-devs"
-	role, err := types.NewRole(mainDevs, types.RoleSpecV5{
+	role, err := types.NewRoleV3(mainDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{suite.me.Username},
 		},
@@ -3965,7 +3996,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "devs" to local role "local-devs"
 	auxDevs := "aux-devs"
-	role, err = types.NewRole(auxDevs, types.RoleSpecV5{
+	role, err = types.NewRoleV3(auxDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{suite.me.Username},
 		},
@@ -4012,7 +4043,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Setting rotation state to %v", types.RotationPhaseInit)
 
 	// start rotation
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseInit,
 		Mode:        types.RotationModeManual,
 	})
@@ -4063,7 +4094,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 
 	// update clients
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateClients,
 		Mode:        types.RotationModeManual,
 	})
@@ -4083,7 +4114,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %v", types.RotationPhaseUpdateServers)
 
 	// move to the next phase
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateServers,
 		Mode:        types.RotationModeManual,
 	})
@@ -4110,7 +4141,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %v.", types.RotationPhaseStandby)
 
 	// complete rotation
-	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 		TargetPhase: types.RotationPhaseStandby,
 		Mode:        types.RotationModeManual,
 	})
@@ -4148,6 +4179,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 // TestRotateChangeSigningAlg tests the change of CA signing algorithm on
 // manual rotation.
 func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
+	ctx := context.Background()
 	// Start with an instance using default signing alg.
 	tconf := suite.rotationConfig(true)
 	teleport := suite.newTeleportInstance()
@@ -4196,18 +4228,18 @@ func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
 	}
 
 	assertSigningAlg := func(svc *service.TeleportProcess, alg string) {
-		hostCA, err := svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
+		hostCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
 		require.NoError(t, err)
 		require.Equal(t, alg, sshutils.GetSigningAlgName(hostCA))
 
-		userCA, err := svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.UserCA, DomainName: Site}, false)
+		userCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.UserCA, DomainName: Site}, false)
 		require.NoError(t, err)
 		require.Equal(t, alg, sshutils.GetSigningAlgName(userCA))
 	}
 
 	rotate := func(svc *service.TeleportProcess, mode string) *service.TeleportProcess {
 		t.Logf("Rotation phase: %q.", types.RotationPhaseInit)
-		err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			TargetPhase: types.RotationPhaseInit,
 			Mode:        mode,
 		})
@@ -4218,7 +4250,7 @@ func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
 		require.NoError(t, err)
 
 		t.Logf("Rotation phase: %q.", types.RotationPhaseUpdateClients)
-		err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			TargetPhase: types.RotationPhaseUpdateClients,
 			Mode:        mode,
 		})
@@ -4229,7 +4261,7 @@ func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
 		require.NoError(t, err)
 
 		t.Logf("Rotation phase: %q.", types.RotationPhaseUpdateServers)
-		err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			TargetPhase: types.RotationPhaseUpdateServers,
 			Mode:        mode,
 		})
@@ -4240,7 +4272,7 @@ func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
 		require.NoError(t, err)
 
 		t.Logf("rotation phase: %q", types.RotationPhaseStandby)
-		err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
+		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
 			TargetPhase: types.RotationPhaseStandby,
 			Mode:        mode,
 		})
@@ -4619,7 +4651,7 @@ func testList(t *testing.T, suite *integrationTestSuite) {
 	for _, tt := range tests {
 		t.Run(tt.inRoleName, func(t *testing.T) {
 			// Create role with logins and labels for this test.
-			role, err := types.NewRole(tt.inRoleName, types.RoleSpecV5{
+			role, err := types.NewRoleV3(tt.inRoleName, types.RoleSpecV5{
 				Allow: types.RoleConditions{
 					Logins:     []string{tt.inLogin},
 					NodeLabels: tt.inLabels,
@@ -4644,7 +4676,7 @@ func testList(t *testing.T, suite *integrationTestSuite) {
 
 			// Get list of nodes and check that the returned nodes match the
 			// expected nodes.
-			nodes, err := userClt.ListNodes(context.Background())
+			nodes, err := userClt.ListNodesWithFilters(context.Background())
 			require.NoError(t, err)
 			for _, node := range nodes {
 				ok := apiutils.SliceContainsStr(tt.outNodes, node.GetHostname())
@@ -5025,7 +5057,7 @@ func testSSHExitCode(t *testing.T, suite *integrationTestSuite) {
 	lsPath, err := exec.LookPath("ls")
 	require.NoError(t, err)
 
-	var tests = []struct {
+	tests := []struct {
 		desc           string
 		command        []string
 		input          string
@@ -5352,7 +5384,7 @@ func testSessionStartContainsAccessRequest(t *testing.T, suite *integrationTestS
 	authServer := main.Process.GetAuthServer()
 
 	// Create new request role
-	requestedRole, err := types.NewRole(requestedRoleName, types.RoleSpecV5{
+	requestedRole, err := types.NewRoleV3(requestedRoleName, types.RoleSpecV5{
 		Options: types.RoleOptions{},
 		Allow:   types.RoleConditions{},
 	})
@@ -5362,7 +5394,7 @@ func testSessionStartContainsAccessRequest(t *testing.T, suite *integrationTestS
 	require.NoError(t, err)
 
 	// Create user role with ability to request role
-	userRole, err := types.NewRole(userRoleName, types.RoleSpecV5{
+	userRole, err := types.NewRoleV3(userRoleName, types.RoleSpecV5{
 		Options: types.RoleOptions{},
 		Allow: types.RoleConditions{
 			Logins: []string{
@@ -5833,7 +5865,7 @@ func TestTraitsPropagation(t *testing.T) {
 	})
 
 	// Update root's certificate authority on leaf to configure role mapping.
-	ca, err := lc.Process.GetAuthServer().GetCertAuthority(types.CertAuthID{
+	ca, err := lc.Process.GetAuthServer().GetCertAuthority(context.Background(), types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: rc.Secrets.SiteName,
 	}, false)
diff --git a/integration/kube_integration_test.go b/integration/kube_integration_test.go
index cc9292677ad42..2bcbae0519380 100644
--- a/integration/kube_integration_test.go
+++ b/integration/kube_integration_test.go
@@ -23,7 +23,6 @@ import (
 	"crypto/x509"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -182,7 +181,7 @@ func testKubeExec(t *testing.T, suite *KubeSuite) {
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
 	kubeUsers := []string{"alice@example.com"}
-	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: kubeGroups,
@@ -351,7 +350,7 @@ func testKubeDeny(t *testing.T, suite *KubeSuite) {
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
 	kubeUsers := []string{"alice@example.com"}
-	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: kubeGroups,
@@ -402,7 +401,7 @@ func testKubePortForward(t *testing.T, suite *KubeSuite) {
 
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
-	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: kubeGroups,
@@ -498,7 +497,7 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
 	// main cluster has a role and user called main-kube
 	username := suite.me.Username
 	mainKubeGroups := []string{testImpersonationGroup}
-	mainRole, err := types.NewRole("main-kube", types.RoleSpecV5{
+	mainRole, err := types.NewRoleV3("main-kube", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: mainKubeGroups,
@@ -533,7 +532,7 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "aux-kube" to local role "main-kube"
 	auxKubeGroups := []string{teleport.TraitInternalKubeGroupsVariable}
-	auxRole, err := types.NewRole("aux-kube", types.RoleSpecV5{
+	auxRole, err := types.NewRoleV3("aux-kube", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 			// Note that main cluster can pass it's kubernetes groups
@@ -749,7 +748,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 	// main cluster has a role and user called main-kube
 	username := suite.me.Username
 	mainKubeGroups := []string{testImpersonationGroup}
-	mainRole, err := types.NewRole("main-kube", types.RoleSpecV5{
+	mainRole, err := types.NewRoleV3("main-kube", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: mainKubeGroups,
@@ -788,7 +787,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "aux-kube" to local role "main-kube"
 	auxKubeGroups := []string{teleport.TraitInternalKubeGroupsVariable}
-	auxRole, err := types.NewRole("aux-kube", types.RoleSpecV5{
+	auxRole, err := types.NewRoleV3("aux-kube", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 			// Note that main cluster can pass it's kubernetes groups
@@ -1023,7 +1022,7 @@ func runKubeDisconnectTest(t *testing.T, suite *KubeSuite, tc disconnectTestCase
 
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
-	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
 		Options: tc.options,
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
@@ -1109,7 +1108,7 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) {
 
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
-	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: kubeGroups,
@@ -1281,7 +1280,7 @@ func kubeProxyClient(cfg kubeProxyConfig) (*kubernetes.Clientset, *rest.Config,
 	}
 	ttl := roles.AdjustSessionTTL(10 * time.Minute)
 
-	ca, err := authServer.GetCertAuthority(types.CertAuthID{
+	ca, err := authServer.GetCertAuthority(context.Background(), types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
@@ -1452,7 +1451,7 @@ func kubeExec(kubeConfig *rest.Config, args kubeExecArgs) error {
 	// stderr channel is only set if there is no tty allocated
 	// otherwise k8s server gets confused
 	if !args.tty && args.stderr == nil {
-		args.stderr = ioutil.Discard
+		args.stderr = io.Discard
 	}
 	if args.stderr != nil && !args.tty {
 		query.Set("stderr", "true")
@@ -1523,7 +1522,7 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 	participantUsername := suite.me.Username + "-participant"
 	kubeGroups := []string{testImpersonationGroup}
 	kubeUsers := []string{"alice@example.com"}
-	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{hostUsername},
 			KubeGroups: kubeGroups,
diff --git a/integration/proxy_helpers_test.go b/integration/proxy_helpers_test.go
index bffe58e25c180..9614826355ad8 100644
--- a/integration/proxy_helpers_test.go
+++ b/integration/proxy_helpers_test.go
@@ -277,7 +277,7 @@ func withLeafClusterPorts(ports *InstancePorts) proxySuiteOptionsFunc {
 }
 
 func newRole(t *testing.T, roleName string, username string) types.Role {
-	role, err := types.NewRole(roleName, types.RoleSpecV5{
+	role, err := types.NewRoleV3(roleName, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -338,7 +338,7 @@ func withStandardRoleMapping() proxySuiteOptionsFunc {
 			rc := suite.root
 			lc := suite.leaf
 			role := suite.root.Secrets.Users[mustGetCurrentUser(t).Username].Roles[0]
-			ca, err := lc.Process.GetAuthServer().GetCertAuthority(types.CertAuthID{
+			ca, err := lc.Process.GetAuthServer().GetCertAuthority(context.Background(), types.CertAuthID{
 				Type:       types.UserCA,
 				DomainName: rc.Secrets.SiteName,
 			}, false)
@@ -509,7 +509,7 @@ func mustCreateUserIdentityFile(t *testing.T, tc *TeleInstance, username string)
 	key.Cert = sshCert
 	key.TLSCert = tlsCert
 
-	hostCAs, err := tc.Process.GetAuthServer().GetCertAuthorities(types.HostCA, false)
+	hostCAs, err := tc.Process.GetAuthServer().GetCertAuthorities(context.Background(), types.HostCA, false)
 	require.NoError(t, err)
 	key.TrustedCA = auth.AuthoritiesToTrustedCerts(hostCAs)
 
diff --git a/integration/proxy_test.go b/integration/proxy_test.go
index e45126e01b684..87516fae4feea 100644
--- a/integration/proxy_test.go
+++ b/integration/proxy_test.go
@@ -254,7 +254,7 @@ func TestALPNSNIProxyKube(t *testing.T) {
 			KubeUsers:  []string{k8User},
 		},
 	}
-	kubeRole, err := types.NewRole(k8RoleName, kubeRoleSpec)
+	kubeRole, err := types.NewRoleV3(k8RoleName, kubeRoleSpec)
 	require.NoError(t, err)
 
 	suite := newProxySuite(t,
@@ -306,7 +306,7 @@ func TestALPNSNIProxyKubeV2Leaf(t *testing.T) {
 			KubeUsers:  []string{k8User},
 		},
 	}
-	kubeRole, err := types.NewRole(k8RoleName, kubeRoleSpec)
+	kubeRole, err := types.NewRoleV3(k8RoleName, kubeRoleSpec)
 	require.NoError(t, err)
 
 	suite := newProxySuite(t,
diff --git a/lib/asciitable/table.go b/lib/asciitable/table.go
index c7f705f51741e..16c1d0f916975 100644
--- a/lib/asciitable/table.go
+++ b/lib/asciitable/table.go
@@ -21,8 +21,11 @@ package asciitable
 import (
 	"bytes"
 	"fmt"
+	"os"
 	"strings"
 	"text/tabwriter"
+
+	"golang.org/x/term"
 )
 
 // Column represents a column in the table.
@@ -50,13 +53,68 @@ func MakeHeadlessTable(columnCount int) Table {
 	}
 }
 
-// MakeTable creates a new instance of the table with given column names.
-func MakeTable(headers []string) Table {
+// MakeTable creates a new instance of the table with given column
+// names. Optionally rows to be added to the table may be included.
+func MakeTable(headers []string, rows ...[]string) Table {
 	t := MakeHeadlessTable(len(headers))
 	for i := range t.columns {
 		t.columns[i].Title = headers[i]
 		t.columns[i].width = len(headers[i])
 	}
+	for _, row := range rows {
+		t.AddRow(row)
+	}
+	return t
+}
+
+// MakeTableWithTruncatedColumn creates a table where the column
+// matching truncatedColumn will be shortened to account for terminal
+// width.
+func MakeTableWithTruncatedColumn(columnOrder []string, rows [][]string, truncatedColumn string) Table {
+	width, _, err := term.GetSize(int(os.Stdin.Fd()))
+	if err != nil {
+		width = 80
+	}
+	truncatedColMinSize := 16
+	maxColWidth := (width - truncatedColMinSize) / (len(columnOrder) - 1)
+	t := MakeTable([]string{})
+	totalLen := 0
+	columns := []Column{}
+
+	for collIndex, colName := range columnOrder {
+		column := Column{
+			Title:         colName,
+			MaxCellLength: len(colName),
+		}
+		if colName == truncatedColumn { // truncated column is handled separately in next loop
+			columns = append(columns, column)
+			continue
+		}
+		for _, row := range rows {
+			cellLen := row[collIndex]
+			if len(cellLen) > column.MaxCellLength {
+				column.MaxCellLength = len(cellLen)
+			}
+		}
+		if column.MaxCellLength > maxColWidth {
+			column.MaxCellLength = maxColWidth
+			totalLen += column.MaxCellLength + 4 // "...<space>"
+		} else {
+			totalLen += column.MaxCellLength + 1 // +1 for column separator
+		}
+		columns = append(columns, column)
+	}
+
+	for _, column := range columns {
+		if column.Title == truncatedColumn {
+			column.MaxCellLength = width - totalLen - len("... ")
+		}
+		t.AddColumn(column)
+	}
+
+	for _, row := range rows {
+		t.AddRow(row)
+	}
 	return t
 }
 
diff --git a/lib/asciitable/table_test.go b/lib/asciitable/table_test.go
index 96c7f0ddf95c4..ee482af693ab4 100644
--- a/lib/asciitable/table_test.go
+++ b/lib/asciitable/table_test.go
@@ -80,3 +80,55 @@ func TestTruncatedTable(t *testing.T) {
 
 	require.Equal(t, truncatedTable, table.AsBuffer().String())
 }
+
+func TestMakeTableWithTruncatedColumn(t *testing.T) {
+	// os.Stdin.Fd() fails during go test, so width is defaulted to 80
+	columns := []string{"column1", "column2", "column3"}
+	rows := [][]string{{strings.Repeat("cell1", 6), strings.Repeat("cell2", 6), strings.Repeat("cell3", 6)}}
+
+	testCases := []struct {
+		truncatedColumn string
+		expectedWidth   int
+		expectedOutput  []string
+	}{
+		{
+			truncatedColumn: "column2",
+			expectedWidth:   80,
+			expectedOutput: []string{
+				"column1                        column2           column3                        ",
+				"------------------------------ ----------------- ------------------------------ ",
+				"cell1cell1cell1cell1cell1cell1 cell2cell2cell... cell3cell3cell3cell3cell3cell3 ",
+				"",
+			},
+		},
+		{
+			truncatedColumn: "column3",
+			expectedWidth:   80,
+			expectedOutput: []string{
+				"column1                        column2                        column3           ",
+				"------------------------------ ------------------------------ ----------------- ",
+				"cell1cell1cell1cell1cell1cell1 cell2cell2cell2cell2cell2cell2 cell3cell3cell... ",
+				"",
+			},
+		},
+		{
+			truncatedColumn: "no column match",
+			expectedWidth:   93,
+			expectedOutput: []string{
+				"column1                        column2                        column3                        ",
+				"------------------------------ ------------------------------ ------------------------------ ",
+				"cell1cell1cell1cell1cell1cell1 cell2cell2cell2cell2cell2cell2 cell3cell3cell3cell3cell3cell3 ",
+				"",
+			},
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.truncatedColumn, func(t *testing.T) {
+			table := MakeTableWithTruncatedColumn(columns, rows, testCase.truncatedColumn)
+			rows := strings.Split(table.AsBuffer().String(), "\n")
+			require.Len(t, rows, 4)
+			require.Len(t, rows[2], testCase.expectedWidth)
+			require.Equal(t, testCase.expectedOutput, rows)
+		})
+	}
+}
diff --git a/lib/auth/access.go b/lib/auth/access.go
index 2ec036cfe102b..d80d4df4d0cce 100644
--- a/lib/auth/access.go
+++ b/lib/auth/access.go
@@ -66,7 +66,7 @@ func (a *Server) DeleteRole(ctx context.Context, name string) error {
 	}
 	// check if it's used by some external cert authorities, e.g.
 	// cert authorities related to external cluster
-	cas, err := a.Trust.GetCertAuthorities(types.UserCA, false)
+	cas, err := a.Trust.GetCertAuthorities(ctx, types.UserCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/auth/access_test.go b/lib/auth/access_test.go
index 071ca60201631..07312080313c7 100644
--- a/lib/auth/access_test.go
+++ b/lib/auth/access_test.go
@@ -35,7 +35,7 @@ func TestUpsertDeleteRoleEventsEmitted(t *testing.T) {
 	require.NoError(t, err)
 
 	// test create new role
-	role, err := types.NewRole("test-role", types.RoleSpecV5{
+	role, err := types.NewRoleV3("test-role", types.RoleSpecV5{
 		Options: types.RoleOptions{},
 		Allow:   types.RoleConditions{},
 	})
diff --git a/lib/auth/accountrecovery.go b/lib/auth/accountrecovery.go
index 8a75c7725970d..4549177934806 100644
--- a/lib/auth/accountrecovery.go
+++ b/lib/auth/accountrecovery.go
@@ -260,7 +260,8 @@ func (s *Server) VerifyAccountRecovery(ctx context.Context, req *proto.VerifyAcc
 		}
 
 		if err := s.verifyAuthnWithRecoveryLock(ctx, startToken, func() error {
-			_, err := s.validateMFAAuthResponse(ctx, startToken.GetUser(), req.GetMFAAuthenticateResponse())
+			_, _, err := s.validateMFAAuthResponse(
+				ctx, req.GetMFAAuthenticateResponse(), startToken.GetUser(), false /* passwordless */)
 			return err
 		}); err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/auth/accountrecovery_test.go b/lib/auth/accountrecovery_test.go
index 6f3cf858e537b..2801ade330e36 100644
--- a/lib/auth/accountrecovery_test.go
+++ b/lib/auth/accountrecovery_test.go
@@ -1291,7 +1291,7 @@ func TestGetAccountRecoveryCodes(t *testing.T) {
 
 func triggerLoginLock(t *testing.T, srv *Server, username string) {
 	for i := 1; i <= defaults.MaxLoginAttempts; i++ {
-		_, err := srv.authenticateUser(context.Background(), AuthenticateUserRequest{
+		_, _, err := srv.authenticateUser(context.Background(), AuthenticateUserRequest{
 			Username: username,
 			OTP:      &OTPCreds{},
 		})
diff --git a/lib/auth/api.go b/lib/auth/api.go
index 21ae421ac4366..fd3a4a2041010 100644
--- a/lib/auth/api.go
+++ b/lib/auth/api.go
@@ -104,10 +104,10 @@ type ReadNodeAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -162,10 +162,10 @@ type ReadProxyAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -293,10 +293,10 @@ type ReadRemoteProxyAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -389,10 +389,10 @@ type ReadKubernetesAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -450,10 +450,10 @@ type ReadAppsAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -517,10 +517,10 @@ type ReadDatabaseAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -584,10 +584,10 @@ type ReadWindowsDesktopAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -642,10 +642,10 @@ type WindowsDesktopAccessPoint interface {
 // AccessCache is a subset of the interface working on the certificate authorities
 type AccessCache interface {
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterAuditConfig returns cluster audit configuration.
 	GetClusterAuditConfig(ctx context.Context, opts ...services.MarshalOption) (types.ClusterAuditConfig, error)
@@ -709,10 +709,10 @@ type Cache interface {
 	GetAuthServers() ([]types.Server, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetUser returns a services.User for this cluster.
 	GetUser(name string, withSecrets bool) (types.User, error)
@@ -809,6 +809,8 @@ type Cache interface {
 
 	// ListResources returns a paginated list of resources.
 	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
+	// ListWindowsDesktops returns a paginated list of windows desktops.
+	ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error)
 }
 
 type NodeWrapper struct {
diff --git a/lib/auth/apiserver.go b/lib/auth/apiserver.go
index a817888340efc..d9ee0df2029ad 100644
--- a/lib/auth/apiserver.go
+++ b/lib/auth/apiserver.go
@@ -22,7 +22,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -970,10 +969,7 @@ func (s *APIServer) registerUsingToken(auth ClientI, w http.ResponseWriter, r *h
 		return nil, trace.Wrap(err)
 	}
 
-	// Teleport 8 clients are still expecting the legacy JSON format.
-	// Teleport 9 clients handle both legacy and new.
-	// TODO(zmb3) return certs directly in Teleport 10
-	return LegacyCertsFromProto(certs), nil
+	return certs, nil
 }
 
 type registerNewAuthServerReq struct {
@@ -997,7 +993,7 @@ func (s *APIServer) rotateCertAuthority(auth ClientI, w http.ResponseWriter, r *
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := auth.RotateCertAuthority(req); err != nil {
+	if err := auth.RotateCertAuthority(r.Context(), req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return message("ok"), nil
@@ -1042,7 +1038,7 @@ func (s *APIServer) rotateExternalCertAuthority(auth ClientI, w http.ResponseWri
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := auth.RotateExternalCertAuthority(ca); err != nil {
+	if err := auth.RotateExternalCertAuthority(r.Context(), ca); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return message("ok"), nil
@@ -1053,7 +1049,7 @@ func (s *APIServer) getCertAuthorities(auth ClientI, w http.ResponseWriter, r *h
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	certs, err := auth.GetCertAuthorities(types.CertAuthType(p.ByName("type")), loadKeys)
+	certs, err := auth.GetCertAuthorities(r.Context(), types.CertAuthType(p.ByName("type")), loadKeys)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1077,7 +1073,7 @@ func (s *APIServer) getCertAuthority(auth ClientI, w http.ResponseWriter, r *htt
 		Type:       types.CertAuthType(p.ByName("type")),
 		DomainName: p.ByName("domain"),
 	}
-	ca, err := auth.GetCertAuthority(id, loadKeys)
+	ca, err := auth.GetCertAuthority(r.Context(), id, loadKeys)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1829,7 +1825,7 @@ func (s *APIServer) emitAuditEvent(auth ClientI, w http.ResponseWriter, r *http.
 
 // HTTP POST /:version/sessions/:id/slice
 func (s *APIServer) postSessionSlice(auth ClientI, w http.ResponseWriter, r *http.Request, p httprouter.Params, version string) (interface{}, error) {
-	data, err := ioutil.ReadAll(r.Body)
+	data, err := io.ReadAll(r.Body)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/auth.go b/lib/auth/auth.go
index 3709a85be4ed4..575c116029d6e 100644
--- a/lib/auth/auth.go
+++ b/lib/auth/auth.go
@@ -422,7 +422,7 @@ func (a *Server) runPeriodicOperations() {
 		case <-a.closeCtx.Done():
 			return
 		case <-ticker.Chan():
-			err := a.autoRotateCertAuthorities()
+			err := a.autoRotateCertAuthorities(ctx)
 			if err != nil {
 				if trace.IsCompareFailed(err) {
 					log.Debugf("Cert authority has been updated concurrently: %v.", err)
@@ -629,7 +629,7 @@ func (a *Server) GetClusterCACert() (*LocalCAResponse, error) {
 		return nil, trace.Wrap(err)
 	}
 	// Extract the TLS CA for this cluster.
-	hostCA, err := a.GetCache().GetCertAuthority(types.CertAuthID{
+	hostCA, err := a.GetCache().GetCertAuthority(context.TODO(), types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, false)
@@ -656,7 +656,7 @@ func (a *Server) GenerateHostCert(hostPublicKey []byte, hostID, nodeName string,
 	}
 
 	// get the certificate authority that will be signing the public key of the host
-	ca, err := a.Trust.GetCertAuthority(types.CertAuthID{
+	ca, err := a.Trust.GetCertAuthority(context.TODO(), types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: domainName,
 	}, true)
@@ -938,13 +938,14 @@ func (a *Server) GenerateDatabaseTestCert(req DatabaseTestCertRequest) ([]byte,
 
 // generateUserCert generates user certificates
 func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
+	ctx := context.TODO()
 	err := req.check()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	// Reject the cert request if there is a matching lock in force.
-	authPref, err := a.GetAuthPreference(context.TODO())
+	authPref, err := a.GetAuthPreference(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1029,7 +1030,7 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
 		}
 	}
 
-	userCA, err := a.Trust.GetCertAuthority(types.CertAuthID{
+	userCA, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: clusterName,
 	}, true)
@@ -1062,6 +1063,7 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
 		DisallowReissue:       req.disallowReissue,
 		Renewable:             req.renewable,
 		Generation:            req.generation,
+		CertificateExtensions: req.checker.CertificateExtensions(),
 	}
 	sshCert, err := a.Authority.GenerateUserCert(params)
 	if err != nil {
@@ -1182,7 +1184,7 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
 
 	// also include host CA certs if requested
 	if req.includeHostCA {
-		hostCA, err := a.Trust.GetCertAuthority(types.CertAuthID{
+		hostCA, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName,
 		}, false)
@@ -1307,6 +1309,7 @@ func (a *Server) PreAuthenticatedSignIn(user string, identity tlsca.Identity) (t
 // CreateAuthenticateChallenge implements AuthService.CreateAuthenticateChallenge.
 func (a *Server) CreateAuthenticateChallenge(ctx context.Context, req *proto.CreateAuthenticateChallengeRequest) (*proto.MFAAuthenticateChallenge, error) {
 	var username string
+	var passwordless bool
 
 	switch req.GetRequest().(type) {
 	case *proto.CreateAuthenticateChallengeRequest_UserCredentials:
@@ -1331,7 +1334,10 @@ func (a *Server) CreateAuthenticateChallenge(ctx context.Context, req *proto.Cre
 
 		username = token.GetUser()
 
-	default:
+	case *proto.CreateAuthenticateChallengeRequest_Passwordless:
+		passwordless = true // Allows empty username.
+
+	default: // unset or CreateAuthenticateChallengeRequest_ContextUser.
 		var err error
 		username, err = GetClientUsername(ctx)
 		if err != nil {
@@ -1339,7 +1345,7 @@ func (a *Server) CreateAuthenticateChallenge(ctx context.Context, req *proto.Cre
 		}
 	}
 
-	challenges, err := a.mfaAuthChallenge(ctx, username)
+	challenges, err := a.mfaAuthChallenge(ctx, username, passwordless)
 	if err != nil {
 		log.Error(trace.DebugReport(err))
 		return nil, trace.AccessDenied("unable to create MFA challenges")
@@ -1368,17 +1374,19 @@ func (a *Server) CreateRegisterChallenge(ctx context.Context, req *proto.CreateR
 	}
 
 	regChal, err := a.createRegisterChallenge(ctx, &newRegisterChallengeRequest{
-		username:   token.GetUser(),
-		token:      token,
-		deviceType: req.GetDeviceType(),
+		username:    token.GetUser(),
+		token:       token,
+		deviceType:  req.GetDeviceType(),
+		deviceUsage: req.GetDeviceUsage(),
 	})
 
 	return regChal, trace.Wrap(err)
 }
 
 type newRegisterChallengeRequest struct {
-	username   string
-	deviceType proto.DeviceType
+	username    string
+	deviceType  proto.DeviceType
+	deviceUsage proto.DeviceUsage
 
 	// token is a user token resource.
 	// It is used as following:
@@ -1447,7 +1455,8 @@ func (a *Server) createRegisterChallenge(ctx context.Context, req *newRegisterCh
 			Identity: identity,
 		}
 
-		credentialCreation, err := webRegistration.Begin(ctx, req.username, false /* passwordless */)
+		passwordless := req.deviceUsage == proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS
+		credentialCreation, err := webRegistration.Begin(ctx, req.username, passwordless)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -2053,7 +2062,7 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 	if req.NoCache {
 		client = a.Services
 	}
-	ca, err := client.GetCertAuthority(types.CertAuthID{
+	ca, err := client.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
@@ -2067,7 +2076,7 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 	// to the backend, which is a fine tradeoff
 	if !req.NoCache && req.Rotation != nil && !req.Rotation.Matches(ca.GetRotation()) {
 		log.Debugf("Client sent rotation state %v, cache state is %v, using state from the DB.", req.Rotation, ca.GetRotation())
-		ca, err = a.GetCertAuthority(types.CertAuthID{
+		ca, err = a.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName.GetClusterName(),
 		}, true)
@@ -2145,11 +2154,11 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 		NotAfter:  a.clock.Now().UTC().Add(defaults.CATTL),
 		DNSNames:  append([]string{}, req.AdditionalPrincipals...),
 	}
+
 	// API requests need to specify a DNS name, which must be present in the certificate's DNS Names.
 	// The target DNS is not always known in advance so we add a default one to all certificates.
-	if (types.SystemRoles{req.Role}).IncludeAny(types.RoleAuth, types.RoleAdmin, types.RoleProxy, types.RoleKube, types.RoleApp) {
-		certRequest.DNSNames = append(certRequest.DNSNames, "*."+constants.APIDomain, constants.APIDomain)
-	}
+	certRequest.DNSNames = append(certRequest.DNSNames, DefaultDNSNamesForRole(req.Role)...)
+
 	// Unlike additional principals, DNS Names is x509 specific and is limited
 	// to services with TLS endpoints (e.g. auth, proxies, kubernetes)
 	if (types.SystemRoles{req.Role}).IncludeAny(types.RoleAuth, types.RoleAdmin, types.RoleProxy, types.RoleKube, types.RoleWindowsDesktop) {
@@ -2577,14 +2586,14 @@ func (a *Server) NewKeepAliver(ctx context.Context) (types.KeepAliver, error) {
 
 // GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
 // controls if signing keys are loaded
-func (a *Server) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
-	return a.GetCache().GetCertAuthority(id, loadSigningKeys, opts...)
+func (a *Server) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+	return a.GetCache().GetCertAuthority(ctx, id, loadSigningKeys, opts...)
 }
 
 // GetCertAuthorities returns a list of authorities of a given type
 // loadSigningKeys controls whether signing keys should be loaded or not
-func (a *Server) GetCertAuthorities(caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
-	return a.GetCache().GetCertAuthorities(caType, loadSigningKeys, opts...)
+func (a *Server) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+	return a.GetCache().GetCertAuthorities(ctx, caType, loadSigningKeys, opts...)
 }
 
 // GenerateCertAuthorityCRL generates an empty CRL for the local CA of a given type.
@@ -2594,7 +2603,7 @@ func (a *Server) GenerateCertAuthorityCRL(ctx context.Context, caType types.Cert
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ca, err := a.GetCertAuthority(types.CertAuthID{
+	ca, err := a.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       caType,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
@@ -2708,9 +2717,31 @@ type ResourcePageFunc func(next []types.ResourceWithLabels) (stop bool, err erro
 // IterateResourcePages can be used to iterate over pages of resources.
 func (a *Server) IterateResourcePages(ctx context.Context, req proto.ListResourcesRequest, f ResourcePageFunc) (*types.ListResourcesResponse, error) {
 	for {
-		resp, err := a.ListResources(ctx, req)
-		if err != nil {
-			return nil, trace.Wrap(err)
+		var resp *types.ListResourcesResponse
+		switch {
+		case req.ResourceType == types.KindWindowsDesktop:
+			wResp, err := a.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+				WindowsDesktopFilter: req.WindowsDesktopFilter,
+				Limit:                int(req.Limit),
+				StartKey:             req.StartKey,
+				PredicateExpression:  req.PredicateExpression,
+				Labels:               req.Labels,
+				SearchKeywords:       req.SearchKeywords,
+				SortBy:               req.SortBy,
+			})
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			resp = &types.ListResourcesResponse{
+				Resources: types.WindowsDesktops(wResp.Desktops).AsResources(),
+				NextKey:   wResp.NextKey,
+			}
+		default:
+			dResp, err := a.ListResources(ctx, req)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			resp = dResp
 		}
 
 		stop, err := f(resp.Resources)
@@ -3003,11 +3034,16 @@ func (a *Server) GetDatabase(ctx context.Context, name string) (types.Database,
 	return a.GetCache().GetDatabase(ctx, name)
 }
 
-// GetDatabases returns all database resources.
+// ListResources returns paginated resources depending on the resource type..
 func (a *Server) ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
 	return a.GetCache().ListResources(ctx, req)
 }
 
+// ListWindowsDesktops returns paginated windows desktops.
+func (a *Server) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
+	return a.GetCache().ListWindowsDesktops(ctx, req)
+}
+
 // GetLock gets a lock by name from the auth server's cache.
 func (a *Server) GetLock(ctx context.Context, name string) (types.Lock, error) {
 	return a.GetCache().GetLock(ctx, name)
@@ -3184,7 +3220,7 @@ func (a *Server) isMFARequired(ctx context.Context, checker services.AccessCheck
 
 // mfaAuthChallenge constructs an MFAAuthenticateChallenge for all MFA devices
 // registered by the user.
-func (a *Server) mfaAuthChallenge(ctx context.Context, user string) (*proto.MFAAuthenticateChallenge, error) {
+func (a *Server) mfaAuthChallenge(ctx context.Context, user string, passwordless bool) (*proto.MFAAuthenticateChallenge, error) {
 	// Check what kind of MFA is enabled.
 	apref, err := a.GetAuthPreference(ctx)
 	if err != nil {
@@ -3212,16 +3248,42 @@ func (a *Server) mfaAuthChallenge(ctx context.Context, user string) (*proto.MFAA
 		webConfig = val
 	}
 
-	devs, err := a.Identity.GetMFADevices(ctx, user, true)
+	// Handle passwordless separately, it works differently from MFA.
+	if passwordless {
+		if !enableWebauthn {
+			return nil, trace.BadParameter("passwordless requires WebAuthn")
+		}
+		webLogin := &wanlib.PasswordlessFlow{
+			Webauthn: webConfig,
+			Identity: a.Identity,
+		}
+		assertion, err := webLogin.Begin(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return &proto.MFAAuthenticateChallenge{
+			WebauthnChallenge: wanlib.CredentialAssertionToProto(assertion),
+		}, nil
+	}
+
+	// User required for non-passwordless.
+	if user == "" {
+		return nil, trace.BadParameter("user required")
+	}
+
+	devs, err := a.Identity.GetMFADevices(ctx, user, true /* withSecrets */)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-
 	groupedDevs := groupByDeviceType(devs, enableWebauthn)
 	challenge := &proto.MFAAuthenticateChallenge{}
+
+	// TOTP challenge.
 	if enableTOTP && groupedDevs.TOTP {
 		challenge.TOTP = &proto.TOTPChallenge{}
 	}
+
+	// WebAuthn challenge.
 	if len(groupedDevs.Webauthn) > 0 {
 		webLogin := &wanlib.LoginFlow{
 			U2F:      u2fPref,
@@ -3264,32 +3326,63 @@ func groupByDeviceType(devs []*types.MFADevice, groupWebauthn bool) devicesByTyp
 	return res
 }
 
-func (a *Server) validateMFAAuthResponse(ctx context.Context, user string, resp *proto.MFAAuthenticateResponse) (*types.MFADevice, error) {
+// validateMFAAuthResponse validates an MFA or passwordless challenge.
+// Returns the device used to solve the challenge (if applicable) and the
+// username.
+func (a *Server) validateMFAAuthResponse(
+	ctx context.Context,
+	resp *proto.MFAAuthenticateResponse, user string, passwordless bool) (*types.MFADevice, string, error) {
+	// Sanity check user/passwordless.
+	if user == "" && !passwordless {
+		return nil, "", trace.BadParameter("user required")
+	}
+
 	switch res := resp.Response.(type) {
-	case *proto.MFAAuthenticateResponse_TOTP:
-		return a.checkOTP(user, res.TOTP.Code)
+	// cases in order of preference
 	case *proto.MFAAuthenticateResponse_Webauthn:
+		// Read necessary configurations.
 		cap, err := a.GetAuthPreference(ctx)
 		if err != nil {
-			return nil, trace.Wrap(err)
+			return nil, "", trace.Wrap(err)
+		}
+		u2f, err := cap.GetU2F()
+		switch {
+		case trace.IsNotFound(err): // OK, may happen.
+		case err != nil: // Unexpected.
+			return nil, "", trace.Wrap(err)
 		}
-		u2f, _ := cap.GetU2F()
 		webConfig, err := cap.GetWebauthn()
 		if err != nil {
-			return nil, trace.Wrap(err)
+			return nil, "", trace.Wrap(err)
 		}
-		webLogin := &wanlib.LoginFlow{
-			U2F:      u2f,
-			Webauthn: webConfig,
-			Identity: a.Identity,
+
+		assertionResp := wanlib.CredentialAssertionResponseFromProto(res.Webauthn)
+		var dev *types.MFADevice
+		if passwordless {
+			webLogin := &wanlib.PasswordlessFlow{
+				Webauthn: webConfig,
+				Identity: a.Identity,
+			}
+			dev, user, err = webLogin.Finish(ctx, assertionResp)
+		} else {
+			webLogin := &wanlib.LoginFlow{
+				U2F:      u2f,
+				Webauthn: webConfig,
+				Identity: a.Identity,
+			}
+			dev, err = webLogin.Finish(ctx, user, wanlib.CredentialAssertionResponseFromProto(res.Webauthn))
 		}
-		dev, err := webLogin.Finish(ctx, user, wanlib.CredentialAssertionResponseFromProto(res.Webauthn))
 		if err != nil {
-			return nil, trace.AccessDenied("MFA response validation failed: %v", err)
+			return nil, "", trace.AccessDenied("MFA response validation failed: %v", err)
 		}
-		return dev, nil
+		return dev, user, nil
+
+	case *proto.MFAAuthenticateResponse_TOTP:
+		dev, err := a.checkOTP(user, res.TOTP.Code)
+		return dev, user, trace.Wrap(err)
+
 	default:
-		return nil, trace.BadParameter("unknown or missing MFAAuthenticateResponse type %T", resp.Response)
+		return nil, "", trace.BadParameter("unknown or missing MFAAuthenticateResponse type %T", resp.Response)
 	}
 }
 
@@ -3343,6 +3436,7 @@ func mergeKeySets(a, b types.CAKeySet) types.CAKeySet {
 // addAdditionalTrustedKeysAtomic performs an atomic CompareAndSwap to update
 // the given CA with newKeys added to the AdditionalTrustedKeys
 func (a *Server) addAddtionalTrustedKeysAtomic(
+	ctx context.Context,
 	currentCA types.CertAuthority,
 	newKeys types.CAKeySet,
 	needsUpdate func(types.CertAuthority) bool) error {
@@ -3373,7 +3467,7 @@ func (a *Server) addAddtionalTrustedKeysAtomic(
 		}
 		// else trace.IsCompareFailed(err) == true (CA was concurrently updated)
 
-		currentCA, err = a.Trust.GetCertAuthority(currentCA.GetID(), true)
+		currentCA, err = a.Trust.GetCertAuthority(ctx, currentCA.GetID(), true)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -3408,7 +3502,7 @@ func newKeySet(keyStore keystore.KeyStore, caID types.CertAuthID) (types.CAKeySe
 
 // ensureLocalAdditionalKeys adds additional trusted keys to the CA if they are not
 // already present.
-func (a *Server) ensureLocalAdditionalKeys(ca types.CertAuthority) error {
+func (a *Server) ensureLocalAdditionalKeys(ctx context.Context, ca types.CertAuthority) error {
 	if a.keyStore.HasLocalAdditionalKeys(ca) {
 		// nothing to do
 		return nil
@@ -3419,7 +3513,7 @@ func (a *Server) ensureLocalAdditionalKeys(ca types.CertAuthority) error {
 		return trace.Wrap(err)
 	}
 
-	err = a.addAddtionalTrustedKeysAtomic(ca, newKeySet, func(ca types.CertAuthority) bool {
+	err = a.addAddtionalTrustedKeysAtomic(ctx, ca, newKeySet, func(ca types.CertAuthority) bool {
 		return !a.keyStore.HasLocalAdditionalKeys(ca)
 	})
 	if err != nil {
@@ -3457,7 +3551,7 @@ func (a *Server) createSelfSignedCA(caID types.CertAuthID) error {
 
 // deleteUnusedKeys deletes all teleport keys held in a connected HSM for this
 // auth server which are not currently used in any CAs.
-func (a *Server) deleteUnusedKeys() error {
+func (a *Server) deleteUnusedKeys(ctx context.Context) error {
 	clusterName, err := a.GetClusterName()
 	if err != nil {
 		return trace.Wrap(err)
@@ -3466,7 +3560,7 @@ func (a *Server) deleteUnusedKeys() error {
 	var usedKeys [][]byte
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
 		caID := types.CertAuthID{Type: caType, DomainName: clusterName.GetClusterName()}
-		ca, err := a.Trust.GetCertAuthority(caID, true)
+		ca, err := a.Trust.GetCertAuthority(ctx, caID, true)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -3700,3 +3794,14 @@ func WithClusterCAs(tlsConfig *tls.Config, ap AccessCache, currentClusterName st
 		return tlsCopy, nil
 	}
 }
+
+// DefaultDNSNamesForRole returns default DNS names for the specified role.
+func DefaultDNSNamesForRole(role types.SystemRole) []string {
+	if (types.SystemRoles{role}).IncludeAny(types.RoleAuth, types.RoleAdmin, types.RoleProxy, types.RoleKube, types.RoleApp, types.RoleDatabase, types.RoleWindowsDesktop) {
+		return []string{
+			"*." + constants.APIDomain,
+			constants.APIDomain,
+		}
+	}
+	return nil
+}
diff --git a/lib/auth/auth_login_test.go b/lib/auth/auth_login_test.go
index e17e1b79d8f8c..84944ed8219b3 100644
--- a/lib/auth/auth_login_test.go
+++ b/lib/auth/auth_login_test.go
@@ -22,10 +22,12 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
+	"github.com/gravitational/teleport/lib/auth/mocku2f"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 )
 
 func TestServer_CreateAuthenticateChallenge_authPreference(t *testing.T) {
@@ -156,7 +158,8 @@ func TestServer_CreateAuthenticateChallenge_authPreference(t *testing.T) {
 					UserCredentials: &proto.UserCredentials{
 						Username: username,
 						Password: []byte(password),
-					}},
+					},
+				},
 			})
 			require.NoError(t, err)
 			test.assertChallenge(challenge)
@@ -164,85 +167,6 @@ func TestServer_CreateAuthenticateChallenge_authPreference(t *testing.T) {
 	}
 }
 
-// sshPubKey is a randomly-generated public key used for login tests.
-//
-// The corresponding private key is:
-// -----BEGIN PRIVATE KEY-----
-// MHcCAQEEIAKuZeB4WL4KAl5cnCrMYBy3kAX9qHt/g6OAbGGd7f3VoAoGCCqGSM49
-// AwEHoUQDQgAEa/6A3YLbc/TyJ4lED2BT8iThuw6HcrDX3dRixwkPDjWYBOP4qrJ/
-// jlGaPwXyuzeLuZgpFde7UiM1EHM2ClfGpw==
-// -----END PRIVATE KEY-----
-const sshPubKey = `ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGv+gN2C23P08ieJRA9gU/Ik4bsOh3Kw193UYscJDw41mATj+Kqyf45Rmj8F8rs3i7mYKRXXu1IjNRBzNgpXxqc=`
-
-func TestServer_AuthenticateUser_mfaDevices(t *testing.T) {
-	t.Parallel()
-
-	svr := newTestTLSServer(t)
-	authServer := svr.Auth()
-	mfa := configureForMFA(t, svr)
-	username := mfa.User
-	password := mfa.Password
-
-	tests := []struct {
-		name           string
-		solveChallenge func(*proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error)
-	}{
-		{name: "OK TOTP device", solveChallenge: mfa.TOTPDev.SolveAuthn},
-		{name: "OK Webauthn device", solveChallenge: mfa.WebDev.SolveAuthn},
-	}
-	for _, test := range tests {
-		test := test
-		// makeRun is used to test both SSH and Web login by switching the
-		// authenticate function.
-		makeRun := func(authenticate func(*Server, AuthenticateUserRequest) error) func(t *testing.T) {
-			return func(t *testing.T) {
-				// 1st step: acquire challenge
-				challenge, err := authServer.CreateAuthenticateChallenge(context.Background(), &proto.CreateAuthenticateChallengeRequest{
-					Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{UserCredentials: &proto.UserCredentials{
-						Username: username,
-						Password: []byte(password),
-					}},
-				})
-				require.NoError(t, err)
-
-				// Solve challenge (client-side)
-				resp, err := test.solveChallenge(challenge)
-				authReq := AuthenticateUserRequest{
-					Username: username,
-				}
-				require.NoError(t, err)
-
-				switch {
-				case resp.GetWebauthn() != nil:
-					authReq.Webauthn = wanlib.CredentialAssertionResponseFromProto(resp.GetWebauthn())
-				case resp.GetTOTP() != nil:
-					authReq.OTP = &OTPCreds{
-						Password: []byte(password),
-						Token:    resp.GetTOTP().Code,
-					}
-				default:
-					t.Fatalf("Unexpected solved challenge type: %T", resp.Response)
-				}
-
-				// 2nd step: finish login - either SSH or Web
-				require.NoError(t, authenticate(authServer, authReq))
-			}
-		}
-		t.Run(test.name+"/ssh", makeRun(func(s *Server, req AuthenticateUserRequest) error {
-			_, err := s.AuthenticateSSHUser(AuthenticateSSHRequest{
-				AuthenticateUserRequest: req,
-				PublicKey:               []byte(sshPubKey),
-				TTL:                     24 * time.Hour,
-			})
-			return err
-		}))
-		t.Run(test.name+"/web", makeRun(func(s *Server, req AuthenticateUserRequest) error {
-			_, err := s.AuthenticateWebUser(req)
-			return err
-		}))
-	}
-}
-
 func TestCreateAuthenticateChallenge_WithAuth(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
@@ -261,7 +185,7 @@ func TestCreateAuthenticateChallenge_WithAuth(t *testing.T) {
 	// TODO(codingllama): Use a public endpoint to verify?
 	mfaResp, err := u.webDev.SolveAuthn(res)
 	require.NoError(t, err)
-	_, err = srv.Auth().validateMFAAuthResponse(ctx, u.username, mfaResp)
+	_, _, err = srv.Auth().validateMFAAuthResponse(ctx, mfaResp, u.username, false /* passwordless */)
 	require.NoError(t, err)
 }
 
@@ -476,6 +400,310 @@ func TestCreateRegisterChallenge(t *testing.T) {
 	}
 }
 
+// sshPubKey is a randomly-generated public key used for login tests.
+//
+// The corresponding private key is:
+// -----BEGIN PRIVATE KEY-----
+// MHcCAQEEIAKuZeB4WL4KAl5cnCrMYBy3kAX9qHt/g6OAbGGd7f3VoAoGCCqGSM49
+// AwEHoUQDQgAEa/6A3YLbc/TyJ4lED2BT8iThuw6HcrDX3dRixwkPDjWYBOP4qrJ/
+// jlGaPwXyuzeLuZgpFde7UiM1EHM2ClfGpw==
+// -----END PRIVATE KEY-----
+const sshPubKey = `ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGv+gN2C23P08ieJRA9gU/Ik4bsOh3Kw193UYscJDw41mATj+Kqyf45Rmj8F8rs3i7mYKRXXu1IjNRBzNgpXxqc=`
+
+func TestServer_AuthenticateUser_mfaDevices(t *testing.T) {
+	t.Parallel()
+
+	svr := newTestTLSServer(t)
+	authServer := svr.Auth()
+	mfa := configureForMFA(t, svr)
+	username := mfa.User
+	password := mfa.Password
+
+	tests := []struct {
+		name           string
+		solveChallenge func(*proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error)
+	}{
+		{name: "OK TOTP device", solveChallenge: mfa.TOTPDev.SolveAuthn},
+		{name: "OK Webauthn device", solveChallenge: mfa.WebDev.SolveAuthn},
+	}
+	for _, test := range tests {
+		test := test
+		// makeRun is used to test both SSH and Web login by switching the
+		// authenticate function.
+		makeRun := func(authenticate func(*Server, AuthenticateUserRequest) error) func(t *testing.T) {
+			return func(t *testing.T) {
+				// 1st step: acquire challenge
+				challenge, err := authServer.CreateAuthenticateChallenge(context.Background(), &proto.CreateAuthenticateChallengeRequest{
+					Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{UserCredentials: &proto.UserCredentials{
+						Username: username,
+						Password: []byte(password),
+					}},
+				})
+				require.NoError(t, err)
+
+				// Solve challenge (client-side)
+				resp, err := test.solveChallenge(challenge)
+				authReq := AuthenticateUserRequest{
+					Username: username,
+				}
+				require.NoError(t, err)
+
+				switch {
+				case resp.GetWebauthn() != nil:
+					authReq.Webauthn = wanlib.CredentialAssertionResponseFromProto(resp.GetWebauthn())
+				case resp.GetTOTP() != nil:
+					authReq.OTP = &OTPCreds{
+						Password: []byte(password),
+						Token:    resp.GetTOTP().Code,
+					}
+				default:
+					t.Fatalf("Unexpected solved challenge type: %T", resp.Response)
+				}
+
+				// 2nd step: finish login - either SSH or Web
+				require.NoError(t, authenticate(authServer, authReq))
+			}
+		}
+		t.Run(test.name+"/ssh", makeRun(func(s *Server, req AuthenticateUserRequest) error {
+			_, err := s.AuthenticateSSHUser(AuthenticateSSHRequest{
+				AuthenticateUserRequest: req,
+				PublicKey:               []byte(sshPubKey),
+				TTL:                     24 * time.Hour,
+			})
+			return err
+		}))
+		t.Run(test.name+"/web", makeRun(func(s *Server, req AuthenticateUserRequest) error {
+			_, err := s.AuthenticateWebUser(req)
+			return err
+		}))
+	}
+}
+
+func TestServer_Authenticate_passwordless(t *testing.T) {
+	t.Parallel()
+	svr := newTestTLSServer(t)
+	authServer := svr.Auth()
+
+	// Configure Auth separately, we want a passwordless-capable device
+	// registered too.
+	ctx := context.Background()
+	authPreference, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
+		Type:         constants.Local,
+		SecondFactor: constants.SecondFactorOptional,
+		Webauthn: &types.Webauthn{
+			RPID: "localhost",
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, authServer.SetAuthPreference(ctx, authPreference))
+
+	// Create user and initial WebAuthn device (MFA).
+	const user = "llama"
+	const password = "p@ssw0rd"
+	_, _, err = CreateUserAndRole(authServer, user, []string{"llama", "root"})
+	require.NoError(t, err)
+	require.NoError(t, authServer.UpsertPassword(user, []byte(password)))
+	userClient, err := svr.NewClient(TestUser(user))
+	require.NoError(t, err)
+	webDev, err := RegisterTestDevice(
+		ctx, userClient, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	require.NoError(t, err)
+
+	// Acquire a privilege token so we can register a passwordless device
+	// synchronously.
+	mfaChallenge, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
+		Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
+			ContextUser: &proto.ContextUser{}, // already authenticated
+		},
+	})
+	require.NoError(t, err)
+	mfaResp, err := webDev.SolveAuthn(mfaChallenge)
+	require.NoError(t, err)
+	token, err := userClient.CreatePrivilegeToken(ctx, &proto.CreatePrivilegeTokenRequest{
+		ExistingMFAResponse: mfaResp,
+	})
+	require.NoError(t, err)
+
+	// Register passwordless device.
+	registerChallenge, err := userClient.CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
+		TokenID:     token.GetName(),
+		DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
+		DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
+	})
+	require.NoError(t, err, "Failed to create passwordless registration challenge")
+	pwdKey, err := mocku2f.Create()
+	require.NoError(t, err)
+	pwdKey.SetPasswordless()
+	const origin = "https://localhost"
+	ccr, err := pwdKey.SignCredentialCreation(origin, wanlib.CredentialCreationFromProto(registerChallenge.GetWebauthn()))
+	require.NoError(t, err)
+	_, err = userClient.AddMFADeviceSync(ctx, &proto.AddMFADeviceSyncRequest{
+		TokenID:       token.GetName(),
+		NewDeviceName: "pwdless1",
+		NewMFAResponse: &proto.MFARegisterResponse{
+			Response: &proto.MFARegisterResponse_Webauthn{
+				Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
+			},
+		},
+	})
+	require.NoError(t, err, "Failed to register passwordless device")
+
+	// userWebID is what identifies the user for usernameless/passwordless.
+	userWebID := registerChallenge.GetWebauthn().PublicKey.User.Id
+
+	// Use a proxy client for now on; the user's identity isn't established yet.
+	proxyClient, err := svr.NewClient(TestBuiltin(types.RoleProxy))
+	require.NoError(t, err)
+
+	tests := []struct {
+		name         string
+		authenticate func(t *testing.T, resp *wanlib.CredentialAssertionResponse)
+	}{
+		{
+			name: "ssh",
+			authenticate: func(t *testing.T, resp *wanlib.CredentialAssertionResponse) {
+				loginResp, err := proxyClient.AuthenticateSSHUser(AuthenticateSSHRequest{
+					AuthenticateUserRequest: AuthenticateUserRequest{
+						Webauthn: resp,
+					},
+					PublicKey: []byte(sshPubKey),
+					TTL:       24 * time.Hour,
+				})
+				require.NoError(t, err, "Failed to perform passwordless authentication")
+				require.NotNil(t, loginResp, "SSH response nil")
+				require.NotEmpty(t, loginResp.Cert, "SSH certificate empty")
+				require.Equal(t, user, loginResp.Username, "Unexpected username")
+			},
+		},
+		{
+			name: "web",
+			authenticate: func(t *testing.T, resp *wanlib.CredentialAssertionResponse) {
+				session, err := proxyClient.AuthenticateWebUser(AuthenticateUserRequest{
+					Webauthn: resp,
+				})
+				require.NoError(t, err, "Failed to perform passwordless authentication")
+				require.Equal(t, user, session.GetUser(), "Unexpected username")
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// Fail a login attempt so have a non-empty list of attempts.
+			_, err := proxyClient.AuthenticateSSHUser(AuthenticateSSHRequest{
+				AuthenticateUserRequest: AuthenticateUserRequest{
+					Username: user,
+					Webauthn: &wanlib.CredentialAssertionResponse{}, // bad response
+				},
+				PublicKey: []byte(sshPubKey),
+				TTL:       24 * time.Hour,
+			})
+			require.True(t, trace.IsAccessDenied(err), "got err = %v, want AccessDenied")
+			attempts, err := authServer.GetUserLoginAttempts(user)
+			require.NoError(t, err)
+			require.NotEmpty(t, attempts, "Want at least one failed login attempt")
+
+			// Create a passwordless challenge.
+			mfaChallenge, err := proxyClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
+				Request: &proto.CreateAuthenticateChallengeRequest_Passwordless{
+					Passwordless: &proto.Passwordless{},
+				},
+			})
+			require.NoError(t, err, "Failed to create passwordless challenge")
+
+			// Sign challenge (mocks user interaction).
+			assertionResp, err := pwdKey.SignAssertion(origin, wanlib.CredentialAssertionFromProto(mfaChallenge.GetWebauthnChallenge()))
+			require.NoError(t, err)
+			assertionResp.AssertionResponse.UserHandle = userWebID // identify user, a real device would set this
+
+			// Complete login procedure (SSH or Web).
+			test.authenticate(t, assertionResp)
+
+			// Verify zeroed login attempts. This is a proxy for various other user
+			// checks (locked, etc).
+			attempts, err = authServer.GetUserLoginAttempts(user)
+			require.NoError(t, err)
+			require.Empty(t, attempts, "Login attempts not reset")
+		})
+	}
+}
+
+func TestServer_Authenticate_nonPasswordlessRequiresUsername(t *testing.T) {
+	t.Parallel()
+	svr := newTestTLSServer(t)
+
+	// We don't mind about the specifics of the configuration, as long as we have
+	// a user and TOTP/WebAuthn devices.
+	mfa := configureForMFA(t, svr)
+	username := mfa.User
+	password := mfa.Password
+
+	userClient, err := svr.NewClient(TestUser(username))
+	require.NoError(t, err)
+	proxyClient, err := svr.NewClient(TestBuiltin(types.RoleProxy))
+	require.NoError(t, err)
+
+	ctx := context.Background()
+	tests := []struct {
+		name    string
+		dev     *TestDevice
+		wantErr string
+	}{
+		{
+			name:    "OTP",
+			dev:     mfa.TOTPDev,
+			wantErr: "username", // Error contains "username"
+		},
+		{
+			name:    "WebAuthn",
+			dev:     mfa.WebDev,
+			wantErr: "invalid Webauthn response", // generic error as it _could_ be a passwordless attempt
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			mfaChallenge, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
+				Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
+					ContextUser: &proto.ContextUser{},
+				},
+			})
+			require.NoError(t, err)
+
+			mfaResp, err := test.dev.SolveAuthn(mfaChallenge)
+			require.NoError(t, err)
+
+			var req AuthenticateUserRequest
+			switch {
+			case mfaResp.GetWebauthn() != nil:
+				req.Webauthn = wanlib.CredentialAssertionResponseFromProto(mfaResp.GetWebauthn())
+			case mfaResp.GetTOTP() != nil:
+				req.OTP = &OTPCreds{
+					Password: []byte(password),
+					Token:    mfaResp.GetTOTP().Code,
+				}
+			}
+
+			// SSH.
+			_, err = proxyClient.AuthenticateSSHUser(AuthenticateSSHRequest{
+				AuthenticateUserRequest: req,
+				PublicKey:               []byte(sshPubKey),
+				TTL:                     24 * time.Hour,
+			})
+			require.Error(t, err, "SSH authentication expected fail (missing username)")
+			require.Contains(t, err.Error(), test.wantErr)
+
+			// Web.
+			_, err = proxyClient.AuthenticateWebUser(req)
+			require.Error(t, err, "Web authentication expected fail (missing username)")
+			require.Contains(t, err.Error(), test.wantErr)
+
+			// Get one right so we don't lock the user between tests.
+			req.Username = username
+			_, err = proxyClient.AuthenticateWebUser(req)
+			require.NoError(t, err, "Web authentication expected to succeed")
+		})
+	}
+}
+
 type configureMFAResp struct {
 	User, Password  string
 	TOTPDev, WebDev *TestDevice
diff --git a/lib/auth/auth_test.go b/lib/auth/auth_test.go
index 077e08b01eb5f..08b7d2813712f 100644
--- a/lib/auth/auth_test.go
+++ b/lib/auth/auth_test.go
@@ -1030,6 +1030,44 @@ func TestEmitSSOLoginFailureEvent(t *testing.T) {
 	})
 }
 
+func TestGenerateUserCertWithCertExtension(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	p, err := newTestPack(ctx, t.TempDir())
+	require.NoError(t, err)
+
+	user, role, err := CreateUserAndRole(p.a, "test-user", []string{})
+	require.NoError(t, err)
+
+	extension := types.CertExtension{
+		Name:  "abc",
+		Value: "cde",
+		Type:  types.CertExtensionType_SSH,
+		Mode:  types.CertExtensionMode_EXTENSION,
+	}
+	options := role.GetOptions()
+	options.CertExtensions = []*types.CertExtension{&extension}
+	role.SetOptions(options)
+
+	keygen := testauthority.New()
+	_, pub, err := keygen.GetNewKeyPairFromPool()
+	require.NoError(t, err)
+	certReq := certRequest{
+		user:      user,
+		checker:   services.NewRoleSet(role),
+		publicKey: pub,
+	}
+	certs, err := p.a.generateUserCert(certReq)
+	require.NoError(t, err)
+
+	key, err := sshutils.ParseCertificate(certs.SSH)
+	require.NoError(t, err)
+
+	val, ok := key.Extensions[extension.Name]
+	require.True(t, ok)
+	require.Equal(t, extension.Value, val)
+}
+
 func TestGenerateUserCertWithLocks(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
diff --git a/lib/auth/auth_with_roles.go b/lib/auth/auth_with_roles.go
index 2396c4c8b6003..b173dd0eebba8 100644
--- a/lib/auth/auth_with_roles.go
+++ b/lib/auth/auth_with_roles.go
@@ -95,23 +95,6 @@ func (a *ServerWithRoles) withOptions(opts ...actionOption) actionConfig {
 	return cfg
 }
 
-func (a *ServerWithRoles) withStaticRoles() (actionConfig, error) {
-	user, err := a.authServer.GetUser(a.context.User.GetName(), false)
-	if err != nil {
-		return actionConfig{}, trace.Wrap(err)
-	}
-
-	checker, err := services.FetchRoles(user.GetRoles(), a.authServer, user.GetTraits())
-	if err != nil {
-		return actionConfig{}, trace.Wrap(err)
-	}
-
-	return actionConfig{context: Context{
-		User:    user,
-		Checker: checker,
-	}}, nil
-}
-
 func (c actionConfig) action(namespace, resource string, verbs ...string) error {
 	if len(verbs) == 0 {
 		return trace.BadParameter("no verbs provided for authorization check on resource %q", resource)
@@ -400,28 +383,28 @@ func (a *ServerWithRoles) CreateCertAuthority(ca types.CertAuthority) error {
 }
 
 // RotateCertAuthority starts or restarts certificate authority rotation process.
-func (a *ServerWithRoles) RotateCertAuthority(req RotateRequest) error {
+func (a *ServerWithRoles) RotateCertAuthority(ctx context.Context, req RotateRequest) error {
 	if err := req.CheckAndSetDefaults(a.authServer.clock); err != nil {
 		return trace.Wrap(err)
 	}
 	if err := a.action(apidefaults.Namespace, types.KindCertAuthority, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
-	return a.authServer.RotateCertAuthority(req)
+	return a.authServer.RotateCertAuthority(ctx, req)
 }
 
 // RotateExternalCertAuthority rotates external certificate authority,
 // this method is called by a remote trusted cluster and is used to update
 // only public keys and certificates of the certificate authority.
-func (a *ServerWithRoles) RotateExternalCertAuthority(ca types.CertAuthority) error {
+func (a *ServerWithRoles) RotateExternalCertAuthority(ctx context.Context, ca types.CertAuthority) error {
 	if ca == nil {
 		return trace.BadParameter("missing certificate authority")
 	}
-	ctx := &services.Context{User: a.context.User, Resource: ca}
-	if err := a.actionWithContext(ctx, apidefaults.Namespace, types.KindCertAuthority, types.VerbRotate); err != nil {
+	sctx := &services.Context{User: a.context.User, Resource: ca}
+	if err := a.actionWithContext(sctx, apidefaults.Namespace, types.KindCertAuthority, types.VerbRotate); err != nil {
 		return trace.Wrap(err)
 	}
-	return a.authServer.RotateExternalCertAuthority(ca)
+	return a.authServer.RotateExternalCertAuthority(ctx, ca)
 }
 
 // UpsertCertAuthority updates existing cert authority or updates the existing one.
@@ -445,7 +428,7 @@ func (a *ServerWithRoles) CompareAndSwapCertAuthority(new, existing types.CertAu
 	return a.authServer.CompareAndSwapCertAuthority(new, existing)
 }
 
-func (a *ServerWithRoles) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (a *ServerWithRoles) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	if err := a.action(apidefaults.Namespace, types.KindCertAuthority, types.VerbList, types.VerbReadNoSecrets); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -454,10 +437,10 @@ func (a *ServerWithRoles) GetCertAuthorities(caType types.CertAuthType, loadKeys
 			return nil, trace.Wrap(err)
 		}
 	}
-	return a.authServer.GetCertAuthorities(caType, loadKeys, opts...)
+	return a.authServer.GetCertAuthorities(ctx, caType, loadKeys, opts...)
 }
 
-func (a *ServerWithRoles) GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (a *ServerWithRoles) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	if err := a.action(apidefaults.Namespace, types.KindCertAuthority, types.VerbReadNoSecrets); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -466,7 +449,7 @@ func (a *ServerWithRoles) GetCertAuthority(id types.CertAuthID, loadKeys bool, o
 			return nil, trace.Wrap(err)
 		}
 	}
-	return a.authServer.GetCertAuthority(id, loadKeys, opts...)
+	return a.authServer.GetCertAuthority(ctx, id, loadKeys, opts...)
 }
 
 func (a *ServerWithRoles) GetDomainName() (string, error) {
@@ -914,7 +897,7 @@ func (a *ServerWithRoles) ListResources(ctx context.Context, req proto.ListResou
 		//   https://github.com/gravitational/teleport/pull/1224
 		actionVerbs = []string{types.VerbList}
 
-	case types.KindDatabaseServer, types.KindAppServer, types.KindKubeService:
+	case types.KindDatabaseServer, types.KindAppServer, types.KindKubeService, types.KindWindowsDesktop:
 
 	default:
 		return nil, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
@@ -991,6 +974,8 @@ func (a *ServerWithRoles) checkAccessToResource(resource types.Resource) error {
 		default:
 			return trace.BadParameter("could not check access to server type %q", resource.GetKind())
 		}
+	case types.WindowsDesktop:
+		return a.checkAccessToWindowsDesktop(r)
 	default:
 		return trace.BadParameter("could not check access to resource type %T", r)
 	}
@@ -1041,6 +1026,42 @@ func (a *ServerWithRoles) listResourcesWithSort(ctx context.Context, req proto.L
 		}
 		resources = servers.AsResources()
 
+	case types.KindKubernetesCluster:
+		kubeservices, err := a.GetKubeServices(ctx)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		// Extract kube clusters into its own list.
+		clusters := []types.KubeCluster{}
+		for _, svc := range kubeservices {
+			for _, legacyCluster := range svc.GetKubernetesClusters() {
+				cluster, err := types.NewKubernetesClusterV3FromLegacyCluster(svc.GetNamespace(), legacyCluster)
+				if err != nil {
+					return nil, trace.Wrap(err)
+				}
+				clusters = append(clusters, cluster)
+			}
+		}
+
+		sortedClusters := types.KubeClusters(types.DeduplicateKubeClusters(clusters))
+		if err := sortedClusters.SortByCustom(req.SortBy); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		resources = sortedClusters.AsResources()
+
+	case types.KindWindowsDesktop:
+		windowsdesktops, err := a.GetWindowsDesktops(ctx, req.GetWindowsDesktopFilter())
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		desktops := types.WindowsDesktops(windowsdesktops)
+		if err := desktops.SortByCustom(req.SortBy); err != nil {
+			return nil, trace.Wrap(err)
+		}
+		resources = desktops.AsResources()
+
 	default:
 		return nil, trace.NotImplemented("resource type %q is not supported for listResourcesWithSort", req.ResourceType)
 	}
@@ -1054,6 +1075,11 @@ func (a *ServerWithRoles) listResourcesWithSort(ctx context.Context, req proto.L
 	return resp, nil
 }
 
+// ListWindowsDesktops not implemented: can only be called locally.
+func (a *ServerWithRoles) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
+	return nil, trace.NotImplemented(notImplementedMessage)
+}
+
 // ListNodes returns a paginated list of nodes filtered by user access.
 //
 // DELETE IN 10.0.0 in favor of ListResources.
@@ -1622,17 +1648,7 @@ func (a *ServerWithRoles) getProxyPublicAddr() string {
 }
 
 func (a *ServerWithRoles) DeleteAccessRequest(ctx context.Context, name string) error {
-	cfg, err := a.withStaticRoles()
-	if err != nil {
-		return err
-	}
-	if err := cfg.action(apidefaults.Namespace, types.KindAccessRequest, types.VerbDelete); err != nil {
-		if trace.IsAccessDenied(err) {
-			if a.withOptions(quietAction(true)).action(apidefaults.Namespace, types.KindAccessRequest, types.VerbDelete) == nil {
-				// the user would've had permission with the roles granted by access requests
-				return trace.WrapWithMessage(err, "access request deletion through elevated roles is not allowed")
-			}
-		}
+	if err := a.action(apidefaults.Namespace, types.KindAccessRequest, types.VerbDelete); err != nil {
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteAccessRequest(ctx, name)
@@ -1722,8 +1738,8 @@ func (a *ServerWithRoles) GenerateKeyPair(pass string) ([]byte, []byte, error) {
 }
 
 func (a *ServerWithRoles) GenerateHostCert(
-	key []byte, hostID, nodeName string, principals []string, clusterName string, role types.SystemRole, ttl time.Duration) ([]byte, error) {
-
+	key []byte, hostID, nodeName string, principals []string, clusterName string, role types.SystemRole, ttl time.Duration,
+) ([]byte, error) {
 	if err := a.action(apidefaults.Namespace, types.KindHostCert, types.VerbCreate); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2645,6 +2661,21 @@ func (a *ServerWithRoles) UpsertRole(ctx context.Context, role types.Role) error
 	}
 
 	// Some options are only available with enterprise subscription
+	if err := checkRoleFeatureSupport(role); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// access predicate syntax is not checked as part of normal role validation in order
+	// to allow the available namespaces to be extended without breaking compatibility with
+	// older nodes/proxies (which do not need to ever evaluate said predicates).
+	if err := services.ValidateAccessPredicates(role); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return a.authServer.UpsertRole(ctx, role)
+}
+
+func checkRoleFeatureSupport(role types.Role) error {
 	features := modules.GetModules().Features()
 	options := role.GetOptions()
 	allowReq, allowRev := role.GetAccessRequestConditions(types.Allow), role.GetAccessReviewConditions(types.Allow)
@@ -2663,16 +2694,9 @@ func (a *ServerWithRoles) UpsertRole(ctx context.Context, role types.Role) error
 	case features.AdvancedAccessWorkflows == false && !allowRev.IsZero():
 		return trace.AccessDenied(
 			"role field allow.review_requests is only available in enterprise subscriptions")
+	default:
+		return nil
 	}
-
-	// access predicate syntax is not checked as part of normal role validation in order
-	// to allow the available namespaces to be extended without breaking compatibility with
-	// older nodes/proxies (which do not need to ever evaluate said predicates).
-	if err := services.ValidateAccessPredicates(role); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return a.authServer.UpsertRole(ctx, role)
 }
 
 // GetRole returns role by name
@@ -3471,7 +3495,7 @@ func (a *ServerWithRoles) GenerateAppToken(ctx context.Context, req types.Genera
 		return "", trace.Wrap(err)
 	}
 
-	session, err := a.authServer.generateAppToken(req.Username, req.Roles, req.URI, req.Expires)
+	session, err := a.authServer.generateAppToken(ctx, req.Username, req.Roles, req.URI, req.Expires)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -4163,7 +4187,6 @@ func (a *ServerWithRoles) filterWindowsDesktops(desktops []types.WindowsDesktop)
 func (a *ServerWithRoles) checkAccessToWindowsDesktop(w types.WindowsDesktop) error {
 	return a.context.Checker.CheckAccess(w,
 		// MFA is not required for operations on desktop resources
-		// TODO(zmb3): per-session MFA for desktops will be added after general availability
 		services.AccessMFAParams{Verified: true},
 		// Note: we don't use the Windows login matcher here, as we won't know what OS user
 		// the user is trying to log in as until they initiate the connection.
diff --git a/lib/auth/auth_with_roles_test.go b/lib/auth/auth_with_roles_test.go
index 2c812a80fde7c..ae6359152c9d1 100644
--- a/lib/auth/auth_with_roles_test.go
+++ b/lib/auth/auth_with_roles_test.go
@@ -323,7 +323,7 @@ func TestGenerateUserCertsWithRoleRequest(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	dummyUserRole, err := types.NewRole("dummy-user-role", types.RoleSpecV5{})
+	dummyUserRole, err := types.NewRoleV3("dummy-user-role", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	dummyUser, err := CreateUser(srv.Auth(), "dummy-user", dummyUserRole)
@@ -1893,7 +1893,7 @@ func TestKindClusterConfig(t *testing.T) {
 	})
 
 	t.Run("with KindClusterConfig privilege", func(t *testing.T) {
-		role, err := types.NewRole("test-role", types.RoleSpecV5{
+		role, err := types.NewRoleV3("test-role", types.RoleSpecV5{
 			Allow: types.RoleConditions{
 				Rules: []types.Rule{
 					types.NewRule(types.KindClusterConfig, []string{types.VerbRead}),
@@ -1909,94 +1909,6 @@ func TestKindClusterConfig(t *testing.T) {
 	})
 }
 
-func TestNoElevatedAccessRequestDeletion(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
-	require.NoError(t, err)
-	t.Cleanup(func() { srv.Close() })
-
-	deleterRole, err := types.NewRole("deleter", types.RoleSpecV5{
-		Allow: types.RoleConditions{
-			Rules: []types.Rule{{
-				Resources: []string{"access_request"},
-				Verbs:     []string{"delete"},
-			}},
-		},
-	})
-	require.NoError(t, err)
-	deleterUser, err := CreateUser(srv.AuthServer, "deletey", deleterRole)
-	require.NoError(t, err)
-
-	requesterRole, err := types.NewRole("requester", types.RoleSpecV5{
-		Allow: types.RoleConditions{
-			Request: &types.AccessRequestConditions{
-				Roles: []string{deleterRole.GetName()},
-			},
-		},
-	})
-	require.NoError(t, err)
-	requesterUser, err := CreateUser(srv.AuthServer, "requesty", requesterRole)
-	require.NoError(t, err)
-
-	request, err := services.NewAccessRequest(requesterUser.GetName(), deleterRole.GetName())
-	require.NoError(t, err)
-	// the request must be for an allowed user/role combination or it will get rejected
-	err = srv.AuthServer.CreateAccessRequest(ctx, request)
-	require.NoError(t, err)
-
-	// requesty has used some other unspecified access request to get the
-	// deleter role in this identity
-	requesterAuthContext, err := srv.Authorizer.Authorize(context.WithValue(ctx,
-		ContextUser,
-		LocalUser{
-			Username: requesterUser.GetName(),
-			Identity: tlsca.Identity{
-				Username: requesterUser.GetName(),
-				Groups:   []string{requesterRole.GetName(), deleterRole.GetName()},
-				// a tlsca.Identity must have a nonempty Traits field or the
-				// roles will be reloaded from the backend during Authorize
-				Traits: map[string][]string{"nonempty": {}},
-			},
-		},
-	))
-	require.NoError(t, err)
-	requesterAuth := &ServerWithRoles{
-		authServer: srv.AuthServer,
-		sessions:   srv.SessionServer,
-		alog:       srv.AuditLog,
-		context:    *requesterAuthContext,
-	}
-
-	err = requesterAuth.DeleteAccessRequest(ctx, request.GetName())
-	require.True(t, trace.IsAccessDenied(err))
-	// matches the message in lib/auth/auth_with_roles.go:(*ServerWithRoles).DeleteAccessRequest()
-	require.Contains(t, err.Error(), "deletion through elevated roles")
-
-	deleterAuthContext, err := srv.Authorizer.Authorize(context.WithValue(ctx,
-		ContextUser,
-		LocalUser{
-			Username: deleterUser.GetName(),
-			Identity: tlsca.Identity{
-				Username: deleterUser.GetName(),
-				Groups:   []string{deleterRole.GetName()},
-				Traits:   map[string][]string{"nonempty": {}},
-			},
-		},
-	))
-	require.NoError(t, err)
-	deleterAuth := &ServerWithRoles{
-		authServer: srv.AuthServer,
-		sessions:   srv.SessionServer,
-		alog:       srv.AuditLog,
-		context:    *deleterAuthContext,
-	}
-
-	err = deleterAuth.DeleteAccessRequest(ctx, request.GetName())
-	require.NoError(t, err)
-}
-
 func TestGetAndList_KubeServices(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
@@ -2162,3 +2074,241 @@ func TestListResources_NeedTotalCountFlag(t *testing.T) {
 	require.NotEmpty(t, resp.NextKey)
 	require.Empty(t, resp.TotalCount)
 }
+
+func TestGetAndList_WindowsDesktops(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	srv := newTestTLSServer(t)
+
+	// Create test desktops.
+	for i := 0; i < 5; i++ {
+		name := uuid.New().String()
+		desktop, err := types.NewWindowsDesktopV3(name, map[string]string{"name": name},
+			types.WindowsDesktopSpecV3{Addr: "_", HostID: "_"})
+		require.NoError(t, err)
+		require.NoError(t, srv.Auth().UpsertWindowsDesktop(ctx, desktop))
+	}
+
+	// Test all has been upserted.
+	testDesktops, err := srv.Auth().GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+	require.NoError(t, err)
+	require.Len(t, testDesktops, 5)
+
+	testResources := types.WindowsDesktops(testDesktops).AsResources()
+
+	// Create user, role, and client.
+	username := "user"
+	user, role, err := CreateUserAndRole(srv.Auth(), username, nil)
+	require.NoError(t, err)
+	identity := TestUser(user.GetName())
+	clt, err := srv.NewClient(identity)
+	require.NoError(t, err)
+
+	// Base request.
+	listRequest := proto.ListResourcesRequest{
+		ResourceType: types.KindWindowsDesktop,
+		Limit:        int32(len(testDesktops) + 1),
+	}
+
+	// Permit user to get the first desktop.
+	role.SetWindowsDesktopLabels(types.Allow, types.Labels{"name": {testDesktops[0].GetName()}})
+	require.NoError(t, srv.Auth().UpsertRole(ctx, role))
+
+	desktops, err := clt.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+	require.NoError(t, err)
+	require.EqualValues(t, 1, len(desktops))
+	require.Empty(t, cmp.Diff(testDesktops[0:1], desktops))
+
+	resp, err := clt.ListResources(ctx, listRequest)
+	require.NoError(t, err)
+	require.Len(t, resp.Resources, 1)
+	require.Empty(t, cmp.Diff(testResources[0:1], resp.Resources))
+	require.Empty(t, resp.NextKey)
+	require.Empty(t, resp.TotalCount)
+
+	// Permit user to get all desktops.
+	role.SetWindowsDesktopLabels(types.Allow, types.Labels{types.Wildcard: {types.Wildcard}})
+	require.NoError(t, srv.Auth().UpsertRole(ctx, role))
+	desktops, err = clt.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+	require.NoError(t, err)
+	require.EqualValues(t, len(testDesktops), len(desktops))
+	require.Empty(t, cmp.Diff(testDesktops, desktops))
+
+	resp, err = clt.ListResources(ctx, listRequest)
+	require.NoError(t, err)
+	require.Len(t, resp.Resources, len(testResources))
+	require.Empty(t, cmp.Diff(testResources, resp.Resources))
+	require.Empty(t, resp.NextKey)
+	require.Empty(t, resp.TotalCount)
+
+	// Test sorting is supported.
+	withSort := listRequest
+	withSort.SortBy = types.SortBy{IsDesc: true, Field: types.ResourceMetadataName}
+	resp, err = clt.ListResources(ctx, withSort)
+	require.NoError(t, err)
+	require.Len(t, resp.Resources, len(testResources))
+	desktops, err = types.ResourcesWithLabels(resp.Resources).AsWindowsDesktops()
+	require.NoError(t, err)
+	names, err := types.WindowsDesktops(desktops).GetFieldVals(types.ResourceMetadataName)
+	require.NoError(t, err)
+	require.IsDecreasing(t, names)
+
+	// Filter by labels.
+	withLabels := listRequest
+	withLabels.Labels = map[string]string{"name": testDesktops[0].GetName()}
+	resp, err = clt.ListResources(ctx, withLabels)
+	require.NoError(t, err)
+	require.Len(t, resp.Resources, 1)
+	require.Empty(t, cmp.Diff(testResources[0:1], resp.Resources))
+	require.Empty(t, resp.NextKey)
+	require.Empty(t, resp.TotalCount)
+
+	// Test search keywords match.
+	withSearchKeywords := listRequest
+	withSearchKeywords.SearchKeywords = []string{"name", testDesktops[0].GetName()}
+	resp, err = clt.ListResources(ctx, withSearchKeywords)
+	require.NoError(t, err)
+	require.Len(t, resp.Resources, 1)
+	require.Empty(t, cmp.Diff(testResources[0:1], resp.Resources))
+
+	// Test predicate match.
+	withExpression := listRequest
+	withExpression.PredicateExpression = fmt.Sprintf(`labels.name == "%s"`, testDesktops[0].GetName())
+	resp, err = clt.ListResources(ctx, withExpression)
+	require.NoError(t, err)
+	require.Len(t, resp.Resources, 1)
+	require.Empty(t, cmp.Diff(testResources[0:1], resp.Resources))
+
+	// Deny user to get the first desktop.
+	role.SetWindowsDesktopLabels(types.Deny, types.Labels{"name": {testDesktops[0].GetName()}})
+	require.NoError(t, srv.Auth().UpsertRole(ctx, role))
+
+	desktops, err = clt.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+	require.NoError(t, err)
+	require.EqualValues(t, len(testDesktops[1:]), len(desktops))
+	require.Empty(t, cmp.Diff(testDesktops[1:], desktops))
+
+	resp, err = clt.ListResources(ctx, listRequest)
+	require.NoError(t, err)
+	require.Len(t, resp.Resources, len(testResources[1:]))
+	require.Empty(t, cmp.Diff(testResources[1:], resp.Resources))
+
+	// Deny user all desktops.
+	role.SetWindowsDesktopLabels(types.Deny, types.Labels{types.Wildcard: {types.Wildcard}})
+	require.NoError(t, srv.Auth().UpsertRole(ctx, role))
+
+	desktops, err = clt.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
+	require.NoError(t, err)
+	require.EqualValues(t, 0, len(desktops))
+	require.Empty(t, cmp.Diff([]types.WindowsDesktop{}, desktops))
+
+	resp, err = clt.ListResources(ctx, listRequest)
+	require.NoError(t, err)
+	require.Len(t, resp.Resources, 0)
+	require.Empty(t, cmp.Diff([]types.ResourceWithLabels{}, resp.Resources))
+}
+
+func TestListResources_KindKubernetesCluster(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	require.NoError(t, err)
+
+	authContext, err := srv.Authorizer.Authorize(context.WithValue(ctx, ContextUser, TestBuiltin(types.RoleProxy).I))
+	require.NoError(t, err)
+
+	s := &ServerWithRoles{
+		authServer: srv.AuthServer,
+		sessions:   srv.SessionServer,
+		alog:       srv.AuditLog,
+		context:    *authContext,
+	}
+
+	testNames := []string{"a", "b", "c", "d"}
+
+	// Add some kube services.
+	kubeService, err := types.NewServer("bar", types.KindKubeService, types.ServerSpecV2{
+		KubernetesClusters: []*types.KubernetesCluster{{Name: "d"}, {Name: "b"}, {Name: "a"}},
+	})
+	require.NoError(t, err)
+	_, err = s.UpsertKubeServiceV2(ctx, kubeService)
+	require.NoError(t, err)
+
+	// Include a duplicate cluster name to test deduplicate.
+	kubeService, err = types.NewServer("foo", types.KindKubeService, types.ServerSpecV2{
+		KubernetesClusters: []*types.KubernetesCluster{{Name: "a"}, {Name: "c"}},
+	})
+	require.NoError(t, err)
+	_, err = s.UpsertKubeServiceV2(ctx, kubeService)
+	require.NoError(t, err)
+
+	// Test upsert.
+	kubeservices, err := s.GetKubeServices(ctx)
+	require.NoError(t, err)
+	require.Len(t, kubeservices, 2)
+
+	t.Run("fetch all", func(t *testing.T) {
+		t.Parallel()
+
+		res, err := s.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindKubernetesCluster,
+			Limit:        10,
+		})
+		require.NoError(t, err)
+		require.Len(t, res.Resources, len(testNames))
+		require.Empty(t, res.NextKey)
+		require.Empty(t, res.TotalCount)
+
+		clusters, err := types.ResourcesWithLabels(res.Resources).AsKubeClusters()
+		require.NoError(t, err)
+		names, err := types.KubeClusters(clusters).GetFieldVals(types.ResourceMetadataName)
+		require.NoError(t, err)
+		require.ElementsMatch(t, names, testNames)
+	})
+
+	t.Run("start keys", func(t *testing.T) {
+		t.Parallel()
+
+		// First fetch.
+		res, err := s.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindKubernetesCluster,
+			Limit:        1,
+		})
+		require.NoError(t, err)
+		require.Len(t, res.Resources, 1)
+		require.Equal(t, kubeservices[0].GetKubernetesClusters()[1].Name, res.NextKey)
+
+		// Second fetch.
+		res, err = s.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindKubernetesCluster,
+			Limit:        1,
+			StartKey:     res.NextKey,
+		})
+		require.NoError(t, err)
+		require.Len(t, res.Resources, 1)
+		require.Equal(t, kubeservices[0].GetKubernetesClusters()[2].Name, res.NextKey)
+	})
+
+	t.Run("fetch with sort and total count", func(t *testing.T) {
+		t.Parallel()
+		res, err := s.ListResources(ctx, proto.ListResourcesRequest{
+			ResourceType: types.KindKubernetesCluster,
+			Limit:        10,
+			SortBy: types.SortBy{
+				IsDesc: true,
+				Field:  types.ResourceMetadataName,
+			},
+			NeedTotalCount: true,
+		})
+		require.NoError(t, err)
+		require.Empty(t, res.NextKey)
+		require.Len(t, res.Resources, len(testNames))
+		require.Equal(t, res.TotalCount, len(testNames))
+
+		clusters, err := types.ResourcesWithLabels(res.Resources).AsKubeClusters()
+		require.NoError(t, err)
+		names, err := types.KubeClusters(clusters).GetFieldVals(types.ResourceMetadataName)
+		require.NoError(t, err)
+		require.IsDecreasing(t, names)
+	})
+}
diff --git a/lib/auth/bot.go b/lib/auth/bot.go
index cbc0ddc729478..3eb553e4414ff 100644
--- a/lib/auth/bot.go
+++ b/lib/auth/bot.go
@@ -44,7 +44,7 @@ func BotResourceName(botName string) string {
 
 // createBotRole creates a role from a bot template with the given parameters.
 func createBotRole(ctx context.Context, s *Server, botName string, resourceName string, roleRequests []string) (types.Role, error) {
-	role, err := types.NewRole(resourceName, types.RoleSpecV5{
+	role, err := types.NewRoleV3(resourceName, types.RoleSpecV5{
 		Options: types.RoleOptions{
 			// TODO: inherit TTLs from cert length?
 			MaxSessionTTL: types.Duration(12 * time.Hour),
@@ -242,7 +242,7 @@ func (s *Server) getBotUsers(ctx context.Context) ([]types.User, error) {
 // random dynamic provision token which allows bots to join with the given
 // botName. Returns the token and any error.
 func (s *Server) checkOrCreateBotToken(ctx context.Context, req *proto.CreateBotRequest) (types.ProvisionToken, error) {
-	resourceName := BotResourceName(req.Name)
+	botName := req.Name
 
 	// if the request includes a TokenID it should already exist
 	if req.TokenID != "" {
@@ -258,9 +258,9 @@ func (s *Server) checkOrCreateBotToken(ctx context.Context, req *proto.CreateBot
 			return nil, trace.BadParameter("token %q is not valid for role %q",
 				req.TokenID, types.RoleBot)
 		}
-		if provisionToken.GetBotName() != resourceName {
+		if provisionToken.GetBotName() != botName {
 			return nil, trace.BadParameter("token %q is valid for bot with name %q, not %q",
-				req.TokenID, provisionToken.GetBotName(), resourceName)
+				req.TokenID, provisionToken.GetBotName(), botName)
 		}
 		switch provisionToken.GetJoinMethod() {
 		case types.JoinMethodToken, types.JoinMethodIAM:
@@ -286,7 +286,7 @@ func (s *Server) checkOrCreateBotToken(ctx context.Context, req *proto.CreateBot
 	tokenSpec := types.ProvisionTokenSpecV2{
 		Roles:      []types.SystemRole{types.RoleBot},
 		JoinMethod: types.JoinMethodToken,
-		BotName:    resourceName,
+		BotName:    botName,
 	}
 	token, err := types.NewProvisionTokenFromSpec(tokenName, time.Now().Add(ttl), tokenSpec)
 	if err != nil {
diff --git a/lib/auth/clt.go b/lib/auth/clt.go
index fff5a88a55d1a..68f75a5c99148 100644
--- a/lib/auth/clt.go
+++ b/lib/auth/clt.go
@@ -22,7 +22,7 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net"
 	"net/http"
 	"net/url"
@@ -269,28 +269,28 @@ func ClientTimeout(timeout time.Duration) roundtrip.ClientParam {
 }
 
 // PostJSON is a generic method that issues http POST request to the server
-func (c *Client) PostJSON(endpoint string, val interface{}) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.PostJSON(context.TODO(), endpoint, val))
+func (c *Client) PostJSON(ctx context.Context, endpoint string, val interface{}) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.PostJSON(ctx, endpoint, val))
 }
 
 // PutJSON is a generic method that issues http PUT request to the server
-func (c *Client) PutJSON(endpoint string, val interface{}) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.PutJSON(context.TODO(), endpoint, val))
+func (c *Client) PutJSON(ctx context.Context, endpoint string, val interface{}) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.PutJSON(ctx, endpoint, val))
 }
 
 // PostForm is a generic method that issues http POST request to the server
-func (c *Client) PostForm(endpoint string, vals url.Values, files ...roundtrip.File) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.PostForm(context.TODO(), endpoint, vals, files...))
+func (c *Client) PostForm(ctx context.Context, endpoint string, vals url.Values, files ...roundtrip.File) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.PostForm(ctx, endpoint, vals, files...))
 }
 
 // Get issues http GET request to the server
-func (c *Client) Get(u string, params url.Values) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.Get(context.TODO(), u, params))
+func (c *Client) Get(ctx context.Context, u string, params url.Values) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.Get(ctx, u, params))
 }
 
 // Delete issues http Delete Request to the server
-func (c *Client) Delete(u string) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.Delete(context.TODO(), u))
+func (c *Client) Delete(ctx context.Context, u string) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.Delete(ctx, u))
 }
 
 // ProcessKubeCSR processes CSR request against Kubernetes CA, returns
@@ -299,7 +299,7 @@ func (c *Client) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
 	if err := req.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.PostJSON(c.Endpoint("kube", "csr"), req)
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("kube", "csr"), req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -316,7 +316,7 @@ func (c *Client) GetSessions(namespace string) ([]session.Session, error) {
 	if namespace == "" {
 		return nil, trace.BadParameter(MissingNamespaceError)
 	}
-	out, err := c.Get(c.Endpoint("namespaces", namespace, "sessions"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("namespaces", namespace, "sessions"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -336,7 +336,7 @@ func (c *Client) GetSession(namespace string, id session.ID) (*session.Session,
 	if err := id.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.Get(c.Endpoint("namespaces", namespace, "sessions", string(id)), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("namespaces", namespace, "sessions", string(id)), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -352,7 +352,7 @@ func (c *Client) DeleteSession(namespace string, id session.ID) error {
 	if namespace == "" {
 		return trace.BadParameter(MissingNamespaceError)
 	}
-	_, err := c.Delete(c.Endpoint("namespaces", namespace, "sessions", string(id)))
+	_, err := c.Delete(context.TODO(), c.Endpoint("namespaces", namespace, "sessions", string(id)))
 	return trace.Wrap(err)
 }
 
@@ -361,7 +361,7 @@ func (c *Client) CreateSession(sess session.Session) error {
 	if sess.Namespace == "" {
 		return trace.BadParameter(MissingNamespaceError)
 	}
-	_, err := c.PostJSON(c.Endpoint("namespaces", sess.Namespace, "sessions"), createSessionReq{Session: sess})
+	_, err := c.PostJSON(context.TODO(), c.Endpoint("namespaces", sess.Namespace, "sessions"), createSessionReq{Session: sess})
 	return trace.Wrap(err)
 }
 
@@ -370,13 +370,13 @@ func (c *Client) UpdateSession(req session.UpdateRequest) error {
 	if err := req.Check(); err != nil {
 		return trace.Wrap(err)
 	}
-	_, err := c.PutJSON(c.Endpoint("namespaces", req.Namespace, "sessions", string(req.ID)), updateSessionReq{Update: req})
+	_, err := c.PutJSON(context.TODO(), c.Endpoint("namespaces", req.Namespace, "sessions", string(req.ID)), updateSessionReq{Update: req})
 	return trace.Wrap(err)
 }
 
 // GetDomainName returns local auth domain of the current auth server
 func (c *Client) GetDomainName() (string, error) {
-	out, err := c.Get(c.Endpoint("domain"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("domain"), url.Values{})
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -390,7 +390,7 @@ func (c *Client) GetDomainName() (string, error) {
 // GetClusterCACert returns the PEM-encoded TLS certs for the local cluster. If
 // the cluster has multiple TLS certs, they will all be concatenated.
 func (c *Client) GetClusterCACert() (*LocalCAResponse, error) {
-	out, err := c.Get(c.Endpoint("cacert"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("cacert"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -416,19 +416,19 @@ func (c *Client) CreateCertAuthority(ca types.CertAuthority) error {
 }
 
 // RotateCertAuthority starts or restarts certificate authority rotation process.
-func (c *Client) RotateCertAuthority(req RotateRequest) error {
+func (c *Client) RotateCertAuthority(ctx context.Context, req RotateRequest) error {
 	caType := "all"
 	if req.Type != "" {
 		caType = string(req.Type)
 	}
-	_, err := c.PostJSON(c.Endpoint("authorities", caType, "rotate"), req)
+	_, err := c.PostJSON(ctx, c.Endpoint("authorities", caType, "rotate"), req)
 	return trace.Wrap(err)
 }
 
 // RotateExternalCertAuthority rotates external certificate authority,
 // this method is used to update only public keys and certificates of the
 // the certificate authorities of trusted clusters.
-func (c *Client) RotateExternalCertAuthority(ca types.CertAuthority) error {
+func (c *Client) RotateExternalCertAuthority(ctx context.Context, ca types.CertAuthority) error {
 	if err := services.ValidateCertAuthority(ca); err != nil {
 		return trace.Wrap(err)
 	}
@@ -436,7 +436,7 @@ func (c *Client) RotateExternalCertAuthority(ca types.CertAuthority) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(c.Endpoint("authorities", string(ca.GetType()), "rotate", "external"),
+	_, err = c.PostJSON(ctx, c.Endpoint("authorities", string(ca.GetType()), "rotate", "external"),
 		&rotateExternalCertAuthorityRawReq{CA: data})
 	return trace.Wrap(err)
 }
@@ -450,7 +450,7 @@ func (c *Client) UpsertCertAuthority(ca types.CertAuthority) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(c.Endpoint("authorities", string(ca.GetType())),
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("authorities", string(ca.GetType())),
 		&upsertCertAuthorityRawReq{CA: data})
 	return trace.Wrap(err)
 }
@@ -462,11 +462,11 @@ func (c *Client) CompareAndSwapCertAuthority(new, existing types.CertAuthority)
 }
 
 // GetCertAuthorities returns a list of certificate authorities
-func (c *Client) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (c *Client) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	if err := caType.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.Get(c.Endpoint("authorities", string(caType)), url.Values{
+	out, err := c.Get(ctx, c.Endpoint("authorities", string(caType)), url.Values{
 		"load_keys": []string{fmt.Sprintf("%t", loadKeys)},
 	})
 	if err != nil {
@@ -489,11 +489,11 @@ func (c *Client) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, op
 
 // GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
 // controls if signing keys are loaded
-func (c *Client) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (c *Client) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	if err := id.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.Get(c.Endpoint("authorities", string(id.Type), id.DomainName), url.Values{
+	out, err := c.Get(ctx, c.Endpoint("authorities", string(id.Type), id.DomainName), url.Values{
 		"load_keys": []string{fmt.Sprintf("%t", loadSigningKeys)},
 	})
 	if err != nil {
@@ -507,7 +507,7 @@ func (c *Client) DeleteCertAuthority(id types.CertAuthID) error {
 	if err := id.Check(); err != nil {
 		return trace.Wrap(err)
 	}
-	_, err := c.Delete(c.Endpoint("authorities", string(id.Type), id.DomainName))
+	_, err := c.Delete(context.TODO(), c.Endpoint("authorities", string(id.Type), id.DomainName))
 	return trace.Wrap(err)
 }
 
@@ -530,7 +530,7 @@ func (c *Client) DeactivateCertAuthority(id types.CertAuthID) error {
 // If token is not supplied, it will be auto generated and returned.
 // If TTL is not supplied, token will be valid until removed.
 func (c *Client) GenerateToken(ctx context.Context, req GenerateTokenRequest) (string, error) {
-	out, err := c.PostJSON(c.Endpoint("tokens"), req)
+	out, err := c.PostJSON(ctx, c.Endpoint("tokens"), req)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -547,7 +547,7 @@ func (c *Client) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 	if err := req.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.PostJSON(c.Endpoint("tokens", "register"), req)
+	out, err := c.PostJSON(ctx, c.Endpoint("tokens", "register"), req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -557,19 +557,12 @@ func (c *Client) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		return nil, trace.Wrap(err)
 	}
 
-	// If we got certs, we're done, however, we may be talking to a Teleport 9 or earlier server,
-	// which still sends back the legacy JSON format.
-	if len(certs.SSH) > 0 && len(certs.TLS) > 0 {
-		return &certs, nil
-	}
-
-	// DELETE IN 10.0.0 (zmb3)
-	return UnmarshalLegacyCerts(out.Bytes())
+	return &certs, nil
 }
 
 // RegisterNewAuthServer is used to register new auth server with token
 func (c *Client) RegisterNewAuthServer(ctx context.Context, token string) error {
-	_, err := c.PostJSON(c.Endpoint("tokens", "register", "auth"), registerNewAuthServerReq{
+	_, err := c.PostJSON(ctx, c.Endpoint("tokens", "register", "auth"), registerNewAuthServerReq{
 		Token: token,
 	})
 	return trace.Wrap(err)
@@ -603,7 +596,7 @@ func (c *Client) UpsertNodes(namespace string, servers []types.Server) error {
 		Namespace: namespace,
 		Nodes:     bytes,
 	}
-	_, err = c.PutJSON(c.Endpoint("namespaces", namespace, "nodes"), args)
+	_, err = c.PutJSON(context.TODO(), c.Endpoint("namespaces", namespace, "nodes"), args)
 	return trace.Wrap(err)
 }
 
@@ -617,7 +610,7 @@ func (c *Client) UpsertReverseTunnel(tunnel types.ReverseTunnel) error {
 	args := &upsertReverseTunnelRawReq{
 		ReverseTunnel: data,
 	}
-	_, err = c.PostJSON(c.Endpoint("reversetunnels"), args)
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("reversetunnels"), args)
 	return trace.Wrap(err)
 }
 
@@ -628,7 +621,7 @@ func (c *Client) GetReverseTunnel(name string, opts ...services.MarshalOption) (
 
 // GetReverseTunnels returns the list of created reverse tunnels
 func (c *Client) GetReverseTunnels(opts ...services.MarshalOption) ([]types.ReverseTunnel, error) {
-	out, err := c.Get(c.Endpoint("reversetunnels"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("reversetunnels"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -655,7 +648,7 @@ func (c *Client) DeleteReverseTunnel(domainName string) error {
 	if strings.TrimSpace(domainName) == "" {
 		return trace.BadParameter("empty domain name")
 	}
-	_, err := c.Delete(c.Endpoint("reversetunnels", domainName))
+	_, err := c.Delete(context.TODO(), c.Endpoint("reversetunnels", domainName))
 	return trace.Wrap(err)
 }
 
@@ -668,7 +661,7 @@ func (c *Client) UpsertTunnelConnection(conn types.TunnelConnection) error {
 	args := &upsertTunnelConnectionRawReq{
 		TunnelConnection: data,
 	}
-	_, err = c.PostJSON(c.Endpoint("tunnelconnections"), args)
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("tunnelconnections"), args)
 	return trace.Wrap(err)
 }
 
@@ -677,7 +670,7 @@ func (c *Client) GetTunnelConnections(clusterName string, opts ...services.Marsh
 	if clusterName == "" {
 		return nil, trace.BadParameter("missing cluster name parameter")
 	}
-	out, err := c.Get(c.Endpoint("tunnelconnections", clusterName), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("tunnelconnections", clusterName), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -698,7 +691,7 @@ func (c *Client) GetTunnelConnections(clusterName string, opts ...services.Marsh
 
 // GetAllTunnelConnections returns all tunnel connections
 func (c *Client) GetAllTunnelConnections(opts ...services.MarshalOption) ([]types.TunnelConnection, error) {
-	out, err := c.Get(c.Endpoint("tunnelconnections"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("tunnelconnections"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -725,7 +718,7 @@ func (c *Client) DeleteTunnelConnection(clusterName string, connName string) err
 	if connName == "" {
 		return trace.BadParameter("missing parameter connection name")
 	}
-	_, err := c.Delete(c.Endpoint("tunnelconnections", clusterName, connName))
+	_, err := c.Delete(context.TODO(), c.Endpoint("tunnelconnections", clusterName, connName))
 	return trace.Wrap(err)
 }
 
@@ -734,7 +727,7 @@ func (c *Client) DeleteTunnelConnections(clusterName string) error {
 	if clusterName == "" {
 		return trace.BadParameter("missing parameter cluster name")
 	}
-	_, err := c.Delete(c.Endpoint("tunnelconnections", clusterName))
+	_, err := c.Delete(context.TODO(), c.Endpoint("tunnelconnections", clusterName))
 	return trace.Wrap(err)
 }
 
@@ -745,7 +738,7 @@ func (c *Client) DeleteAllTokens() error {
 
 // DeleteAllTunnelConnections deletes all tunnel connections
 func (c *Client) DeleteAllTunnelConnections() error {
-	_, err := c.Delete(c.Endpoint("tunnelconnections"))
+	_, err := c.Delete(context.TODO(), c.Endpoint("tunnelconnections"))
 	return trace.Wrap(err)
 }
 
@@ -761,7 +754,7 @@ func (c *Client) GetUserLoginAttempts(user string) ([]services.LoginAttempt, err
 
 // GetRemoteClusters returns a list of remote clusters
 func (c *Client) GetRemoteClusters(opts ...services.MarshalOption) ([]types.RemoteCluster, error) {
-	out, err := c.Get(c.Endpoint("remoteclusters"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("remoteclusters"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -785,7 +778,7 @@ func (c *Client) GetRemoteCluster(clusterName string) (types.RemoteCluster, erro
 	if clusterName == "" {
 		return nil, trace.BadParameter("missing cluster name")
 	}
-	out, err := c.Get(c.Endpoint("remoteclusters", clusterName), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("remoteclusters", clusterName), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -797,13 +790,13 @@ func (c *Client) DeleteRemoteCluster(clusterName string) error {
 	if clusterName == "" {
 		return trace.BadParameter("missing parameter cluster name")
 	}
-	_, err := c.Delete(c.Endpoint("remoteclusters", clusterName))
+	_, err := c.Delete(context.TODO(), c.Endpoint("remoteclusters", clusterName))
 	return trace.Wrap(err)
 }
 
 // DeleteAllRemoteClusters deletes all remote clusters
 func (c *Client) DeleteAllRemoteClusters() error {
-	_, err := c.Delete(c.Endpoint("remoteclusters"))
+	_, err := c.Delete(context.TODO(), c.Endpoint("remoteclusters"))
 	return trace.Wrap(err)
 }
 
@@ -816,7 +809,7 @@ func (c *Client) CreateRemoteCluster(rc types.RemoteCluster) error {
 	args := &createRemoteClusterRawReq{
 		RemoteCluster: data,
 	}
-	_, err = c.PostJSON(c.Endpoint("remoteclusters"), args)
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("remoteclusters"), args)
 	return trace.Wrap(err)
 }
 
@@ -830,13 +823,13 @@ func (c *Client) UpsertAuthServer(s types.Server) error {
 	args := &upsertServerRawReq{
 		Server: data,
 	}
-	_, err = c.PostJSON(c.Endpoint("authservers"), args)
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("authservers"), args)
 	return trace.Wrap(err)
 }
 
 // GetAuthServers returns the list of auth servers registered in the cluster.
 func (c *Client) GetAuthServers() ([]types.Server, error) {
-	out, err := c.Get(c.Endpoint("authservers"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("authservers"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -875,13 +868,13 @@ func (c *Client) UpsertProxy(s types.Server) error {
 	args := &upsertServerRawReq{
 		Server: data,
 	}
-	_, err = c.PostJSON(c.Endpoint("proxies"), args)
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("proxies"), args)
 	return trace.Wrap(err)
 }
 
 // GetProxies returns the list of auth servers registered in the cluster.
 func (c *Client) GetProxies() ([]types.Server, error) {
-	out, err := c.Get(c.Endpoint("proxies"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("proxies"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -902,7 +895,7 @@ func (c *Client) GetProxies() ([]types.Server, error) {
 
 // DeleteAllProxies deletes all proxies
 func (c *Client) DeleteAllProxies() error {
-	_, err := c.Delete(c.Endpoint("proxies"))
+	_, err := c.Delete(context.TODO(), c.Endpoint("proxies"))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -914,7 +907,7 @@ func (c *Client) DeleteProxy(name string) error {
 	if name == "" {
 		return trace.BadParameter("missing parameter name")
 	}
-	_, err := c.Delete(c.Endpoint("proxies", name))
+	_, err := c.Delete(context.TODO(), c.Endpoint("proxies", name))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -924,6 +917,7 @@ func (c *Client) DeleteProxy(name string) error {
 // UpsertPassword updates web access password for the user
 func (c *Client) UpsertPassword(user string, password []byte) error {
 	_, err := c.PostJSON(
+		context.TODO(),
 		c.Endpoint("users", user, "web", "password"),
 		upsertPasswordReq{
 			Password: string(password),
@@ -941,7 +935,7 @@ func (c *Client) UpsertUser(user types.User) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(c.Endpoint("users"), &upsertUserRawReq{User: data})
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("users"), &upsertUserRawReq{User: data})
 	return trace.Wrap(err)
 }
 
@@ -952,13 +946,14 @@ func (c *Client) CompareAndSwapUser(ctx context.Context, new, expected types.Use
 
 // ChangePassword updates users password based on the old password.
 func (c *Client) ChangePassword(req services.ChangePasswordReq) error {
-	_, err := c.PutJSON(c.Endpoint("users", req.User, "web", "password"), req)
+	_, err := c.PutJSON(context.TODO(), c.Endpoint("users", req.User, "web", "password"), req)
 	return trace.Wrap(err)
 }
 
 // CheckPassword checks if the suplied web access password is valid.
 func (c *Client) CheckPassword(user string, password []byte, otpToken string) error {
 	_, err := c.PostJSON(
+		context.TODO(),
 		c.Endpoint("users", user, "web", "password", "check"),
 		checkPasswordReq{
 			Password: string(password),
@@ -971,6 +966,7 @@ func (c *Client) CheckPassword(user string, password []byte, otpToken string) er
 // valid web session
 func (c *Client) ExtendWebSession(req WebSessionReq) (types.WebSession, error) {
 	out, err := c.PostJSON(
+		context.TODO(),
 		c.Endpoint("users", req.User, "web", "sessions"), req)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -981,6 +977,7 @@ func (c *Client) ExtendWebSession(req WebSessionReq) (types.WebSession, error) {
 // CreateWebSession creates a new web session for a user
 func (c *Client) CreateWebSession(user string) (types.WebSession, error) {
 	out, err := c.PostJSON(
+		context.TODO(),
 		c.Endpoint("users", user, "web", "sessions"),
 		WebSessionReq{User: user},
 	)
@@ -994,6 +991,7 @@ func (c *Client) CreateWebSession(user string) (types.WebSession, error) {
 // in case if authentication is successful
 func (c *Client) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSession, error) {
 	out, err := c.PostJSON(
+		context.TODO(),
 		c.Endpoint("users", req.Username, "web", "authenticate"),
 		req,
 	)
@@ -1007,6 +1005,7 @@ func (c *Client) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSess
 // short lived certificates as a result
 func (c *Client) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginResponse, error) {
 	out, err := c.PostJSON(
+		context.TODO(),
 		c.Endpoint("users", req.Username, "ssh", "authenticate"),
 		req,
 	)
@@ -1024,6 +1023,7 @@ func (c *Client) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginRespo
 // it is valid, or error otherwise.
 func (c *Client) GetWebSessionInfo(ctx context.Context, user, sessionID string) (types.WebSession, error) {
 	out, err := c.Get(
+		ctx,
 		c.Endpoint("users", user, "web", "sessions", sessionID), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1033,7 +1033,7 @@ func (c *Client) GetWebSessionInfo(ctx context.Context, user, sessionID string)
 
 // DeleteWebSession deletes the web session specified with sid for the given user
 func (c *Client) DeleteWebSession(user string, sid string) error {
-	_, err := c.Delete(c.Endpoint("users", user, "web", "sessions", sid))
+	_, err := c.Delete(context.TODO(), c.Endpoint("users", user, "web", "sessions", sid))
 	return trace.Wrap(err)
 }
 
@@ -1041,7 +1041,7 @@ func (c *Client) DeleteWebSession(user string, sid string) error {
 // by password. If the pass parameter is an empty string, the key pair
 // is not password-protected.
 func (c *Client) GenerateKeyPair(pass string) ([]byte, []byte, error) {
-	out, err := c.PostJSON(c.Endpoint("keypair"), generateKeyPairReq{Password: pass})
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("keypair"), generateKeyPairReq{Password: pass})
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -1058,7 +1058,7 @@ func (c *Client) GenerateKeyPair(pass string) ([]byte, []byte, error) {
 func (c *Client) GenerateHostCert(
 	key []byte, hostID, nodeName string, principals []string, clusterName string, role types.SystemRole, ttl time.Duration) ([]byte, error) {
 
-	out, err := c.PostJSON(c.Endpoint("ca", "host", "certs"),
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("ca", "host", "certs"),
 		generateHostCertReq{
 			Key:         key,
 			HostID:      hostID,
@@ -1082,7 +1082,7 @@ func (c *Client) GenerateHostCert(
 
 // CreateOIDCAuthRequest creates OIDCAuthRequest
 func (c *Client) CreateOIDCAuthRequest(req services.OIDCAuthRequest) (*services.OIDCAuthRequest, error) {
-	out, err := c.PostJSON(c.Endpoint("oidc", "requests", "create"), createOIDCAuthRequestReq{
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("oidc", "requests", "create"), createOIDCAuthRequestReq{
 		Req: req,
 	})
 	if err != nil {
@@ -1097,7 +1097,7 @@ func (c *Client) CreateOIDCAuthRequest(req services.OIDCAuthRequest) (*services.
 
 // ValidateOIDCAuthCallback validates OIDC auth callback returned from redirect
 func (c *Client) ValidateOIDCAuthCallback(q url.Values) (*OIDCAuthResponse, error) {
-	out, err := c.PostJSON(c.Endpoint("oidc", "requests", "validate"), validateOIDCAuthCallbackReq{
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("oidc", "requests", "validate"), validateOIDCAuthCallbackReq{
 		Query: q,
 	})
 	if err != nil {
@@ -1138,7 +1138,7 @@ func (c *Client) CreateSAMLConnector(ctx context.Context, connector types.SAMLCo
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(c.Endpoint("saml", "connectors"), &createSAMLConnectorRawReq{
+	_, err = c.PostJSON(ctx, c.Endpoint("saml", "connectors"), &createSAMLConnectorRawReq{
 		Connector: data,
 	})
 	if err != nil {
@@ -1149,7 +1149,7 @@ func (c *Client) CreateSAMLConnector(ctx context.Context, connector types.SAMLCo
 
 // CreateSAMLAuthRequest creates SAML AuthnRequest
 func (c *Client) CreateSAMLAuthRequest(req services.SAMLAuthRequest) (*services.SAMLAuthRequest, error) {
-	out, err := c.PostJSON(c.Endpoint("saml", "requests", "create"), createSAMLAuthRequestReq{
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("saml", "requests", "create"), createSAMLAuthRequestReq{
 		Req: req,
 	})
 	if err != nil {
@@ -1164,7 +1164,7 @@ func (c *Client) CreateSAMLAuthRequest(req services.SAMLAuthRequest) (*services.
 
 // ValidateSAMLResponse validates response returned by SAML identity provider
 func (c *Client) ValidateSAMLResponse(re string) (*SAMLAuthResponse, error) {
-	out, err := c.PostJSON(c.Endpoint("saml", "requests", "validate"), validateSAMLResponseReq{
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("saml", "requests", "validate"), validateSAMLResponseReq{
 		Response: re,
 	})
 	if err != nil {
@@ -1205,7 +1205,7 @@ func (c *Client) CreateGithubConnector(connector types.GithubConnector) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(c.Endpoint("github", "connectors"), &createGithubConnectorRawReq{
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("github", "connectors"), &createGithubConnectorRawReq{
 		Connector: bytes,
 	})
 	if err != nil {
@@ -1216,7 +1216,7 @@ func (c *Client) CreateGithubConnector(connector types.GithubConnector) error {
 
 // CreateGithubAuthRequest creates a new request for Github OAuth2 flow
 func (c *Client) CreateGithubAuthRequest(req services.GithubAuthRequest) (*services.GithubAuthRequest, error) {
-	out, err := c.PostJSON(c.Endpoint("github", "requests", "create"),
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("github", "requests", "create"),
 		createGithubAuthRequestReq{Req: req})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1230,7 +1230,7 @@ func (c *Client) CreateGithubAuthRequest(req services.GithubAuthRequest) (*servi
 
 // ValidateGithubAuthCallback validates Github auth callback returned from redirect
 func (c *Client) ValidateGithubAuthCallback(q url.Values) (*GithubAuthResponse, error) {
-	out, err := c.PostJSON(c.Endpoint("github", "requests", "validate"),
+	out, err := c.PostJSON(context.TODO(), c.Endpoint("github", "requests", "validate"),
 		validateGithubAuthCallbackReq{Query: q})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1267,7 +1267,7 @@ func (c *Client) ValidateGithubAuthCallback(q url.Values) (*GithubAuthResponse,
 
 // EmitAuditEventLegacy sends an auditable event to the auth server (part of events.IAuditLog interface)
 func (c *Client) EmitAuditEventLegacy(event events.Event, fields events.EventFields) error {
-	_, err := c.PostJSON(c.Endpoint("events"), &auditEventReq{
+	_, err := c.PostJSON(context.TODO(), c.Endpoint("events"), &auditEventReq{
 		Event:  event,
 		Fields: fields,
 		// Send "type" as well for backwards compatibility.
@@ -1302,7 +1302,7 @@ func (c *Client) PostSessionSlice(slice events.SessionSlice) error {
 	// we **must** consume response by reading all of its body, otherwise the http
 	// client will allocate a new connection for subsequent requests
 	defer re.Body.Close()
-	responseBytes, _ := ioutil.ReadAll(re.Body)
+	responseBytes, _ := io.ReadAll(re.Body)
 	return trace.ReadError(re.StatusCode, responseBytes)
 }
 
@@ -1313,7 +1313,7 @@ func (c *Client) GetSessionChunk(namespace string, sid session.ID, offsetBytes,
 	if namespace == "" {
 		return nil, trace.BadParameter(MissingNamespaceError)
 	}
-	response, err := c.Get(c.Endpoint("namespaces", namespace, "sessions", string(sid), "stream"), url.Values{
+	response, err := c.Get(context.TODO(), c.Endpoint("namespaces", namespace, "sessions", string(sid), "stream"), url.Values{
 		"offset": []string{strconv.Itoa(offsetBytes)},
 		"bytes":  []string{strconv.Itoa(maxBytes)},
 	})
@@ -1335,7 +1335,7 @@ func (c *Client) UploadSessionRecording(r events.SessionRecording) error {
 		"sid":       []string{string(r.SessionID)},
 		"namespace": []string{r.Namespace},
 	}
-	_, err := c.PostForm(c.Endpoint("namespaces", r.Namespace, "sessions", string(r.SessionID), "recording"), values, file)
+	_, err := c.PostForm(context.TODO(), c.Endpoint("namespaces", r.Namespace, "sessions", string(r.SessionID), "recording"), values, file)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1361,7 +1361,7 @@ func (c *Client) GetSessionEvents(namespace string, sid session.ID, afterN int,
 	if includePrintEvents {
 		query.Set("print", fmt.Sprintf("%v", includePrintEvents))
 	}
-	response, err := c.Get(c.Endpoint("namespaces", namespace, "sessions", string(sid), "events"), query)
+	response, err := c.Get(context.TODO(), c.Endpoint("namespaces", namespace, "sessions", string(sid), "events"), query)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1401,7 +1401,7 @@ func (c *Client) SearchSessionEvents(fromUTC, toUTC time.Time, limit int, order
 
 // GetNamespaces returns a list of namespaces
 func (c *Client) GetNamespaces() ([]types.Namespace, error) {
-	out, err := c.Get(c.Endpoint("namespaces"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("namespaces"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1417,7 +1417,7 @@ func (c *Client) GetNamespace(name string) (*types.Namespace, error) {
 	if name == "" {
 		return nil, trace.BadParameter("missing namespace name")
 	}
-	out, err := c.Get(c.Endpoint("namespaces", name), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("namespaces", name), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1426,13 +1426,13 @@ func (c *Client) GetNamespace(name string) (*types.Namespace, error) {
 
 // UpsertNamespace upserts namespace
 func (c *Client) UpsertNamespace(ns types.Namespace) error {
-	_, err := c.PostJSON(c.Endpoint("namespaces"), upsertNamespaceReq{Namespace: ns})
+	_, err := c.PostJSON(context.TODO(), c.Endpoint("namespaces"), upsertNamespaceReq{Namespace: ns})
 	return trace.Wrap(err)
 }
 
 // DeleteNamespace deletes namespace by name
 func (c *Client) DeleteNamespace(name string) error {
-	_, err := c.Delete(c.Endpoint("namespaces", name))
+	_, err := c.Delete(context.TODO(), c.Endpoint("namespaces", name))
 	return trace.Wrap(err)
 }
 
@@ -1443,7 +1443,7 @@ func (c *Client) CreateRole(role types.Role) error {
 
 // GetClusterName returns a cluster name
 func (c *Client) GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error) {
-	out, err := c.Get(c.Endpoint("configuration", "name"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("configuration", "name"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1464,7 +1464,7 @@ func (c *Client) SetClusterName(cn types.ClusterName) error {
 		return trace.Wrap(err)
 	}
 
-	_, err = c.PostJSON(c.Endpoint("configuration", "name"), &setClusterNameReq{ClusterName: data})
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("configuration", "name"), &setClusterNameReq{ClusterName: data})
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1479,13 +1479,13 @@ func (c *Client) UpsertClusterName(cn types.ClusterName) error {
 
 // DeleteStaticTokens deletes static tokens
 func (c *Client) DeleteStaticTokens() error {
-	_, err := c.Delete(c.Endpoint("configuration", "static_tokens"))
+	_, err := c.Delete(context.TODO(), c.Endpoint("configuration", "static_tokens"))
 	return trace.Wrap(err)
 }
 
 // GetStaticTokens returns a list of static register tokens
 func (c *Client) GetStaticTokens() (types.StaticTokens, error) {
-	out, err := c.Get(c.Endpoint("configuration", "static_tokens"), url.Values{})
+	out, err := c.Get(context.TODO(), c.Endpoint("configuration", "static_tokens"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1505,7 +1505,7 @@ func (c *Client) SetStaticTokens(st types.StaticTokens) error {
 		return trace.Wrap(err)
 	}
 
-	_, err = c.PostJSON(c.Endpoint("configuration", "static_tokens"), &setStaticTokensReq{StaticTokens: data})
+	_, err = c.PostJSON(context.TODO(), c.Endpoint("configuration", "static_tokens"), &setStaticTokensReq{StaticTokens: data})
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1548,6 +1548,11 @@ func (c *Client) DeleteAllRoles() error {
 	return trace.NotImplemented(notImplementedMessage)
 }
 
+// ListWindowsDesktops not implemented: can only be called locally.
+func (c *Client) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
+	return nil, trace.NotImplemented(notImplementedMessage)
+}
+
 // DeleteAllUsers not implemented: can only be called locally.
 func (c *Client) DeleteAllUsers() error {
 	return trace.NotImplemented(notImplementedMessage)
@@ -1559,7 +1564,7 @@ func (c *Client) ValidateTrustedCluster(ctx context.Context, validateRequest *Va
 		return nil, trace.Wrap(err)
 	}
 
-	out, err := c.PostJSON(c.Endpoint("trustedclusters", "validate"), validateRequestRaw)
+	out, err := c.PostJSON(ctx, c.Endpoint("trustedclusters", "validate"), validateRequestRaw)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1945,12 +1950,12 @@ type ClientI interface {
 	NewKeepAliver(ctx context.Context) (types.KeepAliver, error)
 
 	// RotateCertAuthority starts or restarts certificate authority rotation process.
-	RotateCertAuthority(req RotateRequest) error
+	RotateCertAuthority(ctx context.Context, req RotateRequest) error
 
 	// RotateExternalCertAuthority rotates external certificate authority,
 	// this method is used to update only public keys and certificates of the
 	// the certificate authorities of trusted clusters.
-	RotateExternalCertAuthority(ca types.CertAuthority) error
+	RotateExternalCertAuthority(ctx context.Context, ca types.CertAuthority) error
 
 	// ValidateTrustedCluster validates trusted cluster token with
 	// main cluster, in case if validation is successful, main cluster
diff --git a/lib/auth/clt_test.go b/lib/auth/clt_test.go
index cf85030c03e54..e9c2c17cb8960 100644
--- a/lib/auth/clt_test.go
+++ b/lib/auth/clt_test.go
@@ -17,16 +17,25 @@ limitations under the License.
 package auth
 
 import (
+	"context"
 	"crypto/tls"
+	"crypto/x509/pkix"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 	"time"
 
 	apiclient "github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 )
 
 func TestClient_DialTimeout(t *testing.T) {
+	t.Parallel()
 	cases := []struct {
 		desc    string
 		timeout time.Duration
@@ -77,3 +86,85 @@ func TestClient_DialTimeout(t *testing.T) {
 		})
 	}
 }
+
+func TestClient_RequestTimeout(t *testing.T) {
+	t.Parallel()
+
+	testDone := make(chan struct{})
+	sawRoot := make(chan bool, 1)
+	sawSlow := make(chan bool, 1)
+
+	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v2/authorities/host/rotate/external":
+			sawRoot <- true
+			http.Redirect(w, r, "/slow", http.StatusFound)
+		case "/slow":
+			sawSlow <- true
+			w.Write([]byte("Hello"))
+			w.(http.Flusher).Flush()
+			<-testDone
+		}
+	}))
+	t.Cleanup(func() {
+		close(testDone)
+		srv.Close()
+	})
+
+	srv.TLS = &tls.Config{InsecureSkipVerify: true}
+
+	cfg := apiclient.Config{
+		Addrs: []string{srv.Listener.Addr().String()},
+		Credentials: []apiclient.Credentials{
+			apiclient.LoadTLS(srv.TLS),
+		},
+	}
+	clt, err := NewClient(cfg)
+	require.NoError(t, err)
+
+	srv.StartTLS()
+
+	ca := newCertAuthority(t, "test", types.HostCA)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	t.Cleanup(cancel)
+
+	err = clt.RotateExternalCertAuthority(ctx, ca)
+	require.ErrorIs(t, trace.Unwrap(err), context.DeadlineExceeded)
+
+	close(sawRoot)
+	require.True(t, <-sawRoot, "handler never got /v2/authorities/host/rotate/external request")
+
+	close(sawSlow)
+	require.True(t, <-sawSlow, "handler never got /slow request")
+}
+
+func newCertAuthority(t *testing.T, name string, caType types.CertAuthType) types.CertAuthority {
+	ta := testauthority.New()
+	priv, pub, err := ta.GenerateKeyPair("")
+	require.NoError(t, err)
+
+	// CA for cluster1 with 1 key pair.
+	key, cert, err := tlsca.GenerateSelfSignedCA(pkix.Name{CommonName: name}, nil, time.Minute)
+	require.NoError(t, err)
+
+	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
+		Type:        caType,
+		ClusterName: name,
+		ActiveKeys: types.CAKeySet{
+			SSH: []*types.SSHKeyPair{{
+				PrivateKey:     priv,
+				PrivateKeyType: types.PrivateKeyType_RAW,
+				PublicKey:      pub,
+			}},
+			TLS: []*types.TLSKeyPair{{
+				Cert: cert,
+				Key:  key,
+			}},
+		},
+		Roles:      nil,
+		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_256,
+	})
+	require.NoError(t, err)
+	return ca
+}
diff --git a/lib/auth/db.go b/lib/auth/db.go
index d9ca5a4c35266..dbb1cd87c4512 100644
--- a/lib/auth/db.go
+++ b/lib/auth/db.go
@@ -43,7 +43,7 @@ func (s *Server) GenerateDatabaseCert(ctx context.Context, req *proto.DatabaseCe
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	hostCA, err := s.GetCertAuthority(types.CertAuthID{
+	hostCA, err := s.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
@@ -102,7 +102,7 @@ func (s *Server) SignDatabaseCSR(ctx context.Context, req *proto.DatabaseCSRRequ
 		return nil, trace.Wrap(err)
 	}
 
-	hostCA, err := s.GetCertAuthority(types.CertAuthID{
+	hostCA, err := s.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: req.ClusterName,
 	}, false)
@@ -144,7 +144,7 @@ func (s *Server) SignDatabaseCSR(ctx context.Context, req *proto.DatabaseCSRRequ
 	ttl := roles.AdjustSessionTTL(apidefaults.CertDuration)
 
 	// Generate the TLS certificate.
-	userCA, err := s.Trust.GetCertAuthority(types.CertAuthID{
+	userCA, err := s.Trust.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
diff --git a/lib/auth/desktop.go b/lib/auth/desktop.go
index 394b34717ad58..1fd07b7526e7c 100644
--- a/lib/auth/desktop.go
+++ b/lib/auth/desktop.go
@@ -45,7 +45,7 @@ func (s *Server) GenerateWindowsDesktopCert(ctx context.Context, req *proto.Wind
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	userCA, err := s.GetCertAuthority(types.CertAuthID{
+	userCA, err := s.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
diff --git a/lib/auth/github.go b/lib/auth/github.go
index 1477491396a2a..2872aeee55bfb 100644
--- a/lib/auth/github.go
+++ b/lib/auth/github.go
@@ -293,7 +293,7 @@ func (a *Server) validateGithubAuthCallback(q url.Values) (*githubAuthResponse,
 		re.auth.TLSCert = tlsCert
 
 		// Return the host CA for this cluster only.
-		authority, err := a.GetCertAuthority(types.CertAuthID{
+		authority, err := a.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName.GetClusterName(),
 		}, false)
diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go
index 4811125550916..105cd927cc5f3 100644
--- a/lib/auth/grpcserver.go
+++ b/lib/auth/grpcserver.go
@@ -1813,7 +1813,8 @@ func (g *GRPCServer) DeleteRole(ctx context.Context, req *proto.DeleteRoleReques
 func doMFAPresenceChallenge(ctx context.Context, actx *grpcContext, stream proto.AuthService_MaintainSessionPresenceServer, challengeReq *proto.PresenceMFAChallengeRequest) error {
 	user := actx.User.GetName()
 
-	authChallenge, err := actx.authServer.mfaAuthChallenge(ctx, user)
+	const passwordless = false
+	authChallenge, err := actx.authServer.mfaAuthChallenge(ctx, user, passwordless)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1835,7 +1836,7 @@ func doMFAPresenceChallenge(ctx context.Context, actx *grpcContext, stream proto
 		return trace.BadParameter("expected MFAAuthenticateResponse, got %T", challengeResp)
 	}
 
-	if _, err := actx.authServer.validateMFAAuthResponse(ctx, user, challengeResp); err != nil {
+	if _, _, err := actx.authServer.validateMFAAuthResponse(ctx, challengeResp, user, passwordless); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -1964,7 +1965,8 @@ func addMFADeviceAuthChallenge(gctx *grpcContext, stream proto.AuthService_AddMF
 	ctx := stream.Context()
 
 	// Note: authChallenge may be empty if this user has no existing MFA devices.
-	authChallenge, err := auth.mfaAuthChallenge(ctx, user)
+	const passwordless = false
+	authChallenge, err := auth.mfaAuthChallenge(ctx, user, passwordless)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1984,7 +1986,7 @@ func addMFADeviceAuthChallenge(gctx *grpcContext, stream proto.AuthService_AddMF
 	}
 	// Only validate if there was a challenge.
 	if authChallenge.TOTP != nil || authChallenge.WebauthnChallenge != nil {
-		if _, err := auth.validateMFAAuthResponse(ctx, user, authResp); err != nil {
+		if _, _, err := auth.validateMFAAuthResponse(ctx, authResp, user, passwordless); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -2006,6 +2008,7 @@ func addMFADeviceRegisterChallenge(gctx *grpcContext, stream proto.AuthService_A
 	res, err := auth.createRegisterChallenge(ctx, &newRegisterChallengeRequest{
 		username:            user,
 		deviceType:          initReq.DeviceType,
+		deviceUsage:         initReq.DeviceUsage,
 		webIdentityOverride: webIdentity,
 	})
 	if err != nil {
@@ -2088,7 +2091,8 @@ func deleteMFADeviceAuthChallenge(gctx *grpcContext, stream proto.AuthService_De
 	auth := gctx.authServer
 	user := gctx.User.GetName()
 
-	authChallenge, err := auth.mfaAuthChallenge(ctx, user)
+	const passwordless = false
+	authChallenge, err := auth.mfaAuthChallenge(ctx, user, passwordless)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -2107,7 +2111,7 @@ func deleteMFADeviceAuthChallenge(gctx *grpcContext, stream proto.AuthService_De
 	if authResp == nil {
 		return trace.BadParameter("expected MFAAuthenticateResponse, got %T", req)
 	}
-	if _, err := auth.validateMFAAuthResponse(ctx, user, authResp); err != nil {
+	if _, _, err := auth.validateMFAAuthResponse(ctx, authResp, user, passwordless); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -2251,7 +2255,8 @@ func userSingleUseCertsAuthChallenge(gctx *grpcContext, stream proto.AuthService
 	auth := gctx.authServer
 	user := gctx.User.GetName()
 
-	challenge, err := auth.mfaAuthChallenge(ctx, user)
+	const passwordless = false
+	challenge, err := auth.mfaAuthChallenge(ctx, user, passwordless)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2272,7 +2277,7 @@ func userSingleUseCertsAuthChallenge(gctx *grpcContext, stream proto.AuthService
 	if authResp == nil {
 		return nil, trace.BadParameter("expected MFAAuthenticateResponse, got %T", req.Request)
 	}
-	mfaDev, err := auth.validateMFAAuthResponse(ctx, user, authResp)
+	mfaDev, _, err := auth.validateMFAAuthResponse(ctx, authResp, user, passwordless)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3718,6 +3723,20 @@ func (g *GRPCServer) ListResources(ctx context.Context, req *proto.ListResources
 			}
 
 			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_KubeService{KubeService: srv}}
+		case types.KindWindowsDesktop:
+			desktop, ok := resource.(*types.WindowsDesktopV3)
+			if !ok {
+				return nil, trace.BadParameter("windows desktop has invalid type %T", resource)
+			}
+
+			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_WindowsDesktop{WindowsDesktop: desktop}}
+		case types.KindKubernetesCluster:
+			cluster, ok := resource.(*types.KubernetesClusterV3)
+			if !ok {
+				return nil, trace.BadParameter("kubernetes cluster has invalid type %T", resource)
+			}
+
+			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_KubeCluster{KubeCluster: cluster}}
 		default:
 			return nil, trace.NotImplemented("resource type %s doesn't support pagination", req.ResourceType)
 		}
diff --git a/lib/auth/grpcserver_test.go b/lib/auth/grpcserver_test.go
index 0e82c5d768c20..efb0df91a2ca1 100644
--- a/lib/auth/grpcserver_test.go
+++ b/lib/auth/grpcserver_test.go
@@ -88,6 +88,8 @@ func TestMFADeviceManagement(t *testing.T) {
 	require.NoError(t, err)
 	webKey2.PreferRPID = true
 	const webDev2Name = "webauthn2"
+	const pwdlessDevName = "pwdless"
+
 	addTests := []struct {
 		desc string
 		opts mfaAddTestOpts
@@ -229,6 +231,41 @@ func TestMFADeviceManagement(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc: "add passwordless device",
+			opts: mfaAddTestOpts{
+				initReq: &proto.AddMFADeviceRequestInit{
+					DeviceName:  pwdlessDevName,
+					DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
+					DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
+				},
+				authHandler:  devs.webAuthHandler,
+				checkAuthErr: require.NoError,
+				registerHandler: func(t *testing.T, challenge *proto.MFARegisterChallenge) *proto.MFARegisterResponse {
+					require.NotNil(t, challenge.GetWebauthn(), "WebAuthn challenge cannot be nil")
+
+					key, err := mocku2f.Create()
+					require.NoError(t, err)
+					key.PreferRPID = true
+					key.SetPasswordless()
+
+					ccr, err := key.SignCredentialCreation(webOrigin, wanlib.CredentialCreationFromProto(challenge.GetWebauthn()))
+					require.NoError(t, err)
+
+					return &proto.MFARegisterResponse{
+						Response: &proto.MFARegisterResponse_Webauthn{
+							Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
+						},
+					}
+				},
+				checkRegisterErr: require.NoError,
+				assertRegisteredDev: func(t *testing.T, dev *types.MFADevice) {
+					// Do a few simple device checks - lib/auth/webauthn goes in depth.
+					require.NotNil(t, dev.GetWebauthn(), "WebAuthnDevice cannot be nil")
+					require.True(t, true, dev.GetWebauthn().ResidentKey, "ResidentKey should be set to true")
+				},
+			},
+		},
 	}
 	for _, tt := range addTests {
 		t.Run(tt.desc, func(t *testing.T) {
@@ -246,7 +283,7 @@ func TestMFADeviceManagement(t *testing.T) {
 		deviceIDs[dev.GetName()] = dev.Id
 	}
 	sort.Strings(deviceNames)
-	require.Equal(t, deviceNames, []string{devs.TOTPName, devs.WebName, webDev2Name})
+	require.Equal(t, deviceNames, []string{pwdlessDevName, devs.TOTPName, devs.WebName, webDev2Name})
 
 	// Delete several of the MFA devices.
 	deleteTests := []struct {
@@ -321,6 +358,16 @@ func TestMFADeviceManagement(t *testing.T) {
 				checkErr:    require.NoError,
 			},
 		},
+		{
+			desc: "delete pwdless device by name",
+			opts: mfaDeleteTestOpts{
+				initReq: &proto.DeleteMFADeviceRequestInit{
+					DeviceName: pwdlessDevName,
+				},
+				authHandler: devs.webAuthHandler,
+				checkErr:    require.NoError,
+			},
+		},
 		{
 			desc: "delete webauthn device by name",
 			opts: mfaDeleteTestOpts{
@@ -1834,11 +1881,11 @@ func TestListResources(t *testing.T) {
 
 	testCases := map[string]struct {
 		resourceType   string
-		createResource func(name string) error
+		createResource func(name string, clt *Client) error
 	}{
 		"DatabaseServers": {
 			resourceType: types.KindDatabaseServer,
-			createResource: func(name string) error {
+			createResource: func(name string, clt *Client) error {
 				server, err := types.NewDatabaseServerV3(types.Metadata{
 					Name: name,
 				}, types.DatabaseServerSpecV3{
@@ -1857,7 +1904,7 @@ func TestListResources(t *testing.T) {
 		},
 		"ApplicationServers": {
 			resourceType: types.KindAppServer,
-			createResource: func(name string) error {
+			createResource: func(name string, clt *Client) error {
 				app, err := types.NewAppV3(types.Metadata{
 					Name: name,
 				}, types.AppSpecV3{
@@ -1884,7 +1931,7 @@ func TestListResources(t *testing.T) {
 		},
 		"KubeService": {
 			resourceType: types.KindKubeService,
-			createResource: func(name string) error {
+			createResource: func(name string, clt *Client) error {
 				server, err := types.NewServer(name, types.KindKubeService, types.ServerSpecV2{
 					KubernetesClusters: []*types.KubernetesCluster{
 						{Name: name, StaticLabels: map[string]string{"name": name}},
@@ -1899,7 +1946,7 @@ func TestListResources(t *testing.T) {
 		},
 		"Node": {
 			resourceType: types.KindNode,
-			createResource: func(name string) error {
+			createResource: func(name string, clt *Client) error {
 				server, err := types.NewServer(name, types.KindNode, types.ServerSpecV2{})
 				if err != nil {
 					return err
@@ -1909,10 +1956,25 @@ func TestListResources(t *testing.T) {
 				return err
 			},
 		},
+		"WindowsDesktops": {
+			resourceType: types.KindWindowsDesktop,
+			createResource: func(name string, clt *Client) error {
+				desktop, err := types.NewWindowsDesktopV3(name, nil,
+					types.WindowsDesktopSpecV3{Addr: "_", HostID: "_"})
+				if err != nil {
+					return err
+				}
+
+				return clt.UpsertWindowsDesktop(ctx, desktop)
+			},
+		},
 	}
 
 	for name, test := range testCases {
+		name := name
+		test := test
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
 			resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
 				ResourceType: test.resourceType,
 				Namespace:    apidefaults.Namespace,
@@ -1923,9 +1985,9 @@ func TestListResources(t *testing.T) {
 			require.Empty(t, resp.NextKey)
 
 			// create two resources
-			err = test.createResource("foo")
+			err = test.createResource("foo", clt)
 			require.NoError(t, err)
-			err = test.createResource("bar")
+			err = test.createResource("bar", clt)
 			require.NoError(t, err)
 
 			resp, err = clt.ListResources(ctx, proto.ListResourcesRequest{
@@ -1938,6 +2000,20 @@ func TestListResources(t *testing.T) {
 			require.Empty(t, resp.NextKey)
 			require.Empty(t, resp.TotalCount)
 
+			// Test types.KindKubernetesCluster
+			if test.resourceType == types.KindKubeService {
+				test.resourceType = types.KindKubernetesCluster
+				resp, err = clt.ListResources(ctx, proto.ListResourcesRequest{
+					ResourceType: test.resourceType,
+					Namespace:    apidefaults.Namespace,
+					Limit:        100,
+				})
+				require.NoError(t, err)
+				require.Len(t, resp.Resources, 2)
+				require.Empty(t, resp.NextKey)
+				require.Empty(t, resp.TotalCount)
+			}
+
 			// Test listing with NeedTotalCount flag.
 			if test.resourceType != types.KindKubeService {
 				resp, err = clt.ListResources(ctx, proto.ListResourcesRequest{
@@ -1966,62 +2042,75 @@ func TestListResources(t *testing.T) {
 func TestCustomRateLimiting(t *testing.T) {
 	t.Parallel()
 
-	cases := []struct {
-		name string
-		fn   func(*Client) error
+	ctx := context.Background()
+	tests := []struct {
+		name  string
+		burst int
+		fn    func(*Client) error
 	}{
 		{
 			name: "RPC ChangeUserAuthentication",
 			fn: func(clt *Client) error {
-				_, err := clt.ChangeUserAuthentication(context.Background(), &proto.ChangeUserAuthenticationRequest{})
+				_, err := clt.ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{})
+				return err
+			},
+		},
+		{
+			name:  "RPC CreateAuthenticateChallenge",
+			burst: defaults.LimiterPasswordlessBurst,
+			fn: func(clt *Client) error {
+				_, err := clt.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{})
 				return err
 			},
 		},
 		{
 			name: "RPC GetAccountRecoveryToken",
 			fn: func(clt *Client) error {
-				_, err := clt.GetAccountRecoveryToken(context.Background(), &proto.GetAccountRecoveryTokenRequest{})
+				_, err := clt.GetAccountRecoveryToken(ctx, &proto.GetAccountRecoveryTokenRequest{})
 				return err
 			},
 		},
 		{
 			name: "RPC StartAccountRecovery",
 			fn: func(clt *Client) error {
-				_, err := clt.StartAccountRecovery(context.Background(), &proto.StartAccountRecoveryRequest{})
+				_, err := clt.StartAccountRecovery(ctx, &proto.StartAccountRecoveryRequest{})
 				return err
 			},
 		},
 		{
 			name: "RPC VerifyAccountRecovery",
 			fn: func(clt *Client) error {
-				_, err := clt.VerifyAccountRecovery(context.Background(), &proto.VerifyAccountRecoveryRequest{})
+				_, err := clt.VerifyAccountRecovery(ctx, &proto.VerifyAccountRecoveryRequest{})
 				return err
 			},
 		},
 	}
-
-	for _, c := range cases {
-		c := c
-		t.Run(c.name, func(t *testing.T) {
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
-			// For now since we only have one custom rate limit,
-			// test limit for 1 request per minute with bursts up to 10 requests.
-			const maxAttempts = 11
-			var err error
-
-			// Create new instance per test case, to troubleshoot
-			// which test case specifically failed, otherwise
-			// multiple cases can fail from running cases in parallel.
+			// Create new instance per test case, to troubleshoot which test case
+			// specifically failed, otherwise multiple cases can fail from running
+			// cases in parallel.
 			srv := newTestTLSServer(t)
 			clt, err := srv.NewClient(TestNop())
 			require.NoError(t, err)
 
-			for i := 0; i < maxAttempts; i++ {
-				err = c.fn(clt)
-				require.Error(t, err)
+			var attempts int
+			if test.burst == 0 {
+				attempts = 10 // Good for most tests.
+			} else {
+				attempts = test.burst
 			}
-			require.True(t, trace.IsLimitExceeded(err))
+
+			for i := 0; i < attempts; i++ {
+				err = test.fn(clt)
+				require.False(t, trace.IsLimitExceeded(err), "got err = %v, want non-IsLimitExceeded", err)
+			}
+
+			err = test.fn(clt)
+			require.True(t, trace.IsLimitExceeded(err), "got err = %v, want LimitExceeded", err)
 		})
 	}
 }
diff --git a/lib/auth/helpers.go b/lib/auth/helpers.go
index 397aeb6d02f1a..f9007cd3f6a48 100644
--- a/lib/auth/helpers.go
+++ b/lib/auth/helpers.go
@@ -486,8 +486,8 @@ func (a *TestAuthServer) Clock() clockwork.Clock {
 }
 
 // Trust adds other server host certificate authority as trusted
-func (a *TestAuthServer) Trust(remote *TestAuthServer, roleMap types.RoleMap) error {
-	remoteCA, err := remote.AuthServer.GetCertAuthority(types.CertAuthID{
+func (a *TestAuthServer) Trust(ctx context.Context, remote *TestAuthServer, roleMap types.RoleMap) error {
+	remoteCA, err := remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: remote.ClusterName,
 	}, false)
@@ -498,7 +498,7 @@ func (a *TestAuthServer) Trust(remote *TestAuthServer, roleMap types.RoleMap) er
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	remoteCA, err = remote.AuthServer.GetCertAuthority(types.CertAuthID{
+	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: remote.ClusterName,
 	}, false)
@@ -923,7 +923,7 @@ type clt interface {
 
 // CreateRole creates a role without assigning any users. Used in tests.
 func CreateRole(ctx context.Context, clt clt, name string, spec types.RoleSpecV5) (types.Role, error) {
-	role, err := types.NewRole(name, spec)
+	role, err := types.NewRoleV3(name, spec)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/httpfallback.go b/lib/auth/httpfallback.go
index 0ff46995a0575..fc0fcfd6f8b6c 100644
--- a/lib/auth/httpfallback.go
+++ b/lib/auth/httpfallback.go
@@ -48,7 +48,7 @@ func (c *Client) UpsertRole(ctx context.Context, role types.Role) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(c.Endpoint("roles"), &upsertRoleRawReq{Role: data})
+	_, err = c.PostJSON(ctx, c.Endpoint("roles"), &upsertRoleRawReq{Role: data})
 	return trace.Wrap(err)
 }
 
@@ -65,7 +65,7 @@ func (c *Client) GetRole(ctx context.Context, name string) (types.Role, error) {
 	if name == "" {
 		return nil, trace.BadParameter("missing name")
 	}
-	out, err := c.Get(c.Endpoint("roles", name), url.Values{})
+	out, err := c.Get(ctx, c.Endpoint("roles", name), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -89,7 +89,7 @@ func (c *Client) DeleteRole(ctx context.Context, name string) error {
 	if name == "" {
 		return trace.BadParameter("missing name")
 	}
-	_, err := c.Delete(c.Endpoint("roles", name))
+	_, err := c.Delete(ctx, c.Endpoint("roles", name))
 	return trace.Wrap(err)
 }
 
@@ -103,7 +103,7 @@ func (c *Client) GetTokens(ctx context.Context, opts ...services.MarshalOption)
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("tokens"), url.Values{})
+	out, err := c.Get(ctx, c.Endpoint("tokens"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -124,7 +124,7 @@ func (c *Client) GetToken(ctx context.Context, token string) (types.ProvisionTok
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("tokens", token), url.Values{})
+	out, err := c.Get(ctx, c.Endpoint("tokens", token), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -142,7 +142,7 @@ func (c *Client) DeleteToken(ctx context.Context, token string) error {
 		return nil
 	}
 
-	_, err := c.Delete(c.Endpoint("tokens", token))
+	_, err := c.Delete(ctx, c.Endpoint("tokens", token))
 	return trace.Wrap(err)
 }
 
@@ -160,7 +160,7 @@ func (c *Client) UpsertOIDCConnector(ctx context.Context, connector types.OIDCCo
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(c.Endpoint("oidc", "connectors"), &upsertOIDCConnectorRawReq{
+	_, err = c.PostJSON(ctx, c.Endpoint("oidc", "connectors"), &upsertOIDCConnectorRawReq{
 		Connector: data,
 	})
 	if err != nil {
@@ -182,7 +182,7 @@ func (c *Client) GetOIDCConnector(ctx context.Context, id string, withSecrets bo
 	if id == "" {
 		return nil, trace.BadParameter("missing connector id")
 	}
-	out, err := c.Get(c.Endpoint("oidc", "connectors", id),
+	out, err := c.Get(ctx, c.Endpoint("oidc", "connectors", id),
 		url.Values{"with_secrets": []string{fmt.Sprintf("%t", withSecrets)}})
 	if err != nil {
 		return nil, err
@@ -200,7 +200,7 @@ func (c *Client) GetOIDCConnectors(ctx context.Context, withSecrets bool) ([]typ
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("oidc", "connectors"),
+	out, err := c.Get(ctx, c.Endpoint("oidc", "connectors"),
 		url.Values{"with_secrets": []string{fmt.Sprintf("%t", withSecrets)}})
 	if err != nil {
 		return nil, err
@@ -233,7 +233,7 @@ func (c *Client) DeleteOIDCConnector(ctx context.Context, connectorID string) er
 	if connectorID == "" {
 		return trace.BadParameter("missing connector id")
 	}
-	_, err := c.Delete(c.Endpoint("oidc", "connectors", connectorID))
+	_, err := c.Delete(ctx, c.Endpoint("oidc", "connectors", connectorID))
 	return trace.Wrap(err)
 }
 
@@ -251,7 +251,7 @@ func (c *Client) UpsertSAMLConnector(ctx context.Context, connector types.SAMLCo
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PutJSON(c.Endpoint("saml", "connectors"), &upsertSAMLConnectorRawReq{
+	_, err = c.PutJSON(ctx, c.Endpoint("saml", "connectors"), &upsertSAMLConnectorRawReq{
 		Connector: data,
 	})
 	if err != nil {
@@ -273,7 +273,7 @@ func (c *Client) GetSAMLConnector(ctx context.Context, id string, withSecrets bo
 	if id == "" {
 		return nil, trace.BadParameter("missing connector id")
 	}
-	out, err := c.Get(c.Endpoint("saml", "connectors", id),
+	out, err := c.Get(ctx, c.Endpoint("saml", "connectors", id),
 		url.Values{"with_secrets": []string{fmt.Sprintf("%t", withSecrets)}})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -291,7 +291,7 @@ func (c *Client) GetSAMLConnectors(ctx context.Context, withSecrets bool) ([]typ
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("saml", "connectors"),
+	out, err := c.Get(ctx, c.Endpoint("saml", "connectors"),
 		url.Values{"with_secrets": []string{fmt.Sprintf("%t", withSecrets)}})
 	if err != nil {
 		return nil, err
@@ -324,7 +324,7 @@ func (c *Client) DeleteSAMLConnector(ctx context.Context, connectorID string) er
 	if connectorID == "" {
 		return trace.BadParameter("missing connector id")
 	}
-	_, err := c.Delete(c.Endpoint("saml", "connectors", connectorID))
+	_, err := c.Delete(ctx, c.Endpoint("saml", "connectors", connectorID))
 	return trace.Wrap(err)
 }
 
@@ -342,7 +342,7 @@ func (c *Client) UpsertGithubConnector(ctx context.Context, connector types.Gith
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PutJSON(c.Endpoint("github", "connectors"), &upsertGithubConnectorRawReq{
+	_, err = c.PutJSON(ctx, c.Endpoint("github", "connectors"), &upsertGithubConnectorRawReq{
 		Connector: bytes,
 	})
 	if err != nil {
@@ -361,7 +361,7 @@ func (c *Client) GetGithubConnectors(ctx context.Context, withSecrets bool) ([]t
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("github", "connectors"), url.Values{
+	out, err := c.Get(ctx, c.Endpoint("github", "connectors"), url.Values{
 		"with_secrets": []string{strconv.FormatBool(withSecrets)},
 	})
 	if err != nil {
@@ -392,7 +392,7 @@ func (c *Client) GetGithubConnector(ctx context.Context, id string, withSecrets
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("github", "connectors", id), url.Values{
+	out, err := c.Get(ctx, c.Endpoint("github", "connectors", id), url.Values{
 		"with_secrets": []string{strconv.FormatBool(withSecrets)},
 	})
 	if err != nil {
@@ -411,7 +411,7 @@ func (c *Client) DeleteGithubConnector(ctx context.Context, id string) error {
 		return nil
 	}
 
-	_, err := c.Delete(c.Endpoint("github", "connectors", id))
+	_, err := c.Delete(ctx, c.Endpoint("github", "connectors", id))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -427,7 +427,7 @@ func (c *Client) GetTrustedCluster(ctx context.Context, name string) (types.Trus
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("trustedclusters", name), url.Values{})
+	out, err := c.Get(ctx, c.Endpoint("trustedclusters", name), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -449,7 +449,7 @@ func (c *Client) GetTrustedClusters(ctx context.Context) ([]types.TrustedCluster
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("trustedclusters"), url.Values{})
+	out, err := c.Get(ctx, c.Endpoint("trustedclusters"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -484,7 +484,7 @@ func (c *Client) UpsertTrustedCluster(ctx context.Context, trustedCluster types.
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.PostJSON(c.Endpoint("trustedclusters"), &upsertTrustedClusterReq{
+	out, err := c.PostJSON(ctx, c.Endpoint("trustedclusters"), &upsertTrustedClusterReq{
 		TrustedCluster: trustedClusterBytes,
 	})
 	if err != nil {
@@ -503,7 +503,7 @@ func (c *Client) DeleteTrustedCluster(ctx context.Context, name string) error {
 		return nil
 	}
 
-	_, err := c.Delete(c.Endpoint("trustedclusters", name))
+	_, err := c.Delete(ctx, c.Endpoint("trustedclusters", name))
 	return trace.Wrap(err)
 }
 
@@ -517,7 +517,7 @@ func (c *Client) DeleteAllNodes(ctx context.Context, namespace string) error {
 		return nil
 	}
 
-	_, err := c.Delete(c.Endpoint("namespaces", namespace, "nodes"))
+	_, err := c.Delete(ctx, c.Endpoint("namespaces", namespace, "nodes"))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -534,7 +534,7 @@ func (c *Client) DeleteNode(ctx context.Context, namespace string, name string)
 		return nil
 	}
 
-	_, err := c.Delete(c.Endpoint("namespaces", namespace, "nodes", name))
+	_, err := c.Delete(ctx, c.Endpoint("namespaces", namespace, "nodes", name))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -548,6 +548,9 @@ type nodeClient interface {
 
 // GetNodesWithLabels is a helper for getting a list of nodes with optional label-based filtering.  This is essentially
 // a wrapper around client.GetNodesWithLabels that performs fallback on NotImplemented errors.
+//
+// DELETE IN 11.0.0, this function is only called by lib/client/client.go (*ProxyClient).FindServersByLabels
+// which is also marked for deletion (replaced by FindNodesByFilters).
 func GetNodesWithLabels(ctx context.Context, clt nodeClient, namespace string, labels map[string]string) ([]types.Server, error) {
 	nodes, err := client.GetNodesWithLabels(ctx, clt, namespace, labels)
 	if err == nil || !trace.IsNotImplemented(err) {
@@ -573,6 +576,8 @@ func GetNodesWithLabels(ctx context.Context, clt nodeClient, namespace string, l
 }
 
 // GetNodes returns the list of servers registered in the cluster.
+//
+// DELETE IN 11.0.0, replaced by GetResourcesWithFilters
 func (c *Client) GetNodes(ctx context.Context, namespace string, opts ...services.MarshalOption) ([]types.Server, error) {
 	if resp, err := c.APIClient.GetNodes(ctx, namespace); err != nil {
 		if !trace.IsNotImplemented(err) {
@@ -582,7 +587,7 @@ func (c *Client) GetNodes(ctx context.Context, namespace string, opts ...service
 		return resp, nil
 	}
 
-	out, err := c.Get(c.Endpoint("namespaces", namespace, "nodes"), url.Values{})
+	out, err := c.Get(ctx, c.Endpoint("namespaces", namespace, "nodes"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/init.go b/lib/auth/init.go
index b831e3040985d..c99c245900d0f 100644
--- a/lib/auth/init.go
+++ b/lib/auth/init.go
@@ -203,7 +203,7 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 	// if resources are supplied, use them to bootstrap backend state
 	// on initial startup.
 	if len(cfg.Resources) > 0 {
-		firstStart, err := isFirstStart(asrv, cfg)
+		firstStart, err := isFirstStart(ctx, asrv, cfg)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -318,7 +318,7 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 	// generate certificate authorities if they don't exist
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
 		caID := types.CertAuthID{Type: caType, DomainName: cfg.ClusterName.GetClusterName()}
-		ca, err := asrv.GetCertAuthority(caID, true)
+		ca, err := asrv.GetCertAuthority(ctx, caID, true)
 		if err != nil {
 			if !trace.IsNotFound(err) {
 				return nil, trace.Wrap(err)
@@ -343,11 +343,11 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 					// without any active keys. These keys will not be used for
 					// any signing operations until a CA rotation. Only the Host
 					// CA is necessary to issue the Admin identity.
-					if err := asrv.ensureLocalAdditionalKeys(ca); err != nil {
+					if err := asrv.ensureLocalAdditionalKeys(ctx, ca); err != nil {
 						return nil, trace.Wrap(err)
 					}
 					// reload updated CA for below checks
-					if ca, err = asrv.GetCertAuthority(caID, true); err != nil {
+					if ca, err = asrv.GetCertAuthority(ctx, caID, true); err != nil {
 						return nil, trace.Wrap(err)
 					}
 				}
@@ -367,7 +367,7 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 
 	// Delete any unused keys from the keyStore. This is to avoid exhausting
 	// (or wasting) HSM resources.
-	if err := asrv.deleteUnusedKeys(); err != nil {
+	if err := asrv.deleteUnusedKeys(ctx); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -515,9 +515,10 @@ func createPresets(asrv *Server) error {
 
 // isFirstStart returns 'true' if the auth server is starting for the 1st time
 // on this server.
-func isFirstStart(authServer *Server, cfg InitConfig) (bool, error) {
+func isFirstStart(ctx context.Context, authServer *Server, cfg InitConfig) (bool, error) {
 	// check if the CA exists?
 	_, err := authServer.GetCertAuthority(
+		ctx,
 		types.CertAuthID{
 			DomainName: cfg.ClusterName.GetClusterName(),
 			Type:       types.HostCA,
@@ -570,6 +571,11 @@ func checkResourceConsistency(keyStore keystore.KeyStore, clusterName string, re
 			if r.GetName() == clusterName {
 				return trace.BadParameter("trusted cluster has same name as local cluster (%q)", clusterName)
 			}
+		case types.Role:
+			// Some options are only available with enterprise subscription
+			if err := checkRoleFeatureSupport(r); err != nil {
+				return trace.Wrap(err)
+			}
 		default:
 			// No validation checks for this resource type
 		}
@@ -948,7 +954,7 @@ func migrateRemoteClusters(ctx context.Context, asrv *Server) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	certAuthorities, err := asrv.GetCertAuthorities(types.HostCA, false)
+	certAuthorities, err := asrv.GetCertAuthorities(ctx, types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -999,7 +1005,7 @@ func migrateRemoteClusters(ctx context.Context, asrv *Server) error {
 func migrateCertAuthorities(ctx context.Context, asrv *Server) error {
 	var errors []error
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
-		cas, err := asrv.GetCertAuthorities(caType, true)
+		cas, err := asrv.GetCertAuthorities(ctx, caType, true)
 		if err != nil {
 			errors = append(errors, trace.Wrap(err, "fetching %v CAs", caType))
 			continue
diff --git a/lib/auth/init_test.go b/lib/auth/init_test.go
index e26569f6764f9..08c25e725aa1c 100644
--- a/lib/auth/init_test.go
+++ b/lib/auth/init_test.go
@@ -446,13 +446,14 @@ func TestClusterName(t *testing.T) {
 }
 
 func TestCASigningAlg(t *testing.T) {
+	ctx := context.Background()
 	verifyCAs := func(auth *Server, alg string) {
-		hostCAs, err := auth.GetCertAuthorities(types.HostCA, false)
+		hostCAs, err := auth.GetCertAuthorities(ctx, types.HostCA, false)
 		require.NoError(t, err)
 		for _, ca := range hostCAs {
 			require.Equal(t, sshutils.GetSigningAlgName(ca), alg)
 		}
-		userCAs, err := auth.GetCertAuthorities(types.UserCA, false)
+		userCAs, err := auth.GetCertAuthorities(ctx, types.UserCA, false)
 		require.NoError(t, err)
 		for _, ca := range userCAs {
 			require.Equal(t, sshutils.GetSigningAlgName(ca), alg)
@@ -635,7 +636,7 @@ func TestMigrateCertAuthorities(t *testing.T) {
 	var caSpecs []types.CertAuthoritySpecV2
 	for _, typ := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
 		t.Run(fmt.Sprintf("verify %v CA", typ), func(t *testing.T) {
-			cas, err := as.GetCertAuthorities(typ, true)
+			cas, err := as.GetCertAuthorities(ctx, typ, true)
 			require.NoError(t, err)
 			require.Len(t, cas, 1)
 			caSpecs = append(caSpecs, cas[0].(*types.CertAuthorityV2).Spec)
@@ -857,7 +858,7 @@ func TestIdentityChecker(t *testing.T) {
 	clusterName, err := authServer.GetDomainName()
 	require.NoError(t, err)
 
-	ca, err := authServer.GetCertAuthority(types.CertAuthID{
+	ca, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName,
 	}, true)
diff --git a/lib/auth/join.go b/lib/auth/join.go
index 6c0754034a8db..c50401c55713f 100644
--- a/lib/auth/join.go
+++ b/lib/auth/join.go
@@ -108,7 +108,10 @@ func (a *Server) generateCerts(ctx context.Context, provisionToken types.Provisi
 	if req.Role == types.RoleBot {
 		// bots use this endpoint but get a user cert
 		// botResourceName must be set, enforced in CheckAndSetDefaults
-		botResourceName := provisionToken.GetBotName()
+		botName := provisionToken.GetBotName()
+
+		// Append `bot-` to the bot name to derive its username.
+		botResourceName := BotResourceName(botName)
 		expires := a.GetClock().Now().Add(defaults.DefaultRenewableCertTTL)
 
 		joinMethod := provisionToken.GetJoinMethod()
@@ -141,7 +144,7 @@ func (a *Server) generateCerts(ctx context.Context, provisionToken types.Provisi
 			return nil, trace.BadParameter("unsupported join method %q for bot", joinMethod)
 		}
 
-		log.Infof("Bot %q has joined the cluster.", botResourceName)
+		log.Infof("Bot %q has joined the cluster.", botName)
 		return certs, nil
 	}
 	// generate and return host certificate and keys
diff --git a/lib/auth/join_test.go b/lib/auth/join_test.go
index f6c8b04f32e26..55654b9f06ce2 100644
--- a/lib/auth/join_test.go
+++ b/lib/auth/join_test.go
@@ -254,11 +254,11 @@ func TestAuth_RegisterUsingToken(t *testing.T) {
 	}
 }
 
-func newBotToken(t *testing.T, tokenName, user string, role types.SystemRole, expiry time.Time) types.ProvisionToken {
+func newBotToken(t *testing.T, tokenName, botName string, role types.SystemRole, expiry time.Time) types.ProvisionToken {
 	t.Helper()
 	token, err := types.NewProvisionTokenFromSpec(tokenName, expiry, types.ProvisionTokenSpecV2{
 		Roles:   []types.SystemRole{role},
-		BotName: user,
+		BotName: botName,
 	})
 	require.NoError(t, err, "could not create bot token")
 	return token
@@ -271,19 +271,22 @@ func TestRegister_Bot(t *testing.T) {
 
 	srv := newTestTLSServer(t)
 
+	botName := "test"
+	botResourceName := BotResourceName(botName)
+
 	_, err := createBotRole(context.Background(), srv.Auth(), "test", "bot-test", []string{})
 	require.NoError(t, err)
 
-	user, err := createBotUser(context.Background(), srv.Auth(), "test", "bot-test")
+	_, err = createBotUser(context.Background(), srv.Auth(), botName, botResourceName)
 	require.NoError(t, err)
 
 	later := srv.Clock().Now().Add(4 * time.Hour)
 
-	goodToken := newBotToken(t, "good-token", user.GetName(), types.RoleBot, later)
-	expiredToken := newBotToken(t, "expired", user.GetName(), types.RoleBot, srv.Clock().Now().Add(-1*time.Hour))
+	goodToken := newBotToken(t, "good-token", botName, types.RoleBot, later)
+	expiredToken := newBotToken(t, "expired", botName, types.RoleBot, srv.Clock().Now().Add(-1*time.Hour))
 	wrongKind := newBotToken(t, "wrong-kind", "", types.RoleNode, later)
 	wrongUser := newBotToken(t, "wrong-user", "llama", types.RoleBot, later)
-	invalidToken := newBotToken(t, "this-token-does-not-exist", user.GetName(), types.RoleBot, later)
+	invalidToken := newBotToken(t, "this-token-does-not-exist", botName, types.RoleBot, later)
 
 	err = srv.Auth().UpsertToken(context.Background(), goodToken)
 	require.NoError(t, err)
diff --git a/lib/auth/kube.go b/lib/auth/kube.go
index 54a9a76b9264d..6ca9d970bc6b1 100644
--- a/lib/auth/kube.go
+++ b/lib/auth/kube.go
@@ -17,6 +17,7 @@ limitations under the License.
 package auth
 
 import (
+	"context"
 	"time"
 
 	"github.com/gravitational/teleport"
@@ -62,6 +63,7 @@ type KubeCSRResponse struct {
 // ProcessKubeCSR processes CSR request against Kubernetes CA, returns
 // signed certificate if successful.
 func (s *Server) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
+	ctx := context.TODO()
 	if !modules.GetModules().Features().Kubernetes {
 		return nil, trace.AccessDenied(
 			"this Teleport cluster is not licensed for Kubernetes, please contact the cluster administrator")
@@ -79,7 +81,7 @@ func (s *Server) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
 	// with special provisions.
 	log.Debugf("Generating certificate to access remote Kubernetes clusters.")
 
-	hostCA, err := s.GetCertAuthority(types.CertAuthID{
+	hostCA, err := s.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: req.ClusterName,
 	}, false)
@@ -109,7 +111,7 @@ func (s *Server) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
 	roleNames := id.Groups
 	// This is a remote user, map roles to local roles first.
 	if id.TeleportCluster != clusterName.GetClusterName() {
-		ca, err := s.GetCertAuthority(types.CertAuthID{Type: types.UserCA, DomainName: id.TeleportCluster}, false)
+		ca, err := s.GetCertAuthority(ctx, types.CertAuthID{Type: types.UserCA, DomainName: id.TeleportCluster}, false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -130,7 +132,7 @@ func (s *Server) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
 	// Get the correct cert TTL based on roles.
 	ttl := roles.AdjustSessionTTL(apidefaults.CertDuration)
 
-	userCA, err := s.Trust.GetCertAuthority(types.CertAuthID{
+	userCA, err := s.Trust.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
diff --git a/lib/auth/methods.go b/lib/auth/methods.go
index a831d5b795284..9a2d486a99909 100644
--- a/lib/auth/methods.go
+++ b/lib/auth/methods.go
@@ -48,10 +48,11 @@ type AuthenticateUserRequest struct {
 
 // CheckAndSetDefaults checks and sets defaults
 func (a *AuthenticateUserRequest) CheckAndSetDefaults() error {
-	if a.Username == "" {
+	switch {
+	case a.Username == "" && a.Webauthn != nil: // OK, passwordless.
+	case a.Username == "":
 		return trace.BadParameter("missing parameter 'username'")
-	}
-	if a.Pass == nil && a.Webauthn == nil && a.OTP == nil && a.Session == nil {
+	case a.Pass == nil && a.Webauthn == nil && a.OTP == nil && a.Session == nil:
 		return trace.BadParameter("at least one authentication method is required")
 	}
 	return nil
@@ -77,16 +78,28 @@ type SessionCreds struct {
 	ID string `json:"id"`
 }
 
-// AuthenticateUser authenticates user based on the request type
-func (s *Server) AuthenticateUser(req AuthenticateUserRequest) error {
-	mfaDev, err := s.authenticateUser(context.TODO(), req)
+// AuthenticateUser authenticates user based on the request type.
+// Returns the username of the authenticated user.
+func (s *Server) AuthenticateUser(req AuthenticateUserRequest) (string, error) {
+	user := req.Username
+
+	mfaDev, actualUser, err := s.authenticateUser(context.TODO(), req)
+	// err is handled below.
+	switch {
+	case user != "" && actualUser != "" && user != actualUser:
+		log.Warnf("Authenticate user mismatch (%q vs %q). Using request user (%q)", user, actualUser, user)
+	case user == "" && actualUser != "":
+		log.Debugf("User %q authenticated via passwordless", actualUser)
+		user = actualUser
+	}
+
 	event := &apievents.UserLogin{
 		Metadata: apievents.Metadata{
 			Type: events.UserLoginEvent,
 			Code: events.UserLocalLoginFailureCode,
 		},
 		UserMetadata: apievents.UserMetadata{
-			User: req.Username,
+			User: user,
 		},
 		Method: events.LoginMethodLocal,
 	}
@@ -105,14 +118,27 @@ func (s *Server) AuthenticateUser(req AuthenticateUserRequest) error {
 	if err := s.emitter.EmitAuditEvent(s.closeCtx, event); err != nil {
 		log.WithError(err).Warn("Failed to emit login event.")
 	}
-	return err
+	return user, trace.Wrap(err)
 }
 
-func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserRequest) (*types.MFADevice, error) {
+// authenticateWebauthnError is the generic error message returned for failed
+// WebAuthn authentication attempts.
+const authenticateWebauthnError = "invalid Webauthn response"
+
+// authenticateUser authenticates a user through various methods (password, MFA,
+// passwordless)
+// Returns the device used to authenticate (if applicable) and the username.
+func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserRequest) (*types.MFADevice, string, error) {
 	if err := req.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
+		return nil, "", trace.Wrap(err)
 	}
 	user := req.Username
+	passwordless := user == ""
+
+	// Only one path if passwordless, other variants shouldn't see an empty user.
+	if passwordless {
+		return s.authenticatePasswordless(ctx, req)
+	}
 
 	// Try 2nd-factor-enabled authentication schemes first.
 	var authenticateFn func() (*types.MFADevice, error)
@@ -126,9 +152,10 @@ func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserReque
 					Webauthn: wanlib.CredentialAssertionResponseToProto(req.Webauthn),
 				},
 			}
-			return s.validateMFAAuthResponse(ctx, user, mfaResponse)
+			dev, _, err := s.validateMFAAuthResponse(ctx, mfaResponse, user, passwordless)
+			return dev, trace.Wrap(err)
 		}
-		failMsg = "invalid Webauthn response"
+		failMsg = authenticateWebauthnError
 	case req.OTP != nil:
 		authenticateFn = func() (*types.MFADevice, error) {
 			// OTP cannot be validated by validateMFAAuthResponse because we need to
@@ -152,28 +179,28 @@ func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserReque
 		case err != nil:
 			log.Debugf("User %v failed to authenticate: %v.", user, err)
 			if fieldErr := getErrorByTraceField(err); fieldErr != nil {
-				return nil, trace.Wrap(fieldErr)
+				return nil, "", trace.Wrap(fieldErr)
 			}
 
-			return nil, trace.AccessDenied(failMsg)
+			return nil, "", trace.AccessDenied(failMsg)
 		case dev == nil:
 			log.Debugf(
 				"MFA authentication returned nil device (Webauthn = %v, TOTP = %v): %v.",
 				req.Webauthn != nil, req.OTP != nil, err)
-			return nil, trace.AccessDenied(failMsg)
+			return nil, "", trace.AccessDenied(failMsg)
 		default:
-			return dev, nil
+			return dev, user, nil
 		}
 	}
 
 	// Try password-only authentication last.
 	if req.Pass == nil {
-		return nil, trace.AccessDenied("unsupported authentication method")
+		return nil, "", trace.AccessDenied("unsupported authentication method")
 	}
 
 	authPreference, err := s.GetAuthPreference(ctx)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, "", trace.Wrap(err)
 	}
 
 	// When using password only make sure that auth preference does not require
@@ -186,37 +213,62 @@ func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserReque
 		// registered.
 		devs, err := s.Identity.GetMFADevices(ctx, user, false /* withSecrets */)
 		if err != nil && !trace.IsNotFound(err) {
-			return nil, trace.Wrap(err)
+			return nil, "", trace.Wrap(err)
 		}
 		if len(devs) != 0 {
 			log.Warningf("MFA bypass attempt by user %q, access denied.", user)
-			return nil, trace.AccessDenied("missing second factor authentication")
+			return nil, "", trace.AccessDenied("missing second factor authentication")
 		}
 	default:
 		// Some form of MFA is required but none provided. Either client is
 		// buggy (didn't send MFA response) or someone is trying to bypass
 		// MFA.
 		log.Warningf("MFA bypass attempt by user %q, access denied.", user)
-		return nil, trace.AccessDenied("missing second factor")
+		return nil, "", trace.AccessDenied("missing second factor")
 	}
 	if err = s.WithUserLock(user, func() error {
 		return s.checkPasswordWOToken(user, req.Pass.Password)
 	}); err != nil {
 		if fieldErr := getErrorByTraceField(err); fieldErr != nil {
-			return nil, trace.Wrap(fieldErr)
+			return nil, "", trace.Wrap(fieldErr)
 		}
 		// provide obscure message on purpose, while logging the real
 		// error server side
 		log.Debugf("User %v failed to authenticate: %v.", user, err)
-		return nil, trace.AccessDenied("invalid username or password")
+		return nil, "", trace.AccessDenied("invalid username or password")
 	}
-	return nil, nil
+	return nil, user, nil
+}
+
+func (s *Server) authenticatePasswordless(ctx context.Context, req AuthenticateUserRequest) (*types.MFADevice, string, error) {
+	mfaResponse := &proto.MFAAuthenticateResponse{
+		Response: &proto.MFAAuthenticateResponse_Webauthn{
+			Webauthn: wanlib.CredentialAssertionResponseToProto(req.Webauthn),
+		},
+	}
+	dev, user, err := s.validateMFAAuthResponse(ctx, mfaResponse, "", true /* passwordless */)
+	if err != nil {
+		log.Debugf("Passwordless authentication failed: %v", err)
+		return nil, "", trace.AccessDenied(authenticateWebauthnError)
+	}
+
+	// A distinction between passwordless and "plain" MFA is that we can't
+	// acquire the user lock beforehand (or at all on failures!)
+	// We do grab it here so successful logins go through the regular process.
+	if err := s.WithUserLock(user, func() error { return nil }); err != nil {
+		log.Debugf("WithUserLock for user %q failed during passwordless authentication: %v", user, err)
+		return nil, user, trace.AccessDenied(authenticateWebauthnError)
+	}
+
+	return dev, user, nil
 }
 
 // AuthenticateWebUser authenticates web user, creates and returns a web session
 // if authentication is successful. In case the existing session ID is used to authenticate,
 // returns the existing session instead of creating a new one
 func (s *Server) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSession, error) {
+	username := req.Username // Empty if passwordless.
+
 	ctx := context.TODO()
 	authPref, err := s.GetAuthPreference(ctx)
 	if err != nil {
@@ -228,13 +280,13 @@ func (s *Server) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSess
 	// This condition uses Session as a blanket check, because any new method added
 	// to the local auth will be disabled by default.
 	if !authPref.GetAllowLocalAuth() && req.Session == nil {
-		s.emitNoLocalAuthEvent(req.Username)
+		s.emitNoLocalAuthEvent(username)
 		return nil, trace.AccessDenied(noLocalAuth)
 	}
 
 	if req.Session != nil {
 		session, err := s.GetWebSession(context.TODO(), types.GetWebSessionRequest{
-			User:      req.Username,
+			User:      username,
 			SessionID: req.Session.ID,
 		})
 		if err != nil {
@@ -243,11 +295,13 @@ func (s *Server) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSess
 		return session, nil
 	}
 
-	if err := s.AuthenticateUser(req); err != nil {
+	actualUser, err := s.AuthenticateUser(req)
+	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	username = actualUser
 
-	user, err := s.GetUser(req.Username, false)
+	user, err := s.GetUser(username, false /* withSecrets */)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -349,13 +403,15 @@ func AuthoritiesToTrustedCerts(authorities []types.CertAuthority) []TrustedCerts
 // AuthenticateSSHUser authenticates an SSH user and returns SSH and TLS
 // certificates for the public key in req.
 func (s *Server) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginResponse, error) {
+	username := req.Username // Empty if passwordless.
+
 	ctx := context.TODO()
 	authPref, err := s.GetAuthPreference(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	if !authPref.GetAllowLocalAuth() {
-		s.emitNoLocalAuthEvent(req.Username)
+		s.emitNoLocalAuthEvent(username)
 		return nil, trace.AccessDenied(noLocalAuth)
 	}
 
@@ -364,13 +420,15 @@ func (s *Server) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginRespo
 		return nil, trace.Wrap(err)
 	}
 
-	if err := s.AuthenticateUser(req.AuthenticateUserRequest); err != nil {
+	actualUser, err := s.AuthenticateUser(req.AuthenticateUserRequest)
+	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	username = actualUser
 
 	// It's safe to extract the roles and traits directly from services.User as
 	// this endpoint is only used for local accounts.
-	user, err := s.GetUser(req.Username, false)
+	user, err := s.GetUser(username, false /* withSecrets */)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -380,7 +438,7 @@ func (s *Server) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginRespo
 	}
 
 	// Return the host CA for this cluster only.
-	authority, err := s.GetCertAuthority(types.CertAuthID{
+	authority, err := s.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, false)
@@ -406,7 +464,7 @@ func (s *Server) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginRespo
 	}
 	UserLoginCount.Inc()
 	return &SSHLoginResponse{
-		Username:    req.Username,
+		Username:    username,
 		Cert:        certs.SSH,
 		TLSCert:     certs.TLS,
 		HostSigners: AuthoritiesToTrustedCerts(hostCertAuthorities),
diff --git a/lib/auth/middleware.go b/lib/auth/middleware.go
index 45d914dd4f17f..08752948435cc 100644
--- a/lib/auth/middleware.go
+++ b/lib/auth/middleware.go
@@ -30,6 +30,7 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -319,6 +320,7 @@ func (a *Middleware) Wrap(h http.Handler) {
 
 func getCustomRate(endpoint string) *ratelimit.RateSet {
 	switch endpoint {
+	// Account recovery RPCs.
 	case
 		"/proto.AuthService/ChangeUserAuthentication",
 		"/proto.AuthService/GetAccountRecoveryToken",
@@ -331,8 +333,18 @@ func getCustomRate(endpoint string) *ratelimit.RateSet {
 			return nil
 		}
 		return rates
+	// Passwordless RPCs (potential unauthenticated challenge generation).
+	case "/proto.AuthService/CreateAuthenticateChallenge":
+		const period = defaults.LimiterPasswordlessPeriod
+		const average = defaults.LimiterPasswordlessAverage
+		const burst = defaults.LimiterPasswordlessBurst
+		rates := ratelimit.NewRateSet()
+		if err := rates.Add(period, average, burst); err != nil {
+			log.WithError(err).Debugf("Failed to define a custom rate for rpc method %q, using default rate", endpoint)
+			return nil
+		}
+		return rates
 	}
-
 	return nil
 }
 
@@ -570,14 +582,15 @@ func (a *Middleware) WrapContextWithUser(ctx context.Context, conn *tls.Conn) (c
 
 // ClientCertPool returns trusted x509 cerificate authority pool
 func ClientCertPool(client AccessCache, clusterName string) (*x509.CertPool, error) {
+	ctx := context.TODO()
 	pool := x509.NewCertPool()
 	var authorities []types.CertAuthority
 	if clusterName == "" {
-		hostCAs, err := client.GetCertAuthorities(types.HostCA, false)
+		hostCAs, err := client.GetCertAuthorities(ctx, types.HostCA, false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		userCAs, err := client.GetCertAuthorities(types.UserCA, false)
+		userCAs, err := client.GetCertAuthorities(ctx, types.UserCA, false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -585,12 +598,14 @@ func ClientCertPool(client AccessCache, clusterName string) (*x509.CertPool, err
 		authorities = append(authorities, userCAs...)
 	} else {
 		hostCA, err := client.GetCertAuthority(
+			ctx,
 			types.CertAuthID{Type: types.HostCA, DomainName: clusterName},
 			false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		userCA, err := client.GetCertAuthority(
+			ctx,
 			types.CertAuthID{Type: types.UserCA, DomainName: clusterName},
 			false)
 		if err != nil {
diff --git a/lib/auth/mocku2f/mocku2f.go b/lib/auth/mocku2f/mocku2f.go
index fe88acd22e224..aaa643c1d4135 100644
--- a/lib/auth/mocku2f/mocku2f.go
+++ b/lib/auth/mocku2f/mocku2f.go
@@ -143,6 +143,14 @@ func CreateWithKeyHandle(keyHandle []byte) (*Key, error) {
 	}, nil
 }
 
+// SetPasswordless sets common passwordless options in Key.
+// Options are AllowResidentKey, IgnoreAllowedCredentials and SetUV.
+func (muk *Key) SetPasswordless() {
+	muk.AllowResidentKey = true         // Passwordless keys must be resident.
+	muk.IgnoreAllowedCredentials = true // Empty for passwordless challenges.
+	muk.SetUV = true                    // UV required for passwordless.
+}
+
 func (muk *Key) RegisterResponse(req *u2f.RegisterRequest) (*u2f.RegisterResponse, error) {
 	appIDHash := sha256.Sum256([]byte(req.AppID))
 
@@ -201,7 +209,7 @@ func (muk *Key) signRegister(appIDHash, clientDataHash []byte) (*signRegisterRes
 		return nil, trace.Wrap(err)
 	}
 
-	var flags = uint8(u2fRegistrationFlags)
+	flags := uint8(u2fRegistrationFlags)
 	if muk.SetUV {
 		// Mimic WebAuthn flags if SetUV is true.
 		flags = uint8(protocol.FlagUserPresent | protocol.FlagUserVerified | protocol.FlagAttestedCredentialData)
diff --git a/lib/auth/oidc.go b/lib/auth/oidc.go
index f732841395f33..fd36bba8b0d29 100644
--- a/lib/auth/oidc.go
+++ b/lib/auth/oidc.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 
@@ -365,7 +365,7 @@ func (a *Server) validateOIDCAuthCallback(q url.Values) (*oidcAuthResponse, erro
 
 	// If the request is coming from a browser, create a web session.
 	if req.CreateWebSession {
-		session, err := a.createWebSession(context.TODO(), types.NewWebSessionRequest{
+		session, err := a.createWebSession(ctx, types.NewWebSessionRequest{
 			User:       user.GetName(),
 			Roles:      user.GetRoles(),
 			Traits:     user.GetTraits(),
@@ -389,7 +389,7 @@ func (a *Server) validateOIDCAuthCallback(q url.Values) (*oidcAuthResponse, erro
 		re.auth.TLSCert = tlsCert
 
 		// Return the host CA for this cluster only.
-		authority, err := a.GetCertAuthority(types.CertAuthID{
+		authority, err := a.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName.GetClusterName(),
 		}, false)
@@ -600,7 +600,7 @@ func claimsFromUserInfo(oidcClient *oidc.Client, issuerURL string, accessToken s
 			code == http.StatusForbidden || code == http.StatusMethodNotAllowed {
 			return nil, trace.AccessDenied("bad status code: %v", code)
 		}
-		body, err := ioutil.ReadAll(resp.Body)
+		body, err := io.ReadAll(resp.Body)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/auth/password.go b/lib/auth/password.go
index a357161b48814..1023a3a17a59c 100644
--- a/lib/auth/password.go
+++ b/lib/auth/password.go
@@ -122,7 +122,7 @@ func (s *Server) ChangePassword(req services.ChangePasswordReq) error {
 			Token:    req.SecondFactorToken,
 		}
 	}
-	if _, err := s.authenticateUser(ctx, authReq); err != nil {
+	if _, _, err := s.authenticateUser(ctx, authReq); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/lib/auth/permissions.go b/lib/auth/permissions.go
index e0c886ba8d7fd..66934095315e9 100644
--- a/lib/auth/permissions.go
+++ b/lib/auth/permissions.go
@@ -81,10 +81,10 @@ type AuthorizerAccessPoint interface {
 	GetUser(name string, withSecrets bool) (types.User, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterAuditConfig returns cluster audit configuration.
 	GetClusterAuditConfig(ctx context.Context, opts ...services.MarshalOption) (types.ClusterAuditConfig, error)
@@ -174,7 +174,7 @@ func (a *authorizer) fromUser(ctx context.Context, userI interface{}) (*Context,
 	case LocalUser:
 		return a.authorizeLocalUser(user)
 	case RemoteUser:
-		return a.authorizeRemoteUser(user)
+		return a.authorizeRemoteUser(ctx, user)
 	case BuiltinRole:
 		return a.authorizeBuiltinRole(ctx, user)
 	case RemoteBuiltinRole:
@@ -190,8 +190,8 @@ func (a *authorizer) authorizeLocalUser(u LocalUser) (*Context, error) {
 }
 
 // authorizeRemoteUser returns checker based on cert authority roles
-func (a *authorizer) authorizeRemoteUser(u RemoteUser) (*Context, error) {
-	ca, err := a.accessPoint.GetCertAuthority(types.CertAuthID{
+func (a *authorizer) authorizeRemoteUser(ctx context.Context, u RemoteUser) (*Context, error) {
+	ca, err := a.accessPoint.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: u.ClusterName,
 	}, false)
diff --git a/lib/auth/permissions_test.go b/lib/auth/permissions_test.go
index a11f9282ea075..f2dc9cc90a6ff 100644
--- a/lib/auth/permissions_test.go
+++ b/lib/auth/permissions_test.go
@@ -66,13 +66,13 @@ func TestAuthorizeWithLocksForLocalUser(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	user, _, err := CreateUserAndRole(srv.AuthServer, "test-user", []string{})
+	user, role, err := CreateUserAndRole(srv.AuthServer, "test-user", []string{})
 	require.NoError(t, err)
 	localUser := LocalUser{
 		Username: user.GetName(),
 		Identity: tlsca.Identity{
 			Username:       user.GetName(),
-			Groups:         []string{"test-role-1"},
+			Groups:         []string{role.GetName()},
 			MFAVerified:    "mfa-device-id",
 			ActiveRequests: []string{"test-request"},
 		},
diff --git a/lib/auth/register.go b/lib/auth/register.go
index ca050b59d3ccf..d905ea00318ea 100644
--- a/lib/auth/register.go
+++ b/lib/auth/register.go
@@ -19,7 +19,6 @@ package auth
 import (
 	"context"
 	"crypto/x509"
-	"encoding/json"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client"
@@ -521,39 +520,3 @@ func ReRegister(params ReRegisterParams) (*Identity, error) {
 
 	return ReadIdentityFromKeyPair(params.PrivateKey, certs)
 }
-
-// LegacyCerts is equivalent to proto.Certs, but uses
-// JSON keys expected by old clients (7.x and earlier)
-// DELETE in 9.0.0 (Joerger/zmb3)
-type LegacyCerts struct {
-	SSHCert    []byte   `json:"cert"`
-	TLSCert    []byte   `json:"tls_cert"`
-	TLSCACerts [][]byte `json:"tls_ca_certs"`
-	SSHCACerts [][]byte `json:"ssh_ca_certs"`
-}
-
-// LegacyCertsFromProto converts proto.Certs to LegacyCerts.
-// DELETE in 10.0.0 (Joerger/zmb3)
-func LegacyCertsFromProto(c *proto.Certs) *LegacyCerts {
-	return &LegacyCerts{
-		SSHCert:    c.SSH,
-		TLSCert:    c.TLS,
-		SSHCACerts: c.SSHCACerts,
-		TLSCACerts: c.TLSCACerts,
-	}
-}
-
-// UnmarshalLegacyCerts unmarshals the a legacy certs response as proto.Certs.
-// DELETE in 10.0.0 (Joerger/zmb3)
-func UnmarshalLegacyCerts(bytes []byte) (*proto.Certs, error) {
-	var lc LegacyCerts
-	if err := json.Unmarshal(bytes, &lc); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &proto.Certs{
-		SSH:        lc.SSHCert,
-		TLS:        lc.TLSCert,
-		TLSCACerts: lc.TLSCACerts,
-		SSHCACerts: lc.SSHCACerts,
-	}, nil
-}
diff --git a/lib/auth/rotate.go b/lib/auth/rotate.go
index 749b64c49a4e8..b8583e41a390b 100644
--- a/lib/auth/rotate.go
+++ b/lib/auth/rotate.go
@@ -17,6 +17,7 @@ limitations under the License.
 package auth
 
 import (
+	"context"
 	"crypto/rsa"
 	"crypto/x509/pkix"
 	"time"
@@ -201,7 +202,7 @@ type rotationReq struct {
 // It is possible to switch from automatic to manual by setting the phase
 // to the rollback phase.
 //
-func (a *Server) RotateCertAuthority(req RotateRequest) error {
+func (a *Server) RotateCertAuthority(ctx context.Context, req RotateRequest) error {
 	if err := req.CheckAndSetDefaults(a.clock); err != nil {
 		return trace.Wrap(err)
 	}
@@ -212,7 +213,7 @@ func (a *Server) RotateCertAuthority(req RotateRequest) error {
 
 	caTypes := req.Types()
 	for _, caType := range caTypes {
-		existing, err := a.Trust.GetCertAuthority(types.CertAuthID{
+		existing, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       caType,
 			DomainName: clusterName.GetClusterName(),
 		}, true)
@@ -250,7 +251,7 @@ func (a *Server) RotateCertAuthority(req RotateRequest) error {
 // RotateExternalCertAuthority rotates external certificate authority,
 // this method is called by remote trusted cluster and is used to update
 // only public keys and certificates of the certificate authority.
-func (a *Server) RotateExternalCertAuthority(ca types.CertAuthority) error {
+func (a *Server) RotateExternalCertAuthority(ctx context.Context, ca types.CertAuthority) error {
 	if ca == nil {
 		return trace.BadParameter("missing certificate authority")
 	}
@@ -265,7 +266,7 @@ func (a *Server) RotateExternalCertAuthority(ca types.CertAuthority) error {
 		return trace.BadParameter("can not rotate local certificate authority")
 	}
 
-	existing, err := a.Trust.GetCertAuthority(types.CertAuthID{
+	existing, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       ca.GetType(),
 		DomainName: ca.GetClusterName(),
 	}, false)
@@ -309,13 +310,13 @@ func (a *Server) RotateExternalCertAuthority(ca types.CertAuthority) error {
 // autoRotateCertAuthorities automatically rotates cert authorities,
 // does nothing if no rotation parameters were set up
 // or it is too early to rotate per schedule
-func (a *Server) autoRotateCertAuthorities() error {
+func (a *Server) autoRotateCertAuthorities(ctx context.Context) error {
 	clusterName, err := a.GetClusterName()
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
-		ca, err := a.Trust.GetCertAuthority(types.CertAuthID{
+		ca, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       caType,
 			DomainName: clusterName.GetClusterName(),
 		}, true)
@@ -327,7 +328,7 @@ func (a *Server) autoRotateCertAuthorities() error {
 		}
 		// make sure there are local AdditionalKeys during init phase of rotation
 		if ca.GetRotation().Phase == types.RotationPhaseInit {
-			if err := a.ensureLocalAdditionalKeys(ca); err != nil {
+			if err := a.ensureLocalAdditionalKeys(ctx, ca); err != nil {
 				return trace.Wrap(err)
 			}
 		}
diff --git a/lib/auth/saml.go b/lib/auth/saml.go
index c007476d3cc1a..8a97bee746508 100644
--- a/lib/auth/saml.go
+++ b/lib/auth/saml.go
@@ -22,7 +22,7 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
-	"io/ioutil"
+	"io"
 
 	"github.com/google/go-cmp/cmp"
 
@@ -254,7 +254,7 @@ func parseSAMLInResponseTo(response string) (string, error) {
 	err := doc.ReadFromBytes(raw)
 	if err != nil {
 		// Attempt to inflate the response in case it happens to be compressed (as with one case at saml.oktadev.com)
-		buf, err := ioutil.ReadAll(flate.NewReader(bytes.NewReader(raw)))
+		buf, err := io.ReadAll(flate.NewReader(bytes.NewReader(raw)))
 		if err != nil {
 			return "", trace.Wrap(err)
 		}
@@ -427,7 +427,7 @@ func (a *Server) validateSAMLResponse(samlResponse string) (*samlAuthResponse, e
 
 	// If the request is coming from a browser, create a web session.
 	if request.CreateWebSession {
-		session, err := a.createWebSession(context.TODO(), types.NewWebSessionRequest{
+		session, err := a.createWebSession(ctx, types.NewWebSessionRequest{
 			User:       user.GetName(),
 			Roles:      user.GetRoles(),
 			Traits:     user.GetTraits(),
@@ -455,7 +455,7 @@ func (a *Server) validateSAMLResponse(samlResponse string) (*samlAuthResponse, e
 		re.auth.TLSCert = tlsCert
 
 		// Return the host CA for this cluster only.
-		authority, err := a.GetCertAuthority(types.CertAuthID{
+		authority, err := a.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName.GetClusterName(),
 		}, false)
diff --git a/lib/auth/session_access.go b/lib/auth/session_access.go
index c4b77b7efde5d..82df61ac6bd20 100644
--- a/lib/auth/session_access.go
+++ b/lib/auth/session_access.go
@@ -17,6 +17,7 @@ limitations under the License.
 package auth
 
 import (
+	"fmt"
 	"regexp"
 	"strings"
 
@@ -36,17 +37,27 @@ import (
 // that is harder to debug in the case of misconfigured policies or other error and are harder to intuitively follow.
 // In the real world, the number of roles and session are small enough that this doesn't have a meaningful impact.
 type SessionAccessEvaluator struct {
-	kind       types.SessionKind
-	policySets []*types.SessionTrackerPolicySet
+	kind        types.SessionKind
+	policySets  []*types.SessionTrackerPolicySet
+	isModerated bool
 }
 
 // NewSessionAccessEvaluator creates a new session access evaluator for a given session kind
 // and a set of roles attached to the host user.
 func NewSessionAccessEvaluator(policySets []*types.SessionTrackerPolicySet, kind types.SessionKind) SessionAccessEvaluator {
-	return SessionAccessEvaluator{
-		kind,
-		policySets,
+	e := SessionAccessEvaluator{
+		kind:       kind,
+		policySets: policySets,
 	}
+
+	for _, policySet := range policySets {
+		if len(e.extractApplicablePolicies(policySet)) != 0 {
+			e.isModerated = true
+			break
+		}
+	}
+
+	return e
 }
 
 func getAllowPolicies(participant SessionAccessContext) []*types.SessionJoinPolicy {
@@ -102,8 +113,13 @@ func (ctx *SessionAccessContext) GetResource() (types.Resource, error) {
 	return nil, trace.BadParameter("resource unsupported")
 }
 
+// IsModerated returns true if the session needs moderation.
+func (e *SessionAccessEvaluator) IsModerated() bool {
+	return e.isModerated
+}
+
 func (e *SessionAccessEvaluator) matchesPredicate(ctx *SessionAccessContext, require *types.SessionRequirePolicy, allow *types.SessionJoinPolicy) (bool, error) {
-	if !e.matchesKind(require.Kinds) || !e.matchesKind(allow.Kinds) {
+	if !e.matchesKind(allow.Kinds) {
 		return false, nil
 	}
 
@@ -209,6 +225,39 @@ func (e *SessionAccessEvaluator) hasPolicies() bool {
 	return false
 }
 
+// Generate a pretty-printed string of precise requirements for session start suitable for user display.
+func (e *SessionAccessEvaluator) PrettyRequirementsList() string {
+	s := new(strings.Builder)
+	s.WriteString("require all:")
+
+	for _, policySet := range e.policySets {
+		policies := e.extractApplicablePolicies(policySet)
+		if len(policies) == 0 {
+			continue
+		}
+
+		fmt.Fprintf(s, "\r\n   one of (%v):", policySet.Name)
+		for _, require := range policies {
+			fmt.Fprintf(s, "\r\n    - %vx %v with mode %v", require.Count, require.Filter, strings.Join(require.Modes, " or "))
+		}
+	}
+
+	return s.String()
+}
+
+// extractApplicablePolicies extracts all policies that match the session kind.
+func (e *SessionAccessEvaluator) extractApplicablePolicies(set *types.SessionTrackerPolicySet) []*types.SessionRequirePolicy {
+	var policies []*types.SessionRequirePolicy
+
+	for _, require := range set.RequireSessionJoin {
+		if e.matchesKind(require.Kinds) {
+			policies = append(policies, require)
+		}
+	}
+
+	return policies
+}
+
 // FulfilledFor checks if a given session may run with a list of participants.
 func (e *SessionAccessEvaluator) FulfilledFor(participants []SessionAccessContext) (bool, PolicyOptions, error) {
 	supported, err := e.supportsSessionAccessControls()
@@ -227,13 +276,14 @@ func (e *SessionAccessEvaluator) FulfilledFor(participants []SessionAccessContex
 	// We need every policy set to match to allow the session.
 policySetLoop:
 	for _, policySet := range e.policySets {
-		if len(policySet.RequireSessionJoin) == 0 {
+		policies := e.extractApplicablePolicies(policySet)
+		if len(policies) == 0 {
 			continue
 		}
 
 		// Check every require policy to see if it's fulfilled.
 		// Only one needs to be checked to pass the policyset.
-		for _, requirePolicy := range policySet.RequireSessionJoin {
+		for _, requirePolicy := range policies {
 			// Count of how many additional participant matches we need to fulfill the policy.
 			left := requirePolicy.Count
 
diff --git a/lib/auth/session_access_test.go b/lib/auth/session_access_test.go
index 0f2f6187d500a..50faddc0b9618 100644
--- a/lib/auth/session_access_test.go
+++ b/lib/auth/session_access_test.go
@@ -32,9 +32,9 @@ type startTestCase struct {
 }
 
 func successStartTestCase(t *testing.T) startTestCase {
-	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	hostRole.SetSessionRequirePolicies([]*types.SessionRequirePolicy{{
@@ -72,9 +72,9 @@ func successStartTestCase(t *testing.T) startTestCase {
 }
 
 func failCountStartTestCase(t *testing.T) startTestCase {
-	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	hostRole.SetSessionRequirePolicies([]*types.SessionRequirePolicy{{
@@ -110,10 +110,29 @@ func failCountStartTestCase(t *testing.T) startTestCase {
 	}
 }
 
+func succeedDiscardPolicySetStartTestCase(t *testing.T) startTestCase {
+	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
+	require.NoError(t, err)
+
+	hostRole.SetSessionRequirePolicies([]*types.SessionRequirePolicy{{
+		Filter: "contains(user.roles, \"host\")",
+		Kinds:  []string{string(types.KubernetesSessionKind)},
+		Count:  2,
+		Modes:  []string{"peer"},
+	}})
+
+	return startTestCase{
+		name:        "succeedDiscardPolicySet",
+		host:        hostRole,
+		sessionKind: types.SSHSessionKind,
+		expected:    true,
+	}
+}
+
 func failFilterStartTestCase(t *testing.T) startTestCase {
-	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	hostRole.SetSessionRequirePolicies([]*types.SessionRequirePolicy{{
@@ -154,6 +173,7 @@ func TestSessionAccessStart(t *testing.T) {
 		successStartTestCase(t),
 		failCountStartTestCase(t),
 		failFilterStartTestCase(t),
+		succeedDiscardPolicySetStartTestCase(t),
 	}
 
 	for _, testCase := range testCases {
@@ -176,9 +196,9 @@ type joinTestCase struct {
 }
 
 func successJoinTestCase(t *testing.T) joinTestCase {
-	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	participantRole.SetSessionJoinPolicies([]*types.SessionJoinPolicy{{
@@ -200,9 +220,9 @@ func successJoinTestCase(t *testing.T) joinTestCase {
 }
 
 func failRoleJoinTestCase(t *testing.T) joinTestCase {
-	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	return joinTestCase{
@@ -218,9 +238,9 @@ func failRoleJoinTestCase(t *testing.T) joinTestCase {
 }
 
 func failKindJoinTestCase(t *testing.T) joinTestCase {
-	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	participantRole.SetSessionJoinPolicies([]*types.SessionJoinPolicy{{
diff --git a/lib/auth/sessions.go b/lib/auth/sessions.go
index ee9dbba7a3a5e..11aae3709104d 100644
--- a/lib/auth/sessions.go
+++ b/lib/auth/sessions.go
@@ -156,13 +156,13 @@ func WaitForAppSession(ctx context.Context, sessionID, user string, ap ReadProxy
 
 // generateAppToken generates an JWT token that will be passed along with every
 // application request.
-func (s *Server) generateAppToken(username string, roles []string, uri string, expires time.Time) (string, error) {
+func (s *Server) generateAppToken(ctx context.Context, username string, roles []string, uri string, expires time.Time) (string, error) {
 	// Get the clusters CA.
 	clusterName, err := s.GetDomainName()
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
-	ca, err := s.GetCertAuthority(types.CertAuthID{
+	ca, err := s.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.JWTSigner,
 		DomainName: clusterName,
 	}, true)
diff --git a/lib/auth/state_unix.go b/lib/auth/state_unix.go
index 88672c3dd390f..0cfb1e166b8eb 100644
--- a/lib/auth/state_unix.go
+++ b/lib/auth/state_unix.go
@@ -36,6 +36,7 @@ func NewProcessStorage(ctx context.Context, path string) (*ProcessStorage, error
 	litebk, err := lite.NewWithConfig(ctx, lite.Config{
 		Path:      path,
 		EventsOff: true,
+		Sync:      lite.SyncFull,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/auth/tls_test.go b/lib/auth/tls_test.go
index 5d099723b3f22..66075cdc02efc 100644
--- a/lib/auth/tls_test.go
+++ b/lib/auth/tls_test.go
@@ -27,7 +27,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -116,7 +115,7 @@ func (s *TLSSuite) TestRemoteBuiltinRole(c *check.C) {
 	fixtures.ExpectConnectionProblem(c, err)
 
 	// after trust is established, things are good
-	err = s.server.AuthServer.Trust(remoteServer, nil)
+	err = s.server.AuthServer.Trust(ctx, remoteServer, nil)
 	c.Assert(err, check.IsNil)
 
 	// re initialize client with trust established.
@@ -212,7 +211,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// after trust is established, things are good
-	err = s.server.AuthServer.Trust(remoteServer, nil)
+	err = s.server.AuthServer.Trust(ctx, remoteServer, nil)
 	c.Assert(err, check.IsNil)
 
 	remoteProxy, err := remoteServer.NewRemoteClient(
@@ -227,7 +226,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	gracePeriod := time.Hour
 	remoteServer.AuthServer.privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
-	err = remoteServer.AuthServer.RotateCertAuthority(RotateRequest{
+	err = remoteServer.AuthServer.RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -236,7 +235,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// moves to update clients
-	err = remoteServer.AuthServer.RotateCertAuthority(RotateRequest{
+	err = remoteServer.AuthServer.RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -244,7 +243,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 
-	remoteCA, err := remoteServer.AuthServer.GetCertAuthority(types.CertAuthID{
+	remoteCA, err := remoteServer.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: remoteServer.ClusterName,
 		Type:       types.HostCA,
 	}, false)
@@ -254,7 +253,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	// that is not associated with the remote cluster
 	clone := remoteCA.Clone()
 	clone.SetName(s.server.ClusterName())
-	err = remoteProxy.RotateExternalCertAuthority(clone)
+	err = remoteProxy.RotateExternalCertAuthority(ctx, clone)
 	fixtures.ExpectAccessDenied(c, err)
 
 	// remote proxy can't upsert the certificate authority,
@@ -263,26 +262,26 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	fixtures.ExpectAccessDenied(c, err)
 
 	// remote proxy can't read local cert authority with secrets
-	_, err = remoteProxy.GetCertAuthority(types.CertAuthID{
+	_, err = remoteProxy.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, true)
 	fixtures.ExpectAccessDenied(c, err)
 
 	// no secrets read is allowed
-	_, err = remoteProxy.GetCertAuthority(types.CertAuthID{
+	_, err = remoteProxy.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
 	c.Assert(err, check.IsNil)
 
 	// remote auth server will get rejected
-	err = remoteAuth.RotateExternalCertAuthority(remoteCA)
+	err = remoteAuth.RotateExternalCertAuthority(ctx, remoteCA)
 	fixtures.ExpectAccessDenied(c, err)
 
 	// remote proxy should be able to perform remote cert authority
 	// rotation
-	err = remoteProxy.RotateExternalCertAuthority(remoteCA)
+	err = remoteProxy.RotateExternalCertAuthority(ctx, remoteCA)
 	c.Assert(err, check.IsNil)
 
 	// newRemoteProxy should be trusted by the auth server
@@ -301,6 +300,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 // TestLocalProxyPermissions tests new local proxy permissions
 // as it's now allowed to update host cert authorities of remote clusters
 func (s *TLSSuite) TestLocalProxyPermissions(c *check.C) {
+	ctx := context.Background()
 	remoteServer, err := NewTestAuthServer(TestAuthServerConfig{
 		Dir:         c.MkDir(),
 		ClusterName: "remote",
@@ -309,10 +309,10 @@ func (s *TLSSuite) TestLocalProxyPermissions(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// after trust is established, things are good
-	err = s.server.AuthServer.Trust(remoteServer, nil)
+	err = s.server.AuthServer.Trust(ctx, remoteServer, nil)
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -326,7 +326,7 @@ func (s *TLSSuite) TestLocalProxyPermissions(c *check.C) {
 	fixtures.ExpectAccessDenied(c, err)
 
 	// local proxy is allowed to update host CA of remote cert authorities
-	remoteCA, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
+	remoteCA, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: remoteServer.ClusterName,
 		Type:       types.HostCA,
 	}, false)
@@ -353,7 +353,7 @@ func (s *TLSSuite) TestAutoRotation(c *check.C) {
 	s.server.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		Mode:        types.RotationModeAuto,
@@ -362,10 +362,10 @@ func (s *TLSSuite) TestAutoRotation(c *check.C) {
 
 	// advance rotation by clock
 	s.clock.Advance(gracePeriod/3 + time.Minute)
-	err = s.server.Auth().autoRotateCertAuthorities()
+	err = s.server.Auth().autoRotateCertAuthorities(ctx)
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -382,10 +382,10 @@ func (s *TLSSuite) TestAutoRotation(c *check.C) {
 
 	// advance rotation by clock
 	s.clock.Advance((gracePeriod*2)/3 + time.Minute)
-	err = s.server.Auth().autoRotateCertAuthorities()
+	err = s.server.Auth().autoRotateCertAuthorities(ctx)
 	c.Assert(err, check.IsNil)
 
-	ca, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
+	ca, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -405,9 +405,9 @@ func (s *TLSSuite) TestAutoRotation(c *check.C) {
 
 	// complete rotation - advance rotation by clock
 	s.clock.Advance(gracePeriod/3 + time.Minute)
-	err = s.server.Auth().autoRotateCertAuthorities()
+	err = s.server.Auth().autoRotateCertAuthorities(ctx)
 	c.Assert(err, check.IsNil)
-	ca, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
+	ca, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -447,7 +447,7 @@ func (s *TLSSuite) TestAutoFallback(c *check.C) {
 	s.server.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		Mode:        types.RotationModeAuto,
@@ -456,10 +456,10 @@ func (s *TLSSuite) TestAutoFallback(c *check.C) {
 
 	// advance rotation by clock
 	s.clock.Advance(gracePeriod/3 + time.Minute)
-	err = s.server.Auth().autoRotateCertAuthorities()
+	err = s.server.Auth().autoRotateCertAuthorities(ctx)
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -468,7 +468,7 @@ func (s *TLSSuite) TestAutoFallback(c *check.C) {
 	c.Assert(ca.GetRotation().Mode, check.Equals, types.RotationModeAuto)
 
 	// rollback rotation
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseRollback,
@@ -476,7 +476,7 @@ func (s *TLSSuite) TestAutoFallback(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 
-	ca, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
+	ca, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -503,7 +503,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	gracePeriod := time.Hour
 	s.server.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateServers,
@@ -512,7 +512,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	fixtures.ExpectBadParameter(c, err)
 
 	// starts rotation
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -525,7 +525,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// clients reconnect
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -545,7 +545,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// can't jump to standy
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseStandby,
@@ -554,7 +554,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	fixtures.ExpectBadParameter(c, err)
 
 	// advance rotation:
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateServers,
@@ -571,7 +571,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// complete rotation
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseStandby,
@@ -609,7 +609,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	gracePeriod := time.Hour
 	s.server.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -618,7 +618,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// move to update clients phase
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -634,7 +634,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// advance rotation:
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateServers,
@@ -643,7 +643,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// rollback rotation
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseRollback,
@@ -657,7 +657,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// can't jump to other phases
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -666,7 +666,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	fixtures.ExpectBadParameter(c, err)
 
 	// complete rollback
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseStandby,
@@ -686,6 +686,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 // TestAppTokenRotation checks that JWT tokens can be rotated and tokens can or
 // can not be validated at the appropriate phase.
 func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
+	ctx := context.Background()
 	client, err := s.server.NewClient(TestBuiltin(types.RoleApp))
 	c.Assert(err, check.IsNil)
 
@@ -701,7 +702,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// Check that the "old" CA can be used to verify tokens.
-	oldCA, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
+	oldCA, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -715,7 +716,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	// Start rotation and move to initial phase. A new CA will be added (for
 	// verification), but requests will continue to be signed by the old CA.
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.JWTSigner,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -724,7 +725,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// At this point in rotation, two JWT key pairs should exist.
-	oldCA, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
+	oldCA, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -738,7 +739,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 
 	// Move rotation into the update client phase. In this phase, requests will
 	// be signed by the new CA, but the old CA will be around to verify requests.
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.JWTSigner,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -747,7 +748,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// New tokens should now fail to validate with the old key.
-	newJWT, err := client.GenerateAppToken(context.Background(),
+	newJWT, err := client.GenerateAppToken(ctx,
 		types.GenerateAppTokenRequest{
 			Username: "foo",
 			Roles:    []string{"bar", "baz"},
@@ -757,7 +758,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// New tokens will validate with the new key.
-	newCA, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
+	newCA, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -772,7 +773,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// Move rotation into update servers phase.
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.JWTSigner,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateServers,
@@ -781,7 +782,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// At this point only the phase on the CA should have changed.
-	newCA, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
+	newCA, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -796,7 +797,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// Complete rotation. The old CA will be removed.
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.JWTSigner,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseStandby,
@@ -805,7 +806,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// The new CA should now only have a single key.
-	newCA, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
+	newCA, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -823,6 +824,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 // TestRemoteUser tests scenario when remote user connects to the local
 // auth server and some edge cases.
 func (s *TLSSuite) TestRemoteUser(c *check.C) {
+	ctx := context.Background()
 	remoteServer, err := NewTestAuthServer(TestAuthServerConfig{
 		Dir:         c.MkDir(),
 		ClusterName: "remote",
@@ -847,7 +849,7 @@ func (s *TLSSuite) TestRemoteUser(c *check.C) {
 
 	// Establish trust, the request will still fail, there is
 	// no role mapping set up
-	err = s.server.AuthServer.Trust(remoteServer, nil)
+	err = s.server.AuthServer.Trust(ctx, remoteServer, nil)
 	c.Assert(err, check.IsNil)
 	_, err = remoteClient.GetDomainName()
 	fixtures.ExpectAccessDenied(c, err)
@@ -856,7 +858,7 @@ func (s *TLSSuite) TestRemoteUser(c *check.C) {
 	_, localRole, err := CreateUserAndRole(s.server.Auth(), "local-user", []string{"local-role"})
 	c.Assert(err, check.IsNil)
 
-	err = s.server.AuthServer.Trust(remoteServer, types.RoleMap{{Remote: remoteRole.GetName(), Local: []string{localRole.GetName()}}})
+	err = s.server.AuthServer.Trust(ctx, remoteServer, types.RoleMap{{Remote: remoteRole.GetName(), Local: []string{localRole.GetName()}}})
 	c.Assert(err, check.IsNil)
 
 	_, err = remoteClient.GetDomainName()
@@ -1589,7 +1591,7 @@ func (s *TLSSuite) TestGetCertAuthority(c *check.C) {
 	defer nodeClt.Close()
 
 	// node is authorized to fetch CA without secrets
-	ca, err := nodeClt.GetCertAuthority(types.CertAuthID{
+	ca, err := nodeClt.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -1602,7 +1604,7 @@ func (s *TLSSuite) TestGetCertAuthority(c *check.C) {
 	}
 
 	// node is not authorized to fetch CA with secrets
-	_, err = nodeClt.GetCertAuthority(types.CertAuthID{
+	_, err = nodeClt.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, true)
@@ -1626,14 +1628,14 @@ func (s *TLSSuite) TestGetCertAuthority(c *check.C) {
 	defer userClt.Close()
 
 	// user is authorized to fetch CA without secrets
-	_, err = userClt.GetCertAuthority(types.CertAuthID{
+	_, err = userClt.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
 	c.Assert(err, check.IsNil)
 
 	// user is not authorized to fetch CA with secrets
-	_, err = userClt.GetCertAuthority(types.CertAuthID{
+	_, err = userClt.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, true)
@@ -2045,7 +2047,7 @@ func TestGenerateCerts(t *testing.T) {
 	t.Run("ImpersonateAllow", func(t *testing.T) {
 		// Super impersonator impersonate anyone and login as root
 		maxSessionTTL := 300 * time.Hour
-		superImpersonatorRole, err := types.NewRole("superimpersonator", types.RoleSpecV5{
+		superImpersonatorRole, err := types.NewRoleV3("superimpersonator", types.RoleSpecV5{
 			Options: types.RoleOptions{
 				MaxSessionTTL: types.Duration(maxSessionTTL),
 			},
@@ -2063,7 +2065,7 @@ func TestGenerateCerts(t *testing.T) {
 		require.NoError(t, err)
 
 		// Impersonator can generate certificates for super impersonator
-		role, err := types.NewRole("impersonate", types.RoleSpecV5{
+		role, err := types.NewRoleV3("impersonate", types.RoleSpecV5{
 			Allow: types.RoleConditions{
 				Logins: []string{superImpersonator.GetName()},
 				Impersonate: &types.ImpersonateConditions{
@@ -2308,7 +2310,7 @@ func (s *TLSSuite) TestGenerateAppToken(c *check.C) {
 	authClient, err := s.server.NewClient(TestBuiltin(types.RoleAdmin))
 	c.Assert(err, check.IsNil)
 
-	ca, err := authClient.GetCertAuthority(types.CertAuthID{
+	ca, err := authClient.GetCertAuthority(context.Background(), types.CertAuthID{
 		Type:       types.JWTSigner,
 		DomainName: s.server.ClusterName(),
 	}, true)
@@ -2864,7 +2866,7 @@ func (s *TLSSuite) TestRegisterCAPin(c *check.C) {
 	c.Assert(err, check.NotNil)
 
 	// Add another cert to the CA (dupe the current one for simplicity)
-	hostCA, err := s.server.AuthServer.AuthServer.GetCertAuthority(types.CertAuthID{
+	hostCA, err := s.server.AuthServer.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.AuthServer.ClusterName,
 		Type:       types.HostCA,
 	}, true)
@@ -2938,7 +2940,7 @@ func (s *TLSSuite) TestRegisterCAPath(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// Extract the root CA public key and write it out to the data dir.
-	hostCA, err := s.server.AuthServer.AuthServer.GetCertAuthority(types.CertAuthID{
+	hostCA, err := s.server.AuthServer.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.AuthServer.ClusterName,
 		Type:       types.HostCA,
 	}, false)
@@ -2947,7 +2949,7 @@ func (s *TLSSuite) TestRegisterCAPath(c *check.C) {
 	c.Assert(certs, check.HasLen, 1)
 	certPem := certs[0]
 	caPath := filepath.Join(s.dataDir, defaults.CACertFile)
-	err = ioutil.WriteFile(caPath, certPem, teleport.FileMaskOwnerOnly)
+	err = os.WriteFile(caPath, certPem, teleport.FileMaskOwnerOnly)
 	c.Assert(err, check.IsNil)
 
 	// Attempt to register with valid CA path, should work.
@@ -3060,7 +3062,7 @@ func (s *TLSSuite) TestEventsPermissions(c *check.C) {
 
 	// start rotation
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -3068,7 +3070,7 @@ func (s *TLSSuite) TestEventsPermissions(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -3197,7 +3199,7 @@ func (s *TLSSuite) TestEventsClusterConfig(c *check.C) {
 
 	// start rotation
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -3205,7 +3207,7 @@ func (s *TLSSuite) TestEventsClusterConfig(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, true)
diff --git a/lib/auth/trustedcluster.go b/lib/auth/trustedcluster.go
index ad67360a3b321..204b0474c21c7 100644
--- a/lib/auth/trustedcluster.go
+++ b/lib/auth/trustedcluster.go
@@ -98,7 +98,7 @@ func (a *Server) UpsertTrustedCluster(ctx context.Context, trustedCluster types.
 			return nil, trace.Wrap(err)
 		}
 
-		remoteCAs, err := a.establishTrust(trustedCluster)
+		remoteCAs, err := a.establishTrust(ctx, trustedCluster)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -122,7 +122,7 @@ func (a *Server) UpsertTrustedCluster(ctx context.Context, trustedCluster types.
 			return nil, trace.Wrap(err)
 		}
 
-		remoteCAs, err := a.establishTrust(trustedCluster)
+		remoteCAs, err := a.establishTrust(ctx, trustedCluster)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -231,7 +231,7 @@ func (a *Server) DeleteTrustedCluster(ctx context.Context, name string) error {
 	return nil
 }
 
-func (a *Server) establishTrust(trustedCluster types.TrustedCluster) ([]types.CertAuthority, error) {
+func (a *Server) establishTrust(ctx context.Context, trustedCluster types.TrustedCluster) ([]types.CertAuthority, error) {
 	var localCertAuthorities []types.CertAuthority
 
 	domainName, err := a.GetDomainName()
@@ -240,7 +240,7 @@ func (a *Server) establishTrust(trustedCluster types.TrustedCluster) ([]types.Ce
 	}
 
 	// get a list of certificate authorities for this auth server
-	allLocalCAs, err := a.GetCertAuthorities(types.HostCA, false)
+	allLocalCAs, err := a.GetCertAuthorities(ctx, types.HostCA, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -472,15 +472,34 @@ func (a *Server) validateTrustedCluster(ctx context.Context, validateRequest *Va
 		return nil, trace.Wrap(err)
 	}
 
-	// add remote cluster resource to keep track of the remote cluster
-	var remoteClusterName string
-	for _, certAuthority := range validateRequest.CAs {
-		// don't add a ca with the same as as local cluster name
-		if certAuthority.GetName() == domainName {
-			return nil, trace.AccessDenied("remote certificate authority has same name as cluster certificate authority: %v", domainName)
-		}
-		remoteClusterName = certAuthority.GetName()
+	if len(validateRequest.CAs) != 1 {
+		return nil, trace.AccessDenied("expected exactly one certificate authority, received %v", len(validateRequest.CAs))
+	}
+	remoteCA := validateRequest.CAs[0]
+	err = remoteCA.CheckAndSetDefaults()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if remoteCA.GetType() != types.HostCA {
+		return nil, trace.AccessDenied("expected host certificate authority, received CA with type %q", remoteCA.GetType())
+	}
+
+	// a host CA shouldn't have a rolemap or roles in the first place
+	remoteCA.SetRoleMap(nil)
+	remoteCA.SetRoles(nil)
+
+	remoteClusterName := remoteCA.GetName()
+	if remoteClusterName == domainName {
+		return nil, trace.AccessDenied("remote cluster has same name as this cluster: %v", domainName)
 	}
+	_, err = a.GetTrustedCluster(ctx, remoteClusterName)
+	if err == nil {
+		return nil, trace.AccessDenied("remote cluster has same name as trusted cluster: %v", remoteClusterName)
+	} else if !trace.IsNotFound(err) {
+		return nil, trace.Wrap(err)
+	}
+
 	remoteCluster, err := types.NewRemoteCluster(remoteClusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -498,12 +517,9 @@ func (a *Server) validateTrustedCluster(ctx context.Context, validateRequest *Va
 		}
 	}
 
-	// token has been validated, upsert the given certificate authority
-	for _, certAuthority := range validateRequest.CAs {
-		err = a.UpsertCertAuthority(certAuthority)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
+	err = a.UpsertCertAuthority(remoteCA)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
 	// export local cluster certificate authority and return it to the cluster
@@ -512,6 +528,7 @@ func (a *Server) validateTrustedCluster(ctx context.Context, validateRequest *Va
 	}
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA} {
 		certAuthority, err := a.GetCertAuthority(
+			ctx,
 			types.CertAuthID{Type: caType, DomainName: domainName},
 			false)
 		if err != nil {
diff --git a/lib/auth/trustedcluster_test.go b/lib/auth/trustedcluster_test.go
index 9091451faf4e0..5eba93dbaa59f 100644
--- a/lib/auth/trustedcluster_test.go
+++ b/lib/auth/trustedcluster_test.go
@@ -24,6 +24,7 @@ import (
 	authority "github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/services/suite"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
@@ -99,6 +100,131 @@ func TestRemoteClusterStatus(t *testing.T) {
 	require.Empty(t, cmp.Diff(rc, gotRC))
 }
 
+func TestValidateTrustedCluster(t *testing.T) {
+	const localClusterName = "localcluster"
+	const validToken = "validtoken"
+	ctx := context.Background()
+
+	testAuth, err := NewTestAuthServer(TestAuthServerConfig{
+		ClusterName: localClusterName,
+		Dir:         t.TempDir(),
+	})
+	require.NoError(t, err)
+	a := testAuth.AuthServer
+
+	tks, err := types.NewStaticTokens(types.StaticTokensSpecV2{
+		StaticTokens: []types.ProvisionTokenV1{{
+			Roles: []types.SystemRole{types.RoleTrustedCluster},
+			Token: validToken,
+		}},
+	})
+	require.NoError(t, err)
+	a.SetStaticTokens(tks)
+
+	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
+		Token: "invalidtoken",
+		CAs:   []types.CertAuthority{},
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "invalid cluster token")
+
+	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
+		Token: validToken,
+		CAs:   []types.CertAuthority{},
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "expected exactly one")
+
+	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
+		Token: validToken,
+		CAs: []types.CertAuthority{
+			suite.NewTestCA(types.HostCA, "rc1"),
+			suite.NewTestCA(types.HostCA, "rc2"),
+		},
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "expected exactly one")
+
+	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
+		Token: validToken,
+		CAs: []types.CertAuthority{
+			suite.NewTestCA(types.UserCA, "rc3"),
+		},
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "expected host certificate authority")
+
+	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
+		Token: validToken,
+		CAs: []types.CertAuthority{
+			suite.NewTestCA(types.HostCA, localClusterName),
+		},
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "same name as this cluster")
+
+	trustedCluster, err := types.NewTrustedCluster("trustedcluster",
+		types.TrustedClusterSpecV2{Roles: []string{"nonempty"}})
+	require.NoError(t, err)
+	// use the UpsertTrustedCluster in Presence as we just want the resource in
+	// the backend, we don't want to actually connect
+	_, err = a.Presence.UpsertTrustedCluster(ctx, trustedCluster)
+	require.NoError(t, err)
+
+	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
+		Token: validToken,
+		CAs: []types.CertAuthority{
+			suite.NewTestCA(types.HostCA, trustedCluster.GetName()),
+		},
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "same name as trusted cluster")
+
+	leafClusterCA := types.CertAuthority(suite.NewTestCA(types.HostCA, "leafcluster"))
+	resp, err := a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
+		Token: validToken,
+		CAs:   []types.CertAuthority{leafClusterCA},
+	})
+	require.NoError(t, err)
+
+	require.Len(t, resp.CAs, 2)
+	require.ElementsMatch(t,
+		[]types.CertAuthType{types.HostCA, types.UserCA},
+		[]types.CertAuthType{resp.CAs[0].GetType(), resp.CAs[1].GetType()},
+	)
+
+	for _, returnedCA := range resp.CAs {
+		localCA, err := a.GetCertAuthority(ctx, types.CertAuthID{
+			Type:       returnedCA.GetType(),
+			DomainName: localClusterName,
+		}, false)
+		require.NoError(t, err)
+		require.True(t, services.CertAuthoritiesEquivalent(localCA, returnedCA))
+	}
+
+	rcs, err := a.GetRemoteClusters()
+	require.NoError(t, err)
+	require.Len(t, rcs, 1)
+	require.Equal(t, leafClusterCA.GetName(), rcs[0].GetName())
+
+	hostCAs, err := a.GetCertAuthorities(ctx, types.HostCA, false)
+	require.NoError(t, err)
+	require.Len(t, hostCAs, 2)
+	require.ElementsMatch(t,
+		[]string{localClusterName, leafClusterCA.GetName()},
+		[]string{hostCAs[0].GetName(), hostCAs[1].GetName()},
+	)
+	require.Empty(t, hostCAs[0].GetRoles())
+	require.Empty(t, hostCAs[0].GetRoleMap())
+	require.Empty(t, hostCAs[1].GetRoles())
+	require.Empty(t, hostCAs[1].GetRoleMap())
+
+	userCAs, err := a.GetCertAuthorities(ctx, types.UserCA, false)
+	require.NoError(t, err)
+	require.Len(t, userCAs, 1)
+	require.Equal(t, localClusterName, userCAs[0].GetName())
+}
+
 func newTestAuthServer(ctx context.Context, t *testing.T, name ...string) *Server {
 	bk, err := memory.New(memory.Config{})
 	require.NoError(t, err)
diff --git a/lib/auth/usertoken.go b/lib/auth/usertoken.go
index ce47a20f0a8e6..06c4ed86441a9 100644
--- a/lib/auth/usertoken.go
+++ b/lib/auth/usertoken.go
@@ -499,7 +499,7 @@ func (s *Server) CreatePrivilegeToken(ctx context.Context, req *proto.CreatePriv
 	switch {
 	case req.GetExistingMFAResponse() == nil:
 		// Allows users with no devices to bypass second factor re-auth.
-		devices, err := s.Identity.GetMFADevices(ctx, username, false)
+		devices, err := s.Identity.GetMFADevices(ctx, username, false /* withSecrets */)
 		switch {
 		case err != nil:
 			return nil, trace.Wrap(err)
@@ -511,7 +511,8 @@ func (s *Server) CreatePrivilegeToken(ctx context.Context, req *proto.CreatePriv
 
 	default:
 		if err := s.WithUserLock(username, func() error {
-			_, err := s.validateMFAAuthResponse(ctx, username, req.GetExistingMFAResponse())
+			_, _, err := s.validateMFAAuthResponse(
+				ctx, req.GetExistingMFAResponse(), username, false /* passwordless */)
 			return err
 		}); err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/auth/webauthn/login.go b/lib/auth/webauthn/login.go
index 609b6d07d11ff..cfe0a2d038d91 100644
--- a/lib/auth/webauthn/login.go
+++ b/lib/auth/webauthn/login.go
@@ -21,6 +21,7 @@ import (
 	"context"
 	"encoding/base64"
 	"encoding/json"
+	"sort"
 	"time"
 
 	"github.com/duo-labs/webauthn/protocol"
@@ -81,6 +82,17 @@ func (f *loginFlow) begin(ctx context.Context, user string, passwordless bool) (
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+
+		// Sort non-resident keys first, which may cause clients to favor them for
+		// MFA in some scenarios (eg, tsh).
+		sort.Slice(devices, func(i, j int) bool {
+			dev1, dev2 := devices[i], devices[j]
+			web1, web2 := dev1.GetWebauthn(), dev2.GetWebauthn()
+			resident1 := web1 != nil && web1.ResidentKey
+			resident2 := web2 != nil && web2.ResidentKey
+			return !resident1 && resident2
+		})
+
 		u = newWebUser(user, webID, true /* credentialIDOnly */, devices)
 
 		// Let's make sure we have at least one registered credential here, since we
diff --git a/lib/auth/webauthn/register.go b/lib/auth/webauthn/register.go
index 6ae37d8b2fb2c..13927f9f8baf8 100644
--- a/lib/auth/webauthn/register.go
+++ b/lib/auth/webauthn/register.go
@@ -137,6 +137,19 @@ func (f *RegistrationFlow) Begin(ctx context.Context, user string, passwordless
 	}
 	var exclusions []protocol.CredentialDescriptor
 	for _, dev := range devices {
+		// Skip existing U2F devices, letting users "upgrade" their registration is
+		// good for us.
+		if dev.GetU2F() != nil {
+			continue
+		}
+		// Skip resident/non-resident keys depending on whether it's a passwordless
+		// registration.
+		// Letting users have both allows them to "swap" between key types in the
+		// same device.
+		if webDev := dev.GetWebauthn(); webDev != nil && webDev.ResidentKey != passwordless {
+			continue
+		}
+
 		cred, ok := deviceToCredential(dev, true /* idOnly */)
 		if !ok {
 			continue
diff --git a/lib/auth/webauthn/register_test.go b/lib/auth/webauthn/register_test.go
index ee5eeaa619f64..614428f05f98b 100644
--- a/lib/auth/webauthn/register_test.go
+++ b/lib/auth/webauthn/register_test.go
@@ -15,8 +15,10 @@
 package webauthn_test
 
 import (
+	"bytes"
 	"context"
 	"encoding/pem"
+	"sort"
 	"testing"
 
 	"github.com/duo-labs/webauthn/protocol"
@@ -120,6 +122,88 @@ func TestRegistrationFlow_BeginFinish(t *testing.T) {
 	}
 }
 
+func TestRegistrationFlow_Begin_excludeList(t *testing.T) {
+	const user = "llama"
+	const rpID = "localhost"
+
+	dev1ID := []byte{1, 1, 1} // U2F
+	web1ID := []byte{1, 1, 2} // WebAuthn / MFA
+	rk1ID := []byte{1, 1, 3}  // WebAuthn / passwordless
+	dev1 := &types.MFADevice{
+		Device: &types.MFADevice_U2F{
+			U2F: &types.U2FDevice{
+				KeyHandle: dev1ID,
+			},
+		},
+	}
+	web1 := &types.MFADevice{
+		Device: &types.MFADevice_Webauthn{
+			Webauthn: &types.WebauthnDevice{
+				CredentialId: web1ID,
+			},
+		},
+	}
+	rk1 := &types.MFADevice{
+		Device: &types.MFADevice_Webauthn{
+			Webauthn: &types.WebauthnDevice{
+				CredentialId: rk1ID,
+				ResidentKey:  true,
+			},
+		},
+	}
+	identity := newFakeIdentity(user, dev1, web1, rk1)
+
+	rf := wanlib.RegistrationFlow{
+		Webauthn: &types.Webauthn{
+			RPID: rpID,
+		},
+		Identity: identity,
+	}
+
+	ctx := context.Background()
+	tests := []struct {
+		name            string
+		passwordless    bool
+		wantExcludeList [][]byte
+	}{
+		{
+			name:            "MFA",
+			wantExcludeList: [][]byte{web1ID}, // U2F and resident excluded
+		},
+		{
+			name:            "passwordless",
+			passwordless:    true,
+			wantExcludeList: [][]byte{rk1ID}, // U2F and MFA excluded
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cc, err := rf.Begin(ctx, user, test.passwordless)
+			require.NoError(t, err, "Begin")
+
+			got := cc.Response.CredentialExcludeList
+			sort.Slice(got, func(i, j int) bool {
+				return bytes.Compare(got[i].CredentialID, got[j].CredentialID) == -1
+			})
+
+			want := make([]protocol.CredentialDescriptor, len(test.wantExcludeList))
+			for i, id := range test.wantExcludeList {
+				want[i] = protocol.CredentialDescriptor{
+					Type:         protocol.PublicKeyCredentialType,
+					CredentialID: id,
+				}
+			}
+			sort.Slice(want, func(i, j int) bool {
+				return bytes.Compare(want[i].CredentialID, want[j].CredentialID) == -1
+			})
+
+			if diff := cmp.Diff(want, got); diff != "" {
+				t.Errorf("Begin() mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
+
 func TestRegistrationFlow_Begin_webID(t *testing.T) {
 	const rpID = "localhost"
 	ctx := context.Background()
diff --git a/lib/auth/webauthncli/api.go b/lib/auth/webauthncli/api.go
new file mode 100644
index 0000000000000..caf00749ddb9b
--- /dev/null
+++ b/lib/auth/webauthncli/api.go
@@ -0,0 +1,64 @@
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package webauthncli
+
+import (
+	"context"
+
+	"github.com/gravitational/teleport/api/client/proto"
+
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
+	log "github.com/sirupsen/logrus"
+)
+
+// Login performs client-side, U2F-compatible, Webauthn login.
+// This method blocks until either device authentication is successful or the
+// context is cancelled. Calling Login without a deadline or cancel condition
+// may cause it block forever.
+// The informed user is used to disambiguate credentials in case of passwordless
+// logins.
+// It returns an MFAAuthenticateResponse and the credential user, if a resident
+// credential is used.
+// The caller is expected to prompt the user for action before calling this
+// method.
+func Login(
+	ctx context.Context,
+	origin string, user string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt,
+) (*proto.MFAAuthenticateResponse, string, error) {
+	if IsFIDO2Available() {
+		log.Debug("FIDO2: Using libfido2 for assertion")
+		return FIDO2Login(ctx, origin, user, assertion, prompt)
+	}
+
+	resp, err := U2FLogin(ctx, origin, assertion)
+	return resp, "" /* credentialUser */, err
+}
+
+// Register performs client-side, U2F-compatible, Webauthn registration.
+// This method blocks until either device authentication is successful or the
+// context is cancelled. Calling Register without a deadline or cancel condition
+// may cause it block forever.
+// The caller is expected to prompt the user for action before calling this
+// method.
+func Register(
+	ctx context.Context,
+	origin string, cc *wanlib.CredentialCreation, prompt RegisterPrompt) (*proto.MFARegisterResponse, error) {
+	if IsFIDO2Available() {
+		log.Debug("FIDO2: Using libfido2 for credential creation")
+		return FIDO2Register(ctx, origin, cc, prompt)
+	}
+
+	return U2FRegister(ctx, origin, cc)
+}
diff --git a/lib/auth/webauthncli/export_fido2_test.go b/lib/auth/webauthncli/export_fido2_test.go
new file mode 100644
index 0000000000000..36b84e5ff42a3
--- /dev/null
+++ b/lib/auth/webauthncli/export_fido2_test.go
@@ -0,0 +1,23 @@
+//go:build libfido2
+// +build libfido2
+
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package webauthncli
+
+var (
+	FIDODeviceLocations = &fidoDeviceLocations
+	FIDONewDevice       = &fidoNewDevice
+)
diff --git a/lib/auth/webauthncli/fido2.go b/lib/auth/webauthncli/fido2.go
new file mode 100644
index 0000000000000..0d6f6c43a0625
--- /dev/null
+++ b/lib/auth/webauthncli/fido2.go
@@ -0,0 +1,776 @@
+//go:build libfido2
+// +build libfido2
+
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package webauthncli
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/duo-labs/webauthn/protocol"
+	"github.com/duo-labs/webauthn/protocol/webauthncose"
+	"github.com/fxamacker/cbor/v2"
+	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/trace"
+	"github.com/keys-pub/go-libfido2"
+
+	wanpb "github.com/gravitational/teleport/api/types/webauthn"
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
+	log "github.com/sirupsen/logrus"
+)
+
+// FIDODevice abstracts *libfido2.Device for testing.
+type FIDODevice interface {
+	// Info mirrors libfido2.Device.Info.
+	Info() (*libfido2.DeviceInfo, error)
+
+	// Cancel mirrors libfido2.Device.Cancel.
+	Cancel() error
+
+	// Credentials mirrors libfido2.Device.Credentials.
+	Credentials(rpID string, pin string) ([]*libfido2.Credential, error)
+
+	// MakeCredential mirrors libfido2.Device.MakeCredential.
+	MakeCredential(
+		clientDataHash []byte,
+		rp libfido2.RelyingParty,
+		user libfido2.User,
+		typ libfido2.CredentialType,
+		pin string,
+		opts *libfido2.MakeCredentialOpts) (*libfido2.Attestation, error)
+
+	// Assertion mirrors libfido2.Device.Assertion.
+	Assertion(
+		rpID string,
+		clientDataHash []byte,
+		credentialIDs [][]byte,
+		pin string,
+		opts *libfido2.AssertionOpts) (*libfido2.Assertion, error)
+}
+
+// fidoDeviceLocations and fidoNewDevice are used to allow testing.
+var fidoDeviceLocations = libfido2.DeviceLocations
+var fidoNewDevice = func(path string) (FIDODevice, error) {
+	return libfido2.NewDevice(path)
+}
+
+// IsFIDO2Available returns true if libfido2 is available in the current build.
+func IsFIDO2Available() bool {
+	return true
+}
+
+// fido2Login implements FIDO2Login.
+func fido2Login(
+	ctx context.Context,
+	origin, user string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt,
+) (*proto.MFAAuthenticateResponse, string, error) {
+	switch {
+	case origin == "":
+		return nil, "", trace.BadParameter("origin required")
+	case assertion == nil:
+		return nil, "", trace.BadParameter("assertion required")
+	case prompt == nil:
+		return nil, "", trace.BadParameter("prompt required")
+	case len(assertion.Response.Challenge) == 0:
+		return nil, "", trace.BadParameter("assertion challenge required")
+	case assertion.Response.RelyingPartyID == "":
+		return nil, "", trace.BadParameter("assertion relying party ID required")
+	}
+
+	allowedCreds := assertion.Response.GetAllowedCredentialIDs()
+	uv := assertion.Response.UserVerification == protocol.VerificationRequired
+	passwordless := len(allowedCreds) == 0 && uv
+
+	// Prepare challenge data for the device.
+	ccdJSON, err := json.Marshal(&CollectedClientData{
+		Type:      string(protocol.AssertCeremony),
+		Challenge: base64.RawURLEncoding.EncodeToString(assertion.Response.Challenge),
+		Origin:    origin,
+	})
+	if err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+	ccdHash := sha256.Sum256(ccdJSON)
+
+	rpID := assertion.Response.RelyingPartyID
+	var appID string
+	if val, ok := assertion.Response.Extensions[wanlib.AppIDExtension]; ok {
+		appID = fmt.Sprint(val)
+	}
+
+	// mu guards the variables below it.
+	var mu sync.Mutex
+	var assertionResp *libfido2.Assertion
+	var credentialID []byte
+	var userID []byte
+	var username string
+	var usedAppID bool
+
+	filter := func(dev FIDODevice, info *deviceInfo) (bool, error) {
+		switch {
+		case uv && !info.uvCapable():
+			log.Debugf("FIDO2: Device %v: filtered due to lack of UV", info.path)
+			return false, nil
+		case passwordless && !info.rk:
+			log.Debugf("FIDO2: Device %v: filtered due to lack of RK", info.path)
+			return false, nil
+		case len(allowedCreds) == 0: // Nothing else to check
+			return true, nil
+		}
+
+		// Does the device have a suitable credential?
+		const pin = "" // not required to filter
+		if _, err := dev.Assertion(rpID, ccdHash[:], allowedCreds, pin, &libfido2.AssertionOpts{
+			UP: libfido2.False,
+		}); err == nil {
+			return true, nil
+		}
+
+		// Try again with the App ID, if present.
+		if appID == "" {
+			return false, nil
+		}
+		if _, err := dev.Assertion(appID, ccdHash[:], allowedCreds, pin, &libfido2.AssertionOpts{
+			UP: libfido2.False,
+		}); err != nil {
+			log.Debugf("FIDO2: Device %v: filtered due to lack of allowed credential", info.path)
+			return false, nil
+		}
+		return true, nil
+	}
+
+	deviceCallback := func(dev FIDODevice, info *deviceInfo, pin string) error {
+		var actualRPID string
+		var cID []byte
+		var uID []byte
+		var uName string
+		if passwordless {
+			cred, err := getPasswordlessCredentials(dev, pin, rpID, user)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			actualRPID = rpID
+			cID = cred.ID
+			uID = cred.User.ID
+			uName = cred.User.Name
+		} else {
+			// TODO(codingllama): Ideally we'd rely on fido_assert_id_ptr/_len.
+			var err error
+			actualRPID, cID, err = getMFACredentials(dev, pin, rpID, appID, allowedCreds)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+		}
+
+		if passwordless {
+			// Ask for another touch before the assertion, we used the first touch
+			// in the Credentials() call.
+			if err := prompt.PromptAdditionalTouch(); err != nil {
+				return trace.Wrap(err)
+			}
+		}
+
+		opts := &libfido2.AssertionOpts{
+			UP: libfido2.True,
+		}
+		if uv {
+			opts.UV = libfido2.True
+		}
+		resp, err := dev.Assertion(actualRPID, ccdHash[:], [][]byte{cID}, pin, opts)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		// Use the first successful assertion.
+		// In practice it is very unlikely we'd hit this twice.
+		mu.Lock()
+		if assertionResp == nil {
+			assertionResp = resp
+			credentialID = cID
+			userID = uID
+			username = uName
+			usedAppID = actualRPID != rpID
+		}
+		mu.Unlock()
+		return nil
+	}
+
+	skipAdditionalPrompt := passwordless
+	if err := runOnFIDO2Devices(ctx, prompt, skipAdditionalPrompt, filter, deviceCallback); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	var rawAuthData []byte
+	if err := cbor.Unmarshal(assertionResp.AuthDataCBOR, &rawAuthData); err != nil {
+		return nil, "", trace.Wrap(err)
+	}
+
+	return &proto.MFAAuthenticateResponse{
+		Response: &proto.MFAAuthenticateResponse_Webauthn{
+			Webauthn: &wanpb.CredentialAssertionResponse{
+				Type:  string(protocol.PublicKeyCredentialType),
+				RawId: credentialID,
+				Response: &wanpb.AuthenticatorAssertionResponse{
+					ClientDataJson:    ccdJSON,
+					AuthenticatorData: rawAuthData,
+					Signature:         assertionResp.Sig,
+					UserHandle:        userID,
+				},
+				Extensions: &wanpb.AuthenticationExtensionsClientOutputs{
+					AppId: usedAppID,
+				},
+			},
+		},
+	}, username, nil
+}
+
+func getPasswordlessCredentials(dev FIDODevice, pin, rpID, user string) (*libfido2.Credential, error) {
+	creds, err := dev.Credentials(rpID, pin)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	switch {
+	case len(creds) == 0:
+		return nil, libfido2.ErrNoCredentials
+	case len(creds) == 1 && user == "": // no need to disambiguate
+		cred := creds[0]
+		log.Debugf("FIDO2: Found resident credential for user %q", cred.User.Name)
+		return cred, nil
+	case len(creds) > 1 && user == "": // can't disambiguate
+		return nil, trace.BadParameter("too many credentials found, explicit user required")
+	}
+
+	duplicateWarning := false
+	var res *libfido2.Credential
+	for _, cred := range creds {
+		if cred.User.Name == user {
+			// Print information about matched credential, useful for debugging.
+			// ykman prints user IDs in hex, hence the unusual encoding choice below.
+			cID := base64.RawURLEncoding.EncodeToString(cred.ID)
+			uID := cred.User.ID
+			log.Debugf("FIDO2: Found resident credential for user %v, credential ID (b64) = %v, user ID (hex) = %x", user, cID, uID)
+			if res == nil {
+				res = cred
+				continue // Don't break, we want to warn about duplicates.
+			}
+			if !duplicateWarning {
+				duplicateWarning = true
+				log.Warnf("Found multiple credentials for %q, using first match", user)
+			}
+		}
+	}
+	if res == nil {
+		return nil, trace.BadParameter("no credentials for user %q", user)
+	}
+	return res, nil
+}
+
+func getMFACredentials(dev FIDODevice, pin, rpID, appID string, allowedCreds [][]byte) (string, []byte, error) {
+	// The actual hash is not necessary here.
+	const cdh = "00000000000000000000000000000000"
+
+	opts := &libfido2.AssertionOpts{
+		UP: libfido2.False,
+	}
+	actualRPID := rpID
+	var cID []byte
+	for _, cred := range allowedCreds {
+		_, err := dev.Assertion(rpID, []byte(cdh), [][]byte{cred}, pin, opts)
+		if err == nil {
+			cID = cred
+			break
+		}
+
+		// Try again with the U2F appID, if present.
+		if appID != "" {
+			_, err = dev.Assertion(appID, []byte(cdh), [][]byte{cred}, pin, opts)
+			if err == nil {
+				actualRPID = appID
+				cID = cred
+				break
+			}
+		}
+	}
+	if len(cID) == 0 {
+		return "", nil, libfido2.ErrNoCredentials
+	}
+
+	return actualRPID, cID, nil
+}
+
+// fido2Register implements FIDO2Register.
+func fido2Register(
+	ctx context.Context,
+	origin string, cc *wanlib.CredentialCreation, prompt RegisterPrompt,
+) (*proto.MFARegisterResponse, error) {
+	switch {
+	case origin == "":
+		return nil, trace.BadParameter("origin required")
+	case cc == nil:
+		return nil, trace.BadParameter("credential creation required")
+	case prompt == nil:
+		return nil, trace.BadParameter("prompt required")
+	case len(cc.Response.Challenge) == 0:
+		return nil, trace.BadParameter("credential creation challenge required")
+	case cc.Response.RelyingParty.ID == "":
+		return nil, trace.BadParameter("credential creation relying party ID required")
+	}
+
+	rrk := cc.Response.AuthenticatorSelection.RequireResidentKey != nil && *cc.Response.AuthenticatorSelection.RequireResidentKey
+	if rrk {
+		// Be more pedantic with resident keys, some of this info gets recorded with
+		// the credential.
+		switch {
+		case len(cc.Response.RelyingParty.Name) == 0:
+			return nil, trace.BadParameter("relying party name required for resident credential")
+		case len(cc.Response.User.Name) == 0:
+			return nil, trace.BadParameter("user name required for resident credential")
+		case len(cc.Response.User.DisplayName) == 0:
+			return nil, trace.BadParameter("user display name required for resident credential")
+		case len(cc.Response.User.ID) == 0:
+			return nil, trace.BadParameter("user ID required for resident credential")
+		}
+	}
+
+	// Can we create ES256 keys?
+	// TODO(codingllama): Consider supporting other algorithms and respecting
+	//  param order in the credential.
+	ok := false
+	for _, p := range cc.Response.Parameters {
+		if p.Type == protocol.PublicKeyCredentialType && p.Algorithm == webauthncose.AlgES256 {
+			ok = true
+			break
+		}
+	}
+	if !ok {
+		return nil, trace.BadParameter("ES256 not allowed by credential parameters")
+	}
+
+	// Prepare challenge data for the device.
+	ccdJSON, err := json.Marshal(&CollectedClientData{
+		Type:      string(protocol.CreateCeremony),
+		Challenge: base64.RawURLEncoding.EncodeToString(cc.Response.Challenge),
+		Origin:    origin,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	ccdHash := sha256.Sum256(ccdJSON)
+
+	rp := libfido2.RelyingParty{
+		ID:   cc.Response.RelyingParty.ID,
+		Name: cc.Response.RelyingParty.Name,
+	}
+	user := libfido2.User{
+		ID:          cc.Response.User.ID,
+		Name:        cc.Response.User.Name,
+		DisplayName: cc.Response.User.DisplayName,
+		Icon:        cc.Response.User.Icon,
+	}
+	plat := cc.Response.AuthenticatorSelection.AuthenticatorAttachment == protocol.Platform
+	uv := cc.Response.AuthenticatorSelection.UserVerification == protocol.VerificationRequired
+
+	excludeList := make([][]byte, len(cc.Response.CredentialExcludeList))
+	for i := range cc.Response.CredentialExcludeList {
+		excludeList[i] = cc.Response.CredentialExcludeList[i].CredentialID
+	}
+
+	// mu guards attestation from goroutines.
+	var mu sync.Mutex
+	var attestation *libfido2.Attestation
+
+	filter := func(dev FIDODevice, info *deviceInfo) (bool, error) {
+		switch {
+		case (plat && !info.plat) || (rrk && !info.rk) || (uv && !info.uvCapable()):
+			log.Debugf("FIDO2: Device %v: filtered due to options", info.path)
+			return false, nil
+		case len(excludeList) == 0:
+			return true, nil
+		}
+
+		// Does the device hold an excluded credential?
+		const pin = "" // not required to filter
+		switch _, err := dev.Assertion(rp.ID, ccdHash[:], excludeList, pin, &libfido2.AssertionOpts{
+			UP: libfido2.False,
+		}); {
+		case errors.Is(err, libfido2.ErrNoCredentials):
+			return true, nil
+		case err == nil:
+			log.Debugf("FIDO2: Device %v: filtered due to presence of excluded credential", info.path)
+			return false, nil
+		default: // unexpected error
+			return false, trace.Wrap(err)
+		}
+	}
+
+	deviceCallback := func(d FIDODevice, info *deviceInfo, pin string) error {
+		// TODO(codingllama): We may need to setup a PIN if rrk=true.
+		//  Do that as a response to specific MakeCredential failures.
+
+		opts := &libfido2.MakeCredentialOpts{}
+		if rrk {
+			opts.RK = libfido2.True
+		}
+		// Only set the "uv" bit if the authenticator supports built-in
+		// verification. PIN-enabled devices don't claim to support "uv", but they
+		// are capable of UV assertions.
+		// See
+		// https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#getinfo-uv.
+		if uv && info.uv {
+			opts.UV = libfido2.True
+		}
+
+		resp, err := d.MakeCredential(ccdHash[:], rp, user, libfido2.ES256, pin, opts)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		// Use the first successful attestation.
+		// In practice it is very unlikely we'd hit this twice.
+		mu.Lock()
+		if attestation == nil {
+			attestation = resp
+		}
+		mu.Unlock()
+		return nil
+	}
+
+	const skipAdditionalPrompt = false
+	if err := runOnFIDO2Devices(ctx, prompt, skipAdditionalPrompt, filter, deviceCallback); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	var rawAuthData []byte
+	if err := cbor.Unmarshal(attestation.AuthData, &rawAuthData); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	format, attStatement, err := makeAttStatement(attestation)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	attObj := &protocol.AttestationObject{
+		RawAuthData:  rawAuthData,
+		Format:       format,
+		AttStatement: attStatement,
+	}
+	attestationCBOR, err := cbor.Marshal(attObj)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &proto.MFARegisterResponse{
+		Response: &proto.MFARegisterResponse_Webauthn{
+			Webauthn: &wanpb.CredentialCreationResponse{
+				Type:  string(protocol.PublicKeyCredentialType),
+				RawId: attestation.CredentialID,
+				Response: &wanpb.AuthenticatorAttestationResponse{
+					ClientDataJson:    ccdJSON,
+					AttestationObject: attestationCBOR,
+				},
+			},
+		},
+	}, nil
+}
+
+func makeAttStatement(attestation *libfido2.Attestation) (string, map[string]interface{}, error) {
+	const fidoU2F = "fido-u2f"
+	const none = "none"
+	const packed = "packed"
+
+	// See https://www.w3.org/TR/webauthn-2/#sctn-defined-attestation-formats.
+	// The formats handled below are what we expect from the keys libfido2
+	// interacts with.
+	format := attestation.Format
+	switch format {
+	case fidoU2F, packed: // OK, continue below
+	case none:
+		return format, nil, nil
+	default:
+		log.Debugf(`FIDO2: Unsupported attestation format %q, using "none"`, format)
+		return none, nil, nil
+	}
+
+	sig := attestation.Sig
+	if len(sig) == 0 {
+		return "", nil, trace.BadParameter("attestation %q without signature", format)
+	}
+	cert := attestation.Cert
+	if len(cert) == 0 {
+		return "", nil, trace.BadParameter("attestation %q without certificate", format)
+	}
+
+	m := map[string]interface{}{
+		"sig": sig,
+		"x5c": []interface{}{cert},
+	}
+	if format == packed {
+		m["alg"] = int64(attestation.CredentialType)
+	}
+
+	return format, m, nil
+}
+
+type deviceWithInfo struct {
+	FIDODevice
+	info *deviceInfo
+}
+
+type deviceFilterFunc func(dev FIDODevice, info *deviceInfo) (ok bool, err error)
+type deviceCallbackFunc func(dev FIDODevice, info *deviceInfo, pin string) error
+
+// runPrompt defines the prompt operations necessary for runOnFIDO2Devices.
+type runPrompt LoginPrompt
+
+func runOnFIDO2Devices(
+	ctx context.Context,
+	prompt runPrompt, skipAdditionalPrompt bool,
+	filter deviceFilterFunc,
+	deviceCallback deviceCallbackFunc) error {
+	devices, err := findSuitableDevicesOrTimeout(ctx, filter)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	dev, requiresPIN, err := selectDevice(ctx, devices, deviceCallback)
+	switch {
+	case err != nil:
+		return trace.Wrap(err)
+	case !requiresPIN:
+		return nil
+	}
+
+	// Selected device requires PIN, let's use the prompt and run the callback
+	// again.
+	pin, err := prompt.PromptPIN()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Ask for an additional touch after PIN.
+	// Works for most flows (except passwordless).
+	if !skipAdditionalPrompt {
+		if err := prompt.PromptAdditionalTouch(); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return trace.Wrap(deviceCallback(dev, dev.info, pin))
+}
+
+func findSuitableDevicesOrTimeout(ctx context.Context, filter deviceFilterFunc) ([]deviceWithInfo, error) {
+	ticker := time.NewTicker(FIDO2PollInterval)
+	defer ticker.Stop()
+
+	knownPaths := make(map[string]struct{})
+	for {
+		devices, err := findSuitableDevices(filter, knownPaths)
+		if err == nil {
+			return devices, nil
+		}
+		log.WithError(err).Debug("FIDO2: Selecting devices")
+
+		select {
+		case <-ctx.Done():
+			return nil, trace.Wrap(ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+func findSuitableDevices(filter deviceFilterFunc, knownPaths map[string]struct{}) ([]deviceWithInfo, error) {
+	locs, err := fidoDeviceLocations()
+	if err != nil {
+		return nil, trace.Wrap(err, "device locations")
+	}
+
+	var devs []deviceWithInfo
+	for _, loc := range locs {
+		path := loc.Path
+		if _, ok := knownPaths[path]; ok {
+			continue
+		}
+		knownPaths[path] = struct{}{}
+
+		dev, err := fidoNewDevice(path)
+		if err != nil {
+			return nil, trace.Wrap(err, "device %v: open", path)
+		}
+
+		var info *libfido2.DeviceInfo
+		const infoAttempts = 3
+		for i := 0; i < infoAttempts; i++ {
+			info, err = dev.Info()
+			switch {
+			case errors.Is(err, libfido2.ErrTX):
+				// Happens occasionally, give the device a short grace period and retry.
+				time.Sleep(1 * time.Millisecond)
+				continue
+			case err != nil: // unexpected error
+				return nil, trace.Wrap(err, "device %v: info", path)
+			}
+			break // err == nil
+		}
+		if info == nil {
+			return nil, trace.Wrap(libfido2.ErrTX, "device %v: max info attempts reached", path)
+		}
+		log.Debugf("FIDO2: Info for device %v: %#v", path, info)
+
+		di := makeDevInfo(path, info)
+		switch ok, err := filter(dev, di); {
+		case err != nil:
+			return nil, trace.Wrap(err, "device %v: filter", path)
+		case !ok:
+			continue // Skip device.
+		}
+		devs = append(devs, deviceWithInfo{FIDODevice: dev, info: di})
+	}
+
+	if len(devs) == 0 {
+		return nil, errors.New("no suitable devices found")
+	}
+
+	return devs, nil
+}
+
+func selectDevice(ctx context.Context, devices []deviceWithInfo, deviceCallback deviceCallbackFunc) (deviceWithInfo, bool, error) {
+	// We don't know the PIN in the device selection step, so we are optimistic
+	// about the fact that there is no PIN.
+	const pin = ""
+
+	callbackWrapper := func(dev FIDODevice, info *deviceInfo, pin string) (requiresPIN bool, err error) {
+		// Attempt to select a device by running "deviceCallback" on it.
+		// For most scenarios this works, saving a touch.
+		if err = deviceCallback(dev, info, pin); !errors.Is(err, libfido2.ErrPinRequired) {
+			return
+		}
+
+		// ErrPinRequired means we can't use "deviceCallback" as the selection
+		// mechanism. Let's run a different operation to ask for a touch.
+		requiresPIN = true
+
+		// TODO(codingllama): What we really want here is fido_dev_get_touch_begin.
+		//  Another option is to put the authenticator into U2F mode.
+		const rpID = "7f364cc0-958c-4177-b3ea-b2d8d7f15d4a" // arbitrary, unlikely to collide with a real RP
+		const cdh = "00000000000000000000000000000000"      // "random", size 32
+		_, err = dev.Assertion(rpID, []byte(cdh), nil /* credentials */, pin, &libfido2.AssertionOpts{
+			UP: libfido2.True,
+		})
+		if errors.Is(err, libfido2.ErrNoCredentials) {
+			err = nil // OK, selected successfully
+		}
+		return
+	}
+
+	// No need for goroutine shenanigans with a single device.
+	if len(devices) == 1 {
+		dev := devices[0]
+		requiresPIN, err := callbackWrapper(dev, dev.info, pin)
+		return dev, requiresPIN, trace.Wrap(err)
+	}
+
+	type selectResp struct {
+		dev         deviceWithInfo
+		requiresPIN bool
+		err         error
+	}
+
+	respC := make(chan selectResp)
+	numGoroutines := len(devices)
+	for _, dev := range devices {
+		dev := dev
+		go func() {
+			requiresPIN, err := callbackWrapper(dev, dev.info, pin)
+			respC <- selectResp{
+				dev:         dev,
+				requiresPIN: requiresPIN,
+				err:         err,
+			}
+		}()
+	}
+
+	// Stop on timeout or first interaction, whatever comes first wins and gets
+	// returned.
+	var resp selectResp
+	select {
+	case <-ctx.Done():
+		resp.err = ctx.Err()
+	case resp = <-respC:
+		numGoroutines--
+	}
+
+	// Cancel ongoing operations and wait for goroutines to complete.
+	for _, dev := range devices {
+		if dev == resp.dev {
+			continue
+		}
+		if err := dev.Cancel(); err != nil {
+			log.WithError(err).Tracef("FIDO2: Device cancel")
+		}
+	}
+	for i := 0; i < numGoroutines; i++ {
+		cancelResp := <-respC
+		if err := cancelResp.err; err != nil && !errors.Is(err, libfido2.ErrKeepaliveCancel) {
+			log.WithError(err).Debugf("FIDO2: Device errored on cancel")
+		}
+	}
+
+	return resp.dev, resp.requiresPIN, trace.Wrap(resp.err)
+}
+
+// deviceInfo contains an aggregate of a device's informations and capabilities.
+// Various fields match options under
+// https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo.
+type deviceInfo struct {
+	path                           string
+	plat                           bool
+	rk                             bool
+	clientPinCapable, clientPinSet bool
+	uv                             bool
+}
+
+// uvCapable returns true for both "uv" and pin-configured devices.
+func (di *deviceInfo) uvCapable() bool {
+	return di.uv || di.clientPinSet
+}
+
+func makeDevInfo(path string, info *libfido2.DeviceInfo) *deviceInfo {
+	di := &deviceInfo{path: path}
+	for _, opt := range info.Options {
+		// See
+		// https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo.
+		switch opt.Name {
+		case "plat":
+			di.plat = opt.Value == libfido2.True
+		case "rk":
+			di.rk = opt.Value == libfido2.True
+		case "clientPin":
+			di.clientPinCapable = true
+			di.clientPinSet = opt.Value == libfido2.True
+		case "uv":
+			di.uv = opt.Value == libfido2.True
+		}
+	}
+	return di
+}
diff --git a/lib/auth/webauthncli/fido2_common.go b/lib/auth/webauthncli/fido2_common.go
new file mode 100644
index 0000000000000..9eb307c2ad1f4
--- /dev/null
+++ b/lib/auth/webauthncli/fido2_common.go
@@ -0,0 +1,75 @@
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package webauthncli
+
+import (
+	"context"
+	"time"
+
+	"github.com/gravitational/teleport/api/client/proto"
+
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
+)
+
+// FIDO2PollInterval is the poll interval used to check for new FIDO2 devices.
+var FIDO2PollInterval = 200 * time.Millisecond
+
+// LoginPrompt is the user interface for FIDO2Login.
+type LoginPrompt interface {
+	// PromptPIN prompts the user for their PIN.
+	PromptPIN() (string, error)
+	// PromptAdditionalTouch prompts the user for an additional security key
+	// touch.
+	// Additional touches may be required after PINs and during passwordless flows.
+	PromptAdditionalTouch() error
+}
+
+// FIDO2Login implements Login for CTAP1 and CTAP2 devices.
+// It must be called with a context with timeout, otherwise it can run
+// indefinitely.
+// The informed user is used to disambiguate credentials in case of passwordless
+// logins.
+// It returns an MFAAuthenticateResponse and the credential user, if a resident
+// credential is used.
+// Most callers should call Login directly, as it is correctly guarded by
+// IsFIDO2Available.
+func FIDO2Login(
+	ctx context.Context,
+	origin, user string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt,
+) (*proto.MFAAuthenticateResponse, string, error) {
+	return fido2Login(ctx, origin, user, assertion, prompt)
+}
+
+// RegisterPrompt is the user interface for FIDO2Register.
+type RegisterPrompt interface {
+	// PromptPIN prompts the user for their PIN.
+	PromptPIN() (string, error)
+	// PromptAdditionalTouch prompts the user for an additional security key
+	// touch.
+	// Additional touches may be required after PINs.
+	PromptAdditionalTouch() error
+}
+
+// FIDO2Register implements Register for CTAP1 and CTAP2 devices.
+// It must be called with a context with timeout, otherwise it can run
+// indefinitely.
+// Most callers should call Register directly, as it is correctly guarded by
+// IsFIDO2Available.
+func FIDO2Register(
+	ctx context.Context,
+	origin string, cc *wanlib.CredentialCreation, prompt RegisterPrompt,
+) (*proto.MFARegisterResponse, error) {
+	return fido2Register(ctx, origin, cc, prompt)
+}
diff --git a/lib/auth/webauthncli/fido2_other.go b/lib/auth/webauthncli/fido2_other.go
new file mode 100644
index 0000000000000..4bb43e4a6c2c6
--- /dev/null
+++ b/lib/auth/webauthncli/fido2_other.go
@@ -0,0 +1,48 @@
+//go:build !libfido2
+// +build !libfido2
+
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package webauthncli
+
+import (
+	"context"
+	"errors"
+
+	"github.com/gravitational/teleport/api/client/proto"
+
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
+)
+
+var errFIDO2Unavailable = errors.New("FIDO2 unavailable in current build")
+
+// IsFIDO2Available returns true if libfido2 is available in the current build.
+func IsFIDO2Available() bool {
+	return false
+}
+
+func fido2Login(
+	ctx context.Context,
+	origin, user string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt,
+) (*proto.MFAAuthenticateResponse, string, error) {
+	return nil, "", errFIDO2Unavailable
+}
+
+func fido2Register(
+	ctx context.Context,
+	origin string, cc *wanlib.CredentialCreation, prompt RegisterPrompt,
+) (*proto.MFARegisterResponse, error) {
+	return nil, errFIDO2Unavailable
+}
diff --git a/lib/auth/webauthncli/fido2_test.go b/lib/auth/webauthncli/fido2_test.go
new file mode 100644
index 0000000000000..c3c083f6f5630
--- /dev/null
+++ b/lib/auth/webauthncli/fido2_test.go
@@ -0,0 +1,1438 @@
+//go:build libfido2
+// +build libfido2
+
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package webauthncli_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/duo-labs/webauthn/protocol"
+	"github.com/duo-labs/webauthn/protocol/webauthncose"
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+	"github.com/gravitational/teleport/lib/auth/mocku2f"
+	"github.com/keys-pub/go-libfido2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	wanpb "github.com/gravitational/teleport/api/types/webauthn"
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
+	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
+)
+
+var makeCredentialAuthDataRaw, makeCredentialAuthDataCBOR, makeCredentialSig []byte
+var assertionAuthDataRaw, assertionAuthDataCBOR, assertionSig []byte
+
+func init() {
+	// Initialize arrays with random data, but use realistic sizes.
+	// YMMV.
+	makeCredentialAuthDataRaw = make([]byte, 37)
+	makeCredentialSig = make([]byte, 70)
+	assertionAuthDataRaw = make([]byte, 37)
+	assertionSig = make([]byte, 70)
+	for _, b := range [][]byte{
+		makeCredentialAuthDataRaw,
+		makeCredentialSig,
+		assertionAuthDataRaw,
+		assertionSig,
+	} {
+		if _, err := rand.Read(b); err != nil {
+			panic(err)
+		}
+	}
+
+	// Returned authData is CBOR-encoded, so let's do that.
+	pairs := []*[]byte{
+		&makeCredentialAuthDataRaw, &makeCredentialAuthDataCBOR,
+		&assertionAuthDataRaw, &assertionAuthDataCBOR,
+	}
+	for i := 0; i < len(pairs); i += 2 {
+		dataRaw := pairs[i]
+		dataCBOR := pairs[i+1]
+
+		res, err := cbor.Marshal(*dataRaw)
+		if err != nil {
+			panic(err)
+		}
+		*dataCBOR = res
+	}
+}
+
+type noopPrompt struct{}
+
+func (p noopPrompt) PromptPIN() (string, error) {
+	return "", nil
+}
+
+func (p noopPrompt) PromptAdditionalTouch() error {
+	return nil
+}
+
+func TestFIDO2Login(t *testing.T) {
+	resetFIDO2AfterTests(t)
+	wancli.FIDO2PollInterval = 1 * time.Millisecond // run fast on tests
+
+	const rpID = "example.com"
+	const appID = "https://example.com"
+	const origin = "https://example.com"
+
+	authOpts := []libfido2.Option{
+		{Name: "rk", Value: "true"},
+		{Name: "up", Value: "true"},
+		{Name: "plat", Value: "false"},
+		{Name: "clientPin", Value: "false"}, // supported but unset
+	}
+	pinOpts := []libfido2.Option{
+		{Name: "rk", Value: "true"},
+		{Name: "up", Value: "true"},
+		{Name: "plat", Value: "false"},
+		{Name: "clientPin", Value: "true"}, // supported and configured
+	}
+	bioOpts := []libfido2.Option{
+		{Name: "rk", Value: "true"},
+		{Name: "up", Value: "true"},
+		{Name: "uv", Value: "true"},
+		{Name: "plat", Value: "false"},
+		{Name: "alwaysUv", Value: "true"},
+		{Name: "bioEnroll", Value: "true"}, // supported and configured
+		{Name: "clientPin", Value: "true"}, // supported and configured
+	}
+
+	// User IDs and names for resident credentials / passwordless.
+	const llamaName = "llama"
+	const alpacaName = "alpaca"
+	var llamaID = make([]byte, 16)
+	var alpacaID = make([]byte, 16)
+	for _, b := range [][]byte{llamaID, alpacaID} {
+		_, err := rand.Read(b)
+		require.NoError(t, err, "Read failed")
+	}
+
+	// auth1 is a FIDO2 authenticator without a PIN configured.
+	auth1 := mustNewFIDO2Device("/path1", "" /* pin */, &libfido2.DeviceInfo{
+		Options: authOpts,
+	})
+	// pin1 is a FIDO2 authenticator with a PIN.
+	pin1 := mustNewFIDO2Device("/pin1", "supersecretpinllama", &libfido2.DeviceInfo{
+		Options: pinOpts,
+	})
+	// pin2 is a FIDO2 authenticator with a PIN.
+	pin2 := mustNewFIDO2Device("/pin2", "supersecretpin2", &libfido2.DeviceInfo{
+		Options: pinOpts,
+	})
+	// pin3 is a FIDO2 authenticator with a PIN and resident credentials.
+	pin3 := mustNewFIDO2Device("/pin3", "supersecretpin3", &libfido2.DeviceInfo{
+		Options: pinOpts,
+	}, &libfido2.Credential{
+		User: libfido2.User{
+			ID:   alpacaID,
+			Name: alpacaName,
+		},
+	})
+	// bio1 is a biometric authenticator.
+	bio1 := mustNewFIDO2Device("/bio1", "supersecretBIOpin", &libfido2.DeviceInfo{
+		Options: bioOpts,
+	})
+	// bio2 is a biometric authenticator with configured resident credentials.
+	bio2 := mustNewFIDO2Device("/bio2", "supersecretBIO2pin", &libfido2.DeviceInfo{
+		Options: bioOpts,
+	}, &libfido2.Credential{
+		User: libfido2.User{
+			ID:   llamaID,
+			Name: llamaName,
+		},
+	}, &libfido2.Credential{
+		User: libfido2.User{
+			ID:   alpacaID,
+			Name: alpacaName,
+		},
+	})
+	// legacy1 is an authenticator registered using the U2F App ID.
+	legacy1 := mustNewFIDO2Device("/legacy1", "" /* pin */, &libfido2.DeviceInfo{Options: authOpts})
+	legacy1.wantRPID = appID
+
+	challenge, err := protocol.CreateChallenge()
+	require.NoError(t, err, "CreateChallenge failed")
+
+	baseAssertion := &wanlib.CredentialAssertion{
+		Response: protocol.PublicKeyCredentialRequestOptions{
+			Challenge:          challenge,
+			RelyingPartyID:     rpID,
+			AllowedCredentials: []protocol.CredentialDescriptor{},
+			UserVerification:   protocol.VerificationDiscouraged,
+			Extensions:         map[string]interface{}{},
+		},
+	}
+
+	tests := []struct {
+		name            string
+		timeout         time.Duration
+		fido2           *fakeFIDO2
+		setUP           func()
+		user            string
+		createAssertion func() *wanlib.CredentialAssertion
+		prompt          wancli.LoginPrompt
+		// assertResponse and wantErr are mutually exclusive.
+		assertResponse func(t *testing.T, resp *wanpb.CredentialAssertionResponse)
+		wantErr        string
+	}{
+		{
+			name:  "single device",
+			fido2: newFakeFIDO2(auth1),
+			setUP: func() {
+				go func() {
+					// Simulate delayed user press.
+					time.Sleep(100 * time.Millisecond)
+					auth1.setUP()
+				}()
+			},
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: auth1.credentialID()},
+				}
+				return &cp
+			},
+			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
+				assert.Equal(t, auth1.credentialID(), resp.RawId, "RawId mismatch")
+			},
+		},
+		{
+			name:  "pin protected device",
+			fido2: newFakeFIDO2(pin1),
+			setUP: pin1.setUP,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: pin1.credentialID()},
+				}
+				return &cp
+			},
+		},
+		{
+			name:  "biometric device",
+			fido2: newFakeFIDO2(bio1),
+			setUP: bio1.setUP,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: bio1.credentialID()},
+				}
+				return &cp
+			},
+		},
+		{
+			name:  "legacy device (AppID)",
+			fido2: newFakeFIDO2(legacy1),
+			setUP: legacy1.setUP,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: legacy1.credentialID()},
+				}
+				cp.Response.Extensions = protocol.AuthenticationExtensions{
+					wanlib.AppIDExtension: appID,
+				}
+				return &cp
+			},
+			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
+				assert.True(t, resp.Extensions.AppId, "AppID mismatch")
+			},
+		},
+		{
+			name: "multiple valid devices",
+			fido2: newFakeFIDO2(
+				auth1,
+				pin1,
+				bio1,
+				legacy1,
+			),
+			setUP: bio1.setUP,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: auth1.credentialID()},
+					{CredentialID: pin1.credentialID()},
+					{CredentialID: bio1.credentialID()},
+					{CredentialID: legacy1.credentialID()},
+				}
+				cp.Response.Extensions = protocol.AuthenticationExtensions{
+					wanlib.AppIDExtension: appID,
+				}
+				return &cp
+			},
+			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
+				assert.Equal(t, bio1.credentialID(), resp.RawId, "RawId mismatch (want bio1)")
+			},
+		},
+		{
+			name: "multiple devices filtered",
+			fido2: newFakeFIDO2(
+				auth1, // allowed
+				pin1,  // not allowed
+				bio1,
+				legacy1, // doesn't match RPID or AppID
+			),
+			setUP: auth1.setUP,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: auth1.credentialID()},
+					{CredentialID: bio1.credentialID()},
+					{CredentialID: legacy1.credentialID()},
+				}
+				cp.Response.Extensions = protocol.AuthenticationExtensions{
+					wanlib.AppIDExtension: "https://badexample.com",
+				}
+				return &cp
+			},
+			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
+				assert.Equal(t, auth1.credentialID(), resp.RawId, "RawId mismatch (want auth1)")
+			},
+		},
+		{
+			name: "multiple pin devices",
+			fido2: newFakeFIDO2(
+				auth1,
+				pin1, pin2,
+				bio1,
+			),
+			setUP: pin2.setUP,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: auth1.credentialID()},
+					{CredentialID: pin1.credentialID()},
+					{CredentialID: pin2.credentialID()},
+					{CredentialID: bio1.credentialID()},
+				}
+				return &cp
+			},
+			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
+				assert.Equal(t, pin2.credentialID(), resp.RawId, "RawId mismatch (want pin2)")
+			},
+		},
+		{
+			name:    "NOK no devices plugged times out",
+			timeout: 10 * time.Millisecond,
+			fido2:   newFakeFIDO2(),
+			setUP:   func() {},
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: auth1.credentialID()},
+				}
+				return &cp
+			},
+			wantErr: context.DeadlineExceeded.Error(),
+		},
+		{
+			name:    "NOK no devices touched times out",
+			timeout: 10 * time.Millisecond,
+			fido2:   newFakeFIDO2(auth1, pin1, bio1, legacy1),
+			setUP:   func() {}, // no interaction
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
+					{CredentialID: auth1.credentialID()},
+					{CredentialID: pin1.credentialID()},
+					{CredentialID: bio1.credentialID()},
+				}
+				return &cp
+			},
+			wantErr: context.DeadlineExceeded.Error(),
+		},
+		{
+			name:  "passwordless pin",
+			fido2: newFakeFIDO2(pin3),
+			setUP: pin3.setUP,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = nil
+				cp.Response.UserVerification = protocol.VerificationRequired
+				return &cp
+			},
+			prompt: pin3,
+			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
+				assert.Equal(t, pin3.credentials[0].ID, resp.RawId, "RawId mismatch (want %q resident credential)", alpacaName)
+				assert.Equal(t, alpacaID, resp.Response.UserHandle, "UserHandle mismatch (want %q)", alpacaName)
+			},
+		},
+		{
+			name:  "passwordless biometric (llama)",
+			fido2: newFakeFIDO2(bio2),
+			setUP: bio2.setUP,
+			user:  llamaName,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = nil
+				cp.Response.UserVerification = protocol.VerificationRequired
+				return &cp
+			},
+			prompt: bio2,
+			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
+				assert.Equal(t, bio2.credentials[0].ID, resp.RawId, "RawId mismatch (want %q resident credential)", llamaName)
+				assert.Equal(t, llamaID, resp.Response.UserHandle, "UserHandle mismatch (want %q)", llamaName)
+			},
+		},
+		{
+			name:  "passwordless biometric (alpaca)",
+			fido2: newFakeFIDO2(bio2),
+			setUP: bio2.setUP,
+			user:  alpacaName,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = nil
+				cp.Response.UserVerification = protocol.VerificationRequired
+				return &cp
+			},
+			prompt: bio2,
+			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
+				assert.Equal(t, bio2.credentials[1].ID, resp.RawId, "RawId mismatch (want %q resident credential)", alpacaName)
+				assert.Equal(t, alpacaID, resp.Response.UserHandle, "UserHandle mismatch (want %q)", alpacaName)
+			},
+		},
+		{
+			name:  "NOK passwordless no credentials",
+			fido2: newFakeFIDO2(bio1),
+			setUP: bio1.setUP,
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = nil
+				cp.Response.UserVerification = protocol.VerificationRequired
+				return &cp
+			},
+			prompt:  bio1,
+			wantErr: libfido2.ErrNoCredentials.Error(),
+		},
+		{
+			name:  "NOK passwordless ambiguous user",
+			fido2: newFakeFIDO2(bio2),
+			setUP: bio2.setUP,
+			user:  "", // >1 resident credential, can't pick unambiguous username.
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = nil
+				cp.Response.UserVerification = protocol.VerificationRequired
+				return &cp
+			},
+			prompt:  bio2,
+			wantErr: "explicit user required",
+		},
+		{
+			name:  "NOK passwordless unknown user",
+			fido2: newFakeFIDO2(bio2),
+			setUP: bio2.setUP,
+			user:  "camel", // unknown
+			createAssertion: func() *wanlib.CredentialAssertion {
+				cp := *baseAssertion
+				cp.Response.AllowedCredentials = nil
+				cp.Response.UserVerification = protocol.VerificationRequired
+				return &cp
+			},
+			prompt:  bio2,
+			wantErr: "no credentials for user",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			test.fido2.setCallbacks()
+			test.setUP()
+
+			timeout := test.timeout
+			if timeout == 0 {
+				timeout = 1 * time.Second
+			}
+			ctx, cancel := context.WithTimeout(context.Background(), timeout)
+			defer cancel()
+
+			prompt := test.prompt
+			if prompt == nil {
+				prompt = noopPrompt{}
+			}
+
+			mfaResp, _, err := wancli.FIDO2Login(ctx, origin, test.user, test.createAssertion(), prompt)
+			switch {
+			case test.wantErr != "" && err == nil:
+				t.Fatalf("FIDO2Login returned err = nil, wantErr %q", test.wantErr)
+			case test.wantErr != "":
+				require.Contains(t, err.Error(), test.wantErr, "FIDO2Login returned err = %q, wantErr %q", err, test.wantErr)
+				return
+			default:
+				require.NoError(t, err, "FIDO2Login failed")
+				require.NotNil(t, mfaResp, "mfaResp nil")
+			}
+
+			// Do a few baseline checks, tests can assert further.
+			got := mfaResp.GetWebauthn()
+			require.NotNil(t, got, "assertion response nil")
+			require.NotNil(t, got.Response, "authenticator response nil")
+			assert.NotNil(t, got.Response.ClientDataJson, "ClientDataJSON nil")
+			want := &wanpb.CredentialAssertionResponse{
+				Type:  string(protocol.PublicKeyCredentialType),
+				RawId: got.RawId,
+				Response: &wanpb.AuthenticatorAssertionResponse{
+					ClientDataJson:    got.Response.ClientDataJson,
+					AuthenticatorData: assertionAuthDataRaw,
+					Signature:         assertionSig,
+					UserHandle:        got.Response.UserHandle,
+				},
+				Extensions: got.Extensions,
+			}
+			if diff := cmp.Diff(want, got); diff != "" {
+				t.Fatalf("FIDO2Login()/CredentialAssertionResponse mismatch (-want +got):\n%v", diff)
+			}
+
+			if test.assertResponse != nil {
+				test.assertResponse(t, got)
+			}
+		})
+	}
+}
+
+func TestFIDO2Login_errors(t *testing.T) {
+	resetFIDO2AfterTests(t)
+
+	// Make sure we won't call the real libfido2.
+	f2 := newFakeFIDO2()
+	f2.setCallbacks()
+
+	const origin = "https://example.com"
+	const user = ""
+	okAssertion := &wanlib.CredentialAssertion{
+		Response: protocol.PublicKeyCredentialRequestOptions{
+			Challenge:      make([]byte, 32),
+			RelyingPartyID: "example.com",
+			AllowedCredentials: []protocol.CredentialDescriptor{
+				{Type: protocol.PublicKeyCredentialType, CredentialID: []byte{1, 2, 3, 4, 5}},
+			},
+		},
+	}
+	var prompt noopPrompt
+
+	nilChallengeAssertion := *okAssertion
+	nilChallengeAssertion.Response.Challenge = nil
+
+	emptyRPIDAssertion := *okAssertion
+	emptyRPIDAssertion.Response.RelyingPartyID = ""
+
+	tests := []struct {
+		name      string
+		origin    string
+		assertion *wanlib.CredentialAssertion
+		prompt    wancli.LoginPrompt
+		wantErr   string
+	}{
+		{
+			name:      "ok - timeout", // check that good params are good
+			origin:    origin,
+			assertion: okAssertion,
+			prompt:    prompt,
+			wantErr:   context.DeadlineExceeded.Error(),
+		},
+		{
+			name:      "nil origin",
+			assertion: okAssertion,
+			prompt:    prompt,
+			wantErr:   "origin",
+		},
+		{
+			name:    "nil assertion",
+			origin:  origin,
+			prompt:  prompt,
+			wantErr: "assertion required",
+		},
+		{
+			name:      "assertion without challenge",
+			origin:    origin,
+			assertion: &nilChallengeAssertion,
+			prompt:    prompt,
+			wantErr:   "challenge",
+		},
+		{
+			name:      "assertion without RPID",
+			origin:    origin,
+			assertion: &emptyRPIDAssertion,
+			prompt:    prompt,
+			wantErr:   "relying party ID",
+		},
+		{
+			name:      "nil prompt",
+			origin:    origin,
+			assertion: okAssertion,
+			wantErr:   "prompt",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Millisecond)
+			defer cancel()
+
+			_, _, err := wancli.FIDO2Login(ctx, test.origin, user, test.assertion, test.prompt)
+			require.Error(t, err, "FIDO2Login returned err = nil, want %q", test.wantErr)
+			assert.Contains(t, err.Error(), test.wantErr, "FIDO2Login returned err = %q, want %q", err, test.wantErr)
+		})
+	}
+}
+
+func TestFIDO2Register(t *testing.T) {
+	resetFIDO2AfterTests(t)
+
+	const rpID = "example.com"
+	const origin = "https://example.com"
+
+	authOpts := []libfido2.Option{
+		{Name: "rk", Value: "true"},
+		{Name: "up", Value: "true"},
+		{Name: "plat", Value: "false"},
+		{Name: "clientPin", Value: "false"}, // supported but unset
+	}
+	pinOpts := []libfido2.Option{
+		{Name: "rk", Value: "true"},
+		{Name: "up", Value: "true"},
+		{Name: "plat", Value: "false"},
+		{Name: "clientPin", Value: "true"}, // supported and configured
+	}
+
+	// auth1 is a FIDO2 authenticator without a PIN configured.
+	auth1 := mustNewFIDO2Device("/path1", "" /* pin */, &libfido2.DeviceInfo{
+		Options: authOpts,
+	})
+	// pin1 is a FIDO2 authenticator with a PIN.
+	pin1 := mustNewFIDO2Device("/pin1", "supersecretpinllama", &libfido2.DeviceInfo{
+		Options: pinOpts,
+	})
+	// pin2 is a FIDO2 authenticator with a PIN.
+	pin2 := mustNewFIDO2Device("/pin2", "supersecretpin2", &libfido2.DeviceInfo{
+		Options: pinOpts,
+	})
+	// bio1 is a biometric authenticator.
+	bio1 := mustNewFIDO2Device("/bio1", "supersecretBIOpin", &libfido2.DeviceInfo{
+		Options: []libfido2.Option{
+			{Name: "rk", Value: "true"},
+			{Name: "up", Value: "true"},
+			{Name: "uv", Value: "true"},
+			{Name: "plat", Value: "false"},
+			{Name: "alwaysUv", Value: "true"},
+			{Name: "bioEnroll", Value: "true"}, // supported and configured
+			{Name: "clientPin", Value: "true"}, // supported and configured
+		},
+	})
+	// u2f1 is an authenticator that uses fido-u2f attestation.
+	u2f1 := mustNewFIDO2Device("/u2f1", "" /* pin */, &libfido2.DeviceInfo{Options: authOpts})
+	u2f1.format = "fido-u2f"
+	// none1 is an authenticator that returns no attestation data.
+	none1 := mustNewFIDO2Device("/none1", "" /* pin */, &libfido2.DeviceInfo{Options: authOpts})
+	none1.format = "none"
+
+	challenge, err := protocol.CreateChallenge()
+	require.NoError(t, err, "CreateChallenge failed")
+
+	baseCC := &wanlib.CredentialCreation{
+		Response: protocol.PublicKeyCredentialCreationOptions{
+			Challenge: challenge,
+			RelyingParty: protocol.RelyingPartyEntity{
+				ID: rpID,
+			},
+			Parameters: []protocol.CredentialParameter{
+				{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgES256},
+			},
+			AuthenticatorSelection: protocol.AuthenticatorSelection{
+				UserVerification: protocol.VerificationDiscouraged,
+			},
+			Attestation: protocol.PreferDirectAttestation,
+		},
+	}
+	pwdlessCC := *baseCC
+	pwdlessCC.Response.RelyingParty.Name = "Teleport"
+	pwdlessCC.Response.User = protocol.UserEntity{
+		CredentialEntity: protocol.CredentialEntity{
+			Name: "llama",
+		},
+		DisplayName: "Llama",
+		ID:          []byte{1, 2, 3, 4, 5}, // arbitrary
+	}
+	pwdlessRRK := true
+	pwdlessCC.Response.AuthenticatorSelection.RequireResidentKey = &pwdlessRRK
+	pwdlessCC.Response.AuthenticatorSelection.UserVerification = protocol.VerificationRequired
+
+	tests := []struct {
+		name             string
+		timeout          time.Duration
+		fido2            *fakeFIDO2
+		setUP            func()
+		createCredential func() *wanlib.CredentialCreation
+		prompt           wancli.RegisterPrompt
+		wantErr          error
+		assertResponse   func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject)
+	}{
+		{
+			name:  "single device, packed attestation",
+			fido2: newFakeFIDO2(auth1),
+			setUP: auth1.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				return &cp
+			},
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				assert.Equal(t, auth1.credentialID(), ccr.RawId, "RawId mismatch")
+
+				// Assert attestation algorithm and signature.
+				require.Equal(t, "packed", attObj.Format, "attestation format mismatch")
+				assert.Equal(t, int64(webauthncose.AlgES256), attObj.AttStatement["alg"], "attestation alg mismatch")
+				assert.Equal(t, makeCredentialSig, attObj.AttStatement["sig"], "attestation sig mismatch")
+
+				// Assert attestation certificate.
+				x5cInterface := attObj.AttStatement["x5c"]
+				x5c, ok := x5cInterface.([]interface{})
+				require.True(t, ok, "attestation x5c type mismatch (got %T)", x5cInterface)
+				assert.Len(t, x5c, 1, "attestation x5c length mismatch")
+				assert.Equal(t, auth1.cert(), x5c[0], "attestation cert mismatch")
+			},
+		},
+		{
+			name:  "fido-u2f attestation",
+			fido2: newFakeFIDO2(u2f1),
+			setUP: u2f1.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				return &cp
+			},
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				// Assert attestation signature.
+				require.Equal(t, "fido-u2f", attObj.Format, "attestation format mismatch")
+				assert.Equal(t, makeCredentialSig, attObj.AttStatement["sig"], "attestation sig mismatch")
+
+				// Assert attestation certificate.
+				x5cInterface := attObj.AttStatement["x5c"]
+				x5c, ok := x5cInterface.([]interface{})
+				require.True(t, ok, "attestation x5c type mismatch (got %T)", x5cInterface)
+				assert.Len(t, x5c, 1, "attestation x5c length mismatch")
+				assert.Equal(t, u2f1.cert(), x5c[0], "attestation cert mismatch")
+			},
+		},
+		{
+			name:  "none attestation",
+			fido2: newFakeFIDO2(none1),
+			setUP: none1.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				return &cp
+			},
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				assert.Equal(t, "none", attObj.Format, "attestation format mismatch")
+			},
+		},
+		{
+			name:  "pin device",
+			fido2: newFakeFIDO2(pin1),
+			setUP: pin1.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				return &cp
+			},
+			prompt: pin1,
+		},
+		{
+			name:  "multiple valid devices",
+			fido2: newFakeFIDO2(auth1, pin1, pin2, bio1),
+			setUP: bio1.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				return &cp
+			},
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				assert.Equal(t, bio1.credentialID(), ccr.RawId, "RawId mismatch (want bio1)")
+			},
+		},
+		{
+			name:  "multiple devices, uses pin",
+			fido2: newFakeFIDO2(auth1, pin1, pin2, bio1),
+			setUP: pin2.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				return &cp
+			},
+			prompt: pin2,
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				assert.Equal(t, pin2.credentialID(), ccr.RawId, "RawId mismatch (want pin2)")
+			},
+		},
+		{
+			name:  "excluded devices, single valid",
+			fido2: newFakeFIDO2(auth1, bio1),
+			setUP: bio1.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				cp.Response.CredentialExcludeList = []protocol.CredentialDescriptor{
+					{
+						Type:         protocol.PublicKeyCredentialType,
+						CredentialID: auth1.credentialID(),
+					},
+				}
+				return &cp
+			},
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				assert.Equal(t, bio1.credentialID(), ccr.RawId, "RawId mismatch (want bio1)")
+			},
+		},
+		{
+			name:  "excluded devices, multiple valid",
+			fido2: newFakeFIDO2(auth1, pin1, pin2, bio1),
+			setUP: bio1.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				cp.Response.CredentialExcludeList = []protocol.CredentialDescriptor{
+					{
+						Type:         protocol.PublicKeyCredentialType,
+						CredentialID: pin1.credentialID(),
+					},
+					{
+						Type:         protocol.PublicKeyCredentialType,
+						CredentialID: pin2.credentialID(),
+					},
+				}
+				return &cp
+			},
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				assert.Equal(t, bio1.credentialID(), ccr.RawId, "RawId mismatch (want bio1)")
+			},
+		},
+		{
+			name:    "NOK timeout without devices",
+			timeout: 10 * time.Millisecond,
+			fido2:   newFakeFIDO2(),
+			setUP:   func() {},
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := *baseCC
+				return &cp
+			},
+			wantErr: context.DeadlineExceeded,
+		},
+		{
+			name:  "passwordless pin device",
+			fido2: newFakeFIDO2(pin2),
+			setUP: pin2.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := pwdlessCC
+				return &cp
+			},
+			prompt: pin2,
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				require.NotEmpty(t, pin2.credentials, "no resident credentials added to pin2")
+				cred := pin2.credentials[len(pin2.credentials)-1]
+				assert.Equal(t, cred.ID, ccr.RawId, "RawId mismatch (want pin2 resident credential)")
+			},
+		},
+		{
+			name:  "passwordless bio device",
+			fido2: newFakeFIDO2(bio1),
+			setUP: bio1.setUP,
+			createCredential: func() *wanlib.CredentialCreation {
+				cp := pwdlessCC
+				return &cp
+			},
+			prompt: bio1,
+			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
+				require.NotEmpty(t, bio1.credentials, "no resident credentials added to bio1")
+				cred := bio1.credentials[len(bio1.credentials)-1]
+				assert.Equal(t, cred.ID, ccr.RawId, "RawId mismatch (want bio1 resident credential)")
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			test.fido2.setCallbacks()
+			test.setUP()
+
+			timeout := test.timeout
+			if timeout == 0 {
+				timeout = 1 * time.Second
+			}
+			ctx, cancel := context.WithTimeout(context.Background(), timeout)
+			defer cancel()
+
+			prompt := test.prompt
+			if prompt == nil {
+				prompt = noopPrompt{}
+			}
+			mfaResp, err := wancli.FIDO2Register(ctx, origin, test.createCredential(), prompt)
+			switch {
+			case test.wantErr != nil && err == nil:
+				t.Fatalf("FIDO2Register returned err = nil, wantErr %q", test.wantErr)
+			case test.wantErr != nil:
+				require.True(t, errors.Is(err, test.wantErr), "FIDO2Register returned err = %q, wantErr %q", err, test.wantErr)
+				return
+			default:
+				require.NoError(t, err, "FIDO2Register failed")
+				require.NotNil(t, mfaResp, "mfaResp nil")
+			}
+
+			// Do a few baseline checks, tests can assert further.
+			got := mfaResp.GetWebauthn()
+			require.NotNil(t, got, "credential response nil")
+			require.NotNil(t, got.Response, "attestation response nil")
+			assert.NotNil(t, got.Response.ClientDataJson, "ClientDataJSON nil")
+			want := &wanpb.CredentialCreationResponse{
+				Type:  string(protocol.PublicKeyCredentialType),
+				RawId: got.RawId,
+				Response: &wanpb.AuthenticatorAttestationResponse{
+					ClientDataJson:    got.Response.ClientDataJson,
+					AttestationObject: got.Response.AttestationObject,
+				},
+				Extensions: got.Extensions,
+			}
+			if diff := cmp.Diff(want, got); diff != "" {
+				t.Fatalf("FIDO2Register()/CredentialCreationResponse mismatch (-want +got):\n%v", diff)
+			}
+
+			attObj := &protocol.AttestationObject{}
+			err = cbor.Unmarshal(got.Response.AttestationObject, attObj)
+			require.NoError(t, err, "Failed to unmarshal AttestationObject")
+			assert.Equal(t, makeCredentialAuthDataRaw, attObj.RawAuthData, "RawAuthData mismatch")
+
+			if test.assertResponse != nil {
+				test.assertResponse(t, got, attObj)
+			}
+		})
+	}
+}
+
+func TestFIDO2Register_errors(t *testing.T) {
+	resetFIDO2AfterTests(t)
+
+	// Make sure we won't call the real libfido2.
+	f2 := newFakeFIDO2()
+	f2.setCallbacks()
+
+	const origin = "https://example.com"
+	okCC := &wanlib.CredentialCreation{
+		Response: protocol.PublicKeyCredentialCreationOptions{
+			Challenge: make([]byte, 32),
+			RelyingParty: protocol.RelyingPartyEntity{
+				ID: "example.com",
+			},
+			Parameters: []protocol.CredentialParameter{
+				{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgES256},
+			},
+			AuthenticatorSelection: protocol.AuthenticatorSelection{
+				UserVerification: protocol.VerificationDiscouraged,
+			},
+			Attestation: protocol.PreferNoAttestation,
+		},
+	}
+
+	pwdlessOK := *okCC
+	pwdlessOK.Response.RelyingParty.Name = "Teleport"
+	pwdlessOK.Response.User = protocol.UserEntity{
+		CredentialEntity: protocol.CredentialEntity{
+			Name: "llama",
+		},
+		DisplayName: "Llama",
+		ID:          []byte{1, 2, 3, 4, 5}, // arbitrary
+	}
+	rrk := true
+	pwdlessOK.Response.AuthenticatorSelection.RequireResidentKey = &rrk
+	pwdlessOK.Response.AuthenticatorSelection.UserVerification = protocol.VerificationRequired
+
+	var prompt noopPrompt
+
+	tests := []struct {
+		name     string
+		origin   string
+		createCC func() *wanlib.CredentialCreation
+		prompt   wancli.RegisterPrompt
+		wantErr  string
+	}{
+		{
+			name:     "ok - timeout", // check that good params are good
+			origin:   origin,
+			createCC: func() *wanlib.CredentialCreation { return okCC },
+			prompt:   prompt,
+			wantErr:  context.DeadlineExceeded.Error(),
+		},
+		{
+			name:     "nil origin",
+			createCC: func() *wanlib.CredentialCreation { return okCC },
+			prompt:   prompt,
+			wantErr:  "origin",
+		},
+		{
+			name:     "nil cc",
+			origin:   origin,
+			createCC: func() *wanlib.CredentialCreation { return nil },
+			prompt:   prompt,
+			wantErr:  "credential creation required",
+		},
+		{
+			name:   "cc without challenge",
+			origin: origin,
+			createCC: func() *wanlib.CredentialCreation {
+				cp := *okCC
+				cp.Response.Challenge = nil
+				return &cp
+			},
+			prompt:  prompt,
+			wantErr: "challenge",
+		},
+		{
+			name:   "cc without RPID",
+			origin: origin,
+			createCC: func() *wanlib.CredentialCreation {
+				cp := *okCC
+				cp.Response.RelyingParty.ID = ""
+				return &cp
+			},
+			prompt:  prompt,
+			wantErr: "relying party ID",
+		},
+		{
+			name:   "cc unsupported parameters",
+			origin: origin,
+			createCC: func() *wanlib.CredentialCreation {
+				cp := *okCC
+				cp.Response.Parameters = []protocol.CredentialParameter{
+					{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgEdDSA},
+				}
+				return &cp
+			},
+			prompt:  prompt,
+			wantErr: "ES256",
+		},
+		{
+			name:     "nil pinPrompt",
+			origin:   origin,
+			createCC: func() *wanlib.CredentialCreation { return okCC },
+			wantErr:  "prompt",
+		},
+		{
+			name:   "rrk empty RP name",
+			origin: origin,
+			createCC: func() *wanlib.CredentialCreation {
+				cp := pwdlessOK
+				cp.Response.RelyingParty.Name = ""
+				return &cp
+			},
+			prompt:  prompt,
+			wantErr: "relying party name",
+		},
+		{
+			name:   "rrk empty user name",
+			origin: origin,
+			createCC: func() *wanlib.CredentialCreation {
+				cp := pwdlessOK
+				cp.Response.User.Name = ""
+				return &cp
+			},
+			prompt:  prompt,
+			wantErr: "user name",
+		},
+		{
+			name:   "rrk empty user display name",
+			origin: origin,
+			createCC: func() *wanlib.CredentialCreation {
+				cp := pwdlessOK
+				cp.Response.User.DisplayName = ""
+				return &cp
+			},
+			prompt:  prompt,
+			wantErr: "user display name",
+		},
+		{
+			name:   "rrk nil user ID",
+			origin: origin,
+			createCC: func() *wanlib.CredentialCreation {
+				cp := pwdlessOK
+				cp.Response.User.ID = nil
+				return &cp
+			},
+			prompt:  prompt,
+			wantErr: "user ID",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Millisecond)
+			defer cancel()
+
+			_, err := wancli.FIDO2Register(ctx, test.origin, test.createCC(), test.prompt)
+			require.Error(t, err, "FIDO2Register returned err = nil, want %q", test.wantErr)
+			assert.Contains(t, err.Error(), test.wantErr, "FIDO2Register returned err = %q, want %q", err, test.wantErr)
+		})
+	}
+}
+
+func resetFIDO2AfterTests(t *testing.T) {
+	pollInterval := wancli.FIDO2PollInterval
+	devLocations := wancli.FIDODeviceLocations
+	newDevice := wancli.FIDONewDevice
+	t.Cleanup(func() {
+		wancli.FIDO2PollInterval = pollInterval
+		wancli.FIDODeviceLocations = devLocations
+		wancli.FIDONewDevice = newDevice
+	})
+}
+
+type fakeFIDO2 struct {
+	locs    []*libfido2.DeviceLocation
+	devices map[string]*fakeFIDO2Device
+}
+
+func newFakeFIDO2(devs ...*fakeFIDO2Device) *fakeFIDO2 {
+	f := &fakeFIDO2{
+		devices: make(map[string]*fakeFIDO2Device),
+	}
+	for _, dev := range devs {
+		if _, ok := f.devices[dev.path]; ok {
+			panic(fmt.Sprintf("Duplicate device path registered: %q", dev.path))
+		}
+		f.locs = append(f.locs, &libfido2.DeviceLocation{
+			Path: dev.path,
+		})
+		f.devices[dev.path] = dev
+	}
+	return f
+}
+
+func (f *fakeFIDO2) setCallbacks() {
+	*wancli.FIDODeviceLocations = f.newMeteredDeviceLocations()
+	*wancli.FIDONewDevice = f.NewDevice
+}
+
+func (f *fakeFIDO2) newMeteredDeviceLocations() func() ([]*libfido2.DeviceLocation, error) {
+	i := 0
+	return func() ([]*libfido2.DeviceLocation, error) {
+		// Delay showing devices for a while to exercise polling.
+		i++
+		const minLoops = 2
+		if i < minLoops {
+			return nil, nil
+		}
+		return f.locs, nil
+	}
+}
+
+func (f *fakeFIDO2) NewDevice(path string) (wancli.FIDODevice, error) {
+	if dev, ok := f.devices[path]; ok {
+		return dev, nil
+	}
+	// go-libfido2 doesn't actually error here, but we do for simplicity.
+	return nil, errors.New("not found")
+}
+
+type fakeFIDO2Device struct {
+	path        string
+	info        *libfido2.DeviceInfo
+	pin         string
+	credentials []*libfido2.Credential
+
+	// wantRPID may be set directly to enable RPID checks on Assertion.
+	wantRPID string
+	// format may be set directly to change the attestation format.
+	format string
+
+	key    *mocku2f.Key
+	pubKey []byte
+
+	// mu and cond guard up and cancel.
+	mu         sync.Mutex
+	cond       *sync.Cond
+	up, cancel bool
+}
+
+func mustNewFIDO2Device(path, pin string, info *libfido2.DeviceInfo, creds ...*libfido2.Credential) *fakeFIDO2Device {
+	dev, err := newFIDO2Device(path, pin, info, creds...)
+	if err != nil {
+		panic(err)
+	}
+	return dev
+}
+
+func newFIDO2Device(path, pin string, info *libfido2.DeviceInfo, creds ...*libfido2.Credential) (*fakeFIDO2Device, error) {
+	key, err := mocku2f.Create()
+	if err != nil {
+		return nil, err
+	}
+
+	pubKeyCBOR, err := wanlib.U2FKeyToCBOR(&key.PrivateKey.PublicKey)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, cred := range creds {
+		cred.ID = make([]byte, 16) // somewhat arbitrary
+		if _, err := rand.Read(cred.ID); err != nil {
+			return nil, err
+		}
+		cred.Type = libfido2.ES256
+	}
+
+	d := &fakeFIDO2Device{
+		path:        path,
+		pin:         pin,
+		credentials: creds,
+		format:      "packed",
+		info:        info,
+		key:         key,
+		pubKey:      pubKeyCBOR,
+	}
+	d.cond = sync.NewCond(&d.mu)
+	return d, nil
+}
+
+func (f *fakeFIDO2Device) PromptPIN() (string, error) {
+	return f.pin, nil
+}
+
+func (f *fakeFIDO2Device) PromptAdditionalTouch() error {
+	f.setUP()
+	return nil
+}
+
+func (f *fakeFIDO2Device) credentialID() []byte {
+	return f.key.KeyHandle
+}
+
+func (f *fakeFIDO2Device) cert() []byte {
+	return f.key.Cert
+}
+
+func (f *fakeFIDO2Device) Info() (*libfido2.DeviceInfo, error) {
+	return f.info, nil
+}
+
+func (f *fakeFIDO2Device) setUP() {
+	f.mu.Lock()
+	f.up = true
+	f.mu.Unlock()
+	f.cond.Broadcast()
+}
+
+func (f *fakeFIDO2Device) Cancel() error {
+	f.mu.Lock()
+	f.cancel = true
+	f.mu.Unlock()
+	f.cond.Broadcast()
+	return nil
+}
+
+func (f *fakeFIDO2Device) Credentials(rpID string, pin string) ([]*libfido2.Credential, error) {
+	if f.pin != "" {
+		if err := f.validatePIN(pin); err != nil {
+			return nil, err
+		}
+	}
+	return f.credentials, nil
+}
+
+func (f *fakeFIDO2Device) MakeCredential(
+	clientDataHash []byte,
+	rp libfido2.RelyingParty,
+	user libfido2.User,
+	typ libfido2.CredentialType,
+	pin string,
+	opts *libfido2.MakeCredentialOpts,
+) (*libfido2.Attestation, error) {
+	switch {
+	case len(clientDataHash) == 0:
+		return nil, errors.New("clientDataHash required")
+	case rp.ID == "":
+		return nil, errors.New("rp.ID required")
+	case typ != libfido2.ES256:
+		return nil, errors.New("bad credential type")
+	case opts.UV == libfido2.False: // can only be empty or true
+		return nil, libfido2.ErrUnsupportedOption
+	case opts.UV == libfido2.True && !f.hasUV():
+		return nil, libfido2.ErrUnsupportedOption // PIN authenticators don't like UV
+	}
+
+	// Validate PIN regardless of opts.
+	// This is in line with how current YubiKeys behave.
+	if err := f.validatePIN(pin); err != nil {
+		return nil, err
+	}
+
+	if err := f.maybeLockUntilInteraction(true /* up */); err != nil {
+		return nil, err
+	}
+
+	cert, sig := f.cert(), makeCredentialSig
+	if f.format == "none" {
+		// Do not return attestation data in case of "none".
+		// This is a hypothetical scenario, as I haven't seen device that does this.
+		cert, sig = nil, nil
+	}
+
+	// Did we create a resident credential? Create a new ID for it and record it.
+	cID := f.key.KeyHandle
+	if opts.RK == libfido2.True {
+		cID = make([]byte, 16) // somewhat arbitrary
+		if _, err := rand.Read(cID); err != nil {
+			return nil, err
+		}
+		f.credentials = append(f.credentials, &libfido2.Credential{
+			ID:   cID,
+			Type: libfido2.ES256,
+			User: user,
+		})
+	}
+
+	return &libfido2.Attestation{
+		ClientDataHash: clientDataHash,
+		AuthData:       makeCredentialAuthDataCBOR,
+		CredentialID:   cID,
+		CredentialType: libfido2.ES256,
+		PubKey:         f.pubKey,
+		Cert:           cert,
+		Sig:            sig,
+		Format:         f.format,
+	}, nil
+}
+
+func (f *fakeFIDO2Device) Assertion(
+	rpID string,
+	clientDataHash []byte,
+	credentialIDs [][]byte,
+	pin string,
+	opts *libfido2.AssertionOpts,
+) (*libfido2.Assertion, error) {
+	switch {
+	case rpID == "":
+		return nil, errors.New("rp.ID required")
+	case f.wantRPID != "" && f.wantRPID != rpID:
+		return nil, libfido2.ErrNoCredentials
+	case len(clientDataHash) == 0:
+		return nil, errors.New("clientDataHash required")
+	case opts.UV == libfido2.False: // can only be empty or true
+		return nil, libfido2.ErrUnsupportedOption
+	}
+
+	// Validate PIN only if present and UP is required.
+	// This is in line with how current YubiKeys behave.
+	privilegedAccess := f.isBio()
+	if pin != "" && opts.UP == libfido2.True {
+		if err := f.validatePIN(pin); err != nil {
+			return nil, err
+		}
+		privilegedAccess = true
+	}
+
+	// Is our credential allowed?
+	foundCredential := false
+	for _, cred := range credentialIDs {
+		if bytes.Equal(cred, f.key.KeyHandle) {
+			foundCredential = true
+			break
+		}
+
+		// Check resident credentials if we are properly authorized.
+		if !privilegedAccess {
+			continue
+		}
+		for _, resident := range f.credentials {
+			if bytes.Equal(cred, resident.ID) {
+				foundCredential = true
+				break
+			}
+		}
+		if foundCredential {
+			break
+		}
+	}
+	explicitCreds := len(credentialIDs) > 0
+	if explicitCreds && !foundCredential {
+		return nil, libfido2.ErrNoCredentials
+	}
+
+	if err := f.maybeLockUntilInteraction(opts.UP == libfido2.True); err != nil {
+		return nil, err
+	}
+
+	// Pick a credential for the user?
+	switch {
+	case !explicitCreds && privilegedAccess && len(f.credentials) > 0:
+		// OK, at this point an authenticator picks a credential for the user.
+	case !explicitCreds:
+		return nil, libfido2.ErrNoCredentials
+	}
+
+	return &libfido2.Assertion{
+		AuthDataCBOR: assertionAuthDataCBOR,
+		Sig:          assertionSig,
+	}, nil
+}
+
+func (f *fakeFIDO2Device) validatePIN(pin string) error {
+	switch {
+	case f.isBio() && pin == "": // OK, biometric check supersedes PIN.
+	case f.pin != "" && pin == "":
+		return libfido2.ErrPinRequired
+	case f.pin != "" && f.pin != pin:
+		return libfido2.ErrPinInvalid
+	}
+	return nil
+}
+
+func (f *fakeFIDO2Device) hasUV() bool {
+	for _, opt := range f.info.Options {
+		if opt.Name == "uv" {
+			return opt.Value == libfido2.True
+		}
+	}
+	return false
+}
+
+func (f *fakeFIDO2Device) isBio() bool {
+	for _, opt := range f.info.Options {
+		if opt.Name == "bioEnroll" {
+			return opt.Value == libfido2.True
+		}
+	}
+	return false
+}
+
+func (f *fakeFIDO2Device) maybeLockUntilInteraction(up bool) error {
+	if !up {
+		return nil // without UserPresence it doesn't lock.
+	}
+
+	// Lock until we get a touch or a cancel.
+	f.mu.Lock()
+	for !f.up && !f.cancel {
+		f.cond.Wait()
+	}
+
+	// Record/reset state.
+	isCancel := f.cancel
+	f.up = false
+	f.cancel = false
+
+	if isCancel {
+		f.mu.Unlock()
+		return libfido2.ErrKeepaliveCancel
+	}
+	f.mu.Unlock()
+
+	return nil
+}
diff --git a/lib/auth/webauthncli/login.go b/lib/auth/webauthncli/u2f_login.go
similarity index 91%
rename from lib/auth/webauthncli/login.go
rename to lib/auth/webauthncli/u2f_login.go
index a6fd964c8c2e0..7c4e81f1da64c 100644
--- a/lib/auth/webauthncli/login.go
+++ b/lib/auth/webauthncli/u2f_login.go
@@ -30,13 +30,10 @@ import (
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 )
 
-// Login performs client-side, U2F-compatible Webauthn login.
-// This method blocks until either device authentication is successful or the
-// context is cancelled. Calling Login without a deadline or cancel condition
-// may cause it block forever.
-// The caller is expected to prompt the user for action before calling this
-// method.
-func Login(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error) {
+// U2FLogin implements Login for U2F/CTAP1 devices.
+// The implementation is backed exclusively by Go code, making it useful in
+// scenarios where libfido2 is unavailable.
+func U2FLogin(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error) {
 	switch {
 	case origin == "":
 		return nil, trace.BadParameter("origin required")
diff --git a/lib/auth/webauthncli/login_test.go b/lib/auth/webauthncli/u2f_login_test.go
similarity index 98%
rename from lib/auth/webauthncli/login_test.go
rename to lib/auth/webauthncli/u2f_login_test.go
index 699a76d1104ca..83d8d8a56384c 100644
--- a/lib/auth/webauthncli/login_test.go
+++ b/lib/auth/webauthncli/u2f_login_test.go
@@ -146,7 +146,7 @@ func TestLogin(t *testing.T) {
 			fakeDevs := &fakeDevices{devs: test.devs}
 			fakeDevs.assignU2FCallbacks()
 
-			mfaResp, err := wancli.Login(ctx, origin, assertion)
+			mfaResp, err := wancli.U2FLogin(ctx, origin, assertion)
 			switch hasErr := err != nil; {
 			case hasErr != test.wantErr:
 				t.Fatalf("Login returned err = %v, wantErr = %v", err, test.wantErr)
@@ -254,7 +254,7 @@ func TestLogin_errors(t *testing.T) {
 			ctx, cancel := context.WithTimeout(ctx, 1*time.Second)
 			defer cancel()
 
-			_, err := wancli.Login(ctx, test.origin, test.getAssertion())
+			_, err := wancli.U2FLogin(ctx, test.origin, test.getAssertion())
 			require.True(t, trace.IsBadParameter(err))
 		})
 	}
@@ -384,7 +384,9 @@ func (f *fakeDevice) Authenticate(req u2ftoken.AuthenticateRequest) (*u2ftoken.A
 		return nil, trace.Wrap(err)
 	}
 	var counter uint32
-	binary.Read(bytes.NewReader(rawResp[1:5]), binary.BigEndian, &counter)
+	if err := binary.Read(bytes.NewReader(rawResp[1:5]), binary.BigEndian, &counter); err != nil {
+		return nil, err
+	}
 	sign := rawResp[5:]
 
 	return &u2ftoken.AuthenticateResponse{
diff --git a/lib/auth/webauthncli/register.go b/lib/auth/webauthncli/u2f_register.go
similarity index 94%
rename from lib/auth/webauthncli/register.go
rename to lib/auth/webauthncli/u2f_register.go
index b06f69c4cbf08..e1863ac75f4a3 100644
--- a/lib/auth/webauthncli/register.go
+++ b/lib/auth/webauthncli/u2f_register.go
@@ -38,13 +38,10 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-// Register performs client-side, U2F-compatible Webauthn registration.
-// This method blocks until either device authentication is successful or the
-// context is cancelled. Calling Register without a deadline or cancel condition
-// may cause it block forever.
-// The caller is expected to prompt the user for action before calling this
-// method.
-func Register(ctx context.Context, origin string, cc *wanlib.CredentialCreation) (*proto.MFARegisterResponse, error) {
+// U2FRegister implements Register for U2F/CTAP1 devices.
+// The implementation is backed exclusively by Go code, making it useful in
+// scenarios where libfido2 is unavailable.
+func U2FRegister(ctx context.Context, origin string, cc *wanlib.CredentialCreation) (*proto.MFARegisterResponse, error) {
 	// Preliminary checks, more below.
 	switch {
 	case origin == "":
diff --git a/lib/auth/webauthncli/register_test.go b/lib/auth/webauthncli/u2f_register_test.go
similarity index 92%
rename from lib/auth/webauthncli/register_test.go
rename to lib/auth/webauthncli/u2f_register_test.go
index dc01544cc3793..f45a39d956936 100644
--- a/lib/auth/webauthncli/register_test.go
+++ b/lib/auth/webauthncli/u2f_register_test.go
@@ -35,7 +35,6 @@ func TestRegister(t *testing.T) {
 	const rpID = "example.com"
 	const origin = "https://example.com"
 
-	// Prepare a few fake devices.
 	u2fKey, err := newFakeDevice("u2fkey" /* name */, "" /* appID */)
 	require.NoError(t, err)
 	registeredKey, err := newFakeDevice("regkey" /* name */, rpID /* appID */)
@@ -48,8 +47,17 @@ func TestRegister(t *testing.T) {
 			RPID: rpID,
 		},
 		Identity: &fakeIdentity{
-			User:    user,
-			Devices: []*types.MFADevice{registeredKey.mfaDevice},
+			User: user,
+			Devices: []*types.MFADevice{
+				// Fake a WebAuthn device record, as U2F devices are not excluded from registration.
+				{
+					Device: &types.MFADevice_Webauthn{
+						Webauthn: &types.WebauthnDevice{
+							CredentialId: registeredKey.key.KeyHandle,
+						},
+					},
+				},
+			},
 		},
 	}
 
@@ -93,7 +101,7 @@ func TestRegister(t *testing.T) {
 			fakeDevs := &fakeDevices{devs: test.devs}
 			fakeDevs.assignU2FCallbacks()
 
-			resp, err := wancli.Register(ctx, origin, cc)
+			resp, err := wancli.U2FRegister(ctx, origin, cc)
 			switch hasErr := err != nil; {
 			case hasErr != test.wantErr:
 				t.Fatalf("Register returned err = %v, wantErr = %v", err, test.wantErr)
@@ -196,7 +204,7 @@ func TestRegister_errors(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			_, err := wancli.Register(ctx, test.origin, test.makeCC())
+			_, err := wancli.U2FRegister(ctx, test.origin, test.makeCC())
 			require.Error(t, err)
 			require.Contains(t, err.Error(), test.wantErr)
 		})
diff --git a/lib/backend/backend.go b/lib/backend/backend.go
index 2b398ec95153e..b17e616b2d2d2 100644
--- a/lib/backend/backend.go
+++ b/lib/backend/backend.go
@@ -85,10 +85,6 @@ type Backend interface {
 	// CloseWatchers closes all the watchers
 	// without closing the backend
 	CloseWatchers()
-
-	// Migrate performs any data migration necessary between Teleport versions.
-	// Migrate must be called BEFORE using any other methods of the Backend.
-	Migrate(context.Context) error
 }
 
 // IterateRange is a helper for stepping over a range
@@ -285,6 +281,8 @@ func GetPaginationKey(r types.Resource) string {
 		return string(internalKey(resourceWithType.GetHostID(), resourceWithType.GetName()))
 	case types.AppServer:
 		return string(internalKey(resourceWithType.GetHostID(), resourceWithType.GetName()))
+	case types.WindowsDesktop:
+		return string(internalKey(resourceWithType.GetHostID(), resourceWithType.GetName()))
 	default:
 		return r.GetName()
 	}
@@ -379,9 +377,3 @@ func Key(parts ...string) []byte {
 func internalKey(internalPrefix string, parts ...string) []byte {
 	return []byte(strings.Join(append([]string{internalPrefix}, parts...), string(Separator)))
 }
-
-// NoMigrations implements a nop Migrate method of Backend.
-// Backend implementations should embed this when no migrations are necessary.
-type NoMigrations struct{}
-
-func (NoMigrations) Migrate(context.Context) error { return nil }
diff --git a/lib/backend/backend_test.go b/lib/backend/backend_test.go
index 65101e2663710..80a5f0b7b9818 100644
--- a/lib/backend/backend_test.go
+++ b/lib/backend/backend_test.go
@@ -19,6 +19,8 @@ package backend
 
 import (
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
 func TestParams(t *testing.T) {
@@ -36,3 +38,20 @@ func TestParams(t *testing.T) {
 		t.Errorf("expected 'path' to be '%v', got '%v'", expectedPath, path)
 	}
 }
+
+func TestRangeEnd(t *testing.T) {
+	for _, test := range []struct {
+		key, expected string
+	}{
+		{"abc", "abd"},
+		{"/foo/bar", "/foo/bas"},
+		{"/xyz", "/xy{"},
+		{"\xFF", "\x00"},
+		{"\xFF\xFF\xFF", "\x00"},
+	} {
+		t.Run(test.key, func(t *testing.T) {
+			end := RangeEnd([]byte(test.key))
+			require.Equal(t, test.expected, string(end))
+		})
+	}
+}
diff --git a/lib/backend/dynamo/dynamodbbk.go b/lib/backend/dynamo/dynamodbbk.go
index ea1dd5535b739..669ca28c251dc 100644
--- a/lib/backend/dynamo/dynamodbbk.go
+++ b/lib/backend/dynamo/dynamodbbk.go
@@ -122,7 +122,6 @@ func (cfg *Config) CheckAndSetDefaults() error {
 type Backend struct {
 	*log.Entry
 	Config
-	backend.NoMigrations
 	svc              *dynamodb.DynamoDB
 	streams          *dynamodbstreams.DynamoDBStreams
 	clock            clockwork.Clock
@@ -363,6 +362,10 @@ func (b *Backend) GetRange(ctx context.Context, startKey []byte, endKey []byte,
 	if len(endKey) == 0 {
 		return nil, trace.BadParameter("missing parameter endKey")
 	}
+	if limit <= 0 {
+		limit = backend.DefaultRangeLimit
+	}
+
 	result, err := b.getAllRecords(ctx, startKey, endKey, limit)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -383,6 +386,7 @@ func (b *Backend) GetRange(ctx context.Context, startKey []byte, endKey []byte,
 
 func (b *Backend) getAllRecords(ctx context.Context, startKey []byte, endKey []byte, limit int) (*getResult, error) {
 	var result getResult
+
 	// this code is being extra careful here not to introduce endless loop
 	// by some unfortunate series of events
 	for i := 0; i < backend.DefaultRangeLimit/100; i++ {
@@ -391,7 +395,9 @@ func (b *Backend) getAllRecords(ctx context.Context, startKey []byte, endKey []b
 			return nil, trace.Wrap(err)
 		}
 		result.records = append(result.records, re.records...)
-		if len(result.records) >= limit || len(re.lastEvaluatedKey) == 0 {
+		// If the limit was exceeded or there are no more records to fetch return the current result
+		// otherwise updated lastEvaluatedKey and proceed with obtaining new records.
+		if (limit != 0 && len(result.records) >= limit) || len(re.lastEvaluatedKey) == 0 {
 			if len(result.records) == backend.DefaultRangeLimit {
 				b.Warnf("Range query hit backend limit. (this is a bug!) startKey=%q,limit=%d", startKey, backend.DefaultRangeLimit)
 			}
@@ -744,12 +750,12 @@ func (b *Backend) getRecords(ctx context.Context, startKey, endKey string, limit
 
 // isExpired returns 'true' if the given object (record) has a TTL and
 // it's due.
-func (r *record) isExpired() bool {
+func (r *record) isExpired(now time.Time) bool {
 	if r.Expires == nil {
 		return false
 	}
 	expiryDateUTC := time.Unix(*r.Expires, 0).UTC()
-	return time.Now().UTC().After(expiryDateUTC)
+	return now.UTC().After(expiryDateUTC)
 }
 
 func removeDuplicates(elements []record) []record {
@@ -868,7 +874,7 @@ func (b *Backend) getKey(ctx context.Context, key []byte) (*record, error) {
 		return nil, trace.WrapWithMessage(err, "failed to unmarshal dynamo item %q", string(key))
 	}
 	// Check if key expired, if expired delete it
-	if r.isExpired() {
+	if r.isExpired(b.clock.Now()) {
 		if err := b.deleteKey(ctx, key); err != nil {
 			b.Warnf("Failed deleting expired key %q: %v", key, err)
 		}
diff --git a/lib/backend/dynamo/dynamodbbk_test.go b/lib/backend/dynamo/dynamodbbk_test.go
index d2b336cd2441f..aba11048f0c64 100644
--- a/lib/backend/dynamo/dynamodbbk_test.go
+++ b/lib/backend/dynamo/dynamodbbk_test.go
@@ -22,11 +22,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/test"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
 )
 
 func TestMain(m *testing.M) {
@@ -70,7 +71,7 @@ func TestDynamoDB(t *testing.T) {
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
-		clock := clockwork.NewFakeClock()
+		clock := clockwork.NewFakeClockAt(time.Now())
 		uut.clock = clock
 		return uut, clock, nil
 	}
diff --git a/lib/backend/etcdbk/etcd.go b/lib/backend/etcdbk/etcd.go
index bec81ffe92f0e..8714618b62731 100644
--- a/lib/backend/etcdbk/etcd.go
+++ b/lib/backend/etcdbk/etcd.go
@@ -23,7 +23,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
-	"io/ioutil"
+	"os"
 	"sort"
 	"strings"
 	"time"
@@ -132,7 +132,6 @@ var (
 )
 
 type EtcdBackend struct {
-	backend.NoMigrations
 	nodes []string
 	*log.Entry
 	cfg       *Config
@@ -278,7 +277,7 @@ func (cfg *Config) Validate() error {
 		cfg.DialTimeout = apidefaults.DefaultDialTimeout
 	}
 	if cfg.PasswordFile != "" {
-		out, err := ioutil.ReadFile(cfg.PasswordFile)
+		out, err := os.ReadFile(cfg.PasswordFile)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
@@ -314,11 +313,11 @@ func (b *EtcdBackend) reconnect(ctx context.Context) error {
 	tlsConfig := utils.TLSConfig(nil)
 
 	if b.cfg.TLSCertFile != "" {
-		clientCertPEM, err := ioutil.ReadFile(b.cfg.TLSCertFile)
+		clientCertPEM, err := os.ReadFile(b.cfg.TLSCertFile)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
-		clientKeyPEM, err := ioutil.ReadFile(b.cfg.TLSKeyFile)
+		clientKeyPEM, err := os.ReadFile(b.cfg.TLSKeyFile)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
@@ -330,7 +329,7 @@ func (b *EtcdBackend) reconnect(ctx context.Context) error {
 	}
 
 	if b.cfg.TLSCAFile != "" {
-		caCertPEM, err := ioutil.ReadFile(b.cfg.TLSCAFile)
+		caCertPEM, err := os.ReadFile(b.cfg.TLSCAFile)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
diff --git a/lib/backend/firestore/firestorebk.go b/lib/backend/firestore/firestorebk.go
index 17cde960a0a39..a051544f64870 100644
--- a/lib/backend/firestore/firestorebk.go
+++ b/lib/backend/firestore/firestorebk.go
@@ -95,7 +95,6 @@ func (cfg *backendConfig) CheckAndSetDefaults() error {
 type Backend struct {
 	*log.Entry
 	backendConfig
-	backend.NoMigrations
 	// svc is the primary Firestore client
 	svc *firestore.Client
 	// clock is the
diff --git a/lib/backend/lite/lite.go b/lib/backend/lite/lite.go
index a9aada40113f4..49ac382b7730a 100644
--- a/lib/backend/lite/lite.go
+++ b/lib/backend/lite/lite.go
@@ -21,10 +21,11 @@ import (
 	"context"
 	"database/sql"
 	"database/sql/driver"
-	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
 	"runtime/debug"
+	"strconv"
 	"sync/atomic"
 	"time"
 
@@ -39,15 +40,36 @@ import (
 )
 
 const (
-	// BackendName is the name of this backend
+	// BackendName is the name of this backend.
 	BackendName = "sqlite"
 	// AlternativeName is another name of this backend.
-	AlternativeName                      = "dir"
-	defaultDirMode           os.FileMode = 0770
-	defaultDBFile                        = "sqlite.db"
-	slowTransactionThreshold             = time.Second
-	syncOFF                              = "OFF"
-	busyTimeout                          = 10000
+	AlternativeName = "dir"
+
+	// SyncOff disables file system sync after writing.
+	SyncOff = "OFF"
+	// SyncFull fsyncs the database file on disk after every write.
+	SyncFull = "FULL"
+
+	// JournalMemory keeps the rollback journal in memory instead of storing it
+	// on disk.
+	JournalMemory = "MEMORY"
+)
+
+const (
+	// defaultDirMode is the mode of the newly created directories that are part
+	// of the Path
+	defaultDirMode os.FileMode = 0770
+
+	// defaultDBFile is the file name of the sqlite db in the directory
+	// specified by Path
+	defaultDBFile            = "sqlite.db"
+	slowTransactionThreshold = time.Second
+
+	// defaultSync is the default value for Sync
+	defaultSync = SyncOff
+
+	// defaultBusyTimeout is the default value for BusyTimeout, in ms
+	defaultBusyTimeout = 10000
 )
 
 // GetName is a part of backend API and it returns SQLite backend type
@@ -56,14 +78,6 @@ func GetName() string {
 	return BackendName
 }
 
-func init() {
-	sql.Register(BackendName, &sqlite3.SQLiteDriver{
-		ConnectHook: func(conn *sqlite3.SQLiteConn) error {
-			return nil
-		},
-	})
-}
-
 // Config structure represents configuration section
 type Config struct {
 	// Path is a path to the database directory
@@ -77,15 +91,12 @@ type Config struct {
 	EventsOff bool `json:"events_off,omitempty"`
 	// Clock allows to override clock used in the backend
 	Clock clockwork.Clock `json:"-"`
-	// Sync sets synchronous pragrma
+	// Sync sets the synchronous pragma
 	Sync string `json:"sync,omitempty"`
 	// BusyTimeout sets busy timeout in milliseconds
 	BusyTimeout int `json:"busy_timeout,omitempty"`
-	// Memory turns memory mode of the database
-	Memory bool `json:"memory"`
-	// MemoryName sets the name of the database,
-	// set to "sqlite.db" by default
-	MemoryName string `json:"memory_name"`
+	// Journal sets the journal_mode pragma
+	Journal string `json:"journal,omitempty"`
 	// Mirror turns on mirror mode for the backend,
 	// which will use record IDs for Put and PutRange passed from
 	// the resources, not generate a new one
@@ -95,7 +106,7 @@ type Config struct {
 // CheckAndSetDefaults is a helper returns an error if the supplied configuration
 // is not enough to connect to sqlite
 func (cfg *Config) CheckAndSetDefaults() error {
-	if cfg.Path == "" && !cfg.Memory {
+	if cfg.Path == "" {
 		return trace.BadParameter("specify directory path to the database using 'path' parameter")
 	}
 	if cfg.BufferSize == 0 {
@@ -108,17 +119,69 @@ func (cfg *Config) CheckAndSetDefaults() error {
 		cfg.Clock = clockwork.NewRealClock()
 	}
 	if cfg.Sync == "" {
-		cfg.Sync = syncOFF
+		cfg.Sync = defaultSync
 	}
 	if cfg.BusyTimeout == 0 {
-		cfg.BusyTimeout = busyTimeout
-	}
-	if cfg.MemoryName == "" {
-		cfg.MemoryName = defaultDBFile
+		cfg.BusyTimeout = defaultBusyTimeout
 	}
 	return nil
 }
 
+// ConnectionURI returns a connection string usable with sqlite according to the
+// Config.
+func (cfg *Config) ConnectionURI() string {
+	params := url.Values{}
+	params.Set("_busy_timeout", strconv.Itoa(cfg.BusyTimeout))
+	// The _txlock parameter is parsed by go-sqlite to determine if (all)
+	// transactions should be started with `BEGIN DEFERRED` (the default, same
+	// as `BEGIN`), `BEGIN IMMEDIATE` or `BEGIN EXCLUSIVE`.
+	//
+	// The way we use sqlite relies entirely on the busy timeout handler (also
+	// configured through the connection URL, with the _busy_timeout parameter)
+	// to address concurrency problems, and treats any SQLITE_BUSY errors as a
+	// fatal issue with the database; however, in scenarios with multiple
+	// readwriters it is possible to still get a busy error even with a generous
+	// busy timeout handler configured, as two transactions that both start off
+	// with a SELECT - thus acquiring a SHARED lock, see
+	// https://www.sqlite.org/lockingv3.html#transaction_control - then attempt
+	// to upgrade to a RESERVED lock to upsert or delete something can end up
+	// requiring one of the two transactions to forcibly rollback to avoid a
+	// deadlock, which is signaled by the sqlite engine with a SQLITE_BUSY error
+	// returned to one of the two. When that happens, a concurrent-aware program
+	// can just try the transaction again a few times - making sure to disregard
+	// what was read before the transaction actually committed.
+	//
+	// As we're not really interested in concurrent sqlite access (process
+	// storage has very little written to, sharing a sqlite database as the
+	// backend between two auths is not really supported, and caches shouldn't
+	// ever run on the same underlying sqlite backend) we instead start every
+	// transaction with `BEGIN IMMEDIATE`, which grabs a RESERVED lock
+	// immediately (waiting for the busy timeout in case some other connection
+	// to the database has the lock) at the beginning of the transaction, thus
+	// avoiding any spurious SQLITE_BUSY error that can happen halfway through a
+	// transaction.
+	//
+	// If we end up requiring better concurrent access to sqlite in the future
+	// we should consider enabling Write-Ahead Logging mode, to actually allow
+	// for reads to happen at the same time as writes, adding some amount of
+	// retries to inTransaction, and double-checking that all uses of it
+	// correctly handle the possibility of the transaction being restarted.
+	params.Set("_txlock", "immediate")
+	if cfg.Sync != "" {
+		params.Set("_sync", cfg.Sync)
+	}
+	if cfg.Journal != "" {
+		params.Set("_journal", cfg.Journal)
+	}
+
+	u := url.URL{
+		Scheme:   "file",
+		Opaque:   url.QueryEscape(filepath.Join(cfg.Path, defaultDBFile)),
+		RawQuery: params.Encode(),
+	}
+	return u.String()
+}
+
 // New returns a new instance of sqlite backend
 func New(ctx context.Context, params backend.Params) (*Backend, error) {
 	var cfg *Config
@@ -135,23 +198,18 @@ func NewWithConfig(ctx context.Context, cfg Config) (*Backend, error) {
 	if err := cfg.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	var connectorURL string
-	if !cfg.Memory {
-		// Ensure that the path to the root directory exists.
-		err := os.MkdirAll(cfg.Path, defaultDirMode)
-		if err != nil {
-			return nil, trace.ConvertSystemError(err)
-		}
-		fullPath := filepath.Join(cfg.Path, defaultDBFile)
-		connectorURL = fmt.Sprintf("file:%v?_busy_timeout=%v&_sync=%v", fullPath, cfg.BusyTimeout, cfg.Sync)
-	} else {
-		connectorURL = fmt.Sprintf("file:%v?mode=memory", cfg.MemoryName)
+	connectionURI := cfg.ConnectionURI()
+	// Ensure that the path to the root directory exists.
+	err := os.MkdirAll(cfg.Path, defaultDirMode)
+	if err != nil {
+		return nil, trace.ConvertSystemError(err)
 	}
-	db, err := sql.Open(BackendName, connectorURL)
+	db, err := sql.Open("sqlite3", cfg.ConnectionURI())
 	if err != nil {
-		return nil, trace.Wrap(err, "error opening URI: %v", connectorURL)
+		return nil, trace.Wrap(err, "error opening URI: %v", connectionURI)
 	}
-	// serialize access to sqlite to avoid database is locked errors
+	// serialize access to sqlite, as we're using immediate transactions anyway,
+	// and in-memory go locks are faster than sqlite locks
 	db.SetMaxOpenConns(1)
 	buf := backend.NewCircularBuffer(
 		backend.BufferCapacity(cfg.BufferSize),
@@ -166,9 +224,9 @@ func NewWithConfig(ctx context.Context, cfg Config) (*Backend, error) {
 		ctx:    closeCtx,
 		cancel: cancel,
 	}
-	l.Debugf("Connected to: %v, poll stream period: %v", connectorURL, cfg.PollStreamPeriod)
+	l.Debugf("Connected to: %v, poll stream period: %v", connectionURI, cfg.PollStreamPeriod)
 	if err := l.createSchema(); err != nil {
-		return nil, trace.Wrap(err, "error creating schema: %v", connectorURL)
+		return nil, trace.Wrap(err, "error creating schema: %v", connectionURI)
 	}
 	if err := l.showPragmas(); err != nil {
 		l.Warningf("Failed to show pragma settings: %v.", err)
@@ -181,7 +239,6 @@ func NewWithConfig(ctx context.Context, cfg Config) (*Backend, error) {
 type Backend struct {
 	Config
 	*log.Entry
-	backend.NoMigrations
 	db *sql.DB
 	// clock is used to generate time,
 	// could be swapped in tests for fixed time
@@ -199,17 +256,22 @@ type Backend struct {
 // parameters, when called, logs some key PRAGMA values
 func (l *Backend) showPragmas() error {
 	return l.inTransaction(l.ctx, func(tx *sql.Tx) error {
-		row := tx.QueryRowContext(l.ctx, "PRAGMA synchronous;")
-		var syncValue string
-		if err := row.Scan(&syncValue); err != nil {
+		var journalMode string
+		row := tx.QueryRowContext(l.ctx, "PRAGMA journal_mode;")
+		if err := row.Scan(&journalMode); err != nil {
+			return trace.Wrap(err)
+		}
+		row = tx.QueryRowContext(l.ctx, "PRAGMA synchronous;")
+		var synchronous string
+		if err := row.Scan(&synchronous); err != nil {
 			return trace.Wrap(err)
 		}
-		var timeoutValue string
+		var busyTimeout string
 		row = tx.QueryRowContext(l.ctx, "PRAGMA busy_timeout;")
-		if err := row.Scan(&timeoutValue); err != nil {
+		if err := row.Scan(&busyTimeout); err != nil {
 			return trace.Wrap(err)
 		}
-		l.Debugf("Synchronous: %v, busy timeout: %v", syncValue, timeoutValue)
+		l.Debugf("journal_mode=%v, synchronous=%v, busy_timeout=%v", journalMode, synchronous, busyTimeout)
 		return nil
 	})
 }
diff --git a/lib/backend/lite/litemem_test.go b/lib/backend/lite/litemem_test.go
deleted file mode 100644
index 764539739e691..0000000000000
--- a/lib/backend/lite/litemem_test.go
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
-Copyright 2018-2019 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package lite
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/test"
-	"github.com/gravitational/trace"
-
-	"github.com/jonboulle/clockwork"
-)
-
-func TestLiteMem(t *testing.T) {
-	newBackend := func(options ...test.ConstructionOption) (backend.Backend, clockwork.FakeClock, error) {
-		clock := clockwork.NewFakeClock()
-
-		testCfg, err := test.ApplyOptions(options)
-		if err != nil {
-			return nil, nil, err
-		}
-
-		backendCfg := Config{
-			Memory:           true,
-			PollStreamPeriod: 300 * time.Millisecond,
-			Clock:            clock,
-			Mirror:           testCfg.MirrorMode,
-		}
-
-		backend, err := NewWithConfig(context.Background(), backendCfg)
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-
-		return backend, clock, nil
-	}
-
-	test.RunBackendComplianceSuite(t, newBackend)
-}
diff --git a/lib/backend/memory/memory.go b/lib/backend/memory/memory.go
index 7568c4b3d6cb8..58a384f96a498 100644
--- a/lib/backend/memory/memory.go
+++ b/lib/backend/memory/memory.go
@@ -116,7 +116,6 @@ type Memory struct {
 	*sync.Mutex
 	*log.Entry
 	Config
-	backend.NoMigrations
 	// tree is a BTree with items
 	tree *btree.BTree
 	// heap is a min heap with expiry records
diff --git a/lib/backend/report.go b/lib/backend/report.go
index b229dac8a5b07..89207f194aeef 100644
--- a/lib/backend/report.go
+++ b/lib/backend/report.go
@@ -253,9 +253,6 @@ func (s *Reporter) Clock() clockwork.Clock {
 	return s.Backend.Clock()
 }
 
-// Migrate runs the necessary data migrations for this backend.
-func (s *Reporter) Migrate(ctx context.Context) error { return s.Backend.Migrate(ctx) }
-
 type topRequestsCacheKey struct {
 	component string
 	key       string
diff --git a/lib/backend/sanitize.go b/lib/backend/sanitize.go
index ccdc289e85ad6..f6c751035b9fc 100644
--- a/lib/backend/sanitize.go
+++ b/lib/backend/sanitize.go
@@ -30,16 +30,16 @@ import (
 // errorMessage is the error message to return when invalid input is provided by the caller.
 const errorMessage = "special characters are not allowed in resource names, please use name composed only from characters, hyphens, dots, and plus signs: %q"
 
-// whitelistPattern is the pattern of allowed characters for each key within
+// allowPattern is the pattern of allowed characters for each key within
 // the path.
-var whitelistPattern = regexp.MustCompile(`^[0-9A-Za-z@_:.\-/+]*$`)
+var allowPattern = regexp.MustCompile(`^[0-9A-Za-z@_:.\-/+]*$`)
 
-// blacklistPattern matches some unallowed combinations
-var blacklistPattern = regexp.MustCompile(`//`)
+// denyPattern matches some unallowed combinations
+var denyPattern = regexp.MustCompile(`//`)
 
 // isKeySafe checks if the passed in key conforms to whitelist
 func isKeySafe(s []byte) bool {
-	return whitelistPattern.Match(s) && !blacklistPattern.Match(s) && utf8.Valid(s)
+	return allowPattern.Match(s) && !denyPattern.Match(s) && utf8.Valid(s)
 }
 
 // Sanitizer wraps a Backend implementation to make sure all values requested
@@ -118,12 +118,12 @@ func (s *Sanitizer) Delete(ctx context.Context, key []byte) error {
 
 // DeleteRange deletes range of items
 func (s *Sanitizer) DeleteRange(ctx context.Context, startKey []byte, endKey []byte) error {
+	// we only validate the start key, since we often compute the end key
+	// in order to delete a bunch of related entries
 	if !isKeySafe(startKey) {
 		return trace.BadParameter(errorMessage, startKey)
 	}
-	if !isKeySafe(endKey) {
-		return trace.BadParameter(errorMessage, endKey)
-	}
+
 	return s.backend.DeleteRange(ctx, startKey, endKey)
 }
 
@@ -163,6 +163,3 @@ func (s *Sanitizer) Clock() clockwork.Clock {
 func (s *Sanitizer) CloseWatchers() {
 	s.backend.CloseWatchers()
 }
-
-// Migrate runs the necessary data migrations for this backend.
-func (s *Sanitizer) Migrate(ctx context.Context) error { return s.backend.Migrate(ctx) }
diff --git a/lib/backend/sanitize_test.go b/lib/backend/sanitize_test.go
index 42e34975c8f5f..81f4e750a55c0 100644
--- a/lib/backend/sanitize_test.go
+++ b/lib/backend/sanitize_test.go
@@ -16,99 +16,88 @@ package backend
 
 import (
 	"context"
+	"fmt"
+	"testing"
 	"time"
 
 	"github.com/jonboulle/clockwork"
-	"gopkg.in/check.v1"
+	"github.com/stretchr/testify/require"
 )
 
-type Suite struct {
-}
-
-var _ = check.Suite(&Suite{})
-
-func (s *Suite) SetUpSuite(c *check.C) {
-}
-
-func (s *Suite) TearDownSuite(c *check.C) {
-}
-
-func (s *Suite) TearDownTest(c *check.C) {
-}
-
-func (s *Suite) SetUpTest(c *check.C) {
-}
-
-func (s *Suite) TestSanitizeBucket(c *check.C) {
+func TestSanitize(t *testing.T) {
 	tests := []struct {
-		inKey    []byte
-		outError bool
+		inKey  []byte
+		assert require.ErrorAssertionFunc
 	}{
 		{
-			inKey:    []byte("a-b/c:d/.e_f/01"),
-			outError: false,
+			inKey:  []byte("a-b/c:d/.e_f/01"),
+			assert: require.NoError,
 		},
 		{
-			inKey:    []byte("/namespaces//params"),
-			outError: true,
+			inKey:  []byte("/namespaces//params"),
+			assert: require.Error,
 		},
 		{
-			inKey:    RangeEnd([]byte("a-b/c:d/.e_f/01")),
-			outError: false,
+			inKey:  RangeEnd([]byte("a-b/c:d/.e_f/01")),
+			assert: require.NoError,
 		},
 		{
-			inKey:    RangeEnd([]byte("/")),
-			outError: false,
+			inKey:  RangeEnd([]byte("/")),
+			assert: require.NoError,
 		},
 		{
-			inKey:    RangeEnd([]byte("Malformed \xf0\x90\x28\xbc UTF8")),
-			outError: true,
+			inKey:  RangeEnd([]byte("Malformed \xf0\x90\x28\xbc UTF8")),
+			assert: require.Error,
 		},
 		{
-			inKey:    []byte("test+subaddr@example.com"),
-			outError: false,
+			inKey:  []byte("test+subaddr@example.com"),
+			assert: require.NoError,
+		},
+		{
+			inKey:  []byte("xyz"),
+			assert: require.NoError,
 		},
 	}
 
-	for i, tt := range tests {
-		comment := check.Commentf("Test %v, key: %q", i, string(tt.inKey))
-
-		safeBackend := NewSanitizer(&nopBackend{})
+	for _, tt := range tests {
+		t.Run(fmt.Sprintf("%v", string(tt.inKey)), func(t *testing.T) {
+			ctx := context.Background()
+			safeBackend := NewSanitizer(&nopBackend{})
 
-		ctx := context.TODO()
-		_, err := safeBackend.Get(ctx, tt.inKey)
-		c.Assert(err != nil, check.Equals, tt.outError, comment)
+			_, err := safeBackend.Get(ctx, tt.inKey)
+			tt.assert(t, err)
 
-		_, err = safeBackend.Create(ctx, Item{Key: tt.inKey})
-		c.Assert(err != nil, check.Equals, tt.outError, comment)
+			_, err = safeBackend.Create(ctx, Item{Key: tt.inKey})
+			tt.assert(t, err)
 
-		_, err = safeBackend.Put(ctx, Item{Key: tt.inKey})
-		c.Assert(err != nil, check.Equals, tt.outError, comment)
+			_, err = safeBackend.Put(ctx, Item{Key: tt.inKey})
+			tt.assert(t, err)
 
-		_, err = safeBackend.Update(ctx, Item{Key: tt.inKey})
-		c.Assert(err != nil, check.Equals, tt.outError, comment)
+			_, err = safeBackend.Update(ctx, Item{Key: tt.inKey})
+			tt.assert(t, err)
 
-		_, err = safeBackend.CompareAndSwap(ctx, Item{Key: tt.inKey}, Item{Key: tt.inKey})
-		c.Assert(err != nil, check.Equals, tt.outError, comment)
+			_, err = safeBackend.CompareAndSwap(ctx, Item{Key: tt.inKey}, Item{Key: tt.inKey})
+			tt.assert(t, err)
 
-		err = safeBackend.Delete(ctx, tt.inKey)
-		c.Assert(err != nil, check.Equals, tt.outError, comment)
+			err = safeBackend.Delete(ctx, tt.inKey)
+			tt.assert(t, err)
 
-		err = safeBackend.DeleteRange(ctx, tt.inKey, tt.inKey)
-		c.Assert(err != nil, check.Equals, tt.outError, comment)
+			err = safeBackend.DeleteRange(ctx, tt.inKey, tt.inKey)
+			tt.assert(t, err)
+		})
 	}
 }
 
-type nopBackend struct {
-	NoMigrations
-}
+type nopBackend struct{}
 
 func (n *nopBackend) Get(_ context.Context, _ []byte) (*Item, error) {
 	return &Item{}, nil
 }
 
 func (n *nopBackend) GetRange(_ context.Context, startKey []byte, endKey []byte, limit int) (*GetResult, error) {
-	return &GetResult{Items: []Item{Item{Key: []byte("foo"), Value: []byte("bar")}}}, nil
+	return &GetResult{Items: []Item{
+		{Key: []byte("foo"), Value: []byte("bar")},
+	}}, nil
 }
 
 func (n *nopBackend) Create(_ context.Context, _ Item) (*Lease, error) {
diff --git a/lib/backend/test/suite.go b/lib/backend/test/suite.go
index 195236eba1b6a..2ca3bc04462e6 100644
--- a/lib/backend/test/suite.go
+++ b/lib/backend/test/suite.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"encoding/hex"
 	"errors"
+	"fmt"
 	"math/rand"
 	"sync"
 	"sync/atomic"
@@ -140,7 +141,6 @@ func RunBackendComplianceSuite(t *testing.T, newBackend Constructor) {
 	t.Run("Events", func(t *testing.T) {
 		testEvents(t, newBackend)
 	})
-
 	t.Run("WatchersClose", func(t *testing.T) {
 		testWatchersClose(t, newBackend)
 	})
@@ -156,6 +156,14 @@ func RunBackendComplianceSuite(t *testing.T, newBackend Constructor) {
 	t.Run("Mirror", func(t *testing.T) {
 		testMirror(t, newBackend)
 	})
+
+	t.Run("FetchLimit", func(t *testing.T) {
+		testFetchLimit(t, newBackend)
+	})
+
+	t.Run("Limit", func(t *testing.T) {
+		testLimit(t, newBackend)
+	})
 }
 
 // RequireItems asserts that the supplied `actual` items collection matches
@@ -572,6 +580,72 @@ func testEvents(t *testing.T, newBackend Constructor) {
 	requireEvent(t, watcher, types.OpDelete, item.Key, 2*time.Second)
 }
 
+// testFetchLimit tests fetch max items size limit.
+func testFetchLimit(t *testing.T, newBackend Constructor) {
+	uut, _, err := newBackend()
+	require.NoError(t, err)
+	defer func() { require.NoError(t, uut.Close()) }()
+
+	prefix := MakePrefix()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// Allocate 65KB buffer.
+	buff := make([]byte, 1<<16)
+	itemsCount := 20
+	// Fill the backend with events that total size is greater than 1MB (65KB * 20 > 1MB).
+	for i := 0; i < itemsCount; i++ {
+		item := &backend.Item{Key: prefix(fmt.Sprintf("/db/database%d", i)), Value: buff}
+		_, err = uut.Put(ctx, *item)
+		require.NoError(t, err)
+	}
+
+	result, err := uut.GetRange(ctx, prefix("/db"), backend.RangeEnd(prefix("/db")), backend.NoLimit)
+	require.NoError(t, err)
+	require.Equal(t, itemsCount, len(result.Items))
+}
+
+// testLimit tests limit.
+func testLimit(t *testing.T, newBackend Constructor) {
+	uut, clock, err := newBackend()
+	require.NoError(t, err)
+	defer func() { require.NoError(t, uut.Close()) }()
+
+	prefix := MakePrefix()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	item := &backend.Item{
+		Key:     prefix("/db/database_tail_item"),
+		Value:   []byte("data"),
+		Expires: clock.Now().Add(time.Minute),
+	}
+	_, err = uut.Put(ctx, *item)
+	require.NoError(t, err)
+	for i := 0; i < 10; i++ {
+		item := &backend.Item{
+			Key:     prefix(fmt.Sprintf("/db/database%d", i)),
+			Value:   []byte("data"),
+			Expires: clock.Now().Add(time.Second * 10),
+		}
+		_, err = uut.Put(ctx, *item)
+		require.NoError(t, err)
+	}
+	clock.Advance(time.Second * 20)
+
+	item = &backend.Item{
+		Key:     prefix("/db/database_head_item"),
+		Value:   []byte("data"),
+		Expires: clock.Now().Add(time.Minute),
+	}
+	_, err = uut.Put(ctx, *item)
+	require.NoError(t, err)
+
+	result, err := uut.GetRange(ctx, prefix("/db"), backend.RangeEnd(prefix("/db")), 2)
+	require.NoError(t, err)
+	require.Equal(t, 2, len(result.Items))
+}
+
 // requireEvent asserts that a given event type with the given key is emitted
 // by a watcher within the supplied timeout, returning that event for further
 // inspection if successful.
diff --git a/lib/backend/wrap.go b/lib/backend/wrap.go
index 387c506f146f2..ec1f3dea142f8 100644
--- a/lib/backend/wrap.go
+++ b/lib/backend/wrap.go
@@ -136,6 +136,3 @@ func (s *Wrapper) CloseWatchers() {
 func (s *Wrapper) Clock() clockwork.Clock {
 	return s.backend.Clock()
 }
-
-// Migrate runs the necessary data migrations for this backend.
-func (s *Wrapper) Migrate(ctx context.Context) error { return s.backend.Migrate(ctx) }
diff --git a/lib/benchmark/benchmark.go b/lib/benchmark/benchmark.go
index 5b1d728b1e848..2775ddbee90f7 100644
--- a/lib/benchmark/benchmark.go
+++ b/lib/benchmark/benchmark.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -157,8 +156,8 @@ func ExportLatencyProfile(path string, h *hdrhistogram.Histogram, ticks int32, v
 // to benchmark spec. It returns benchmark result when completed.
 // This is a blocking function that can be cancelled via context argument.
 func (c *Config) Benchmark(ctx context.Context, tc *client.TeleportClient) (Result, error) {
-	tc.Stdout = ioutil.Discard
-	tc.Stderr = ioutil.Discard
+	tc.Stdout = io.Discard
+	tc.Stderr = io.Discard
 	tc.Stdin = &bytes.Buffer{}
 	var delay time.Duration
 	ctx, cancel := context.WithCancel(ctx)
diff --git a/lib/bpf/bpf_test.go b/lib/bpf/bpf_test.go
index 5fa947e96b7f9..d276e80273094 100644
--- a/lib/bpf/bpf_test.go
+++ b/lib/bpf/bpf_test.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	_ "embed"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -69,7 +68,7 @@ func (s *Suite) TestWatch(c *check.C) {
 	}
 
 	// Create temporary directory where cgroup2 hierarchy will be mounted.
-	dir, err := ioutil.TempDir("", "cgroup-test")
+	dir, err := os.MkdirTemp("", "cgroup-test")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(dir)
 
@@ -171,7 +170,7 @@ func (s *Suite) TestObfuscate(c *check.C) {
 	// has been executed.
 	go func() {
 		// Create temporary file.
-		file, err := ioutil.TempFile("", "test-script")
+		file, err := os.CreateTemp("", "test-script")
 		c.Assert(err, check.IsNil)
 		defer os.Remove(file.Name())
 
@@ -248,7 +247,7 @@ func (s *Suite) TestScript(c *check.C) {
 	// has been executed.
 	go func() {
 		// Create temporary file.
-		file, err := ioutil.TempFile("", "test-script")
+		file, err := os.CreateTemp("", "test-script")
 		c.Assert(err, check.IsNil)
 		defer os.Remove(file.Name())
 
diff --git a/lib/cache/cache.go b/lib/cache/cache.go
index 91c30e3153292..42fc0e9996872 100644
--- a/lib/cache/cache.go
+++ b/lib/cache/cache.go
@@ -1200,7 +1200,7 @@ var _ map[getCertAuthorityCacheKey]struct{} // compile-time hashability check
 
 // GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
 // controls if signing keys are loaded
-func (c *Cache) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (c *Cache) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	rg, err := c.read()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1209,8 +1209,10 @@ func (c *Cache) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts
 
 	if !rg.IsCacheRead() && !loadSigningKeys {
 		ta := func(_ types.CertAuthority) {} // compile-time type assertion
-		ci, err := c.fnCache.Get(context.TODO(), getCertAuthorityCacheKey{id}, func() (interface{}, error) {
-			ca, err := rg.trust.GetCertAuthority(id, loadSigningKeys, opts...)
+		ci, err := c.fnCache.Get(ctx, getCertAuthorityCacheKey{id}, func() (interface{}, error) {
+			// use cache's close context instead of request context in order to ensure
+			// that we don't cache a context cancellation error.
+			ca, err := rg.trust.GetCertAuthority(c.ctx, id, loadSigningKeys, opts...)
 			ta(ca)
 			return ca, err
 		})
@@ -1222,13 +1224,13 @@ func (c *Cache) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts
 		return cachedCA.Clone(), nil
 	}
 
-	ca, err := rg.trust.GetCertAuthority(id, loadSigningKeys, opts...)
+	ca, err := rg.trust.GetCertAuthority(ctx, id, loadSigningKeys, opts...)
 	if trace.IsNotFound(err) && rg.IsCacheRead() {
 		// release read lock early
 		rg.Release()
 		// fallback is sane because method is never used
 		// in construction of derivative caches.
-		if ca, err := c.Config.Trust.GetCertAuthority(id, loadSigningKeys, opts...); err == nil {
+		if ca, err := c.Config.Trust.GetCertAuthority(ctx, id, loadSigningKeys, opts...); err == nil {
 			return ca, nil
 		}
 	}
@@ -1243,7 +1245,7 @@ var _ map[getCertAuthoritiesCacheKey]struct{} // compile-time hashability check
 
 // GetCertAuthorities returns a list of authorities of a given type
 // loadSigningKeys controls whether signing keys should be loaded or not
-func (c *Cache) GetCertAuthorities(caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (c *Cache) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	rg, err := c.read()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1251,8 +1253,10 @@ func (c *Cache) GetCertAuthorities(caType types.CertAuthType, loadSigningKeys bo
 	defer rg.Release()
 	if !rg.IsCacheRead() && !loadSigningKeys {
 		ta := func(_ []types.CertAuthority) {} // compile-time type assertion
-		ci, err := c.fnCache.Get(context.TODO(), getCertAuthoritiesCacheKey{caType}, func() (interface{}, error) {
-			cas, err := rg.trust.GetCertAuthorities(caType, loadSigningKeys, opts...)
+		ci, err := c.fnCache.Get(ctx, getCertAuthoritiesCacheKey{caType}, func() (interface{}, error) {
+			// use cache's close context instead of request context in order to ensure
+			// that we don't cache a context cancellation error.
+			cas, err := rg.trust.GetCertAuthorities(c.ctx, caType, loadSigningKeys, opts...)
 			ta(cas)
 			return cas, trace.Wrap(err)
 		})
@@ -1267,7 +1271,7 @@ func (c *Cache) GetCertAuthorities(caType types.CertAuthType, loadSigningKeys bo
 		}
 		return cas, nil
 	}
-	return rg.trust.GetCertAuthorities(caType, loadSigningKeys, opts...)
+	return rg.trust.GetCertAuthorities(ctx, caType, loadSigningKeys, opts...)
 }
 
 // GetStaticTokens gets the list of static tokens used to provision nodes.
@@ -1932,6 +1936,16 @@ func (c *Cache) GetWindowsDesktops(ctx context.Context, filter types.WindowsDesk
 	return rg.windowsDesktops.GetWindowsDesktops(ctx, filter)
 }
 
+// ListWindowsDesktops returns all registered Windows desktop hosts.
+func (c *Cache) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
+	rg, err := c.read()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	defer rg.Release()
+	return rg.windowsDesktops.ListWindowsDesktops(ctx, req)
+}
+
 // ListResources is a part of auth.Cache implementation
 func (c *Cache) ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
 	rg, err := c.read()
diff --git a/lib/cache/cache_test.go b/lib/cache/cache_test.go
index 56ab363baa454..462ed97418afc 100644
--- a/lib/cache/cache_test.go
+++ b/lib/cache/cache_test.go
@@ -239,6 +239,7 @@ func newPack(dir string, setupConfig func(c Config) Config, opts ...packOption)
 func TestCA(t *testing.T) {
 	p := newPackForAuth(t)
 	t.Cleanup(p.Close)
+	ctx := context.Background()
 
 	ca := suite.NewTestCA(types.UserCA, "example.com")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ca))
@@ -249,7 +250,7 @@ func TestCA(t *testing.T) {
 		t.Fatalf("timeout waiting for event")
 	}
 
-	out, err := p.cache.GetCertAuthority(ca.GetID(), true)
+	out, err := p.cache.GetCertAuthority(ctx, ca.GetID(), true)
 	require.NoError(t, err)
 	ca.SetResourceID(out.GetResourceID())
 	require.Empty(t, cmp.Diff(ca, out))
@@ -263,7 +264,7 @@ func TestCA(t *testing.T) {
 		t.Fatalf("timeout waiting for event")
 	}
 
-	_, err = p.cache.GetCertAuthority(ca.GetID(), false)
+	_, err = p.cache.GetCertAuthority(ctx, ca.GetID(), false)
 	require.True(t, trace.IsNotFound(err))
 }
 
@@ -576,7 +577,7 @@ func TestCompletenessInit(t *testing.T) {
 
 		p.backend.SetReadError(nil)
 
-		cas, err := p.cache.GetCertAuthorities(types.UserCA, false)
+		cas, err := p.cache.GetCertAuthorities(ctx, types.UserCA, false)
 		// we don't actually care whether the cache ever fully constructed
 		// the CA list.  for the purposes of this test, we just care that it
 		// doesn't return the CA list *unless* it was successfully constructed.
@@ -633,7 +634,7 @@ func TestCompletenessReset(t *testing.T) {
 	require.NoError(t, err)
 
 	// verify that CAs are immediately available
-	cas, err := p.cache.GetCertAuthorities(types.UserCA, false)
+	cas, err := p.cache.GetCertAuthorities(ctx, types.UserCA, false)
 	require.NoError(t, err)
 	require.Len(t, cas, caCount)
 
@@ -644,7 +645,7 @@ func TestCompletenessReset(t *testing.T) {
 		p.backend.SetReadError(nil)
 
 		// load CAs while connection is bad
-		cas, err := p.cache.GetCertAuthorities(types.UserCA, false)
+		cas, err := p.cache.GetCertAuthorities(ctx, types.UserCA, false)
 		// we don't actually care whether the cache ever fully constructed
 		// the CA list.  for the purposes of this test, we just care that it
 		// doesn't return the CA list *unless* it was successfully constructed.
@@ -696,7 +697,7 @@ func TestTombstones(t *testing.T) {
 	require.NoError(t, err)
 
 	// verify that CAs are immediately available
-	cas, err := p.cache.GetCertAuthorities(types.UserCA, false)
+	cas, err := p.cache.GetCertAuthorities(ctx, types.UserCA, false)
 	require.NoError(t, err)
 	require.Len(t, cas, caCount)
 
@@ -732,7 +733,7 @@ func TestTombstones(t *testing.T) {
 
 	// verify that CAs are immediately available despite the fact
 	// that the origin state was never available.
-	cas, err = p.cache.GetCertAuthorities(types.UserCA, false)
+	cas, err = p.cache.GetCertAuthorities(ctx, types.UserCA, false)
 	require.NoError(t, err)
 	require.Len(t, cas, caCount)
 }
@@ -976,7 +977,7 @@ func initStrategy(t *testing.T) {
 	}))
 	require.NoError(t, err)
 
-	_, err = p.cache.GetCertAuthorities(types.UserCA, false)
+	_, err = p.cache.GetCertAuthorities(ctx, types.UserCA, false)
 	require.True(t, trace.IsConnectionProblem(err))
 
 	ca := suite.NewTestCA(types.UserCA, "example.com")
@@ -998,7 +999,7 @@ func initStrategy(t *testing.T) {
 	}
 	_ = normalizeCA
 
-	out, err := p.cache.GetCertAuthority(ca.GetID(), false)
+	out, err := p.cache.GetCertAuthority(ctx, ca.GetID(), false)
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(normalizeCA(ca), normalizeCA(out)))
 
@@ -1012,7 +1013,7 @@ func initStrategy(t *testing.T) {
 	expectNextEvent(t, p.eventsC, WatcherFailed, EventProcessed, Reloading)
 
 	// backend is out, but old value is available
-	out2, err := p.cache.GetCertAuthority(ca.GetID(), false)
+	out2, err := p.cache.GetCertAuthority(ctx, ca.GetID(), false)
 	require.NoError(t, err)
 	require.Equal(t, out.GetResourceID(), out2.GetResourceID())
 	require.Empty(t, cmp.Diff(normalizeCA(ca), normalizeCA(out)))
@@ -1030,7 +1031,7 @@ func initStrategy(t *testing.T) {
 	expectEvent(t, p.eventsC, WatcherStarted)
 
 	// new value is available now
-	out, err = p.cache.GetCertAuthority(ca.GetID(), false)
+	out, err = p.cache.GetCertAuthority(ctx, ca.GetID(), false)
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(normalizeCA(ca), normalizeCA(out)))
 }
@@ -1070,7 +1071,7 @@ func TestRecovery(t *testing.T) {
 		t.Fatalf("timeout waiting for event")
 	}
 
-	out, err := p.cache.GetCertAuthority(ca2.GetID(), false)
+	out, err := p.cache.GetCertAuthority(context.Background(), ca2.GetID(), false)
 	require.NoError(t, err)
 	ca2.SetResourceID(out.GetResourceID())
 	types.RemoveCASecrets(ca2)
@@ -1405,7 +1406,7 @@ func TestRoles(t *testing.T) {
 	p := newPackForNode(t)
 	t.Cleanup(p.Close)
 
-	role, err := types.NewRole("role1", types.RoleSpecV5{
+	role, err := types.NewRoleV3("role1", types.RoleSpecV5{
 		Options: types.RoleOptions{
 			MaxSessionTTL: types.Duration(time.Hour),
 		},
diff --git a/lib/cache/collections.go b/lib/cache/collections.go
index 4a7837b4fc738..3b08860466bcb 100644
--- a/lib/cache/collections.go
+++ b/lib/cache/collections.go
@@ -813,17 +813,17 @@ func (c *certAuthority) erase(ctx context.Context) error {
 }
 
 func (c *certAuthority) fetch(ctx context.Context) (apply func(ctx context.Context) error, err error) {
-	applyHostCAs, err := c.fetchCertAuthorities(types.HostCA)
+	applyHostCAs, err := c.fetchCertAuthorities(ctx, types.HostCA)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	applyUserCAs, err := c.fetchCertAuthorities(types.UserCA)
+	applyUserCAs, err := c.fetchCertAuthorities(ctx, types.UserCA)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	applyJWTSigners, err := c.fetchCertAuthorities(types.JWTSigner)
+	applyJWTSigners, err := c.fetchCertAuthorities(ctx, types.JWTSigner)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -839,8 +839,8 @@ func (c *certAuthority) fetch(ctx context.Context) (apply func(ctx context.Conte
 	}, nil
 }
 
-func (c *certAuthority) fetchCertAuthorities(caType types.CertAuthType) (apply func(ctx context.Context) error, err error) {
-	authorities, err := c.Trust.GetCertAuthorities(caType, c.watch.LoadSecrets)
+func (c *certAuthority) fetchCertAuthorities(ctx context.Context, caType types.CertAuthType) (apply func(ctx context.Context) error, err error) {
+	authorities, err := c.Trust.GetCertAuthorities(ctx, caType, c.watch.LoadSecrets)
 	if err != nil {
 		// DELETE IN: 5.1
 		//
diff --git a/lib/cgroup/cgroup.go b/lib/cgroup/cgroup.go
index 1ae2a1b85ea9d..8f3a07fd5d4cd 100644
--- a/lib/cgroup/cgroup.go
+++ b/lib/cgroup/cgroup.go
@@ -28,9 +28,7 @@ import (
 	"bufio"
 	"bytes"
 	"encoding/binary"
-	"io/ioutil"
 	"os"
-	"path"
 	"path/filepath"
 	"regexp"
 	"strconv"
@@ -83,7 +81,7 @@ func New(config *Config) (*Service, error) {
 
 	s := &Service{
 		Config:       config,
-		teleportRoot: path.Join(config.MountPath, teleportRoot, uuid.New().String()),
+		teleportRoot: filepath.Join(config.MountPath, teleportRoot, uuid.New().String()),
 	}
 
 	// Mount the cgroup2 filesystem.
@@ -93,7 +91,6 @@ func New(config *Config) (*Service, error) {
 	}
 
 	log.Debugf("Teleport session hierarchy mounted at: %v.", s.teleportRoot)
-
 	return s, nil
 }
 
@@ -115,7 +112,7 @@ func (s *Service) Close() error {
 
 // Create will create a cgroup for a given session.
 func (s *Service) Create(sessionID string) error {
-	err := os.Mkdir(path.Join(s.teleportRoot, sessionID), fileMode)
+	err := os.Mkdir(filepath.Join(s.teleportRoot, sessionID), fileMode)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -126,33 +123,32 @@ func (s *Service) Create(sessionID string) error {
 // moved to the root controller.
 func (s *Service) Remove(sessionID string) error {
 	// Read in all PIDs for the cgroup.
-	pids, err := readPids(path.Join(s.teleportRoot, sessionID, cgroupProcs))
+	pids, err := readPids(filepath.Join(s.teleportRoot, sessionID, cgroupProcs))
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	// Move all PIDs to the root controller. This has to be done before a cgroup
 	// can be removed.
-	err = writePids(path.Join(s.MountPath, cgroupProcs), pids)
+	err = writePids(filepath.Join(s.MountPath, cgroupProcs), pids)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	// The rmdir syscall is used to remove a cgroup.
-	err = unix.Rmdir(path.Join(s.teleportRoot, sessionID))
+	err = unix.Rmdir(filepath.Join(s.teleportRoot, sessionID))
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	log.Debugf("Removed cgroup for session: %v.", sessionID)
-
 	return nil
 }
 
 // Place  place a process in the cgroup for that session.
 func (s *Service) Place(sessionID string, pid int) error {
 	// Open cgroup.procs file for the cgroup.
-	filepath := path.Join(s.teleportRoot, sessionID, cgroupProcs)
+	filepath := filepath.Join(s.teleportRoot, sessionID, cgroupProcs)
 	f, err := os.OpenFile(filepath, os.O_APPEND|os.O_WRONLY, fileMode)
 	if err != nil {
 		return trace.Wrap(err)
@@ -213,7 +209,7 @@ func (s *Service) cleanupHierarchy() error {
 	var sessions []string
 
 	// Recursively look within the Teleport hierarchy for cgroups for session.
-	err := filepath.Walk(path.Join(s.teleportRoot), func(path string, info os.FileInfo, _ error) error {
+	err := filepath.Walk(filepath.Join(s.teleportRoot), func(path string, info os.FileInfo, _ error) error {
 		// Only pick up cgroup.procs files.
 		if !pattern.MatchString(path) {
 			return nil
@@ -259,7 +255,7 @@ func (s *Service) mount() error {
 
 	// Check if the Teleport root cgroup exists, if it does the cgroup filesystem
 	// is already mounted, return right away.
-	files, err := ioutil.ReadDir(s.MountPath)
+	files, err := os.ReadDir(s.MountPath)
 	if err == nil && len(files) > 0 {
 		// Create cgroup that will hold Teleport sessions.
 		err = os.MkdirAll(s.teleportRoot, fileMode)
@@ -335,7 +331,7 @@ type fileHandle struct {
 // ID returns the cgroup ID for the given session.
 func (s *Service) ID(sessionID string) (uint64, error) {
 	var fh fileHandle
-	path := path.Join(s.teleportRoot, sessionID)
+	path := filepath.Join(s.teleportRoot, sessionID)
 
 	// Call the "name_to_handle_at" syscall directly (unix.NameToHandleAt is a
 	// thin wrapper around the syscall) instead of calling the glibc wrapper.
diff --git a/lib/cgroup/cgroup_test.go b/lib/cgroup/cgroup_test.go
index 38329f48cd7cd..5f542efb1fbf2 100644
--- a/lib/cgroup/cgroup_test.go
+++ b/lib/cgroup/cgroup_test.go
@@ -20,7 +20,6 @@ limitations under the License.
 package cgroup
 
 import (
-	"io/ioutil"
 	"os"
 	"path"
 	"testing"
@@ -51,7 +50,7 @@ func (s *Suite) TestCreate(c *check.C) {
 	}
 
 	// Create temporary directory where cgroup2 hierarchy will be mounted.
-	dir, err := ioutil.TempDir("", "cgroup-test")
+	dir, err := os.MkdirTemp("", "cgroup-test")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(dir)
 
@@ -103,7 +102,7 @@ func (s *Suite) TestCleanup(c *check.C) {
 	}
 
 	// Create temporary directory where cgroup2 hierarchy will be mounted.
-	dir, err := ioutil.TempDir("", "cgroup-test")
+	dir, err := os.MkdirTemp("", "cgroup-test")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(dir)
 
diff --git a/lib/client/api.go b/lib/client/api.go
index 4c19cd4a3609e..1110d1aa5dcd2 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -17,7 +17,6 @@ limitations under the License.
 package client
 
 import (
-	"bufio"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
@@ -26,7 +25,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -57,6 +55,7 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keypaths"
 	"github.com/gravitational/teleport/lib/auth"
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/client/terminal"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
@@ -73,6 +72,7 @@ import (
 
 	"github.com/gravitational/trace"
 
+	"github.com/duo-labs/webauthn/protocol"
 	"github.com/jonboulle/clockwork"
 	"github.com/sirupsen/logrus"
 )
@@ -172,6 +172,12 @@ type Config struct {
 	// Remote host to connect
 	Host string
 
+	// SearchKeywords host to connect
+	SearchKeywords []string
+
+	// PredicateExpression host to connect
+	PredicateExpression string
+
 	// Labels represent host Labels
 	Labels map[string]string
 
@@ -349,6 +355,18 @@ type Config struct {
 
 	// Invited is a list of people invited to a session.
 	Invited []string
+
+	// DisplayParticipantRequirements is set if debug information about participants requirements
+	// should be printed in moderated sessions.
+	DisplayParticipantRequirements bool
+
+	// ExtraProxyHeaders is a collection of http headers to be included in requests to the WebProxy.
+	ExtraProxyHeaders map[string]string
+
+	// Passwordless enables passwordless authentication for TeleportClient.
+	// Affects the TeleportClient.Login and, indirectly, RetryWithRelogin
+	// functions.
+	Passwordless bool
 }
 
 // CachePolicy defines cache policy for local clients
@@ -466,7 +484,6 @@ func (p *ProfileStatus) DatabaseCertPathForCluster(clusterName string, databaseN
 // It's kept in <profile-dir>/keys/<proxy>/<user>-app/<cluster>/<name>-x509.pem
 func (p *ProfileStatus) AppCertPath(name string) string {
 	return keypaths.AppCertPath(p.Dir, p.Name, p.Username, p.Cluster, name)
-
 }
 
 // KubeConfigPath returns path to the specified kubeconfig for this profile.
@@ -516,8 +533,8 @@ func (p *ProfileStatus) AppNames() (result []string) {
 	return result
 }
 
-// RetryWithRelogin is a helper error handling method,
-// attempts to relogin and retry the function once
+// RetryWithRelogin is a helper error handling method, attempts to relogin and
+// retry the function once.
 func RetryWithRelogin(ctx context.Context, tc *TeleportClient, fn func() error) error {
 	err := fn()
 	if err == nil {
@@ -1244,7 +1261,12 @@ func (tc *TeleportClient) getTargetNodes(ctx context.Context, proxy *ProxyClient
 		retval = make([]string, 0)
 	)
 	if tc.Labels != nil && len(tc.Labels) > 0 {
-		nodes, err = proxy.FindServersByLabels(ctx, tc.Namespace, tc.Labels)
+		nodes, err = proxy.FindNodesByFilters(ctx, proto.ListResourcesRequest{
+			Namespace:           tc.Namespace,
+			Labels:              tc.Labels,
+			SearchKeywords:      tc.SearchKeywords,
+			PredicateExpression: tc.PredicateExpression,
+		})
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1504,7 +1526,7 @@ func (tc *TeleportClient) Join(ctx context.Context, mode types.SessionParticipan
 	if sessionID.Check() != nil {
 		return trace.Errorf("Invalid session ID format: %s", string(sessionID))
 	}
-	var notFoundErrorMessage = fmt.Sprintf("session '%s' not found or it has ended", sessionID)
+	notFoundErrorMessage := fmt.Sprintf("session '%s' not found or it has ended", sessionID)
 
 	// connect to proxy:
 	if !tc.Config.ProxySpecified() {
@@ -1667,7 +1689,7 @@ func PlayFile(ctx context.Context, tarFile io.Reader, sid string) error {
 	var sessionEvents []events.EventFields
 	var stream []byte
 	protoReader := events.NewProtoReader(tarFile)
-	playbackDir, err := ioutil.TempDir("", "playback")
+	playbackDir, err := os.MkdirTemp("", "playback")
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1895,17 +1917,8 @@ func isRemoteDest(name string) bool {
 	return strings.ContainsRune(name, ':')
 }
 
-// ListNodes returns a list of nodes connected to a proxy
-func (tc *TeleportClient) ListNodes(ctx context.Context) ([]types.Server, error) {
-	var err error
-	// userhost is specified? that must be labels
-	if tc.Host != "" {
-		tc.Labels, err = ParseLabelSpec(tc.Host)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
+// ListNodesWithFilters returns a list of nodes connected to a proxy
+func (tc *TeleportClient) ListNodesWithFilters(ctx context.Context) ([]types.Server, error) {
 	// connect to the proxy and ask it to return a full list of servers
 	proxyClient, err := tc.ConnectToProxy(ctx)
 	if err != nil {
@@ -1913,23 +1926,48 @@ func (tc *TeleportClient) ListNodes(ctx context.Context) ([]types.Server, error)
 	}
 	defer proxyClient.Close()
 
-	return proxyClient.FindServersByLabels(ctx, tc.Namespace, tc.Labels)
+	servers, err := proxyClient.FindNodesByFilters(ctx, proto.ListResourcesRequest{
+		Namespace:           tc.Namespace,
+		Labels:              tc.Labels,
+		SearchKeywords:      tc.SearchKeywords,
+		PredicateExpression: tc.PredicateExpression,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return servers, nil
 }
 
-// ListAppServers returns a list of application servers.
-func (tc *TeleportClient) ListAppServers(ctx context.Context) ([]types.AppServer, error) {
+// ListAppServersWithFilters returns a list of application servers.
+func (tc *TeleportClient) ListAppServersWithFilters(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.AppServer, error) {
 	proxyClient, err := tc.ConnectToProxy(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	defer proxyClient.Close()
 
-	return proxyClient.GetAppServers(ctx, tc.Namespace)
+	filter := customFilter
+	if customFilter == nil {
+		filter = &proto.ListResourcesRequest{
+			Namespace:           tc.Namespace,
+			Labels:              tc.Labels,
+			SearchKeywords:      tc.SearchKeywords,
+			PredicateExpression: tc.PredicateExpression,
+		}
+	}
+
+	servers, err := proxyClient.FindAppServersByFilters(ctx, *filter)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return servers, nil
 }
 
 // ListApps returns all registered applications.
-func (tc *TeleportClient) ListApps(ctx context.Context) ([]types.Application, error) {
-	servers, err := tc.ListAppServers(ctx)
+func (tc *TeleportClient) ListApps(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.Application, error) {
+	servers, err := tc.ListAppServersWithFilters(ctx, customFilter)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1960,19 +1998,35 @@ func (tc *TeleportClient) DeleteAppSession(ctx context.Context, sessionID string
 	return proxyClient.DeleteAppSession(ctx, sessionID)
 }
 
-// ListDatabaseServers returns all registered database proxy servers.
-func (tc *TeleportClient) ListDatabaseServers(ctx context.Context) ([]types.DatabaseServer, error) {
+// ListDatabaseServersWithFilters returns all registered database proxy servers.
+func (tc *TeleportClient) ListDatabaseServersWithFilters(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.DatabaseServer, error) {
 	proxyClient, err := tc.ConnectToProxy(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	defer proxyClient.Close()
-	return proxyClient.GetDatabaseServers(ctx, tc.Namespace)
+
+	filter := customFilter
+	if customFilter == nil {
+		filter = &proto.ListResourcesRequest{
+			Namespace:           tc.Namespace,
+			Labels:              tc.Labels,
+			SearchKeywords:      tc.SearchKeywords,
+			PredicateExpression: tc.PredicateExpression,
+		}
+	}
+
+	servers, err := proxyClient.FindDatabaseServersByFilters(ctx, *filter)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return servers, nil
 }
 
 // ListDatabases returns all registered databases.
-func (tc *TeleportClient) ListDatabases(ctx context.Context) ([]types.Database, error) {
-	servers, err := tc.ListDatabaseServers(ctx)
+func (tc *TeleportClient) ListDatabases(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.Database, error) {
+	servers, err := tc.ListDatabaseServersWithFilters(ctx, customFilter)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1991,13 +2045,15 @@ func (tc *TeleportClient) ListAllNodes(ctx context.Context) ([]types.Server, err
 	}
 	defer proxyClient.Close()
 
-	return proxyClient.FindServersByLabels(ctx, tc.Namespace, nil)
+	return proxyClient.FindNodesByFilters(ctx, proto.ListResourcesRequest{
+		Namespace: tc.Namespace,
+	})
 }
 
 // runCommandOnNodes executes a given bash command on a bunch of remote nodes.
 func (tc *TeleportClient) runCommandOnNodes(
-	ctx context.Context, siteName string, nodeAddresses []string, proxyClient *ProxyClient, command []string) error {
-
+	ctx context.Context, siteName string, nodeAddresses []string, proxyClient *ProxyClient, command []string,
+) error {
 	resultsC := make(chan error, len(nodeAddresses))
 	for _, address := range nodeAddresses {
 		go func(address string) {
@@ -2064,7 +2120,7 @@ func (tc *TeleportClient) runShell(ctx context.Context, nodeClient *NodeClient,
 	env := make(map[string]string)
 	env[teleport.EnvSSHJoinMode] = string(mode)
 	env[teleport.EnvSSHSessionReason] = tc.Config.Reason
-
+	env[teleport.EnvSSHSessionDisplayParticipantRequirements] = strconv.FormatBool(tc.Config.DisplayParticipantRequirements)
 	encoded, err := json.Marshal(&tc.Config.Invited)
 	if err != nil {
 		return trace.Wrap(err)
@@ -2380,14 +2436,8 @@ func (tc *TeleportClient) LogoutAll() error {
 	return nil
 }
 
-// Login logs the user into a Teleport cluster by talking to a Teleport proxy.
-//
-// The returned Key should typically be passed to ActivateKey in order to
-// update local agent state.
-//
-func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
-	// Ping the endpoint to see if it's up and find the type of authentication
-	// supported.
+// PingAndShowMOTD pings the Teleport Proxy and displays the Message Of The Day if it's available.
+func (tc *TeleportClient) PingAndShowMOTD(ctx context.Context) (*webclient.PingResponse, error) {
 	pr, err := tc.Ping(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -2399,6 +2449,22 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 			return nil, trace.Wrap(err)
 		}
 	}
+	return pr, nil
+}
+
+// Login logs the user into a Teleport cluster by talking to a Teleport proxy.
+//
+// If tc.Passwordless is set, then the passwordless authentication flow is used.
+//
+// The returned Key should typically be passed to ActivateKey in order to
+// update local agent state.
+func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
+	// Ping the endpoint to see if it's up and find the type of authentication
+	// supported, also show the message of the day if available.
+	pr, err := tc.PingAndShowMOTD(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
 
 	// generate a new keypair. the public key will be signed via proxy if client's
 	// password+OTP are valid
@@ -2409,13 +2475,27 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 
 	var response *auth.SSHLoginResponse
 
-	switch pr.Auth.Type {
-	case constants.Local:
+	switch authType := pr.Auth.Type; {
+	case tc.Passwordless: // Takes precedence over other methods if set.
+		// Do a few sanity checks before obeying.
+		switch {
+		case authType != constants.Local:
+			return nil, trace.BadParameter("Passwordless is only available for local authentication")
+		case pr.Auth.Webauthn == nil:
+			return nil, trace.BadParameter(
+				"Webauthn is not configured in this cluster, please contact your administrator and ask them to follow https://goteleport.com/docs/access-controls/guides/webauthn/")
+		}
+		response, err = tc.pwdlessLogin(ctx, key.Pub)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		tc.Username = response.Username
+	case authType == constants.Local:
 		response, err = tc.localLogin(ctx, pr.Auth.SecondFactor, key.Pub)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-	case constants.OIDC:
+	case authType == constants.OIDC:
 		response, err = tc.ssoLogin(ctx, pr.Auth.OIDC.Name, key.Pub, constants.OIDC)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2425,7 +2505,7 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 		if tc.localAgent != nil {
 			tc.localAgent.username = response.Username
 		}
-	case constants.SAML:
+	case authType == constants.SAML:
 		response, err = tc.ssoLogin(ctx, pr.Auth.SAML.Name, key.Pub, constants.SAML)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2435,7 +2515,7 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 		if tc.localAgent != nil {
 			tc.localAgent.username = response.Username
 		}
-	case constants.Github:
+	case authType == constants.Github:
 		response, err = tc.ssoLogin(ctx, pr.Auth.Github.Name, key.Pub, constants.Github)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2476,6 +2556,195 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 	return key, nil
 }
 
+type pwdlessPrompt struct {
+	Out io.Writer
+}
+
+func (l pwdlessPrompt) PromptPIN() (string, error) {
+	fmt.Fprintln(l.Out, "Enter your security key PIN:")
+	pwd, err := passwordFromConsoleFn()
+	if err != nil {
+		fmt.Fprintln(l.Out, err)
+		return "", trace.Wrap(err)
+	}
+	return pwd, nil
+}
+
+func (l pwdlessPrompt) PromptAdditionalTouch() error {
+	fmt.Fprintln(l.Out, "Tap your security key again to complete login")
+	return nil
+}
+
+func (tc *TeleportClient) pwdlessLogin(ctx context.Context, pubKey []byte) (*auth.SSHLoginResponse, error) {
+	webClient, webURL, err := initClient(tc.WebProxyAddr, tc.InsecureSkipVerify, loopbackPool(tc.WebProxyAddr))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	challengeJSON, err := webClient.PostJSON(
+		ctx, webClient.Endpoint("webapi", "mfa", "login", "begin"),
+		&MFAChallengeRequest{
+			Passwordless: true,
+		})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	challenge := &MFAAuthenticateChallenge{}
+	if err := json.Unmarshal(challengeJSON.Bytes(), challenge); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// Sanity check WebAuthn challenge.
+	switch {
+	case challenge.WebauthnChallenge == nil:
+		return nil, trace.BadParameter("passwordless: webauthn challenge missing")
+	case challenge.WebauthnChallenge.Response.UserVerification == protocol.VerificationDiscouraged:
+		return nil, trace.BadParameter("passwordless: user verification requirement too lax (%v)", challenge.WebauthnChallenge.Response.UserVerification)
+	}
+
+	prompt := pwdlessPrompt{Out: tc.Stderr}
+	fmt.Fprintln(tc.Stderr, "Tap your security key")
+	mfaResp, _, err := prompts.Webauthn(ctx, webURL.String(), tc.Username, challenge.WebauthnChallenge, prompt)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	loginRespJSON, err := webClient.PostJSON(
+		ctx, webClient.Endpoint("webapi", "mfa", "login", "finish"),
+		&AuthenticateSSHUserRequest{
+			User:                      "", // User carried on WebAuthn assertion.
+			WebauthnChallengeResponse: wanlib.CredentialAssertionResponseFromProto(mfaResp.GetWebauthn()),
+			PubKey:                    pubKey,
+			TTL:                       tc.KeyTTL,
+			Compatibility:             tc.CertificateFormat,
+			RouteToCluster:            tc.SiteName,
+			KubernetesCluster:         tc.KubernetesCluster,
+		})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	loginResp := &auth.SSHLoginResponse{}
+	if err := json.Unmarshal(loginRespJSON.Bytes(), loginResp); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return loginResp, nil
+}
+
+func (tc *TeleportClient) localLogin(ctx context.Context, secondFactor constants.SecondFactorType, pub []byte) (*auth.SSHLoginResponse, error) {
+	var err error
+	var response *auth.SSHLoginResponse
+
+	// TODO(awly): mfa: ideally, clients should always go through mfaLocalLogin
+	// (with a nop MFA challenge if no 2nd factor is required). That way we can
+	// deprecate the direct login endpoint.
+	switch secondFactor {
+	case constants.SecondFactorOff, constants.SecondFactorOTP:
+		response, err = tc.directLogin(ctx, secondFactor, pub)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	case constants.SecondFactorU2F, constants.SecondFactorWebauthn, constants.SecondFactorOn, constants.SecondFactorOptional:
+		response, err = tc.mfaLocalLogin(ctx, pub)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	default:
+		return nil, trace.BadParameter("unsupported second factor type: %q", secondFactor)
+	}
+
+	return response, nil
+}
+
+// directLogin asks for a password + HOTP token, makes a request to CA via proxy
+func (tc *TeleportClient) directLogin(ctx context.Context, secondFactorType constants.SecondFactorType, pub []byte) (*auth.SSHLoginResponse, error) {
+	password, err := tc.AskPassword()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// only ask for a second factor if it's enabled
+	var otpToken string
+	if secondFactorType == constants.SecondFactorOTP {
+		otpToken, err = tc.AskOTP()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	// ask the CA (via proxy) to sign our public key:
+	response, err := SSHAgentLogin(ctx, SSHLoginDirect{
+		SSHLogin: SSHLogin{
+			ProxyAddr:         tc.WebProxyAddr,
+			PubKey:            pub,
+			TTL:               tc.KeyTTL,
+			Insecure:          tc.InsecureSkipVerify,
+			Pool:              loopbackPool(tc.WebProxyAddr),
+			Compatibility:     tc.CertificateFormat,
+			RouteToCluster:    tc.SiteName,
+			KubernetesCluster: tc.KubernetesCluster,
+		},
+		User:     tc.Config.Username,
+		Password: password,
+		OTPToken: otpToken,
+	})
+
+	return response, trace.Wrap(err)
+}
+
+// mfaLocalLogin asks for a password and performs the challenge-response authentication
+func (tc *TeleportClient) mfaLocalLogin(ctx context.Context, pub []byte) (*auth.SSHLoginResponse, error) {
+	password, err := tc.AskPassword()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	response, err := SSHAgentMFALogin(ctx, SSHLoginMFA{
+		SSHLogin: SSHLogin{
+			ProxyAddr:         tc.WebProxyAddr,
+			PubKey:            pub,
+			TTL:               tc.KeyTTL,
+			Insecure:          tc.InsecureSkipVerify,
+			Pool:              loopbackPool(tc.WebProxyAddr),
+			Compatibility:     tc.CertificateFormat,
+			RouteToCluster:    tc.SiteName,
+			KubernetesCluster: tc.KubernetesCluster,
+		},
+		User:     tc.Config.Username,
+		Password: password,
+	})
+
+	return response, trace.Wrap(err)
+}
+
+// SSOLoginFunc is a function used in tests to mock SSO logins.
+type SSOLoginFunc func(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error)
+
+// samlLogin opens browser window and uses OIDC or SAML redirect cycle with browser
+func (tc *TeleportClient) ssoLogin(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error) {
+	if tc.MockSSOLogin != nil {
+		// sso login response is being mocked for testing purposes
+		return tc.MockSSOLogin(ctx, connectorID, pub, protocol)
+	}
+	// ask the CA (via proxy) to sign our public key:
+	response, err := SSHAgentSSOLogin(ctx, SSHLoginSSO{
+		SSHLogin: SSHLogin{
+			ProxyAddr:         tc.WebProxyAddr,
+			PubKey:            pub,
+			TTL:               tc.KeyTTL,
+			Insecure:          tc.InsecureSkipVerify,
+			Pool:              loopbackPool(tc.WebProxyAddr),
+			Compatibility:     tc.CertificateFormat,
+			RouteToCluster:    tc.SiteName,
+			KubernetesCluster: tc.KubernetesCluster,
+		},
+		ConnectorID: connectorID,
+		Protocol:    protocol,
+		BindAddr:    tc.BindAddr,
+		Browser:     tc.Browser,
+	})
+	return response, trace.Wrap(err)
+}
+
 // ActivateKey saves the target session cert into the local
 // keystore (and into the ssh-agent) for future use.
 func (tc *TeleportClient) ActivateKey(ctx context.Context, key *Key) error {
@@ -2534,12 +2803,13 @@ func (tc *TeleportClient) Ping(ctx context.Context) (*webclient.PingResponse, er
 	if tc.lastPing != nil {
 		return tc.lastPing, nil
 	}
-	pr, err := webclient.Ping(
-		ctx,
-		tc.WebProxyAddr,
-		tc.InsecureSkipVerify,
-		loopbackPool(tc.WebProxyAddr),
-		tc.AuthConnector)
+	pr, err := webclient.Ping(&webclient.Config{
+		Context:       ctx,
+		ProxyAddr:     tc.WebProxyAddr,
+		Insecure:      tc.InsecureSkipVerify,
+		Pool:          loopbackPool(tc.WebProxyAddr),
+		ConnectorName: tc.AuthConnector,
+		ExtraHeaders:  tc.ExtraProxyHeaders})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2547,7 +2817,7 @@ func (tc *TeleportClient) Ping(ctx context.Context) (*webclient.PingResponse, er
 	// If version checking was requested and the server advertises a minimum version.
 	if tc.CheckVersions && pr.MinClientVersion != "" {
 		if err := utils.CheckVersion(teleport.Version, pr.MinClientVersion); err != nil && trace.IsBadParameter(err) {
-			fmt.Printf(`
+			fmt.Fprintf(tc.Config.Stderr, `
 			WARNING
 			Detected potentially incompatible client and server versions.
 			Minimum client version supported by the server is %v but you are using %v.
@@ -2571,22 +2841,25 @@ func (tc *TeleportClient) Ping(ctx context.Context) (*webclient.PingResponse, er
 // confirmation from the user.
 func (tc *TeleportClient) ShowMOTD(ctx context.Context) error {
 	motd, err := webclient.GetMOTD(
-		ctx,
-		tc.WebProxyAddr,
-		tc.InsecureSkipVerify,
-		loopbackPool(tc.WebProxyAddr))
+		&webclient.Config{
+			Context:      ctx,
+			ProxyAddr:    tc.WebProxyAddr,
+			Insecure:     tc.InsecureSkipVerify,
+			Pool:         loopbackPool(tc.WebProxyAddr),
+			ExtraHeaders: tc.ExtraProxyHeaders})
+
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	if motd.Text != "" {
-		fmt.Printf("%s\nPress [ENTER] to continue.\n", motd.Text)
+		fmt.Fprintf(tc.Config.Stderr, "%s\nPress [ENTER] to continue.\n", motd.Text)
 		// We're re-using the password reader for user acknowledgment for
 		// aesthetic purposes, because we want to hide any garbage the
 		// use might enter at the prompt. Whatever the user enters will
 		// be simply discarded, and the user can still CTRL+C out if they
 		// disagree.
-		_, err := passwordFromConsole()
+		_, err := passwordFromConsoleFn()
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -2615,7 +2888,7 @@ func (tc *TeleportClient) GetTrustedCA(ctx context.Context, clusterName string)
 	}
 
 	// Get the list of host certificates that this cluster knows about.
-	return clt.GetCertAuthorities(types.HostCA, false)
+	return clt.GetCertAuthorities(ctx, types.HostCA, false)
 }
 
 // UpdateTrustedCA connects to the Auth Server and fetches all host certificates
@@ -2799,31 +3072,6 @@ func (tc *TeleportClient) applyProxySettings(proxySettings webclient.ProxySettin
 	return nil
 }
 
-func (tc *TeleportClient) localLogin(ctx context.Context, secondFactor constants.SecondFactorType, pub []byte) (*auth.SSHLoginResponse, error) {
-	var err error
-	var response *auth.SSHLoginResponse
-
-	// TODO(awly): mfa: ideally, clients should always go through mfaLocalLogin
-	// (with a nop MFA challenge if no 2nd factor is required). That way we can
-	// deprecate the direct login endpoint.
-	switch secondFactor {
-	case constants.SecondFactorOff, constants.SecondFactorOTP:
-		response, err = tc.directLogin(ctx, secondFactor, pub)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	case constants.SecondFactorU2F, constants.SecondFactorWebauthn, constants.SecondFactorOn, constants.SecondFactorOptional:
-		response, err = tc.mfaLocalLogin(ctx, pub)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	default:
-		return nil, trace.BadParameter("unsupported second factor type: %q", secondFactor)
-	}
-
-	return response, nil
-}
-
 // AddTrustedCA adds a new CA as trusted CA for this client, used in tests
 func (tc *TeleportClient) AddTrustedCA(ca types.CertAuthority) error {
 	if tc.localAgent == nil {
@@ -2857,96 +3105,6 @@ func (tc *TeleportClient) AddKey(key *Key) (*agent.AddedKey, error) {
 	return tc.localAgent.AddKey(key)
 }
 
-// directLogin asks for a password + HOTP token, makes a request to CA via proxy
-func (tc *TeleportClient) directLogin(ctx context.Context, secondFactorType constants.SecondFactorType, pub []byte) (*auth.SSHLoginResponse, error) {
-	password, err := tc.AskPassword()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// only ask for a second factor if it's enabled
-	var otpToken string
-	if secondFactorType == constants.SecondFactorOTP {
-		otpToken, err = tc.AskOTP()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	// ask the CA (via proxy) to sign our public key:
-	response, err := SSHAgentLogin(ctx, SSHLoginDirect{
-		SSHLogin: SSHLogin{
-			ProxyAddr:         tc.WebProxyAddr,
-			PubKey:            pub,
-			TTL:               tc.KeyTTL,
-			Insecure:          tc.InsecureSkipVerify,
-			Pool:              loopbackPool(tc.WebProxyAddr),
-			Compatibility:     tc.CertificateFormat,
-			RouteToCluster:    tc.SiteName,
-			KubernetesCluster: tc.KubernetesCluster,
-		},
-		User:     tc.Config.Username,
-		Password: password,
-		OTPToken: otpToken,
-	})
-
-	return response, trace.Wrap(err)
-}
-
-// SSOLoginFunc is a function used in tests to mock SSO logins.
-type SSOLoginFunc func(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error)
-
-// samlLogin opens browser window and uses OIDC or SAML redirect cycle with browser
-func (tc *TeleportClient) ssoLogin(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error) {
-	if tc.MockSSOLogin != nil {
-		// sso login response is being mocked for testing purposes
-		return tc.MockSSOLogin(ctx, connectorID, pub, protocol)
-	}
-	// ask the CA (via proxy) to sign our public key:
-	response, err := SSHAgentSSOLogin(ctx, SSHLoginSSO{
-		SSHLogin: SSHLogin{
-			ProxyAddr:         tc.WebProxyAddr,
-			PubKey:            pub,
-			TTL:               tc.KeyTTL,
-			Insecure:          tc.InsecureSkipVerify,
-			Pool:              loopbackPool(tc.WebProxyAddr),
-			Compatibility:     tc.CertificateFormat,
-			RouteToCluster:    tc.SiteName,
-			KubernetesCluster: tc.KubernetesCluster,
-		},
-		ConnectorID: connectorID,
-		Protocol:    protocol,
-		BindAddr:    tc.BindAddr,
-		Browser:     tc.Browser,
-	})
-	return response, trace.Wrap(err)
-}
-
-// mfaLocalLogin asks for a password and performs the challenge-response authentication
-func (tc *TeleportClient) mfaLocalLogin(ctx context.Context, pub []byte) (*auth.SSHLoginResponse, error) {
-	password, err := tc.AskPassword()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	response, err := SSHAgentMFALogin(ctx, SSHLoginMFA{
-		SSHLogin: SSHLogin{
-			ProxyAddr:         tc.WebProxyAddr,
-			PubKey:            pub,
-			TTL:               tc.KeyTTL,
-			Insecure:          tc.InsecureSkipVerify,
-			Pool:              loopbackPool(tc.WebProxyAddr),
-			Compatibility:     tc.CertificateFormat,
-			RouteToCluster:    tc.SiteName,
-			KubernetesCluster: tc.KubernetesCluster,
-		},
-		User:     tc.Config.Username,
-		Password: password,
-	})
-
-	return response, trace.Wrap(err)
-}
-
 // SendEvent adds a events.EventFields to the channel.
 func (tc *TeleportClient) SendEvent(ctx context.Context, e events.EventFields) error {
 	// Try and send the event to the eventsCh. If blocking, keep blocking until
@@ -2976,7 +3134,7 @@ func loopbackPool(proxyAddr string) *x509.CertPool {
 	certPool := x509.NewCertPool()
 
 	certPath := filepath.Join(defaults.DataDir, defaults.SelfSignedCertPath)
-	pemByte, err := ioutil.ReadFile(certPath)
+	pemByte, err := os.ReadFile(certPath)
 	if err != nil {
 		log.Debugf("could not open any path in: %v", certPath)
 		return nil
@@ -3034,8 +3192,8 @@ func Username() (string, error) {
 
 // AskOTP prompts the user to enter the OTP token.
 func (tc *TeleportClient) AskOTP() (token string, err error) {
-	fmt.Printf("Enter your OTP token:\n")
-	token, err = lineFromConsole()
+	fmt.Fprintf(tc.Config.Stderr, "Enter your OTP token:\n")
+	token, err = passwordFromConsoleFn()
 	if err != nil {
 		fmt.Fprintln(tc.Stderr, err)
 		return "", trace.Wrap(err)
@@ -3045,7 +3203,7 @@ func (tc *TeleportClient) AskOTP() (token string, err error) {
 
 // AskPassword prompts the user to enter the password
 func (tc *TeleportClient) AskPassword() (pwd string, err error) {
-	fmt.Printf("Enter password for Teleport user %v:\n", tc.Config.Username)
+	fmt.Fprintf(tc.Config.Stderr, "Enter password for Teleport user %v:\n", tc.Config.Username)
 	pwd, err = passwordFromConsoleFn()
 	if err != nil {
 		fmt.Fprintln(tc.Stderr, err)
@@ -3157,19 +3315,13 @@ func passwordFromConsole() (string, error) {
 	return string(bytes), err
 }
 
-// lineFromConsole reads a line from stdin
-func lineFromConsole() (string, error) {
-	bytes, _, err := bufio.NewReader(os.Stdin).ReadLine()
-	return string(bytes), err
-}
-
 // ParseLabelSpec parses a string like 'name=value,"long name"="quoted value"` into a map like
 // { "name" -> "value", "long name" -> "quoted value" }
 func ParseLabelSpec(spec string) (map[string]string, error) {
 	tokens := []string{}
-	var openQuotes = false
+	openQuotes := false
 	var tokenStart, assignCount int
-	var specLen = len(spec)
+	specLen := len(spec)
 	// tokenize the label spec:
 	for i, ch := range spec {
 		endOfToken := false
@@ -3207,6 +3359,44 @@ func ParseLabelSpec(spec string) (map[string]string, error) {
 	return labels, nil
 }
 
+// ParseSearchKeywords parses a string ie: foo,bar,"quoted value"` into a slice of
+// strings: ["foo", "bar", "quoted value"].
+// Almost a replica to ParseLabelSpec, but with few modifications such as
+// allowing a custom delimiter. Defaults to comma delimiter if not defined.
+func ParseSearchKeywords(spec string, customDelimiter rune) []string {
+	delimiter := customDelimiter
+	if customDelimiter == 0 {
+		delimiter = rune(',')
+	}
+
+	tokens := []string{}
+	openQuotes := false
+	var tokenStart int
+	specLen := len(spec)
+	// tokenize the label search:
+	for i, ch := range spec {
+		endOfToken := false
+		if i+utf8.RuneLen(ch) == specLen {
+			i += utf8.RuneLen(ch)
+			endOfToken = true
+		}
+		switch ch {
+		case '"':
+			openQuotes = !openQuotes
+		case delimiter:
+			if !openQuotes {
+				endOfToken = true
+			}
+		}
+		if endOfToken && i > tokenStart {
+			tokens = append(tokens, strings.TrimSpace(strings.Trim(spec[tokenStart:i], `"`)))
+			tokenStart = i + 1
+		}
+	}
+
+	return tokens
+}
+
 // Executes the given command on the client machine (localhost). If no command is given,
 // executes shell
 func runLocalCommand(command []string) error {
@@ -3343,7 +3533,7 @@ func playSession(sessionEvents []events.EventFields, stream []byte) error {
 		}
 	}
 
-	var errorCh = make(chan error)
+	errorCh := make(chan error)
 	player := newSessionPlayer(sessionEvents, stream, term)
 	// keys:
 	const (
diff --git a/lib/client/api_login_test.go b/lib/client/api_login_test.go
index 065b274eee9bf..e9201cc5d2b76 100644
--- a/lib/client/api_login_test.go
+++ b/lib/client/api_login_test.go
@@ -43,10 +43,11 @@ import (
 	"github.com/stretchr/testify/require"
 
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
+	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	log "github.com/sirupsen/logrus"
 )
 
-func TestTeleportClient_Login_localMFALogin(t *testing.T) {
+func TestTeleportClient_Login_local(t *testing.T) {
 	// Silence logging during this test.
 	lvl := log.GetLevel()
 	t.Cleanup(func() {
@@ -60,6 +61,7 @@ func TestTeleportClient_Login_localMFALogin(t *testing.T) {
 	sa := newStandaloneTeleport(t, clock)
 	username := sa.Username
 	password := sa.Password
+	webID := sa.WebAuthnID
 	device := sa.Device
 	otpKey := sa.OTPKey
 
@@ -110,6 +112,13 @@ func TestTeleportClient_Login_localMFALogin(t *testing.T) {
 			},
 		}, nil
 	}
+	solvePwdless := func(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error) {
+		resp, err := solveWebauthn(ctx, origin, assertion)
+		if err == nil {
+			resp.GetWebauthn().Response.UserHandle = webID
+		}
+		return resp, err
+	}
 
 	ctx := context.Background()
 	tests := []struct {
@@ -117,19 +126,27 @@ func TestTeleportClient_Login_localMFALogin(t *testing.T) {
 		secondFactor  constants.SecondFactorType
 		solveOTP      func(context.Context) (string, error)
 		solveWebauthn func(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error)
+		pwdless       bool
 	}{
 		{
-			name:          "OK OTP device login",
+			name:          "OTP device login",
 			secondFactor:  constants.SecondFactorOptional,
 			solveOTP:      solveOTP,
 			solveWebauthn: promptWebauthnNoop,
 		},
 		{
-			name:          "OK Webauthn device login",
+			name:          "WebAuthn device login",
 			secondFactor:  constants.SecondFactorOptional,
 			solveOTP:      promptOTPNoop,
 			solveWebauthn: solveWebauthn,
 		},
+		{
+			name:          "passwordless login",
+			secondFactor:  constants.SecondFactorOptional,
+			solveOTP:      promptOTPNoop,
+			solveWebauthn: solvePwdless,
+			pwdless:       true,
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -137,11 +154,12 @@ func TestTeleportClient_Login_localMFALogin(t *testing.T) {
 			defer cancel()
 
 			client.Prompts.Swap(
-				func(ctx context.Context, out io.Writer, in *prompt.ContextReader, question string) (string, error) {
+				func(ctx context.Context, out io.Writer, in prompt.Reader, question string) (string, error) {
 					return test.solveOTP(ctx)
 				},
-				func(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error) {
-					return test.solveWebauthn(ctx, origin, assertion)
+				func(ctx context.Context, origin, _ string, assertion *wanlib.CredentialAssertion, _ wancli.LoginPrompt) (*proto.MFAAuthenticateResponse, string, error) {
+					resp, err := test.solveWebauthn(ctx, origin, assertion)
+					return resp, "", err
 				},
 			)
 
@@ -155,6 +173,7 @@ func TestTeleportClient_Login_localMFALogin(t *testing.T) {
 
 			tc, err := client.NewClient(cfg)
 			require.NoError(t, err)
+			tc.Passwordless = test.pwdless
 
 			clock.Advance(30 * time.Second)
 			_, err = tc.Login(ctx)
@@ -166,6 +185,7 @@ func TestTeleportClient_Login_localMFALogin(t *testing.T) {
 type standaloneBundle struct {
 	AuthAddr, ProxyWebAddr string
 	Username, Password     string
+	WebAuthnID             []byte
 	Device                 *mocku2f.Key
 	OTPKey                 string
 	Auth, Proxy            *service.TeleportProcess
@@ -186,7 +206,7 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 
 	user, err := types.NewUser("llama")
 	require.NoError(t, err)
-	role, err := types.NewRole(user.GetName(), types.RoleSpecV5{
+	role, err := types.NewRoleV3(user.GetName(), types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{user.GetName()},
 		},
@@ -244,14 +264,18 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 	require.NoError(t, err)
 	tokenID := token.GetName()
 	res, err := authServer.CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
-		TokenID:    tokenID,
-		DeviceType: proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
+		TokenID:     tokenID,
+		DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
+		DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
 	})
 	require.NoError(t, err)
+	cc := wanlib.CredentialCreationFromProto(res.GetWebauthn())
+	webID := cc.Response.User.ID
 	device, err := mocku2f.Create()
 	require.NoError(t, err)
+	device.SetPasswordless()
 	const origin = "https://localhost"
-	ccr, err := device.SignCredentialCreation(origin, wanlib.CredentialCreationFromProto(res.GetWebauthn()))
+	ccr, err := device.SignCredentialCreation(origin, cc)
 	require.NoError(t, err)
 	_, err = authServer.ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
 		TokenID:     tokenID,
@@ -296,6 +320,7 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 		ProxyWebAddr: proxyWebAddr.String(),
 		Username:     username,
 		Password:     password,
+		WebAuthnID:   webID,
 		Device:       device,
 		OTPKey:       otpKey,
 		Auth:         authProcess,
diff --git a/lib/client/api_test.go b/lib/client/api_test.go
index dd2fde21226ba..a8e524e54ae81 100644
--- a/lib/client/api_test.go
+++ b/lib/client/api_test.go
@@ -34,8 +34,7 @@ func TestMain(m *testing.M) {
 }
 
 // register test suite
-type APITestSuite struct {
-}
+type APITestSuite struct{}
 
 // bootstrap check
 func TestClientAPI(t *testing.T) { check.TestingT(t) }
@@ -277,7 +276,6 @@ func (s *APITestSuite) TestPortsParsing(c *check.C) {
 }
 
 func (s *APITestSuite) TestDynamicPortsParsing(c *check.C) {
-
 	tests := []struct {
 		spec    []string
 		isError bool
@@ -500,3 +498,61 @@ func TestApplyProxySettings(t *testing.T) {
 		})
 	}
 }
+
+func TestParseSearchKeywords(t *testing.T) {
+	t.Parallel()
+
+	expected := [][]string{
+		{},
+		{"foo"},
+		{"foo,bar", "some phrase's", "baz=qux's", "some other  phrase", "another one"},
+		{"服务器环境=测试,操作系统类别", "Linux", "机房=华北"},
+	}
+
+	testCases := []struct {
+		name      string
+		delimiter rune
+		specs     []string
+	}{
+		{
+			name:      "with comma delimiter",
+			delimiter: ',',
+			specs: []string{
+				"",
+				"foo",
+				`"foo,bar","some phrase's",baz=qux's ,"some other  phrase"," another one  "`,
+				`"服务器环境=测试,操作系统类别", Linux , 机房=华北 `,
+			},
+		},
+		{
+			name: "with 0 value delimiter (fallback to comma)",
+			specs: []string{
+				"",
+				"foo",
+				`"foo,bar","some phrase's",baz=qux's ,"some other  phrase"," another one  "`,
+				`"服务器环境=测试,操作系统类别", Linux , 机房=华北 `,
+			},
+		},
+		{
+			name:      "with space delimiter",
+			delimiter: ' ',
+			specs: []string{
+				"",
+				"foo",
+				`foo,bar "some phrase's" baz=qux's "some other  phrase" " another one  "`,
+				`服务器环境=测试,操作系统类别 Linux  机房=华北 `,
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			for i, spec := range tc.specs {
+				m := ParseSearchKeywords(spec, tc.delimiter)
+				require.Equal(t, expected[i], m)
+			}
+		})
+	}
+}
diff --git a/lib/client/client.go b/lib/client/client.go
index 3c0a2e59340ef..56089e0475d28 100644
--- a/lib/client/client.go
+++ b/lib/client/client.go
@@ -24,7 +24,6 @@ import (
 	"encoding/json"
 	"errors"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"strconv"
@@ -598,6 +597,8 @@ func (proxy *ProxyClient) isAuthBoring(ctx context.Context) (bool, error) {
 //
 // A server is matched when ALL labels match.
 // If no labels are passed, ALL nodes are returned.
+//
+// DELETE IN 11.0.0 replaced by FindNodesByFilters.
 func (proxy *ProxyClient) FindServersByLabels(ctx context.Context, namespace string, labels map[string]string) ([]types.Server, error) {
 	if namespace == "" {
 		return nil, trace.BadParameter(auth.MissingNamespaceError)
@@ -609,14 +610,66 @@ func (proxy *ProxyClient) FindServersByLabels(ctx context.Context, namespace str
 	return auth.GetNodesWithLabels(ctx, site, namespace, labels)
 }
 
-// GetAppServers returns a list of application servers.
-func (proxy *ProxyClient) GetAppServers(ctx context.Context, namespace string) ([]types.AppServer, error) {
+// FindServersByFilters returns list of the nodes which have filters matched.
+func (proxy *ProxyClient) FindNodesByFilters(ctx context.Context, req proto.ListResourcesRequest) ([]types.Server, error) {
+	req.ResourceType = types.KindNode
+
+	site, err := proxy.CurrentClusterAccessPoint(ctx, false)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	resources, err := client.GetResourcesWithFilters(ctx, site, req)
+	if err != nil {
+		// ListResources for nodes not availalbe, provide fallback.
+		// Fallback does not support search/predicate support, so if users
+		// provide them, it does nothing.
+		//
+		// DELETE IN 11.0.0
+		if trace.IsNotImplemented(err) {
+			servers, err := proxy.FindServersByLabels(ctx, req.Namespace, req.Labels)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return servers, nil
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	servers, err := types.ResourcesWithLabels(resources).AsServers()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return servers, nil
+}
+
+// FindAppServersByFilters returns a list of application servers which have filters matched.
+func (proxy *ProxyClient) FindAppServersByFilters(ctx context.Context, req proto.ListResourcesRequest) ([]types.AppServer, error) {
+	req.ResourceType = types.KindAppServer
 	authClient, err := proxy.CurrentClusterAccessPoint(ctx, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	servers, err := authClient.GetApplicationServers(ctx, namespace)
+	resources, err := client.GetResourcesWithFilters(ctx, authClient, req)
+	if err != nil {
+		// ListResources for app servers not availalbe, provide fallback.
+		// Fallback does not support filters, so if users
+		// provide them, it does nothing.
+		//
+		// DELETE IN 11.0.0
+		if trace.IsNotImplemented(err) {
+			servers, err := authClient.GetApplicationServers(ctx, req.Namespace)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return servers, nil
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	servers, err := types.ResourcesWithLabels(resources).AsAppServers()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -663,13 +716,32 @@ func (proxy *ProxyClient) DeleteAppSession(ctx context.Context, sessionID string
 	return nil
 }
 
-// GetDatabaseServers returns all registered database proxy servers.
-func (proxy *ProxyClient) GetDatabaseServers(ctx context.Context, namespace string) ([]types.DatabaseServer, error) {
+// FindDatabaseServersByFilters returns all registered database proxy servers.
+func (proxy *ProxyClient) FindDatabaseServersByFilters(ctx context.Context, req proto.ListResourcesRequest) ([]types.DatabaseServer, error) {
+	req.ResourceType = types.KindDatabaseServer
 	authClient, err := proxy.CurrentClusterAccessPoint(ctx, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	servers, err := authClient.GetDatabaseServers(ctx, namespace)
+
+	resources, err := client.GetResourcesWithFilters(ctx, authClient, req)
+	if err != nil {
+		// ListResources for db servers not availalbe, provide fallback.
+		// Fallback does not support filters, so if users
+		// provide them, it does nothing.
+		//
+		// DELETE IN 11.0.0
+		if trace.IsNotImplemented(err) {
+			servers, err := authClient.GetDatabaseServers(ctx, req.Namespace)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			return servers, nil
+		}
+		return nil, trace.Wrap(err)
+	}
+
+	servers, err := types.ResourcesWithLabels(resources).AsDatabaseServers()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -928,7 +1000,7 @@ func (proxy *ProxyClient) dialAuthServer(ctx context.Context, clusterName string
 	if err != nil {
 		// read the stderr output from the failed SSH session and append
 		// it to the end of our own message:
-		serverErrorMsg, _ := ioutil.ReadAll(proxyErr)
+		serverErrorMsg, _ := io.ReadAll(proxyErr)
 		return nil, trace.ConnectionProblem(err, "failed connecting to node %v. %s",
 			nodeName(strings.Split(address, "@")[0]), serverErrorMsg)
 	}
@@ -1079,7 +1151,7 @@ func (proxy *ProxyClient) ConnectToNode(ctx context.Context, nodeAddress NodeAdd
 
 		// read the stderr output from the failed SSH session and append
 		// it to the end of our own message:
-		serverErrorMsg, _ := ioutil.ReadAll(proxyErr)
+		serverErrorMsg, _ := io.ReadAll(proxyErr)
 		return nil, trace.ConnectionProblem(err, "failed connecting to node %v. %s",
 			nodeName(nodeAddress.Addr), serverErrorMsg)
 	}
@@ -1250,8 +1322,8 @@ func (c *NodeClient) handleGlobalRequests(ctx context.Context, requestCh <-chan
 func newClientConn(ctx context.Context,
 	conn net.Conn,
 	nodeAddress string,
-	config *ssh.ClientConfig) (ssh.Conn, <-chan ssh.NewChannel, <-chan *ssh.Request, error) {
-
+	config *ssh.ClientConfig,
+) (ssh.Conn, <-chan ssh.NewChannel, <-chan *ssh.Request, error) {
 	type response struct {
 		conn   ssh.Conn
 		chanCh <-chan ssh.NewChannel
diff --git a/lib/client/client_test.go b/lib/client/client_test.go
index 55d25fe673980..93e9850deb44f 100644
--- a/lib/client/client_test.go
+++ b/lib/client/client_test.go
@@ -20,7 +20,6 @@ package client
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"strings"
@@ -122,7 +121,7 @@ func (s *ClientTestSuite) TestProxyConnection(c *check.C) {
 	c.Assert(err, check.IsNil)
 	clientErrCh := make(chan error, 3)
 	go func(con net.Conn) {
-		_, err := io.Copy(ioutil.Discard, con)
+		_, err := io.Copy(io.Discard, con)
 		if err != nil && strings.Contains(err.Error(), "use of closed network connection") {
 			err = nil
 		}
@@ -156,7 +155,7 @@ func (s *ClientTestSuite) TestProxyConnection(c *check.C) {
 	localCon, err = net.Dial("tcp", localSrv.Addr().String())
 	c.Assert(err, check.IsNil)
 	go func(con net.Conn) {
-		_, err := io.Copy(ioutil.Discard, con)
+		_, err := io.Copy(io.Discard, con)
 		if err != nil && strings.Contains(err.Error(), "use of closed network connection") {
 			err = nil
 		}
diff --git a/lib/client/export_test.go b/lib/client/export.go
similarity index 100%
rename from lib/client/export_test.go
rename to lib/client/export.go
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
index ea5fac1a89a4d..66adb430ef035 100644
--- a/lib/client/https_client_test.go
+++ b/lib/client/https_client_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package client
 
 import (
-	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -28,21 +27,24 @@ func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
 	client := NewInsecureWebClient()
 	// resp should be nil, so there will be no body to close.
 	//nolint:bodyclose
-	resp, err := client.Get("https://example.com")
+	resp, err := client.Get("https://fakedomain.example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "lookup fakeproxy.example.com")
 	require.Contains(t, err.Error(), "no such host")
 }
 
 func TestNewInsecureWebClientNoProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
-	t.Setenv("NO_PROXY", "example.com")
+	t.Setenv("NO_PROXY", "fakedomain.example.com")
 	client := NewInsecureWebClient()
-	resp, err := client.Get("https://example.com")
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	require.Equal(t, http.StatusOK, resp.StatusCode)
+	//nolint:bodyclose
+	resp, err := client.Get("https://fakedomain.example.com")
+	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
+	require.NotContains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "lookup fakedomain.example.com")
+	require.Contains(t, err.Error(), "no such host")
 }
 
 func TestNewClientWithPoolHTTPProxy(t *testing.T) {
@@ -50,19 +52,22 @@ func TestNewClientWithPoolHTTPProxy(t *testing.T) {
 	client := newClientWithPool(nil)
 	// resp should be nil, so there will be no body to close.
 	//nolint:bodyclose
-	resp, err := client.Get("https://example.com")
+	resp, err := client.Get("https://fakedomain.example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "lookup fakeproxy.example.com")
 	require.Contains(t, err.Error(), "no such host")
 }
 
 func TestNewClientWithPoolNoProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
-	t.Setenv("NO_PROXY", "example.com")
+	t.Setenv("NO_PROXY", "fakedomain.example.com")
 	client := newClientWithPool(nil)
-	resp, err := client.Get("https://example.com")
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	require.Equal(t, http.StatusOK, resp.StatusCode)
+	//nolint:bodyclose
+	resp, err := client.Get("https://fakedomain.example.com")
+	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
+	require.NotContains(t, err.Error(), "proxyconnect")
+	require.Contains(t, err.Error(), "lookup fakedomain.example.com")
+	require.Contains(t, err.Error(), "no such host")
 }
diff --git a/lib/client/identityfile/identity.go b/lib/client/identityfile/identity.go
index 854546bb4f0a6..9cdf7d0aa3bb1 100644
--- a/lib/client/identityfile/identity.go
+++ b/lib/client/identityfile/identity.go
@@ -20,7 +20,6 @@ package identityfile
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -159,12 +158,12 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 			return nil, trace.Wrap(err)
 		}
 
-		err = ioutil.WriteFile(certPath, cfg.Key.Cert, identityfile.FilePermissions)
+		err = os.WriteFile(certPath, cfg.Key.Cert, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		err = ioutil.WriteFile(keyPath, cfg.Key.Priv, identityfile.FilePermissions)
+		err = os.WriteFile(keyPath, cfg.Key.Priv, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -186,12 +185,12 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 			return nil, trace.Wrap(err)
 		}
 
-		err = ioutil.WriteFile(certPath, cfg.Key.TLSCert, identityfile.FilePermissions)
+		err = os.WriteFile(certPath, cfg.Key.TLSCert, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		err = ioutil.WriteFile(keyPath, cfg.Key.Priv, identityfile.FilePermissions)
+		err = os.WriteFile(keyPath, cfg.Key.Priv, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -201,7 +200,7 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 				caCerts = append(caCerts, cert...)
 			}
 		}
-		err = ioutil.WriteFile(casPath, caCerts, identityfile.FilePermissions)
+		err = os.WriteFile(casPath, caCerts, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -215,7 +214,7 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 		if err := checkOverwrite(cfg.OverwriteDestination, filesWritten...); err != nil {
 			return nil, trace.Wrap(err)
 		}
-		err = ioutil.WriteFile(certPath, append(cfg.Key.TLSCert, cfg.Key.Priv...), identityfile.FilePermissions)
+		err = os.WriteFile(certPath, append(cfg.Key.TLSCert, cfg.Key.Priv...), identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -225,7 +224,7 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 				caCerts = append(caCerts, cert...)
 			}
 		}
-		err = ioutil.WriteFile(casPath, caCerts, identityfile.FilePermissions)
+		err = os.WriteFile(casPath, caCerts, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/client/identityfile/identity_test.go b/lib/client/identityfile/identity_test.go
index 50a37e97561e1..42953743cc47d 100644
--- a/lib/client/identityfile/identity_test.go
+++ b/lib/client/identityfile/identity_test.go
@@ -18,7 +18,7 @@ import (
 	"bytes"
 	"crypto/rsa"
 	"crypto/x509/pkix"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -128,12 +128,12 @@ func TestWrite(t *testing.T) {
 	require.NoError(t, err)
 
 	// key is OK:
-	out, err := ioutil.ReadFile(cfg.OutputPath)
+	out, err := os.ReadFile(cfg.OutputPath)
 	require.NoError(t, err)
 	require.Equal(t, string(out), string(key.Priv))
 
 	// cert is OK:
-	out, err = ioutil.ReadFile(keypaths.IdentitySSHCertPath(cfg.OutputPath))
+	out, err = os.ReadFile(keypaths.IdentitySSHCertPath(cfg.OutputPath))
 	require.NoError(t, err)
 	require.Equal(t, string(out), string(key.Cert))
 
@@ -144,7 +144,7 @@ func TestWrite(t *testing.T) {
 	require.NoError(t, err)
 
 	// key+cert are OK:
-	out, err = ioutil.ReadFile(cfg.OutputPath)
+	out, err = os.ReadFile(cfg.OutputPath)
 	require.NoError(t, err)
 
 	wantArr := [][]byte{
diff --git a/lib/client/keyagent_test.go b/lib/client/keyagent_test.go
index c2c67e97c82c9..a6df53f40ad22 100644
--- a/lib/client/keyagent_test.go
+++ b/lib/client/keyagent_test.go
@@ -19,7 +19,6 @@ package client
 import (
 	"bytes"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -549,7 +548,7 @@ func (s *KeyAgentTestSuite) makeKey(username string, allowedLogins []string, ttl
 func startDebugAgent(t *testing.T) error {
 	// Create own tmp dir instead of using t.TmpDir
 	// because net.Listen("unix", path) has dir path length limitation
-	tempDir, err := ioutil.TempDir("", "teleport-test")
+	tempDir, err := os.MkdirTemp("", "teleport-test")
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		os.RemoveAll(tempDir)
diff --git a/lib/client/keystore.go b/lib/client/keystore.go
index fb1d59051748c..868bda99381e4 100644
--- a/lib/client/keystore.go
+++ b/lib/client/keystore.go
@@ -22,7 +22,6 @@ import (
 	"fmt"
 	"io"
 	osfs "io/fs"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -50,6 +49,10 @@ const (
 	// keyFilePerms is the default permissions applied to key files (.cert, .key, pub)
 	// under ~/.tsh
 	keyFilePerms os.FileMode = 0600
+
+	// tshConfigFileName is the name of the directory containing the
+	// tsh config file.
+	tshConfigFileName = "config"
 )
 
 // LocalKeyStore interface allows for different storage backends for tsh to
@@ -180,7 +183,7 @@ func (fs *FSLocalKeyStore) writeBytes(bytes []byte, fp string) error {
 		fs.log.Error(err)
 		return trace.ConvertSystemError(err)
 	}
-	err := ioutil.WriteFile(fp, bytes, keyFilePerms)
+	err := os.WriteFile(fp, bytes, keyFilePerms)
 	if err != nil {
 		fs.log.Error(err)
 	}
@@ -223,9 +226,27 @@ func (fs *FSLocalKeyStore) DeleteUserCerts(idx KeyIndex, opts ...CertOption) err
 
 // DeleteKeys removes all session keys.
 func (fs *FSLocalKeyStore) DeleteKeys() error {
-	if err := os.RemoveAll(fs.KeyDir); err != nil {
+
+	files, err := os.ReadDir(fs.KeyDir)
+	if err != nil {
 		return trace.ConvertSystemError(err)
 	}
+	for _, file := range files {
+		if file.IsDir() && file.Name() == tshConfigFileName {
+			continue
+		}
+		if file.IsDir() {
+			err := os.RemoveAll(filepath.Join(fs.KeyDir, file.Name()))
+			if err != nil {
+				return trace.ConvertSystemError(err)
+			}
+			continue
+		}
+		err := os.Remove(filepath.Join(fs.KeyDir, file.Name()))
+		if err != nil {
+			return trace.ConvertSystemError(err)
+		}
+	}
 	return nil
 }
 
@@ -238,22 +259,22 @@ func (fs *FSLocalKeyStore) GetKey(idx KeyIndex, opts ...CertOption) (*Key, error
 		}
 	}
 
-	if _, err := ioutil.ReadDir(fs.KeyDir); err != nil && trace.IsNotFound(err) {
+	if _, err := os.ReadDir(fs.KeyDir); err != nil && trace.IsNotFound(err) {
 		return nil, trace.Wrap(err, "no session keys for %+v", idx)
 	}
 
-	priv, err := ioutil.ReadFile(fs.UserKeyPath(idx))
+	priv, err := os.ReadFile(fs.UserKeyPath(idx))
 	if err != nil {
 		fs.log.Error(err)
 		return nil, trace.ConvertSystemError(err)
 	}
-	pub, err := ioutil.ReadFile(fs.sshCAsPath(idx))
+	pub, err := os.ReadFile(fs.sshCAsPath(idx))
 	if err != nil {
 		fs.log.Error(err)
 		return nil, trace.ConvertSystemError(err)
 	}
 	tlsCertFile := fs.tlsCertPath(idx)
-	tlsCert, err := ioutil.ReadFile(tlsCertFile)
+	tlsCert, err := os.ReadFile(tlsCertFile)
 	if err != nil {
 		fs.log.Error(err)
 		return nil, trace.ConvertSystemError(err)
@@ -309,14 +330,14 @@ func (fs *FSLocalKeyStore) updateKeyWithCerts(o CertOption, key *Key) error {
 
 	if info.IsDir() {
 		certDataMap := map[string][]byte{}
-		certFiles, err := ioutil.ReadDir(certPath)
+		certFiles, err := os.ReadDir(certPath)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
 		for _, certFile := range certFiles {
 			name := keypaths.TrimCertPathSuffix(certFile.Name())
 			if isCert := name != certFile.Name(); isCert {
-				data, err := ioutil.ReadFile(filepath.Join(certPath, certFile.Name()))
+				data, err := os.ReadFile(filepath.Join(certPath, certFile.Name()))
 				if err != nil {
 					return trace.ConvertSystemError(err)
 				}
@@ -326,7 +347,7 @@ func (fs *FSLocalKeyStore) updateKeyWithCerts(o CertOption, key *Key) error {
 		return o.updateKeyWithMap(key, certDataMap)
 	}
 
-	certBytes, err := ioutil.ReadFile(certPath)
+	certBytes, err := os.ReadFile(certPath)
 	if err != nil {
 		return trace.ConvertSystemError(err)
 	}
@@ -616,7 +637,7 @@ func matchesWildcard(hostname, pattern string) bool {
 
 // GetKnownHostKeys returns all known public keys from `known_hosts`.
 func (fs *fsLocalNonSessionKeyStore) GetKnownHostKeys(hostname string) ([]ssh.PublicKey, error) {
-	bytes, err := ioutil.ReadFile(fs.knownHostsPath())
+	bytes, err := os.ReadFile(fs.knownHostsPath())
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, nil
@@ -723,7 +744,7 @@ func (fs *fsLocalNonSessionKeyStore) GetTrustedCertsPEM(proxyHost string) ([][]b
 			return nil
 		}
 
-		data, err := ioutil.ReadFile(path)
+		data, err := os.ReadFile(path)
 		for len(data) > 0 {
 			if err != nil {
 				return trace.Wrap(err)
diff --git a/lib/client/keystore_test.go b/lib/client/keystore_test.go
index c6e26402464b5..332641614be8d 100644
--- a/lib/client/keystore_test.go
+++ b/lib/client/keystore_test.go
@@ -21,7 +21,6 @@ import (
 	"crypto/rsa"
 	"crypto/x509/pkix"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -402,6 +401,19 @@ func TestAddKey_withoutSSHCert(t *testing.T) {
 	require.Len(t, keyCopy.DBTLSCerts, 1)
 }
 
+func TestConfigDirNotDeleted(t *testing.T) {
+	s, cleanup := newTest(t)
+	t.Cleanup(cleanup)
+	idx := KeyIndex{"host.a", "bob", "root"}
+	s.store.AddKey(s.makeSignedKey(t, idx, false))
+	configPath := filepath.Join(s.storeDir, "config")
+	require.NoError(t, os.Mkdir(configPath, 0700))
+	require.NoError(t, s.store.DeleteKeys())
+	require.DirExists(t, configPath)
+
+	require.NoDirExists(t, filepath.Join(s.storeDir, "keys"))
+}
+
 type keyStoreTest struct {
 	storeDir  string
 	store     *FSLocalKeyStore
@@ -493,7 +505,7 @@ func newSelfSignedCA(privateKey []byte) (*tlsca.CertAuthority, auth.TrustedCerts
 }
 
 func newTest(t *testing.T) (keyStoreTest, func()) {
-	dir, err := ioutil.TempDir("", "teleport-keystore")
+	dir, err := os.MkdirTemp("", "teleport-keystore")
 	require.NoError(t, err)
 
 	store, err := NewFSLocalKeyStore(dir)
diff --git a/lib/client/mfa.go b/lib/client/mfa.go
index 4f8e999c7965a..42d2ac5d957fe 100644
--- a/lib/client/mfa.go
+++ b/lib/client/mfa.go
@@ -18,6 +18,7 @@ package client
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -33,8 +34,12 @@ import (
 )
 
 type (
-	OTPPrompt func(ctx context.Context, out io.Writer, in *prompt.ContextReader, question string) (string, error)
-	WebPrompt func(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error)
+	OTPPrompt func(ctx context.Context, out io.Writer, in prompt.Reader, question string) (string, error)
+	WebPrompt func(
+		ctx context.Context,
+		origin, user string,
+		assertion *wanlib.CredentialAssertion,
+		prompt wancli.LoginPrompt) (*proto.MFAAuthenticateResponse, string, error)
 )
 
 // PlatformPrompt groups functions that prompt the user for inputs.
@@ -59,13 +64,29 @@ func (pp *PlatformPrompt) Swap(otp OTPPrompt, web WebPrompt) {
 
 var prompts = (&PlatformPrompt{}).Reset()
 
+type noopPrompt struct{}
+
+func (p noopPrompt) PromptPIN() (string, error) {
+	// TODO(codingllama): Revisit? There may be authenticators out there that disagree.
+	// The main issue with PIN prompts in MFA is that prompts.OTP hijacks Stdin,
+	// so we'd have to make that into a password read and redirect it into either
+	// an OTP (not sensitive) or a PIN (sensitive).
+	return "", errors.New("PIN not supported for MFA")
+}
+
+func (p noopPrompt) PromptAdditionalTouch() error {
+	return errors.New("additional touches not supported for MFA")
+}
+
 // PromptMFAChallenge prompts the user to complete MFA authentication
 // challenges.
 //
 // If promptDevicePrefix is set, it will be printed in prompts before "security
 // key" or "device". This is used to emphasize between different kinds of
 // devices, like registered vs new.
-func PromptMFAChallenge(ctx context.Context, proxyAddr string, c *proto.MFAAuthenticateChallenge, promptDevicePrefix string, quiet bool) (*proto.MFAAuthenticateResponse, error) {
+func PromptMFAChallenge(
+	ctx context.Context,
+	proxyAddr string, c *proto.MFAAuthenticateChallenge, promptDevicePrefix string, quiet bool) (*proto.MFAAuthenticateResponse, error) {
 	// Is there a challenge present?
 	if c.TOTP == nil && c.WebauthnChallenge == nil {
 		return &proto.MFAAuthenticateResponse{}, nil
@@ -148,7 +169,9 @@ func PromptMFAChallenge(ctx context.Context, proxyAddr string, c *proto.MFAAuthe
 		go func() {
 			defer wg.Done()
 			log.Debugf("WebAuthn: prompting devices with origin %q", origin)
-			resp, err := prompts.Webauthn(ctx, origin, wanlib.CredentialAssertionFromProto(c.WebauthnChallenge))
+			const user = ""       // No ambiguity in MFA prompts.
+			var prompt noopPrompt // No PINs or additional touches required for MFA.
+			resp, _, err := prompts.Webauthn(ctx, origin, user, wanlib.CredentialAssertionFromProto(c.WebauthnChallenge), prompt)
 			respC <- response{kind: "WEBAUTHN", resp: resp, err: err}
 		}()
 	}
diff --git a/lib/client/weblogin.go b/lib/client/weblogin.go
index fa432f142fe6a..6148704369663 100644
--- a/lib/client/weblogin.go
+++ b/lib/client/weblogin.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"net"
 	"net/url"
+	"os"
 	"os/exec"
 	"runtime"
 	"time"
@@ -86,6 +87,8 @@ type SSOLoginConsoleResponse struct {
 type MFAChallengeRequest struct {
 	User string `json:"user"`
 	Pass string `json:"pass"`
+	// Passwordless explicitly requests a passwordless/usernameless challenge.
+	Passwordless bool `json:"passwordless"`
 }
 
 // CreateSSHCertReq are passed by web client
@@ -234,7 +237,7 @@ func initClient(proxyAddr string, insecure bool, pool *x509.CertPool) (*WebClien
 
 	if insecure {
 		// Skip https cert verification, print a warning that this is insecure.
-		fmt.Printf("WARNING: You are using insecure connection to SSH proxy %v\n", proxyAddr)
+		fmt.Fprintf(os.Stderr, "WARNING: You are using insecure connection to SSH proxy %v\n", proxyAddr)
 		opts = append(opts, roundtrip.HTTPClient(NewInsecureWebClient()))
 	} else if pool != nil {
 		// use custom set of trusted CAs
@@ -289,17 +292,17 @@ func SSHAgentSSOLogin(ctx context.Context, login SSHLoginSSO) (*auth.SSHLoginRes
 	}
 	if execCmd != nil {
 		if err := execCmd.Start(); err != nil {
-			fmt.Printf("Failed to open a browser window for login: %v\n", err)
+			fmt.Fprintf(os.Stderr, "Failed to open a browser window for login: %v\n", err)
 		}
 	}
 
 	// Print the URL to the screen, in case the command that launches the browser did not run.
 	// If Browser is set to the special string teleport.BrowserNone, no browser will be opened.
 	if login.Browser == teleport.BrowserNone {
-		fmt.Printf("Use the following URL to authenticate:\n %v\n", clickableURL)
+		fmt.Fprintf(os.Stderr, "Use the following URL to authenticate:\n %v\n", clickableURL)
 	} else {
-		fmt.Printf("If browser window does not open automatically, open it by ")
-		fmt.Printf("clicking on the link:\n %v\n", clickableURL)
+		fmt.Fprintf(os.Stderr, "If browser window does not open automatically, open it by ")
+		fmt.Fprintf(os.Stderr, "clicking on the link:\n %v\n", clickableURL)
 	}
 
 	select {
@@ -431,12 +434,5 @@ func HostCredentials(ctx context.Context, proxyAddr string, insecure bool, req t
 		return nil, trace.Wrap(err)
 	}
 
-	// If we got certs, we're done, however, we may be talking to a Teleport 9 or earlier server,
-	// which still sends back the legacy JSON format.
-	if len(certs.SSH) > 0 && len(certs.TLS) > 0 {
-		return &certs, nil
-	}
-
-	// DELETE IN 10.0.0 (zmb3)
-	return auth.UnmarshalLegacyCerts(resp.Bytes())
+	return &certs, nil
 }
diff --git a/lib/client/weblogin_test.go b/lib/client/weblogin_test.go
index ed50896d937d6..571e1014907ff 100644
--- a/lib/client/weblogin_test.go
+++ b/lib/client/weblogin_test.go
@@ -24,8 +24,8 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
 
 	"github.com/stretchr/testify/require"
 )
@@ -47,7 +47,7 @@ func TestPlainHttpFallback(t *testing.T) {
 				}
 				w.Header().Set("Content-Type", "application/json")
 				w.WriteHeader(http.StatusOK)
-				json.NewEncoder(w).Encode(auth.LegacyCerts{})
+				json.NewEncoder(w).Encode(proto.Certs{})
 			},
 			actionUnderTest: func(ctx context.Context, addr string, insecure bool) error {
 				_, err := HostCredentials(ctx, addr, insecure, types.RegisterUsingTokenRequest{})
diff --git a/lib/config/configuration.go b/lib/config/configuration.go
index 28ca24f86ce90..e1ef67529bae7 100644
--- a/lib/config/configuration.go
+++ b/lib/config/configuration.go
@@ -24,7 +24,6 @@ import (
 	"bufio"
 	"crypto/x509"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -34,6 +33,8 @@ import (
 	"time"
 	"unicode"
 
+	stdlog "log"
+
 	"golang.org/x/crypto/ssh"
 
 	"github.com/go-ldap/ldap/v3"
@@ -289,18 +290,10 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error {
 	}
 
 	// apply logger settings
-	logger := utils.NewLogger()
-	err = applyLogConfig(fc.Logger, logger)
+	err = applyLogConfig(fc.Logger, cfg)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	cfg.Log = logger
-
-	// Apply logging configuration for the global logger instance
-	// DELETE this when global logger instance is no longer in use.
-	//
-	// Logging configuration has already been validated above
-	_ = applyLogConfig(fc.Logger, log.StandardLogger())
 
 	if fc.CachePolicy.TTL != "" {
 		log.Warnf("cache.ttl config option is deprecated and will be ignored, caches no longer attempt to anticipate resource expiration.")
@@ -427,14 +420,18 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error {
 	return nil
 }
 
-func applyLogConfig(loggerConfig Log, logger *log.Logger) error {
+func applyLogConfig(loggerConfig Log, cfg *service.Config) error {
+	logger := log.StandardLogger()
+
 	switch loggerConfig.Output {
 	case "":
 		break // not set
 	case "stderr", "error", "2":
 		logger.SetOutput(os.Stderr)
+		cfg.Console = io.Discard // disable console printing
 	case "stdout", "out", "1":
 		logger.SetOutput(os.Stdout)
+		cfg.Console = io.Discard // disable console printing
 	case teleport.Syslog:
 		err := utils.SwitchLoggerToSyslog(logger)
 		if err != nil {
@@ -487,10 +484,13 @@ func applyLogConfig(loggerConfig Log, logger *log.Logger) error {
 		}
 
 		logger.SetFormatter(formatter)
+		stdlog.SetOutput(io.Discard) // disable the standard logger used by external dependencies
+		stdlog.SetFlags(0)
 	default:
 		return trace.BadParameter("unsupported log output format : %q", loggerConfig.Format.Output)
 	}
 
+	cfg.Log = logger
 	return nil
 }
 
@@ -547,6 +547,9 @@ func applyAuthConfig(fc *FileConfig, cfg *service.Config) error {
 		if err != nil {
 			return trace.Wrap(err)
 		}
+	}
+
+	if fc.Auth.MessageOfTheDay != "" {
 		cfg.Auth.Preference.SetMessageOfTheDay(fc.Auth.MessageOfTheDay)
 	}
 
@@ -1274,15 +1277,6 @@ func applyMetricsConfig(fc *FileConfig, cfg *service.Config) error {
 func applyWindowsDesktopConfig(fc *FileConfig, cfg *service.Config) error {
 	cfg.WindowsDesktop.Enabled = true
 
-	// Support for reading an LDAP password from a file was dropped for Teleport 9.
-	// Check if this old option is still set and issue a clear error for one major version.
-	// DELETE IN 10.0 (zmb3)
-	if len(fc.WindowsDesktop.LDAP.PasswordFile) > 0 {
-		return trace.BadParameter("Support for password_file was deprecated in Teleport 9 " +
-			"in favor of certificate-based authentication. Remove the password_file field from " +
-			"teleport.yaml to fix this error.")
-	}
-
 	if fc.WindowsDesktop.ListenAddress != "" {
 		listenAddr, err := utils.ParseHostPortAddr(fc.WindowsDesktop.ListenAddress, int(defaults.WindowsDesktopListenPort))
 		if err != nil {
@@ -1749,7 +1743,7 @@ func Configure(clf *CommandLineFlags, cfg *service.Config) error {
 
 	// apply --debug flag to config:
 	if clf.Debug {
-		cfg.Console = ioutil.Discard
+		cfg.Console = io.Discard
 		cfg.Debug = clf.Debug
 	}
 
diff --git a/lib/config/configuration_test.go b/lib/config/configuration_test.go
index 45ac88b006ad3..71d8ed81f4c72 100644
--- a/lib/config/configuration_test.go
+++ b/lib/config/configuration_test.go
@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"encoding/base64"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"path"
@@ -65,7 +64,7 @@ var testConfigs testConfigFiles
 func writeTestConfigs() error {
 	var err error
 
-	testConfigs.tempDir, err = ioutil.TempDir("", "teleport-config")
+	testConfigs.tempDir, err = os.MkdirTemp("", "teleport-config")
 	if err != nil {
 		return err
 	}
@@ -669,7 +668,7 @@ func TestApplyConfig(t *testing.T) {
 
 	require.Equal(t, "tcp://127.0.0.1:3000", cfg.DiagnosticAddr.FullAddress())
 
-	u2fCAFromFile, err := ioutil.ReadFile("testdata/u2f_attestation_ca.pem")
+	u2fCAFromFile, err := os.ReadFile("testdata/u2f_attestation_ca.pem")
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(cfg.Auth.Preference, &types.AuthPreferenceV2{
 		Kind:    types.KindClusterAuthPreference,
@@ -1572,13 +1571,6 @@ func TestWindowsDesktopService(t *testing.T) {
 				}
 			},
 		},
-		{
-			desc:        "NOK - uses deprecated password_file field",
-			expectError: require.Error,
-			mutate: func(fc *FileConfig) {
-				fc.WindowsDesktop.LDAP.PasswordFile = "/path/to/some/file"
-			},
-		},
 	} {
 		t.Run(test.desc, func(t *testing.T) {
 			fc := &FileConfig{}
diff --git a/lib/config/fileconf.go b/lib/config/fileconf.go
index 21f388a161e3d..e087351fb0c1a 100644
--- a/lib/config/fileconf.go
+++ b/lib/config/fileconf.go
@@ -22,7 +22,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -111,7 +110,7 @@ func ReadFromString(configString string) (*FileConfig, error) {
 // ReadConfig reads Teleport configuration from reader in YAML format
 func ReadConfig(reader io.Reader) (*FileConfig, error) {
 	// read & parse YAML config:
-	bytes, err := ioutil.ReadAll(reader)
+	bytes, err := io.ReadAll(reader)
 	if err != nil {
 		return nil, trace.Wrap(err, "failed reading Teleport configuration")
 	}
@@ -794,7 +793,7 @@ func getAttestationPEM(certOrPath string) (string, error) {
 	}
 
 	// Try reading as a file and parsing that.
-	data, err := ioutil.ReadFile(certOrPath)
+	data, err := os.ReadFile(certOrPath)
 	if err != nil {
 		// Don't use trace in order to keep a clean error message.
 		return "", fmt.Errorf("%q is not a valid x509 certificate (%v) and can't be read as a file (%v)", certOrPath, parseErr, err)
@@ -1478,12 +1477,4 @@ type LDAPConfig struct {
 	InsecureSkipVerify bool `yaml:"insecure_skip_verify"`
 	// DEREncodedCAFile is the filepath to an optional DER encoded CA cert to be used for verification (if InsecureSkipVerify is set to false).
 	DEREncodedCAFile string `yaml:"der_ca_file,omitempty"`
-
-	// PasswordFile was used in Teleport 8 before we supported client certificates
-	// for LDAP authentication. Support for LDAP passwords was removed for Teleport 9
-	// and this field remains only to issue a warning to users who are upgrading to
-	// Teleport 9.
-	//
-	// TODO(zmb3) DELETE IN 10.0
-	PasswordFile string `yaml:"password_file"`
 }
diff --git a/lib/datalog/access_test.go b/lib/datalog/access_test.go
index 5b0a0c584ae54..12f89bee44755 100644
--- a/lib/datalog/access_test.go
+++ b/lib/datalog/access_test.go
@@ -93,7 +93,7 @@ func createUser(name string, roles []string, traits map[string][]string) (types.
 }
 
 func createRole(name string, allowLogins []string, denyLogins []string, allowLabels types.Labels, denyLabels types.Labels) (types.Role, error) {
-	role, err := types.NewRole(name, types.RoleSpecV5{
+	role, err := types.NewRoleV3(name, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     allowLogins,
 			NodeLabels: allowLabels,
diff --git a/lib/defaults/defaults.go b/lib/defaults/defaults.go
index d65999522c772..88539fa023c4e 100644
--- a/lib/defaults/defaults.go
+++ b/lib/defaults/defaults.go
@@ -468,6 +468,17 @@ const (
 	LimiterMaxConcurrentSignatures = 10
 )
 
+// Default rate limits for unauthenticated passwordless endpoints.
+const (
+	// LimiterPasswordlessPeriod is the default period for passwordless limiters.
+	LimiterPasswordlessPeriod = 1 * time.Minute
+	// LimiterPasswordlessAverage is the default average for passwordless
+	// limiters.
+	LimiterPasswordlessAverage = 10
+	// LimiterPasswordlessBurst is the default burst for passwordless limiters.
+	LimiterPasswordlessBurst = 20
+)
+
 const (
 	// HostCertCacheSize is the number of host certificates to cache at any moment.
 	HostCertCacheSize = 4000
diff --git a/lib/events/api.go b/lib/events/api.go
index e4f7b7ad503f1..8a5cf8e9f61a5 100644
--- a/lib/events/api.go
+++ b/lib/events/api.go
@@ -502,6 +502,9 @@ const (
 	// DesktopClipboardSendEvent is emitted when local clipboard data
 	// is sent to Teleport.
 	DesktopClipboardSendEvent = "desktop.clipboard.send"
+
+	// UnknownEvent is any event received that isn't recognized as any other event type.
+	UnknownEvent = apievents.UnknownEvent
 )
 
 const (
diff --git a/lib/events/auditlog_test.go b/lib/events/auditlog_test.go
index c337baffefdcb..5fcd30417e377 100644
--- a/lib/events/auditlog_test.go
+++ b/lib/events/auditlog_test.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -331,7 +330,7 @@ func (a *AuditTestSuite) TestBasicLogging(c *check.C) {
 	c.Assert(alog.Close(), check.IsNil)
 
 	// read back what's been written:
-	bytes, err := ioutil.ReadFile(logfile)
+	bytes, err := os.ReadFile(logfile)
 	c.Assert(err, check.IsNil)
 	c.Assert(string(bytes), check.Equals,
 		fmt.Sprintf("{\"apples?\":\"yes\",\"event\":\"user.joined\",\"time\":\"%s\",\"uid\":\"%s\"}\n",
@@ -371,7 +370,7 @@ func (a *AuditTestSuite) TestLogRotation(c *check.C) {
 		c.Assert(dt, check.Equals, time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location()))
 
 		// read back what's been written:
-		bytes, err := ioutil.ReadFile(logfile)
+		bytes, err := os.ReadFile(logfile)
 		c.Assert(err, check.IsNil)
 		contents, err := json.Marshal(event)
 		contents = append(contents, '\n')
@@ -379,7 +378,7 @@ func (a *AuditTestSuite) TestLogRotation(c *check.C) {
 		c.Assert(string(bytes), check.Equals, string(contents))
 
 		// read back the contents using symlink
-		bytes, err = ioutil.ReadFile(filepath.Join(alog.localLog.SymlinkDir, SymlinkFilename))
+		bytes, err = os.ReadFile(filepath.Join(alog.localLog.SymlinkDir, SymlinkFilename))
 		c.Assert(err, check.IsNil)
 		c.Assert(string(bytes), check.Equals, string(contents))
 
@@ -432,7 +431,7 @@ func (a *AuditTestSuite) TestLegacyHandler(c *check.C) {
 	// Download the session in the old format
 	ctx := context.TODO()
 
-	tarball, err := ioutil.TempFile("", "teleport-legacy")
+	tarball, err := os.CreateTemp("", "teleport-legacy")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(tarball.Name())
 
diff --git a/lib/events/codes.go b/lib/events/codes.go
index 7c03d71d9a8da..9d0032d94c5b2 100644
--- a/lib/events/codes.go
+++ b/lib/events/codes.go
@@ -16,6 +16,8 @@ limitations under the License.
 
 package events
 
+import apievents "github.com/gravitational/teleport/api/types/events"
+
 // Event describes an audit log event.
 type Event struct {
 	// Name is the event name.
@@ -500,4 +502,7 @@ const (
 	// RenewableCertificateGenerationMismatchCode is the renewable cert
 	// generation mismatch code.
 	RenewableCertificateGenerationMismatchCode = "TCB00W"
+
+	// UnknownCode is used when an event of unknown type is encountered.
+	UnknownCode = apievents.UnknownCode
 )
diff --git a/lib/events/complete.go b/lib/events/complete.go
index 3b8a2b050f9d1..c7594c61521c3 100644
--- a/lib/events/complete.go
+++ b/lib/events/complete.go
@@ -18,12 +18,11 @@ package events
 
 import (
 	"context"
+	"fmt"
 	"time"
 
 	"github.com/gravitational/teleport"
-	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types/events"
-	apievents "github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
@@ -137,28 +136,43 @@ func (u *UploadCompleter) CheckUploads(ctx context.Context) error {
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		if len(parts) == 0 {
-			continue
-		}
-		u.log.Debugf("Upload %v grace period is over. Trying to complete.", upload)
+
+		u.log.Debugf("Upload %v grace period is over. Trying to complete.", upload.ID)
 		if err := u.cfg.Uploader.CompleteUpload(ctx, upload, parts); err != nil {
 			return trace.Wrap(err)
 		}
 		u.log.Debugf("Completed upload %v.", upload)
 		completed++
-		uploadData := u.cfg.Uploader.GetUploadMetadata(upload.SessionID)
-		err = u.ensureSessionEndEvent(ctx, uploadData)
-		if err != nil {
-			return trace.Wrap(err)
+
+		if len(parts) == 0 {
+			continue
 		}
+
+		uploadData := u.cfg.Uploader.GetUploadMetadata(upload.SessionID)
+
+		// Schedule a background operation to check for (and emit) a session end event.
+		// This is necessary because we'll need to download the session in order to
+		// enumerate its events, and the S3 API takes a little while after the upload
+		// is completed before version metadata becomes available.
+		go func() {
+			select {
+			case <-ctx.Done():
+				return
+			case <-u.cfg.Clock.After(2 * time.Minute):
+				u.log.Debugf("checking for session end event for session %v", upload.SessionID)
+				if err := u.ensureSessionEndEvent(ctx, uploadData); err != nil {
+					u.log.WithError(err).Warningf("failed to ensure session end event")
+				}
+			}
+		}()
 		session := &events.SessionUpload{
-			Metadata: apievents.Metadata{
+			Metadata: events.Metadata{
 				Type:  SessionUploadEvent,
 				Code:  SessionUploadCode,
 				ID:    uuid.New().String(),
 				Index: SessionUploadIndex,
 			},
-			SessionMetadata: apievents.SessionMetadata{
+			SessionMetadata: events.SessionMetadata{
 				SessionID: string(uploadData.SessionID),
 			},
 			SessionURL: uploadData.URL,
@@ -181,91 +195,104 @@ func (u *UploadCompleter) Close() error {
 }
 
 func (u *UploadCompleter) ensureSessionEndEvent(ctx context.Context, uploadData UploadMetadata) error {
-	var serverID, clusterName, user, login, hostname, namespace, serverAddr string
-	var interactive bool
+	// at this point, we don't know whether we'll need to emit a session.end or a
+	// windows.desktop.session.end, but as soon as we see the session start we'll
+	// be able to start filling in the details
+	var sshSessionEnd events.SessionEnd
+	var desktopSessionEnd events.WindowsDesktopSessionEnd
 
-	// Get session events to find fields for constructed session end
-	sessionEvents, err := u.cfg.AuditLog.GetSessionEvents(apidefaults.Namespace, uploadData.SessionID, 0, false)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	if len(sessionEvents) == 0 {
-		return nil
-	}
+	first := true
 
-	// Return if session.end event already exists
-	for _, event := range sessionEvents {
-		if event.GetType() == SessionEndEvent {
-			return nil
+	// We use the streaming events API to search through the session events, because it works
+	// for both Desktop and SSH sessions, where as the GetSessionEvents API relies on downloading
+	// a copy of the session and using the SSH-specific index to iterate through events.
+	var lastEvent events.AuditEvent
+	evts, errors := u.cfg.AuditLog.StreamSessionEvents(ctx, uploadData.SessionID, 0)
+
+loop:
+	for {
+		select {
+		case evt, more := <-evts:
+			if !more {
+				break loop
+			}
+
+			if first {
+				u.log.Infof("got first event %T", evt)
+				first = false
+			}
+
+			lastEvent = evt
+
+			switch e := evt.(type) {
+			// Return if session end event already exists
+			case *events.SessionEnd, *events.WindowsDesktopSessionEnd:
+				return nil
+
+			case *events.WindowsDesktopSessionStart:
+				desktopSessionEnd.Type = WindowsDesktopSessionEndEvent
+				desktopSessionEnd.Code = DesktopSessionEndCode
+				desktopSessionEnd.ClusterName = e.ClusterName
+				desktopSessionEnd.StartTime = e.Time
+				desktopSessionEnd.Participants = append(desktopSessionEnd.Participants, e.User)
+				desktopSessionEnd.Recorded = true
+				desktopSessionEnd.UserMetadata = e.UserMetadata
+				desktopSessionEnd.SessionMetadata = e.SessionMetadata
+				desktopSessionEnd.WindowsDesktopService = e.WindowsDesktopService
+				desktopSessionEnd.Domain = e.Domain
+				desktopSessionEnd.DesktopAddr = e.DesktopAddr
+				desktopSessionEnd.DesktopLabels = e.DesktopLabels
+				desktopSessionEnd.DesktopName = fmt.Sprintf("%v (recovered)", e.DesktopName)
+
+			case *events.SessionStart:
+				sshSessionEnd.Type = SessionEndEvent
+				sshSessionEnd.Code = SessionEndCode
+				sshSessionEnd.ClusterName = e.ClusterName
+				sshSessionEnd.StartTime = e.Time
+				sshSessionEnd.UserMetadata = e.UserMetadata
+				sshSessionEnd.SessionMetadata = e.SessionMetadata
+				sshSessionEnd.ServerMetadata = e.ServerMetadata
+				sshSessionEnd.ConnectionMetadata = e.ConnectionMetadata
+				sshSessionEnd.KubernetesClusterMetadata = e.KubernetesClusterMetadata
+				sshSessionEnd.KubernetesPodMetadata = e.KubernetesPodMetadata
+				sshSessionEnd.InitialCommand = e.InitialCommand
+				sshSessionEnd.SessionRecording = e.SessionRecording
+				sshSessionEnd.Interactive = e.TerminalSize != ""
+				sshSessionEnd.Participants = append(sshSessionEnd.Participants, e.User)
+
+			case *events.SessionJoin:
+				sshSessionEnd.Participants = append(sshSessionEnd.Participants, e.User)
+			}
+
+		case err := <-errors:
+			return trace.Wrap(err)
+		case <-ctx.Done():
+			return ctx.Err()
 		}
 	}
 
-	// Session start event is the first of session events
-	sessionStart := sessionEvents[0]
-	if sessionStart.GetType() != SessionStartEvent {
-		return trace.BadParameter("invalid session, session start is not the first event")
-	}
+	sshSessionEnd.Participants = apiutils.Deduplicate(sshSessionEnd.Participants)
+	sshSessionEnd.EndTime = lastEvent.GetTime()
+	desktopSessionEnd.EndTime = lastEvent.GetTime()
 
-	// Set variables
-	serverID = sessionStart.GetString(SessionServerHostname)
-	clusterName = sessionStart.GetString(SessionClusterName)
-	hostname = sessionStart.GetString(SessionServerHostname)
-	namespace = sessionStart.GetString(EventNamespace)
-	serverAddr = sessionStart.GetString(SessionServerAddr)
-	user = sessionStart.GetString(EventUser)
-	login = sessionStart.GetString(EventLogin)
-	if terminalSize := sessionStart.GetString(TerminalSize); terminalSize != "" {
-		interactive = true
+	var sessionEndEvent events.AuditEvent
+	switch {
+	case sshSessionEnd.Code != "":
+		sessionEndEvent = &sshSessionEnd
+	case desktopSessionEnd.Code != "":
+		sessionEndEvent = &desktopSessionEnd
+	default:
+		return trace.BadParameter("invalid session, could not find session start")
 	}
 
-	// Get last event to get session end time
-	lastEvent := sessionEvents[len(sessionEvents)-1]
-
-	participants := getParticipants(sessionEvents)
-
-	sessionEndEvent := &events.SessionEnd{
-		Metadata: events.Metadata{
-			Type:        SessionEndEvent,
-			Code:        SessionEndCode,
-			ClusterName: clusterName,
-		},
-		ServerMetadata: events.ServerMetadata{
-			ServerID:        serverID,
-			ServerNamespace: namespace,
-			ServerHostname:  hostname,
-			ServerAddr:      serverAddr,
-		},
-		SessionMetadata: events.SessionMetadata{
-			SessionID: string(uploadData.SessionID),
-		},
-		UserMetadata: events.UserMetadata{
-			User:  user,
-			Login: login,
-		},
-		Participants: participants,
-		Interactive:  interactive,
-		StartTime:    sessionStart.GetTime(EventTime),
-		EndTime:      lastEvent.GetTime(EventTime),
-	}
+	u.log.Infof("emitting %T event for completed session %v", sessionEndEvent, uploadData.SessionID)
 
 	// Check and set event fields
-	if err = checkAndSetEventFields(sessionEndEvent, u.cfg.Clock, utils.NewRealUID(), clusterName); err != nil {
+	if err := checkAndSetEventFields(sessionEndEvent, u.cfg.Clock, utils.NewRealUID(), sessionEndEvent.GetClusterName()); err != nil {
 		return trace.Wrap(err)
 	}
-	if err = u.cfg.AuditLog.EmitAuditEvent(ctx, sessionEndEvent); err != nil {
+	if err := u.cfg.AuditLog.EmitAuditEvent(ctx, sessionEndEvent); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
 }
-
-func getParticipants(sessionEvents []EventFields) []string {
-	var participants []string
-	for _, event := range sessionEvents {
-		if event.GetType() == SessionJoinEvent || event.GetType() == SessionStartEvent {
-			participant := event.GetString(EventUser)
-			participants = append(participants, participant)
-
-		}
-	}
-	return apiutils.Deduplicate(participants)
-}
diff --git a/lib/events/complete_test.go b/lib/events/complete_test.go
new file mode 100644
index 0000000000000..7e79aa2c8fce7
--- /dev/null
+++ b/lib/events/complete_test.go
@@ -0,0 +1,145 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package events
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	apievents "github.com/gravitational/teleport/api/types/events"
+	"github.com/gravitational/teleport/lib/session"
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+)
+
+// TestUploadCompleterEmitsSessionEnd verifies that the upload completer
+// emits session.end or windows.desktop.session.end events for sessions
+// that are completed.
+func TestUploadCompleterEmitsSessionEnd(t *testing.T) {
+	for _, test := range []struct {
+		startEvent   apievents.AuditEvent
+		endEventType string
+	}{
+		{&apievents.SessionStart{}, SessionEndEvent},
+		{&apievents.WindowsDesktopSessionStart{}, WindowsDesktopSessionEndEvent},
+	} {
+		t.Run(test.endEventType, func(t *testing.T) {
+			clock := clockwork.NewFakeClock()
+			mu := NewMemoryUploader()
+			mu.Clock = clock
+
+			log := &MockAuditLog{
+				sessionEvents: []apievents.AuditEvent{test.startEvent},
+			}
+
+			uc, err := NewUploadCompleter(UploadCompleterConfig{
+				Unstarted:   true,
+				Uploader:    mu,
+				AuditLog:    log,
+				GracePeriod: 2 * time.Hour,
+				Clock:       clock,
+			})
+			require.NoError(t, err)
+
+			upload, err := mu.CreateUpload(context.Background(), session.NewID())
+			require.NoError(t, err)
+
+			// advance the clock to force the grace period check to succeed
+			clock.Advance(3 * time.Hour)
+
+			// session end events are only emitted if there's at least one
+			// part to be uploaded, so create that here
+			_, err = mu.UploadPart(context.Background(), *upload, 0, strings.NewReader("part"))
+			require.NoError(t, err)
+
+			err = uc.CheckUploads(context.Background())
+			require.NoError(t, err)
+
+			// advance the clock to force the asynchronous session end event emission
+			clock.BlockUntil(1)
+			clock.Advance(3 * time.Minute)
+
+			// expect two events - a session end and a session upload
+			// the session end is done asynchronously, so wait for that
+			require.Eventually(t, func() bool { return len(log.emitter.Events()) == 2 }, 5*time.Second, 1*time.Second,
+				"should have emitted 2 events, but only got %d", len(log.emitter.Events()))
+
+			require.IsType(t, &apievents.SessionUpload{}, log.emitter.Events()[0])
+			require.Equal(t, test.endEventType, log.emitter.Events()[1].GetType())
+		})
+	}
+}
+
+// TestUploadCompleterCompletesEmptyUploads verifies that the upload completer
+// completes uploads that have no parts. This ensures that we don't leave empty
+// directories behind.
+func TestUploadCompleterCompletesEmptyUploads(t *testing.T) {
+	clock := clockwork.NewFakeClock()
+	mu := NewMemoryUploader()
+	mu.Clock = clock
+
+	log := &MockAuditLog{}
+
+	uc, err := NewUploadCompleter(UploadCompleterConfig{
+		Unstarted:   true,
+		Uploader:    mu,
+		AuditLog:    log,
+		GracePeriod: 2 * time.Hour,
+	})
+	require.NoError(t, err)
+
+	upload, err := mu.CreateUpload(context.Background(), session.NewID())
+	require.NoError(t, err)
+	clock.Advance(3 * time.Hour)
+
+	err = uc.CheckUploads(context.Background())
+	require.NoError(t, err)
+
+	require.True(t, mu.uploads[upload.ID].completed)
+}
+
+type MockAuditLog struct {
+	DiscardAuditLog
+
+	emitter       MockEmitter
+	sessionEvents []apievents.AuditEvent
+}
+
+func (m *MockAuditLog) StreamSessionEvents(ctx context.Context, sid session.ID, startIndex int64) (chan apievents.AuditEvent, chan error) {
+	errors := make(chan error, 1)
+	events := make(chan apievents.AuditEvent)
+
+	go func() {
+		defer close(events)
+
+		for _, event := range m.sessionEvents {
+			select {
+			case <-ctx.Done():
+				return
+			case events <- event:
+			}
+		}
+	}()
+
+	return events, errors
+}
+
+func (m *MockAuditLog) EmitAuditEvent(ctx context.Context, event apievents.AuditEvent) error {
+	return m.emitter.EmitAuditEvent(ctx, event)
+}
diff --git a/lib/events/dynamic.go b/lib/events/dynamic.go
index ae556e014005a..9f53bbcd0bffd 100644
--- a/lib/events/dynamic.go
+++ b/lib/events/dynamic.go
@@ -22,6 +22,7 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
 
 	"encoding/json"
 )
@@ -213,8 +214,21 @@ func FromEventFields(fields EventFields) (apievents.AuditEvent, error) {
 		e = &events.CertificateCreate{}
 	case RenewableCertificateGenerationMismatchEvent:
 		e = &events.RenewableCertificateGenerationMismatch{}
+	case UnknownEvent:
+		e = &events.Unknown{}
 	default:
-		return nil, trace.BadParameter("unknown event type: %q", eventType)
+		log.Errorf("Attempted to convert dynamic event of unknown type \"%v\" into protobuf event.", eventType)
+		unknown := &events.Unknown{}
+		if err := utils.FastUnmarshal(data, unknown); err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		unknown.Type = UnknownEvent
+		unknown.Code = UnknownCode
+		unknown.UnknownType = eventType
+		unknown.UnknownCode = fields.GetString(EventCode)
+		unknown.Data = string(data)
+		return unknown, nil
 	}
 
 	if err := utils.FastUnmarshal(data, e); err != nil {
diff --git a/lib/events/emitter_test.go b/lib/events/emitter_test.go
index 56e532a1319fd..621e3246ed10f 100644
--- a/lib/events/emitter_test.go
+++ b/lib/events/emitter_test.go
@@ -22,7 +22,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -285,7 +284,7 @@ func TestExport(t *testing.T) {
 	parts, err := uploader.GetParts(uploads[0].ID)
 	require.NoError(t, err)
 
-	f, err := ioutil.TempFile("", "")
+	f, err := os.CreateTemp("", "")
 	require.NoError(t, err)
 	defer os.Remove(f.Name())
 
diff --git a/lib/events/events_test.go b/lib/events/events_test.go
index d25ac64af2150..b464d77d8a2cf 100644
--- a/lib/events/events_test.go
+++ b/lib/events/events_test.go
@@ -486,7 +486,7 @@ func TestJSON(t *testing.T) {
 		},
 		{
 			name: "desktop session start",
-			json: `{"uid":"cd06365f-3cef-4b21-809a-4af9502c11a1","user":"foo","impersonator":"bar","login":"Administrator","success":true,"proto":"tdp","sid":"test-session","addr.local":"192.168.1.100:39887","addr.remote":"[::1]:34902","with_mfa":"mfa-device","code":"TDP00I","event":"windows.desktop.session.start","time":"2020-04-23T18:22:35.35Z","ei":4,"cluster_name":"test-cluster","windows_user":"Administrator","windows_domain":"test.example.com","desktop_addr":"[::1]:34902","windows_desktop_service":"00baaef5-ff1e-4222-85a5-c7cb0cd8e7b8","desktop_labels":{"env":"production"}}`,
+			json: `{"uid":"cd06365f-3cef-4b21-809a-4af9502c11a1","user":"foo","impersonator":"bar","login":"Administrator","success":true,"proto":"tdp","sid":"test-session","addr.local":"192.168.1.100:39887","addr.remote":"[::1]:34902","with_mfa":"mfa-device","code":"TDP00I","event":"windows.desktop.session.start","time":"2020-04-23T18:22:35.35Z","ei":4,"cluster_name":"test-cluster","windows_user":"Administrator","windows_domain":"test.example.com","desktop_name":"test-desktop","desktop_addr":"[::1]:34902","windows_desktop_service":"00baaef5-ff1e-4222-85a5-c7cb0cd8e7b8","desktop_labels":{"env":"production"}}`,
 			event: apievents.WindowsDesktopSessionStart{
 				Metadata: apievents.Metadata{
 					Index:       4,
@@ -514,6 +514,7 @@ func TestJSON(t *testing.T) {
 					Success: true,
 				},
 				WindowsDesktopService: "00baaef5-ff1e-4222-85a5-c7cb0cd8e7b8",
+				DesktopName:           "test-desktop",
 				DesktopAddr:           "[::1]:34902",
 				Domain:                "test.example.com",
 				WindowsUser:           "Administrator",
diff --git a/lib/events/fields.go b/lib/events/fields.go
index 3952c5d6fa9c4..6d00aace3b943 100644
--- a/lib/events/fields.go
+++ b/lib/events/fields.go
@@ -21,7 +21,6 @@ import (
 	"bufio"
 	"compress/gzip"
 	"io"
-	"io/ioutil"
 	"strings"
 	"time"
 
@@ -102,7 +101,7 @@ func ValidateArchive(reader io.Reader, serverID string) error {
 
 		// Skip over any file in the archive that doesn't contain session events.
 		if !strings.HasSuffix(header.Name, eventsSuffix) {
-			_, err = io.Copy(ioutil.Discard, tarball)
+			_, err = io.Copy(io.Discard, tarball)
 			if err != nil {
 				return trace.Wrap(err)
 			}
diff --git a/lib/events/filesessions/fileasync.go b/lib/events/filesessions/fileasync.go
index db058cd1a134b..22c8ae5bf465e 100644
--- a/lib/events/filesessions/fileasync.go
+++ b/lib/events/filesessions/fileasync.go
@@ -21,7 +21,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"time"
@@ -159,7 +158,7 @@ func (u *Uploader) writeSessionError(sessionID session.ID, err error) error {
 		return trace.BadParameter("missing session ID")
 	}
 	path := u.sessionErrorFilePath(sessionID)
-	return trace.ConvertSystemError(ioutil.WriteFile(path, []byte(err.Error()), 0600))
+	return trace.ConvertSystemError(os.WriteFile(path, []byte(err.Error()), 0600))
 }
 
 func (u *Uploader) checkSessionError(sessionID session.ID) (bool, error) {
@@ -253,7 +252,7 @@ type ScanStats struct {
 
 // Scan scans the streaming directory and uploads recordings
 func (u *Uploader) Scan() (*ScanStats, error) {
-	files, err := ioutil.ReadDir(u.cfg.ScanDir)
+	files, err := os.ReadDir(u.cfg.ScanDir)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
@@ -316,7 +315,7 @@ type upload struct {
 
 // readStatus reads stream status
 func (u *upload) readStatus() (*apievents.StreamStatus, error) {
-	data, err := ioutil.ReadAll(u.checkpointFile)
+	data, err := io.ReadAll(u.checkpointFile)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
diff --git a/lib/events/filesessions/fileasync_chaos_test.go b/lib/events/filesessions/fileasync_chaos_test.go
index 95d50e5068cb1..302aeae5843e2 100644
--- a/lib/events/filesessions/fileasync_chaos_test.go
+++ b/lib/events/filesessions/fileasync_chaos_test.go
@@ -23,7 +23,6 @@ package filesessions
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -65,7 +64,7 @@ func TestChaosUpload(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	scanDir, err := ioutil.TempDir("", "teleport-streams")
+	scanDir, err := os.MkdirTemp("", "teleport-streams")
 	require.NoError(t, err)
 	defer os.RemoveAll(scanDir)
 
@@ -95,7 +94,7 @@ func TestChaosUpload(t *testing.T) {
 				return nil, trace.ConnectionProblem(nil, "failed to resume stream")
 			} else if resumed >= 5 && resumed < 8 {
 				// for the next several resumes, lose checkpoint file for the stream
-				files, err := ioutil.ReadDir(scanDir)
+				files, err := os.ReadDir(scanDir)
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
diff --git a/lib/events/filesessions/fileasync_test.go b/lib/events/filesessions/fileasync_test.go
index aec9f59121aa9..6d02ff3f82478 100644
--- a/lib/events/filesessions/fileasync_test.go
+++ b/lib/events/filesessions/fileasync_test.go
@@ -20,7 +20,6 @@ package filesessions
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -242,7 +241,7 @@ func TestUploadResume(t *testing.T) {
 			name:    "stream created when checkpoint is lost after failure",
 			retries: 1,
 			onRetry: func(t *testing.T, attempt int, uploader *Uploader) {
-				files, err := ioutil.ReadDir(uploader.cfg.ScanDir)
+				files, err := os.ReadDir(uploader.cfg.ScanDir)
 				require.Nil(t, err)
 				checkpointsDeleted := 0
 				for i := range files {
@@ -405,7 +404,7 @@ func TestUploadBadSession(t *testing.T) {
 	sessionID := session.NewID()
 	fileName := filepath.Join(p.scanDir, string(sessionID)+tarExt)
 
-	err := ioutil.WriteFile(fileName, []byte("this session is corrupted"), 0600)
+	err := os.WriteFile(fileName, []byte("this session is corrupted"), 0600)
 	require.NoError(t, err)
 
 	// initiate the scan by advancing clock past
@@ -450,16 +449,10 @@ func (u *uploaderPack) Close(t *testing.T) {
 
 	err := u.uploader.Close()
 	require.NoError(t, err)
-
-	if u.scanDir != "" {
-		err := os.RemoveAll(u.scanDir)
-		require.NoError(t, err)
-	}
 }
 
 func newUploaderPack(t *testing.T, wrapStreamer wrapStreamerFn) uploaderPack {
-	scanDir, err := ioutil.TempDir("", "teleport-streams")
-	require.NoError(t, err)
+	scanDir := t.TempDir()
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	pack := uploaderPack{
@@ -518,9 +511,7 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 
 	test := testCase.newTest(streamer)
 
-	scanDir, err := ioutil.TempDir("", "teleport-streams")
-	require.Nil(t, err)
-	defer os.RemoveAll(scanDir)
+	scanDir := t.TempDir()
 
 	scanPeriod := 10 * time.Second
 	uploader, err := NewUploader(UploaderConfig{
diff --git a/lib/events/filesessions/filestream.go b/lib/events/filesessions/filestream.go
index c7415c866b702..3bff4937474a8 100644
--- a/lib/events/filesessions/filestream.go
+++ b/lib/events/filesessions/filestream.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sort"
@@ -96,9 +95,6 @@ func (h *Handler) UploadPart(ctx context.Context, upload events.StreamUpload, pa
 
 // CompleteUpload completes the upload
 func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload, parts []events.StreamPart) error {
-	if len(parts) == 0 {
-		return trace.BadParameter("need at least one part to complete the upload")
-	}
 	if err := checkUpload(upload); err != nil {
 		return trace.Wrap(err)
 	}
@@ -127,30 +123,26 @@ func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload
 		}
 	}()
 
-	files := make([]*os.File, 0, len(parts))
-	readers := make([]io.Reader, 0, len(parts))
-
-	defer func() {
-		for i := 0; i < len(files); i++ {
-			if err := files[i].Close(); err != nil {
-				h.WithError(err).Errorf("Failed to close file %q.", files[i].Name())
-			}
+	writePartToFile := func(path string) error {
+		file, err := os.Open(path)
+		if err != nil {
+			return err
 		}
-	}()
+		defer func() {
+			if err := file.Close(); err != nil {
+				h.WithError(err).Errorf("failed to close file %q", path)
+			}
+		}()
+
+		_, err = io.Copy(f, file)
+		return err
+	}
 
 	for _, part := range parts {
 		partPath := h.partPath(upload, part.Number)
-		file, err := os.Open(partPath)
-		if err != nil {
-			return trace.Wrap(err, "failed to open part file for upload")
+		if err := writePartToFile(partPath); err != nil {
+			return trace.Wrap(err)
 		}
-		files = append(files, file)
-		readers = append(readers, file)
-	}
-
-	_, err = io.Copy(f, io.MultiReader(readers...))
-	if err != nil {
-		return trace.Wrap(err)
 	}
 
 	err = h.Config.OnBeforeComplete(ctx, upload)
@@ -207,7 +199,7 @@ func (h *Handler) ListParts(ctx context.Context, upload events.StreamUpload) ([]
 func (h *Handler) ListUploads(ctx context.Context) ([]events.StreamUpload, error) {
 	var uploads []events.StreamUpload
 
-	dirs, err := ioutil.ReadDir(h.uploadsPath())
+	dirs, err := os.ReadDir(h.uploadsPath())
 	if err != nil {
 		err = trace.ConvertSystemError(err)
 		// The upload folder may not exist if there are no uploads yet.
@@ -226,7 +218,7 @@ func (h *Handler) ListUploads(ctx context.Context) ([]events.StreamUpload, error
 			h.WithError(err).Warningf("Skipping upload %v with bad format.", uploadID)
 			continue
 		}
-		files, err := ioutil.ReadDir(filepath.Join(h.uploadsPath(), dir.Name()))
+		files, err := os.ReadDir(filepath.Join(h.uploadsPath(), dir.Name()))
 		if err != nil {
 			err = trace.ConvertSystemError(err)
 			if trace.IsNotFound(err) {
@@ -243,10 +235,16 @@ func (h *Handler) ListUploads(ctx context.Context) ([]events.StreamUpload, error
 			h.Warningf("Skipping upload %v, not a directory.", uploadID)
 			continue
 		}
+
+		info, err := dir.Info()
+		if err != nil {
+			h.WithError(err).Warningf("Skipping upload %v: cannot read file info", uploadID)
+			continue
+		}
 		uploads = append(uploads, events.StreamUpload{
 			SessionID: session.ID(filepath.Base(files[0].Name())),
 			ID:        uploadID,
-			Initiated: dir.ModTime(),
+			Initiated: info.ModTime(),
 		})
 	}
 	sort.Slice(uploads, func(i, j int) bool {
diff --git a/lib/events/filesessions/fileuploader_test.go b/lib/events/filesessions/fileuploader_test.go
index acb46dbf20f4e..22698e5f301bf 100644
--- a/lib/events/filesessions/fileuploader_test.go
+++ b/lib/events/filesessions/fileuploader_test.go
@@ -19,7 +19,6 @@ package filesessions
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -40,9 +39,7 @@ func TestMain(m *testing.M) {
 
 // TestStreams tests various streaming upload scenarios
 func TestStreams(t *testing.T) {
-	dir, err := ioutil.TempDir("", "teleport-streams")
-	require.Nil(t, err)
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	handler, err := NewHandler(Config{
 		Directory: dir,
diff --git a/lib/events/gcssessions/gcsstream.go b/lib/events/gcssessions/gcsstream.go
index 4663841b1eb9b..b1ef99f57892c 100644
--- a/lib/events/gcssessions/gcsstream.go
+++ b/lib/events/gcssessions/gcsstream.go
@@ -125,6 +125,11 @@ func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload
 		return convertGCSError(err)
 	}
 
+	// If there are no parts to complete, move to cleanup
+	if len(parts) == 0 {
+		return h.cleanupUpload(ctx, upload)
+	}
+
 	objects := h.partsToObjects(upload, parts)
 	for len(objects) > maxParts {
 		h.Logger.Debugf("Got %v objects for upload %v, performing temp merge.",
@@ -365,7 +370,7 @@ func uploadFromPath(path string) (*events.StreamUpload, error) {
 	if err := sessionID.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	parts := strings.Split(dir, slash)
+	parts := strings.Split(strings.TrimSuffix(dir, slash), slash)
 	if len(parts) < 2 {
 		return nil, trace.BadParameter("expected format uploads/<upload-id>, got %v", dir)
 	}
diff --git a/lib/events/gcssessions/gcsstream_test.go b/lib/events/gcssessions/gcsstream_test.go
index cb578ae5d4b2b..7fb63ec05af59 100644
--- a/lib/events/gcssessions/gcsstream_test.go
+++ b/lib/events/gcssessions/gcsstream_test.go
@@ -34,6 +34,40 @@ import (
 	"github.com/gravitational/trace"
 )
 
+func TestUploadFromPath(t *testing.T) {
+	for _, test := range []struct {
+		path                string
+		sessionID, uploadID string
+		assertErr           require.ErrorAssertionFunc
+	}{
+		{
+			path:      "uploads/73de0358-2a40-4940-ae26-0c06877e35d9/cf9e08d5-6651-4ddd-a472-52d2286d6bb4.upload",
+			sessionID: "cf9e08d5-6651-4ddd-a472-52d2286d6bb4",
+			uploadID:  "73de0358-2a40-4940-ae26-0c06877e35d9",
+			assertErr: require.NoError,
+		},
+		{
+			path:      "uploads/73de0358-2a40-4940-ae26-0c06877e35d9/cf9e08d5-6651-4ddd-a472-52d2286d6bb4.BADEXTENSION",
+			assertErr: require.Error,
+		},
+		{
+			path:      "no-dir.upload",
+			assertErr: require.Error,
+		},
+	} {
+		t.Run(test.path, func(t *testing.T) {
+			upload, err := uploadFromPath(test.path)
+			test.assertErr(t, err)
+			if test.sessionID != "" {
+				require.Equal(t, test.sessionID, string(upload.SessionID))
+			}
+			if test.uploadID != "" {
+				require.Equal(t, test.uploadID, upload.ID)
+			}
+		})
+	}
+}
+
 // TestStreams tests various streaming upload scenarios
 func TestStreams(t *testing.T) {
 	ctx := context.Background()
diff --git a/lib/events/playback.go b/lib/events/playback.go
index 82c47efda1bb7..cd39f1c1d5fd8 100644
--- a/lib/events/playback.go
+++ b/lib/events/playback.go
@@ -24,7 +24,6 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -190,7 +189,7 @@ func (w *PlaybackWriter) SessionChunks() ([]byte, error) {
 		return nil, trace.Wrap(err)
 	}
 	defer grChunk.Close()
-	stream, err = ioutil.ReadAll(grChunk)
+	stream, err = io.ReadAll(grChunk)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/events/s3sessions/s3stream.go b/lib/events/s3sessions/s3stream.go
index 201723c01b529..bef290faff5b0 100644
--- a/lib/events/s3sessions/s3stream.go
+++ b/lib/events/s3sessions/s3stream.go
@@ -91,8 +91,25 @@ func (h *Handler) UploadPart(ctx context.Context, upload events.StreamUpload, pa
 	return &events.StreamPart{ETag: *resp.ETag, Number: partNumber}, nil
 }
 
+func (h *Handler) abortUpload(ctx context.Context, upload events.StreamUpload) error {
+	req := &s3.AbortMultipartUploadInput{
+		Bucket:   aws.String(h.Bucket),
+		Key:      aws.String(h.path(upload.SessionID)),
+		UploadId: aws.String(upload.ID),
+	}
+	_, err := h.client.AbortMultipartUploadWithContext(ctx, req)
+	if err != nil {
+		return ConvertS3Error(err)
+	}
+	return nil
+}
+
 // CompleteUpload completes the upload
 func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload, parts []events.StreamPart) error {
+	if len(parts) == 0 {
+		return h.abortUpload(ctx, upload)
+	}
+
 	start := time.Now()
 	defer func() { h.Infof("UploadPart(%v) completed in %v.", upload.ID, time.Since(start)) }()
 
diff --git a/lib/events/sessionlog.go b/lib/events/sessionlog.go
index e365264f82b77..af95b69f52aa3 100644
--- a/lib/events/sessionlog.go
+++ b/lib/events/sessionlog.go
@@ -22,7 +22,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -236,7 +235,7 @@ func (sl *DiskSessionLogger) finalize() error {
 
 	// create a sentinel to signal completion
 	signalFile := filepath.Join(sl.sessionDir, fmt.Sprintf("%v.completed", sl.SessionID.String()))
-	err := ioutil.WriteFile(signalFile, []byte("completed"), 0640)
+	err := os.WriteFile(signalFile, []byte("completed"), 0640)
 	if err != nil {
 		log.Warningf("Failed creating signal file: %v.", err)
 	}
@@ -601,7 +600,7 @@ func (f *gzipWriter) Close() error {
 	var errors []error
 	if f.Writer != nil {
 		errors = append(errors, f.Writer.Close())
-		f.Writer.Reset(ioutil.Discard)
+		f.Writer.Reset(io.Discard)
 		writerPool.Put(f.Writer)
 		f.Writer = nil
 	}
@@ -618,7 +617,7 @@ func (f *gzipWriter) Close() error {
 // internal buffers to avoid too many objects on the heap
 var writerPool = sync.Pool{
 	New: func() interface{} {
-		w, _ := gzip.NewWriterLevel(ioutil.Discard, gzip.BestSpeed)
+		w, _ := gzip.NewWriterLevel(io.Discard, gzip.BestSpeed)
 		return w
 	},
 }
diff --git a/lib/events/stream.go b/lib/events/stream.go
index c00e31c1d4fa0..88957755bca63 100644
--- a/lib/events/stream.go
+++ b/lib/events/stream.go
@@ -22,7 +22,6 @@ import (
 	"encoding/binary"
 	"errors"
 	"io"
-	"io/ioutil"
 	"sort"
 	"sync"
 	"time"
@@ -966,7 +965,7 @@ func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 				return nil, r.setError(trace.ConvertSystemError(err))
 			}
 			r.padding = int64(binary.BigEndian.Uint64(r.sizeBytes[:Int64Size]))
-			gzipReader, err := newGzipReader(ioutil.NopCloser(io.LimitReader(r.reader, int64(partSize))))
+			gzipReader, err := newGzipReader(io.NopCloser(io.LimitReader(r.reader, int64(partSize))))
 			if err != nil {
 				return nil, r.setError(trace.Wrap(err))
 			}
@@ -988,7 +987,7 @@ func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 					return nil, r.setError(trace.ConvertSystemError(err))
 				}
 				if r.padding != 0 {
-					skipped, err := io.CopyBuffer(ioutil.Discard, io.LimitReader(r.reader, r.padding), r.messageBytes[:])
+					skipped, err := io.CopyBuffer(io.Discard, io.LimitReader(r.reader, r.padding), r.messageBytes[:])
 					if err != nil {
 						return nil, r.setError(trace.ConvertSystemError(err))
 					}
@@ -1074,6 +1073,8 @@ type MemoryUploader struct {
 	uploads map[string]*MemoryUpload
 	objects map[session.ID][]byte
 	eventsC chan UploadEvent
+
+	Clock clockwork.Clock
 }
 
 // MemoryUpload is used in tests
@@ -1114,6 +1115,9 @@ func (m *MemoryUploader) CreateUpload(ctx context.Context, sessionID session.ID)
 		ID:        uuid.New().String(),
 		SessionID: sessionID,
 	}
+	if m.Clock != nil {
+		upload.Initiated = m.Clock.Now()
+	}
 	m.uploads[upload.ID] = &MemoryUpload{
 		id:        upload.ID,
 		sessionID: sessionID,
@@ -1158,7 +1162,7 @@ func (m *MemoryUploader) CompleteUpload(ctx context.Context, upload StreamUpload
 
 // UploadPart uploads part and returns the part
 func (m *MemoryUploader) UploadPart(ctx context.Context, upload StreamUpload, partNumber int64, partBody io.ReadSeeker) (*StreamPart, error) {
-	data, err := ioutil.ReadAll(partBody)
+	data, err := io.ReadAll(partBody)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1243,7 +1247,7 @@ func (m *MemoryUploader) Upload(ctx context.Context, sessionID session.ID, readC
 	if ok {
 		return "", trace.AlreadyExists("session %q already exists", sessionID)
 	}
-	data, err := ioutil.ReadAll(readCloser)
+	data, err := io.ReadAll(readCloser)
 	if err != nil {
 		return "", trace.ConvertSystemError(err)
 	}
diff --git a/lib/events/test/streamsuite.go b/lib/events/test/streamsuite.go
index e3f7810c31ff1..119d92caa53f1 100644
--- a/lib/events/test/streamsuite.go
+++ b/lib/events/test/streamsuite.go
@@ -16,7 +16,6 @@ package test
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -105,7 +104,7 @@ func StreamWithParameters(t *testing.T, handler events.MultipartHandler, params
 	err = stream.Complete(ctx)
 	require.Nil(t, err)
 
-	f, err := ioutil.TempFile("", string(sid))
+	f, err := os.CreateTemp("", string(sid))
 	require.Nil(t, err)
 	defer os.Remove(f.Name())
 	defer f.Close()
@@ -172,7 +171,7 @@ func StreamResumeWithParameters(t *testing.T, handler events.MultipartHandler, p
 	err = stream.Complete(ctx)
 	require.Nil(t, err, "Complete after resume should succeed")
 
-	f, err := ioutil.TempFile("", string(sid))
+	f, err := os.CreateTemp("", string(sid))
 	require.Nil(t, err)
 	defer os.Remove(f.Name())
 	defer f.Close()
diff --git a/lib/events/test/suite.go b/lib/events/test/suite.go
index 5f0c95d47998a..46671c1687b34 100644
--- a/lib/events/test/suite.go
+++ b/lib/events/test/suite.go
@@ -21,7 +21,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"os"
 	"testing"
 	"time"
@@ -46,7 +46,7 @@ func UploadDownload(t *testing.T, handler events.MultipartHandler) {
 	_, err := handler.Upload(context.TODO(), id, bytes.NewBuffer([]byte(val)))
 	require.Nil(t, err)
 
-	f, err := ioutil.TempFile("", string(id))
+	f, err := os.CreateTemp("", string(id))
 	require.Nil(t, err)
 	defer os.Remove(f.Name())
 	defer f.Close()
@@ -57,7 +57,7 @@ func UploadDownload(t *testing.T, handler events.MultipartHandler) {
 	_, err = f.Seek(0, 0)
 	require.Nil(t, err)
 
-	data, err := ioutil.ReadAll(f)
+	data, err := io.ReadAll(f)
 	require.Nil(t, err)
 	require.Equal(t, string(data), val)
 }
@@ -66,7 +66,7 @@ func UploadDownload(t *testing.T, handler events.MultipartHandler) {
 func DownloadNotFound(t *testing.T, handler events.MultipartHandler) {
 	id := session.NewID()
 
-	f, err := ioutil.TempFile("", string(id))
+	f, err := os.CreateTemp("", string(id))
 	require.Nil(t, err)
 	defer os.Remove(f.Name())
 	defer f.Close()
diff --git a/lib/kube/kubeconfig/kubeconfig_test.go b/lib/kube/kubeconfig/kubeconfig_test.go
index 46b3c1714e61b..571a5e7ac4b58 100644
--- a/lib/kube/kubeconfig/kubeconfig_test.go
+++ b/lib/kube/kubeconfig/kubeconfig_test.go
@@ -17,7 +17,6 @@ package kubeconfig
 import (
 	"crypto/x509/pkix"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -39,7 +38,7 @@ import (
 )
 
 func setup(t *testing.T) (string, clientcmdapi.Config) {
-	f, err := ioutil.TempFile("", "kubeconfig")
+	f, err := os.CreateTemp("", "kubeconfig")
 	if err != nil {
 		t.Fatalf("failed to create temp kubeconfig file: %v", err)
 	}
diff --git a/lib/kube/proxy/auth_test.go b/lib/kube/proxy/auth_test.go
index df0854c33b21f..5b9b7b6a6499d 100644
--- a/lib/kube/proxy/auth_test.go
+++ b/lib/kube/proxy/auth_test.go
@@ -19,7 +19,6 @@ package proxy
 import (
 	"context"
 	"errors"
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -130,7 +129,7 @@ func TestGetKubeCreds(t *testing.T) {
 	ctx := context.TODO()
 	const teleClusterName = "teleport-cluster"
 
-	tmpFile, err := ioutil.TempFile("", "teleport")
+	tmpFile, err := os.CreateTemp("", "teleport")
 	require.NoError(t, err)
 	defer os.Remove(tmpFile.Name())
 	kubeconfigPath := tmpFile.Name()
diff --git a/lib/kube/proxy/forwarder_test.go b/lib/kube/proxy/forwarder_test.go
index 4483671f9d4a7..d208c3b30f096 100644
--- a/lib/kube/proxy/forwarder_test.go
+++ b/lib/kube/proxy/forwarder_test.go
@@ -902,7 +902,7 @@ func (ap mockAccessPoint) GetKubeServices(ctx context.Context) ([]types.Server,
 	return ap.kubeServices, nil
 }
 
-func (ap mockAccessPoint) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (ap mockAccessPoint) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	var cas []types.CertAuthority
 	for _, ca := range ap.cas {
 		cas = append(cas, ca)
@@ -910,7 +910,7 @@ func (ap mockAccessPoint) GetCertAuthorities(caType types.CertAuthType, loadKeys
 	return cas, nil
 }
 
-func (ap mockAccessPoint) GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (ap mockAccessPoint) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	return ap.cas[id.DomainName], nil
 }
 
diff --git a/lib/kube/proxy/roundtrip.go b/lib/kube/proxy/roundtrip.go
index de92c54925780..491a9cccbe2f3 100644
--- a/lib/kube/proxy/roundtrip.go
+++ b/lib/kube/proxy/roundtrip.go
@@ -23,7 +23,6 @@ import (
 	"crypto/tls"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -210,7 +209,7 @@ func (s *SpdyRoundTripper) NewConnection(resp *http.Response) (httpstream.Connec
 	if (resp.StatusCode != http.StatusSwitchingProtocols) || !strings.Contains(connectionHeader, strings.ToLower(httpstream.HeaderUpgrade)) || !strings.Contains(upgradeHeader, strings.ToLower(streamspdy.HeaderSpdy31)) {
 		defer resp.Body.Close()
 		responseError := ""
-		responseErrorBytes, err := ioutil.ReadAll(resp.Body)
+		responseErrorBytes, err := io.ReadAll(resp.Body)
 		if err != nil {
 			responseError = "unable to read error from server response"
 		} else {
diff --git a/lib/kube/proxy/sess.go b/lib/kube/proxy/sess.go
index ec56a94bb3d31..e2fd43ee8f060 100644
--- a/lib/kube/proxy/sess.go
+++ b/lib/kube/proxy/sess.go
@@ -302,6 +302,9 @@ type session struct {
 
 	// PresenceEnabled is set to true if MFA based presence is required.
 	PresenceEnabled bool
+
+	// Set if we should broadcast information about participant requirements to the session.
+	displayParticipantRequirements bool
 }
 
 // newSession creates a new session in pending mode.
@@ -334,29 +337,39 @@ func newSession(ctx authContext, forwarder *Forwarder, req *http.Request, params
 	}
 
 	s := &session{
-		ctx:               ctx,
-		forwarder:         forwarder,
-		req:               req,
-		params:            params,
-		id:                id,
-		parties:           make(map[uuid.UUID]*party),
-		partiesHistorical: make(map[uuid.UUID]*party),
-		log:               log,
-		io:                io,
-		state:             types.SessionState_SessionStatePending,
-		accessEvaluator:   accessEvaluator,
-		emitter:           events.NewDiscardEmitter(),
-		tty:               tty,
-		terminalSizeQueue: newMultiResizeQueue(),
-		started:           false,
-		sess:              sess,
-		closeC:            make(chan struct{}),
-		initiator:         initiator.ID,
-		expires:           time.Now().UTC().Add(time.Hour * 24),
-		PresenceEnabled:   ctx.Identity.GetIdentity().MFAVerified != "",
-		stateUpdate:       sync.NewCond(&sync.Mutex{}),
+		ctx:                            ctx,
+		forwarder:                      forwarder,
+		req:                            req,
+		params:                         params,
+		id:                             id,
+		parties:                        make(map[uuid.UUID]*party),
+		partiesHistorical:              make(map[uuid.UUID]*party),
+		log:                            log,
+		io:                             io,
+		state:                          types.SessionState_SessionStatePending,
+		accessEvaluator:                accessEvaluator,
+		emitter:                        events.NewDiscardEmitter(),
+		tty:                            tty,
+		terminalSizeQueue:              newMultiResizeQueue(),
+		started:                        false,
+		sess:                           sess,
+		closeC:                         make(chan struct{}),
+		initiator:                      initiator.ID,
+		expires:                        time.Now().UTC().Add(time.Hour * 24),
+		PresenceEnabled:                ctx.Identity.GetIdentity().MFAVerified != "",
+		stateUpdate:                    sync.NewCond(&sync.Mutex{}),
+		displayParticipantRequirements: utils.AsBool(q.Get("displayParticipantRequirements")),
 	}
 
+	go func() {
+		if _, open := <-s.io.TerminateNotifier(); open {
+			err := s.Close()
+			if err != nil {
+				s.log.Errorf("Failed to close session: %v.", err)
+			}
+		}
+	}()
+
 	err = s.trackerCreate(initiator, policySets)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -369,7 +382,7 @@ func newSession(ctx authContext, forwarder *Forwarder, req *http.Request, params
 // to fulfill the access requirements again.
 func (s *session) waitOnAccess() {
 	s.io.Off()
-	s.io.BroadcastMessage("Session paused, Waiting for required participants...")
+	s.BroadcastMessage("Session paused, Waiting for required participants...")
 
 	s.stateUpdate.L.Lock()
 	defer s.stateUpdate.L.Unlock()
@@ -388,7 +401,7 @@ outer:
 		s.stateUpdate.Wait()
 	}
 
-	s.io.BroadcastMessage("Resuming session...")
+	s.BroadcastMessage("Resuming session...")
 	s.io.On()
 }
 
@@ -432,10 +445,7 @@ func (s *session) launch() error {
 	}()
 
 	s.log.Debugf("Launching session: %v", s.id)
-
-	if s.tty {
-		s.io.BroadcastMessage("Launching session...")
-	}
+	s.BroadcastMessage("Connecting to %v over K8S", s.podName)
 
 	q := s.req.URL.Query()
 	request := &remoteCommandRequest{
@@ -521,10 +531,7 @@ func (s *session) launch() error {
 		case <-time.After(time.Until(s.expires)):
 			s.mu.Lock()
 			defer s.mu.Unlock()
-
-			if s.tty {
-				s.io.BroadcastMessage("Session expired, closing...")
-			}
+			s.BroadcastMessage("Session expired, closing...")
 
 			err := s.Close()
 			if err != nil {
@@ -898,10 +905,7 @@ func (s *session) join(p *party) error {
 	}
 
 	s.io.AddWriter(stringID, p.Client.stdoutStream())
-
-	if s.tty {
-		s.io.BroadcastMessage(fmt.Sprintf("User %v joined the session.", p.Ctx.User.GetName()))
-	}
+	s.BroadcastMessage("User %v joined the session.", p.Ctx.User.GetName())
 
 	if p.Mode == types.SessionModeratorMode {
 		go func() {
@@ -935,18 +939,30 @@ func (s *session) join(p *party) error {
 			}()
 		} else if !s.tty {
 			return trace.AccessDenied("insufficient permissions to launch non-interactive session")
-		} else {
-			s.stateUpdate.L.Lock()
-			if s.state == types.SessionState_SessionStatePending {
-				s.io.BroadcastMessage("Waiting for required participants...")
+		} else if len(s.parties) == 1 {
+			base := "Waiting for required participants..."
+
+			if s.displayParticipantRequirements {
+				s.BroadcastMessage(base+"\r\n%v", s.accessEvaluator.PrettyRequirementsList())
+			} else {
+				s.BroadcastMessage(base)
 			}
-			s.stateUpdate.L.Unlock()
 		}
 	}
 
 	return nil
 }
 
+func (s *session) BroadcastMessage(format string, args ...interface{}) {
+	if s.accessEvaluator.IsModerated() && s.tty {
+		err := s.io.BroadcastMessage(fmt.Sprintf(format, args...))
+
+		if err != nil {
+			s.log.Debugf("Failed to broadcast message: %v", err)
+		}
+	}
+}
+
 // leave removes a party from the session.
 func (s *session) leave(id uuid.UUID) error {
 	s.stateUpdate.L.Lock()
@@ -968,9 +984,7 @@ func (s *session) leave(id uuid.UUID) error {
 	s.io.DeleteReader(stringID)
 	s.io.DeleteWriter(stringID)
 
-	if s.tty {
-		s.io.BroadcastMessage(fmt.Sprintf("User %v left the session.", party.Ctx.User.GetName()))
-	}
+	s.BroadcastMessage("User %v left the session.", party.Ctx.User.GetName())
 
 	sessionLeaveEvent := &apievents.SessionLeave{
 		Metadata: apievents.Metadata{
@@ -1086,10 +1100,7 @@ func (s *session) Close() error {
 	defer s.mu.Unlock()
 
 	s.closeOnce.Do(func() {
-		if s.tty {
-			s.io.BroadcastMessage("Closing session...")
-		}
-
+		s.BroadcastMessage("Closing session...")
 		s.stateUpdate.L.Lock()
 		defer s.stateUpdate.L.Unlock()
 		s.state = types.SessionState_SessionStateTerminated
diff --git a/lib/kube/utils/utils.go b/lib/kube/utils/utils.go
index 93e926e81bdbf..f6f3928f0de12 100644
--- a/lib/kube/utils/utils.go
+++ b/lib/kube/utils/utils.go
@@ -21,6 +21,8 @@ import (
 	"encoding/hex"
 	"sort"
 
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/trace"
@@ -151,11 +153,36 @@ type KubeServicesPresence interface {
 
 // KubeClusterNames returns a sorted list of unique kubernetes clusters
 // registered in p.
+//
+// DELETE IN 11.0.0, replaced by ListKubeClusterNamesWithFilters
 func KubeClusterNames(ctx context.Context, p KubeServicesPresence) ([]string, error) {
 	kss, err := p.GetKubeServices(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	return extractAndSortKubeClusterNames(kss), nil
+}
+
+// ListKubeClusterNamesWithFilters returns a sorted list of unique kubernetes clusters
+// registered in p.
+func ListKubeClusterNamesWithFilters(ctx context.Context, p client.ListResourcesClient, req proto.ListResourcesRequest) ([]string, error) {
+	req.ResourceType = types.KindKubeService
+	var kss []types.Server
+
+	resources, err := client.GetResourcesWithFilters(ctx, p, req)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	kss, err = types.ResourcesWithLabels(resources).AsServers()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return extractAndSortKubeClusterNames(kss), nil
+}
+
+func extractAndSortKubeClusterNames(kss []types.Server) []string {
 	kubeClusters := make(map[string]struct{})
 	for _, ks := range kss {
 		for _, kc := range ks.GetKubernetesClusters() {
@@ -167,7 +194,7 @@ func KubeClusterNames(ctx context.Context, p KubeServicesPresence) ([]string, er
 		kubeClusterNames = append(kubeClusterNames, n)
 	}
 	sort.Strings(kubeClusterNames)
-	return kubeClusterNames, nil
+	return kubeClusterNames
 }
 
 // CheckOrSetKubeCluster validates kubeClusterName if it's set, or a sane
diff --git a/lib/kube/utils/utils_test.go b/lib/kube/utils/utils_test.go
index 5b4e387d2aa7e..dd29fdce70afb 100644
--- a/lib/kube/utils/utils_test.go
+++ b/lib/kube/utils/utils_test.go
@@ -120,3 +120,33 @@ func kubeService(kubeClusters ...string) types.Server {
 		},
 	}
 }
+
+func TestExtractAndSortKubeClusterNames(t *testing.T) {
+	t.Parallel()
+
+	server1, err := types.NewServer("foo", types.KindNode, types.ServerSpecV2{
+		KubernetesClusters: []*types.KubernetesCluster{
+			{Name: "watermelon"},
+		},
+	})
+	require.NoError(t, err)
+
+	server2, err := types.NewServer("foo", types.KindNode, types.ServerSpecV2{
+		KubernetesClusters: []*types.KubernetesCluster{
+			{Name: "watermelon"},
+		},
+	})
+	require.NoError(t, err)
+
+	server3, err := types.NewServer("bar", types.KindNode, types.ServerSpecV2{
+		KubernetesClusters: []*types.KubernetesCluster{
+			{Name: "banana"},
+			{Name: "apple"},
+			{Name: "pear"},
+		},
+	})
+	require.NoError(t, err)
+
+	names := extractAndSortKubeClusterNames([]types.Server{server1, server2, server3})
+	require.Equal(t, []string{"apple", "banana", "pear", "watermelon"}, names)
+}
diff --git a/lib/multiplexer/multiplexer_test.go b/lib/multiplexer/multiplexer_test.go
index 7272784d9ef0a..f87af998a11dc 100644
--- a/lib/multiplexer/multiplexer_test.go
+++ b/lib/multiplexer/multiplexer_test.go
@@ -26,7 +26,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -122,7 +121,7 @@ func TestMux(t *testing.T) {
 		re, err := client.Get(backend1.URL)
 		require.Nil(t, err)
 		defer re.Body.Close()
-		bytes, err := ioutil.ReadAll(re.Body)
+		bytes, err := io.ReadAll(re.Body)
 		require.Nil(t, err)
 		require.Equal(t, string(bytes), "backend 1")
 
@@ -345,7 +344,7 @@ func TestMux(t *testing.T) {
 		re, err := client.Get(backend1.URL)
 		require.Nil(t, err)
 		defer re.Body.Close()
-		bytes, err := ioutil.ReadAll(re.Body)
+		bytes, err := io.ReadAll(re.Body)
 		require.Nil(t, err)
 		require.Equal(t, string(bytes), "backend 1")
 
@@ -482,7 +481,7 @@ func TestMux(t *testing.T) {
 		re, err := client.Get(url)
 		require.Nil(t, err)
 		defer re.Body.Close()
-		bytes, err := ioutil.ReadAll(re.Body)
+		bytes, err := io.ReadAll(re.Body)
 		require.Nil(t, err)
 		require.Equal(t, string(bytes), "http backend")
 
diff --git a/lib/restrictedsession/restricted_test.go b/lib/restrictedsession/restricted_test.go
index 4c6e86291b841..4fabd1d73b7b9 100644
--- a/lib/restrictedsession/restricted_test.go
+++ b/lib/restrictedsession/restricted_test.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"regexp"
@@ -193,7 +192,7 @@ func (s *Suite) SetUpSuite(c *check.C) {
 	}
 
 	// Create temporary directory where cgroup2 hierarchy will be mounted.
-	s.cgroupDir, err = ioutil.TempDir("", "cgroup-test")
+	s.cgroupDir, err = os.MkdirTemp("", "cgroup-test")
 	c.Assert(err, check.IsNil)
 
 	// Create BPF service since we piggy-back on it
diff --git a/lib/reversetunnel/agent.go b/lib/reversetunnel/agent.go
index 8f040c6974b3a..a5c8b97fd1162 100644
--- a/lib/reversetunnel/agent.go
+++ b/lib/reversetunnel/agent.go
@@ -245,7 +245,7 @@ func (a *Agent) getPrincipalsList() []string {
 }
 
 func (a *Agent) getHostCheckers() ([]ssh.PublicKey, error) {
-	cas, err := a.AccessPoint.GetCertAuthorities(types.HostCA, false)
+	cas, err := a.AccessPoint.GetCertAuthorities(context.TODO(), types.HostCA, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -264,7 +264,9 @@ func (a *Agent) getHostCheckers() ([]ssh.PublicKey, error) {
 // If this is Web Service port check if proxy support ALPN SNI Listener.
 func (a *Agent) getReverseTunnelDetails() *reverseTunnelDetails {
 	pd := reverseTunnelDetails{TLSRoutingEnabled: false}
-	resp, err := webclient.Find(a.ctx, a.Addr.Addr, lib.IsInsecureDevMode(), nil)
+	resp, err := webclient.Find(
+		&webclient.Config{Context: a.ctx, ProxyAddr: a.Addr.Addr, Insecure: lib.IsInsecureDevMode()})
+
 	if err != nil {
 		// If TLS Routing is disabled the address is the proxy reverse tunnel
 		// address the ping call will always fail.
diff --git a/lib/reversetunnel/agent_test.go b/lib/reversetunnel/agent_test.go
index 76597fbbb482e..dea1134680a57 100644
--- a/lib/reversetunnel/agent_test.go
+++ b/lib/reversetunnel/agent_test.go
@@ -89,7 +89,7 @@ type fakeClient struct {
 	caKey ssh.PublicKey
 }
 
-func (fc *fakeClient) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (fc *fakeClient) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
 		Type:         types.HostCA,
 		ClusterName:  "example.com",
diff --git a/lib/reversetunnel/api.go b/lib/reversetunnel/api.go
index 34fc9d572700a..952b1420ffc69 100644
--- a/lib/reversetunnel/api.go
+++ b/lib/reversetunnel/api.go
@@ -123,3 +123,18 @@ type Server interface {
 	// Wait waits for server to close all outstanding operations
 	Wait()
 }
+
+const (
+	// NoApplicationTunnel is the error message returned when application
+	// reverse tunnel cannot be found.
+	//
+	// It usually happens when an app agent has shut down (or crashed) but
+	// hasn't expired from the backend yet.
+	NoApplicationTunnel = "could not find reverse tunnel, check that Application Service agent proxying this application is up and running"
+	// NoDatabaseTunnel is the error message returned when database reverse
+	// tunnel cannot be found.
+	//
+	// It usually happens when a database agent has shut down (or crashed) but
+	// hasn't expired from the backend yet.
+	NoDatabaseTunnel = "could not find reverse tunnel, check that Database Service agent proxying this database is up and running"
+)
diff --git a/lib/reversetunnel/conn.go b/lib/reversetunnel/conn.go
index 63b58a148391d..557b585f2b8fa 100644
--- a/lib/reversetunnel/conn.go
+++ b/lib/reversetunnel/conn.go
@@ -17,7 +17,6 @@ limitations under the License.
 package reversetunnel
 
 import (
-	"context"
 	"fmt"
 	"net"
 	"sync"
@@ -67,11 +66,6 @@ type remoteConn struct {
 	// Used to make sure calling Close on the connection multiple times is safe.
 	closed int32
 
-	// closeContext and closeCancel are used to signal to any waiting goroutines
-	// that the remoteConn is now closed and to release any resources.
-	closeContext context.Context
-	closeCancel  context.CancelFunc
-
 	// clock is used to control time in tests.
 	clock clockwork.Clock
 
@@ -115,8 +109,6 @@ func newRemoteConn(cfg *connConfig) *remoteConn {
 		newProxiesC: make(chan []types.Server, 100),
 	}
 
-	c.closeContext, c.closeCancel = context.WithCancel(context.Background())
-
 	return c
 }
 
@@ -125,8 +117,6 @@ func (c *remoteConn) String() string {
 }
 
 func (c *remoteConn) Close() error {
-	defer c.closeCancel()
-
 	// If the connection has already been closed, return right away.
 	if !atomic.CompareAndSwapInt32(&c.closed, 0, 1) {
 		return nil
diff --git a/lib/reversetunnel/fake.go b/lib/reversetunnel/fake.go
index ab01542329d30..c7e3a9bcca62c 100644
--- a/lib/reversetunnel/fake.go
+++ b/lib/reversetunnel/fake.go
@@ -18,9 +18,9 @@ package reversetunnel
 
 import (
 	"net"
+	"sync"
 
 	"github.com/gravitational/teleport/lib/auth"
-
 	"github.com/gravitational/trace"
 )
 
@@ -51,12 +51,25 @@ type FakeRemoteSite struct {
 	RemoteSite
 	// Name is the remote site name.
 	Name string
-	// ConnCh receives the connection when dialing this site.
-	ConnCh chan net.Conn
 	// AccessPoint is the auth server client.
 	AccessPoint auth.RemoteProxyAccessPoint
 	// OfflineTunnels is a list of server IDs that will return connection error.
 	OfflineTunnels map[string]struct{}
+	// connCh receives the connection when dialing this site.
+	connCh chan net.Conn
+	// closedMtx is a mutex that protects closed.
+	closedMtx sync.Mutex
+	// closed is set to true after the site is being closed.
+	closed bool
+}
+
+// NewFakeRemoteSite is a FakeRemoteSite constructor.
+func NewFakeRemoteSite(clusterName string, accessPoint auth.RemoteProxyAccessPoint) *FakeRemoteSite {
+	return &FakeRemoteSite{
+		Name:        clusterName,
+		connCh:      make(chan net.Conn),
+		AccessPoint: accessPoint,
+	}
 }
 
 // CachingAccessPoint returns caching auth server client.
@@ -69,13 +82,33 @@ func (s *FakeRemoteSite) GetName() string {
 	return s.Name
 }
 
+// ProxyConn returns proxy connection channel with incoming connections.
+func (s *FakeRemoteSite) ProxyConn() <-chan net.Conn {
+	return s.connCh
+}
+
 // Dial returns the connection to the remote site.
 func (s *FakeRemoteSite) Dial(params DialParams) (net.Conn, error) {
 	if _, ok := s.OfflineTunnels[params.ServerID]; ok {
 		return nil, trace.ConnectionProblem(nil, "server %v tunnel is offline",
 			params.ServerID)
 	}
+
+	s.closedMtx.Lock()
+	defer s.closedMtx.Unlock()
+
+	if s.closed {
+		return nil, trace.ConnectionProblem(nil, "tunnel has been closed")
+	}
+
 	readerConn, writerConn := net.Pipe()
-	s.ConnCh <- readerConn
+	s.connCh <- readerConn
 	return writerConn, nil
 }
+
+func (s *FakeRemoteSite) Close() {
+	s.closedMtx.Lock()
+	defer s.closedMtx.Unlock()
+	close(s.connCh)
+	s.closed = true
+}
diff --git a/lib/reversetunnel/localsite.go b/lib/reversetunnel/localsite.go
index 3a33f1447dbe2..440c188f5779f 100644
--- a/lib/reversetunnel/localsite.go
+++ b/lib/reversetunnel/localsite.go
@@ -67,7 +67,7 @@ func newlocalSite(srv *server, domainName string, client auth.ClientI) (*localSi
 		accessPoint:      accessPoint,
 		certificateCache: certificateCache,
 		domainName:       domainName,
-		remoteConns:      make(map[connKey]*remoteConn),
+		remoteConns:      make(map[connKey][]*remoteConn),
 		clock:            srv.Clock,
 		log: log.WithFields(log.Fields{
 			trace.Component: teleport.ComponentReverseTunnelServer,
@@ -89,8 +89,6 @@ func newlocalSite(srv *server, domainName string, client auth.ClientI) (*localSi
 //
 // it implements RemoteSite interface
 type localSite struct {
-	sync.Mutex
-
 	log        log.FieldLogger
 	domainName string
 	srv        *server
@@ -104,8 +102,11 @@ type localSite struct {
 	// certificateCache caches host certificates for the forwarding server.
 	certificateCache *certificateCache
 
-	// remoteConns maps UUID and connection type to an remote connection.
-	remoteConns map[connKey]*remoteConn
+	// remoteConns maps UUID and connection type to remote connections, oldest to newest.
+	remoteConns map[connKey][]*remoteConn
+
+	// remoteConnsMtx protects remoteConns.
+	remoteConnsMtx sync.Mutex
 
 	// clock is used to control time in tests.
 	clock clockwork.Clock
@@ -117,8 +118,8 @@ type localSite struct {
 
 // GetTunnelsCount always the number of tunnel connections to this cluster.
 func (s *localSite) GetTunnelsCount() int {
-	s.Lock()
-	defer s.Unlock()
+	s.remoteConnsMtx.Lock()
+	defer s.remoteConnsMtx.Unlock()
 
 	return len(s.remoteConns)
 }
@@ -203,7 +204,7 @@ func (s *localSite) DialTCP(params DialParams) (net.Conn, error) {
 	}
 	s.log.Debugf("Succeeded dialing %v.", params)
 
-	return newEmitConn(s.srv.ctx, conn, s.client, s.srv.ID), nil
+	return conn, nil
 }
 
 // IsClosed always returns false because localSite is never closed.
@@ -349,8 +350,8 @@ with the cluster.`
 }
 
 func (s *localSite) addConn(nodeID string, connType types.TunnelType, conn net.Conn, sconn ssh.Conn) (*remoteConn, error) {
-	s.Lock()
-	defer s.Unlock()
+	s.remoteConnsMtx.Lock()
+	defer s.remoteConnsMtx.Unlock()
 
 	rconn := newRemoteConn(&connConfig{
 		conn:             conn,
@@ -365,7 +366,7 @@ func (s *localSite) addConn(nodeID string, connType types.TunnelType, conn net.C
 		uuid:     nodeID,
 		connType: connType,
 	}
-	s.remoteConns[key] = rconn
+	s.remoteConns[key] = append(s.remoteConns[key], rconn)
 
 	return rconn, nil
 }
@@ -374,10 +375,13 @@ func (s *localSite) addConn(nodeID string, connType types.TunnelType, conn net.C
 // list so that remote connection can notify the remote agent
 // about the list update
 func (s *localSite) fanOutProxies(proxies []types.Server) {
-	s.Lock()
-	defer s.Unlock()
-	for _, conn := range s.remoteConns {
-		conn.updateProxies(proxies)
+	s.remoteConnsMtx.Lock()
+	defer s.remoteConnsMtx.Unlock()
+
+	for _, conns := range s.remoteConns {
+		for _, conn := range conns {
+			conn.updateProxies(proxies)
+		}
 	}
 }
 
@@ -446,14 +450,22 @@ func (s *localSite) handleHeartbeat(rconn *remoteConn, ch ssh.Channel, reqC <-ch
 }
 
 func (s *localSite) getRemoteConn(dreq *sshutils.DialReq) (*remoteConn, error) {
-	s.Lock()
-	defer s.Unlock()
+	s.remoteConnsMtx.Lock()
+	defer s.remoteConnsMtx.Unlock()
 
 	// Loop over all connections and remove and invalid connections from the
 	// connection map.
-	for key := range s.remoteConns {
-		if s.remoteConns[key].isInvalid() {
+	for key, conns := range s.remoteConns {
+		validConns := conns[:0]
+		for _, conn := range conns {
+			if !conn.isInvalid() {
+				validConns = append(validConns, conn)
+			}
+		}
+		if len(validConns) == 0 {
 			delete(s.remoteConns, key)
+		} else {
+			s.remoteConns[key] = validConns
 		}
 	}
 
@@ -461,15 +473,17 @@ func (s *localSite) getRemoteConn(dreq *sshutils.DialReq) (*remoteConn, error) {
 		uuid:     dreq.ServerID,
 		connType: dreq.ConnType,
 	}
-	rconn, ok := s.remoteConns[key]
-	if !ok {
+	if len(s.remoteConns[key]) == 0 {
 		return nil, trace.NotFound("no %v reverse tunnel for %v found", dreq.ConnType, dreq.ServerID)
 	}
-	if !rconn.isReady() {
-		return nil, trace.NotFound("%v is offline: no active %v tunnels found", dreq.ConnType, dreq.ServerID)
-	}
 
-	return rconn, nil
+	conns := s.remoteConns[key]
+	for i := len(conns) - 1; i >= 0; i-- {
+		if conns[i].isReady() {
+			return conns[i], nil
+		}
+	}
+	return nil, trace.NotFound("%v is offline: no active %v tunnels found", dreq.ConnType, dreq.ServerID)
 }
 
 func (s *localSite) chanTransportConn(rconn *remoteConn, dreq *sshutils.DialReq) (net.Conn, error) {
diff --git a/lib/reversetunnel/localsite_test.go b/lib/reversetunnel/localsite_test.go
new file mode 100644
index 0000000000000..34156bf046247
--- /dev/null
+++ b/lib/reversetunnel/localsite_test.go
@@ -0,0 +1,101 @@
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package reversetunnel
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/sshutils"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLocalSiteOverlap(t *testing.T) {
+	t.Parallel()
+
+	// to stop (*localSite).periodicFunctions()
+	ctx, ctxCancel := context.WithCancel(context.Background())
+	ctxCancel()
+
+	srv := &server{
+		ctx: ctx,
+		newAccessPoint: func(clt auth.ClientI, _ []string) (auth.RemoteProxyAccessPoint, error) {
+			return clt, nil
+		},
+	}
+
+	site, err := newlocalSite(srv, "clustername", &mockLocalSiteClient{})
+	require.NoError(t, err)
+
+	nodeID := uuid.NewString()
+	connType := types.NodeTunnel
+	dreq := &sshutils.DialReq{
+		ServerID: nodeID,
+		ConnType: connType,
+	}
+
+	conn1, err := site.addConn(nodeID, connType, mockRemoteConnConn{}, nil)
+	require.NoError(t, err)
+
+	conn2, err := site.addConn(nodeID, connType, mockRemoteConnConn{}, nil)
+	require.NoError(t, err)
+
+	c, err := site.getRemoteConn(dreq)
+	require.True(t, trace.IsNotFound(err))
+	require.Nil(t, c)
+
+	conn1.setLastHeartbeat(time.Now())
+	c, err = site.getRemoteConn(dreq)
+	require.NoError(t, err)
+	require.Equal(t, conn1, c)
+
+	conn2.setLastHeartbeat(time.Now())
+	c, err = site.getRemoteConn(dreq)
+	require.NoError(t, err)
+	require.Equal(t, conn2, c)
+
+	conn2.markInvalid(nil)
+	c, err = site.getRemoteConn(dreq)
+	require.NoError(t, err)
+	require.Equal(t, conn1, c)
+
+	conn1.markInvalid(nil)
+	c, err = site.getRemoteConn(dreq)
+	require.True(t, trace.IsNotFound(err))
+	require.Nil(t, c)
+}
+
+type mockLocalSiteClient struct {
+	auth.Client
+}
+
+// called by (*localSite).sshTunnelStats() as part of (*localSite).periodicFunctions()
+func (mockLocalSiteClient) GetNodes(_ context.Context, _ string, _ ...services.MarshalOption) ([]types.Server, error) {
+	return nil, nil
+}
+
+type mockRemoteConnConn struct {
+	net.Conn
+}
+
+// called for logging by (*remoteConn).markInvalid()
+func (mockRemoteConnConn) RemoteAddr() net.Addr { return nil }
diff --git a/lib/reversetunnel/remotesite.go b/lib/reversetunnel/remotesite.go
index 69fcb4192bde7..7fb01bea51cbf 100644
--- a/lib/reversetunnel/remotesite.go
+++ b/lib/reversetunnel/remotesite.go
@@ -89,7 +89,7 @@ type remoteSite struct {
 
 func (s *remoteSite) getRemoteClient() (auth.ClientI, bool, error) {
 	// check if all cert authorities are initiated and if everything is OK
-	ca, err := s.srv.localAccessPoint.GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: s.domainName}, false)
+	ca, err := s.srv.localAccessPoint.GetCertAuthority(s.ctx, types.CertAuthID{Type: types.HostCA, DomainName: s.domainName}, false)
 	if err != nil {
 		return nil, false, trace.Wrap(err)
 	}
@@ -493,7 +493,7 @@ func (s *remoteSite) watchCertAuthorities() error {
 					continue
 				}
 
-				if err := s.remoteClient.RotateExternalCertAuthority(localCA); err != nil {
+				if err := s.remoteClient.RotateExternalCertAuthority(s.ctx, localCA); err != nil {
 					s.WithError(err).Warn("Failed to rotate external ca")
 					return trace.Wrap(err)
 				}
@@ -505,7 +505,7 @@ func (s *remoteSite) watchCertAuthorities() error {
 					continue
 				}
 
-				oldRemoteCA, err := s.localClient.GetCertAuthority(types.CertAuthID{
+				oldRemoteCA, err := s.localClient.GetCertAuthority(s.ctx, types.CertAuthID{
 					Type:       types.HostCA,
 					DomainName: remoteCA.GetClusterName(),
 				}, false)
diff --git a/lib/reversetunnel/resolver.go b/lib/reversetunnel/resolver.go
index a467f5214577b..528063a0acbc3 100644
--- a/lib/reversetunnel/resolver.go
+++ b/lib/reversetunnel/resolver.go
@@ -58,7 +58,9 @@ func WebClientResolver(ctx context.Context, addrs []utils.NetAddr, insecureTLS b
 		for _, addr := range addrs {
 			// In insecure mode, any certificate is accepted. In secure mode the hosts
 			// CAs are used to validate the certificate on the proxy.
-			tunnelAddr, err := webclient.GetTunnelAddr(ctx, addr.String(), insecureTLS, nil)
+			tunnelAddr, err := webclient.GetTunnelAddr(
+				&webclient.Config{Context: ctx, ProxyAddr: addr.String(), Insecure: insecureTLS})
+
 			if err != nil {
 				errs = append(errs, err)
 				continue
diff --git a/lib/reversetunnel/srv.go b/lib/reversetunnel/srv.go
index 67e16a01ee959..40eb296354719 100644
--- a/lib/reversetunnel/srv.go
+++ b/lib/reversetunnel/srv.go
@@ -724,7 +724,7 @@ func (s *server) findLocalCluster(sconn *ssh.ServerConn) (*localSite, error) {
 }
 
 func (s *server) getTrustedCAKeysByID(id types.CertAuthID) ([]ssh.PublicKey, error) {
-	ca, err := s.localAccessPoint.GetCertAuthority(id, false)
+	ca, err := s.localAccessPoint.GetCertAuthority(context.TODO(), id, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/reversetunnel/srv_test.go b/lib/reversetunnel/srv_test.go
index e0747f0630dcc..792b39959735b 100644
--- a/lib/reversetunnel/srv_test.go
+++ b/lib/reversetunnel/srv_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package reversetunnel
 
 import (
+	"context"
 	"net"
 	"testing"
 	"time"
@@ -155,6 +156,6 @@ type mockAccessPoint struct {
 	ca types.CertAuthority
 }
 
-func (ap mockAccessPoint) GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (ap mockAccessPoint) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	return ap.ca, nil
 }
diff --git a/lib/reversetunnel/transport.go b/lib/reversetunnel/transport.go
index 65237ca5514e4..923a4a3cf8705 100644
--- a/lib/reversetunnel/transport.go
+++ b/lib/reversetunnel/transport.go
@@ -23,7 +23,6 @@ import (
 	"fmt"
 	"io"
 	"net"
-	"strings"
 	"time"
 
 	"golang.org/x/crypto/ssh"
@@ -93,7 +92,8 @@ func (t *TunnelAuthDialer) DialContext(ctx context.Context, _, _ string) (net.Co
 	}
 
 	// Check if t.ProxyAddr is ProxyWebPort and remote Proxy supports TLS ALPNSNIListener.
-	resp, err := webclient.Find(ctx, addr.Addr, t.InsecureSkipTLSVerify, nil)
+	resp, err := webclient.Find(
+		&webclient.Config{Context: ctx, ProxyAddr: addr.Addr, Insecure: t.InsecureSkipTLSVerify})
 	if err != nil {
 		// If TLS Routing is disabled the address is the proxy reverse tunnel
 		// address thus the ping call will always fail.
@@ -379,9 +379,13 @@ func (p *transport) getConn(servers []string, r *sshutils.DialReq) (net.Conn, bo
 			return nil, false, trace.Wrap(err)
 		}
 
-		// Connections to applications should never occur over a direct dial, return right away.
-		if r.ConnType == types.AppTunnel {
-			return nil, false, trace.ConnectionProblem(err, "failed to connect to application")
+		// Connections to applications and databases should never occur over
+		// a direct dial, return right away.
+		switch r.ConnType {
+		case types.AppTunnel:
+			return nil, false, trace.ConnectionProblem(err, NoApplicationTunnel)
+		case types.DatabaseTunnel:
+			return nil, false, trace.ConnectionProblem(err, NoDatabaseTunnel)
 		}
 
 		errTun := err
@@ -441,7 +445,7 @@ func (p *transport) directDial(servers []string, serverID string) (net.Conn, err
 	for _, addr := range servers {
 		conn, err := net.Dial("tcp", addr)
 		if err == nil {
-			return newEmitConn(p.closeContext, conn, p.emitter, strings.Split(serverID, ".")[0]), nil
+			return conn, nil
 		}
 
 		errors = append(errors, err)
diff --git a/lib/service/connect.go b/lib/service/connect.go
index 669dad410bffd..4f9a3fdad1f05 100644
--- a/lib/service/connect.go
+++ b/lib/service/connect.go
@@ -320,9 +320,9 @@ func (process *TeleportProcess) newWatcher(conn *Connector, watch types.Watch) (
 // TLS client this method uses the local auth server.
 func (process *TeleportProcess) getCertAuthority(conn *Connector, id types.CertAuthID, loadPrivateKeys bool) (types.CertAuthority, error) {
 	if conn.ClientIdentity.ID.Role == types.RoleAdmin || conn.ClientIdentity.ID.Role == types.RoleAuth {
-		return process.localAuth.GetCertAuthority(id, loadPrivateKeys)
+		return process.localAuth.GetCertAuthority(process.ExitContext(), id, loadPrivateKeys)
 	}
-	return conn.Client.GetCertAuthority(id, loadPrivateKeys)
+	return conn.Client.GetCertAuthority(process.ExitContext(), id, loadPrivateKeys)
 }
 
 // reRegister receives new identity credentials for proxy, node and auth.
diff --git a/lib/service/desktop.go b/lib/service/desktop.go
index e281cbce997b7..8263c7d9f9fed 100644
--- a/lib/service/desktop.go
+++ b/lib/service/desktop.go
@@ -226,6 +226,7 @@ func (process *TeleportProcess) initWindowsDesktopServiceRegistered(log *logrus.
 		LDAPConfig:           desktop.LDAPConfig(cfg.WindowsDesktop.LDAP),
 		DiscoveryBaseDN:      cfg.WindowsDesktop.Discovery.BaseDN,
 		DiscoveryLDAPFilters: cfg.WindowsDesktop.Discovery.Filters,
+		Hostname:             cfg.Hostname,
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/service/service.go b/lib/service/service.go
index 0c64fb0f67ef6..4ce4847aa6b34 100644
--- a/lib/service/service.go
+++ b/lib/service/service.go
@@ -26,7 +26,6 @@ import (
 	"encoding/hex"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -1579,7 +1578,6 @@ func (process *TeleportProcess) newAccessCache(cfg accessCacheConfig) (*cache.Ca
 			lite.Config{
 				Path:             path,
 				EventsOff:        !cfg.events,
-				Memory:           false,
 				Mirror:           true,
 				PollStreamPeriod: 100 * time.Millisecond,
 			})
@@ -2130,36 +2128,6 @@ func (process *TeleportProcess) initUploaderService(streamer events.Streamer, au
 		}
 	}
 
-	// DELETE IN (5.1.0)
-	// this uploader was superseded by filesessions.Uploader,
-	// see below
-	uploader, err := events.NewUploader(events.UploaderConfig{
-		DataDir:   filepath.Join(process.Config.DataDir, teleport.LogsDir),
-		Namespace: apidefaults.Namespace,
-		ServerID:  teleport.ComponentUpload,
-		AuditLog:  auditLog,
-		EventsC:   process.Config.UploadEventsC,
-	})
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	process.RegisterFunc("uploader.service", func() error {
-		err := uploader.Serve()
-		if err != nil {
-			log.Errorf("Uploader server exited with error: %v.", err)
-		}
-		return nil
-	})
-
-	process.OnExit("uploader.shutdown", func(payload interface{}) {
-		log.Infof("Shutting down.")
-		warnOnErr(uploader.Stop(), log)
-		log.Infof("Exited.")
-	})
-
-	// This uploader supersedes the events.Uploader above,
-	// that is kept for backwards compatibility purposes for one release.
-	// Delete this comment once the uploader above is phased out.
 	fileUploader, err := filesessions.NewUploader(filesessions.UploaderConfig{
 		ScanDir:  filepath.Join(streamingDir...),
 		Streamer: streamer,
@@ -2218,7 +2186,7 @@ func (process *TeleportProcess) initMetricsService() error {
 
 		pool := x509.NewCertPool()
 		for _, caCertPath := range process.Config.Metrics.CACerts {
-			caCert, err := ioutil.ReadFile(caCertPath)
+			caCert, err := os.ReadFile(caCertPath)
 			if err != nil {
 				return trace.Wrap(err, "failed to read prometheus CA certificate %+v", caCertPath)
 			}
@@ -2394,6 +2362,11 @@ func (process *TeleportProcess) getAdditionalPrincipals(role types.SystemRole) (
 		principals = append(principals, process.Config.Hostname)
 	}
 	var addrs []utils.NetAddr
+
+	// Add default DNSNames to the dnsNames list.
+	// For identities generated by teleport <= v6.1.6 the teleport.cluster.local DNS is not present
+	dnsNames = append(dnsNames, auth.DefaultDNSNamesForRole(role)...)
+
 	switch role {
 	case types.RoleProxy:
 		addrs = append(process.Config.Proxy.PublicAddrs,
@@ -3219,7 +3192,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 	var grpcServer *grpc.Server
 	if alpnRouter != nil {
-		grpcServer := grpc.NewServer(
+		grpcServer = grpc.NewServer(
 			grpc.ChainUnaryInterceptor(
 				utils.ErrorConvertUnaryInterceptor,
 				proxyLimiter.UnaryServerInterceptor(),
@@ -3784,9 +3757,6 @@ func (process *TeleportProcess) initAuthStorage() (bk backend.Backend, err error
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := bk.Migrate(ctx); err != nil {
-		return nil, trace.Wrap(err)
-	}
 	reporter, err := backend.NewReporter(backend.ReporterConfig{
 		Component: teleport.ComponentBackend,
 		Backend:   backend.NewSanitizer(bk),
@@ -3828,12 +3798,18 @@ func (process *TeleportProcess) StartShutdown(ctx context.Context) context.Conte
 			process.log.Warnf("Error waiting for all services to complete: %v", err)
 		}
 		process.log.Debug("All supervisor functions are completed.")
-		localAuth := process.getLocalAuth()
-		if localAuth != nil {
-			if err := process.localAuth.Close(); err != nil {
+
+		if localAuth := process.getLocalAuth(); localAuth != nil {
+			if err := localAuth.Close(); err != nil {
 				process.log.Warningf("Failed closing auth server: %v.", err)
 			}
 		}
+
+		if process.storage != nil {
+			if err := process.storage.Close(); err != nil {
+				process.log.Warningf("Failed closing process storage: %v.", err)
+			}
+		}
 	}()
 	go process.printShutdownStatus(localCtx)
 	return localCtx
@@ -3855,9 +3831,9 @@ func (process *TeleportProcess) Close() error {
 	process.Config.Keygen.Close()
 
 	var errors []error
-	localAuth := process.getLocalAuth()
-	if localAuth != nil {
-		errors = append(errors, process.localAuth.Close())
+
+	if localAuth := process.getLocalAuth(); localAuth != nil {
+		errors = append(errors, localAuth.Close())
 	}
 
 	if process.storage != nil {
@@ -3878,7 +3854,7 @@ func validateConfig(cfg *Config) error {
 	}
 
 	if cfg.Console == nil {
-		cfg.Console = ioutil.Discard
+		cfg.Console = io.Discard
 	}
 
 	if len(cfg.AuthServers) == 0 {
@@ -3932,10 +3908,10 @@ func initSelfSignedHTTPSCert(cfg *Config) (err error) {
 		return trace.Wrap(err)
 	}
 
-	if err := ioutil.WriteFile(keyPath, creds.PrivateKey, 0600); err != nil {
+	if err := os.WriteFile(keyPath, creds.PrivateKey, 0600); err != nil {
 		return trace.Wrap(err, "error writing key PEM")
 	}
-	if err := ioutil.WriteFile(certPath, creds.Cert, 0600); err != nil {
+	if err := os.WriteFile(certPath, creds.Cert, 0600); err != nil {
 		return trace.Wrap(err, "error writing key PEM")
 	}
 	return nil
@@ -4036,7 +4012,8 @@ func getPublicAddr(authClient auth.ReadAppsAccessPoint, a App) (string, error) {
 	for {
 		select {
 		case <-ticker.C:
-			publicAddr, err := findPublicAddr(authClient, a)
+			publicAddr, err := app.FindPublicAddr(authClient, a.PublicAddr, a.Name)
+
 			if err == nil {
 				return publicAddr, nil
 			}
@@ -4046,37 +4023,6 @@ func getPublicAddr(authClient auth.ReadAppsAccessPoint, a App) (string, error) {
 	}
 }
 
-// findPublicAddr tries to resolve the public address of the proxy of this cluster.
-func findPublicAddr(authClient auth.ReadAppsAccessPoint, a App) (string, error) {
-	// If the application has a public address already set, use it.
-	if a.PublicAddr != "" {
-		return a.PublicAddr, nil
-	}
-
-	// Fetch list of proxies, if first has public address set, use it.
-	servers, err := authClient.GetProxies()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	if len(servers) == 0 {
-		return "", trace.BadParameter("cluster has no proxied registered, at least one proxy must be registered for application access")
-	}
-	if servers[0].GetPublicAddr() != "" {
-		addr, err := utils.ParseAddr(servers[0].GetPublicAddr())
-		if err != nil {
-			return "", trace.Wrap(err)
-		}
-		return fmt.Sprintf("%v.%v", a.Name, addr.Host()), nil
-	}
-
-	// Fall back to cluster name.
-	cn, err := authClient.GetClusterName()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	return fmt.Sprintf("%v.%v", a.Name, cn.GetClusterName()), nil
-}
-
 // newHTTPFileSystem creates a new HTTP file system for the web handler.
 // It uses external configuration to make the decision
 func newHTTPFileSystem() (http.FileSystem, error) {
diff --git a/lib/service/service_test.go b/lib/service/service_test.go
index 0b7fa5fedc04e..8c233409bb238 100644
--- a/lib/service/service_test.go
+++ b/lib/service/service_test.go
@@ -18,7 +18,6 @@ package service
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"strings"
@@ -88,15 +87,11 @@ func TestMonitor(t *testing.T) {
 	cfg := MakeDefaultConfig()
 	cfg.Clock = fakeClock
 	var err error
-	cfg.DataDir, err = ioutil.TempDir("", "teleport")
-	require.NoError(t, err)
-	defer os.RemoveAll(cfg.DataDir)
+	cfg.DataDir = t.TempDir()
 	cfg.DiagnosticAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
 	cfg.AuthServers = []utils.NetAddr{{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}}
 	cfg.Auth.Enabled = true
-	cfg.Auth.StorageConfig.Params["path"], err = ioutil.TempDir("", "teleport")
-	require.NoError(t, err)
-	defer os.RemoveAll(cfg.DataDir)
+	cfg.Auth.StorageConfig.Params["path"] = t.TempDir()
 	cfg.Auth.SSHAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
 	cfg.Proxy.Enabled = false
 	cfg.SSH.Enabled = false
@@ -347,6 +342,8 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"proxy-kube-public-2",
 			},
 			wantDNS: []string{
+				"*.teleport.cluster.local",
+				"teleport.cluster.local",
 				"*.proxy-public-1",
 				"*.proxy-public-2",
 				"*.proxy-kube-public-1",
@@ -360,7 +357,10 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"auth-public-1",
 				"auth-public-2",
 			},
-			wantDNS: []string{},
+			wantDNS: []string{
+				"*.teleport.cluster.local",
+				"teleport.cluster.local",
+			},
 		},
 		{
 			role: types.RoleAdmin,
@@ -369,7 +369,10 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"auth-public-1",
 				"auth-public-2",
 			},
-			wantDNS: []string{},
+			wantDNS: []string{
+				"*.teleport.cluster.local",
+				"teleport.cluster.local",
+			},
 		},
 		{
 			role: types.RoleNode,
@@ -393,7 +396,10 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"kube-public-1",
 				"kube-public-2",
 			},
-			wantDNS: []string{},
+			wantDNS: []string{
+				"*.teleport.cluster.local",
+				"teleport.cluster.local",
+			},
 		},
 		{
 			role: types.RoleApp,
@@ -401,7 +407,10 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"global-hostname",
 				"global-uuid",
 			},
-			wantDNS: []string{},
+			wantDNS: []string{
+				"*.teleport.cluster.local",
+				"teleport.cluster.local",
+			},
 		},
 		{
 			role: types.SystemRole("unknown"),
diff --git a/lib/service/state.go b/lib/service/state.go
index c391ae487d3b4..bc6e18685a87b 100644
--- a/lib/service/state.go
+++ b/lib/service/state.go
@@ -88,7 +88,7 @@ func (f *processState) update(event Event) {
 
 	component, ok := event.Payload.(string)
 	if !ok {
-		f.process.log.Errorf("TeleportDegradedEvent broadcasted without component name, this is a bug!")
+		f.process.log.Errorf("%v broadcasted without component name, this is a bug!", event.Name)
 		return
 	}
 	s, ok := f.states[component]
@@ -118,7 +118,7 @@ func (f *processState) update(event Event) {
 			s.recoveryTime = f.process.Clock.Now()
 			f.process.log.Infof("Teleport component %q is recovering from a degraded state.", component)
 		case stateRecovering:
-			if f.process.Clock.Now().Sub(s.recoveryTime) > defaults.HeartbeatCheckPeriod*2 {
+			if f.process.Clock.Since(s.recoveryTime) > defaults.HeartbeatCheckPeriod*2 {
 				s.state = stateOK
 				f.process.log.Infof("Teleport component %q has recovered from a degraded state.", component)
 			}
diff --git a/lib/services/access_request_test.go b/lib/services/access_request_test.go
index f1bbd5584fac0..e7a2fe16384f2 100644
--- a/lib/services/access_request_test.go
+++ b/lib/services/access_request_test.go
@@ -176,7 +176,7 @@ func TestReviewThresholds(t *testing.T) {
 	roles := make(map[string]types.Role)
 
 	for name, conditions := range roleDesc {
-		role, err := types.NewRole(name, types.RoleSpecV5{
+		role, err := types.NewRoleV3(name, types.RoleSpecV5{
 			Allow: conditions,
 		})
 		require.NoError(t, err)
diff --git a/lib/services/database.go b/lib/services/database.go
index eed6b7bea19a6..0d53cbe48cf8d 100644
--- a/lib/services/database.go
+++ b/lib/services/database.go
@@ -31,6 +31,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/aws/aws-sdk-go/service/redshift"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 )
@@ -49,7 +50,7 @@ type Databases interface {
 	DatabaseGetter
 	// CreateDatabase creates a new database resource.
 	CreateDatabase(context.Context, types.Database) error
-	// UpdateDatabse updates an existing database resource.
+	// UpdateDatabase updates an existing database resource.
 	UpdateDatabase(context.Context, types.Database) error
 	// DeleteDatabase removes the specified database resource.
 	DeleteDatabase(ctx context.Context, name string) error
@@ -290,7 +291,7 @@ func engineToProtocol(engine string) string {
 	switch engine {
 	case RDSEnginePostgres, RDSEngineAuroraPostgres:
 		return defaults.ProtocolPostgres
-	case RDSEngineMySQL, RDSEngineAurora, RDSEngineAuroraMySQL:
+	case RDSEngineMySQL, RDSEngineAurora, RDSEngineAuroraMySQL, RDSEngineMariaDB:
 		return defaults.ProtocolMySQL
 	}
 	return ""
@@ -369,6 +370,27 @@ func rdsTagsToLabels(tags []*rds.Tag) map[string]string {
 	return labels
 }
 
+// IsRDSInstanceSupported returns true if database supports IAM authentication.
+// Currently, only MariaDB is being checked.
+func IsRDSInstanceSupported(instance *rds.DBInstance) bool {
+	// TODO(jakule): Check other engines.
+	if aws.StringValue(instance.Engine) != RDSEngineMariaDB {
+		return true
+	}
+
+	// MariaDB follows semver schema: https://mariadb.org/about/
+	ver, err := semver.NewVersion(aws.StringValue(instance.EngineVersion))
+	if err != nil {
+		log.Errorf("Failed to parse RDS MariaDB version: %s", aws.StringValue(instance.EngineVersion))
+		return false
+	}
+
+	// Min supported MariaDB version that supports IAM is 10.6
+	// https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html
+	minIAMSupportedVer := semver.New("10.6.0")
+	return !ver.LessThan(*minIAMSupportedVer)
+}
+
 // IsRDSClusterSupported checks whether the aurora cluster is supported and logs
 // related info if not.
 func IsRDSClusterSupported(cluster *rds.DBCluster) bool {
@@ -390,6 +412,107 @@ func IsRDSClusterSupported(cluster *rds.DBCluster) bool {
 	return true
 }
 
+// IsRDSInstanceAvailable checks if the RDS instance is available.
+func IsRDSInstanceAvailable(instance *rds.DBInstance) bool {
+	// For a full list of status values, see:
+	// https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/accessing-monitoring.html
+	switch aws.StringValue(instance.DBInstanceStatus) {
+	// Statuses marked as "Billed" in the above guide.
+	case "available", "backing-up", "configuring-enhanced-monitoring",
+		"configuring-iam-database-auth", "configuring-log-exports",
+		"converting-to-vpc", "incompatible-option-group",
+		"incompatible-parameters", "maintenance", "modifying", "moving-to-vpc",
+		"rebooting", "resetting-master-credentials", "renaming", "restore-error",
+		"storage-full", "storage-optimization", "upgrading":
+		return true
+
+	// Statuses marked as "Not billed" in the above guide.
+	case "creating", "deleting", "failed",
+		"inaccessible-encryption-credentials", "incompatible-network",
+		"incompatible-restore":
+		return false
+
+	// Statuses marked as "Billed for storage" in the above guide.
+	case "inaccessible-encryption-credentials-recoverable", "starting",
+		"stopped", "stopping":
+		return false
+
+	// Statuses that have no billing information in the above guide, but
+	// believed to be unavailable.
+	case "insufficient-capacity":
+		return false
+
+	default:
+		log.Warnf("Unknown status type: %q. Assuming RDS instance %q is available.",
+			aws.StringValue(instance.DBInstanceStatus),
+			aws.StringValue(instance.DBInstanceIdentifier),
+		)
+		return true
+	}
+}
+
+// IsRDSClusterAvailable checks if the RDS cluster is available.
+func IsRDSClusterAvailable(cluster *rds.DBCluster) bool {
+	// For a full list of status values, see:
+	// https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/accessing-monitoring.html
+	switch aws.StringValue(cluster.Status) {
+	// Statuses marked as "Billed" in the above guide.
+	case "available", "backing-up", "backtracking", "failing-over",
+		"maintenance", "migrating", "modifying", "promoting", "renaming",
+		"resetting-master-credentials", "update-iam-db-auth", "upgrading":
+		return true
+
+	// Statuses marked as "Not billed" in the above guide.
+	case "cloning-failed", "creating", "deleting",
+		"inaccessible-encryption-credentials", "migration-failed":
+		return false
+
+	// Statuses marked as "Billed for storage" in the above guide.
+	case "starting", "stopped", "stopping":
+		return false
+
+	default:
+		log.Warnf("Unknown status type: %q. Assuming Aurora cluster %q is available.",
+			aws.StringValue(cluster.Status),
+			aws.StringValue(cluster.DBClusterIdentifier),
+		)
+		return true
+	}
+}
+
+// IsRedshiftClusterAvailable checks if the Redshift cluster is available.
+func IsRedshiftClusterAvailable(cluster *redshift.Cluster) bool {
+	// For a full list of status values, see:
+	// https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html#rs-mgmt-cluster-status
+	//
+	// Note that the Redshift guide does not specify billing information like
+	// the RDS and Aurora guides do. Most Redshift statuses are
+	// cross-referenced with similar statuses from RDS and Aurora guides to
+	// determine the availability.
+	//
+	// For "incompatible-xxx" statuses, the cluster is assumed to be available
+	// if the status is resulted by modifying the cluster, and the cluster is
+	// assumed to be unavailable if the cluster cannot be created or restored.
+	switch aws.StringValue(cluster.ClusterStatus) {
+	case "available", "available, prep-for-resize", "available, resize-cleanup",
+		"cancelling-resize", "final-snapshot", "modifying", "rebooting",
+		"renaming", "resizing", "rotating-keys", "storage-full", "updating-hsm",
+		"incompatible-parameters", "incompatible-hsm":
+		return true
+
+	case "creating", "deleting", "hardware-failure", "paused",
+		"incompatible-network":
+		return false
+
+	default:
+		log.Warnf("Unknown status type: %q. Assuming Redshift cluster %q is available.",
+			aws.StringValue(cluster.ClusterStatus),
+			aws.StringValue(cluster.ClusterIdentifier),
+		)
+		return true
+	}
+}
+
 // auroraMySQLVersion extracts aurora mysql version from engine version
 func auroraMySQLVersion(cluster *rds.DBCluster) string {
 	// version guide: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Updates.Versions.html
@@ -435,6 +558,8 @@ const (
 	RDSEngineMySQL = "mysql"
 	// RDSEnginePostgres is RDS engine name for Postgres instances.
 	RDSEnginePostgres = "postgres"
+	// RDSEngineMariaDB is RDS engine name for MariaDB instances.
+	RDSEngineMariaDB = "mariadb"
 	// RDSEngineAurora is RDS engine name for Aurora MySQL 5.6 compatible clusters.
 	RDSEngineAurora = "aurora"
 	// RDSEngineAuroraMySQL is RDS engine name for Aurora MySQL 5.7 compatible clusters.
@@ -452,9 +577,9 @@ const (
 	// RDSEndpointTypeReader is the endpoint that load-balances connections across the Aurora Replicas that are
 	// available in a RDS cluster.
 	RDSEndpointTypeReader RDSEndpointType = "reader"
-	// RDSEndpointTypeCustom is the endpoint that specifieds one of the custom endpoints associated with the RDS cluster.
+	// RDSEndpointTypeCustom is the endpoint that specifies one of the custom endpoints associated with the RDS cluster.
 	RDSEndpointTypeCustom RDSEndpointType = "custom"
-	// RDSEndpointTypeInstance is the endpoint of a RDS DB instance.
+	// RDSEndpointTypeInstance is the endpoint of an RDS DB instance.
 	RDSEndpointTypeInstance RDSEndpointType = "instance"
 )
 
diff --git a/lib/services/database_test.go b/lib/services/database_test.go
index c16862d506f3a..0e50fc7243930 100644
--- a/lib/services/database_test.go
+++ b/lib/services/database_test.go
@@ -358,8 +358,57 @@ func TestIsRDSClusterSupported(t *testing.T) {
 				EngineVersion:       aws.String(test.engineVersion),
 			}
 
-			require.Equal(t, test.isSupported, IsRDSClusterSupported(cluster))
+			got, want := IsRDSClusterSupported(cluster), test.isSupported
+			require.Equal(t, want, got, "IsRDSClusterSupported = %v, want = %v", got, want)
+		})
+	}
+}
+
+func TestIsRDSInstanceSupported(t *testing.T) {
+	tests := []struct {
+		name          string
+		engine        string
+		engineVersion string
+		isSupported   bool
+	}{
+		{
+			name:          "non-MariaDB engine",
+			engine:        RDSEnginePostgres,
+			engineVersion: "13.3",
+			isSupported:   true,
+		},
+		{
+			name:          "unsupported MariaDB",
+			engine:        RDSEngineMariaDB,
+			engineVersion: "10.3.28",
+			isSupported:   false,
+		},
+		{
+			name:          "min supported version",
+			engine:        RDSEngineMariaDB,
+			engineVersion: "10.6.2",
+			isSupported:   true,
+		},
+		{
+			name:          "supported version",
+			engine:        RDSEngineMariaDB,
+			engineVersion: "10.8.0",
+			isSupported:   true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cluster := &rds.DBInstance{
+				DBInstanceArn:       aws.String("arn:aws:rds:us-east-1:1234567890:instance:test"),
+				DBClusterIdentifier: aws.String(test.name),
+				DbiResourceId:       aws.String(uuid.New().String()),
+				Engine:              aws.String(test.engine),
+				EngineVersion:       aws.String(test.engineVersion),
+			}
 
+			got, want := IsRDSInstanceSupported(cluster), test.isSupported
+			require.Equal(t, want, got, "IsRDSInstanceSupported = %v, want = %v", got, want)
 		})
 	}
 }
diff --git a/lib/services/desktop.go b/lib/services/desktop.go
index a4cc25b01e340..5ef6089109d17 100644
--- a/lib/services/desktop.go
+++ b/lib/services/desktop.go
@@ -33,6 +33,7 @@ type WindowsDesktops interface {
 	UpsertWindowsDesktop(ctx context.Context, desktop types.WindowsDesktop) error
 	DeleteWindowsDesktop(ctx context.Context, hostID, name string) error
 	DeleteAllWindowsDesktops(context.Context) error
+	ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error)
 }
 
 // MarshalWindowsDesktop marshals the WindowsDesktop resource to JSON.
diff --git a/lib/services/local/desktops.go b/lib/services/local/desktops.go
index 3e0f78f381fb5..1eae39b1cc566 100644
--- a/lib/services/local/desktops.go
+++ b/lib/services/local/desktops.go
@@ -163,6 +163,73 @@ func (s *WindowsDesktopService) DeleteAllWindowsDesktops(ctx context.Context) er
 	return nil
 }
 
+// ListWindowsDesktops returns all Windows desktops matching filter.
+func (s *WindowsDesktopService) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
+	reqLimit := req.Limit
+	if reqLimit <= 0 {
+		return nil, trace.BadParameter("nonpositive parameter limit")
+	}
+
+	keyPrefix := []string{windowsDesktopsPrefix}
+	rangeStart := backend.Key(append(keyPrefix, req.StartKey)...)
+	rangeEnd := backend.RangeEnd(backend.Key(keyPrefix...))
+	filter := services.MatchResourceFilter{
+		ResourceKind:        types.KindWindowsDesktop,
+		Labels:              req.Labels,
+		SearchKeywords:      req.SearchKeywords,
+		PredicateExpression: req.PredicateExpression,
+	}
+
+	// Get most limit+1 results to determine if there will be a next key.
+	maxLimit := reqLimit + 1
+	var desktops []types.WindowsDesktop
+	if err := backend.IterateRange(ctx, s.Backend, rangeStart, rangeEnd, maxLimit, func(items []backend.Item) (stop bool, err error) {
+		for _, item := range items {
+			if len(desktops) == maxLimit {
+				break
+			}
+
+			desktop, err := services.UnmarshalWindowsDesktop(item.Value,
+				services.WithResourceID(item.ID), services.WithExpires(item.Expires))
+			if err != nil {
+				return false, trace.Wrap(err)
+			}
+
+			if !req.WindowsDesktopFilter.Match(desktop) {
+				continue
+			}
+
+			switch match, err := services.MatchResourceByFilters(desktop, filter); {
+			case err != nil:
+				return false, trace.Wrap(err)
+			case match:
+				desktops = append(desktops, desktop)
+			}
+		}
+
+		return len(desktops) == maxLimit, nil
+	}); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// If both HostID and Name are set in the filter only one desktop should be expected
+	if req.HostID != "" && req.Name != "" && len(desktops) == 0 {
+		return nil, trace.NotFound("windows desktop \"%s/%s\" doesn't exist", req.HostID, req.Name)
+	}
+
+	var nextKey string
+	if len(desktops) > reqLimit {
+		nextKey = backend.GetPaginationKey(desktops[len(desktops)-1])
+		// Truncate the last item that was used to determine next row existence.
+		desktops = desktops[:reqLimit]
+	}
+
+	return &types.ListWindowsDesktopsResponse{
+		Desktops: desktops,
+		NextKey:  nextKey,
+	}, nil
+}
+
 const (
 	windowsDesktopsPrefix = "windowsDesktop"
 )
diff --git a/lib/services/local/desktops_test.go b/lib/services/local/desktops_test.go
new file mode 100644
index 0000000000000..3500b8b53b73f
--- /dev/null
+++ b/lib/services/local/desktops_test.go
@@ -0,0 +1,213 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package local
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/lite"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListWindowsDesktops(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	liteBackend, err := lite.NewWithConfig(ctx, lite.Config{
+		Path:  t.TempDir(),
+		Clock: clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	service := NewWindowsDesktopService(liteBackend)
+
+	// Initially we expect no desktops.
+	out, err := service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+		Limit: 10,
+	})
+	require.NoError(t, err)
+	require.Empty(t, out.Desktops)
+	require.Empty(t, out.NextKey)
+
+	// Upsert some windows desktops.
+
+	// With label.
+	testLabel := map[string]string{"env": "test"}
+	d1, err := types.NewWindowsDesktopV3("apple", testLabel, types.WindowsDesktopSpecV3{Addr: "_"})
+	require.NoError(t, err)
+	require.NoError(t, service.CreateWindowsDesktop(ctx, d1))
+
+	d2, err := types.NewWindowsDesktopV3("banana", testLabel, types.WindowsDesktopSpecV3{Addr: "_"})
+	require.NoError(t, err)
+	require.NoError(t, service.CreateWindowsDesktop(ctx, d2))
+
+	// Without labels.
+	d3, err := types.NewWindowsDesktopV3("carrot", nil, types.WindowsDesktopSpecV3{Addr: "_", HostID: "test-host-id"})
+	require.NoError(t, err)
+	require.NoError(t, service.CreateWindowsDesktop(ctx, d3))
+
+	// Test fetch all.
+	out, err = service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+		Limit: 10,
+	})
+	require.NoError(t, err)
+	require.Empty(t, out.NextKey)
+	require.Empty(t, cmp.Diff([]types.WindowsDesktop{d1, d2, d3}, out.Desktops,
+		cmpopts.IgnoreFields(types.Metadata{}, "ID"),
+	))
+
+	// Test pagination.
+
+	// First fetch.
+	resp, err := service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+		Limit: 1,
+	})
+	require.NoError(t, err)
+	require.Len(t, resp.Desktops, 1)
+	require.Equal(t, out.Desktops[0], resp.Desktops[0])
+	require.Equal(t, backend.GetPaginationKey(out.Desktops[1]), resp.NextKey)
+
+	// Middle fetch.
+	resp, err = service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+		Limit:    1,
+		StartKey: resp.NextKey,
+	})
+	require.NoError(t, err)
+	require.Len(t, resp.Desktops, 1)
+	require.Equal(t, out.Desktops[1], resp.Desktops[0])
+	require.Equal(t, backend.GetPaginationKey(out.Desktops[2]), resp.NextKey)
+
+	// Last fetch.
+	resp, err = service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
+		Limit:    1,
+		StartKey: resp.NextKey,
+	})
+	require.NoError(t, err)
+	require.Len(t, resp.Desktops, 1)
+	require.Equal(t, out.Desktops[2], resp.Desktops[0])
+	require.Empty(t, resp.NextKey)
+}
+
+func TestListWindowsDesktops_Filters(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	liteBackend, err := lite.NewWithConfig(ctx, lite.Config{
+		Path:  t.TempDir(),
+		Clock: clockwork.NewFakeClock(),
+	})
+	require.NoError(t, err)
+
+	service := NewWindowsDesktopService(liteBackend)
+
+	// Upsert some windows desktops.
+
+	// With label.
+	testLabel := map[string]string{"env": "test"}
+	d1, err := types.NewWindowsDesktopV3("banana", testLabel, types.WindowsDesktopSpecV3{Addr: "_", HostID: "test-host-id"})
+	require.NoError(t, err)
+	require.NoError(t, service.CreateWindowsDesktop(ctx, d1))
+
+	d2, err := types.NewWindowsDesktopV3("banana", testLabel, types.WindowsDesktopSpecV3{Addr: "_"})
+	require.NoError(t, err)
+	require.NoError(t, service.CreateWindowsDesktop(ctx, d2))
+
+	// Without labels.
+	d3, err := types.NewWindowsDesktopV3("carrot", nil, types.WindowsDesktopSpecV3{Addr: "_", HostID: "test-host-id"})
+	require.NoError(t, err)
+	require.NoError(t, service.CreateWindowsDesktop(ctx, d3))
+
+	tests := []struct {
+		name    string
+		filter  types.ListWindowsDesktopsRequest
+		wantErr bool
+	}{
+		{
+			name: "NOK non-matching host id and name",
+			filter: types.ListWindowsDesktopsRequest{
+				Limit: 10,
+				WindowsDesktopFilter: types.WindowsDesktopFilter{
+					HostID: "no-match",
+					Name:   "no-match",
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name:    "NOK invalid limit",
+			filter:  types.ListWindowsDesktopsRequest{},
+			wantErr: true,
+		},
+		{
+			name: "matching host id",
+			filter: types.ListWindowsDesktopsRequest{
+				Limit:                5,
+				WindowsDesktopFilter: types.WindowsDesktopFilter{HostID: "test-host-id"},
+			},
+		},
+		{
+			name: "matching name",
+			filter: types.ListWindowsDesktopsRequest{
+				Limit:                5,
+				WindowsDesktopFilter: types.WindowsDesktopFilter{Name: "banana"},
+			},
+		},
+		{
+			name: "with search",
+			filter: types.ListWindowsDesktopsRequest{
+				Limit:          5,
+				SearchKeywords: []string{"env", "test"},
+			},
+		},
+		{
+			name: "with labels",
+			filter: types.ListWindowsDesktopsRequest{
+				Limit:  5,
+				Labels: testLabel,
+			},
+		},
+		{
+			name: "with predicate",
+			filter: types.ListWindowsDesktopsRequest{
+				Limit:               5,
+				PredicateExpression: `labels.env == "test"`,
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			resp, err := service.ListWindowsDesktops(ctx, tc.filter)
+
+			if tc.wantErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Len(t, resp.Desktops, 2)
+			}
+		})
+	}
+}
diff --git a/lib/services/local/perf_test.go b/lib/services/local/perf_test.go
index 8f790824c40de..8b05a159ae686 100644
--- a/lib/services/local/perf_test.go
+++ b/lib/services/local/perf_test.go
@@ -19,8 +19,6 @@ package local
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
-	"os"
 	"testing"
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
@@ -70,9 +68,7 @@ func BenchmarkGetNodes(b *testing.B) {
 				bk, err = memory.New(memory.Config{})
 				require.NoError(b, err)
 			} else {
-				dir, err := ioutil.TempDir("", "teleport")
-				require.NoError(b, err)
-				defer os.RemoveAll(dir)
+				dir := b.TempDir()
 
 				bk, err = lite.NewWithConfig(context.TODO(), lite.Config{
 					Path: dir,
diff --git a/lib/services/local/presence.go b/lib/services/local/presence.go
index 4e4b37cd2b8c7..b2d4f8b8f3b5d 100644
--- a/lib/services/local/presence.go
+++ b/lib/services/local/presence.go
@@ -798,6 +798,13 @@ func (s *PresenceService) DeleteAllRemoteClusters() error {
 	return trace.Wrap(err)
 }
 
+// this combination of backoff parameters leads to worst-case total time spent
+// in backoff between 1200ms and 2400ms depending on jitter.  tests are in
+// place to verify that this is sufficient to resolve a 20-lease contention
+// event, which is worse than should ever occur in practice.
+const baseBackoff = time.Millisecond * 300
+const leaseRetryAttempts int64 = 6
+
 // AcquireSemaphore attempts to acquire the specified semaphore.  AcquireSemaphore will automatically handle
 // retry on contention.  If the semaphore has already reached MaxLeases, or there is too much contention,
 // a LimitExceeded error is returned (contention in this context means concurrent attempts to update the
@@ -805,13 +812,6 @@ func (s *PresenceService) DeleteAllRemoteClusters() error {
 // is the only semaphore method that handles retries internally.  This is because this method both blocks
 // user-facing operations, and contains multiple different potential contention points.
 func (s *PresenceService) AcquireSemaphore(ctx context.Context, req types.AcquireSemaphoreRequest) (*types.SemaphoreLease, error) {
-	// this combination of backoff parameters leads to worst-case total time spent
-	// in backoff between 1200ms and 2400ms depending on jitter.  tests are in
-	// place to verify that this is sufficient to resolve a 20-lease contention
-	// event, which is worse than should ever occur in practice.
-	const baseBackoff = time.Millisecond * 300
-	const acquireAttempts int64 = 6
-
 	if err := req.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -826,7 +826,7 @@ func (s *PresenceService) AcquireSemaphore(ctx context.Context, req types.Acquir
 	key := backend.Key(semaphoresPrefix, req.SemaphoreKind, req.SemaphoreName)
 
 Acquire:
-	for i := int64(0); i < acquireAttempts; i++ {
+	for i := int64(0); i < leaseRetryAttempts; i++ {
 		if i > 0 {
 			// Not our first attempt, apply backoff. If we knew that we were only in
 			// contention with one other acquire attempt we could retry immediately
@@ -997,40 +997,59 @@ func (s *PresenceService) CancelSemaphoreLease(ctx context.Context, lease types.
 		return trace.BadParameter("the lease %v has expired at %v", lease.LeaseID, lease.Expires)
 	}
 
-	key := backend.Key(semaphoresPrefix, lease.SemaphoreKind, lease.SemaphoreName)
-	item, err := s.Get(ctx, key)
-	if err != nil {
-		return trace.Wrap(err)
-	}
+	for i := int64(0); i < leaseRetryAttempts; i++ {
+		if i > 0 {
+			// Not our first attempt, apply backoff. If we knew that we were only in
+			// contention with one other cancel attempt we could retry immediately
+			// since we got here because some other attempt *succeeded*.  It is safer,
+			// however, to assume that we are under high contention and attempt to
+			// spread out retries via random backoff.
+			select {
+			case <-time.After(s.jitter(baseBackoff * time.Duration(i))):
+			case <-ctx.Done():
+				return trace.Wrap(ctx.Err())
+			}
+		}
 
-	sem, err := services.UnmarshalSemaphore(item.Value)
-	if err != nil {
-		return trace.Wrap(err)
-	}
+		key := backend.Key(semaphoresPrefix, lease.SemaphoreKind, lease.SemaphoreName)
+		item, err := s.Get(ctx, key)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 
-	if err := sem.Cancel(lease); err != nil {
-		return trace.Wrap(err)
-	}
+		sem, err := services.UnmarshalSemaphore(item.Value)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 
-	newValue, err := services.MarshalSemaphore(sem)
-	if err != nil {
-		return trace.Wrap(err)
-	}
+		if err := sem.Cancel(lease); err != nil {
+			return trace.Wrap(err)
+		}
 
-	newItem := backend.Item{
-		Key:     key,
-		Value:   newValue,
-		Expires: sem.Expiry(),
-	}
+		newValue, err := services.MarshalSemaphore(sem)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 
-	_, err = s.CompareAndSwap(ctx, *item, newItem)
-	if err != nil {
-		if trace.IsCompareFailed(err) {
-			return trace.CompareFailed("semaphore %v/%v has been concurrently updated, try again", sem.GetSubKind(), sem.GetName())
+		newItem := backend.Item{
+			Key:     key,
+			Value:   newValue,
+			Expires: sem.Expiry(),
+		}
+
+		_, err = s.CompareAndSwap(ctx, *item, newItem)
+		switch {
+		case err == nil:
+			return nil
+		case trace.IsCompareFailed(err):
+			// semaphore was concurrently updated
+			continue
+		default:
+			return trace.Wrap(err)
 		}
-		return trace.Wrap(err)
 	}
-	return nil
+
+	return trace.LimitExceeded("too much contention on semaphore %s/%s", lease.SemaphoreKind, lease.SemaphoreName)
 }
 
 // GetSemaphores returns all semaphores matching the supplied filter.
diff --git a/lib/services/local/presence_test.go b/lib/services/local/presence_test.go
index ae9a152cea679..88c3e91592d0a 100644
--- a/lib/services/local/presence_test.go
+++ b/lib/services/local/presence_test.go
@@ -27,7 +27,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/check.v1"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
@@ -40,26 +39,14 @@ import (
 	"github.com/gravitational/trace"
 )
 
-type PresenceSuite struct {
-	bk backend.Backend
-}
-
-var _ = check.Suite(&PresenceSuite{})
-
-func (s *PresenceSuite) SetUpTest(c *check.C) {
-	var err error
-
-	s.bk, err = lite.New(context.TODO(), backend.Params{"path": c.MkDir()})
-	c.Assert(err, check.IsNil)
-}
+func TestTrustedClusterCRUD(t *testing.T) {
+	ctx := context.Background()
 
-func (s *PresenceSuite) TearDownTest(c *check.C) {
-	c.Assert(s.bk.Close(), check.IsNil)
-}
+	bk, err := lite.New(ctx, backend.Params{"path": t.TempDir()})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, bk.Close()) })
 
-func (s *PresenceSuite) TestTrustedClusterCRUD(c *check.C) {
-	ctx := context.Background()
-	presenceBackend := NewPresenceService(s.bk)
+	presenceBackend := NewPresenceService(bk)
 
 	tc, err := types.NewTrustedCluster("foo", types.TrustedClusterSpecV2{
 		Enabled:              true,
@@ -68,7 +55,7 @@ func (s *PresenceSuite) TestTrustedClusterCRUD(c *check.C) {
 		ProxyAddress:         "quux",
 		ReverseTunnelAddress: "quuz",
 	})
-	c.Assert(err, check.IsNil)
+	require.NoError(t, err)
 
 	// we just insert this one for get all
 	stc, err := types.NewTrustedCluster("bar", types.TrustedClusterSpecV2{
@@ -78,37 +65,37 @@ func (s *PresenceSuite) TestTrustedClusterCRUD(c *check.C) {
 		ProxyAddress:         "quuz",
 		ReverseTunnelAddress: "corge",
 	})
-	c.Assert(err, check.IsNil)
+	require.NoError(t, err)
 
 	// create trusted clusters
 	_, err = presenceBackend.UpsertTrustedCluster(ctx, tc)
-	c.Assert(err, check.IsNil)
+	require.NoError(t, err)
 	_, err = presenceBackend.UpsertTrustedCluster(ctx, stc)
-	c.Assert(err, check.IsNil)
+	require.NoError(t, err)
 
 	// get trusted cluster make sure it's correct
 	gotTC, err := presenceBackend.GetTrustedCluster(ctx, "foo")
-	c.Assert(err, check.IsNil)
-	c.Assert(gotTC.GetName(), check.Equals, "foo")
-	c.Assert(gotTC.GetEnabled(), check.Equals, true)
-	c.Assert(gotTC.GetRoles(), check.DeepEquals, []string{"bar", "baz"})
-	c.Assert(gotTC.GetToken(), check.Equals, "qux")
-	c.Assert(gotTC.GetProxyAddress(), check.Equals, "quux")
-	c.Assert(gotTC.GetReverseTunnelAddress(), check.Equals, "quuz")
+	require.NoError(t, err)
+	require.Equal(t, "foo", gotTC.GetName())
+	require.True(t, gotTC.GetEnabled())
+	require.EqualValues(t, []string{"bar", "baz"}, gotTC.GetRoles())
+	require.Equal(t, "qux", gotTC.GetToken())
+	require.Equal(t, "quux", gotTC.GetProxyAddress())
+	require.Equal(t, "quuz", gotTC.GetReverseTunnelAddress())
 
 	// get all clusters
 	allTC, err := presenceBackend.GetTrustedClusters(ctx)
-	c.Assert(err, check.IsNil)
-	c.Assert(allTC, check.HasLen, 2)
+	require.NoError(t, err)
+	require.Len(t, allTC, 2)
 
 	// delete cluster
 	err = presenceBackend.DeleteTrustedCluster(ctx, "foo")
-	c.Assert(err, check.IsNil)
+	require.NoError(t, err)
 
 	// make sure it's really gone
 	_, err = presenceBackend.GetTrustedCluster(ctx, "foo")
-	c.Assert(err, check.NotNil)
-	c.Assert(trace.IsNotFound(err), check.Equals, true)
+	require.Error(t, err)
+	require.ErrorIs(t, err, trace.NotFound("key /trustedclusters/foo is not found"))
 }
 
 // TestApplicationServersCRUD verifies backend operations on app servers.
@@ -1130,3 +1117,63 @@ func TestFakePaginate_TotalCount(t *testing.T) {
 		require.Equal(t, 3, resp.TotalCount)
 	})
 }
+
+func TestPresenceService_CancelSemaphoreLease(t *testing.T) {
+	ctx := context.Background()
+	bk, err := lite.New(ctx, backend.Params{"path": t.TempDir()})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, bk.Close()) })
+	presence := NewPresenceService(bk)
+
+	maxLeases := 5
+	leases := make([]*types.SemaphoreLease, maxLeases)
+
+	// Acquire max number of leases
+	request := types.AcquireSemaphoreRequest{
+		SemaphoreKind: "test",
+		SemaphoreName: "test",
+		MaxLeases:     int64(maxLeases),
+		Expires:       time.Now().Add(time.Hour),
+		Holder:        "test",
+	}
+	for i := range leases {
+		lease, err := presence.AcquireSemaphore(ctx, request)
+		require.NoError(t, err)
+		require.NotNil(t, lease)
+
+		leases[i] = lease
+	}
+
+	// Validate a semaphore exists with the correct number of leases
+	semaphores, err := presence.GetSemaphores(ctx, types.SemaphoreFilter{
+		SemaphoreKind: "test",
+		SemaphoreName: "test",
+	})
+	require.NoError(t, err)
+	require.Len(t, semaphores, 1)
+	require.Len(t, semaphores[0].LeaseRefs(), maxLeases)
+
+	// Cancel the leases concurrently and ensure that all
+	// cancellations are honored
+	errCh := make(chan error, maxLeases)
+	for _, l := range leases {
+		l := l
+		go func() {
+			errCh <- presence.CancelSemaphoreLease(ctx, *l)
+		}()
+	}
+
+	for i := 0; i < maxLeases; i++ {
+		err := <-errCh
+		require.NoError(t, err)
+	}
+
+	// Validate the semaphore still exists but all leases were removed
+	semaphores, err = presence.GetSemaphores(ctx, types.SemaphoreFilter{
+		SemaphoreKind: "test",
+		SemaphoreName: "test",
+	})
+	require.NoError(t, err)
+	require.Len(t, semaphores, 1)
+	require.Empty(t, semaphores[0].LeaseRefs())
+}
diff --git a/lib/services/local/session.go b/lib/services/local/session.go
index a0e761cec64fc..ed365cb2f36a2 100644
--- a/lib/services/local/session.go
+++ b/lib/services/local/session.go
@@ -116,12 +116,8 @@ func (r *webSessions) Get(ctx context.Context, req types.GetWebSessionRequest) (
 	if err != nil && !trace.IsNotFound(err) {
 		return nil, trace.Wrap(err)
 	}
-	if session != nil {
-		return session, nil
-	}
-	// DELETE IN 7.x:
-	// Return web sessions from a legacy path under /web/users/<user>/sessions/<id>
-	return getLegacyWebSession(ctx, r.backend, req.User, req.SessionID)
+
+	return session, trace.Wrap(err)
 }
 
 // List gets all regular web sessions.
@@ -290,25 +286,6 @@ type webTokens struct {
 	log     logrus.FieldLogger
 }
 
-// DELETE in 7.x.
-// getLegacySession returns the web session for the specified user/sessionID
-// under a legacy path /web/users/<user>/sessions/<id>
-func getLegacyWebSession(ctx context.Context, backend backend.Backend, user, sessionID string) (types.WebSession, error) {
-	item, err := backend.Get(ctx, legacyWebSessionKey(user, sessionID))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	session, err := services.UnmarshalWebSession(item.Value)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	// this is for backwards compatibility to ensure we
-	// always have these values
-	session.SetUser(user)
-	session.SetName(sessionID)
-	return session, nil
-}
-
 func webSessionKey(sessionID string) (key []byte) {
 	return backend.Key(webPrefix, sessionsPrefix, sessionID)
 }
@@ -316,7 +293,3 @@ func webSessionKey(sessionID string) (key []byte) {
 func webTokenKey(token string) (key []byte) {
 	return backend.Key(webPrefix, tokensPrefix, token)
 }
-
-func legacyWebSessionKey(user, sessionID string) (key []byte) {
-	return backend.Key(webPrefix, usersPrefix, user, sessionsPrefix, sessionID)
-}
diff --git a/lib/services/local/trust.go b/lib/services/local/trust.go
index 9d71b45e51e6f..81a4907354889 100644
--- a/lib/services/local/trust.go
+++ b/lib/services/local/trust.go
@@ -77,7 +77,7 @@ func (s *CA) UpsertCertAuthority(ca types.CertAuthority) error {
 	}
 
 	// try to skip writes that would have no effect
-	if existing, err := s.GetCertAuthority(types.CertAuthID{
+	if existing, err := s.GetCertAuthority(context.TODO(), types.CertAuthID{
 		Type:       ca.GetType(),
 		DomainName: ca.GetClusterName(),
 	}, true); err == nil {
@@ -200,7 +200,7 @@ func (s *CA) ActivateCertAuthority(id types.CertAuthID) error {
 // DeactivateCertAuthority moves a CertAuthority from the normal list to
 // the deactivated list.
 func (s *CA) DeactivateCertAuthority(id types.CertAuthID) error {
-	certAuthority, err := s.GetCertAuthority(id, true)
+	certAuthority, err := s.GetCertAuthority(context.TODO(), id, true)
 	if err != nil {
 		if trace.IsNotFound(err) {
 			return trace.NotFound("can not deactivate cert authority %q which does not exist", id.DomainName)
@@ -234,11 +234,11 @@ func (s *CA) DeactivateCertAuthority(id types.CertAuthID) error {
 
 // GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
 // controls if signing keys are loaded
-func (s *CA) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (s *CA) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	if err := id.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	item, err := s.Get(context.TODO(), backend.Key(authoritiesPrefix, string(id.Type), id.DomainName))
+	item, err := s.Get(ctx, backend.Key(authoritiesPrefix, string(id.Type), id.DomainName))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -263,14 +263,14 @@ func setSigningKeys(ca types.CertAuthority, loadSigningKeys bool) {
 
 // GetCertAuthorities returns a list of authorities of a given type
 // loadSigningKeys controls whether signing keys should be loaded or not
-func (s *CA) GetCertAuthorities(caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (s *CA) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	if err := caType.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	// Get all items in the bucket.
 	startKey := backend.Key(authoritiesPrefix, string(caType))
-	result, err := s.GetRange(context.TODO(), startKey, backend.RangeEnd(startKey), backend.NoLimit)
+	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/services/local/users.go b/lib/services/local/users.go
index 934952fecd2d1..2f64cd2c8ce70 100644
--- a/lib/services/local/users.go
+++ b/lib/services/local/users.go
@@ -388,6 +388,8 @@ func (s *IdentityService) DeleteUser(ctx context.Context, user string) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	// each user has multiple related entries in the backend,
+	// so use DeleteRange to make sure we get them all
 	startKey := backend.Key(webPrefix, usersPrefix, user)
 	err = s.DeleteRange(ctx, startKey, backend.RangeEnd(startKey))
 	return trace.Wrap(err)
diff --git a/lib/services/local/users_test.go b/lib/services/local/users_test.go
index d0dd62336a993..424d78d8e09d9 100644
--- a/lib/services/local/users_test.go
+++ b/lib/services/local/users_test.go
@@ -26,6 +26,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/trace"
@@ -60,7 +61,6 @@ func TestRecoveryCodesCRUD(t *testing.T) {
 	}
 
 	t.Run("upsert, get, delete recovery codes", func(t *testing.T) {
-		t.Parallel()
 		username := "someuser"
 
 		rc1, err := types.NewRecoveryCodes(mockedCodes, clock.Now(), username)
@@ -100,7 +100,6 @@ func TestRecoveryCodesCRUD(t *testing.T) {
 	})
 
 	t.Run("deleting user deletes recovery codes", func(t *testing.T) {
-		t.Parallel()
 		username := "someuser2"
 
 		// Create a user.
@@ -124,6 +123,35 @@ func TestRecoveryCodesCRUD(t *testing.T) {
 		_, err = identity.GetRecoveryCodes(ctx, username, true /* withSecrets */)
 		require.True(t, trace.IsNotFound(err))
 	})
+
+	t.Run("deleting user ending with 'z'", func(t *testing.T) {
+		// enable the sanitizer, and use a key ending with z,
+		// which will produce an invalid backend key when we
+		// compute the end range
+		username := "xyz"
+		identity.Backend = backend.NewSanitizer(identity.Backend)
+
+		// Create a user.
+		userResource := &types.UserV2{}
+		userResource.SetName(username)
+		err := identity.CreateUser(userResource)
+		require.NoError(t, err)
+
+		// Test codes exist for user.
+		rc1, err := types.NewRecoveryCodes(mockedCodes, clock.Now(), username)
+		require.NoError(t, err)
+		err = identity.UpsertRecoveryCodes(ctx, username, rc1)
+		require.NoError(t, err)
+		codes, err := identity.GetRecoveryCodes(ctx, username, true /* withSecrets */)
+		require.NoError(t, err)
+		require.ElementsMatch(t, mockedCodes, codes.GetCodes())
+
+		// Test deletion of recovery code along with user.
+		err = identity.DeleteUser(ctx, username)
+		require.NoError(t, err)
+		_, err = identity.GetRecoveryCodes(ctx, username, true /* withSecrets */)
+		require.True(t, trace.IsNotFound(err))
+	})
 }
 
 func TestRecoveryAttemptsCRUD(t *testing.T) {
@@ -138,7 +166,6 @@ func TestRecoveryAttemptsCRUD(t *testing.T) {
 	time3 := time1.Add(4 * time.Minute)
 
 	t.Run("create, get, and delete recovery attempts", func(t *testing.T) {
-		t.Parallel()
 		username := "someuser"
 
 		// Test creation of recovery attempt.
@@ -166,7 +193,6 @@ func TestRecoveryAttemptsCRUD(t *testing.T) {
 	})
 
 	t.Run("deleting user deletes recovery attempts", func(t *testing.T) {
-		t.Parallel()
 		username := "someuser2"
 
 		// Create a user, to test deletion of recovery attempts with user.
diff --git a/lib/services/matchers.go b/lib/services/matchers.go
index d82a4dde30e51..b734adfbfb1d8 100644
--- a/lib/services/matchers.go
+++ b/lib/services/matchers.go
@@ -72,7 +72,7 @@ func MatchResourceByFilters(resource types.ResourceWithLabels, filter MatchResou
 	// We assume when filtering for services like KubeService, AppServer, and DatabaseServer
 	// the user is wanting to filter the contained resource ie. KubeClusters, Application, and Database.
 	switch filter.ResourceKind {
-	case types.KindNode:
+	case types.KindNode, types.KindWindowsDesktop, types.KindKubernetesCluster:
 		specResource = resource
 
 	case types.KindKubeService:
diff --git a/lib/services/matchers_test.go b/lib/services/matchers_test.go
index cfd225ae49b6d..1e6edf23f43d9 100644
--- a/lib/services/matchers_test.go
+++ b/lib/services/matchers_test.go
@@ -451,6 +451,20 @@ func TestMatchResourceByFilters(t *testing.T) {
 				PredicateExpression: filterExpression,
 			},
 		},
+		{
+			name: "kube cluster",
+			resource: func() types.ResourceWithLabels {
+				cluster, err := types.NewKubernetesClusterV3FromLegacyCluster("_", &types.KubernetesCluster{
+					Name: "foo",
+				})
+				require.NoError(t, err)
+				return cluster
+			},
+			filters: MatchResourceFilter{
+				ResourceKind:        types.KindKubernetesCluster,
+				PredicateExpression: filterExpression,
+			},
+		},
 		{
 			name: "node",
 			resource: func() types.ResourceWithLabels {
@@ -463,6 +477,18 @@ func TestMatchResourceByFilters(t *testing.T) {
 				PredicateExpression: filterExpression,
 			},
 		},
+		{
+			name: "windows desktop",
+			resource: func() types.ResourceWithLabels {
+				desktop, err := types.NewWindowsDesktopV3("foo", nil, types.WindowsDesktopSpecV3{Addr: "_"})
+				require.NoError(t, err)
+				return desktop
+			},
+			filters: MatchResourceFilter{
+				ResourceKind:        types.KindWindowsDesktop,
+				PredicateExpression: filterExpression,
+			},
+		},
 	}
 
 	for _, tc := range testcases {
diff --git a/lib/services/reconciler.go b/lib/services/reconciler.go
index d99071c5bd4e0..84ea4ca40eb37 100644
--- a/lib/services/reconciler.go
+++ b/lib/services/reconciler.go
@@ -30,9 +30,9 @@ type ReconcilerConfig struct {
 	// Matcher is used to match resources.
 	Matcher Matcher
 	// GetCurrentResources returns currently registered resources.
-	GetCurrentResources func() types.ResourcesWithLabels
+	GetCurrentResources func() types.ResourcesWithLabelsMap
 	// GetNewResources returns resources to compare current resources against.
-	GetNewResources func() types.ResourcesWithLabels
+	GetNewResources func() types.ResourcesWithLabelsMap
 	// OnCreate is called when a new resource is detected.
 	OnCreate func(context.Context, types.ResourceWithLabels) error
 	// OnUpdate is called when an existing resource is updated.
@@ -83,7 +83,7 @@ func NewReconciler(cfg ReconcilerConfig) (*Reconciler, error) {
 	}, nil
 }
 
-// Reconcile reconciles currently registered resources with new resources and
+// Reconciler reconciles currently registered resources with new resources and
 // creates/updates/deletes them appropriately.
 //
 // It's used in combination with watchers by agents (app, database, desktop)
@@ -123,9 +123,9 @@ func (r *Reconciler) Reconcile(ctx context.Context) error {
 
 // processRegisteredResource checks the specified registered resource against the
 // new list of resources.
-func (r *Reconciler) processRegisteredResource(ctx context.Context, newResources types.ResourcesWithLabels, registered types.ResourceWithLabels) error {
+func (r *Reconciler) processRegisteredResource(ctx context.Context, newResources types.ResourcesWithLabelsMap, registered types.ResourceWithLabels) error {
 	// See if this registered resource is still present among "new" resources.
-	if new := newResources.Find(registered.GetName()); new != nil {
+	if new := newResources[registered.GetName()]; new != nil {
 		return nil
 	}
 
@@ -139,10 +139,10 @@ func (r *Reconciler) processRegisteredResource(ctx context.Context, newResources
 
 // processNewResource checks the provided new resource agsinst currently
 // registered resources.
-func (r *Reconciler) processNewResource(ctx context.Context, currentResources types.ResourcesWithLabels, new types.ResourceWithLabels) error {
+func (r *Reconciler) processNewResource(ctx context.Context, currentResources types.ResourcesWithLabelsMap, new types.ResourceWithLabels) error {
 	// First see if the resource is already registered and if not, whether it
 	// matches the selector labels and should be registered.
-	registered := currentResources.Find(new.GetName())
+	registered := currentResources[new.GetName()]
 	if registered == nil {
 		if r.cfg.Matcher(new) {
 			r.log.Infof("%v %v matches, creating.", new.GetKind(), new.GetName())
@@ -155,9 +155,9 @@ func (r *Reconciler) processNewResource(ctx context.Context, currentResources ty
 		return nil
 	}
 
-	// Don't overwrite resource of a different origin.
+	// Don't overwrite resource of a different origin (e.g., keep static resource from config and ignore dynamic resource)
 	if registered.Origin() != new.Origin() {
-		r.log.Debugf("%v has different origin (%v vs %v), not updating.", new.GetName(),
+		r.log.Warnf("%v has different origin (%v vs %v), not updating.", new.GetName(),
 			new.Origin(), registered.Origin())
 		return nil
 	}
diff --git a/lib/services/reconciler_test.go b/lib/services/reconciler_test.go
index 7fe5ef4e62701..2aba193a1ba8e 100644
--- a/lib/services/reconciler_test.go
+++ b/lib/services/reconciler_test.go
@@ -156,11 +156,11 @@ func TestReconciler(t *testing.T) {
 				Matcher: func(rwl types.ResourceWithLabels) bool {
 					return MatchResourceLabels(test.selectors, rwl)
 				},
-				GetCurrentResources: func() types.ResourcesWithLabels {
-					return test.registeredResources
+				GetCurrentResources: func() types.ResourcesWithLabelsMap {
+					return test.registeredResources.ToMap()
 				},
-				GetNewResources: func() types.ResourcesWithLabels {
-					return test.newResources
+				GetNewResources: func() types.ResourcesWithLabelsMap {
+					return test.newResources.ToMap()
 				},
 				OnCreate: func(ctx context.Context, r types.ResourceWithLabels) error {
 					onCreateCalls = append(onCreateCalls, r)
diff --git a/lib/services/resource.go b/lib/services/resource.go
index bc7e19386cd59..04dca54f5c39f 100644
--- a/lib/services/resource.go
+++ b/lib/services/resource.go
@@ -412,80 +412,99 @@ func getResourceUnmarshaler(kind string) (ResourceUnmarshaler, bool) {
 }
 
 func init() {
-	RegisterResourceMarshaler(types.KindUser, func(r types.Resource, opts ...MarshalOption) ([]byte, error) {
-		rsc, ok := r.(types.User)
+	RegisterResourceMarshaler(types.KindUser, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
+		user, ok := resource.(types.User)
 		if !ok {
-			return nil, trace.BadParameter("expected User, got %T", r)
+			return nil, trace.BadParameter("expected User, got %T", resource)
 		}
-		raw, err := MarshalUser(rsc, opts...)
+		bytes, err := MarshalUser(user, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return raw, nil
+		return bytes, nil
 	})
-	RegisterResourceUnmarshaler(types.KindUser, func(b []byte, opts ...MarshalOption) (types.Resource, error) {
-		rsc, err := UnmarshalUser(b, opts...)
+	RegisterResourceUnmarshaler(types.KindUser, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
+		user, err := UnmarshalUser(bytes, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return rsc, nil
+		return user, nil
 	})
 
-	RegisterResourceMarshaler(types.KindCertAuthority, func(r types.Resource, opts ...MarshalOption) ([]byte, error) {
-		rsc, ok := r.(types.CertAuthority)
+	RegisterResourceMarshaler(types.KindCertAuthority, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
+		certAuthority, ok := resource.(types.CertAuthority)
 		if !ok {
-			return nil, trace.BadParameter("expected CertAuthority, got %T", r)
+			return nil, trace.BadParameter("expected CertAuthority, got %T", resource)
 		}
-		raw, err := MarshalCertAuthority(rsc, opts...)
+		bytes, err := MarshalCertAuthority(certAuthority, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return raw, nil
+		return bytes, nil
 	})
-	RegisterResourceUnmarshaler(types.KindCertAuthority, func(b []byte, opts ...MarshalOption) (types.Resource, error) {
-		rsc, err := UnmarshalCertAuthority(b, opts...)
+	RegisterResourceUnmarshaler(types.KindCertAuthority, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
+		certAuthority, err := UnmarshalCertAuthority(bytes, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return rsc, nil
+		return certAuthority, nil
 	})
 
-	RegisterResourceMarshaler(types.KindTrustedCluster, func(r types.Resource, opts ...MarshalOption) ([]byte, error) {
-		rsc, ok := r.(types.TrustedCluster)
+	RegisterResourceMarshaler(types.KindTrustedCluster, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
+		trustedCluster, ok := resource.(types.TrustedCluster)
 		if !ok {
-			return nil, trace.BadParameter("expected TrustedCluster, got %T", r)
+			return nil, trace.BadParameter("expected TrustedCluster, got %T", resource)
 		}
-		raw, err := MarshalTrustedCluster(rsc, opts...)
+		bytes, err := MarshalTrustedCluster(trustedCluster, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return raw, nil
+		return bytes, nil
 	})
-	RegisterResourceUnmarshaler(types.KindTrustedCluster, func(b []byte, opts ...MarshalOption) (types.Resource, error) {
-		rsc, err := UnmarshalTrustedCluster(b, opts...)
+	RegisterResourceUnmarshaler(types.KindTrustedCluster, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
+		trustedCluster, err := UnmarshalTrustedCluster(bytes, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return rsc, nil
+		return trustedCluster, nil
 	})
 
-	RegisterResourceMarshaler(types.KindGithubConnector, func(r types.Resource, opts ...MarshalOption) ([]byte, error) {
-		rsc, ok := r.(types.GithubConnector)
+	RegisterResourceMarshaler(types.KindGithubConnector, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
+		githubConnector, ok := resource.(types.GithubConnector)
 		if !ok {
-			return nil, trace.BadParameter("expected GithubConnector, got %T", r)
+			return nil, trace.BadParameter("expected GithubConnector, got %T", resource)
 		}
-		raw, err := MarshalGithubConnector(rsc, opts...)
+		bytes, err := MarshalGithubConnector(githubConnector, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return raw, nil
+		return bytes, nil
 	})
-	RegisterResourceUnmarshaler(types.KindGithubConnector, func(b []byte, opts ...MarshalOption) (types.Resource, error) {
-		rsc, err := UnmarshalGithubConnector(b) // XXX: Does not support marshal options.
+	RegisterResourceUnmarshaler(types.KindGithubConnector, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
+		githubConnector, err := UnmarshalGithubConnector(bytes) // XXX: Does not support marshal options.
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return rsc, nil
+		return githubConnector, nil
+	})
+
+	RegisterResourceMarshaler(types.KindRole, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
+		role, ok := resource.(types.Role)
+		if !ok {
+			return nil, trace.BadParameter("expected Role, got %T", resource)
+		}
+		bytes, err := MarshalRole(role, opts...)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return bytes, nil
+	})
+	RegisterResourceUnmarshaler(types.KindRole, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
+		role, err := UnmarshalRole(bytes, opts...)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return role, nil
 	})
 }
 
diff --git a/lib/services/role.go b/lib/services/role.go
index eda4222e64d2b..56ab3b285a8dd 100644
--- a/lib/services/role.go
+++ b/lib/services/role.go
@@ -122,7 +122,7 @@ func NewImplicitRole() types.Role {
 //
 // Used in tests only.
 func RoleForUser(u types.User) types.Role {
-	role, _ := types.NewRole(RoleNameForUser(u.GetName()), types.RoleSpecV5{
+	role, _ := types.NewRoleV3(RoleNameForUser(u.GetName()), types.RoleSpecV5{
 		Options: types.RoleOptions{
 			CertificateFormat: constants.CertificateFormatStandard,
 			MaxSessionTTL:     types.NewDuration(defaults.MaxCertDuration),
@@ -148,6 +148,7 @@ func RoleForUser(u types.User) types.Role {
 				types.NewRule(types.KindApp, RW()),
 				types.NewRule(types.KindDatabase, RW()),
 				types.NewRule(types.KindLock, RW()),
+				types.NewRule(types.KindToken, RW()),
 			},
 		},
 	})
@@ -156,7 +157,7 @@ func RoleForUser(u types.User) types.Role {
 
 // RoleForCertAuthority creates role using types.CertAuthority.
 func RoleForCertAuthority(ca types.CertAuthority) types.Role {
-	role, _ := types.NewRole(RoleNameForCertAuthority(ca.GetClusterName()), types.RoleSpecV5{
+	role, _ := types.NewRoleV3(RoleNameForCertAuthority(ca.GetClusterName()), types.RoleSpecV5{
 		Options: types.RoleOptions{
 			MaxSessionTTL: types.NewDuration(defaults.MaxCertDuration),
 		},
@@ -730,7 +731,7 @@ type AccessChecker interface {
 
 // FromSpec returns new RoleSet created from spec
 func FromSpec(name string, spec types.RoleSpecV5) (RoleSet, error) {
-	role, err := types.NewRole(name, spec)
+	role, err := types.NewRoleV3(name, spec)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -778,9 +779,11 @@ func ExtractFromCertificate(cert *ssh.Certificate) ([]string, wrappers.Traits, e
 // which Teleport passes along as a *tlsca.Identity. If roles and traits do not
 // exist in the certificates, they are extracted from the backend.
 func ExtractFromIdentity(access UserGetter, identity tlsca.Identity) ([]string, wrappers.Traits, error) {
-	// For legacy certificates, fetch roles and traits from the services.User
-	// object in the backend.
-	if missingIdentity(identity) {
+	// Legacy certs are not encoded with roles or traits,
+	// so we fallback to the traits and roles in the backend.
+	// empty traits are a valid use case in standard certs,
+	// so we only check for whether roles are empty.
+	if len(identity.Groups) == 0 {
 		u, err := access.GetUser(identity.Username, false)
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
@@ -823,15 +826,6 @@ func FetchRoles(roleNames []string, access RoleGetter, traits map[string][]strin
 	return NewRoleSet(roles...), nil
 }
 
-// missingIdentity returns true if the identity is missing or the identity
-// has no roles or traits.
-func missingIdentity(identity tlsca.Identity) bool {
-	if len(identity.Groups) == 0 || len(identity.Traits) == 0 {
-		return true
-	}
-	return false
-}
-
 // ExtractRolesFromCert extracts roles from certificate metadata extensions.
 func ExtractRolesFromCert(cert *ssh.Certificate) ([]string, error) {
 	data, ok := cert.Extensions[teleport.CertExtensionTeleportRoles]
diff --git a/lib/services/role_test.go b/lib/services/role_test.go
index bf8406ca2612c..12ec744ab8ab9 100644
--- a/lib/services/role_test.go
+++ b/lib/services/role_test.go
@@ -1506,7 +1506,7 @@ func TestCheckRuleAccess(t *testing.T) {
 
 func TestGuessIfAccessIsPossible(t *testing.T) {
 	// Examples from https://goteleport.com/docs/access-controls/reference/#rbac-for-sessions.
-	ownSessions, err := types.NewRole("own-sessions", types.RoleSpecV5{
+	ownSessions, err := types.NewRoleV3("own-sessions", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -1518,7 +1518,7 @@ func TestGuessIfAccessIsPossible(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	ownSSHSessions, err := types.NewRole("own-ssh-sessions", types.RoleSpecV5{
+	ownSSHSessions, err := types.NewRoleV3("own-ssh-sessions", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -1540,7 +1540,7 @@ func TestGuessIfAccessIsPossible(t *testing.T) {
 	require.NoError(t, err)
 
 	// Simple, all-or-nothing roles.
-	readAllSessions, err := types.NewRole("all-sessions", types.RoleSpecV5{
+	readAllSessions, err := types.NewRoleV3("all-sessions", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -1551,7 +1551,7 @@ func TestGuessIfAccessIsPossible(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	allowSSHSessions, err := types.NewRole("all-ssh-sessions", types.RoleSpecV5{
+	allowSSHSessions, err := types.NewRoleV3("all-ssh-sessions", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -1562,7 +1562,7 @@ func TestGuessIfAccessIsPossible(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	denySSHSessions, err := types.NewRole("deny-ssh-sessions", types.RoleSpecV5{
+	denySSHSessions, err := types.NewRoleV3("deny-ssh-sessions", types.RoleSpecV5{
 		Deny: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -3536,7 +3536,7 @@ func TestRoleSetLockingMode(t *testing.T) {
 
 	missingMode := constants.LockingMode("")
 	newRoleWithLockingMode := func(t *testing.T, mode constants.LockingMode) types.Role {
-		role, err := types.NewRole(uuid.New().String(), types.RoleSpecV5{Options: types.RoleOptions{Lock: mode}})
+		role, err := types.NewRoleV3(uuid.New().String(), types.RoleSpecV5{Options: types.RoleOptions{Lock: mode}})
 		require.NoError(t, err)
 		return role
 	}
@@ -3575,14 +3575,14 @@ func TestExtractConditionForIdentifier(t *testing.T) {
 	require.True(t, trace.IsAccessDenied(err))
 
 	allowWhere := func(where string) types.Role {
-		role, err := types.NewRole(uuid.New().String(), types.RoleSpecV5{Allow: types.RoleConditions{
+		role, err := types.NewRoleV3(uuid.New().String(), types.RoleSpecV5{Allow: types.RoleConditions{
 			Rules: []types.Rule{{Resources: []string{types.KindSession}, Verbs: []string{types.VerbList}, Where: where}},
 		}})
 		require.NoError(t, err)
 		return role
 	}
 	denyWhere := func(where string) types.Role {
-		role, err := types.NewRole(uuid.New().String(), types.RoleSpecV5{Deny: types.RoleConditions{
+		role, err := types.NewRoleV3(uuid.New().String(), types.RoleSpecV5{Deny: types.RoleConditions{
 			Rules: []types.Rule{{Resources: []string{types.KindSession}, Verbs: []string{types.VerbList}, Where: where}},
 		}})
 		require.NoError(t, err)
diff --git a/lib/services/suite/suite.go b/lib/services/suite/suite.go
index 9d891559fb056..8d2e2452d352a 100644
--- a/lib/services/suite/suite.go
+++ b/lib/services/suite/suite.go
@@ -275,15 +275,16 @@ func (s *ServicesTestSuite) LoginAttempts(c *check.C) {
 }
 
 func (s *ServicesTestSuite) CertAuthCRUD(c *check.C) {
+	ctx := context.Background()
 	ca := NewTestCA(types.UserCA, "example.com")
 	c.Assert(s.CAS.UpsertCertAuthority(ca), check.IsNil)
 
-	out, err := s.CAS.GetCertAuthority(ca.GetID(), true)
+	out, err := s.CAS.GetCertAuthority(ctx, ca.GetID(), true)
 	c.Assert(err, check.IsNil)
 	ca.SetResourceID(out.GetResourceID())
 	fixtures.DeepCompare(c, out, ca)
 
-	cas, err := s.CAS.GetCertAuthorities(types.UserCA, false)
+	cas, err := s.CAS.GetCertAuthorities(ctx, types.UserCA, false)
 	c.Assert(err, check.IsNil)
 	ca2 := ca.Clone().(*types.CertAuthorityV2)
 	ca2.Spec.ActiveKeys.SSH[0].PrivateKey = nil
@@ -294,11 +295,11 @@ func (s *ServicesTestSuite) CertAuthCRUD(c *check.C) {
 	ca2.Spec.JWTKeyPairs[0].PrivateKey = nil
 	fixtures.DeepCompare(c, cas[0], ca2)
 
-	cas, err = s.CAS.GetCertAuthorities(types.UserCA, true)
+	cas, err = s.CAS.GetCertAuthorities(ctx, types.UserCA, true)
 	c.Assert(err, check.IsNil)
 	fixtures.DeepCompare(c, cas[0], ca)
 
-	cas, err = s.CAS.GetCertAuthorities(types.UserCA, true)
+	cas, err = s.CAS.GetCertAuthorities(ctx, types.UserCA, true)
 	c.Assert(err, check.IsNil)
 	fixtures.DeepCompare(c, cas[0], ca)
 
@@ -322,7 +323,7 @@ func (s *ServicesTestSuite) CertAuthCRUD(c *check.C) {
 	err = s.CAS.CompareAndSwapCertAuthority(&newCA, ca)
 	c.Assert(err, check.IsNil)
 
-	out, err = s.CAS.GetCertAuthority(ca.GetID(), true)
+	out, err = s.CAS.GetCertAuthority(ctx, ca.GetID(), true)
 	c.Assert(err, check.IsNil)
 	newCA.SetResourceID(out.GetResourceID())
 	fixtures.DeepCompare(c, &newCA, out)
@@ -1348,7 +1349,7 @@ func (s *ServicesTestSuite) Events(c *check.C) {
 				ca := NewTestCA(types.UserCA, "example.com")
 				c.Assert(s.CAS.UpsertCertAuthority(ca), check.IsNil)
 
-				out, err := s.CAS.GetCertAuthority(*ca.ID(), true)
+				out, err := s.CAS.GetCertAuthority(ctx, *ca.ID(), true)
 				c.Assert(err, check.IsNil)
 
 				c.Assert(s.CAS.DeleteCertAuthority(*ca.ID()), check.IsNil)
@@ -1369,7 +1370,7 @@ func (s *ServicesTestSuite) Events(c *check.C) {
 				ca := NewTestCA(types.UserCA, "example.com")
 				c.Assert(s.CAS.UpsertCertAuthority(ca), check.IsNil)
 
-				out, err := s.CAS.GetCertAuthority(*ca.ID(), false)
+				out, err := s.CAS.GetCertAuthority(ctx, *ca.ID(), false)
 				c.Assert(err, check.IsNil)
 
 				c.Assert(s.CAS.DeleteCertAuthority(*ca.ID()), check.IsNil)
@@ -1461,7 +1462,7 @@ func (s *ServicesTestSuite) Events(c *check.C) {
 				Kind: types.KindRole,
 			},
 			crud: func(context.Context) types.Resource {
-				role, err := types.NewRole("role1", types.RoleSpecV5{
+				role, err := types.NewRoleV3("role1", types.RoleSpecV5{
 					Options: types.RoleOptions{
 						MaxSessionTTL: types.Duration(time.Hour),
 					},
diff --git a/lib/services/trust.go b/lib/services/trust.go
index 84d4c5d4aeb5b..996fe4595b641 100644
--- a/lib/services/trust.go
+++ b/lib/services/trust.go
@@ -16,15 +16,19 @@ limitations under the License.
 
 package services
 
-import "github.com/gravitational/teleport/api/types"
+import (
+	"context"
+
+	"github.com/gravitational/teleport/api/types"
+)
 
 // AuthorityGetter defines interface for fetching cert authority resources.
 type AuthorityGetter interface {
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...MarshalOption) ([]types.CertAuthority, error)
 }
 
 // Trust is responsible for managing certificate authorities
diff --git a/lib/services/watcher.go b/lib/services/watcher.go
index c1d932323248f..16cb6dbd88801 100644
--- a/lib/services/watcher.go
+++ b/lib/services/watcher.go
@@ -729,7 +729,13 @@ func (p *databaseCollector) getResourcesAndUpdateCurrent(ctx context.Context) er
 	p.lock.Lock()
 	defer p.lock.Unlock()
 	p.current = newCurrent
-	p.DatabasesC <- databases
+
+	select {
+	case <-ctx.Done():
+		return trace.Wrap(ctx.Err())
+	case p.DatabasesC <- databases:
+	}
+
 	return nil
 }
 
@@ -744,7 +750,10 @@ func (p *databaseCollector) processEventAndUpdateCurrent(ctx context.Context, ev
 	switch event.Type {
 	case types.OpDelete:
 		delete(p.current, event.Resource.GetName())
-		p.DatabasesC <- databasesToSlice(p.current)
+		select {
+		case <-ctx.Done():
+		case p.DatabasesC <- databasesToSlice(p.current):
+		}
 	case types.OpPut:
 		database, ok := event.Resource.(types.Database)
 		if !ok {
@@ -752,7 +761,11 @@ func (p *databaseCollector) processEventAndUpdateCurrent(ctx context.Context, ev
 			return
 		}
 		p.current[database.GetName()] = database
-		p.DatabasesC <- databasesToSlice(p.current)
+		select {
+		case <-ctx.Done():
+		case p.DatabasesC <- databasesToSlice(p.current):
+		}
+
 	default:
 		p.Log.Warnf("Unsupported event type %s.", event.Type)
 		return
@@ -845,7 +858,12 @@ func (p *appCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
 	p.lock.Lock()
 	defer p.lock.Unlock()
 	p.current = newCurrent
-	p.AppsC <- apps
+
+	select {
+	case <-ctx.Done():
+		return trace.Wrap(ctx.Err())
+	case p.AppsC <- apps:
+	}
 	return nil
 }
 
@@ -861,6 +879,12 @@ func (p *appCollector) processEventAndUpdateCurrent(ctx context.Context, event t
 	case types.OpDelete:
 		delete(p.current, event.Resource.GetName())
 		p.AppsC <- appsToSlice(p.current)
+
+		select {
+		case <-ctx.Done():
+		case p.AppsC <- appsToSlice(p.current):
+		}
+
 	case types.OpPut:
 		app, ok := event.Resource.(types.Application)
 		if !ok {
@@ -868,7 +892,11 @@ func (p *appCollector) processEventAndUpdateCurrent(ctx context.Context, event t
 			return
 		}
 		p.current[app.GetName()] = app
-		p.AppsC <- appsToSlice(p.current)
+
+		select {
+		case <-ctx.Done():
+		case p.AppsC <- appsToSlice(p.current):
+		}
 	default:
 		p.Log.Warnf("Unsupported event type %s.", event.Type)
 		return
@@ -961,7 +989,7 @@ func (c *caCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
 	)
 
 	if c.WatchHostCA {
-		host, err := c.AuthorityGetter.GetCertAuthorities(types.HostCA, false)
+		host, err := c.AuthorityGetter.GetCertAuthorities(ctx, types.HostCA, false)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -972,7 +1000,7 @@ func (c *caCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
 	}
 
 	if c.WatchUserCA {
-		user, err := c.AuthorityGetter.GetCertAuthorities(types.UserCA, false)
+		user, err := c.AuthorityGetter.GetCertAuthorities(ctx, types.UserCA, false)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -987,7 +1015,11 @@ func (c *caCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
 	c.user = newUser
 	c.lock.Unlock()
 
-	c.CertAuthorityC <- casToSlice(newHost, newUser)
+	select {
+	case <-ctx.Done():
+		return trace.Wrap(ctx.Err())
+	case c.CertAuthorityC <- casToSlice(newHost, newUser):
+	}
 	return nil
 }
 
@@ -1008,7 +1040,10 @@ func (c *caCollector) processEventAndUpdateCurrent(ctx context.Context, event ty
 			delete(c.user, event.Resource.GetName())
 		}
 
-		c.CertAuthorityC <- casToSlice(c.host, c.user)
+		select {
+		case <-ctx.Done():
+		case c.CertAuthorityC <- casToSlice(c.host, c.user):
+		}
 	case types.OpPut:
 		ca, ok := event.Resource.(types.CertAuthority)
 		if !ok {
@@ -1023,7 +1058,10 @@ func (c *caCollector) processEventAndUpdateCurrent(ctx context.Context, event ty
 			c.user[ca.GetName()] = ca
 		}
 
-		c.CertAuthorityC <- casToSlice(c.host, c.user)
+		select {
+		case <-ctx.Done():
+		case c.CertAuthorityC <- casToSlice(c.host, c.user):
+		}
 	default:
 		c.Log.Warnf("Unsupported event type %s.", event.Type)
 		return
diff --git a/lib/srv/alpnproxy/auth/auth_proxy.go b/lib/srv/alpnproxy/auth/auth_proxy.go
index ec8740fae261e..f7b5aae4115b3 100644
--- a/lib/srv/alpnproxy/auth/auth_proxy.go
+++ b/lib/srv/alpnproxy/auth/auth_proxy.go
@@ -18,6 +18,7 @@ package alpnproxyauth
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"math/rand"
 	"net"
@@ -113,13 +114,23 @@ func (s *AuthProxyDialerService) dialLocalAuthServer(ctx context.Context) (net.C
 	if len(authServers) == 0 {
 		return nil, trace.NotFound("empty auth servers list")
 	}
-	//TODO(smallinksy) Better support for HA. Add dial retry on auth network errors.
-	authServerIndex := rand.Intn(len(authServers))
-	conn, err := net.Dial("tcp", authServers[authServerIndex].GetAddr())
-	if err != nil {
-		return nil, trace.Wrap(err)
+	var errors []error
+
+	// iterate over the addresses in random order
+	for len(authServers) > 0 {
+		l := len(authServers)
+		authServerIndex := rand.Intn(l)
+		addr := authServers[authServerIndex].GetAddr()
+		var d net.Dialer
+		conn, err := d.DialContext(ctx, "tcp", addr)
+		if err == nil {
+			return conn, nil
+		}
+		errors = append(errors, fmt.Errorf("%s: %w", addr, err))
+		authServers[authServerIndex] = authServers[l-1]
+		authServers = authServers[:l-1]
 	}
-	return conn, nil
+	return nil, trace.NewAggregate(errors...)
 }
 
 func (s *AuthProxyDialerService) dialRemoteAuthServer(ctx context.Context, clusterName string) (net.Conn, error) {
diff --git a/lib/srv/alpnproxy/auth/auth_proxy_test.go b/lib/srv/alpnproxy/auth/auth_proxy_test.go
new file mode 100644
index 0000000000000..ff25f26412124
--- /dev/null
+++ b/lib/srv/alpnproxy/auth/auth_proxy_test.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2021 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package alpnproxyauth
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/stretchr/testify/require"
+)
+
+type mockAuthGetter struct {
+	servers []types.Server
+}
+
+func (m mockAuthGetter) GetClusterName(...services.MarshalOption) (types.ClusterName, error) {
+	return nil, nil
+}
+
+func (m mockAuthGetter) GetAuthServers() ([]types.Server, error) {
+	return m.servers, nil
+}
+
+func TestDialLocalAuthServerNoServers(t *testing.T) {
+	s := NewAuthProxyDialerService(nil, mockAuthGetter{servers: []types.Server{}})
+	_, err := s.dialLocalAuthServer(context.Background())
+	require.Error(t, err, "dialLocalAuthServer expected to fail")
+	require.Equal(t, "empty auth servers list", err.Error())
+}
+
+func TestDialLocalAuthServerNoAvailableServers(t *testing.T) {
+	server1, err := types.NewServer("s1", "auth", types.ServerSpecV2{Addr: "invalid:8000"})
+	require.NoError(t, err)
+	s := NewAuthProxyDialerService(nil, mockAuthGetter{servers: []types.Server{server1}})
+	_, err = s.dialLocalAuthServer(context.Background())
+	require.Error(t, err, "dialLocalAuthServer expected to fail")
+	require.Contains(t, err.Error(), "invalid:8000:")
+}
+
+func TestDialLocalAuthServerAvailableServers(t *testing.T) {
+	socket, err := net.Listen("tcp", "127.0.0.1:")
+	require.NoError(t, err)
+	defer socket.Close()
+	server, err := types.NewServer("s1", "auth", types.ServerSpecV2{Addr: socket.Addr().String()})
+	require.NoError(t, err)
+	servers := []types.Server{server}
+	// multiple invalid servers to minimize chance that we select good one first try
+	for i := 0; i < 20; i++ {
+		server, err := types.NewServer("s1", "auth", types.ServerSpecV2{Addr: "invalid2:8000"})
+		require.NoError(t, err)
+		servers = append(servers, server)
+	}
+	s := NewAuthProxyDialerService(nil, mockAuthGetter{servers: servers})
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	defer cancel()
+	_, err = s.dialLocalAuthServer(ctx)
+	require.NoError(t, err)
+}
diff --git a/lib/srv/alpnproxy/common/protocols.go b/lib/srv/alpnproxy/common/protocols.go
index 74055f4e8c7eb..3009453a94b1c 100644
--- a/lib/srv/alpnproxy/common/protocols.go
+++ b/lib/srv/alpnproxy/common/protocols.go
@@ -17,9 +17,10 @@ limitations under the License.
 package common
 
 import (
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/acme"
+
+	"github.com/gravitational/teleport/lib/defaults"
 )
 
 // Protocol is the TLS ALPN protocol type.
@@ -105,3 +106,17 @@ func ToALPNProtocol(dbProtocol string) (Protocol, error) {
 		return "", trace.NotImplemented("%q protocol is not supported", dbProtocol)
 	}
 }
+
+// IsDBTLSProtocol returns if DB protocol has supported native TLS protocol.
+// where connection can be TLS terminated on ALPN proxy side.
+// For protocol like MySQL or Postgres where custom TLS implementation is used the incoming
+// connection needs to be forwarded to proxy database service where custom TLS handler is invoked
+// to terminated DB connection.
+func IsDBTLSProtocol(protocol Protocol) bool {
+	switch protocol {
+	case ProtocolMongoDB, ProtocolRedisDB, ProtocolSQLServer:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/lib/srv/alpnproxy/proxy.go b/lib/srv/alpnproxy/proxy.go
index c14aa82f8ac6e..2cc4636e426d2 100644
--- a/lib/srv/alpnproxy/proxy.go
+++ b/lib/srv/alpnproxy/proxy.go
@@ -176,6 +176,9 @@ func (h *HandlerDecs) handle(ctx context.Context, conn net.Conn, info Connection
 	if h.HandlerWithConnInfo != nil {
 		return h.HandlerWithConnInfo(ctx, conn, info)
 	}
+	if h.Handler == nil {
+		return trace.BadParameter("failed to find ALPN handler for ALPN: %v, SNI %v", info.ALPN, info.SNI)
+	}
 	return h.Handler(ctx, conn)
 }
 
@@ -434,15 +437,6 @@ func (p *Proxy) databaseHandlerWithTLSTermination(ctx context.Context, conn net.
 	return trace.Wrap(p.handleDatabaseConnection(ctx, tlsConn, info))
 }
 
-func isDBTLSProtocol(protocol common.Protocol) bool {
-	switch protocol {
-	case common.ProtocolMongoDB, common.ProtocolRedisDB:
-		return true
-	default:
-		return false
-	}
-}
-
 func (p *Proxy) getHandlerDescBaseOnClientHelloMsg(clientHelloInfo *tls.ClientHelloInfo) (*HandlerDecs, error) {
 	if shouldRouteToKubeService(clientHelloInfo.ServerName) {
 		if p.cfg.Router.kubeHandler == nil {
@@ -464,7 +458,7 @@ func (p *Proxy) getHandleDescBasedOnALPNVal(clientHelloInfo *tls.ClientHelloInfo
 
 	for _, v := range clientProtocols {
 		protocol := common.Protocol(v)
-		if isDBTLSProtocol(protocol) {
+		if common.IsDBTLSProtocol(protocol) {
 			return &HandlerDecs{
 				MatchFunc:           MatchByProtocol(protocol),
 				HandlerWithConnInfo: p.databaseHandlerWithTLSTermination,
diff --git a/lib/srv/alpnproxy/proxy_test.go b/lib/srv/alpnproxy/proxy_test.go
index 029090c6dee16..1bf971d0fad09 100644
--- a/lib/srv/alpnproxy/proxy_test.go
+++ b/lib/srv/alpnproxy/proxy_test.go
@@ -178,6 +178,65 @@ func TestProxyTLSDatabaseHandler(t *testing.T) {
 	})
 }
 
+// TestProxyRouteToDatabase tests db connection with protocol registered without any handler.
+// ALPN router leverages empty handler to route the connection to DBHandler
+// based on TLS RouteToDatabase identity entry.
+func TestProxyRouteToDatabase(t *testing.T) {
+	t.Parallel()
+	const (
+		databaseHandleResponse = "database handler response"
+	)
+
+	suite := NewSuite(t)
+	clientCert := mustGenCertSignedWithCA(t, suite.ca,
+		withIdentity(tlsca.Identity{
+			Username: "test-user",
+			Groups:   []string{"test-group"},
+			RouteToDatabase: tlsca.RouteToDatabase{
+				ServiceName: "mongo-test-database",
+			},
+		}),
+	)
+
+	suite.router.AddDBTLSHandler(func(ctx context.Context, conn net.Conn) error {
+		defer conn.Close()
+		_, err := fmt.Fprint(conn, databaseHandleResponse)
+		require.NoError(t, err)
+		return nil
+	})
+	suite.router.Add(HandlerDecs{
+		MatchFunc: MatchByProtocol(common.ProtocolReverseTunnel),
+	})
+
+	suite.Start(t)
+
+	t.Run("dial with user certs with RouteToDatabase info", func(t *testing.T) {
+		conn, err := tls.Dial("tcp", suite.GetServerAddress(), &tls.Config{
+			NextProtos: []string{string(common.ProtocolReverseTunnel)},
+			RootCAs:    suite.GetCertPool(),
+			ServerName: "localhost",
+			Certificates: []tls.Certificate{
+				clientCert,
+			},
+		})
+		require.NoError(t, err)
+		mustReadFromConnection(t, conn, databaseHandleResponse)
+		mustCloseConnection(t, conn)
+	})
+
+	t.Run("dial with no user certs", func(t *testing.T) {
+		conn, err := tls.Dial("tcp", suite.GetServerAddress(), &tls.Config{
+			NextProtos: []string{string(common.ProtocolReverseTunnel)},
+			RootCAs:    suite.GetCertPool(),
+			ServerName: "localhost",
+		})
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			require.NoError(t, conn.Close())
+		})
+	})
+}
+
 // TestLocalProxyPostgresProtocol tests Proxy Postgres connection  forwarded by LocalProxy.
 // Client connects to LocalProxy with raw connection where downstream Proxy connection is upgraded to TLS with
 // ALPN value set to ProtocolPostgres.
diff --git a/lib/srv/app/aws/endpoints.go b/lib/srv/app/aws/endpoints.go
new file mode 100644
index 0000000000000..684a0f8a204bf
--- /dev/null
+++ b/lib/srv/app/aws/endpoints.go
@@ -0,0 +1,160 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package aws
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/aws/aws-sdk-go/service/appstream"
+	"github.com/aws/aws-sdk-go/service/detective"
+	"github.com/aws/aws-sdk-go/service/ecr"
+	"github.com/aws/aws-sdk-go/service/ecrpublic"
+	"github.com/aws/aws-sdk-go/service/elasticinference"
+	"github.com/aws/aws-sdk-go/service/iot1clickdevicesservice"
+	"github.com/aws/aws-sdk-go/service/iotdataplane"
+	"github.com/aws/aws-sdk-go/service/iotdeviceadvisor"
+	"github.com/aws/aws-sdk-go/service/ioteventsdata"
+	"github.com/aws/aws-sdk-go/service/iotfleethub"
+	"github.com/aws/aws-sdk-go/service/iotjobsdataplane"
+	"github.com/aws/aws-sdk-go/service/iotsecuretunneling"
+	"github.com/aws/aws-sdk-go/service/iottwinmaker"
+	"github.com/aws/aws-sdk-go/service/iotwireless"
+	"github.com/aws/aws-sdk-go/service/lexmodelsv2"
+	"github.com/aws/aws-sdk-go/service/marketplacecatalog"
+	"github.com/aws/aws-sdk-go/service/mediatailor"
+	"github.com/aws/aws-sdk-go/service/memorydb"
+	"github.com/aws/aws-sdk-go/service/migrationhubstrategyrecommendations"
+	"github.com/aws/aws-sdk-go/service/mobile"
+	"github.com/aws/aws-sdk-go/service/pinpoint"
+	"github.com/aws/aws-sdk-go/service/pinpointsmsvoice"
+	"github.com/aws/aws-sdk-go/service/pricing"
+	"github.com/aws/aws-sdk-go/service/proton"
+	"github.com/aws/aws-sdk-go/service/sagemaker"
+	"github.com/aws/aws-sdk-go/service/ses"
+	"github.com/aws/aws-sdk-go/service/sso"
+	"github.com/aws/aws-sdk-go/service/ssooidc"
+	"github.com/aws/aws-sdk-go/service/timestreamquery"
+
+	awsutils "github.com/gravitational/teleport/lib/utils/aws"
+
+	"github.com/gravitational/trace"
+)
+
+// resolveEndpoint extracts the aws-service on and aws-region from the request
+// authorization header and resolves the aws-service and aws-region to AWS
+// endpoint.
+func resolveEndpoint(r *http.Request) (*endpoints.ResolvedEndpoint, error) {
+	awsAuthHeader, err := awsutils.ParseSigV4(r.Header.Get(awsutils.AuthorizationHeader))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// aws-sdk-go maintains a mapping of service endpoints which can be looked
+	// up by calling `endpoints.DefaultResolver().EndpointFor`. This mapping
+	// can be found at:
+	// https://github.com/aws/aws-sdk-go/blob/main/aws/endpoints/defaults.go
+	//
+	// The json equivalent can be found in botocore source code at:
+	// https://github.com/boto/botocore/blob/develop/botocore/data/endpoints.json
+	//
+	// The keys used for lookups are endpoints IDs, which can be different from
+	// the signing names. We have to translate the signing name received from
+	// the header back to the endpoints ID.
+	//
+	// In addition, many services are NOT found in aws-sdk-go's endpoints
+	// mapping. How aws-sdk-go resolves endpoints for these services is to
+	// allow ResolveUnknownService when creating the client sessions, which in
+	// turn generates the endpoint by using the endpoints ID and some default
+	// suffixes. We allow ResolveUnknownService here for the same purpose.
+	endpointsID := endpointsIDFromSigningName(awsAuthHeader.Service)
+	opts := func(opts *endpoints.Options) {
+		opts.ResolveUnknownService = true
+	}
+
+	resolvedEndpoint, err := endpoints.DefaultResolver().EndpointFor(endpointsID, awsAuthHeader.Region, opts)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// SigningName can be derived from the endpoint ID which may not be the
+	// correct signing name. Set it back to what is received from the header.
+	resolvedEndpoint.SigningName = awsAuthHeader.Service
+	return &resolvedEndpoint, nil
+}
+
+// endpointsIDFromSigningName returns the endpoints ID used for endpoint
+// lookups when calling endpoints.DefaultResolver().EndpointFor.
+func endpointsIDFromSigningName(signingName string) string {
+	// Some clients may sign some services with upper case letters. We use all
+	// lower cases in our mapping.
+	signingName = strings.ToLower(signingName)
+
+	if endpointsID, ok := signingNameToEndpointsID[signingName]; ok {
+		return endpointsID
+	}
+
+	// If not found in the mapping, endpoints ID is expected to be the same as
+	// the signing name.
+	return signingName
+}
+
+// signingNameToEndpointsID is a map of AWS services' signing names to their
+// endpoints IDs.
+//
+// This mapping was created by the following process:
+// 1. Compiled a mapping of all signing names to their hostnames (e.g. grep/awk
+// keywords in "aws-sdk-go-v2/services/")
+// 2. Created unit test "TestResolveEndpoints" to test each signing name.
+// 3. Investigated the test failures, and updated this mapping to fix them.
+//
+// TODO Many services may sign with same names but use different hostnames.
+// Will need a way to differentiate them. For now, either make the best guess
+// in this mapping or use the default signing names. See signingNameToHostname
+// in endpoints_test.go for conflicting services.
+var signingNameToEndpointsID = map[string]string{
+	"appstream":                             appstream.EndpointsID,
+	"aws-marketplace":                       marketplacecatalog.EndpointsID,
+	"awsiottwinmaker":                       iottwinmaker.EndpointsID,
+	"awsmigrationhubstrategyrecommendation": migrationhubstrategyrecommendations.EndpointsID,
+	"awsmobilehubservice":                   mobile.EndpointsID,
+	"awsproton20200720":                     proton.EndpointsID,
+	"awsssooidc":                            ssooidc.EndpointsID,
+	"awsssoportal":                          sso.EndpointsID,
+	"detective":                             detective.EndpointsID,
+	"ecr":                                   ecr.EndpointsID,
+	"ecr-public":                            ecrpublic.EndpointsID,
+	"elastic-inference":                     elasticinference.EndpointsID,
+	"iot-jobs-data":                         iotjobsdataplane.EndpointsID,
+	"iot1click":                             iot1clickdevicesservice.EndpointsID,
+	"iotdata":                               iotdataplane.EndpointsID,
+	"iotdeviceadvisor":                      iotdeviceadvisor.EndpointsID,
+	"ioteventsdata":                         ioteventsdata.EndpointsID,
+	"iotfleethub":                           iotfleethub.EndpointsID,
+	"iotsecuredtunneling":                   iotsecuretunneling.EndpointsID,
+	"iotwireless":                           iotwireless.EndpointsID,
+	"lex":                                   lexmodelsv2.EndpointsID,
+	"mediatailor":                           mediatailor.EndpointsID,
+	"memorydb":                              memorydb.EndpointsID,
+	"mobiletargeting":                       pinpoint.EndpointsID,
+	"pricing":                               pricing.EndpointsID,
+	"sagemaker":                             sagemaker.EndpointsID,
+	"ses":                                   ses.EndpointsID,
+	"sms-voice":                             pinpointsmsvoice.EndpointsID,
+	"timestream":                            timestreamquery.EndpointsID,
+}
diff --git a/lib/srv/app/aws/endpoints_test.go b/lib/srv/app/aws/endpoints_test.go
new file mode 100644
index 0000000000000..bc80f410144fb
--- /dev/null
+++ b/lib/srv/app/aws/endpoints_test.go
@@ -0,0 +1,359 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package aws
+
+import (
+	"bytes"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/stretchr/testify/require"
+)
+
+// signingNameToHostname is a map of AWS services' signing names to their
+// hostnames.
+var signingNameToHostname = map[string]string{
+	"a4b":                                   "a4b.us-east-1.amazonaws.com",
+	"access-analyzer":                       "access-analyzer.us-east-1.amazonaws.com",
+	"account":                               "account.us-east-1.amazonaws.com",
+	"acm":                                   "acm.us-east-1.amazonaws.com",
+	"acm-pca":                               "acm-pca.us-east-1.amazonaws.com",
+	"airflow":                               "airflow.us-east-1.amazonaws.com",
+	"amplify":                               "amplify.us-east-1.amazonaws.com",
+	"amplifybackend":                        "amplifybackend.us-east-1.amazonaws.com",
+	"amplifyuibuilder":                      "amplifyuibuilder.us-east-1.amazonaws.com",
+	"apigateway":                            "apigateway.us-east-1.amazonaws.com",
+	"app-integrations":                      "app-integrations.us-east-1.amazonaws.com",
+	"appconfig":                             "appconfig.us-east-1.amazonaws.com",
+	"appconfigdata":                         "appconfigdata.us-east-1.amazonaws.com",
+	"appflow":                               "appflow.us-east-1.amazonaws.com",
+	"application-autoscaling":               "application-autoscaling.us-east-1.amazonaws.com",
+	"application-cost-profiler":             "application-cost-profiler.us-east-1.amazonaws.com",
+	"applicationinsights":                   "applicationinsights.us-east-1.amazonaws.com",
+	"appmesh":                               "appmesh.us-east-1.amazonaws.com",
+	"apprunner":                             "apprunner.us-east-1.amazonaws.com",
+	"appstream":                             "appstream2.us-east-1.amazonaws.com",
+	"appsync":                               "appsync.us-east-1.amazonaws.com",
+	"aps":                                   "aps.us-east-1.amazonaws.com",
+	"athena":                                "athena.us-east-1.amazonaws.com",
+	"auditmanager":                          "auditmanager.us-east-1.amazonaws.com",
+	"autoscaling":                           "autoscaling.us-east-1.amazonaws.com",
+	"autoscaling-plans":                     "autoscaling-plans.us-east-1.amazonaws.com",
+	"aws-marketplace":                       "catalog.marketplace.us-east-1.amazonaws.com",
+	"awsiottwinmaker":                       "iottwinmaker.us-east-1.amazonaws.com",
+	"awsmigrationhubstrategyrecommendation": "migrationhub-strategy.us-east-1.amazonaws.com",
+	"awsmobilehubservice":                   "mobile.us-east-1.amazonaws.com",
+	"awsproton20200720":                     "proton.us-east-1.amazonaws.com",
+	"awsssooidc":                            "oidc.us-east-1.amazonaws.com",
+	"awsssoportal":                          "portal.sso.us-east-1.amazonaws.com",
+	"backup":                                "backup.us-east-1.amazonaws.com",
+	"backup-gateway":                        "backup-gateway.us-east-1.amazonaws.com",
+	"batch":                                 "batch.us-east-1.amazonaws.com",
+	"braket":                                "braket.us-east-1.amazonaws.com",
+	"budgets":                               "budgets.amazonaws.com",
+	"ce":                                    "ce.us-east-1.amazonaws.com",
+	"chime":                                 "chime.us-east-1.amazonaws.com",
+	"cloud9":                                "cloud9.us-east-1.amazonaws.com",
+	"cloudcontrolapi":                       "cloudcontrolapi.us-east-1.amazonaws.com",
+	"clouddirectory":                        "clouddirectory.us-east-1.amazonaws.com",
+	"cloudformation":                        "cloudformation.us-east-1.amazonaws.com",
+	"cloudfront":                            "cloudfront.amazonaws.com",
+	"cloudhsm":                              "cloudhsm.us-east-1.amazonaws.com",
+	"cloudsearch":                           "cloudsearch.us-east-1.amazonaws.com",
+	"cloudtrail":                            "cloudtrail.us-east-1.amazonaws.com",
+	"codeartifact":                          "codeartifact.us-east-1.amazonaws.com",
+	"codebuild":                             "codebuild.us-east-1.amazonaws.com",
+	"codecommit":                            "codecommit.us-east-1.amazonaws.com",
+	"codedeploy":                            "codedeploy.us-east-1.amazonaws.com",
+	"codeguru-profiler":                     "codeguru-profiler.us-east-1.amazonaws.com",
+	"codeguru-reviewer":                     "codeguru-reviewer.us-east-1.amazonaws.com",
+	"codepipeline":                          "codepipeline.us-east-1.amazonaws.com",
+	"codestar":                              "codestar.us-east-1.amazonaws.com",
+	"codestar-connections":                  "codestar-connections.us-east-1.amazonaws.com",
+	"codestar-notifications":                "codestar-notifications.us-east-1.amazonaws.com",
+	"cognito-identity":                      "cognito-identity.us-east-1.amazonaws.com",
+	"cognito-idp":                           "cognito-idp.us-east-1.amazonaws.com",
+	"cognito-sync":                          "cognito-sync.us-east-1.amazonaws.com",
+	"comprehend":                            "comprehend.us-east-1.amazonaws.com",
+	"comprehendmedical":                     "comprehendmedical.us-east-1.amazonaws.com",
+	"compute-optimizer":                     "compute-optimizer.us-east-1.amazonaws.com",
+	"config":                                "config.us-east-1.amazonaws.com",
+	"connect":                               "connect.us-east-1.amazonaws.com",
+	"cur":                                   "cur.us-east-1.amazonaws.com",
+	"databrew":                              "databrew.us-east-1.amazonaws.com",
+	"dataexchange":                          "dataexchange.us-east-1.amazonaws.com",
+	"datapipeline":                          "datapipeline.us-east-1.amazonaws.com",
+	"datasync":                              "datasync.us-east-1.amazonaws.com",
+	"dax":                                   "dax.us-east-1.amazonaws.com",
+	"detective":                             "api.detective.us-east-1.amazonaws.com",
+	"devicefarm":                            "devicefarm.us-east-1.amazonaws.com",
+	"devops-guru":                           "devops-guru.us-east-1.amazonaws.com",
+	"directconnect":                         "directconnect.us-east-1.amazonaws.com",
+	"discovery":                             "discovery.us-east-1.amazonaws.com",
+	"dlm":                                   "dlm.us-east-1.amazonaws.com",
+	"dms":                                   "dms.us-east-1.amazonaws.com",
+	"drs":                                   "drs.us-east-1.amazonaws.com",
+	"ds":                                    "ds.us-east-1.amazonaws.com",
+	"dynamodb":                              "dynamodb.us-east-1.amazonaws.com",
+	"ebs":                                   "ebs.us-east-1.amazonaws.com",
+	"ec2":                                   "ec2.us-east-1.amazonaws.com",
+	"ec2-instance-connect":                  "ec2-instance-connect.us-east-1.amazonaws.com",
+	"ecr":                                   "api.ecr.us-east-1.amazonaws.com",
+	"ecr-public":                            "api.ecr-public.us-east-1.amazonaws.com",
+	"ecs":                                   "ecs.us-east-1.amazonaws.com",
+	"eks":                                   "eks.us-east-1.amazonaws.com",
+	"elastic-inference":                     "api.elastic-inference.us-east-1.amazonaws.com",
+	"elasticache":                           "elasticache.us-east-1.amazonaws.com",
+	"elasticbeanstalk":                      "elasticbeanstalk.us-east-1.amazonaws.com",
+	"elasticfilesystem":                     "elasticfilesystem.us-east-1.amazonaws.com",
+	"elasticloadbalancing":                  "elasticloadbalancing.us-east-1.amazonaws.com",
+	"elasticmapreduce":                      "elasticmapreduce.us-east-1.amazonaws.com",
+	"elastictranscoder":                     "elastictranscoder.us-east-1.amazonaws.com",
+	"emr-containers":                        "emr-containers.us-east-1.amazonaws.com",
+	"es":                                    "es.us-east-1.amazonaws.com",
+	"events":                                "events.us-east-1.amazonaws.com",
+	"evidently":                             "evidently.us-east-1.amazonaws.com",
+	"finspace":                              "finspace.us-east-1.amazonaws.com",
+	"finspace-api":                          "finspace-api.us-east-1.amazonaws.com",
+	"firehose":                              "firehose.us-east-1.amazonaws.com",
+	"fis":                                   "fis.us-east-1.amazonaws.com",
+	"fms":                                   "fms.us-east-1.amazonaws.com",
+	"forecast":                              "forecast.us-east-1.amazonaws.com",
+	"frauddetector":                         "frauddetector.us-east-1.amazonaws.com",
+	"fsx":                                   "fsx.us-east-1.amazonaws.com",
+	"gamelift":                              "gamelift.us-east-1.amazonaws.com",
+	"geo":                                   "geo.us-east-1.amazonaws.com",
+	"glacier":                               "glacier.us-east-1.amazonaws.com",
+	"globalaccelerator":                     "globalaccelerator.us-east-1.amazonaws.com",
+	"glue":                                  "glue.us-east-1.amazonaws.com",
+	"grafana":                               "grafana.us-east-1.amazonaws.com",
+	"greengrass":                            "greengrass.us-east-1.amazonaws.com",
+	"groundstation":                         "groundstation.us-east-1.amazonaws.com",
+	"guardduty":                             "guardduty.us-east-1.amazonaws.com",
+	"health":                                "health.us-east-1.amazonaws.com",
+	"healthlake":                            "healthlake.us-east-1.amazonaws.com",
+	"honeycode":                             "honeycode.us-east-1.amazonaws.com",
+	"iam":                                   "iam.amazonaws.com",
+	"identitystore":                         "identitystore.us-east-1.amazonaws.com",
+	"imagebuilder":                          "imagebuilder.us-east-1.amazonaws.com",
+	"inspector":                             "inspector.us-east-1.amazonaws.com",
+	"inspector2":                            "inspector2.us-east-1.amazonaws.com",
+	"iot":                                   "iot.us-east-1.amazonaws.com",
+	"iot-jobs-data":                         "data.jobs.iot.us-east-1.amazonaws.com",
+	"iot1click":                             "devices.iot1click.us-east-1.amazonaws.com",
+	"iotanalytics":                          "iotanalytics.us-east-1.amazonaws.com",
+	"iotdata":                               "data.iot.us-east-1.amazonaws.com",
+	"iotdeviceadvisor":                      "api.iotdeviceadvisor.us-east-1.amazonaws.com",
+	"iotevents":                             "iotevents.us-east-1.amazonaws.com",
+	"ioteventsdata":                         "data.iotevents.us-east-1.amazonaws.com",
+	"iotfleethub":                           "api.fleethub.iot.us-east-1.amazonaws.com",
+	"iotsecuredtunneling":                   "api.tunneling.iot.us-east-1.amazonaws.com",
+	"iotsitewise":                           "iotsitewise.us-east-1.amazonaws.com",
+	"iotthingsgraph":                        "iotthingsgraph.us-east-1.amazonaws.com",
+	"iotwireless":                           "api.iotwireless.us-east-1.amazonaws.com",
+	"ivs":                                   "ivs.us-east-1.amazonaws.com",
+	"kafka":                                 "kafka.us-east-1.amazonaws.com",
+	"kafkaconnect":                          "kafkaconnect.us-east-1.amazonaws.com",
+	"kendra":                                "kendra.us-east-1.amazonaws.com",
+	"kinesis":                               "kinesis.us-east-1.amazonaws.com",
+	"kinesisanalytics":                      "kinesisanalytics.us-east-1.amazonaws.com",
+	"kinesisvideo":                          "kinesisvideo.us-east-1.amazonaws.com",
+	"kms":                                   "kms.us-east-1.amazonaws.com",
+	"lakeformation":                         "lakeformation.us-east-1.amazonaws.com",
+	"lambda":                                "lambda.us-east-1.amazonaws.com",
+	"lex":                                   "models-v2-lex.us-east-1.amazonaws.com",
+	"license-manager":                       "license-manager.us-east-1.amazonaws.com",
+	"lightsail":                             "lightsail.us-east-1.amazonaws.com",
+	"logs":                                  "logs.us-east-1.amazonaws.com",
+	"lookoutequipment":                      "lookoutequipment.us-east-1.amazonaws.com",
+	"lookoutmetrics":                        "lookoutmetrics.us-east-1.amazonaws.com",
+	"lookoutvision":                         "lookoutvision.us-east-1.amazonaws.com",
+	"machinelearning":                       "machinelearning.us-east-1.amazonaws.com",
+	"macie":                                 "macie.us-east-1.amazonaws.com",
+	"macie2":                                "macie2.us-east-1.amazonaws.com",
+	"managedblockchain":                     "managedblockchain.us-east-1.amazonaws.com",
+	"marketplacecommerceanalytics":          "marketplacecommerceanalytics.us-east-1.amazonaws.com",
+	"mediaconnect":                          "mediaconnect.us-east-1.amazonaws.com",
+	"mediaconvert":                          "mediaconvert.us-east-1.amazonaws.com",
+	"medialive":                             "medialive.us-east-1.amazonaws.com",
+	"mediapackage":                          "mediapackage.us-east-1.amazonaws.com",
+	"mediapackage-vod":                      "mediapackage-vod.us-east-1.amazonaws.com",
+	"mediastore":                            "mediastore.us-east-1.amazonaws.com",
+	"mediatailor":                           "api.mediatailor.us-east-1.amazonaws.com",
+	"memorydb":                              "memory-db.us-east-1.amazonaws.com",
+	"mgh":                                   "mgh.us-east-1.amazonaws.com",
+	"mgn":                                   "mgn.us-east-1.amazonaws.com",
+	"mobiletargeting":                       "pinpoint.us-east-1.amazonaws.com",
+	"monitoring":                            "monitoring.us-east-1.amazonaws.com",
+	"mq":                                    "mq.us-east-1.amazonaws.com",
+	"mturk-requester":                       "mturk-requester.us-east-1.amazonaws.com",
+	"network-firewall":                      "network-firewall.us-east-1.amazonaws.com",
+	"networkmanager":                        "networkmanager.us-west-2.amazonaws.com", // Maps to us-west-2.
+	"nimble":                                "nimble.us-east-1.amazonaws.com",
+	"opsworks":                              "opsworks.us-east-1.amazonaws.com",
+	"opsworks-cm":                           "opsworks-cm.us-east-1.amazonaws.com",
+	"organizations":                         "organizations.us-east-1.amazonaws.com",
+	"outposts":                              "outposts.us-east-1.amazonaws.com",
+	"panorama":                              "panorama.us-east-1.amazonaws.com",
+	"personalize":                           "personalize.us-east-1.amazonaws.com",
+	"pi":                                    "pi.us-east-1.amazonaws.com",
+	"polly":                                 "polly.us-east-1.amazonaws.com",
+	"pricing":                               "api.pricing.us-east-1.amazonaws.com",
+	"profile":                               "profile.us-east-1.amazonaws.com",
+	"qldb":                                  "qldb.us-east-1.amazonaws.com",
+	"quicksight":                            "quicksight.us-east-1.amazonaws.com",
+	"ram":                                   "ram.us-east-1.amazonaws.com",
+	"rbin":                                  "rbin.us-east-1.amazonaws.com",
+	"rds":                                   "rds.us-east-1.amazonaws.com",
+	"rds-data":                              "rds-data.us-east-1.amazonaws.com",
+	"redshift":                              "redshift.us-east-1.amazonaws.com",
+	"redshift-data":                         "redshift-data.us-east-1.amazonaws.com",
+	"refactor-spaces":                       "refactor-spaces.us-east-1.amazonaws.com",
+	"rekognition":                           "rekognition.us-east-1.amazonaws.com",
+	"resiliencehub":                         "resiliencehub.us-east-1.amazonaws.com",
+	"resource-groups":                       "resource-groups.us-east-1.amazonaws.com",
+	"robomaker":                             "robomaker.us-east-1.amazonaws.com",
+	"route53":                               "route53.amazonaws.com",
+	"route53-recovery-cluster":              "route53-recovery-cluster.us-east-1.amazonaws.com",
+	"route53-recovery-control-config":       "route53-recovery-control-config.us-east-1.amazonaws.com",
+	"route53-recovery-readiness":            "route53-recovery-readiness.us-east-1.amazonaws.com",
+	"route53domains":                        "route53domains.us-east-1.amazonaws.com",
+	"route53resolver":                       "route53resolver.us-east-1.amazonaws.com",
+	"rum":                                   "rum.us-east-1.amazonaws.com",
+	"s3":                                    "s3.amazonaws.com",
+	"s3-outposts":                           "s3-outposts.us-east-1.amazonaws.com",
+	"sagemaker":                             "api.sagemaker.us-east-1.amazonaws.com",
+	"savingsplans":                          "savingsplans.amazonaws.com",
+	"schemas":                               "schemas.us-east-1.amazonaws.com",
+	"secretsmanager":                        "secretsmanager.us-east-1.amazonaws.com",
+	"securityhub":                           "securityhub.us-east-1.amazonaws.com",
+	"serverlessrepo":                        "serverlessrepo.us-east-1.amazonaws.com",
+	"servicecatalog":                        "servicecatalog.us-east-1.amazonaws.com",
+	"servicediscovery":                      "servicediscovery.us-east-1.amazonaws.com",
+	"servicequotas":                         "servicequotas.us-east-1.amazonaws.com",
+	"ses":                                   "email.us-east-1.amazonaws.com",
+	"shield":                                "shield.us-east-1.amazonaws.com",
+	"signer":                                "signer.us-east-1.amazonaws.com",
+	"sms":                                   "sms.us-east-1.amazonaws.com",
+	"sms-voice":                             "sms-voice.pinpoint.us-east-1.amazonaws.com",
+	"snow-device-management":                "snow-device-management.us-east-1.amazonaws.com",
+	"snowball":                              "snowball.us-east-1.amazonaws.com",
+	"sns":                                   "sns.us-east-1.amazonaws.com",
+	"sqs":                                   "sqs.us-east-1.amazonaws.com",
+	"ssm":                                   "ssm.us-east-1.amazonaws.com",
+	"ssm-contacts":                          "ssm-contacts.us-east-1.amazonaws.com",
+	"ssm-incidents":                         "ssm-incidents.us-east-1.amazonaws.com",
+	"sso":                                   "sso.us-east-1.amazonaws.com",
+	"states":                                "states.us-east-1.amazonaws.com",
+	"storagegateway":                        "storagegateway.us-east-1.amazonaws.com",
+	"sts":                                   "sts.amazonaws.com",
+	"support":                               "support.us-east-1.amazonaws.com",
+	"swf":                                   "swf.us-east-1.amazonaws.com",
+	"synthetics":                            "synthetics.us-east-1.amazonaws.com",
+	"tagging":                               "tagging.us-east-1.amazonaws.com",
+	"textract":                              "textract.us-east-1.amazonaws.com",
+	"timestream":                            "query.timestream.us-east-1.amazonaws.com",
+	"transcribe":                            "transcribe.us-east-1.amazonaws.com",
+	"transfer":                              "transfer.us-east-1.amazonaws.com",
+	"translate":                             "translate.us-east-1.amazonaws.com",
+	"voiceid":                               "voiceid.us-east-1.amazonaws.com",
+	"waf":                                   "waf.amazonaws.com",
+	"waf-regional":                          "waf-regional.us-east-1.amazonaws.com",
+	"wafv2":                                 "wafv2.us-east-1.amazonaws.com",
+	"wellarchitected":                       "wellarchitected.us-east-1.amazonaws.com",
+	"wisdom":                                "wisdom.us-east-1.amazonaws.com",
+	"workdocs":                              "workdocs.us-east-1.amazonaws.com",
+	"worklink":                              "worklink.us-east-1.amazonaws.com",
+	"workmail":                              "workmail.us-east-1.amazonaws.com",
+	"workmailmessageflow":                   "workmailmessageflow.us-east-1.amazonaws.com",
+	"workspaces":                            "workspaces.us-east-1.amazonaws.com",
+	"workspaces-web":                        "workspaces-web.us-east-1.amazonaws.com",
+	"xray":                                  "xray.us-east-1.amazonaws.com",
+
+	// TODO here is a list of hostnames sharing same signing names. They are
+	// currently commented out since we don't know how to handle them yet.
+	// "apigateway":      "apigateway.us-east-1.amazonaws.com",
+	// "apigateway":      "execute-api.us-east-1.amazonaws.com",
+	// "aws-marketplace": "catalog.marketplace.us-east-1.amazonaws.com",
+	// "aws-marketplace": "entitlement.marketplace.us-east-1.amazonaws.com",
+	// "aws-marketplace": "metering.marketplace.us-east-1.amazonaws.com",
+	// "chime":           "chime.us-east-1.amazonaws.com",
+	// "chime":           "identity-chime.us-east-1.amazonaws.com",
+	// "chime":           "meetings-chime.us-east-1.amazonaws.com",
+	// "chime":           "messaging-chime.us-east-1.amazonaws.com",
+	// "cloudhsm":        "cloudhsm.us-east-1.amazonaws.com",
+	// "cloudhsm":        "cloudhsmv2.us-east-1.amazonaws.com",
+	// "cloudsearch":     "cloudsearch.us-east-1.amazonaws.com",
+	// "cloudsearch":     "cloudsearchdomain.us-east-1.amazonaws.com",
+	// "connect":         "connect.us-east-1.amazonaws.com",
+	// "connect":         "contact-lens.us-east-1.amazonaws.com",
+	// "connect":         "participant.connect.us-east-1.amazonaws.com",
+	// "dynamodb":        "dynamodb.us-east-1.amazonaws.com",
+	// "dynamodb":        "streams.dynamodb.us-east-1.amazonaws.com",
+	// "forecast":        "forecast.us-east-1.amazonaws.com",
+	// "forecast":        "forecastquery.us-east-1.amazonaws.com",
+	// "iot1click":       "devices.iot1click.us-east-1.amazonaws.com",
+	// "iot1click":       "projects.iot1click.us-east-1.amazonaws.com",
+	// "lex":             "models-v2-lex.us-east-1.amazonaws.com",
+	// "lex":             "models.lex.us-east-1.amazonaws.com",
+	// "lex":             "runtime-v2-lex.us-east-1.amazonaws.com",
+	// "lex":             "runtime.lex.us-east-1.amazonaws.com",
+	// "mediastore":      "data.mediastore.us-east-1.amazonaws.com",
+	// "mediastore":      "mediastore.us-east-1.amazonaws.com",
+	// "mgh":             "mgh.us-east-1.amazonaws.com",
+	// "mgh":             "migrationhub-config.us-east-1.amazonaws.com",
+	// "personalize":     "personalize-events.us-east-1.amazonaws.com",
+	// "personalize":     "personalize-runtime.us-east-1.amazonaws.com",
+	// "personalize":     "personalize.us-east-1.amazonaws.com",
+	// "qldb":            "session.qldb.us-east-1.amazonaws.com",
+	// "qldb":            "qldb.us-east-1.amazonaws.com",
+	// "s3":              "s3-control.dualstack.us-east-1.amazonaws.com",
+	// "s3":              "s3.amazonaws.com",
+	// "sagemaker":       "a2i-runtime.sagemaker.us-east-1.amazonaws.com",
+	// "sagemaker":       "api.sagemaker.us-east-1.amazonaws.com",
+	// "sagemaker":       "edge.sagemaker.us-east-1.amazonaws.com",
+	// "sagemaker":       "featurestore-runtime.sagemaker.us-east-1.amazonaws.com",
+	// "sagemaker":       "runtime.sagemaker.us-east-1.amazonaws.com",
+	// "servicecatalog":  "servicecatalog-appregistry.us-east-1.amazonaws.com",
+	// "servicecatalog":  "servicecatalog.us-east-1.amazonaws.com",
+	// "timestream":      "ingest.timestream.us-east-1.amazonaws.com",
+	// "timestream":      "query.timestream.us-east-1.amazonaws.com",
+	// "transcribe":      "transcribe.us-east-1.amazonaws.com",
+	// "transcribe":      "transcribestreaming.us-east-1.amazonaws.com",
+}
+
+func TestResolveEndpoints(t *testing.T) {
+	signer := v4.NewSigner(credentials.NewStaticCredentials("fakeClientKeyID", "fakeClientSecret", ""))
+	region := "us-east-1"
+	now := time.Now()
+
+	for signingName := range signingNameToHostname {
+		req, err := http.NewRequest("GET", "http://localhost", nil)
+		require.NoError(t, err)
+
+		_, err = signer.Sign(req, bytes.NewReader(nil), signingName, region, now)
+		require.NoError(t, err)
+
+		endpoint, err := resolveEndpoint(req)
+		require.NoError(t, err)
+		require.Equal(t, signingName, endpoint.SigningName)
+		require.Equal(t, "https://"+signingNameToHostname[signingName], endpoint.URL, "for signing name %q", signingName)
+	}
+}
diff --git a/lib/srv/app/aws/handler.go b/lib/srv/app/aws/handler.go
index 4a5a820cb099e..96936dd2073b4 100644
--- a/lib/srv/app/aws/handler.go
+++ b/lib/srv/app/aws/handler.go
@@ -185,20 +185,6 @@ func (s *SigningService) formatForwardResponseError(rw http.ResponseWriter, r *h
 	}
 }
 
-// resolveEndpoint extracts the aws-service on and aws-region from the request authorization header
-// and resolves the aws-service and aws-region to AWS endpoint.
-func resolveEndpoint(r *http.Request) (*endpoints.ResolvedEndpoint, error) {
-	awsAuthHeader, err := awsutils.ParseSigV4(r.Header.Get(awsutils.AuthorizationHeader))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	resolvedEndpoint, err := endpoints.DefaultResolver().EndpointFor(awsAuthHeader.Service, awsAuthHeader.Region)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return &resolvedEndpoint, nil
-}
-
 // prepareSignedRequest creates a new HTTP request and rewrites the header from the original request and returns a new
 // HTTP request signed by STS AWS API.
 func (s *SigningService) prepareSignedRequest(r *http.Request, re *endpoints.ResolvedEndpoint, identity *tlsca.Identity) (*http.Request, error) {
diff --git a/lib/srv/app/server.go b/lib/srv/app/server.go
index 148a039f3c3dc..83e3a9f5884b2 100644
--- a/lib/srv/app/server.go
+++ b/lib/srv/app/server.go
@@ -203,10 +203,10 @@ func (m *monitoredApps) setResources(apps types.Apps) {
 	m.resources = apps
 }
 
-func (m *monitoredApps) get() types.ResourcesWithLabels {
+func (m *monitoredApps) get() types.ResourcesWithLabelsMap {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	return append(m.static, m.resources...).AsResources()
+	return append(m.static, m.resources...).AsResources().ToMap()
 }
 
 // New returns a new application server.
diff --git a/lib/srv/app/server_test.go b/lib/srv/app/server_test.go
index 0f6bbbe67e788..aa1a6e935c0af 100644
--- a/lib/srv/app/server_test.go
+++ b/lib/srv/app/server_test.go
@@ -155,7 +155,7 @@ func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 	err = s.tlsServer.Auth().UpsertRole(context.Background(), s.role)
 	require.NoError(t, err)
 
-	rootCA, err := s.tlsServer.Auth().GetCertAuthority(types.CertAuthID{
+	rootCA, err := s.tlsServer.Auth().GetCertAuthority(context.Background(), types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: "root.example.com",
 	}, false)
diff --git a/lib/srv/app/watcher.go b/lib/srv/app/watcher.go
index 7f8cc11b1f81c..94552cf92be37 100644
--- a/lib/srv/app/watcher.go
+++ b/lib/srv/app/watcher.go
@@ -18,11 +18,13 @@ package app
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/services"
-
+	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/trace"
 )
 
@@ -82,7 +84,11 @@ func (s *Server) startResourceWatcher(ctx context.Context) (*services.AppWatcher
 		for {
 			select {
 			case apps := <-watcher.AppsC:
-				s.monitoredApps.setResources(apps)
+				appsWithAddr := make(types.Apps, 0, len(apps))
+				for _, app := range apps {
+					appsWithAddr = append(appsWithAddr, s.guessPublicAddr(app))
+				}
+				s.monitoredApps.setResources(appsWithAddr)
 				select {
 				case s.reconcileCh <- struct{}{}:
 				case <-ctx.Done():
@@ -97,8 +103,54 @@ func (s *Server) startResourceWatcher(ctx context.Context) (*services.AppWatcher
 	return watcher, nil
 }
 
-func (s *Server) getResources() (resources types.ResourcesWithLabels) {
-	return s.getApps().AsResources()
+// guessPublicAddr will guess PublicAddr for given application if it is missing, based on proxy information and app name.
+func (s *Server) guessPublicAddr(app types.Application) types.Application {
+	if app.GetPublicAddr() != "" {
+		return app
+	}
+	appCopy := app.Copy()
+	pubAddr, err := FindPublicAddr(s.c.AccessPoint, app.GetPublicAddr(), app.GetName())
+	if err == nil {
+		appCopy.Spec.PublicAddr = pubAddr
+	} else {
+		s.log.WithError(err).Errorf("Unable to find public address for app %q, leaving empty.", app.GetName())
+	}
+	return appCopy
+}
+
+// FindPublicAddr tries to resolve the public address of the proxy of this cluster.
+func FindPublicAddr(authClient auth.ReadAppsAccessPoint, appPublicAddr string, appName string) (string, error) {
+	// If the application has a public address already set, use it.
+	if appPublicAddr != "" {
+		return appPublicAddr, nil
+	}
+
+	// Fetch list of proxies, if first has public address set, use it.
+	servers, err := authClient.GetProxies()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	if len(servers) == 0 {
+		return "", trace.BadParameter("cluster has no proxy registered, at least one proxy must be registered for application access")
+	}
+	if servers[0].GetPublicAddr() != "" {
+		addr, err := utils.ParseAddr(servers[0].GetPublicAddr())
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+		return fmt.Sprintf("%v.%v", appName, addr.Host()), nil
+	}
+
+	// Fall back to cluster name.
+	cn, err := authClient.GetClusterName()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return fmt.Sprintf("%v.%v", appName, cn.GetClusterName()), nil
+}
+
+func (s *Server) getResources() (resources types.ResourcesWithLabelsMap) {
+	return s.getApps().AsResources().ToMap()
 }
 
 func (s *Server) onCreate(ctx context.Context, resource types.ResourceWithLabels) error {
diff --git a/lib/srv/authhandlers.go b/lib/srv/authhandlers.go
index 4664b43a2f33a..0615da51ca3f8 100644
--- a/lib/srv/authhandlers.go
+++ b/lib/srv/authhandlers.go
@@ -17,6 +17,7 @@ limitations under the License.
 package srv
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -507,7 +508,7 @@ func (h *AuthHandlers) fetchRoleSet(cert *ssh.Certificate, ca types.CertAuthorit
 // Certificate Authority and returns it.
 func (h *AuthHandlers) authorityForCert(caType types.CertAuthType, key ssh.PublicKey) (types.CertAuthority, error) {
 	// get all certificate authorities for given type
-	cas, err := h.c.AccessPoint.GetCertAuthorities(caType, false)
+	cas, err := h.c.AccessPoint.GetCertAuthorities(context.TODO(), caType, false)
 	if err != nil {
 		h.log.Warnf("%v", trace.DebugReport(err))
 		return nil, trace.Wrap(err)
diff --git a/lib/srv/ctx.go b/lib/srv/ctx.go
index 05157991b7809..273e9172d4c42 100644
--- a/lib/srv/ctx.go
+++ b/lib/srv/ctx.go
@@ -99,7 +99,7 @@ type AccessPoint interface {
 	GetRole(ctx context.Context, name string) (types.Role, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 }
 
 // Server is regular or forwarding SSH server.
@@ -369,6 +369,18 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 		cancel:                 cancel,
 	}
 
+	fields := log.Fields{
+		"local":        child.ServerConn.LocalAddr(),
+		"remote":       child.ServerConn.RemoteAddr(),
+		"login":        child.Identity.Login,
+		"teleportUser": child.Identity.TeleportUser,
+		"id":           child.id,
+	}
+	child.Entry = log.WithFields(log.Fields{
+		trace.Component:       child.srv.Component(),
+		trace.ComponentFields: fields,
+	})
+
 	authPref, err := srv.GetAccessPoint().GetAuthPreference(ctx)
 	if err != nil {
 		childErr := child.Close()
@@ -379,13 +391,7 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 		child.disconnectExpiredCert = identityContext.CertValidBefore
 	}
 
-	fields := log.Fields{
-		"local":        child.ServerConn.LocalAddr(),
-		"remote":       child.ServerConn.RemoteAddr(),
-		"login":        child.Identity.Login,
-		"teleportUser": child.Identity.TeleportUser,
-		"id":           child.id,
-	}
+	// Update log entry fields.
 	if !child.disconnectExpiredCert.IsZero() {
 		fields["cert"] = child.disconnectExpiredCert
 	}
diff --git a/lib/srv/db/access_test.go b/lib/srv/db/access_test.go
index e8824cd564219..d7f0884f2ee2c 100644
--- a/lib/srv/db/access_test.go
+++ b/lib/srv/db/access_test.go
@@ -23,7 +23,6 @@ import (
 	"fmt"
 	"net"
 	"os"
-	"sort"
 	"sync"
 	"testing"
 	"time"
@@ -429,6 +428,31 @@ func TestAccessMySQLChangeUser(t *testing.T) {
 	require.Error(t, err)
 }
 
+func TestMySQLCloseConnection(t *testing.T) {
+	ctx := context.Background()
+	testCtx := setupTestContext(ctx, t, withSelfHostedMySQL("mysql"))
+	go testCtx.startHandlingConnections()
+
+	// Create user/role with the requested permissions.
+	testCtx.createUserAndRole(ctx, t, "alice", "admin", []string{"alice"}, []string{types.Wildcard})
+
+	// Connect to the database as this user.
+	mysqlConn, err := testCtx.mysqlClient("alice", "mysql", "alice")
+	require.NoError(t, err)
+
+	_, err = mysqlConn.Execute("select 1")
+	require.NoError(t, err)
+
+	// Close connection to DB proxy
+	err = mysqlConn.Close()
+	require.NoError(t, err)
+
+	// DB proxy should close the DB connection and send COM_QUIT message.
+	require.Eventually(t, func() bool {
+		return testCtx.mysql["mysql"].db.ConnsClosed()
+	}, 2*time.Second, 100*time.Millisecond)
+}
+
 // TestAccessRedisAUTHDefaultCmd checks if empty user can log in to Redis as default.
 func TestAccessRedisAUTHDefaultCmd(t *testing.T) {
 	ctx := context.Background()
@@ -493,6 +517,9 @@ func TestAccessMySQLServerPacket(t *testing.T) {
 	// in a way that previously would cause our packet parsing logic to fail.
 	_, err = mysqlConn.Execute("show tables")
 	require.NoError(t, err)
+
+	err = mysqlConn.Close()
+	require.NoError(t, err)
 }
 
 // TestGCPRequireSSL tests connecting to GCP Cloud SQL Postgres and MySQL
@@ -771,12 +798,12 @@ func TestAccessMongoDB(t *testing.T) {
 					testCtx.createUserAndRole(ctx, t, test.user, test.role, test.allowDbUsers, test.allowDbNames)
 
 					// Try to connect to the database as this user.
-					client, err := testCtx.mongoClient(ctx, test.user, "mongo", test.dbUser, clientOpt.opts)
-					defer func() {
-						if client != nil {
-							client.Disconnect(ctx)
+					mongoClient, err := testCtx.mongoClient(ctx, test.user, "mongo", test.dbUser, clientOpt.opts)
+					t.Cleanup(func() {
+						if mongoClient != nil {
+							require.NoError(t, mongoClient.Disconnect(ctx))
 						}
-					}()
+					})
 					if test.connectErr != "" {
 						require.Error(t, err)
 						require.Contains(t, err.Error(), test.connectErr)
@@ -785,13 +812,14 @@ func TestAccessMongoDB(t *testing.T) {
 					require.NoError(t, err)
 
 					// Execute a "find" command. Collection name doesn't matter currently.
-					_, err = client.Database(test.dbName).Collection("test").Find(ctx, bson.M{})
+					records, err := mongoClient.Database(test.dbName).Collection("test").Find(ctx, bson.M{})
 					if test.queryErr != "" {
 						require.Error(t, err)
 						require.Contains(t, err.Error(), test.queryErr)
 						return
 					}
 					require.NoError(t, err)
+					require.NoError(t, records.Close(ctx))
 				})
 			}
 		}
@@ -921,7 +949,7 @@ func TestCompatibilityWithOldAgents(t *testing.T) {
 		},
 	})
 	go func() {
-		for conn := range testCtx.proxyConn {
+		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
 			go databaseServer.HandleConnection(conn)
 		}
 	}()
@@ -1222,7 +1250,6 @@ type testContext struct {
 	mux            *multiplexer.Mux
 	mysqlListener  net.Listener
 	webListener    *multiplexer.WebListener
-	proxyConn      chan net.Conn
 	fakeRemoteSite *reversetunnel.FakeRemoteSite
 	server         *Server
 	emitter        *testEmitter
@@ -1300,7 +1327,7 @@ func (c *testContext) startHandlingConnections() {
 	// Start all proxy services.
 	c.startProxy()
 	// Start handling database client connections on the database server.
-	for conn := range c.proxyConn {
+	for conn := range c.fakeRemoteSite.ProxyConn() {
 		go c.server.HandleConnection(conn)
 	}
 }
@@ -1518,6 +1545,12 @@ func (c *testContext) Close() error {
 	return trace.NewAggregate(errors...)
 }
 
+func init() {
+	// Override database agents shuffle behavior to ensure they're always
+	// tried in the same order during tests. Used for HA tests.
+	SetShuffleFunc(ShuffleSort)
+}
+
 func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDatabaseOption) *testContext {
 	testCtx := &testContext{
 		clusterName: "root.example.com",
@@ -1538,8 +1571,12 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 		Dir:         t.TempDir(),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, authServer.Close()) })
+
 	testCtx.tlsServer, err = authServer.NewTestTLSServer()
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testCtx.tlsServer.Close()) })
+
 	testCtx.authServer = testCtx.tlsServer.Auth()
 
 	// Create multiplexer.
@@ -1557,6 +1594,7 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 		Listener: tls.NewListener(testCtx.mux.TLS(), testCtx.makeTLSConfig(t)),
 	})
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, testCtx.webListener.Close()) })
 
 	// Create MySQL proxy listener.
 	testCtx.mysqlListener, err = net.Listen("tcp", "localhost:0")
@@ -1572,12 +1610,16 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 	// Auth client for database service.
 	testCtx.authClient, err = testCtx.tlsServer.NewClient(auth.TestServerID(types.RoleDatabase, testCtx.hostID))
 	require.NoError(t, err)
-	testCtx.hostCA, err = testCtx.authClient.GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: testCtx.clusterName}, false)
+	t.Cleanup(func() { require.NoError(t, testCtx.authClient.Close()) })
+
+	testCtx.hostCA, err = testCtx.authClient.GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: testCtx.clusterName}, false)
 	require.NoError(t, err)
 
 	// Auth client, lock watcher and authorizer for database proxy.
 	proxyAuthClient, err := testCtx.tlsServer.NewClient(auth.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, proxyAuthClient.Close()) })
+
 	proxyLockWatcher, err := services.NewLockWatcher(ctx, services.LockWatcherConfig{
 		ResourceWatcherConfig: services.ResourceWatcherConfig{
 			Component: teleport.ComponentProxy,
@@ -1601,12 +1643,10 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 	}
 
 	// Establish fake reversetunnel b/w database proxy and database service.
-	testCtx.proxyConn = make(chan net.Conn)
-	testCtx.fakeRemoteSite = &reversetunnel.FakeRemoteSite{
-		Name:        testCtx.clusterName,
-		ConnCh:      testCtx.proxyConn,
-		AccessPoint: proxyAuthClient,
-	}
+	testCtx.fakeRemoteSite = reversetunnel.NewFakeRemoteSite(testCtx.clusterName, proxyAuthClient)
+	t.Cleanup(func() {
+		testCtx.fakeRemoteSite.Close()
+	})
 	tunnel := &reversetunnel.FakeServer{
 		Sites: []reversetunnel.RemoteSite{
 			testCtx.fakeRemoteSite,
@@ -1630,11 +1670,6 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 		Emitter:     testCtx.emitter,
 		Clock:       testCtx.clock,
 		ServerID:    "proxy-server",
-		Shuffle: func(servers []types.DatabaseServer) []types.DatabaseServer {
-			// To ensure predictability in tests, sort servers instead of shuffling.
-			sort.Sort(types.DatabaseServers(servers))
-			return servers
-		},
 		LockWatcher: proxyLockWatcher,
 	})
 	require.NoError(t, err)
@@ -1929,7 +1964,9 @@ func withSelfHostedMySQL(name string) withDatabaseOption {
 		})
 		require.NoError(t, err)
 		go mysqlServer.Serve()
-		t.Cleanup(func() { mysqlServer.Close() })
+		t.Cleanup(func() {
+			require.NoError(t, mysqlServer.Close())
+		})
 		database, err := types.NewDatabaseV3(types.Metadata{
 			Name: name,
 		}, types.DatabaseSpecV3{
diff --git a/lib/srv/db/audit_test.go b/lib/srv/db/audit_test.go
index 4b85e6058dbd7..c6d621b62b782 100644
--- a/lib/srv/db/audit_test.go
+++ b/lib/srv/db/audit_test.go
@@ -122,22 +122,22 @@ func TestAuditMongo(t *testing.T) {
 	waitForEvent(t, testCtx, libevents.DatabaseSessionStartFailureCode)
 
 	// Connect should trigger successful session start event.
-	mongo, err := testCtx.mongoClient(ctx, "alice", "mongo", "admin")
+	mongoClient, err := testCtx.mongoClient(ctx, "alice", "mongo", "admin")
 	require.NoError(t, err)
 	waitForEvent(t, testCtx, libevents.DatabaseSessionStartCode)
 
 	// Find command in a database we don't have access to.
-	_, err = mongo.Database("notadmin").Collection("test").Find(ctx, bson.M{})
+	_, err = mongoClient.Database("notadmin").Collection("test").Find(ctx, bson.M{})
 	require.Error(t, err)
 	waitForEvent(t, testCtx, libevents.DatabaseSessionQueryFailedCode)
 
 	// Find command should trigger the query event.
-	_, err = mongo.Database("admin").Collection("test").Find(ctx, bson.M{})
+	_, err = mongoClient.Database("admin").Collection("test").Find(ctx, bson.M{})
 	require.NoError(t, err)
 	waitForEvent(t, testCtx, libevents.DatabaseSessionQueryCode)
 
 	// Closing connection should trigger session end event.
-	err = mongo.Disconnect(ctx)
+	err = mongoClient.Disconnect(ctx)
 	require.NoError(t, err)
 	waitForEvent(t, testCtx, libevents.DatabaseSessionEndCode)
 }
diff --git a/lib/srv/db/ca.go b/lib/srv/db/ca.go
index dbb4a05b53097..aeb3c8c01a80c 100644
--- a/lib/srv/db/ca.go
+++ b/lib/srv/db/ca.go
@@ -19,8 +19,9 @@ package db
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
+	"os"
 	"path/filepath"
 
 	"github.com/gravitational/teleport"
@@ -81,7 +82,7 @@ func (s *Server) getCACert(ctx context.Context, database types.Database) ([]byte
 	// It's already downloaded.
 	if err == nil {
 		s.log.Debugf("Loaded CA certificate %v.", filePath)
-		return ioutil.ReadFile(filePath)
+		return os.ReadFile(filePath)
 	}
 	// Otherwise download it.
 	s.log.Debugf("Downloading CA certificate for %v.", database)
@@ -90,7 +91,7 @@ func (s *Server) getCACert(ctx context.Context, database types.Database) ([]byte
 		return nil, trace.Wrap(err)
 	}
 	// Save to the filesystem.
-	err = ioutil.WriteFile(filePath, bytes, teleport.FileMaskOwnerOnly)
+	err = os.WriteFile(filePath, bytes, teleport.FileMaskOwnerOnly)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -158,7 +159,7 @@ func (d *realDownloader) downloadFromURL(downloadURL string) ([]byte, error) {
 		return nil, trace.BadParameter("status code %v when fetching from %q",
 			resp.StatusCode, downloadURL)
 	}
-	bytes, err := ioutil.ReadAll(resp.Body)
+	bytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/srv/db/ca_test.go b/lib/srv/db/ca_test.go
index 5525f81697934..663dd5dba4e98 100644
--- a/lib/srv/db/ca_test.go
+++ b/lib/srv/db/ca_test.go
@@ -237,7 +237,7 @@ func setupPostgres(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *tes
 	})
 
 	go func() {
-		for conn := range testCtx.proxyConn {
+		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
 			go server1.HandleConnection(conn)
 		}
 	}()
@@ -282,7 +282,7 @@ func setupMySQL(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *testCo
 	})
 
 	go func() {
-		for conn := range testCtx.proxyConn {
+		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
 			go server1.HandleConnection(conn)
 		}
 	}()
@@ -307,7 +307,9 @@ func setupMongo(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *testCo
 	})
 	require.NoError(t, err)
 	go mongoServer.Serve()
-	t.Cleanup(func() { mongoServer.Close() })
+	t.Cleanup(func() {
+		require.NoError(t, mongoServer.Close())
+	})
 
 	mongoDB, err := types.NewDatabaseV3(types.Metadata{
 		Name: "mongo",
@@ -325,9 +327,12 @@ func setupMongo(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *testCo
 	server1 := testCtx.setupDatabaseServer(ctx, t, agentParams{
 		Databases: types.Databases{mongoDB},
 	})
+	t.Cleanup(func() {
+		require.NoError(t, server1.Close())
+	})
 
 	go func() {
-		for conn := range testCtx.proxyConn {
+		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
 			go server1.HandleConnection(conn)
 		}
 	}()
@@ -463,11 +468,12 @@ func TestTLSConfiguration(t *testing.T) {
 						})
 
 						mongoConn, err := testCtx.mongoClient(ctx, "bob", "mongo", "admin")
-						if tt.errMsg == "" {
-							require.NoError(t, err)
-
+						t.Cleanup(func() {
 							err = mongoConn.Disconnect(ctx)
 							require.NoError(t, err)
+						})
+						if tt.errMsg == "" {
+							require.NoError(t, err)
 						} else {
 							require.Error(t, err)
 							// Do not verify Mongo error message. On authentication error Mongo re-tries and
diff --git a/lib/srv/db/cloud/watchers/rds.go b/lib/srv/db/cloud/watchers/rds.go
index 8d11c09d28334..17fa187f6787d 100644
--- a/lib/srv/db/cloud/watchers/rds.go
+++ b/lib/srv/db/cloud/watchers/rds.go
@@ -106,6 +106,21 @@ func (f *rdsDBInstancesFetcher) getRDSDatabases(ctx context.Context) (types.Data
 	}
 	databases := make(types.Databases, 0, len(instances))
 	for _, instance := range instances {
+		if !services.IsRDSInstanceSupported(instance) {
+			f.log.Debugf("RDS instance %q (engine mode %v, engine version %v) doesn't support IAM authentication. Skipping.",
+				aws.StringValue(instance.DBInstanceIdentifier),
+				aws.StringValue(instance.Engine),
+				aws.StringValue(instance.EngineVersion))
+			continue
+		}
+
+		if !services.IsRDSInstanceAvailable(instance) {
+			f.log.Debugf("The current status of RDS instance %q is %q. Skipping.",
+				aws.StringValue(instance.DBInstanceIdentifier),
+				aws.StringValue(instance.DBInstanceStatus))
+			continue
+		}
+
 		database, err := services.NewDatabaseFromRDSInstance(instance)
 		if err != nil {
 			f.log.Warnf("Could not convert RDS instance %q to database resource: %v.",
@@ -195,6 +210,13 @@ func (f *rdsAuroraClustersFetcher) getAuroraDatabases(ctx context.Context) (type
 			continue
 		}
 
+		if !services.IsRDSClusterAvailable(cluster) {
+			f.log.Debugf("The current status of Aurora cluster %q is %q. Skipping.",
+				aws.StringValue(cluster.DBClusterIdentifier),
+				aws.StringValue(cluster.Status))
+			continue
+		}
+
 		// Add a database from primary endpoint
 		database, err := services.NewDatabaseFromRDSCluster(cluster)
 		if err != nil {
@@ -261,7 +283,8 @@ func rdsFilters() []*rds.Filter {
 		Name: aws.String("engine"),
 		Values: aws.StringSlice([]string{
 			services.RDSEnginePostgres,
-			services.RDSEngineMySQL}),
+			services.RDSEngineMySQL,
+			services.RDSEngineMariaDB}),
 	}}
 }
 
diff --git a/lib/srv/db/cloud/watchers/redshift.go b/lib/srv/db/cloud/watchers/redshift.go
index 2a8f8a98ba7db..33baed413046d 100644
--- a/lib/srv/db/cloud/watchers/redshift.go
+++ b/lib/srv/db/cloud/watchers/redshift.go
@@ -86,6 +86,13 @@ func (f *redshiftFetcher) Get(ctx context.Context) (types.Databases, error) {
 
 	var databases types.Databases
 	for _, cluster := range clusters {
+		if !services.IsRedshiftClusterAvailable(cluster) {
+			f.log.Debugf("The current status of Redshift cluster %q is %q. Skipping.",
+				aws.StringValue(cluster.ClusterIdentifier),
+				aws.StringValue(cluster.ClusterStatus))
+			continue
+		}
+
 		database, err := services.NewDatabaseFromRedshiftCluster(cluster)
 		if err != nil {
 			f.log.Infof("Could not convert Redshift cluster %q to database resource: %v.",
diff --git a/lib/srv/db/cloud/watchers/watcher_test.go b/lib/srv/db/cloud/watchers/watcher_test.go
index f8ab8f50e662d..bcb3ddb8fa7e7 100644
--- a/lib/srv/db/cloud/watchers/watcher_test.go
+++ b/lib/srv/db/cloud/watchers/watcher_test.go
@@ -44,14 +44,20 @@ func TestWatcher(t *testing.T) {
 	rdsInstance2, _ := makeRDSInstance(t, "instance-2", "us-east-2", map[string]string{"env": "prod"})
 	rdsInstance3, _ := makeRDSInstance(t, "instance-3", "us-east-1", map[string]string{"env": "dev"})
 	rdsInstance4, rdsDatabase4 := makeRDSInstance(t, "instance-4", "us-west-1", nil)
+	rdsInstanceUnavailable, _ := makeRDSInstance(t, "instance-5", "us-west-1", nil, withRDSInstanceStatus("stopped"))
+	rdsInstanceUnknownStatus, rdsDatabaseUnknownStatus := makeRDSInstance(t, "instance-5", "us-west-6", nil, withRDSInstanceStatus("status-does-not-exist"))
 
-	auroraCluster1, auroraDatabase1 := makeRDSCluster(t, "cluster-1", "us-east-1", services.RDSEngineModeProvisioned, map[string]string{"env": "prod"})
+	auroraCluster1, auroraDatabase1 := makeRDSCluster(t, "cluster-1", "us-east-1", map[string]string{"env": "prod"})
 	auroraCluster2, auroraDatabases2 := makeRDSClusterWithExtraEndpoints(t, "cluster-2", "us-east-2", map[string]string{"env": "dev"})
-	auroraCluster3, _ := makeRDSCluster(t, "cluster-3", "us-east-2", services.RDSEngineModeProvisioned, map[string]string{"env": "prod"})
-	auroraClusterUnsupported, _ := makeRDSCluster(t, "serverless", "us-east-1", services.RDSEngineModeServerless, map[string]string{"env": "prod"})
+	auroraCluster3, _ := makeRDSCluster(t, "cluster-3", "us-east-2", map[string]string{"env": "prod"})
+	auroraClusterUnsupported, _ := makeRDSCluster(t, "serverless", "us-east-1", nil, withRDSClusterEngineMode("serverless"))
+	auroraClusterUnavailable, _ := makeRDSCluster(t, "cluster-4", "us-east-1", nil, withRDSClusterStatus("creating"))
+	auroraClusterUnknownStatus, auroraDatabaseUnknownStatus := makeRDSCluster(t, "cluster-5", "us-east-1", nil, withRDSClusterStatus("status-does-not-exist"))
 
 	redshiftUse1Prod, redshiftDatabaseUse1Prod := makeRedshiftCluster(t, "us-east-1", "prod")
 	redshiftUse1Dev, _ := makeRedshiftCluster(t, "us-east-1", "dev")
+	redshiftUse1Unavailable, _ := makeRedshiftCluster(t, "us-east-1", "qa", withRedshiftStatus("paused"))
+	redshiftUse1UnknownStatus, redshiftDatabaseUnknownStatus := makeRedshiftCluster(t, "us-east-1", "test", withRedshiftStatus("status-does-not-exist"))
 
 	tests := []struct {
 		name              string
@@ -60,7 +66,7 @@ func TestWatcher(t *testing.T) {
 		expectedDatabases types.Databases
 	}{
 		{
-			name: "rds labels matching",
+			name: "RDS labels matching",
 			awsMatchers: []services.AWSMatcher{
 				{
 					Types:   []string{services.AWSMatcherRDS},
@@ -88,7 +94,7 @@ func TestWatcher(t *testing.T) {
 			expectedDatabases: append(types.Databases{rdsDatabase1, auroraDatabase1}, auroraDatabases2...),
 		},
 		{
-			name: "rds aurora unsupported",
+			name: "RDS unsupported databases are skipped",
 			awsMatchers: []services.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRDS},
 				Regions: []string{"us-east-1"},
@@ -103,6 +109,21 @@ func TestWatcher(t *testing.T) {
 			},
 			expectedDatabases: types.Databases{auroraDatabase1},
 		},
+		{
+			name: "RDS unavailable databases are skipped",
+			awsMatchers: []services.AWSMatcher{{
+				Types:   []string{services.AWSMatcherRDS},
+				Regions: []string{"us-east-1"},
+				Tags:    types.Labels{"*": []string{"*"}},
+			}},
+			clients: &common.TestCloudClients{
+				RDS: &cloud.RDSMock{
+					DBInstances: []*rds.DBInstance{rdsInstance1, rdsInstanceUnavailable, rdsInstanceUnknownStatus},
+					DBClusters:  []*rds.DBCluster{auroraCluster1, auroraClusterUnavailable, auroraClusterUnknownStatus},
+				},
+			},
+			expectedDatabases: types.Databases{rdsDatabase1, rdsDatabaseUnknownStatus, auroraDatabase1, auroraDatabaseUnknownStatus},
+		},
 		{
 			name: "skip access denied errors",
 			awsMatchers: []services.AWSMatcher{{
@@ -126,7 +147,7 @@ func TestWatcher(t *testing.T) {
 			expectedDatabases: types.Databases{rdsDatabase4, auroraDatabase1},
 		},
 		{
-			name: "redshift",
+			name: "Redshift labels matching",
 			awsMatchers: []services.AWSMatcher{
 				{
 					Types:   []string{services.AWSMatcherRedshift},
@@ -141,6 +162,22 @@ func TestWatcher(t *testing.T) {
 			},
 			expectedDatabases: types.Databases{redshiftDatabaseUse1Prod},
 		},
+		{
+			name: "Redshift unavailable databases are skipped",
+			awsMatchers: []services.AWSMatcher{
+				{
+					Types:   []string{services.AWSMatcherRedshift},
+					Regions: []string{"us-east-1"},
+					Tags:    types.Labels{"*": []string{"*"}},
+				},
+			},
+			clients: &common.TestCloudClients{
+				Redshift: &cloud.RedshiftMock{
+					Clusters: []*redshift.Cluster{redshiftUse1Prod, redshiftUse1Unavailable, redshiftUse1UnknownStatus},
+				},
+			},
+			expectedDatabases: types.Databases{redshiftDatabaseUse1Prod, redshiftDatabaseUnknownStatus},
+		},
 		{
 			name: "matcher with multiple types",
 			awsMatchers: []services.AWSMatcher{
@@ -178,43 +215,54 @@ func TestWatcher(t *testing.T) {
 	}
 }
 
-func makeRDSInstance(t *testing.T, name, region string, labels map[string]string) (*rds.DBInstance, types.Database) {
+func makeRDSInstance(t *testing.T, name, region string, labels map[string]string, opts ...func(*rds.DBInstance)) (*rds.DBInstance, types.Database) {
 	instance := &rds.DBInstance{
 		DBInstanceArn:        aws.String(fmt.Sprintf("arn:aws:rds:%v:1234567890:db:%v", region, name)),
 		DBInstanceIdentifier: aws.String(name),
 		DbiResourceId:        aws.String(uuid.New().String()),
 		Engine:               aws.String(services.RDSEnginePostgres),
+		DBInstanceStatus:     aws.String("available"),
 		Endpoint: &rds.Endpoint{
 			Address: aws.String("localhost"),
 			Port:    aws.Int64(5432),
 		},
 		TagList: labelsToTags(labels),
 	}
+	for _, opt := range opts {
+		opt(instance)
+	}
+
 	database, err := services.NewDatabaseFromRDSInstance(instance)
 	require.NoError(t, err)
 	return instance, database
 }
 
-func makeRDSCluster(t *testing.T, name, region, engineMode string, labels map[string]string) (*rds.DBCluster, types.Database) {
+func makeRDSCluster(t *testing.T, name, region string, labels map[string]string, opts ...func(*rds.DBCluster)) (*rds.DBCluster, types.Database) {
 	cluster := &rds.DBCluster{
 		DBClusterArn:        aws.String(fmt.Sprintf("arn:aws:rds:%v:1234567890:cluster:%v", region, name)),
 		DBClusterIdentifier: aws.String(name),
 		DbClusterResourceId: aws.String(uuid.New().String()),
 		Engine:              aws.String(services.RDSEngineAuroraMySQL),
-		EngineMode:          aws.String(engineMode),
+		EngineMode:          aws.String(services.RDSEngineModeProvisioned),
+		Status:              aws.String("available"),
 		Endpoint:            aws.String("localhost"),
 		Port:                aws.Int64(3306),
 		TagList:             labelsToTags(labels),
 	}
+	for _, opt := range opts {
+		opt(cluster)
+	}
+
 	database, err := services.NewDatabaseFromRDSCluster(cluster)
 	require.NoError(t, err)
 	return cluster, database
 }
 
-func makeRedshiftCluster(t *testing.T, region, env string) (*redshift.Cluster, types.Database) {
+func makeRedshiftCluster(t *testing.T, region, env string, opts ...func(*redshift.Cluster)) (*redshift.Cluster, types.Database) {
 	cluster := &redshift.Cluster{
 		ClusterIdentifier:   aws.String(env),
 		ClusterNamespaceArn: aws.String(fmt.Sprintf("arn:aws:redshift:%s:1234567890:namespace:%s", region, env)),
+		ClusterStatus:       aws.String("available"),
 		Endpoint: &redshift.Endpoint{
 			Address: aws.String("localhost"),
 			Port:    aws.Int64(5439),
@@ -224,6 +272,10 @@ func makeRedshiftCluster(t *testing.T, region, env string) (*redshift.Cluster, t
 			Value: aws.String(env),
 		}},
 	}
+	for _, opt := range opts {
+		opt(cluster)
+	}
+
 	database, err := services.NewDatabaseFromRedshiftCluster(cluster)
 	require.NoError(t, err)
 	return cluster, database
@@ -236,6 +288,7 @@ func makeRDSClusterWithExtraEndpoints(t *testing.T, name, region string, labels
 		DbClusterResourceId: aws.String(uuid.New().String()),
 		Engine:              aws.String(services.RDSEngineAuroraMySQL),
 		EngineMode:          aws.String(services.RDSEngineModeProvisioned),
+		Status:              aws.String("available"),
 		Endpoint:            aws.String("localhost"),
 		ReaderEndpoint:      aws.String("reader.host"),
 		Port:                aws.Int64(3306),
@@ -259,6 +312,34 @@ func makeRDSClusterWithExtraEndpoints(t *testing.T, name, region string, labels
 	return cluster, append(types.Databases{primaryDatabase, readerDatabase}, customDatabases...)
 }
 
+// withRDSInstanceStatus returns an option function for makeRDSInstance to overwrite status.
+func withRDSInstanceStatus(status string) func(*rds.DBInstance) {
+	return func(instance *rds.DBInstance) {
+		instance.DBInstanceStatus = aws.String(status)
+	}
+}
+
+// withRDSClusterEngineMode returns an option function for makeRDSCluster to overwrite engine mode.
+func withRDSClusterEngineMode(mode string) func(*rds.DBCluster) {
+	return func(cluster *rds.DBCluster) {
+		cluster.EngineMode = aws.String(mode)
+	}
+}
+
+// withRDSClusterStatus returns an option function for makeRDSCluster to overwrite status.
+func withRDSClusterStatus(status string) func(*rds.DBCluster) {
+	return func(cluster *rds.DBCluster) {
+		cluster.Status = aws.String(status)
+	}
+}
+
+// withRedshiftStatus returns an option function for makeRedshiftCluster to overwrite status.
+func withRedshiftStatus(status string) func(*redshift.Cluster) {
+	return func(cluster *redshift.Cluster) {
+		cluster.ClusterStatus = aws.String(status)
+	}
+}
+
 func labelsToTags(labels map[string]string) (tags []*rds.Tag) {
 	for key, val := range labels {
 		tags = append(tags, &rds.Tag{
diff --git a/lib/srv/db/common/errors.go b/lib/srv/db/common/errors.go
index 3ba4483086be4..298ce5f3187b0 100644
--- a/lib/srv/db/common/errors.go
+++ b/lib/srv/db/common/errors.go
@@ -18,8 +18,10 @@ package common
 
 import (
 	"net/http"
+	"strings"
 
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
+	"github.com/gravitational/teleport/lib/defaults"
 
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/jackc/pgconn"
@@ -102,3 +104,57 @@ type causer interface {
 type pgError interface {
 	Unwrap() error
 }
+
+// ConvertConnectError converts common connection errors to trace errors with
+// extra information/recommendations if necessary.
+func ConvertConnectError(err error, sessionCtx *Session) error {
+	errString := err.Error()
+	switch {
+	case strings.Contains(errString, "x509: certificate signed by unknown authority"):
+		return trace.AccessDenied("Database service cannot validate database's certificate: %v. Please verify if the correct CA bundle is used in the database config.", err)
+
+	case strings.Contains(errString, "tls: unknown certificate authority"):
+		return trace.AccessDenied("Database cannot validate client certificate generated by database service: %v.", err)
+	}
+
+	err = ConvertError(err)
+
+	if trace.IsAccessDenied(err) && sessionCtx.Database.IsRDS() {
+		return createRDSAccessDeniedError(err, sessionCtx)
+	}
+
+	return trace.Wrap(err)
+}
+
+// createRDSAccessDeniedError creates an error with help message to setup IAM
+// auth for RDS.
+func createRDSAccessDeniedError(err error, sessionCtx *Session) error {
+	switch sessionCtx.Database.GetProtocol() {
+	case defaults.ProtocolMySQL:
+		return trace.AccessDenied(`Could not connect to database:
+
+  %v
+
+Make sure that IAM auth is enabled for MySQL user %q and Teleport database
+agent's IAM policy has "rds-connect" permissions (note that IAM changes may
+take a few minutes to propagate):
+
+%v
+`, err, sessionCtx.DatabaseUser, sessionCtx.Database.GetIAMPolicy())
+
+	case defaults.ProtocolPostgres:
+		return trace.AccessDenied(`Could not connect to database:
+
+  %v
+
+Make sure that Postgres user %q has "rds_iam" role and Teleport database
+agent's IAM policy has "rds-connect" permissions (note that IAM changes may
+take a few minutes to propagate):
+
+%v
+`, err, sessionCtx.DatabaseUser, sessionCtx.Database.GetIAMPolicy())
+
+	default:
+		return trace.Wrap(err)
+	}
+}
diff --git a/lib/srv/db/common/test.go b/lib/srv/db/common/test.go
index 5a992e7749d3e..26568f9cb83d9 100644
--- a/lib/srv/db/common/test.go
+++ b/lib/srv/db/common/test.go
@@ -145,7 +145,7 @@ func MakeTestClientTLSConfig(config TestClientConfig) (*tls.Config, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ca, err := config.AuthClient.GetCertAuthority(types.CertAuthID{
+	ca, err := config.AuthClient.GetCertAuthority(context.Background(), types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: config.Cluster,
 	}, false)
diff --git a/lib/srv/db/ha_test.go b/lib/srv/db/ha_test.go
index a6ba7cdbda11a..4ee485e2b5960 100644
--- a/lib/srv/db/ha_test.go
+++ b/lib/srv/db/ha_test.go
@@ -76,7 +76,7 @@ func TestHA(t *testing.T) {
 		HostID:    onlineHostID,
 	})
 	go func() {
-		for conn := range testCtx.proxyConn {
+		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
 			go onlineServer.HandleConnection(conn)
 		}
 	}()
diff --git a/lib/srv/db/mongodb/connect.go b/lib/srv/db/mongodb/connect.go
index 05dfc3d0609d4..b4e6f6eb8802d 100644
--- a/lib/srv/db/mongodb/connect.go
+++ b/lib/srv/db/mongodb/connect.go
@@ -41,10 +41,10 @@ import (
 // When connecting to a replica set, returns connection to the server selected
 // based on the read preference connection string option. This allows users to
 // configure database access to always connect to a secondary for example.
-func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (driver.Connection, error) {
+func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (driver.Connection, func(), error) {
 	options, selector, err := e.getTopologyOptions(ctx, sessionCtx)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, nil, trace.Wrap(err)
 	}
 	// Using driver's "topology" package allows to retain low-level control
 	// over server connections (reading/writing wire messages) but at the
@@ -52,22 +52,31 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (drive
 	// in a replica set.
 	top, err := topology.New(options...)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, nil, trace.Wrap(err)
 	}
 	err = top.Connect()
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, nil, trace.Wrap(err)
 	}
 	server, err := top.SelectServer(ctx, selector)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, nil, trace.Wrap(err)
 	}
 	e.Log.Debugf("Cluster topology: %v, selected server %v.", top, server)
 	conn, err := server.Connection(ctx)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return nil, nil, trace.Wrap(err)
+	}
+
+	closeFn := func() {
+		if err := top.Disconnect(ctx); err != nil {
+			e.Log.WithError(err).Warn("Failed to close topology")
+		}
+		if err := conn.Close(); err != nil {
+			e.Log.WithError(err).Error("Failed to close server connection.")
+		}
 	}
-	return conn, nil
+	return conn, closeFn, nil
 }
 
 // getTopologyOptions constructs topology options for connecting to a MongoDB server.
diff --git a/lib/srv/db/mongodb/engine.go b/lib/srv/db/mongodb/engine.go
index 5886cc5fb22c2..cfeeebde7cf59 100644
--- a/lib/srv/db/mongodb/engine.go
+++ b/lib/srv/db/mongodb/engine.go
@@ -80,16 +80,11 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 		return trace.Wrap(err, "error authorizing database access")
 	}
 	// Establish connection to the MongoDB server.
-	serverConn, err := e.connect(ctx, sessionCtx)
+	serverConn, closeFn, err := e.connect(ctx, sessionCtx)
 	if err != nil {
 		return trace.Wrap(err, "error connecting to the database")
 	}
-	defer func() {
-		err := serverConn.Close()
-		if err != nil {
-			e.Log.WithError(err).Error("Failed to close server connection.")
-		}
-	}()
+	defer closeFn()
 	e.Audit.OnSessionStart(e.Context, sessionCtx, nil)
 	defer e.Audit.OnSessionEnd(e.Context, sessionCtx)
 	// Start reading client messages and sending them to server.
diff --git a/lib/srv/db/mongodb/test.go b/lib/srv/db/mongodb/test.go
index 1d800d736a518..dc99e26083447 100644
--- a/lib/srv/db/mongodb/test.go
+++ b/lib/srv/db/mongodb/test.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"crypto/tls"
 	"net"
+	"sync/atomic"
 	"time"
 
 	"github.com/gravitational/teleport/lib/defaults"
@@ -72,7 +73,8 @@ type TestServer struct {
 	port     string
 	log      logrus.FieldLogger
 
-	wireVersion int
+	wireVersion      int
+	activeConnection int32
 }
 
 // TestServerOption allows to set test server options.
@@ -137,6 +139,8 @@ func (s *TestServer) Serve() error {
 		go func() {
 			defer s.log.Debug("Connection done.")
 			defer conn.Close()
+			atomic.AddInt32(&s.activeConnection, 1)
+			defer atomic.AddInt32(&s.activeConnection, -1)
 			if err := s.handleConnection(conn); err != nil {
 				if !utils.IsOKNetworkError(err) {
 					s.log.Errorf("Failed to handle connection: %v.",
@@ -257,6 +261,11 @@ func (s *TestServer) Port() string {
 	return s.port
 }
 
+// GetActiveConnectionsCount returns the current value of activeConnection counter.
+func (s *TestServer) GetActiveConnectionsCount() int32 {
+	return atomic.LoadInt32(&s.activeConnection)
+}
+
 // Close closes the server listener.
 func (s *TestServer) Close() error {
 	return s.listener.Close()
diff --git a/lib/srv/db/mysql/engine.go b/lib/srv/db/mysql/engine.go
index 6b987b171b018..de84f4bbfdf85 100644
--- a/lib/srv/db/mysql/engine.go
+++ b/lib/srv/db/mysql/engine.go
@@ -242,19 +242,7 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (*clie
 		dialer,
 		connectOpt)
 	if err != nil {
-		if trace.IsAccessDenied(common.ConvertError(err)) && sessionCtx.Database.IsRDS() {
-			return nil, trace.AccessDenied(`Could not connect to database:
-
-  %v
-
-Make sure that IAM auth is enabled for MySQL user %q and Teleport database
-agent's IAM policy has "rds-connect" permissions (note that IAM changes may
-take a few minutes to propagate):
-
-%v
-`, common.ConvertError(err), sessionCtx.DatabaseUser, sessionCtx.Database.GetIAMPolicy())
-		}
-		return nil, trace.Wrap(err)
+		return nil, common.ConvertConnectError(err, sessionCtx)
 	}
 	return conn, nil
 }
diff --git a/lib/srv/db/mysql/test.go b/lib/srv/db/mysql/test.go
index 18b4ae22db6c7..520bdc8dc31de 100644
--- a/lib/srv/db/mysql/test.go
+++ b/lib/srv/db/mysql/test.go
@@ -19,6 +19,7 @@ package mysql
 import (
 	"crypto/tls"
 	"net"
+	"sync"
 	"sync/atomic"
 
 	"github.com/gravitational/teleport/lib/defaults"
@@ -62,6 +63,11 @@ type TestServer struct {
 	tlsConfig *tls.Config
 	log       logrus.FieldLogger
 	handler   *testHandler
+
+	// serverConnsMtx is a mutex that guards serverConns.
+	serverConnsMtx sync.Mutex
+	// serverConns holds all connections created by the server.
+	serverConns []*server.Conn
 }
 
 // NewTestServer returns a new instance of a test MySQL server.
@@ -152,6 +158,11 @@ func (s *TestServer) handleConnection(conn net.Conn) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
+
+	s.serverConnsMtx.Lock()
+	s.serverConns = append(s.serverConns, serverConn)
+	s.serverConnsMtx.Unlock()
+
 	for {
 		if serverConn.Closed() {
 			return nil
@@ -196,6 +207,20 @@ func (s *TestServer) Close() error {
 	return s.listener.Close()
 }
 
+// ConnsClosed returns true if all connections has been correctly closed (message COM_QUIT), false otherwise.
+func (s *TestServer) ConnsClosed() bool {
+	s.serverConnsMtx.Lock()
+	defer s.serverConnsMtx.Unlock()
+
+	for _, conn := range s.serverConns {
+		if !conn.Closed() {
+			return false
+		}
+	}
+
+	return true
+}
+
 type testHandler struct {
 	server.EmptyHandler
 	log logrus.FieldLogger
diff --git a/lib/srv/db/postgres/engine.go b/lib/srv/db/postgres/engine.go
index efd2614724d60..44d63f644ea0c 100644
--- a/lib/srv/db/postgres/engine.go
+++ b/lib/srv/db/postgres/engine.go
@@ -227,19 +227,7 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (*pgpr
 	// messages b/w server and client e.g. to get client's password.
 	conn, err := pgconn.ConnectConfig(ctx, connectConfig)
 	if err != nil {
-		if trace.IsAccessDenied(common.ConvertError(err)) && sessionCtx.Database.IsRDS() {
-			return nil, nil, trace.AccessDenied(`Could not connect to database:
-
-  %v
-
-Make sure that Postgres user %q has "rds_iam" role and Teleport database
-agent's IAM policy has "rds-connect" permissions (note that IAM changes may
-take a few minutes to propagate):
-
-%v
-`, common.ConvertError(err), sessionCtx.DatabaseUser, sessionCtx.Database.GetIAMPolicy())
-		}
-		return nil, nil, trace.Wrap(err)
+		return nil, nil, common.ConvertConnectError(err, sessionCtx)
 	}
 	// Hijacked connection exposes some internal connection data, such as
 	// parameters we'll need to relay back to the client (e.g. database
diff --git a/lib/srv/db/proxy_test.go b/lib/srv/db/proxy_test.go
index c8baf6d720c60..277fe77009850 100644
--- a/lib/srv/db/proxy_test.go
+++ b/lib/srv/db/proxy_test.go
@@ -197,7 +197,9 @@ func TestProxyClientDisconnectDueToLockInForce(t *testing.T) {
 		Target: types.LockTarget{User: "alice"},
 	})
 	require.NoError(t, err)
-	testCtx.authServer.UpsertLock(ctx, lock)
+
+	err = testCtx.authServer.UpsertLock(ctx, lock)
+	require.NoError(t, err)
 
 	waitForEvent(t, testCtx, events.ClientDisconnectCode)
 	err = mysql.Ping()
diff --git a/lib/srv/db/proxyserver.go b/lib/srv/db/proxyserver.go
index e4c0ae7a366e8..3c277360bff00 100644
--- a/lib/srv/db/proxyserver.go
+++ b/lib/srv/db/proxyserver.go
@@ -24,6 +24,9 @@ import (
 	"io"
 	"math/rand"
 	"net"
+	"sort"
+	"strings"
+	"sync"
 	"time"
 
 	"github.com/gravitational/teleport"
@@ -85,12 +88,51 @@ type ProxyServerConfig struct {
 	Clock clockwork.Clock
 	// ServerID is the ID of the audit log server.
 	ServerID string
-	// Shuffle allows to override shuffle logic in tests.
-	Shuffle func([]types.DatabaseServer) []types.DatabaseServer
 	// LockWatcher is a lock watcher.
 	LockWatcher *services.LockWatcher
 }
 
+// ShuffleFunc defines a function that shuffles a list of database servers.
+type ShuffleFunc func([]types.DatabaseServer) []types.DatabaseServer
+
+// ShuffleRandom is a ShuffleFunc that randomizes the order of database servers.
+// Used to provide load balancing behavior when proxying to multiple agents.
+func ShuffleRandom(servers []types.DatabaseServer) []types.DatabaseServer {
+	rand.New(rand.NewSource(time.Now().UnixNano())).Shuffle(
+		len(servers), func(i, j int) {
+			servers[i], servers[j] = servers[j], servers[i]
+		})
+	return servers
+}
+
+// ShuffleSort is a ShuffleFunc that sorts database servers by name and host ID.
+// Used to provide predictable behavior in tests.
+func ShuffleSort(servers []types.DatabaseServer) []types.DatabaseServer {
+	sort.Sort(types.DatabaseServers(servers))
+	return servers
+}
+
+var (
+	// mu protects the shuffleFunc global access.
+	mu sync.RWMutex
+	// shuffleFunc provides shuffle behavior for multiple database agents.
+	shuffleFunc ShuffleFunc = ShuffleRandom
+)
+
+// SetShuffleFunc sets the shuffle behavior when proxying to multiple agents.
+func SetShuffleFunc(fn ShuffleFunc) {
+	mu.Lock()
+	defer mu.Unlock()
+	shuffleFunc = fn
+}
+
+// getShuffleFunc returns the configured function used to shuffle agents.
+func getShuffleFunc() ShuffleFunc {
+	mu.RLock()
+	defer mu.RUnlock()
+	return shuffleFunc
+}
+
 // CheckAndSetDefaults validates the config and sets default values.
 func (c *ProxyServerConfig) CheckAndSetDefaults() error {
 	if c.AccessPoint == nil {
@@ -114,15 +156,6 @@ func (c *ProxyServerConfig) CheckAndSetDefaults() error {
 	if c.ServerID == "" {
 		return trace.BadParameter("missing ServerID")
 	}
-	if c.Shuffle == nil {
-		c.Shuffle = func(servers []types.DatabaseServer) []types.DatabaseServer {
-			rand.New(rand.NewSource(c.Clock.Now().UnixNano())).Shuffle(
-				len(servers), func(i, j int) {
-					servers[i], servers[j] = servers[j], servers[i]
-				})
-			return servers
-		}
-	}
 	if c.LockWatcher == nil {
 		return trace.BadParameter("missing LockWatcher")
 	}
@@ -177,7 +210,7 @@ func (s *ProxyServer) ServePostgres(listener net.Listener) error {
 		go func() {
 			defer clientConn.Close()
 			err := s.PostgresProxy().HandleConnection(s.closeCtx, clientConn)
-			if err != nil {
+			if err != nil && !utils.IsOKNetworkError(err) {
 				s.log.WithError(err).Warn("Failed to handle Postgres client connection.")
 			}
 		}()
@@ -231,7 +264,9 @@ func (s *ProxyServer) serveGenericTLS(listener net.Listener, tlsConfig *tls.Conf
 			defer clientConn.Close()
 			tlsConn := tls.Server(clientConn, tlsConfig)
 			if err := tlsConn.Handshake(); err != nil {
-				s.log.WithError(err).Errorf("%s TLS handshake failed.", dbName)
+				if !utils.IsOKNetworkError(err) {
+					s.log.WithError(err).Errorf("%s TLS handshake failed.", dbName)
+				}
 				return
 			}
 			err := s.handleConnection(tlsConn)
@@ -351,7 +386,7 @@ func (s *ProxyServer) Connect(ctx context.Context, proxyCtx *common.ProxyContext
 	// There may be multiple database servers proxying the same database. If
 	// we get a connection problem error trying to dial one of them, likely
 	// the database server is down so try the next one.
-	for _, server := range s.cfg.Shuffle(proxyCtx.Servers) {
+	for _, server := range getShuffleFunc()(proxyCtx.Servers) {
 		s.log.Debugf("Dialing to %v.", server)
 		tlsConfig, err := s.getConfigForServer(ctx, proxyCtx.Identity, server)
 		if err != nil {
@@ -364,9 +399,9 @@ func (s *ProxyServer) Connect(ctx context.Context, proxyCtx *common.ProxyContext
 			ConnType: types.DatabaseTunnel,
 		})
 		if err != nil {
-			// Connection problem indicates reverse tunnel to this server is down.
-			if trace.IsConnectionProblem(err) {
-				s.log.WithError(err).Warnf("Failed to dial %v.", server)
+			// If an agent is down, we'll retry on the next one (if available).
+			if isReverseTunnelDownError(err) {
+				s.log.WithError(err).Warnf("Failed to dial database %v.", server)
 				continue
 			}
 			return nil, trace.Wrap(err)
@@ -380,6 +415,13 @@ func (s *ProxyServer) Connect(ctx context.Context, proxyCtx *common.ProxyContext
 	return nil, trace.BadParameter("failed to connect to any of the database servers")
 }
 
+// isReverseTunnelDownError returns true if the provided error indicates that
+// the reverse tunnel connection is down e.g. because the agent is down.
+func isReverseTunnelDownError(err error) bool {
+	return trace.IsConnectionProblem(err) ||
+		strings.Contains(err.Error(), reversetunnel.NoDatabaseTunnel)
+}
+
 // Proxy starts proxying all traffic received from database client between
 // this proxy and Teleport database service over reverse tunnel.
 //
diff --git a/lib/srv/db/proxyserver_test.go b/lib/srv/db/proxyserver_test.go
index 33fe5a69bce4e..df6500b49641a 100644
--- a/lib/srv/db/proxyserver_test.go
+++ b/lib/srv/db/proxyserver_test.go
@@ -91,10 +91,10 @@ func TestProxyConnectionLimiting(t *testing.T) {
 			t.Run("limit can be hit", func(t *testing.T) {
 				for i := 0; i < connLimitNumber; i++ {
 					// Try to connect to the database.
-					pgConn, err := tt.connect()
+					dbConn, err := tt.connect()
 					require.NoError(t, err)
 
-					connsClosers = append(connsClosers, pgConn)
+					connsClosers = append(connsClosers, dbConn)
 				}
 
 				// This connection should go over the limit.
@@ -114,9 +114,9 @@ func TestProxyConnectionLimiting(t *testing.T) {
 				require.NoError(t, err)
 
 				// Create a new connection. We do not expect an error here as we have just closed one.
-				pgConn, err := tt.connect()
+				dbConn, err := tt.connect()
 				require.NoError(t, err)
-				connsClosers = append(connsClosers, pgConn)
+				connsClosers = append(connsClosers, dbConn)
 
 				// Here the limit should be reached again.
 				_, err = tt.connect()
diff --git a/lib/srv/db/redis/client.go b/lib/srv/db/redis/client.go
new file mode 100644
index 0000000000000..de0bf1f7fdbdc
--- /dev/null
+++ b/lib/srv/db/redis/client.go
@@ -0,0 +1,293 @@
+/*
+
+ Copyright 2022 Gravitational, Inc.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+
+*/
+
+package redis
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"strings"
+	"sync"
+
+	"github.com/go-redis/redis/v8"
+	"github.com/gravitational/teleport/lib/srv/db/redis/protocol"
+	"github.com/gravitational/trace"
+)
+
+// Commands with additional processing in Teleport when using cluster mode.
+const (
+	dbsizeCmd   = "dbsize"
+	keysCmd     = "keys"
+	mgetCmd     = "mget"
+	flushallCmd = "flushall"
+	flushdbCmd  = "flushdb"
+	scriptCmd   = "script"
+)
+
+// Overridden subcommands for Redis SCRIPT command.
+const (
+	scriptLoadSubcmd   = "load"
+	scriptExistsSubcmd = "exists"
+	scriptFLushSubcmd  = "flush"
+)
+
+// List of unsupported commands in cluster mode.
+const (
+	aclCmd        = "acl"
+	askingCmd     = "asking"
+	clientCmd     = "client"
+	clusterCmd    = "cluster"
+	configCmd     = "config"
+	debugCmd      = "debug"
+	execCmd       = "exec"
+	infoCmd       = "info"
+	latencyCmd    = "latency"
+	memoryCmd     = "memory"
+	migrateCmd    = "migrate"
+	moduleCmd     = "module"
+	monitorCmd    = "monitor"
+	multiCmd      = "multi"
+	pfdebugCmd    = "pfdebug"
+	pfselftestCmd = "pfselftest"
+	psyncCmd      = "psync"
+	readonlyCmd   = "readonly"
+	readwriteCmd  = "readwrite"
+	replconfCmd   = "replconf"
+	replicaofCmd  = "replicaof"
+	roleCmd       = "role"
+	scanCmd       = "scan"
+	shutdownCmd   = "shutdown"
+	slaveofCmd    = "slaveof"
+	slowlogCmd    = "slowlog"
+	syncCmd       = "sync"
+	timeCmd       = "time"
+	waitCmd       = "wait"
+	watchCmd      = "watch"
+)
+
+// clusterClient is a wrapper around redis.ClusterClient
+type clusterClient struct {
+	redis.ClusterClient
+}
+
+// newClient creates a new Redis client based on given ConnectionMode. If connection mode is not supported
+// an error is returned.
+func newClient(ctx context.Context, connectionOptions *ConnectionOptions, tlsConfig *tls.Config, username, password string) (redis.UniversalClient, error) {
+	connectionAddr := net.JoinHostPort(connectionOptions.address, connectionOptions.port)
+	// TODO(jakub): Use system CA bundle if connecting to AWS.
+	// TODO(jakub): Investigate Redis Sentinel.
+	switch connectionOptions.mode {
+	case Standalone:
+		return redis.NewClient(&redis.Options{
+			Addr:      connectionAddr,
+			TLSConfig: tlsConfig,
+			Username:  username,
+			Password:  password,
+		}), nil
+	case Cluster:
+		client := &clusterClient{
+			ClusterClient: *redis.NewClusterClient(&redis.ClusterOptions{
+				Addrs:     []string{connectionAddr},
+				TLSConfig: tlsConfig,
+				Username:  username,
+				Password:  password,
+			}),
+		}
+		// Load cluster information.
+		client.ReloadState(ctx)
+
+		return client, nil
+	default:
+		// We've checked that while validating the config, but checking again can help with regression.
+		return nil, trace.BadParameter("incorrect connection mode %s", connectionOptions.mode)
+	}
+}
+
+// Process add supports for additional cluster commands. Our Redis implementation passes most commands to
+// go-redis `Process()` function which doesn't handel all Cluster commands like for ex. DBSIZE, FLUSHDB, etc.
+// This function provides additional processing for those commands enabling more Redis commands in Cluster mode.
+// Commands are override by a simple rule:
+// * If command work only on a single slot (one shard) without any modifications and returns a CROSSSLOT error if executed on
+//   multiple keys it's send the Redis client as it is, and it's the client responsibility to make sure keys are in a single slot.
+// * If a command returns incorrect result in the Cluster mode (for ex. DBSIZE as it would return only size of one shard not whole cluster)
+//   then it's handled by Teleport or blocked if reasonable processing is not possible.
+// * Otherwise a commands is sent to Redis without any modifications.
+func (c *clusterClient) Process(ctx context.Context, inCmd redis.Cmder) error {
+	cmd, ok := inCmd.(*redis.Cmd)
+	if !ok {
+		return trace.BadParameter("failed to cast Redis command type: %T", cmd)
+	}
+
+	switch cmdName := strings.ToLower(cmd.Name()); cmdName {
+	case multiCmd, execCmd, watchCmd, scanCmd, aclCmd, askingCmd, clientCmd, clusterCmd, configCmd, debugCmd,
+		infoCmd, latencyCmd, memoryCmd, migrateCmd, moduleCmd, monitorCmd, pfdebugCmd, pfselftestCmd,
+		psyncCmd, readonlyCmd, readwriteCmd, replconfCmd, replicaofCmd, roleCmd, shutdownCmd, slaveofCmd,
+		slowlogCmd, syncCmd, timeCmd, waitCmd:
+		// block commands that return incorrect results in Cluster mode
+		return protocol.ErrCmdNotSupported
+	case dbsizeCmd:
+		// use go-redis dbsize implementation. It returns size of all keys in the whole cluster instead of
+		// just currently connected instance.
+		res := c.DBSize(ctx)
+		cmd.SetVal(res.Val())
+		cmd.SetErr(res.Err())
+
+		return nil
+	case keysCmd:
+		var resultsKeys []string
+		var mtx sync.Mutex
+
+		if err := c.ForEachMaster(ctx, func(ctx context.Context, client *redis.Client) error {
+			scanCmd := redis.NewStringSliceCmd(ctx, cmd.Args()...)
+			err := client.Process(ctx, scanCmd)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			keys, err := scanCmd.Result()
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			mtx.Lock()
+			resultsKeys = append(resultsKeys, keys...)
+			mtx.Unlock()
+
+			return nil
+		}); err != nil {
+			return trace.Wrap(err)
+		}
+
+		cmd.SetVal(resultsKeys)
+
+		return nil
+	case mgetCmd:
+		if len(cmd.Args()) == 1 {
+			return trace.BadParameter("wrong number of arguments for 'mget' command")
+		}
+
+		var resultsKeys []interface{}
+
+		keys := cmd.Args()[1:]
+		for _, key := range keys {
+			k, ok := key.(string)
+			if !ok {
+				return trace.BadParameter("wrong key type, expected string, got %T", key)
+			}
+
+			result := c.Get(ctx, k)
+			if result.Err() == redis.Nil {
+				resultsKeys = append(resultsKeys, redis.Nil)
+				continue
+			}
+
+			if result.Err() != nil {
+				cmd.SetErr(result.Err())
+				return trace.Wrap(result.Err())
+			}
+
+			resultsKeys = append(resultsKeys, result.Val())
+		}
+
+		cmd.SetVal(resultsKeys)
+
+		return nil
+	case flushallCmd, flushdbCmd:
+		var mtx sync.Mutex
+
+		if err := c.ForEachMaster(ctx, func(ctx context.Context, client *redis.Client) error {
+			singleCmd := redis.NewCmd(ctx, cmd.Args()...)
+			err := client.Process(ctx, singleCmd)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			mtx.Lock()
+			defer mtx.Unlock()
+
+			if cmd.Err() != nil {
+				// If other call have already set error do not erase it.
+				// It should be returned to the caller.
+				return nil
+			}
+
+			cmd.SetVal(singleCmd.Val())
+			cmd.SetErr(singleCmd.Err())
+
+			return nil
+		}); err != nil {
+			return trace.Wrap(err)
+		}
+
+		return nil
+	case scriptCmd:
+		return c.handleScriptCmd(ctx, cmd)
+	default:
+		return c.ClusterClient.Process(ctx, cmd)
+	}
+}
+
+// handleScriptCmd processes Redis SCRIPT command in Cluster mode.
+func (c *clusterClient) handleScriptCmd(ctx context.Context, cmd *redis.Cmd) error {
+	cmdArgs := cmd.Args()
+
+	if len(cmdArgs) < 2 {
+		return trace.BadParameter("wrong number of arguments for 'script' command")
+	}
+
+	args := make([]string, len(cmdArgs))
+
+	for i := range cmdArgs {
+		var ok bool
+		args[i], ok = cmdArgs[i].(string)
+		if !ok {
+			return trace.BadParameter("wrong script subcommand type, expected string, got %T", cmdArgs[i])
+		}
+	}
+
+	switch cmdSubName := strings.ToLower(args[1]); cmdSubName {
+	case scriptExistsSubcmd:
+		res := c.ScriptExists(ctx, args[2:]...)
+
+		cmd.SetVal(res.Val())
+		cmd.SetErr(res.Err())
+
+		return nil
+	case scriptLoadSubcmd:
+		res := c.ScriptLoad(ctx, args[2])
+
+		cmd.SetVal(res.Val())
+		cmd.SetErr(res.Err())
+
+		return nil
+
+	case scriptFLushSubcmd:
+		// TODO(jakule): ASYNC is ignored.
+		res := c.ScriptFlush(ctx)
+
+		cmd.SetVal(res.Val())
+		cmd.SetErr(res.Err())
+
+		return nil
+	default:
+		// SCRIPT KILL and SCRIPT DEBUG
+		return protocol.ErrCmdNotSupported
+	}
+}
diff --git a/lib/srv/db/redis/cmds.go b/lib/srv/db/redis/cmds.go
index 7d33879e3cb33..cec1a3442527a 100644
--- a/lib/srv/db/redis/cmds.go
+++ b/lib/srv/db/redis/cmds.go
@@ -29,16 +29,19 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
+	"github.com/gravitational/teleport/lib/srv/db/redis/protocol"
 	"github.com/gravitational/trace"
 )
 
-// List of all commands that Teleport handles in a special way.
+// List of commands that Teleport handles in a special way by Redis standalone and cluster.
 const (
-	helloCmd        = "hello"
-	authCmd         = "auth"
-	subscribeCmd    = "subscribe"
-	psubscribeCmd   = "psubscribe"
+	helloCmd      = "hello"
+	authCmd       = "auth"
+	subscribeCmd  = "subscribe"
+	psubscribeCmd = "psubscribe"
+	// TODO(jakub): go-redis doesn't expose any API for this command. Investigate alternative options.
 	punsubscribeCmd = "punsubscribe"
+	// go-redis doesn't support Redis 7+ commands yet.
 	ssubscribeCmd   = "ssubscribe"
 	sunsubscribeCmd = "sunsubscribe"
 )
@@ -48,29 +51,23 @@ const (
 //  * Redis 7.0+ commands are rejected as at the moment of writing Redis 7.0 hasn't been released and go-redis doesn't support it.
 //  * RESP3 commands are rejected as Teleport/go-redis currently doesn't support this version of protocol.
 //  * Subscribe related commands created a new DB connection as they change Redis request-response model to Pub/Sub.
-func (e *Engine) processCmd(ctx context.Context, redisClient redis.UniversalClient, cmd *redis.Cmd) error {
+func (e *Engine) processCmd(ctx context.Context, cmd *redis.Cmd) error {
 	switch strings.ToLower(cmd.Name()) {
-	case helloCmd:
-		return trace.NotImplemented("RESP3 is not supported")
+	case helloCmd, punsubscribeCmd, ssubscribeCmd, sunsubscribeCmd:
+		return protocol.ErrCmdNotSupported
 	case authCmd:
-		return e.processAuth(ctx, redisClient, cmd)
+		return e.processAuth(ctx, cmd)
 	case subscribeCmd:
 		e.Audit.OnQuery(e.Context, e.sessionCtx, common.Query{Query: cmd.String()})
-		return e.subscribeCmd(ctx, redisClient.Subscribe, cmd)
+		return e.subscribeCmd(ctx, e.redisClient.Subscribe, cmd)
 	case psubscribeCmd:
 		e.Audit.OnQuery(e.Context, e.sessionCtx, common.Query{Query: cmd.String()})
-		return e.subscribeCmd(ctx, redisClient.PSubscribe, cmd)
-	case punsubscribeCmd:
-		// TODO(jakub): go-redis doesn't expose any API for this command. Investigate alternative options.
-		return trace.NotImplemented("PUNSUBSCRIBE is not supported by Teleport")
-	case ssubscribeCmd, sunsubscribeCmd:
-		// go-redis doesn't support Redis 7+ commands yet.
-		return trace.NotImplemented("Redis 7.0+ is not yet supported")
+		return e.subscribeCmd(ctx, e.redisClient.PSubscribe, cmd)
 	default:
 		e.Audit.OnQuery(e.Context, e.sessionCtx, common.Query{Query: cmd.String()})
 
 		// Here the command is sent to the DB.
-		return redisClient.Process(ctx, cmd)
+		return e.redisClient.Process(ctx, cmd)
 	}
 }
 
@@ -148,7 +145,7 @@ func (e *Engine) processPubSub(ctx context.Context, pubSub *redis.PubSub) error
 
 // processAuth runs RBAC check on Redis AUTH command if command contains username. Command containing only password
 // is passed to Redis. Commands with incorrect number of arguments are rejected and an error is returned.
-func (e *Engine) processAuth(ctx context.Context, redisClient redis.UniversalClient, cmd *redis.Cmd) error {
+func (e *Engine) processAuth(ctx context.Context, cmd *redis.Cmd) error {
 	// AUTH command may contain only password or login and password. Depends on the version we need to make sure
 	// that the user has permission to connect as the provided db user.
 	// ref: https://redis.io/commands/auth
@@ -180,13 +177,13 @@ func (e *Engine) processAuth(ctx context.Context, redisClient redis.UniversalCli
 			return trace.Wrap(err)
 		}
 
-		return redisClient.Process(ctx, cmd)
+		return e.redisClient.Process(ctx, cmd)
 	case 3:
 		// Redis 6 version that contains username and password. Check the username against our RBAC before sending to Redis.
 		// ex. AUTH bob my-secret-password
 		dbUser, ok := cmd.Args()[1].(string)
 		if !ok {
-			return trace.BadParameter("username has a wrong type, expected string")
+			return trace.BadParameter("username has a wrong type, expected string got %T", cmd.Args()[1])
 		}
 
 		e.Audit.OnQuery(e.Context, e.sessionCtx, common.Query{Query: fmt.Sprintf("AUTH %s ****", dbUser)})
@@ -207,7 +204,19 @@ func (e *Engine) processAuth(ctx context.Context, redisClient redis.UniversalCli
 			return trace.Wrap(err)
 		}
 
-		return redisClient.Process(ctx, cmd)
+		password, ok := cmd.Args()[2].(string)
+		if !ok {
+			return trace.BadParameter("password has a wrong type, expected string got %T", cmd.Args()[2])
+		}
+
+		// reconnect with new username and password. go-redis manages those internally and sends AUTH commands
+		// at the beginning of every new connection.
+		e.redisClient, err = e.reconnect(dbUser, password)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		return e.redisClient.Process(ctx, cmd)
 	default:
 		// Redis returns "syntax error" if AUTH has more than 2 arguments.
 		return trace.BadParameter("syntax error")
diff --git a/lib/srv/db/redis/engine.go b/lib/srv/db/redis/engine.go
index 1fb4b7cb3641d..37a8fc5383d6a 100644
--- a/lib/srv/db/redis/engine.go
+++ b/lib/srv/db/redis/engine.go
@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"context"
 	"errors"
-	"fmt"
 	"net"
 
 	"github.com/go-redis/redis/v8"
@@ -44,6 +43,10 @@ func newEngine(ec common.EngineConfig) common.Engine {
 	}
 }
 
+// redisClientFactoryFn is a prototype that takes Redis username and password and return a new
+// Redis client.
+type redisClientFactoryFn func(username, password string) (redis.UniversalClient, error)
+
 // Engine implements common.Engine.
 type Engine struct {
 	// EngineConfig is the common database engine configuration.
@@ -54,6 +57,10 @@ type Engine struct {
 	clientReader *redis.Reader
 	// sessionCtx is current session context.
 	sessionCtx *common.Session
+	// newClient returns a new client connection
+	newClient redisClientFactoryFn
+	// redisClient is a current connection to Redis server.
+	redisClient redis.UniversalClient
 }
 
 // InitializeConnection initializes the database connection.
@@ -139,41 +146,20 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 		return trace.Wrap(err)
 	}
 
-	tlsConfig, err := e.Auth.GetTLSConfig(ctx, sessionCtx)
+	// Initialize newClient factory function with current connection state.
+	e.newClient, err = e.getNewClientFn(ctx, sessionCtx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	connectionOptions, err := ParseRedisAddress(sessionCtx.Database.GetURI())
+	// Create new client without username or password. Those will be added when we receive AUTH command.
+	e.redisClient, err = e.newClient("", "")
 	if err != nil {
-		return trace.BadParameter("Redis connection string is incorrect %q: %v", sessionCtx.Database.GetURI(), err)
-	}
-
-	var (
-		redisConn      redis.UniversalClient
-		connectionAddr = fmt.Sprintf("%s:%s", connectionOptions.address, connectionOptions.port)
-	)
-
-	// TODO(jakub): Use system CA bundle if connecting to AWS.
-	// TODO(jakub): Investigate Redis Sentinel.
-	switch connectionOptions.mode {
-	case Standalone:
-		redisConn = redis.NewClient(&redis.Options{
-			Addr:      connectionAddr,
-			TLSConfig: tlsConfig,
-		})
-	case Cluster:
-		redisConn = redis.NewClusterClient(&redis.ClusterOptions{
-			Addrs:     []string{connectionAddr},
-			TLSConfig: tlsConfig,
-		})
-	default:
-		// We've checked that while validating the config, but checking again can help with regression.
-		return trace.BadParameter("incorrect connection mode %s", connectionOptions.mode)
+		return trace.Wrap(err)
 	}
 
 	defer func() {
-		if err := redisConn.Close(); err != nil {
+		if err := e.redisClient.Close(); err != nil {
 			e.Log.Errorf("Failed to close Redis connection: %v.", err)
 		}
 	}()
@@ -181,16 +167,54 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 	e.Audit.OnSessionStart(e.Context, sessionCtx, nil)
 	defer e.Audit.OnSessionEnd(e.Context, sessionCtx)
 
-	if err := e.process(ctx, redisConn); err != nil {
+	if err := e.process(ctx); err != nil {
 		return trace.Wrap(err)
 	}
 
 	return nil
 }
 
+// getNewClientFn returns a partial Redis client factory function.
+func (e *Engine) getNewClientFn(ctx context.Context, sessionCtx *common.Session) (redisClientFactoryFn, error) {
+	tlsConfig, err := e.Auth.GetTLSConfig(ctx, sessionCtx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	connectionOptions, err := ParseRedisAddress(sessionCtx.Database.GetURI())
+	if err != nil {
+		return nil, trace.BadParameter("Redis connection string is incorrect %q: %v", sessionCtx.Database.GetURI(), err)
+	}
+
+	return func(username, password string) (redis.UniversalClient, error) {
+		redisClient, err := newClient(ctx, connectionOptions, tlsConfig, username, password)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		return redisClient, nil
+	}, nil
+}
+
+// reconnect closes the current Redis server connection and creates a new one pre-authenticated
+// with provided username and password.
+func (e *Engine) reconnect(username, password string) (redis.UniversalClient, error) {
+	err := e.redisClient.Close()
+	if err != nil {
+		return nil, trace.Wrap(err, "failed to close Redis connection")
+	}
+
+	e.redisClient, err = e.newClient(username, password)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return e.redisClient, nil
+}
+
 // process is the main processing function for Redis. It reads commands from connected client and passes them to
 // a Redis instance. This function returns when a server closes a connection or in case of connection error.
-func (e *Engine) process(ctx context.Context, redisClient redis.UniversalClient) error {
+func (e *Engine) process(ctx context.Context) error {
 	for {
 		// Read commands from connected client.
 		cmd, err := e.readClientCmd(ctx)
@@ -199,7 +223,7 @@ func (e *Engine) process(ctx context.Context, redisClient redis.UniversalClient)
 		}
 
 		// send valid commands to Redis instance/cluster.
-		err = e.processCmd(ctx, redisClient, cmd)
+		err = e.processCmd(ctx, cmd)
 		// go-redis returns some errors as err and some as cmd.Err().
 		// Function below maps errors that should be returned to the
 		// client as value or return them as err if we should terminate
diff --git a/lib/srv/db/redis/protocol/resp2.go b/lib/srv/db/redis/protocol/resp2.go
index 4f48bdfd6c61d..897debde67c75 100644
--- a/lib/srv/db/redis/protocol/resp2.go
+++ b/lib/srv/db/redis/protocol/resp2.go
@@ -20,12 +20,16 @@
 package protocol
 
 import (
+	"reflect"
 	"strconv"
 
 	"github.com/go-redis/redis/v8"
 	"github.com/gravitational/trace"
 )
 
+// ErrCmdNotSupported is returned when an unsupported Redis command is sent to Teleport proxy.
+var ErrCmdNotSupported = trace.NotImplemented("command not supported")
+
 // WriteCmd writes Redis commands passed as vals to Redis wire form.
 // Most types are covered by go-redis implemented WriteArg() function. Types override by this function are:
 // * Redis errors and Go error: go-redis returns a "human-readable" string instead of RESP compatible error message
@@ -95,16 +99,20 @@ func WriteCmd(wr *redis.Writer, vals interface{}) error {
 		if err := writeUinteger(wr, val); err != nil {
 			return trace.Wrap(err)
 		}
-	case []string:
-		if err := writeStringSlice(wr, val); err != nil {
-			return trace.Wrap(err)
+	case interface{}:
+		var err error
+		v := reflect.ValueOf(val)
+
+		if v.Kind() == reflect.Ptr {
+			v = v.Elem()
 		}
-	case []interface{}:
-		if err := writeSlice(wr, val); err != nil {
-			return trace.Wrap(err)
+
+		if v.Kind() == reflect.Slice {
+			err = writeSlice(wr, val)
+		} else {
+			err = wr.WriteArg(val)
 		}
-	case interface{}:
-		err := wr.WriteArg(val)
+
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -132,37 +140,25 @@ func writeError(wr *redis.Writer, prefix string, val error) error {
 	return nil
 }
 
-// writeSlice converts []interface{} to Redis wire form.
-func writeSlice(wr *redis.Writer, vals []interface{}) error {
-	if err := wr.WriteByte(redis.ArrayReply); err != nil {
-		return trace.Wrap(err)
-	}
-	n := len(vals)
-	if err := wr.WriteLen(n); err != nil {
-		return trace.Wrap(err)
-	}
+// writeSlice converts a slice to Redis wire form.
+func writeSlice(wr *redis.Writer, vals interface{}) error {
+	v := reflect.ValueOf(vals)
 
-	for _, v0 := range vals {
-		if err := WriteCmd(wr, v0); err != nil {
-			return trace.Wrap(err)
-		}
+	if v.Kind() != reflect.Slice {
+		return trace.BadParameter("expected slice, passed %T", vals)
 	}
 
-	return nil
-}
-
-// writeStringSlice converts a string slice to Redis wire form.
-func writeStringSlice(wr *redis.Writer, vals []string) error {
 	if err := wr.WriteByte(redis.ArrayReply); err != nil {
 		return trace.Wrap(err)
 	}
-	n := len(vals)
+
+	n := v.Len()
 	if err := wr.WriteLen(n); err != nil {
 		return trace.Wrap(err)
 	}
 
-	for _, v0 := range vals {
-		if err := WriteCmd(wr, v0); err != nil {
+	for i := 0; i < n; i++ {
+		if err := WriteCmd(wr, v.Index(i).Interface()); err != nil {
 			return trace.Wrap(err)
 		}
 	}
diff --git a/lib/srv/db/redis/protocol/resp2_test.go b/lib/srv/db/redis/protocol/resp2_test.go
new file mode 100644
index 0000000000000..fccb0518f9f0e
--- /dev/null
+++ b/lib/srv/db/redis/protocol/resp2_test.go
@@ -0,0 +1,106 @@
+/*
+
+ Copyright 2022 Gravitational, Inc.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+
+*/
+
+package protocol
+
+import (
+	"bytes"
+	"errors"
+	"testing"
+
+	"github.com/go-redis/redis/v8"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWriteCmd(t *testing.T) {
+	tests := []struct {
+		name     string
+		val      interface{}
+		expected []byte
+		wantErr  bool
+	}{
+		{
+			name:     "string",
+			val:      "test val",
+			expected: []byte("$8\r\ntest val\r\n"),
+		},
+		{
+			name:     "int",
+			val:      1,
+			expected: []byte(":1\r\n"),
+		},
+		{
+			name:     "int32",
+			val:      19,
+			expected: []byte(":19\r\n"),
+		},
+		{
+			name:     "int64",
+			val:      64,
+			expected: []byte(":64\r\n"),
+		},
+		{
+			name:     "float",
+			val:      3.14,
+			expected: []byte("$4\r\n3.14\r\n"),
+		},
+		{
+			name:     "[]string",
+			val:      []string{"test val1", "test val 2"},
+			expected: []byte("*2\r\n$9\r\ntest val1\r\n$10\r\ntest val 2\r\n"),
+		},
+		{
+			name:     "[]bool",
+			val:      []bool{true, false},
+			expected: []byte("*2\r\n$1\r\n1\r\n$1\r\n0\r\n"),
+		},
+		{
+			name:     "error",
+			val:      errors.New("something bad"),
+			expected: []byte("-ERR something bad\r\n"),
+		},
+		{
+			name:     "Teleport error",
+			val:      trace.Errorf("something bad"),
+			expected: []byte("-ERR Teleport: something bad\r\n"),
+		},
+		{
+			name:     "Redis nil",
+			val:      redis.Nil,
+			expected: []byte("$-1\r\n"),
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			buf := &bytes.Buffer{}
+			wr := redis.NewWriter(buf)
+
+			if err := WriteCmd(wr, tt.val); (err != nil) != tt.wantErr {
+				t.Errorf("WriteCmd() error = %v, wantErr %v", err, tt.wantErr)
+			}
+
+			require.Equal(t, tt.expected, buf.Bytes())
+		})
+	}
+}
diff --git a/lib/srv/db/server.go b/lib/srv/db/server.go
index 9519aa242111d..bd35f2375547b 100644
--- a/lib/srv/db/server.go
+++ b/lib/srv/db/server.go
@@ -245,10 +245,10 @@ func (m *monitoredDatabases) setCloud(databases types.Databases) {
 	m.cloud = databases
 }
 
-func (m *monitoredDatabases) get() types.ResourcesWithLabels {
+func (m *monitoredDatabases) get() types.ResourcesWithLabelsMap {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	return append(append(m.static, m.resources...), m.cloud...).AsResources()
+	return append(append(m.static, m.resources...), m.cloud...).AsResources().ToMap()
 }
 
 // New returns a new database server.
diff --git a/lib/srv/db/watcher.go b/lib/srv/db/watcher.go
index af261ac028ba5..887e4b889faeb 100644
--- a/lib/srv/db/watcher.go
+++ b/lib/srv/db/watcher.go
@@ -134,11 +134,8 @@ func (s *Server) startCloudWatcher(ctx context.Context) error {
 }
 
 // getResources returns proxied databases as resources.
-func (s *Server) getResources() (resources types.ResourcesWithLabels) {
-	for _, database := range s.getProxiedDatabases() {
-		resources = append(resources, database)
-	}
-	return resources
+func (s *Server) getResources() types.ResourcesWithLabelsMap {
+	return s.getProxiedDatabases().AsResources().ToMap()
 }
 
 // onCreate is called by reconciler when a new database is created.
diff --git a/lib/srv/desktop/audit.go b/lib/srv/desktop/audit.go
index d1710c559ecd1..1989fbf7a3053 100644
--- a/lib/srv/desktop/audit.go
+++ b/lib/srv/desktop/audit.go
@@ -27,7 +27,7 @@ import (
 	"github.com/gravitational/trace"
 )
 
-func (s *WindowsService) onSessionStart(ctx context.Context, id *tlsca.Identity, startTime time.Time, windowsUser, sessionID string, desktop types.WindowsDesktop, err error) {
+func (s *WindowsService) onSessionStart(ctx context.Context, emitter events.Emitter, id *tlsca.Identity, startTime time.Time, windowsUser, sessionID string, desktop types.WindowsDesktop, err error) {
 	userMetadata := id.GetUserMetadata()
 	userMetadata.Login = windowsUser
 
@@ -52,6 +52,7 @@ func (s *WindowsService) onSessionStart(ctx context.Context, id *tlsca.Identity,
 			Success: err == nil,
 		},
 		WindowsDesktopService: s.cfg.Heartbeat.HostUUID,
+		DesktopName:           desktop.GetName(),
 		DesktopAddr:           desktop.GetAddr(),
 		Domain:                desktop.GetDomain(),
 		WindowsUser:           windowsUser,
@@ -62,10 +63,10 @@ func (s *WindowsService) onSessionStart(ctx context.Context, id *tlsca.Identity,
 		event.Error = trace.Unwrap(err).Error()
 		event.UserMessage = err.Error()
 	}
-	s.emit(ctx, event)
+	s.emit(ctx, emitter, event)
 }
 
-func (s *WindowsService) onSessionEnd(ctx context.Context, id *tlsca.Identity, startedAt time.Time, recorded bool, windowsUser, sessionID string, desktop types.WindowsDesktop) {
+func (s *WindowsService) onSessionEnd(ctx context.Context, emitter events.Emitter, id *tlsca.Identity, startedAt time.Time, recorded bool, windowsUser, sessionID string, desktop types.WindowsDesktop) {
 	userMetadata := id.GetUserMetadata()
 	userMetadata.Login = windowsUser
 
@@ -93,10 +94,10 @@ func (s *WindowsService) onSessionEnd(ctx context.Context, id *tlsca.Identity, s
 		// There can only be 1 participant, desktop sessions are not join-able.
 		Participants: []string{userMetadata.User},
 	}
-	s.emit(ctx, event)
+	s.emit(ctx, emitter, event)
 }
 
-func (s *WindowsService) onClipboardSend(ctx context.Context, id *tlsca.Identity, sessionID string, desktopAddr string, length int32) {
+func (s *WindowsService) onClipboardSend(ctx context.Context, emitter events.Emitter, id *tlsca.Identity, sessionID string, desktopAddr string, length int32) {
 	event := &events.DesktopClipboardSend{
 		Metadata: events.Metadata{
 			Type:        libevents.DesktopClipboardSendEvent,
@@ -117,10 +118,10 @@ func (s *WindowsService) onClipboardSend(ctx context.Context, id *tlsca.Identity
 		DesktopAddr: desktopAddr,
 		Length:      length,
 	}
-	s.emit(ctx, event)
+	s.emit(ctx, emitter, event)
 }
 
-func (s *WindowsService) onClipboardReceive(ctx context.Context, id *tlsca.Identity, sessionID string, desktopAddr string, length int32) {
+func (s *WindowsService) onClipboardReceive(ctx context.Context, emitter events.Emitter, id *tlsca.Identity, sessionID string, desktopAddr string, length int32) {
 	event := &events.DesktopClipboardReceive{
 		Metadata: events.Metadata{
 			Type:        libevents.DesktopClipboardReceiveEvent,
@@ -141,11 +142,11 @@ func (s *WindowsService) onClipboardReceive(ctx context.Context, id *tlsca.Ident
 		DesktopAddr: desktopAddr,
 		Length:      length,
 	}
-	s.emit(ctx, event)
+	s.emit(ctx, emitter, event)
 }
 
-func (s *WindowsService) emit(ctx context.Context, event events.AuditEvent) {
-	if err := s.cfg.Emitter.EmitAuditEvent(ctx, event); err != nil {
+func (s *WindowsService) emit(ctx context.Context, emitter events.Emitter, event events.AuditEvent) {
+	if err := emitter.EmitAuditEvent(ctx, event); err != nil {
 		s.cfg.Log.WithError(err).Errorf("Failed to emit audit event %v", event)
 	}
 }
diff --git a/lib/srv/desktop/audit_test.go b/lib/srv/desktop/audit_test.go
index 86a46bea7aefb..e308fb11ee61a 100644
--- a/lib/srv/desktop/audit_test.go
+++ b/lib/srv/desktop/audit_test.go
@@ -99,6 +99,7 @@ func TestSessionStartEvent(t *testing.T) {
 			Success: true,
 		},
 		WindowsDesktopService: s.cfg.Heartbeat.HostUUID,
+		DesktopName:           "test-desktop",
 		DesktopAddr:           desktop.GetAddr(),
 		Domain:                desktop.GetDomain(),
 		WindowsUser:           "Administrator",
@@ -131,6 +132,7 @@ func TestSessionStartEvent(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			s.onSessionStart(
 				context.Background(),
+				s.cfg.Emitter,
 				id,
 				s.cfg.Clock.Now().UTC().Round(time.Millisecond),
 				"Administrator",
@@ -173,6 +175,7 @@ func TestSessionEndEvent(t *testing.T) {
 
 	s.onSessionEnd(
 		context.Background(),
+		s.cfg.Emitter,
 		id,
 		startTime,
 		true,
diff --git a/lib/srv/desktop/discovery.go b/lib/srv/desktop/discovery.go
index 5a3f010183fc9..d89a3135a79c1 100644
--- a/lib/srv/desktop/discovery.go
+++ b/lib/srv/desktop/discovery.go
@@ -69,7 +69,7 @@ func (s *WindowsService) startDesktopDiscovery() error {
 		// pre-filtered by nature of using an LDAP search with filters.
 		Matcher: func(r types.ResourceWithLabels) bool { return true },
 
-		GetCurrentResources: func() types.ResourcesWithLabels { return s.lastDiscoveryResults },
+		GetCurrentResources: func() types.ResourcesWithLabelsMap { return s.lastDiscoveryResults },
 		GetNewResources:     s.getDesktopsFromLDAP,
 		OnCreate:            s.upsertDesktop,
 		OnUpdate:            s.upsertDesktop,
@@ -117,7 +117,7 @@ func (s *WindowsService) ldapSearchFilter() string {
 }
 
 // getDesktopsFromLDAP discovers Windows hosts via LDAP
-func (s *WindowsService) getDesktopsFromLDAP() types.ResourcesWithLabels {
+func (s *WindowsService) getDesktopsFromLDAP() types.ResourcesWithLabelsMap {
 	if !s.ldapReady() {
 		s.cfg.Log.Warn("skipping desktop discovery: LDAP not yet initialized")
 		return nil
@@ -144,14 +144,14 @@ func (s *WindowsService) getDesktopsFromLDAP() types.ResourcesWithLabels {
 
 	s.cfg.Log.Debugf("discovered %d Windows Desktops", len(entries))
 
-	var result types.ResourcesWithLabels
+	result := make(types.ResourcesWithLabelsMap)
 	for _, entry := range entries {
 		desktop, err := s.ldapEntryToWindowsDesktop(s.closeCtx, entry, s.cfg.HostLabelsFn)
 		if err != nil {
 			s.cfg.Log.Warnf("could not create Windows Desktop from LDAP entry: %v", err)
 			continue
 		}
-		result = append(result, desktop)
+		result[desktop.GetName()] = desktop
 	}
 
 	// capture the result, which will be used on the next reconcile loop
@@ -177,14 +177,14 @@ func (s *WindowsService) deleteDesktop(ctx context.Context, r types.ResourceWith
 }
 
 func applyLabelsFromLDAP(entry *ldap.Entry, labels map[string]string) {
-	labels["teleport.dev/dns_host_name"] = entry.GetAttributeValue(attrDNSHostName)
-	labels["teleport.dev/computer_name"] = entry.GetAttributeValue(attrName)
-	labels["teleport.dev/os"] = entry.GetAttributeValue(attrOS)
-	labels["teleport.dev/os_version"] = entry.GetAttributeValue(attrOSVersion)
+	labels[types.TeleportNamespace+"/dns_host_name"] = entry.GetAttributeValue(attrDNSHostName)
+	labels[types.TeleportNamespace+"/computer_name"] = entry.GetAttributeValue(attrName)
+	labels[types.TeleportNamespace+"/os"] = entry.GetAttributeValue(attrOS)
+	labels[types.TeleportNamespace+"/os_version"] = entry.GetAttributeValue(attrOSVersion)
 	labels[types.OriginLabel] = types.OriginDynamic
 	switch entry.GetAttributeValue(attrPrimaryGroupID) {
 	case writableDomainControllerGroupID, readOnlyDomainControllerGroupID:
-		labels["teleport.dev/is_domain_controller"] = "true"
+		labels[types.TeleportNamespace+"/is_domain_controller"] = "true"
 	}
 }
 
@@ -193,7 +193,7 @@ func applyLabelsFromLDAP(entry *ldap.Entry, labels map[string]string) {
 func (s *WindowsService) ldapEntryToWindowsDesktop(ctx context.Context, entry *ldap.Entry, getHostLabels func(string) map[string]string) (types.ResourceWithLabels, error) {
 	hostname := entry.GetAttributeValue(attrDNSHostName)
 	labels := getHostLabels(hostname)
-	labels["teleport.dev/windows_domain"] = s.cfg.Domain
+	labels[types.TeleportNamespace+"/windows_domain"] = s.cfg.Domain
 	applyLabelsFromLDAP(entry, labels)
 
 	addrs, err := s.dnsResolver.LookupHost(ctx, hostname)
diff --git a/lib/srv/desktop/discovery_test.go b/lib/srv/desktop/discovery_test.go
index 5635f8fc3190e..6ad26a602a197 100644
--- a/lib/srv/desktop/discovery_test.go
+++ b/lib/srv/desktop/discovery_test.go
@@ -71,10 +71,10 @@ func TestAppliesLDAPLabels(t *testing.T) {
 	applyLabelsFromLDAP(entry, l)
 
 	require.Equal(t, l[types.OriginLabel], types.OriginDynamic)
-	require.Equal(t, l["teleport.dev/dns_host_name"], "foo.example.com")
-	require.Equal(t, l["teleport.dev/computer_name"], "foo")
-	require.Equal(t, l["teleport.dev/os"], "Windows Server")
-	require.Equal(t, l["teleport.dev/os_version"], "6.1")
+	require.Equal(t, l[types.TeleportNamespace+"/dns_host_name"], "foo.example.com")
+	require.Equal(t, l[types.TeleportNamespace+"/computer_name"], "foo")
+	require.Equal(t, l[types.TeleportNamespace+"/os"], "Windows Server")
+	require.Equal(t, l[types.TeleportNamespace+"/os_version"], "6.1")
 }
 
 func TestLabelsDomainControllers(t *testing.T) {
@@ -109,7 +109,7 @@ func TestLabelsDomainControllers(t *testing.T) {
 			l := make(map[string]string)
 			applyLabelsFromLDAP(test.entry, l)
 
-			b, _ := strconv.ParseBool(l["teleport.dev/is_domain_controller"])
+			b, _ := strconv.ParseBool(l[types.TeleportNamespace+"/is_domain_controller"])
 			test.assert(t, b)
 		})
 	}
diff --git a/lib/srv/desktop/rdp/rdpclient/client.go b/lib/srv/desktop/rdp/rdpclient/client.go
index a74d6695b78b8..d191c768feba4 100644
--- a/lib/srv/desktop/rdp/rdpclient/client.go
+++ b/lib/srv/desktop/rdp/rdpclient/client.go
@@ -362,13 +362,17 @@ func (c *Client) start() {
 					return
 				}
 			case tdp.ClipboardData:
-				if err := cgoError(C.update_clipboard(
-					c.rustClient,
-					(*C.uint8_t)(unsafe.Pointer(&m[0])),
-					C.uint32_t(len(m)),
-				)); err != nil {
-					c.cfg.Log.Warningf("Failed forwarding RDP clipboard data: %v", err)
-					return
+				if len(m) > 0 {
+					if err := cgoError(C.update_clipboard(
+						c.rustClient,
+						(*C.uint8_t)(unsafe.Pointer(&m[0])),
+						C.uint32_t(len(m)),
+					)); err != nil {
+						c.cfg.Log.Warningf("Failed forwarding RDP clipboard data: %v", err)
+						return
+					}
+				} else {
+					c.cfg.Log.Warning("Recieved an empty clipboard message")
 				}
 			default:
 				c.cfg.Log.Warningf("Skipping unimplemented TDP message type %T", msg)
@@ -378,17 +382,23 @@ func (c *Client) start() {
 }
 
 //export handle_bitmap
-func handle_bitmap(handle C.uintptr_t, cb C.CGOBitmap) C.CGOError {
+func handle_bitmap(handle C.uintptr_t, cb *C.CGOBitmap) C.CGOError {
 	return cgo.Handle(handle).Value().(*Client).handleBitmap(cb)
 }
 
-func (c *Client) handleBitmap(cb C.CGOBitmap) C.CGOError {
+func (c *Client) handleBitmap(cb *C.CGOBitmap) C.CGOError {
 	// Notify the input forwarding goroutine that we're ready for input.
 	// Input can only be sent after connection was established, which we infer
 	// from the fact that a bitmap was sent.
 	atomic.StoreUint32(&c.readyForInput, 1)
 
-	data := C.GoBytes(unsafe.Pointer(cb.data_ptr), C.int(cb.data_len))
+	// use unsafe.Slice here instead of C.GoBytes, because unsafe.Slice
+	// creates a Go slice backed by data managed from Rust - it does not
+	// copy. This way we only need one copy into img.Pix below.
+	ptr := unsafe.Pointer(cb.data_ptr)
+	uptr := (*uint8)(ptr)
+	data := unsafe.Slice(uptr, C.int(cb.data_len))
+
 	// Convert BGRA to RGBA. It's likely due to Windows using uint32 values for
 	// pixels (ARGB) and encoding them as big endian. The image.RGBA type uses
 	// a byte slice with 4-byte segments representing pixels (RGBA).
diff --git a/lib/srv/desktop/rdp/rdpclient/librdprs.h b/lib/srv/desktop/rdp/rdpclient/librdprs.h
index f1a2876cdc078..e31462e98dc69 100644
--- a/lib/srv/desktop/rdp/rdpclient/librdprs.h
+++ b/lib/srv/desktop/rdp/rdpclient/librdprs.h
@@ -7,6 +7,19 @@
 
 #define SPECIAL_NO_RESPONSE 4294967295
 
+/**
+ * The default maximum chunk size for virtual channel data.
+ *
+ * If an RDP server supports larger chunks, it will advertise
+ * the larger chunk size in the `VCChunkSize` field of the
+ * virtual channel capability set.
+ *
+ * See also:
+ * - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/6c074267-1b32-4ceb-9496-2eb941a23e6b
+ * - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/a8593178-80c0-4b80-876c-cb77e62cecfc
+ */
+#define CHANNEL_CHUNK_LEGNTH 1600
+
 typedef enum CGOPointerButton {
   PointerButtonNone,
   PointerButtonLeft,
@@ -165,6 +178,6 @@ void free_rust_string(char *s);
 
 extern void free_go_string(char *s);
 
-extern CGOError handle_bitmap(uintptr_t client_ref, struct CGOBitmap b);
+extern CGOError handle_bitmap(uintptr_t client_ref, struct CGOBitmap *b);
 
 extern CGOError handle_remote_copy(uintptr_t client_ref, uint8_t *data, uint32_t len);
diff --git a/lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs b/lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs
index 48488c2d20f48..3d38a4ddeef77 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs
@@ -13,24 +13,39 @@
 // limitations under the License.
 
 use crate::errors::invalid_data_error;
+use crate::vchan::ChannelPDUFlags;
 use crate::{vchan, Payload};
 use bitflags::bitflags;
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
 use num_traits::FromPrimitive;
 use rdp::core::{mcs, tpkt};
-use rdp::model::data::Message;
 use rdp::model::error::*;
 use rdp::try_let;
 use std::collections::HashMap;
-use std::io::{Read, Write};
+use std::io::{Cursor, Read, Write};
 
 pub const CHANNEL_NAME: &str = "cliprdr";
 
+struct PendingData {
+    data: Vec<u8>,
+    total_length: u32,
+    clipboard_header: Option<ClipboardPDUHeader>,
+}
+
+impl PendingData {
+    fn reset(&mut self, length: u32) {
+        self.data.clear();
+        self.total_length = length;
+        self.clipboard_header = None;
+    }
+}
+
 /// Client implements a client for the clipboard virtual channel
 /// (CLIPRDR) extension, as defined in:
 /// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpeclip/fb9b7e0b-6db4-41c2-b83c-f889c1ee7688
 pub struct Client {
     clipboard: HashMap<u32, Vec<u8>>,
+    pending: PendingData,
     on_remote_copy: Box<dyn Fn(Vec<u8>)>,
 }
 
@@ -44,6 +59,11 @@ impl Client {
     pub fn new(on_remote_copy: Box<dyn Fn(Vec<u8>)>) -> Self {
         Client {
             clipboard: HashMap::new(),
+            pending: PendingData {
+                data: Vec::new(),
+                total_length: 0,
+                clipboard_header: None,
+            },
             on_remote_copy,
         }
     }
@@ -54,28 +74,58 @@ impl Client {
         mcs: &mut mcs::Client<S>,
     ) -> RdpResult<()> {
         let mut payload = try_let!(tpkt::Payload::Raw, payload)?;
-        let _pdu_header = vchan::ChannelPDUHeader::decode(&mut payload)?;
-        let header = ClipboardPDUHeader::decode(&mut payload)?;
+        let pdu_header = vchan::ChannelPDUHeader::decode(&mut payload)?;
+
+        // TODO(zmb3): this logic is the same for all virtual channels, and should
+        // be moved to vchan.rs and reused for the rdpdr client as well
+        if pdu_header
+            .flags
+            .contains(ChannelPDUFlags::CHANNEL_FLAG_FIRST)
+        {
+            self.pending.reset(pdu_header.length);
+            self.pending.clipboard_header = Some(ClipboardPDUHeader::decode(&mut payload)?);
+        }
+
+        payload.read_to_end(&mut self.pending.data)?;
+
+        if pdu_header
+            .flags
+            .contains(ChannelPDUFlags::CHANNEL_FLAG_LAST)
+            && self.pending.clipboard_header.is_some()
+        {
+            let full_msg = self.pending.data.split_off(0);
+            let mut payload = Cursor::new(full_msg);
+            let header = self.pending.clipboard_header.take().unwrap();
+            return self.handle_message(header, &mut payload, mcs);
+        }
+
+        Ok(())
+    }
+
+    fn handle_message<S: Read + Write>(
+        &mut self,
+        header: ClipboardPDUHeader,
+        payload: &mut Payload,
+        mcs: &mut mcs::Client<S>,
+    ) -> RdpResult<()> {
         debug!("received {:?}", header.msg_type);
 
-        let resp = match header.msg_type {
-            ClipboardPDUType::CB_CLIP_CAPS => self.handle_server_caps(&mut payload)?,
-            ClipboardPDUType::CB_MONITOR_READY => self.handle_monitor_ready(&mut payload)?,
+        let responses = match header.msg_type {
+            ClipboardPDUType::CB_CLIP_CAPS => self.handle_server_caps(payload)?,
+            ClipboardPDUType::CB_MONITOR_READY => self.handle_monitor_ready(payload)?,
             ClipboardPDUType::CB_FORMAT_LIST => {
-                self.handle_format_list(&mut payload, header.data_len)?
+                self.handle_format_list(payload, header.data_len)?
             }
             ClipboardPDUType::CB_FORMAT_LIST_RESPONSE => {
                 self.handle_format_list_response(header.msg_flags)?
             }
-            ClipboardPDUType::CB_FORMAT_DATA_REQUEST => {
-                self.handle_format_data_request(&mut payload)?
-            }
+            ClipboardPDUType::CB_FORMAT_DATA_REQUEST => self.handle_format_data_request(payload)?,
             ClipboardPDUType::CB_FORMAT_DATA_RESPONSE => {
                 if header
                     .msg_flags
                     .contains(ClipboardHeaderFlags::CB_RESPONSE_OK)
                 {
-                    self.handle_format_data_response(&mut payload, header.data_len)?
+                    self.handle_format_data_response(payload, header.data_len)?
                 } else {
                     warn!("RDP server failed to process format data request");
                     vec![]
@@ -91,8 +141,8 @@ impl Client {
         };
 
         let chan = &CHANNEL_NAME.to_string();
-        for msg in resp {
-            mcs.write(chan, msg)?;
+        for resp in responses {
+            mcs.write(chan, resp)?;
         }
 
         Ok(())
@@ -101,7 +151,7 @@ impl Client {
     /// update_clipboard is invoked from Go.
     /// It updates the local clipboard cache and returns the encoded message
     /// that should be sent to the RDP server.
-    pub fn update_clipboard(&mut self, data: Vec<u8>) -> RdpResult<Vec<u8>> {
+    pub fn update_clipboard(&mut self, data: Vec<u8>) -> RdpResult<Vec<Vec<u8>>> {
         const CR: u8 = 13;
         const LF: u8 = 10;
 
@@ -163,26 +213,23 @@ impl Client {
         // 1. Send our clipboard capabilities
         // 2. Mimic a "copy" operation by sending a format list PDU
         // This completes the initialization process.
-
-        let result = vec![
-            encode_message(
-                ClipboardPDUType::CB_CLIP_CAPS,
-                ClipboardCapabilitiesPDU {
-                    general: Some(GeneralClipboardCapabilitySet {
-                        version: CB_CAPS_VERSION_2,
-                        flags: ClipboardGeneralCapabilityFlags::CB_USE_LONG_FORMAT_NAMES,
-                    }),
-                }
-                .encode()?,
-            )?,
-            encode_message(
-                ClipboardPDUType::CB_FORMAT_LIST,
-                FormatListPDU::<LongFormatName> {
-                    format_names: vec![LongFormatName::id(0)],
-                }
-                .encode()?,
-            )?,
-        ];
+        let mut result = encode_message(
+            ClipboardPDUType::CB_CLIP_CAPS,
+            ClipboardCapabilitiesPDU {
+                general: Some(GeneralClipboardCapabilitySet {
+                    version: CB_CAPS_VERSION_2,
+                    flags: ClipboardGeneralCapabilityFlags::CB_USE_LONG_FORMAT_NAMES,
+                }),
+            }
+            .encode()?,
+        )?;
+        result.extend(encode_message(
+            ClipboardPDUType::CB_FORMAT_LIST,
+            FormatListPDU::<LongFormatName> {
+                format_names: vec![LongFormatName::id(0)],
+            }
+            .encode()?,
+        )?);
 
         Ok(result)
     }
@@ -207,17 +254,14 @@ impl Client {
         //
         // see section 3.1.1.1 for details
 
-        let mut result = vec![encode_message(
-            ClipboardPDUType::CB_FORMAT_LIST_RESPONSE,
-            vec![],
-        )?];
+        let mut result = encode_message(ClipboardPDUType::CB_FORMAT_LIST_RESPONSE, vec![])?;
 
         for name in list.format_names {
             match FromPrimitive::from_u32(name.format_id) {
                 // TODO(zmb3): support CF_TEXT, CF_UNICODETEXT, ...
                 Some(ClipboardFormat::CF_OEMTEXT) => {
                     // request the data by imitating a paste event
-                    result.push(encode_message(
+                    result.extend(encode_message(
                         ClipboardPDUType::CB_FORMAT_DATA_REQUEST,
                         FormatDataRequestPDU::for_id(name.format_id).encode()?,
                     )?);
@@ -259,20 +303,20 @@ impl Client {
             }
         };
 
-        Ok(vec![encode_message(
+        encode_message(
             ClipboardPDUType::CB_FORMAT_DATA_RESPONSE,
             FormatDataResponsePDU { data }.encode()?,
-        )?])
+        )
     }
 
     /// Receives clipboard data from the remote desktop. This is the server responding
     /// to our format data request.
     fn handle_format_data_response(
-        &self,
+        &mut self,
         payload: &mut Payload,
         length: u32,
     ) -> RdpResult<Vec<Vec<u8>>> {
-        let resp = FormatDataResponsePDU::decode(payload, length)?;
+        let mut resp = FormatDataResponsePDU::decode(payload, length)?;
         let data_len = resp.data.len();
         debug!(
             "recieved {} bytes of copied data from Windows Desktop",
@@ -281,12 +325,12 @@ impl Client {
 
         // trim the null-terminator, if it exists
         // (but don't worry about CRLF conversion, most non-Windows systems can handle CRLF well enough)
-        let mut data = resp.data;
-        if !data.is_empty() && data[data.len() - 1] == 0x00 {
-            data.truncate(data.len() - 1);
+        if let Some(0x00) = resp.data.last() {
+            resp.data.truncate(resp.data.len() - 1);
         }
 
-        (self.on_remote_copy)(data);
+        (self.on_remote_copy)(resp.data);
+
         Ok(vec![])
     }
 }
@@ -486,7 +530,7 @@ impl<T: FormatName> FormatListPDU<T> {
     fn encode(&self) -> RdpResult<Vec<u8>> {
         let mut w = Vec::new();
         for name in &self.format_names {
-            w.extend_from_slice(&name.encode()?);
+            w.extend(name.encode()?);
         }
 
         Ok(w)
@@ -712,8 +756,9 @@ impl FormatDataResponsePDU {
 }
 
 /// encode_message encodes a message by wrapping it in the appropriate
-/// channel header
-fn encode_message(msg_type: ClipboardPDUType, payload: Vec<u8>) -> RdpResult<Vec<u8>> {
+/// channel header. If the payload exceeds the maximum size, the message
+/// is split into multiple messages.
+fn encode_message(msg_type: ClipboardPDUType, payload: Vec<u8>) -> RdpResult<Vec<Vec<u8>>> {
     let msg_flags = match msg_type {
         // the spec requires 0 for these messages
         ClipboardPDUType::CB_CLIP_CAPS => ClipboardHeaderFlags::from_bits_truncate(0),
@@ -732,28 +777,51 @@ fn encode_message(msg_type: ClipboardPDUType, payload: Vec<u8>) -> RdpResult<Vec
 
         _ => ClipboardHeaderFlags::from_bits_truncate(0),
     };
-
     let mut inner = ClipboardPDUHeader::new(msg_type, msg_flags, payload.len() as u32).encode()?;
-    inner.extend_from_slice(&payload);
-
-    let mut channel_flags = vchan::ChannelPDUFlags::CHANNEL_FLAG_ONLY;
-    match msg_type {
-        ClipboardPDUType::CB_FORMAT_LIST
-        | ClipboardPDUType::CB_CLIP_CAPS
-        | ClipboardPDUType::CB_FORMAT_DATA_REQUEST
-        | ClipboardPDUType::CB_FORMAT_DATA_RESPONSE => {
-            channel_flags.set(vchan::ChannelPDUFlags::CHANNEL_FLAG_SHOW_PROTOCOL, true)
+    inner.extend(payload);
+    let total_len = inner.len() as u32;
+
+    let mut result = Vec::new();
+    let mut first = true;
+    while !inner.is_empty() {
+        let i = std::cmp::min(inner.len(), vchan::CHANNEL_CHUNK_LEGNTH);
+        let leftover = inner.split_off(i);
+
+        let mut channel_flags = match msg_type {
+            ClipboardPDUType::CB_FORMAT_LIST
+            | ClipboardPDUType::CB_CLIP_CAPS
+            | ClipboardPDUType::CB_FORMAT_DATA_REQUEST
+            | ClipboardPDUType::CB_FORMAT_DATA_RESPONSE => {
+                vchan::ChannelPDUFlags::CHANNEL_FLAG_SHOW_PROTOCOL
+            }
+            _ => vchan::ChannelPDUFlags::from_bits_truncate(0),
+        };
+
+        if first {
+            channel_flags.set(vchan::ChannelPDUFlags::CHANNEL_FLAG_FIRST, true);
+            first = false;
+        }
+        if leftover.is_empty() {
+            channel_flags.set(vchan::ChannelPDUFlags::CHANNEL_FLAG_LAST, true);
         }
-        _ => {}
+
+        // the Channel PDU Header always specifies the *total length* of the PDU,
+        // even if it has to be split into multpile chunks:
+        // https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/a542bf19-1c86-4c80-ab3e-61449653abf6
+        let mut outer = vchan::ChannelPDUHeader::new(total_len, channel_flags).encode()?;
+        outer.extend(inner);
+        result.push(outer);
+
+        inner = leftover;
     }
 
-    let mut outer = vchan::ChannelPDUHeader::new(inner.length() as u32, channel_flags).encode()?;
-    outer.extend_from_slice(&inner);
-    Ok(outer)
+    Ok(result)
 }
 
 #[cfg(test)]
 mod tests {
+    use crate::vchan::ChannelPDUFlags;
+
     use super::*;
     use std::io::Cursor;
     use std::sync::mpsc::channel;
@@ -771,7 +839,7 @@ mod tests {
         .unwrap();
 
         assert_eq!(
-            msg,
+            msg[0],
             vec![
                 // virtual channel header
                 0x2C, 0x00, 0x00, 0x00, // length (44 bytes)
@@ -800,7 +868,7 @@ mod tests {
             encode_message(ClipboardPDUType::CB_FORMAT_LIST, empty.encode().unwrap()).unwrap();
 
         assert_eq!(
-            encoded,
+            encoded[0],
             vec![
                 0x0e, 0x00, 0x00, 0x00, // message length (14 bytes)
                 0x13, 0x00, 0x00, 0x00, // flags (first + last + show protocol)
@@ -947,6 +1015,32 @@ mod tests {
         assert_eq!(format_list.format_names[0].format_name, None);
     }
 
+    #[test]
+    fn encodes_large_format_data_response() {
+        let mut data = Vec::new();
+        data.resize(vchan::CHANNEL_CHUNK_LEGNTH + 2, 0);
+        for (i, item) in data.iter_mut().enumerate() {
+            *item = (i % 256) as u8;
+        }
+        let pdu = FormatDataResponsePDU { data };
+        let encoded = pdu.encode().unwrap();
+        let messages = encode_message(ClipboardPDUType::CB_FORMAT_DATA_RESPONSE, encoded).unwrap();
+        assert_eq!(2, messages.len());
+
+        let header0 =
+            vchan::ChannelPDUHeader::decode(&mut Cursor::new(messages[0].clone())).unwrap();
+        assert_eq!(
+            ChannelPDUFlags::CHANNEL_FLAG_FIRST | ChannelPDUFlags::CHANNEL_FLAG_SHOW_PROTOCOL,
+            header0.flags
+        );
+        let header1 =
+            vchan::ChannelPDUHeader::decode(&mut Cursor::new(messages[1].clone())).unwrap();
+        assert_eq!(
+            ChannelPDUFlags::CHANNEL_FLAG_LAST | ChannelPDUFlags::CHANNEL_FLAG_SHOW_PROTOCOL,
+            header1.flags
+        );
+    }
+
     #[test]
     fn responds_to_format_data_request_hasdata() {
         // a null-terminated utf-16 string, represented as a Vec<u8>
@@ -980,7 +1074,7 @@ mod tests {
     fn invokes_callback_with_clipboard_data() {
         let (send, recv) = channel();
 
-        let c = Client::new(Box::new(move |vec| {
+        let mut c = Client::new(Box::new(move |vec| {
             send.send(vec).unwrap();
         }));
 
@@ -1003,9 +1097,10 @@ mod tests {
     #[test]
     fn update_clipboard_returns_format_list_pdu() {
         let mut c: Client = Default::default();
-        let bytes = c
+        let messages = c
             .update_clipboard(String::from("abc").into_bytes())
             .unwrap();
+        let bytes = messages[0].clone();
 
         // verify that it returns a properly encoded format list PDU
         let mut payload = Cursor::new(bytes);
diff --git a/lib/srv/desktop/rdp/rdpclient/src/lib.rs b/lib/srv/desktop/rdp/rdpclient/src/lib.rs
index 332174ee43111..ba8529174f411 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/lib.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/lib.rs
@@ -404,10 +404,17 @@ pub unsafe extern "C" fn update_clipboard(
 
     match lock.cliprdr {
         Some(ref mut clip) => match clip.update_clipboard(data) {
-            Ok(message) => match lock.mcs.write(&cliprdr::CHANNEL_NAME.to_string(), message) {
-                Ok(()) => CGO_OK,
-                Err(e) => to_cgo_error(format!("failed writing cliprdr format list: {:?}", e)),
-            },
+            Ok(messages) => {
+                for message in messages {
+                    if let Err(e) = lock.mcs.write(&cliprdr::CHANNEL_NAME.to_string(), message) {
+                        return to_cgo_error(format!(
+                            "failed writing cliprdr format list: {:?}",
+                            e
+                        ));
+                    }
+                }
+                CGO_OK
+            }
             Err(e) => to_cgo_error(format!("failed updating clipboard: {:?}", e)),
         },
         None => CGO_OK,
@@ -451,7 +458,7 @@ fn read_rdp_output_inner(client: &Client) -> Option<String> {
             .unwrap()
             .read(|rdp_event| match rdp_event {
                 RdpEvent::Bitmap(bitmap) => {
-                    let cbitmap = match CGOBitmap::try_from(bitmap) {
+                    let mut cbitmap = match CGOBitmap::try_from(bitmap) {
                         Ok(cb) => cb,
                         Err(e) => {
                             error!(
@@ -462,7 +469,7 @@ fn read_rdp_output_inner(client: &Client) -> Option<String> {
                         }
                     };
                     unsafe {
-                        err = handle_bitmap(client_ref, cbitmap) as CGOError;
+                        err = handle_bitmap(client_ref, &mut cbitmap) as CGOError;
                     };
                 }
                 // These should never really be sent by the server to us.
@@ -689,8 +696,7 @@ unsafe fn from_cgo_error(e: CGOError) -> String {
 // comments.
 extern "C" {
     fn free_go_string(s: *mut c_char);
-    fn handle_bitmap(client_ref: usize, b: CGOBitmap) -> CGOError;
-
+    fn handle_bitmap(client_ref: usize, b: *mut CGOBitmap) -> CGOError;
     fn handle_remote_copy(client_ref: usize, data: *mut u8, len: u32) -> CGOError;
 }
 
diff --git a/lib/srv/desktop/rdp/rdpclient/src/vchan.rs b/lib/srv/desktop/rdp/rdpclient/src/vchan.rs
index 0292e036f8022..0ab8ce6ecb878 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/vchan.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/vchan.rs
@@ -18,6 +18,17 @@ use bitflags::bitflags;
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
 use rdp::model::error::*;
 
+/// The default maximum chunk size for virtual channel data.
+///
+/// If an RDP server supports larger chunks, it will advertise
+/// the larger chunk size in the `VCChunkSize` field of the
+/// virtual channel capability set.
+///
+/// See also:
+/// - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/6c074267-1b32-4ceb-9496-2eb941a23e6b
+/// - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/a8593178-80c0-4b80-876c-cb77e62cecfc
+pub const CHANNEL_CHUNK_LEGNTH: usize = 1600;
+
 bitflags! {
     /// Channel control flags, as specified in section 2.2.6.1.1 of MS-RDPBCGR.
     ///
@@ -43,8 +54,13 @@ bitflags! {
 /// It is specified in section 2.2.6.1.1 of MS-RDPBCGR.
 #[derive(Debug)]
 pub struct ChannelPDUHeader {
-    length: u32,
-    flags: ChannelPDUFlags,
+    /// The total length of the uncompressed PDU data,
+    /// excluding the length of this header.
+    /// Note: the data can span multiple PDUs, in which
+    /// case each PDU in the series contains the same
+    /// length field.
+    pub length: u32,
+    pub flags: ChannelPDUFlags,
 }
 
 impl ChannelPDUHeader {
diff --git a/lib/srv/desktop/windows_server.go b/lib/srv/desktop/windows_server.go
index ed33e43a9269b..ed9c513794485 100644
--- a/lib/srv/desktop/windows_server.go
+++ b/lib/srv/desktop/windows_server.go
@@ -113,7 +113,7 @@ type WindowsService struct {
 	// when desktop discovery is enabled.
 	// no synchronization is necessary because this is only read/written from
 	// the reconciler goroutine.
-	lastDiscoveryResults types.ResourcesWithLabels
+	lastDiscoveryResults types.ResourcesWithLabelsMap
 
 	// Windows hosts discovered via LDAP likely won't resolve with the
 	// default DNS resolver, so we need a custom resolver that will
@@ -163,6 +163,8 @@ type WindowsServiceConfig struct {
 	// Windows Desktops. If multiple filters are specified, they are ANDed
 	// together into a single search.
 	DiscoveryLDAPFilters []string
+	// Hostname of the windows desktop service
+	Hostname string
 }
 
 // LDAPConfig contains parameters for connecting to an LDAP server.
@@ -829,7 +831,7 @@ func (s *WindowsService) connectRDP(ctx context.Context, log logrus.FieldLogger,
 		AllowClipboard: authCtx.Checker.DesktopClipboard(),
 	})
 	if err != nil {
-		s.onSessionStart(ctx, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)
+		s.onSessionStart(ctx, sw, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)
 		return trace.Wrap(err)
 	}
 
@@ -857,13 +859,13 @@ func (s *WindowsService) connectRDP(ctx context.Context, log logrus.FieldLogger,
 		// consider this a connection failure and return an error
 		// (in the happy path, rdpc remains open until Wait() completes)
 		rdpc.Close()
-		s.onSessionStart(ctx, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)
+		s.onSessionStart(ctx, sw, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)
 		return trace.Wrap(err)
 	}
 
-	s.onSessionStart(ctx, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, nil)
+	s.onSessionStart(ctx, sw, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, nil)
 	err = rdpc.Wait()
-	s.onSessionEnd(ctx, &identity, sessionStartTime, recordSession, windowsUser, string(sessionID), desktop)
+	s.onSessionEnd(ctx, sw, &identity, sessionStartTime, recordSession, windowsUser, string(sessionID), desktop)
 
 	return trace.Wrap(err)
 }
@@ -872,7 +874,7 @@ func (s *WindowsService) makeTDPSendHandler(ctx context.Context, emitter events.
 	id *tlsca.Identity, sessionID, desktopAddr string) func(m tdp.Message, b []byte) {
 	return func(m tdp.Message, b []byte) {
 		switch b[0] {
-		case byte(tdp.TypePNGFrame):
+		case byte(tdp.TypePNGFrame), byte(tdp.TypeError):
 			e := &events.DesktopRecording{
 				Metadata: events.Metadata{
 					Type: libevents.DesktopRecordingEvent,
@@ -896,7 +898,7 @@ func (s *WindowsService) makeTDPSendHandler(ctx context.Context, emitter events.
 				// the TDP send handler emits a clipboard receive event, because we
 				// received clipboard data from the remote desktop and are sending
 				// it on the TDP connection
-				s.onClipboardReceive(ctx, id, sessionID, desktopAddr, int32(len(clip)))
+				s.onClipboardReceive(ctx, emitter, id, sessionID, desktopAddr, int32(len(clip)))
 			}
 		}
 	}
@@ -930,7 +932,7 @@ func (s *WindowsService) makeTDPReceiveHandler(ctx context.Context, emitter even
 			// the TDP receive handler emits a clipboard send event, because we
 			// received clipboard data from the user (over TDP) and are sending
 			// it to the remote desktop
-			s.onClipboardSend(ctx, id, sessionID, desktopAddr, int32(len(msg)))
+			s.onClipboardSend(ctx, emitter, id, sessionID, desktopAddr, int32(len(msg)))
 		}
 	}
 }
@@ -941,6 +943,7 @@ func (s *WindowsService) getServiceHeartbeatInfo() (types.Resource, error) {
 		types.WindowsDesktopServiceSpecV3{
 			Addr:            s.cfg.Heartbeat.PublicAddr,
 			TeleportVersion: teleport.Version,
+			Hostname:        s.cfg.Hostname,
 		})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1028,7 +1031,7 @@ func (s *WindowsService) updateCA(ctx context.Context) error {
 	// have to do it here.
 	//
 	// TODO(zmb3): support multiple CA certs per cluster (such as with HSMs).
-	ca, err := s.cfg.AccessPoint.GetCertAuthority(types.CertAuthID{
+	ca, err := s.cfg.AccessPoint.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: s.clusterName,
 	}, false)
diff --git a/lib/srv/desktop/windows_server_test.go b/lib/srv/desktop/windows_server_test.go
index 0256f18441b02..4bc0f32983e34 100644
--- a/lib/srv/desktop/windows_server_test.go
+++ b/lib/srv/desktop/windows_server_test.go
@@ -285,13 +285,8 @@ func TestEmitsRecordingEventsOnReceive(t *testing.T) {
 
 func TestEmitsClipboardSendEvents(t *testing.T) {
 	s, id, emitter := setup()
-
-	// clipboard events go straight to the audit log,
-	// not the session recording, so they use s.cfg.Emitter
-	// rather than the emitter passed in here
-	var recordingStreamer events.Emitter /* = nil */
 	handler := s.makeTDPReceiveHandler(context.Background(),
-		recordingStreamer, func() int64 { return 0 },
+		emitter, func() int64 { return 0 },
 		id, "session-0", "windows.example.com")
 
 	fakeClipboardData := make([]byte, 1024)
@@ -314,13 +309,8 @@ func TestEmitsClipboardSendEvents(t *testing.T) {
 
 func TestEmitsClipboardReceiveEvents(t *testing.T) {
 	s, id, emitter := setup()
-
-	// clipboard events go straight to the audit log,
-	// not the session recording, so they use s.cfg.Emitter
-	// rather than the emitter passed in here
-	var recordingStreamer events.Emitter /* = nil */
 	handler := s.makeTDPSendHandler(context.Background(),
-		recordingStreamer, func() int64 { return 0 },
+		emitter, func() int64 { return 0 },
 		id, "session-0", "windows.example.com")
 
 	fakeClipboardData := make([]byte, 512)
diff --git a/lib/srv/reexec.go b/lib/srv/reexec.go
index 1444f5295b64a..ca4018eb1d481 100644
--- a/lib/srv/reexec.go
+++ b/lib/srv/reexec.go
@@ -22,7 +22,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/exec"
@@ -202,8 +201,8 @@ func RunCommand() (errw io.Writer, code int, err error) {
 			stderr = tty
 		} else {
 			stdin = os.Stdin
-			stdout = ioutil.Discard
-			stderr = ioutil.Discard
+			stdout = io.Discard
+			stderr = io.Discard
 		}
 
 		// Open the PAM context.
@@ -326,7 +325,7 @@ func RunCommand() (errw io.Writer, code int, err error) {
 		}
 	}
 
-	return ioutil.Discard, exitCode(err), trace.Wrap(err)
+	return io.Discard, exitCode(err), trace.Wrap(err)
 }
 
 // RunForward reads in the command to run from the parent process (over a
@@ -363,8 +362,8 @@ func RunForward() (errw io.Writer, code int, err error) {
 			ServiceName: c.PAMConfig.ServiceName,
 			Login:       c.Login,
 			Stdin:       os.Stdin,
-			Stdout:      ioutil.Discard,
-			Stderr:      ioutil.Discard,
+			Stdout:      io.Discard,
+			Stderr:      io.Discard,
 			// Set Teleport specific environment variables that PAM modules
 			// like pam_script.so can pick up to potentially customize the
 			// account/session.
@@ -409,19 +408,19 @@ func RunForward() (errw io.Writer, code int, err error) {
 		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
-	return ioutil.Discard, teleport.RemoteCommandSuccess, nil
+	return io.Discard, teleport.RemoteCommandSuccess, nil
 }
 
 // runCheckHomeDir check's if the active user's $HOME dir exists.
 func runCheckHomeDir() (errw io.Writer, code int, err error) {
 	home, err := os.UserHomeDir()
 	if err != nil {
-		return ioutil.Discard, teleport.HomeDirNotFound, nil
+		return io.Discard, teleport.HomeDirNotFound, nil
 	}
 	if !utils.IsDir(home) {
-		return ioutil.Discard, teleport.HomeDirNotFound, nil
+		return io.Discard, teleport.HomeDirNotFound, nil
 	}
-	return ioutil.Discard, teleport.RemoteCommandSuccess, nil
+	return io.Discard, teleport.RemoteCommandSuccess, nil
 }
 
 // RunAndExit will run the requested command and then exit. This wrapper
diff --git a/lib/srv/regular/sshserver.go b/lib/srv/regular/sshserver.go
index 8e3d0cd72981f..b68550b2215b4 100644
--- a/lib/srv/regular/sshserver.go
+++ b/lib/srv/regular/sshserver.go
@@ -22,7 +22,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/user"
@@ -862,7 +861,7 @@ func (s *Server) serveAgent(ctx *srv.ServerContext) error {
 	pid := os.Getpid()
 
 	// build the socket path and set permissions
-	socketDir, err := ioutil.TempDir(os.TempDir(), "teleport-")
+	socketDir, err := os.MkdirTemp(os.TempDir(), "teleport-")
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/srv/regular/sshserver_test.go b/lib/srv/regular/sshserver_test.go
index e37e31ecbe86e..ff1014ed80143 100644
--- a/lib/srv/regular/sshserver_test.go
+++ b/lib/srv/regular/sshserver_test.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -279,7 +278,7 @@ const hostID = "00000000-0000-0000-0000-000000000000"
 func startReadAll(r io.Reader) <-chan []byte {
 	ch := make(chan []byte)
 	go func() {
-		data, _ := ioutil.ReadAll(r)
+		data, _ := io.ReadAll(r)
 		ch <- data
 	}()
 	return ch
@@ -449,7 +448,7 @@ func TestDirectTCPIP(t *testing.T) {
 	defer resp.Body.Close()
 
 	// Make sure the response is what was expected.
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	require.NoError(t, err)
 	require.Equal(t, []byte("hello, world\n"), body)
 }
@@ -620,7 +619,7 @@ func TestAgentForward(t *testing.T) {
 	require.NoError(t, err)
 
 	// create a temp file to collect the shell output into:
-	tmpFile, err := ioutil.TempFile(os.TempDir(), "teleport-agent-forward-test")
+	tmpFile, err := os.CreateTemp(os.TempDir(), "teleport-agent-forward-test")
 	require.NoError(t, err)
 	tmpFile.Close()
 	defer os.Remove(tmpFile.Name())
@@ -632,7 +631,7 @@ func TestAgentForward(t *testing.T) {
 	// wait for the output
 	var socketPath string
 	require.Eventually(t, func() bool {
-		output, err := ioutil.ReadFile(tmpFile.Name())
+		output, err := os.ReadFile(tmpFile.Name())
 		if err == nil && len(output) != 0 {
 			socketPath = strings.TrimSpace(string(output))
 			return true
diff --git a/lib/srv/sess.go b/lib/srv/sess.go
index dac30094a1c94..28860ac7e2f55 100644
--- a/lib/srv/sess.go
+++ b/lib/srv/sess.go
@@ -93,6 +93,7 @@ func NewSessionRegistry(srv Server, auth auth.ClientI) (*SessionRegistry, error)
 		}),
 		srv:      srv,
 		sessions: make(map[rsession.ID]*session),
+		auth:     auth,
 	}, nil
 }
 
@@ -319,7 +320,7 @@ func (s *SessionRegistry) ForceTerminate(ctx *ServerContext) error {
 	}
 
 	sess.terminated = true
-	sess.io.BroadcastMessage("Forcefully terminating session...")
+	sess.BroadcastMessage("Forcefully terminating session...")
 	sess.term.Kill()
 	sess.doneCh <- struct{}{}
 
@@ -601,6 +602,8 @@ type session struct {
 	bpfContext *bpf.SessionContext
 
 	cgroupID uint64
+
+	displayParticipantRequirements bool
 }
 
 // newSession creates a new session with a given ID within a given context.
@@ -669,25 +672,35 @@ func newSession(id rsession.ID, r *SessionRegistry, ctx *ServerContext) (*sessio
 		log: log.WithFields(log.Fields{
 			trace.Component: teleport.Component(teleport.ComponentSession, r.srv.Component()),
 		}),
-		id:              id,
-		registry:        r,
-		parties:         make(map[rsession.ID]*party),
-		participants:    make(map[rsession.ID]*party),
-		login:           ctx.Identity.Login,
-		closeC:          make(chan bool),
-		lingerTTL:       defaults.SessionIdlePeriod,
-		startTime:       startTime,
-		serverCtx:       ctx.srv.Context(),
-		state:           types.SessionState_SessionStatePending,
-		access:          auth.NewSessionAccessEvaluator(policySets, types.SSHSessionKind),
-		scx:             ctx,
-		presenceEnabled: ctx.Identity.Certificate.Extensions[teleport.CertExtensionMFAVerified] != "",
-		io:              NewTermManager(),
-		stateUpdate:     sync.NewCond(&sync.Mutex{}),
-		doneCh:          make(chan struct{}, 2),
-		initiator:       ctx.Identity.TeleportUser,
+		id:                             id,
+		registry:                       r,
+		parties:                        make(map[rsession.ID]*party),
+		participants:                   make(map[rsession.ID]*party),
+		login:                          ctx.Identity.Login,
+		closeC:                         make(chan bool),
+		lingerTTL:                      defaults.SessionIdlePeriod,
+		startTime:                      startTime,
+		serverCtx:                      ctx.srv.Context(),
+		state:                          types.SessionState_SessionStatePending,
+		access:                         auth.NewSessionAccessEvaluator(policySets, types.SSHSessionKind),
+		scx:                            ctx,
+		presenceEnabled:                ctx.Identity.Certificate.Extensions[teleport.CertExtensionMFAVerified] != "",
+		io:                             NewTermManager(),
+		stateUpdate:                    sync.NewCond(&sync.Mutex{}),
+		doneCh:                         make(chan struct{}, 2),
+		initiator:                      ctx.Identity.TeleportUser,
+		displayParticipantRequirements: utils.AsBool(ctx.env[teleport.EnvSSHSessionDisplayParticipantRequirements]),
 	}
 
+	go func() {
+		if _, open := <-sess.io.TerminateNotifier(); open {
+			err := sess.registry.ForceTerminate(sess.scx)
+			if err != nil {
+				sess.log.Errorf("Failed to terminate session: %v.", err)
+			}
+		}
+	}()
+
 	err = sess.trackerCreate(ctx.Identity.TeleportUser, policySets)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -730,7 +743,7 @@ func (s *session) Close() error {
 			defer s.mu.Unlock()
 
 			close(s.closeC)
-			s.io.BroadcastMessage("Closing session...")
+			s.BroadcastMessage("Closing session...")
 			s.log.Infof("Closing session %v.", s.id)
 			if s.term != nil {
 				s.term.Close()
@@ -768,10 +781,7 @@ func (s *session) isLingering() bool {
 
 func (s *session) waitOnAccess() error {
 	s.io.Off()
-	err := s.io.BroadcastMessage("Session paused, Waiting for required participants...")
-	if err != nil {
-		log.WithError(err).Errorf("Failed to broadcast message.")
-	}
+	s.BroadcastMessage("Session paused, Waiting for required participants...")
 
 	s.stateUpdate.L.Lock()
 	defer s.stateUpdate.L.Unlock()
@@ -789,11 +799,21 @@ outer:
 		s.stateUpdate.Wait()
 	}
 
-	s.io.BroadcastMessage("Resuming session...")
+	s.BroadcastMessage("Resuming session...")
 	s.io.On()
 	return nil
 }
 
+func (s *session) BroadcastMessage(format string, args ...interface{}) {
+	if s.access.IsModerated() && !services.IsRecordAtProxy(s.scx.SessionRecordingConfig.GetMode()) {
+		err := s.io.BroadcastMessage(fmt.Sprintf(format, args...))
+
+		if err != nil {
+			s.log.Debugf("Failed to broadcast message: %v", err)
+		}
+	}
+}
+
 func (s *session) launch(ctx *ServerContext) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -801,7 +821,7 @@ func (s *session) launch(ctx *ServerContext) error {
 	defer s.stateUpdate.L.Unlock()
 
 	s.log.Debugf("Launching session %v.", s.id)
-	s.io.BroadcastMessage("Launching session...")
+	s.BroadcastMessage("Connecting to %v over SSH", ctx.srv.GetInfo().GetHostname())
 	s.state = types.SessionState_SessionStateRunning
 
 	err := s.io.On()
@@ -927,34 +947,11 @@ func (s *session) startInteractive(ch ssh.Channel, ctx *ServerContext) error {
 	// create a new "party" (connected client)
 	p := newParty(s, types.SessionPeerMode, ch, ctx)
 
-	// Nodes discard events in cases when proxies are already recording them.
-	if s.registry.srv.Component() == teleport.ComponentNode &&
-		services.IsRecordAtProxy(ctx.SessionRecordingConfig.GetMode()) {
-		s.recorder = &events.DiscardStream{}
-	} else {
-		streamer, err := s.newStreamer(ctx)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		s.recorder, err = events.NewAuditWriter(events.AuditWriterConfig{
-			// Audit stream is using server context, not session context,
-			// to make sure that session is uploaded even after it is closed
-			Context:      ctx.srv.Context(),
-			Streamer:     streamer,
-			Clock:        ctx.srv.GetClock(),
-			SessionID:    s.id,
-			Namespace:    ctx.srv.GetNamespace(),
-			ServerID:     ctx.srv.HostUUID(),
-			RecordOutput: ctx.SessionRecordingConfig.GetMode() != types.RecordOff,
-			Component:    teleport.Component(teleport.ComponentSession, ctx.srv.Component()),
-			ClusterName:  ctx.ClusterName,
-		})
-		if err != nil {
-			return trace.Wrap(err)
-		}
+	rec, err := newRecorder(s, ctx)
+	if err != nil {
+		return trace.Wrap(err)
 	}
-
-	var err error
+	s.recorder = rec
 
 	// allocate a terminal or take the one previously allocated via a
 	// seaprate "allocate TTY" SSH request
@@ -1007,10 +1004,7 @@ func (s *session) startInteractive(ch ssh.Channel, ctx *ServerContext) error {
 	s.inWriter = inWriter
 	s.io.AddReader("reader", inReader)
 	s.io.AddWriter("session-recorder", utils.WriteCloserWithContext(ctx.srv.Context(), s.recorder))
-	err = s.io.BroadcastMessage(fmt.Sprintf("Creating session with ID: %v...", s.id))
-	if err != nil {
-		return trace.Wrap(err)
-	}
+	s.BroadcastMessage("Creating session with ID: %v...", s.id)
 
 	if err := s.term.Run(); err != nil {
 		ctx.Errorf("Unable to run shell command: %v.", err)
@@ -1055,37 +1049,46 @@ func (s *session) startInteractive(ch ssh.Channel, ctx *ServerContext) error {
 	return nil
 }
 
-func (s *session) startExec(channel ssh.Channel, ctx *ServerContext) error {
-	var err error
-
+// newRecorder creates a new events.StreamWriter to be used as the recorder
+// of the passed in session.
+func newRecorder(s *session, ctx *ServerContext) (events.StreamWriter, error) {
 	// Nodes discard events in cases when proxies are already recording them.
 	if s.registry.srv.Component() == teleport.ComponentNode &&
 		services.IsRecordAtProxy(ctx.SessionRecordingConfig.GetMode()) {
-		s.recorder = &events.DiscardStream{}
-	} else {
-		streamer, err := s.newStreamer(ctx)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		rec, err := events.NewAuditWriter(events.AuditWriterConfig{
-			// Audit stream is using server context, not session context,
-			// to make sure that session is uploaded even after it is closed
-			Context:      ctx.srv.Context(),
-			Streamer:     streamer,
-			SessionID:    s.id,
-			Clock:        ctx.srv.GetClock(),
-			Namespace:    ctx.srv.GetNamespace(),
-			ServerID:     ctx.srv.HostUUID(),
-			RecordOutput: ctx.SessionRecordingConfig.GetMode() != types.RecordOff,
-			Component:    teleport.Component(teleport.ComponentSession, ctx.srv.Component()),
-			ClusterName:  ctx.ClusterName,
-		})
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		s.recorder = rec
+		return &events.DiscardStream{}, nil
 	}
 
+	streamer, err := s.newStreamer(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	rec, err := events.NewAuditWriter(events.AuditWriterConfig{
+		// Audit stream is using server context, not session context,
+		// to make sure that session is uploaded even after it is closed
+		Context:      ctx.srv.Context(),
+		Streamer:     streamer,
+		SessionID:    s.id,
+		Clock:        ctx.srv.GetClock(),
+		Namespace:    ctx.srv.GetNamespace(),
+		ServerID:     ctx.srv.HostUUID(),
+		RecordOutput: ctx.SessionRecordingConfig.GetMode() != types.RecordOff,
+		Component:    teleport.Component(teleport.ComponentSession, ctx.srv.Component()),
+		ClusterName:  ctx.ClusterName,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return rec, nil
+}
+
+func (s *session) startExec(channel ssh.Channel, ctx *ServerContext) error {
+	rec, err := newRecorder(s, ctx)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	s.recorder = rec
+
 	// Emit a session.start event for the exec session.
 	sessionStartEvent := &apievents.SessionStart{
 		Metadata: apievents.Metadata{
@@ -1316,7 +1319,7 @@ func (s *session) removeParty(p *party) error {
 	}
 
 	s.io.DeleteWriter(string(p.id))
-	s.io.BroadcastMessage(fmt.Sprintf("User %v left the session.", p.user))
+	s.BroadcastMessage("User %v left the session.", p.user)
 	return nil
 }
 
@@ -1477,6 +1480,18 @@ func (s *session) addParty(p *party, mode types.SessionParticipantMode) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
+	if len(s.parties) == 0 {
+		canStart, _, err := s.checkIfStart()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if !canStart && services.IsRecordAtProxy(p.ctx.SessionRecordingConfig.GetMode()) {
+			go s.Close()
+			return trace.AccessDenied("session requires additional moderation but is in proxy-record mode")
+		}
+	}
+
 	// Adds participant to in-memory map of party members.
 	s.parties[p.id] = p
 	s.participants[p.id] = p
@@ -1497,7 +1512,7 @@ func (s *session) addParty(p *party, mode types.SessionParticipantMode) error {
 	p.ctx.AddCloser(p)
 	s.term.AddParty(1)
 
-	s.io.BroadcastMessage(fmt.Sprintf("User %v joined the session.", p.user))
+	s.BroadcastMessage("User %v joined the session.", p.user)
 	s.log.Infof("New party %v joined session: %v", p.String(), s.id)
 
 	if mode == types.SessionPeerMode {
@@ -1539,6 +1554,14 @@ func (s *session) addParty(p *party, mode types.SessionParticipantMode) error {
 				s.state = types.SessionState_SessionStateRunning
 				s.stateUpdate.Broadcast()
 			}
+		} else if !s.started {
+			base := "Waiting for required participants..."
+
+			if s.displayParticipantRequirements {
+				s.BroadcastMessage(base+"\r\n%v", s.access.PrettyRequirementsList())
+			} else {
+				s.BroadcastMessage(base)
+			}
 		}
 	}
 
@@ -1692,9 +1715,12 @@ func (s *session) trackerCreate(teleportUser string, policySet []*types.SessionT
 
 	reason := s.scx.env[teleport.EnvSSHSessionReason]
 	var invited []string
-	err := json.Unmarshal([]byte(s.scx.env[teleport.EnvSSHSessionInvited]), &invited)
-	if err != nil {
-		return trace.Wrap(err)
+
+	if s.scx.env[teleport.EnvSSHSessionInvited] != "" {
+		err := json.Unmarshal([]byte(s.scx.env[teleport.EnvSSHSessionInvited]), &invited)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
 	req := &proto.CreateSessionTrackerRequest{
@@ -1713,7 +1739,7 @@ func (s *session) trackerCreate(teleportUser string, policySet []*types.SessionT
 		HostPolicies: policySet,
 	}
 
-	_, err = s.registry.auth.CreateSessionTracker(s.serverCtx, req)
+	_, err := s.registry.auth.CreateSessionTracker(s.serverCtx, req)
 	return trace.Wrap(err)
 }
 
diff --git a/lib/srv/sess_test.go b/lib/srv/sess_test.go
index 88b433559cda8..02a98f96cec1a 100644
--- a/lib/srv/sess_test.go
+++ b/lib/srv/sess_test.go
@@ -17,8 +17,20 @@ limitations under the License.
 package srv
 
 import (
+	"context"
 	"testing"
 
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/bpf"
+	"github.com/gravitational/teleport/lib/events"
+	"github.com/gravitational/teleport/lib/pam"
+	restricted "github.com/gravitational/teleport/lib/restrictedsession"
+	"github.com/gravitational/teleport/lib/services"
+	rsession "github.com/gravitational/teleport/lib/session"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 )
 
@@ -63,3 +75,237 @@ func TestParseAccessRequestIDs(t *testing.T) {
 	}
 
 }
+
+type mockServer struct {
+	events.StreamEmitter
+}
+
+// ID is the unique ID of the server.
+func (m *mockServer) ID() string {
+	return "test"
+}
+
+// HostUUID is the UUID of the underlying host. For the forwarding
+// server this is the proxy the forwarding server is running in.
+func (m *mockServer) HostUUID() string {
+	return "test"
+}
+
+// GetNamespace returns the namespace the server was created in.
+func (m *mockServer) GetNamespace() string {
+	return "test"
+}
+
+// AdvertiseAddr is the publicly addressable address of this server.
+func (m *mockServer) AdvertiseAddr() string {
+	return "test"
+}
+
+// Component is the type of server, forwarding or regular.
+func (m *mockServer) Component() string {
+	return teleport.ComponentNode
+}
+
+// PermitUserEnvironment returns if reading environment variables upon
+// startup is allowed.
+func (m *mockServer) PermitUserEnvironment() bool {
+	return false
+}
+
+// GetAccessPoint returns an AccessPoint for this cluster.
+func (m *mockServer) GetAccessPoint() AccessPoint {
+	return nil
+}
+
+// GetSessionServer returns a session server.
+func (m *mockServer) GetSessionServer() rsession.Service {
+	return nil
+}
+
+// GetDataDir returns data directory of the server
+func (m *mockServer) GetDataDir() string {
+	return "test"
+}
+
+// GetPAM returns PAM configuration for this server.
+func (m *mockServer) GetPAM() (*pam.Config, error) {
+	return nil, nil
+}
+
+// GetClock returns a clock setup for the server
+func (m *mockServer) GetClock() clockwork.Clock {
+	return clockwork.NewRealClock()
+}
+
+// GetInfo returns a services.Server that represents this server.
+func (m *mockServer) GetInfo() types.Server {
+	return nil
+}
+
+// UseTunnel used to determine if this node has connected to this cluster
+// using reverse tunnel.
+func (m *mockServer) UseTunnel() bool {
+	return false
+}
+
+// GetBPF returns the BPF service used for enhanced session recording.
+func (m *mockServer) GetBPF() bpf.BPF {
+	return nil
+}
+
+// GetRestrictedSessionManager returns the manager for restricting user activity
+func (m *mockServer) GetRestrictedSessionManager() restricted.Manager {
+	return nil
+}
+
+// Context returns server shutdown context
+func (m *mockServer) Context() context.Context {
+	return context.Background()
+}
+
+// GetUtmpPath returns the path of the user accounting database and log. Returns empty for system defaults.
+func (m *mockServer) GetUtmpPath() (utmp, wtmp string) {
+	return "test", "test"
+}
+
+// GetLockWatcher gets the server's lock watcher.
+func (m *mockServer) GetLockWatcher() *services.LockWatcher {
+	return nil
+}
+
+func TestSession_newRecorder(t *testing.T) {
+	proxyRecording, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
+		Mode: types.RecordAtProxy,
+	})
+	require.NoError(t, err)
+
+	proxyRecordingSync, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
+		Mode: types.RecordAtProxySync,
+	})
+	require.NoError(t, err)
+
+	nodeRecording, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
+		Mode: types.RecordAtNode,
+	})
+	require.NoError(t, err)
+
+	nodeRecordingSync, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
+		Mode: types.RecordAtNodeSync,
+	})
+	require.NoError(t, err)
+
+	logger := logrus.WithFields(logrus.Fields{
+		trace.Component: teleport.ComponentAuth,
+	})
+
+	cases := []struct {
+		desc         string
+		sess         *session
+		sctx         *ServerContext
+		errAssertion require.ErrorAssertionFunc
+		recAssertion require.ValueAssertionFunc
+	}{
+		{
+			desc: "discard-stream-when-proxy-recording",
+			sess: &session{
+				id:  "test",
+				log: logger,
+				registry: &SessionRegistry{
+					srv: &mockServer{},
+				},
+			},
+			sctx: &ServerContext{
+				SessionRecordingConfig: proxyRecording,
+			},
+			errAssertion: require.NoError,
+			recAssertion: func(t require.TestingT, i interface{}, i2 ...interface{}) {
+				require.NotNil(t, i)
+				_, ok := i.(*events.DiscardStream)
+				require.True(t, ok)
+			},
+		},
+		{
+			desc: "discard-stream--when-proxy-sync-recording",
+			sess: &session{
+				id:  "test",
+				log: logger,
+				registry: &SessionRegistry{
+					srv: &mockServer{},
+				},
+			},
+			sctx: &ServerContext{
+				SessionRecordingConfig: proxyRecordingSync,
+			},
+			errAssertion: require.NoError,
+			recAssertion: func(t require.TestingT, i interface{}, i2 ...interface{}) {
+				require.NotNil(t, i)
+				_, ok := i.(*events.DiscardStream)
+				require.True(t, ok)
+			},
+		},
+		{
+			desc: "err-new-streamer-fails",
+			sess: &session{
+				id:  "test",
+				log: logger,
+				registry: &SessionRegistry{
+					srv: &mockServer{},
+				},
+			},
+			sctx: &ServerContext{
+				SessionRecordingConfig: nodeRecording,
+				srv:                    &mockServer{},
+			},
+			errAssertion: require.Error,
+			recAssertion: require.Nil,
+		},
+		{
+			desc: "err-new-audit-writer-fails",
+			sess: &session{
+				id:  "test",
+				log: logger,
+				registry: &SessionRegistry{
+					srv: &mockServer{},
+				},
+			},
+			sctx: &ServerContext{
+				SessionRecordingConfig: nodeRecordingSync,
+				srv:                    &mockServer{},
+			},
+			errAssertion: require.Error,
+			recAssertion: require.Nil,
+		},
+		{
+			desc: "audit-writer",
+			sess: &session{
+				id:  "test",
+				log: logger,
+				registry: &SessionRegistry{
+					srv: &mockServer{},
+				},
+			},
+			sctx: &ServerContext{
+				ClusterName:            "test",
+				SessionRecordingConfig: nodeRecordingSync,
+				srv: &mockServer{
+					StreamEmitter: &events.DiscardEmitter{},
+				},
+			},
+			errAssertion: require.NoError,
+			recAssertion: func(t require.TestingT, i interface{}, i2 ...interface{}) {
+				require.NotNil(t, i)
+				aw, ok := i.(*events.AuditWriter)
+				require.True(t, ok)
+				require.NoError(t, aw.Close(context.Background()))
+			},
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.desc, func(t *testing.T) {
+			rec, err := newRecorder(tt.sess, tt.sctx)
+			tt.errAssertion(t, err)
+			tt.recAssertion(t, rec)
+		})
+	}
+}
diff --git a/lib/srv/termmanager.go b/lib/srv/termmanager.go
index e3d8796ee65bc..b9bf958ca3c33 100644
--- a/lib/srv/termmanager.go
+++ b/lib/srv/termmanager.go
@@ -31,12 +31,15 @@ const maxHistory = 1000
 // - history scrollback for new clients
 // - stream breaking
 type TermManager struct {
+	// These two fields need to be first in the struct so that they are 64-bit aligned which is a requirement
+	// for atomic operations on certain architectures.
+	countWritten uint64
+	countRead    uint64
+
 	mu           sync.Mutex
 	writers      map[string]io.Writer
-	readerState  map[string]*int32
+	readerState  map[string]bool
 	OnWriteError func(idString string, err error)
-	countWritten uint64
-	countRead    uint64
 	// buffer is used to buffer writes when turned off
 	buffer []byte
 	on     bool
@@ -46,23 +49,27 @@ type TermManager struct {
 	incoming chan []byte
 	// remaining is a partially read chunk of stdin data
 	// we only support one concurrent reader so this isn't mutex protected
-	remaining       []byte
-	readStateUpdate *sync.Cond
-	closed          *int32
+	remaining         []byte
+	readStateUpdate   *sync.Cond
+	closed            bool
+	lastWasBroadcast  bool
+	terminateNotifier chan struct{}
 }
 
 // NewTermManager creates a new TermManager.
 func NewTermManager() *TermManager {
 	return &TermManager{
-		writers:         make(map[string]io.Writer),
-		readerState:     make(map[string]*int32),
-		closed:          new(int32),
-		readStateUpdate: sync.NewCond(&sync.Mutex{}),
-		incoming:        make(chan []byte, 100),
+		writers:           make(map[string]io.Writer),
+		readerState:       make(map[string]bool),
+		closed:            false,
+		readStateUpdate:   sync.NewCond(&sync.Mutex{}),
+		incoming:          make(chan []byte, 100),
+		terminateNotifier: make(chan struct{}),
 	}
 }
 
 func (g *TermManager) writeToClients(p []byte) int {
+	g.lastWasBroadcast = false
 	truncateFront := func(slice []byte, max int) []byte {
 		if len(slice) > max {
 			return slice[len(slice)-max:]
@@ -95,6 +102,10 @@ func (g *TermManager) writeToClients(p []byte) int {
 	return len(p)
 }
 
+func (g *TermManager) TerminateNotifier() <-chan struct{} {
+	return g.terminateNotifier
+}
+
 func (g *TermManager) Write(p []byte) (int, error) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
@@ -163,9 +174,14 @@ func (g *TermManager) writeUnconditional(p []byte) (int, error) {
 
 // BroadcastMessage injects a message into the stream.
 func (g *TermManager) BroadcastMessage(message string) error {
-	data := []byte("\r\nTeleport > " + message + "\r\n")
 	g.mu.Lock()
 	defer g.mu.Unlock()
+	data := []byte("Teleport > " + message + "\r\n")
+	if g.lastWasBroadcast {
+		data = append([]byte("\r\n"), data...)
+	} else {
+		g.lastWasBroadcast = true
+	}
 	_, err := g.writeUnconditional(data)
 	return trace.Wrap(err)
 }
@@ -201,8 +217,7 @@ func (g *TermManager) DeleteWriter(name string) {
 }
 
 func (g *TermManager) AddReader(name string, r io.Reader) {
-	readerState := new(int32)
-	g.readerState[name] = readerState
+	g.readerState[name] = false
 
 	go func() {
 		for {
@@ -214,10 +229,28 @@ func (g *TermManager) AddReader(name string, r io.Reader) {
 				return
 			}
 
+			for _, b := range buf[:n] {
+				// This is the ASCII control code for CTRL+C.
+				if b == 0x03 {
+					g.mu.Lock()
+					if !g.on && !g.closed {
+						select {
+						case g.terminateNotifier <- struct{}{}:
+						default:
+						}
+					}
+					g.mu.Unlock()
+					break
+				}
+			}
+
 			g.incoming <- buf[:n]
-			if atomic.LoadInt32(g.closed) == 1 || atomic.LoadInt32(readerState) == 1 {
+			g.mu.Lock()
+			if g.closed || g.readerState[name] {
+				g.mu.Unlock()
 				return
 			}
+			g.mu.Unlock()
 		}
 	}()
 }
@@ -225,10 +258,7 @@ func (g *TermManager) AddReader(name string, r io.Reader) {
 func (g *TermManager) DeleteReader(name string) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
-
-	if g.readerState[name] != nil {
-		atomic.StoreInt32(g.readerState[name], 1)
-	}
+	g.readerState[name] = true
 }
 
 func (g *TermManager) CountWritten() uint64 {
@@ -240,7 +270,13 @@ func (g *TermManager) CountRead() uint64 {
 }
 
 func (g *TermManager) Close() {
-	atomic.StoreInt32(g.closed, 1)
+	g.mu.Lock()
+	defer g.mu.Unlock()
+
+	if !g.closed {
+		g.closed = true
+		close(g.terminateNotifier)
+	}
 }
 
 func (g *TermManager) GetRecentHistory() []byte {
diff --git a/lib/srv/termmanager_test.go b/lib/srv/termmanager_test.go
new file mode 100644
index 0000000000000..feb5667bab47c
--- /dev/null
+++ b/lib/srv/termmanager_test.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package srv
+
+import (
+	"io"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCTRLCPassthrough(t *testing.T) {
+	m := NewTermManager()
+	m.On()
+	r, w := io.Pipe()
+	m.AddReader("foo", r)
+	go w.Write([]byte("\x03"))
+	buf := make([]byte, 1)
+	_, err := m.Read(buf)
+	require.NoError(t, err)
+	require.Equal(t, []byte("\x03"), buf)
+}
+
+func TestCTRLCCapture(t *testing.T) {
+	m := NewTermManager()
+	r, w := io.Pipe()
+	m.AddReader("foo", r)
+	go w.Write([]byte("\x03"))
+
+	select {
+	case <-m.TerminateNotifier():
+	case <-time.After(time.Second * 10):
+		t.Fatal("terminateNotifier should've seen an event")
+	}
+}
diff --git a/lib/sshutils/scp/scp_test.go b/lib/sshutils/scp/scp_test.go
index 01f4a0f9daf45..19579e243643b 100644
--- a/lib/sshutils/scp/scp_test.go
+++ b/lib/sshutils/scp/scp_test.go
@@ -19,7 +19,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -65,7 +64,7 @@ func TestHTTPSendFile(t *testing.T) {
 	require.NoError(t, err)
 	err = runSCP(cmd, "-v", "-t", outDir)
 	require.NoError(t, err)
-	bytesReceived, err := ioutil.ReadFile(filepath.Join(outDir, "filename"))
+	bytesReceived, err := os.ReadFile(filepath.Join(outDir, "filename"))
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(string(bytesReceived), string(expectedBytes)))
 }
@@ -74,7 +73,7 @@ func TestHTTPReceiveFile(t *testing.T) {
 	source := filepath.Join(t.TempDir(), "target")
 
 	contents := []byte("hello, file contents!")
-	err := ioutil.WriteFile(source, contents, 0666)
+	err := os.WriteFile(source, contents, 0666)
 	require.NoError(t, err)
 
 	w := httptest.NewRecorder()
@@ -91,7 +90,7 @@ func TestHTTPReceiveFile(t *testing.T) {
 	err = runSCP(cmd, "-v", "-f", source)
 	require.NoError(t, err)
 
-	data, err := ioutil.ReadAll(w.Body)
+	data, err := io.ReadAll(w.Body)
 	contentLengthStr := strconv.Itoa(len(data))
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(string(data), string(contents)))
@@ -428,7 +427,7 @@ func TestInvalidDir(t *testing.T) {
 			doneC := make(chan struct{})
 			// Service stderr
 			go func() {
-				io.Copy(ioutil.Discard, stderr)
+				io.Copy(io.Discard, stderr)
 				close(doneC)
 			}()
 
@@ -452,7 +451,7 @@ func TestVerifyDirectoryModeFailsWithFile(t *testing.T) {
 	// Create temporary directory with a file "target" in it.
 	dir := t.TempDir()
 	target := filepath.Join(dir, "target")
-	err := ioutil.WriteFile(target, []byte{}, 0666)
+	err := os.WriteFile(target, []byte{}, 0666)
 	require.NoError(t, err)
 
 	cmd, err := CreateCommand(
@@ -478,7 +477,7 @@ func TestVerifyDirectoryModeIsRequiredForDirectory(t *testing.T) {
 	// Create temporary directory with a file "target" in it.
 	dir := t.TempDir()
 	target := filepath.Join(dir, "target")
-	err := ioutil.WriteFile(target, []byte{}, 0666)
+	err := os.WriteFile(target, []byte{}, 0666)
 	require.NoError(t, err)
 
 	cmd, err := CreateCommand(
@@ -666,7 +665,7 @@ func validateSCPContents(t *testing.T, expected *testFS, actual FileSystem) {
 		rc, err := actual.OpenFile(path)
 		require.NoError(t, err)
 		defer rc.Close()
-		bytes, err := ioutil.ReadAll(rc)
+		bytes, err := io.ReadAll(rc)
 		require.NoError(t, err)
 		require.Empty(t, cmp.Diff(fileinfo.contents.String(), string(bytes)))
 	}
diff --git a/lib/sshutils/x11/display.go b/lib/sshutils/x11/display.go
index 2fd6f66554bd2..6e0b2a152274c 100644
--- a/lib/sshutils/x11/display.go
+++ b/lib/sshutils/x11/display.go
@@ -118,12 +118,29 @@ func (d *Display) Listen() (XServerListener, error) {
 
 // xserverUnixSocket returns the display's associated unix socket.
 func (d *Display) unixSocket() (*net.UnixAddr, error) {
-	// For x11 unix domain sockets, the hostname must be "unix" or empty. In these cases
-	// we return the actual unix socket for the display "/tmp/.X11-unix/X<display_number>"
+	// If hostname is "unix" or empty, then the actual unix socket
+	// for the display is "/tmp/.X11-unix/X<display_number>"
 	if d.HostName == "unix" || d.HostName == "" {
 		sockName := filepath.Join(x11SockDir(), fmt.Sprintf("X%d", d.DisplayNumber))
 		return net.ResolveUnixAddr("unix", sockName)
 	}
+
+	// It's possible that the display is actually the full path
+	// to an open XServer socket, such as with xquartz on OSX:
+	// "/private/tmp/com.apple.com/launchd.xxx/org.xquartz.com:0"
+	if d.HostName[0] == '/' {
+		sockName := d.String()
+		if _, err := os.Stat(sockName); err == nil {
+			return net.ResolveUnixAddr("unix", sockName)
+		}
+
+		// The socket might not include the screen number.
+		sockName = fmt.Sprintf("%s:%d", d.HostName, d.DisplayNumber)
+		if _, err := os.Stat(sockName); err == nil {
+			return net.ResolveUnixAddr("unix", sockName)
+		}
+	}
+
 	return nil, trace.BadParameter("display is not a unix socket")
 }
 
@@ -131,7 +148,7 @@ func (d *Display) unixSocket() (*net.UnixAddr, error) {
 // e.g. "hostname:<6000+display_number>"
 func (d *Display) tcpSocket() (*net.TCPAddr, error) {
 	if d.HostName == "" {
-		return nil, trace.BadParameter("hostname can't be empty for an XServer tcp socket")
+		return nil, trace.BadParameter("display is not a tcp socket, hostname can't be empty")
 	}
 
 	port := fmt.Sprint(d.DisplayNumber + x11BasePort)
@@ -162,6 +179,7 @@ func GetXDisplay() (Display, error) {
 // display number, and screen number, or a parsing error. display must be
 //in one of the following formats - hostname:d[.s], unix:d[.s], :d[.s], ::d[.s].
 func ParseDisplay(displayString string) (Display, error) {
+
 	if displayString == "" {
 		return Display{}, trace.BadParameter("display cannot be an empty string")
 	}
diff --git a/lib/sshutils/x11/display_test.go b/lib/sshutils/x11/display_test.go
index d28edb551d64a..0d4bdc0b1d575 100644
--- a/lib/sshutils/x11/display_test.go
+++ b/lib/sshutils/x11/display_test.go
@@ -22,139 +22,89 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestParseDisplay(t *testing.T) {
+func TestDisplay(t *testing.T) {
 	t.Parallel()
 
 	testCases := []struct {
-		desc          string
-		displayString string
-		expectDisplay Display
-		assertErr     require.ErrorAssertionFunc
-		validSocket   string
+		desc             string
+		displayString    string
+		expectDisplay    Display
+		expectParseError bool
+		expectUnixAddr   string
+		expectTCPAddr    string
 	}{
 		{
-			desc:          "unix socket",
-			displayString: ":10",
-			expectDisplay: Display{DisplayNumber: 10},
-			assertErr:     require.NoError,
-			validSocket:   "unix",
-		}, {
-			desc:          "unix socket",
-			displayString: "::10",
-			expectDisplay: Display{DisplayNumber: 10},
-			assertErr:     require.NoError,
-			validSocket:   "unix",
-		}, {
-			desc:          "unix socket",
-			displayString: "unix:10",
-			expectDisplay: Display{HostName: "unix", DisplayNumber: 10},
-			assertErr:     require.NoError,
-			validSocket:   "unix",
-		}, {
-			desc:          "unix socket with screen number",
-			displayString: "unix:10.1",
-			expectDisplay: Display{HostName: "unix", DisplayNumber: 10, ScreenNumber: 1},
-			assertErr:     require.NoError,
-			validSocket:   "unix",
+			desc:           "unix socket",
+			displayString:  ":10",
+			expectDisplay:  Display{DisplayNumber: 10},
+			expectUnixAddr: filepath.Join(x11SockDir(), "X10"),
+		}, {
+			desc:           "unix socket",
+			displayString:  "::10",
+			expectDisplay:  Display{DisplayNumber: 10},
+			expectUnixAddr: filepath.Join(x11SockDir(), "X10"),
+		}, {
+			desc:           "unix socket",
+			displayString:  "unix:10",
+			expectDisplay:  Display{HostName: "unix", DisplayNumber: 10},
+			expectUnixAddr: filepath.Join(x11SockDir(), "X10"),
+		}, {
+			desc:           "unix socket with screen number",
+			displayString:  "unix:10.1",
+			expectDisplay:  Display{HostName: "unix", DisplayNumber: 10, ScreenNumber: 1},
+			expectUnixAddr: filepath.Join(x11SockDir(), "X10"),
 		}, {
 			desc:          "localhost",
 			displayString: "localhost:10",
 			expectDisplay: Display{HostName: "localhost", DisplayNumber: 10},
-			assertErr:     require.NoError,
-			validSocket:   "tcp",
-		}, {
-			desc:          "some hostname",
-			displayString: "example.com:10",
-			expectDisplay: Display{HostName: "example.com", DisplayNumber: 10},
-			assertErr:     require.NoError,
-			validSocket:   "tcp",
+			expectTCPAddr: "127.0.0.1:6010",
 		}, {
 			desc:          "some ip address",
 			displayString: "1.2.3.4:10",
 			expectDisplay: Display{HostName: "1.2.3.4", DisplayNumber: 10},
-			assertErr:     require.NoError,
-			validSocket:   "tcp",
+			expectTCPAddr: "1.2.3.4:6010",
+		}, {
+			desc:          "invalid ip address",
+			displayString: "1.2.3.4.5:10",
+			expectDisplay: Display{HostName: "1.2.3.4.5", DisplayNumber: 10},
+		}, {
+			desc:             "empty",
+			displayString:    "",
+			expectParseError: true,
 		}, {
-			desc:          "empty",
-			displayString: "",
-			expectDisplay: Display{},
-			assertErr:     require.Error,
+			desc:             "no display number",
+			displayString:    ":",
+			expectParseError: true,
 		}, {
-			desc:          "no display number",
-			displayString: ":",
-			expectDisplay: Display{},
-			assertErr:     require.Error,
+			desc:             "negative display number",
+			displayString:    ":-10",
+			expectParseError: true,
 		}, {
-			desc:          "negative display number",
-			displayString: ":-10",
-			expectDisplay: Display{},
-			assertErr:     require.Error,
+			desc:             "negative screen number",
+			displayString:    ":10.-1",
+			expectParseError: true,
 		}, {
-			desc:          "negative screen number",
-			displayString: ":10.-1",
-			expectDisplay: Display{},
-			assertErr:     require.Error,
+			desc:             "invalid characters",
+			displayString:    "$(exec ls)",
+			expectParseError: true,
 		}, {
-			desc:          "invalid characters",
-			displayString: "$(exec ls)",
-			expectDisplay: Display{},
-			assertErr:     require.Error,
+			desc:             "invalid unix socket",
+			displayString:    "/some/socket/without/display",
+			expectParseError: true,
 		},
 	}
 
 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
 			display, err := ParseDisplay(tc.displayString)
-			tc.assertErr(t, err)
-			require.Equal(t, tc.expectDisplay, display)
-
-			switch tc.validSocket {
-			case "unix":
-				_, err := display.unixSocket()
-				require.NoError(t, err)
-			case "tcp":
-				_, err := display.tcpSocket()
-				require.NoError(t, err)
+			if tc.expectParseError == true {
+				require.Error(t, err)
+				return
 			}
-		})
-	}
-}
-
-func TestDisplaySocket(t *testing.T) {
-	testCases := []struct {
-		desc           string
-		display        Display
-		expectUnixAddr string
-		expectTCPAddr  string
-	}{
-		{
-			desc:           "unix socket no hostname",
-			display:        Display{DisplayNumber: 10},
-			expectUnixAddr: filepath.Join(os.TempDir(), ".X11-unix", "X10"),
-		}, {
-			desc:           "unix socket with hostname",
-			display:        Display{HostName: "unix", DisplayNumber: 10},
-			expectUnixAddr: filepath.Join(os.TempDir(), ".X11-unix", "X10"),
-		}, {
-			desc:          "localhost",
-			display:       Display{HostName: "localhost", DisplayNumber: 10},
-			expectTCPAddr: "127.0.0.1:6010",
-		}, {
-			desc:          "some ip address",
-			display:       Display{HostName: "1.2.3.4", DisplayNumber: 10},
-			expectTCPAddr: "1.2.3.4:6010",
-		}, {
-			desc:    "invalid ip address",
-			display: Display{HostName: "1.2.3.4.5", DisplayNumber: 10},
-		}, {
-			desc:    "invalid unix socket",
-			display: Display{HostName: filepath.Join(os.TempDir(), "socket"), DisplayNumber: 10},
-		},
-	}
+			require.NoError(t, err)
+			require.Equal(t, tc.expectDisplay, display)
 
-	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			unixSock, err := tc.display.unixSocket()
+			unixSock, err := display.unixSocket()
 			if tc.expectUnixAddr == "" {
 				require.Error(t, err)
 			} else {
@@ -162,7 +112,7 @@ func TestDisplaySocket(t *testing.T) {
 				require.Equal(t, tc.expectUnixAddr, unixSock.String())
 			}
 
-			tcpSock, err := tc.display.tcpSocket()
+			tcpSock, err := display.tcpSocket()
 			if tc.expectTCPAddr == "" {
 				require.Error(t, err)
 			} else {
@@ -171,4 +121,25 @@ func TestDisplaySocket(t *testing.T) {
 			}
 		})
 	}
+
+	// The unix socket full path test requires its associated
+	// unix addr to be discoverable in the file system
+	t.Run("unix socket full path", func(t *testing.T) {
+		tmpDir := os.TempDir()
+		unixSocket := filepath.Join(tmpDir, "org.xquartz.com:0")
+		hostName := filepath.Join(tmpDir, "org.xquartz.com")
+		_, err := os.Create(unixSocket)
+		require.NoError(t, err)
+
+		display, err := ParseDisplay(unixSocket)
+		require.NoError(t, err)
+		require.Equal(t, Display{HostName: hostName, DisplayNumber: 0}, display)
+
+		unixSock, err := display.unixSocket()
+		require.NoError(t, err)
+		require.Equal(t, unixSocket, unixSock.String())
+
+		_, err = display.tcpSocket()
+		require.Error(t, err)
+	})
 }
diff --git a/lib/tlsca/ca.go b/lib/tlsca/ca.go
index 4d5b215f7870c..ee56515458f50 100644
--- a/lib/tlsca/ca.go
+++ b/lib/tlsca/ca.go
@@ -29,14 +29,15 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/sirupsen/logrus"
+
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
-
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/sirupsen/logrus"
+	"github.com/gravitational/teleport/api/utils"
 )
 
 var log = logrus.WithFields(logrus.Fields{
@@ -772,6 +773,9 @@ func (c *CertificateRequest) CheckAndSetDefaults() error {
 	if c.KeyUsage == 0 {
 		c.KeyUsage = x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature
 	}
+
+	c.DNSNames = utils.Deduplicate(c.DNSNames)
+
 	return nil
 }
 
diff --git a/lib/utils/certs_test.go b/lib/utils/certs_test.go
index 4ddaa0f180651..c8dfa7d0637c7 100644
--- a/lib/utils/certs_test.go
+++ b/lib/utils/certs_test.go
@@ -17,7 +17,7 @@ limitations under the License.
 package utils
 
 import (
-	"io/ioutil"
+	"os"
 
 	"github.com/gravitational/trace"
 
@@ -34,7 +34,7 @@ func (s *CertsSuite) TestRejectsInvalidPEMData(c *check.C) {
 }
 
 func (s *CertsSuite) TestRejectsSelfSignedCertificate(c *check.C) {
-	certificateChainBytes, err := ioutil.ReadFile("../../fixtures/certs/ca.pem")
+	certificateChainBytes, err := os.ReadFile("../../fixtures/certs/ca.pem")
 	c.Assert(err, check.IsNil)
 
 	certificateChain, err := ReadCertificateChain(certificateChainBytes)
diff --git a/lib/utils/chconn_test.go b/lib/utils/chconn_test.go
index 180fdd52299b4..6088aeee641ab 100644
--- a/lib/utils/chconn_test.go
+++ b/lib/utils/chconn_test.go
@@ -19,7 +19,7 @@ package utils
 import (
 	"crypto/rand"
 	"crypto/rsa"
-	"io/ioutil"
+	"io"
 	"net"
 	"os"
 	"testing"
@@ -60,7 +60,7 @@ func TestChConn(t *testing.T) {
 		go func() {
 			// Nothing is sent on the channel so this will block until the
 			// read is canceled by the deadline set below.
-			_, err := ioutil.ReadAll(chConn)
+			_, err := io.ReadAll(chConn)
 			doneCh <- err
 		}()
 		// Set the read deadline in the past and make sure that the read
diff --git a/lib/utils/cli.go b/lib/utils/cli.go
index 79362ed1e62eb..1b2e685cb7ae8 100644
--- a/lib/utils/cli.go
+++ b/lib/utils/cli.go
@@ -22,7 +22,6 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"io/ioutil"
 	stdlog "log"
 	"math"
 	"os"
@@ -61,7 +60,7 @@ func InitLogger(purpose LoggingPurpose, level log.Level, verbose ...bool) {
 			log.SetFormatter(NewDefaultTextFormatter(trace.IsTerminal(os.Stderr)))
 			log.SetOutput(os.Stderr)
 		} else {
-			log.SetOutput(ioutil.Discard)
+			log.SetOutput(io.Discard)
 		}
 	case LoggingForDaemon:
 		log.SetFormatter(NewDefaultTextFormatter(trace.IsTerminal(os.Stderr)))
@@ -83,7 +82,7 @@ func InitLoggerForTests() {
 		return
 	}
 	logger.SetLevel(log.WarnLevel)
-	logger.SetOutput(ioutil.Discard)
+	logger.SetOutput(io.Discard)
 }
 
 // NewLoggerForTests creates a new logger for test environment
@@ -251,6 +250,8 @@ func formatCertError(err error) string {
 }
 
 const (
+	// Bold is an escape code to format as bold or increased intensity
+	Bold = 1
 	// Red is an escape code for red terminal color
 	Red = 31
 	// Yellow is an escape code for yellow terminal color
@@ -291,7 +292,55 @@ func InitCLIParser(appName, appHelp string) (app *kingpin.Application) {
 	app.HelpFlag.NoEnvar()
 
 	// set our own help template
-	return app.UsageTemplate(defaultUsageTemplate)
+	return app.UsageTemplate(createUsageTemplate())
+}
+
+// createUsageTemplate creates an usage template for kingpin applications.
+func createUsageTemplate(opts ...func(*usageTemplateOptions)) string {
+	opt := &usageTemplateOptions{
+		commandPrintfWidth: defaultCommandPrintfWidth,
+	}
+
+	for _, optFunc := range opts {
+		optFunc(opt)
+	}
+	return fmt.Sprintf(defaultUsageTemplate, opt.commandPrintfWidth)
+}
+
+// UpdateAppUsageTemplate updates usage template for kingpin applications by
+// pre-parsing the arguments then applying any changes to the usage template if
+// necessary.
+func UpdateAppUsageTemplate(app *kingpin.Application, args []string) {
+	// If ParseContext fails, kingpin will not show usage so there is no need
+	// to update anything here. See app.Parse for more details.
+	context, err := app.ParseContext(args)
+	if err != nil {
+		return
+	}
+
+	app.UsageTemplate(createUsageTemplate(
+		withCommandPrintfWidth(app, context),
+	))
+}
+
+// withCommandPrintfWidth returns an usage template option that
+// updates command printf width if longer than default.
+func withCommandPrintfWidth(app *kingpin.Application, context *kingpin.ParseContext) func(*usageTemplateOptions) {
+	return func(opt *usageTemplateOptions) {
+		var commands []*kingpin.CmdModel
+		if context.SelectedCommand != nil {
+			commands = context.SelectedCommand.Model().FlattenedCommands()
+		} else {
+			commands = app.Model().FlattenedCommands()
+		}
+
+		for _, command := range commands {
+			if !command.Hidden && len(command.FullCommand) > opt.commandPrintfWidth {
+				opt.commandPrintfWidth = len(command.FullCommand)
+			}
+		}
+
+	}
 }
 
 // SplitIdentifiers splits list of identifiers by commas/spaces/newlines.  Helpful when
@@ -379,8 +428,19 @@ func needsQuoting(text string) bool {
 	return false
 }
 
-// Usage template with compactly formatted commands.
-var defaultUsageTemplate = `{{define "FormatCommand"}}\
+// usageTemplateOptions defines options to format the usage template.
+type usageTemplateOptions struct {
+	// commandPrintfWidth is the width of the command name with padding, for
+	//   {{.FullCommand | printf "%%-%ds"}}
+	commandPrintfWidth int
+}
+
+// defaultCommandPrintfWidth is the default command printf width.
+const defaultCommandPrintfWidth = 12
+
+// defaultUsageTemplate is a fmt format that defines the usage template with
+// compactly formatted commands. Should be only used in createUsageTemplate.
+const defaultUsageTemplate = `{{define "FormatCommand"}}\
 {{if .FlagSummary}} {{.FlagSummary}}{{end}}\
 {{range .Args}} {{if not .Required}}[{{end}}<{{.Name}}>{{if .Value|IsCumulative}}...{{end}}{{if not .Required}}]{{end}}{{end}}\
 {{end}}\
@@ -388,7 +448,7 @@ var defaultUsageTemplate = `{{define "FormatCommand"}}\
 {{define "FormatCommands"}}\
 {{range .FlattenedCommands}}\
 {{if not .Hidden}}\
-  {{.FullCommand | printf "%-12s" }}{{if .Default}} (Default){{end}} {{ .Help }}
+  {{.FullCommand | printf "%%-%ds"}}{{if .Default}} (Default){{end}} {{ .Help }}
 {{end}}\
 {{end}}\
 {{end}}\
diff --git a/lib/utils/cli_test.go b/lib/utils/cli_test.go
index 0be2fb4c0edcc..9985aa60be042 100644
--- a/lib/utils/cli_test.go
+++ b/lib/utils/cli_test.go
@@ -19,7 +19,7 @@ package utils
 import (
 	"crypto/x509"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"strings"
 	"testing"
 
@@ -64,7 +64,7 @@ func TestUserMessageFromError(t *testing.T) {
 func TestConsolefLongComponent(t *testing.T) {
 	require.NotPanics(t, func() {
 		component := strings.Repeat("na ", 10) + "batman!"
-		Consolef(ioutil.Discard, logrus.New(), component, "test message")
+		Consolef(io.Discard, logrus.New(), component, "test message")
 	})
 }
 
diff --git a/lib/utils/conn.go b/lib/utils/conn.go
index c43aac61d44c4..07a47b759eff7 100644
--- a/lib/utils/conn.go
+++ b/lib/utils/conn.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"sync/atomic"
@@ -100,7 +99,7 @@ func RoundtripWithConn(conn net.Conn) (string, error) {
 		return "", err
 	}
 	defer re.Body.Close()
-	out, err := ioutil.ReadAll(re.Body)
+	out, err := io.ReadAll(re.Body)
 	if err != nil {
 		return "", err
 	}
diff --git a/lib/utils/environment_test.go b/lib/utils/environment_test.go
index e7d7409dd3a0a..5b5e335a48dde 100644
--- a/lib/utils/environment_test.go
+++ b/lib/utils/environment_test.go
@@ -16,7 +16,6 @@ limitations under the License.
 package utils
 
 import (
-	"io/ioutil"
 	"os"
 
 	"gopkg.in/check.v1"
@@ -40,7 +39,7 @@ foo=
 `)
 
 	// create a temp file with an environment in it
-	f, err := ioutil.TempFile("", "teleport-environment-")
+	f, err := os.CreateTemp("", "teleport-environment-")
 	c.Assert(err, check.IsNil)
 	defer os.Remove(f.Name())
 	_, err = f.Write(rawenv)
diff --git a/lib/utils/jsontools_test.go b/lib/utils/jsontools_test.go
index c4389e51f1011..8b55ffe814c31 100644
--- a/lib/utils/jsontools_test.go
+++ b/lib/utils/jsontools_test.go
@@ -19,6 +19,7 @@ import (
 	"bytes"
 	"testing"
 
+	"github.com/gravitational/teleport/api/types"
 	"github.com/stretchr/testify/require"
 )
 
@@ -28,8 +29,8 @@ import (
 // operations that depend on the byte ordering fail (e.g. CompareAndSwap).
 func TestMarshalMapConsistency(t *testing.T) {
 	value := map[string]string{
-		"teleport.dev/foo": "1234",
-		"teleport.dev/bar": "5678",
+		types.TeleportNamespace + "/foo": "1234",
+		types.TeleportNamespace + "/bar": "5678",
 	}
 
 	compareTo, err := FastMarshal(value)
diff --git a/lib/utils/kernel.go b/lib/utils/kernel.go
index f687301cb752f..9f4d88103cfd1 100644
--- a/lib/utils/kernel.go
+++ b/lib/utils/kernel.go
@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"runtime"
 	"strings"
@@ -55,7 +54,7 @@ func KernelVersion() (*semver.Version, error) {
 // kernelVersion reads in the kernel version from the reader and returns
 // a *semver.Version.
 func kernelVersion(reader io.Reader) (*semver.Version, error) {
-	buf, err := ioutil.ReadAll(reader)
+	buf, err := io.ReadAll(reader)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/utils/prompt/confirmation.go b/lib/utils/prompt/confirmation.go
index 1710f67ccb308..82ff796a812f1 100644
--- a/lib/utils/prompt/confirmation.go
+++ b/lib/utils/prompt/confirmation.go
@@ -26,13 +26,20 @@ import (
 	"github.com/gravitational/trace"
 )
 
+// Reader is the interface for prompt readers.
+type Reader interface {
+	// ReadContext reads from the underlying buffer, respecting context
+	// cancellation.
+	ReadContext(ctx context.Context) ([]byte, error)
+}
+
 // Confirmation prompts the user for a yes/no confirmation for question.
 // The prompt is written to out and the answer is read from in.
 //
 // question should be a plain sentece without "[yes/no]"-type hints at the end.
 //
 // ctx can be canceled to abort the prompt.
-func Confirmation(ctx context.Context, out io.Writer, in *ContextReader, question string) (bool, error) {
+func Confirmation(ctx context.Context, out io.Writer, in Reader, question string) (bool, error) {
 	fmt.Fprintf(out, "%s [y/N]: ", question)
 	answer, err := in.ReadContext(ctx)
 	if err != nil {
@@ -52,7 +59,7 @@ func Confirmation(ctx context.Context, out io.Writer, in *ContextReader, questio
 // question should be a plain sentece without the list of provided options.
 //
 // ctx can be canceled to abort the prompt.
-func PickOne(ctx context.Context, out io.Writer, in *ContextReader, question string, options []string) (string, error) {
+func PickOne(ctx context.Context, out io.Writer, in Reader, question string, options []string) (string, error) {
 	fmt.Fprintf(out, "%s [%s]: ", question, strings.Join(options, ", "))
 	answerOrig, err := in.ReadContext(ctx)
 	if err != nil {
@@ -72,7 +79,7 @@ func PickOne(ctx context.Context, out io.Writer, in *ContextReader, question str
 // The prompt is written to out and the answer is read from in.
 //
 // ctx can be canceled to abort the prompt.
-func Input(ctx context.Context, out io.Writer, in *ContextReader, question string) (string, error) {
+func Input(ctx context.Context, out io.Writer, in Reader, question string) (string, error) {
 	fmt.Fprintf(out, "%s: ", question)
 	answer, err := in.ReadContext(ctx)
 	if err != nil {
diff --git a/lib/utils/prompt/sync_reader.go b/lib/utils/prompt/sync_reader.go
new file mode 100644
index 0000000000000..a175ec2cc4908
--- /dev/null
+++ b/lib/utils/prompt/sync_reader.go
@@ -0,0 +1,55 @@
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package prompt
+
+import (
+	"context"
+	"io"
+	"os"
+
+	"github.com/gravitational/trace"
+)
+
+// StdinSync returns a synchronous reader to os.Stdin.
+// It is safe for use mixed with other methods that read Stdin, albeit not
+// concurrently, but doesn't respect context cancelletion.
+func StdinSync() *SyncReader {
+	return &SyncReader{Reader: os.Stdin}
+}
+
+// SyncReader is a synchronous version of ContextReader.
+// Its main advantage is that it allows multiple sources to read from the same
+// underlying reader, albeit not concurrently.
+type SyncReader struct {
+	Reader io.Reader
+}
+
+// ReadContext reads a chunk from the underlying reader.
+// It does not respect context cancellation after the read starts.
+func (c *SyncReader) ReadContext(ctx context.Context) ([]byte, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	buf := make([]byte, 4*1024) // 4kB, matches Linux page size.
+	n, err := c.Reader.Read(buf)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	buf = buf[:n]
+	return buf, nil
+}
diff --git a/lib/utils/prompt/sync_reader_test.go b/lib/utils/prompt/sync_reader_test.go
new file mode 100644
index 0000000000000..1038e8011141e
--- /dev/null
+++ b/lib/utils/prompt/sync_reader_test.go
@@ -0,0 +1,66 @@
+// Copyright 2022 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package prompt_test
+
+import (
+	"bytes"
+	"context"
+	"testing"
+
+	"github.com/gravitational/teleport/lib/utils/prompt"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSyncReader_ReadContext(t *testing.T) {
+	ctx := context.Background()
+	data := []byte("who let the llamas out?")
+
+	cancelledCtx, cancel := context.WithCancel(ctx)
+	cancel()
+
+	tests := []struct {
+		name     string
+		data     []byte
+		ctx      context.Context
+		wantData []byte
+		wantErr  error
+	}{
+		{
+			name:     "ok",
+			data:     data,
+			ctx:      ctx,
+			wantData: data,
+		},
+		{
+			name:    "ctx cancelled",
+			data:    data,
+			ctx:     cancelledCtx,
+			wantErr: cancelledCtx.Err(),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			r := &prompt.SyncReader{
+				Reader: bytes.NewReader(test.data),
+			}
+			got, err := r.ReadContext(test.ctx)
+			require.Equal(t, test.wantErr, err, "ReadContext error mismatch")
+			if err != nil {
+				return
+			}
+			require.Equal(t, test.wantData, got, "ReadContext data mismatch")
+		})
+	}
+}
diff --git a/lib/utils/syslog.go b/lib/utils/syslog.go
index 9037d432821ab..37630dd6b5ea5 100644
--- a/lib/utils/syslog.go
+++ b/lib/utils/syslog.go
@@ -20,7 +20,7 @@ limitations under the License.
 package utils
 
 import (
-	"io/ioutil"
+	"io"
 	"log/syslog"
 	"os"
 
@@ -46,6 +46,6 @@ func SwitchLoggerToSyslog(logger *log.Logger) error {
 	}
 	logger.AddHook(hook)
 	// ... and disable stderr:
-	logger.SetOutput(ioutil.Discard)
+	logger.SetOutput(io.Discard)
 	return nil
 }
diff --git a/lib/utils/timeout_test.go b/lib/utils/timeout_test.go
index fe113899409dd..7bd9cac3e3e40 100644
--- a/lib/utils/timeout_test.go
+++ b/lib/utils/timeout_test.go
@@ -20,7 +20,7 @@ package utils
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -95,7 +95,7 @@ func newClient(timeout time.Duration) *http.Client {
 
 // bodyText helper returns a body string from an http response
 func bodyText(resp *http.Response) string {
-	bytes, err := ioutil.ReadAll(resp.Body)
+	bytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return ""
 	}
diff --git a/lib/utils/token.go b/lib/utils/token.go
index a2b8ba14012b9..b417f9d23e52e 100644
--- a/lib/utils/token.go
+++ b/lib/utils/token.go
@@ -17,7 +17,7 @@ limitations under the License.
 package utils
 
 import (
-	"io/ioutil"
+	"os"
 	"strings"
 
 	"github.com/gravitational/trace"
@@ -31,7 +31,7 @@ func ReadToken(token string) (string, error) {
 		return token, nil
 	}
 	// treat it as a file
-	out, err := ioutil.ReadFile(token)
+	out, err := os.ReadFile(token)
 	if err != nil {
 		return "", trace.ConvertSystemError(err)
 	}
diff --git a/lib/utils/utils.go b/lib/utils/utils.go
index ee32b0bbc125c..96893ee62935e 100644
--- a/lib/utils/utils.go
+++ b/lib/utils/utils.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -323,7 +322,7 @@ func ReadPath(path string) ([]byte, error) {
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
-	bytes, err := ioutil.ReadFile(abs)
+	bytes, err := os.ReadFile(abs)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
@@ -437,7 +436,7 @@ func ReadHostUUID(dataDir string) (string, error) {
 
 // WriteHostUUID writes host UUID into a file
 func WriteHostUUID(dataDir string, id string) error {
-	err := ioutil.WriteFile(filepath.Join(dataDir, HostUUIDFile), []byte(id), os.ModeExclusive|0400)
+	err := os.WriteFile(filepath.Join(dataDir, HostUUIDFile), []byte(id), os.ModeExclusive|0400)
 	if err != nil {
 		return trace.ConvertSystemError(err)
 	}
@@ -561,7 +560,7 @@ func StoreErrorOf(f func() error, err *error) {
 // when limit bytes are read.
 func ReadAtMost(r io.Reader, limit int64) ([]byte, error) {
 	limitedReader := &io.LimitedReader{R: r, N: limit}
-	data, err := ioutil.ReadAll(limitedReader)
+	data, err := io.ReadAll(limitedReader)
 	if err != nil {
 		return data, err
 	}
diff --git a/lib/utils/utils_test.go b/lib/utils/utils_test.go
index a27933b315e26..fc2faf7f8c2a6 100644
--- a/lib/utils/utils_test.go
+++ b/lib/utils/utils_test.go
@@ -18,7 +18,7 @@ package utils
 
 import (
 	"bytes"
-	"io/ioutil"
+	"io"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -104,7 +104,7 @@ func (s *UtilsSuite) TestHostUUID(c *check.C) {
 	// newlines are getting ignored
 	dir = c.MkDir()
 	id := "id-with-newline\n"
-	err = ioutil.WriteFile(filepath.Join(dir, HostUUIDFile), []byte(id), 0666)
+	err = os.WriteFile(filepath.Join(dir, HostUUIDFile), []byte(id), 0666)
 	c.Assert(err, check.IsNil)
 	out, err := ReadHostUUID(dir)
 	c.Assert(err, check.IsNil)
@@ -502,7 +502,7 @@ func (s *UtilsSuite) TestReadToken(c *check.C) {
 
 	dir := c.MkDir()
 	tokenPath := filepath.Join(dir, "token")
-	err = ioutil.WriteFile(tokenPath, []byte("shmoken"), 0644)
+	err = os.WriteFile(tokenPath, []byte("shmoken"), 0644)
 	c.Assert(err, check.IsNil)
 
 	tok, err = ReadToken(tokenPath)
@@ -542,7 +542,7 @@ func (s *UtilsSuite) TestRepeatReader(c *check.C) {
 		},
 	}
 	for _, tc := range tcs {
-		data, err := ioutil.ReadAll(NewRepeatReader(tc.repeat, tc.count))
+		data, err := io.ReadAll(NewRepeatReader(tc.repeat, tc.count))
 		c.Assert(err, check.IsNil)
 		c.Assert(string(data), check.Equals, tc.expected)
 	}
diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
index 7652d11ca481d..ff8cad79f1225 100644
--- a/lib/web/apiserver.go
+++ b/lib/web/apiserver.go
@@ -26,7 +26,6 @@ import (
 	"fmt"
 	"html/template"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -35,6 +34,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/gravitational/oxy/ratelimit"
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/client/webclient"
@@ -51,6 +51,7 @@ import (
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/httplib/csrf"
 	"github.com/gravitational/teleport/lib/jwt"
+	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/plugin"
 	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/secret"
@@ -260,6 +261,23 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 	}
 	h.sshPort = sshPort
 
+	// challengeLimiter is used to limit unauthenticated challenge generation for
+	// passwordless.
+	challengeLimiter, err := limiter.NewRateLimiter(limiter.Config{
+		Rates: []limiter.Rate{
+			{
+				Period:  defaults.LimiterPasswordlessPeriod,
+				Average: defaults.LimiterPasswordlessAverage,
+				Burst:   defaults.LimiterPasswordlessBurst,
+			},
+		},
+		MaxConnections:   defaults.LimiterMaxConnections,
+		MaxNumberOfUsers: defaults.LimiterMaxConcurrentUsers,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	// ping endpoint is used to check if the server is up. the /webapi/ping
 	// endpoint returns the default authentication method and configuration that
 	// the server supports. the /webapi/ping/:connector endpoint can be used to
@@ -332,8 +350,13 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 	h.GET("/webapi/sites/:site/nodes/:server/:login/scp", h.WithClusterAuth(h.transferFile))
 	h.POST("/webapi/sites/:site/nodes/:server/:login/scp", h.WithClusterAuth(h.transferFile))
 
+	// token generation
+	h.POST("/webapi/token", h.WithAuth(h.createTokenHandle))
+
 	// add Node token generation
-	h.POST("/webapi/nodes/token", h.WithAuth(h.createScriptJoinTokenHandle))
+	// DELETE IN 11.0. Deprecated, use /webapi/token for generating tokens of any role.
+	h.POST("/webapi/nodes/token", h.WithAuth(h.createNodeTokenHandle))
+	// join scripts
 	h.GET("/scripts/:token/install-node.sh", httplib.MakeHandler(h.getNodeJoinScriptHandle))
 	h.GET("/scripts/:token/install-app.sh", httplib.MakeHandler(h.getAppJoinScriptHandle))
 	// web context
@@ -361,7 +384,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 	h.POST("/webapi/github/login/console", httplib.MakeHandler(h.githubLoginConsole))
 
 	// MFA public endpoints.
-	h.POST("/webapi/mfa/login/begin", httplib.MakeHandler(h.mfaLoginBegin))
+	h.POST("/webapi/mfa/login/begin", h.withLimiter(challengeLimiter, h.mfaLoginBegin))
 	h.POST("/webapi/mfa/login/finish", httplib.MakeHandler(h.mfaLoginFinish))
 	h.POST("/webapi/mfa/login/finishsession", httplib.MakeHandler(h.mfaLoginFinishSession))
 	h.DELETE("/webapi/mfa/token/:token/devices/:devicename", httplib.MakeHandler(h.deleteMFADeviceWithTokenHandle))
@@ -419,7 +442,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 			return nil, trace.Wrap(err)
 		}
 		defer index.Close()
-		indexContent, err := ioutil.ReadAll(index)
+		indexContent, err := io.ReadAll(index)
 		if err != nil {
 			return nil, trace.ConvertSystemError(err)
 		}
@@ -739,7 +762,6 @@ func defaultAuthenticationSettings(ctx context.Context, authClient auth.ClientI)
 
 func (h *Handler) ping(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
 	var err error
-
 	defaultSettings, err := defaultAuthenticationSettings(r.Context(), h.cfg.ProxyClient)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -788,12 +810,13 @@ func (h *Handler) pingWithConnector(w http.ResponseWriter, r *http.Request, p ht
 		ServerVersion: teleport.Version,
 	}
 
+	hasMessageOfTheDay := cap.GetMessageOfTheDay() != ""
 	if connectorName == constants.Local {
-		as, err := localSettings(cap)
+		response.Auth, err = localSettings(cap)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		response.Auth = as
+		response.Auth.HasMessageOfTheDay = hasMessageOfTheDay
 		return response, nil
 	}
 
@@ -801,6 +824,7 @@ func (h *Handler) pingWithConnector(w http.ResponseWriter, r *http.Request, p ht
 	oidcConnector, err := authClient.GetOIDCConnector(r.Context(), connectorName, false)
 	if err == nil {
 		response.Auth = oidcSettings(oidcConnector, cap)
+		response.Auth.HasMessageOfTheDay = hasMessageOfTheDay
 		return response, nil
 	}
 
@@ -808,6 +832,7 @@ func (h *Handler) pingWithConnector(w http.ResponseWriter, r *http.Request, p ht
 	samlConnector, err := authClient.GetSAMLConnector(r.Context(), connectorName, false)
 	if err == nil {
 		response.Auth = samlSettings(samlConnector, cap)
+		response.Auth.HasMessageOfTheDay = hasMessageOfTheDay
 		return response, nil
 	}
 
@@ -815,6 +840,7 @@ func (h *Handler) pingWithConnector(w http.ResponseWriter, r *http.Request, p ht
 	githubConnector, err := authClient.GetGithubConnector(r.Context(), connectorName, false)
 	if err == nil {
 		response.Auth = githubSettings(githubConnector, cap)
+		response.Auth.HasMessageOfTheDay = hasMessageOfTheDay
 		return response, nil
 	}
 
@@ -946,7 +972,7 @@ func (h *Handler) jwks(w http.ResponseWriter, r *http.Request, p httprouter.Para
 	}
 
 	// Fetch the JWT public keys only.
-	ca, err := h.cfg.ProxyClient.GetCertAuthority(types.CertAuthID{
+	ca, err := h.cfg.ProxyClient.GetCertAuthority(r.Context(), types.CertAuthID{
 		Type:       types.JWTSigner,
 		DomainName: clusterName,
 	}, false)
@@ -1633,27 +1659,39 @@ func (h *Handler) getResetPasswordToken(ctx context.Context, tokenID string) (in
 }
 
 // mfaLoginBegin is the first step in the MFA authentication ceremony, which
-// may be completed either via mfaLoginFinish (SSH) or mfaLoginFinishSession (Web).
+// may be completed either via mfaLoginFinish (SSH) or mfaLoginFinishSession
+// (Web).
 //
 // POST /webapi/mfa/login/begin
 //
 // {"user": "alex", "pass": "abc123"}
+// {"passwordless": true}
 //
 // Successful response:
 //
 // {"webauthn_challenge": {...}, "totp_challenge": true}
+// {"webauthn_challenge": {...}} // passwordless
 func (h *Handler) mfaLoginBegin(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
 	var req *client.MFAChallengeRequest
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	mfaChallenge, err := h.auth.proxyClient.CreateAuthenticateChallenge(r.Context(), &proto.CreateAuthenticateChallengeRequest{
-		Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{UserCredentials: &proto.UserCredentials{
-			Username: req.User,
-			Password: []byte(req.Pass),
-		}},
-	})
+	mfaReq := &proto.CreateAuthenticateChallengeRequest{}
+	if req.Passwordless {
+		mfaReq.Request = &proto.CreateAuthenticateChallengeRequest_Passwordless{
+			Passwordless: &proto.Passwordless{},
+		}
+	} else {
+		mfaReq.Request = &proto.CreateAuthenticateChallengeRequest_UserCredentials{
+			UserCredentials: &proto.UserCredentials{
+				Username: req.User,
+				Password: []byte(req.Pass),
+			},
+		}
+	}
+
+	mfaChallenge, err := h.auth.proxyClient.CreateAuthenticateChallenge(r.Context(), mfaReq)
 	if err != nil {
 		return nil, trace.AccessDenied("bad auth credentials")
 	}
@@ -1704,10 +1742,14 @@ func (h *Handler) mfaLoginFinishSession(w http.ResponseWriter, r *http.Request,
 	if err != nil {
 		return nil, trace.AccessDenied("bad auth credentials")
 	}
-	if err := SetSessionCookie(w, req.User, session.GetName()); err != nil {
+
+	// Fetch user from session, user is empty for passwordless requests.
+	user := session.GetUser()
+	if err := SetSessionCookie(w, user, session.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ctx, err := h.auth.newSessionContext(req.User, session.GetName())
+
+	ctx, err := h.auth.newSessionContext(user, session.GetName())
 	if err != nil {
 		return nil, trace.AccessDenied("need auth")
 	}
@@ -2304,10 +2346,7 @@ func (h *Handler) hostCredentials(w http.ResponseWriter, r *http.Request, p http
 		return nil, trace.Wrap(err)
 	}
 
-	// Teleport 8 clients are still expecting the legacy JSON format.
-	// Teleport 9 clients handle both legacy and new.
-	// TODO(zmb3) return certs directly in Teleport 10
-	return auth.LegacyCertsFromProto(certs), nil
+	return certs, nil
 }
 
 // createSSHCert is a web call that generates new SSH certificate based
@@ -2499,6 +2538,21 @@ func (h *Handler) WithAuth(fn ContextHandler) httprouter.Handle {
 	})
 }
 
+// withLimiter adds IP-based rate limiting to fn.
+func (h *Handler) withLimiter(l *limiter.RateLimiter, fn httplib.HandlerFunc) httprouter.Handle {
+	return httplib.MakeHandler(func(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
+		err := l.RegisterRequest(r.RemoteAddr, nil /* customRate */)
+		// MaxRateError doesn't play well with errors.Is, hence the cast.
+		if _, ok := err.(*ratelimit.MaxRateError); ok {
+			return nil, trace.LimitExceeded(err.Error())
+		}
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		return fn(w, r, p)
+	})
+}
+
 // AuthenticateRequest authenticates request using combination of a session cookie
 // and bearer token
 func (h *Handler) AuthenticateRequest(w http.ResponseWriter, r *http.Request, checkBearerToken bool) (*SessionContext, error) {
diff --git a/lib/web/apiserver_login_test.go b/lib/web/apiserver_login_test.go
index 045d252d63320..1857d66548221 100644
--- a/lib/web/apiserver_login_test.go
+++ b/lib/web/apiserver_login_test.go
@@ -29,8 +29,12 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
+
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 )
 
 func TestWebauthnLogin_ssh(t *testing.T) {
@@ -41,7 +45,6 @@ func TestWebauthnLogin_ssh(t *testing.T) {
 		Webauthn: &types.Webauthn{
 			RPID: env.server.TLS.ClusterName(),
 		},
-		// Use default Webauthn configuration.
 	})
 	user := clusterMFA.User
 	password := clusterMFA.Password
@@ -97,7 +100,6 @@ func TestWebauthnLogin_web(t *testing.T) {
 		Webauthn: &types.Webauthn{
 			RPID: env.server.TLS.ClusterName(),
 		},
-		// Use default Webauthn configuration.
 	})
 	user := clusterMFA.User
 	password := clusterMFA.Password
@@ -136,6 +138,139 @@ func TestWebauthnLogin_web(t *testing.T) {
 	require.NotEmpty(t, createSessionResp.SessionExpires.Unix())
 }
 
+func TestAuthenticate_passwordless(t *testing.T) {
+	env := newWebPack(t, 1)
+	clusterMFA := configureClusterForMFA(t, env, &types.AuthPreferenceSpecV2{
+		Type:         constants.Local,
+		SecondFactor: constants.SecondFactorOn,
+		Webauthn: &types.Webauthn{
+			RPID: env.server.TLS.ClusterName(),
+		},
+	})
+	user := clusterMFA.User
+	device := clusterMFA.WebDev.Key
+
+	// Fake a passwordless device. Typically this would require a separate
+	// registration, but because we use fake devices we can get away with it.
+	device.SetPasswordless()
+
+	// Fetch the WebAuthn User Handle. In a real-world scenario the device stores
+	// the handle alongside the credentials during registration.
+	ctx := context.Background()
+	authServer := env.server.Auth()
+	wla, err := authServer.GetWebauthnLocalAuth(ctx, user)
+	require.NoError(t, err)
+	userHandle := wla.UserID
+
+	// Prepare SSH key to be signed.
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	pub, err := ssh.NewPublicKey(&priv.PublicKey)
+	require.NoError(t, err)
+	pubBytes := ssh.MarshalAuthorizedKey(pub)
+
+	clt, err := client.NewWebClient(env.proxies[0].webURL.String(), roundtrip.HTTPClient(client.NewInsecureWebClient()))
+	require.NoError(t, err)
+
+	tests := []struct {
+		name  string
+		login func(t *testing.T, assertionResp *wanlib.CredentialAssertionResponse)
+	}{
+		{
+			name: "ssh",
+			login: func(t *testing.T, assertionResp *wanlib.CredentialAssertionResponse) {
+				ep := clt.Endpoint("webapi", "mfa", "login", "finish")
+				sshResp, err := clt.PostJSON(ctx, ep, &client.AuthenticateSSHUserRequest{
+					WebauthnChallengeResponse: assertionResp, // no username
+					PubKey:                    pubBytes,
+					TTL:                       24 * time.Hour,
+				})
+				require.NoError(t, err, "Passwordless authentication failed")
+				loginResp := &auth.SSHLoginResponse{}
+				require.NoError(t, json.Unmarshal(sshResp.Bytes(), loginResp))
+				require.Equal(t, user, loginResp.Username)
+			},
+		},
+		{
+			name: "web",
+			login: func(t *testing.T, assertionResp *wanlib.CredentialAssertionResponse) {
+				ep := clt.Endpoint("webapi", "mfa", "login", "finishsession")
+				sessionResp, err := clt.PostJSON(ctx, ep, &client.AuthenticateWebUserRequest{
+					WebauthnAssertionResponse: assertionResp, // no username
+				})
+				require.NoError(t, err, "Passwordless authentication failed")
+				createSessionResp := &CreateSessionResponse{}
+				require.NoError(t, json.Unmarshal(sessionResp.Bytes(), createSessionResp))
+				require.NotEmpty(t, createSessionResp.TokenType)
+				require.NotEmpty(t, createSessionResp.Token)
+				require.NotEmpty(t, createSessionResp.TokenExpiresIn)
+				require.NotEmpty(t, createSessionResp.SessionExpires.Unix())
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// Request passwordless challenge.
+			ep := clt.Endpoint("webapi", "mfa", "login", "begin")
+			beginResp, err := clt.PostJSON(ctx, ep, &client.MFAChallengeRequest{
+				Passwordless: true, // no username and password
+			})
+			require.NoError(t, err, "Failed to create passwordless challenge")
+			mfaChallenge := &client.MFAAuthenticateChallenge{}
+			require.NoError(t, json.Unmarshal(beginResp.Bytes(), mfaChallenge))
+			require.NotNil(t, mfaChallenge.WebauthnChallenge, "Want non-nil WebAuthn challenge")
+
+			// Sign challenge and set user handle.
+			origin := "https://" + env.server.TLS.ClusterName()
+			assertionResp, err := device.SignAssertion(origin, mfaChallenge.WebauthnChallenge)
+			require.NoError(t, err)
+			assertionResp.AssertionResponse.UserHandle = userHandle
+
+			// Complete passwordless login.
+			test.login(t, assertionResp)
+		})
+	}
+}
+
+func TestAuthenticate_rateLimiting(t *testing.T) {
+	ctx := context.Background()
+
+	tests := []struct {
+		name  string
+		burst int
+		fn    func(clt *client.WebClient) error
+	}{
+		{
+			name:  "/webapi/mfa/login/begin",
+			burst: defaults.LimiterPasswordlessBurst,
+			fn: func(clt *client.WebClient) error {
+				ep := clt.Endpoint("webapi", "mfa", "login", "begin")
+				_, err := clt.PostJSON(ctx, ep, &client.MFAChallengeRequest{})
+				return err
+			},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			// Use a separate webPack per test, so limits won't influence one another.
+			env := newWebPack(t, 1)
+			clt, err := client.NewWebClient(env.proxies[0].webURL.String(), roundtrip.HTTPClient(client.NewInsecureWebClient()))
+			require.NoError(t, err)
+
+			for i := 0; i < test.burst; i++ {
+				err := test.fn(clt)
+				require.False(t, trace.IsLimitExceeded(err), "got err = %v, want non-LimitExceeded", err)
+			}
+
+			err = test.fn(clt)
+			require.True(t, trace.IsLimitExceeded(err), "got err = %v, want LimitExceeded", err)
+		})
+	}
+}
+
 type configureMFAResp struct {
 	User, Password string
 	WebDev         *auth.TestDevice
diff --git a/lib/web/apiserver_test.go b/lib/web/apiserver_test.go
index db8a00ee70065..7c8089b67054c 100644
--- a/lib/web/apiserver_test.go
+++ b/lib/web/apiserver_test.go
@@ -29,7 +29,6 @@ import (
 	"fmt"
 	"image"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/cookiejar"
@@ -517,7 +516,7 @@ func (s *WebSuite) TestSAMLSuccess(c *C) {
 	err = services.ValidateSAMLConnector(connector)
 	c.Assert(err, IsNil)
 
-	role, err := types.NewRole(connector.GetAttributesToRoles()[0].Roles[0], types.RoleSpecV5{
+	role, err := types.NewRoleV3(connector.GetAttributesToRoles()[0].Roles[0], types.RoleSpecV5{
 		Options: types.RoleOptions{
 			MaxSessionTTL: types.NewDuration(apidefaults.MaxCertDuration),
 		},
@@ -559,7 +558,7 @@ func (s *WebSuite) TestSAMLSuccess(c *C) {
 	c.Assert(u.Scheme+"://"+u.Host+u.Path, Equals, fixtures.SAMLOktaSSO)
 	data, err := base64.StdEncoding.DecodeString(u.Query().Get("SAMLRequest"))
 	c.Assert(err, IsNil)
-	buf, err := ioutil.ReadAll(flate.NewReader(bytes.NewReader(data)))
+	buf, err := io.ReadAll(flate.NewReader(bytes.NewReader(data)))
 	c.Assert(err, IsNil)
 	doc := etree.NewDocument()
 	err = doc.ReadFromBytes(buf)
@@ -1163,7 +1162,7 @@ func mustStartWindowsDesktopMock(t *testing.T, authClient *auth.Server) *windows
 	tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
 	require.NoError(t, err)
 
-	ca, err := authClient.GetCertAuthority(types.CertAuthID{Type: types.UserCA, DomainName: n.GetClusterName()}, false)
+	ca, err := authClient.GetCertAuthority(context.Background(), types.CertAuthID{Type: types.UserCA, DomainName: n.GetClusterName()}, false)
 	require.NoError(t, err)
 
 	for _, kp := range services.GetTLSCerts(ca) {
@@ -1960,6 +1959,70 @@ func (s *WebSuite) TestGetClusterDetails(c *C) {
 	c.Assert(nodes, HasLen, cluster.NodeCount)
 }
 
+func TestTokenGeneration(t *testing.T) {
+	tt := []struct {
+		name      string
+		roles     types.SystemRoles
+		shouldErr bool
+	}{
+		{
+			name:      "single node role",
+			roles:     types.SystemRoles{types.RoleNode},
+			shouldErr: false,
+		},
+		{
+			name:      "single app role",
+			roles:     types.SystemRoles{types.RoleApp},
+			shouldErr: false,
+		},
+		{
+			name:      "single db role",
+			roles:     types.SystemRoles{types.RoleDatabase},
+			shouldErr: false,
+		},
+		{
+			name:      "multiple roles",
+			roles:     types.SystemRoles{types.RoleNode, types.RoleApp, types.RoleDatabase},
+			shouldErr: false,
+		},
+		{
+			name:      "return error if no role is requested",
+			roles:     types.SystemRoles{},
+			shouldErr: true,
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			env := newWebPack(t, 1)
+
+			proxy := env.proxies[0]
+			pack := proxy.authPack(t, "test-user@example.com")
+
+			endpoint := pack.clt.Endpoint("webapi", "token")
+			re, err := pack.clt.PostJSON(context.Background(), endpoint, createTokenRequest{
+				Roles: tc.roles,
+			})
+
+			if tc.shouldErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+
+			var responseToken nodeJoinToken
+			err = json.Unmarshal(re.Bytes(), &responseToken)
+			require.NoError(t, err)
+
+			// generated token roles should match the requested ones
+			generatedToken, err := proxy.auth.Auth().GetToken(context.Background(), responseToken.ID)
+			require.NoError(t, err)
+			require.Equal(t, tc.roles, generatedToken.GetRoles())
+		})
+	}
+}
+
 func TestClusterDatabasesGet(t *testing.T) {
 	env := newWebPack(t, 1)
 
@@ -2398,37 +2461,55 @@ func TestCreateRegisterChallenge(t *testing.T) {
 	require.NoError(t, err)
 
 	tests := []struct {
-		name       string
-		deviceType string
+		name            string
+		req             *createRegisterChallengeRequest
+		assertChallenge func(t *testing.T, c *client.MFARegisterChallenge)
 	}{
 		{
-			name:       "totp challenge",
-			deviceType: "totp",
+			name: "totp",
+			req: &createRegisterChallengeRequest{
+				DeviceType: "totp",
+			},
 		},
 		{
-			name:       "webauthn challenge",
-			deviceType: "webauthn",
+			name: "webauthn",
+			req: &createRegisterChallengeRequest{
+				DeviceType: "webauthn",
+			},
+		},
+		{
+			name: "passwordless",
+			req: &createRegisterChallengeRequest{
+				DeviceType:  "webauthn",
+				DeviceUsage: "passwordless",
+			},
+			assertChallenge: func(t *testing.T, c *client.MFARegisterChallenge) {
+				// rrk=true is a good proxy for passwordless.
+				require.NotNil(t, c.Webauthn.Response.AuthenticatorSelection.RequireResidentKey, "rrk cannot be nil")
+				require.True(t, *c.Webauthn.Response.AuthenticatorSelection.RequireResidentKey, "rrk cannot be false")
+			},
 		},
 	}
-
 	for _, tc := range tests {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			endpoint := clt.Endpoint("webapi", "mfa", "token", token.GetName(), "registerchallenge")
-			res, err := clt.PostJSON(ctx, endpoint, &createRegisterChallengeRequest{
-				DeviceType: tc.deviceType,
-			})
+			res, err := clt.PostJSON(ctx, endpoint, tc.req)
 			require.NoError(t, err)
 
 			var chal client.MFARegisterChallenge
 			require.NoError(t, json.Unmarshal(res.Bytes(), &chal))
 
-			switch tc.deviceType {
+			switch tc.req.DeviceType {
 			case "totp":
-				require.NotNil(t, chal.TOTP.QRCode)
+				require.NotNil(t, chal.TOTP.QRCode, "TOTP QR code cannot be nil")
 			case "webauthn":
-				require.NotNil(t, chal.Webauthn)
+				require.NotNil(t, chal.Webauthn, "WebAuthn challenge cannot be nil")
+			}
+
+			if tc.assertChallenge != nil {
+				tc.assertChallenge(t, &chal)
 			}
 		})
 	}
diff --git a/lib/web/app/transport.go b/lib/web/app/transport.go
index b8a63e00d5d72..e8781f2abc3a8 100644
--- a/lib/web/app/transport.go
+++ b/lib/web/app/transport.go
@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"strings"
 	"sync"
 
 	"github.com/gravitational/teleport/api/constants"
@@ -189,8 +190,7 @@ func (t *transport) DialContext(ctx context.Context, _, _ string) (net.Conn, err
 		var dialErr error
 		conn, dialErr = dialAppServer(t.c.proxyClient, t.c.identity, appServer)
 		if dialErr != nil {
-			// Connection problem with the server.
-			if trace.IsConnectionProblem(dialErr) {
+			if isReverseTunnelDownError(dialErr) {
 				t.c.log.Warnf("Failed to connect to application server %q: %v.", serverID, dialErr)
 				t.servers.Delete(serverID)
 				// Only goes for the next server if the error returned is a
@@ -256,7 +256,7 @@ func configureTLS(c *transportConfig) (*tls.Config, error) {
 	// Configure the pool of certificates that will be used to verify the
 	// identity of the server. This allows the client to verify the identity of
 	// the server it is connecting to.
-	ca, err := c.accessPoint.GetCertAuthority(types.CertAuthID{
+	ca, err := c.accessPoint.GetCertAuthority(context.TODO(), types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: c.identity.RouteToApp.ClusterName,
 	}, false)
@@ -283,3 +283,10 @@ func configureTLS(c *transportConfig) (*tls.Config, error) {
 
 	return tlsConfig, nil
 }
+
+// isReverseTunnelDownError returns true if the provided error indicates that
+// the reverse tunnel connection is down e.g. because the agent is down.
+func isReverseTunnelDownError(err error) bool {
+	return trace.IsConnectionProblem(err) ||
+		strings.Contains(err.Error(), reversetunnel.NoApplicationTunnel)
+}
diff --git a/lib/web/desktop/playback.go b/lib/web/desktop/playback.go
index 31c72c9cd8785..79f0a7c86d1d7 100644
--- a/lib/web/desktop/playback.go
+++ b/lib/web/desktop/playback.go
@@ -19,13 +19,16 @@ package desktop
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net"
+	"os"
 	"sync"
 	"time"
 
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/trace"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/net/websocket"
 )
@@ -203,8 +206,19 @@ func (pp *Player) streamSessionEvents(ctx context.Context, cancel context.Cancel
 
 		select {
 		case err := <-errC:
+			// TODO(zmb3, isaiah): send some sort of error to the browser,
+			// otherwise it just sits at the player UI
 			if err != nil && !errors.Is(err, context.Canceled) {
 				pp.log.WithError(err).Errorf("streaming session %v", pp.sID)
+				var errorText string
+				if os.IsNotExist(err) || trace.IsNotFound(err) {
+					errorText = "session not found"
+				} else {
+					errorText = "server error"
+				}
+				if _, err := pp.ws.Write([]byte(fmt.Sprintf(`{"message": "error", "errorText": "%v"}`, errorText))); err != nil {
+					pp.log.WithError(err).Error("failed to write \"error\" message over websocket")
+				}
 			}
 			return
 		case evt := <-eventsC:
@@ -225,6 +239,10 @@ func (pp *Player) streamSessionEvents(ctx context.Context, cancel context.Cancel
 				msg, err := utils.FastMarshal(e)
 				if err != nil {
 					pp.log.WithError(err).Errorf("failed to marshal DesktopRecording event into JSON: %v", e)
+					if _, err := pp.ws.Write([]byte(`{"message":"error","errorText":"server error"}`)); err != nil {
+						pp.log.WithError(err).Error("failed to write \"error\" message over websocket")
+					}
+					return
 				}
 				if _, err := pp.ws.Write(msg); err != nil {
 					// We expect net.ErrClosed to arise when another goroutine returns before
@@ -234,6 +252,12 @@ func (pp *Player) streamSessionEvents(ctx context.Context, cancel context.Cancel
 					}
 					return
 				}
+			case *apievents.WindowsDesktopSessionStart, *apievents.WindowsDesktopSessionEnd:
+				// these events are part of the stream but never needed for playback
+			case *apievents.DesktopClipboardReceive, *apievents.DesktopClipboardSend:
+				// these events are not currently needed for playback,
+				// but may be useful in the future
+
 			default:
 				pp.log.Warnf("session %v contains unexpected event type %T", pp.sID, evt)
 			}
diff --git a/lib/web/desktop/playback_test.go b/lib/web/desktop/playback_test.go
index bb0be1f908993..3348112580795 100644
--- a/lib/web/desktop/playback_test.go
+++ b/lib/web/desktop/playback_test.go
@@ -65,7 +65,7 @@ func TestStreamsDesktopEvents(t *testing.T) {
 	b := make([]byte, 4096)
 	n, err := ws.Read(b)
 	require.NoError(t, err)
-	require.Equal(t, []byte(`{"message":"end"}`), b[:n])
+	require.JSONEq(t, `{"message":"end"}`, string(b[:n]))
 }
 
 func newServer(t *testing.T, streamInterval time.Duration, events []apievents.AuditEvent) *httptest.Server {
diff --git a/lib/web/gziphandler.go b/lib/web/gziphandler.go
index 37e5a80662fd9..d7acf9b03113e 100644
--- a/lib/web/gziphandler.go
+++ b/lib/web/gziphandler.go
@@ -18,7 +18,7 @@ package web
 
 import (
 	"compress/gzip"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"strings"
 	"sync"
@@ -30,7 +30,7 @@ import (
 // internal buffers to avoid too many objects on the heap
 var writerPool = sync.Pool{
 	New: func() interface{} {
-		gz := gzip.NewWriter(ioutil.Discard)
+		gz := gzip.NewWriter(io.Discard)
 		return gz
 	},
 }
diff --git a/lib/web/join_tokens.go b/lib/web/join_tokens.go
index 64ff8c9047069..328133e9fa83f 100644
--- a/lib/web/join_tokens.go
+++ b/lib/web/join_tokens.go
@@ -31,6 +31,7 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/defaults"
+	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web/scripts"
@@ -56,13 +57,40 @@ type scriptSettings struct {
 	appURI         string
 }
 
-func (h *Handler) createScriptJoinTokenHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
+// createTokenRequest is the expected request body of
+// the endpoint to create token
+type createTokenRequest struct {
+	Roles types.SystemRoles `json:"roles"`
+}
+
+func (h *Handler) createTokenHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
+	var req createTokenRequest
+	if err := httplib.ReadJSON(r, &req); err != nil {
+		log.WithError(err).Error("error reading body")
+		return nil, trace.Wrap(err)
+	}
+
+	clt, err := ctx.GetClient()
+	if err != nil {
+		log.WithError(err).Error("error getting client")
+		return nil, trace.Wrap(err)
+	}
+
+	return createJoinToken(r.Context(), clt, req.Roles)
+}
+
+func (h *Handler) createNodeTokenHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
 	clt, err := ctx.GetClient()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return createScriptJoinToken(r.Context(), clt)
+	roles := types.SystemRoles{
+		types.RoleNode,
+		types.RoleApp,
+	}
+
+	return createJoinToken(r.Context(), clt, roles)
 }
 
 func (h *Handler) getNodeJoinScriptHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params) (interface{}, error) {
@@ -130,13 +158,10 @@ func (h *Handler) getAppJoinScriptHandle(w http.ResponseWriter, r *http.Request,
 	return nil, nil
 }
 
-func createScriptJoinToken(ctx context.Context, m nodeAPIGetter) (*nodeJoinToken, error) {
+func createJoinToken(ctx context.Context, m nodeAPIGetter, roles types.SystemRoles) (*nodeJoinToken, error) {
 	req := auth.GenerateTokenRequest{
-		Roles: types.SystemRoles{
-			types.RoleNode,
-			types.RoleApp,
-		},
-		TTL: defaults.NodeJoinTokenTTL,
+		Roles: roles,
+		TTL:   defaults.NodeJoinTokenTTL,
 	}
 
 	token, err := m.GenerateToken(ctx, req)
diff --git a/lib/web/join_tokens_test.go b/lib/web/join_tokens_test.go
index 6a17db4b08a60..24ac93f0bc478 100644
--- a/lib/web/join_tokens_test.go
+++ b/lib/web/join_tokens_test.go
@@ -36,7 +36,10 @@ func TestCreateNodeJoinToken(t *testing.T) {
 		return "some-token-id", nil
 	}
 
-	token, err := createScriptJoinToken(context.Background(), m)
+	token, err := createJoinToken(context.Background(), m, types.SystemRoles{
+		types.RoleNode,
+		types.RoleApp,
+	})
 	require.NoError(t, err)
 
 	require.Equal(t, defaults.NodeJoinTokenTTL, token.Expiry.Sub(time.Now().UTC()).Round(time.Second))
diff --git a/lib/web/mfa.go b/lib/web/mfa.go
index 70130d727ae06..8813bd5ee432d 100644
--- a/lib/web/mfa.go
+++ b/lib/web/mfa.go
@@ -18,6 +18,7 @@ package web
 
 import (
 	"net/http"
+	"strings"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/lib/auth/webauthn"
@@ -146,6 +147,10 @@ func (h *Handler) createAuthenticateChallengeWithTokenHandle(w http.ResponseWrit
 type createRegisterChallengeRequest struct {
 	// DeviceType is the type of MFA device to get a register challenge for.
 	DeviceType string `json:"deviceType"`
+	// DeviceUsage is the intended usage of the device (MFA, Passwordless, etc).
+	// It mimics the proto.DeviceUsage enum.
+	// Defaults to MFA.
+	DeviceUsage string `json:"deviceUsage"`
 }
 
 // createRegisterChallengeWithTokenHandle creates and returns MFA register challenges for a new device for the specified device type.
@@ -165,9 +170,20 @@ func (h *Handler) createRegisterChallengeWithTokenHandle(w http.ResponseWriter,
 		return nil, trace.BadParameter("MFA device type %q unsupported", req.DeviceType)
 	}
 
+	var deviceUsage proto.DeviceUsage
+	switch strings.ToLower(req.DeviceUsage) {
+	case "", "mfa":
+		deviceUsage = proto.DeviceUsage_DEVICE_USAGE_MFA
+	case "passwordless":
+		deviceUsage = proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS
+	default:
+		return nil, trace.BadParameter("device usage %q unsupported", req.DeviceUsage)
+	}
+
 	chal, err := h.cfg.ProxyClient.CreateRegisterChallenge(r.Context(), &proto.CreateRegisterChallengeRequest{
-		TokenID:    p.ByName("token"),
-		DeviceType: deviceType,
+		TokenID:     p.ByName("token"),
+		DeviceType:  deviceType,
+		DeviceUsage: deviceUsage,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/web/resources_test.go b/lib/web/resources_test.go
index 97b8b030ea142..929008e0d4387 100644
--- a/lib/web/resources_test.go
+++ b/lib/web/resources_test.go
@@ -122,7 +122,7 @@ spec:
       desktop: true
 version: v3
 `
-	role, err := types.NewRole("roleName", types.RoleSpecV5{
+	role, err := types.NewRoleV3("roleName", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{"test"},
 		},
@@ -167,7 +167,7 @@ func TestGetRoles(t *testing.T) {
 	m := &mockedResourceAPIGetter{}
 
 	m.mockGetRoles = func(ctx context.Context) ([]types.Role, error) {
-		role, err := types.NewRole("test", types.RoleSpecV5{
+		role, err := types.NewRoleV3("test", types.RoleSpecV5{
 			Allow: types.RoleConditions{
 				Logins: []string{"test"},
 			},
diff --git a/lib/web/sessions.go b/lib/web/sessions.go
index 405a4ba607ad2..947e2be6dc323 100644
--- a/lib/web/sessions.go
+++ b/lib/web/sessions.go
@@ -209,9 +209,10 @@ func (c *SessionContext) tryRemoteTLSClient(cluster reversetunnel.RemoteSite) (a
 // ClientTLSConfig returns client TLS authentication associated
 // with the web session context
 func (c *SessionContext) ClientTLSConfig(clusterName ...string) (*tls.Config, error) {
+	ctx := context.TODO()
 	var certPool *x509.CertPool
 	if len(clusterName) == 0 {
-		certAuthorities, err := c.parent.proxyClient.GetCertAuthorities(types.HostCA, false)
+		certAuthorities, err := c.parent.proxyClient.GetCertAuthorities(ctx, types.HostCA, false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -220,7 +221,7 @@ func (c *SessionContext) ClientTLSConfig(clusterName ...string) (*tls.Config, er
 			return nil, trace.Wrap(err)
 		}
 	} else {
-		certAuthority, err := c.parent.proxyClient.GetCertAuthority(types.CertAuthID{
+		certAuthority, err := c.parent.proxyClient.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName[0],
 		}, false)
@@ -305,7 +306,8 @@ func (c *SessionContext) GetAgent() (agent.Agent, *ssh.Certificate, error) {
 }
 
 func (c *SessionContext) getCheckers() ([]ssh.PublicKey, error) {
-	cas, err := c.unsafeCachedAuthClient.GetCertAuthorities(types.HostCA, false)
+	ctx := context.TODO()
+	cas, err := c.unsafeCachedAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -826,7 +828,8 @@ func (s *sessionCache) newSessionContextFromSession(session types.WebSession) (*
 }
 
 func (s *sessionCache) tlsConfig(cert, privKey []byte) (*tls.Config, error) {
-	ca, err := s.proxyClient.GetCertAuthority(types.CertAuthID{
+	ctx := context.TODO()
+	ca, err := s.proxyClient.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: s.clusterName,
 	}, false)
diff --git a/lib/web/static_test.go b/lib/web/static_test.go
index 79f47fbbc7c98..6ea4d05afc996 100644
--- a/lib/web/static_test.go
+++ b/lib/web/static_test.go
@@ -18,7 +18,6 @@ package web
 
 import (
 	"io"
-	"io/ioutil"
 	"os"
 	"strings"
 
@@ -38,7 +37,7 @@ func (s *StaticSuite) TestLocalFS(c *check.C) {
 
 	f, err := fs.Open("/index.html")
 	c.Assert(err, check.IsNil)
-	bytes, err := ioutil.ReadAll(f)
+	bytes, err := io.ReadAll(f)
 	c.Assert(err, check.IsNil)
 
 	html := string(bytes[:])
@@ -55,7 +54,7 @@ func (s *StaticSuite) TestZipFS(c *check.C) {
 	// test simple full read:
 	f, err := fs.Open("/index.html")
 	c.Assert(err, check.IsNil)
-	bytes, err := ioutil.ReadAll(f)
+	bytes, err := io.ReadAll(f)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(bytes), check.Equals, 813)
 	c.Assert(f.Close(), check.IsNil)
@@ -69,14 +68,14 @@ func (s *StaticSuite) TestZipFS(c *check.C) {
 	c.Assert(err, check.IsNil)
 	c.Assert(n, check.Equals, int64(10))
 
-	bytes, err = ioutil.ReadAll(f)
+	bytes, err = io.ReadAll(f)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(bytes), check.Equals, 803)
 
 	n, err = f.Seek(-50, io.SeekEnd)
 	c.Assert(err, check.IsNil)
 	c.Assert(n, check.Equals, int64(763))
-	bytes, err = ioutil.ReadAll(f)
+	bytes, err = io.ReadAll(f)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(bytes), check.Equals, 50)
 
@@ -85,7 +84,7 @@ func (s *StaticSuite) TestZipFS(c *check.C) {
 	n, err = f.Seek(-50, io.SeekCurrent)
 	c.Assert(err, check.IsNil)
 	c.Assert(n, check.Equals, int64(713))
-	bytes, err = ioutil.ReadAll(f)
+	bytes, err = io.ReadAll(f)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(bytes), check.Equals, 100)
 }
diff --git a/lib/web/ui/perf_test.go b/lib/web/ui/perf_test.go
index eb71151b4024e..9e79dfc6233ea 100644
--- a/lib/web/ui/perf_test.go
+++ b/lib/web/ui/perf_test.go
@@ -19,8 +19,6 @@ package ui
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
-	"os"
 	"testing"
 	"time"
 
@@ -79,12 +77,8 @@ func BenchmarkGetClusterDetails(b *testing.B) {
 				bk, err = memory.New(memory.Config{})
 				require.NoError(b, err)
 			} else {
-				dir, err := ioutil.TempDir("", "teleport")
-				require.NoError(b, err)
-				defer os.RemoveAll(dir)
-
 				bk, err = lite.NewWithConfig(context.TODO(), lite.Config{
-					Path: dir,
+					Path: b.TempDir(),
 				})
 				require.NoError(b, err)
 			}
diff --git a/lib/web/ui/usercontext.go b/lib/web/ui/usercontext.go
index 5e7426ec8daf1..3db8a148db565 100644
--- a/lib/web/ui/usercontext.go
+++ b/lib/web/ui/usercontext.go
@@ -216,9 +216,6 @@ func NewUserContext(user types.User, userRoles services.RoleSet, features proto.
 	var billingAccess access
 	if features.Cloud {
 		billingAccess = newAccess(userRoles, ctx, types.KindBilling)
-
-		// disable access to preview features
-		desktopAccess = access{}
 	}
 
 	logins := getLogins(userRoles)
diff --git a/lib/web/ui/usercontext_test.go b/lib/web/ui/usercontext_test.go
index 874d5600e0293..9ccab941f65c0 100644
--- a/lib/web/ui/usercontext_test.go
+++ b/lib/web/ui/usercontext_test.go
@@ -157,7 +157,6 @@ func (s *UserContextSuite) TestNewUserContextCloud(c *check.C) {
 	roleSet := []types.Role{role}
 
 	allowed := access{true, true, true, true, true}
-	denied := access{false, false, false, false, false}
 
 	userContext, err := NewUserContext(user, roleSet, proto.Features{Cloud: true}, true)
 	c.Assert(err, check.IsNil)
@@ -186,5 +185,5 @@ func (s *UserContextSuite) TestNewUserContextCloud(c *check.C) {
 
 	// cloud-specific asserts
 	c.Assert(userContext.ACL.Billing, check.DeepEquals, allowed)
-	c.Assert(userContext.ACL.Desktops, check.DeepEquals, denied)
+	c.Assert(userContext.ACL.Desktops, check.DeepEquals, allowed)
 }
diff --git a/rfd/0039-sni-alpn-teleport-proxy-routing.md b/rfd/0039-sni-alpn-teleport-proxy-routing.md
index fda09f9dc0fc4..e34ae5eaafad5 100644
--- a/rfd/0039-sni-alpn-teleport-proxy-routing.md
+++ b/rfd/0039-sni-alpn-teleport-proxy-routing.md
@@ -103,7 +103,7 @@ In order to expose WEB, Kubernetes proxy services in one teleport proxy port, th
 
 #### Setting SNI value for kubectl CLI:
 
-`tsh kube login` command generates a local kubeconfig.yaml file used during accessing teleport proxy by kubectl CLI. Additional to the current configuration the  tls-server-name  failed will be added with appropriate SNI value:
+`tsh kube login` command generates a local kubeconfig.yaml file used during accessing teleport proxy by kubectl CLI. Additional to the current configuration the `tls-server-name` field will be added with appropriate SNI value:
 
 ```yaml
 apiVersion: v1
diff --git a/rfd/0043-kubeaccess-multiparty.md b/rfd/0043-kubeaccess-multiparty.md
index a9b1cd9140f92..77c0d487da9a1 100644
--- a/rfd/0043-kubeaccess-multiparty.md
+++ b/rfd/0043-kubeaccess-multiparty.md
@@ -3,65 +3,72 @@ authors: Joel Wejdenstål (jwejdenstal@goteleport.com)
 state: implemented
 ---
 
-# RFD 43 - Shared sessions with observers for Kubernetes Access
+# RFD 43 - Moderated Sessions
 
 ## What
 
-Implement joint observer support for Kubernetes Access with support for configurable conditions similar to those of [RFD 26](https://github.com/gravitational/teleport/blob/2fd6a88800604342bfa6277060b056d8bf0cbfb2/rfd/0026-custom-approval-conditions.md).
-Also support defining conditions for required observers in order to initiate and maintain a session.
+Implement the ability to define RBAC policies with filters similar to those of [RFD 26](https://github.com/gravitational/teleport/blob/2fd6a88800604342bfa6277060b056d8bf0cbfb2/rfd/0026-custom-approval-conditions.md) that can be used to require others to be present in a session for it to be usable.
 
 ## Why
 
-Heavily regulated and security critical industries require that one or more observers with a certain role
-are present in Kubernetes Access sessions and viewing it live in order to guarantee that
-operator does not perform any mistakes or acts of malice.
+Heavily regulated and security-critical industries require that one or more participants with a certain role
+are present in SSH and Kubernetes sessions and viewing it live to guarantee that
+the operator does not perform any mistakes or acts of malice.
 
-Such observers need to have the power to terminate a session immediately should anything go wrong.
+Such participants need to have the power to terminate a session immediately should anything go wrong.
 
 To suit everyone this will need a more detailed configuration model based on rules
-that can be used to define observers, their powers and when and in what capacity they are required.
+that can be used to define observers, their powers, and when and in what capacity they are required.
 
 ## Details
 
-### Multiparty sessions
+### Terminology
 
-SSH sessions via TSH currently have rich support for sessions with multiple users at once.
+This RFD repeatedly refers to some specific nouns of which explanations can be found below:
+- Participant: Any user in the session regardless of mode, including the session initiator.
+- Initiator: The user that started the session. This user is in peer mode.
+- Mode: One of the modes below. Any given participant must be in one mode only.
+- Observer: A participant who can only view the session.
+- Moderator: A participant who can view and terminate the session at any point.
+- Peer: A participant with the ability to view and interact with the session.
+
+### Multiparty sessions for Kubernetes
+
+SSH sessions via TSH currently have support for sessions with multiple users at once.
 This concept is to be extended to Kubernetes Access which will allow us to build additional features on top.
 
-Multiparty sessions shall be implemented by modifying the k8s request proxy forwarder in the `kubernetes_service`. This
-approach was chosen as it is a hub that sessions pass through which makes it optimal for multiplexing.
+Multiparty sessions shall be implemented by modifying the k8s request proxy forwarder in the `kubernetes_service`. This approach was chosen as it is a hub that sessions pass through which makes it optimal for multiplexing.
 
 An approach using multiplexing in the `proxy_service` layer was considered but was ultimately determined to be more complicated
-due to the fact that proxies don't handle the final session traffic hop when using Kubernetes Access.
+since proxies don't handle the final session traffic hop when using Kubernetes Access.
 
-It will work by adding a multiplexing layer inside the forwarder that similar to the current session recording
-functionality, but instead this multiplexes outputs to the session initiator and all observers
-but only streams back input from the initiator.
+It will be implemented by adding a multiplexing layer inside the forwarder that similar to the current session recording
+functionality, but instead this multiplexes output to the session initiator and all participants
+but only streams back input from participants with the `peer` mode.
 
-#### Session observers
+#### Session participants and require policies
 
-A core feature we need to support is required observers. This will allow cluster administrators to configure
+A core feature we need to support is the required participants. This will allow cluster administrators to configure
 policies that require certain Teleport users of a certain role to be actively monitoring the session.
 
-This feature is useful in security critical environments where multiple people need to witness every action
-in the event of severe error or malice and have the ability to halt any erroneous or malicious action.
+This feature is useful in security-critical environments where multiple people need to witness every action
+in the event of severe error or malice and can halt any erroneous or malicious action.
 
 #### Session states
 
-By default, a `tsh kube exec` and `kubectl attach` request will go through as usual if no policies are defined. If a policy like the one above is defined the session will be put in a pending state
+By default, a `tsh kube exec` and `tsh ssh` request will go through as usual if no policies are defined. If a policy like the one above is defined the session will be put in a pending state
 until the required viewers have joined.
 
 Sessions can have 3 possible states:
 
 - `PENDING`\
-  When a session is in a `PENDING` state, the connection to the pod from the proxy has not yet started
-  and all users are shown a default message informing them that the session is pending, current participants
-  and who else is required for the session to start.
+ When a session is in a `PENDING` state, the connection to the pod from the proxy has not yet started
+ and all users are shown a default message informing them that the session is pending.
 - `RUNNING`\
 A `RUNNING` session behaves like a normal multiparty session. `stdout`, `stdin` and `stdout` are mapped as usual
-  and the pod can be interacted with.
+ and the pod can be interacted with.
 - `TERMINATED`\
-  A session becomes `TERMINATED` once the shell spawned inside the pod quits or is forcefully terminated by one of the session participants.
+ A session becomes `TERMINATED` once the shell spawned inside the pod quits or is forcefully terminated by one of the session participants.
 
 All sessions begin in the `PENDING` state and can change states based on the following transitions:
 
@@ -72,13 +79,13 @@ the session transitions to a `RUNNING` state. This involves initiating the conne
 and setting up the shell. Finally, all clients are multiplexed
 onto the correct streams as described previously.
 
-Only the session initiator is able to make input, observers are not connected to the input stream
+Only the session initiator can make input, observers are not connected to the input stream
 and may only view stdout/stderr and terminate the session.
 
 ##### Transition 2: `RUNNING -> TERMINATED`
 
-When the shell process created on the pod is terminated, the session transitions to a `TERMINATED` state and all clients
-are disconnected as per standard `kubectl` behaviour.
+When the shell process created on the pod is terminated, the session transitions to a `TERMINATED` state, and all clients
+are disconnected as per standard `kubectl` behavior.
 
 ##### Transition 3: `RUNNING -> TERMINATED`
 
@@ -96,7 +103,7 @@ Here, the connection is frozen for a configurable amount of time as a sort of gr
 ##### Transition 5: `PENDING -> TERMINATED`
 
 After a grace period has elapsed in a session in a session that previously was in a `RUNNING`
-state, the session is automatically terminated. This can be cancelled by having the required observers
+state, the session is automatically terminated. This can be canceled by having the required observers
 join back in which transitions the session back to `RUNNING`.
 
 ##### Transition 6: `PENDING -> TERMINATED`
@@ -107,22 +114,22 @@ connection to the pod exists at this time.
 
 #### UI/UX
 
-The initial implementation of multiparty sessions on Kubernetes access will only be supported via CLI access for implementation simplicity.
+The initial implementation of multiparty sessions for SSH Kubernetes access will only be supported via CLI access for implementation simplicity.
 
-Terminating the `kubectl` process that started the session terminates the session. Terminating an observer `tsh` process
+Terminating the `tsh kube exec` or `tsh ssh` process that started the session terminates the session. Terminating a participant `tsh` process
 disconnects the observer from the session and applies relevant state transitions if any.
 
-Terminating the session from a observer `tsh` instance can be done with the key combination `CTRL-T`
+Terminating the session from a moderator `tsh` instance can be done with the T hotkey.
 
 ##### Session creation
 
 Session creation can happen with the existing flow using `kubectl exec`
-but the wrapper command `tsh kube exec --invite=bob@example.com,eve@foo.net --reason="Need to fix this pod" -- database_pod -- /bin/bash`. This subcommand allows you to invite one or more accounts which will receive a notification saying they are invited. An arbitrary string may also be provided as a reason
+but the wrapper command `tsh kube exec --invite=bob@example.com,eve@foo.net --reason="Need to fix this pod" -- database_pod -- /bin/bash`. This subcommand allows you to invite one or more accounts that will receive a notification saying they are invited. An arbitrary string may also be provided as a reason
 for the session invite, it could for example be used to say what the purpose of the session is.
 
 ##### Session join
 
-`kubectl` itself has no concept of multiparty sessions. This means that we cannot easily use
+Kubernetes itself has no concept of multiparty sessions. This means that we cannot easily use
 its built-in facilities for support session joining.
 
 To make this process easier for the user. I propose extending the current `tsh join` command
@@ -132,58 +139,98 @@ to an ongoing session and displays stdout/stderr.
 ##### MFA tap
 
 If the standard `per_session_mfa` option is enabled for a role then MFA tap input via Yubikey or other is required for the participant to be considered active.
-This requirement is on an interval of 1 minute. When there is 15 seconds left, an alert is printed to the console.
+This requirement is on an interval of 1 minute. When there are 15 seconds left, an alert is printed to the console.
 
 ```
-Teleport >> Please tap your MFA key within 15 seconds.
+Teleport > Please tap your MFA key within 15 seconds.
 ```
 
-If tap is made after the alert, the follwing message is shown:
+If the tap is made after the alert, the following message is shown:
+
+```
+Teleport > MFA tap received.
+```
+
+#### Broadcast messages
+
+For TTY-enabled SSH and Kubernetes sessions that require additional participants regardless of mode as per a require policy, Teleport will now inject broadcast messages into the session to notify participants
+about the state of the session. No messages will be shown in sessions that do not require additional participants.
+
+This is needed so that participants are aware of what is currently happening in the session
+for security and usability reasons.
+
+Each broadcast message is prefixed with `Teleport > ` to indicate that this message
+is injected by Teleport and not from the originating shell.
+
+There are 10 kinds of broadcast messages:
+- `Creating session with uuid <example-uuid>...`: Sent on session creation.
+- `User <user> joined the session.`: Sent when a user joins the session.
+- `User <user> left the session.`: Sent when a user leaves the session.
+- `Connecting to $HOSTNAME over $PROTOCOL`: Sent when the session is launched and thus transferred to a normal shell.
+- `Session closed.`: Sent when the session is closed due to the termination of the shell.
+- `Session terminated by a moderator`: Sent when moderator forcefully terminates a session.
+- `Session paused, waiting for additional participants...`: Sent when a session is paused due to lack of required participants.
+- `Session resumed.`: Sent when a session has the required participants and is resumed.
+- `Please tap your MFA key within 15 seconds.` and `MFA tap received.` are messages shown to moderators in sessions that are MFA-presence enabled.
+- `Session terminated: participant requirements not met`: Sent when a session is terminated due to lack of required participants and when the pause mode is not enabled.
+
+##### Verbose participant requirements
+
+The optional flag `--participant-req` may be passed `tsh kube exec` or `tsh ssh` when the session is started to provide a verbose output of the participant requirements. By default, we avoid this because the output is large and may be overwhelming but the option is provided for users who wish to see exactly what the requirements for starting a session are.
+
+In this case, the `Session paused, waiting for additional participants...` message will be replaced by the message below.
 
 ```
-Teleport >> MFA tap received.
+Teleport > Session paused, waiting for additional participants:
+           role-1:
+             one-of:
+               - 2x `contains(user.roles, "auditor")`
+               - 1x `contains(user.roles, "admin")`
+           role-2:
+             one-of:
+               - 1x `contains(user.roles, "cs-overwatch")`
 ```
 
 ##### Example
 
-This example illustrates how a group 3 users of which Alice is the initiator and Eve and Ben are two observers
-start a multiparty session. Below is a a series of events that happen that include what each user sees and what
-they do.
+This example illustrates how a group of 3 users of which Alice is the initiator and Eve and Ben are two observers start a multiparty session. Below is a series of events that happen that include what each user sees and actions taken.
 
-- Alice initiates an interactive session to a pod: `tsh kube exec -st --invite=ben@foo.net,eve@foo.net,alice@foo.net database_pod /bin/bash`
+- Alice initiates an interactive session to a pod: `tsh kube exec -st --invite=ben@foo.net,eve@foo.net,alice@foo.net redis-bastion /bin/bash`
 - Alice sees:
 ```
-Creating session with uuid <example-uuid>...
-This session requires moderator. Waiting for others to join:
-- role: auditor-role x2
+Teleport > Creating session with uuid <example-uuid>...
+Teleport > User Alice joined the session.
+Teleport > This session requires additional participants to start...
 ```
 - Eve joins the session with `tsh kube join <example-uuid>` and sees:
 ```
 Please tap MFA key to continue...
 ```
 - Eve taps MFA
-- Alice and Eve sees:
+- Alice and Eve sees
+:
 ```
-Creating session with uuid <example-uuid>...
-This session requires moderator. Waiting for others to join:
-- role: auditor-role x1
-Events:
-- User Eve joined the session.
+Teleport > Creating session with uuid <example-uuid>...
+Teleport > User Alice joined the session.
+Teleport > This session requires additional participants to start...
+Teleport > User Eve joined the session.
 ```
 - Ben joins the session with `tsh kube join <example-uuid>` and sees:
 ```
 Please tap MFA key to continue...
 ```
 - Ben taps MFA
-- Alice, Eve and Ben sees
+- Alice, Eve, and Ben sees
 ```
-Creating session with uuid <example-uuid>...
-Session starting...
-Events:
-- User Eve joined the session.
-- User Ben joined the session
+Teleport > Creating session with uuid <example-uuid>...
+Teleport > User Alice joined the session.
+Teleport > This session requires additional participants to start...
+Teleport > User Eve joined the session.
+Teleport > User Ben joined the session.
+Teleport > Connecting to redis-bastion over Kubernetes...
+redis-bastion@localhost $
 ```
-- The connection to the pod is made and each the session turns into a normal shell.
+- The connection to the pod is made and each session turns into a normal shell.
 
 #### Session invites and notifications
 
@@ -198,12 +245,12 @@ session resource which allows Teleport clients and plugins to detect notify them
 
 ##### Session resource
 
-There currently isn't a general purpose session resource in Teleport that's suitable.
+There currently isn't a general-purpose session resource in Teleport that's suitable.
 therefore I suggest that this shall be added. This will be initially used for tracking Kubernetes
 sessions but is compatible with all current and future session types.
 
 This resource is stored centrally in the backend and is used for storing and tracking metadata of active
-sessions. Detailed runtime information needed to join such as the TTY size is stored in memory on the the multiplexing node.
+sessions. Detailed runtime information needed to join such as the TTY size is stored in memory on the multiplexing node.
 
 This effectively replaces the resource defined [here](https://github.com/gravitational/teleport/blob/master/lib/session/session.go).
 
@@ -302,7 +349,7 @@ enum SessionState {
     // to start the session.
     SessionStatePending = 0;
 
-    // Running variant represents a session that has had it's criteria for starting
+    // Running variant represents a session that has had its criteria for starting
     // fulfilled at least once and has transitioned to a RUNNING state.
     SessionStateRunning = 1;
 
@@ -316,14 +363,14 @@ enum SessionState {
 Instead of having fixed fields for specifying values such as required session viewers and roles this
 model centers around conditional allow rules and filters. It is implemented as a bi-directional mapping between the role of the session initiator and the roles of the other session participants.
 
-Roles can have `require_session_join` rule under `allow` containing requirements for session participants
-before a session may be started with privilege access to nodes that the role provides.
+Roles can have a `require_session_join` rule under `allow` containing requirements for session participants
+before a session may be started with privileged access to nodes that the role provides.
 
-Roles can also have an `join_sessions` rule under `allow` specifying which roles
-and session types that that the role grants privileges to join.
+Roles can also have a `join_sessions` rule under `allow` specifying which roles
+and session types that the role grants privileges to join.
 
 We will only initially support the modes `moderator` for Kubernetes Access and `peer` for SSH sessions.
-An `observer` mode also exists which only grants access to view but not terminate an ongoing session.
+An `observer` mode also exists which only grants access to view but does not terminate an ongoing session.
 
 Imagine you have 4 roles:
 - `prod-access`
@@ -332,7 +379,7 @@ Imagine you have 4 roles:
 - `maintenance-observer`
 
 And these requirements:
-- `prod-access` should be able to start sessions of any type with either one `senior-dev` observeror two `dev` observers.
+- `prod-access` should be able to start sessions of any type with either one `senior-dev` participant two `dev` participants.
 - `senior-dev` should be able to start sessions of any type without oversight.
 - `customer-db-maintenance` needs oversight by one `maintenance-observer` on `ssh` type sessions.
 
@@ -410,7 +457,7 @@ To make it more workable, the language has been slimmed down significantly to ha
 
 ##### Provided variables
 
-- `participant`
+- `user`
 ```json
 {
   "traits": "map<string, []string>",
diff --git a/rfd/0046-database-access-config.md b/rfd/0046-database-access-config.md
index 9758f2a198121..fa83487ab3b8c 100644
--- a/rfd/0046-database-access-config.md
+++ b/rfd/0046-database-access-config.md
@@ -1,6 +1,6 @@
 ---
-authors: Roman Tkachenko (roman@goteleport.com)
-state: draft
+authors: Roman Tkachenko (roman@goteleport.com), Gabriel Corado (gabriel.oliveira@goteleport.com)
+state: implemented
 ---
 
 # RFD 46 - Database access configurator
@@ -26,15 +26,17 @@ this initial IAM bootstrap besides documentation guides.
 The same applies to self-hosted databases and other clouds. Instructions vary
 greatly between different database deployment models (self-hosted, cloud) and
 authentication types (X.509, IAM, AD) and having a tool that can guide users
-through the initial setup would significanly improve the getting started
+through the initial setup would significantly improve the getting started
 experience.
 
 ## Scope
 
-The initial implementation will focus on bootstrapping the agent's AWS IAM
-policies but we'll make the effort to design the CLI interface in a way which
-would allow for extensibility to support other scenarios (self-hosted, other
-clouds and auth types).
+The initial implementation will focus on:
+
+1. Generate database agent configuration with samples;
+2. Bootstrap the agent's AWS IAM policies but we'll make the effort to design
+   the CLI interface in a way which would allow for extensibility to support
+   other scenarios (self-hosted, other clouds and auth types);
 
 ## Prior art
 
@@ -64,14 +66,284 @@ $ clusterawsadm bootstrap iam print-policy --document AWSIAMManagedPolicyControl
 
 Teleport has a `teleport configure` command that generates a sample config file.
 
-Database agent bootstrap commands will reside under `teleport db configure`
-family of subcommands. This aligns with our strategy of placing commands related
-to a particular service under its own subcommand namespace.
+Database agent bootstrap commands will reside under teleport db configure family
+of subcommands. This aligns with our strategy of placing commands related to a
+particular service under its subcommand namespace. It will provide subcommands
+for generating configuration files and bootstrapping database agents’ necessary
+configurations, for example, setting up IAM permissions for agents to proxy
+AWS-hosted databases.
+
+### Create config subcommand
+
+Similar to `teleport configure` but focused on configurations for Database
+agents. This command will generate a configuration file. It can also provide
+some examples of configuration, for instance, self-hosted databases setup.
+
+There will be flags to enable features like Aurora/RDS auto-discovery and
+dynamic registration. Each sample will show the required options with some
+explanation on how to fill them and documentation links.
+
+It will also provide flags to configure a specific database (similar to the
+flags present on the `teleport db start` command). When executed with these
+flags, the samples will not be included, only the static configuration of a
+single database.
+
+```bash
+teleport db configure create [--proxy] [--token=] [--discovery-rds=] [--discovery-redshift] [--output=] [--ca-pin=] [--name=] [--protocol=] [--uri=] [--labels=]
+```
+
+| Flag                            | Description |
+| ------------------------------- | ----------- |
+| `--proxy`                       | Teleport proxy address to connect to [0.0.0.0:3080]. |
+| `--token`                       | Invitation token to register with an auth server [none]. |
+| `--discovery-rds`               | List of AWS regions the agent will discover for RDS/Aurora instances. |
+| `--discovery-redshift`          | List of AWS regions the agent will discover for Redshift instances. |
+| `--output`                      | Write to stdout with -o=stdout, default config file with -o=file or custom path with -o=file:///path |
+| `--ca-pin`                      | CA pin to validate the auth server (can be repeated for multiple pins). |
+| `--name`                        | Name of the proxied database. |
+| `--protocol`                    | Proxied database protocol. Supported are: [postgres mysql mongodb cockroachdb]. |
+| `--uri`                         | Address the proxied database is reachable at. |
+| `--description`                 | Description of the proxied database. Default: "" |
+| `--labels`                      | Comma-separated list of labels for the database, for example env=dev,dept=it |
+
+* When configuring a single database, `name`, `protocol` and `uri` are required;
+
+**Examples:**
+
+None of the flags are required. Running the command without flags should output
+a configuration with samples.
+
+```bash
+# will generate a configuration file for the database agent.
+$ teleport db configure create
+
+#
+# Teleport database agent configuration file.
+# Configuration reference: https://goteleport.com/docs/database-access/reference/configuration/
+#
+version: v2
+teleport:
+  nodename: localhost
+  data_dir: /var/lib/teleport
+  auth_token: /tmp/token
+  auth_servers:
+  - 127.0.0.1:3025
+db_service:
+  enabled: "yes"
+  # Matchers for database resources created with "tctl create" command.
+  # For more information: https://goteleport.com/docs/database-access/guides/dynamic-registration/
+  resources:
+  - labels:
+      "*": "*"
+  # Lists statically registered databases proxied by this agent.
+  # databases:
+  # # RDS database static configuration.
+  # # RDS/Aurora databases Auto-discovery reference: https://goteleport.com/docs/database-access/guides/rds/
+  # - name: rds
+  #   description: AWS RDS/Aurora instance configuration example.
+  #   # Supported protocols for RDS/Aurora: "postgres" or "mysql"
+  #   protocol: postgres
+  #   # Database connection endpoint. Must be reachable from Database Service.
+  #   uri: rds-instance-1.abcdefghijklmnop.us-west-1.rds.amazonaws.com:5432
+  #   # AWS specific configuration.
+  #   aws:
+  #     # Region the database is deployed in.
+  #     region: us-west-1
+  #     # RDS/Aurora specific configuration.
+  #     rds:
+  #       # RDS Instance ID. Only present on RDS databases.
+  #       instance_id: rds-instance-1
+  # # Aurora database static configuration.
+  # # RDS/Aurora databases Auto-discovery reference: https://goteleport.com/docs/database-access/guides/rds/
+  # - name: aurora
+  #   description: AWS Aurora cluster configuration example.
+  #   # Supported protocols for RDS/Aurora: "postgres" or "mysql"
+  #   protocol: postgres
+  #   # Database connection endpoint. Must be reachable from Database Service.
+  #   uri: aurora-cluster-1.abcdefghijklmnop.us-west-1.rds.amazonaws.com:5432
+  #   # AWS specific configuration.
+  #   aws:
+  #     # Region the database is deployed in.
+  #     region: us-west-1
+  #     # RDS/Aurora specific configuration.
+  #     rds:
+  #       # Aurora Cluster ID. Only present on Aurora databases.
+  #       cluster_id: aurora-cluster-1
+  # # Redshift database static configuration.
+  # # For more information: https://goteleport.com/docs/database-access/guides/postgres-redshift/
+  # - name: redshift
+  #   description: AWS Redshift cluster configuration example.
+  #   # Supported protocols for Redshift: "postgres".
+  #   protocol: postgres
+  #   # Database connection endpoint. Must be reachable from Database service.
+  #   uri: redshift-cluster-example-1.abcdefghijklmnop.us-west-1.redshift.amazonaws.com:5439
+  #   # AWS specific configuration.
+  #   aws:
+  #     # Region the database is deployed in.
+  #     region: us-west-1
+  #     # Redshift specific configuration.
+  #     redshift:
+  #       # Redshift Cluster ID.
+  #       cluster_id: redshift-cluster-example-1
+  # # Self-hosted static configuration.
+  # - name: self-hosted
+  #   description: Self-hosted database configuration.
+  #   # Supported protocols for self-hosted: postgres, mysql, mongodb, cockroachdb.
+  #   protocol: postgres
+  #   # Database connection endpoint. Must be reachable from Database service.
+  #   uri: database.example.com:5432
+auth_service:
+  enabled: "no"
+ssh_service:
+  enabled: "no"
+proxy_service:
+  enabled: "no"
+```
+
+Similarly to configure command, it will also support writing the configuration
+directly to a file.
+
+```bash
+# write to the default file location.
+$ teleport db configure create --output file
+
+Wrote config to file "/etc/teleport.yaml". Now you can start the server. Happy Teleporting!
+```
+
+```bash
+# write to the provided file location.
+$ teleport db configure create --output file:///teleport.yaml
+
+Wrote config to file "/teleport.yaml". Now you can start the server. Happy Teleporting!
+```
+
+Configure a single database.
+
+```bash
+# generates a configuration for a Postgres database.
+$ teleport db configure create \
+   --token=/tmp/token \
+   --auth-server=localhost:3025 \
+   --name=sample-db \
+   --protocol=postgres \
+   --uri=postgres://localhost:5432
+```
+
+### Bootstrap permissions command
 
-The "configure" command will provide subcommands for configuring database agents
-in different environments. This RFD focuses on `aws` subcommands that deal with
-configuring IAM for agents that proxy AWS-hosted databases (RDS, Aurora,
-Redshift).
+Subcommand will bootstrap the necessary configuration for the database agent. It
+reads the provided agent configuration to determine what will be bootstrapped.
+
+```bash
+$ teleport db configure bootstrap [-c=,--config=] [--manual] [--policy-name=] [--attach-to-user=] [--attach-to-role=] [--confirm]
+```
+
+| Flag               | Description |
+| ------------------ | ----------- |
+| `-c, --config`     | Path to the database agent configuration file. Default: "/etc/teleport.yaml". |
+| `--manual`         | When executed in "manual" mode, it will print the instructions to complete the configuration instead of applying them directly. |
+| `--policy-name`    | Name of the Teleport Database agent policy. Default: "DatabaseAccess". |
+| `--attach-to-role` | Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
+| `--attach-to-user` | User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
+| `--confirm`        | Do not prompt the user and auto-confirm all actions. Defaults to false. |
+
+**Examples:**
+
+```bash
+# When the database configuration has RDS/Aurora or Redshift auto-discovery.
+# Configure AWS provider attaching the created policies to “SampleUser” when confirmation is given.
+$ teleport db configure bootstrap --attach-to-user SampleUser
+Reading configuration at "/etc/teleport.yaml"...
+
+AWS
+1. Create IAM policy "DatabaseAccess":
+{ ...policy document... }
+
+2. Create IAM boundary policy "DatabaseAccessBoundary":
+{ ...policy document... }
+
+3. Attach policy and boundary to "SampleUser".
+
+Confirm actions? [y/N] y
+✅[AWS] Creating IAM Policy "DatabaseAccess"... done.
+✅[AWS] Creating IAM policy boundary "DatabaseAcessBoundary"... done.
+✅[AWS] Attaching IAM policy and boundary to IAM user "SampleUser"... done.
+```
+
+```bash
+# When the database configuration has RDS/Aurora or Redshift auto-discovery.
+# Configure AWS provider attaching the created policies to “SampleUser”.
+$ teleport db configure bootstrap --attach-to-user SampleUser --confirm
+Reading configuration at "/etc/teleport.yaml"...
+
+AWS
+1. Create IAM policy "DatabaseAccess":
+{ ...policy document... }
+
+2. Create IAM boundary policy "DatabaseAccessBoundary":
+{ ...policy document... }
+
+3. Attach policy and boundary to "SampleUser".
+
+✅[AWS] Creating IAM Policy "DatabaseAccess"... done.
+✅[AWS] Creating IAM policy boundary "DatabaseAcessBoundary"... done.
+✅[AWS] Attaching IAM policy and boundary to IAM user "SampleUser"... done.
+```
+
+```bash
+# When the database configuration has RDS/Aurora or Redshift auto-discovery.
+# Show instructions on how to configure AWS.
+$ teleport db configure bootstrap --manual --attach-to-user SampleUser
+Reading configuration at "/etc/teleport.yaml"...
+Running in "manual" mode, there will be presented the instructions to bootstrap the agent.
+
+AWS
+1. Create IAM policy "DatabaseAccess":
+{ ...policy document... }
+
+2. Create IAM boundary policy "DatabaseAccessBoundary":
+{ ...policy document... }
+
+3. Attach policy and boundary to "username".
+```
+
+```bash
+# When the database agent has a configuration that requires no bootstrapping.
+$ teleport db configure bootstrap
+Reading configuration at "/etc/teleport.yaml"...
+Nothing to be bootstrapped.
+```
+
+#### Error handling:
+
+No external calls will be issued when running with `--mode=manual`, meaning the
+command won't fail. In automatic mode, however, if the command fails, the error
+will be presented.
+
+**Examples:**
+
+```bash
+# Fails to attach the created policy into the user.
+$ teleport db configure bootstrap --attach-to-user SampleUser
+Reading configuration at "/etc/teleport.yaml"...
+
+AWS
+1. Create IAM policy "DatabaseAccess":
+{ ...policy document... }
+
+2. Create IAM boundary policy "DatabaseAccessBoundary":
+{ ...policy document... }
+
+3. Attach policy and boundary to "SampleUser".
+
+Confirm actions? [y/N] y
+✅[AWS] Creating IAM Policy "DatabaseAccess"... done.
+✅[AWS] Creating IAM policy boundary "DatabaseAcessBoundary"... done.
+❌[AWS] Attaching IAM policy and boundary to IAM user "SampleUser"... failed.
+Failure reason: unable to find user "SampleUser".
+```
+
+### AWS subcommand
 
 ```bash
 $ teleport db configure aws ...
@@ -92,7 +364,7 @@ $ teleport db configure aws create-iam
 $ teleport db configure aws print-iam
 ```
 
-### Automatic mode
+#### Automatic mode
 
 To use automatic mode, user needs to run `teleport db configure aws` command
 on the machine with permissions to create and attach IAM policies.
@@ -111,14 +383,14 @@ The command will:
 $ teleport db configure aws create-iam [--name=] [--types=] [--attach] [--role=|--user=] [--confirm]
 ```
 
-| Flag          | Description |
-| ------------- | ----------- |
-| `--name`      | Created policy name. Defaults to empty. Will be auto-generated if not provided. |
-| `--types`     | Permissions to include in the policy. Any of `rds`, `aurora`, `redshift`. Defaults to none. |
-| `--attach`    | Try to attach the policy to the IAM identity. Defaults to `true`. |
-| `--role`      | IAM role name to attach policy to. Mutually exclusive with `--user`. Defaults to empty. |
-| `--user`      | IAM user name to attach policy to. Mutually exclusive with `--role`. Defaults to empty. |
-| `--confirm`   | Do not prompt user and auto-confirm all actions. Defaults to `false`. |
+| Flag        | Description |
+| ----------- | ----------- |
+| `--name`    | Created policy name. Defaults to empty. Will be auto-generated if not provided. |
+| `--types`   | Permissions to include in the policy. Any of `rds`, `aurora`, `redshift`. Defaults to none. |
+| `--attach`  | Try to attach the policy to the IAM identity. Defaults to `true`. |
+| `--role`    | IAM role name to attach policy to. Mutually exclusive with `--user`. Defaults to empty. |
+| `--user`    | IAM user name to attach policy to. Mutually exclusive with `--role`. Defaults to empty. |
+| `--confirm` | Do not prompt user and auto-confirm all actions. Defaults to `false`. |
 
 * At least one type must be specified via `--types` flag.
 * If neither `--role` nor `--user` is specified, tries to attach the policy to the identity of current AWS credentials.
@@ -171,7 +443,7 @@ Example output:
 ✅ Attaching IAM policy and boundary to DatabaseAgentRole... done
 ```
 
-#### Error handling
+##### Error handling
 
 In case the automatic mode encounters a permission or any other kind of error
 (e.g. policy doesn't allow creating or attaching other policies), it falls back
@@ -180,7 +452,7 @@ to manual mode where it prints:
 - IAM permissions it requires to be able to create and attach these policies.
 - Policy and boundary in case user wants to create them themselves.
 
-### Manual mode
+#### Manual mode
 
 In manual mode configurator only prints the policy and boundary. User is
 responsible for creating and attaching them to IAM identity themselves.
@@ -193,13 +465,13 @@ respective policy/boundary documents, suitable for automation tools.
 $ teleport db configure aws print-iam [--types=] [--role=|--user=] [--policy|--boundary]
 ```
 
-| Flag          | Description |
-| ------------- | ----------- |
-| `--types`     | Permissions to include in the policy. Any of `rds`, `aurora`, `redshift`. Defaults to none. |
-| `--role`      | IAM role name to attach policy to. Mutually exclusive with `--user`. Defaults to empty. |
-| `--user`      | IAM user name to attach policy to. Mutually exclusive with `--role`. Defaults to empty. |
-| `--policy`    | Only print IAM policy document. Defaults to `false`. |
-| `--boundary`  | Only print IAM boundary policy document. Defaults to `false`. |
+| Flag         | Description |
+| ------------ | ----------- |
+| `--types`    | Permissions to include in the policy. Any of `rds`, `aurora`, `redshift`. Defaults to none. |
+| `--role`     | IAM role name to attach policy to. Mutually exclusive with `--user`. Defaults to empty. |
+| `--user`     | IAM user name to attach policy to. Mutually exclusive with `--role`. Defaults to empty. |
+| `--policy`   | Only print IAM policy document. Defaults to `false`. |
+| `--boundary` | Only print IAM boundary policy document. Defaults to `false`. |
 
 **Examples:**
 
@@ -253,3 +525,78 @@ $ teleport db configure azure ...
 $ teleport db configure postgres ...
 $ teleport db configure mysql ...
 ```
+
+## Security
+
+The bootstrap command doesn’t communicate with Teleport instances. However, it
+makes calls to the AWS API. As mentioned earlier, the command won’t request the
+AWS credentials, and it relies on the [default AWS credential provider
+chain](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials).
+
+### Necessary permissions
+When executed in "automatic" mode, the bootstrap command will require the
+current identity to have the following permissions:
+
+**Policy-related:**
+- `iam:GetPolicy` wildcard ("*") or the policy to be retrieved: Used to identify
+  if a policy already exists to update it.
+- `iam.ListPolicyVersions`: wildcard ("*") or the policy to be retrieved: Used
+  to identify if the policy exceeds the policy versions limit;
+- `iam:CreatePolicy` wildcard ("*") or policy that will be created: Used when
+  the policy doesn’t exist.
+- `iam:DeletePolicyVersion` wildcard ("*") or policy that will be created: Used
+  when the policy exceeds the version’s limit. It will then delete the oldest
+  non-default version.
+- `iam:CreatePolicyVersion` wildcard ("*") or policy that will be created: Used
+  when the policy already exists and will be updated;
+
+**Identity-related:**
+- `iam:AttachUserPolicy` wildcard ("*") or provided user identity: Needed to
+  attach the policy to the user. Only necessary when attaching policies to a
+  user;
+- `iam:AttachRolePolicy` wildcard ("*") or provided role identity: Needed to
+  attach the policy to the role. Only necessary when attaching policies to a
+  role;
+- `iam:PutUserPermissionsBoundary` wildcard ("*") or provided user identity:
+  Needed to attach boundary policy to the user. Only necessary when attaching
+  policies to a user;
+- `iam:PutRolePermissionsBoundary` wildcard ("*") or provided role identity:
+  Needed to attach boundary policy to the role. Only necessary when attaching
+  policies to a role;
+
+### IAM policies
+The IAM policies created by the bootstrap command will follow the AWS
+recommendation of [least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege),
+meaning that the Teleport database access policies will be granted permissions
+based on the agent configuration. For example, the policy won’t include
+RDS/Aurora permissions if the agent only has Redshift databases configured.
+
+#### RDS databases and Aurora clusters
+If the configuration has any static RDS/Aurora database or auto-discovery
+enabled, the following permissions will be added:
+
+- `rds:DescribeDBInstances`: Is a list operation, only supporting wildcard resources;
+- `rds:ModifyDBInstance`: Since the databases that will be modified are only
+  known during the discovery process or configured using dynamic registration,
+  we need wildcard access;
+- `rds:DescribeDBClusters`: Is a list operation, only supporting wildcard
+  resources;
+- `rds:ModifyDBCluster`: Since the clusters that will be modified are only known
+  during the discovery process or configured using dynamic registration, we
+  need wildcard access;
+
+##### Boundary
+- `rds-db:connect`: The list of database/clusters the Teleport agent will
+  connect to is only known after the discovery; we need wildcard access;
+
+#### Redshift clusters
+If the configuration has any static Redshift cluster or auto-discovery enabled,
+the following permissions will be added:
+
+- `redshift:DescribeClusters`: Is a list operation, only supporting wildcard
+  resources.
+
+##### Boundary
+- `redshift:GetClusterCredentials`: The list of clusters the Teleport agent will
+  get credentials to is only known after the discovery or configured using
+  dynamic registration; we need wildcard access;
diff --git a/rfd/0056-sql-backend.md b/rfd/0056-sql-backend.md
new file mode 100644
index 0000000000000..d4d792611703c
--- /dev/null
+++ b/rfd/0056-sql-backend.md
@@ -0,0 +1,137 @@
+---
+authors: Jim Bishopp (jim@goteleport.com)
+state: draft
+---
+
+# RFD 56 - SQL Backend
+
+
+## What
+
+A Teleport Backend is a pluggable interface for storing core cluster state.
+This RFD proposes the addition of a new backend supporting SQL database platforms.
+The initial supported platforms for the SQL Backend will be PostgreSQL and 
+CockroachDB. Support will include self-hosted PostgreSQL/CockroachDB or 
+hosting the database on a cloud provider platform (AWS/GCP).
+
+
+## Why
+
+Supporting a SQL Backend reduces onboarding time for Teleport customers by
+allowing them to use existing infrastructure.
+
+
+## Scope
+
+This RFD focuses on implementing a SQL Backend for PostgreSQL and CockroachDB
+where the database is either self-hosted or cloud-hosted. The implementation's 
+design will be extensible to allow future work that supports other SQL databases
+such as MySQL.
+
+Cloud-hosted configurations will support AWS RDS/Aurora/Redshift and GCP Cloud SQL.
+
+The implementation will support connecting to a single endpoint. Failover to
+a secondary endpoint will not be supported but may be considered in a future
+proposal.
+
+
+## Authentication
+
+Self-hosted configurations will require mutual TLS authentication using
+user-generated client certificates. The user's CA, client certificate, and
+client key must be added to the Teleport configuration file. Users must ensure
+the provided CA is trusted by the host where the Teleport authentication server
+is running.
+
+AWS and GCP cloud-hosted configurations require IAM. Teleport uses the
+default credential provider for both AWS and GCP to authenticate using IAM.
+
+Mutual TLS authentication is optionally supported for GCP Cloud SQL.
+Paths to a client certificate and key must be added to the Teleport
+configuration file to enable mTLS.
+
+
+## UX
+
+Teleport users must first configure the instance and database where Teleport will 
+store its data. A new database instance and user must be created. The new user
+should be granted ownership of the new database and have the ability to login.
+And cloud-hosted configurations must configure and enable IAM.
+
+Once the database instance and user are created, Teleport users must enable the
+SQL Backend by configuring the storage section in the Teleport configuration
+file. Setting the storage type to either `postgres` or `cockroachdb` enables the
+SQL Backend. Additional configurations may apply depending on whether the
+configuration is for self-hosted or cloud-hosted environments.
+
+```yaml
+teleport:
+  storage:
+    # Type of storage backend (postgres or cockroachdb).
+    type: postgres
+
+    # Database connection address.
+    addr: "postgres.example.com:5432"
+
+    # Optional database name that Teleport will use to store its data.
+    # Defaults to "teleport". The database must not be shared.
+    database: "teleport"
+
+    # TLS validation and mutual authentication.
+    tls:
+      # Path to the CA file that Teleport will use to verify TLS connections.
+      ca_file: /var/lib/teleport/backend.ca.crt
+
+      # Paths to the client certificate and key Teleport will use for mutual
+      # TLS authentication. Required for self-hosted configurations. Optional
+      # for GCP Cloud SQL. Not supported for AWS.
+      client_cert_file: /var/lib/teleport/backend-client.crt
+      client_key_file: /var/lib/teleport/backend-client.key
+
+    # AWS specific configuration, only required for RDS/Aurora/Redshift.
+    aws:
+      # Region the database is deployed in.
+      region: "us-east-1"
+
+      # Redshift specific configuration (postgres only).
+      redshift:
+        # Redshift cluster identifier.
+        cluster_id: "redshift-cluster-1"
+
+    # GCP specific configuration, only required for Cloud SQL.
+    gcp:
+      # GCP project ID.
+      project_id: "xxx-1234"
+      # Cloud SQL instance ID.
+      instance_id: "example"
+```
+
+## Implementation Details
+
+Users can set the Teleport storage type to either `postgres` or `cockroachdb`.
+The initial implementation will use the same PostgreSQL driver for both settings.
+
+Future iterations of Teleport will be able to easily create a unique `cockroachdb`
+driver implementation if CockroachDB specific functionality is desired, such as
+using hash-sharded indexes, which are not available in PostgreSQL.
+
+### Transaction Isolation
+
+One difference between CockroachDB and PostgreSQL is how they handle transaction
+isolation. CockroachDB [always uses `SERIALIZABLE` isolation][1], which is the
+strongest of the [four transaction isolation levels][2].
+
+The `SERIALIZABLE` isolation level guarantees that even though transactions may
+execute in parallel, the result is the same as if they had executed one at a time,
+without any concurrency.
+
+The SQL Backend will enforce `SERIALIZABLE` transaction isolation for all database 
+platforms. The trade-off is data consistency versus slower execution and the need
+to retry transactions when a conflict occurs. Teleport's Backend interface assumes
+consistency. E.g. the `Create` function requires the new record does not exist, and
+`CompareAndSwap` requires the previous record has a specific value. Using
+`SERIALIZABLE` is the desirable isolation level for the majority of Teleport Backend 
+functionality.
+
+[1]: https://www.cockroachlabs.com/docs/stable/demo-serializable.html
+[2]: https://en.wikipedia.org/wiki/Isolation_(database_systems)#Isolation_levels
diff --git a/rfd/0060-gRPC-backend.md b/rfd/0060-gRPC-backend.md
new file mode 100644
index 0000000000000..c5e9d7ff3443e
--- /dev/null
+++ b/rfd/0060-gRPC-backend.md
@@ -0,0 +1,200 @@
+---
+authors: Michael McAllister (michael.mcallister@goteleport.com)
+state: draft
+---
+
+# RFD 60 - gRPC Backend
+
+## What
+
+A new [backend](https://github.com/gravitational/teleport/tree/v8.3.1/lib/backend) that sends requests to a user defined gRPC server for persistence. Initially targeting cluster state with audit events to come later (in a subsequent RFD)
+
+## Why
+
+As Cloud-Hosted Teleport continues to grow, so does our need to have greater flexibility on not only what persistence layer we use (be it currently supported backends like DynamoDB, or otherwise) but _how_ these are implemented. 
+
+Take for instance, the current implementation of the [DynamoDB backend](https://github.com/gravitational/teleport/tree/v8.3.1/lib/backend/dynamo) which allows in its configuration to specify the table name, but does not presently have the ability to customize the Partition key. This means that it's not possible to co-locate multiple installations of Teleport within the same DynamoDB table, and as a result are bounded by [AWS account limits](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ServiceQuotas.html#limits-tables) when deploying multiple installations.
+
+Other backend solutions have their own challenges regarding authentication and authorization. For instance, most databases have limits on the number of users/roles that you can define which we'd need to leverage to ensure strong data isolation between each deployment. Using an authentication method that would allow one tenant to access another tenants data would be a non-option. 
+
+Implementing a gRPC client within Teleport allows not only the Cloud team, but external developers to implement:
+ - A custom persistence layer that may not be supported by Teleport natively
+ - Custom caching logic, connection pooling, etc.
+ - Custom database schema, partition scheme, etc.
+ - Custom authentication and authorization (mTLS, LDAP, etc.)
+
+## Details
+
+### Scope
+
+It is proposed that the Teleport core codebase hold the protocol buffer definitions and the corresponding client.
+
+To keep this RFD brief the Cloud teams (aspirational) implementation of the corresponding gRPC server is out of scope of this documentation and not discussed in detail, it will also be wholly owned by the Cloud team and not apart of the core codebase.
+
+Additionally audit events are initially outside of scope, but will be implemented at a later date.
+
+### Protobuf Definition
+
+The proposed protobuf definition aims to mirror the interface that is defined in [backend.go](https://github.com/gravitational/teleport/blob/cf162af679f3c136b0cc5a7c5bfcd8bba14afdaa/lib/backend/backend.go#L41-L91)
+
+```protobuf
+message Item {
+    // Key is a key of the key value item
+    bytes key = 1;
+
+    // Value is a value of the key value item
+    bytes value = 2;
+
+    // Expires is an optional record expiry time
+    google.protobuf.Timestamp expires = 3 [
+        (gogoproto.stdtime) = true,
+        (gogoproto.nullable) = false
+    ];
+
+    // ID is a record ID, newer records have newer ids
+    sfixed64 id = 4;
+
+    // LeaseID is a lease ID, could be set on objects with TTL
+    sfixed64 lease_id = 5;
+}
+
+message Lease {
+    // Key is a key of the key value item
+    bytes key = 1;
+
+    // ID is a record ID, newer records have newer ids
+    sfixed64 id = 2;
+}
+
+message Watch {
+    // resume_last_id is the last item index we saw, and we want to resume from any event after that point
+    sfixed64 resume_last_id = 1;
+}
+
+message CompareAndSwapRequest {
+    // Expected is the existing item
+    Item expected = 1;
+
+    // replace_with is the new item to swap
+    Item replace_with = 2;
+}
+
+message GetRequest {
+    // Key is a key of the key value item
+    bytes key = 1;
+}
+
+message GetRangeRequest {
+    // start_key is the starting key to request in the range request
+    bytes start_key = 1;
+
+    // end_key is the ending key to request in the range request
+    bytes end_key = 2;
+
+    // limit is the maximum number of results to return
+    int32 limit = 3;
+}
+
+message GetRangeResult {
+    repeated Item items = 1;
+}
+
+message DeleteRequest {
+    // Key is a key of the key value item
+    bytes key = 1;
+}
+
+message DeleteRangeRequest {
+    // start_key is the starting key to request in the range request
+    bytes start_key = 1;
+
+    // end_key is the ending key to request in the range request
+    bytes end_key = 2;
+}
+
+message KeepAliveRequest {
+    Lease lease = 1;
+    google.protobuf.Timestamp expires = 2 [
+        (gogoproto.stdtime) = true,
+        (gogoproto.nullable) = false
+    ];
+}
+
+
+message Event {
+   // OpType specifies operation type
+   enum OpType {
+      UNKNOWN = 0;
+      UNRELIABLE = 1;
+      INVALID = 2;
+      INIT = 3;
+      PUT = 4;
+      DELETE = 5;
+      GET = 6;
+   }
+   OpType type = 1;
+   Item item = 2;
+}
+
+service BackendService {
+    // Create creates item if it does not exist
+    rpc Create(Item) returns (Lease);
+
+    // Put upserts value into backend
+    rpc Put(Item) returns (Lease);
+
+    // CompareAndSwap compares item with existing item and replaces is with replace_with item
+    rpc CompareAndSwap(CompareAndSwapRequest) returns (Lease);
+
+    // Update updates value in the backend
+    rpc Update(Item) returns (Lease);
+
+    // Get returns a single item or not found error
+    rpc Get(GetRequest) returns (Item);
+
+    // GetRange returns query range
+    rpc GetRange(GetRangeRequest) returns (GetRangeResult);
+
+    // Delete deletes item by key, returns NotFound error if item does not exist
+    rpc Delete(DeleteRequest) returns (google.protobuf.Empty);
+
+    // DeleteRange deletes range of items with keys between startKey and endKey
+    rpc DeleteRange(DeleteRangeRequest) returns (google.protobuf.Empty);
+
+    // KeepAlive keeps object from expiring, updates lease on the existing object,
+	 // expires contains the new expiry to set on the lease,
+	 // some backends may ignore expires based on the implementation
+	 // in case if the lease managed server side
+    rpc KeepAlive(KeepAliveRequest) returns (google.protobuf.Empty);
+
+    // NewWatcher returns a new event watcher
+    rpc NewWatcher(Watch) returns (stream Event);
+}
+```
+
+### Configuration
+
+In order for the gRPC client (the Teleport side) to be able to talk to a server, at minimum the address of the server providing the gRPC service will be required, additionally the following existing configuration properties will be reused:
+
+- buffer size for client size buffering 
+- mTLS details (CA, Cert, Key) (currently used for etcd)
+
+Representing this in yaml the storage stanza of the configuration could potentially look like:
+```yaml
+storage:
+   type: grpc
+   server: endpoint.example.com:1992
+   tls_ca_file: /secrets/grpc/ca.crt
+   tls_cert_file: /secrets/grpc/tls.crt
+   tls_key_file:  /secrets/tls.key
+   audit_events_uri: ['dynamodb://example-ddb-table.events'] # Future iteration will support grpc://endpoint.example.com:1992
+   audit_sessions_uri: s3://example-bucket/sessions
+   continuous_backups: true
+   auto_scaling: true
+   read_min_capacity: 20
+   read_max_capacity: 100
+   read_target_value: 50.0
+   write_min_capacity: 10
+   write_max_capacity: 100
+   write_target_value: 70.0
+```
\ No newline at end of file
diff --git a/tool/tbot/botfs/botfs.go b/tool/tbot/botfs/botfs.go
new file mode 100644
index 0000000000000..ceacbb49fd071
--- /dev/null
+++ b/tool/tbot/botfs/botfs.go
@@ -0,0 +1,156 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package botfs
+
+import (
+	"io/fs"
+	"os"
+	"os/user"
+	"runtime"
+	"strconv"
+	"syscall"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/trace"
+	"github.com/sirupsen/logrus"
+)
+
+var log = logrus.WithFields(logrus.Fields{
+	trace.Component: teleport.ComponentTBot,
+})
+
+// SymlinksMode is an enum type listing various symlink behavior modes.
+type SymlinksMode string
+
+const (
+	// SymlinksInsecure does allow resolving symlink paths and does not issue
+	// any symlink-related warnings.
+	SymlinksInsecure SymlinksMode = "insecure"
+
+	// SymlinksTrySecure attempts to write files securely and avoid symlink
+	// attacks, but falls back with a warning if the necessary OS / kernel
+	// support is missing.
+	SymlinksTrySecure SymlinksMode = "try-secure"
+
+	// SymlinksSecure attempts to write files securely and fails with an error
+	// if the operation fails. This should be the default on systems where we
+	// expect it to be supported.
+	SymlinksSecure SymlinksMode = "secure"
+)
+
+// ACLMode is an enum type listing various ACL behavior modes.
+type ACLMode string
+
+const (
+	// ACLOff disables ACLs
+	ACLOff ACLMode = "off"
+
+	// ACLTry attempts to use ACLs but falls back to no ACLs with a warning if
+	// unavailable.
+	ACLTry ACLMode = "try"
+
+	// ACLRequired enables ACL support and fails if ACLs are unavailable.
+	ACLRequired ACLMode = "required"
+)
+
+const (
+	// DefaultMode is the preferred permissions mode for bot files.
+	DefaultMode fs.FileMode = 0600
+
+	// DefaultDirMode is the preferred permissions mode for bot directories.
+	// Directories need the execute bit set for most operations on their
+	// contents to succeed.
+	DefaultDirMode fs.FileMode = 0700
+)
+
+// ACLOptions contains parameters needed to configure ACLs
+type ACLOptions struct {
+	// BotUser is the bot user that should have write access to this entry
+	BotUser *user.User
+
+	// ReaderUser is the user that should have read access to the file. This
+	// may be nil if the reader user is not known.
+	ReaderUser *user.User
+}
+
+// openStandard attempts to open the given path for writing with O_CREATE set.
+func openStandard(path string) (*os.File, error) {
+	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, DefaultMode)
+	if err != nil {
+		return nil, trace.ConvertSystemError(err)
+	}
+
+	return file, nil
+}
+
+// createStandard creates an empty file or directory at the given path without
+// attempting to prevent symlink attacks.
+func createStandard(path string, isDir bool) error {
+	if isDir {
+		if err := os.Mkdir(path, DefaultDirMode); err != nil {
+			return trace.ConvertSystemError(err)
+		}
+
+		return nil
+	}
+
+	f, err := openStandard(path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := f.Close(); err != nil {
+		log.Warnf("Failed to close file at %q: %+v", path, err)
+	}
+
+	return nil
+}
+
+// GetOwner attempts to retrieve the owner of the given file. This is not
+// supported on all platforms and will return a trace.NotImplemented in that
+// case.
+func GetOwner(fileInfo fs.FileInfo) (*user.User, error) {
+	info, ok := fileInfo.Sys().(*syscall.Stat_t)
+	if !ok {
+		return nil, trace.NotImplemented("Cannot verify file ownership on this platform.")
+	}
+
+	user, err := user.LookupId(strconv.Itoa(int(info.Uid)))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return user, nil
+}
+
+// IsOwnedBy checks that the file at the given path is owned by the given user.
+// Returns a trace.NotImplemented() on unsupported platforms.
+func IsOwnedBy(fileInfo fs.FileInfo, user *user.User) (bool, error) {
+	if runtime.GOOS == constants.WindowsOS {
+		// no-op on windows
+		return false, trace.NotImplemented("Cannot verify file ownership on this platform.")
+	}
+
+	info, ok := fileInfo.Sys().(*syscall.Stat_t)
+	if !ok {
+		return false, trace.NotImplemented("Cannot verify file ownership on this platform.")
+	}
+
+	// Our files are 0600, so don't bother checking gid.
+	return strconv.Itoa(int(info.Uid)) == user.Uid, nil
+}
diff --git a/tool/tbot/botfs/fs_linux.go b/tool/tbot/botfs/fs_linux.go
new file mode 100644
index 0000000000000..835fc6ab0ca95
--- /dev/null
+++ b/tool/tbot/botfs/fs_linux.go
@@ -0,0 +1,450 @@
+//go:build linux
+// +build linux
+
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package botfs
+
+import (
+	"io"
+	"io/fs"
+	"os"
+	"os/user"
+	"path/filepath"
+	"sync"
+
+	"github.com/coreos/go-semver/semver"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/trace"
+	"github.com/joshlf/go-acl"
+	"golang.org/x/sys/unix"
+)
+
+// Openat2MinKernel is the kernel release that adds support for the openat2()
+// syscall.
+const Openat2MinKernel = "5.6.0"
+
+// modeACLReadExecute is the permissions mode needed for read on directories.
+const modeACLReadExecute fs.FileMode = 05
+
+// modeACLReadWrite is the lower 3 bytes of a UNIX file mode for permission
+// bits, i.e. just one r/w/x.
+const modeACLReadWrite fs.FileMode = 06
+
+// modeACLReadWriteExecute is the permissions mode needed for full rwx on
+// directories.
+const modeACLReadWriteExecute fs.FileMode = 07
+
+// modeACLNone is the UNIX file mode for no permissions, used for group and
+// world read/write.
+const modeACLNone fs.FileMode = 0
+
+// missingSyscallWarning is used to reduce log spam when a syscall is missing.
+var missingSyscallWarning sync.Once
+
+// openSecure opens the given path for writing (with O_CREAT, mode 0600)
+// with the RESOLVE_NO_SYMLINKS flag set.
+func openSecure(path string) (*os.File, error) {
+	how := unix.OpenHow{
+		// Equivalent to 0600. Unfortunately it's not worth reusing our
+		// default file mode constant here.
+		Mode:    unix.O_RDONLY | unix.S_IRUSR | unix.S_IWUSR,
+		Flags:   unix.O_RDWR | unix.O_CREAT,
+		Resolve: unix.RESOLVE_NO_SYMLINKS,
+	}
+
+	fd, err := unix.Openat2(unix.AT_FDCWD, path, &how)
+	if err != nil {
+		// note: returning the original error here for comparison purposes
+		return nil, err
+	}
+
+	// os.File.Close() appears to close wrapped files sanely, so rely on that
+	// rather than relying on callers to use unix.Close(fd)
+	return os.NewFile(uintptr(fd), filepath.Base(path)), nil
+}
+
+// openSymlinks mode opens the file for read/write using the given symlink
+// mode, potentially failing or logging a warning if symlinks can't be
+// secured.
+func openSymlinksMode(path string, symlinksMode SymlinksMode) (*os.File, error) {
+	var file *os.File
+	var err error
+
+	switch symlinksMode {
+	case SymlinksSecure:
+		file, err = openSecure(path)
+		if err == unix.ENOSYS {
+			return nil, trace.Errorf("openSecure(%q) failed due to missing "+
+				"syscall; `symlinks: insecure` may be required for this "+
+				"system", path)
+		} else if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	case SymlinksTrySecure:
+		file, err = openSecure(path)
+		if err == unix.ENOSYS {
+			log.Warnf("Failed to write to %q securely due to missing "+
+				"syscall; falling back to regular file write. Set "+
+				"`symlinks: insecure` on this destination to disable this "+
+				"warning.", path)
+			file, err = openStandard(path)
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+		} else if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	case SymlinksInsecure:
+		file, err = openStandard(path)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	default:
+		return nil, trace.BadParameter("invalid symlinks mode %q", symlinksMode)
+	}
+
+	return file, nil
+}
+
+// createStandard creates an empty file or directory at the given path while
+// attempting to prevent symlink attacks.
+func createSecure(path string, isDir bool) error {
+	if isDir {
+		// We can't specify RESOLVE_NO_SYMLINKS for mkdir. This isn't the end
+		// of the world, though: if an attacker attempts a symlink attack we'll
+		// just open the correct file for read/write later (and error when it
+		// doesn't exist).
+		if err := os.Mkdir(path, DefaultDirMode); err != nil {
+			return trace.Wrap(err)
+		}
+
+		return nil
+	}
+
+	f, err := openSecure(path)
+	if err == unix.ENOSYS {
+		// bubble up the original error for comparison
+		return err
+	} else if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// No writing to do, just close it.
+	if err := f.Close(); err != nil {
+		log.Warnf("Failed to close file at %q: %+v", path, err)
+	}
+
+	return nil
+}
+
+// Create attempts to create the given file or directory with the given
+// symlinks mode.
+func Create(path string, isDir bool, symlinksMode SymlinksMode) error {
+	// Implementation note: paranoid file _creation_ is only really useful for
+	// providing an early warning if openat2() / ACLs are unsupported on the
+	// host system, as it will catch compatibility issues during `tbot init`.
+	// Read() and Write() with Symlinks(Try)Secure are the codepaths that
+	// actually prevents symlink attacks.
+
+	switch symlinksMode {
+	case SymlinksSecure:
+		if err := createSecure(path, isDir); err != nil {
+			if err == unix.ENOSYS {
+				return trace.Errorf("createSecure(%q) failed due to missing "+
+					"syscall; `symlinks: insecure` may be required for this "+
+					"system", path)
+			}
+
+			return trace.Wrap(err)
+		}
+	case SymlinksTrySecure:
+		err := createSecure(path, isDir)
+		if err == nil {
+			// All good, move on.
+			return nil
+		}
+
+		if err != unix.ENOSYS {
+			// Something else went wrong, fail.
+			return trace.Wrap(err)
+		}
+
+		// It's a bit gross to stuff this sync.Once into a global, but
+		// hopefully that's forgivable since it just manages a log message.
+		missingSyscallWarning.Do(func() {
+			log.Warnf("Failed to create %q securely due to missing syscall; "+
+				"falling back to regular file creation. Set `symlinks: "+
+				"insecure` on this destination to disable this warning.", path)
+		})
+
+		return trace.Wrap(createStandard(path, isDir))
+	case SymlinksInsecure:
+		return trace.Wrap(createStandard(path, isDir))
+	default:
+		return trace.BadParameter("invalid symlinks mode %q", symlinksMode)
+	}
+
+	return nil
+}
+
+// Read reads the contents of the given file into memory.
+func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
+	file, err := openSymlinksMode(path, symlinksMode)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	defer file.Close()
+
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return data, nil
+}
+
+// Write stores the given data to the file at the given path.
+func Write(path string, data []byte, symlinksMode SymlinksMode) error {
+	file, err := openSymlinksMode(path, symlinksMode)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	defer file.Close()
+
+	if _, err := file.Write(data); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// desiredPerms determines the desired bot permissions for an artifact at
+// the given path. Directories require read/exec, files require read/write.
+func desiredPerms(path string) (ownerMode fs.FileMode, botAndReaderMode fs.FileMode, err error) {
+	stat, err := os.Stat(path)
+	if err != nil {
+		return 0, 0, trace.Wrap(err)
+	}
+
+	botAndReaderMode = modeACLReadWrite
+	ownerMode = modeACLReadWrite
+	if stat.IsDir() {
+		botAndReaderMode = modeACLReadExecute
+		ownerMode = modeACLReadWriteExecute
+	}
+
+	return
+}
+
+// VerifyACL verifies whether the ACL of the given file allows writes from the
+// bot user. Errors may optionally be used as more informational warnings;
+// ConfigureACL can be used to correct them, assuming the user has permissions.
+func VerifyACL(path string, opts *ACLOptions) error {
+	current, err := acl.Get(path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	stat, err := os.Stat(path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	owner, err := GetOwner(stat)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	ownerMode, botAndReaderMode, err := desiredPerms(path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Attempt to determine the max # of expected user tags. We can't know the
+	// reader user in all cases because we only know it during `tbot init`, so
+	// instead we'll try to determine the upper bound of expected entries here.
+	maxExpectedUserTags := 2
+	if owner.Uid == opts.BotUser.Uid {
+		// This path is owned by the bot user, so at least one user tag will
+		// be missing.
+		maxExpectedUserTags--
+	}
+
+	// Also determine the minimum number of expected user tags. There should
+	// generally be at least 1 unless all users are the same.
+	minExpectedUserTags := 0
+	if owner.Uid != opts.BotUser.Uid {
+		minExpectedUserTags++
+	}
+	if opts.ReaderUser != nil && owner.Uid != opts.ReaderUser.Uid {
+		minExpectedUserTags++
+	}
+
+	userTagCount := 0
+	errors := []error{}
+
+	for _, entry := range current {
+		switch entry.Tag {
+		case acl.TagUserObj:
+			if entry.Perms != ownerMode {
+				errors = append(errors, trace.BadParameter("user entry has improper permissions %d", entry.Perms))
+			}
+		case acl.TagGroupObj:
+			if entry.Perms != modeACLNone {
+				errors = append(errors, trace.BadParameter("group entry has improper permissions %d", entry.Perms))
+			}
+		case acl.TagOther:
+			if entry.Perms != modeACLNone {
+				errors = append(errors, trace.BadParameter("other entry has improper permissions %d", entry.Perms))
+			}
+		case acl.TagMask:
+			if entry.Perms != botAndReaderMode {
+				errors = append(errors, trace.BadParameter("mask entry has improper permissions %d", entry.Perms))
+			}
+		case acl.TagGroup:
+			// Group tags currently not allowed.
+			errors = append(errors, trace.BadParameter("unexpected group entry found"))
+		case acl.TagUser:
+			userTagCount++
+
+			// It's only worth checking the qualifiers if we know all expected
+			// values in advance. We can't know them at bot runtime in any way
+			// that isn't also subject to e.g. an attacker with root / owner
+			// access, so we might as well not spam warnings every time we
+			// verify the ACLs. We'll have to rely on the tag counter instead.
+			if opts.BotUser != nil &&
+				opts.ReaderUser != nil &&
+				entry.Qualifier != opts.BotUser.Uid &&
+				entry.Qualifier != opts.ReaderUser.Uid {
+				errors = append(errors, trace.BadParameter("invalid qualifier %q for user entry", entry.Qualifier))
+			}
+
+			if entry.Perms != botAndReaderMode {
+				errors = append(errors, trace.BadParameter("invalid permissions %q for bot user entry", entry.Perms))
+			}
+		}
+	}
+
+	if userTagCount > maxExpectedUserTags {
+		errors = append(errors, trace.BadParameter("too many user tags found"))
+	} else if userTagCount < minExpectedUserTags {
+		errors = append(errors, trace.BadParameter("too few user tags found"))
+	}
+
+	return trace.NewAggregate(errors...)
+}
+
+// ConfigureACL configures ACLs of the given file to allow writes from the bot
+// user.
+func ConfigureACL(path string, owner *user.User, opts *ACLOptions) error {
+	if owner.Uid == opts.BotUser.Uid && owner.Uid == opts.ReaderUser.Uid {
+		// We'll end up with an empty ACL. This isn't technically a problem
+		log.Warnf("The owner, bot, and reader all appear to be the same "+
+			"user (%+v). This is an unusual configuration: consider setting "+
+			"`acls: off` in the destination config to remove this warning.",
+			owner.Username)
+	}
+
+	// We fully specify the ACL here to ensure the correct permissions are
+	// always set (rather than just appending an "allow" for the bot user).
+	// Note: These need to be sorted by tag value.
+	ownerMode, botAndReaderMode, err := desiredPerms(path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Note: ACL entries need to be ordered per acl_linux entryPriority
+	desiredACL := acl.ACL{
+		{
+			// Note: Mask does not apply to user object.
+			Tag:   acl.TagUserObj,
+			Perms: ownerMode,
+		},
+	}
+
+	// Only add an entry for the bot user if it isn't the owner.
+	if owner.Uid != opts.BotUser.Uid {
+		desiredACL = append(desiredACL, acl.Entry{
+			// Entry to allow the bot to read/write.
+			Tag:       acl.TagUser,
+			Qualifier: opts.BotUser.Uid,
+			Perms:     botAndReaderMode,
+		})
+	}
+
+	// Only add entry for the reader if it isn't the owner.
+	if owner.Uid != opts.ReaderUser.Uid {
+		desiredACL = append(desiredACL, acl.Entry{
+			// Entry to allow the reader user to read/write.
+			Tag:       acl.TagUser,
+			Qualifier: opts.ReaderUser.Uid,
+			Perms:     botAndReaderMode,
+		})
+	}
+
+	desiredACL = append(desiredACL,
+		acl.Entry{
+			Tag:   acl.TagGroupObj,
+			Perms: modeACLNone,
+		},
+		acl.Entry{
+			// Mask is the maximum permissions the ACL can grant. This should
+			// match the desired bot permissions.
+			Tag:   acl.TagMask,
+			Perms: botAndReaderMode,
+		},
+		acl.Entry{
+			Tag:   acl.TagOther,
+			Perms: modeACLNone,
+		},
+	)
+
+	// Note: we currently give both the bot and reader read/write to all the
+	// files. This is done for simplicity and shouldn't represent a security
+	// risk - the bot obviously knows the contents of the destination, and
+	// the files being writable to the reader is (maybe arguably) not a
+	// security issue.
+
+	log.Debugf("Configuring ACL on path %q: %v", path, desiredACL)
+	return trace.ConvertSystemError(trace.Wrap(acl.Set(path, desiredACL)))
+}
+
+// HasACLSupport determines if this binary / system supports ACLs.
+func HasACLSupport() (bool, error) {
+	// We just assume Linux _can_ support ACLs here, and will test for support
+	// at runtime.
+	return true, nil
+}
+
+// HasSecureWriteSupport determines if `CreateSecure()` should be supported
+// on this OS / kernel version. Note that it just checks the kernel version,
+// so this should be treated as a fallible hint.
+func HasSecureWriteSupport() (bool, error) {
+	minKernel := semver.New(Openat2MinKernel)
+	version, err := utils.KernelVersion()
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	if version.LessThan(*minKernel) {
+		return false, nil
+	}
+
+	return true, nil
+}
diff --git a/tool/tbot/botfs/fs_other.go b/tool/tbot/botfs/fs_other.go
new file mode 100644
index 0000000000000..87b2b90e3721a
--- /dev/null
+++ b/tool/tbot/botfs/fs_other.go
@@ -0,0 +1,113 @@
+//go:build !linux
+// +build !linux
+
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package botfs
+
+import (
+	"io"
+	"os/user"
+
+	"github.com/gravitational/trace"
+)
+
+// Create attempts to create the given file or directory without
+// evaluating symlinks. This is only supported on recent Linux kernel versions
+// (5.6+). The resulting file permissions are unspecified; Chmod should be
+// called afterward.
+func Create(path string, isDir bool, symlinksMode SymlinksMode) error {
+	if symlinksMode == SymlinksSecure {
+		return trace.BadParameter("cannot write with `symlinks: secure` on unsupported platform")
+	}
+
+	return trace.Wrap(createStandard(path, isDir))
+}
+
+// Read reads the contents of the given file into memory.
+func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
+	switch symlinksMode {
+	case SymlinksSecure:
+		return nil, trace.BadParameter("cannot read with `symlinks: secure` on unsupported platform")
+	case SymlinksTrySecure:
+		log.Warn("Secure symlinks not supported on this platform, set `symlinks: insecure` to disable this message", path)
+	}
+
+	file, err := openStandard(path)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	defer file.Close()
+
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return data, nil
+}
+
+// Write stores the given data to the file at the given path.
+func Write(path string, data []byte, symlinksMode SymlinksMode) error {
+	switch symlinksMode {
+	case SymlinksSecure:
+		return trace.BadParameter("cannot write with `symlinks: secure` on unsupported platform")
+	case SymlinksTrySecure:
+		log.Warn("Secure symlinks not supported on this platform, set `symlinks: insecure` to disable this message", path)
+	}
+
+	file, err := openStandard(path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	defer file.Close()
+
+	if _, err := file.Write(data); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+//nolint:staticcheck // staticcheck does not like our nop implementations.
+// VerifyACL verifies whether the ACL of the given file allows writes from the
+// bot user.
+func VerifyACL(path string, opts *ACLOptions) error {
+	return trace.NotImplemented("ACLs not supported on this platform")
+}
+
+//nolint:staticcheck // staticcheck does not like our nop implementations.
+// ConfigureACL configures ACLs of the given file to allow writes from the bot
+// user.
+func ConfigureACL(path string, owner *user.User, opts *ACLOptions) error {
+	return trace.NotImplemented("ACLs not supported on this platform")
+}
+
+// HasACLSupport determines if this binary / system supports ACLs. This
+// catch-all implementation just returns false.
+func HasACLSupport() (bool, error) {
+	return false, nil
+}
+
+// HasSecureWriteSupport determines if `CreateSecure()` should be supported
+// on this OS / kernel version. This is only supported on Linux, so this
+// catch-all implementation just returns false.
+func HasSecureWriteSupport() (bool, error) {
+	return false, nil
+}
diff --git a/tool/tbot/config/config.go b/tool/tbot/config/config.go
index b52a5bc21a2d1..a5a1523086f3b 100644
--- a/tool/tbot/config/config.go
+++ b/tool/tbot/config/config.go
@@ -34,6 +34,7 @@ import (
 const (
 	DefaultCertificateTTL = 60 * time.Minute
 	DefaultRenewInterval  = 20 * time.Minute
+	DefaultJoinMethod     = "token"
 )
 
 var log = logrus.WithFields(logrus.Fields{
@@ -60,9 +61,9 @@ type CLIConf struct {
 	// Token is a bot join token.
 	Token string
 
-	// RenewInterval is the interval at which certificates are renewed, as a
+	// RenewalInterval is the interval at which certificates are renewed, as a
 	// time.ParseDuration() string. It must be less than the certificate TTL.
-	RenewInterval time.Duration
+	RenewalInterval time.Duration
 
 	// CertificateTTL is the requested TTL of certificates. It should be some
 	// multiple of the renewal interval to allow for failed renewals.
@@ -71,6 +72,29 @@ type CLIConf struct {
 	// JoinMethod is the method the bot should use to exchange a token for the
 	// initial certificate
 	JoinMethod string
+
+	// Oneshot controls whether the bot quits after a single renewal.
+	Oneshot bool
+
+	// InitDir specifies which destination to initialize if multiple are
+	// configured.
+	InitDir string
+
+	// BotUser is a Unix username that should be given permission to write
+	BotUser string
+
+	// ReaderUser is the Unix username that will be reading the files
+	ReaderUser string
+
+	// Owner is the user:group that will own the destination files. Due to SSH
+	// restrictions on key permissions, it cannot be the same as the reader
+	// user. If ACL support is unused or unavailable, the reader user will own
+	// files directly.
+	Owner string
+
+	// Clean is a flag that, if set, instructs `tbot init` to remove existing
+	// unexpected files.
+	Clean bool
 }
 
 // OnboardingConfig contains values only required on first connect.
@@ -79,7 +103,7 @@ type OnboardingConfig struct {
 	Token string `yaml:"token"`
 
 	// CAPath is an optional path to a CA certificate.
-	CAPath string
+	CAPath string `yaml:"ca_path"`
 
 	// CAPins is a list of certificate authority pins, used to validate the
 	// connection to the Teleport auth server.
@@ -93,16 +117,21 @@ type OnboardingConfig struct {
 // BotConfig is the bot's root config object.
 type BotConfig struct {
 	Onboarding   *OnboardingConfig    `yaml:"onboarding,omitempty"`
-	Storage      StorageConfig        `yaml:"storage,omitempty"`
+	Storage      *StorageConfig       `yaml:"storage,omitempty"`
 	Destinations []*DestinationConfig `yaml:"destinations,omitempty"`
 
-	Debug          bool          `yaml:"debug"`
-	AuthServer     string        `yaml:"auth_server"`
-	CertificateTTL time.Duration `yaml:"certificate_ttl"`
-	RenewInterval  time.Duration `yaml:"renew_interval"`
+	Debug           bool          `yaml:"debug"`
+	AuthServer      string        `yaml:"auth_server"`
+	CertificateTTL  time.Duration `yaml:"certificate_ttl"`
+	RenewalInterval time.Duration `yaml:"renewal_interval"`
+	Oneshot         bool          `yaml:"oneshot"`
 }
 
 func (conf *BotConfig) CheckAndSetDefaults() error {
+	if conf.Storage == nil {
+		conf.Storage = &StorageConfig{}
+	}
+
 	if err := conf.Storage.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
@@ -113,21 +142,43 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 		}
 	}
 
-	if conf.AuthServer == "" {
-		return trace.BadParameter("an auth server address must be configured")
-	}
-
 	if conf.CertificateTTL == 0 {
 		conf.CertificateTTL = DefaultCertificateTTL
 	}
 
-	if conf.RenewInterval == 0 {
-		conf.RenewInterval = DefaultRenewInterval
+	if conf.RenewalInterval == 0 {
+		conf.RenewalInterval = DefaultRenewInterval
 	}
 
 	return nil
 }
 
+// GetDestinationByPath attempts to fetch a destination by its filesystem path.
+// Only valid for filesystem destinations; returns nil if no matching
+// destination exists.
+func (conf *BotConfig) GetDestinationByPath(path string) (*DestinationConfig, error) {
+	for _, dest := range conf.Destinations {
+		destImpl, err := dest.GetDestination()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		destDir, ok := destImpl.(*DestinationDirectory)
+		if !ok {
+			continue
+		}
+
+		// Note: this compares only paths as written in the config file. We
+		// might want to compare .Abs() if that proves to be confusing (though
+		// this may have its own problems)
+		if destDir.Path == path {
+			return dest, nil
+		}
+	}
+
+	return nil, nil
+}
+
 // NewDefaultConfig creates a new minimal bot configuration from defaults.
 // CheckAndSetDefaults() will be called.
 func NewDefaultConfig(authServer string) (*BotConfig, error) {
@@ -163,6 +214,10 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 		config.Debug = true
 	}
 
+	if cf.Oneshot {
+		config.Oneshot = true
+	}
+
 	if cf.AuthServer != "" {
 		if config.AuthServer != "" {
 			log.Warnf("CLI parameters are overriding auth server configured in %s", cf.ConfigPath)
@@ -177,20 +232,22 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 		config.CertificateTTL = cf.CertificateTTL
 	}
 
-	if cf.RenewInterval != 0 {
-		if config.RenewInterval != 0 {
+	if cf.RenewalInterval != 0 {
+		if config.RenewalInterval != 0 {
 			log.Warnf("CLI parameters are overriding renewal interval configured in %s", cf.ConfigPath)
 		}
-		config.RenewInterval = cf.RenewInterval
+		config.RenewalInterval = cf.RenewalInterval
 	}
 
 	// DataDir overrides any previously-configured storage config
 	if cf.DataDir != "" {
-		if _, err := config.Storage.GetDestination(); err != nil {
-			log.Warnf("CLI parameters are overriding storage location from %s", cf.ConfigPath)
+		if config.Storage != nil {
+			if _, err := config.Storage.GetDestination(); err != nil {
+				log.Warnf("CLI parameters are overriding storage location from %s", cf.ConfigPath)
+			}
 		}
 
-		config.Storage = StorageConfig{
+		config.Storage = &StorageConfig{
 			DestinationMixin: DestinationMixin{
 				Directory: &DestinationDirectory{
 					Path: cf.DataDir,
@@ -220,9 +277,9 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 	// (CAPath, CAPins, etc follow different codepaths so we don't want a
 	// situation where different fields become set weirdly due to struct
 	// merging)
-	if cf.Token != "" || len(cf.CAPins) > 0 || cf.JoinMethod != "" {
+	if cf.Token != "" || len(cf.CAPins) > 0 || cf.JoinMethod != DefaultJoinMethod {
 		onboarding := config.Onboarding
-		if onboarding != nil && (onboarding.Token != "" || onboarding.CAPath != "" || len(onboarding.CAPins) > 0) || cf.JoinMethod != "" {
+		if onboarding != nil && (onboarding.Token != "" || onboarding.CAPath != "" || len(onboarding.CAPins) > 0) || cf.JoinMethod != DefaultJoinMethod {
 			// To be safe, warn about possible confusion.
 			log.Warnf("CLI parameters are overriding onboarding config from %s", cf.ConfigPath)
 		}
diff --git a/tool/tbot/config/config_destination.go b/tool/tbot/config/config_destination.go
index fbe4e89fde87a..8e986a824a8a1 100644
--- a/tool/tbot/config/config_destination.go
+++ b/tool/tbot/config/config_destination.go
@@ -17,23 +17,17 @@ limitations under the License.
 package config
 
 import (
+	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/gravitational/trace"
 )
 
-type Kind string
-
-const (
-	KindSSH Kind = "ssh"
-	KindTLS Kind = "tls"
-)
-
 // DestinationConfig configures a user certificate destination.
 type DestinationConfig struct {
 	DestinationMixin `yaml:",inline"`
 
-	Roles   []string         `yaml:"roles,omitempty"`
-	Kinds   []Kind           `yaml:"kinds,omitempty"`
-	Configs []TemplateConfig `yaml:"configs,omitempty"`
+	Roles   []string                `yaml:"roles,omitempty"`
+	Kinds   []identity.ArtifactKind `yaml:"kinds,omitempty"`
+	Configs []TemplateConfig        `yaml:"configs,omitempty"`
 }
 
 // destinationDefaults applies defaults for an output sink's destination. Since
@@ -52,7 +46,7 @@ func (dc *DestinationConfig) CheckAndSetDefaults() error {
 	// time
 
 	if len(dc.Kinds) == 0 && len(dc.Configs) == 0 {
-		dc.Kinds = []Kind{KindSSH}
+		dc.Kinds = []identity.ArtifactKind{identity.KindSSH}
 		dc.Configs = []TemplateConfig{{
 			SSHClient: &TemplateSSHClient{},
 		}}
@@ -68,7 +62,7 @@ func (dc *DestinationConfig) CheckAndSetDefaults() error {
 }
 
 // ContainsKind determines if this destination contains the given ConfigKind.
-func (dc *DestinationConfig) ContainsKind(kind Kind) bool {
+func (dc *DestinationConfig) ContainsKind(kind identity.ArtifactKind) bool {
 	for _, k := range dc.Kinds {
 		if k == kind {
 			return true
diff --git a/tool/tbot/config/config_test.go b/tool/tbot/config/config_test.go
index c2147e5bba8e1..9d583a480ed1f 100644
--- a/tool/tbot/config/config_test.go
+++ b/tool/tbot/config/config_test.go
@@ -21,6 +21,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/coreos/go-semver/semver"
+	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/stretchr/testify/require"
 )
 
@@ -29,7 +31,7 @@ func TestConfigDefaults(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, DefaultCertificateTTL, cfg.CertificateTTL)
-	require.Equal(t, DefaultRenewInterval, cfg.RenewInterval)
+	require.Equal(t, DefaultRenewInterval, cfg.RenewalInterval)
 
 	storageDest, err := cfg.Storage.GetDestination()
 	require.NoError(t, err)
@@ -73,7 +75,7 @@ func TestConfigCLIOnlySample(t *testing.T) {
 	// A single default destination should exist
 	require.Len(t, cfg.Destinations, 1)
 	dest := cfg.Destinations[0]
-	require.ElementsMatch(t, []Kind{KindSSH}, dest.Kinds)
+	require.ElementsMatch(t, []identity.ArtifactKind{identity.KindSSH}, dest.Kinds)
 
 	require.Len(t, dest.Configs, 1)
 	template := dest.Configs[0]
@@ -92,7 +94,7 @@ func TestConfigFile(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, "auth.example.com", cfg.AuthServer)
-	require.Equal(t, time.Minute*5, cfg.RenewInterval)
+	require.Equal(t, time.Minute*5, cfg.RenewalInterval)
 
 	require.NotNil(t, cfg.Onboarding)
 	require.Equal(t, "foo", cfg.Onboarding.Token)
@@ -107,7 +109,7 @@ func TestConfigFile(t *testing.T) {
 	require.Len(t, cfg.Destinations, 1)
 	destination := cfg.Destinations[0]
 
-	require.ElementsMatch(t, []Kind{KindSSH, KindTLS}, destination.Kinds)
+	require.ElementsMatch(t, []identity.ArtifactKind{identity.KindSSH, identity.KindTLS}, destination.Kinds)
 
 	require.Len(t, destination.Configs, 1)
 	template := destination.Configs[0]
@@ -124,9 +126,53 @@ func TestConfigFile(t *testing.T) {
 	require.Equal(t, "/tmp/foo", destImplReal.Path)
 }
 
+func TestParseSSHVersion(t *testing.T) {
+	tests := []struct {
+		str     string
+		version *semver.Version
+		err     bool
+	}{
+		{
+			str:     "OpenSSH_8.2p1 Ubuntu-4ubuntu0.4, OpenSSL 1.1.1f  31 Mar 2020",
+			version: semver.New("8.2.1"),
+		},
+		{
+			str:     "OpenSSH_8.8p1, OpenSSL 1.1.1m  14 Dec 2021",
+			version: semver.New("8.8.1"),
+		},
+		{
+			str:     "OpenSSH_7.5p1, OpenSSL 1.0.2s-freebsd  28 May 2019",
+			version: semver.New("7.5.1"),
+		},
+		{
+			str:     "OpenSSH_7.9p1 Raspbian-10+deb10u2, OpenSSL 1.1.1d  10 Sep 2019",
+			version: semver.New("7.9.1"),
+		},
+		{
+			// Couldn't find a full example but in theory patch is optional:
+			str:     "OpenSSH_8.1 foo",
+			version: semver.New("8.1.0"),
+		},
+		{
+			str: "Teleport v8.0.0-dev.40 git:v8.0.0-dev.40-0-ge9194c256 go1.17.2",
+			err: true,
+		},
+	}
+
+	for _, test := range tests {
+		version, err := parseSSHVersion(test.str)
+		if test.err {
+			require.Error(t, err)
+		} else {
+			require.NoError(t, err)
+			require.True(t, version.Equal(*test.version), "got version = %v, want = %v", version, test.version)
+		}
+	}
+}
+
 const exampleConfigFile = `
 auth_server: auth.example.com
-renew_interval: 5m
+renewal_interval: 5m
 onboarding:
   token: foo
   ca_pins:
diff --git a/tool/tbot/config/configtemplate.go b/tool/tbot/config/configtemplate.go
index b281a6344eaef..f54e86a6ee165 100644
--- a/tool/tbot/config/configtemplate.go
+++ b/tool/tbot/config/configtemplate.go
@@ -21,7 +21,6 @@ import (
 	"strings"
 
 	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/gravitational/trace"
 	"gopkg.in/yaml.v3"
@@ -42,10 +41,6 @@ type FileDescription struct {
 	// IsDir designates whether this describes a subdirectory inside the
 	// destination.
 	IsDir bool
-
-	// ModeHint describes the intended permissions for this data, for
-	// Destination backends where permissions are relevant.
-	ModeHint destination.ModeHint
 }
 
 // Template defines functions for dynamically writing additional files to
diff --git a/tool/tbot/config/configtemplate_ssh.go b/tool/tbot/config/configtemplate_ssh.go
index f0daae845b5d3..2c8f7da6d9550 100644
--- a/tool/tbot/config/configtemplate_ssh.go
+++ b/tool/tbot/config/configtemplate_ssh.go
@@ -17,19 +17,22 @@ limitations under the License.
 package config
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"text/template"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
@@ -41,6 +44,66 @@ type TemplateSSHClient struct {
 	ProxyPort uint16 `yaml:"proxy_port"`
 }
 
+// openSSHVersionRegex is a regex used to parse OpenSSH version strings.
+var openSSHVersionRegex = regexp.MustCompile(`^OpenSSH_(?P<major>\d+)\.(?P<minor>\d+)(?:p(?P<patch>\d+))?`)
+
+// openSSHMinVersionForRSAWorkaround is the OpenSSH version after which the
+// RSA deprecation workaround should be added to generated ssh_config.
+var openSSHMinVersionForRSAWorkaround = semver.New("8.5.0")
+
+// parseSSHVersion attempts to parse
+func parseSSHVersion(versionString string) (*semver.Version, error) {
+	versionTokens := strings.Split(versionString, " ")
+	if len(versionTokens) == 0 {
+		return nil, trace.BadParameter("invalid version string: %s", versionString)
+	}
+
+	versionID := versionTokens[0]
+	matches := openSSHVersionRegex.FindStringSubmatch(versionID)
+	if matches == nil {
+		return nil, trace.BadParameter("cannot parse version string: %q", versionID)
+	}
+
+	major, err := strconv.Atoi(matches[1])
+	if err != nil {
+		return nil, trace.Wrap(err, "invalid major version number: %s", matches[1])
+	}
+
+	minor, err := strconv.Atoi(matches[2])
+	if err != nil {
+		return nil, trace.Wrap(err, "invalid minor version number: %s", matches[2])
+	}
+
+	patch := 0
+	if matches[3] != "" {
+		patch, err = strconv.Atoi(matches[3])
+		if err != nil {
+			return nil, trace.Wrap(err, "invalid patch version number: %s", matches[3])
+		}
+	}
+
+	return &semver.Version{
+		Major: int64(major),
+		Minor: int64(minor),
+		Patch: int64(patch),
+	}, nil
+}
+
+// getSSHVersion attempts to query the system SSH for its current version.
+func getSSHVersion() (*semver.Version, error) {
+	var out bytes.Buffer
+
+	cmd := exec.Command("ssh", "-V")
+	cmd.Stderr = &out
+
+	err := cmd.Run()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return parseSSHVersion(out.String())
+}
+
 func (c *TemplateSSHClient) CheckAndSetDefaults() error {
 	if c.ProxyPort == 0 {
 		c.ProxyPort = defaults.SSHProxyListenPort
@@ -51,18 +114,16 @@ func (c *TemplateSSHClient) CheckAndSetDefaults() error {
 func (c *TemplateSSHClient) Describe() []FileDescription {
 	return []FileDescription{
 		{
-			Name:     "ssh_config",
-			ModeHint: destination.ModeHintSecret,
+			Name: "ssh_config",
 		},
 		{
-			Name:     "known_hosts",
-			ModeHint: destination.ModeHintSecret,
+			Name: "known_hosts",
 		},
 	}
 }
 
 func (c *TemplateSSHClient) Render(ctx context.Context, authClient auth.ClientI, currentIdentity *identity.Identity, destination *DestinationConfig) error {
-	if !destination.ContainsKind(KindSSH) {
+	if !destination.ContainsKind(identity.KindSSH) {
 		return trace.BadParameter("%s config template requires kind `ssh` to be enabled", TemplateSSHClientName)
 	}
 
@@ -104,7 +165,7 @@ func (c *TemplateSSHClient) Render(ctx context.Context, authClient auth.ClientI,
 		dataDir = ""
 	}
 
-	knownHosts, err := fetchKnownHosts(authClient, clusterName.GetClusterName(), proxyHost)
+	knownHosts, err := fetchKnownHosts(ctx, authClient, clusterName.GetClusterName(), proxyHost)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -114,18 +175,31 @@ func (c *TemplateSSHClient) Render(ctx context.Context, authClient auth.ClientI,
 		return trace.Wrap(err)
 	}
 
+	// Default to including the RSA deprecation workaround.
+	rsaWorkaround := true
+	version, err := getSSHVersion()
+	if err != nil {
+		log.WithError(err).Debugf("Could not determine SSH version, will include RSA workaround.")
+	} else if version.LessThan(*openSSHMinVersionForRSAWorkaround) {
+		log.Debugf("OpenSSH version %s does not require workaround for RSA deprecation", version)
+		rsaWorkaround = false
+	} else {
+		log.Debugf("OpenSSH version %s will use workaround for RSA deprecation", version)
+	}
+
 	var sshConfigBuilder strings.Builder
 	identityFilePath := filepath.Join(dataDir, identity.PrivateKeyKey)
 	certificateFilePath := filepath.Join(dataDir, identity.SSHCertKey)
 	sshConfigPath := filepath.Join(dataDir, "ssh_config")
 	if err := sshConfigTemplate.Execute(&sshConfigBuilder, sshConfigParameters{
-		ClusterName:         clusterName.GetClusterName(),
-		ProxyHost:           proxyHost,
-		ProxyPort:           proxyPort,
-		KnownHostsPath:      knownHostsPath,
-		IdentityFilePath:    identityFilePath,
-		CertificateFilePath: certificateFilePath,
-		SSHConfigPath:       sshConfigPath,
+		ClusterName:          clusterName.GetClusterName(),
+		ProxyHost:            proxyHost,
+		ProxyPort:            proxyPort,
+		KnownHostsPath:       knownHostsPath,
+		IdentityFilePath:     identityFilePath,
+		CertificateFilePath:  certificateFilePath,
+		SSHConfigPath:        sshConfigPath,
+		IncludeRSAWorkaround: rsaWorkaround,
 	}); err != nil {
 		return trace.Wrap(err)
 	}
@@ -145,6 +219,15 @@ type sshConfigParameters struct {
 	ProxyHost           string
 	ProxyPort           string
 	SSHConfigPath       string
+
+	// IncludeRSAWorkaround controls whether the RSA deprecation workaround is
+	// included in the generated configuration. Newer versions of OpenSSH
+	// deprecate RSA certificates and, due to a bug in golang's ssh package,
+	// Teleport wrongly advertises its unaffected certificates as a
+	// now-deprecated certificate type. The workaround includes a config
+	// override to re-enable RSA certs for just Teleport hosts, however it is
+	// only supported on OpenSSH 8.5 and later.
+	IncludeRSAWorkaround bool
 }
 
 var sshConfigTemplate = template.Must(template.New("ssh-config").Parse(`
@@ -155,19 +238,19 @@ Host *.{{ .ClusterName }} {{ .ProxyHost }}
     UserKnownHostsFile "{{ .KnownHostsPath }}"
     IdentityFile "{{ .IdentityFilePath }}"
     CertificateFile "{{ .CertificateFilePath }}"
-    HostKeyAlgorithms ssh-rsa-cert-v01@openssh.com
-    PubkeyAcceptedAlgorithms +ssh-rsa-cert-v01@openssh.com
+    HostKeyAlgorithms ssh-rsa-cert-v01@openssh.com{{- if .IncludeRSAWorkaround }}
+    PubkeyAcceptedAlgorithms +ssh-rsa-cert-v01@openssh.com{{- end }}
 
 # Flags for all {{ .ClusterName }} hosts except the proxy
 Host *.{{ .ClusterName }} !{{ .ProxyHost }}
     Port 3022
-    ProxyCommand ssh -F {{ .SSHConfigPath }} -l %r -p {{ .ProxyPort }} {{ .ProxyHost }} -s proxy:%h:%p@{{ .ClusterName }}
+    ProxyCommand ssh -F {{ .SSHConfigPath }} -l %r -p {{ .ProxyPort }} {{ .ProxyHost }} -s proxy:$(echo %h | cut -d '.' -f 1):%p@{{ .ClusterName }}
 
 # End generated Teleport configuration
 `))
 
-func fetchKnownHosts(client auth.ClientI, clusterName, proxyHosts string) (string, error) {
-	ca, err := client.GetCertAuthority(types.CertAuthID{
+func fetchKnownHosts(ctx context.Context, client auth.ClientI, clusterName, proxyHosts string) (string, error) {
+	ca, err := client.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName,
 	}, false)
diff --git a/tool/tbot/config/destination.go b/tool/tbot/config/destination.go
index c72a8afb7aace..6383ba82cc7a9 100644
--- a/tool/tbot/config/destination.go
+++ b/tool/tbot/config/destination.go
@@ -31,12 +31,12 @@ type DestinationMixin struct {
 
 type DestinationDefaults = func(*DestinationMixin) error
 
-func (dm *DestinationMixin) CheckAndSetDefaults(applyDefaults DestinationDefaults) error {
+// checkAndSetDefaultsInner performs member initialization that won't recurse
+func (dm *DestinationMixin) checkAndSetDefaultsInner() (int, error) {
 	notNilCount := 0
-
 	if dm.Directory != nil {
 		if err := dm.Directory.CheckAndSetDefaults(); err != nil {
-			return trace.Wrap(err)
+			return 0, trace.Wrap(err)
 		}
 
 		notNilCount++
@@ -44,17 +44,35 @@ func (dm *DestinationMixin) CheckAndSetDefaults(applyDefaults DestinationDefault
 
 	if dm.Memory != nil {
 		if err := dm.Memory.CheckAndSetDefaults(); err != nil {
-			return trace.Wrap(err)
+			return 0, trace.Wrap(err)
 		}
 
 		notNilCount++
 	}
+	return notNilCount, nil
+}
+
+func (dm *DestinationMixin) CheckAndSetDefaults(applyDefaults DestinationDefaults) error {
+	notNilCount, err := dm.checkAndSetDefaultsInner()
+	if err != nil {
+		return trace.Wrap(err)
+	}
 
 	if notNilCount == 0 {
 		// use defaults
 		if err := applyDefaults(dm); err != nil {
 			return trace.Wrap(err)
 		}
+
+		// CheckAndSetDefaults() again
+		notNilCount, err := dm.checkAndSetDefaultsInner()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if notNilCount == 0 {
+			return trace.BadParameter("a destination is required")
+		}
 	} else if notNilCount > 1 {
 		return trace.BadParameter("only one destination backend may be specified at a time")
 	}
diff --git a/tool/tbot/config/destination_directory.go b/tool/tbot/config/destination_directory.go
index de09b82bcc8b0..b3b39cd7da38c 100644
--- a/tool/tbot/config/destination_directory.go
+++ b/tool/tbot/config/destination_directory.go
@@ -19,16 +19,19 @@ package config
 import (
 	"fmt"
 	"os"
+	"os/user"
 	"path/filepath"
 
-	"github.com/gravitational/teleport/tool/tbot/destination"
+	"github.com/gravitational/teleport/tool/tbot/botfs"
 	"github.com/gravitational/trace"
 	"gopkg.in/yaml.v3"
 )
 
 // DestinationDirectory is a Destination that writes to the local filesystem
 type DestinationDirectory struct {
-	Path string `yaml:"path,omitempty"`
+	Path     string             `yaml:"path,omitempty"`
+	Symlinks botfs.SymlinksMode `yaml:"symlinks,omitempty"`
+	ACLs     botfs.ACLMode      `yaml:"acls,omitempty"`
 }
 
 func (dd *DestinationDirectory) UnmarshalYAML(node *yaml.Node) error {
@@ -58,23 +61,142 @@ func (dd *DestinationDirectory) CheckAndSetDefaults() error {
 		return trace.BadParameter("destination path must not be empty")
 	}
 
+	secureSupported, err := botfs.HasSecureWriteSupport()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	aclsSupported, err := botfs.HasACLSupport()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	switch dd.Symlinks {
+	case "":
+		if secureSupported {
+			// We expect Openat2 to be available, so try to use it by default.
+			dd.Symlinks = botfs.SymlinksSecure
+		} else {
+			// TrySecure will print a warning on fallback.
+			dd.Symlinks = botfs.SymlinksTrySecure
+		}
+	case botfs.SymlinksInsecure, botfs.SymlinksTrySecure:
+		// valid
+	case botfs.SymlinksSecure:
+		if !secureSupported {
+			return trace.BadParameter("symlink mode %q not supported on this system", dd.Symlinks)
+		}
+	default:
+		return trace.BadParameter("invalid symlinks mode: %q", dd.Symlinks)
+	}
+
+	switch dd.ACLs {
+	case "":
+		if aclsSupported {
+			// Unlike openat2(), we can't ever depend on ACLs being available.
+			// We'll only ever try to use them, end users can opt-in to a hard
+			// ACL check if they wish.
+			dd.ACLs = botfs.ACLTry
+		} else {
+			// if aclsSupported == false here, we know it will never work, so
+			// don't bother trying.
+			dd.ACLs = botfs.ACLOff
+		}
+	case botfs.ACLOff, botfs.ACLTry:
+		// valid
+	case botfs.ACLRequired:
+		if !aclsSupported {
+			return trace.BadParameter("acls mode %q not supported on this system", dd.ACLs)
+		}
+	default:
+		return trace.BadParameter("invalid acls mode: %q", dd.ACLs)
+	}
+
 	return nil
 }
 
-func (dd *DestinationDirectory) Write(name string, data []byte, modeHint destination.ModeHint) error {
-	// TODO: honor modeHint?
-	if err := os.WriteFile(filepath.Join(dd.Path, name), data, 0600); err != nil {
+func (dd *DestinationDirectory) Init() error {
+	// Create the directory if needed.
+	stat, err := os.Stat(dd.Path)
+	if trace.IsNotFound(err) {
+		if err := os.MkdirAll(dd.Path, botfs.DefaultDirMode); err != nil {
+			return trace.Wrap(err)
+		}
+		log.Infof("Created directory %q", dd.Path)
+	} else if err != nil {
 		return trace.Wrap(err)
+	} else if !stat.IsDir() {
+		return trace.BadParameter("Path %q already exists and is not a directory", dd.Path)
 	}
+
 	return nil
 }
 
+func (dd *DestinationDirectory) Verify(keys []string) error {
+	aclsSupported, err := botfs.HasACLSupport()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	currentUser, err := user.Current()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	stat, err := os.Stat(dd.Path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	ownedByBot, err := botfs.IsOwnedBy(stat, currentUser)
+	if trace.IsNotImplemented(err) {
+		// If file owners aren't supported, ACLs certainly aren't. Just bail.
+		// (Subject to change if we ever try to support Windows ACLs.)
+		return nil
+	} else if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Make sure it's worth warning about ACLs for this destination. If ACLs
+	// are disabled, unsupported, or the destination is owned by the bot
+	// (implying the user is not trying to use ACLs), just bail.
+	if dd.ACLs == botfs.ACLOff || !aclsSupported || ownedByBot {
+		return nil
+	}
+
+	errors := []error{}
+	for _, key := range keys {
+		path := filepath.Join(dd.Path, key)
+
+		errors = append(errors, botfs.VerifyACL(path, &botfs.ACLOptions{
+			BotUser: currentUser,
+		}))
+	}
+
+	aggregate := trace.NewAggregate(errors...)
+	if dd.ACLs == botfs.ACLRequired {
+		// Hard fail if ACLs are specifically requested and there are errors.
+		return aggregate
+	}
+
+	if aggregate != nil {
+		log.Warnf("Destination %q has unexpected ACLs: %v", dd.Path, aggregate)
+	}
+
+	return nil
+}
+
+func (dd *DestinationDirectory) Write(name string, data []byte) error {
+	return trace.Wrap(botfs.Write(filepath.Join(dd.Path, name), data, dd.Symlinks))
+}
+
 func (dd *DestinationDirectory) Read(name string) ([]byte, error) {
-	b, err := os.ReadFile(filepath.Join(dd.Path, name))
+	data, err := botfs.Read(filepath.Join(dd.Path, name), dd.Symlinks)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return b, nil
+
+	return data, nil
 }
 
 func (dd *DestinationDirectory) String() string {
diff --git a/tool/tbot/config/destination_memory.go b/tool/tbot/config/destination_memory.go
index 1cacbb61a9fe1..2778bc838a52e 100644
--- a/tool/tbot/config/destination_memory.go
+++ b/tool/tbot/config/destination_memory.go
@@ -17,7 +17,6 @@ limitations under the License.
 package config
 
 import (
-	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/trace"
 	"gopkg.in/yaml.v3"
 )
@@ -51,7 +50,17 @@ func (dm *DestinationMemory) CheckAndSetDefaults() error {
 	return nil
 }
 
-func (dm *DestinationMemory) Write(name string, data []byte, _ destination.ModeHint) error {
+func (dm *DestinationMemory) Init() error {
+	// Nothing to do.
+	return nil
+}
+
+func (dm *DestinationMemory) Verify(keys []string) error {
+	// Nothing to do.
+	return nil
+}
+
+func (dm *DestinationMemory) Write(name string, data []byte) error {
 	dm.store[name] = data
 
 	return nil
diff --git a/tool/tbot/destination/destination.go b/tool/tbot/destination/destination.go
index 093ce60bf71b6..3ad0ca5358b3d 100644
--- a/tool/tbot/destination/destination.go
+++ b/tool/tbot/destination/destination.go
@@ -16,23 +16,20 @@ limitations under the License.
 
 package destination
 
-// ModeHint is a backend-agnostic file mode hint.
-type ModeHint int64
-
-const (
-	// ModeHintUnspecified hints that files should be created with default
-	// (possibly insecure) permissions.
-	ModeHintUnspecified ModeHint = iota
-
-	// ModeHintSecret hints that files should be created with restricted
-	// permissions, appropriate for secret data.
-	ModeHintSecret
-)
-
 // Destination can persist renewable certificates.
 type Destination interface {
+	// Init attempts to initialize this destination for writing. Init should be
+	// idempotent and may write informational log messages if resources are
+	// created.
+	Init() error
+
+	// Verify is run before renewals to check for any potential problems with
+	// the destination. These errors may be informational (logged warnings) or
+	// return an error that may potentially terminate the process.
+	Verify(keys []string) error
+
 	// Write stores data to the destination with the given name.
-	Write(name string, data []byte, modeHint ModeHint) error
+	Write(name string, data []byte) error
 
 	// Read fetches data from the destination with a given name.
 	Read(name string) ([]byte, error)
diff --git a/tool/tbot/identity/artifact.go b/tool/tbot/identity/artifact.go
new file mode 100644
index 0000000000000..840c491500a13
--- /dev/null
+++ b/tool/tbot/identity/artifact.go
@@ -0,0 +1,144 @@
+/*
+Copyright 2021-2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package identity
+
+import (
+	"bytes"
+
+	"github.com/gravitational/teleport/api/client/proto"
+)
+
+// Artifact is a component of a serialized identity.
+type Artifact struct {
+	Key       string
+	Kind      ArtifactKind
+	ToBytes   func(*Identity) []byte
+	FromBytes func(*proto.Certs, *LoadIdentityParams, []byte)
+}
+
+// Matches returns true if this artifact's Kind matches any one of the given
+// kinds or if it's kind is KindAlways
+func (a *Artifact) Matches(kinds ...ArtifactKind) bool {
+	if a.Kind == KindAlways {
+		return true
+	}
+
+	for _, kind := range kinds {
+		if a.Kind == kind {
+			return true
+		}
+	}
+
+	return false
+}
+
+var artifacts = []Artifact{
+	// SSH artifacts
+	{
+		Key:  SSHCertKey,
+		Kind: KindSSH,
+		ToBytes: func(i *Identity) []byte {
+			return i.CertBytes
+		},
+		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
+			c.SSH = b
+		},
+	},
+	{
+		Key:  SSHCACertsKey,
+		Kind: KindSSH,
+		ToBytes: func(i *Identity) []byte {
+			return bytes.Join(i.SSHCACertBytes, []byte("$"))
+		},
+		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
+			c.SSHCACerts = bytes.Split(b, []byte("$"))
+		},
+	},
+
+	// TLS artifacts
+	{
+		Key:  TLSCertKey,
+		Kind: KindTLS,
+		ToBytes: func(i *Identity) []byte {
+			return i.TLSCertBytes
+		},
+		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
+			c.TLS = b
+		},
+	},
+	{
+		Key:  TLSCACertsKey,
+		Kind: KindTLS,
+		ToBytes: func(i *Identity) []byte {
+			return bytes.Join(i.TLSCACertsBytes, []byte("$"))
+		},
+		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
+			c.TLSCACerts = bytes.Split(b, []byte("$"))
+		},
+	},
+
+	// Common artifacts
+	{
+		Key:  PrivateKeyKey,
+		Kind: KindAlways,
+		ToBytes: func(i *Identity) []byte {
+			return i.PrivateKeyBytes
+		},
+		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
+			p.PrivateKeyBytes = b
+		},
+	},
+	{
+		Key:  PublicKeyKey,
+		Kind: KindAlways,
+		ToBytes: func(i *Identity) []byte {
+			return i.PublicKeyBytes
+		},
+		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
+			p.PublicKeyBytes = b
+		},
+	},
+	{
+		// The token hash is used to detect changes to the token and
+		// request a new identity when changes are detected.
+		Key:  TokenHashKey,
+		Kind: KindBotInternal,
+		ToBytes: func(i *Identity) []byte {
+			return i.TokenHashBytes
+		},
+		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
+			p.TokenHashBytes = b
+		},
+	},
+	{
+		// The write test is used to ensure the destination is writable before
+		// attempting a renewal.
+		Key:  WriteTestKey,
+		Kind: KindAlways,
+		ToBytes: func(i *Identity) []byte {
+			// always empty
+			return []byte{}
+		},
+		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
+			// nothing to do
+		},
+	},
+}
+
+func GetArtifacts() []Artifact {
+	return artifacts
+}
diff --git a/tool/tbot/identity/identity.go b/tool/tbot/identity/identity.go
index b71ad535266a8..33cd4a050d936 100644
--- a/tool/tbot/identity/identity.go
+++ b/tool/tbot/identity/identity.go
@@ -17,7 +17,6 @@ limitations under the License.
 package identity
 
 import (
-	"bytes"
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
@@ -57,8 +56,12 @@ const (
 	// PublicKeyKey is the ssh public key, required for successful SSH connections.
 	PublicKeyKey = "key.pub"
 
-	// MetadataKey is the name under which additional metadata exists in a destination.
-	MetadataKey = "meta"
+	// TokenHashKey is the key where a hash of the onboarding token will be stored.
+	TokenHashKey = "tokenhash"
+
+	// WriteTestKey is the key for a file used to check that the destination is
+	// writable.
+	WriteTestKey = ".write-test"
 )
 
 var log = logrus.WithFields(logrus.Fields{
@@ -69,10 +72,10 @@ var log = logrus.WithFields(logrus.Fields{
 // identity. This is derived from Teleport's usual auth.Identity with small
 // modifications to work with user rather than host certificates.
 type Identity struct {
-	// KeyBytes is a PEM encoded private key
-	KeyBytes []byte
-	// SSHPublicKeyBytes contains bytes of the original SSH public key
-	SSHPublicKeyBytes []byte
+	// PrivateKeyBytes is a PEM encoded private key
+	PrivateKeyBytes []byte
+	// PublicKeyBytes contains bytes of the original SSH public key
+	PublicKeyBytes []byte
 	// CertBytes is a PEM encoded SSH host cert
 	CertBytes []byte
 	// TLSCertBytes is a PEM encoded TLS x509 client certificate
@@ -84,19 +87,39 @@ type Identity struct {
 	SSHCACertBytes [][]byte
 	// KeySigner is an SSH host certificate signer
 	KeySigner ssh.Signer
-	// Cert is a parsed SSH certificate
-	Cert *ssh.Certificate
-	// XCert is X509 client certificate
-	XCert *x509.Certificate
+	// SSHCert is a parsed SSH certificate
+	SSHCert *ssh.Certificate
+	// X509Cert is an X509 client certificate
+	X509Cert *x509.Certificate
 	// ClusterName is a name of host's cluster
 	ClusterName string
+	// TokenHashBytes is the hash of the original join token
+	TokenHashBytes []byte
+}
+
+// LoadIdentityParams contains parameters beyond proto.Certs needed to load a
+// stored identity.
+type LoadIdentityParams struct {
+	PrivateKeyBytes []byte
+	PublicKeyBytes  []byte
+	TokenHashBytes  []byte
+}
+
+// Params returns the LoadIdentityParams for this Identity, which are the
+// local-only parameters to be carried over to a renewed identity.
+func (i *Identity) Params() *LoadIdentityParams {
+	return &LoadIdentityParams{
+		PrivateKeyBytes: i.PrivateKeyBytes,
+		PublicKeyBytes:  i.PublicKeyBytes,
+		TokenHashBytes:  i.TokenHashBytes,
+	}
 }
 
 // String returns user-friendly representation of the identity.
 func (i *Identity) String() string {
 	var out []string
-	if i.XCert != nil {
-		out = append(out, fmt.Sprintf("cert(%v issued by %v:%v)", i.XCert.Subject.CommonName, i.XCert.Issuer.CommonName, i.XCert.Issuer.SerialNumber))
+	if i.X509Cert != nil {
+		out = append(out, fmt.Sprintf("cert(%v issued by %v:%v)", i.X509Cert.Subject.CommonName, i.X509Cert.Issuer.CommonName, i.X509Cert.Issuer.SerialNumber))
 	}
 	for j := range i.TLSCACertsBytes {
 		cert, err := tlsca.ParseCertificatePEM(i.TLSCACertsBytes[j])
@@ -144,7 +167,7 @@ func (i *Identity) HasTLSConfig() bool {
 
 // HasPrincipals returns whether identity has principals
 func (i *Identity) HasPrincipals(additionalPrincipals []string) bool {
-	set := utils.StringsSet(i.Cert.ValidPrincipals)
+	set := utils.StringsSet(i.SSHCert.ValidPrincipals)
 	for _, principal := range additionalPrincipals {
 		if _, ok := set[principal]; !ok {
 			return false
@@ -155,10 +178,10 @@ func (i *Identity) HasPrincipals(additionalPrincipals []string) bool {
 
 // HasDNSNames returns true if TLS certificate has required DNS names
 func (i *Identity) HasDNSNames(dnsNames []string) bool {
-	if i.XCert == nil {
+	if i.X509Cert == nil {
 		return false
 	}
-	set := utils.StringsSet(i.XCert.DNSNames)
+	set := utils.StringsSet(i.X509Cert.DNSNames)
 	for _, dnsName := range dnsNames {
 		if _, ok := set[dnsName]; !ok {
 			return false
@@ -174,7 +197,7 @@ func (i *Identity) TLSConfig(cipherSuites []uint16) (*tls.Config, error) {
 	if !i.HasTLSConfig() {
 		return nil, trace.NotFound("no TLS credentials setup for this identity")
 	}
-	tlsCert, err := tls.X509KeyPair(i.TLSCertBytes, i.KeyBytes)
+	tlsCert, err := tls.X509KeyPair(i.TLSCertBytes, i.PrivateKeyBytes)
 	if err != nil {
 		return nil, trace.BadParameter("failed to parse private key: %v", err)
 	}
@@ -211,185 +234,208 @@ func (i *Identity) SSHClientConfig() (*ssh.ClientConfig, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if len(i.Cert.ValidPrincipals) < 1 {
+	if len(i.SSHCert.ValidPrincipals) < 1 {
 		return nil, trace.BadParameter("user cert has no valid principals")
 	}
 	return &ssh.ClientConfig{
-		User:            i.Cert.ValidPrincipals[0],
+		User:            i.SSHCert.ValidPrincipals[0],
 		Auth:            []ssh.AuthMethod{ssh.PublicKeys(i.KeySigner)},
 		HostKeyCallback: callback,
 		Timeout:         apidefaults.DefaultDialTimeout,
 	}, nil
 }
 
-// ReadIdentityFromKeyPair reads SSH and TLS identity from key pair.
-func ReadIdentityFromKeyPair(privateKey []byte, publicKey []byte, certs *proto.Certs) (*Identity, error) {
-	identity, err := ReadSSHIdentityFromKeyPair(privateKey, publicKey, certs.SSH)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+// ReadIdentityFromStore reads stored identity credentials
+func ReadIdentityFromStore(params *LoadIdentityParams, certs *proto.Certs, kinds ...ArtifactKind) (*Identity, error) {
+	var identity Identity
+	if ContainsKind(KindSSH, kinds) {
+		if len(certs.SSH) == 0 {
+			return nil, trace.BadParameter("identity requires SSH certificates but they are unset")
+		}
 
-	if len(certs.SSHCACerts) != 0 {
-		identity.SSHCACertBytes = certs.SSHCACerts
+		err := ReadSSHIdentityFromKeyPair(&identity, params.PrivateKeyBytes, params.PrivateKeyBytes, certs.SSH)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		if len(certs.SSHCACerts) != 0 {
+			identity.SSHCACertBytes = certs.SSHCACerts
+		}
 	}
 
-	if len(certs.TLSCACerts) != 0 {
+	if ContainsKind(KindTLS, kinds) {
+		if len(certs.TLSCACerts) == 0 || len(certs.TLS) == 0 {
+			return nil, trace.BadParameter("identity requires TLS certificates but they are empty")
+		}
+
 		// Parse the key pair to verify that identity parses properly for future use.
-		i, err := ReadTLSIdentityFromKeyPair(privateKey, certs.TLS, certs.TLSCACerts)
-		if err != nil {
+		if err := ReadTLSIdentityFromKeyPair(&identity, params.PrivateKeyBytes, certs.TLS, certs.TLSCACerts); err != nil {
 			return nil, trace.Wrap(err)
 		}
-		identity.XCert = i.XCert
-		identity.TLSCertBytes = certs.TLS
-		identity.TLSCACertsBytes = certs.TLSCACerts
 	}
 
-	return identity, nil
+	identity.PublicKeyBytes = params.PublicKeyBytes
+	identity.PrivateKeyBytes = params.PrivateKeyBytes
+	identity.TokenHashBytes = params.TokenHashBytes
+
+	return &identity, nil
 }
 
 // ReadTLSIdentityFromKeyPair reads TLS identity from key pair
-func ReadTLSIdentityFromKeyPair(keyBytes, certBytes []byte, caCertsBytes [][]byte) (*Identity, error) {
+func ReadTLSIdentityFromKeyPair(identity *Identity, keyBytes, certBytes []byte, caCertsBytes [][]byte) error {
 	if len(keyBytes) == 0 {
-		return nil, trace.BadParameter("missing private key")
+		return trace.BadParameter("missing private key")
 	}
 
 	if len(certBytes) == 0 {
-		return nil, trace.BadParameter("missing certificate")
+		return trace.BadParameter("missing certificate")
 	}
 
 	cert, err := tlsca.ParseCertificatePEM(certBytes)
 	if err != nil {
-		return nil, trace.Wrap(err, "failed to parse TLS certificate")
+		return trace.Wrap(err, "failed to parse TLS certificate")
 	}
 
 	if len(cert.Issuer.Organization) == 0 {
-		return nil, trace.BadParameter("missing CA organization")
+		return trace.BadParameter("missing CA organization")
 	}
 
 	clusterName := cert.Issuer.Organization[0]
 	if clusterName == "" {
-		return nil, trace.BadParameter("misssing cluster name")
-	}
-	identity := &Identity{
-		ClusterName:     clusterName,
-		KeyBytes:        keyBytes,
-		TLSCertBytes:    certBytes,
-		TLSCACertsBytes: caCertsBytes,
-		XCert:           cert,
+		return trace.BadParameter("misssing cluster name")
 	}
+
+	identity.ClusterName = clusterName
+	identity.PrivateKeyBytes = keyBytes
+	identity.TLSCertBytes = certBytes
+	identity.TLSCACertsBytes = caCertsBytes
+	identity.X509Cert = cert
+
 	// The passed in ciphersuites don't appear to matter here since the returned
 	// *tls.Config is never actually used?
 	_, err = identity.TLSConfig(utils.DefaultCipherSuites())
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return trace.Wrap(err)
 	}
-	return identity, nil
+	return nil
 }
 
 // ReadSSHIdentityFromKeyPair reads identity from initialized keypair
-func ReadSSHIdentityFromKeyPair(keyBytes, publicKeyBytes, certBytes []byte) (*Identity, error) {
+func ReadSSHIdentityFromKeyPair(identity *Identity, keyBytes, publicKeyBytes, certBytes []byte) error {
 	if len(keyBytes) == 0 {
-		return nil, trace.BadParameter("PrivateKey: missing private key")
+		return trace.BadParameter("PrivateKey: missing private key")
 	}
 
 	if len(publicKeyBytes) == 0 {
-		return nil, trace.BadParameter("PublicKey: missing public key")
+		return trace.BadParameter("PublicKey: missing public key")
 	}
 
 	if len(certBytes) == 0 {
-		return nil, trace.BadParameter("Cert: missing parameter")
+		return trace.BadParameter("Cert: missing parameter")
 	}
 
 	cert, err := apisshutils.ParseCertificate(certBytes)
 	if err != nil {
-		return nil, trace.BadParameter("failed to parse server certificate: %v", err)
+		return trace.BadParameter("failed to parse server certificate: %v", err)
 	}
 
 	signer, err := ssh.ParsePrivateKey(keyBytes)
 	if err != nil {
-		return nil, trace.BadParameter("failed to parse private key: %v", err)
+		return trace.BadParameter("failed to parse private key: %v", err)
 	}
 	// this signer authenticates using certificate signed by the cert authority
 	// not only by the public key
 	certSigner, err := ssh.NewCertSigner(cert, signer)
 	if err != nil {
-		return nil, trace.BadParameter("unsupported private key: %v", err)
+		return trace.BadParameter("unsupported private key: %v", err)
 	}
 
 	// check principals on certificate
 	if len(cert.ValidPrincipals) < 1 {
-		return nil, trace.BadParameter("valid principals: at least one valid principal is required")
+		return trace.BadParameter("valid principals: at least one valid principal is required")
 	}
 	for _, validPrincipal := range cert.ValidPrincipals {
 		if validPrincipal == "" {
-			return nil, trace.BadParameter("valid principal can not be empty: %q", cert.ValidPrincipals)
+			return trace.BadParameter("valid principal can not be empty: %q", cert.ValidPrincipals)
 		}
 	}
 
 	clusterName := cert.Permissions.Extensions[teleport.CertExtensionTeleportRouteToCluster]
 	if clusterName == "" {
-		return nil, trace.BadParameter("missing cert extension %v", utils.CertExtensionAuthority)
+		return trace.BadParameter("missing cert extension %v", utils.CertExtensionAuthority)
 	}
 
-	return &Identity{
-		ClusterName:       clusterName,
-		KeyBytes:          keyBytes,
-		SSHPublicKeyBytes: publicKeyBytes,
-		CertBytes:         certBytes,
-		KeySigner:         certSigner,
-		Cert:              cert,
-	}, nil
+	identity.ClusterName = clusterName
+	identity.PrivateKeyBytes = keyBytes
+	identity.PublicKeyBytes = publicKeyBytes
+	identity.CertBytes = certBytes
+	identity.KeySigner = certSigner
+	identity.SSHCert = cert
+
+	return nil
+}
+
+// VerifyWrite attempts to write to the .write-test artifact inside the given
+// destination. It should be called before attempting a renewal to help ensure
+// we won't then fail to save the identity.
+func VerifyWrite(dest destination.Destination) error {
+	return trace.Wrap(dest.Write(WriteTestKey, []byte{}))
+}
+
+// ListKeys returns a list of artifact keys that will be written given a list
+// of artifacts.
+func ListKeys(kinds ...ArtifactKind) []string {
+	keys := []string{}
+	for _, artifact := range GetArtifacts() {
+		if !artifact.Matches(kinds...) {
+			continue
+		}
+
+		keys = append(keys, artifact.Key)
+	}
+
+	return keys
 }
 
 // SaveIdentity saves a bot identity to a destination.
-func SaveIdentity(id *Identity, d destination.Destination) error {
-	for _, data := range []struct {
-		name     string
-		data     []byte
-		modeHint destination.ModeHint
-	}{
-		{TLSCertKey, id.TLSCertBytes, destination.ModeHintSecret},
-		{SSHCertKey, id.CertBytes, destination.ModeHintSecret},
-		{TLSCACertsKey, bytes.Join(id.TLSCACertsBytes, []byte("$")), destination.ModeHintSecret},
-		{SSHCACertsKey, bytes.Join(id.SSHCACertBytes, []byte("$")), destination.ModeHintSecret},
-		{PrivateKeyKey, id.KeyBytes, destination.ModeHintSecret},
-		{PublicKeyKey, id.SSHPublicKeyBytes, destination.ModeHintUnspecified},
-	} {
-		log.Debugf("Writing %s", data.name)
-		if err := d.Write(data.name, data.data, data.modeHint); err != nil {
-			return trace.Wrap(err, "could not write to %v", data.name)
+func SaveIdentity(id *Identity, d destination.Destination, kinds ...ArtifactKind) error {
+	for _, artifact := range GetArtifacts() {
+		// Only store artifacts matching one of the set kinds.
+		if !artifact.Matches(kinds...) {
+			continue
+		}
+
+		data := artifact.ToBytes(id)
+
+		log.Debugf("Writing %s", artifact.Key)
+		if err := d.Write(artifact.Key, data); err != nil {
+			return trace.WrapWithMessage(err, "could not write to %v", artifact.Key)
 		}
 	}
+
 	return nil
 }
 
 // LoadIdentity loads a bot identity from a destination.
-func LoadIdentity(d destination.Destination) (*Identity, error) {
-	var key, sshPublicKey, tlsCA, sshCA []byte
+func LoadIdentity(d destination.Destination, kinds ...ArtifactKind) (*Identity, error) {
 	var certs proto.Certs
-	var err error
-
-	for _, item := range []struct {
-		name string
-		out  *[]byte
-	}{
-		{TLSCertKey, &certs.TLS},
-		{SSHCertKey, &certs.SSH},
-		{TLSCACertsKey, &tlsCA},
-		{SSHCACertsKey, &sshCA},
-		{PrivateKeyKey, &key},
-		{PublicKeyKey, &sshPublicKey},
-	} {
-		*item.out, err = d.Read(item.name)
+	var params LoadIdentityParams
+
+	for _, artifact := range GetArtifacts() {
+		// Only attempt to load artifacts matching one of the specified kinds
+		if !artifact.Matches(kinds...) {
+			continue
+		}
+
+		data, err := d.Read(artifact.Key)
 		if err != nil {
-			return nil, trace.Wrap(err, "could not read %v", item.name)
+			return nil, trace.WrapWithMessage(err, "could not read artifact %q from destination %s", artifact.Key, d)
 		}
-	}
 
-	certs.SSHCACerts = bytes.Split(sshCA, []byte("$"))
-	certs.TLSCACerts = bytes.Split(tlsCA, []byte("$"))
+		artifact.FromBytes(&certs, &params, data)
+	}
 
 	log.Debugf("Loaded %d SSH CA certs and %d TLS CA certs", len(certs.SSHCACerts), len(certs.TLSCACerts))
 
-	return ReadIdentityFromKeyPair(key, sshPublicKey, &certs)
+	return ReadIdentityFromStore(&params, &certs, kinds...)
 }
diff --git a/tool/tbot/identity/kinds.go b/tool/tbot/identity/kinds.go
new file mode 100644
index 0000000000000..5e98ff2da6905
--- /dev/null
+++ b/tool/tbot/identity/kinds.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package identity
+
+import (
+	"strings"
+
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v3"
+)
+
+// ArtifactKind is a type of identity artifact that can be stored and loaded.
+type ArtifactKind string
+
+const (
+	// KindAlways identifies identity resources that should always be
+	// generated.
+	KindAlways ArtifactKind = "always"
+
+	// KindSSH identifies resources that should only be generated for SSH use.
+	KindSSH ArtifactKind = "ssh"
+
+	// KindTLS identifies resources that should only be stored for TLS use.
+	KindTLS ArtifactKind = "tls"
+
+	// KindBotInternal identifies resources that should only be stored in the
+	// bot's internal data directory.
+	KindBotInternal ArtifactKind = "bot-internal"
+)
+
+// allConfigKinds is a list of all ArtifactKinds allowed in config files.
+var allConfigKinds = []string{string(KindSSH), string(KindTLS)}
+
+func (ac *ArtifactKind) UnmarshalYAML(node *yaml.Node) error {
+	var kind string
+	if err := node.Decode(&kind); err != nil {
+		return err
+	}
+
+	// Only TLS and SSH are configurable values.
+	switch kind {
+	case string(KindTLS):
+		*ac = KindTLS
+	case string(KindSSH):
+		*ac = KindSSH
+	default:
+		return trace.BadParameter(
+			"invalid kind %q, expected one of: %s",
+			kind, strings.Join(allConfigKinds, ", "),
+		)
+	}
+
+	return nil
+}
+
+// ContainsKind determines if a particular artifact kind is included in the
+// list of kinds.
+func ContainsKind(kind ArtifactKind, kinds []ArtifactKind) bool {
+	for _, k := range kinds {
+		if kind == k {
+			return true
+		}
+	}
+
+	return false
+}
+
+// BotKinds returns a list of all artifact kinds used internally by the bot.
+// End-user destinations may contain a different set of artifacts.
+func BotKinds() []ArtifactKind {
+	return []ArtifactKind{KindAlways, KindBotInternal, KindSSH, KindTLS}
+}
diff --git a/tool/tbot/init.go b/tool/tbot/init.go
new file mode 100644
index 0000000000000..8a78090190ef8
--- /dev/null
+++ b/tool/tbot/init.go
@@ -0,0 +1,557 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/tool/tbot/botfs"
+	"github.com/gravitational/teleport/tool/tbot/config"
+	"github.com/gravitational/teleport/tool/tbot/identity"
+	"github.com/gravitational/trace"
+)
+
+// RootUID is the UID of the root user
+const RootUID = "0"
+
+// aclTestFailedMessage is printed when an ACL test fails.
+const aclTestFailedMessage = "ACLs are not usable for destination %s; " +
+	"Change the destination's ACL mode to `off` to silence this warning."
+
+// getInitArtifacts returns a map of all desired artifacts for the destination
+func getInitArtifacts(destination *config.DestinationConfig) (map[string]bool, error) {
+	// true = directory, false = regular file
+	toCreate := map[string]bool{}
+
+	// Collect all base artifacts and filter for the destination.
+	for _, artifact := range identity.GetArtifacts() {
+		if artifact.Matches(destination.Kinds...) {
+			toCreate[artifact.Key] = false
+		}
+	}
+
+	// Collect all config template artifacts.
+	for _, templateConfig := range destination.Configs {
+		template, err := templateConfig.GetConfigTemplate()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
+		for _, file := range template.Describe() {
+			toCreate[file.Name] = file.IsDir
+		}
+	}
+
+	return toCreate, nil
+}
+
+// getExistingArtifacts fetches all entries in a destination directory
+func getExistingArtifacts(dir string) (map[string]bool, error) {
+	existing := map[string]bool{}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	for _, entry := range entries {
+		existing[entry.Name()] = entry.IsDir()
+	}
+
+	return existing, nil
+}
+
+// diffArtifacts computes the difference of two artifact sets
+func diffArtifacts(a, b map[string]bool) map[string]bool {
+	diff := map[string]bool{}
+
+	for k, v := range a {
+		if _, ok := b[k]; !ok {
+			diff[k] = v
+		}
+	}
+
+	return diff
+}
+
+// testACL creates a temporary file and attempts to apply an ACL to it. If the
+// ACL is successfully applied, returns nil; otherwise, returns the error.
+func testACL(directory string, ownerUser *user.User, opts *botfs.ACLOptions) error {
+	// Note: we need to create the test file in the dest dir to ensure we
+	// actually test the target filesystem.
+	id, err := uuid.NewRandom()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	testFile := filepath.Join(directory, id.String())
+	if err := botfs.Create(testFile, false, botfs.SymlinksInsecure); err != nil {
+		return trace.Wrap(err)
+	}
+
+	defer func() {
+		err := os.Remove(testFile)
+		if err != nil {
+			log.Debugf("Failed to delete ACL test file %q", testFile)
+		}
+	}()
+
+	//nolint:staticcheck // staticcheck doesn't like nop implementations in fs_other.go
+	if err := botfs.ConfigureACL(testFile, ownerUser, opts); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+// ensurePermissionsParams sets permissions options
+type ensurePermissionsParams struct {
+	// dirPath is the directory containing the file
+	dirPath string
+
+	// symlinksMode configures symlink attack mitigation behavior
+	symlinksMode botfs.SymlinksMode
+
+	// ownerUser is the user that should own the file
+	ownerUser *user.User
+
+	// ownerGroup is the group that should own the file
+	ownerGroup *user.Group
+
+	// aclOptions contains configuration for ACLs, if they are in use. nil if
+	// ACLs are disabled
+	aclOptions *botfs.ACLOptions
+
+	// toCreate is a set of files that will be newly created, used to reduce
+	// log spam when configuring new files
+	toCreate map[string]bool
+}
+
+// ensurePermissions verifies permissions on the given path and, when
+// possible, attempts to fix permissions / ACLs on any misconfigured paths.
+func ensurePermissions(params *ensurePermissionsParams, key string, isDir bool) error {
+	path := filepath.Join(params.dirPath, key)
+
+	//nolint:staticcheck // this entirely innocuous line generates "related
+	// information" lints for a false positive staticcheck lint relating to
+	// nop function implementations in fs_other.go.
+	stat, err := os.Stat(path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	cleanPath := filepath.Clean(path)
+	resolved, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Precomputed flag to determine if certain log messages should be hidden.
+	// We expect ownership, ACLs, etc to be wrong on initial create so warnings
+	// are not desirable.
+	_, newlyCreated := params.toCreate[key]
+	verboseLogging := key != "" && !newlyCreated
+
+	// This is unlikely as CreateSecure() refuses to follow symlinks, but users
+	// could move things around after the fact.
+	if cleanPath != resolved {
+		switch params.symlinksMode {
+		case botfs.SymlinksSecure:
+			return trace.BadParameter("Path %q contains symlinks which is not "+
+				"allowed for security reasons.", path)
+		case botfs.SymlinksInsecure:
+			// do nothing
+		default:
+			log.Warnf("Path %q contains symlinks and may be subject to symlink "+
+				"attacks. If this is intentional, consider setting `symlinks: "+
+				"insecure` in destination config.", path)
+		}
+	}
+
+	// A few conditions we won't try to handle...
+	if isDir && !stat.IsDir() {
+		return trace.BadParameter("File %s is expected to be a directory but is a file", path)
+	} else if !isDir && stat.IsDir() {
+		return trace.BadParameter("File %s is expected to be a file but is a directory", path)
+	}
+
+	currentUser, err := user.Current()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Correct ownership.
+	ownedByDesiredOwner, err := botfs.IsOwnedBy(stat, params.ownerUser)
+	if err != nil {
+		log.WithError(err).Debugf("Could not determine file ownership of %q", path)
+
+		// Can't read file ownership on this platform (e.g. Windows), so always
+		// attempt to chown (which does work on Windows)
+		ownedByDesiredOwner = false
+	}
+
+	if !ownedByDesiredOwner {
+		// If we're not running as root, this will probably fail.
+		if currentUser.Uid != RootUID && runtime.GOOS != constants.WindowsOS {
+			log.Warnf("Not running as root, ownership change is likely to fail.")
+		}
+
+		uid, err := strconv.Atoi(params.ownerUser.Uid)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		gid, err := strconv.Atoi(params.ownerGroup.Gid)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if verboseLogging {
+			log.Warnf("Ownership of %q is incorrect and will be corrected to %s", path, params.ownerUser.Username)
+		}
+
+		err = os.Chown(path, uid, gid)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	if params.aclOptions != nil {
+		// We can verify ACLs as any user with read, but can only correct ACLs
+		// as root or the owner.
+		// Note that we rely on VerifyACL to return some error if permissions
+		// are incorrect.
+
+		//nolint:staticcheck // staticcheck doesn't like nop implementations in fs_other.go
+		err = botfs.VerifyACL(path, params.aclOptions)
+		//nolint:staticcheck
+		if err != nil && (currentUser.Uid == RootUID || currentUser.Uid == params.ownerUser.Uid) {
+			if verboseLogging {
+				log.Warnf("ACL for %q is not correct and will be corrected: %v", path, err)
+			}
+
+			return trace.Wrap(botfs.ConfigureACL(path, params.ownerUser, params.aclOptions))
+		} else if err != nil {
+			log.Errorf("ACL for %q is incorrect but `tbot init` must be run "+
+				"as root or the owner (%s) to correct it: %v",
+				path, params.ownerUser.Username, err)
+			return trace.AccessDenied("Elevated permissions required")
+		}
+
+		// ACL is valid.
+		return nil
+	}
+
+	desiredMode := botfs.DefaultMode
+	if stat.IsDir() {
+		desiredMode = botfs.DefaultDirMode
+	}
+
+	// Using regular permissions, so attempt to correct the file mode.
+	if stat.Mode().Perm() != desiredMode {
+		if err := os.Chmod(path, desiredMode); err != nil {
+			return trace.Wrap(err, "Could not fix permissions on file %q, expected %#o", path, desiredMode)
+		}
+
+		log.Infof("Corrected permissions on %q from %#o to %#o", path, stat.Mode().Perm(), botfs.DefaultMode)
+	}
+
+	return nil
+}
+
+// parseOwnerString parses and looks up an user and group from a user:group
+// owner string.
+func parseOwnerString(owner string) (*user.User, *user.Group, error) {
+	ownerParts := strings.Split(owner, ":")
+	if len(ownerParts) != 2 {
+		return nil, nil, trace.BadParameter("invalid owner string: %q", owner)
+	}
+
+	ownerUser, err := user.Lookup(ownerParts[0])
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	ownerGroup, err := user.LookupGroup(ownerParts[1])
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return ownerUser, ownerGroup, nil
+}
+
+// getOwner determines the user/group owner given a CLI parameter (--owner)
+// and desired default value. An empty defaultOwner defaults to the current
+// user and their primary group.
+func getOwner(cliOwner, defaultOwner string) (*user.User, *user.Group, error) {
+	if cliOwner != "" {
+		// If --owner is set, always use it.
+		log.Debugf("Attempting to use explicitly requested owner: %s", cliOwner)
+		return parseOwnerString(cliOwner)
+	}
+
+	if defaultOwner != "" {
+		log.Debugf("Attempting to use default owner: %s", defaultOwner)
+		// If a default owner is specified, try it instead.
+		return parseOwnerString(defaultOwner)
+	}
+
+	log.Debugf("Will use current user as owner.")
+	// Otherwise, return the current user and group
+	currentUser, err := user.Current()
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	currentGroup, err := user.LookupGroupId(currentUser.Gid)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	return currentUser, currentGroup, nil
+}
+
+// getAndTestACLOptions gets options needed to configure an ACL from CLI
+// options and attempts to configure a test ACL to validate them. Ownership is
+// not validated here.
+func getAndTestACLOptions(cf *config.CLIConf, destDir string) (*user.User, *user.Group, *botfs.ACLOptions, error) {
+	if cf.BotUser == "" {
+		return nil, nil, nil, trace.BadParameter("--bot-user must be set")
+	}
+
+	if cf.ReaderUser == "" {
+		return nil, nil, nil, trace.BadParameter("--reader-user must be set")
+	}
+
+	botUser, err := user.Lookup(cf.BotUser)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err)
+	}
+
+	botGroup, err := user.LookupGroupId(botUser.Gid)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err)
+	}
+
+	readerUser, err := user.Lookup(cf.ReaderUser)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err)
+	}
+
+	opts := botfs.ACLOptions{
+		BotUser:    botUser,
+		ReaderUser: readerUser,
+	}
+
+	// Default to letting the bot own the destination, since by this point we
+	// know the bot user definitely exists and is a reasonable owner choice.
+	defaultOwner := fmt.Sprintf("%s:%s", botUser.Username, botGroup.Name)
+
+	ownerUser, ownerGroup, err := getOwner(cf.Owner, defaultOwner)
+	if err != nil {
+		return nil, nil, nil, trace.Wrap(err)
+	}
+
+	err = testACL(destDir, ownerUser, &opts)
+	if err != nil && trace.IsAccessDenied(err) {
+		return nil, nil, nil, trace.Wrap(err, "The destination %q does not appear to be writable", destDir)
+	} else if err != nil {
+		return nil, nil, nil, trace.Wrap(err, "ACL support may need to be enabled for the filesystem.")
+	}
+
+	return ownerUser, ownerGroup, &opts, nil
+}
+
+func onInit(botConfig *config.BotConfig, cf *config.CLIConf) error {
+	var destination *config.DestinationConfig
+	var err error
+
+	// First, resolve the correct destination. If using a config file with only
+	// 1 destination we can assume we want to init that one; otherwise,
+	// --init-dir is required.
+	if cf.InitDir == "" {
+		if len(botConfig.Destinations) == 1 {
+			destination = botConfig.Destinations[0]
+		} else {
+			return trace.BadParameter("A destination to initialize must be specified with --init-dir")
+		}
+	} else {
+		destination, err = botConfig.GetDestinationByPath(cf.InitDir)
+		if err != nil {
+			return trace.WrapWithMessage(err, "Could not find specified destination %q", cf.InitDir)
+		}
+
+		if destination == nil {
+			// TODO: in the future if/when other backends are supported,
+			// destination might be nil because the user tried to enter a non
+			// filesystem path, so this error message could be misleading.
+			return trace.NotFound("Cannot initialize destination %q because "+
+				"it has not been configured.", cf.InitDir)
+		}
+	}
+
+	destImpl, err := destination.GetDestination()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	destDir, ok := destImpl.(*config.DestinationDirectory)
+	if !ok {
+		return trace.BadParameter("`tbot init` only supports directory destinations")
+	}
+
+	log.Infof("Initializing destination: %s", destImpl)
+
+	// Create the directory if needed. We haven't checked directory ownership,
+	// but it will fail when the ACLs are created if anything is misconfigured.
+	if err := destDir.Init(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Next, test if we want + have ACL support, and set aclOpts if we do.
+	// Desired owner is derived from the ACL mode.
+	var aclOpts *botfs.ACLOptions
+	var ownerUser *user.User
+	var ownerGroup *user.Group
+
+	switch destDir.ACLs {
+	case botfs.ACLRequired, botfs.ACLTry:
+		log.Debug("Testing for ACL support...")
+
+		// Awkward control flow here, but we want these to fail together.
+		ownerUser, ownerGroup, aclOpts, err = getAndTestACLOptions(cf, destDir.Path)
+		if err != nil {
+			if destDir.ACLs == botfs.ACLRequired {
+				// ACLs were specifically requested (vs "try" mode), so fail.
+				return trace.Wrap(err, aclTestFailedMessage, destImpl)
+			}
+
+			// Otherwise, fall back to no ACL with a warning.
+			log.WithError(err).Warnf(aclTestFailedMessage, destImpl)
+			aclOpts = nil
+
+			// We'll also need to re-fetch the owner as the defaults are
+			// different in the fallback case.
+			ownerUser, ownerGroup, err = getOwner(cf.Owner, "")
+			if err != nil {
+				return trace.Wrap(err)
+			}
+		} else if aclOpts.ReaderUser.Uid == ownerUser.Uid {
+			log.Warnf("The destination owner (%s) and reader (%s) are the "+
+				"same. This will break OpenSSH.", aclOpts.ReaderUser.Username,
+				ownerUser.Username)
+		}
+	default:
+		log.Info("ACLs disabled for this destination.")
+		ownerUser, ownerGroup, err = getOwner(cf.Owner, "")
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	// Next, resolve what we want and what we already have.
+	desired, err := getInitArtifacts(destination)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	existing, err := getExistingArtifacts(destDir.Path)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	toCreate := diffArtifacts(desired, existing)
+	toRemove := diffArtifacts(existing, desired)
+
+	// Based on this, create any new files.
+	if len(toCreate) > 0 {
+		log.Infof("Attempting to create: %v", toCreate)
+
+		for key, isDir := range toCreate {
+			path := filepath.Join(destDir.Path, key)
+			if err := botfs.Create(path, isDir, destDir.Symlinks); err != nil {
+				return trace.Wrap(err)
+			}
+
+			log.Infof("Created: %s", path)
+		}
+	} else {
+		log.Info("Nothing to create.")
+	}
+
+	// ... and warn about / remove any unneeded files.
+	if len(toRemove) > 0 && cf.Clean {
+		log.Infof("Attempting to remove: %v", toRemove)
+
+		var errors []error
+
+		for key := range toRemove {
+			path := filepath.Join(destDir.Path, key)
+
+			if err := os.RemoveAll(path); err != nil {
+				errors = append(errors, err)
+			} else {
+				log.Infof("Removed: %s", path)
+			}
+		}
+
+		if err := trace.NewAggregate(errors...); err != nil {
+			return trace.Wrap(err)
+		}
+	} else if len(toRemove) > 0 {
+		log.Warnf("Unexpected files found in destination directory, consider " +
+			"removing it manually or rerunning `tbot init` with the `--clean` " +
+			"flag.")
+	} else {
+		log.Info("Nothing to remove.")
+	}
+
+	params := ensurePermissionsParams{
+		dirPath:      destDir.Path,
+		aclOptions:   aclOpts,
+		ownerUser:    ownerUser,
+		ownerGroup:   ownerGroup,
+		symlinksMode: destDir.Symlinks,
+		toCreate:     toCreate,
+	}
+
+	// Check and set permissions on the directory itself.
+	if err := ensurePermissions(&params, "", true); err != nil {
+		return trace.Wrap(err)
+	}
+
+	// Lastly, set and check permissions on all the desired files.
+	for key, isDir := range desired {
+		if err := ensurePermissions(&params, key, isDir); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	log.Infof("Destination %s has been initialized. Note that these files "+
+		"will be empty and invalid until the bot issues certificates.",
+		destImpl)
+
+	return nil
+}
diff --git a/tool/tbot/init_test.go b/tool/tbot/init_test.go
new file mode 100644
index 0000000000000..d154e0cb39480
--- /dev/null
+++ b/tool/tbot/init_test.go
@@ -0,0 +1,271 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/gravitational/teleport/api/constants"
+	"github.com/gravitational/teleport/tool/tbot/botfs"
+	"github.com/gravitational/teleport/tool/tbot/config"
+	"github.com/gravitational/teleport/tool/tbot/identity"
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/require"
+)
+
+// usernamesToTry contains a list of usernames we can use as ACL targets in
+// testing.
+var usernamesToTry = []string{"nobody", "ci", "root"}
+
+func contains(entries []string, entry string) bool {
+	for _, e := range entries {
+		if e == entry {
+			return true
+		}
+	}
+
+	return false
+}
+
+// filterUsers returns the input list of usernames except for those in the
+// exclude list.
+func filterUsers(usernames, exclude []string) []string {
+	ret := []string{}
+
+	for _, username := range usernames {
+		if !contains(exclude, username) {
+			ret = append(ret, username)
+		}
+	}
+
+	return ret
+}
+
+// findUser attempts to find a usable user on the local system from the given
+// list of usernames and returns the first match found.
+func findUser(usernamesToTry, usernamesToExclude []string) (*user.User, error) {
+	filtered := filterUsers(usernamesToTry, usernamesToExclude)
+	for _, username := range filtered {
+		u, err := user.Lookup(username)
+		if err == nil {
+			return u, nil
+		}
+	}
+
+	return nil, trace.NotFound("No users found matching %+v (excluding %+v)", usernamesToTry, usernamesToExclude)
+}
+
+// getACLOptions returns sane ACLOptions for this platform.
+func getACLOptions() (*botfs.ACLOptions, error) {
+	if runtime.GOOS != constants.LinuxOS {
+		return nil, trace.NotImplemented("Unsupported platform")
+	}
+
+	user, err := user.Current()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	exclude := []string{user.Name}
+
+	// Find a set of users we can test against.
+	readerUser, err := findUser(usernamesToTry, exclude)
+	if trace.IsNotFound(err) {
+		return nil, trace.NotFound("Not enough usable users for testing ACLs")
+	} else if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	exclude = append(exclude, readerUser.Name)
+	botUser, err := findUser(usernamesToTry, exclude)
+	if trace.IsNotFound(err) {
+		return nil, trace.NotFound("Not enough suitable users found for testing ACLs.")
+	} else if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return &botfs.ACLOptions{
+		ReaderUser: readerUser,
+		BotUser:    botUser,
+	}, nil
+}
+
+// testConfigFromCLI creates a BotConfig from the given CLI config.
+func testConfigFromCLI(t *testing.T, cf *config.CLIConf) *config.BotConfig {
+	cfg, err := config.FromCLIConf(cf)
+	require.NoError(t, err)
+
+	return cfg
+}
+
+// testConfigFromString parses a YAML config file from a string.
+func testConfigFromString(t *testing.T, yaml string) *config.BotConfig {
+	cfg, err := config.ReadConfig(strings.NewReader(yaml))
+	require.NoError(t, err)
+
+	return cfg
+}
+
+// validateFileDestinations ensures all files in a destination exist on disk as
+// expected, and returns the destination.
+func validateFileDestination(t *testing.T, dest *config.DestinationConfig) *config.DestinationDirectory {
+	destImpl, err := dest.GetDestination()
+	require.NoError(t, err)
+
+	destDir, ok := destImpl.(*config.DestinationDirectory)
+	require.True(t, ok)
+
+	for _, art := range identity.GetArtifacts() {
+		if !art.Matches(dest.Kinds...) {
+			continue
+		}
+
+		require.FileExists(t, filepath.Join(destDir.Path, art.Key))
+	}
+
+	return destDir
+}
+
+// TestInit ensures defaults work regardless of host platform. With no bot user
+// specified, this never tries to use ACLs.
+func TestInit(t *testing.T) {
+	dir := t.TempDir()
+	cf := &config.CLIConf{
+		AuthServer:     "example.com",
+		DestinationDir: dir,
+	}
+	cfg := testConfigFromCLI(t, cf)
+
+	// Run init.
+	require.NoError(t, onInit(cfg, cf))
+
+	// Make sure everything was created.
+	_ = validateFileDestination(t, cfg.Destinations[0])
+}
+
+// TestInitMaybeACLs tests defaults with ACLs possibly enabled, by supplying
+// bot and reader users.
+func TestInitMaybeACLs(t *testing.T) {
+	opts, err := getACLOptions()
+	if trace.IsNotImplemented(err) {
+		t.Skipf("%+v", err)
+	} else if trace.IsNotFound(err) {
+		t.Skipf("%+v", err)
+	}
+	require.NoError(t, err)
+
+	hasACLSupport, err := botfs.HasACLSupport()
+	require.NoError(t, err)
+
+	currentUser, err := user.Current()
+	require.NoError(t, err)
+
+	currentGroup, err := user.LookupGroupId(currentUser.Gid)
+	require.NoError(t, err)
+
+	// Determine if we expect init to use ACLs.
+	expectACLs := false
+	if hasACLSupport {
+		if err := testACL(t.TempDir(), currentUser, opts); err == nil {
+			expectACLs = true
+		}
+	}
+
+	// Note: we'll use the current user as owner as that's the only way to
+	// guarantee ACL write access.
+	dir := t.TempDir()
+	cf := &config.CLIConf{
+		AuthServer:     "example.com",
+		DestinationDir: dir,
+		BotUser:        opts.BotUser.Username,
+		ReaderUser:     opts.ReaderUser.Username,
+
+		// This isn't a default, but unfortunately we need to specify a
+		// non-nobody owner for CI purposes.
+		Owner: fmt.Sprintf("%s:%s", currentUser.Name, currentGroup.Name),
+	}
+	cfg := testConfigFromCLI(t, cf)
+
+	// Run init.
+	require.NoError(t, onInit(cfg, cf))
+
+	// Make sure everything was created.
+	destDir := validateFileDestination(t, cfg.Destinations[0])
+
+	// If we expect ACLs, verify them.
+	if expectACLs {
+		require.NoError(t, destDir.Verify(identity.ListKeys(cfg.Destinations[0].Kinds...)))
+	} else {
+		t.Logf("Skipping ACL check on %q as they should not be supported.", dir)
+	}
+}
+
+// testInitSymlinksTemplate is a config template with a configurable symlinks
+// mode and ACLs disabled.
+const testInitSymlinksTemplate = `
+auth_server: example.com
+destinations:
+  - directory:
+      path: %s
+      acls: off
+      symlinks: %s
+`
+
+// TestInitSymlink tests tbot init with a symlink in the path.
+func TestInitSymlink(t *testing.T) {
+	secureWriteSupported, err := botfs.HasSecureWriteSupport()
+	require.NoError(t, err)
+	if !secureWriteSupported {
+		t.Skip("Secure write not supported on this system.")
+	}
+
+	dir := t.TempDir()
+
+	realPath := filepath.Join(dir, "data")
+	dataDir := filepath.Join(dir, "data-symlink")
+	require.NoError(t, os.Symlink(realPath, dataDir))
+
+	// Should fail due to symlink in path.
+	cfg := testConfigFromString(t, fmt.Sprintf(testInitSymlinksTemplate, dataDir, botfs.SymlinksSecure))
+	require.Error(t, onInit(cfg, &config.CLIConf{}))
+
+	// Should succeed when writing to the dir directly.
+	cfg = testConfigFromString(t, fmt.Sprintf(testInitSymlinksTemplate, realPath, botfs.SymlinksSecure))
+	require.NoError(t, onInit(cfg, &config.CLIConf{}))
+
+	// Make sure everything was created.
+	_ = validateFileDestination(t, cfg.Destinations[0])
+}
+
+// TestInitSymlinksInsecure should work on all platforms.
+func TestInitSymlinkInsecure(t *testing.T) {
+	dir := t.TempDir()
+
+	realPath := filepath.Join(dir, "data")
+	dataDir := filepath.Join(dir, "data-symlink")
+	require.NoError(t, os.Symlink(realPath, dataDir))
+
+	// Should succeed due to SymlinksInsecure
+	cfg := testConfigFromString(t, fmt.Sprintf(testInitSymlinksTemplate, dataDir, botfs.SymlinksInsecure))
+	require.Error(t, onInit(cfg, &config.CLIConf{}))
+}
diff --git a/tool/tbot/main.go b/tool/tbot/main.go
index 5c7c941c4e1c2..484a73f97caeb 100644
--- a/tool/tbot/main.go
+++ b/tool/tbot/main.go
@@ -17,10 +17,15 @@ limitations under the License.
 package main
 
 import (
+	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	"os"
+	"os/signal"
 	"strings"
+	"syscall"
 	"time"
 
 	"github.com/gravitational/teleport"
@@ -35,6 +40,7 @@ import (
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/tool/tbot/config"
+	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/gravitational/trace"
 	"github.com/kr/pretty"
@@ -62,28 +68,40 @@ func Run(args []string) error {
 	var cf config.CLIConf
 	utils.InitLogger(utils.LoggingForDaemon, logrus.InfoLevel)
 
-	app := utils.InitCLIParser("tbot", "tbot: Teleport Credential Bot").Interspersed(false)
+	app := utils.InitCLIParser("tbot", "tbot: Teleport Machine ID").Interspersed(false)
 	app.Flag("debug", "Verbose logging to stdout").Short('d').BoolVar(&cf.Debug)
-	app.Flag("config", "tbot.yaml path").Short('c').StringVar(&cf.ConfigPath)
+	app.Flag("config", "Path to a configuration file. Defaults to `/etc/tbot.yaml` if unspecified.").Short('c').StringVar(&cf.ConfigPath)
+	app.HelpFlag.Short('h')
+
+	versionCmd := app.Command("version", "Print the version")
 
 	startCmd := app.Command("start", "Starts the renewal bot, writing certificates to the data dir at a set interval.")
-	startCmd.Flag("auth-server", "Specify the Teleport auth server host").Short('a').Envar(authServerEnvVar).StringVar(&cf.AuthServer)
+	startCmd.Flag("auth-server", "Address of the Teleport Auth Server (On-Prem installs) or Proxy Server (Cloud installs).").Short('a').Envar(authServerEnvVar).StringVar(&cf.AuthServer)
 	startCmd.Flag("token", "A bot join token, if attempting to onboard a new bot; used on first connect.").Envar(tokenEnvVar).StringVar(&cf.Token)
-	startCmd.Flag("ca-pin", "A repeatable auth server CA hash to pin; used on first connect.").StringsVar(&cf.CAPins)
-	startCmd.Flag("data-dir", "Directory to store internal bot data.").StringVar(&cf.DataDir)
-	startCmd.Flag("destination-dir", "Directory to write generated certificates").StringVar(&cf.DestinationDir)
-	startCmd.Flag("certificate-ttl", "TTL of generated certificates").Default("60m").DurationVar(&cf.CertificateTTL)
-	startCmd.Flag("renew-interval", "Interval at which certificates are renewed; must be less than the certificate TTL.").DurationVar(&cf.RenewInterval)
-	startCmd.Flag("join-method", "Method to use to join the cluster.").Default("token").EnumVar(&cf.JoinMethod, "token", "iam")
+	startCmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&cf.CAPins)
+	startCmd.Flag("data-dir", "Directory to store internal bot data. Access to this directory should be limited.").StringVar(&cf.DataDir)
+	startCmd.Flag("destination-dir", "Directory to write short-lived machine certificates.").StringVar(&cf.DestinationDir)
+	startCmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").Default("60m").DurationVar(&cf.CertificateTTL)
+	startCmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&cf.RenewalInterval)
+	startCmd.Flag("join-method", "Method to use to join the cluster, can be \"token\" or \"iam\".").Default(config.DefaultJoinMethod).EnumVar(&cf.JoinMethod, "token", "iam")
+	startCmd.Flag("oneshot", "If set, quit after the first renewal.").BoolVar(&cf.Oneshot)
+
+	initCmd := app.Command("init", "Initialize a certificate destination directory for writes from a separate bot user.")
+	initCmd.Flag("destination-dir", "Directory to write short-lived machine certificates to.").StringVar(&cf.DestinationDir)
+	initCmd.Flag("owner", "Defines Linux \"user:group\" owner of \"--destination-dir\". Defaults to the Linux user running tbot if unspecified.").StringVar(&cf.Owner)
+	initCmd.Flag("bot-user", "Enables POSIX ACLs and defines Linux user that can read/write short-lived certificates to \"--destination-dir\".").StringVar(&cf.BotUser)
+	initCmd.Flag("reader-user", "Enables POSIX ACLs and defines Linux user that will read short-lived certificates from \"--destination-dir\".").StringVar(&cf.ReaderUser)
+	initCmd.Flag("init-dir", "If using a config file and multiple destinations are configured, controls which destination dir to configure.").StringVar(&cf.InitDir)
+	initCmd.Flag("clean", "If set, remove unexpected files and directories from the destination.").BoolVar(&cf.Clean)
 
 	configCmd := app.Command("config", "Parse and dump a config file").Hidden()
 
-	initCmd := app.Command("init", "Initialize a certificate destination directory.")
-
-	watchCmd := app.Command("watch", "Watch a destination directory for changes.")
+	watchCmd := app.Command("watch", "Watch a destination directory for changes.").Hidden()
 
+	utils.UpdateAppUsageTemplate(app, args)
 	command, err := app.Parse(args)
 	if err != nil {
+		app.Usage(args)
 		return trace.Wrap(err)
 	}
 
@@ -98,12 +116,14 @@ func Run(args []string) error {
 	}
 
 	switch command {
+	case versionCmd.FullCommand():
+		err = onVersion()
 	case startCmd.FullCommand():
 		err = onStart(botConfig)
 	case configCmd.FullCommand():
 		err = onConfig(botConfig)
 	case initCmd.FullCommand():
-		err = onInit(botConfig)
+		err = onInit(botConfig, &cf)
 	case watchCmd.FullCommand():
 		err = onWatch(botConfig)
 	default:
@@ -114,47 +134,65 @@ func Run(args []string) error {
 	return err
 }
 
+func onVersion() error {
+	utils.PrintVersion()
+	return nil
+}
+
 func onConfig(botConfig *config.BotConfig) error {
 	pretty.Println(botConfig)
 
 	return nil
 }
 
-func onInit(botConfig *config.BotConfig) error {
-	return trace.NotImplemented("init not yet implemented")
-}
-
 func onWatch(botConfig *config.BotConfig) error {
 	return trace.NotImplemented("watch not yet implemented")
 }
 
 func onStart(botConfig *config.BotConfig) error {
+	if botConfig.AuthServer == "" {
+		return trace.BadParameter("an auth or proxy server must be set via --auth-server or configuration")
+	}
+
+	// First, try to make sure all destinations are usable.
+	if err := checkDestinations(botConfig); err != nil {
+		return trace.Wrap(err)
+	}
+
 	// Start by loading the bot's primary destination.
 	dest, err := botConfig.Storage.GetDestination()
 	if err != nil {
 		return trace.Wrap(err, "could not read bot storage destination from config")
 	}
 
-	var authClient auth.ClientI
-
-	// TODO: graceful shutdown via signal; see #7066
+	reloadChan := make(chan struct{})
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
+	go handleSignals(reloadChan, cancel)
+
+	configTokenHashBytes := []byte{}
+	if botConfig.Onboarding != nil && botConfig.Onboarding.Token != "" {
+		sha := sha256.Sum256([]byte(botConfig.Onboarding.Token))
+		configTokenHashBytes = []byte(hex.EncodeToString(sha[:]))
+	}
+
+	var authClient auth.ClientI
+
 	// First, attempt to load an identity from storage.
-	ident, err := identity.LoadIdentity(dest)
-	if err == nil {
-		identStr, err := describeIdentity(ident)
+	ident, err := identity.LoadIdentity(dest, identity.BotKinds()...)
+	if err == nil && !hasTokenChanged(ident.TokenHashBytes, configTokenHashBytes) {
+		identStr, err := describeTLSIdentity(ident)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
 		log.Infof("Successfully loaded bot identity, %s", identStr)
 
-		// TODO: we should cache the token; if --token is provided but
-		// different, assume the user is attempting to start with a new
-		// identity. (May want to store a sha256 has to avoid storing the
-		// token directly.)
+		if err := checkIdentity(ident); err != nil {
+			return trace.Wrap(err)
+		}
+
 		if botConfig.Onboarding != nil {
 			log.Warn("Note: onboarding config ignored as identity was loaded from persistent storage")
 		}
@@ -167,9 +205,19 @@ func onStart(botConfig *config.BotConfig) error {
 		// If the identity can't be loaded, assume we're starting fresh and
 		// need to generate our initial identity from a token
 
+		if ident != nil {
+			// If ident is set here, we detected a token change above.
+			log.Warnf("Detected a token change, will attempt to fetch a new identity.")
+		}
+
 		// TODO: validate that errors from LoadIdentity are sanely typed; we
 		// actually only want to ignore NotFound errors
 
+		// Verify we can write to the destination.
+		if err := identity.VerifyWrite(dest); err != nil {
+			return trace.Wrap(err, "Could not write to destination %s, aborting.", dest)
+		}
+
 		// Get first identity
 		ident, err = getIdentityFromToken(botConfig)
 		if err != nil {
@@ -187,24 +235,18 @@ func onStart(botConfig *config.BotConfig) error {
 			return trace.Wrap(err, "unable to communicate with auth server")
 		}
 
-		identStr, err := describeIdentity(ident)
+		identStr, err := describeTLSIdentity(ident)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 		log.Infof("Successfully generated new bot identity, %s", identStr)
 
 		log.Debugf("Storing new bot identity to %s", dest)
-		if err := identity.SaveIdentity(ident, dest); err != nil {
+		if err := identity.SaveIdentity(ident, dest, identity.BotKinds()...); err != nil {
 			return trace.Wrap(err, "unable to save generated identity back to destination")
 		}
 	}
 
-	// TODO: handle cases where an identity exists on disk but we might _not_
-	// want to use it:
-	//  - identity has expired
-	//  - user provided a new token
-	//  - ???
-
 	watcher, err := authClient.NewWatcher(ctx, types.Watch{
 		Kinds: []types.WatchKind{{
 			Kind: types.KindCertAuthority,
@@ -218,7 +260,100 @@ func onStart(botConfig *config.BotConfig) error {
 
 	defer watcher.Close()
 
-	return renewLoop(ctx, botConfig, authClient, ident)
+	return renewLoop(ctx, botConfig, authClient, ident, reloadChan)
+}
+
+func hasTokenChanged(configTokenBytes, identityBytes []byte) bool {
+	if len(configTokenBytes) == 0 || len(identityBytes) == 0 {
+		return false
+	}
+
+	return !bytes.Equal(identityBytes, configTokenBytes)
+}
+
+// checkDestinations checks all destinations and tries to create any that
+// don't already exist.
+func checkDestinations(cfg *config.BotConfig) error {
+	// Note: This is vaguely problematic as we don't recommend that users
+	// store renewable certs under the same user as end-user certs. That said,
+	//  - if the destination was properly created via tbot init this is a no-op
+	//  - if users intend to follow that advice but miss a step, it should fail
+	//    due to lack of permissions
+	storage, err := cfg.Storage.GetDestination()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	// TODO: consider warning if ownership of all destintions is not expected.
+
+	if err := storage.Init(); err != nil {
+		return trace.Wrap(err)
+	}
+
+	for _, dest := range cfg.Destinations {
+		destImpl, err := dest.GetDestination()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+
+		if err := destImpl.Init(); err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+// checkIdentity performs basic startup checks on an identity and loudly warns
+// end users if it is unlikely to work.
+func checkIdentity(ident *identity.Identity) error {
+	var validAfter time.Time
+	var validBefore time.Time
+
+	if ident.X509Cert != nil {
+		validAfter = ident.X509Cert.NotBefore
+		validBefore = ident.X509Cert.NotAfter
+	} else if ident.SSHCert != nil {
+		validAfter = time.Unix(int64(ident.SSHCert.ValidAfter), 0)
+		validBefore = time.Unix(int64(ident.SSHCert.ValidBefore), 0)
+	} else {
+		return trace.BadParameter("identity is invalid and contains no certificates")
+	}
+
+	now := time.Now().UTC()
+	if now.After(validBefore) {
+		log.Errorf(
+			"Identity has expired. The renewal is likely to fail. (expires: %s, current time: %s)",
+			validBefore.Format(time.RFC3339),
+			now.Format(time.RFC3339),
+		)
+	} else if now.Before(validAfter) {
+		log.Warnf(
+			"Identity is not yet valid. Confirm that the system time is correct. (valid after: %s, current time: %s)",
+			validAfter.Format(time.RFC3339),
+			now.Format(time.RFC3339),
+		)
+	}
+
+	return nil
+}
+
+// handleSignals handles incoming Unix signals.
+func handleSignals(reload chan struct{}, cancel context.CancelFunc) {
+	signals := make(chan os.Signal, 1)
+	signal.Notify(signals, syscall.SIGINT, syscall.SIGHUP, syscall.SIGUSR1)
+
+	for signal := range signals {
+		switch signal {
+		case syscall.SIGINT:
+			log.Info("Received interrupt, cancelling...")
+			cancel()
+			return
+		case syscall.SIGHUP, syscall.SIGUSR1:
+			log.Info("Received reload signal, reloading...")
+			reload <- struct{}{}
+		}
+	}
 }
 
 func watchCARotations(watcher types.Watcher) {
@@ -253,7 +388,7 @@ func getIdentityFromToken(cfg *config.BotConfig) (*identity.Identity, error) {
 		return nil, trace.WrapWithMessage(err, "unable to generate new keypairs")
 	}
 
-	log.Info("attempting to generate new identity from token")
+	log.Info("Attempting to generate new identity from token")
 	params := auth.RegisterParams{
 		Token: cfg.Onboarding.Token,
 		ID: auth.IdentityID{
@@ -271,7 +406,13 @@ func getIdentityFromToken(cfg *config.BotConfig) (*identity.Identity, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ident, err := identity.ReadIdentityFromKeyPair(tlsPrivateKey, sshPublicKey, certs)
+	sha := sha256.Sum256([]byte(params.Token))
+	tokenHash := hex.EncodeToString(sha[:])
+	ident, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
+		PrivateKeyBytes: tlsPrivateKey,
+		PublicKeyBytes:  sshPublicKey,
+		TokenHashBytes:  []byte(tokenHash),
+	}, certs, identity.BotKinds()...)
 	return ident, trace.Wrap(err)
 }
 
@@ -299,18 +440,18 @@ func renewIdentityViaAuth(
 	// Ask the auth server to generate a new set of certs with a new
 	// expiration date.
 	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
-		PublicKey: currentIdentity.SSHPublicKeyBytes,
-		Username:  currentIdentity.XCert.Subject.CommonName,
+		PublicKey: currentIdentity.PublicKeyBytes,
+		Username:  currentIdentity.X509Cert.Subject.CommonName,
 		Expires:   time.Now().Add(cfg.CertificateTTL),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	newIdentity, err := identity.ReadIdentityFromKeyPair(
-		currentIdentity.KeyBytes,
-		currentIdentity.SSHPublicKeyBytes,
+	newIdentity, err := identity.ReadIdentityFromStore(
+		currentIdentity.Params(),
 		certs,
+		identity.BotKinds()...,
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -331,26 +472,31 @@ func fetchDefaultRoles(ctx context.Context, roleGetter services.RoleGetter, botR
 	return conditions.Roles, nil
 }
 
-// describeIdentity writes an informational message about the given identity to
+// describeTLSIdentity writes an informational message about the given identity to
 // the log.
-func describeIdentity(ident *identity.Identity) (string, error) {
-	tlsIdent, err := tlsca.FromSubject(ident.XCert.Subject, ident.XCert.NotAfter)
+func describeTLSIdentity(ident *identity.Identity) (string, error) {
+	cert := ident.X509Cert
+	if cert == nil {
+		return "", trace.BadParameter("attempted to describe TLS identity without TLS credentials")
+	}
+
+	tlsIdent, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
 	if err != nil {
 		return "", trace.Wrap(err, "bot TLS certificate can not be parsed as an identity")
 	}
 
 	var principals []string
-	for _, principal := range ident.Cert.ValidPrincipals {
+	for _, principal := range tlsIdent.Principals {
 		if !strings.HasPrefix(principal, constants.NoLoginPrefix) {
 			principals = append(principals, principal)
 		}
 	}
 
-	duration := time.Second * time.Duration(ident.Cert.ValidBefore-ident.Cert.ValidAfter)
+	duration := cert.NotAfter.Sub(cert.NotBefore)
 	return fmt.Sprintf(
-		"valid: after=%v, before=%v, duration=%s | properties: renewable=%v, disallow-reissue=%v, roles=%v, principals=%v, generation=%v",
-		time.Unix(int64(ident.Cert.ValidAfter), 0),
-		time.Unix(int64(ident.Cert.ValidBefore), 0),
+		"valid: after=%v, before=%v, duration=%s | kind=tls, renewable=%v, disallow-reissue=%v, roles=%v, principals=%v, generation=%v",
+		cert.NotBefore.Format(time.RFC3339),
+		cert.NotAfter.Format(time.RFC3339),
 		duration,
 		tlsIdent.Renewable,
 		tlsIdent.DisallowReissue,
@@ -360,136 +506,242 @@ func describeIdentity(ident *identity.Identity) (string, error) {
 	), nil
 }
 
-func renewLoop(ctx context.Context, cfg *config.BotConfig, client auth.ClientI, ident *identity.Identity) error {
-	// TODO: failures here should probably not just end the renewal loop, there
-	// should be some retry / back-off logic.
-
-	// TODO: what should this interval be? should it be user configurable?
-	// Also, must be < the validity period.
-	// TODO: validate that cert is actually renewable.
+// describeSSHIdentity writes an informational message about the given SSH
+// identity to the log.
+func describeSSHIdentity(ident *identity.Identity) (string, error) {
+	cert := ident.SSHCert
+	if cert == nil {
+		return "", trace.BadParameter("attempted to describe SSH identity without SSH credentials")
+	}
 
-	log.Infof("Beginning renewal loop: ttl=%s interval=%s", cfg.CertificateTTL, cfg.RenewInterval)
-	if cfg.RenewInterval > cfg.CertificateTTL {
-		log.Errorf(
-			"Certificate TTL (%s) is shorter than the renewal interval (%s). The next renewal is likely to fail.",
-			cfg.CertificateTTL,
-			cfg.RenewInterval,
-		)
+	renewable := false
+	if _, ok := cert.Extensions[teleport.CertExtensionRenewable]; ok {
+		renewable = true
 	}
 
-	// Determine where the bot should write its internal data (renewable cert
-	// etc)
-	botDestination, err := cfg.Storage.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
+	disallowReissue := false
+	if _, ok := cert.Extensions[teleport.CertExtensionDisallowReissue]; ok {
+		disallowReissue = true
 	}
 
-	ticker := time.NewTicker(cfg.RenewInterval)
-	defer ticker.Stop()
-	for {
-		log.Debug("Attempting to renew bot certificates...")
-		newIdentity, err := renewIdentityViaAuth(ctx, client, ident, cfg)
-		if err != nil {
-			return trace.Wrap(err)
+	var roles []string
+	if rolesStr, ok := cert.Extensions[teleport.CertExtensionTeleportRoles]; ok {
+		if actualRoles, err := services.UnmarshalCertRoles(rolesStr); err == nil {
+			roles = actualRoles
 		}
+	}
 
-		identStr, err := describeIdentity(ident)
-		if err != nil {
-			return trace.Wrap(err, "Could not describe bot identity at %s", botDestination)
+	var principals []string
+	for _, principal := range cert.ValidPrincipals {
+		if !strings.HasPrefix(principal, constants.NoLoginPrefix) {
+			principals = append(principals, principal)
 		}
+	}
+
+	duration := time.Second * time.Duration(cert.ValidBefore-cert.ValidAfter)
+	return fmt.Sprintf(
+		"valid: after=%v, before=%v, duration=%s | kind=ssh, renewable=%v, disallow-reissue=%v, roles=%v, principals=%v",
+		time.Unix(int64(cert.ValidAfter), 0).Format(time.RFC3339),
+		time.Unix(int64(cert.ValidBefore), 0).Format(time.RFC3339),
+		duration,
+		renewable,
+		disallowReissue,
+		roles,
+		principals,
+	), nil
+}
+
+// renew performs a single renewal
+func renew(
+	ctx context.Context, cfg *config.BotConfig, client auth.ClientI,
+	ident *identity.Identity, botDestination destination.Destination,
+) (auth.ClientI, *identity.Identity, error) {
+	// Make sure we can still write to the bot's destination.
+	if err := identity.VerifyWrite(botDestination); err != nil {
+		return nil, nil, trace.Wrap(err, "Cannot write to destination %s, aborting.", botDestination)
+	}
+
+	log.Debug("Attempting to renew bot certificates...")
+	newIdentity, err := renewIdentityViaAuth(ctx, client, ident, cfg)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	identStr, err := describeTLSIdentity(ident)
+	if err != nil {
+		return nil, nil, trace.Wrap(err, "Could not describe bot identity at %s", botDestination)
+	}
 
-		log.Infof("Successfully renewed bot certificates, %s", identStr)
+	log.Infof("Successfully renewed bot certificates, %s", identStr)
 
-		// TODO: warn if duration < certTTL? would indicate TTL > server's max renewable cert TTL
-		// TODO: error if duration < renewalInterval? next renewal attempt will fail
+	// TODO: warn if duration < certTTL? would indicate TTL > server's max renewable cert TTL
+	// TODO: error if duration < renewalInterval? next renewal attempt will fail
 
-		// Immediately attempt to reconnect using the new identity (still
-		// haven't persisted the known-good certs).
-		newClient, err := authenticatedUserClientFromIdentity(ctx, newIdentity, cfg.AuthServer)
+	// Immediately attempt to reconnect using the new identity (still
+	// haven't persisted the known-good certs).
+	newClient, err := authenticatedUserClientFromIdentity(ctx, newIdentity, cfg.AuthServer)
+	if err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	// Attempt a request to make sure our client works.
+	// TODO: consider a retry/backoff loop.
+	if _, err := newClient.Ping(ctx); err != nil {
+		return nil, nil, trace.Wrap(err, "unable to communicate with auth server")
+	}
+
+	log.Debug("Auth client now using renewed credentials.")
+	client = newClient
+	ident = newIdentity
+
+	// Now that we're sure the new creds work, persist them.
+	if err := identity.SaveIdentity(newIdentity, botDestination, identity.BotKinds()...); err != nil {
+		return nil, nil, trace.Wrap(err)
+	}
+
+	// Determine the default role list based on the bot role. The role's
+	// name should match the certificate's Key ID (user and role names
+	// should all match bot-$name)
+	botResourceName := ident.X509Cert.Subject.CommonName
+	defaultRoles, err := fetchDefaultRoles(ctx, client, botResourceName)
+	if err != nil {
+		log.WithError(err).Warnf("Unable to determine default roles, no roles will be requested if unspecified")
+		defaultRoles = []string{}
+	}
+
+	// Next, generate impersonated certs
+	expires := ident.X509Cert.NotAfter
+	for _, dest := range cfg.Destinations {
+		destImpl, err := dest.GetDestination()
 		if err != nil {
-			return trace.Wrap(err)
+			return nil, nil, trace.Wrap(err)
 		}
 
-		// Attempt a request to make sure our client works.
-		// TODO: consider a retry/backoff loop.
-		if _, err := newClient.Ping(ctx); err != nil {
-			return trace.Wrap(err, "unable to communicate with auth server")
+		// Check the ACLs. We can't fix them, but we can warn if they're
+		// misconfigured. We'll need to precompute a list of keys to check.
+		// Note: This may only log a warning, depending on configuration.
+		if err := destImpl.Verify(identity.ListKeys(dest.Kinds...)); err != nil {
+			return nil, nil, trace.Wrap(err)
 		}
 
-		log.Debug("Auth client now using renewed credentials.")
-		client = newClient
-		ident = newIdentity
+		// Ensure this destination is also writable. This is a hard fail if
+		// ACLs are misconfigured, regardless of configuration.
+		// TODO: consider not making these a hard error? e.g. write other
+		// destinations even if this one is broken?
+		if err := identity.VerifyWrite(destImpl); err != nil {
+			return nil, nil, trace.Wrap(err, "Could not write to destination %s, aborting.", destImpl)
+		}
 
-		// Now that we're sure the new creds work, persist them.
-		if err := identity.SaveIdentity(newIdentity, botDestination); err != nil {
-			return trace.Wrap(err)
+		var desiredRoles []string
+		if len(dest.Roles) > 0 {
+			desiredRoles = dest.Roles
+		} else {
+			log.Debugf("Destination specified no roles, defaults will be requested: %v", defaultRoles)
+			desiredRoles = defaultRoles
 		}
 
-		// Determine the default role list based on the bot role. The role's
-		// name should match the certificate's Key ID (user and role names
-		// should all match bot-$name)
-		defaultRoles, err := fetchDefaultRoles(ctx, client, ident.Cert.KeyId)
+		impersonatedIdent, err := generateImpersonatedIdentity(ctx, client, ident, expires, desiredRoles, dest.Kinds)
 		if err != nil {
-			log.WithError(err).Warnf("Unable to determine default roles, no roles will be requested if unspecified")
-			defaultRoles = []string{}
+			return nil, nil, trace.Wrap(err, "Failed to generate impersonated certs for %s: %+v", destImpl, err)
 		}
 
-		// Next, generate impersonated certs
-		expires := time.Unix(int64(ident.Cert.ValidBefore), 0)
-		for _, dest := range cfg.Destinations {
-			destImpl, err := dest.GetDestination()
+		var impersonatedIdentStr string
+		if dest.ContainsKind(identity.KindTLS) {
+			impersonatedIdentStr, err = describeTLSIdentity(impersonatedIdent)
 			if err != nil {
-				return trace.Wrap(err)
+				return nil, nil, trace.Wrap(err, "could not describe impersonated certs for destination %s", destImpl)
 			}
-
-			var desiredRoles []string
-			if len(dest.Roles) > 0 {
-				desiredRoles = dest.Roles
-			} else {
-				log.Debugf("Destination specified no roles, defaults will be requested: %v", defaultRoles)
-				desiredRoles = defaultRoles
-			}
-
-			impersonatedIdent, err := generateImpersonatedIdentity(ctx, client, ident, expires, desiredRoles)
+		} else {
+			// Note: kinds must contain at least 1 of TLS or SSH
+			impersonatedIdentStr, err = describeSSHIdentity(impersonatedIdent)
 			if err != nil {
-				return trace.Wrap(err, "Failed to generate impersonated certs for %s: %+v", destImpl, err)
+				return nil, nil, trace.Wrap(err, "could not describe impersonated certs for destination %s", destImpl)
 			}
+		}
+		log.Infof("Successfully renewed impersonated certificates for %s, %s", destImpl, impersonatedIdentStr)
+
+		if err := identity.SaveIdentity(impersonatedIdent, destImpl, dest.Kinds...); err != nil {
+			return nil, nil, trace.Wrap(err, "failed to save impersonated identity to destination %s", destImpl)
+		}
 
-			impersonatedIdentStr, err := describeIdentity(impersonatedIdent)
+		for _, templateConfig := range dest.Configs {
+			template, err := templateConfig.GetConfigTemplate()
 			if err != nil {
-				return trace.Wrap(err, "could not describe impersonated certs for destination %s", destImpl)
+				return nil, nil, trace.Wrap(err)
 			}
-			log.Infof("Successfully renewed impersonated certificates for %s, %s", destImpl, impersonatedIdentStr)
 
-			if err := identity.SaveIdentity(impersonatedIdent, destImpl); err != nil {
-				return trace.Wrap(err, "failed to save impersonated identity to destination %s", destImpl)
+			if err := template.Render(ctx, client, impersonatedIdent, dest); err != nil {
+				log.WithError(err).Warnf("Failed to render config template %+v", templateConfig)
 			}
+		}
+	}
 
-			for _, templateConfig := range dest.Configs {
-				template, err := templateConfig.GetConfigTemplate()
-				if err != nil {
-					return trace.Wrap(err)
-				}
+	log.Infof("Persisted new certificates to disk. Next renewal in approximately %s", cfg.RenewalInterval)
+	return newClient, newIdentity, nil
+}
 
-				if err := template.Render(ctx, client, impersonatedIdent, dest); err != nil {
-					log.WithError(err).Warnf("Failed to render config template %+v", templateConfig)
-				}
-			}
+func renewLoop(ctx context.Context, cfg *config.BotConfig, client auth.ClientI, ident *identity.Identity, reloadChan chan struct{}) error {
+	// TODO: failures here should probably not just end the renewal loop, there
+	// should be some retry / back-off logic.
+
+	// TODO: what should this interval be? should it be user configurable?
+	// Also, must be < the validity period.
+	// TODO: validate that cert is actually renewable.
+
+	log.Infof("Beginning renewal loop: ttl=%s interval=%s", cfg.CertificateTTL, cfg.RenewalInterval)
+	if cfg.RenewalInterval > cfg.CertificateTTL {
+		log.Errorf(
+			"Certificate TTL (%s) is shorter than the renewal interval (%s). The next renewal is likely to fail.",
+			cfg.CertificateTTL,
+			cfg.RenewalInterval,
+		)
+	}
+
+	// Determine where the bot should write its internal data (renewable cert
+	// etc)
+	botDestination, err := cfg.Storage.GetDestination()
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	ticker := time.NewTicker(cfg.RenewalInterval)
+	defer ticker.Stop()
+	for {
+		newClient, newIdentity, err := renew(ctx, cfg, client, ident, botDestination)
+		if err != nil {
+			return trace.Wrap(err)
 		}
 
-		log.Infof("Persisted new certificates to disk. Next renewal in approximately %s", cfg.RenewInterval)
+		if cfg.Oneshot {
+			log.Info("Oneshot mode enabled, exiting successfully.")
+			break
+		}
+
+		client = newClient
+		ident = newIdentity
 
 		select {
 		case <-ctx.Done():
 			return nil
 		case <-ticker.C:
 			continue
+		case <-reloadChan:
+			continue
 		}
-
 	}
+
+	return nil
 }
 
+// authenticatedUserClientFromIdentity creates a new auth client from the given
+// identity. Note that depending on the connection address given, this may
+// attempt to connect via the proxy and therefore requires both SSH and TLS
+// credentials.
 func authenticatedUserClientFromIdentity(ctx context.Context, id *identity.Identity, authServer string) (auth.ClientI, error) {
+	if id.SSHCert == nil || id.X509Cert == nil {
+		return nil, trace.BadParameter("auth client requires a fully formed identity")
+	}
+
 	tlsConfig, err := id.TLSConfig(nil /* cipherSuites */)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -522,6 +774,7 @@ func generateImpersonatedIdentity(
 	currentIdentity *identity.Identity,
 	expires time.Time,
 	roleRequests []string,
+	kinds []identity.ArtifactKind,
 ) (*identity.Identity, error) {
 	// TODO: enforce expiration > renewal period (by what margin?)
 
@@ -537,7 +790,7 @@ func generateImpersonatedIdentity(
 	// expiration date.
 	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
 		PublicKey:    publicKey,
-		Username:     currentIdentity.XCert.Subject.CommonName,
+		Username:     currentIdentity.X509Cert.Subject.CommonName,
 		Expires:      expires,
 		RoleRequests: roleRequests,
 	})
@@ -566,11 +819,10 @@ func generateImpersonatedIdentity(
 		certs.TLSCACerts = append(certs.TLSCACerts, pemBytes)
 	}
 
-	newIdentity, err := identity.ReadIdentityFromKeyPair(
-		privateKey,
-		publicKey,
-		certs,
-	)
+	newIdentity, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
+		PrivateKeyBytes: privateKey,
+		PublicKeyBytes:  publicKey,
+	}, certs, kinds...)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/app_command.go b/tool/tctl/common/app_command.go
index 3c5554a018c86..711e18b7d01ce 100644
--- a/tool/tctl/common/app_command.go
+++ b/tool/tctl/common/app_command.go
@@ -25,8 +25,12 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
+	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/service"
 )
 
@@ -37,6 +41,13 @@ type AppsCommand struct {
 	// format is the output format (text, json, or yaml)
 	format string
 
+	searchKeywords string
+	predicateExpr  string
+	labels         string
+
+	// verbose sets whether full table output should be shown for labels
+	verbose bool
+
 	// appsList implements the "tctl apps ls" subcommand.
 	appsList *kingpin.CmdClause
 }
@@ -47,7 +58,11 @@ func (c *AppsCommand) Initialize(app *kingpin.Application, config *service.Confi
 
 	apps := app.Command("apps", "Operate on applications registered with the cluster.")
 	c.appsList = apps.Command("ls", "List all applications registered with the cluster.")
-	c.appsList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default("text").StringVar(&c.format)
+	c.appsList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).StringVar(&c.format)
+	c.appsList.Arg("labels", labelHelp).StringVar(&c.labels)
+	c.appsList.Flag("search", searchHelp).StringVar(&c.searchKeywords)
+	c.appsList.Flag("query", queryHelp).StringVar(&c.predicateExpr)
+	c.appsList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
 }
 
 // TryRun attempts to run subcommands like "apps ls".
@@ -63,27 +78,52 @@ func (c *AppsCommand) TryRun(cmd string, client auth.ClientI) (match bool, err e
 
 // ListApps prints the list of applications that have recently sent heartbeats
 // to the cluster.
-func (c *AppsCommand) ListApps(client auth.ClientI) error {
-	servers, err := client.GetApplicationServers(context.TODO(), apidefaults.Namespace)
+func (c *AppsCommand) ListApps(clt auth.ClientI) error {
+	ctx := context.TODO()
+
+	labels, err := libclient.ParseLabelSpec(c.labels)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	coll := &appServerCollection{servers: servers}
+
+	var servers []types.AppServer
+	resources, err := client.GetResourcesWithFilters(ctx, clt, proto.ListResourcesRequest{
+		ResourceType:        types.KindAppServer,
+		Labels:              labels,
+		PredicateExpression: c.predicateExpr,
+		SearchKeywords:      libclient.ParseSearchKeywords(c.searchKeywords, ','),
+	})
+	switch {
+	// Underlying ListResources for app servers not available, use fallback.
+	// Using filter flags with older auth will silently do nothing.
+	//
+	// DELETE IN 11.0.0
+	case trace.IsNotImplemented(err):
+		servers, err = clt.GetApplicationServers(ctx, apidefaults.Namespace)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	case err != nil:
+		return trace.Wrap(err)
+	default:
+		servers, err = types.ResourcesWithLabels(resources).AsAppServers()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	coll := &appServerCollection{servers: servers, verbose: c.verbose}
 
 	switch c.format {
 	case teleport.Text:
-		err = coll.writeText(os.Stdout)
+		return trace.Wrap(coll.writeText(os.Stdout))
 	case teleport.JSON:
-		err = coll.writeJSON(os.Stdout)
+		return trace.Wrap(coll.writeJSON(os.Stdout))
 	case teleport.YAML:
-		err = coll.writeYAML(os.Stdout)
+		return trace.Wrap(coll.writeYAML(os.Stdout))
 	default:
 		return trace.BadParameter("unknown format %q", c.format)
 	}
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
 }
 
 var appMessageTemplate = template.Must(template.New("app").Parse(`The invite token: {{.token}}.
diff --git a/tool/tctl/common/auth_command.go b/tool/tctl/common/auth_command.go
index 6dce83157fa70..f89acecb3155a 100644
--- a/tool/tctl/common/auth_command.go
+++ b/tool/tctl/common/auth_command.go
@@ -19,7 +19,6 @@ import (
 	"crypto/x509/pkix"
 	"encoding/pem"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -133,15 +132,16 @@ func (a *AuthCommand) Initialize(app *kingpin.Application, config *service.Confi
 // TryRun takes the CLI command as an argument (like "auth gen") and executes it
 // or returns match=false if 'cmd' does not belong to it
 func (a *AuthCommand) TryRun(cmd string, client auth.ClientI) (match bool, err error) {
+	ctx := context.Background()
 	switch cmd {
 	case a.authGenerate.FullCommand():
-		err = a.GenerateKeys()
+		err = a.GenerateKeys(ctx)
 	case a.authExport.FullCommand():
-		err = a.ExportAuthorities(client)
+		err = a.ExportAuthorities(ctx, client)
 	case a.authSign.FullCommand():
-		err = a.GenerateAndSignKeys(client)
+		err = a.GenerateAndSignKeys(ctx, client)
 	case a.authRotate.FullCommand():
-		err = a.RotateCertAuthority(client)
+		err = a.RotateCertAuthority(ctx, client)
 	default:
 		return false, nil
 	}
@@ -153,7 +153,7 @@ var allowedCertificateTypes = []string{"user", "host", "tls-host", "tls-user", "
 // ExportAuthorities outputs the list of authorities in OpenSSH compatible formats
 // If --type flag is given, only prints keys for CAs of this type, otherwise
 // prints all keys
-func (a *AuthCommand) ExportAuthorities(client auth.ClientI) error {
+func (a *AuthCommand) ExportAuthorities(ctx context.Context, client auth.ClientI) error {
 	var typesToExport []types.CertAuthType
 
 	// this means to export TLS authority
@@ -162,11 +162,11 @@ func (a *AuthCommand) ExportAuthorities(client auth.ClientI) error {
 	// "tls-host" and "tls-user" were added later to allow export of the user
 	// TLS CA.
 	case "tls", "tls-host":
-		return a.exportTLSAuthority(client, types.HostCA, false)
+		return a.exportTLSAuthority(ctx, client, types.HostCA, false)
 	case "tls-user":
-		return a.exportTLSAuthority(client, types.UserCA, false)
+		return a.exportTLSAuthority(ctx, client, types.UserCA, false)
 	case "tls-user-der", "windows":
-		return a.exportTLSAuthority(client, types.UserCA, true)
+		return a.exportTLSAuthority(ctx, client, types.UserCA, true)
 	}
 
 	// if no --type flag is given, export all types
@@ -188,7 +188,7 @@ func (a *AuthCommand) ExportAuthorities(client auth.ClientI) error {
 	// trusted ones)
 	var authorities []types.CertAuthority
 	for _, at := range typesToExport {
-		cas, err := client.GetCertAuthorities(at, a.exportPrivateKeys)
+		cas, err := client.GetCertAuthorities(ctx, at, a.exportPrivateKeys)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -257,12 +257,13 @@ func (a *AuthCommand) ExportAuthorities(client auth.ClientI) error {
 	return nil
 }
 
-func (a *AuthCommand) exportTLSAuthority(client auth.ClientI, typ types.CertAuthType, unpackPEM bool) error {
+func (a *AuthCommand) exportTLSAuthority(ctx context.Context, client auth.ClientI, typ types.CertAuthType, unpackPEM bool) error {
 	clusterName, err := client.GetDomainName()
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	certAuthority, err := client.GetCertAuthority(
+		ctx,
 		types.CertAuthID{Type: typ, DomainName: clusterName},
 		a.exportPrivateKeys,
 	)
@@ -295,19 +296,19 @@ func (a *AuthCommand) exportTLSAuthority(client auth.ClientI, typ types.CertAuth
 }
 
 // GenerateKeys generates a new keypair
-func (a *AuthCommand) GenerateKeys() error {
-	keygen := native.New(context.TODO(), native.PrecomputeKeys(0))
+func (a *AuthCommand) GenerateKeys(ctx context.Context) error {
+	keygen := native.New(ctx, native.PrecomputeKeys(0))
 	defer keygen.Close()
 	privBytes, pubBytes, err := keygen.GenerateKeyPair("")
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	err = ioutil.WriteFile(a.genPubPath, pubBytes, 0600)
+	err = os.WriteFile(a.genPubPath, pubBytes, 0600)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	err = ioutil.WriteFile(a.genPrivPath, privBytes, 0600)
+	err = os.WriteFile(a.genPrivPath, privBytes, 0600)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -317,23 +318,23 @@ func (a *AuthCommand) GenerateKeys() error {
 }
 
 // GenerateAndSignKeys generates a new keypair and signs it for role
-func (a *AuthCommand) GenerateAndSignKeys(clusterAPI auth.ClientI) error {
+func (a *AuthCommand) GenerateAndSignKeys(ctx context.Context, clusterAPI auth.ClientI) error {
 	switch a.outputFormat {
 	case identityfile.FormatDatabase, identityfile.FormatMongo, identityfile.FormatCockroach, identityfile.FormatRedis:
-		return a.generateDatabaseKeys(clusterAPI)
+		return a.generateDatabaseKeys(ctx, clusterAPI)
 	}
 	switch {
 	case a.genUser != "" && a.genHost == "":
-		return a.generateUserKeys(clusterAPI)
+		return a.generateUserKeys(ctx, clusterAPI)
 	case a.genUser == "" && a.genHost != "":
-		return a.generateHostKeys(clusterAPI)
+		return a.generateHostKeys(ctx, clusterAPI)
 	default:
 		return trace.BadParameter("--user or --host must be specified")
 	}
 }
 
 // RotateCertAuthority starts or restarts certificate authority rotation process
-func (a *AuthCommand) RotateCertAuthority(client auth.ClientI) error {
+func (a *AuthCommand) RotateCertAuthority(ctx context.Context, client auth.ClientI) error {
 	req := auth.RotateRequest{
 		Type:        types.CertAuthType(a.rotateType),
 		GracePeriod: &a.rotateGracePeriod,
@@ -344,7 +345,7 @@ func (a *AuthCommand) RotateCertAuthority(client auth.ClientI) error {
 	} else {
 		req.Mode = types.RotationModeAuto
 	}
-	if err := client.RotateCertAuthority(req); err != nil {
+	if err := client.RotateCertAuthority(ctx, req); err != nil {
 		return err
 	}
 	if a.rotateTargetPhase != "" {
@@ -356,7 +357,7 @@ func (a *AuthCommand) RotateCertAuthority(client auth.ClientI) error {
 	return nil
 }
 
-func (a *AuthCommand) generateHostKeys(clusterAPI auth.ClientI) error {
+func (a *AuthCommand) generateHostKeys(ctx context.Context, clusterAPI auth.ClientI) error {
 	// only format=openssh is supported
 	if a.outputFormat != identityfile.FormatOpenSSH {
 		return trace.BadParameter("invalid --format flag %q, only %q is supported", a.outputFormat, identityfile.FormatOpenSSH)
@@ -383,7 +384,7 @@ func (a *AuthCommand) generateHostKeys(clusterAPI auth.ClientI) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	hostCAs, err := clusterAPI.GetCertAuthorities(types.HostCA, false)
+	hostCAs, err := clusterAPI.GetCertAuthorities(ctx, types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -410,17 +411,17 @@ func (a *AuthCommand) generateHostKeys(clusterAPI auth.ClientI) error {
 
 // generateDatabaseKeys generates a new unsigned key and signs it with Teleport
 // CA for database access.
-func (a *AuthCommand) generateDatabaseKeys(clusterAPI auth.ClientI) error {
+func (a *AuthCommand) generateDatabaseKeys(ctx context.Context, clusterAPI auth.ClientI) error {
 	key, err := client.NewKey()
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	return a.generateDatabaseKeysForKey(clusterAPI, key)
+	return a.generateDatabaseKeysForKey(ctx, clusterAPI, key)
 }
 
 // generateDatabaseKeysForKey signs the provided unsigned key with Teleport CA
 // for database access.
-func (a *AuthCommand) generateDatabaseKeysForKey(clusterAPI auth.ClientI, key *client.Key) error {
+func (a *AuthCommand) generateDatabaseKeysForKey(ctx context.Context, clusterAPI auth.ClientI, key *client.Key) error {
 	principals := strings.Split(a.genHost, ",")
 	if len(principals) == 1 && principals[0] == "" {
 		return trace.BadParameter("at least one hostname must be specified via --host flag")
@@ -455,7 +456,7 @@ func (a *AuthCommand) generateDatabaseKeysForKey(clusterAPI auth.ClientI, key *c
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	resp, err := clusterAPI.GenerateDatabaseCert(context.TODO(),
+	resp, err := clusterAPI.GenerateDatabaseCert(ctx,
 		&proto.DatabaseCertRequest{
 			CSR: csr,
 			// Important to include SANs since CommonName has been deprecated
@@ -553,13 +554,13 @@ cockroach start \
 To enable mutual TLS on your Redis server, add the following to your redis.conf:
 
 tls-ca-cert-file /path/to/{{.output}}.cas
-tls-cert-file /path/to/{{.output}}.crt 
+tls-cert-file /path/to/{{.output}}.crt
 tls-key-file /path/to/{{.output}}.key
 tls-protocols "TLSv1.2 TLSv1.3"
 `))
 )
 
-func (a *AuthCommand) generateUserKeys(clusterAPI auth.ClientI) error {
+func (a *AuthCommand) generateUserKeys(ctx context.Context, clusterAPI auth.ClientI) error {
 	// Validate --proxy flag.
 	if err := a.checkProxyAddr(clusterAPI); err != nil {
 		return trace.Wrap(err)
@@ -589,7 +590,7 @@ func (a *AuthCommand) generateUserKeys(clusterAPI auth.ClientI) error {
 	}
 	key.ClusterName = a.leafCluster
 
-	if err := a.checkKubeCluster(clusterAPI); err != nil {
+	if err := a.checkKubeCluster(ctx, clusterAPI); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -597,12 +598,12 @@ func (a *AuthCommand) generateUserKeys(clusterAPI auth.ClientI) error {
 	var certUsage proto.UserCertsRequest_CertUsage
 
 	if a.appName != "" {
-		server, err := getApplicationServer(context.TODO(), clusterAPI, a.appName)
+		server, err := getApplicationServer(ctx, clusterAPI, a.appName)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
-		appSession, err := clusterAPI.CreateAppSession(context.TODO(), types.CreateAppSessionRequest{
+		appSession, err := clusterAPI.CreateAppSession(ctx, types.CreateAppSessionRequest{
 			Username:    a.genUser,
 			PublicAddr:  server.GetApp().GetPublicAddr(),
 			ClusterName: a.leafCluster,
@@ -622,7 +623,7 @@ func (a *AuthCommand) generateUserKeys(clusterAPI auth.ClientI) error {
 
 	reqExpiry := time.Now().UTC().Add(a.genTTL)
 	// Request signed certs from `auth` server.
-	certs, err := clusterAPI.GenerateUserCerts(context.TODO(), proto.UserCertsRequest{
+	certs, err := clusterAPI.GenerateUserCerts(ctx, proto.UserCertsRequest{
 		PublicKey:         key.Pub,
 		Username:          a.genUser,
 		Expires:           reqExpiry,
@@ -638,7 +639,7 @@ func (a *AuthCommand) generateUserKeys(clusterAPI auth.ClientI) error {
 	key.Cert = certs.SSH
 	key.TLSCert = certs.TLS
 
-	hostCAs, err := clusterAPI.GetCertAuthorities(types.HostCA, false)
+	hostCAs, err := clusterAPI.GetCertAuthorities(ctx, types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -699,7 +700,7 @@ func (a *AuthCommand) checkLeafCluster(clusterAPI auth.ClientI) error {
 
 }
 
-func (a *AuthCommand) checkKubeCluster(clusterAPI auth.ClientI) error {
+func (a *AuthCommand) checkKubeCluster(ctx context.Context, clusterAPI auth.ClientI) error {
 	if a.outputFormat != identityfile.FormatKubernetes && a.kubeCluster != "" {
 		// User set --kube-cluster-name but it's not actually used for the chosen --format.
 		// Print a warning but continue.
@@ -719,7 +720,7 @@ func (a *AuthCommand) checkKubeCluster(clusterAPI auth.ClientI) error {
 		return nil
 	}
 
-	a.kubeCluster, err = kubeutils.CheckOrSetKubeCluster(context.TODO(), clusterAPI, a.kubeCluster, a.leafCluster)
+	a.kubeCluster, err = kubeutils.CheckOrSetKubeCluster(ctx, clusterAPI, a.kubeCluster, a.leafCluster)
 	if err != nil && !trace.IsNotFound(err) {
 		return trace.Wrap(err)
 	}
@@ -737,7 +738,21 @@ func (a *AuthCommand) checkProxyAddr(clusterAPI auth.ClientI) error {
 		return nil
 	}
 	if a.proxyAddr != "" {
-		return nil
+		// User set --proxy. Validate it and set its scheme to https in case it was omitted.
+		u, err := url.Parse(a.proxyAddr)
+		if err != nil {
+			return trace.WrapWithMessage(err, "specified --proxy URL is invalid")
+		}
+		switch u.Scheme {
+		case "":
+			u.Scheme = "https"
+			a.proxyAddr = u.String()
+			return nil
+		case "http", "https":
+			return nil
+		default:
+			return trace.BadParameter("expected --proxy URL with http or https scheme")
+		}
 	}
 
 	// User didn't specify --proxy for kubeconfig. Let's try to guess it.
diff --git a/tool/tctl/common/auth_command_test.go b/tool/tctl/common/auth_command_test.go
index 078160132d496..1b267066a6606 100644
--- a/tool/tctl/common/auth_command_test.go
+++ b/tool/tctl/common/auth_command_test.go
@@ -18,7 +18,6 @@ import (
 	"bytes"
 	"context"
 	"crypto/x509/pkix"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -42,11 +41,7 @@ import (
 func TestAuthSignKubeconfig(t *testing.T) {
 	t.Parallel()
 
-	tmpDir, err := ioutil.TempDir("", "auth_command_test")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(tmpDir)
+	tmpDir := t.TempDir()
 
 	clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
 		ClusterName: "example.com",
@@ -104,17 +99,55 @@ func TestAuthSignKubeconfig(t *testing.T) {
 		ac          AuthCommand
 		wantAddr    string
 		wantCluster string
-		wantError   string
+		assertErr   require.ErrorAssertionFunc
 	}{
 		{
-			desc: "--proxy specified",
+			desc: "valid --proxy URL with valid URL scheme",
+			ac: AuthCommand{
+				output:        filepath.Join(tmpDir, "kubeconfig"),
+				outputFormat:  identityfile.FormatKubernetes,
+				signOverwrite: true,
+				proxyAddr:     "https://proxy-from-flag.example.com",
+			},
+			wantAddr:  "https://proxy-from-flag.example.com",
+			assertErr: require.NoError,
+		},
+		{
+			desc: "valid --proxy URL with invalid URL scheme",
+			ac: AuthCommand{
+				output:        filepath.Join(tmpDir, "kubeconfig"),
+				outputFormat:  identityfile.FormatKubernetes,
+				signOverwrite: true,
+				proxyAddr:     "file://proxy-from-flag.example.com",
+			},
+			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
+				require.Error(t, err)
+				require.Equal(t, err.Error(), "expected --proxy URL with http or https scheme")
+			},
+		},
+		{
+			desc: "valid --proxy URL without URL scheme",
 			ac: AuthCommand{
 				output:        filepath.Join(tmpDir, "kubeconfig"),
 				outputFormat:  identityfile.FormatKubernetes,
 				signOverwrite: true,
 				proxyAddr:     "proxy-from-flag.example.com",
 			},
-			wantAddr: "proxy-from-flag.example.com",
+			wantAddr:  "https://proxy-from-flag.example.com",
+			assertErr: require.NoError,
+		},
+		{
+			desc: "invalid --proxy URL",
+			ac: AuthCommand{
+				output:        filepath.Join(tmpDir, "kubeconfig"),
+				outputFormat:  identityfile.FormatKubernetes,
+				signOverwrite: true,
+				proxyAddr:     "1https://proxy-from-flag.example.com",
+			},
+			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), "specified --proxy URL is invalid")
+			},
 		},
 		{
 			desc: "k8s proxy running locally with public_addr",
@@ -127,7 +160,8 @@ func TestAuthSignKubeconfig(t *testing.T) {
 					PublicAddrs: []utils.NetAddr{{Addr: "proxy-from-config.example.com:3026"}},
 				}}},
 			},
-			wantAddr: "https://proxy-from-config.example.com:3026",
+			wantAddr:  "https://proxy-from-config.example.com:3026",
+			assertErr: require.NoError,
 		},
 		{
 			desc: "k8s proxy running locally without public_addr",
@@ -142,7 +176,8 @@ func TestAuthSignKubeconfig(t *testing.T) {
 					PublicAddrs: []utils.NetAddr{{Addr: "proxy-from-config.example.com:3080"}},
 				}},
 			},
-			wantAddr: "https://proxy-from-config.example.com:3026",
+			wantAddr:  "https://proxy-from-config.example.com:3026",
+			assertErr: require.NoError,
 		},
 		{
 			desc: "k8s proxy from cluster info",
@@ -156,7 +191,8 @@ func TestAuthSignKubeconfig(t *testing.T) {
 					},
 				}},
 			},
-			wantAddr: "https://proxy-from-api.example.com:3026",
+			wantAddr:  "https://proxy-from-api.example.com:3026",
+			assertErr: require.NoError,
 		},
 		{
 			desc: "--kube-cluster specified with valid cluster",
@@ -172,6 +208,7 @@ func TestAuthSignKubeconfig(t *testing.T) {
 				}},
 			},
 			wantCluster: remoteCluster.GetMetadata().Name,
+			assertErr:   require.NoError,
 		},
 		{
 			desc: "--kube-cluster specified with invalid cluster",
@@ -186,19 +223,17 @@ func TestAuthSignKubeconfig(t *testing.T) {
 					},
 				}},
 			},
-			wantError: "couldn't find leaf cluster named \"doesnotexist.example.com\"",
+			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
+				require.Error(t, err)
+				require.Equal(t, err.Error(), "couldn't find leaf cluster named \"doesnotexist.example.com\"")
+			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			// Generate kubeconfig.
-			if err = tt.ac.generateUserKeys(client); err != nil && tt.wantError == "" {
-				t.Fatalf("generating KubeProxyConfig: %v", err)
-			}
-
-			if tt.wantError != "" && (err == nil || err.Error() != tt.wantError) {
-				t.Errorf("got error %v, want %v", err, tt.wantError)
-			}
+			err := tt.ac.generateUserKeys(context.Background(), client)
+			tt.assertErr(t, err)
 
 			// Validate kubeconfig contents.
 			kc, err := kubeconfig.Load(tt.ac.output)
@@ -248,7 +283,7 @@ func (c *mockClient) GenerateUserCerts(ctx context.Context, userCertsReq proto.U
 	c.userCertsReq = &userCertsReq
 	return c.userCerts, nil
 }
-func (c *mockClient) GetCertAuthorities(types.CertAuthType, bool, ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (c *mockClient) GetCertAuthorities(context.Context, types.CertAuthType, bool, ...services.MarshalOption) ([]types.CertAuthority, error) {
 	return c.cas, nil
 }
 func (c *mockClient) GetProxies() ([]types.Server, error) {
@@ -362,7 +397,7 @@ func TestCheckKubeCluster(t *testing.T) {
 				leafCluster:  tt.leafCluster,
 				outputFormat: tt.outputFormat,
 			}
-			err := a.checkKubeCluster(client)
+			err := a.checkKubeCluster(context.Background(), client)
 			tt.assertErr(t, err)
 			require.Equal(t, tt.want, a.kubeCluster)
 		})
@@ -499,7 +534,7 @@ func TestGenerateDatabaseKeys(t *testing.T) {
 				genTTL:        time.Hour,
 			}
 
-			err = ac.generateDatabaseKeysForKey(authClient, key)
+			err = ac.generateDatabaseKeysForKey(context.Background(), authClient, key)
 			if test.genKeyErrMsg == "" {
 				require.NoError(t, err)
 			} else {
@@ -516,19 +551,19 @@ func TestGenerateDatabaseKeys(t *testing.T) {
 			require.Equal(t, test.outServerNames[0], authClient.dbCertsReq.ServerName)
 
 			if len(test.outKey) > 0 {
-				keyBytes, err := ioutil.ReadFile(filepath.Join(test.inOutDir, test.outKeyFile))
+				keyBytes, err := os.ReadFile(filepath.Join(test.inOutDir, test.outKeyFile))
 				require.NoError(t, err)
 				require.Equal(t, test.outKey, keyBytes, "keys match")
 			}
 
 			if len(test.outCert) > 0 {
-				certBytes, err := ioutil.ReadFile(filepath.Join(test.inOutDir, test.outCertFile))
+				certBytes, err := os.ReadFile(filepath.Join(test.inOutDir, test.outCertFile))
 				require.NoError(t, err)
 				require.Equal(t, test.outCert, certBytes, "certificates match")
 			}
 
 			if len(test.outCA) > 0 {
-				caBytes, err := ioutil.ReadFile(filepath.Join(test.inOutDir, test.outCAFile))
+				caBytes, err := os.ReadFile(filepath.Join(test.inOutDir, test.outCAFile))
 				require.NoError(t, err)
 				require.Equal(t, test.outCA, caBytes, "CA certificates match")
 			}
@@ -612,7 +647,7 @@ func TestGenerateAppCertificates(t *testing.T) {
 				genTTL:        time.Hour,
 				appName:       tc.appName,
 			}
-			err = ac.generateUserKeys(authClient)
+			err = ac.generateUserKeys(context.Background(), authClient)
 			tc.assertErr(t, err)
 			if err != nil {
 				return
@@ -627,7 +662,7 @@ func TestGenerateAppCertificates(t *testing.T) {
 			require.Equal(t, proto.UserCertsRequest_App, authClient.userCertsReq.Usage)
 			require.Equal(t, expectedRouteToApp, authClient.userCertsReq.RouteToApp)
 
-			certBytes, err := ioutil.ReadFile(filepath.Join(tc.outDir, tc.outFileBase+".crt"))
+			certBytes, err := os.ReadFile(filepath.Join(tc.outDir, tc.outFileBase+".crt"))
 			require.NoError(t, err)
 			require.Equal(t, authClient.userCerts.TLS, certBytes, "certificates match")
 		})
diff --git a/tool/tctl/common/bots_command.go b/tool/tctl/common/bots_command.go
index 58e570cb2c882..882727f428054 100644
--- a/tool/tctl/common/bots_command.go
+++ b/tool/tctl/common/bots_command.go
@@ -34,6 +34,7 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/tlsca"
+	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/trace"
 )
 
@@ -66,6 +67,7 @@ func (c *BotsCommand) Initialize(app *kingpin.Application, config *service.Confi
 	c.botsAdd.Flag("roles", "Roles the bot is able to assume.").Required().StringVar(&c.botRoles)
 	c.botsAdd.Flag("ttl", "TTL for the bot join token.").DurationVar(&c.tokenTTL)
 	c.botsAdd.Flag("token", "Name of an existing token to use.").StringVar(&c.tokenID)
+	c.botsAdd.Flag("format", "Output format, 'text' or 'json'").Hidden().Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
 	// TODO: --ttl for setting a ttl on the join token
 
 	c.botsRemove = bots.Command("rm", "Permanently remove a certificate renewal bot from the cluster.")
@@ -135,10 +137,29 @@ func (c *BotsCommand) ListBots(client auth.ClientI) error {
 	return nil
 }
 
-var startMessageTemplate = template.Must(template.New("node").Parse(`The bot token: {{.token}}
+// bold wraps the given text in an ANSI escape to bold it
+func bold(text string) string {
+	return utils.Color(utils.Bold, text)
+}
+
+var startMessageTemplate = template.Must(template.New("node").Funcs(template.FuncMap{
+	"bold": bold,
+}).Parse(`The bot token: {{.token}}
 This token will expire in {{.minutes}} minutes.
 
-Run this on the new bot node to join the cluster:
+Optionally, if running the bot under an isolated user account, first initialize
+the data directory by running the following command {{ bold "as root" }}:
+
+> tbot init \
+   --destination-dir=./tbot-user \
+   --bot-user=tbot \
+   --reader-user=alice
+
+... where "tbot" is the username of the bot's UNIX user, and "alice" is the
+UNIX user that will be making use of the certificates.
+
+Then, run this {{ bold "as the bot user" }} to begin continuously fetching
+certificates:
 
 > tbot start \
    --destination-dir=./tbot-user \
@@ -149,6 +170,9 @@ Run this on the new bot node to join the cluster:
 
 Please note:
 
+  - The ./tbot-user destination directory can be changed as desired.
+  - /var/lib/teleport/bot must be accessible to the bot user, or --data-dir
+    must point to another accessible directory to store internal bot data.
   - This invitation token will expire in {{.minutes}} minutes
   - {{.auth_server}} must be reachable from the new node
 `))
@@ -165,6 +189,16 @@ func (c *BotsCommand) AddBot(client auth.ClientI) error {
 		return trace.WrapWithMessage(err, "error while creating bot")
 	}
 
+	if c.format == teleport.JSON {
+		out, err := json.MarshalIndent(response, "", "  ")
+		if err != nil {
+			return trace.Wrap(err, "failed to marshal CreateBot response")
+		}
+
+		fmt.Println(string(out))
+		return nil
+	}
+
 	// Calculate the CA pins for this cluster. The CA pins are used by the
 	// client to verify the identity of the Auth Server.
 	localCAResponse, err := client.GetClusterCACert()
diff --git a/tool/tctl/common/collection.go b/tool/tctl/common/collection.go
index 72faa13de047d..0a5bed166ff29 100644
--- a/tool/tctl/common/collection.go
+++ b/tool/tctl/common/collection.go
@@ -41,7 +41,8 @@ type ResourceCollection interface {
 }
 
 type roleCollection struct {
-	roles []types.Role
+	roles   []types.Role
+	verbose bool
 }
 
 func (r *roleCollection) resources() (res []types.Resource) {
@@ -52,17 +53,26 @@ func (r *roleCollection) resources() (res []types.Resource) {
 }
 
 func (r *roleCollection) writeText(w io.Writer) error {
-	t := asciitable.MakeTable([]string{"Role", "Allowed to login as", "Node Labels", "Access to resources"})
+	var rows [][]string
 	for _, r := range r.roles {
 		if r.GetName() == constants.DefaultImplicitRole {
 			continue
 		}
-		t.AddRow([]string{
+		rows = append(rows, []string{
 			r.GetMetadata().Name,
 			strings.Join(r.GetLogins(types.Allow), ","),
 			printNodeLabels(r.GetNodeLabels(types.Allow)),
 			printActions(r.GetRules(types.Allow))})
 	}
+
+	headers := []string{"Role", "Allowed to login as", "Node Labels", "Access to resources"}
+	var t asciitable.Table
+	if r.verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Access to resources")
+	}
+
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
@@ -116,6 +126,7 @@ func printNodeLabels(labels types.Labels) string {
 
 type serverCollection struct {
 	servers []types.Server
+	verbose bool
 }
 
 func (s *serverCollection) resources() (r []types.Resource) {
@@ -126,16 +137,38 @@ func (s *serverCollection) resources() (r []types.Resource) {
 }
 
 func (s *serverCollection) writeText(w io.Writer) error {
-	t := asciitable.MakeTable([]string{"Nodename", "UUID", "Address", "Labels"})
-	for _, s := range s.servers {
-		t.AddRow([]string{
-			s.GetHostname(), s.GetName(), s.GetAddr(), s.LabelsString(),
+	var rows [][]string
+	for _, se := range s.servers {
+		labels := stripInternalTeleportLabels(s.verbose, se.GetAllLabels())
+		rows = append(rows, []string{
+			se.GetHostname(), se.GetName(), se.GetAddr(), labels, se.GetTeleportVersion(),
 		})
 	}
+	headers := []string{"Host", "UUID", "Public Address", "Labels", "Version"}
+	var t asciitable.Table
+	if s.verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
+
+	}
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
 
+func (s *serverCollection) writeYaml(w io.Writer) error {
+	return utils.WriteYAML(w, s.servers)
+}
+
+func (s *serverCollection) writeJSON(w io.Writer) error {
+	data, err := json.MarshalIndent(s.resources(), "", "    ")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	_, err = w.Write(data)
+	return trace.Wrap(err)
+}
+
 type userCollection struct {
 	users []types.User
 }
@@ -441,6 +474,7 @@ func (c *semaphoreCollection) writeText(w io.Writer) error {
 
 type appServerCollection struct {
 	servers []types.AppServer
+	verbose bool
 }
 
 func (a *appServerCollection) resources() (r []types.Resource) {
@@ -451,13 +485,21 @@ func (a *appServerCollection) resources() (r []types.Resource) {
 }
 
 func (a *appServerCollection) writeText(w io.Writer) error {
-	t := asciitable.MakeTable([]string{"Application", "Host", "Public Address", "URI", "Labels"})
+	var rows [][]string
 	for _, server := range a.servers {
 		app := server.GetApp()
-		t.AddRow([]string{
-			app.GetName(), server.GetHostname(), app.GetPublicAddr(), app.GetURI(), app.LabelsString(),
-		})
+		labels := stripInternalTeleportLabels(a.verbose, app.GetAllLabels())
+		rows = append(rows, []string{
+			server.GetHostname(), app.GetName(), app.GetPublicAddr(), app.GetURI(), labels, server.GetTeleportVersion()})
+	}
+	var t asciitable.Table
+	headers := []string{"Host", "Name", "Public Address", "URI", "Labels", "Version"}
+	if a.verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
 	}
+
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
@@ -480,7 +522,8 @@ func (a *appServerCollection) writeYAML(w io.Writer) error {
 }
 
 type appCollection struct {
-	apps []types.Application
+	apps    []types.Application
+	verbose bool
 }
 
 func (c *appCollection) resources() (r []types.Resource) {
@@ -491,11 +534,18 @@ func (c *appCollection) resources() (r []types.Resource) {
 }
 
 func (c *appCollection) writeText(w io.Writer) error {
-	t := asciitable.MakeTable([]string{"Name", "Description", "URI", "Public Address", "Labels"})
+	var rows [][]string
 	for _, app := range c.apps {
-		t.AddRow([]string{
-			app.GetName(), app.GetDescription(), app.GetURI(), app.GetPublicAddr(), app.LabelsString(),
-		})
+		labels := stripInternalTeleportLabels(c.verbose, app.GetAllLabels())
+		rows = append(rows, []string{
+			app.GetName(), app.GetDescription(), app.GetURI(), app.GetPublicAddr(), labels, app.GetVersion()})
+	}
+	headers := []string{"Name", "Description", "URI", "Public Address", "Labels", "Version"}
+	var t asciitable.Table
+	if c.verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
 	}
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
@@ -590,6 +640,7 @@ func (c *netRestrictionsCollection) writeText(w io.Writer) error {
 
 type databaseServerCollection struct {
 	servers []types.DatabaseServer
+	verbose bool
 }
 
 func (c *databaseServerCollection) resources() (r []types.Resource) {
@@ -600,17 +651,25 @@ func (c *databaseServerCollection) resources() (r []types.Resource) {
 }
 
 func (c *databaseServerCollection) writeText(w io.Writer) error {
-	t := asciitable.MakeTable([]string{"Name", "Protocol", "URI", "Labels", "Hostname", "Version"})
+	var rows [][]string
 	for _, server := range c.servers {
-		t.AddRow([]string{
+		labels := stripInternalTeleportLabels(c.verbose, server.GetDatabase().GetAllLabels())
+		rows = append(rows, []string{
+			server.GetHostname(),
 			server.GetDatabase().GetName(),
 			server.GetDatabase().GetProtocol(),
 			server.GetDatabase().GetURI(),
-			server.GetDatabase().LabelsString(),
-			server.GetHostname(),
+			labels,
 			server.GetTeleportVersion(),
 		})
 	}
+	headers := []string{"Host", "Name", "Protocol", "URI", "Labels", "Version"}
+	var t asciitable.Table
+	if c.verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
+	}
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
@@ -634,6 +693,7 @@ func (c *databaseServerCollection) writeYAML(w io.Writer) error {
 
 type databaseCollection struct {
 	databases []types.Database
+	verbose   bool
 }
 
 func (c *databaseCollection) resources() (r []types.Resource) {
@@ -644,12 +704,20 @@ func (c *databaseCollection) resources() (r []types.Resource) {
 }
 
 func (c *databaseCollection) writeText(w io.Writer) error {
-	t := asciitable.MakeTable([]string{"Name", "Protocol", "URI", "Labels"})
+	var rows [][]string
 	for _, database := range c.databases {
-		t.AddRow([]string{
-			database.GetName(), database.GetProtocol(), database.GetURI(), database.LabelsString(),
+		labels := stripInternalTeleportLabels(c.verbose, database.GetAllLabels())
+		rows = append(rows, []string{
+			database.GetName(), database.GetProtocol(), database.GetURI(), labels,
 		})
 	}
+	headers := []string{"Name", "Protocol", "URI", "Labels"}
+	var t asciitable.Table
+	if c.verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
+	}
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
@@ -723,6 +791,59 @@ func (c *windowsDesktopCollection) writeText(w io.Writer) error {
 	return trace.Wrap(err)
 }
 
+type windowsDesktopAndService struct {
+	desktop types.WindowsDesktop
+	service types.WindowsDesktopService
+}
+
+type windowsDesktopAndServiceCollection struct {
+	desktops []windowsDesktopAndService
+	verbose  bool
+}
+
+func stripInternalTeleportLabels(verbose bool, labels map[string]string) string {
+	if verbose { // remove teleport.dev labels unless we're in verbose mode.
+		return types.LabelsAsString(labels, nil)
+	}
+	for key := range labels {
+		if strings.HasPrefix(key, types.TeleportNamespace+"/") {
+			delete(labels, key)
+		}
+	}
+	return types.LabelsAsString(labels, nil)
+}
+
+func (c *windowsDesktopAndServiceCollection) writeText(w io.Writer) error {
+	var rows [][]string
+	for _, d := range c.desktops {
+		labels := stripInternalTeleportLabels(c.verbose, d.desktop.GetAllLabels())
+		rows = append(rows, []string{d.service.GetHostname(), d.desktop.GetAddr(),
+			d.desktop.GetDomain(), labels, d.service.GetTeleportVersion()})
+	}
+	headers := []string{"Host", "Address", "AD Domain", "Labels", "Version"}
+	var t asciitable.Table
+	if c.verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
+	}
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
+
+func (c *windowsDesktopAndServiceCollection) writeYAML(w io.Writer) error {
+	return utils.WriteYAML(w, c.desktops)
+}
+
+func (c *windowsDesktopAndServiceCollection) writeJSON(w io.Writer) error {
+	data, err := json.MarshalIndent(c.desktops, "", "    ")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	_, err = w.Write(data)
+	return trace.Wrap(err)
+}
+
 type tokenCollection struct {
 	tokens []types.ProvisionToken
 }
@@ -743,3 +864,47 @@ func (c *tokenCollection) writeText(w io.Writer) error {
 	}
 	return nil
 }
+
+type kubeServerCollection struct {
+	servers []types.Server
+	verbose bool
+}
+
+func (c *kubeServerCollection) writeText(w io.Writer) error {
+	var rows [][]string
+	for _, server := range c.servers {
+		kubes := server.GetKubernetesClusters()
+		for _, kube := range kubes {
+			labels := stripInternalTeleportLabels(c.verbose,
+				types.CombineLabels(kube.StaticLabels, kube.DynamicLabels))
+			rows = append(rows, []string{
+				kube.Name,
+				labels,
+				server.GetTeleportVersion(),
+			})
+		}
+	}
+	headers := []string{"Cluster", "Labels", "Version"}
+	var t asciitable.Table
+	if c.verbose {
+		t = asciitable.MakeTable(headers, rows...)
+	} else {
+		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
+	}
+
+	_, err := t.AsBuffer().WriteTo(w)
+	return trace.Wrap(err)
+}
+
+func (c *kubeServerCollection) writeYAML(w io.Writer) error {
+	return utils.WriteYAML(w, c.servers)
+}
+
+func (c *kubeServerCollection) writeJSON(w io.Writer) error {
+	data, err := json.MarshalIndent(c.servers, "", "    ")
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	_, err = w.Write(data)
+	return trace.Wrap(err)
+}
diff --git a/tool/tctl/common/db_command.go b/tool/tctl/common/db_command.go
index 50e6ff1bad122..11426be1b081d 100644
--- a/tool/tctl/common/db_command.go
+++ b/tool/tctl/common/db_command.go
@@ -22,8 +22,12 @@ import (
 	"text/template"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
+	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/service"
 
 	"github.com/gravitational/kingpin"
@@ -37,6 +41,13 @@ type DBCommand struct {
 	// format is the output format (text, json or yaml).
 	format string
 
+	searchKeywords string
+	predicateExpr  string
+	labels         string
+
+	// verbose sets whether full table output should be shown for labels
+	verbose bool
+
 	// dbList implements the "tctl db ls" subcommand.
 	dbList *kingpin.CmdClause
 }
@@ -47,7 +58,11 @@ func (c *DBCommand) Initialize(app *kingpin.Application, config *service.Config)
 
 	db := app.Command("db", "Operate on databases registered with the cluster.")
 	c.dbList = db.Command("ls", "List all databases registered with the cluster.")
-	c.dbList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default("text").StringVar(&c.format)
+	c.dbList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).StringVar(&c.format)
+	c.dbList.Arg("labels", labelHelp).StringVar(&c.labels)
+	c.dbList.Flag("search", searchHelp).StringVar(&c.searchKeywords)
+	c.dbList.Flag("query", queryHelp).StringVar(&c.predicateExpr)
+	c.dbList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
 }
 
 // TryRun attempts to run subcommands like "db ls".
@@ -63,26 +78,51 @@ func (c *DBCommand) TryRun(cmd string, client auth.ClientI) (match bool, err err
 
 // ListDatabases prints the list of database proxies that have recently sent
 // heartbeats to the cluster.
-func (c *DBCommand) ListDatabases(client auth.ClientI) error {
-	servers, err := client.GetDatabaseServers(context.TODO(), apidefaults.Namespace)
+func (c *DBCommand) ListDatabases(clt auth.ClientI) error {
+	ctx := context.TODO()
+
+	labels, err := libclient.ParseLabelSpec(c.labels)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	coll := &databaseServerCollection{servers: servers}
+
+	var servers []types.DatabaseServer
+	resources, err := client.GetResourcesWithFilters(ctx, clt, proto.ListResourcesRequest{
+		ResourceType:        types.KindDatabaseServer,
+		Labels:              labels,
+		PredicateExpression: c.predicateExpr,
+		SearchKeywords:      libclient.ParseSearchKeywords(c.searchKeywords, ','),
+	})
+	switch {
+	// Underlying ListResources for db servers not available, use fallback.
+	// Using filter flags with older auth will silently do nothing.
+	//
+	// DELETE IN 11.0.0
+	case trace.IsNotImplemented(err):
+		servers, err = clt.GetDatabaseServers(ctx, apidefaults.Namespace)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	case err != nil:
+		return trace.Wrap(err)
+	default:
+		servers, err = types.ResourcesWithLabels(resources).AsDatabaseServers()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	coll := &databaseServerCollection{servers: servers, verbose: c.verbose}
 	switch c.format {
 	case teleport.Text:
-		err = coll.writeText(os.Stdout)
+		return trace.Wrap(coll.writeText(os.Stdout))
 	case teleport.JSON:
-		err = coll.writeJSON(os.Stdout)
+		return trace.Wrap(coll.writeJSON(os.Stdout))
 	case teleport.YAML:
-		err = coll.writeYAML(os.Stdout)
+		return trace.Wrap(coll.writeYAML(os.Stdout))
 	default:
 		return trace.BadParameter("unknown format %q", c.format)
 	}
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	return nil
 }
 
 var dbMessageTemplate = template.Must(template.New("db").Parse(`The invite token: {{.token}}.
diff --git a/tool/tctl/common/desktop_command.go b/tool/tctl/common/desktop_command.go
new file mode 100644
index 0000000000000..ad92a1b443d6e
--- /dev/null
+++ b/tool/tctl/common/desktop_command.go
@@ -0,0 +1,97 @@
+/*
+Copyright 2021 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package common
+
+import (
+	"context"
+	"os"
+
+	"github.com/gravitational/kingpin"
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/service"
+)
+
+// DesktopCommand implements "tctl desktop" group of commands.
+type DesktopCommand struct {
+	config *service.Config
+
+	// format is the output format (text or yaml)
+	format string
+
+	// verbose sets whether full table output should be shown for labels
+	verbose bool
+
+	// desktopList implements the "tctl desktop ls" subcommand.
+	desktopList *kingpin.CmdClause
+}
+
+// Initialize allows DesktopCommand to plug itself into the CLI parser
+func (c *DesktopCommand) Initialize(app *kingpin.Application, config *service.Config) {
+	c.config = config
+
+	desktop := app.Command("desktops", "Operate on registered desktops.")
+	c.desktopList = desktop.Command("ls", "List all desktops registered with the cluster.")
+	c.desktopList.Flag("format", "Output format, 'text', 'json' or 'yaml'").Default(teleport.Text).StringVar(&c.format)
+	c.desktopList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
+}
+
+// TryRun attempts to run subcommands like "desktop ls".
+func (c *DesktopCommand) TryRun(cmd string, client auth.ClientI) (match bool, err error) {
+	switch cmd {
+	case c.desktopList.FullCommand():
+		err = c.ListDesktop(client)
+	default:
+		return false, nil
+	}
+	return true, trace.Wrap(err)
+}
+
+// ListDesktop prints the list of desktops that have recently sent heartbeats
+// to the cluster.
+func (c *DesktopCommand) ListDesktop(client auth.ClientI) error {
+	desktops, err := client.GetWindowsDesktops(context.TODO(), types.WindowsDesktopFilter{})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	coll := windowsDesktopAndServiceCollection{
+		desktops: []windowsDesktopAndService{},
+		verbose:  c.verbose,
+	}
+	ctx := context.Background()
+	for _, desktop := range desktops {
+		ds, err := client.GetWindowsDesktopService(ctx, desktop.GetHostID())
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		coll.desktops = append(coll.desktops,
+			windowsDesktopAndService{desktop: desktop, service: ds})
+	}
+	switch c.format {
+	case teleport.Text:
+		return trace.Wrap(coll.writeText(os.Stdout))
+	case teleport.JSON:
+		return trace.Wrap(coll.writeJSON(os.Stdout))
+	case teleport.YAML:
+		return trace.Wrap(coll.writeYAML(os.Stdout))
+	default:
+		return trace.BadParameter("unknown format %q", c.format)
+	}
+}
diff --git a/tool/tctl/common/kube_command.go b/tool/tctl/common/kube_command.go
new file mode 100644
index 0000000000000..079eab31df597
--- /dev/null
+++ b/tool/tctl/common/kube_command.go
@@ -0,0 +1,84 @@
+/*
+Copyright 2021 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package common
+
+import (
+	"context"
+	"os"
+
+	"github.com/gravitational/kingpin"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/lib/service"
+)
+
+// KubeCommand implements "tctl kube" group of commands.
+type KubeCommand struct {
+	config *service.Config
+
+	// format is the output format (text or yaml)
+	format string
+
+	// verbose sets whether full table output should be shown for labels
+	verbose bool
+
+	// kubeList implements the "tctl kube ls" subcommand.
+	kubeList *kingpin.CmdClause
+}
+
+// Initialize allows KubeCommand to plug itself into the CLI parser
+func (c *KubeCommand) Initialize(app *kingpin.Application, config *service.Config) {
+	c.config = config
+
+	kube := app.Command("kube", "Operate on registered kubernetes clusters.")
+	c.kubeList = kube.Command("ls", "List all kubernetes clusters registered with the cluster.")
+	c.kubeList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).StringVar(&c.format)
+	c.kubeList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
+}
+
+// TryRun attempts to run subcommands like "kube ls".
+func (c *KubeCommand) TryRun(cmd string, client auth.ClientI) (match bool, err error) {
+	switch cmd {
+	case c.kubeList.FullCommand():
+		err = c.ListKube(client)
+	default:
+		return false, nil
+	}
+	return true, trace.Wrap(err)
+}
+
+// ListKube prints the list of kube clusters that have recently sent heartbeats
+// to the cluster.
+func (c *KubeCommand) ListKube(client auth.ClientI) error {
+	kubes, err := client.GetKubeServices(context.TODO())
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	coll := &kubeServerCollection{servers: kubes, verbose: c.verbose}
+	switch c.format {
+	case teleport.Text:
+		return trace.Wrap(coll.writeText(os.Stdout))
+	case teleport.JSON:
+		return trace.Wrap(coll.writeJSON(os.Stdout))
+	case teleport.YAML:
+		return trace.Wrap(coll.writeYAML(os.Stdout))
+	default:
+		return trace.BadParameter("unknown format %q", c.format)
+	}
+}
diff --git a/tool/tctl/common/node_command.go b/tool/tctl/common/node_command.go
index 1212b8ec7db24..5208268d7bca3 100644
--- a/tool/tctl/common/node_command.go
+++ b/tool/tctl/common/node_command.go
@@ -26,11 +26,16 @@ import (
 	"time"
 
 	"github.com/gravitational/kingpin"
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/trace"
+	log "github.com/sirupsen/logrus"
 
+	"github.com/gravitational/teleport/api/client"
+	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
+	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -52,6 +57,16 @@ type NodeCommand struct {
 	// if not specified, is autogenerated
 	token string
 
+	searchKeywords string
+	predicateExpr  string
+	labels         string
+
+	// ls output format -- text or json
+	lsFormat string
+
+	// verbose sets whether full table output should be shown for labels
+	verbose bool
+
 	// CLI subcommands (clauses)
 	nodeAdd  *kingpin.CmdClause
 	nodeList *kingpin.CmdClause
@@ -67,12 +82,17 @@ func (c *NodeCommand) Initialize(app *kingpin.Application, config *service.Confi
 	c.nodeAdd.Flag("roles", "Comma-separated list of roles for the new node to assume [node]").Default("node").StringVar(&c.roles)
 	c.nodeAdd.Flag("ttl", "Time to live for a generated token").Default(defaults.ProvisioningTokenTTL.String()).DurationVar(&c.ttl)
 	c.nodeAdd.Flag("token", "Custom token to use, autogenerated if not provided").StringVar(&c.token)
-	c.nodeAdd.Flag("format", "Output format, 'text' or 'json'").Hidden().Default("text").StringVar(&c.format)
+	c.nodeAdd.Flag("format", "Output format, 'text' or 'json'").Hidden().Default(teleport.Text).StringVar(&c.format)
 	c.nodeAdd.Alias(AddNodeHelp)
 
 	c.nodeList = nodes.Command("ls", "List all active SSH nodes within the cluster")
 	c.nodeList.Flag("namespace", "Namespace of the nodes").Default(apidefaults.Namespace).StringVar(&c.namespace)
+	c.nodeList.Flag("format", "Output format, 'text', or 'yaml'").Default(teleport.Text).StringVar(&c.lsFormat)
+	c.nodeList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
 	c.nodeList.Alias(ListNodesHelp)
+	c.nodeList.Arg("labels", labelHelp).StringVar(&c.labels)
+	c.nodeList.Flag("search", searchHelp).StringVar(&c.searchKeywords)
+	c.nodeList.Flag("query", queryHelp).StringVar(&c.predicateExpr)
 }
 
 // TryRun takes the CLI command as an argument (like "nodes ls") and executes it.
@@ -145,16 +165,33 @@ func (c *NodeCommand) Invite(client auth.ClientI) error {
 	}
 
 	// output format switch:
-	if c.format == "text" {
+	if c.format == teleport.Text {
 		if roles.Include(types.RoleTrustedCluster) {
 			fmt.Printf(trustedClusterMessage, token, int(c.ttl.Minutes()))
 		} else {
+			authServer := authServers[0].GetAddr()
+
+			pingResponse, err := client.Ping(context.TODO())
+			if err != nil {
+				log.Debugf("unnable to ping auth client: %s.", err.Error())
+			}
+
+			if err == nil && pingResponse.GetServerFeatures().Cloud {
+				proxies, err := client.GetProxies()
+				if err != nil {
+					return trace.Wrap(err)
+				}
+
+				if len(proxies) != 0 {
+					authServer = proxies[0].GetPublicAddr()
+				}
+			}
 			return nodeMessageTemplate.Execute(os.Stdout, map[string]interface{}{
 				"token":       token,
 				"minutes":     int(c.ttl.Minutes()),
 				"roles":       strings.ToLower(roles.String()),
 				"ca_pins":     caPins,
-				"auth_server": authServers[0].GetAddr(),
+				"auth_server": authServer,
 			})
 		}
 	} else {
@@ -172,15 +209,57 @@ func (c *NodeCommand) Invite(client auth.ClientI) error {
 
 // ListActive retreives the list of nodes who recently sent heartbeats to
 // to a cluster and prints it to stdout
-func (c *NodeCommand) ListActive(client auth.ClientI) error {
+func (c *NodeCommand) ListActive(clt auth.ClientI) error {
 	ctx := context.TODO()
-	nodes, err := client.GetNodes(ctx, c.namespace)
+
+	labels, err := libclient.ParseLabelSpec(c.labels)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	coll := &serverCollection{servers: nodes}
-	if err := coll.writeText(os.Stdout); err != nil {
+
+	var nodes []types.Server
+	resources, err := client.GetResourcesWithFilters(ctx, clt, proto.ListResourcesRequest{
+		ResourceType:        types.KindNode,
+		Namespace:           c.namespace,
+		Labels:              labels,
+		PredicateExpression: c.predicateExpr,
+		SearchKeywords:      libclient.ParseSearchKeywords(c.searchKeywords, ','),
+	})
+	switch {
+	// Underlying ListResources for nodes not available, use fallback.
+	// Using filter flags with older auth will silently do nothing.
+	//
+	// DELETE IN 11.0.0
+	case trace.IsNotImplemented(err):
+		nodes, err = clt.GetNodes(ctx, c.namespace)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	case err != nil:
 		return trace.Wrap(err)
+	default:
+		nodes, err = types.ResourcesWithLabels(resources).AsServers()
+		if err != nil {
+			return trace.Wrap(err)
+		}
+	}
+
+	coll := &serverCollection{servers: nodes, verbose: c.verbose}
+	switch c.lsFormat {
+	case teleport.Text:
+		if err := coll.writeText(os.Stdout); err != nil {
+			return trace.Wrap(err)
+		}
+	case teleport.YAML:
+		if err := coll.writeYaml(os.Stdout); err != nil {
+			return trace.Wrap(err)
+		}
+	case teleport.JSON:
+		if err := coll.writeJSON(os.Stdout); err != nil {
+			return trace.Wrap(err)
+		}
+	default:
+		return trace.Errorf("Invalid format %s, only text, json and yaml are supported", c.lsFormat)
 	}
 	return nil
 }
diff --git a/tool/tctl/common/resource_command.go b/tool/tctl/common/resource_command.go
index 7ef91868417db..87a55e6af44cd 100644
--- a/tool/tctl/common/resource_command.go
+++ b/tool/tctl/common/resource_command.go
@@ -68,6 +68,8 @@ type ResourceCommand struct {
 	createCmd *kingpin.CmdClause
 	updateCmd *kingpin.CmdClause
 
+	verbose bool
+
 	CreateHandlers map[ResourceKind]ResourceCreateHandler
 
 	// stdout allows to switch standard output source for resource command. Used in tests.
@@ -133,6 +135,7 @@ func (rc *ResourceCommand) Initialize(app *kingpin.Application, config *service.
 	rc.getCmd.Flag("format", "Output format: 'yaml', 'json' or 'text'").Default(teleport.YAML).StringVar(&rc.format)
 	rc.getCmd.Flag("namespace", "Namespace of the resources").Hidden().Default(apidefaults.Namespace).StringVar(&rc.namespace)
 	rc.getCmd.Flag("with-secrets", "Include secrets in resources like certificate authorities or OIDC connectors").Default("false").BoolVar(&rc.withSecrets)
+	rc.getCmd.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&rc.verbose)
 
 	rc.getCmd.Alias(getHelp)
 
@@ -770,6 +773,21 @@ func (rc *ResourceCommand) Delete(client auth.ClientI) (err error) {
 			return err
 		}
 		fmt.Printf(fmts+"\n", deleted, rc.ref.Name)
+	case types.KindCertAuthority:
+		if rc.ref.SubKind == "" || rc.ref.Name == "" {
+			return trace.BadParameter(
+				"full %s path must be specified (e.g. '%s/%s/clustername')",
+				types.KindCertAuthority, types.KindCertAuthority, types.HostCA,
+			)
+		}
+		err := client.DeleteCertAuthority(types.CertAuthID{
+			Type:       types.CertAuthType(rc.ref.SubKind),
+			DomainName: rc.ref.Name,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		fmt.Printf("%s '%s/%s' has been deleted\n", types.KindCertAuthority, rc.ref.SubKind, rc.ref.Name)
 	default:
 		return trace.BadParameter("deleting resources of type %q is not supported", rc.ref.Kind)
 	}
@@ -960,7 +978,7 @@ func (rc *ResourceCommand) getCollection(client auth.ClientI) (ResourceCollectio
 		if rc.ref.SubKind == "" && rc.ref.Name == "" {
 			var allAuthorities []types.CertAuthority
 			for _, caType := range types.CertAuthTypes {
-				authorities, err := client.GetCertAuthorities(caType, rc.withSecrets)
+				authorities, err := client.GetCertAuthorities(ctx, caType, rc.withSecrets)
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
@@ -969,7 +987,7 @@ func (rc *ResourceCommand) getCollection(client auth.ClientI) (ResourceCollectio
 			return &authorityCollection{cas: allAuthorities}, nil
 		}
 		id := types.CertAuthID{Type: types.CertAuthType(rc.ref.SubKind), DomainName: rc.ref.Name}
-		authority, err := client.GetCertAuthority(id, rc.withSecrets)
+		authority, err := client.GetCertAuthority(ctx, id, rc.withSecrets)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1022,13 +1040,13 @@ func (rc *ResourceCommand) getCollection(client auth.ClientI) (ResourceCollectio
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			return &roleCollection{roles: roles}, nil
+			return &roleCollection{roles: roles, verbose: rc.verbose}, nil
 		}
 		role, err := client.GetRole(ctx, rc.ref.Name)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return &roleCollection{roles: []types.Role{role}}, nil
+		return &roleCollection{roles: []types.Role{role}, verbose: rc.verbose}, nil
 	case types.KindNamespace:
 		if rc.ref.Name == "" {
 			namespaces, err := client.GetNamespaces()
diff --git a/tool/tctl/common/resource_command_test.go b/tool/tctl/common/resource_command_test.go
index 952f999fc106a..d0ce85477e536 100644
--- a/tool/tctl/common/resource_command_test.go
+++ b/tool/tctl/common/resource_command_test.go
@@ -19,7 +19,7 @@ package common
 import (
 	"crypto/x509"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -165,7 +165,7 @@ func TestDatabaseResource(t *testing.T) {
 
 	// Create the databases.
 	dbYAMLPath := filepath.Join(t.TempDir(), "db.yaml")
-	require.NoError(t, ioutil.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
+	require.NoError(t, os.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
 	_, err = runResourceCommand(t, fileConfig, []string{"create", dbYAMLPath})
 	require.NoError(t, err)
 
@@ -252,7 +252,7 @@ func TestAppResource(t *testing.T) {
 
 	// Create the apps.
 	appYAMLPath := filepath.Join(t.TempDir(), "app.yaml")
-	require.NoError(t, ioutil.WriteFile(appYAMLPath, []byte(appYAML), 0644))
+	require.NoError(t, os.WriteFile(appYAMLPath, []byte(appYAML), 0644))
 	_, err = runResourceCommand(t, fileConfig, []string{"create", appYAMLPath})
 	require.NoError(t, err)
 
@@ -315,7 +315,7 @@ func TestCreateDatabaseInInsecureMode(t *testing.T) {
 
 	// Create the databases yaml file.
 	dbYAMLPath := filepath.Join(t.TempDir(), "db.yaml")
-	require.NoError(t, ioutil.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
+	require.NoError(t, os.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
 
 	// Reset RootCertPool and run tctl command with --insecure flag.
 	opts := []optionsFunc{
diff --git a/tool/tctl/common/status_command.go b/tool/tctl/common/status_command.go
index 261dd67f260f9..09e2c32202c8f 100644
--- a/tool/tctl/common/status_command.go
+++ b/tool/tctl/common/status_command.go
@@ -49,7 +49,7 @@ func (c *StatusCommand) Initialize(app *kingpin.Application, config *service.Con
 func (c *StatusCommand) TryRun(cmd string, client auth.ClientI) (match bool, err error) {
 	switch cmd {
 	case c.status.FullCommand():
-		err = c.Status(client)
+		err = c.Status(context.Background(), client)
 	default:
 		return false, nil
 	}
@@ -57,29 +57,29 @@ func (c *StatusCommand) TryRun(cmd string, client auth.ClientI) (match bool, err
 }
 
 // Status is called to execute "status" CLI command.
-func (c *StatusCommand) Status(client auth.ClientI) error {
-	pingRsp, err := client.Ping(context.TODO())
+func (c *StatusCommand) Status(ctx context.Context, client auth.ClientI) error {
+	pingRsp, err := client.Ping(ctx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	serverVersion := pingRsp.ServerVersion
 	clusterName := pingRsp.ClusterName
 
-	authorities := []types.CertAuthority{}
+	var authorities []types.CertAuthority
 
-	hostCAs, err := client.GetCertAuthorities(types.HostCA, false)
+	hostCAs, err := client.GetCertAuthorities(ctx, types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	authorities = append(authorities, hostCAs...)
 
-	userCAs, err := client.GetCertAuthorities(types.UserCA, false)
+	userCAs, err := client.GetCertAuthorities(ctx, types.UserCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	authorities = append(authorities, userCAs...)
 
-	jwtKeys, err := client.GetCertAuthorities(types.JWTSigner, false)
+	jwtKeys, err := client.GetCertAuthorities(ctx, types.JWTSigner, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/tctl.go b/tool/tctl/common/tctl.go
index 47dc8c5c02c7b..12010a012cd60 100644
--- a/tool/tctl/common/tctl.go
+++ b/tool/tctl/common/tctl.go
@@ -41,6 +41,12 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+const (
+	searchHelp = `List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")`
+	queryHelp  = `Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and || (e.g. --query='labels.key1 == "value1" && labels.key2 != "value2"')`
+	labelHelp  = "List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)"
+)
+
 // GlobalCLIFlags keeps the CLI flags that apply to all tctl commands
 type GlobalCLIFlags struct {
 	// Debug enables verbose logging mode to the console
@@ -131,8 +137,10 @@ func Run(commands []CLICommand) {
 	app.HelpFlag.Short('h')
 
 	// parse CLI commands+flags:
+	utils.UpdateAppUsageTemplate(app, os.Args[1:])
 	selectedCmd, err := app.Parse(os.Args[1:])
 	if err != nil {
+		app.Usage(os.Args[1:])
 		utils.FatalError(err)
 	}
 
diff --git a/tool/tctl/common/token_command.go b/tool/tctl/common/token_command.go
index 908b998283222..9d48a924c6ba8 100644
--- a/tool/tctl/common/token_command.go
+++ b/tool/tctl/common/token_command.go
@@ -33,6 +33,7 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/tlsca"
+	log "github.com/sirupsen/logrus"
 
 	"github.com/gravitational/kingpin"
 	"github.com/gravitational/trace"
@@ -93,9 +94,10 @@ func (c *TokenCommand) Initialize(app *kingpin.Application, config *service.Conf
 	c.tokenAdd.Flag("type", "Type of token to add").Required().StringVar(&c.tokenType)
 	c.tokenAdd.Flag("value", "Value of token to add").StringVar(&c.value)
 	c.tokenAdd.Flag("labels", "Set token labels, e.g. env=prod,region=us-west").StringVar(&c.labels)
-	c.tokenAdd.Flag("ttl", fmt.Sprintf("Set expiration time for token, default is %v hour, maximum is %v hours",
-		int(defaults.SignupTokenTTL/time.Hour), int(defaults.MaxSignupTokenTTL/time.Hour))).
-		Default(fmt.Sprintf("%v", defaults.SignupTokenTTL)).DurationVar(&c.ttl)
+	c.tokenAdd.Flag("ttl", fmt.Sprintf("Set expiration time for token, default is %v hour",
+		int(defaults.SignupTokenTTL/time.Hour))).
+		Default(fmt.Sprintf("%v", defaults.SignupTokenTTL)).
+		DurationVar(&c.ttl)
 	c.tokenAdd.Flag("app-name", "Name of the application to add").Default("example-app").StringVar(&c.appName)
 	c.tokenAdd.Flag("app-uri", "URI of the application to add").Default("http://localhost:8080").StringVar(&c.appURI)
 	c.tokenAdd.Flag("db-name", "Name of the database to add").StringVar(&c.dbName)
@@ -218,12 +220,30 @@ func (c *TokenCommand) Add(client auth.ClientI) error {
 			token,
 			int(c.ttl.Minutes()))
 	default:
+		authServer := authServers[0].GetAddr()
+
+		pingResponse, err := client.Ping(context.TODO())
+		if err != nil {
+			log.Debugf("unnable to ping auth client: %s.", err.Error())
+		}
+
+		if err == nil && pingResponse.GetServerFeatures().Cloud {
+			proxies, err := client.GetProxies()
+			if err != nil {
+				return trace.Wrap(err)
+			}
+
+			if len(proxies) != 0 {
+				authServer = proxies[0].GetPublicAddr()
+			}
+		}
+
 		return nodeMessageTemplate.Execute(os.Stdout, map[string]interface{}{
 			"token":       token,
 			"roles":       strings.ToLower(roles.String()),
 			"minutes":     int(c.ttl.Minutes()),
 			"ca_pins":     caPins,
-			"auth_server": authServers[0].GetAddr(),
+			"auth_server": authServer,
 		})
 	}
 
diff --git a/tool/tctl/common/usage.go b/tool/tctl/common/usage.go
index 3a34cbe1f49b3..e7c32c0eace77 100644
--- a/tool/tctl/common/usage.go
+++ b/tool/tctl/common/usage.go
@@ -17,7 +17,7 @@ limitations under the License.
 package common
 
 const (
-	GlobalHelpString = "CLI Admin tool for the Teleport Auth service. Runs on a host where Teleport Auth is running."
+	GlobalHelpString = "Admin tool for the Teleport Access Plane"
 
 	AddUserHelp = `Notes:
 
@@ -37,12 +37,12 @@ Examples:
 `
 
 	AddNodeHelp = `Notes:
-  This command generates and prints an invitation token another node can use to 
-  join the cluster. 
+  This command generates and prints an invitation token another node can use to
+  join the cluster.
 
 Examples:
 
-  > tctl nodes add 
+  > tctl nodes add
 
   Generates a token when can be used to add a regular SSH node to the cluster.
   The token genrated single-use token will be valid for 30 minutes.
@@ -50,7 +50,7 @@ Examples:
   > tctl nodes add --roles=node,proxy --ttl=1h
 
   Generates a token when can be used to add an SSH node to the cluster which
-  will also be a proxy node. This token can be used multiple times within an 
+  will also be a proxy node. This token can be used multiple times within an
   hour.
 `
 	ListNodesHelp = `Notes:
diff --git a/tool/tctl/main.go b/tool/tctl/main.go
index 1d3485d23aae8..ebe57353b9d94 100644
--- a/tool/tctl/main.go
+++ b/tool/tctl/main.go
@@ -21,6 +21,7 @@ import (
 )
 
 func main() {
+	// Note: these commands should be kept in sync with e/tool/tctl/main.go.
 	commands := []common.CLICommand{
 		&common.UserCommand{},
 		&common.NodeCommand{},
@@ -32,6 +33,8 @@ func main() {
 		&common.AccessRequestCommand{},
 		&common.AppsCommand{},
 		&common.DBCommand{},
+		&common.KubeCommand{},
+		&common.DesktopCommand{},
 		&common.AccessCommand{},
 		&common.LockCommand{},
 		&common.BotsCommand{},
diff --git a/tool/teleport/common/teleport.go b/tool/teleport/common/teleport.go
index 09aa21f954fb9..8bd6bc0a2b090 100644
--- a/tool/teleport/common/teleport.go
+++ b/tool/teleport/common/teleport.go
@@ -62,7 +62,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	// configure logger for a typical CLI scenario until configuration file is
 	// parsed
 	utils.InitLogger(utils.LoggingForDaemon, log.ErrorLevel)
-	app = utils.InitCLIParser("teleport", "Clustered SSH service. Learn more at https://goteleport.com/teleport")
+	app = utils.InitCLIParser("teleport", "Teleport Access Plane. Learn more at https://goteleport.com")
 
 	// define global flags:
 	var (
@@ -294,8 +294,10 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dump.Flag("key-file", "Path to a TLS key file for the proxy.").ExistingFileVar(&dumpFlags.KeyFile)
 
 	// parse CLI commands+flags:
+	utils.UpdateAppUsageTemplate(app, options.Args)
 	command, err := app.Parse(options.Args)
 	if err != nil {
+		app.Usage(options.Args)
 		utils.FatalError(err)
 	}
 
diff --git a/tool/teleport/common/teleport_test.go b/tool/teleport/common/teleport_test.go
index 2423248510fd7..ec99389ca9e9e 100644
--- a/tool/teleport/common/teleport_test.go
+++ b/tool/teleport/common/teleport_test.go
@@ -17,11 +17,11 @@ limitations under the License.
 package common
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
@@ -43,10 +43,26 @@ func TestTeleportMain(t *testing.T) {
 	hostname, err := os.Hostname()
 	require.NoError(t, err)
 
+	fixtureDir := t.TempDir()
 	// generate the fixture config file
-	configFile := filepath.Join(t.TempDir(), "teleport.yaml")
-	err = ioutil.WriteFile(configFile, []byte(YAMLConfig), 0660)
-	require.NoError(t, err)
+	configFile := filepath.Join(fixtureDir, "teleport.yaml")
+	require.NoError(t, os.WriteFile(configFile, []byte(configData), 0660))
+
+	// generate the fixture bootstrap file
+	bootstrapEntries := []struct{ fileName, kind, name string }{
+		{"role.yaml", types.KindRole, "role_name"},
+		{"github.yaml", types.KindGithubConnector, "github"},
+		{"user.yaml", types.KindRole, "user"},
+	}
+	var bootstrapData []byte
+	for _, entry := range bootstrapEntries {
+		data, err := os.ReadFile(filepath.Join("..", "..", "..", "examples", "resources", entry.fileName))
+		require.NoError(t, err)
+		bootstrapData = append(bootstrapData, data...)
+		bootstrapData = append(bootstrapData, "\n---\n"...)
+	}
+	bootstrapFile := filepath.Join(fixtureDir, "bootstrap.yaml")
+	require.NoError(t, os.WriteFile(bootstrapFile, bootstrapData, 0660))
 
 	// set defaults to test-mode (non-existing files&locations)
 	defaults.ConfigFilePath = "/tmp/teleport/etc/teleport.yaml"
@@ -111,6 +127,20 @@ func TestTeleportMain(t *testing.T) {
 		require.Equal(t, "10.5.5.5", conf.AdvertiseIP)
 		require.Equal(t, map[string]string{"a": "a1", "b": "b1"}, conf.SSH.Labels)
 	})
+
+	t.Run("Bootstrap", func(t *testing.T) {
+		_, cmd, conf := Run(Options{
+			Args:     []string{"start", "--bootstrap", bootstrapFile},
+			InitOnly: true,
+		})
+		require.Equal(t, "start", cmd)
+		require.Equal(t, len(bootstrapEntries), len(conf.Auth.Resources))
+		for i, entry := range bootstrapEntries {
+			require.Equal(t, entry.kind, conf.Auth.Resources[i].GetKind(), entry.fileName)
+			require.Equal(t, entry.name, conf.Auth.Resources[i].GetName(), entry.fileName)
+			require.NoError(t, conf.Auth.Resources[i].CheckAndSetDefaults(), entry.fileName)
+		}
+	})
 }
 
 func TestConfigure(t *testing.T) {
@@ -143,7 +173,7 @@ func TestConfigure(t *testing.T) {
 	})
 }
 
-const YAMLConfig = `
+const configData = `
 teleport:
   advertise_ip: 10.5.5.5
   nodename: hvostongo.example.org
diff --git a/tool/tsh/app.go b/tool/tsh/app.go
index b602ade1dec0d..01d6dbc912803 100644
--- a/tool/tsh/app.go
+++ b/tool/tsh/app.go
@@ -114,11 +114,17 @@ tsh aws {{.awsCmd}}
 
 // getRegisteredApp returns the registered application with the specified name.
 func getRegisteredApp(cf *CLIConf, tc *client.TeleportClient) (app types.Application, err error) {
+	var apps []types.Application
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		allApps, err := tc.ListApps(cf.Context)
+		allApps, err := tc.ListApps(cf.Context, &proto.ListResourcesRequest{
+			Namespace:           tc.Namespace,
+			PredicateExpression: fmt.Sprintf(`name == "%s"`, cf.AppName),
+		})
+		// Kept for fallback in case older auth does not apply filters.
+		// DELETE IN 11.0.0
 		for _, a := range allApps {
 			if a.GetName() == cf.AppName {
-				app = a
+				apps = append(apps, a)
 				return nil
 			}
 		}
@@ -127,10 +133,10 @@ func getRegisteredApp(cf *CLIConf, tc *client.TeleportClient) (app types.Applica
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if app == nil {
+	if len(apps) == 0 {
 		return nil, trace.NotFound("app %q not found, use `tsh app ls` to see registered apps", cf.AppName)
 	}
-	return app, nil
+	return apps[0], nil
 }
 
 // onAppLogout implements "tsh app logout" command.
diff --git a/tool/tsh/aws.go b/tool/tsh/aws.go
index ec0a791bac6f3..5ec7a0e74c739 100644
--- a/tool/tsh/aws.go
+++ b/tool/tsh/aws.go
@@ -23,7 +23,6 @@ import (
 	"crypto/x509/pkix"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"os/exec"
@@ -292,7 +291,7 @@ func newTempSelfSignedLocalCert() (*tempSelfSignedLocalCert, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	f, err := ioutil.TempFile("", "*_aws_local_proxy_cert.pem")
+	f, err := os.CreateTemp("", "*_aws_local_proxy_cert.pem")
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/tool/tsh/db.go b/tool/tsh/db.go
index 0b8d2ee75afa8..021fdbeadd1b9 100644
--- a/tool/tsh/db.go
+++ b/tool/tsh/db.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"sort"
@@ -43,7 +42,7 @@ func onListDatabases(cf *CLIConf) error {
 	}
 	var databases []types.Database
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		databases, err = tc.ListDatabases(cf.Context)
+		databases, err = tc.ListDatabases(cf.Context, nil /* custom filter */)
 		return trace.Wrap(err)
 	})
 	if err != nil {
@@ -410,7 +409,12 @@ func getDatabaseInfo(cf *CLIConf, tc *client.TeleportClient, dbName string) (*tl
 func getDatabase(cf *CLIConf, tc *client.TeleportClient, dbName string) (types.Database, error) {
 	var databases []types.Database
 	err := client.RetryWithRelogin(cf.Context, tc, func() error {
-		allDatabases, err := tc.ListDatabases(cf.Context)
+		allDatabases, err := tc.ListDatabases(cf.Context, &proto.ListResourcesRequest{
+			Namespace:           tc.Namespace,
+			PredicateExpression: fmt.Sprintf(`name == "%s"`, dbName),
+		})
+		// Kept for fallback in case an older auth does not apply filters.
+		// DELETE IN 11.0.0
 		for _, database := range allDatabases {
 			if database.GetName() == dbName {
 				databases = append(databases, database)
@@ -469,7 +473,7 @@ func dbInfoHasChanged(cf *CLIConf, certPath string) (bool, error) {
 		return false, nil
 	}
 
-	buff, err := ioutil.ReadFile(certPath)
+	buff, err := os.ReadFile(certPath)
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
diff --git a/tool/tsh/db_test.go b/tool/tsh/db_test.go
index 382f8e58cea8a..fe2920c590fa9 100644
--- a/tool/tsh/db_test.go
+++ b/tool/tsh/db_test.go
@@ -22,7 +22,6 @@ import (
 	"crypto/rsa"
 	"encoding/pem"
 	"errors"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -232,7 +231,7 @@ func TestDBInfoHasChanged(t *testing.T) {
 			require.NoError(t, err)
 
 			certPath := filepath.Join(t.TempDir(), "mongo_db_cert.pem")
-			require.NoError(t, ioutil.WriteFile(certPath, certBytes, 0600))
+			require.NoError(t, os.WriteFile(certPath, certBytes, 0600))
 
 			cliConf := &CLIConf{DatabaseUser: tc.databaseUserName, DatabaseName: tc.databaseName}
 			got, err := dbInfoHasChanged(cliConf, certPath)
diff --git a/tool/tsh/dbcmd.go b/tool/tsh/dbcmd.go
index 36c436d01e4bb..78c7b8f92c4bc 100644
--- a/tool/tsh/dbcmd.go
+++ b/tool/tsh/dbcmd.go
@@ -231,7 +231,7 @@ func (c *cliCommandBuilder) getMySQLCommand() (*exec.Cmd, error) {
 
 	// Check for mysql binary. Return with error as mysql and mariadb are missing. There is nothing else we can do here.
 	if !c.isMySQLBinAvailable() {
-		return nil, trace.NotFound("neither \"mysql\" nor \"mariadb\" were found")
+		return nil, trace.NotFound("neither %q nor %q CLI clients were found, please make sure an appropriate CLI client is available in $PATH", mysqlBin, mariadbBin)
 	}
 
 	// Check which flavor is installed. Otherwise, we don't know which ssl flag to use.
diff --git a/tool/tsh/kube.go b/tool/tsh/kube.go
index f42c9d95cc6f1..8899f93b6de63 100644
--- a/tool/tsh/kube.go
+++ b/tool/tsh/kube.go
@@ -23,13 +23,14 @@ import (
 	"net"
 	"net/url"
 	"os"
-
+	"strconv"
 	"strings"
 	"time"
 
 	"github.com/gravitational/kingpin"
 	"github.com/gravitational/trace"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/profile"
 	"github.com/gravitational/teleport/api/types"
@@ -292,11 +293,12 @@ type ExecOptions struct {
 	ExecutablePodFn  polymorphichelpers.AttachablePodForObjectFunc
 	restClientGetter genericclioptions.RESTClientGetter
 
-	Pod           *corev1.Pod
-	Executor      RemoteExecutor
-	PodClient     coreclient.PodsGetter
-	GetPodTimeout time.Duration
-	Config        *restclient.Config
+	Pod                            *corev1.Pod
+	Executor                       RemoteExecutor
+	PodClient                      coreclient.PodsGetter
+	GetPodTimeout                  time.Duration
+	Config                         *restclient.Config
+	displayParticipantRequirements bool
 }
 
 // Run executes a validated remote execution against a pod.
@@ -365,7 +367,8 @@ func (p *ExecOptions) Run() error {
 			Resource("pods").
 			Name(pod.Name).
 			Namespace(pod.Namespace).
-			SubResource("exec")
+			SubResource("exec").
+			Param("displayParticipantRequirements", strconv.FormatBool(p.displayParticipantRequirements))
 		req.VersionedParams(&corev1.PodExecOptions{
 			Container: containerName,
 			Command:   p.Command,
@@ -383,15 +386,16 @@ func (p *ExecOptions) Run() error {
 
 type kubeExecCommand struct {
 	*kingpin.CmdClause
-	target    string
-	container string
-	filename  string
-	quiet     bool
-	stdin     bool
-	tty       bool
-	reason    string
-	invited   string
-	command   []string
+	target                         string
+	container                      string
+	filename                       string
+	quiet                          bool
+	stdin                          bool
+	tty                            bool
+	reason                         string
+	invited                        string
+	command                        []string
+	displayParticipantRequirements bool
 }
 
 func newKubeExecCommand(parent *kingpin.CmdClause) *kubeExecCommand {
@@ -406,6 +410,7 @@ func newKubeExecCommand(parent *kingpin.CmdClause) *kubeExecCommand {
 	c.Flag("tty", "Stdin is a TTY").Short('t').BoolVar(&c.tty)
 	c.Flag("reason", "The purpose of the session.").StringVar(&c.reason)
 	c.Flag("invite", "A comma separated list of people to mark as invited for the session.").StringVar(&c.invited)
+	c.Flag("participant-req", "Displays a verbose list of required participants in a moderated session.").BoolVar(&c.displayParticipantRequirements)
 	c.Arg("target", "Pod or deployment name").Required().StringVar(&c.target)
 	c.Arg("command", "Command to execute in the container").Required().StringsVar(&c.command)
 	return c
@@ -434,6 +439,7 @@ func (c *kubeExecCommand) run(cf *CLIConf) error {
 	p.Builder = f.NewBuilder
 	p.restClientGetter = f
 	p.Executor = &DefaultRemoteExecutor{}
+	p.displayParticipantRequirements = c.displayParticipantRequirements
 	p.Namespace, p.EnforceNamespace, err = f.ToRawKubeConfigLoader().Namespace()
 	if err != nil {
 		return trace.Wrap(err)
@@ -589,16 +595,26 @@ func (c *kubeCredentialsCommand) writeResponse(key *client.Key, kubeClusterName
 
 type kubeLSCommand struct {
 	*kingpin.CmdClause
+	labels         string
+	predicateExpr  string
+	searchKeywords string
 }
 
 func newKubeLSCommand(parent *kingpin.CmdClause) *kubeLSCommand {
 	c := &kubeLSCommand{
 		CmdClause: parent.Command("ls", "Get a list of kubernetes clusters"),
 	}
+	c.Flag("search", searchHelp).StringVar(&c.searchKeywords)
+	c.Flag("query", queryHelp).StringVar(&c.predicateExpr)
+	c.Arg("labels", labelHelp).StringVar(&c.labels)
 	return c
 }
 
 func (c *kubeLSCommand) run(cf *CLIConf) error {
+	cf.SearchKeywords = c.searchKeywords
+	cf.UserHost = c.labels
+	cf.PredicateExpression = c.predicateExpr
+
 	tc, err := makeClient(cf, true)
 	if err != nil {
 		return trace.Wrap(err)
@@ -715,10 +731,27 @@ func fetchKubeClusters(ctx context.Context, tc *client.TeleportClient) (teleport
 		}
 		teleportCluster = cn.GetClusterName()
 
-		kubeClusters, err = kubeutils.KubeClusterNames(ctx, ac)
+		kubeClusters, err = kubeutils.ListKubeClusterNamesWithFilters(ctx, ac, proto.ListResourcesRequest{
+			SearchKeywords:      tc.SearchKeywords,
+			PredicateExpression: tc.PredicateExpression,
+			Labels:              tc.Labels,
+		})
 		if err != nil {
+			// ListResources for kube service not availalbe, provide fallback.
+			// Fallback does not support filters, so if users
+			// provide them, it does nothing.
+			//
+			// DELETE IN 11.0.0
+			if trace.IsNotImplemented(err) {
+				kubeClusters, err = kubeutils.KubeClusterNames(ctx, ac)
+				if err != nil {
+					return trace.Wrap(err)
+				}
+				return nil
+			}
 			return trace.Wrap(err)
 		}
+
 		return nil
 	})
 	if err != nil {
diff --git a/tool/tsh/mfa.go b/tool/tsh/mfa.go
index 25b8e0093b50c..6e46c2f11acc1 100644
--- a/tool/tsh/mfa.go
+++ b/tool/tsh/mfa.go
@@ -38,6 +38,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
+	"golang.org/x/term"
 
 	wantypes "github.com/gravitational/teleport/api/types/webauthn"
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
@@ -147,6 +148,10 @@ type mfaAddCommand struct {
 	*kingpin.CmdClause
 	devName string
 	devType string
+	// pwdless is nil if unset, true/false if explicitly set.
+	// If passwordless is not supported it's always set to false.
+	// The default behavior is the same as false.
+	pwdless *bool
 }
 
 func newMFAAddCommand(parent *kingpin.CmdClause) *mfaAddCommand {
@@ -156,6 +161,22 @@ func newMFAAddCommand(parent *kingpin.CmdClause) *mfaAddCommand {
 	c.Flag("name", "Name of the new MFA device").StringVar(&c.devName)
 	c.Flag("type", fmt.Sprintf("Type of the new MFA device (%s)", strings.Join(defaultDeviceTypes, ", "))).
 		StringVar(&c.devType)
+
+	if wancli.IsFIDO2Available() {
+		var allowPwdless bool
+		c.Flag("allow-passwordless", "Allow passwordless logins").
+			Action(func(_ *kingpin.ParseContext) error {
+				// If the callback is called it means that the flag was explicitly set,
+				// so we can copy its contents to the command.
+				c.pwdless = &allowPwdless
+				return nil
+			}).
+			BoolVar(&allowPwdless)
+	} else {
+		allowPwdless := false
+		c.pwdless = &allowPwdless
+	}
+
 	return c
 }
 
@@ -166,6 +187,12 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 	}
 	ctx := cf.Context
 
+	// IMPORTANT: mfa add may need to read secure key PINs in some scenarios,
+	// meaning it has to use term.ReadPassword.
+	// Because of that we can't use prompt.Stdin(), as it hijacks stdin, making
+	// password-like reads impossible.
+	stdin := prompt.StdinSync()
+
 	deviceTypes := defaultDeviceTypes
 	if c.devType == "" {
 		// If we are prompting the user for the device type, then take a glimpse at
@@ -177,7 +204,7 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 		}
 		deviceTypes = deviceTypesFromPreferredMFA(pingResp.Auth.PreferredLocalMFA)
 
-		c.devType, err = prompt.PickOne(ctx, os.Stdout, prompt.Stdin(), "Choose device type", deviceTypes)
+		c.devType, err = prompt.PickOne(ctx, os.Stdout, stdin, "Choose device type", deviceTypes)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -194,7 +221,7 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 
 	if c.devName == "" {
 		var err error
-		c.devName, err = prompt.Input(ctx, os.Stdout, prompt.Stdin(), "Enter device name")
+		c.devName, err = prompt.Input(ctx, os.Stdout, stdin, "Enter device name")
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -204,7 +231,18 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 		return trace.BadParameter("device name can not be empty")
 	}
 
-	dev, err := c.addDeviceRPC(ctx, tc, c.devName, devType)
+	// If passwordless is supported but unset then ask the user.
+	if c.pwdless == nil {
+		answer, err := prompt.PickOne(ctx, os.Stdout, stdin, "Allow passwordless logins", []string{"YES", "NO"})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		val := answer == "YES"
+		c.pwdless = &val
+	}
+	pwdless := c.pwdless != nil && *c.pwdless
+
+	dev, err := c.addDeviceRPC(ctx, tc, c.devName, devType, pwdless, stdin)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -231,7 +269,9 @@ func deviceTypesFromPreferredMFA(preferredMFA constants.SecondFactorType) []stri
 	}
 }
 
-func (c *mfaAddCommand) addDeviceRPC(ctx context.Context, tc *client.TeleportClient, devName string, devType proto.DeviceType) (*types.MFADevice, error) {
+func (c *mfaAddCommand) addDeviceRPC(
+	ctx context.Context,
+	tc *client.TeleportClient, devName string, devType proto.DeviceType, passwordless bool, r prompt.Reader) (*types.MFADevice, error) {
 	var dev *types.MFADevice
 	if err := client.RetryWithRelogin(ctx, tc, func() error {
 		pc, err := tc.ConnectToProxy(ctx)
@@ -252,10 +292,15 @@ func (c *mfaAddCommand) addDeviceRPC(ctx context.Context, tc *client.TeleportCli
 			return trace.Wrap(err)
 		}
 		// Init.
+		usage := proto.DeviceUsage_DEVICE_USAGE_MFA
+		if passwordless {
+			usage = proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS
+		}
 		if err := stream.Send(&proto.AddMFADeviceRequest{Request: &proto.AddMFADeviceRequest_Init{
 			Init: &proto.AddMFADeviceRequestInit{
-				DeviceName: devName,
-				DeviceType: devType,
+				DeviceName:  devName,
+				DeviceType:  devType,
+				DeviceUsage: usage,
 			},
 		}}); err != nil {
 			return trace.Wrap(err)
@@ -289,7 +334,7 @@ func (c *mfaAddCommand) addDeviceRPC(ctx context.Context, tc *client.TeleportCli
 		if regChallenge == nil {
 			return trace.BadParameter("server bug: server sent %T when client expected AddMFADeviceResponse_NewMFARegisterChallenge", resp.Response)
 		}
-		regResp, err := promptRegisterChallenge(ctx, tc.Config.WebProxyAddr, regChallenge)
+		regResp, err := promptRegisterChallenge(ctx, tc.Config.WebProxyAddr, regChallenge, r)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -316,18 +361,20 @@ func (c *mfaAddCommand) addDeviceRPC(ctx context.Context, tc *client.TeleportCli
 	return dev, nil
 }
 
-func promptRegisterChallenge(ctx context.Context, proxyAddr string, c *proto.MFARegisterChallenge) (*proto.MFARegisterResponse, error) {
+func promptRegisterChallenge(ctx context.Context, proxyAddr string, c *proto.MFARegisterChallenge, r prompt.Reader) (*proto.MFARegisterResponse, error) {
 	switch c.Request.(type) {
 	case *proto.MFARegisterChallenge_TOTP:
-		return promptTOTPRegisterChallenge(ctx, c.GetTOTP())
+		return promptTOTPRegisterChallenge(ctx, c.GetTOTP(), r)
 	case *proto.MFARegisterChallenge_Webauthn:
+		// WebAuthn prompt doesn't take in "r" because it reads directly from stdin
+		// using term.ReadPassword.
 		return promptWebauthnRegisterChallenge(ctx, proxyAddr, c.GetWebauthn())
 	default:
 		return nil, trace.BadParameter("server bug: unexpected registration challenge type: %T", c.Request)
 	}
 }
 
-func promptTOTPRegisterChallenge(ctx context.Context, c *proto.TOTPRegisterChallenge) (*proto.MFARegisterResponse, error) {
+func promptTOTPRegisterChallenge(ctx context.Context, c *proto.TOTPRegisterChallenge, r prompt.Reader) (*proto.MFARegisterResponse, error) {
 	secretBin, err := base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(c.Secret)
 	if err != nil {
 		return nil, trace.BadParameter("server sent an invalid TOTP secret key %q: %v", c.Secret, err)
@@ -388,7 +435,7 @@ func promptTOTPRegisterChallenge(ctx context.Context, c *proto.TOTPRegisterChall
 	// Help the user with typos, don't submit the code until it has the right
 	// length.
 	for {
-		totpCode, err = prompt.Input(ctx, os.Stdout, prompt.Stdin(), "Once created, enter an OTP code generated by the app")
+		totpCode, err = prompt.Input(ctx, os.Stdout, r, "Once created, enter an OTP code generated by the app")
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -402,6 +449,23 @@ func promptTOTPRegisterChallenge(ctx context.Context, c *proto.TOTPRegisterChall
 	}}, nil
 }
 
+// mfaAddPrompt implements wancli.RegisterPrompt for MFA registrations.
+type mfaAddPrompt struct{}
+
+func (m mfaAddPrompt) PromptPIN() (string, error) {
+	fmt.Println("Enter your *new* security key PIN")
+	pwd, err := term.ReadPassword(int(os.Stdin.Fd()))
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return string(pwd), nil
+}
+
+func (m mfaAddPrompt) PromptAdditionalTouch() error {
+	fmt.Println("Tap your *new* security key again to complete registration")
+	return nil
+}
+
 func promptWebauthnRegisterChallenge(ctx context.Context, proxyAddr string, cc *wantypes.CredentialCreation) (*proto.MFARegisterResponse, error) {
 	origin := proxyAddr
 	if !strings.HasPrefix(proxyAddr, "https://") {
@@ -410,8 +474,7 @@ func promptWebauthnRegisterChallenge(ctx context.Context, proxyAddr string, cc *
 	log.Debugf("WebAuthn: prompting MFA devices with origin %q", origin)
 
 	fmt.Println("Tap your *new* security key")
-
-	resp, err := wancli.Register(ctx, origin, wanlib.CredentialCreationFromProto(cc))
+	resp, err := wancli.Register(ctx, origin, wanlib.CredentialCreationFromProto(cc), mfaAddPrompt{})
 	return resp, trace.Wrap(err)
 }
 
diff --git a/tool/tsh/proxy_test.go b/tool/tsh/proxy_test.go
index ad6a097b57460..b5d0e3c738284 100644
--- a/tool/tsh/proxy_test.go
+++ b/tool/tsh/proxy_test.go
@@ -19,7 +19,6 @@ package main
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"os/user"
@@ -174,7 +173,7 @@ func TestProxySSHDial(t *testing.T) {
 	tmpHomePath := t.TempDir()
 
 	connector := mockConnector(t)
-	sshLoginRole, err := types.NewRole("ssh-login", types.RoleSpecV5{
+	sshLoginRole, err := types.NewRoleV3("ssh-login", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{"alice"},
 		},
@@ -320,7 +319,7 @@ func createAgent(t *testing.T) string {
 	// Create own tmp dir instead of using t.TmpDir
 	// because  net.Listen("unix", path) has dir path length limitation and
 	// the t.TmpDir calls creates tmp dir with test name.
-	sockDir, err := ioutil.TempDir("", "test")
+	sockDir, err := os.MkdirTemp("", "test")
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		os.RemoveAll(sockDir)
@@ -375,7 +374,7 @@ func mustGetOpenSSHConfigFile(t *testing.T) string {
 
 	tmpDir := t.TempDir()
 	configPath := filepath.Join(tmpDir, "ssh_config")
-	err = ioutil.WriteFile(configPath, buff.Bytes(), 0600)
+	err = os.WriteFile(configPath, buff.Bytes(), 0600)
 	require.NoError(t, err)
 
 	return configPath
diff --git a/tool/tsh/resolve_default_addr.go b/tool/tsh/resolve_default_addr.go
index cbfe56dd40bbd..6b3f6abd2a1f4 100644
--- a/tool/tsh/resolve_default_addr.go
+++ b/tool/tsh/resolve_default_addr.go
@@ -21,7 +21,6 @@ import (
 	"crypto/tls"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"strconv"
@@ -56,7 +55,7 @@ func logResponseBody(level logrus.Level, bodyStream io.Reader) {
 	//     context originally supplied to the request that initiated this
 	//     response, so no need to have an independent reading timeout
 	//     here.
-	body, err := ioutil.ReadAll(io.LimitReader(bodyStream, maxPingBodySize))
+	body, err := io.ReadAll(io.LimitReader(bodyStream, maxPingBodySize))
 	if err != nil {
 		// This is only for debugging purposes, so it's safe to just give up here.
 		log.WithError(err).Debug("Could not read failed racer response body")
diff --git a/tool/tsh/tsh.go b/tool/tsh/tsh.go
index 9b6284e63e380..0e5285d080b65 100644
--- a/tool/tsh/tsh.go
+++ b/tool/tsh/tsh.go
@@ -26,6 +26,7 @@ import (
 	"os/signal"
 	"path"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"sort"
 	"strings"
@@ -34,16 +35,17 @@ import (
 
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
-	"golang.org/x/term"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
+	"github.com/gravitational/teleport/api/profile"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth"
+	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	"github.com/gravitational/teleport/lib/benchmark"
 	"github.com/gravitational/teleport/lib/client"
 	dbprofile "github.com/gravitational/teleport/lib/client/db"
@@ -208,6 +210,12 @@ type CLIConf struct {
 	// Format is used to change the format of output
 	Format string
 
+	// SearchKeywords is a list of search keywords to match against resource field values.
+	SearchKeywords string
+
+	// PredicateExpression defines boolean conditions that will be matched against the resource.
+	PredicateExpression string
+
 	// NoRemoteExec will not execute a remote command after connecting to a host,
 	// will block instead. Useful when port forwarding. Equivalent of -N for OpenSSH.
 	NoRemoteExec bool
@@ -253,6 +261,8 @@ type CLIConf struct {
 
 	// overrideStdout allows to switch standard output source for resource command. Used in tests.
 	overrideStdout io.Writer
+	// overrideStderr allows to switch standard error source for resource command. Used in tests.
+	overrideStderr io.Writer
 
 	// mockSSOLogin used in tests to override sso login handler in teleport client.
 	mockSSOLogin client.SSOLoginFunc
@@ -283,6 +293,15 @@ type CLIConf struct {
 
 	// JoinMode is the participant mode someone is joining a session as.
 	JoinMode string
+
+	// Passwordless instructs tsh to do passwordless login.
+	Passwordless bool
+
+	// displayParticipantRequirements is set if verbose participant requirement information should be printed for moderated sessions.
+	displayParticipantRequirements bool
+
+	// ExtraProxyHeaders is configuration read from the .tsh/config/config.yaml file.
+	ExtraProxyHeaders []ExtraProxyHeaders
 }
 
 // Stdout returns the stdout writer.
@@ -293,6 +312,14 @@ func (c *CLIConf) Stdout() io.Writer {
 	return os.Stdout
 }
 
+// Stderr returns the stderr writer.
+func (c *CLIConf) Stderr() io.Writer {
+	if c.overrideStderr != nil {
+		return c.overrideStderr
+	}
+	return os.Stderr
+}
+
 func main() {
 	cmdLineOrig := os.Args[1:]
 	var cmdLine []string
@@ -329,7 +356,9 @@ const (
 
 	clusterHelp = "Specify the Teleport cluster to connect"
 	browserHelp = "Set to 'none' to suppress browser opening on login"
-
+	searchHelp  = `List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")`
+	queryHelp   = `Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and || (e.g. --query='labels.key1 == "value1" && labels.key2 != "value2"')`
+	labelHelp   = "List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)"
 	// proxyDefaultResolutionTimeout is how long to wait for an unknown proxy
 	// port to be resolved.
 	//
@@ -338,8 +367,6 @@ const (
 	// establishment of a TCP connection, rather than the full HTTP round-
 	// trip that we measure against, so some tweaking may be needed.
 	proxyDefaultResolutionTimeout = 2 * time.Second
-
-	teleportNamespace = "teleport.dev"
 )
 
 // cliOption is used in tests to inject/override configuration within Run
@@ -353,12 +380,15 @@ func Run(args []string, opts ...cliOption) error {
 	moduleCfg := modules.GetModules()
 
 	// configure CLI argument parser:
-	app := utils.InitCLIParser("tsh", "TSH: Teleport Authentication Gateway Client").Interspersed(false)
+	app := utils.InitCLIParser("tsh", "Teleport Command Line Client").Interspersed(false)
 	app.Flag("login", "Remote host login").Short('l').Envar(loginEnvVar).StringVar(&cf.NodeLogin)
 	localUser, _ := client.Username()
 	app.Flag("proxy", "SSH proxy address").Envar(proxyEnvVar).StringVar(&cf.Proxy)
 	app.Flag("nocache", "do not cache cluster discovery locally").Hidden().BoolVar(&cf.NoCache)
 	app.Flag("user", fmt.Sprintf("SSH proxy user [%s]", localUser)).Envar(userEnvVar).StringVar(&cf.Username)
+	if wancli.IsFIDO2Available() {
+		app.Flag("pwdless", "Do passwordless login").BoolVar(&cf.Passwordless)
+	}
 	app.Flag("option", "").Short('o').Hidden().AllowDuplicate().PreAction(func(ctx *kingpin.ParseContext) error {
 		return trace.BadParameter("invalid flag, perhaps you want to use this flag as tsh ssh -o?")
 	}).String()
@@ -392,7 +422,9 @@ func Run(args []string, opts ...cliOption) error {
 		BoolVar(&cf.EnableEscapeSequences)
 	app.Flag("bind-addr", "Override host:port used when opening a browser for cluster logins").Envar(bindAddrEnvVar).StringVar(&cf.BindAddr)
 	app.HelpFlag.Short('h')
+
 	ver := app.Command("version", "Print the version")
+
 	// ssh
 	ssh := app.Command("ssh", "Run shell or execute a command on a remote SSH node")
 	ssh.Arg("[user@]host", "Remote hostname and the login to use").Required().StringVar(&cf.UserHost)
@@ -410,6 +442,7 @@ func Run(args []string, opts ...cliOption) error {
 	ssh.Flag("x11-untrusted", "Requests untrusted (secure) X11 forwarding for this session").Short('X').BoolVar(&cf.X11ForwardingUntrusted)
 	ssh.Flag("x11-trusted", "Requests trusted (insecure) X11 forwarding for this session. This can make your local displays vulnerable to attacks, use with caution").Short('Y').BoolVar(&cf.X11ForwardingTrusted)
 	ssh.Flag("x11-untrusted-timeout", "Sets a timeout for untrusted X11 forwarding, after which the client will reject any forwarding requests from the server").Default("10m").DurationVar((&cf.X11ForwardingTimeout))
+	ssh.Flag("participant-req", "Displays a verbose list of required participants in a moderated session.").BoolVar(&cf.displayParticipantRequirements)
 
 	// AWS.
 	aws := app.Command("aws", "Access AWS API.")
@@ -421,6 +454,9 @@ func Run(args []string, opts ...cliOption) error {
 	lsApps := apps.Command("ls", "List available applications.")
 	lsApps.Flag("verbose", "Show extra application fields.").Short('v').BoolVar(&cf.Verbose)
 	lsApps.Flag("cluster", clusterHelp).StringVar(&cf.SiteName)
+	lsApps.Flag("search", searchHelp).StringVar(&cf.SearchKeywords)
+	lsApps.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
+	lsApps.Arg("labels", labelHelp).StringVar(&cf.UserHost)
 	appLogin := apps.Command("login", "Retrieve short-lived certificate for an app.")
 	appLogin.Arg("app", "App name to retrieve credentials for. Can be obtained from `tsh apps ls` output.").Required().StringVar(&cf.AppName)
 	appLogin.Flag("aws-role", "(For AWS CLI access only) Amazon IAM role ARN or role name.").StringVar(&cf.AWSRole)
@@ -450,6 +486,9 @@ func Run(args []string, opts ...cliOption) error {
 	db.Flag("cluster", clusterHelp).StringVar(&cf.SiteName)
 	dbList := db.Command("ls", "List all available databases.")
 	dbList.Flag("verbose", "Show extra database fields.").Short('v').BoolVar(&cf.Verbose)
+	dbList.Flag("search", searchHelp).StringVar(&cf.SearchKeywords)
+	dbList.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
+	dbList.Arg("labels", labelHelp).StringVar(&cf.UserHost)
 	dbLogin := db.Command("login", "Retrieve credentials for a database.")
 	dbLogin.Arg("db", "Database to retrieve credentials for. Can be obtained from 'tsh db ls' output.").Required().StringVar(&cf.DatabaseService)
 	dbLogin.Flag("db-user", "Optional database user to configure as default.").StringVar(&cf.DatabaseUser)
@@ -494,9 +533,11 @@ func Run(args []string, opts ...cliOption) error {
 	// ls
 	ls := app.Command("ls", "List remote SSH nodes")
 	ls.Flag("cluster", clusterHelp).StringVar(&cf.SiteName)
-	ls.Arg("labels", "List of labels to filter node list").StringVar(&cf.UserHost)
 	ls.Flag("verbose", "One-line output (for text format), including node UUIDs").Short('v').BoolVar(&cf.Verbose)
 	ls.Flag("format", "Format output (text, json, names)").Short('f').Default(teleport.Text).StringVar(&cf.Format)
+	ls.Arg("labels", labelHelp).StringVar(&cf.UserHost)
+	ls.Flag("search", searchHelp).StringVar(&cf.SearchKeywords)
+	ls.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
 	// clusters
 	clusters := app.Command("clusters", "List available Teleport clusters")
 	clusters.Flag("quiet", "Quiet mode").Short('q').BoolVar(&cf.Quiet)
@@ -597,8 +638,10 @@ func Run(args []string, opts ...cliOption) error {
 	}
 
 	// parse CLI commands+flags:
+	utils.UpdateAppUsageTemplate(app, args)
 	command, err := app.Parse(args)
 	if err != nil {
+		app.Usage(args)
 		return trace.Wrap(err)
 	}
 
@@ -645,6 +688,15 @@ func Run(args []string, opts ...cliOption) error {
 
 	setEnvFlags(&cf, os.Getenv)
 
+	confOptions, err := loadConfig(cf.HomePath)
+	if err != nil && !trace.IsNotFound(err) {
+		return trace.Wrap(err, "failed to load tsh config from %s",
+			filepath.Join(profile.FullProfilePath(cf.HomePath), tshConfigPath))
+	}
+	if confOptions != nil {
+		cf.ExtraProxyHeaders = confOptions.ExtraHeaders
+	}
+
 	switch command {
 	case ver.FullCommand():
 		utils.PrintVersion()
@@ -860,23 +912,37 @@ func onLogin(cf *CLIConf) error {
 		// in case if nothing is specified, re-fetch kube clusters and print
 		// current status
 		case cf.Proxy == "" && cf.SiteName == "" && cf.DesiredRoles == "" && cf.RequestID == "" && cf.IdentityFileOut == "":
+			_, err := tc.PingAndShowMOTD(cf.Context)
+			if err != nil {
+				return trace.Wrap(err)
+			}
 			if err := updateKubeConfig(cf, tc, ""); err != nil {
 				return trace.Wrap(err)
 			}
 			printProfiles(cf.Debug, profile, profiles)
+
 			return nil
 		// in case if parameters match, re-fetch kube clusters and print
 		// current status
 		case host(cf.Proxy) == host(profile.ProxyURL.Host) && cf.SiteName == profile.Cluster && cf.DesiredRoles == "" && cf.RequestID == "":
+			_, err := tc.PingAndShowMOTD(cf.Context)
+			if err != nil {
+				return trace.Wrap(err)
+			}
 			if err := updateKubeConfig(cf, tc, ""); err != nil {
 				return trace.Wrap(err)
 			}
 			printProfiles(cf.Debug, profile, profiles)
+
 			return nil
 		// proxy is unspecified or the same as the currently provided proxy,
 		// but cluster is specified, treat this as selecting a new cluster
 		// for the same proxy
 		case (cf.Proxy == "" || host(cf.Proxy) == host(profile.ProxyURL.Host)) && cf.SiteName != "":
+			_, err := tc.PingAndShowMOTD(cf.Context)
+			if err != nil {
+				return trace.Wrap(err)
+			}
 			// trigger reissue, preserving any active requests.
 			err = tc.ReissueUserCerts(cf.Context, client.CertCacheKeep, client.ReissueParams{
 				AccessRequests: profile.ActiveRequests.AccessRequests,
@@ -891,11 +957,16 @@ func onLogin(cf *CLIConf) error {
 			if err := updateKubeConfig(cf, tc, ""); err != nil {
 				return trace.Wrap(err)
 			}
+
 			return trace.Wrap(onStatus(cf))
 		// proxy is unspecified or the same as the currently provided proxy,
 		// but desired roles or request ID is specified, treat this as a
 		// privilege escalation request for the same login session.
 		case (cf.Proxy == "" || host(cf.Proxy) == host(profile.ProxyURL.Host)) && (cf.DesiredRoles != "" || cf.RequestID != "") && cf.IdentityFileOut == "":
+			_, err := tc.PingAndShowMOTD(cf.Context)
+			if err != nil {
+				return trace.Wrap(err)
+			}
 			if err := executeAccessRequest(cf, tc); err != nil {
 				return trace.Wrap(err)
 			}
@@ -1245,7 +1316,7 @@ func onListNodes(cf *CLIConf) error {
 	// Get list of all nodes in backend and sort by "Node Name".
 	var nodes []types.Server
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		nodes, err = tc.ListNodes(cf.Context)
+		nodes, err = tc.ListNodesWithFilters(cf.Context)
 		return err
 	})
 	if err != nil {
@@ -1416,7 +1487,7 @@ func printNodesAsText(nodes []types.Server, verbose bool) {
 			rows = append(rows,
 				[]string{n.GetHostname(), getAddr(n), sortedLabels(n.GetAllLabels())})
 		}
-		t = makeTableWithTruncatedColumn([]string{"Node Name", "Address", "Labels"}, rows, "Labels")
+		t = asciitable.MakeTableWithTruncatedColumn([]string{"Node Name", "Address", "Labels"}, rows, "Labels")
 	}
 	fmt.Println(t.AsBuffer().String())
 }
@@ -1426,7 +1497,7 @@ func sortedLabels(labels map[string]string) string {
 	var namespaced []string
 	var result []string
 	for key, val := range labels {
-		if strings.HasPrefix(key, teleportNamespace+"/") {
+		if strings.HasPrefix(key, types.TeleportNamespace+"/") {
 			teleportNamespaced = append(teleportNamespaced, key)
 			continue
 		}
@@ -1479,60 +1550,12 @@ func showApps(apps []types.Application, active []tlsca.RouteToApp, verbose bool)
 			labels := sortedLabels(app.GetAllLabels())
 			rows = append(rows, []string{name, desc, addr, labels})
 		}
-		t := makeTableWithTruncatedColumn(
+		t := asciitable.MakeTableWithTruncatedColumn(
 			[]string{"Application", "Description", "Public Address", "Labels"}, rows, "Labels")
 		fmt.Println(t.AsBuffer().String())
 	}
 }
 
-func makeTableWithTruncatedColumn(columnOrder []string, rows [][]string, truncatedColumn string) asciitable.Table {
-	width, _, err := term.GetSize(int(os.Stdin.Fd()))
-	if err != nil {
-		width = 80
-	}
-	truncatedColMinSize := 16
-	maxColWidth := (width - truncatedColMinSize) / (len(columnOrder) - 1)
-	t := asciitable.MakeTable([]string{})
-	totalLen := 0
-	columns := []asciitable.Column{}
-
-	for collIndex, colName := range columnOrder {
-		column := asciitable.Column{
-			Title:         colName,
-			MaxCellLength: len(colName),
-		}
-		if colName == truncatedColumn { // truncated column is handled separately in next loop
-			columns = append(columns, column)
-			continue
-		}
-		for _, row := range rows {
-			cellLen := row[collIndex]
-			if len(cellLen) > column.MaxCellLength {
-				column.MaxCellLength = len(cellLen)
-			}
-		}
-		if column.MaxCellLength > maxColWidth {
-			column.MaxCellLength = maxColWidth
-			totalLen += column.MaxCellLength + 4 // "...<space>"
-		} else {
-			totalLen += column.MaxCellLength + 1 // +1 for column separator
-		}
-		columns = append(columns, column)
-	}
-
-	for _, column := range columns {
-		if column.Title == truncatedColumn {
-			column.MaxCellLength = width - totalLen - len("... ")
-		}
-		t.AddColumn(column)
-	}
-
-	for _, row := range rows {
-		t.AddRow(row)
-	}
-	return t
-}
-
 func showDatabases(clusterFlag string, databases []types.Database, active []tlsca.RouteToDatabase, verbose bool) {
 	if verbose {
 		t := asciitable.MakeTable([]string{"Name", "Description", "Protocol", "Type", "URI", "Labels", "Connect", "Expires"})
@@ -1575,7 +1598,7 @@ func showDatabases(clusterFlag string, databases []types.Database, active []tlsc
 				connect,
 			})
 		}
-		t := makeTableWithTruncatedColumn([]string{"Name", "Description", "Labels", "Connect"}, rows, "Labels")
+		t := asciitable.MakeTableWithTruncatedColumn([]string{"Name", "Description", "Labels", "Connect"}, rows, "Labels")
 		fmt.Println(t.AsBuffer().String())
 	}
 }
@@ -1739,7 +1762,8 @@ func onBenchmark(cf *CLIConf) error {
 	fmt.Printf("\nHistogram\n\n")
 	t := asciitable.MakeTable([]string{"Percentile", "Response Duration"})
 	for _, quantile := range []float64{25, 50, 75, 90, 95, 99, 100} {
-		t.AddRow([]string{fmt.Sprintf("%v", quantile),
+		t.AddRow([]string{
+			fmt.Sprintf("%v", quantile),
 			fmt.Sprintf("%v ms", result.Histogram.ValueAtQuantile(quantile)),
 		})
 	}
@@ -1958,12 +1982,29 @@ func makeClient(cf *CLIConf, useProfileLogin bool) (*client.TeleportClient, erro
 	if cf.Username != "" {
 		c.Username = cf.Username
 	}
+	c.Passwordless = cf.Passwordless
 	// if proxy is set, and proxy is not equal to profile's
 	// loaded addresses, override the values
 	if err := setClientWebProxyAddr(cf, c); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
+	if c.ExtraProxyHeaders == nil {
+		c.ExtraProxyHeaders = map[string]string{}
+	}
+	for _, proxyHeaders := range cf.ExtraProxyHeaders {
+		proxyGlob := utils.GlobToRegexp(proxyHeaders.Proxy)
+		proxyRegexp, err := regexp.Compile(proxyGlob)
+		if err != nil {
+			return nil, trace.Wrap(err, "invalid proxy glob %q in tsh configuration file", proxyGlob)
+		}
+		if proxyRegexp.MatchString(c.WebProxyAddr) {
+			for k, v := range proxyHeaders.Headers {
+				c.ExtraProxyHeaders[k] = v
+			}
+		}
+	}
+
 	if len(fPorts) > 0 {
 		c.LocalForwardPorts = fPorts
 	}
@@ -1992,6 +2033,11 @@ func makeClient(cf *CLIConf, useProfileLogin bool) (*client.TeleportClient, erro
 	c.Labels = labels
 	c.KeyTTL = time.Minute * time.Duration(cf.MinsToLive)
 	c.InsecureSkipVerify = cf.InsecureSkipVerify
+	c.PredicateExpression = cf.PredicateExpression
+
+	if cf.SearchKeywords != "" {
+		c.SearchKeywords = client.ParseSearchKeywords(cf.SearchKeywords, ',')
+	}
 
 	// If a TTY was requested, make sure to allocate it. Note this applies to
 	// "exec" command because a shell always has a TTY allocated.
@@ -2086,8 +2132,12 @@ func makeClient(cf *CLIConf, useProfileLogin bool) (*client.TeleportClient, erro
 		}
 	}
 
+	tc.Config.Stderr = cf.Stderr()
+	tc.Config.Stdout = cf.Stdout()
+
 	tc.Config.Reason = cf.Reason
 	tc.Config.Invited = cf.Invited
+	tc.Config.DisplayParticipantRequirements = cf.displayParticipantRequirements
 	return tc, nil
 }
 
@@ -2185,7 +2235,6 @@ func refuseArgs(command string, args []string) error {
 		} else {
 			return trace.BadParameter("unexpected argument: %s", arg)
 		}
-
 	}
 	return nil
 }
@@ -2453,7 +2502,7 @@ func onApps(cf *CLIConf) error {
 	// Get a list of all applications.
 	var apps []types.Application
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		apps, err = tc.ListApps(cf.Context)
+		apps, err = tc.ListApps(cf.Context, nil /* custom filter */)
 		return err
 	})
 	if err != nil {
diff --git a/tool/tsh/tsh_helper_test.go b/tool/tsh/tsh_helper_test.go
index 823f0f4f48141..faac5aae33ff0 100644
--- a/tool/tsh/tsh_helper_test.go
+++ b/tool/tsh/tsh_helper_test.go
@@ -84,7 +84,7 @@ func (s *suite) setupRootCluster(t *testing.T, options testSuiteOptions) {
 	require.NoError(t, err)
 
 	s.connector = mockConnector(t)
-	sshLoginRole, err := types.NewRole("ssh-login", types.RoleSpecV5{
+	sshLoginRole, err := types.NewRoleV3("ssh-login", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{user.Username},
 		},
@@ -143,7 +143,7 @@ func (s *suite) setupLeafCluster(t *testing.T) {
 	require.NoError(t, err)
 
 	cfg.Proxy.DisableWebInterface = true
-	sshLoginRole, err := types.NewRole("ssh-login", types.RoleSpecV5{
+	sshLoginRole, err := types.NewRoleV3("ssh-login", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{user.Username},
 		},
diff --git a/tool/tsh/tsh_test.go b/tool/tsh/tsh_test.go
index 375554dea5750..4ceb4adc0c994 100644
--- a/tool/tsh/tsh_test.go
+++ b/tool/tsh/tsh_test.go
@@ -17,9 +17,10 @@ limitations under the License.
 package main
 
 import (
+	"bufio"
+	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -153,7 +154,7 @@ func TestOIDCLogin(t *testing.T) {
 
 	// set up an initial role with `request_access: always` in order to
 	// trigger automatic post-login escalation.
-	populist, err := types.NewRole("populist", types.RoleSpecV5{
+	populist, err := types.NewRoleV3("populist", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Request: &types.AccessRequestConditions{
 				Roles: []string{"dictator"},
@@ -166,7 +167,7 @@ func TestOIDCLogin(t *testing.T) {
 	require.NoError(t, err)
 
 	// empty role which serves as our escalation target
-	dictator, err := types.NewRole("dictator", types.RoleSpecV5{})
+	dictator, err := types.NewRoleV3("dictator", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	alice, err := types.NewUser("alice@example.com")
@@ -175,7 +176,11 @@ func TestOIDCLogin(t *testing.T) {
 
 	connector := mockConnector(t)
 
-	authProcess, proxyProcess := makeTestServers(t, withBootstrap(populist, dictator, connector, alice))
+	motd := "MESSAGE_OF_THE_DAY_OIDC"
+	authProcess, proxyProcess := makeTestServers(t,
+		withBootstrap(populist, dictator, connector, alice),
+		withMOTD(t, motd),
+	)
 
 	authServer := authProcess.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -213,6 +218,8 @@ func TestOIDCLogin(t *testing.T) {
 		}
 	}()
 
+	buf := bytes.NewBuffer([]byte{})
+	sc := bufio.NewScanner(buf)
 	err = Run([]string{
 		"login",
 		"--insecure",
@@ -223,6 +230,7 @@ func TestOIDCLogin(t *testing.T) {
 	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
 		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
 		cf.SiteName = "localhost"
+		cf.overrideStderr = buf
 		return nil
 	}))
 
@@ -231,11 +239,22 @@ func TestOIDCLogin(t *testing.T) {
 	// verify that auto-request happened
 	require.True(t, didAutoRequest.Load())
 
+	findMOTD(t, sc, motd)
 	// if we got this far, then tsh successfully registered name change from `alice` to
 	// `alice@example.com`, since the correct name needed to be used for the access
 	// request to be generated.
 }
 
+func findMOTD(t *testing.T, sc *bufio.Scanner, motd string) {
+	t.Helper()
+	for sc.Scan() {
+		if strings.Contains(sc.Text(), motd) {
+			return
+		}
+	}
+	require.Fail(t, "Failed to find %q MOTD in the logs", motd)
+}
+
 // TestLoginIdentityOut makes sure that "tsh login --out <ident>" command
 // writes identity credentials to the specified path.
 func TestLoginIdentityOut(t *testing.T) {
@@ -283,7 +302,11 @@ func TestRelogin(t *testing.T) {
 	require.NoError(t, err)
 	alice.SetRoles([]string{"access"})
 
-	authProcess, proxyProcess := makeTestServers(t, withBootstrap(connector, alice))
+	motd := "RELOGIN MOTD PRESENT"
+	authProcess, proxyProcess := makeTestServers(t,
+		withBootstrap(connector, alice),
+		withMOTD(t, motd),
+	)
 
 	authServer := authProcess.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -291,6 +314,8 @@ func TestRelogin(t *testing.T) {
 	proxyAddr, err := proxyProcess.ProxyWebAddr()
 	require.NoError(t, err)
 
+	buf := bytes.NewBuffer([]byte{})
+	sc := bufio.NewScanner(buf)
 	err = Run([]string{
 		"login",
 		"--insecure",
@@ -299,9 +324,11 @@ func TestRelogin(t *testing.T) {
 		"--proxy", proxyAddr.String(),
 	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
 		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+		cf.overrideStderr = buf
 		return nil
 	}))
 	require.NoError(t, err)
+	findMOTD(t, sc, motd)
 
 	err = Run([]string{
 		"login",
@@ -309,10 +336,20 @@ func TestRelogin(t *testing.T) {
 		"--debug",
 		"--proxy", proxyAddr.String(),
 		"localhost",
-	}, setHomePath(tmpHomePath))
+	}, setHomePath(tmpHomePath),
+		cliOption(func(cf *CLIConf) error {
+			cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+			cf.overrideStderr = buf
+			return nil
+		}))
 	require.NoError(t, err)
+	findMOTD(t, sc, motd)
 
-	err = Run([]string{"logout"}, setHomePath(tmpHomePath))
+	err = Run([]string{"logout"}, setHomePath(tmpHomePath),
+		cliOption(func(cf *CLIConf) error {
+			cf.overrideStderr = buf
+			return nil
+		}))
 	require.NoError(t, err)
 
 	err = Run([]string{
@@ -324,8 +361,10 @@ func TestRelogin(t *testing.T) {
 		"localhost",
 	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
 		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
+		cf.overrideStderr = buf
 		return nil
 	}))
+	findMOTD(t, sc, motd)
 	require.NoError(t, err)
 }
 
@@ -384,6 +423,11 @@ func TestMakeClient(t *testing.T) {
 	conf.NodePort = 46528
 	conf.LocalForwardPorts = []string{"80:remote:180"}
 	conf.DynamicForwardedPorts = []string{":8080"}
+	conf.ExtraProxyHeaders = []ExtraProxyHeaders{
+		{Proxy: "proxy:3080", Headers: map[string]string{"A": "B"}},
+		{Proxy: "*roxy:3080", Headers: map[string]string{"C": "D"}},
+		{Proxy: "*hello:3080", Headers: map[string]string{"E": "F"}}, // shouldn't get included
+	}
 	tc, err = makeClient(&conf, true)
 	require.NoError(t, err)
 	require.Equal(t, time.Minute*time.Duration(conf.MinsToLive), tc.Config.KeyTTL)
@@ -403,6 +447,10 @@ func TestMakeClient(t *testing.T) {
 		},
 	}, tc.Config.DynamicForwardedPorts)
 
+	require.Equal(t,
+		map[string]string{"A": "B", "C": "D"},
+		tc.ExtraProxyHeaders)
+
 	_, proxy := makeTestServers(t)
 
 	proxyWebAddr, err := proxy.ProxyWebAddr()
@@ -444,7 +492,7 @@ func TestAccessRequestOnLeaf(t *testing.T) {
 		lib.SetInsecureDevMode(isInsecure)
 	})
 
-	requester, err := types.NewRole("requester", types.RoleSpecV5{
+	requester, err := types.NewRoleV3("requester", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Request: &types.AccessRequestConditions{
 				Roles: []string{"access"},
@@ -634,7 +682,7 @@ func TestIdentityRead(t *testing.T) {
 	require.NotNil(t, cb)
 
 	// prepare the cluster CA separately
-	certBytes, err := ioutil.ReadFile("../../fixtures/certs/identities/ca.pem")
+	certBytes, err := os.ReadFile("../../fixtures/certs/identities/ca.pem")
 	require.NoError(t, err)
 
 	_, hosts, cert, _, _, err := ssh.ParseKnownHosts(certBytes)
@@ -986,58 +1034,6 @@ func TestKubeConfigUpdate(t *testing.T) {
 	}
 }
 
-func TestMakeTableWithTruncatedColumn(t *testing.T) {
-	// os.Stdin.Fd() fails during go test, so width is defaulted to 80
-	columns := []string{"column1", "column2", "column3"}
-	rows := [][]string{[]string{strings.Repeat("cell1", 6), strings.Repeat("cell2", 6), strings.Repeat("cell3", 6)}}
-
-	testCases := []struct {
-		truncatedColumn string
-		expectedWidth   int
-		expectedOutput  []string
-	}{
-		{
-			truncatedColumn: "column2",
-			expectedWidth:   80,
-			expectedOutput: []string{
-				"column1                        column2           column3                        ",
-				"------------------------------ ----------------- ------------------------------ ",
-				"cell1cell1cell1cell1cell1cell1 cell2cell2cell... cell3cell3cell3cell3cell3cell3 ",
-				"",
-			},
-		},
-		{
-			truncatedColumn: "column3",
-			expectedWidth:   80,
-			expectedOutput: []string{
-				"column1                        column2                        column3           ",
-				"------------------------------ ------------------------------ ----------------- ",
-				"cell1cell1cell1cell1cell1cell1 cell2cell2cell2cell2cell2cell2 cell3cell3cell... ",
-				"",
-			},
-		},
-		{
-			truncatedColumn: "no column match",
-			expectedWidth:   93,
-			expectedOutput: []string{
-				"column1                        column2                        column3                        ",
-				"------------------------------ ------------------------------ ------------------------------ ",
-				"cell1cell1cell1cell1cell1cell1 cell2cell2cell2cell2cell2cell2 cell3cell3cell3cell3cell3cell3 ",
-				"",
-			},
-		},
-	}
-	for _, testCase := range testCases {
-		t.Run(testCase.truncatedColumn, func(t *testing.T) {
-			table := makeTableWithTruncatedColumn(columns, rows, testCase.truncatedColumn)
-			rows := strings.Split(table.AsBuffer().String(), "\n")
-			require.Len(t, rows, 4)
-			require.Len(t, rows[2], testCase.expectedWidth)
-			require.Equal(t, testCase.expectedOutput, rows)
-		})
-	}
-}
-
 func TestSetX11Config(t *testing.T) {
 	t.Parallel()
 
@@ -1238,8 +1234,8 @@ func TestSetX11Config(t *testing.T) {
 }
 
 type testServersOpts struct {
-	bootstrap      []types.Resource
-	authConfigFunc func(cfg *service.AuthConfig)
+	bootstrap       []types.Resource
+	authConfigFuncs []func(cfg *service.AuthConfig)
 }
 
 type testServerOptFunc func(o *testServersOpts)
@@ -1252,7 +1248,11 @@ func withBootstrap(bootstrap ...types.Resource) testServerOptFunc {
 
 func withAuthConfig(fn func(cfg *service.AuthConfig)) testServerOptFunc {
 	return func(o *testServersOpts) {
-		o.authConfigFunc = fn
+		if o.authConfigFuncs == nil {
+			o.authConfigFuncs = []func(cfg *service.AuthConfig){}
+		}
+
+		o.authConfigFuncs = append(o.authConfigFuncs, fn)
 	}
 }
 
@@ -1267,6 +1267,17 @@ func withClusterName(t *testing.T, n string) testServerOptFunc {
 	})
 }
 
+func withMOTD(t *testing.T, motd string) testServerOptFunc {
+	oldpass := client.PasswordFromConsoleFn
+	*client.PasswordFromConsoleFn = func() (string, error) {
+		return "", nil
+	}
+	t.Cleanup(func() { *client.PasswordFromConsoleFn = *oldpass })
+	return withAuthConfig(func(cfg *service.AuthConfig) {
+		cfg.Preference.SetMessageOfTheDay(motd)
+	})
+}
+
 func makeTestServers(t *testing.T, opts ...testServerOptFunc) (auth *service.TeleportProcess, proxy *service.TeleportProcess) {
 	var options testServersOpts
 	for _, opt := range opts {
@@ -1299,8 +1310,8 @@ func makeTestServers(t *testing.T, opts ...testServerOptFunc) (auth *service.Tel
 	cfg.Proxy.Enabled = false
 	cfg.Log = utils.NewLoggerForTests()
 
-	if options.authConfigFunc != nil {
-		options.authConfigFunc(&cfg.Auth)
+	for _, fn := range options.authConfigFuncs {
+		fn(&cfg.Auth)
 	}
 
 	auth, err = service.NewTeleport(cfg)
@@ -1383,7 +1394,7 @@ func mockSSOLogin(t *testing.T, authServer *auth.Server, user types.User) client
 		require.NoError(t, err)
 
 		// load CA cert
-		authority, err := authServer.GetCertAuthority(types.CertAuthID{
+		authority, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: "localhost",
 		}, false)
diff --git a/tool/tsh/tshconfig.go b/tool/tsh/tshconfig.go
new file mode 100644
index 0000000000000..c4a4a76c8f8b5
--- /dev/null
+++ b/tool/tsh/tshconfig.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/gravitational/teleport/api/profile"
+	"github.com/gravitational/trace"
+	"gopkg.in/yaml.v2"
+)
+
+// .tsh config must go in a subdir as all .yaml files in .tsh get
+// parsed automatically by the profile loader and results in yaml
+// unmarshal errors.
+const tshConfigPath = "config/config.yaml"
+
+// TshConfig represents configuration loaded from the tsh config file.
+type TshConfig struct {
+	// ExtraHeaders are additional http headers to be included in
+	// webclient requests.
+	ExtraHeaders []ExtraProxyHeaders `yaml:"add_headers"`
+}
+
+// ExtraProxyHeaders represents the headers to include with the
+// webclient.
+type ExtraProxyHeaders struct {
+	// Proxy is the domain of the proxy for these set of Headers, can contain globs.
+	Proxy string `yaml:"proxy"`
+	// Headers are the http header key values.
+	Headers map[string]string `yaml:"headers,omitempty"`
+}
+
+func loadConfig(homePath string) (*TshConfig, error) {
+	confPath := filepath.Join(profile.FullProfilePath(homePath), tshConfigPath)
+	configFile, err := os.Open(confPath)
+	if err != nil {
+		return nil, trace.ConvertSystemError(err)
+	}
+	defer configFile.Close()
+	cfg := TshConfig{}
+	err = yaml.NewDecoder(configFile).Decode(&cfg)
+	return &cfg, trace.Wrap(err)
+}
diff --git a/webassets b/webassets
index d92318d2efa30..f9ba10f271617 160000
--- a/webassets
+++ b/webassets
@@ -1 +1 @@
-Subproject commit d92318d2efa301f5b58ec3a242fb3b09dd580f19
+Subproject commit f9ba10f271617fabe1f247e91ea363286a84f604

From c4ab70ab96e58afe7db566f3a4e48d8e11d09a08 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 23 Mar 2022 14:05:14 -0700
Subject: [PATCH 29/43] Revert "Merge master"

This reverts commit a23bf820939893108512446cb3185ffd9c246574.
---
 .cloudbuild/ci/integration-tests.yaml         |   23 +-
 .cloudbuild/ci/unit-tests.yaml                |   24 +-
 .../scripts/cmd/integration-tests/args.go     |    4 -
 .../scripts/cmd/integration-tests/main.go     |   30 +-
 .cloudbuild/scripts/cmd/unit-tests/main.go    |   32 +-
 .cloudbuild/scripts/go.mod                    |   15 +-
 .cloudbuild/scripts/go.sum                    |   27 +-
 .../internal/artifacts/artifacts_test.go      |    3 +-
 .cloudbuild/scripts/internal/etcd/start.go    |  199 +-
 .cloudbuild/scripts/internal/git/configure.go |  145 -
 .cloudbuild/scripts/internal/git/deploykey.go |   34 -
 .../scripts/internal/git/knownhosts.go        |   33 -
 .cloudbuild/scripts/internal/git/unshallow.go |   25 -
 .cloudbuild/scripts/internal/github/meta.go   |   58 -
 .cloudbuild/scripts/internal/secrets/fetch.go |   41 -
 .drone.yml                                    |   46 +-
 .github/ISSUE_TEMPLATE/testplan.md            |   20 +-
 .../workflows/robot/internal/bot/assign.go    |  123 +-
 .../robot/internal/bot/assign_test.go         |  146 -
 .github/workflows/robot/internal/bot/bot.go   |   12 +-
 .../workflows/robot/internal/bot/bot_test.go  |   19 +-
 .github/workflows/robot/internal/bot/check.go |    2 +-
 .github/workflows/robot/internal/bot/label.go |    2 +-
 .../robot/internal/bot/label_test.go          |    4 +-
 .github/workflows/robot/internal/env/env.go   |   24 +-
 .../workflows/robot/internal/env/env_test.go  |    2 +-
 .../workflows/robot/internal/env/structs.go   |   24 +-
 .../workflows/robot/internal/github/github.go |  130 +-
 .../workflows/robot/internal/review/review.go |   39 +-
 .../robot/internal/review/review_test.go      |  304 +-
 .golangci.yml                                 |    8 -
 Cargo.lock                                    |   12 +-
 Makefile                                      |   15 +-
 README.md                                     |    2 +-
 api/client/client.go                          |  121 +-
 api/client/client_test.go                     |   37 +-
 api/client/contextdialer.go                   |   14 +-
 api/client/credentials.go                     |    4 +-
 api/client/credentials_test.go                |   40 +-
 api/client/proto/authservice.pb.go            | 1983 ++++---------
 api/client/proto/authservice.proto            |   44 +-
 api/client/proto/types.go                     |    2 +-
 api/client/proxy.go                           |    4 +-
 api/client/proxy/proxy.go                     |   16 -
 api/client/webclient/webclient.go             |  103 +-
 api/client/webclient/webclient_test.go        |   32 +-
 api/go.mod                                    |    2 +-
 api/go.sum                                    |   24 +-
 api/identityfile/identityfile.go              |    5 +-
 api/profile/profile.go                        |   36 +-
 api/types/app_test.go                         |    4 +
 api/types/appserver.go                        |    9 +-
 api/types/constants.go                        |    6 +-
 api/types/database.go                         |   10 +
 api/types/databaseserver.go                   |    9 +-
 api/types/databaseserver_test.go              |    4 +
 api/types/desktop.go                          |   97 -
 api/types/desktop_test.go                     |   88 -
 api/types/events/events.pb.go                 | 1365 +++------
 api/types/events/events.proto                 |   19 -
 api/types/events/oneof.go                     |   24 +-
 api/types/events/unknown.go                   |   25 -
 api/types/kubernetes.go                       |   98 -
 api/types/kubernetes_test.go                  |   84 -
 api/types/resource.go                         |   47 +-
 api/types/resource_test.go                    |   50 -
 api/types/role.go                             |   21 +-
 api/types/server_test.go                      |    4 +
 api/types/types.pb.go                         | 1501 +++++-----
 api/types/types.proto                         |    5 -
 assets/aws/Makefile                           |    2 +-
 assets/backport/main.go                       |    3 +-
 assets/loadtest/k8s/Makefile                  |    9 +-
 assets/loadtest/k8s/auth-etcd.yaml            |    3 -
 assets/loadtest/k8s/auth-firestore.yaml       |    3 -
 assets/loadtest/k8s/prometheus.yaml           |  291 --
 assets/loadtest/k8s/proxy.yaml                |    4 +-
 assets/loadtest/k8s/secrets/Makefile          |   20 +-
 build.assets/Dockerfile                       |    5 -
 build.assets/Makefile                         |   10 -
 build.assets/build-package.sh                 |    6 +-
 .../gomod/update-api-import-path/main.go      |   15 +-
 build.assets/install                          |    2 +-
 build.assets/tooling/cmd/check/main.go        |    6 -
 build.assets/tooling/cmd/check/main_test.go   |    9 -
 constants.go                                  |    4 -
 docker/teleport-ent-quickstart.yml            |    4 +-
 docker/teleport-lab.yml                       |    8 +-
 docker/teleport-quickstart.yml                |    4 +-
 docs/config.json                              |   99 +-
 .../guides/redis/redisinsight-add-config.png  |  Bin 228417 -> 0 bytes
 .../guides/redis/redisinsight-connected.png   |  Bin 181286 -> 0 bytes
 .../guides/redis/redisinsight-startup.png     |  Bin 453447 -> 0 bytes
 .../guides/redis/redisinsight-tls-config.png  |  Bin 326444 -> 0 bytes
 .../pages/access-controls/getting-started.mdx |    2 +-
 .../access-controls/guides/dual-authz.mdx     |   97 +-
 .../access-controls/guides/impersonation.mdx  |   32 +-
 .../guides/per-session-mfa.mdx                |   48 +-
 docs/pages/access-controls/guides/u2f.mdx     |    2 +-
 .../pages/access-controls/guides/webauthn.mdx |    2 +-
 docs/pages/access-controls/reference.mdx      |   20 +-
 docs/pages/api/getting-started.mdx            |   14 +-
 docs/pages/application-access/controls.mdx    |    2 +-
 .../application-access/getting-started.mdx    |   83 +-
 .../application-access/guides/api-access.mdx  |    1 -
 .../application-access/guides/aws-console.mdx |   38 +-
 .../guides/connecting-apps.mdx                |   38 +-
 docs/pages/cloud/faq.mdx                      |    4 +-
 .../pages/database-access/getting-started.mdx |   33 +-
 .../guides/cockroachdb-self-hosted.mdx        |    4 +-
 .../database-access/guides/gui-clients.mdx    |   31 -
 .../database-access/guides/mongodb-atlas.mdx  |    6 +-
 .../guides/mysql-self-hosted.mdx              |   53 +-
 .../guides/postgres-redshift.mdx              |  177 +-
 .../guides/postgres-self-hosted.mdx           |   50 +-
 docs/pages/database-access/guides/rds.mdx     |  293 +-
 docs/pages/database-access/guides/redis.mdx   |  375 ---
 docs/pages/database-access/reference/aws.mdx  |  219 +-
 docs/pages/database-access/reference/cli.mdx  |   47 -
 docs/pages/desktop-access/getting-started.mdx |   12 +-
 docs/pages/desktop-access/reference.mdx       |   19 -
 .../desktop-access/reference/clipboard.mdx    |   46 -
 .../desktop-access/reference/sessions.mdx     |   86 -
 docs/pages/enterprise/hsm.mdx                 |    2 +-
 docs/pages/enterprise/sso/adfs.mdx            |   83 +-
 docs/pages/enterprise/sso/azuread.mdx         |   30 +-
 docs/pages/enterprise/sso/gitlab.mdx          |   12 +-
 .../pages/enterprise/sso/google-workspace.mdx |    2 -
 docs/pages/enterprise/sso/oidc.mdx            |   12 +-
 docs/pages/enterprise/sso/okta.mdx            |   12 +-
 docs/pages/enterprise/sso/one-login.mdx       |   12 +-
 .../workflow/ssh-approval-jira-cloud.mdx      |  115 +-
 .../workflow/ssh-approval-jira-server.mdx     |  127 +-
 .../workflow/ssh-approval-mattermost.mdx      |   93 +-
 .../workflow/ssh-approval-pagerduty.mdx       |  101 +-
 .../workflow/ssh-approval-slack.mdx           |  157 +-
 docs/pages/faq.mdx                            |    2 +-
 docs/pages/getting-started/docker-compose.mdx |    6 +-
 docs/pages/getting-started/linux-server.mdx   |   49 +-
 docs/pages/includes/acme.mdx                  |   29 -
 .../database-access/aws-bootstrap.mdx         |   47 -
 .../database-access/database-config.yaml      |    2 +-
 .../database-access/guides-next-steps.mdx     |    1 -
 .../pages/includes/database-access/guides.mdx |    3 -
 .../database-access/start-auth-proxy.mdx      |   42 +-
 docs/pages/includes/dns-app-access.mdx        |    4 -
 docs/pages/includes/dns.mdx                   |   59 -
 .../enterprise/oidcauthentication.mdx         |   34 -
 .../enterprise/samlauthentication.mdx         |   33 -
 docs/pages/includes/helm.mdx                  |    2 +-
 .../includes/kubernetes-access/helm-k8s.mdx   |    2 +-
 .../includes/plugins/identity-export.mdx      |   29 -
 docs/pages/includes/plugins/rbac.mdx          |   60 -
 docs/pages/includes/tctl.mdx                  |   29 +-
 docs/pages/index.mdx                          |    4 +-
 docs/pages/installation.mdx                   |   13 -
 docs/pages/kubernetes-access/controls.mdx     |    2 +-
 .../getting-started/agent.mdx                 |  132 +-
 .../getting-started/cluster.mdx               |   54 +-
 docs/pages/kubernetes-access/guides.mdx       |    3 +
 .../kubernetes-access/guides/federation.mdx   |   49 +-
 .../kubernetes-access/guides/migration.mdx    |  392 +++
 .../guides/multiple-clusters.mdx              |  136 +-
 .../guides/standalone-teleport.mdx            |  114 +-
 .../kubernetes-access/helm/guides/aws.mdx     |   36 +-
 .../kubernetes-access/helm/guides/custom.mdx  |   20 +-
 .../helm/guides/digitalocean.mdx              |    2 -
 .../kubernetes-access/helm/guides/gcp.mdx     |   35 +-
 .../helm/guides/migration.mdx                 |   22 +-
 .../helm/includes/helm-install.mdx            |   48 +
 .../helm/includes/helm-repo-add.mdx           |   11 -
 .../teleport-cluster-cloud-warning.mdx        |   10 -
 .../includes/teleport-cluster-install.mdx     |   12 -
 .../includes/teleport-cluster-prereqs.mdx     |    6 -
 .../kubernetes-access/helm/reference.mdx      | 2575 ++++++++++++++++-
 .../helm/reference/teleport-cluster.mdx       | 1348 ---------
 .../helm/reference/teleport-kube-agent.mdx    | 1334 ---------
 docs/pages/kubernetes-access/introduction.mdx |    9 +-
 docs/pages/machine-id/getting-started.mdx     |  236 --
 docs/pages/machine-id/guides.mdx              |   11 -
 docs/pages/machine-id/guides/ansible.mdx      |  122 -
 docs/pages/machine-id/introduction.mdx        |   56 -
 docs/pages/machine-id/reference.mdx           |    8 -
 docs/pages/machine-id/reference/cli.mdx       |   90 -
 .../machine-id/reference/configuration.mdx    |   99 -
 docs/pages/server-access/getting-started.mdx  |  145 +-
 docs/pages/server-access/guides/ansible.mdx   |  126 +
 docs/pages/server-access/guides/vscode.mdx    |   59 +-
 docs/pages/setup/admin/adding-nodes.mdx       |  322 +--
 docs/pages/setup/admin/daemon.mdx             |    2 +-
 docs/pages/setup/admin/github-sso.mdx         |  162 +-
 docs/pages/setup/admin/troubleshooting.mdx    |   24 +-
 docs/pages/setup/admin/trustedclusters.mdx    |    2 +-
 .../pages/setup/deployments/aws-terraform.mdx |    2 +-
 docs/pages/setup/guides/fluentd.mdx           |  238 +-
 docs/pages/setup/guides/joining-nodes-aws.mdx |   24 +-
 .../pages/setup/guides/terraform-provider.mdx |  229 +-
 docs/pages/setup/operations/ca-rotation.mdx   |  259 +-
 docs/pages/setup/reference/authentication.mdx |   33 +-
 docs/pages/setup/reference/cli.mdx            |   75 +-
 docs/pages/setup/reference/license.mdx        |   25 +-
 docs/pages/setup/reference/metrics.mdx        |   87 +-
 .../setup/reference/predicate-language.mdx    |   71 -
 docs/postrelease.md                           |    7 +-
 dronegen/mac_pkg.go                           |    5 +-
 dronegen/main.go                              |    5 +-
 e                                             |    2 +-
 examples/aws/cloudformation/ent.yaml          |   30 +-
 examples/aws/cloudformation/oss.yaml          |   30 +-
 examples/aws/terraform/AMIS.md                |  102 +-
 .../terraform/ha-autoscale-cluster/README.md  |    2 +-
 .../aws/terraform/starter-cluster/README.md   |    2 +-
 .../aws/terraform/starter-cluster/vars.tf     |    2 +-
 examples/chart/CONTRIBUTING.md                |   51 -
 .../teleport-auto-trustedcluster/README.md    |    5 -
 .../.lint/{service.yaml => service.yml}       |    0
 .../.lint/standalone-customsize.yaml          |    2 +-
 .../.lint/standalone-existingpvc.yaml         |    2 +-
 .../chart/teleport-cluster/.lint/volumes.yaml |    2 +-
 .../teleport-cluster/.lint/webauthn.yaml      |    8 -
 examples/chart/teleport-cluster/README.md     |    4 -
 .../teleport-cluster/templates/config.yaml    |   24 +-
 .../chart/teleport-cluster/tests/README.md    |   18 -
 .../__snapshot__/certificate_test.yaml.snap   |   16 -
 .../__snapshot__/clusterrole_test.yaml.snap   |   27 -
 .../clusterrolebinding_test.yaml.snap         |   14 -
 .../tests/__snapshot__/config_test.yaml.snap  | 1098 -------
 .../__snapshot__/deployment_test.yaml.snap    | 1585 ----------
 .../tests/__snapshot__/pdb_test.yaml.snap     |   14 -
 .../tests/__snapshot__/psp_test.yaml.snap     |   34 -
 .../tests/__snapshot__/pvc_test.yaml.snap     |   30 -
 .../tests/__snapshot__/service_test.yaml.snap |  143 -
 .../serviceaccount_test.yaml.snap             |   10 -
 .../tests/certificate_test.yaml               |   29 -
 .../tests/clusterrole_test.yaml               |   11 -
 .../tests/clusterrolebinding_test.yaml        |   11 -
 .../teleport-cluster/tests/config_test.yaml   |  330 ---
 .../tests/deployment_test.yaml                |  533 ----
 .../teleport-cluster/tests/pdb_test.yaml      |   13 -
 .../teleport-cluster/tests/psp_test.yaml      |   21 -
 .../teleport-cluster/tests/pvc_test.yaml      |   65 -
 .../teleport-cluster/tests/service_test.yaml  |   66 -
 .../tests/serviceaccount_test.yaml            |   15 -
 .../chart/teleport-cluster/values.schema.json |   30 -
 examples/chart/teleport-cluster/values.yaml   |    3 -
 examples/chart/teleport-daemonset/README.md   |    5 -
 .../.lint/existing-data-volume.yaml           |    5 -
 .../teleport-kube-agent/.lint/extra-args.yaml |    5 -
 .../teleport-kube-agent/.lint/extra-env.yaml  |    7 -
 .../.lint/image-pull-policy-stateful.yaml     |    7 -
 .../.lint/image-pull-policy.yaml              |    5 -
 .../.lint/service-account-name.yaml           |    5 -
 .../teleport-kube-agent/.lint/volumes.yaml    |    2 +-
 examples/chart/teleport-kube-agent/README.md  |    4 -
 .../teleport-kube-agent/templates/config.yaml |    6 -
 .../templates/deployment.yaml                 |   27 +-
 .../templates/statefulset.yaml                |   27 +-
 .../chart/teleport-kube-agent/tests/README.md |   18 -
 .../__snapshot__/clusterrole_test.yaml.snap   |   27 -
 .../clusterrolebinding_test.yaml.snap         |   14 -
 .../tests/__snapshot__/config_test.yaml.snap  |  658 -----
 .../__snapshot__/deployment_test.yaml.snap    | 1346 ---------
 .../tests/__snapshot__/pdb_test.yaml.snap     |   14 -
 .../tests/__snapshot__/psp_test.yaml.snap     |   34 -
 .../tests/__snapshot__/secret_test.yaml.snap  |   22 -
 .../serviceaccount_test.yaml.snap             |   10 -
 .../__snapshot__/statefulset_test.yaml.snap   | 1454 ----------
 .../tests/clusterrole_test.yaml               |   11 -
 .../tests/clusterrolebinding_test.yaml        |   11 -
 .../tests/config_test.yaml                    |  209 --
 .../tests/deployment_test.yaml                |  349 ---
 .../teleport-kube-agent/tests/pdb_test.yaml   |   13 -
 .../teleport-kube-agent/tests/psp_test.yaml   |   21 -
 .../tests/secret_test.yaml                    |   30 -
 .../tests/serviceaccount_test.yaml            |   15 -
 .../tests/statefulset_test.yaml               |  369 ---
 .../teleport-kube-agent/values.schema.json    |   10 -
 .../chart/teleport-kube-agent/values.yaml     |    9 -
 examples/chart/teleport/.helmignore           |    1 -
 examples/chart/teleport/README.md             |    5 -
 .../plugins/teleport-jira-cloud.toml          |   20 -
 ...ra-self-hosted.toml => teleport-jira.toml} |    0
 .../plugins/teleport-mattermost-cloud.toml    |   21 -
 ...ost-self.toml => teleport-mattermost.toml} |    0
 .../plugins/teleport-pagerduty-cloud.toml     |   26 -
 ...duty-self.toml => teleport-pagerduty.toml} |    0
 .../terraform/terraform-user-role-cloud.tf    |   79 -
 ...-self-hosted.tf => terraform-user-role.tf} |    4 +-
 go.mod                                        |    9 +-
 go.sum                                        |   32 +-
 integration/app_integration_test.go           |  154 +-
 integration/db_integration_test.go            |  173 +-
 integration/helpers.go                        |   19 +-
 integration/hsm/hsm_test.go                   |   20 +-
 integration/integration_test.go               |  130 +-
 integration/kube_integration_test.go          |   25 +-
 integration/proxy_helpers_test.go             |    6 +-
 integration/proxy_test.go                     |    4 +-
 lib/asciitable/table.go                       |   62 +-
 lib/asciitable/table_test.go                  |   52 -
 lib/auth/access.go                            |    2 +-
 lib/auth/access_test.go                       |    2 +-
 lib/auth/accountrecovery.go                   |    3 +-
 lib/auth/accountrecovery_test.go              |    2 +-
 lib/auth/api.go                               |   38 +-
 lib/auth/apiserver.go                         |   16 +-
 lib/auth/auth.go                              |  205 +-
 lib/auth/auth_login_test.go                   |  392 +--
 lib/auth/auth_test.go                         |   38 -
 lib/auth/auth_with_roles.go                   |  127 +-
 lib/auth/auth_with_roles_test.go              |  330 +--
 lib/auth/bot.go                               |   10 +-
 lib/auth/clt.go                               |  187 +-
 lib/auth/clt_test.go                          |   91 -
 lib/auth/db.go                                |    6 +-
 lib/auth/desktop.go                           |    2 +-
 lib/auth/github.go                            |    2 +-
 lib/auth/grpcserver.go                        |   35 +-
 lib/auth/grpcserver_test.go                   |  151 +-
 lib/auth/helpers.go                           |    8 +-
 lib/auth/httpfallback.go                      |   55 +-
 lib/auth/init.go                              |   22 +-
 lib/auth/init_test.go                         |    9 +-
 lib/auth/join.go                              |    7 +-
 lib/auth/join_test.go                         |   15 +-
 lib/auth/kube.go                              |    8 +-
 lib/auth/methods.go                           |  124 +-
 lib/auth/middleware.go                        |   21 +-
 lib/auth/mocku2f/mocku2f.go                   |   10 +-
 lib/auth/oidc.go                              |    8 +-
 lib/auth/password.go                          |    2 +-
 lib/auth/permissions.go                       |   10 +-
 lib/auth/permissions_test.go                  |    4 +-
 lib/auth/register.go                          |   37 +
 lib/auth/rotate.go                            |   15 +-
 lib/auth/saml.go                              |    8 +-
 lib/auth/session_access.go                    |   66 +-
 lib/auth/session_access_test.go               |   44 +-
 lib/auth/sessions.go                          |    4 +-
 lib/auth/state_unix.go                        |    1 -
 lib/auth/tls_test.go                          |  130 +-
 lib/auth/trustedcluster.go                    |   53 +-
 lib/auth/trustedcluster_test.go               |  126 -
 lib/auth/usertoken.go                         |    5 +-
 lib/auth/webauthn/login.go                    |   12 -
 lib/auth/webauthn/register.go                 |   13 -
 lib/auth/webauthn/register_test.go            |   84 -
 lib/auth/webauthncli/api.go                   |   64 -
 lib/auth/webauthncli/export_fido2_test.go     |   23 -
 lib/auth/webauthncli/fido2.go                 |  776 -----
 lib/auth/webauthncli/fido2_common.go          |   75 -
 lib/auth/webauthncli/fido2_other.go           |   48 -
 lib/auth/webauthncli/fido2_test.go            | 1438 ---------
 .../webauthncli/{u2f_login.go => login.go}    |   11 +-
 .../{u2f_login_test.go => login_test.go}      |    8 +-
 .../{u2f_register.go => register.go}          |   11 +-
 ...{u2f_register_test.go => register_test.go} |   18 +-
 lib/backend/backend.go                        |   12 +-
 lib/backend/backend_test.go                   |   19 -
 lib/backend/dynamo/dynamodbbk.go              |   16 +-
 lib/backend/dynamo/dynamodbbk_test.go         |    7 +-
 lib/backend/etcdbk/etcd.go                    |   11 +-
 lib/backend/firestore/firestorebk.go          |    1 +
 lib/backend/lite/lite.go                      |  164 +-
 lib/backend/lite/litemem_test.go              |   56 +
 lib/backend/memory/memory.go                  |    1 +
 lib/backend/report.go                         |    3 +
 lib/backend/sanitize.go                       |   19 +-
 lib/backend/sanitize_test.go                  |  101 +-
 lib/backend/test/suite.go                     |   76 +-
 lib/backend/wrap.go                           |    3 +
 lib/benchmark/benchmark.go                    |    5 +-
 lib/bpf/bpf_test.go                           |    7 +-
 lib/cache/cache.go                            |   32 +-
 lib/cache/cache_test.go                       |   27 +-
 lib/cache/collections.go                      |   10 +-
 lib/cgroup/cgroup.go                          |   22 +-
 lib/cgroup/cgroup_test.go                     |    5 +-
 lib/client/api.go                             |  568 ++--
 lib/client/api_login_test.go                  |   45 +-
 lib/client/api_test.go                        |   62 +-
 lib/client/client.go                          |   94 +-
 lib/client/client_test.go                     |    5 +-
 lib/client/{export.go => export_test.go}      |    0
 lib/client/https_client_test.go               |   31 +-
 lib/client/identityfile/identity.go           |   15 +-
 lib/client/identityfile/identity_test.go      |    8 +-
 lib/client/keyagent_test.go                   |    3 +-
 lib/client/keystore.go                        |   45 +-
 lib/client/keystore_test.go                   |   16 +-
 lib/client/mfa.go                             |   31 +-
 lib/client/weblogin.go                        |   22 +-
 lib/client/weblogin_test.go                   |    4 +-
 lib/config/configuration.go                   |   36 +-
 lib/config/configuration_test.go              |   12 +-
 lib/config/fileconf.go                        |   13 +-
 lib/datalog/access_test.go                    |    2 +-
 lib/defaults/defaults.go                      |   11 -
 lib/events/api.go                             |    3 -
 lib/events/auditlog_test.go                   |    9 +-
 lib/events/codes.go                           |    5 -
 lib/events/complete.go                        |  195 +-
 lib/events/complete_test.go                   |  145 -
 lib/events/dynamic.go                         |   16 +-
 lib/events/emitter_test.go                    |    3 +-
 lib/events/events_test.go                     |    3 +-
 lib/events/fields.go                          |    3 +-
 lib/events/filesessions/fileasync.go          |    7 +-
 .../filesessions/fileasync_chaos_test.go      |    5 +-
 lib/events/filesessions/fileasync_test.go     |   17 +-
 lib/events/filesessions/filestream.go         |   50 +-
 lib/events/filesessions/fileuploader_test.go  |    5 +-
 lib/events/gcssessions/gcsstream.go           |    7 +-
 lib/events/gcssessions/gcsstream_test.go      |   34 -
 lib/events/playback.go                        |    3 +-
 lib/events/s3sessions/s3stream.go             |   17 -
 lib/events/sessionlog.go                      |    7 +-
 lib/events/stream.go                          |   14 +-
 lib/events/test/streamsuite.go                |    5 +-
 lib/events/test/suite.go                      |    8 +-
 lib/kube/kubeconfig/kubeconfig_test.go        |    3 +-
 lib/kube/proxy/auth_test.go                   |    3 +-
 lib/kube/proxy/forwarder_test.go              |    4 +-
 lib/kube/proxy/roundtrip.go                   |    3 +-
 lib/kube/proxy/sess.go                        |  105 +-
 lib/kube/utils/utils.go                       |   29 +-
 lib/kube/utils/utils_test.go                  |   30 -
 lib/multiplexer/multiplexer_test.go           |    7 +-
 lib/restrictedsession/restricted_test.go      |    3 +-
 lib/reversetunnel/agent.go                    |    6 +-
 lib/reversetunnel/agent_test.go               |    2 +-
 lib/reversetunnel/api.go                      |   15 -
 lib/reversetunnel/conn.go                     |   10 +
 lib/reversetunnel/fake.go                     |   41 +-
 lib/reversetunnel/localsite.go                |   64 +-
 lib/reversetunnel/localsite_test.go           |  101 -
 lib/reversetunnel/remotesite.go               |    6 +-
 lib/reversetunnel/resolver.go                 |    4 +-
 lib/reversetunnel/srv.go                      |    2 +-
 lib/reversetunnel/srv_test.go                 |    3 +-
 lib/reversetunnel/transport.go                |   16 +-
 lib/service/connect.go                        |    4 +-
 lib/service/desktop.go                        |    1 -
 lib/service/service.go                        |  102 +-
 lib/service/service_test.go                   |   31 +-
 lib/service/state.go                          |    4 +-
 lib/services/access_request_test.go           |    2 +-
 lib/services/database.go                      |  133 +-
 lib/services/database_test.go                 |   51 +-
 lib/services/desktop.go                       |    1 -
 lib/services/local/desktops.go                |   67 -
 lib/services/local/desktops_test.go           |  213 --
 lib/services/local/perf_test.go               |    6 +-
 lib/services/local/presence.go                |   89 +-
 lib/services/local/presence_test.go           |  117 +-
 lib/services/local/session.go                 |   31 +-
 lib/services/local/trust.go                   |   12 +-
 lib/services/local/users.go                   |    2 -
 lib/services/local/users_test.go              |   34 +-
 lib/services/matchers.go                      |    2 +-
 lib/services/matchers_test.go                 |   26 -
 lib/services/reconciler.go                    |   18 +-
 lib/services/reconciler_test.go               |    8 +-
 lib/services/resource.go                      |   83 +-
 lib/services/role.go                          |   24 +-
 lib/services/role_test.go                     |   16 +-
 lib/services/suite/suite.go                   |   17 +-
 lib/services/trust.go                         |   10 +-
 lib/services/watcher.go                       |   58 +-
 lib/srv/alpnproxy/auth/auth_proxy.go          |   23 +-
 lib/srv/alpnproxy/auth/auth_proxy_test.go     |   76 -
 lib/srv/alpnproxy/common/protocols.go         |   17 +-
 lib/srv/alpnproxy/proxy.go                    |   14 +-
 lib/srv/alpnproxy/proxy_test.go               |   59 -
 lib/srv/app/aws/endpoints.go                  |  160 -
 lib/srv/app/aws/endpoints_test.go             |  359 ---
 lib/srv/app/aws/handler.go                    |   14 +
 lib/srv/app/server.go                         |    4 +-
 lib/srv/app/server_test.go                    |    2 +-
 lib/srv/app/watcher.go                        |   60 +-
 lib/srv/authhandlers.go                       |    3 +-
 lib/srv/ctx.go                                |   22 +-
 lib/srv/db/access_test.go                     |   83 +-
 lib/srv/db/audit_test.go                      |    8 +-
 lib/srv/db/ca.go                              |    9 +-
 lib/srv/db/ca_test.go                         |   20 +-
 lib/srv/db/cloud/watchers/rds.go              |   25 +-
 lib/srv/db/cloud/watchers/redshift.go         |    7 -
 lib/srv/db/cloud/watchers/watcher_test.go     |  101 +-
 lib/srv/db/common/errors.go                   |   56 -
 lib/srv/db/common/test.go                     |    2 +-
 lib/srv/db/ha_test.go                         |    2 +-
 lib/srv/db/mongodb/connect.go                 |   23 +-
 lib/srv/db/mongodb/engine.go                  |    9 +-
 lib/srv/db/mongodb/test.go                    |   11 +-
 lib/srv/db/mysql/engine.go                    |   14 +-
 lib/srv/db/mysql/test.go                      |   25 -
 lib/srv/db/postgres/engine.go                 |   14 +-
 lib/srv/db/proxy_test.go                      |    4 +-
 lib/srv/db/proxyserver.go                     |   76 +-
 lib/srv/db/proxyserver_test.go                |    8 +-
 lib/srv/db/redis/client.go                    |  293 --
 lib/srv/db/redis/cmds.go                      |   53 +-
 lib/srv/db/redis/engine.go                    |   86 +-
 lib/srv/db/redis/protocol/resp2.go            |   54 +-
 lib/srv/db/redis/protocol/resp2_test.go       |  106 -
 lib/srv/db/server.go                          |    4 +-
 lib/srv/db/watcher.go                         |    7 +-
 lib/srv/desktop/audit.go                      |   21 +-
 lib/srv/desktop/audit_test.go                 |    3 -
 lib/srv/desktop/discovery.go                  |   20 +-
 lib/srv/desktop/discovery_test.go             |   10 +-
 lib/srv/desktop/rdp/rdpclient/client.go       |   30 +-
 lib/srv/desktop/rdp/rdpclient/librdprs.h      |   15 +-
 lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs  |  233 +-
 lib/srv/desktop/rdp/rdpclient/src/lib.rs      |   22 +-
 lib/srv/desktop/rdp/rdpclient/src/vchan.rs    |   20 +-
 lib/srv/desktop/windows_server.go             |   21 +-
 lib/srv/desktop/windows_server_test.go        |   14 +-
 lib/srv/reexec.go                             |   19 +-
 lib/srv/regular/sshserver.go                  |    3 +-
 lib/srv/regular/sshserver_test.go             |    9 +-
 lib/srv/sess.go                               |  202 +-
 lib/srv/sess_test.go                          |  246 --
 lib/srv/termmanager.go                        |   76 +-
 lib/srv/termmanager_test.go                   |   50 -
 lib/sshutils/scp/scp_test.go                  |   15 +-
 lib/sshutils/x11/display.go                   |   24 +-
 lib/sshutils/x11/display_test.go              |  187 +-
 lib/tlsca/ca.go                               |   12 +-
 lib/utils/certs_test.go                       |    4 +-
 lib/utils/chconn_test.go                      |    4 +-
 lib/utils/cli.go                              |   74 +-
 lib/utils/cli_test.go                         |    4 +-
 lib/utils/conn.go                             |    3 +-
 lib/utils/environment_test.go                 |    3 +-
 lib/utils/jsontools_test.go                   |    5 +-
 lib/utils/kernel.go                           |    3 +-
 lib/utils/prompt/confirmation.go              |   13 +-
 lib/utils/prompt/sync_reader.go               |   55 -
 lib/utils/prompt/sync_reader_test.go          |   66 -
 lib/utils/syslog.go                           |    4 +-
 lib/utils/timeout_test.go                     |    4 +-
 lib/utils/token.go                            |    4 +-
 lib/utils/utils.go                            |    7 +-
 lib/utils/utils_test.go                       |    8 +-
 lib/web/apiserver.go                          |   96 +-
 lib/web/apiserver_login_test.go               |  139 +-
 lib/web/apiserver_test.go                     |  115 +-
 lib/web/app/transport.go                      |   13 +-
 lib/web/desktop/playback.go                   |   24 -
 lib/web/desktop/playback_test.go              |    2 +-
 lib/web/gziphandler.go                        |    4 +-
 lib/web/join_tokens.go                        |   41 +-
 lib/web/join_tokens_test.go                   |    5 +-
 lib/web/mfa.go                                |   20 +-
 lib/web/resources_test.go                     |    4 +-
 lib/web/sessions.go                           |   11 +-
 lib/web/static_test.go                        |   11 +-
 lib/web/ui/perf_test.go                       |    8 +-
 lib/web/ui/usercontext.go                     |    3 +
 lib/web/ui/usercontext_test.go                |    3 +-
 rfd/0039-sni-alpn-teleport-proxy-routing.md   |    2 +-
 rfd/0043-kubeaccess-multiparty.md             |  185 +-
 rfd/0046-database-access-config.md            |  411 +--
 rfd/0056-sql-backend.md                       |  137 -
 rfd/0060-gRPC-backend.md                      |  200 --
 tool/tbot/botfs/botfs.go                      |  156 -
 tool/tbot/botfs/fs_linux.go                   |  450 ---
 tool/tbot/botfs/fs_other.go                   |  113 -
 tool/tbot/config/config.go                    |  101 +-
 tool/tbot/config/config_destination.go        |   18 +-
 tool/tbot/config/config_test.go               |   56 +-
 tool/tbot/config/configtemplate.go            |    5 +
 tool/tbot/config/configtemplate_ssh.go        |  121 +-
 tool/tbot/config/destination.go               |   26 +-
 tool/tbot/config/destination_directory.go     |  136 +-
 tool/tbot/config/destination_memory.go        |   13 +-
 tool/tbot/destination/destination.go          |   25 +-
 tool/tbot/identity/artifact.go                |  144 -
 tool/tbot/identity/identity.go                |  254 +-
 tool/tbot/identity/kinds.go                   |   86 -
 tool/tbot/init.go                             |  557 ----
 tool/tbot/init_test.go                        |  271 --
 tool/tbot/main.go                             |  534 +---
 tool/tctl/common/app_command.go               |   62 +-
 tool/tctl/common/auth_command.go              |   89 +-
 tool/tctl/common/auth_command_test.go         |   91 +-
 tool/tctl/common/bots_command.go              |   38 +-
 tool/tctl/common/collection.go                |  211 +-
 tool/tctl/common/db_command.go                |   62 +-
 tool/tctl/common/desktop_command.go           |   97 -
 tool/tctl/common/kube_command.go              |   84 -
 tool/tctl/common/node_command.go              |   93 +-
 tool/tctl/common/resource_command.go          |   26 +-
 tool/tctl/common/resource_command_test.go     |    8 +-
 tool/tctl/common/status_command.go            |   14 +-
 tool/tctl/common/tctl.go                      |    8 -
 tool/tctl/common/token_command.go             |   28 +-
 tool/tctl/common/usage.go                     |   10 +-
 tool/tctl/main.go                             |    3 -
 tool/teleport/common/teleport.go              |    4 +-
 tool/teleport/common/teleport_test.go         |   40 +-
 tool/tsh/app.go                               |   14 +-
 tool/tsh/aws.go                               |    3 +-
 tool/tsh/db.go                                |   12 +-
 tool/tsh/db_test.go                           |    3 +-
 tool/tsh/dbcmd.go                             |    2 +-
 tool/tsh/kube.go                              |   67 +-
 tool/tsh/mfa.go                               |   89 +-
 tool/tsh/proxy_test.go                        |    7 +-
 tool/tsh/resolve_default_addr.go              |    3 +-
 tool/tsh/tsh.go                               |  173 +-
 tool/tsh/tsh_helper_test.go                   |    4 +-
 tool/tsh/tsh_test.go                          |  145 +-
 tool/tsh/tshconfig.go                         |   59 -
 webassets                                     |    2 +-
 617 files changed, 11203 insertions(+), 37048 deletions(-)
 delete mode 100644 .cloudbuild/scripts/internal/git/configure.go
 delete mode 100644 .cloudbuild/scripts/internal/git/deploykey.go
 delete mode 100644 .cloudbuild/scripts/internal/git/knownhosts.go
 delete mode 100644 .cloudbuild/scripts/internal/git/unshallow.go
 delete mode 100644 .cloudbuild/scripts/internal/github/meta.go
 delete mode 100644 .cloudbuild/scripts/internal/secrets/fetch.go
 delete mode 100644 .github/workflows/robot/internal/bot/assign_test.go
 delete mode 100644 api/types/desktop_test.go
 delete mode 100644 api/types/events/unknown.go
 delete mode 100644 api/types/kubernetes_test.go
 delete mode 100644 assets/loadtest/k8s/prometheus.yaml
 delete mode 100644 docs/img/database-access/guides/redis/redisinsight-add-config.png
 delete mode 100644 docs/img/database-access/guides/redis/redisinsight-connected.png
 delete mode 100644 docs/img/database-access/guides/redis/redisinsight-startup.png
 delete mode 100644 docs/img/database-access/guides/redis/redisinsight-tls-config.png
 delete mode 100644 docs/pages/database-access/guides/redis.mdx
 delete mode 100644 docs/pages/desktop-access/reference.mdx
 delete mode 100644 docs/pages/desktop-access/reference/clipboard.mdx
 delete mode 100644 docs/pages/desktop-access/reference/sessions.mdx
 delete mode 100644 docs/pages/includes/acme.mdx
 delete mode 100644 docs/pages/includes/database-access/aws-bootstrap.mdx
 delete mode 100644 docs/pages/includes/dns-app-access.mdx
 delete mode 100644 docs/pages/includes/dns.mdx
 delete mode 100644 docs/pages/includes/enterprise/oidcauthentication.mdx
 delete mode 100644 docs/pages/includes/enterprise/samlauthentication.mdx
 delete mode 100644 docs/pages/includes/plugins/identity-export.mdx
 delete mode 100644 docs/pages/includes/plugins/rbac.mdx
 create mode 100644 docs/pages/kubernetes-access/guides/migration.mdx
 create mode 100644 docs/pages/kubernetes-access/helm/includes/helm-install.mdx
 delete mode 100644 docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx
 delete mode 100644 docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx
 delete mode 100644 docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx
 delete mode 100644 docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
 delete mode 100644 docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx
 delete mode 100644 docs/pages/kubernetes-access/helm/reference/teleport-kube-agent.mdx
 delete mode 100644 docs/pages/machine-id/getting-started.mdx
 delete mode 100644 docs/pages/machine-id/guides.mdx
 delete mode 100644 docs/pages/machine-id/guides/ansible.mdx
 delete mode 100644 docs/pages/machine-id/introduction.mdx
 delete mode 100644 docs/pages/machine-id/reference.mdx
 delete mode 100644 docs/pages/machine-id/reference/cli.mdx
 delete mode 100644 docs/pages/machine-id/reference/configuration.mdx
 create mode 100644 docs/pages/server-access/guides/ansible.mdx
 delete mode 100644 docs/pages/setup/reference/predicate-language.mdx
 delete mode 100644 examples/chart/CONTRIBUTING.md
 rename examples/chart/teleport-cluster/.lint/{service.yaml => service.yml} (100%)
 delete mode 100644 examples/chart/teleport-cluster/.lint/webauthn.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/README.md
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/certificate_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/clusterrole_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/clusterrolebinding_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/config_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/pdb_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/psp_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/pvc_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/service_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/__snapshot__/serviceaccount_test.yaml.snap
 delete mode 100644 examples/chart/teleport-cluster/tests/certificate_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/clusterrole_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/clusterrolebinding_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/config_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/deployment_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/pdb_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/psp_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/pvc_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/service_test.yaml
 delete mode 100644 examples/chart/teleport-cluster/tests/serviceaccount_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/.lint/existing-data-volume.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/.lint/extra-args.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/.lint/extra-env.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/.lint/image-pull-policy-stateful.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/.lint/image-pull-policy.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/.lint/service-account-name.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/README.md
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrole_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrolebinding_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/pdb_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/psp_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/secret_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/serviceaccount_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
 delete mode 100644 examples/chart/teleport-kube-agent/tests/clusterrole_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/clusterrolebinding_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/config_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/deployment_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/pdb_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/psp_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/secret_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/serviceaccount_test.yaml
 delete mode 100644 examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
 delete mode 100644 examples/resources/plugins/teleport-jira-cloud.toml
 rename examples/resources/plugins/{teleport-jira-self-hosted.toml => teleport-jira.toml} (100%)
 delete mode 100644 examples/resources/plugins/teleport-mattermost-cloud.toml
 rename examples/resources/plugins/{teleport-mattermost-self.toml => teleport-mattermost.toml} (100%)
 delete mode 100644 examples/resources/plugins/teleport-pagerduty-cloud.toml
 rename examples/resources/plugins/{teleport-pagerduty-self.toml => teleport-pagerduty.toml} (100%)
 delete mode 100644 examples/resources/terraform/terraform-user-role-cloud.tf
 rename examples/resources/terraform/{terraform-user-role-self-hosted.tf => terraform-user-role.tf} (93%)
 delete mode 100644 lib/auth/webauthncli/api.go
 delete mode 100644 lib/auth/webauthncli/export_fido2_test.go
 delete mode 100644 lib/auth/webauthncli/fido2.go
 delete mode 100644 lib/auth/webauthncli/fido2_common.go
 delete mode 100644 lib/auth/webauthncli/fido2_other.go
 delete mode 100644 lib/auth/webauthncli/fido2_test.go
 rename lib/auth/webauthncli/{u2f_login.go => login.go} (91%)
 rename lib/auth/webauthncli/{u2f_login_test.go => login_test.go} (98%)
 rename lib/auth/webauthncli/{u2f_register.go => register.go} (94%)
 rename lib/auth/webauthncli/{u2f_register_test.go => register_test.go} (92%)
 create mode 100644 lib/backend/lite/litemem_test.go
 rename lib/client/{export.go => export_test.go} (100%)
 delete mode 100644 lib/events/complete_test.go
 delete mode 100644 lib/reversetunnel/localsite_test.go
 delete mode 100644 lib/services/local/desktops_test.go
 delete mode 100644 lib/srv/alpnproxy/auth/auth_proxy_test.go
 delete mode 100644 lib/srv/app/aws/endpoints.go
 delete mode 100644 lib/srv/app/aws/endpoints_test.go
 delete mode 100644 lib/srv/db/redis/client.go
 delete mode 100644 lib/srv/db/redis/protocol/resp2_test.go
 delete mode 100644 lib/srv/termmanager_test.go
 delete mode 100644 lib/utils/prompt/sync_reader.go
 delete mode 100644 lib/utils/prompt/sync_reader_test.go
 delete mode 100644 rfd/0056-sql-backend.md
 delete mode 100644 rfd/0060-gRPC-backend.md
 delete mode 100644 tool/tbot/botfs/botfs.go
 delete mode 100644 tool/tbot/botfs/fs_linux.go
 delete mode 100644 tool/tbot/botfs/fs_other.go
 delete mode 100644 tool/tbot/identity/artifact.go
 delete mode 100644 tool/tbot/identity/kinds.go
 delete mode 100644 tool/tbot/init.go
 delete mode 100644 tool/tbot/init_test.go
 delete mode 100644 tool/tctl/common/desktop_command.go
 delete mode 100644 tool/tctl/common/kube_command.go
 delete mode 100644 tool/tsh/tshconfig.go

diff --git a/.cloudbuild/ci/integration-tests.yaml b/.cloudbuild/ci/integration-tests.yaml
index 61deb3012cf17..8a64ecf50b964 100644
--- a/.cloudbuild/ci/integration-tests.yaml
+++ b/.cloudbuild/ci/integration-tests.yaml
@@ -1,14 +1,14 @@
 timeout: 25m
 options:
   machineType: E2_HIGHCPU_32
-  
-  # This build needs to run in environments where the _GITHUB_DEPLOY_KEY_SRC
-  # substitution is defined, but also environments where it isn't. The
-  # ALLOW_LOOSE option disables GCBs strict checking of substitution usage,
-  # so that the build will still run if _GITHUB_DEPLOY_KEY_SRC is not defined.
-  substitution_option: ALLOW_LOOSE
 
 steps:
+  # GCB does a shallow checkout for a build, but if we want to check our changes
+  # against other branches we'll need to fetch the repo history.
+  - name: gcr.io/cloud-builders/git
+    id: fetch-history
+    args: ['fetch', '--unshallow']
+
   # Run the integration tests. Actual content of this job depends on the changes 
   # detected in the PR
   - name: quay.io/gravitational/teleport-buildbox:teleport10
@@ -18,10 +18,9 @@ steps:
     args: 
       - -c
       - |
-        go run ./cmd/integration-tests          \
-          -target "$_BASE_BRANCH"               \
-          -bucket test-logs                     \
-          -build $BUILD_ID                      \
-          -key-secret "$_GITHUB_DEPLOY_KEY_SRC" \
+        go run ./cmd/integration-tests \
+          -target $_BASE_BRANCH        \
+          -bucket test-logs            \
+          -build $BUILD_ID             \
           -a "test-logs/*.json"          
-    timeout: 25m
+    timeout: 20m
diff --git a/.cloudbuild/ci/unit-tests.yaml b/.cloudbuild/ci/unit-tests.yaml
index ae9935c10088f..c673e9485150c 100644
--- a/.cloudbuild/ci/unit-tests.yaml
+++ b/.cloudbuild/ci/unit-tests.yaml
@@ -3,13 +3,14 @@ timeout: 25m
 options:
   machineType: 'E2_HIGHCPU_32'
   
-  # This build needs to run in environments where the _GITHUB_DEPLOY_KEY_SRC  
-  # substitution is defined, but also environments where it isn't. The
-  # ALLOW_LOOSE option disables GCBs strict checking of substitution usage,
-  # so that the build will still run if _GITHUB_DEPLOY_KEY_SRC is not defined.
-  substitution_option: ALLOW_LOOSE
-  
 steps:
+  # GCB does a shallow checkout for a build, but if we want to check our changes
+  # against other branches we'll need to fetch the repo history. This takes less 
+  # than 30s at the time of writing, so it is probably not worth tweaking.
+  - name: gcr.io/cloud-builders/git
+    id: fetch-history
+    args: ['fetch', '--unshallow']
+
   # Run the unit tests. Actual content of this job depends on the changes 
   # detected in the PR
   - name: quay.io/gravitational/teleport-buildbox:teleport10
@@ -19,10 +20,9 @@ steps:
     args: 
       - -c
       - |
-        go run ./cmd/unit-tests                 \
-          -target $_BASE_BRANCH                 \
-          -bucket test-logs                     \
-          -build $BUILD_ID                      \
-          -key-secret "$_GITHUB_DEPLOY_KEY_SRC" \
+        go run ./cmd/unit-tests \
+          -target $_BASE_BRANCH \
+          -bucket test-logs     \
+          -build $BUILD_ID      \
           -a "test-logs/*.json"
-    timeout: 25m
+    timeout: 20m
diff --git a/.cloudbuild/scripts/cmd/integration-tests/args.go b/.cloudbuild/scripts/cmd/integration-tests/args.go
index 2c98fab9c9077..aa29b10c71f91 100644
--- a/.cloudbuild/scripts/cmd/integration-tests/args.go
+++ b/.cloudbuild/scripts/cmd/integration-tests/args.go
@@ -33,8 +33,6 @@ type commandlineArgs struct {
 	buildID                string
 	artifactSearchPatterns customflag.StringArray
 	bucket                 string
-	githubKeySrc           string
-	skipUnshallow          bool
 }
 
 // validate ensures the suplied arguments are valid & internally consistent.
@@ -87,8 +85,6 @@ func parseCommandLine() (*commandlineArgs, error) {
 	flag.StringVar(&args.buildID, "build", "", "The build ID")
 	flag.StringVar(&args.bucket, "bucket", "", "The artifact storage bucket.")
 	flag.Var(&args.artifactSearchPatterns, "a", "Path to artifacts. May be shell-globbed, and have multiple entries.")
-	flag.StringVar(&args.githubKeySrc, "key-secret", "", "Location of github deploy token, as a Google Cloud Secret")
-	flag.BoolVar(&args.skipUnshallow, "skip-unshallow", false, "Skip unshallowing the repository.")
 
 	flag.Parse()
 
diff --git a/.cloudbuild/scripts/cmd/integration-tests/main.go b/.cloudbuild/scripts/cmd/integration-tests/main.go
index 3f64c8fee7a58..f6de022e00fcc 100644
--- a/.cloudbuild/scripts/cmd/integration-tests/main.go
+++ b/.cloudbuild/scripts/cmd/integration-tests/main.go
@@ -29,8 +29,6 @@ import (
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/artifacts"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/changes"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/etcd"
-	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/git"
-	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/secrets"
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 )
@@ -57,26 +55,6 @@ func innerMain() error {
 		return trace.Wrap(err)
 	}
 
-	// If a github deploy key location was supplied...
-	var deployKey []byte
-	if args.githubKeySrc != "" {
-		// fetch the deployment key from the GCB secret manager
-		log.Infof("Fetching deploy key from %s", args.githubKeySrc)
-		deployKey, err = secrets.Fetch(context.Background(), args.githubKeySrc)
-		if err != nil {
-			return trace.Wrap(err, "failed fetching deploy key")
-		}
-	}
-
-	if !args.skipUnshallow {
-		unshallowCtx, unshallowCancel := context.WithTimeout(context.Background(), 5*time.Minute)
-		defer unshallowCancel()
-		err = git.UnshallowRepository(unshallowCtx, args.workspace, deployKey)
-		if err != nil {
-			return trace.Wrap(err, "unshallow failed")
-		}
-	}
-
 	moduleCacheDir := filepath.Join(os.TempDir(), gomodcacheDir)
 	gomodcache := fmt.Sprintf("GOMODCACHE=%s", moduleCacheDir)
 
@@ -92,6 +70,9 @@ func innerMain() error {
 		return nil
 	}
 
+	cancelCtx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
 	// From this point on, whatever happens we want to upload any artifacts
 	// produced by the build
 	defer func() {
@@ -133,13 +114,10 @@ func innerMain() error {
 	// diagnostic warnings that would pollute the build log and just confuse
 	// people when they are trying to work out why their build failed.
 	log.Printf("Starting etcd...")
-	timeoutCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	etcdSvc, err := etcd.Start(timeoutCtx, args.workspace)
+	err = etcd.Start(cancelCtx, args.workspace, nonrootUID, nonrootGID, gomodcache)
 	if err != nil {
 		return trace.Wrap(err, "failed starting etcd")
 	}
-	defer etcdSvc.Stop()
 
 	log.Printf("Running nonroot integration tests...")
 	err = runNonrootIntegrationTests(args.workspace, nonrootUID, nonrootGID, gomodcache)
diff --git a/.cloudbuild/scripts/cmd/unit-tests/main.go b/.cloudbuild/scripts/cmd/unit-tests/main.go
index 3f8e52ef551ad..8b374c726d772 100644
--- a/.cloudbuild/scripts/cmd/unit-tests/main.go
+++ b/.cloudbuild/scripts/cmd/unit-tests/main.go
@@ -29,8 +29,6 @@ import (
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/changes"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/customflag"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/etcd"
-	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/git"
-	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/secrets"
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 )
@@ -50,8 +48,6 @@ type commandlineArgs struct {
 	buildID                string
 	artifactSearchPatterns customflag.StringArray
 	bucket                 string
-	githubKeySrc           string
-	skipUnshallow          bool
 }
 
 // NOTE: changing the interface to this build script may require follow-up
@@ -65,8 +61,6 @@ func parseCommandLine() (commandlineArgs, error) {
 	flag.StringVar(&args.buildID, "build", "", "The build ID")
 	flag.StringVar(&args.bucket, "bucket", "", "The artifact storage bucket.")
 	flag.Var(&args.artifactSearchPatterns, "a", "Path to artifacts. May be globbed, and have multiple entries.")
-	flag.StringVar(&args.githubKeySrc, "key-secret", "", "Location of github deploy token, as a Google Cloud Secret")
-	flag.BoolVar(&args.skipUnshallow, "skip-unshallow", false, "Skip unshallowing the repository.")
 
 	flag.Parse()
 
@@ -114,26 +108,6 @@ func run() error {
 		return trace.Wrap(err)
 	}
 
-	// If a github deploy key location was supplied...
-	var deployKey []byte
-	if args.githubKeySrc != "" {
-		// fetch the deployment key from the GCB secret manager
-		log.Infof("Fetching deploy key from %s", args.githubKeySrc)
-		deployKey, err = secrets.Fetch(context.Background(), args.githubKeySrc)
-		if err != nil {
-			return trace.Wrap(err, "failed fetching deploy key")
-		}
-	}
-
-	if !args.skipUnshallow {
-		unshallowCtx, unshallowCancel := context.WithTimeout(context.Background(), 5*time.Minute)
-		defer unshallowCancel()
-		err = git.UnshallowRepository(unshallowCtx, args.workspace, deployKey)
-		if err != nil {
-			return trace.Wrap(err, "unshallow failed")
-		}
-	}
-
 	log.Println("Analysing code changes")
 	ch, err := changes.Analyze(args.workspace, args.targetBranch, args.commitSHA)
 	if err != nil {
@@ -147,13 +121,11 @@ func run() error {
 	}
 
 	log.Printf("Starting etcd...")
-	timeoutCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	cancelCtx, cancel := context.WithCancel(context.Background())
 	defer cancel()
-	etcdSvc, err := etcd.Start(timeoutCtx, args.workspace)
-	if err != nil {
+	if err := etcd.Start(cancelCtx, args.workspace, 0, 0); err != nil {
 		return trace.Wrap(err, "failed starting etcd")
 	}
-	defer etcdSvc.Stop()
 
 	// From this point on, whatever happens we want to upload any artifacts
 	// produced by the build
diff --git a/.cloudbuild/scripts/go.mod b/.cloudbuild/scripts/go.mod
index 49cf54361d31c..300c5bb2c445a 100644
--- a/.cloudbuild/scripts/go.mod
+++ b/.cloudbuild/scripts/go.mod
@@ -3,15 +3,11 @@ module github.com/gravitational/teleport/.cloudbuild/scripts
 go 1.17
 
 require (
-	cloud.google.com/go/secretmanager v1.2.0
 	cloud.google.com/go/storage v1.19.0
 	github.com/go-git/go-git/v5 v5.4.2
 	github.com/gravitational/trace v1.1.15
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/sirupsen/logrus v1.8.1
-	github.com/stretchr/testify v1.7.0
-	golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b
-	google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c
 )
 
 require (
@@ -37,18 +33,21 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/sergi/go-diff v1.1.0 // indirect
-	github.com/stretchr/objx v0.2.0 // indirect
+	github.com/stretchr/objx v0.1.1 // indirect
+	github.com/stretchr/testify v1.7.0 // indirect
 	github.com/xanzy/ssh-agent v0.3.0 // indirect
 	go.opencensus.io v0.23.0 // indirect
+	golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b // indirect
 	golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420 // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
-	golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 // indirect
+	golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e // indirect
 	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 // indirect
 	golang.org/x/text v0.3.6 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/api v0.67.0 // indirect
+	google.golang.org/api v0.65.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/grpc v1.44.0 // indirect
+	google.golang.org/genproto v0.0.0-20220118154757-00ab72f36ad5 // indirect
+	google.golang.org/grpc v1.40.1 // indirect
 	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
diff --git a/.cloudbuild/scripts/go.sum b/.cloudbuild/scripts/go.sum
index d2b25fdba3cd4..a9f64ef4f6699 100644
--- a/.cloudbuild/scripts/go.sum
+++ b/.cloudbuild/scripts/go.sum
@@ -39,15 +39,12 @@ cloud.google.com/go/compute v0.1.0 h1:rSUBvAyVwNJ5uQCKNJFMwPtTvJkfN38b6Pvb9zZoqJ
 cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c=
 cloud.google.com/go/iam v0.1.1 h1:4CapQyNFjiksks1/x7jsvsygFPhihslYk5GptIrlX68=
 cloud.google.com/go/iam v0.1.1/go.mod h1:CKqrcnI/suGpybEHxZ7BMehL0oA4LpdyJdUlTl9jVMw=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/secretmanager v1.2.0 h1:VR6MzO4wjTj5jQKTPpsZhCF2PqqdAAZmN54BwJbQPhs=
-cloud.google.com/go/secretmanager v1.2.0/go.mod h1:HNMYTaLrMrAN37vi2mM2vvFgjgaoCE1qvtccCIJwFRc=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
@@ -73,7 +70,6 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -81,11 +77,7 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -99,7 +91,6 @@ github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5y
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -244,11 +235,9 @@ github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1 h1:2vfRuCMp5sSVIDSqO8oNnWJq7mPa6KVP3iPIwFBuy8A=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
-github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -431,9 +420,8 @@ golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e h1:fLOSk5Q00efkSvAm+4xcoXD+RRmLmmulPn5I3Y9F2EM=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 h1:XDXtA5hveEEV8JB2l7nhMTp3t3cHp9ZpwcdjqyEWLlo=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -536,9 +524,8 @@ google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdr
 google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
 google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
 google.golang.org/api v0.64.0/go.mod h1:931CdxA8Rm4t6zqTFGSsgwbAEZ2+GMYurbndwSimebM=
+google.golang.org/api v0.65.0 h1:MTW9c+LIBAbwoS1Gb+YV7NjFBt2f7GtAS5hIzh2NjgQ=
 google.golang.org/api v0.65.0/go.mod h1:ArYhxgGadlWmqO1IqVujw6Cs8IdD33bTmzKo2Sh+cbg=
-google.golang.org/api v0.67.0 h1:lYaaLa+x3VVUhtosaK9xihwQ9H9KRa557REHwwZ2orM=
-google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -610,11 +597,8 @@ google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211223182754-3ac035c7e7cb/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220111164026-67b88f271998/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220118154757-00ab72f36ad5 h1:zzNejm+EgrbLfDZ6lu9Uud2IVvHySPl8vQzf04laR5Q=
 google.golang.org/genproto v0.0.0-20220118154757-00ab72f36ad5/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c h1:TU4rFa5APdKTq0s6B7WTsH6Xmx0Knj86s6Biz56mErE=
-google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -640,9 +624,8 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.40.1 h1:pnP7OclFFFgFi4VHQDQDaoXUVauOFyktqTsqqgzFKbc=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.44.0 h1:weqSxi/TMs1SqFRMHCtBgXRs8k3X39QIDEZ0pRcttUg=
-google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
diff --git a/.cloudbuild/scripts/internal/artifacts/artifacts_test.go b/.cloudbuild/scripts/internal/artifacts/artifacts_test.go
index e5336608d7f11..eba6ca9b64c83 100644
--- a/.cloudbuild/scripts/internal/artifacts/artifacts_test.go
+++ b/.cloudbuild/scripts/internal/artifacts/artifacts_test.go
@@ -21,6 +21,7 @@ import (
 	"context"
 	"errors"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -34,7 +35,7 @@ func write(t *testing.T, data []byte, path ...string) string {
 	t.Helper()
 	filePath := filepath.Join(path...)
 	require.NoError(t, os.MkdirAll(filepath.Dir(filePath), 0777))
-	require.NoError(t, os.WriteFile(filePath, data, 0644))
+	require.NoError(t, ioutil.WriteFile(filePath, data, 0644))
 	return filePath
 }
 
diff --git a/.cloudbuild/scripts/internal/etcd/start.go b/.cloudbuild/scripts/internal/etcd/start.go
index fe4993228e047..932d368881c0c 100644
--- a/.cloudbuild/scripts/internal/etcd/start.go
+++ b/.cloudbuild/scripts/internal/etcd/start.go
@@ -17,208 +17,59 @@ limitations under the License.
 package etcd
 
 import (
-	"bytes"
 	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/json"
-	"io"
-	"net/http"
+	"net"
 	"os"
 	"os/exec"
-	"path"
+	"syscall"
 	"time"
 
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 )
 
-const (
-	metricsURL = "https://127.0.0.1:3379"
-)
-
-type Instance struct {
-	process *exec.Cmd
-	dataDir string
-	kill    context.CancelFunc
-	stdout  bytes.Buffer
-	stderr  bytes.Buffer
-}
-
-func (etcd *Instance) Stop() {
-	log.Printf("Killing etcd process")
-	etcd.kill()
-
-	log.Printf("Waiting for etcd process to exit...")
-	switch err := etcd.process.Wait().(type) {
-	case nil:
-		break
-
-	case *exec.ExitError:
-		// we expect a return code of -1 because we've just killed the process
-		// above. If we get something else then etcd failed earlier for some
-		// reason and we should print diagnostic output
-		if err.ExitCode() != -1 {
-			log.Printf("Etcd exited with unexpected status %d", err.ExitCode())
-			log.Printf("stderr:\n%s", etcd.stderr.String())
-		}
-
-	default:
-		log.Printf("Failed: %s", err)
-	}
-
-	log.Printf("Removing data dir")
-	if err := os.RemoveAll(etcd.dataDir); err != nil {
-		log.Printf("Failed removing data dir: %s", err)
-	}
-}
-
-// Start starts the etcd server using the keys extpected by the
-// integration and unit tests
-func Start(ctx context.Context, workspace string, env ...string) (*Instance, error) {
-	etcdBinary, err := exec.LookPath("etcd")
-	if err != nil {
-		return nil, trace.Wrap(err, "can't find etcd binary")
-	}
-
-	dataDir, err := os.MkdirTemp(os.TempDir(), "teleport-etcd-*")
-	if err != nil {
-		return nil, trace.Wrap(err, "can't create temp dir")
-	}
-
-	certsDir := path.Join(workspace, "examples", "etcd", "certs")
-
-	etcdInstance := &Instance{}
-	var processCtx context.Context
-	processCtx, etcdInstance.kill = context.WithCancel(context.Background())
-
-	etcdInstance.process = exec.CommandContext(processCtx, etcdBinary,
-		"--name", "teleportstorage",
-		"--data-dir", dataDir,
-		"--initial-cluster-state", "new",
-		"--cert-file", path.Join(certsDir, "server-cert.pem"),
-		"--key-file", path.Join(certsDir, "server-key.pem"),
-		"--trusted-ca-file", path.Join(certsDir, "ca-cert.pem"),
-		"--advertise-client-urls=https://127.0.0.1:2379",
-		"--listen-client-urls=https://127.0.0.1:2379",
-		"--listen-metrics-urls", metricsURL,
-		"--client-cert-auth",
-	)
-	etcdInstance.process.Dir = workspace
-	etcdInstance.process.Stdout = &etcdInstance.stdout
-	etcdInstance.process.Stderr = &etcdInstance.stderr
+// Start starts the etcd server using the Makefile `run-etcd` task and waits for it to start.
+func Start(ctx context.Context, workspace string, uid, gid int, env ...string) error {
+	cmd := exec.CommandContext(ctx, "make", "run-etcd")
+	cmd.Dir = workspace
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
 
 	if len(env) > 0 {
-		etcdInstance.process.Env = append(os.Environ(), env...)
-	}
-
-	log.Printf("Launching etcd (%s)", etcdInstance.process.Path)
-	if err = etcdInstance.process.Start(); err != nil {
-		return nil, trace.Wrap(err, "failed starting etcd")
+		cmd.Env = append(os.Environ(), env...)
 	}
 
-	timeoutCtx, cancelTimeout := context.WithTimeout(ctx, 5*time.Second)
-	defer cancelTimeout()
-
-	if err := waitForEtcdToStart(timeoutCtx, certsDir); err != nil {
-		log.Printf("Etcd failed to come up. Tidying up.")
-		etcdInstance.Stop()
-		return nil, trace.Wrap(err, "failed while waiting for etcd to start")
+	// make etcd run under the supplied account
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Credential: &syscall.Credential{
+			Uid: uint32(uid),
+			Gid: uint32(gid),
+		},
 	}
 
-	return etcdInstance, nil
-}
+	log.Printf("Launching etcd with %v in %q", cmd.Args, cmd.Dir)
+	go cmd.Run()
 
-// waitForEtcdToStart polls an etcd server (as started with Start()) until either
-// a) the etcd service reports itself as healthy, or
-// b) the supplied context expires
-func waitForEtcdToStart(ctx context.Context, certDir string) error {
-	log.Printf("Waiting for etcd to come up...")
+	log.Printf("Waiting for etcd to start...")
 
 	ticker := time.NewTicker(100 * time.Millisecond)
 	defer ticker.Stop()
 
-	client, err := newHTTPSTransport(certDir)
-	if err != nil {
-		return trace.Wrap(err, "failed to create https client")
-	}
+	timeoutCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
 
 	for {
 		select {
 		case <-ticker.C:
-			healthy, err := pollForHealth(ctx, client, metricsURL+"/health")
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			if healthy {
-				log.Printf("Etcd reporting healthy")
+			d := net.Dialer{Timeout: 100 * time.Millisecond}
+			_, err := d.Dial("tcp", "127.0.0.1:2379")
+			if err == nil {
+				log.Printf("Etcd is up")
 				return nil
 			}
 
-		case <-ctx.Done():
+		case <-timeoutCtx.Done():
 			return trace.Errorf("timed out waiting for etcd to start")
 		}
 	}
 }
-
-// newHTTPSTransport creates an HTTP client configured to use TLS with an etcd server
-// as started with Start()
-func newHTTPSTransport(certDir string) (*http.Client, error) {
-	caCertPath := path.Join(certDir, "ca-cert.pem")
-	caCert, err := os.ReadFile(caCertPath)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed reading CA cert from %s", caCertPath)
-	}
-
-	clientCert, err := tls.LoadX509KeyPair(
-		path.Join(certDir, "client-cert.pem"), path.Join(certDir, "client-key.pem"))
-	if err != nil {
-		return nil, trace.Wrap(err, "failed reading client cert")
-	}
-
-	transport := http.DefaultTransport.(*http.Transport).Clone()
-	transport.TLSClientConfig.RootCAs = x509.NewCertPool()
-	if !transport.TLSClientConfig.RootCAs.AppendCertsFromPEM(caCert) {
-		return nil, trace.Errorf("Failed adding CA cert")
-	}
-	transport.TLSClientConfig.Certificates = []tls.Certificate{clientCert}
-
-	return &http.Client{Transport: transport}, nil
-}
-
-// pollForHealth polls the etcd metrecs endpoint for status information, returning
-// true if the service reports itself as healthy
-func pollForHealth(ctx context.Context, client *http.Client, url string) (bool, error) {
-	type health struct {
-		Health string `json:"health"`
-		Reason string `json:"reason"`
-	}
-
-	timeoutCtx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
-	defer cancel()
-
-	request, err := http.NewRequestWithContext(timeoutCtx, http.MethodGet, url, nil)
-	if err != nil {
-		return false, trace.Wrap(err, "Failed constructing poll request")
-	}
-
-	// A request failure is considered "not healthy" rather than an error, as
-	// the etcd server may just not be up yet.
-	response, err := client.Do(request)
-	if err != nil {
-		return false, nil
-	}
-	defer response.Body.Close()
-
-	body, err := io.ReadAll(response.Body)
-	if err != nil {
-		return false, trace.Wrap(err, "failed reading poll response body")
-	}
-
-	status := health{}
-	if err = json.Unmarshal(body, &status); err != nil {
-		return false, trace.Wrap(err, "failed parsing poll response")
-	}
-
-	return status.Health == "true", nil
-}
diff --git a/.cloudbuild/scripts/internal/git/configure.go b/.cloudbuild/scripts/internal/git/configure.go
deleted file mode 100644
index 63d2fdb54e9b2..0000000000000
--- a/.cloudbuild/scripts/internal/git/configure.go
+++ /dev/null
@@ -1,145 +0,0 @@
-package git
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-
-	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/github"
-	"github.com/gravitational/trace"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/crypto/ssh"
-)
-
-// Config represents a git repository that has been configured to use a
-// deployment key, and acts as a handle to the resources so that we can
-// clean them up when we're done.
-type Config struct {
-	identity   string
-	knownHosts string
-	repoDir    string
-}
-
-// Configure alters the configuration of the git repository in `repoDir`
-// so that we can access it from build. If `deployKey` is non-nil the repo
-// will be configured to use that. If no deploy key is supplied, the repository
-// config is untouched.
-func Configure(ctx context.Context, repoDir string, deployKey []byte) (cfg *Config, err error) {
-	var identity string
-	var hostsFile string
-
-	// The deploy key we're using is too sensitive to just hope that every
-	// exit path will clean it up on failure, so let's just register a
-	// cleanup function now just in case.
-	defer func() {
-		if err != nil {
-			cleanup(identity, hostsFile)
-		}
-	}()
-
-	// If we have been supplied with deployment key, then we need to use that
-	// to access the repository. This implies that need to use ssh to read from
-	// the remote, so we will have to deal with known_hosts, etc.
-	if deployKey != nil {
-		githubHostKeys, err := getGithubHostKeys(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err, "failed configuring known hosts")
-		}
-
-		// configure SSH known_hosts for github.com
-		hostsFile, err = configureKnownHosts("github.com", githubHostKeys)
-		if err != nil {
-			return nil, trace.Wrap(err, "failed configuring known hosts")
-		}
-
-		// GCB clones via https, and our deploy key won't work with that, so
-		// force git to access the remote over ssh with a rewrite rule
-		log.Info("Adding remote url rewrite rule")
-		err = git(ctx, repoDir, "config", `url.git@github.com:.insteadOf`, "https://github.com/")
-		if err != nil {
-			return nil, trace.Wrap(err, "failed configuring url rewrite rule")
-		}
-
-		// set up the identity for the deploy key
-		identity, err = writeKey(deployKey)
-		if err != nil {
-			return nil, trace.Wrap(err, "failed configuring SSH identity")
-		}
-
-		// finally, force git to
-		//   a) use our custom SSH setup when accessing the remote, and
-		//   b) fail if the github host tries to present a host key other than
-		//      one we got from the metadata service
-		log.Infof("Configuring git ssh command")
-		err = git(ctx, repoDir, "config", "core.sshCommand",
-			fmt.Sprintf("ssh -i %s -o StrictHostKeyChecking=yes -o UserKnownHostsFile=%s", identity, hostsFile))
-		if err != nil {
-			return nil, trace.Wrap(err, "failed configuring git to use deploy key")
-		}
-	}
-
-	return &Config{identity: identity, repoDir: repoDir, knownHosts: hostsFile}, nil
-}
-
-// Do runs `git args...` in the configured repository
-func (cfg *Config) Do(ctx context.Context, args ...string) error {
-	return git(ctx, cfg.repoDir, args...)
-}
-
-// Close cleans up the repository, including deleting the deployment key (if any)
-func (cfg *Config) Close() error {
-	cleanup(cfg.identity, cfg.knownHosts)
-	return nil
-}
-
-func run(ctx context.Context, workingDir string, env []string, cmd string, args ...string) error {
-	p := exec.CommandContext(ctx, cmd, args...)
-	if len(env) != 0 {
-		p.Env = append(os.Environ(), env...)
-	}
-	p.Dir = workingDir
-
-	cmdLogger := log.WithField("cmd", cmd)
-	p.Stdout = cmdLogger.WriterLevel(log.InfoLevel)
-	p.Stderr = cmdLogger.WriterLevel(log.ErrorLevel)
-	return p.Run()
-}
-
-func git(ctx context.Context, repoDir string, args ...string) error {
-	return run(ctx, repoDir, nil, "/usr/bin/git", args...)
-}
-
-func cleanup(deployKey, knownHosts string) {
-	if knownHosts != "" {
-		log.Infof("Removing known_hosts file %s", knownHosts)
-		if err := os.Remove(knownHosts); err != nil {
-			log.WithError(err).Error("Failed cleaning up known_hosts key")
-		}
-	}
-
-	if deployKey != "" {
-		log.Infof("Removing deploy key file %s", deployKey)
-		if err := os.Remove(deployKey); err != nil {
-			log.WithError(err).Error("Failed cleaning up deploy key")
-		}
-	}
-}
-
-// getGithubHostKeys fetches the github host keys from the github metadata
-// service. The metadata is fetched over HTTPS, and so we have built-on
-// protection against MitM attacks while fetching the expected host keys.
-func getGithubHostKeys(ctx context.Context) ([]ssh.PublicKey, error) {
-	metadata, err := github.GetMetadata(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed fetching github metadata")
-	}
-
-	// extract the host keys
-	githubHostKeys, err := metadata.HostKeys()
-	if err != nil {
-		return nil, trace.Wrap(err, "failed fetching github hostKeys")
-	}
-
-	return githubHostKeys, nil
-}
diff --git a/.cloudbuild/scripts/internal/git/deploykey.go b/.cloudbuild/scripts/internal/git/deploykey.go
deleted file mode 100644
index fc57eb2798ef7..0000000000000
--- a/.cloudbuild/scripts/internal/git/deploykey.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package git
-
-import (
-	"os"
-
-	"github.com/gravitational/trace"
-	log "github.com/sirupsen/logrus"
-)
-
-func writeKey(deployKey []byte) (string, error) {
-	// Note that tempfiles are automatically created with 0600, so no-one else
-	// should be able to read this.
-	keyFile, err := os.CreateTemp("", "*")
-	if err != nil {
-		return "", trace.Wrap(err, "failed creating keyfile")
-	}
-	defer keyFile.Close()
-
-	log.Infof("Writing deploy key to %s", keyFile.Name())
-	_, err = keyFile.Write(deployKey)
-	if err != nil {
-		return "", trace.Wrap(err, "failed writing deploy key")
-	}
-
-	// ensure there is a trailing newline in the key, as older versions of the
-	// `ssh` client will barf on a key that doesn't have one, but will happily
-	// allow multiples
-	_, err = keyFile.WriteString("\n")
-	if err != nil {
-		return "", trace.Wrap(err, "failed formatting key")
-	}
-
-	return keyFile.Name(), nil
-}
diff --git a/.cloudbuild/scripts/internal/git/knownhosts.go b/.cloudbuild/scripts/internal/git/knownhosts.go
deleted file mode 100644
index 66096bb07f2d7..0000000000000
--- a/.cloudbuild/scripts/internal/git/knownhosts.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package git
-
-import (
-	"os"
-
-	"github.com/gravitational/trace"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/knownhosts"
-)
-
-func configureKnownHosts(hostname string, keys []ssh.PublicKey) (string, error) {
-	knownHostsFile, err := os.CreateTemp("", "*")
-	if err != nil {
-		return "", trace.Wrap(err, "failed creating known hosts file")
-	}
-	defer knownHostsFile.Close()
-
-	log.Infof("Writing known_hosts file to %s", knownHostsFile.Name())
-
-	addrs := []string{hostname}
-	for _, k := range keys {
-		log.Infof("processing key %s...", k.Type())
-		_, err := knownHostsFile.WriteString(knownhosts.Line(addrs, k) + "\n")
-		if err != nil {
-			knownHostsFile.Close()
-			os.Remove(knownHostsFile.Name())
-			return "", trace.Wrap(err, "failed writing known hosts")
-		}
-	}
-
-	return knownHostsFile.Name(), nil
-}
diff --git a/.cloudbuild/scripts/internal/git/unshallow.go b/.cloudbuild/scripts/internal/git/unshallow.go
deleted file mode 100644
index af3387359840f..0000000000000
--- a/.cloudbuild/scripts/internal/git/unshallow.go
+++ /dev/null
@@ -1,25 +0,0 @@
-package git
-
-import (
-	"context"
-
-	"github.com/gravitational/trace"
-	log "github.com/sirupsen/logrus"
-)
-
-func UnshallowRepository(ctx context.Context, workspace string, deployKey []byte) error {
-	log.Info("Configuring git")
-	gitCfg, err := Configure(ctx, workspace, deployKey)
-	if err != nil {
-		return trace.Wrap(err, "failed configuring git")
-	}
-	defer gitCfg.Close()
-
-	log.Info("Unshallowing repository")
-	err = gitCfg.Do(ctx, "fetch", "--unshallow")
-	if err != nil {
-		return trace.Wrap(err, "unshallow failed")
-	}
-
-	return nil
-}
diff --git a/.cloudbuild/scripts/internal/github/meta.go b/.cloudbuild/scripts/internal/github/meta.go
deleted file mode 100644
index a8096a013dae2..0000000000000
--- a/.cloudbuild/scripts/internal/github/meta.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package github
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-
-	"github.com/gravitational/trace"
-	"golang.org/x/crypto/ssh"
-)
-
-const (
-	metadataURL = "https://api.github.com/meta"
-)
-
-// Metadata contains information about the github networking environment,
-// enclosing host keys for git/ssh access
-type Metadata struct {
-	SSHKeyFingerPrints map[string]string `json:"ssh_key_fingerprints"`
-	SSHKeys            []string          `json:"ssh_keys"`
-}
-
-func GetMetadata(ctx context.Context) (*Metadata, error) {
-	request, err := http.NewRequestWithContext(ctx, http.MethodGet, metadataURL, nil)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed creating metadata request")
-	}
-
-	response, err := http.DefaultClient.Do(request)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed issuing metadata request")
-	}
-	defer response.Body.Close()
-
-	if response.StatusCode != http.StatusOK {
-		return nil, trace.Errorf("Metadata request failed %d", response.StatusCode)
-	}
-
-	var meta Metadata
-	err = json.NewDecoder(response.Body).Decode(&meta)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed parsing metadata")
-	}
-
-	return &meta, nil
-}
-
-func (meta *Metadata) HostKeys() ([]ssh.PublicKey, error) {
-	keys := make([]ssh.PublicKey, 0, len(meta.SSHKeys))
-	for _, text := range meta.SSHKeys {
-		key, _, _, _, err := ssh.ParseAuthorizedKey([]byte(text))
-		if err != nil {
-			return nil, trace.Wrap(err, "failed parsing host key")
-		}
-		keys = append(keys, key)
-	}
-	return keys, nil
-}
diff --git a/.cloudbuild/scripts/internal/secrets/fetch.go b/.cloudbuild/scripts/internal/secrets/fetch.go
deleted file mode 100644
index 38cbc1889d280..0000000000000
--- a/.cloudbuild/scripts/internal/secrets/fetch.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package secrets
-
-import (
-	"context"
-
-	secretmanager "cloud.google.com/go/secretmanager/apiv1"
-	"github.com/gravitational/trace"
-	log "github.com/sirupsen/logrus"
-	secretmanagerpb "google.golang.org/genproto/googleapis/cloud/secretmanager/v1"
-)
-
-// Fetch goes and grabs a single secret from the Google Cloud secret manager
-func Fetch(ctx context.Context, resourceName string) ([]byte, error) {
-	c, err := secretmanager.NewClient(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err, "failed creating SecretManager client")
-	}
-	defer c.Close()
-
-	log.Debugf("Fetching secret %s", resourceName)
-	secret, err := c.AccessSecretVersion(ctx, &secretmanagerpb.AccessSecretVersionRequest{
-		Name: resourceName,
-	})
-
-	if err != nil {
-		return nil, trace.Wrap(err, "failed fetching secret token")
-	}
-
-	return secret.Payload.Data, nil
-}
-
-// FetchString fetches a single secret from the Google Cloud secret manager and returns
-// it as a string.
-func FetchString(ctx context.Context, resourceName string) (string, error) {
-	data, err := Fetch(ctx, resourceName)
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-
-	return string(data), nil
-}
diff --git a/.drone.yml b/.drone.yml
index 73fd7d9337bf7..631e422378c4a 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,32 +1,4 @@
 ---
-kind: pipeline
-type: kubernetes
-name: update-docs-webhook
-
-trigger:
-  event:
-    include:
-      - push
-    exclude:
-      - pull_request
-  branch:
-    include:
-      - master
-      - branch/*
-  repo:
-    include:
-      - gravitational/teleport
-
-clone:
-  disable: true
-
-steps:
-  - name: Trigger docs deployment
-    image: plugins/webhook
-    settings:
-      urls:
-        from_secret: DOCS_DEPLOY_HOOK
----
 ################################################
 # Generated using dronegen, do not edit by hand!
 # Use 'make dronegen' to update.
@@ -815,19 +787,19 @@ steps:
       # increment these variables when a new major/minor version is released to bump the automatic builds
       # this only needs to be done on the master branch, as that's the branch that the Drone cron is configured for
       # build major version images which are just teleport:x
-      CURRENT_VERSION_ROOT: v9
-      PREVIOUS_VERSION_ONE_ROOT: v8
-      PREVIOUS_VERSION_TWO_ROOT: v7
+      CURRENT_VERSION_ROOT: v8
+      PREVIOUS_VERSION_ONE_ROOT: v7
+      PREVIOUS_VERSION_TWO_ROOT: v6
     commands:
       - apk --update --no-cache add curl go
       - mkdir -p /go/build && cd /go/build
-      # CURRENT_VERSION (9)
+      # CURRENT_VERSION (8)
       - (cd /go/build.assets/tooling && go run ./cmd/query-latest $CURRENT_VERSION_ROOT > /go/build/CURRENT_VERSION_TAG.txt)
       - echo "$(cat /go/build/CURRENT_VERSION_TAG.txt | cut -d. -f1 | tr -d '^v')" > /go/build/CURRENT_VERSION_TAG_GENERIC.txt
-      # PREVIOUS_VERSION_ONE (8)
+      # PREVIOUS_VERSION_ONE (7)
       - (cd /go/build.assets/tooling && go run ./cmd/query-latest $PREVIOUS_VERSION_ONE_ROOT > /go/build/PREVIOUS_VERSION_ONE_TAG.txt)
       - echo "$(cat /go/build/PREVIOUS_VERSION_ONE_TAG.txt | cut -d. -f1 | tr -d '^v')" > /go/build/PREVIOUS_VERSION_ONE_TAG_GENERIC.txt
-      # PREVIOUS_VERSION_TWO (7)
+      # PREVIOUS_VERSION_TWO (6)
       - (cd /go/build.assets/tooling && go run ./cmd/query-latest $PREVIOUS_VERSION_TWO_ROOT > /go/build/PREVIOUS_VERSION_TWO_TAG.txt)
       - echo "$(cat /go/build/PREVIOUS_VERSION_TWO_TAG.txt | cut -d. -f1 | tr -d '^v')" > /go/build/PREVIOUS_VERSION_TWO_TAG_GENERIC.txt
       # list versions
@@ -3152,9 +3124,9 @@ steps:
     ARCH: amd64
     BUILDBOX_PASSWORD:
       from_secret: BUILDBOX_PASSWORD
-    ENT_TARBALL_PATH: /tmp/build-darwin-amd64-pkg-tsh/go/artifacts
+    ENT_TARBALL_PATH: /tmp/build-darwin-amd64-pkg/go/artifacts
     OS: darwin
-    OSS_TARBALL_PATH: /tmp/build-darwin-amd64-pkg-tsh/go/artifacts
+    OSS_TARBALL_PATH: /tmp/build-darwin-amd64-pkg/go/artifacts
     WORKSPACE_DIR: /tmp/build-darwin-amd64-pkg-tsh
 - name: Copy Mac pkg artifacts
   commands:
@@ -5084,6 +5056,6 @@ volumes:
       name: drone-s3-debrepo-pvc
 ---
 kind: signature
-hmac: 8d0b79ebd4a3a0432402abf3b2773f45f8d787c0114d921dcdb5c909f2c338db
+hmac: 91c43e2655c4225898f8ba6fc034a0b5ee3de067d2f58979a474fcba342db799
 
 ...
diff --git a/.github/ISSUE_TEMPLATE/testplan.md b/.github/ISSUE_TEMPLATE/testplan.md
index 633930f8ecc65..e394322075ce1 100644
--- a/.github/ISSUE_TEMPLATE/testplan.md
+++ b/.github/ISSUE_TEMPLATE/testplan.md
@@ -139,11 +139,6 @@ With every user combination, try to login and signup with invalid second factor,
   - [ ] ssh -L \<regular-node\>
   - [ ] ssh -L \<node-remote-cluster\>
 
-- [ ] Verify proxy jump functionality
-  Log into leaf cluster via root, shut down the root proxy and verify proxy jump works.
-  - [ ] tsh ssh -J \<leaf-proxy\>
-  - [ ] ssh -J \<leaf-proxy\>
-
 - [ ] Interact with a cluster using the Web UI
   - [ ] Connect to a Teleport node
   - [ ] Connect to a OpenSSH node
@@ -281,15 +276,6 @@ tsh --proxy=proxy.example.com --user=<username> --insecure ssh --cluster=foo.com
 - [ ] Test receiving a message via Teleport Slackbot
 - [ ] Test receiving a new Jira Ticket via Teleport Jira
 
-### AWS Node Joining
-[Docs](https://goteleport.com/docs/setup/guides/joining-nodes-aws/)
-- [ ] On EC2 instance with `ec2:DescribeInstances` permissions for local account:
-  `TELEPORT_TEST_EC2=1 go test ./integration -run TestEC2NodeJoin`
-- [ ] On EC2 instance with any attached role:
-  `TELEPORT_TEST_EC2=1 go test ./integration -run TestIAMNodeJoin`
-- [ ] EC2 Join method in IoT mode with node and auth in different AWS accounts
-- [ ] IAM Join method in IoT mode with node and auth in different AWS accounts
-
 ## WEB UI
 
 ## Main
@@ -952,10 +938,6 @@ and non interactive tsh bench loads.
   - [ ] Verify async recording (`mode: node` or `mode: proxy`)
   - [ ] Sessions show up in session recordings UI with desktop icon
   - [ ] Sessions can be played back, including play/pause functionality
-  - [ ] A session that ends with a TDP error message can be played back, ends by displaying the error message,
-        and the progress bar progresses to the end.
-  - [ ] Attempting to play back a session that doesn't exist (i.e. by entering a non-existing session id in the url) shows
-        a relevant error message.
   - [ ] RBAC for sessions: ensure users can only see their own recordings when
     using the RBAC rule from our
     [docs](../../docs/pages/access-controls/reference.mdx#rbac-for-sessions)
@@ -979,4 +961,4 @@ and non interactive tsh bench loads.
   - [ ] Debian 9
 - Verify tsh runs on:
   - [ ] Windows 10
-  - [ ] MacOS
+  - [ ] MacOS
\ No newline at end of file
diff --git a/.github/workflows/robot/internal/bot/assign.go b/.github/workflows/robot/internal/bot/assign.go
index 35fe61ac3a243..e7743d822b569 100644
--- a/.github/workflows/robot/internal/bot/assign.go
+++ b/.github/workflows/robot/internal/bot/assign.go
@@ -19,9 +19,6 @@ package bot
 import (
 	"context"
 	"log"
-	"regexp"
-	"strconv"
-	"strings"
 
 	"github.com/gravitational/trace"
 )
@@ -53,128 +50,10 @@ func (b *Bot) Assign(ctx context.Context) error {
 }
 
 func (b *Bot) getReviewers(ctx context.Context) ([]string, error) {
-	// If a backport PR was found, assign original reviewers. Otherwise fall
-	// through to normal assignment logic.
-	if isBackport(b.c.Environment.UnsafeBase) {
-		reviewers, err := b.backportReviewers(ctx)
-		if err == nil {
-			return reviewers, nil
-		}
-		log.Printf("Assign: Found backport PR, but failed to find original reviewers: %v. Falling through to normal assignment logic.", err)
-	}
-
 	docs, code, err := b.parseChanges(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return b.c.Review.Get(b.c.Environment.Author, docs, code), nil
-}
 
-func (b *Bot) backportReviewers(ctx context.Context) ([]string, error) {
-	// Search inside the PR to find a reference to the original PR.
-	original, err := b.findOriginal(ctx,
-		b.c.Environment.Organization,
-		b.c.Environment.Repository,
-		b.c.Environment.Number)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var originalReviewers []string
-
-	// Append list of reviewers that have yet to submit a review.
-	reviewers, err := b.c.GitHub.ListReviewers(ctx,
-		b.c.Environment.Organization,
-		b.c.Environment.Repository,
-		original)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	originalReviewers = append(originalReviewers, reviewers...)
-
-	// Append list of reviews that have submitted a review.
-	reviews, err := b.c.GitHub.ListReviews(ctx,
-		b.c.Environment.Organization,
-		b.c.Environment.Repository,
-		original)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	for _, review := range reviews {
-		originalReviewers = append(originalReviewers, review.Author)
-	}
-
-	return dedup(b.c.Environment.Author, originalReviewers), nil
-}
-
-func (b *Bot) findOriginal(ctx context.Context, organization string, repository string, number int) (int, error) {
-	pull, err := b.c.GitHub.GetPullRequest(ctx,
-		organization,
-		repository,
-		number)
-	if err != nil {
-		return 0, trace.Wrap(err)
-	}
-
-	var original string
-
-	// Search inside the title and body for the original PR number.
-	title := pattern.FindStringSubmatch(pull.UnsafeTitle)
-	body := pattern.FindStringSubmatch(pull.UnsafeBody)
-	switch {
-	case len(title) == 0 && len(body) == 0:
-		return 0, trace.NotFound("no PR referenced in title or body")
-	case len(title) == 0 && len(body) == 2:
-		original = body[1]
-	case len(title) == 2 && len(body) == 0:
-		original = title[1]
-	case len(title) == 2 && len(body) == 2:
-		if title[1] != body[1] {
-			return 0, trace.NotFound("different PRs referenced in title and body")
-		}
-		original = title[1]
-	default:
-		return 0, trace.NotFound("failed to find reference to PR")
-	}
-
-	n, err := strconv.Atoi(original)
-	if err != nil {
-		return 0, trace.Wrap(err)
-	}
-
-	// Verify the number found is a Pull Request and not an Issue.
-	_, err = b.c.GitHub.GetPullRequest(ctx,
-		organization,
-		repository,
-		n)
-	if err != nil {
-		return 0, trace.NotFound("found Issue %v, not Pull Request", original)
-	}
-
-	log.Printf("Assign: Found original PR #%v.", original)
-	return n, nil
-}
-
-func dedup(author string, reviewers []string) []string {
-	m := map[string]bool{}
-
-	for _, reviewer := range reviewers {
-		if reviewer == author {
-			continue
-		}
-		m[reviewer] = true
-	}
-
-	var filtered []string
-	for k := range m {
-		filtered = append(filtered, k)
-	}
-
-	return filtered
-}
-
-func isBackport(unsafeBase string) bool {
-	return strings.HasPrefix(unsafeBase, "branch/v")
+	return b.c.Review.Get(b.c.Environment.Author, docs, code), nil
 }
-
-var pattern = regexp.MustCompile(`(?:https:\/\/github\.com\/gravitational\/teleport\/pull\/|#)([0-9]+)`)
diff --git a/.github/workflows/robot/internal/bot/assign_test.go b/.github/workflows/robot/internal/bot/assign_test.go
deleted file mode 100644
index b065a6023de36..0000000000000
--- a/.github/workflows/robot/internal/bot/assign_test.go
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package bot
-
-import (
-	"context"
-	"testing"
-
-	"github.com/gravitational/teleport/.github/workflows/robot/internal/env"
-	"github.com/gravitational/teleport/.github/workflows/robot/internal/github"
-	"github.com/gravitational/teleport/.github/workflows/robot/internal/review"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TestBackportReviewers checks if backport reviewers are correctly assigned.
-func TestBackportReviewers(t *testing.T) {
-	r, err := review.New(&review.Config{
-		CodeReviewers:     map[string]review.Reviewer{},
-		CodeReviewersOmit: map[string]bool{},
-		DocsReviewers:     map[string]review.Reviewer{},
-		DocsReviewersOmit: map[string]bool{},
-		Admins:            []string{},
-	})
-	require.NoError(t, err)
-
-	tests := []struct {
-		desc      string
-		pull      github.PullRequest
-		reviewers []string
-		reviews   []github.Review
-		err       bool
-		expected  []string
-	}{
-		{
-			desc: "backport-original-pr-number-approved",
-			pull: github.PullRequest{
-				Author:      "baz",
-				Repository:  "bar",
-				UnsafeHead:  "baz/fix",
-				UnsafeTitle: "Backport #0 to branch/v8",
-				UnsafeBody:  "",
-				Fork:        false,
-			},
-			reviewers: []string{"3"},
-			reviews: []github.Review{
-				{Author: "4", State: "APPROVED"},
-			},
-			err:      false,
-			expected: []string{"3", "4"},
-		},
-		{
-			desc: "backport-original-url-approved",
-			pull: github.PullRequest{
-				Author:      "baz",
-				Repository:  "bar",
-				UnsafeHead:  "baz/fix",
-				UnsafeTitle: "Fixed an issue",
-				UnsafeBody:  "https://github.com/gravitational/teleport/pull/0",
-				Fork:        false,
-			},
-			reviewers: []string{"3"},
-			reviews: []github.Review{
-				{Author: "4", State: "APPROVED"},
-			},
-			err:      false,
-			expected: []string{"3", "4"},
-		},
-		{
-			desc: "backport-multiple-reviews",
-			pull: github.PullRequest{
-				Author:      "baz",
-				Repository:  "bar",
-				UnsafeHead:  "baz/fix",
-				UnsafeTitle: "Fixed feature",
-				UnsafeBody:  "",
-				Fork:        false,
-			},
-			reviewers: []string{"3"},
-			reviews: []github.Review{
-				{Author: "4", State: "COMMENTED"},
-				{Author: "4", State: "CHANGES_REQUESTED"},
-				{Author: "4", State: "APPROVED"},
-				{Author: "9", State: "APPROVED"},
-			},
-			err:      true,
-			expected: []string{},
-		},
-		{
-			desc: "backport-original-not-found",
-			pull: github.PullRequest{
-				Author:      "baz",
-				Repository:  "bar",
-				UnsafeHead:  "baz/fix",
-				UnsafeTitle: "Fixed feature",
-				UnsafeBody:  "",
-				Fork:        false,
-			},
-			reviewers: []string{"3"},
-			reviews: []github.Review{
-				{Author: "4", State: "APPROVED"},
-			},
-			err:      true,
-			expected: []string{},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.desc, func(t *testing.T) {
-			b := &Bot{
-				c: &Config{
-					Environment: &env.Environment{
-						Organization: "foo",
-						Author:       "9",
-						Repository:   "bar",
-						Number:       0,
-						UnsafeBase:   "branch/v8",
-						UnsafeHead:   "fix",
-					},
-					Review: r,
-					GitHub: &fakeGithub{
-						pull:      test.pull,
-						reviewers: test.reviewers,
-						reviews:   test.reviews,
-					},
-				},
-			}
-			reviewers, err := b.backportReviewers(context.Background())
-			require.Equal(t, err != nil, test.err)
-			require.ElementsMatch(t, reviewers, test.expected)
-		})
-	}
-}
diff --git a/.github/workflows/robot/internal/bot/bot.go b/.github/workflows/robot/internal/bot/bot.go
index 5a979acdb60e7..e892be1fc1ae6 100644
--- a/.github/workflows/robot/internal/bot/bot.go
+++ b/.github/workflows/robot/internal/bot/bot.go
@@ -29,22 +29,16 @@ import (
 
 // Client implements the GitHub API.
 type Client interface {
-	// RequestReviewers is used to assign reviewers to a Pull Request.
+	// RequestReviewers is used to assign reviewers to a PR.
 	RequestReviewers(ctx context.Context, organization string, repository string, number int, reviewers []string) error
 
 	// ListReviews is used to list all submitted reviews for a PR.
-	ListReviews(ctx context.Context, organization string, repository string, number int) ([]github.Review, error)
-
-	// ListReviewers returns a list of reviewers that have yet to submit a review.
-	ListReviewers(ctx context.Context, organization string, repository string, number int) ([]string, error)
-
-	// GetPullRequest returns a specific Pull Request.
-	GetPullRequest(ctx context.Context, organization string, repository string, number int) (github.PullRequest, error)
+	ListReviews(ctx context.Context, organization string, repository string, number int) (map[string]*github.Review, error)
 
 	// ListPullRequests returns a list of Pull Requests.
 	ListPullRequests(ctx context.Context, organization string, repository string, state string) ([]github.PullRequest, error)
 
-	// ListFiles is used to list all the files within a Pull Request.
+	// ListFiles is used to list all the files within a PR.
 	ListFiles(ctx context.Context, organization string, repository string, number int) ([]string, error)
 
 	// AddLabels will add labels to an Issue or Pull Request.
diff --git a/.github/workflows/robot/internal/bot/bot_test.go b/.github/workflows/robot/internal/bot/bot_test.go
index 5ff4744385c9a..72ac663acf7b5 100644
--- a/.github/workflows/robot/internal/bot/bot_test.go
+++ b/.github/workflows/robot/internal/bot/bot_test.go
@@ -78,7 +78,7 @@ func TestParseChanges(t *testing.T) {
 						Number:       0,
 					},
 					GitHub: &fakeGithub{
-						files: test.files,
+						test.files,
 					},
 				},
 			}
@@ -91,26 +91,15 @@ func TestParseChanges(t *testing.T) {
 }
 
 type fakeGithub struct {
-	files     []string
-	pull      github.PullRequest
-	reviewers []string
-	reviews   []github.Review
+	files []string
 }
 
 func (f *fakeGithub) RequestReviewers(ctx context.Context, organization string, repository string, number int, reviewers []string) error {
 	return nil
 }
 
-func (f *fakeGithub) ListReviews(ctx context.Context, organization string, repository string, number int) ([]github.Review, error) {
-	return f.reviews, nil
-}
-
-func (f *fakeGithub) ListReviewers(ctx context.Context, organization string, repository string, number int) ([]string, error) {
-	return f.reviewers, nil
-}
-
-func (f *fakeGithub) GetPullRequest(ctx context.Context, organization string, repository string, number int) (github.PullRequest, error) {
-	return f.pull, nil
+func (f *fakeGithub) ListReviews(ctx context.Context, organization string, repository string, number int) (map[string]*github.Review, error) {
+	return nil, nil
 }
 
 func (f *fakeGithub) ListPullRequests(ctx context.Context, organization string, repository string, state string) ([]github.PullRequest, error) {
diff --git a/.github/workflows/robot/internal/bot/check.go b/.github/workflows/robot/internal/bot/check.go
index 34fc5daf4341e..d62c4d1e3a925 100644
--- a/.github/workflows/robot/internal/bot/check.go
+++ b/.github/workflows/robot/internal/bot/check.go
@@ -40,7 +40,7 @@ func (b *Bot) Check(ctx context.Context) error {
 		err := b.dismiss(ctx,
 			b.c.Environment.Organization,
 			b.c.Environment.Repository,
-			b.c.Environment.UnsafeHead)
+			b.c.Environment.UnsafeBranch)
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/.github/workflows/robot/internal/bot/label.go b/.github/workflows/robot/internal/bot/label.go
index 5bb5154a6b67a..843fe6fa37ee8 100644
--- a/.github/workflows/robot/internal/bot/label.go
+++ b/.github/workflows/robot/internal/bot/label.go
@@ -51,7 +51,7 @@ func (b *Bot) labels(ctx context.Context) ([]string, error) {
 	var labels []string
 
 	// The branch name is unsafe, but here we are simply adding a label.
-	if strings.HasPrefix(b.c.Environment.UnsafeHead, "branch/") {
+	if strings.HasPrefix(b.c.Environment.UnsafeBranch, "branch/") {
 		log.Println("Label: Found backport branch.")
 		labels = append(labels, "backport")
 	}
diff --git a/.github/workflows/robot/internal/bot/label_test.go b/.github/workflows/robot/internal/bot/label_test.go
index 3e1b1f71c343b..c68ff90c6d80f 100644
--- a/.github/workflows/robot/internal/bot/label_test.go
+++ b/.github/workflows/robot/internal/bot/label_test.go
@@ -84,10 +84,10 @@ func TestLabel(t *testing.T) {
 						Organization: "foo",
 						Repository:   "bar",
 						Number:       0,
-						UnsafeHead:   test.branch,
+						UnsafeBranch: test.branch,
 					},
 					GitHub: &fakeGithub{
-						files: test.files,
+						test.files,
 					},
 				},
 			}
diff --git a/.github/workflows/robot/internal/env/env.go b/.github/workflows/robot/internal/env/env.go
index 73fb61b844ec3..ebf989a2fffd7 100644
--- a/.github/workflows/robot/internal/env/env.go
+++ b/.github/workflows/robot/internal/env/env.go
@@ -38,26 +38,13 @@ type Environment struct {
 	// Author is the author of the PR.
 	Author string
 
-	// UnsafeHead is the name of the branch the workflow is running in.
+	// UnsafeBranch is the name of the branch the workflow is running in.
 	//
-	// UnsafeHead can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
+	// UnsafeBranch can be attacker controlled and should not be used in any
+	// security sensitive context. See the following link for more details:
 	//
 	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
-	UnsafeHead string
-
-	// UnsafeBase is the name of the base branch the user is trying to merge the
-	// PR into. For example: "master" or "branch/v8".
-	//
-	// UnsafeBase can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
-	//
-	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
-	UnsafeBase string
+	UnsafeBranch string
 }
 
 // New returns a new execution environment for the workflow.
@@ -85,8 +72,7 @@ func New() (*Environment, error) {
 		Repository:   event.Repository.Name,
 		Number:       event.PullRequest.Number,
 		Author:       event.PullRequest.User.Login,
-		UnsafeHead:   event.PullRequest.UnsafeHead.UnsafeRef,
-		UnsafeBase:   event.PullRequest.UnsafeBase.UnsafeRef,
+		UnsafeBranch: event.PullRequest.UnsafeHead.UnsafeRef,
 	}, nil
 }
 
diff --git a/.github/workflows/robot/internal/env/env_test.go b/.github/workflows/robot/internal/env/env_test.go
index 5ec2972db0120..205b7a3026447 100644
--- a/.github/workflows/robot/internal/env/env_test.go
+++ b/.github/workflows/robot/internal/env/env_test.go
@@ -95,7 +95,7 @@ func TestEnvironment(t *testing.T) {
 				require.Equal(t, environment.Repository, test.repository)
 				require.Equal(t, environment.Number, test.number)
 				require.Equal(t, environment.Author, test.author)
-				require.Equal(t, environment.UnsafeHead, test.unsafeBranch)
+				require.Equal(t, environment.UnsafeBranch, test.unsafeBranch)
 			}
 		})
 	}
diff --git a/.github/workflows/robot/internal/env/structs.go b/.github/workflows/robot/internal/env/structs.go
index d34de2e46f27f..ac82d282c8d41 100644
--- a/.github/workflows/robot/internal/env/structs.go
+++ b/.github/workflows/robot/internal/env/structs.go
@@ -39,39 +39,25 @@ type PullRequest struct {
 	Number int  `json:"number"`
 
 	// UnsafeHead can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
+	// security sensitive context. See the following link for more details:
 	//
 	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
-	UnsafeHead Branch `json:"head"`
-
-	// UnsafeHead can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
-	//
-	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
-	UnsafeBase Branch `json:"base"`
+	UnsafeHead Head `json:"head"`
 }
 
 type User struct {
 	Login string `json:"login"`
 }
 
-type Branch struct {
+type Head struct {
 	// UnsafeSHA can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
+	// security sensitive context. See the following link for more details:
 	//
 	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
 	UnsafeSHA string `json:"sha"`
 
 	// UnsafeRef can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
+	// security sensitive context. See the following link for more details:
 	//
 	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
 	UnsafeRef string `json:"ref"`
diff --git a/.github/workflows/robot/internal/github/github.go b/.github/workflows/robot/internal/github/github.go
index e25d7dbf6ff29..a52861b3e1972 100644
--- a/.github/workflows/robot/internal/github/github.go
+++ b/.github/workflows/robot/internal/github/github.go
@@ -22,7 +22,6 @@ import (
 	"net/http"
 	"net/url"
 	"path"
-	"sort"
 	"strconv"
 	"time"
 
@@ -46,7 +45,6 @@ func New(ctx context.Context, token string) (*Client, error) {
 	}, nil
 }
 
-// RequestReviewers is used to assign reviewers to a Pull Requests.
 func (c *Client) RequestReviewers(ctx context.Context, organization string, repository string, number int, reviewers []string) error {
 	_, _, err := c.client.PullRequests.RequestReviewers(ctx,
 		organization,
@@ -65,15 +63,14 @@ func (c *Client) RequestReviewers(ctx context.Context, organization string, repo
 type Review struct {
 	// Author is the GitHub login of the user that created the PR.
 	Author string
-	// State is the state of the PR, for example APPROVED, COMMENTED,
-	// CHANGES_REQUESTED, or DISMISSED.
+	// State is the state of the PR, for example APPROVED or CHANGES_REQUESTED.
 	State string
 	// SubmittedAt is the time the PR was created.
 	SubmittedAt time.Time
 }
 
-func (c *Client) ListReviews(ctx context.Context, organization string, repository string, number int) ([]Review, error) {
-	var reviews []Review
+func (c *Client) ListReviews(ctx context.Context, organization string, repository string, number int) (map[string]*Review, error) {
+	reviews := map[string]*Review{}
 
 	opt := &go_github.ListOptions{
 		Page:    0,
@@ -90,11 +87,20 @@ func (c *Client) ListReviews(ctx context.Context, organization string, repositor
 		}
 
 		for _, r := range page {
-			reviews = append(reviews, Review{
+			// Always pick up the last submitted review from each reviewer.
+			review, ok := reviews[r.GetUser().GetLogin()]
+			if ok {
+				if r.GetSubmittedAt().After(review.SubmittedAt) {
+					review.State = r.GetState()
+					review.SubmittedAt = r.GetSubmittedAt()
+				}
+			}
+
+			reviews[r.GetUser().GetLogin()] = &Review{
 				Author:      r.GetUser().GetLogin(),
 				State:       r.GetState(),
 				SubmittedAt: r.GetSubmittedAt(),
-			})
+			}
 		}
 
 		if resp.NextPage == 0 {
@@ -103,11 +109,6 @@ func (c *Client) ListReviews(ctx context.Context, organization string, repositor
 		opt.Page = resp.NextPage
 	}
 
-	// Sort oldest review first.
-	sort.SliceStable(reviews, func(i, j int) bool {
-		return reviews[i].SubmittedAt.Before(reviews[j].SubmittedAt)
-	})
-
 	return reviews, nil
 }
 
@@ -117,95 +118,13 @@ type PullRequest struct {
 	Author string
 	// Repository is the name of the repository.
 	Repository string
-	// Number is the Pull Request number.
-	Number int
-	// State is the state of the submitted review.
-	State string
-	// UnsafeHead is the name head of the branch.
-	//
-	// UnsafeHead can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
-	//
-	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
+	// UnsafeHead is the name of the branch this PR is created from. It is marked
+	// unsafe as it can be attacker controlled.
 	UnsafeHead string
-	// UnsafeTitle is the title of the Pull Request.
-	//
-	// UnsafeTitle can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
-	//
-	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
-	UnsafeTitle string
-	// UnsafeBody is the body of the Pull Request.
-	//
-	// UnsafeBody can be attacker controlled and should not be used in any
-	// security sensitive context. For example, don't use it when crafting a URL
-	// to send a request to or an access decision. See the following link for
-	// more details:
-	//
-	// https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
-	UnsafeBody string
 	// Fork determines if the pull request is from a fork.
 	Fork bool
 }
 
-// ListReviewers returns a list of reviewers that have yet to submit a review.
-func (c *Client) ListReviewers(ctx context.Context, organization string, repository string, number int) ([]string, error) {
-	var reviewers []string
-
-	opt := &go_github.ListOptions{
-		Page:    0,
-		PerPage: perPage,
-	}
-	for {
-		page, resp, err := c.client.PullRequests.ListReviewers(ctx,
-			organization,
-			repository,
-			number,
-			opt)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		for _, r := range page.Users {
-			reviewers = append(reviewers, r.GetLogin())
-		}
-
-		if resp.NextPage == 0 {
-			break
-		}
-		opt.Page = resp.NextPage
-	}
-
-	return reviewers, nil
-}
-
-// GetPullRequest returns a specific Pull Request.
-func (c *Client) GetPullRequest(ctx context.Context, organization string, repository string, number int) (PullRequest, error) {
-	pull, _, err := c.client.PullRequests.Get(ctx,
-		organization,
-		repository,
-		number)
-	if err != nil {
-		return PullRequest{}, trace.Wrap(err)
-	}
-
-	return PullRequest{
-		Author:      pull.GetUser().GetLogin(),
-		Repository:  repository,
-		Number:      pull.GetNumber(),
-		State:       pull.GetState(),
-		UnsafeHead:  pull.GetHead().GetRef(),
-		UnsafeTitle: pull.GetTitle(),
-		UnsafeBody:  pull.GetBody(),
-		Fork:        pull.GetHead().GetRepo().GetFork(),
-	}, nil
-}
-
-// ListPullRequests returns a list of Pull Requests.
 func (c *Client) ListPullRequests(ctx context.Context, organization string, repository string, state string) ([]PullRequest, error) {
 	var pulls []PullRequest
 
@@ -225,16 +144,12 @@ func (c *Client) ListPullRequests(ctx context.Context, organization string, repo
 			return nil, trace.Wrap(err)
 		}
 
-		for _, pull := range page {
+		for _, pr := range page {
 			pulls = append(pulls, PullRequest{
-				Author:      pull.GetUser().GetLogin(),
-				Repository:  repository,
-				Number:      pull.GetNumber(),
-				State:       pull.GetState(),
-				UnsafeHead:  pull.GetHead().GetRef(),
-				UnsafeTitle: pull.GetTitle(),
-				UnsafeBody:  pull.GetBody(),
-				Fork:        pull.GetHead().GetRepo().GetFork(),
+				Author:     pr.GetUser().GetLogin(),
+				Repository: repository,
+				UnsafeHead: pr.GetHead().GetRef(),
+				Fork:       pr.GetHead().GetRepo().GetFork(),
 			})
 		}
 		if resp.NextPage == 0 {
@@ -246,7 +161,6 @@ func (c *Client) ListPullRequests(ctx context.Context, organization string, repo
 	return pulls, nil
 }
 
-// ListFiles is used to list all the files within a Pull Request.
 func (c *Client) ListFiles(ctx context.Context, organization string, repository string, number int) ([]string, error) {
 	var files []string
 
@@ -301,7 +215,6 @@ type Workflow struct {
 	Path string
 }
 
-// ListWorkflows lists all workflows within a repository.
 func (c *Client) ListWorkflows(ctx context.Context, organization string, repository string) ([]Workflow, error) {
 	var workflows []Workflow
 
@@ -347,7 +260,6 @@ type Run struct {
 	CreatedAt time.Time
 }
 
-// ListWorkflowRuns is used to list all workflow runs for an ID.
 func (c *Client) ListWorkflowRuns(ctx context.Context, organization string, repository string, branch string, workflowID int64) ([]Run, error) {
 	var runs []Run
 
diff --git a/.github/workflows/robot/internal/review/review.go b/.github/workflows/robot/internal/review/review.go
index 0d1072c2c5d08..2bf803c7ed531 100644
--- a/.github/workflows/robot/internal/review/review.go
+++ b/.github/workflows/robot/internal/review/review.go
@@ -195,7 +195,7 @@ func (r *Assignments) getCodeReviewerSets(author string) ([]string, []string) {
 }
 
 // CheckExternal requires two admins have approved.
-func (r *Assignments) CheckExternal(author string, reviews []github.Review) error {
+func (r *Assignments) CheckExternal(author string, reviews map[string]*github.Review) error {
 	log.Printf("Check: Found external author %v.", author)
 
 	reviewers := r.getAdminReviewers(author)
@@ -209,7 +209,7 @@ func (r *Assignments) CheckExternal(author string, reviews []github.Review) erro
 // CheckInternal will verify if required reviewers have approved. Checks if
 // docs and if each set of code reviews have approved. Admin approvals bypass
 // all checks.
-func (r *Assignments) CheckInternal(author string, reviews []github.Review, docs bool, code bool) error {
+func (r *Assignments) CheckInternal(author string, reviews map[string]*github.Review, docs bool, code bool) error {
 	log.Printf("Check: Found internal author %v.", author)
 
 	// Skip checks if admins have approved.
@@ -247,7 +247,7 @@ func (r *Assignments) CheckInternal(author string, reviews []github.Review, docs
 	return nil
 }
 
-func (r *Assignments) checkDocsReviews(author string, reviews []github.Review) error {
+func (r *Assignments) checkDocsReviews(author string, reviews map[string]*github.Review) error {
 	reviewers := r.getDocsReviewers(author)
 
 	if check(reviewers, reviews) {
@@ -257,7 +257,7 @@ func (r *Assignments) checkDocsReviews(author string, reviews []github.Review) e
 	return trace.BadParameter("requires at least one approval from %v", reviewers)
 }
 
-func (r *Assignments) checkCodeReviews(author string, reviews []github.Review) error {
+func (r *Assignments) checkCodeReviews(author string, reviews map[string]*github.Review) error {
 	// External code reviews should never hit this path, if they do, fail and
 	// return an error.
 	v, ok := r.c.CodeReviewers[author]
@@ -314,42 +314,23 @@ func getReviewerSets(author string, team string, reviewers map[string]Reviewer,
 	return setA, setB
 }
 
-func check(reviewers []string, reviews []github.Review) bool {
+func check(reviewers []string, reviews map[string]*github.Review) bool {
 	return checkN(reviewers, reviews) > 0
 }
 
-func checkN(reviewers []string, reviews []github.Review) int {
-	r := reviewsByAuthor(reviews)
-
+func checkN(reviewers []string, reviews map[string]*github.Review) int {
 	var n int
 	for _, reviewer := range reviewers {
-		if state, ok := r[reviewer]; ok && state == approved {
-			n++
-		}
-	}
-	return n
-}
-
-func reviewsByAuthor(reviews []github.Review) map[string]string {
-	m := map[string]string{}
-
-	for _, review := range reviews {
-		// Always pick up the last submitted review from each reviewer.
-		if state, ok := m[review.Author]; ok {
-			// If the reviewer left comments after approval, skip this review.
-			if review.State == commented && state == approved {
-				continue
+		if review, ok := reviews[reviewer]; ok {
+			if review.State == approved && review.Author == reviewer {
+				n++
 			}
 		}
-		m[review.Author] = review.State
 	}
-
-	return m
+	return n
 }
 
 const (
-	// commented is a code review where the reviewer has left comments only.
-	commented = "COMMENTED"
 	// approved is a code review where the reviewer has approved changes.
 	approved = "APPROVED"
 	// changesRequested is a code review where the reviewer has requested changes.
diff --git a/.github/workflows/robot/internal/review/review_test.go b/.github/workflows/robot/internal/review/review_test.go
index 3412e1d374f7a..d8df894053445 100644
--- a/.github/workflows/robot/internal/review/review_test.go
+++ b/.github/workflows/robot/internal/review/review_test.go
@@ -37,16 +37,16 @@ func TestIsInternal(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
-						"3": {Team: "Core", Owner: false},
-						"4": {Team: "Core", Owner: false},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
+						"3": Reviewer{Team: "Core", Owner: false},
+						"4": Reviewer{Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"5": {Team: "Core", Owner: true},
-						"6": {Team: "Core", Owner: true},
+						"5": Reviewer{Team: "Core", Owner: true},
+						"6": Reviewer{Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -65,16 +65,16 @@ func TestIsInternal(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
-						"3": {Team: "Core", Owner: false},
-						"4": {Team: "Core", Owner: false},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
+						"3": Reviewer{Team: "Core", Owner: false},
+						"4": Reviewer{Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"5": {Team: "Core", Owner: true},
-						"6": {Team: "Core", Owner: true},
+						"5": Reviewer{Team: "Core", Owner: true},
+						"6": Reviewer{Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -93,16 +93,16 @@ func TestIsInternal(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
-						"3": {Team: "Core", Owner: false},
-						"4": {Team: "Core", Owner: false},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
+						"3": Reviewer{Team: "Core", Owner: false},
+						"4": Reviewer{Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"5": {Team: "Core", Owner: true},
-						"6": {Team: "Core", Owner: true},
+						"5": Reviewer{Team: "Core", Owner: true},
+						"6": Reviewer{Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -139,10 +139,10 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
-						"3": {Team: "Core", Owner: false},
-						"4": {Team: "Core", Owner: false},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
+						"3": Reviewer{Team: "Core", Owner: false},
+						"4": Reviewer{Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Admins.
@@ -162,11 +162,11 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
-						"3": {Team: "Core", Owner: false},
-						"4": {Team: "Core", Owner: false},
-						"5": {Team: "Core", Owner: false},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
+						"3": Reviewer{Team: "Core", Owner: false},
+						"4": Reviewer{Team: "Core", Owner: false},
+						"5": Reviewer{Team: "Core", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{
 						"3": true,
@@ -188,11 +188,11 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
-						"3": {Team: "Core", Owner: false},
-						"4": {Team: "Core", Owner: false},
-						"5": {Team: "Internal"},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
+						"3": Reviewer{Team: "Core", Owner: false},
+						"4": Reviewer{Team: "Core", Owner: false},
+						"5": Reviewer{Team: "Internal"},
 					},
 					CodeReviewersOmit: map[string]bool{},
 					// Admins.
@@ -212,15 +212,15 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
-						"3": {Team: "Core", Owner: true},
-						"4": {Team: "Core", Owner: false},
-						"5": {Team: "Core", Owner: false},
-						"6": {Team: "Core", Owner: false},
-						"7": {Team: "Internal", Owner: false},
-						"8": {Team: "Cloud", Owner: false},
-						"9": {Team: "Cloud", Owner: false},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
+						"3": Reviewer{Team: "Core", Owner: true},
+						"4": Reviewer{Team: "Core", Owner: false},
+						"5": Reviewer{Team: "Core", Owner: false},
+						"6": Reviewer{Team: "Core", Owner: false},
+						"7": Reviewer{Team: "Internal", Owner: false},
+						"8": Reviewer{Team: "Cloud", Owner: false},
+						"9": Reviewer{Team: "Cloud", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{
 						"6": true,
@@ -245,13 +245,13 @@ func TestGetCodeReviewers(t *testing.T) {
 				c: &Config{
 					// Code.
 					CodeReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
-						"3": {Team: "Core", Owner: true},
-						"4": {Team: "Core", Owner: false},
-						"5": {Team: "Core", Owner: false},
-						"6": {Team: "Core", Owner: false},
-						"7": {Team: "Internal", Owner: false},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
+						"3": Reviewer{Team: "Core", Owner: true},
+						"4": Reviewer{Team: "Core", Owner: false},
+						"5": Reviewer{Team: "Core", Owner: false},
+						"6": Reviewer{Team: "Core", Owner: false},
+						"7": Reviewer{Team: "Internal", Owner: false},
 					},
 					CodeReviewersOmit: map[string]bool{
 						"6": true,
@@ -294,8 +294,8 @@ func TestGetDocsReviewers(t *testing.T) {
 				c: &Config{
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -314,8 +314,8 @@ func TestGetDocsReviewers(t *testing.T) {
 				c: &Config{
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{
 						"2": true,
@@ -336,8 +336,8 @@ func TestGetDocsReviewers(t *testing.T) {
 				c: &Config{
 					// Docs.
 					DocsReviewers: map[string]Reviewer{
-						"1": {Team: "Core", Owner: true},
-						"2": {Team: "Core", Owner: true},
+						"1": Reviewer{Team: "Core", Owner: true},
+						"2": Reviewer{Team: "Core", Owner: true},
 					},
 					DocsReviewersOmit: map[string]bool{},
 					// Admins.
@@ -365,12 +365,12 @@ func TestCheckExternal(t *testing.T) {
 		c: &Config{
 			// Code.
 			CodeReviewers: map[string]Reviewer{
-				"1": {Team: "Core", Owner: true},
-				"2": {Team: "Core", Owner: true},
-				"3": {Team: "Core", Owner: true},
-				"4": {Team: "Core", Owner: false},
-				"5": {Team: "Core", Owner: false},
-				"6": {Team: "Core", Owner: false},
+				"1": Reviewer{Team: "Core", Owner: true},
+				"2": Reviewer{Team: "Core", Owner: true},
+				"3": Reviewer{Team: "Core", Owner: true},
+				"4": Reviewer{Team: "Core", Owner: false},
+				"5": Reviewer{Team: "Core", Owner: false},
+				"6": Reviewer{Team: "Core", Owner: false},
 			},
 			CodeReviewersOmit: map[string]bool{},
 			// Default.
@@ -383,48 +383,72 @@ func TestCheckExternal(t *testing.T) {
 	tests := []struct {
 		desc    string
 		author  string
-		reviews []github.Review
+		reviews map[string]*github.Review
 		result  bool
 	}{
 		{
 			desc:    "no-reviews-fail",
 			author:  "5",
-			reviews: []github.Review{},
+			reviews: map[string]*github.Review{},
 			result:  false,
 		},
 		{
 			desc:   "two-non-admin-reviews-fail",
 			author: "5",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "4", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{
+					Author: "3",
+					State:  approved,
+				},
+				"4": &github.Review{
+					Author: "4",
+					State:  approved,
+				},
 			},
 			result: false,
 		},
 		{
 			desc:   "one-admin-reviews-fail",
 			author: "5",
-			reviews: []github.Review{
-				{Author: "1", State: approved},
-				{Author: "4", State: approved},
+			reviews: map[string]*github.Review{
+				"1": &github.Review{
+					Author: "1",
+					State:  approved,
+				},
+				"4": &github.Review{
+					Author: "4",
+					State:  approved,
+				},
 			},
 			result: false,
 		},
 		{
 			desc:   "two-admin-reviews-one-denied-success",
 			author: "5",
-			reviews: []github.Review{
-				{Author: "1", State: changesRequested},
-				{Author: "2", State: approved},
+			reviews: map[string]*github.Review{
+				"1": &github.Review{
+					Author: "1",
+					State:  changesRequested,
+				},
+				"2": &github.Review{
+					Author: "2",
+					State:  approved,
+				},
 			},
 			result: false,
 		},
 		{
 			desc:   "two-admin-reviews-success",
 			author: "5",
-			reviews: []github.Review{
-				{Author: "1", State: approved},
-				{Author: "2", State: approved},
+			reviews: map[string]*github.Review{
+				"1": &github.Review{
+					Author: "1",
+					State:  approved,
+				},
+				"2": &github.Review{
+					Author: "2",
+					State:  approved,
+				},
 			},
 			result: true,
 		},
@@ -447,21 +471,21 @@ func TestCheckInternal(t *testing.T) {
 		c: &Config{
 			// Code.
 			CodeReviewers: map[string]Reviewer{
-				"1":  {Team: "Core", Owner: true},
-				"2":  {Team: "Core", Owner: true},
-				"3":  {Team: "Core", Owner: true},
-				"9":  {Team: "Core", Owner: true},
-				"4":  {Team: "Core", Owner: false},
-				"5":  {Team: "Core", Owner: false},
-				"6":  {Team: "Core", Owner: false},
-				"8":  {Team: "Internal", Owner: false},
-				"10": {Team: "Cloud", Owner: false},
-				"11": {Team: "Cloud", Owner: false},
-				"12": {Team: "Cloud", Owner: false},
+				"1":  Reviewer{Team: "Core", Owner: true},
+				"2":  Reviewer{Team: "Core", Owner: true},
+				"3":  Reviewer{Team: "Core", Owner: true},
+				"9":  Reviewer{Team: "Core", Owner: true},
+				"4":  Reviewer{Team: "Core", Owner: false},
+				"5":  Reviewer{Team: "Core", Owner: false},
+				"6":  Reviewer{Team: "Core", Owner: false},
+				"8":  Reviewer{Team: "Internal", Owner: false},
+				"10": Reviewer{Team: "Cloud", Owner: false},
+				"11": Reviewer{Team: "Cloud", Owner: false},
+				"12": Reviewer{Team: "Cloud", Owner: false},
 			},
 			// Docs.
 			DocsReviewers: map[string]Reviewer{
-				"7": {Team: "Core", Owner: true},
+				"7": Reviewer{Team: "Core", Owner: true},
 			},
 			DocsReviewersOmit: map[string]bool{},
 			CodeReviewersOmit: map[string]bool{},
@@ -475,7 +499,7 @@ func TestCheckInternal(t *testing.T) {
 	tests := []struct {
 		desc    string
 		author  string
-		reviews []github.Review
+		reviews map[string]*github.Review
 		docs    bool
 		code    bool
 		result  bool
@@ -483,13 +507,13 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:    "no-reviews-fail",
 			author:  "4",
-			reviews: []github.Review{},
+			reviews: map[string]*github.Review{},
 			result:  false,
 		},
 		{
 			desc:    "docs-only-no-reviews-fail",
 			author:  "4",
-			reviews: []github.Review{},
+			reviews: map[string]*github.Review{},
 			docs:    true,
 			code:    false,
 			result:  false,
@@ -497,8 +521,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-only-non-docs-approval-fail",
 			author: "4",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
 			},
 			docs:   true,
 			code:   false,
@@ -507,8 +531,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-only-docs-approval-success",
 			author: "4",
-			reviews: []github.Review{
-				{Author: "7", State: approved},
+			reviews: map[string]*github.Review{
+				"7": &github.Review{Author: "7", State: approved},
 			},
 			docs:   true,
 			code:   false,
@@ -517,7 +541,7 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:    "code-only-no-reviews-fail",
 			author:  "4",
-			reviews: []github.Review{},
+			reviews: map[string]*github.Review{},
 			docs:    false,
 			code:    true,
 			result:  false,
@@ -525,8 +549,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-one-approval-fail",
 			author: "4",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -535,9 +559,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-two-approval-setb-fail",
 			author: "4",
-			reviews: []github.Review{
-				{Author: "5", State: approved},
-				{Author: "6", State: approved},
+			reviews: map[string]*github.Review{
+				"5": &github.Review{Author: "5", State: approved},
+				"6": &github.Review{Author: "6", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -546,9 +570,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-one-changes-fail",
 			author: "4",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "4", State: changesRequested},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
+				"4": &github.Review{Author: "4", State: changesRequested},
 			},
 			docs:   false,
 			code:   true,
@@ -557,9 +581,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-two-approvals-success",
 			author: "6",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "4", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
+				"4": &github.Review{Author: "4", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -568,8 +592,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-and-code-only-docs-approval-fail",
 			author: "6",
-			reviews: []github.Review{
-				{Author: "7", State: approved},
+			reviews: map[string]*github.Review{
+				"7": &github.Review{Author: "7", State: approved},
 			},
 			docs:   true,
 			code:   true,
@@ -578,9 +602,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-and-code-only-code-approval-fail",
 			author: "6",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "4", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
+				"4": &github.Review{Author: "4", State: approved},
 			},
 			docs:   true,
 			code:   true,
@@ -589,10 +613,10 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "docs-and-code-docs-and-code-approval-success",
 			author: "6",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "4", State: approved},
-				{Author: "7", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
+				"4": &github.Review{Author: "4", State: approved},
+				"7": &github.Review{Author: "7", State: approved},
 			},
 			docs:   true,
 			code:   true,
@@ -601,8 +625,8 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-internal-on-approval-failure",
 			author: "8",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -611,9 +635,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-internal-code-approval-success",
 			author: "8",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "4", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
+				"4": &github.Review{Author: "4", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -622,33 +646,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "code-only-internal-two-code-owner-approval-success",
 			author: "4",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "9", State: approved},
-			},
-			docs:   false,
-			code:   true,
-			result: true,
-		},
-		{
-			desc:   "code-only-changes-requested-after-approval-failure",
-			author: "4",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "9", State: approved},
-				{Author: "9", State: changesRequested},
-			},
-			docs:   false,
-			code:   true,
-			result: false,
-		},
-		{
-			desc:   "code-only-comment-after-approval-success",
-			author: "4",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "9", State: approved},
-				{Author: "9", State: commented},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
+				"9": &github.Review{Author: "9", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -657,9 +657,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "cloud-with-self-approval-failure",
 			author: "10",
-			reviews: []github.Review{
-				{Author: "11", State: approved},
-				{Author: "12", State: approved},
+			reviews: map[string]*github.Review{
+				"11": &github.Review{Author: "11", State: approved},
+				"12": &github.Review{Author: "12", State: approved},
 			},
 			docs:   false,
 			code:   true,
@@ -668,9 +668,9 @@ func TestCheckInternal(t *testing.T) {
 		{
 			desc:   "cloud-with-core-approval-success",
 			author: "10",
-			reviews: []github.Review{
-				{Author: "3", State: approved},
-				{Author: "9", State: approved},
+			reviews: map[string]*github.Review{
+				"3": &github.Review{Author: "3", State: approved},
+				"9": &github.Review{Author: "9", State: approved},
 			},
 			docs:   false,
 			code:   true,
diff --git a/.golangci.yml b/.golangci.yml
index 89ff401c285d6..3d28c3459114b 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -15,7 +15,6 @@ linters:
   enable:
     - bodyclose
     - deadcode
-    - depguard
     - goimports
     - gosimple
     - govet
@@ -29,13 +28,6 @@ linters:
     - unconvert
     - varcheck
 
-linters-settings:
-  depguard:
-    list-type: denylist
-    include-go-root: true # check against stdlib
-    packages-with-error-message:
-    - io/ioutil: 'use "io" or "os" packages instead'
-
 output:
   uniq-by-line: false
 
diff --git a/Cargo.lock b/Cargo.lock
index e4035cdf0adc3..0edacf469da90 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.55"
+version = "1.0.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "159bb86af3a200e19a068f4224eae4c8bb2d0fa054c7e5d1cacd5cef95e684cd"
+checksum = "94a45b455c14666b85fc40a019e8ab9eb75e3a124e05494f5397122bc9eb06e0"
 
 [[package]]
 name = "arrayvec"
@@ -176,9 +176,9 @@ dependencies = [
 
 [[package]]
 name = "crepe"
-version = "0.1.6"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d0c81f0055a7c877a9a69ec9d667a0b14c2b38394c712f54b9a400d035f49a9"
+checksum = "a143ee68e4ec17aa70d0b95a1a5ef2c4e510b79cc3d956ea51bd2fe56d1856bd"
 dependencies = [
  "petgraph",
  "proc-macro-error",
@@ -1176,9 +1176,9 @@ checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.9.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8820f5d777f6224dc4be3632222971ac30164d4a258d595640799554ebfd99"
+checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
 
 [[package]]
 name = "unicode-xid"
diff --git a/Makefile b/Makefile
index f8d46f2c275ad..399933fdf75c0 100644
--- a/Makefile
+++ b/Makefile
@@ -462,7 +462,7 @@ $(RENDER_TESTS): $(wildcard $(TOOLINGDIR)/cmd/render-tests/*.go)
 # Runs all Go/shell tests, called by CI/CD.
 #
 .PHONY: test
-test: test-helm test-sh test-ci test-api test-go test-rust
+test: test-sh test-ci test-api test-go test-rust
 
 # Runs bot Go tests.
 #
@@ -475,19 +475,6 @@ test-bot:
 $(TEST_LOG_DIR):
 	mkdir $(TEST_LOG_DIR)
 
-# Google Cloud Build uses a weird homedir and Helm can't pick up plugins by default there,
-# so override the plugin location via environment variable when running in CI.
-.PHONY: test-helm
-test-helm:
-	@if [ -d /builder/home ]; then export HELM_PLUGINS=/root/.local/share/helm/plugins; fi; \
-		helm unittest examples/chart/teleport-cluster && \
-		helm unittest examples/chart/teleport-kube-agent
-
-.PHONY: test-helm-update-snapshots
-test-helm-update-snapshots:
-	helm unittest -u examples/chart/teleport-cluster
-	helm unittest -u examples/chart/teleport-kube-agent
-
 #
 # Runs all Go tests except integration, called by CI/CD.
 # Chaos tests have high concurrency, run without race detector and have TestChaos prefix.
diff --git a/README.md b/README.md
index adf743dfc2fd0..99c7386576e91 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@
 1. [Installing and Running](#installing-and-running)
 1. [Docker](#docker)
 1. [Building Teleport](#building-teleport)
-1. [Why Did We Build Teleport?](#why-did-we-build-teleport)
+1. [Why did We Build Teleport?](#why-did-we-build-teleport)
 1. [More Information](#more-information)
 1. [Support and Contributing](#support-and-contributing)
 1. [Is Teleport Secure and Production Ready?](#is-teleport-secure-and-production-ready)
diff --git a/api/client/client.go b/api/client/client.go
index e936e8887abc4..b9fee45872518 100644
--- a/api/client/client.go
+++ b/api/client/client.go
@@ -877,14 +877,9 @@ func (c *Client) UpsertKubeServiceV2(ctx context.Context, s types.Server) (*type
 // GetKubeServices returns the list of kubernetes services registered in the
 // cluster.
 func (c *Client) GetKubeServices(ctx context.Context) ([]types.Server, error) {
-	resources, err := GetResourcesWithFilters(ctx, c, proto.ListResourcesRequest{
-		Namespace:    defaults.Namespace,
-		ResourceType: types.KindKubeService,
-	})
+	resources, err := c.GetResources(ctx, defaults.Namespace, types.KindKubeService)
 	if err != nil {
-		// Underlying ListResources for kube service was not available, use fallback.
-		//
-		// DELETE IN 11.0.0
+		// DELETE IN 10.0
 		if trace.IsNotImplemented(err) {
 			return c.getKubeServicesFallback(ctx)
 		}
@@ -892,9 +887,14 @@ func (c *Client) GetKubeServices(ctx context.Context) ([]types.Server, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	servers, err := types.ResourcesWithLabels(resources).AsServers()
-	if err != nil {
-		return nil, trace.Wrap(err)
+	servers := make([]types.Server, len(resources))
+	for i, resource := range resources {
+		srv, ok := resource.(types.Server)
+		if !ok {
+			return nil, trace.BadParameter("expected Server resource, got %T", resource)
+		}
+
+		servers[i] = srv
 	}
 
 	return servers, nil
@@ -919,14 +919,8 @@ func (c *Client) getKubeServicesFallback(ctx context.Context) ([]types.Server, e
 
 // GetApplicationServers returns all registered application servers.
 func (c *Client) GetApplicationServers(ctx context.Context, namespace string) ([]types.AppServer, error) {
-	resources, err := GetResourcesWithFilters(ctx, c, proto.ListResourcesRequest{
-		Namespace:    namespace,
-		ResourceType: types.KindAppServer,
-	})
+	resources, err := c.GetResources(ctx, namespace, types.KindAppServer)
 	if err != nil {
-		// Underlying ListResources for app server was not available, use fallback.
-		//
-		// DELETE IN 11.0.0
 		if trace.IsNotImplemented(err) {
 			servers, err := c.getApplicationServersFallback(ctx, namespace)
 			if err != nil {
@@ -939,9 +933,14 @@ func (c *Client) GetApplicationServers(ctx context.Context, namespace string) ([
 		return nil, trace.Wrap(err)
 	}
 
-	servers, err := types.ResourcesWithLabels(resources).AsAppServers()
-	if err != nil {
-		return nil, trace.Wrap(err)
+	servers := make([]types.AppServer, len(resources))
+	for i, resource := range resources {
+		appServer, ok := resource.(types.AppServer)
+		if !ok {
+			return nil, trace.BadParameter("expected AppServer resource, got %T", resource)
+		}
+
+		servers[i] = appServer
 	}
 
 	// In addition, we need to fetch legacy application servers.
@@ -1179,14 +1178,8 @@ func (c *Client) DeleteAllKubeServices(ctx context.Context) error {
 
 // GetDatabaseServers returns all registered database proxy servers.
 func (c *Client) GetDatabaseServers(ctx context.Context, namespace string) ([]types.DatabaseServer, error) {
-	resources, err := GetResourcesWithFilters(ctx, c, proto.ListResourcesRequest{
-		Namespace:    namespace,
-		ResourceType: types.KindDatabaseServer,
-	})
+	resources, err := c.GetResources(ctx, namespace, types.KindDatabaseServer)
 	if err != nil {
-		// Underlying ListResources for db server was not available, use fallback.
-		//
-		// DELETE IN 11.0.0
 		if trace.IsNotImplemented(err) {
 			servers, err := c.getDatabaseServersFallback(ctx, namespace)
 			if err != nil {
@@ -1199,9 +1192,14 @@ func (c *Client) GetDatabaseServers(ctx context.Context, namespace string) ([]ty
 		return nil, trace.Wrap(err)
 	}
 
-	servers, err := types.ResourcesWithLabels(resources).AsDatabaseServers()
-	if err != nil {
-		return nil, trace.Wrap(err)
+	servers := make([]types.DatabaseServer, len(resources))
+	for i, resource := range resources {
+		databaseServer, ok := resource.(types.DatabaseServer)
+		if !ok {
+			return nil, trace.BadParameter("expected DatabaseServer resource, got %T", resource)
+		}
+
+		servers[i] = databaseServer
 	}
 
 	return servers, nil
@@ -1626,46 +1624,17 @@ func (c *Client) GetNode(ctx context.Context, namespace, name string) (types.Ser
 
 // GetNodes returns a complete list of nodes that the user has access to in the given namespace.
 func (c *Client) GetNodes(ctx context.Context, namespace string) ([]types.Server, error) {
-	resources, err := GetResourcesWithFilters(ctx, c, proto.ListResourcesRequest{
-		ResourceType: types.KindNode,
-		Namespace:    namespace,
-	})
-	if err != nil {
-		// Underlying ListResources for nodes was not available, use fallback.
-		//
-		// DELETE IN 11.0.0
-		if trace.IsNotImplemented(err) {
-			servers, err := GetNodesWithLabels(ctx, c, namespace, nil)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			return servers, nil
-		}
-
-		return nil, trace.Wrap(err)
-	}
-
-	servers, err := types.ResourcesWithLabels(resources).AsServers()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return servers, nil
+	return GetNodesWithLabels(ctx, c, namespace, nil)
 }
 
 // NodeClient is an interface used by GetNodesWithLabels to abstract over implementations of
 // the ListNodes method.
-//
-// DELETE IN 11.0.0 with GetNodesWithLabels (used in both api/client/client.go and lib/auth/httpfallback.go)
-// replaced by ListResourcesClient
 type NodeClient interface {
 	ListNodes(ctx context.Context, req proto.ListNodesRequest) (nodes []types.Server, nextKey string, err error)
 }
 
 // GetNodesWithLabels is a helper for getting a list of nodes with optional label-based filtering.  In addition to
 // iterating pages, it also correctly handles downsizing pages when LimitExceeded errors are encountered.
-//
-// DELETE IN 11.0.0 replaced by GetResourcesWithFilters.
 func GetNodesWithLabels(ctx context.Context, clt NodeClient, namespace string, labels map[string]string) ([]types.Server, error) {
 	// Retrieve the complete list of nodes in chunks.
 	var (
@@ -2440,10 +2409,6 @@ func (c *Client) ListResources(ctx context.Context, req proto.ListResourcesReque
 			resources[i] = respResource.GetNode()
 		case types.KindKubeService:
 			resources[i] = respResource.GetKubeService()
-		case types.KindWindowsDesktop:
-			resources[i] = respResource.GetWindowsDesktop()
-		case types.KindKubernetesCluster:
-			resources[i] = respResource.GetKubeCluster()
 		default:
 			return nil, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
 		}
@@ -2456,16 +2421,9 @@ func (c *Client) ListResources(ctx context.Context, req proto.ListResourcesReque
 	}, nil
 }
 
-// ListResourcesClient is an interface used by GetResourcesWithFilters to abstract over implementations of
-// the ListResources method.
-type ListResourcesClient interface {
-	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
-}
-
-// GetResourcesWithFilters is a helper for getting a list of resources with optional filtering. In addition to
-// iterating pages, it also correctly handles downsizing pages when LimitExceeded errors are encountered.
-func GetResourcesWithFilters(ctx context.Context, clt ListResourcesClient, req proto.ListResourcesRequest) ([]types.ResourceWithLabels, error) {
-	// Retrieve the complete list of resources in chunks.
+// GetResources retrieves all pages from ListResourcesPage and return all
+// resources.
+func (c *Client) GetResources(ctx context.Context, namespace, resourceType string) ([]types.ResourceWithLabels, error) {
 	var (
 		resources []types.ResourceWithLabels
 		startKey  string
@@ -2473,20 +2431,15 @@ func GetResourcesWithFilters(ctx context.Context, clt ListResourcesClient, req p
 	)
 
 	for {
-		resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
-			Namespace:           req.Namespace,
-			ResourceType:        req.ResourceType,
-			StartKey:            startKey,
-			Limit:               chunkSize,
-			Labels:              req.Labels,
-			SearchKeywords:      req.SearchKeywords,
-			PredicateExpression: req.PredicateExpression,
+		resp, err := c.ListResources(ctx, proto.ListResourcesRequest{
+			Namespace:    namespace,
+			ResourceType: resourceType,
+			StartKey:     startKey,
+			Limit:        chunkSize,
 		})
 		if err != nil {
 			if trace.IsLimitExceeded(err) {
-				// Cut chunkSize in half if gRPC max message size is exceeded.
 				chunkSize = chunkSize / 2
-				// This is an extremely unlikely scenario, but better to cover it anyways.
 				if chunkSize == 0 {
 					return nil, trace.Wrap(trail.FromGRPC(err), "resource is too large to retrieve")
 				}
diff --git a/api/client/client_test.go b/api/client/client_test.go
index 58855bd74688f..5b67271ff7238 100644
--- a/api/client/client_test.go
+++ b/api/client/client_test.go
@@ -121,13 +121,6 @@ func (m *mockServer) ListResources(ctx context.Context, req *proto.ListResources
 			}
 
 			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_KubeService{KubeService: srv}}
-		case types.KindWindowsDesktop:
-			desktop, ok := resource.(*types.WindowsDesktopV3)
-			if !ok {
-				return nil, trace.Errorf("windows desktop has invalid type %T", resource)
-			}
-
-			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_WindowsDesktop{WindowsDesktop: desktop}}
 		}
 
 		resp.Resources = append(resp.Resources, protoResource)
@@ -233,21 +226,6 @@ func testResources(resourceType, namespace string) ([]types.ResourceWithLabels,
 				return nil, trace.Wrap(err)
 			}
 		}
-	case types.KindWindowsDesktop:
-		for i := 0; i < size; i++ {
-			var err error
-			name := fmt.Sprintf("windows-desktop-%d", i)
-			resources[i], err = types.NewWindowsDesktopV3(
-				name,
-				map[string]string{"label": string(make([]byte, labelSize))},
-				types.WindowsDesktopSpecV3{
-					Addr:   "_",
-					HostID: "_",
-				})
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-		}
 
 	default:
 		return nil, trace.Errorf("unsupported resource type %s", resourceType)
@@ -501,10 +479,6 @@ func TestListResources(t *testing.T) {
 			resourceType:   types.KindKubeService,
 			resourceStruct: &types.ServerV2{},
 		},
-		"WindowsDesktop": {
-			resourceType:   types.KindWindowsDesktop,
-			resourceStruct: &types.WindowsDesktopV3{},
-		},
 	}
 
 	// Create client
@@ -584,9 +558,6 @@ func TestGetResources(t *testing.T) {
 		"KubeService": {
 			resourceType: types.KindKubeService,
 		},
-		"WindowsDesktop": {
-			resourceType: types.KindWindowsDesktop,
-		},
 	}
 
 	for name, test := range testCases {
@@ -594,7 +565,7 @@ func TestGetResources(t *testing.T) {
 			expectedResources, err := testResources(test.resourceType, defaults.Namespace)
 			require.NoError(t, err)
 
-			// Test listing everything at once errors with limit exceeded.
+			// listing everything at once breaks the ListResource.
 			_, err = clt.ListResources(ctx, proto.ListResourcesRequest{
 				Namespace:    defaults.Namespace,
 				Limit:        int32(len(expectedResources)),
@@ -603,11 +574,7 @@ func TestGetResources(t *testing.T) {
 			require.Error(t, err)
 			require.IsType(t, &trace.LimitExceededError{}, err.(*trace.TraceErr).OrigError())
 
-			// Test getting all resources by chunks to handle limit exceeded.
-			resources, err := GetResourcesWithFilters(ctx, clt, proto.ListResourcesRequest{
-				Namespace:    defaults.Namespace,
-				ResourceType: test.resourceType,
-			})
+			resources, err := clt.GetResources(ctx, defaults.Namespace, test.resourceType)
 			require.NoError(t, err)
 			require.Len(t, resources, len(expectedResources))
 			require.Empty(t, cmp.Diff(expectedResources, resources))
diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 1710672b941d1..a8396165aa173 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -45,8 +45,8 @@ func (f ContextDialerFunc) DialContext(ctx context.Context, network, addr string
 	return f(ctx, network, addr)
 }
 
-// newDirectDialer makes a new dialer to connect directly to an Auth server.
-func newDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
+// NewDirectDialer makes a new dialer to connect directly to an Auth server.
+func NewDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	return &net.Dialer{
 		Timeout:   dialTimeout,
 		KeepAlive: keepAlivePeriod,
@@ -56,8 +56,8 @@ func newDirectDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 // NewDialer makes a new dialer that connects to an Auth server either directly or via an HTTP proxy, depending
 // on the environment.
 func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
+	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (net.Conn, error) {
-		dialer := newDirectDialer(keepAlivePeriod, dialTimeout)
 		if proxyAddr := proxy.GetProxyAddress(addr); proxyAddr != nil {
 			return DialProxyWithDialer(ctx, proxyAddr, addr, dialer)
 		}
@@ -70,8 +70,7 @@ func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 func NewProxyDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration, discoveryAddr string, insecure bool) ContextDialer {
 	dialer := newTunnelDialer(ssh, keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, _ string) (conn net.Conn, err error) {
-		tunnelAddr, err := webclient.GetTunnelAddr(
-			&webclient.Config{Context: ctx, ProxyAddr: discoveryAddr, Insecure: insecure})
+		tunnelAddr, err := webclient.GetTunnelAddr(ctx, discoveryAddr, insecure, nil)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -86,7 +85,7 @@ func NewProxyDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Dura
 
 // newTunnelDialer makes a dialer to connect to an Auth server through the SSH reverse tunnel on the proxy.
 func newTunnelDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
-	dialer := newDirectDialer(keepAlivePeriod, dialTimeout)
+	dialer := NewDirectDialer(keepAlivePeriod, dialTimeout)
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (conn net.Conn, err error) {
 		conn, err = dialer.DialContext(ctx, network, addr)
 		if err != nil {
@@ -105,8 +104,7 @@ func newTunnelDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Dur
 // through the SSH reverse tunnel on the proxy.
 func newTLSRoutingTunnelDialer(ssh ssh.ClientConfig, keepAlivePeriod, dialTimeout time.Duration, discoveryAddr string, insecure bool) ContextDialer {
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (conn net.Conn, err error) {
-		tunnelAddr, err := webclient.GetTunnelAddr(
-			&webclient.Config{Context: ctx, ProxyAddr: discoveryAddr, Insecure: insecure})
+		tunnelAddr, err := webclient.GetTunnelAddr(ctx, discoveryAddr, insecure, nil)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/api/client/credentials.go b/api/client/credentials.go
index c2660c0e181c6..2b4e13312d03a 100644
--- a/api/client/credentials.go
+++ b/api/client/credentials.go
@@ -19,7 +19,7 @@ package client
 import (
 	"crypto/tls"
 	"crypto/x509"
-	"os"
+	"io/ioutil"
 
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/identityfile"
@@ -115,7 +115,7 @@ func (c *keypairCreds) TLSConfig() (*tls.Config, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	cas, err := os.ReadFile(c.caFile)
+	cas, err := ioutil.ReadFile(c.caFile)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
diff --git a/api/client/credentials_test.go b/api/client/credentials_test.go
index 7985d9a4b4a5a..faa09c4245d6f 100644
--- a/api/client/credentials_test.go
+++ b/api/client/credentials_test.go
@@ -19,6 +19,7 @@ package client
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -152,11 +153,11 @@ func TestLoadKeyPair(t *testing.T) {
 	// Write key pair and CAs files from bytes.
 	path := t.TempDir() + "username"
 	certPath, keyPath, caPath := path+".crt", path+".key", path+".cas"
-	err := os.WriteFile(certPath, tlsCert, 0600)
+	err := ioutil.WriteFile(certPath, tlsCert, 0600)
 	require.NoError(t, err)
-	err = os.WriteFile(keyPath, keyPEM, 0600)
+	err = ioutil.WriteFile(keyPath, keyPEM, 0600)
 	require.NoError(t, err)
-	err = os.WriteFile(caPath, tlsCACert, 0600)
+	err = ioutil.WriteFile(caPath, tlsCACert, 0600)
 	require.NoError(t, err)
 
 	// Load key pair from disk.
@@ -184,7 +185,20 @@ func TestLoadProfile(t *testing.T) {
 			SiteName:     "example.com",
 			Username:     "testUser",
 			Dir:          dir,
-		})
+		}, false)
+		testProfileContents(t, dir, profileName)
+	})
+
+	// DELETE IN 8.0.0
+	t.Run("old profile", func(t *testing.T) {
+		t.Parallel()
+		dir := t.TempDir()
+		writeProfile(t, &profile.Profile{
+			WebProxyAddr: profileName + ":3080",
+			SiteName:     "example.com",
+			Username:     "testUser",
+			Dir:          dir,
+		}, true)
 		testProfileContents(t, dir, profileName)
 	})
 
@@ -222,18 +236,24 @@ func testProfileContents(t *testing.T, dir, name string) {
 	require.NoError(t, err)
 }
 
-func writeProfile(t *testing.T, p *profile.Profile) {
+func writeProfile(t *testing.T, p *profile.Profile, oldSSHPath bool) {
 	// Save profile and keys to disk.
 	require.NoError(t, p.SaveToDir(p.Dir, true))
 	require.NoError(t, os.MkdirAll(p.KeyDir(), 0700))
 	require.NoError(t, os.MkdirAll(p.ProxyKeyDir(), 0700))
 	require.NoError(t, os.MkdirAll(p.TLSClusterCASDir(), 0700))
-	require.NoError(t, os.WriteFile(p.UserKeyPath(), keyPEM, 0600))
-	require.NoError(t, os.WriteFile(p.TLSCertPath(), tlsCert, 0600))
-	require.NoError(t, os.WriteFile(p.TLSCAPathCluster(p.SiteName), tlsCACert, 0600))
-	require.NoError(t, os.WriteFile(p.KnownHostsPath(), sshCACert, 0600))
+	require.NoError(t, ioutil.WriteFile(p.UserKeyPath(), keyPEM, 0600))
+	require.NoError(t, ioutil.WriteFile(p.TLSCertPath(), tlsCert, 0600))
+	require.NoError(t, ioutil.WriteFile(p.TLSCAPathCluster(p.SiteName), tlsCACert, 0600))
+	require.NoError(t, ioutil.WriteFile(p.KnownHostsPath(), sshCACert, 0600))
+	// If oldSSHPath is specified, write the sshCert to the old ssh cert path.
+	// DELETE IN 8.0.0
+	if oldSSHPath {
+		require.NoError(t, ioutil.WriteFile(p.OldSSHCertPath(), sshCert, 0600))
+		return
+	}
 	require.NoError(t, os.MkdirAll(p.SSHDir(), 0700))
-	require.NoError(t, os.WriteFile(p.SSHCertPath(), sshCert, 0600))
+	require.NoError(t, ioutil.WriteFile(p.SSHCertPath(), sshCert, 0600))
 }
 
 func getExpectedTLSConfig(t *testing.T) *tls.Config {
diff --git a/api/client/proto/authservice.pb.go b/api/client/proto/authservice.pb.go
index abeac68187fcd..5ae16cf258b81 100644
--- a/api/client/proto/authservice.pb.go
+++ b/api/client/proto/authservice.pb.go
@@ -105,39 +105,6 @@ func (DeviceType) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptor_ce8bd90b12161215, []int{1}
 }
 
-type DeviceUsage int32
-
-const (
-	DeviceUsage_DEVICE_USAGE_UNSPECIFIED DeviceUsage = 0
-	// Device intended for MFA use, but not for passwordless.
-	// Allows both FIDO and FIDO2 devices.
-	// Resident keys not required.
-	DeviceUsage_DEVICE_USAGE_MFA DeviceUsage = 1
-	// Device intended for both MFA and passwordless.
-	// Requires a FIDO2 device and takes a resident key slot.
-	DeviceUsage_DEVICE_USAGE_PASSWORDLESS DeviceUsage = 2
-)
-
-var DeviceUsage_name = map[int32]string{
-	0: "DEVICE_USAGE_UNSPECIFIED",
-	1: "DEVICE_USAGE_MFA",
-	2: "DEVICE_USAGE_PASSWORDLESS",
-}
-
-var DeviceUsage_value = map[string]int32{
-	"DEVICE_USAGE_UNSPECIFIED":  0,
-	"DEVICE_USAGE_MFA":          1,
-	"DEVICE_USAGE_PASSWORDLESS": 2,
-}
-
-func (x DeviceUsage) String() string {
-	return proto.EnumName(DeviceUsage_name, int32(x))
-}
-
-func (DeviceUsage) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{2}
-}
-
 // Order specifies any ordering of some objects as returned in regards to some aspect
 // of said objects which may be trivially ordered such as a timestamp.
 type Order int32
@@ -162,7 +129,7 @@ func (x Order) String() string {
 }
 
 func (Order) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{3}
+	return fileDescriptor_ce8bd90b12161215, []int{2}
 }
 
 type UserCertsRequest_CertUsage int32
@@ -5727,14 +5694,11 @@ func (*AddMFADeviceResponse) XXX_OneofWrappers() []interface{} {
 
 // AddMFADeviceRequestInit describes the new MFA device.
 type AddMFADeviceRequestInit struct {
-	DeviceName string     `protobuf:"bytes,1,opt,name=DeviceName,proto3" json:"DeviceName,omitempty"`
-	DeviceType DeviceType `protobuf:"varint,3,opt,name=DeviceType,proto3,enum=proto.DeviceType" json:"DeviceType,omitempty"`
-	// DeviceUsage is the requested usage for the device.
-	// Defaults to DEVICE_USAGE_MFA.
-	DeviceUsage          DeviceUsage `protobuf:"varint,4,opt,name=DeviceUsage,proto3,enum=proto.DeviceUsage" json:"device_usage,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
-	XXX_unrecognized     []byte      `json:"-"`
-	XXX_sizecache        int32       `json:"-"`
+	DeviceName           string     `protobuf:"bytes,1,opt,name=DeviceName,proto3" json:"DeviceName,omitempty"`
+	DeviceType           DeviceType `protobuf:"varint,3,opt,name=DeviceType,proto3,enum=proto.DeviceType" json:"DeviceType,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
+	XXX_unrecognized     []byte     `json:"-"`
+	XXX_sizecache        int32      `json:"-"`
 }
 
 func (m *AddMFADeviceRequestInit) Reset()         { *m = AddMFADeviceRequestInit{} }
@@ -5784,13 +5748,6 @@ func (m *AddMFADeviceRequestInit) GetDeviceType() DeviceType {
 	return DeviceType_DEVICE_TYPE_UNSPECIFIED
 }
 
-func (m *AddMFADeviceRequestInit) GetDeviceUsage() DeviceUsage {
-	if m != nil {
-		return m.DeviceUsage
-	}
-	return DeviceUsage_DEVICE_USAGE_UNSPECIFIED
-}
-
 // AddMFADeviceResponseAck is a confirmation of successful device registration.
 type AddMFADeviceResponseAck struct {
 	Device               *types.MFADevice `protobuf:"bytes,1,opt,name=Device,proto3" json:"Device,omitempty"`
@@ -8804,97 +8761,16 @@ func (m *UserCredentials) GetPassword() []byte {
 	return nil
 }
 
-// ContextUser marks requests that rely in the currently authenticated user.
-type ContextUser struct {
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *ContextUser) Reset()         { *m = ContextUser{} }
-func (m *ContextUser) String() string { return proto.CompactTextString(m) }
-func (*ContextUser) ProtoMessage()    {}
-func (*ContextUser) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{130}
-}
-func (m *ContextUser) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *ContextUser) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_ContextUser.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *ContextUser) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_ContextUser.Merge(m, src)
-}
-func (m *ContextUser) XXX_Size() int {
-	return m.Size()
-}
-func (m *ContextUser) XXX_DiscardUnknown() {
-	xxx_messageInfo_ContextUser.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_ContextUser proto.InternalMessageInfo
-
-// Passwordless marks requests for passwordless challenges.
-type Passwordless struct {
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *Passwordless) Reset()         { *m = Passwordless{} }
-func (m *Passwordless) String() string { return proto.CompactTextString(m) }
-func (*Passwordless) ProtoMessage()    {}
-func (*Passwordless) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{131}
-}
-func (m *Passwordless) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *Passwordless) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Passwordless.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *Passwordless) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Passwordless.Merge(m, src)
-}
-func (m *Passwordless) XXX_Size() int {
-	return m.Size()
-}
-func (m *Passwordless) XXX_DiscardUnknown() {
-	xxx_messageInfo_Passwordless.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Passwordless proto.InternalMessageInfo
-
 // CreateAuthenticateChallengeRequest is a request for creating MFA authentication challenges for a
 // users mfa devices.
 type CreateAuthenticateChallengeRequest struct {
 	// Request defines how the request will be verified before creating challenges.
-	// An empty Request is equivalent to context_user being set.
+	// This field can be empty, which implies the request is to create challenges for the
+	// user in context (logged in user).
 	//
 	// Types that are valid to be assigned to Request:
 	//	*CreateAuthenticateChallengeRequest_UserCredentials
 	//	*CreateAuthenticateChallengeRequest_RecoveryStartTokenID
-	//	*CreateAuthenticateChallengeRequest_ContextUser
-	//	*CreateAuthenticateChallengeRequest_Passwordless
 	Request              isCreateAuthenticateChallengeRequest_Request `protobuf_oneof:"Request"`
 	XXX_NoUnkeyedLiteral struct{}                                     `json:"-"`
 	XXX_unrecognized     []byte                                       `json:"-"`
@@ -8905,7 +8781,7 @@ func (m *CreateAuthenticateChallengeRequest) Reset()         { *m = CreateAuthen
 func (m *CreateAuthenticateChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateAuthenticateChallengeRequest) ProtoMessage()    {}
 func (*CreateAuthenticateChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{132}
+	return fileDescriptor_ce8bd90b12161215, []int{130}
 }
 func (m *CreateAuthenticateChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -8946,21 +8822,11 @@ type CreateAuthenticateChallengeRequest_UserCredentials struct {
 type CreateAuthenticateChallengeRequest_RecoveryStartTokenID struct {
 	RecoveryStartTokenID string `protobuf:"bytes,2,opt,name=RecoveryStartTokenID,proto3,oneof" json:"recovery_start_token_id,omitempty"`
 }
-type CreateAuthenticateChallengeRequest_ContextUser struct {
-	ContextUser *ContextUser `protobuf:"bytes,3,opt,name=ContextUser,proto3,oneof" json:"context_user,omitempty"`
-}
-type CreateAuthenticateChallengeRequest_Passwordless struct {
-	Passwordless *Passwordless `protobuf:"bytes,4,opt,name=Passwordless,proto3,oneof" json:"passwordless,omitempty"`
-}
 
 func (*CreateAuthenticateChallengeRequest_UserCredentials) isCreateAuthenticateChallengeRequest_Request() {
 }
 func (*CreateAuthenticateChallengeRequest_RecoveryStartTokenID) isCreateAuthenticateChallengeRequest_Request() {
 }
-func (*CreateAuthenticateChallengeRequest_ContextUser) isCreateAuthenticateChallengeRequest_Request() {
-}
-func (*CreateAuthenticateChallengeRequest_Passwordless) isCreateAuthenticateChallengeRequest_Request() {
-}
 
 func (m *CreateAuthenticateChallengeRequest) GetRequest() isCreateAuthenticateChallengeRequest_Request {
 	if m != nil {
@@ -8983,27 +8849,11 @@ func (m *CreateAuthenticateChallengeRequest) GetRecoveryStartTokenID() string {
 	return ""
 }
 
-func (m *CreateAuthenticateChallengeRequest) GetContextUser() *ContextUser {
-	if x, ok := m.GetRequest().(*CreateAuthenticateChallengeRequest_ContextUser); ok {
-		return x.ContextUser
-	}
-	return nil
-}
-
-func (m *CreateAuthenticateChallengeRequest) GetPasswordless() *Passwordless {
-	if x, ok := m.GetRequest().(*CreateAuthenticateChallengeRequest_Passwordless); ok {
-		return x.Passwordless
-	}
-	return nil
-}
-
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*CreateAuthenticateChallengeRequest) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
 		(*CreateAuthenticateChallengeRequest_UserCredentials)(nil),
 		(*CreateAuthenticateChallengeRequest_RecoveryStartTokenID)(nil),
-		(*CreateAuthenticateChallengeRequest_ContextUser)(nil),
-		(*CreateAuthenticateChallengeRequest_Passwordless)(nil),
 	}
 }
 
@@ -9025,7 +8875,7 @@ func (m *CreatePrivilegeTokenRequest) Reset()         { *m = CreatePrivilegeToke
 func (m *CreatePrivilegeTokenRequest) String() string { return proto.CompactTextString(m) }
 func (*CreatePrivilegeTokenRequest) ProtoMessage()    {}
 func (*CreatePrivilegeTokenRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{133}
+	return fileDescriptor_ce8bd90b12161215, []int{131}
 }
 func (m *CreatePrivilegeTokenRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9068,20 +8918,17 @@ type CreateRegisterChallengeRequest struct {
 	// All user token types are accepted except UserTokenTypeRecoveryStart.
 	TokenID string `protobuf:"bytes,1,opt,name=TokenID,proto3" json:"token_id"`
 	// DeviceType is the type of MFA device to make a register challenge for.
-	DeviceType DeviceType `protobuf:"varint,2,opt,name=DeviceType,proto3,enum=proto.DeviceType" json:"device_type"`
-	// DeviceUsage is the requested usage for the device.
-	// Defaults to DEVICE_USAGE_MFA.
-	DeviceUsage          DeviceUsage `protobuf:"varint,3,opt,name=DeviceUsage,proto3,enum=proto.DeviceUsage" json:"device_usage,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
-	XXX_unrecognized     []byte      `json:"-"`
-	XXX_sizecache        int32       `json:"-"`
+	DeviceType           DeviceType `protobuf:"varint,2,opt,name=DeviceType,proto3,enum=proto.DeviceType" json:"device_type"`
+	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
+	XXX_unrecognized     []byte     `json:"-"`
+	XXX_sizecache        int32      `json:"-"`
 }
 
 func (m *CreateRegisterChallengeRequest) Reset()         { *m = CreateRegisterChallengeRequest{} }
 func (m *CreateRegisterChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateRegisterChallengeRequest) ProtoMessage()    {}
 func (*CreateRegisterChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{134}
+	return fileDescriptor_ce8bd90b12161215, []int{132}
 }
 func (m *CreateRegisterChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9124,13 +8971,6 @@ func (m *CreateRegisterChallengeRequest) GetDeviceType() DeviceType {
 	return DeviceType_DEVICE_TYPE_UNSPECIFIED
 }
 
-func (m *CreateRegisterChallengeRequest) GetDeviceUsage() DeviceUsage {
-	if m != nil {
-		return m.DeviceUsage
-	}
-	return DeviceUsage_DEVICE_USAGE_UNSPECIFIED
-}
-
 // PaginatedResource represents one of the supported resources.
 type PaginatedResource struct {
 	// Resource is the resource itself.
@@ -9140,8 +8980,6 @@ type PaginatedResource struct {
 	//	*PaginatedResource_AppServer
 	//	*PaginatedResource_Node
 	//	*PaginatedResource_KubeService
-	//	*PaginatedResource_WindowsDesktop
-	//	*PaginatedResource_KubeCluster
 	Resource             isPaginatedResource_Resource `protobuf_oneof:"resource"`
 	XXX_NoUnkeyedLiteral struct{}                     `json:"-"`
 	XXX_unrecognized     []byte                       `json:"-"`
@@ -9152,7 +8990,7 @@ func (m *PaginatedResource) Reset()         { *m = PaginatedResource{} }
 func (m *PaginatedResource) String() string { return proto.CompactTextString(m) }
 func (*PaginatedResource) ProtoMessage()    {}
 func (*PaginatedResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{135}
+	return fileDescriptor_ce8bd90b12161215, []int{133}
 }
 func (m *PaginatedResource) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9199,19 +9037,11 @@ type PaginatedResource_Node struct {
 type PaginatedResource_KubeService struct {
 	KubeService *types.ServerV2 `protobuf:"bytes,4,opt,name=KubeService,proto3,oneof" json:"kube_service,omitempty"`
 }
-type PaginatedResource_WindowsDesktop struct {
-	WindowsDesktop *types.WindowsDesktopV3 `protobuf:"bytes,5,opt,name=WindowsDesktop,proto3,oneof" json:"windows_desktop,omitempty"`
-}
-type PaginatedResource_KubeCluster struct {
-	KubeCluster *types.KubernetesClusterV3 `protobuf:"bytes,6,opt,name=KubeCluster,proto3,oneof" json:"kube_cluster,omitempty"`
-}
 
 func (*PaginatedResource_DatabaseServer) isPaginatedResource_Resource() {}
 func (*PaginatedResource_AppServer) isPaginatedResource_Resource()      {}
 func (*PaginatedResource_Node) isPaginatedResource_Resource()           {}
 func (*PaginatedResource_KubeService) isPaginatedResource_Resource()    {}
-func (*PaginatedResource_WindowsDesktop) isPaginatedResource_Resource() {}
-func (*PaginatedResource_KubeCluster) isPaginatedResource_Resource()    {}
 
 func (m *PaginatedResource) GetResource() isPaginatedResource_Resource {
 	if m != nil {
@@ -9248,20 +9078,6 @@ func (m *PaginatedResource) GetKubeService() *types.ServerV2 {
 	return nil
 }
 
-func (m *PaginatedResource) GetWindowsDesktop() *types.WindowsDesktopV3 {
-	if x, ok := m.GetResource().(*PaginatedResource_WindowsDesktop); ok {
-		return x.WindowsDesktop
-	}
-	return nil
-}
-
-func (m *PaginatedResource) GetKubeCluster() *types.KubernetesClusterV3 {
-	if x, ok := m.GetResource().(*PaginatedResource_KubeCluster); ok {
-		return x.KubeCluster
-	}
-	return nil
-}
-
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*PaginatedResource) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -9269,8 +9085,6 @@ func (*PaginatedResource) XXX_OneofWrappers() []interface{} {
 		(*PaginatedResource_AppServer)(nil),
 		(*PaginatedResource_Node)(nil),
 		(*PaginatedResource_KubeService)(nil),
-		(*PaginatedResource_WindowsDesktop)(nil),
-		(*PaginatedResource_KubeCluster)(nil),
 	}
 }
 
@@ -9297,19 +9111,17 @@ type ListResourcesRequest struct {
 	SortBy types.SortBy `protobuf:"bytes,8,opt,name=SortBy,proto3" json:"sort_by,omitempty"`
 	// NeedTotalCount indicates whether or not the caller also wants the total number of resources
 	// after filtering.
-	NeedTotalCount bool `protobuf:"varint,9,opt,name=NeedTotalCount,proto3" json:"need_total_count,omitempty"`
-	// WindowsDesktopFilter specifies windows desktop specific filters.
-	WindowsDesktopFilter types.WindowsDesktopFilter `protobuf:"bytes,10,opt,name=WindowsDesktopFilter,proto3" json:"windows_desktop_filter,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}                   `json:"-"`
-	XXX_unrecognized     []byte                     `json:"-"`
-	XXX_sizecache        int32                      `json:"-"`
+	NeedTotalCount       bool     `protobuf:"varint,9,opt,name=NeedTotalCount,proto3" json:"need_total_count,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *ListResourcesRequest) Reset()         { *m = ListResourcesRequest{} }
 func (m *ListResourcesRequest) String() string { return proto.CompactTextString(m) }
 func (*ListResourcesRequest) ProtoMessage()    {}
 func (*ListResourcesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{136}
+	return fileDescriptor_ce8bd90b12161215, []int{134}
 }
 func (m *ListResourcesRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9401,13 +9213,6 @@ func (m *ListResourcesRequest) GetNeedTotalCount() bool {
 	return false
 }
 
-func (m *ListResourcesRequest) GetWindowsDesktopFilter() types.WindowsDesktopFilter {
-	if m != nil {
-		return m.WindowsDesktopFilter
-	}
-	return types.WindowsDesktopFilter{}
-}
-
 // ListResourceResponse response of ListResources.
 type ListResourcesResponse struct {
 	// Resources is a list of resource.
@@ -9427,7 +9232,7 @@ func (m *ListResourcesResponse) Reset()         { *m = ListResourcesResponse{} }
 func (m *ListResourcesResponse) String() string { return proto.CompactTextString(m) }
 func (*ListResourcesResponse) ProtoMessage()    {}
 func (*ListResourcesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{137}
+	return fileDescriptor_ce8bd90b12161215, []int{135}
 }
 func (m *ListResourcesResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9522,7 +9327,7 @@ func (m *CreateSessionTrackerRequest) Reset()         { *m = CreateSessionTracke
 func (m *CreateSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*CreateSessionTrackerRequest) ProtoMessage()    {}
 func (*CreateSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{138}
+	return fileDescriptor_ce8bd90b12161215, []int{136}
 }
 func (m *CreateSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9662,7 +9467,7 @@ func (m *GetSessionTrackerRequest) Reset()         { *m = GetSessionTrackerReque
 func (m *GetSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*GetSessionTrackerRequest) ProtoMessage()    {}
 func (*GetSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{139}
+	return fileDescriptor_ce8bd90b12161215, []int{137}
 }
 func (m *GetSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9711,7 +9516,7 @@ func (m *RemoveSessionTrackerRequest) Reset()         { *m = RemoveSessionTracke
 func (m *RemoveSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*RemoveSessionTrackerRequest) ProtoMessage()    {}
 func (*RemoveSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{140}
+	return fileDescriptor_ce8bd90b12161215, []int{138}
 }
 func (m *RemoveSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9759,7 +9564,7 @@ func (m *SessionTrackerUpdateState) Reset()         { *m = SessionTrackerUpdateS
 func (m *SessionTrackerUpdateState) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerUpdateState) ProtoMessage()    {}
 func (*SessionTrackerUpdateState) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{141}
+	return fileDescriptor_ce8bd90b12161215, []int{139}
 }
 func (m *SessionTrackerUpdateState) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9807,7 +9612,7 @@ func (m *SessionTrackerAddParticipant) Reset()         { *m = SessionTrackerAddP
 func (m *SessionTrackerAddParticipant) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerAddParticipant) ProtoMessage()    {}
 func (*SessionTrackerAddParticipant) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{142}
+	return fileDescriptor_ce8bd90b12161215, []int{140}
 }
 func (m *SessionTrackerAddParticipant) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9855,7 +9660,7 @@ func (m *SessionTrackerRemoveParticipant) Reset()         { *m = SessionTrackerR
 func (m *SessionTrackerRemoveParticipant) String() string { return proto.CompactTextString(m) }
 func (*SessionTrackerRemoveParticipant) ProtoMessage()    {}
 func (*SessionTrackerRemoveParticipant) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{143}
+	return fileDescriptor_ce8bd90b12161215, []int{141}
 }
 func (m *SessionTrackerRemoveParticipant) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -9909,7 +9714,7 @@ func (m *UpdateSessionTrackerRequest) Reset()         { *m = UpdateSessionTracke
 func (m *UpdateSessionTrackerRequest) String() string { return proto.CompactTextString(m) }
 func (*UpdateSessionTrackerRequest) ProtoMessage()    {}
 func (*UpdateSessionTrackerRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{144}
+	return fileDescriptor_ce8bd90b12161215, []int{142}
 }
 func (m *UpdateSessionTrackerRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10015,7 +9820,7 @@ func (m *PresenceMFAChallengeRequest) Reset()         { *m = PresenceMFAChalleng
 func (m *PresenceMFAChallengeRequest) String() string { return proto.CompactTextString(m) }
 func (*PresenceMFAChallengeRequest) ProtoMessage()    {}
 func (*PresenceMFAChallengeRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{145}
+	return fileDescriptor_ce8bd90b12161215, []int{143}
 }
 func (m *PresenceMFAChallengeRequest) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10066,7 +9871,7 @@ func (m *PresenceMFAChallengeSend) Reset()         { *m = PresenceMFAChallengeSe
 func (m *PresenceMFAChallengeSend) String() string { return proto.CompactTextString(m) }
 func (*PresenceMFAChallengeSend) ProtoMessage()    {}
 func (*PresenceMFAChallengeSend) Descriptor() ([]byte, []int) {
-	return fileDescriptor_ce8bd90b12161215, []int{146}
+	return fileDescriptor_ce8bd90b12161215, []int{144}
 }
 func (m *PresenceMFAChallengeSend) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -10143,7 +9948,6 @@ func (*PresenceMFAChallengeSend) XXX_OneofWrappers() []interface{} {
 func init() {
 	proto.RegisterEnum("proto.Operation", Operation_name, Operation_value)
 	proto.RegisterEnum("proto.DeviceType", DeviceType_name, DeviceType_value)
-	proto.RegisterEnum("proto.DeviceUsage", DeviceUsage_name, DeviceUsage_value)
 	proto.RegisterEnum("proto.Order", Order_name, Order_value)
 	proto.RegisterEnum("proto.UserCertsRequest_CertUsage", UserCertsRequest_CertUsage_name, UserCertsRequest_CertUsage_value)
 	proto.RegisterType((*Event)(nil), "proto.Event")
@@ -10278,8 +10082,6 @@ func init() {
 	proto.RegisterType((*GetAccountRecoveryTokenRequest)(nil), "proto.GetAccountRecoveryTokenRequest")
 	proto.RegisterType((*GetAccountRecoveryCodesRequest)(nil), "proto.GetAccountRecoveryCodesRequest")
 	proto.RegisterType((*UserCredentials)(nil), "proto.UserCredentials")
-	proto.RegisterType((*ContextUser)(nil), "proto.ContextUser")
-	proto.RegisterType((*Passwordless)(nil), "proto.Passwordless")
 	proto.RegisterType((*CreateAuthenticateChallengeRequest)(nil), "proto.CreateAuthenticateChallengeRequest")
 	proto.RegisterType((*CreatePrivilegeTokenRequest)(nil), "proto.CreatePrivilegeTokenRequest")
 	proto.RegisterType((*CreateRegisterChallengeRequest)(nil), "proto.CreateRegisterChallengeRequest")
@@ -10301,598 +10103,586 @@ func init() {
 func init() { proto.RegisterFile("authservice.proto", fileDescriptor_ce8bd90b12161215) }
 
 var fileDescriptor_ce8bd90b12161215 = []byte{
-	// 9444 bytes of a gzipped FileDescriptorProto
+	// 9254 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x7d, 0x5b, 0x6c, 0x1b, 0xc9,
-	0x96, 0x98, 0x49, 0xbd, 0xc8, 0xa3, 0x87, 0xe9, 0x92, 0x64, 0xd1, 0xb4, 0x2c, 0x7a, 0xda, 0x33,
-	0xbe, 0x9e, 0xd9, 0x59, 0xdb, 0x23, 0xcd, 0xfb, 0xb9, 0x24, 0x25, 0x4b, 0xb2, 0x65, 0x59, 0xd3,
-	0x94, 0xe8, 0xc9, 0xdc, 0xd9, 0x70, 0x5a, 0x64, 0x59, 0xea, 0x88, 0x62, 0xf3, 0x76, 0x37, 0xed,
-	0x31, 0x82, 0x04, 0x79, 0x6d, 0x12, 0x04, 0x08, 0xb0, 0x01, 0xb2, 0x48, 0x82, 0x7c, 0x64, 0xb1,
-	0xc9, 0x4f, 0x12, 0xec, 0x4f, 0x10, 0xe4, 0x33, 0x5f, 0x01, 0x72, 0x13, 0x20, 0x48, 0x7e, 0x16,
-	0x01, 0xf6, 0x83, 0x7b, 0x73, 0x3f, 0xf5, 0x1b, 0x24, 0x40, 0xee, 0x57, 0x50, 0xcf, 0xae, 0xea,
-	0xee, 0x22, 0x25, 0xdb, 0xd9, 0xfc, 0xd8, 0xea, 0x53, 0x75, 0x4e, 0x55, 0x9d, 0x3a, 0x75, 0xea,
-	0xd4, 0xa9, 0x53, 0x87, 0x70, 0xc5, 0xe9, 0x87, 0xc7, 0x01, 0xf6, 0x9f, 0xbb, 0x2d, 0x7c, 0xb7,
-	0xe7, 0x7b, 0xa1, 0x87, 0x26, 0xe8, 0x7f, 0xa5, 0x85, 0x23, 0xef, 0xc8, 0xa3, 0x7f, 0xde, 0x23,
-	0x7f, 0xb1, 0xc2, 0xd2, 0xf5, 0x23, 0xcf, 0x3b, 0xea, 0xe0, 0x7b, 0xf4, 0xeb, 0xb0, 0xff, 0xec,
-	0x1e, 0x3e, 0xed, 0x85, 0x2f, 0x79, 0x61, 0x39, 0x5e, 0x18, 0xba, 0xa7, 0x38, 0x08, 0x9d, 0xd3,
+	0x96, 0x98, 0x49, 0xbd, 0xc8, 0xa3, 0x87, 0xa9, 0x92, 0x64, 0xd1, 0xb4, 0x2c, 0x7a, 0xda, 0x33,
+	0xbe, 0x9e, 0xd9, 0x59, 0xdb, 0x23, 0xcd, 0xfb, 0x79, 0x49, 0x4a, 0x96, 0x64, 0xcb, 0xb2, 0xa6,
+	0x29, 0xd3, 0x93, 0x7b, 0x67, 0xc3, 0x69, 0x91, 0x65, 0xa9, 0x23, 0x8a, 0xcd, 0xdb, 0xdd, 0xb4,
+	0xc7, 0x08, 0x12, 0xe4, 0xb5, 0x49, 0x10, 0x24, 0xc0, 0x06, 0xc8, 0x22, 0xc9, 0x57, 0x16, 0x9b,
+	0x00, 0x41, 0x12, 0xec, 0x4f, 0x10, 0xe4, 0x33, 0xbf, 0xb9, 0x09, 0x10, 0x24, 0x3f, 0x8b, 0x00,
+	0xfb, 0xc1, 0xdd, 0xdc, 0x4f, 0x7d, 0x05, 0x08, 0x12, 0x20, 0xf7, 0x2b, 0xa8, 0x67, 0x57, 0x75,
+	0x77, 0x91, 0x92, 0xed, 0xdc, 0xfd, 0xb1, 0xd5, 0xa7, 0xea, 0x9c, 0xaa, 0x3a, 0x75, 0xea, 0xd4,
+	0xa9, 0x53, 0xa7, 0x0e, 0x61, 0xde, 0xe9, 0x87, 0xc7, 0x01, 0xf6, 0x9f, 0xbb, 0x2d, 0x7c, 0xa7,
+	0xe7, 0x7b, 0xa1, 0x87, 0x26, 0xe8, 0x7f, 0xa5, 0xc5, 0x23, 0xef, 0xc8, 0xa3, 0x7f, 0xde, 0x25,
+	0x7f, 0xb1, 0xc2, 0xd2, 0xb5, 0x23, 0xcf, 0x3b, 0xea, 0xe0, 0xbb, 0xf4, 0xeb, 0xb0, 0xff, 0xec,
+	0x2e, 0x3e, 0xed, 0x85, 0x2f, 0x79, 0x61, 0x39, 0x5e, 0x18, 0xba, 0xa7, 0x38, 0x08, 0x9d, 0xd3,
 	0x1e, 0xaf, 0x30, 0xdd, 0xc2, 0x7e, 0x18, 0xf0, 0x8f, 0x4f, 0x8e, 0xdc, 0xf0, 0xb8, 0x7f, 0x78,
-	0xb7, 0xe5, 0x9d, 0xde, 0x3b, 0xf2, 0x9d, 0xe7, 0x6e, 0xe8, 0x84, 0xae, 0xd7, 0x75, 0x3a, 0xf7,
-	0x42, 0xdc, 0xc1, 0x3d, 0xcf, 0x0f, 0xef, 0x39, 0x3d, 0xf7, 0x5e, 0xf8, 0xb2, 0x87, 0x03, 0xf6,
+	0xa7, 0xe5, 0x9d, 0xde, 0x3d, 0xf2, 0x9d, 0xe7, 0x6e, 0xe8, 0x84, 0xae, 0xd7, 0x75, 0x3a, 0x77,
+	0x43, 0xdc, 0xc1, 0x3d, 0xcf, 0x0f, 0xef, 0x3a, 0x3d, 0xf7, 0x6e, 0xf8, 0xb2, 0x87, 0x03, 0xf6,
 	0x2f, 0x47, 0xac, 0x5d, 0x04, 0xf1, 0x05, 0x3e, 0x24, 0x43, 0xec, 0xca, 0x3f, 0x5e, 0x89, 0x88,
 	0xef, 0xf4, 0x7a, 0xd8, 0x8f, 0xfe, 0xe0, 0x44, 0xbe, 0xb9, 0x08, 0x11, 0xfc, 0x1c, 0x77, 0x43,
-	0xf1, 0x1f, 0x23, 0x60, 0xfd, 0xeb, 0x05, 0x98, 0xd8, 0x20, 0x00, 0xf4, 0x29, 0x8c, 0xef, 0xbf,
-	0xec, 0xe1, 0x62, 0xe6, 0x66, 0xe6, 0xce, 0xdc, 0x6a, 0x81, 0x95, 0xdf, 0x7d, 0xd2, 0xc3, 0x3e,
+	0xf1, 0x1f, 0x23, 0x60, 0xfd, 0x9b, 0x45, 0x98, 0xd8, 0x24, 0x00, 0xf4, 0x29, 0x8c, 0x1f, 0xbc,
+	0xec, 0xe1, 0x62, 0xe6, 0x46, 0xe6, 0xf6, 0xdc, 0x5a, 0x81, 0x95, 0xdf, 0x79, 0xdc, 0xc3, 0x3e,
 	0x25, 0x59, 0x45, 0x67, 0x83, 0xf2, 0x1c, 0x21, 0xf4, 0xbe, 0x77, 0xea, 0x86, 0x94, 0xeb, 0x36,
-	0xc5, 0x40, 0x4f, 0x61, 0xce, 0xc6, 0x81, 0xd7, 0xf7, 0x5b, 0x78, 0x0b, 0x3b, 0x6d, 0xec, 0x17,
-	0xb3, 0x37, 0x33, 0x77, 0xa6, 0x57, 0x17, 0xef, 0x32, 0xa6, 0xe9, 0x85, 0xd5, 0xab, 0x67, 0x83,
-	0x32, 0xf2, 0x39, 0x2c, 0x22, 0xb6, 0x75, 0xc9, 0x8e, 0x91, 0x41, 0x3f, 0xc0, 0x6c, 0x0d, 0xfb,
-	0x61, 0xa5, 0x1f, 0x1e, 0x7b, 0xbe, 0x1b, 0xbe, 0x2c, 0x8e, 0x51, 0xba, 0x57, 0x39, 0x5d, 0xad,
-	0xac, 0xb1, 0x5a, 0x5d, 0x3e, 0x1b, 0x94, 0x8b, 0x64, 0x82, 0x9b, 0x8e, 0x80, 0x6a, 0xe4, 0x75,
-	0x62, 0xe8, 0x3b, 0x98, 0xa9, 0x13, 0x76, 0xb5, 0xf6, 0xbd, 0x13, 0xdc, 0x0d, 0x8a, 0xe3, 0x5a,
-	0xa7, 0xd5, 0xa2, 0xc6, 0x6a, 0xf5, 0xfa, 0xd9, 0xa0, 0xbc, 0x14, 0x50, 0x58, 0x33, 0xa4, 0x40,
-	0x8d, 0xb4, 0x46, 0x09, 0xfd, 0x08, 0x73, 0x7b, 0xbe, 0xf7, 0xdc, 0x0d, 0x5c, 0xaf, 0x4b, 0x41,
-	0xc5, 0x09, 0x4a, 0x7b, 0x89, 0xd3, 0xd6, 0x0b, 0x1b, 0xab, 0xd5, 0x1b, 0x67, 0x83, 0xf2, 0xb5,
-	0x9e, 0x80, 0xb2, 0x06, 0x74, 0xce, 0xe8, 0x28, 0x68, 0x1f, 0xa6, 0x6b, 0x9d, 0x7e, 0x10, 0x62,
-	0x7f, 0xd7, 0x39, 0xc5, 0xc5, 0x49, 0x4a, 0x7e, 0x41, 0xf0, 0x25, 0x2a, 0x69, 0xac, 0x56, 0x4b,
-	0x67, 0x83, 0xf2, 0xd5, 0x16, 0x03, 0x35, 0xbb, 0xce, 0xa9, 0xce, 0x72, 0x95, 0x0c, 0xfa, 0x04,
-	0xc6, 0x0f, 0x02, 0xec, 0x17, 0x73, 0x94, 0xdc, 0x2c, 0x27, 0x47, 0x40, 0x8d, 0x55, 0x36, 0xff,
-	0xfd, 0x00, 0xfb, 0x1a, 0x3e, 0x45, 0x20, 0x88, 0xb6, 0xd7, 0xc1, 0xc5, 0xbc, 0x86, 0x48, 0x40,
-	0x8d, 0x8f, 0x18, 0xa2, 0xef, 0x75, 0xf4, 0x86, 0x29, 0x02, 0xda, 0x86, 0x3c, 0x69, 0x39, 0xe8,
-	0x39, 0x2d, 0x5c, 0x04, 0x8a, 0x5d, 0xe0, 0xd8, 0x12, 0x5e, 0x5d, 0x3a, 0x1b, 0x94, 0xe7, 0xbb,
-	0xe2, 0x53, 0xa3, 0x12, 0x61, 0xa3, 0x6f, 0x60, 0xb2, 0x8e, 0xfd, 0xe7, 0xd8, 0x2f, 0x4e, 0x53,
-	0x3a, 0x97, 0xc5, 0x44, 0x52, 0x60, 0x63, 0xb5, 0xba, 0x70, 0x36, 0x28, 0x17, 0x02, 0xfa, 0xa5,
-	0xd1, 0xe0, 0x68, 0x44, 0xda, 0x6c, 0xfc, 0x1c, 0xfb, 0x01, 0xde, 0xef, 0x77, 0xbb, 0xb8, 0x53,
-	0x9c, 0xd1, 0xa4, 0x4d, 0x2b, 0x13, 0xd2, 0xe6, 0x33, 0x60, 0x33, 0xa4, 0x50, 0x5d, 0xda, 0x34,
-	0x04, 0x74, 0x0c, 0x05, 0xf6, 0x57, 0xcd, 0xeb, 0x76, 0x71, 0x8b, 0x2c, 0xa9, 0xe2, 0x2c, 0x6d,
-	0xe0, 0x1a, 0x6f, 0x20, 0x5e, 0xdc, 0x58, 0xad, 0x96, 0xcf, 0x06, 0xe5, 0xeb, 0x8c, 0x76, 0xb3,
-	0x25, 0x0b, 0xb4, 0x66, 0x12, 0x54, 0xc9, 0x38, 0x2a, 0xad, 0x16, 0x0e, 0x02, 0x1b, 0xff, 0xa2,
-	0x8f, 0x83, 0xb0, 0x38, 0xa7, 0x8d, 0x43, 0x2b, 0x6b, 0xac, 0xb1, 0x71, 0x38, 0x14, 0xd8, 0xf4,
-	0x19, 0x54, 0x1f, 0x87, 0x86, 0x80, 0xf6, 0x00, 0x2a, 0xbd, 0x5e, 0x1d, 0x07, 0x44, 0x18, 0x8b,
-	0x97, 0x29, 0xe9, 0x79, 0x4e, 0xfa, 0x29, 0x3e, 0xe4, 0x05, 0x8d, 0xd5, 0xea, 0xb5, 0xb3, 0x41,
-	0x79, 0xd1, 0xe9, 0xf5, 0x9a, 0x01, 0x03, 0x69, 0x44, 0x15, 0x1a, 0x8c, 0xef, 0xa7, 0x5e, 0x88,
-	0xb9, 0x28, 0x16, 0x0b, 0x31, 0xbe, 0x2b, 0x65, 0xa2, 0xbf, 0x3e, 0x05, 0x36, 0xb9, 0x58, 0xc7,
-	0xf9, 0xae, 0x20, 0x90, 0xb5, 0xb8, 0xee, 0x84, 0xce, 0xa1, 0x13, 0x60, 0x2e, 0x1e, 0x57, 0xb4,
-	0xb5, 0xa8, 0x17, 0x36, 0xd6, 0xd8, 0x5a, 0x6c, 0x73, 0x68, 0x33, 0x45, 0x5e, 0x62, 0xf4, 0x08,
-	0x47, 0xa2, 0x81, 0x17, 0xd1, 0x08, 0x8e, 0xbc, 0xc0, 0x87, 0xe9, 0x1c, 0x89, 0xaa, 0xa2, 0x2d,
-	0xc8, 0x3d, 0xc5, 0x87, 0x4c, 0x73, 0xcc, 0x53, 0x7a, 0x57, 0x22, 0x7a, 0x4c, 0x67, 0xac, 0xb1,
-	0x55, 0x41, 0xa8, 0x25, 0xb5, 0x85, 0xc4, 0x46, 0xbf, 0x97, 0x81, 0x25, 0xb1, 0xc2, 0x71, 0xf8,
-	0xc2, 0xf3, 0x4f, 0xdc, 0xee, 0x51, 0xcd, 0xeb, 0x3e, 0x73, 0x8f, 0x8a, 0x0b, 0x94, 0xf2, 0xcd,
-	0x98, 0xd2, 0x88, 0xd5, 0x6a, 0xac, 0x56, 0x7f, 0x76, 0x36, 0x28, 0xdf, 0x92, 0x0a, 0x44, 0x96,
-	0x13, 0x81, 0x7c, 0xe6, 0x1e, 0x69, 0x0d, 0x9b, 0xda, 0x42, 0x7f, 0x3d, 0x03, 0x57, 0xf9, 0xe8,
-	0x6c, 0xdc, 0xf2, 0xfc, 0x76, 0xd4, 0x8d, 0x45, 0xda, 0x8d, 0xb2, 0x5c, 0xad, 0x69, 0x95, 0x1a,
-	0xab, 0xd5, 0xdb, 0x67, 0x83, 0xb2, 0xc5, 0x19, 0xd7, 0xf4, 0x45, 0x71, 0x5a, 0x27, 0x0c, 0x0d,
-	0x11, 0x49, 0x20, 0xca, 0x7f, 0xcf, 0xc7, 0xcf, 0xb0, 0x8f, 0xbb, 0x2d, 0x5c, 0xbc, 0xaa, 0x49,
-	0x82, 0x5e, 0x28, 0xb4, 0x32, 0xd9, 0x4a, 0x9a, 0x3d, 0x09, 0xd6, 0x25, 0x41, 0x47, 0x41, 0xbf,
-	0x00, 0xc4, 0x19, 0x50, 0xe9, 0xb7, 0xdd, 0x90, 0x0f, 0x70, 0x89, 0xb6, 0x72, 0x5d, 0xe7, 0xb3,
-	0x52, 0xa1, 0xb1, 0x5a, 0xb5, 0xce, 0x06, 0xe5, 0x15, 0xc1, 0x62, 0x87, 0x14, 0xa5, 0x0d, 0x2c,
-	0x85, 0x38, 0xd1, 0xbc, 0x3b, 0x5e, 0xeb, 0xa4, 0x58, 0xd4, 0x34, 0x2f, 0x01, 0x09, 0x95, 0xdd,
-	0xf1, 0x5a, 0x27, 0xba, 0xe6, 0x25, 0xa5, 0x28, 0x84, 0x79, 0x3e, 0x4b, 0x36, 0x0e, 0x42, 0xdf,
-	0xa5, 0xba, 0x23, 0x28, 0x5e, 0xa3, 0x74, 0x96, 0x85, 0x0e, 0x4e, 0xd6, 0x68, 0x7c, 0xc8, 0x7a,
-	0xcb, 0x05, 0xa1, 0xe9, 0x2b, 0x65, 0x5a, 0x33, 0x69, 0xe4, 0xd1, 0x5f, 0x81, 0xc5, 0xa7, 0x6e,
-	0xb7, 0xed, 0xbd, 0x08, 0xd6, 0x71, 0x70, 0x12, 0x7a, 0xbd, 0x3a, 0xb3, 0xfc, 0x8a, 0x25, 0xda,
-	0xee, 0x8a, 0x10, 0xf3, 0xb4, 0x3a, 0x8d, 0xb5, 0xea, 0x3b, 0x67, 0x83, 0xf2, 0x5b, 0x2f, 0x58,
-	0x61, 0xb3, 0xcd, 0x4a, 0x9b, 0xdc, 0x78, 0xd4, 0x1a, 0x4f, 0x6f, 0x85, 0x88, 0x80, 0x5e, 0x50,
-	0xbc, 0xae, 0x89, 0x80, 0x5e, 0x28, 0x94, 0x41, 0xac, 0x41, 0x5d, 0x04, 0x74, 0x14, 0xb4, 0x09,
-	0x39, 0xa1, 0x1e, 0x8a, 0xcb, 0xda, 0xd2, 0x15, 0xe0, 0xc6, 0x1a, 0xb3, 0x80, 0x84, 0x8a, 0xd1,
-	0x57, 0xae, 0xa8, 0x85, 0x76, 0x20, 0x4f, 0x75, 0x24, 0x55, 0x59, 0x37, 0x28, 0x25, 0x24, 0x04,
-	0x55, 0xc0, 0x1b, 0x6b, 0xd5, 0xe2, 0xd9, 0xa0, 0xbc, 0xc0, 0xb4, 0x6c, 0x42, 0x51, 0x45, 0x04,
-	0xd0, 0x1a, 0x8c, 0x55, 0x7a, 0xbd, 0xe2, 0x0a, 0xa5, 0x33, 0x13, 0xd1, 0x69, 0xac, 0x55, 0xaf,
-	0x9c, 0x0d, 0xca, 0xb3, 0x4e, 0x4f, 0x1f, 0x16, 0xa9, 0x5d, 0x05, 0xc8, 0x09, 0x83, 0xec, 0xe1,
-	0x78, 0x6e, 0xaa, 0x90, 0xb3, 0xb6, 0x60, 0xe2, 0xa9, 0x13, 0xb6, 0x8e, 0xd1, 0x37, 0x30, 0xf1,
-	0xc8, 0xed, 0xb6, 0x83, 0x62, 0xe6, 0xe6, 0x18, 0xdd, 0xb3, 0x99, 0xb5, 0x48, 0x0b, 0x49, 0x41,
-	0x75, 0xe9, 0x97, 0x83, 0xf2, 0xa5, 0xb3, 0x41, 0xf9, 0xf2, 0x09, 0xa9, 0xa6, 0x98, 0x8c, 0x0c,
-	0xcf, 0xfa, 0xb7, 0x59, 0xc8, 0xcb, 0xda, 0x68, 0x19, 0xc6, 0xc9, 0xff, 0xd4, 0xf6, 0xcc, 0x57,
-	0x73, 0x67, 0x83, 0xf2, 0x38, 0xc1, 0xb3, 0x29, 0x14, 0xad, 0xc2, 0xf4, 0x8e, 0xe7, 0xb4, 0xeb,
-	0xb8, 0xe5, 0xe3, 0x30, 0xa0, 0xc6, 0x65, 0xae, 0x5a, 0x38, 0x1b, 0x94, 0x67, 0x3a, 0x9e, 0xd3,
-	0x6e, 0x06, 0x0c, 0x6e, 0xab, 0x95, 0x08, 0x45, 0x6a, 0x19, 0x8d, 0x45, 0x14, 0x89, 0x05, 0x61,
-	0x53, 0x28, 0x7a, 0x08, 0x93, 0x0f, 0xdc, 0x0e, 0xd9, 0x6b, 0xc6, 0x69, 0xff, 0x97, 0xe3, 0xfd,
-	0xbf, 0xcb, 0x8a, 0x37, 0xba, 0xa1, 0xff, 0x92, 0x19, 0x0e, 0xcf, 0x28, 0x40, 0x19, 0x08, 0xa7,
-	0x80, 0xee, 0xc3, 0x54, 0xbd, 0x7f, 0x48, 0xbb, 0x3f, 0x41, 0x1b, 0xa3, 0xb3, 0x1b, 0xf4, 0x0f,
-	0x9b, 0x64, 0x08, 0x0a, 0x82, 0xa8, 0x56, 0xfa, 0x0c, 0xa6, 0x15, 0xf2, 0xa8, 0x00, 0x63, 0x27,
-	0xf8, 0x25, 0x1b, 0xbb, 0x4d, 0xfe, 0x44, 0x0b, 0x30, 0xf1, 0xdc, 0xe9, 0xf4, 0x31, 0x1d, 0x6a,
-	0xde, 0x66, 0x1f, 0x9f, 0x67, 0x3f, 0xcd, 0x58, 0xff, 0x75, 0x1c, 0x0a, 0x5b, 0x5e, 0x10, 0x12,
-	0x4b, 0x56, 0x6e, 0xc9, 0xb7, 0x60, 0x92, 0xc0, 0xb6, 0xd7, 0x39, 0xff, 0xa6, 0xcf, 0x06, 0xe5,
-	0xa9, 0x63, 0x2f, 0x08, 0x9b, 0x6e, 0xdb, 0xe6, 0x45, 0xe8, 0x5d, 0xc8, 0xed, 0x7a, 0x6d, 0x4c,
-	0x99, 0x42, 0xc9, 0x56, 0x67, 0xcf, 0x06, 0xe5, 0x7c, 0xd7, 0x6b, 0x63, 0x6a, 0x15, 0xda, 0xb2,
-	0x18, 0x35, 0xb8, 0x35, 0xc7, 0x78, 0x57, 0x25, 0xbc, 0x23, 0xe6, 0xdb, 0x6f, 0x06, 0xe5, 0x8f,
-	0x2f, 0x70, 0xdc, 0xb8, 0x5b, 0x7f, 0x19, 0x84, 0xf8, 0x94, 0x50, 0xe2, 0xc6, 0xde, 0x53, 0x58,
-	0xa8, 0xb4, 0xdb, 0x2e, 0xc3, 0xd8, 0xf3, 0xdd, 0x6e, 0xcb, 0xed, 0x39, 0x9d, 0x80, 0xce, 0x41,
-	0xbe, 0x7a, 0xeb, 0x6c, 0x50, 0x2e, 0x3b, 0xb2, 0xbc, 0xd9, 0x93, 0x15, 0x14, 0x1e, 0xa6, 0x12,
-	0x40, 0x6b, 0x90, 0x5b, 0xdf, 0xad, 0x53, 0x53, 0xb0, 0x38, 0x41, 0x89, 0xd1, 0xcd, 0xb1, 0xdd,
-	0x0d, 0xe8, 0xd0, 0x54, 0x02, 0xb2, 0x22, 0xfa, 0x18, 0x66, 0xf6, 0xfa, 0x87, 0x1d, 0xb7, 0xb5,
-	0xbf, 0x53, 0x7f, 0x84, 0x5f, 0x52, 0x1b, 0x7a, 0x86, 0xa9, 0xcc, 0x1e, 0x85, 0x37, 0xc3, 0x4e,
-	0xd0, 0x3c, 0xc1, 0x2f, 0x6d, 0xad, 0x5e, 0x84, 0x57, 0xaf, 0x6f, 0x11, 0xbc, 0xa9, 0x04, 0x5e,
-	0x10, 0x1c, 0xab, 0x78, 0xac, 0x1e, 0xba, 0x07, 0xc0, 0x2c, 0x93, 0x4a, 0xbb, 0xcd, 0x4c, 0xec,
-	0x7c, 0xf5, 0xf2, 0xd9, 0xa0, 0x3c, 0xcd, 0x6d, 0x19, 0xa7, 0xdd, 0xf6, 0x6d, 0xa5, 0x0a, 0xaa,
-	0x41, 0xce, 0xf6, 0x18, 0x83, 0xb9, 0x61, 0x7d, 0x59, 0x1a, 0xd6, 0x0c, 0xcc, 0x8f, 0x52, 0xfc,
-	0x4b, 0x1d, 0xa5, 0xa8, 0x81, 0xca, 0x30, 0xb5, 0xeb, 0xd5, 0x9c, 0xd6, 0x31, 0x33, 0xaf, 0x73,
-	0xd5, 0x89, 0xb3, 0x41, 0x39, 0xf3, 0xdb, 0xb6, 0x80, 0x5a, 0xff, 0x22, 0x07, 0x05, 0x62, 0xc3,
-	0x6b, 0x12, 0xf5, 0x3e, 0xe4, 0x59, 0xdf, 0x1f, 0x71, 0xc1, 0x9c, 0xa9, 0xce, 0x9d, 0x0d, 0xca,
-	0xc0, 0x07, 0x48, 0x06, 0x17, 0x55, 0x40, 0x77, 0x20, 0x47, 0x28, 0x74, 0x23, 0xd1, 0x9a, 0x39,
-	0x1b, 0x94, 0x73, 0x7d, 0x0e, 0xb3, 0x65, 0x29, 0xaa, 0xc3, 0xd4, 0xc6, 0x4f, 0x3d, 0xd7, 0xc7,
-	0x01, 0x3f, 0xca, 0x95, 0xee, 0xb2, 0x13, 0xfb, 0x5d, 0x71, 0x62, 0xbf, 0xbb, 0x2f, 0x4e, 0xec,
-	0xd5, 0x1b, 0x5c, 0x85, 0x5c, 0xc1, 0x0c, 0x25, 0x1a, 0xdf, 0xef, 0xff, 0x59, 0x39, 0x63, 0x0b,
-	0x4a, 0xe8, 0x7d, 0x98, 0x7c, 0xe0, 0xf9, 0xa7, 0x4e, 0x48, 0x4f, 0x70, 0x79, 0xbe, 0x5c, 0x29,
-	0x44, 0x5b, 0xae, 0x14, 0x82, 0x1e, 0xc0, 0x9c, 0xed, 0xf5, 0x43, 0xbc, 0xef, 0x09, 0x73, 0x93,
-	0xad, 0xda, 0x95, 0xb3, 0x41, 0xb9, 0xe4, 0x93, 0x92, 0x66, 0xe8, 0x25, 0x0d, 0x4b, 0x3b, 0x86,
-	0x85, 0x36, 0x60, 0x4e, 0x33, 0x8c, 0x83, 0xe2, 0x24, 0x95, 0x3c, 0x66, 0x34, 0x68, 0xe6, 0xb4,
-	0x2a, 0x7f, 0x31, 0x24, 0xb4, 0x0b, 0x57, 0x1e, 0xf5, 0x0f, 0xb1, 0xdf, 0xc5, 0x21, 0x0e, 0x44,
-	0x8f, 0xa6, 0x68, 0x8f, 0x6e, 0x9e, 0x0d, 0xca, 0xcb, 0x27, 0xb2, 0x30, 0xa5, 0x4f, 0x49, 0x54,
-	0x84, 0xe1, 0x32, 0xef, 0xa8, 0xdc, 0x86, 0x72, 0xdc, 0x9c, 0x66, 0x2a, 0x2e, 0x56, 0x5a, 0xbd,
-	0xc5, 0xb9, 0x7c, 0x5d, 0x8e, 0x3d, 0xb9, 0x31, 0xd9, 0x71, 0x9a, 0x64, 0xc5, 0x49, 0x6d, 0x92,
-	0xa7, 0xbd, 0x65, 0x87, 0x34, 0xa1, 0x4d, 0x54, 0x59, 0x94, 0x7a, 0x65, 0x07, 0x26, 0x0e, 0x02,
-	0xe7, 0x88, 0x49, 0xe2, 0xdc, 0xea, 0x5b, 0xbc, 0x47, 0x71, 0xe9, 0xa3, 0xe7, 0x7a, 0x5a, 0xb1,
-	0x3a, 0x4f, 0x76, 0x90, 0x3e, 0xf9, 0x53, 0xdd, 0x41, 0x68, 0x19, 0xfa, 0x16, 0x80, 0xf7, 0x8a,
-	0xec, 0x6c, 0xd3, 0x7c, 0xaf, 0xd5, 0x06, 0x49, 0x36, 0xb1, 0x15, 0x3e, 0xbe, 0xab, 0x72, 0x7c,
-	0xda, 0x5e, 0x67, 0x2b, 0x44, 0xd0, 0x37, 0x30, 0x43, 0xd5, 0x95, 0x98, 0xd1, 0x19, 0x3a, 0xa3,
-	0xf4, 0xe8, 0x4f, 0x14, 0x60, 0xda, 0x7c, 0x6a, 0x08, 0xe8, 0xaf, 0xc2, 0x22, 0x27, 0x17, 0x33,
-	0x33, 0x66, 0xb9, 0x59, 0xa5, 0x75, 0x4f, 0xaf, 0x53, 0x7d, 0x8f, 0xf7, 0xd4, 0x92, 0x3d, 0x35,
-	0x1a, 0x1e, 0x76, 0x7a, 0x33, 0xd6, 0x77, 0x90, 0x97, 0xcc, 0x43, 0x53, 0x30, 0x56, 0xe9, 0x74,
-	0x0a, 0x97, 0xc8, 0x1f, 0xf5, 0xfa, 0x56, 0x21, 0x83, 0xe6, 0x00, 0x22, 0x89, 0x29, 0x64, 0xd1,
-	0x4c, 0x64, 0xac, 0x14, 0xc6, 0x68, 0xfd, 0x5e, 0xaf, 0x30, 0x8e, 0x50, 0xdc, 0x4a, 0x2a, 0x4c,
-	0x58, 0xff, 0x3d, 0x93, 0x10, 0x2c, 0xb2, 0x2f, 0x73, 0xc3, 0x8a, 0xca, 0x01, 0xdb, 0x7c, 0xe8,
-	0xbe, 0xcc, 0x4d, 0x32, 0xb6, 0xb1, 0xa8, 0x95, 0x88, 0xae, 0xd8, 0x23, 0x3c, 0x68, 0x79, 0x1d,
-	0x55, 0x57, 0xf4, 0x38, 0xcc, 0x96, 0xa5, 0x68, 0x55, 0xd1, 0x2a, 0x63, 0xd1, 0xc6, 0x2a, 0xb4,
-	0x8a, 0x2a, 0x61, 0x52, 0xbf, 0xac, 0x2a, 0xd6, 0xd7, 0x78, 0x84, 0x93, 0x22, 0xd1, 0xb2, 0x9e,
-	0xd5, 0x37, 0xcc, 0x19, 0xfa, 0x22, 0x61, 0x2c, 0xb2, 0x11, 0x52, 0xa1, 0x8c, 0x4d, 0x4d, 0xc2,
-	0x0e, 0x2c, 0xc3, 0xc4, 0x8e, 0x77, 0xe4, 0x76, 0xf9, 0x20, 0xf3, 0x67, 0x83, 0xf2, 0x44, 0x87,
-	0x00, 0x6c, 0x06, 0xb7, 0xfe, 0x4f, 0x46, 0x95, 0x5f, 0x69, 0xaf, 0x64, 0x52, 0xed, 0x95, 0xf7,
-	0x21, 0xcf, 0x0f, 0x35, 0xdb, 0xeb, 0x9c, 0x22, 0xd5, 0xc7, 0xe2, 0x3c, 0xe4, 0xb6, 0xed, 0xa8,
-	0x02, 0xd9, 0x69, 0x98, 0x72, 0xa6, 0x3b, 0xcd, 0x58, 0xb4, 0xd3, 0x70, 0xf5, 0xcd, 0x76, 0x9a,
-	0xa8, 0x0a, 0x99, 0x48, 0xd5, 0x9b, 0x34, 0x1e, 0x4d, 0xa4, 0xea, 0x37, 0xd2, 0x7d, 0x45, 0x9f,
-	0x03, 0x54, 0x9e, 0xd6, 0x89, 0xf4, 0x57, 0xec, 0x5d, 0xae, 0x43, 0xa9, 0xab, 0xc9, 0x79, 0x11,
-	0x34, 0xe9, 0x6a, 0x71, 0x7c, 0x75, 0x4b, 0x52, 0x6a, 0x5b, 0x1d, 0x98, 0xdb, 0xc4, 0x21, 0x99,
-	0x35, 0xb1, 0xe1, 0x0c, 0x1f, 0xfe, 0x97, 0x30, 0xfd, 0xd4, 0x0d, 0x8f, 0x75, 0x03, 0x90, 0x36,
-	0xf6, 0xc2, 0x0d, 0x8f, 0x85, 0x01, 0xa8, 0x34, 0xa6, 0x56, 0xb7, 0x36, 0xe0, 0x32, 0x6f, 0x4d,
-	0xee, 0x6f, 0xab, 0x3a, 0xc1, 0x4c, 0x64, 0x51, 0xaa, 0x04, 0x75, 0x32, 0x38, 0xae, 0xf0, 0x51,
-	0x3d, 0xb1, 0x05, 0x30, 0x6b, 0xd8, 0xe4, 0x69, 0xa1, 0x82, 0x13, 0xdb, 0x1a, 0xe2, 0x1b, 0x82,
-	0x75, 0x00, 0xb3, 0x7b, 0x9d, 0xfe, 0x91, 0xdb, 0x25, 0x02, 0x5a, 0xc7, 0xbf, 0x40, 0xeb, 0x00,
-	0x11, 0x80, 0xb7, 0x20, 0xdc, 0x0b, 0x51, 0x41, 0x63, 0x8d, 0x4f, 0x31, 0x85, 0x50, 0x1d, 0x6e,
-	0x2b, 0x78, 0xd6, 0xdf, 0x1b, 0x03, 0xc4, 0xdb, 0xa8, 0x87, 0x4e, 0x88, 0xeb, 0x38, 0x24, 0xdb,
-	0xc5, 0x55, 0xc8, 0x4a, 0xb3, 0x71, 0xf2, 0x6c, 0x50, 0xce, 0xba, 0x6d, 0x3b, 0xbb, 0xbd, 0x8e,
-	0x3e, 0x84, 0x09, 0x5a, 0x8d, 0xf2, 0x7a, 0x4e, 0xb6, 0xa7, 0x52, 0x60, 0x32, 0x1d, 0x90, 0x3f,
-	0x6d, 0x56, 0x19, 0x7d, 0x04, 0xf9, 0x75, 0xdc, 0xc1, 0x47, 0x4e, 0xe8, 0x09, 0xb9, 0x63, 0x86,
-	0x98, 0x00, 0x2a, 0x53, 0x14, 0xd5, 0x24, 0x1b, 0xb8, 0x8d, 0x9d, 0xc0, 0xeb, 0xaa, 0x1b, 0xb8,
-	0x4f, 0x21, 0xea, 0x06, 0xce, 0xea, 0xa0, 0x3f, 0xc8, 0xc0, 0x74, 0xa5, 0xdb, 0xe5, 0x06, 0x4e,
-	0xc0, 0x5d, 0xab, 0x8b, 0x77, 0xa5, 0x67, 0x7c, 0xc7, 0x39, 0xc4, 0x9d, 0x06, 0x31, 0x99, 0x83,
-	0xea, 0x0f, 0x44, 0xa7, 0xfe, 0xe9, 0xa0, 0xfc, 0xc5, 0xab, 0x38, 0xdb, 0xef, 0xee, 0xfb, 0x8e,
-	0x1b, 0x06, 0xd4, 0x8f, 0x15, 0x35, 0xa8, 0x8a, 0x99, 0xd2, 0x0f, 0xf4, 0x2e, 0x4c, 0x10, 0xf9,
-	0x16, 0x76, 0x00, 0x9d, 0x6c, 0xb2, 0x0e, 0xb4, 0xc3, 0x0f, 0xad, 0x61, 0xdd, 0x82, 0x3c, 0xe7,
-	0xe4, 0xf6, 0xba, 0x69, 0x0a, 0xac, 0x75, 0xb8, 0x41, 0xad, 0x38, 0x4c, 0x24, 0x97, 0x7a, 0x73,
-	0xb8, 0x24, 0x46, 0x66, 0xff, 0x14, 0x05, 0x4b, 0x6c, 0x3a, 0x21, 0xd4, 0x1b, 0x64, 0x8b, 0x12,
-	0xab, 0x06, 0xcb, 0x9b, 0x38, 0xb4, 0x71, 0x80, 0xc3, 0x3d, 0x27, 0x08, 0x5e, 0x78, 0x7e, 0x9b,
-	0x16, 0x5d, 0x88, 0xc8, 0xdf, 0xca, 0x40, 0xb9, 0xe6, 0x63, 0x32, 0xd3, 0x46, 0x42, 0xc3, 0x57,
-	0xf0, 0x32, 0xbf, 0x5c, 0xc8, 0x46, 0xa5, 0x84, 0xd7, 0xfc, 0x02, 0xe1, 0x1d, 0x18, 0xdb, 0xdf,
-	0xdf, 0xa1, 0x12, 0x33, 0x46, 0x19, 0x37, 0x16, 0x86, 0x9d, 0xdf, 0x0c, 0xca, 0xb9, 0xf5, 0x3e,
-	0xbb, 0x7c, 0xb0, 0x49, 0xb9, 0xf5, 0x0c, 0x16, 0x6d, 0xdc, 0xc5, 0x2f, 0x9c, 0xc3, 0x0e, 0xd6,
-	0xcc, 0xd5, 0x32, 0x4c, 0x30, 0x67, 0x59, 0x62, 0x08, 0x0c, 0xae, 0xdb, 0xb3, 0xd9, 0x11, 0xf6,
-	0xac, 0xf5, 0x87, 0x19, 0x28, 0xb0, 0xe1, 0x56, 0xbd, 0xf0, 0x7c, 0xe3, 0xe3, 0x23, 0xc8, 0x0e,
-	0x1f, 0x01, 0xba, 0x1d, 0x71, 0x7b, 0x2c, 0xda, 0xfc, 0x68, 0x57, 0x89, 0x0e, 0x17, 0x85, 0x64,
-	0x40, 0x4c, 0x96, 0xd8, 0xd1, 0x88, 0x0e, 0x88, 0xca, 0x92, 0x90, 0xa0, 0x3f, 0xce, 0xc2, 0x15,
-	0xa5, 0x8b, 0x41, 0xcf, 0xeb, 0x06, 0x98, 0x9c, 0xf1, 0x88, 0xb0, 0x28, 0xfd, 0xa4, 0x67, 0x3c,
-	0xb2, 0x65, 0x36, 0x23, 0x4b, 0x9c, 0x76, 0xf8, 0x5d, 0x72, 0xb8, 0xe8, 0x24, 0x8e, 0x83, 0x54,
-	0x71, 0xb3, 0xaa, 0xa2, 0xf8, 0xdc, 0x9d, 0xbe, 0x07, 0x39, 0xfa, 0x27, 0x61, 0xc4, 0xb8, 0x99,
-	0x11, 0xb2, 0x12, 0x72, 0x01, 0x1e, 0x7a, 0x6e, 0xf7, 0x31, 0x0e, 0x8f, 0x3d, 0x71, 0x78, 0xde,
-	0x26, 0x4a, 0xec, 0x2f, 0x79, 0x6e, 0xb7, 0x79, 0x4a, 0xc1, 0x17, 0x3d, 0x74, 0x46, 0x04, 0x6d,
-	0x85, 0xb8, 0x75, 0x1f, 0x0a, 0x44, 0xdf, 0x9c, 0x7f, 0x46, 0xad, 0x05, 0x40, 0x9b, 0x38, 0xac,
-	0x7a, 0xda, 0xc6, 0x61, 0xcd, 0xc2, 0xf4, 0x9e, 0xdb, 0x3d, 0x12, 0x9f, 0xff, 0x2e, 0x0b, 0x33,
-	0xec, 0x9b, 0xcf, 0x40, 0x6c, 0x27, 0xcd, 0x9c, 0x67, 0x27, 0xfd, 0x14, 0x66, 0xb9, 0x3b, 0x07,
-	0xfb, 0xd4, 0x85, 0xcc, 0xe6, 0x83, 0x9e, 0x28, 0x99, 0x57, 0xa7, 0xf9, 0x9c, 0x95, 0xd8, 0x7a,
-	0x45, 0xb4, 0x03, 0x73, 0x0c, 0xf0, 0x00, 0x3b, 0x61, 0x3f, 0x3a, 0x55, 0x5d, 0xe6, 0x76, 0xa6,
-	0x00, 0x33, 0x65, 0xc4, 0x69, 0x3d, 0xe3, 0x40, 0x3b, 0x86, 0x8b, 0xbe, 0x81, 0xcb, 0x7b, 0xbe,
-	0xf7, 0xd3, 0x4b, 0xc5, 0x76, 0x60, 0xfa, 0x78, 0x91, 0x1c, 0xc2, 0x7a, 0xa4, 0xa8, 0xa9, 0x5a,
-	0x10, 0xf1, 0xda, 0x44, 0xa6, 0xb6, 0x83, 0xaa, 0xe7, 0xbb, 0xdd, 0x23, 0x3a, 0x9b, 0x39, 0x26,
-	0x53, 0x6e, 0xd0, 0x3c, 0xa4, 0x40, 0x5b, 0x16, 0x5b, 0x7f, 0x34, 0x06, 0x39, 0xd9, 0xf0, 0x5d,
-	0xd5, 0x2c, 0xe5, 0x9b, 0x31, 0x5d, 0x9e, 0xd1, 0xe1, 0xc7, 0x56, 0x6a, 0xa0, 0x6b, 0xcc, 0x99,
-	0xc5, 0xcc, 0x80, 0x29, 0x22, 0x63, 0x4e, 0xaf, 0x47, 0x5d, 0x56, 0x44, 0x99, 0xae, 0x57, 0x29,
-	0x17, 0x72, 0x4c, 0x99, 0xb6, 0x0f, 0xed, 0xec, 0x7a, 0x95, 0xcc, 0xf5, 0x93, 0xed, 0xf5, 0x1a,
-	0x1d, 0x50, 0x8e, 0xcd, 0xb5, 0xe7, 0xb6, 0x5b, 0x36, 0x85, 0x92, 0xd2, 0x7a, 0xe5, 0xf1, 0x0e,
-	0xef, 0x34, 0x2d, 0x0d, 0x9c, 0xd3, 0x8e, 0x4d, 0xa1, 0xc4, 0x0e, 0x64, 0x7b, 0x74, 0xcd, 0xeb,
-	0x86, 0xbe, 0xd7, 0x09, 0xa8, 0xab, 0x20, 0xa7, 0x6d, 0xe7, 0x2d, 0x5e, 0x64, 0xc7, 0xaa, 0xa2,
-	0xa7, 0xb0, 0x54, 0x69, 0x3f, 0x77, 0xba, 0x2d, 0xdc, 0x66, 0x25, 0x4f, 0x3d, 0xff, 0xe4, 0x59,
-	0xc7, 0x7b, 0x11, 0xd0, 0x53, 0x5e, 0x8e, 0x9f, 0x17, 0x79, 0x95, 0x26, 0x27, 0xf7, 0x42, 0x54,
-	0xb2, 0x4d, 0xd8, 0x44, 0x45, 0xd4, 0x3a, 0x5e, 0xbf, 0x4d, 0x8f, 0x77, 0x39, 0xa6, 0x22, 0x5a,
-	0x04, 0x60, 0x33, 0x38, 0xe1, 0xd2, 0x56, 0xfd, 0x31, 0x3d, 0x9d, 0x71, 0x2e, 0x1d, 0x07, 0xa7,
-	0x36, 0x81, 0xa1, 0x77, 0x60, 0x4a, 0x98, 0xb4, 0xcc, 0x29, 0x40, 0x3d, 0x46, 0xc2, 0x94, 0x15,
-	0x65, 0xd6, 0x07, 0x70, 0x85, 0x2d, 0x9a, 0x73, 0x5b, 0x6a, 0xd6, 0x1e, 0x40, 0x1d, 0x9f, 0x3a,
-	0xbd, 0x63, 0x8f, 0x4c, 0x6c, 0x55, 0xfd, 0xe2, 0xa6, 0x0b, 0x92, 0x8e, 0x7e, 0x5e, 0xd0, 0x58,
-	0x13, 0xb6, 0xac, 0xa8, 0x69, 0x2b, 0x58, 0xd6, 0x7f, 0xc9, 0x02, 0xa2, 0x0e, 0xef, 0x7a, 0xe8,
-	0x63, 0xe7, 0x54, 0x74, 0xe3, 0x33, 0x98, 0x61, 0xfa, 0x8f, 0x81, 0x69, 0x77, 0x88, 0x5d, 0xc4,
-	0x04, 0x5f, 0x2d, 0xda, 0xba, 0x64, 0x6b, 0x55, 0x09, 0xaa, 0x8d, 0x83, 0xfe, 0xa9, 0x40, 0xcd,
-	0x6a, 0xa8, 0x6a, 0x11, 0x41, 0x55, 0xbf, 0xd1, 0x37, 0x30, 0x57, 0xf3, 0x4e, 0x7b, 0x84, 0x27,
-	0x1c, 0x79, 0x8c, 0x5b, 0x1f, 0xbc, 0x5d, 0xad, 0x70, 0xeb, 0x92, 0x1d, 0xab, 0x8e, 0x76, 0x61,
-	0xfe, 0x41, 0xa7, 0x1f, 0x1c, 0x57, 0xba, 0xed, 0x5a, 0xc7, 0x0b, 0x04, 0x95, 0x71, 0xee, 0x0c,
-	0xe1, 0xcb, 0x36, 0x59, 0x63, 0xeb, 0x92, 0x9d, 0x86, 0x88, 0xde, 0xe1, 0xb7, 0xf7, 0xdc, 0x0a,
-	0x9a, 0xbd, 0xcb, 0x2f, 0xf7, 0x9f, 0x74, 0xf1, 0x93, 0x67, 0x5b, 0x97, 0x6c, 0x56, 0x5a, 0xcd,
-	0xc3, 0x94, 0x50, 0x59, 0xf7, 0xe0, 0x8a, 0xc2, 0x4e, 0x62, 0xb7, 0xf5, 0x03, 0x54, 0x82, 0xdc,
-	0x41, 0xaf, 0xe3, 0x39, 0x6d, 0x61, 0x06, 0xd8, 0xf2, 0xdb, 0x7a, 0x5f, 0xe7, 0x34, 0x5a, 0x56,
-	0xcf, 0x22, 0xac, 0x72, 0x04, 0xb0, 0xb6, 0x74, 0xe6, 0x0e, 0xaf, 0xad, 0xb5, 0x9b, 0x8d, 0xb5,
-	0x5b, 0x88, 0xf3, 0xda, 0x5a, 0x4c, 0x65, 0x9e, 0xf5, 0x88, 0x9a, 0x38, 0x95, 0x5e, 0xaf, 0xe3,
-	0xb6, 0xe8, 0xce, 0xc0, 0xf4, 0x9a, 0xb4, 0x0e, 0x7e, 0x4b, 0xbd, 0x63, 0x56, 0xb6, 0x45, 0x79,
-	0xa3, 0xac, 0xdc, 0x22, 0x5b, 0xdf, 0xc3, 0x0d, 0x03, 0x31, 0xae, 0xe1, 0x3f, 0x83, 0x29, 0x0e,
-	0x8a, 0x09, 0xb4, 0xea, 0x95, 0xa7, 0xeb, 0x29, 0xe0, 0x98, 0xa2, 0xbe, 0xf5, 0x1d, 0xac, 0x1c,
-	0xf4, 0x02, 0xec, 0x27, 0xc9, 0x8b, 0xae, 0x7e, 0x2c, 0xef, 0xb0, 0x33, 0x46, 0x8f, 0x3f, 0x9c,
-	0x0d, 0xca, 0x93, 0x8c, 0xb6, 0xb8, 0xba, 0xb6, 0x7e, 0x3f, 0x03, 0x2b, 0x6c, 0xa9, 0x1a, 0x49,
-	0x5f, 0x84, 0x0b, 0x8a, 0x47, 0x39, 0x6b, 0xf6, 0x28, 0x0f, 0x75, 0xb1, 0x5b, 0xdf, 0x82, 0xc5,
-	0x7b, 0xd4, 0xe9, 0xbc, 0xa1, 0xb9, 0xf9, 0x1b, 0x19, 0x58, 0x60, 0x93, 0xf3, 0x1a, 0x54, 0xd0,
-	0x57, 0x30, 0x57, 0x3f, 0x71, 0x7b, 0x0d, 0xa7, 0xe3, 0xb6, 0x99, 0x73, 0x95, 0x6d, 0x24, 0x8b,
-	0x74, 0x8f, 0x3c, 0x71, 0x7b, 0xcd, 0xe7, 0x51, 0x51, 0xc6, 0x8e, 0x55, 0xb6, 0x9e, 0xc0, 0x62,
-	0xac, 0x0f, 0x5c, 0x30, 0x3e, 0x8e, 0x0b, 0x46, 0x22, 0x00, 0x21, 0x5d, 0x2a, 0x1e, 0xc3, 0x55,
-	0x29, 0x15, 0xfa, 0x94, 0xad, 0xc5, 0xa4, 0x21, 0x41, 0x30, 0x4d, 0x14, 0x5a, 0x70, 0x55, 0x4a,
-	0xc2, 0x6b, 0x48, 0x80, 0x98, 0xdc, 0x6c, 0xea, 0xe4, 0x6e, 0x43, 0x49, 0x9d, 0xdc, 0xd7, 0x99,
-	0xd4, 0xff, 0x9c, 0x81, 0xa5, 0x4d, 0xdc, 0xc5, 0xbe, 0x43, 0xbb, 0xac, 0x9d, 0x29, 0x54, 0xc7,
-	0x72, 0x66, 0xa8, 0x63, 0x59, 0x1a, 0xcc, 0xd9, 0x74, 0x83, 0x99, 0xec, 0x86, 0x07, 0xf6, 0x36,
-	0x97, 0x55, 0xba, 0x1b, 0xf6, 0x7d, 0xd7, 0x26, 0x30, 0xb4, 0x1d, 0x39, 0xa5, 0xc7, 0x47, 0x3a,
-	0xa5, 0xe7, 0xb9, 0x93, 0x6e, 0x8a, 0x3b, 0xa5, 0x35, 0x57, 0xb4, 0xf5, 0x05, 0x14, 0x93, 0x63,
-	0xe1, 0xf2, 0x31, 0xea, 0x90, 0x62, 0xad, 0x47, 0xd2, 0xcd, 0xef, 0xaf, 0xa5, 0x33, 0x3e, 0xa6,
-	0x42, 0x87, 0x38, 0x7f, 0xac, 0x7a, 0x24, 0x9f, 0x9c, 0x0a, 0x6f, 0xff, 0x73, 0x22, 0x9f, 0x2c,
-	0x46, 0x21, 0x63, 0x8e, 0x51, 0xe0, 0x32, 0xca, 0x50, 0x05, 0x82, 0xf5, 0x14, 0xae, 0x6a, 0x44,
-	0x23, 0xa9, 0xff, 0x0a, 0x72, 0x02, 0x16, 0xf3, 0x4d, 0x68, 0x64, 0xe9, 0xbc, 0x05, 0x02, 0x59,
-	0xa2, 0x58, 0xbf, 0xca, 0xc0, 0x12, 0xdb, 0x5d, 0x92, 0xe3, 0x3e, 0xff, 0xec, 0xff, 0xb9, 0x38,
-	0xbc, 0xee, 0xa7, 0x38, 0xbc, 0x28, 0x8a, 0xea, 0xf0, 0x52, 0xdd, 0x5c, 0x0f, 0xc7, 0x73, 0xd9,
-	0xc2, 0x98, 0xd5, 0x80, 0x62, 0x72, 0x84, 0x6f, 0x60, 0x4e, 0x36, 0x61, 0x49, 0x59, 0xe8, 0xaf,
-	0x2d, 0x31, 0x51, 0x8b, 0x6f, 0x50, 0x62, 0xa2, 0x8a, 0x6f, 0x4c, 0x62, 0xb6, 0x61, 0x9e, 0x11,
-	0xd6, 0x57, 0xd7, 0xaa, 0xba, 0xba, 0x52, 0xe3, 0x65, 0x92, 0x0b, 0xee, 0x31, 0x5d, 0x70, 0xa2,
-	0x4a, 0xd4, 0xc3, 0x8f, 0x60, 0x92, 0x87, 0x04, 0xb2, 0xfe, 0xa5, 0x10, 0xa3, 0x9a, 0x97, 0xc5,
-	0x01, 0xda, 0xbc, 0xb2, 0x55, 0xa4, 0x43, 0x26, 0xe7, 0x14, 0xee, 0xf0, 0x96, 0xa7, 0xc6, 0x6f,
-	0x89, 0x8a, 0x8b, 0x95, 0xbc, 0xe6, 0xae, 0xf1, 0x04, 0x8a, 0x6c, 0xd7, 0x50, 0xa8, 0xbe, 0xd6,
-	0xbe, 0xf1, 0x29, 0x14, 0x99, 0x38, 0xa5, 0x10, 0x1c, 0xbe, 0x19, 0xac, 0xc0, 0xb2, 0xdc, 0x0c,
-	0xd2, 0x46, 0xff, 0x77, 0x32, 0x70, 0x6d, 0x13, 0x87, 0x7a, 0xd4, 0xd4, 0xff, 0x97, 0xbd, 0xfb,
-	0x07, 0x28, 0xa5, 0x75, 0x84, 0x4f, 0xc5, 0xd7, 0xf1, 0xa9, 0x30, 0x86, 0x88, 0xa5, 0x4f, 0xc9,
-	0xf7, 0x70, 0x9d, 0x4d, 0x89, 0x5e, 0x5f, 0x0c, 0xf4, 0x8b, 0xd8, 0xac, 0x18, 0xa9, 0xa7, 0xcd,
-	0xce, 0xdf, 0xcf, 0xc0, 0x75, 0xc6, 0xe4, 0x74, 0xe2, 0x7f, 0xde, 0xd6, 0xdd, 0x2e, 0x94, 0xe5,
-	0x9c, 0xbf, 0x81, 0x89, 0xb5, 0x5a, 0x80, 0x04, 0x99, 0x5a, 0xdd, 0x16, 0x24, 0xae, 0xc1, 0x58,
-	0xad, 0x6e, 0xf3, 0x0b, 0x68, 0xba, 0x69, 0xb7, 0x02, 0xdf, 0x26, 0xb0, 0xb8, 0x06, 0xcf, 0x9e,
-	0x43, 0x83, 0x5b, 0x3f, 0x87, 0x79, 0xad, 0x11, 0x3e, 0xef, 0xcb, 0x30, 0x5e, 0xc3, 0x7e, 0xc8,
-	0x9b, 0xa1, 0x23, 0x6d, 0x61, 0x3f, 0xb4, 0x29, 0x14, 0xdd, 0x86, 0xa9, 0x5a, 0x85, 0x7a, 0x1b,
-	0xa9, 0x6d, 0x31, 0xc3, 0x14, 0x53, 0xcb, 0x69, 0xd2, 0x48, 0x72, 0x5b, 0x14, 0x5a, 0xff, 0x3e,
-	0xa3, 0x50, 0x27, 0xe8, 0xa3, 0xc7, 0xf0, 0x01, 0x39, 0x1e, 0x13, 0x9e, 0x29, 0x43, 0xb8, 0x42,
-	0xb6, 0x2d, 0xee, 0xa9, 0x61, 0x3b, 0x9f, 0xad, 0x54, 0x3a, 0xa7, 0xa7, 0x54, 0xdc, 0xcc, 0x31,
-	0x24, 0xe1, 0x45, 0x94, 0x37, 0x73, 0x9c, 0x74, 0x60, 0xab, 0x95, 0xac, 0x1f, 0x60, 0x41, 0xef,
-	0xff, 0x1b, 0x65, 0xcf, 0xdb, 0xf4, 0xca, 0x47, 0xb9, 0x2c, 0x45, 0x48, 0x75, 0x24, 0x70, 0xb1,
-	0xfa, 0x04, 0x0a, 0xbc, 0x56, 0xb4, 0x2c, 0x6f, 0x09, 0xd3, 0x8e, 0x2d, 0x4a, 0x3d, 0xb8, 0x58,
-	0xf8, 0x43, 0x7f, 0x26, 0x5c, 0x15, 0xa3, 0x5a, 0xf8, 0x47, 0x19, 0x28, 0x3e, 0x7e, 0x50, 0xa9,
-	0xf4, 0xc3, 0x63, 0xdc, 0x0d, 0xc9, 0xa1, 0x04, 0xd7, 0x8e, 0x9d, 0x4e, 0x07, 0x77, 0x8f, 0x30,
-	0xba, 0x03, 0xe3, 0xfb, 0x4f, 0xf6, 0xf7, 0xb8, 0x47, 0x60, 0x81, 0x1f, 0xc7, 0x09, 0x48, 0xd6,
-	0xb1, 0x69, 0x0d, 0xf4, 0x08, 0xae, 0x3c, 0xe5, 0xe1, 0xfc, 0xb2, 0x88, 0xfb, 0x02, 0x6e, 0xdc,
-	0x95, 0x81, 0xfe, 0x35, 0x1f, 0xb7, 0x49, 0x2b, 0x4e, 0xa7, 0x12, 0x10, 0xc5, 0x40, 0xe6, 0x27,
-	0x89, 0xf7, 0x70, 0x3c, 0x97, 0x29, 0x64, 0xad, 0x3f, 0xc8, 0xc0, 0x52, 0xac, 0x67, 0x8a, 0x63,
-	0x57, 0xed, 0xd8, 0xbc, 0xd2, 0x31, 0x51, 0x65, 0xeb, 0x12, 0xef, 0x59, 0x8d, 0xc6, 0x8e, 0xd2,
-	0x16, 0x78, 0x87, 0xde, 0x19, 0xde, 0xa1, 0x88, 0x80, 0x44, 0xe4, 0x91, 0x5f, 0x14, 0x6e, 0x5d,
-	0x86, 0x59, 0x8d, 0x03, 0x96, 0x05, 0x33, 0x6a, 0xcb, 0x84, 0xcd, 0x35, 0xaf, 0x2d, 0xd9, 0x4c,
-	0xfe, 0xb6, 0xfe, 0x41, 0x06, 0x16, 0x1e, 0x3f, 0xa8, 0xd8, 0xf8, 0xc8, 0x25, 0xcb, 0x2f, 0x62,
-	0xf1, 0xaa, 0x36, 0x92, 0x65, 0x6d, 0x24, 0xb1, 0xba, 0x72, 0x48, 0x9f, 0x27, 0x86, 0xb4, 0x9c,
-	0x36, 0x24, 0x6a, 0x65, 0xb9, 0x5e, 0x57, 0x1b, 0x89, 0xe2, 0xf9, 0xf8, 0xc7, 0x19, 0x98, 0x57,
-	0xfa, 0x24, 0xfb, 0xff, 0x81, 0xd6, 0xa5, 0xeb, 0x29, 0x5d, 0x4a, 0x30, 0xb9, 0x9a, 0xe8, 0xd1,
-	0xdb, 0xc3, 0x7a, 0x34, 0x92, 0xc7, 0x7f, 0x92, 0x81, 0xc5, 0x54, 0x1e, 0xa0, 0xab, 0x64, 0xd7,
-	0x68, 0xf9, 0x38, 0xe4, 0xec, 0xe5, 0x5f, 0x04, 0xbe, 0x1d, 0x04, 0x7d, 0xfe, 0xd6, 0x22, 0x6f,
-	0xf3, 0x2f, 0xf4, 0x36, 0xcc, 0xee, 0x61, 0xdf, 0xf5, 0xda, 0x75, 0xdc, 0xf2, 0xba, 0x6d, 0xe6,
-	0x11, 0x9e, 0xb5, 0x75, 0x20, 0x5a, 0x86, 0x7c, 0xa5, 0x73, 0xe4, 0xf9, 0x6e, 0x78, 0xcc, 0x9c,
-	0x4f, 0x79, 0x3b, 0x02, 0x10, 0xda, 0xeb, 0xee, 0x91, 0x1b, 0xb2, 0xbb, 0xb5, 0x59, 0x9b, 0x7f,
-	0xa1, 0x22, 0x4c, 0x55, 0x5a, 0x2d, 0xaf, 0xdf, 0x0d, 0xa9, 0x07, 0x34, 0x6f, 0x8b, 0x4f, 0x82,
-	0xf1, 0xad, 0x4d, 0x85, 0x80, 0x46, 0x43, 0xd9, 0xfc, 0xcb, 0x7a, 0x0f, 0x16, 0xd2, 0xf8, 0x98,
-	0x2a, 0x32, 0x7f, 0x2d, 0x0b, 0xf3, 0x95, 0x76, 0xfb, 0xf1, 0x83, 0xca, 0x3a, 0x56, 0x8d, 0x8f,
-	0x0f, 0x61, 0x7c, 0xbb, 0xeb, 0x86, 0x7c, 0xd7, 0x5c, 0xe1, 0xd3, 0x93, 0x52, 0x93, 0xd4, 0x22,
-	0x33, 0x44, 0xfe, 0x47, 0x36, 0xcc, 0x6f, 0xfc, 0xe4, 0x06, 0xa1, 0xdb, 0x3d, 0xa2, 0x73, 0xce,
-	0x1a, 0xe6, 0x73, 0x2c, 0x88, 0x18, 0x96, 0xdb, 0xd6, 0x25, 0x3b, 0x0d, 0x19, 0xed, 0xc3, 0xd5,
-	0x5d, 0xfc, 0x22, 0x45, 0x84, 0x64, 0x30, 0x93, 0x24, 0x9b, 0x22, 0x39, 0x06, 0x5c, 0x55, 0x42,
-	0xff, 0x76, 0x96, 0x46, 0xc8, 0x29, 0x03, 0xe3, 0x2d, 0x1f, 0xc0, 0x82, 0xd2, 0xa1, 0x48, 0xe3,
-	0x64, 0x78, 0xec, 0x74, 0xea, 0x70, 0xd4, 0x85, 0x94, 0x8a, 0x8e, 0x9e, 0xc2, 0x92, 0xde, 0xa9,
-	0x88, 0xb2, 0xbe, 0x18, 0xd2, 0xaa, 0x6c, 0x5d, 0xb2, 0x4d, 0xd8, 0x68, 0x15, 0xc6, 0x2a, 0xad,
-	0x13, 0xce, 0x96, 0xf4, 0x29, 0x63, 0x23, 0xab, 0xb4, 0x4e, 0x68, 0xb4, 0x69, 0xeb, 0x44, 0x5b,
-	0x0f, 0xff, 0x21, 0x03, 0x4b, 0x86, 0x19, 0x46, 0x2b, 0x00, 0x0c, 0xa8, 0xe8, 0x76, 0x05, 0x42,
-	0x76, 0x55, 0xf6, 0x45, 0x2f, 0x1c, 0xc7, 0xe8, 0xfd, 0xb5, 0x88, 0x0b, 0x8a, 0x0a, 0x6c, 0xa5,
-	0x12, 0xda, 0x83, 0x69, 0xf6, 0xc5, 0xc2, 0x93, 0xc6, 0x29, 0x0e, 0xd2, 0x70, 0x58, 0x3c, 0x12,
-	0x8d, 0x39, 0x68, 0x53, 0x40, 0x33, 0x1e, 0x96, 0xa4, 0x92, 0xe0, 0x47, 0xbf, 0x5a, 0x7c, 0x14,
-	0x72, 0xd0, 0xe8, 0x0e, 0x4c, 0x32, 0x20, 0x9f, 0x43, 0xf1, 0xea, 0x25, 0xaa, 0xcc, 0xcb, 0xad,
-	0x3f, 0xcc, 0x08, 0x8f, 0x4e, 0x62, 0x69, 0x7c, 0xa2, 0x2d, 0x8d, 0xb7, 0x64, 0x87, 0xd3, 0x2a,
-	0x6b, 0xab, 0xa3, 0x0a, 0xd3, 0xaf, 0xb2, 0x2a, 0x54, 0x24, 0x55, 0x6e, 0xff, 0x79, 0x46, 0x9c,
-	0x45, 0x93, 0xa2, 0xbb, 0x01, 0x33, 0xaf, 0x26, 0xb2, 0x1a, 0x1a, 0xfa, 0x88, 0x49, 0x54, 0x76,
-	0xf8, 0x48, 0x87, 0x0a, 0xd5, 0x97, 0xc2, 0x69, 0xf5, 0x2a, 0x62, 0x65, 0x2d, 0xa7, 0x60, 0xcb,
-	0xe6, 0xac, 0x7e, 0xa2, 0xb4, 0xfe, 0xb2, 0xdb, 0x12, 0xf3, 0x74, 0x3b, 0x7e, 0xc9, 0x6e, 0xbc,
-	0x41, 0x55, 0xfb, 0x90, 0x8d, 0xfc, 0x18, 0x5c, 0xe4, 0xa8, 0x49, 0xab, 0x76, 0xea, 0x2c, 0xb6,
-	0x4e, 0x5e, 0xa5, 0xd1, 0x1a, 0xcc, 0xee, 0xe2, 0x17, 0x89, 0x76, 0xe9, 0xbd, 0x54, 0x17, 0xbf,
-	0x68, 0x2a, 0x6d, 0x2b, 0xd2, 0xae, 0xe3, 0xa0, 0x43, 0x98, 0x13, 0xba, 0xe0, 0xbc, 0x2a, 0x91,
-	0x45, 0x5c, 0x92, 0x16, 0x4e, 0x9f, 0x39, 0x4d, 0x9f, 0x43, 0xd5, 0x50, 0x49, 0x9d, 0xa2, 0xb5,
-	0x07, 0xc5, 0xe4, 0x58, 0xb9, 0x94, 0x7d, 0x38, 0x6a, 0x39, 0xb1, 0x53, 0x55, 0x5b, 0x5f, 0x5a,
-	0x5b, 0xd4, 0x01, 0x20, 0xeb, 0xc8, 0xa3, 0xcb, 0xfd, 0x38, 0xeb, 0x68, 0x14, 0x99, 0x60, 0x9d,
-	0x1a, 0xd2, 0x1d, 0x85, 0x59, 0x2c, 0xc6, 0x28, 0xf1, 0x8e, 0xbd, 0x07, 0x53, 0x1c, 0x24, 0x43,
-	0xe5, 0xe3, 0x0b, 0x5d, 0x54, 0xb0, 0xfe, 0x49, 0x06, 0xae, 0x1d, 0x04, 0xd8, 0xaf, 0xbb, 0xdd,
-	0xa3, 0x0e, 0x3e, 0x08, 0xf4, 0x20, 0x87, 0xdf, 0xd6, 0x16, 0xfb, 0x92, 0x21, 0x78, 0xf2, 0xff,
-	0xd5, 0x12, 0xff, 0x67, 0x19, 0x28, 0xa5, 0xf5, 0xed, 0xcd, 0xae, 0xf2, 0xbb, 0xfc, 0xac, 0xc1,
-	0x7a, 0x5b, 0xe4, 0xe8, 0xb2, 0x4d, 0x31, 0x58, 0x32, 0x48, 0xf2, 0xbf, 0xb6, 0xbc, 0xff, 0x77,
-	0x06, 0x16, 0xb6, 0x03, 0xda, 0xfd, 0x5f, 0xf4, 0x5d, 0x1f, 0xb7, 0x05, 0xe3, 0xee, 0xa6, 0x85,
-	0xd8, 0xd2, 0x79, 0xdd, 0xba, 0x94, 0x16, 0x42, 0xfb, 0xa1, 0x12, 0x44, 0x98, 0x1d, 0x16, 0x3b,
-	0xab, 0xbd, 0xd7, 0xb8, 0x0d, 0xe3, 0xbb, 0xc4, 0xa4, 0x19, 0xe3, 0xf2, 0xc7, 0x30, 0x08, 0x88,
-	0xc6, 0xfb, 0x91, 0x2e, 0x93, 0x0f, 0xf4, 0x20, 0x11, 0x55, 0x38, 0x3e, 0x3a, 0x36, 0x34, 0xf9,
-	0xd0, 0xa4, 0x9a, 0x83, 0xc9, 0x7d, 0xc7, 0x3f, 0xc2, 0xa1, 0xf5, 0x3d, 0x94, 0xf8, 0x65, 0x1e,
-	0xf3, 0x91, 0xd1, 0x2b, 0xbf, 0x20, 0xf2, 0xdd, 0x0c, 0xbb, 0x80, 0x5b, 0x01, 0xa8, 0x87, 0x8e,
-	0x1f, 0x6e, 0x77, 0xdb, 0xf8, 0x27, 0x3a, 0xda, 0x09, 0x5b, 0x81, 0x58, 0x1f, 0x41, 0x5e, 0x0e,
-	0x81, 0x9e, 0xa7, 0x14, 0xab, 0x8d, 0x0e, 0x67, 0x41, 0x8b, 0x73, 0x14, 0xc1, 0x8d, 0x6b, 0xb0,
-	0x18, 0x9b, 0x0a, 0x2e, 0x27, 0x25, 0x32, 0x61, 0x0c, 0xc6, 0x2e, 0xfa, 0x6d, 0xf9, 0x6d, 0xd5,
-	0xe0, 0x4a, 0x62, 0xa6, 0x11, 0xa2, 0xb1, 0xab, 0xec, 0xf0, 0x49, 0x94, 0x7a, 0xbd, 0xbe, 0x45,
-	0x60, 0xfb, 0x3b, 0x75, 0x16, 0xc7, 0x43, 0x60, 0xfb, 0x3b, 0xf5, 0xea, 0x24, 0x93, 0x1c, 0xeb,
-	0x5f, 0x65, 0xe9, 0x11, 0x32, 0xc1, 0x83, 0x98, 0x2b, 0x42, 0x75, 0x87, 0x54, 0x21, 0x4f, 0x47,
-	0xbc, 0x2e, 0xe2, 0xdd, 0x86, 0xdf, 0x00, 0xe4, 0x7e, 0x39, 0x28, 0x5f, 0xa2, 0x6e, 0xff, 0x08,
-	0x0d, 0x7d, 0x0d, 0x53, 0x1b, 0xdd, 0x36, 0xa5, 0x30, 0x76, 0x01, 0x0a, 0x02, 0x89, 0xcc, 0x03,
-	0xed, 0x32, 0x31, 0x47, 0xf8, 0x79, 0xdd, 0x56, 0x20, 0x94, 0xcd, 0xee, 0xa9, 0xcb, 0xee, 0x79,
-	0x27, 0x6c, 0xf6, 0x41, 0xb8, 0x49, 0xbb, 0x20, 0x9e, 0x2f, 0xe4, 0x6d, 0xf9, 0x8d, 0x2c, 0x98,
-	0x78, 0xe2, 0xb7, 0x79, 0x30, 0xf9, 0xdc, 0xea, 0x8c, 0x78, 0xcf, 0x4d, 0x60, 0x36, 0x2b, 0xb2,
-	0xfe, 0x27, 0xbd, 0x7b, 0x09, 0x53, 0xe5, 0x46, 0xe3, 0x4a, 0xe6, 0xb5, 0xb9, 0x92, 0x7d, 0x15,
-	0xae, 0xc8, 0x51, 0x8f, 0x99, 0x46, 0x3d, 0x6e, 0x1a, 0xf5, 0x84, 0x79, 0xd4, 0x9b, 0x30, 0xc9,
-	0x86, 0x8a, 0x6e, 0xc1, 0xc4, 0x76, 0x88, 0x4f, 0x23, 0xd7, 0x82, 0x7a, 0x7b, 0x6e, 0xb3, 0x32,
-	0x72, 0xea, 0xd9, 0x71, 0x82, 0x50, 0x44, 0x8e, 0xe5, 0x6d, 0xf1, 0x69, 0xfd, 0x69, 0x06, 0x0a,
-	0x3b, 0x6e, 0x10, 0x92, 0x85, 0x70, 0x4e, 0x59, 0x93, 0x23, 0xca, 0x9a, 0x46, 0x34, 0x16, 0x1b,
-	0xd1, 0x17, 0x30, 0x49, 0x03, 0x1a, 0x03, 0xfe, 0x54, 0xe9, 0x16, 0x1f, 0x52, 0xbc, 0x61, 0x16,
-	0xf6, 0x18, 0xd0, 0x27, 0x45, 0x36, 0x47, 0x29, 0x7d, 0x06, 0xd3, 0x0a, 0xf8, 0x42, 0x2f, 0x8d,
-	0xbe, 0x83, 0x2b, 0x4a, 0x13, 0xd2, 0x0f, 0x31, 0xc2, 0x5b, 0x2d, 0xbd, 0xa1, 0x84, 0x6d, 0xbb,
-	0xf8, 0x27, 0x95, 0x6d, 0xfc, 0xd3, 0xfa, 0x91, 0xc6, 0xe3, 0xee, 0x78, 0xad, 0x13, 0xc5, 0x57,
-	0x38, 0xc5, 0x94, 0x59, 0xdc, 0xe5, 0x4e, 0x6a, 0xb1, 0x12, 0x5b, 0xd4, 0x40, 0x37, 0x61, 0x7a,
-	0xbb, 0xfb, 0xc0, 0xf3, 0x5b, 0xf8, 0x49, 0xb7, 0xc3, 0xa8, 0xe7, 0x6c, 0x15, 0xc4, 0xdd, 0x48,
-	0xbc, 0x85, 0xc8, 0x8d, 0x44, 0x01, 0x31, 0x37, 0x12, 0x7b, 0x29, 0x69, 0xb3, 0x32, 0xee, 0xa5,
-	0x22, 0x7f, 0x0f, 0xf3, 0x21, 0x49, 0x67, 0xd3, 0xa8, 0x8a, 0x87, 0x70, 0xcd, 0xc6, 0xbd, 0x8e,
-	0x43, 0x6c, 0xc5, 0x53, 0x8f, 0xd5, 0x97, 0x63, 0xbe, 0x99, 0x12, 0x2a, 0xa6, 0xdf, 0x38, 0xc9,
-	0x2e, 0x67, 0x87, 0x74, 0xf9, 0x14, 0xde, 0xda, 0xc4, 0x61, 0xea, 0x73, 0xc7, 0x68, 0xf0, 0x5b,
-	0x90, 0xe3, 0x21, 0xf9, 0x62, 0xfc, 0xa3, 0x5e, 0x5a, 0xf2, 0xeb, 0x17, 0x4e, 0x47, 0xfe, 0x65,
-	0x7d, 0x03, 0x65, 0x53, 0x73, 0xe7, 0x8b, 0x10, 0x72, 0xe1, 0xa6, 0x99, 0x80, 0xb4, 0x26, 0xa6,
-	0x78, 0x83, 0xf2, 0xd4, 0x3f, 0xbc, 0xb7, 0xd2, 0x21, 0x4f, 0xed, 0x29, 0xfe, 0x87, 0x55, 0x15,
-	0x21, 0x08, 0xaf, 0xd1, 0xdd, 0x26, 0xbd, 0x32, 0xd0, 0x09, 0x44, 0x7c, 0xad, 0x40, 0x4e, 0xc0,
-	0x62, 0x77, 0x06, 0x89, 0x97, 0xa4, 0x94, 0xa1, 0x6d, 0x41, 0x40, 0xa2, 0x59, 0x3f, 0x0a, 0xc7,
-	0xbe, 0x8e, 0x71, 0xbe, 0xb0, 0xd3, 0xf3, 0x78, 0xf2, 0x2d, 0x0f, 0xae, 0xe9, 0xb4, 0x55, 0xf7,
-	0x74, 0x41, 0x71, 0x4f, 0x33, 0xaf, 0x34, 0x91, 0x4b, 0x7b, 0x67, 0xa3, 0xdb, 0xee, 0x79, 0x6e,
-	0x37, 0xe4, 0x8b, 0x57, 0x05, 0xa1, 0x15, 0xd5, 0x09, 0x3d, 0x93, 0x8c, 0xd3, 0xbd, 0x0f, 0xa5,
-	0xb4, 0x06, 0x15, 0xdf, 0x8f, 0xf4, 0x27, 0x33, 0x3b, 0xce, 0x3a, 0x86, 0x05, 0x2d, 0x37, 0x47,
-	0x94, 0x6c, 0x20, 0xca, 0x49, 0x92, 0xaf, 0x7e, 0xf9, 0x9b, 0x41, 0xf9, 0xd3, 0x8b, 0x04, 0x83,
-	0x0a, 0x9a, 0xfb, 0x32, 0xd4, 0xd8, 0x5a, 0x82, 0xb1, 0x9a, 0xbd, 0x43, 0x87, 0x6d, 0xef, 0xc8,
-	0x61, 0xdb, 0x3b, 0xd6, 0x6f, 0x32, 0x50, 0xae, 0x1d, 0x3b, 0xdd, 0x23, 0x6a, 0x7b, 0x28, 0xe6,
-	0xaa, 0x72, 0xaf, 0x7a, 0xde, 0x23, 0xd5, 0x2a, 0x4c, 0xef, 0xe2, 0x17, 0x22, 0x4c, 0x9a, 0x07,
-	0x1c, 0x53, 0xf7, 0x3b, 0x39, 0xee, 0xf4, 0x38, 0xdc, 0x56, 0x2b, 0xa1, 0xbf, 0xfc, 0xea, 0xce,
-	0x25, 0xf6, 0x42, 0x3f, 0x3a, 0x49, 0xb1, 0xd2, 0xb4, 0x23, 0x95, 0xa1, 0x09, 0xeb, 0xdf, 0x64,
-	0xe0, 0xa6, 0x79, 0xf0, 0x7c, 0xe2, 0xd6, 0xb5, 0x3c, 0x07, 0x43, 0x6e, 0x84, 0xe9, 0x91, 0x55,
-	0xc9, 0x73, 0x10, 0xcf, 0x6d, 0x60, 0xe3, 0x96, 0xf7, 0x1c, 0xfb, 0x2f, 0x63, 0x7e, 0x76, 0x01,
-	0xae, 0x91, 0x2d, 0x47, 0x64, 0x89, 0x61, 0x20, 0xed, 0x69, 0x23, 0x87, 0x59, 0xff, 0x29, 0x03,
-	0xd7, 0xe9, 0x36, 0xc9, 0xbd, 0x90, 0xa2, 0xe0, 0xe2, 0xf1, 0x03, 0x1f, 0xc1, 0x8c, 0xda, 0x38,
-	0x9f, 0x30, 0xfa, 0x30, 0x5a, 0xf4, 0xa0, 0xd9, 0xf2, 0xda, 0xd8, 0xd6, 0xaa, 0xa1, 0x6d, 0x98,
-	0xe6, 0xdf, 0x8a, 0xab, 0x69, 0x51, 0xc9, 0x9a, 0x42, 0xe5, 0x81, 0x79, 0x8e, 0xe8, 0xec, 0x73,
-	0x62, 0x4d, 0x1a, 0xfa, 0xae, 0xe2, 0x5a, 0xbf, 0xce, 0xc2, 0x72, 0x03, 0xfb, 0xee, 0xb3, 0x97,
-	0x86, 0xc1, 0x3c, 0x81, 0x05, 0x01, 0xa2, 0x63, 0xd6, 0xe5, 0x90, 0x3d, 0x51, 0x13, 0x5d, 0x0d,
-	0x48, 0x85, 0xa6, 0x14, 0xcb, 0x54, 0xc4, 0x0b, 0x3c, 0xda, 0xfc, 0x10, 0x72, 0x52, 0x94, 0xc7,
-	0x28, 0x67, 0xe8, 0xdc, 0x08, 0x31, 0xd6, 0xdf, 0xaf, 0x4b, 0x79, 0xfe, 0x9b, 0xe6, 0xeb, 0x0c,
-	0x7e, 0xe2, 0x19, 0x71, 0x18, 0x65, 0x52, 0x4d, 0x24, 0xda, 0x51, 0x4a, 0x53, 0xa4, 0x7a, 0xeb,
-	0x92, 0x6d, 0x6a, 0xa9, 0x3a, 0x0d, 0xf9, 0x0a, 0xbd, 0x6c, 0x21, 0x07, 0x8c, 0xff, 0x95, 0x85,
-	0x15, 0x11, 0x52, 0x68, 0x60, 0xf3, 0x77, 0xb0, 0x24, 0x40, 0x95, 0x5e, 0xcf, 0xf7, 0x9e, 0xe3,
-	0xb6, 0xce, 0x69, 0xf6, 0x4c, 0x54, 0x70, 0xda, 0xe1, 0x75, 0x22, 0x66, 0x9b, 0xd0, 0xdf, 0x8c,
-	0x9b, 0xe5, 0x6b, 0x5d, 0xb1, 0xb0, 0xd9, 0xa0, 0x4e, 0x49, 0x55, 0xb1, 0xe8, 0x09, 0x7e, 0x54,
-	0x25, 0xd3, 0x4e, 0xb8, 0x69, 0xc6, 0x5f, 0xd7, 0x4d, 0x43, 0x8e, 0xa6, 0x3a, 0xcd, 0xea, 0x1c,
-	0xcc, 0xec, 0xe2, 0x17, 0x11, 0xdf, 0x7f, 0x2f, 0x03, 0xb3, 0xda, 0xe2, 0x46, 0xef, 0xc2, 0x04,
-	0xfd, 0x83, 0x6e, 0x9a, 0xfc, 0xad, 0x0c, 0x59, 0x60, 0xda, 0x5b, 0x19, 0x56, 0x75, 0x1b, 0xa6,
-	0x58, 0xf8, 0x4c, 0xfb, 0x1c, 0x67, 0x08, 0x19, 0x9d, 0xd5, 0x62, 0x28, 0xec, 0x38, 0xc1, 0xf1,
-	0xad, 0x47, 0xf0, 0x16, 0x8f, 0xc4, 0xd1, 0x27, 0xbf, 0xa6, 0xda, 0xef, 0xe7, 0xd4, 0xf1, 0x96,
-	0x03, 0x2b, 0x9b, 0x38, 0xae, 0x7a, 0xb4, 0xe8, 0xb5, 0x6f, 0xe0, 0xb2, 0x06, 0x97, 0x14, 0x69,
-	0x3c, 0xbd, 0x94, 0x21, 0x49, 0x3a, 0x5e, 0xdb, 0xba, 0x99, 0xd6, 0x84, 0xda, 0x59, 0x0b, 0xc3,
-	0x65, 0x7a, 0x52, 0x96, 0x37, 0x4e, 0xc1, 0x05, 0xb4, 0xde, 0x1d, 0x65, 0x5d, 0x33, 0x8d, 0xc7,
-	0x9e, 0x62, 0x8a, 0xed, 0x49, 0x96, 0x5a, 0xb3, 0x30, 0x5d, 0xf3, 0xba, 0x21, 0xfe, 0x89, 0x3e,
-	0x86, 0xb0, 0xe6, 0x60, 0x46, 0x14, 0x75, 0x70, 0x10, 0x58, 0xff, 0x74, 0x0c, 0x2c, 0xce, 0xd8,
-	0x34, 0x2f, 0x8f, 0xe0, 0xc7, 0x61, 0xa2, 0xb3, 0x7c, 0x13, 0xb9, 0xaa, 0xfa, 0xb2, 0xa2, 0x52,
-	0x26, 0x79, 0xf4, 0xf1, 0x4a, 0x2b, 0x82, 0x6a, 0x92, 0x97, 0x18, 0xfd, 0xcf, 0x0d, 0x6a, 0x92,
-	0x2d, 0x36, 0x9a, 0x3e, 0xc4, 0xa0, 0x26, 0x35, 0xba, 0xe9, 0x2a, 0xd3, 0xd6, 0xd8, 0xc0, 0xf7,
-	0x65, 0x24, 0x43, 0xbf, 0x65, 0x09, 0x4f, 0xb9, 0xc5, 0x00, 0xcd, 0x44, 0xca, 0x2c, 0x95, 0x08,
-	0x3a, 0xd0, 0x79, 0xc9, 0xd7, 0xa3, 0xb8, 0xe1, 0x55, 0x8b, 0x18, 0xd5, 0x9e, 0x02, 0xd1, 0x33,
-	0x90, 0x69, 0x75, 0x15, 0xcf, 0xdd, 0x3f, 0xcc, 0xc0, 0x75, 0x36, 0x3b, 0x7b, 0xbe, 0xfb, 0xdc,
-	0xed, 0xe0, 0x23, 0xac, 0x89, 0x69, 0x3f, 0xfd, 0xa6, 0x2c, 0x73, 0x2e, 0x1d, 0x4d, 0x93, 0x36,
-	0x60, 0x8e, 0x6e, 0x72, 0xe4, 0xa6, 0xd1, 0xb7, 0x06, 0x19, 0x58, 0x11, 0x6f, 0xca, 0x62, 0xd7,
-	0x47, 0x17, 0x35, 0xb7, 0xaa, 0xda, 0x8d, 0x4f, 0xd6, 0x70, 0xe3, 0xa3, 0x79, 0xd2, 0xc3, 0x11,
-	0x57, 0x40, 0x63, 0xaf, 0x7d, 0x05, 0x64, 0xfd, 0x6a, 0x0c, 0xae, 0xec, 0x39, 0x47, 0x6e, 0x97,
-	0xe8, 0x1e, 0x91, 0x47, 0x05, 0x55, 0x12, 0xe9, 0xa8, 0x86, 0x47, 0x03, 0xa5, 0xe4, 0x9b, 0x5a,
-	0x55, 0x33, 0xc3, 0x64, 0x4d, 0x71, 0xe2, 0x7a, 0xfe, 0x97, 0xcf, 0x34, 0xef, 0x64, 0x22, 0x20,
-	0x8c, 0xbe, 0x35, 0xea, 0x7a, 0xed, 0x58, 0x8a, 0x36, 0xea, 0xe1, 0x7b, 0x02, 0xd3, 0x4a, 0x54,
-	0x17, 0x17, 0xd0, 0x04, 0x05, 0xca, 0x96, 0x93, 0xfe, 0x21, 0x4e, 0x4d, 0xc7, 0xa3, 0x52, 0x48,
-	0x49, 0xc2, 0x33, 0xf1, 0x86, 0x93, 0xf0, 0x7c, 0xcf, 0xba, 0x2c, 0x7c, 0xbd, 0x93, 0x7c, 0xdf,
-	0x60, 0xe4, 0x13, 0x0e, 0xdf, 0xc6, 0x9a, 0xd2, 0xfb, 0xb4, 0x8c, 0x62, 0x2a, 0xb1, 0x2a, 0x40,
-	0x4e, 0xe4, 0x2e, 0xb4, 0xfe, 0x68, 0x12, 0x16, 0x76, 0xdc, 0x20, 0x14, 0xb3, 0x1b, 0x44, 0xaa,
-	0x7f, 0x46, 0xc0, 0x94, 0xf3, 0x0b, 0xb7, 0xd2, 0x18, 0xbc, 0x19, 0x4b, 0xa5, 0xa8, 0x21, 0xa0,
-	0x8f, 0x54, 0x2f, 0x52, 0x56, 0x49, 0xb0, 0x90, 0xcc, 0x82, 0xa7, 0xba, 0x97, 0xde, 0xd5, 0x1c,
-	0x66, 0x6c, 0x5f, 0xed, 0x10, 0x80, 0xba, 0xaf, 0x32, 0x9f, 0xd3, 0x5a, 0xdc, 0x8b, 0xc6, 0x1a,
-	0x60, 0x4a, 0xf1, 0x04, 0x6b, 0x26, 0xb7, 0x74, 0x46, 0x1d, 0x48, 0x67, 0xd4, 0x04, 0x3d, 0xed,
-	0xfe, 0x4c, 0x71, 0x46, 0xc5, 0x99, 0xa0, 0x3a, 0xa4, 0xd8, 0x93, 0xde, 0x0e, 0x05, 0xa8, 0x4f,
-	0x7a, 0x59, 0x15, 0xb4, 0x0f, 0xf3, 0x7b, 0x3e, 0x6e, 0x53, 0xd5, 0xb2, 0xf1, 0x53, 0xcf, 0xe7,
-	0x47, 0x0c, 0xea, 0xd2, 0x64, 0xd9, 0xa6, 0x7a, 0xa2, 0xb8, 0x89, 0x65, 0xb9, 0xaa, 0x61, 0x52,
-	0xd0, 0xd1, 0x06, 0xcc, 0xd5, 0xb1, 0xe3, 0xb7, 0x8e, 0x1f, 0xe1, 0x97, 0x44, 0x31, 0x06, 0xc5,
-	0xa9, 0x28, 0x43, 0x47, 0x40, 0x4b, 0xc8, 0x40, 0x69, 0x91, 0x7a, 0xed, 0xa4, 0x23, 0xa1, 0xdf,
-	0x81, 0xc9, 0xba, 0xe7, 0x87, 0xd5, 0x97, 0xb1, 0xb4, 0x88, 0x0c, 0x58, 0xbd, 0x26, 0xb2, 0x94,
-	0x04, 0x9e, 0x1f, 0x36, 0x0f, 0x55, 0xbe, 0x71, 0x3c, 0xf4, 0x80, 0x58, 0x5d, 0xc4, 0x12, 0x0c,
-	0x9d, 0x4e, 0x8d, 0x86, 0x4f, 0xb0, 0x47, 0x59, 0xdc, 0xb2, 0xa2, 0xe6, 0x63, 0xe8, 0x74, 0x9a,
-	0x74, 0x9f, 0xd7, 0x2f, 0xc0, 0x54, 0x2c, 0xf4, 0x12, 0x16, 0x74, 0x41, 0xe7, 0x39, 0x8c, 0x40,
-	0x4b, 0x30, 0x96, 0x56, 0xa5, 0x7a, 0x87, 0xf7, 0xf2, 0x66, 0x3c, 0x79, 0x56, 0x22, 0xad, 0x51,
-	0x6a, 0x13, 0xaf, 0xe3, 0x48, 0xfc, 0x93, 0x0c, 0x2c, 0xc6, 0xe4, 0x83, 0x1f, 0x28, 0x9f, 0x40,
-	0x5e, 0x02, 0xb9, 0xfb, 0xa4, 0x28, 0x37, 0xbe, 0x98, 0xe2, 0x64, 0xd2, 0x29, 0x16, 0x8f, 0x3a,
-	0x5f, 0x11, 0x0d, 0x74, 0x3f, 0xe6, 0x73, 0x64, 0x07, 0x95, 0x2e, 0xd9, 0x85, 0x75, 0x89, 0x16,
-	0xd5, 0xd0, 0x67, 0x00, 0xca, 0xb4, 0xb0, 0x55, 0x43, 0xd3, 0xf4, 0xa5, 0xcf, 0x88, 0x52, 0xd9,
-	0xfa, 0xb3, 0x49, 0xb1, 0xaf, 0xf2, 0xa3, 0xed, 0xbe, 0xef, 0xb4, 0x4e, 0xa2, 0x90, 0xcc, 0x8f,
-	0x92, 0xf1, 0x8f, 0xe7, 0x59, 0xc2, 0xb7, 0xb5, 0x97, 0xd2, 0xe6, 0xa4, 0xab, 0xd1, 0xa3, 0xf9,
-	0xb1, 0x73, 0x3c, 0x9a, 0xbf, 0x07, 0x53, 0xdb, 0xdd, 0xe7, 0x2e, 0xb1, 0xa2, 0x59, 0x30, 0x20,
-	0xb5, 0x41, 0x5d, 0x06, 0x52, 0x19, 0xc3, 0x6b, 0xa1, 0xcf, 0x20, 0xb7, 0xe5, 0x05, 0x21, 0x35,
-	0x23, 0x27, 0xa2, 0x93, 0x4a, 0x48, 0x7d, 0xb0, 0xcd, 0x63, 0x5e, 0xa4, 0x2a, 0x09, 0x51, 0x1d,
-	0x7d, 0x0c, 0x53, 0x95, 0x76, 0x9b, 0xac, 0x42, 0xbe, 0x82, 0x69, 0xc6, 0x46, 0x8e, 0xe9, 0xb0,
-	0x12, 0xb5, 0x49, 0x5e, 0x19, 0x7d, 0xa9, 0x3b, 0x44, 0xa7, 0xa2, 0x94, 0x12, 0xe9, 0xd9, 0x4b,
-	0x75, 0x67, 0xe9, 0xbb, 0xe2, 0x22, 0x2a, 0x17, 0x25, 0xe9, 0xa0, 0x09, 0x37, 0x34, 0xd5, 0x47,
-	0xef, 0xb1, 0xb6, 0x21, 0xbf, 0xdd, 0x75, 0x43, 0x97, 0xa6, 0x29, 0xc8, 0x6b, 0x1b, 0xe8, 0x9e,
-	0xe3, 0x87, 0x6e, 0xcb, 0xed, 0x39, 0xdd, 0x90, 0xcd, 0x96, 0x2b, 0x2a, 0xaa, 0xb3, 0x25, 0xb1,
-	0xd5, 0x84, 0x46, 0xf0, 0xc6, 0x12, 0x1a, 0xa5, 0xe6, 0x04, 0x9a, 0x7e, 0xf5, 0x9c, 0x40, 0x6b,
-	0x6c, 0x2e, 0xa9, 0xd1, 0x3a, 0x13, 0x09, 0x22, 0xf5, 0x13, 0xea, 0xd6, 0xa9, 0x2d, 0x2b, 0xa2,
-	0x9b, 0x34, 0x2d, 0xc1, 0x6c, 0x14, 0x57, 0xab, 0x5d, 0x7c, 0x67, 0xb7, 0xd7, 0x51, 0x13, 0x66,
-	0x48, 0xed, 0x3d, 0xaf, 0xe3, 0xb6, 0x5c, 0x1c, 0x14, 0xe7, 0x34, 0xc7, 0xb2, 0xbe, 0x28, 0x68,
-	0xa5, 0x97, 0x75, 0x1c, 0xb2, 0x4d, 0x90, 0x36, 0xdd, 0xe3, 0x88, 0xea, 0x26, 0xa8, 0x12, 0xb4,
-	0x6c, 0x28, 0x46, 0xb7, 0x53, 0xb1, 0xd5, 0xf5, 0x71, 0xf2, 0x89, 0x03, 0x4d, 0x85, 0x17, 0x3d,
-	0x71, 0x50, 0x27, 0x2c, 0x7a, 0xec, 0x70, 0x00, 0xd7, 0x6d, 0x7c, 0xea, 0x3d, 0xc7, 0x6f, 0x96,
-	0xec, 0xcf, 0xe1, 0x9a, 0x4e, 0xf0, 0xa0, 0xd7, 0xa6, 0x4f, 0x26, 0xd9, 0x35, 0x58, 0x6a, 0x32,
-	0x0d, 0x8e, 0xc0, 0x92, 0x69, 0xb0, 0x17, 0xda, 0xe4, 0x4f, 0x55, 0x5e, 0x69, 0x99, 0xe5, 0xc1,
-	0xb2, 0x4e, 0xbc, 0xd2, 0x6e, 0x2b, 0x82, 0x4a, 0x2c, 0x34, 0xe5, 0x33, 0x66, 0x12, 0xaa, 0x12,
-	0x4d, 0x35, 0x5b, 0x2f, 0x02, 0xa8, 0x6b, 0x49, 0xa9, 0x67, 0x61, 0x28, 0xc7, 0xd9, 0x43, 0x58,
-	0xa6, 0xb6, 0x59, 0x85, 0x59, 0xe5, 0x53, 0x9e, 0xb0, 0xe8, 0x52, 0x57, 0x5a, 0xd0, 0x19, 0xa6,
-	0xa3, 0x58, 0xff, 0x72, 0x0c, 0xae, 0x73, 0x3e, 0xbd, 0xc9, 0xc9, 0x40, 0x3f, 0xc2, 0xb4, 0xc2,
-	0x7e, 0xce, 0x8f, 0x9b, 0x22, 0x98, 0xc0, 0x34, 0x4d, 0x4c, 0xd5, 0xf4, 0x29, 0xa0, 0x19, 0x9b,
-	0x09, 0x62, 0x04, 0xaa, 0x33, 0xda, 0x81, 0x39, 0x7d, 0x0e, 0xb8, 0x61, 0x7d, 0x2b, 0xb5, 0x11,
-	0xbd, 0xaa, 0x78, 0xf1, 0xdd, 0x6e, 0xa6, 0xce, 0x04, 0x4d, 0x2b, 0xaa, 0xcf, 0xef, 0x4f, 0x70,
-	0x25, 0x31, 0x01, 0xdc, 0x0e, 0xbf, 0x9d, 0xda, 0x60, 0xa2, 0x36, 0xd3, 0x1b, 0x3e, 0x05, 0x1b,
-	0x9b, 0x4d, 0x36, 0x52, 0xcd, 0xc1, 0x24, 0x1b, 0x36, 0x59, 0x37, 0x7b, 0x3e, 0x0e, 0x70, 0xb7,
-	0x85, 0xd5, 0x88, 0x8d, 0xd7, 0x5d, 0x37, 0xff, 0x31, 0x03, 0xc5, 0x34, 0xba, 0x75, 0xdc, 0x6d,
-	0xa3, 0x3d, 0x28, 0xc4, 0x1b, 0xe2, 0xa7, 0x25, 0x4b, 0x98, 0x09, 0xe6, 0x2e, 0x6d, 0x5d, 0xb2,
-	0x13, 0xd8, 0x44, 0xb3, 0x2a, 0xb0, 0x0b, 0x86, 0xc6, 0x24, 0x51, 0x95, 0x63, 0xf6, 0x7b, 0xef,
-	0x41, 0x5e, 0xe6, 0x4a, 0x47, 0x39, 0x18, 0xdf, 0xde, 0xdd, 0xde, 0x67, 0xb9, 0xb7, 0xf6, 0x0e,
-	0xf6, 0x0b, 0x19, 0x04, 0x30, 0xb9, 0xbe, 0xb1, 0xb3, 0xb1, 0xbf, 0x51, 0xc8, 0xbe, 0xd7, 0x54,
-	0x0f, 0xac, 0xe8, 0x3a, 0x2c, 0xad, 0x6f, 0x34, 0xb6, 0x6b, 0x1b, 0xcd, 0xfd, 0xbf, 0xb0, 0xb7,
-	0xd1, 0x3c, 0xd8, 0xad, 0xef, 0x6d, 0xd4, 0xb6, 0x1f, 0x6c, 0x6f, 0xac, 0x17, 0x2e, 0xa1, 0x05,
-	0x28, 0xa8, 0x85, 0xfb, 0x4f, 0xf6, 0xf7, 0x0a, 0x19, 0x54, 0x84, 0x05, 0x15, 0xfa, 0x74, 0xa3,
-	0x5a, 0x39, 0xd8, 0xdf, 0xda, 0x2d, 0x8c, 0x59, 0xe3, 0xb9, 0x6c, 0x21, 0xfb, 0xde, 0x8f, 0xda,
-	0x69, 0x16, 0x2d, 0x43, 0x91, 0x57, 0x3f, 0xa8, 0x57, 0x36, 0xcd, 0x4d, 0xb0, 0xd2, 0xc7, 0x0f,
-	0x2a, 0x85, 0x0c, 0xba, 0x01, 0xd7, 0x34, 0xe8, 0x5e, 0xa5, 0x5e, 0x7f, 0xfa, 0xc4, 0x5e, 0xdf,
-	0xd9, 0xa8, 0xd7, 0x0b, 0xd9, 0xf7, 0x6e, 0xf3, 0x8b, 0x76, 0x34, 0x07, 0xb0, 0xbe, 0x51, 0xaf,
-	0x6d, 0xec, 0xae, 0x6f, 0xef, 0x6e, 0x16, 0x2e, 0xa1, 0x59, 0xc8, 0x57, 0xe4, 0x67, 0x66, 0xf5,
-	0x8f, 0x7f, 0x84, 0x69, 0xc2, 0x4f, 0x71, 0xf8, 0x6b, 0xc2, 0xd2, 0x63, 0xc7, 0xed, 0x86, 0x8e,
-	0xdb, 0xe5, 0x52, 0x20, 0xe6, 0x10, 0x95, 0x87, 0x4c, 0x2a, 0x91, 0x87, 0xd2, 0xa8, 0x70, 0xa2,
-	0x3b, 0x99, 0xfb, 0x19, 0x54, 0x87, 0x85, 0x34, 0xab, 0x0c, 0x59, 0x7a, 0x6a, 0x80, 0x34, 0x85,
-	0x53, 0x5a, 0x4a, 0xdd, 0xbb, 0x1a, 0x1f, 0xa0, 0xc7, 0x70, 0x25, 0xb1, 0x13, 0xc9, 0xfe, 0x9a,
-	0xf6, 0xa8, 0x61, 0xe4, 0x8a, 0xd4, 0xb1, 0x17, 0xba, 0xf1, 0x7d, 0x28, 0x40, 0x57, 0x13, 0x06,
-	0xc4, 0x06, 0x59, 0x34, 0x46, 0x62, 0xf7, 0x33, 0xc8, 0x86, 0x85, 0xb4, 0x3d, 0x4d, 0x0e, 0x79,
-	0xc8, 0x86, 0x57, 0x32, 0x34, 0x47, 0x68, 0xa6, 0xa9, 0x66, 0x49, 0x73, 0x88, 0xde, 0x36, 0xd2,
-	0xfc, 0x92, 0x1c, 0xc8, 0xba, 0xed, 0x47, 0x18, 0xf7, 0x2a, 0x1d, 0xf7, 0x39, 0x0e, 0x90, 0x08,
-	0x86, 0x93, 0x20, 0x13, 0xee, 0x9d, 0x0c, 0xfa, 0x2d, 0x98, 0xa6, 0xe9, 0x59, 0x79, 0xec, 0xc6,
-	0x8c, 0x9a, 0xb2, 0xb5, 0x24, 0xbe, 0x68, 0xe1, 0xfd, 0x0c, 0xfa, 0x0a, 0xa6, 0x36, 0x31, 0x0d,
-	0x5e, 0x40, 0x6f, 0xc5, 0x7e, 0x85, 0x60, 0xbb, 0x2b, 0x8d, 0x6d, 0xd1, 0xe1, 0xb8, 0x37, 0x03,
-	0xd5, 0x20, 0xc7, 0xd1, 0x03, 0x64, 0xc5, 0xf0, 0x83, 0x14, 0x02, 0xf3, 0x31, 0x02, 0xe4, 0xbc,
-	0x83, 0x6a, 0x90, 0x97, 0x11, 0x14, 0x68, 0xc9, 0x10, 0xb6, 0x51, 0x2a, 0x26, 0x0b, 0xb8, 0x87,
-	0x6c, 0xec, 0xef, 0x66, 0x33, 0xe8, 0x1e, 0x00, 0x7b, 0x54, 0x46, 0xc7, 0x12, 0xef, 0x68, 0x29,
-	0xc1, 0x40, 0xb4, 0x49, 0x74, 0x4b, 0x07, 0x87, 0xf8, 0xbc, 0x83, 0x37, 0xcd, 0xd6, 0x0e, 0xcc,
-	0xc9, 0x27, 0x5e, 0xe7, 0xe7, 0x84, 0x89, 0xda, 0xe7, 0x64, 0x05, 0xb1, 0x97, 0xd1, 0x32, 0x64,
-	0x11, 0x99, 0x82, 0x18, 0xe5, 0x74, 0xb2, 0x6a, 0x0a, 0xae, 0xcc, 0x7d, 0x2b, 0x71, 0xe3, 0xd9,
-	0x70, 0x63, 0xb8, 0x18, 0x4a, 0x6a, 0xbb, 0x7a, 0xf8, 0x22, 0xba, 0xa9, 0x74, 0x20, 0x35, 0xea,
-	0xb2, 0xf4, 0xd6, 0x90, 0x1a, 0x6c, 0x9e, 0xa8, 0xd6, 0x79, 0x08, 0xb3, 0x5a, 0xc0, 0x1b, 0x12,
-	0x91, 0xf3, 0x69, 0x11, 0x89, 0xa5, 0xe5, 0xf4, 0x42, 0x7e, 0x2c, 0x7e, 0x40, 0x95, 0x4d, 0x2c,
-	0xd7, 0x5c, 0x29, 0x2d, 0xa7, 0x1c, 0x3f, 0x9c, 0x8b, 0xec, 0x23, 0x31, 0x94, 0x0d, 0x98, 0x97,
-	0xd7, 0x1d, 0x4a, 0x02, 0x7f, 0x43, 0x76, 0x3a, 0xe3, 0xcc, 0x7d, 0x03, 0xf3, 0x5c, 0x0e, 0x34,
-	0x32, 0x05, 0xa9, 0x5c, 0x78, 0x22, 0x33, 0x23, 0x81, 0x87, 0xb0, 0x58, 0x8f, 0x8d, 0x87, 0x59,
-	0x51, 0xd7, 0x74, 0x12, 0x4a, 0x5e, 0x3a, 0x23, 0xad, 0x47, 0x80, 0xea, 0xfd, 0xc3, 0x53, 0x57,
-	0x92, 0x7b, 0xee, 0xe2, 0x17, 0xe8, 0x46, 0x6c, 0x48, 0x04, 0x48, 0xab, 0x51, 0xed, 0x54, 0x32,
-	0x8c, 0x18, 0xed, 0xb3, 0xa7, 0xf2, 0x2c, 0x61, 0x8f, 0xd3, 0x73, 0x0e, 0xdd, 0x8e, 0x1b, 0xba,
-	0x98, 0x88, 0x85, 0x8a, 0xa0, 0x16, 0x89, 0x19, 0xbc, 0x66, 0xac, 0x81, 0xbe, 0x86, 0xd9, 0x4d,
-	0x1c, 0x46, 0xa9, 0xf7, 0xd0, 0x52, 0x22, 0x59, 0x1f, 0x9f, 0x37, 0x71, 0xf1, 0xad, 0xe7, 0xfb,
-	0xdb, 0x86, 0x02, 0x53, 0xae, 0x0a, 0x89, 0x1b, 0x09, 0x12, 0xbc, 0x8a, 0xe3, 0x3b, 0xa7, 0x81,
-	0x91, 0x5b, 0xf7, 0x60, 0x7c, 0xcf, 0xed, 0x1e, 0x21, 0xe1, 0xc7, 0x56, 0x52, 0x57, 0x95, 0xe6,
-	0x35, 0x18, 0x17, 0xbd, 0x43, 0x28, 0xb3, 0x9c, 0x73, 0xc9, 0x3c, 0x6f, 0x22, 0xb1, 0xf6, 0xdb,
-	0x32, 0x4e, 0x75, 0x48, 0x6e, 0x3a, 0xc9, 0x9f, 0x78, 0x79, 0x63, 0x0d, 0xed, 0x51, 0xae, 0x27,
-	0x1b, 0x40, 0xb7, 0xa2, 0xfd, 0xd4, 0x98, 0x66, 0xae, 0x84, 0xe2, 0x84, 0x1b, 0x6b, 0x48, 0xbe,
-	0xb0, 0x4f, 0x21, 0x7a, 0x5b, 0xdb, 0xf6, 0x2f, 0x46, 0xf7, 0x6b, 0xc8, 0xcb, 0x1c, 0x6b, 0x52,
-	0xdf, 0xc4, 0x13, 0xc3, 0x49, 0x05, 0x9e, 0x4c, 0xc7, 0xf6, 0x25, 0x4b, 0x87, 0xa8, 0xe3, 0xc7,
-	0xd3, 0x90, 0x19, 0x27, 0xef, 0x33, 0x98, 0x56, 0x12, 0x90, 0xc9, 0xc5, 0x92, 0x4c, 0x4a, 0x56,
-	0xd2, 0x7f, 0xa8, 0xe5, 0x3e, 0xd9, 0x34, 0xa6, 0x78, 0xc6, 0x4b, 0xb4, 0x18, 0xa1, 0x29, 0x59,
-	0x9c, 0x62, 0x28, 0x68, 0x8d, 0xee, 0x77, 0xac, 0xa1, 0xab, 0x3a, 0x86, 0xb9, 0x95, 0x35, 0x00,
-	0x36, 0x66, 0xda, 0x90, 0x5e, 0x6c, 0x1c, 0xd5, 0x1a, 0xd9, 0xcf, 0xda, 0x17, 0x44, 0xfa, 0x5a,
-	0xec, 0x69, 0x14, 0xa9, 0xa8, 0x71, 0x52, 0x1d, 0x95, 0x09, 0x7f, 0x1b, 0x0a, 0x95, 0x16, 0xd5,
-	0xb2, 0x32, 0xb1, 0x14, 0x5a, 0x91, 0x2b, 0x58, 0x2f, 0x10, 0xb4, 0x16, 0xe3, 0x79, 0xaa, 0x76,
-	0xb0, 0x43, 0x23, 0xe9, 0x96, 0xe4, 0x5e, 0x1b, 0x2b, 0x4a, 0xc7, 0x30, 0x76, 0x6a, 0x03, 0x16,
-	0x6a, 0x4e, 0xb7, 0x85, 0x3b, 0xaf, 0x47, 0xe6, 0x73, 0xaa, 0x6e, 0x94, 0xa4, 0x5b, 0x57, 0xe3,
-	0xf8, 0x5c, 0xdb, 0x5c, 0x91, 0x47, 0x45, 0x59, 0xb5, 0x02, 0x97, 0x19, 0x13, 0x23, 0xb6, 0x98,
-	0xb0, 0x4d, 0xcd, 0x7f, 0x02, 0x73, 0x1b, 0x44, 0x1d, 0xf7, 0xdb, 0x2e, 0x0b, 0xba, 0x46, 0x7a,
-	0x14, 0xad, 0x11, 0x71, 0x4b, 0x24, 0x30, 0x54, 0xb2, 0x51, 0x49, 0x21, 0x4f, 0x26, 0xfc, 0x2a,
-	0x2d, 0x08, 0xb2, 0x6a, 0xe2, 0x2a, 0xba, 0xf7, 0x1e, 0x89, 0x8c, 0x27, 0xb1, 0x1c, 0x43, 0xaa,
-	0x42, 0x31, 0x66, 0x20, 0x2a, 0xbd, 0x3d, 0xbc, 0x92, 0x6a, 0x8b, 0xd9, 0xb0, 0x64, 0xc8, 0xdf,
-	0x84, 0xde, 0x91, 0x66, 0xf1, 0xb0, 0xfc, 0x4e, 0x29, 0xe6, 0xda, 0x77, 0x4a, 0x16, 0x0f, 0x03,
-	0xcd, 0xe1, 0x89, 0x9d, 0x8c, 0x0c, 0x96, 0x81, 0x85, 0xa9, 0x09, 0x98, 0xd0, 0xbb, 0x3a, 0xf5,
-	0x21, 0x49, 0x9a, 0x8c, 0x2d, 0x3c, 0xa1, 0xa2, 0x17, 0xe5, 0xff, 0x91, 0x46, 0x4f, 0x5a, 0x92,
-	0x26, 0x69, 0xf4, 0xa4, 0x66, 0x4f, 0x62, 0x0c, 0xde, 0x84, 0xcb, 0xb1, 0x54, 0x48, 0xe8, 0x46,
-	0x9c, 0xb1, 0x23, 0x18, 0xca, 0x08, 0x3d, 0x16, 0x82, 0x9d, 0x24, 0x94, 0x9e, 0x1c, 0xc9, 0x34,
-	0x46, 0x46, 0xee, 0x40, 0x9a, 0x40, 0x6a, 0xba, 0x23, 0xf4, 0x56, 0x0a, 0x0b, 0xcf, 0xc7, 0x3a,
-	0x46, 0xb6, 0x0e, 0x85, 0x78, 0xb6, 0x20, 0xb4, 0x22, 0xb9, 0x94, 0x9a, 0x12, 0xa9, 0x54, 0x36,
-	0x96, 0xf3, 0x4d, 0xe7, 0x61, 0x34, 0x29, 0xec, 0x1a, 0x2c, 0x3e, 0x29, 0x6a, 0xa6, 0x98, 0xc4,
-	0xa4, 0xe8, 0x09, 0x60, 0x36, 0x69, 0x38, 0xb4, 0x92, 0xf6, 0xc7, 0x78, 0x3a, 0xbd, 0x91, 0x46,
-	0x27, 0xba, 0xe9, 0xa9, 0x8b, 0x84, 0xaa, 0x4a, 0xbf, 0x56, 0xb4, 0x7d, 0x33, 0xd9, 0xb5, 0xb2,
-	0xb1, 0x5c, 0x8e, 0xb4, 0x10, 0x4f, 0x80, 0x23, 0x89, 0x1a, 0x32, 0xe3, 0x18, 0x45, 0xf9, 0x01,
-	0x2c, 0xe8, 0xb3, 0x38, 0x62, 0xbc, 0x66, 0x5b, 0x77, 0x56, 0x4b, 0x7b, 0x83, 0xc4, 0xad, 0x5c,
-	0x2c, 0xc3, 0x4e, 0x82, 0xfb, 0x29, 0xe9, 0x77, 0x18, 0xf7, 0x95, 0x14, 0x3a, 0xe7, 0xe1, 0x7e,
-	0x5a, 0xc6, 0x1d, 0xc9, 0x28, 0xa5, 0x5f, 0x62, 0xfb, 0x8b, 0x17, 0x5c, 0x84, 0x51, 0xe7, 0xe9,
-	0x9a, 0x89, 0xce, 0x3a, 0xb5, 0x6e, 0xe4, 0xef, 0x54, 0x5d, 0xd3, 0xd8, 0xa4, 0x49, 0x7c, 0x49,
-	0x1b, 0x9c, 0x2e, 0xec, 0x35, 0x98, 0x51, 0x33, 0xf8, 0x18, 0x7b, 0x71, 0x3d, 0x49, 0x23, 0x50,
-	0xce, 0x5b, 0x73, 0x92, 0x0b, 0xac, 0x37, 0xcb, 0x71, 0xe6, 0x68, 0x1d, 0x32, 0x0f, 0x09, 0xa9,
-	0xac, 0x19, 0xd1, 0x25, 0xb3, 0x59, 0x30, 0xcf, 0x0c, 0x24, 0xfd, 0x67, 0xcc, 0x0c, 0xbf, 0x86,
-	0x66, 0x24, 0x73, 0x40, 0x1f, 0x59, 0xa8, 0xe9, 0x78, 0x90, 0x22, 0x25, 0x29, 0x69, 0x7a, 0x4a,
-	0x2b, 0xa6, 0x62, 0x55, 0x43, 0x7f, 0x0b, 0x57, 0x12, 0x69, 0x87, 0xa4, 0x23, 0xcc, 0x94, 0x90,
-	0x68, 0xb8, 0x16, 0xdc, 0x22, 0x03, 0x8e, 0x21, 0x36, 0x56, 0x47, 0x13, 0x4d, 0xee, 0xa5, 0x3b,
-	0xe2, 0x5d, 0x46, 0x5a, 0xe7, 0x4c, 0xc9, 0x8d, 0x8c, 0x1c, 0xdc, 0x87, 0xc5, 0xd4, 0xb4, 0x46,
-	0xd2, 0xac, 0x18, 0x96, 0xf4, 0xc8, 0x48, 0xf5, 0x2f, 0xd2, 0xb4, 0xc2, 0xb1, 0x94, 0x39, 0xd2,
-	0x0f, 0x61, 0x4c, 0x93, 0x24, 0xfd, 0x10, 0xe6, 0xfc, 0x45, 0x8c, 0x9b, 0x3b, 0xb0, 0x90, 0x96,
-	0x84, 0x48, 0xf1, 0xdb, 0x19, 0x33, 0x14, 0xa5, 0x70, 0xd4, 0x16, 0xab, 0xdd, 0x40, 0x6d, 0x48,
-	0x4a, 0x22, 0x23, 0x07, 0xbe, 0x17, 0x89, 0xa6, 0x92, 0xa9, 0x83, 0xe4, 0x69, 0x6d, 0x44, 0x6e,
-	0xa1, 0x21, 0x46, 0xe5, 0xe5, 0xba, 0x7b, 0xd4, 0x55, 0xb2, 0xfc, 0x48, 0x93, 0x32, 0x99, 0x5e,
-	0x48, 0x6a, 0x96, 0xb4, 0xa4, 0x40, 0x4f, 0x60, 0x41, 0x6c, 0xb1, 0x6a, 0x56, 0x1c, 0x94, 0xc0,
-	0x89, 0xde, 0x52, 0x48, 0x2d, 0x93, 0x9a, 0x46, 0x87, 0x9d, 0xc9, 0xe8, 0xef, 0x20, 0x29, 0x67,
-	0x32, 0x25, 0x5d, 0x4d, 0x49, 0xcf, 0x6c, 0x83, 0xbe, 0xa0, 0x67, 0x32, 0x96, 0xbd, 0xd0, 0xec,
-	0x14, 0xd6, 0x28, 0x45, 0x3a, 0x6d, 0x4d, 0xb8, 0x0d, 0x69, 0x83, 0x3a, 0xe5, 0xd1, 0xc7, 0x2c,
-	0x8a, 0xa4, 0x1f, 0xb3, 0xd4, 0x8e, 0x9a, 0x9d, 0x33, 0x33, 0xea, 0x03, 0x6d, 0xc9, 0xab, 0x94,
-	0x4c, 0x0e, 0x92, 0x57, 0x69, 0xf9, 0x11, 0xa8, 0x55, 0xbf, 0x2f, 0x4c, 0xb8, 0x88, 0xde, 0x8d,
-	0xa1, 0x09, 0x0e, 0x4a, 0x2b, 0xc3, 0xb3, 0x02, 0xf0, 0xdb, 0x81, 0x42, 0xfc, 0x0d, 0x39, 0x4a,
-	0xcb, 0x4f, 0xa1, 0x3c, 0xa4, 0x97, 0x86, 0x88, 0xf1, 0xf1, 0xf9, 0x9e, 0x30, 0x0f, 0x75, 0xba,
-	0x86, 0x2c, 0x05, 0x2a, 0xe9, 0xe1, 0x66, 0x44, 0xf4, 0x9c, 0x5c, 0x35, 0xe2, 0x12, 0xcf, 0xd5,
-	0x55, 0x33, 0x22, 0xe5, 0x05, 0xba, 0x2b, 0xc2, 0x54, 0xd2, 0x73, 0x1e, 0xbd, 0xab, 0x9b, 0x59,
-	0x43, 0x02, 0x78, 0x47, 0xde, 0xbf, 0xa0, 0xdf, 0x15, 0xc9, 0x1c, 0x93, 0x19, 0x41, 0xde, 0x89,
-	0xf9, 0x61, 0xd2, 0x43, 0x3e, 0x4b, 0xc3, 0x12, 0x8e, 0xa0, 0xc7, 0xf4, 0x59, 0xdf, 0x93, 0xed,
-	0xf5, 0x1a, 0xff, 0xb5, 0x53, 0xcf, 0x4f, 0x38, 0xb8, 0x95, 0x5f, 0xec, 0x88, 0x98, 0xcc, 0xaa,
-	0x68, 0x88, 0x8d, 0x35, 0x54, 0xa7, 0x7e, 0x56, 0x0d, 0x9a, 0xe2, 0xe3, 0x4e, 0x21, 0x58, 0x4a,
-	0x27, 0x48, 0x9d, 0xfe, 0x1b, 0x62, 0x37, 0xd3, 0xbb, 0x69, 0xe8, 0xc3, 0x30, 0x2b, 0x80, 0x89,
-	0x4d, 0x3a, 0x19, 0xd1, 0xbb, 0x51, 0x72, 0xc4, 0x38, 0x56, 0xaf, 0x3c, 0xde, 0x79, 0x25, 0x8e,
-	0x69, 0x88, 0x8d, 0x55, 0xce, 0x31, 0x0d, 0x7a, 0x31, 0x8e, 0xc5, 0x08, 0xea, 0x1c, 0xd3, 0xbb,
-	0x69, 0xe8, 0xc3, 0x68, 0x8e, 0xa5, 0x93, 0x39, 0x2f, 0xc7, 0xbe, 0xa5, 0xfb, 0xf3, 0x26, 0x7d,
-	0x64, 0x76, 0x21, 0x9e, 0x15, 0x85, 0x05, 0xab, 0xa3, 0x36, 0xd6, 0xd0, 0x53, 0x9a, 0xb1, 0x32,
-	0x06, 0x3f, 0x1f, 0xdf, 0x96, 0x4d, 0x44, 0x29, 0xe7, 0xb6, 0x61, 0x91, 0x71, 0x2e, 0xde, 0x5d,
-	0x63, 0x5f, 0x8c, 0xc3, 0xde, 0x14, 0xc6, 0x4e, 0x9c, 0xd4, 0x45, 0xf9, 0xb7, 0x4e, 0x45, 0x64,
-	0xdf, 0x27, 0xf6, 0x69, 0x3b, 0x69, 0xbc, 0xea, 0x44, 0x84, 0x67, 0x5c, 0xaf, 0xde, 0x58, 0x45,
-	0xdb, 0x74, 0x16, 0x74, 0xf0, 0x30, 0xeb, 0x3e, 0x9d, 0x0c, 0x65, 0xd2, 0x96, 0x30, 0x88, 0x62,
-	0x7d, 0x32, 0xb5, 0x6d, 0xee, 0x94, 0x3c, 0xfa, 0x9c, 0x73, 0x74, 0x26, 0x16, 0xb1, 0x8d, 0x9d,
-	0x9d, 0x34, 0x46, 0x71, 0x26, 0xfe, 0x4b, 0xe1, 0xe8, 0x77, 0x20, 0x2f, 0x90, 0x47, 0x33, 0x24,
-	0x8e, 0x4d, 0x19, 0xf2, 0x35, 0x4c, 0x73, 0x86, 0xd0, 0x1e, 0x98, 0x5a, 0x32, 0x76, 0xff, 0x2b,
-	0x98, 0xe6, 0x6c, 0x18, 0x3a, 0x02, 0xf3, 0xb5, 0xe2, 0xe2, 0x26, 0x0e, 0x53, 0x7e, 0xc9, 0x76,
-	0xd4, 0x60, 0xd2, 0x7e, 0x38, 0x17, 0x35, 0xe8, 0xf3, 0x5c, 0xd3, 0xaf, 0x0e, 0x9b, 0x48, 0x8e,
-	0xfc, 0xcd, 0x63, 0x42, 0xb7, 0x6e, 0xa6, 0x3b, 0x12, 0xdf, 0x38, 0xfa, 0x5d, 0x58, 0xa6, 0x77,
-	0x10, 0x17, 0xed, 0xb1, 0xf9, 0x90, 0x72, 0x2d, 0x0a, 0x3f, 0x88, 0xff, 0xe0, 0xb1, 0x89, 0xd8,
-	0xa8, 0xdf, 0x5a, 0x26, 0x54, 0xeb, 0x46, 0xaa, 0xa3, 0xb0, 0x87, 0x6c, 0x46, 0xd7, 0xe9, 0xd8,
-	0x2f, 0xd8, 0xdb, 0xe1, 0x9a, 0x26, 0xf6, 0x0b, 0xcc, 0xa3, 0xa2, 0x27, 0xe2, 0xbf, 0xf1, 0x4c,
-	0xa8, 0xd4, 0x13, 0x54, 0x4c, 0xb5, 0x87, 0x6d, 0x3e, 0x74, 0x68, 0xe7, 0xec, 0x8d, 0xf9, 0x72,
-	0x24, 0x2f, 0x73, 0x97, 0x20, 0xc5, 0xb6, 0xd7, 0x32, 0x73, 0x94, 0x66, 0xd5, 0x58, 0x87, 0x00,
-	0x55, 0xd8, 0x1e, 0xaf, 0xe6, 0xf0, 0x50, 0xbc, 0x88, 0xa9, 0xc9, 0x3d, 0xe2, 0x24, 0xd8, 0xd9,
-	0x84, 0xfe, 0x2c, 0xb4, 0x72, 0x36, 0x51, 0xb2, 0x1b, 0x94, 0xf4, 0xdc, 0x03, 0x5c, 0x85, 0xd1,
-	0x04, 0x04, 0xea, 0x7d, 0x91, 0x9a, 0xdf, 0x40, 0x3d, 0x9b, 0xe8, 0x99, 0x18, 0xe4, 0xd9, 0x84,
-	0x36, 0xa8, 0x53, 0x1e, 0x7d, 0x36, 0xa1, 0x48, 0xfa, 0xd9, 0x44, 0xed, 0xa8, 0x79, 0xe1, 0xa1,
-	0x64, 0x2a, 0x06, 0x79, 0xee, 0x36, 0x66, 0x69, 0x18, 0x72, 0xa5, 0x34, 0x9f, 0x92, 0x74, 0x47,
-	0xda, 0xfc, 0xe6, 0x84, 0x3c, 0x25, 0xfd, 0x7e, 0xe4, 0x7e, 0x06, 0xed, 0xd2, 0xbc, 0xd1, 0x69,
-	0xbf, 0x96, 0x6d, 0x92, 0x9f, 0xa1, 0x3f, 0xcf, 0x4d, 0xe8, 0xd5, 0xd3, 0xe9, 0x0d, 0xc5, 0x1b,
-	0x72, 0xac, 0xbb, 0xc6, 0x23, 0x4a, 0x2e, 0xd0, 0x45, 0xb3, 0x88, 0x4f, 0x31, 0x1f, 0xb1, 0x19,
-	0xb5, 0xa0, 0xfe, 0x3c, 0x35, 0xdd, 0xb2, 0xee, 0xc2, 0x24, 0x43, 0x32, 0xee, 0x36, 0xda, 0x4f,
-	0x5a, 0xa3, 0x0f, 0xc4, 0xc5, 0x2d, 0x41, 0xd1, 0x8a, 0x8c, 0xfd, 0xfa, 0x00, 0xf2, 0xcc, 0xed,
-	0x76, 0x7e, 0x94, 0x2f, 0xc4, 0xf5, 0xee, 0xb0, 0x8e, 0x99, 0xa3, 0x2a, 0x66, 0x55, 0x87, 0xf3,
-	0xc5, 0x19, 0xf9, 0x15, 0x75, 0x7d, 0x0a, 0x57, 0x83, 0x19, 0x7f, 0x31, 0xf1, 0xf3, 0xe3, 0x94,
-	0xa5, 0x9f, 0x52, 0xff, 0xab, 0xcc, 0x5e, 0x65, 0xea, 0x7e, 0xf2, 0xc7, 0xcb, 0xd1, 0x17, 0x30,
-	0xc7, 0x98, 0x2b, 0x91, 0x93, 0x95, 0x86, 0xf0, 0x6c, 0x8e, 0xb1, 0xf9, 0x55, 0x90, 0x7f, 0x47,
-	0x38, 0x6a, 0x47, 0x76, 0xfb, 0x3c, 0x2e, 0xda, 0xd1, 0xac, 0x33, 0x51, 0xf9, 0x5d, 0xba, 0xe9,
-	0xa6, 0xa7, 0x5c, 0x31, 0x12, 0xbb, 0xa3, 0xb8, 0xa0, 0x87, 0x27, 0x6b, 0x39, 0xa1, 0xd1, 0x81,
-	0xe9, 0x3f, 0x60, 0x7f, 0x7b, 0x04, 0x15, 0xc1, 0x80, 0x9f, 0x8d, 0xac, 0x27, 0xfd, 0x5c, 0x3c,
-	0x69, 0x79, 0x7a, 0x7b, 0x23, 0x12, 0xaf, 0xa4, 0xb8, 0x0c, 0x0d, 0xf9, 0x4c, 0x04, 0x41, 0xfd,
-	0xda, 0x71, 0xe8, 0x18, 0xcc, 0x47, 0xb4, 0x28, 0xf7, 0xf8, 0x05, 0x27, 0xc1, 0x6c, 0x46, 0xa1,
-	0x64, 0x96, 0x17, 0x34, 0xec, 0x45, 0x95, 0xea, 0x90, 0x35, 0x65, 0x87, 0xd9, 0x14, 0xa1, 0xa8,
-	0xb1, 0xe7, 0x89, 0xa6, 0x87, 0x8e, 0x43, 0x4e, 0x67, 0x3c, 0x18, 0xf3, 0x8d, 0x10, 0x4a, 0xce,
-	0xf6, 0xc5, 0x09, 0x49, 0xc7, 0x70, 0x8c, 0x90, 0x35, 0x64, 0x7a, 0x47, 0x3b, 0xbd, 0x8a, 0x86,
-	0x79, 0xbd, 0xf8, 0x84, 0x3a, 0x51, 0xd8, 0x5f, 0x32, 0x15, 0x8d, 0xdc, 0xf6, 0x8d, 0x69, 0x71,
-	0xe4, 0xec, 0x0e, 0xc9, 0x63, 0x53, 0x8b, 0x7e, 0xeb, 0x45, 0xcb, 0x5d, 0x53, 0xb3, 0x77, 0xa4,
-	0xbb, 0x2e, 0x2d, 0xa9, 0x4d, 0x09, 0x44, 0xa1, 0xbd, 0x43, 0xd6, 0xba, 0x29, 0xef, 0x4a, 0x14,
-	0xba, 0x34, 0x3c, 0x2b, 0x8d, 0x5c, 0xeb, 0x23, 0x13, 0xb8, 0xec, 0xc2, 0x42, 0x5a, 0xbe, 0x14,
-	0x39, 0x69, 0x43, 0x92, 0xa9, 0xa4, 0xc6, 0x47, 0xed, 0xc1, 0x62, 0x6a, 0xce, 0x12, 0x79, 0x43,
-	0x32, 0x2c, 0xa3, 0x49, 0x2a, 0xc5, 0xef, 0x60, 0xc9, 0x90, 0xa0, 0x23, 0x72, 0x20, 0x0e, 0x4d,
-	0xe0, 0x61, 0x14, 0x88, 0x1f, 0xa0, 0x64, 0xce, 0xfd, 0x80, 0xee, 0xe8, 0x4e, 0x50, 0x73, 0xc6,
-	0x85, 0x52, 0x6a, 0xb2, 0x1a, 0xb4, 0x4f, 0xf3, 0xe8, 0xa5, 0x25, 0x83, 0x90, 0xfd, 0x1e, 0x9e,
-	0x2c, 0xc2, 0x10, 0xd7, 0xb6, 0x64, 0xc8, 0xff, 0x30, 0x84, 0xea, 0x39, 0x7a, 0xbb, 0x2b, 0xf4,
-	0x92, 0x9e, 0x10, 0x20, 0x16, 0x22, 0x9f, 0x9a, 0x2d, 0x20, 0xb5, 0x9f, 0x0f, 0x61, 0x56, 0x7b,
-	0xe0, 0x29, 0xc5, 0x3f, 0xed, 0x59, 0xb0, 0xf4, 0x56, 0xa7, 0xbe, 0x09, 0xad, 0x16, 0x7e, 0xf9,
-	0x3f, 0x56, 0x32, 0xbf, 0xfc, 0xf5, 0x4a, 0xe6, 0xbf, 0xfd, 0x7a, 0x25, 0xf3, 0xab, 0x5f, 0xaf,
-	0x64, 0x0e, 0x27, 0x69, 0xf5, 0xb5, 0xff, 0x1b, 0x00, 0x00, 0xff, 0xff, 0xaa, 0x07, 0x03, 0xcc,
-	0x29, 0x90, 0x00, 0x00,
+	0xc5, 0x40, 0x4f, 0x61, 0xce, 0xc6, 0x81, 0xd7, 0xf7, 0x5b, 0x78, 0x1b, 0x3b, 0x6d, 0xec, 0x17,
+	0xb3, 0x37, 0x32, 0xb7, 0xa7, 0xd7, 0x96, 0xee, 0x30, 0xa6, 0xe9, 0x85, 0xd5, 0x2b, 0x67, 0x83,
+	0x32, 0xf2, 0x39, 0x2c, 0x22, 0xb6, 0x7d, 0xc9, 0x8e, 0x91, 0x41, 0xdf, 0xc3, 0x6c, 0x0d, 0xfb,
+	0x61, 0xa5, 0x1f, 0x1e, 0x7b, 0xbe, 0x1b, 0xbe, 0x2c, 0x8e, 0x51, 0xba, 0x57, 0x38, 0x5d, 0xad,
+	0xac, 0xb1, 0x56, 0x5d, 0x39, 0x1b, 0x94, 0x8b, 0x64, 0x82, 0x9b, 0x8e, 0x80, 0x6a, 0xe4, 0x75,
+	0x62, 0xe8, 0x3b, 0x98, 0xa9, 0x13, 0x76, 0xb5, 0x0e, 0xbc, 0x13, 0xdc, 0x0d, 0x8a, 0xe3, 0x5a,
+	0xa7, 0xd5, 0xa2, 0xc6, 0x5a, 0xf5, 0xda, 0xd9, 0xa0, 0xbc, 0x1c, 0x50, 0x58, 0x33, 0xa4, 0x40,
+	0x8d, 0xb4, 0x46, 0x09, 0xfd, 0x00, 0x73, 0xfb, 0xbe, 0xf7, 0xdc, 0x0d, 0x5c, 0xaf, 0x4b, 0x41,
+	0xc5, 0x09, 0x4a, 0x7b, 0x99, 0xd3, 0xd6, 0x0b, 0x1b, 0x6b, 0xd5, 0xeb, 0x67, 0x83, 0xf2, 0xd5,
+	0x9e, 0x80, 0xb2, 0x06, 0x74, 0xce, 0xe8, 0x28, 0xe8, 0x00, 0xa6, 0x6b, 0x9d, 0x7e, 0x10, 0x62,
+	0x7f, 0xcf, 0x39, 0xc5, 0xc5, 0x49, 0x4a, 0x7e, 0x51, 0xf0, 0x25, 0x2a, 0x69, 0xac, 0x55, 0x4b,
+	0x67, 0x83, 0xf2, 0x95, 0x16, 0x03, 0x35, 0xbb, 0xce, 0xa9, 0xce, 0x72, 0x95, 0x0c, 0xfa, 0x04,
+	0xc6, 0x9f, 0x04, 0xd8, 0x2f, 0xe6, 0x28, 0xb9, 0x59, 0x4e, 0x8e, 0x80, 0x1a, 0x6b, 0x6c, 0xfe,
+	0xfb, 0x01, 0xf6, 0x35, 0x7c, 0x8a, 0x40, 0x10, 0x6d, 0xaf, 0x83, 0x8b, 0x79, 0x0d, 0x91, 0x80,
+	0x1a, 0x1f, 0x31, 0x44, 0xdf, 0xeb, 0xe8, 0x0d, 0x53, 0x04, 0xb4, 0x03, 0x79, 0xd2, 0x72, 0xd0,
+	0x73, 0x5a, 0xb8, 0x08, 0x14, 0xbb, 0xc0, 0xb1, 0x25, 0xbc, 0xba, 0x7c, 0x36, 0x28, 0x2f, 0x74,
+	0xc5, 0xa7, 0x46, 0x25, 0xc2, 0x46, 0xdf, 0xc0, 0x64, 0x1d, 0xfb, 0xcf, 0xb1, 0x5f, 0x9c, 0xa6,
+	0x74, 0x2e, 0x8b, 0x89, 0xa4, 0xc0, 0xc6, 0x5a, 0x75, 0xf1, 0x6c, 0x50, 0x2e, 0x04, 0xf4, 0x4b,
+	0xa3, 0xc1, 0xd1, 0x88, 0xb4, 0xd9, 0xf8, 0x39, 0xf6, 0x03, 0x7c, 0xd0, 0xef, 0x76, 0x71, 0xa7,
+	0x38, 0xa3, 0x49, 0x9b, 0x56, 0x26, 0xa4, 0xcd, 0x67, 0xc0, 0x66, 0x48, 0xa1, 0xba, 0xb4, 0x69,
+	0x08, 0xe8, 0x18, 0x0a, 0xec, 0xaf, 0x9a, 0xd7, 0xed, 0xe2, 0x16, 0x59, 0x52, 0xc5, 0x59, 0xda,
+	0xc0, 0x55, 0xde, 0x40, 0xbc, 0xb8, 0xb1, 0x56, 0x2d, 0x9f, 0x0d, 0xca, 0xd7, 0x18, 0xed, 0x66,
+	0x4b, 0x16, 0x68, 0xcd, 0x24, 0xa8, 0x92, 0x71, 0x54, 0x5a, 0x2d, 0x1c, 0x04, 0x36, 0xfe, 0x45,
+	0x1f, 0x07, 0x61, 0x71, 0x4e, 0x1b, 0x87, 0x56, 0xd6, 0x58, 0x67, 0xe3, 0x70, 0x28, 0xb0, 0xe9,
+	0x33, 0xa8, 0x3e, 0x0e, 0x0d, 0x01, 0xed, 0x03, 0x54, 0x7a, 0xbd, 0x3a, 0x0e, 0x88, 0x30, 0x16,
+	0x2f, 0x53, 0xd2, 0x0b, 0x9c, 0xf4, 0x53, 0x7c, 0xc8, 0x0b, 0x1a, 0x6b, 0xd5, 0xab, 0x67, 0x83,
+	0xf2, 0x92, 0xd3, 0xeb, 0x35, 0x03, 0x06, 0xd2, 0x88, 0x2a, 0x34, 0x18, 0xdf, 0x4f, 0xbd, 0x10,
+	0x73, 0x51, 0x2c, 0x16, 0x62, 0x7c, 0x57, 0xca, 0x44, 0x7f, 0x7d, 0x0a, 0x6c, 0x72, 0xb1, 0x8e,
+	0xf3, 0x5d, 0x41, 0x20, 0x6b, 0x71, 0xc3, 0x09, 0x9d, 0x43, 0x27, 0xc0, 0x5c, 0x3c, 0xe6, 0xb5,
+	0xb5, 0xa8, 0x17, 0x36, 0xd6, 0xd9, 0x5a, 0x6c, 0x73, 0x68, 0x33, 0x45, 0x5e, 0x62, 0xf4, 0x08,
+	0x47, 0xa2, 0x81, 0x17, 0xd1, 0x08, 0x8e, 0xbc, 0xc0, 0x87, 0xe9, 0x1c, 0x89, 0xaa, 0xa2, 0x6d,
+	0xc8, 0x3d, 0xc5, 0x87, 0x4c, 0x73, 0x2c, 0x50, 0x7a, 0xf3, 0x11, 0x3d, 0xa6, 0x33, 0xd6, 0xd9,
+	0xaa, 0x20, 0xd4, 0x92, 0xda, 0x42, 0x62, 0xa3, 0xdf, 0xcd, 0xc0, 0xb2, 0x58, 0xe1, 0x38, 0x7c,
+	0xe1, 0xf9, 0x27, 0x6e, 0xf7, 0xa8, 0xe6, 0x75, 0x9f, 0xb9, 0x47, 0xc5, 0x45, 0x4a, 0xf9, 0x46,
+	0x4c, 0x69, 0xc4, 0x6a, 0x35, 0xd6, 0xaa, 0x3f, 0x39, 0x1b, 0x94, 0x6f, 0x4a, 0x05, 0x22, 0xcb,
+	0x89, 0x40, 0x3e, 0x73, 0x8f, 0xb4, 0x86, 0x4d, 0x6d, 0xa1, 0xbf, 0x9e, 0x81, 0x2b, 0x7c, 0x74,
+	0x36, 0x6e, 0x79, 0x7e, 0x3b, 0xea, 0xc6, 0x12, 0xed, 0x46, 0x59, 0xae, 0xd6, 0xb4, 0x4a, 0x8d,
+	0xb5, 0xea, 0xad, 0xb3, 0x41, 0xd9, 0xe2, 0x8c, 0x6b, 0xfa, 0xa2, 0x38, 0xad, 0x13, 0x86, 0x86,
+	0x88, 0x24, 0x10, 0xe5, 0xbf, 0xef, 0xe3, 0x67, 0xd8, 0xc7, 0xdd, 0x16, 0x2e, 0x5e, 0xd1, 0x24,
+	0x41, 0x2f, 0x14, 0x5a, 0x99, 0x6c, 0x25, 0xcd, 0x9e, 0x04, 0xeb, 0x92, 0xa0, 0xa3, 0xa0, 0x5f,
+	0x00, 0xe2, 0x0c, 0xa8, 0xf4, 0xdb, 0x6e, 0xc8, 0x07, 0xb8, 0x4c, 0x5b, 0xb9, 0xa6, 0xf3, 0x59,
+	0xa9, 0xd0, 0x58, 0xab, 0x5a, 0x67, 0x83, 0xf2, 0xaa, 0x60, 0xb1, 0x43, 0x8a, 0xd2, 0x06, 0x96,
+	0x42, 0x9c, 0x68, 0xde, 0x5d, 0xaf, 0x75, 0x52, 0x2c, 0x6a, 0x9a, 0x97, 0x80, 0x84, 0xca, 0xee,
+	0x78, 0xad, 0x13, 0x5d, 0xf3, 0x92, 0x52, 0x14, 0xc2, 0x02, 0x9f, 0x25, 0x1b, 0x07, 0xa1, 0xef,
+	0x52, 0xdd, 0x11, 0x14, 0xaf, 0x52, 0x3a, 0x2b, 0x42, 0x07, 0x27, 0x6b, 0x34, 0x3e, 0x64, 0xbd,
+	0xe5, 0x82, 0xd0, 0xf4, 0x95, 0x32, 0xad, 0x99, 0x34, 0xf2, 0xe8, 0xaf, 0xc0, 0xd2, 0x53, 0xb7,
+	0xdb, 0xf6, 0x5e, 0x04, 0x1b, 0x38, 0x38, 0x09, 0xbd, 0x5e, 0x9d, 0x59, 0x7e, 0xc5, 0x12, 0x6d,
+	0x77, 0x55, 0x88, 0x79, 0x5a, 0x9d, 0xc6, 0x7a, 0xf5, 0x9d, 0xb3, 0x41, 0xf9, 0xad, 0x17, 0xac,
+	0xb0, 0xd9, 0x66, 0xa5, 0x4d, 0x6e, 0x3c, 0x6a, 0x8d, 0xa7, 0xb7, 0x42, 0x44, 0x40, 0x2f, 0x28,
+	0x5e, 0xd3, 0x44, 0x40, 0x2f, 0x14, 0xca, 0x20, 0xd6, 0xa0, 0x2e, 0x02, 0x3a, 0x0a, 0xda, 0x82,
+	0x9c, 0x50, 0x0f, 0xc5, 0x15, 0x6d, 0xe9, 0x0a, 0x70, 0x63, 0x9d, 0x59, 0x40, 0x42, 0xc5, 0xe8,
+	0x2b, 0x57, 0xd4, 0x42, 0xbb, 0x90, 0xa7, 0x3a, 0x92, 0xaa, 0xac, 0xeb, 0x94, 0x12, 0x12, 0x82,
+	0x2a, 0xe0, 0x8d, 0xf5, 0x6a, 0xf1, 0x6c, 0x50, 0x5e, 0x64, 0x5a, 0x36, 0xa1, 0xa8, 0x22, 0x02,
+	0x68, 0x1d, 0xc6, 0x2a, 0xbd, 0x5e, 0x71, 0x95, 0xd2, 0x99, 0x89, 0xe8, 0x34, 0xd6, 0xab, 0xf3,
+	0x67, 0x83, 0xf2, 0xac, 0xd3, 0xd3, 0x87, 0x45, 0x6a, 0x57, 0x01, 0x72, 0xc2, 0x20, 0x7b, 0x30,
+	0x9e, 0x9b, 0x2a, 0xe4, 0xac, 0x6d, 0x98, 0x78, 0xea, 0x84, 0xad, 0x63, 0xf4, 0x0d, 0x4c, 0x3c,
+	0x74, 0xbb, 0xed, 0xa0, 0x98, 0xb9, 0x31, 0x46, 0xf7, 0x6c, 0x66, 0x2d, 0xd2, 0x42, 0x52, 0x50,
+	0x5d, 0xfe, 0xe5, 0xa0, 0x7c, 0xe9, 0x6c, 0x50, 0xbe, 0x7c, 0x42, 0xaa, 0x29, 0x26, 0x23, 0xc3,
+	0xb3, 0xfe, 0x5d, 0x16, 0xf2, 0xb2, 0x36, 0x5a, 0x81, 0x71, 0xf2, 0x3f, 0xb5, 0x3d, 0xf3, 0xd5,
+	0xdc, 0xd9, 0xa0, 0x3c, 0x4e, 0xf0, 0x6c, 0x0a, 0x45, 0x6b, 0x30, 0xbd, 0xeb, 0x39, 0xed, 0x3a,
+	0x6e, 0xf9, 0x38, 0x0c, 0xa8, 0x71, 0x99, 0xab, 0x16, 0xce, 0x06, 0xe5, 0x99, 0x8e, 0xe7, 0xb4,
+	0x9b, 0x01, 0x83, 0xdb, 0x6a, 0x25, 0x42, 0x91, 0x5a, 0x46, 0x63, 0x11, 0x45, 0x62, 0x41, 0xd8,
+	0x14, 0x8a, 0x1e, 0xc0, 0xe4, 0x7d, 0xb7, 0x43, 0xf6, 0x9a, 0x71, 0xda, 0xff, 0x95, 0x78, 0xff,
+	0xef, 0xb0, 0xe2, 0xcd, 0x6e, 0xe8, 0xbf, 0x64, 0x86, 0xc3, 0x33, 0x0a, 0x50, 0x06, 0xc2, 0x29,
+	0xa0, 0x7b, 0x30, 0x55, 0xef, 0x1f, 0xd2, 0xee, 0x4f, 0xd0, 0xc6, 0xe8, 0xec, 0x06, 0xfd, 0xc3,
+	0x26, 0x19, 0x82, 0x82, 0x20, 0xaa, 0x95, 0x3e, 0x83, 0x69, 0x85, 0x3c, 0x2a, 0xc0, 0xd8, 0x09,
+	0x7e, 0xc9, 0xc6, 0x6e, 0x93, 0x3f, 0xd1, 0x22, 0x4c, 0x3c, 0x77, 0x3a, 0x7d, 0x4c, 0x87, 0x9a,
+	0xb7, 0xd9, 0xc7, 0xe7, 0xd9, 0x4f, 0x33, 0xd6, 0x7f, 0x1d, 0x87, 0xc2, 0xb6, 0x17, 0x84, 0xc4,
+	0x92, 0x95, 0x5b, 0xf2, 0x4d, 0x98, 0x24, 0xb0, 0x9d, 0x0d, 0xce, 0xbf, 0xe9, 0xb3, 0x41, 0x79,
+	0xea, 0xd8, 0x0b, 0xc2, 0xa6, 0xdb, 0xb6, 0x79, 0x11, 0x7a, 0x17, 0x72, 0x7b, 0x5e, 0x1b, 0x53,
+	0xa6, 0x50, 0xb2, 0xd5, 0xd9, 0xb3, 0x41, 0x39, 0xdf, 0xf5, 0xda, 0x98, 0x5a, 0x85, 0xb6, 0x2c,
+	0x46, 0x0d, 0x6e, 0xcd, 0x31, 0xde, 0x55, 0x09, 0xef, 0x88, 0xf9, 0xf6, 0xeb, 0x41, 0xf9, 0xe3,
+	0x0b, 0x1c, 0x37, 0xee, 0xd4, 0x5f, 0x06, 0x21, 0x3e, 0x25, 0x94, 0xb8, 0xb1, 0xf7, 0x14, 0x16,
+	0x2b, 0xed, 0xb6, 0xcb, 0x30, 0xf6, 0x7d, 0xb7, 0xdb, 0x72, 0x7b, 0x4e, 0x27, 0xa0, 0x73, 0x90,
+	0xaf, 0xde, 0x3c, 0x1b, 0x94, 0xcb, 0x8e, 0x2c, 0x6f, 0xf6, 0x64, 0x05, 0x85, 0x87, 0xa9, 0x04,
+	0xd0, 0x3a, 0xe4, 0x36, 0xf6, 0xea, 0xd4, 0x14, 0x2c, 0x4e, 0x50, 0x62, 0x74, 0x73, 0x6c, 0x77,
+	0x03, 0x3a, 0x34, 0x95, 0x80, 0xac, 0x88, 0x3e, 0x86, 0x99, 0xfd, 0xfe, 0x61, 0xc7, 0x6d, 0x1d,
+	0xec, 0xd6, 0x1f, 0xe2, 0x97, 0xd4, 0x86, 0x9e, 0x61, 0x2a, 0xb3, 0x47, 0xe1, 0xcd, 0xb0, 0x13,
+	0x34, 0x4f, 0xf0, 0x4b, 0x5b, 0xab, 0x17, 0xe1, 0xd5, 0xeb, 0xdb, 0x04, 0x6f, 0x2a, 0x81, 0x17,
+	0x04, 0xc7, 0x2a, 0x1e, 0xab, 0x87, 0xee, 0x02, 0x30, 0xcb, 0xa4, 0xd2, 0x6e, 0x33, 0x13, 0x3b,
+	0x5f, 0xbd, 0x7c, 0x36, 0x28, 0x4f, 0x73, 0x5b, 0xc6, 0x69, 0xb7, 0x7d, 0x5b, 0xa9, 0x82, 0x6a,
+	0x90, 0xb3, 0x3d, 0xc6, 0x60, 0x6e, 0x58, 0x5f, 0x96, 0x86, 0x35, 0x03, 0xf3, 0xa3, 0x14, 0xff,
+	0x52, 0x47, 0x29, 0x6a, 0xa0, 0x32, 0x4c, 0xed, 0x79, 0x35, 0xa7, 0x75, 0xcc, 0xcc, 0xeb, 0x5c,
+	0x75, 0xe2, 0x6c, 0x50, 0xce, 0xfc, 0xb6, 0x2d, 0xa0, 0xd6, 0xbf, 0xc8, 0x41, 0x81, 0xd8, 0xf0,
+	0x9a, 0x44, 0xbd, 0x0f, 0x79, 0xd6, 0xf7, 0x87, 0x5c, 0x30, 0x67, 0xaa, 0x73, 0x67, 0x83, 0x32,
+	0xf0, 0x01, 0x92, 0xc1, 0x45, 0x15, 0xd0, 0x6d, 0xc8, 0x11, 0x0a, 0xdd, 0x48, 0xb4, 0x66, 0xce,
+	0x06, 0xe5, 0x5c, 0x9f, 0xc3, 0x6c, 0x59, 0x8a, 0xea, 0x30, 0xb5, 0xf9, 0x63, 0xcf, 0xf5, 0x71,
+	0xc0, 0x8f, 0x72, 0xa5, 0x3b, 0xec, 0xc4, 0x7e, 0x47, 0x9c, 0xd8, 0xef, 0x1c, 0x88, 0x13, 0x7b,
+	0xf5, 0x3a, 0x57, 0x21, 0xf3, 0x98, 0xa1, 0x44, 0xe3, 0xfb, 0xbd, 0x3f, 0x2d, 0x67, 0x6c, 0x41,
+	0x09, 0xbd, 0x0f, 0x93, 0xf7, 0x3d, 0xff, 0xd4, 0x09, 0xe9, 0x09, 0x2e, 0xcf, 0x97, 0x2b, 0x85,
+	0x68, 0xcb, 0x95, 0x42, 0xd0, 0x7d, 0x98, 0xb3, 0xbd, 0x7e, 0x88, 0x0f, 0x3c, 0x61, 0x6e, 0xb2,
+	0x55, 0xbb, 0x7a, 0x36, 0x28, 0x97, 0x7c, 0x52, 0xd2, 0x0c, 0xbd, 0xa4, 0x61, 0x69, 0xc7, 0xb0,
+	0xd0, 0x26, 0xcc, 0x69, 0x86, 0x71, 0x50, 0x9c, 0xa4, 0x92, 0xc7, 0x8c, 0x06, 0xcd, 0x9c, 0x56,
+	0xe5, 0x2f, 0x86, 0x84, 0xf6, 0x60, 0xfe, 0x61, 0xff, 0x10, 0xfb, 0x5d, 0x1c, 0xe2, 0x40, 0xf4,
+	0x68, 0x8a, 0xf6, 0xe8, 0xc6, 0xd9, 0xa0, 0xbc, 0x72, 0x22, 0x0b, 0x53, 0xfa, 0x94, 0x44, 0x45,
+	0x18, 0x2e, 0xf3, 0x8e, 0xca, 0x6d, 0x28, 0xc7, 0xcd, 0x69, 0xa6, 0xe2, 0x62, 0xa5, 0xd5, 0x9b,
+	0x9c, 0xcb, 0xd7, 0xe4, 0xd8, 0x93, 0x1b, 0x93, 0x1d, 0xa7, 0x49, 0x56, 0x9c, 0xd4, 0x26, 0x79,
+	0xda, 0x5b, 0x76, 0x48, 0x13, 0xda, 0x44, 0x95, 0x45, 0xa9, 0x57, 0x76, 0x61, 0xe2, 0x49, 0xe0,
+	0x1c, 0x31, 0x49, 0x9c, 0x5b, 0x7b, 0x8b, 0xf7, 0x28, 0x2e, 0x7d, 0xf4, 0x5c, 0x4f, 0x2b, 0x56,
+	0x17, 0xc8, 0x0e, 0xd2, 0x27, 0x7f, 0xaa, 0x3b, 0x08, 0x2d, 0x43, 0xdf, 0x02, 0xf0, 0x5e, 0x91,
+	0x9d, 0x6d, 0x9a, 0xef, 0xb5, 0xda, 0x20, 0xc9, 0x26, 0xb6, 0xca, 0xc7, 0x77, 0x45, 0x8e, 0x4f,
+	0xdb, 0xeb, 0x6c, 0x85, 0x08, 0xfa, 0x06, 0x66, 0xa8, 0xba, 0x12, 0x33, 0x3a, 0x43, 0x67, 0x94,
+	0x1e, 0xfd, 0x89, 0x02, 0x4c, 0x9b, 0x4f, 0x0d, 0x01, 0xfd, 0x55, 0x58, 0xe2, 0xe4, 0x62, 0x66,
+	0xc6, 0x2c, 0x37, 0xab, 0xb4, 0xee, 0xe9, 0x75, 0xaa, 0xef, 0xf1, 0x9e, 0x5a, 0xb2, 0xa7, 0x46,
+	0xc3, 0xc3, 0x4e, 0x6f, 0xc6, 0xfa, 0x0e, 0xf2, 0x92, 0x79, 0x68, 0x0a, 0xc6, 0x2a, 0x9d, 0x4e,
+	0xe1, 0x12, 0xf9, 0xa3, 0x5e, 0xdf, 0x2e, 0x64, 0xd0, 0x1c, 0x40, 0x24, 0x31, 0x85, 0x2c, 0x9a,
+	0x89, 0x8c, 0x95, 0xc2, 0x18, 0xad, 0xdf, 0xeb, 0x15, 0xc6, 0x11, 0x8a, 0x5b, 0x49, 0x85, 0x09,
+	0xeb, 0xbf, 0x67, 0x12, 0x82, 0x45, 0xf6, 0x65, 0x6e, 0x58, 0x51, 0x39, 0x60, 0x9b, 0x0f, 0xdd,
+	0x97, 0xb9, 0x49, 0xc6, 0x36, 0x16, 0xb5, 0x12, 0xd1, 0x15, 0xfb, 0x84, 0x07, 0x2d, 0xaf, 0xa3,
+	0xea, 0x8a, 0x1e, 0x87, 0xd9, 0xb2, 0x14, 0xad, 0x29, 0x5a, 0x65, 0x2c, 0xda, 0x58, 0x85, 0x56,
+	0x51, 0x25, 0x4c, 0xea, 0x97, 0x35, 0xc5, 0xfa, 0x1a, 0x8f, 0x70, 0x52, 0x24, 0x5a, 0xd6, 0xb3,
+	0xfa, 0x86, 0x39, 0x43, 0x5f, 0x24, 0x8c, 0x45, 0x36, 0x42, 0x2a, 0x94, 0xb1, 0xa9, 0x49, 0xd8,
+	0x81, 0x65, 0x98, 0xd8, 0xf5, 0x8e, 0xdc, 0x2e, 0x1f, 0x64, 0xfe, 0x6c, 0x50, 0x9e, 0xe8, 0x10,
+	0x80, 0xcd, 0xe0, 0xd6, 0xff, 0xcd, 0xa8, 0xf2, 0x2b, 0xed, 0x95, 0x4c, 0xaa, 0xbd, 0xf2, 0x3e,
+	0xe4, 0xf9, 0xa1, 0x66, 0x67, 0x83, 0x53, 0xa4, 0xfa, 0x58, 0x9c, 0x87, 0xdc, 0xb6, 0x1d, 0x55,
+	0x20, 0x3b, 0x0d, 0x53, 0xce, 0x74, 0xa7, 0x19, 0x8b, 0x76, 0x1a, 0xae, 0xbe, 0xd9, 0x4e, 0x13,
+	0x55, 0x21, 0x13, 0xa9, 0x7a, 0x93, 0xc6, 0xa3, 0x89, 0x54, 0xfd, 0x46, 0xba, 0xaf, 0xe8, 0x73,
+	0x80, 0xca, 0xd3, 0x3a, 0x91, 0xfe, 0x8a, 0xbd, 0xc7, 0x75, 0x28, 0x75, 0x35, 0x39, 0x2f, 0x82,
+	0x26, 0x5d, 0x2d, 0x8e, 0xaf, 0x6e, 0x49, 0x4a, 0x6d, 0xab, 0x03, 0x73, 0x5b, 0x38, 0x24, 0xb3,
+	0x26, 0x36, 0x9c, 0xe1, 0xc3, 0xff, 0x12, 0xa6, 0x9f, 0xba, 0xe1, 0xb1, 0x6e, 0x00, 0xd2, 0xc6,
+	0x5e, 0xb8, 0xe1, 0xb1, 0x30, 0x00, 0x95, 0xc6, 0xd4, 0xea, 0xd6, 0x26, 0x5c, 0xe6, 0xad, 0xc9,
+	0xfd, 0x6d, 0x4d, 0x27, 0x98, 0x89, 0x2c, 0x4a, 0x95, 0xa0, 0x4e, 0x06, 0xc7, 0x15, 0x3e, 0xaa,
+	0x27, 0xb6, 0x00, 0x66, 0x0d, 0x9b, 0x3c, 0x2d, 0x54, 0x70, 0x62, 0x5b, 0x43, 0x7c, 0x43, 0xb0,
+	0x9e, 0xc0, 0xec, 0x7e, 0xa7, 0x7f, 0xe4, 0x76, 0x89, 0x80, 0xd6, 0xf1, 0x2f, 0xd0, 0x06, 0x40,
+	0x04, 0xe0, 0x2d, 0x08, 0xf7, 0x42, 0x54, 0xd0, 0x58, 0xe7, 0x53, 0x4c, 0x21, 0x54, 0x87, 0xdb,
+	0x0a, 0x9e, 0xf5, 0xf7, 0xc6, 0x00, 0xf1, 0x36, 0xea, 0xa1, 0x13, 0xe2, 0x3a, 0x0e, 0xc9, 0x76,
+	0x71, 0x05, 0xb2, 0xd2, 0x6c, 0x9c, 0x3c, 0x1b, 0x94, 0xb3, 0x6e, 0xdb, 0xce, 0xee, 0x6c, 0xa0,
+	0x0f, 0x61, 0x82, 0x56, 0xa3, 0xbc, 0x9e, 0x93, 0xed, 0xa9, 0x14, 0x98, 0x4c, 0x07, 0xe4, 0x4f,
+	0x9b, 0x55, 0x46, 0x1f, 0x41, 0x7e, 0x03, 0x77, 0xf0, 0x91, 0x13, 0x7a, 0x42, 0xee, 0x98, 0x21,
+	0x26, 0x80, 0xca, 0x14, 0x45, 0x35, 0xc9, 0x06, 0x6e, 0x63, 0x27, 0xf0, 0xba, 0xea, 0x06, 0xee,
+	0x53, 0x88, 0xba, 0x81, 0xb3, 0x3a, 0xe8, 0xf7, 0x33, 0x30, 0x5d, 0xe9, 0x76, 0xb9, 0x81, 0x13,
+	0x70, 0xd7, 0xea, 0xd2, 0x1d, 0xe9, 0x19, 0xdf, 0x75, 0x0e, 0x71, 0xa7, 0x41, 0x4c, 0xe6, 0xa0,
+	0xfa, 0x3d, 0xd1, 0xa9, 0x7f, 0x32, 0x28, 0x7f, 0xf1, 0x2a, 0xce, 0xf6, 0x3b, 0x07, 0xbe, 0xe3,
+	0x86, 0x01, 0xf5, 0x63, 0x45, 0x0d, 0xaa, 0x62, 0xa6, 0xf4, 0x03, 0xbd, 0x0b, 0x13, 0x44, 0xbe,
+	0x85, 0x1d, 0x40, 0x27, 0x9b, 0xac, 0x03, 0xed, 0xf0, 0x43, 0x6b, 0x58, 0x37, 0x21, 0xcf, 0x39,
+	0xb9, 0xb3, 0x61, 0x9a, 0x02, 0x6b, 0x03, 0xae, 0x53, 0x2b, 0x0e, 0x13, 0xc9, 0xa5, 0xde, 0x1c,
+	0x2e, 0x89, 0x91, 0xd9, 0x3f, 0x45, 0xc1, 0x12, 0x9b, 0x4e, 0x08, 0xf5, 0x06, 0xd9, 0xa2, 0xc4,
+	0xaa, 0xc1, 0xca, 0x16, 0x0e, 0x6d, 0x1c, 0xe0, 0x70, 0xdf, 0x09, 0x82, 0x17, 0x9e, 0xdf, 0xa6,
+	0x45, 0x17, 0x22, 0xf2, 0xb7, 0x32, 0x50, 0xae, 0xf9, 0x98, 0xcc, 0xb4, 0x91, 0xd0, 0xf0, 0x15,
+	0xbc, 0xc2, 0x2f, 0x17, 0xb2, 0x51, 0x29, 0xe1, 0x35, 0xbf, 0x40, 0x78, 0x07, 0xc6, 0x0e, 0x0e,
+	0x76, 0xa9, 0xc4, 0x8c, 0x51, 0xc6, 0x8d, 0x85, 0x61, 0xe7, 0xd7, 0x83, 0x72, 0x6e, 0xa3, 0xcf,
+	0x2e, 0x1f, 0x6c, 0x52, 0x6e, 0x3d, 0x83, 0x25, 0x1b, 0x77, 0xf1, 0x0b, 0xe7, 0xb0, 0x83, 0x35,
+	0x73, 0xb5, 0x0c, 0x13, 0xcc, 0x59, 0x96, 0x18, 0x02, 0x83, 0xeb, 0xf6, 0x6c, 0x76, 0x84, 0x3d,
+	0x6b, 0xfd, 0x41, 0x06, 0x0a, 0x6c, 0xb8, 0x55, 0x2f, 0x3c, 0xdf, 0xf8, 0xf8, 0x08, 0xb2, 0xc3,
+	0x47, 0x80, 0x6e, 0x45, 0xdc, 0x1e, 0x8b, 0x36, 0x3f, 0xda, 0x55, 0xa2, 0xc3, 0x45, 0x21, 0x19,
+	0x10, 0x93, 0x25, 0x76, 0x34, 0xa2, 0x03, 0xa2, 0xb2, 0x24, 0x24, 0xe8, 0x8f, 0xb2, 0x30, 0xaf,
+	0x74, 0x31, 0xe8, 0x79, 0xdd, 0x00, 0x93, 0x33, 0x1e, 0x11, 0x16, 0xa5, 0x9f, 0xf4, 0x8c, 0x47,
+	0xb6, 0xcc, 0x66, 0x64, 0x89, 0xd3, 0x0e, 0xbf, 0x4b, 0x0e, 0x17, 0x9d, 0xc4, 0x71, 0x90, 0x2a,
+	0x6e, 0x56, 0x55, 0x14, 0x9f, 0xbb, 0xd3, 0x77, 0x21, 0x47, 0xff, 0x24, 0x8c, 0x18, 0x37, 0x33,
+	0x42, 0x56, 0x42, 0x2e, 0xc0, 0x03, 0xcf, 0xed, 0x3e, 0xc2, 0xe1, 0xb1, 0x27, 0x0e, 0xcf, 0x3b,
+	0x44, 0x89, 0xfd, 0x25, 0xcf, 0xed, 0x36, 0x4f, 0x29, 0xf8, 0xa2, 0x87, 0xce, 0x88, 0xa0, 0xad,
+	0x10, 0xb7, 0xee, 0x41, 0x81, 0xe8, 0x9b, 0xf3, 0xcf, 0xa8, 0xb5, 0x08, 0x68, 0x0b, 0x87, 0x55,
+	0x4f, 0xdb, 0x38, 0xac, 0x59, 0x98, 0xde, 0x77, 0xbb, 0x47, 0xe2, 0xf3, 0xdf, 0x67, 0x61, 0x86,
+	0x7d, 0xf3, 0x19, 0x88, 0xed, 0xa4, 0x99, 0xf3, 0xec, 0xa4, 0x9f, 0xc2, 0x2c, 0x77, 0xe7, 0x60,
+	0x9f, 0xba, 0x90, 0xd9, 0x7c, 0xd0, 0x13, 0x25, 0xf3, 0xea, 0x34, 0x9f, 0xb3, 0x12, 0x5b, 0xaf,
+	0x88, 0x76, 0x61, 0x8e, 0x01, 0xee, 0x63, 0x27, 0xec, 0x47, 0xa7, 0xaa, 0xcb, 0xdc, 0xce, 0x14,
+	0x60, 0xa6, 0x8c, 0x38, 0xad, 0x67, 0x1c, 0x68, 0xc7, 0x70, 0xd1, 0x37, 0x70, 0x79, 0xdf, 0xf7,
+	0x7e, 0x7c, 0xa9, 0xd8, 0x0e, 0x4c, 0x1f, 0x2f, 0x91, 0x43, 0x58, 0x8f, 0x14, 0x35, 0x55, 0x0b,
+	0x22, 0x5e, 0x9b, 0xc8, 0xd4, 0x4e, 0x50, 0xf5, 0x7c, 0xb7, 0x7b, 0x44, 0x67, 0x33, 0xc7, 0x64,
+	0xca, 0x0d, 0x9a, 0x87, 0x14, 0x68, 0xcb, 0x62, 0xeb, 0x0f, 0xc7, 0x20, 0x27, 0x1b, 0xbe, 0xa3,
+	0x9a, 0xa5, 0x7c, 0x33, 0xa6, 0xcb, 0x33, 0x3a, 0xfc, 0xd8, 0x4a, 0x0d, 0x74, 0x95, 0x39, 0xb3,
+	0x98, 0x19, 0x30, 0x45, 0x64, 0xcc, 0xe9, 0xf5, 0xa8, 0xcb, 0x8a, 0x28, 0xd3, 0x8d, 0x2a, 0xe5,
+	0x42, 0x8e, 0x29, 0xd3, 0xf6, 0xa1, 0x9d, 0xdd, 0xa8, 0x92, 0xb9, 0x7e, 0xbc, 0xb3, 0x51, 0xa3,
+	0x03, 0xca, 0xb1, 0xb9, 0xf6, 0xdc, 0x76, 0xcb, 0xa6, 0x50, 0x52, 0x5a, 0xaf, 0x3c, 0xda, 0xe5,
+	0x9d, 0xa6, 0xa5, 0x81, 0x73, 0xda, 0xb1, 0x29, 0x94, 0xd8, 0x81, 0x6c, 0x8f, 0xae, 0x79, 0xdd,
+	0xd0, 0xf7, 0x3a, 0x01, 0x75, 0x15, 0xe4, 0xb4, 0xed, 0xbc, 0xc5, 0x8b, 0xec, 0x58, 0x55, 0xf4,
+	0x14, 0x96, 0x2b, 0xed, 0xe7, 0x4e, 0xb7, 0x85, 0xdb, 0xac, 0xe4, 0xa9, 0xe7, 0x9f, 0x3c, 0xeb,
+	0x78, 0x2f, 0x02, 0x7a, 0xca, 0xcb, 0xf1, 0xf3, 0x22, 0xaf, 0xd2, 0xe4, 0xe4, 0x5e, 0x88, 0x4a,
+	0xb6, 0x09, 0x9b, 0xa8, 0x88, 0x5a, 0xc7, 0xeb, 0xb7, 0xe9, 0xf1, 0x2e, 0xc7, 0x54, 0x44, 0x8b,
+	0x00, 0x6c, 0x06, 0x27, 0x5c, 0xda, 0xae, 0x3f, 0xa2, 0xa7, 0x33, 0xce, 0xa5, 0xe3, 0xe0, 0xd4,
+	0x26, 0x30, 0xf4, 0x0e, 0x4c, 0x09, 0x93, 0x96, 0x39, 0x05, 0xa8, 0xc7, 0x48, 0x98, 0xb2, 0xa2,
+	0xcc, 0xfa, 0x00, 0xe6, 0xd9, 0xa2, 0x39, 0xb7, 0xa5, 0x66, 0xed, 0x03, 0xd4, 0xf1, 0xa9, 0xd3,
+	0x3b, 0xf6, 0xc8, 0xc4, 0x56, 0xd5, 0x2f, 0x6e, 0xba, 0x20, 0xe9, 0xe8, 0xe7, 0x05, 0x8d, 0x75,
+	0x61, 0xcb, 0x8a, 0x9a, 0xb6, 0x82, 0x65, 0xfd, 0x97, 0x2c, 0x20, 0xea, 0xf0, 0xae, 0x87, 0x3e,
+	0x76, 0x4e, 0x45, 0x37, 0x3e, 0x83, 0x19, 0xa6, 0xff, 0x18, 0x98, 0x76, 0x87, 0xd8, 0x45, 0x4c,
+	0xf0, 0xd5, 0xa2, 0xed, 0x4b, 0xb6, 0x56, 0x95, 0xa0, 0xda, 0x38, 0xe8, 0x9f, 0x0a, 0xd4, 0xac,
+	0x86, 0xaa, 0x16, 0x11, 0x54, 0xf5, 0x1b, 0x7d, 0x03, 0x73, 0x35, 0xef, 0xb4, 0x47, 0x78, 0xc2,
+	0x91, 0xc7, 0xb8, 0xf5, 0xc1, 0xdb, 0xd5, 0x0a, 0xb7, 0x2f, 0xd9, 0xb1, 0xea, 0x68, 0x0f, 0x16,
+	0xee, 0x77, 0xfa, 0xc1, 0x71, 0xa5, 0xdb, 0xae, 0x75, 0xbc, 0x40, 0x50, 0x19, 0xe7, 0xce, 0x10,
+	0xbe, 0x6c, 0x93, 0x35, 0xb6, 0x2f, 0xd9, 0x69, 0x88, 0xe8, 0x1d, 0x7e, 0x7b, 0xcf, 0xad, 0xa0,
+	0xd9, 0x3b, 0xfc, 0x72, 0xff, 0x71, 0x17, 0x3f, 0x7e, 0xb6, 0x7d, 0xc9, 0x66, 0xa5, 0xd5, 0x3c,
+	0x4c, 0x09, 0x95, 0x75, 0x17, 0xe6, 0x15, 0x76, 0x12, 0xbb, 0xad, 0x1f, 0xa0, 0x12, 0xe4, 0x9e,
+	0xf4, 0x3a, 0x9e, 0xd3, 0x16, 0x66, 0x80, 0x2d, 0xbf, 0xad, 0xf7, 0x75, 0x4e, 0xa3, 0x15, 0xf5,
+	0x2c, 0xc2, 0x2a, 0x47, 0x00, 0x6b, 0x5b, 0x67, 0xee, 0xf0, 0xda, 0x5a, 0xbb, 0xd9, 0x58, 0xbb,
+	0x85, 0x38, 0xaf, 0xad, 0xa5, 0x54, 0xe6, 0x59, 0x0f, 0xa9, 0x89, 0x53, 0xe9, 0xf5, 0x3a, 0x6e,
+	0x8b, 0xee, 0x0c, 0x4c, 0xaf, 0x49, 0xeb, 0xe0, 0xb7, 0xd4, 0x3b, 0x66, 0x65, 0x5b, 0x94, 0x37,
+	0xca, 0xca, 0x2d, 0xb2, 0xf5, 0x33, 0xb8, 0x6e, 0x20, 0xc6, 0x35, 0xfc, 0x67, 0x30, 0xc5, 0x41,
+	0x31, 0x81, 0x56, 0xbd, 0xf2, 0x74, 0x3d, 0x05, 0x1c, 0x53, 0xd4, 0xb7, 0xbe, 0x83, 0xd5, 0x27,
+	0xbd, 0x00, 0xfb, 0x49, 0xf2, 0xa2, 0xab, 0x1f, 0xcb, 0x3b, 0xec, 0x8c, 0xd1, 0xe3, 0x0f, 0x67,
+	0x83, 0xf2, 0x24, 0xa3, 0x2d, 0xae, 0xae, 0xad, 0xdf, 0xcb, 0xc0, 0x2a, 0x5b, 0xaa, 0x46, 0xd2,
+	0x17, 0xe1, 0x82, 0xe2, 0x51, 0xce, 0x9a, 0x3d, 0xca, 0x43, 0x5d, 0xec, 0xd6, 0xb7, 0x60, 0xf1,
+	0x1e, 0x75, 0x3a, 0x6f, 0x68, 0x6e, 0xfe, 0x46, 0x06, 0x16, 0xd9, 0xe4, 0xbc, 0x06, 0x15, 0xf4,
+	0x15, 0xcc, 0xd5, 0x4f, 0xdc, 0x5e, 0xc3, 0xe9, 0xb8, 0x6d, 0xe6, 0x5c, 0x65, 0x1b, 0xc9, 0x12,
+	0xdd, 0x23, 0x4f, 0xdc, 0x5e, 0xf3, 0x79, 0x54, 0x94, 0xb1, 0x63, 0x95, 0xad, 0xc7, 0xb0, 0x14,
+	0xeb, 0x03, 0x17, 0x8c, 0x8f, 0xe3, 0x82, 0x91, 0x08, 0x40, 0x48, 0x97, 0x8a, 0x47, 0x70, 0x45,
+	0x4a, 0x85, 0x3e, 0x65, 0xeb, 0x31, 0x69, 0x48, 0x10, 0x4c, 0x13, 0x85, 0x16, 0x5c, 0x91, 0x92,
+	0xf0, 0x1a, 0x12, 0x20, 0x26, 0x37, 0x9b, 0x3a, 0xb9, 0x3b, 0x50, 0x52, 0x27, 0xf7, 0x75, 0x26,
+	0xf5, 0x3f, 0x67, 0x60, 0x79, 0x0b, 0x77, 0xb1, 0xef, 0xd0, 0x2e, 0x6b, 0x67, 0x0a, 0xd5, 0xb1,
+	0x9c, 0x19, 0xea, 0x58, 0x96, 0x06, 0x73, 0x36, 0xdd, 0x60, 0x26, 0xbb, 0xe1, 0x13, 0x7b, 0x87,
+	0xcb, 0x2a, 0xdd, 0x0d, 0xfb, 0xbe, 0x6b, 0x13, 0x18, 0xda, 0x89, 0x9c, 0xd2, 0xe3, 0x23, 0x9d,
+	0xd2, 0x0b, 0xdc, 0x49, 0x37, 0xc5, 0x9d, 0xd2, 0x9a, 0x2b, 0xda, 0xfa, 0x02, 0x8a, 0xc9, 0xb1,
+	0x70, 0xf9, 0x18, 0x75, 0x48, 0xb1, 0x36, 0x22, 0xe9, 0xe6, 0xf7, 0xd7, 0xd2, 0x19, 0x1f, 0x53,
+	0xa1, 0x43, 0x9c, 0x3f, 0x56, 0x3d, 0x92, 0x4f, 0x4e, 0x85, 0xb7, 0xff, 0x39, 0x91, 0x4f, 0x16,
+	0xa3, 0x90, 0x31, 0xc7, 0x28, 0x70, 0x19, 0x65, 0xa8, 0x02, 0xc1, 0x7a, 0x0a, 0x57, 0x34, 0xa2,
+	0x91, 0xd4, 0x7f, 0x05, 0x39, 0x01, 0x8b, 0xf9, 0x26, 0x34, 0xb2, 0x74, 0xde, 0x02, 0x81, 0x2c,
+	0x51, 0xac, 0x3f, 0xcb, 0xc0, 0x32, 0xdb, 0x5d, 0x92, 0xe3, 0x3e, 0xff, 0xec, 0xff, 0x46, 0x1c,
+	0x5e, 0xf7, 0x52, 0x1c, 0x5e, 0x14, 0x45, 0x75, 0x78, 0xa9, 0x6e, 0xae, 0x07, 0xe3, 0xb9, 0x6c,
+	0x61, 0xcc, 0x6a, 0x40, 0x31, 0x39, 0xc2, 0x37, 0x30, 0x27, 0x5b, 0xb0, 0xac, 0x2c, 0xf4, 0xd7,
+	0x96, 0x98, 0xa8, 0xc5, 0x37, 0x28, 0x31, 0x51, 0xc5, 0x37, 0x26, 0x31, 0x3b, 0xb0, 0xc0, 0x08,
+	0xeb, 0xab, 0x6b, 0x4d, 0x5d, 0x5d, 0xa9, 0xf1, 0x32, 0xc9, 0x05, 0xf7, 0x88, 0x2e, 0x38, 0x51,
+	0x25, 0xea, 0xe1, 0x47, 0x30, 0xc9, 0x43, 0x02, 0x59, 0xff, 0x52, 0x88, 0x51, 0xcd, 0xcb, 0xe2,
+	0x00, 0x6d, 0x5e, 0xd9, 0x2a, 0xd2, 0x21, 0x93, 0x73, 0x0a, 0x77, 0x78, 0xcb, 0x53, 0xe3, 0xb7,
+	0x44, 0xc5, 0xc5, 0x4a, 0x5e, 0x73, 0xd7, 0x78, 0x0c, 0x45, 0xb6, 0x6b, 0x28, 0x54, 0x5f, 0x6b,
+	0xdf, 0xf8, 0x14, 0x8a, 0x4c, 0x9c, 0x52, 0x08, 0x0e, 0xdf, 0x0c, 0x56, 0x61, 0x45, 0x6e, 0x06,
+	0x69, 0xa3, 0xff, 0x3b, 0x19, 0xb8, 0xba, 0x85, 0x43, 0x3d, 0x6a, 0xea, 0xcf, 0x65, 0xef, 0xfe,
+	0x1e, 0x4a, 0x69, 0x1d, 0xe1, 0x53, 0xf1, 0x75, 0x7c, 0x2a, 0x8c, 0x21, 0x62, 0xe9, 0x53, 0xf2,
+	0x33, 0xb8, 0xc6, 0xa6, 0x44, 0xaf, 0x2f, 0x06, 0xfa, 0x45, 0x6c, 0x56, 0x8c, 0xd4, 0xd3, 0x66,
+	0xe7, 0x1f, 0x64, 0xe0, 0x1a, 0x63, 0x72, 0x3a, 0xf1, 0xdf, 0xb4, 0x75, 0xb7, 0x07, 0x65, 0x39,
+	0xe7, 0x6f, 0x60, 0x62, 0xad, 0x16, 0x20, 0x41, 0xa6, 0x56, 0xb7, 0x05, 0x89, 0xab, 0x30, 0x56,
+	0xab, 0xdb, 0xfc, 0x02, 0x9a, 0x6e, 0xda, 0xad, 0xc0, 0xb7, 0x09, 0x2c, 0xae, 0xc1, 0xb3, 0xe7,
+	0xd0, 0xe0, 0xd6, 0xcf, 0x61, 0x41, 0x6b, 0x84, 0xcf, 0xfb, 0x0a, 0x8c, 0xd7, 0xb0, 0x1f, 0xf2,
+	0x66, 0xe8, 0x48, 0x5b, 0xd8, 0x0f, 0x6d, 0x0a, 0x45, 0xb7, 0x60, 0xaa, 0x56, 0xa1, 0xde, 0x46,
+	0x6a, 0x5b, 0xcc, 0x30, 0xc5, 0xd4, 0x72, 0x9a, 0x34, 0x92, 0xdc, 0x16, 0x85, 0xd6, 0x7f, 0xc8,
+	0x28, 0xd4, 0x09, 0xfa, 0xe8, 0x31, 0x7c, 0x40, 0x8e, 0xc7, 0x84, 0x67, 0xca, 0x10, 0xe6, 0xc9,
+	0xb6, 0xc5, 0x3d, 0x35, 0x6c, 0xe7, 0xb3, 0x95, 0x4a, 0xe7, 0xf4, 0x94, 0x8a, 0x9b, 0x39, 0x86,
+	0x24, 0xbc, 0x88, 0xf2, 0x66, 0x8e, 0x93, 0x0e, 0x6c, 0xb5, 0x92, 0xf5, 0x3d, 0x2c, 0xea, 0xfd,
+	0x7f, 0xa3, 0xec, 0x79, 0x9b, 0x5e, 0xf9, 0x28, 0x97, 0xa5, 0x08, 0xa9, 0x8e, 0x04, 0x2e, 0x56,
+	0x9f, 0x40, 0x81, 0xd7, 0x8a, 0x96, 0xe5, 0x4d, 0x61, 0xda, 0xb1, 0x45, 0xa9, 0x07, 0x17, 0x0b,
+	0x7f, 0xe8, 0x4f, 0x84, 0xab, 0x62, 0x54, 0x0b, 0xff, 0x38, 0x03, 0xc5, 0x47, 0xf7, 0x2b, 0x95,
+	0x7e, 0x78, 0x8c, 0xbb, 0x21, 0x39, 0x94, 0xe0, 0xda, 0xb1, 0xd3, 0xe9, 0xe0, 0xee, 0x11, 0x46,
+	0xb7, 0x61, 0xfc, 0xe0, 0xf1, 0xc1, 0x3e, 0xf7, 0x08, 0x2c, 0xf2, 0xe3, 0x38, 0x01, 0xc9, 0x3a,
+	0x36, 0xad, 0x81, 0x1e, 0xc2, 0xfc, 0x53, 0x1e, 0xce, 0x2f, 0x8b, 0xb8, 0x2f, 0xe0, 0xfa, 0x1d,
+	0x19, 0xe8, 0x5f, 0xf3, 0x71, 0x9b, 0xb4, 0xe2, 0x74, 0x2a, 0x01, 0x51, 0x0c, 0x64, 0x7e, 0x92,
+	0x78, 0x0f, 0xc6, 0x73, 0x99, 0x42, 0xd6, 0xfa, 0xfd, 0x0c, 0x2c, 0xc7, 0x7a, 0xa6, 0x38, 0x76,
+	0xd5, 0x8e, 0x2d, 0x28, 0x1d, 0x13, 0x55, 0xb6, 0x2f, 0xf1, 0x9e, 0xd5, 0x68, 0xec, 0x28, 0x6d,
+	0x81, 0x77, 0xe8, 0x9d, 0xe1, 0x1d, 0x8a, 0x08, 0x48, 0x44, 0x1e, 0xf9, 0x45, 0xe1, 0xd6, 0x65,
+	0x98, 0xd5, 0x38, 0x60, 0x59, 0x30, 0xa3, 0xb6, 0x4c, 0xd8, 0x5c, 0xf3, 0xda, 0x92, 0xcd, 0xe4,
+	0x6f, 0xeb, 0x1f, 0x66, 0x60, 0xf1, 0xd1, 0xfd, 0x8a, 0x8d, 0x8f, 0x5c, 0xb2, 0xfc, 0x22, 0x16,
+	0xaf, 0x69, 0x23, 0x59, 0xd1, 0x46, 0x12, 0xab, 0x2b, 0x87, 0xf4, 0x79, 0x62, 0x48, 0x2b, 0x69,
+	0x43, 0xa2, 0x56, 0x96, 0xeb, 0x75, 0xb5, 0x91, 0x28, 0x9e, 0x8f, 0x7f, 0x92, 0x81, 0x05, 0xa5,
+	0x4f, 0xb2, 0xff, 0x1f, 0x68, 0x5d, 0xba, 0x96, 0xd2, 0xa5, 0x04, 0x93, 0xab, 0x89, 0x1e, 0xbd,
+	0x3d, 0xac, 0x47, 0x23, 0x79, 0xfc, 0xc7, 0x19, 0x58, 0x4a, 0xe5, 0x01, 0xba, 0x42, 0x76, 0x8d,
+	0x96, 0x8f, 0x43, 0xce, 0x5e, 0xfe, 0x45, 0xe0, 0x3b, 0x41, 0xd0, 0xe7, 0x6f, 0x2d, 0xf2, 0x36,
+	0xff, 0x42, 0x6f, 0xc3, 0xec, 0x3e, 0xf6, 0x5d, 0xaf, 0x5d, 0xc7, 0x2d, 0xaf, 0xdb, 0x66, 0x1e,
+	0xe1, 0x59, 0x5b, 0x07, 0xa2, 0x15, 0xc8, 0x57, 0x3a, 0x47, 0x9e, 0xef, 0x86, 0xc7, 0xcc, 0xf9,
+	0x94, 0xb7, 0x23, 0x00, 0xa1, 0xbd, 0xe1, 0x1e, 0xb9, 0x21, 0xbb, 0x5b, 0x9b, 0xb5, 0xf9, 0x17,
+	0x2a, 0xc2, 0x54, 0xa5, 0xd5, 0xf2, 0xfa, 0xdd, 0x90, 0x7a, 0x40, 0xf3, 0xb6, 0xf8, 0x24, 0x18,
+	0xdf, 0xda, 0x54, 0x08, 0x68, 0x34, 0x94, 0xcd, 0xbf, 0xac, 0xf7, 0x60, 0x31, 0x8d, 0x8f, 0xa9,
+	0x22, 0xf3, 0xd7, 0xb2, 0xb0, 0x50, 0x69, 0xb7, 0x1f, 0xdd, 0xaf, 0x6c, 0x60, 0xd5, 0xf8, 0xf8,
+	0x10, 0xc6, 0x77, 0xba, 0x6e, 0xc8, 0x77, 0xcd, 0x55, 0x3e, 0x3d, 0x29, 0x35, 0x49, 0x2d, 0x32,
+	0x43, 0xe4, 0x7f, 0x64, 0xc3, 0xc2, 0xe6, 0x8f, 0x6e, 0x10, 0xba, 0xdd, 0x23, 0x3a, 0xe7, 0xac,
+	0x61, 0x3e, 0xc7, 0x82, 0x88, 0x61, 0xb9, 0x6d, 0x5f, 0xb2, 0xd3, 0x90, 0xd1, 0x01, 0x5c, 0xd9,
+	0xc3, 0x2f, 0x52, 0x44, 0x48, 0x06, 0x33, 0x49, 0xb2, 0x29, 0x92, 0x63, 0xc0, 0x55, 0x25, 0xf4,
+	0x6f, 0x67, 0x69, 0x84, 0x9c, 0x32, 0x30, 0xde, 0xf2, 0x13, 0x58, 0x54, 0x3a, 0x14, 0x69, 0x9c,
+	0x0c, 0x8f, 0x9d, 0x4e, 0x1d, 0x8e, 0xba, 0x90, 0x52, 0xd1, 0xd1, 0x53, 0x58, 0xd6, 0x3b, 0x15,
+	0x51, 0xd6, 0x17, 0x43, 0x5a, 0x95, 0xed, 0x4b, 0xb6, 0x09, 0x1b, 0xad, 0xc1, 0x58, 0xa5, 0x75,
+	0xc2, 0xd9, 0x92, 0x3e, 0x65, 0x6c, 0x64, 0x95, 0xd6, 0x09, 0x8d, 0x36, 0x6d, 0x9d, 0x68, 0xeb,
+	0xa1, 0x03, 0xcb, 0x86, 0x09, 0x46, 0xab, 0x00, 0x0c, 0xa8, 0xa8, 0x76, 0x05, 0x42, 0x36, 0x55,
+	0xf6, 0x45, 0xef, 0x1b, 0xc7, 0xe8, 0xf5, 0xb5, 0x08, 0x0b, 0x8a, 0x0a, 0x6c, 0xa5, 0x92, 0x55,
+	0x8b, 0xb7, 0x26, 0xfb, 0x86, 0x6e, 0xc3, 0x24, 0x03, 0x72, 0x56, 0x8b, 0xc7, 0x29, 0x51, 0x65,
+	0x5e, 0x6e, 0xfd, 0x41, 0x46, 0x38, 0x5e, 0x12, 0x12, 0xfc, 0x89, 0x26, 0xc1, 0x6f, 0xc9, 0xce,
+	0xa4, 0x55, 0xd6, 0x84, 0xb8, 0x0a, 0xd3, 0xaf, 0x22, 0xbc, 0x2a, 0x92, 0x2a, 0x5e, 0xff, 0x3c,
+	0x23, 0x8e, 0x8c, 0x49, 0x09, 0xdb, 0x84, 0x99, 0x57, 0x93, 0x2c, 0x0d, 0x0d, 0x7d, 0xc4, 0x26,
+	0x3e, 0x3b, 0x7c, 0xa4, 0x43, 0xe7, 0xfe, 0x4b, 0xe1, 0x5b, 0x7a, 0x95, 0xe9, 0xb7, 0x56, 0x52,
+	0xb0, 0x65, 0x73, 0x56, 0x3f, 0x51, 0x5a, 0x7f, 0xd9, 0x6d, 0x89, 0x79, 0xba, 0x15, 0xbf, 0x0b,
+	0x37, 0x5e, 0x74, 0xaa, 0x7d, 0xc8, 0x46, 0xee, 0x86, 0x36, 0x8e, 0xa2, 0x9e, 0xd4, 0x4e, 0x9d,
+	0x65, 0x74, 0x09, 0x7b, 0x95, 0x46, 0x6b, 0x30, 0xbb, 0x87, 0x5f, 0x24, 0xda, 0xa5, 0xd7, 0x47,
+	0x5d, 0xfc, 0xa2, 0xa9, 0xb4, 0xad, 0x04, 0x1c, 0xe8, 0x38, 0xe8, 0x10, 0xe6, 0xc4, 0x92, 0x3d,
+	0xaf, 0xe6, 0x62, 0x81, 0x91, 0xa4, 0x85, 0xd3, 0x67, 0x4e, 0xd3, 0xe7, 0x50, 0x35, 0xa2, 0x51,
+	0xa7, 0x68, 0xed, 0x43, 0x31, 0x39, 0x56, 0x2e, 0x65, 0x1f, 0x8e, 0x5a, 0x4e, 0xec, 0xf0, 0xd3,
+	0xd6, 0x97, 0xd6, 0x36, 0x3d, 0xa7, 0xcb, 0x3a, 0xf2, 0x84, 0x71, 0x2f, 0xce, 0x3a, 0x1a, 0xec,
+	0x25, 0x58, 0xa7, 0x46, 0x5e, 0x47, 0xd1, 0x10, 0x4b, 0x31, 0x4a, 0xbc, 0x63, 0xef, 0xc1, 0x14,
+	0x07, 0xc9, 0x88, 0xf6, 0xf8, 0x42, 0x17, 0x15, 0xac, 0x7f, 0x9a, 0x81, 0xab, 0x4f, 0x02, 0xec,
+	0xd7, 0xdd, 0xee, 0x51, 0x07, 0x3f, 0x09, 0xf4, 0x58, 0x84, 0xdf, 0xd6, 0x16, 0xfb, 0xb2, 0x21,
+	0xc6, 0xf1, 0xff, 0xd7, 0x12, 0xff, 0x67, 0x19, 0x28, 0xa5, 0xf5, 0xed, 0xcd, 0xae, 0xf2, 0x3b,
+	0xfc, 0x48, 0xc0, 0x7a, 0x5b, 0xe4, 0xe8, 0xb2, 0x4d, 0x31, 0x58, 0x32, 0x48, 0xf2, 0xbf, 0xb6,
+	0xbc, 0xff, 0x4f, 0x06, 0x16, 0x77, 0x02, 0xda, 0xfd, 0x5f, 0xf4, 0x5d, 0x1f, 0xb7, 0x05, 0xe3,
+	0xee, 0xa4, 0x45, 0xc2, 0xd2, 0x79, 0xdd, 0xbe, 0x94, 0x16, 0xe9, 0xfa, 0xa1, 0x12, 0xeb, 0x97,
+	0x1d, 0x16, 0xe2, 0xaa, 0x3d, 0xab, 0xb8, 0x05, 0xe3, 0x7b, 0xc4, 0xf2, 0x18, 0xe3, 0xf2, 0xc7,
+	0x30, 0x08, 0x88, 0x86, 0xe5, 0x91, 0x2e, 0x93, 0x0f, 0x74, 0x3f, 0x11, 0xfc, 0x37, 0x3e, 0x3a,
+	0x84, 0x33, 0xf9, 0x1e, 0xa4, 0x9a, 0x83, 0xc9, 0x03, 0xc7, 0x3f, 0xc2, 0xa1, 0xf5, 0x33, 0x28,
+	0xf1, 0x3b, 0x37, 0xe6, 0xca, 0xa2, 0x37, 0x73, 0x41, 0xe4, 0x62, 0x19, 0x76, 0x4f, 0xb6, 0x0a,
+	0x50, 0x0f, 0x1d, 0x3f, 0xdc, 0xe9, 0xb6, 0xf1, 0x8f, 0x74, 0xb4, 0x13, 0xb6, 0x02, 0xb1, 0x3e,
+	0x82, 0xbc, 0x1c, 0x02, 0x3d, 0xf6, 0x28, 0xc6, 0x15, 0x1d, 0xce, 0xa2, 0x16, 0x8e, 0x28, 0x62,
+	0x10, 0xd7, 0x61, 0x29, 0x36, 0x15, 0x5c, 0x4e, 0x4a, 0x64, 0xc2, 0x18, 0x8c, 0xdd, 0xc7, 0xdb,
+	0xf2, 0xdb, 0xaa, 0xc1, 0x7c, 0x62, 0xa6, 0x11, 0xa2, 0x21, 0xa6, 0xec, 0x8c, 0x48, 0x94, 0x7a,
+	0xbd, 0xbe, 0x4d, 0x60, 0x07, 0xbb, 0x75, 0x16, 0x6e, 0x43, 0x60, 0x07, 0xbb, 0xf5, 0xea, 0x24,
+	0x93, 0x1c, 0xeb, 0x5f, 0x67, 0xe9, 0x49, 0x2f, 0xc1, 0x83, 0x98, 0xc7, 0x40, 0xf5, 0x5a, 0x54,
+	0x21, 0x4f, 0x47, 0xbc, 0x21, 0xc2, 0xd2, 0x86, 0x3b, 0xea, 0x73, 0xbf, 0x1c, 0x94, 0x2f, 0x51,
+	0xef, 0x7c, 0x84, 0x86, 0xbe, 0x86, 0xa9, 0xcd, 0x6e, 0x9b, 0x52, 0x18, 0xbb, 0x00, 0x05, 0x81,
+	0x44, 0xe6, 0x81, 0x76, 0x99, 0x98, 0x0d, 0xfc, 0x58, 0x6d, 0x2b, 0x10, 0xca, 0x66, 0xf7, 0xd4,
+	0x65, 0xd7, 0xb1, 0x13, 0x36, 0xfb, 0x20, 0xdc, 0xa4, 0x5d, 0x10, 0xaf, 0x0c, 0xf2, 0xb6, 0xfc,
+	0x46, 0x16, 0x4c, 0x3c, 0xf6, 0xdb, 0x3c, 0xe6, 0x7b, 0x6e, 0x6d, 0x46, 0x3c, 0xbb, 0x26, 0x30,
+	0x9b, 0x15, 0x59, 0xff, 0x8b, 0x5e, 0x91, 0x84, 0xa9, 0x72, 0xa3, 0x71, 0x25, 0xf3, 0xda, 0x5c,
+	0xc9, 0xbe, 0x0a, 0x57, 0xe4, 0xa8, 0xc7, 0x4c, 0xa3, 0x1e, 0x37, 0x8d, 0x7a, 0xc2, 0x3c, 0xea,
+	0x2d, 0x98, 0x64, 0x43, 0x45, 0x37, 0x61, 0x62, 0x27, 0xc4, 0xa7, 0x91, 0x07, 0x40, 0xbd, 0xe4,
+	0xb6, 0x59, 0x19, 0x39, 0x9c, 0xec, 0x3a, 0x41, 0x28, 0x02, 0xbc, 0xf2, 0xb6, 0xf8, 0xb4, 0xfe,
+	0x24, 0x03, 0x85, 0x5d, 0x37, 0x08, 0xc9, 0x42, 0x38, 0xa7, 0xac, 0xc9, 0x11, 0x65, 0x4d, 0x23,
+	0x1a, 0x8b, 0x8d, 0xe8, 0x0b, 0x98, 0xa4, 0x71, 0x87, 0x01, 0x7f, 0x51, 0x74, 0x93, 0x0f, 0x29,
+	0xde, 0x30, 0x8b, 0x4e, 0x0c, 0xe8, 0xcb, 0x1f, 0x9b, 0xa3, 0x94, 0x3e, 0x83, 0x69, 0x05, 0x7c,
+	0xa1, 0x07, 0x41, 0xdf, 0xc1, 0xbc, 0xd2, 0x84, 0x74, 0x17, 0x8c, 0x70, 0x2a, 0x4b, 0xa7, 0x25,
+	0x61, 0xdb, 0x1e, 0xfe, 0x51, 0x65, 0x1b, 0xff, 0xb4, 0x7e, 0xa0, 0x61, 0xb3, 0xbb, 0x5e, 0xeb,
+	0x44, 0x71, 0xe9, 0x4d, 0x31, 0x65, 0x16, 0xf7, 0x8c, 0x93, 0x5a, 0xac, 0xc4, 0x16, 0x35, 0xd0,
+	0x0d, 0x98, 0xde, 0xe9, 0xde, 0xf7, 0xfc, 0x16, 0x7e, 0xdc, 0xed, 0x30, 0xea, 0x39, 0x5b, 0x05,
+	0x71, 0x6f, 0x0f, 0x6f, 0x21, 0xf2, 0xf6, 0x50, 0x40, 0xcc, 0xdb, 0xc3, 0x1e, 0x34, 0xda, 0xac,
+	0x8c, 0x3b, 0x93, 0xc8, 0xdf, 0xc3, 0x5c, 0x3d, 0xd2, 0x27, 0x34, 0xaa, 0xe2, 0x21, 0x5c, 0xb5,
+	0x71, 0xaf, 0xe3, 0x10, 0x5b, 0xf1, 0xd4, 0x63, 0xf5, 0xe5, 0x98, 0x6f, 0xa4, 0x44, 0x74, 0xe9,
+	0x17, 0x43, 0xb2, 0xcb, 0xd9, 0x21, 0x5d, 0x3e, 0x85, 0xb7, 0xb6, 0x70, 0x98, 0xfa, 0x2a, 0x31,
+	0x1a, 0xfc, 0x36, 0xe4, 0x78, 0xe4, 0xbc, 0x18, 0xff, 0xa8, 0x07, 0x91, 0xfc, 0x96, 0x84, 0xd3,
+	0x91, 0x7f, 0x59, 0xdf, 0x40, 0xd9, 0xd4, 0xdc, 0xf9, 0x02, 0x79, 0x5c, 0xb8, 0x61, 0x26, 0x20,
+	0xad, 0x89, 0x29, 0xde, 0xa0, 0x3c, 0x9c, 0x0f, 0xef, 0xad, 0xf4, 0x9b, 0x53, 0x7b, 0x8a, 0xff,
+	0x61, 0x55, 0x45, 0xa4, 0xc0, 0x6b, 0x74, 0xb7, 0x49, 0x3d, 0xfb, 0x3a, 0x81, 0x88, 0xaf, 0x15,
+	0xc8, 0x09, 0x58, 0xcc, 0xb5, 0x9f, 0x78, 0xf0, 0x49, 0x19, 0xda, 0x16, 0x04, 0x24, 0x9a, 0xf5,
+	0x83, 0xf0, 0xbf, 0xeb, 0x18, 0xe7, 0x8b, 0x0e, 0x3d, 0x8f, 0xc3, 0xdd, 0xf2, 0xe0, 0xaa, 0x4e,
+	0x5b, 0xf5, 0x22, 0x17, 0x14, 0x2f, 0x32, 0x73, 0x1e, 0x13, 0xb9, 0xb4, 0x77, 0x37, 0xbb, 0xed,
+	0x9e, 0xe7, 0x76, 0x43, 0xbe, 0x78, 0x55, 0x10, 0x5a, 0x55, 0x7d, 0xc5, 0x33, 0xc9, 0x70, 0xda,
+	0x7b, 0x50, 0x4a, 0x6b, 0x50, 0x71, 0xd1, 0x48, 0xb7, 0x2f, 0xb3, 0xe3, 0xac, 0x63, 0x58, 0xd4,
+	0x52, 0x68, 0x44, 0x39, 0x01, 0xa2, 0xd4, 0x21, 0xf9, 0xea, 0x97, 0xbf, 0x1e, 0x94, 0x3f, 0xbd,
+	0x48, 0xcc, 0xa6, 0xa0, 0x79, 0x20, 0x23, 0x82, 0xad, 0x65, 0x18, 0xab, 0xd9, 0xbb, 0x74, 0xd8,
+	0xf6, 0xae, 0x1c, 0xb6, 0xbd, 0x6b, 0xfd, 0x3a, 0x03, 0xe5, 0xda, 0xb1, 0xd3, 0x3d, 0xa2, 0xb6,
+	0x87, 0x62, 0xae, 0x2a, 0xd7, 0x9f, 0xe7, 0x3d, 0x52, 0xad, 0xc1, 0xf4, 0x1e, 0x7e, 0x21, 0xa2,
+	0x99, 0x79, 0x5c, 0x30, 0xf5, 0x92, 0x93, 0xe3, 0x4e, 0x8f, 0xc3, 0x6d, 0xb5, 0x12, 0xfa, 0xcb,
+	0xaf, 0xee, 0x03, 0x62, 0x0f, 0xe9, 0xa3, 0x93, 0x14, 0x2b, 0x4d, 0x3b, 0x52, 0x19, 0x9a, 0xb0,
+	0xfe, 0x6d, 0x06, 0x6e, 0x98, 0x07, 0xcf, 0x27, 0x6e, 0x43, 0x4b, 0x47, 0x30, 0xe4, 0xe2, 0x96,
+	0x1e, 0x59, 0x95, 0x74, 0x04, 0xf1, 0x14, 0x04, 0x36, 0x6e, 0x79, 0xcf, 0xb1, 0xff, 0x32, 0xe6,
+	0x0e, 0x17, 0xe0, 0x1a, 0xd9, 0x72, 0x44, 0x32, 0x17, 0x06, 0xd2, 0x5e, 0x20, 0x72, 0x98, 0xf5,
+	0x9f, 0x32, 0x70, 0x8d, 0x6e, 0x93, 0xdc, 0x59, 0x28, 0x0a, 0x2e, 0x7e, 0xcd, 0xff, 0x11, 0xcc,
+	0xa8, 0x8d, 0xf3, 0x09, 0xa3, 0xef, 0x97, 0x45, 0x0f, 0x9a, 0x2d, 0xaf, 0x8d, 0x6d, 0xad, 0x1a,
+	0xda, 0x81, 0x69, 0xfe, 0xad, 0xb8, 0x84, 0x96, 0x94, 0xe4, 0x26, 0x54, 0x1e, 0xd8, 0x83, 0x33,
+	0x3a, 0xfb, 0x9c, 0x58, 0x93, 0x46, 0xa8, 0xab, 0xb8, 0xd6, 0xaf, 0xb2, 0xb0, 0xd2, 0xc0, 0xbe,
+	0xfb, 0xec, 0xa5, 0x61, 0x30, 0x8f, 0x61, 0x51, 0x80, 0xe8, 0x98, 0x75, 0x39, 0x64, 0x2f, 0xc9,
+	0x44, 0x57, 0x03, 0x52, 0xa1, 0x29, 0xc5, 0x32, 0x15, 0xf1, 0x02, 0x6f, 0x2b, 0x3f, 0x84, 0x9c,
+	0x14, 0xe5, 0x31, 0xca, 0x19, 0x3a, 0x37, 0x42, 0x8c, 0xf5, 0x67, 0xe6, 0x52, 0x9e, 0xff, 0xa6,
+	0xf9, 0xd6, 0x81, 0x9f, 0x78, 0x46, 0x1c, 0x46, 0x99, 0x54, 0x13, 0x89, 0x76, 0x94, 0xd2, 0x14,
+	0xa9, 0xde, 0xbe, 0x64, 0x9b, 0x5a, 0xaa, 0x4e, 0x43, 0xbe, 0x42, 0xef, 0x44, 0xc8, 0x01, 0xe3,
+	0x7f, 0x67, 0x61, 0x55, 0x44, 0xfe, 0x19, 0xd8, 0xfc, 0x1d, 0x2c, 0x0b, 0x50, 0xa5, 0xd7, 0xf3,
+	0xbd, 0xe7, 0xb8, 0xad, 0x73, 0x9a, 0xbd, 0xe6, 0x14, 0x9c, 0x76, 0x78, 0x9d, 0x88, 0xd9, 0x26,
+	0xf4, 0x37, 0xe3, 0x66, 0xf9, 0x5a, 0x57, 0x2c, 0x6c, 0x36, 0xe8, 0x7b, 0x25, 0x55, 0xb1, 0xe8,
+	0x79, 0x78, 0x54, 0x25, 0xd3, 0x4e, 0xb8, 0x69, 0xc6, 0x5f, 0xd7, 0x4d, 0x43, 0x8e, 0xa6, 0x3a,
+	0xcd, 0xea, 0x1c, 0xcc, 0xec, 0xe1, 0x17, 0x11, 0xdf, 0x7f, 0x37, 0x03, 0xb3, 0xda, 0xe2, 0x46,
+	0xef, 0xc2, 0x04, 0xfd, 0x83, 0x6e, 0x9a, 0xfc, 0x49, 0x0b, 0x59, 0x60, 0xda, 0x93, 0x16, 0x56,
+	0x75, 0x07, 0xa6, 0x58, 0x94, 0x4b, 0xfb, 0x1c, 0x67, 0x08, 0x19, 0x44, 0xd5, 0x62, 0x28, 0xec,
+	0x38, 0xc1, 0xf1, 0xad, 0x87, 0xf0, 0x16, 0x0f, 0x98, 0xd1, 0x27, 0xbf, 0xa6, 0xda, 0xef, 0xe7,
+	0xd4, 0xf1, 0x96, 0x03, 0xab, 0x5b, 0x38, 0xae, 0x7a, 0xb4, 0x20, 0xb3, 0x6f, 0xe0, 0xb2, 0x06,
+	0x97, 0x14, 0x69, 0xd8, 0xbb, 0x94, 0x21, 0x49, 0x3a, 0x5e, 0xdb, 0xba, 0x91, 0xd6, 0x84, 0xda,
+	0x59, 0x0b, 0xc3, 0x65, 0x7a, 0x52, 0x96, 0x17, 0x43, 0xc1, 0x05, 0xb4, 0xde, 0x6d, 0x65, 0x5d,
+	0x33, 0x8d, 0xc7, 0x5e, 0x4c, 0x8a, 0xed, 0x49, 0x96, 0x5a, 0xff, 0x33, 0x03, 0x16, 0xe7, 0x5c,
+	0x9a, 0x1b, 0x47, 0x0c, 0xf8, 0x30, 0xd1, 0x1b, 0xbe, 0x4b, 0x5c, 0x51, 0x9d, 0x55, 0x51, 0x29,
+	0x13, 0x2d, 0xfa, 0x88, 0xa4, 0x15, 0x41, 0x35, 0xd1, 0x4a, 0x0c, 0xef, 0xe7, 0x06, 0x3d, 0xc8,
+	0x56, 0x13, 0x4d, 0xe3, 0x61, 0xd0, 0x83, 0x1a, 0xdd, 0x54, 0x22, 0xaa, 0xbf, 0xeb, 0x1f, 0x65,
+	0xe0, 0x1a, 0x1b, 0xf2, 0xbe, 0xef, 0x3e, 0x77, 0x3b, 0xf8, 0x08, 0x6b, 0x93, 0xdb, 0x4f, 0xbf,
+	0x06, 0xca, 0x9c, 0x4b, 0xb3, 0xd1, 0x8c, 0x04, 0x98, 0xa3, 0x9b, 0xdc, 0x9f, 0x69, 0xf4, 0xad,
+	0xbf, 0x9f, 0x81, 0x55, 0xf1, 0x60, 0x2a, 0x76, 0x37, 0x72, 0x51, 0x23, 0xa5, 0xaa, 0xdd, 0x67,
+	0x64, 0x0d, 0xf7, 0x19, 0x9a, 0xff, 0x39, 0x8c, 0x5f, 0x70, 0xfc, 0x61, 0x16, 0xe6, 0xf7, 0x9d,
+	0x23, 0xb7, 0x4b, 0xd6, 0x97, 0x48, 0xe9, 0x81, 0x2a, 0x89, 0xcc, 0x48, 0xc3, 0x03, 0x53, 0x52,
+	0x52, 0x1f, 0xad, 0xa9, 0x49, 0x4a, 0xb2, 0xa6, 0x90, 0x65, 0x3d, 0x15, 0xc9, 0x67, 0x9a, 0x07,
+	0x2e, 0x11, 0x9b, 0x44, 0x9f, 0xbd, 0x74, 0xbd, 0x76, 0x2c, 0x5b, 0x18, 0xf5, 0x62, 0x3d, 0x86,
+	0x69, 0x25, 0xc0, 0x88, 0x2b, 0xc5, 0x04, 0x05, 0xaa, 0x68, 0x4f, 0xfa, 0x87, 0x38, 0x35, 0x33,
+	0x8c, 0x4a, 0xa1, 0x0a, 0x90, 0x13, 0x89, 0xe8, 0xac, 0x7f, 0x39, 0x01, 0x8b, 0xe4, 0x28, 0x2d,
+	0xf8, 0x13, 0x44, 0x0a, 0x62, 0x46, 0xc0, 0x14, 0x2b, 0x97, 0xef, 0xe5, 0x0c, 0xde, 0x8c, 0xe5,
+	0xc5, 0xd3, 0x10, 0xd0, 0x47, 0xaa, 0xaf, 0x21, 0xab, 0xbc, 0x96, 0x4f, 0xa6, 0x34, 0x53, 0x9d,
+	0x10, 0xef, 0x6a, 0x6e, 0x15, 0xa6, 0x7d, 0x3b, 0x04, 0xa0, 0x6a, 0x5f, 0xe6, 0x99, 0x58, 0x8f,
+	0xfb, 0x5a, 0x58, 0x03, 0x6c, 0x65, 0x9d, 0x60, 0xcd, 0x30, 0x93, 0x2e, 0x8b, 0x27, 0xd2, 0x65,
+	0x31, 0x41, 0xcf, 0x44, 0x3f, 0x51, 0x5c, 0x16, 0x71, 0x26, 0xa8, 0x6e, 0x0b, 0xf6, 0x3e, 0xb3,
+	0x43, 0x01, 0xea, 0xfb, 0x4c, 0x56, 0x05, 0x1d, 0xc0, 0xc2, 0xbe, 0x8f, 0xdb, 0x74, 0x29, 0x6d,
+	0xfe, 0xd8, 0xf3, 0xb9, 0x21, 0x4a, 0x1d, 0x5f, 0x2c, 0x75, 0x50, 0x4f, 0x14, 0x37, 0xb1, 0x2c,
+	0x57, 0x57, 0x54, 0x0a, 0x3a, 0xda, 0x84, 0xb9, 0x3a, 0x76, 0xfc, 0xd6, 0xf1, 0x43, 0xfc, 0x92,
+	0x28, 0xbb, 0xa0, 0x38, 0x15, 0xa5, 0x5b, 0x08, 0x68, 0x09, 0x19, 0x28, 0x2d, 0x52, 0x2f, 0x27,
+	0x74, 0x24, 0xf4, 0x53, 0x98, 0xac, 0x7b, 0x7e, 0x58, 0x7d, 0x19, 0xcb, 0x71, 0xc7, 0x80, 0xd5,
+	0xab, 0x22, 0xe5, 0x44, 0xe0, 0xf9, 0x61, 0xf3, 0x50, 0xe5, 0x1b, 0xc7, 0x43, 0xf7, 0xc9, 0xde,
+	0x4c, 0xec, 0x85, 0xd0, 0xe9, 0xd4, 0xe8, 0x5d, 0x38, 0x7b, 0x61, 0xc3, 0xf7, 0x5f, 0x6a, 0x64,
+	0x84, 0x4e, 0xa7, 0x49, 0x77, 0x03, 0xfd, 0x9a, 0x44, 0xc5, 0x7a, 0x1d, 0x9f, 0xcf, 0x1f, 0x67,
+	0x60, 0x29, 0x36, 0x49, 0xdc, 0xf6, 0x7f, 0x0c, 0x79, 0x09, 0xe4, 0x27, 0x5d, 0xe1, 0x9d, 0x4f,
+	0xac, 0x7f, 0x26, 0x22, 0x42, 0x82, 0x55, 0xa6, 0x45, 0x34, 0xd0, 0xbd, 0x98, 0x7b, 0x88, 0xd9,
+	0x94, 0x5d, 0xfc, 0x63, 0x5c, 0xac, 0x44, 0x35, 0xf4, 0x19, 0x80, 0xc2, 0x1b, 0x26, 0xba, 0x34,
+	0xf1, 0x59, 0x3a, 0x5b, 0x94, 0xca, 0xd6, 0x9f, 0x4e, 0x0a, 0x65, 0xce, 0x4f, 0x21, 0x07, 0xbe,
+	0xd3, 0x3a, 0x89, 0x82, 0xdc, 0x3e, 0x4a, 0x46, 0x94, 0x9d, 0x67, 0x1d, 0xdd, 0xd2, 0xde, 0x9e,
+	0x9a, 0xd3, 0x58, 0x46, 0xcf, 0x90, 0xc7, 0xce, 0xf1, 0x0c, 0xf9, 0x2e, 0x4c, 0xed, 0x74, 0x9f,
+	0xbb, 0xc4, 0xe0, 0x61, 0xe1, 0x55, 0xd4, 0x5c, 0x70, 0x19, 0x48, 0x65, 0x0c, 0xaf, 0x85, 0x3e,
+	0x83, 0x1c, 0x39, 0xe9, 0xd3, 0x1d, 0x7f, 0x22, 0x32, 0x2a, 0x43, 0xea, 0x2e, 0x6b, 0x1e, 0xf3,
+	0x22, 0x75, 0xa5, 0x8a, 0xea, 0xe8, 0x63, 0x98, 0xaa, 0xb4, 0xdb, 0x64, 0x29, 0xf0, 0x65, 0x44,
+	0x73, 0xe0, 0x71, 0x4c, 0x87, 0x95, 0xa8, 0x4d, 0xf2, 0xca, 0xe8, 0x4b, 0xdd, 0x77, 0x35, 0x15,
+	0x3d, 0xd2, 0x4f, 0xcf, 0x07, 0xa9, 0xfb, 0xb5, 0xde, 0x15, 0x77, 0x06, 0xb9, 0x28, 0xed, 0x01,
+	0x4d, 0x61, 0xa0, 0xe9, 0x1f, 0x7a, 0xe5, 0xb0, 0x03, 0xf9, 0x9d, 0xae, 0x1b, 0xba, 0xf4, 0xe1,
+	0x77, 0x5e, 0xdb, 0x07, 0xf6, 0x1d, 0x3f, 0x74, 0x5b, 0x6e, 0xcf, 0xe9, 0x86, 0x6c, 0xb6, 0x5c,
+	0x51, 0x51, 0x9d, 0x2d, 0x89, 0xad, 0xa6, 0x88, 0x81, 0x37, 0x96, 0x22, 0x26, 0x35, 0xcb, 0xca,
+	0xf4, 0xab, 0x67, 0x59, 0x59, 0x67, 0x73, 0x49, 0x93, 0x65, 0xce, 0x44, 0x82, 0x48, 0x5d, 0x3a,
+	0x7a, 0x8a, 0x4c, 0x5b, 0x56, 0x44, 0x37, 0xe8, 0x43, 0xef, 0xd9, 0x28, 0x52, 0x51, 0xbb, 0xa3,
+	0xcc, 0xee, 0x6c, 0xa0, 0x26, 0xcc, 0x90, 0xda, 0xfb, 0x5e, 0xc7, 0x6d, 0xb9, 0x38, 0x28, 0xce,
+	0x69, 0x3e, 0x40, 0x7d, 0x51, 0xd0, 0x4a, 0x2f, 0xeb, 0x38, 0x64, 0x3b, 0x11, 0x6d, 0xba, 0xc7,
+	0x11, 0xd5, 0x9d, 0x48, 0x25, 0x68, 0xd9, 0x50, 0x8c, 0x2e, 0x12, 0x62, 0xab, 0xeb, 0xe3, 0x64,
+	0xd0, 0x38, 0x4d, 0x2e, 0x16, 0x05, 0x8d, 0xab, 0x13, 0x16, 0x85, 0x8f, 0x3f, 0x81, 0x6b, 0x36,
+	0x3e, 0xf5, 0x9e, 0xe3, 0x37, 0x4b, 0xf6, 0xe7, 0x70, 0x55, 0x27, 0xf8, 0xa4, 0xd7, 0xa6, 0x8f,
+	0xd0, 0xd8, 0x8d, 0x45, 0x6a, 0x7a, 0x02, 0x8e, 0xc0, 0xd2, 0x13, 0xb0, 0x37, 0xaf, 0xe4, 0x4f,
+	0x55, 0x5e, 0x69, 0x99, 0xe5, 0xc1, 0x8a, 0x4e, 0xbc, 0xd2, 0x6e, 0x2b, 0x82, 0x4a, 0x0c, 0x0d,
+	0xe5, 0x33, 0x66, 0xd9, 0xa8, 0x12, 0x4d, 0x35, 0x5b, 0x2f, 0x02, 0xa8, 0x6b, 0x49, 0xa9, 0x67,
+	0x61, 0x28, 0xc7, 0xd9, 0x43, 0x58, 0xa6, 0xb6, 0x59, 0x85, 0x59, 0xe5, 0x53, 0xda, 0xca, 0x74,
+	0xa9, 0x2b, 0x2d, 0xe8, 0x0c, 0xd3, 0x51, 0xac, 0x7f, 0x35, 0x06, 0xd7, 0x38, 0x9f, 0xde, 0xe4,
+	0x64, 0xa0, 0x1f, 0x60, 0x5a, 0x61, 0x3f, 0xe7, 0xc7, 0x0d, 0x71, 0xef, 0x6b, 0x9a, 0x26, 0xa6,
+	0x6a, 0xfa, 0x14, 0xd0, 0x8c, 0xcd, 0x04, 0xb1, 0xc4, 0xd4, 0x19, 0xed, 0xc0, 0x9c, 0x3e, 0x07,
+	0xdc, 0x3e, 0xbc, 0x99, 0xda, 0x88, 0x5e, 0x55, 0xbc, 0xa1, 0x6d, 0x37, 0x53, 0x67, 0x82, 0x26,
+	0x6a, 0xd4, 0xe7, 0xf7, 0x47, 0x98, 0x4f, 0x4c, 0x00, 0x37, 0x27, 0x6f, 0xa5, 0x36, 0x98, 0xa8,
+	0xcd, 0xf4, 0x86, 0x4f, 0xc1, 0xc6, 0x66, 0x93, 0x8d, 0x54, 0x73, 0x30, 0xc9, 0x86, 0x4d, 0xd6,
+	0xcd, 0xbe, 0x8f, 0x03, 0xdc, 0x6d, 0x61, 0xf5, 0x72, 0xfd, 0x75, 0xd7, 0xcd, 0x7f, 0xcc, 0x40,
+	0x31, 0x8d, 0x6e, 0x1d, 0x77, 0xdb, 0x68, 0x1f, 0x0a, 0xf1, 0x86, 0xb8, 0xd1, 0x6f, 0x09, 0x33,
+	0xc1, 0xdc, 0xa5, 0xed, 0x4b, 0x76, 0x02, 0x9b, 0x68, 0x56, 0x05, 0x76, 0xc1, 0x28, 0x86, 0x24,
+	0xaa, 0x72, 0xb6, 0x7b, 0xef, 0x3d, 0xc8, 0xcb, 0xec, 0xd3, 0x28, 0x07, 0xe3, 0x3b, 0x7b, 0x3b,
+	0x07, 0x2c, 0x9b, 0xd1, 0xfe, 0x93, 0x83, 0x42, 0x06, 0x01, 0x4c, 0x6e, 0x6c, 0xee, 0x6e, 0x1e,
+	0x6c, 0x16, 0xb2, 0xef, 0x35, 0xd5, 0x53, 0x12, 0xba, 0x06, 0xcb, 0x1b, 0x9b, 0x8d, 0x9d, 0xda,
+	0x66, 0xf3, 0xe0, 0x2f, 0xec, 0x6f, 0x36, 0x9f, 0xec, 0xd5, 0xf7, 0x37, 0x6b, 0x3b, 0xf7, 0x77,
+	0x36, 0x37, 0x0a, 0x97, 0xd0, 0x22, 0x14, 0xd4, 0xc2, 0x83, 0xc7, 0x07, 0xfb, 0x85, 0x0c, 0x2a,
+	0xc2, 0xa2, 0x0a, 0x7d, 0xba, 0x59, 0xad, 0x3c, 0x39, 0xd8, 0xde, 0x2b, 0x8c, 0x59, 0xe3, 0xb9,
+	0x6c, 0x21, 0xfb, 0xde, 0x2d, 0x7e, 0x63, 0x89, 0xe6, 0x00, 0x36, 0x36, 0xeb, 0xb5, 0xcd, 0xbd,
+	0x8d, 0x9d, 0xbd, 0xad, 0xc2, 0x25, 0x34, 0x0b, 0xf9, 0x8a, 0xfc, 0xcc, 0xac, 0xfd, 0xd1, 0x0f,
+	0x30, 0x4d, 0x46, 0x2b, 0x32, 0x4e, 0x36, 0x61, 0xf9, 0x91, 0xe3, 0x76, 0x43, 0xc7, 0xed, 0xf2,
+	0x39, 0x12, 0x1c, 0x46, 0xe5, 0x21, 0x2c, 0x27, 0xb3, 0x55, 0x1a, 0x15, 0x97, 0x71, 0x3b, 0x73,
+	0x2f, 0x83, 0xea, 0xb0, 0x98, 0x66, 0x33, 0x21, 0x4b, 0x7f, 0x0a, 0x9d, 0xa6, 0x0e, 0x4a, 0xcb,
+	0xa9, 0x3b, 0x4b, 0xe3, 0x03, 0xf4, 0x08, 0xe6, 0x13, 0xfb, 0x84, 0xec, 0xaf, 0x69, 0x07, 0x19,
+	0x46, 0xae, 0x48, 0x3d, 0x24, 0xa1, 0x1b, 0xdf, 0x25, 0x02, 0x74, 0x25, 0xb1, 0xbd, 0x6f, 0x12,
+	0x91, 0x36, 0x12, 0xbb, 0x97, 0x41, 0x36, 0x2c, 0xa6, 0xed, 0x38, 0x72, 0xc8, 0x43, 0xb6, 0xa3,
+	0x92, 0xa1, 0x39, 0x42, 0x33, 0x4d, 0x71, 0x4a, 0x9a, 0x43, 0xb4, 0xaa, 0x91, 0xe6, 0x97, 0xe4,
+	0xcc, 0xd2, 0x6d, 0x3f, 0xc4, 0xb8, 0x57, 0xe9, 0xb8, 0xcf, 0x71, 0x80, 0x44, 0x54, 0x91, 0x04,
+	0x99, 0x70, 0x6f, 0x67, 0xd0, 0x6f, 0xc1, 0x34, 0x4d, 0x47, 0xc9, 0x2f, 0xc1, 0x67, 0xd4, 0x14,
+	0x95, 0x25, 0xf1, 0x45, 0x0b, 0xef, 0x65, 0xd0, 0x57, 0x30, 0xb5, 0x85, 0xe9, 0x2d, 0x30, 0x7a,
+	0x2b, 0x96, 0x75, 0x7d, 0xa7, 0x2b, 0x4d, 0x61, 0xd1, 0xe1, 0xf8, 0x91, 0x19, 0xd5, 0x20, 0xc7,
+	0xd1, 0x03, 0x64, 0xc5, 0xf0, 0x83, 0x14, 0x02, 0x0b, 0x31, 0x02, 0xe4, 0x34, 0x82, 0x6a, 0x90,
+	0x97, 0x57, 0xd1, 0x68, 0xd9, 0x70, 0xff, 0x5d, 0x2a, 0x26, 0x0b, 0xb8, 0xd3, 0x64, 0xec, 0xef,
+	0x66, 0x33, 0xe8, 0x2e, 0x00, 0x7b, 0x44, 0x43, 0xc7, 0x12, 0xef, 0x68, 0x29, 0xc1, 0x40, 0xb4,
+	0x45, 0x56, 0x7e, 0x07, 0x87, 0xf8, 0xbc, 0x83, 0x37, 0xcd, 0xd6, 0x2e, 0xcc, 0xc9, 0x27, 0x2d,
+	0xe7, 0xe7, 0x84, 0x89, 0xda, 0xe7, 0x64, 0x05, 0xb1, 0x97, 0xa0, 0x32, 0xf6, 0x0b, 0x99, 0xa2,
+	0xc1, 0xe4, 0x74, 0xb2, 0x6a, 0x0a, 0xae, 0xcc, 0xf5, 0x29, 0x71, 0xe3, 0xd9, 0x3f, 0x63, 0xb8,
+	0x18, 0x4a, 0x6a, 0xbb, 0x7a, 0x1c, 0x18, 0xba, 0xa1, 0x74, 0x20, 0x35, 0x7c, 0xad, 0xf4, 0xd6,
+	0x90, 0x1a, 0x6c, 0x9e, 0xa8, 0xd6, 0x79, 0x00, 0xb3, 0x5a, 0xe4, 0x10, 0x12, 0x91, 0xc2, 0x69,
+	0xa1, 0x5d, 0xa5, 0x95, 0xf4, 0x42, 0x7e, 0x68, 0xbd, 0x4f, 0x95, 0x4d, 0x2c, 0xb7, 0x56, 0x29,
+	0x2d, 0x87, 0x16, 0xcb, 0x9a, 0x5a, 0x12, 0xd9, 0x16, 0x62, 0x28, 0x9b, 0xb0, 0x20, 0xfd, 0xc6,
+	0x4a, 0xc2, 0x72, 0x43, 0x36, 0x2e, 0xe3, 0xcc, 0x7d, 0x03, 0x0b, 0x5c, 0x0e, 0x34, 0x32, 0x05,
+	0xa9, 0x5c, 0x78, 0xe2, 0x26, 0x23, 0x81, 0x07, 0xb0, 0x54, 0x8f, 0x8d, 0x87, 0xd9, 0x38, 0x57,
+	0x75, 0x12, 0x4a, 0x1e, 0x2e, 0x23, 0xad, 0x87, 0x80, 0xea, 0xfd, 0xc3, 0x53, 0x57, 0x92, 0x7b,
+	0xee, 0xe2, 0x17, 0xe8, 0x7a, 0x6c, 0x48, 0x04, 0x48, 0xab, 0x51, 0xed, 0x54, 0x32, 0x8c, 0x18,
+	0x1d, 0xb0, 0xa7, 0xc1, 0x2c, 0x41, 0x89, 0xd3, 0x73, 0x0e, 0xdd, 0x8e, 0x1b, 0xba, 0x98, 0x88,
+	0x85, 0x8a, 0xa0, 0x16, 0x89, 0x19, 0xbc, 0x6a, 0xac, 0x81, 0xbe, 0x86, 0xd9, 0x2d, 0x1c, 0x46,
+	0xa9, 0xc6, 0xd0, 0x72, 0x22, 0x39, 0x19, 0x9f, 0x37, 0x71, 0x83, 0xa8, 0xe7, 0x37, 0xdb, 0x81,
+	0x02, 0x53, 0xae, 0x0a, 0x89, 0xeb, 0x09, 0x12, 0xbc, 0x8a, 0xe3, 0x3b, 0xa7, 0x81, 0x91, 0x5b,
+	0x77, 0x61, 0x7c, 0xdf, 0xed, 0x1e, 0x21, 0x24, 0x1a, 0x8a, 0x52, 0xf5, 0x94, 0x16, 0x34, 0x18,
+	0x17, 0xbd, 0x43, 0x28, 0xb3, 0x1c, 0x5b, 0xc9, 0xbc, 0x56, 0x22, 0x91, 0xf0, 0xdb, 0x32, 0xe0,
+	0x6f, 0x48, 0x2e, 0x2e, 0xc9, 0x9f, 0x78, 0x79, 0x63, 0x1d, 0xed, 0x53, 0xae, 0x27, 0x1b, 0x40,
+	0x37, 0xa3, 0xfd, 0xd4, 0x98, 0x56, 0xab, 0x84, 0xe2, 0x84, 0x1b, 0xeb, 0x48, 0xbe, 0x28, 0x4e,
+	0x21, 0x7a, 0x4b, 0xdb, 0xf6, 0x2f, 0x46, 0xf7, 0x6b, 0xc8, 0xcb, 0x9c, 0x52, 0x52, 0xdf, 0xc4,
+	0x13, 0x61, 0x49, 0x05, 0x9e, 0x4c, 0x3f, 0xf5, 0x25, 0x4b, 0xff, 0xa6, 0xe3, 0xc7, 0xd3, 0x2e,
+	0x19, 0x27, 0xef, 0x33, 0x98, 0x56, 0x12, 0x2e, 0xc9, 0xc5, 0x92, 0x4c, 0xc2, 0x54, 0xd2, 0x7f,
+	0x98, 0xe2, 0x1e, 0xd9, 0x34, 0xa6, 0x78, 0x86, 0x3f, 0xb4, 0x14, 0xa1, 0x29, 0x59, 0x6b, 0x62,
+	0x28, 0xe4, 0xfc, 0x2e, 0x52, 0x02, 0xa2, 0x2b, 0x3a, 0x86, 0xb9, 0x95, 0x75, 0x00, 0x36, 0x66,
+	0xda, 0x90, 0x5e, 0x6c, 0x1c, 0xd5, 0x3a, 0xd9, 0xcf, 0xda, 0x17, 0x44, 0xfa, 0x5a, 0xec, 0x69,
+	0x14, 0xa9, 0xa8, 0x71, 0x52, 0x1d, 0x95, 0x09, 0x7f, 0x07, 0x0a, 0x95, 0x16, 0xd5, 0xb2, 0x32,
+	0x91, 0x0e, 0x5a, 0x95, 0x2b, 0x58, 0x2f, 0x10, 0xb4, 0x96, 0xe2, 0x79, 0x79, 0x76, 0xb1, 0x43,
+	0x43, 0x92, 0x96, 0xe5, 0x5e, 0x1b, 0x2b, 0x4a, 0xc7, 0x30, 0x76, 0x6a, 0x13, 0x16, 0x6b, 0x4e,
+	0xb7, 0x85, 0x3b, 0xaf, 0x47, 0xe6, 0x73, 0xaa, 0x6e, 0x94, 0x24, 0x43, 0x57, 0xe2, 0xf8, 0x5c,
+	0xdb, 0xcc, 0xcb, 0x83, 0x9c, 0xac, 0x5a, 0x81, 0xcb, 0x8c, 0x89, 0x11, 0x5b, 0x4c, 0xd8, 0xa6,
+	0xe6, 0x3f, 0x81, 0xb9, 0x4d, 0xa2, 0x8e, 0xfb, 0x6d, 0x97, 0x45, 0xaf, 0x22, 0x3d, 0x1c, 0xd1,
+	0x88, 0xb8, 0x2d, 0x12, 0xb6, 0x29, 0xd9, 0x77, 0xa4, 0x90, 0x27, 0x13, 0x1c, 0x95, 0x16, 0x05,
+	0x59, 0x35, 0x51, 0x0f, 0xdd, 0x7b, 0x8f, 0x44, 0x86, 0x87, 0x58, 0x4e, 0x15, 0x55, 0xa1, 0x18,
+	0x33, 0xae, 0x94, 0xde, 0x1e, 0x5e, 0x49, 0xb5, 0xc5, 0x6c, 0x58, 0x36, 0xe4, 0xab, 0x41, 0xef,
+	0x48, 0xb3, 0x78, 0x58, 0x3e, 0x9b, 0x14, 0x73, 0xed, 0x3b, 0x25, 0x6b, 0x81, 0x81, 0xe6, 0xf0,
+	0x44, 0x36, 0x46, 0x06, 0xcb, 0x08, 0xad, 0xd4, 0x84, 0x33, 0xe8, 0x5d, 0x9d, 0xfa, 0x90, 0xa4,
+	0x34, 0xc6, 0x16, 0x1e, 0x53, 0xd1, 0x8b, 0xf2, 0x9d, 0x48, 0xa3, 0x27, 0x2d, 0x29, 0x8d, 0x34,
+	0x7a, 0x52, 0xb3, 0xc5, 0x30, 0x06, 0x6f, 0xc1, 0xe5, 0x58, 0xea, 0x17, 0x74, 0x3d, 0xce, 0xd8,
+	0x11, 0x0c, 0x65, 0x84, 0x1e, 0x09, 0xc1, 0x4e, 0x12, 0x4a, 0x4f, 0x06, 0x63, 0x1a, 0x23, 0x23,
+	0xf7, 0x44, 0x9a, 0x40, 0x6a, 0x7a, 0x17, 0xf4, 0x56, 0x0a, 0x0b, 0xcf, 0xc7, 0x3a, 0x46, 0xb6,
+	0x0e, 0x85, 0x78, 0x76, 0x14, 0xb4, 0x2a, 0xb9, 0x94, 0x9a, 0x02, 0xa6, 0x54, 0x36, 0x96, 0xf3,
+	0x4d, 0xe7, 0x41, 0x34, 0x29, 0xec, 0xa6, 0x28, 0x3e, 0x29, 0x6a, 0x66, 0x8c, 0xc4, 0xa4, 0xe8,
+	0x09, 0x2f, 0xb6, 0x68, 0x5c, 0xa9, 0x92, 0xe6, 0xc4, 0x78, 0x3a, 0xbd, 0x9e, 0x46, 0x27, 0xba,
+	0x87, 0xa9, 0x8b, 0x04, 0x92, 0x4a, 0xbf, 0x56, 0xb5, 0x7d, 0x33, 0xd9, 0xb5, 0xb2, 0xb1, 0x5c,
+	0x8e, 0xb4, 0x10, 0x4f, 0xf8, 0x21, 0x89, 0x1a, 0x32, 0x81, 0x18, 0x45, 0xf9, 0x3e, 0x2c, 0xea,
+	0xb3, 0x38, 0x62, 0xbc, 0x66, 0x5b, 0x77, 0x56, 0x4b, 0xf3, 0x81, 0xc4, 0xcf, 0x9c, 0xc4, 0x32,
+	0x8a, 0x24, 0xb8, 0x9f, 0x92, 0x6e, 0x84, 0x71, 0x5f, 0x49, 0x19, 0x72, 0x1e, 0xee, 0xa7, 0x65,
+	0x18, 0x91, 0x8c, 0x52, 0xfa, 0x25, 0xb6, 0xbf, 0x78, 0xc1, 0x45, 0x18, 0x75, 0x9e, 0xae, 0x99,
+	0xe8, 0x6c, 0x50, 0xeb, 0x46, 0xfe, 0x2e, 0xcf, 0x55, 0x8d, 0x4d, 0x9a, 0xc4, 0x97, 0xb4, 0xc1,
+	0xe9, 0xc2, 0x5e, 0x83, 0x19, 0x35, 0x63, 0x89, 0xb1, 0x17, 0xd7, 0x92, 0x34, 0x02, 0xe5, 0xbc,
+	0x35, 0x27, 0xb9, 0xc0, 0x7a, 0xb3, 0x12, 0x67, 0x8e, 0xd6, 0x21, 0xf3, 0x90, 0x90, 0xca, 0x9a,
+	0x11, 0x5d, 0x32, 0x9b, 0x05, 0x0b, 0xcc, 0x40, 0xd2, 0x7f, 0xb6, 0xc9, 0xf0, 0xeb, 0x4f, 0x46,
+	0x32, 0x4f, 0x68, 0xb4, 0xba, 0x9a, 0x7e, 0x04, 0x29, 0x52, 0x92, 0x92, 0x96, 0xa4, 0xb4, 0x6a,
+	0x2a, 0x56, 0x35, 0xf4, 0xb7, 0x30, 0x9f, 0x48, 0xb3, 0x22, 0x1d, 0x61, 0xa6, 0x04, 0x2c, 0xc3,
+	0xb5, 0xe0, 0x36, 0x19, 0x70, 0x0c, 0xb1, 0xb1, 0x36, 0x9a, 0x68, 0x72, 0x2f, 0xdd, 0x15, 0x01,
+	0xee, 0x69, 0x9d, 0x33, 0x25, 0x73, 0x31, 0x72, 0xf0, 0x00, 0x96, 0x52, 0xd3, 0xb8, 0x48, 0xb3,
+	0x62, 0x58, 0x92, 0x17, 0x23, 0xd5, 0xbf, 0x48, 0xd3, 0xa8, 0xc6, 0x52, 0x84, 0x48, 0x3f, 0x84,
+	0x31, 0x2d, 0x8c, 0xf4, 0x43, 0x98, 0xf3, 0xb5, 0x30, 0x6e, 0xee, 0xc2, 0x62, 0x5a, 0xd2, 0x15,
+	0xc5, 0x6f, 0x67, 0xcc, 0xc8, 0x92, 0xc2, 0x51, 0x5b, 0xac, 0x76, 0x03, 0xb5, 0x21, 0x29, 0x58,
+	0x8c, 0x1c, 0xf8, 0x99, 0x48, 0xac, 0x93, 0x4c, 0x95, 0x22, 0x4f, 0x6b, 0x23, 0x72, 0xa9, 0x0c,
+	0x31, 0x2a, 0x2f, 0xd7, 0xdd, 0xa3, 0xae, 0x92, 0xd5, 0x44, 0x9a, 0x94, 0xc9, 0x74, 0x2a, 0x52,
+	0xb3, 0xa4, 0x25, 0x41, 0x79, 0x0c, 0x8b, 0x62, 0x8b, 0x55, 0xb3, 0x80, 0xa0, 0x04, 0x4e, 0x14,
+	0x94, 0x2e, 0xb5, 0x4c, 0x6a, 0xda, 0x10, 0x76, 0x26, 0xa3, 0xbf, 0xfb, 0xa2, 0x9c, 0xc9, 0x94,
+	0xf4, 0x1c, 0x25, 0x3d, 0x93, 0x07, 0xfa, 0x82, 0x9e, 0xc9, 0x58, 0xb6, 0x36, 0xb3, 0x53, 0x58,
+	0xa3, 0x14, 0xe9, 0xb4, 0x75, 0xe1, 0x36, 0xa4, 0x0d, 0xea, 0x94, 0x47, 0x1f, 0xb3, 0x28, 0x92,
+	0x7e, 0xcc, 0x52, 0x3b, 0x6a, 0x76, 0xce, 0xcc, 0xa8, 0x2f, 0x5d, 0x25, 0xaf, 0x52, 0x9e, 0xae,
+	0x4b, 0x5e, 0xa5, 0x3d, 0x34, 0xa7, 0x56, 0xfd, 0x81, 0x30, 0xe1, 0x22, 0x7a, 0xd7, 0x87, 0xbe,
+	0x14, 0x2f, 0xad, 0x0e, 0x7f, 0x5e, 0xcd, 0x6f, 0x07, 0x0a, 0xf1, 0xc7, 0xb8, 0x28, 0xed, 0x3d,
+	0xbe, 0xf2, 0x22, 0x59, 0x1a, 0x22, 0xc6, 0x57, 0xbc, 0xfb, 0xc2, 0x3c, 0xd4, 0xe9, 0x1a, 0x9e,
+	0x7b, 0xab, 0xa4, 0x87, 0x9b, 0x11, 0xd1, 0xbb, 0x5c, 0xd5, 0x88, 0x4b, 0xbc, 0xfb, 0x55, 0xcd,
+	0x88, 0x94, 0xa7, 0xbc, 0xae, 0x08, 0x22, 0x49, 0xcf, 0xf1, 0xf2, 0xae, 0x6e, 0x66, 0x0d, 0x09,
+	0x94, 0x1c, 0x79, 0xff, 0x82, 0x7e, 0x47, 0x24, 0xaf, 0x4b, 0x66, 0x40, 0x78, 0x27, 0xe6, 0x87,
+	0x49, 0x8f, 0x02, 0x2c, 0x0d, 0x4b, 0xb0, 0x80, 0x1e, 0xd1, 0xf7, 0x51, 0x8f, 0x77, 0x36, 0x6a,
+	0xfc, 0xd7, 0x1d, 0x3d, 0x3f, 0xe1, 0xe0, 0x56, 0x7e, 0xa1, 0x20, 0x62, 0x32, 0xab, 0xa2, 0x21,
+	0x36, 0xd6, 0x51, 0x9d, 0xfa, 0x59, 0x35, 0x68, 0x8a, 0x8f, 0x3b, 0x85, 0x60, 0x29, 0x9d, 0x20,
+	0x75, 0xfa, 0x6f, 0x8a, 0xdd, 0x4c, 0xef, 0xa6, 0xa1, 0x0f, 0xc3, 0xac, 0x00, 0x26, 0x36, 0xe9,
+	0x64, 0x44, 0xef, 0x46, 0xc9, 0x11, 0xe3, 0x58, 0xbd, 0xf2, 0x68, 0xf7, 0x95, 0x38, 0xa6, 0x21,
+	0x36, 0xd6, 0x38, 0xc7, 0x34, 0xe8, 0xc5, 0x38, 0x16, 0x23, 0xa8, 0x73, 0x4c, 0xef, 0xa6, 0xa1,
+	0x0f, 0xa3, 0x39, 0x96, 0x4e, 0xe6, 0xbc, 0x1c, 0xfb, 0x96, 0xee, 0xcf, 0x5b, 0xf4, 0xb5, 0xce,
+	0x85, 0x78, 0x56, 0x14, 0x16, 0xac, 0x8e, 0xda, 0x58, 0x47, 0x4f, 0x69, 0x86, 0xbe, 0x18, 0xfc,
+	0x7c, 0x7c, 0x5b, 0x31, 0x11, 0xa5, 0x9c, 0xdb, 0x81, 0x25, 0xc6, 0xb9, 0x78, 0x77, 0x8d, 0x7d,
+	0x31, 0x0e, 0x7b, 0x4b, 0x18, 0x3b, 0x71, 0x52, 0x17, 0xe5, 0xdf, 0x06, 0x15, 0x91, 0x03, 0x9f,
+	0xd8, 0xa7, 0xed, 0xa4, 0xf1, 0xaa, 0x13, 0x11, 0x9e, 0x71, 0xbd, 0x7a, 0x63, 0x0d, 0xed, 0xd0,
+	0x59, 0xd0, 0xc1, 0xc3, 0xac, 0xfb, 0x74, 0x32, 0x94, 0x49, 0xdb, 0xc2, 0x20, 0x8a, 0xf5, 0xc9,
+	0xd4, 0xb6, 0xb9, 0x53, 0xf2, 0xe8, 0x73, 0xce, 0xd1, 0x99, 0x58, 0xc4, 0x36, 0x76, 0x76, 0xd2,
+	0x18, 0xc5, 0x99, 0xf8, 0x2f, 0x23, 0xa3, 0x9f, 0x42, 0x5e, 0x20, 0x8f, 0x66, 0x48, 0x1c, 0x9b,
+	0x32, 0xe4, 0x6b, 0x98, 0xe6, 0x0c, 0xa1, 0x3d, 0x30, 0xb5, 0x64, 0xec, 0xfe, 0x57, 0x30, 0xcd,
+	0xd9, 0x30, 0x74, 0x04, 0xe6, 0x6b, 0xc5, 0xa5, 0x2d, 0x1c, 0xa6, 0xfc, 0x72, 0xe7, 0xa8, 0xc1,
+	0xa4, 0xfd, 0x50, 0x28, 0x6a, 0xd0, 0x77, 0x8e, 0xa6, 0x5f, 0x59, 0x35, 0x91, 0x1c, 0xf9, 0x1b,
+	0xaf, 0x84, 0x6e, 0xdd, 0x4c, 0x77, 0x24, 0xbe, 0x71, 0xf4, 0x7b, 0xb0, 0x42, 0xef, 0x20, 0x2e,
+	0xda, 0x63, 0xf3, 0x21, 0xe5, 0x6a, 0x14, 0x7e, 0x10, 0xff, 0x81, 0x57, 0x13, 0xb1, 0x51, 0xbf,
+	0x2d, 0x4b, 0xa8, 0xd6, 0x8d, 0x54, 0x47, 0x61, 0x0f, 0xd9, 0x8c, 0xae, 0xd1, 0xb1, 0x5f, 0xb0,
+	0xb7, 0xc3, 0x35, 0x4d, 0xec, 0x17, 0x67, 0x47, 0x45, 0x4f, 0xc4, 0x7f, 0xd3, 0x96, 0x50, 0xa9,
+	0x27, 0xa8, 0x98, 0x6a, 0x0f, 0xdb, 0x7c, 0xe8, 0xd0, 0xce, 0xd9, 0x1b, 0xf3, 0xe5, 0x48, 0x5e,
+	0x26, 0x81, 0x40, 0x8a, 0x6d, 0xaf, 0xa5, 0x38, 0x28, 0xcd, 0xaa, 0xb1, 0x0e, 0x01, 0xaa, 0xb0,
+	0x3d, 0x5e, 0x4d, 0x86, 0xa0, 0x78, 0x11, 0x53, 0xb3, 0x24, 0xc4, 0x49, 0xb0, 0xb3, 0x09, 0xfd,
+	0x19, 0x5c, 0xe5, 0x6c, 0xa2, 0x3c, 0x13, 0x2f, 0xe9, 0x8f, 0xb8, 0xb9, 0x0a, 0xa3, 0x2f, 0xb9,
+	0xd5, 0xfb, 0x22, 0xf5, 0xa1, 0xb8, 0x7a, 0x36, 0xd1, 0x9f, 0xb4, 0xcb, 0xb3, 0x09, 0x6d, 0x50,
+	0xa7, 0x3c, 0xfa, 0x6c, 0x42, 0x91, 0xf4, 0xb3, 0x89, 0xda, 0x51, 0xf3, 0xc2, 0x43, 0xc9, 0x37,
+	0xed, 0xf2, 0xdc, 0x6d, 0x7c, 0xee, 0x3e, 0xe4, 0x4a, 0x69, 0x21, 0x25, 0x7b, 0x89, 0xb4, 0xf9,
+	0xcd, 0x99, 0x4d, 0x4a, 0xfa, 0xfd, 0xc8, 0xbd, 0x0c, 0xda, 0xa3, 0x79, 0x72, 0xd3, 0x7e, 0x1d,
+	0xd8, 0x24, 0x3f, 0x43, 0x7f, 0x8e, 0x98, 0xd0, 0xab, 0xa7, 0xd3, 0x1b, 0x8a, 0x37, 0xe4, 0x58,
+	0x77, 0x95, 0x47, 0x94, 0x5c, 0xa0, 0x8b, 0x66, 0x11, 0x9f, 0x62, 0x3e, 0x62, 0x33, 0x6a, 0x41,
+	0xfd, 0x39, 0x5e, 0xba, 0x65, 0xdd, 0x81, 0x49, 0x86, 0x64, 0xdc, 0x6d, 0xb4, 0x9f, 0xf0, 0x45,
+	0x1f, 0x88, 0x8b, 0x5b, 0x82, 0xa2, 0x15, 0x19, 0xfb, 0xf5, 0x01, 0xe4, 0x99, 0xdb, 0xed, 0xfc,
+	0x28, 0x5f, 0x88, 0xeb, 0xdd, 0x61, 0x1d, 0x33, 0x47, 0x55, 0xcc, 0xaa, 0x0e, 0xe7, 0x8b, 0x33,
+	0xf2, 0x2b, 0xea, 0xfa, 0x14, 0xae, 0x06, 0x33, 0xfe, 0x52, 0xe2, 0xe7, 0x96, 0x29, 0x4b, 0x3f,
+	0xa5, 0xfe, 0x57, 0x99, 0x06, 0xc8, 0xd4, 0xfd, 0xe4, 0x8f, 0x35, 0xa3, 0x2f, 0x60, 0x8e, 0x31,
+	0x57, 0x22, 0x27, 0x2b, 0x0d, 0xe1, 0xd9, 0x1c, 0x63, 0xf3, 0xab, 0x20, 0xff, 0x54, 0x38, 0x6a,
+	0x47, 0x76, 0xfb, 0x3c, 0x2e, 0xda, 0xd1, 0xac, 0x33, 0x51, 0xf9, 0x1d, 0xba, 0xe9, 0xa6, 0xe7,
+	0xae, 0x30, 0x12, 0xbb, 0xad, 0xb8, 0xa0, 0x87, 0x67, 0xbd, 0x38, 0xa1, 0xd1, 0x81, 0xe9, 0x3f,
+	0xd8, 0x7d, 0x6b, 0x04, 0x15, 0xc1, 0x80, 0x9f, 0x8c, 0xac, 0x27, 0xfd, 0x5c, 0x3c, 0x49, 0x73,
+	0x7a, 0x7b, 0x23, 0x32, 0x58, 0xa4, 0xb8, 0x0c, 0x0d, 0x89, 0x21, 0x04, 0x41, 0xfd, 0xda, 0x71,
+	0xe8, 0x18, 0xcc, 0x47, 0xb4, 0x28, 0xd7, 0xf2, 0x05, 0x27, 0xc1, 0x6c, 0x46, 0xa1, 0x64, 0xba,
+	0x0c, 0x79, 0x77, 0xa3, 0xc3, 0xf9, 0x85, 0xf8, 0x5b, 0x26, 0x0e, 0x07, 0xca, 0x05, 0x0e, 0x0f,
+	0x45, 0x8d, 0xfd, 0x16, 0xa6, 0x29, 0xd9, 0xc6, 0x90, 0xd3, 0x19, 0x0f, 0xc6, 0x7c, 0x23, 0x84,
+	0x92, 0xb3, 0x7d, 0x71, 0x42, 0xd2, 0x31, 0x1c, 0x23, 0x64, 0x0d, 0x99, 0xde, 0xd1, 0x4e, 0xaf,
+	0xa2, 0x61, 0x5e, 0x2f, 0x3e, 0xa1, 0x4e, 0x14, 0xf6, 0x97, 0xcc, 0xe9, 0x21, 0xb7, 0x7d, 0x63,
+	0x7e, 0x11, 0x39, 0xbb, 0x43, 0x12, 0x82, 0xd4, 0xa2, 0xdf, 0xb6, 0xd0, 0x92, 0x80, 0xd4, 0xec,
+	0x5d, 0xe9, 0xae, 0x4b, 0xcb, 0x0e, 0x52, 0x02, 0x51, 0x68, 0xef, 0x92, 0xb5, 0x6e, 0x4a, 0x60,
+	0x11, 0x85, 0x2e, 0x0d, 0x4f, 0xef, 0x21, 0xd7, 0xfa, 0xc8, 0x4c, 0x18, 0x7b, 0xb0, 0x98, 0x96,
+	0x78, 0x42, 0x4e, 0xda, 0x90, 0xac, 0x14, 0xa9, 0xf1, 0x51, 0xfb, 0xb0, 0x94, 0x9a, 0xfc, 0x41,
+	0xde, 0x90, 0x0c, 0x4b, 0x0d, 0x91, 0x4a, 0xf1, 0x3b, 0x58, 0x36, 0x64, 0x3a, 0x88, 0x1c, 0x88,
+	0x43, 0x33, 0x21, 0x18, 0x05, 0xe2, 0x7b, 0x28, 0x99, 0x1f, 0xd1, 0xa3, 0xdb, 0xba, 0x13, 0xd4,
+	0xfc, 0x74, 0xbd, 0x94, 0x9a, 0xf5, 0x03, 0x1d, 0xd0, 0x84, 0x64, 0x69, 0xaf, 0xea, 0x65, 0xbf,
+	0x87, 0xbf, 0xba, 0x37, 0xc4, 0xb5, 0x2d, 0x1b, 0x1e, 0xd2, 0x0f, 0xa1, 0x7a, 0x8e, 0xde, 0xee,
+	0x09, 0xbd, 0xa4, 0xbf, 0x11, 0x8f, 0x85, 0xc8, 0xa7, 0x3e, 0x20, 0x4f, 0xed, 0xe7, 0x03, 0x98,
+	0xd5, 0x9e, 0x5f, 0x4a, 0xf1, 0x4f, 0x7b, 0x39, 0x2b, 0xbd, 0xd5, 0xa9, 0x2f, 0x36, 0xab, 0x85,
+	0x5f, 0xfe, 0x8f, 0xd5, 0xcc, 0x2f, 0x7f, 0xb5, 0x9a, 0xf9, 0x6f, 0xbf, 0x5a, 0xcd, 0xfc, 0xd9,
+	0xaf, 0x56, 0x33, 0x87, 0x93, 0xb4, 0xfa, 0xfa, 0xff, 0x0b, 0x00, 0x00, 0xff, 0xff, 0x8e, 0xe9,
+	0x48, 0xe5, 0x19, 0x8d, 0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -22333,11 +22123,6 @@ func (m *AddMFADeviceRequestInit) MarshalToSizedBuffer(dAtA []byte) (int, error)
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.DeviceUsage != 0 {
-		i = encodeVarintAuthservice(dAtA, i, uint64(m.DeviceUsage))
-		i--
-		dAtA[i] = 0x20
-	}
 	if m.DeviceType != 0 {
 		i = encodeVarintAuthservice(dAtA, i, uint64(m.DeviceType))
 		i--
@@ -24658,60 +24443,6 @@ func (m *UserCredentials) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *ContextUser) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *ContextUser) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *ContextUser) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	return len(dAtA) - i, nil
-}
-
-func (m *Passwordless) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *Passwordless) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *Passwordless) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	return len(dAtA) - i, nil
-}
-
 func (m *CreateAuthenticateChallengeRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -24783,48 +24514,6 @@ func (m *CreateAuthenticateChallengeRequest_RecoveryStartTokenID) MarshalToSized
 	dAtA[i] = 0x12
 	return len(dAtA) - i, nil
 }
-func (m *CreateAuthenticateChallengeRequest_ContextUser) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *CreateAuthenticateChallengeRequest_ContextUser) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.ContextUser != nil {
-		{
-			size, err := m.ContextUser.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintAuthservice(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x1a
-	}
-	return len(dAtA) - i, nil
-}
-func (m *CreateAuthenticateChallengeRequest_Passwordless) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *CreateAuthenticateChallengeRequest_Passwordless) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.Passwordless != nil {
-		{
-			size, err := m.Passwordless.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintAuthservice(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x22
-	}
-	return len(dAtA) - i, nil
-}
 func (m *CreatePrivilegeTokenRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -24888,11 +24577,6 @@ func (m *CreateRegisterChallengeRequest) MarshalToSizedBuffer(dAtA []byte) (int,
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.DeviceUsage != 0 {
-		i = encodeVarintAuthservice(dAtA, i, uint64(m.DeviceUsage))
-		i--
-		dAtA[i] = 0x18
-	}
 	if m.DeviceType != 0 {
 		i = encodeVarintAuthservice(dAtA, i, uint64(m.DeviceType))
 		i--
@@ -25028,48 +24712,6 @@ func (m *PaginatedResource_KubeService) MarshalToSizedBuffer(dAtA []byte) (int,
 	}
 	return len(dAtA) - i, nil
 }
-func (m *PaginatedResource_WindowsDesktop) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *PaginatedResource_WindowsDesktop) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.WindowsDesktop != nil {
-		{
-			size, err := m.WindowsDesktop.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintAuthservice(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x2a
-	}
-	return len(dAtA) - i, nil
-}
-func (m *PaginatedResource_KubeCluster) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *PaginatedResource_KubeCluster) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.KubeCluster != nil {
-		{
-			size, err := m.KubeCluster.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintAuthservice(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x32
-	}
-	return len(dAtA) - i, nil
-}
 func (m *ListResourcesRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -25094,16 +24736,6 @@ func (m *ListResourcesRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	{
-		size, err := m.WindowsDesktopFilter.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintAuthservice(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x52
 	if m.NeedTotalCount {
 		i--
 		if m.NeedTotalCount {
@@ -25300,12 +24932,12 @@ func (m *CreateSessionTrackerRequest) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i--
 		dAtA[i] = 0x5a
 	}
-	n101, err101 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err101 != nil {
-		return 0, err101
+	n96, err96 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err96 != nil {
+		return 0, err96
 	}
-	i -= n101
-	i = encodeVarintAuthservice(dAtA, i, uint64(n101))
+	i -= n96
+	i = encodeVarintAuthservice(dAtA, i, uint64(n96))
 	i--
 	dAtA[i] = 0x52
 	if m.Initiator != nil {
@@ -27983,9 +27615,6 @@ func (m *AddMFADeviceRequestInit) Size() (n int) {
 	if m.DeviceType != 0 {
 		n += 1 + sovAuthservice(uint64(m.DeviceType))
 	}
-	if m.DeviceUsage != 0 {
-		n += 1 + sovAuthservice(uint64(m.DeviceUsage))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -29090,30 +28719,6 @@ func (m *UserCredentials) Size() (n int) {
 	return n
 }
 
-func (m *ContextUser) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func (m *Passwordless) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
 func (m *CreateAuthenticateChallengeRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -29151,30 +28756,6 @@ func (m *CreateAuthenticateChallengeRequest_RecoveryStartTokenID) Size() (n int)
 	n += 1 + l + sovAuthservice(uint64(l))
 	return n
 }
-func (m *CreateAuthenticateChallengeRequest_ContextUser) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.ContextUser != nil {
-		l = m.ContextUser.Size()
-		n += 1 + l + sovAuthservice(uint64(l))
-	}
-	return n
-}
-func (m *CreateAuthenticateChallengeRequest_Passwordless) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.Passwordless != nil {
-		l = m.Passwordless.Size()
-		n += 1 + l + sovAuthservice(uint64(l))
-	}
-	return n
-}
 func (m *CreatePrivilegeTokenRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -29204,9 +28785,6 @@ func (m *CreateRegisterChallengeRequest) Size() (n int) {
 	if m.DeviceType != 0 {
 		n += 1 + sovAuthservice(uint64(m.DeviceType))
 	}
-	if m.DeviceUsage != 0 {
-		n += 1 + sovAuthservice(uint64(m.DeviceUsage))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -29276,30 +28854,6 @@ func (m *PaginatedResource_KubeService) Size() (n int) {
 	}
 	return n
 }
-func (m *PaginatedResource_WindowsDesktop) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.WindowsDesktop != nil {
-		l = m.WindowsDesktop.Size()
-		n += 1 + l + sovAuthservice(uint64(l))
-	}
-	return n
-}
-func (m *PaginatedResource_KubeCluster) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.KubeCluster != nil {
-		l = m.KubeCluster.Size()
-		n += 1 + l + sovAuthservice(uint64(l))
-	}
-	return n
-}
 func (m *ListResourcesRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -29344,8 +28898,6 @@ func (m *ListResourcesRequest) Size() (n int) {
 	if m.NeedTotalCount {
 		n += 2
 	}
-	l = m.WindowsDesktopFilter.Size()
-	n += 1 + l + sovAuthservice(uint64(l))
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -40406,25 +39958,6 @@ func (m *AddMFADeviceRequestInit) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
-		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceUsage", wireType)
-			}
-			m.DeviceUsage = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DeviceUsage |= DeviceUsage(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -45827,108 +45360,6 @@ func (m *UserCredentials) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ContextUser) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: ContextUser: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ContextUser: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *Passwordless) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAuthservice
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Passwordless: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Passwordless: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAuthservice(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
 func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -46025,76 +45456,6 @@ func (m *CreateAuthenticateChallengeRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.Request = &CreateAuthenticateChallengeRequest_RecoveryStartTokenID{string(dAtA[iNdEx:postIndex])}
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ContextUser", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &ContextUser{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Request = &CreateAuthenticateChallengeRequest_ContextUser{v}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Passwordless", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &Passwordless{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Request = &CreateAuthenticateChallengeRequest_Passwordless{v}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -46284,25 +45645,6 @@ func (m *CreateRegisterChallengeRequest) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceUsage", wireType)
-			}
-			m.DeviceUsage = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.DeviceUsage |= DeviceUsage(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -46494,76 +45836,6 @@ func (m *PaginatedResource) Unmarshal(dAtA []byte) error {
 			}
 			m.Resource = &PaginatedResource_KubeService{v}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktop", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &types.WindowsDesktopV3{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_WindowsDesktop{v}
-			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field KubeCluster", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &types.KubernetesClusterV3{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Resource = &PaginatedResource_KubeCluster{v}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
@@ -46974,39 +46246,6 @@ func (m *ListResourcesRequest) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.NeedTotalCount = bool(v != 0)
-		case 10:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WindowsDesktopFilter", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAuthservice
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthAuthservice
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.WindowsDesktopFilter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthservice(dAtA[iNdEx:])
diff --git a/api/client/proto/authservice.proto b/api/client/proto/authservice.proto
index 1b08662e5ab2c..e7631dfd1aa95 100644
--- a/api/client/proto/authservice.proto
+++ b/api/client/proto/authservice.proto
@@ -818,19 +818,6 @@ enum DeviceType {
     DEVICE_TYPE_WEBAUTHN = 3;
 }
 
-enum DeviceUsage {
-    DEVICE_USAGE_UNSPECIFIED = 0;
-
-    // Device intended for MFA use, but not for passwordless.
-    // Allows both FIDO and FIDO2 devices.
-    // Resident keys not required.
-    DEVICE_USAGE_MFA = 1;
-
-    // Device intended for both MFA and passwordless.
-    // Requires a FIDO2 device and takes a resident key slot.
-    DEVICE_USAGE_PASSWORDLESS = 2;
-}
-
 // MFAAuthenticateChallenge is a challenge for all MFA devices registered for a
 // user.
 message MFAAuthenticateChallenge {
@@ -941,11 +928,7 @@ message AddMFADeviceResponse {
 // AddMFADeviceRequestInit describes the new MFA device.
 message AddMFADeviceRequestInit {
     string DeviceName = 1;
-    reserved 2; // LegacyDeviceType LegacyType
     DeviceType DeviceType = 3;
-    // DeviceUsage is the requested usage for the device.
-    // Defaults to DEVICE_USAGE_MFA.
-    DeviceUsage DeviceUsage = 4 [ (gogoproto.jsontag) = "device_usage,omitempty" ];
 }
 
 // AddMFADeviceResponseAck is a confirmation of successful device registration.
@@ -1391,17 +1374,12 @@ message UserCredentials {
     bytes Password = 2 [ (gogoproto.jsontag) = "password" ];
 }
 
-// ContextUser marks requests that rely in the currently authenticated user.
-message ContextUser {}
-
-// Passwordless marks requests for passwordless challenges.
-message Passwordless {}
-
 // CreateAuthenticateChallengeRequest is a request for creating MFA authentication challenges for a
 // users mfa devices.
 message CreateAuthenticateChallengeRequest {
     // Request defines how the request will be verified before creating challenges.
-    // An empty Request is equivalent to context_user being set.
+    // This field can be empty, which implies the request is to create challenges for the
+    // user in context (logged in user).
     oneof Request {
         // UserCredentials verifies request with username and password. Used with logins or
         // when the logged in user wants to change their password.
@@ -1411,12 +1389,6 @@ message CreateAuthenticateChallengeRequest {
         // VerifyAccountRecovery (step 2 of the recovery process after RPC StartAccountRecovery).
         string RecoveryStartTokenID = 2
             [ (gogoproto.jsontag) = "recovery_start_token_id,omitempty" ];
-        // ContextUser issues a challenge for the currently-authenticated user.
-        // Default option if no other is provided.
-        ContextUser ContextUser = 3 [ (gogoproto.jsontag) = "context_user,omitempty" ];
-        // Passwordless issues a passwordless challenge (authenticated user not
-        // required).
-        Passwordless Passwordless = 4 [ (gogoproto.jsontag) = "passwordless,omitempty" ];
     }
 }
 
@@ -1440,9 +1412,6 @@ message CreateRegisterChallengeRequest {
     string TokenID = 1 [ (gogoproto.jsontag) = "token_id" ];
     // DeviceType is the type of MFA device to make a register challenge for.
     DeviceType DeviceType = 2 [ (gogoproto.jsontag) = "device_type" ];
-    // DeviceUsage is the requested usage for the device.
-    // Defaults to DEVICE_USAGE_MFA.
-    DeviceUsage DeviceUsage = 3 [ (gogoproto.jsontag) = "device_usage,omitempty" ];
 }
 
 // PaginatedResource represents one of the supported resources.
@@ -1457,12 +1426,6 @@ message PaginatedResource {
         types.ServerV2 Node = 3 [ (gogoproto.jsontag) = "node,omitempty" ];
         // KubeService represents a KubernetesService resource.
         types.ServerV2 KubeService = 4 [ (gogoproto.jsontag) = "kube_service,omitempty" ];
-        // WindowsDesktop represents a WindowsDesktop resource.
-        types.WindowsDesktopV3 WindowsDesktop = 5
-            [ (gogoproto.jsontag) = "windows_desktop,omitempty" ];
-        // KubeCluster represents a KubeCluster resource.
-        types.KubernetesClusterV3 KubeCluster = 6
-            [ (gogoproto.jsontag) = "kube_cluster,omitempty" ];
     }
 }
 
@@ -1491,9 +1454,6 @@ message ListResourcesRequest {
     // NeedTotalCount indicates whether or not the caller also wants the total number of resources
     // after filtering.
     bool NeedTotalCount = 9 [ (gogoproto.jsontag) = "need_total_count,omitempty" ];
-    // WindowsDesktopFilter specifies windows desktop specific filters.
-    types.WindowsDesktopFilter WindowsDesktopFilter = 10
-        [ (gogoproto.nullable) = false, (gogoproto.jsontag) = "windows_desktop_filter,omitempty" ];
 }
 
 // ListResourceResponse response of ListResources.
diff --git a/api/client/proto/types.go b/api/client/proto/types.go
index 9e1b789474628..ece8f561c6ba0 100644
--- a/api/client/proto/types.go
+++ b/api/client/proto/types.go
@@ -88,5 +88,5 @@ func (req *ListResourcesRequest) CheckAndSetDefaults() error {
 // RequiresFakePagination checks if we need to fallback to GetXXX calls
 // that retrieves entire resources upfront rather than working with subsets.
 func (req *ListResourcesRequest) RequiresFakePagination() bool {
-	return req.SortBy.Field != "" || req.NeedTotalCount || req.ResourceType == types.KindKubernetesCluster
+	return req.SortBy.Field != "" || req.NeedTotalCount
 }
diff --git a/api/client/proxy.go b/api/client/proxy.go
index 7e4f80c59a09e..e128bb1b275a0 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -46,8 +46,8 @@ func DialProxyWithDialer(ctx context.Context, proxyAddr *url.URL, addr string, d
 		Host:   addr,
 		Header: make(http.Header),
 	}
-
-	if err := connectReq.Write(conn); err != nil {
+	err = connectReq.Write(conn)
+	if err != nil {
 		log.Warnf("Unable to write to proxy: %v.", err)
 		return nil, trace.Wrap(err)
 	}
diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index c896fb7ec0711..7477d6b897b21 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -1,19 +1,3 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
 package proxy
 
 import (
diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index f65877cc161d9..e0f5e1b0d8f77 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -40,54 +40,19 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-// Config specifies information when building requests with the
-// webclient.
-type Config struct {
-	// Context is a context for creating webclient requests.
-	Context context.Context
-	// ProxyAddr specifies the teleport proxy address for requests.
-	ProxyAddr string
-	// Insecure turns off TLS certificate verification when enabled.
-	Insecure bool
-	// Pool defines the set of root CAs to use when verifying server
-	// certificates.
-	Pool *x509.CertPool
-	// ConnectorName is the name of the ODIC or SAML connector.
-	ConnectorName string
-	// ExtraHeaders is a map of extra HTTP headers to be included in
-	// requests.
-	ExtraHeaders map[string]string
-}
-
-// CheckAndSetDefaults checks and sets defaults
-func (c *Config) CheckAndSetDefaults() error {
-	message := "webclient config: %s"
-	if c.Context == nil {
-		return trace.BadParameter(message, "missing parameter Context")
-	}
-	if c.ProxyAddr == "" && os.Getenv(defaults.TunnelPublicAddrEnvar) == "" {
-		return trace.BadParameter(message, "missing parameter ProxyAddr")
-	}
-
-	return nil
-}
-
 // newWebClient creates a new client to the HTTPS web proxy.
-func newWebClient(cfg *Config) (*http.Client, error) {
-	if err := cfg.CheckAndSetDefaults(); err != nil {
-		return nil, trace.Wrap(err)
-	}
+func newWebClient(insecure bool, pool *x509.CertPool) *http.Client {
 	return &http.Client{
 		Transport: &proxy.ProxyAwareRoundTripper{Transport: http.Transport{
 			TLSClientConfig: &tls.Config{
-				RootCAs:            cfg.Pool,
-				InsecureSkipVerify: cfg.Insecure,
+				RootCAs:            pool,
+				InsecureSkipVerify: insecure,
 			},
 			Proxy: func(req *http.Request) (*url.URL, error) {
 				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
 			},
-		},
-		}}, nil
+		}},
+	}
 }
 
 // doWithFallback attempts to execute an HTTP request using https, and then
@@ -96,13 +61,9 @@ func newWebClient(cfg *Config) (*http.Client, error) {
 //  * The target host must resolve to the loopback address.
 // If these conditions are not met, then the plain-HTTP fallback is not allowed,
 // and a the HTTPS failure will be considered final.
-func doWithFallback(clt *http.Client, allowPlainHTTP bool, extraHeaders map[string]string, req *http.Request) (*http.Response, error) {
+func doWithFallback(clt *http.Client, allowPlainHTTP bool, req *http.Request) (*http.Response, error) {
 	// first try https and see how that goes
 	req.URL.Scheme = "https"
-	for k, v := range extraHeaders {
-		req.Header.Add(k, v)
-	}
-
 	log.Debugf("Attempting %s %s%s", req.Method, req.URL.Host, req.URL.Path)
 	resp, err := clt.Do(req)
 
@@ -132,21 +93,18 @@ func doWithFallback(clt *http.Client, allowPlainHTTP bool, extraHeaders map[stri
 
 // Find fetches discovery data by connecting to the given web proxy address.
 // It is designed to fetch proxy public addresses without any inefficiencies.
-func Find(cfg *Config) (*PingResponse, error) {
-	clt, err := newWebClient(cfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+func Find(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertPool) (*PingResponse, error) {
+	clt := newWebClient(insecure, pool)
 	defer clt.CloseIdleConnections()
 
-	endpoint := fmt.Sprintf("https://%s/webapi/find", cfg.ProxyAddr)
+	endpoint := fmt.Sprintf("https://%s/webapi/find", proxyAddr)
 
-	req, err := http.NewRequestWithContext(cfg.Context, http.MethodGet, endpoint, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := doWithFallback(clt, cfg.Insecure, cfg.ExtraHeaders, req)
+	resp, err := doWithFallback(clt, insecure, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -165,24 +123,21 @@ func Find(cfg *Config) (*PingResponse, error) {
 // errors before being asked for passwords. The second is to return the form
 // of authentication that the server supports. This also leads to better user
 // experience: users only get prompted for the type of authentication the server supports.
-func Ping(cfg *Config) (*PingResponse, error) {
-	clt, err := newWebClient(cfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+func Ping(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertPool, connectorName string) (*PingResponse, error) {
+	clt := newWebClient(insecure, pool)
 	defer clt.CloseIdleConnections()
 
-	endpoint := fmt.Sprintf("https://%s/webapi/ping", cfg.ProxyAddr)
-	if cfg.ConnectorName != "" {
-		endpoint = fmt.Sprintf("%s/%s", endpoint, cfg.ConnectorName)
+	endpoint := fmt.Sprintf("https://%s/webapi/ping", proxyAddr)
+	if connectorName != "" {
+		endpoint = fmt.Sprintf("%s/%s", endpoint, connectorName)
 	}
 
-	req, err := http.NewRequestWithContext(cfg.Context, http.MethodGet, endpoint, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := doWithFallback(clt, cfg.Insecure, cfg.ExtraHeaders, req)
+	resp, err := doWithFallback(clt, insecure, req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -197,38 +152,32 @@ func Ping(cfg *Config) (*PingResponse, error) {
 }
 
 // GetTunnelAddr returns the tunnel address either set in an environment variable or retrieved from the web proxy.
-func GetTunnelAddr(cfg *Config) (string, error) {
-	if err := cfg.CheckAndSetDefaults(); err != nil {
-		return "", trace.Wrap(err)
-	}
+func GetTunnelAddr(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertPool) (string, error) {
 	// If TELEPORT_TUNNEL_PUBLIC_ADDR is set, nothing else has to be done, return it.
 	if tunnelAddr := os.Getenv(defaults.TunnelPublicAddrEnvar); tunnelAddr != "" {
 		return extractHostPort(tunnelAddr)
 	}
 
 	// Ping web proxy to retrieve tunnel proxy address.
-	pr, err := Find(cfg)
+	pr, err := Find(ctx, proxyAddr, insecure, nil)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
-	return tunnelAddr(cfg.ProxyAddr, pr.Proxy)
+	return tunnelAddr(proxyAddr, pr.Proxy)
 }
 
-func GetMOTD(cfg *Config) (*MotD, error) {
-	clt, err := newWebClient(cfg)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
+func GetMOTD(ctx context.Context, proxyAddr string, insecure bool, pool *x509.CertPool) (*MotD, error) {
+	clt := newWebClient(insecure, pool)
 	defer clt.CloseIdleConnections()
 
-	endpoint := fmt.Sprintf("https://%s/webapi/motd", cfg.ProxyAddr)
+	endpoint := fmt.Sprintf("https://%s/webapi/motd", proxyAddr)
 
-	req, err := http.NewRequestWithContext(cfg.Context, http.MethodGet, endpoint, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := doWithFallback(clt, cfg.Insecure, cfg.ExtraHeaders, req)
+	resp, err := clt.Do(req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/api/client/webclient/webclient_test.go b/api/client/webclient/webclient_test.go
index b908a9777a718..963b6b5f2156c 100644
--- a/api/client/webclient/webclient_test.go
+++ b/api/client/webclient/webclient_test.go
@@ -52,15 +52,14 @@ func TestPlainHttpFallback(t *testing.T) {
 			desc:    "Ping",
 			handler: newPingHandler("/webapi/ping"),
 			actionUnderTest: func(addr string, insecure bool) error {
-				_, err := Ping(
-					&Config{Context: context.Background(), ProxyAddr: addr, Insecure: insecure})
+				_, err := Ping(context.Background(), addr, insecure, nil /*pool*/, "")
 				return err
 			},
 		}, {
 			desc:    "Find",
 			handler: newPingHandler("/webapi/find"),
 			actionUnderTest: func(addr string, insecure bool) error {
-				_, err := Find(&Config{Context: context.Background(), ProxyAddr: addr, Insecure: insecure})
+				_, err := Find(context.Background(), addr, insecure, nil /*pool*/)
 				return err
 			},
 		},
@@ -105,7 +104,7 @@ func TestPlainHttpFallback(t *testing.T) {
 
 func TestGetTunnelAddr(t *testing.T) {
 	t.Setenv(defaults.TunnelPublicAddrEnvar, "tunnel.example.com:4024")
-	tunnelAddr, err := GetTunnelAddr(&Config{Context: context.Background(), ProxyAddr: "", Insecure: false})
+	tunnelAddr, err := GetTunnelAddr(context.Background(), "", true, nil)
 	require.NoError(t, err)
 	require.Equal(t, "tunnel.example.com:4024", tunnelAddr)
 }
@@ -293,33 +292,22 @@ func TestExtract(t *testing.T) {
 
 func TestNewWebClientRespectHTTPProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
-	client, err := newWebClient(&Config{
-		Context:   context.Background(),
-		ProxyAddr: "localhost:3080",
-	})
-	require.NoError(t, err)
+	client := newWebClient(false /* insecure */, nil /* pool */)
 	// resp should be nil, so there will be no body to close.
 	//nolint:bodyclose
-	resp, err := client.Get("https://fakedomain.example.com")
+	resp, err := client.Get("https://example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "lookup fakeproxy.example.com")
 	require.Contains(t, err.Error(), "no such host")
 }
 
 func TestNewWebClientNoProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
-	t.Setenv("NO_PROXY", "fakedomain.example.com")
-	client, err := newWebClient(&Config{
-		Context:   context.Background(),
-		ProxyAddr: "localhost:3080",
-	})
+	t.Setenv("NO_PROXY", "example.com")
+	client := newWebClient(false /* insecure */, nil /* pool */)
+	resp, err := client.Get("https://example.com")
 	require.NoError(t, err)
-	//nolint:bodyclose
-	resp, err := client.Get("https://fakedomain.example.com")
-	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
-	require.NotContains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "lookup fakedomain.example.com")
-	require.Contains(t, err.Error(), "no such host")
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
 }
diff --git a/api/go.mod b/api/go.mod
index 32f30b53bd167..3a7210c771f25 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -3,7 +3,7 @@ module github.com/gravitational/teleport/api
 go 1.15
 
 require (
-	github.com/gogo/protobuf v1.3.2
+	github.com/gogo/protobuf v1.3.1
 	github.com/golang/protobuf v1.4.3
 	github.com/google/go-cmp v0.5.4
 	github.com/gravitational/trace v1.1.17
diff --git a/api/go.sum b/api/go.sum
index e0d13feb2fd5c..72c1f18217730 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -21,8 +21,8 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
+github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -50,7 +50,7 @@ github.com/gravitational/trace v1.1.17/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jj
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
@@ -68,11 +68,8 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8 h1:kACShD3qhmr/3rLmg1yXyt+N4HcwutKyPRB93s54TIU=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
@@ -80,18 +77,13 @@ golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd h1:O7DYs+zxREGLKzKoMQrtrEacpb0ZVXA5rIwylE2Xchk=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -101,14 +93,11 @@ golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -119,20 +108,15 @@ golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9sn
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/api/identityfile/identityfile.go b/api/identityfile/identityfile.go
index 9f19ce811a91d..2f45f8cc6a749 100644
--- a/api/identityfile/identityfile.go
+++ b/api/identityfile/identityfile.go
@@ -24,6 +24,7 @@ import (
 	"crypto/x509"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"strings"
 
@@ -101,7 +102,7 @@ func Write(idFile *IdentityFile, path string) error {
 	if err := encodeIdentityFile(buf, idFile); err != nil {
 		return trace.Wrap(err)
 	}
-	if err := os.WriteFile(path, buf.Bytes(), FilePermissions); err != nil {
+	if err := ioutil.WriteFile(path, buf.Bytes(), FilePermissions); err != nil {
 		return trace.ConvertSystemError(err)
 	}
 	return nil
@@ -138,7 +139,7 @@ func ReadFile(path string) (*IdentityFile, error) {
 	// separate file with -cert.pub suffix.
 	if len(ident.Certs.SSH) == 0 {
 		certFn := keypaths.IdentitySSHCertPath(path)
-		if ident.Certs.SSH, err = os.ReadFile(certFn); err != nil {
+		if ident.Certs.SSH, err = ioutil.ReadFile(certFn); err != nil {
 			return nil, trace.Wrap(err, "could not find SSH cert in the identity file or %v", certFn)
 		}
 	}
diff --git a/api/profile/profile.go b/api/profile/profile.go
index 7b9b701d63c8b..ba63ce65d6517 100644
--- a/api/profile/profile.go
+++ b/api/profile/profile.go
@@ -21,6 +21,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"io/fs"
+	"io/ioutil"
 	"net"
 	"os"
 	"os/user"
@@ -117,7 +118,7 @@ func (p *Profile) TLSConfig() (*tls.Config, error) {
 		if info.IsDir() {
 			return nil
 		}
-		cert, err := os.ReadFile(path)
+		cert, err := ioutil.ReadFile(path)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
@@ -138,17 +139,23 @@ func (p *Profile) TLSConfig() (*tls.Config, error) {
 
 // SSHClientConfig returns the profile's associated SSHClientConfig.
 func (p *Profile) SSHClientConfig() (*ssh.ClientConfig, error) {
-	cert, err := os.ReadFile(p.SSHCertPath())
+	cert, err := ioutil.ReadFile(p.SSHCertPath())
 	if err != nil {
-		return nil, trace.Wrap(err)
+		// Try reading SSHCert from old cert path, return original error otherwise
+		// DELETE IN 8.0.0
+		var err2 error
+		cert, err2 = ioutil.ReadFile(p.OldSSHCertPath())
+		if err2 != nil {
+			return nil, trace.Wrap(err)
+		}
 	}
 
-	key, err := os.ReadFile(p.UserKeyPath())
+	key, err := ioutil.ReadFile(p.UserKeyPath())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	caCerts, err := os.ReadFile(p.KnownHostsPath())
+	caCerts, err := ioutil.ReadFile(p.KnownHostsPath())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -167,7 +174,7 @@ func SetCurrentProfileName(dir string, name string) error {
 	}
 
 	path := filepath.Join(dir, currentProfileFilename)
-	if err := os.WriteFile(path, []byte(strings.TrimSpace(name)+"\n"), 0660); err != nil {
+	if err := ioutil.WriteFile(path, []byte(strings.TrimSpace(name)+"\n"), 0660); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -179,7 +186,7 @@ func GetCurrentProfileName(dir string) (name string, err error) {
 		return "", trace.BadParameter("cannot get current profile: missing dir")
 	}
 
-	data, err := os.ReadFile(filepath.Join(dir, currentProfileFilename))
+	data, err := ioutil.ReadFile(filepath.Join(dir, currentProfileFilename))
 	if err != nil {
 		if os.IsNotExist(err) {
 			return "", trace.NotFound("current-profile is not set")
@@ -198,7 +205,7 @@ func ListProfileNames(dir string) ([]string, error) {
 	if dir == "" {
 		return nil, trace.BadParameter("cannot list profiles: missing dir")
 	}
-	files, err := os.ReadDir(dir)
+	files, err := ioutil.ReadDir(dir)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -208,8 +215,7 @@ func ListProfileNames(dir string) ([]string, error) {
 		if file.IsDir() {
 			continue
 		}
-
-		if file.Type()&os.ModeSymlink != 0 {
+		if file.Mode()&os.ModeSymlink != 0 {
 			continue
 		}
 		if !strings.HasSuffix(file.Name(), ".yaml") {
@@ -260,7 +266,7 @@ func FromDir(dir string, name string) (*Profile, error) {
 
 // profileFromFile loads the profile from a YAML file.
 func profileFromFile(filePath string) (*Profile, error) {
-	bytes, err := os.ReadFile(filePath)
+	bytes, err := ioutil.ReadFile(filePath)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
@@ -300,7 +306,7 @@ func (p *Profile) saveToFile(filepath string) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if err = os.WriteFile(filepath, bytes, 0660); err != nil {
+	if err = ioutil.WriteFile(filepath, bytes, 0660); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -346,6 +352,12 @@ func (p *Profile) SSHCertPath() string {
 	return keypaths.SSHCertPath(p.Dir, p.Name(), p.Username, p.SiteName)
 }
 
+// OldSSHCertPath returns the old (before v6.1) path to the profile's ssh certificate.
+// DELETE IN 8.0.0
+func (p *Profile) OldSSHCertPath() string {
+	return keypaths.OldSSHCertPath(p.Dir, p.Name(), p.Username)
+}
+
 // KnownHostsPath returns the path to the profile's ssh certificate authorities.
 func (p *Profile) KnownHostsPath() string {
 	return keypaths.KnownHostsPath(p.Dir)
diff --git a/api/types/app_test.go b/api/types/app_test.go
index 9b5b12d23c806..731edb7ffa1a2 100644
--- a/api/types/app_test.go
+++ b/api/types/app_test.go
@@ -141,6 +141,8 @@ func TestAppServerSorter(t *testing.T) {
 	for _, c := range cases {
 		c := c
 		t.Run(fmt.Sprintf("%s desc", c.name), func(t *testing.T) {
+			t.Parallel()
+
 			sortBy := SortBy{Field: c.fieldName, IsDesc: true}
 			servers := AppServers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
@@ -150,6 +152,8 @@ func TestAppServerSorter(t *testing.T) {
 		})
 
 		t.Run(fmt.Sprintf("%s asc", c.name), func(t *testing.T) {
+			t.Parallel()
+
 			sortBy := SortBy{Field: c.fieldName}
 			servers := AppServers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
diff --git a/api/types/appserver.go b/api/types/appserver.go
index aa5a96b43d2d4..10fb2bdea62db 100644
--- a/api/types/appserver.go
+++ b/api/types/appserver.go
@@ -304,14 +304,7 @@ func (s AppServers) Len() int { return len(s) }
 
 // Less compares app servers by name and host ID.
 func (s AppServers) Less(i, j int) bool {
-	switch {
-	case s[i].GetName() < s[j].GetName():
-		return true
-	case s[i].GetName() > s[j].GetName():
-		return false
-	default:
-		return s[i].GetHostID() < s[j].GetHostID()
-	}
+	return s[i].GetName() < s[j].GetName() && s[i].GetHostID() < s[j].GetHostID()
 }
 
 // Swap swaps two app servers.
diff --git a/api/types/constants.go b/api/types/constants.go
index 52a4d64210e98..54f00730c9906 100644
--- a/api/types/constants.go
+++ b/api/types/constants.go
@@ -297,13 +297,9 @@ const (
 )
 
 const (
-	// TeleportNamespace is used as the namespace prefix for any
-	// labels defined by teleport
-	TeleportNamespace = "teleport.dev"
-
 	// OriginLabel is a resource metadata label name used to identify a source
 	// that the resource originates from.
-	OriginLabel = TeleportNamespace + "/origin"
+	OriginLabel = "teleport.dev/origin"
 
 	// OriginConfigFile is an origin value indicating that the resource was
 	// constructed as a default value.
diff --git a/api/types/database.go b/api/types/database.go
index 39b94b4b96a6f..7e752b0412d40 100644
--- a/api/types/database.go
+++ b/api/types/database.go
@@ -563,6 +563,16 @@ func DeduplicateDatabases(databases []Database) (result []Database) {
 // Databases is a list of database resources.
 type Databases []Database
 
+// Find returns database with the specified name or nil.
+func (d Databases) Find(name string) Database {
+	for _, database := range d {
+		if database.GetName() == name {
+			return database
+		}
+	}
+	return nil
+}
+
 // ToMap returns these databases as a map keyed by database name.
 func (d Databases) ToMap() map[string]Database {
 	m := make(map[string]Database)
diff --git a/api/types/databaseserver.go b/api/types/databaseserver.go
index db2637513a3cc..4a4e6cfb0e6a4 100644
--- a/api/types/databaseserver.go
+++ b/api/types/databaseserver.go
@@ -291,14 +291,7 @@ func (s DatabaseServers) Len() int { return len(s) }
 
 // Less compares database servers by name and host ID.
 func (s DatabaseServers) Less(i, j int) bool {
-	switch {
-	case s[i].GetName() < s[j].GetName():
-		return true
-	case s[i].GetName() > s[j].GetName():
-		return false
-	default:
-		return s[i].GetHostID() < s[j].GetHostID()
-	}
+	return s[i].GetName() < s[j].GetName() && s[i].GetHostID() < s[j].GetHostID()
 }
 
 // Swap swaps two database servers.
diff --git a/api/types/databaseserver_test.go b/api/types/databaseserver_test.go
index de45c5c788df8..babd27ac9a0d7 100644
--- a/api/types/databaseserver_test.go
+++ b/api/types/databaseserver_test.go
@@ -154,6 +154,8 @@ func TestDatabaseServerSorter(t *testing.T) {
 	for _, c := range cases {
 		c := c
 		t.Run(fmt.Sprintf("%s desc", c.name), func(t *testing.T) {
+			t.Parallel()
+
 			sortBy := SortBy{Field: c.fieldName, IsDesc: true}
 			servers := DatabaseServers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
@@ -163,6 +165,8 @@ func TestDatabaseServerSorter(t *testing.T) {
 		})
 
 		t.Run(fmt.Sprintf("%s asc", c.name), func(t *testing.T) {
+			t.Parallel()
+
 			sortBy := SortBy{Field: c.fieldName}
 			servers := DatabaseServers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
diff --git a/api/types/desktop.go b/api/types/desktop.go
index 6fdda0b05fa75..6d2199711401a 100644
--- a/api/types/desktop.go
+++ b/api/types/desktop.go
@@ -17,8 +17,6 @@ limitations under the License.
 package types
 
 import (
-	"sort"
-
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/trace"
 )
@@ -31,8 +29,6 @@ type WindowsDesktopService interface {
 	GetAddr() string
 	// GetVersion returns the teleport binary version of this service.
 	GetTeleportVersion() string
-	// GetHostname returns the hostname of this service
-	GetHostname() string
 }
 
 var _ WindowsDesktopService = &WindowsDesktopServiceV3{}
@@ -99,11 +95,6 @@ func (s *WindowsDesktopServiceV3) GetAllLabels() map[string]string {
 	return s.Metadata.Labels
 }
 
-// GetHostname returns the windows hostname of this service.
-func (s *WindowsDesktopServiceV3) GetHostname() string {
-	return s.Spec.Hostname
-}
-
 // MatchSearch goes through select field values and tries to
 // match against the list of search values.
 func (s *WindowsDesktopServiceV3) MatchSearch(values []string) bool {
@@ -227,91 +218,3 @@ func (f *WindowsDesktopFilter) Match(req WindowsDesktop) bool {
 	}
 	return true
 }
-
-// WindowsDesktops represents a list of windows desktops.
-type WindowsDesktops []WindowsDesktop
-
-// Len returns the slice length.
-func (s WindowsDesktops) Len() int { return len(s) }
-
-// Less compares desktops by name and host ID.
-func (s WindowsDesktops) Less(i, j int) bool {
-	switch {
-	case s[i].GetName() < s[j].GetName():
-		return true
-	case s[i].GetName() > s[j].GetName():
-		return false
-	default:
-		return s[i].GetHostID() < s[j].GetHostID()
-	}
-}
-
-// Swap swaps two windows desktops.
-func (s WindowsDesktops) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
-
-// SortByCustom custom sorts by given sort criteria.
-func (s WindowsDesktops) SortByCustom(sortBy SortBy) error {
-	if sortBy.Field == "" {
-		return nil
-	}
-
-	isDesc := sortBy.IsDesc
-	switch sortBy.Field {
-	case ResourceMetadataName:
-		sort.SliceStable(s, func(i, j int) bool {
-			return stringCompare(s[i].GetName(), s[j].GetName(), isDesc)
-		})
-	case ResourceSpecAddr:
-		sort.SliceStable(s, func(i, j int) bool {
-			return stringCompare(s[i].GetAddr(), s[j].GetAddr(), isDesc)
-		})
-	default:
-		return trace.NotImplemented("sorting by field %q for resource %q is not supported", sortBy.Field, KindWindowsDesktop)
-	}
-
-	return nil
-}
-
-// AsResources returns windows desktops as type resources with labels.
-func (s WindowsDesktops) AsResources() []ResourceWithLabels {
-	resources := make([]ResourceWithLabels, 0, len(s))
-	for _, server := range s {
-		resources = append(resources, ResourceWithLabels(server))
-	}
-	return resources
-}
-
-// GetFieldVals returns list of select field values.
-func (s WindowsDesktops) GetFieldVals(field string) ([]string, error) {
-	vals := make([]string, 0, len(s))
-	switch field {
-	case ResourceMetadataName:
-		for _, server := range s {
-			vals = append(vals, server.GetName())
-		}
-	case ResourceSpecAddr:
-		for _, server := range s {
-			vals = append(vals, server.GetAddr())
-		}
-	default:
-		return nil, trace.NotImplemented("getting field %q for resource %q is not supported", field, KindWindowsDesktop)
-	}
-
-	return vals, nil
-}
-
-// ListWindowsDesktopsResponse is a response type to ListWindowsDesktops.
-type ListWindowsDesktopsResponse struct {
-	Desktops []WindowsDesktop
-	NextKey  string
-}
-
-// ListWindowsDesktopsRequest is a request type to ListWindowsDesktops.
-type ListWindowsDesktopsRequest struct {
-	WindowsDesktopFilter
-	Limit                         int
-	StartKey, PredicateExpression string
-	Labels                        map[string]string
-	SearchKeywords                []string
-	SortBy                        SortBy
-}
diff --git a/api/types/desktop_test.go b/api/types/desktop_test.go
deleted file mode 100644
index f17c480bd0685..0000000000000
--- a/api/types/desktop_test.go
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package types
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-)
-
-func TestWindowsDesktopsSorter(t *testing.T) {
-	t.Parallel()
-
-	testValsUnordered := []string{"d", "b", "a", "c"}
-
-	makeDesktops := func(testVals []string, testField string) []WindowsDesktop {
-		desktops := make([]WindowsDesktop, len(testVals))
-		for i := 0; i < len(testVals); i++ {
-			testVal := testVals[i]
-			var err error
-			desktops[i], err = NewWindowsDesktopV3(
-				getTestVal(testField == ResourceMetadataName, testVal),
-				nil,
-				WindowsDesktopSpecV3{
-					Addr: getTestVal(testField == ResourceSpecAddr, testVal),
-				})
-
-			require.NoError(t, err)
-		}
-		return desktops
-	}
-
-	cases := []struct {
-		name      string
-		fieldName string
-	}{
-		{
-			name:      "by name",
-			fieldName: ResourceMetadataName,
-		},
-		{
-			name:      "by addr",
-			fieldName: ResourceSpecAddr,
-		},
-	}
-
-	for _, c := range cases {
-		c := c
-		t.Run(fmt.Sprintf("%s desc", c.name), func(t *testing.T) {
-			sortBy := SortBy{Field: c.fieldName, IsDesc: true}
-			servers := WindowsDesktops(makeDesktops(testValsUnordered, c.fieldName))
-			require.NoError(t, servers.SortByCustom(sortBy))
-			targetVals, err := servers.GetFieldVals(c.fieldName)
-			require.NoError(t, err)
-			require.IsDecreasing(t, targetVals)
-		})
-
-		t.Run(fmt.Sprintf("%s asc", c.name), func(t *testing.T) {
-			sortBy := SortBy{Field: c.fieldName}
-			servers := WindowsDesktops(makeDesktops(testValsUnordered, c.fieldName))
-			require.NoError(t, servers.SortByCustom(sortBy))
-			targetVals, err := servers.GetFieldVals(c.fieldName)
-			require.NoError(t, err)
-			require.IsIncreasing(t, targetVals)
-		})
-	}
-
-	// Test error.
-	sortBy := SortBy{Field: "unsupported"}
-	desktops := makeDesktops(testValsUnordered, "does-not-matter")
-	require.True(t, trace.IsNotImplemented(WindowsDesktops(desktops).SortByCustom(sortBy)))
-}
diff --git a/api/types/events/events.pb.go b/api/types/events/events.pb.go
index 64cd82b30c814..423a29e72972f 100644
--- a/api/types/events/events.pb.go
+++ b/api/types/events/events.pb.go
@@ -3673,12 +3673,10 @@ type WindowsDesktopSessionStart struct {
 	// WindowsUser is the Windows username used to connect.
 	WindowsUser string `protobuf:"bytes,9,opt,name=WindowsUser,proto3" json:"windows_user"`
 	// DesktopLabels are the labels on the desktop resource.
-	DesktopLabels map[string]string `protobuf:"bytes,10,rep,name=DesktopLabels,proto3" json:"desktop_labels" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	// DesktopName is the name of the desktop resource.
-	DesktopName          string   `protobuf:"bytes,11,opt,name=DesktopName,proto3" json:"desktop_name"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	DesktopLabels        map[string]string `protobuf:"bytes,10,rep,name=DesktopLabels,proto3" json:"desktop_labels" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+	XXX_unrecognized     []byte            `json:"-"`
+	XXX_sizecache        int32             `json:"-"`
 }
 
 func (m *WindowsDesktopSessionStart) Reset()         { *m = WindowsDesktopSessionStart{} }
@@ -4378,54 +4376,6 @@ func (m *RenewableCertificateGenerationMismatch) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_RenewableCertificateGenerationMismatch proto.InternalMessageInfo
 
-// Unknown is a fallback event used when we don't recognize an event from the backend.
-type Unknown struct {
-	// Metadata is a common event metadata.
-	Metadata `protobuf:"bytes,1,opt,name=Metadata,proto3,embedded=Metadata" json:""`
-	// UnknownType is the event type extracted from the unknown event.
-	UnknownType string `protobuf:"bytes,2,opt,name=UnknownType,proto3" json:"unknown_event"`
-	// UnknownCode is the event code extracted from the unknown event.
-	UnknownCode string `protobuf:"bytes,3,opt,name=UnknownCode,proto3" json:"unknown_code,omitempty"`
-	// Data is the serialized JSON data of the unknown event.
-	Data                 string   `protobuf:"bytes,4,opt,name=Data,proto3" json:"data"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *Unknown) Reset()         { *m = Unknown{} }
-func (m *Unknown) String() string { return proto.CompactTextString(m) }
-func (*Unknown) ProtoMessage()    {}
-func (*Unknown) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{85}
-}
-func (m *Unknown) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *Unknown) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Unknown.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *Unknown) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Unknown.Merge(m, src)
-}
-func (m *Unknown) XXX_Size() int {
-	return m.Size()
-}
-func (m *Unknown) XXX_DiscardUnknown() {
-	xxx_messageInfo_Unknown.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Unknown proto.InternalMessageInfo
-
 // OneOf is a union of one of audit events submitted to the auth service
 type OneOf struct {
 	// Event is one of the audit events
@@ -4510,7 +4460,6 @@ type OneOf struct {
 	//	*OneOf_MySQLStatementFetch
 	//	*OneOf_MySQLStatementBulkExecute
 	//	*OneOf_RenewableCertificateGenerationMismatch
-	//	*OneOf_Unknown
 	Event                isOneOf_Event `protobuf_oneof:"Event"`
 	XXX_NoUnkeyedLiteral struct{}      `json:"-"`
 	XXX_unrecognized     []byte        `json:"-"`
@@ -4521,7 +4470,7 @@ func (m *OneOf) Reset()         { *m = OneOf{} }
 func (m *OneOf) String() string { return proto.CompactTextString(m) }
 func (*OneOf) ProtoMessage()    {}
 func (*OneOf) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{86}
+	return fileDescriptor_8f22242cb04491f9, []int{85}
 }
 func (m *OneOf) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -4793,9 +4742,6 @@ type OneOf_MySQLStatementBulkExecute struct {
 type OneOf_RenewableCertificateGenerationMismatch struct {
 	RenewableCertificateGenerationMismatch *RenewableCertificateGenerationMismatch `protobuf:"bytes,79,opt,name=RenewableCertificateGenerationMismatch,proto3,oneof" json:"RenewableCertificateGenerationMismatch,omitempty"`
 }
-type OneOf_Unknown struct {
-	Unknown *Unknown `protobuf:"bytes,80,opt,name=Unknown,proto3,oneof" json:"Unknown,omitempty"`
-}
 
 func (*OneOf_UserLogin) isOneOf_Event()                              {}
 func (*OneOf_UserCreate) isOneOf_Event()                             {}
@@ -4876,7 +4822,6 @@ func (*OneOf_MySQLStatementReset) isOneOf_Event()                    {}
 func (*OneOf_MySQLStatementFetch) isOneOf_Event()                    {}
 func (*OneOf_MySQLStatementBulkExecute) isOneOf_Event()              {}
 func (*OneOf_RenewableCertificateGenerationMismatch) isOneOf_Event() {}
-func (*OneOf_Unknown) isOneOf_Event()                                {}
 
 func (m *OneOf) GetEvent() isOneOf_Event {
 	if m != nil {
@@ -5438,13 +5383,6 @@ func (m *OneOf) GetRenewableCertificateGenerationMismatch() *RenewableCertificat
 	return nil
 }
 
-func (m *OneOf) GetUnknown() *Unknown {
-	if x, ok := m.GetEvent().(*OneOf_Unknown); ok {
-		return x.Unknown
-	}
-	return nil
-}
-
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*OneOf) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -5527,7 +5465,6 @@ func (*OneOf) XXX_OneofWrappers() []interface{} {
 		(*OneOf_MySQLStatementFetch)(nil),
 		(*OneOf_MySQLStatementBulkExecute)(nil),
 		(*OneOf_RenewableCertificateGenerationMismatch)(nil),
-		(*OneOf_Unknown)(nil),
 	}
 }
 
@@ -5548,7 +5485,7 @@ func (m *StreamStatus) Reset()         { *m = StreamStatus{} }
 func (m *StreamStatus) String() string { return proto.CompactTextString(m) }
 func (*StreamStatus) ProtoMessage()    {}
 func (*StreamStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{87}
+	return fileDescriptor_8f22242cb04491f9, []int{86}
 }
 func (m *StreamStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5596,7 +5533,7 @@ func (m *SessionUpload) Reset()         { *m = SessionUpload{} }
 func (m *SessionUpload) String() string { return proto.CompactTextString(m) }
 func (*SessionUpload) ProtoMessage()    {}
 func (*SessionUpload) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{88}
+	return fileDescriptor_8f22242cb04491f9, []int{87}
 }
 func (m *SessionUpload) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5691,7 +5628,7 @@ func (m *Identity) Reset()         { *m = Identity{} }
 func (m *Identity) String() string { return proto.CompactTextString(m) }
 func (*Identity) ProtoMessage()    {}
 func (*Identity) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{89}
+	return fileDescriptor_8f22242cb04491f9, []int{88}
 }
 func (m *Identity) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5741,7 +5678,7 @@ func (m *RouteToApp) Reset()         { *m = RouteToApp{} }
 func (m *RouteToApp) String() string { return proto.CompactTextString(m) }
 func (*RouteToApp) ProtoMessage()    {}
 func (*RouteToApp) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{90}
+	return fileDescriptor_8f22242cb04491f9, []int{89}
 }
 func (m *RouteToApp) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5789,7 +5726,7 @@ func (m *RouteToDatabase) Reset()         { *m = RouteToDatabase{} }
 func (m *RouteToDatabase) String() string { return proto.CompactTextString(m) }
 func (*RouteToDatabase) ProtoMessage()    {}
 func (*RouteToDatabase) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{91}
+	return fileDescriptor_8f22242cb04491f9, []int{90}
 }
 func (m *RouteToDatabase) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5840,7 +5777,7 @@ func (m *MySQLStatementPrepare) Reset()         { *m = MySQLStatementPrepare{} }
 func (m *MySQLStatementPrepare) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementPrepare) ProtoMessage()    {}
 func (*MySQLStatementPrepare) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{92}
+	return fileDescriptor_8f22242cb04491f9, []int{91}
 }
 func (m *MySQLStatementPrepare) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5893,7 +5830,7 @@ func (m *MySQLStatementExecute) Reset()         { *m = MySQLStatementExecute{} }
 func (m *MySQLStatementExecute) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementExecute) ProtoMessage()    {}
 func (*MySQLStatementExecute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{93}
+	return fileDescriptor_8f22242cb04491f9, []int{92}
 }
 func (m *MySQLStatementExecute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5948,7 +5885,7 @@ func (m *MySQLStatementSendLongData) Reset()         { *m = MySQLStatementSendLo
 func (m *MySQLStatementSendLongData) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementSendLongData) ProtoMessage()    {}
 func (*MySQLStatementSendLongData) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{94}
+	return fileDescriptor_8f22242cb04491f9, []int{93}
 }
 func (m *MySQLStatementSendLongData) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -5999,7 +5936,7 @@ func (m *MySQLStatementClose) Reset()         { *m = MySQLStatementClose{} }
 func (m *MySQLStatementClose) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementClose) ProtoMessage()    {}
 func (*MySQLStatementClose) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{95}
+	return fileDescriptor_8f22242cb04491f9, []int{94}
 }
 func (m *MySQLStatementClose) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6050,7 +5987,7 @@ func (m *MySQLStatementReset) Reset()         { *m = MySQLStatementReset{} }
 func (m *MySQLStatementReset) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementReset) ProtoMessage()    {}
 func (*MySQLStatementReset) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{96}
+	return fileDescriptor_8f22242cb04491f9, []int{95}
 }
 func (m *MySQLStatementReset) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6103,7 +6040,7 @@ func (m *MySQLStatementFetch) Reset()         { *m = MySQLStatementFetch{} }
 func (m *MySQLStatementFetch) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementFetch) ProtoMessage()    {}
 func (*MySQLStatementFetch) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{97}
+	return fileDescriptor_8f22242cb04491f9, []int{96}
 }
 func (m *MySQLStatementFetch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6156,7 +6093,7 @@ func (m *MySQLStatementBulkExecute) Reset()         { *m = MySQLStatementBulkExe
 func (m *MySQLStatementBulkExecute) String() string { return proto.CompactTextString(m) }
 func (*MySQLStatementBulkExecute) ProtoMessage()    {}
 func (*MySQLStatementBulkExecute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_8f22242cb04491f9, []int{98}
+	return fileDescriptor_8f22242cb04491f9, []int{97}
 }
 func (m *MySQLStatementBulkExecute) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -6278,7 +6215,6 @@ func init() {
 	proto.RegisterMapType((map[string]string)(nil), "events.WindowsDesktopSessionEnd.DesktopLabelsEntry")
 	proto.RegisterType((*CertificateCreate)(nil), "events.CertificateCreate")
 	proto.RegisterType((*RenewableCertificateGenerationMismatch)(nil), "events.RenewableCertificateGenerationMismatch")
-	proto.RegisterType((*Unknown)(nil), "events.Unknown")
 	proto.RegisterType((*OneOf)(nil), "events.OneOf")
 	proto.RegisterType((*StreamStatus)(nil), "events.StreamStatus")
 	proto.RegisterType((*SessionUpload)(nil), "events.SessionUpload")
@@ -6297,444 +6233,438 @@ func init() {
 func init() { proto.RegisterFile("events.proto", fileDescriptor_8f22242cb04491f9) }
 
 var fileDescriptor_8f22242cb04491f9 = []byte{
-	// 6991 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0x7d, 0x5d, 0x6c, 0x24, 0xd9,
-	0x55, 0xb0, 0xbb, 0xdb, 0xfd, 0xe3, 0xdb, 0xfe, 0xbd, 0xe3, 0xd9, 0xa9, 0x99, 0x9d, 0x9d, 0x9e,
-	0xad, 0x49, 0x66, 0x67, 0xb2, 0xb3, 0x76, 0xc6, 0x33, 0xbb, 0x93, 0x6c, 0x76, 0xb3, 0xd3, 0x6e,
-	0xdb, 0xeb, 0xce, 0x7a, 0x6c, 0xef, 0xb5, 0x67, 0x37, 0x52, 0x94, 0x6d, 0x95, 0xbb, 0xee, 0xd8,
-	0x95, 0xe9, 0xae, 0xaa, 0x54, 0x55, 0xdb, 0xe3, 0x7d, 0xfa, 0x7e, 0x10, 0x44, 0x51, 0x40, 0x28,
-	0x3c, 0x20, 0xc4, 0x43, 0x50, 0x00, 0x09, 0xa4, 0x88, 0x00, 0x42, 0x11, 0x12, 0xbc, 0x40, 0x00,
-	0x6d, 0x84, 0x12, 0x02, 0x41, 0x41, 0xe2, 0xa1, 0x03, 0x41, 0xbc, 0xb4, 0x40, 0x8a, 0x04, 0x12,
-	0x81, 0x27, 0x74, 0xcf, 0xbd, 0x55, 0x75, 0xeb, 0xa7, 0x3d, 0xe3, 0xb1, 0x17, 0xe3, 0x19, 0x3f,
-	0xd9, 0x7d, 0xfe, 0x6e, 0xd5, 0xb9, 0x7f, 0xe7, 0x9e, 0x7b, 0xce, 0x29, 0x34, 0x4c, 0xb7, 0xa9,
-	0xe9, 0xb9, 0x53, 0xb6, 0x63, 0x79, 0x16, 0x2e, 0xf0, 0x5f, 0xe7, 0x26, 0x37, 0xad, 0x4d, 0x0b,
-	0x40, 0xd3, 0xec, 0x3f, 0x8e, 0x3d, 0x57, 0xd9, 0xb4, 0xac, 0xcd, 0x16, 0x9d, 0x86, 0x5f, 0x1b,
-	0x9d, 0x7b, 0xd3, 0x9e, 0xd1, 0xa6, 0xae, 0xa7, 0xb5, 0x6d, 0x41, 0x70, 0x3e, 0x4e, 0xe0, 0x7a,
-	0x4e, 0xa7, 0xe9, 0x09, 0x6c, 0x6d, 0xd3, 0xf0, 0xb6, 0x3a, 0x1b, 0x53, 0x4d, 0xab, 0x3d, 0xbd,
-	0xe9, 0x68, 0xdb, 0x86, 0xa7, 0x79, 0x86, 0x65, 0x6a, 0xad, 0x69, 0x8f, 0xb6, 0xa8, 0x6d, 0x39,
-	0xde, 0xb4, 0x66, 0x1b, 0xd3, 0xde, 0xae, 0x4d, 0xdd, 0xe9, 0x1d, 0x47, 0xb3, 0x6d, 0xea, 0x84,
-	0xff, 0x70, 0x21, 0xea, 0x57, 0xb3, 0xa8, 0x74, 0x87, 0x7a, 0x9a, 0xae, 0x79, 0x1a, 0x3e, 0x8f,
-	0xf2, 0x75, 0x53, 0xa7, 0x0f, 0x94, 0xcc, 0xc5, 0xcc, 0x95, 0xdc, 0x6c, 0xa1, 0xd7, 0xad, 0x64,
-	0xa9, 0x41, 0x38, 0x10, 0x3f, 0x87, 0x06, 0xd7, 0x77, 0x6d, 0xaa, 0x64, 0x2f, 0x66, 0xae, 0x0c,
-	0xcd, 0x0e, 0xf5, 0xba, 0x95, 0x3c, 0xbc, 0x1e, 0x01, 0x30, 0x7e, 0x1e, 0x65, 0xeb, 0x73, 0x4a,
-	0x0e, 0x90, 0x13, 0xbd, 0x6e, 0x65, 0xa4, 0x63, 0xe8, 0xd7, 0xac, 0xb6, 0xe1, 0xd1, 0xb6, 0xed,
-	0xed, 0x92, 0x6c, 0x7d, 0x0e, 0x5f, 0x46, 0x83, 0x35, 0x4b, 0xa7, 0xca, 0x20, 0x10, 0xe1, 0x5e,
-	0xb7, 0x32, 0xda, 0xb4, 0x74, 0x2a, 0x51, 0x01, 0x1e, 0xdf, 0x46, 0x83, 0xeb, 0x46, 0x9b, 0x2a,
-	0xf9, 0x8b, 0x99, 0x2b, 0xe5, 0x99, 0x73, 0x53, 0x5c, 0x0d, 0x53, 0xbe, 0x1a, 0xa6, 0xd6, 0x7d,
-	0x3d, 0xcd, 0x8e, 0x7f, 0xd0, 0xad, 0x0c, 0xf4, 0xba, 0x95, 0x41, 0xa6, 0xba, 0x5f, 0xfc, 0x51,
-	0x25, 0x43, 0x80, 0x13, 0xbf, 0x86, 0xca, 0xb5, 0x56, 0xc7, 0xf5, 0xa8, 0xb3, 0xac, 0xb5, 0xa9,
-	0x52, 0x80, 0x06, 0xcf, 0xf5, 0xba, 0x95, 0x67, 0x9a, 0x1c, 0xdc, 0x30, 0xb5, 0xb6, 0xdc, 0xb0,
-	0x4c, 0xae, 0x7e, 0x01, 0x8d, 0xad, 0x51, 0xd7, 0x35, 0x2c, 0x33, 0x50, 0xcd, 0x47, 0xd1, 0x90,
-	0x00, 0xd5, 0xe7, 0x40, 0x3d, 0x43, 0xb3, 0xc5, 0x5e, 0xb7, 0x92, 0x73, 0x0d, 0x9d, 0x84, 0x18,
-	0xfc, 0x71, 0x54, 0x7c, 0xd7, 0xf0, 0xb6, 0xee, 0x2c, 0x54, 0x85, 0x9a, 0x9e, 0xe9, 0x75, 0x2b,
-	0x78, 0xc7, 0xf0, 0xb6, 0x1a, 0xed, 0x7b, 0x9a, 0xd4, 0x9e, 0x4f, 0xa6, 0xfe, 0x46, 0x16, 0x0d,
-	0xdf, 0x75, 0xa9, 0x13, 0xb4, 0x74, 0x19, 0x0d, 0xb2, 0xdf, 0xa2, 0x11, 0x50, 0x52, 0xc7, 0xa5,
-	0x8e, 0xac, 0x24, 0x86, 0xc7, 0x57, 0x51, 0x7e, 0xc9, 0xda, 0x34, 0x4c, 0xd1, 0xd0, 0xa9, 0x5e,
-	0xb7, 0x32, 0xd6, 0x62, 0x00, 0x89, 0x92, 0x53, 0xe0, 0x4f, 0xa3, 0xe1, 0x7a, 0x9b, 0x75, 0xba,
-	0x65, 0x6a, 0x9e, 0xe5, 0x88, 0x4e, 0x02, 0x75, 0x18, 0x12, 0x5c, 0x62, 0x8c, 0xd0, 0xe3, 0x57,
-	0x11, 0xaa, 0xbe, 0xbb, 0x46, 0xac, 0x16, 0xad, 0x92, 0x65, 0xd1, 0x7b, 0xc0, 0xad, 0xed, 0xb8,
-	0x0d, 0xc7, 0x6a, 0xd1, 0x86, 0xe6, 0xc8, 0xcd, 0x4a, 0xd4, 0x78, 0x1e, 0x8d, 0x56, 0x9b, 0x4d,
-	0xea, 0xba, 0x84, 0x7e, 0xb1, 0x43, 0x5d, 0xcf, 0x55, 0xf2, 0x17, 0x73, 0x57, 0x86, 0x66, 0x9f,
-	0xeb, 0x75, 0x2b, 0x67, 0x35, 0xc0, 0x34, 0x1c, 0x81, 0x92, 0x44, 0xc4, 0x98, 0xd4, 0xdf, 0xcd,
-	0xa1, 0xd1, 0x35, 0xea, 0x6c, 0x4b, 0x8a, 0xaa, 0xb2, 0x5e, 0x62, 0x10, 0xd6, 0x67, 0xae, 0xad,
-	0x35, 0xa9, 0xd0, 0xd9, 0x99, 0x5e, 0xb7, 0x72, 0xca, 0xf4, 0x81, 0x92, 0xd0, 0x38, 0x3d, 0xbe,
-	0x8a, 0x4a, 0x1c, 0x54, 0x9f, 0x13, 0x6a, 0x1c, 0xe9, 0x75, 0x2b, 0x43, 0x2e, 0xc0, 0x1a, 0x86,
-	0x4e, 0x02, 0x34, 0x7b, 0x0f, 0xfe, 0xff, 0xa2, 0xe5, 0x7a, 0x4c, 0xb8, 0xd0, 0x22, 0xbc, 0x87,
-	0x60, 0xd8, 0x12, 0x28, 0xf9, 0x3d, 0xa2, 0x4c, 0xf8, 0x93, 0x08, 0x71, 0x48, 0x55, 0xd7, 0x1d,
-	0xa1, 0xca, 0xb3, 0xbd, 0x6e, 0xe5, 0xb4, 0x10, 0xa1, 0xe9, 0xba, 0xdc, 0x0f, 0x12, 0x31, 0x6e,
-	0xa3, 0x61, 0xfe, 0x6b, 0x49, 0xdb, 0xa0, 0x2d, 0xae, 0xc7, 0xf2, 0xcc, 0x95, 0x29, 0xb1, 0xe2,
-	0x44, 0xb5, 0x33, 0x25, 0x93, 0xce, 0x9b, 0x9e, 0xb3, 0x3b, 0x5b, 0x11, 0x73, 0xe5, 0x8c, 0x68,
-	0xaa, 0x05, 0x38, 0xb9, 0xd3, 0x65, 0x9e, 0x73, 0x6f, 0xa0, 0x89, 0x84, 0x0c, 0x3c, 0x8e, 0x72,
-	0xf7, 0xe9, 0x2e, 0xd7, 0x33, 0x61, 0xff, 0xe2, 0x49, 0x94, 0xdf, 0xd6, 0x5a, 0x1d, 0xb1, 0x2c,
-	0x10, 0xfe, 0xe3, 0xd5, 0xec, 0x27, 0x32, 0xea, 0x1f, 0x66, 0x10, 0xae, 0x59, 0xa6, 0x49, 0x9b,
-	0x9e, 0x3c, 0x93, 0x5e, 0x41, 0x43, 0x4b, 0x56, 0x53, 0x6b, 0x81, 0x02, 0x78, 0x87, 0x29, 0xbd,
-	0x6e, 0x65, 0x92, 0xbd, 0xf9, 0x54, 0x8b, 0x61, 0xa4, 0x47, 0x0a, 0x49, 0x99, 0xe6, 0x08, 0x6d,
-	0x5b, 0x1e, 0x05, 0xc6, 0x6c, 0xa8, 0x39, 0x60, 0x74, 0x00, 0x25, 0x6b, 0x2e, 0x24, 0xc6, 0xd3,
-	0xa8, 0xb4, 0xca, 0xd6, 0x8e, 0xa6, 0xd5, 0x12, 0xbd, 0x06, 0xb3, 0x05, 0xd6, 0x13, 0x89, 0x25,
-	0x20, 0x52, 0xff, 0x5f, 0x16, 0x9d, 0x7d, 0xab, 0xb3, 0x41, 0x1d, 0x93, 0x7a, 0xd4, 0x15, 0x4b,
-	0x43, 0xf0, 0x06, 0xcb, 0x68, 0x22, 0x81, 0x14, 0x6f, 0x72, 0xb1, 0xd7, 0xad, 0x9c, 0xbf, 0x1f,
-	0x20, 0x1b, 0x62, 0xb5, 0x91, 0x1a, 0x49, 0xb2, 0xe2, 0x45, 0x34, 0x16, 0x02, 0xd9, 0xdc, 0x76,
-	0x95, 0x2c, 0xcc, 0x91, 0x0b, 0xbd, 0x6e, 0xe5, 0x9c, 0x24, 0x8d, 0xad, 0x03, 0x72, 0x87, 0xc5,
-	0xd9, 0xf0, 0x5b, 0x68, 0x3c, 0x04, 0xbd, 0xe9, 0x58, 0x1d, 0xdb, 0x55, 0x72, 0x20, 0xaa, 0xd2,
-	0xeb, 0x56, 0x9e, 0x95, 0x44, 0x6d, 0x02, 0x52, 0x92, 0x95, 0x60, 0x54, 0xff, 0x39, 0x87, 0x4e,
-	0x87, 0xc0, 0x55, 0x4b, 0x0f, 0x14, 0xb0, 0x22, 0x2b, 0x60, 0xd5, 0xd2, 0x61, 0x8d, 0xe5, 0x0a,
-	0x78, 0xbe, 0xd7, 0xad, 0x3c, 0x27, 0xb5, 0x63, 0x5b, 0x7a, 0x7c, 0xa9, 0x4d, 0xf2, 0xe2, 0xf7,
-	0xd0, 0x33, 0x09, 0x20, 0x9f, 0xd1, 0xbc, 0x9f, 0x2f, 0xf7, 0xba, 0x15, 0x35, 0x45, 0x6a, 0x7c,
-	0x82, 0xf7, 0x91, 0x82, 0x35, 0x74, 0x46, 0x52, 0xbb, 0x65, 0x7a, 0x9a, 0x61, 0x8a, 0xad, 0x81,
-	0x8f, 0x87, 0x17, 0x7a, 0xdd, 0xca, 0x25, 0xb9, 0xdf, 0x7c, 0x9a, 0xf8, 0xc3, 0xf7, 0x93, 0x83,
-	0x75, 0xa4, 0xa4, 0xa0, 0xea, 0x6d, 0x6d, 0xd3, 0xdf, 0xef, 0xae, 0xf4, 0xba, 0x95, 0x8f, 0xa4,
-	0xb6, 0x61, 0x30, 0x2a, 0xa9, 0x91, 0xbe, 0x92, 0x30, 0x41, 0x38, 0xc4, 0x2d, 0x5b, 0x3a, 0x85,
-	0x77, 0xc8, 0x83, 0x7c, 0xb5, 0xd7, 0xad, 0x5c, 0x90, 0xe4, 0x9b, 0x96, 0x4e, 0xe3, 0x8f, 0x9f,
-	0xc2, 0xad, 0xfe, 0x28, 0xcf, 0x16, 0x16, 0xd8, 0xc1, 0xd6, 0x3c, 0xcd, 0xf1, 0xf0, 0xab, 0xa1,
-	0x49, 0x00, 0xbd, 0x5a, 0x9e, 0x19, 0xf7, 0x17, 0x19, 0x1f, 0x3e, 0x3b, 0xcc, 0x16, 0x93, 0xef,
-	0x77, 0x2b, 0x99, 0x5e, 0xb7, 0x32, 0x40, 0x4a, 0xd2, 0xec, 0xe6, 0xbb, 0x57, 0x16, 0xf8, 0x26,
-	0x7d, 0x3e, 0x79, 0x87, 0x8b, 0xf1, 0xf2, 0xdd, 0xec, 0x0d, 0x54, 0x14, 0xcf, 0x00, 0x3d, 0x52,
-	0x9e, 0x39, 0x13, 0xae, 0x6b, 0x91, 0x9d, 0x38, 0xc6, 0xed, 0x73, 0xe1, 0xd7, 0x50, 0x81, 0x2f,
-	0x57, 0xa0, 0xed, 0xf2, 0xcc, 0x33, 0xe9, 0xeb, 0x62, 0x8c, 0x5d, 0xf0, 0xe0, 0x45, 0x84, 0xc2,
-	0xa5, 0x2a, 0xb0, 0x3b, 0x84, 0x84, 0xe4, 0x22, 0x16, 0x93, 0x22, 0xf1, 0xe2, 0x57, 0xd0, 0xf0,
-	0x3a, 0x75, 0xda, 0x86, 0xa9, 0xb5, 0xd6, 0x8c, 0xf7, 0x7d, 0xd3, 0x03, 0xb6, 0x71, 0xd7, 0x78,
-	0x5f, 0xee, 0x8b, 0x08, 0x1d, 0xfe, 0x7c, 0xda, 0xa2, 0x52, 0x84, 0x07, 0x79, 0xde, 0x7f, 0x90,
-	0xbe, 0x4b, 0x52, 0xec, 0x79, 0x52, 0xd6, 0x98, 0xb7, 0xd1, 0x48, 0x64, 0x6e, 0x28, 0x25, 0x10,
-	0xfd, 0x5c, 0x52, 0xb4, 0x34, 0xd1, 0x63, 0x62, 0xa3, 0x12, 0xd8, 0x8e, 0x58, 0x37, 0x0d, 0xcf,
-	0xd0, 0x5a, 0x35, 0xab, 0xdd, 0xd6, 0x4c, 0x5d, 0x19, 0x0a, 0x77, 0x76, 0x83, 0x63, 0x1a, 0x4d,
-	0x8e, 0x92, 0x77, 0xc4, 0x28, 0x13, 0x5b, 0xb3, 0x44, 0x1f, 0x12, 0xda, 0xb4, 0x1c, 0xdd, 0x30,
-	0x37, 0x15, 0x04, 0x4a, 0x83, 0x35, 0xcb, 0xe5, 0xb8, 0x86, 0xe3, 0x23, 0xe5, 0x35, 0x2b, 0xce,
-	0xf8, 0x99, 0xc1, 0x52, 0x79, 0x7c, 0x38, 0x61, 0x3c, 0xfc, 0x76, 0x0e, 0x95, 0x05, 0xe9, 0x67,
-	0x2c, 0xc3, 0x3c, 0x19, 0xe0, 0x07, 0x19, 0xe0, 0xa9, 0x03, 0xb5, 0x70, 0x58, 0x03, 0x55, 0xfd,
-	0x4a, 0x36, 0x58, 0x8d, 0x56, 0x1d, 0xc3, 0x3c, 0xd8, 0x6a, 0x74, 0x19, 0xa1, 0xda, 0x56, 0xc7,
-	0xbc, 0xcf, 0x4f, 0x35, 0xd9, 0xf0, 0x54, 0xd3, 0x34, 0x88, 0x84, 0x61, 0x47, 0x9b, 0x39, 0x26,
-	0x9f, 0xf5, 0xcc, 0xf0, 0xec, 0xd0, 0x07, 0x5c, 0x52, 0xe6, 0x25, 0x02, 0x60, 0x5c, 0x41, 0xf9,
-	0xd9, 0x5d, 0x8f, 0xba, 0xa0, 0xf9, 0x1c, 0x3f, 0xfa, 0x6c, 0x30, 0x00, 0xe1, 0x70, 0x7c, 0x13,
-	0x4d, 0xcc, 0xd1, 0x96, 0xb6, 0x7b, 0xc7, 0x68, 0xb5, 0x0c, 0x97, 0x36, 0x2d, 0x53, 0x77, 0x41,
-	0xc9, 0xa2, 0xb9, 0xb6, 0x4b, 0x92, 0x04, 0x58, 0x45, 0x85, 0x95, 0x7b, 0xf7, 0x5c, 0xea, 0x81,
-	0xfa, 0x72, 0xb3, 0xa8, 0xd7, 0xad, 0x14, 0x2c, 0x80, 0x10, 0x81, 0x51, 0xbf, 0x99, 0x41, 0xe3,
-	0x73, 0xd4, 0xbd, 0xef, 0x59, 0x76, 0x30, 0xca, 0x0f, 0xa4, 0x92, 0xab, 0xa8, 0x78, 0x87, 0xba,
-	0x2e, 0xdb, 0x96, 0xb2, 0xf0, 0xb6, 0x63, 0xe2, 0x6d, 0x8b, 0x6d, 0x0e, 0x26, 0x3e, 0x3e, 0xfd,
-	0xad, 0x72, 0x0f, 0x79, 0x2b, 0xf5, 0x27, 0x59, 0x74, 0x46, 0x3c, 0x71, 0xad, 0x65, 0xd8, 0x1b,
-	0x96, 0xe6, 0xe8, 0x84, 0x36, 0xa9, 0xb1, 0x4d, 0x8f, 0xe7, 0xc4, 0x8b, 0x4e, 0x9d, 0xc1, 0x03,
-	0x4c, 0x9d, 0x19, 0x54, 0x16, 0x9a, 0x01, 0x1b, 0x96, 0x6f, 0xdb, 0xe3, 0xbd, 0x6e, 0x65, 0x58,
-	0xe7, 0x60, 0x30, 0xff, 0x89, 0x4c, 0xc4, 0x06, 0xc9, 0x12, 0x35, 0x37, 0xbd, 0x2d, 0x18, 0x24,
-	0x79, 0x3e, 0x48, 0x5a, 0x00, 0x21, 0x02, 0xa3, 0xfe, 0x6b, 0x16, 0x4d, 0xc6, 0x55, 0xbe, 0x46,
-	0x4d, 0xfd, 0x44, 0xdf, 0x1f, 0x8e, 0xbe, 0xff, 0x26, 0x8b, 0x46, 0x82, 0xad, 0xe7, 0x0b, 0xb4,
-	0x79, 0x34, 0x26, 0x53, 0xb8, 0x21, 0xe4, 0x0e, 0xbc, 0x21, 0x1c, 0x44, 0xcb, 0x2a, 0x2a, 0x10,
-	0xaa, 0xb9, 0x62, 0x5b, 0x19, 0xe2, 0x1a, 0x73, 0x00, 0x42, 0x04, 0x06, 0x3f, 0x8f, 0x8a, 0x77,
-	0xb4, 0x07, 0x46, 0xbb, 0xd3, 0x16, 0x6b, 0x1d, 0x38, 0x4f, 0xda, 0xda, 0x03, 0xe2, 0xc3, 0xd5,
-	0xbf, 0xcd, 0xb0, 0x13, 0x36, 0x28, 0x55, 0x08, 0x3f, 0x90, 0x56, 0x43, 0xed, 0x64, 0x0f, 0xac,
-	0x9d, 0xdc, 0xe3, 0x6b, 0x47, 0xfd, 0xe6, 0x20, 0x53, 0x0f, 0x33, 0xfd, 0x9e, 0xf6, 0xd9, 0x18,
-	0xf6, 0x48, 0xfe, 0x31, 0x7a, 0xe4, 0xa9, 0xb1, 0xab, 0xd5, 0xff, 0x28, 0x22, 0x24, 0xb4, 0x3f,
-	0x7f, 0xb2, 0x86, 0x1f, 0x6c, 0xd4, 0xcc, 0xa1, 0x89, 0x79, 0x73, 0x4b, 0x33, 0x9b, 0x54, 0x0f,
-	0x4f, 0x17, 0x6c, 0xe8, 0x94, 0xb8, 0x67, 0x96, 0x0a, 0x64, 0x78, 0xbc, 0x20, 0x49, 0x06, 0x7c,
-	0x1d, 0x95, 0xeb, 0xa6, 0x47, 0x1d, 0xad, 0xe9, 0x19, 0xdb, 0x14, 0x46, 0x4f, 0x69, 0x76, 0xac,
-	0xd7, 0xad, 0x94, 0x8d, 0x10, 0x4c, 0x64, 0x1a, 0x7c, 0x13, 0x0d, 0xaf, 0x6a, 0x8e, 0x67, 0x34,
-	0x0d, 0x5b, 0x33, 0x3d, 0x57, 0x29, 0xc1, 0xd1, 0x08, 0xf6, 0x1e, 0x5b, 0x82, 0x93, 0x08, 0x15,
-	0xfe, 0x3c, 0x1a, 0x82, 0x23, 0x38, 0x78, 0xbf, 0x87, 0x1e, 0xea, 0xfd, 0xbe, 0x14, 0x7a, 0xf4,
-	0xf8, 0x21, 0xc9, 0x65, 0xcc, 0xe1, 0x54, 0x00, 0x87, 0x78, 0x28, 0x11, 0x7f, 0x16, 0x15, 0xe7,
-	0x4d, 0x1d, 0x84, 0xa3, 0x87, 0x0a, 0x57, 0x85, 0xf0, 0x67, 0x42, 0xe1, 0x96, 0x1d, 0x93, 0xed,
-	0x8b, 0x4b, 0x9f, 0x65, 0xe5, 0x0f, 0x6f, 0x96, 0x0d, 0x7f, 0x08, 0xa7, 0xd7, 0x91, 0xc3, 0x3a,
-	0xbd, 0x8e, 0x3e, 0xe6, 0xe9, 0x55, 0x7d, 0x1f, 0x95, 0x67, 0x57, 0x17, 0x82, 0xd9, 0x7b, 0x16,
-	0xe5, 0x56, 0xc5, 0x6d, 0xc3, 0x20, 0xdf, 0x30, 0x6d, 0x43, 0x27, 0x0c, 0x86, 0xaf, 0xa2, 0x52,
-	0x0d, 0x5c, 0x78, 0xc2, 0x71, 0x3d, 0xc8, 0x1d, 0xd7, 0x4d, 0x80, 0x81, 0xe3, 0xda, 0x47, 0xe3,
-	0x8f, 0xa2, 0xe2, 0xaa, 0x63, 0x6d, 0x3a, 0x5a, 0x5b, 0xf8, 0xba, 0xca, 0xcc, 0xd8, 0xb7, 0x39,
-	0x88, 0xf8, 0x38, 0xf5, 0x97, 0x32, 0xa8, 0xb0, 0xe6, 0x69, 0x5e, 0xc7, 0x65, 0x1c, 0x6b, 0x1d,
-	0x38, 0x41, 0x43, 0xdb, 0x25, 0xce, 0xe1, 0x72, 0x10, 0xf1, 0x71, 0xf8, 0x2a, 0xca, 0xcf, 0x3b,
-	0x8e, 0xe5, 0xc8, 0x17, 0x10, 0x94, 0x01, 0xe4, 0x0b, 0x08, 0xa0, 0xc0, 0xb7, 0x50, 0x99, 0xaf,
-	0x39, 0xfc, 0xe0, 0xc1, 0x9f, 0xe3, 0x74, 0xaf, 0x5b, 0x99, 0x10, 0x87, 0x0e, 0xf9, 0x26, 0x46,
-	0xa2, 0x54, 0xbf, 0x9d, 0x93, 0x8c, 0x02, 0xae, 0xf1, 0xa7, 0xf0, 0xf0, 0x7e, 0x03, 0xe5, 0x66,
-	0x57, 0x17, 0xc4, 0x02, 0x78, 0xca, 0x67, 0x95, 0x86, 0x4a, 0x8c, 0x8f, 0x51, 0xe3, 0xf3, 0x68,
-	0x70, 0x95, 0x0d, 0x9f, 0x02, 0x0c, 0x8f, 0x52, 0xaf, 0x5b, 0x19, 0xb4, 0xd9, 0xf8, 0x01, 0x28,
-	0x60, 0x35, 0x6f, 0x0b, 0xd6, 0xb2, 0x21, 0x81, 0xd5, 0xbc, 0x2d, 0x02, 0x50, 0x86, 0xad, 0x3a,
-	0x9b, 0xdb, 0x62, 0xd5, 0x02, 0xac, 0xe6, 0x6c, 0x6e, 0x13, 0x80, 0xe2, 0x69, 0x84, 0x08, 0xf5,
-	0x3a, 0x8e, 0x09, 0x97, 0x79, 0x43, 0x60, 0x26, 0xc3, 0x6a, 0xe8, 0x00, 0xb4, 0xd1, 0xb4, 0x74,
-	0x4a, 0x24, 0x12, 0xf5, 0x37, 0x43, 0xff, 0xcb, 0x9c, 0xe1, 0xde, 0x3f, 0xe9, 0xc2, 0x7d, 0x74,
-	0xa1, 0x26, 0x4e, 0x22, 0xc9, 0x4e, 0xaa, 0xa0, 0xfc, 0x42, 0x4b, 0xdb, 0x74, 0xa1, 0x0f, 0xf3,
-	0xdc, 0x2b, 0x71, 0x8f, 0x01, 0x08, 0x87, 0xc7, 0xfa, 0xa9, 0xf4, 0xf0, 0x7e, 0xfa, 0xe5, 0x7c,
-	0x30, 0xdb, 0x96, 0xa9, 0xb7, 0x63, 0x39, 0x27, 0x5d, 0xf5, 0xa8, 0x5d, 0x75, 0x19, 0x15, 0xd7,
-	0x9c, 0x26, 0x1c, 0x33, 0x79, 0x6f, 0x0d, 0xf7, 0xba, 0x95, 0x92, 0xeb, 0x34, 0xf9, 0x11, 0xd3,
-	0x47, 0x32, 0xba, 0x39, 0xd7, 0x03, 0xba, 0x62, 0x48, 0xa7, 0xbb, 0x9e, 0xa0, 0x13, 0x48, 0x41,
-	0xb7, 0x6a, 0x39, 0x9e, 0xe8, 0xb8, 0x80, 0xce, 0xb6, 0x1c, 0x8f, 0xf8, 0x48, 0xfc, 0x22, 0x42,
-	0xeb, 0xb5, 0xd5, 0x77, 0xa8, 0x03, 0xea, 0xe2, 0x73, 0x11, 0x96, 0xeb, 0x6d, 0x0e, 0x22, 0x12,
-	0x1a, 0xaf, 0xa3, 0xa1, 0x15, 0x9b, 0x3a, 0x10, 0x26, 0x00, 0x16, 0xc0, 0xe8, 0xcc, 0x0b, 0x31,
-	0xd5, 0x8a, 0x7e, 0x9f, 0x12, 0x7f, 0x03, 0x72, 0xbe, 0xbf, 0x58, 0xfe, 0x4f, 0x12, 0x0a, 0xc2,
-	0xb7, 0x50, 0xa1, 0xca, 0xed, 0xbc, 0x32, 0x88, 0x0c, 0x54, 0x36, 0xcf, 0xfe, 0x70, 0x14, 0x3f,
-	0x14, 0x6a, 0xf0, 0x3f, 0x11, 0xe4, 0xea, 0x55, 0x34, 0x1e, 0x6f, 0x06, 0x97, 0x51, 0xb1, 0xb6,
-	0xb2, 0xbc, 0x3c, 0x5f, 0x5b, 0x1f, 0x1f, 0xc0, 0x25, 0x34, 0xb8, 0x36, 0xbf, 0x3c, 0x37, 0x9e,
-	0x51, 0xbf, 0x21, 0xad, 0x20, 0x6c, 0x68, 0x9d, 0x78, 0x70, 0x0f, 0xe4, 0x16, 0x19, 0x07, 0xb7,
-	0xe5, 0xba, 0xa3, 0x99, 0x6e, 0xdb, 0xf0, 0x3c, 0xaa, 0x8b, 0x5d, 0x02, 0xdc, 0x7a, 0xde, 0x03,
-	0x92, 0xc0, 0xe3, 0x6b, 0x68, 0x04, 0x60, 0xc2, 0x93, 0xa7, 0xc3, 0xe8, 0x15, 0x0c, 0xce, 0x03,
-	0x12, 0x45, 0xaa, 0x7f, 0x19, 0x3a, 0x71, 0x97, 0xa8, 0x76, 0x5c, 0x1d, 0x7f, 0xff, 0x4b, 0xfa,
-	0x4b, 0xfd, 0xf5, 0x1c, 0x1a, 0x62, 0x6f, 0xc4, 0x83, 0x39, 0x8e, 0x42, 0x95, 0x37, 0x7d, 0xdb,
-	0x50, 0x68, 0x72, 0x34, 0xd0, 0x04, 0x40, 0x13, 0x1a, 0xe0, 0x76, 0xe4, 0x35, 0x54, 0xb8, 0x43,
-	0xbd, 0x2d, 0x4b, 0x17, 0x17, 0xa0, 0x93, 0xbd, 0x6e, 0x65, 0xbc, 0x0d, 0x10, 0xc9, 0xde, 0x13,
-	0x34, 0xf8, 0x3e, 0xc2, 0x75, 0x9d, 0x9a, 0x9e, 0xe1, 0xed, 0x56, 0x3d, 0xcf, 0x31, 0x36, 0x3a,
-	0x1e, 0x75, 0x85, 0xde, 0xce, 0x24, 0xce, 0x29, 0x6b, 0x10, 0x09, 0x05, 0x77, 0x9e, 0x93, 0x5a,
-	0x40, 0x1e, 0x8a, 0xfd, 0xaf, 0x6e, 0xa5, 0xc0, 0x69, 0x48, 0x8a, 0x58, 0xfc, 0x36, 0x1a, 0xba,
-	0xb3, 0x50, 0x9d, 0xa3, 0xdb, 0x46, 0x93, 0x8a, 0xcb, 0x8b, 0xb3, 0x81, 0x16, 0x7d, 0x44, 0xa0,
-	0x12, 0x88, 0x4f, 0x68, 0xdf, 0xd3, 0x1a, 0x3a, 0xc0, 0xe5, 0xf8, 0x84, 0x80, 0x58, 0xfd, 0x97,
-	0x0c, 0x1a, 0x27, 0xd4, 0xb5, 0x3a, 0x4e, 0xc8, 0x89, 0x2f, 0xa3, 0x41, 0xe9, 0x72, 0x1c, 0xbc,
-	0x15, 0xb1, 0x1b, 0x59, 0xc0, 0xe3, 0x35, 0x54, 0x9c, 0x7f, 0x60, 0x1b, 0x0e, 0x75, 0x45, 0xdf,
-	0xec, 0x75, 0x32, 0x7b, 0x4e, 0x9c, 0xcc, 0x26, 0x28, 0x67, 0x49, 0x1c, 0xca, 0x38, 0x18, 0xbf,
-	0x82, 0x86, 0xee, 0xda, 0xba, 0xe6, 0x51, 0x7d, 0x76, 0x57, 0xd8, 0xdc, 0xf0, 0x26, 0x1d, 0x0e,
-	0x6c, 0x6c, 0xec, 0xca, 0x6f, 0x12, 0x90, 0xe2, 0x4b, 0x28, 0xb7, 0xbe, 0xbe, 0x24, 0x3a, 0x0d,
-	0x42, 0xb9, 0x3c, 0x4f, 0x0e, 0xca, 0x60, 0x58, 0xf5, 0xab, 0x59, 0x84, 0xd8, 0xd8, 0xa8, 0x39,
-	0x54, 0xf3, 0x8e, 0x66, 0x82, 0xcf, 0xa2, 0x92, 0xaf, 0x70, 0x31, 0x2e, 0x15, 0x9f, 0x37, 0xde,
-	0x11, 0xf1, 0xb6, 0x7d, 0x3c, 0x33, 0xa2, 0x88, 0xd5, 0x82, 0xab, 0x9d, 0x9c, 0x1f, 0xd5, 0xe6,
-	0x30, 0x00, 0xe1, 0x70, 0xfc, 0x22, 0x1a, 0x12, 0x53, 0xd1, 0xf2, 0x3d, 0xc8, 0xfc, 0xa8, 0xe5,
-	0x03, 0x49, 0x88, 0x57, 0xff, 0x2c, 0xc3, 0x95, 0x32, 0x47, 0x5b, 0xf4, 0xf8, 0x2a, 0x45, 0xfd,
-	0x52, 0x06, 0x61, 0x26, 0x6c, 0x55, 0x73, 0xdd, 0x1d, 0xcb, 0xd1, 0x6b, 0x5b, 0x9a, 0xb9, 0x79,
-	0x24, 0xaf, 0xa3, 0x7e, 0x39, 0x8f, 0x4e, 0x45, 0x6e, 0x73, 0x8f, 0xf9, 0x78, 0xbb, 0x1a, 0x1d,
-	0x6f, 0x70, 0x68, 0x86, 0xf1, 0x26, 0x1f, 0x9a, 0xf9, 0xc8, 0xfb, 0x08, 0x1a, 0x12, 0xef, 0x5c,
-	0x9f, 0x13, 0x23, 0x0f, 0xb6, 0x5b, 0x43, 0x27, 0x21, 0x02, 0xbf, 0x84, 0x86, 0xc5, 0x0f, 0xb6,
-	0xea, 0xfa, 0x7e, 0x51, 0x18, 0xc7, 0x2e, 0x03, 0x90, 0x08, 0x1a, 0xbf, 0x8c, 0x86, 0xd8, 0xe0,
-	0xdc, 0x84, 0x38, 0xc0, 0x62, 0x18, 0x2e, 0xa7, 0xfb, 0x40, 0x79, 0x49, 0x08, 0x28, 0xd9, 0x52,
-	0x2e, 0x7c, 0xfc, 0xa5, 0x70, 0x29, 0xe7, 0x3e, 0x7e, 0x79, 0x29, 0x17, 0xde, 0xfe, 0xf7, 0x50,
-	0xb9, 0x6a, 0x9a, 0x16, 0x8f, 0x47, 0x75, 0x85, 0x23, 0xab, 0xef, 0x1a, 0x7e, 0x09, 0x82, 0xb8,
-	0x42, 0xfa, 0xd4, 0x45, 0x5c, 0x16, 0x88, 0x67, 0x58, 0x47, 0x6c, 0x1b, 0x74, 0x87, 0x3a, 0x22,
-	0x54, 0x00, 0x9c, 0x79, 0x8e, 0x80, 0xc9, 0x21, 0x5d, 0x3e, 0x1d, 0x9e, 0x45, 0x23, 0xab, 0x8e,
-	0x65, 0x5b, 0x2e, 0xd5, 0xb9, 0xa2, 0xca, 0xc0, 0x78, 0xbe, 0xd7, 0xad, 0x28, 0xb6, 0x40, 0x34,
-	0x40, 0x63, 0x12, 0x7b, 0x94, 0x45, 0xfd, 0x66, 0x26, 0x36, 0x18, 0x8f, 0x70, 0x9e, 0x47, 0x46,
-	0x47, 0xae, 0xcf, 0xe8, 0x50, 0xbf, 0x96, 0x45, 0x65, 0x76, 0x4e, 0x58, 0xb0, 0x9c, 0x1d, 0xcd,
-	0x39, 0x1a, 0xe7, 0xc9, 0xa1, 0xdd, 0xa5, 0x48, 0x66, 0xc8, 0xe0, 0x3e, 0xcc, 0x90, 0xf3, 0x68,
-	0x50, 0xba, 0xfe, 0xe3, 0xce, 0x0c, 0x76, 0xd6, 0x02, 0xa8, 0xfa, 0x7f, 0xb2, 0x08, 0x7d, 0xf6,
-	0xfa, 0xf5, 0xa7, 0x58, 0x41, 0xea, 0xaf, 0x66, 0xd0, 0x98, 0xf0, 0xae, 0x49, 0xf1, 0xce, 0x45,
-	0xdf, 0x2f, 0x9a, 0x09, 0xbd, 0x86, 0xc2, 0x1f, 0x4a, 0x7c, 0x1c, 0x9b, 0x89, 0xf3, 0x0f, 0x0c,
-	0x0f, 0x1c, 0x0c, 0x52, 0xc0, 0x33, 0x15, 0x30, 0x79, 0x26, 0xfa, 0x74, 0xf8, 0x25, 0xdf, 0x6f,
-	0x98, 0x0b, 0x97, 0x1f, 0xc6, 0x30, 0x9f, 0xea, 0x3b, 0x54, 0xbf, 0x35, 0x88, 0x06, 0xe7, 0x1f,
-	0xd0, 0xe6, 0x31, 0xef, 0x1a, 0xe9, 0x34, 0x32, 0x78, 0xc0, 0xd3, 0xc8, 0xe3, 0x5c, 0x84, 0xbc,
-	0x11, 0xf6, 0x67, 0x21, 0xda, 0x7c, 0xac, 0xe7, 0xe3, 0xcd, 0xfb, 0x3d, 0x7d, 0xfc, 0xee, 0xd1,
-	0xfe, 0x3c, 0x87, 0x72, 0x6b, 0xb5, 0xd5, 0x93, 0x71, 0x73, 0xa4, 0xe3, 0x66, 0x6f, 0x47, 0xb3,
-	0x1a, 0xf8, 0x8e, 0x4a, 0x61, 0xec, 0x40, 0xcc, 0x4d, 0xf4, 0x95, 0x2c, 0x1a, 0x5a, 0xeb, 0x6c,
-	0xb8, 0xbb, 0xae, 0x47, 0xdb, 0xc7, 0xbc, 0x37, 0xcf, 0x8b, 0xf3, 0xe0, 0x60, 0xa8, 0x0d, 0x76,
-	0x1e, 0x14, 0xa7, 0xc0, 0x4b, 0xfe, 0xca, 0x28, 0x9d, 0x33, 0x82, 0x95, 0xd1, 0x5f, 0x0f, 0x7f,
-	0x3f, 0x8b, 0xc6, 0x6b, 0x2d, 0x83, 0x9a, 0xde, 0x9c, 0xe1, 0x36, 0x0f, 0x21, 0x52, 0xe2, 0xe8,
-	0xb5, 0x72, 0x30, 0x47, 0xcb, 0x23, 0xc4, 0x9f, 0xa8, 0xff, 0x37, 0x8b, 0xca, 0xd5, 0x8e, 0xb7,
-	0x55, 0xf5, 0x60, 0x73, 0x79, 0x2a, 0xb7, 0xf9, 0xef, 0x64, 0xd0, 0x18, 0x7b, 0x90, 0x75, 0xeb,
-	0x3e, 0x35, 0x0f, 0xe1, 0x18, 0x25, 0x1f, 0x87, 0xb2, 0x8f, 0x79, 0x1c, 0xf2, 0x75, 0x99, 0xdb,
-	0xe7, 0xb1, 0x90, 0x1d, 0xb4, 0xd9, 0x29, 0xe9, 0x09, 0x79, 0x8d, 0x43, 0x38, 0x47, 0x1c, 0xe5,
-	0x6b, 0x7c, 0x2f, 0x83, 0x26, 0xd7, 0x1d, 0xb6, 0x91, 0xeb, 0x62, 0x3f, 0x3f, 0xe6, 0xfd, 0x92,
-	0x7c, 0xa1, 0x63, 0xde, 0x43, 0x3f, 0xc8, 0xa0, 0xb3, 0xd1, 0x17, 0x7a, 0x12, 0x56, 0x81, 0xbf,
-	0xca, 0xa0, 0xd3, 0x6f, 0x42, 0x12, 0x6c, 0xe0, 0x82, 0x7b, 0xf2, 0xde, 0xe8, 0x98, 0x8f, 0xbc,
-	0xef, 0x66, 0xd0, 0xa9, 0x95, 0xfa, 0x5c, 0xed, 0x49, 0xe9, 0xa1, 0xc4, 0xfb, 0x3c, 0x01, 0xfd,
-	0xb3, 0x56, 0xbd, 0xb3, 0xf4, 0x24, 0xf5, 0x4f, 0xe4, 0x7d, 0x8e, 0x79, 0xff, 0xfc, 0xff, 0x02,
-	0x2a, 0xb3, 0x73, 0xad, 0xf0, 0xe9, 0x3d, 0xd5, 0x96, 0xfe, 0x0c, 0x2a, 0x0b, 0x35, 0xc0, 0x91,
-	0x52, 0x8a, 0xe7, 0x17, 0x19, 0xe4, 0x0d, 0x38, 0x5a, 0xca, 0x44, 0xec, 0xc4, 0xf5, 0x0e, 0x75,
-	0x36, 0xe4, 0x18, 0x9a, 0x6d, 0xea, 0x6c, 0x10, 0x80, 0xe2, 0xa5, 0xf0, 0xce, 0xae, 0xba, 0x5a,
-	0x87, 0xc4, 0x57, 0x71, 0x52, 0x85, 0x4c, 0x5e, 0x47, 0xe0, 0x1a, 0x9a, 0x6d, 0xf0, 0x94, 0x59,
-	0x39, 0x7e, 0x2f, 0xce, 0x89, 0x97, 0xd1, 0x84, 0x0f, 0x0b, 0x33, 0x58, 0x4b, 0x29, 0xe2, 0xd2,
-	0x72, 0x57, 0x93, 0xac, 0xf8, 0x0d, 0x34, 0xec, 0x03, 0xdf, 0x32, 0x20, 0xbf, 0x8e, 0x89, 0x7a,
-	0xb6, 0xd7, 0xad, 0x9c, 0x09, 0x44, 0xdd, 0x37, 0x22, 0xf1, 0x89, 0x11, 0x06, 0x59, 0x00, 0x1c,
-	0x3b, 0x51, 0x8a, 0x80, 0xd8, 0x7d, 0x64, 0x84, 0x01, 0xbf, 0x0c, 0x02, 0x6c, 0xcb, 0x74, 0x29,
-	0xf8, 0xf8, 0xca, 0x10, 0x60, 0x02, 0x77, 0x82, 0x8e, 0x80, 0xf3, 0x30, 0xa2, 0x08, 0x19, 0x5e,
-	0x41, 0x28, 0xf4, 0xc5, 0x88, 0x60, 0xcd, 0x7d, 0x7b, 0x89, 0x24, 0x11, 0xea, 0x5f, 0xb3, 0xf3,
-	0x9b, 0x6d, 0x07, 0x23, 0xf9, 0x25, 0x54, 0xa8, 0xda, 0xf6, 0x5d, 0x52, 0x17, 0xde, 0x49, 0x88,
-	0x25, 0xd4, 0x6c, 0xbb, 0xd1, 0x71, 0x0c, 0xf9, 0x42, 0x82, 0x13, 0xe1, 0x1a, 0x1a, 0xa9, 0xda,
-	0xf6, 0x6a, 0x67, 0xa3, 0x65, 0x34, 0xa5, 0xf4, 0x71, 0x5e, 0x83, 0xc0, 0xb6, 0x1b, 0x36, 0x60,
-	0xe2, 0xc9, 0xf7, 0x51, 0x1e, 0xfc, 0x1e, 0x1a, 0xaa, 0xda, 0xb6, 0x48, 0xbe, 0xcf, 0x41, 0xf2,
-	0xbd, 0xea, 0xbf, 0x93, 0xf4, 0x6c, 0x53, 0x01, 0x11, 0x4f, 0xbb, 0x3f, 0x2f, 0x6e, 0x6b, 0x27,
-	0x59, 0x43, 0x89, 0x9c, 0xfb, 0x50, 0x24, 0xfe, 0x38, 0x2a, 0x56, 0x6d, 0x5b, 0x72, 0x0f, 0x80,
-	0x2b, 0x95, 0x71, 0xc5, 0xba, 0xc8, 0x27, 0x3b, 0xf7, 0x1a, 0x1a, 0x8d, 0x36, 0xb6, 0xaf, 0xfc,
-	0xfc, 0x9f, 0x66, 0xe0, 0x85, 0x8e, 0xf9, 0x85, 0xda, 0x0d, 0x94, 0xab, 0xda, 0xb6, 0x58, 0x4e,
-	0x4e, 0xa5, 0xf4, 0x47, 0x3c, 0x5a, 0xab, 0x6a, 0xdb, 0xfe, 0xab, 0xf3, 0x2b, 0xef, 0xa7, 0xeb,
-	0xd5, 0xbf, 0xcd, 0x5f, 0xfd, 0x98, 0xdf, 0x50, 0x7f, 0x2b, 0x87, 0xc6, 0xaa, 0xb6, 0x7d, 0x92,
-	0xb6, 0x7e, 0x58, 0x31, 0x61, 0xd7, 0x11, 0x92, 0x96, 0xc7, 0x62, 0x10, 0xfa, 0x51, 0x96, 0x96,
-	0x46, 0x25, 0x43, 0x24, 0x22, 0x7f, 0xf8, 0x95, 0xf6, 0x35, 0xfc, 0xfe, 0x24, 0xd2, 0x71, 0x90,
-	0x82, 0x7b, 0xd2, 0x71, 0xf9, 0x03, 0x59, 0x54, 0xa3, 0xb2, 0x32, 0x45, 0xc0, 0xb7, 0xb8, 0xa1,
-	0xf7, 0xd3, 0x0f, 0x9a, 0x0c, 0xd5, 0x30, 0x74, 0x12, 0xa3, 0xf5, 0xfb, 0xb0, 0xb8, 0xaf, 0x3e,
-	0xfc, 0x7a, 0x16, 0x4d, 0x84, 0x7d, 0x78, 0x18, 0x86, 0xe9, 0x34, 0x42, 0xdc, 0x49, 0x19, 0x5c,
-	0x24, 0x8e, 0xf0, 0x48, 0x65, 0x17, 0xa0, 0x22, 0x52, 0x39, 0x24, 0x09, 0x6e, 0x15, 0x72, 0xa9,
-	0xb7, 0x0a, 0x57, 0x51, 0x89, 0x68, 0x3b, 0x6f, 0x77, 0xa8, 0xb3, 0x2b, 0xb6, 0x52, 0x70, 0xa5,
-	0x3b, 0xda, 0x4e, 0xe3, 0x8b, 0x0c, 0x48, 0x02, 0x34, 0x56, 0x83, 0x18, 0x35, 0xc9, 0x79, 0xcc,
-	0x63, 0xd4, 0x82, 0xc8, 0x34, 0xa1, 0xa4, 0xc2, 0xbe, 0x94, 0xf4, 0x83, 0x02, 0x1a, 0x9f, 0xd3,
-	0x3c, 0x6d, 0x43, 0x73, 0xa9, 0x74, 0x90, 0x18, 0xf3, 0x61, 0x6c, 0x20, 0x18, 0x41, 0xc9, 0x22,
-	0x88, 0xcb, 0xd2, 0x37, 0x1a, 0x2e, 0x87, 0xca, 0x35, 0x5e, 0x62, 0x0c, 0xf8, 0x53, 0xa1, 0xdc,
-	0xa0, 0xa8, 0x0d, 0x37, 0x67, 0x40, 0x63, 0xfa, 0x46, 0xc3, 0x16, 0x60, 0x92, 0x20, 0xc4, 0xd7,
-	0x50, 0xd9, 0x87, 0x31, 0xe3, 0x29, 0x17, 0xbe, 0xb3, 0xbe, 0xc1, 0x6c, 0x27, 0x22, 0xa3, 0xf1,
-	0x27, 0xd1, 0xb0, 0xff, 0x53, 0x32, 0x4b, 0xc0, 0xd6, 0xd2, 0x37, 0x12, 0x86, 0xa3, 0x4c, 0x2a,
-	0xb3, 0xc2, 0xfc, 0xcc, 0x47, 0x58, 0x63, 0x05, 0xad, 0x22, 0xa4, 0xf8, 0x8b, 0x68, 0xd4, 0xff,
-	0x2d, 0x8c, 0xad, 0x02, 0x18, 0x5b, 0xd7, 0x7c, 0xcd, 0xc7, 0xd5, 0x3a, 0x15, 0x25, 0xe7, 0x66,
-	0xd7, 0xb3, 0xc2, 0xec, 0x3a, 0xa5, 0x6f, 0x24, 0xad, 0xae, 0x58, 0x03, 0xb8, 0x8e, 0x26, 0x7c,
-	0x48, 0xf5, 0xdd, 0x35, 0x42, 0x37, 0xd9, 0xac, 0x2c, 0x86, 0xc6, 0xb2, 0xbe, 0xd1, 0x80, 0x52,
-	0x57, 0x80, 0x90, 0x6d, 0xf6, 0x04, 0x17, 0x6e, 0xa1, 0xf3, 0x11, 0xa0, 0xee, 0x6e, 0x19, 0xf7,
-	0x3c, 0x61, 0xe9, 0xd6, 0xe7, 0xc4, 0x71, 0x00, 0x6a, 0xc1, 0x04, 0x52, 0x39, 0x8d, 0x5f, 0x2c,
-	0xa8, 0x11, 0xa9, 0x9b, 0xb6, 0xa7, 0x34, 0xbc, 0x86, 0x26, 0x7d, 0xfc, 0x9b, 0xb5, 0xd5, 0x55,
-	0xc7, 0xfa, 0x02, 0x6d, 0x7a, 0xf5, 0x39, 0x71, 0x52, 0x80, 0x14, 0x24, 0x7d, 0xa3, 0xb1, 0xd9,
-	0xb4, 0xd9, 0xa0, 0x60, 0xb8, 0xa8, 0xf0, 0x54, 0x66, 0xfc, 0x0e, 0x3a, 0x2d, 0xc1, 0xeb, 0xa6,
-	0xeb, 0x69, 0x66, 0x93, 0xd6, 0xe7, 0xc4, 0xf1, 0x01, 0x8e, 0x32, 0x42, 0xaa, 0x21, 0x90, 0x51,
-	0xb1, 0xe9, 0xec, 0xe7, 0xaa, 0xe8, 0x54, 0x4a, 0x4f, 0xed, 0xcb, 0x66, 0xfd, 0x4a, 0x36, 0x1c,
-	0x1c, 0xc7, 0xdc, 0x70, 0x9d, 0x45, 0x25, 0xff, 0x4d, 0xc4, 0x16, 0xa2, 0xf4, 0x1b, 0xe0, 0x71,
-	0x19, 0x3e, 0x3e, 0xa2, 0x8e, 0x63, 0x6e, 0xcc, 0x1e, 0x86, 0x3a, 0x3e, 0xc8, 0x84, 0xea, 0x38,
-	0xe6, 0x06, 0xee, 0x77, 0x73, 0xe1, 0xcc, 0x3e, 0xb1, 0x72, 0x0f, 0xcb, 0x58, 0x0a, 0x2f, 0x4e,
-	0x0b, 0xfb, 0x08, 0x20, 0x93, 0x87, 0x66, 0xf1, 0x31, 0x87, 0xe6, 0x0f, 0x93, 0xfd, 0xc9, 0x0d,
-	0x90, 0x63, 0xd9, 0x9f, 0x87, 0x30, 0x59, 0xf1, 0x0c, 0x1a, 0xf1, 0xff, 0xe7, 0x96, 0x5a, 0x5e,
-	0xca, 0x87, 0xda, 0x10, 0x86, 0x5a, 0x94, 0x04, 0x7f, 0x0e, 0x9d, 0x89, 0x00, 0x56, 0x35, 0x47,
-	0x6b, 0x53, 0x8f, 0x3a, 0xdc, 0x46, 0x10, 0xe5, 0xe7, 0x7c, 0xee, 0x86, 0x1d, 0xa0, 0xe5, 0x0a,
-	0x6e, 0x7d, 0x24, 0x48, 0x83, 0xa3, 0xb8, 0x8f, 0x5b, 0xf5, 0x7f, 0xca, 0xa2, 0x91, 0x55, 0xcb,
-	0xf5, 0x36, 0x1d, 0xea, 0xae, 0x6a, 0x8e, 0x4b, 0x9f, 0xde, 0x1e, 0xfd, 0x04, 0x1a, 0x81, 0x38,
-	0xd9, 0x36, 0x35, 0x3d, 0xa9, 0x2e, 0x1d, 0xaf, 0xd1, 0xe0, 0x23, 0xc0, 0x6c, 0x24, 0x51, 0x42,
-	0x5c, 0x41, 0x79, 0x3e, 0x06, 0xa4, 0xe8, 0x65, 0x3e, 0x00, 0x38, 0x5c, 0xfd, 0x7a, 0x0e, 0x0d,
-	0xfb, 0x5a, 0x9e, 0x35, 0x8e, 0x6b, 0x16, 0xf0, 0xd1, 0x2a, 0x79, 0x1a, 0xa1, 0x55, 0xcb, 0xf1,
-	0xb4, 0x96, 0x54, 0x12, 0x17, 0x8e, 0x0c, 0x36, 0x40, 0x39, 0x8f, 0x44, 0x82, 0xa7, 0x10, 0x92,
-	0x26, 0x58, 0x11, 0x26, 0xd8, 0x68, 0xaf, 0x5b, 0x41, 0xe1, 0xbc, 0x22, 0x12, 0x85, 0xfa, 0x47,
-	0x59, 0x34, 0xe6, 0x77, 0xd2, 0xfc, 0x03, 0xda, 0xec, 0x78, 0x4f, 0xf1, 0x64, 0x88, 0x6a, 0x3b,
-	0xff, 0x50, 0x6d, 0xab, 0xff, 0x26, 0x2d, 0x24, 0xb5, 0x96, 0x75, 0xb2, 0x90, 0xfc, 0x4f, 0x8c,
-	0x71, 0xf5, 0x67, 0x72, 0x68, 0xd2, 0xd7, 0xfa, 0x42, 0xc7, 0x04, 0x33, 0xa1, 0xa6, 0xb5, 0x5a,
-	0x4f, 0xf3, 0xbe, 0x5c, 0xf6, 0x15, 0xb1, 0x22, 0x12, 0x4f, 0x46, 0xf8, 0x25, 0xdb, 0x3d, 0x01,
-	0x6e, 0x58, 0x86, 0x4e, 0x64, 0x22, 0xfc, 0x06, 0x1a, 0xf6, 0x7f, 0x56, 0x9d, 0x4d, 0x7f, 0x33,
-	0x86, 0xa3, 0x73, 0xc0, 0xa4, 0x39, 0x9b, 0x91, 0x62, 0xc3, 0x32, 0x83, 0xfa, 0xb5, 0x02, 0x3a,
-	0xf7, 0xae, 0x61, 0xea, 0xd6, 0x8e, 0x2b, 0x8a, 0x71, 0x1d, 0x7f, 0xa3, 0xf7, 0xf0, 0x6a, 0xe0,
-	0x84, 0x96, 0x49, 0x7e, 0x1f, 0x66, 0xeb, 0xdb, 0xe8, 0x74, 0x5c, 0xa5, 0x4e, 0x90, 0xef, 0x28,
-	0x7a, 0x67, 0x87, 0x13, 0x34, 0xfc, 0x7a, 0x68, 0xc2, 0xff, 0x44, 0xd2, 0x39, 0xe3, 0x05, 0xd5,
-	0x8a, 0x8f, 0x52, 0x50, 0xed, 0x63, 0xa8, 0x30, 0x67, 0xb5, 0x35, 0xc3, 0x0f, 0xf1, 0x85, 0x59,
-	0x1c, 0xb4, 0x0b, 0x18, 0x22, 0x28, 0x98, 0x7c, 0xd1, 0x30, 0x74, 0xd9, 0x50, 0x28, 0xdf, 0x67,
-	0xe8, 0xb8, 0xd4, 0x21, 0x32, 0x11, 0xb6, 0xd0, 0x88, 0x68, 0x4e, 0x78, 0x8b, 0x10, 0x78, 0x8b,
-	0x5e, 0xf6, 0x75, 0xd4, 0x7f, 0x58, 0x4d, 0x45, 0xf8, 0xb8, 0xdb, 0x08, 0x9e, 0xce, 0x7f, 0x19,
-	0xee, 0x37, 0x22, 0x51, 0xf9, 0x92, 0x12, 0x60, 0x91, 0x29, 0x27, 0x95, 0x00, 0xab, 0x8c, 0x4c,
-	0x74, 0xee, 0x36, 0xc2, 0xc9, 0xc6, 0xf6, 0xe5, 0xf9, 0xf8, 0xf9, 0x2c, 0xc2, 0xb1, 0x03, 0xc4,
-	0xfc, 0x53, 0x6c, 0x07, 0xa9, 0xbf, 0x93, 0x41, 0x13, 0x89, 0x4c, 0x5d, 0x7c, 0x03, 0x21, 0x0e,
-	0x91, 0xb2, 0x6e, 0x21, 0xc7, 0x2e, 0xcc, 0xde, 0x15, 0x7b, 0x40, 0x48, 0x86, 0xa7, 0x51, 0x89,
-	0xff, 0x0a, 0xaa, 0xc0, 0xc7, 0x59, 0x3a, 0x1d, 0x43, 0x27, 0x01, 0x51, 0xd8, 0x0a, 0x7c, 0x0f,
-	0x21, 0x97, 0xca, 0xe2, 0xed, 0xda, 0x41, 0x2b, 0x8c, 0x4c, 0xfd, 0x76, 0x06, 0x0d, 0x07, 0x0f,
-	0x5c, 0xd5, 0x8f, 0xaa, 0xeb, 0x0a, 0x22, 0xe9, 0x39, 0xf7, 0xb0, 0xa4, 0xe7, 0xd8, 0xa2, 0x22,
-	0xb2, 0x9c, 0xff, 0x22, 0x83, 0xc6, 0x02, 0xda, 0x23, 0xf4, 0xb1, 0x1c, 0xf8, 0x45, 0x7e, 0x21,
-	0x83, 0x94, 0x59, 0xa3, 0xd5, 0x32, 0xcc, 0xcd, 0xba, 0x79, 0xcf, 0x72, 0xda, 0x90, 0x5b, 0x78,
-	0x74, 0x4e, 0x34, 0xf5, 0xe7, 0x32, 0x68, 0x42, 0x3c, 0x50, 0x4d, 0x73, 0xf4, 0xa3, 0xf3, 0x6e,
-	0xc6, 0x9f, 0xe4, 0xe8, 0x7a, 0x19, 0xe2, 0xa3, 0x97, 0xac, 0xe6, 0xfd, 0x27, 0x20, 0xcc, 0x9b,
-	0xbd, 0xc6, 0x31, 0x0f, 0x45, 0xfb, 0x72, 0x06, 0x4d, 0x12, 0xda, 0xb4, 0xb6, 0xa9, 0xb3, 0x5b,
-	0xb3, 0x74, 0xfa, 0x26, 0x35, 0xa9, 0x73, 0x54, 0x83, 0xf4, 0x8f, 0xa1, 0xdc, 0x42, 0xf8, 0x30,
-	0x77, 0x5d, 0xaa, 0x1f, 0x9f, 0xda, 0x18, 0xea, 0x1f, 0x14, 0x91, 0x92, 0x6a, 0x99, 0x1c, 0xdb,
-	0x4d, 0xbd, 0xaf, 0xb9, 0x39, 0x78, 0x58, 0xe6, 0x66, 0x7e, 0x7f, 0xe6, 0x66, 0x61, 0xbf, 0xe6,
-	0x66, 0xf1, 0x51, 0xcc, 0xcd, 0x76, 0xdc, 0xdc, 0x2c, 0x81, 0xb9, 0x79, 0x63, 0x4f, 0x73, 0x73,
-	0xde, 0xd4, 0x1f, 0xd3, 0xd8, 0x3c, 0xb6, 0x15, 0x21, 0x1f, 0xc3, 0x4a, 0xc6, 0x57, 0xd8, 0xe2,
-	0xd6, 0xb4, 0x1c, 0x9d, 0xf2, 0x0a, 0x8f, 0x25, 0xee, 0x0d, 0x76, 0x04, 0x8c, 0x04, 0xd8, 0x44,
-	0x79, 0xcd, 0x91, 0x47, 0x29, 0xaf, 0x79, 0x08, 0x56, 0xf8, 0xf7, 0x32, 0x68, 0xa2, 0x46, 0x1d,
-	0xcf, 0xb8, 0x67, 0x34, 0x35, 0xef, 0x30, 0xae, 0x20, 0xab, 0x68, 0x4c, 0x12, 0x28, 0x7d, 0x60,
-	0x0b, 0xf2, 0xa2, 0x9b, 0xd4, 0xf1, 0xc0, 0x94, 0x94, 0x23, 0x02, 0x62, 0xf4, 0xac, 0x79, 0xbf,
-	0xc4, 0x8d, 0x98, 0xbb, 0x41, 0xf3, 0x3e, 0x9c, 0x2b, 0xd2, 0x10, 0xbf, 0x48, 0x40, 0xaf, 0x7e,
-	0x23, 0x83, 0x2e, 0x13, 0x6a, 0xd2, 0x1d, 0x6d, 0xa3, 0x45, 0x25, 0xc1, 0x62, 0x6d, 0x67, 0xf3,
-	0xde, 0x70, 0xdb, 0x9a, 0xd7, 0xdc, 0x3a, 0xd0, 0x5b, 0x2e, 0x44, 0x3f, 0x72, 0xb5, 0x8f, 0xd5,
-	0x29, 0xc2, 0xa7, 0xfe, 0x30, 0x83, 0x8a, 0x77, 0xcd, 0xfb, 0xa6, 0xb5, 0x73, 0xb0, 0x42, 0x48,
-	0x37, 0x50, 0x59, 0x88, 0x91, 0x34, 0xce, 0xbf, 0x5a, 0xc6, 0xc1, 0x0d, 0xfe, 0x69, 0x33, 0x99,
-	0x0a, 0xbf, 0x16, 0x30, 0x41, 0x98, 0x8a, 0xf4, 0x15, 0x2d, 0x9f, 0x29, 0xf6, 0x35, 0x33, 0x99,
-	0x1c, 0x9f, 0x17, 0xdf, 0x18, 0x90, 0x52, 0x3f, 0xd9, 0xa3, 0xf0, 0x4f, 0x0c, 0xa8, 0xbf, 0x72,
-	0x0d, 0xe5, 0x57, 0x4c, 0xba, 0x72, 0x0f, 0x5f, 0x97, 0x8a, 0x3d, 0x89, 0xf7, 0x9a, 0x90, 0xf5,
-	0x04, 0x88, 0xc5, 0x01, 0x22, 0x95, 0x84, 0xba, 0x29, 0x97, 0xe2, 0x11, 0xba, 0xc5, 0x32, 0x0f,
-	0xc7, 0x2c, 0x0e, 0x10, 0xb9, 0x64, 0xcf, 0x4d, 0xb9, 0x56, 0x8d, 0x18, 0x38, 0x11, 0x2e, 0x8e,
-	0xf1, 0xb9, 0x84, 0xf1, 0xb2, 0x94, 0x56, 0x1a, 0x26, 0xee, 0xdd, 0x48, 0x52, 0x2c, 0x0e, 0x90,
-	0xf4, 0x92, 0x32, 0x91, 0x4f, 0xcf, 0x08, 0xff, 0xc6, 0x64, 0x6c, 0xeb, 0x01, 0xdc, 0xe2, 0x00,
-	0x89, 0x7e, 0xa6, 0xe6, 0x56, 0xe4, 0xa3, 0x1e, 0xf1, 0xf0, 0x1c, 0x09, 0xb5, 0x38, 0x40, 0x62,
-	0x9f, 0xff, 0x88, 0x7c, 0x61, 0x42, 0x5c, 0xf7, 0xc4, 0x1b, 0x05, 0x9c, 0xd4, 0x28, 0xff, 0x1a,
-	0xc5, 0xeb, 0xb1, 0xca, 0xef, 0x22, 0xfc, 0xed, 0x74, 0x8c, 0x99, 0x23, 0x17, 0x07, 0x48, 0xac,
-	0x4e, 0xfc, 0x15, 0xbf, 0x18, 0xb8, 0x58, 0xcb, 0x47, 0x25, 0xe3, 0xcd, 0x78, 0x9f, 0x69, 0xc9,
-	0x2f, 0x16, 0x7e, 0x53, 0x2e, 0x02, 0x2d, 0x16, 0x67, 0x1c, 0x6b, 0x65, 0xde, 0xd4, 0x59, 0xef,
-	0x48, 0x96, 0xc3, 0xed, 0x78, 0xb9, 0x54, 0x51, 0x84, 0xf7, 0x99, 0x18, 0xa7, 0xc0, 0x2e, 0x0e,
-	0x90, 0x78, 0x79, 0xd5, 0x5b, 0x91, 0x52, 0x9d, 0x22, 0x76, 0x3b, 0xae, 0x55, 0x86, 0x92, 0xb4,
-	0x0a, 0x45, 0x3d, 0x6f, 0xc7, 0x6b, 0x47, 0x2a, 0x23, 0xa9, 0x4d, 0x0b, 0xac, 0xd4, 0xb4, 0x5f,
-	0x6b, 0xf2, 0x56, 0xa4, 0xc6, 0x1f, 0x94, 0xd1, 0x4d, 0x69, 0x5a, 0xf3, 0x34, 0xb9, 0x69, 0x5e,
-	0x0d, 0x30, 0x52, 0x6d, 0x4e, 0x19, 0x4b, 0xed, 0x50, 0xc0, 0x49, 0x1d, 0xca, 0x2b, 0xd3, 0xdd,
-	0x8a, 0x14, 0x48, 0x51, 0xc6, 0xa3, 0x8d, 0x4a, 0x28, 0xd6, 0xa8, 0x5c, 0x4a, 0xe5, 0xa6, 0x5c,
-	0x37, 0x44, 0x99, 0x88, 0x76, 0x50, 0x88, 0x61, 0x1d, 0x24, 0xd5, 0x17, 0xa9, 0x40, 0x4d, 0x02,
-	0x05, 0x03, 0x79, 0x39, 0x78, 0xc2, 0xda, 0xea, 0xe2, 0x00, 0x81, 0x6a, 0x05, 0x2a, 0xaf, 0x76,
-	0xa1, 0x9c, 0x02, 0x8a, 0xe1, 0xa0, 0x96, 0xe2, 0x03, 0xda, 0x5c, 0x1c, 0x20, 0xbc, 0x12, 0xc6,
-	0x75, 0x29, 0x21, 0x5e, 0x99, 0x8c, 0x2e, 0x11, 0x01, 0x82, 0x2d, 0x11, 0x61, 0xda, 0xfc, 0x42,
-	0x32, 0x69, 0x5c, 0x39, 0x1d, 0x3d, 0x3f, 0xc4, 0xf1, 0x8b, 0x03, 0x24, 0x99, 0x68, 0x7e, 0x2b,
-	0x92, 0x47, 0xad, 0x3c, 0x13, 0x8b, 0x89, 0x0b, 0x51, 0x4c, 0x5d, 0x72, 0xc6, 0xf5, 0x4a, 0x6a,
-	0x1d, 0x27, 0xe5, 0x0c, 0x08, 0x78, 0x36, 0x10, 0x90, 0x24, 0x59, 0x1c, 0x20, 0xa9, 0x15, 0xa0,
-	0x6a, 0x89, 0x6c, 0x66, 0x45, 0x89, 0x1a, 0xae, 0x31, 0xf4, 0xe2, 0x00, 0x49, 0xe4, 0x3f, 0xdf,
-	0x94, 0xd3, 0x88, 0x95, 0xb3, 0xd1, 0x4e, 0x0c, 0x31, 0xac, 0x13, 0xa5, 0x74, 0xe3, 0x9b, 0x72,
-	0xd6, 0xae, 0x72, 0x2e, 0xc9, 0x15, 0xae, 0x9c, 0x52, 0x76, 0x2f, 0x49, 0x4f, 0x92, 0x55, 0x9e,
-	0x05, 0xfe, 0xf3, 0x3e, 0x7f, 0x1a, 0xcd, 0xe2, 0x00, 0x49, 0x4f, 0xb0, 0x25, 0xe9, 0x79, 0xaa,
-	0xca, 0xf9, 0xbd, 0x64, 0x06, 0x4f, 0x97, 0x9e, 0xe3, 0xaa, 0xed, 0x91, 0x2a, 0xaa, 0x3c, 0x17,
-	0xcd, 0xe5, 0xe8, 0x4b, 0xb8, 0x38, 0x40, 0xf6, 0x48, 0x38, 0xbd, 0xdb, 0x27, 0x6f, 0x53, 0xb9,
-	0x10, 0xad, 0xfa, 0x91, 0x4a, 0xb4, 0x38, 0x40, 0xfa, 0x64, 0x7d, 0xde, 0xed, 0x93, 0x3c, 0xa9,
-	0x54, 0xf6, 0x14, 0x1b, 0xe8, 0xa3, 0x4f, 0xea, 0xe5, 0x4a, 0x6a, 0x06, 0xa3, 0x72, 0x31, 0x3a,
-	0x74, 0x53, 0x48, 0xd8, 0xd0, 0x4d, 0xcb, 0x7d, 0x5c, 0x49, 0x4d, 0x21, 0x54, 0x9e, 0xdf, 0x43,
-	0x60, 0xf0, 0x8c, 0xa9, 0xc9, 0x87, 0x2b, 0xa9, 0x39, 0x7c, 0x8a, 0x1a, 0x15, 0x98, 0x42, 0xc2,
-	0x04, 0xa6, 0x65, 0xff, 0xad, 0xa4, 0x26, 0xd1, 0x29, 0x97, 0xf6, 0x10, 0x18, 0x3e, 0x61, 0x5a,
-	0xfa, 0xdd, 0xad, 0x48, 0x16, 0x9b, 0xf2, 0x91, 0xe8, 0xba, 0x21, 0xa1, 0xd8, 0xba, 0x21, 0xe7,
-	0xbb, 0xd5, 0x12, 0x81, 0xfe, 0xca, 0x47, 0xa3, 0xd3, 0x3c, 0x86, 0x66, 0xd3, 0x3c, 0x9e, 0x1a,
-	0x50, 0x4b, 0x04, 0x9d, 0x2b, 0x97, 0xfb, 0x09, 0x01, 0x74, 0x54, 0x08, 0x0f, 0x53, 0xaf, 0xa7,
-	0x44, 0x3d, 0x2b, 0x2f, 0x44, 0xbd, 0x8f, 0x09, 0x82, 0xc5, 0x01, 0x92, 0x12, 0x2b, 0x4d, 0xd2,
-	0x83, 0xbb, 0x94, 0x2b, 0xd1, 0x69, 0x9b, 0x46, 0xc3, 0xa6, 0x6d, 0x6a, 0x60, 0xd8, 0x52, 0xda,
-	0xfd, 0x80, 0x72, 0x35, 0x6a, 0x98, 0x25, 0x29, 0x98, 0x61, 0x96, 0x72, 0xaf, 0x40, 0xd2, 0xc3,
-	0x95, 0x94, 0x8f, 0xed, 0xf9, 0x84, 0x40, 0x93, 0xf2, 0x84, 0x3c, 0x7a, 0x27, 0xb4, 0x9d, 0xee,
-	0xda, 0x2d, 0x4b, 0xd3, 0x95, 0x17, 0x53, 0x6d, 0x27, 0x8e, 0x94, 0x6c, 0x27, 0x0e, 0x60, 0xbb,
-	0xbc, 0xec, 0x3f, 0x57, 0xae, 0x45, 0x77, 0x79, 0x19, 0xc7, 0x76, 0xf9, 0x88, 0xaf, 0xbd, 0x96,
-	0xf0, 0x5a, 0x2b, 0x2f, 0x45, 0x07, 0x40, 0x0c, 0xcd, 0x06, 0x40, 0xdc, 0xcf, 0xfd, 0x5e, 0x7f,
-	0x8f, 0xb1, 0x32, 0x05, 0xd2, 0x2e, 0x06, 0xd5, 0xa2, 0xfb, 0xd0, 0x2d, 0x0e, 0x90, 0xfe, 0x5e,
-	0xe7, 0x7a, 0x8a, 0x03, 0x58, 0x99, 0x8e, 0x0e, 0xb0, 0x04, 0x01, 0x1b, 0x60, 0x49, 0xb7, 0x71,
-	0x3d, 0xc5, 0x83, 0xab, 0x7c, 0xbc, 0xaf, 0xa8, 0xe0, 0x9d, 0x53, 0xfc, 0xbe, 0x37, 0x65, 0x17,
-	0xac, 0x72, 0x3d, 0xba, 0xd9, 0x85, 0x18, 0xb6, 0xd9, 0x49, 0xae, 0xda, 0x9b, 0xb2, 0xc7, 0x53,
-	0x99, 0x49, 0x72, 0x85, 0x5b, 0xa4, 0xe4, 0x19, 0x25, 0xe9, 0x0e, 0x46, 0xe5, 0x46, 0x74, 0xd4,
-	0xa5, 0xd1, 0xb0, 0x51, 0x97, 0xea, 0x9c, 0x5c, 0x48, 0xfa, 0x09, 0x95, 0x9b, 0x71, 0xcf, 0x69,
-	0x14, 0xcf, 0x2c, 0x9f, 0x84, 0x6f, 0xf1, 0x76, 0x3c, 0xf2, 0x58, 0x79, 0x39, 0x6a, 0xdf, 0x46,
-	0xb1, 0xcc, 0xbe, 0x8d, 0x45, 0x2a, 0xdf, 0x8e, 0x07, 0xeb, 0x2a, 0xaf, 0xa4, 0x4b, 0x08, 0xc6,
-	0x4a, 0x3c, 0xb8, 0xf7, 0x76, 0x3c, 0xbe, 0x55, 0xb9, 0x95, 0x2e, 0x21, 0xd0, 0x6e, 0x3c, 0x1e,
-	0xf6, 0xba, 0x94, 0xf3, 0xa7, 0x7c, 0x22, 0x6a, 0x3a, 0x06, 0x08, 0x66, 0x3a, 0x86, 0x99, 0x81,
-	0xd7, 0xa5, 0x5c, 0x39, 0xe5, 0x93, 0x09, 0x96, 0xe0, 0x61, 0xa5, 0x8c, 0xba, 0xeb, 0x52, 0x8e,
-	0x99, 0xf2, 0x6a, 0x82, 0x25, 0x78, 0x3a, 0x29, 0x13, 0x4d, 0xdf, 0x2b, 0x00, 0x40, 0xf9, 0x14,
-	0xc8, 0x50, 0x1f, 0x7e, 0xa7, 0xbb, 0x38, 0x40, 0xf6, 0x0a, 0x24, 0x78, 0xaf, 0xbf, 0xd7, 0x55,
-	0x79, 0x2d, 0x3a, 0x85, 0xfb, 0xd1, 0xb1, 0x29, 0xdc, 0xd7, 0x73, 0xfb, 0x7a, 0x2c, 0x18, 0x50,
-	0x79, 0x3d, 0xba, 0xc4, 0x45, 0x90, 0x6c, 0x89, 0x8b, 0x87, 0x0e, 0x46, 0xa2, 0xdc, 0x94, 0x4f,
-	0x47, 0x97, 0x38, 0x19, 0xc7, 0x96, 0xb8, 0x48, 0x44, 0x5c, 0x2d, 0x11, 0x7c, 0xa5, 0xbc, 0x11,
-	0x5d, 0xe2, 0x62, 0x68, 0xb6, 0xc4, 0xc5, 0xc3, 0xb5, 0x5e, 0x8f, 0xc5, 0x20, 0x29, 0xb7, 0xd3,
-	0x9f, 0x1f, 0x90, 0xf2, 0xf3, 0xf3, 0x88, 0x25, 0x92, 0x1e, 0x4c, 0xa3, 0x54, 0xa3, 0xf3, 0x37,
-	0x8d, 0x86, 0xcd, 0xdf, 0xd4, 0x40, 0x9c, 0x95, 0xd4, 0x9a, 0x9b, 0xca, 0xec, 0x1e, 0x07, 0x87,
-	0xd0, 0x14, 0x49, 0xab, 0xd6, 0x79, 0x3b, 0xfe, 0x9d, 0x31, 0xa5, 0xd6, 0xe7, 0x8c, 0xec, 0x1f,
-	0x83, 0xe2, 0xdf, 0x25, 0xab, 0xa7, 0x38, 0x01, 0x95, 0xb9, 0xe8, 0xea, 0x9a, 0x20, 0x60, 0xab,
-	0x6b, 0xd2, 0x75, 0xb8, 0x90, 0xfc, 0xbc, 0xa3, 0x32, 0x1f, 0xbb, 0x12, 0x8f, 0xe1, 0xd9, 0xea,
-	0x94, 0xf8, 0x24, 0x24, 0x49, 0xff, 0x02, 0xa0, 0xb2, 0x10, 0xdb, 0xaf, 0x53, 0x68, 0x60, 0xbf,
-	0x4e, 0xfb, 0x7a, 0xe0, 0xe7, 0xfa, 0x7e, 0xc8, 0x51, 0x79, 0x13, 0xc4, 0x56, 0xfa, 0x89, 0x15,
-	0x64, 0x8b, 0x03, 0xa4, 0xef, 0xa7, 0x20, 0xef, 0xa2, 0xd3, 0x77, 0x76, 0xd7, 0xde, 0x5e, 0x0a,
-	0xe2, 0xb7, 0x56, 0x1d, 0x6a, 0x6b, 0x0e, 0x55, 0x16, 0xa3, 0xb6, 0x7a, 0x2a, 0x11, 0xb3, 0xd5,
-	0x53, 0x11, 0x49, 0xb1, 0xfe, 0x5c, 0xa8, 0xef, 0x25, 0x36, 0x9c, 0x11, 0xe9, 0xdc, 0x6c, 0x75,
-	0x8a, 0x22, 0x98, 0x82, 0x96, 0x2c, 0x73, 0x13, 0x3c, 0x15, 0x9f, 0x89, 0xae, 0x4e, 0xfd, 0x29,
-	0xd9, 0xea, 0xd4, 0x1f, 0xcb, 0x86, 0x7a, 0x14, 0xcb, 0xe7, 0xe0, 0x5b, 0xd1, 0xa1, 0x9e, 0x42,
-	0xc2, 0x86, 0x7a, 0x0a, 0x38, 0x29, 0x90, 0x50, 0x97, 0x7a, 0xca, 0xd2, 0x5e, 0x02, 0x81, 0x24,
-	0x29, 0x10, 0xc0, 0x49, 0x81, 0x0b, 0xd4, 0x6b, 0x6e, 0x29, 0x77, 0xf6, 0x12, 0x08, 0x24, 0x49,
-	0x81, 0x00, 0x66, 0x87, 0xcd, 0x28, 0x78, 0xb6, 0xd3, 0xba, 0xef, 0xf7, 0xd9, 0x72, 0xf4, 0xb0,
-	0xd9, 0x97, 0x90, 0x1d, 0x36, 0xfb, 0x22, 0xf1, 0x97, 0x1e, 0xd9, 0xc5, 0xad, 0xac, 0x40, 0x83,
-	0x53, 0xa1, 0x5d, 0xf0, 0x28, 0x5c, 0x8b, 0x03, 0xe4, 0x51, 0x5d, 0xe8, 0x2f, 0x06, 0xde, 0x6b,
-	0x65, 0x15, 0x9a, 0x1a, 0x0b, 0x7c, 0x15, 0x1c, 0xbc, 0x38, 0x40, 0x7c, 0x8a, 0xd9, 0x22, 0xca,
-	0xc3, 0x17, 0x34, 0xd4, 0x5f, 0xcb, 0xa0, 0xe1, 0x35, 0xcf, 0xa1, 0x5a, 0x5b, 0x44, 0x76, 0x9d,
-	0x43, 0x25, 0x6e, 0x13, 0x8b, 0xaf, 0x43, 0x0d, 0x91, 0xe0, 0x37, 0xbe, 0x8c, 0x46, 0x97, 0x34,
-	0xd7, 0x03, 0x4e, 0xe9, 0xb3, 0xb7, 0x24, 0x06, 0xc5, 0x4b, 0x9c, 0x8e, 0xf3, 0xc1, 0x05, 0x50,
-	0xee, 0xa1, 0x17, 0x40, 0xa5, 0x0f, 0xba, 0x95, 0x01, 0xb8, 0xe6, 0x89, 0xf1, 0xaa, 0xbd, 0x0c,
-	0x4a, 0x58, 0xeb, 0x8f, 0xef, 0x9d, 0x5f, 0x41, 0x63, 0xb1, 0x4b, 0x47, 0xe1, 0xd4, 0x7e, 0xc4,
-	0x3b, 0xc9, 0x38, 0x37, 0xbe, 0x84, 0x72, 0x77, 0xeb, 0x73, 0x72, 0x45, 0xfb, 0x4e, 0x24, 0x61,
-	0x8d, 0x61, 0xf1, 0x0b, 0x81, 0xc7, 0xf5, 0x2e, 0x59, 0x12, 0x97, 0x8d, 0xf0, 0xd5, 0xad, 0x8e,
-	0xd3, 0x22, 0x12, 0x4a, 0xfd, 0x4e, 0x39, 0xbc, 0x70, 0xc1, 0x97, 0xc5, 0x7d, 0xab, 0x54, 0xe1,
-	0x3f, 0x96, 0xdd, 0xc8, 0xef, 0x57, 0x3f, 0x8d, 0x86, 0xeb, 0x6d, 0x9b, 0x3a, 0xae, 0x65, 0x42,
-	0xed, 0xed, 0x6c, 0x78, 0x7b, 0x60, 0x48, 0x70, 0x39, 0x42, 0x52, 0xa6, 0x0f, 0x0b, 0x87, 0xe7,
-	0x1e, 0x5a, 0x38, 0xfc, 0x2a, 0xca, 0xdf, 0x75, 0xf9, 0x77, 0xe7, 0x03, 0xd2, 0x4e, 0xec, 0x2b,
-	0x5b, 0x9c, 0x02, 0x5f, 0x43, 0x05, 0xb8, 0x42, 0x70, 0x95, 0x3c, 0xd0, 0x42, 0xd6, 0x70, 0x0b,
-	0x20, 0x72, 0x19, 0x0d, 0x4e, 0x83, 0xdf, 0x42, 0xe3, 0x61, 0x4d, 0x0e, 0x28, 0x79, 0xe2, 0x87,
-	0x7a, 0x42, 0xa6, 0xa1, 0xf4, 0xed, 0x79, 0xa8, 0x95, 0x22, 0x8b, 0x48, 0x30, 0xe2, 0x45, 0x34,
-	0x16, 0xc2, 0x98, 0x8a, 0xfc, 0x10, 0xf3, 0x0b, 0xbd, 0x6e, 0xe5, 0x9c, 0x24, 0x8b, 0xa9, 0x53,
-	0x16, 0x15, 0x67, 0xc3, 0xf5, 0xf0, 0xe3, 0x09, 0xa5, 0x87, 0x8e, 0xe1, 0x53, 0xe2, 0x12, 0xb3,
-	0x28, 0x3e, 0x9e, 0x10, 0xfd, 0x64, 0xc2, 0x02, 0x1a, 0x25, 0x56, 0xc7, 0xa3, 0xeb, 0x96, 0x5f,
-	0xe2, 0x96, 0xc7, 0x20, 0xc2, 0x33, 0x39, 0x0c, 0xd3, 0xf0, 0x2c, 0x3f, 0x51, 0x53, 0x4e, 0x28,
-	0x8d, 0x72, 0xe1, 0xe5, 0xb4, 0x6a, 0xb9, 0x52, 0xfa, 0xa4, 0xf4, 0x7a, 0x49, 0x61, 0x29, 0xe5,
-	0x71, 0x7f, 0x36, 0x83, 0x0a, 0xeb, 0x8e, 0x66, 0x78, 0xae, 0x70, 0xe8, 0x9f, 0x9e, 0xda, 0x71,
-	0x34, 0x9b, 0x8d, 0x8f, 0x29, 0xb8, 0xcb, 0x7c, 0x47, 0x6b, 0x75, 0xa8, 0x3b, 0xfb, 0x2e, 0x7b,
-	0xbb, 0xbf, 0xef, 0x56, 0x3e, 0xb5, 0x09, 0x9e, 0xac, 0xa9, 0xa6, 0xd5, 0x9e, 0xde, 0x74, 0xb4,
-	0x6d, 0x83, 0x97, 0x4e, 0xd7, 0x5a, 0xd3, 0x1e, 0x6d, 0x51, 0xdb, 0x72, 0xbc, 0x69, 0xcd, 0x36,
-	0xa6, 0xbd, 0x5d, 0x9b, 0xba, 0xd3, 0x81, 0x24, 0xde, 0x02, 0x1b, 0x02, 0x1e, 0xfc, 0x27, 0x0f,
-	0x01, 0x8e, 0xc3, 0xcb, 0x08, 0x89, 0x57, 0xad, 0xda, 0xb6, 0xb8, 0x1d, 0x90, 0x5c, 0x9f, 0x3e,
-	0x86, 0x0f, 0xec, 0x40, 0x61, 0x9a, 0x2d, 0x17, 0xce, 0x91, 0x24, 0xb0, 0x51, 0xb0, 0x2e, 0x9e,
-	0xc8, 0x57, 0xd3, 0x48, 0xa8, 0x71, 0xff, 0x61, 0x53, 0x94, 0x14, 0x67, 0xc3, 0x1b, 0x68, 0x4c,
-	0xc8, 0x0d, 0x62, 0x0b, 0x47, 0xa3, 0x8b, 0x46, 0x0c, 0xcd, 0x07, 0x6d, 0xf0, 0x8c, 0xba, 0x00,
-	0xcb, 0x6d, 0xc4, 0x38, 0xf0, 0x6c, 0x98, 0xb3, 0x04, 0x55, 0x7a, 0x94, 0x31, 0x18, 0xb1, 0x50,
-	0x44, 0xde, 0xe7, 0xe7, 0xc5, 0x7d, 0xe4, 0x32, 0x32, 0x11, 0x16, 0x59, 0x06, 0x1f, 0xf5, 0xe3,
-	0x29, 0x32, 0xe2, 0x63, 0x3e, 0xca, 0x82, 0x6b, 0x68, 0x24, 0x70, 0x4e, 0xdc, 0x65, 0x2b, 0xdb,
-	0x44, 0x58, 0xcf, 0x26, 0x16, 0xb6, 0x28, 0x0b, 0x89, 0xf0, 0xe0, 0x1b, 0xa8, 0xc4, 0xdd, 0xfb,
-	0x75, 0x7e, 0x1f, 0xe1, 0x5f, 0x39, 0x03, 0xac, 0x61, 0xc8, 0x3d, 0x16, 0x10, 0xe2, 0xd7, 0x51,
-	0xb9, 0xfa, 0xee, 0x1a, 0x5b, 0x67, 0xaa, 0x64, 0xd9, 0x55, 0x4e, 0x85, 0x81, 0xde, 0x90, 0xca,
-	0x6c, 0xb5, 0x68, 0x43, 0x73, 0x22, 0x8b, 0x87, 0x4c, 0x8f, 0xe7, 0x51, 0xec, 0xdb, 0xfc, 0xca,
-	0x64, 0xf8, 0xd5, 0x45, 0x0d, 0x30, 0x0d, 0x51, 0xcb, 0x29, 0x92, 0xaf, 0x1d, 0x65, 0x62, 0xa3,
-	0x66, 0xce, 0x70, 0xb5, 0x56, 0xcb, 0xda, 0x21, 0xd4, 0x70, 0xdd, 0x0e, 0x85, 0xcb, 0x8c, 0x12,
-	0x1f, 0x35, 0xba, 0x40, 0x35, 0x1c, 0x8e, 0x8b, 0x64, 0xd3, 0x47, 0xd9, 0xd4, 0xff, 0xcc, 0xc8,
-	0x03, 0x3a, 0xa8, 0xcf, 0x9b, 0x49, 0xad, 0xcf, 0x7b, 0x0d, 0x0d, 0x89, 0x6d, 0x20, 0x88, 0x14,
-	0x85, 0x7c, 0x18, 0x3f, 0x1e, 0xc2, 0xd0, 0x49, 0x48, 0x00, 0xb9, 0x08, 0x61, 0x49, 0x8d, 0x9c,
-	0x94, 0x8b, 0x10, 0x96, 0xd4, 0x88, 0x14, 0xd4, 0x98, 0x41, 0x65, 0x31, 0x98, 0xa5, 0x6c, 0x7b,
-	0x88, 0x69, 0xf0, 0x33, 0xc3, 0x79, 0xc8, 0x84, 0x44, 0x84, 0x5f, 0x45, 0x28, 0xd4, 0xaf, 0xd8,
-	0xb4, 0x60, 0xee, 0xc9, 0xdd, 0x21, 0xcf, 0xbd, 0x90, 0x5a, 0xfd, 0xbb, 0x4c, 0x62, 0xca, 0xb0,
-	0x67, 0x10, 0xd1, 0x37, 0x92, 0x1e, 0xe0, 0x19, 0x44, 0xac, 0x8e, 0x78, 0x06, 0x89, 0x08, 0x5f,
-	0x41, 0xa5, 0x58, 0x25, 0x02, 0x88, 0x36, 0x08, 0xca, 0x10, 0x04, 0x58, 0x3c, 0x83, 0x4a, 0x6c,
-	0x00, 0x33, 0x11, 0x42, 0x21, 0x50, 0xe3, 0xa8, 0x23, 0x60, 0xf2, 0x88, 0xf3, 0xe9, 0x18, 0x4f,
-	0x24, 0x58, 0x58, 0xf0, 0xa4, 0x4c, 0xd7, 0x30, 0x38, 0xf8, 0xf7, 0xb2, 0x7d, 0x4e, 0x17, 0x4f,
-	0x6f, 0x5a, 0x47, 0x90, 0x62, 0x97, 0xef, 0x93, 0x62, 0xf7, 0xef, 0xd9, 0x3e, 0x47, 0xa7, 0xa7,
-	0x3a, 0x15, 0x26, 0x50, 0x46, 0x34, 0x15, 0x26, 0xcc, 0x42, 0x32, 0x74, 0x22, 0x13, 0xc5, 0x92,
-	0xe6, 0x0a, 0x0f, 0x4d, 0x9a, 0xfb, 0xad, 0xdc, 0x5e, 0x47, 0xcb, 0x13, 0xdd, 0xef, 0x47, 0xf7,
-	0x33, 0xa8, 0x1c, 0x68, 0x56, 0x14, 0xc2, 0x19, 0x09, 0x82, 0xc2, 0x38, 0x18, 0x78, 0x24, 0x22,
-	0x7c, 0x95, 0x3f, 0x2b, 0x7c, 0x53, 0xbc, 0x08, 0x0c, 0x50, 0x2b, 0x86, 0x3d, 0x5b, 0xc3, 0x35,
-	0xde, 0xa7, 0x24, 0x40, 0xab, 0x7f, 0x9a, 0x4d, 0x3d, 0x9f, 0x9f, 0xf4, 0xd1, 0x3e, 0xfa, 0x28,
-	0x45, 0x89, 0xdc, 0xb3, 0x70, 0xa2, 0xc4, 0x7d, 0x28, 0xf1, 0x27, 0xd9, 0x54, 0x3f, 0xcc, 0x89,
-	0x12, 0xf7, 0xb3, 0x5a, 0x5c, 0x43, 0x43, 0xc4, 0xda, 0x71, 0x6b, 0x56, 0xc7, 0xf4, 0xc4, 0x5a,
-	0x01, 0x0b, 0xb5, 0x63, 0xed, 0xb8, 0x8d, 0x26, 0x83, 0x92, 0x90, 0x40, 0xfd, 0x69, 0x76, 0x0f,
-	0x4f, 0xd5, 0x89, 0xe2, 0x3f, 0xc4, 0x2d, 0xf2, 0x63, 0x2f, 0xa0, 0xb2, 0xf4, 0x29, 0x59, 0x3c,
-	0x8c, 0x4a, 0x2b, 0xb3, 0x6b, 0xf3, 0xe4, 0x9d, 0xf9, 0xb9, 0xf1, 0x01, 0x8c, 0x50, 0x61, 0x6e,
-	0x7e, 0xb9, 0x3e, 0x3f, 0x37, 0x9e, 0x99, 0x1d, 0xff, 0xe0, 0x1f, 0x2f, 0x0c, 0x7c, 0xf0, 0xe3,
-	0x0b, 0x99, 0xef, 0xff, 0xf8, 0x42, 0xe6, 0x1f, 0x7e, 0x7c, 0x21, 0xb3, 0x51, 0x00, 0x23, 0xf4,
-	0xc6, 0x7f, 0x07, 0x00, 0x00, 0xff, 0xff, 0x7f, 0xeb, 0x35, 0x7a, 0x97, 0x97, 0x00, 0x00,
+	// 6886 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0x7d, 0x5f, 0x6c, 0x24, 0xc9,
+	0x59, 0xb8, 0x67, 0xc6, 0xf3, 0xc7, 0x35, 0xf6, 0xda, 0xae, 0xf5, 0xee, 0xf6, 0xed, 0xed, 0xdd,
+	0xdc, 0xf5, 0x25, 0x7b, 0xbb, 0xb9, 0x3d, 0x3b, 0xbb, 0xb7, 0x77, 0x9b, 0x5c, 0xee, 0x72, 0x3b,
+	0x1e, 0xdb, 0xe7, 0xc9, 0x79, 0x6d, 0x5f, 0xd9, 0x7b, 0x17, 0x29, 0xca, 0x8d, 0xda, 0xd3, 0xb5,
+	0x76, 0x67, 0x67, 0xa6, 0x3b, 0xdd, 0x3d, 0xf6, 0xfa, 0x9e, 0x7e, 0x3f, 0x40, 0x10, 0x45, 0x01,
+	0xa1, 0xf0, 0xc0, 0x03, 0x0f, 0xa0, 0x00, 0x12, 0x48, 0x11, 0x01, 0x84, 0x22, 0x24, 0x78, 0x81,
+	0x00, 0xba, 0x08, 0x25, 0x04, 0x82, 0x40, 0xe2, 0x61, 0x02, 0x41, 0xbc, 0x0c, 0x41, 0x8a, 0x04,
+	0x12, 0x81, 0x27, 0x54, 0x5f, 0x55, 0x77, 0x57, 0x75, 0xf7, 0x78, 0xd7, 0x6b, 0x1f, 0xc6, 0xbb,
+	0x7e, 0xb2, 0xe7, 0xfb, 0x57, 0xdd, 0x5f, 0xfd, 0xfb, 0xea, 0xab, 0xef, 0xfb, 0x1a, 0x8d, 0xd2,
+	0x6d, 0xda, 0xf1, 0xbd, 0x69, 0xc7, 0xb5, 0x7d, 0x1b, 0x17, 0xf8, 0xaf, 0xf3, 0x53, 0x9b, 0xf6,
+	0xa6, 0x0d, 0xa0, 0x19, 0xf6, 0x1f, 0xc7, 0x9e, 0xaf, 0x6c, 0xda, 0xf6, 0x66, 0x8b, 0xce, 0xc0,
+	0xaf, 0x8d, 0xee, 0x9d, 0x19, 0xdf, 0x6a, 0x53, 0xcf, 0x37, 0xda, 0x8e, 0x20, 0xb8, 0x10, 0x27,
+	0xf0, 0x7c, 0xb7, 0xdb, 0xf4, 0x05, 0xb6, 0xb6, 0x69, 0xf9, 0x5b, 0xdd, 0x8d, 0xe9, 0xa6, 0xdd,
+	0x9e, 0xd9, 0x74, 0x8d, 0x6d, 0xcb, 0x37, 0x7c, 0xcb, 0xee, 0x18, 0xad, 0x19, 0x9f, 0xb6, 0xa8,
+	0x63, 0xbb, 0xfe, 0x8c, 0xe1, 0x58, 0x33, 0xfe, 0xae, 0x43, 0xbd, 0x99, 0x1d, 0xd7, 0x70, 0x1c,
+	0xea, 0x46, 0xff, 0x70, 0x21, 0xfa, 0x57, 0xb3, 0xa8, 0x74, 0x8b, 0xfa, 0x86, 0x69, 0xf8, 0x06,
+	0xbe, 0x80, 0xf2, 0xf5, 0x8e, 0x49, 0xef, 0x69, 0x99, 0x67, 0x32, 0x97, 0x72, 0xb3, 0x85, 0x7e,
+	0xaf, 0x92, 0xa5, 0x16, 0xe1, 0x40, 0xfc, 0x14, 0x1a, 0x5e, 0xdf, 0x75, 0xa8, 0x96, 0x7d, 0x26,
+	0x73, 0x69, 0x64, 0x76, 0xa4, 0xdf, 0xab, 0xe4, 0xe1, 0xf5, 0x08, 0x80, 0xf1, 0xb3, 0x28, 0x5b,
+	0x9f, 0xd3, 0x72, 0x80, 0x9c, 0xec, 0xf7, 0x2a, 0x63, 0x5d, 0xcb, 0xbc, 0x62, 0xb7, 0x2d, 0x9f,
+	0xb6, 0x1d, 0x7f, 0x97, 0x64, 0xeb, 0x73, 0xf8, 0x22, 0x1a, 0xae, 0xd9, 0x26, 0xd5, 0x86, 0x81,
+	0x08, 0xf7, 0x7b, 0x95, 0x53, 0x4d, 0xdb, 0xa4, 0x12, 0x15, 0xe0, 0xf1, 0x4d, 0x34, 0xbc, 0x6e,
+	0xb5, 0xa9, 0x96, 0x7f, 0x26, 0x73, 0xa9, 0x7c, 0xed, 0xfc, 0x34, 0x57, 0xc3, 0x74, 0xa0, 0x86,
+	0xe9, 0xf5, 0x40, 0x4f, 0xb3, 0x13, 0x1f, 0xf4, 0x2a, 0x43, 0xfd, 0x5e, 0x65, 0x98, 0xa9, 0xee,
+	0x17, 0x7f, 0x50, 0xc9, 0x10, 0xe0, 0xc4, 0xaf, 0xa1, 0x72, 0xad, 0xd5, 0xf5, 0x7c, 0xea, 0x2e,
+	0x1b, 0x6d, 0xaa, 0x15, 0xa0, 0xc1, 0xf3, 0xfd, 0x5e, 0xe5, 0x6c, 0x93, 0x83, 0x1b, 0x1d, 0xa3,
+	0x2d, 0x37, 0x2c, 0x93, 0xeb, 0x5f, 0x40, 0xe3, 0x6b, 0xd4, 0xf3, 0x2c, 0xbb, 0x13, 0xaa, 0xe6,
+	0xa3, 0x68, 0x44, 0x80, 0xea, 0x73, 0xa0, 0x9e, 0x91, 0xd9, 0x62, 0xbf, 0x57, 0xc9, 0x79, 0x96,
+	0x49, 0x22, 0x0c, 0xfe, 0x38, 0x2a, 0xbe, 0x6b, 0xf9, 0x5b, 0xb7, 0x16, 0xaa, 0x42, 0x4d, 0x67,
+	0xfb, 0xbd, 0x0a, 0xde, 0xb1, 0xfc, 0xad, 0x46, 0xfb, 0x8e, 0x21, 0xb5, 0x17, 0x90, 0xe9, 0xbf,
+	0x91, 0x45, 0xa3, 0xb7, 0x3d, 0xea, 0x86, 0x2d, 0x5d, 0x44, 0xc3, 0xec, 0xb7, 0x68, 0x04, 0x94,
+	0xd4, 0xf5, 0xa8, 0x2b, 0x2b, 0x89, 0xe1, 0xf1, 0x65, 0x94, 0x5f, 0xb2, 0x37, 0xad, 0x8e, 0x68,
+	0xe8, 0x74, 0xbf, 0x57, 0x19, 0x6f, 0x31, 0x80, 0x44, 0xc9, 0x29, 0xf0, 0xa7, 0xd1, 0x68, 0xbd,
+	0xcd, 0x3a, 0xdd, 0xee, 0x18, 0xbe, 0xed, 0x8a, 0x4e, 0x02, 0x75, 0x58, 0x12, 0x5c, 0x62, 0x54,
+	0xe8, 0xf1, 0xab, 0x08, 0x55, 0xdf, 0x5d, 0x23, 0x76, 0x8b, 0x56, 0xc9, 0xb2, 0xe8, 0x3d, 0xe0,
+	0x36, 0x76, 0xbc, 0x86, 0x6b, 0xb7, 0x68, 0xc3, 0x70, 0xe5, 0x66, 0x25, 0x6a, 0x3c, 0x8f, 0x4e,
+	0x55, 0x9b, 0x4d, 0xea, 0x79, 0x84, 0x7e, 0xb1, 0x4b, 0x3d, 0xdf, 0xd3, 0xf2, 0xcf, 0xe4, 0x2e,
+	0x8d, 0xcc, 0x3e, 0xd5, 0xef, 0x55, 0x9e, 0x30, 0x00, 0xd3, 0x70, 0x05, 0x4a, 0x12, 0x11, 0x63,
+	0xd2, 0x7f, 0x37, 0x87, 0x4e, 0xad, 0x51, 0x77, 0x5b, 0x52, 0x54, 0x95, 0xf5, 0x12, 0x83, 0xb0,
+	0x3e, 0xf3, 0x1c, 0xa3, 0x49, 0x85, 0xce, 0xce, 0xf5, 0x7b, 0x95, 0xd3, 0x9d, 0x00, 0x28, 0x09,
+	0x8d, 0xd3, 0xe3, 0xcb, 0xa8, 0xc4, 0x41, 0xf5, 0x39, 0xa1, 0xc6, 0xb1, 0x7e, 0xaf, 0x32, 0xe2,
+	0x01, 0xac, 0x61, 0x99, 0x24, 0x44, 0xb3, 0xf7, 0xe0, 0xff, 0x2f, 0xda, 0x9e, 0xcf, 0x84, 0x0b,
+	0x2d, 0xc2, 0x7b, 0x08, 0x86, 0x2d, 0x81, 0x92, 0xdf, 0x43, 0x65, 0xc2, 0x9f, 0x44, 0x88, 0x43,
+	0xaa, 0xa6, 0xe9, 0x0a, 0x55, 0x3e, 0xd1, 0xef, 0x55, 0xce, 0x08, 0x11, 0x86, 0x69, 0xca, 0xfd,
+	0x20, 0x11, 0xe3, 0x36, 0x1a, 0xe5, 0xbf, 0x96, 0x8c, 0x0d, 0xda, 0xe2, 0x7a, 0x2c, 0x5f, 0xbb,
+	0x34, 0x2d, 0x56, 0x1c, 0x55, 0x3b, 0xd3, 0x32, 0xe9, 0x7c, 0xc7, 0x77, 0x77, 0x67, 0x2b, 0x62,
+	0xae, 0x9c, 0x13, 0x4d, 0xb5, 0x00, 0x27, 0x77, 0xba, 0xcc, 0x73, 0xfe, 0x0d, 0x34, 0x99, 0x90,
+	0x81, 0x27, 0x50, 0xee, 0x2e, 0xdd, 0xe5, 0x7a, 0x26, 0xec, 0x5f, 0x3c, 0x85, 0xf2, 0xdb, 0x46,
+	0xab, 0x2b, 0x96, 0x05, 0xc2, 0x7f, 0xbc, 0x9a, 0xfd, 0x44, 0x46, 0xff, 0xc3, 0x0c, 0xc2, 0x35,
+	0xbb, 0xd3, 0xa1, 0x4d, 0x5f, 0x9e, 0x49, 0xaf, 0xa0, 0x91, 0x25, 0xbb, 0x69, 0xb4, 0x40, 0x01,
+	0xbc, 0xc3, 0xb4, 0x7e, 0xaf, 0x32, 0xc5, 0xde, 0x7c, 0xba, 0xc5, 0x30, 0xd2, 0x23, 0x45, 0xa4,
+	0x4c, 0x73, 0x84, 0xb6, 0x6d, 0x9f, 0x02, 0x63, 0x36, 0xd2, 0x1c, 0x30, 0xba, 0x80, 0x92, 0x35,
+	0x17, 0x11, 0xe3, 0x19, 0x54, 0x5a, 0x65, 0x6b, 0x47, 0xd3, 0x6e, 0x89, 0x5e, 0x83, 0xd9, 0x02,
+	0xeb, 0x89, 0xc4, 0x12, 0x12, 0xe9, 0x3f, 0x95, 0x45, 0x4f, 0xbc, 0xd5, 0xdd, 0xa0, 0x6e, 0x87,
+	0xfa, 0xd4, 0x13, 0x4b, 0x43, 0xf8, 0x06, 0xcb, 0x68, 0x32, 0x81, 0x14, 0x6f, 0xf2, 0x4c, 0xbf,
+	0x57, 0xb9, 0x70, 0x37, 0x44, 0x36, 0xc4, 0x6a, 0x23, 0x35, 0x92, 0x64, 0xc5, 0x8b, 0x68, 0x3c,
+	0x02, 0xb2, 0xb9, 0xed, 0x69, 0x59, 0x98, 0x23, 0x4f, 0xf7, 0x7b, 0x95, 0xf3, 0x92, 0x34, 0xb6,
+	0x0e, 0xc8, 0x1d, 0x16, 0x67, 0xc3, 0x6f, 0xa1, 0x89, 0x08, 0xf4, 0xa6, 0x6b, 0x77, 0x1d, 0x4f,
+	0xcb, 0x81, 0xa8, 0x4a, 0xbf, 0x57, 0x79, 0x52, 0x12, 0xb5, 0x09, 0x48, 0x49, 0x56, 0x82, 0x51,
+	0xff, 0x97, 0x1c, 0x3a, 0x13, 0x01, 0x57, 0x6d, 0x33, 0x54, 0xc0, 0x8a, 0xac, 0x80, 0x55, 0xdb,
+	0x84, 0x35, 0x96, 0x2b, 0xe0, 0xd9, 0x7e, 0xaf, 0xf2, 0x94, 0xd4, 0x8e, 0x63, 0x9b, 0xf1, 0xa5,
+	0x36, 0xc9, 0x8b, 0xdf, 0x43, 0x67, 0x13, 0x40, 0x3e, 0xa3, 0x79, 0x3f, 0x5f, 0xec, 0xf7, 0x2a,
+	0x7a, 0x8a, 0xd4, 0xf8, 0x04, 0x1f, 0x20, 0x05, 0x1b, 0xe8, 0x9c, 0xa4, 0x76, 0xbb, 0xe3, 0x1b,
+	0x56, 0x47, 0x6c, 0x0d, 0x7c, 0x3c, 0x3c, 0xdf, 0xef, 0x55, 0x9e, 0x93, 0xfb, 0x2d, 0xa0, 0x89,
+	0x3f, 0xfc, 0x20, 0x39, 0xd8, 0x44, 0x5a, 0x0a, 0xaa, 0xde, 0x36, 0x36, 0x83, 0xfd, 0xee, 0x52,
+	0xbf, 0x57, 0xf9, 0x48, 0x6a, 0x1b, 0x16, 0xa3, 0x92, 0x1a, 0x19, 0x28, 0x09, 0x13, 0x84, 0x23,
+	0xdc, 0xb2, 0x6d, 0x52, 0x78, 0x87, 0x3c, 0xc8, 0xd7, 0xfb, 0xbd, 0xca, 0xd3, 0x92, 0xfc, 0x8e,
+	0x6d, 0xd2, 0xf8, 0xe3, 0xa7, 0x70, 0xeb, 0x3f, 0xc8, 0xb3, 0x85, 0x05, 0x76, 0xb0, 0x35, 0xdf,
+	0x70, 0x7d, 0xfc, 0x6a, 0x64, 0x12, 0x40, 0xaf, 0x96, 0xaf, 0x4d, 0x04, 0x8b, 0x4c, 0x00, 0x9f,
+	0x1d, 0x65, 0x8b, 0xc9, 0xf7, 0x7a, 0x95, 0x4c, 0xbf, 0x57, 0x19, 0x22, 0x25, 0x69, 0x76, 0xf3,
+	0xdd, 0x2b, 0x0b, 0x7c, 0x53, 0x01, 0x9f, 0xbc, 0xc3, 0xc5, 0x78, 0xf9, 0x6e, 0xf6, 0x06, 0x2a,
+	0x8a, 0x67, 0x80, 0x1e, 0x29, 0x5f, 0x3b, 0x17, 0xad, 0x6b, 0xca, 0x4e, 0x1c, 0xe3, 0x0e, 0xb8,
+	0xf0, 0x6b, 0xa8, 0xc0, 0x97, 0x2b, 0xd0, 0x76, 0xf9, 0xda, 0xd9, 0xf4, 0x75, 0x31, 0xc6, 0x2e,
+	0x78, 0xf0, 0x22, 0x42, 0xd1, 0x52, 0x15, 0xda, 0x1d, 0x42, 0x42, 0x72, 0x11, 0x8b, 0x49, 0x91,
+	0x78, 0xf1, 0x2b, 0x68, 0x74, 0x9d, 0xba, 0x6d, 0xab, 0x63, 0xb4, 0xd6, 0xac, 0xf7, 0x03, 0xd3,
+	0x03, 0xb6, 0x71, 0xcf, 0x7a, 0x5f, 0xee, 0x0b, 0x85, 0x0e, 0x7f, 0x3e, 0x6d, 0x51, 0x29, 0xc2,
+	0x83, 0x3c, 0x1b, 0x3c, 0xc8, 0xc0, 0x25, 0x29, 0xf6, 0x3c, 0x29, 0x6b, 0xcc, 0xdb, 0x68, 0x4c,
+	0x99, 0x1b, 0x5a, 0x09, 0x44, 0x3f, 0x95, 0x14, 0x2d, 0x4d, 0xf4, 0x98, 0x58, 0x55, 0x02, 0xdb,
+	0x11, 0xeb, 0x1d, 0xcb, 0xb7, 0x8c, 0x56, 0xcd, 0x6e, 0xb7, 0x8d, 0x8e, 0xa9, 0x8d, 0x44, 0x3b,
+	0xbb, 0xc5, 0x31, 0x8d, 0x26, 0x47, 0xc9, 0x3b, 0xa2, 0xca, 0xc4, 0xd6, 0x2c, 0xd1, 0x87, 0x84,
+	0x36, 0x6d, 0xd7, 0xb4, 0x3a, 0x9b, 0x1a, 0x02, 0xa5, 0xc1, 0x9a, 0xe5, 0x71, 0x5c, 0xc3, 0x0d,
+	0x90, 0xf2, 0x9a, 0x15, 0x67, 0xfc, 0xcc, 0x70, 0xa9, 0x3c, 0x31, 0x9a, 0x30, 0x1e, 0x7e, 0x3b,
+	0x87, 0xca, 0x82, 0xf4, 0x33, 0xb6, 0xd5, 0x39, 0x19, 0xe0, 0x07, 0x19, 0xe0, 0xa9, 0x03, 0xb5,
+	0x70, 0x58, 0x03, 0x55, 0xff, 0x4a, 0x36, 0x5c, 0x8d, 0x56, 0x5d, 0xab, 0x73, 0xb0, 0xd5, 0xe8,
+	0x22, 0x42, 0xb5, 0xad, 0x6e, 0xe7, 0x2e, 0x3f, 0xd5, 0x64, 0xa3, 0x53, 0x4d, 0xd3, 0x22, 0x12,
+	0x86, 0x1d, 0x6d, 0xe6, 0x98, 0x7c, 0xd6, 0x33, 0xa3, 0xb3, 0x23, 0x1f, 0x70, 0x49, 0x99, 0x17,
+	0x09, 0x80, 0x71, 0x05, 0xe5, 0x67, 0x77, 0x7d, 0xea, 0x81, 0xe6, 0x73, 0xfc, 0xe8, 0xb3, 0xc1,
+	0x00, 0x84, 0xc3, 0xf1, 0x75, 0x34, 0x39, 0x47, 0x5b, 0xc6, 0xee, 0x2d, 0xab, 0xd5, 0xb2, 0x3c,
+	0xda, 0xb4, 0x3b, 0xa6, 0x07, 0x4a, 0x16, 0xcd, 0xb5, 0x3d, 0x92, 0x24, 0xc0, 0x3a, 0x2a, 0xac,
+	0xdc, 0xb9, 0xe3, 0x51, 0x1f, 0xd4, 0x97, 0x9b, 0x45, 0xfd, 0x5e, 0xa5, 0x60, 0x03, 0x84, 0x08,
+	0x8c, 0xfe, 0x8d, 0x0c, 0x9a, 0x98, 0xa3, 0xde, 0x5d, 0xdf, 0x76, 0xc2, 0x51, 0x7e, 0x20, 0x95,
+	0x5c, 0x46, 0xc5, 0x5b, 0xd4, 0xf3, 0xd8, 0xb6, 0x94, 0x85, 0xb7, 0x1d, 0x17, 0x6f, 0x5b, 0x6c,
+	0x73, 0x30, 0x09, 0xf0, 0xe9, 0x6f, 0x95, 0xbb, 0xcf, 0x5b, 0xe9, 0x3f, 0xce, 0xa2, 0x73, 0xe2,
+	0x89, 0x6b, 0x2d, 0xcb, 0xd9, 0xb0, 0x0d, 0xd7, 0x24, 0xb4, 0x49, 0xad, 0x6d, 0x7a, 0x3c, 0x27,
+	0x9e, 0x3a, 0x75, 0x86, 0x0f, 0x30, 0x75, 0xae, 0xa1, 0xb2, 0xd0, 0x0c, 0xd8, 0xb0, 0x7c, 0xdb,
+	0x9e, 0xe8, 0xf7, 0x2a, 0xa3, 0x26, 0x07, 0x83, 0xf9, 0x4f, 0x64, 0x22, 0x36, 0x48, 0x96, 0x68,
+	0x67, 0xd3, 0xdf, 0x82, 0x41, 0x92, 0xe7, 0x83, 0xa4, 0x05, 0x10, 0x22, 0x30, 0xfa, 0xbf, 0x65,
+	0xd1, 0x54, 0x5c, 0xe5, 0x6b, 0xb4, 0x63, 0x9e, 0xe8, 0xfb, 0xc3, 0xd1, 0xf7, 0xdf, 0x64, 0xd1,
+	0x58, 0xb8, 0xf5, 0x7c, 0x81, 0x36, 0x8f, 0xc6, 0x64, 0x8a, 0x36, 0x84, 0xdc, 0x81, 0x37, 0x84,
+	0x83, 0x68, 0x59, 0x47, 0x05, 0x42, 0x0d, 0x4f, 0x6c, 0x2b, 0x23, 0x5c, 0x63, 0x2e, 0x40, 0x88,
+	0xc0, 0xe0, 0x67, 0x51, 0xf1, 0x96, 0x71, 0xcf, 0x6a, 0x77, 0xdb, 0x62, 0xad, 0x03, 0xe7, 0x49,
+	0xdb, 0xb8, 0x47, 0x02, 0xb8, 0xfe, 0xb7, 0x19, 0x76, 0xc2, 0x06, 0xa5, 0x0a, 0xe1, 0x07, 0xd2,
+	0x6a, 0xa4, 0x9d, 0xec, 0x81, 0xb5, 0x93, 0x7b, 0x78, 0xed, 0xe8, 0xdf, 0x18, 0x66, 0xea, 0x61,
+	0xa6, 0xdf, 0xe3, 0x3e, 0x1b, 0xa3, 0x1e, 0xc9, 0x3f, 0x44, 0x8f, 0x3c, 0x36, 0x76, 0xb5, 0xfe,
+	0x9f, 0x45, 0x84, 0x84, 0xf6, 0xe7, 0x4f, 0xd6, 0xf0, 0x83, 0x8d, 0x9a, 0x39, 0x34, 0x39, 0xdf,
+	0xd9, 0x32, 0x3a, 0x4d, 0x6a, 0x46, 0xa7, 0x0b, 0x36, 0x74, 0x4a, 0xdc, 0x33, 0x4b, 0x05, 0x32,
+	0x3a, 0x5e, 0x90, 0x24, 0x03, 0xbe, 0x8a, 0xca, 0xf5, 0x8e, 0x4f, 0x5d, 0xa3, 0xe9, 0x5b, 0xdb,
+	0x14, 0x46, 0x4f, 0x69, 0x76, 0xbc, 0xdf, 0xab, 0x94, 0xad, 0x08, 0x4c, 0x64, 0x1a, 0x7c, 0x1d,
+	0x8d, 0xae, 0x1a, 0xae, 0x6f, 0x35, 0x2d, 0xc7, 0xe8, 0xf8, 0x9e, 0x56, 0x82, 0xa3, 0x11, 0xec,
+	0x3d, 0x8e, 0x04, 0x27, 0x0a, 0x15, 0xfe, 0x3c, 0x1a, 0x81, 0x23, 0x38, 0x78, 0xbf, 0x47, 0xee,
+	0xeb, 0xfd, 0x7e, 0x2e, 0xf2, 0xe8, 0xf1, 0x43, 0x92, 0xc7, 0x98, 0xa3, 0xa9, 0x00, 0x0e, 0xf1,
+	0x48, 0x22, 0xfe, 0x2c, 0x2a, 0xce, 0x77, 0x4c, 0x10, 0x8e, 0xee, 0x2b, 0x5c, 0x17, 0xc2, 0xcf,
+	0x46, 0xc2, 0x6d, 0x27, 0x26, 0x3b, 0x10, 0x97, 0x3e, 0xcb, 0xca, 0x1f, 0xde, 0x2c, 0x1b, 0xfd,
+	0x10, 0x4e, 0xaf, 0x63, 0x87, 0x75, 0x7a, 0x3d, 0xf5, 0x90, 0xa7, 0x57, 0xfd, 0x7d, 0x54, 0x9e,
+	0x5d, 0x5d, 0x08, 0x67, 0xef, 0x13, 0x28, 0xb7, 0x2a, 0x6e, 0x1b, 0x86, 0xf9, 0x86, 0xe9, 0x58,
+	0x26, 0x61, 0x30, 0x7c, 0x19, 0x95, 0x6a, 0xe0, 0xc2, 0x13, 0x8e, 0xeb, 0x61, 0xee, 0xb8, 0x6e,
+	0x02, 0x0c, 0x1c, 0xd7, 0x01, 0x1a, 0x7f, 0x14, 0x15, 0x57, 0x5d, 0x7b, 0xd3, 0x35, 0xda, 0xc2,
+	0xd7, 0x55, 0x66, 0xc6, 0xbe, 0xc3, 0x41, 0x24, 0xc0, 0xe9, 0xbf, 0x94, 0x41, 0x85, 0x35, 0xdf,
+	0xf0, 0xbb, 0x1e, 0xe3, 0x58, 0xeb, 0xc2, 0x09, 0x1a, 0xda, 0x2e, 0x71, 0x0e, 0x8f, 0x83, 0x48,
+	0x80, 0xc3, 0x97, 0x51, 0x7e, 0xde, 0x75, 0x6d, 0x57, 0xbe, 0x80, 0xa0, 0x0c, 0x20, 0x5f, 0x40,
+	0x00, 0x05, 0xbe, 0x81, 0xca, 0x7c, 0xcd, 0xe1, 0x07, 0x0f, 0xfe, 0x1c, 0x67, 0xfa, 0xbd, 0xca,
+	0xa4, 0x38, 0x74, 0xc8, 0x37, 0x31, 0x12, 0xa5, 0xfe, 0xad, 0x9c, 0x64, 0x14, 0x70, 0x8d, 0x3f,
+	0x86, 0x87, 0xf7, 0x97, 0x50, 0x6e, 0x76, 0x75, 0x41, 0x2c, 0x80, 0xa7, 0x03, 0x56, 0x69, 0xa8,
+	0xc4, 0xf8, 0x18, 0x35, 0xbe, 0x80, 0x86, 0x57, 0xd9, 0xf0, 0x29, 0xc0, 0xf0, 0x28, 0xf5, 0x7b,
+	0x95, 0x61, 0x87, 0x8d, 0x1f, 0x80, 0x02, 0xd6, 0xf0, 0xb7, 0x60, 0x2d, 0x1b, 0x11, 0x58, 0xc3,
+	0xdf, 0x22, 0x00, 0x65, 0xd8, 0xaa, 0xbb, 0xb9, 0x2d, 0x56, 0x2d, 0xc0, 0x1a, 0xee, 0xe6, 0x36,
+	0x01, 0x28, 0x9e, 0x41, 0x88, 0x50, 0xbf, 0xeb, 0x76, 0xe0, 0x32, 0x6f, 0x04, 0xcc, 0x64, 0x58,
+	0x0d, 0x5d, 0x80, 0x36, 0x9a, 0xb6, 0x49, 0x89, 0x44, 0xa2, 0xff, 0x66, 0xe4, 0x7f, 0x99, 0xb3,
+	0xbc, 0xbb, 0x27, 0x5d, 0xb8, 0x8f, 0x2e, 0x34, 0xc4, 0x49, 0x24, 0xd9, 0x49, 0x15, 0x94, 0x5f,
+	0x68, 0x19, 0x9b, 0x1e, 0xf4, 0x61, 0x9e, 0x7b, 0x25, 0xee, 0x30, 0x00, 0xe1, 0xf0, 0x58, 0x3f,
+	0x95, 0xee, 0xdf, 0x4f, 0xbf, 0x9c, 0x0f, 0x67, 0xdb, 0x32, 0xf5, 0x77, 0x6c, 0xf7, 0xa4, 0xab,
+	0x1e, 0xb4, 0xab, 0x2e, 0xa2, 0xe2, 0x9a, 0xdb, 0x84, 0x63, 0x26, 0xef, 0xad, 0xd1, 0x7e, 0xaf,
+	0x52, 0xf2, 0xdc, 0x26, 0x3f, 0x62, 0x06, 0x48, 0x46, 0x37, 0xe7, 0xf9, 0x40, 0x57, 0x8c, 0xe8,
+	0x4c, 0xcf, 0x17, 0x74, 0x02, 0x29, 0xe8, 0x56, 0x6d, 0xd7, 0x17, 0x1d, 0x17, 0xd2, 0x39, 0xb6,
+	0xeb, 0x93, 0x00, 0x89, 0x5f, 0x40, 0x68, 0xbd, 0xb6, 0xfa, 0x0e, 0x75, 0x41, 0x5d, 0x7c, 0x2e,
+	0xc2, 0x72, 0xbd, 0xcd, 0x41, 0x44, 0x42, 0xe3, 0x75, 0x34, 0xb2, 0xe2, 0x50, 0x17, 0xc2, 0x04,
+	0xc0, 0x02, 0x38, 0x75, 0xed, 0xf9, 0x98, 0x6a, 0x45, 0xbf, 0x4f, 0x8b, 0xbf, 0x21, 0x39, 0xdf,
+	0x5f, 0xec, 0xe0, 0x27, 0x89, 0x04, 0xe1, 0x1b, 0xa8, 0x50, 0xe5, 0x76, 0x5e, 0x19, 0x44, 0x86,
+	0x2a, 0x9b, 0x67, 0x7f, 0x38, 0x8a, 0x1f, 0x0a, 0x0d, 0xf8, 0x9f, 0x08, 0x72, 0xfd, 0x32, 0x9a,
+	0x88, 0x37, 0x83, 0xcb, 0xa8, 0x58, 0x5b, 0x59, 0x5e, 0x9e, 0xaf, 0xad, 0x4f, 0x0c, 0xe1, 0x12,
+	0x1a, 0x5e, 0x9b, 0x5f, 0x9e, 0x9b, 0xc8, 0xe8, 0x5f, 0x97, 0x56, 0x10, 0x36, 0xb4, 0x4e, 0x3c,
+	0xb8, 0x07, 0x72, 0x8b, 0x4c, 0x80, 0xdb, 0x72, 0xdd, 0x35, 0x3a, 0x5e, 0xdb, 0xf2, 0x7d, 0x6a,
+	0x8a, 0x5d, 0x02, 0xdc, 0x7a, 0xfe, 0x3d, 0x92, 0xc0, 0xe3, 0x2b, 0x68, 0x0c, 0x60, 0xc2, 0x93,
+	0x67, 0xc2, 0xe8, 0x15, 0x0c, 0xee, 0x3d, 0xa2, 0x22, 0xf5, 0xbf, 0x8c, 0x9c, 0xb8, 0x4b, 0xd4,
+	0x38, 0xae, 0x8e, 0xbf, 0xff, 0x23, 0xfd, 0xa5, 0xff, 0x7a, 0x0e, 0x8d, 0xb0, 0x37, 0xe2, 0xc1,
+	0x1c, 0x47, 0xa1, 0xca, 0xeb, 0x81, 0x6d, 0x28, 0x34, 0x79, 0x2a, 0xd4, 0x04, 0x40, 0x13, 0x1a,
+	0xe0, 0x76, 0xe4, 0x15, 0x54, 0xb8, 0x45, 0xfd, 0x2d, 0xdb, 0x14, 0x17, 0xa0, 0x53, 0xfd, 0x5e,
+	0x65, 0xa2, 0x0d, 0x10, 0xc9, 0xde, 0x13, 0x34, 0xf8, 0x2e, 0xc2, 0x75, 0x93, 0x76, 0x7c, 0xcb,
+	0xdf, 0xad, 0xfa, 0xbe, 0x6b, 0x6d, 0x74, 0x7d, 0xea, 0x09, 0xbd, 0x9d, 0x4b, 0x9c, 0x53, 0xd6,
+	0x20, 0x12, 0x0a, 0xee, 0x3c, 0xa7, 0x8c, 0x90, 0x3c, 0x12, 0xfb, 0xdf, 0xbd, 0x4a, 0x81, 0xd3,
+	0x90, 0x14, 0xb1, 0xf8, 0x6d, 0x34, 0x72, 0x6b, 0xa1, 0x3a, 0x47, 0xb7, 0xad, 0x26, 0x15, 0x97,
+	0x17, 0x4f, 0x84, 0x5a, 0x0c, 0x10, 0xa1, 0x4a, 0x20, 0x3e, 0xa1, 0x7d, 0xc7, 0x68, 0x98, 0x00,
+	0x97, 0xe3, 0x13, 0x42, 0x62, 0xfd, 0x47, 0x19, 0x34, 0x41, 0xa8, 0x67, 0x77, 0xdd, 0x88, 0x13,
+	0x5f, 0x44, 0xc3, 0xd2, 0xe5, 0x38, 0x78, 0x2b, 0x62, 0x37, 0xb2, 0x80, 0xc7, 0x6b, 0xa8, 0x38,
+	0x7f, 0xcf, 0xb1, 0x5c, 0xea, 0x89, 0xbe, 0xd9, 0xeb, 0x64, 0xf6, 0x94, 0x38, 0x99, 0x4d, 0x52,
+	0xce, 0x92, 0x38, 0x94, 0x71, 0x30, 0x7e, 0x05, 0x8d, 0xdc, 0x76, 0x4c, 0xc3, 0xa7, 0xe6, 0xec,
+	0xae, 0xb0, 0xb9, 0xe1, 0x4d, 0xba, 0x1c, 0xd8, 0xd8, 0xd8, 0x95, 0xdf, 0x24, 0x24, 0xc5, 0xcf,
+	0xa1, 0xdc, 0xfa, 0xfa, 0x92, 0xe8, 0x34, 0x08, 0xe5, 0xf2, 0x7d, 0x39, 0x28, 0x83, 0x61, 0xf5,
+	0xaf, 0x66, 0x11, 0x62, 0x63, 0xa3, 0xe6, 0x52, 0xc3, 0x3f, 0x9a, 0x09, 0x3e, 0x8b, 0x4a, 0x81,
+	0xc2, 0xc5, 0xb8, 0xd4, 0x02, 0xde, 0x78, 0x47, 0xc4, 0xdb, 0x0e, 0xf0, 0xcc, 0x88, 0x22, 0x76,
+	0x0b, 0xae, 0x76, 0x72, 0x41, 0x54, 0x9b, 0xcb, 0x00, 0x84, 0xc3, 0xf1, 0x0b, 0x68, 0x44, 0x4c,
+	0x45, 0x3b, 0xf0, 0x20, 0xf3, 0xa3, 0x56, 0x00, 0x24, 0x11, 0x5e, 0xff, 0xb3, 0x0c, 0x57, 0xca,
+	0x1c, 0x6d, 0xd1, 0xe3, 0xab, 0x14, 0xfd, 0x4b, 0x19, 0x84, 0x99, 0xb0, 0x55, 0xc3, 0xf3, 0x76,
+	0x6c, 0xd7, 0xac, 0x6d, 0x19, 0x9d, 0xcd, 0x23, 0x79, 0x1d, 0xfd, 0xcb, 0x79, 0x74, 0x5a, 0xb9,
+	0xcd, 0x3d, 0xe6, 0xe3, 0xed, 0xb2, 0x3a, 0xde, 0xe0, 0xd0, 0x0c, 0xe3, 0x4d, 0x3e, 0x34, 0xf3,
+	0x91, 0xf7, 0x11, 0x34, 0x22, 0xde, 0xb9, 0x3e, 0x27, 0x46, 0x1e, 0x6c, 0xb7, 0x96, 0x49, 0x22,
+	0x04, 0x7e, 0x11, 0x8d, 0x8a, 0x1f, 0x6c, 0xd5, 0x0d, 0xfc, 0xa2, 0x30, 0x8e, 0x3d, 0x06, 0x20,
+	0x0a, 0x1a, 0xbf, 0x8c, 0x46, 0xd8, 0xe0, 0xdc, 0x84, 0x38, 0xc0, 0x62, 0x14, 0x2e, 0x67, 0x06,
+	0x40, 0x79, 0x49, 0x08, 0x29, 0xd9, 0x52, 0x2e, 0x7c, 0xfc, 0xa5, 0x68, 0x29, 0xe7, 0x3e, 0x7e,
+	0x79, 0x29, 0x17, 0xde, 0xfe, 0xf7, 0x50, 0xb9, 0xda, 0xe9, 0xd8, 0x3c, 0x1e, 0xd5, 0x13, 0x8e,
+	0xac, 0x81, 0x6b, 0xf8, 0x73, 0x10, 0xc4, 0x15, 0xd1, 0xa7, 0x2e, 0xe2, 0xb2, 0x40, 0x7c, 0x8d,
+	0x75, 0xc4, 0xb6, 0x45, 0x77, 0xa8, 0x2b, 0x42, 0x05, 0xc0, 0x99, 0xe7, 0x0a, 0x98, 0x1c, 0xd2,
+	0x15, 0xd0, 0xe1, 0x59, 0x34, 0xb6, 0xea, 0xda, 0x8e, 0xed, 0x51, 0x93, 0x2b, 0xaa, 0x0c, 0x8c,
+	0x17, 0xfa, 0xbd, 0x8a, 0xe6, 0x08, 0x44, 0x03, 0x34, 0x26, 0xb1, 0xab, 0x2c, 0xfa, 0x37, 0x32,
+	0xb1, 0xc1, 0x78, 0x84, 0xf3, 0x5c, 0x19, 0x1d, 0xb9, 0x01, 0xa3, 0x43, 0xff, 0xd5, 0x2c, 0x2a,
+	0xb3, 0x73, 0xc2, 0x82, 0xed, 0xee, 0x18, 0xee, 0xd1, 0x38, 0x4f, 0x0e, 0xed, 0x2e, 0x45, 0x32,
+	0x43, 0x86, 0xf7, 0x61, 0x86, 0x5c, 0x40, 0xc3, 0xd2, 0xf5, 0x1f, 0x77, 0x66, 0xb0, 0xb3, 0x16,
+	0x40, 0xf5, 0xff, 0x97, 0x45, 0xe8, 0xb3, 0x57, 0xaf, 0x3e, 0xc6, 0x0a, 0xd2, 0x7f, 0x25, 0x83,
+	0xc6, 0x85, 0x77, 0x4d, 0x8a, 0x77, 0x2e, 0x06, 0x7e, 0xd1, 0x4c, 0xe4, 0x35, 0x14, 0xfe, 0x50,
+	0x12, 0xe0, 0xd8, 0x4c, 0x9c, 0xbf, 0x67, 0xf9, 0xe0, 0x60, 0x90, 0x02, 0x9e, 0xa9, 0x80, 0xc9,
+	0x33, 0x31, 0xa0, 0xc3, 0x2f, 0x06, 0x7e, 0xc3, 0x5c, 0xb4, 0xfc, 0x30, 0x86, 0xf9, 0x54, 0xdf,
+	0xa1, 0xfe, 0xcd, 0x61, 0x34, 0x3c, 0x7f, 0x8f, 0x36, 0x8f, 0x79, 0xd7, 0x48, 0xa7, 0x91, 0xe1,
+	0x03, 0x9e, 0x46, 0x1e, 0xe6, 0x22, 0xe4, 0x8d, 0xa8, 0x3f, 0x0b, 0x6a, 0xf3, 0xb1, 0x9e, 0x8f,
+	0x37, 0x1f, 0xf4, 0xf4, 0xf1, 0xbb, 0x47, 0xfb, 0xf3, 0x1c, 0xca, 0xad, 0xd5, 0x56, 0x4f, 0xc6,
+	0xcd, 0x91, 0x8e, 0x9b, 0xbd, 0x1d, 0xcd, 0x7a, 0xe8, 0x3b, 0x2a, 0x45, 0xb1, 0x03, 0x31, 0x37,
+	0xd1, 0x57, 0xb2, 0x68, 0x64, 0xad, 0xbb, 0xe1, 0xed, 0x7a, 0x3e, 0x6d, 0x1f, 0xf3, 0xde, 0xbc,
+	0x20, 0xce, 0x83, 0xc3, 0x91, 0x36, 0xd8, 0x79, 0x50, 0x9c, 0x02, 0x9f, 0x0b, 0x56, 0x46, 0xe9,
+	0x9c, 0x11, 0xae, 0x8c, 0xc1, 0x7a, 0xf8, 0xfb, 0x59, 0x34, 0x51, 0x6b, 0x59, 0xb4, 0xe3, 0xcf,
+	0x59, 0x5e, 0xf3, 0x10, 0x22, 0x25, 0x8e, 0x5e, 0x2b, 0x07, 0x73, 0xb4, 0x3c, 0x40, 0xfc, 0x89,
+	0xfe, 0xff, 0xb3, 0xa8, 0x5c, 0xed, 0xfa, 0x5b, 0x55, 0x1f, 0x36, 0x97, 0xc7, 0x72, 0x9b, 0xff,
+	0x76, 0x06, 0x8d, 0xb3, 0x07, 0x59, 0xb7, 0xef, 0xd2, 0xce, 0x21, 0x1c, 0xa3, 0xe4, 0xe3, 0x50,
+	0xf6, 0x21, 0x8f, 0x43, 0x81, 0x2e, 0x73, 0xfb, 0x3c, 0x16, 0xb2, 0x83, 0x36, 0x3b, 0x25, 0x3d,
+	0x22, 0xaf, 0x71, 0x08, 0xe7, 0x88, 0xa3, 0x7c, 0x8d, 0xef, 0x66, 0xd0, 0xd4, 0xba, 0xcb, 0x36,
+	0x72, 0x53, 0xec, 0xe7, 0xc7, 0xbc, 0x5f, 0x92, 0x2f, 0x74, 0xcc, 0x7b, 0xe8, 0xfb, 0x19, 0xf4,
+	0x84, 0xfa, 0x42, 0x8f, 0xc2, 0x2a, 0xf0, 0x57, 0x19, 0x74, 0xe6, 0x4d, 0x48, 0x82, 0x0d, 0x5d,
+	0x70, 0x8f, 0xde, 0x1b, 0x1d, 0xf3, 0x91, 0xf7, 0x9d, 0x0c, 0x3a, 0xbd, 0x52, 0x9f, 0xab, 0x3d,
+	0x2a, 0x3d, 0x94, 0x78, 0x9f, 0x47, 0xa0, 0x7f, 0xd6, 0xaa, 0xb7, 0x96, 0x1e, 0xa5, 0xfe, 0x51,
+	0xde, 0xe7, 0x98, 0xf7, 0xcf, 0x4f, 0x17, 0x50, 0x99, 0x9d, 0x6b, 0x85, 0x4f, 0xef, 0xb1, 0xb6,
+	0xf4, 0xaf, 0xa1, 0xb2, 0x50, 0x03, 0x1c, 0x29, 0xa5, 0x78, 0x7e, 0x91, 0x41, 0xde, 0x80, 0xa3,
+	0xa5, 0x4c, 0xc4, 0x4e, 0x5c, 0xef, 0x50, 0x77, 0x43, 0x8e, 0xa1, 0xd9, 0xa6, 0xee, 0x06, 0x01,
+	0x28, 0x5e, 0x8a, 0xee, 0xec, 0xaa, 0xab, 0x75, 0x48, 0x7c, 0x15, 0x27, 0x55, 0xc8, 0xe4, 0x75,
+	0x05, 0xae, 0x61, 0x38, 0x16, 0x4f, 0x99, 0x95, 0xe3, 0xf7, 0xe2, 0x9c, 0x78, 0x19, 0x4d, 0x06,
+	0xb0, 0x28, 0x83, 0xb5, 0x94, 0x22, 0x2e, 0x2d, 0x77, 0x35, 0xc9, 0x8a, 0xdf, 0x40, 0xa3, 0x01,
+	0xf0, 0x2d, 0x0b, 0xf2, 0xeb, 0x98, 0xa8, 0x27, 0xfb, 0xbd, 0xca, 0xb9, 0x50, 0xd4, 0x5d, 0x4b,
+	0x89, 0x4f, 0x54, 0x18, 0x64, 0x01, 0x70, 0xec, 0x44, 0x29, 0x02, 0x62, 0xf7, 0x91, 0x0a, 0x03,
+	0x7e, 0x19, 0x04, 0x38, 0x76, 0xc7, 0xa3, 0xe0, 0xe3, 0x2b, 0x43, 0x80, 0x09, 0xdc, 0x09, 0xba,
+	0x02, 0xce, 0xc3, 0x88, 0x14, 0x32, 0xbc, 0x82, 0x50, 0xe4, 0x8b, 0x11, 0xc1, 0x9a, 0xfb, 0xf6,
+	0x12, 0x49, 0x22, 0xf4, 0xbf, 0x66, 0xe7, 0x37, 0xc7, 0x09, 0x47, 0xf2, 0x8b, 0xa8, 0x50, 0x75,
+	0x9c, 0xdb, 0xa4, 0x2e, 0xbc, 0x93, 0x10, 0x4b, 0x68, 0x38, 0x4e, 0xa3, 0xeb, 0x5a, 0xf2, 0x85,
+	0x04, 0x27, 0xc2, 0x35, 0x34, 0x56, 0x75, 0x9c, 0xd5, 0xee, 0x46, 0xcb, 0x6a, 0x4a, 0xe9, 0xe3,
+	0xbc, 0x06, 0x81, 0xe3, 0x34, 0x1c, 0xc0, 0xc4, 0x93, 0xef, 0x55, 0x1e, 0xfc, 0x1e, 0x1a, 0xa9,
+	0x3a, 0x8e, 0x48, 0xbe, 0xcf, 0x41, 0xf2, 0xbd, 0x1e, 0xbc, 0x93, 0xf4, 0x6c, 0xd3, 0x21, 0x11,
+	0x4f, 0xbb, 0xbf, 0x20, 0x6e, 0x6b, 0xa7, 0x58, 0x43, 0x89, 0x9c, 0xfb, 0x48, 0x24, 0xfe, 0x38,
+	0x2a, 0x56, 0x1d, 0x47, 0x72, 0x0f, 0x80, 0x2b, 0x95, 0x71, 0xc5, 0xba, 0x28, 0x20, 0x3b, 0xff,
+	0x1a, 0x3a, 0xa5, 0x36, 0xb6, 0xaf, 0xfc, 0xfc, 0x9f, 0x64, 0xe0, 0x85, 0x8e, 0xf9, 0x85, 0xda,
+	0x4b, 0x28, 0x57, 0x75, 0x1c, 0xb1, 0x9c, 0x9c, 0x4e, 0xe9, 0x8f, 0x78, 0xb4, 0x56, 0xd5, 0x71,
+	0x82, 0x57, 0xe7, 0x57, 0xde, 0x8f, 0xd7, 0xab, 0x7f, 0x8b, 0xbf, 0xfa, 0x31, 0xbf, 0xa1, 0xfe,
+	0x66, 0x0e, 0x8d, 0x57, 0x1d, 0xe7, 0x24, 0x6d, 0xfd, 0xb0, 0x62, 0xc2, 0xae, 0x22, 0x24, 0x2d,
+	0x8f, 0xc5, 0x30, 0xf4, 0xa3, 0x2c, 0x2d, 0x8d, 0x5a, 0x86, 0x48, 0x44, 0xc1, 0xf0, 0x2b, 0xed,
+	0x6b, 0xf8, 0xfd, 0x89, 0xd2, 0x71, 0x90, 0x82, 0x7b, 0xd2, 0x71, 0xf9, 0x03, 0x59, 0x54, 0xa7,
+	0x64, 0x65, 0x8a, 0x80, 0x6f, 0x71, 0x43, 0x1f, 0xa4, 0x1f, 0x34, 0x19, 0xaa, 0x61, 0x99, 0x24,
+	0x46, 0x1b, 0xf4, 0x61, 0x71, 0x5f, 0x7d, 0xf8, 0xb5, 0x2c, 0x9a, 0x8c, 0xfa, 0xf0, 0x30, 0x0c,
+	0xd3, 0x19, 0x84, 0xb8, 0x93, 0x32, 0xbc, 0x48, 0x1c, 0xe3, 0x91, 0xca, 0x1e, 0x40, 0x45, 0xa4,
+	0x72, 0x44, 0x12, 0xde, 0x2a, 0xe4, 0x52, 0x6f, 0x15, 0x2e, 0xa3, 0x12, 0x31, 0x76, 0xde, 0xee,
+	0x52, 0x77, 0x57, 0x6c, 0xa5, 0xe0, 0x4a, 0x77, 0x8d, 0x9d, 0xc6, 0x17, 0x19, 0x90, 0x84, 0x68,
+	0xac, 0x87, 0x31, 0x6a, 0x92, 0xf3, 0x98, 0xc7, 0xa8, 0x85, 0x91, 0x69, 0x42, 0x49, 0x85, 0x7d,
+	0x29, 0xe9, 0xfb, 0x05, 0x34, 0x31, 0x67, 0xf8, 0xc6, 0x86, 0xe1, 0x51, 0xe9, 0x20, 0x31, 0x1e,
+	0xc0, 0xd8, 0x40, 0xb0, 0xc2, 0x92, 0x45, 0x10, 0x97, 0x65, 0x6e, 0x34, 0x3c, 0x0e, 0x95, 0x6b,
+	0xbc, 0xc4, 0x18, 0xf0, 0xa7, 0x22, 0xb9, 0x61, 0x51, 0x1b, 0x6e, 0xce, 0x80, 0xc6, 0xcc, 0x8d,
+	0x86, 0x23, 0xc0, 0x24, 0x41, 0x88, 0xaf, 0xa0, 0x72, 0x00, 0x63, 0xc6, 0x53, 0x2e, 0x7a, 0x67,
+	0x73, 0x83, 0xd9, 0x4e, 0x44, 0x46, 0xe3, 0x4f, 0xa2, 0xd1, 0xe0, 0xa7, 0x64, 0x96, 0x80, 0xad,
+	0x65, 0x6e, 0x24, 0x0c, 0x47, 0x99, 0x54, 0x66, 0x85, 0xf9, 0x99, 0x57, 0x58, 0x63, 0x05, 0xad,
+	0x14, 0x52, 0xfc, 0x45, 0x74, 0x2a, 0xf8, 0x2d, 0x8c, 0xad, 0x02, 0x18, 0x5b, 0x57, 0x02, 0xcd,
+	0xc7, 0xd5, 0x3a, 0xad, 0x92, 0x73, 0xb3, 0xeb, 0x49, 0x61, 0x76, 0x9d, 0x36, 0x37, 0x92, 0x56,
+	0x57, 0xac, 0x01, 0x5c, 0x47, 0x93, 0x01, 0xa4, 0xfa, 0xee, 0x1a, 0xa1, 0x9b, 0x6c, 0x56, 0x16,
+	0x23, 0x63, 0xd9, 0xdc, 0x68, 0x40, 0xa9, 0x2b, 0x40, 0xc8, 0x36, 0x7b, 0x82, 0x0b, 0xb7, 0xd0,
+	0x05, 0x05, 0x68, 0x7a, 0x5b, 0xd6, 0x1d, 0x5f, 0x58, 0xba, 0xf5, 0x39, 0x71, 0x1c, 0x80, 0x5a,
+	0x30, 0xa1, 0x54, 0x4e, 0x13, 0x14, 0x0b, 0x6a, 0x28, 0x75, 0xd3, 0xf6, 0x94, 0x86, 0xd7, 0xd0,
+	0x54, 0x80, 0x7f, 0xb3, 0xb6, 0xba, 0xea, 0xda, 0x5f, 0xa0, 0x4d, 0xbf, 0x3e, 0x27, 0x4e, 0x0a,
+	0x90, 0x82, 0x64, 0x6e, 0x34, 0x36, 0x9b, 0x0e, 0x1b, 0x14, 0x0c, 0xa7, 0x0a, 0x4f, 0x65, 0xc6,
+	0xef, 0xa0, 0x33, 0x12, 0xbc, 0xde, 0xf1, 0x7c, 0xa3, 0xd3, 0xa4, 0xf5, 0x39, 0x71, 0x7c, 0x80,
+	0xa3, 0x8c, 0x90, 0x6a, 0x09, 0xa4, 0x2a, 0x36, 0x9d, 0xfd, 0x7c, 0x15, 0x9d, 0x4e, 0xe9, 0xa9,
+	0x7d, 0xd9, 0xac, 0x5f, 0xc9, 0x46, 0x83, 0xe3, 0x98, 0x1b, 0xae, 0xb3, 0xa8, 0x14, 0xbc, 0x89,
+	0xd8, 0x42, 0xb4, 0x41, 0x03, 0x3c, 0x2e, 0x23, 0xc0, 0x2b, 0xea, 0x38, 0xe6, 0xc6, 0xec, 0x61,
+	0xa8, 0xe3, 0x83, 0x4c, 0xa4, 0x8e, 0x63, 0x6e, 0xe0, 0x7e, 0x27, 0x17, 0xcd, 0xec, 0x13, 0x2b,
+	0xf7, 0xb0, 0x8c, 0xa5, 0xe8, 0xe2, 0xb4, 0xb0, 0x8f, 0x00, 0x32, 0x79, 0x68, 0x16, 0x1f, 0x72,
+	0x68, 0xfe, 0x5d, 0xb2, 0x3f, 0xb9, 0x01, 0x72, 0x2c, 0xfb, 0xf3, 0x10, 0x26, 0x2b, 0xbe, 0x86,
+	0xc6, 0x82, 0xff, 0xb9, 0xa5, 0x96, 0x97, 0xf2, 0xa1, 0x36, 0x84, 0xa1, 0xa6, 0x92, 0xe0, 0xcf,
+	0xa1, 0x73, 0x0a, 0x60, 0xd5, 0x70, 0x8d, 0x36, 0xf5, 0xa9, 0xcb, 0x6d, 0x04, 0x51, 0x7e, 0x2e,
+	0xe0, 0x6e, 0x38, 0x21, 0x5a, 0xae, 0xe0, 0x36, 0x40, 0x82, 0x34, 0x38, 0x8a, 0xfb, 0xb8, 0x55,
+	0xff, 0xe7, 0x2c, 0x1a, 0x5b, 0xb5, 0x3d, 0x7f, 0xd3, 0xa5, 0xde, 0xaa, 0xe1, 0x7a, 0xf4, 0xf1,
+	0xed, 0xd1, 0x4f, 0xa0, 0x31, 0x88, 0x93, 0x6d, 0xd3, 0x8e, 0x2f, 0xd5, 0xa5, 0xe3, 0x35, 0x1a,
+	0x02, 0x04, 0x98, 0x8d, 0x44, 0x25, 0xc4, 0x15, 0x94, 0xe7, 0x63, 0x40, 0x8a, 0x5e, 0xe6, 0x03,
+	0x80, 0xc3, 0xf5, 0xaf, 0xe5, 0xd0, 0x68, 0xa0, 0xe5, 0x59, 0xeb, 0xb8, 0x66, 0x01, 0x1f, 0xad,
+	0x92, 0x67, 0x10, 0x5a, 0xb5, 0x5d, 0xdf, 0x68, 0x49, 0x25, 0x71, 0xe1, 0xc8, 0xe0, 0x00, 0x94,
+	0xf3, 0x48, 0x24, 0x78, 0x1a, 0x21, 0x69, 0x82, 0x15, 0x61, 0x82, 0x9d, 0xea, 0xf7, 0x2a, 0x28,
+	0x9a, 0x57, 0x44, 0xa2, 0xd0, 0xff, 0x28, 0x8b, 0xc6, 0x83, 0x4e, 0x9a, 0xbf, 0x47, 0x9b, 0x5d,
+	0xff, 0x31, 0x9e, 0x0c, 0xaa, 0xb6, 0xf3, 0xf7, 0xd5, 0xb6, 0xfe, 0xef, 0xd2, 0x42, 0x52, 0x6b,
+	0xd9, 0x27, 0x0b, 0xc9, 0xff, 0xc6, 0x18, 0xd7, 0x7f, 0x26, 0x87, 0xa6, 0x02, 0xad, 0x2f, 0x74,
+	0x3b, 0x60, 0x26, 0xd4, 0x8c, 0x56, 0xeb, 0x71, 0xde, 0x97, 0xcb, 0x81, 0x22, 0x56, 0x44, 0xe2,
+	0xc9, 0x18, 0xbf, 0x64, 0xbb, 0x23, 0xc0, 0x0d, 0xdb, 0x32, 0x89, 0x4c, 0x84, 0xdf, 0x40, 0xa3,
+	0xc1, 0xcf, 0xaa, 0xbb, 0x19, 0x6c, 0xc6, 0x70, 0x74, 0x0e, 0x99, 0x0c, 0x77, 0x53, 0x29, 0x36,
+	0x2c, 0x33, 0xe8, 0xff, 0x9a, 0x47, 0xe7, 0xdf, 0xb5, 0x3a, 0xa6, 0xbd, 0xe3, 0x89, 0x62, 0x5c,
+	0xc7, 0xdf, 0xe8, 0x3d, 0xbc, 0x1a, 0x38, 0x91, 0x65, 0x92, 0xdf, 0x87, 0xd9, 0xfa, 0x36, 0x3a,
+	0x13, 0x57, 0xa9, 0x1b, 0xe6, 0x3b, 0x8a, 0xde, 0xd9, 0xe1, 0x04, 0x8d, 0xa0, 0x1e, 0x9a, 0xf0,
+	0x3f, 0x91, 0x74, 0xce, 0x78, 0x41, 0xb5, 0xe2, 0x83, 0x14, 0x54, 0xfb, 0x18, 0x2a, 0xcc, 0xd9,
+	0x6d, 0xc3, 0x0a, 0x42, 0x7c, 0x61, 0x16, 0x87, 0xed, 0x02, 0x86, 0x08, 0x0a, 0x26, 0x5f, 0x34,
+	0x0c, 0x5d, 0x36, 0x12, 0xc9, 0x0f, 0x18, 0xba, 0x1e, 0x75, 0x89, 0x4c, 0x84, 0x6d, 0x34, 0x26,
+	0x9a, 0x13, 0xde, 0x22, 0x04, 0xde, 0xa2, 0x97, 0x03, 0x1d, 0x0d, 0x1e, 0x56, 0xd3, 0x0a, 0x1f,
+	0x77, 0x1b, 0xc1, 0xd3, 0x05, 0x2f, 0xc3, 0xfd, 0x46, 0x44, 0x95, 0x7f, 0xfe, 0x26, 0xc2, 0x49,
+	0xc6, 0x7d, 0x79, 0x31, 0x7e, 0x3e, 0x8b, 0x70, 0xec, 0x30, 0x30, 0xff, 0x18, 0xdb, 0x34, 0xfa,
+	0xef, 0x64, 0xd0, 0x64, 0x22, 0xeb, 0x16, 0xbf, 0x84, 0x10, 0x87, 0x48, 0x19, 0xb4, 0x90, 0x2f,
+	0x17, 0x65, 0xe2, 0x8a, 0xf5, 0x3c, 0x22, 0xc3, 0x33, 0xa8, 0xc4, 0x7f, 0x85, 0x15, 0xdd, 0xe3,
+	0x2c, 0xdd, 0xae, 0x65, 0x92, 0x90, 0x28, 0x6a, 0x05, 0xbe, 0x6d, 0x90, 0x4b, 0x65, 0xf1, 0x77,
+	0x9d, 0xb0, 0x15, 0x46, 0xa6, 0x7f, 0x2b, 0x83, 0x46, 0xc3, 0x07, 0xae, 0x9a, 0x47, 0xd5, 0x75,
+	0x05, 0x91, 0xc0, 0x9c, 0xbb, 0x5f, 0x02, 0x73, 0x6c, 0x81, 0x10, 0x19, 0xcb, 0x7f, 0x91, 0x41,
+	0xe3, 0x21, 0xed, 0x11, 0xfa, 0x4b, 0x0e, 0xfc, 0x22, 0xbf, 0x90, 0x41, 0xda, 0xac, 0xd5, 0x6a,
+	0x59, 0x9d, 0xcd, 0x7a, 0xe7, 0x8e, 0xed, 0xb6, 0x21, 0x4f, 0xf0, 0xe8, 0x1c, 0x62, 0xfa, 0xcf,
+	0x65, 0xd0, 0xa4, 0x78, 0xa0, 0x9a, 0xe1, 0x9a, 0x47, 0xe7, 0xa9, 0x8c, 0x3f, 0xc9, 0xd1, 0xf5,
+	0x32, 0xc4, 0x3a, 0x2f, 0xd9, 0xcd, 0xbb, 0x8f, 0x40, 0xc8, 0x36, 0x7b, 0x8d, 0x63, 0x1e, 0x56,
+	0xf6, 0xe5, 0x0c, 0x9a, 0x22, 0xb4, 0x69, 0x6f, 0x53, 0x77, 0xb7, 0x66, 0x9b, 0xf4, 0x4d, 0xda,
+	0xa1, 0xee, 0x51, 0x0d, 0xd2, 0x3f, 0x86, 0xd2, 0x09, 0xd1, 0xc3, 0xdc, 0xf6, 0xa8, 0x79, 0x7c,
+	0xea, 0x5c, 0xe8, 0x7f, 0x50, 0x44, 0x5a, 0xaa, 0x95, 0x71, 0x6c, 0x37, 0xf5, 0x81, 0xa6, 0xe3,
+	0xf0, 0x61, 0x99, 0x8e, 0xf9, 0xfd, 0x99, 0x8e, 0x85, 0xfd, 0x9a, 0x8e, 0xc5, 0x07, 0x31, 0x1d,
+	0xdb, 0x71, 0xd3, 0xb1, 0x04, 0xa6, 0xe3, 0x4b, 0x7b, 0x9a, 0x8e, 0xf3, 0x1d, 0xf3, 0xe1, 0x0c,
+	0xc7, 0xe3, 0x5b, 0xdd, 0x31, 0xea, 0x3b, 0x30, 0xc5, 0xca, 0xc9, 0xbe, 0x03, 0x3b, 0x4c, 0x26,
+	0xc2, 0x97, 0xd8, 0xe2, 0xd6, 0xb4, 0x5d, 0x93, 0xf2, 0x6a, 0x8d, 0x25, 0xee, 0xd9, 0x75, 0x05,
+	0x8c, 0x84, 0xd8, 0x44, 0xa9, 0xcc, 0xb1, 0x07, 0x29, 0x95, 0x79, 0x08, 0x56, 0xf8, 0x77, 0x33,
+	0x68, 0xb2, 0x46, 0x5d, 0xdf, 0xba, 0x63, 0x35, 0x0d, 0xff, 0x30, 0xae, 0x13, 0xab, 0x68, 0x5c,
+	0x12, 0x28, 0x7d, 0x2c, 0x0b, 0x72, 0x9c, 0x9b, 0xd4, 0xf5, 0xc1, 0x94, 0x94, 0x6f, 0xf7, 0x63,
+	0xf4, 0xac, 0xf9, 0xa0, 0x5c, 0x8d, 0x98, 0xbb, 0x61, 0xf3, 0x01, 0x9c, 0x2b, 0xd2, 0x12, 0xbf,
+	0x48, 0x48, 0xaf, 0x7f, 0x3d, 0x83, 0x2e, 0x12, 0xda, 0xa1, 0x3b, 0xc6, 0x46, 0x8b, 0x4a, 0x82,
+	0xc5, 0xda, 0xce, 0xe6, 0xbd, 0xe5, 0xb5, 0x0d, 0xbf, 0xb9, 0x75, 0xa0, 0xb7, 0x5c, 0x50, 0x3f,
+	0x58, 0xb5, 0x8f, 0xd5, 0x49, 0xe1, 0xd3, 0x7f, 0xf4, 0x02, 0xca, 0xaf, 0x74, 0xe8, 0xca, 0x1d,
+	0x7c, 0x55, 0xaa, 0x6f, 0x24, 0x1e, 0x67, 0x52, 0x16, 0x07, 0x88, 0xc5, 0x21, 0x22, 0x55, 0x41,
+	0xba, 0x2e, 0x57, 0x9f, 0x11, 0x8f, 0x80, 0x65, 0x1e, 0x8e, 0x59, 0x1c, 0x22, 0x72, 0x95, 0x9a,
+	0xeb, 0x72, 0x79, 0x16, 0xa1, 0x5f, 0x85, 0x8b, 0x63, 0x02, 0x2e, 0xb1, 0xc7, 0x2f, 0xa5, 0x55,
+	0x43, 0x89, 0x1f, 0xe8, 0x93, 0x14, 0x8b, 0x43, 0x24, 0xbd, 0x8a, 0x8a, 0xf2, 0xb5, 0x15, 0x71,
+	0xa4, 0x9f, 0x8a, 0xad, 0xd0, 0x80, 0x5b, 0x1c, 0x22, 0xea, 0x97, 0x59, 0x6e, 0x28, 0xdf, 0xb1,
+	0x88, 0x47, 0xa4, 0x48, 0xa8, 0xc5, 0x21, 0x12, 0xfb, 0xe2, 0x85, 0xf2, 0x51, 0x05, 0x71, 0xc3,
+	0x11, 0x6f, 0x14, 0x70, 0x52, 0xa3, 0xfc, 0x03, 0x0c, 0xaf, 0xc7, 0x8a, 0x9d, 0x8b, 0x88, 0xaf,
+	0x33, 0x31, 0x66, 0x8e, 0x5c, 0x1c, 0x22, 0xb1, 0xd2, 0xe8, 0x97, 0x82, 0xfa, 0xd7, 0x62, 0xc9,
+	0x3b, 0x25, 0xd9, 0x38, 0xd6, 0xfb, 0x4c, 0x4b, 0x41, 0x7d, 0xec, 0xeb, 0x72, 0xdd, 0x63, 0xb1,
+	0x86, 0xe1, 0x58, 0x2b, 0xf3, 0x1d, 0x93, 0xf5, 0x8e, 0xb4, 0xc1, 0xde, 0x8c, 0x57, 0x08, 0x15,
+	0x75, 0x67, 0xcf, 0xc6, 0x38, 0x05, 0x76, 0x71, 0x88, 0xc4, 0x2b, 0x8a, 0xde, 0x50, 0xaa, 0x53,
+	0x8a, 0x70, 0xe5, 0xb8, 0x56, 0x19, 0x4a, 0xd2, 0x2a, 0xd4, 0xb1, 0xbc, 0x19, 0x2f, 0x97, 0xa8,
+	0x8d, 0xa5, 0x36, 0x2d, 0xb0, 0x52, 0xd3, 0x41, 0x79, 0xc5, 0x1b, 0x4a, 0x59, 0x3b, 0xa8, 0x1c,
+	0x9b, 0xd2, 0xb4, 0xe1, 0x1b, 0x72, 0xd3, 0xbc, 0x00, 0x9e, 0x52, 0x60, 0x4d, 0x1b, 0x4f, 0xed,
+	0x50, 0xc0, 0x49, 0x1d, 0xca, 0x8b, 0xb1, 0xdd, 0x50, 0x6a, 0x82, 0x68, 0x13, 0x6a, 0xa3, 0x12,
+	0x8a, 0x35, 0x2a, 0x57, 0x0f, 0xb9, 0x2e, 0x97, 0xca, 0xd0, 0x26, 0xd5, 0x0e, 0x8a, 0x30, 0xac,
+	0x83, 0xa4, 0x92, 0x1a, 0x15, 0x48, 0xc3, 0xd7, 0x30, 0x90, 0x97, 0xc3, 0x27, 0xac, 0xad, 0x2e,
+	0x0e, 0x11, 0x48, 0xd0, 0xd7, 0x79, 0x81, 0x07, 0xed, 0x34, 0x50, 0x8c, 0x86, 0xe5, 0x03, 0xef,
+	0xd1, 0xe6, 0xe2, 0x10, 0xe1, 0xc5, 0x1f, 0xae, 0x4a, 0x39, 0xe0, 0xda, 0x94, 0xba, 0x44, 0x84,
+	0x08, 0xb6, 0x44, 0x44, 0x99, 0xe2, 0x0b, 0xc9, 0x3c, 0x69, 0xed, 0x8c, 0x6a, 0x66, 0xc7, 0xf1,
+	0x8b, 0x43, 0x24, 0x99, 0x5b, 0x7d, 0x43, 0x49, 0x1d, 0xd6, 0xce, 0xc6, 0xc2, 0xc0, 0x22, 0x14,
+	0x53, 0x97, 0x9c, 0x64, 0xbc, 0x92, 0x5a, 0xba, 0x48, 0x3b, 0x07, 0x02, 0x9e, 0x0c, 0x05, 0x24,
+	0x49, 0x16, 0x87, 0x48, 0x6a, 0xd1, 0xa3, 0x5a, 0x22, 0x81, 0x57, 0xd3, 0x54, 0xfb, 0x2e, 0x86,
+	0x5e, 0x1c, 0x22, 0x89, 0x94, 0xdf, 0xeb, 0x72, 0xe6, 0xac, 0xf6, 0x84, 0xda, 0x89, 0x11, 0x86,
+	0x75, 0xa2, 0x94, 0x61, 0x7b, 0x5d, 0x4e, 0x54, 0xd5, 0xce, 0x27, 0xb9, 0xa2, 0x95, 0x53, 0x4a,
+	0x68, 0x25, 0xe9, 0x79, 0xa1, 0xda, 0x93, 0xc0, 0x7f, 0x21, 0xe0, 0x4f, 0xa3, 0x59, 0x1c, 0x22,
+	0xe9, 0x39, 0xa5, 0x24, 0x3d, 0x35, 0x53, 0xbb, 0xb0, 0x97, 0xcc, 0xf0, 0xe9, 0xd2, 0xd3, 0x3a,
+	0x8d, 0x3d, 0xb2, 0x23, 0xb5, 0xa7, 0xd4, 0xf4, 0x85, 0x81, 0x84, 0x8b, 0x43, 0x64, 0x8f, 0x1c,
+	0xcb, 0xdb, 0x03, 0x52, 0x15, 0xb5, 0xa7, 0xd5, 0x42, 0x17, 0xa9, 0x44, 0x8b, 0x43, 0x64, 0x40,
+	0xa2, 0xe3, 0xed, 0x01, 0xf9, 0x82, 0x5a, 0x65, 0x4f, 0xb1, 0xa1, 0x3e, 0x06, 0x64, 0x1b, 0xae,
+	0xa4, 0x26, 0xed, 0x69, 0xcf, 0xa8, 0x43, 0x37, 0x85, 0x84, 0x0d, 0xdd, 0xb4, 0x74, 0xbf, 0x95,
+	0xd4, 0xac, 0x39, 0xed, 0xd9, 0x3d, 0x04, 0x86, 0xcf, 0x98, 0x9a, 0x6f, 0xb7, 0x92, 0x9a, 0xb6,
+	0xa6, 0xe9, 0xaa, 0xc0, 0x14, 0x12, 0x26, 0x30, 0x2d, 0xe1, 0x6d, 0x25, 0x35, 0x6f, 0x4c, 0x7b,
+	0x6e, 0x0f, 0x81, 0xd1, 0x13, 0xa6, 0x65, 0x9c, 0xdd, 0x50, 0x12, 0xb7, 0xb4, 0x8f, 0xa8, 0xeb,
+	0x86, 0x84, 0x62, 0xeb, 0x86, 0x9c, 0xe2, 0x55, 0x4b, 0xc4, 0xb6, 0x6b, 0x1f, 0x55, 0xa7, 0x79,
+	0x0c, 0xcd, 0xa6, 0x79, 0x3c, 0x1a, 0xbe, 0x96, 0x88, 0xb3, 0xd6, 0x2e, 0x0e, 0x12, 0x02, 0x68,
+	0x55, 0x08, 0x8f, 0xcc, 0xae, 0xa7, 0x04, 0xfa, 0x6a, 0xcf, 0xab, 0x4e, 0xba, 0x04, 0xc1, 0xe2,
+	0x10, 0x49, 0x09, 0x0f, 0x26, 0xe9, 0xf1, 0x4c, 0xda, 0x25, 0x75, 0xda, 0xa6, 0xd1, 0xb0, 0x69,
+	0x9b, 0x1a, 0x0b, 0xb5, 0x94, 0xe6, 0x46, 0xd7, 0x2e, 0xab, 0x86, 0x59, 0x92, 0x82, 0x19, 0x66,
+	0x29, 0xee, 0x77, 0x92, 0x1e, 0xa1, 0xa3, 0x7d, 0x6c, 0xcf, 0x27, 0x04, 0x9a, 0x94, 0x27, 0xe4,
+	0x01, 0x2b, 0x91, 0xed, 0x74, 0xdb, 0x69, 0xd9, 0x86, 0xa9, 0xbd, 0x90, 0x6a, 0x3b, 0x71, 0xa4,
+	0x64, 0x3b, 0x71, 0x00, 0xdb, 0xe5, 0x65, 0x37, 0xb3, 0x76, 0x45, 0xdd, 0xe5, 0x65, 0x1c, 0xdb,
+	0xe5, 0x15, 0x97, 0x74, 0x2d, 0xe1, 0xdc, 0xd5, 0x5e, 0x54, 0x07, 0x40, 0x0c, 0xcd, 0x06, 0x40,
+	0xdc, 0x1d, 0xfc, 0xde, 0x60, 0xc7, 0xaa, 0x36, 0x0d, 0xd2, 0x9e, 0x09, 0x0b, 0x24, 0x0f, 0xa0,
+	0x5b, 0x1c, 0x22, 0x83, 0x9d, 0xb3, 0xf5, 0x14, 0x3f, 0xa9, 0x36, 0xa3, 0x0e, 0xb0, 0x04, 0x01,
+	0x1b, 0x60, 0x49, 0xef, 0x6a, 0x3d, 0xc5, 0xd1, 0xa9, 0x7d, 0x7c, 0xa0, 0xa8, 0xf0, 0x9d, 0x53,
+	0xdc, 0xa3, 0xd7, 0x65, 0x4f, 0xa5, 0x76, 0x55, 0xdd, 0xec, 0x22, 0x0c, 0xdb, 0xec, 0x24, 0x8f,
+	0xe6, 0x75, 0xd9, 0x31, 0xa8, 0x5d, 0x4b, 0x72, 0x45, 0x5b, 0xa4, 0xe4, 0x40, 0x24, 0xe9, 0x7e,
+	0x38, 0xed, 0x25, 0x75, 0xd4, 0xa5, 0xd1, 0xb0, 0x51, 0x97, 0xea, 0xc3, 0x5b, 0x48, 0xba, 0xd3,
+	0xb4, 0xeb, 0x71, 0x07, 0xa3, 0x8a, 0x67, 0x96, 0x4f, 0xc2, 0x05, 0x77, 0x33, 0x1e, 0x6c, 0xab,
+	0xbd, 0xac, 0xda, 0xb7, 0x2a, 0x96, 0xd9, 0xb7, 0xb1, 0xe0, 0xdc, 0x9b, 0xf1, 0xf8, 0x54, 0xed,
+	0x95, 0x74, 0x09, 0xe1, 0x58, 0x89, 0xc7, 0xb3, 0xde, 0x8c, 0x87, 0x74, 0x6a, 0x37, 0xd2, 0x25,
+	0x84, 0xda, 0x8d, 0x87, 0x80, 0x5e, 0x95, 0xd2, 0xdc, 0xb4, 0x4f, 0xa8, 0xa6, 0x63, 0x88, 0x60,
+	0xa6, 0x63, 0x94, 0x0c, 0x77, 0x55, 0x4a, 0x0f, 0xd3, 0x3e, 0x99, 0x60, 0x09, 0x1f, 0x56, 0x4a,
+	0x22, 0xbb, 0x2a, 0xa5, 0x55, 0x69, 0xaf, 0x26, 0x58, 0xc2, 0xa7, 0x93, 0x92, 0xaf, 0xcc, 0xbd,
+	0xee, 0xbc, 0xb5, 0x4f, 0x81, 0x0c, 0xfd, 0xfe, 0xd7, 0x98, 0x8b, 0x43, 0x64, 0xaf, 0xbb, 0xf3,
+	0xf7, 0x06, 0x3b, 0x27, 0xb5, 0xd7, 0xd4, 0x29, 0x3c, 0x88, 0x8e, 0x4d, 0xe1, 0x81, 0x0e, 0xce,
+	0xd7, 0x63, 0xf1, 0x6f, 0xda, 0xeb, 0xea, 0x12, 0xa7, 0x20, 0xd9, 0x12, 0x17, 0x8f, 0x96, 0x53,
+	0x02, 0xbb, 0xb4, 0x4f, 0xab, 0x4b, 0x9c, 0x8c, 0x63, 0x4b, 0x9c, 0x12, 0x04, 0x56, 0x4b, 0xc4,
+	0x1b, 0x69, 0x6f, 0xa8, 0x4b, 0x5c, 0x0c, 0xcd, 0x96, 0xb8, 0x78, 0x84, 0xd2, 0xeb, 0xb1, 0xb0,
+	0x1b, 0xed, 0x66, 0xfa, 0xf3, 0x03, 0x52, 0x7e, 0x7e, 0x1e, 0xa4, 0x43, 0xd2, 0xe3, 0x47, 0xb4,
+	0xaa, 0x3a, 0x7f, 0xd3, 0x68, 0xd8, 0xfc, 0x4d, 0x8d, 0x3d, 0x59, 0x49, 0x2d, 0x33, 0xa9, 0xcd,
+	0xee, 0x71, 0x70, 0x88, 0x4c, 0x91, 0xb4, 0x02, 0x95, 0x37, 0xe3, 0x9f, 0xd6, 0xd2, 0x6a, 0x03,
+	0xce, 0xc8, 0xc1, 0x31, 0x28, 0xfe, 0x29, 0xae, 0x7a, 0x8a, 0xaf, 0x4c, 0x9b, 0x53, 0x57, 0xd7,
+	0x04, 0x01, 0x5b, 0x5d, 0x93, 0x1e, 0xb6, 0x85, 0xe4, 0x17, 0x0d, 0xb5, 0xf9, 0xd8, 0xcd, 0x71,
+	0x0c, 0xcf, 0x56, 0xa7, 0xc4, 0x57, 0x10, 0x49, 0xfa, 0x47, 0xef, 0xb4, 0x85, 0xd8, 0x7e, 0x9d,
+	0x42, 0x03, 0xfb, 0x75, 0xda, 0x07, 0xf3, 0x3e, 0x37, 0xf0, 0xdb, 0x85, 0xda, 0x9b, 0x20, 0xb6,
+	0x32, 0x48, 0xac, 0x20, 0x5b, 0x1c, 0x22, 0x03, 0xbf, 0x7e, 0x78, 0x1b, 0x9d, 0xb9, 0xb5, 0xbb,
+	0xf6, 0xf6, 0x52, 0x18, 0xb2, 0xb4, 0xea, 0x52, 0xc7, 0x70, 0xa9, 0xb6, 0xa8, 0xda, 0xea, 0xa9,
+	0x44, 0xcc, 0x56, 0x4f, 0x45, 0x24, 0xc5, 0x06, 0x73, 0xa1, 0xbe, 0x97, 0xd8, 0x68, 0x46, 0xa4,
+	0x73, 0xb3, 0xd5, 0x49, 0x45, 0x30, 0x05, 0x2d, 0xd9, 0x9d, 0x4d, 0xf0, 0x54, 0x7c, 0x46, 0x5d,
+	0x9d, 0x06, 0x53, 0xb2, 0xd5, 0x69, 0x30, 0x96, 0x0d, 0x75, 0x15, 0xcb, 0xe7, 0xe0, 0x5b, 0xea,
+	0x50, 0x4f, 0x21, 0x61, 0x43, 0x3d, 0x05, 0x9c, 0x14, 0x48, 0xa8, 0x47, 0x7d, 0x6d, 0x69, 0x2f,
+	0x81, 0x40, 0x92, 0x14, 0x08, 0xe0, 0xa4, 0xc0, 0x05, 0xea, 0x37, 0xb7, 0xb4, 0x5b, 0x7b, 0x09,
+	0x04, 0x92, 0xa4, 0x40, 0x00, 0xb3, 0xc3, 0xa6, 0x0a, 0x9e, 0xed, 0xb6, 0xee, 0x06, 0x7d, 0xb6,
+	0xac, 0x1e, 0x36, 0x07, 0x12, 0xb2, 0xc3, 0xe6, 0x40, 0x24, 0xfe, 0xd2, 0x03, 0x7b, 0x82, 0xb5,
+	0x15, 0x68, 0x70, 0x3a, 0xb2, 0x0b, 0x1e, 0x84, 0x6b, 0x71, 0x88, 0x3c, 0xa0, 0xfc, 0xd9, 0x22,
+	0xca, 0xc3, 0x77, 0x20, 0xf4, 0x5f, 0xcb, 0xa0, 0xd1, 0x35, 0xdf, 0xa5, 0x46, 0x5b, 0xc4, 0x27,
+	0x9d, 0x47, 0x25, 0x6e, 0xe6, 0x8a, 0x6f, 0x1c, 0x8d, 0x90, 0xf0, 0x37, 0xbe, 0x88, 0x4e, 0x2d,
+	0x19, 0x9e, 0x0f, 0x9c, 0xd2, 0xc7, 0x5b, 0x49, 0x0c, 0x8a, 0x97, 0x38, 0x1d, 0xe7, 0x83, 0xab,
+	0x8f, 0xdc, 0x7d, 0xaf, 0x3e, 0x4a, 0x1f, 0xf4, 0x2a, 0x43, 0x70, 0xc1, 0x11, 0xe3, 0xd5, 0xfb,
+	0x19, 0x94, 0x30, 0xc0, 0x1f, 0xde, 0x4f, 0xbe, 0x82, 0xc6, 0x63, 0xd7, 0x6d, 0xc2, 0x4f, 0xfd,
+	0x80, 0xb7, 0x71, 0x71, 0x6e, 0xfc, 0x1c, 0xca, 0xdd, 0xae, 0xcf, 0xc9, 0x75, 0xd9, 0xbb, 0x4a,
+	0xda, 0x15, 0xc3, 0xe2, 0xe7, 0x43, 0x27, 0xea, 0x6d, 0xb2, 0x24, 0xae, 0xd9, 0xe0, 0xdb, 0x51,
+	0x5d, 0xb7, 0x45, 0x24, 0x94, 0xfe, 0xed, 0x72, 0x74, 0xd5, 0x80, 0x2f, 0x8a, 0x9b, 0x46, 0xa9,
+	0x4e, 0x7d, 0x2c, 0x47, 0x8f, 0xdf, 0x2c, 0x7e, 0x1a, 0x8d, 0xd6, 0xdb, 0x0e, 0x75, 0x3d, 0xbb,
+	0x03, 0x15, 0xa4, 0xf9, 0xf5, 0xc6, 0xf9, 0x7e, 0xaf, 0x72, 0xd6, 0x92, 0xe0, 0x72, 0x9c, 0x9f,
+	0x4c, 0x1f, 0x95, 0xbf, 0xce, 0xdd, 0xb7, 0xfc, 0xf5, 0x65, 0x94, 0xbf, 0xed, 0xf1, 0xaf, 0xa7,
+	0x87, 0xa4, 0xdd, 0xd8, 0xb7, 0xa2, 0x38, 0x05, 0xbe, 0x82, 0x0a, 0x70, 0x2b, 0xe0, 0x69, 0x79,
+	0xa0, 0x85, 0xdc, 0xd7, 0x16, 0x40, 0xe4, 0x62, 0x10, 0x9c, 0x26, 0xf5, 0x23, 0xf9, 0x85, 0x87,
+	0xfc, 0x48, 0x7e, 0xda, 0xb7, 0xfb, 0x8b, 0x0f, 0xf7, 0xed, 0xfe, 0x7a, 0xf4, 0x09, 0x80, 0xd2,
+	0x7d, 0xc7, 0xf0, 0x69, 0x71, 0x7d, 0x57, 0x14, 0x9f, 0x00, 0x50, 0x0b, 0xff, 0x2f, 0xa0, 0x53,
+	0xc4, 0xee, 0xfa, 0x74, 0xdd, 0x0e, 0x0a, 0xb5, 0xf2, 0x48, 0x3a, 0x78, 0x26, 0x97, 0x61, 0x1a,
+	0xbe, 0x1d, 0xa4, 0x1b, 0xca, 0x69, 0x91, 0x2a, 0x17, 0x5e, 0x4e, 0xab, 0xf9, 0x2a, 0x25, 0x01,
+	0xca, 0x1f, 0xb3, 0x4f, 0x08, 0x4b, 0x29, 0xf2, 0xfa, 0xb3, 0x19, 0x54, 0x58, 0x77, 0x0d, 0xcb,
+	0xf7, 0x84, 0x8f, 0xfe, 0xcc, 0xf4, 0x8e, 0x6b, 0x38, 0x6c, 0x7c, 0x4c, 0xc3, 0x2d, 0xde, 0x3b,
+	0x46, 0xab, 0x4b, 0xbd, 0xd9, 0x77, 0xd9, 0xdb, 0xfd, 0x43, 0xaf, 0xf2, 0xa9, 0x4d, 0x70, 0x4e,
+	0x4d, 0x37, 0xed, 0xf6, 0xcc, 0xa6, 0x6b, 0x6c, 0x5b, 0xbc, 0x00, 0xb8, 0xd1, 0x9a, 0xf1, 0x69,
+	0x8b, 0x3a, 0xb6, 0xeb, 0xcf, 0x18, 0x8e, 0x35, 0xe3, 0xef, 0x3a, 0xd4, 0x9b, 0x09, 0x25, 0xf1,
+	0x16, 0xd8, 0x10, 0xf0, 0xe1, 0x3f, 0x79, 0x08, 0x70, 0x1c, 0x5e, 0x46, 0x48, 0xbc, 0x6a, 0xd5,
+	0x71, 0x84, 0xc3, 0x5f, 0xf2, 0x66, 0x06, 0x18, 0x3e, 0xb0, 0x43, 0x85, 0x19, 0x8e, 0x5c, 0xfe,
+	0x45, 0x92, 0xc0, 0x46, 0xc1, 0xba, 0x78, 0xa2, 0x40, 0x4d, 0x63, 0x91, 0xc6, 0x83, 0x87, 0x4d,
+	0x51, 0x52, 0x9c, 0x0d, 0x6f, 0xa0, 0x71, 0x21, 0x37, 0x8c, 0xaa, 0x3b, 0xa5, 0x2e, 0x1a, 0x31,
+	0x34, 0x1f, 0xb4, 0xe1, 0x33, 0x9a, 0x02, 0x2c, 0xb7, 0x11, 0xe3, 0xc0, 0xb3, 0x51, 0xe6, 0x0d,
+	0xd4, 0x9a, 0xd1, 0xc6, 0x61, 0xc4, 0x42, 0x29, 0xf4, 0x80, 0x9f, 0x97, 0xa8, 0x91, 0x8b, 0xa1,
+	0x28, 0x2c, 0xb2, 0x0c, 0x3e, 0xea, 0x27, 0x52, 0x64, 0xc4, 0xc7, 0xbc, 0xca, 0x82, 0x6b, 0x68,
+	0x2c, 0xf4, 0x37, 0xdc, 0x66, 0x2b, 0xdb, 0x64, 0x54, 0x95, 0x25, 0x16, 0xb0, 0x27, 0x0b, 0x51,
+	0x78, 0xf0, 0x4b, 0xa8, 0xc4, 0x3d, 0xf6, 0x75, 0x7e, 0xc5, 0x10, 0x5c, 0xb6, 0x02, 0xac, 0x61,
+	0xc9, 0x3d, 0x16, 0x12, 0xe2, 0xd7, 0x51, 0xb9, 0xfa, 0xee, 0x1a, 0x5b, 0x67, 0xaa, 0x64, 0xd9,
+	0xd3, 0x4e, 0x47, 0xe1, 0xca, 0x90, 0x90, 0x6b, 0xb7, 0x68, 0xc3, 0x70, 0x95, 0xc5, 0x43, 0xa6,
+	0xc7, 0xf3, 0x28, 0xf6, 0x85, 0x79, 0x6d, 0x2a, 0xfa, 0x76, 0xa0, 0x01, 0x98, 0x86, 0xa8, 0x48,
+	0xa4, 0x64, 0x1d, 0xab, 0x4c, 0x6c, 0xd4, 0xcc, 0x59, 0x9e, 0xd1, 0x6a, 0xd9, 0x3b, 0x84, 0x5a,
+	0x9e, 0xd7, 0xa5, 0x70, 0x3f, 0x51, 0xe2, 0xa3, 0xc6, 0x14, 0xa8, 0x86, 0xcb, 0x71, 0x4a, 0x4e,
+	0xb8, 0xca, 0xa6, 0xff, 0x57, 0x46, 0x1e, 0xd0, 0x61, 0x95, 0xd9, 0x4c, 0x6a, 0x95, 0xd9, 0x2b,
+	0x68, 0x44, 0x6c, 0x03, 0x61, 0x8c, 0x24, 0x64, 0x75, 0x04, 0x91, 0x00, 0x96, 0x49, 0x22, 0x02,
+	0x88, 0xa8, 0x8f, 0x0a, 0x43, 0xe4, 0xa4, 0x88, 0xfa, 0xa8, 0x30, 0x84, 0x52, 0x16, 0xe2, 0x1a,
+	0x2a, 0x8b, 0xc1, 0x2c, 0xe5, 0x8c, 0xc3, 0x6d, 0x7e, 0x90, 0xdf, 0xcc, 0x83, 0x05, 0x24, 0x22,
+	0xfc, 0x2a, 0x42, 0x91, 0x7e, 0xc5, 0xa6, 0x05, 0x73, 0x4f, 0xee, 0x0e, 0x79, 0xee, 0x45, 0xd4,
+	0xfa, 0xdf, 0x67, 0x12, 0x53, 0x86, 0x3d, 0x83, 0x88, 0x3b, 0x91, 0xf4, 0x00, 0xcf, 0x20, 0xa2,
+	0x54, 0xc4, 0x33, 0x48, 0x44, 0xf8, 0x12, 0x2a, 0xc5, 0xf2, 0xe9, 0xe1, 0x9e, 0x3d, 0x4c, 0xa6,
+	0x0f, 0xb1, 0xf8, 0x1a, 0x2a, 0xb1, 0x01, 0xcc, 0x44, 0x08, 0x85, 0x40, 0xa5, 0x9e, 0xae, 0x80,
+	0xc9, 0x23, 0x2e, 0xa0, 0x63, 0x3c, 0x4a, 0x98, 0xac, 0xe0, 0x49, 0x99, 0xae, 0x51, 0x58, 0xec,
+	0xef, 0x65, 0x07, 0x1c, 0x18, 0x1e, 0xdf, 0xe4, 0x84, 0x30, 0x51, 0x2c, 0x3f, 0x20, 0x51, 0xec,
+	0x3f, 0xb2, 0x03, 0x4e, 0x43, 0x8f, 0x75, 0x42, 0x47, 0xa8, 0x0c, 0x35, 0xa1, 0x23, 0xca, 0xa5,
+	0xb1, 0x4c, 0x22, 0x13, 0xc5, 0x52, 0xbf, 0x0a, 0xf7, 0x4d, 0xfd, 0xfa, 0xad, 0xdc, 0x5e, 0xa7,
+	0xc5, 0x13, 0xdd, 0xef, 0x47, 0xf7, 0xd7, 0x50, 0x39, 0xd4, 0xac, 0x28, 0xe7, 0x32, 0x16, 0x86,
+	0x43, 0x71, 0x30, 0xf0, 0x48, 0x44, 0xf8, 0x32, 0x7f, 0x56, 0xf8, 0x32, 0x76, 0x11, 0x18, 0xa0,
+	0xe2, 0x09, 0x7b, 0xb6, 0x86, 0x67, 0xbd, 0x4f, 0x49, 0x88, 0xd6, 0xff, 0x34, 0x9b, 0x7a, 0xe4,
+	0x3e, 0xe9, 0xa3, 0x7d, 0xf4, 0x51, 0x8a, 0x12, 0xb9, 0xb3, 0xe0, 0x44, 0x89, 0xfb, 0x50, 0xe2,
+	0x8f, 0xb3, 0xa9, 0xae, 0x95, 0x13, 0x25, 0xee, 0x67, 0xb5, 0xb8, 0x82, 0x46, 0x88, 0xbd, 0xe3,
+	0xd5, 0xec, 0x6e, 0xc7, 0x17, 0x6b, 0x05, 0x2c, 0xd4, 0xae, 0xbd, 0xe3, 0x35, 0x9a, 0x0c, 0x4a,
+	0x22, 0x02, 0xfd, 0x27, 0xd9, 0x3d, 0x9c, 0x4f, 0x27, 0x8a, 0xff, 0x10, 0xb7, 0xc8, 0x8f, 0x3d,
+	0x8f, 0xca, 0xd2, 0x07, 0x51, 0xf1, 0x28, 0x2a, 0xad, 0xcc, 0xae, 0xcd, 0x93, 0x77, 0xe6, 0xe7,
+	0x26, 0x86, 0x30, 0x42, 0x85, 0xb9, 0xf9, 0xe5, 0xfa, 0xfc, 0xdc, 0x44, 0x66, 0x76, 0xe2, 0x83,
+	0x7f, 0x7a, 0x7a, 0xe8, 0x83, 0x1f, 0x3e, 0x9d, 0xf9, 0xde, 0x0f, 0x9f, 0xce, 0xfc, 0xe3, 0x0f,
+	0x9f, 0xce, 0x6c, 0x14, 0xc0, 0x08, 0x7d, 0xe9, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0xf0, 0x99,
+	0x5b, 0x81, 0x5d, 0x96, 0x00, 0x00,
 }
 
 func (m *Metadata) Marshal() (dAtA []byte, err error) {
@@ -11941,13 +11871,6 @@ func (m *WindowsDesktopSessionStart) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.DesktopName) > 0 {
-		i -= len(m.DesktopName)
-		copy(dAtA[i:], m.DesktopName)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.DesktopName)))
-		i--
-		dAtA[i] = 0x5a
-	}
 	if len(m.DesktopLabels) > 0 {
 		for k := range m.DesktopLabels {
 			v := m.DesktopLabels[k]
@@ -12885,64 +12808,6 @@ func (m *RenewableCertificateGenerationMismatch) MarshalToSizedBuffer(dAtA []byt
 	return len(dAtA) - i, nil
 }
 
-func (m *Unknown) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *Unknown) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.Data) > 0 {
-		i -= len(m.Data)
-		copy(dAtA[i:], m.Data)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.Data)))
-		i--
-		dAtA[i] = 0x22
-	}
-	if len(m.UnknownCode) > 0 {
-		i -= len(m.UnknownCode)
-		copy(dAtA[i:], m.UnknownCode)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.UnknownCode)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.UnknownType) > 0 {
-		i -= len(m.UnknownType)
-		copy(dAtA[i:], m.UnknownType)
-		i = encodeVarintEvents(dAtA, i, uint64(len(m.UnknownType)))
-		i--
-		dAtA[i] = 0x12
-	}
-	{
-		size, err := m.Metadata.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintEvents(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
 func (m *OneOf) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -14766,29 +14631,6 @@ func (m *OneOf_RenewableCertificateGenerationMismatch) MarshalToSizedBuffer(dAtA
 	}
 	return len(dAtA) - i, nil
 }
-func (m *OneOf_Unknown) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *OneOf_Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	if m.Unknown != nil {
-		{
-			size, err := m.Unknown.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintEvents(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x5
-		i--
-		dAtA[i] = 0x82
-	}
-	return len(dAtA) - i, nil
-}
 func (m *StreamStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -14813,12 +14655,12 @@ func (m *StreamStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	n357, err357 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUploadTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUploadTime):])
-	if err357 != nil {
-		return 0, err357
+	n355, err355 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.LastUploadTime, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.LastUploadTime):])
+	if err355 != nil {
+		return 0, err355
 	}
-	i -= n357
-	i = encodeVarintEvents(dAtA, i, uint64(n357))
+	i -= n355
+	i = encodeVarintEvents(dAtA, i, uint64(n355))
 	i--
 	dAtA[i] = 0x1a
 	if m.LastEventIndex != 0 {
@@ -15048,12 +14890,12 @@ func (m *Identity) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x4a
 	}
-	n363, err363 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
-	if err363 != nil {
-		return 0, err363
+	n361, err361 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Expires, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Expires):])
+	if err361 != nil {
+		return 0, err361
 	}
-	i -= n363
-	i = encodeVarintEvents(dAtA, i, uint64(n363))
+	i -= n361
+	i = encodeVarintEvents(dAtA, i, uint64(n361))
 	i--
 	dAtA[i] = 0x42
 	if len(m.KubernetesUsers) > 0 {
@@ -17680,10 +17522,6 @@ func (m *WindowsDesktopSessionStart) Size() (n int) {
 			n += mapEntrySize + 1 + sovEvents(uint64(mapEntrySize))
 		}
 	}
-	l = len(m.DesktopName)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -17985,32 +17823,6 @@ func (m *RenewableCertificateGenerationMismatch) Size() (n int) {
 	return n
 }
 
-func (m *Unknown) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Metadata.Size()
-	n += 1 + l + sovEvents(uint64(l))
-	l = len(m.UnknownType)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.UnknownCode)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	l = len(m.Data)
-	if l > 0 {
-		n += 1 + l + sovEvents(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
 func (m *OneOf) Size() (n int) {
 	if m == nil {
 		return 0
@@ -18974,18 +18786,6 @@ func (m *OneOf_RenewableCertificateGenerationMismatch) Size() (n int) {
 	}
 	return n
 }
-func (m *OneOf_Unknown) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.Unknown != nil {
-		l = m.Unknown.Size()
-		n += 2 + l + sovEvents(uint64(l))
-	}
-	return n
-}
 func (m *StreamStatus) Size() (n int) {
 	if m == nil {
 		return 0
@@ -35336,38 +35136,6 @@ func (m *WindowsDesktopSessionStart) Unmarshal(dAtA []byte) error {
 			}
 			m.DesktopLabels[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 11:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DesktopName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.DesktopName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
@@ -37762,186 +37530,6 @@ func (m *RenewableCertificateGenerationMismatch) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Unknown) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEvents
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Unknown: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Unknown: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Metadata.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UnknownType", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.UnknownType = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UnknownCode", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.UnknownCode = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Data = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEvents(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
 func (m *OneOf) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -40736,41 +40324,6 @@ func (m *OneOf) Unmarshal(dAtA []byte) error {
 			}
 			m.Event = &OneOf_RenewableCertificateGenerationMismatch{v}
 			iNdEx = postIndex
-		case 80:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Unknown", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowEvents
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthEvents
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthEvents
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			v := &Unknown{}
-			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			m.Event = &OneOf_Unknown{v}
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipEvents(dAtA[iNdEx:])
diff --git a/api/types/events/events.proto b/api/types/events/events.proto
index 7a1e69e52b463..6cdcd923ddbd2 100644
--- a/api/types/events/events.proto
+++ b/api/types/events/events.proto
@@ -1573,8 +1573,6 @@ message WindowsDesktopSessionStart {
     string WindowsUser = 9 [ (gogoproto.jsontag) = "windows_user" ];
     // DesktopLabels are the labels on the desktop resource.
     map<string, string> DesktopLabels = 10 [ (gogoproto.jsontag) = "desktop_labels" ];
-    // DesktopName is the name of the desktop resource.
-    string DesktopName = 11 [ (gogoproto.jsontag) = "desktop_name" ];
 }
 
 // DatabaseSessionEnd is emitted when a user ends the database session.
@@ -1784,22 +1782,6 @@ message RenewableCertificateGenerationMismatch {
         [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
 }
 
-// Unknown is a fallback event used when we don't recognize an event from the backend.
-message Unknown {
-    // Metadata is a common event metadata.
-    Metadata Metadata = 1
-        [ (gogoproto.nullable) = false, (gogoproto.embed) = true, (gogoproto.jsontag) = "" ];
-
-    // UnknownType is the event type extracted from the unknown event.
-    string UnknownType = 2 [ (gogoproto.jsontag) = "unknown_event" ];
-
-    // UnknownCode is the event code extracted from the unknown event.
-    string UnknownCode = 3 [ (gogoproto.jsontag) = "unknown_code,omitempty" ];
-
-    // Data is the serialized JSON data of the unknown event.
-    string Data = 4 [ (gogoproto.jsontag) = "data" ];
-}
-
 // OneOf is a union of one of audit events submitted to the auth service
 message OneOf {
     // Event is one of the audit events
@@ -1883,7 +1865,6 @@ message OneOf {
         events.MySQLStatementFetch MySQLStatementFetch = 77;
         events.MySQLStatementBulkExecute MySQLStatementBulkExecute = 78;
         events.RenewableCertificateGenerationMismatch RenewableCertificateGenerationMismatch = 79;
-        events.Unknown Unknown = 80;
     }
 }
 
diff --git a/api/types/events/oneof.go b/api/types/events/oneof.go
index 8181e7c98bcc0..5d3476d536e9d 100644
--- a/api/types/events/oneof.go
+++ b/api/types/events/oneof.go
@@ -17,11 +17,9 @@ limitations under the License.
 package events
 
 import (
-	"encoding/json"
 	"reflect"
 
 	"github.com/gravitational/trace"
-	log "github.com/sirupsen/logrus"
 )
 
 // MustToOneOf converts audit event to OneOf
@@ -355,28 +353,8 @@ func ToOneOf(in AuditEvent) (*OneOf, error) {
 		out.Event = &OneOf_RenewableCertificateGenerationMismatch{
 			RenewableCertificateGenerationMismatch: e,
 		}
-	case *Unknown:
-		out.Event = &OneOf_Unknown{
-			Unknown: e,
-		}
 	default:
-		log.Errorf("Attempted to convert dynamic event of unknown type \"%v\" into protobuf event.", in.GetType())
-		unknown := &Unknown{}
-		unknown.Type = UnknownEvent
-		unknown.Code = UnknownCode
-		unknown.Time = in.GetTime()
-		unknown.ClusterName = in.GetClusterName()
-		unknown.UnknownType = in.GetType()
-		unknown.UnknownCode = in.GetCode()
-		data, err := json.Marshal(in)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		unknown.Data = string(data)
-		out.Event = &OneOf_Unknown{
-			Unknown: unknown,
-		}
+		return nil, trace.BadParameter("event type %T is not supported", in)
 	}
 	return &out, nil
 }
diff --git a/api/types/events/unknown.go b/api/types/events/unknown.go
deleted file mode 100644
index d2f55cacd24a4..0000000000000
--- a/api/types/events/unknown.go
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
-Copyright 2021 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package events
-
-const (
-	// UnknownEvent is any event received that isn't recognized as any other event type.
-	UnknownEvent = "unknown"
-
-	// UnknownCode is used when an event of unknown type is encountered.
-	UnknownCode = "TCC00E"
-)
diff --git a/api/types/kubernetes.go b/api/types/kubernetes.go
index 511f527defa29..13e5c7545c946 100644
--- a/api/types/kubernetes.go
+++ b/api/types/kubernetes.go
@@ -18,7 +18,6 @@ package types
 
 import (
 	"fmt"
-	"sort"
 	"time"
 
 	"github.com/gogo/protobuf/proto"
@@ -26,30 +25,6 @@ import (
 	"github.com/gravitational/trace"
 )
 
-// KubeCluster represents a kubernetes cluster.
-type KubeCluster interface {
-	// ResourceWithLabels provides common resource methods.
-	ResourceWithLabels
-	// GetNamespace returns the kube cluster namespace.
-	GetNamespace() string
-	// GetStaticLabels returns the kube cluster static labels.
-	GetStaticLabels() map[string]string
-	// SetStaticLabels sets the kube cluster static labels.
-	SetStaticLabels(map[string]string)
-	// GetDynamicLabels returns the kube cluster dynamic labels.
-	GetDynamicLabels() map[string]CommandLabel
-	// SetDynamicLabels sets the kube cluster dynamic labels.
-	SetDynamicLabels(map[string]CommandLabel)
-	// LabelsString returns all labels as a string.
-	LabelsString() string
-	// String returns string representation of the kube cluster.
-	String() string
-	// GetDescription returns the kube cluster description.
-	GetDescription() string
-	// Copy returns a copy of this kube cluster resource.
-	Copy() *KubernetesClusterV3
-}
-
 // NewKubernetesClusterV3FromLegacyCluster creates a new Kubernetes cluster resource
 // from the legacy type.
 func NewKubernetesClusterV3FromLegacyCluster(namespace string, cluster *KubernetesCluster) (*KubernetesClusterV3, error) {
@@ -217,76 +192,3 @@ func (k *KubernetesClusterV3) CheckAndSetDefaults() error {
 
 	return nil
 }
-
-// KubeClusters represents a list of kube clusters.
-type KubeClusters []KubeCluster
-
-// Len returns the slice length.
-func (s KubeClusters) Len() int { return len(s) }
-
-// Less compares kube clusters by name.
-func (s KubeClusters) Less(i, j int) bool {
-	return s[i].GetName() < s[j].GetName()
-}
-
-// Swap swaps two kube clusters.
-func (s KubeClusters) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
-
-// SortByCustom custom sorts by given sort criteria.
-func (s KubeClusters) SortByCustom(sortBy SortBy) error {
-	if sortBy.Field == "" {
-		return nil
-	}
-
-	isDesc := sortBy.IsDesc
-	switch sortBy.Field {
-	case ResourceMetadataName:
-		sort.SliceStable(s, func(i, j int) bool {
-			return stringCompare(s[i].GetName(), s[j].GetName(), isDesc)
-		})
-	default:
-		return trace.NotImplemented("sorting by field %q for resource %q is not supported", sortBy.Field, KindKubernetesCluster)
-	}
-
-	return nil
-}
-
-// AsResources returns as type resources with labels.
-func (s KubeClusters) AsResources() []ResourceWithLabels {
-	resources := make([]ResourceWithLabels, 0, len(s))
-	for _, cluster := range s {
-		resources = append(resources, ResourceWithLabels(cluster))
-	}
-	return resources
-}
-
-// GetFieldVals returns list of select field values.
-func (s KubeClusters) GetFieldVals(field string) ([]string, error) {
-	vals := make([]string, 0, len(s))
-	switch field {
-	case ResourceMetadataName:
-		for _, server := range s {
-			vals = append(vals, server.GetName())
-		}
-	default:
-		return nil, trace.NotImplemented("getting field %q for resource %q is not supported", field, KindKubernetesCluster)
-	}
-
-	return vals, nil
-}
-
-// DeduplicateKubeClusters deduplicates kube clusters by name.
-func DeduplicateKubeClusters(kubeclusters []KubeCluster) []KubeCluster {
-	seen := make(map[string]struct{})
-	result := make([]KubeCluster, 0, len(kubeclusters))
-
-	for _, cluster := range kubeclusters {
-		if _, ok := seen[cluster.GetName()]; ok {
-			continue
-		}
-		seen[cluster.GetName()] = struct{}{}
-		result = append(result, cluster)
-	}
-
-	return result
-}
diff --git a/api/types/kubernetes_test.go b/api/types/kubernetes_test.go
deleted file mode 100644
index 2931ebf626a0f..0000000000000
--- a/api/types/kubernetes_test.go
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package types
-
-import (
-	"testing"
-
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-)
-
-func TestKubeClustersSorter(t *testing.T) {
-	t.Parallel()
-
-	makeClusters := func(testVals []string, testField string) []KubeCluster {
-		servers := make([]KubeCluster, len(testVals))
-		for i := 0; i < len(testVals); i++ {
-			var err error
-			servers[i], err = NewKubernetesClusterV3FromLegacyCluster("_", &KubernetesCluster{
-				Name: testVals[i],
-			})
-			require.NoError(t, err)
-		}
-		return servers
-	}
-
-	testValsUnordered := []string{"d", "b", "a", "c"}
-
-	// Test descending.
-	sortBy := SortBy{Field: ResourceMetadataName, IsDesc: true}
-	clusters := KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
-	require.NoError(t, clusters.SortByCustom(sortBy))
-	targetVals, err := clusters.GetFieldVals(ResourceMetadataName)
-	require.NoError(t, err)
-	require.IsDecreasing(t, targetVals)
-
-	// Test ascending.
-	sortBy = SortBy{Field: ResourceMetadataName}
-	clusters = KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
-	require.NoError(t, clusters.SortByCustom(sortBy))
-	targetVals, err = clusters.GetFieldVals(ResourceMetadataName)
-	require.NoError(t, err)
-	require.IsIncreasing(t, targetVals)
-
-	// Test error.
-	sortBy = SortBy{Field: "unsupported"}
-	clusters = KubeClusters(makeClusters(testValsUnordered, ResourceMetadataName))
-	require.True(t, trace.IsNotImplemented(clusters.SortByCustom(sortBy)))
-}
-
-func TestDeduplicateKubeClusters(t *testing.T) {
-	t.Parallel()
-
-	expected := []KubeCluster{
-		&KubernetesClusterV3{Metadata: Metadata{Name: "a"}},
-		&KubernetesClusterV3{Metadata: Metadata{Name: "b"}},
-		&KubernetesClusterV3{Metadata: Metadata{Name: "c"}},
-	}
-
-	extra := []KubeCluster{
-		&KubernetesClusterV3{Metadata: Metadata{Name: "a"}},
-		&KubernetesClusterV3{Metadata: Metadata{Name: "a"}},
-		&KubernetesClusterV3{Metadata: Metadata{Name: "b"}},
-	}
-
-	clusters := append(expected, extra...)
-
-	result := DeduplicateKubeClusters(clusters)
-	require.ElementsMatch(t, result, expected)
-}
diff --git a/api/types/resource.go b/api/types/resource.go
index 65c18167cff4c..ef52ae8ca0f01 100644
--- a/api/types/resource.go
+++ b/api/types/resource.go
@@ -90,21 +90,14 @@ type ResourceWithLabels interface {
 // ResourcesWithLabels is a list of labeled resources.
 type ResourcesWithLabels []ResourceWithLabels
 
-// ResourcesWithLabelsMap is like ResourcesWithLabels, but a map from resource name to its value.
-type ResourcesWithLabelsMap map[string]ResourceWithLabels
-
-// ToMap returns these databases as a map keyed by database name.
-func (r ResourcesWithLabels) ToMap() ResourcesWithLabelsMap {
-	rm := make(ResourcesWithLabelsMap, len(r))
-
-	// there may be duplicate resources in the input list.
-	// by iterating from end to start, the first resource of given name wins.
-	for i := len(r) - 1; i >= 0; i-- {
-		resource := r[i]
-		rm[resource.GetName()] = resource
+// Find returns resource with the specified name or nil.
+func (r ResourcesWithLabels) Find(name string) ResourceWithLabels {
+	for _, resource := range r {
+		if resource.GetName() == name {
+			return resource
+		}
 	}
-
-	return rm
+	return nil
 }
 
 // Len returns the slice length.
@@ -155,32 +148,6 @@ func (r ResourcesWithLabels) AsDatabaseServers() ([]DatabaseServer, error) {
 	return dbs, nil
 }
 
-// AsWindowsDesktops converts each resource into type WindowsDesktop.
-func (r ResourcesWithLabels) AsWindowsDesktops() ([]WindowsDesktop, error) {
-	desktops := make([]WindowsDesktop, 0, len(r))
-	for _, resource := range r {
-		desktop, ok := resource.(WindowsDesktop)
-		if !ok {
-			return nil, trace.BadParameter("expected types.WindowsDesktop, got: %T", resource)
-		}
-		desktops = append(desktops, desktop)
-	}
-	return desktops, nil
-}
-
-// AsKubeClusters converts each resource into type KubeCluster.
-func (r ResourcesWithLabels) AsKubeClusters() ([]KubeCluster, error) {
-	clusters := make([]KubeCluster, 0, len(r))
-	for _, resource := range r {
-		cluster, ok := resource.(KubeCluster)
-		if !ok {
-			return nil, trace.BadParameter("expected types.KubeCluster, got: %T", resource)
-		}
-		clusters = append(clusters, cluster)
-	}
-	return clusters, nil
-}
-
 // GetVersion returns resource version
 func (h *ResourceHeader) GetVersion() string {
 	return h.Version
diff --git a/api/types/resource_test.go b/api/types/resource_test.go
index 9dd7c9e88b80f..b0f9c9bb4146a 100644
--- a/api/types/resource_test.go
+++ b/api/types/resource_test.go
@@ -322,53 +322,3 @@ func TestMatchSearch_ResourceSpecific(t *testing.T) {
 		})
 	}
 }
-
-func TestResourcesWithLabels_ToMap(t *testing.T) {
-	mkServerHost := func(name string, hostname string) ResourceWithLabels {
-		server, err := NewServerWithLabels(name, KindNode, ServerSpecV2{
-			Hostname: hostname + ".example.com",
-			Addr:     name + ".example.com",
-		}, nil)
-		require.NoError(t, err)
-
-		return server
-	}
-
-	mkServer := func(name string) ResourceWithLabels {
-		return mkServerHost(name, name)
-	}
-
-	tests := []struct {
-		name string
-		r    ResourcesWithLabels
-		want ResourcesWithLabelsMap
-	}{
-		{
-			name: "empty",
-			r:    nil,
-			want: map[string]ResourceWithLabels{},
-		},
-		{
-			name: "simple list",
-			r:    []ResourceWithLabels{mkServer("a"), mkServer("b"), mkServer("c")},
-			want: map[string]ResourceWithLabels{
-				"a": mkServer("a"),
-				"b": mkServer("b"),
-				"c": mkServer("c"),
-			},
-		},
-		{
-			name: "first duplicate wins",
-			r:    []ResourceWithLabels{mkServerHost("a", "a1"), mkServerHost("a", "a2"), mkServerHost("a", "a3")},
-			want: map[string]ResourceWithLabels{
-				"a": mkServerHost("a", "a1"),
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require.Equal(t, tt.r.ToMap(), tt.want)
-		})
-	}
-}
diff --git a/api/types/role.go b/api/types/role.go
index 0953b122624a7..2f4d0ad9af991 100644
--- a/api/types/role.go
+++ b/api/types/role.go
@@ -159,11 +159,11 @@ type Role interface {
 	GetSessionPolicySet() SessionTrackerPolicySet
 }
 
-// NewRole constructs new standard V5 role.
-// This creates a V5 role with V4+ RBAC semantics.
+// NewRole constructs new standard V3 role.
+// This is mostly a legacy function and will create a role with V3 RBAC semantics.
 func NewRole(name string, spec RoleSpecV5) (Role, error) {
 	role := RoleV5{
-		Version: V5,
+		Version: V3,
 		Metadata: Metadata{
 			Name: name,
 		},
@@ -175,11 +175,11 @@ func NewRole(name string, spec RoleSpecV5) (Role, error) {
 	return &role, nil
 }
 
-// NewRoleV3 constructs new standard V3 role.
-// This is mostly a legacy function and will create a role with V3 RBAC semantics.
-func NewRoleV3(name string, spec RoleSpecV5) (Role, error) {
+// NewRoleV5 constructs new standard V5 role.
+// This creates a V5 role with V4+ RBAC semantics. This should be preferred over `NewRole`.
+func NewRoleV5(name string, spec RoleSpecV5) (Role, error) {
 	role := RoleV5{
-		Version: V3,
+		Version: V5,
 		Metadata: Metadata{
 			Name: name,
 		},
@@ -604,8 +604,11 @@ func (r *RoleV5) SetRules(rct RoleConditionType, in []Rule) {
 // setStaticFields sets static resource header and metadata fields.
 func (r *RoleV5) setStaticFields() {
 	r.Kind = KindRole
-	if r.Version != V3 && r.Version != V4 {
-		r.Version = V5
+	// TODO(Joerger/nklaassen) Role should default to V4
+	// but shouldn't overwrite V3. For now, this does the
+	// opposite due to an internal reliance on V3 defaults.
+	if r.Version != V4 && r.Version != V5 {
+		r.Version = V3
 	}
 }
 
diff --git a/api/types/server_test.go b/api/types/server_test.go
index 4b145d7bb0ad2..b5de2617ae0e4 100644
--- a/api/types/server_test.go
+++ b/api/types/server_test.go
@@ -76,6 +76,8 @@ func TestServerSorter(t *testing.T) {
 	for _, c := range cases {
 		c := c
 		t.Run(fmt.Sprintf("%s desc", c.name), func(t *testing.T) {
+			t.Parallel()
+
 			sortBy := SortBy{Field: c.fieldName, IsDesc: true}
 			servers := Servers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
@@ -85,6 +87,8 @@ func TestServerSorter(t *testing.T) {
 		})
 
 		t.Run(fmt.Sprintf("%s asc", c.name), func(t *testing.T) {
+			t.Parallel()
+
 			sortBy := SortBy{Field: c.fieldName}
 			servers := Servers(makeServers(testValsUnordered, c.fieldName))
 			require.NoError(t, servers.SortByCustom(sortBy))
diff --git a/api/types/types.pb.go b/api/types/types.pb.go
index 29ee65f6c47ad..b8185b731b525 100644
--- a/api/types/types.pb.go
+++ b/api/types/types.pb.go
@@ -8156,9 +8156,7 @@ type WindowsDesktopServiceSpecV3 struct {
 	// Addr is the address that this service can be reached at.
 	Addr string `protobuf:"bytes,1,opt,name=Addr,proto3" json:"addr"`
 	// TeleportVersion is teleport binary version running this service.
-	TeleportVersion string `protobuf:"bytes,2,opt,name=TeleportVersion,proto3" json:"teleport_version"`
-	// Hostname is the desktop service hostname.
-	Hostname             string   `protobuf:"bytes,3,opt,name=Hostname,proto3" json:"hostname"`
+	TeleportVersion      string   `protobuf:"bytes,2,opt,name=TeleportVersion,proto3" json:"teleport_version"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -8197,11 +8195,8 @@ func (m *WindowsDesktopServiceSpecV3) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_WindowsDesktopServiceSpecV3 proto.InternalMessageInfo
 
-// WindowsDesktopFilter are filters to apply when searching for windows desktops.
 type WindowsDesktopFilter struct {
-	// HostID is the ID of the host the Windows Desktop Service proxying the desktop.
-	HostID string `protobuf:"bytes,1,opt,name=HostID,proto3" json:"host_id"`
-	// Name is the name of the desktop.
+	HostID               string   `protobuf:"bytes,1,opt,name=HostID,proto3" json:"host_id"`
 	Name                 string   `protobuf:"bytes,2,opt,name=Name,proto3" json:"name"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
@@ -9005,731 +9000,730 @@ func init() {
 func init() { proto.RegisterFile("types.proto", fileDescriptor_d938547f84707355) }
 
 var fileDescriptor_d938547f84707355 = []byte{
-	// 11573 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xdc, 0xbd, 0x5d, 0x6c, 0x24, 0x49,
-	0x72, 0x18, 0x3c, 0xd5, 0xdd, 0x24, 0xbb, 0x83, 0x4d, 0xb2, 0x99, 0x9c, 0x1f, 0xce, 0xec, 0xec,
-	0xf6, 0x5c, 0xed, 0xdf, 0xcc, 0xdc, 0xee, 0xf0, 0x86, 0x73, 0x3b, 0xd2, 0xde, 0xfe, 0x5d, 0x37,
-	0xc9, 0x99, 0xe1, 0x0e, 0x87, 0xe4, 0x56, 0xf3, 0xe7, 0x4e, 0x77, 0xa7, 0x52, 0xb1, 0x2b, 0x87,
-	0xac, 0x65, 0x77, 0x57, 0xab, 0xaa, 0x7a, 0x66, 0x28, 0x7d, 0x82, 0xf4, 0xc1, 0x90, 0x05, 0x41,
-	0xd0, 0xfd, 0x08, 0x27, 0x4b, 0x32, 0x64, 0x48, 0x16, 0x2c, 0xd8, 0xb2, 0x71, 0x7e, 0x90, 0x0d,
-	0xd8, 0x06, 0x0c, 0x03, 0x02, 0x0c, 0xe1, 0x1e, 0x6c, 0x58, 0x6f, 0x86, 0x64, 0x83, 0xb6, 0xee,
-	0xfc, 0x22, 0x02, 0x36, 0x0c, 0xf8, 0x49, 0x67, 0x0b, 0x36, 0x32, 0x32, 0xb3, 0x2a, 0xb3, 0xba,
-	0x9a, 0x6c, 0xee, 0xce, 0x02, 0x37, 0xf3, 0x44, 0x76, 0x64, 0x44, 0x54, 0xfe, 0x46, 0x46, 0x64,
-	0x46, 0x44, 0xc2, 0x78, 0x74, 0xd0, 0xa5, 0xe1, 0x8d, 0x6e, 0xe0, 0x47, 0x3e, 0x19, 0xc1, 0x1f,
-	0x97, 0xce, 0xee, 0xfa, 0xbb, 0x3e, 0x42, 0xe6, 0xd8, 0x7f, 0xbc, 0xf0, 0x52, 0x75, 0xd7, 0xf7,
-	0x77, 0x5b, 0x74, 0x0e, 0x7f, 0xed, 0xf4, 0x1e, 0xce, 0x45, 0x5e, 0x9b, 0x86, 0x91, 0xd3, 0xee,
-	0x0a, 0x84, 0x85, 0x5d, 0x2f, 0xda, 0xeb, 0xed, 0xdc, 0x68, 0xfa, 0xed, 0xb9, 0xdd, 0xc0, 0x79,
-	0xe4, 0x45, 0x4e, 0xe4, 0xf9, 0x1d, 0xa7, 0x35, 0x17, 0xd1, 0x16, 0xed, 0xfa, 0x41, 0x34, 0xe7,
-	0x74, 0xbd, 0x39, 0xfc, 0xc6, 0xdc, 0xe3, 0xc0, 0xe9, 0x76, 0x69, 0x90, 0xfc, 0xc3, 0x99, 0x98,
-	0x7f, 0x3f, 0x0f, 0xa5, 0xfb, 0x94, 0x76, 0x6b, 0x2d, 0xef, 0x11, 0x25, 0x2f, 0x43, 0x61, 0xd5,
-	0x69, 0xd3, 0x59, 0xe3, 0x8a, 0x71, 0xb5, 0x54, 0x9f, 0x3a, 0x3a, 0xac, 0x8e, 0x87, 0x34, 0x78,
-	0x44, 0x03, 0xbb, 0xe3, 0xb4, 0xa9, 0x85, 0x85, 0xe4, 0xf3, 0x50, 0x62, 0x7f, 0xc3, 0xae, 0xd3,
-	0xa4, 0xb3, 0x39, 0xc4, 0x9c, 0x38, 0x3a, 0xac, 0x96, 0x3a, 0x12, 0x68, 0x25, 0xe5, 0xe4, 0x35,
-	0x18, 0x5b, 0xa1, 0x4e, 0x48, 0x97, 0x17, 0x67, 0xf3, 0x57, 0x8c, 0xab, 0xf9, 0x7a, 0xf9, 0xe8,
-	0xb0, 0x5a, 0x6c, 0x31, 0x90, 0xed, 0xb9, 0x96, 0x2c, 0x24, 0xcb, 0x30, 0xb6, 0xf4, 0xa4, 0xeb,
-	0x05, 0x34, 0x9c, 0x2d, 0x5c, 0x31, 0xae, 0x8e, 0xcf, 0x5f, 0xba, 0xc1, 0xdb, 0x7f, 0x43, 0xb6,
-	0xff, 0xc6, 0x86, 0x6c, 0x7f, 0x7d, 0xe6, 0xfb, 0x87, 0xd5, 0x33, 0x47, 0x87, 0xd5, 0x31, 0xca,
-	0x49, 0xbe, 0xfd, 0x5f, 0xaa, 0x86, 0x25, 0xe9, 0xc9, 0xbb, 0x50, 0xd8, 0x38, 0xe8, 0xd2, 0xd9,
-	0xd2, 0x15, 0xe3, 0xea, 0xe4, 0xfc, 0x4b, 0x37, 0x78, 0x8f, 0xc7, 0x8d, 0x4c, 0xfe, 0x63, 0x58,
-	0xf5, 0xe2, 0xd1, 0x61, 0xb5, 0xc0, 0x50, 0x2c, 0xa4, 0x22, 0x6f, 0xc2, 0xe8, 0x3d, 0x3f, 0x8c,
-	0x96, 0x17, 0x67, 0x01, 0x9b, 0x76, 0xee, 0xe8, 0xb0, 0x3a, 0xbd, 0xe7, 0x87, 0x91, 0xed, 0xb9,
-	0x6f, 0xf8, 0x6d, 0x2f, 0xa2, 0xed, 0x6e, 0x74, 0x60, 0x09, 0x24, 0x73, 0x07, 0x26, 0x34, 0x7e,
-	0x64, 0x1c, 0xc6, 0x36, 0x57, 0xef, 0xaf, 0xae, 0x6d, 0xaf, 0x56, 0xce, 0x90, 0x22, 0x14, 0x56,
-	0xd7, 0x16, 0x97, 0x2a, 0x06, 0x19, 0x83, 0x7c, 0x6d, 0x7d, 0xbd, 0x92, 0x23, 0x65, 0x28, 0x2e,
-	0xd6, 0x36, 0x6a, 0xf5, 0x5a, 0x63, 0xa9, 0x92, 0x27, 0x33, 0x30, 0xb5, 0xbd, 0xbc, 0xba, 0xb8,
-	0xb6, 0xdd, 0xb0, 0x17, 0x97, 0x1a, 0xf7, 0x37, 0xd6, 0xd6, 0x2b, 0x05, 0x32, 0x09, 0x70, 0x7f,
-	0xb3, 0xbe, 0x64, 0xad, 0x2e, 0x6d, 0x2c, 0x35, 0x2a, 0x23, 0xe6, 0xaf, 0xe4, 0xa1, 0xf8, 0x80,
-	0x46, 0x8e, 0xeb, 0x44, 0x0e, 0xb9, 0xac, 0x0d, 0x11, 0xd6, 0x5e, 0x19, 0x9b, 0x97, 0xfb, 0xc7,
-	0x66, 0xe4, 0xe8, 0xb0, 0x6a, 0xbc, 0xa9, 0x8e, 0xc9, 0x3b, 0x30, 0xbe, 0x48, 0xc3, 0x66, 0xe0,
-	0x75, 0xd9, 0x7c, 0xc1, 0x71, 0x29, 0xd5, 0x2f, 0x1e, 0x1d, 0x56, 0xcf, 0xb9, 0x09, 0x58, 0x69,
-	0xab, 0x8a, 0x4d, 0x96, 0x61, 0x74, 0xc5, 0xd9, 0xa1, 0xad, 0x70, 0x76, 0xe4, 0x4a, 0xfe, 0xea,
-	0xf8, 0xfc, 0x0b, 0xa2, 0x7f, 0x65, 0x05, 0x6f, 0xf0, 0xd2, 0xa5, 0x4e, 0x14, 0x1c, 0xd4, 0xcf,
-	0x1e, 0x1d, 0x56, 0x2b, 0x2d, 0x04, 0xa8, 0x7d, 0xc7, 0x51, 0x48, 0x23, 0x19, 0xf3, 0xd1, 0x13,
-	0xc7, 0xfc, 0xc5, 0xef, 0x1f, 0x56, 0x0d, 0x36, 0x16, 0x62, 0xcc, 0x13, 0x7e, 0xfa, 0xe8, 0x5f,
-	0x81, 0xdc, 0xf2, 0xe2, 0xec, 0x18, 0xce, 0xb5, 0xca, 0xd1, 0x61, 0xb5, 0xac, 0x0d, 0x5b, 0x6e,
-	0x79, 0xf1, 0xd2, 0xdb, 0x30, 0xae, 0xd4, 0x91, 0x54, 0x20, 0xbf, 0x4f, 0x0f, 0x78, 0x7f, 0x5a,
-	0xec, 0x5f, 0x72, 0x16, 0x46, 0x1e, 0x39, 0xad, 0x9e, 0xe8, 0x40, 0x8b, 0xff, 0xf8, 0x52, 0xee,
-	0x27, 0x0d, 0xf3, 0x37, 0x0a, 0x50, 0xb4, 0x7c, 0xbe, 0xce, 0xc8, 0x35, 0x18, 0x69, 0x44, 0x4e,
-	0x24, 0x87, 0x62, 0xe6, 0xe8, 0xb0, 0x3a, 0x15, 0x32, 0x80, 0xf2, 0x3d, 0x8e, 0xc1, 0x50, 0xd7,
-	0xf7, 0x9c, 0x50, 0x0e, 0x09, 0xa2, 0x76, 0x19, 0x40, 0x45, 0x45, 0x0c, 0xf2, 0x1a, 0x14, 0x1e,
-	0xf8, 0x2e, 0x15, 0xa3, 0x42, 0x8e, 0x0e, 0xab, 0x93, 0x6d, 0xdf, 0x55, 0x11, 0xb1, 0x9c, 0xbc,
-	0x01, 0xa5, 0x85, 0x5e, 0x10, 0xd0, 0x0e, 0x9b, 0xaa, 0x05, 0x44, 0x9e, 0x3c, 0x3a, 0xac, 0x42,
-	0x93, 0x03, 0xd9, 0xe2, 0x4a, 0x10, 0x58, 0x57, 0x37, 0x22, 0x27, 0x88, 0xa8, 0x3b, 0x3b, 0x32,
-	0x54, 0x57, 0xb3, 0xe5, 0x35, 0x1d, 0x72, 0x92, 0x74, 0x57, 0x0b, 0x4e, 0xe4, 0x1e, 0x8c, 0xdf,
-	0x0d, 0x9c, 0x26, 0x5d, 0xa7, 0x81, 0xe7, 0xbb, 0x38, 0x86, 0xf9, 0xfa, 0x6b, 0x47, 0x87, 0xd5,
-	0xf3, 0xbb, 0x0c, 0x6c, 0x77, 0x11, 0x9e, 0x50, 0xff, 0xe8, 0xb0, 0x5a, 0x5c, 0xec, 0x05, 0xd8,
-	0x7b, 0x96, 0x4a, 0x4a, 0x7e, 0x86, 0x0d, 0x49, 0x18, 0x61, 0xd7, 0x52, 0x17, 0x47, 0xef, 0xf8,
-	0x2a, 0x9a, 0xa2, 0x8a, 0xe7, 0x5b, 0x4e, 0x18, 0xd9, 0x01, 0xa7, 0x4b, 0xd5, 0x53, 0x65, 0x49,
-	0xd6, 0xa0, 0xd8, 0x68, 0xee, 0x51, 0xb7, 0xd7, 0xa2, 0xb3, 0x45, 0x64, 0x7f, 0x41, 0x4c, 0x5c,
-	0x39, 0x9e, 0xb2, 0xb8, 0x7e, 0x49, 0xf0, 0x26, 0xa1, 0x80, 0x28, 0x7d, 0x1f, 0x33, 0xf9, 0x52,
-	0xf1, 0xb7, 0x7f, 0xbf, 0x7a, 0xe6, 0x97, 0xfe, 0xf3, 0x95, 0x33, 0xe6, 0xbf, 0xc8, 0x41, 0x25,
-	0xcd, 0x84, 0x3c, 0x84, 0x89, 0xcd, 0xae, 0xeb, 0x44, 0x74, 0xa1, 0xe5, 0xd1, 0x4e, 0x14, 0xe2,
-	0x24, 0x39, 0xbe, 0x4d, 0xaf, 0x88, 0xef, 0xce, 0xf6, 0x90, 0xd0, 0x6e, 0x72, 0xca, 0x54, 0xab,
-	0x74, 0xb6, 0xc9, 0x77, 0x1a, 0x28, 0xa7, 0x43, 0x9c, 0x61, 0xa7, 0xfb, 0x0e, 0x97, 0xf0, 0x03,
-	0xbe, 0x23, 0xd8, 0x8a, 0x09, 0xd4, 0x71, 0x77, 0x0e, 0x70, 0x66, 0x0e, 0x3f, 0x81, 0x18, 0x49,
-	0xc6, 0x04, 0x62, 0x60, 0xf3, 0xbf, 0x19, 0x30, 0x69, 0xd1, 0xd0, 0xef, 0x05, 0x4d, 0x7a, 0x8f,
-	0x3a, 0x2e, 0x0d, 0xd8, 0xf4, 0xbf, 0xef, 0x75, 0x5c, 0xb1, 0xa6, 0x70, 0xfa, 0xef, 0x7b, 0x1d,
-	0x75, 0x09, 0x63, 0x39, 0xf9, 0x02, 0x8c, 0x35, 0x7a, 0x3b, 0x88, 0xca, 0xd7, 0xd4, 0x79, 0x1c,
-	0xb1, 0xde, 0x8e, 0x9d, 0x42, 0x97, 0x68, 0x64, 0x0e, 0xc6, 0xb6, 0x68, 0x10, 0x26, 0x12, 0x0f,
-	0x25, 0xfb, 0x23, 0x0e, 0x52, 0x09, 0x04, 0x16, 0xb9, 0x9b, 0x48, 0x5d, 0xb1, 0x27, 0x4d, 0xa5,
-	0x64, 0x5d, 0x32, 0x55, 0xda, 0x02, 0xa2, 0x4e, 0x15, 0x89, 0x65, 0x7e, 0x27, 0x07, 0x95, 0x45,
-	0x27, 0x72, 0x76, 0x9c, 0x50, 0xf4, 0xe7, 0xd6, 0x2d, 0x26, 0xc7, 0x95, 0x86, 0xa2, 0x1c, 0x67,
-	0x35, 0xff, 0xc4, 0xcd, 0x7b, 0x35, 0xdd, 0xbc, 0x71, 0xb6, 0x41, 0x8a, 0xe6, 0x25, 0x8d, 0x7a,
-	0xef, 0xe4, 0x46, 0x55, 0x44, 0xa3, 0x8a, 0xb2, 0x51, 0x49, 0x53, 0xc8, 0x7b, 0x50, 0x68, 0x74,
-	0x69, 0x53, 0x08, 0x11, 0x29, 0xfb, 0xf5, 0xc6, 0x31, 0x84, 0xad, 0x5b, 0xf5, 0xb2, 0x60, 0x53,
-	0x08, 0xbb, 0xb4, 0x69, 0x21, 0x99, 0xb2, 0x68, 0xbe, 0x3b, 0x0a, 0x67, 0xb3, 0xc8, 0xc8, 0x7b,
-	0xfa, 0xe6, 0xc4, 0xbb, 0xe7, 0x85, 0x81, 0x9b, 0xd3, 0xac, 0xa1, 0x6f, 0x4f, 0xd7, 0xa1, 0xb8,
-	0xce, 0x26, 0x64, 0xd3, 0x6f, 0x89, 0x9e, 0x63, 0x52, 0xb1, 0xd8, 0x95, 0x30, 0xc3, 0x8a, 0xcb,
-	0xc9, 0x0b, 0x90, 0xdf, 0xb4, 0x96, 0x45, 0x77, 0x95, 0x8e, 0x0e, 0xab, 0xf9, 0x5e, 0xe0, 0xcd,
-	0x1a, 0x16, 0x83, 0x92, 0x39, 0x18, 0x5d, 0xa8, 0x2d, 0xd0, 0x20, 0xc2, 0x6e, 0x2a, 0xd7, 0x2f,
-	0xb0, 0xd9, 0xd2, 0x74, 0xec, 0x26, 0x0d, 0x22, 0xed, 0xf3, 0x02, 0x8d, 0x7c, 0x1e, 0xf2, 0xb5,
-	0xed, 0x86, 0xe8, 0x19, 0x10, 0x3d, 0x53, 0xdb, 0x6e, 0xd4, 0x27, 0x44, 0x47, 0xe4, 0x9d, 0xc7,
-	0x21, 0xe3, 0x5e, 0xdb, 0x6e, 0xa8, 0xa3, 0x35, 0x7a, 0xcc, 0x68, 0x5d, 0x85, 0x22, 0xd3, 0x33,
-	0xd8, 0x06, 0x8f, 0x42, 0xb1, 0xc4, 0xd5, 0xa7, 0x3d, 0x01, 0xb3, 0xe2, 0x52, 0xf2, 0x72, 0xac,
-	0xb6, 0x14, 0x13, 0x7e, 0x42, 0x6d, 0x91, 0xca, 0x0a, 0x79, 0x02, 0x13, 0x8b, 0x07, 0x1d, 0xa7,
-	0xed, 0x35, 0xc5, 0x16, 0x5e, 0xc2, 0x2d, 0xfc, 0xc6, 0x31, 0xc3, 0x78, 0x43, 0x23, 0xe0, 0xbb,
-	0xba, 0x14, 0xbe, 0xb3, 0x2e, 0x2f, 0xb3, 0xd3, 0x3b, 0xfc, 0xac, 0x61, 0xe9, 0x1f, 0x62, 0x6b,
-	0x49, 0x8a, 0x48, 0xd4, 0xab, 0x92, 0x69, 0x27, 0xc1, 0xc9, 0x5a, 0x0a, 0x04, 0x44, 0x5d, 0x4b,
-	0xf1, 0xa6, 0xfb, 0x1e, 0xe4, 0xef, 0x2e, 0xac, 0xcf, 0x8e, 0x23, 0x0f, 0x22, 0x78, 0xdc, 0x5d,
-	0x58, 0x5f, 0x68, 0xf9, 0x3d, 0xb7, 0xf1, 0xd1, 0x4a, 0xfd, 0x82, 0x60, 0x33, 0xb1, 0xdb, 0xec,
-	0x6a, 0x35, 0x62, 0x74, 0x64, 0x09, 0x8a, 0xb2, 0x95, 0xb3, 0x65, 0xe4, 0x31, 0x9d, 0x6a, 0xfc,
-	0xd6, 0x2d, 0xbe, 0xd6, 0x5c, 0xf1, 0x5b, 0xad, 0x85, 0xc4, 0xb9, 0xb4, 0x0d, 0xa4, 0xbf, 0x5f,
-	0x32, 0x34, 0x89, 0xcf, 0xab, 0x9a, 0xc4, 0xf8, 0xfc, 0x39, 0xf1, 0xad, 0x05, 0xbf, 0xdd, 0x76,
-	0x3a, 0x2e, 0xd2, 0x6e, 0xcd, 0xab, 0x0a, 0x46, 0x0d, 0x26, 0x93, 0x8a, 0xac, 0x78, 0x61, 0x44,
-	0xe6, 0xa0, 0x24, 0x21, 0x6c, 0x13, 0xc9, 0x67, 0x56, 0xd9, 0x4a, 0x70, 0xcc, 0x3f, 0xcd, 0x01,
-	0x24, 0x25, 0xcf, 0xa8, 0x9c, 0xf9, 0x09, 0x4d, 0xce, 0x9c, 0x4b, 0x4f, 0xd0, 0x81, 0x12, 0x86,
-	0x7c, 0x00, 0xa3, 0x4c, 0xe5, 0xea, 0x49, 0x95, 0xf2, 0x42, 0x9a, 0x14, 0x0b, 0xb7, 0x6e, 0xd5,
-	0x27, 0x05, 0xf1, 0x68, 0x88, 0x10, 0x4b, 0x90, 0x29, 0x22, 0xea, 0x7f, 0x14, 0x92, 0xc1, 0x10,
-	0xc2, 0xe9, 0xaa, 0x22, 0x5d, 0x8c, 0x64, 0x3d, 0x4a, 0xe9, 0xa2, 0xc8, 0x96, 0x8b, 0x5c, 0xb6,
-	0xf0, 0x4e, 0x1d, 0x13, 0xb2, 0x25, 0x2d, 0x59, 0x78, 0x07, 0x9e, 0x28, 0x59, 0xba, 0xe9, 0x65,
-	0x5b, 0xc0, 0x69, 0x70, 0x35, 0xb3, 0x57, 0xb2, 0x16, 0xec, 0x95, 0x93, 0x16, 0x6c, 0x7a, 0xb9,
-	0xde, 0x1a, 0x24, 0xcb, 0xce, 0xc9, 0xd5, 0xe5, 0x3c, 0x56, 0xc9, 0x51, 0xa6, 0xbd, 0xc3, 0x97,
-	0xe6, 0xe8, 0xc0, 0xa5, 0x79, 0x2e, 0x73, 0x69, 0xf2, 0x85, 0xf9, 0x0e, 0x8c, 0xd4, 0x7e, 0xae,
-	0x17, 0x50, 0xa1, 0xfb, 0x95, 0xe5, 0x37, 0x19, 0x2c, 0x5e, 0xd3, 0x53, 0x0e, 0xfb, 0xa9, 0xea,
-	0xcc, 0x58, 0xce, 0xbe, 0xbc, 0xb1, 0xd2, 0x10, 0x7a, 0x1d, 0x49, 0x75, 0xcb, 0xc6, 0x8a, 0x52,
-	0xed, 0x48, 0x6b, 0x35, 0xa3, 0x22, 0x73, 0x90, 0xab, 0x2d, 0xa2, 0xb1, 0x38, 0x3e, 0x5f, 0x92,
-	0x9f, 0x5d, 0xac, 0x9f, 0x15, 0x24, 0x65, 0x47, 0xb3, 0x1f, 0x6a, 0x8b, 0x9f, 0xdd, 0xe2, 0x6f,
-	0x29, 0x6a, 0x82, 0x98, 0xa6, 0xcc, 0x1c, 0x15, 0x93, 0xc5, 0x48, 0x94, 0x96, 0xbe, 0xc9, 0x12,
-	0x4f, 0x95, 0x6b, 0x7c, 0xe0, 0x72, 0x7d, 0x03, 0x37, 0xae, 0x6c, 0x42, 0x38, 0x5c, 0xe6, 0x5f,
-	0x19, 0x88, 0x4b, 0xde, 0x80, 0x51, 0x8b, 0xee, 0x26, 0x7b, 0x2d, 0xda, 0x6c, 0x01, 0x42, 0xd4,
-	0x0f, 0x70, 0x1c, 0x14, 0xe4, 0xd4, 0x0d, 0xf7, 0xbc, 0x87, 0x91, 0xf8, 0x4a, 0x2c, 0xc8, 0x05,
-	0x58, 0x11, 0xe4, 0x02, 0xa2, 0x09, 0x72, 0x01, 0x63, 0x53, 0xcc, 0x5a, 0x6c, 0x08, 0x65, 0x52,
-	0xd6, 0xd4, 0x5a, 0x54, 0xc6, 0x2a, 0x70, 0xb5, 0xb1, 0xb2, 0x16, 0x1b, 0xe4, 0x36, 0x94, 0x6a,
-	0xcd, 0xa6, 0xdf, 0x53, 0x8c, 0x9e, 0xd9, 0xa3, 0xc3, 0xea, 0x59, 0x87, 0x03, 0x75, 0x13, 0x3d,
-	0x41, 0x35, 0xeb, 0x49, 0xad, 0x19, 0x8f, 0x85, 0x56, 0x2f, 0x8c, 0x68, 0xb0, 0xbc, 0x28, 0x9a,
-	0x8c, 0x3c, 0x9a, 0x1c, 0x98, 0xe2, 0x11, 0xa3, 0x9a, 0xff, 0xc9, 0xc0, 0x1a, 0x93, 0xb7, 0x01,
-	0x96, 0x3b, 0x4c, 0xb1, 0x6d, 0xd2, 0x98, 0x01, 0x1a, 0xcf, 0x9e, 0x80, 0xea, 0x1c, 0x14, 0x64,
-	0xfd, 0xd3, 0xb9, 0xa1, 0x3f, 0xcd, 0x3e, 0x29, 0xd5, 0x64, 0x71, 0x8e, 0x22, 0x3e, 0x19, 0x08,
-	0x68, 0xea, 0x93, 0x09, 0x32, 0x79, 0x0d, 0xc6, 0x96, 0x6b, 0x0f, 0x6a, 0xbd, 0x68, 0x0f, 0xfb,
-	0xab, 0xc8, 0x05, 0x96, 0xe7, 0xb4, 0x6d, 0xa7, 0x17, 0xed, 0x59, 0xb2, 0xd0, 0xfc, 0x25, 0x03,
-	0xc6, 0x95, 0xb5, 0xca, 0xaa, 0xba, 0x1e, 0xf8, 0x1f, 0xd3, 0x66, 0xa4, 0xf7, 0x52, 0x97, 0x03,
-	0x53, 0x55, 0x8d, 0x51, 0x53, 0xbd, 0x93, 0x3b, 0x45, 0xef, 0x98, 0x73, 0x42, 0x04, 0x30, 0x1b,
-	0x40, 0x39, 0xe2, 0x40, 0x1b, 0x80, 0xe9, 0x38, 0xaa, 0x0d, 0xc0, 0xca, 0xcd, 0x3f, 0x32, 0xd8,
-	0xd2, 0x25, 0x73, 0x00, 0xf7, 0xe9, 0x41, 0xe4, 0xec, 0xdc, 0xf1, 0x5a, 0xda, 0xd1, 0xd5, 0x3e,
-	0x42, 0xed, 0x87, 0x5e, 0x8b, 0x5a, 0x0a, 0x0a, 0xb9, 0x05, 0xc5, 0xfb, 0xc1, 0xce, 0x5b, 0x88,
-	0x9e, 0x8b, 0x45, 0xf0, 0xcc, 0x7e, 0xb0, 0xf3, 0x16, 0x22, 0xab, 0xf3, 0x55, 0x22, 0x12, 0x13,
-	0x46, 0x17, 0xfd, 0xb6, 0xe3, 0xc9, 0x6d, 0x0f, 0xd8, 0xde, 0xe1, 0x22, 0xc4, 0x12, 0x25, 0x4c,
-	0xe8, 0x37, 0xd6, 0x57, 0xc5, 0xc4, 0x44, 0xa1, 0x1f, 0x76, 0x3b, 0x16, 0x83, 0x99, 0xdf, 0x33,
-	0x60, 0x5c, 0x91, 0x48, 0xe4, 0x8b, 0xc2, 0xcc, 0x37, 0xf0, 0x90, 0xea, 0x7c, 0xbf, 0xcc, 0x62,
-	0xa5, 0x7c, 0xbb, 0x66, 0xe6, 0xbf, 0x30, 0xfa, 0x13, 0x69, 0x90, 0x1b, 0x46, 0x1a, 0xbc, 0x0d,
-	0xc0, 0x75, 0x39, 0xec, 0x4e, 0x65, 0xde, 0x28, 0x87, 0x7a, 0xea, 0x60, 0x24, 0xc8, 0xe6, 0xff,
-	0x9f, 0x83, 0xa2, 0xb0, 0x55, 0xe6, 0x9f, 0x51, 0x1d, 0xe2, 0x2d, 0x4d, 0x87, 0x98, 0x11, 0xa4,
-	0x8a, 0x72, 0x3b, 0x7f, 0x82, 0x8d, 0xf2, 0x36, 0x94, 0x65, 0x17, 0xa0, 0x2a, 0x76, 0x0d, 0xc6,
-	0xa4, 0x95, 0xcd, 0x15, 0xb1, 0x29, 0x8d, 0xe7, 0xd6, 0xbc, 0x25, 0xcb, 0xcd, 0xef, 0x8c, 0x48,
-	0x5a, 0xfe, 0x25, 0xd6, 0x85, 0x35, 0xd7, 0x0d, 0xd4, 0x2e, 0x74, 0x5c, 0x37, 0xb0, 0x10, 0xca,
-	0x06, 0x6a, 0xbd, 0xb7, 0xd3, 0xf2, 0x9a, 0x88, 0xa3, 0xac, 0x9a, 0x2e, 0x42, 0x6d, 0x86, 0xaa,
-	0x0e, 0x54, 0x82, 0xac, 0x99, 0x08, 0xf9, 0x63, 0x4d, 0x84, 0x9f, 0x86, 0xd2, 0x42, 0xdb, 0xd5,
-	0x54, 0x08, 0x33, 0xa3, 0x53, 0x6e, 0xc4, 0x48, 0x5c, 0x79, 0xb8, 0x2c, 0xfa, 0xe8, 0x6c, 0xb3,
-	0xed, 0xf6, 0x2b, 0x0e, 0x09, 0x4b, 0x4d, 0xc7, 0x1f, 0xf9, 0x34, 0x3a, 0xfe, 0x6d, 0x28, 0x6d,
-	0x86, 0x74, 0xa3, 0xd7, 0xe9, 0xd0, 0x16, 0xaa, 0x13, 0x45, 0x2e, 0x7b, 0x7a, 0x21, 0xb5, 0x23,
-	0x84, 0xaa, 0x15, 0x88, 0x51, 0xd5, 0x69, 0x35, 0x76, 0xcc, 0xb4, 0xfa, 0x22, 0x14, 0x6a, 0xdd,
-	0xae, 0x34, 0x7e, 0xe2, 0x4d, 0xb2, 0xdb, 0xc5, 0xad, 0x6f, 0xd2, 0xe9, 0x76, 0x75, 0x53, 0x06,
-	0xb1, 0x09, 0x05, 0x72, 0xbf, 0xb7, 0x43, 0x83, 0x0e, 0x8d, 0x68, 0x28, 0x44, 0x73, 0x38, 0x0b,
-	0xc8, 0x63, 0x56, 0x9e, 0x31, 0xa7, 0x11, 0xd0, 0x70, 0xbd, 0xb0, 0xdf, 0xdb, 0xa1, 0xb6, 0x90,
-	0xf1, 0x6a, 0xdf, 0x65, 0x30, 0xbc, 0xd4, 0x80, 0x49, 0xbd, 0xff, 0x9f, 0x82, 0x62, 0xf1, 0x61,
-	0xa1, 0x58, 0xac, 0x94, 0xcc, 0x5f, 0xc9, 0xc1, 0x78, 0xad, 0xdb, 0x7d, 0xc6, 0x4f, 0x20, 0x7e,
-	0x52, 0x5b, 0xd5, 0xe7, 0x93, 0xd1, 0x3b, 0xc5, 0xe1, 0xc3, 0x5f, 0x1b, 0x30, 0x95, 0xa2, 0x50,
-	0x6b, 0x6f, 0x0c, 0x69, 0x91, 0xe7, 0x86, 0xb4, 0xc8, 0xf3, 0x83, 0x2d, 0x72, 0x75, 0xcd, 0x14,
-	0x3e, 0xcd, 0x9a, 0x79, 0x1d, 0xf2, 0xb5, 0x6e, 0x57, 0xf4, 0x4a, 0x39, 0xe9, 0x95, 0xad, 0x5b,
-	0x7c, 0x23, 0x72, 0xba, 0x5d, 0x8b, 0x61, 0x98, 0x6f, 0x42, 0x09, 0xc1, 0x28, 0xd1, 0xae, 0x88,
-	0xa5, 0xc0, 0xc5, 0x99, 0x46, 0xc6, 0xa7, 0xbd, 0xf9, 0xbf, 0x0d, 0x18, 0xc1, 0xdf, 0xcf, 0xe8,
-	0x74, 0x99, 0xd7, 0xa6, 0x4b, 0x45, 0x99, 0x2e, 0xc3, 0x4c, 0x94, 0x3f, 0xce, 0x63, 0x6f, 0x89,
-	0x29, 0x22, 0x6c, 0x3a, 0x23, 0xc3, 0xa6, 0xfb, 0x14, 0x02, 0x7c, 0x3f, 0x6d, 0xdd, 0xe5, 0x71,
-	0x30, 0x5e, 0x4e, 0x57, 0xf5, 0xa9, 0x18, 0x76, 0xf7, 0x80, 0x2c, 0x77, 0x42, 0xda, 0xec, 0x05,
-	0xb4, 0xb1, 0xef, 0x75, 0xb7, 0x68, 0xe0, 0x3d, 0x3c, 0x10, 0x9a, 0x21, 0xca, 0x58, 0x4f, 0x94,
-	0xda, 0xe1, 0xbe, 0xd7, 0xb5, 0x1f, 0x61, 0xb9, 0x95, 0x41, 0x43, 0x3e, 0x80, 0x31, 0x8b, 0x3e,
-	0x0e, 0xbc, 0x88, 0x8a, 0xbe, 0x9d, 0x8c, 0xed, 0x00, 0x84, 0x72, 0xdd, 0x24, 0xe0, 0x3f, 0xd4,
-	0xf1, 0x17, 0xe5, 0x9f, 0x9d, 0x19, 0xf5, 0xdd, 0x11, 0x5c, 0x0b, 0x27, 0xdc, 0x94, 0x1d, 0x63,
-	0xa0, 0xeb, 0x83, 0x99, 0x3f, 0xcd, 0x60, 0x6e, 0x41, 0x99, 0x99, 0x6e, 0x29, 0x4b, 0xfd, 0x72,
-	0x32, 0x96, 0x37, 0xd4, 0xe2, 0xe3, 0x2e, 0xc9, 0x34, 0x3e, 0xc4, 0x4e, 0x4f, 0x12, 0x7e, 0xf9,
-	0xf6, 0xa2, 0xc2, 0x38, 0x63, 0x7a, 0xc4, 0xa2, 0xa3, 0xc9, 0x3b, 0xeb, 0xd4, 0x13, 0x63, 0xf4,
-	0xd3, 0x4d, 0x8c, 0xb1, 0x4f, 0x32, 0x31, 0xd2, 0xd7, 0x93, 0xc5, 0xd3, 0x5c, 0x4f, 0x5e, 0xfa,
-	0x00, 0xa6, 0xfb, 0x7a, 0xf8, 0x34, 0x57, 0x7c, 0x9f, 0xdd, 0xb4, 0xfc, 0x85, 0xb8, 0x5f, 0xc8,
-	0x3c, 0x9a, 0xa3, 0x5e, 0x40, 0x9b, 0x11, 0x8a, 0x5e, 0x21, 0x2d, 0x03, 0x01, 0x4b, 0xd9, 0xcb,
-	0x08, 0x23, 0xef, 0xc3, 0x18, 0xbf, 0x22, 0x09, 0x67, 0x73, 0x38, 0xf6, 0x13, 0xe2, 0x8b, 0x1c,
-	0x2a, 0xee, 0xa9, 0x39, 0x86, 0xda, 0xab, 0x82, 0xc8, 0xbc, 0x0b, 0xa3, 0xe2, 0x8a, 0xe5, 0xf8,
-	0x75, 0x51, 0x85, 0x91, 0xad, 0xa4, 0x67, 0xf0, 0x58, 0x9c, 0x37, 0xc2, 0xe2, 0x70, 0xf3, 0xd7,
-	0x0c, 0x98, 0xd4, 0x5b, 0x49, 0x6e, 0xc0, 0xa8, 0xb8, 0x03, 0x34, 0xf0, 0x0e, 0x90, 0xb5, 0x66,
-	0x94, 0xdf, 0xfe, 0x69, 0x77, 0x7e, 0x02, 0x8b, 0x89, 0x7e, 0xc1, 0x01, 0xdb, 0x22, 0x44, 0xbf,
-	0x98, 0xa4, 0x96, 0x2c, 0x63, 0x26, 0x97, 0x45, 0xc3, 0x5e, 0x2b, 0x52, 0x4d, 0xae, 0x00, 0x21,
-	0x96, 0x28, 0x31, 0x0f, 0x0d, 0x80, 0x46, 0xe3, 0xde, 0x7d, 0x7a, 0xb0, 0xee, 0x78, 0x01, 0x9a,
-	0xad, 0xb8, 0x1a, 0xef, 0x8b, 0xd1, 0x2a, 0x0b, 0xb3, 0x95, 0xaf, 0xdc, 0x7d, 0x7a, 0xa0, 0x99,
-	0xad, 0x12, 0x15, 0x97, 0x7c, 0xe0, 0x3d, 0x72, 0x22, 0xca, 0x08, 0x73, 0x48, 0xc8, 0x97, 0x3c,
-	0x87, 0xa6, 0x28, 0x15, 0x64, 0xf2, 0x0d, 0x98, 0x4c, 0x7e, 0xa1, 0xe3, 0x41, 0x1e, 0x6d, 0x3a,
-	0x39, 0x23, 0xf4, 0xc2, 0xfa, 0x4b, 0x47, 0x87, 0xd5, 0x4b, 0x0a, 0x57, 0x9b, 0x61, 0x29, 0xac,
-	0x53, 0xcc, 0xcc, 0x3f, 0x30, 0x00, 0x36, 0x56, 0x1a, 0xb2, 0x81, 0xaf, 0x41, 0x21, 0x3e, 0x0d,
-	0x2a, 0x73, 0xdb, 0x38, 0x65, 0xfc, 0x61, 0x39, 0x79, 0x19, 0xf2, 0x49, 0x4b, 0xa6, 0x8f, 0x0e,
-	0xab, 0x13, 0x7a, 0x0b, 0x58, 0x29, 0xb9, 0x0b, 0x63, 0x43, 0xd5, 0x19, 0x67, 0x67, 0x46, 0x5d,
-	0x25, 0x35, 0x8e, 0xc2, 0x87, 0xdb, 0x1b, 0xcf, 0xef, 0x28, 0x7c, 0x2b, 0x07, 0x53, 0xac, 0x5f,
-	0x6b, 0xbd, 0x68, 0xcf, 0x0f, 0xbc, 0xe8, 0xe0, 0x99, 0xb5, 0x8a, 0xdf, 0xd5, 0x14, 0xa2, 0x4b,
-	0x52, 0x6c, 0xa9, 0x6d, 0x1b, 0xca, 0x38, 0xfe, 0xcb, 0x31, 0x98, 0xc9, 0xa0, 0x22, 0x6f, 0x08,
-	0xef, 0x9b, 0xe4, 0xcc, 0x08, 0xbd, 0x6b, 0x7e, 0x74, 0x58, 0x2d, 0x4b, 0xf4, 0x8d, 0xc4, 0xdb,
-	0x66, 0x1e, 0xc6, 0x85, 0xe9, 0xb3, 0x9a, 0x68, 0xd4, 0xe8, 0xb6, 0x21, 0xcf, 0xc4, 0x50, 0x34,
-	0xa9, 0x48, 0xa4, 0x06, 0xe5, 0x85, 0x3d, 0xda, 0xdc, 0xf7, 0x3a, 0xbb, 0xf7, 0xe9, 0x01, 0xd7,
-	0x97, 0xca, 0xf5, 0x17, 0x99, 0xa5, 0xd5, 0x14, 0x70, 0x36, 0xa4, 0xba, 0x11, 0xa7, 0x91, 0x90,
-	0xf7, 0x61, 0xbc, 0xe1, 0xed, 0x76, 0x24, 0x87, 0x02, 0x72, 0xb8, 0x7c, 0x74, 0x58, 0x3d, 0x1f,
-	0x72, 0x70, 0x3f, 0x03, 0x95, 0x80, 0x5c, 0x83, 0x11, 0xcb, 0x6f, 0x51, 0xbe, 0x0d, 0x0b, 0x7f,
-	0x8e, 0x80, 0x01, 0xd4, 0xb3, 0x69, 0xc4, 0x20, 0xf7, 0x60, 0x8c, 0xfd, 0xf3, 0xc0, 0xe9, 0xce,
-	0x8e, 0xa2, 0xdc, 0x26, 0xb1, 0x82, 0x8f, 0xd0, 0xae, 0xd7, 0xd9, 0x55, 0x75, 0xfc, 0x16, 0xb5,
-	0xdb, 0x4e, 0x57, 0xdb, 0x17, 0x39, 0x22, 0xd9, 0x82, 0xf1, 0x44, 0x10, 0x84, 0xb3, 0x63, 0xda,
-	0x5d, 0x50, 0x52, 0x52, 0xff, 0x9c, 0x60, 0x76, 0x21, 0x6a, 0x85, 0x38, 0xb7, 0xbb, 0x0c, 0x5f,
-	0x6f, 0x8c, 0xc2, 0x48, 0xb3, 0x41, 0x8a, 0x83, 0x6d, 0x10, 0xe3, 0x44, 0x1b, 0xc4, 0x05, 0x10,
-	0x9d, 0x54, 0x6b, 0xed, 0x0a, 0xf7, 0xab, 0x6b, 0x83, 0x27, 0xd8, 0x8d, 0x04, 0x19, 0xd7, 0x24,
-	0x3f, 0x99, 0x12, 0xfd, 0xef, 0xb4, 0x76, 0xb5, 0x93, 0xa9, 0x18, 0x95, 0x75, 0x43, 0x22, 0x6a,
-	0xa4, 0x05, 0x2e, 0xbb, 0x21, 0x29, 0x49, 0xba, 0xe1, 0xe3, 0xc7, 0xd1, 0xa0, 0x6e, 0x50, 0x18,
-	0x91, 0x55, 0x80, 0x5a, 0x33, 0xf2, 0x1e, 0x51, 0x9c, 0x12, 0xe3, 0x5a, 0x47, 0x2c, 0xd4, 0xee,
-	0xd3, 0x83, 0x06, 0x8d, 0x62, 0xcf, 0x86, 0x73, 0x0e, 0xa2, 0xa6, 0xa6, 0x89, 0xa5, 0x70, 0x20,
-	0x5d, 0x38, 0x57, 0x73, 0x5d, 0x8f, 0xbb, 0xe4, 0x6d, 0x04, 0x6c, 0xfe, 0xba, 0xc8, 0xba, 0x9c,
-	0xcd, 0xfa, 0x9a, 0x60, 0xfd, 0x39, 0x27, 0xa6, 0xb2, 0x23, 0x4e, 0x96, 0xfe, 0x4c, 0x36, 0x63,
-	0x73, 0x0d, 0x26, 0xf5, 0x2e, 0xd5, 0x9d, 0xd1, 0xca, 0x50, 0xb4, 0x1a, 0x35, 0xbb, 0x71, 0xaf,
-	0x76, 0xb3, 0x62, 0x90, 0x0a, 0x94, 0xc5, 0xaf, 0x79, 0x7b, 0xfe, 0xad, 0xdb, 0x95, 0x9c, 0x06,
-	0x79, 0xeb, 0xe6, 0x7c, 0x25, 0x6f, 0xfe, 0xb1, 0x01, 0x45, 0x59, 0x3f, 0x72, 0x1b, 0xf2, 0x8d,
-	0xc6, 0xbd, 0xd4, 0x15, 0x64, 0xb2, 0xf5, 0xf2, 0x4d, 0x26, 0x0c, 0xf7, 0xd4, 0x4d, 0xa6, 0xd1,
-	0xb8, 0xc7, 0xe8, 0x36, 0x56, 0x1a, 0x42, 0x69, 0xc9, 0x98, 0xae, 0xd3, 0x03, 0xee, 0x65, 0x6e,
-	0x43, 0xfe, 0xc3, 0xed, 0x0d, 0x61, 0x0d, 0x65, 0x8c, 0x2f, 0xd2, 0x7d, 0xfc, 0x58, 0xdd, 0xfa,
-	0x18, 0x81, 0x69, 0xc1, 0xb8, 0xb2, 0xb4, 0xb8, 0x12, 0xd1, 0xf6, 0x63, 0x37, 0x2d, 0xa1, 0x44,
-	0x30, 0x88, 0x25, 0x4a, 0x98, 0xce, 0xb3, 0xe2, 0x37, 0x9d, 0x96, 0xd0, 0x46, 0x50, 0xe7, 0x69,
-	0x31, 0x80, 0xc5, 0xe1, 0xe6, 0x9f, 0x18, 0x50, 0x59, 0x0f, 0xfc, 0x47, 0x1e, 0x93, 0xc0, 0x1b,
-	0xfe, 0x3e, 0xed, 0x6c, 0xdd, 0x24, 0x6f, 0x4a, 0x21, 0xc0, 0x55, 0xb8, 0x0b, 0x8c, 0x0a, 0x85,
-	0xc0, 0x8f, 0x0e, 0xab, 0xd0, 0x38, 0x08, 0x23, 0xda, 0x66, 0xe5, 0x52, 0x10, 0x28, 0xde, 0x6e,
-	0xb9, 0xe1, 0x3d, 0x68, 0x4e, 0xf0, 0x76, 0xab, 0xc2, 0x08, 0x56, 0x47, 0x71, 0x62, 0x18, 0x89,
-	0x18, 0xc0, 0xe2, 0x70, 0x45, 0x60, 0x7f, 0x27, 0xd7, 0xd7, 0x86, 0xf9, 0xe7, 0xca, 0x0b, 0x45,
-	0x6f, 0xdc, 0x50, 0x9b, 0xd8, 0x57, 0xe1, 0x6c, 0xba, 0x4b, 0xf0, 0x5c, 0xa4, 0x06, 0x53, 0x3a,
-	0x5c, 0x1e, 0x91, 0x5c, 0xc8, 0xfc, 0xd6, 0xd6, 0xbc, 0x95, 0xc6, 0x37, 0x7f, 0x60, 0x40, 0x09,
-	0xff, 0xb5, 0x7a, 0x2d, 0xca, 0x34, 0x9b, 0xda, 0x76, 0x43, 0x5c, 0x48, 0xa9, 0x97, 0x46, 0xce,
-	0xe3, 0xd0, 0x16, 0xb7, 0x57, 0x9a, 0x1c, 0x89, 0x91, 0x05, 0x29, 0xbf, 0x7e, 0x0b, 0xc5, 0x0c,
-	0x8d, 0x49, 0xf9, 0x3d, 0x5d, 0x98, 0x22, 0x15, 0xc8, 0x6c, 0xfc, 0xd8, 0x2f, 0xbf, 0x25, 0x8f,
-	0x86, 0x71, 0xfc, 0x90, 0xce, 0xd7, 0xae, 0x39, 0x24, 0x1a, 0x79, 0x13, 0x46, 0xd9, 0xa7, 0x2d,
-	0x79, 0x89, 0x81, 0x56, 0x05, 0xd6, 0x31, 0xd0, 0x6e, 0x03, 0x39, 0x92, 0xf9, 0x2f, 0x73, 0xe9,
-	0x0e, 0x14, 0x5a, 0xc0, 0x29, 0xd7, 0xc6, 0x3b, 0x30, 0x52, 0x6b, 0xb5, 0xfc, 0xc7, 0x42, 0x4a,
-	0xc8, 0x63, 0x9a, 0xb8, 0xff, 0xf8, 0x0e, 0xeb, 0x30, 0x14, 0xed, 0xf6, 0x97, 0x01, 0xc8, 0x02,
-	0x94, 0x6a, 0xdb, 0x8d, 0xe5, 0xe5, 0xc5, 0x8d, 0x8d, 0x15, 0xe1, 0x64, 0xfc, 0xaa, 0xec, 0x1f,
-	0xcf, 0x73, 0xed, 0x28, 0x6a, 0x0d, 0xf0, 0x41, 0x4c, 0xe8, 0xc8, 0x7b, 0x00, 0x1f, 0xfa, 0x5e,
-	0xe7, 0x01, 0x8d, 0xf6, 0x7c, 0x57, 0x34, 0x9e, 0xa9, 0x14, 0xe3, 0x1f, 0xfb, 0x5e, 0xc7, 0x6e,
-	0x23, 0x98, 0xd5, 0x3d, 0x41, 0xb2, 0x94, 0xff, 0x59, 0x4f, 0xd7, 0xfd, 0x08, 0x75, 0x98, 0x91,
-	0xa4, 0xa7, 0x77, 0xfc, 0x28, 0x7d, 0xc7, 0x22, 0xd1, 0xcc, 0x5f, 0xcf, 0xc1, 0x24, 0xb7, 0x54,
-	0xf9, 0x84, 0x79, 0x66, 0x17, 0xe3, 0x3b, 0xda, 0x62, 0xbc, 0x28, 0x37, 0x06, 0xa5, 0x69, 0x43,
-	0x2d, 0xc5, 0x3d, 0x20, 0xfd, 0x34, 0xc4, 0x92, 0xe7, 0x29, 0xc3, 0xac, 0xc2, 0x9b, 0xc9, 0xdd,
-	0x71, 0x88, 0x44, 0x36, 0x8a, 0xc2, 0xd0, 0xd2, 0x78, 0x98, 0xbf, 0x96, 0x83, 0x09, 0x45, 0x9f,
-	0x7c, 0x66, 0x3b, 0xfe, 0x4b, 0x5a, 0xc7, 0xcb, 0x3b, 0x08, 0xa5, 0x65, 0x43, 0xf5, 0x7b, 0x0f,
-	0xa6, 0xfb, 0x48, 0xd2, 0x6a, 0xb9, 0x31, 0x8c, 0x5a, 0xfe, 0x46, 0xff, 0xe5, 0x36, 0x77, 0x48,
-	0x8e, 0x2f, 0xb7, 0xd5, 0xdb, 0xf4, 0x6f, 0xe5, 0xe0, 0xac, 0xf8, 0x55, 0xeb, 0xb9, 0x5e, 0xb4,
-	0xe0, 0x77, 0x1e, 0x7a, 0xbb, 0xcf, 0xec, 0x58, 0xd4, 0xb4, 0xb1, 0xa8, 0xea, 0x63, 0xa1, 0x34,
-	0x70, 0xf0, 0x90, 0x98, 0xff, 0xba, 0x08, 0xb3, 0x83, 0x08, 0x98, 0xd9, 0xaf, 0x58, 0x55, 0x68,
-	0xf6, 0xa7, 0x2c, 0x56, 0x6e, 0x4f, 0x25, 0xce, 0x1c, 0xb9, 0x21, 0x9c, 0x39, 0x56, 0xa0, 0x82,
-	0x9f, 0x6a, 0xd0, 0x90, 0x75, 0x42, 0x98, 0x78, 0x43, 0x5e, 0x39, 0x3a, 0xac, 0x5e, 0x76, 0x58,
-	0x99, 0x1d, 0x8a, 0x42, 0xbb, 0x17, 0x78, 0x0a, 0x8f, 0x3e, 0x4a, 0xf2, 0x07, 0x06, 0x4c, 0x22,
-	0x70, 0xe9, 0x11, 0xed, 0x44, 0xc8, 0xac, 0x20, 0x2e, 0x69, 0xe2, 0xa0, 0x93, 0x46, 0x14, 0x78,
-	0x9d, 0x5d, 0x3c, 0x48, 0x0a, 0xeb, 0x3b, 0xac, 0x17, 0xfe, 0xe2, 0xb0, 0xfa, 0xee, 0x27, 0x09,
-	0x64, 0x11, 0xac, 0x42, 0x66, 0xc8, 0xf3, 0x8a, 0x52, 0xfc, 0x6c, 0xaa, 0x9a, 0xa9, 0x1a, 0x91,
-	0x9f, 0x82, 0x0b, 0x4b, 0x1d, 0x67, 0xa7, 0x45, 0x17, 0xfc, 0x4e, 0xe4, 0x75, 0x7a, 0x7e, 0x2f,
-	0xac, 0x3b, 0xcd, 0xfd, 0x5e, 0x37, 0x14, 0x87, 0x9d, 0xd8, 0xf2, 0x66, 0x5c, 0x68, 0xef, 0xf0,
-	0x52, 0x85, 0xe5, 0x20, 0x06, 0xe4, 0x1e, 0x4c, 0xf3, 0xa2, 0x5a, 0x2f, 0xf2, 0x1b, 0x4d, 0xa7,
-	0xe5, 0x75, 0x76, 0xf1, 0x0c, 0xb4, 0x58, 0xbf, 0xc4, 0x6c, 0x4b, 0xa7, 0x17, 0xf9, 0x76, 0xc8,
-	0xe1, 0x0a, 0xbf, 0x7e, 0x22, 0xb2, 0x0c, 0x53, 0x16, 0x75, 0xdc, 0x07, 0xce, 0x93, 0x05, 0xa7,
-	0xeb, 0x34, 0xbd, 0xe8, 0x00, 0x2d, 0xb3, 0x7c, 0xbd, 0x7a, 0x74, 0x58, 0x7d, 0x21, 0xa0, 0x8e,
-	0x6b, 0xb7, 0x9d, 0x27, 0x76, 0x53, 0x14, 0x2a, 0xcc, 0xd2, 0x74, 0x31, 0x2b, 0xaf, 0x13, 0xb3,
-	0x2a, 0xa5, 0x59, 0x79, 0x9d, 0xc1, 0xac, 0x12, 0x3a, 0xc9, 0x6a, 0xc3, 0x09, 0x76, 0x69, 0xc4,
-	0x0f, 0x09, 0xe1, 0x8a, 0x71, 0xd5, 0x50, 0x58, 0x45, 0x58, 0x66, 0xe3, 0x81, 0x61, 0x9a, 0x95,
-	0x42, 0xc7, 0x66, 0xde, 0x76, 0xe0, 0x45, 0x54, 0x6d, 0xe1, 0x38, 0x56, 0x0b, 0xfb, 0x1f, 0x8f,
-	0x49, 0x07, 0x35, 0xb1, 0x8f, 0x32, 0xe1, 0xa6, 0x34, 0xb2, 0xdc, 0xc7, 0x2d, 0xbb, 0x95, 0x7d,
-	0x94, 0x31, 0x37, 0xb5, 0x9d, 0x13, 0xd8, 0x4e, 0x85, 0xdb, 0x80, 0x86, 0xf6, 0x51, 0x92, 0x55,
-	0xd6, 0x69, 0x11, 0xed, 0xb0, 0x19, 0x2d, 0x0e, 0x49, 0x27, 0xb1, 0x6a, 0xaf, 0x08, 0x9b, 0xba,
-	0x12, 0xc8, 0x62, 0x3b, 0xe3, 0xc8, 0x34, 0x4d, 0xfc, 0x61, 0xa1, 0x38, 0x52, 0x19, 0xb5, 0x2a,
-	0x7c, 0xca, 0x47, 0x6c, 0xe2, 0xa0, 0x2c, 0x36, 0x7f, 0x27, 0x07, 0x17, 0xa5, 0x38, 0xa6, 0xd1,
-	0x63, 0x3f, 0xd8, 0xf7, 0x3a, 0xbb, 0xcf, 0xb8, 0x54, 0xbd, 0xa3, 0x49, 0xd5, 0x57, 0x52, 0x3b,
-	0x5c, 0xaa, 0x95, 0xc7, 0x88, 0xd6, 0x3f, 0x1f, 0x81, 0x17, 0x8f, 0xa5, 0x22, 0x1f, 0xb1, 0x5d,
-	0xd0, 0xa3, 0x9d, 0x68, 0xd9, 0x6d, 0x51, 0x66, 0x86, 0xf9, 0xbd, 0x48, 0x1c, 0x66, 0xbf, 0x7c,
-	0x74, 0x58, 0x9d, 0xe1, 0xb1, 0x18, 0xb6, 0xe7, 0xb6, 0xa8, 0x1d, 0xf1, 0x62, 0x6d, 0x98, 0xfa,
-	0xa9, 0x19, 0xcb, 0x38, 0x32, 0x6c, 0xb9, 0x13, 0xd1, 0xe0, 0x91, 0xc3, 0x5d, 0xd2, 0x05, 0xcb,
-	0x7d, 0x4a, 0xbb, 0xb6, 0xc3, 0x4a, 0x6d, 0x4f, 0x14, 0xeb, 0x2c, 0xfb, 0xa8, 0xc9, 0x1d, 0x85,
-	0xe5, 0x02, 0x33, 0x0e, 0x1e, 0x38, 0x4f, 0x84, 0xc6, 0x8b, 0xe7, 0xab, 0x0a, 0x4b, 0xee, 0x0f,
-	0xd7, 0x76, 0x9e, 0x58, 0xfd, 0x24, 0xe4, 0x1b, 0x70, 0x4e, 0x08, 0x6e, 0x26, 0xc4, 0x02, 0xbf,
-	0x25, 0x5b, 0x5c, 0x40, 0x5e, 0xaf, 0x1f, 0x1d, 0x56, 0x2f, 0x08, 0xb1, 0x6f, 0x37, 0x39, 0x46,
-	0x66, 0xab, 0xb3, 0xb9, 0x90, 0x0d, 0xb6, 0x91, 0xa5, 0xba, 0xe3, 0x01, 0x0d, 0x43, 0x67, 0x57,
-	0x6a, 0xc7, 0xfc, 0x46, 0x49, 0xe9, 0x4c, 0xbb, 0xcd, 0xcb, 0xad, 0x81, 0x94, 0xe4, 0x1e, 0x4c,
-	0x6e, 0xd3, 0x1d, 0x75, 0x7c, 0x46, 0xe3, 0x25, 0x5e, 0x79, 0x4c, 0x77, 0x06, 0x0f, 0x4e, 0x8a,
-	0x8e, 0x78, 0x30, 0xbd, 0x1e, 0xf8, 0x4f, 0x0e, 0x98, 0xa9, 0x47, 0x3b, 0x34, 0x40, 0x47, 0xac,
-	0x31, 0x3c, 0xae, 0x9a, 0x4d, 0x34, 0x4b, 0xbd, 0xbc, 0xfe, 0xb9, 0xa3, 0xc3, 0xea, 0x8b, 0x5d,
-	0x06, 0xb6, 0x5b, 0x02, 0x6e, 0xa7, 0x02, 0xb3, 0xfa, 0xb9, 0x92, 0x9f, 0x81, 0x29, 0xcb, 0xef,
-	0x45, 0x5e, 0x67, 0xb7, 0x11, 0x05, 0x4e, 0x44, 0x77, 0xb9, 0x20, 0x4f, 0x3c, 0xbe, 0x52, 0xa5,
-	0xfc, 0x60, 0x3a, 0xe0, 0x40, 0x3b, 0x14, 0x50, 0x4d, 0x92, 0xea, 0x04, 0xe6, 0x6f, 0xe5, 0x60,
-	0x56, 0x0c, 0x83, 0x45, 0x9b, 0x7e, 0xe0, 0x3e, 0xfb, 0xcb, 0x7e, 0x49, 0x5b, 0xf6, 0x2f, 0xc7,
-	0x3e, 0x4a, 0x59, 0x8d, 0x3c, 0x66, 0xd5, 0xff, 0x53, 0x03, 0x2e, 0x1f, 0x47, 0xc4, 0x7a, 0x27,
-	0xf6, 0xc1, 0x2b, 0xf5, 0xf9, 0xda, 0x75, 0x61, 0x06, 0xc7, 0x13, 0x0f, 0x8e, 0xc3, 0x7b, 0x7e,
-	0x18, 0xe1, 0xe9, 0x5d, 0x4e, 0x73, 0x24, 0xa8, 0xfb, 0x7e, 0x0b, 0xe5, 0x7c, 0xfd, 0x0d, 0x26,
-	0xce, 0xff, 0xe2, 0xb0, 0x0a, 0x0c, 0xb4, 0x86, 0x97, 0x91, 0x6c, 0xcf, 0xe7, 0x33, 0x06, 0xcf,
-	0xa5, 0x43, 0x1b, 0xbd, 0x3f, 0xf6, 0xe9, 0x41, 0x68, 0x65, 0xb1, 0xc6, 0x13, 0x9a, 0x5a, 0x2f,
-	0xda, 0x5b, 0x0f, 0xe8, 0x43, 0x1a, 0xd0, 0x4e, 0x93, 0x3e, 0x67, 0x27, 0x34, 0x7a, 0xe3, 0x86,
-	0x32, 0x4f, 0xfe, 0xef, 0x28, 0x9c, 0xcd, 0x22, 0x63, 0xfd, 0xa2, 0x68, 0xc4, 0xe9, 0x28, 0xde,
-	0xbf, 0x65, 0x40, 0xb9, 0x41, 0x9b, 0x7e, 0xc7, 0xbd, 0xe3, 0x34, 0x23, 0x5f, 0xba, 0x64, 0xd8,
-	0x5c, 0xb2, 0x31, 0xb8, 0xfd, 0x10, 0x0b, 0xb4, 0x93, 0x81, 0x2f, 0x0f, 0xa7, 0x88, 0x36, 0x7d,
-	0x74, 0x5a, 0x8d, 0xd8, 0x9c, 0x4c, 0x3e, 0x81, 0xb7, 0x1a, 0xda, 0x47, 0x49, 0x1d, 0x26, 0x16,
-	0xfc, 0x4e, 0x87, 0xb2, 0x1f, 0x8a, 0x0b, 0xe6, 0xe5, 0xa3, 0xc3, 0xea, 0x6c, 0x53, 0x16, 0xa4,
-	0x4f, 0x08, 0x74, 0x12, 0x72, 0x0b, 0xf2, 0x9b, 0xf3, 0x77, 0xc4, 0x18, 0x48, 0x67, 0xb5, 0xcd,
-	0xf9, 0x3b, 0x68, 0xeb, 0x32, 0xfd, 0x61, 0xa2, 0x37, 0xff, 0x50, 0x3d, 0x03, 0xdd, 0x9c, 0xbf,
-	0x43, 0xd6, 0x60, 0xda, 0xa2, 0x3f, 0xdb, 0xf3, 0x02, 0x2a, 0x16, 0xc0, 0x83, 0x3b, 0x35, 0x1c,
-	0x8b, 0x22, 0x97, 0x63, 0x01, 0x2f, 0x94, 0xba, 0xbd, 0xdd, 0x7e, 0xa8, 0x46, 0xae, 0xf5, 0xd3,
-	0x92, 0x5f, 0x84, 0x73, 0x8b, 0x5e, 0x28, 0xea, 0xcc, 0x0f, 0x1f, 0x5d, 0xbc, 0x87, 0x1c, 0x1d,
-	0xb0, 0x1c, 0x7e, 0x22, 0x73, 0x39, 0x7c, 0xce, 0x8d, 0x99, 0xd8, 0xfc, 0x64, 0xd3, 0x4d, 0xfb,
-	0xae, 0x66, 0x7f, 0x87, 0x7c, 0x0c, 0x93, 0x78, 0xda, 0x83, 0xe7, 0xb1, 0xe8, 0xce, 0x3c, 0x36,
-	0xe0, 0xcb, 0x5f, 0xc8, 0xfc, 0xf2, 0x25, 0x3c, 0x3c, 0xb2, 0xf1, 0x54, 0x17, 0x5d, 0x9f, 0x35,
-	0x1b, 0x41, 0xe3, 0x4c, 0x3e, 0x84, 0x29, 0xb1, 0xe9, 0xac, 0x3d, 0xdc, 0xd8, 0xa3, 0x8b, 0xce,
-	0x81, 0x70, 0x42, 0x40, 0xfd, 0x4f, 0xec, 0x54, 0xb6, 0xff, 0xd0, 0x8e, 0xf6, 0xa8, 0xed, 0x3a,
-	0x9a, 0x78, 0x4e, 0x11, 0x92, 0x9f, 0x87, 0xf1, 0x15, 0x1f, 0x2f, 0x9e, 0x50, 0xd4, 0x94, 0x90,
-	0xcf, 0x57, 0x31, 0x72, 0x95, 0x83, 0x53, 0x9b, 0xc8, 0x8f, 0x0e, 0xab, 0xef, 0x9c, 0x76, 0x16,
-	0x2a, 0x1f, 0xb0, 0xd4, 0xaf, 0x91, 0x05, 0x28, 0x6e, 0xd3, 0x1d, 0xd6, 0xda, 0x74, 0xd4, 0x95,
-	0x04, 0x73, 0x79, 0xf1, 0x58, 0xfc, 0x52, 0x6f, 0x75, 0x24, 0x86, 0xf9, 0xaf, 0x0c, 0x9c, 0x81,
-	0xe4, 0x3a, 0x3a, 0x82, 0xc5, 0xde, 0xe0, 0x68, 0x59, 0x3a, 0xdd, 0xae, 0xee, 0xcf, 0xcd, 0x51,
-	0x98, 0x19, 0x7a, 0xc7, 0x69, 0xd2, 0x48, 0x9e, 0x57, 0x22, 0xf2, 0x43, 0x84, 0xa8, 0x66, 0x28,
-	0xc7, 0x21, 0x5f, 0x81, 0xb3, 0x8b, 0xf4, 0x91, 0xd7, 0xa4, 0xb5, 0x28, 0xa2, 0x21, 0x6f, 0xed,
-	0x42, 0x8d, 0x5f, 0xec, 0x95, 0xea, 0xaf, 0x1c, 0x1d, 0x56, 0xaf, 0xb8, 0x58, 0x6e, 0x3b, 0x09,
-	0x82, 0xdd, 0x74, 0x54, 0x5e, 0x99, 0x1c, 0xcc, 0xff, 0x69, 0x24, 0x3d, 0x40, 0x5e, 0x87, 0x82,
-	0xb5, 0x1e, 0xd7, 0x9f, 0xdf, 0xd9, 0xa5, 0xaa, 0x8f, 0x08, 0xe4, 0x6b, 0x70, 0x4e, 0xe1, 0x83,
-	0x93, 0x83, 0xba, 0xac, 0x42, 0xbc, 0x31, 0xaf, 0xe2, 0x25, 0x8d, 0x52, 0x13, 0x87, 0x63, 0xa4,
-	0x6a, 0x94, 0xcd, 0x83, 0x35, 0x56, 0x29, 0x58, 0xa4, 0x1d, 0x8f, 0xf3, 0x56, 0x1a, 0xab, 0xf2,
-	0x76, 0x11, 0x21, 0xdd, 0xd8, 0x2c, 0x0e, 0x1f, 0x16, 0x8a, 0x85, 0xca, 0x88, 0xf9, 0xd7, 0x86,
-	0x92, 0x02, 0xe0, 0x19, 0xdd, 0x3d, 0x6e, 0x6b, 0xbb, 0xc7, 0x59, 0x41, 0x1a, 0xb7, 0x8a, 0x95,
-	0x65, 0xee, 0xf8, 0x53, 0x30, 0xa1, 0x21, 0xa1, 0xcb, 0xeb, 0x66, 0x48, 0x03, 0x7e, 0x3e, 0xf8,
-	0x7c, 0xb9, 0xbc, 0xc6, 0xed, 0x1a, 0xca, 0x93, 0xf1, 0x2f, 0x0d, 0x98, 0x4a, 0x51, 0xb0, 0xde,
-	0x60, 0x20, 0xb5, 0x37, 0x7a, 0x21, 0x0d, 0x2c, 0x84, 0x72, 0x07, 0xb9, 0x15, 0xdd, 0x41, 0xae,
-	0x65, 0x31, 0x18, 0xf9, 0x32, 0x8c, 0x6c, 0xa2, 0x36, 0xaf, 0xfb, 0x58, 0xc4, 0xfc, 0xb1, 0x90,
-	0xaf, 0xb0, 0x1e, 0xfb, 0x57, 0x15, 0x10, 0x58, 0x46, 0x1a, 0x30, 0xb6, 0x10, 0x50, 0x0c, 0xf6,
-	0x2f, 0x0c, 0x7f, 0x19, 0xd6, 0xe4, 0x24, 0xe9, 0xcb, 0x30, 0xc1, 0xc9, 0xfc, 0xcd, 0x1c, 0x90,
-	0xa4, 0x8d, 0xb4, 0x19, 0xd0, 0x28, 0x7c, 0x66, 0x07, 0xfd, 0x03, 0x6d, 0xd0, 0x5f, 0xec, 0x1b,
-	0x74, 0xde, 0xbc, 0xa1, 0xc6, 0xfe, 0x4f, 0x0c, 0x38, 0x9f, 0x4d, 0x48, 0x5e, 0x86, 0xd1, 0xb5,
-	0x8d, 0x75, 0xe9, 0xa6, 0x23, 0x9a, 0xe2, 0x77, 0x51, 0x4b, 0xb5, 0x44, 0x11, 0x79, 0x13, 0x46,
-	0x3f, 0xb2, 0x16, 0xd8, 0xf6, 0xa5, 0x44, 0x9d, 0xfc, 0x6c, 0x60, 0x37, 0x75, 0xf3, 0x47, 0x20,
-	0xa9, 0x63, 0x9b, 0x7f, 0x6a, 0x63, 0xfb, 0xad, 0x1c, 0x4c, 0xd5, 0x9a, 0x4d, 0x1a, 0x86, 0x4c,
-	0x39, 0xa1, 0x61, 0xf4, 0xcc, 0x0e, 0x6c, 0xb6, 0x03, 0x8e, 0xd6, 0xb6, 0xa1, 0x46, 0xf5, 0x4f,
-	0x0d, 0x38, 0x27, 0xa9, 0x1e, 0x79, 0xf4, 0xf1, 0xc6, 0x5e, 0x40, 0xc3, 0x3d, 0xbf, 0xe5, 0x0e,
-	0x1b, 0x3f, 0x85, 0xbb, 0xb4, 0xd7, 0x8a, 0x68, 0xa0, 0x1e, 0x16, 0x3f, 0x44, 0x88, 0xb6, 0x4b,
-	0x23, 0x84, 0xcc, 0xc1, 0x58, 0xad, 0xdb, 0x0d, 0xfc, 0x47, 0x7c, 0xd9, 0x4f, 0x88, 0xbb, 0x41,
-	0x0e, 0xd2, 0xee, 0x12, 0x39, 0x88, 0x55, 0x63, 0x91, 0x76, 0xb8, 0x77, 0xf1, 0x04, 0xaf, 0x86,
-	0x4b, 0x3b, 0xaa, 0xb6, 0x84, 0xe5, 0xe6, 0x37, 0x0b, 0x50, 0x56, 0x1b, 0x42, 0x4c, 0x18, 0xe5,
-	0xae, 0x22, 0xea, 0x95, 0xbd, 0x83, 0x10, 0x4b, 0x94, 0x24, 0x1e, 0x38, 0xb9, 0x13, 0x3d, 0x70,
-	0xb6, 0x61, 0x62, 0x3d, 0xf0, 0xbb, 0x7e, 0x48, 0x5d, 0x9e, 0xaf, 0x85, 0x4b, 0xad, 0x99, 0xd8,
-	0x2d, 0x95, 0xf7, 0x39, 0x2b, 0xe2, 0xaa, 0x79, 0x57, 0x60, 0xdb, 0xe9, 0x6c, 0x2e, 0x3a, 0x1f,
-	0x7e, 0xd8, 0xee, 0x84, 0xc2, 0x75, 0x3f, 0x3e, 0x6c, 0x67, 0x10, 0xfd, 0xb0, 0x9d, 0x41, 0xd4,
-	0x65, 0x31, 0xf2, 0xb4, 0x96, 0x05, 0xf9, 0x4d, 0x03, 0xc6, 0x6b, 0x9d, 0x8e, 0xf0, 0xc0, 0x91,
-	0x41, 0xcf, 0xe7, 0x92, 0x03, 0x77, 0xee, 0xa2, 0xc9, 0xcf, 0xdb, 0xbf, 0x2e, 0xce, 0xdb, 0xdf,
-	0xf9, 0x44, 0xe7, 0xed, 0x1b, 0x81, 0xe3, 0x45, 0x21, 0x5e, 0xac, 0x26, 0x1f, 0x54, 0xdd, 0x70,
-	0x95, 0x7a, 0x90, 0x77, 0xa0, 0x12, 0xcf, 0xc7, 0xe5, 0x8e, 0x4b, 0x9f, 0x50, 0xee, 0xb0, 0x34,
-	0xc1, 0x23, 0xf3, 0xb4, 0x8b, 0x84, 0x34, 0xa2, 0xf9, 0x2d, 0x03, 0xce, 0xab, 0x13, 0xa2, 0xd1,
-	0xdb, 0x69, 0x7b, 0x68, 0x8a, 0x90, 0x1b, 0x50, 0x12, 0xe3, 0x15, 0x2b, 0x72, 0xfd, 0x49, 0x7e,
-	0x12, 0x14, 0xb2, 0xc4, 0x86, 0x88, 0xf1, 0x10, 0x76, 0xfb, 0x4c, 0x6a, 0xb9, 0xb1, 0xa2, 0xfa,
-	0xac, 0xe8, 0xec, 0x4a, 0x80, 0xbf, 0xf5, 0xb1, 0x63, 0x10, 0xf3, 0x7d, 0x98, 0xd6, 0x6b, 0xd9,
-	0xa0, 0x18, 0x0e, 0x26, 0x9b, 0x66, 0x64, 0x37, 0x4d, 0x96, 0x9b, 0xdb, 0x40, 0xfa, 0xe8, 0x43,
-	0xbc, 0x34, 0xa2, 0x91, 0xbc, 0xd4, 0x94, 0x47, 0x4f, 0x7d, 0x88, 0x71, 0xba, 0xab, 0x71, 0xb5,
-	0xbb, 0x91, 0xd4, 0xfc, 0x9b, 0x12, 0xcc, 0x64, 0x88, 0x8e, 0x13, 0xb6, 0xf6, 0xaa, 0xbe, 0x78,
-	0x4a, 0xf1, 0xed, 0xbc, 0x5c, 0x32, 0xef, 0xcb, 0xd4, 0x46, 0xc7, 0x2c, 0x95, 0xe3, 0xf2, 0x1d,
-	0x7d, 0x16, 0xdb, 0xbb, 0xea, 0x40, 0x33, 0xf2, 0xd4, 0x1c, 0x68, 0xea, 0x30, 0x21, 0x5a, 0x25,
-	0x96, 0xf2, 0x68, 0x62, 0xa2, 0x07, 0xbc, 0xc0, 0xee, 0x5b, 0xd2, 0x3a, 0x09, 0xe7, 0x11, 0xfa,
-	0xad, 0x47, 0x54, 0xf0, 0x18, 0x53, 0x79, 0x60, 0x41, 0x26, 0x0f, 0x85, 0x84, 0xfc, 0x13, 0x03,
-	0x88, 0x80, 0xa8, 0xeb, 0xb9, 0x78, 0xdc, 0x7a, 0x76, 0x9f, 0xce, 0x7a, 0x7e, 0x51, 0xd6, 0x31,
-	0x7b, 0x5d, 0x67, 0x54, 0x8b, 0xfc, 0x23, 0x03, 0xa6, 0xb9, 0x17, 0x87, 0x5a, 0xd9, 0xd2, 0x71,
-	0x95, 0x6d, 0x3e, 0x9d, 0xca, 0x5e, 0x0e, 0xf1, 0xb3, 0x03, 0xea, 0xda, 0x5f, 0x29, 0xf2, 0x53,
-	0x00, 0xf1, 0x8a, 0x92, 0xde, 0x82, 0x97, 0x33, 0xa4, 0x40, 0x8c, 0x94, 0x04, 0x3c, 0x46, 0x31,
-	0x9d, 0xea, 0x5f, 0x93, 0x70, 0x23, 0xbf, 0x08, 0x67, 0xd9, 0x7a, 0x89, 0x21, 0xc2, 0xe7, 0x6c,
-	0x76, 0x1c, 0xbf, 0xf2, 0xc5, 0xc1, 0x5b, 0xfb, 0x8d, 0x2c, 0x32, 0x1e, 0xb3, 0x91, 0x84, 0xbf,
-	0x47, 0x6d, 0xd5, 0xe4, 0xcb, 0xa2, 0x40, 0xe7, 0x52, 0xac, 0x7d, 0x38, 0x5b, 0xc6, 0x6f, 0x66,
-	0xca, 0xb7, 0x8b, 0x72, 0x2d, 0x70, 0xf9, 0x16, 0xea, 0x41, 0x17, 0x08, 0x22, 0x1f, 0x01, 0x69,
-	0xf4, 0x76, 0x77, 0x69, 0x18, 0x51, 0x97, 0xc3, 0x68, 0x10, 0xce, 0x4e, 0xa0, 0x7c, 0xc0, 0x23,
-	0xa3, 0x50, 0x96, 0xda, 0x81, 0x2c, 0x56, 0x27, 0x49, 0x3f, 0xf1, 0xa5, 0x1d, 0xb8, 0x38, 0xb0,
-	0x99, 0x19, 0x01, 0x15, 0x73, 0x7a, 0x40, 0xc5, 0xc5, 0x41, 0xe2, 0x30, 0x54, 0x83, 0x2a, 0x7e,
-	0xcf, 0x48, 0xc9, 0x3f, 0xa1, 0xac, 0xf0, 0x2c, 0x70, 0x83, 0x36, 0x88, 0x1c, 0x06, 0xc6, 0x73,
-	0x09, 0x99, 0x4b, 0x94, 0x24, 0x26, 0x21, 0x55, 0x09, 0x8b, 0xb2, 0xf2, 0x53, 0x8a, 0x42, 0xf3,
-	0x9f, 0x1b, 0x40, 0x78, 0x0d, 0x17, 0x9c, 0xae, 0xb3, 0xe3, 0xb5, 0xbc, 0xc8, 0xa3, 0x21, 0xb9,
-	0x0f, 0x15, 0xc1, 0xc2, 0xd9, 0x69, 0x51, 0xd5, 0x57, 0x4a, 0x5c, 0xa6, 0xc6, 0x65, 0x76, 0x5a,
-	0xad, 0xe9, 0x23, 0x1c, 0x30, 0x78, 0xb9, 0x4f, 0x31, 0x78, 0xe6, 0x0f, 0x0d, 0xb8, 0xd8, 0x5f,
-	0x6d, 0xf1, 0xe5, 0xb8, 0xf3, 0x8c, 0x13, 0x3a, 0x2f, 0xab, 0x95, 0x39, 0x3c, 0x86, 0x7c, 0x6a,
-	0xad, 0xcc, 0x27, 0xa7, 0x9a, 0xa7, 0x6f, 0xe5, 0xaf, 0xe6, 0xa0, 0xbc, 0xde, 0xea, 0xed, 0x7a,
-	0x9d, 0x45, 0x27, 0x72, 0x9e, 0x59, 0x93, 0xe2, 0x6d, 0xcd, 0xa4, 0x88, 0xbd, 0xa3, 0xe2, 0x86,
-	0x0d, 0x97, 0x91, 0xcb, 0x80, 0xa9, 0x84, 0x84, 0xaf, 0xd2, 0x7b, 0x50, 0x60, 0x3f, 0x84, 0x86,
-	0x72, 0xa5, 0x8f, 0x31, 0x62, 0xdd, 0x88, 0xff, 0x13, 0x4a, 0xbe, 0x9e, 0x07, 0x0d, 0x39, 0x5c,
-	0xfa, 0x09, 0x9e, 0xc6, 0xe8, 0xf4, 0x29, 0x17, 0xff, 0x99, 0x01, 0x95, 0x74, 0x4b, 0xc8, 0x7d,
-	0x18, 0x63, 0x9c, 0xbc, 0x38, 0x25, 0xd2, 0x2b, 0x03, 0xda, 0x7c, 0x43, 0xa0, 0xf1, 0xea, 0x61,
-	0xe7, 0x53, 0x0e, 0xb1, 0x24, 0x87, 0x4b, 0x16, 0x94, 0x55, 0xac, 0x8c, 0xda, 0xbd, 0xa1, 0x8b,
-	0xa6, 0xf3, 0xd9, 0xfd, 0xa0, 0xd6, 0xfa, 0x77, 0xb5, 0x5a, 0x0b, 0xa1, 0x34, 0x6c, 0x6e, 0x3b,
-	0x0c, 0x0f, 0xe3, 0x19, 0x3c, 0xd4, 0x79, 0x26, 0x93, 0x7d, 0xe8, 0xe1, 0x61, 0x1c, 0xc6, 0x6c,
-	0x11, 0xfe, 0x3d, 0x31, 0xcf, 0xd0, 0x16, 0xe9, 0x22, 0x44, 0xd5, 0x67, 0x39, 0x8e, 0xf9, 0xf7,
-	0xf2, 0x70, 0x3e, 0xa9, 0x1e, 0xcf, 0xf4, 0xb7, 0xee, 0x04, 0x4e, 0x3b, 0x3c, 0x61, 0x05, 0x5c,
-	0xed, 0xab, 0x1a, 0x86, 0x3f, 0xcb, 0xaa, 0x29, 0x15, 0x32, 0x53, 0x15, 0x42, 0x23, 0x8e, 0x57,
-	0x48, 0x56, 0x83, 0xdc, 0x87, 0x7c, 0x83, 0x46, 0x22, 0x48, 0xf2, 0xb5, 0xbe, 0x5e, 0x55, 0xeb,
-	0x75, 0xa3, 0x41, 0x23, 0x3e, 0x88, 0xdc, 0xcf, 0x9c, 0x6a, 0x7e, 0xdf, 0x4c, 0x1d, 0xdf, 0x86,
-	0xd1, 0xa5, 0x27, 0x5d, 0xda, 0x8c, 0x44, 0x6c, 0xe4, 0xb5, 0xe3, 0xf9, 0x71, 0x5c, 0x25, 0x02,
-	0x93, 0x22, 0x40, 0xed, 0x2c, 0x8e, 0x72, 0xe9, 0x36, 0x14, 0xe5, 0xc7, 0x4f, 0x15, 0x49, 0xf8,
-	0x36, 0x8c, 0x2b, 0x1f, 0x39, 0xd5, 0xa4, 0xff, 0x1b, 0x03, 0x46, 0x99, 0xd0, 0xdb, 0x7a, 0xeb,
-	0x19, 0x95, 0x48, 0xb7, 0x34, 0x89, 0x34, 0xad, 0x84, 0xbc, 0xe0, 0xba, 0x7c, 0xeb, 0x04, 0x59,
-	0x74, 0x68, 0x00, 0x24, 0xc8, 0xe4, 0x2e, 0x8c, 0xf1, 0x8b, 0x1c, 0x99, 0x46, 0x53, 0x8d, 0xa1,
-	0x11, 0x25, 0x89, 0x96, 0xe3, 0x77, 0xd3, 0x6a, 0xa1, 0xa4, 0x26, 0x8b, 0x89, 0x9f, 0xb1, 0x1a,
-	0xb4, 0xc9, 0xd8, 0x2c, 0xf8, 0x1d, 0x1e, 0x53, 0x11, 0x2a, 0xe9, 0xa6, 0xb2, 0x1d, 0x8e, 0x6b,
-	0xe2, 0x60, 0x23, 0x7f, 0x1c, 0x93, 0xf3, 0x82, 0x49, 0xf6, 0x99, 0xc7, 0xb7, 0xc7, 0x79, 0x94,
-	0x82, 0xac, 0xd8, 0x7b, 0x50, 0xbe, 0xe3, 0x07, 0x8f, 0x9d, 0xc0, 0xad, 0xed, 0x52, 0xe1, 0x21,
-	0x5e, 0x44, 0x37, 0xef, 0x89, 0x87, 0x1c, 0x6e, 0x3b, 0xac, 0xe0, 0x47, 0x87, 0xd5, 0x42, 0xdd,
-	0xf7, 0x5b, 0x96, 0x86, 0x4e, 0xd6, 0x60, 0xe2, 0x81, 0xf3, 0x44, 0xdc, 0xd7, 0x6d, 0x6c, 0xac,
-	0x08, 0x3f, 0x93, 0x6b, 0x47, 0x87, 0xd5, 0x8b, 0x6d, 0xe7, 0x49, 0x7c, 0xcf, 0x37, 0xd8, 0x15,
-	0x5a, 0xa7, 0x27, 0x1e, 0x4c, 0xae, 0xfb, 0x41, 0x24, 0x3e, 0xc2, 0x74, 0xda, 0xfc, 0x80, 0xeb,
-	0xb6, 0xb9, 0xcc, 0xeb, 0xb6, 0x8b, 0x4c, 0x91, 0xb7, 0x1f, 0xc6, 0xe4, 0x5a, 0x68, 0x9d, 0xc6,
-	0x98, 0xbc, 0x07, 0xd3, 0x0b, 0x34, 0x88, 0xbc, 0x87, 0x5e, 0xd3, 0x89, 0xe8, 0x1d, 0x3f, 0x68,
-	0x3b, 0x91, 0x38, 0x50, 0x41, 0x83, 0xba, 0x49, 0x39, 0xa7, 0xb6, 0x13, 0x59, 0xfd, 0x98, 0xe4,
-	0x6b, 0x59, 0x9e, 0x3b, 0x23, 0xd8, 0xfc, 0x37, 0x99, 0x52, 0x90, 0xe1, 0xb9, 0x33, 0xa0, 0x0b,
-	0x32, 0x7c, 0x78, 0x76, 0x8f, 0xbb, 0xf6, 0x2c, 0xd6, 0x6f, 0x8a, 0x2b, 0xd8, 0x93, 0xaf, 0x35,
-	0xe3, 0x71, 0x1b, 0x70, 0xbd, 0x39, 0x0f, 0xf9, 0xfa, 0xfa, 0x1d, 0x3c, 0x22, 0x11, 0xd7, 0x8c,
-	0xb4, 0xb3, 0xe7, 0x74, 0x9a, 0xa8, 0xcb, 0x08, 0xdf, 0x05, 0x55, 0xe0, 0xd5, 0xd7, 0xef, 0x10,
-	0x07, 0x66, 0xd6, 0x69, 0xd0, 0xf6, 0xa2, 0xaf, 0xdc, 0xbc, 0xa9, 0x0c, 0x54, 0x11, 0xab, 0x36,
-	0x27, 0xaa, 0x56, 0xed, 0x22, 0x8a, 0xfd, 0xe4, 0xe6, 0xcd, 0xcc, 0xe1, 0x88, 0x2b, 0x96, 0xc5,
-	0x8b, 0x2c, 0xc1, 0xe4, 0x03, 0xe7, 0x89, 0xb8, 0x90, 0x8e, 0x6d, 0xbc, 0x3c, 0x7a, 0xc6, 0xe3,
-	0xc4, 0x6a, 0x26, 0x45, 0xea, 0x10, 0xeb, 0x44, 0xe4, 0x5d, 0x18, 0x4f, 0xa6, 0x57, 0x88, 0x57,
-	0x91, 0x79, 0xee, 0x12, 0xa9, 0x4c, 0x4e, 0xed, 0x2c, 0x49, 0x41, 0x27, 0x9b, 0xb1, 0x89, 0xce,
-	0x15, 0x52, 0x74, 0x14, 0x2c, 0xd5, 0xe7, 0x54, 0x13, 0xdd, 0xc1, 0x12, 0xad, 0x59, 0x53, 0xb1,
-	0x8a, 0xce, 0x3d, 0x65, 0x2c, 0x9d, 0x8b, 0x62, 0xf9, 0xaf, 0x07, 0x7e, 0xbb, 0x1b, 0xa1, 0xc7,
-	0x60, 0xca, 0xf2, 0xef, 0x62, 0x49, 0x86, 0xe5, 0xcf, 0x49, 0xb2, 0xef, 0xd9, 0x27, 0x3e, 0xc5,
-	0x3d, 0x3b, 0x85, 0xc2, 0x8a, 0xdf, 0xdc, 0x47, 0x17, 0xc1, 0x52, 0xfd, 0x23, 0x26, 0x3f, 0x5a,
-	0x7e, 0x73, 0xff, 0xe9, 0xdd, 0x0f, 0x23, 0x7b, 0xb2, 0xca, 0xda, 0xce, 0xa6, 0x95, 0xf8, 0xf4,
-	0xec, 0x94, 0x76, 0xd3, 0xa6, 0x95, 0x71, 0x45, 0x85, 0xcf, 0x42, 0xd9, 0x10, 0x4b, 0x27, 0x27,
-	0x14, 0x2a, 0x8b, 0x34, 0xdc, 0x8f, 0xfc, 0xee, 0x42, 0xcb, 0xeb, 0xee, 0xf8, 0x4e, 0xe0, 0xce,
-	0x56, 0x06, 0x08, 0x8c, 0xd7, 0x33, 0x05, 0xc6, 0xb4, 0xcb, 0xe9, 0xed, 0xa6, 0x64, 0x60, 0xf5,
-	0xb1, 0x24, 0x5f, 0x83, 0x49, 0xb6, 0x5a, 0x96, 0x9e, 0x44, 0xb4, 0xc3, 0xa7, 0xd2, 0x34, 0x6e,
-	0xf5, 0x67, 0x95, 0x20, 0xc3, 0xb8, 0x90, 0x4f, 0x52, 0x94, 0x1e, 0x34, 0x26, 0x50, 0x27, 0xa9,
-	0xce, 0xca, 0xfc, 0xa9, 0x54, 0x9f, 0x90, 0x65, 0x18, 0x13, 0x35, 0x10, 0xbb, 0x4e, 0x7f, 0x5b,
-	0x5e, 0xcc, 0x6c, 0xcb, 0x98, 0x68, 0x8b, 0x25, 0xe9, 0xcd, 0x7f, 0x63, 0xc0, 0x84, 0xf6, 0x39,
-	0x72, 0x5b, 0x71, 0x5f, 0x49, 0xdc, 0xce, 0x34, 0x9c, 0xcc, 0xf4, 0xf4, 0xb7, 0x85, 0xcf, 0x52,
-	0x6e, 0x30, 0x5d, 0x66, 0xe6, 0x30, 0x19, 0xf4, 0x9f, 0x3f, 0x3e, 0xe8, 0xbf, 0x30, 0x20, 0xe8,
-	0xff, 0xdb, 0x13, 0x30, 0xa9, 0x6f, 0x70, 0x4c, 0xe3, 0x5c, 0xf1, 0x77, 0xbd, 0x8e, 0xb4, 0x5b,
-	0x79, 0x1a, 0x0b, 0x84, 0x68, 0xb9, 0xde, 0x11, 0x42, 0x5e, 0x05, 0x88, 0xaf, 0x66, 0xa5, 0x69,
-	0x2a, 0x32, 0xd3, 0x2b, 0x05, 0xe4, 0xa7, 0x01, 0x56, 0x7d, 0x97, 0xc6, 0x99, 0x50, 0x8e, 0x39,
-	0x50, 0x7a, 0x5d, 0x1c, 0x28, 0x89, 0x6c, 0xf2, 0x47, 0x87, 0xd5, 0x73, 0x1d, 0xdf, 0xa5, 0xfd,
-	0x29, 0x50, 0x14, 0x8e, 0xe4, 0x4b, 0x30, 0x62, 0xf5, 0x5a, 0x54, 0x26, 0xe6, 0x18, 0x97, 0x13,
-	0xbe, 0xd7, 0x52, 0xb2, 0x4c, 0x06, 0xbd, 0xf4, 0x3d, 0x02, 0x03, 0x90, 0x0f, 0x00, 0xee, 0xf7,
-	0x76, 0xe8, 0xdd, 0xc0, 0xef, 0x75, 0x65, 0xe4, 0x2f, 0x9a, 0xb1, 0xfb, 0x71, 0x1a, 0x27, 0x7b,
-	0x17, 0x0b, 0xd5, 0x8f, 0x27, 0x24, 0x64, 0x0d, 0xc6, 0x84, 0xf8, 0x10, 0xe7, 0xf4, 0x2f, 0x65,
-	0x9d, 0x10, 0x29, 0x3a, 0x84, 0xc8, 0x94, 0x81, 0x60, 0xfd, 0xd0, 0x86, 0x9b, 0xe1, 0xef, 0x42,
-	0x89, 0xb1, 0x67, 0xa6, 0x76, 0x28, 0xf6, 0x0e, 0xf4, 0x1f, 0x54, 0x2a, 0xc4, 0xcc, 0x72, 0x2d,
-	0x5f, 0x57, 0x4c, 0x40, 0xbe, 0x86, 0xb9, 0x6d, 0x44, 0x57, 0x1f, 0x7b, 0xd0, 0xf8, 0x5a, 0x5f,
-	0x57, 0x9f, 0x75, 0xba, 0xdd, 0x8c, 0x64, 0x60, 0x31, 0x3f, 0xb2, 0x1b, 0xc7, 0xd8, 0xc4, 0xa9,
-	0x86, 0x8f, 0xf9, 0xc0, 0xf5, 0xbe, 0x0f, 0xcc, 0xca, 0xb0, 0x91, 0xfe, 0x8c, 0x36, 0x1a, 0x5f,
-	0xd2, 0x85, 0x4a, 0x92, 0x46, 0x4b, 0x7c, 0x0b, 0x8e, 0xfb, 0xd6, 0x9b, 0x7d, 0xdf, 0x52, 0x07,
-	0xb0, 0xef, 0x73, 0x7d, 0xdc, 0x89, 0x9b, 0xa4, 0x85, 0x15, 0xdf, 0x1b, 0x3f, 0xee, 0x7b, 0xaf,
-	0xf6, 0x7d, 0x6f, 0xc6, 0xdd, 0xe9, 0xff, 0x4e, 0x8a, 0x27, 0x79, 0x17, 0x26, 0x24, 0x04, 0xd7,
-	0x07, 0x1e, 0xf0, 0x09, 0xfd, 0xde, 0xdd, 0x41, 0xa7, 0x31, 0x3d, 0x9d, 0x8b, 0x8a, 0xac, 0x52,
-	0xf3, 0xd9, 0x31, 0xa1, 0x51, 0xa7, 0x67, 0x85, 0x8e, 0x4c, 0xbe, 0x0a, 0xe3, 0xcb, 0x6d, 0xd6,
-	0x10, 0xbf, 0xe3, 0x44, 0x14, 0x37, 0xa3, 0xe4, 0xd0, 0x54, 0x29, 0x51, 0xa6, 0x2a, 0xcf, 0xf1,
-	0x98, 0x14, 0xa9, 0x9b, 0xb9, 0x42, 0xc1, 0x3a, 0x8f, 0x1f, 0xbf, 0x88, 0x39, 0x1c, 0x8a, 0xad,
-	0xe7, 0xc5, 0x8c, 0x83, 0x4b, 0x85, 0x3d, 0xca, 0x72, 0x7e, 0xaa, 0x63, 0x8b, 0x05, 0xa1, 0x75,
-	0x9e, 0xce, 0x93, 0xbc, 0x07, 0xe3, 0x22, 0xa2, 0xb1, 0x66, 0xad, 0x86, 0xb3, 0x15, 0x6c, 0x3c,
-	0xe6, 0x62, 0x93, 0xc1, 0x8f, 0xb6, 0x13, 0xa4, 0x6e, 0xaf, 0x12, 0x7c, 0xf2, 0x15, 0x38, 0xbb,
-	0xed, 0x75, 0x5c, 0xff, 0x71, 0x28, 0x04, 0xb8, 0x10, 0x74, 0xd3, 0x89, 0x8f, 0xce, 0x63, 0x5e,
-	0x6e, 0xcb, 0x6d, 0xab, 0x4f, 0xf0, 0x65, 0x72, 0x20, 0xbf, 0xd0, 0xc7, 0x99, 0xcf, 0x20, 0x72,
-	0xdc, 0x0c, 0x9a, 0xef, 0x9b, 0x41, 0xfd, 0x9f, 0x4f, 0x4f, 0xa7, 0xcc, 0xcf, 0x10, 0x1f, 0x88,
-	0xae, 0x73, 0x7c, 0xe8, 0x7b, 0x9d, 0xd9, 0x19, 0xed, 0x21, 0x8f, 0xd8, 0x65, 0x16, 0xf1, 0xd6,
-	0xfd, 0x96, 0xd7, 0x3c, 0xa8, 0x9b, 0x47, 0x87, 0xd5, 0x97, 0xd2, 0xda, 0xcc, 0xc7, 0xbe, 0x76,
-	0xb8, 0x90, 0xc1, 0x9a, 0x7c, 0x15, 0xca, 0xec, 0x6f, 0xac, 0xfa, 0x9d, 0xd5, 0xae, 0xba, 0x14,
-	0x4c, 0xf1, 0x1d, 0x1c, 0x23, 0x0c, 0xb9, 0xcc, 0xd0, 0x0a, 0x35, 0x56, 0xe6, 0x0f, 0x0d, 0x38,
-	0x9b, 0x55, 0xd7, 0x13, 0xf2, 0xdb, 0x98, 0xa9, 0x4b, 0x6f, 0x3c, 0x97, 0xe0, 0x97, 0xde, 0xf1,
-	0x55, 0x77, 0x15, 0x46, 0x98, 0xad, 0x2c, 0x9d, 0xb2, 0x70, 0x3b, 0x64, 0xf6, 0x74, 0x68, 0x71,
-	0x38, 0x43, 0x40, 0x67, 0x7a, 0xdc, 0x2f, 0x47, 0x38, 0x02, 0x7a, 0xdc, 0x5b, 0x1c, 0xce, 0x10,
-	0xd8, 0xb6, 0x2b, 0xb7, 0x09, 0x44, 0x60, 0xbb, 0x71, 0x68, 0x71, 0x38, 0x79, 0x0d, 0xc6, 0xd6,
-	0x3a, 0x2b, 0xd4, 0x79, 0x44, 0xc5, 0x8d, 0x13, 0x9e, 0xa3, 0xf8, 0x1d, 0xbb, 0xc5, 0x60, 0x96,
-	0x2c, 0x34, 0xbf, 0x6b, 0xc0, 0x74, 0x5f, 0x37, 0x9d, 0x9c, 0xc2, 0xe7, 0xf8, 0xeb, 0xbd, 0x61,
-	0xda, 0xc7, 0xab, 0x5f, 0xc8, 0xae, 0xbe, 0xf9, 0x57, 0x79, 0xb8, 0x30, 0x60, 0xd7, 0x4a, 0xae,
-	0xe6, 0x8d, 0x13, 0xaf, 0xe6, 0xbf, 0xce, 0x76, 0x09, 0xc7, 0x6b, 0x87, 0x1b, 0x7e, 0x52, 0xe3,
-	0xe4, 0x16, 0x03, 0xcb, 0x64, 0x8e, 0x0c, 0x99, 0xcf, 0xe1, 0x62, 0x13, 0x29, 0xec, 0xc8, 0xef,
-	0x3b, 0x33, 0xd6, 0x99, 0xf5, 0x5d, 0x8e, 0xe7, 0x7f, 0x4c, 0x2e, 0xc7, 0xf5, 0x2b, 0xa9, 0xc2,
-	0x53, 0xbd, 0x92, 0xca, 0x3e, 0x24, 0x1f, 0xf9, 0x34, 0x57, 0x01, 0xff, 0x2e, 0x75, 0x1d, 0xff,
-	0xe3, 0x38, 0xd4, 0xd7, 0x60, 0x64, 0x7b, 0x8f, 0x06, 0x52, 0xbf, 0xc5, 0x8a, 0x3c, 0x66, 0x00,
-	0xb5, 0x22, 0x88, 0x61, 0xfe, 0x3c, 0x94, 0xd5, 0x8f, 0xe1, 0x5a, 0x66, 0xbf, 0xc5, 0x62, 0xe2,
-	0x6b, 0x99, 0x01, 0x2c, 0x0e, 0x3f, 0x31, 0x23, 0x56, 0xd2, 0x0b, 0xf9, 0x93, 0x7a, 0xc1, 0xfc,
-	0xb7, 0x06, 0x14, 0x30, 0x21, 0xc0, 0x5b, 0x50, 0x92, 0x47, 0xa5, 0x6a, 0x90, 0xfc, 0x8c, 0x3c,
-	0x49, 0x0d, 0x75, 0x7f, 0x06, 0x01, 0x64, 0x9f, 0xda, 0xa2, 0xc1, 0x8e, 0xe6, 0xf6, 0xf2, 0x88,
-	0x01, 0xd4, 0x4f, 0x21, 0xc6, 0x29, 0xba, 0x04, 0x5d, 0x7b, 0x84, 0x7d, 0xcf, 0x17, 0x3c, 0x77,
-	0xed, 0xe9, 0xb3, 0xeb, 0x25, 0x96, 0xf9, 0xdb, 0x06, 0x9c, 0xcb, 0xd4, 0x03, 0xd8, 0x57, 0xb9,
-	0xc2, 0xa1, 0xcc, 0x88, 0xb4, 0xb6, 0xc1, 0x31, 0x4e, 0xe3, 0xc2, 0x73, 0x8a, 0xe1, 0xfd, 0x1c,
-	0x94, 0x62, 0xfb, 0x8c, 0x9c, 0x95, 0x43, 0x87, 0xe7, 0x69, 0xd2, 0x98, 0xf9, 0x1b, 0x03, 0x46,
-	0x59, 0x15, 0x9e, 0xd9, 0xe8, 0x8a, 0xec, 0xd3, 0x55, 0xd6, 0xa4, 0xa1, 0x62, 0x2a, 0xfe, 0x60,
-	0x14, 0x20, 0x41, 0x26, 0x3b, 0x30, 0xb9, 0xb6, 0xbc, 0xb8, 0xb0, 0xec, 0xd2, 0x4e, 0x84, 0xb7,
-	0x7c, 0xa9, 0x28, 0x7b, 0x66, 0x58, 0x06, 0x1d, 0xa7, 0x25, 0x10, 0x0e, 0x92, 0xe5, 0xe9, 0x7b,
-	0x6e, 0xd3, 0xf6, 0x62, 0x3a, 0x55, 0x21, 0xd3, 0x39, 0xb2, 0x6f, 0x34, 0x6a, 0x0f, 0x56, 0x94,
-	0x6f, 0xe4, 0x86, 0xfc, 0x46, 0xe8, 0xb4, 0x5b, 0x03, 0xbe, 0xa1, 0x73, 0x24, 0x7b, 0x50, 0xb9,
-	0x8b, 0xb2, 0x5b, 0xf9, 0x4a, 0xfe, 0xf8, 0xaf, 0xbc, 0x2c, 0xbe, 0xf2, 0x02, 0x17, 0xfa, 0xd9,
-	0xdf, 0xe9, 0xe3, 0x9a, 0xcc, 0xdc, 0xc2, 0x89, 0x33, 0xf7, 0x6f, 0x1b, 0x30, 0xca, 0x37, 0x87,
-	0xf8, 0x2d, 0x8b, 0xcc, 0xed, 0x67, 0xfb, 0xe9, 0x6c, 0x3f, 0x95, 0x08, 0xff, 0x53, 0x0d, 0x70,
-	0x5e, 0x46, 0x16, 0x53, 0x0f, 0x63, 0xc8, 0x23, 0x74, 0x54, 0x4c, 0x79, 0x49, 0xe2, 0x08, 0xc5,
-	0xdf, 0xc4, 0x50, 0xb9, 0x70, 0x0c, 0xf5, 0x99, 0xbe, 0xb1, 0x4f, 0xf9, 0x4c, 0xdf, 0x0a, 0x94,
-	0x84, 0x67, 0x4f, 0xfd, 0x40, 0x98, 0x9f, 0xf2, 0x80, 0x25, 0x86, 0x2b, 0xc9, 0xa7, 0x39, 0xc8,
-	0xde, 0xd1, 0x52, 0xc7, 0xc5, 0x88, 0x64, 0x0d, 0x4a, 0x49, 0x68, 0x48, 0x49, 0xbb, 0x07, 0x8d,
-	0xe1, 0xc2, 0xf5, 0x95, 0x47, 0x1f, 0x66, 0x46, 0x82, 0x24, 0x3c, 0xcc, 0x6f, 0x1a, 0x50, 0x49,
-	0xcf, 0x17, 0xf2, 0x2e, 0x8c, 0xc7, 0xd1, 0x39, 0xb1, 0x7f, 0x01, 0x1e, 0x64, 0x26, 0xe1, 0x3c,
-	0x9a, 0xa7, 0x81, 0x8a, 0x4e, 0xe6, 0xa1, 0xc8, 0x96, 0x9d, 0x92, 0x3b, 0x18, 0xe5, 0x49, 0x4f,
-	0xc0, 0xd4, 0x7b, 0x3d, 0x89, 0xa7, 0xac, 0xda, 0xff, 0x90, 0x87, 0x71, 0x65, 0xb0, 0xc8, 0x35,
-	0x28, 0x2e, 0x87, 0x2b, 0x7e, 0x73, 0x9f, 0xba, 0xe2, 0xba, 0x00, 0x5f, 0x61, 0xf4, 0x42, 0xbb,
-	0x85, 0x40, 0x2b, 0x2e, 0x26, 0x75, 0x98, 0xe0, 0xff, 0xc9, 0x28, 0xcc, 0x5c, 0x72, 0xd4, 0xc9,
-	0x91, 0x65, 0xfc, 0xa5, 0xba, 0xc3, 0x6a, 0x24, 0xe4, 0x1b, 0x00, 0x1c, 0xc0, 0xc6, 0x77, 0x08,
-	0xc7, 0x5e, 0xb9, 0x80, 0xcf, 0x89, 0x0f, 0x44, 0x9e, 0xda, 0x42, 0x9c, 0x0a, 0x0a, 0x43, 0x7c,
-	0x01, 0xce, 0x6f, 0xee, 0x0f, 0xff, 0x06, 0x64, 0xf2, 0x02, 0x9c, 0xdf, 0xdc, 0xb7, 0xb3, 0xbd,
-	0xbc, 0x54, 0x96, 0xe4, 0x5b, 0x06, 0x5c, 0xb2, 0x68, 0xd3, 0x7f, 0x44, 0x83, 0x83, 0x5a, 0x84,
-	0x58, 0xea, 0x17, 0x4f, 0x76, 0x29, 0xbb, 0x25, 0xbe, 0xf8, 0x7a, 0x20, 0xb8, 0x60, 0x38, 0x4a,
-	0xbb, 0x1b, 0xd9, 0xc7, 0x54, 0xe1, 0x98, 0x4f, 0x9a, 0x7f, 0x6e, 0x28, 0x4b, 0x80, 0xac, 0x42,
-	0x29, 0x9e, 0x2c, 0xe2, 0xc0, 0x31, 0x56, 0x8e, 0x24, 0xdc, 0xa2, 0x0f, 0xeb, 0x2f, 0x88, 0x93,
-	0xfd, 0x99, 0x78, 0xca, 0x69, 0x2b, 0x42, 0x02, 0xc9, 0x97, 0xa1, 0x80, 0x43, 0x75, 0x72, 0xb2,
-	0x29, 0xb9, 0xd5, 0x14, 0xd8, 0x18, 0x61, 0xad, 0x91, 0x92, 0x7c, 0x41, 0x78, 0x79, 0xe4, 0xb5,
-	0x34, 0xae, 0x0c, 0xc4, 0xea, 0x11, 0xef, 0x31, 0x89, 0x63, 0xa1, 0x32, 0x5b, 0xff, 0x4e, 0x0e,
-	0x2a, 0xe9, 0x85, 0x47, 0x3e, 0x80, 0xf2, 0xba, 0x13, 0x86, 0x8f, 0xfd, 0xc0, 0xbd, 0xe7, 0x84,
-	0x7b, 0x22, 0x35, 0x24, 0xda, 0x7c, 0x5d, 0x01, 0xb7, 0xf7, 0x1c, 0x2d, 0x85, 0x98, 0x46, 0xc0,
-	0x36, 0xe4, 0x0d, 0xe1, 0xaf, 0xae, 0x2c, 0xa0, 0xc8, 0x8f, 0xba, 0xa9, 0xd4, 0x90, 0x12, 0x8d,
-	0xbc, 0x05, 0x79, 0x1e, 0xfb, 0xa6, 0xe6, 0x15, 0x7a, 0x70, 0xa7, 0xc6, 0xc3, 0x85, 0xf8, 0x65,
-	0xb2, 0x7e, 0x2a, 0xcf, 0xf0, 0xc9, 0x8a, 0x12, 0x39, 0x35, 0xaa, 0xe5, 0x57, 0x91, 0xe0, 0xb8,
-	0x71, 0x27, 0x87, 0x50, 0x7d, 0x58, 0x28, 0xe6, 0x2b, 0x05, 0x11, 0x9f, 0xf3, 0x47, 0x79, 0x28,
-	0xc5, 0xdf, 0x27, 0x04, 0x50, 0xdf, 0x10, 0xb7, 0xc2, 0xf8, 0x3f, 0xb9, 0x08, 0x45, 0xa9, 0x62,
-	0x88, 0x9b, 0xe1, 0xb1, 0x50, 0xa8, 0x17, 0xb3, 0x20, 0x75, 0x09, 0xae, 0x5e, 0x58, 0xf2, 0x27,
-	0xb9, 0x09, 0xb1, 0xa2, 0x30, 0x48, 0xa3, 0x28, 0xb0, 0x01, 0xb3, 0x62, 0x34, 0x32, 0x09, 0x39,
-	0x8f, 0xfb, 0x22, 0x97, 0xac, 0x9c, 0xe7, 0x92, 0x0f, 0xa0, 0xe8, 0xb8, 0x2e, 0x75, 0x6d, 0x27,
-	0x1a, 0xe2, 0x3d, 0xce, 0x22, 0xe3, 0xc6, 0x25, 0x3a, 0x52, 0xd5, 0x22, 0x52, 0x83, 0x12, 0x3e,
-	0xc7, 0xd8, 0x0b, 0x87, 0x7a, 0xc3, 0x31, 0xe1, 0x50, 0x64, 0x64, 0x9b, 0x21, 0x75, 0xc9, 0xeb,
-	0x50, 0x60, 0xa3, 0x29, 0xf6, 0x83, 0x38, 0x5b, 0xdc, 0xda, 0xc6, 0x3a, 0xef, 0xb0, 0x7b, 0x67,
-	0x2c, 0x44, 0x20, 0xaf, 0x40, 0xbe, 0x37, 0xff, 0x50, 0x48, 0xfa, 0x4a, 0x12, 0x16, 0x19, 0xa3,
-	0xb1, 0x62, 0x72, 0x0b, 0x8a, 0x8f, 0xf5, 0x00, 0xb8, 0x73, 0xa9, 0x61, 0x8c, 0xf1, 0x63, 0xc4,
-	0x7a, 0x11, 0x46, 0x79, 0xb8, 0x99, 0xf9, 0x12, 0x40, 0xf2, 0xe9, 0xfe, 0x0b, 0x7c, 0xf3, 0x1b,
-	0x50, 0x8a, 0x3f, 0x49, 0x5e, 0x04, 0xd8, 0xa7, 0x07, 0xf6, 0x9e, 0xd3, 0x71, 0xc5, 0x33, 0x24,
-	0x65, 0xab, 0xb4, 0x4f, 0x0f, 0xee, 0x21, 0x80, 0x5c, 0x80, 0xb1, 0x2e, 0x1b, 0x55, 0x99, 0xd8,
-	0xd4, 0x1a, 0xed, 0xf6, 0x76, 0xd8, 0x0c, 0x9d, 0x85, 0x31, 0x3c, 0x3a, 0x10, 0x0b, 0x6d, 0xc2,
-	0x92, 0x3f, 0xcd, 0xdf, 0xcb, 0x61, 0xc8, 0xbb, 0x52, 0x4f, 0xf2, 0x32, 0x4c, 0x34, 0x03, 0x8a,
-	0xdb, 0x91, 0xc3, 0xd4, 0x22, 0xf1, 0x9d, 0x72, 0x02, 0x5c, 0x76, 0xc9, 0x6b, 0x30, 0x95, 0x64,
-	0x5a, 0xb5, 0x9b, 0x3b, 0x22, 0xfc, 0xb5, 0x6c, 0x4d, 0x74, 0x65, 0xaa, 0xd5, 0x85, 0x1d, 0xf4,
-	0xa1, 0xaf, 0xa8, 0xa1, 0x66, 0x91, 0xcc, 0x9a, 0x5a, 0xb2, 0xa6, 0x14, 0x38, 0x5e, 0x3b, 0x9c,
-	0x87, 0x51, 0xc7, 0xd9, 0xed, 0x79, 0xdc, 0x9f, 0xb7, 0x6c, 0x89, 0x5f, 0xe4, 0xf3, 0x30, 0x1d,
-	0x7a, 0xbb, 0x1d, 0x27, 0xea, 0x05, 0x22, 0xe7, 0x00, 0x0d, 0x70, 0x4a, 0x4d, 0x58, 0x95, 0xb8,
-	0x60, 0x81, 0xc3, 0xc9, 0x9b, 0x40, 0xd4, 0xef, 0xf9, 0x3b, 0x1f, 0xd3, 0x26, 0x9f, 0x6a, 0x65,
-	0x6b, 0x5a, 0x29, 0x59, 0xc3, 0x02, 0xf2, 0x39, 0x28, 0x07, 0x34, 0x44, 0x95, 0x0c, 0xbb, 0x0d,
-	0x33, 0xa9, 0x58, 0xe3, 0x12, 0x76, 0x9f, 0x1e, 0x98, 0x75, 0x98, 0xee, 0x5b, 0x8f, 0xe4, 0x4d,
-	0xae, 0xdd, 0x8b, 0xfd, 0xb9, 0xcc, 0x8d, 0x19, 0x26, 0xa4, 0x52, 0x2f, 0xf8, 0x72, 0x24, 0xb3,
-	0x03, 0x65, 0x55, 0xbe, 0x9e, 0x10, 0x58, 0x7c, 0x1e, 0x1d, 0x0b, 0xb9, 0xf0, 0x19, 0x3d, 0x3a,
-	0xac, 0xe6, 0x3c, 0x17, 0xdd, 0x09, 0xaf, 0x42, 0x51, 0x6a, 0x09, 0xea, 0x33, 0x1c, 0x42, 0xa1,
-	0x3c, 0xb0, 0xe2, 0x52, 0xf3, 0x75, 0x18, 0x13, 0x22, 0xf4, 0xf8, 0x63, 0x1c, 0xf3, 0x97, 0x73,
-	0x30, 0x65, 0x51, 0xb6, 0xc0, 0xc5, 0x03, 0x17, 0xcf, 0x59, 0xce, 0x59, 0xad, 0x6d, 0xc7, 0xc4,
-	0xf1, 0x7f, 0xcf, 0x80, 0x99, 0x0c, 0xdc, 0x4f, 0x94, 0xa4, 0xea, 0x36, 0x94, 0x16, 0x3d, 0xa7,
-	0x55, 0x73, 0xdd, 0xd8, 0x41, 0x12, 0xb5, 0x41, 0x97, 0x2d, 0x27, 0x87, 0x41, 0xd5, 0xcd, 0x34,
-	0x46, 0x25, 0xd7, 0xc5, 0xa4, 0x48, 0xd2, 0xe8, 0xc9, 0xac, 0xb6, 0xc0, 0xeb, 0x94, 0xe4, 0xb4,
-	0xc5, 0x30, 0x34, 0x0e, 0x4c, 0xee, 0xc0, 0x9f, 0xd9, 0xa1, 0xcb, 0x0e, 0x43, 0x4b, 0x37, 0x6f,
-	0x28, 0xb3, 0xf3, 0x9b, 0x39, 0x38, 0x9f, 0x4d, 0xf8, 0x49, 0xf3, 0x8d, 0x61, 0x12, 0x05, 0x25,
-	0x71, 0x30, 0xe6, 0x1b, 0xe3, 0x19, 0x17, 0x10, 0x3f, 0x41, 0x20, 0x0f, 0x61, 0x62, 0xc5, 0x09,
-	0xa3, 0x7b, 0xd4, 0x09, 0xa2, 0x1d, 0xea, 0x44, 0x43, 0x68, 0xb0, 0xf1, 0x3b, 0xb9, 0xb8, 0xa9,
-	0xed, 0x49, 0xca, 0xf4, 0x3b, 0xb9, 0x1a, 0xdb, 0x78, 0xa2, 0x14, 0x86, 0x98, 0x28, 0x3f, 0x0b,
-	0x53, 0x0d, 0xda, 0x76, 0xba, 0x7b, 0x7e, 0x40, 0xc5, 0xc9, 0xf3, 0x0d, 0x98, 0x88, 0x41, 0x99,
-	0xb3, 0x45, 0x2f, 0xd6, 0xf0, 0x95, 0x8e, 0x48, 0x44, 0x89, 0x5e, 0x6c, 0xfe, 0x4e, 0x0e, 0x2e,
-	0xd4, 0x9a, 0xe2, 0x98, 0x5e, 0x14, 0xc8, 0xdb, 0xc4, 0xcf, 0xf8, 0xdb, 0x64, 0x0e, 0x4a, 0x0f,
-	0x9c, 0x27, 0xf8, 0xe0, 0x7b, 0x28, 0xb2, 0xd6, 0x70, 0xf5, 0xcb, 0x79, 0x62, 0xc7, 0xc7, 0x5e,
-	0x56, 0x82, 0xf3, 0x34, 0xdf, 0x84, 0x37, 0x61, 0xf4, 0x9e, 0xdf, 0x72, 0xc5, 0xe6, 0x24, 0x4e,
-	0xfd, 0xf7, 0x10, 0x62, 0x89, 0x12, 0xf3, 0x87, 0x06, 0x4c, 0xc6, 0x35, 0xc6, 0x2a, 0x7c, 0xe6,
-	0x5d, 0x92, 0x7a, 0x1d, 0xbf, 0x34, 0xc4, 0xeb, 0xf8, 0x23, 0x9f, 0xae, 0x27, 0xcc, 0x7f, 0x8c,
-	0x17, 0x0a, 0x6a, 0x2b, 0xd9, 0x4e, 0xa4, 0x54, 0xc4, 0x18, 0xb2, 0x22, 0xb9, 0xa7, 0x36, 0x24,
-	0xf9, 0x81, 0x43, 0xf2, 0x2b, 0x39, 0x18, 0x8f, 0x2b, 0xfb, 0x9c, 0xc5, 0x6f, 0xc7, 0xed, 0x1a,
-	0xca, 0x3b, 0xbb, 0xa1, 0xc8, 0x0a, 0xe1, 0x04, 0xfd, 0x65, 0x18, 0x15, 0x8b, 0xc9, 0x48, 0xdd,
-	0xaa, 0xa5, 0x46, 0x37, 0x79, 0xeb, 0x14, 0x07, 0x34, 0xb4, 0x04, 0x1d, 0xba, 0xbf, 0x6f, 0xd3,
-	0x1d, 0x71, 0xbf, 0xf4, 0xcc, 0xee, 0x51, 0xd9, 0xee, 0xef, 0x49, 0xc3, 0x86, 0xda, 0x9d, 0xfe,
-	0x41, 0x01, 0x2a, 0x69, 0x92, 0x93, 0x23, 0xe4, 0xd7, 0x7b, 0x3b, 0xe2, 0x9d, 0x02, 0x8c, 0x90,
-	0xef, 0xf6, 0x76, 0x2c, 0x06, 0x23, 0xaf, 0x41, 0x61, 0x3d, 0xf0, 0x1e, 0x61, 0xab, 0xc5, 0x33,
-	0x0d, 0xdd, 0xc0, 0x7b, 0xa4, 0xfa, 0x81, 0xb2, 0x72, 0x34, 0x68, 0x57, 0x1a, 0xca, 0x33, 0xd3,
-	0xdc, 0xa0, 0x6d, 0x85, 0xe9, 0xb4, 0x28, 0x12, 0x8d, 0x6d, 0x95, 0x75, 0xea, 0x04, 0x22, 0x9a,
-	0x5b, 0x88, 0x33, 0xdc, 0x2a, 0x77, 0x10, 0xcc, 0x73, 0x9e, 0x5a, 0x2a, 0x12, 0x69, 0x01, 0x51,
-	0x7e, 0xca, 0x05, 0x7c, 0xb2, 0x8d, 0x27, 0x9f, 0x17, 0x3a, 0xab, 0xb2, 0xb6, 0xd5, 0xd5, 0x9c,
-	0xc1, 0xf7, 0x69, 0x9e, 0x11, 0xae, 0x43, 0x09, 0x8f, 0xbc, 0xf0, 0x20, 0xa3, 0x78, 0x22, 0x33,
-	0xe9, 0x73, 0x0b, 0x78, 0x1b, 0x6f, 0xc7, 0xc7, 0x19, 0x09, 0x13, 0xf2, 0x3e, 0x8c, 0xab, 0x8e,
-	0xa2, 0xdc, 0x9d, 0xf1, 0x32, 0x8f, 0x10, 0x1a, 0x90, 0x3e, 0x4c, 0x25, 0x30, 0xbf, 0xa0, 0xce,
-	0x12, 0xb1, 0x69, 0x1f, 0x3b, 0x4b, 0xcc, 0xdf, 0x42, 0x35, 0xbe, 0xed, 0x47, 0x54, 0x68, 0x2f,
-	0xcf, 0xac, 0x1c, 0x4b, 0x8e, 0x90, 0x47, 0x34, 0x8f, 0x10, 0xad, 0x75, 0xa7, 0x78, 0x60, 0xf9,
-	0x0f, 0x0d, 0x38, 0x97, 0x49, 0x4b, 0x6e, 0x00, 0x24, 0x3a, 0xa2, 0xe8, 0x25, 0x9e, 0x4c, 0x36,
-	0x86, 0x5a, 0x0a, 0x06, 0xf9, 0x7a, 0x5a, 0xbb, 0x3b, 0x79, 0x73, 0x92, 0x4f, 0x2e, 0x4c, 0xea,
-	0xda, 0x5d, 0x86, 0x4e, 0x67, 0x7e, 0x2f, 0x0f, 0xd3, 0x7d, 0x4f, 0xf5, 0x9d, 0x70, 0x07, 0xbf,
-	0x9f, 0x7a, 0x08, 0x8a, 0x5f, 0x77, 0x5c, 0x1f, 0xf4, 0x50, 0x60, 0xc6, 0xb3, 0x50, 0x78, 0x2c,
-	0x26, 0xf2, 0x18, 0x9f, 0xf0, 0x3a, 0x54, 0x98, 0xfd, 0x84, 0xd8, 0xe7, 0x07, 0x7e, 0xed, 0x29,
-	0x3c, 0x25, 0xf6, 0x63, 0xfc, 0xd2, 0xd2, 0x6f, 0xe5, 0x60, 0xa6, 0xaf, 0xcd, 0xcf, 0xec, 0xaa,
-	0xfb, 0xb2, 0xb6, 0xbb, 0xbd, 0x34, 0x68, 0x4c, 0x87, 0xd2, 0x22, 0xfe, 0xbb, 0x01, 0x17, 0x06,
-	0x50, 0x92, 0x83, 0xf4, 0x24, 0xe2, 0x5a, 0xc5, 0xcd, 0xe3, 0x3f, 0xf8, 0x54, 0xa6, 0xd2, 0x67,
-	0x36, 0x13, 0x7e, 0x39, 0x07, 0xb0, 0x4d, 0x77, 0x9e, 0xed, 0xf4, 0x3f, 0xd9, 0x6f, 0xe1, 0xcb,
-	0x66, 0x0d, 0x35, 0xee, 0x6b, 0x78, 0x90, 0x38, 0x7c, 0xee, 0x9f, 0xf8, 0x59, 0x89, 0x5c, 0xf6,
-	0xb3, 0x12, 0xe6, 0x0e, 0x9c, 0xbd, 0x4b, 0xa3, 0x64, 0x27, 0x94, 0x36, 0xe4, 0xf1, 0x6c, 0xdf,
-	0x80, 0x92, 0xc0, 0xd7, 0x53, 0x84, 0x4b, 0x87, 0x32, 0xcf, 0xb5, 0x12, 0x04, 0x93, 0xc2, 0x85,
-	0x45, 0xda, 0xa2, 0x11, 0xfd, 0x6c, 0x3f, 0xd3, 0x00, 0xc2, 0x9b, 0xc2, 0x5f, 0x1b, 0x18, 0xea,
-	0x0b, 0x27, 0xf6, 0xcf, 0x16, 0x9c, 0x8b, 0xeb, 0xfe, 0x34, 0xf9, 0xce, 0x31, 0x5d, 0x42, 0xc4,
-	0xda, 0x25, 0x1c, 0x8f, 0x39, 0x44, 0x7c, 0x02, 0x97, 0x24, 0xc1, 0xb6, 0x17, 0xdf, 0xc4, 0x0c,
-	0x45, 0x4b, 0xde, 0x85, 0x71, 0x85, 0x46, 0x04, 0xee, 0xe2, 0x6d, 0xe7, 0x63, 0x2f, 0xda, 0xb3,
-	0x43, 0x0e, 0x57, 0x6f, 0x3b, 0x15, 0x74, 0xf3, 0x6b, 0xf0, 0x42, 0xec, 0xb7, 0x92, 0xf1, 0xe9,
-	0x14, 0x73, 0xe3, 0x74, 0xcc, 0x57, 0x93, 0x66, 0x2d, 0x77, 0x62, 0xff, 0x71, 0xc9, 0x9b, 0xa8,
-	0xcd, 0x12, 0x8d, 0xb9, 0xac, 0xa4, 0x45, 0x13, 0x7b, 0x51, 0x02, 0x30, 0xdf, 0x51, 0x2a, 0x9b,
-	0xc1, 0x50, 0x23, 0x36, 0xd2, 0xc4, 0xbf, 0x9c, 0x83, 0xa9, 0xb5, 0xe5, 0xc5, 0x85, 0xf8, 0x18,
-	0xf9, 0x39, 0xcb, 0x4d, 0xa4, 0xb5, 0x6d, 0xb0, 0xbc, 0x31, 0x37, 0x61, 0x26, 0xd5, 0x0d, 0xf8,
-	0x98, 0xca, 0xfb, 0xdc, 0xbf, 0x24, 0x06, 0xcb, 0x9d, 0xe5, 0x7c, 0x16, 0xfb, 0xad, 0x5b, 0x56,
-	0x0a, 0xdb, 0xfc, 0xde, 0x68, 0x8a, 0xaf, 0x10, 0x61, 0x6f, 0x40, 0x69, 0x39, 0x0c, 0x7b, 0x34,
-	0xd8, 0xb4, 0x56, 0x54, 0x1d, 0xd1, 0x43, 0xa0, 0xdd, 0x0b, 0x5a, 0x56, 0x82, 0x40, 0xae, 0x41,
-	0x51, 0xc4, 0x77, 0x49, 0x99, 0x80, 0xd7, 0xe5, 0x71, 0x78, 0x98, 0x15, 0x17, 0x93, 0xb7, 0xa0,
-	0xcc, 0xff, 0xe7, 0xb3, 0x4d, 0x74, 0x38, 0x9e, 0x55, 0x09, 0x74, 0x3e, 0x3b, 0x2d, 0x0d, 0x8d,
-	0x59, 0x66, 0xf2, 0xb5, 0x46, 0x56, 0xa3, 0x42, 0x62, 0x99, 0xc9, 0x87, 0x1d, 0xb1, 0x4e, 0x2a,
-	0x12, 0xb9, 0x0e, 0xf9, 0xda, 0x82, 0xa5, 0x66, 0x45, 0x76, 0x9a, 0x01, 0xcf, 0x2a, 0xae, 0x3d,
-	0x88, 0x54, 0x5b, 0xb0, 0xc8, 0x3c, 0x14, 0xf1, 0xc1, 0x0b, 0x97, 0x06, 0xc2, 0x67, 0x14, 0x67,
-	0x4d, 0x57, 0xc0, 0xd4, 0x9b, 0x47, 0x89, 0x47, 0xe6, 0x60, 0x6c, 0xd1, 0x0b, 0xbb, 0x2d, 0xe7,
-	0x40, 0x24, 0x25, 0xc1, 0xcb, 0x10, 0x97, 0x83, 0xd4, 0x79, 0x26, 0xb0, 0xc8, 0x35, 0x18, 0x69,
-	0x34, 0xfd, 0x2e, 0xb3, 0xb6, 0x62, 0xd7, 0x96, 0x90, 0x01, 0xb4, 0xcc, 0x06, 0x0c, 0x80, 0x21,
-	0xc7, 0x3c, 0x72, 0xaa, 0xa4, 0x84, 0x1c, 0xa7, 0x23, 0xa6, 0x04, 0x4e, 0xbf, 0xff, 0x1f, 0x3c,
-	0x4d, 0xff, 0xbf, 0x1d, 0xb8, 0x70, 0x17, 0x55, 0xfd, 0x06, 0x0d, 0x30, 0x0f, 0x24, 0x7f, 0x3c,
-	0x67, 0xd3, 0x5a, 0x16, 0xd1, 0x62, 0x57, 0x8f, 0x0e, 0xab, 0xaf, 0x70, 0x6b, 0xc0, 0x0e, 0x39,
-	0x8e, 0x7c, 0x77, 0x27, 0xf5, 0x62, 0xc0, 0x20, 0x46, 0xe4, 0x2b, 0x70, 0x36, 0xab, 0x48, 0xc4,
-	0x8d, 0xa1, 0x57, 0x78, 0xf6, 0x07, 0x54, 0xb7, 0xec, 0x2c, 0x0e, 0x64, 0x05, 0x2a, 0x1c, 0x5e,
-	0x73, 0xdb, 0x5e, 0x67, 0xa9, 0xed, 0x78, 0x2d, 0x8c, 0x22, 0x13, 0xa1, 0x80, 0x82, 0xab, 0xc3,
-	0x0a, 0x6d, 0xca, 0x4a, 0x35, 0xef, 0xa4, 0x14, 0x25, 0x8a, 0xa3, 0x46, 0xed, 0xc1, 0x4a, 0xb2,
-	0xa6, 0x9e, 0xaf, 0x7b, 0x23, 0xad, 0x6d, 0xc7, 0xdc, 0x1b, 0x6d, 0xc2, 0x4c, 0xaa, 0x1b, 0xa4,
-	0x38, 0xd2, 0xc0, 0x69, 0x71, 0x94, 0xa2, 0xb1, 0x52, 0xd8, 0xe6, 0x7f, 0x1c, 0x4d, 0xf1, 0x15,
-	0x67, 0x45, 0x26, 0x8c, 0x72, 0x69, 0xa3, 0x66, 0x2d, 0xe3, 0xb2, 0xc8, 0x12, 0x25, 0xe4, 0x22,
-	0xe4, 0x1b, 0x8d, 0x35, 0x35, 0xa7, 0x62, 0x18, 0xfa, 0x16, 0x83, 0xb1, 0x11, 0xc2, 0x63, 0x20,
-	0x25, 0x40, 0xab, 0x49, 0x83, 0x48, 0x3c, 0xe7, 0xf9, 0x6a, 0xb2, 0x8e, 0x0b, 0x49, 0x7f, 0x8b,
-	0x75, 0x9c, 0xac, 0xde, 0x05, 0x98, 0xad, 0x85, 0x21, 0x0d, 0x22, 0x9e, 0x94, 0x3d, 0xec, 0xb5,
-	0x69, 0x20, 0xe6, 0x9a, 0x90, 0x31, 0xfc, 0x31, 0xf0, 0x66, 0x68, 0x0d, 0x44, 0x24, 0x57, 0xa1,
-	0x58, 0xeb, 0xb9, 0x1e, 0xed, 0x34, 0x35, 0xdf, 0x74, 0x47, 0xc0, 0xac, 0xb8, 0x94, 0x7c, 0x04,
-	0xe7, 0x04, 0x91, 0x14, 0x38, 0xa2, 0x07, 0xb8, 0xac, 0xe1, 0x16, 0xac, 0x58, 0x0b, 0x52, 0x4c,
-	0xd9, 0xa2, 0x4b, 0xb2, 0x29, 0x49, 0x0d, 0x2a, 0x4b, 0x78, 0x4f, 0x2a, 0x1f, 0xf5, 0xf5, 0x03,
-	0x91, 0x7c, 0x17, 0x25, 0x17, 0xbf, 0x43, 0xb5, 0xdd, 0xb8, 0xd0, 0xea, 0x43, 0x27, 0xf7, 0x61,
-	0x26, 0x0d, 0x63, 0xf2, 0xb8, 0x94, 0x3c, 0xba, 0xd5, 0xc7, 0x05, 0x05, 0x73, 0x16, 0x15, 0xd9,
-	0x81, 0xe9, 0x5a, 0x14, 0x05, 0xde, 0x4e, 0x2f, 0xa2, 0x29, 0xd1, 0x25, 0x0f, 0x1a, 0xe3, 0x72,
-	0x29, 0xbe, 0x5e, 0x10, 0x93, 0x71, 0xc6, 0x89, 0x29, 0x63, 0x11, 0x66, 0xf5, 0xb3, 0x23, 0x6e,
-	0xfc, 0x6e, 0x9f, 0x78, 0xdb, 0x4e, 0x04, 0x14, 0xc9, 0x03, 0xdd, 0x5a, 0x78, 0xd0, 0x6e, 0xd3,
-	0x28, 0xc0, 0x9b, 0x7b, 0x7c, 0xfb, 0xce, 0x14, 0x3e, 0x40, 0x97, 0x94, 0xe7, 0x2a, 0xf1, 0x7d,
-	0x43, 0xcd, 0x3d, 0x52, 0xe3, 0xa9, 0x6d, 0x1f, 0xe5, 0x21, 0xb7, 0x8f, 0x16, 0x4c, 0x2f, 0x75,
-	0x9a, 0xc1, 0x01, 0x46, 0x36, 0xca, 0xca, 0x4d, 0x9c, 0x50, 0x39, 0xf9, 0xb0, 0xc5, 0x65, 0x47,
-	0xce, 0xb0, 0xac, 0xea, 0xf5, 0x33, 0x36, 0xff, 0x3f, 0xa8, 0xa4, 0xfb, 0xf2, 0x53, 0x3e, 0x56,
-	0x7c, 0x1a, 0xd7, 0x6c, 0x36, 0xd2, 0xe9, 0xb6, 0x90, 0x39, 0xed, 0x45, 0x5a, 0x23, 0x89, 0x4a,
-	0x57, 0xde, 0x8e, 0xd5, 0xde, 0xa1, 0x95, 0xcb, 0x38, 0x97, 0xb5, 0x8c, 0xcd, 0x5f, 0xcd, 0xc1,
-	0x34, 0xf7, 0x26, 0x7d, 0xf6, 0x75, 0xc5, 0xf7, 0x35, 0xe1, 0x2c, 0xcf, 0x02, 0x53, 0xad, 0x3b,
-	0x46, 0x5b, 0xfc, 0x06, 0x9c, 0xeb, 0xeb, 0x0a, 0x14, 0xd0, 0x8b, 0xd2, 0x8f, 0xb7, 0x4f, 0x44,
-	0xcf, 0x66, 0x7f, 0x64, 0xeb, 0x96, 0xd5, 0x47, 0x61, 0xfe, 0xc3, 0x5c, 0x1f, 0x7f, 0xa1, 0x37,
-	0xaa, 0x9a, 0xa0, 0x71, 0x3a, 0x4d, 0x30, 0xf7, 0x89, 0x34, 0xc1, 0xfc, 0x30, 0x9a, 0xe0, 0x47,
-	0x30, 0xb1, 0x41, 0x1d, 0xa6, 0xd1, 0x88, 0x60, 0xb3, 0x82, 0xf6, 0x5a, 0x2c, 0x2b, 0x93, 0xf2,
-	0x25, 0x0e, 0x54, 0x8d, 0x18, 0x01, 0x13, 0x2d, 0x3c, 0xfa, 0xcc, 0xd2, 0x39, 0xa8, 0x9b, 0xc6,
-	0xc8, 0xe0, 0x4d, 0xc3, 0xfc, 0x66, 0x0e, 0xc6, 0x15, 0xf6, 0xe4, 0x8b, 0x50, 0x5e, 0x0b, 0x76,
-	0x9d, 0x8e, 0xf7, 0x73, 0x8e, 0x72, 0xfc, 0x8a, 0xd5, 0xf7, 0x15, 0xb8, 0xa5, 0x61, 0xa1, 0xdb,
-	0x0c, 0x75, 0xda, 0xea, 0xc4, 0x67, 0xd5, 0xb3, 0x10, 0xaa, 0x04, 0x0b, 0xe7, 0x87, 0x08, 0x16,
-	0xd6, 0x23, 0x6d, 0x0b, 0xa7, 0x8f, 0xb4, 0xd5, 0x02, 0x63, 0x47, 0x4e, 0x19, 0x18, 0x6b, 0xfe,
-	0x7a, 0x0e, 0x2a, 0xe2, 0x5d, 0x55, 0x79, 0x78, 0xf8, 0x7c, 0xbd, 0xc3, 0xa0, 0x37, 0xee, 0x98,
-	0xeb, 0xb1, 0xc2, 0x6f, 0xff, 0x7e, 0x15, 0x5f, 0xc9, 0x4c, 0x77, 0x87, 0x7c, 0x25, 0x53, 0x87,
-	0xa7, 0x23, 0x07, 0xd2, 0x54, 0x56, 0x1a, 0xdf, 0xfc, 0xb3, 0x5c, 0x9a, 0xb7, 0xd0, 0xa6, 0x5e,
-	0x85, 0x31, 0xfe, 0x2c, 0x96, 0x74, 0x6e, 0x16, 0xb9, 0x9b, 0x10, 0x64, 0xc9, 0xb2, 0xd3, 0xc4,
-	0x90, 0x9c, 0xf4, 0x54, 0x2a, 0xb9, 0x0d, 0x65, 0xf4, 0x17, 0xa9, 0xb9, 0x6e, 0x40, 0xc3, 0x50,
-	0x28, 0x5a, 0x78, 0x77, 0xf7, 0x98, 0xee, 0xd8, 0xdc, 0xaf, 0xc4, 0x71, 0xdd, 0xc0, 0xd2, 0xf0,
-	0xc8, 0x02, 0x9c, 0xd5, 0xdc, 0x93, 0x24, 0xfd, 0x48, 0xb2, 0x5b, 0x44, 0x58, 0xc0, 0x89, 0x33,
-	0x91, 0x9f, 0xde, 0x33, 0xd1, 0xe6, 0xff, 0x32, 0xd8, 0x5a, 0x6b, 0xee, 0x3f, 0x67, 0xd1, 0x2d,
-	0xac, 0x49, 0xc7, 0x28, 0xfb, 0xff, 0xde, 0xe0, 0xfe, 0xe9, 0x62, 0xfa, 0xbc, 0x0d, 0xa3, 0xfc,
-	0x11, 0x2e, 0xe1, 0x49, 0xad, 0x72, 0xe1, 0x05, 0xc9, 0xfd, 0x14, 0x7f, 0xca, 0xcb, 0x12, 0x04,
-	0xcc, 0x64, 0xd6, 0xdd, 0xe4, 0x51, 0xf1, 0xec, 0xf7, 0x8f, 0x97, 0x58, 0x6a, 0x5e, 0xd2, 0xe1,
-	0xf2, 0x5d, 0x1b, 0x27, 0xe7, 0x25, 0x35, 0xff, 0x4f, 0x8e, 0xb7, 0x47, 0x54, 0x6a, 0xd8, 0x84,
-	0x7b, 0xaf, 0x41, 0x01, 0x9f, 0x7b, 0x55, 0xb2, 0x1a, 0xa6, 0x9e, 0x7a, 0xc5, 0x72, 0xb6, 0x6e,
-	0x50, 0xd6, 0xaa, 0x01, 0x55, 0x28, 0x8e, 0xd5, 0x75, 0x83, 0x18, 0x98, 0x4d, 0xda, 0x77, 0xa9,
-	0xba, 0x1c, 0x3a, 0x7a, 0xe2, 0x6f, 0x2c, 0x27, 0xb7, 0x15, 0xbf, 0x66, 0xf5, 0x40, 0xa3, 0xfd,
-	0xd0, 0xb1, 0xb9, 0x3f, 0xad, 0x2a, 0x6d, 0x13, 0x17, 0xe8, 0x25, 0x98, 0xd4, 0x63, 0x95, 0x85,
-	0xd1, 0x81, 0x21, 0xdf, 0xa9, 0x38, 0x67, 0x55, 0xbd, 0xd5, 0x89, 0x48, 0x1d, 0x26, 0xb4, 0x80,
-	0x54, 0x35, 0x09, 0x2b, 0xcf, 0x0e, 0x63, 0xf7, 0x67, 0x52, 0xd0, 0x49, 0x94, 0x03, 0xf3, 0x2f,
-	0x40, 0x45, 0xac, 0xcc, 0x38, 0xb6, 0x0d, 0x55, 0xbb, 0xe5, 0x45, 0x4b, 0x5d, 0x4d, 0x4d, 0xcf,
-	0x0d, 0x2c, 0x84, 0x9a, 0xdf, 0x35, 0xe0, 0xa2, 0x78, 0x5c, 0xcc, 0xa2, 0x21, 0xd3, 0x21, 0x31,
-	0x20, 0x0e, 0xe7, 0xe3, 0x17, 0xc9, 0xbb, 0x32, 0xf1, 0x94, 0x2e, 0x20, 0xd3, 0xdf, 0xa8, 0x4f,
-	0x88, 0x49, 0x39, 0x82, 0xa9, 0xa7, 0x64, 0xc2, 0xa9, 0xb7, 0x45, 0xc2, 0xa9, 0xdc, 0xf1, 0xc4,
-	0xf1, 0xba, 0x70, 0x69, 0x47, 0x26, 0x9a, 0xfa, 0x4e, 0x0e, 0xce, 0x65, 0x54, 0x6b, 0xeb, 0x8b,
-	0xcf, 0xa8, 0x70, 0xa8, 0x6b, 0xc2, 0x41, 0x66, 0x24, 0x1c, 0xd8, 0xf1, 0x99, 0xb2, 0xe2, 0x77,
-	0x0d, 0xb8, 0xa0, 0xcf, 0x1e, 0x61, 0x8b, 0x6e, 0xdd, 0x22, 0xef, 0xc0, 0xe8, 0x3d, 0xea, 0xb8,
-	0x54, 0x86, 0x60, 0xc4, 0xd9, 0xbd, 0xc4, 0xe9, 0x30, 0x2f, 0xe4, 0x6c, 0xff, 0x8c, 0x2f, 0xe5,
-	0x33, 0x96, 0x20, 0x21, 0x8b, 0xa2, 0x72, 0xfc, 0x7a, 0xca, 0x94, 0x37, 0x35, 0x59, 0x9f, 0x3a,
-	0x46, 0x31, 0xfe, 0x43, 0x03, 0x5e, 0x38, 0x86, 0x86, 0x0d, 0x1c, 0x1b, 0x7a, 0x75, 0xe0, 0x70,
-	0x63, 0x41, 0x28, 0x79, 0x1f, 0xa6, 0x36, 0x44, 0xa4, 0x98, 0x1c, 0x0e, 0x25, 0xbb, 0xbb, 0x0c,
-	0x22, 0xb3, 0xe5, 0xb8, 0xa4, 0x91, 0x99, 0xf5, 0x7f, 0xcf, 0x0f, 0xa3, 0x4e, 0x92, 0x2c, 0x06,
-	0xad, 0xff, 0x3d, 0x01, 0xb3, 0xe2, 0x52, 0xa6, 0x16, 0xe8, 0xd5, 0x14, 0xee, 0x10, 0x2f, 0xc3,
-	0x28, 0xc3, 0x89, 0xb5, 0x6b, 0x9c, 0x07, 0xf8, 0xf4, 0x95, 0xe7, 0x5a, 0xa2, 0x28, 0xb6, 0xeb,
-	0x72, 0x99, 0xb7, 0x16, 0xdf, 0x34, 0xa0, 0xa2, 0xf3, 0xfe, 0xb4, 0x43, 0xf3, 0x9e, 0x36, 0x34,
-	0x2f, 0x64, 0x0f, 0xcd, 0xe0, 0x31, 0xe9, 0xcb, 0xdb, 0x30, 0xd4, 0x58, 0x98, 0x30, 0xba, 0xe8,
-	0xb7, 0x1d, 0xaf, 0xa3, 0xe6, 0x1a, 0x70, 0x11, 0x62, 0x89, 0x12, 0xa5, 0xb7, 0xf2, 0x03, 0x7b,
-	0xcb, 0xfc, 0x76, 0x01, 0x2e, 0x5a, 0x74, 0xd7, 0x63, 0x0a, 0xd2, 0x66, 0xe8, 0x75, 0x76, 0xb5,
-	0x3b, 0x25, 0x33, 0xd5, 0xe1, 0xc2, 0x93, 0x8e, 0x41, 0xe2, 0xfe, 0xbe, 0x06, 0x45, 0x26, 0xa5,
-	0x95, 0x3e, 0x47, 0xa3, 0x07, 0x33, 0xe6, 0xf0, 0x71, 0x95, 0xc5, 0xe4, 0xba, 0xd8, 0x43, 0x14,
-	0x5f, 0x67, 0xb6, 0x87, 0xa4, 0x5e, 0xee, 0xe6, 0xfb, 0x48, 0xac, 0x54, 0x15, 0x06, 0x28, 0x55,
-	0x0f, 0xe0, 0x6c, 0xcd, 0xe5, 0xf2, 0xc9, 0x69, 0xad, 0x07, 0x5e, 0xa7, 0xe9, 0x75, 0x9d, 0x96,
-	0x54, 0xca, 0xf9, 0x3b, 0xe6, 0x71, 0xb9, 0xdd, 0x8d, 0x11, 0xac, 0x4c, 0x32, 0xd6, 0x8c, 0xc5,
-	0xd5, 0x06, 0x4f, 0x88, 0x32, 0x8a, 0x2c, 0xb0, 0x19, 0x6e, 0x27, 0xe4, 0x19, 0x51, 0xac, 0xb8,
-	0x18, 0xd5, 0x39, 0x0c, 0x77, 0xd8, 0x58, 0x69, 0xdc, 0x17, 0xe1, 0x03, 0xd2, 0x15, 0x8b, 0x47,
-	0x47, 0x44, 0xad, 0x10, 0xed, 0x77, 0x0d, 0x2f, 0xa1, 0x6b, 0x34, 0xee, 0x31, 0xba, 0x62, 0x1f,
-	0x5d, 0x18, 0xee, 0xa9, 0x74, 0x1c, 0x8f, 0xcc, 0x01, 0x70, 0x67, 0x16, 0x9c, 0x10, 0xa5, 0x44,
-	0xf9, 0x0b, 0x10, 0xca, 0x95, 0x3f, 0x05, 0x85, 0xbc, 0x0b, 0x33, 0x4b, 0x0b, 0xf3, 0x32, 0x2e,
-	0x60, 0xd1, 0x6f, 0xf6, 0xda, 0xb4, 0x13, 0x61, 0x9c, 0x4a, 0x99, 0x8f, 0x21, 0x6d, 0xce, 0xb3,
-	0x59, 0x90, 0x85, 0x26, 0xa2, 0x03, 0x78, 0x6c, 0xd9, 0x82, 0xef, 0xd2, 0x70, 0xeb, 0xe6, 0x73,
-	0x16, 0x1d, 0xa0, 0xb4, 0x0d, 0x57, 0xdb, 0xcd, 0xcc, 0x95, 0xf9, 0x77, 0x31, 0x3a, 0xa0, 0x0f,
-	0x97, 0xfc, 0x24, 0x8c, 0xe0, 0x4f, 0xb1, 0xe3, 0xce, 0x64, 0xb0, 0x4d, 0x76, 0xdb, 0x26, 0xcf,
-	0x6d, 0x81, 0x04, 0x64, 0x39, 0x49, 0x5e, 0x7f, 0x0a, 0x1f, 0x57, 0x11, 0xa0, 0xaa, 0xbf, 0x5a,
-	0xe2, 0x42, 0x59, 0xfd, 0x20, 0x9b, 0x23, 0xf7, 0x9c, 0x70, 0x8f, 0xba, 0x0b, 0xf2, 0xdd, 0xc1,
-	0x32, 0x9f, 0x23, 0x7b, 0x08, 0xc5, 0x17, 0x55, 0x2c, 0x05, 0x85, 0x49, 0x87, 0xe5, 0x70, 0x33,
-	0x14, 0x55, 0x11, 0x56, 0x90, 0x87, 0xd6, 0xab, 0x6b, 0x89, 0x22, 0x94, 0x96, 0x32, 0x77, 0x63,
-	0xe0, 0x34, 0xf7, 0x69, 0xb0, 0x75, 0xf3, 0xb3, 0x90, 0x96, 0xfa, 0x37, 0x8e, 0x19, 0x93, 0xdf,
-	0x28, 0xc6, 0xa9, 0x59, 0x34, 0x64, 0xa6, 0x23, 0x26, 0x37, 0xf3, 0x46, 0xa2, 0x23, 0x26, 0x37,
-	0xf3, 0xaa, 0x8e, 0x18, 0xa3, 0xc6, 0x99, 0x73, 0x73, 0x27, 0x64, 0xce, 0x1d, 0x90, 0xac, 0x5b,
-	0x3a, 0x75, 0x3e, 0x47, 0xef, 0x16, 0x7c, 0x09, 0xca, 0xb5, 0x28, 0x72, 0x9a, 0x7b, 0xd4, 0xc5,
-	0x0c, 0xcd, 0xca, 0x85, 0xa0, 0x23, 0xe0, 0xaa, 0xbb, 0x98, 0x8a, 0xab, 0xbc, 0x5b, 0x32, 0x36,
-	0xc4, 0xbb, 0x25, 0x73, 0x30, 0xb6, 0xdc, 0x79, 0xe4, 0xb1, 0x3e, 0x29, 0x26, 0xc9, 0x21, 0x3c,
-	0x0e, 0xd2, 0x1f, 0xbb, 0x40, 0x10, 0x79, 0x5b, 0xd1, 0x20, 0x4a, 0x89, 0x2a, 0x2f, 0x5e, 0x4c,
-	0x96, 0x8a, 0x84, 0x7a, 0xde, 0x2c, 0xd1, 0xc9, 0x6d, 0x18, 0x93, 0xd6, 0x33, 0x24, 0xea, 0xbb,
-	0xa0, 0x74, 0x78, 0x89, 0x96, 0x8f, 0x42, 0x58, 0xcf, 0xef, 0xea, 0xf1, 0x23, 0xe3, 0x4a, 0x5c,
-	0xb6, 0x12, 0x3f, 0xa2, 0xc5, 0x65, 0x2b, 0x91, 0x24, 0xb1, 0x31, 0x54, 0x3e, 0xd1, 0x18, 0xda,
-	0x82, 0xf2, 0xba, 0x13, 0x44, 0x1e, 0xdb, 0x8e, 0x3a, 0x11, 0x4f, 0xab, 0x95, 0xd8, 0xea, 0x4a,
-	0x51, 0xfd, 0x25, 0x19, 0x9f, 0xdc, 0x55, 0xf0, 0xf5, 0xc0, 0xd6, 0x04, 0x4e, 0x56, 0x33, 0x3c,
-	0x0c, 0x45, 0x12, 0x48, 0xbc, 0x02, 0x54, 0x0e, 0xae, 0x44, 0x8b, 0xd4, 0xa3, 0xf4, 0x7e, 0xe7,
-	0xc4, 0x5b, 0x7c, 0x0c, 0xd0, 0x66, 0x9c, 0x42, 0x36, 0x98, 0x5d, 0x04, 0xf5, 0x8a, 0x94, 0xe1,
-	0x18, 0x23, 0x92, 0xaf, 0x43, 0x99, 0xfd, 0x8f, 0x39, 0x86, 0x3c, 0xca, 0xd3, 0x66, 0x25, 0x1e,
-	0x67, 0xfa, 0x82, 0xe6, 0x89, 0x88, 0x1a, 0x34, 0xe2, 0x0b, 0x18, 0x19, 0xa7, 0x0f, 0x5e, 0x34,
-	0x6e, 0xe6, 0x0f, 0x0d, 0xb8, 0x30, 0x80, 0xc7, 0xd0, 0x2f, 0x16, 0xcd, 0x25, 0x1b, 0x92, 0x62,
-	0x9b, 0x8b, 0x0d, 0x49, 0x9d, 0x18, 0x72, 0x6b, 0xca, 0x4e, 0x78, 0x95, 0xff, 0xcc, 0x12, 0x5e,
-	0x99, 0x87, 0x06, 0x8c, 0x2b, 0x23, 0xfb, 0x14, 0x1f, 0x22, 0x78, 0x4d, 0x64, 0x7e, 0xcc, 0x27,
-	0x78, 0xa9, 0xf7, 0x87, 0x79, 0xa6, 0xc7, 0x6f, 0x00, 0xac, 0x38, 0x61, 0x54, 0x6b, 0x46, 0xde,
-	0x23, 0x3a, 0x84, 0x18, 0x4b, 0x02, 0xf5, 0x1d, 0x4c, 0xa4, 0xca, 0xc8, 0xfa, 0x02, 0xf5, 0x63,
-	0x86, 0xe6, 0x2a, 0x8c, 0x36, 0xfc, 0x20, 0xaa, 0x1f, 0xf0, 0xbd, 0x69, 0x91, 0x86, 0x4d, 0xf5,
-	0x84, 0xce, 0x43, 0x5b, 0xbd, 0x69, 0x89, 0x22, 0xa6, 0x20, 0xde, 0xf1, 0x68, 0xcb, 0x55, 0x6f,
-	0x68, 0x1e, 0x32, 0x80, 0xc5, 0xe1, 0xd7, 0x3f, 0x80, 0x29, 0x99, 0x7c, 0x6e, 0x63, 0xa5, 0x81,
-	0x2d, 0x98, 0x82, 0xf1, 0xad, 0x25, 0x6b, 0xf9, 0xce, 0x57, 0xed, 0x3b, 0x9b, 0x2b, 0x2b, 0x95,
-	0x33, 0x64, 0x02, 0x4a, 0x02, 0xb0, 0x50, 0xab, 0x18, 0xa4, 0x0c, 0xc5, 0xe5, 0xd5, 0xc6, 0xd2,
-	0xc2, 0xa6, 0xb5, 0x54, 0xc9, 0x5d, 0x7f, 0x15, 0x26, 0x93, 0xfb, 0x17, 0x8c, 0xd1, 0x1c, 0x83,
-	0xbc, 0x55, 0xdb, 0xae, 0x9c, 0x21, 0x00, 0xa3, 0xeb, 0xf7, 0x17, 0x1a, 0x37, 0x6f, 0x56, 0x8c,
-	0xeb, 0x5f, 0xc8, 0x78, 0xf4, 0x99, 0x71, 0x6a, 0xd0, 0xae, 0x13, 0x38, 0x11, 0xe5, 0x9f, 0x79,
-	0xd0, 0x6b, 0x45, 0x5e, 0xb7, 0x45, 0x9f, 0x54, 0x8c, 0xeb, 0x6f, 0xf7, 0xbd, 0xdd, 0x4c, 0xce,
-	0xc1, 0xf4, 0xe6, 0x6a, 0xed, 0x41, 0x7d, 0xf9, 0xee, 0xe6, 0xda, 0x66, 0xc3, 0x7e, 0x50, 0xdb,
-	0x58, 0xb8, 0x57, 0x39, 0xc3, 0x2a, 0xfc, 0x60, 0xad, 0xb1, 0x61, 0x5b, 0x4b, 0x0b, 0x4b, 0xab,
-	0x1b, 0x15, 0xe3, 0xfa, 0xaf, 0x19, 0x30, 0xa9, 0xbf, 0x86, 0x47, 0xae, 0xc0, 0xe5, 0xcd, 0xc6,
-	0x92, 0x65, 0x6f, 0xac, 0xdd, 0x5f, 0x5a, 0xb5, 0x37, 0x1b, 0xb5, 0xbb, 0x4b, 0xf6, 0xe6, 0x6a,
-	0x63, 0x7d, 0x69, 0x61, 0xf9, 0xce, 0xf2, 0xd2, 0x62, 0xe5, 0x0c, 0xa9, 0xc2, 0x0b, 0x0a, 0x86,
-	0xb5, 0xb4, 0xb0, 0xb6, 0xb5, 0x64, 0xd9, 0xeb, 0xb5, 0x46, 0x63, 0x7b, 0xcd, 0x5a, 0xac, 0x18,
-	0xe4, 0x12, 0x9c, 0xcf, 0x40, 0x78, 0x70, 0xa7, 0x56, 0xc9, 0xf5, 0x95, 0xad, 0x2e, 0x6d, 0xd7,
-	0x56, 0xec, 0xfa, 0xda, 0x46, 0x25, 0x7f, 0xfd, 0x03, 0xa6, 0x85, 0x24, 0xcf, 0x55, 0x90, 0x22,
-	0x14, 0x56, 0xd7, 0x56, 0x97, 0x2a, 0x67, 0xc8, 0x38, 0x8c, 0xad, 0x2f, 0xad, 0x2e, 0x2e, 0xaf,
-	0xde, 0xe5, 0xdd, 0x5a, 0x5b, 0x5f, 0xb7, 0xd6, 0xb6, 0x96, 0x16, 0x2b, 0x39, 0xd6, 0x77, 0x8b,
-	0x4b, 0xab, 0xac, 0x66, 0xf9, 0xeb, 0x26, 0x4f, 0xd1, 0xac, 0x65, 0x18, 0x65, 0xbd, 0xb5, 0xf4,
-	0x95, 0x8d, 0xa5, 0xd5, 0xc6, 0xf2, 0xda, 0x6a, 0xe5, 0xcc, 0xf5, 0xcb, 0x29, 0x1c, 0x39, 0x12,
-	0x8d, 0xc6, 0xbd, 0xca, 0x99, 0xeb, 0x5f, 0x87, 0xb2, 0xba, 0x09, 0x93, 0x0b, 0x30, 0xa3, 0xfe,
-	0x5e, 0xa7, 0x1d, 0xd7, 0xeb, 0xec, 0x56, 0xce, 0xa4, 0x0b, 0xac, 0x5e, 0xa7, 0xc3, 0x0a, 0xb0,
-	0xf1, 0x6a, 0xc1, 0x06, 0x0d, 0xda, 0x5e, 0x87, 0xed, 0xaf, 0x95, 0x5c, 0xbd, 0xf2, 0xfd, 0xbf,
-	0x7c, 0xe9, 0xcc, 0xf7, 0x7f, 0xf0, 0x92, 0xf1, 0x67, 0x3f, 0x78, 0xc9, 0xf8, 0xaf, 0x3f, 0x78,
-	0xc9, 0xd8, 0x19, 0xc5, 0x89, 0x7e, 0xeb, 0xff, 0x05, 0x00, 0x00, 0xff, 0xff, 0x67, 0x6d, 0x41,
-	0x27, 0x6f, 0xb5, 0x00, 0x00,
+	// 11557 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xdc, 0x7d, 0x6d, 0x6c, 0x1c, 0x49,
+	0x76, 0x98, 0x7a, 0x66, 0x48, 0xce, 0x3c, 0x0e, 0xc9, 0x61, 0x51, 0x1f, 0x94, 0x56, 0xbb, 0xa3,
+	0xeb, 0xfd, 0x92, 0x74, 0xbb, 0xe2, 0x89, 0xba, 0x95, 0xbd, 0xb7, 0x5f, 0x37, 0x43, 0x52, 0x12,
+	0x57, 0x14, 0xc9, 0xed, 0xe1, 0xc7, 0x9d, 0xef, 0xce, 0xed, 0xe6, 0x74, 0x89, 0xec, 0xe5, 0xcc,
+	0xf4, 0xb8, 0xbb, 0x47, 0x12, 0xed, 0x18, 0x76, 0x10, 0x38, 0x86, 0x61, 0xf8, 0x3e, 0x8c, 0x73,
+	0x6c, 0x07, 0x0e, 0xec, 0x18, 0x09, 0x12, 0x27, 0xb8, 0xfc, 0x70, 0x02, 0x24, 0x01, 0x82, 0x00,
+	0x06, 0x02, 0xe3, 0x7e, 0x24, 0x88, 0xff, 0x05, 0x76, 0x02, 0x26, 0xbe, 0xcb, 0x1f, 0x13, 0x48,
+	0x10, 0x20, 0xbf, 0x7c, 0x89, 0x91, 0xa0, 0x5e, 0x55, 0x75, 0x57, 0xf5, 0xf4, 0x90, 0xc3, 0x5d,
+	0x2d, 0x70, 0xd2, 0x2f, 0x72, 0x5e, 0xbd, 0xf7, 0xba, 0x3e, 0x5f, 0xbd, 0x57, 0xf5, 0xde, 0x2b,
+	0x18, 0x8f, 0x0e, 0xba, 0x34, 0xbc, 0xd1, 0x0d, 0xfc, 0xc8, 0x27, 0x23, 0xf8, 0xe3, 0xd2, 0xd9,
+	0x5d, 0x7f, 0xd7, 0x47, 0xc8, 0x1c, 0xfb, 0x8f, 0x17, 0x5e, 0xaa, 0xee, 0xfa, 0xfe, 0x6e, 0x8b,
+	0xce, 0xe1, 0xaf, 0x9d, 0xde, 0xc3, 0xb9, 0xc8, 0x6b, 0xd3, 0x30, 0x72, 0xda, 0x5d, 0x81, 0xb0,
+	0xb0, 0xeb, 0x45, 0x7b, 0xbd, 0x9d, 0x1b, 0x4d, 0xbf, 0x3d, 0xb7, 0x1b, 0x38, 0x8f, 0xbc, 0xc8,
+	0x89, 0x3c, 0xbf, 0xe3, 0xb4, 0xe6, 0x22, 0xda, 0xa2, 0x5d, 0x3f, 0x88, 0xe6, 0x9c, 0xae, 0x37,
+	0x87, 0xdf, 0x98, 0x7b, 0x1c, 0x38, 0xdd, 0x2e, 0x0d, 0x92, 0x7f, 0x38, 0x13, 0xf3, 0xef, 0xe7,
+	0xa1, 0x74, 0x9f, 0xd2, 0x6e, 0xad, 0xe5, 0x3d, 0xa2, 0xe4, 0x65, 0x28, 0xac, 0x3a, 0x6d, 0x3a,
+	0x6b, 0x5c, 0x31, 0xae, 0x96, 0xea, 0x53, 0x47, 0x87, 0xd5, 0xf1, 0x90, 0x06, 0x8f, 0x68, 0x60,
+	0x77, 0x9c, 0x36, 0xb5, 0xb0, 0x90, 0x7c, 0x1e, 0x4a, 0xec, 0x6f, 0xd8, 0x75, 0x9a, 0x74, 0x36,
+	0x87, 0x98, 0x13, 0x47, 0x87, 0xd5, 0x52, 0x47, 0x02, 0xad, 0xa4, 0x9c, 0xbc, 0x06, 0x63, 0x2b,
+	0xd4, 0x09, 0xe9, 0xf2, 0xe2, 0x6c, 0xfe, 0x8a, 0x71, 0x35, 0x5f, 0x2f, 0x1f, 0x1d, 0x56, 0x8b,
+	0x2d, 0x06, 0xb2, 0x3d, 0xd7, 0x92, 0x85, 0x64, 0x19, 0xc6, 0x96, 0x9e, 0x74, 0xbd, 0x80, 0x86,
+	0xb3, 0x85, 0x2b, 0xc6, 0xd5, 0xf1, 0xf9, 0x4b, 0x37, 0x78, 0xfb, 0x6f, 0xc8, 0xf6, 0xdf, 0xd8,
+	0x90, 0xed, 0xaf, 0xcf, 0x7c, 0xff, 0xb0, 0x7a, 0xe6, 0xe8, 0xb0, 0x3a, 0x46, 0x39, 0xc9, 0xb7,
+	0xff, 0x6b, 0xd5, 0xb0, 0x24, 0x3d, 0x79, 0x17, 0x0a, 0x1b, 0x07, 0x5d, 0x3a, 0x5b, 0xba, 0x62,
+	0x5c, 0x9d, 0x9c, 0x7f, 0xe9, 0x06, 0xef, 0xf1, 0xb8, 0x91, 0xc9, 0x7f, 0x0c, 0xab, 0x5e, 0x3c,
+	0x3a, 0xac, 0x16, 0x18, 0x8a, 0x85, 0x54, 0xe4, 0x4d, 0x18, 0xbd, 0xe7, 0x87, 0xd1, 0xf2, 0xe2,
+	0x2c, 0x60, 0xd3, 0xce, 0x1d, 0x1d, 0x56, 0xa7, 0xf7, 0xfc, 0x30, 0xb2, 0x3d, 0xf7, 0x0d, 0xbf,
+	0xed, 0x45, 0xb4, 0xdd, 0x8d, 0x0e, 0x2c, 0x81, 0x64, 0xee, 0xc0, 0x84, 0xc6, 0x8f, 0x8c, 0xc3,
+	0xd8, 0xe6, 0xea, 0xfd, 0xd5, 0xb5, 0xed, 0xd5, 0xca, 0x19, 0x52, 0x84, 0xc2, 0xea, 0xda, 0xe2,
+	0x52, 0xc5, 0x20, 0x63, 0x90, 0xaf, 0xad, 0xaf, 0x57, 0x72, 0xa4, 0x0c, 0xc5, 0xc5, 0xda, 0x46,
+	0xad, 0x5e, 0x6b, 0x2c, 0x55, 0xf2, 0x64, 0x06, 0xa6, 0xb6, 0x97, 0x57, 0x17, 0xd7, 0xb6, 0x1b,
+	0xf6, 0xe2, 0x52, 0xe3, 0xfe, 0xc6, 0xda, 0x7a, 0xa5, 0x40, 0x26, 0x01, 0xee, 0x6f, 0xd6, 0x97,
+	0xac, 0xd5, 0xa5, 0x8d, 0xa5, 0x46, 0x65, 0xc4, 0xfc, 0x95, 0x3c, 0x14, 0x1f, 0xd0, 0xc8, 0x71,
+	0x9d, 0xc8, 0x21, 0x97, 0xb5, 0x21, 0xc2, 0xda, 0x2b, 0x63, 0xf3, 0x72, 0xff, 0xd8, 0x8c, 0x1c,
+	0x1d, 0x56, 0x8d, 0x37, 0xd5, 0x31, 0x79, 0x07, 0xc6, 0x17, 0x69, 0xd8, 0x0c, 0xbc, 0x2e, 0x9b,
+	0x2f, 0x38, 0x2e, 0xa5, 0xfa, 0xc5, 0xa3, 0xc3, 0xea, 0x39, 0x37, 0x01, 0x2b, 0x6d, 0x55, 0xb1,
+	0xc9, 0x32, 0x8c, 0xae, 0x38, 0x3b, 0xb4, 0x15, 0xce, 0x8e, 0x5c, 0xc9, 0x5f, 0x1d, 0x9f, 0x7f,
+	0x41, 0xf4, 0xaf, 0xac, 0xe0, 0x0d, 0x5e, 0xba, 0xd4, 0x89, 0x82, 0x83, 0xfa, 0xd9, 0xa3, 0xc3,
+	0x6a, 0xa5, 0x85, 0x00, 0xb5, 0xef, 0x38, 0x0a, 0x69, 0x24, 0x63, 0x3e, 0x7a, 0xe2, 0x98, 0xbf,
+	0xf8, 0xfd, 0xc3, 0xaa, 0xc1, 0xc6, 0x42, 0x8c, 0x79, 0xc2, 0x4f, 0x1f, 0xfd, 0x2b, 0x90, 0x5b,
+	0x5e, 0x9c, 0x1d, 0xc3, 0xb9, 0x56, 0x39, 0x3a, 0xac, 0x96, 0xb5, 0x61, 0xcb, 0x2d, 0x2f, 0x5e,
+	0x7a, 0x1b, 0xc6, 0x95, 0x3a, 0x92, 0x0a, 0xe4, 0xf7, 0xe9, 0x01, 0xef, 0x4f, 0x8b, 0xfd, 0x4b,
+	0xce, 0xc2, 0xc8, 0x23, 0xa7, 0xd5, 0x13, 0x1d, 0x68, 0xf1, 0x1f, 0x5f, 0xca, 0xfd, 0xa4, 0x61,
+	0xfe, 0x46, 0x01, 0x8a, 0x96, 0xcf, 0xd7, 0x19, 0xb9, 0x06, 0x23, 0x8d, 0xc8, 0x89, 0xe4, 0x50,
+	0xcc, 0x1c, 0x1d, 0x56, 0xa7, 0x42, 0x06, 0x50, 0xbe, 0xc7, 0x31, 0x18, 0xea, 0xfa, 0x9e, 0x13,
+	0xca, 0x21, 0x41, 0xd4, 0x2e, 0x03, 0xa8, 0xa8, 0x88, 0x41, 0x5e, 0x83, 0xc2, 0x03, 0xdf, 0xa5,
+	0x62, 0x54, 0xc8, 0xd1, 0x61, 0x75, 0xb2, 0xed, 0xbb, 0x2a, 0x22, 0x96, 0x93, 0x37, 0xa0, 0xb4,
+	0xd0, 0x0b, 0x02, 0xda, 0x61, 0x53, 0xb5, 0x80, 0xc8, 0x93, 0x47, 0x87, 0x55, 0x68, 0x72, 0x20,
+	0x5b, 0x5c, 0x09, 0x02, 0xeb, 0xea, 0x46, 0xe4, 0x04, 0x11, 0x75, 0x67, 0x47, 0x86, 0xea, 0x6a,
+	0xb6, 0xbc, 0xa6, 0x43, 0x4e, 0x92, 0xee, 0x6a, 0xc1, 0x89, 0xdc, 0x83, 0xf1, 0xbb, 0x81, 0xd3,
+	0xa4, 0xeb, 0x34, 0xf0, 0x7c, 0x17, 0xc7, 0x30, 0x5f, 0x7f, 0xed, 0xe8, 0xb0, 0x7a, 0x7e, 0x97,
+	0x81, 0xed, 0x2e, 0xc2, 0x13, 0xea, 0x1f, 0x1d, 0x56, 0x8b, 0x8b, 0xbd, 0x00, 0x7b, 0xcf, 0x52,
+	0x49, 0xc9, 0xcf, 0xb0, 0x21, 0x09, 0x23, 0xec, 0x5a, 0xea, 0xe2, 0xe8, 0x1d, 0x5f, 0x45, 0x53,
+	0x54, 0xf1, 0x7c, 0xcb, 0x09, 0x23, 0x3b, 0xe0, 0x74, 0xa9, 0x7a, 0xaa, 0x2c, 0xc9, 0x1a, 0x14,
+	0x1b, 0xcd, 0x3d, 0xea, 0xf6, 0x5a, 0x74, 0xb6, 0x88, 0xec, 0x2f, 0x88, 0x89, 0x2b, 0xc7, 0x53,
+	0x16, 0xd7, 0x2f, 0x09, 0xde, 0x24, 0x14, 0x10, 0xa5, 0xef, 0x63, 0x26, 0x5f, 0x2a, 0xfe, 0xf6,
+	0xef, 0x57, 0xcf, 0xfc, 0xd2, 0x7f, 0xb9, 0x72, 0xc6, 0xfc, 0x97, 0x39, 0xa8, 0xa4, 0x99, 0x90,
+	0x87, 0x30, 0xb1, 0xd9, 0x75, 0x9d, 0x88, 0x2e, 0xb4, 0x3c, 0xda, 0x89, 0x42, 0x9c, 0x24, 0xc7,
+	0xb7, 0xe9, 0x15, 0xf1, 0xdd, 0xd9, 0x1e, 0x12, 0xda, 0x4d, 0x4e, 0x99, 0x6a, 0x95, 0xce, 0x36,
+	0xf9, 0x4e, 0x03, 0xe5, 0x74, 0x88, 0x33, 0xec, 0x74, 0xdf, 0xe1, 0x12, 0x7e, 0xc0, 0x77, 0x04,
+	0x5b, 0x31, 0x81, 0x3a, 0xee, 0xce, 0x01, 0xce, 0xcc, 0xe1, 0x27, 0x10, 0x23, 0xc9, 0x98, 0x40,
+	0x0c, 0x6c, 0xfe, 0x77, 0x03, 0x26, 0x2d, 0x1a, 0xfa, 0xbd, 0xa0, 0x49, 0xef, 0x51, 0xc7, 0xa5,
+	0x01, 0x9b, 0xfe, 0xf7, 0xbd, 0x8e, 0x2b, 0xd6, 0x14, 0x4e, 0xff, 0x7d, 0xaf, 0xa3, 0x2e, 0x61,
+	0x2c, 0x27, 0x5f, 0x80, 0xb1, 0x46, 0x6f, 0x07, 0x51, 0xf9, 0x9a, 0x3a, 0x8f, 0x23, 0xd6, 0xdb,
+	0xb1, 0x53, 0xe8, 0x12, 0x8d, 0xcc, 0xc1, 0xd8, 0x16, 0x0d, 0xc2, 0x44, 0xe2, 0xa1, 0x64, 0x7f,
+	0xc4, 0x41, 0x2a, 0x81, 0xc0, 0x22, 0x77, 0x13, 0xa9, 0x2b, 0xf6, 0xa4, 0xa9, 0x94, 0xac, 0x4b,
+	0xa6, 0x4a, 0x5b, 0x40, 0xd4, 0xa9, 0x22, 0xb1, 0xcc, 0xef, 0xe4, 0xa0, 0xb2, 0xe8, 0x44, 0xce,
+	0x8e, 0x13, 0x8a, 0xfe, 0xdc, 0xba, 0xc5, 0xe4, 0xb8, 0xd2, 0x50, 0x94, 0xe3, 0xac, 0xe6, 0x9f,
+	0xb8, 0x79, 0xaf, 0xa6, 0x9b, 0x37, 0xce, 0x36, 0x48, 0xd1, 0xbc, 0xa4, 0x51, 0xef, 0x9d, 0xdc,
+	0xa8, 0x8a, 0x68, 0x54, 0x51, 0x36, 0x2a, 0x69, 0x0a, 0x79, 0x0f, 0x0a, 0x8d, 0x2e, 0x6d, 0x0a,
+	0x21, 0x22, 0x65, 0xbf, 0xde, 0x38, 0x86, 0xb0, 0x75, 0xab, 0x5e, 0x16, 0x6c, 0x0a, 0x61, 0x97,
+	0x36, 0x2d, 0x24, 0x53, 0x16, 0xcd, 0x77, 0x47, 0xe1, 0x6c, 0x16, 0x19, 0x79, 0x4f, 0xdf, 0x9c,
+	0x78, 0xf7, 0xbc, 0x30, 0x70, 0x73, 0x9a, 0x35, 0xf4, 0xed, 0xe9, 0x3a, 0x14, 0xd7, 0xd9, 0x84,
+	0x6c, 0xfa, 0x2d, 0xd1, 0x73, 0x4c, 0x2a, 0x16, 0xbb, 0x12, 0x66, 0x58, 0x71, 0x39, 0x79, 0x01,
+	0xf2, 0x9b, 0xd6, 0xb2, 0xe8, 0xae, 0xd2, 0xd1, 0x61, 0x35, 0xdf, 0x0b, 0xbc, 0x59, 0xc3, 0x62,
+	0x50, 0x32, 0x07, 0xa3, 0x0b, 0xb5, 0x05, 0x1a, 0x44, 0xd8, 0x4d, 0xe5, 0xfa, 0x05, 0x36, 0x5b,
+	0x9a, 0x8e, 0xdd, 0xa4, 0x41, 0xa4, 0x7d, 0x5e, 0xa0, 0x91, 0xcf, 0x43, 0xbe, 0xb6, 0xdd, 0x10,
+	0x3d, 0x03, 0xa2, 0x67, 0x6a, 0xdb, 0x8d, 0xfa, 0x84, 0xe8, 0x88, 0xbc, 0xf3, 0x38, 0x64, 0xdc,
+	0x6b, 0xdb, 0x0d, 0x75, 0xb4, 0x46, 0x8f, 0x19, 0xad, 0xab, 0x50, 0x64, 0x7a, 0x06, 0xdb, 0xe0,
+	0x51, 0x28, 0x96, 0xb8, 0xfa, 0xb4, 0x27, 0x60, 0x56, 0x5c, 0x4a, 0x5e, 0x8e, 0xd5, 0x96, 0x62,
+	0xc2, 0x4f, 0xa8, 0x2d, 0x52, 0x59, 0x21, 0x4f, 0x60, 0x62, 0xf1, 0xa0, 0xe3, 0xb4, 0xbd, 0xa6,
+	0xd8, 0xc2, 0x4b, 0xb8, 0x85, 0xdf, 0x38, 0x66, 0x18, 0x6f, 0x68, 0x04, 0x7c, 0x57, 0x97, 0xc2,
+	0x77, 0xd6, 0xe5, 0x65, 0x76, 0x7a, 0x87, 0x9f, 0x35, 0x2c, 0xfd, 0x43, 0x6c, 0x2d, 0x49, 0x11,
+	0x89, 0x7a, 0x55, 0x32, 0xed, 0x24, 0x38, 0x59, 0x4b, 0x81, 0x80, 0xa8, 0x6b, 0x29, 0xde, 0x74,
+	0xdf, 0x83, 0xfc, 0xdd, 0x85, 0xf5, 0xd9, 0x71, 0xe4, 0x41, 0x04, 0x8f, 0xbb, 0x0b, 0xeb, 0x0b,
+	0x2d, 0xbf, 0xe7, 0x36, 0x3e, 0x5a, 0xa9, 0x5f, 0x10, 0x6c, 0x26, 0x76, 0x9b, 0x5d, 0xad, 0x46,
+	0x8c, 0x8e, 0x2c, 0x41, 0x51, 0xb6, 0x72, 0xb6, 0x8c, 0x3c, 0xa6, 0x53, 0x8d, 0xdf, 0xba, 0xc5,
+	0xd7, 0x9a, 0x2b, 0x7e, 0xab, 0xb5, 0x90, 0x38, 0x97, 0xb6, 0x81, 0xf4, 0xf7, 0x4b, 0x86, 0x26,
+	0xf1, 0x79, 0x55, 0x93, 0x18, 0x9f, 0x3f, 0x27, 0xbe, 0xb5, 0xe0, 0xb7, 0xdb, 0x4e, 0xc7, 0x45,
+	0xda, 0xad, 0x79, 0x55, 0xc1, 0xa8, 0xc1, 0x64, 0x52, 0x91, 0x15, 0x2f, 0x8c, 0xc8, 0x1c, 0x94,
+	0x24, 0x84, 0x6d, 0x22, 0xf9, 0xcc, 0x2a, 0x5b, 0x09, 0x8e, 0xf9, 0x27, 0x39, 0x80, 0xa4, 0xe4,
+	0x19, 0x95, 0x33, 0x3f, 0xa1, 0xc9, 0x99, 0x73, 0xe9, 0x09, 0x3a, 0x50, 0xc2, 0x90, 0x0f, 0x60,
+	0x94, 0xa9, 0x5c, 0x3d, 0xa9, 0x52, 0x5e, 0x48, 0x93, 0x62, 0xe1, 0xd6, 0xad, 0xfa, 0xa4, 0x20,
+	0x1e, 0x0d, 0x11, 0x62, 0x09, 0x32, 0x45, 0x44, 0xfd, 0xcf, 0x42, 0x32, 0x18, 0x42, 0x38, 0x5d,
+	0x55, 0xa4, 0x8b, 0x91, 0xac, 0x47, 0x29, 0x5d, 0x14, 0xd9, 0x72, 0x91, 0xcb, 0x16, 0xde, 0xa9,
+	0x63, 0x42, 0xb6, 0xa4, 0x25, 0x0b, 0xef, 0xc0, 0x13, 0x25, 0x4b, 0x37, 0xbd, 0x6c, 0x0b, 0x38,
+	0x0d, 0xae, 0x66, 0xf6, 0x4a, 0xd6, 0x82, 0xbd, 0x72, 0xd2, 0x82, 0x4d, 0x2f, 0xd7, 0x5b, 0x83,
+	0x64, 0xd9, 0x39, 0xb9, 0xba, 0x9c, 0xc7, 0x2a, 0x39, 0xca, 0xb4, 0x77, 0xf8, 0xd2, 0x1c, 0x1d,
+	0xb8, 0x34, 0xcf, 0x65, 0x2e, 0x4d, 0xbe, 0x30, 0xdf, 0x81, 0x91, 0xda, 0xcf, 0xf5, 0x02, 0x2a,
+	0x74, 0xbf, 0xb2, 0xfc, 0x26, 0x83, 0xc5, 0x6b, 0x7a, 0xca, 0x61, 0x3f, 0x55, 0x9d, 0x19, 0xcb,
+	0xd9, 0x97, 0x37, 0x56, 0x1a, 0x42, 0xaf, 0x23, 0xa9, 0x6e, 0xd9, 0x58, 0x51, 0xaa, 0x1d, 0x69,
+	0xad, 0x66, 0x54, 0x64, 0x0e, 0x72, 0xb5, 0x45, 0x34, 0x16, 0xc7, 0xe7, 0x4b, 0xf2, 0xb3, 0x8b,
+	0xf5, 0xb3, 0x82, 0xa4, 0xec, 0x68, 0xf6, 0x43, 0x6d, 0xf1, 0xb3, 0x5b, 0xfc, 0x2d, 0x45, 0x4d,
+	0x10, 0xd3, 0x94, 0x99, 0xa3, 0x62, 0xb2, 0x18, 0x89, 0xd2, 0xd2, 0x37, 0x59, 0xe2, 0xa9, 0x72,
+	0x8d, 0x0f, 0x5c, 0xae, 0x6f, 0xe0, 0xc6, 0x95, 0x4d, 0x08, 0x87, 0xcb, 0xfc, 0x4b, 0x03, 0x71,
+	0xc9, 0x1b, 0x30, 0x6a, 0xd1, 0xdd, 0x64, 0xaf, 0x45, 0x9b, 0x2d, 0x40, 0x88, 0xfa, 0x01, 0x8e,
+	0x83, 0x82, 0x9c, 0xba, 0xe1, 0x9e, 0xf7, 0x30, 0x12, 0x5f, 0x89, 0x05, 0xb9, 0x00, 0x2b, 0x82,
+	0x5c, 0x40, 0x34, 0x41, 0x2e, 0x60, 0x6c, 0x8a, 0x59, 0x8b, 0x0d, 0xa1, 0x4c, 0xca, 0x9a, 0x5a,
+	0x8b, 0xca, 0x58, 0x05, 0xae, 0x36, 0x56, 0xd6, 0x62, 0x83, 0xdc, 0x86, 0x52, 0xad, 0xd9, 0xf4,
+	0x7b, 0x8a, 0xd1, 0x33, 0x7b, 0x74, 0x58, 0x3d, 0xeb, 0x70, 0xa0, 0x6e, 0xa2, 0x27, 0xa8, 0x66,
+	0x3d, 0xa9, 0x35, 0xe3, 0xb1, 0xd0, 0xea, 0x85, 0x11, 0x0d, 0x96, 0x17, 0x45, 0x93, 0x91, 0x47,
+	0x93, 0x03, 0x53, 0x3c, 0x62, 0x54, 0xf3, 0x3f, 0x1b, 0x58, 0x63, 0xf2, 0x36, 0xc0, 0x72, 0x87,
+	0x29, 0xb6, 0x4d, 0x1a, 0x33, 0x40, 0xe3, 0xd9, 0x13, 0x50, 0x9d, 0x83, 0x82, 0xac, 0x7f, 0x3a,
+	0x37, 0xf4, 0xa7, 0xd9, 0x27, 0xa5, 0x9a, 0x2c, 0xce, 0x51, 0xc4, 0x27, 0x03, 0x01, 0x4d, 0x7d,
+	0x32, 0x41, 0x26, 0xaf, 0xc1, 0xd8, 0x72, 0xed, 0x41, 0xad, 0x17, 0xed, 0x61, 0x7f, 0x15, 0xb9,
+	0xc0, 0xf2, 0x9c, 0xb6, 0xed, 0xf4, 0xa2, 0x3d, 0x4b, 0x16, 0x9a, 0xbf, 0x64, 0xc0, 0xb8, 0xb2,
+	0x56, 0x59, 0x55, 0xd7, 0x03, 0xff, 0x63, 0xda, 0x8c, 0xf4, 0x5e, 0xea, 0x72, 0x60, 0xaa, 0xaa,
+	0x31, 0x6a, 0xaa, 0x77, 0x72, 0xa7, 0xe8, 0x1d, 0x73, 0x4e, 0x88, 0x00, 0x66, 0x03, 0x28, 0x47,
+	0x1c, 0x68, 0x03, 0x30, 0x1d, 0x47, 0xb5, 0x01, 0x58, 0xb9, 0xf9, 0x87, 0x06, 0x5b, 0xba, 0x64,
+	0x0e, 0xe0, 0x3e, 0x3d, 0x88, 0x9c, 0x9d, 0x3b, 0x5e, 0x4b, 0x3b, 0xba, 0xda, 0x47, 0xa8, 0xfd,
+	0xd0, 0x6b, 0x51, 0x4b, 0x41, 0x21, 0xb7, 0xa0, 0x78, 0x3f, 0xd8, 0x79, 0x0b, 0xd1, 0x73, 0xb1,
+	0x08, 0x9e, 0xd9, 0x0f, 0x76, 0xde, 0x42, 0x64, 0x75, 0xbe, 0x4a, 0x44, 0x62, 0xc2, 0xe8, 0xa2,
+	0xdf, 0x76, 0x3c, 0xb9, 0xed, 0x01, 0xdb, 0x3b, 0x5c, 0x84, 0x58, 0xa2, 0x84, 0x09, 0xfd, 0xc6,
+	0xfa, 0xaa, 0x98, 0x98, 0x28, 0xf4, 0xc3, 0x6e, 0xc7, 0x62, 0x30, 0xf3, 0x7b, 0x06, 0x8c, 0x2b,
+	0x12, 0x89, 0x7c, 0x51, 0x98, 0xf9, 0x06, 0x1e, 0x52, 0x9d, 0xef, 0x97, 0x59, 0xac, 0x94, 0x6f,
+	0xd7, 0xcc, 0xfc, 0x17, 0x46, 0x7f, 0x22, 0x0d, 0x72, 0xc3, 0x48, 0x83, 0xb7, 0x01, 0xb8, 0x2e,
+	0x87, 0xdd, 0xa9, 0xcc, 0x1b, 0xe5, 0x50, 0x4f, 0x1d, 0x8c, 0x04, 0xd9, 0xfc, 0x9b, 0x39, 0x28,
+	0x0a, 0x5b, 0x65, 0xfe, 0x19, 0xd5, 0x21, 0xde, 0xd2, 0x74, 0x88, 0x19, 0x41, 0xaa, 0x28, 0xb7,
+	0xf3, 0x27, 0xd8, 0x28, 0x6f, 0x43, 0x59, 0x76, 0x01, 0xaa, 0x62, 0xd7, 0x60, 0x4c, 0x5a, 0xd9,
+	0x5c, 0x11, 0x9b, 0xd2, 0x78, 0x6e, 0xcd, 0x5b, 0xb2, 0xdc, 0xfc, 0xce, 0x88, 0xa4, 0xe5, 0x5f,
+	0x62, 0x5d, 0x58, 0x73, 0xdd, 0x40, 0xed, 0x42, 0xc7, 0x75, 0x03, 0x0b, 0xa1, 0x6c, 0xa0, 0xd6,
+	0x7b, 0x3b, 0x2d, 0xaf, 0x89, 0x38, 0xca, 0xaa, 0xe9, 0x22, 0xd4, 0x66, 0xa8, 0xea, 0x40, 0x25,
+	0xc8, 0x9a, 0x89, 0x90, 0x3f, 0xd6, 0x44, 0xf8, 0x69, 0x28, 0x2d, 0xb4, 0x5d, 0x4d, 0x85, 0x30,
+	0x33, 0x3a, 0xe5, 0x46, 0x8c, 0xc4, 0x95, 0x87, 0xcb, 0xa2, 0x8f, 0xce, 0x36, 0xdb, 0x6e, 0xbf,
+	0xe2, 0x90, 0xb0, 0xd4, 0x74, 0xfc, 0x91, 0x4f, 0xa3, 0xe3, 0xdf, 0x86, 0xd2, 0x66, 0x48, 0x37,
+	0x7a, 0x9d, 0x0e, 0x6d, 0xa1, 0x3a, 0x51, 0xe4, 0xb2, 0xa7, 0x17, 0x52, 0x3b, 0x42, 0xa8, 0x5a,
+	0x81, 0x18, 0x55, 0x9d, 0x56, 0x63, 0xc7, 0x4c, 0xab, 0x2f, 0x42, 0xa1, 0xd6, 0xed, 0x4a, 0xe3,
+	0x27, 0xde, 0x24, 0xbb, 0x5d, 0xdc, 0xfa, 0x26, 0x9d, 0x6e, 0x57, 0x37, 0x65, 0x10, 0x9b, 0x50,
+	0x20, 0xf7, 0x7b, 0x3b, 0x34, 0xe8, 0xd0, 0x88, 0x86, 0x42, 0x34, 0x87, 0xb3, 0x80, 0x3c, 0x66,
+	0xe5, 0x19, 0x73, 0x1a, 0x01, 0x0d, 0xd7, 0x0b, 0xfb, 0xbd, 0x1d, 0x6a, 0x0b, 0x19, 0xaf, 0xf6,
+	0x5d, 0x06, 0xc3, 0x4b, 0x0d, 0x98, 0xd4, 0xfb, 0xff, 0x29, 0x28, 0x16, 0x1f, 0x16, 0x8a, 0xc5,
+	0x4a, 0xc9, 0xfc, 0x95, 0x1c, 0x8c, 0xd7, 0xba, 0xdd, 0x67, 0xfc, 0x04, 0xe2, 0x27, 0xb5, 0x55,
+	0x7d, 0x3e, 0x19, 0xbd, 0x53, 0x1c, 0x3e, 0xfc, 0x95, 0x01, 0x53, 0x29, 0x0a, 0xb5, 0xf6, 0xc6,
+	0x90, 0x16, 0x79, 0x6e, 0x48, 0x8b, 0x3c, 0x3f, 0xd8, 0x22, 0x57, 0xd7, 0x4c, 0xe1, 0xd3, 0xac,
+	0x99, 0xd7, 0x21, 0x5f, 0xeb, 0x76, 0x45, 0xaf, 0x94, 0x93, 0x5e, 0xd9, 0xba, 0xc5, 0x37, 0x22,
+	0xa7, 0xdb, 0xb5, 0x18, 0x86, 0xf9, 0x26, 0x94, 0x10, 0x8c, 0x12, 0xed, 0x8a, 0x58, 0x0a, 0x5c,
+	0x9c, 0x69, 0x64, 0x7c, 0xda, 0x9b, 0xff, 0xc7, 0x80, 0x11, 0xfc, 0xfd, 0x8c, 0x4e, 0x97, 0x79,
+	0x6d, 0xba, 0x54, 0x94, 0xe9, 0x32, 0xcc, 0x44, 0xf9, 0xa3, 0x3c, 0xf6, 0x96, 0x98, 0x22, 0xc2,
+	0xa6, 0x33, 0x32, 0x6c, 0xba, 0x4f, 0x21, 0xc0, 0xf7, 0xd3, 0xd6, 0x5d, 0x1e, 0x07, 0xe3, 0xe5,
+	0x74, 0x55, 0x9f, 0x8a, 0x61, 0x77, 0x0f, 0xc8, 0x72, 0x27, 0xa4, 0xcd, 0x5e, 0x40, 0x1b, 0xfb,
+	0x5e, 0x77, 0x8b, 0x06, 0xde, 0xc3, 0x03, 0xa1, 0x19, 0xa2, 0x8c, 0xf5, 0x44, 0xa9, 0x1d, 0xee,
+	0x7b, 0x5d, 0xfb, 0x11, 0x96, 0x5b, 0x19, 0x34, 0xe4, 0x03, 0x18, 0xb3, 0xe8, 0xe3, 0xc0, 0x8b,
+	0xa8, 0xe8, 0xdb, 0xc9, 0xd8, 0x0e, 0x40, 0x28, 0xd7, 0x4d, 0x02, 0xfe, 0x43, 0x1d, 0x7f, 0x51,
+	0xfe, 0xd9, 0x99, 0x51, 0xdf, 0x1d, 0xc1, 0xb5, 0x70, 0xc2, 0x4d, 0xd9, 0x31, 0x06, 0xba, 0x3e,
+	0x98, 0xf9, 0xd3, 0x0c, 0xe6, 0x16, 0x94, 0x99, 0xe9, 0x96, 0xb2, 0xd4, 0x2f, 0x27, 0x63, 0x79,
+	0x43, 0x2d, 0x3e, 0xee, 0x92, 0x4c, 0xe3, 0x43, 0xec, 0xf4, 0x24, 0xe1, 0x97, 0x6f, 0x2f, 0x2a,
+	0x8c, 0x33, 0xa6, 0x47, 0x2c, 0x3a, 0x9a, 0xbc, 0xb3, 0x4e, 0x3d, 0x31, 0x46, 0x3f, 0xdd, 0xc4,
+	0x18, 0xfb, 0x24, 0x13, 0x23, 0x7d, 0x3d, 0x59, 0x3c, 0xcd, 0xf5, 0xe4, 0xa5, 0x0f, 0x60, 0xba,
+	0xaf, 0x87, 0x4f, 0x73, 0xc5, 0xf7, 0xd9, 0x4d, 0xcb, 0x5f, 0x88, 0xfb, 0x85, 0xcc, 0xa3, 0x39,
+	0xea, 0x05, 0xb4, 0x19, 0xa1, 0xe8, 0x15, 0xd2, 0x32, 0x10, 0xb0, 0x94, 0xbd, 0x8c, 0x30, 0xf2,
+	0x3e, 0x8c, 0xf1, 0x2b, 0x92, 0x70, 0x36, 0x87, 0x63, 0x3f, 0x21, 0xbe, 0xc8, 0xa1, 0xe2, 0x9e,
+	0x9a, 0x63, 0xa8, 0xbd, 0x2a, 0x88, 0xcc, 0xbb, 0x30, 0x2a, 0xae, 0x58, 0x8e, 0x5f, 0x17, 0x55,
+	0x18, 0xd9, 0x4a, 0x7a, 0x06, 0x8f, 0xc5, 0x79, 0x23, 0x2c, 0x0e, 0x37, 0x7f, 0xcd, 0x80, 0x49,
+	0xbd, 0x95, 0xe4, 0x06, 0x8c, 0x8a, 0x3b, 0x40, 0x03, 0xef, 0x00, 0x59, 0x6b, 0x46, 0xf9, 0xed,
+	0x9f, 0x76, 0xe7, 0x27, 0xb0, 0x98, 0xe8, 0x17, 0x1c, 0xb0, 0x2d, 0x42, 0xf4, 0x8b, 0x49, 0x6a,
+	0xc9, 0x32, 0x66, 0x72, 0x59, 0x34, 0xec, 0xb5, 0x22, 0xd5, 0xe4, 0x0a, 0x10, 0x62, 0x89, 0x12,
+	0xf3, 0xd0, 0x00, 0x68, 0x34, 0xee, 0xdd, 0xa7, 0x07, 0xeb, 0x8e, 0x17, 0xa0, 0xd9, 0x8a, 0xab,
+	0xf1, 0xbe, 0x18, 0xad, 0xb2, 0x30, 0x5b, 0xf9, 0xca, 0xdd, 0xa7, 0x07, 0x9a, 0xd9, 0x2a, 0x51,
+	0x71, 0xc9, 0x07, 0xde, 0x23, 0x27, 0xa2, 0x8c, 0x30, 0x87, 0x84, 0x7c, 0xc9, 0x73, 0x68, 0x8a,
+	0x52, 0x41, 0x26, 0xdf, 0x80, 0xc9, 0xe4, 0x17, 0x3a, 0x1e, 0xe4, 0xd1, 0xa6, 0x93, 0x33, 0x42,
+	0x2f, 0xac, 0xbf, 0x74, 0x74, 0x58, 0xbd, 0xa4, 0x70, 0xb5, 0x19, 0x96, 0xc2, 0x3a, 0xc5, 0xcc,
+	0xfc, 0x03, 0x03, 0x60, 0x63, 0xa5, 0x21, 0x1b, 0xf8, 0x1a, 0x14, 0xe2, 0xd3, 0xa0, 0x32, 0xb7,
+	0x8d, 0x53, 0xc6, 0x1f, 0x96, 0x93, 0x97, 0x21, 0x9f, 0xb4, 0x64, 0xfa, 0xe8, 0xb0, 0x3a, 0xa1,
+	0xb7, 0x80, 0x95, 0x92, 0xbb, 0x30, 0x36, 0x54, 0x9d, 0x71, 0x76, 0x66, 0xd4, 0x55, 0x52, 0xe3,
+	0x28, 0x7c, 0xb8, 0xbd, 0xf1, 0xfc, 0x8e, 0xc2, 0xb7, 0x72, 0x30, 0xc5, 0xfa, 0xb5, 0xd6, 0x8b,
+	0xf6, 0xfc, 0xc0, 0x8b, 0x0e, 0x9e, 0x59, 0xab, 0xf8, 0x5d, 0x4d, 0x21, 0xba, 0x24, 0xc5, 0x96,
+	0xda, 0xb6, 0xa1, 0x8c, 0xe3, 0xbf, 0x18, 0x83, 0x99, 0x0c, 0x2a, 0xf2, 0x86, 0xf0, 0xbe, 0x49,
+	0xce, 0x8c, 0xd0, 0xbb, 0xe6, 0x47, 0x87, 0xd5, 0xb2, 0x44, 0xdf, 0x48, 0xbc, 0x6d, 0xe6, 0x61,
+	0x5c, 0x98, 0x3e, 0xab, 0x89, 0x46, 0x8d, 0x6e, 0x1b, 0xf2, 0x4c, 0x0c, 0x45, 0x93, 0x8a, 0x44,
+	0x6a, 0x50, 0x5e, 0xd8, 0xa3, 0xcd, 0x7d, 0xaf, 0xb3, 0x7b, 0x9f, 0x1e, 0x70, 0x7d, 0xa9, 0x5c,
+	0x7f, 0x91, 0x59, 0x5a, 0x4d, 0x01, 0x67, 0x43, 0xaa, 0x1b, 0x71, 0x1a, 0x09, 0x79, 0x1f, 0xc6,
+	0x1b, 0xde, 0x6e, 0x47, 0x72, 0x28, 0x20, 0x87, 0xcb, 0x47, 0x87, 0xd5, 0xf3, 0x21, 0x07, 0xf7,
+	0x33, 0x50, 0x09, 0xc8, 0x35, 0x18, 0xb1, 0xfc, 0x16, 0xe5, 0xdb, 0xb0, 0xf0, 0xe7, 0x08, 0x18,
+	0x40, 0x3d, 0x9b, 0x46, 0x0c, 0x72, 0x0f, 0xc6, 0xd8, 0x3f, 0x0f, 0x9c, 0xee, 0xec, 0x28, 0xca,
+	0x6d, 0x12, 0x2b, 0xf8, 0x08, 0xed, 0x7a, 0x9d, 0x5d, 0x55, 0xc7, 0x6f, 0x51, 0xbb, 0xed, 0x74,
+	0xb5, 0x7d, 0x91, 0x23, 0x92, 0x2d, 0x18, 0x4f, 0x04, 0x41, 0x38, 0x3b, 0xa6, 0xdd, 0x05, 0x25,
+	0x25, 0xf5, 0xcf, 0x09, 0x66, 0x17, 0xa2, 0x56, 0x88, 0x73, 0xbb, 0xcb, 0xf0, 0xf5, 0xc6, 0x28,
+	0x8c, 0x34, 0x1b, 0xa4, 0x38, 0xd8, 0x06, 0x31, 0x4e, 0xb4, 0x41, 0x5c, 0x00, 0xd1, 0x49, 0xb5,
+	0xd6, 0xae, 0x70, 0xbf, 0xba, 0x36, 0x78, 0x82, 0xdd, 0x48, 0x90, 0x71, 0x4d, 0xf2, 0x93, 0x29,
+	0xd1, 0xff, 0x4e, 0x6b, 0x57, 0x3b, 0x99, 0x8a, 0x51, 0x59, 0x37, 0x24, 0xa2, 0x46, 0x5a, 0xe0,
+	0xb2, 0x1b, 0x92, 0x92, 0xa4, 0x1b, 0x3e, 0x7e, 0x1c, 0x0d, 0xea, 0x06, 0x85, 0x11, 0x59, 0x05,
+	0xa8, 0x35, 0x23, 0xef, 0x11, 0xc5, 0x29, 0x31, 0xae, 0x75, 0xc4, 0x42, 0xed, 0x3e, 0x3d, 0x68,
+	0xd0, 0x28, 0xf6, 0x6c, 0x38, 0xe7, 0x20, 0x6a, 0x6a, 0x9a, 0x58, 0x0a, 0x07, 0xd2, 0x85, 0x73,
+	0x35, 0xd7, 0xf5, 0xb8, 0x4b, 0xde, 0x46, 0xc0, 0xe6, 0xaf, 0x8b, 0xac, 0xcb, 0xd9, 0xac, 0xaf,
+	0x09, 0xd6, 0x9f, 0x73, 0x62, 0x2a, 0x3b, 0xe2, 0x64, 0xe9, 0xcf, 0x64, 0x33, 0x36, 0xd7, 0x60,
+	0x52, 0xef, 0x52, 0xdd, 0x19, 0xad, 0x0c, 0x45, 0xab, 0x51, 0xb3, 0x1b, 0xf7, 0x6a, 0x37, 0x2b,
+	0x06, 0xa9, 0x40, 0x59, 0xfc, 0x9a, 0xb7, 0xe7, 0xdf, 0xba, 0x5d, 0xc9, 0x69, 0x90, 0xb7, 0x6e,
+	0xce, 0x57, 0xf2, 0xe6, 0x1f, 0x19, 0x50, 0x94, 0xf5, 0x23, 0xb7, 0x21, 0xdf, 0x68, 0xdc, 0x4b,
+	0x5d, 0x41, 0x26, 0x5b, 0x2f, 0xdf, 0x64, 0xc2, 0x70, 0x4f, 0xdd, 0x64, 0x1a, 0x8d, 0x7b, 0x8c,
+	0x6e, 0x63, 0xa5, 0x21, 0x94, 0x96, 0x8c, 0xe9, 0x3a, 0x3d, 0xe0, 0x5e, 0xe6, 0x36, 0xe4, 0x3f,
+	0xdc, 0xde, 0x10, 0xd6, 0x50, 0xc6, 0xf8, 0x22, 0xdd, 0xc7, 0x8f, 0xd5, 0xad, 0x8f, 0x11, 0x98,
+	0x16, 0x8c, 0x2b, 0x4b, 0x8b, 0x2b, 0x11, 0x6d, 0x3f, 0x76, 0xd3, 0x12, 0x4a, 0x04, 0x83, 0x58,
+	0xa2, 0x84, 0xe9, 0x3c, 0x2b, 0x7e, 0xd3, 0x69, 0x09, 0x6d, 0x04, 0x75, 0x9e, 0x16, 0x03, 0x58,
+	0x1c, 0x6e, 0xfe, 0xb1, 0x01, 0x95, 0xf5, 0xc0, 0x7f, 0xe4, 0x31, 0x09, 0xbc, 0xe1, 0xef, 0xd3,
+	0xce, 0xd6, 0x4d, 0xf2, 0xa6, 0x14, 0x02, 0x5c, 0x85, 0xbb, 0xc0, 0xa8, 0x50, 0x08, 0xfc, 0xe8,
+	0xb0, 0x0a, 0x8d, 0x83, 0x30, 0xa2, 0x6d, 0x56, 0x2e, 0x05, 0x81, 0xe2, 0xed, 0x96, 0x1b, 0xde,
+	0x83, 0xe6, 0x04, 0x6f, 0xb7, 0x2a, 0x8c, 0x60, 0x75, 0x14, 0x27, 0x86, 0x91, 0x88, 0x01, 0x2c,
+	0x0e, 0x57, 0x04, 0xf6, 0x77, 0x72, 0x7d, 0x6d, 0x98, 0x7f, 0xae, 0xbc, 0x50, 0xf4, 0xc6, 0x0d,
+	0xb5, 0x89, 0x7d, 0x15, 0xce, 0xa6, 0xbb, 0x04, 0xcf, 0x45, 0x6a, 0x30, 0xa5, 0xc3, 0xe5, 0x11,
+	0xc9, 0x85, 0xcc, 0x6f, 0x6d, 0xcd, 0x5b, 0x69, 0x7c, 0xf3, 0x07, 0x06, 0x94, 0xf0, 0x5f, 0xab,
+	0xd7, 0xa2, 0x4c, 0xb3, 0xa9, 0x6d, 0x37, 0xc4, 0x85, 0x94, 0x7a, 0x69, 0xe4, 0x3c, 0x0e, 0x6d,
+	0x71, 0x7b, 0xa5, 0xc9, 0x91, 0x18, 0x59, 0x90, 0xf2, 0xeb, 0xb7, 0x50, 0xcc, 0xd0, 0x98, 0x94,
+	0xdf, 0xd3, 0x85, 0x29, 0x52, 0x81, 0xcc, 0xc6, 0x8f, 0xfd, 0xf2, 0x5b, 0xf2, 0x68, 0x18, 0xc7,
+	0x0f, 0xe9, 0x7c, 0xed, 0x9a, 0x43, 0xa2, 0x91, 0x37, 0x61, 0x94, 0x7d, 0xda, 0x92, 0x97, 0x18,
+	0x68, 0x55, 0x60, 0x1d, 0x03, 0xed, 0x36, 0x90, 0x23, 0x99, 0xff, 0x2a, 0x97, 0xee, 0x40, 0xa1,
+	0x05, 0x9c, 0x72, 0x6d, 0xbc, 0x03, 0x23, 0xb5, 0x56, 0xcb, 0x7f, 0x2c, 0xa4, 0x84, 0x3c, 0xa6,
+	0x89, 0xfb, 0x8f, 0xef, 0xb0, 0x0e, 0x43, 0xd1, 0x6e, 0x7f, 0x19, 0x80, 0x2c, 0x40, 0xa9, 0xb6,
+	0xdd, 0x58, 0x5e, 0x5e, 0xdc, 0xd8, 0x58, 0x11, 0x4e, 0xc6, 0xaf, 0xca, 0xfe, 0xf1, 0x3c, 0xd7,
+	0x8e, 0xa2, 0xd6, 0x00, 0x1f, 0xc4, 0x84, 0x8e, 0xbc, 0x07, 0xf0, 0xa1, 0xef, 0x75, 0x1e, 0xd0,
+	0x68, 0xcf, 0x77, 0x45, 0xe3, 0x99, 0x4a, 0x31, 0xfe, 0xb1, 0xef, 0x75, 0xec, 0x36, 0x82, 0x59,
+	0xdd, 0x13, 0x24, 0x4b, 0xf9, 0x9f, 0xf5, 0x74, 0xdd, 0x8f, 0x50, 0x87, 0x19, 0x49, 0x7a, 0x7a,
+	0xc7, 0x8f, 0xd2, 0x77, 0x2c, 0x12, 0xcd, 0xfc, 0xf5, 0x1c, 0x4c, 0x72, 0x4b, 0x95, 0x4f, 0x98,
+	0x67, 0x76, 0x31, 0xbe, 0xa3, 0x2d, 0xc6, 0x8b, 0x72, 0x63, 0x50, 0x9a, 0x36, 0xd4, 0x52, 0xdc,
+	0x03, 0xd2, 0x4f, 0x43, 0x2c, 0x79, 0x9e, 0x32, 0xcc, 0x2a, 0xbc, 0x99, 0xdc, 0x1d, 0x87, 0x48,
+	0x64, 0xa3, 0x28, 0x0c, 0x2d, 0x8d, 0x87, 0xf9, 0x6b, 0x39, 0x98, 0x50, 0xf4, 0xc9, 0x67, 0xb6,
+	0xe3, 0xbf, 0xa4, 0x75, 0xbc, 0xbc, 0x83, 0x50, 0x5a, 0x36, 0x54, 0xbf, 0xf7, 0x60, 0xba, 0x8f,
+	0x24, 0xad, 0x96, 0x1b, 0xc3, 0xa8, 0xe5, 0x6f, 0xf4, 0x5f, 0x6e, 0x73, 0x87, 0xe4, 0xf8, 0x72,
+	0x5b, 0xbd, 0x4d, 0xff, 0x56, 0x0e, 0xce, 0x8a, 0x5f, 0xb5, 0x9e, 0xeb, 0x45, 0x0b, 0x7e, 0xe7,
+	0xa1, 0xb7, 0xfb, 0xcc, 0x8e, 0x45, 0x4d, 0x1b, 0x8b, 0xaa, 0x3e, 0x16, 0x4a, 0x03, 0x07, 0x0f,
+	0x89, 0xf9, 0x6f, 0x8a, 0x30, 0x3b, 0x88, 0x80, 0x99, 0xfd, 0x8a, 0x55, 0x85, 0x66, 0x7f, 0xca,
+	0x62, 0xe5, 0xf6, 0x54, 0xe2, 0xcc, 0x91, 0x1b, 0xc2, 0x99, 0x63, 0x05, 0x2a, 0xf8, 0xa9, 0x06,
+	0x0d, 0x59, 0x27, 0x84, 0x89, 0x37, 0xe4, 0x95, 0xa3, 0xc3, 0xea, 0x65, 0x87, 0x95, 0xd9, 0xa1,
+	0x28, 0xb4, 0x7b, 0x81, 0xa7, 0xf0, 0xe8, 0xa3, 0x24, 0x7f, 0x60, 0xc0, 0x24, 0x02, 0x97, 0x1e,
+	0xd1, 0x4e, 0x84, 0xcc, 0x0a, 0xe2, 0x92, 0x26, 0x0e, 0x3a, 0x69, 0x44, 0x81, 0xd7, 0xd9, 0xc5,
+	0x83, 0xa4, 0xb0, 0xbe, 0xc3, 0x7a, 0xe1, 0xcf, 0x0f, 0xab, 0xef, 0x7e, 0x92, 0x40, 0x16, 0xc1,
+	0x2a, 0x64, 0x86, 0x3c, 0xaf, 0x28, 0xc5, 0xcf, 0xa6, 0xaa, 0x99, 0xaa, 0x11, 0xf9, 0x29, 0xb8,
+	0xb0, 0xd4, 0x71, 0x76, 0x5a, 0x74, 0xc1, 0xef, 0x44, 0x5e, 0xa7, 0xe7, 0xf7, 0xc2, 0xba, 0xd3,
+	0xdc, 0xef, 0x75, 0x43, 0x71, 0xd8, 0x89, 0x2d, 0x6f, 0xc6, 0x85, 0xf6, 0x0e, 0x2f, 0x55, 0x58,
+	0x0e, 0x62, 0x40, 0xee, 0xc1, 0x34, 0x2f, 0xaa, 0xf5, 0x22, 0xbf, 0xd1, 0x74, 0x5a, 0x5e, 0x67,
+	0x17, 0xcf, 0x40, 0x8b, 0xf5, 0x4b, 0xcc, 0xb6, 0x74, 0x7a, 0x91, 0x6f, 0x87, 0x1c, 0xae, 0xf0,
+	0xeb, 0x27, 0x22, 0xcb, 0x30, 0x65, 0x51, 0xc7, 0x7d, 0xe0, 0x3c, 0x59, 0x70, 0xba, 0x4e, 0xd3,
+	0x8b, 0x0e, 0xd0, 0x32, 0xcb, 0xd7, 0xab, 0x47, 0x87, 0xd5, 0x17, 0x02, 0xea, 0xb8, 0x76, 0xdb,
+	0x79, 0x62, 0x37, 0x45, 0xa1, 0xc2, 0x2c, 0x4d, 0x17, 0xb3, 0xf2, 0x3a, 0x31, 0xab, 0x52, 0x9a,
+	0x95, 0xd7, 0x19, 0xcc, 0x2a, 0xa1, 0x93, 0xac, 0x36, 0x9c, 0x60, 0x97, 0x46, 0xfc, 0x90, 0x10,
+	0xae, 0x18, 0x57, 0x0d, 0x85, 0x55, 0x84, 0x65, 0x36, 0x1e, 0x18, 0xa6, 0x59, 0x29, 0x74, 0x6c,
+	0xe6, 0x6d, 0x07, 0x5e, 0x44, 0xd5, 0x16, 0x8e, 0x63, 0xb5, 0xb0, 0xff, 0xf1, 0x98, 0x74, 0x50,
+	0x13, 0xfb, 0x28, 0x13, 0x6e, 0x4a, 0x23, 0xcb, 0x7d, 0xdc, 0xb2, 0x5b, 0xd9, 0x47, 0x19, 0x73,
+	0x53, 0xdb, 0x39, 0x81, 0xed, 0x54, 0xb8, 0x0d, 0x68, 0x68, 0x1f, 0x25, 0x59, 0x65, 0x9d, 0x16,
+	0xd1, 0x0e, 0x9b, 0xd1, 0xe2, 0x90, 0x74, 0x12, 0xab, 0xf6, 0x8a, 0xb0, 0xa9, 0x2b, 0x81, 0x2c,
+	0xb6, 0x33, 0x8e, 0x4c, 0xd3, 0xc4, 0x1f, 0x16, 0x8a, 0x23, 0x95, 0x51, 0xab, 0xc2, 0xa7, 0x7c,
+	0xc4, 0x26, 0x0e, 0xca, 0x62, 0xf3, 0x77, 0x72, 0x70, 0x51, 0x8a, 0x63, 0x1a, 0x3d, 0xf6, 0x83,
+	0x7d, 0xaf, 0xb3, 0xfb, 0x8c, 0x4b, 0xd5, 0x3b, 0x9a, 0x54, 0x7d, 0x25, 0xb5, 0xc3, 0xa5, 0x5a,
+	0x79, 0x8c, 0x68, 0xfd, 0xb3, 0x11, 0x78, 0xf1, 0x58, 0x2a, 0xf2, 0x11, 0xdb, 0x05, 0x3d, 0xda,
+	0x89, 0x96, 0xdd, 0x16, 0x65, 0x66, 0x98, 0xdf, 0x8b, 0xc4, 0x61, 0xf6, 0xcb, 0x47, 0x87, 0xd5,
+	0x19, 0x1e, 0x8b, 0x61, 0x7b, 0x6e, 0x8b, 0xda, 0x11, 0x2f, 0xd6, 0x86, 0xa9, 0x9f, 0x9a, 0xb1,
+	0x8c, 0x23, 0xc3, 0x96, 0x3b, 0x11, 0x0d, 0x1e, 0x39, 0xdc, 0x25, 0x5d, 0xb0, 0xdc, 0xa7, 0xb4,
+	0x6b, 0x3b, 0xac, 0xd4, 0xf6, 0x44, 0xb1, 0xce, 0xb2, 0x8f, 0x9a, 0xdc, 0x51, 0x58, 0x2e, 0x30,
+	0xe3, 0xe0, 0x81, 0xf3, 0x44, 0x68, 0xbc, 0x78, 0xbe, 0xaa, 0xb0, 0xe4, 0xfe, 0x70, 0x6d, 0xe7,
+	0x89, 0xd5, 0x4f, 0x42, 0xbe, 0x01, 0xe7, 0x84, 0xe0, 0x66, 0x42, 0x2c, 0xf0, 0x5b, 0xb2, 0xc5,
+	0x05, 0xe4, 0xf5, 0xfa, 0xd1, 0x61, 0xf5, 0x82, 0x10, 0xfb, 0x76, 0x93, 0x63, 0x64, 0xb6, 0x3a,
+	0x9b, 0x0b, 0xd9, 0x60, 0x1b, 0x59, 0xaa, 0x3b, 0x1e, 0xd0, 0x30, 0x74, 0x76, 0xa5, 0x76, 0xcc,
+	0x6f, 0x94, 0x94, 0xce, 0xb4, 0xdb, 0xbc, 0xdc, 0x1a, 0x48, 0x49, 0xee, 0xc1, 0xe4, 0x36, 0xdd,
+	0x51, 0xc7, 0x67, 0x34, 0x5e, 0xe2, 0x95, 0xc7, 0x74, 0x67, 0xf0, 0xe0, 0xa4, 0xe8, 0x88, 0x07,
+	0xd3, 0xeb, 0x81, 0xff, 0xe4, 0x80, 0x99, 0x7a, 0xb4, 0x43, 0x03, 0x74, 0xc4, 0x1a, 0xc3, 0xe3,
+	0xaa, 0xd9, 0x44, 0xb3, 0xd4, 0xcb, 0xeb, 0x9f, 0x3b, 0x3a, 0xac, 0xbe, 0xd8, 0x65, 0x60, 0xbb,
+	0x25, 0xe0, 0x76, 0x2a, 0x30, 0xab, 0x9f, 0x2b, 0xf9, 0x19, 0x98, 0xb2, 0xfc, 0x5e, 0xe4, 0x75,
+	0x76, 0x1b, 0x51, 0xe0, 0x44, 0x74, 0x97, 0x0b, 0xf2, 0xc4, 0xe3, 0x2b, 0x55, 0xca, 0x0f, 0xa6,
+	0x03, 0x0e, 0xb4, 0x43, 0x01, 0xd5, 0x24, 0xa9, 0x4e, 0x60, 0xfe, 0x56, 0x0e, 0x66, 0xc5, 0x30,
+	0x58, 0xb4, 0xe9, 0x07, 0xee, 0xb3, 0xbf, 0xec, 0x97, 0xb4, 0x65, 0xff, 0x72, 0xec, 0xa3, 0x94,
+	0xd5, 0xc8, 0x63, 0x56, 0xfd, 0x3f, 0x33, 0xe0, 0xf2, 0x71, 0x44, 0xac, 0x77, 0x62, 0x1f, 0xbc,
+	0x52, 0x9f, 0xaf, 0x5d, 0x17, 0x66, 0x70, 0x3c, 0xf1, 0xe0, 0x38, 0xbc, 0xe7, 0x87, 0x11, 0x9e,
+	0xde, 0xe5, 0x34, 0x47, 0x82, 0xba, 0xef, 0xb7, 0x50, 0xce, 0xd7, 0xdf, 0x60, 0xe2, 0xfc, 0xcf,
+	0x0f, 0xab, 0xc0, 0x40, 0x6b, 0x78, 0x19, 0xc9, 0xf6, 0x7c, 0x3e, 0x63, 0xf0, 0x5c, 0x3a, 0xb4,
+	0xd1, 0xfb, 0x63, 0x9f, 0x1e, 0x84, 0x56, 0x16, 0x6b, 0x3c, 0xa1, 0xa9, 0xf5, 0xa2, 0xbd, 0xf5,
+	0x80, 0x3e, 0xa4, 0x01, 0xed, 0x34, 0xe9, 0x73, 0x76, 0x42, 0xa3, 0x37, 0x6e, 0x28, 0xf3, 0xe4,
+	0xff, 0x8d, 0xc2, 0xd9, 0x2c, 0x32, 0xd6, 0x2f, 0x8a, 0x46, 0x9c, 0x8e, 0xe2, 0xfd, 0x5b, 0x06,
+	0x94, 0x1b, 0xb4, 0xe9, 0x77, 0xdc, 0x3b, 0x4e, 0x33, 0xf2, 0xa5, 0x4b, 0x86, 0xcd, 0x25, 0x1b,
+	0x83, 0xdb, 0x0f, 0xb1, 0x40, 0x3b, 0x19, 0xf8, 0xf2, 0x70, 0x8a, 0x68, 0xd3, 0x47, 0xa7, 0xd5,
+	0x88, 0xcd, 0xc9, 0xe4, 0x13, 0x78, 0xab, 0xa1, 0x7d, 0x94, 0xd4, 0x61, 0x62, 0xc1, 0xef, 0x74,
+	0x28, 0xfb, 0xa1, 0xb8, 0x60, 0x5e, 0x3e, 0x3a, 0xac, 0xce, 0x36, 0x65, 0x41, 0xfa, 0x84, 0x40,
+	0x27, 0x21, 0xb7, 0x20, 0xbf, 0x39, 0x7f, 0x47, 0x8c, 0x81, 0x74, 0x56, 0xdb, 0x9c, 0xbf, 0x83,
+	0xb6, 0x2e, 0xd3, 0x1f, 0x26, 0x7a, 0xf3, 0x0f, 0xd5, 0x33, 0xd0, 0xcd, 0xf9, 0x3b, 0x64, 0x0d,
+	0xa6, 0x2d, 0xfa, 0xb3, 0x3d, 0x2f, 0xa0, 0x62, 0x01, 0x3c, 0xb8, 0x53, 0xc3, 0xb1, 0x28, 0x72,
+	0x39, 0x16, 0xf0, 0x42, 0xa9, 0xdb, 0xdb, 0xed, 0x87, 0x6a, 0xe4, 0x5a, 0x3f, 0x2d, 0xf9, 0x45,
+	0x38, 0xb7, 0xe8, 0x85, 0xa2, 0xce, 0xfc, 0xf0, 0xd1, 0xc5, 0x7b, 0xc8, 0xd1, 0x01, 0xcb, 0xe1,
+	0x27, 0x32, 0x97, 0xc3, 0xe7, 0xdc, 0x98, 0x89, 0xcd, 0x4f, 0x36, 0xdd, 0xb4, 0xef, 0x6a, 0xf6,
+	0x77, 0xc8, 0xc7, 0x30, 0x89, 0xa7, 0x3d, 0x78, 0x1e, 0x8b, 0xee, 0xcc, 0x63, 0x03, 0xbe, 0xfc,
+	0x85, 0xcc, 0x2f, 0x5f, 0xc2, 0xc3, 0x23, 0x1b, 0x4f, 0x75, 0xd1, 0xf5, 0x59, 0xb3, 0x11, 0x34,
+	0xce, 0xe4, 0x43, 0x98, 0x12, 0x9b, 0xce, 0xda, 0xc3, 0x8d, 0x3d, 0xba, 0xe8, 0x1c, 0x08, 0x27,
+	0x04, 0xd4, 0xff, 0xc4, 0x4e, 0x65, 0xfb, 0x0f, 0xed, 0x68, 0x8f, 0xda, 0xae, 0xa3, 0x89, 0xe7,
+	0x14, 0x21, 0xf9, 0x79, 0x18, 0x5f, 0xf1, 0xf1, 0xe2, 0x09, 0x45, 0x4d, 0x09, 0xf9, 0x7c, 0x15,
+	0x23, 0x57, 0x39, 0x38, 0xb5, 0x89, 0xfc, 0xe8, 0xb0, 0xfa, 0xce, 0x69, 0x67, 0xa1, 0xf2, 0x01,
+	0x4b, 0xfd, 0x1a, 0x59, 0x80, 0xe2, 0x36, 0xdd, 0x61, 0xad, 0x4d, 0x47, 0x5d, 0x49, 0x30, 0x97,
+	0x17, 0x8f, 0xc5, 0x2f, 0xf5, 0x56, 0x47, 0x62, 0x98, 0xff, 0xda, 0xc0, 0x19, 0x48, 0xae, 0xa3,
+	0x23, 0x58, 0xec, 0x0d, 0x8e, 0x96, 0xa5, 0xd3, 0xed, 0xea, 0xfe, 0xdc, 0x1c, 0x85, 0x99, 0xa1,
+	0x77, 0x9c, 0x26, 0x8d, 0xe4, 0x79, 0x25, 0x22, 0x3f, 0x44, 0x88, 0x6a, 0x86, 0x72, 0x1c, 0xf2,
+	0x15, 0x38, 0xbb, 0x48, 0x1f, 0x79, 0x4d, 0x5a, 0x8b, 0x22, 0x1a, 0xf2, 0xd6, 0x2e, 0xd4, 0xf8,
+	0xc5, 0x5e, 0xa9, 0xfe, 0xca, 0xd1, 0x61, 0xf5, 0x8a, 0x8b, 0xe5, 0xb6, 0x93, 0x20, 0xd8, 0x4d,
+	0x47, 0xe5, 0x95, 0xc9, 0xc1, 0xfc, 0x5f, 0x46, 0xd2, 0x03, 0xe4, 0x75, 0x28, 0x58, 0xeb, 0x71,
+	0xfd, 0xf9, 0x9d, 0x5d, 0xaa, 0xfa, 0x88, 0x40, 0xbe, 0x06, 0xe7, 0x14, 0x3e, 0x38, 0x39, 0xa8,
+	0xcb, 0x2a, 0xc4, 0x1b, 0xf3, 0x2a, 0x5e, 0xd2, 0x28, 0x35, 0x71, 0x38, 0x46, 0xaa, 0x46, 0xd9,
+	0x3c, 0x58, 0x63, 0x95, 0x82, 0x45, 0xda, 0xf1, 0x38, 0x6f, 0xa5, 0xb1, 0x2a, 0x6f, 0x17, 0x11,
+	0xd2, 0x8d, 0xcd, 0xe2, 0xf0, 0x61, 0xa1, 0x58, 0xa8, 0x8c, 0x98, 0x7f, 0x65, 0x28, 0x29, 0x00,
+	0x9e, 0xd1, 0xdd, 0xe3, 0xb6, 0xb6, 0x7b, 0x9c, 0x15, 0xa4, 0x71, 0xab, 0x58, 0x59, 0xe6, 0x8e,
+	0x3f, 0x05, 0x13, 0x1a, 0x12, 0xba, 0xbc, 0x6e, 0x86, 0x34, 0xe0, 0xe7, 0x83, 0xcf, 0x97, 0xcb,
+	0x6b, 0xdc, 0xae, 0xa1, 0x3c, 0x19, 0xff, 0xc2, 0x80, 0xa9, 0x14, 0x05, 0xeb, 0x0d, 0x06, 0x52,
+	0x7b, 0xa3, 0x17, 0xd2, 0xc0, 0x42, 0x28, 0x77, 0x90, 0x5b, 0xd1, 0x1d, 0xe4, 0x5a, 0x16, 0x83,
+	0x91, 0x2f, 0xc3, 0xc8, 0x26, 0x6a, 0xf3, 0xba, 0x8f, 0x45, 0xcc, 0x1f, 0x0b, 0xf9, 0x0a, 0xeb,
+	0xb1, 0x7f, 0x55, 0x01, 0x81, 0x65, 0xa4, 0x01, 0x63, 0x0b, 0x01, 0xc5, 0x60, 0xff, 0xc2, 0xf0,
+	0x97, 0x61, 0x4d, 0x4e, 0x92, 0xbe, 0x0c, 0x13, 0x9c, 0xcc, 0xdf, 0xcc, 0x01, 0x49, 0xda, 0x48,
+	0x9b, 0x01, 0x8d, 0xc2, 0x67, 0x76, 0xd0, 0x3f, 0xd0, 0x06, 0xfd, 0xc5, 0xbe, 0x41, 0xe7, 0xcd,
+	0x1b, 0x6a, 0xec, 0xff, 0xd8, 0x80, 0xf3, 0xd9, 0x84, 0xe4, 0x65, 0x18, 0x5d, 0xdb, 0x58, 0x97,
+	0x6e, 0x3a, 0xa2, 0x29, 0x7e, 0x17, 0xb5, 0x54, 0x4b, 0x14, 0x91, 0x37, 0x61, 0xf4, 0x23, 0x6b,
+	0x81, 0x6d, 0x5f, 0x4a, 0xd4, 0xc9, 0xcf, 0x06, 0x76, 0x53, 0x37, 0x7f, 0x04, 0x92, 0x3a, 0xb6,
+	0xf9, 0xa7, 0x36, 0xb6, 0xdf, 0xca, 0xc1, 0x54, 0xad, 0xd9, 0xa4, 0x61, 0xc8, 0x94, 0x13, 0x1a,
+	0x46, 0xcf, 0xec, 0xc0, 0x66, 0x3b, 0xe0, 0x68, 0x6d, 0x1b, 0x6a, 0x54, 0xff, 0xc4, 0x80, 0x73,
+	0x92, 0xea, 0x91, 0x47, 0x1f, 0x6f, 0xec, 0x05, 0x34, 0xdc, 0xf3, 0x5b, 0xee, 0xb0, 0xf1, 0x53,
+	0xb8, 0x4b, 0x7b, 0xad, 0x88, 0x06, 0xea, 0x61, 0xf1, 0x43, 0x84, 0x68, 0xbb, 0x34, 0x42, 0xc8,
+	0x1c, 0x8c, 0xd5, 0xba, 0xdd, 0xc0, 0x7f, 0xc4, 0x97, 0xfd, 0x84, 0xb8, 0x1b, 0xe4, 0x20, 0xed,
+	0x2e, 0x91, 0x83, 0x58, 0x35, 0x16, 0x69, 0x87, 0x7b, 0x17, 0x4f, 0xf0, 0x6a, 0xb8, 0xb4, 0xa3,
+	0x6a, 0x4b, 0x58, 0x6e, 0x7e, 0xb3, 0x00, 0x65, 0xb5, 0x21, 0xc4, 0x84, 0x51, 0xee, 0x2a, 0xa2,
+	0x5e, 0xd9, 0x3b, 0x08, 0xb1, 0x44, 0x49, 0xe2, 0x81, 0x93, 0x3b, 0xd1, 0x03, 0x67, 0x1b, 0x26,
+	0xd6, 0x03, 0xbf, 0xeb, 0x87, 0xd4, 0xe5, 0xf9, 0x5a, 0xb8, 0xd4, 0x9a, 0x89, 0xdd, 0x52, 0x79,
+	0x9f, 0xb3, 0x22, 0xae, 0x9a, 0x77, 0x05, 0xb6, 0x9d, 0xce, 0xe6, 0xa2, 0xf3, 0xe1, 0x87, 0xed,
+	0x4e, 0x28, 0x5c, 0xf7, 0xe3, 0xc3, 0x76, 0x06, 0xd1, 0x0f, 0xdb, 0x19, 0x44, 0x5d, 0x16, 0x23,
+	0x4f, 0x6b, 0x59, 0x90, 0xdf, 0x34, 0x60, 0xbc, 0xd6, 0xe9, 0x08, 0x0f, 0x1c, 0x19, 0xf4, 0x7c,
+	0x2e, 0x39, 0x70, 0xe7, 0x2e, 0x9a, 0xfc, 0xbc, 0xfd, 0xeb, 0xe2, 0xbc, 0xfd, 0x9d, 0x4f, 0x74,
+	0xde, 0xbe, 0x11, 0x38, 0x5e, 0x14, 0xe2, 0xc5, 0x6a, 0xf2, 0x41, 0xd5, 0x0d, 0x57, 0xa9, 0x07,
+	0x79, 0x07, 0x2a, 0xf1, 0x7c, 0x5c, 0xee, 0xb8, 0xf4, 0x09, 0xe5, 0x0e, 0x4b, 0x13, 0x3c, 0x32,
+	0x4f, 0xbb, 0x48, 0x48, 0x23, 0x9a, 0xdf, 0x32, 0xe0, 0xbc, 0x3a, 0x21, 0x1a, 0xbd, 0x9d, 0xb6,
+	0x87, 0xa6, 0x08, 0xb9, 0x01, 0x25, 0x31, 0x5e, 0xb1, 0x22, 0xd7, 0x9f, 0xe4, 0x27, 0x41, 0x21,
+	0x4b, 0x6c, 0x88, 0x18, 0x0f, 0x61, 0xb7, 0xcf, 0xa4, 0x96, 0x1b, 0x2b, 0xaa, 0xcf, 0x8a, 0xce,
+	0xae, 0x04, 0xf8, 0x5b, 0x1f, 0x3b, 0x06, 0x31, 0xdf, 0x87, 0x69, 0xbd, 0x96, 0x0d, 0x8a, 0xe1,
+	0x60, 0xb2, 0x69, 0x46, 0x76, 0xd3, 0x64, 0xb9, 0xb9, 0x0d, 0xa4, 0x8f, 0x3e, 0xc4, 0x4b, 0x23,
+	0x1a, 0xc9, 0x4b, 0x4d, 0x79, 0xf4, 0xd4, 0x87, 0x18, 0xa7, 0xbb, 0x1a, 0x57, 0xbb, 0x1b, 0x49,
+	0xcd, 0xbf, 0x2e, 0xc1, 0x4c, 0x86, 0xe8, 0x38, 0x61, 0x6b, 0xaf, 0xea, 0x8b, 0xa7, 0x14, 0xdf,
+	0xce, 0xcb, 0x25, 0xf3, 0xbe, 0x4c, 0x6d, 0x74, 0xcc, 0x52, 0x39, 0x2e, 0xdf, 0xd1, 0x67, 0xb1,
+	0xbd, 0xab, 0x0e, 0x34, 0x23, 0x4f, 0xcd, 0x81, 0xa6, 0x0e, 0x13, 0xa2, 0x55, 0x62, 0x29, 0x8f,
+	0x26, 0x26, 0x7a, 0xc0, 0x0b, 0xec, 0xbe, 0x25, 0xad, 0x93, 0x70, 0x1e, 0xa1, 0xdf, 0x7a, 0x44,
+	0x05, 0x8f, 0x31, 0x95, 0x07, 0x16, 0x64, 0xf2, 0x50, 0x48, 0xc8, 0x3f, 0x35, 0x80, 0x08, 0x88,
+	0xba, 0x9e, 0x8b, 0xc7, 0xad, 0x67, 0xf7, 0xe9, 0xac, 0xe7, 0x17, 0x65, 0x1d, 0xb3, 0xd7, 0x75,
+	0x46, 0xb5, 0xc8, 0x3f, 0x36, 0x60, 0x9a, 0x7b, 0x71, 0xa8, 0x95, 0x2d, 0x1d, 0x57, 0xd9, 0xe6,
+	0xd3, 0xa9, 0xec, 0xe5, 0x10, 0x3f, 0x3b, 0xa0, 0xae, 0xfd, 0x95, 0x22, 0x3f, 0x05, 0x10, 0xaf,
+	0x28, 0xe9, 0x2d, 0x78, 0x39, 0x43, 0x0a, 0xc4, 0x48, 0x49, 0xc0, 0x63, 0x14, 0xd3, 0xa9, 0xfe,
+	0x35, 0x09, 0x37, 0xf2, 0x8b, 0x70, 0x96, 0xad, 0x97, 0x18, 0x22, 0x7c, 0xce, 0x66, 0xc7, 0xf1,
+	0x2b, 0x5f, 0x1c, 0xbc, 0xb5, 0xdf, 0xc8, 0x22, 0xe3, 0x31, 0x1b, 0x49, 0xf8, 0x7b, 0xd4, 0x56,
+	0x4d, 0xbe, 0x2c, 0x0a, 0x74, 0x2e, 0xc5, 0xda, 0x87, 0xb3, 0x65, 0xfc, 0x66, 0xa6, 0x7c, 0xbb,
+	0x28, 0xd7, 0x02, 0x97, 0x6f, 0xa1, 0x1e, 0x74, 0x81, 0x20, 0xf2, 0x11, 0x90, 0x46, 0x6f, 0x77,
+	0x97, 0x86, 0x11, 0x75, 0x39, 0x8c, 0x06, 0xe1, 0xec, 0x04, 0xca, 0x07, 0x3c, 0x32, 0x0a, 0x65,
+	0xa9, 0x1d, 0xc8, 0x62, 0x75, 0x92, 0xf4, 0x13, 0x5f, 0xda, 0x81, 0x8b, 0x03, 0x9b, 0x99, 0x11,
+	0x50, 0x31, 0xa7, 0x07, 0x54, 0x5c, 0x1c, 0x24, 0x0e, 0x43, 0x35, 0xa8, 0xe2, 0xf7, 0x8c, 0x94,
+	0xfc, 0x13, 0xca, 0x0a, 0xcf, 0x02, 0x37, 0x68, 0x83, 0xc8, 0x61, 0x60, 0x3c, 0x97, 0x90, 0xb9,
+	0x44, 0x49, 0x62, 0x12, 0x52, 0x95, 0xb0, 0x28, 0x2b, 0x3f, 0xa5, 0x28, 0x34, 0xff, 0x85, 0x01,
+	0x84, 0xd7, 0x70, 0xc1, 0xe9, 0x3a, 0x3b, 0x5e, 0xcb, 0x8b, 0x3c, 0x1a, 0x92, 0xfb, 0x50, 0x11,
+	0x2c, 0x9c, 0x9d, 0x16, 0x55, 0x7d, 0xa5, 0xc4, 0x65, 0x6a, 0x5c, 0x66, 0xa7, 0xd5, 0x9a, 0x3e,
+	0xc2, 0x01, 0x83, 0x97, 0xfb, 0x14, 0x83, 0x67, 0xfe, 0xd0, 0x80, 0x8b, 0xfd, 0xd5, 0x16, 0x5f,
+	0x8e, 0x3b, 0xcf, 0x38, 0xa1, 0xf3, 0xb2, 0x5a, 0x99, 0xc3, 0x63, 0xc8, 0xa7, 0xd6, 0xca, 0x7c,
+	0x72, 0xaa, 0x79, 0xfa, 0x56, 0xfe, 0x6a, 0x0e, 0xca, 0xeb, 0xad, 0xde, 0xae, 0xd7, 0x59, 0x74,
+	0x22, 0xe7, 0x99, 0x35, 0x29, 0xde, 0xd6, 0x4c, 0x8a, 0xd8, 0x3b, 0x2a, 0x6e, 0xd8, 0x70, 0x19,
+	0xb9, 0x0c, 0x98, 0x4a, 0x48, 0xf8, 0x2a, 0xbd, 0x07, 0x05, 0xf6, 0x43, 0x68, 0x28, 0x57, 0xfa,
+	0x18, 0x23, 0xd6, 0x8d, 0xf8, 0x3f, 0xa1, 0xe4, 0xeb, 0x79, 0xd0, 0x90, 0xc3, 0xa5, 0x9f, 0xe0,
+	0x69, 0x8c, 0x4e, 0x9f, 0x72, 0xf1, 0x9f, 0x1b, 0x50, 0x49, 0xb7, 0x84, 0xdc, 0x87, 0x31, 0xc6,
+	0xc9, 0x8b, 0x53, 0x22, 0xbd, 0x32, 0xa0, 0xcd, 0x37, 0x04, 0x1a, 0xaf, 0x1e, 0x76, 0x3e, 0xe5,
+	0x10, 0x4b, 0x72, 0xb8, 0x64, 0x41, 0x59, 0xc5, 0xca, 0xa8, 0xdd, 0x1b, 0xba, 0x68, 0x3a, 0x9f,
+	0xdd, 0x0f, 0x6a, 0xad, 0x7f, 0x57, 0xab, 0xb5, 0x10, 0x4a, 0xc3, 0xe6, 0xb6, 0xc3, 0xf0, 0x30,
+	0x9e, 0xc1, 0x43, 0x9d, 0x67, 0x32, 0xd9, 0x87, 0x1e, 0x1e, 0xc6, 0x61, 0xcc, 0x16, 0xe1, 0xdf,
+	0x13, 0xf3, 0x0c, 0x6d, 0x91, 0x2e, 0x42, 0x54, 0x7d, 0x96, 0xe3, 0x98, 0x7f, 0x2f, 0x0f, 0xe7,
+	0x93, 0xea, 0xf1, 0x4c, 0x7f, 0xeb, 0x4e, 0xe0, 0xb4, 0xc3, 0x13, 0x56, 0xc0, 0xd5, 0xbe, 0xaa,
+	0x61, 0xf8, 0xb3, 0xac, 0x9a, 0x52, 0x21, 0x33, 0x55, 0x21, 0x34, 0xe2, 0x78, 0x85, 0x64, 0x35,
+	0xc8, 0x7d, 0xc8, 0x37, 0x68, 0x24, 0x82, 0x24, 0x5f, 0xeb, 0xeb, 0x55, 0xb5, 0x5e, 0x37, 0x1a,
+	0x34, 0xe2, 0x83, 0xc8, 0xfd, 0xcc, 0xa9, 0xe6, 0xf7, 0xcd, 0xd4, 0xf1, 0x6d, 0x18, 0x5d, 0x7a,
+	0xd2, 0xa5, 0xcd, 0x48, 0xc4, 0x46, 0x5e, 0x3b, 0x9e, 0x1f, 0xc7, 0x55, 0x22, 0x30, 0x29, 0x02,
+	0xd4, 0xce, 0xe2, 0x28, 0x97, 0x6e, 0x43, 0x51, 0x7e, 0xfc, 0x54, 0x91, 0x84, 0x6f, 0xc3, 0xb8,
+	0xf2, 0x91, 0x53, 0x4d, 0xfa, 0xbf, 0x36, 0x60, 0x94, 0x09, 0xbd, 0xad, 0xb7, 0x9e, 0x51, 0x89,
+	0x74, 0x4b, 0x93, 0x48, 0xd3, 0x4a, 0xc8, 0x0b, 0xae, 0xcb, 0xb7, 0x4e, 0x90, 0x45, 0x87, 0x06,
+	0x40, 0x82, 0x4c, 0xee, 0xc2, 0x18, 0xbf, 0xc8, 0x91, 0x69, 0x34, 0xd5, 0x18, 0x1a, 0x51, 0x92,
+	0x68, 0x39, 0x7e, 0x37, 0xad, 0x16, 0x4a, 0x6a, 0xb2, 0x98, 0xf8, 0x19, 0xab, 0x41, 0x9b, 0x8c,
+	0xcd, 0x82, 0xdf, 0xe1, 0x31, 0x15, 0xa1, 0x92, 0x6e, 0x2a, 0xdb, 0xe1, 0xb8, 0x26, 0x0e, 0x36,
+	0xf2, 0xc7, 0x31, 0x39, 0x2f, 0x98, 0x64, 0x9f, 0x79, 0x7c, 0x7b, 0x9c, 0x47, 0x29, 0xc8, 0x8a,
+	0xbd, 0x07, 0xe5, 0x3b, 0x7e, 0xf0, 0xd8, 0x09, 0xdc, 0xda, 0x2e, 0x15, 0x1e, 0xe2, 0x45, 0x74,
+	0xf3, 0x9e, 0x78, 0xc8, 0xe1, 0xb6, 0xc3, 0x0a, 0x7e, 0x74, 0x58, 0x2d, 0xd4, 0x7d, 0xbf, 0x65,
+	0x69, 0xe8, 0x64, 0x0d, 0x26, 0x1e, 0x38, 0x4f, 0xc4, 0x7d, 0xdd, 0xc6, 0xc6, 0x8a, 0xf0, 0x33,
+	0xb9, 0x76, 0x74, 0x58, 0xbd, 0xd8, 0x76, 0x9e, 0xc4, 0xf7, 0x7c, 0x83, 0x5d, 0xa1, 0x75, 0x7a,
+	0xe2, 0xc1, 0xe4, 0xba, 0x1f, 0x44, 0xe2, 0x23, 0x4c, 0xa7, 0xcd, 0x0f, 0xb8, 0x6e, 0x9b, 0xcb,
+	0xbc, 0x6e, 0xbb, 0xc8, 0x14, 0x79, 0xfb, 0x61, 0x4c, 0xae, 0x85, 0xd6, 0x69, 0x8c, 0xc9, 0x7b,
+	0x30, 0xbd, 0x40, 0x83, 0xc8, 0x7b, 0xe8, 0x35, 0x9d, 0x88, 0xde, 0xf1, 0x83, 0xb6, 0x13, 0x89,
+	0x03, 0x15, 0x34, 0xa8, 0x9b, 0x94, 0x73, 0x6a, 0x3b, 0x91, 0xd5, 0x8f, 0x49, 0xbe, 0x96, 0xe5,
+	0xb9, 0x33, 0x82, 0xcd, 0x7f, 0x93, 0x29, 0x05, 0x19, 0x9e, 0x3b, 0x03, 0xba, 0x20, 0xc3, 0x87,
+	0x67, 0xf7, 0xb8, 0x6b, 0xcf, 0x62, 0xfd, 0xa6, 0xb8, 0x82, 0x3d, 0xf9, 0x5a, 0x33, 0x1e, 0xb7,
+	0x01, 0xd7, 0x9b, 0xf3, 0x90, 0xaf, 0xaf, 0xdf, 0xc1, 0x23, 0x12, 0x71, 0xcd, 0x48, 0x3b, 0x7b,
+	0x4e, 0xa7, 0x89, 0xba, 0x8c, 0xf0, 0x5d, 0x50, 0x05, 0x5e, 0x7d, 0xfd, 0x0e, 0x71, 0x60, 0x66,
+	0x9d, 0x06, 0x6d, 0x2f, 0xfa, 0xca, 0xcd, 0x9b, 0xca, 0x40, 0x15, 0xb1, 0x6a, 0x73, 0xa2, 0x6a,
+	0xd5, 0x2e, 0xa2, 0xd8, 0x4f, 0x6e, 0xde, 0xcc, 0x1c, 0x8e, 0xb8, 0x62, 0x59, 0xbc, 0xc8, 0x12,
+	0x4c, 0x3e, 0x70, 0x9e, 0x88, 0x0b, 0xe9, 0xd8, 0xc6, 0xcb, 0xa3, 0x67, 0x3c, 0x4e, 0xac, 0x66,
+	0x52, 0xa4, 0x0e, 0xb1, 0x4e, 0x44, 0xde, 0x85, 0xf1, 0x64, 0x7a, 0x85, 0x78, 0x15, 0x99, 0xe7,
+	0x2e, 0x91, 0xca, 0xe4, 0xd4, 0xce, 0x92, 0x14, 0x74, 0xb2, 0x19, 0x9b, 0xe8, 0x5c, 0x21, 0x45,
+	0x47, 0xc1, 0x52, 0x7d, 0x4e, 0x35, 0xd1, 0x1d, 0x2c, 0xd1, 0x9a, 0x35, 0x15, 0xab, 0xe8, 0xdc,
+	0x53, 0xc6, 0xd2, 0xb9, 0x28, 0x96, 0xff, 0x7a, 0xe0, 0xb7, 0xbb, 0x11, 0x7a, 0x0c, 0xa6, 0x2c,
+	0xff, 0x2e, 0x96, 0x64, 0x58, 0xfe, 0x9c, 0x24, 0xfb, 0x9e, 0x7d, 0xe2, 0x53, 0xdc, 0xb3, 0x53,
+	0x28, 0xac, 0xf8, 0xcd, 0x7d, 0x74, 0x11, 0x2c, 0xd5, 0x3f, 0x62, 0xf2, 0xa3, 0xe5, 0x37, 0xf7,
+	0x9f, 0xde, 0xfd, 0x30, 0xb2, 0x27, 0xab, 0xac, 0xed, 0x6c, 0x5a, 0x89, 0x4f, 0xcf, 0x4e, 0x69,
+	0x37, 0x6d, 0x5a, 0x19, 0x57, 0x54, 0xf8, 0x2c, 0x94, 0x0d, 0xb1, 0x74, 0x72, 0x42, 0xa1, 0xb2,
+	0x48, 0xc3, 0xfd, 0xc8, 0xef, 0x2e, 0xb4, 0xbc, 0xee, 0x8e, 0xef, 0x04, 0xee, 0x6c, 0x65, 0x80,
+	0xc0, 0x78, 0x3d, 0x53, 0x60, 0x4c, 0xbb, 0x9c, 0xde, 0x6e, 0x4a, 0x06, 0x56, 0x1f, 0x4b, 0xf2,
+	0x35, 0x98, 0x64, 0xab, 0x65, 0xe9, 0x49, 0x44, 0x3b, 0x7c, 0x2a, 0x4d, 0xe3, 0x56, 0x7f, 0x56,
+	0x09, 0x32, 0x8c, 0x0b, 0xf9, 0x24, 0x45, 0xe9, 0x41, 0x63, 0x02, 0x75, 0x92, 0xea, 0xac, 0xcc,
+	0x9f, 0x4a, 0xf5, 0x09, 0x59, 0x86, 0x31, 0x51, 0x03, 0xb1, 0xeb, 0xf4, 0xb7, 0xe5, 0xc5, 0xcc,
+	0xb6, 0x8c, 0x89, 0xb6, 0x58, 0x92, 0xde, 0xfc, 0xb7, 0x06, 0x4c, 0x68, 0x9f, 0x23, 0xb7, 0x15,
+	0xf7, 0x95, 0xc4, 0xed, 0x4c, 0xc3, 0xc9, 0x4c, 0x4f, 0x7f, 0x5b, 0xf8, 0x2c, 0xe5, 0x06, 0xd3,
+	0x65, 0x66, 0x0e, 0x93, 0x41, 0xff, 0xf9, 0xe3, 0x83, 0xfe, 0x0b, 0x03, 0x82, 0xfe, 0xbf, 0x3d,
+	0x01, 0x93, 0xfa, 0x06, 0xc7, 0x34, 0xce, 0x15, 0x7f, 0xd7, 0xeb, 0x48, 0xbb, 0x95, 0xa7, 0xb1,
+	0x40, 0x88, 0x96, 0xeb, 0x1d, 0x21, 0xe4, 0x55, 0x80, 0xf8, 0x6a, 0x56, 0x9a, 0xa6, 0x22, 0x33,
+	0xbd, 0x52, 0x40, 0x7e, 0x1a, 0x60, 0xd5, 0x77, 0x69, 0x9c, 0x09, 0xe5, 0x98, 0x03, 0xa5, 0xd7,
+	0xc5, 0x81, 0x92, 0xc8, 0x26, 0x7f, 0x74, 0x58, 0x3d, 0xd7, 0xf1, 0x5d, 0xda, 0x9f, 0x02, 0x45,
+	0xe1, 0x48, 0xbe, 0x04, 0x23, 0x56, 0xaf, 0x45, 0x65, 0x62, 0x8e, 0x71, 0x39, 0xe1, 0x7b, 0x2d,
+	0x25, 0xcb, 0x64, 0xd0, 0x4b, 0xdf, 0x23, 0x30, 0x00, 0xf9, 0x00, 0xe0, 0x7e, 0x6f, 0x87, 0xde,
+	0x0d, 0xfc, 0x5e, 0x57, 0x46, 0xfe, 0xa2, 0x19, 0xbb, 0x1f, 0xa7, 0x71, 0xb2, 0x77, 0xb1, 0x50,
+	0xfd, 0x78, 0x42, 0x42, 0xd6, 0x60, 0x4c, 0x88, 0x0f, 0x71, 0x4e, 0xff, 0x52, 0xd6, 0x09, 0x91,
+	0xa2, 0x43, 0x88, 0x4c, 0x19, 0x08, 0xd6, 0x0f, 0x6d, 0xb8, 0x19, 0xfe, 0x2e, 0x94, 0x18, 0x7b,
+	0x66, 0x6a, 0x87, 0x62, 0xef, 0x40, 0xff, 0x41, 0xa5, 0x42, 0xcc, 0x2c, 0xd7, 0xf2, 0x75, 0xc5,
+	0x04, 0xe4, 0x6b, 0x98, 0xdb, 0x46, 0x74, 0xf5, 0xb1, 0x07, 0x8d, 0xaf, 0xf5, 0x75, 0xf5, 0x59,
+	0xa7, 0xdb, 0xcd, 0x48, 0x06, 0x16, 0xf3, 0x23, 0xbb, 0x71, 0x8c, 0x4d, 0x9c, 0x6a, 0xf8, 0x98,
+	0x0f, 0x5c, 0xef, 0xfb, 0xc0, 0xac, 0x0c, 0x1b, 0xe9, 0xcf, 0x68, 0xa3, 0xf1, 0x25, 0x5d, 0xa8,
+	0x24, 0x69, 0xb4, 0xc4, 0xb7, 0xe0, 0xb8, 0x6f, 0xbd, 0xd9, 0xf7, 0x2d, 0x75, 0x00, 0xfb, 0x3e,
+	0xd7, 0xc7, 0x9d, 0xb8, 0x49, 0x5a, 0x58, 0xf1, 0xbd, 0xf1, 0xe3, 0xbe, 0xf7, 0x6a, 0xdf, 0xf7,
+	0x66, 0xdc, 0x9d, 0xfe, 0xef, 0xa4, 0x78, 0x92, 0x77, 0x61, 0x42, 0x42, 0x70, 0x7d, 0xe0, 0x01,
+	0x9f, 0xd0, 0xef, 0xdd, 0x1d, 0x74, 0x1a, 0xd3, 0xd3, 0xb9, 0xa8, 0xc8, 0x2a, 0x35, 0x9f, 0x1d,
+	0x13, 0x1a, 0x75, 0x7a, 0x56, 0xe8, 0xc8, 0xe4, 0xab, 0x30, 0xbe, 0xdc, 0x66, 0x0d, 0xf1, 0x3b,
+	0x4e, 0x44, 0x71, 0x33, 0x4a, 0x0e, 0x4d, 0x95, 0x12, 0x65, 0xaa, 0xf2, 0x1c, 0x8f, 0x49, 0x91,
+	0xba, 0x99, 0x2b, 0x14, 0xac, 0xf3, 0xf8, 0xf1, 0x8b, 0x98, 0xc3, 0xa1, 0xd8, 0x7a, 0x5e, 0xcc,
+	0x38, 0xb8, 0x54, 0xd8, 0xa3, 0x2c, 0xe7, 0xa7, 0x3a, 0xb6, 0x58, 0x10, 0x5a, 0xe7, 0xe9, 0x3c,
+	0xc9, 0x7b, 0x30, 0x2e, 0x22, 0x1a, 0x6b, 0xd6, 0x6a, 0x38, 0x5b, 0xc1, 0xc6, 0x63, 0x2e, 0x36,
+	0x19, 0xfc, 0x68, 0x3b, 0x41, 0xea, 0xf6, 0x2a, 0xc1, 0x27, 0x5f, 0x81, 0xb3, 0xdb, 0x5e, 0xc7,
+	0xf5, 0x1f, 0x87, 0x42, 0x80, 0x0b, 0x41, 0x37, 0x9d, 0xf8, 0xe8, 0x3c, 0xe6, 0xe5, 0xb6, 0xdc,
+	0xb6, 0xfa, 0x04, 0x5f, 0x26, 0x07, 0xf2, 0x0b, 0x7d, 0x9c, 0xf9, 0x0c, 0x22, 0xc7, 0xcd, 0xa0,
+	0xf9, 0xbe, 0x19, 0xd4, 0xff, 0xf9, 0xf4, 0x74, 0xca, 0xfc, 0x0c, 0xf1, 0x81, 0xe8, 0x3a, 0xc7,
+	0x87, 0xbe, 0xd7, 0x99, 0x9d, 0xd1, 0x1e, 0xf2, 0x88, 0x5d, 0x66, 0x11, 0x6f, 0xdd, 0x6f, 0x79,
+	0xcd, 0x83, 0xba, 0x79, 0x74, 0x58, 0x7d, 0x29, 0xad, 0xcd, 0x7c, 0xec, 0x6b, 0x87, 0x0b, 0x19,
+	0xac, 0xc9, 0x57, 0xa1, 0xcc, 0xfe, 0xc6, 0xaa, 0xdf, 0x59, 0xed, 0xaa, 0x4b, 0xc1, 0x14, 0xdf,
+	0xc1, 0x31, 0xc2, 0x90, 0xcb, 0x0c, 0xad, 0x50, 0x63, 0x65, 0xfe, 0xd0, 0x80, 0xb3, 0x59, 0x75,
+	0x3d, 0x21, 0xbf, 0x8d, 0x99, 0xba, 0xf4, 0xc6, 0x73, 0x09, 0x7e, 0xe9, 0x1d, 0x5f, 0x75, 0x57,
+	0x61, 0x84, 0xd9, 0xca, 0xd2, 0x29, 0x0b, 0xb7, 0x43, 0x66, 0x4f, 0x87, 0x16, 0x87, 0x33, 0x04,
+	0x74, 0xa6, 0xc7, 0xfd, 0x72, 0x84, 0x23, 0xa0, 0xc7, 0xbd, 0xc5, 0xe1, 0x0c, 0x81, 0x6d, 0xbb,
+	0x72, 0x9b, 0x40, 0x04, 0xb6, 0x1b, 0x87, 0x16, 0x87, 0x93, 0xd7, 0x60, 0x6c, 0xad, 0xb3, 0x42,
+	0x9d, 0x47, 0x54, 0xdc, 0x38, 0xe1, 0x39, 0x8a, 0xdf, 0xb1, 0x5b, 0x0c, 0x66, 0xc9, 0x42, 0xf3,
+	0xbb, 0x06, 0x4c, 0xf7, 0x75, 0xd3, 0xc9, 0x29, 0x7c, 0x8e, 0xbf, 0xde, 0x1b, 0xa6, 0x7d, 0xbc,
+	0xfa, 0x85, 0xec, 0xea, 0x9b, 0x7f, 0x99, 0x87, 0x0b, 0x03, 0x76, 0xad, 0xe4, 0x6a, 0xde, 0x38,
+	0xf1, 0x6a, 0xfe, 0xeb, 0x6c, 0x97, 0x70, 0xbc, 0x76, 0xb8, 0xe1, 0x27, 0x35, 0x4e, 0x6e, 0x31,
+	0xb0, 0x4c, 0xe6, 0xc8, 0x90, 0xf9, 0x1c, 0x2e, 0x36, 0x91, 0xc2, 0x8e, 0xfc, 0xbe, 0x33, 0x63,
+	0x9d, 0x59, 0xdf, 0xe5, 0x78, 0xfe, 0xc7, 0xe4, 0x72, 0x5c, 0xbf, 0x92, 0x2a, 0x3c, 0xd5, 0x2b,
+	0xa9, 0xec, 0x43, 0xf2, 0x91, 0x4f, 0x73, 0x15, 0xf0, 0xef, 0x53, 0xd7, 0xf1, 0x3f, 0x8e, 0x43,
+	0x7d, 0x0d, 0x46, 0xb6, 0xf7, 0x68, 0x20, 0xf5, 0x5b, 0xac, 0xc8, 0x63, 0x06, 0x50, 0x2b, 0x82,
+	0x18, 0xe6, 0xcf, 0x43, 0x59, 0xfd, 0x18, 0xae, 0x65, 0xf6, 0x5b, 0x2c, 0x26, 0xbe, 0x96, 0x19,
+	0xc0, 0xe2, 0xf0, 0x13, 0x33, 0x62, 0x25, 0xbd, 0x90, 0x3f, 0xa9, 0x17, 0xcc, 0x7f, 0x67, 0x40,
+	0x01, 0x13, 0x02, 0xbc, 0x05, 0x25, 0x79, 0x54, 0xaa, 0x06, 0xc9, 0xcf, 0xc8, 0x93, 0xd4, 0x50,
+	0xf7, 0x67, 0x10, 0x40, 0xf6, 0xa9, 0x2d, 0x1a, 0xec, 0x68, 0x6e, 0x2f, 0x8f, 0x18, 0x40, 0xfd,
+	0x14, 0x62, 0x9c, 0xa2, 0x4b, 0xd0, 0xb5, 0x47, 0xd8, 0xf7, 0x7c, 0xc1, 0x73, 0xd7, 0x9e, 0x3e,
+	0xbb, 0x5e, 0x62, 0x99, 0xbf, 0x6d, 0xc0, 0xb9, 0x4c, 0x3d, 0x80, 0x7d, 0x95, 0x2b, 0x1c, 0xca,
+	0x8c, 0x48, 0x6b, 0x1b, 0x1c, 0xe3, 0x34, 0x2e, 0x3c, 0xa7, 0x18, 0xde, 0xcf, 0x41, 0x29, 0xb6,
+	0xcf, 0xc8, 0x59, 0x39, 0x74, 0x78, 0x9e, 0x26, 0x8d, 0x99, 0xbf, 0x36, 0x60, 0x94, 0x55, 0xe1,
+	0x99, 0x8d, 0xae, 0xc8, 0x3e, 0x5d, 0x65, 0x4d, 0x1a, 0x2a, 0xa6, 0xe2, 0x0f, 0x46, 0x01, 0x12,
+	0x64, 0xb2, 0x03, 0x93, 0x6b, 0xcb, 0x8b, 0x0b, 0xcb, 0x2e, 0xed, 0x44, 0x78, 0xcb, 0x97, 0x8a,
+	0xb2, 0x67, 0x86, 0x65, 0xd0, 0x71, 0x5a, 0x02, 0xe1, 0x20, 0x59, 0x9e, 0xbe, 0xe7, 0x36, 0x6d,
+	0x2f, 0xa6, 0x53, 0x15, 0x32, 0x9d, 0x23, 0xfb, 0x46, 0xa3, 0xf6, 0x60, 0x45, 0xf9, 0x46, 0x6e,
+	0xc8, 0x6f, 0x84, 0x4e, 0xbb, 0x35, 0xe0, 0x1b, 0x3a, 0x47, 0xb2, 0x07, 0x95, 0xbb, 0x28, 0xbb,
+	0x95, 0xaf, 0xe4, 0x8f, 0xff, 0xca, 0xcb, 0xe2, 0x2b, 0x2f, 0x70, 0xa1, 0x9f, 0xfd, 0x9d, 0x3e,
+	0xae, 0xc9, 0xcc, 0x2d, 0x9c, 0x38, 0x73, 0xff, 0xb6, 0x01, 0xa3, 0x7c, 0x73, 0x88, 0xdf, 0xb2,
+	0xc8, 0xdc, 0x7e, 0xb6, 0x9f, 0xce, 0xf6, 0x53, 0x89, 0xf0, 0x3f, 0xd5, 0x00, 0xe7, 0x65, 0x64,
+	0x31, 0xf5, 0x30, 0x86, 0x3c, 0x42, 0x47, 0xc5, 0x94, 0x97, 0x24, 0x8e, 0x50, 0xfc, 0x4d, 0x0c,
+	0x95, 0x0b, 0xc7, 0x50, 0x9f, 0xe9, 0x1b, 0xfb, 0x94, 0xcf, 0xf4, 0xad, 0x40, 0x49, 0x78, 0xf6,
+	0xd4, 0x0f, 0x84, 0xf9, 0x29, 0x0f, 0x58, 0x62, 0xb8, 0x92, 0x7c, 0x9a, 0x83, 0xec, 0x1d, 0x2d,
+	0x75, 0x5c, 0x8c, 0x48, 0xd6, 0xa0, 0x94, 0x84, 0x86, 0x94, 0xb4, 0x7b, 0xd0, 0x18, 0x2e, 0x5c,
+	0x5f, 0x79, 0xf4, 0x61, 0x66, 0x24, 0x48, 0xc2, 0xc3, 0xfc, 0xa6, 0x01, 0x95, 0xf4, 0x7c, 0x21,
+	0xef, 0xc2, 0x78, 0x1c, 0x9d, 0x13, 0xfb, 0x17, 0xe0, 0x41, 0x66, 0x12, 0xce, 0xa3, 0x79, 0x1a,
+	0xa8, 0xe8, 0x64, 0x1e, 0x8a, 0x6c, 0xd9, 0x29, 0xb9, 0x83, 0x51, 0x9e, 0xf4, 0x04, 0x4c, 0xbd,
+	0xd7, 0x93, 0x78, 0xca, 0xaa, 0xfd, 0x8f, 0x79, 0x18, 0x57, 0x06, 0x8b, 0x5c, 0x83, 0xe2, 0x72,
+	0xb8, 0xe2, 0x37, 0xf7, 0xa9, 0x2b, 0xae, 0x0b, 0xf0, 0x15, 0x46, 0x2f, 0xb4, 0x5b, 0x08, 0xb4,
+	0xe2, 0x62, 0x52, 0x87, 0x09, 0xfe, 0x9f, 0x8c, 0xc2, 0xcc, 0x25, 0x47, 0x9d, 0x1c, 0x59, 0xc6,
+	0x5f, 0xaa, 0x3b, 0xac, 0x46, 0x42, 0xbe, 0x01, 0xc0, 0x01, 0x6c, 0x7c, 0x87, 0x70, 0xec, 0x95,
+	0x0b, 0xf8, 0x9c, 0xf8, 0x40, 0xe4, 0xa9, 0x2d, 0xc4, 0xa9, 0xa0, 0x30, 0xc4, 0x17, 0xe0, 0xfc,
+	0xe6, 0xfe, 0xf0, 0x6f, 0x40, 0x26, 0x2f, 0xc0, 0xf9, 0xcd, 0x7d, 0x3b, 0xdb, 0xcb, 0x4b, 0x65,
+	0x49, 0xbe, 0x65, 0xc0, 0x25, 0x8b, 0x36, 0xfd, 0x47, 0x34, 0x38, 0xa8, 0x45, 0x88, 0xa5, 0x7e,
+	0xf1, 0x64, 0x97, 0xb2, 0x5b, 0xe2, 0x8b, 0xaf, 0x07, 0x82, 0x0b, 0x86, 0xa3, 0xb4, 0xbb, 0x91,
+	0x7d, 0x4c, 0x15, 0x8e, 0xf9, 0xa4, 0xf9, 0x67, 0x86, 0xb2, 0x04, 0xc8, 0x2a, 0x94, 0xe2, 0xc9,
+	0x22, 0x0e, 0x1c, 0x63, 0xe5, 0x48, 0xc2, 0x2d, 0xfa, 0xb0, 0xfe, 0x82, 0x38, 0xd9, 0x9f, 0x89,
+	0xa7, 0x9c, 0xb6, 0x22, 0x24, 0x90, 0x7c, 0x19, 0x0a, 0x38, 0x54, 0x27, 0x27, 0x9b, 0x92, 0x5b,
+	0x4d, 0x81, 0x8d, 0x11, 0xd6, 0x1a, 0x29, 0xc9, 0x17, 0x84, 0x97, 0x47, 0x5e, 0x4b, 0xe3, 0xca,
+	0x40, 0xac, 0x1e, 0xf1, 0x1e, 0x93, 0x38, 0x16, 0x2a, 0xb3, 0xf5, 0xef, 0xe4, 0xa0, 0x92, 0x5e,
+	0x78, 0xe4, 0x03, 0x28, 0xaf, 0x3b, 0x61, 0xf8, 0xd8, 0x0f, 0xdc, 0x7b, 0x4e, 0xb8, 0x27, 0x52,
+	0x43, 0xa2, 0xcd, 0xd7, 0x15, 0x70, 0x7b, 0xcf, 0xd1, 0x52, 0x88, 0x69, 0x04, 0x6c, 0x43, 0xde,
+	0x10, 0xfe, 0xea, 0xca, 0x02, 0x8a, 0xfc, 0xa8, 0x9b, 0x4a, 0x0d, 0x29, 0xd1, 0xc8, 0x5b, 0x90,
+	0xe7, 0xb1, 0x6f, 0x6a, 0x5e, 0xa1, 0x07, 0x77, 0x6a, 0x3c, 0x5c, 0x88, 0x5f, 0x26, 0xeb, 0xa7,
+	0xf2, 0x0c, 0x9f, 0xac, 0x28, 0x91, 0x53, 0xa3, 0x5a, 0x7e, 0x15, 0x09, 0x8e, 0x1b, 0x77, 0x72,
+	0x08, 0xd5, 0x87, 0x85, 0x62, 0xbe, 0x52, 0x10, 0xf1, 0x39, 0x7f, 0x98, 0x87, 0x52, 0xfc, 0x7d,
+	0x42, 0x00, 0xf5, 0x0d, 0x71, 0x2b, 0x8c, 0xff, 0x93, 0x8b, 0x50, 0x94, 0x2a, 0x86, 0xb8, 0x19,
+	0x1e, 0x0b, 0x85, 0x7a, 0x31, 0x0b, 0x52, 0x97, 0xe0, 0xea, 0x85, 0x25, 0x7f, 0x92, 0x9b, 0x10,
+	0x2b, 0x0a, 0x83, 0x34, 0x8a, 0x02, 0x1b, 0x30, 0x2b, 0x46, 0x23, 0x93, 0x90, 0xf3, 0xb8, 0x2f,
+	0x72, 0xc9, 0xca, 0x79, 0x2e, 0xf9, 0x00, 0x8a, 0x8e, 0xeb, 0x52, 0xd7, 0x76, 0xa2, 0x21, 0xde,
+	0xe3, 0x2c, 0x32, 0x6e, 0x5c, 0xa2, 0x23, 0x55, 0x2d, 0x22, 0x35, 0x28, 0xe1, 0x73, 0x8c, 0xbd,
+	0x70, 0xa8, 0x37, 0x1c, 0x13, 0x0e, 0x45, 0x46, 0xb6, 0x19, 0x52, 0x97, 0xbc, 0x0e, 0x05, 0x36,
+	0x9a, 0x62, 0x3f, 0x88, 0xb3, 0xc5, 0xad, 0x6d, 0xac, 0xf3, 0x0e, 0xbb, 0x77, 0xc6, 0x42, 0x04,
+	0xf2, 0x0a, 0xe4, 0x7b, 0xf3, 0x0f, 0x85, 0xa4, 0xaf, 0x24, 0x61, 0x91, 0x31, 0x1a, 0x2b, 0x26,
+	0xb7, 0xa0, 0xf8, 0x58, 0x0f, 0x80, 0x3b, 0x97, 0x1a, 0xc6, 0x18, 0x3f, 0x46, 0xac, 0x17, 0x61,
+	0x94, 0x87, 0x9b, 0x99, 0x2f, 0x01, 0x24, 0x9f, 0xee, 0xbf, 0xc0, 0x37, 0xbf, 0x01, 0xa5, 0xf8,
+	0x93, 0xe4, 0x45, 0x80, 0x7d, 0x7a, 0x60, 0xef, 0x39, 0x1d, 0x57, 0x3c, 0x43, 0x52, 0xb6, 0x4a,
+	0xfb, 0xf4, 0xe0, 0x1e, 0x02, 0xc8, 0x05, 0x18, 0xeb, 0xb2, 0x51, 0x95, 0x89, 0x4d, 0xad, 0xd1,
+	0x6e, 0x6f, 0x87, 0xcd, 0xd0, 0x59, 0x18, 0xc3, 0xa3, 0x03, 0xb1, 0xd0, 0x26, 0x2c, 0xf9, 0xd3,
+	0xfc, 0xbd, 0x1c, 0x86, 0xbc, 0x2b, 0xf5, 0x24, 0x2f, 0xc3, 0x44, 0x33, 0xa0, 0xb8, 0x1d, 0x39,
+	0x4c, 0x2d, 0x12, 0xdf, 0x29, 0x27, 0xc0, 0x65, 0x97, 0xbc, 0x06, 0x53, 0x49, 0xa6, 0x55, 0xbb,
+	0xb9, 0x23, 0xc2, 0x5f, 0xcb, 0xd6, 0x44, 0x57, 0xa6, 0x5a, 0x5d, 0xd8, 0x41, 0x1f, 0xfa, 0x8a,
+	0x1a, 0x6a, 0x16, 0xc9, 0xac, 0xa9, 0x25, 0x6b, 0x4a, 0x81, 0xe3, 0xb5, 0xc3, 0x79, 0x18, 0x75,
+	0x9c, 0xdd, 0x9e, 0xc7, 0xfd, 0x79, 0xcb, 0x96, 0xf8, 0x45, 0x3e, 0x0f, 0xd3, 0xa1, 0xb7, 0xdb,
+	0x71, 0xa2, 0x5e, 0x20, 0x72, 0x0e, 0xd0, 0x00, 0xa7, 0xd4, 0x84, 0x55, 0x89, 0x0b, 0x16, 0x38,
+	0x9c, 0xbc, 0x09, 0x44, 0xfd, 0x9e, 0xbf, 0xf3, 0x31, 0x6d, 0xf2, 0xa9, 0x56, 0xb6, 0xa6, 0x95,
+	0x92, 0x35, 0x2c, 0x20, 0x9f, 0x83, 0x72, 0x40, 0x43, 0x54, 0xc9, 0xb0, 0xdb, 0x30, 0x93, 0x8a,
+	0x35, 0x2e, 0x61, 0xf7, 0xe9, 0x81, 0x59, 0x87, 0xe9, 0xbe, 0xf5, 0x48, 0xde, 0xe4, 0xda, 0xbd,
+	0xd8, 0x9f, 0xcb, 0xdc, 0x98, 0x61, 0x42, 0x2a, 0xf5, 0x82, 0x2f, 0x47, 0x32, 0x3b, 0x50, 0x56,
+	0xe5, 0xeb, 0x09, 0x81, 0xc5, 0xe7, 0xd1, 0xb1, 0x90, 0x0b, 0x9f, 0xd1, 0xa3, 0xc3, 0x6a, 0xce,
+	0x73, 0xd1, 0x9d, 0xf0, 0x2a, 0x14, 0xa5, 0x96, 0xa0, 0x3e, 0xc3, 0x21, 0x14, 0xca, 0x03, 0x2b,
+	0x2e, 0x35, 0x5f, 0x87, 0x31, 0x21, 0x42, 0x8f, 0x3f, 0xc6, 0x31, 0x7f, 0x39, 0x07, 0x53, 0x16,
+	0x65, 0x0b, 0x5c, 0x3c, 0x70, 0xf1, 0x9c, 0xe5, 0x9c, 0xd5, 0xda, 0x76, 0x4c, 0x1c, 0xff, 0xf7,
+	0x0c, 0x98, 0xc9, 0xc0, 0xfd, 0x44, 0x49, 0xaa, 0x6e, 0x43, 0x69, 0xd1, 0x73, 0x5a, 0x35, 0xd7,
+	0x8d, 0x1d, 0x24, 0x51, 0x1b, 0x74, 0xd9, 0x72, 0x72, 0x18, 0x54, 0xdd, 0x4c, 0x63, 0x54, 0x72,
+	0x5d, 0x4c, 0x8a, 0x24, 0x8d, 0x9e, 0xcc, 0x6a, 0x0b, 0xbc, 0x4e, 0x49, 0x4e, 0x5b, 0x0c, 0x43,
+	0xe3, 0xc0, 0xe4, 0x0e, 0xfc, 0x99, 0x1d, 0xba, 0xec, 0x30, 0xb4, 0x74, 0xf3, 0x86, 0x32, 0x3b,
+	0xbf, 0x99, 0x83, 0xf3, 0xd9, 0x84, 0x9f, 0x34, 0xdf, 0x18, 0x26, 0x51, 0x50, 0x12, 0x07, 0x63,
+	0xbe, 0x31, 0x9e, 0x71, 0x01, 0xf1, 0x13, 0x04, 0xf2, 0x10, 0x26, 0x56, 0x9c, 0x30, 0xba, 0x47,
+	0x9d, 0x20, 0xda, 0xa1, 0x4e, 0x34, 0x84, 0x06, 0x1b, 0xbf, 0x93, 0x8b, 0x9b, 0xda, 0x9e, 0xa4,
+	0x4c, 0xbf, 0x93, 0xab, 0xb1, 0x8d, 0x27, 0x4a, 0x61, 0x88, 0x89, 0xf2, 0xb3, 0x30, 0xd5, 0xa0,
+	0x6d, 0xa7, 0xbb, 0xe7, 0x07, 0x54, 0x9c, 0x3c, 0xdf, 0x80, 0x89, 0x18, 0x94, 0x39, 0x5b, 0xf4,
+	0x62, 0x0d, 0x5f, 0xe9, 0x88, 0x44, 0x94, 0xe8, 0xc5, 0xe6, 0xef, 0xe4, 0xe0, 0x42, 0xad, 0x29,
+	0x8e, 0xe9, 0x45, 0x81, 0xbc, 0x4d, 0xfc, 0x8c, 0xbf, 0x4d, 0xe6, 0xa0, 0xf4, 0xc0, 0x79, 0x82,
+	0x0f, 0xbe, 0x87, 0x22, 0x6b, 0x0d, 0x57, 0xbf, 0x9c, 0x27, 0x76, 0x7c, 0xec, 0x65, 0x25, 0x38,
+	0x4f, 0xf3, 0x4d, 0x78, 0x13, 0x46, 0xef, 0xf9, 0x2d, 0x57, 0x6c, 0x4e, 0xe2, 0xd4, 0x7f, 0x0f,
+	0x21, 0x96, 0x28, 0x31, 0x7f, 0x68, 0xc0, 0x64, 0x5c, 0x63, 0xac, 0xc2, 0x67, 0xde, 0x25, 0xa9,
+	0xd7, 0xf1, 0x4b, 0x43, 0xbc, 0x8e, 0x3f, 0xf2, 0xe9, 0x7a, 0xc2, 0xfc, 0x27, 0x78, 0xa1, 0xa0,
+	0xb6, 0x92, 0xed, 0x44, 0x4a, 0x45, 0x8c, 0x21, 0x2b, 0x92, 0x7b, 0x6a, 0x43, 0x92, 0x1f, 0x38,
+	0x24, 0xbf, 0x92, 0x83, 0xf1, 0xb8, 0xb2, 0xcf, 0x59, 0xfc, 0x76, 0xdc, 0xae, 0xa1, 0xbc, 0xb3,
+	0x1b, 0x8a, 0xac, 0x10, 0x4e, 0xd0, 0x5f, 0x86, 0x51, 0xb1, 0x98, 0x8c, 0xd4, 0xad, 0x5a, 0x6a,
+	0x74, 0x93, 0xb7, 0x4e, 0x71, 0x40, 0x43, 0x4b, 0xd0, 0xa1, 0xfb, 0xfb, 0x36, 0xdd, 0x11, 0xf7,
+	0x4b, 0xcf, 0xec, 0x1e, 0x95, 0xed, 0xfe, 0x9e, 0x34, 0x6c, 0xa8, 0xdd, 0xe9, 0x1f, 0x14, 0xa0,
+	0x92, 0x26, 0x39, 0x39, 0x42, 0x7e, 0xbd, 0xb7, 0x23, 0xde, 0x29, 0xc0, 0x08, 0xf9, 0x6e, 0x6f,
+	0xc7, 0x62, 0x30, 0xf2, 0x1a, 0x14, 0xd6, 0x03, 0xef, 0x11, 0xb6, 0x5a, 0x3c, 0xd3, 0xd0, 0x0d,
+	0xbc, 0x47, 0xaa, 0x1f, 0x28, 0x2b, 0x47, 0x83, 0x76, 0xa5, 0xa1, 0x3c, 0x33, 0xcd, 0x0d, 0xda,
+	0x56, 0x98, 0x4e, 0x8b, 0x22, 0xd1, 0xd8, 0x56, 0x59, 0xa7, 0x4e, 0x20, 0xa2, 0xb9, 0x85, 0x38,
+	0xc3, 0xad, 0x72, 0x07, 0xc1, 0x3c, 0xe7, 0xa9, 0xa5, 0x22, 0x91, 0x16, 0x10, 0xe5, 0xa7, 0x5c,
+	0xc0, 0x27, 0xdb, 0x78, 0xf2, 0x79, 0xa1, 0xb3, 0x2a, 0x6b, 0x5b, 0x5d, 0xcd, 0x19, 0x7c, 0x9f,
+	0xe6, 0x19, 0xe1, 0x3a, 0x94, 0xf0, 0xc8, 0x0b, 0x0f, 0x32, 0x8a, 0x27, 0x32, 0x93, 0x3e, 0xb7,
+	0x80, 0xb7, 0xf1, 0x76, 0x7c, 0x9c, 0x91, 0x30, 0x21, 0xef, 0xc3, 0xb8, 0xea, 0x28, 0xca, 0xdd,
+	0x19, 0x2f, 0xf3, 0x08, 0xa1, 0x01, 0xe9, 0xc3, 0x54, 0x02, 0xf3, 0x0b, 0xea, 0x2c, 0x11, 0x9b,
+	0xf6, 0xb1, 0xb3, 0xc4, 0xfc, 0x2d, 0x54, 0xe3, 0xdb, 0x7e, 0x44, 0x85, 0xf6, 0xf2, 0xcc, 0xca,
+	0xb1, 0xe4, 0x08, 0x79, 0x44, 0xf3, 0x08, 0xd1, 0x5a, 0x77, 0x8a, 0x07, 0x96, 0xff, 0xa1, 0x01,
+	0xe7, 0x32, 0x69, 0xc9, 0x0d, 0x80, 0x44, 0x47, 0x14, 0xbd, 0xc4, 0x93, 0xc9, 0xc6, 0x50, 0x4b,
+	0xc1, 0x20, 0x5f, 0x4f, 0x6b, 0x77, 0x27, 0x6f, 0x4e, 0xf2, 0xc9, 0x85, 0x49, 0x5d, 0xbb, 0xcb,
+	0xd0, 0xe9, 0xcc, 0xef, 0xe5, 0x61, 0xba, 0xef, 0xa9, 0xbe, 0x13, 0xee, 0xe0, 0xf7, 0x53, 0x0f,
+	0x41, 0xf1, 0xeb, 0x8e, 0xeb, 0x83, 0x1e, 0x0a, 0xcc, 0x78, 0x16, 0x0a, 0x8f, 0xc5, 0x44, 0x1e,
+	0xe3, 0x13, 0x5e, 0x87, 0x0a, 0xb3, 0x9f, 0x10, 0xfb, 0xfc, 0xc0, 0xaf, 0x3d, 0x85, 0xa7, 0xc4,
+	0x7e, 0x8c, 0x5f, 0x5a, 0xfa, 0xad, 0x1c, 0xcc, 0xf4, 0xb5, 0xf9, 0x99, 0x5d, 0x75, 0x5f, 0xd6,
+	0x76, 0xb7, 0x97, 0x06, 0x8d, 0xe9, 0x50, 0x5a, 0xc4, 0xff, 0x30, 0xe0, 0xc2, 0x00, 0x4a, 0x72,
+	0x90, 0x9e, 0x44, 0x5c, 0xab, 0xb8, 0x79, 0xfc, 0x07, 0x9f, 0xca, 0x54, 0xfa, 0xcc, 0x66, 0xc2,
+	0x2f, 0xe7, 0x00, 0xb6, 0xe9, 0xce, 0xb3, 0x9d, 0xfe, 0x27, 0xfb, 0x2d, 0x7c, 0xd9, 0xac, 0xa1,
+	0xc6, 0x7d, 0x0d, 0x0f, 0x12, 0x87, 0xcf, 0xfd, 0x13, 0x3f, 0x2b, 0x91, 0xcb, 0x7e, 0x56, 0xc2,
+	0xdc, 0x81, 0xb3, 0x77, 0x69, 0x94, 0xec, 0x84, 0xd2, 0x86, 0x3c, 0x9e, 0xed, 0x1b, 0x50, 0x12,
+	0xf8, 0x7a, 0x8a, 0x70, 0xe9, 0x50, 0xe6, 0xb9, 0x56, 0x82, 0x60, 0x52, 0xb8, 0xb0, 0x48, 0x5b,
+	0x34, 0xa2, 0x9f, 0xed, 0x67, 0x1a, 0x40, 0x78, 0x53, 0xf8, 0x6b, 0x03, 0x43, 0x7d, 0xe1, 0xc4,
+	0xfe, 0xd9, 0x82, 0x73, 0x71, 0xdd, 0x9f, 0x26, 0xdf, 0x39, 0xa6, 0x4b, 0x88, 0x58, 0xbb, 0x84,
+	0xe3, 0x31, 0x87, 0x88, 0x4f, 0xe0, 0x92, 0x24, 0xd8, 0xf6, 0xe2, 0x9b, 0x98, 0xa1, 0x68, 0xc9,
+	0xbb, 0x30, 0xae, 0xd0, 0x88, 0xc0, 0x5d, 0xbc, 0xed, 0x7c, 0xec, 0x45, 0x7b, 0x76, 0xc8, 0xe1,
+	0xea, 0x6d, 0xa7, 0x82, 0x6e, 0x7e, 0x0d, 0x5e, 0x88, 0xfd, 0x56, 0x32, 0x3e, 0x9d, 0x62, 0x6e,
+	0x9c, 0x8e, 0xf9, 0x6a, 0xd2, 0xac, 0xe5, 0x4e, 0xec, 0x3f, 0x2e, 0x79, 0x13, 0xb5, 0x59, 0xa2,
+	0x31, 0x97, 0x95, 0xb4, 0x68, 0x62, 0x2f, 0x4a, 0x00, 0xe6, 0x3b, 0x4a, 0x65, 0x33, 0x18, 0x6a,
+	0xc4, 0x46, 0x9a, 0xf8, 0x97, 0x73, 0x30, 0xb5, 0xb6, 0xbc, 0xb8, 0x10, 0x1f, 0x23, 0x3f, 0x67,
+	0xb9, 0x89, 0xb4, 0xb6, 0x0d, 0x96, 0x37, 0xe6, 0x26, 0xcc, 0xa4, 0xba, 0x01, 0x1f, 0x53, 0x79,
+	0x9f, 0xfb, 0x97, 0xc4, 0x60, 0xb9, 0xb3, 0x9c, 0xcf, 0x62, 0xbf, 0x75, 0xcb, 0x4a, 0x61, 0x9b,
+	0xdf, 0x1b, 0x4d, 0xf1, 0x15, 0x22, 0xec, 0x0d, 0x28, 0x2d, 0x87, 0x61, 0x8f, 0x06, 0x9b, 0xd6,
+	0x8a, 0xaa, 0x23, 0x7a, 0x08, 0xb4, 0x7b, 0x41, 0xcb, 0x4a, 0x10, 0xc8, 0x35, 0x28, 0x8a, 0xf8,
+	0x2e, 0x29, 0x13, 0xf0, 0xba, 0x3c, 0x0e, 0x0f, 0xb3, 0xe2, 0x62, 0xf2, 0x16, 0x94, 0xf9, 0xff,
+	0x7c, 0xb6, 0x89, 0x0e, 0xc7, 0xb3, 0x2a, 0x81, 0xce, 0x67, 0xa7, 0xa5, 0xa1, 0x31, 0xcb, 0x4c,
+	0xbe, 0xd6, 0xc8, 0x6a, 0x54, 0x48, 0x2c, 0x33, 0xf9, 0xb0, 0x23, 0xd6, 0x49, 0x45, 0x22, 0xd7,
+	0x21, 0x5f, 0x5b, 0xb0, 0xd4, 0xac, 0xc8, 0x4e, 0x33, 0xe0, 0x59, 0xc5, 0xb5, 0x07, 0x91, 0x6a,
+	0x0b, 0x16, 0x99, 0x87, 0x22, 0x3e, 0x78, 0xe1, 0xd2, 0x40, 0xf8, 0x8c, 0xe2, 0xac, 0xe9, 0x0a,
+	0x98, 0x7a, 0xf3, 0x28, 0xf1, 0xc8, 0x1c, 0x8c, 0x2d, 0x7a, 0x61, 0xb7, 0xe5, 0x1c, 0x88, 0xa4,
+	0x24, 0x78, 0x19, 0xe2, 0x72, 0x90, 0x3a, 0xcf, 0x04, 0x16, 0xb9, 0x06, 0x23, 0x8d, 0xa6, 0xdf,
+	0x65, 0xd6, 0x56, 0xec, 0xda, 0x12, 0x32, 0x80, 0x96, 0xd9, 0x80, 0x01, 0x30, 0xe4, 0x98, 0x47,
+	0x4e, 0x95, 0x94, 0x90, 0xe3, 0x74, 0xc4, 0x94, 0xc0, 0xe9, 0xf7, 0xff, 0x83, 0xa7, 0xe9, 0xff,
+	0xb7, 0x03, 0x17, 0xee, 0xa2, 0xaa, 0xdf, 0xa0, 0x01, 0xe6, 0x81, 0xe4, 0x8f, 0xe7, 0x6c, 0x5a,
+	0xcb, 0x22, 0x5a, 0xec, 0xea, 0xd1, 0x61, 0xf5, 0x15, 0x6e, 0x0d, 0xd8, 0x21, 0xc7, 0x91, 0xef,
+	0xee, 0xa4, 0x5e, 0x0c, 0x18, 0xc4, 0x88, 0x7c, 0x05, 0xce, 0x66, 0x15, 0x89, 0xb8, 0x31, 0xf4,
+	0x0a, 0xcf, 0xfe, 0x80, 0xea, 0x96, 0x9d, 0xc5, 0x81, 0xac, 0x40, 0x85, 0xc3, 0x6b, 0x6e, 0xdb,
+	0xeb, 0x2c, 0xb5, 0x1d, 0xaf, 0x85, 0x51, 0x64, 0x22, 0x14, 0x50, 0x70, 0x75, 0x58, 0xa1, 0x4d,
+	0x59, 0xa9, 0xe6, 0x9d, 0x94, 0xa2, 0x44, 0x71, 0xd4, 0xa8, 0x3d, 0x58, 0x49, 0xd6, 0xd4, 0xf3,
+	0x75, 0x6f, 0xa4, 0xb5, 0xed, 0x98, 0x7b, 0xa3, 0x4d, 0x98, 0x49, 0x75, 0x83, 0x14, 0x47, 0x1a,
+	0x38, 0x2d, 0x8e, 0x52, 0x34, 0x56, 0x0a, 0xdb, 0xfc, 0x4f, 0xa3, 0x29, 0xbe, 0xe2, 0xac, 0xc8,
+	0x84, 0x51, 0x2e, 0x6d, 0xd4, 0xac, 0x65, 0x5c, 0x16, 0x59, 0xa2, 0x84, 0x5c, 0x84, 0x7c, 0xa3,
+	0xb1, 0xa6, 0xe6, 0x54, 0x0c, 0x43, 0xdf, 0x62, 0x30, 0x36, 0x42, 0x78, 0x0c, 0xa4, 0x04, 0x68,
+	0x35, 0x69, 0x10, 0x89, 0xe7, 0x3c, 0x5f, 0x4d, 0xd6, 0x71, 0x21, 0xe9, 0x6f, 0xb1, 0x8e, 0x93,
+	0xd5, 0xbb, 0x00, 0xb3, 0xb5, 0x30, 0xa4, 0x41, 0xc4, 0x93, 0xb2, 0x87, 0xbd, 0x36, 0x0d, 0xc4,
+	0x5c, 0x13, 0x32, 0x86, 0x3f, 0x06, 0xde, 0x0c, 0xad, 0x81, 0x88, 0xe4, 0x2a, 0x14, 0x6b, 0x3d,
+	0xd7, 0xa3, 0x9d, 0xa6, 0xe6, 0x9b, 0xee, 0x08, 0x98, 0x15, 0x97, 0x92, 0x8f, 0xe0, 0x9c, 0x20,
+	0x92, 0x02, 0x47, 0xf4, 0x00, 0x97, 0x35, 0xdc, 0x82, 0x15, 0x6b, 0x41, 0x8a, 0x29, 0x5b, 0x74,
+	0x49, 0x36, 0x25, 0xa9, 0x41, 0x65, 0x09, 0xef, 0x49, 0xe5, 0xa3, 0xbe, 0x7e, 0x20, 0x92, 0xef,
+	0xa2, 0xe4, 0xe2, 0x77, 0xa8, 0xb6, 0x1b, 0x17, 0x5a, 0x7d, 0xe8, 0xe4, 0x3e, 0xcc, 0xa4, 0x61,
+	0x4c, 0x1e, 0x97, 0x92, 0x47, 0xb7, 0xfa, 0xb8, 0xa0, 0x60, 0xce, 0xa2, 0x22, 0x3b, 0x30, 0x5d,
+	0x8b, 0xa2, 0xc0, 0xdb, 0xe9, 0x45, 0x34, 0x25, 0xba, 0xe4, 0x41, 0x63, 0x5c, 0x2e, 0xc5, 0xd7,
+	0x0b, 0x62, 0x32, 0xce, 0x38, 0x31, 0x65, 0x2c, 0xc2, 0xac, 0x7e, 0x76, 0xc4, 0x8d, 0xdf, 0xed,
+	0x13, 0x6f, 0xdb, 0x89, 0x80, 0x22, 0x79, 0xa0, 0x5b, 0x0b, 0x0f, 0xda, 0x6d, 0x1a, 0x05, 0x78,
+	0x73, 0x8f, 0x6f, 0xdf, 0x99, 0xc2, 0x07, 0xe8, 0x92, 0xf2, 0x5c, 0x25, 0xbe, 0x6f, 0xa8, 0xb9,
+	0x47, 0x6a, 0x3c, 0xb5, 0xed, 0xa3, 0x3c, 0xe4, 0xf6, 0xd1, 0x82, 0xe9, 0xa5, 0x4e, 0x33, 0x38,
+	0xc0, 0xc8, 0x46, 0x59, 0xb9, 0x89, 0x13, 0x2a, 0x27, 0x1f, 0xb6, 0xb8, 0xec, 0xc8, 0x19, 0x96,
+	0x55, 0xbd, 0x7e, 0xc6, 0xe6, 0xdf, 0x80, 0x4a, 0xba, 0x2f, 0x3f, 0xe5, 0x63, 0xc5, 0xa7, 0x71,
+	0xcd, 0x66, 0x23, 0x9d, 0x6e, 0x0b, 0x99, 0xd3, 0x5e, 0xa4, 0x35, 0x92, 0xa8, 0x74, 0xe5, 0xed,
+	0x58, 0xed, 0x1d, 0x5a, 0xb9, 0x8c, 0x73, 0x59, 0xcb, 0xd8, 0xfc, 0xd5, 0x1c, 0x4c, 0x73, 0x6f,
+	0xd2, 0x67, 0x5f, 0x57, 0x7c, 0x5f, 0x13, 0xce, 0xf2, 0x2c, 0x30, 0xd5, 0xba, 0x63, 0xb4, 0xc5,
+	0x6f, 0xc0, 0xb9, 0xbe, 0xae, 0x40, 0x01, 0xbd, 0x28, 0xfd, 0x78, 0xfb, 0x44, 0xf4, 0x6c, 0xf6,
+	0x47, 0xb6, 0x6e, 0x59, 0x7d, 0x14, 0xe6, 0x3f, 0xca, 0xf5, 0xf1, 0x17, 0x7a, 0xa3, 0xaa, 0x09,
+	0x1a, 0xa7, 0xd3, 0x04, 0x73, 0x9f, 0x48, 0x13, 0xcc, 0x0f, 0xa3, 0x09, 0x7e, 0x04, 0x13, 0x1b,
+	0xd4, 0x61, 0x1a, 0x8d, 0x08, 0x36, 0x2b, 0x68, 0xaf, 0xc5, 0xb2, 0x32, 0x29, 0x5f, 0xe2, 0x40,
+	0xd5, 0x88, 0x11, 0x30, 0xd1, 0xc2, 0xa3, 0xcf, 0x2c, 0x9d, 0x83, 0xba, 0x69, 0x8c, 0x0c, 0xde,
+	0x34, 0xcc, 0x6f, 0xe6, 0x60, 0x5c, 0x61, 0x4f, 0xbe, 0x08, 0xe5, 0xb5, 0x60, 0xd7, 0xe9, 0x78,
+	0x3f, 0xe7, 0x28, 0xc7, 0xaf, 0x58, 0x7d, 0x5f, 0x81, 0x5b, 0x1a, 0x16, 0xba, 0xcd, 0x50, 0xa7,
+	0xad, 0x4e, 0x7c, 0x56, 0x3d, 0x0b, 0xa1, 0x4a, 0xb0, 0x70, 0x7e, 0x88, 0x60, 0x61, 0x3d, 0xd2,
+	0xb6, 0x70, 0xfa, 0x48, 0x5b, 0x2d, 0x30, 0x76, 0xe4, 0x94, 0x81, 0xb1, 0xe6, 0xaf, 0xe7, 0xa0,
+	0x22, 0xde, 0x55, 0x95, 0x87, 0x87, 0xcf, 0xd7, 0x3b, 0x0c, 0x7a, 0xe3, 0x8e, 0xb9, 0x1e, 0x2b,
+	0xfc, 0xf6, 0xef, 0x57, 0xf1, 0x95, 0xcc, 0x74, 0x77, 0xc8, 0x57, 0x32, 0x75, 0x78, 0x3a, 0x72,
+	0x20, 0x4d, 0x65, 0xa5, 0xf1, 0xcd, 0x3f, 0xcd, 0xa5, 0x79, 0x0b, 0x6d, 0xea, 0x55, 0x18, 0xe3,
+	0xcf, 0x62, 0x49, 0xe7, 0x66, 0x91, 0xbb, 0x09, 0x41, 0x96, 0x2c, 0x3b, 0x4d, 0x0c, 0xc9, 0x49,
+	0x4f, 0xa5, 0x92, 0xdb, 0x50, 0x46, 0x7f, 0x91, 0x9a, 0xeb, 0x06, 0x34, 0x0c, 0x85, 0xa2, 0x85,
+	0x77, 0x77, 0x8f, 0xe9, 0x8e, 0xcd, 0xfd, 0x4a, 0x1c, 0xd7, 0x0d, 0x2c, 0x0d, 0x8f, 0x2c, 0xc0,
+	0x59, 0xcd, 0x3d, 0x49, 0xd2, 0x8f, 0x24, 0xbb, 0x45, 0x84, 0x05, 0x9c, 0x38, 0x13, 0xf9, 0xe9,
+	0x3d, 0x13, 0x6d, 0xfe, 0x6f, 0x83, 0xad, 0xb5, 0xe6, 0xfe, 0x73, 0x16, 0xdd, 0xc2, 0x9a, 0x74,
+	0x8c, 0xb2, 0xff, 0x1f, 0x0c, 0xee, 0x9f, 0x2e, 0xa6, 0xcf, 0xdb, 0x30, 0xca, 0x1f, 0xe1, 0x12,
+	0x9e, 0xd4, 0x2a, 0x17, 0x5e, 0x90, 0xdc, 0x4f, 0xf1, 0xa7, 0xbc, 0x2c, 0x41, 0xc0, 0x4c, 0x66,
+	0xdd, 0x4d, 0x1e, 0x15, 0xcf, 0x7e, 0xff, 0x78, 0x89, 0xa5, 0xe6, 0x25, 0x1d, 0x2e, 0xdf, 0xb5,
+	0x71, 0x72, 0x5e, 0x52, 0xf3, 0xff, 0xe6, 0x78, 0x7b, 0x44, 0xa5, 0x86, 0x4d, 0xb8, 0xf7, 0x1a,
+	0x14, 0xf0, 0xb9, 0x57, 0x25, 0xab, 0x61, 0xea, 0xa9, 0x57, 0x2c, 0x67, 0xeb, 0x06, 0x65, 0xad,
+	0x1a, 0x50, 0x85, 0xe2, 0x58, 0x5d, 0x37, 0x88, 0x81, 0xd9, 0xa4, 0x7d, 0x97, 0xaa, 0xcb, 0xa1,
+	0xa3, 0x27, 0xfe, 0xc6, 0x72, 0x72, 0x5b, 0xf1, 0x6b, 0x56, 0x0f, 0x34, 0xda, 0x0f, 0x1d, 0x9b,
+	0xfb, 0xd3, 0xaa, 0xd2, 0x36, 0x71, 0x81, 0x5e, 0x82, 0x49, 0x3d, 0x56, 0x59, 0x18, 0x1d, 0x18,
+	0xf2, 0x9d, 0x8a, 0x73, 0x56, 0xd5, 0x5b, 0x9d, 0x88, 0xd4, 0x61, 0x42, 0x0b, 0x48, 0x55, 0x93,
+	0xb0, 0xf2, 0xec, 0x30, 0x76, 0x7f, 0x26, 0x05, 0x9d, 0x44, 0x39, 0x30, 0xff, 0x02, 0x54, 0xc4,
+	0xca, 0x8c, 0x63, 0xdb, 0x50, 0xb5, 0x5b, 0x5e, 0xb4, 0xd4, 0xd5, 0xd4, 0xf4, 0xdc, 0xc0, 0x42,
+	0xa8, 0xf9, 0x5d, 0x03, 0x2e, 0x8a, 0xc7, 0xc5, 0x2c, 0x1a, 0x32, 0x1d, 0x12, 0x03, 0xe2, 0x70,
+	0x3e, 0x7e, 0x91, 0xbc, 0x2b, 0x13, 0x4f, 0xe9, 0x02, 0x32, 0xfd, 0x8d, 0xfa, 0x84, 0x98, 0x94,
+	0x23, 0x98, 0x7a, 0x4a, 0x26, 0x9c, 0x7a, 0x5b, 0x24, 0x9c, 0xca, 0x1d, 0x4f, 0x1c, 0xaf, 0x0b,
+	0x97, 0x76, 0x64, 0xa2, 0xa9, 0xef, 0xe4, 0xe0, 0x5c, 0x46, 0xb5, 0xb6, 0xbe, 0xf8, 0x8c, 0x0a,
+	0x87, 0xba, 0x26, 0x1c, 0x64, 0x46, 0xc2, 0x81, 0x1d, 0x9f, 0x29, 0x2b, 0x7e, 0xd7, 0x80, 0x0b,
+	0xfa, 0xec, 0x11, 0xb6, 0xe8, 0xd6, 0x2d, 0xf2, 0x0e, 0x8c, 0xde, 0xa3, 0x8e, 0x4b, 0x65, 0x08,
+	0x46, 0x9c, 0xdd, 0x4b, 0x9c, 0x0e, 0xf3, 0x42, 0xce, 0xf6, 0x4f, 0xf9, 0x52, 0x3e, 0x63, 0x09,
+	0x12, 0xb2, 0x28, 0x2a, 0xc7, 0xaf, 0xa7, 0x4c, 0x79, 0x53, 0x93, 0xf5, 0xa9, 0x63, 0x14, 0xe3,
+	0x9f, 0x87, 0x17, 0x8e, 0x21, 0x61, 0xe3, 0xc6, 0x46, 0x5e, 0x1d, 0x37, 0xdc, 0x57, 0x10, 0x4a,
+	0xde, 0x87, 0xa9, 0x0d, 0x11, 0x28, 0x26, 0x47, 0x43, 0x49, 0xee, 0x2e, 0x63, 0xc8, 0x6c, 0x39,
+	0x2c, 0x69, 0x64, 0xb6, 0xd7, 0xeb, 0x1f, 0x17, 0x3e, 0x0e, 0x2f, 0xc3, 0xe8, 0x3d, 0x5f, 0xc9,
+	0xba, 0x8d, 0x83, 0x8b, 0xef, 0x59, 0x79, 0xae, 0x25, 0x8a, 0x62, 0x63, 0x2d, 0x97, 0x79, 0x15,
+	0xf1, 0x4d, 0x03, 0x2a, 0x3a, 0xef, 0x4f, 0xdb, 0xdf, 0xef, 0x69, 0xfd, 0xfd, 0x42, 0x76, 0x7f,
+	0x0f, 0xee, 0xe8, 0xbe, 0x64, 0x0c, 0x43, 0xf5, 0xb0, 0x09, 0xa3, 0x8b, 0x7e, 0xdb, 0xf1, 0x3a,
+	0x6a, 0x02, 0x01, 0x17, 0x21, 0x96, 0x28, 0x51, 0x7a, 0x2b, 0x3f, 0xb0, 0xb7, 0xcc, 0x6f, 0x17,
+	0xe0, 0xa2, 0x45, 0x77, 0x3d, 0xa6, 0xf5, 0x6c, 0x86, 0x5e, 0x67, 0x57, 0xbb, 0x28, 0x32, 0x53,
+	0x1d, 0x2e, 0xdc, 0xe3, 0x18, 0x24, 0xee, 0xef, 0x6b, 0x50, 0x64, 0xa2, 0x57, 0xe9, 0x73, 0xb4,
+	0x64, 0x30, 0x0d, 0x0e, 0x76, 0x7c, 0x5c, 0x4c, 0xae, 0x8b, 0x8d, 0x41, 0x71, 0x60, 0x66, 0x1b,
+	0x43, 0xea, 0x39, 0x6e, 0xbe, 0x39, 0xc4, 0x9a, 0x52, 0x61, 0x80, 0xa6, 0xf4, 0x00, 0xce, 0xd6,
+	0x5c, 0x2e, 0x74, 0x9c, 0xd6, 0x7a, 0xe0, 0x75, 0x9a, 0x5e, 0xd7, 0x69, 0x49, 0x4d, 0x9b, 0x3f,
+	0x4e, 0x1e, 0x97, 0xdb, 0xdd, 0x18, 0xc1, 0xca, 0x24, 0x63, 0xcd, 0x58, 0x5c, 0x6d, 0xf0, 0x2c,
+	0x27, 0xa3, 0xc8, 0x02, 0x9b, 0xe1, 0x76, 0x42, 0x9e, 0xe6, 0xc4, 0x8a, 0x8b, 0x51, 0x47, 0xc3,
+	0x18, 0x86, 0x8d, 0x95, 0xc6, 0x7d, 0x11, 0x13, 0x20, 0xfd, 0xab, 0x78, 0xc8, 0x43, 0xd4, 0x0a,
+	0xd1, 0x28, 0xd7, 0xf0, 0x12, 0xba, 0x46, 0xe3, 0x1e, 0xa3, 0x2b, 0xf6, 0xd1, 0x85, 0xe1, 0x9e,
+	0x4a, 0xc7, 0xf1, 0x98, 0xfd, 0xcf, 0x3d, 0x54, 0x70, 0x42, 0x94, 0x12, 0x8d, 0x2e, 0x40, 0x28,
+	0xd7, 0xe8, 0x14, 0x14, 0xf2, 0x2e, 0xcc, 0x2c, 0x2d, 0xcc, 0x4b, 0x67, 0xff, 0x45, 0xbf, 0xd9,
+	0x6b, 0xd3, 0x4e, 0x84, 0xc1, 0x27, 0x65, 0x3e, 0x86, 0xb4, 0x39, 0xcf, 0x66, 0x41, 0x16, 0x9a,
+	0x70, 0xf9, 0xe7, 0x01, 0x63, 0x0b, 0xbe, 0x4b, 0xc3, 0xad, 0x9b, 0xcf, 0x99, 0xcb, 0xbf, 0xd2,
+	0x36, 0x5c, 0x6d, 0x37, 0x33, 0x57, 0xe6, 0xdf, 0x45, 0x97, 0xff, 0x3e, 0x5c, 0xf2, 0x93, 0x30,
+	0x82, 0x3f, 0xc5, 0x36, 0x3a, 0x93, 0xc1, 0x36, 0xd9, 0x42, 0x9b, 0x3c, 0x61, 0x05, 0x12, 0x90,
+	0xe5, 0x24, 0x23, 0xfd, 0x29, 0x1c, 0x57, 0x45, 0xd4, 0xa9, 0xfe, 0x14, 0x89, 0x0b, 0x65, 0xf5,
+	0x83, 0x6c, 0x8e, 0xdc, 0x73, 0xc2, 0x3d, 0xea, 0x2e, 0xc8, 0xc7, 0x04, 0xcb, 0x7c, 0x8e, 0xec,
+	0x21, 0x14, 0x9f, 0x49, 0xb1, 0x14, 0x14, 0x26, 0x1d, 0x96, 0xc3, 0xcd, 0x50, 0x54, 0x45, 0x98,
+	0x36, 0x1e, 0x9a, 0xa4, 0xae, 0x25, 0x8a, 0x50, 0x5a, 0xca, 0x84, 0x8c, 0x81, 0xd3, 0xdc, 0xa7,
+	0xc1, 0xd6, 0xcd, 0xcf, 0x42, 0x5a, 0xea, 0xdf, 0x38, 0x66, 0x4c, 0x7e, 0xa3, 0x18, 0xe7, 0x5b,
+	0xd1, 0x90, 0x99, 0xe2, 0x97, 0x5c, 0xb7, 0x1b, 0x89, 0xe2, 0x97, 0x5c, 0xb7, 0xab, 0x8a, 0x5f,
+	0x8c, 0x1a, 0xa7, 0xc3, 0xcd, 0x9d, 0x90, 0x0e, 0x77, 0x40, 0x06, 0x6e, 0xe9, 0xa9, 0xf9, 0x1c,
+	0x3d, 0x46, 0xf0, 0x25, 0x28, 0xd7, 0xa2, 0xc8, 0x69, 0xee, 0x51, 0x17, 0xd3, 0x2e, 0x2b, 0xb7,
+	0x7c, 0x8e, 0x80, 0xab, 0x3e, 0x60, 0x2a, 0xae, 0xf2, 0x18, 0xc9, 0xd8, 0x10, 0x8f, 0x91, 0xcc,
+	0xc1, 0xd8, 0x72, 0xe7, 0x91, 0xc7, 0xfa, 0xa4, 0x98, 0x64, 0x7c, 0xf0, 0x38, 0x48, 0x7f, 0xc1,
+	0x02, 0x41, 0xe4, 0x6d, 0x28, 0xb2, 0x4d, 0x07, 0x63, 0x97, 0x4b, 0x89, 0x7e, 0x2e, 0x9e, 0x41,
+	0xde, 0x13, 0x45, 0xea, 0x21, 0xb2, 0x44, 0x27, 0xb7, 0x61, 0x4c, 0x9a, 0xc4, 0x90, 0xe8, 0xe4,
+	0x82, 0xd2, 0xe1, 0x25, 0x5a, 0x92, 0x09, 0x61, 0x12, 0xbf, 0xab, 0x07, 0x85, 0x8c, 0x2b, 0xc1,
+	0xd6, 0x4a, 0x50, 0x88, 0x16, 0x6c, 0xad, 0x84, 0x87, 0xc4, 0x16, 0x4e, 0xf9, 0x44, 0x0b, 0x67,
+	0x0b, 0xca, 0xeb, 0x4e, 0x10, 0x79, 0x6c, 0x3b, 0xea, 0x44, 0x3c, 0x57, 0x56, 0x62, 0x80, 0x2b,
+	0x45, 0xf5, 0x97, 0x64, 0xd0, 0x71, 0x57, 0xc1, 0xd7, 0xa3, 0x55, 0x13, 0x38, 0x59, 0xcd, 0x70,
+	0x1b, 0x14, 0x99, 0x1d, 0xf1, 0x5e, 0x4f, 0x39, 0x8d, 0x12, 0x2d, 0x52, 0xcf, 0xc7, 0xfb, 0x3d,
+	0x0e, 0x6f, 0xf1, 0x31, 0x40, 0x43, 0x70, 0x0a, 0xd9, 0x60, 0xca, 0x10, 0xd4, 0x2b, 0x52, 0xd6,
+	0x60, 0x8c, 0x48, 0xbe, 0x0e, 0x65, 0xf6, 0x3f, 0x26, 0x0e, 0xf2, 0x28, 0xcf, 0x85, 0x95, 0xb8,
+	0x91, 0xe9, 0x0b, 0x9a, 0x67, 0x17, 0x6a, 0xd0, 0x88, 0x2f, 0x60, 0x64, 0x9c, 0x3e, 0x4d, 0xd1,
+	0xb8, 0x99, 0x3f, 0x34, 0xe0, 0xc2, 0x00, 0x1e, 0x43, 0x3f, 0x43, 0x34, 0x97, 0x6c, 0x48, 0x8a,
+	0xc1, 0x2d, 0x36, 0x24, 0x75, 0x62, 0xc8, 0xad, 0x29, 0x3b, 0x8b, 0x55, 0xfe, 0x33, 0xcb, 0x62,
+	0x65, 0x1e, 0x1a, 0x30, 0xae, 0x8c, 0xec, 0x53, 0x7c, 0x5d, 0xe0, 0x35, 0x91, 0xce, 0x31, 0x9f,
+	0xe0, 0xa5, 0x1e, 0x15, 0xe6, 0xe9, 0x1b, 0xbf, 0x01, 0xb0, 0xe2, 0x84, 0x51, 0xad, 0x19, 0x79,
+	0x8f, 0xe8, 0x10, 0x62, 0x2c, 0x89, 0xbe, 0x77, 0x30, 0x3b, 0x2a, 0x23, 0xeb, 0x8b, 0xbe, 0x8f,
+	0x19, 0x9a, 0xab, 0x30, 0xda, 0xf0, 0x83, 0xa8, 0x7e, 0xc0, 0xf7, 0xa6, 0x45, 0x1a, 0x36, 0xd5,
+	0x63, 0x37, 0x0f, 0x0d, 0xf0, 0xa6, 0x25, 0x8a, 0x98, 0x82, 0x78, 0xc7, 0xa3, 0x2d, 0x57, 0xbd,
+	0x76, 0x79, 0xc8, 0x00, 0x16, 0x87, 0x5f, 0xff, 0x00, 0xa6, 0x64, 0x46, 0xb9, 0x8d, 0x95, 0x06,
+	0xb6, 0x60, 0x0a, 0xc6, 0xb7, 0x96, 0xac, 0xe5, 0x3b, 0x5f, 0xb5, 0xef, 0x6c, 0xae, 0xac, 0x54,
+	0xce, 0x90, 0x09, 0x28, 0x09, 0xc0, 0x42, 0xad, 0x62, 0x90, 0x32, 0x14, 0x97, 0x57, 0x1b, 0x4b,
+	0x0b, 0x9b, 0xd6, 0x52, 0x25, 0x77, 0xfd, 0x55, 0x98, 0x4c, 0x2e, 0x55, 0x30, 0xf0, 0x72, 0x0c,
+	0xf2, 0x56, 0x6d, 0xbb, 0x72, 0x86, 0x00, 0x8c, 0xae, 0xdf, 0x5f, 0x68, 0xdc, 0xbc, 0x59, 0x31,
+	0xae, 0x7f, 0x21, 0xe3, 0x25, 0x67, 0xc6, 0xa9, 0x41, 0xbb, 0x4e, 0xe0, 0x44, 0x94, 0x7f, 0xe6,
+	0x41, 0xaf, 0x15, 0x79, 0xdd, 0x16, 0x7d, 0x52, 0x31, 0xae, 0xbf, 0xdd, 0xf7, 0x20, 0x33, 0x39,
+	0x07, 0xd3, 0x9b, 0xab, 0xb5, 0x07, 0xf5, 0xe5, 0xbb, 0x9b, 0x6b, 0x9b, 0x0d, 0xfb, 0x41, 0x6d,
+	0x63, 0xe1, 0x5e, 0xe5, 0x0c, 0xab, 0xf0, 0x83, 0xb5, 0xc6, 0x86, 0x6d, 0x2d, 0x2d, 0x2c, 0xad,
+	0x6e, 0x54, 0x8c, 0xeb, 0xbf, 0x66, 0xc0, 0xa4, 0xfe, 0xc4, 0x1d, 0xb9, 0x02, 0x97, 0x37, 0x1b,
+	0x4b, 0x96, 0xbd, 0xb1, 0x76, 0x7f, 0x69, 0xd5, 0xde, 0x6c, 0xd4, 0xee, 0x2e, 0xd9, 0x9b, 0xab,
+	0x8d, 0xf5, 0xa5, 0x85, 0xe5, 0x3b, 0xcb, 0x4b, 0x8b, 0x95, 0x33, 0xa4, 0x0a, 0x2f, 0x28, 0x18,
+	0xd6, 0xd2, 0xc2, 0xda, 0xd6, 0x92, 0x65, 0xaf, 0xd7, 0x1a, 0x8d, 0xed, 0x35, 0x6b, 0xb1, 0x62,
+	0x90, 0x4b, 0x70, 0x3e, 0x03, 0xe1, 0xc1, 0x9d, 0x5a, 0x25, 0xd7, 0x57, 0xb6, 0xba, 0xb4, 0x5d,
+	0x5b, 0xb1, 0xeb, 0x6b, 0x1b, 0x95, 0xfc, 0xf5, 0x0f, 0x98, 0x16, 0x92, 0xbc, 0x41, 0x41, 0x8a,
+	0x50, 0x58, 0x5d, 0x5b, 0x5d, 0xaa, 0x9c, 0x21, 0xe3, 0x30, 0xb6, 0xbe, 0xb4, 0xba, 0xb8, 0xbc,
+	0x7a, 0x97, 0x77, 0x6b, 0x6d, 0x7d, 0xdd, 0x5a, 0xdb, 0x5a, 0x5a, 0xac, 0xe4, 0x58, 0xdf, 0x2d,
+	0x2e, 0xad, 0xb2, 0x9a, 0xe5, 0xaf, 0x9b, 0x3c, 0xef, 0xb2, 0x96, 0x36, 0x94, 0xf5, 0xd6, 0xd2,
+	0x57, 0x36, 0x96, 0x56, 0x1b, 0xcb, 0x6b, 0xab, 0x95, 0x33, 0xd7, 0x2f, 0xa7, 0x70, 0xe4, 0x48,
+	0x34, 0x1a, 0xf7, 0x2a, 0x67, 0xae, 0x7f, 0x1d, 0xca, 0xea, 0x26, 0x4c, 0x2e, 0xc0, 0x8c, 0xfa,
+	0x7b, 0x9d, 0x76, 0x5c, 0xaf, 0xb3, 0x5b, 0x39, 0x93, 0x2e, 0xb0, 0x7a, 0x9d, 0x0e, 0x2b, 0xc0,
+	0xc6, 0xab, 0x05, 0x1b, 0x34, 0x68, 0x7b, 0x1d, 0xb6, 0xbf, 0x56, 0x72, 0xf5, 0xca, 0xf7, 0xff,
+	0xe2, 0xa5, 0x33, 0xdf, 0xff, 0xc1, 0x4b, 0xc6, 0x9f, 0xfe, 0xe0, 0x25, 0xe3, 0xbf, 0xfd, 0xe0,
+	0x25, 0x63, 0x67, 0x14, 0x27, 0xfa, 0xad, 0xff, 0x1f, 0x00, 0x00, 0xff, 0xff, 0x0e, 0x77, 0x83,
+	0xa8, 0x44, 0xb5, 0x00, 0x00,
 }
 
 func (m *KeepAlive) Marshal() (dAtA []byte, err error) {
@@ -19622,13 +19616,6 @@ func (m *WindowsDesktopServiceSpecV3) MarshalToSizedBuffer(dAtA []byte) (int, er
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.Hostname) > 0 {
-		i -= len(m.Hostname)
-		copy(dAtA[i:], m.Hostname)
-		i = encodeVarintTypes(dAtA, i, uint64(len(m.Hostname)))
-		i--
-		dAtA[i] = 0x1a
-	}
 	if len(m.TeleportVersion) > 0 {
 		i -= len(m.TeleportVersion)
 		copy(dAtA[i:], m.TeleportVersion)
@@ -24843,10 +24830,6 @@ func (m *WindowsDesktopServiceSpecV3) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTypes(uint64(l))
 	}
-	l = len(m.Hostname)
-	if l > 0 {
-		n += 1 + l + sovTypes(uint64(l))
-	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -55100,38 +55083,6 @@ func (m *WindowsDesktopServiceSpecV3) Unmarshal(dAtA []byte) error {
 			}
 			m.TeleportVersion = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Hostname", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTypes
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthTypes
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthTypes
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Hostname = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
diff --git a/api/types/types.proto b/api/types/types.proto
index c123c47bd1585..058fa01a12616 100644
--- a/api/types/types.proto
+++ b/api/types/types.proto
@@ -2776,15 +2776,10 @@ message WindowsDesktopServiceSpecV3 {
     string Addr = 1 [ (gogoproto.jsontag) = "addr" ];
     // TeleportVersion is teleport binary version running this service.
     string TeleportVersion = 2 [ (gogoproto.jsontag) = "teleport_version" ];
-    // Hostname is the desktop service hostname.
-    string Hostname = 3 [ (gogoproto.jsontag) = "hostname" ];
 }
 
-// WindowsDesktopFilter are filters to apply when searching for windows desktops.
 message WindowsDesktopFilter {
-    // HostID is the ID of the host the Windows Desktop Service proxying the desktop.
     string HostID = 1 [ (gogoproto.jsontag) = "host_id" ];
-    // Name is the name of the desktop.
     string Name = 2 [ (gogoproto.jsontag) = "name" ];
 }
 
diff --git a/assets/aws/Makefile b/assets/aws/Makefile
index 2de8319b906c5..d2c2c39a42fc6 100644
--- a/assets/aws/Makefile
+++ b/assets/aws/Makefile
@@ -14,7 +14,7 @@ AWS_REGION ?= us-west-2
 # This must be a _released_ version of Teleport, i.e. one which has binaries
 # available for download on https://gravitational.com/teleport/download
 # Unreleased versions will fail to build.
-TELEPORT_VERSION ?= 9.0.1
+TELEPORT_VERSION ?= 8.3.1
 
 # Teleport UID is the UID of a non-privileged 'teleport' user
 TELEPORT_UID ?= 1007
diff --git a/assets/backport/main.go b/assets/backport/main.go
index 804bca8d3aabc..f8bd1eca3b400 100644
--- a/assets/backport/main.go
+++ b/assets/backport/main.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -99,7 +100,7 @@ func getGithubToken() (string, error) {
 		return "", trace.Wrap(err)
 	}
 	ghConfigPath := filepath.Join(dirname, githubConfigPath)
-	yamlFile, err := os.ReadFile(ghConfigPath)
+	yamlFile, err := ioutil.ReadFile(ghConfigPath)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
diff --git a/assets/loadtest/k8s/Makefile b/assets/loadtest/k8s/Makefile
index 71f785b0b3260..915636397cc06 100644
--- a/assets/loadtest/k8s/Makefile
+++ b/assets/loadtest/k8s/Makefile
@@ -115,7 +115,7 @@ install-teleport: install-auth install-proxy install-node install-iot-node
 .PHONY: delete-teleport
 delete-teleport: delete-tc delete-nodes delete-proxy delete-auth
 
-# installs grafana, influxdb, and prometheus
+# installs grafana and influxdb
 .PHONY: install-monitor
 install-monitor:
 	kubectl create configmap grafana-config -n loadtest \
@@ -128,16 +128,13 @@ install-monitor:
 	kubectl apply -f influxdb.yaml
 	@make expand-yaml FILENAME=grafana
 	kubectl apply -f grafana-gen.yaml
-	@make expand-yaml FILENAME=prometheus
-	kubectl apply -f prometheus-gen.yaml
 
-# deletes grafana, influxdb, and prometheus deployments, services and configmaps
+# deletes grafana and influxdb deployments, services and configmaps
 .PHONY: delete-monitor
 delete-monitor:
 	kubectl delete -f influxdb.yaml --ignore-not-found
 	kubectl delete -f grafana-gen.yaml --ignore-not-found
 	kubectl delete configmap grafana-config -n loadtest --ignore-not-found
-	kubectl delete -f prometheus-gen.yaml --ignore-not-found
 
 # installs an etcd cluster
 .PHONY: install-etcd
@@ -463,4 +460,4 @@ fetch-profiles:
 # output file will be named the same with a -gen suffix, i.e input = test then output will be test-gen.yaml
 .PHONY: expand-yaml
 expand-yaml:
-	@bash -c "set -a && source ./secrets/secrets.env && set +a && envsubst < $(FILENAME).yaml > $(FILENAME)-gen.yaml"
+	@bash -c "set -a && source ./secrets/secrets.env && set +a && envsubst < $(FILENAME).yaml > $(FILENAME)-gen.yaml"
\ No newline at end of file
diff --git a/assets/loadtest/k8s/auth-etcd.yaml b/assets/loadtest/k8s/auth-etcd.yaml
index 049df023b70de..15d648055ec69 100644
--- a/assets/loadtest/k8s/auth-etcd.yaml
+++ b/assets/loadtest/k8s/auth-etcd.yaml
@@ -14,9 +14,6 @@ spec:
     metadata:
       labels:
         teleport-role: auth
-        backend: etcd
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "3434"
     spec:
       volumes:
         - name: config
diff --git a/assets/loadtest/k8s/auth-firestore.yaml b/assets/loadtest/k8s/auth-firestore.yaml
index 3b5c3c3affbd5..a3acd6d26cfdb 100644
--- a/assets/loadtest/k8s/auth-firestore.yaml
+++ b/assets/loadtest/k8s/auth-firestore.yaml
@@ -14,9 +14,6 @@ spec:
     metadata:
       labels:
         teleport-role: auth
-        backend: firestore
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "3434"
     spec:
       volumes:
         - name: config
diff --git a/assets/loadtest/k8s/prometheus.yaml b/assets/loadtest/k8s/prometheus.yaml
deleted file mode 100644
index 3649f3f7f92d0..0000000000000
--- a/assets/loadtest/k8s/prometheus.yaml
+++ /dev/null
@@ -1,291 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: prometheus-loadtest
----
-# Source: prometheus/templates/server/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-  namespace: prometheus-loadtest
-  annotations:
-    {}
----
-# Source: prometheus/templates/server/cm.yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-  namespace: prometheus-loadtest
-data:
-  alerting_rules.yml: |
-    {}
-  alerts: |
-    {}
-  prometheus.yml: |
-    global:
-      evaluation_interval: 1m
-      scrape_interval: 1m
-      scrape_timeout: 10s
-    remote_write:
-    - url: ${PROM_REMOTE_URL}
-      basic_auth:
-        username: ${PROM_USER}
-        password: ${PROM_PASSWORD}
-    rule_files:
-    - /etc/config/recording_rules.yml
-    - /etc/config/alerting_rules.yml
-    - /etc/config/rules
-    - /etc/config/alerts
-    scrape_configs:
-    - job_name: kubernetes-pods
-      kubernetes_sd_configs:
-      - role: pod
-      relabel_configs:
-      - action: keep
-        regex: true
-        source_labels:
-        - __meta_kubernetes_pod_annotation_prometheus_io_scrape
-      - action: drop
-        regex: true
-        source_labels:
-        - __meta_kubernetes_pod_annotation_prometheus_io_scrape_slow
-      - action: replace
-        regex: (https?)
-        source_labels:
-        - __meta_kubernetes_pod_annotation_prometheus_io_scheme
-        target_label: __scheme__
-      - action: replace
-        regex: (.+)
-        source_labels:
-        - __meta_kubernetes_pod_annotation_prometheus_io_path
-        target_label: __metrics_path__
-      - action: replace
-        regex: ([^:]+)(?::\d+)?;(\d+)
-        replacement: $1:$2
-        source_labels:
-        - __address__
-        - __meta_kubernetes_pod_annotation_prometheus_io_port
-        target_label: __address__
-      - action: labelmap
-        regex: __meta_kubernetes_pod_annotation_prometheus_io_param_(.+)
-        replacement: __param_$1
-      - action: labelmap
-        regex: __meta_kubernetes_pod_label_(.+)
-      - action: replace
-        source_labels:
-        - __meta_kubernetes_namespace
-        target_label: namespace
-      - action: replace
-        source_labels:
-        - __meta_kubernetes_pod_name
-        target_label: pod
-      - action: drop
-        regex: Pending|Succeeded|Failed|Completed
-        source_labels:
-        - __meta_kubernetes_pod_phase
-  recording_rules.yml: |
-    {}
-  rules: |
-    {}
----
-# Source: prometheus/templates/server/clusterrole.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-      - nodes/proxy
-      - nodes/metrics
-      - services
-      - endpoints
-      - pods
-      - ingresses
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - "extensions"
-      - "networking.k8s.io"
-    resources:
-      - ingresses/status
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - nonResourceURLs:
-      - "/metrics"
-    verbs:
-      - get
----
-# Source: prometheus/templates/server/clusterrolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-subjects:
-  - kind: ServiceAccount
-    name: prometheus-server
-    namespace: prometheus-loadtest
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: prometheus-server
----
-# Source: prometheus/templates/server/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-  namespace: prometheus-loadtest
-spec:
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: 9090
-  selector:
-    component: "server"
-    app: prometheus
-    release: prometheus
-  sessionAffinity: None
-  type: "ClusterIP"
----
-# Source: prometheus/templates/server/deploy.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    component: "server"
-    app: prometheus
-    release: prometheus
-    chart: prometheus-15.4.0
-    heritage: Helm
-  name: prometheus-server
-  namespace: prometheus-loadtest
-spec:
-  selector:
-    matchLabels:
-      component: "server"
-      app: prometheus
-      release: prometheus
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        component: "server"
-        app: prometheus
-        release: prometheus
-        chart: prometheus-15.4.0
-        heritage: Helm
-    spec:
-      enableServiceLinks: true
-      serviceAccountName: prometheus-server
-      containers:
-        - name: prometheus-server-configmap-reload
-          image: "jimmidyson/configmap-reload:v0.5.0"
-          imagePullPolicy: "IfNotPresent"
-          args:
-            - --volume-dir=/etc/config
-            - --webhook-url=http://127.0.0.1:9090/-/reload
-          resources:
-            {}
-          volumeMounts:
-            - name: config-volume
-              mountPath: /etc/config
-              readOnly: true
-
-        - name: prometheus-server
-          image: "quay.io/prometheus/prometheus:v2.31.1"
-          imagePullPolicy: "IfNotPresent"
-          args:
-            - --storage.tsdb.retention.time=15d
-            - --config.file=/etc/config/prometheus.yml
-            - --storage.tsdb.path=/data
-            - --web.console.libraries=/etc/prometheus/console_libraries
-            - --web.console.templates=/etc/prometheus/consoles
-            - --web.enable-lifecycle
-          ports:
-            - containerPort: 9090
-          readinessProbe:
-            httpGet:
-              path: /-/ready
-              port: 9090
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 5
-            timeoutSeconds: 4
-            failureThreshold: 3
-            successThreshold: 1
-          livenessProbe:
-            httpGet:
-              path: /-/healthy
-              port: 9090
-              scheme: HTTP
-            initialDelaySeconds: 30
-            periodSeconds: 15
-            timeoutSeconds: 10
-            failureThreshold: 3
-            successThreshold: 1
-          resources:
-            {}
-          volumeMounts:
-            - name: config-volume
-              mountPath: /etc/config
-            - name: storage-volume
-              mountPath: /data
-              subPath: ""
-      hostNetwork: false
-      dnsPolicy: ClusterFirst
-      securityContext:
-        fsGroup: 65534
-        runAsGroup: 65534
-        runAsNonRoot: true
-        runAsUser: 65534
-      terminationGracePeriodSeconds: 300
-      volumes:
-        - name: config-volume
-          configMap:
-            name: prometheus-server
-        - name: storage-volume
-          emptyDir:
-            {}
diff --git a/assets/loadtest/k8s/proxy.yaml b/assets/loadtest/k8s/proxy.yaml
index 4fd0dac33816e..4ef2396e8cb64 100644
--- a/assets/loadtest/k8s/proxy.yaml
+++ b/assets/loadtest/k8s/proxy.yaml
@@ -14,8 +14,6 @@ spec:
     metadata:
       labels:
         teleport-role: proxy
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "3434"
     spec:
       volumes:
         - name: config
@@ -102,4 +100,4 @@ spec:
     targetPort: 3036
     protocol: TCP
   selector:
-    teleport-role: proxy
+    teleport-role: proxy
\ No newline at end of file
diff --git a/assets/loadtest/k8s/secrets/Makefile b/assets/loadtest/k8s/secrets/Makefile
index 6151d28f801d0..c0110552f208e 100644
--- a/assets/loadtest/k8s/secrets/Makefile
+++ b/assets/loadtest/k8s/secrets/Makefile
@@ -23,21 +23,6 @@ env:
 		exit 1; \
 	fi
 
-	@if [ -z ${PROM_REMOTE_URL} ]; then \
-		echo "PROM_REMOTE_URL is not set, cannot apply cluster."; \
-		exit 1; \
-	fi
-
-	@if [ -z ${PROM_USER} ]; then \
-		echo "PROM_USER is not set, cannot apply cluster."; \
-		exit 1; \
-	fi
-
-	@if [ -z ${PROM_PASSWORD} ]; then \
-		echo "PROM_PASSWORD is not set, cannot apply cluster."; \
-		exit 1; \
-	fi
-
 	@echo PROXY_IP=$(shell make -C ../../network get-proxy-ip) > secrets.env
 	@echo PROXY_HOST=${PROXY_HOST} >> secrets.env
 	@echo GRAFANA_IP=$(shell make -C ../../network get-grafana-ip) >> secrets.env
@@ -46,9 +31,6 @@ env:
 	@echo PROXY_TOKEN=$(shell cat proxy-token) >> secrets.env
 	@echo TC_TOKEN=$(shell cat tc-token) >> secrets.env
 	@echo GCP_PROJECT=$(shell make -C ../../cluster get-project) >> secrets.env
-	@echo PROM_REMOTE_URL=${PROM_REMOTE_URL} >> secrets.env
-	@echo PROM_USER=${PROM_USER} >> secrets.env
-	@echo PROM_PASSWORD=${PROM_PASSWORD} >> secrets.env
 
 grafana-pass:
 	openssl rand -base64 32 | tr -d '\n' > grafana-pass
@@ -74,4 +56,4 @@ join-tokens: node-token proxy-token tc-token
 # removes everything
 .PHONY:clean
 clean:
-	rm -rf *-pass *-token *-auth *.env
+	rm -rf *-pass *-token *-auth *.env
\ No newline at end of file
diff --git a/build.assets/Dockerfile b/build.assets/Dockerfile
index 171abbb1b11a9..8158548290341 100644
--- a/build.assets/Dockerfile
+++ b/build.assets/Dockerfile
@@ -114,11 +114,6 @@ RUN (curl -L https://github.com/golangci/golangci-lint/releases/download/v1.44.0
 RUN (mkdir -p helm-tarball && curl -L https://get.helm.sh/helm-v3.5.2-$(go env GOOS)-$(go env GOARCH).tar.gz | tar -C helm-tarball -xz && \
      cp helm-tarball/$(go env GOOS)-$(go env GOARCH)/helm /bin/ && \
      rm -r helm-tarball*)
-RUN helm plugin install https://github.com/vbehar/helm3-unittest && \
-    mkdir -p /home/ci/.local/share/helm && \
-    cp -r /root/.local/share/helm/plugins /home/ci/.local/share/helm && \
-    chown -R ci /home/ci/.local/share/helm && \
-    HELM_PLUGINS=/home/ci/.local/share/helm/plugins helm plugin list
 
 # Install bats.
 RUN (curl -L https://github.com/bats-core/bats-core/archive/v1.2.1.tar.gz | tar -xz && \
diff --git a/build.assets/Makefile b/build.assets/Makefile
index b6f1659ef0f50..587054299b88c 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -247,16 +247,6 @@ test-sh: buildbox
 	docker run $(DOCKERFLAGS) $(NOROOT) -t $(BUILDBOX) \
 		/bin/bash -c "make -C $(SRCDIR) BATSFLAGS=$(BATSFLAGS) test-sh"
 
-.PHONY:test-helm
-test-helm: buildbox
-	docker run $(DOCKERFLAGS) $(NOROOT) -t $(BUILDBOX) \
-		/bin/bash -c "make -C $(SRCDIR) test-helm"
-
-.PHONY:test-helm-update-snapshots
-test-helm-update-snapshots:
-	docker run $(DOCKERFLAGS) $(NOROOT) -t $(BUILDBOX) \
-		/bin/bash -c "make -C $(SRCDIR) test-helm-update-snapshots"
-
 .PHONY:integration
 integration: buildbox
 	docker run \
diff --git a/build.assets/build-package.sh b/build.assets/build-package.sh
index 22d90fd713d09..17e1bfbc52eb6 100755
--- a/build.assets/build-package.sh
+++ b/build.assets/build-package.sh
@@ -232,7 +232,7 @@ if [[ "${PACKAGE_TYPE}" == "pkg" ]]; then
         BUNDLE_ID="com.gravitational.teleport.tsh"
         PKG_FILENAME="tsh-${TELEPORT_VERSION}.${PACKAGE_TYPE}"
     else
-        FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport ${TAR_PATH}/tbot"
+        FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport"
         BUNDLE_ID="com.gravitational.teleport"
         if [[ "${TELEPORT_TYPE}" == "ent" ]]; then
             PKG_FILENAME="teleport-ent-${TELEPORT_VERSION}.${PACKAGE_TYPE}"
@@ -241,8 +241,8 @@ if [[ "${PACKAGE_TYPE}" == "pkg" ]]; then
         fi
     fi
 else
-    FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport ${TAR_PATH}/tbot ${TAR_PATH}/examples/systemd/teleport.service"
-    LINUX_BINARY_FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/tbot ${TAR_PATH}/teleport"
+    FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport ${TAR_PATH}/examples/systemd/teleport.service"
+    LINUX_BINARY_FILE_LIST="${TAR_PATH}/tsh ${TAR_PATH}/tctl ${TAR_PATH}/teleport"
     LINUX_SYSTEMD_FILE_LIST="${TAR_PATH}/examples/systemd/teleport.service"
     EXTRA_DOCKER_OPTIONS=""
     RPM_SIGN_STANZA=""
diff --git a/build.assets/gomod/update-api-import-path/main.go b/build.assets/gomod/update-api-import-path/main.go
index 0163e9c66ceaf..f89054b2976bc 100644
--- a/build.assets/gomod/update-api-import-path/main.go
+++ b/build.assets/gomod/update-api-import-path/main.go
@@ -52,17 +52,10 @@ func main() {
 		buildFlags = os.Args[1:]
 	}
 
-	newVersion, err := semver.NewVersion(api.Version)
-	if err != nil {
-		exitWithError(trace.Wrap(err, "invalid semver version"), nil)
-	}
-
-	// check the version's prelease section, and exit if it is a
-	// non beta/alpha pre release.
-	switch newVersion.PreRelease.Slice()[0] {
-	case "", "alpha", "beta":
-	default:
-		exitWithMessage("the current API version (%v) is not a release or alpha/beta pre-release, continue without updating", newVersion)
+	// the api module import path should only be updated on releases
+	newVersion := semver.New(api.Version)
+	if newVersion.PreRelease != "" {
+		exitWithMessage("the current API version (%v) is not a release, continue without updating", newVersion)
 	}
 
 	// get the current api module import path
diff --git a/build.assets/install b/build.assets/install
index dc6ff9d0cd39f..cc3bed422ccdb 100755
--- a/build.assets/install
+++ b/build.assets/install
@@ -13,7 +13,7 @@ VARDIR=/var/lib/teleport
 [ ! $(id -u) != "0" ] || { echo "ERROR: You must be root"; exit 1; }
 cd $(dirname $0)
 mkdir -p $VARDIR $BINDIR
-cp -f teleport tctl tsh tbot $BINDIR/ || exit 1
+cp -f teleport tctl tsh $BINDIR/ || exit 1
 
 #
 # What operating system is the user running?
diff --git a/build.assets/tooling/cmd/check/main.go b/build.assets/tooling/cmd/check/main.go
index ac1b8fe3172b6..16fb6dca2f6af 100644
--- a/build.assets/tooling/cmd/check/main.go
+++ b/build.assets/tooling/cmd/check/main.go
@@ -90,12 +90,6 @@ func checkLatest(ctx context.Context, tag string, gh github.GitHub) error {
 		if r.GetDraft() {
 			continue
 		}
-		// Because pre-releases are not published to apt, we do not want to
-		// consider them when making apt publishing decisions.
-		// see: https://github.com/gravitational/teleport/issues/10800
-		if semver.Prerelease(r.GetTagName()) != "" {
-			continue
-		}
 		tags = append(tags, r.GetTagName())
 	}
 
diff --git a/build.assets/tooling/cmd/check/main_test.go b/build.assets/tooling/cmd/check/main_test.go
index 3ca92aab1b9b2..4c2ab57368c7f 100644
--- a/build.assets/tooling/cmd/check/main_test.go
+++ b/build.assets/tooling/cmd/check/main_test.go
@@ -105,15 +105,6 @@ func TestCheckLatest(t *testing.T) {
 			},
 			wantErr: require.NoError,
 		},
-		{ // see https://github.com/gravitational/teleport/issues/10800
-			desc: "pass-pre-release",
-			tag:  "v8.3.3",
-			releases: []string{
-				"v9.0.0-beta.1",
-				"v8.3.2",
-			},
-			wantErr: require.NoError,
-		},
 	}
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
diff --git a/constants.go b/constants.go
index 1ab18552fc5ab..13bf738f230b4 100644
--- a/constants.go
+++ b/constants.go
@@ -631,10 +631,6 @@ const (
 
 	// EnvSSHSessionInvited is an environment variable listning people invited to a session.
 	EnvSSHSessionInvited = "TELEPORT_SESSION_JOIN_MODE"
-
-	// EnvSSHSessionDisplayParticipantRequirements is set to true or false to indicate if participant
-	// requirement information should be printed.
-	EnvSSHSessionDisplayParticipantRequirements = "TELEPORT_SESSION_PARTICIPANT_REQUIREMENTS"
 )
 
 const (
diff --git a/docker/teleport-ent-quickstart.yml b/docker/teleport-ent-quickstart.yml
index f6b25dde811d7..b68f11aa837da 100644
--- a/docker/teleport-ent-quickstart.yml
+++ b/docker/teleport-ent-quickstart.yml
@@ -3,7 +3,7 @@ services:
   # The configure container starts, generates a config, writes it to
   # /etc/teleport/teleport.yaml and then immediately exits.
   configure:
-    image: quay.io/gravitational/teleport-ent:9
+    image: quay.io/gravitational/teleport-ent:8
     container_name: teleport-configure
     entrypoint: /bin/sh
     hostname: localhost
@@ -14,7 +14,7 @@ services:
   # This container depends on the config written by the configure container above, so it
   # sleeps for a second on startup to allow the configure container to run first.
   teleport:
-    image: quay.io/gravitational/teleport-ent:9
+    image: quay.io/gravitational/teleport-ent:8
     container_name: teleport
     entrypoint: /bin/sh
     hostname: localhost
diff --git a/docker/teleport-lab.yml b/docker/teleport-lab.yml
index 3298d11034d5e..46655bd0304ed 100644
--- a/docker/teleport-lab.yml
+++ b/docker/teleport-lab.yml
@@ -3,7 +3,7 @@ services:
   # This container depends on the config written by the configure container above, so it
   # sleeps for a second on startup to allow the configure container to run first.
   teleport:
-    image: quay.io/gravitational/teleport-lab:9
+    image: quay.io/gravitational/teleport-lab:8
     container_name: teleport
     entrypoint: /bin/sh
     hostname: luna.teleport
@@ -24,7 +24,7 @@ services:
 
   # The bootstrap container generates certificates and then immediately exits.
   bootstrap:
-    image: quay.io/gravitational/teleport-lab:9
+    image: quay.io/gravitational/teleport-lab:8
     container_name: teleport-bootstrap
     entrypoint: /bin/sh
     command: -c "/etc/teleport.d/scripts/generate-certs.sh"
@@ -41,7 +41,7 @@ services:
   # openssh is a demo of openssh node
   #
   openssh:
-    image: quay.io/gravitational/teleport-lab:9
+    image: quay.io/gravitational/teleport-lab:8
     container_name: openssh
     hostname: mars.openssh.teleport
     entrypoint: /bin/sh
@@ -60,7 +60,7 @@ services:
   # term is a container with a terminal to try things out
   #
   term:
-    image: quay.io/gravitational/teleport-lab:9
+    image: quay.io/gravitational/teleport-lab:8
     hostname: term
     container_name: term
     entrypoint: /bin/sh
diff --git a/docker/teleport-quickstart.yml b/docker/teleport-quickstart.yml
index a8e1a7a7075d7..a78626201ac0e 100644
--- a/docker/teleport-quickstart.yml
+++ b/docker/teleport-quickstart.yml
@@ -3,7 +3,7 @@ services:
   # The configure container starts, generates a config, writes it to
   # /etc/teleport/teleport.yaml and then immediately exits.
   configure:
-    image: quay.io/gravitational/teleport:9
+    image: quay.io/gravitational/teleport:8
     container_name: teleport-configure
     entrypoint: /bin/sh
     hostname: localhost
@@ -14,7 +14,7 @@ services:
   # This container depends on the config written by the configure container above, so it
   # sleeps for a second on startup to allow the configure container to run first.
   teleport:
-    image: quay.io/gravitational/teleport:9
+    image: quay.io/gravitational/teleport:8
     container_name: teleport
     entrypoint: /bin/sh
     hostname: localhost
diff --git a/docs/config.json b/docs/config.json
index 3c409cf64aedd..d57ae33b2a23d 100644
--- a/docs/config.json
+++ b/docs/config.json
@@ -278,6 +278,10 @@
           "title": "Guides",
           "slug": "/server-access/guides/",
           "entries": [
+            {
+              "title": "Ansible",
+              "slug": "/server-access/guides/ansible/"
+            },
             {
               "title": "Using Teleport with PAM",
               "slug": "/server-access/guides/ssh-pam/"
@@ -344,6 +348,10 @@
               "title": "Federation",
               "slug": "/kubernetes-access/guides/federation/"
             },
+            {
+              "title": "Migration",
+              "slug": "/kubernetes-access/guides/migration/"
+            },
             {
               "title": "Standalone",
               "slug": "/kubernetes-access/guides/standalone-teleport/"
@@ -378,17 +386,7 @@
         },
         {
           "title": "Helm Chart Reference",
-          "slug": "/kubernetes-access/helm/reference/",
-          "entries": [
-            {
-              "title": "teleport-cluster",
-              "slug": "/kubernetes-access/helm/reference/teleport-cluster/"
-            },
-            {
-               "title": "teleport-kube-agent",
-               "slug": "/kubernetes-access/helm/reference/teleport-kube-agent/"
-            }
-          ]
+          "slug": "/kubernetes-access/helm/reference/"
         },
         {
           "title": "Access Controls",
@@ -452,10 +450,6 @@
               "title": "Self-Hosted CockroachDB",
               "slug": "/database-access/guides/cockroachdb-self-hosted/"
             },
-            {
-              "title": "Self-Hosted Redis",
-              "slug": "/database-access/guides/redis/"
-            },
             {
               "title": "SQL Server (Preview)",
               "slug": "/database-access/guides/sql-server-ad/"
@@ -523,34 +517,8 @@
           "slug": "/desktop-access/getting-started/"
         },
         {
-          "title": "Access Controls",
-          "slug": "/desktop-access/rbac/"
-        },
-        {
-          "title": "Reference",
-          "slug": "/desktop-access/reference/",
-          "entries": [
-            {
-              "title": "Configuration",
-              "slug": "/desktop-access/reference/configuration/"
-            },
-            {
-              "title": "Audit Events",
-              "slug": "/desktop-access/reference/audit/"
-            },
-            {
-              "title": "Clipboard Sharing",
-              "slug": "/desktop-access/reference/clipboard/"
-            },
-            {
-              "title": "Session Recording",
-              "slug": "/desktop-access/reference/sessions/"
-            },
-            {
-              "title": "CLI",
-              "slug": "/desktop-access/reference/cli/"
-            }
-          ]
+          "title": "Configuration",
+          "slug": "/desktop-access/reference/configuration/"
         },
         {
           "title": "Troubleshooting",
@@ -558,44 +526,6 @@
         }
       ]
     },
-    {
-      "icon": "wand",
-      "title": "Machine ID",
-      "entries": [
-        {
-          "title": "Introduction",
-          "slug": "/machine-id/introduction/"
-        },
-        {
-          "title": "Getting Started",
-          "slug": "/machine-id/getting-started/"
-        },
-        {
-          "title": "Reference",
-          "slug": "/machine-id/reference/",
-          "entries": [
-            {
-              "title": "Configuration",
-              "slug": "/machine-id/reference/configuration/"
-            },
-            {
-              "title": "CLI",
-              "slug": "/machine-id/reference/cli/"
-            }
-          ]
-        },
-        {
-          "title": "Guides",
-          "slug": "/machine-id/guides/",
-          "entries": [
-            {
-              "title": "Machine ID with Ansible",
-              "slug": "/machine-id/guides/ansible/"
-            }
-          ]
-        }
-      ]
-    },
     {
       "icon": "lock",
       "title": "Access Controls",
@@ -1092,11 +1022,6 @@
       "source": "/docs/best-practices/",
       "destination": "/contributing/documentation/",
       "permanent": true
-    },
-    {
-      "source": "/kubernetes-access/guides/migration/",
-      "destination": "/kubernetes-access/introduction/",
-      "permanent": true
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/docs/img/database-access/guides/redis/redisinsight-add-config.png b/docs/img/database-access/guides/redis/redisinsight-add-config.png
deleted file mode 100644
index da0298b6c6f02c69fd774aaaf84ec64cce2bcda5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 228417
zcmd43c|6o#`v**fN_JT@wk+AwB3WjXWh^1PB4bGrl6^O19orC6S;m?qTgev2uE@Si
zc7`EhEHh)4XMDH2`}zHT_x=3&c)e!ke3tY1oO7M)T<`aFo$G+zF#w-E&3l@Pit4P6
zwuUhk)yYUIDjEy}9pw!D3<EV46*bsdUHy)Zy1L*UPxpt;u8vex5-AS0wro1m5?}1>
zY;C{vNlBje^fQi)O)$2FcC~Z}whDIHb_r&^w6>n-W|^lkZKEnMYOQr)Oc2C>kp1$0
zcR07?{y^<*tI?E@3lCCiPQ3}_Xi0y5FN?8|OyzOU^QO@$8XAYw$z|3y##HuxR8zv5
zYGCRqFSSi?h9H{QY+5@2b?K>7o^&7FsisbR<$<YP;f7F6Dd}i0u4}u#Z4zu*T0}1u
zusnY7*lFQbOMPL)^U*jqmY-RWJ9pDw<rwA9GcXpJo*Za=pnCqK2#tsc9o?Om>ZVX8
z+L#LklRS}@Bw;$b_zFhGZ|p4gI#+nOYiciF(w?~$TOw_1JMV61JL%gjSS7)_Mb+gl
z-Raz=#i9Ubr=i(sB9lR-@|P+NAKGG-7s%wfcoLcXncInUo-Udufa<-0o&3Tl2?dH|
z%^fXu9_s5;U8Iy5sHkI{sc0!Bim<78DIdxJJddWLr~I-}J{q|v{=RxLGMDD>G7aYV
z#+xSUIy#hJ69-R6$0uG+?%r<Nrnf1Nnshd`^tRN$t>obDCTsV=-QH2w-|gvf6)F{f
zB}&oF(c4bY-_7-jmy*A#@E><5QOd`s<%9+QxW(H=RoGJhj-a}`r=y^P>?PSt!obsl
zf`TfZ4<0HRYiRvdopPiq?BwnJR7p<G&(BZR?~1Iu=Oa1!8#ivqUAioH`LYb<4jHe2
zC*F4cGEclj{(Q*a&(U!7a`1G1>h0|QMDX~zcJ}T*-m1dF$1nQl@6UER`aA#YO;5c3
z>K3Jga>rNX<Yh0({qt-}Rh8qjN_U+79bNBgIJ;5ALwN^K{*t`B${!W}$EAP0^0%s%
zzg4{|fBE;Szg_x&S2go;^i+3uqrB7`_^+|~tMcy`|Ej1Wcii{iWbvn<|2RvLH1M>F
z+&`lRJnhD@JVQmLMx~>1)6}1OGn>BdzGgj1you%c;4Nm_lHnk^6Q?EYZ{9SGvquJU
zZjZSf_IwI5E1x9$c1FL=-4kxo-PRWj<8amy+!w_SxQ_=MlKPc`5FZD0Zk-4~qV7I=
z*o^D>_SxbU@u8!y?l}=#+JrFHODD8i7`Unb|9@cln1S)`<5v(YOvLxh=i)0@GuBXk
z89&hZ?a`rl7MvbDNeLfVFSzkbb56I=FLY@eGcbYJ2K60D9qRos2_f%ex(DVSpIq1n
zN71;5Z=KN&`B79e0kMGw5`S(3@Hu8bWL`sy4iDv^<lR5NDvHR&(f~i-G6&jdAJ_U|
zZl-~e2Rrbv#8}!-`}5!mIo3U)$!<BODoAKrTs*VeroBOkT{;q<pN-*zW&^Uou>&9o
zw3&Pr7VjT|C0YFtArN*j6C3c=49*H<BPn6yarxN_Wa*=*90Z9p)S+&PJ<32r*YR)r
znT{J_2qjyeLqa_(lGrAYYxPO{#7ool&HO?wI{EAuW+w{-6rD!o_<EcQxU(LxO}#Tb
zn3Q<ojs21nI9e(Lm>w-S>(hag;>Sv<L?!;ZOahX<W!AG|QD^qwT37);Br1%uLZF;X
zg#CRByF4#-RQxumnY?C`?<H&_H(FrhhWny0eFq#&E_pg%u?^xpr*z%B8B1C^f^S_=
z5?|cErHUSV0e3xq$syu2Jqb@T`TzVF##PdYhR=<X_2mG0!`e`Lr*b7Dti@S$)+Kz#
ziCK;pYmlh1@(f!EzLjD9+gLU(zVwc#q|-Ei4{0+Qk6S{?NkybJlHO8UH*T)4Kk#}2
zqMy)6df!ixXy!6|>{?Kat~ZIaunowfA(2+LA%A_19UWO%8}5ALK!Aywl3BEJ3JdDX
z5e_@;1poOVEw};ECuHlfc6E^rSEpKq;%ItC=(<_g%gM2QtX{s%enYMZUB2RIHWJ5k
zhAW-bWNA*tJ@O0+uA!ux)R2q8S>)wo;$KuyhCQ%rt?>>|h2$KRB0>b$*pEUy-vH+v
zROGULFo94~IT)bPI{*MdDdq9^4YH<PLGKXAP}2B7Jo?E!Vj?OIfn<Fp1`H*cTdt|(
zub{T$$+%u(*uX3GLzs1l$Cr2*OA@)QHJ>3bfve=n7P`3aq|DqT93V`#%s_g_<q^B>
zk(b13>=$DsYGxVYa4W@^r`aJj9fBbFG>`?Kcqt)!4tqpc>T!yzK%xcKj|_bb)^d7?
zW{3LemTSQ~#EAhwwp1u7khrj)F@dmw9v#IXp=KKrq}||z4GAcD?^r)wZ2+TtA#HQW
zi`La|k`5Dn=a7+w<8zbiq<GLR$pqN>r4d7`ne#PO5Y#(DmBsy?f+T{G;oKR6tLt1d
zEtoJK<rtvGs@nYqf8m{*JFOx^&BLZ4N<wR>mK<a8SBvY5W+Yc*S}X5KqaIm{URb{3
zq>xg;RfUxTgt{AUJ#s|xL9t?oX(;|di~wI}9&-u;V_|v5ec@fr(<`L08wD6$#dVd%
ztX-VNeZOW>FnP!)Kd5X=q?!CI76EE-$Ky6oaxQ1fuJ2i!Ssk9O05y{4ZSqiY{p>%$
zb;W_im3=N$%mkuuBXZ-Ji^ic*1yZeJL+;0QNg^R+p$z0d?x9^*zE3EKgvJkO106Ib
zpkwby!`%UbK|QVSk-tRzO8M_LZN{JD>LqDsiqJj<Hu~SZ0>_^PFi*`#jD8;;DQ0Hp
zTWHe>PxM5KetoAUy?F!I(BLEgW^<@B^|r!AFFz3waG!vE4&Lz`!%+*x?;PS#8v}=c
zIcRB+UGST=fCUsBfwX~MoiJ?BGX0P=h#%OHs{l2TR^#55bEzs5hy?*;D!yN81Y-Lf
z=&!G(C=5}3z%R$G0bYBLJQR}?(J=k)k=YPyML+1GLbDuqKpvwxAT|tsCZHt=kk$eg
z4<hVSuj^eV#;Jd$f2V>j=nH42zaF}|oKdPt_Z&jniSHinsR&Rc590`lP#+?efWg&X
z-9l0%P7Dt_HY->XhEM^e*kIzsA>>%+_c0R#ltL%6HPOS+a+qKR*<fBdN9Mw5;LHrS
z`*Gm@9mjheX>z?0%QQE!EW$9|Y-SiuUSy>v91gs?|H!P$u7A&@=f&kNF4-NL1maYq
z#S`z8OG&tE^t-kn6?fU=X@>aILH!VgNh63gh5`o_UcD%Qg#`wGxIfWIM)Olsgc$q>
zC_pQq=R%0<6fK7Y)&vqe(QO+P3~*s9#gochA~Ee7hQ|^OwtEk{E8^K?+_f)!s2KSu
zCnxBl4|!?2o1SNLAAn&m?kBU>0_k>LzBQ1YTszbTCwz(=?qWq2z3y`B@kg|9_y;Ri
zl{3F$Rs%HRPu2kMtiH{p3YlCOU_}`s3?zb`M+{2{*e`$|v0Kg7SG&OH^8mMAabpE(
z`YLX865=)pU2`bN_6D+HIGDH&TsVSnQ>=xl-$@WOb0foG9ApFCvmviHqmR2`0}UW{
zhENSPeRv!|EIBGXp1y&^yFWM^Nx`IXM3&ckkA=NDdJoV&3OYPtn((hrZP+3&t9=n~
zzLZ1e1<T(XCsB=lkO;dtPg~t3`E(sjb>D~ZGIjNWs=}U!=bejUMXt-KW@q^bgG&(-
zKp$KuVbte@79Xy**HF6e3@EWG2LbGg2>DFdbCLbvL1NTBM=_MO-bw4$l&P34Lf}+r
zCI!xtTe^-_*=Jxr_$`S1CpI#dC#>@JZB(3Qu0XzaIa4O@Ew_&^RRUwBTpLNd`1nV#
zEkqXIad%3B#845G$>|flmC-wb*Rx7ov$ov|eBqfRINzpPSg{}D>S$=?k0z<#?N(SV
zM$GgeN;T5}kg1Lj-(A<aUe62zbgn&P;C{^@4PX%ze%H+gnGRM9rmB*=&ga%SI5U<6
zXvW)zq9@rbeD(|4V|<HooCPC<*M<f|FXO#=*^4lK2RJ@5I`{zB%{hiyokQa%K1G+I
ztCoXz_ff~=(@ggLK>9_Y9e|vsP|~i(KBgAA4Y=nLmX5C4!?*uAQ}^&A8v`rO#1d2<
z_WEl7>$o5xw%)qgcNNHW5iRMel(oBhR{Pvm1CW*Oa$u4<uFC46Mo0Isz#ZBbO1bFv
z+@xGovdz41cj6tuX(d`d?;)_)8)hSb&x)Y9Z#7IRB%#P-Ws8kQ8D|^Ad}FXPt19O+
zFHjy_O6V!uc}&3O#UD?Ozqrz$!0K-8)zL5kuz`92oqm>lqG(Sa=GF$3LR7YSNTk;L
zAMaTiqhIeFR-g$i0%^xXvA$nCf$-?#*_Z)wb>ky~^c%^;T6N^L`ZC{d6%=wt;Luwd
z#sESR#^T5$AB}J@Nq}c(@F*+Jw5*75ohjIv@#LjyEUiC~mb!29t%G`YC`>IOB(C6c
zj^GIZ)P87urX;mCmB4Efyl?GbVw2uc0C(_M8OS>=7JmiG?=FsY*e3MF2N{8&OLMq=
z6lQJ$d2Dr#Spu`mJJL8b`#tj5=G2btBab`gPr<a9KMPe4#vzM1%g-Jai7t(;KqyRv
z6##~fPC&DlA2kimq2|)v=suGYf`uG{XCq-UG7AyqhK;jb(ag77jPp}%<rdAZJ9ox<
zwMQ$E_Pjb2>+cqZE=qtd#OzAZUjXjy(6F=Z$s-Mv2q~o9kqYbA0Jrruu*4Vu1%X2l
z$gcN_7c5ByxB?5=PCt^ESX-homYcl#>7=YRI~xM3O6dgY9Y%d3rJsEcdQr5c^KcH$
zKSUfGK&;-#+lV&CVvl=>ieLg!@IVsUMEZpn2_<9jy&G~{@W3Rr!NUHdDB3!I$^eN^
z#ExeSOyDzBb_gR)udANMTC_9S1+R4?Kiwm<s2`H8Wp;L)eTdzJQL8=#_XiVb2(iqg
zYv&6XQ;Mpn{fcQkO=Ha~Y?}sg>uRIFkW3w0V{ls6)knj&1S7;?ihE$Do}U=Jo*+)q
ztPek>Kp{N?STqhcBnuVCSlsTr54`9=%Id*gp$mS&_J_JbFajsf%_y_{P=8z7Krvj!
zY(coUd&FXxjN-GHZIGZ5?05p<N#7g6SkeZHdB8wp;0`*JR6`=sYuP|eQKv1}vW(XE
zEikh^KFfbn6t4@WyY|-5jewRJrFybvrul}P_s<+;?%Uw9E#%V|i{uA<1E645Z@hGD
z#F~IXQx4z<MvQk5lU~VGsP-I~L^H^OU!>Qu%FRPT==@c!0MVO{;1Xs)&~)skDLl}-
z$53@u-0#}}lCiqi@Ef-UZpr_HPF2czx5E3On{=;1tL>nguTlNDoB5JmNSLMyIfR76
zV~EB0;U1r%uSC$S`>`7$p2IxjNF?l2EI`F-V8k(TRcR!lam4-&<_eIY?XjI3+1MuG
zitA>Bg`nj5z()j{dNPLNrwa+~@`*IeTSy{w*8CvG1oMjf^7n)bl+-#}?3+W=tq!W(
zVPir@2)PAy4O+S)ZEM|@IKkzIOYv;P6AI6I`ofr_C;9i8g-dxo(jf|ISP^+p085BA
zRuUArE0kb{TkmE%Uli>1X>CvsY~z}SXbxW$A6MIbgn5n_#w8;EbZ1Nt-RGc0iYHTB
zZ(#2h?$p%wF~6C#^QS>mhLAS`^Y`%IH{2_bO{9b40#*b{ULzmTAL^CqEzBw1g+BZ!
zJRkoBG5}euZbNeWkz2tV5Yvu0++D7bF0I2o#qsw~e!=CDU2rH7(=8s?l^f8}+-dVj
zZ6JezHXLjPND|XSXdF~ipJ(-tyUF)iqGPntw3`X=Y26~z*kd`vEHTw!$yC5V7>yN5
zLl>0skEUB(2*ED33t8b)0z<v~Aq%1jfA<DU>K$o4CgM$`!RfG#n=Tj8_xwusD09fL
z0!gIMCM1D4GKb6@(8VynKlcqO9Zz6KoY_z)+fiD8?)|v40ZhNgSJOatFhL;8&!n^@
zoXj*Qs8^fu@1~TRh1$p7e&No4ojBZ$d$j+YJ-l)GvMJSNp;M`*Hu~Ixh3v7_OZ4H$
z&B^?m^VC2ff0lHd4iAXCvjPRKsOu@I+3n4EUVtPlzeNqai<S^@cvBwCy(W6Ig0RNw
z%`XpX-p3tMNY31ELlYh>wNJe6kc(-h7>R(^`URAGRQLp7>{{E6zj*v1f#MATej>@Z
zBMZzc^frR?+&%Xlm7POq1;_{JPwe9yN;4Rrn=zSIg%*l4<sZQp^VwI|Ou-dL3V~(N
zp|J^Q*)BUcU$MGMb1%T8+x+KC1kkfL=D?nd^-a9$Q<+>fmH<8w6?zZ+)B_Bk7vY-@
z<LH(dq!m_>f3bLHvAF6>4qLVX6Pn?GAJ26PXBT524C+j^@iNN{WgYKGSM^z$u>1wX
zIoI~iJtj>~U|eM5mI(R@6lO^}B9xY2DF;BHeMbQQwPqtqCrBm>g-4Q>Le1m@>&9by
zh@7DK{BO6othtU2eXG|P1!s|UT!MdahHLB;&M-HIo8Jbg;)+)mjxxrz(}*FY251eQ
z6lE}xG7f2|*&`Hbc#}KnQvm*YF*ypiR8G}YbDmM%xhmFa4$EFNd6!d~XubBL?o#dr
z$qsm`N%jX)_*+A@6VHKac#XFHUY}5H*#p!=>MUmZ?<u&qAF+4G9HiwzAsr5lYp^_Q
zTJ=|0GNLMXf{P!&V-`vrJYU7KAg$c<65;#JFk4-mh3G-*0qi(uKyG-&cKzw5Z3NuM
z<6UOS!Q?+2vtw<2yG3)%^VavT&j|*Gl6MZ_Xyx=~hfjD?F|g7kd-!+)ipWtqO2KSg
zOGxV+avDm0ow>6PC+CB9q4PbewV~v`cfxC}{4i{(0Z3j_gbW5LF?lAZHef+3MH*}B
z5<7{3Ip?b#48}e-++=j9?a-jP$95{VOg**eEcc1%Mpo_+iQN%>Hf3*Z>&QVkNLbZv
z#l&^`9R);oOc+-($`+keK1^Vju(1U@+Hy#4FwShTxc(ESSFBTPwOBR???8G9pR6it
zytsjbnE`6O`{z^!68<nVeL)$=u^VXP9G+tR4OIYpGiK{3cZ@(A(bOf;|A#i}7{RUO
z8hi-^Hyh<p5+2vP-{LocZG;^fp&NWn@wk!3XaeD@xc0gJRR39R6siJ&j6cFjl_z?+
z=1w5Cys+a4=-R#P?uKon=W?^;*qHg44s5j#X-ORFS^%`U-otG4zJVZ-f+r01n)}<v
z7zA+85bZgiOP{iPep{<(*Xh=BVbUF4ImB=ZnSp!yLwt?>&z;mVUEnwW=Mr>4w$8%)
zwVK72Y0Jr~^05F6>LHxj0w>u@EfhU_)m%DV9;Bp!E9oXo*7N{=eqWg&q+1kWt`FQ@
z8sI@;<ZKL^Nv{t<fBGoJhZxYT9Dz_aZaU900kVOnfn6MADA>16;WLo28*JO+$GXnC
z&3P;bD->Xn*mjI1d#XR98cFYRB115ctPO1<;nA$eF>kJ!(X&!D*%=Bk-^rH&wxwS_
z_zEoT{oeM$<aY29zBUJ;P?M&eAa1oc6n$XN&L(?`m8xUB@Fk0n{<+MTkdPr@=2h1R
z@qm10-a&`kduyWDQ)*~@WtGuw-6U@D@tqVmRgfE=)in(Ql&|p|j6vA1K86$49By|$
zKVP(3QC}jrnqd%N=KCCinXr`Lgb(9N2L`d%EBN|Z5zsNBxDB#l%M_2_Ad^r>%zjho
z`uQU$=57fp8376<{n|YC9p|v`e^CI3x%oTA(?RD2K6(73Wcb)o3wZKarU)ZC3wHRi
zF(78%_HAQ8(+c{mppt(L*NvMz4P6{XkmVI{YZF8`5QcZ^R&vWGUmSAQJ6$efFO1ED
z4*=GERE;iz4n|qgA7D5~b=cbu^N=D34+5-XeKB_8q84pRsLY}W%jgpQ-EH;&K8Mz7
zn%J<fV_o#(gS6Z?E_4`YhE82XZVozt`+ad^asXYNq%Z#!V#lJ|1HEhleu8Ft2!dO(
zULsV%g&{qGp<VAidYK@7fFO+!4-y5NP5`@*ZO^>&WtIGb|Ktw=1M^CM&HKzl%^cR)
z34kh6dyNOZZ{bD!x&H`rck!5k&xkaVWZ`fDsP}f^9{yv%0F~&m=W2b9;_}5?BN9&X
zFp#4lpHYy;gA$R8CGAB%m!YmZ6h?8Yn2=!gOaO)}EDd}&6DMWm8e8Bolq5e0M$EWA
zjoruYoxNv2e3SlEQdpTLAI+F;dW?cv*H;HPAS7+i&hY$AKr4$=AWKh19Yf&MU>788
zxckM~<z#@5_nxyWC4M1=u<!QWdXm5ul2x(mz)s=G%SCeih)@j-9QU?cL80wT)2~}|
zkkHj_LKgzlg@Ry6OB-?smb;YD*;esRsGe%gU-4Vd&k_?+6gUeR`O|wUZ-#pK&A%$y
zw#1W`j!oUlHiAU@+SED+A`(rGejXeWGf{N;C<YYMz`cHvGEhl3sv_rF+K0R(xtb1R
z05Ntk5Bz}LVZuwo_eXS14)lXixp!GVbfsA1OGRBZXAE9AUaaX$xF?mp$0bX;^Bb>C
z&9CD{Vu#MDy1}N`-qHw&pDiLhkgKFJ57}w&M{9+md5iZZF9MV_em3t~yy#=r^LSOe
z>ynT~wa1=eENr!B6q&tRfa|`|W1}Ds^66|TuORSdEE@G#RAnP^b0;EUzl^_A<^l)-
z?Q@C6bWA{wjwn&=F|V74?7GKcAJ|q|C<%)zAipT~x-}6$eLUm&22TD^zhQXn;#h1j
z>YhTy?hPBEXNGXgl<*K`&X_hvm!G;X_xOks?{Zh+@@8I9ao#6HVbFV|GuviJQpc;#
ztYzcdp2IQorALk4@*rTWy%vPx{B90@HFs0BQ0kKdb+J3>7?uEc&!~Iv@7OClu?j{o
zvG8BB)jfN)D<g^iF@cKX7O~;guU5NK?zLBq)1&JdOsZ;MV;ZzatYyThm1gP0Krz5N
zYZ)K=Pd$dNO#3c`j^d<I%toOZWHSR)pO0L0kb<HaidHW|cMH@xAYLz^W8XI`mLLO$
z{7g6#utYYptrcs5diEy^P5WN3jpT{OejCFS+&Xr#5%&;lxFIwSem>?`LDHQ+Vtc6Y
zehRaraBWP+X9o;!aT}zH0B|Z%BCy1Y0P-HD_By!*6V<)}&mp8tK=d9Gc@U6$b2Z9j
zOV9|{1Za(AZ&U=@{gKK_L%x&e`5CK~ZY>{I)Cvt*0xd39zXr$o^v$bhV~r}^G7wpD
z5X2eWsG&}#ND>79UZ9cXfstnF!^@*E$>f(REx9AD8Z4XZ-R7Zb)m3JY@)x1&`$7&8
z5=g52GG=w0L-6LWL>vrefRo&}E64~bKTy)C)VvCvetiYE1k=n?gs!xRuNId#Tg!yB
zaWvV#g&X5`%1{&BN4<v7j=MLC#Nm`h2L#mmRQgjl!DH<3n1j9xs@Wnplg%e6(ayd{
z^oM6um-Y!0UN4M81jSW-D3K%X(|i=A3L%gA{Gll`SBQkNW{N}K%AVgKw)dlRU~ZLH
z{ZPN`N+Ze1z5t_T9XkPuhY~w+Zwll{FqhgS5P~^>AK;@(u8M*#5xO$?Cxt#(0P)G#
z8x)4vV80H`4<&db(#vu{afxMw%16QSAYXYT+NgpsRUK>Z0(_0Y)0<wL49j}l)iEf@
zlVES$#Z1lTed3vKH5krBEuqoyQoVlg6zx=LV#Q`!%=3ts!FPB8N`*Ok4n+thdN$&+
zdgv-IrZ>qr5RJ8!Q@ubhp3;@iX0>l}+AzHb-n8owqY*Tf=aLQxLR}{*ZJXi=nEh^5
z^_VT?i$0JYV)t=4GO+v+g+!EFcq5K6MXmxAR6(Y=E{Dv2tOSK@8?SFe`nCl;R4Kff
zQ}&)klVvk>hezaRKh(e4UtkSCNEnm7xeLe^Z>U|=Q{9dFP{!W9RyFog;wzkm%LuqT
zQe3k;{*w|)`Y<p?=b_&O1h}RnjCZ19Hm?Eg8Fd+&C4`~+S>bu{>_vUyXNf0XDLu0R
zB)dv*D&y_p9nHEX#0yLwUn{Va#ufs2g)iNDm@0Lk!a#Rg@cR_z6*sesS_&H%CPgNb
z<@y1tO0H{<NDMw2fn$z*dO#;sMdgX&25$0c3bY<az>i@BvC12+T#!@rXK>%bt4ytL
zV<5-H<A;>}`hG1E`sXTC&_f@3H&XiSu>;gQhkWs48xpMWa~uj^Z9c+yxB$z)c4y=2
zt^*k6itB3b(y!fv7sXmGO3@d&dVU%mi^=hi9Y6Q37ycZW9!TnVi4`2~JTe@+(t;GV
z;($d&CY)4EM~_6NNj*p2j;s;u&-@&0yS8M5+=G9MX<lPH1ENkTE&5~3ft%a|(Ktm>
zKt;|~=iy&x6((&DcwOGhhZac}fZ;aRHb#<##x8NmzQ5J&``$t7COo7mf%r~J_NV#5
zK7ZBujkt-6NsB#Nq1D;QfF1_%^tQ{3qMLiTE+9IVu;DoNU8UHG54r>xIFoImB)5o*
zzVF)IVE;v|YbZd14>x3<V;(xJsf@cAx>=AU0cm<4nCX@KlK><y1>|9LQJN}qmGM6<
zEf}Xd6qT4AML^R%BRz%<PU4VGc*rR0N@<3fyBAY+_8bbTBIj+h-WZGG^F3~qP$oAR
zmFKz)whFk1)8YELT#BuNE9D38e?YtShu2_^2yj$Xzf?BYPH?+yjl+HU2kc90Drt!X
zCn-ZI(0YD$Fem812%J`7W8TzvW6(DgLEdQ`3@E|~=eSRH`o5QncD3ivj`@%Ra9eR+
z5x-xZTCvzo>GJMa@4MO?^wa&@7*GzEQiZoo2j=YO$t0i7Wc`E!%pHZ@f-)5!Bq}Fp
z3+6oXMwN(Nf*T$mYOOqHMvn$(y?}q-6?$^nB3_Ndp62>j>N&;hfJs<!Aw;46o<^et
zaBt{^s=U7mkE#cUmD}dqR4WfBuX#OWkM;RF(@j(haarijq9C^fyOC@9>#*S1JeV!q
zmOV=0fPXR>9Jc&eBnC+9{mvnNUN4Jgw`u}iTG8A+8?>!zcd$9Np>nkO(Ruv+-ICH$
zsXhb<$v@R)|DV>dTjCkQ?b@R+B(aKU6%y>7USG1i#jEVQ*^bKgn;n6x9!xq0yyIF~
z+T4<i5993CIfZ24;oDf0mfUHL4%H}Pu%6ycBw}?(D+r4>C9QTUcKPl|4tuK^Oj*(t
zJ;-M~omWQFv`I_lhW?P(!DZEzucMBB+*Usw8*x5g5&QJZ3nhg(FzhD@HyL#Fvv$to
zW1qrz{CY7$fZV}uSV*Wi;XK<I5XF#0_Dpt@`H!pcjoK_>M@vz6>eOslvgIALUMu@;
zVf7WJ9t>l5mPXo{LEp-0p2i<WNye8(Iz&R3S>_l}Zv)E}7;MqWEogSQ&MB1SlQiph
z@!w5fedf(q*%PYvak4Hd7y*e2BqS%$uwELy#y}U9gSBrhO06IacAr{#D8f|pI+rRh
zQGkjwRb})V0RJ_<j}GS_A{OCy&+XG#&A@}FuYn<f_bS8o{&On9i|e%WbVAXnZ?96t
z46^FRd!#B<L{r<I#xt)hl?1n3Ym*Tc_AhY|$uVv$)(tl00_l7ex@@fS)*JgY*J8$6
z1~@6WXjD>=nr)xIZK;v#yE*9gHhg4s9@ZIo;dQK9n?b6RV}$I9+^Vk#;QGt=u0uns
zG{&L$w2ilokYCh|JcMso2GVMuc_BLgQ=UWk3P1HM_v+7u#=gyauax<-{W!uNHC_bx
zkW4h>95)MONtZ47B4vCuW+Z1W)ckspHe{&s(EK`~6KY?~z0696h2CLHJ$p5bVd|x|
zhIG*vt4<0{W(RG)<oD6VbEv!N+a#!XI2Kq|-&kvBQeBD0`R~hq-n<-6d^RQA_8+x4
zjFsiY)96i!$_bmGvMe8ZltXH;cMph-&Pqe&jbg9v_hn#bOdJg-S#p*G$j-O(Zc$}O
z=c=skR7pj_2Vk8+)^d9oPXe8!uQk<MI2(Xz>g{>@B!gyjx4?O~#bkD)&yR~b1OU9u
z2XP;bLY4hB9^xhz)Ia@~ln^vS%lZBs)u5k*H<t=GwQy@`P|-B35yQP5#Av5STwT#w
zcgg0o2CO0aS7yo*2iH4nTy|evE}-&KY&b*2Bf-~<G)1!6VrgcY^kK1LI($}4-f3|Z
zldu1EnPu~<<agE|KHmJx=AasW`Pu%B_aFPEElK6&<ui`*zvrv?R|&RMXjuJw8cWNf
z8r2pHlSkA3cxJ|uTPCwdqO?*;yP@%8){6oh&1^72aoz3oz4&&Gm{_t#1+dO|(a5(4
z`B-JD=!zX14J#clJ$J|}MjE=SXJ3Zu8;f2dQFVng4T(zfu!qFrotKJ3@v*%(Wi@bi
zq3O_gLiDe=?8fsd_Ft0sx=u;Gp|RjkRp7rHl63ejJEQ-#yi~S|o7U@$LpGk+gf9gl
zOZ{htsjd1A`O1xOvzWDH?}NVf;jb2F^)Y)Xe!Sk;<g4z73neZ`dCsk`IaSmFcV9+B
zJ_{z+NgLL?*e-2cE&KUTXT!O!pHScBja41FrvnKo+bm#$=zPYaw+pjW0z9W}BhF&?
zQQn6?{E97*_%Y`nJ`?)l+1|#l72NKL3r$Zi0{{k6<#qNAB>V=~4f9gb?{2mC7c)xT
z>lUIr-0xZb^P1z-pcneI*p&Kj7m|7lzKa2*ofd>U4Id9N`rWAg3{i1@a;}wboS6^(
zG_4wT!G?2-4MfZ5@v3^L7gAr<ig+F|iOm%OHc+3Urn@N0%JQ1uExeH0_;LOy>omi`
z>oB^q8ZmvV+(kJmuTR*K@+-fvxfw(>1=@446f^n2Ea=tMU`r*BG9Bksqtg~sPp$=;
zF8cRjIfv;<IRC&#y>@p%e2&f%*BkfqW9bTaO-weDt_RpnKlZdxdhl6jeGV$Gq6)lU
zxp&@uAyUYBJV@(Jl*^S*Z=@}u+OI!{ie>omyzUByKH<Gw_Ne(yk;`v(crCHTqx-x?
zTJ4Odp3>orR}eRUz;cT7n3;t>nScU~Y=<6x76>6;Q<!<$ervLa=@yn^+zrUsZqRU1
zhRyVguooevo{87SwZA|4?8d9)?IaY5sZc96D$pw8G`F-%(U~DEwL5<rGuNX$+z?!~
zyKRytL?UiOx7VO~ZjC!#&VAP=Zc|1OacaRFQ10_v(=4@E=IK|p61e5_f)p2d7C;M^
zH5qjcPt}XdUa^SJ_BYu<ump})6>;Rn=Wzc*pu6eL(|b6pTXrebFer7JCJhhGA#xZU
zpyOsBnD-^B@SAcz_HirY9hFNg)QLIVvFJ30BC!Oxz4P<Ef&z`0MEfBzdin;R?gXAI
z&aEeI-#g<@S1TM*a7|;U_KKZ~=iA|q*&Lr)#wVI|V5!(ecKDXANR-y*`w2{DYuT51
zCpsgQBh`Z4_eTK8p4X4x%&=f(=Q*p&Uv6R4xYIld9oIwn=!mAv?az4G_IA1fhAef;
zo0aO*LEBA7J6rFMmQxK4kfi;JGj=~-buWIL_L;cP4(@Q>(exAjJ%25{D2j^TKD6H3
zxF2Z%>;PTn-+4aTX%PqI@Pi2`%e*g&sf_40eN|c{+xFa8MVu7tD!I;Op^Myf2*#~!
zk&4)LKL|t>@-h}_u(RL%mdl;sD&g!B#_OHX?Y}lrR|zB4-^HIa-b`iQ;V4*s4T7k*
zH5E77wbj|U(;Zg7y~p>+7(2MLH0+-9YUthPyrA}^Gl5M!Gi!|Li5La8n5{}d;;QbO
zVVl*T3hyT<@_EnoKD##UOO1%^YNAK{ZwYyH(JgN>pS*t3j9Xo-9y7Pve;Pd>(rY#Q
zJenC`Gb{S=dvujU_nUSm<@b$0kG{{56#8CWDUM-IEY1nMNW=|5Wdmy*zaXcxY<8b#
z6rPc5tYqm6+N=V<zU-*Wd;N)Z;NB2;#LVKpSxsb%-Oo=G292;xa<5I`W>xoa0*~s1
ztsE5BJEAL9mSzAV?(J1TiBdZ+<gBi!sSIS@_{cJpVeP5&EUo-Z$JGN|XSnyoeZPI-
zCZ3Ug<?Sr<yN>CL16IRa)=zH+@L~JhL%l?1GH3VRd^k&MrC*J)lV)43KHB=6@l!H3
zU`UfI9rAIt?9uLyn7ozVr3vM&I+6PUE9sr-H*OZ90E&_hQMTO{<TFnS5*2j6yMEMP
zN9nr;S2P_=Ck0<q$oOqqTsrZ}$IUbLSNyN%)32$SF7GC<Eu1fqy{`B9SIX57Ef#F?
zG)C40!INWe<W|)Tk+HUTR*(F+7(;%rJbK%3&h>%2`(}aRZCSC))0YINQwT+UwmU_T
zLOG>K->mnG!-j}WuTSy|YczxWCzDAB@0Fc8t2)-Tm8w*qZX7Iosp^Q=+*iKzssDjs
zO}1ur`aeVY%N`u2DYtQ9mQBllgVX*pNl=cM{F$ZFl|KCTtII{z7&-Y`(TI4Xc+kBE
z+qH9{D~WcuC*KK?S)K;|*s!tCwyX(PTuxSJJEBuxGkAF^PaYVh(e2N@-2r1C38xpZ
z+${gR)o_c!oq~8#cV0C0WHj#;IS;5FO1rCJ3WQkN1NnIQzBnI<N5?iF&IYj`eYsh;
z^?AGbr1+Odr(UXI4^~91bhRO0AWTn#f4V@d8Yl*@_p&*I-vKz<6?OIjkbXJ6BG~aB
zl(>K9YhMlD{0SgKAf88VS>d~rTBCZPNC@s64f)@Ic`aP+dWHmvEtEA+gC3#N)Nho}
z4uGAliLEo)c@+l+iRN!=Tv}4+Utcibq=B%)M>(Y|f<~PWB}KVoov0Y&3NIFkpQE|(
zBr6T?C@0Jvgs&_XeS<eeU2`FDL`<k?t*W<}^l&M!fWe;)r(8Mmlv4GTD}T7U4f}~@
zmX9HSKJ!_8^xbdf<c9B)?|!0(y#M64_MSPxQtme!@aUPEBjA2beAt5(xBCpYzf$;l
z4uwyr?zTT^%vN&jNgIx8&Q_Zg2wcmHn&()LQ+4N8e<qx9-}kQ2eVoztSc6%?Rq*02
zbWG~#CuuhWDeeB4KNP#*2$(gm7mQ*3@^Cge%GA-u3$<$nP>sSebjV{`4qrMXNs7t@
zGCZltpO2?1RCJ)M$PjzK*LEx?K4ATX%JMScQPy~(46xUI(y;!<n}kDU)P})<__bT1
z5v-Al?)OufKX6M6ehCoaex6Yq&C1}a{rEukToqGZBD4JD8GH&@KyoPx+f^<HN$f59
zNBt;yzH02@TR#Wp0SlZWesN5@`YIQ)L^aB>;GNVpR@V}Bs<za3Ndi_=u-<R)=oaEt
zDY%`Z{@`i30@lQPPbiI;nm8q4aJt(!A65cs<x%m$3q5fbVblWdjf|6cs;f+(<p;Ya
z!D2Gs8K{7-MO#MbKgI(BgL`HgKpivI-s?RO#&gBqr^-4xO}CBZ%KeiZ{_)zRxfm+V
zXd^F)%7}`72dQaj-NKTNw&fy4-IqS3w*_vLS!nBQPM^}au>67HI|WC}So)H4*_zhh
zDRjt(GAzHDH4R<Mi<xF?V+LYvg+2*AW>%aJTRc<3h&v7AjoJ~x3Qp=HfK82#w}U1t
z?N)xyP~r!<@=SXnWs=JKuatZ)=IH`=pNT9{yVtbXy2MKKd>!X%-2c3kr2K*=|0tU8
ziNu43SYHNPCYb&Hij>vA8ykJvhB=mKi%5qAf=IlnqIOE<B4FQF&JEugV!X(X>zQ$N
zRS#F)sbWRyoX_L%(*7D=&Pmn{K0hQ^YNaP0S$X0V6=e^^RU=DJ^rT3bI-d|+EIdh_
zz10R-KfP9vbhepQajF-5gUX=rN=Q#e>Ccse8(t&k1sLWJK7xne9OFWIe=;-cSm{5k
zBlfDoPdLn7-ph+}Zp9P7vpTMcWUu^GE(l8eJH<PE<t%m0O<RObO=8##g<S9j{cP%O
zd)eeXb>^iEmsS%0-C6UM#A)AM3d)Kda6LRa5&Y)%D`SG7Ev}U*b`C)L6?1{BLp})q
z;Uvw2D{XweleTA!ei#TEkPm8+MZI#!MprUbRiF9kO(Q}J4fEd9h}bBN6@8}~h;7j6
z*)Qp?6c}?<re|<EP+C3vUCCL-YL-z;X<w+gCUP+Ia{`L9!e3J;B0%bB+{#_%J6OXr
zqZW$u0Df_pwVZV>&hBaDYjw414W3-Gbcb945Z`)2nwM+-%}d$S$UOqAEN}`f&!6AV
zm%2bGsMCp6Olhy5o(HY);dJah1m7(g-X|2>m!!#DSZc8$l-f&jDa2_u8LmgNi1FlW
zq}`5fb)Fx+c1iyQn-wMa^WNHRvS2B>2~SxGC9YM*(_V3-1|z$|`;woS148s}xOBZw
zI%Vg2l={(K;KeDs{zTHr@1zIVPiKZ__FvhPpOyXYaz@;w@=OT{VI|gCt1`J`Z!s8B
zY`^zS7C&La+H}qLCsqg3QQsQ(hV{<8`Zn8`T-F%!4L*I-f7e`YS^WDIHSb-KC$4a+
zSJMWQ@Qfx;M99I^uES%jFw20C5Z8CDUo|rF0jcNMtn)vKxL?C`Rn^4Y0j*paP%-J!
z?WaUh8eHYVo8<s_p{}WojDTBV>R&!|Mt!mBiU6)g`hyN89pZBUaqQFsnIp+4mgdQi
zs7paS5j^hK)twN5=#mipWwGC>NrIXlt>BXXj;VXh@Obar#hcFYG2h184CCmF^s_@Z
zSrz*y4G|1KzCfR!QDzFRGU8t;Fl_$7iHyq$v|5jJ7M1ua!TRhn_lW|oE9Ip3j~RLS
z&RWy70&Z5+rOB7O!b+IKl)wq}>!pevYL$6ObGL{VpRL^`p)Y|VKdylhZhEQtjmk)!
z1UKkzOli!U&r1H7!>#UUQOZcLW~?+V3!LNsSr!9S0ol3y21{zi3~HfqR8ccg+AI1C
z*mh^M_$s@hiV+jq)vG16rc48PQOLWZakt0*wEQ=#`bXJ5=2I`8xv~3BIcD5?Xyes)
z4Hn}2=-W#pypVT*9(T~}drc0L3raO*VbYFs3r&Z!pLe3=f@mkAu&%XKc|Dn58ao*!
z<5}2;Gt15kS_nOj(){Mv$!WoH*|+S|_{Hy*dnggeENMmm(d_)m-Vp=kvgJs@m~RhN
zSe9JVh3tZ2DTDWMPrYlq`Dm*sw2S9a+CV%J5s=E0AoN`*f`_ueg}WG|_ix14hC%HE
zESa6GEqR%ll%jOuM1^EOdp3Gerb^P<(GO6?2?$Es^>mSC-IWqk5%)-A2H}<;!_+|s
zaj@pH`5A<5fkxVEe`V0~E7Xw<UuKp3I~G||GD}s_J?h9!?lW%qQA3!GWBEBczz;Jp
zzeh)$^zhMho%Wa__KDYN3Oq&U#RKoDb0f(JcyagVmKx}*tD$!Iaijarsn>XX-NP@D
zS_Wc@yNj=MkR1QzjJfovh6pBrp-=;g59ZUHGya6<AGp@CooD!UPR6}bAoy473V0FQ
zdikLEzUcyByF2N;6@xizvHa>=qk_{oexIM{j%O-4*Idk(z!TF`A2?510ju!~H-i05
zGOqjWFS(U1Cd(z&n*cWNt^9N^cP(jsDY#^H%B$G$NEVz)3N9$y_>D+f=CImsl+O`X
zuV1-Br@X3O=-L!n8C4J|UC8tmd@7*WxBMK`b<HBd+-GW-z7-6+!?nPrhh8>D5(ZO>
z4Ou<D7aMJj3Nq;4XU{9w5REVzv-SK$|FMsXS~tS@_H@c}q8qyBrlj&7?-?c7OK;a3
zS{<4V3Fr$N+g5<!tLGK$I``h~IE<t<YJ<0yG75_aZX*#2B7J-<%sn^v1aM8P>y_DD
zg%(df3hLiYTv+ud^S<t{vva}|&D2L4`|DN~>4%gLHoQg}Rile=%1nkBi${-n61va5
zv77KNV$E2!y{{y$n?e4~dfHYA=eqGQ^jLjr?E9=3`RN`pX3l=bcllAZQMP5H^LLoq
z`x;@#l~OnH(I;l(6R)!I)xF>6tc4nmo;N?;9H_0R+q!b%9|5-PMyeh18WP?pYVE+2
zgBJl(Z54~^n&0Bc@2^1DV4D0X{_<iWJvuNAd!F<1=?L!8bU6z?H+xBXyv^__p>Olr
zxjM#=!)PbwuL@o0ptGVAYSjwMod{<RJZpI)R_G}Qmom3i=LHa^#b8HbsBhc7H`djJ
zw(YR+(VGnQ22Dw!V8e!BryJ)k7_?t!Zx)gLw(Jg+{-<?etp3fc{)C<G-f>#jr55H-
zp90V9;{;MMzv&%iPgHnkB89{<P}7qcm?cT6roZ5e+G9x%&Sw=W8sS-Y-eO@GQL&iK
zDkIsw$rL@GgU_8>Rm*aqMG1jWkK6TACQ3q)oME;M5$f8{kaTMHXM-P<FBOMhQKZdA
zSC=fsu+USxqC41r)xVB~smd>_gKlL4Tk?SyN4>`WEgV=W!B9C+elUGMP4VE`zeIct
z>%Esx{BUPz*N=lnk_%;LO)lW;aV+8`&qL8^SQwyhj1C?rM-+}-P%epgDPp$c$FdvF
zl;8)Y!2EJmc#h}Z7a4UUavun$WH~-tyK1Mqe)YyQoA>LtgxFq<m&sz9FhIzpI^)P{
zvW(9r3pMygAqj$ui~3z_{<ocDj~Tp?Lf`b>{!0IqC~Ua^7-}^VZv3Q&^f#Vfl+YY)
zb2R2Mj8k>n`(PIAI_Q-QQAmMyYQ=auSwEICP;iss-V<j`Q_r7gJUwhCKd5JKKQ$7=
z91^D^$);$*r*;Qy7<~SAlKRdXJ->Y}mv;R$zk9Kj*8GFt%>3Vk=Qkr#52j)}$Mg|I
zN(tRbpNua^m=T{5Ge#K<Ex=_I(ir45*xLQ#vfdcV{~Ey-b~CpY8xDoxFAK+tfo)HA
z#{l)sLl|$Tju%$8o@=6uN~$3&ikfx<f?O*#2lC`4Ld`i<71kc4LRj87|Ho#uFnC9X
zDe5U|Mb;?lf9b+1Tnbb)-{YTbgL}5vUDR5>QdJ-W(Dlfzzh{3(c(@l~OpvPD;pB>w
z@#(3_r~Y*9%XxVxeo^)@s$UZ=X2pdF>cJR^b1i~K6@4k3^bn?LJj(-w*;!weXSYB=
z?N^y|Eafe~Aiv|oza;Y4z$x8Q<1d))ck2dek&J<&VZ8~WRf-0zUnf1aV*xt%_x8Xf
zvx7<D$0p$78r?mas9d5BKVw9(zHL*(H(F=#bBjXh!1HU|{Js~xK6Sv3P85jH`}UOi
z4?EDX8)Py^hpq|-1rMcs|2KX9pSup%IH)}me!+jmS4(z+Rv$-TOtaZiny`ktv9?%U
zj~Dg#>hwCJx+#kqu$%_0#ZDGhWKTz&^wH*AyE&9H$#|~ji;i9sT9+7dW=lgm<TA!8
z;I7JVI=cwh-=kH=Ef#<6P{ei-BhtA*8uf$%Pfh`n%Rm0dZzk|>Wo~I<3HuzG8Tqm(
zGBvFQ6ju?M*`by7*7sJ6fU^I$wfOUH>!uIQhDsnaWq3(gx1~f?fozaBKV@-uHb1v1
z=r!*N;nQzKSw6q6#=oj#uo06TTm%22rixUI)g^FC7kL_qgJKp}AD8sLP<VEBC*Zr~
z{vT0VKKDlX(%+5L|FSbP{D6TGV6$e7)veR6Gw|1qe6HRhr!alumWG>odMMV=Uw2(H
zh3?VReJ+pNvL1z#Mj0{}+>%~`uJbLK1bbH*e9rK`#URC#sz&>aP92t<;J@b(Z`0yz
zoHl8vZmkhIx-*e0<m<@pV2lz3UXZ^=*L3au%l58{M!S2?!!xcQg1^)m4M+pn_oe^w
zD*lH`CA8RU+3t^7SZH`;{yHAj<k1Ddf;4Jby;0N$Kh*BtmKZnjZA|OFwOHZh6J(wH
zHM{H+IywklkDR+>f)P9su`W~g6XqO^WjD73lb^{u!PIi$N>$ojH?t#jF1=M`Ku^Xe
zB#B-=*z=HZFMpxrp*SkXhaUr<2ifOmB9mYI&bWWG_<sv?@WzR!6irJxiuB@mBnf0I
zXQwEd$BU;06hGKmeI|~tGl{}HVc8lA9*n!KNi@K8w#+0^F{c%^;Xt*M#c9w76(`dc
zDLJcEiyD=z3{)B_orQ8WJ4<S&7S`0@Od81=^<|@V!o+Ve&i}0yTqjZvH{+qA(Uagh
zeUBGwof*blh@S7Ald<GN0o=D4>1V1Ti)KdSFk3uF#^tV#=CUu9={K{aiHyR!qAo)Y
z6%*Oc4srl$wNr|d!ml~lZw(d{lwqr{N$N({P1+ZzbX;imzWA}{zfC-D>K*vgWFL~z
z&o7|3xxz?nRB4*6coMs+0)HI)_eGGGUj(W!>C!nj=9^Zew2l_8P}4@|@`H19BL*6a
z_U)`+&4Wh`g`W?K)r%EhE{#LdvF-2aEOw;BfdpC(AAQr*j_A<E$CL%Uwg0Br2COV(
z?s`pa8>}|A`)zTOYGYB7wT!~r7@Udxr78|`L5%Qlv$v0Wr-C=4iwnb6DkOY|FK+8J
zP4cBd^L!Y)x<Xv{a*3DI;^cgL2g}}W5l2aUj?#r^2z1&z7vtqPAN&qVu>8L$$0Zip
zc}@`&_r@ZiDm=4LW{X`JYv|3t7e6=3JnU$;AS=m=Ki;(RCP(E1>l_cxV)JXM{FfL0
zO&Zkb^R&tHZ)<eDh255DVd8vE&EKemFO7<@?4}@esqX+p0=)^R0T*^8Z^Xvi7I<*}
zR~S{&$TcCcDr0XqW$89?l6CH}e)1u)%d%%PxehrG*zII3YOVlq7F~IYAK2Y>8>4L}
zb+z+>>64NYL|V}s>}jeI$pTh;dk$beTNYO*shn8rv(`J6W}*9eCQRs#!ZHsA#Z8nP
zhf2NOf5EK12&x48VnTtxP87!gtl5Ob4w#CQivn;CNY1i1n-EGD!K7<`*XvC2R&ig(
zCrg&)C5WOASzf1Y3a{t_=tDmAjxBc2vrx8Zr^Gbu4h_^fl_u<PKzyg(v!(*8c7ze@
zwf~C|{vE`XZmJPPW*#gXb{e%Q8*`DhRd+Lo#QivPO!y^glsaPKu3wPzkYJrMD?`gw
zT?0-H6;SezU8MF~?P9M4@?Vn}TWT@u&iNXj-9IM0=EDM4|5h{IG1ekEB!%3pTDU`T
z@~cZkmMvVT3LuJ+|J8u-oLCf>yx=-VMTQv=95%UXC6kQZTr~yT{f5nh(UVdF!KI28
zloW=!Q)J$dv@`da^F-npxfyPO=ylRxhHJx{@Yi%USvISUE-P(T!r1c!9NwO-V_@&3
z&x0#e4SHzIImO#7^~u+7TK)aM0L=c)^Zs2je=gGHiqOsrb%NqXI3^@yO$iRmpdD7I
z4kHtR1y>>?%njJrB(a~5!5Z#=Rq)%N*Mms`&^`J(3DLG3nn}V|9`kCIj=6h6YtFsV
z&w*1W;yFxHG^ZnS(+0u8=~N}baWSesi82PaZ_q04q=PK}bD{!wcoGY@G?~FqlEm@E
z<bk|S5f@T2DNTX?md#YF`^6kriK-OU8y)d+Qbo)mR-sp)f0!yyF>RGNb&Klkvw6k@
zh16RQ3fTBG*ja8!srvHocE12lW0SdBnT<km4(*fR)dJv6+~N`-y;tzxS1A8&xsr0Q
z#!aoLO_?N8L!8a>859^wW$=Caa!=^uP&~?1+P=lPf1{=#vBFnRu)L<|PB0};jKyl{
z4lG;I)ceB)@msgodE<=NNd*Qs?)2y=u~F8*idz>-bsn=!3Q;n<XbX$sig7xO__X-v
z3V}>hY!Kfbgjpi98spKOZ6QYK|1%##`aW%qfV^~wTicp<|2wHdk?vcpcN1DJ$5Zha
zV!?E$z%bce#90z+g!JUoT=2YXr(>5ff3c#zu4kTwz~&0vphh0L3@Pe1ulkk2QX#~f
z%Yp6)SMwarU24&0(X3fZ&mwV~06T`}D{n3?ueTc(?K%{D80i}7gfe-u#49QMpAF*<
zFN&nn_+@p4`nKc^&&@BlPs49t@6SZ^2S2fC$khwZkhbOxFN&ig2+s(Mi!~N#1h3A#
z&#mZJjmu0E2-=K|Now#;TjOMhoC@51%s=c9VdKs^B39ld0a&p>PES>Twam~Wsf$O;
z^Y}!DF($JqGo58RPZMt21$lNhL^r8P+X>IoS(wCR)v|zyv$sZ14jY~~Qo+52D4gNC
zsOPwi{9i!yFCwYO9d0iARCVRkM^q90L!Y8g`m>{X9zp9OgY)MwcRHZ?5e(-hzDj7G
z9-&8lHD{S@H)=~a=9;@Jw=RAzaI6#h(5yX!n;~QpM&{TksaxB?E%#zg-IG7wwTNu-
zHWnT|NyV;V$i^mdgSe+NDhJt%gUQ_DNAvHE)jm%?9}-q_N)ma%^aifZK2cXC*HBdD
z*x_4n?#;%klSF{%|0!>2dIrWw2AgXp*GnJX&aq;8O0kGf8Pqm~Q^=8wNhhF^&(1NW
z(%fX0gWZV{P4E>y+X-zeZF3i%T!@!l?e7}~!)%YEHU)$@#OJ{MJQq=^M1nZm=QRfH
zOOzb^OV{-Pz&+TgX2ngDM`0a<e8}n>zw$KJ;PV`gq=>U2tW=cEH+%9P_FjT(uu_Ev
zl&0Xbx#mTJ28`fO*FLb~eYXB8vHSm`Fmk-KN<!gF4*)sJAokY$$agtk+oRu<VDbW_
zwQOIhsWs+f!K@vPh3^^^^-}7pr7l<MZ1x~@)@i#1^7KJKVc!xjk5S_My&-woPFAum
zAAo7af)9XJ)!6))#!E}hdV)=x#uR2iZKr&Sk-I}3?sR9gs+B9{|6%N{!`fVz_2HJ%
z0xj;^pvAqogyL3cf#OzNOVOf9Dei7Xg3}gvclY92B)Aoa03rFZ&e{8S_Bv<ny}rMa
zkn76J^FH&;+%t2}{o*)Y%pcH}LAUHqCuBE-69K?Og3lW=VK)=pZ@(vW@GexcYikyY
zBL?aAN*3H3@@oIJp7T%m_g^;SxlY@G*X@{e{W#j^5uV3|JswrOq!>t5)JaW8)X78V
zcJ7NY^{lDP(l{pelZONqPzt)swda?~Jj;yC-v^AG6Kl32qJ*`3bBN1X%e1J!JG`@+
z>T-=&SZ0G4!?bRbB19`m5~wj9FQ}s;lr!~oWHTp=Uo*R3P}4h-BodmU=8X?GWx`_I
z8uj<*4?14l&N>oD2vcKvg(+c2g$Zi7aDI2Rq5aa{YNsP|A^$O{ZfDiric1mfY4_o4
z%SW|w-1=l&bZv4WuA{0Y<1KQb54{C^vjTJaMVqT$a}vqQh*Y<GR&G}F1&_PT+(q}l
zNC0)C33Ry=>hVUtrl_S$`c!6Dd;qDy9B)Fl)%3j_L_yTYaL&7`gR<tr@0vx0s9s1}
zzo{+q_ow!Q9G^;|z}^Uptdnpkp!ZWa(jxpM5z|BT=enlwpdtNquOFKlGn^R&742=8
zNAUM$mu0|yCilQ6FBkcwu_&K3=4S6IawJn4#CQ0zvx)`^()*a%@W3_{24_kK*Hmc4
zl2FO7E#F12FKlX?(`;*GhA^*3FT)4(`cjZbDGzR|uk#gxEbh)nb>S5E7L4C099R~&
z?b{_x22(jMl21F<ucQ{Lr_b8-4^i5eCCx&r-pjaeT!PiBtwtSc$O_PIgzctxpVMXe
zdB}UiD-|YDbOKNP2B{(gyoBCKU7w@Dy=Nx(+F_T7Pk^Kk?U#iw86m0=5k#@=ufc;N
z?)!1(sn+Y|T3wggXI1^icZJt2$ZiyiuW_#<h0}=sDybagCwfs)pAVLVn~I*D=+skH
zUH*mZs>q<@sq{(5i0cZ8Jid_t(SB4Nc6z*;sI=|n+B|teHbB({xcwP2L`?U&{btlD
zS+wUHrrExZp>wa4sUqyKYM3j^^O4K*Kwk6Kvmtg2@iA|<K5=piZ25peeklM<K9m{P
zQ)vaeFcQwR%n)+OLg0oHB6zhI(5z*6y9Q)}?OLKFHQvYIc+F@_D&wM4MXA7992cP6
zl0rJgvIUd(3SpRm2~P@XQwahkm2b^+mpL8<W*4a6^QtjAQD7&$^WFa%dA2c}PogO}
zRDOydP|0FdmfVmS!T5;oOOj2};~Vh_)qG$7#3hG%^IKR^`%m&CZtzw2MK!>$ej+;Q
zQ`@zSEyT}c;!W!jXSs?dprL%iIB_Thc)M3KyLeEC{gC&j*#s$me>n}TIW!?0s+~*A
zxbj{YR<RjkdX32)CL&z;uiedmLLz@A|IeZ85s<93tU;$++(dF?R=oXS+v=xDXs73!
z@#LH5#6)PG*^D2lDSP&z^tR^99_}uj`>9L4zh%eMr$YcB82$TMrL2dGq2PRCif214
z(L|Z4z|*hFuMAq4MBz4?^gq~1nK165GV8BM6f&%}1sc@O_yyt9fQ`;LHd1F>a~<@4
z7IHRBcbr7gT+^qFG?LWeMPWRiSfVdVHhZKu6(CQPGeNIq>k_Fq`=7j3qFy1726baJ
zTlSbLnm(C=!25e{_Da%Zrb=BO+k&5~v?D+3JdXz<5{|FE8BooG{-R&k%hq9du|m<u
zjR(>3A&$hJ0Tj8gh8SPA(u%I9LFC5JfB~%M-Y5PS=_dF2Ep)!yCP=t%zTqadLi@c$
zm{2KQxjKA1g-j&t(O<%Dd^9ra7bw*&L5*!f7tidT6N&TfqNCueP375vyQeY3NQ3Jv
zuD42bgM7w8Yt$ttg_SFU&mAKDVXw2qy=b?GBRH8En6ny`U<xorH+nPMDLf>~Niqd;
z`ca3=s6v0re=CMa8of@eL3R990H7iDcIe!V?rlY0B8#={@T*L8X&wz19AcV#Y<Z%h
zQLDarmjR%T3Y9_p0lw#jio*B#2a4ER%r8(31l$Kfu%uW>om5Y7Dr^iel1!iwot3%L
z96q_t67klU*Xot1ThQYm{9tlP``Mot)YV48mXrAclel8P<I5WN&z|Qke?mT*3MDwr
z+ns2gr^Hih1^Vr-uB?P&P{5A>2)@^;JiM((naE_dn|r12#Sv3xgTpaxCXNi1oBW(v
z*au}oOpcA09udr`d4G8;F)<A@R=b*o`GHO}k}peFp;0ZJ_}z5AbpCB(&Z<pJ3BB<7
z<(r$-M+Z~#o>PgXc(j@e!BR^iie$g`?=LRpy6mVz8aTVKm^1KYuD;d#bPH|w`d2zn
zud?)&l^w*<3RS!ktvwj7Yxm9EW_$D$d>cWfno`RqtGP+J4j_Q_4Q#%bfi#R7a)LhQ
z#^vP$G8;5*-2@~0^Gk*2d*P8G%hYED`84JzvOR%i4b#w^XP%J9nyd@%7q$o9U$PZ2
zzu@Mm0Uk-2Vx1B>t5VAb%su$IQPi13rc@ecuR-sZgqm8xzRWSt2v0B09Nw1M*#r*`
zAtm1L4%Cc==GgXEQi67PZ>yJmH@o2D80S-@GCPIiqvUXe=>3-7G(zFImvCw0_TpZL
zPHP<*oo@%biDnn@b^u7^gQc*5vipK}+Ij-7)2~!T4=yy#b^ajGd3UcXY)g1)Ho+$&
z2m_C$0*~m&;0KV&^p&$ZX+`w~(>%9pqk19fNNN$bqsDQNZC;en>y3VOj#KWoljVyO
z89YG;Gs}e6CSN_4y{^w@PcuI)FWP5KT%8C3jK0nx?tk<d46}IJrwM&uF!B7I(YUwL
ze5|;W<?8+QX4!S3)zPnB;z}vqsqr;s3V7sqAyv7Gj)|9^fq|&DvDeJS*&~y8XE;=n
z;u5#xAyW(12quZIKyLJ0#HEus{p+zno~r%)nS?$>e*#$Zib;OFZ9wd(%Ev3hGwGd<
z%2bxui(lTuQG2=1#+07j&gXemkJc-5FCBjtUm-bP>i<+2f$;d?O@Dk~nDPgO(C-?^
z;#f0iWorn^LyfsUS5Gl=dEc~EcyLf?yYbri>($CNiS6Wmaf(FoLd@-C1h<Vybc#cR
z^CGC<XetrMSYxbG?6`r`D7D{kRp;x?QQeND?b4Bl^2RxkHWmqeHqPxMeNFk9<S)V(
z4=sB1An-vwa(CTU<2t<+)e}wVa}WD!8yw#AQFF=5F@m6b(oUp*_6D{%;)RpTCja?!
zkniT_8WR67oJ++kY3jMV%I@-+^wys3Zz_=lcRz<EKLq_`i#Fqtj3S^hk97JCEk3n{
z<9C+A1xRmcds*+QNaBo{lk?im%oqrpCFK|1%<hB((3@QFslZAl{a(dj*2I(Olkh~S
zP_Mo81J_&`@;?d%gRdYcHG}!LgwNVEc*BZP6Jc@B(#d5qI6x@CA31;l8j=f}cBdCS
zWv4%T=ZMChqxkMJ4l@o<>7~s@&FTBto@_1}=Xc{X^pxVKC!NMOw(Pj~uy~V%(HS#!
z&<nuER9_ja7KZU-c_ys_@1#V8_1@O_lJxN4h0T8EO?`EfBoel5eq&PGw+%B7pQuv7
zgg7q(rYesSQj6x}DVEZX(i{C-vyiiR)IO$@brJEsvB=wQ+5eF+DYkmoDgE=8=Y8#7
z99S~HOj@e#ZZ%rPb!SY;8r$U{=<zw#&PT+_4UFA?`CfMgsVn>KLIH4>buop!&NN<9
zp>{p=nKFn0SyRR<*`aHEx;oU`>jw(IEt44f)LQQS!1sX4#16kJb`XL*!?J~8s<jqU
zXJH+H!N(JvVH$c-qXx#lhngn4m6v^;<z6y$m2|@fSevKTh@Ilrl`)V?R{xIVJ!G#c
z0+}oyO_}ym+e~V|_<n9mjWv*`=OzVly%Z*qm)G(eM<IW%eSLJV0gpPpX?qXQ@s+eC
z3CHSfwC_^$l#V2F&#l*Tl()LIA8YkSiEcRW=)D4UrW)did-A&dJ}US&^-~Ksjn_ys
zr6XIp#Kr5hjCKyc{dUQD&qux}KF=P_@y+#xJmOW(9e=`9`iigW?IANTL+KPuN&@Lm
zX}dbA`GqSsoS(S4V+flWN1EWZQvH=Z^PtbB@pEUUfggO>P@VtX)HQH1M52)NV8`0b
zQ<ln%Jb?M>=#*ZW&$$P|wI!~l#n_{_(_x_xf*MMm^)TFr4!n-5r)Ongja0jbNiFVk
zzVCgt8paYm@D}=!B?NQ5&5RecP14VDR*NX)wfI<6_cg)g*|R=kS0zB0(act{S2%Wm
zNF|R4s^{@d(tUs0(i!i4oH)KbJeztm0j8iP*PyIObh}PB(Wyy4`8K2j+VMOGPs}%V
zHw4G~aF83=JNg5vjt$=}ie};B{T9KY`FyLtZe5G=7nm4RVV`j=)&?IvkS<9gKx(rn
zaGw49lW+*sjC<A4u}6lRO4&@-0QxBUjNN2p{MnZX4*YKFL-2W#?N`KFm$9Vzhp%zh
zJwe#=R-A^|kEoa5h@OdFAGVW1NnIR~I@HT2A}8-=mO6JJKJs*LsAzsAP4VvuTVEYY
zFTVOHFH&(gY8JXlF;&!C7QLUKZNfm~d14>IiO@W5FP~nRf}NwFHeG;I^H$--4HBX2
zeO&3J)-JJEWDBcUPs>KU@gmYz@>o5v#G)rMJ3ZDhiIcqkj#P!fciW3pxI}@i$B&S#
z)u7=RUwHd73T*BE=Uz6qyUxc-F%q|m`hHOYQ|U3@3J`?Tuq?|R5BCVt<#b0AlrD*Y
z9CL4gt`;cvDuiejhChv@R_<v+?v&{Q%A25*7bXCZlPF>ez`FU;VoyQxYSmKG6j^}0
zv1q!lOIN{O=_(w31vuNzi{`Z8al9f!bofN8G2g=#3XTg59FmOBo4S=H5PE)5wUa1Y
zP6EYUCt78#!uC&ZN|(S)704dzwp49>ucY7`u-_R>`bk3iI1~tkmAMTD?Ia<D+V;NH
ztjnh--ijWS&Cv$Xg~doh1%eE>aV!U}ew_p56=_{Xw#PElfpd_8Pwhu1d_~Q_TR0t4
zS22+T%+cIV66WBwS0TiFp4%fkLp!&1^=)PN6Bn<f`YUs*{{p3SbP%M*w~vnvTO6^f
zk1K<H1l!-GShlNTAJ<OKzjWw1adUcRW;OFfXXaCz$T?YIi1i4U#mCiT2_HE#jr|U^
zTtXMZFhTr;8iHF(8G|LYHz8|@ko{e;IC4#=A-3cp1Qh?#7ajAY*2PjqqlIrh$v3k~
zhL^>GExp>61^qFN{WssZlVPkFC@D^SJ!;34iKd330kAYwX}n^caZds7Jxeqp)qdPu
zWQNsmyLpWmj~W6f9WT&vD+bQ&eJIBV&4VZIRyqxw$d~>Y_)KUWnHSykBBi)j-U0<U
zu_GJi*VWti6EBDiynFLyH)UwVq5@LqSxm~V!cp}TOb>|{1~n0|BKqK+<Riu>=Y1!s
zk8j0&a4ihwxAmf0tmiZwUylc}_Z$u52@BJ>o!CzT)FoM8iT_51>m)g6X06h$xW}~m
zL^=0G?s+{6n3|+Z(-LP%s0ZFnd>S_Ret6e>@H^?=1mWw#-LC!g3LCLZR$Q;dtZoc^
zZ43@D69l$1!NE7LjaFXDuY6tQv1EU|2tmL?Ci&HY?=E749C#lz4#bogfsbb7z=zF}
zZ<JS9?&rZR<*`*PWi4=MOKERK&FU~7+r8htzm`Su<4tvDr06g3YU>sZdJ0iAaI7}+
zzWr{8U23-WY2e_;>utJ(jhMDq%1HQJ(bZzO`H+ero59PER^a<#WM-D{Ss0<W=ZYYd
z2y(BX?+g#D(FXBfuZI*Co{vdN{84SNtxox%SCLI)Ig^2`GjLMYF#;*k<?S^eB~wjF
z-nG(~wvKJWpTI~bTBdIf+u=ZnGFiqatGwevsxlQIVv9AbK9ep2e3I$(qAvV_3>3L<
z4OESt8<@uUJ-p;~XtLk(9yI>zQ*x=qn~K&x)^_B(1^O?5lk|2|5Z#PO3Vwy;{?Rel
z<<wc@IkHXXXht?N1dySBm9%2DMDuiT)EfI$B#)$|=4QyM1f4|Y__J+ZkHe=o=U#Nk
z4~}W^e?eSG#zNQLh_G8ZNJ-hV!UZH>(Fm~}Nq(?cl!*CV2oFBytZtqZ^>cU)^Hs|w
znFv#JI*>+-7$H8Tz*37M`DKc!Mo>TWDnqRxle3aosL!q-;=Xj>d93tyaAt0quJj<c
zarScfqu5!@%_bL$HKMvmZ&jJ6hE-i8>V!8e57K+rpu89!7DN6jsY)lEkOo5<t5Z>}
zLEG%DLWLZe>#)u#<q~l1v#AubKjSo3APb8-rv7c>gG{)Va*-fY<xAbg&3yE4`$*D@
z5gD}=^l0;LW6?8q`N))+fP|RQjMyu{+qlTPm~ShEB?^=rydzYd=D|E8S!Yu-O_Ncs
zA&elK-^Z@0V^s_&nI*tex|U8AK{bcLiZixi5|?N{9}#_mu1G{o8m-@@{i-eq?s)8H
zVvIR-&lfkc)Q4=iE^|8=74mqgboKq0dAXm@yfJ7mXfNLc&hpE7i4*5u`xh|F<2v(G
zKIa*z<!wz=$CEU2dHI;<39|<;lFQr9CZAAnK&sV{t_p!CD5jfHsOrGaaS-BQFQXa}
z-|yy1p;PSVLIQ~wvY>MzP+VYfnE8khvCgljzK{OK6?lZP;-@w7s;Mll{!1#4vl$-M
zN_H^*Z*|1=FogX@i#*V|AZbeZhCFjs3WTcjJfjn5Jr*-0TQQ8b;JI&k=-cf+w<+QG
zY0&kD;=G9KcH$A=ZiugCjHOFOJufdzRc9Ee9ctrb%>!>gMsOUT`WQEDTp0`@I=#~=
z#Kt7*8l|3t596Nipu2t+-hOR40LFaZ`wLZlJ0qnsQJFJxwe&K--CTv|ZngEGT>fA9
zU8#Ola!8ThYU*jnC+I}xyv5HyrHLw|{^H|pnfbQ9)p3}(S3PBSp5vXIQA5u-_~I;C
z<5D{hpY8`?x(Dway}bFMVs76ute(Lu4|v(8_^wZf87v^^$UkBG9D0!yQCZWSSMGd8
zMzm_FNP8?y`+?R(#I|4xiyBMv(z@ELh+W1hIJ`OkHH}a2;LMYqAJn^v0I}2ZOVA;{
zgDi_#9(*WA(!qeRYnL~k;nmAGZq&Ok>Bwys&2lXv@8rrgcq`0#s+glgO&vDXff%BD
zw)Tdw2^3wtbiXPEr}7EYd2oy(MwC(Ntbs87z2of9n$Fm8+A@rYo|9a}gJ10ZT#D4!
z?l?+hBh>LA@qj%Jzs9X?sv(2&L#mOO;l1|7bB~WEXm1D7bD9t9tXDv5C(@Yq#aN2l
zYC*y#H(l04>G=S7j5={WMv>&t0Bre2<L7{?n`DEcaYwz@w}!;)<4@Tm*?}JQ8i-D@
z!PW9c=^1$}*2S<B1}lg369C}O!7E+hcYu%M3tF#(l+$`b&}X$Tjz+W+23S6b=clvv
zDM#G21{m!4Lnut$R&zXzr&?S(n+|s*(dqGSjRD*S;2T??c}H=9Y)+1jeZgJ~)K&GF
zCr_>i+wU#CyWcx0IlSximkK}c_FYA6>kQQ~-umv{)#HH@a|=qA?q$4-?r*NQ0PJ-u
zR(Cbm!^XzA)UcfH)%#oPy-&>dk%fQNr+yOF(d*S58o~eC-EBq2^B1WTvMeKPRjhDS
znQXI^vVPnL+v%mRji?)Z_hN3(brN>6Bo(0A-m@&5A^)Y8CXK@JmMRu1FRi=z(r^Em
zTdn9m{5y5xF0Jd*XwlUCuzzNQT&Qkq<WP-VPlsc;LlAh{AIBSx>Up2)7&%w}=xh(a
zlVvt>&VdmaIBxZ8H>Fac)Se3RODnhSoTPQJb`$7C0~slanI63{yZoNntZe36scHD6
zQ`U4Y?3D;TfN)`=5aLPb@JBuu_xQ`%4*<XghhijV$nRs&!rn>PQwe&S1n|ufqKsrR
ziN9%5|GNY)HTZK`V*;DZo?)St+wUxts?bY_Py(~t?}k85r1w5x@(y@mVp$v-$Dokx
zXR`oo0E%pVYG*@D696oDoSe?`9P#}!he}#@&W^ke9!5LzQ#9$kxL!%Uo@?FxQay!A
z{%0|}(~Dv={z&3QFJnecemIc3>16r+UTA6UYzX#NjF~FYh%s>Pl?Q{9+B3l(UJULj
zzpmMwUL04Pe+V)SqP>UCsi`VFN9-rlS$#U*TB_n_*RkOZrg1$S2X7f{jY8SE+w)EN
z-1q%#QM`zRfisWO{abGEy^p2Av%1VR$KM!d9%R$27s=+6qy~-#Lfl6ri}=llj*+Sm
z?IWyF4{~P28kyxYygIiv&O?mfNCj_?zQ~Kyao?O4Iz#FvlpxrWiMlm>E5^$p=GSEM
z&FkZ%PxA#1ubkf?Fhb$C9#F^aovQLcNA{YeKsPoBY|gv@MKb|_kd<E1OGTy4_3`t3
z;}MQ3D@oT0ptCS=5;#8=@+VU9KNvpb<Y>nLe)^-#7%Um~+wDWRxr@0zJat(=jRVAZ
z{Mc6yv6{&}?DUMA(;t1S)I|BJ^GKamU2Y{@^=Q1P9TZm+`H0WUx!)<tL?kIfC^!vl
zlK;_Htm)mzmMk+OVQ(K}Q}$<gHwWDOcgX4{Mt1`_ElFh&7oVP?jW!8EiV`mFA>&Xn
zVJkE{fx7_H#AWEkcCWE{zHvT?gpDQo$3`Fv1(Cc0VSHF%fr$l*7Zhe+bwLMv5Nnpx
z4GGZQ%+EJDwRMe6VA$3%FsE%_5iHCCn})YPN)R9$8}wPpcQe7QT?h@bEpqOjy6q+_
zywssg&eG!%G)fIyPih7empxAt3dUfVBIQsO8c&7vd5kLMVGx;O-DUX9nheKO?Y$m9
z=c5?OD!(6epEFMS-F*GKXQiH=V;s0M676fyE6Ll=*>r>}mQwmq^6YfH;F{V;c7Go=
zT|QW?3_4FKr7dfM#y?+@D&hHHsE_JGFfjrZ`>0A`m6qLw+`n=i)bY<9+j?g!7wROP
zp~{vY;13q{iXi&9kvE-!S1eXY^OZ!$ORJ**yydyjVe&t!oAT*H+XffQS7^T;-eBC2
z^VdP(HnkXhw~qCzVY#K#U?XQ2P(-psblf-y+8v~ue7^1^sXt@9l|M7b!Fa5xE-|so
zaMhRYpuOl#<&CO(v3g`M9E0cLERi<Yw9yLKF~}#0gg~}>{gtdQ08H_%Yv!Z?k>|()
zBElsJhm^thn*d}(Q6iio`8sd1twTf27_3YwVW;Z#h@8fUIp#Tkq3>)vd=HPXABIIV
z1nNH&X!Vnf*}r3BPyQ?G+XeWC!BY)aggiIkG>$QU4EEpjZ^lNP#SH&isHJt(_fc^Q
zSO%G1we+xm+=$qkym_?1YUcS?K3h1mr-KxY+=bLXa%&AW>ZNbt9QhsH?p&df0z*Me
zx}p4tmRJ-qpXJ6~MOa24sUZt+^i)BoS6+V6!<{SX{Pkll$@_OrRB&d)LX@r(Y2$$Z
z8yC}OKsE$w&UP&Tm*8zFeD@o>aio$7fk-h;lpN`B+{2zV)bQv&kHoZqE_5(N*iKW&
z5G7e1(`m<!d4ZYGt4+-96`Km-ojWJX>x8GpuRh6=aQblDnQ%TOmxeC?Vtcndlcxo)
zzdiE)k`DKU%GP<0EB`YJaTun`Y(l-07lY2^ss}+;Uf`xo4br{{_(CVc4opkm{t1dC
z<zzf3P<XynA<T>nrK!55v@iU1wOllPiE#$=0V3QH>$Ti3>b%x4_7I>;l7hS1kTzB)
z&7X{)>8w}1FPb+Otq0R9kau99>Z<Um!dCx?#mG`!ydJ;xkHx%}gRvzlpxxE)YnnNj
zvuGr)D9qjVdXf6)xd%Jn3!+Ry%mpE8Q2tkmp`Ejx;F9*v;H@KD_vqtj86VXZb-k`-
zFPZwx3b|fqz`fSZE5U^m8JF9f_6RQFqHh9fhYFh#c}yWKh>DkXZsXvydD|3;r@^c6
zF?GTo2{gTNykR<iYi;C7$1EY-25|O62e8P1d&i4}krgG5>pBTlmp*}v_Dfy{LAwDf
zrl9@7{g6$ox*J2vzOuhUU+tI<sY)x4&zpu~1~XGu@#U|^?w+*ULsLf{VXI%`5%^7E
z3w+n}Gqz{W_$bW)VB~NbagplLP|FmprN+rKBnVSRHM0F@qU-!-=-wm+XrS@3+baD0
z0j6aVG0WOr0<5!F>C3ub6mVhh-;&v;6OrR4Xtc1x8Qf1HHN8$|#e(j*viH*@A(C+s
zRYb@znp`;S+e$c6%NJ^@V8H8ItI#_4yh|0`->p=PkmIS~yyhe`pmt(n{BxLG*tfDl
zO{gYsnS}X!b?O({gSiPdk@Ev;rz!|v6T7OnXOyOm3qO5jhVz<XdyTf*FZ}Vy$KPm(
zRwQ;0Q+3zx00Nh&n_mqjJPRp&7tC{Ese^FYXWb*gpwUolT>7wgh_RkJdb5+2wsN|H
zx9y0dt^8>PWPd}~B$u|eV4aZ+J~>LV9AB(|ei`kigdpGxl|DOcyaw5h`(3F+?z)5~
zql668v%GG<R~7O2Y;uh-caMYNt@3uETSp%A-&<;L!K?SSh@9r;sh{vw!#^6dE8);t
zxZqwg&XNboivCvr>3ltG*aWH8bb4z)yi{S}R4wD&`1@E#U`4mI-;_NP;JcH)XAVL5
zdJV%;+V54GuCtmam5WQ_XGegfpL`I`qAM;@(k(}4>7}t*%pfG$UQWn!MX|#gd%Q1#
zi>tm<mwRh-EjbPoCwH3TD%IAb%Kcl8#J@+Egr%a-`VNa?kai1`59$5R;pV;$dz~@A
zYY9QJF|GOFyQ1o;dt^g>?0n0^D4sf0395a%y#4pS+ep_n$>h}?@W!!eug`u;MQHU$
z3ywH9lHnPUi@9+#_ngp&n?E@L1omD41^E3C8on9`+R;JccV=~&+(WG=h1%~Es>V;o
z!LD|lpc&O6r=|tcn`)}Bv{Bscn@+vQ<wcnqi1(j`a=`9qdnj-IL7B?JECZ~#26)Vc
zSZeGY1OIRO6N>L(dP>W~hsrEYr}(EX;4VKU*`rmPH~j)~#E@~Tq;1=cjkcq3BL~~3
zvdjidp}P(WseQci(hVd8%BmOlSd1ly`f;^GQzjW|cN^*b({h6BpTIXASYN11XeR~K
zF&)g-R<S^t(K<a1eGA`L&rO-z611k*dA;mY6Z8!8QRHo``*|7qE-z?^niKJkU4Tjy
zS@7YmLg=ey<oJqLhtfL^qn6l=S5o-I1ibWCa!eFFI~kBYe#t5R9cqZk4xE^Qjm3(X
zG4!FUJUTifs~#ix{`eRF1#We7^)O)%8|YJWb5qlg<FquR?d2x-Fgb|!)nvhG<tth2
zVPnS(i`a1Lh*x9J&5K1u<P}T>1Aw^O8e(csIsqYv6MKvgSj3F?@eI)0=jj&P;e%O?
z<UmGs?Qhc=V(bVPAFng&bi;;o$9?U}1j=`HcK(~UUTtjJS~l~RT@;KwTYztu`lR29
z6}2tHuCQxE*`+;Wsd_AvV*R|Y9;X--NIjv~F?5Ok1v;-41i^KeSf-<XSvAv`OPK7>
z8+%No$+wzdQG8>j@%iRQWk-}?sglfU$&__)75K~VE{c!6GDx@Q*ud!mJJ4cFaqPoP
zjta*+DUmPsT)_68OQ-gmA4cBmV28uhReCSwQp*(uAwxf<fdS*x3g5D&4S5M`zKqJF
zri~Ak)V)DF94vsiC%)IE#<Lp*JM<6ri`0zlmo1p`S{_@xynFH}biPdNh*a6J<b90z
zN1d^Tvm5Jg?Y>ug{Yx=99_RW8B~-)j*CHr;_MX!Y9ye??>F(6`vK3R-el8BW9V5$f
z4S$VU>!V2l{7{nlX<I3-quihzR6_7N`K%<3-#jg(D9cyaeC%<MdCdH{<l*Yv{)|1o
ziOGQT$(r~nKYxkLHv?=$o;-pQ>k5Tgnc_R!qn_K&89Kj;OmRM>QRpD}h)(_RPcQy_
z3_o=u)n=8SlM8uHV*5A`nF#WU>z28DrY^s_wC`yyMSkO8W43?$yt~tX&;P*?(~x)2
zH;ynZ3*0JxGP)m)4#@fKvk0!JVt1Gl-o-pAnGRy=a=(}<+Ds{>ZsEMgX`#yUrT_H1
zEB+q)E6J+4A#RV**(tl$E9nfas{TDgXJ=vXfF(TQrTQFaL7V66u7lU<qrgJJ3r$3V
zdsR`nx(XNSP0zqpzo;8i@7&jEH3t@65*<!S{vJE(K!8~(MKwi+?L+g+1;wVfhc(HO
zhKCyXHLQY(R)>66G+$b0bD4u;$wje#Sx3{@SIkKMM0xl_;+;XqPr~0&vX~s6C%UP_
zDoxs)v`J0c1y!$4&kPFoXWJ_JKHBw?RB8o}m73v=lsKl$WS9xCSB|2k@wUes@#bY^
zYP#-AQ*`Yh^-Qe1>fL{+4=s5pQD`964$rx(_xx4GP0Pzp{oPdP1<`lIqo|ewPdAiH
z^;8`V_UEH%_(f${lHFsbTOF%3s#7h+Jr2nk@@hFIv)9A>WR^fw5^V8xOr=Z#p9%^`
z9SlPs@fv@9Q<$TaP{?bLrr$~!`cctLS#0x%D@U^-CzF)!-I7xt{d&gm6V(CnEJ??&
zaYlw;d(Q1<M_8&KI%BUJXM7~c_BtmOw4XgZ`P|^lWcFn5^{=%sFx=Ro&%@c-@EB7V
zE&4OV+MizD@S$aPe;OX+dD%NqzJ9l)?@zoUZh_5Eu9jvS+ZVs?|AK<}_r65M$-3L*
zs=%i<8qLOdKgw-M922}E+uSb(iUaYXBQFj09H!hGZ%OvpQ;=HBxdN-_s&kX$E9~Y&
zrlBv#>X2eFOSSgat=^Yk97O1;V?FW3EpEbh-$#EEPwN`t@2C3e6^b24F?ldLM(*RO
zGMgJR)ni--)v1)Ju*~A+bPfxkIiO(ATFf3gX)4)JJmRz92*!-Y49vOZkg8GI#vh%s
zKBr`lJv<4)bBNU{m-H5l!gJ7L0GG)0lM|+j$ezRA`0C%}zXQ4rzc}v>DEBB6SY6cq
z{$8Rm7-J~NyQ?t}<7X76fXfPATIYdQx|6{Zm-zw~G@swDQd%dbO=;jH)e17BMjM9x
z=dPO!7LC#52o=e~-o-c9$%j*CPq#RQ&j=LPst(DP-z5lLs#D<bxeYU*h*Obx4(zs^
zsj)ff<vr(=$*Tts^fJnwhRi=U{KZbJVQPt^`Jwir&A)&(n%p=^?49*!bx8N4-6rkv
z7@_sI+xd&XC>7UT62!c+?DP~TtLBqQ+vxo`f9o#z++&Dqacu#-p1E|0NpJEoXQJ-a
z$FCRboM|#PTk83o=D3HkiFgGuGzTx$Au#;@M(8lWzH)}3>De>+@1~LY5H-gdQ>#w(
zy;>!!%@~}?Ir61LqW5|FDv;EzFm(>!VUu0?&y%p-v*anedrO^C;W^RiRBN0rk`k~$
zi9_)mPFgx0RfDjtk!|7V)7rPk&+xLTBxT63!>bWHyK~0%rKPo3-lu_NTkl<v)ID%j
znm_xee|++9XGX*C*1<qa(I9LbQYxX?4nYbuD|&pqN{hxEd2{V`e$=+6u$QtRC}|AG
zjD46<92jtMXzDeBJLb=k!GJc-vO>s3s22|}64ruFDpYM$15e8r>qE_=Ho6jFQQ;>6
zy`rz&IHq+uMXTH?y0xBRI!1eu+dHH(<BEQn>c?#zl3WWB>D9={9@^biiOKY3lN5dU
zh11*3GI<-dJg0_cKb!c=X1k;tk2e8Bg6_tg2NLel0vY|~1wodrC#H?-DqL6|>o^?d
zU*)5|&a?l5)P~WWCt<WV{^fq7{@8IA^`PftqSxaZRi!OP4Mqf6=-PWT&?MF|w=?<x
zW}z`pK2H}pANgRJ7j@F`4xXocgNm?P70^p20xTQCVoqjE1R|D<m$dg1V$VzEt@92k
z#`(bllS|p3AOL`2y&=$u>z*PgUreaEWk#6{fGHhc`y)j)7ODNi^Su`zbF<MfX})lR
zQv31DZ$kwOCG80u@MmqEL@Bm~PYUjN`=TqM{C(i*gHLbBQ}muzfkuDdx5k%J4ZS)!
zX=r*c<TKOnPU7P_M7=@h%GJxjlf8P^w+{W2gZUSCgXBP$#ZJ*u`*PbkKheZtfEfxS
zA@D`XXKfkTdo742xE#sD8K@cjgkLL4c`EM@<)SF?2u()bx(fk7Qzf_G5EzOlrVkHA
zs@}7=4VdV=p(Y`FyUETYnQVbFO?DboW|8lkC<IG!Yy#$UP>&b^%(IgVmiQ~ph>PCt
zTJ}?-YO&-8`NRN#enjSN4%Ia~poWCrQD&B#+k7>w+QECvuFkcU%{f3UC|Pr#h%dMu
zLZWDXX!yTk>7Oh&oc6(9I$?KZNl&iDDaq;YfZi}EkNdS=3VVt(PUE-YC@BSWgr+zX
z=Q0zDuU#6aCT_i0n9u30Xe^7cS(i_fsoGEp0hIOz%fKC)p4>%t*c9eQv3^5SiD9^<
zoT7)(37gN-F9r&JQOh=EFsV{U@sm5VMpj>D%@!b%XgEwtqR!V}rI4`I%E+H!_>&`A
zH3SX_G1p1D)tUoG*1710vTbMRd0V`{F}Hj>TWYz`BArPu|Mb7%!T(#5=^g{Endjbd
z&!;ua#L&+$g$5<(*b@kG_&c*=nDS`1wM$1_?v$__gUOJnTj;iJZ%S^zyvJG0b1~>a
zr{#CRwg$Mwnp1F}zwd>zAYCLuZdApaPLkBd#M0>&w|S)yuy5{E3u-Zb(0udH0h^Yu
zMf){>>2_ya$*1q11Y{3OwhO;qj5$Y^I2jd_#x@xhZ*yTT+aNgZyw5nOEN4pnGTCOE
z_EF03F=O^Y4rW<FdL9&f_2D=fnxk!L!>mpJ?wI`}>U9vxKQJa3d)vau>C0q@VtD$=
z!Wp(0f0~Cx*^TgVzgI)&7xnGP8De%l>(4OT&@n7_sJ>C3rPmJt;2us&1g>`leiu~3
z=gf|=nL?M})bjt?Y1XA>&L9EWj37<Fu-L1%jq4w&Hui>p%w{M|oqP#;W4-;e=roPJ
zx`m(Wx0gS$0(L#7rHs5<x~<<+fK>fE+K^#-0rrPs3+1ltOXse3ixpm$1}4e69}fQA
zA^JxIFQ9)=AKJkm{;hy}<!vB$M!|sYDI~JjT>65wm`vg-(zZ7!+z|Ii1D8>G>Ph|u
z!R+@eUQnok6c6eAPlcGD(3ne#K`X#QiC|GLx_KO0UJ4hJH5P5Fpg*^n4bh}||65LK
z!akVFMm3<6PSOu|A%C+HI%PMyEXS$9V3wL(vJMSh7m!X1U0C00VHW@Vp<X{jd9O<e
zJ3~`S9LQg+z4vUn>;K}=|7U1_U{q2eG$<e};S4ev!EE_FTphhiSm^>kaOk4<$tw&U
zws>-%*>K{qZD6-nB;-iPqh{gMlKl(cmhvf?5WZLtaPqMzFF~oxm*+HJq6HSw&DEsO
zpAPg@tOr)6jQ<>s9j)rc_35jL?JMaN65V#UQ9p~2@N30n*RsHQued%Lx_;Rmuob*h
z#z#<RDKCGrdBZ**lEZ=CA9<4z9`V0G(!cny|GNDg446{$VeNt7Kv&r{mR<uhhBghs
z8hT$nZh{n6NF<%V?N$sa64TqEHw;QPkt*UqUgYtf+-t(kWY<CkOedYHBpYo*aG{?n
znkXSyWqCdynwW&c>3#D)>$UwxNrIaFOqD$7gbq#EjbGXq7fyR|YP24Y$7^W#lgxUi
zCgu^r;lK5<|1ghXMl{xtv=8`g1a0vlG4B~Z@Vn)OA`_n*I2Y{hZajLA3$W|;<12#M
zP0*F}s!{Ypfwh8B+&)J^&cvZJT09*Doi!r2n79ksXr{%lbIciFQ+?7xU%D~`L;Sv4
zW!~nO!{|c-*fvrmPiwh*b;P0FHGE_99Cm}DYsI=sVeccu*_nA?inHJv^bD?H1|a`W
zLh>g=NPdUTw`?|VIuunX%i&{<8?8ajY>qoyB+FyI5QfyEG3`SIGI-#JKB03=*ZBfC
zi}wvtWeIQTm74FRs}&}{(gRuMj?{$g-n3AYj6HN2p{M7I4_rfi?IP9e(*hW+GU3B&
zs1u#~$b*FHVu*A$>$Ka@fxXH?_9RVH_6ipVFWBD5>q9U(DS`MjfH;LnNJsSl0_A_P
zfni#-AE(dyS;pSt#hW+F!TP&+Gnl%**2Lh_leNO$ZBsB@B-KRFv?XyA!w&sLumn$X
z=L<lobD%xz@tk4wh=7wv%-<^%sivQ#GP87LphckOO<qs+lZtIG;G5&Z3qWpW8IcZ?
zM0w+158Yd&VB4`QS$!(`L9ngQv>#f#GUiR_{Ut*G#zwV>(OAc^##z3Qx86d5X(7WF
z*r;eq)QSpxH*fU`n!kn|^jHu1R7HCQYS;Co7-w*pJAa2sy;R#E8wrH)#iKEV>R{nk
z#+jqBvebnhK7Qhj>%cT$q1G|Ld|p)~7sKfnD4@@7suIp^Qu2C(-#8bl*QrAM0dM<1
zIxf_I1tsZy%N8J%jwEhWF?3FiNJlaz3%@zi6!p}^9ko9HHowIfNM|fZT%F1*4QN#~
zxOgfxtduuJc~}#i>~(|lYrfwYLvT;u;brnFU%yF)K;T05-=0?;On515{Bw(^E=&ie
zh2`yBK1o7n^H%!MifWzF{mJ<V9U=J(!&iC{EGUz+QyUTBL_JYw1J9@oR&jEsBz|Mz
z7j~K=i?d#VLH4J-`cG#3UpPTm5}$<#Nv@`6xTUcUbnOYTmg`w1jeH80?kUWz6y$ah
zlwghPt{Jh9LVK7xVBmJKrJinzb3idQr|%YeNCJS&^N@;UIKeA=djH0KQv0{yv#=v|
z36WUkO$|5d&XpO|aMn{d7D?B)sfu#xb7-T3tlqc6gtqJedY^}?vRr;QlU5Z(jm46Z
zbe<6r<>Z#p$4m@pKe+x+Qur^nj`}W^8;xWT+!fa4&n1Z9hml$<b3j8~EhBlxFasUg
zzQ<9sCZq(7$UG^^ce>I%*$i-JeN>t-`-Gf5*!KVn6e$n_KyRnEc&76Vqbn6w(rql5
zL)Gt!v}IyIX(^60Hvdh`mZBiA`I-HYeGSkX77or20u#r4=UuiKQmTr+427xBb|koD
zcR#1`Ti^-7&4JLEc!U?gzN<S_ZEWCmN-A?n>vqmRVE#@d6{G2h&Af|$J5u@Z7Qb#$
z*c?uaMnv-^%bgn2`-;&7zqRDOp#=5(23cI`Re`{+9y3qHeg8nk`)&m9&OY=0f3|8y
zw9A9J{>%my{RRd7P?OUbs6+u#Bb6$jVWF_rX)a7k;TdvJAI^h^9Lz8ai$Mu^Y{m#&
zXs!^8T?L1#B&nV1k;y%c;+?jj4D~|eWhP9cU38$7vfwzVoCpg<d8Wb`ZZ$*Z06$8I
z`{FZD#nfQ%hYKS+Uv7$rT7S2DZz$1{o(|!3IMJ&FAOrDAzrmocz3qJoLoWi~Dr1PK
z0L+qQ=z}R0V!Nxzyo%kQGHQRloX?k(BemxgJPQH9i%ut!SP{Td3)znTzcb097^yT^
zKfcvllrjK>q_@3mFdSSEG##ut8aklEYLQKfK~3*4QIu|uYvesZx{BUy?7Yj5r#Mm>
zEpl;2C&5`4K?!X5==^Wt=|3u4wA|>)j7Yr+IJ+Tx23v@ywsZCAW(4+^CmN(Og7ohr
zX<T<HTw_}!)W)XVFPQYZ$tBtzB()vdymJizQ9=;8J$S=L{|VIp*LMTY9-bzH$q@Wx
z$fuAW=PWLh8Cq=kEts4U_@v?3^32xCnWT-y943Oaz!EtPKu?dnsu;)<lg3`yVz>pW
z#BG!suGcp*jK}#$<hqbM_`8T5EhUNBAwqwW%-G!}L=UA)qK&}i(!?-#&Z~jt^r{cJ
z2EV@ui>@UsrF+h++uw3X4E)9?ZbwPgdZ<_K4jaWB($dW)>Uo2Ki_ckT`G`JIFM#XU
zgSLqx!IE`Z3&<FTyI~Bjl6i_)8&Iq4fhuzEKN_?!nis=K{W`Flq5#gG!C`1O)K0qo
z8Fh>4n8Pa`xR7<ekkClhL$7d<yQ+#N#1HkIwB~nsgOdBap$&FOBg4WDGt~DjHDEzq
zj4ONR@0NZ;9~*(>NCso834|bfd%@eo?Nwy3X$M47tDL{h>&NB<HD<{qkqJub(Y0s_
zezQOOlS#q)0i}K61X^icx3<1RinQT)3+yJlB%00@!z2KMzw^=`(TBcBwZZd*hkFOX
zcHE7y@t2Ywk-gtt+H8UGKUkQChJs$rN|SzEi<F69{Hen;J4gzq_pgoiI$RJ3rCDRI
zr_%s`J@T-H^Nbu;&clrP&{F?nnuxNfY--F<$RCT8BqKvAjreX9<#YSZR&k#;<rvT|
zpckvD;#T#SOd9TE)2EDvVOnw3G6;VG%3fXQg-GFB_p98?<(<fYDD07EDT@kX+!S>4
zE$;vMp!kdbS15wNZx@EC!;^==q<txwFdbo?(=xjNJO6HBOkj@{QDiT*z7#+LLmL0F
z>4<)nFVh}%Am@P%9q2K>C>%ea4a#pNf#DZbxh^$C*lrqxbo<X2MJ?0<eW)AA<%rOP
zv)z3*CwVo}_zf`LG(c;kOG~fA?2m(CzIf=BK`3iaQKUfL=e`)a{c|d%!uEz%o)SRl
z^%lw=T>m!_X$^Bz))e&WexaQKIhf^oTK+84T9A(83n`j5+S_!M{C<VSe(laJ2xH5w
z?mx8vyl~+%hx85__IpIG&b@eLfA0ZUp8G4y9gG)dSTFW>R`sFgh{M4%#_NV6FL8gN
zNeg<!12{-|BfiQ}7R%|>e&ib64_ZsY*<v8Z|2*9vEOSsJPi5Zf8~EV`=m)ooukT-%
z{Qfogq2jD1O7TS?<pom7S6KTBJ4AUH1>R8RVf%uIl2gO$3AIh-wsXFh8w#soLJujs
zcGKqMcNrEVZ%gDtV=B~q7$mz4n}EK&Ax4w{2}E8S?XXy6mBsyQkI_kZYp@C4@5}4O
zisRY;2rP8_2v|5M9;RTeV)iQn+MKO~*XV5vLW+rzB4QT=4(p1&;Hs>)3)Xhll_XLi
z6j-S~XJ4xCTx#pPu%W_>!rrbF1bb|c)fmYO)9JDw{CrX=$BfeDtkB_c(3KG%wWkrR
zGRHZm-j%(|)$w&JNy@x^Me;`_rZ=4EN3Zk-5o+rzGH8DmzNVt$vluV~rhl!aGDsjz
z*U!A=bO<7;LY8n`ojm_XBrp|`GhJyB5p+Cbp#tt}rt|uBxp*go^#8|xDoW_y=<-Ro
zm<<8#iccUT5txN?Jz%>ix0;g-sF(mGI>{pacIN9eo*$H<C$GFVvY=b&K7$_PYa;Kh
zo92EsL56LK6wd>*HW{JtZJX2nhf;gwKr~%mfpO}qnsA+MnA|W3UHzXym?Zdt#mWA`
zk?kdA*|x>Upq%~ae*_w-&k>QRXP+NqgPs25DRjSJcBqHP<d0X5oI!%_i0au8TISBh
zoh4FLnvJ@jLqlhzMY^&?;u_|kQtxSWRLtp*@>}6}>=QB5$Z%CB3+x%z@>t<8y{Hjd
z)ItF*Bb1^v7IOW+o%<VJ%vg#Mva7HSa787<lZ6Zs@ViL!>wmc8lNg0;<s{148cQGh
zd5a@Y=Alr)D!ktu`rv<zvIDA+U15RVLZ5+BG0|6+?s(TF!N#rwXK>xE?6%St#^3IJ
z$5&*bw|(+ZfekV;2yhJ_y-fsLazLuAIdcVeNz&^=O%tDv{j4N-JV}4SN)c&HRWRP!
zG;K_kpVaCrGi!Ga>jVncj1ZV0WQ1<H)O~0FS;OIYg3dzZFHF%w-r=6|U;7E~CRn3q
z0Gr_7x88)vK#TsRpP}-=za*Xj%5UqAddg^#u<j87NPsClg0|m+O_WaLy>ULLT7F2X
z+`zOYjt4b*lF_aerbS%GF8*PUn}S>pE<O2bcz2UrxXH52))$k11P^~XSt)@434Tuk
z|BJ1E7?cRX&sDPf)<N4%<$uis*q%Rx4YcDRDXyM|e2oBaQCHop1`*Sn&^Zw3$8}A<
zg5~DPF@HoSc6E3#q3=-fPMgOY3$#fDxY*K6mp3Vc8OsRM{{M)Qv}N%gX*<B~=e@&K
zI!yCc=jCax>dbFk;zKX&ChT$hFR&7y)}aUXFx{oxOa}{;BpIhCM7xL6N$YWXk0uF$
zKK}dC>^~2TR2XJr3fOQFZtdX<({IonV`iZDE$DcVsYWT`N6?I4qn{wkK+ee1<!jfS
z5o+XXs|KPl@6Lg-ig37ys44*UAv%AcQip#Yh=2a>|7kl>q6Oh4v7<62U#@oue)cxl
zJ2inV6AFciL0b-uWKshEXE`bm1}4x%F}Cck{M$FREP5gNr@O8!PtL=+#kNl%eLLU%
zFa-<xuHy*^*#Bwqe@<Nf<x>Ie8`zshzSEc>t`tgS8i`2@*M1_H^Ci3T&s;`+GJ2g5
zOoO;)`u7wJ8Q&g2AG#94O(RT;BTWd}&{!@5N~`?SbX1R&m}3cl_Vy~2!(i@z3sSRX
z(Vy}Mu8U}{R0$&zEZ$kzo<J7h>^`4;NRU77i!C8<tCTcJcV&6-E7`szOQBpV!NN20
z$9>vga1MU*sxME+%x3p%w^dH)KTI!sHYKu=r@q1O@%NY2{o}H|?BRJF(MT<($MCRj
zLk&2y&y-}?IQdFqKwDo<`nvvJzYBJyChU<+s7|P!ew2*R1||)&q7*^hMN(t204!TQ
zV!*od+paEetv0Rw2<1%|-g(Ky^M#O9pVF|?*5Hp)g^?Q79z^!DRjo5WmPXj#O%ChG
zGk^Gv@;lGyc)$qpJJ)@3Dt@!r(NsxLj+f5=c$7aILI<Bes>qCKLQn#IHBkU(xE+uQ
z*3MuOMVDx?9Wu8nw~TCsy^V9;B>}9wJJpnYSvw<1EXEObI>p=cEi$tUKyDK-NtBV0
zBPSe|h;3yqYCB6`WyxVM$}4Xp2d~PS-*xHT$=^!wJR7_v-0;C!|NMpmov*=tskOwT
zbzAL8%0nR`cl5JYpPzB~*1;lA^<4km{q?sb^ha6GI(E-HE)oR4f^S?$4b+5RDnc$<
z+T782)4^MVKEyU{j`A@YPh9=(?l45KlX8~7u)KCL`%hUtlL`6&_EpK6?}Uq(LbfmF
z3B^YB_P+(ls4|}A7C;3GTz^L<gk<F+<ylt`E0Q@)i|CSNTWle<QB#|k>W@=2xWQj|
zW=ij}H=H6EkU3y<d5YC(VCdV+;)*(r1aCM4-n{7gBY7hQq9ODQ;N(8&|LVT}Cl|^t
z!6cT{Dx<$q7k(@Jv$qfYWEHB4QXO?JizMiyAedm2vtz_yeH#(&@attlO2}YNKUpbm
zpRJWMxz+51wd*2BdRO@@Um*mCxXBlaQN8O^mJ<0O9Nt?UaNa+}N#if~ssm^r@g=Jq
z1zr8YY-mxGLY1RSPWS2(e!yd<NU510?;KGvzMU(nEo{+!f4*+%*rNG&rFvLj3*^(X
zWsFV2m5QO(!-OUGU%g)ijT+I!lYaFozfRYywVQF_a+tJWI%wJ`6WKBRf9VZ}68cjB
zTM8Z$Q@!!!&A9JIce#rN;~iL7nD8M=W0>~=>QSAG!`iIV^QhrhQ<Vr@vB$kBZaGx<
z>j^U6H&foT1I!*U8RhVp%vlBVf4Z5IYx&RITfKg~I}tBUT5isajrZog#0>0@+=rXR
zcbcLE7nVP?9?&gWRG%eb>b(ydszdc-7EsR{c4UTldql>mr0~P&St7cdgzxDC_45mG
zbR23F4^lSGjDg1e;jvAZ`%C^I@ZsML*St%h5F@rO%b?pe*Xi%W9!$3_TVohUNHy_N
z*>uAM`?A_-8W-3^V_|OeHA|po5*z#zU%ghjaW~~ln^YgZi7&3BUj>LpCy%ngr|&%0
z3+DP>pEO6Wdcl9Ye)mM5T{Sho8y6v4YF8JV8xy}K6x*AwF3~$D^}<+0O$L=}A1w-2
zm_P{Uq^QfAjhp}b?ne)LU+(K|4Ly@2vM;SJoB3`~Pn|{THz;{WV^%t+%U_g-+POv1
zgHnj=SkgcJe@DD*Hjj)j0O4$V4zY}a_!B^1lBki=lf1{J*Oi8d+&iJ6=~(a{kXHvg
zZOl(7^lzh^QQ}cmMUVtEzHC!t`<4ed6uxi-mj97!!TuXT!R{DNmWQ1dIy!;dj6ry!
zn~KecKd2n1M(a7|!e+m{o%+ynWGr@^TRc?T)*xpg=J?B*%6>B6*7*g~zL>|#Y+2j-
zm6UO*O*@j8ZgG1uX*Zub!Rhj*XXW?Zo-{kew@$$q$8N5y`sZ@I7PWT|?^T}<V1cR?
zV}ZT=Ix6tB68c*FvVn6YN`d_6qSMUxhCRML<Z+-Ty`F&Okj33WdHYa}hY~r&XCmop
z)!<k_Qm1!No2Ch!o&yXGiC{<ilokB~jpxngOx0b%rnr|R?*Q@6<3aHW>S9Z`*zh6m
zwuSLq+}l2`#<O7hzz@YUa}^i>@Yo6f7Swu!=%3v{aU4*T`Z3s>qI1C|gKM4D>Q7zP
z*`JWyhhf&<7K&mE98n${uj?_%QtCo;8V7ogTLN$;Tx=aI8>0u04@<?|>M)L5e|>1a
zp={o}W&i)!dhdTY8@B5=O-S?zqPK*I7QGKq6M~3DFTo(9cQT^|LG%)$N3@7uM;)T~
ziC#u0Mj1vOW!j$W+0S*~d%vIe5Aci6Ip=vC>saf%kkdw%^#$>YgP9Ox$to|m>5r6{
ztznqUdXLg^t<|E2=I8dR+7H9MY`h|b^A)eMK*ExAz<f*6zcO@nJ<a108e!rW9c`L~
z<;!+d?~T;%<#5qZJFvf>&tt>jX;>(HVoG*rM6S<N1YxQj6VCurel~aQob1^acde!#
zhrTu#TPHQWM$K_iGMx>sj+Y#XBrQCe{9o1SU4X`SxIw~#v{kTmUJ%y0S@)!>!+x%m
zkKK-FaZzrmY<D$l#o+mnNu;R8k~|{010Z0dKbv#cHAfM*S>UoYa${X2y^`BT=nls$
z_B{Ui0;<jBdg<HTZzVYap={teee{)+2>g2}&Y4(LR9BFIfe;H2Mh`kLGsjKkhmwij
z{SnC7NkU+3;K?*2{XsB>&94px#SIAqP^Wj#EoiB#+SgUgYV<dh4Pj9S3}-%84R&RT
zl(_d7VCq`P3V5`|xh^aaaAC`1>-&MTcO{@KJ;#427&&08Tc2*Z%@9oO%rK;dY)3tl
z@*6X6MGukN&a4GeE4kPPv9Lu!<&ozr{bmT4mW97YD?ov&Med-Pc_fsSm06g=!jVWE
zUdjEq&Q<odtZ~2k<RIxefTt}t4=hp5&1nkc2vcGLBJhZZnB$n=<FmEL@=i&5&iwM6
zAn>drx{+WBYSzh;lB~<J(xj+^SfLz2D8IxduYMiTo4MrdW%cHxeF-cqcWjwZ!K>CY
zo(<Fc0|fcO&v<N#;^p>D4SNhb2<3LRCtaV^5ns)i7yRVpTw|{mzCObmxHvd--tLD)
zaFH-RhXDv;pw(r#^F&YdjPu{EMvNr}u6n+d<k25wc&CFe;V$M9y(hAN>5v=il?VrB
zNV_!F9tG{<!H}PbHnjZVD>J8@GbC(hvciG0yMr>=s;+2IOJ_eMjEZ_M3;rixX}*f*
zGrX<YYah4lHea*$W7<ivr60z!Cv(2mK@o>C62p>GA~~ur$2&nCVN?wbv#w5bys>86
zCk^=9Ec2DEC|e(utwX<+Ko^k+#bc1&->tH_d`(stfy%kLAnaP}q2HBtmSUCy&wmuA
z?<%w*!D_3FYkZQQgVlPnb`xk$Y`A*$HM&*Ih-}+XSP#Vir76{Af1YzxmF(ra5e3@?
z2|!S9?~sU#hH>KEtS)6CDw%qwQ_lx29{;Z{deQZdE(+tNkNm&LqC~*@oE(tFQ`;>|
zayGgoV32+mUZCd#5rQ1t7rz5)7ylElfL1FrDNC~mSQ0|}=IK?yW2#t8vXX=Ig5ufG
zRkjt=yA}IaSqD<CjD*>7zB%!w6*8-J7PY#@J-7Ggw_oqHCrVzZB>1hnU?PkXHo)mF
ze$^$p!ID>zw*-Vz8g)4DH0={|sBaT_HtlhWKO4ENj^%xJm~nvReLHzvIk`|eRai2b
z<ae)ZJ=}fco4!Bx1-&LW0H-1%kLVJ(5#Vk-GW5`vQB26l{xOK}q|&;Zej_Meac#=q
z^{aqUqiupx@4z+G65%Au?W#qspo=4wdsT85hu-s@E<((kg?<mX2yHFj*xK8A7}k9D
z&5JMPbbYug#w4Fw@d(VRV>%}V-+y3L=7$NiM|}4BJ{3|}I7`BkbB+(C2tXG}7p&0X
zad}OwpCVqWEGx~1BM-7r{>rYl+6<Vm1Vt9uSxeTzNSkI9Y>#l&%CP{t39W}81od#5
z*Zxi7v#Qq!b+#xNH9cB<%>R1P>80#-v5~>zptJq!N4RbmWb(w89ceRVJXnfmxd6Dw
z9(>FsR%0+GGn>1O))Jhqw(5+4Ba_xG{e(s$^0%fc*`oNP3M{LjK&v3U<HL!Arn8U4
z<p$?Gpr@oJ?%K+M-O)@M2$O(f&@2T(Iqn{$vf_()t2%ojc|<H7&m~6d9DyvKjE4|k
zh{Cy~e>H!-t#Wn9@pF7wqpNiJ0Cdz`f*kB;e=0n1NF0hh@1S;utD0q@zF61mUhTdg
zsSlutpd;?zI*=s}i&w{?v0LAwSpfv;CA@MHg)Z4saPr^?>i+YcH=Gw2IS`B4oEThA
zFVsKbsQKd_PH!EP4a?F#B9m~L86g&)*ckBYnGU>v&iT%)d_rvZl1(!sKY^689<t(J
z5#^GQo(CD{32rFK^PkHN+!b|NEPV0U%QIGScK=Q*cD>H!aP^rlHo7G89#wA#!=nl&
zqT8_%Ek}ZK5>9)?Z5Jmw8xLCb+nf_Eh*^RWja8!~4K9!*#j90CU(D!iFU5sa1OTnH
z{WMF`DQ(I9?9t4Aa6(Uq7bOdW5KQ&*PLRmy9wyf!V5b?~>yX!zISB4c{CLKEpI=|U
z)z_lTG)IA5d`RU@g<;}hy&GpPBGT=nG~xWo-sLg*nwwhs`)=x}-J4W$UAe*N;I$uP
z>QeH^=#?t6TPJWg^cVliSB@lb=a`Bg(52ffX6;=av-)dF|4!AR>Z+VLTS{sE<<~Ci
z$9WfsL_HfpEiiO(HRfgzeK0xn5J-KO@+pw+UZ0?i=*K?R>dEa*1q)59ACj@-8!;(A
zMC45$_+ZENHYTl7FRYvY_t@Ea9IG7mnbPHK#-&_il=(=43wzN;!GDH3CxH~d?mnw2
zvAi1&<iVV#Q1e84s&kq@tT1$=tBWtz$x0h+;Sq3F{&`*230-~>feBUKd{(RAzp{_+
zK3~x|eh#Vd(#B9i7U}MU5kFhgnGxls26(UBMUkn>nO_Zx%meMj33p`q&aIik7j!(=
z14k)IGAtHf%O54IY{;PxRb>*)<)T88(Y-;xw|)#))>X*6*oxbaL~SzIF`hp9m_Pcr
zv=gNp`crOglh7lmQ)|e@C(?A98KF>p{$dTi6L7Mn{&Fx|Rk#hg@O(i3YV~Z^vc_k|
zLW!mr_P0&F!-w-3Z8ZYi^q0eiu-bi>tW_oh8&YqbKvMzSN@63mcAv#1Xs%!Fxob-^
z71J!pAGB$jn=I^oq6PSonY3uK`hZWP556T9wW(vM(D3afDe#=gPYOaFHU1&`@_Le%
z#_slbfpgb|N9YK=H(uuILZ;(9h_ru}L+m6UgNiD;?)mlU<@;B`SuC}Oyn31UJy_`m
z^31D5Z|$lkC~<If&fqRfHb4~j)Ft0*XThB1yn~qJ9_F5Gtzi=>rI!VP3YBJsK}Wi+
zNT!u;udR_gDBM?ZNtGDT($S=An2x8-fccZQszcD&WjdT#p&&p5IOACxv$)<JbSaxj
z{KO~uPSiwxK4&BdNy6WC>)2rCR}*Zs`?gXCQ&br?s%2)V#hSQ4W{u8vqpCApMVe83
zN^?iDtctrvW{(m>cOq_X`RnkjUKiD~2X;W)U9#M*x6_EtS#p-FYdFsf{r=wBk7L=N
zZY2+QVOFbyaaJStpS^imPRB60Q9aT`wBe30+z!%ivj|hdOpUd#etDiK8u_M5p9jiI
z*@b9rS}}2;w+!bpOI>-<25aw8yB^ewD>r~ZM=!iSjyax!T{%yZh-Q2-aG%ofVtc-N
zV(H0^;TOZ>LBqOI+ucE;;@>`o=LMbS>*UBif^M0nETz?dhNTJzsay-DUFL9ExKGpN
z(uFw2xOE7x3xkw0ksQlqz-K9Iv3j+x&5yfK1Ag7=kY+CgiDy78<sC+y8I!7zkQr0q
ziI?A=0`L`^=d>M&&x}C~b_S-y4h|`=ZvQ1dUSDo0<o$)+tPxy0-yx1K_Xd63_Xxi+
zM_s%pi91v0xh(ix1@u7skt^+~dF%(s?@#3I+y9YqL)De91to8wx`MaXt=0^D*ww$U
z7QPNmRDW+0UY%GIWg^Qn%t+g;Eg*ksEtGu4$qViA-iXxhD_=_#I_X(YBywW^ITa56
zpQpk@YSj>tSVT^M=fgSxg&qhIYB^;dA)_+Tx%gx%I{c;fo`TAh;`!-D<4Gk*qicUW
z@*o-woKd-*<Fnu)^#mBql_-<=iN;m)Ru`$wPLHzI4!JD#*pFpL;WY+7D3~}gLX(U;
zw|4j3VlqNlT<aa1NG?fuVj2Qs-Xi18Du<f}W}c~}*NX^YA1zLRdY*xL;2*e724vU)
z&Oh0j&f~@Sjm%1172&oe@kwtwuQN>%nOu=eOky&>Uw2&|UX!SWdINyX$+EIUS13Bq
z056jHNpZdlsJGjYOzpa_*$F-@2}6#~g63R7NS56l%ll-X=(~jQ)Wh}9hxZALxdw?z
z*wd3Lb<ezeTpT3HpPhlVu5g$7==Slwuf`w07ta2TNzDH;b$5OXa{zUD_@<H4By*PZ
z1~muuO0WZ`@N!+8^pe7IrVwaGS?V?P-8%yGDBm7<@TF-pEjWsPH%)~B$0}yUg{l1u
zZFLp>V4r~X@xQGZMfWf;j{2^hq(3V01@1!v;|4fRncMUFMkO5YWYGxE@3|E1i2LGn
zA^Lcg^qH2gI3x?Q^2?UhASHc*MxpwPU@t)t|IR*6uG!LWls=NH(C-O&xw3ivlmB%M
z>T!?&a7@K?$$hjaX-aQD0H;eeUza%0ZW$<h&mVa0BnZYpY^Ms2>mnV{p<;BXjfi1N
z9BSizA`~{7i(!2abhHdUdsJgiA}4&n>V8No8j~gZy5fT*+$mi+$$aaCG!$zJJ2-0l
z#-aEDh{d{fYzWtkbTXLvMs13jj0}`<fsSiRtiIro9KE<PZuv}dktO{3&u2da&qs}<
ze35SR!-3hHhoFm`>7Peh(e}^MW1>^|^hQ#7SAE7bnIlb)tw`2ozItr*^~eO{<pke4
zTs^9|bXT@=n(!`iugU*h!9->aNHI?|<-(2@gpd8niv(g*r!K|0p!}5jLcqi00IJ{t
z8?;-Cui9hMq@gcy%=DM6Pf7F5B->yoU+GySqx0ysES?8lULr<%JLy@Z8x1RFq8Rfe
z2u4lcU-){$(sQX9IjHLt&jFm4oZ!Djh%WWoXkV|N=h<mjf8^Z$b(M#Da$iG4b($sn
zTw95Xic}+wjQ+Fxjsg|k-t@*4yPBd3ea|$kw{1W3RFh&xR7Ad)`q#FmhXF^eL;Flk
zWGs-bOYl!I@Nwk!BpvPLFUic5_8T^QEZ*5<a!AKX#R1`;8wwRz>k`Fr&w$*sC^WB`
zch9f;c*4Io{zGcDkjz$~6t@!YBG8#j?cw4RDlYSmXWiW4)mwFDt}pmv&SL9?hh8QL
z-TwW8_Xz~9LW89dt9UroBot3$S+)Q9h+J|$Dmf_h`R2@_58RbTtl(~x<|zGaTBAq>
z=(5*AT<vxb*F)>f_9v~$3tAZjZo%pwK|D<M$)Q|X8Ra6i+y*MfCyv7b+>5?~q4g~E
zADk;8LBF$4>uG)sAo3!vY8-I#Xe;o+4$-p?I7%bh3D>x*K%Az7zZecax=E0sZa!R@
zjd&?VORW^XkQN2*c^1#Hc>HqzW%&8foM?yL44A1F`!fLZy6SxYL{BN+1i7eU!SKRr
z!$-APvI`UanwJdqw(yMErM&(!m4-Ja(;1;7<-#HI(YeO1-yL)w6H1}T37tu-AXD=<
zDHMEw-o1Q1qOu}DQym!|d$<!i^65<u-R@^kmY^pN5%M?v<J?+zGDi?eEd^6I#~7B@
z$9jJ_8kF?yFh@YzOBz$NLf_;t3|zfA1^lB*i0{JPpi+yUgI!p?5Z6?4Z0)cH8aGUA
z;~J2CW~i9JrKLX~<0RwER+Fen!8B$;?vd9_*6e75BHe%g{c9PBtb3(vt4sjYP<fev
zv6IgIk#dc7-E3UIPES6SCoHaQjss~pu7Y)3V#3QDIa&L3gA$|HC9X>m!oc_OjfIlt
zGR#+#dTV~uw?%C;Ryxep)>XKf4vBr1Z_B`9LaD=KZr-hDePy=3ULKZB%C*m;(zQ~)
zX7;u!|IycO`mly_>Kpo1EE1YnX<5<oxu)W6>-WuDVWrk0K*J8&1J=Pb(KSB=8^n?k
zb$>1p7HFGeJ!BRV_8$k_tKVc%t>J#zY*ePSzpr4*n;c=eA_8@HT~-CA`*VHxs|HQI
z$wVL6^68s5Z12=*RDfyn0HXBTnACRkz`|n^!p79kPJSMSRSKfV<Bz!R^+X}UO>3bW
zub%T7Z`a+v2Bd2djRy~<1zi7q=PQHN9>W(7Vb6a(T-ckmtG-5q;4k-Y=bMK<ToE~`
z<;(JzDbJ9y=@H4;$bneKQ0IR7S^l<67yBvi3U>liY5?amczzM7DpiEk^8kbX3KZ>Y
z2l4VriVkK!^s0CG>64*7M~X4CCc)nlN&FZp5%FG6e7M%h#n3c=mD&xEVS{7~jn%e0
zPJJO-AcjF>k0O}*hdS*kdmcR`lQiSn_ImLVL%?>OUkg`H6@1ONGOJE~+1=l^*>1Qh
zaSofme(o)@gGq88Cm)mT1u#i;O5L6Bb;u6X7bHoJd*%uwSvZya+^N>7ftpWHVy3C{
z4<-bvl$TgcfX%b9-<@CJZc{p+2sKK%8U*twOi_ykri?E1zh<JjR1ho^OcwbJO!i8;
zt`az)x6)re%R@acpN3dn^C*2KkbTSo<V|4`;2Qph>_?tQJ@*vz9&FLbly=Lvt9f+7
zQ5$2n*^C3wPv5CZo%*henC7c{^Wz-XRAVbvMagJ5P+d$Bx~s5vetplsYMU$Y*uYd9
zEzu)^=#2<1t8ASflOs$_r2Um#sj=1EFkTK{A+L&vu}futpVmgr83oyG(rJtNUXFPA
zg7iS`6`SR<mylUyZfS7Nu$7||lz`v6$i!c$UU$?H+Rss$XVFsHOlDeh)2}4wo^LeY
zWR~;<HnF@b^FN9VV4s<*o!(V{$u->ETC7^)vVL>rLb20=Dp?7CvGlVyeyY--|ILBs
zNxk{|b+_+Pc4EN+>>=T#^A#LJMz8c(*5Yp+P(9O?+b_SkS`DiedD5$Lhga+QfAcc*
z;UP^!se~!Up$MY0%)l$$%A9!3QqhWmSzd^x*ZwdazT%#5j_u`j(&dW_>vGc_{~Yk#
zG_?C0bimR%qn{(I&@MMkXHAdAI#!5Veya%)W$63Q$@w|6)!r|L-Do|l#{7TZ+eBMQ
zWXN+<*WX{U_go|YuDK*Ac?NHVssa(7WtXQrlg^t1YofL>SG_}($V3HB&7i5{aGzRI
zF4BSf>O=*Yt5J#CBr$@4{t=N0ZPhCjF_0;`0poty?5s&acr>MADGA(ZjLFE~HZp0j
z1Ak+}FaWlt@16k%6B$ezcI?f5j3qjGBwmW<wI=b5hfv$OL#QGB9k{--@h_w|^ffO^
zloN}>`BPR%YAN#3M?BQaY#4>ZD&n+e+vlS7v~SQ8`!i}*{i2*^$aqsAi`0hB<`P?{
z7oG9P==O2t_a2Rt=ise9P2XP?+9t73R0qrS6j@Ph=iG{h!v_?Dw20CN(o>L9>ZFV~
zyE)ATQ72prHNDvtMh%Hkb4qY0_d9xh>Lao&d`@8}{P?%>V9J|cpP38A9k5^Zk2?83
zL>OqTX9@@pZSR0thh8ZQqT1lOeK-HoEITRq->dz0vzFb4;og^H8ZZ^jkaQxB(lJk{
zi;2ZfEcsdBK}0&-jxqPE3wwVD1x~iHK*eHR-mRSrT^iZ)cP7VnKB40-%rWK=6H@z_
z421Ag_odvFVG0uThY4NeH0=Az_rg$<dH@?ARmXI`ynSmn;<_o#Agp4v96LnCCN~#=
z$Z-H2G?x%9ntE_!Vbg=`Z<1bVYz({QMtA2IuxugzZK%pDag${`+3~#Y?rp&KNo9`5
zSj1Xo;z~E7)$<`?lH6$?uVr?EgRF#S{)u!LqDyLi$##k&M;Q*F&(}JsZ8Vgq8UL>N
zJ{p`PfF3V<{LUf4>ayJv#>PG_kE!&jQ?<u0`7J)EJ@re-7zDcl?l5Mj=3tlQ-R5fe
za+$Rd&ep+LQ7!}~?c5o1xU6t-SYUgH1x%pX<*1?`@Vn)iwX%;0hfQ$M@y=x@UScOs
zU_G(`CsOuPkt{36pf>H*B1ZDl)&polJ3T%Pd_3Oy9`RrO;jT&uVX8!dFYw}pX)VdO
zNJKb9ZB_JAkID9ml?+?*Fej3bDs-~D!I<A0Y1->RWp;YOBWeT|XpyjdV2^%A%qu)7
zA)_+>sZ-Ex@?`Fv-f;HJ``GvZsR$9%aA=eTw!ndsFSHOkL1(XnX0O-m1(q9&23>UA
z?y3G)s_^{ONyu^k@EN<B>Q7^$PX37gf_t%f7%e3M&WODDh%W6%W)haI(=9#1h*Ev`
zk>Rv<W!vwjw{0+xo2FQlnSWIa-VnqK<V`-C0?;V*4jSkw+`nVZ&aQ6H>7#zWi0L$z
zPh+mT)N;fO{f)dz6*=|iThzdN{9FPdRd``OAceHaCS0!O{@JUruOl#A*W~J;;i&NN
zD_NlCia)%41{dMrT=&X0O|DMC!xCt^i)}r$3*L)|KcKG1?8d;>_xDm=IYCLt84)E8
zR`z-y=h*JB#@dK-39v!lIX0&1u1~m9Es-lM0eJVb$r<6yQ4}Yz?nBGpy=T(uyJSq>
zSl>jGh_Lim7Yx4Ed~;mKzC>6!wGjZyJ*Fk)@J-FRK#5mq`I9mHy{jvK@~Jvc&UYK%
zYU+40kLLsjQ8U#7iAa2j+7T`b|MtY>A$4HKLE@kt?NHXCvIP6UtTc^NT&6^gKvnxZ
zaY(Ofd8%w-%P#TU5TCFX=s7^E*-w+2>Mu1_6tq50x{in;oopbZjx5L?w8XGKV1M~m
zK%oa!`}}rY2=nL^9=b=opv)i2{xmK60KQ<EA52j6MybFLjwZZl9oWkUB529r;;?p^
zDV|EZ#E(y?lZ3IS8=<0;Ovhg$X^x>vtBE|^`F@8`d6puQ$2U7kuGdBlLbtAazq8EV
zyvmslfLA7!w<3Sk+4xFgHuC)jdef~K2aeipDZPdesc&7I@<Rp=#tZsAU))V89eq}M
zQ~0HRF&D9T&Nw-0JDt+bL#7E6Hlcbi%J3`W3(N>3<a2X0T`;6hPh=p?ZX}}IJ64!p
z3kqh@;w@#pgF1O*NzFt^zO&KaPfo9JO1W;t$ReQ!mjT}<-v5>@!3U)y5v^V#EfdRR
z!6J!77}ng^^lTRP7URJD$b+Lq)jPh@5iK2U(wAA<f@BsiP|AWGjQGA|xx)EN^QW82
zF!o2Y7Cs(hxDU%_|K8Kz(b9xCg%{i>3~+FIyC-a4CNN{|uQ;T(Y9e7hxdGnfcz>bQ
z*MF5>Iv}@sE>@LzdR~K(v^zZ=6E<N{2EDgI4I@HoWOY%he5In~29dSDnSO+1vwF$V
z&gW}N^s&=ExVX-_wL`~|pBF#w7!UA@T91+F<6Q_CjEYJi5bG&c4QD?3IL&YJPo{6w
z39gjNO8xD2F|qP-<_tF&3^LY}Gg`*S9<DNrg;L)MXQnQIyCv+~Qoh=y<nUW}Jo@dp
zIHohR)*fM1ereOD<^LT<yf1y2UG{e<SGv6DK3{mTwr1EIUOrkTEU#p5Zt1sSk>vj1
zer=O$(^l=h=sahuDPAE*t9i5sD_%t<RbN0n{T2J_?yyKToi2dK-rnXW(*UC%+4`HG
zUUI%8?_1Y1v)1=7tUk9CrCYqIFD^rt-qhCM?b&2$|JWlq=`|)Z{*S_>{EN*ck|V&p
zylmuV%NHK=F*)3=*6j(W8yO8oU}a{LvBW9r@W`6C;ct5O#4b`2%26Pc+K;S}l_fu<
z#qNyd-ngQr+NyPM;_s>0_Kmc?VI5axiR153FX5&||KQO~S@D@7=zg)&2Bxh35=p5#
zMZx+<dZw^QSK^qct*v9ykcTkR;OzE?;$vqm4!kGZueifW)p9-inte|RIjlzI3$<@K
z15gl6_NKDcd{^leI`K08mE@o;e`AL5r>K<zDtNyz1&VFpEwVF2(2||^ap)Z2WNJfY
zFrIvWN_>p`0v3~J7gcP|C_5n7hyMpHKrY-Y*ODK9VZz9kKA4&A){q$EkQekLhmlNT
z{cy!<pdzcXRUySB7(Y*F9Ik8;1qf37K#r55?rfSi_#deTO-Rk61gm8qWp`KjDc<LP
zbGK@?e{FqI)q`o188QzO5G+Z#8iG*szbrmH*18*}swK4*qy55{pUFJgLe3~xa_8e2
ze<bZs7fNjxgBw!tZ!aB!^m5R7<j$vVJgSOF$&HBaQ<P|jxIb!(r=|O0x=_#;xHft(
ztm40mNGMrhu<<I#rRoru=huL~+JXo~`2Ei-Y7<J(a@AGgaa*1nCW|Gf*1w`wQV9=r
z<@y+sat)87Gtf0L+(muPT3Krk-G5NVwDqQSE(qHG5A$K>T>_12){i`U<hrVFy=hEt
zsw1*N^X|<Fhj`;m2R6A}EoD|D%~sx=Z)Dg9FkXE;Ql)49?^!=GDaPA=4`P+*QvE!h
zVRF4pSZ=Y!ThRZ(FcU)QeOSju^YcQGD`0TO%B|sNmbioKh2AcQ6mr%BZIf^vZDKRL
z|FIopnPP&OwW@RO890&xZo8q?Aj?u8M>sN?k-E%b&HM)VdMl0C28Y(*cevZa{#ADH
zL0G+`xby7I$|wlMR%@isjA<`>6Yf4{twi5<(a}%Ch*-H?N0+eN>pO2fnP{Rv+83V%
z3<F&Lw%m~%2)YWW@1l21koV-1Ute`8h$o0Auqg58`sLxR%wV%hrcwT!EQduU!u6ji
zcf$#>u$m?67BTQ|A<o1WMbG#K<7RzY!p>?4PgMd)#VBo-5_3ey+dqpA3vpPfhB)(&
zS^?&q8wWFehb8;%TjMw64^WOGZHr0>bM+@3?Dg)qf$CRolf`kAOk#!H7Q&m_9pVh<
z&4Ty+@9=ZR4g7rRRCh0PA$q%3oB3%!v#UCRXUcKZ=umS$dL4S2)~n}%8AAUCXb;Jx
zDnh>UG`k9M$XsZ${6PiE@6~VE7BifgoPC$9fK97BbcZ^E#oBknjXxe5R{E62ujna^
zP-HVQ-l_gsMc(kP)P%w$y~>>{=G+`0v$dDPoLzV0lA1qTTPq9JP^{2mUIjA29dbSw
zX3suC*$&}aRLc#inW9s#KYr0k(#3D}njEwo(*`;D+LV6SJa~55MT&Y>n|rdPTDf8}
z{mY1&5L#KEn1DnMfzPvDNV#4ruJxJ#Yyt>oDRDb1b}x(F!)^=ok=A*R_x>mRVr)q>
z_r4$wN$f4(P&y*qC1vF^=O>+ScTX@s3om$6{M2ji*|$HQoHT8$BRuuxv!;EAnO{OH
zF5VIep&1S@$w{@$k<||6{vX1gT-n9NPYDb6J^#dW!@3+mPSfX{OvF{3jyn<kzug>w
z>SwRpueRqU0M&MJ>orttwn?4&SsDG2>ytx#6<7It$9|gMHO_v`5Q#b6>2<Q9{y*<U
zuQ{t2BV-N>P~D7&CNm$;>}LY@8jnJ%+cCd?KrW7Y_s<|o4OeF$=1pBpi5MGKd$?O&
zz6I#y1Z}zU$@J@S#*)e#yr^SlMYDz%{JTq;d$}vZ3jd8(p1zMREC;wXa(WPQ$SZ_k
zACqycdVV_?x9`3uzsh1JfV73=NI~MwDjW!MYYbUp4gNQ7*aR4J)|gdJ^hhmyZ*XBB
z7|&^3nZtYiR!zE?wv-hac=xo*u;Pmg{b4XFtZMxfgM-$7KHKZTH|9u@L6!`~y@T;4
z$}%I5AI1+KxA=hat8n=K`(_TKZ@c#3W4?>7bn<7}804_qXGiU{gpS&G;%n#p=<yOI
zd+a2Wl#O{(4K==*Oxf5z<@a|{Q3dOE8EYMrfz=5tJtJQ_v@p;PUIKJRo68Bu|I~8X
zR?W6^aI%BH&n7pR+0wqfK`IvHK}Tcv+W?W)2rNl^dy(}j3HbC#`^0DgYy!)d!4Mxl
zkH+4e0Ht^i>EcD;)1c<VWLR%{?fPp&3>f`-=KLM;DeJW$8#q5PU3B77RC`)@c%02&
z?seAq_(p2_>VKn7Y0|eYlmcj)Ufcq_X60$)DU56~*!icKkb*bE=QJZ-DXB45_AueS
zknPo6jqb^5G<9^g02EupV8)i;THVQ8@=27cM?<{-wtJe;_I#AoU>mYfGxA+ooCo)a
z_>5^^&qIJpp5$}r(d4&XCnb_xEJ7@@Q(#HBG1m<Yq*lZmmV&}4K2w0#GnUtWi@{Ax
zDi#)8&QAv}i)gakpe(e3uJF<v3vcu@-#^eC<PyMY?p!H;q$iV(ebozBA<}bnmrG#p
zqQI|Fm3rHzB(JF?@WSJIX}0Ltt~aR0jkixf($%e>wI*zT(PuJ(Y|UH5M0mYg0mMnX
zaSOA|<%!!bWH17N!O=h}#2-nTg)G-L`{-~frr!h*y8S_iPg$`q?ysgv>zV016y)pz
z3qMJAo-E~L!R#O~b4hEg@_xojs$?sK0T!`39Vv63dtK*>*ejL!X}f@><z2<OAiUkn
zQ_w;*XbunZsg4UnrP2tGTA9>b+Fi_zfH=KWmWjqsVxDp}?Uc4V@~_>VM!d2*r?Su+
zs&qT@>wFRE6|>!b8~=?=#eBZzxBrMc=w7@&Q_v}qOZQ8(k=sUnlUVEZl4HyuXae9A
zbBoGWt?jYsMEg@xLaF2z0hYcIN6V}4rpl{*&(^4A6XPScX&Sa4qm;|&e!#YXJbjrV
z3!H(@x8Ag9um}kM6B@zNjM<r}fA_6mHWXUq%}(&%`6Ha!&aA}(#&lQBH0djvx#hgo
zw$Rep^AZW9*{4!+&$8J^L<lIKD;|G*7+~aV-0!<&U1#G`$9J3F{#)f@xi$JtM&IQ@
zzJ1&;!*<i@#AX@A#oOg8qV|4@e<pRQi-<;pAhl(WNGcX5>E&_7g|LL6qjBHmkAW=W
zzCV(h<>gaX=RU;v*!cP`kA+zWSV3y?vq{9H6VauqTUFdOFE&1|{Npm!Sp9wI{$1J%
zRdX2bM7)Eqazut`X=D?Za6*&UIi2r+B1EBo8A59h6SRq8V8l@F+N<8?A4W<iD$hoW
zKV84kT`1eI{Wmp$_1?8wBXnZtHa&&n$sE@y?P!@u;0q#D!3+CI(5<Tpn?w6ut!HL`
z_Rf4k$NaZf0uVwZiCzzbtnotg*@4-st&n4?q8F&H*R+>&>oFti`*LnHOH?rZ5APb@
z8r3$;Iw#2z<s`5p=o|Zx*ejI(UweUtc1Sibl7!oDGHzjR<P{>_bnx99hD-lLz5J~;
zD?^dgG2_w~xTgC379pOUWmLDDE$=acNJ2H0EQ>t8=W^_8F*957cDT64{8o`Xdf7!g
z>pmH({<Av(KlDYX!gN}^in5B1k@-I-L}F?RN%l&+DVWe}71n{2KcWBEIQfrXdNV=U
zdXTJX<bM(dna5S@o@-V_<Vi8V(<j4l!9WU+&cT9oThkpCX;t(@KQU`#@HF)Kllm?7
zd$v6CGf!cmR3PH9B_Y0{)<Ef}4fyiAkI8LXnf-7@n<dl6+rJ@RvpUXoapceY;0Kg?
zIfSe92;X+~pC05)rIC%44^AuCf~R!3F!dEnC$Gj^I?08ozIf2xC7ZC<VPSqmqIGXx
z$||5Yc?3CPfQ~=&G_tBFoh~yQ*1(}#6|p^CMIvJa7+xLgJ%9Eo+fMj(0T}Im>7xg4
zE<ri4l&=iUSb(ORvPpN^@na>v@TIDr*ySk)N1Vq7AAGmL$@oNB>?EW`IA7rw_Xvji
zN_d8u*U7*0`wySwm=oeZdB66Ada!Ao@$fAnkQZ>OI|RmkCCO^stFI?T$-L!4)|9L?
zXy$_D#nJKq8Wo9TllW_r;YlpSWz&1ZZl2qG8^IwK42AyK>{!$KYFIrzvoNNCJq`Nl
z1L&99@vnVbHT~x{)JI2`?`_$1<4wJflPya15Tdi)nk&oHCv%QBNB0f@0+G&@9Sh<x
zOT1r`m@km__(t2<02rDkTuf0o+LBERg}iA@SZ)o7&NXWe+d=QL`iB?=0QCMYYtM8o
zQ3WqT@!K9Ocw1CC6UYC+2NGFAyW~rH1&Xl+42O{+0Ul}fWUP;f1ey3Wg7J4F0hYKI
zwd$`sGF21YqN9YoPaD!|yf5@-!`E(vn(L^u@W?!)H~z?K=l1RFLO+`9da=%Xp1C{s
zoj0}7*&$M8blsLk{Bz_#d=^-2oul${sjn`tTJK*850l;C(TGo=erzj0RrQz4W`!Y5
z=9|<$EV~ssQ4^9~h<8g#{4Fb~@H8$mG>J=_7p13^FxITArHDl)L{F}VMP0z&dT_(<
zbm$3<J=`scP@KB^NQ5(Nu$s8V^~WeA>cpS|ex_3re15AA-K~;vlyk^}v3DM&9(FeH
z#_egU_~U$xVm7bX<=tr6{Ut})ho0#oC=7o(|M~8V3>CPs6&yj@9mjs6*@NxpD)<2<
z?s7yUvVh>5Aue5e+~d8yKGjQ&*ld~?J4-5QheZgsd&@kd$k6`f*xZvdBL-)GRH1Pk
zYr|oBP5I<;{(m2chh)mPQ`lb4M|HF!K}hWxa07acAX|5X$*8wj=W-OlaTpRv8xJlF
zDwuYuD#&dhEX{}}LmKuZ>xkhr#@19qij-?(ZpABE9CKYKxPXe!w42wZe0EZE{*<2t
zW@7wwue~T#ImXaz9?#ci?}Zro@({796jb9;0DwGecdH%jAiTCV`$e}b|FsKrh~ftO
z2H~2k0<p_N>Wyu?%sDPFp4R!L^v1_OtdhfS$IVoKki-giK8kMc_q>%xcdJLKOGhJK
zv>t1N7hqj~tST+8$pJ99CFCSgOikM>=aHLPLT|;~!USNDKdRZT;eqZ_mjr#&#zl+w
zY6N;zK6{(0Y*$V<p)s*~cf@?C*wJgknvad8mrrigiD!F?Pgjnic{tO%(sYfP?A?AG
zgVMwr>9h0mOLAri7ItxT?8ITOn;KaisNnxR+64Oc*PBMF&~UZNR_wrtsm}mVD2`^?
zKWt_^n>6YxZ!MeQm;IXw9ZXTnN9awQ!)H%Qrw18bN?3^xT<2DS@`5La%@MpY`l*ei
zVmbV7hfbUkrPmdLx;BkX^YsW-DtDq&T)KVB7&l}gnY9d*EJPoK)U87~r%Ibq!zVu@
zv5U3{dJ{F1=(vT3Mm;5t*J^o+k70Wn_G00Jq{b@OQ1v+8B$}~V;-^1fu(vbec-Vgo
zpvfWsFYbewZhbA*WYrNgOu~9|xn<#Yush^!<?AIw*XHK^pq`Y_ZI%z+LH;FECs`6}
z4z1_MhEh)UgV7{Ka!(}QH*ZOyO*%j>>lev{m9JGwkg^B2wnlSY{46E}EhSdDJAXNO
z*D4aGM*+Km1-QfB7<#&%_Ww=B2uj|%OLw_Szs4%N%IwHxyY_^s+k$(YBO`@Ps_q*_
zm%_(e9NgcSHf~bA1!SZsZQaj0TQ{{6`2WQ0fON$RGS9Z_LI6K>=pG~)kf@OI3%D2d
zCxFLoQgQ_YrG$>Z1zb&RM20oZi6#^tNitZ+R;-I7j-@r;rBKdRxA=TmAidd9vm6K=
z$$l~Um3c0@A8C_wlPlZa-=5;Gyo;$cq=0IVSyQj$4<D#yplPp>WnL;rs=9R2-WVng
zcp{eW^i*hW$#ZttceF_JK@nHH{JwC3bN7$u0FW_1ki^Pod`(JbiX6bBpr-qYJww8=
z<xNo|<?d{wm+p%6g5qSm+X(h8??DQzjgbsNGXHpA+Drh*<;MKf&Fl$R+s`T%YIH%H
z<|s3`eDwItC~2;z6W{&cD61#8`*HxnPAn{)QA|d0yxGfsVIUuegq3bo_%7Lde5jyA
z*GRdXS6eQ{4}No<*jX`bT_*0RPK;(>e@X8DF<5~hP%G2LdKNOY)<p~~Ch1F64H{em
z{>XvfQrk-edo0iotps%#V0U%O@oQaZ-2E8ZezBU{XfxTM%Jd}|p3VWVVe@P6S`Juy
z!y@VYy`pKt^f$_9#(P?)JE(tQmP5%p46{TBjTnXOO76nBN=_TkLAefQ&VKQd@2BJv
z(?pCrW<?;nt(JCs&fxE(xspp)XD#){Vs&RNt+(I;6}q@BsgHA<puNi!F@(`;WDBKX
z0}hX}17XvIobhd+2t3km4Mje4mtr71)MA}KMIX1c>fjvL*lITYp`pBgBQiXawd!4#
zFJN@R)z`nXu@on@Zo7xsjo{jAS>*;4Ni@#y^*!$y%ak33vY&nnoH&nv8S5;_IQy-Z
zldhj|Kf$8_T8&Ex7DArUWr=zCQ_O#Cx2VARI+%s^xj3&kak#9?&oc0v{iz<zJn}IM
zXc%?biXB8xYbFS#TC=c4z%Bh236&w2GJAwRdi{n2-pE_Ax}s0nPxkm`N)ROI{w9uf
zbK#d8Jz~cN56vGpcY&~xA}#POcz7+-*Rnp?o%w$Feqc<+L`#8A_Mw44H6G53Mf)i5
zI5#dIaho}X1#UPTrlVG>p;Z?5o?0B5fBlfJpgoH_sFsB9+Xd^gxLHM<kE{my^~0iU
z?1L*aD{DP2uokv)MwUv@;+rciGoORbTaILxFTax_OXcMvULIw5P|LHsC&Y2!z6Q<^
zmStQUe2w5Tsj&e&YoAai!(^vWN}}*PK=)7j^e_QSTQGec^|*@>pLCf@0LD_H-Lq@e
z6BHNuE1F&<4L|$3rqp05y7pp+=Qx_0s@I;1rEi<obiEe9BlA4s-9k3QMwI&9Sj(2w
z>_;J|bDS64pQX5nUG5|=^|o(W$12TKQ->QmMd{_Kf_m6lwmkb_`dyE|wFnB3wawXv
z1YV9---GaY9!D76?jbE6{1(~F)}*KDH0}AwsrdsP3vI2>Bhr01e{xHigq!pJjG0iX
z%unYf%WbE;@CmBYH+PDt$7BNZ%Gk7&64zP{vlwb#cEv&bAkitsMa8{nu3sydRRMUT
zfxP@_i10t+m%8)(Fb7?XeYC<E5+fxFEav_@-#xn$7iH3)SZHJgZVJTC>*bHA6eQ}j
zdRzn(z}j`yG0w&AfAVoH`BQ3&X3aZa`noqb7nR7V<HD|K47B9RI{7|0Z|tx?2K`d@
zPqcU#uFAFsKiHwQbrfzDg6+-tWW}lYp4@j@D17!X=V;!qQ+nJ7N*t*v=f~SfUtb1n
ze`^yaD|Bl6Pcj&rLK8x<_5Eefu?DO~w)0;Wz-@ykpOCA>Z#R8n>a-K-J=D_0v0<5I
z|A$$t<^gSs0(;f6x5f;gL=u6q>pW(h2b=*N1f(no^|h`d;IZN#yM(>kQL&A4P_{!W
z8$LV`GiV@XGk{6z`Oq@N+c@!rh2+Oh;q&cy!hV_ZHz{(TsFhkh%%UsGTWM)m(%I4C
zyj}6$@0%-7sZ=&&u7l{z`ov$7A1dC%Q6MwU899<J%uUe2GTTOg?-FXve^?1<@`Prn
zmHjHJ{StXc3P9tY<J<a#)u=zSuc)_@HA?RAyKo(J>TM~rRwaqxL!VtpHC3y*>k6^k
z?RjH<<WtMQ9Jc)mM%~5^JeKEPIEVxHNzr$*IO%i=)s&0IG@<s3BGHr&&xU3^(gjpr
z_gRT%nFghM%Wuu<+1mT3Z0&Og%za$S;fcn$o{MwmQzkX<<tHpS>9H|6y_~ItPf^KT
z?thEJA7~TqY!X@;RXGD4aFV^y2N$oB_T8Fs&7r4O@Q)o}!>OwFaeUHuj>E05Yo9tJ
zlVny9a|h_2Q8P79CB|ZPR^i@fj!kbWOy$8+jTESJkC~IfZd(p+|JMT(1VQu75SkS*
zT>Pe?pD9Eh66a96pDX=2hKq$1JXX)NhMNGGU(6kav{oSKBJIY!%h*I3^_DwE0bopv
z|1<l39EylKA~XNzSHD{|H$)|qpB~68EYUWJlW-dU-~_*1B}GP%qO0%NLZkCqx5`|Y
z0OEn`DDtQ+;#>9w*&5qM#HW$lZT~0$!J5Q*tJd#A^SRl@^PS$5+iz)w4T6vVbo+ei
zE>!<>#6glIG}rC&|0CC3Fr<IUagL7Y%+O+_pC=fMKP30I;WqtytDVf!yL_DYLEZIH
z0Zx|g&;E164%-^-;2}oz+=L2qLBI4~^>n`CU=@<&Mt1(NSZrrI_4yMIKVX#a!mkRQ
zjN_8PqiGR!X9UUmN!az31<Tfkgj>Y}FJl{b=7a%n;wEl#P+(^)!9~Hk>luW4RBQhX
z8WEe3^om#DflB%WiCq#L75FGEPUiT}zU|IuYaWIv3VV_H<6V|KAlce6(t5cqz<2Gd
z-rSKU${Fsr%xV9EF3hx7dim&e>3nNq=Uzl)X&jrh=)K{<t3bQ<WxT|_HmCCC5ktpu
z8Nf^7M`3?C*4b{bb65q-D`2M9o7$@2)}*d<voI=?nT<ZZ+LBz*3OjX`rpZ5B+t<vg
z1XSp$nt!4tfN6b)8Ab4-m0AC}Q9&T(%EBY^oO8}*AgB(Z0YiQPZc1heijF<remR6G
zXfBE1z(I+0Q^Fa0P}7<=*a^U`OO}W^Fjd2svW10S3di5*%3&bXT(wn@a3o?P-Q0IN
z&bRjwBGr}Hhcj`m{34%`9^<@{1KD8?R)VfzDv+grZOkVyrTQDZTw&G8IuDe_<cN~T
zhnaFmqIWs7=*pQ!D|5K<%wv#D5C(keK*co36@ch9uobe78-^#3%C14&`^~sYrL9LG
zQa%#{##WN)dRvGQ{4g&;R1ioPoF-ao*>3rhAME`wO5c?&N|<aTVWmTIVfAD*@pmi1
zqe`PzpFE(Nt?<$DiF6fHk9nRlO^Q0U|H5qJ=HURC72ORty=V4ZSS%_s=v<?`g5vl5
z&z%+zSK_*iplgllW(~9Y<TfP42_(3(e&AE`@|#sw4yN}Bv~1@D&R1H;8JhCdSMc1y
zjx53Z1LIh5>c(}+F3=?t?XNWU1(U_GRN>fP9x$3jnq#HFC7$>W0`{^R#n3oS#i*|0
zUzdoJdjkBv*H)r?C7GCG#B5SpTHcJ$ZCoynoUc1a(yUOAJoA4IzuHU4i!DwpbaHF5
z8VSOoCrb*1dnKNvbtc5gX9M>lM*hAT$kZ#6Fb86E{qvFnwP#K=%pzlG3p(oE0GC$T
z#kxn<CBZb}L#339zIEL;w-x7)$>y&Ja(f&89>Ad<T77A3zuyh}^L{|XZwzr^fW?b_
ztWz>F2R={)zw)Of7hZVPNb)+kpduk=ez4;+%zRj~RZXQyowJ&svD>Migc<-Tt7vw)
z09(*(Tv8Li<QH)6YXy(-_wcl1w4nusBJr=mMb7Wn__@F}<8mGu$Ad(iv?2ceQNm+@
zE!dNjSpZ;rHDP;G<V!oTE{8)(f9~Crm)xFeG2dsqrt*<BNkUou8inP~@5hI!Pn^|Q
z9CEx(%hDu|!>DPAIzH{XZ32fH;?>jRykPBHoPcwMi(fY9K_?a>Op%+Lb$4CI$D5kc
zYN>MkWILL6?wvK;99Fk1QMc6&w3z#<Q*?2zC>}m-cQzCI=GJr;;a@&i?K<N8c~1BR
zJB3eztX6VfFjL*D@+th`hMR6=P4KF|^!;(6_}L0UR2aCL%S?e~lACWW%<gWe_!#tY
zA^>js^~qc3qGAE~wthz+ZYi)|2TgRSqy|(GQ@xY9;Kq_TqCvWiMht{@235l8W={Sh
zhLOZpQb;2Q6w}ui%j6=x<lDhkOQ@8Rq-ni;-mp8ppE?O^5NbreOX1V0H>`lq5#xC9
zB?v(pyp!vc<yO;xJ3dLg`zV}6%6z<W_fNBVxO>GyLrgZ$EjTgGK!Hsp{_T6Kz{^V;
zo^Zcqmnyqtni)_?%#BAcpmWkrGYZf=t>fOsOkxh%oUZFpdmefjwVF8ocKV=ok7474
zXt@o0PF8Z&;<MLFE;w1jxOkK@_VsfGEIn44fXAf|kG#t{BW)Ls{>$*|O{ukz;ffqE
z&ywA3m~fc0XZO0&w`hxH;V^Gmpw{q~3#}c0SZS#D%Q}CfyAP+%^Ayd1)8Ae-hIrnN
z%dDguSmxMR?75>VCUrX46iyL;Z{Y>qXAK)k+c$I8xcb3@{X_BFJrv7pN@wv8pH3F_
z>YiupOS2icKAZ6W+bAUt93&#esDEn=QUFIO(RVYNCY@UY85G*eP0w1m_WZw6Ffmf5
zcO{rMWX;9ybo2*?DB4lI=F0LOu0%wZ?+?w?_x9CzYsyit@lVhx8ke`PLD4EQeqT95
z-8Y|wjT*tbeC2+ItoHaWW1IE$I9`Yf{Sn0Hr5aqUoiN7S;<o)*#&$PKA8pAjEV%XK
zvzF-7Vzr(g<tD9D%Sxt0*EwLE^5YSR?|wq#8Jy!$N)vmw8d(CX9H+RZ!<5KPn>4pL
zQxcfYAl_Wkq}gHsTVZ(1cBo<`kDAT;s4IHCqHzX|-Y^m|D{JtJqAmhfB@$AzJ^s<#
zJ0$;sl;%be2@nsQdt8PzuqCJNUuimOBOpDbU92A))&Us?;D&9Q8Jm(=o4%fjg@1s$
z7vsdT^PhL4raxK!*5mb1d+HJo_@pZJ^V-}8gY7vowF)VQmJCWquelOC-q(4j^c?O$
zzK&<~8%|bVs{H3_l=_%ha2$NZ_{KltGcx)9@P2gKMh|P2XGkN3a5K>c5Nq3DSg~J;
z$*ablBU=VqS(RL4+3I1s<J3Ll-Fnb>s*%|DE8zB3ZAX(&SlPgqeW-0@tzZp{E3_Ya
zfuxg{NE|SK9?A(tf0joU8o+8>T?L?(z>H6CzI&i$m)(aIk9;oW5<7+I!>&C<kSi|N
z#G92HiBhE-i2M^=7!%h%1G?(v0jAl53qzj1KzIuK+AWg_x;^6d%=N#xC+dKXHGc9#
z_wiu0BVy7;|Bkg7le#WHFEyV)*+_<D!9emauA6nQ<L}XXsosfrGX2Hgfx+ZK$4C0<
z&6d_=MF3r`!K^dHPjI6ev!=&9pR_n;g`ZR37|X>uXy`YX=FFAER}Vl&fZN1TOkm~(
z-sgGV8@Ae9D<Lt<iJM|srG6A9CbH%)-w}vyBqkv*OwBEtZU{1Gue$#J)V)5uesFMb
zi!xOClassO9U8&v-zMHitHNA|bxo@7#+=ymii62F=jah{)IoJuGweiXz5-OXyz^{q
zYHHTshpY?zoF^d}1L}GE@F;H2JHsmY(i%)va_7juav`w!D;=a`sKkhN*X}U!m6p}u
z8^Dr<XC~Wt>+;14`b$F>32b*b`&Zo??0ro|Y!TV4BK8m$vLM1Qkrn_xOo_tc&d-#j
zk0^&Kuh=E==5hDVO}r%4E@cY<t68v<HoQmN$ZMxu8l&o14!#IbiCNVme<eSwq>iL*
z71-z2Y|SCAF(c#-Mc%Dn1l9?q!Xl+wCj6TI-I~*UpY`r<;TBil5}>6X3&#b8ir-Bq
zc!fpp^ZjaQj<p>U!PQM*QgVM`zv#UPiUt3g4WCrFXGIn({-~JpG3UPL#;J7fj8IB4
zg@H=LPC;ewPpivmd-kJY>{S&nxMgGosr11ncl6fF&RZ|v-QqfgWnC2&rCD%Uteiu^
zA1`Xl+;nZ@-d^UtXuQBEo@;B1wAz%k;;<*M2@I+|t2ons0V%!jEnZkR)*-kQgxc5{
zIT6;bx6>AE_HOy1x8mJhabA++yCmOoRyC4Z*@A8af1q8l@Ll0sT0o6^?~k5uDml)A
zzs3m82oM4=5r`c9R$iM<$VxF?g1kZ?c0AIv>}x>+Kw|*~i!5Ss1#wz<;c^_q;vnU5
zY{5gam#Kwvb6zMr!vP)LGj?##(N0<`dpx7N<yZS}I}pz@0of%56qtMqnzX)o50nj@
z81&4d`^J~+8&v6(fMKT*;m-7l_Z~TND8%7C{e@;;cH~GRnm3?)6C8MN_lk~k?A5Go
ziE6w8;B5c=dCPGgq_`I(^p<4{(~SL6_7`t<0DfFiyRgt8`h+dc<Ku%FzhweY4*8Sr
zWa;R_z{)F!GOO}VaquD`(R*W`8dzyQ&c!kX3)wR8?F&MB^yz?CjNS5BFn=efN16{&
zf$MtjG)F-uc4t1@T5S7qHKH4JLEA}ug~W)kpvCEVaPfSwG~?2x90`E*>6VxAK}7+~
zzG``R3nh;yWeYN2$4rgPtoX-xk5c;mZ3>n>{f3R9zy`_hA$Q!;t<n!ZuI_j*ui%qp
zc48|!#<v{z_I({&bo=Dt938jTy@oU66?c$W@$T$~S-1?>g;eI1k)=;X{n+iSLLJB=
z0Ehd<QkT{Do|D_T9ap*2Vs<b}9A+Drni;+byxr#G+iT3|q*elRoFB!fJfnyzqoaw^
zR=wri3&34WgXL;Z|DJBHGK-jI`EFfVrFxFu^ds4O<Q$d~X1w@yh<`In1TJS0uyr>&
z{gVg8-Kd$A;)1(mtI|5d@=uAc?I8X2#g#>W9~G2;^y22^X)GO#FjyiIK+87EbBM*1
z{y%(O2UJtp)>Z};MwF)XA|OqA6%Yvug4EDMkAU>vq=iImbWnN^f*~MHsuUq85Tr|J
zf*?o_9YRY8;g2(~%zOVl*UDnugtc;W&)H}1@7uL>_}CZG_T|bfQ(StN?~U}e+rgO=
z>2R`yMl;8z9%Oef>%yTUWIgps$F)hp(2_08R%sKK7LK0?!xD7lwRAdSsRUygKYqOl
z4rf5V1oSD^!nE}Zp@gB*EG6Bvav#^AA2|<}9iM%8Q?>B%@W+}2p!j*VOA-NGtABMI
zKy!3}YZ^X~TQ1(NR^4QfaA+mi&+L6{9(20d5v+2G$_<+))}W&gZrV29)RQ}5a9w2$
zLxR8`>S&gms59DpG#;Ot(YWit%DjAwvG7ZH7y&*KdQ!J)hAopTc;XkIUwUCEwg3J?
zDwPhqgYM&if^_KIZ0rx6?9S~kO!?CK0nSwx^C=x)vWjun=+bdni-N7Ynxjq>0uLwz
zBnucauB#*Y)2!t;8v4;ZtF6hl_(2qovvECLM1U@cwBOdk=>=!ZoVug5JcTPFH@6Ut
zXS1KuLc-x*tvi#oJ=L*A*<K9-oIB&jbFzb<@y~Y2d3#JCC8C^X!$A!8n2vg>B&PVf
z>X~@}*HVuAcREm5(J07Tne*M2m+K6jU+Jl#q16T0=INBoZ}75kT>SX(jD!km3E9Ja
za7z-*S2fn7Q{-81E+O{*(+%pOi`gy((e8I;H+In6fSD5Qa5#XIK|&7?o_yG1is|m+
zWW7775kULUI_TXOUY!Nf#L|(?_ch2x(UfmQY-@$u7cQXkLDU`w1qWW(M1hokWVE~O
zgm$*n!@h<`){Y9eBk!s0nZ;$Pnb0MpNQ5;A=6Lou(#r$D_Gek_L*s|ct#GQ?>@t*_
z(#qqO;qO&jQfQ7E`Id>V3iAo+4x5c@@~-<=(>~ulknSzdS&jpIe1@0#;-MFIvLnI6
zk(e}Q-54|}o>77NvE&+&7fUndoL~Q?H~`J{dZ&;UperIeDwFFsXZRz`Ag>8mpN-DV
z_-(gjr}d^yw$e9tMl&n_>4wz>Zr4WsW#DpdxVDnGy74m?^@F^N5?Nzb;S*#q=KjXB
z{+k@sPTDmR-jAJYVt97KM|=BPd7bvwk^e^Jus&*;nQQ+=aI?MgxAT>CAS<PKnS%z`
zUe8B8`Vj6@-_A}~ym@cUpz^EwsS4g|UQzGbi7~zLiBZy+4J<ie7Ji^BB0eos!5gCJ
zn<$Hx2uE`vdA}?stTOM<g!b-ZC*3P_LDr#mq!2rEhml4V`&akE5V`f!3ZBjQP(1u>
zuPAxIuQU2*0&vit_scOWhl%w_A#%S5hA3E`KXTLhq9-SkcB_X@CG_xlLwZ0Kg!kp;
ziiixm15-<iJ)%Q8LXl~ToXIF3cCf6Dy*mm(cnhmu(4UG>THK3W3Ui`=N7t2Ry^$fB
z#H)R|Vh4F#>Opu9iIk|);0!E-On1DWfu?PNH$)FXa1^}KAS0Zlw~N&}PzFtXoXq6u
zXgR>-?##VwaZ^NQhLp%UOd(>AB9D5p-|%Ti;l#Uc>k7W#_{5rsU<@P{M9LhtSm(KY
zek)oan=iJZhCF|v>6p;K_L?C0HgP7*Ez5z_KUY)zP``J%Xc+^$pEzxWzj$G@CfB~{
z9&Q?yBf3Fv&1`!B<hgztu$msd)v^<u(5(I8fzNuwi!))n5&jsCiyll8M%g#tH}*Vu
zn(GZLjF+<YqU{AY&0#ht@#iRzNzCglL9LU|@iGHdZV)Gl1aJc%zX^@4^=}b|166HH
z*vv@rz6~dEUd*j5WTtBgv6oh#9%o?{IIJ_A;u{|qcU&KamY^V<9v@8YZ?2J}GlF@F
zJ0YGQVy*nGv&f)>oARyTvmwQ13^)G5rASjL2+Zpw8G-?H4;rslTB3SbDp=;+Ty=S0
zlDdWMQj?@okM2)7&Qoe+@aHk48*JN&pEu|<;^==Z_VP&j0<6c+CX0Dm4z`=fL|Y}f
z@fx!WVw60~C>cSY)|QFn05$vX!^f>(J^Jc6s6OHUqjT6HQRNCu-d6Fo359C#0_AK5
zk9;eA5cO8`xVZ1loov^k&M-lJ8a|<T+1>lt1S@a-Z=3I|vfNf(F*iypbGaHS!A(f;
zB7i6n#a!cAi#2onYONW?6|(S3?H$|A+qe-%*Z8aHEGvWDUGN75d#+QcZ!x|}fmpgy
zvz2L?OH@@a89R`0KM$4Hkoo=b0G21ro?@uEx32N2p^NF>I}{b)j=x_Cv-ZnZq*d_=
znhZP)_lFJAJ>F{ASdyI~-X7K)Kcs#Y@FM_^U>@to3s9<6G#(MwD(5ca;3OK{+g=HM
zID}{j<@#`%C+k2plX!c#a?-kEnm^rAy!`!=ACC_VZhPs~)=(sO-yz!}zRPhU(Rer~
zP2)3cYdQ#%Vyti6tl2p6mA&#1m|cOgEa>1OjGy>&<7gTO(w*ExH#3nKKaq;0a~6I(
zEdZa>+w)@kGhI+-&h<f6(0b*E^@6>bhMQSaK{Fv%N(<ZbIA;yGX)0e=uya`R7I{Kr
zJMA?5FcgTog;82Vy=1y<ce>NXrQf{KU`mSHQ4IU>+_~oSsoHwwgtPysLOi6a{HEh8
zfK2mTQot^j`He$@f@IfNdf@nsY%Ua2#p48f*_?2?_S&_6V!1ES_UO=!Xdf|nE^HFI
zd|Os5uy){hYhxTss-V*MZoz9L_>Z{?F2F4|?KgWG#@Xz`+a7x}f^uaiSKZ6g#amXU
z_Ix2`RoPxE$$<2rnLsNx;b%qEbIjC(fI~B)5fU^Eu<(vsK8U*a;ML-(b>p&}%EcMz
ziEGZ@TJ~l$KL0~^;`cC~ox7!S^$p}?yIoh6ON2Q_(5OCLkj4{{OTj#oO5bK)lDnVu
zLio=~&}Z9EKEIVcw#XvL<J|~pR=5`$tegt|@@g%Q{b0+_OXTv@Z$#A(FE2}Z?9p+c
zh{WlD)BX!xr)NnShcl*|w+QR6(rlJTWWA~Ct%b>h(dTiZX83zXn)qYeMzuNhZGq-#
zZb5s%K+x|q!Pq5yfT({(i%$zAa{I{+ucB@6p;uH<(B4E#p^w@JZu-#oe1Mp(AMf!{
zEB*6ezfZh@65J48N^k|IxohFYq>A$)dz;Dg_k3WzYaz>Zk;9&+UlqmbF+3ra0j)<1
z08IN1-c44&#4ihy+AppJ%5Ag{-P>eTQ|00-uiFRA*Y4c32w2u;?AWuLZkm%8T3eQB
z7-8!|^dE*QoLc*FA8dfO(t!3N-wT7_DWT<|>TE$zuyd3I^^b%e{mO_R=K_N|FJ8lQ
z97GLDz&N*8FNP2M@3g$+p&XoXe@}*4Y)6sY=dW*Wk@g#sX#;M@Ej7rVWn@vIGNHxY
z2c--Mc`}~RC#RLjhadUWQ24WIqCDaXq1y4U!=yo;sY9vr`ORtg5*hAxP@p!pasll!
zJgAoA(NAf2K2zO7$z2-3WFekmzQ|!eTY65&DS+&e?J0qDbd8whDk{gxXyVN^6ANr&
zK_}-tX(oOWn>I=f6N;^_@HXj=E^0Jfa!2sA_c=?b4O~Rd1k}nb5n<(k;K#vp2c?#$
zELJ-0VuX=BNK=Uqdq`$8-p~YQ-VqaHz2xU&=k5lCk|vO&WvM`A(*4lAR~Lr)K~pbP
z@C$_j6P?S>5lu^UspNxpt6#adj6BCIA>%W(C9C`0$0E<iNtLZhMREH9PRT$iQx&=R
z;u~SB-J03If1(;U2FiG<+>5>z+Q9>h0So~|Vk2w%<TXR34@P2Ad2jAZ-R%>Pm+Ks=
zn7n$0EsWF%SJ*93Vhs%boE87kG5UM&o5eIRzwKKb3Sv)4Q?L<nuP^G`drFHL2cHCZ
zFES>Y9yEM^k$vgFIbY=9c4%ByrNL~#O?R$LFmFe@>n5gY^4nTvi)GU?*h^Ole+8R;
zjM8uJOr@{smjW?;N9H*-K?qlOTF44u_bBeft0H8V+Vvc9E_M*t?cXB%l2lTZC%?aS
z8e?7kG9e?uHxx3{@Z@QDoZ^ys;9ZZ%we`6$(0~KyRwwxEifo7{{ZoTX`<Rm9gy!|s
z`f1<ylk4fEle^G6bH19~NtbUC-q0Os#DepuGV~RHtPo?LWEG0=$ws&j*cA4j-1b?s
z!;%N3W^F~>ixb^wJ_|-99~@)TnGV12rTZz|W_mK~aG1jY!%Nx`ae`1D`qLUC!nmU5
zJSLf`bS)I$xW))9Y}qBoM@KRi5Lt<do!$2<SX}x(Vm0$H6$%cG)fS-i)8fJtrMdCb
zq`I0Z$~!qrjt)8R7JAOC?;Pt7@`Kq9?{kBAr}hrTa9FVZfE$+s3-6I5axWnRl>i^~
zc7NjTSR01oy&}Ksk@jlqV|x%+Hh0CA>Q}GY^t{dF;D*SwX4eq<{IZ$-R50dkE|9yF
zo*$*#fZBTPT04a9=5>)8NpV&D&bgleeH2{v-4&KukX9`s-mfx$)3!RqQ{}3DdHT$6
zP*>k}{_IXzO<Wd0CLWMZi1W?L8)W=ct{yrk*Q<3J3$#t;hE}ivp2nf}S5E@h@+$}N
z?uK7~o&*{SvYn5VIenF&p%pEl1(($!t{~q4v-rbVPNM1oX50|AWel2|n;0TVNadb3
z#qSK~U_fgIn?Ai&J@Vmrb?*uj)U0Y7#zjPddV=yr<u%EQ=LR=k5PMaYWD=7YTRQAi
z5b|%NoBTwHR~hM!aMvh?iyr2LWI$kL*2jj}y??@i<THW{j>M3`y6}qoYhLeMvwVv(
zhv$9oHpm<wcP=Ah#gCm;IKOTUSmCf%w&GpzxSNyOr4^Z{9H@0}=PBP_rwSah4B08H
zU6Gani+DafB$)H+o<habmo0P@D+0dGVj#1WC*Q372h%Sr92M7k5lc`sQo*~zMSX$^
zfYbHisoOuEF(Sx}6)@h|^n@AHt-<cOXWjo~oyDQ#R{DILjIE8;C4IEt+mtmK1-W>-
z!yQfT#pG@Y<wK8YHaTa59tgk>k|;mpv#&H1W?=7nSunxk=1h$@>O{b^b^kKwcUY-n
znM1X3QL#hJS4I7tRVNQ0z;8BHfVoP+<-yOt9qyB7hHm{>uB&aTE^U#^OIvJRcFqe`
zj?K*ph?D^^3c`Ku621*NC*KB-FTd>&o*G!6PXxp@7dj6HdChl4Z=GYZzP>zl+QzqQ
z%Cm)*u%b&p{CfP@vN&Ok4CT?W;LXoRaX`hz5o}@N4P^2tK#2cX;h^~GFqteE+{_)m
z7Buz9cr^?ch;Q|*C^q*^m78yhEnOu}u}D#`KU!#eG9A@8OdkXS-VXL!4VqS&uK(D`
z^j!elHRMU%B)mNl*`ETW4>CTgoj!ZoeW(%yBK}a^oJrVHw9c90%3}@N5cm>L`GtK*
z909u=rDXYLueX@=2B2ZniV<*iNLk71b5IeC!HNX-xh&OR{)R~-l@Q%z5><M#NERD>
zHx<cUkXpx*FKC&tC1>;*i|gLmPF2vE$cXY~ic*ag7KXBTqI)_GK@fZUUE~5!k$g{9
zi3n;*h`E)3vL|@_WWEn5P?8ikt%LNS!ptBglP%clOR|H4_%cBu_%vX|7r9t^vBCby
zEw2zf+abOGDK^>{xxE!M#e16pMDJ1ES&y%kfUN?&txF{5b!%v@gnfL@)E$(#**rdg
zAH>gu;_4uyYS<%_DNvvA%=F=R0B6wNYkb}<^_q=GleedRHUQe=kh->HpmN%nWl(#-
z&bj4|JW@LNM$q!c`-dp<{BDtpgE_mL-XC^wy+1ZlhZT^wEI-^!g0bIo-%lrXI@^|w
zzVhvCAN#gt)XXqnrLg#6<1&hSrHQIvGiUSugEXK+cOXMfhx)_$7^+r)CTEyi(@}x{
zoc<z`ZQ9BW$RubFzL*yEkt!6|k1`+}#tsH59VP=+62iRT+NG6^wo?-jTidRL=FQa2
z--{B_!nltoG}q>W(9r5`WLfzuFvT{nV%*^Td*A+#84jlUUmw-ow9N?qK7m{kQ7X#y
zB6LiT<WSf;O{5ylG#pU2TH8qDL~9n0IK$<)T8<Nl6ljrCs9}!Vsltq0U+?_E%<^GK
zUaJq{llD%F+Wo~Vw+_t*CFlEm>$<*0Gj>LOWI<60mlp>5bp<)kG|SCb%!JLyFhT7;
zQv2u&!nR3ajw_ef;GN6<L~5u~iG`Bi#zlA7YP2S9a0%_(wL{)m3Ey)UC6?z&51^z*
zP!2p$zohcrE}O5!&Q-j2oOIe6-{pwijvrAqB3lpdGpPD3RgE&L`uudeX0%b=&mZ9)
zVncwn-A%Zy(kp~-8?*6y2I#0iSkg&B&~oFAcT?_Gb=cvhx#7|%$jWfANe#EBYjX#p
zyz#eOI<(=PV)xf0Qs<1X?Mp>!+E>b751us7v~G-w;AVeA3nm6%iB!@k3G4<tEG(ZE
z$tE@ycAQ@L2R4D)QPRzS55?^Vv<HIT*ZNn8%m!?WH*X~;D3O~{4jym3N&w*3_a>a-
zi-7kiV$ww%9OYjrF32r`BBaq-%>XM=-vJdy!2$Ukw6}x7mUf8Ins?7$cG@&-p$>=Z
zn6kFJZU<?H5$#U*65YLf?b)6zO$SZqozun_FD$zM^b*#hE!h{s!r&o<=)LzB2YT95
z1athnETM?eIpEPuR5K7ha1s^qVK3e|f!(`FZ!>I`)I5CmqD0ZVK>jC^cUOKpoX$ON
zw0w|F_l!GEv40&70@FV^fE#Tg(t(lO91<AUArgZG^{tg{2i!?7xHI)q;)@1_VtYwp
z@5E+r#j{~!c&a|(8V^U|3#Jogb(<O%x=Y88tgPuDU)uZ$T9|WTPD)$epiZrI5<c(Y
zW^<>)#z1Ztv$da|c=IHC5N`Km@r}~B2?r+}ycyGa!*=rk8LTzs=3d5bzZz6G2-bw_
zsla9WmED^@0B49bxNz&iZF0km0rwjyYo7tEEBu63Kiq3Qy)src;Q44e81l+?>(s4j
zp=WKFTo`HDi)<{z<+mqX@(s;t3Vc+Da-R2x5){+l_|7wPzT;u`u&ROv9q4s&z%-bU
z@8i-r(jGyhR$y_=>LgrIGfwUbv4CQS{Z%&eybT=)?PJr0JU#JN!apm-1ngj1X11!l
zNsiQ~kgA`e_|I2d1347Xf-n8bLqL+|Ysk`heMnkP-zM~}tTCm-QW~uk|277Uj&sr*
zHUUUwJRQ>X*nOD@?JSBf>1Tmv^|EYarT!McV10Rn`pt7pr7wdpHUCMdi$mWqS#j#9
z?mAxzrAx_t%1wKc$|sYmG|v*=;hdwexAwZ9Wg|9JqM5`3R2d}>N;*I~YPP;}l-=$h
z@^Ai_wbe~ltL2Qr2d@du$CmJktmQbFfec$HesL`4!jR5s-^yl7ZL{(w<#(^HX<W(o
zN6Tp>C4|L+;WENEXGL@i?z#86Kaeg*Np!|<x-U_MwAWf1e6;hVajTX6B`^t-7B7pr
zzf%pDTHW*<W#JdhMG;ned7w?Nm{WGPtD7Ii8>i1eaC*HIV9<^tb*YG4)2>*T#f9-l
z*S_DJoQ0l`8mAAl+4v|y!4|(p-+H=vJn4)i8`ooEoGj)u{$Z)D0cdGurKX#DZAg>5
zrFTtvcTg45+S^<a4W3v7)ddc}-+$EHVN=S7@E=faY#$5(9j~n%s}d{Xw!G(+<StxZ
zZ=6_8-#UwY>bU;;L!QQocr(219bqeLbEZ+|Uz<mBiNb&Ic2E<!p<QdtlvPJN)|R9h
z!Qg39Ai7bVkSEN&r%h5zQsG*17x!lYaR;J>Sm!?q4Joh=Kcy{F>_BTuUA<tFa&)va
z8(Gp<;EpKWO+70hOn-;^@lfTn+Qm{O2hqn+N~_hr*Loar=BtHzC?-vIF!jei&5_ab
z4d?G>$GP=`)^6ZrfRfvFe@Yec2~}D1M<=y~fx*hwGML3nI$jQWMq0Uw>JRMZ;hd@E
zQ6Kxnz@i}Z-Qrc3mZP0z;<TN$Z<~zJ*sJ?Dg{m@SgzP18N>-Yhx>hGNbSS=q{$~$}
zRYp;7rboYLg+q_-smn-Z1e0~Y;-w*0+9i9=4OC%^nbWzoIezGB;kp})Gn~7Jg>&@Q
zH=rg*)acRecPvx%c8A&jl=qCbsC)ULcUj^Y3RBXeXGKm7n~;R-XlYGLf$)p~L;E4Y
z6XOEu`93?{Mi+;k#KgH**`X!bb6t~?iy-*!IH~K>PMs_V>vh#kDsKK!4#@rd{4BL>
zmXuY8idDn@7qs}OE~gz3bpMB1Zezz6r^2k`+B@j0V0+2MN=stt-MNV;XAX^aKe1+0
zXQ&=B%sTgvg;O@%I_ke^yVgpX;6WkqMLI$S1pZ!K$*K1TrTmjv>OOE`oR#?e>C06q
zHYL2(?`3hriBag&*+Nh44pVS|W4sB0-xKYkb46(RRV<Wi&KQHlFF32v;@+S%>X?{e
z=$+1#NK)31FD|Rb3=G?!YZWPY$9mxR9%Lb(S;{(C7TX)mRW=?8ah)){NQJl7?}Az*
zpVigfoh==_&^lk88gd|YmeD2gF>GvdezfAIguDA9rFXOMhBx^Kt3)IM2$DNLQUAYR
z4-|O6q>)&T**H#WMzo&0`0N&T7gRE&Gf1)M)j2VMM|m!!QqI15po8kLSd!EL<3Fc=
zy>7f)yreYm5hF!*X~(>VYC|sEggtv#r#+iHPD%w*zhCtRkR5yn)ILfXa5?e{{%ceJ
zb<rlNHM=|lh^!^WjKvi7@a5L&|5oAtjIls8K~!CX9e`dz_7|3NT=|frX;Y+Fixp%t
zDCtc!3i2|Lz!`Jr5T&NaZbVd~h}T+(y70YDq_+i&*VU{O-TZqLR3C{RJ2L3OtUsfe
ze|=c;^@EJ-*QWh~hXC2w%9WByP0ok%rfdZg8r|39q8XlIjU_p4(i(Jx0iAZ@X6S2z
zu_+jR4%@q399($m3dkx5OtWZ=juW}epE##3*HutkcmHviQ7eA6eGfJWhR+aeTkbb^
zPCSx1%eWGE1^`|h&aCYE_hSF$x4d9GE2~K}oz(trB|anIKIcmWt(Y;bX8@2G_&GI6
z0WrYZzplpZ@0isN@smvS#S6m%7V$k+=$8PTTw;Tq`;}*z`ImYO&$8d--7)pAeSjC?
zf$qLejQ<h|aBMt}zZb-XG*PDRW}EkOTyn6?hG6-~Nb^Fpe0gZdBc_TBH^T<K$B%AC
z2vF|%cN$oD&#j98;guyjX8-z%cnwsY<ZmkUl7C4jdP#aMQ7XYp@fsIoNW`=Y-fA@N
zF#>R%7c{m_-7`)nX_c@bNN=s<N(Yq7Uxn5i#Ua!__EPG8N{M^6N1t&CgJwzps>5zT
zuCHhDSGW}C%EeDx^%)oqXkB=%S8@Toh<sCi=@odVoBPv6u;&JY(7Dp;?_M0o|5geA
zlAb>=$Z;}N0^cX`v0^}h0w#UGO9-K-A?KduQs9y;4Y|sA!oYVvaIfFUK`b1R_*TN&
z-M=^)j(3D&OBXp-<s9z1Y9}Oj*y}ww>*y0*mGV|5vWZDYxt}Lta^xy#e#rEjvIE1T
z#S8fukfLzirW4-b>z@I%KbXXyeB!TvJ?ULcVJS}02@^I1<QPWxR1`O_X_a+@U3|^r
z1HxEfk?px9V`iJ0B$owN&89m;5IjfyWJxLk5GyD?UrP^R$ECZsRrYcBPqN+WJ9U_T
zlxa_vqW{>9zrKw~qq+}YH-N<nO(S4QHKRnt@7lSIWwD{TMV8~mN*Lss$>K>V6LyiO
zJPXwdOKz=821y)zTmrDwzIM7Oc3kRCwK2rddNR%-21IZMfLRUCE>!;YdH(BKjNU~D
z78gan8N+*>lbS3r6ayZzMl`>TtAJB1X+U0O=}8OVTqptwA(BZ#XFZozFVjpevOE#P
z3DHCO>4r5q{0u<Q$-d>+74j;|=C|-7GQ`op=%K$HjX%$elAxpzVgAb)08v?eS=NlY
zWBuO#hqWe+J;^(FE94_+X+3+;zE6_W{aw?6vN&ZibqBHxR=IRu)6C?i5AoR*iPZTs
z&cJhj7Is=n<nl=|)Zl(%$l3FcyWXJO+hRUBMqB^;eC9V(6U`f8kAg=47XC6Pf!7|!
zKY2%KNome{*HgwAAl0MPs$Fpuhoj@RV|I9zrIVX8oeH@7?awcGAsZo~5-t*%^Kdm!
z>vUM<jlV+PAF8iSBKgdz?T;CW3{p6*_xcZ;e@QekhZ1TEJM}0DNefJqEyKcB-eSOY
zX0jlzx<X5OJAcH{r-#%v0Ww;iseAjy2YlNUXGG4~CdB_}SFo>4GVTK6uE3v{R45Ob
zt`+J7RFpf4MCa*1{@sHOf9k&cY%0k1m;-ivUjG&PwBH*ytmn!x_Q&(jGV4Ab{zyDV
z|3#<)GH0=gE^#Y~wIN@)MPTAq!dSI&b?(kYC6%v_gL@P)Vx~^Wx3uAo0NfWqw5GNF
zjkK|Lr4*1Nq6#CvJOtNEaAUlZEVGY^^kqUT+$m1ivY<TCj^m!6qzTlWe_M*GA;#6^
zqWpTYW##{|H+r+=(7A4<3e1MEo;;p(niF(?I8gcLKaU(4XJ<r+$IoGd+gt2^F(O0`
z%C{g58nV>-2=9Yj8&@i;tMh=HZjX(ghz4>Xt`AqXrBJo(rha9&kwauDLA3><l!W^l
zmVWR7mgv$WRfzmIL;&G^sqodIRGi3p#2-rqt)l!1TH%gcL?B^JV*kX#Pciy$3|D|)
z#A+%%=Bmz#q3e(iYr2zGwASee$G%~KzxLKh@Wfd3ymZA<if^&bHa~Y@KcZa4-q_pi
z_xwAG!(egkK&HErb*WUZ%#cqDv-BKNI_A$BOb8^L5kaC^+u=s|$pJ8ILsPx_ufYGm
zji+iC<rhJOrqMF1)BfNp;Z3<Vz|?Bet-&-d0+aDrYr-i9Ii;YoDtIlBK=){oeRPr<
z-0w)k4e1rksteh3Fskp(h&!8ColE@T^-KLSKy6YP=K_LpOcI<k!35E;e0cSMkI*GS
z>i0$;<)Wd_>~mKTaCrn5b?cBRV@TaK{Jffn&B<d4->5`deupC=sEPmgJKclUf7!bK
zewN470owULdZ@6O7!~2jdt?LxMpPD*SDT?%X~^)+^Zp%{@#{~Dx$T(d^@937CPqHn
zjdjygMMpwep*a-dxZy}TU5`a!=JJNPx||t_)QgsX%GF;L<-e{Y%&2P-01X4#zSl)C
z@;t>$btB+HMV|}VopjDp+5$tBD$gtkLfB*l5req1XNIjI+oL592#y_wy7mSjU9r%Y
zxZ}%qc8^^D$fEdLBk+adtZQmY`v(%Mdy06kWnf#qA*|f9nIk`0&wdr8g+f#5=Bgup
z=-gGe)<2cDB}hg#u8z-*bSW>s%r8rV#$R$HQQ7@+Q}n56-jWn*_Xp9$l{%NIb)*vm
zWHjQp@JZQ|5&m`FFK+s*aSuc3Ipz_xWaAZ$km^Ll(<bhw&%NtdWEt?4MInf-(i9%Q
zTBQmq6Y!03G9;9Wd`p^m2`1dI659t&PSh&a@%I?nGx*R4l;Bc6Nt`sD=Y2boV#1%>
z*WLpe2}ybCyO_@H&>?|?MLMvk*eo5U(r2ck{{NQ$>yv;x`2?fJ`n@i<&*UAEUr4Xe
z2`WLEO|PD_R8q{0eOapcq`bo>`dzJ*{0-F)5A-!SAX1RPIna~JGpWAYqplCosmAV@
z^V(;d3W<9n0AJ7lGFkue_KR@DDz#m}fYJN)`=<-<Zph2-4QiaE%H_9c!$t|F)dL>!
z1;UKA^c>gAwDbAt18KmzB#Oe0qn>R$uJE|z_i=@ad-J7Vk6bF+(s1?-u24cRvG&(@
z<oS6=Yz#)|76uTQOtJIEj$};`bRSmg2C`45L^e$tmb;dZTu{0f%lE1DnSI?3LLa4W
zMND~|q&JLIJaWCvKOe(BYTX5<Ravx#jF?T;|CB(<$$#6c|7SEUuS;5E;Z=gzcPnIc
zD@{POysgyFM=;vGABw)_D4F8S72PKEL%YXXH`=uq<X}`G933kK58jjO9h9Sw(NgJr
z2u0$<BYo(8rGjd;^Tkf2o@keH+#on76IaSI_P%MC60Y*p%huHeN7pPCUB7HBU7@H=
zDH;8K&k&?6_C&D{sb}MlZC|J)c63D6cl<EJbzS+TVyIQmw>hbjIbpP^Yu*RCR(V`L
zNr8l>z^goHQi?j=pP;X#KvyY~TuNCO!uByYqu<9MI%fraL4o$X+mBMfijxCdB79HY
z{w)XibJ_BBC`QwJE@_=G>Rq{1`)zM9N~}M{dg0ZQHhZCs40ZXcQ0|rdD{k2NTCb3#
z^z`l_ps4ok+TP^Op|bwMfw@|9rhC@?2)!2iE8*n}wC_2NFMwIk{{D-HQUy`Il}L5J
z2UACKWD%T8@k5{xH*|px-%H8|>J~X?RdY!gaI4bYcnJzg+SZi4AILWyMqm?vW&7P?
z@Qy58F(#UO=iR{WJQ6=K0se&)=;q5%jFO{2D~W1Wrye(9p5LgDh$@R`CUH{F9<T<Y
z={%$;t)n~p3j1@oc4jqmRhR^$9919+Hf0=fsrb5*l>y)Fc^;K9BPbabMlAjc7UnV*
z=h1onM22ccr|L4CMtH=sHmpBe;+*A>0r#9}pnM0P8YP<QnSv;cDb_WQ0c#@Zzz}oQ
z_?;{>cPHQFoyA_3aL+}uu6R)M3#(Uq|EI{=UrrziZzLPZE8vG7BCtk&#Z3RnQDKb=
z=oJxeJVW-wBN5s_^u!g1K8HAHrvZS!^=UTX?tfC>|2jSS{1gBrN%74-sMbu@lnYyi
zal$RFu?;;HisifbY6zVuMR3KX1f9GE;#_)VBjryzDBdoq%Z)dx6j(r)X!W6U{{Vu2
zzccw)DKKJ@%qKOOq?o+7;UgQFdZ{n2#TrUeI}~(0AY9SaOy}QRO_8{0z_DcSNaHuh
zhsaeZM7RGh=J|`&%1{-d{K6p>prb!oaMK>c6G%u?snxw*i-<R3i2RdVawMxP^~gp-
z79McT?;4X<-eQX#y$FkgkbXX|{uR-9>d9*fp;V7urTH(u%<tnM^qiy1CSf8KJ=95y
z!2!$oJv+zEI|EzkJ*E!`rGJBy{-NYmdnsSApU6BiS*>)bb}2!SERko&<vzWNx7Ssj
z>f9EF8#$((5d}xL^v(ZHr7KlZ!@?vql&;cwEfT_-P8An5WeV+Q7eaw=Fz@{%g!3Ot
z{hwC2oWX@`(u>K)J)R!byf<jJ4;p)tH(89TuJ<rX97S8)6?GWV8WZ}W0owR1WiR#u
z-eJ2mRLS@;CC<27XwH?f_Np2*&NrSCL8J?dPNYS1pi?446Wy|jBa7^&Rw9&-Ztc#S
zO|3ipPus7S+opA__a)a|HApm2e-)#9K|R+uKtDi-CY<4Rl6)Xn*_F6n-#s9H4yoiT
zrEOnq0!42l;K7T{6DuOPdo}f!S3`blG&;F!5En0L7+aM10HJlg=%KFvNKs<2XpDIZ
zOCWVKIWI}kgF?h1mEB2yo~>46@lCn4BFvgKLej(iX<JAnaQel2oB!}e{Z+(gmj&PL
zlPXU+wAlAGJ3xdlTtnhRvO_l!o*HtAg`fiGIf-zSn>W-!dOD^M!h$9z-+97~M(q=s
ztU48JWy;Y5j7cW4&d8~-M)sT&!`Rm%pu_LF+|*aCCA9(aPhAank-*rq1`aCr!d$Hx
zb4KHYtCf3$P%_-m{T19``U8~d5}VaduY08voaIo&H>iR}?I2TD8^F1~_#@t{Sr2uW
zhA3C}a1X8<QcU)VrEdGtd`t^TQR3tnog(u}$qHg^=AfF*#+`m{o?nTHz!(0AABLwX
ztudq+^o@v&mg2mdw&PJ;0{1_sM#cWgD5)E>M25^9b-Qu3FRS5AarZ>dEA|khK0i$c
zEB?%m`xkoo?+aC93IO_~#;(1P)SX3kF8#JqV@Q{#8hb`Wt=Q9PRZzpC3)FoT?#ngD
zw{9<L<X@6p)4Z$c@(X)GM#s9dp#8(av@B-}!M1lru!2%DSg{<k4jD;syZ5p`b?#y^
ze;=m*dYvhzt9MeU*SLl1!|o3P6+h+6)uU~fyd@XAK2Tio*lzmC#)9CBUl_wSN=yDP
z38bhBMcIAeZedlmldOsM<X$P)XiTbL1a|1U&7kTTy)lIdS$*zoM7-)$aHQl(oIB5m
zl$b`~lKnzg2D0uIw?mmVcNI%}Wgif*;}2U*399|ocC;%;xH{*Qd&QrCp{*6ux$$IX
z<&wD)?-DmM#Ey!;AeLlw;*yF1pkkF?NU)Xc0hf$Huo7?WAjI{AJs`0cpH*sP>7EHD
zbr=m4J2{j&DWnv=N%{Sgy(Gi$XFTy3K|U^MoMF$lAqQHrpD&TC^9@H5zT5ei0Q>S!
z*7LGLxZFrd0QbW5Bw4NiX^#Pml)tDX=NkzOgJY`SGN$;}mEe5XKs`YwHLh_<!OBse
z9J3WD%5vD8%QB_ORn+*k%9E(fUx+=~J(!_tMR0ibDo@d5Z;%&OlBw;ENJKi(qzGKK
zK!&g`+ZiiUp^l2-4@R(RUsJtJ{JBZwAdbpW8c^09x6&1`ug;oWb*CHt8zJ_8%OqKX
zH1b0oDana`Z(wPJ(mjg<Rn*?tWWDd7JTB#b@wn*DBZkPMBLnFdiF2BA%bY31zJJ6G
z{#)$-JQ1o$O16r)mw9CC>}Ng#&^a+B+?c%K?pQWJ2i6&Wapjq>9&Z$Z-bu>#d>02X
z_`VRTc#QHPWF`Gam+-7KAe`!BhgqKAP)x6RFaE@+G2ihQo8*%EbLA-SwR5-;oCWbi
z20ABlS-%Cnv!L;1DtyRrvZ|JWNK8_RuA%5;IV0KMc>$dJdl6WJqx1Utz|N6^3yP>M
zIwq&|zcnO(ekexw(o9RSZw+3hfvqkxz2L#VKR#LCdsb=UdJ!~r&pobfgq()ZdR@I^
zaZiFwwfr+mp<?>sea4rmdv0LIzveF`(*1k$vs-R1|Fajs-}v)ZQrhxY{{U)ziMFv!
zy-+uSk04HkFG#&%pv@<7it?qDkN1n1KT47LqJUkxIh(Qd<k7YeO!%^nb;1u0O`KH^
z8R@n;{bI#dVpR7LexBGwdjH~8aybFnqc&;;L*(jZ8(S5K@(Y}0zLTy56eeOS-LDm7
z>1mO(>Xpm-G;=i-SwK*{lm=1yG)Upak6}kL9(-ki|AoM*GXDW_$(0K)e(sJM6x$S#
zPH-PBx6MZ+CpS_xhF<@wJ@rS~LLo)R#ifTGADP=hf>8dW-wjyF8+G2vTCq;RGyh8d
ztsWq1mvQ_r-l_k;VYv)s@TsvZ8rVzL2bW9j)znTsM!*)oO_uI~%EA0=ePcpd(s$TD
z-ud*F(vrcjYrAtnLQ*@fl7@R}s7oQFS0PIc&>9n;xb(Y+qQr~rB_yg3`0bZ><otQZ
zv<jj4YQ7WWo5FNJwxvM?tXjT2nOHld7gAixIhr-59iDGotHAp~TgZ$Zyt=1T+X<u=
znvf08dJ11MkgjMj><=XF&l(SOYI=5h-Xcrm`NCglW^zQMJ(a{7mUKCm3><G1f+tG}
ztCW^X^pDtcsf^C6g)F_IiespF)7P1jQ4f(5Sj<XlV8KOef@_G@jIT2mjCGfSvSxy)
z$Yt&STT!T%QchyH`HE|MUKhaRyAuauv{2=>Z^88TI>uJ9=?Yd}+H;cp^I3)JXOe?;
zxC1+fc{AD}lOuBJD!QZ|pf1Ekhr>$_ru!cu>;G02sydXDqujTK0Yj$ER;MXUy-Qz!
z-AGM5YcE>W)$)UYi|!pPQvX_XeGE?(NFqErxYXQ|2Feg*DkwnVt%*-9+#owIc#D6<
zf19owgqKXc903fe52-fmoyL8|=yu=Za;>P9nv_fa@-_jZbyoXznu`8fnqWvsCdWxf
z!H8P3vIR%~r1Gk$eypQm$Efw>2>YF(acvSg!40;ZN}vDk7f?Ik-cKKf*`8)V&+8Ic
zeHM3kD$+@`NtQzEj7CZ)>zNU(#K~eQ-^dZ~8QiRn7B^H|TXg@PTo<1}BH=0!msyx`
zL{GaW3V>$8b5A;d=?~{KxXm*a^N0865pKLb-p7(H``-Od7B#9gLuZ<gOlobZ=6%YO
zeOP*0=m^%q_lfyZd*pCu&qwo2aCXcl#{~e_oP*d;s&&<z<n}+2tiTsVvfttd*)0>L
zaD5*rJIs>`4z1W5|A05jzj|q(XTZo=O<7v~L7Zw-`>u0U#**+W{c|z`ug#^->G<y$
zD$mh@TjPet&B(gqto*M;F7^+RTbf;glbwH#Pm{Uz%(BG!Bi)8f+y!<_IsFW@&TvuJ
z@1@5&#I^3elBm*pf!Z~2&e4-XE2CFHH2cPLw;J$#&wg=q$e@OI+kX|VW(m9Je$ROE
z)xZr;dGFQ=`rA>}3e|M1o<x>HxI8dqypkZBSg-5vG7J>WchfiV&t2ooT68AOE(o^%
z`s;cABbGRwH(}yRRn5YmEGeK(Qw01N5MVJ^p^vXV^N(nviqT}WjGJ=bk5>}&JxJ(&
zr-6!NU&EZit`PaAqT0V$t;f{0chB_GtG!=%BNoahz-ff^#;Wy>s98-4@%suz8?WXJ
z^+{nJDs=rnYhGTG5(g|MR%9huE){`EedEe=V{rqRjQmS;#gS(+1dOZCQ1|q`uCzW=
zg_Q`;XxCT(Cuj!c0lCeVxE6@e66<qCs9zx6THOZ?LjVU&1Sv)!HqCOiGLX&3hL2-H
z2u;~xLj&IxHg%$IBfH;wl`9^%T}f7owToZ~#~Rc4eNOj{Zj1VCvpD`CV)q!~cW3Yy
zy7tSB2q%JbB-zl9vg|bLoO+nT9K}{j;t3+|y)V94vJEh}AVfu2vxRSVS${OlRUFwt
zT+dsYEv@%c2YKd%X2RXCOD<}zn~D-rjYGEG)40LEUR||((-Xri$DmcXrH;%=O<y88
zo$KxT`!Z+4RQ*i-#e!?@yo|wAXg-nfVi8u{f{t=@TUM6>Ni?q^Zdha6vkzQx79|an
zb$4HvL{-L}N&bc0JfQnW=q}@*p}Q3wa_CN{$;(7!Oz54P!|z|dI;Ej|9#A!k>fe=g
zKyY_U&DrfD2b5_d8l=Fi<Pl=borv;%5nC+$1mgJYT_ZW0{(l7uT_S#>rH*#gtv%q}
zqY{`It`|rU$tn#1r4H>Iw@pP!7}aQ@A9CsC>jP*t82I!1t@ZIeJyMibONP9}-|50T
zcrFAkBKsj+t8Vk{PwSFV((T~?$uY@%GvA-$X#wD}=ZP`l#+s@_s%oFD$zXGZyE-l7
z^#wP^qwOz69vp%~TC(Yn@ai&y!*^vh0D-KrW;A{&c=}ft1W|rJiv#}G<48snQ9{e6
z0JoG^;bo1PB&9DZ?C0#LYpLEzKbv$ag4(A9LQ<`FSeJQJK8d4w<<gZDn?+#H{>bY4
zU*wG(QTbOCj)KOWAlUSlj32J{r)q8#n^8_!3%5#Id=j13HL~Ilzx~!>vBZ|r7Vi`O
zjDg~QAS758=wB<jB%)#Bj_)Ns+GTA2g;0}Ir5Ic^Vd~>#{~sB-np?=Q-Qf2mm?pY)
zvIt$epgS&OAQ65g#g`)KaeogteFl`j5bjI;VMHpvw1PCSD>L?p)FbST`L!F%fnrpI
z?~8OK+3zw&KAjl9A+V!ki~f4&odOYrx|MvQu#fO}?fmj!lMV+omh7^Baz9r}mscue
zPqN7Q{*oa47oyunsdU|-Mfz@2QGhl!qfgC;lW89~7L^yH1uL&*Yt@!AyE&j+1aDHe
z7<HAYAiF&_Pe-w{#ZJR4{5!#P>Amv4l;(<Z11zMJp7BQ{f;)gW>DPA?c&s9PJ4tC!
zvJ_@EF6e1WD4E2VwU^t|q@XEvkxy8cg>NP#5~%Ozsyws7Ysej9@A>vQ|2x_h)oae0
zEH!6XpA4A#wX>dV^it_JRueJ$k!d80rF4~Et`%gN42QPJbE}fstY;E;tMvCUz-*&L
z%9)k7(H|^d5_fp&JM1CRY7mGJYrE!7VHWPPHgxG%@I*J?nBo#h<NjdEftI4^DjY$&
z5q{M(wNBd1nH*@Ae{(I)o#D<%qGarTRHWk3&PxNRVLA2Zqc0NeiN<Y?Py*eP=yK)7
zf~)COX}F&XwD%XXMpmF?8%`DTLUCkoP=B}ZbsE84_QK|a8kRXxa<&U$G*VKBn?Ibv
z`CN?DnFm?1w5>{4by0B&F<LaMF(vnC{h%{EqJ84OIO>+yu9YYGWsCzH;xUdErI)|T
zuU6K1rvDaDt)+WH=0PkGCCSCI5Ur@FUMv``!@VR4I<d?lWFR>hQcN+GRe!i^_;@3p
zGg&B?*N_BCG!qRqJ2o!Wgb~)Foe{kijr?NOUy}g6Z11NYE$4V=b3$hvTgip5Y2k^t
z7N^9+Vfv9yVMqKBC=za0L_BFYidlo{PYpQ!4Yqlz{lH+q>vcIyeo3?PUaTWPZob3I
zRbe(Nx#NM}wQCgR&n(Ur_CKZ4RbEO}8R=cHmWiM)v!6o}$sotrnrv4Bg;BddkULq4
zWaa*C+ri2k<v!^$T<(66wAp+XOHK<Tr`;a7g%V%E5bWM7$xtF(B}q75p0I+QZBGOi
z?ybC1A#6Vl80QRk_qV~?QZVW&7-j{}X$`LwCJq@DEP^b>HgHI_YKfWl{V{X#aN<s+
zSbwMMdR1399?j)ECBD4f_`vhG){}ZQFu7gWR_GhAoWXAwwovJ|!K8_R{j1DK80rWz
zeKaf2b|`rrfZ8Cf(`?#KX3p@L<4%r9&0CY1PT;@Mt49;m<bWS&n91QRL%|zZwLrYg
z3yp4;rt6+u=%Jf(`c_a3;DX7COQAc1ns0$+cCSJa5d#ou0bomdDvweYx;|HidhUc=
zZ>3{#*4AY=P@NQ|<D(--2cM{v>Bi6&J#!oW$s|{d|74P=E9b~<CVs|dFg`9b<N<e7
zA1e_+6}*Dpt&P1B(3ayc*D+Bs*LM>^F3k57IzGtu##|b=$;}I1|FO3&1AO~!QSyF1
zXlv1}lrVaq578MaX6jD6(Q~|o$|h~4reh*^be?x3Gj52rtjAzSY9z1+!-La1c+Y)j
zB<E7EI7)jm4D}R)=`9}_kUjnznA7H?`H!&Vsz7Ac&j@If`1A@=*^)in!lOTRl{sY%
zBYP+LD%}t>AB#WBvU()}t5(*z(w^u`-HLGGm=4L2%H8dRXLJ}qRxKlUXS;4jeN~oT
zH2${eqcQuG_Pb8DcSESHoS@=zX3)pl`HC<^rc<6A=c5rV*KcBDdgKN~j$DAnXN50n
zrcZX$j@Q76xl7q7=Q+yF@SvH@P>GtmmLJA3*d`UwWkyMHh2z?QHL=t+8uPUuu-p9o
zJI#$a=go*?Lf{%(<lgf8TzIb8P5G`If8<q=E#D;;$!pWTYkKASHSoV-gET=uOMi88
zjR|~Vufg_JdqDKi4c9_%?bA2l{o*lo3(opcg-}5$o$2I|IER#7eiQ+bi4h>Xl#0hD
z$@-~A&XzTTv70)I{$+jA+c&_o^ln<8KSgT-67$vT9(_tzy69|OwFuO*rtUWESDAEa
z6kqJpBrR}@am_uLR6{IQwu_x5^$}l1ZUV{mprK8(7!_Acw*b(}qs3V1WC68wn=@qH
z)pg3ZO9z<~91!}W5$Qi;Vhqf#|L&D8yR3{u8ftRN?Zfs{1F-j&i^!*=IidYwGBESR
zDf1-A^}`Mt=-s)0B}buED(_UzTCZv%?Hdx$Y_6auH9CUbc>i6OT#oyoY2|~=@XZ-W
zu7e-vr`qBEmtLrSbU?o;tg^S}^p0kca8ZU5dFt^FwnUIyC+DS&bBmr)B_gfgzhQIk
z^@S}R=DeU#y%m8rYGfXqTtig5H(q#ITc%%D$MS}Lg)J0&4%^+eR;gqltq=6B?|kHX
zpt!6>mA%!1Gy6`vRzmtsOst03<60gluRVC7lw9L003MP8M%B$gP6C^D2&Kb|>DC7C
z52d;|L_BNey+XDe;uJLo!pUnP;;6%aNW-^&x)u?p7Tm&f@ss~xvnr`IoPdR`*>7hz
z1dh$fiZLP$1#=-W#M>=|9-TEv5BkYPu{8Ow4|`?jby5AG*r||jV!oKe77U`Czzl}u
zJ$IwD)4!OgIA&hA)oqR<1x~tsv%x6i#4-f(9%6_gjlvaDjhk@LsEs3Lfb0A+?%OE3
zi7>$`tP<&7-fU>e)A7A~-ucH`C8|eoWAN5-%3kOx$p7f+Wq|n4>OudO@uc227EYPB
zZ<7@ymgukFA5L8N{D7}_ebt$+%c!@Pz1Q8vjXd6LlsVZT$_y{VVe(%Xel%`eZbtCW
zjQ~KAKGmmv#)&#xt++@1?^6SROsx*$M}~FN>!+NMvb`QC9r6k}<(xkSHZ6Rr8J<s6
zG3o6-^ym+i*DWn;)z1=D34(_cTtjDDq1X>K`dScyzwuh5XefxMb{PTpu;lzGmrQc1
z=(6Fhw-$x!>yF|Mh_n)gRiw$~IR@~*>s3Ya{JPW4SsJA#k9O$<tz_<G+z~KL8_3cv
zxtDfPz)Ufc<;d-946DsVPrcs_?j5N*Q|HUH^L>UYV-Y@OkHqq}=q}&ji)uL;W4DmC
z3E1Hu_VDks_%=$zL#fYlI6+eCP@=IrJTe~CW7L&243&EZ_nzmnP%k4lr{USC>K(&Q
zAmN{({?E-J>N%8)m#ra3xD!_AJpPT=LlU(eNbqKK&~7F(LbxbL3GNe4E<wVOmn_>U
z!*>bN6PUhnQ|C0kRP1|j3v4cLN(#+Vs82`g??`_0U8nNpR?VWmWyh>T0)VfdomaE~
zhZ|H${n|dc=9v@BI{C<|EPcG4*E!E|?1PHFvvfk>^#pyzQCV!q@W9|*$u+#Bz6FqT
z+;e^J81TkWgO%TA=P-5`(m;GPHbE{2p~B23+=AYH>;Sj&e(z40!^K>Sk+I(^aVEFu
zi&lsV^6os$U;Y$}v~Y&Y?6W-QZXAmf0lYijY~=%Q?TmuJ0?(H2rJLV~#W<z_)`NVO
z$n}|ux`6gReAxKusjcv|U-<J>5HM^j%wUdtEGqG5UEidzeiDFL_d=IbW?+IcXVvLi
zWoyrVG*re{X|W8o*z7~E4<@%rnfF%!5l-@s5fe|k$SMk~GeH*jeVmof*j+>+JlE#n
z>&^1krBHm>aZj&A=dvTYpE3k^1o3E|Xv!20I!(CBEB+#*SHcj@4tp}i6*w}4`B|a}
z+{EE<mQkOH*4L!@indUL6%&;Q{H?&Q93S#L#4{Sfi*FPtj`hEJTtV%H@HN+0SD3*D
zm{%I_D;-5K?mA}<50k5_^t0SI@fhnJqYj5eC535@Co1(jPT#KE61tpmWI5;qB$u9J
zKWN^vz2(RaBWH;J7ri>_q<cw<Y7;RuRT2uvi0%}^lT=*O_U!ifCJRip-+Scfu*0yK
zeIHjq&;ZaPh+{Feaxz7_9Jpb9BSI-N|J++(_Un$Xl(elLNzdsceV6Qa5n|x@A+%6t
zqN^`Cxui0=>nI5*)!YZB-_LYnr>FXGGPV}No<p<#nQ5ibh3P4G$Vx<Q|I%7f?)z`o
zZJ3a5iafp3?^y0Ge?R8R=p3{1YLYLn|77o4ZW@Msdio)V3+%9QY3};&mBxhp7?!^1
z$v_ZT-m`HhtMN^|d2O%P@k3PeW&{7S>a%;QsXW0v<|;m56eKISPHwE<e*0&uDtSw1
zMC~_ytD-uP%?-Gj`p9%}ji+3lS;bXBX2r#0a*0%2pe*w(kgaFA==sw%QW!?5R3cga
z+k-j<Ux-FR73Qt`sC~(km1zmvPw&a0nNB6MKBNk(mFuY7A_MQ9K!^lYpOt6*qgJ#-
ze`+W~aDKpv5@Qx;T!)ir@L@vPwbjw*yg;X!`(c~tsLG;Nzka;1o-1$d{yZ2zRgHZ!
zpFrgcsaFDbbd!q*`D$90-s%iziAb=9*~<Ow+T)t_)#?`7cJ`x|xqe#ZJEO&>Byw8{
z^IH}z{^XgbniK7zJBqW%_0SJ2TjaCZkF20Ss(N(r#Us8P0?qDUdt15V9J$r|)|ZXx
zn`2}@=D^DH<(P#hR+Qp&>1Oivv51Y@4Rpzt-uNPcjBMF+!VvR`ir3#S=fXaUo`>!3
zXohSaSXICerUJ8->%Z{EE`vuFH1;o|GLF33g7D9u5IH<K;4r9byX%2x(A4d)x~2*<
zg&j=m?L)i{DP(yBr{P|iVa^B8{Cc^0Jrh`ByqtdVt4i2<2I<}LforKbx8PIyQo*?7
z!GA|l{wcB%;443Q%{9Jqzv30R-mcD-G^o{KKYK}qDZLXGGsi!WmVNhG>ixb3dm;L^
z>r}&_-#aZS{iD>fo0c$<a!Z2b!5umr==Z6_A5QFsR6e0s*+ulz6O^k}#P^%o18WWa
zFTh#{;4u!wi9^4ZrQT1x8zIYJA^3xZ!B0RH(&rBNm_NlqUbENWCy|01NM?G@eco~v
zkWE@AV2O_cgKnT@rjKPz90VK(Y+CV>YHjPysXl$peLs`bn+meJl^#y=wIE#6Z?n&-
zSRkDDAd{bNM?7M1G#xRluOtv#4~FjCQ#2`^@%`41rET_v>nj|*`@npj3re2UI^f!`
zVVeWJ4cHvG*Qb`F!O}(7=%~~Aovi&@N*_J{S<Ff|9>|eBE{YoHdCt6%S{WNmDCtVB
zh-?7N+2Q)eWnv?;Dj^>Xw)3FxOK(jx++C27Le=8u!afI{`?{EJYyJ%fvkm1r!L9cC
z!%D&R-=X6H-#bCejAQJbT80%@8$|w(xVH|Avg_K11yNC?m2L#3yG!XtT3Wihb3|!|
zlI|{%?v`$l4(S}aV}^nGF7GGa`-$(p-~WDp%^U|DTwHsvz1LdjI@h_{41kto9}Kpu
zxs6Q*3=4<p2Zhp=Q6l%Om(Axhx&{u}VV@R8$<DfiSO7~SE~uHZxvD<z!x8~h5K1oA
zf!<64pSle1f-|&WKqjDIs6n@<(;NdyT|Ofe_vV`t-(}6i9$x4TwUvkzx$lJ`|1CJS
z3NsVeS5ikylOgR!0!7pNr17?ID{-n!bZszv_7-7qf8e-4x>3Wy?G3*~YG;KVgG6LX
z$}2py{RW_uQsjQoeenOp)mQPw{*_+l^Cd6wYwRDjh;3QpDsk;S`5!OhDE0~?mDz)X
z+bIhbjO0%&tl4f12PH^Fri5Udn!R++bnS31N!_@&Bh;gBfYQVp@LTSIyx6U!mfK~4
zr-oI@Lh$n2$wULcm<FXpfne-IEGs}JrohF%UEnNqY}YJ_O-Vvf9L$8irp|qPygjI1
z=H{`v_GBu3NQ&H(B0O3biEZhEW2@v%e@7aP7fUQN##*#UX(q?f`BvUqmm?;-CWpfk
zN*y5Pkk2){#5xOQKkJVt@3SmO7S8mVPHzVbUG=xW;jc|J@M1$-1@w}9zXvZG2UUc|
zB;L?)BspCAA4JURkEoY9{otJz^h^WylA$4$a-xWoQGRmNEZC>Y@LC_|yhp(`yG~r+
zd!FQE6n7hVDaxZLZH(#`apj~tp4Dta7<*iTxITOPnRJ$~##op7?CO_&Z)*>OxdwjE
zT|K^mg9cN8qR+VyA0#A9`g;dkZxL&T*#e<c;>`3Q*^6989Vk5EzI28d<c0-mY)@qP
zaNmHSbbRKv&KSLikDMFyW+DDm4(ljmJCQ22duiGSBt>p}k<vgPqwe_l`3?8VPAT_R
zIE!Fxst+D-{FvTa>GzVCifORkhTg55A%^yoe$rFZ#Rh$pRI{et4ZD5sb$o7~LRX$S
zM*UX}?!u*TkYix)h9k~>=IKxp<}!%o_P-R=e}pJyee073i5qmw-eD`?U_UVobKHY`
zy^;3Wa$qpt5|iIvmje-Uq%`VX;eO#uGU7<|xnOXUcn|xd`I2~gv0%91sTD5jByCbr
zpjD*}*i#m!H>LF=3YL?y^A!1zJz-&ZoGLjyOMX5{q{*t%UzrbCdzTtSC(c1Wl;vY8
z{-`(P?6Q8kS#QOo6cnr@+A{CBk3RXB*go0Ak+9IX5kG$C7(X*n2`!3iX3kSM$K0HI
zJ1O2fw4InWOHt4i7((Kk{<wR<ND()Z43rYNL|Q1}9?9^k;X1*Zc00rU-pBl;)zO`~
zFdB+`rToqPxDB3(e;!`)`yf*X^9HpaRF4U()^<6~Z)wWh22}KAEI)OOolMR2gUJNv
z09=a}vv=MX1YGUWQI%(b24{Cix0y4AZM|P{XBOAOY}=+Wpq3Z!1QRKSWvstzwH*_m
z4P3Wk(GVXtf7aXhP<<6Ks~0<avI{~G=d2c-sx&JAIsZL%W=1b)xRQSV^E`*rOs1NK
zAd0E{zLhCvicSJ>yT~Cl_9H|DbSE9AP74dQHYBW3;fv#N4c!5DyG0tI(T0t>7YVnY
zqe7cK8pjf2w_Cm+j@&>~-C%^(b1MV^$8ykcj9w|CP*9KBbL^&R*V;}Qk@n2KF(s*$
zdd%gLkXE48*Qh0~0@S7vq}rvc+}Wj$Bhc+igco?J=ky;eaB6P<ZyEvjZxmjXVq*v3
zv?>!7FA&Aj4hU`=qbj9*Q5+N_Z|lxxChvuG74d8*k~?3T+;J>~$^72$DobCjIrY~x
z4`peUHHfn^v$T_Zav8>q!95dEA4>u!%^Z_HP6UsS36g>Ry3Kk-A*L9%ktLR~%B4^%
zy%e$M+c5@?xmLu>PaW`CkYDurwx$!Z6!ITI#Hxl~s4B)EZ*AFWA5Cn*LS|v@U;F%c
zW(BqKn3SG6=eRCE!VBA{wkt_D6Yo!V9`)SlUKOjY@wB^qL35pD1W$%;MBOv2w9BUP
zZEUH}r8}lSlqA!);@UNd-SKv5<TjEfKvXPH>KF9NtX7ZlvgtYQ2J#)aP!2mHyT1od
zrjh&I_^k_T5wu+#?^qk&O!@^}mD#LGBuJwU>5iNZ4qX<y^#OVZjA`fQcWJVtg^?S#
zy=V*lvlglfLV9|M`fs^CaSilds_<k7_6F``WZbkljy&kRH+*u>Ha4*n=<7^g+qN<y
z+P2h7mNHUUUNUAcb<V$Me^uS3{wAa&Eo;T6YkE@CK%=aK7gAw-zEhq1!4yH8YM<Kk
zQE~sM{(96iWNdx<RPKSF@`QzPU`3?I@K`8Vz>6(ly?(>x<k=~5kH+lu%ff|gCch4+
zDZ?jIW#IQmRpJLb3wUIT+|I8r{6Kty<?b;Jqw5R8nh8f`|7`8~XYm`Hh4Sr5a-N<_
zj*to!Toxqmo@d|-$)BLiH<cBOXO?{qdowPQ41^@fT}e*ky>aB^J;oT9Dm*>qZ0)eP
zOwakLZ0<-RMqD;Us@@N*k~mCt@)T?d&>IVC02}U_3hn8wC4>*bhbOf|zGQL}PtTm)
z4x+wCU+G0lzfnE9!{leT-wfQzl&N2G5(`dUr*Uv!yf#^|Ef+B*7tbvzZ+SI~U5xcT
z!*egx2N}N-7(MDWYsA*3-lAp`->{R2+q8JfaB9E1rTGo2JigSaE6|}=R3%_n8qz*g
z+F<2J`SSCx*eH>lwS`N})<pg6qZc$REzM=ezPsS_d;N3UTJ}-i4YRdppt7Fm->}9v
z3>E0QbG*oof%%<+^(l1nUSY%QfufU}X{#4YqF&jdv&4dT{o!85-PJNp_$MDsyk~0!
z8{Xj^cx*a#tD@og8Pft@)7R^0W82W*|3byLrs^bJ{T^jvi|o$U!ImEw`>hvep)CaN
zjLzk3y)p+AH)*H78_vPC)xqqMd%(4^^-Fzzek`)A!vnyXtc*_PPWdJ>hUU`JdTBE}
zzE%mGB1?R4IrhANgkQXLsJo+UYtwi*%2k<^*+cWq-39?@(oO(^f;!%m#+v(9fs>Pt
zDXE#p;ucG%!|YgBV}gh(xbH@r{ZUBU-STUd6~CzMM4Gc9tg;x7y;G_4Z&Jj*;JrP)
ze_F>szkneqH=t?O3k7iRSSctc7^4_&QQV#TJ-K^HTT1QKFx9B+l&LPR{|~{1l=9US
zfJ#7fAJR;KM!=OJ&n*j`R3cTC@muGpKcFUK3sEX&>-k9LOn`YBRbICi@#9sjd_q~%
z(N#l~3m9(1Q;PVFT=kLMC;HzX=x)U6j#bR?6BoSH)S`BzIvwG4ZGafbnc*L;Z}AA}
z7CQ{Aj4A*Kobkdnpt&1}r$^;`({byVQm5ILdKD8)Cf$O9E^r0;GC5$b8>jKX@{&^`
zEzEa!g(dGduBnI^P3<Z8ot571qOr(}&HYyDbDmvtU)FGEKV7U=9K5b`nmu{xYo}1Z
z;-v~tzW0E>V%gt%WOYcyG9p^DX|fNfizXbkAD8(|Buv(SG2Y4a*48#TUA9b^-<D3)
zbC&aB)vxOtus9l_Db(MaVSFO&^=|p$^%ZgdqveoK-P;SOM-E$ikISrA$$mLAH_@-q
z2(F3aZpC)%cKjHyA`}&RU5*`v@c5ApRWwuNq?UGi=KUU>@?_Z~dug5W1=W>Z?XEV|
z<oeWc9o`T-CbMr}<GI&(VzldjBkUY}2FPAyGzf28wef7n9Uf%Q69MrIcWPmq2FT52
z-Mdm>E}v9*p23mk$?H&W@Sups{$WP5y%Mo~o5F$jsmo?%A<dDk@a+ZeS+V2M?p7Wv
ziz6I>S!mZC7ZN7-A|yd$5_n3j3EIqnl1F>Pxfcw6w_|<=EZgW&X&Dgc0GO9X(`JtI
z1m3TMI6y9I^Fn;_=`ah<c0?lK83$Yu>^#d+I7zsncB0&uo^eA+27*65zfR`j_%D31
z8wu>Upzfde<FBVBLEU+&PIE7fb?Ngs2L-VVPV%FqgyBjYmHEahgDl_pGJN{W*?O`@
z8l2*xp$tqKj&#<5Wcr5}81zqnh&h1$9_5V?_-;`f7~z(@a4F^(rHX$d0(&WT7k7hU
z2Q)bmFQZb>DzJ8lTgH*)cB?;RF|9m-bRp8N7F<&s46aHQ>(Av;8>Iq|UuXKH^@tvo
zr5hHkn8h3i7-N)<Y~>qDkzeij@VqH>#)i>iP^MUuU<f&6ra<7oGYkQ7?A%5jm%~eL
zML@F5T==qiDPjM${<a3u`ox#(6}|nY^DEdsQ-iR-r+Z)g3*&C}r>I%sK@gZrH)22L
zNr82FV-9zH`k>*HJGOQRdbVdXsr%S#oB5U1x&1o>1@Fh_f2188US+B`!1E^CybpDo
z4eE1m(E2jx&kL`~eNOb3TygV7I*IE(j!A5gZL>|dub@kNA5<xbMoYcgyk85YO?j0L
z6f_)rdRw=qbVZoEz1j@YAmVB1=F5*b+Rw-MTq#!E_!aq1AwE`kNGS$HAAJz+^M=(v
z$VsXL#I|(`DbV`r{9kshY=_M|inT&@&B48{wJ@k{TA^Esh=8wsoA65P@O6lH?5wtV
zE~C%#vis`fwNGz(6WktZ9u`{%c*Q{vKyA^4IaxKN40Uj)FP`zZWeIM60Xn7XZ*^PZ
zZawuv)X1mRY$qb2-rXKoTPwKOy6TlWt#3t2ku`z5u9xboSDVKRbPC5eXq;ztT`d=G
zuYZ}c5x7Z_oE5@3_y87$<f^`BZSC1Ko-S910n&ddTl*=a{G>NsDh1(y9DqVHLwX{P
zLcA1zNpDUGRp++sCE6FptZ~jzw!M)0IFzjp*>{N&MI%WR6NPNs*$xb3wxkM^v;-Tw
z*iqZNQ><;;PmC`Z$nK|Dj#>|3xgyXhCHG9pl@QyNR=y9nzYhDOCIODT&<D1l`~i3|
zFAEg5dUsuIF*m-@aQ~qFdL!_INN?zmNSin^p|kWRU7FLoYuMI%sb#%u1bx7<%(@y2
z%Xb)McU1@1{ddEh75TKs-A_#wPcURQ`2E>LrHxCcZ(V{+Zv2fLeft7%6-ZuZuIzs0
zqJq4NRm_mED)WWdZKQ-hrA@0CitYb>Rix<L0awK@D{@gd3a(-tXuQ*MZd5*V7D(eM
zG9wdNUiUPbr>gFi5?xDj1SgJjRlChh)4%o`<wIIhR-Ea$zT$D@>YX(J#orURtHJn$
z_eZXdh5vz*`~%~=p}|dZ>z&`LTS07XFD%d8wr40V*nj3<>98FZx?bEZYd(U}uG<h{
zB67hGx@A7flA)xXnXuZDK~?rTGWnYdx3gWXFz$$QGx?o=3Kpx<Cjg=8^;%T1fiomG
zk}a`m{b!=Yq;9ca42LP9S}cSCzmK!~1CCsUI#n;E@6F4H*?8n|Hf}mceDZ%PD0u!B
zP{3>xOghulzK4ZV{}?J6#Q)%mvKr1JtR$#Mcpc-k)E&*<ZLTPdK_}KCT5*VR3$Iqf
z9UC*%Z9cuyv9F24pmdh@GiZ_>q+8V}%eOGc9C4}x%%8h{S{UU*gU|iKbEMtJ;ykxQ
z#w#Q8d%A1wU~zn=V_SXc8N}l7i02=x^G_U<;OJ=<pApWdd@k8w@t^TW(#64i6OweH
zVlrteJ7BXJmR(g6*q{1k2G8T`!IYqFYcfY`Npnm2pN}1<#2(1U(rG<dXYM6|)u6&c
z6hOOOB-~U8C&8w3A6NzZHN_65@9_Upvj2#Dh(%y`F*c`G+@3R#lMhtv(;w^3qDpax
zvAt8F7v2&Ru|<}9kWk*eOz@2~T|*w0)P+m~n<ymcj$_%t@yCv79xV5KxOFYJ_4)4_
z{(o)&`RDg6b>xwYF^tPT)NgF-?uqyF-|h#sf2tA#T{8*j*|nT$G(TmvG}yUS?IIgL
z=khxjZOF+8j&x|+ZiSRB@LsaFAK_~Fb?f(ZYVyTDX*YwO{_osy0Tk_N@_a3~!u#S{
z&PkCW_|14i!Jyxe7oPfV+^!n)vnpD4|KN{;RTIHYU)hw}x?@qldxAH{)<cJQZBbTw
z;afx}4ChkSb-ftpKy1tUcb%;N+Gh3G|I@_)@Ma-^3d3tYoe_huwyETyro4U0TB8W$
z67GTr5w>QQ-=7CX53RpK;n0A^{5Meq?e_Kf`}r|VNz~N8i3t3Mz5F&De>~LR4aI{0
zOYaI->c94`Y{iv-ClRYKC8Oyqe=z?4OcUY1z7C)pBfHu+cvt=ZsDouTmtP}ePhvG5
zb5`mN<tMeiV5xIXDKz6YBk|gV_5=IZB5ePqF84pIaDedQ2Jmo403PmF@`!k@+-#MJ
z0-$WI0W`)t{BRL^csU{Uj_@_b)4A_(Z2w(Nb{Jve4>{7whP}OGMiFD%o$|CZ+K9iP
zBLU<mWG3g|{Kry&yu*Zlr>-%x->pybs!2t*#`HW1IdQ!dWg$#TLeMM?AUx29Oc8dy
z!ikl_H1-NI@jLt9OjkZj>^E~O&sw%HE^<H+W!6v`VG;o;PP&+tEm<phVeGmwYyvBm
zi&IbM-mp^LS-Uq#$B4Azj!?#ldg9n<gDdqZUUdV!rc~?$yi5BPHP!$AG-G5)>;!f3
z`SWU+xvTGlMt<fuCR?sWdVq{A|HFko$uYxe186|`^p6IVO#K&qKD{R$^*%XTsZt_A
z4d8e-LTWNo0ch9K|9YtbJ)-)A<7M}64qYsEGXedT>H~kjLH@4n8kL6lXJs<KXS@8+
zQRlMt2}S-K7C?cAY~=1A;!ovP9}>E>RGwb$S699iwnQ2d%0yB3CM4-i=^KI-_-yN#
z<5Jf^Dg_7pN{`Fh>~M$VO89oZ+B_Fc`Fn^y%u>|~cg<Rl@T(@;S7H7+JS{M@TSXKG
zjWMLZO+9yI@5a0={C|cr|9vv<zkfW!?w2K`6joh)y#?+E6~Iew)Em@i20y$Upbe-M
zWAALBH59+Ys+KnXmGp&-7$e_&`nf+C;|}K{1X=NJ@(DKB7Ak|!)C`V4STUeCw`lzL
zzyIgK>%h<67Nf@Xh@>d<4nN)yLAwbSQ-Eq(E3R~mQbkvz(!@eE$-5bS<1RweUjCLS
z$Z3RRl@xu1(agmt*t}0vU}{>p7YeTUcs21qgK9~TfI(vpDF6B)`}VCa&DQfV&;n7<
zP?g4`IkWTf<R!%?5R=!~mnC@y#smeCxoSUqC|@y;w}T7$hYibMwY-;XO2XoAe*bv-
z(w_ED)8zm20e?L1O~_kUXkXB_NcCOUY-dlE2qC2r&&wC@#brz?Xg^|o*698Y9yj}f
z(o1%(Lb_M%JRwhktie4V3+gxA9bk6;Io-5raQ}1CL$Xg*^1&}K%bg+_*9OakCIpy^
z2&`N5yVYK2ev>_YV7Sx2zvSx5=eJvOTkMNDhnj;Cog!33=D?IJeO&#o+{7CvsYHcL
zLZ_Lk43`$h_{3Gl)5E&G*u5(E9BvEb^Rb{>y3?ptgG=ev-sM3N0<&nG>`~xEul6K`
z81&8&#Ilw>Vh!pqSh%ocHjZu|?uy#h;Tl!VFuJJWs^vdF&E<Td&2df`o?i%NePxET
z3p)MEF(B)k{KrlYFQ8uV?M?DO%F?PfbG2HD`1>sADGX%Q0{LQ6F}t3BY*vy#R*_Hf
zV$C2;2U{m!)t&yllyV^GyG@r4)v(MyM09h4#V_7*0oC=<VNS5H*GWb(sP`3wHB#Ry
z*wHa>s=5y{<kA~-*Ma)DmMv6bykInlV*%9|SsJ_bqA>hjV%?A25y4lrVmbopu&I<y
z0~A&m6h0Z%_SZ*(hVnfj<@Z(f?adAHHO4iWn4ndWYN+N+^jZ13o_cTK+3QqJ)30s;
zj@Tt}3qasLXSN$okYJ2Q^Dfx)f-Q1oDsua0RGCd~ZsXQXz2!K5{$D>*0=o!|g;!1&
z$xe<)mOKpW`p$A6TWgtqfN$HN#=U2y!_`%*GA4s6))Mx{Ea!vC-bHv#z5#~#;zS`I
z1dvh4>Mv6_CiS(2<T;Nk>$nYF9rFeFkN<P2|NVIU-JE2_KNhTu*k*Qjb+&gF%0lq3
zzqQe$Fr{NP&&v|XM05yNhoS^MO;p{ca+23+BEof62-ORK&gHTsf+ocKY41&9p^xso
zF$~4}|ME!^S&aAN;II-Ktb2}NkcWmi+*YFGj78jr-pcxv%6u{%hfjW>VY?suQ)o+m
zRMUYa_OPL_?Ouu;Ih8N8kCwki0wZy6rJ&(2u9r{L?{Sc~&Y}Wulsu-Jwnch+s+>;>
zZzgFGU<pHtmrVM&oV2+Ys(sPYI`dfbC5dgJE%8iDkA-5IzZv6x=E(#>-~4I^>{?Cl
zKTh1g-T_%}kmFh6OBC*L6<=V~jNT|!GmXA5xWV3$CC*OA#xC8HjyIv8vD&59=84$c
zGIhEz4p$*Q<gA)YN%ox5O2Zq<sVHfzDK>v7VL*4Uz_f5b30whze`P2y#Inxvo$^nj
zPU6r9KnZ)~e(_AyjQlU3hdv03lOTLhG?}?4r%5>l5q(gd4FG6fPGL-!T3icVw5c#t
zpcjWa6=H}<w@EHE5;b_=_m6}4|6?5_{-UUAlBkKDBHWw^tun;0omg5y=cs5N75E*B
zToK1(!|=DOVT@*Ew%eR_=t6rJmAw8*FtK2W5%eSDWqEqlk;M}s?gMHX=ye?S%a2fl
z|8h_Nd6j|MqG^DG7Ccw$JFu*yHFfatv6l!UcVQZfz#tffd2zLv4UY6j6tU>83G>R3
z?SYt_&xE+jjH$?S&f_sc2OkZZz~h<;ASFU18|Hs=JD>i|55A{DHa(3ptEPn)HYmx;
zD8Rc0!Y1=y72zpzQBwhmfREw{KH?h6ftmod1v#EwBVu#N&~LQ`y56Kdg1ag}5YWYX
zZ$<w9WR8~upc!t&v)N~bgR~jyi#Cf;dh~t&IEk1*X^ULouhq;?=(g`o3NGM`WGjf&
zJy3W4PPCsF)xVVq<vNY>#s7<Cb3l=O_qJtgxD&L!Zm_0WORj#EoG$xF6ffHZr&Bzp
z<6<C5G*RM+elYP-KZbM6)MMds?8(S<+B&vig(mP&CT!YVjBPN<aX#B5mb64tC+@G-
zZWT4|^Mf>MWP6!BCLd}lGL`ZAiw;w(Tqe6X9D%qw8BaxP$<zxr%^bd)t|#XNi5YMm
z%^)cS-$@o<AenUI5H+Wl|A~=Pg#Iw(ccTtA(5S<r_n>Z9$u+4fQd)$x{)jhI_|>JJ
zE#h9K@fqt~`M>Sm>fgNMKR@EYKjgbW3uO6lhBQW9tHE}SwNE9S@-d_mNe>#svtsS&
zh8U4QG*NjcOFcss=l(;1VIom@{ztG2A^y|np}NEE+X_3sqZi2kA$r+d7dbzRGE+02
zD`&W`R=ba{{ZR-67vGtliCfdZ3D0_2&1ilg-{d^}k{8h1<8O+an<R0WPQctB1gk3D
z#Y!T_fco|4a}0#Hp0w)TkGuXC-~Mkm4GD_u7I}}>3=N{V7I?ZU0y2(QICx)hDgAAN
zPFaol`S0Ws-Pq=<T5wYun^Myp?o%MS%pF^=1d>bC6&u7Z(NDQM9ggbWmU|&n6xP3d
zNiHlbk>o@WXR2!tXuVnuLAU!y^G-{dI>W2fkJFI@Z{1S0h~y&P0kV789pHQ~Ua5*;
z=}i7}EYx)yP;qOK3CJX|ZidCX*l+4Q4*T<n++UdR8zld#8>#AGKfRO8Ii^971}rh-
zMw3_bw2Z!VpZrUuA*kDI13X}p@;2R%8|Agr+tfyJsO$tAD$v0r3V%ictN4PscczpI
zwV9fh3`VEx1NA&d?EjmY{D<dwYl!l#>-XJ8=NIq#qcV)b%s?&5TQA>GNFFPuB>io0
z1h?rGucTv6BfyYNam>KWVFPlL4>dNc)R&l{y10n5wfw&@O<rU^?3-pP#KCYssA^jm
zzVC9ItbiJx75FLs?bJ5Tr7?ABF2hdM7%%Y^r5iS0apTmfmgfCP&0qNeUSueCQmNJb
zeB8PGK0(qr;O*2;%e5KO7*ZEBN-0c?X`o#u*ngMR<0>PO%k`r4$QOg5@}W>nj~h-3
zj*NFEu@GyF+$h}+okpSmAMO~5ERuU{{c1|661)r0PT>7RJHc-HnGE%B?Sy>uAD?Kg
zNyLZ>qtf%y-=(FCCHeK%V(o?C0pJQYoO*b2;UtPRp$t<8oSg_OB)_d}ryBgF&0PH)
zd8oWW_CrS<EKb0_Ia_#%E2&&{tmzG>)zq6bzcb}WvlYMeZ-ar^LEO66?Q)$(<&rO^
zY#|*?_49Ntdbv^!x1*_DPmVF|AY1T~J08mg&NQ#>K*P=($F<IL#qe9N)$G22K)fR?
z=C;*gR<{Es#NOR?dTJ#WWYP1qA&aFQ-trDF2%(tX9Dp<?GEH%B{<v^{=PTci4c^Sr
zJi~KheqJBM5)VfgGn`?DcTA9}^RzIH)DOOP>j3T9xo5Z<aPRz+AN}nz3&5X-0_+2f
z^DtI!nr$6o;`V||ULg2J_E4J~^43L?mGtiD+Ub_#aRk;y#+7!g%Vce2HShDIn4mRQ
zFM8RjCe%p@zGfvcKMqEIizc2Z{1jH@-<Fo$MFO|fJ^vX)=3K*Z5qgksa1S&?UZ~ZV
zHR#W0xg-Z-%>jd&I+>d<tt*5ww4?z|uZGJqDY1R-bBXU5A{JvOJv*5R0l&f+%8AS}
zTW>(6Jxz?*8rr6pKYhv?ofej?ex-M|Jt2!BOy#sRA`sduIoZO`4D>#3;)25`lZHR&
zY4S5Ju$5gVza}rX)|{?d@vQ9W+L~R&+ljn~l{oxZ7Em%bZ~vl@_c{6>S^$yHb?mB*
z58AK3g?AZauJELff`4|5ptRwOL_jI4(`XX)xm~n;iXUhltfNl7M!r4pw&-2@grqc0
z%!Y>D;#VH=1$9?3y(xgWtevVl0rq`r)8{?;{;+W3_vZVcwV%{VsP-*aPQ14l8~esj
z(YL9EuBt<Th6^Si4%q(5Wl_x9_><$OnSN)6t)-=o8?>i$5%&LL>1K~m=v5^{;L=d3
zLt*&q4Jso#?9<GYTwz%cMVPv*l<lMW0ynN+pVOkL)2N?Pdd`+5n76wm*7wxWCB+to
zynV$aCFElBXlBB04x>pACaG$$hzD7hApHp!^GMs~`#fa_=1d{mmbNwH9iS$W3xpom
zVen-Gd>@<lH0jH}E%_}0l7e_u2qfA61+5c4`^}gL0=#K=O}3vPk2=d;vC(@^B8<4$
z`1wsC^`~Vev*E63BIf?}ayM1<C|Y^TjnBZ*c9L<V!;yq$-~jIHAPyy=x=l}x)b-AA
zMj|`|r`?d`8H|A@#WD1$i{BZu?Axr_$Eo5>As=#Fye}7CP2mIUtf1z!N9@!<NfmE>
z?&EN>))y=x;EI8-bs-Xy=SpeceyY8?z4QZVY$^~+I6=F!=f2`4#F^=R^fOzm?}2j5
zXj5ya80I3WT~k>L@zcvw!jWhSSk9m0x*{^<b#h8?>OKpamJR#5(A*j;Gcf;R0jl<P
zk%FEsgKtPL-6_)Ru#c(e0O<@(2+r_~ueR%hRTST_gp{je*^GMp+kB?i+R}Tvk%YLR
zLnMF@1*AAC&?r_o!kY4;I5M+_$tjU<_e1O;AJz|TVj8!pVA23#c=Iq7>f6C(*V~Az
zH@n`Kb$#RngwH9#!;E<j*R@`~mjKoA&R<#&bxpvok@;%+nw%<aRJfFCu*7nbugmWV
zDK__lO9=rIw@rVuVM{*V8;J(*`r#^ufYXiMgdAbj{qOeTc(0mFw$z)05=ym8c7HpA
zxKD2j74@i)(4G!)uMe#u<<ymh&c}tACErAv)Wl4nzeAnfhJH%*l4EMswV22|%DIza
zaPFbmNj!Oq@K*D?wUv!0PEWOMOcyeA_Ly@E7B=knwhz2s_N?AaFO3>2+U#k_`LoaA
zU`39nqh5WvM$#jvBHG)j-YL|nN3~8)m`g6?Qm_!j%3Su94SN`D_z**#n=n?WcQX~b
zuAR@2I$_S7!*?;nV+!Cr^0f|W@6C~2#lw5qsB)de$@9MdP!@4B3CBry0ite;m_D$o
zrik0zNjTYt^qzq&b}wX5#F#nqZ93IkHFnQ%^T#S4BegT=svv~WMSV+OE6=hZ<3gqL
zhmReBUG6K9WuM1`Qf;v7=DdP`*6H1z0H-oIwY<G*uz?8cf%lQO1GwteYBO;y`}Sz+
zy%tSWm%iujBg4@A1U8-U;6t}PV!M_)D%jI1_gSIq>M3Noh4IbflT)d#PV`w_GU@D}
zbxZIy&LLay@TAeQLr-me;24;-wKE4CBkG(hx<#&Hc)>+ZY+Gge=_A?M@~^d~5*Bpa
z*Wj_Dm(>y(J+0RQuUrn>++Ilpf$n7*2Cml5$L=W|fEEn@qUsALhF;XeDD+>%OoI%>
z2=L_Kv$~t_GkWFqYfhdw8&P4-N@M!OJr>6-!63Zc;7QM(ndZGc>j0r^zW$ubCjkI?
zjLoL0r!KoIC;i}@%qp`7#8FIoHIJyMSf?-P>9>s;Kd<Fl9BX3*6Y){SVm3H#^k$FQ
z-3GV<JZA0s&|;AcFL=kvs_)&T=~gL^^|D}^w_(rqL7p+@Q&qn^uDww<sSStw9t2vu
zd<Kc4z;1ubx$h6`H!uD19}DUQKENZCqkl3jSF0YG5n?fd{q8yC5|+v!bQK<6j^V5Y
z%k09K>%wS<gV9bUjWU;R1Chpr3CZfDr+?2j&Ui>5umwizoGMmT0J*35Z*-3OUSn8)
zZ&b7}?`t2=l?*Cm8srgBP@>!U3XJ2TI{@`7uQ7$cXuI3C&h@pkayr_28WxJ%7mT0b
zJ=j}TU3<n+Dat!*+XSsMjFAw~#yCG+i%-mm^4tKWvP;mPE>5~fg`E#i6}R`DFDuL%
zyo~zdtmSglh_C<hzGmadQHtzipTQ#_LmUN_qblsAailp+`JXlnD;Q;v?b#H^(ki9A
zSoXP#_n5o{Du$tLZp*IaKaJBb8Jn)ZRY(U*h>czHJbO(Jve@=W)Ow#Wh#Mu0bsc|x
ze&kIaO&JhQ3PSUhBpJItaQ`Te*5Q~mh2_5J<m<6h`fjrH^9vEIiST)7(hEGyMQ<q&
z&sAr_Ru!9<x5EwZ<nJNV&838y7DUi3{I$_vWl=k(e0vr=%CLE;Td`>ZCP+RN?{WLB
zhL8QbVxF(2eg6^+J5ff*vwtQ}pt35i?hpt&2?Uu4Zi!gteqkmlblH{4B#(<*7iC~R
zDeV%67j6%|7Nm0(=dSFaT>)o{rTPWnv=5JkJf5aBXMdFo=1{&P5T!6r24Gr60H%dR
zJJwCHc^Ng85(Nsoq5eAS65I<pm|&i7Z&zbB+5zn$Ax%hNWe*3^LBZzYyK|P6()SpI
zaK)Rg!~sJGQxj#t4XJ4{vuFz(6va}p-InT|xYqTT1E#?_%qD=4KwwYc>wYvr!rzT{
zRY>6sWyx3*E#*g^XZ^vv9n;f90JZLvxYxqhHH$GH3ZiuDxIW~`?XuFF<zzq0d7yj)
z>=EHpR?0om2l8pGl=9I0_0HzGMc(4Gu`)@NgNpN`weYpfAUah)bgWW*eWy}r(cF%T
z4XJOZrDT;owlE3ztCp)lw9_6h^E7YARS9X-?%S8MOJp;;CFb&zNT*HO^+#(HC3ayb
zR$D4gcvxtgBQ|XILlt{_OSu?sjTL^tzth?99Rg9A5x8DF?;dNI4N487j^v}^tQBn2
z4f%4sCY70_CDnX|Cf>R|azF4C9s0nreYG>(<N|~LV6LKzxjA@+Dd+G~)1any)Ozze
z+we;S_ZZ~Gx3>=vCwK0Kr!)z5QaL>RMP+sb@9<)b7kaRZ7*O`UqRym*z9nNb@;a**
z_OV8%mlGm)pbkUq?~XO#xt&L}&DbtTI>)|N8eGiF5iUMUl9x?AXG|Yc^u2n1{>yQ*
zT1g~~=c@mq&!^V+Dk^)80WB9dTapx=j%#_UW9W<EFCTl4fk|`Nb-x@nlQ9;5^1~sq
zVz-a*tBlWovYJ<$8Q!M50W=ODH_5`(rS4`()qWR!i7T41AKd>o^0aqGeRc&q>Q~wd
zFN;IhS3wAl^f=H}$+Qe#r(Ie|Xxq`H4w)y9oZVo|NroQ*OE1$h-roXUs0+XSfy=)M
z>f5$a_oEu}x<7-OXNG)9=XV|0ykv2Mk6aTvMhg5It=u%f-z&j3gsi%6z!Zh=T0HI*
zG&`U>i{WM9OaYdw4FQ)$8S`E>B}lwc$((sm1R6^-vrX&L=o-LCLo09Nq`-li8#pwk
z-_C>#t#JtcvJ+*r<q4<E^;`%cj*%jBw`$TY|2yRTN5c1B6=iUpd_?QZS>_{nS9a&T
zM$7?5O!@C(1OG({rcr{hEKGd#*_+-6NaMOLKLfSiMfp8-Gl^x}t16bz{MEjLg*U7}
z^8}fWZdl?3Op6uMuVde$t=tCHW^BHO5X#*<WJ_$~JN44_1>|BJ;=>N>()Hq6vCPU}
zNo{1^%^M#-G+yy_U&6auGQM@_e&-#CHhQm=WZ&kdLe~r*M}3DPio094y%2NJdf98;
z>1m!$5-DhM%sR-dO{s}r2cg%0TUewlJsBG%z`6JlyC#1)LN*>m#FIgNu;iZV02`1B
z{&Ka8D_r?zGZ1eVE4N6lvPa@zu*5CgTHqRt+m(->L7Mwb1a@-w)6f4=ZlW(HuOO$r
zux7*h#5ww}+%CStOsulDbwsDG<nWOZwoA|Ed?9%h{l0yLBjYS96}gJXTN=LTQI;T`
zZ)gd@2eUjRO^Bo9#F^3>*;(n6La)HR=<|~DN{wMsukH@-o+3jDOZWXYjqGCe-Vi@A
zFP(s<091ZEJi*&3<Gr&9>>_MrtO^@(6uA(hpbFCxw1JoC@=d7v7PG&-Qr48Kp2HO#
z+qW0Kk-j9s*b~H99niM?2MZ-*GixT{@D=;=^v=0V(6iKe+^5lBq+Q2oN(kQZrpAm4
za&@3_De)auNO$iA7PQ1+tiJ?30r)(Eng^BVc&EG)7j!#>b|#_)qWYP}EZ;UHN^TF@
z^n5yYb)82@uS9N&8hU{qbM6G8nWNu3Du&@X@3id9VGE-6z|JXVX*~JvFuZpAXgh`+
zRO&htWelqxc47#qRup2kY4#k;f*3};WN^*cOcMm%KH3-=H|ksQ$;94tO@%H5y(@1c
z5Xs~~ILmv$LW7yAnq^+~Pu31w2b?^-Uc|ooH7RW;5bRhcb^|v{EmeNi89q;cm27Jl
zGqx#1W`Q8b6mf`hm`9`&M+&=SLd?kpf~gicU#a6@@8w~wwcJf@U=sTa(uhS%Ngy`<
zgm=6h!NSs%;p;ljtdnd|JuQD$F|uvI5%TtDL8l^>{Eukbi7`oXil0h!z9nWZsyi2Q
z!79!bxjh4z=TlOlMJ8njAH}-a`Eh0fgx#<X#UzFh{K%I9pY$1}@>ug6eA_n5=9t|K
zte1+;+-R`jqp4pySMUtwE|~B&H&<!agZsxbd*N7leR8%Lpre6`%d2J+U5C?paK6x6
zfP_1qRQCx+{6#-hSv$|ZDAK_(3Vx~C12Sb6o~Iy@sb_T$$7A~(KK1yJF}<fBIZ8W`
z<9cM)AYzlft#E#$FiObB;1zp<zFDA0wpLiF0V6xcXa6D=CxJE#@ds{LC)xvNcW3>l
zue_m4R(j2Sek!IEx^eip6CX|*UAR8SOC?dthK3j)wsJ3iAG}bRDS0Yrg*Ffw-Sk<F
z<lqVZ)r#+J#MH9{LD41mV1-<aOkZ#6Wau)5k7E8az8_j>;>u6L<>8*gQ85<xt9Km|
zlU8wiU6&+Cl<ze+%MW(wU!pH!wM|~eISET&mZ<JnJ`CW*h^18kyGF95>Gb0(i5~&8
z=G6|J2Lc8K&-3yqye>B|g9Dw%1lg9wy9s%Ac?;h<d<79ue!V`Jj6_3YTBMZB!f_m~
zjKp7SwNq|I?PESWz_o3ul0b3pI<D1x9P|)_j~`3nx##dCUG$zR;~~oJ!_Wawm$-aI
zZHMf@ji6FCw_!;j6C{*VXQP;bo<qJ|ce~&uN3zrNE3pT<PHo<xnF-j;Gi2m?tR1wR
z*F6)*rJnDzvm177)8xmPF!bT@QtPf-f*(@f_xz4`G-{7gIz8X+$SmY>t+#Y5>_3e!
zPMfJq+<$j<t~Po(t4lO#n7zOLXH#UNjCM*YmN|`T*Llr<l465%nh5|RujD?vG`=sR
z5T^H#hmFUGlt?P;<inD~F>R=7PHC1oFEb+xt-;;&UvM6?1#mD$@_&AZ_vQ)2O8KG^
zD@2=V_*?QLOGgNg*$;7NQ(WRROx}rDz3r?L*MW9;cHt=)BkB%-IWHsLa?>p$u3*0N
zdS!RE?LS0M+1@kjd+KVi_fT1dXw$S)<Bvcn$+hi%sZr>Ank1+pN$+#p8ktPbRf+^3
zx8DYHZi=1)-PEXhvyd1?mc}xRg>eHQ>JRx8_z`G|M`tg_H~G$99+ff~zcoDKN4ORx
z;zxcM!;D1NGozk(H>+ZsMnI0e&1Tr|M%Bk$8N#;~SQ@L8d7m$hM&z$8|KrLtJcR1W
z7M{+rg^83VbqRTx$=j<%z%2Phd=RDIDqj%3)!%YLISUqyo6LVscdm?{6M$LMH^5VK
zL2M8Kr}7&U<Znn*>U5QRM-hRl(Or=fB(acSRH&AIV6mzgU+nr=&;WtmnV*3vyHxMv
zh4xDoum6eUT>e?dtr!($OEk6*Kext??%5(ol+<TDqvSUR0jXw*IvAe%b+m|ip1L-8
zCsntt7(jWB|KP`J<G^_NBqzob?ZdaHIS!P<jdW5ApSLtW(BQ-^Ciwu9vtmL5K1w#k
zxWf4GhvW-}g?pVhN}F=dH)||ajZ;Vu0Be&Qy)R`{e-YsDa)940R)_a?s}yVZK!ENY
zZ{mw;^#cwahwNu0q5PvXXp9vVtte;bKVoHWsAgF^?NghN8^)c8R+6n#uK9jf$N!H1
zzsEz4KOXIO2<Ilmz{N($=xu;IgxPx~IBmIm*M5t8c*WHeY9!RGaaB?ZXp9V-lEi>c
zGhenMPKwW1ZsTsGP6}Zz0jxoUdE!MJ{@eoZLfNp}!If;ZhPr4UpT{WF?oR6VeoRVw
zeLF10N$XuRpR&*kOb2HA&Se~2`N8Ziq1FyxD$5V6Nc7n+IkS)#qqL;^<}@$$FD$G%
z!pqi7Ip?WFJ)BHm;K%S5J18%H*E)X=mG*j^XF8<82FlH8hwLw!I)+sRzR?!aP$-kx
z%<76l2i$LH>&*f5q}v!%8)L2fFpygch3ZR~44-pj2qsH=G@DEwXHNKviVgNVN#T|J
z1TE&TkN4-B28R0OPBN-pFw@lfLp?sW>#_5iktBFr??KHoLZG}dY)FQ30*P@|%ev>!
zF1ch;jg|<ag#&(oM&acWno8(EqGt6<Cu9?t0+^bo;spJSZQ_08T;Y2}+-G4*RX#BA
z8>XX0rt+mUQ}6Thl{_l&vvytyo2S3@iC$RqIPW8eqg0dY$MZa%Jk`B)bnC)mukFeq
zEm`CZke2YPdi}u4iFxf&abbo>fW!u~QTNd|e-{k#N94|(yV+w`sVJ=<zpI))LoSV(
zda@}Jd_v0OW^*u;lGk-wV%zL?+HiM1W^8mV_b@Y}@9JnfxDX%94o1nZ>5$RBnuh3Z
zyTI)0Rl7iuSkSa;bvM<&TFdk$%5}ANf^P+Sd(WRHq_*W5P;@q?E>SEWXHggEVDR9i
zd?@pDNX*+A1adjVaId6Oa-8}un%0&QwAj9NckiVCi+k{v#)o-*;n}Xy+SV@pTQZ!n
z4r(bMN>>)rKQS_j02}NupQL}?^#_sRTns{v!+jRTEva?-rSWs3{66^IjgcIj9vFhO
zcan<g1<8GKoD4IU|BSH#$#)~bmy#9o2DizZ+su)JKfWi9{qVwe&xSWQf|d3Yg)7aj
z(a(IQ6AKPZnZutmiiN_pv`~B`upa;n<{kqZLWg|(E6{*aS<%o%n!MvzAF=H39LNQo
zZ6vU&&KP5b=c>GB(27mvX1`prmpiJxU|dv}qCoW9L;VN6xz*z4G9Ckpu1=`2pcs7g
zcf(E{*B?#e#=;m%@f2dozt$jOJ^#-1k}P>^J%y)Lj9yMQnPF*~f!tPuSOrO0Hq5Bb
zLm4Zk{nydY*OD<y9)~a2@Vv!@IybsjC0t$x2yUWoA`vThd;gNKDQ3~9CL$)GFmJ0u
zyI#u#;rN;$=<1ej?nG^c)|>NM;nJN$J}PTHpTCEuMY7Dx`ORrc4Cj00PkA;jzNHTI
zL`kc8^^obZcdA%@AWr3=A(Hz2b0pMx03J4(3L%oTN_{aCQN~G>6tbqvk~G9vfWZLV
zdLKUDBhJq_2H3R_h~3xI7@ZMfp>_wQ%eG9eJ;oQ`;^~})?{2<$*nB@~G)X<Y?cT7<
zm8|Z0t*a<>+V7#iKKD*LokbYI3DYY*Gd0mhp`&GPxoE0@<fM0nun33qKs;hBy+(EB
z&x&Hdg=`$y<N1c2<nTsHSZg1xa?KtQsxn}Og26XN9)g%LECds(eIAitNH#+0%g`xV
zIFytqqI0B+`&M)_V@6*B-NVlEzNcN7D}ey~8tGPzh_=^)f!{r@w_2jzKB9RU();Xp
zXo!yZzMdu-X=*6lco*p_wjy*@dUHRwGXQnd5;$&wouRQAoXfEY;wKJ`SpN&wZ58&r
zx^7$@dj@n?DS4=%EWrTY(%)Du+U>G4gc1kU3-X^8Iw+`&;=i)RLw@#Vp&EVa$RIHm
z%X-g_4~+5oN;;BV$_HV8;ydV~mtwv|=nKc?12c)=z8^npk9<o?kriUlzuaus&Q|{9
zg5pcO>WA|)#iA`F<~hLCJ~5~}4owJGit2HSQGCUW|Dol<PMEcQl)c?+r!WXZ$gCP!
z%kk)q1p>P-!^mFSKu9ten1?%gGQ<-5kY$68R*t#W225`|{Vk$ZqDA$UTqtMTMUFE&
z-}8ZXX}><w+XF*!Nc4~Jsj5)P{*U_F;?DxRBKbSWUf)p(!hQ;|xf@qDYE!dB->#tF
zZ4eJ>*1O<;kGP|tC#0*x2(da_cB_@9ae(zwCG%ADGnjbL&^b=JYAygXYw;ub?>WN{
zd>3;JqzJKFv|5rxwr;v|?C3xqn+eCNWr+ipewCN9<#At8cNDl+Xl+dGeeLZs89bvy
zQRE~%*&F#P+{VyFiM@fLvv|`lCnRmGSkgr^e9vO`QcgW1-@ZekFrhTt*Re`<U^c(o
z%E0vKpj85s_)W?9Lws`_o3+W7YzS?-A!m4{jn{s`9|p6tPxEcA7d_=ZjOj1d4{YoF
zVrw&gMZ&Xa5q{IDI3e9~zaTd*4<tw8OE`y%oo5NL!oeH9&2Hy?Q;z_Y&}OH~-;j7n
z`FXPM^rgGxghyN5d0*m^V|A44SI~7^vwalHRm;LCl2QsOtM-^v4K>hLYsm=h8d_QQ
zw0=KK`rH$~I2mP{aYZ2oSnDDwfHTZGjBm}RmP>(Kp0fpFc|tF%Cc%|B40(vPT{IN|
z$BfNll2OmRob_!AmAzA*S@XO`V!NvR!y$5P2H|Sm&WMo>B|e50vxcwQ7F~mhpsJPV
zk^DKp)|Vy`2|uf6C9l|jq;KpzU2FTg<+%LgY*UQ$+%w`1x>FJ4`=pt%O)Y8m<i~cH
zn<}v`FQWO+WnLipr>73+VF)vSQBP--<i}m>7>?0VHf+kc#cnEf7k7p<->F-xuB}-^
zeg9Gjp3UHWW~x`I)Q#STy#T2)4KYO5Hh6*l&A|3?@#I*LF}VLtK8*8;&`7q4u3IV5
z{@l+XMSgtJ+VO1tIs{H;XK!LS^?N21ag=kMMjss_!WPko;!k5SK0jPY{h~k67-j$5
zi|z{dGC<cdDgtL~K!TBFdbec`=j!SbcU?kLtq6X;X^a{8yBeV%;Aq&8A+!$Kv7P-D
zZn~^AeKykw*?uInDF%1CDU9hBayU*eX|V|I|9FODX9-1Dx*6lEE5M7X8Rhmu2-OF(
z1cA)NxA3wxkDq-moNAnFI!zfm%okk=Ous#PIq;Dzbt~f1ORzSHiCKJ1@N$l|9~DEt
z%^f~q4rm%_LO{RJ@eZ}IT~T8kt}Oe44I(UPqd1^JGOZ54q3AAJKkyx#o$0xGJEWJa
z6jsW!(xQ9!FcZ}4gfD`v`o+fh_OYSgRzAL(@>Y+F5|QWV#@fLx##O5)<o;gWWzaHO
z>BV|7s>K$J(Y$S+A32|bwNv_?I0_SXm(BhTWw&f)vYff(Ai3@lbhR$E3_bJ1D;Ay+
z*qo=`aspFVdc8i+l3m-!KE8f|9GLrFwYi1Ocx?-OAJTP&{$<6N1Av2ur4@b_*#44U
z&bZ7pHs*i)T>V=2tUDL8*O)PH7Z9Ye<H5KF_pP3f@zaz=wd@yWI=T2b86pi$wjnyC
z9z`0qpd5h_B(apvw<~VO4M(6vaTVv_boYAa{({qjWso8-)pJs~V!ZFx;v3~A)LQ%M
zkR=_v8v_edmPG2UP5@8FvWMTTJTiZ5*QO!marXKA6$=@S2zwq}IrxC|TIWhu=zbdp
z_8<yQta9Wyj^khs5obX0Wu`P>ZO5cAs9$g^WcALS-*CJ?60i%~`{O9YG(#Jxuj&)g
z{Rj-wWMNVHiCV%Au_u1iN7zoN1}^uzY~|-b@s<oj7~XJl2r2JE=s8HnPrXu}NBqly
z@I^7Bzn^qd6=Z}nkbDd9b1dI0$;ldZ!SSt`4n~S;x1@^(dS3F*i>fJ}y4qlm50L~K
z=1Rq}ZOj>}>i7;@tMC<A7|X(vl=RN+49c$+oiPZtW5TCkh&y&$mx!y=lk?sn;<4TL
z)Wp-ti^rSF*@zxF4Rb5A(T%ZIvRs$=W*(0BO7U?QBY=VoK_>xnWA;pvwO$~Mf?>yY
zp8t2DIjN8}li8AJyE@#5Y=4Tn80u0oiJ7dhIhz-XyRp#|XmgU_p3@MwQIXa-N8|d4
z4@Ux}uuZmBf+(VK$5J`^!Fv=g<$hP1{IYsA#7GJc4|20i#~sx%?QO4n0d1#o&)t;>
z=Shw*6++jH5d}taX_=nEAYH0r;B@4fD1~zqv|k>=d_8~tQyMGN#b{UgHgM+IJa`1@
zVa79A!gs_mW1{Egacoqoo{sp+Ie`Ic=&0CD#nFD*rX?EjJGg#>3M^cFiNnUqor^Xb
z+q%qj)7-bv+o_d@#nx6-izl0D65`grGJiOIY)ftrPWIVGmRXoiea4s*XH@#p0Hq61
ztU2J=;OW<OGfr8-g9bQX*(9)wTMC`+dV-cHe>ishlWJLnhQjX#eQip3C516Ia@g@&
z&&_CGTdz}=q4dRL43e90!lg;>Etb51E)&&s@=Va2WHG;pTk(D{#l}f|jXJwxI*zZc
zMuhA9=asy&uY4&|#pE+7N}**76aK0_ijovMssmi1j&69=sFFphgE8v47&HRU=)zf*
zysW}2)QK~zqL@GHi3?DioD8L?B2uUgAflYq7r)c)&u`u6gLD-s1I%gt7ip-9lduB0
zw)@t-dJZ;;cc|hMG2^M`@gui}dxTA-ggbN9bn?J&@X$39#VZ`>U0WwuG(@B2p9ad{
zFb`UL8Dhk=?&AIG9$TXsBLAI$&>+vVxKT&3zGBw7`rta#A-9he(=k<v{!Wl1RR5=j
z&B(lX#Ra8gIBB1?6EmHpNrF}L)ZLWd7K046+REP?klI07d@D;{fB)<J1;Edo62H1l
z%Q)m%f%5B&{raEOaurqWp?@4G!1@J<u1wiC3E<}ntCG;zddT&E+zyY+$0XeiN0^X|
z#&X|tk?R4~7HqiOYf^KtCuAr=+H@r1%NyCe{#V>j??S+as2d>{tb-VqY}ze0mTZv9
zaShVj;gKB!;lZn8I_l@@e~Z=3s8E_1E7g1)e{v)UBv}A#g)C-lEF?y9Du0R1Z|zN{
zKympS){s|6+Jw5=Y}uIezZ1j#o8Em|rN`wRTv!+B@t+|?SX#d{4`YFcI7bMm&e!FL
zQrN4?#G6Qeua(yQAuVH2xd`Df;7)q|c;TBPTUCCYPe1o~*KlDe+crfN`a?x8RG^N|
zu=jx<%!W|Xhphb_*kL`VIDr<D2m89M*llZ7lwTP5za_$cPWL=UhxjWC(T8ql+ZzYs
zKQH9puy}9Olc{e{;kh32r%`by5$kNzL8<b5GTUtA9ZB0iVyni3h24teg4tkLd-M1C
zuMN&J7sOxx61l><$gRjyBlw6DTl>cC6aQUtn+s*|xVbTsw!@W?&705u8F-(BZ1)m{
zM*7-qa!MKl;kkuSjenumee^;RA1+||O3Y^DA-~Vs>gFlbnB!k<z^a)cG3)l9%P5(}
zF52+o9=l8pP7QNNMb$0vP+V9Srkge(hMPCuYstO9`}!>0TnekVTXwQwlmJa~4k@N*
z!Ezg`G(5xYYtPf}DRO>R$XUmSJp%#LrEz>On>i`jGhnaje*nSqKjDjLVx*W(B6a>J
zIo{S{Rfn@d3iWG$LeKv8d#+#p&WtV1<Ay5nPA;6W2y4QvQ4}`q!m>iN`n6)3z}8f+
zSkEo2+rZY$G`?|=htE1OVvdm5@nhOhO)iz!$!~`xFtahe=Y9z1_nJH;-Db7(d;|Sg
zr0x+iR%;llqRa}Qso3&N{5KsZ-p!SG-Ypcz?8_TkB0k?WU02^5!T(_M6{(}Fl4IXU
z+{o0fkz=10pfpo~!vkMP5k5J<Y`UnFc_NJaYn_b_C`wu=@!!lQ+59xqZBs$ay~Jl|
zjw8g*F2TSHM9#;Hzf#6WvYsyb@(@;AiS_^Sb(T?aZA-h}AtXQu?(PJFOK@m{I{|`Q
zfDj<Kd-o=|LvRbhgS%UTySux)cLUvbW$$y&KHqomxc_=EfU(x<xoXy|dfvB=vV+-h
znu>UU-Du1lh}ZG^DyDc8$1$2bRAD|E+^?=fzx@wP&W{%}rV=&a2;hg_5WfaGPodUo
zq-d{#$c}OxdjEOgf0d2I`H<!x%mzfmAi4O=EWYPovAZ|K^Ma$}Z*z?wSRSWvV3o2|
z5|DumZp<g?7nv6v%TxTY3-jq08+=-?5ti>T_w%DPq+|*Uj(BaQ&@C|Quwm~DGM`Q4
zvx_SHNxPBcbr39MGNDIi{Z`f&Nhm{hxf>@0^{DAy%p_?UHZ4r*z6>^NxU3^PSS}ZK
z`Frv8MgH0ML2ivC)MvU$=Q^UMY>CP1f0M7AiqwD9_dQ3TK?m~N;t@3`Ojn`Nx%f#%
zo=oFdh<;)ip!9f26ozR~(4g^<BTHqrP?CBsOOX)|Nq|7dh?^V>O!F?HpEJL~k*(np
zry}z`!bbX~s4r!IgES^@YbiS>Tam+ydl$>Tc>!4W&%aCWZ8&;Yl{FajVbGjVcI`3i
zG!Q6<coNF~a$o%oz4_?^tGA4qM5!qR0O)v$Ik#R%sSS*3OEKdym$W_Cj~D*G-mE9s
ze>zL8u}P0j5MnWZNff)2wXNxn3{%YOQW<d0MuEs14;X*OG`j<awoSxA4#O_D`D<zZ
z=7y03(_Y|7<twN?-=EE9l5YDP)sxE+yeAI?jR3KExmjvavZ&4Ys#mnSW>To=$fe3n
zdu!HwkV5izLkrwPsOxyP&i{gKlU;H85)%DHI;=3)VKNrt9<Omb?ijcm;__lXD8q4^
zU~u}S%zqac|5ay<!F%GEbQUFbqaKDzh(ZFDJq)f-*DHK#Tqpz^QuG|QfyeQA;X*a#
zL9XYS@l~-G<rjIb3dYu5GV$@inDCxAeqZHLUDGSagYjZpwIVlZy{(?cyCpWFI)^-$
zsqpXnq=1_f%?{oxm`a2dMAx~YBC4Vxz{OMl!<bidA_dAB_ss%0T=vR%KX^Qy@SSDp
z#QFa%hB_dBavqJ{EXRjn`o;?sqS)<l4F!}1)D+Mz&GF#4zn%lv7(rK9cBgjDRR#<e
z7=4%mxjNPrDj$|%Gv<DM9nLx<MHoX$M50&-Xk)D_X+29>P9hfeRdV?>5VUUFnHkEi
z+i~ibPSD=^aJsQI)DnPaam3i-0Y5a(Zn~{VYd>=$|MyXBiULUiohxT|*Vp9dBo6Yc
zz{8W~wZ#9fpZ#7++&D}L5PS=?XkG1xf|;-32&KmyS^f0a&FM3A`pN}TLvLQX-bh8{
zWiuHm^zh2s!YW>2GvORnIm9-^58()ZTQIGxVXm##8V;FZ%B-2MAbHduKvh=+o*qWf
z&kGr3$p_lpa&a*ahy!cC?aQ}Ho*P^!y<!L+GwQKi`AJUKgHxU!Qy+pT@h{>zGLapC
z8x&5y@?_+}$Fbt5pD!bR0za@*wHqdc-${a?pVqoZ{!mOaixTWuy^*{b1zlhIJlC0G
ztwN5fjwBtnTb;H#7hY^|#6u`^hWp&KrTshph*Kh0L1nX@_VFzGu?!meu7cTtWb7<u
zk4GhwHmo#tUEMrWY+p^bBJ1a3JmRAgdC{G=f(y1|(Vk^#yqeDY*Gi^lUk~DyzDw~k
zc3$<<geQWFWI-Lok9%|r@`Sy5#6-zjk=HfKRF@19G#4Bb#2G&<W+?zv>(BU7MV#@p
zWB)y4RO6oeRj^qQb|U4bYbzi0V8Xng)9dQT*`mG16hSJVEh(X4jq}}6bu^Ffo5CR;
z)$p<WVIPyNK91t#6z>zy4xh`~YB)#H)#wilx$w!+2F`TPo^#DJ)7GO+z-SjY30@FO
z3VP&ajGzL!$t)8X&%XRq9F_r03~TQI;JFT<M`C=O;A&(OTG7v_AIQSqP7S7NE^oB+
zIGOLIb9`@`Bj%VW@m*{LrST7jXy;8v<qo`P5HUcXGS>i9*4d1{zf+-CCQZdKpK$Og
z<c_`N;^L3qoR`R2`nHj0m!qIS9J-(+uHvGD0Ty?RLAG}FhU-LYiNVCuP8`{9#45tq
z$wdk)PXF2S{UE}?Za}w0m)57*W2G34`wdTB$A*3rH@4Ct=_-c~Nq4CLmJ+w13{{0q
z@->CPn72XO&fB2Z7I+<c0{+}(XvB(#dN#ZtA-vi+jZPy1!U4b@TS`jAqE75PLq|1L
z?OUZ`gL<P*by4oC(7S<*;IXEqR<A3&1z)Z#7dOPL{w|pTp2QfMJ(iZ~LLVIs2cv|K
zDNh<6gE&7=g+#EhJHd_?IMTs-#|B&C?6(Hx?hO}V=saRST=vGeY{tB+9iZmB+WQ>!
zl}7-dxZVlEXh*C##5Nyo&MY3`i@_~*EKLKvdZWU-iNu%PPmiBel^a;`7%y_p8aM~5
z89!b&=JK8KTU~T<&am5AJcIIY#DXn8RsX2wvt7{J(#>&LES(K721D~?s93g0`AtHa
z=)aETA^G`0JqNpkr!cmNwNgg3GY8ar)mwe8eQ!i-2Hx533YJA*zD=O$8&58VE}5)&
z>TeULcsB2(SL;5M`CN_PW7OecxQ<vdwf~XvxcI%hh3)v$i9N;*NrTxx3C7(l^>=jE
zyWT5PDtIgv*#?DX)#ll^AxSFm*E(3m(<eg$eE8-{6l8l=ltT0H>6xW?#8mQ3DBIP?
z;Hm+zW!1H;2~xPYnkyr9Ay;kfq(ChA;H9Wbg&$^z04<21G%Ta%c~e9`)#YA}vXKdN
zO5kQIQ~jnE^Ux_}8t3;b<Jrzl5a1JX#1{CHQB$f7)olK<3dzs5ZkYi<2N>3Gxj=kO
z^is&6GjT-2^N`j}RRNxohK(YVv$gs`qgmW=4vL(bOPmhTnFA8}v-(ds5_hX%vapPG
z#j52S-;Sok8%)3$-eG<<#RZA~#mNE0d13on0hwBjfM%{xBS~&5;VGsRM^_1|iIIpb
zMd67~A-sCl=%6J<{&X`s_*oq!Zpd0{OH2QhnDi^Q-4ACON$B={+~cBnV*^5Ym2LIE
zD!@OCkzf1Us>9XD>00P;K5y_&tA>V5=3?3xf)(cRtP}zGR?68*LpIuzv>*y1O+Bf?
zKW}EYU_ZRikcRyU>G_`a95?z;ow~76i5j_{yaHfUgG((ZAc9;-RV2&2ll{Si!aNN*
z&~Pm+==h4rV8H1k$k3k^k6}dW-`4-gwaJ4^BGOA9d7S-uw_@w-U{|_lix1#OZfuc~
zB^~bBnW%sKA+{}JW6l}?CXBp~y9Kl|KvG?Hb@O~#m!{#pKNh0Jd_W?XLz`T$J|E85
zcH9VG)yjqvy~JaT!om{s(7yAU>T?+T)f@0>I5pV!R+Kg3&dH<U{zSj1;nSnk3485S
z6_=jVUW|LES@beh4x_f7=QVM^;>h&&G0r<AW`NWj=XB{49)BKvW#2d*l|Lz{l*}pC
z!ns!Xx(@wK$O}e-=dq=I7l~M2t=D`na{Gz-Z+7=&bEgvZPq4w1_Zm7wH}?S3hLH(@
zhf1s1llI|xE}dHhz#r{j<g~+IZ`y^k)zy!h%~$B`GSGT@tV2|z%>sQsGHPoj>f7a2
z0I+*!3!7e$<0b@CRTL_Bw-G+Nv4@1tiqE&`vp7~}=&e7>v3~uQBM`7{XNw}}jPNB9
zKG_|c58<Qj>`^5q0_>xr&X(O*yPzVNZS$WN^@?KZ64lKNJPrzFI~*2`KbAG_yhvLh
z7KlN=^*531z*7|=POPn+VW1S&jeoGH3;K21N-+EObBrXWDEpGr<+RDgmi)Q1zSZ_L
zQX_3U-0P#qLnR8&zIc?_4rqPBnmy7>$*A=(HOp`jYP*aT7?NNjKC+(&_&6E(oX?Mg
zvp{jLlwXvxRcU`|t)0~a@$%cq9be4l+%D3Mnr)oXQV0bNV{o(qbkw~v@y%OlOsD6e
z6-(BqPdoFH(ydo>9uUFX7Fw^Nkb<PX>xB<-RcI!1y0O2C&_T5X6iWK)mP$h13aD)J
zLs5k6eD!=i=)Oq<f>dXFaG^sR?9>rK3y~G&%FT#?O=A8(8ydCxjPGyIgNEzp*oW-*
z8S+&!NR52A1J7WG9I`wQR68DNhX~tD!&^)$FemRz3Ygs#Lm2$0e-tLxyr6l+^7|#r
zoMASGp95TanXkke1UnJyM~KneC1?G)1-X^t@-~4>{613a5()wBJbo9w+Ru15C+-d+
zH_jp!8U9DfdV4;-9SWk~c7^$SGKwEGCY@!nF888@PYA_0MWo#>J<rnCQ;Rv!rq2fj
zKYq#JC)Br*SM02DcxZE8+N?G*4K?oos$U(Cx2q|hMOMeIUV)UNGZ<U9RFBs`97aX!
z7w`z<oZ)<Hx6iCRugLPpJUKI$@n>sRe1~0+=2pc-F8W$iPAFcIwMkO>aMDli68sZj
zlN)i?>dk03Uab=+Ad;Hyl;2Ow5ZT2kOO@TJE=;Y9n7=CJsSh)=rrVG{k1Y%2x>FsF
zHQpclq_lZZUj{*4n)~rU_w>Mw);B}}Cif^_NRd6VkxSP@8mvd{>Vo`UNEUr?7j(?g
z+ujHy-v?BF25S9zF~7F(Wy;%}(9u(-wT$U@@Wl`<h=4S^me;s}*zQt4PbznxoFl;y
z>_RL{K9kc~*7cO<v|7%SxL>fcS(d2{7|3<pSAE+#?Uv>o)*+)IQiMc9iwl7aRp&kW
zx>Iu~>m}7HsO59du4nX5@$bvqPpZxq<C$Yynh|heQ)8ILvFi-KQ;B)QUI$OkFrX}A
z{OY{NTibh}&6j<uNGEX)t%;4hvtDo+k)u4V+=ZWaTvaKKqTeobBMyqoQ&QP=g2~r6
zuF2@msV8+2%kIm#Bci)oa?j(w`lDMQSJ{`=&Y;`3oqzVYioNfsxLrkmYV5)21E6~A
zU&BX3`P40dkpGTe?K$yVjP+pr%h(ZPpU}Kx=OxA^=iActbZ3<p9GE`rN1x^-OD<E6
zmQQ2O7K)#CdhUKRZ7{-XBI$p^6^h>x;dqmm=8N?W42yO6^{k*f+|!PfIws!x)b|~|
z)X#N!I_3MTc^2{HGwAKIZ9C^U`wf)!C*Xc{99grHJ92(EW+(Dz`^Wvfq-bOg{wI7(
z4wn^YwBbR;Wlc;54)DTQ-c^fL$q4eD_e7?c@^B8hR8r>g7N|ibnpTY5T;t7xV&2#4
zfQMI*!+~O#+R?|(A5V2FSG>rAyic1&VepIa(atj8`)-7{Py5Zn;m@-X;qt{ftM$C3
zZ^czuCGyeByZ4}UXPOmV{3o$}*wxtWHn_Ee6q64mtwXnluXlYahPVfVuV+>TMBsN%
z0m%Ejev#DL+^to9Ge4F!k1i7wrSW(p$h%Uqp(7zSi@`U?%i4CQKCY65s9(a?F`u?0
zfrPV8aKY~3_x6DJ*^XdgA(GSXA|||9_i~4egMVNik=YLY^d3;0K3zJBt)QYJd6N7>
z^~n-=(KR-A%LBfXR^GE|n009=*n8=-+v9@qM$`gdD0;-4UodU1Ql+D@EpXXVs%SIG
zx$kqaD;5^WDLMl&61AJx87(kA^3=a`-VIJAa#!jRM|8jBV&J}v5#iIudqx)MPIGlM
zpOzJKSpTH=)5xh@*5wD9W=E$e(9%x>&xC2Z^HI*#@w}s+V~b4Rc*(`)f0Q(9#(#<n
zKA1^fW^Neh@{qq~Aga771{8SE-GjR9NF=2GVy=X%L8eXOt|uSMuW0=ClXzexvRGMB
zmIkiZL>Hqv^Kj8TTI^;(X%*8b=SGSK!xv2F;7)GbHFVLOI@BOBA8LWc%pbKAL9u9(
zzz^prgDgHaL-qsDG!zg0yS7YY&?`+kpX=uy4+thrH(mQ=*{}K**&J#aHE{VcZF)v*
zdBLHtHq$0U@4UMD#sM%WZv$x%o>X6fUb5rn2VZHn?+JI^QBLC<#-xV?Tix`W8rc7U
z^k%1=wrut^h-DkfM%{IU%-twOavv1O##-*!9!o{U8pjYVS5ne`%=Cm+%3<Pa^8Vn4
zDLGdU0=a3o9A|c7C^>^325xh3Y$SGzmkDt|m-lI#S|Bos&{f9SegRdt96-wGVlj*l
z&I^8E>4Cq5JV0g1EhzHt#=JrW%tb+SilJw3uW-j5eWIjJeC>!TO32z{NJe$0T%svO
z-z;B{?)E6XI0fuvR|&EYs6m7}AJzqG4n8k$7|<3pa-v{m8-=bgF4O`%&pCtT5mjs>
zmY73Q?7DIH8(?phsylDp5RNSQOx$9QGah3g<tqx?^EC;Rw)3Ap^f!u9TVh7Tf3*$0
z%rQ}#62Y-<%=Ntw?2vzziKim`*l{N(NDsQBv34;QZn0i<HR9_<{JLF*@S9G}(8g%L
zkw8ZZm*a1v+Ztm$;7Zy8-YCV{`!G6j7cMK>8fMd^l&R^={I5)WT1$r!S+S?h??<2?
zB2Nyb)T5IUFP69ORRX-(`*))eIi0}}+=i4+$1t;g3il=K=*w>SssyWB)hl8Ty{Edr
z?CLJwqw?o9xgFym+Tm8cS_^<DqfA0tI`9&qV0baZLER%A=<XrTRmNWjU>lyV6E!v~
zTj!u<>6?P>e>!K7>Bi;e??#yJszLkNiw|#GZ&xCq=lyvjr!VaAoxgQZ_KMi$<31Y^
zjBv+x__pyd>Rx2H9XVs#j`1P`1$};aMYi^paw>6-pSE$U_tD0uwRggwF7<o<(+F`u
zhKr)UH%jX?AK`r{D1EbS+`Zk=t}x;CQe);1hJa#Z>6aCkSA(2+u#!|7@4_4ovc3Kk
zae92cP1?|LKu<|*k%Q$MJ8+>&<(ya0<SLD*db_`Y%1ewi@99TyuDIoJLmdA8iqov+
zBc^GxV53WMwMLAAfp|g3W|jdq9gyzGy;h5@9-d)(Npj)lF*6|`e#V#Dsuppkv>OFw
zcBfqBGHc5`$#aqlJ69JB=w0d6TL>6<YIEfOk<m2%$HuEn4*?l_3g4?jlZ{+7LL8{i
z4i4f+`Ysm7EUh^*jv{t^OGEh8%ddbILi0^xOb>R>(duks{*w*~3576;4zn_;RwomM
z40QE?D^#x`<4YQ)eh$_YPH;=n^lQa)n$F8wTQa)l>HMk9N!y5*h(c}#zaCwd2Kft<
zMC)|fUj(8vJ)E|ScJPWtyL*K<i7oFia4941#1t$oHuEb@%>_NyE+c1+(Uv2BkXr1s
z1MC0S-5pQtHc;oF)bPoL_YgyK-&0#b%7mDCUi1UY6AxirVjBDFP$zeB?H1n8KkSY@
z@mW5cH|gPHbPZnr@UB#s!)xP($RGw*Qc?YjM=F)dk#C#F9jGD5S}C84Rm}^{3XLSE
z4>x^&BCd&0#PrRHeuY^s+VtNpclRW7f!?d_%8*SIX&!z-*wYY)Dj1DSAUjINr6u#P
zIGDHWqxH`%(ne~~P}N7701Gr&2YeUFw?NyK#w(-l{Imq0*{zLb_fB)!*-TI@EJIdt
z-eNy~!#ynHo<ZbE7vuWFQ{7Pw0_-l)W9Aoja%bxEz<FZ36`Buyjh=xbkM*9S+5dSf
zzH#5+DW2WJ`TLmvszE<AW3Rb~gnD$xL#Co6$~f6azT)B_3Iz{xwrG>V2@`6~U(yRd
zYnu%bMJpI?Vfq5Ig@HqC=1AoZ2&pkOjIc*#{e9GQbk@-`9x7o03#C7;aP&ejq`&9V
z=}%ao5D(7m4)}p*zF2;nks+gaD7cqItP*5qO&fgDMV9KCdG<$R-@-O4hbc|}n{Qu#
zNnx=JG{j^$^@f!A-6=dnN)92<b&Ts-pSPfj7F6qJQ~c~_F9V^tyn~<jW}chd)xKrL
zdDb{4L9rqIjn=nu%^%zBC6$4J;~$LK@$u-H`n=e&xq%;dGj1b@9#8e8*d^>b)jwWr
zg{H_N@<5{^1UTlOEs`KQ@!V=@^AcrC(roT!sOUYRK@^}YB(nu6!C5JVbDI0jNFSpb
zv)$K+>$XRLQr9q|Mm@LWN|y!MT{&<HO$vF{D%NMdYR*(q=@xo9FX@1bV^kLJk5ael
z<^4|JW^S@$%a}2xy`FYlyo;!VZX2l7g}B0ptUY|}a2iqhRr(B>ttPHAy^dJU%@`B_
zD|fAzWO{IQyVulf(y*Af{zhTPSECb(97&t^P}LWS@A+2|CLvr&52!J4zbotk{&eGN
zH<>e8qtl>xm;jZ-ke!_>YHr6Q%{+f9@#yXHcKVp(c(*#<`5jlmHa#F@;V^>$8HYa`
zZL&{02!7_fgNAJv;3WC=;i@rebKG(UVPOZ0tursJosG8g_Q(dB4Sy}ZZmu6fyFE@m
zKtiEK{uCikGR}KXocv5q5L}(FGQ0E>4&mdvxEWx9lYyEEwDpG7g*B!2R0`6k)%HZ@
zrq$^+d)fJ8`yE@xd-NA>Jr&@mYBPE*`~S3!cqot_UI#=69OaEXKfOz{-C!zBCCS08
zXZ}LyTU!`zorg6pz#w)O2q<n_ZN%^q1EBPUUoxMgp}z&U3wu)IA8XYlx@>qx7&`@K
zviDRYtIZ~AKTk;-JCjU~m`SE-@?36FIT6X*a%)i_#$ymEt~k`!NaJ;`m7;KiZpB%3
z7f?m-duMqCN=bF=K}P?{#{Kk~b|F_vo?RTH?P)q#j8Bo27)^1>1Y4T`Chd)|Hy1HZ
zya*hgAbO+P#TGq>tJ!@Al&;8)@!w~-o+Yypsar1w)?QTKRLQZ)y$|8a_R+4B<)jJn
zgpydlyJAO{4ENj_-cJ+(mypm<(R=DC#+J8{;`CcyG|(Q=9TrBNHLx|Bc%tDVt*fZ4
zxUcrBx=1LEOw#iI3XU{pR4uC--M*tn*;H^_7cpLROAf=COIr*-xDyF}34Zl;7Q50X
zU#jP=x=DNfMO$o|At0Ndbo_vhv@_Nj6}?YOZ2+nCWqk9DAL&e40mn{)+BFpAMjq|S
zTZQ<uMHx)GrQ|il6DSXql4k3Mp7fn3*b|K)HmHQ?tMxNQM|DHby<g3n?kySx?BmGe
zcUwXXz1$M-X$s}!sLr$U8g(4=G<jkdw-!|<y}Hm6AitxfYl{)VlL^t7ww$Ex3bEUk
zK{_r2%^Wv<?9mo_Om*V+YiS9KQ)%CHEHRkF51b!|=61QP4QsR}g3Tmf6)$|<1rq^r
zZd|K}O{hTR<`kj69ns}-(gh-sDA7rT5m7SYx->?|_GA|XkERj1Y44@H@AYZ}i5QCW
zGVwEc7BM89ZJ~Xv9kJ~mao;8%Mb99ctex6Q2Ug~Q2KtuaZo{xAF87;+)H~(ltySR?
z&3}6V6!p5!E8B+nd~+FqQxd>z-|dO$4B3^{{y43D%hA2cWuHLIR_19W^dGeQ=a8TH
zHs0`Aj6(_!IwA$|-m;iSfpypG)k;w7XuOpdE<%fGLw&^Vj;RTW7(nxtI_P*`AXP?4
z?<@U~-AQ~?$x@Z%cyQ1wMh4sCit3{@L$#G4V$wj&xTGZDP;b<+=LA$&GPrX#emPH3
z-uue_rSj5-mEcOp!f=4P*@H&njyOE(VVJUetMqj1baHWF6>R-(&ZM_({YQ=}8U%6e
z9?>?DGuFanv1sca8nAxajv&kd8GGA)s7)Nq$*ecAZ#L{m6`cv++NxiT!n|Gf_O7{o
za8~W9kGMT*G`YJh2Xz8wuw+y?<}vkk_U)3ZKXV>{+Kwv$VpQ~2YHm6^R9;kk#1OSb
zJplb4?!JP5TYejq){Q=rbj<aR@|Z(A1fK4FLTIx3h#4-$M>MQDkA8&TpEyX#5wGt&
z?Alq`n?dQ(2?Ok<-$@@+4B9qMsx*_CRO;QWY9fd(9TE?oR{8BM`eO<SVLuxTyaLEm
zyu+IN+jhaTe0Lbxn^d-ZE)VGT6U_(hg11x4kGIPtZu`{*IQI~;bs@H|T*lF)B*V*Y
z*4?|RH58si`;aw1xMK<X`B+;FS;`b`SX2R`viF2P+ba0(5rvFWvF&)qnrA$sCB%Wq
zn~PG4n_0DQd$HuJ(${5m#Xj^40{iyPvK#f*OEXF{u>wgfVRjj=4Zy9cEiLCLsM~o|
z4Ce;47BY}V7nCP0Dsg3@n1$$^Z(4z)Jdx9#=yH%mHYF~!&DK);6;G~BlTD_6u<3JF
z)LK!Mx4b2=GpDiXeruuF&)IPC{Nqg<5$xnbedxIE6t5s=B*X>7D@(r;I5#TMy9*$U
zLr@bP$hQLXdMO}Y$s$(jN~&FvsS*-hEQOIT^1|2Ve#N1r%Q6dc5D2X%IFB&7*eL;n
zJ$~17m@;>bZmQlnWjP;h^(<sl5Dhkzg|0@#iV*mm*4?+6q?l`kkgkF+U6l&yt|k7;
zZNuji9t{|Jcf!abB%Lt4|EuLVw1tX|`Vpx<<R?#utomm&n<87(7Wz$QgghC=)w)2Q
zA_(SC07!!ghynjcxW?snoV1$kM?5l{i(z7+ntfTOb29fZ%v^=e1%b(pWLArK?(fgW
zdy%lyxxO7JVo|UmiJ}_X&|x=(9PtEUK3<tfGMLHfWxt|;oiq6M*zGs|QW*|z1EIG<
z-4`quj}HddcOx<QzfESro)-yLulDCiAi@>H_l9=ASQ?_v3frf_xvqVj53<|eb(KGu
z<4w(XaowwH({rKlW&4MI9AJ<_U}vPUh$2T1NuF$z4w?h=uf~nAyKLq=bjp%y#Em3s
zUfbIXMT4D?cEVQ_T%D(XJ?m)ZyTQ_Lq>LQdP7<SR4@4b$)!3tW{mVkEVB278<4qDa
zLoc|%GsAgbvjA%mDuyLyR-tteGX*YtWaBe>O?iI|k@DEy-rYpMR!^IPf^n9U4y*r=
zr9HYlR;?>_TAbTO5NAr);on2j4v1i&^n>Z#mE9kzhgSw~qsCHE$J?xs*<%}HT3=;&
z=)A3-kYvs<c2JLfJ0E}w2HKdh*dzSUI+9U0uB2USVw<RA!+pzN_$DccQpGzPux~{p
zRv%UeUDID*A^50fuB!QVc7!rNj?yW3#wpjQvde<&C~c!?(q|`}<+Cm+oE1dD+rs>&
zbO{E%W9mNm_bp-bKgw2JjvEiU+lm9hWFMlTjU)cuM>~4xzOBcts9OeF2bn%z)e;~p
zp8vR1`ZbAvH%lryRVEP>;jc%@beRt=wRS~gDXmc_7I2^@+LK}oQ3|XHoXZ=Qp}>rb
z6!M{e++!|%>I%aimZUP=ACnoA=6#-2B-WtX@P5APGr%&qU|&_px7%nG82i`+jn%d>
zk&bPsKjrS|;0ze+C5JItRsRt=NP{ke(m^N+)9|ih*5AufM5|<39Fo*dv*|0ldL}`4
z|F{c4TVw!QBJ~Gd3o(1<N4%ef-!4#g6-8qYv<gPLUBtMFy&L-kp)}LtwhHVW+BcVx
zj(!<N9~CpJz8I9j1LXyg?GE_0TMhIZQTwLs%Ffk&&r){j{Lj_2kuA7@uik8Dd%+mS
z04$GR{!{p+dbKYy!KwGX$g8CWb?4|&uAu}s&auBP4EGSF4q2>M5P|9Y`dMMugRk;W
z-nQb?a3?F%vpa`S&P?Lw&BdsY5*V;IE)_Z_{S0C%(s8q{E&<wDg1y@ktIHCIcJ#+~
zwgBz!g}Z$ngQoJvC~1^-ErW4hC!C?cD0gDE8c5-!satN^p@3Fcv}vX`7uoc6vFk2N
zxUV+)Bi~QPOXm!f@cH3dO1aBv*5LE&S;KGEbNByM<5~6pvq7OjmhaIaASahS>MPfI
z`qgAm!F&9QozTH}c3V_qh54K=0EgL-sto_ZhNvklrlRl|cQL#&!OCD_<s^8HLy|4E
zH`_J!{c1e6%*`mb#Dyt^ML41wn=Re*VA3FAD3-#e;$%oghvF9qHuts$i+~OA%9`Rr
z0?M+?GIEG_Ay>oo_|in9sIeo^nZ3uTpF<IU<o+^zwD0%UF!{8?Z|tp!Oszg&M5jQ4
zqak<o8l<P=`6Yoe+dx9Mkfo^FEmMOZ^(7e}y^qcQD`0hANP%E|t?LDu3X00xA^%9X
zekz5F518Z&)4*dx1YNpp6=WX@VC%1Gz<KEQ%$NyWFwL<0nzEO{MXqDPoJ6A1SmB7N
zrK$F-TEYc2pc#PA`M+g>M^+|Uk>5G<yR*vUu~J#m_WD6<a;k2nEU?+Xd{#RNk0YX<
zAp=B!Ym~U{*I%r4S(8Rnf*($P;#g86gYVXxpI;o=9pd>NO<`Mg*%u!6MG*$&vJvj5
z!I<;)Eh(%9LL|Jzv>>Q2YnPVUqy9jBxESPEm-IHt`tLKKH_jR}ZQRRx%j<YD<xrg~
zVl$+c{18J}GFE$`<HAHvu5uCD^}kG6mm0ngRK_EuP+~=)+G*<6z0n7;Kh3j|3tp<z
zPNj&aWqj}Ye_OJ~`R>q>#)&T2DBGHeJ%$m^q*iw7u!@=o&~Sw-)}L4hj~FKY;CjJ<
z<--mrIHz3P6d3%+2MOLNK{B@(TmsdVm3Ehe|F!B4@cnr8bYhzi;x>6jrI;JPyczu;
z78QT}TJkyen&?x;fphd;ITZa=+3FVvOS77FR-Bz&*B)x8eWLaO0o#D4FK*+KRH7cE
zQy?>37h+kC+Rg?6^@Dk{EA#a3phx*o;4$Pr`~2i;6W>HBO8Q`;Tv|hxNVG>6+m`PL
z5JKS%vSsc^p#>ay`iRecitEc<FdFGVJ({u@t>{wMjEmJqiORpJD$uukFit4U`}#}a
zSyn%7PzuL6FOEdV-xvLv=*h(&!A8@gz4}ag0+BDutUi`sJWon9&2}4ivi>)Q@h|-D
zXG!F5ux`M)gC~qS-}pBa)9E-7w2F_AZ$HqAd|=88F^ueVHH}kmd38xF%aj)mxekxZ
z%eW|=8LH7hT*>0xm+&bF^iY3!yWmvxRg5IyM>jKiFXf{RQg=~Gh{*wKy5oGJ7=v5o
ztGBYksbz}r@i;MfD0vTNw(k#1=&CNE-*3}^9sBkVk+%pya9V1bW57*}n=DA{&n07s
z^UDfCAiMG}d(LDU>^{bz-(kyhpX_7Bf33NH5#B=&zwJ81wed$$5vZ!n+&Vt_3r7M%
zF|9)cqbat4+<~-{-FaHe%5WUB#rgoS>%(!;Ea)Ocat|BJ&%_W`bHeF($sNkAIrCA0
zjoXm3ZbFdOw)T&C-dZLreX(t<`;Y~|&@j?*r;qCJPXR4qvr%VMve)c1X+x#V^xHte
z0nui^b?PaD3OR#+7{xJ|#QM4WmlMOg=SX1<hV8RGZ?C!YRSSyZaj-kyM7~goWKnfo
z*meD<7xk|jwZum50!f^Oy(hp@$P`e#+AF}fc)=l0B>~E1^W9*p-kp#!_F;6!hHX==
zXu{29!Fk1ec~XZO!ii4bRTwS(4kkz5(H<d_HDOn?z7&q&A&O<U-TxfHC&9d-9sb+9
zR+^Fr3sR*!1(-WL=T2IX`Y!bGtmNivgW!%O`KL@nM5{HPZ~gY~<FxoS_8Noz7R<aD
z!w<hqliR~zd85kID||ucLkeH2jvjpy1bdB~ua|rtKz$;T^sJ|Ts97#G$QxaoZhF2N
zk$M_Q#*cZlJ46i_q@X3>yyfY1@{Rmw5x%ScZHB#|-lfThib&~fmoqu9*Bl#wyXMys
zayaoVGwV>sc12i6kv~aBHG!#T>x6&6bhFf$HQ<t)hgXJTKGFt{vvs!@0?c)-|IZ<%
z=Xm{fTk3;B42e2IH7Vt`8Aj>0Kw52bU1mLlx%ap8vY(##A4o}iYXGIe8*}R}^R*%0
zC=FTea3SOayZb6NNENi%!MU40yfL*xW=E-4lU#4WgLv(mUCY1VF-Ur<vD=-9ibC%3
z(MY(v=TfDl^U0&p8h>YYxZ8*iN713vDL6PFZ-}sJ;j=aJQPOK4eqEGB(;#z02uHNw
zO%2e;zE@A$_4?-#oSn*iH-J}SBhbqAW&tx+9WjFQyt|Kake=+1!D5`c^lSjT!5xNk
zts%>l(kZj>e1X>G8Ko^?*(=rdBj;7Nu2*5kRMLZ@vDq90vgBn2PcY!#i*NAxnO_jK
z|E_Va_1*em{b%z>eY;x8WWd-inb%Rma`{u+SibTir^6c0`tQ<a0@@@xOxJCmpyLei
zoLPma8W-t0gkk-47Uh(r5tk}ALPA+bfeM*+ojup5>q@3gr14J(%l<|9F)B35X40!|
zEVoehCI8m$SWMfs_iy*XbMJ~iT8d6Z;DomV@KU54#Q@;aY2W^+Rh1zKm=_&Y_QHQt
zBArK(pRj-mEm7)%`(>=`33?|8kxMTOzt5vjHt7GySr8ZbwIJ?!^jWyv0H{O0!@MI+
z20pIfA@3s9hPyPN(_|9YxHplxQ1dBh@;!(z*}sp^xf-gq5aPoH=#|VP++=v)QYcBi
z>riWY2P3xVO@8%?UR5SZ*;gx4m<ijmpl&J=YhH_T%?7bI$oFAyUKn<ki93EpGxyt<
zSc>&Q6$8f-mD>Y)5*)PMOobcN3eK~wy{yWfMQH{2qC5YPp5NvHzHZCHGVqr^>nYi&
zw$;b%>#5f4XzkI^${%Gce+4Pd9NL(#W!P2Nofr(*6WG6ULoGx4)(q~4qgR_x+ZbkJ
zZigjMbK8mZ>TD>Y1aGD|r&a=gV`-lQI?$hfE1P+crE27NmTUs-v?NyB?gN@(s|FJo
z6o^N4wm#pl|0Xs$73tokNW6e^G1#wDt&^{lb(<BHayfn-G803hDiS=)wYka)r#P4}
zi4Y6$s)OuvY3px+O4-ul=i#L+VKYRbhOX+|)E2bnwNJ0i-lNBrxpsR-RO-NJY-$}A
zSTS*uuV}7#qA{|JS@|z%yiz&^vR*I914bIPWmBNbWRB*&<{>0h*7}Zt+P0)x>F4Di
zIO16}rGV7hn4%R8uO~2=vW11*<&5h$&e0n#G9hnMwLg;uG>}Y|8Y<Vbf=@7iAFf?f
z-&j-LEZ<hh8Hf{No41t4cA>LZI3x=l-<|<=gh2NdPtof5o#CAq!lzXh5#UXvi#(!C
ztkbr88FCI@cSrqB!ZdrLop0XXe#3pgF@YdsaEeVMIT>JVx*)<@|1iL{+}%rsf&Lpo
zN*0=?OXT_P{ky56AVJL#7_LnHB`F>=ZwFlq`9l5`rPh#(f8;0t16FKn2?s?{2nPeV
z5=;~kud@B~Y4i)M1?YM(RU0}qs(&lM(7rXY1859m46{ym{V10WlBI0p2WUXPRK1mv
z-Uw$_Dgd52yPAxaxv)E~ovn9PIy{>*yR|T|tK7aBpVcSydof=RFf2h(*4lB8@OQod
z!@?c=9fiut#$!9-iOI67cQF5o2Sdx_%=ZY4*U%A@2rl<AYmT6@<(U`9iyYW8QFpXU
z-lxYV1M$WrQH3vObS?bHrfAhc^?j4f?Qq<C=SSu(i&#vG&Ye22I*%`424ymb;$NK1
z#K*oJNO*u<x8l|7a6L^F+zv0g+i&e5wGN&sUF>pR{Wp=5yt1aP&w^Y=>oJ}-3#glj
zcfQg^i7@}>6>dDE!*%dG)STac!Qp?QS7V6-VTq~pW7@!^5DEmrlL?Kyue;AuO~PX~
z{N9tX%<Y0~4{FX-wmm_Z3z@@wi;NF<o44x#8WnwC^@!;!c@O=Ia*AFR1Uuu$sToIx
zs0!HHfPbRsdS@7A$ws?AZLE-mJdWC<fH&js@AFzsnuqIzdtVjyz#lX`9zszz?P(tH
zVMn^1de)^xJITJ7bfc@0tLHD4E;hS&btzuzg#TAE0noY$I2{}8%<GiQG~jMf*zJ2N
z&_b7F*dTuJYa@KJE42;?HxaO{26I8PBl|!?RlVc~%=TeMb&%_R&}H_T2mwAxm-qoH
zh2S)~i%xpPXH47U2v~A)lV;9$f6!57^-vt-I!iL6ac*ox@68R`haPj|kDS{!-?))}
ze8M346w4A*-+a=hT6%H@n3;y(sEF*W{TXfWMfHmJn>7Y)ad_(ob_RcI9wC9*rgj8;
z@vOJTD$BMRx*5oV)9JqKs(ANM9o?BK>J?NP0Tg_~5P+nsnKj*^Lw7wftsK(~u%=PA
zZM{}8i8pLm_L)R<d_iX?2Z~F5XX~<($Fxlw8%_7Ahe5)p4Kz!(Hw*Q~oB)Hd#_2c_
zU@5%1w3@GkCOp>-d_9IlZI5m)^sF=b_MK;Un^>f3t(q+Y%{Qrvo6ne#I~db!%%dY$
z(yV7&M*j}u)F?<&!bbp5@*Ab?G*9|Ql**sULaC@R?HO^Fwk*fya!C>AeY?WSTH_FW
z)?Up1V)962qWL!84G%B@8lFxHU`R4xv}rllTA$G`3*9mX#6U-(@nD%EW6J)SM=Swa
z+}4=Tr6YaM?deW}Bn1E2*1(E46+UG{JLGOJ=Qgs!i1i4#A96DO6ALnXk|vU@`?aT!
zPj}1TSHzu?2T?jF>4Wne7HwyPdh(kmN4x`SBhtYDliSHX$VxS%4>6;wIpvywg;%uf
z+qMp?kbJ3q55ms#K6d@!F<_^KNpexPy?Trvs&V!<EV2OH_7`4Z)KfR5J}Avfd|20`
z7wZx{_KM@wA8Uz347$}BvUuWsL<Fy*YK_^-)m?K|er9uRS}!4x@BE|w^R&<v=U3;J
zWqSC20oQmBr8gzESoJCzP)C(rDrjpy#v48DT%jW8tGnbzK4s%K#$#0d_Hpa+xrxdB
zH#r^c$$aM?##NkedQI@A!Oh5LU@`+o=reUT9f>`j%u}W=UT|5<M#tG<d0gks;w^@#
zH$Y;FoWH9Dw_jDPay+uZh%bCRo6%Zlzo7&HWm@6<roLN>Gzk1zM=IaxgyJX$<Pn<m
z$S6b$E}v`v;xYY)|Cc|Y-~YV>t)Wh#`VF9(ct|6+#ZtLAd}aPMAn<sW67kD6tV=V~
zRXXbZ1A}dkB@c@HuK8u=-dF+j&O(grva4P1jhXfXQ&Y&pSSC*2jLk2mxGgEXkAF&Y
zM%V3V%+m5kiyhO4OO4TZ>F{j>w)a_Bzc6o7(r(tN$mR;Bl5IGn1tS)*q~T3NFHptj
z!jemm9|3f==T!i&KD!@l4`#q=bk6Ef3R#0#|A$h?FzHh#zZ;-s8#s6@5n)M;38sRG
z4ADB(hkP~|g4-hU=ezHzAZNy$0l{ou9@*P;aDc7`96f#Ua)uU0_}gQ<=r-<RXza<>
z&!kJ7*Hx}2iU8-a0EetbgNnMkhlC-TFC<yz*0YpuG>{DFJzd!;FccG2_@t&8uLFnX
zZ^tTeD^&4s=MyEsOv0g%rNY=6vMbo&d7j}sVMs)uyV6cR%@)OYVW0D;D2bMCt@Tu}
zI6VPQ>~~bp)YWP^HPm5Qwp$j}@8YD8yY+W0Np*W`r=_R6f8msXRdkOt$}YpsWiBcQ
zz4!7=NXym4<$9WZTh#THYL;{Im64~Xc#D<%#8X;<B)%#F-JE-&#GIQ_Ij0HmX=^?0
zxss^<3+Os|Z)5nLc0kMhZ#IzC<US0aELx#I^R3&8LC*a`EOyZQ?WG~l1hTwL$c-A~
zGkmpqsi&6#s%}#*rez9msG`&tOoEp;JTr+fFexrn8qRx)O>?=oz>0K9t3I2W;XSsv
zbV0!wWaOb5H?{iplx}ou3olI&50|PkKIZibR_){Z#Er`>p3e8+7Lxkco6kr!j-ET2
z(GAUqd~AQHy4<wKZ7YwNmij?A4Sl@G-d5Dgy}t(r4tf6U*G#a#qsOL>ByF0ArJZ=Y
zPf_WIDu*GRiu45{PR*ojrH+rChl-ple>x$|MBPfnoR#z^syu4I1!#2MH<-uW;$+CC
z-)`vs5$t}-yb5h|&TJKKz8^_(rt;-vZC-le=Nobw4RN2k7Y;Sp+ByBMZA_7{BdJfq
zf$RdOJ79gfvG|_>W?u2)X?N#&a6l|W$M{%%yo}(G)`#V)srQ`aMM^3#crh;IxhRcX
zgm(|n8u*OKP8SeQg=QHHsaBHE0i!nswUxe<krIbIwNQR-pTqiuk1!4k&2sjaR7f~g
z<=*Jvl^Ik3MiR{o+I^r64UJ}JBGdra?m{oq@8%itkV@KYYmn-7@fThr(P*<k!p#`O
zfv;*`d3&42(Ymx&|7Ep)12lVGGuy#F<d;uPT!I9UM5*AqL3ce0^O6)1;*O;c&Kjei
zNcj{Wk~hz;&fiG|(ntp7Rz1i@m#tXeEi>_QwDj?-yU))#j|z&GP-v%C?yg#wx008I
zQxQ?}d{PQ)9a&h_ymOIh*`b;M(yiR0WrDxP82T+B2X)V$Xd96vbbauw2zC@LeoTEZ
z@lxJ#4~|%U8WKRfD7xia)B1R$ZxYIom_<wp-h;oF!8Q`9qY*F_8H!RZc}dk~R&=P?
ze&mjWB~)zQA~?V2PE4C^vou#}BL48`_iL+8-~OGpP;~(hi%YmxV(_XhhX}%8I)*5l
znEh>o8f5yXj;DZ_TqOS|i*KGY6+>04VJwM@ceoZVJ>MM9woNLB^+cmcA>+~(z0*sh
z0n1?c;F$q_9Yf4TkS&547R**Rr&6~6pz@G0x{CL>>A!mQiIYMk<mQ?bNz510zH@Q4
zpV@jN#97KIlM7}FJ0G4?a$I~(89#W6c=9y=MX_wG&q?F1A{5XpC)cGG5fvQSWB0f`
z+;3-aKEC8hfM*0S4bQNYuv#p#)loDa41`aTEnR!W7PGu0w&(fxoVPtSB<V-Brks%p
zRvZ<kL1Xg((*a^L`iiZlSH}~^Rs|8`Dk2M<3(m*!VB|Fe#CtGwr}137OveV#P9y6v
zTqq&t(?Dv?mx(BB#Z26>{Lo1i)(E}?D~m5v%!AQ9-|q&~oxTNgLt?G%hMrN?qPd7g
zRShFINr_8T)MYWf7%mO_rL<G3eWHjJx@qEQZR_MFjeml{l?-LAUkcmLbPLebvaWow
zv(-RFh4^_sKI40Pk6}j<K_IE$6OE|K2!J~-SeHL7ddSakgB8KjoxyK>AF6Cvk>2R5
zpPj3Hqa6W9k=eGG!-$z!rspQB?zq;A=*#||tQ?O^%(LT<xrp|XLa1gZ8CKpe%K*9Q
zGzV#u6bGG#XES&sstl1>{LMo?o+9dPA?vb~ji8d+8!x|7EJ6c^^@h)P9a}x%o)Xkg
z%~@Kd39BaEb2hd=!?u>@_$2SqcaP0IduGD$%GG9m7=wkXn-W@~^9x^EW{ur74<yp1
zABHg6Y#jgeCGB=xVNE#SIf>V}u<*9-Nu(q)c2Sw*v-9^GQ}(%mJzh<YPDp;Lt*^}f
z8mBpAqsztj;-o6e@pN6U=M{KPD~ziI$wD8eu4LnWye~1DB{mb>bWGD|UH+KCsfiy5
zO$%rzNYrtfzq=iN@kTQK5hMG_!{e8q>}DW~fP<=2QEws;E)jM`G*5@XqH)E>WB*-?
zzgJ7hD#7#A%+ddh&=ZyU!#36*l#6XFIF)#qSt&?jdu5hB&cPL#qa+M_<$K4X!m3sC
z&Sy+0FXJna_wG&NgclBxbiSH3P5}NSDSbNS^}KjGwp|{tHSV4DOQKw~9#a&^0<Zi?
zGGnh`w4~2Ls=+r9QH*dLD5y3?d>7TS81)8a<o4M~1aS$82p|<>R7)26E7Ck{Hg|*-
z=O;Ay_#{CNf-p1KeXoePi0^wgruB`_uoh~@QOI~b93D{EyP_@HG7lcAc_n=~73_R?
z6I)TZwD{RbL3U8f2a7@*n|AQy<Y#(Hp<a=15cqt}Krlps3i7aiRY3?(=}e69R<Wxd
z9w|KH`1?5w;}E|&=)U@1-%Y5`jUj$zSbVmRE?tC3eX#Oi1;>N)nEt?uYRBRfQy)DP
zTYRxhRj;&W;(SCEeZE!#I6ZTTI3QX9reg5*_HVE%BFvjaQDkcqiq3jgTl0!F>InVe
za`_embu_YM{IsI#T(u`*fTg@j#*3N+>^yWnT>;=dQ{?K2yP*xI=eUaO8oGtT9%nIK
za(<-OgB+mM%TZyLMYi)lwIT>+P)|xkWR#>sq<sQ}`Cu9Koe!6gQd+0#ZQRw}5n?1!
zS^x#Jk9CR+)7LuV)b6H7VDT@pw)zczHmvLa0Q$7RRTsn5_O`^cA~o?b2TCT@eyVF_
z^hqSf!T+wJwQ)n#aT8;fUVBC7P8Gkuwp;$(d-h<JqlJX+Z3aK<oar-@`XlerqPxuF
zDhu3|Niwo?JQWe_`Us-9)0h6-VkiGZA1$OtJ3;2X%!v<v;whj$r$@~W&PVxemB1Sg
zQgO|w8WT@ym{S(tX&h*cX|tfAhK7DJpBVb}8MONZ6Pg!N98J&xJJf<EkWo27vz%fo
zTtolJKEvsKU>4<7@xu;DTV|9nyWq*@>`^emEGeL(mW`saZ&KEa?D!TfQggf&hlqhY
zDnU0X{~Tn$Ev>lazzXw5ic(blP+;gbn^B+p%A_6d)`gseioKUIynSgm=4{0~XA*C#
zmRlZvg<yhLkAgmn3<b54;kZ_Mnc;xTTW<y`rnQ7~Ax6E?RK}hPu<dgbP)WnQ#j1a2
zG8RaQilg;tqMbS8UvHK&w)lII(<Ppc=#4s&!;<?}`s`&KP*J-JzC*ayO{$Ny509fi
z2484952gx>tS8>-!yPqy#Oxi7WIhIv4tnEuW7CyKE+QgGuO%3sEz+C`Z+vOb(6rjb
zqXwdg-JDOjZI0ZXG=9>nTw6RNPiS74YAe$HT;d~UF@Mxe^GVYiTeRPIt#oM~o)f(B
z@L5-vQcICe{X(3pOI+(tjJ&>6hr3LtoAi2ip!c)&&Ec#Y&fQr*Ii*(}9F~?_ngP2#
zCDN{dvn=62MomXWE~OUgOuFE~jH|Mn;C`=ae!-f%z*20tdDqh#6ken^Sm15=+W`38
z=DC&TEg-r{%{KDthnmDu*%Khd1O(7}fq(IFL8D%4AZ?><auxAQ#^ic>79-OauKVG1
z#p`nE6}<JA<mH|IW?sVuaNLhlx+lU*I$b?0b&tSu)ECJ!2@msoilV7r2fH1NQxzq3
zTkwn~HgkaK2WSp$vE8p+@)KmAQ+h|p&2}V`Cv^o=Ibp@0e-3=R{l(xv1Ami~k#h~R
zg{!KPoZHls8tEUozKyeax|2~|DI_p3?lyf=L*zzfDtWr*XK+`#YQ4PBU@UO5`gSo(
zPLdW8l|7#S<n^YcZvPK!^%@goZ8CGlU)`^RVAmvkJv0ZVSMp2Sta4Wx`NkHoLg%q^
zZpZ#^662$mH#74tslim9Ri%7_J{f19lggZ;=~mDSsQ9##OkF;m-L!iNrr+KN3h}sP
zN4~|MdAiv|`+OH~=3p(9=J~GY;K0+(PD8OM37hkr?-A=}1rKJUAOT_)%MFBurng!?
z5M1;@6`w;Agd5+GDnd$I{rX2mc!Ndq2Z7Lr7yOgZTWm6?on`K6P5GS9B^$BZ-1#n>
zss#e4xnAUxDV8{|<XG{wmvOq{yfrtAXQ;+tpPKbypkA9NS?2Tcu(_62wZ<cNot(-C
zunB14(?#O8i7V@DDar}KCEvm5qwfBF#;ILQoyx$XW)R*{c)Qttrq_Yh#Ody*w)U{u
zffQR@>|^Whf@n7wnQp6h@pwZ^JI>_D!=w5srOj3A?rzqM!mg81En=s?ys|v;vbFL4
zfLxU0?@UlW?xzSktKOUQB)FmeqNJ)2SZc8#uK2l2R@K&5#UOqA)`VzPdjc%qfKZT)
zz?hho<ks34RYy%VY9bHVGTt($W?eQ#Y@o*ELVEGN$ijK|UV&13PmgI{Bzadh72R{&
zyX;K$0)q%+92GNT?(_tFwS=lKg%nguzb<kk#-B|_ao|nT3-I9hgoIm}#&63~b+B7N
zaf0veK6rv7<HUyym<Nd<X=pB?f3O73zy4y2bs+k&Y#O-)AACRUT};V7`#Iv|1_5+G
znrNWA?1<j-#1H!92KKe8IhEHi&+k~lf6bj`B=k$$e9@1PwwC^Jd}Qs!BIwjJ98%TT
zK49M7xutQsbaTHwh%!2TnbXROwP7R5m0TGKJCChw#nb1Ts^(U?mV$Xz>e*TxhInbs
zXp?K4uDpgN0P|vwhgLbR=lEbNv$*~#-Xw7+AKvx!`u=C%H>CX&9)e1f5m&{l5n!^w
zFw|o@!8J}d&gE=~_o$J0n*$k00w;uqJ2FO%45(7I)!?bp*7#idR5oXqtDjJ#Dw@Zp
zvT_j`D+h2ht|##T&XPj5U1sV^UwCA6JJ`>yEM5}%ZCASBq?2f*Kds!;P&pV#xae)~
z#|g4!9AiTc!%94i`YvKQ^7j<kF@Cg`vkqs!&QD0KZ`Ue&DKS;MTSIOCbG5*SR)z0B
zK%etC7wDSkQyF3THN!eeFnTZGpah?gWggs1N|Yy80^8PdTx;*=rIYv<D#KVTOijCT
zjNw9)vu{5nR20eMA4aHUB2CIjFy=^IZG#P7=F9hI@);uk83w)ZxHAn?OaUvMJ0Z4a
z;Y#6r9FRBv&ZYmF{45{vlg<&#w45?Ss!jJ>KHA^OX7W!2sbAt%ugCe_Z2(+;DF|la
z4Tj1?66VO8Szs*N3P0b68s|#HMf@ViwPBtd@r#v0`@zGf-Ek>~tl#4ZyyiMewp}zR
zj{~Y1=j5p(+ao*ClK<nz|N9~Q{yY}*GxrBX!B`q1ZI&QDRQn^Hy`>0OpO~6Po0eUS
zd`gh$o?+{AiIjfEW(=<iUjHKVU~-LV4BcpS$Wp??z<Tw+ul&#d$A>BUG5F6Fd0-0h
zNbS`u=BzG$0K*vV&jIYu)+r02u}SBePTd8W{&%R&#BozP16xOh4_r0>-}%W0|A(@-
zfQqu;+Qt=8L6H<m8I_jq5ExWK1O-Goh7jrQnh^nMQ0W{M38|qQM(OTGa_DZR`H#<Y
z&UxSSt#kOk|5_~8z+&CQ+`oPAy{~IudvBU`-NtkKVxLt@qGK@}jj=YmU^Qa3`>QW+
z6=~Uzj{#;S!TPBT-|PA-4obxPQTZmsCa98tU}~agmj05WFD*oc+If_Cbq?2dik3M)
zT=-t8?1K^bu;QsSG$(3EFGYm$q19$Z0du5-lCq<u>2zkG>u%PUW15e|Mt{~p+vo~U
zZxGf&GibrPZ3TMNK|LtA##`ZwHz<<_p7OD3+~#D!iS&z2fU;M<!MhJ#6DA{r6m<Kk
z9csPR0^JUDh#b<C)4bJyJBL~7l-whsD*5cO<Y;$ytN+_NX#PK!|HnFLN#cp7JczLJ
z@oP1-ong_wc0_5a%Ui*nc=qmmwG8kWw_C|MOy_!sx$ub#2g~&(R};>dOFX&gjTUJ6
zVP!hpcP5s;>%uL~C!}B0pT~ah9kMzZI7O)#CV=znD#q5w-?}fiUs5Z0zp>USzznFQ
z`6%o_QhylTHkxz2O(;{&f4?tQuP7?(?o*@o!{lSCST`P2R{e!1(@k38#4wak*auxv
zeLNroKh`e}^z7IE@YJ!^nTOUWXkU?QJi=u9huir5UlQWl3MMa};gOVv=0Z)a_vPf$
zH(HbrEQD5e)WGf2|DsU-!;3HR@@73G8!5wbQfG=d5yJVvz7+}UqVo&6NVeYJ4hG+P
z5H?Nqw)FCWDH)iVEgr<HL;S|yI%%=v;erg%f#g@KPNx5GgeqtRh0~~g)^ow#8|3}-
z*wf#>RX%Y%@EL2JSBqyXxXV<dN9J+|(R*)t?1P{xlhrg^|Bc%Lmwt-g0r*!wO!j1O
zxgAFzPpcKT>ki(#&)X}P_Me`@zg>&yV|fGiH8~ihUFvy~WwC*&;V6hFDZ^{9Q_<XZ
zBE|EBDp@$(wIwMytfmm34Lma=vluJx`VsBYegCn()%4iJ6jmts!c%!p>aGLXcEFV<
z0~+t}C2svlCI*Qu$fxnAdUjKLQdx^}P$&t@lEmPDhsu%Gx4wcdz3K>kigI(&TXNlg
z=_1<n13M>7WH0_#y#C+L@?Wn5m58SS4<|n3=`Bw4@%o(t0ST&oC%T(m?k@SN@hed(
zKNSbFdq3TTSJ*Ly>8a&>mmcYq<Q-5>c`CK83q}noV`a{XnX?v01mV?D&kC_^#Q)*c
zfByB$FP8&PL%S=#1FJ%}#c<^xL3R9nwfN~>9lpWg&TgY%qr24h?7Po{vtwMo6184g
zebf4ju0@vz%#OUF!Ezl`bS(!YCB|ti&o4jGqh5bVGjYM;n-XOcPwSFoxvkb&%HrbM
z^7Wk7p^CT!sV|MsA!AsNx0ziL-?*>1-<N!*mmshDpqsua8GBVJ{2*bmMRIzb(}_jd
z!n#AZ^k7IYu&<+SHx*?waHLh8^52aiS>BjvhbK6j=Xq9PF2t7e>XJ%Jx*nR-ZA7L^
z{qAghP}ydw-jD&em!4uIYjZ)c`Pf0WTD^iHHvXLm-HWvLg<PTZ4c*^*YL-}!g}B%@
zWsf!oDfk)XwX6#)<ckVXTs)ourXtOY=JCys^0a~37EoK;C`|H6Q?XHeIPASoMbB=e
z!Vt+V<bldp?-sLKGLPb9aUgUiya+b`tS-a=N}cy3QGRlfiM%DP_zrCUGW^g_@x1U8
zAcHmzJfmZG9zmIwwwc<{I)(klM(&mavWO=!rFOE(D)dezwxCzfC~F`7&;>$;hf{cj
zxAYOBrv3jJDG9;yUtfc_19eV1gbDGdGWSH?rqqZT&5d&B0tR%gcfN?5xOBqJwG&Uu
zHl!oOcDni1iQ0))HSU-CQgL^y!a`9JNXnppkB{|%cG`c4ng2)x<ew7lP$X=<#L>LC
zeXFA5c!1t8mAkf+wJ$+hsnML;VC>@~Zh8LE;da|ue|7<ixU3AlbPtUI-8&t&mdutM
zxn08COSZfo-HI9&VsXH_>`ACk4~fR)f3^3Y#EewdkUS$1G^@0w(<ZcURT;FBM_=IM
z#!6`pd;Nz0#--$7Gw$xg>{#KzN>}gvQ(+6yTD`)s+6pu3U@`9LO13n;D@%{T=-iml
zdmZKxk+9W-H7jNWt;8LNfQ-M8!$j^n>Tjb|BPId_91kgUF5Uj0oBH?N9sDGZxnX9L
zl%DNW#-)R1tz+G>eJYSZ&dsOA_|TU_iFf)tL^x4$7__0qzfsy98@nX*!L>MTNw*g!
zzG7umX7FAxgSeAsvG6-%5JjApM)cR>NKGaS?U=SVNRmr*J(8Ohs_WV*rLBW)?dB1j
zKaY8uT21?L4VJ`t=%x(tq)`CmbLQ9oaxg#7MFUT1o7W@geOa6NQs3~G46D~4YgN1m
zud$7Mp|TbaR>_dtY;8GoQN+;zrbRQcQER5@#}j&mtqF1w0y#1jx>1)DwbDL+eD^db
zlJ#D55jKT5$K`pR%1CbbLk=sf*d0JymT_~*;mG(auoJ`OR~MN`9I?SLz@oQ!9a{S`
zf5U?vn97TO=pw~>E$fGl+EM}I@)wcIl5CU1{4R+?$3uyLLw515c$qs|DPaBxxptfP
z5nny~k)C1@GP8d%E&oEd|MMa+heS;cS6+XjTcIPWO}<g6&FHMnE`7gysZ-(2=s{Mj
z=O%OET=t7!M=tS}j88K>%`YdEVI}PbZgu;ByN$a5q5o5-_z&jyg_~%YkCPTxo`{dg
z%-_nZv*v#&L2MEw5+r!-Ia$t&Uls29O9ZIIO>R*tb4@Dcd%Wk;KBaWKb7vBGMXP?=
zT-U%-4Zh^Os*$dzRw{Y%dod7M$I#cYN16>W32l5dxTnfwkVC$?o{6;k#ACIzENxZD
z0hp%e8KG~F3vxN`QAb&5F~S;r$WS6Ch%iGTMmLLh{FKUfiGPYFi_m=hQW!bPw$CoU
zQ%hk{Ly20$l}Z`kbI{AI|0~{$C*y7Zm&^E<@A!wAiw3GFok!`$Z^5j~tbf$v4YDum
zYJbZj23>om-_8kiP0%MQ@n=76zi)Gsq(4F>rAzQ}cvA)UHK}D)xPqy|vJy(H_$e6p
znt!<b0!J^Z`Xv#suM3HKJf@7z90sP1fl_Yz+G;{99lIzE+*<UBisCKV5$1=H7KICW
zz4YBkSB}i~g@QWQ)|}_S6&c{nGt=(a$pXC!p4`I)T^?Z51-|z(jdh58IXX+UCvy}i
zmSljo$^-y6hhNvuHKZ$OGg=xXM7}Q!BwM&gAIf|7weU?;oWKDaksUJ*DdMv<tbX@b
zbutio1?+>@E9xzE{A2zc7nwgN$unqS0kAz;HXHJ}d<t8;u9{NXt6JyCTcxjQIu^n$
zU)s-gvhs`4H6=aR6zvN9Y|+}Xte)aRPvjy5ViAyP6NpeXKGJRY4I~U&A~8Ffx*#1O
zCF0wN6=K25euYq1f5lH_g22O|A*1a2P3E*FvgC&ck)!sXg_56M;rb^kOVn;EYoPd*
z=#owaz8WUJ^f9RHP|Hf@y5-ox;!lIFdGTh@i@$S?|M>k&y1dnK$J{tD8zxL4szcgp
z6xqFzU+}Or<TACZ2Nlv;W6fxrlS@T3(HGom%a|LU7wg$A%uz(Y+<C<Mz>6L3inRal
z=4VPIM(RIQb-qmif5K}9XuHrY-W$!-)>NjJB$btFJFT5P$cME{BLk29gN>t9Y<VqR
zPhaEdr!UN6PDqan<{;t|GDpIf(W&_G;)ghGH$}G<4cR+0#8a<3n*{ZmdHcv-8Cy+X
zt2kRJ@TKxzX*s2OPI52dU~y0~dZ?8iMqjGe1+A|B45h!=&=Tc&2(jTUAyO?XTUhp6
z=cWG`DR$+pVz^to_|C@fT6b;i`(br?YUk2JW#Sy;F6&$nk$|Nd?qNYAFED^_&B<`(
z1>*(Q^^SCubFj&h*kF|{3({V@iY}-yI@Z-UDW>*w`MBP#|Ba6>mfM+s?)evoBWs%2
zja*~!G3f(Kv|xDa^3Y>w%x<r`+{Kq?CtN<*{l!N7un<G&!Zh89`f6BagbKu=fVSzm
zkd8<{Sx!cof_}n}5ty_k`RV!CA8?-|*WZeeH|pPNr7~T44GciK=`<xC={jMkST9DJ
za+i-)Ha^8mp$qX-azLAcVRh}KD#qFAsF>gM?`*UMam=U?M3yJftDIYAx=p3Y)5l*V
z+ebnvnov{)2`&{DVLf^*adJy8j_eTki!)29KcLfK43M31nut$XOOopm8|<&`cJAb(
zbIg8kN7+QuW-z4s$fIAH4cVR((OE#+1pt_<^0p^QwswSy1R%M<yg3aST?2X--oJQi
zE_;UivRc!eYXn?NIG<zf3hmYBpaj~hX2u`i55gW3Yd&h`6~D(4^(!_gm{9tTco#*n
zBaGF%n!c8M>wfZNcbvL`%Z8ma9Pp6N=AyetAOZ-GBj}siX)0d-GvF2hsasT9T%n7+
z-*2AIpin<e`PK%Zme#5t_>JOHa{E#cOy}wdKWmIRbx@hP?Qll_o@{W)l+^{ehJ)l;
z!Se65lL1NPjj~?toA!}tyOpvda>m+cYCF;+#d1Vi9GZ^E&y-Y2WANiOxhS*3X)&ov
zp_fu@Tw7}OXz4WIhms4zK(ah{VE<-pV-e)eQP#w_Hdk5NxP^ji%+@1{BQFUI8&OgF
z@~>w(*MAK`F@v0DNqU=FMw>`yE(kxls!_}=cTBrP!n~o<yS@va|G_YM%+r;>G7^(9
z;7wFE%#{$<p3A22zw`(%OBW)oA*qX(a$QXFbhttl*%klVijg671;ypYMWCw$faoyj
z8uXoos6XTCSt3<<0{kC|@P7g^qW1>z8npz#eEP952Xg07bs}480yHz5f7O6dKPB>G
z!PECet;XRcqeA?z-+BK`kCH^1BW>GY#GuRFh=qbNLeiJJ`u%3-)pcK#jV^fU|Hc9k
z5>oemqiO<FD$}Fgx`ivxg9~4;(A|Kg!uxwg^fg5--|-V)CnbOx6$OSCx;XexE}<r2
ze|lvm+;ShnnrsL8P+X3Yrvz0qX)FTV@d0mM=-l#DzXXJoxGUPk6NEH7-{oa&l4(@W
z-#DgnqJCthxoYUh-r+IeSs^d5c2V$7&?uB{inmF!j)YP>uYR)`p~s4T5Wz(-MgE9_
zllvc*BJ+xC_}0!?noTP%un<ud)6c^|gqTVwfeBPk7~<d2cF-o`izca8<b1#UOCwW?
zjVLRahucDkJ%=B3qEfr6W)yYMnpLC&t_s&sJLKj-s2=%IEI#YJ$VC2TIbIuB!q%Z;
zhgs$3!%j1{J0L1^H!b71B*`>Te5+aiv0W7PWwj+fhj?1`I8!pj53O;%X+abZQ0U+*
zze~*&)+Ou$l=+i5^}%31UM~mot>Cl*&&`(@`4q?wC11%EAjAfnL&h(1SF<yO1KFk@
zerPq3J$|uNWNssjRQau)l1$QYa>%3HgKD%?_-=baPHg?`3+}7y><`Gd@Na>q$#@0}
zRS|YNpYOG=I`VYYo)j>;a$fBWF__jXN`o!0n7LNaM3$3pqPmy<@LaviqWT<)M$y?X
zYe^!i-X1Df-^Pd#a-AC&xI1~)KWNZS38Ij@{Q^hGb=C`*X)T6psh$xDe&g-G^hM2Y
zR{+HKwVm#A@)b~j#bWOF)>nqSIo_?y8ud#yG8VUKfJ<hUsDlyY@;}Se|0nSJJ1^Bx
zBG{g@2-?DF3tF@aGZJ62b2KUpeyyM#Y?{)|81ybuFA|`XQP!&0ZyQ&`J3pCl_%YU-
zIxPX@&>JG`681~z9!v6}+xTODG($%%v^py6HU|}xxcwxXu$KDBzb9Cx$Lm8M{+Sn_
zyZzxn*3hi=tY1{V8Gd{G9P&LwIKVn>{d@8>SC*!2Ag>2HPvlxp2UVIU`Jr3R3q;p|
zH+lH4c%im2?0#E(=xKz??;_DwqRaH(*%-fEQhV<*DwZismsgr@Gx8>x?Zd$90}VBl
z9j{!4*)pe`#gX_SO%O7jAccyuAjADKRFXFvE-kg_cqtusqV{i@nW-?lp!fbl*Kv2i
z)Zce4j`Z@eGFbpsz$=eqWwko)Z-Pqj<Ciw^KUl%PlEleTU#zGNr8%rnZ3Kh~I4n>X
z${T?h`GA+6M`|1O)5ay|U*iY~>L*^fC#h6V^olT#82eG6G(6#EUHpdC=k6fD&i`L%
zMjBz6-}uj20B!5}!}<lH3;EC8pTxI)3h&HAC<Aszr8IJFwD$d(EmPVxax?Vgvw4C2
zT$_Zw(M>!kg!2W~_l{IlQNC{F`!~oqA?MZdxT{Uqr?~RrUZl%g%69op>bJCNs@d$j
zwh02@2tuD+?BkdI-z#X8XPybZY&wpMe7Zxx#tGRY5iKcK=FRbwZ!UPU1Oq=1e~<iT
zSVpg7kmdf2?;|_qAA~lnl%4I$@v_)$Nm=bLe1`7)C5c|i#g=kM>(0r1z%syGT8rqT
zYlY<L!m`MTOc{GqNS|rEC38qs;LQoHAVkc?C(F>Yj#bf2ao&O14J<g%h)M0=Ycl_$
z8UK1=o%-`n=Eu{0qI+yoF=_-U8h%&saOl&`Hu`&(3{Y&R_FK}QhY6FaWDfa-$rVBj
z99%<5;%)ar{Wp?GqQZW2!P`AL_d>fBeJ}9!fp1Aihk;w0u|j$1uz4-CRXLi+?Xf!F
zCajl_;fbB2r0SQ1vcfk;YG9WrTIK|XrwpL}))9JtZQYp3*BiO%YgSC8YA7l{+DOlp
z*DP4um5z&f#v)2<9Z3A!sW^1*>MPar-Xnyvaq7c~w4}Ja=UHk6u9_dkK3--fMtoe6
zi%*DhIb_dNFpbUvKseNm&_7s_caGNFehLf#3KFEo`v?ry&x?+7o%r%boX1HAeR=M&
zx~q5^kS>5*B+*A@BDzhS=SE?j;8m`1hU_L8`X~Hxag=JHU1irO?_?~u2>H`{{Hr|(
z_FSZ*%MUwzL=uJ*=)`c}{$h6f3p-Azy#>yBtiB{Z3Y<CWQAhKn7P#wXSd1iH)?x>L
zN_`=G&CU9f<+POGXRga0?PcA%iD&mGg=0jTVV8!Km<e$eycxCjrBGUqS&s)bql7H@
zFD%esDM>uddK7+g2AzAXy&Bm5FfiFpQ_9#wo4ra<{z)-E5rBL%JrYOE9^U?HAXe`M
zLX_%c=%s%9ciJFkAF#r5@v<&C^xvG!{{aHOa0CiWpF%Tk6JUXnDrCnwL-Da55g$<@
z+1IMX9~tyM3?O!0f3#FsY)Pb$N_4hbe`Yt}>Ba1aTp)N1Gq9R!Wx^p38UYSzXTxoa
zt&5rSJIvGWrQMjKyQZ3)o$@$;OKs-eX_LRU01?c8Qtk=q<?q6B%#680sq_e1);m0?
zqf?zj8bWdPKSz+i9C{zMwIW1ef)K3Yu-1jW47U<QJf;a8oOl+i1hb&SfV|Y1rUshy
z84<q@KI~@&55vx}>OywZ50GVL(n>CD1?y1Ipki^Mqd*f+S4YYBq`x^Hkeo1rBqT=S
zANKTUn+uRr8%wEHtSkv#?Qb(At#Dv*SQ5fj^u)?N{;me#_>?Roy*@IOf$Fll@bYzk
zF8{HZJL8o!2ZGWF^9|p{JftPG0duHq*5z)uZBO}Cp_Ry0AnbwG&h7n$ha22wj_exk
zNbzP4>+#8uBq~hb%%y<zcTc$DHywcHY!^D%QO<XA+_ImAm7!z6nKe!aZS;@LVVx|)
zw4qN-R|Jc0<Um>B&i<n><-05HZ+A=F(Mn^v-QkVi|0Mx5uN02)By(Ztu^3jC=`UK2
z-Mzr!T&Cgr18Wru&{-8DbHl(R?66hswP`6`2J+gK=Azfmx0>m`>hbv6<o4@_63<V*
zrt%THk3u}P4{t+K6T}M6ITV1l*tYm;5yEJo3-8}6q7Xvu(ds#7`8VCk0O5R^BC5KL
zHVVqV-7CELiV`grcF$Hhx$RnOkPy=4qXxKCkLu&WSK|+Wf_F#Qiu=SghCYWXJp2JK
z*3O=;Jm9<F?#Y+`#e-^y_L__URS&biuA=P<J?$6Fg<ACqG@`XGQ!}qax=oxUkH+!k
zOCx&z`(yd0)0VB8YUUa`YA@<WP>rD_f*5<ES#{H&?=G8lbE8UQfX7;DR5_`(`Mc_$
z71Le2F9)Wd6ly{mUE*G0M6X=;+;aDem=YZ!Bg3Ir1Wsn99j<R>5&Ld}H-Gf3$l*Yh
zcpN5_u!=LsPyoi+1TSntg79+7^Y4`A<CJhdg(}%H+(tBzj^pEbfw=Coo+HtJ2A{kK
z_liEdK_`F+=IkC}UA~gObM7_ihlyT;c`qyfKs^$*6ouMF)h7x@I_JYsjNpe-+ll4T
zcF7e29VxQ2xn+;1Z$5>;G|fcaAvqG*uOv^Z9c%_sw7ku%d|J;`r?jwkF7d#AKkJ3o
zN3n7I%gOUEtaW!vey#IW&B@u<w-kFc5>#AwC!gL8<Ln7=%Xa6j$3~d_g7Lkg8hjM@
z8Db#NbeKrUhCYh=BRwC5rhMr8ouZK-B-^%K0XJc8l0K73kO?RiByd35O+d69UlsCI
zqwrW;Q|X&zFq%Pn8SiTkHEU0it~eX};CrTpFE8nJoxgF^`v~ISA`c(u#E<ogW6~G%
z5HCp~GArAH9qFJ9Bu(BYA*<25FgjJ<N_$B(QcH_t_p1Z=u$*56c7`i*k$NG~hf1hz
zW>_<tt~md`oeWX8HCEP#cs0yTbnDx15jJ8rNAi!a%sXrqp5cCO*@{&4`vOV)cKkF%
ziuo|ThY2gqqCp%P6Z?q*gIE4RQZGQ#<gHGW@k5`+!>>t~o(!0Sj}2CTr9b5OrF%<q
zFefs{nC@{(<Y2N4eb@0lNwgaP&9+Ug8W5p+7eKx;&}J6iQ(AxWS4lH2_EuB@Cj}7Q
zDmd#tqRa1_sBd-iI`(v3a4{~H$ALfjXX`yd>-`1i!LJ<zDKm(tu%dg@EV9UpBsZ$z
z9&baZx$(<^&6%mJyf#^&5E+$kNP<oV{SOX<m_7W0vRVCIuUkB@y0<Ixh4$@taOfqo
zQ>j(^_DXK3vFEuZ(!d{)Z~bVm&MIjyX*bi(C8lrm2pTdrt|t*Cxv=kyRj~?TuwowX
z-6xkbZUpFpwq_Qmax+ODIhMP4<0^HfTlb<rq-%P?P1HpCL<yIMQ|lE;36XsY_ymJk
zn1A1NjZrZxZkxa;x$Slj_=9Q)&EE(|f}B2SXZXx>vP8exU2N{nmfE0FLytLs_4s46
zoT)@EHy7wXqpLiCAQRD$!X3z{tV5|Ris8>eA&$jx9qa0V@%mRUf?U{0l=R;hDHyyb
zIJ&#XUF*u12!N1QOVDOS4~-;~M6lghBPu)PZddOZE$#KjR@@3%EsT7*W@7a2cJAA>
zN#ac3rBdes;4Yb=L%kbv<N&U^Q9ZYtyI2-EaPu6uhoSM4?zbWe|EU6z;qVuAG<pcD
z?e}U{hcxLT+xTZZ!u#n!{wy)l*q{7u)|UGvDORNQ+fC}owOOwU;lcro91`Z&Y?GTl
zcqk(=X<fd*A9NNXVFD>yDW&m~2c_EK%LSL-wKVVVc;4s$_<8p{tMdi+GXY;TpTPtS
z`t#~d1Zvb{u{$u1=@tIQZHX)2*x+%Px)(Rx_?qS<Qr*0;z3Q81i>S5qA%|)c*16fl
z&cJ`wQP5<8r|Kdvt)Y}?)>KyIrs0z3kf?ysAwHq@WlQuiuh>SxF(OnmQK=xL6#3O}
z6;(+uA)f1hj7aMEs?Ny0Vh(Ufc=LlAzTC|3KsHP)c6qv%GD?m;F;BIg<AuKby490W
zsW8Id#@<Aj$BV!PA9KYZm=x^E84yQx(*c=eBvCRu>Wkk;1}G+sJXEG9Jipd39w99#
zRCVR%u{S^51=lGj+wJ<agaW{n#SPod&O2jC*-d*zaLr_&ME#bOTwLvwaLMc2XOV&g
z`SC-C+mixbBYai2?23<O1-&~z?)PfNh616^?%tRpiMV+s;GA$Fd@&~wX95jCcRBY`
zU1xvn8%>x94LWb9UPQzKU-D4H!+=Cq_!afVDnrM-2=%M;ZHamh{SQ!Ui-v@?yK_F6
zzWw^A6eRv+hcolD_X3X3wm;<tZxz?dL|axa?fUHkYT6GF9ieXL=p^TsO5N-x1YSni
z$Y&#D@zMOeV6W_+|6+It3uy<7k29e)phfWf{mqcOkkiPL`Anc{lmC<j4A*i+ldFC!
z#&Gyyr>_gom9pm7TIzRWFe9DL>yI%yI&-Db*Lm)qq2SQBnGS8fh3hK@68M9CLBZmR
zfOWjz$QduiU>>Lmh+O1YEO6_KYf`qIaht!=(s<s$^ZPE$C1Gs*`TW2Jq9dQs;#BEQ
zA%kCk+T{Vmk>5D4IU0|kl=k}lmf+{BL6d&58PsW1*IB6e>(?7f`c4U}E9Sh;_BVM1
zcoh4NFy}rnTMV_%kc;|Zsm(6*6GTc#=2$*WqiwSby3^#P=U&RbB#ZQvJl`HEFlTXV
z1~mg95C!^^;hTXFJ+C>-fj=!I!B$Y8eAfZ(TVV;pZ@0hJY_VWItiUT@t<&jJyMi)Z
zmrBhD{*D5Un<ceT4f?cZk~wF(XcanEF|&7kB*=^ZEqF$A?)=7E8qeFg8u@Kz_tV(6
zOXUI+49@uS(FXE4q_MQutXlGIZB1J{VcZ&ZKW58j5p4%kyFbN(u&Up=dncw>E*$t&
z*9cwhZS)bH+6e9|8mis4O7KfT@ii?An;~9Qlh06`Yu@M>Scw&%d!Y7c)_udz+4W6_
z$5HvzX22^uusuWBM&eA!*aX%yS-KecCS>aeC+_Q}hgDFtxH`su9=sKO;CF^88R3WL
zNlnOr8}~w11IAY9KHRb}Le6{7j%gG5PT}I$^0dLnpRTv$7r-*=kgq$)fitYUO|8O<
z<pXk&PTR9A{nEH)q=8h^6*wYBPIS9={@2~z4jE;J0xaeX(N}$|ey2j4{*kAeB~n0{
znVO~MJkz-+dLl<$?g@n8s6Paqp2L3*I8B``2v`~42BRV~;s8OloZdT9JIja>J857K
zq9gWZ55#Sy<VbzGYUT%9u_jlO$!L8CeK#kCsiYOw$B*DjmbT9N62k0Lj?-B21lhG&
z<Y@br<AKRzcV2_3v+B96He0(wn)&!y?%B`=6Xt^%+{oT9-?J3gvR4pqf03m5AA}tW
zdh#Fr_hyF@P~+$fgHvD4)9L*50>YY^zS=}w(U(%`BxBvFv*3ehbV5+M$)1l$)*TRP
z^~?*8etqiq(qb#a??{f<kMC{Mi3tYPi0;m#<ADRm@t#;e^O2&ZT-$4H5<&O`@Pvp-
zv&%Ws>n`M`3t$zJHde1pKcmeg-to#TWlSmft4J?RI~eKfy&jX*l9sjm(##5Kl~8hQ
zi}~>QsTG9<&|CJm7vi$nF%v~@(@9l>sEo(?hS|`H7ukTUzlrxzf?xAPpyYiS%;1#S
zqGi?1E1|uNCf?Z3`wKhDo*oe_PX7QoaeRN*{c9b$1Cu=yvLS~ZqD`Yi64{VpLe+_*
zF|It=_$14NI<DMZy?rCrz5kFMKHU`x^f+|W=y*MFRDIG4bA5G%FgIVAXf;sf`*)=I
zAsyMY)czj{PoSn6dSxKR)1TWSiXh=}-~d`2VMiSZBop4{vE+;pUSvOxODDqv4Q&Y~
zr5RR^qlo@CzLJFHBbz_QY(O!4ZLv{D6yoh2Y@sh78Pl@se7%pq6AfuccHqxFF)EXu
zN4J`J1mL$%r_Lq1qO~=doTOzUh#rMFh#LZ<BA*ZjxI4w6DZ?i8{2KQ=pPq42*)0Fy
z`~cmPdO*e~T9f=Byvt5uaSh-#dk0*$LeY{%AxlZ=iMpPgUU-V$a3pyrl2c0JqYgxQ
zPrAnKeQ2Rz_!Qju^=a;l0DpJaZ0!jWxRmMMe)*0B#g*%~ZZJ6xbCB(StV(&CkDoks
zAL*k!qOhf}ZuxF;<;mSA17{MGdBctUUgH!LRgvil?Rs1mCq=Znx6&L?actf@H7D&t
zt5*VJkv)WFme`|NuiuQdklZq59*j+y)%KM$oJff-Cx*Iw+OwdOJP>?-g@R&RAhHy;
zH98fPn-i?N9R5P6E&iY{#OIq}jr*h%%(#WH5#{r=UBKd9rB<)qXv`i)+0}-|CPw}J
zp-!4VVJpxfsTsV+)^&Vp^%=z*i~4Y{IWW(59U@WX=R{*Zl8_R)naZ`!iR?m<m@IHy
z)45ZJ1cmslt6{Bne{?d=I*u={rvB-2UqIRKLmmYe?-ee|CMvMsg1|@`VT)7O+r>Ry
z<J8?2+)@W#xm`j-e8zd!`REoTcIiZbr<Uv9LKsi;&i&AHxr1evVu{2?=IghZnXBfu
zudA5O-^T~ZIo!U9%ESB$y~|`0;PHCWChbLYAS?LO+=BeF^(nf5W5Ogw%8|Q#RJcc%
z92Ji%%mjA>5IBD)-;7T`tA-!ieV3q(k=^`Q(szgHJLW|9Iv~XanA)iRHVPOTR)YEj
zB>czNik68x2BO<3CWKRomGOs2Zs*ZlacXvk<4s!tp~hJY)i@pCjmWl%T&JR%=Xqkf
z#;j{)dsmO%!shi6OhonP_A`R!d&VsWTVRQj0q*g2@bi}*P5UL~+TZB0M*c_dV_V9L
z1`M5=KAF&&b=wW@9#m5C93oD#y@7W|;!C?zoPlfRf-ZQMvz^6I%}YrEBCh`DxbyE4
zmfcHB18EVcJu(x!T!-_<VNdmdM{QGU=bk#q)HMSbo#h$*S^s^_{YIfC(wdz+Kr%Yq
z4orLEXL>S|&YlVP%kM*fdAp42d1k!lZYQDf>YQXhU^gXKbx-7woJCla7v9`$7HeD;
zeKdcsaksRHgt;56KI+%V<>$}`D<3!VVJ+Tv3i0=!8c@&LQ^~^1P*^t3O{BW*rp?d$
z2G}0^@dKbqnC1YzQ-faYCT<t879$Z?N~>!kYhO0C@7xJHBY)&ruj0+y^nvh;akFQb
z`De&`yc6h|LMo?r&vr`RiQnr{`=eK^f>qV^xx=dq{LhhsZ|Y#d+&Sseqzx3aK58{c
z^`1~VXbo@4NwEFkpnl7HReP4*#zo!55Ke(eI3Sm7gu;-EEc29SaoSCsOafHnk$kqr
z^kHh%;PF#`@qZ#u>ra;;Rtj;&T+y$VG&IlSYkKJabKNQRy<js>GcSSpr6-VSHS*I5
z@5-k|uK}YM2|Ap1^M^D~ugjtI{9kv3x)Mq$p@Q_Bz<P8<<j9<h)~)1+MXn*2crx@(
zJmzJ+uFmb4DI!vGp|5?o49epvbHu}*&=n-fVHe;wS7)TG@a(@`M?6$2%qv%mUD_B9
zIMtABE9rijK0J$54k<0UP%xujn}p}~WQBCa(ns1%|D~aQQzM3+=Us&4;UQW0xhRyb
zZC4$b@e%)Z(c&ke$sNS#vg87f49Lx{A#~~5Q{P?1ZW<+6CmDG=8kk{r*S(r|s*M1;
z)L#BblQt<H(TKEKoe13y+K|G`)vf~)gTk8HuK@{GZQOUd^#UM4(Je(1#%Vea%b!#J
z`n2^~Y%>Y4b~eX!cNepkL3;q{<LaKLnu-OSYu<h#ev>X;LbyR@vrTmQpo1l*5JuXd
zKNxjiC*v>|_<c-iXYYY0z2`JYfRxU}#Z3~M2mD}_34W07-YnE*mEi;th(N}MZ~`Er
z;Ytmq@8qj~OX!kCwuWx{ixs~C^2}v5bp68W{m}2}e5BYQV3igS^YbC6&Mhc<4Iy14
zZr&bo*g`QSK>7v%-hXVMBB$Hn6&^b{kg|96Y<CR`q4GT6*x!fw?Y-PNQ))s5yga-)
z0OY|j3-0#MINlhL#klL4t&FL597ZNdSW&t!ly;%*K2R)q3WPnWxUb{}ijD+IcquO0
ztZ<P?_~GupYrRIS9_)E{2ab%hYlLcp@p^6D0}?WVa%RpWw<dyzoZxpqkg=rh3J}-8
z{5^I@=X(PV5y<u-7&+c}>{r?qdf1~vcOa@2Sw{n$-S@#R|I|(b-EMC^JUr-&KE7FY
zemfBAv%59x$-<&rIiG356XEva@(f%QEeAfG%C)(AccM36O9!^~D<gV0S0=XmI<xC*
z$)!nP=n;RdcvLi0Ly{BxIneKJ>DKS^X%jd>c2u+AS8#o21zU5vgv&#wGnM9_;CedF
zkBVoO1`rh+nOPao5j#Y{1eYUAmI-Pl$waMSx~EDo|IAm@Gq#9E7ua;%3?H$5wyUBe
zk7qSe<}2`m-40+1fNV9IIKu-N=Yv;zjr4qeugeAPa6`}mbzVLJi*eL4Y>DbG<8hgJ
zgzKD6r-H1CYO4;bpG<j(p)*A{2i8)O?E0kkU>*>!)iWbdEk$jWFRZPv>GWtCRqdvf
zqi(-H{mbrzkX$BM6r^QQ?d9L&d%cQ5$2PA|0B-CxoXY!;_z+ma`hifdd0*aMp}oxw
ztJOU#CrT5@V%2N#Nl03Yy9l2iEv^fa!8qr)6~2$MayX9#AE0s<OZ{G|ot!ruy*99s
zY2l63iFWyyUiynAk@d%6X-os2VXfOA<pz~<OZ=;3e77oU@Tv~8`F-5p;GFy=?g8Xy
zVuGYs%p`n8-Pj?@irMOv=q(vS3K2_~%b&c7YU2V}5GX)ttLVtK=fwik3IVD1aWt2S
zublF~@hFZ8ecxcB_bYs%wZqP^G$o5mOcA?&x&>=AU}y(6l4#SP_d4FKj?-hip@#r6
zCJ`vHq%KNlS0)-oOF6u852e~0i}om$2Om$rWoLk+Gc5XH!Lnyk_xhqC-jmX%-CR1|
zlPph8AK%7!cWQ`?b2%2#+o$cTVI?t)c92JoszMw$GGkxMq0=x)rB6uYHF~49Wwl<k
z^(Z}i@>m}t7b9%Q93{EF?|g98>bjgXy8bC7!)SAs&VRd>0f7mBr~USkeWNCILyR1L
zl*=BZMMY%=Met}IXK-TCALq4i?Eyj>rIt>BnBF*A5OYPeVuG9BN=eN_{~iZVHJ*Md
z6a9@SWV#`1j+VNJ$K(ke=6liQNzXSilE5mNJj*chLKYK|;s$&TE-*UGv$pYcv&ToQ
zE!CrHD(;!S6R#6<?;Sv*SE~@G(q+d8WX?~I#X^ynH_F>;OS)a)Ab<{S9Bqppp{YTv
zr122uw_7|-bpOm|#VTQsoo67)c(;dEAJzuFqVokOfyYX?K}*_*o$jo7Hg`c@j2+j}
zz|Q+5<~r-+tovnqPx<|Y&8tD%NjmQjm8glBoH*k3v-VhF5+o1GD3)+B_hQBBprRbW
z^OLB!mKqm}7Q!$x8W4Qi1eyXo({Hl8T;Msy|L*$NgH;6)Y<w;i4{Geu5eBiz!ygWH
zos?`qt!|mkq3%Q(>iwpwV@&ejyIlpy7Yi+$i1a<9C)1b8V1gy}ygAE4Q|hJF>M{mE
z>W@x{0*%hD94%|f?!|x~fep-0D-3Gp_C|dPIRUI_Nn_7w&+ADMoVFVbW(-g#FrH~3
ztLZIct*O1*CRc!Kqb1=fYdAe>pEf**<FA#aoex_Xp)D(8KHTU(8r)dBG14yz(enrr
zsODysn-RNz2)1kzYnF+0q?E%PBjT$di)ULk6a_G=W=;#l9ScyC4g@=dIiOK+fQ`*c
zIdusC9drY`qAvNe!cB*GhS-7O%Eh4e%_Ou1Zx7uInh^o3{-`8;*Q2_M73sHyInw8^
z?HZ2NS9CL6DqL27(m!RgS`F(`Mu<U2^>OolGxx5!Ez@XGUQ<b5F;Y_i(kOgsi@yzw
zk`6#E6UX_twk{8(1SQvLtnz};qDr;<V<7K}DYbi4rWA9EbcPKP*LaX~F@UZPxr}`q
z#q}>S$krQ(Z>7`m+A22%&?ouVSN9K)ghW}?zVw7#<@+qcYDOUt5&0AEw$;u@<2!tf
zf`$4NxE@xbjMb}FsL>iIY)q|?q$qwgPaO!B`xfrO&R?KE6|o5XG?DERJ8PiRe&c>Y
zO~`e?N<ztO9z2=C<+yPu3t<AUZ-wv!$pjja{;rEndTeuag=C3+)O$CpY=3gx-i-{L
zI;A>3l67o139x)!a}ONlI}kt~fuYz-Zp960?wcy^n_b_VxK9i?$PmX!@{o)43Tj;k
zGENF4AX!hR*&VKz4aHX9@Y}`}bc4S#j)qOiVa~;O8v|@=HqZqll&8;&t$JfIsdkS=
zmk|S284$~aM}GZ>Ig$2(SLw(l=8<O=FO(Zg?b-JyK5^#C>QXI{M;VgJ(CNC~CokR9
z*uEX-Rz3lZ-PjfOlbQFyyx52iHMiFxmGFb!?#S=oBCi^J5Sf!;Z@VTIrCpEhopYIq
zwo!Mlsx!Np(pQaEL9+$<+hwGo<i;754YM#m#%naQO!8z*HF4NNzM8=Y8zaOdf%H(`
zg%^Bi$}fhC6JZI5i5akS4DDh?xqynHqVvGvs<wy=Q=>`iO>R}gjRKUfrfclMHPxbt
zp65Rc2e%uC*D*60FgpJRD8bOrvAd5)SJv{k&lDObBFiSm$rSs{v*5Ick1c_~1}dXd
zS({Pl+J<fI&|a<Y!JjPF$+1ELGd;lc(!VTFBG>Y$eT{E@kG=9m?@<lKJlS3oO0VXq
zdsg~;hQ-`iGoh=T+7UaGbNQ>+!bkn)507RwS0<KKRmSLb|HWS#aD3c~rM4Ji$QH|w
z{#ilm@p>aC9i@C7r}d53A!-Onk}l=?Rd1=ppCMK~6C_vh19&G6;L#UeGb$#oZQf|^
z+8X{;=~0d;@$mN*WetuWU4!cSrFmNIu}=xyJTmG}uZ1LH#2tM8>$c4lbszy_$VJpd
zDht_$u&qB3wwLqAIJbB>JQ%lg$zG&BxUY%6?%2486D+FYTS5SI<nS?<dgpQ`ZybDe
zB1{ja9g#q&iD=7l#O5`a|2C}1jSkhj|El~han-`a9hCy!w630~quyU={2o|@dCII`
z+j?%q^1K6xEIeIC^i&o`jRAL?_~bfm%OfQF@bywXO1R2HW1p$3i^?v0Z)BfQLYa!|
z9~RP9SDS8Kib5SWCUJEK9Q4uZs7y2ip)$#^a?iGGx^}<ixS!*f=x20F09(xmtVi@1
z&9Vo#@#<|mPjVtLPs^RSlpKRU8MJp4#hxFf*zD=I>YqL?Jo$92)cZE<Y}e35k*ys+
zqRQWB#6El7h5eDCl(i!5{G;g#b7P9@1!Q4YgKdg9jBQh#a>fSFu!#O+kylQ<extjG
zM~x#m?9$DFY}!<#9-0FHDpn57br5>>4C4r&l(4@IpnmO%D<nf){)qI-E#35Lujvci
z9#4ZsVz$5nJLhUlJcr&t>6>-D=wW=zrt>;F;pSnQVSV;9zc$+})Ft_5bHl8|*6XfE
zxb>}#^qvWw4fGJQx8K!;y=RFMb~WO&ph8b8MVX0LJrQRXyCY%RyN0mdDrS3?!=Rey
zNVHw?GsnKxm6P{S{ap!gQsMM6=Pld5EaaaA?SN8l&R;>H&HKf?Y1TAF5l_ADp^qpU
zpGZi~2Kp%H**=Ta4J=f)?cb%A06Ucc#3_jVd`4BX;aY_BExxhJ_N6r4+Vr~9)o6r~
zr*U)>XEgdqrp?u*zY={kk*fq>i$EOtI?acoj3QRbCh)(LWGj7wqGZ>61bGJn7k&ly
z8GMpBTfcL#r`&i)f{F8t>7-Z8CU)M;jW;EAN&@+)MSxJC0}1a2$haZjU?HFB2?L~W
z21o!l%l=s;`KfSku<2elLFDkVK<zyK+VftPA%e<*25OY<h7;3)-wyh5Z*sN$Uesf1
zP>MARv5+`jK(;Glz`M;f{r0+^TAU{DSV9mo%Hl+DjiAAK9Ue^tvrI#N1{K8oa5HVi
z7p955yFCfwctKQ1jGFx_6Xvj2flh+3Ifna<nlPS?x8XhZfN|^Y{a1B6uIo0Yx7Nij
zB~nyw4?tw3BXr<oxgE4`NbdL(8yHd=5wgd{ck|4&ic8uf<|S)TKWPUhO`extm8D7h
zd=e&1{gP|L`%1UH=Y0_;HD$YfInCuur@cti64n?wq2ffaNReK^(m~Z&nQ?f}O|BWG
zDBlfKT>++BZ>XcC@a3berHat)Etil12TjU20^|aL!4G%m(}Ob~ITnkSO9)Y{J~}+(
z%#J-}70-0p1YE&LSR}RiF#9eaET%`|Swip<OKF!SbX$*}f8@C7&xWT^2Bfl(caC4$
z?(#J%+&kNPis(25s+$WLvdQ2^5!_2uE=*ywXVXBkdB?TZk30O7@)7MUBips8f}j{R
ziWCImbX(S_LaDc(!N=CX2Cwv+{OV$A5%A5q&)#fB?9mTafiR2!UKaPekO^?9LoUt&
zA^Y7=37?Ki#_c`Ot$MKlSkEGlR9A@wq`<dM4WBfYPP8QuR)M>jnucK3K6S;Z%X~iV
z;b5Vlo(UMhjQ~%v_Hs<Rx*(UXt2Q?yd?(H;YYyWjE>G$*^DAN;e`BgU-8+zjbxNKH
z58cqlvqzE<&hzAccz+C%qh)17PI_^<e7IYG^(-kaMqR4@0ps$K>CG_cZk?_qJD36q
z{umU>b|50NIuGEOgP?nAZ6dGhjI((4ezoy-Dc%m?=fRkC=FZg);a)o#m1e}wo^u2^
zDSwxprNU1MU?*8Axa)K_+b{>|BI-rQnp_szD|)XMPu^?qqLllX+V1*nLYJ=4P~4i2
z^-DZ_%T!Q3g=rMg@o(g+@0fhB@uw7%75j+2k?LpF<LWkv$GVYcRzsQRXXPGy3BRie
zbj|k366oMpN?2VkG{6RH!fc2ZQGdDnXEB-pR;cOzhmXB>JD(2D#K@AB8|Qym{*~{c
zJnpRdf_^LI{NZZs|Haj)mm1mi*Qy^_H4y@wzkTWNnKLsNIiJR<`G5xQz7|iPr%BhT
z=D=IG7Iz;xy?{!0A;x&<eBktFTdThs8dBQqG+7M~>N{H1uT}=2FVC;B$O*`xV-YQ~
z6R{*bki8mrXt`Kxq`EPK68yj!xmSNqegv^Vl;BS#+Hk`_lD!7BeAew<iGLC>>u-s6
zZbl3OvMruNmZRpl?rM2}r?d#UUWYfCi;l&hiWJ*#>d-R(^{iW2M!f>Sl~;Hf4!JgL
zYl|p6zNF~KP65$Yv#6ObsS=Pb_+Au+Lo&w~7m}(}NnEQLZ;nuU_*1{R+^Wg+V3U*b
zTf_ma*=lORrb~HI0+tRjzPpTD_R@VVu`&#495iW!!6N+b|7);_=YEM<%kY(P=|@co
zE<vGWDiqoICqm1QgRbSunoTK}eY($5mdp3v*|EX<-usni)wy{s%YX_4iaJ|%iuZT@
zs>T^-QfdmLmRSkQOsZ|D-M9L(sd(s*N*4^wS%jEQ)_nA7MPEdDOmlNC_az87M^}B%
z6Ro1_Mn^Pd{Aekd6Z@RzSD51Wc~3h_Ho7M{yQv25-UPJ*%N8zRdBOfBnC`OA$v#Pa
zMRS!2(JNrKoWo_e1=c+hlS<d|Iy@MM&V|$*(a&nLNLp)HCWs2vLa&oEk1mRRtv{sV
zbg-g<Qy64qbZ`J+DwW`vNVmR@ga83oxWP&p=0_q#pJ^UgWhKw%*iHyLE@}(~-<(Rp
zqkxw&elgGyGmsUwd&w1kE8<MC5xQocsk3Eyrk6D_BBMLi_!*NB03jq}xA$t5&KTU5
z*6O{TB<hO);1(DVCH9KHKcT7&PP?9zV62-}E3v5?W3Xo6){nD2@tW8ZUNzpUEKaa%
zuAZ~g0rN$7SDIkNuH8>or~Mt!!S^E^I`nDH_|D`=y2MCYWxACY-h@H$WKeJsApkx4
zf>IOfb1w~0!{XZDaseaPI@HOdW1xi6_1|iGd3DNUt3btq=BDGl>FK#YLt~hM=IsyX
zi**w9%)<#YN~`Z5+tX2;lD7{&MJb066vdiKam)Y;cg^XeE1D|sPVR!2%-A78S_-~6
zPya9#pcEHP5O{jM!#XR9zgyCLNI=WKKPnqA;{W;Q^!Vs0t+KSsn|IW0=GjqPk&91X
zVFd|onO*tOk`EDtALW)*Mzz6}i%<X2mB|haknX%i*6y;qM(C2gYIvRKq?MmJa>+6D
zm;Tc<=U=gpEANY{+Y2Q#h*A?3Sm_%h5Q7dd#j%}HX_}<i0U&*KH1Zz!H@ugz)Yjs+
zi)F64_-4|4ycRjhe2m}RF5THwk=047DYgf_*=CpBs3v2}?j<r`ApG_R3}*(aT#cnn
zW8x_$jF_?GVVdy-j>pKz72hkesw{@mI?7rqE=FK#6DB_P_ul-}kgV&{2~s7?fzQ#S
zyPN2alk}%>uf>aXKt+2XKEf*PJ>|+RqxR==mHpcw*`C7k5Den^gn`bTBuvqqEQm*^
zz~R4|%flEm{^;U@?UQd)dx}L3mJpuhsP5u|q2GU=mxvXDp#<2TR3Bp4Vzqfi_IzO;
zMMgA)Vp@5GRL`a*?Cy3*!+Bt6X!er$v+dd5%o!&*N(sw0`NH!4qvI8sG*n|5N+2_e
zFi#JZK385}JT2RR{e99XaoOr0gm9or{3Ry?<)^x>dH0g{W7+H2JvL%1v~prWSn9CR
zJ87SlRQzr*4jgMv0P|6j{?=>vfL8z3@cNf1TN$O5)jIpy=KP7qHSX|hT$kcZnLVO&
z3stO{9qOLp#DXabLTR;XMa4a{|2QcB_NCAvC9pXqv>bi=3ZQ)uplf$9Mo=0GmXele
z6VE(2rnNYq`J)Gb$tmQ(O7>+4NTQq6ACIzf>3I*DFbXk|8*U`%5(A=tTExoGd(OHP
zlpL4MM?vQp8FjBgZ?hmL8f8zrsEp519ojJ4SM~ohyDpCGe`~tYoPRXkub=(DYPwlX
z9o24J?@xU_r=(A0&&vUz9xM(Dr=$a#s|;$VfO!F-0tlg%wR8}h(818vHuIIVZ@<$S
z;?`OR{(QPmr2D4jO>YWc<JV@Z&$79F`2T!{_@8-6ChJ)uM-_xmDgAVz@l2@$w+Gwk
z)rb}PXV6IYC%t{rVdNK&@6`WRh|N}ga9j0C0zlMlHqLVcR-x5yO=zH}->LO{4kU6e
zhCGD(AN@x1=<@1B){k!Va>_G#u=jCt2PP6Dml0e&q95waH@+=*FlbaBZaooo@s~>N
z0~lXCK<2MjctW3|-HP(Sn8#~l(QmenVa4=T*UZS`=~dI-+x)0#HSRyuVs1D0A#)X0
z;htz65~n8ge&V`wJuBOayN7Ms7JCDogdp~17c{6O6FTCD6^Hor$#{x1rN7_lq$c6h
zy6)kwj+LSb6>)LR5YdUFaEMB<AwzWizi7k96>X`J)M=-`LxqgOut)gGbpDTjOT!QJ
zX)jbzT8I3l438uz!$tM~M;Wg9Uf>E__EH?6LW{G6*cA1AJKFdky}Lqc8s7vQA|9)u
zh6SkTscJRB(OVzqDH0-&FPbvYN1c}q86N{!Xq-^NbB_n!p6IT=&omeXr5FkakN<Wi
zv_M+wchw|gm*{yUABubsZb}c&6+-40Gnf7tR+kzW5T{N)WIcU&XQ%sz405bH7S>11
zAsvXv<&tTsNu4MRYz6-}1@G*WFZwvmR7>?uXsRk7PGle!;9-;huCqtwb+%@Xb}d&Y
zW9KFE_b#2TfbQq*k|=8R2PN%8vA{S^e%vUPe<bQiY9VPYcC4Fu>rXeAY1zrOKos2!
zTVcuEP~)d*ssE;Yt_yv4+*OCRP#e)gb4sQ4K_i>u8G0JNZ?&7J(O%UtP9`D@U3vv#
zA-kW{r9zS;aK<X7B%_9pX9&GdNq4kz@L3D{jX(`R+Inztgx(WM@ryLpsrUZ0^&uAL
zY0#W5Oq<Xh)Cwn#wokjRpucpZ=N&;6^{kJBAxKK}o$wAby-NH$X$$=oo*oRPJwpe>
zqV79uR&psW9-v3Nn}!ZS@>iIEbzsGg{d<eczpJ{tN!^wHOi0l}KRlBE$GD|pMi+63
zYxkO$^2)ApCBMsq9<XU<fbSCK;Lz8S6neIO>;E1eC}0t<PA8uc5VFxSs!q1DR+x-p
z-miYaK|DTlIK2NmYc2F@(xeO-qp+d(>7rXp!NC0OL=Z;83~hEZ#B1JP^mjmCrWv+o
zD7=$QM1VTcBtRkAF$dMsfjDQ%4A|cm&FuHNqYvyAUK2KJ4t6mkET$sSjWrTzPZ#5@
zUkx;yWL6Cski$vJ94(|QZd@P8SE&Y_<AqM~X2q}~It-kIV%|l~dt;;EvjFC%K<Q!T
z4;Tc_J;DrVz<Di>Bo`F;*u89z{%^*XP26NXLueZYWD9+J1ZJi{kLHL7W!t<`s{T%a
zDD+;3(tD5-5{B%TQgmJ$oYzqLQHDJ5B_SQRR|FjEAi2WPVZ=4A;0ElronW)klHqu!
z@8KUw*Q_9xC@kgo5JKjVW<)~9C~cSghm`80bD(i-FpVr3d}SDt&~z5+ymt$JBMDk(
zo4ntZyno`fo9;};EaRr<hWJGIsQqL~nGLQrJHvNBe{A?E0ZvC>C!=R>o4VDk3}|8?
zuv>S&g5ccEwoI9fa>#+m#e9+RTh%6Y0eYqfec$ph8L8fX^eFq|J!io@>V_gR?j1vB
zC=ZHTS8^CX`zINAKm})`jyh`6LgCOxaI$Uc29blF?orM?y!n4o*AEg1Rf35B<#RM=
zUH-9dpW&0z&F~Q78D_E|_TJ%s`7w_i2YEk0cjbE;b-7oCDq-?b6#r@Rm4h(r{xQxf
zm=pk^m%|RIF7_pzGnhaQPWR`%&hN^hkU{&yTDl<&Z}ml~Qk+VoTbKl98BF{Z6ZOs?
zMBx@r_V<lDK7=IB<viJj@5v?UTp|$MerBsuN#sGH{r?|(?-kb6zO{WTVnOLBAT1!h
z6Qqj-1wpz<l@>`vx(J9;k^o9?QA6)VK)NWsDpi{FDvFd)rG*v(gm<EQ?X{QByLnE&
zgYV$IE)RkS%FO(iG43($-(XAjnyC@P`uOs<c63`X%v!uHW0xmv1>XJH4LOtu^CT?J
zK%NA6+^i?+`JJvSwhi-o2uu|q)3sRvC429`7BiyH7W5FrJp1%tHdE?VQj=bgm+4{T
zY<ptw9odY^qb{7Xdv&z2^b~!#2P8J{2xM<iW7J+boYV|E)LBU=fGn5Q_O{bFY@cyj
zLK+9(#BOlXBk|Z>TV9kMU<PNkFKY|=$g4{p%|W8Wcxc6%#t3F$mTMe$E?w2g$rlCH
z>>wOcR0qXY8l?rW9Q|EUP2*AZ-iXZbhO?`+#s)@M%sS|8?3a`<Z^$fLq%xMMM}97}
zs6y4?Fm?x8*jXUxk@vjnzrNLrN2ci>@m}U$M*a-x_vWM~T-K!-2I_~2)E$g<HgEbM
zmv!zfSJv@=i@NIk#(OFSJ#3s5%n!xJK#C);(qnp!z`=!f>@Ue%5#n4IPiRp?#~$DX
z&k)rEsNkQoQQ?iMsIcDV9-iWur`YW9Vw|3=ROYV08S4ZxfN#9>iP?70X+^?jp2gD4
zj9;i@LZ4B3wyPw4CtySR0u=E{_?zsW&ChGj`*V}unY~%Rd(Xwi-|)QR)TR9B-;L{k
z14Dj=CbxgvCt{b-R{)S*y`M3eavwzU%%R!g8`fIA0}u01hm8tc*Yq78h>AlylZLrt
zli`YSzSQYEd5N~&yqV&39I=b)ezyg&*XS`h=&S28CnAS~IX|}Npa^So`3T{;qVL<B
zD(~YIRem&Q7oNM?UHoL+)qQYeOtj$3LCg8-mStv<FEw>SbsJ-+7Sfz92-VrnPt-3T
zP_P-6&%0bhEDR_I2lm$D#<wgdGs`LTw5~fceR?rtxHri!sVd!mZOLpR#EbPXb=Fuq
z{{QAd2JFct$|sO_J-MtR6!N^wx^>2KH}wWH3slObrf<5yPw;RUp1O3-o4_?SB`9Op
z;X7GWyqNukabKTD$3oTYp%5Hbmjg=zJAl(FoxgkydeLiGQ#UXv%EM0b6O0%h^zySB
zmKSq8{Yh!s!V?#=Hgk~Ombth;nmygP9CIjvaQ)Uu(y;EQ(-N@r9U-&~Hp7l6W9t$q
z&vz6dZ;#v$G;L6wRtZG6)Ud8pulvMvGGmkMKRE^3TAQ&iqs^}RF#oqZn2FYALY%~$
zrc1Yq%eu@@F;CfRAlGaGz1bT9Qb=h!l>s&3M$YHv(wz#|2QTQ!6C#-p&Ac-U8FAKt
z%1|OGJtx3v+{<Wu(P3Se8Pjx8KUjuy;C#f?57m1pJawoX52VRdBmmXk&buBXg)kVF
z8I;wbqr&OV%6NslNhJ{`Rg=S-+nRW4#xgH_n-1D(SP1MI%w$Yrm3J6<Ck8Zoe4$*$
z$rvt{Enm-1$-%w+dAd`5qR@f$#+hwel^~T($CgDb_R|vwrGHXwe3N;OOq{^5p7~_$
zY5ecY2*dB|L2q2L*bXH;b98jtgVwS{fWYu5CnG@(k;(@ZTSKNaPs&5iS~uMzWsuPE
zGm_{)Px<Q3-2tKS@JO1tpick@qHaEZbB;*+W=#)bh4|cdS&5T7tE5-HY*U{gw%By%
znj@=W&y{Tf{!fvKH(0o`%;|1CX?{Cbw|n~b=VqN{yz9FuBb6lgnV5MYe-@BdB4a!!
z5#M8U)w_<$ezW)hO*aDT9@|?dqM=W*xbLW~y2t(gje>3r|E{6@@xg?L{os}FJUXam
z{*_&fHd8`wiKcBzNrszx<4jm@fMEz<*d)4)pQiGy_mmP5X143hQ&ytCKcgW+-lgxD
z<4ZP^rF~|;fvZH|+;WL!30MV_`h|3$$WN0Tgqtji1<(+e^orM7W3Hxymzy2}mJbQu
z=BRr1O~7IPYUsg(xdT*M+q@kz=f7R|*A)Q}-5BTDc+LP7wR=pNo9erdRk8;J?uTQd
z`L!bDu83JTPirDHcQb=&8T8C|bMy?aDa@zu*4S{eDYP-ZWKN15bIUSElIEXp@Ug+a
ze%a=FgDZzC#HvNia2bEska;>%>3QLolDwi1yYO?z_=bFdvu{5C$irt1hIkfi4!57y
zSTi_9S+bCB8*^XdvacZ=cb}`j@8NOQj$<-~-?Td31DDr5fUzEXM5qt}&=G<$g`s*c
zl<$3sB{d^8Z)d4o)2J@94{Cm(o_jSstPzKZl#P6W!p4A*P2C&zXo}xJgjcVR@w}&U
z_@W$PFbx9Ss|WBv0qljPzQm=X<wt{ngMTcK1Z?zNgdyX-vhgA#lBDTOtN7IIf#$zp
zb%Dhu6p3>KiBC>eo-h}MEVt{J{V!jd4U{7h^0^?H81%3WW{@wv*_}>oXX&xXtXF?F
z80Wzw7?MTa<Nt%*GU|g!n0SCFk2hJPdgq%5c(Dj6LR&&>FXPy{fdfLKENb7`xV?Gw
zSSKL`SxFIfbRmEE`($EH(#0S_3Rl=dN~hKa7sRbZpRye=FW$1x9JjnA9C5CQHpHMc
zMtqspab1suth~gQ9L3alneYFx5dI$v;r|mBLWAuiGohOTDxjP1!o-p1${0xsn_w-v
z)}21?KUCwSczA<66cEPd`7E2*T{qog*=B$|gE!VY;z=+I9cMN_GG*SZ0E&AmKLO%j
zS4lNaqdSTiFQUL;b4$rF=tE>BJLTmoVk+!Smb+K)X--Gp25_pFJNdECGmG(jY|cTV
zP=bv;KR~rSk<dj7(fz*m7YpEz%i-@I0UF~G(dwbmrjBh&qLq0YnnzG8=4z;2uf8D9
zx&ehtPuvLrG7Q9GsvyT*4k!#m?u|{;gfQF!P0weTg9pA`o+z9}a~!8&@Bo~|;2iI#
z<;0MokgRr&B!e-BDtxZG!;SyM65wi4gIUf4R=?SC25=ZSYE&WJ5Y_UG8?t`9_C$Vi
zAsQ1xyr%&$OOCXss|-=h&xKmzZZMwWKGUCd-=s>&*(eVY=QAZn-vNI~2jX9DiW6W9
zn|%3~`c%>$ivr}QG@0U9m~+{&`qNd?9v1Ku4a2c?X;>deDIr>_M3Z$OGu(xT@;5s!
z3%~#vW`Soo&rZ+Bq~Kb!LL%blvdoEL!!lEbVJ+i~sTZ1b&z=;cnC&Fx;=3A9h9GIm
zx(<+58Lk}GK%}zQfjI^%+DCrZvHOH$%;$>zq&xsI*h06kKD{kH6R^8RoiQ^AjxghE
zIniWJ{x_STL#E8<<3)@(#_~BW(pHb$1z_d{e*}gXC43w;*I(F+y3X~0n~a*B^!5mc
z&rdHOA8P7RWy=T3J<c~Kc{^o-LWq}W%+9b_4>;d&ZoGVh+XoiOI=X}G&?e#7tJ^5b
zUO|ewIZdq8m0#mPVs;P;6NR~Y*<W&28~eUF3AoX`GR-S;(^>?mKv%9GbEPO2kmfF=
zbO8{AoY~Lyg`3?bTSnV}(3MmFzWl*mv?P!5O(EA!enb8q6{CgEV3@E<Vw1(t<Z$qP
zlUdu*i@Te&VNpuXozCH;1yj^sZ93#FOtbodsPd^;!saFB>M|Afp6X|-DkE7tHvc85
zem6;{_^i`So6x6e)TFR6pEw`Q2++W}-~@SN5yrWV`IHcDZ6pp>GIJ-7&`A@Tg4nhG
zFxj!xY-tPH?7#3vd;NkM*uu|$OhVx`7I2tH%NF!9f_6tPR@#6Gv`^d6DUvm$(R1z4
zSji}_9yS9^v0Wx%z5Se@rRgc^SV?=sQ$PDm|63+C5_C>~5gk;7?_ui|>6HLHCyp(T
z;#G^3ySXd~Zy)Ig6~2zn-N#>41#zAw<Zj+InF8;=sqdpjtLYikj7hYyOOxdZH3+og
zC9<3Fe0<b14@A(@R$`9o>-bID6S?`SB3Mp(JqyBEJr29h|HVkf=Qzys9Zuh>&DK~9
z-Yw1hb-BU82V<!7ZxCK?c;PeJtQ-4RF2%!yW_w8pcn`6Vw<q93v+C{&f%iM)Op+)g
zzRhq_NyZu>Tk_}9ikwZCS}z_GKmk0#C`Hc2ls=<gXs<Ch^@hk|HiIa$GSvmH8TBUa
zfIzS#w#Lt_Aj&3BN<?j`<kh$iv?VL*1(OF-d1iaSh@$+z#h^!je<$kW*LC8kP54{y
z_j7gxd(2M$zwzXGar-l$_nLAma96vPPyhi>%T5?+SC~ftmmU*_0q7y#o}7K+sM$v6
z9@o6hZ;594QdgAf^oa1e_c<7(WwGDAaiKnAVFiW!a4E=O=*K+9LiC**CvtSi(L=W3
zQZ1g?pl^2%#-Tb$m*Z%ynyH2)Tl47o_$9r=Hvn78OGPQuDhzrsBFsovN#nENd4}K-
z_F7!$=J~bvA*!S;MKF9EKqm+F*AQ^!`YDxFOAOi`dM(F>UR`v27MFdaN5u%%<Mx0p
zx8s&~6!t*8IOarfVF|6HhlghHFFH9#Iy>7{G}O71><V%g0N@SuHYO&Q-b*=-d;+}N
zXhmQPEX4QmXTsl8ekuiC^iLXqOGY$dG(bebgrq+Swdg?8^9f;b!?6lfJBN!;9{=R&
zXA$0Yr;gbGdypDSN_MlXm*g5fJHXjPV8^i{0fLRruUs9OOqu6Rzw-;Q(9&lJH~tj+
zIsA02_UWtLn0gs74)an$!Oy(8<q>Y-#guV33%F@khb4MwvXwffSf1B)CZix5MSeX0
zu7fnhNM#@oqJGUBO0c$o5`<QLQp!5d{fmD`Q+%#jt~WFVT);+F*K0uQQOeOwr}QYe
zx#@M_ep8RQY8bBdQSR4hLVoG7w^1mmKw;R+Wd3DL8Su?j5(SW#9HVN*jUGlle`j%9
zEq3_I>(6MhP`6Mj`=IHx)G1gw7dzbxs0vHA&jtZc{k*L}ZZ|6`rZRr%=zKnwuTVg`
z2ykZaN_1{zd6(V!#lM?=m-8Z~nc5m`LO&TpWl0YbRtWw;(#&!~tbjYfIO%+gC@0$G
z^@}<eyMD*Q)oTF$uHdgurvE9XC{mEVG3a~hesFa~w@S!s@Z?wZgVN2hT~cieS`1Ve
z)%7Y?!QX{5`gu@ABGF0#ZAoE|9iE+mC)wS;V;Bl`bu0ks9luv@kvI;5hRccf?)^fO
z@9@WwLS@f=%#Hz8*b)71Xr_%Xi|RQX__wtiL@Fh+Yr=vjbq~x~qAOUk_1FrEa_WkH
zg;syZPybZ*HB%)?nyI4lG`z!Phx3T{bfE-+qWGnvFw6p0BAQPl^cR}E8*`x^??$2g
zlSfatROVhFc58m)?U{|-BAMCGDZ@~;`w}pdf>l9IT0!rB7x@0r)qo!X$m+Th7I-D0
z{KE-H|5cU9ikY`?K-7g28QCNHo$7D;T^QIx-v{p_d)XtXIcP8#N>)b_Imcm`?HgyL
zwX7!k@<LD7U~3U!=6_pfA-sOQvaa9W%N}4Fb4Lh05JBL6_SpvDo_j_e3K)ZsETNuI
zYIaKi7w10@Z-Rv|Fka#@R3Tql1M7T~M-TnrHLMKoHSz5lZeGaUTA$mxd_1P+9!WD@
zL*J!LU8!vEMV`|*wMInwrp|U2@@@*aik}J@4ljRG+UMjF60PWGMApnirva*0Hl5P<
ziH>Q>mTa=65Z-8KuFlb^VT0jHn{4uH+=h2pkEh=a+)ho~?8a;NSpqkWo)tc`w%v%Q
zXG(dbfc%PDGC4L*^@^B!MaX-4J<FDm!Nf>=6C5m`7gT4rRmpQxHYYnV->JB6l{&)j
zxM;YP_ARhH)G`eU84f<EBcB**5*#h{_m9ZrEn`Py@=Pwue(@qn0aCHxa{Rntiqt2j
zp{rR%rFgOCJO$ZcOCjfqA%b)8u{V(2l{-bmk=FoxwW{!lOkM+!$+tG&D!8`Ae%4AD
zCh6kmM-jMQ+vKs(dTkw%$)hw9IJBn<2{Xz+91H902FxdnRFrd%xs`nl$u2_lA2}|j
z*reN}E@>WyRc6NB4VCLNy9^K0;7K!xkiSjll12~8cH6+zAYxfiF1?GEi77%6jeT+i
z2kitay_rFimQBGMlX;maa*ax(z4qhD<R+YV_U}}hY^pwK-^%eGG65l@vL86eNz<yG
zP>JMbJh8bxw;nP`V+W)0@d(OnR!t0ftx-3kwfnh^vmR%A-98c{gR>MK<keo%dv_dG
zGFDN86j<!`y}ynMr-MFw&cxZ4jw^3qogAbc^H&4!hjRQ-7kbDFA9@lBw5+ce%iic*
zqG?=!4c-?iDvAkNi42rs!@(s7ccN%c8y|~*7WbVZn>>o7oR7Z9Ec?8=O|ylf1+1&D
zp~Q?*VrKV+_0QD4U|J4J!Q?KON%l>-OPz^+FziL40&bPv&q}Cf@xY=&Lf!u|FoB6|
zAQRG(xZDfLME13h>4CHi<3)r6fh11@Nb)F8zvVuOCN<sPosDgbfrM~NHwPK95;`~T
zb{0p-?zeM5go~H|*Ta>EWHpOeS@xR`&bE->_prYsh9do}ZnUD*6}TpgEB^Av%rl_c
z?-pid(#Qy@^vRVhP9T_pbPE)gzUrmyAG6p_(!KTfdD5ZM3&~q3n$Ph>zkfEH>7w+q
z+2)>K@g10$0(XC}RdBT&w&P4>V5xEPi}<G7w!At!_;&%S#hrP{`?%(uC+)Ew*fgwe
z@`zTY&9V99oeL)=RLQ@+#+1#6$3D58RM#9BofBAGqHBWddCfa4J1vH7YBh-)x`SrQ
zhg&%3g3P&DC5ytL>-ocSxM*_gM?yUpXx|2s#?tq{KS|b}|0%}FXB@x5IJ9;pq<b#o
zT0v_dw)Csn1W3ThXQAkr;8c>%hVkHP-QNjb+!-^eAm19k7Lq3Ou-N^!BluiM)JTV1
zq0h%ij6#Ct3tHql|5?e49W_UA@S#O}a|{7sq~1PiFZm0x_~(Z^g1&Y~$T_%Xt}L!d
z@Zf{tK~!yOw&7yY&tLR8(qHsBSdAvpCI1r3);*;ZV-uV$MKM#J%9E(sg}JRt6%svU
zlLfY+C_Y!otd!7nJV=#|q;wJ8Co~Mqsjb!Thinj<z|mRld$R|9&M+Rar1o1k3e9f6
zAAb@O^REPoi=-bmV>M0dZF}#<k5Fvoh!EVQ*5PNgrkB1}i~Nk{)^rrjH}&3?V^FbA
zY)CK`$U4sDqPyNRhNOr-As~gi@^=aajAWfx@gEVk&1pyLIB$Yo=7D3-Tb!4|fFLLg
zj+HQgl^BgZka5+6<+Mb>VUkBV)Z3ZouUgl|W2G|P5o6>&0!yznc7vKDW9qhx5FUt-
zjVPM?b}U~l16doh61HvM1H;TgmkFE8!%g*4EFhVU#L`zSvcCg~p(`irKtHRNlGjH$
z$(hT{=f@nE4|i7{RfnIK{~x>JE&H7qBI7V^y~w5xt}NG^eo0XKH{-6fcT2lLA_$la
zr5DyLZ=wi-P^r*dy5BiwM%Fz??Ql;uum4kV0%9f&h&8%nx8ye^AK4$oHVmC3)rL&}
ze79WoReE$WCmYE}4*EVY!S(KR>yJ-L4Nt!=-w9EC@ZF`O;I73O@DRH3uC2c+viA>Y
zf9!ptQDvjsW+~N?*&3h<5Jj#tTQ+@8`dX87eS7>GK=!;^usUApI`VAdMZ-&ugzP{R
z?;)8>!l>szXDc}PkTL;g<GK)HNK43U$hycPuj(kfr}3}(Q(*ZpTfsSC{#1doX{ocC
zNp|=QiXbjkz%uZ8iStT%cAZ_tw;-~gH5)6F?;0ZnXyykh^<)UK(~b0|<P;fbIgyZ)
z`%8|$F=g|7q$`zstCIl}#4Bd5T~U_%_^%CTA@14<<xd~(e`P-)Z0RgjH}|(73EO0W
zAm=ACo9}wlbW#-3Or?=eZX{^9|MM4*{dh+4$FlpOLy5`&WYksiptKEg324i4htp3F
z+d}=u?9?x#E~TOQwTaJnlIZGaJ>#-<YH)Y-NWe(!8-wp7!f``b*^Ai(rWpFlemrT_
zlLguqmTOWqbJx!XtbD5uY{T&SLG~w~S*|3GE?^@<rdDWFBgo9FpHiS9#K#p2EfWE?
zJEM@A9XtlJ+7Sc2ghG9zYV;enAOlQ~6y@VCdOwPIbYj=kryJLqk9Nq%GwMGEjiBfE
z9ck*$-WNuK@Z-%;@@L;YykrRT(~So^-!4<i&#(358La{XOGU_vn&pR~htpzii;-fE
zV*`CVuPzBjJEhL-oBVN*Y*D|(e|^!%+so*7D2k*kq(=d>I-|paZ+)Gy3{yLNAk<~x
z(E}N@7T$;oNb!{4wFtu0sYBf^HO3;^`60z>c&((Lp|qcyZz5t%5N5Nj6|^T##{zDi
z01pdlkn5)F<949AagaATaJ(c}C#7bLb8CH+DNJz!b<mJ{<3-2Q@Cw0emOuF|ZEB__
zA$4B2jLRHsWoCLf8?zPMoGS>q9gPnYC@2G2QBNus6Ji1-?T7rj5!(|DD_%d3Jmar=
z%5^5h5Y?;=PN;(q?_99$J(aF8YduOk{=977T%8Hh(h=7J2lIA^|0Rs{ygIjbY817{
zdeOogX-7ERR9n4PJGy#m|FG8k@Z{u6r3mu+>PZGm!sc*e23mo!4marJf4JLQI@u*{
z{l>`j()1%@|6zdk`r*NKFNeNY7Q<eDg!}W1q;DYU;46&aXyV%!C4Hb?NgA8r475sc
zL6A<JN>%3AMg6dxtl)I-*XWuVeUarrLT+As)10$OAY}BKfT^XXShInjLTHK4E`rY4
zSfKsP=~Iy68B4txOHELJ%Ye183VDm%vX*Eg3wm2sWHyM?Vrv}(*}afmGyQo;jI<?8
zHtna~St*6bKT=D)l}!tgiu>m8A2{Q_d3Ccch}>3S41#V3UlxB5DrVK*v{sN;9}mMn
zAF1Y15HwtyxH4^^MxJ#DV4!;cm6pj-`%de~$eJ&SJ((Y}{PcWx(x`r4jo^*Ym^hn^
z!1ZpP@jm>TGR^;^EvGwWYkjzmI@G8@VE?VSZJ#~syjJb+Y2JVJJc{{7+)Q=1^4nCE
zP$A5R@0Z>zxoxuBE6~dw2kbn;{uIXnW@{7My`{BKSTbW75r{|B4&`!Z!wjJ7Gk3d2
zv|7yCxT@N3T)FJK`;d?C#29-q{y~%A*>wRGa{IU09tE5#&iTC^KQJSq(5>}iL+3?R
zqp>2Fo-wAEAH(Yp9o<(dv)iAd+UilV;j&xJP=@5|UWTLcH`h|}Y0l?PmQN^%AbxaG
z1)e;0CV&CzE;9b4->I>||3drJ_21dtJf0M9%2HH^yK7wHu4~MA+S1|2$1an7h1BvX
zC)EE)Wm7Fkngu!E2+k5R?xuN*i*iKMV~9DDxZZTvDWg2baJSD=-FdP@8mgH(NOBOe
zz)A?TyCLa}kKp%}Ki>kaRFnFoB;J)neWf6Bbwn#m)&#eHf)9jI^)b-f=%mrf^8^y4
zzyMWG=9kVl$-e@}e#iIo>(9QA%dXSSc)ii9H-c_OJ#kdtVf)tT+?u3MzvTNXmsf;S
z$6ob%8VjD@dd=8bXu7A6DlJINsS9}YXKO(!8_7JTk8@$;iSfaQieJ+QB%{li8qc>V
zKN9-*#^Ha8FA}0lahw4o`@ulYupb+_{I~Yv$VZCLs~bNpOLz;P=55;1C@Nhl^z!SP
zzC;5w7d?^ZuJNdtPuJ)VY;~4%Sd475>`nLQe>9nXI?ZXKfw$9%Pkx{6==^$DOk=aW
zr|2q=x9BNPsXr^x+KT!oq2HIpcWUyr=a#B%_7cF#UD8Owvaa<<Una4CMEi)wv(!gH
zMcfaTG;eVC5=Vd+qEeKT!R42jqYaDA(6I=v?d*?9*_UskYn9JJbXta0GkmR4a4n+<
z`luyMluD$B*b*;5@t!s3VW|E4l~$9j5MsA`_S$Q_CRw-q-UEDjw>LNP?fAI69Ui!}
z<ZBNACIcNM8YHumDGI&(d41ef$4OCtU*Ol%tW(=808evqrDnQlGXKLDt!G__^MS(>
z3=ix7DZG4C(N3LeKewr}dE4are1t#MTTfNdt}UH~?4}H70eXlW&lrC}$sN|P@WR(b
zHHyKETfCXgkr)>F+%6Vy*gCvqzzW&ceg?2C8?@<%8IqN7ARJC)Fm8C%Oa)m|a#G%i
z3Aa2~5sSO3N{&Lz+!5rEaSGNWN7?ZwSEhhGI^$}SJqf!b-)=i#OP<!w`x|{BgVe%|
zt6geLLwDCI9(}6{#CF6;^0#@{e5-O3MEaPq^<=1a=i1{KcYZG`IR)S7Ix79I*Vo6D
zx&u4@9NfT^^3fwki)`3J?r}lgXA7_8ODi=S+6po&`S{zKw@Pk}Sam9aC@_Hvo?NJ@
z%?oFdh}a<-oqQN0oYr45Fj@dK#%q%6()=i=NCqZ0^*I<?xiB5WW=d<9AsWY1qDU4Q
z#xA9D#bmbhGHm{8w$@vA6pY3pxbaBu5?6)FMiq5!ApxAIllyYKq<#FQr?TJcVW$tT
zOO@J@xb*XR{f_(O<bFTHwRQRzd9RAQ|Jmo3`rM~PeT)(q)ps2j)mKFOQgCayPjHq_
z#zRdLRf?BXg%K{chZ~>2GL?S+YD(+7fKr^jE3Q~ul8Y~|xu~*i2+e<-4#CrN#kXt`
zy<~crpO3Z(rSI5_)O=pVLi(d$V>(;ZlEK%|9{1p4KltJ72IDN(&(|8R?H#d<Y=gg$
zmd<k6UPAn0>x=aN5ug62QUwV2zcng&-&U@-;Xq7Xd-W_qaQcC#Y&ds&AB^@f&69<V
znFdjm`6-&}Hhq0z?IBB#>je4SPc@5z5wf_sEw|P);DR9_lRm!n!QfxIn-Gt=6T$ix
za-pii^`Ml|P^4!HsC3*cWFsr1ea77&-r}x%vM;c9l9#HOu~=?h@RN}bPQGbTLTn>9
z=la5Fmy=bM1iV2?&GC=*N^#v!OwPK{6wszzj4zpj2-cazcDAG52fIVNQS0~Wy^*Iq
zX-K&8)l)O6kzvM~>m(TsP3=LJtO~O^33I(n`%MDUU=v^#M3szrsRFS^0e(zr4A8AL
zQr&MFSEWm|&u;2`d!wje8@n1!Z2MlKvv^fS8VeLrenyuV6122?X@k}T(v0CSV7c08
zB%bfV_2EkbWD3%(EIi=STfxIhnsw2P;Zfx)ggPb0uwx$6mx)XQnA11$uQ`3>^(98T
z?W87&=c=P_aJ6C5<Tq}Us*oA!4#5OEjf>+kE?OEEVOukeMg<DP%6z<Ak(e#vAwY3^
z_3{{{3MgLyeiCp_N&8m1w_y$%7;#lE92Rmk3ZmaQ0T=~Q4~&8UcA1L*37&O&5E9$Z
zW8CQ3vRO(G%5op%<pqavQx2OzM2e3U$+buq2SKKN0P1?U^k@`Bj1nX>nQhQo<g#cC
zb0~LTpY_SCH(ak%6jVBx*hGM)yc<SqTt5Y*0^Z2ye+p9i!Tqex7Tac@Q#U24TDY>V
ziyV5o1uV#$FGkdOlLpwYZAl%SN%yCD#2$@TxShY>84F&LsK@*s!<o-Y0>Jp7*MbxO
z;-&y$&{SZ%ns@#HPcNvKt5>{N3qxcy-M4v73zZ#jHzU5plr~LuOLoZ!*~a7M0v|;s
zlty_9!Zl0ZDzOxVIk%N4Qqsdnb@?Xv6lOiZLpkR_JgP!yL~(+}9csq8N(n;>><};B
zV2IbE(${w_bTR`aqCDOBxpvG*g^QkI!^%9AoZ?giGcbyHgpVxWxH!GBe#bUDX}j=e
z@0G^t=cBidj;GWv(*3|^jw*BhzvFz?#G}3319DxbKcMNNsnwOsYKh12w8;&@=hIAH
zXt%#W8{>M6$X)Sbgs81cttQvi4#VKsHwF11^R|-u5)N70xcfArrTi8?3aF6J7X=OC
zB|X8g4TcAloD4`uAB5+OkwSrWI6HM-=`WQIemulpn2s-*y6~2_*#yD5c1uGv;&D8)
zXz0rjFt0&87&-eSm+_<#47|knA)vpiskgOtmK0p1N`Ah|PAq14SmV|+wN#$yePgXH
zq?Pi?==%TG+<DaBsR``83XucwLo;9oaQwnpuIP0mg1zUiS?VQ<U25xvjhph~%J;*R
zgBnAuKg15@yaeh<ylKX=r#0+@bro<gp~an(d3pb9=|JVzR<QOu>cl8{zdfLeiOSOG
zNHdWbe65CvQaWj;_L1`wy?34L>>3sgYtsTx83Zb9)LeAUhf~(OeAdx$@cQ2hsc(Zn
zR_AyZIv!jqxTF=ODwkI>x{0%TF@GbH`(^lNM!HrOREzwsIUtv^!sCX-T69EG?X-So
zDGaOX=XDdd2YBm`*~=eE?Ks%Kz1Q9BwmTZ^`90%jl1I)s^#h<dWGNKM7^c(q1eoDh
zsJ;9CB-T<mdM=d*e0Qv^|GGl{q^{6LE^j@;Ss+RLp@oNyM<nl4JrR>*PsD+nC%R~q
z%4gmPdvfxy-pzJePqSLI6mpD=mM@uUbNeErDGS8xS&{=8XO?1(5`oxVO|{E@+DLw>
zG@^#PF^>7d=5x|Tj+0r<B@T+u#qHOy%<R%c`2fk9ps9`BdF`cjOOItKAR=zRbbJ>^
z7bz1k!O!XM34U28V<=$kq9Mg6oEbQIynl`GgK=-aj}T-R!@lW$IFhOiMYP|bXcqtF
z0xBh#48N)S-zNACsHesgNArn{7`ur5CH2F618*zQ`J5<%pqEBKPdxJ{TANIvJVsGW
zJ&XNmRpd|)Z*(-mL@B=|m&QEPgW!QIeDzTuRBTkamY20i4V=-%#~l5D+#0A@a5TZs
zEyvqVba1n~M!`8OGY41a0SV5Pv64HQ;O8&&gX1z<2%T00%hway1t$2hZZv)Hz=?M=
zeky;DsyjP{BRCt6!9M^yj5PMRNW_ty9r^y=0eIHTh`=jpUjW#BHt%)R0d}89pQx=|
zIbW)VN<;@~<j>+BoU0VLncx&D69R7+o-}$#?Kyg3WAok%HRB;h==T`Ke8Sz&!D`Nc
z9RA?<<N1dBfBek)j1mA#Wd3x6dSII+>b8a;k-Ps&!TvK?d8?j!*IU_Z=Eg?k(>7!0
zlKI44x3bO-<G?iYDb-Wl^c@?Mt+<*>VlV`h{R38m<5Ml1%SDA0UGyt;=7}=9a65X(
zfQvf>T2f}(n>I!6p*v+O394Sea-FB^M(MvmS!r3AD1MF^zJsjQQ(*Y_Joa~!v@fYO
zLu+v^H%K1}O_0GSK#!`o(4QLC0`^vYCp!Nb6y7hO{tTodQCuqCX7r$i2)j6?od>Mz
z^O!KKQmgWbhsi96Z6@c<wi}5<G<x@-@B$#F@3KvqxuWf1lT)-?QYj;H`N9aP@8X9O
z9T?mEm@Htm!<uN6C}Co=;6eVd^9fhZ7I)^b0ad$M3(LU)`Ca`K!`)K!{9mTLj{zF@
ze~##pz(k*RNg72r{n!t`lpzz^Aj|r%!2IvpXeywLH5`1XB=UvRd~^0dys>Q;6}}tK
z6Wk+=%{EX7ejnx$)L0S?Mot-Ldk_YO$sV-qW+3vr4xC2@-tgE5oaXvi1n+S0c>w4|
z;Wn5~L2VR*v3QJ8v_T$TV5O<G2nSyMpa}#h%Wms^p7~2jf9Ff{vZo{Xe$$Ux@{_Tu
z>rMAAK8lDw_(QE?7WCD|?sTiCD8py;MOC1LhYCD~uzWwWg_N+&N&zZDHX+}tuJ28#
zx{{TJCotXvk(+m*K5d}A8!XIy`^6Lk_e-=tUaS;fLGU#cRZgMcR|%0kUHWOCyF}Z*
zq<D65j_A4AiYp8ERc!Wtw-B|ywFF_GaotStik}`RcdDPw$|cx`ckdWTzDhd!)p|%y
z23MP%(&ayMbq9KQ5XyC8j-T3>1})2<pT~vURatqqI4-O2B`^^jYbSO8<Hw!?Q`858
z{TtbFiBX4#D=gE1v}`I|fc)bz!_`vR4xEuoDSc+6SDA93nCvgc5cyM;=dx}EmD1YT
zau12?KsSmLnk-uO&t&Q~<Aa;gjQQa`ttFSYw!Sjhiw)U25emX(*<AQVT>-30&JE&>
zXd*6x^XnOn`}l3nhHQ}v83!r%+cK+-*_k^t3|m*b3Abg|XZjmME+x)VO~wo#@Qv^8
zd~Li3Qh<aZp}S{A+!n{Vg<_?p5mPl({!>tj+v)54+1`9D^e(ufiHS$`+~aFYOX^^L
z=k*Jc_Tj5vi@fpkt)l17f?SmG<JMoO`m?mZ=vDq=@&bC;(iT-vtC|qtN_f`Q(Ul@l
zXiLY+H{YIjc+~*{YkkkEl_bt@wm*vI22F@6#MME`Dd)WLn|H^-t>F~b$;d~>Wlz)?
z#U6iHn}MVKK&ZoOmV>zlliBqIB)@jjBlGG&(Bayc7*Vv`PfKdylEQY|g+|m_7MAGN
zRq2ix;S2RuE8Y#K4l7hA|I|B}f)sTbUK4{_Zi8xRe944g8=^|o7b4}BHH4UQHg$&j
zV<5xQZLKWA9<kG(Vv2@MN@w)*7X_2eaxYi6#R|qL8_C}0;uM=8KYdz}nTtLp%pJ>a
z(Hvw+u_aOD*2EVf>3JDJ>$RSzpfDt$eK4=SXFzH4^^Eq9HBK~{Dq5C9exnmJ`8gv(
zxORC@dsk5g-^1C!&47}x*=^Z;H)pX*mU1{X-1sJ#uA!*t(AiV{Q?cv%Ts_M}P48OG
z`Rj*J1?DoADz^#(b4*~2g}c;am!H!qReXrW4>5j+RokY!xPc-`)RJQvMar&s3f0bc
zq$;gn0@wS-qXWy1{Uh1^u>Mbjn!`70_S-KEX7vY8g^E;3B+(9??J=Nm5Szosn6p@T
zZDsZqPFU#Sos}j;lfx%OBV_C}ZHYac5!&9dJEfxLv{{<T7xBz&KpS0lgS9B}Ccec;
zl)^eiq3oiD^+;J`qjcQ?bP}}l{ZiGlRW_0Osjrh!F&5;9p1r&c%vUX_zOKH5<A2T(
zuWyb&z-$J-v<m(6<ey(74e@5aQw1x8*sac|bZP*#V?0(V-c}Nr-Rzm|G7D#Y-?bqi
zC1RUi-`;9b5>1frv%XMIPIJ$abf!fG=P!^?0Yoi8lVDKE-8#5*+^kJb<Eco5Cfms`
z(s?M#S7UC&=s+n)W-(uY`_E^F8l7u!?Upy#jute^Cx_sP&-z8@_S?Sb>Buuh3t3z|
zL&2s`-|7P;PJEcSVO3w@RJ-*~Y_^tHWpZbc>kOUrvz5fPiHW_ZGBax#)1v#F&QbZv
zc-apV=VL5fZpb?#>}_kW{W?$#NoY}d1;bm^gR@*D=<sYmX)e=Bms`fg2oK{A54G$r
z!*%3|j|W#7_F6Hu=<B%qv@e29-`z)5Od3I`GNwRWkBYH(%&er2Dk+Ur-x=szSNQ=Q
zTV!+W%`^Ncx;~|Df?8&>G-etkN901x?CV4oZ2Z{{lXfl@Diub&ydzL6Iq?BFMCG}a
zK6g=kx`d(5^QVPv&{g|?e)i+`NS7~7QE9w&Cr^-Girg-vb6jbD+gw#E*uLu0!HlKC
z4!}}3+C|wmK&4nnLg_{F3F777T=e2n^eStmm;04vc;?^rw)z=O+rGctpB**iz;?^W
zAH4IE@B3`o<H_e@&%XS8w@a@yEqYKCnY9=Ueg8nsHtDZ#iBomO%#DAC#1&`MLN+z4
z3=eJy`9?j4`R=VU0`IQvH=q=4ssFbA;&5L(c6T=H-Q!QsbBoIPh~BlYv3;4L{iQdQ
zq$aMMukF`Zs%qKur@Drlf4p2?bi0mY-RskgT9JQw20roYOmI;q!HlZpKCuSTj{HMn
zq|^q4Y*NTfhOBzb8?5@d67>?*r1mJ{XBN~{5Pza3KcJfm#PwT_j%dmDNJU{}v7GgG
zAChHeFXknNSPN%K;yr>ggs(n#;XDUwGq@ePhDnqqua{C!39OV)MtEK<8V@S%w4C99
zfJ-`cp}TNt>>~~2(3ljAgk|e+zE$L$H=5TaFSyuD)_D$JA4xOi8FYGME_zqOn9;iu
zBzFHQg`TMsViZR8D=`cwji-A;<C{>eo*tgb1RD);XTpzWr<`MGtsbpMEZnl~W;oo#
zF1(nG_d2;kz<!@RMJXrI?6%Oy{aw=ALe6sh!yJ!Q$9AZ9g5S00DZ<2p$djjbEqe9W
zk|5qFlh&Oxe+2%DaGJLj;x|2c3X&s!&v+d)a}e1JyyNjan&GvK#+Bd_u9u2oDNSLr
zIiWc(_bYoeC~)_2bghlS(93WfHeGbDmuazgu9q!1=40ZjfxY2TuUlI9xc2pf{LQx2
zdi)qw!b`@=X%WlE`(jmRSL&-BC?{j7&gVY7?ztV-fJ=X$<2l_y@Aa#KZvX1U6)+XA
zzs|W;C-7BpS8%(q$j?;F;Y7@#aK6bsJj>a_-Ce8w$K_6_xq6^_8h+bIR{!hvRh{cJ
zsJ*-t|4@-#7=fAnT!VMzvX13sy1(vE;d9j{(w?2`0APq{B1cp6WPK`kLa+kDXj=84
zIJyeR)BiJ0wGkre1C2@&IC-D;a$*5%m${WmmW0~AO;VqjEf`^w=?^tKzuP0_HdS%=
zFibB8Wo6Oa`#OPz(K#fOKH#AM)J6Y%L;M3@3t&X$>mM;6L(!6Bq;RQJk4q2WO?S}l
z*syOiM%vgb$;Kwi@co&Gti_%syjX)8_9xqbnlq&0pc=+T7vZrw;(qt1>y4e;vob26
zjqiMCCg`GtP2;N@6P&cE4yM`)za(AD)`RUnICQ__Fq9uxnYV&}-^_MYf>dNCW1lY@
zwgAHM?W}pRCGIo!N_4z6w9%qa`ZH9Q`|{Z}e}bH9IKmD)ge~U{O#^N9vi%J54E?Eq
z`#P4c=-g{ZDVy6>Ayd4N3d2JDA@Q<h3X)1Fd~ouC*zoPn<m(zDfA;)_-}+@Yqxxkx
zgC5z<ntRgquHb1i-1@{bgT+-yvkVkWaPVAFt;m|#7N9;}x8IZ+I=k1PssMXk%r4CX
z-W{A8W+Cf%{f?cf_~L_&8tPl>{;(9u{HPRT!Y|o%KKC!#m6^_0*K0L_IJP=0dWdkh
zpJmpvs8vNLPrhu75ZV)yJ*^cd!7miCqrT$(k;5hPX?D`H3rW}9DCsPam7UPPcNzuh
zquOOETLaTulf`i9d@9UWw;kQd3o+1pDlQ3@U(XPsheMq>NK?m)?a>{d$1}aHSpdqV
zWV0_*W9n=;8})Zj`-h0{LjDm7iz91O8{K|!qdOSuWKZ#*75yUXOli10j?cRQ%g-Mu
zYxe%x1>EC9I+hD5bUOI(Ug5|W*9SR6R_8+Pqazv)eJ+e7H7RJr=xVAa#C5}CG4C`)
zy7)!mFn4_jLm;<E>jGg3=;wOph$#EE&DmIQwpRHVJ1lacNGHMM(#IQtENrvg2@DqQ
zD+?0ctl*UWpWK!)-?lZggAV~R^km|O!sP&`a;5kQhn^pgzt<yp_P4sr-&6;kr5cqt
zb6?L?JNIML*?#@p0BCQ<-(UxpeN@~S&`>l|ngOvJ37-YU2H;KkSyIHx9w#Zgf@F+@
zja0XRKoA`K;Vj7W!PxA_t~35SDa14}+djX|PflISNvkw-$vX>T;^(Uopb=O{LBqYd
zL=cg7)p97Xc@i=eJKezQEn4rCO!rym`npZUkM!=qI^<p^ZFS2k2X8XM1P|Y5gZ(iI
z%|`x6mBye(sR`C^04H9bk#EXUQKmN|i{+Q_X3{>`CijT?8*cukwWT)nM=|t?{L*66
zcK%p=Nwmz$)cqvoNi)Tv>z|qy7HIbJd9{ac*>rm@3=rCbZrgBvARe3z5Jl{U^b{TX
zJRW@JeP?@noURQ@(Gn5z?8bMu*5%Ayt*IpR-m>@OSb680w82gX{o#|#gHC}O^-pg7
z`2J%sZ`iN?8%m>Ma(FmX5<%Fn0~3c5oX(FMjGF8R(OmOCpp=o>-{*zA^+evX<^0uN
zqZm#q!;R>Th&iJ?X<x_>Va>aE?vuPIbmO_18vDa{9LTlthSL`so)r@8@FTn;<a4N>
z{b|ouzpo!+yZu%X8+pRX1IUf=g-JrnAzw&C%6U`A>q7a)rQ+kL4$$=BS0|zMF(kV7
z=7iQ>Kp@fCsV)19H)3gNl5@^m4zU^t%=Bq`qW+BPaOUj91s(bAcQ?oX5bh+XPg43R
z_p{c|qh;KqTU8CSAS%4@CmLar9x1YvHB&$ZLLMGgCt<=0D97Kf78NyC^d>EWb<C0j
zWo_SV3eK%Xo#s;Az9pLAB&PHB&dHZz8uHE#=QGe$mPWGoICW*8>gCUFzV8$aRJJUb
zw8AND&<3|PveYdB5%-5VjLvmXHFI!5;!q(&?OMC+WVR8xy-`G&h{D1fOhbk9^jH<5
zAb%P{m`Wjy!Y<X?ro59ueY}%dP=If*VFUDHheT4td}H06P**}se_c>@Y2x-Rc@_3T
z$vPLM?4+k-a);hqv0!)uetlX{V_1IWQuF;4y22Ri?&JiCO1-+F^rWezjoPWeS0WZ>
z#I%gk!e@y`TSJ1$cbiyW)%$&T@AqXgA4~eB+CjZyyALNgK33hYo1x-gy;2nl{qiM(
z>WWahAPJbj6VHR3-2fv=;R~tx)0X)x`P>XtSsp-(=qi^A8h15IM+7!67}(MqwI2q?
zes-mQIA!G5KOSkU#-G~c$<f^Nnx!{7Ivhg<p_1jA?|Xd#BbGlNlARenM6E#%bZXWG
zakA;jZ_)T;jfB8bbZ>(dCBd=&g8-4s9!P?I={GhPP6mGrY7i!C4Ek7QkzN3MY`R^p
zFeG%Zrb5d~5OTjHnafPn5?sLsi}=SS=^LT;yI%4{#WrCc&4^+PU#H<*kCEN%XqU(J
z+fjbQlrrUo7wRh!1f2&sqqi7~7yD^n=rY5@QUc}Ma>*Jr-v>!i4Z%zt#V5onagwx-
zr6;jrmTkCVyIi(iaQL7#1=U8r?)7co$NA3uDL~J!{=XD1W(i+)UE`fouH9k*jA7u}
zc(PqgKlE==<gW->fb6!n@{g#u0<8MHUYU?7UW<5sK;A$pn<C_!Zm&KN=`KLv!BhI6
zZw6aYs&1F^zy+F;655WL?42Yb*cM~vv{Zed)%D>h<3^KhtqWgrF(N-EwKLda$i~%^
zqtscTfYV~h04*8xG0bf-)-4t`0o>lF+5gpz`p%M0@#5^{d9pAn4CdZBda^(7OP)J)
zCpT3jG#66LXkIPFaPcpoi;IkHF?~9jFVqib{6vAIQ|f8IaiHU6jYEB8_`N{1R1q4D
z_(`J|He?U6eSeqwAx)?UE}Wk%l<P~MAwA53L>PIAn-U)84g?5dIjY*4>m~9t1EKG&
zo5iywb8iXVyc+QDHbrKNlS%a7Z7fDa?fz_Bv`<kigs6wzvW^_$14XSHEWYj2vZe9u
zg>bh|!L>4paTl6t11|}7Nfi|_BI42CUR&f{e`Q1v+~Bs9qL^YhP20rTh@Q;Qx#DQz
ze9;;+M!vBb6$)rj?u>al+Cx%CP)VDmT%h~@3iyvO^gkU7ig~0VDGUZcBOa#gjko$K
zb8CWiaorOG6WhXp7RDGLvSRU|K4=f0QaY(x)6AIR(*HWtkP7Yx53VmZHBn6&Z?eGv
z?au|aKm(ot)?!(ZQ}Lgif<HpO@T1xb(~ZMOwy*KTkh*rg_jb?UX)j)BrzJl@z;C#R
zOif>WNBiL<+kOc?SWnlbjiH(!B+E@smxnOvX2NnsFy?0xnrxBhw;BEsOa5nE34FE*
z1`3;xg$dJyA;?kz)YB2z&+hm9^uuKR?q5dEQagbC%!8Zr;hjt?=XfF%6r=#F>vfon
zc|KDoc5CZyZxW8WRSA`!1vDh5pXh-8*#Pp_+6Q)n3C|sQ4m05UyIQCPSY4ku4#p%4
z9!S<AM0!F35J4X{Jvi8otgctS(R9ZC+4;;<qyscQtFBZn9>o}cmj3^9ui0@OHA}jd
zsUAjds|nicASLeER+X^i-qI6}Yci6(m>NwgPwTKgmjI`P68WOXFLGMA&0p=-0JqA`
zt_cS2mo$}?qco3uHDbQ;=V}rNb7Mo$UXxyZk2fFG6SPF3QbBCW_ee&A!obd*lh&P>
zi7mmDA#k)U1rSk_<PJ4GT69G!mlE=wbdb2?eGv2{eZtJQ4)e3>)3X<^w||d|X{WeB
zpJ7GQax?f7K2lRPhI?f(Qk3})+Yroy(vFrhGfDp2bR!d6vv`pwu7e@Fj~_l86&S7R
z0h7k2AMf%I{_Snm{_SmbBhZ6Pve;VsRBYRnG?LBc!Wtv#K=xK9O4se)MR+vlpq@lM
z8K{v$HGi;J`fMtmSXrzndOMYk_P&W`#~CiZ4`-ltCjs~{+_*86Pay@pQo;s`9)9GC
z^nPo0GV8dK+kj@OC1Au*sU(K*ghm4f8Y`y9qwHsJ>5LbspMhaGUZXhf6M}{?(WMF!
z5<P8#LjZ;PW^*>nz#X9tTHpWwI8Gn;sqsoSNY$$T+H}5dn!ifJ70>&BmxhmWq2GUi
z^Q4E>H3?HE(SND9TV9U0iaS6dn5_+PyhUGV*_9_`!-DlvY8ZuO2XYl$o2Gc7#8C%4
z&J!rGoIThi$<f=tc{hx~GEFKR{h(5fE6YmTUZO=+LF$%>Nm!kqId0mTLev*qiDP)E
zg=H&I9ej{)l7p%dC$StEIzieJ&OCggdXxV5b{&%R1?C<WEzy4YYwFp*C1t?6G6151
zuBTm3H&3@scT)cv_Duq95uB`6v#CoEpUt#Ve_>$8_M%RpHZoc=7SRW_Z43Sn|LK@A
zHrBX{AFOcxJgID4$F%!p&4j!13bmyF*XHTJDh~htlK$fZ;M4&Mva?($^ZAq+M}tG5
zA)~}iqu?&*D!}t9%B}eVe@j53*|?MQQ?vq#E$oWG$Jo+J+T?DIk@pdX*)QPIfOmpo
z)*uDE<Wb^50Gwkn$M>uokO2Nrb?7bcTSvUM>bEHtH4fC*g<ifCq={i<YblA^pmixV
zOfML#;40`>ae*K&Cm2%N&1})U`l<(&{4+@X`@I8?q-a3m)VgP#Aqk9@P6q4^THin1
zrH)n%Jt3&{w%{QS!?{YAH`U%PPqj<)6fBifx|vg1xY#;yZ28V6Suq>8XYJZ`brqAE
zv5+!vn-(hZ7YiV_4_ay@VZ;U)sMtSeX>a>C(>`?ma2sBV$G?*r+t&x?eZwjgZk|5*
zMgc5uk}WyLxD>_tRAbB4`}$Vf@kgNv*+2#)-M&!g07J0J{|U_djs~N);N|x<XH-sP
zEnS|U1FN^olktD-5MZNWtPh#AwjdEjYHlocOx#7zE*3&%uv(Y@eeEh{(992oL%c=G
zEgJ&@9m~HJj*ounmHO(yT=w-*;KL6rPe<nOINwbj9iebeFWp%k$Z?&)9DW`_od<fx
z&}y3*mU|nrFaFwMzgEw{QO78$$-~C^6z8H!VlJq&7i#4JG4D?$8{5x*M56YwW7-I2
zvJ2QGxBGZ4WP|j;H)c%Eb!l+%0L`G5$!AkmC|kN4naqXLWDxCYNNnog2dV_SZ<<m$
zB~YetH$Ku?Ydy7M<*e?yFXpuNCy=vL+}r;$!LOMt?_5xO?~r)vCOY|gV^eUEL04sC
z(5p$}-YR7?h%&EbU>Z=WEi89&R+e2%2j}#=7oS1ODtC^$=w;SYl}<e;gj^DA$iH{B
z5xMg{N+w)(+fU4<=ZE-1Z^ATSxzE&S2<(=H9DEo|5HhO}8~5x0^*#Rlva2yo*C)^o
z&6ePIq(ay1<1W}1W+t{{hyGDt98*elr&d1F!UYO8RX25~Y`_xgwpo1w>z4aJ&^iS;
zyG{;M&0QPGK&Z#O9;i_jYJa&ym59({se=dQRocP@avN}%w=RwOyy(K9`@&gTHk^1;
ze@5(GdC}Ca#pa;l!HYjn_scDZgTVvc6K4;<Vuw-6=zn(=q$<(Pk5_8Q><7Ucgr^^o
zhtdmc^6Ip*cp*kyW_!foEt{0JJ0{Z426|fqRM}AMor${-3pC^&jMwe4#wsr-JgVV1
zUnAH^+yk+cjoBpt4eOC56Q)kPaAQE&#?*42KO`Qa`kT7>r+ZadnTf>mdS&O`f*wGS
zoGj^wMB;?+y{~9a)OtN?`H!&Ek(d2|#!=ihtoYV5pzLZJS!^1gflh9Fq0+__zMx^>
z9B7+t=*f?A*`VgVF7*`1YK+8#qUShNlXc?x!HXKMR*rE#?Xm2d%x$5V*oIEErtoil
zvooC9%sk17c!{F$A4jsc@sx-?PL{aBZcpt~Dm^x?%0>>_`rD~Qp`5A_^M!*=UW-?4
zbo;AQ5t%ph;oN&cvZKmJgdCyb9X8t3e-x+$Jo^q-NUGpQ4S(A{2V`}s^T4Wzm2-1(
z$ETfb$Tbjbd|UgSE?VT?T{*|9<+bI;m!A>>RoOgztm53xdo7phjM&bZV?OUTO`{*U
zu0A;nOm%rW0Wacmk6@|PljHE}{^qT7lSen<(HL)%%XfzlH%@}-PPzka?ii<@R1Vui
zy(~>&0_|b)v)3(bM%*ljHA_pIi-xkdI_18<*jfBq4s~Di-Gk|8Kkkg(3CNz#u~oME
z9^+9#t?^|r&qz8U^f_R{pbBL1RAv;r|3S?9%g>706)|sOO=NZS&gxjH{f}DjXN^Va
zd^K{!t4l0wC_Lzm$OnsBPhMgo`<HMGL#>w+)2NWzQrt8Z?hrTU+>G?Y6Fd4LhwYew
zE^OyU^*=8*M~*xDroQtbHWBhR;Uz)EHc?@{BH#sdCw~Ov!CFU6iMq?}`w`#XH<mVu
zWg}*c9B1E@=GM6gB$vhx{V;MI6VJP-sn&8cr$s0gZQFmbB~ssijRQcP?a$2U%7bSH
zF7#OU)1u?DMIj#ULA((jn!B-$j2dD*hFftT{@u1Faqgscymo?=WTJat4nW^DY6PlR
z=qpS4d`yehg)dk3SPzH4zFzZ~w^UWR@nmPMi4GmWs`8U@PNk{8S(+QX<8z9N>}<0j
z#Y*kYm!1qS^gDssXlIBsaL7mqm0nw^a2<I#Qf9diJ!HA{9cx*CKoxQ`6U8Fnf9qt4
z#t(&QuhmM<q^I9FLmKy*>E3(SE$gV&C~Q|0FT`Ki4(3C20yQAVaw7lvfx~mB&QhL7
zUnksgUn<Dr^>Z_5IckQ#=(y*f0Tdm>s&{uLfw^esvJ*WY#;%R!sWGao-6Ee&@{kD+
zU47T68mODGO@>zGsID~Ah!LS^t=(x_o57%)5k-E0w<u0~)+O`Q6(`|UQ82^0yKznb
z<yYHLF;LC)cZEYTE}OAj7daImJ3sX%d+}cw8@Bee6|M(w*Lv+lkgt+sc(iV3hhIp4
za{IZwk?z{}j%Z<FUndc3{*SExNP29}`i2N{_Aqk~^v&IP7WpHT_!$A1y?6qQCA6ET
zc$1;(fQDYT5&GpCA$ur~r~YM6>pwc5h4=geNGo+U6Z&Da#kc*}J7PjVTzr|r7-sf=
z$a~MQCbunWR1pO%R0RYC1!>Yj1Qdu$6Dbjp-a)#65Rgtpkq!~*QlcP4r1wscDqULW
zy@w8=1(JL(d!K#w_I$eUbD#V3{tG<H%3Ic)bB!_PnEgLE<~SorPHQ*EduN-n(C46@
zz@=e(k0gaUG;=lpr{8CP>0o}Cob(|@aFseFu4jzfAPnFCXyu-Mdx7q=*aOMAr#yQj
zSptD;r7V%ys?|dM%X%ykM6A##p3i;XSnjSQZPuOH&v4>1emQ2dxOoieZagkh7k{|0
z>HeYo!wn-=J#&HTO#{jFDl4>O$pC80f2X%tjL87Hsebv6f_%Z%8}S<5S=xCaoK`z<
zocOgdKGX>R*ufEF@3qREh0f5yXUZ4!9i@14q0-6Z@^kZ;9k^qa#K4G$)x_bq-e7bf
zb2aE<2qI3ut;BsR)dl-<#((g=yOh&RmT6wiB+c7}+E1u`g;NWS+piD0{dw4y*gRqJ
zRT|U*#z3FUb<m&;X1Py{tj>UatC>-xJ~VQG1}qsXUPr42cgG9fZzfwk>6oa1EPj@%
z&rVO$Tl_gip@>c|!#+QR&XKrb9v!Af$!jOXwpL%v(O}@<3!un(3Ob;Mm1Y`WytUgc
z9)s3i&}8DPX!WB)=-8TCXKb@8q+icgq+MzPjP1w(yhR#iO%pc!YC-c|IF*dlOpM6O
zC_ud(>TYI36}}af=-P<xNr~3pdi|rK%`c^V?7wZ4KMKgIua&F%k&L=co~f5UTBTc$
z&=xi^V81@AceW9HQB9pw`6@({SeyF#Bb4o&`%b6W<LRJ^pvZx+5n)vtw-v2}p0D7`
zT6CXR=x#Ii)|Q5I+UN`CCQP+3snRVr2bP!`kZh%VpE+q2vg6ux3US9DyR9$JPgpQF
z_AfYZMfBfY_CdU7y*lI4eelh*q!xsT^nj{vnvGpK)|0gF$TU(t&-S&Qa+~Un*rb^?
zwZB9SZ{lqmGpxy7X<os_uE4$mLZ2$ZBp#0~<_bejn5oV~?0(95c7A~T+?Q(V0i^K<
z*RoRDGu6ACzRkz#A2sUqIQcXR!l?XgVqmey@n|I)c7conv`B^kNC<G~tKE!*#XoyH
zsdxL9vamX<UYML-JZB@PMz)brYPOlRZkA+65tV(C>$Xjf9*PUV22Zs(w0;3gdI;9Y
znEqGAV?uQ4fyvU3ocbT1^y6~rO!`PadB4)NYtA$nAJz|Ai<XX8-tTuV)Iyag&BGqN
zz1nC=*5O{x6Gw3`tL2NB^IVsO(w$(Icg@$D`K}^t4ttgsK;!X^t8F@sTB<$U-|TTm
z6r{k*uEH7VVWo;QTTQNtvFeiT&rPvAczN%0R9V?LwxyVZpuTdX0XvGQl8s0L#;~T6
zTw+LyhkQK*8t87NFXT-)#SnYVw*_4l$%tE65)3q%5M76BOrG_+*AX@&$(bU-J!a5l
zme2T8_|efPcD^Li&5etsxz+e+^l2Cde0X@)pC$H6s6(bPe|$rp)`*o$%<ZRZfc3rJ
zj7w^~P)YHfJeF~GpXm7aHfNj#g9QXKF3~icD+$n9$Zrdu6Y3}+XEXYbKA!}D*y#E*
zR&q}qBxL?_knjt*A?UU~=ECVPUHsg1v>|YV^6j^b{WY!HexL?Tx4U|C$(dzyb-1Wk
z5hWK&`<AbiiJ@s+b=hdtbd)^LAf>qv0an@{v~@0<5v61p>~-GQ%1CrzC<UmJ%U!-N
z!?cZo%JxP$m7y1AY53+9ZNvP@Yw}@Xkhd&v<yl;x(=&mNBbbg@Uc9I*I_ObgR%Rh>
zsZvgm6xu?Ml)QNC*%*}k{>6wo|DKph-K!aHGugRy)79V&uzk)3?7F1mMAD4WEQLFO
zftA9v-KweH8mU@tK<geXUltZ<^=U9j6JqoI!h9q-RVUMTt)s)fs52ka{j4iVLapD3
zX>Sa&fywPC$ou3pKISg<NJ&EC^u)-r-S*GG(TR0Ocf-3s$Qo}>UypZymr9Iw=dN~h
z>n&Jwe*FF5g1_mSp3JeO$1{A4KlFg!#S^|p!uQP$0au${q7NF<&63_k7gx4ciu3of
z<5Y9<!h-&52=U`Sz@Hq!jy4qcdsvBB&pR7$0u7hrXnn~Y49#>M*PWD?*kLsTgLkTZ
z+n*eV?DA@o)?09O353fVtVZ<Uq%KvrEiDe8;{t_xpzrpYsxRTHn!mvnj+Ud4#46!b
z=bUEJTDOU<L9P+zgmsWSug~;bD<y<kg}NU_mP~Z6x4=4h;m!2RNuQ_G4-iPaCw8;q
z4TZF%VN>0}MaeOR>URDr1Te2}X{w=q*(&K8c&Q6KXfx(BIN7K5p}py*ka>jEjq$P$
zikfcFzRO$*YyS>@4oJ&Fr+b*3K4kHxK=H$kq5CuF3(l-V&MN-Wvaov}!BT4-jd3(X
zZsQWtH9Xqpb-@%#v**cCPP@c|Dkh!tW3Gcz^+5-w?onyt4nHwyetVQtizC*RvvfEr
zlJ0x^s4Ezy1?OwjozxBR{ov_39^d7x4w2?1rL=)>Ix|0{g4KMI&qw6G_k9e|ITaWp
zmsHIzb}Qz0Ov7|n+QoGEj0E^iW8G(NqI+8cm$H(wBfl_Jace<5br)jZlwe8%;#!Y7
zfRi2t<RF(tYM~<qEWPW!>Tt8vS+B|nQ_r*L4>uCZHk7Cy`p=mOMSHr@M0VKotS+$*
zGfIm=f{I&TM71zix9G0)F@4|5*=LS;Q=7I%{6S9;!$27JEpEqLW2L!-)*#p~$jF9o
z-Znx(YGYFU`Tn|8YWanY?foed`=QGVx7?UOvZ)EKvRa93##^@)`kw9m6Eb-I?my&>
zy7WEswc#&nY4wI~<4qL#RxN?XTnB#1EQN<nuUKrCMSvlMZ1hSb7S|}u=S}!3Fc)4e
zq-D7*3JQ5f!-agDx0Hx|=6{G+zK08CFog|(X}lkZcd7)(L=!#Erc=MjM@D69<M%-N
zSaR;&M<peG<@$VQo|ITUJsDo1Mjovr)(Cgyt$qc-W4@sA?`}ngclY_~?Mnt9HrlIx
z&k?l}H7(K0L3snb4(fIpXg;e<I`#0YCe}$w_q@GQ#fRCR-VfWWTbyIJSc}cXm-Ra-
z9TREZ1UotyLLfj_lv?ROyP{57ApbCh5qUf+3vJxou?~aL2O~Q^8EY*>!nGjBl-+va
z1M=EmZ{T9Y(Nyi8VLH1uyBAKE2sIyge2-F&Vz5*94NpM8;DPlw)ztM4|Ir%L`YABp
zn@@;=Mh5x+qBrI_Kkd#}z$ivoH9$nnf4uFw|B&R>HW8StNwnh?3%+KCumUsD7Wy=H
zfo9L`=`1Z{PS~uAqD@|=@AL>o?9UPCAMp4IhW$~K=<c#U&>2#cqkZBOvlnhdc&oN$
z2NW;`jrzewhf0b}85Tx%Pq~l;BDm_Ix_Y9?rIo9FgL-6*F}tmb7kz^pN>DJRze>(u
z`ae9O@$=kmiN%0j23&KX=okC~oHel@B)@hW0C29&j^0NJ_9ie~mfAi>#!R3tKFU4I
zVC13`wHwfTL*xkA)l38Kl`yON-zdmGU(`Q87eD@ZFnrlggCI*I_XknZ!PgnB*B`mi
zMsIE)OqSz3_u%on3nd5QIf?MOd0_w`PaS9w2k9~ern_Q>lkT)<e9tNgTh@MEudRfm
z*LqS1=*hYM?V@t1xO~4D@L}2R&SU#Qb~!MBFA=_z%ou$06x&~fNfVk>w1BiuvaxrD
zO;xUy-FP*_du}e$_^>!dv`vxeFh3SegV^OB`UP|MH^1<a{p58lS^A@iuFQA2gh~}M
zYeA(hv_SdV0+S$<-$eO>owg_fkg+udienFklCCf822HyZ{MCcfCc{K=SnvU$F@lKx
z)fv<};e?nm#F}@M-`NG<?kmwW_RPf$Vzw*p^Du1R=;~d3>;5dLjy{+&@JhF(P>#lp
z<nxxQ4-1^n$D*jyyytEp%@P{4wSA1Qp1$*6eC;22>VKXZK<}S;e0A+D!F#1`EY>pr
za088%DY5>_9(8alkf{ItD}~p5cyCC@bURDa`$V(GEOMU(5AFpWpmk*a9Xxhu@BgXo
z5P0L<GzbQxSROr|54T`0S~f+?fNx9B8!n~mjFCbdfa6S<$99$PeBa$>;T+R2xWWB_
z4?`+Gxv(!<@ZGgcu<yTI0H6YSc)!vjZ3#Yr(Z)QjQ5e3rqh4|2yIC=By$+WUJ^cOh
zQemTE^0vj9wgx@k?guJnpNpdqUfwzlX*vs<VBf=;r*|zns<(e^bAeYg42u61X8rQ^
z6rd+^XjRn5$SdFdtU5U()85~pGs4B^Vci<FlH?TcJY$}tZ1+Xs5=tmfd;pgFKH|e*
zbDlfO?wW@Z5HM($&XV=Z5GjY+48J0_Kuxua-FG<lxM=52)wH<NlZ={e*d76l(<owi
z>M+_r6_Gy?cYYtpZUZ9ANv=WTo@YJkK;xtG8Ggpb`$m_|PtWknE92*G6%m^>JzllA
zrhVU}O%dLi{~);bAo>kMh=mcWAgi<8Zb`1<2`%&4D(mq_yE2DQN^!>&T3-Wl#H<#(
zlFxV*{}-tEpZ#5(^&i(xC#w(UQGYe2kQ)7eXiO<RcO$=n{9XW%(?nLQ+t*Dur*529
zb1@v&wMu3rzq_>Q8dJMaEmJna0a$)GsLbq-Z+v{QUIACeOZyzXE#OR{zFPv=44k{f
zz!V{ktx-V_{S4;)m(BpZAAi~9V&;K#Ns1>^MmVdz<Dt{K1-aX#)SiR_a*a2&pN-IV
zp;IujIQzk7)3(9$SfL!FJ1><oq`q>PGdpLT*m<%P@J^!-lKZ;F@A2vgf;!+Jf$JvZ
z47YEFu|Vz0Hzw{ijEasC3R+UU0^^K5Z}1w|X3rv@I|VML90mUnJ6}uK8h7*;n}|1Z
zos_C{1M^b)+f6@7c-AeoPX-_+WTO`uQyLc&L?%fg3mv%^cm66y{tioj=8=y{_tWv;
zb4U+9>jGSj+}~V{<W6=^`1u0;UiBCj_{@^|+>dXg283s-48R}}Ju^X@uZ`Au#jQh6
z9e8I<BeBK2ADd1rL!Z7=;gN<lz=Q(f?#cqK3qu!nUSF-sgu}K9jGCD;u+-r|<IS4*
zlLYFc_A2mHN)-VZ|FNF=v>ZzCn`ToJTpNZ&3F7n0N-GmYx+OWiHvmKO*H&ypCvd(N
zuQ4;T*Xnfs;KWe?60o8AI+`N7lCv2KCwxI0@O3dudHS;{z{p0Qi=3#}!vyV69eS}6
z%|Aic|GoY@@<cIMwh=a1qvpa@o(S4x8Z{k;TRXzR1=eu~!I7_c*ED=la~=>J4OE(g
zHVUq_3z5>^)p!Bq)o_u_IlcRZ)p?y6vRk1jv}|sONcRQ68{u$BB{7CeS@KBj5;jKE
zgPS?b+vC!};JtZ>jUVzhv!BP#g8$_BX6R-`D3X4?W-%iF`EajGa$_qeoQg6O*h1HQ
z_p4SK<`ik_2}ffVpS1HPru*m&s80m&FL1jcRYX|#@f0X9XQt#Lk5+cj>lJwY8;S{S
zqMj_bjTc=YsAL#Z1?297qcS8;Lh|?r&L)MXtutpnBv3;YXR_3XaEuqWP(K(DfKt=)
z>BX-fOF02fDE&r90sLE)p+K91@Ypee5Xu=F7iYVW3>d};NNzQz3AHr77_qSu<sse4
zC2R*@XwaOjmgEDWzs%N8D=^VedUAqObhHQ^6iGBMhh6vcZ3n(aZ+s)!xFk?}U?9%g
zJn1%>9NDnVMT(4ZZ1^8d^M3^ler}|5*tFuumOU(ocFVoj2809GTkp>Fa9(W>j0ir}
zAt?bkb4g1C_1!hQwPKfDQi0EuSc@`f<fh=;6*Z>zNfWqw0mFJ2z`n4+n!TX-m@20;
zw5LT!;bP8$c^SqTGaT(qN?edl)%Zuld-!9M=CHwrwiurJ1^wp<#Dg&JIU3WkPO*UY
z+83tobJI|N5mnH=nvs3N4*Dh<-wn&XggoqYZFOrVk!Iph@#OPf4uxMB#H}LFn9G_E
zPY1Fj=cbw97YA{IN$xY5=||p)`t2o`tO$J`(_%=xZd)jqlx4?I^tR8&J*nrlhq2RM
zlU272e0H^E@>Dznqf+xeL|Wz5Q2Miw<;kCBbn*l+jjXrL6v!2(a~J937XT_tR{Yk)
zS?{%y$%}E&L*uANz8yj>h>9~5;<tgbG@JMQHuMtcU}Ga-AMR|qH15?0z`vbh1nDu)
z6_)x{iK4Hl{J!7pgqK83S$BDM)o!;%<o?Ir7W$bqyJE{Z{;4IFeK-EWp9Ev-e+WjO
ze-MnN@*H)zvKlXYh6$scmj`=gwG6=VZrLSny=aSgomQV*C9f1P$(c)=cj4VbB9AP}
zaRRgT=z*+;l|1mJByncI7Up(KoC1rFpfX@T!~l3G@g+Z;AiR?4Ew3m!hMg92E9yLl
zpr|<-zcd&KSR4iPgAS$|8phoK9d*R+;r;4B=2}ol?NNqzjBx<P<c*YDMwFJ_zC78w
zMI4g5bLOTSHTzi??S$p86SOWTE;iqLrJbX9)yR8#IKPSZ?77v@6;W}u<Ap?#dL$J8
zI{yT!6xeAOKvHVS-2pe#wEix&`(+US&=PJJ?XCttQs@Jk#(}2(yy}av<^p~GV-AJm
zdNZ=31D($WfJqUqj^2;%ln(!9>UXLJNwd6=KEPct8XlgRceh7#yQc+wkpd{9B>|-m
zTEx-r1(9K;iwY6v{zR@(&8^ka(J%QMz9i`y4b^&!UD(0A<xp~F$(u>8dkV8;qx{^y
zeJV#8wXBmL4l^n<)0-WtV2^RJC?mIViu$b$DG4KPCslx7bfy<u-(PMc-Sa%&;*6V5
zx|V0PG*P2a`Sk{Tsxk;L(m>d8Z$jkc0LHPGdqOg|5NX+oc4756LAkQHJa^GoX!#A^
z)iVbT$~-R}{^)Ms-1G^8=u+HVcq;h1=)c6=|DH`O0S$T&eGkjkosS?|Rn}UFm0<k^
zqAO0A;BQ)uoW^Y9>h|YvHBYtUzJjH<-)mG9v+RAU{Ho~9jBq`On&<R$qEt4$@~NAZ
z&qR7smMJ!b^~d>hzGkfr8Q&Xp+LG_k8gjGP37MUApLt$ga4!Zq3n?&deTBh~TUjU|
zBMeD(ek9izENetXd?-h9tJbN=#W#PvSQDKLGg~VBk!MVJaj2b}iw#JMmfBB)hjE4=
zX(v3ht{?kO7v{w^?X65ApI5sczbiZ3S;){R?aYxgNI6_!oIaW)XjM0qSyk3fzhS{X
zI_Pq%O;P27AcPR%`ogLd8=`2bX&Cf)62lxaFSAuT;i(gU$3DbBWn^~ZsP;#W*ZyX*
zBb0Ao6fp1dKf^|o?R7bx>Q(E#+Y^bvY)U%+ObyOJPB<oWisSm)PX*lH!Sehc9zTHT
zQ?G*K+?muLtTyusS<(2`nmYP|llf1&U}L<&<V_Yx@mwT6Sim^1#I`k4XFyxB;wb=K
z3uy}zIcu=$vESg9e{k9)TgO{?o2muy44|JkCGWe7UQ$yXIdNnzJ;zozUItiUJ-zGX
zH5-mpL>L_Ht<eGPM+Vet`(Mk={3u?oFv^)d?^6*AH@^4waAz@n>(1y!@Sx=92V3o@
zk65VBk&p3)2RyHp8-jG#G|a+4{WBw~Y8^EP?*-CnYJz(68nftW1@xkG&8J2J*&>)|
z?hJp{ZmZa+B?*A}9E*6g_Ol3?Aq1_~lXO<5HvtoyxD-T+Z}os3n@OE3)iK3+Q;+^H
zK97OULBiAv&uWbX<b<G<QKXR7Ubc&K#pS7ppLqShtJ3>LC&tT<2BWpOuSL0D(<D5D
zEoH`I2J64f@F1)qQIzdU+9AbZioBH6&vn7f(T)qmVLDRODd{dWX$B#j0lR>j&hXMF
zy5743R@r^u4v(gwRmUT+r2<!XA{ObzV;7Rm_w1p4io+X*UYhX|JK@C}oM}^SWYYq^
z%ZyuR=3)cL@~*5C29(A<T8tZjk~ML?8`ndTM+TGLzJIViKN*GyoeY^-(l<4_Yzpx@
zh=dZW?(YGFh>!K?HMcS56i@Wl<=!#9_38ODBVD*9#KS>%xyD`#r3SvTv1rusBms9T
z$*CEX{^0^`2iWYk8<qCR#L+6t#zhBD+qfg2VM4i+m=-^G_(r9jx8&i`a()Z5S2{r_
zLnYCG`Xh_?REmq-InGZN9A-0(+I=Lb7}_fHpK$-b%i|vm0MlZfplBY(S2<gF@F*>8
zyqC!bqs)9;9c8V|f{SwPl@tZ@)ZBil<jL#QYqLe8;FJ8YYez6{G0O6B7`E3SE$f}Q
zYl!i-BGywUyZ*U4D}Q^jJYys*HXLnH5+I4OVc(<X1RZ{V3lrD72<<+wzUB+Gs)QaK
zA9gMYS-pgAXD+6Bu@%JhjqIk<8A)&+V?s>V+O`~c*9WrPbZFlW*}Ba-+m^ntdNGZp
zTHlyAPQ1cXUYcI%v<q~fw)bU@N~V^S46L8ClyV~j&~NSu{cM8jPWIZy4nk9K>dfp{
z-N9T#nnYXguT7&?zrG9M@>A9A8UA(x*UGiZq-^`Yycjfe;|o_LNJs}&S$~oYk}N)O
z{~^hKY)wA?o<8^qbzpE)5L<u{WGOiwRX}U60Rar~=fC@4dgOEids-B-Z;w{XyCB(0
z0gwFDn|dFcI(Q@!>*F;f`2x7wL#fg(3AUuU2iG-DA!rljr`Q8Lu-j3Af$lT$EzvNE
zFsFU9#6hdBQa`FG%nL{W>4yuSNNaMgYJ;8@p-^|kx&tS3P|%P8>axBTSE|n7Z=a1y
zLI{q3gLD5alK=dGzVXD#g4mPoJVg$(ivn5g()*4@ET_3ykizU!Uf-D>Rh#s;3#<_s
zaE`W$i#j$Q@bXqD0UWu6e8XZZvjHch`6oi`>go%+T%cgVMqL!3{#0vfa=7(f5^NMN
zZgipureiHb=SN6qREOD}9AuSNkN>hk`JeA{^5e%le|TWbdk%o~zrX?j;otHa&oyde
zD!^gfY_mO3Fcd}$Z`AcOBPWeVQOoeY7H~SSm{U_-SmHt48D9V_ZFJ(t|EDA1@6Z5%
z11CeL>;nfuv&`x3h1%EhbNY>y@{++*bL@Y%_XIC%aEY052L-h+8w0*asC+G7dsS&v
zW&p7T;J7r1!V10pT}u2TL+ai9q4h_*b<A#$U5}Xu{Jr94%$rl*1d!L_X-93%g|#c!
z$*x_v{`xw3$aSuvD;IQ9BQD;#{4{&0;GRgx+wNTPyLZJ?&E*Q{KAh(5p<;Y}{tW3O
z&CjI0USw<f-L;EQo&C9qM2I7`gTr<;a#GqZ$F0U<E%5Socb9a9&2b0YD(epp1fP6S
z^~P)5oq!tBs{S@3bRkCo4^H1ne8zcv9eoq}1%Kif{DJu9_0wdJ?h{eJd-c=Dd~qUg
zM~xE2Wtgb1-fp)azDK(PrUkVa*LC1u2`UWJIT={BU;rG?KzV*&`nq~=v#D<9m$E=|
zF(x1!O$+nxD8AbLDw|~i4)9iKX`}enA}33m2oZZ4-xA}-6=*w;U``ftbt=Q!2|O>p
z9~#98p>l@E<%gFuQpJikho7S~7Nkof2TYqhX2f1Qo+@z->g=mqMObx3Gg_Zr+QQC)
zp=jIxy_CN%kmKeLuZQ%>MFV^-eIO5=D~aSd$P?)NMeDpCV+cMhsi^2dPqhCS>1ir0
zwjaGg67syU2d@;(&CDC$1;Tu=rLOPaz=!%dI4Vw$E)1**9nCr(6`_7}1A$e;ls@kJ
zzi?@?j-FkHdqffKrkYOZVmYnaC6>Dx#-l?$P_83`dI<vCm-+li^Qc0KIASI6L8Xo9
zr`g291tc2T10!+$IeiYQ-uz}G24;n-<BIzy?&bZzThi|aSqB%cXhOq92LQhM>G9Ti
zTdo_6YXaz-M2;(Iq^<O4QzaDu!zOUw9KvZvw?#oZ&^$?B!1=pX*k)ouWo7lAWiO10
zdD61;k<WHMrgGek6m}|s3=VLliDWI9u%B-2efE5lZ$uLRd3m&+5-o*W$Mt~dP##&v
z&XYd4f-V|H`}d;FLAh6PQDVGPcCH<jtEe?Q=QL;r6g4+({`_b*P0Xs1I_fwHG5T4}
z?q+1i05h*#P`G%z_)rjzw78=$T0Bg2#@?&E?lX&ML8FMXnuu6i0!_P-b8o1QzvV^v
zoj0Thpcs)QP^?1C-!HI^4cUQU%i|;X1Y;cV+x$XG>)n>1f~Bw?hS@hHwGXa|R&ukk
z0;4Qsb-m{<qTxADn4H85dY+HsgTKY$?yjwrNYJ>ZAqywzEUV;jkFGy35IUxpUbx)$
ziADiJp3sorEm@)?!Wj|jy3l{qts1}lO*|9WPN~#=zkM=I)Jr~@W1lfCdM>Ou5r!q<
zK9CnKElXG)k}lR<=}4tFYyBpkg84GbdGQ&5Fo;Qv)C;T7VPjG_&gt`IhS<_X$*7A}
zv?kaR^uA{KWC0Th-g5kM;{xv;Z^Zo#rFqNO_^VPcov=LETiTP&)c!l4`BQnnoid3)
zh9kJ8Q;1Ye$?M+2sX$IPk8=*t#aRlSqz#Q3M%%55Dl<XfIM85&?J5({?=I*xnX)YK
zc5ez|XI)m{QEQV(piKZ(e$pl&<v&Fa**j?y7!PWiE8qxpBL+N$SOPCJma+&*8YVHX
zmf#>71LFfXB0{l4Pk{K)NXiRh|9hMMw5DG$8774?B^s~8!~aK<fXyx}g%MX$b*T06
zQuqO-RRToDKnQSNdg!4bXh$B(E)c%`RM3kmL_;M1y^``M92;x_8;L>#M0j0>;{P4!
z{#;guIv!ZTjz1WGbuCJ$^d_$7S=zGj_7lDjwv(*2&5^IdE>DG+gd(MwybeZq3i>my
zZY?(?`8b3~Z4WiT8MZ{It3KoG$W;EXIQrLB)jc6zSH?kXR`RTKtiKxc=%#hP6a(3+
zNd*-WJHMm1n;B~8{*dJ}=;+;Qeocwo?zo@G))`%#xPuKUz(yf&;xhAo`{k+W1Ma)D
zC!|6n(t-AX1!?(l5wQUVVD{A`YI(Cp6L0QVg*dkL1#V;VcX#K^>@Rsz)1)Wgg`nlg
zwatdX$b;D|{c(-vRRlSkHoD(NJ5(*|@2&JdX+iMfpRVYf_C1UROYb~RngcBPQ9bfk
zGaDWyYb|EC=W<9po40;qk@{{9a#}Vv^to2D77p5)<AhcEGz>G4RXiYqsGU+0W+Msu
zs7zkFcdEa6viV&@_|4k!ymfvS7SvvfGZgvMfj9&HQ?&WVSE~C#Y#D~v-S{%_2hy#N
zbB#VHX{&aoLM@E=#1ehaR&#;0E;xKhi8=38oqCi+;PfjhpRM$BQq=9fCzj|<yWj~{
z98SIBG5EKa8o(|Xi<ij7>x5duu<eftOj^)+-lfbpSRSjDi=RqFU$gy?*Hsm9$f%KU
zKEnxdj;CpVR5M4J=<4}Y8w&Rrg%3V5S%wWI>K*in_yjR#feL<`Yp?sYQqpTd!z?R!
zce|4;cyUE*V5Sx8uVaq)He@xE3M2uir6gJEa<1kpcINSjs~*AWMzT|L1z^cQ1piSs
zl{d*znbq~&HRCv(NW>^Gv*DHEZ!at3{&nnJIo3R<A{zttBp*dy@kxkkuSi`%EeBmX
zpIuRKncg5OrlyqsA%9>fWrq=?0wl~+XC@&En5s^(XSd?|V3*BRckwuLu-Of;SYjPw
z`t8QOL8|;1n!OujOpE1orOSfuVLAB$k8(Sg!LR{Wg>MdOpj6AguxGh91zWn`_T0Rr
z6V<L!Tkw+NTdbtK|KzE9g=?OIU?5RIgt|Y_^FJ5HDF`1&|Km0I`J<qaU*;05F9#}b
zJkMmEO%+rT*HKl)T=IpPnssi0BWT*JQ@k9k_TgrntJi=<T-=*y6rdgYK-Ej0#W<?S
zxX(~e@y8!K5=0Q*W=MhPs&OA&OhEG;im}@2*>RTDbvM+ltY{L@9F@g@<{@|HulJ&V
z-5T2lJUJN1@ytrl&Yazr2M@%F_=uig{PdDH6wa`gG;|y6vsdv2mLKZ$eNGs$Sco=O
zvZJQI0f5=JEQ-7)5!t1-M-ARh8AS^p>|#~cOKjYt_RCwO+9!^@zaWhYHpZ%c`Dhzx
z;zhBzqMU`{F7EPbK<ob%sA#lqYv*RKxXAjiadeWjQdv4hMZ3y-7kT*-Pe|Ghov*Hz
zeoeopHqo0T;nb?+LmumaeX2d#!UPgB=(l{n@<glxV`Z%WjjVb#CNB$I)x~d&KSo&f
zC#w!t2vlyq-Y%3%(R3)sW3M)~H$47DVD-BfdH=+g8KZzQSb}-jI{-sFQ~))3Jk1-v
zZ0$svaba`1{?KoO*gm*tf4ZgZyd(xZi3w|NtL$u;9G+r(e>vUhbwX4U@!qIRzXg(;
z$lhd%Gxjc1$lYu<rbUy1fdMu;wsUL(R_&enEipT4p;9wJVCZrG#xWb%V=$)lA@$HK
zd)}>kQd^n3B+c1{<8N5>q>%(f8#nasr);;ls#xu6>?Mm)5_@BZ^67x>A~=&8`Mrax
z`O?vCnL~1>tejH4Vcc5*0hq^_sznzX((VKm&+x|azy$`4yj19l_oZ3*k=RLiEXe>C
zHeuT0JfNu^dln>7&Ez{o@puDH6|Hh-JiB`JidW2$eT8Pl%yxTQH{J0UrmcoImADd=
zUX?cnv@ZZ3-<X}36Yz1BScf5b>~bsi;umXYpRyILu^i_Y?ufwkeX+AFv2;j`=zI|Y
z7wkNe3B7es+R12mUbiad(w(9FB-dt}`BwryrAg3<N$fIga=CT>YWHx>*nF-VA17|o
zY2JU9@MAJj#LeMwh!dneanw~7%adDPEzMo6>(RL~sfV`-<-1_E6^CE!n=b~z$6#)(
zzp5^@Xo;k9II(OGsUeu=MD$zQR(g=01*SW3g^7(eJUZSwp<@;Xt6s_t%O0L(t?dLm
z$ah5#VZf3lLsr-97JYg|6EBBQ4KW7<oPKwPI#fX3+m;e;+4%0wqeR>sRg}21v&aGK
z-V7M(J;%YngGP5HGK7tsS2cNX<?-O;iv}z<P_z9Li4Vd+=d8*^_)#r|Z*`LP*<K1f
zvZl)IEOIG5kM{x{|ElcBgPUHp*l>%`qj9A77UU?#F1My~6<aOUX5@%1+h$?$aHOlm
zV;O-t4bFMaIyr<IM;4tsqpQ*ud13_piZzseJJk*azgx}dczYmdZ&~#P{umGEWqe+)
z=3#$DXHd^;ZF}6&w`8+xBK*!s`T6F&tcTlF^ZtY*8Ql`>xo#<UeiTI8xaPUj<WUTC
zc)ntu(fH`$;iz#pKY)ADw1*nwKWwj^LH3fBf!%xi+Po&p96j1s_Ibr7+-0uhuo$~z
z-SMA5Tu|}7rS0--aGexFYFwPY1M{IP*;dj{cCVL3^U5S<V?H_x%nLv4uhq2neeAJ<
zL?Wv9t_UoJj+-Yd!GAi>{ihDmp(4W=U8OQC7+`@^Ex}h6f-C@GXIer;IxqlwL%H*1
za^UmP%HSOC(51XBr`Wk(I1iS0M=1OiO8ik`e6z%LyS*aIuD6dE=c`ojwKKE%l)viD
z&7`SYGZk^X(d*TVQ$X&eY5maRBBC=shB>?Xn8mHE7Igufw40&FTpEkE+|;EuD-bSt
zdk~qV3qQaCLMrK;BaC56&G#C%1?jC;Fb|2h6JZ<LLa6l`*{eGvZOptEbgeCbaUzWc
z7UVTI9T?p%P*qIhg52E|h_jOPDsv#{R!Jk1T<V?X-?4aC8F;of&37Y`o=O)@Li=%x
zS5n9$u6b^{p`#iUV%zy^K8LxkH(rX6R5^wdw*0n_%zgFYFKcU8D@U2<TXrbcYz<%F
zE9Mi83F<gSS1*r#bLPSHb?h-++*y!x^*svkCFl_&N%SOcFYb-S(MtH8iO)>9MB|rM
zcMpyxZyA577YD1@{i<>?VP}8kD`Af5_Czh^tR<x7&CH@lKce4Eg~$b|nEC6>42K3O
zJ!fbdBw~}U7`9R&cS`6(7_#w4DXCV8A#z)%cPS+p%~#UM0~|N;m6t$T&xsNztwL4B
zeRfwS#*jUt=(w*rNPK`r7n3jPxaoebF@Fo_tb1D@K3#G?^WMG~?L>9{^Xk@&<VPVp
z{a9jqJ4DJcV!d^$WKg&4c|jAdJ<qq|<2b)n3Vsnwyk&3Er?O$#g`BE(*bvanPx-$7
za(}nIeI@GqkVTxKdM!4+dv}p^f_`z)K;HrPYCEHBef;oXN|T<^vDzj<%IoEDaV^md
z51g=pXO1dT1?5Oqhm4sI_aLReuI~8x-1~Mo2TImynT$^K0@J{*<bi)xI%j_&_RI^r
zuPqA+<8S>As*wi<(06E5^so#!fSH7<@6nrs^w_<YzUpe63BN5mtR%J9n|J`A6v+(1
zoODX$c#I{J#hcgMO^=u^KUZw~Bylq~)yALV)14PH-8X2!%3ehs5-yGAdkHPzYy4R1
z7U@{eRnu%XdYVN1stpg-X``YS^D%L8QL1-+`wdz2-*!D<+l$qA;O9(sAN#`ROz{17
z=rh?VHov$P#4{=0y29<gvH3M?4j~6h_mVs7Rlw*tb46s9G0#ODDZLeH2pQ1C)x8y)
z7=m{vRC#{dUq+;;^H&|euZ8az>2y~$GuXN0eJP)NABy!-cBtS(s)jqeg$fJ^%pT2d
z!1yVA4$|6{jPU5fBW3}f4ewDSoEw+GhffN>ym9fw=YV;Q6ZD^ACFoe6__JaZ_VjU4
zqC$<SP8_tLEo(&BDpg;|ow<_3<zUq|CM6Zy7wKYNjk1##ozlDCHyF?ADfL}8|4gZ9
zqug_#=TsWbelG2X)KJ3=Cp^o?AWC%CxzBY(`+Gtk8~`W2C`wvcI(FcFGY!~_sCAAe
z4>vTQj!zfdi!sK}Sk3QE#C`8f>5MAbN6U^>Xg&=Gc9_T8-C?T~qpo}Vj!to%>op$x
z^G;6BD-V4h+Za{lubo+m8!&|WRG`~<+71^}G)kdMY;CXz@!QiDIIM-^N<SiS^aHNb
zvNz=jot1~4kQjR|AY8NeA*)?ebbVwcms<gMjKKLAIXY?hC~N~lZNpq7zS22QMNA;h
zz}pE5-RUe_>K-LCV8#b2#7*MX2X{5;p}Zu_n;;8<fN$FKnzb|SED;iwmt6UOlL&iQ
zDvU7-vig|s2R*Dk!UbCG&p^$-x0U5DvgmQA3d&24Sjw8BXO!S~*RT{Q6{cAeLgRwB
zb;g!jo<RT0P;6x9O+gNBX@+U@#yCb+F|pQglh!6Mub46up59eGN@^i9!SevoKj}uQ
z?aWhdcnk||<Jcc5_7aZO$F1eTzV7JGC+uEBR^NKPKV3W3<P~d}vRf_pXft9Ql<e;9
zp^9UzxP*@DGlh*zJIzn-`9ggz$@tR8Zh!V57`R_K+x-25Ku|-(mkrJd%S4hGPRZrW
zaUMp>c;hX!SoGvE7TSI#&KT7cwkzbmUSQU|jhow)X^%=Ngj8(A>bs6Ijzea*r@^bn
zC?l_A2cLcdzIYY?Ixf}~Wmu-~hzIZUfql`)FwL*E3}&VtmOdogvuL^j)1nm~Zp#5g
za`$1ou6gsyFUxtJ(|$nrReKFyx0~KDwkWk7IM!<I2VIiB(V=2S<;*rVvlt>63O^T|
z*H`<UaZ4=qg&BR6OfnNc$xVUUIm?@3u3xB3D^!n~6M|qNab8O#;<`d)K#WdnOLH44
z@II_#iOw4o@IPwmhN??r@oq8NYrC<xFtzz(PmL>Hpb`)<-5UgBbD{$bVvjG+b1ktQ
zu?PA%_5>NdUVlM=i?EYGVA=)dUyx%Re2^O}?E#GTPf>=BHQOs`zDBkC$$7532f|f2
z>D|cfUa9?C0>e8c$s7AE_)_n+cD9XE%tbb?5w7c7X8IswRWYmevBK^nkQOa!P}x9Z
zQs5Zp2+i3%3(QJF9u5>*UHQCEs28gg7(Qx|ql*QWRP`9?>R#O=0o85|2t+T|OtAx{
zqnBnyW-V%lQ-S#odU@uX``|D0&sokNw()B@^3b`OkBuMgoSRai%`mOjK4h?5+2?c3
z%=oY#>0u>8*nyyPa63&?_HxWvDb&?%OX9*x7j=>=xopwPE?)+YKt_|UCT0mL+gZd7
z>Ak+BmTdDeLG2luc4?<p0K<qpNP6qB_vPCK{ozo8-90IfeNnLFaz9#6adlxQZb^Rf
zxTn264pco%JrHlZUG1^c_WJCFj1Lo1m%L{$iMbe4$FbUF7g+9JUgayBTU2~Wdrdpb
z_<QNd*Q^*IvzYcTaPA#FlsNF3<W(5dmd~!mGK}8~Y{_cTsH`sZ6YyX}xrcacjy23}
zt0syL8e|!`jhC1Q>^#Guckv#bje^ZJmnMz`J(~Xkd1reQ$6^TM+R|nd1%K2`ycdY_
z-1jRikZu$9nXwZNRcmc(3fG#vpvF)0NRdk)gQN~$a~U1hF?<V_sJtoE!S=AAOB0c{
zu=E)dwAU($<?_-&!?NY~GQ-!0&x0{_fzzBISB+3t5Q$KUC__<ekPzn$v8G2iwl^13
zox*TTVLrT~Ma^*rd%(nMCEOmzkdl;H#kseWbEq6Ov6>J7>uYT@t?qOC;ZSa>Hff@a
z^3G%&lr0tih8eNTOW^Y9s43`@vYdJq<ygZ6zQ}R8$5Tfr{-9}`QRtVDgH9wFruHd6
z5fzr*lU=*f#DRtHea%bRqQ=cKh#95xR@x`^P#+Zij&*S(6-#7XJO=i|z|iobC%2RR
zwY?zNrFB=lIE^gThXpgZOo3&WoCu2E>$Lw1Mmq`_-W8@4Q4bycKv###wFHrL(5sPZ
z0KNiObNI1y)ZOzCD4(ik&o%#5M7??4Z$9x9#gt}yLskbTVAHQC^nU&MpZI(Zo&k58
zZE=+s4ME+!@mZZRG{5b;k-V9Xh9HqpJ@0OBJcD2TBmQ$g`X49H<*Skx%u#j^rSNzR
zjKdHhFuBHscB!!J<LJ7}WG5%HjCh-0-j{cE%B%oCAYN(a(rlgRAt<V6i5g=Sl3abv
zf0PrOaCb{2gQSwPLf0xgH&+#-J+q|n9G$N1>MCs}=xLrEJdeK6Fq~c6Rd^MOdM@13
zEoUC`nakX}^#;F0*eb#y`6a}5jy0o`ox{#79$ZNX`U2+u7r4;uPb6Q(Wk`#6fn!U-
z%VPX$7mD&F$s0<uQ8TV?11dkY+P-LmFs3k9v!WIT^UwV9(z~1C10XQ-;9703^i$~M
zjf=v+T|v08&h;-Z0Q&d$Q!v*6tVR@}NnlC?EjByjBQ-Z5Pbj<Y&e%5&?`5!(ixk3>
zZWHMcn|gO>2n1da^hR|=G5U#bErV6ebQGAFOQ9+~KjF4NJ>!dVCWY8pSuAHIx)23Q
zYjTDxAu#PR_*K_tc{>Sj>cY6xg9Ht(RC`<5)w4SO1`C-n4U}|FVh~%_&4@ve6vsG#
zYCZk>>&FJ*K>0dEH3BjE9{^{5u0ODKyEW?!Oe*-cHi~|wR?a#+?b2gEtuIY2eU)ob
z)zuyJpb~mWfdia3w;cf2$>SQFxzHSOqB{?s90V*IH&l+4VSzcM*1rm)CqPHt3@NaK
z9O!XW$<B9oyG@VM@|<_WWy<6~k=6lt?wMB-_&d@C9{wM6h)wv-u5MAqW%P&SsaARR
z&xL??--A_csTHK2r{Wvgkr(!4epSEy5uWN~i9Nxj6loyUGQ7kv9ycm4ZXcc~_o!(|
zhBQLRisBosOkKE+GP9kt<zT4z!hyKK^-^5W^zsbGBySC#_;o#(+{vK7CEx`6mNz-%
z{^^nYBLFHZpCI`s+=P?O$pBKNEGTAdDQ~>9jL6=)F;KiciE$?629f#YwtKI2Av(Ms
zHqnUJ!=X=-KKR8Ln2q53!MtAmDNms%y7J$?aP;r%PF8>@V!Ey2VFm2VFb+nQxX6?7
zqerw`q7lT;KA+MC#*eN|4>b%L1*hNX3<9$(tU@$aBU_m9{Xy`^A@((6rQbf2SHuCV
zFRajTC4H!zot(yeNEd^BY1N@xDEefs!J9@MfRpq^8LU<L&MGml=s4@lB50pPX&}av
z1{J~v;K%ICV4vT9`FC}K#HspSmvInY+!ZO&eIay8MJ5WEY9Rk!kecn>tWtqwC6kjF
z_|W-P{|!1jyB|^UTx<Oa8UoJc0OX8qVlf^^rwChuT<I&+5vo;sVZVKoult#jev~j<
zij}kpod}W(?C2{y_#q4_h`7`C=$bsb_^y@VOVO=JMkR9G(gWtBU?l<?z4FE0@i>?h
z<k7!2`tiE*LkB^>1Hog7%jS)PbI$~}Y#teyZ91_XsHaKE%%ESEb;o;By)SBMk2!P0
zN{Lqp^I<-&&ChIM2*|~jU8Yi*zrqdP)rCC1KEhsUKJlFLhB(7B1PJBh(*Aarm9|D0
zGP6}ux$qI+`k`D0YuVT>35W-5i-Fk~1#k%u3AUXsJt10!kg`jU>U+Zi4!D>K%2cax
zK{eT@V-nfv*a8uLLTHmPgPcc6Z~90;=DDRHX;j4xEJ7L=YJ7|2ZG!0qTHg4pB)ieS
z-i<uMeoHXYs-cf~`sCt1mKEP(MYA4IkL*?RIRpomUH;NS4`{e$M8{T^(BbPGlny$w
zhc5IykBTaA2*2qPHKD-BR3J{q^pP*6LC{i_e23`{tD~!{Sd^%!Mp@4A9xOjm+@UmF
z1>8IrK7e%i<;ng}?2|*zL<cAIf&K16VJ`?0TY%{<1vzD>WjZ&kRns^+HK!V+J>iTb
z<_~dd8lhjXkvB5Sq$6!Lhr5%54fk}}4#@W$yYCx}BKeQ3n97hq(vSKr!KdtZAJgiz
z3+yJ{WjKbZ6v~4Y=8S{L4d(PwF<#bzm~#u3bMScC3;7$6)7^-#xf8KKznkAE!bu@>
zoq2T-welLRfG+Gh)W{3pnDMrd&6oHUe)~tbkfA&w##X41ycjT=UyHE13pT)L-yU4b
zy_&TW@p?SfSGF_bYO8^wNd){tnj%9!M;yZ2e2w`vpGO!e^0YtfF2*DU5BNBnrHBd{
z3_Zibo*n!)5Ir(6Bhu($LFg00YTG1!=&(^j1QOibqyU=irtJ4l70QOD4^A)OskasR
zSN6WP^9zu)GW#wFktZ`?tdH1O1r!OG7r#7G{PF4ta`=rZOn~mu?1H-_WAT;WeaO$(
zQ(04)n3I;6>mK)8FE(a)po_ZYeEbc=WH{m^q~bIQdV0Ua+yDH7(tf&Wlb})Cl(i(H
z_C#RLHUm!7N)9sLR;j8$JnYcx{f^0$R!mXXs!^<}Y*2b2v@Vg}h$S-MR9g~#?i@QO
z2^&ZhT|9~01!sUnZ~smqai6GxIz9{^lq->p<;3;qNQf}pVzWC=7+el2=wUdmW7J(&
z9j>Uh$NlJx!=0_5x`V!ppd%{x1oPo;NqjK2NNgDo0OEb}|9T-4fER+W6~L->kD&8<
zoO_JT*Sw>Ll<v!FHwTrDNygUaxHI~_ylEyYX~_be8M+|5uxd&byc`u;W1v(7!u`va
zpQT=^5oWElbZJ|PpSw}c4+Gc{S#VP-G9vq&bQ*n&ieT$Of<km>lIW4H$l?qR>2bIG
z4{UL_oHA}y)RjnFs;HZJD{L9Kjx^&VH6EK^2ZEE|Hgmp`zAE)zV$d0&o4V-iMX@%h
z9xc0}lN&{*lXBh?o>k*yHiNhh@g}Vb&gtul69{30OPK}P=T)vQPPb6T6_j##^_wRt
z6Bu%T&GDS%&G`8H8!=Q-11xFDs&RNANJzI!O<6Hn5ErA)m#KY=lI4Bql(N*+{Xs~Z
zcoK~ct(JH)6a49AqnTNzjE@=pFdN72O7Y6Q82sG7id6(R+k%!7dZe$$DF9AB#%Xz}
zInG*p^1~mmCow*z+KZBnJfN~H7~W+K6z6B)$W=We5*9izZ``{4Vw8pDp<qcLLdpeQ
zDCPptskyzqzpKvtOvz4oI=LP}gbE?)BZ$E^3yGRfC3m2eNot~3tY=}V=arWCrm{K{
zB6Z57l|5ic@=6#;KDqz%xt;!wPlz!9p&%(r`(@SuN;5&?pHA}&r$-;)N}!`_=Tsf2
zLqTl#Rke7Da6PuzfS__oT)Qu$40*-Y;)|`wIA*G7k(us^r$>X-|B@}q$domqNe(zj
zKFE_#k9WVXjI`E?@|A#CINZbEka%RSxXC(J;I%n2+*F{Rzoam(GCO$sF+qzdqTHaY
z>TWB`*OO42_}ftXr<Q^v9fbPO_Z3Qx0on+2O0hgEUCt0)g=mXL)+yE{;YHiG#>XC)
zWRqXUW?Xf8A6SBmhoqAnEyKn4zD({R6Y6Xmc}szHmUIqp{H_S&4LA{P01NFsR!zi9
z`~X$*uWLcq-iFg!J8c8Q>l|`POR3!0>I<98drr+<STO6qLCbard@R3t>0>E*fd@l8
z4%3m~d?x3Vlo9lJ8Ep73#f<++U6}?ct(<qqa#CcO^?ibpqw|tZuZd#qy5NzJmv^{6
zynn}d<9fX<u^xj^OHdOvi=d72^Dz4D%>wXbsjBlPP2x!7O)-<v>Pjg~=&?N%^)JuJ
z=|sU1kxL)$EQu3wRR3snyW^e`VeYvECr&pl(OIawQuRoWXGbn2m7Q{0^q~`~QMiSr
zC${{y$y~-3dtmvTU?IHHb)+-6TTVGqNg0)SZyA3wx9+z~3f}a)nhr&Ig^-8hLsA$T
zSk^>q)rk01{l~vu4=HYXl2XA+l;)4%uFzp9QhmOcY9OLc#|HO2XhwJ2v8qS;W-8+S
zaXx`B*gyX^1^^)$$cv%!SxK}wNEm)8TL&`=oSA5Dl$K;e4uXo-ROFZ}pMfN7i1UNW
z4&o6;<PXRXvlBS!SYiQOi9;xxjhtc>nengXte`H=i4{j<=&HK{?=h>8z-VCSA4B)<
znx~a8Ns|pLsU3H4U+%dh%DT6pG|4)Vp+zoZ&^X?a8C-YIh=7TA0Sa=p%-=?sI<pfP
zz~Q9gPqqHou1v@-NlWMrmF_XnHP1ex{UjQ3hwH4~Ct4QpN-21I+rs%Evnf8*_2`+C
z;oeR>q?{>MMop|DJAvYLy%-QKQ3JIDfb!tsZ?g=o!pHq|=Y}QNQgmM?lzf!MCnn30
zsZ#X3+$s5JcKTBtTV-3pooxM$tfwGU?Ln~e+v!@~t|J3!9NNd3ao*1AQQ~M*nq5x*
zL&JQQ-=_eMlQX<KJ<h3ex4U(3WAaYDjoldU!&}YF4_|~yc#)RU6FD@RZR<pdR2el2
zwX{qV6|5;-1k)i%yzB{MPhH(ygJx5u@0^@wgoxU~ze~zMrBcJ`&k4kZ5GA0gS;SBe
zm$oPmU2~|tVlBfa-Ke`TMyY*~iaw2U=EaNzZ*2ALHjQtqa$KsNb&vUlG8L|&Ib)@~
z|NkaSV$1=$aKnO14XDi77B~VC-fADBMCgsnuqv%h;!Imq9$WK~Xw0|4Jp}(s<{l#D
z@35Q^Q+F#XTYUjgXyjPsSNxQ11TXs~WI#*n1$G|buJDyQR#b?;ulrDEK#J6Pf0fEs
zt+n8`O`^h-z4`axQ_7dN3yl%UOQ95YUf>EOpgbjlWOzGN%%d#AMNv$yfWe-&fWCdr
z8W;S+AJ1N=fD9nVV&_j&xId|3{*xpw89r2fo8UFMUp1*Uui`l2wJ`CD^F(R*U$s}8
zoJsQ%d>5pI(R9(gJuKPC_#ctd8?yRG@?%XwHUh`l+)Ss%3#hzSw5G36>evc%2A+|}
zG{rIWEAt*v0sf_QgCLJk%)Zk6t(vRP1U$ER+NIW=y45&qN5|KVjPToo5!)4i$g}*e
zB-TOTWeUSi2+lYX`~7#@NsE%m)twYr^pVyB&HvevFE}abl?Y7Q(Co!lW(9pM>|#Ek
zX=-Jp6Q_tBbD-KS*YBrz&DL1hlH~uuue9=R<ee8fA}~Np#p;kkYWWNvDO2)V#Llds
zk*Xb;`E0J9(kl~uQJ&lj(8IL^>h!@q%vPTMwWJ9L)k!;|k*dUe<N9})&nivZ4xI3Q
z`x8a29mn`<tAA)Vfh)1R;|EAIS$de#68N(r$4f~|vGmxRo;U3l40L$t%Z`@d!R-7H
zv{_jH_jvp&RVdtZ&8=wK?r6Y*z|>L2xWrLI5n?t*8Z2>JI;4a)GCs0q?pZj@lPN?m
zjD80YLAQX(#r#T2Mi@D)HZMw;dlstZ<w61VVFy7h<4Mn5qT{IPaW^l;VeIKqfaR-5
zKR!?Z@wPDStT+JUch=Qk`mA4Q_gRNbI`4E|XcvHCbr0tSps2NJB&JvCJi%ZeyOPT{
ziA9~Bw<lmzUJvCrn7`!RuU_N;{*^?U_YR{m{~%y~wGWPR^O^{4J5%cMBtg_J#`$=w
zCH4&k_GLv4{*~uY1G8pn`9|#g-l&5Bh4+s)?N_u7v}*SNuwOwMEi~T)^YtFw_|8Vb
zhrEZ?#)%NxySn*D?FspXwm#4~xT^H0<IVhyxI~A_%+dWnp(R@IRCbZ7K=<(OSwOs`
z&F5CLGTye{4Ye757Nyb-%pzaeI2$-HdBL~u%CK#geOu8AP18ztk%Pqk7^F?C7N73C
zRx%h}aD1Xo@Ho0Rp<TOq2p*hd<6qyNJjf`EgA-O2=KD1W{W-vY$aBVQ_-d*i?X+4P
zk$|#063ZaEZsWUc7Q6e=hk-0lyQEjb_#Lt*t=4M}K`~Y!yZu7^ImXxv{Ni~@?)6TF
z**}N&x-eG3FCf<185u9xD%n2S$*@vg#JIF4yC=uiYE+cit$rJ0B^4j<VDkvIGd?j!
zIe6VTA7hNRyji~W*SY!Zu;l6Id~X%&&kY_F#?>EK$ItlnG&_mtkjJ=tOI&<)4meKi
z1~sY2d33=&?Y-$10g-6&%upKh;gGP~ZpFOM25x`5qT9Dna%H$G?nJS(DJPZZyPMe7
zL`O*TK9JeqC+vU-nlFb;Th=Ky#-xPqt=-OJ!i}c2Js|PPI^!HyHC7T*Ou=W2oq@*r
zfGWY$hE4aRrn$!_XwdF)x5PJZj?^CEk=w6wSaeD=X9Vv6e9-ofK<TeZF1=gxxDBX+
z#7<b>T_=w{+oF|<38SXz?l{9NYd?BFsoAUDYesJX02Z2k+ybpeW>+-pS;V3Llpvdk
z6BVHy7bu_yY4_B2QTmR2-J@$w^GT4d+`LG4eTgX^_!<h38foD!RO?#6=xS2ER}zhv
z_YN-HBOcp2K5k;I=ZCfi0eXUS<HolfiaP%fd+!+)RkpQ_Dk7m(pg;s96iG@1L6QW4
zQps6B1tf!jNX`;VKqXTuQBo<0s3gfb7ddAnN|7@ZsVFMkjop1t_j!-~-5>Y<_{Mnu
zIB*OGd+)XPnrqJagy}iuvp+m~^)R1gR}v;u<(sf0P__Q3HsA+C)%flb_`a#lUS(mw
zBC}UPa9!_qLTtYOhN094?3w+;-{col({AKP?Ek&dslWNN?C_Gq74|{DQ~|@_N1-nL
zru{}4Rn|Fqw|)Z<QV@NTHMiT9K*<1sNFLkzq{)YrPKPx1?UwSG3+#SFAINw2Y&2vU
zc7cq(k!KLb-PFsZ^&C31OTJe%x!||}CYFC&$486DuC3D50X56><B1uzVgKOcDDlaA
zni8|{g@y@eHLSN4>}7w5)H{B>DM&bM-4FY**6~2k*dQ9Zc{nv_&COzn5WNMg7oW6@
zC*ET;u88Prjh7?x;2**8YX%F&gPOc$lYVZJ2V*nw0OC}H!?f;p=9W$CJPVJ?dIO@Q
z`RX+`yE7HjQTA{)aK8YsN&H?bdp+l8W?7FUB^<5v^5;*iIV_w3<9atc6+k`(TmFY@
z3y`V&iZV~moj5%clbe&y8Jngq+sDYMt=c<>Ya3p5Zf276ueT!CvPJ-TxqfLLY$aqT
z|1M!WWaa?~b9yQ%E1U@2;L>3b>ze5`0n7?$Aw7aHy^-pFz%-RltnT0(A;|8ADoKCB
z;kTB&h~Y1@5_=`)dKW&@!L>gBy_);xN0%5*keI?ku)Ir)KgpFlRwh|oD0}f0|JTnc
zk{>UsC>NYk;r}Aqo`g4A&m<GlM-SQ{Z*gLExb8Y(7s&K?O)j9nt?LTnnRM%9&g_hz
zXLmk!DD!}YI>9R+`J(|=1*X@yV{3JdV>1AtnXJuh=Uc^LuZ2JfJBhAHP)KamXjbJz
z1FK<lVM6UEjg2(M=(!HQ{I+5!+9#B;5uGCGR<!{9QwiyL)@V1|nA}0O<}@aw5I@H3
zSk47Ma@d~~pK`Y>JtzBgr#DH@*rNp9OT={%*yz%fEfM3tR}zsLKgKL!x;;|6d#(=n
z{i7s+SwQY^&$MB?QRZOX1l+(E1fbnhj+*tS$^G(hyMt*4ro20EU8gHxe7j4;_qYuw
z80%>7t#HIn*HYZ~{Wy7PCcnpcnFW)>@f`ba4KiQvRXZFefma81->NB^@HJeX6XXG-
zUn@oOui6|RpWm@b^L_+_Q^L&4ALRZA#k5oKv<btbT%hG3lzxkIUVbpLPVF<{Ns`C-
zN<08ev87*cNwSmQuH;G(^LXS^CUC1Jh9Dhz>mhN7%WK<cSZw^+qp}hf8d%!F!l{eQ
zqBs`rkjGG$ow=sa?gq~JLQR34z4KQW=gpc9oP4d*b|dej-6|l?-uR`O>W&X$q(Ars
z>WbaE-^parJ*Sr0^R=48Zno*wqAx5|?-Cy7eYFtOTG}j|sZEubShSfwrc4DGhY_ae
z)lJ*Enb9m*!IUSg{l(6lgUN%l=dpkb0=cJFcoajH=}+wA(iP_;tAx07g4Je2WJJ~Z
z1>f2{KhzvJhhzg<S>si6EH~A5{8Et6s<0q}IC^$?`8`B-#dhIH@R>mrzCMuv-#DJu
zMAl$X5gj)t97n_ItGzILgIX&{Gvow#_>j(0&&b95FkkzbutbX~b{1Yz*9$=HhFx~t
zkLISD{$51_-}(<z)|;37X`_U;h*oU=F?~5<QH;zV#IX>&#V2WB27B6Bhs*PXa6?N^
zdvy|01(H+tG}J|>*ITtr^m39#!MrpKVVG}`7yy$I5=W*qUEv8Ay8wCuuw9asO<Y~S
z?O@9Y?R)vxOWxgmeu$PmaM4;fIoI&coBqreVL`=geHK3ULHe-5*L^D(=Zg<YJ7K#W
z7rw6>f(>-iRl@V~ZEn;2fNVMLv&Mv;))gZ3X*xt6>P*8rbF*|l`DT)uaw4H(CYDiR
zRhRvEr?O4(Exf}bDkrE_ho;#^3CO_4BOe>s3>f!K*Kh_M<zOGB!SH4Nm0qWJeH-8H
zi(MEs_T4BCaQzmumf*jM7Oe8jC%HQ$gD=)y%b(B^&>O8A>eQ|Cvt`{9T2xaOGEpm#
z!*llIn$4H&Wi<(d#Nn(Eut9I3`4aGFJUXIp$yS6pU;A6vgMW#X=O?Je)Ey_1@j+No
zzNZ?_e5JC4n`1=rvxczC`XKu;hQ`-`i)QHyN@~Mmrw9>zqxJKh>yeTb`hN2Z_Is^k
zbLkIP3zdu}5Nt#1zY~6Ma!~+tO`(Eb23w8`GRJ-&eai&3g7CA4N(rV!EUao5tXsE|
z3ghV-G^_p;=yinFaxM_`-w|0j+BaN6V26yQToSXY1H6ZND{I;VaLa9SRggY`T%t54
z9y>3j1=kp^CE}f8mt?jS7Kk-oGnz&}{F|$ZIzN-$z;?PHtQ)YLt)qp}`-=&to+=fE
zhp_@%9>iH{*gY72Iy>i~>8P8W|KS$kCNYU$nA9h@Lo;iYFt%F0ijqfK5O;xT=DHrK
zwFd=<%P-vP7<Q~aI6a%2SgTsg=gl4&y~z5|cjvfI|6mlW;12jSD|-(n&-CM)7rOWD
zTZg^AL+3xhS@?|p&iee8LbHtT1jZmeiR|iU_BJMc#BGUt64%eWJ1+<*$&vD%kJ$jO
zt%8@;<8C&F9ftr{5k<QzH}P~@*AEO@$Gu0{nIl!qG%ctUcGiVHX{UNBYRgZtkU_|i
zy`f;ak5|A=t+xWd(BDaXV={k(79r+4kK#&5s43K3U#;=*xp$oXlmDR!@IR!C|0n-L
z|8l$ZY-dbG^{5xWp+m{A)E!3cXMKx3sfL)~Lw(=i0=iu9fy6^x>DIZls{t;))oRb;
z9$0(W7#igq|K5NX3Vh>LJ7Y4_T<hFbzcW23n+EIRoRc^j<=eQm+)BAN8F7raPd7UJ
zS7CNiqXCMdYSh$HJbv1{EG(F(q6&X7kzk5LG2rgZo!!413?!OAy1}wE0Xr@n>dn2%
zERU=Y3@q1Ydu6@b;dPbR3e0lwK|7Oc^m6X-Fffsnhim`FqCQ$5PTNPLWthQqnzx6=
z6nF9IXqV9H{HwO+fmk8(S+jYXm`7odS2YcoP^9EDwCl|gWM5qk7*_@l*ihPkA`)~8
z#w?P?*mYsj^&GLHwKUlgCHNF5$ZGaSGI_|{E>F7{sr}x|`F4?le^X7ebpqTAeaCfy
zk4)Fir4FI-DZk)vU6J}!MRqKgs%DnZ2xw}j#YZ6{XOO_=R;(c)&*xfb&6Z0Kj`wd_
z&cuA_R$!5`^#LgnrC&~tnCIszQB@!xvvrqLD&DMA+2YdRG<?$**C@)vLnxIHj~|oT
z0C@HSz7^h2=f4gHm|&GQ?Cc7~;|N2ee_Q6iZFzO&_lF%6?rrZr!b-7rdj^}QVS6J4
zf4aWQcR-FAcOjI}yF#4TUm?US^C)VEhZ(%x-XrPcHbR?`Iw4r(jY1{$)lu6~uWR`B
z;eWcw^U>M|$+lRV>^eXNqF7FSpvZ)>vje&7zQA*9a|gUIh}08%Eyu!efle>W|Ma`W
zXr7*@|M&LGy}eye+U1yX*K$mo8l0koX~)Lt>p#oTUXXtJ`jbyE2Clip8h^ZENID}y
zQJ;|9(#ryUbvrqwl(8GF;JjWYw5~9g`S3s|0f6mRX2P3532O)Q$0wt9eu=;QPKyx0
zE=2Z0*JMh7_x!-IWZ3k$EG;>LE1jR~(rJb}36gqzI8?74`)YBKXm@Cgbk0U=3ZKlF
z77<yXgfAs_lRo^vOfxKk93D}=t(?hz$vo~&O(gQ8gt(@8{XJ?ZgBZ!nH%8~*e~FW7
zH&11;Xy-^PkkLbbtpaNiEB4bb#rrZE992xxC5k&uyTTNyum0RInf$<%f_D}tB<pxv
z{|L38e3JnV!1^ASsoQq#_bnc{5PExya&|eqpDDvZkuf^{otW3{^VC&uI|H(<K5612
zR{}Rx97mY4v$KOY#}9yEk1KIw%lUgP`gEPc46j;gUwr2dE4ZL3Y)SQ<O+ssv2a@hU
z^*TwcrpPljtvypV-eYmzxj;*^r%f__5)x8wP%BrilX#~zN8uIIi^hx-v{+w&a?$|i
zoz?cuh_G~c4@fUk<;`XrUwY|eeJT6yF>0KZX8-B;j+ogIga!`^6i<KZe$OwL5L!3L
zvBua<3w{OeFC7*lcQc>^`^U1Jhha0SKEbj>N(&^Fd~}2Ho>BR3o-xzprzOpBqD$6{
zLXJTZ`Z$(I)Ot+BmH6LTPu$?n+22V|bZT`&M)v<qdisNdBJyaVco|{22d7}cdk#4$
zDMSMk1Y}Y6zPg|grteysmrwHt-Kc$dwTGjP10l9Mk7^=2){SArfkHwyOm+VO>XZW|
z<`5(ROP0LKoc-P>1(Qa5k9=G+p}r?wh!Cy22Rav_ZoerMYea?CoU#-|IXqpsfmE36
zP64Jz&FyQ!0eN>EDDLaOyPp3M>-ghOFrxTRgfO0PvdXT#-bc5Rcx#sFy5q$D)DY{u
zr+>P$Q|x%mEhwnfqIJE+C}#o^u~vv^O=(*A#u8rHZq@BabFtPOJNgZDcJhBa_W#?l
z|BJ-;e}%;VD<uB^KuFBdQL4zU_qH$^5HuZ(TToQkHjc5yN+el+VVxEKM&l!S?zpSH
zfs@}RDnC_;U6Xiq9_bE<iAf&w<vY}L2Y0xo9X6t84>ydha|>0!2ONjQ#b`?BP5Rgc
zP~=tHSG)ZilnbO!sK=L1ezo_m%k9K(mOU_!PW1-FkX<5Ld`c`XZQ;Ii)9?N`g;r=7
zfx%^O%lo7=j0-hcxTI{3r6wNwaZ<}wA>m}I{39bx@DdM0z!9=)Gst)6OU&imv}A&@
z-*4QKB-fi&7F9{yaFR3?w)e8|$=1;&zNe9GQA+GR8hydu*roav#6Cb(7#QzRHUog9
ztI76-wq9%hlJ45O=D*qRXlwF~|2Imcze5RlmlkyzPNRD?&&#6P<T_yZQ6)eI=wk~Z
zb2~hS9oW5O{1e6xbfN5$$BSUEVfg@^(9Ci^K3O5fA?gK1-8+b6GYR+c{2=#QXlYmm
zo7f{zxxlf1q9sexWl++fpm=@K;crS$dSv|v0Kady=+y!4dmRc4CihHATZ=j_jG78k
z{d+-AQ|7!TrSU=3?iNXb5+OlCX*7#Z5$Acx?EF)k{xET=SJnJ+@aC|$6l*D}=-!&V
zO1~jWc=D!Slq1xU32M3e0cMd?5!&>&Gs&B8vry{-c8T)w$VQycd?}&QXo&2rIqlWw
zQ22GXQ{fjb2T;A0D@2rIcFd8BW*}DsNWwE8z<gMf>ZU!h)Min#SNRH5Pnm>y6!P5k
zC`mm2`WErI>y*bRpoJhfN}{(Fh)k0y6>goavPTu@X|LK6BbVj{)`$@4b#1FMhU)Uk
zHIqXD1{3!?N7H4s4++le{r;MN*Umm5hG74tojun4>yi7dn&$TTMS76*g-8yPE!^I!
zoe5I|9WaL0NLoQXI(-|BHtlo!ovMqzZ8oxe*sF+;x2&%4l3nZ<cd^p2M~+d{^g|6q
zly=oqJv9Z6gD)A!vTYcI$`REyu{^KDe7^$)<tB}DmBJR+Sriut91ogV_Yqor1>oyQ
z`GQa8RBb7V&!4*et827TO#iOlaE6fPx{{d?3-j%?`)XDN^KMVezkWE4LtLs@FxU@S
zQ)G59dT0=baLSaPH;3~(`AkeNgoOCjRqsdn#v|~UZS)9iCd)nmalI1XDoY4kXcmNN
z9QEVmI;sfxsD*r(WL5Q&|8YE^o67hTMT!?BS({qOTL`4~b2iAV6_NEM=9XP&9?>If
zez=$@>9!b4F1y@dm0L1G6}>5@YB;$?z?TT2+o@m09W8a--;!DXWGBD3@WqsLhSB22
z)_Fzt9zL$^=FlsUAQxQppOvfo-#SBzZp{d9FI~ULtCn~xhTF89g0Liu9>#)rlCB~E
z#2xFr94MhhKL@!4wQ#0tWa%^)hA?oEpD4l+t7CH=N1vP7Tpa$U2-kNwSa<Dm3V0BJ
zjX7EX8oZk(=UjRuZ4!=0h#Z6oN!YvXG}CRAOy^;pznLUfT*<=)3M@?FiuEBct^t!$
zmuBoa<p4*|9fiar1SJY5h>N3j_t|zasT~<?yXCG!y)Y?r2l1bt2tRtRd>a{Gi`7~`
zd|9~ZvlcglTV+_N1ODFT=+2Z0X27+xTRfqLxWB)E?i4h%wFJa)Dd^}!zt8r^?>9P|
ziRGWG_xJO!8akGEd|x^P&L_d<pkMX|e8u6ipu&o>Q}C#Y?EKmRg3-Ixd^)eq{AZS4
zbLZxxrBQvG5p$up=NC};25-|FS|qy!Gu#wI*D&m~5*6nTEOn>9;N03D*lW(?6NzOg
zA+)89rRL43!g~ebmYG$AH#$LIRL3ISN*E56-BVvJXl+Z95%Bw?LliHK3(LB6oMX9B
zZ5Mx`MO0(%q7}UHbiGso#zK@kTBe0jh=t0MT8)joBQ7Zt!x&S>jkjZRP~ffyqp5Gr
zSM7U%CSsRliOmaE`F_R*K%=lT$u3W9cB3avCd<BbW$^@tV5UFJ?1fbl0x@lkbUM}H
zz&v*Fz3IJ?nyR%ZrvTrIjnavZ7G@`@YppMTMtF5-ps!N^Li7A0_k^r-)#mL9*=3HY
zHdD4~*qXy?9h-r-CC0{S!v0pHRg<s%eMC~NQkmlU7GO4gLo?&id}~Vw&duuU;WS=8
zX_4B5Ug*Ibuf@NjFNmZ@Pf>m}@*xvz%=?80#Q8{2fD%CoHXncKXrAm5SK?#9cdNs?
zCkdbP&TU83F?LI8gWorDXzuQ$!{`v@kG(EgU!=&VnUBXO{hr*9x%WsHdyH$UiChSN
zt%;*|3msUKAA?#lnMPh4Vi7g175n~;MXONWG_eS<XT*5QqXg4apS=cDS`YKLU`zF`
zli+}|CqZmK19##>5}4##m+OuKgQtzeVp-i~CYalOaTC~-2e6LOf_!f0wIo^G_9znE
zdStT+5lMBUGriHg=bRqtJJxL+xULJ;@wT)<pf?{bBKUM`4mTN+Z3&Eic)7GwJ-33q
zr4qeyED4a8-d0E^8-jO|mXq)A=S97%(kXvoA8xn21%Mcw>J%3!V#DfC;s|Gq9?^FT
z)(>LhLN4x~2f5HGQE6CwQIoD%zY?Oq80k$d<gyc^CM}C%6vAbX@_A$ET9vP(Ce{qK
z63dQL=rpBED)nfqj&N5h`^8~<X!HWLQ>nbzrzBtoOm(4ILy!tEDq9=Q>svh^w{Sgw
zrsz1BzkQ3i4e11DKe<Kh+w$6?3|O$6zJK5|%yxDMvo@1zYI4{i(_xihVpNM6-im92
zJ-c^!#oZSB(OXL}yW1oeH{S-17i7Z(ql2%V5`jCE&&qUYoMVX3&a37WP&#>BKKj5f
zxJNPuw}DYyYVV*h!sEf;OxY?Mu)l-Xh|c5S{F=p8SN#5{M{S(sCxV6zfUo<;!HnFs
zD;DD4z`9E}E7yi+4i``K>yKZ&6GE@x$MoO9^3?aIkL$MiU$!@5iOIS`q^4;X7sWt~
zL0kH!*FvsF?qs@3vr5Ma#!Z|Q)q8dxqho)b!#bSX;a&*C1K*{oc%70r!V?Z<#*(X_
zGaNr>CyYdpn|YhXMG(WRkqP9MyGfzz9}H<@X1c<fLS(~131Yte_hOU;#;p&w-ORuA
zV-qtX-i8RZD)E=RE0bA8Qx%jL4#6*~+<p69%Z2J?LBcb|^V;#uTs-7vaK0T-U|55e
zAXQYo+WF(IxhyJ%9b^GKlg*cLO|qt7qc^QIh_<|jK=Y`mR@~JSzf_Nd@5UR-yq`QI
z9Bz@$Hcz47gn)I@wm)XYi)a$vj&^w=^hlFw=4xUVbUKspr_xmNI7g(zU>}wwUb)n=
z5DY$c_nxVm{={A_QNDT77fB=|Ip<Vq8_U=Q5+Jm;={8CBbg<|W7mJMmees?CC_PjE
z;m<$MpwNGvL2g~T_0^C>uQNr9Q}q;0`Y+5zLL0)~^@vOu{;tFMRt;hVri1!$`EXkb
zxVKUOc8Kd`0QPfYhp7J34v{J2B`2Y!&2D#)E;Uv%K56KOs?$NJc@)_4BioUG#%(*>
zB#X$4oV-!ImreP4N(+!?q94h9^>OoV96wt0bx)|NyWAm!u8PnPJUhs5;?^hp+_wgS
z8$<%;*j3R#w<)16;9kYv+lbDWFlgOx<u+6vtx)NCUn@_4z3u5Of|>v7VT-_$?~K&9
z6m%9{<<SRnSeEa&J>n3S!=JNtt#<J%-&#VSe=flsJNaRinfouT*uY!Kw*d_B0gaGf
zX#ECVQ+UINx!)U4w2U!;UCYgWFvy{wYYwjY$T*`|{lM}`YX1!;A-^Y?p^c0?Pm)0|
z$@jG^mZAFME|Ei@$P|q%R$hL1*D@+ec6Qbt;EYD}C2<1D9Hy<EL*MQBdKL#c*Q)?z
zmUXHpVMzTtD$Gh=v_;DS9SR^nnU1J4=JYchMz*>2o}JgrV&PlI(}e(x8E@!RQ&M~G
zji66;Q#5g|z$zcQ*)Qo>xzbWNQM9-(9!5OL<rJpRbV{w|=;qa8R{<RNDQs=cRA7eC
zqE{*S1(<hfr?gS^m&*2aJzDwH=|sN#*FVC{b9`Yp@<S!iuL*;VopVPrF@IDDlI%3O
zv>R{Eb%W$G9<xOW`&d~p0$9mKXLP!iBAr$0=-rQOT>Axka2{1-{<S@uZs`DvK7|Rl
z*$g(JRG0dZF{Dl?s0o2AHA97|@P|Nn((Nr6ce1FCS-8m|KefpaK%0EJT=Q5FhWZk`
zz^3>xAg_<~#6*X825g!xa+R#Cc}(xTW0=HW*kp;6r0C*pb%|`7KeP?}Hl&X(6v;f=
zQ%Y0j<{7uP_$lNK+fLSZ?|kwZ04f+aiYl>}pY{Y&b0w5ZYqQ`*DjbN&CH|aSou><<
zB_?im28PW(Z|8`YvEOEQIPW`ej<gZ<FraISBh;HmxddYhes-d`e*D^RiHD~?IB+=K
zw1)y;lvZ{^PIm?85;`i2CXGfwR$MKL^-((Al@H$UP|M~fe`5Ng!8USW*%QaMo&~4}
zG6E)`TVw3MdqZaanq(VsrSDj$0`Q=$Ngw=lLcY$6s2Vo)HRrOhgK0y&r|$aYnsrK_
z1^Eg&io&JJ1SMKR^dmrOEXN=}u1jSeV{-P<80H4?{hcMAacROC?PR|A00Ti`$K%&o
zf~aJb=omQEm4|h-=oji2vkC~nB`qJ8>}TSlnLE)n9Y2Z7=@-v{p?a$|kEy#B%_r6~
zymX3&W!f#lmg@ZYIk<I462WMwzR>X)zCP4jFwLRPc~<DRLe0TQj1J9*cpjD%A4~;F
zrsgrHpc_?Bz*9)tn@Z5zwc?2OsL~}>m<8?6-Z0fkZ}@`Wwa-+iTz;XJ35-kmvjq%L
z=7hP(lzO`^KSi=1yk$;x`v$atzh?;iu2rR~w3|Rk9x)cY6VW**cdJ={ZYf>U=6jb^
z@{UcntQ*cq^pkS<;t$MQIU`rbc9kiqjYZ_rPo?VGP^$Y$M^*99H0UpZ<o6$ej%wrp
z(Ck+TacH)1q=yyjjR3vQ3+7%ou389iy+U`<gBTZX0qjoNPN{<LmQg~k%8`Dnv&`AB
zH0itv|4e_thE$I6@!v7{KUtJOsSGf=rB`m9So3LS6C@R3Jy8oduI%Y0Kmy@`ocKwz
zw*7-<P0{!lnzcBI3u+LNg!~pQA#G1gO8+H~o0c)W{_%cm*vaf8E5JM~VqvjQYbAjX
z|9veoYQz=8{a8?8M<nZ>{KQb`*tu^M6<xY~AshlI$HgJ}AFTN>AN5Lr*#G&y*k4QN
zzi2C!%?eKZP0K`qfj!!yeO7?;<#@mPiUQ(EUXIX+e?;G9CFWR?+<Ou5ERP9@x3{-&
zz*C_`iz!(HqXfM4B8x!C!o4940lUTE_uCf+>t1=3IPJ%Q-uL~rO#RDxu?IGTPK+jR
zoXkCPUqv(>D48y-GKV-u-32`dSy7Uma>F_JS?vCtdt`(ZMsW#fe4#f@_1yp5P7hnX
zf=C(Sj`kUo$A_r}Fsz6C9v4p_h<~>&e*PF3Mgeg8*%W_DFADL;Wl_%Km&GGqhZls<
zuvqp0@~>CVnF|u7N9Mco7+kt`T*`0TAA_0(n^zi4CZOUEri@up<)7gfh5=n~WIbB<
ze_rAD@9RWqLpcjXfD+We5VT)C;URIkqTjSC+3D<fUnsRpyrejiUXHZoYOEJ&(c(9K
z^uSfEvqcOaB*f0}RUnJ;Ul95SpJh(WIsd`y7Wl|cuCVxa83BlGEY$|U8aI;!xTuHI
zzZ_gg*|AWzDW3+^7nq5rf{^?gS~Z6x5JI-=`_iW|F1QTt3kb?ppf+9?|I2rBn)1BD
zkDeiDLMb79B>YnceX7{Fz1OZcUassjIJA%@=m+C2cR_+=1;_z#QHZzh+R<ic0`DYv
zqZqyYktu2U8vwQTquWg^9T+UGqyacY=5^mDIq_r-%sOcM`EI@yQ?3_w3aC|m-2aa+
z<Gk7_hd1Z&G3183&USmPtE&f0LZa=<ZzB7(VwBDY>}ef@E`^sQ@jQY^UESHU5kv{d
z3h;BeSv<mv;Rm^Vkq0y6lh;?3ZZgFvyNpOO2KY_VToSr@ck9RLP+Pls#n9Hz!8GdB
zdB{R7!92i8GEV?rGh{xmnkvP5_EkwK3mt%FHMsgo!G8xeye<U-Hu5tDx$9hik0oaO
zBu}ClD}k}>BmEp)eZUN*u4bw6C&l+qG_MesCyAK0s4F2dKCfE?Py+x6?_)c`3`4bR
zv3VT7DiWi85(-L;AOYy!lBa-KNB_UuO2ThjerZo>a;^`p#pndHg;_y?0ZM2T7UJ~g
z!~`cZ>zDDSiS`fjwL*~+-YOGDm0jn0X>aHbKCZ~)Rp0pK2GElX{wyZ(!D*I?z!*u%
zt}v^QCa$5~QZiq&>w2p<dhNKs?J2EmT*s}vlSM`iBlLe6n_t&IrZ}GsRV*@!$J+D=
z#{)t&NVJFOgUzy3uk>p@`e_{scQiREjV>D9^7H%C3t%q1M5t>pvKpx)$mxt8gQPX-
zCiss~)CS`xL}*42@;eDkts5s^s=q$9b=hhBU5)SsBSsIg5SfsTnef`K_64JUk2QBB
z+1Zgv{ol^#wRe~pp65ttQlPNTkIIl#l;Pj$YHy+mB|k3NuY8YvQ<>vN7_ytIk}zcg
z+5f9M^w+rh6Bnf+JyB-)AO(RByfR`Ku+*hvz|(h&Rob<zR%Vz1+e^F1R#8}wHgRsL
z@yT1Voc0CY8U3mdGc`7@MyFG=8B{WfSx`H4MWT(yd4`+s2wY47zeom7>W#$u`+Kb`
zfPq22E0yR71#(htampC}=sq<iU{g(pbS|)FnasMX@wT(FX0@=h^G;z1!aGtfi%e#m
z5Zb0T0G0WrStei>t@5*{+9QvT5rJpc3AiGHgPchpk&ZFm-O#@T6&sf<uua3RyJ>^X
z8RlNMTWR)M4cEp0ll!#R&yHkilFhBGdh{n)dbT30+o0d5qA+g|bf*+xs&OkNHf!jN
zFzs}20`uPYIk$OUjVgWQcrFZi#pm7L-q5BMCAD$rgpXO#y6_KQ*|(FPUAmoS7C{9j
z`miVRRY%)p*rJD&g?+K&srXTm8%~xwvHrgeJWtk;=Da}=ZR!mmHCfa@5P`$e3F{h_
z#5UdO;(suYh}1gajudw>Wxz&?0QN|+(cY;3Eif=OfTllADE+!PJkyzPTJb$=7$XS&
zy%iAMk-U-g)t9%x&RYnM4y<cI|KaA#e|Ep}m{NtMc)Tg{Ix`6EO#QkA%lTZ{fxTB-
zT<Fw=0~SG6A~xLtBV85Gh)!u#d4oNLt;#Y2$OTW0)Ki+h>qSb^mRR69mPZ4IRDYSu
zum|o?zSmNOKkg}+Tt(FEDi}ruBzY7MU%q*=P$cnyrNYuvr<6ntZyO7^(a~b9cy}QJ
z)n)@{w3x^iIQGT}A+2(9+u8ORAwVARPeOE_K3^*&kkmZM8q9>1;xl?(sWD7SOs8{8
z8XfL$bAtfq28hp2k#!e+Ls=!3(}^nfnZ;+;f<*n*dk99wgHRQ~0voHD39a~tXQ8A#
zUoFh(V_mG(vY<`0-ydDhev+LMSEGIND#g+(oj>_D_MSCufX(x(u<XIw=j!JPj4sk=
zCl6XfXw*0MY^hT#*Dp-X2*za>{}NO;(<g};0NZJccG(U>A<OVrfIQiw;&X6vGmQ=4
zzOdbTG7bP_iv0fEg8G!cYZ%8(t+R7*ZHU;H25B+3W!@9R^oI36D%}6fVt|AB4*R1k
zbFTTY5fR0Ng&gmC&wH?q8PBS~m}DfXHx%l7(ONTOBs7zQQ$UMY2pAR1IpQRZ{N^*2
zNEae8MdHJRk{7>(>y^#!lIRYf$k|!e;U*E6I`Ml^5Klv{=eL76$smD26vZHG-AFM8
z&Kvt}fU$2`w|6(`rEgzUjIdl(5CM;Nj+;xW#62#7V|?PRwK$NW6JWEqz9gM25)aVJ
zzcL?5%)geaJZd0kojjC$^B)P?zfRY9=!rGTnq9>Hi`<*xgitGljHs%+hP%p$(RzlH
zHNpdx4ii{!F8CxM23S)ZSFBsEmtbv{a=>2_2nHep;0)Me>hlS2U+_ii7?7nV$(nS7
zS^-7fx=R6rC6wHZTCF>0=SqSM(iFWMgOl1oqth%<uHCtA=#`k!d-GlMMWa!j*f<a<
zh>L`H)SE@0H>i2+2Ix$3JBtu9oV2667ZuE}{z?X^FMFa<++3Vq>0|6?sc>99VpIgG
zL9xm!iki0|mpB+;dk+9^Ue|7)fD4i?Wb^xhjiBQBV`PcP7+kT#&zah^&Hy+Ba=%5u
zKeF5)uh-IztPzd=903in*5r3tcVizh8nRpa#t?T)W`g<Li-vy}i7_A{jPX{0jb1V&
zu$9gaQMBeJWzOh=;Q|w$&_`++^DGs7{#AB-!{bC7XqZZuDnueg=*oZ<!du!e`-@;9
zgs!#XK_w=xb!%{LOj2b3zw1Vx&dOoKwZb|_!0RuPCl~Z$`*H@m5U+ZM=#@)qer7+G
zIBzPR_dXqyv<^uFK?}NsT;DQ(Yuba9ZS?wlVYaxTb%qOFYH<T#(K$!ffH*M4nzyY@
z|CC|<j|3h7bAUU{;8V<C(IQ5ccWTHtRTu4P^~AdkAOLTCKvJ<*oL?erI!|d%0x|(v
zGZp0x25|UIvR~jD6LvD4dVLwGb55=M&G51ZbFcJk@?+iL2!B+0=q!u&W{liqj@3TZ
zEJbYyi=Q$vY=+o7?OXrdJNA%ZsZzE2_PSc>e7Hln)vd8T3ww4_3fA)<7?lHI1S57M
z<z=A?4)L2D^=IWsC}~zR83sv&u7C1!K5cljyYPDF>f7PWxcOthrIeW}H<Q#U8Jj~E
zTPu7T^;Qpn_r5zy^|tAEYISp`l|Wn1$^$-7OS%m%QQHITZz}AbeZL}mg+ImU@@XzJ
z(#Yqa8zhSL6pVlSPoT<+=NKglQ&0}-PJbMZ3)>~9$lF898pJkTJTJ6Xi@I6RkVbwd
zAGe*?VT%5cncMPV68XN)J|mlUUJ+M+`%G-~y!tCzbJ{CRUG)^2(ArRY+s=pn#UNEs
z-DQ?a&!cz67H_qLcEDmV=qAmjopav}O^EN0gCsBDCYPke5p3}SE$<w5W^2t6v}B-&
z|8|Ri+;5^gg?lr!Wx4qQ+eJc=M!=i;Sd=N>>t;^152a*+uB9olZRV=jg$(&qJm^ct
zDi`f&Fh8`CEB(akeF7{jf=%X~vyPfFp*nRuL2F#9ZxaRMvm^W@uGkCx&qew73YiUX
z^j#-PTqaWHk2?``jrebe=U;)q(Sr#u+v9?Ylpn21u>Yn?v+{*27PIZ_aK-^tNdhk=
z3ua9>8Y&3>p#Z58)_kXSWR)+AqH5uSqSV(~<3K6cm$>UMV;UF4Xi`qe;`cH$RUYIY
zKV;4O`>Xl)UHp7$&V4jb0=}eRlrRb(=fShwv%<3)B1Fb3)!a8ZO(iE)O^;~kOzry<
zgfa|Vk_Hk&9O;>7q-Io^wFS^-O1vM8!&pAngBn8R7jF0W_ae7--(t&t@RHG8q|kN<
z%Pe)hTDo~UZ>iPf=+qe$!yP5U+t7!E^Y@{7k?by2gLTWGHnUo1s#$EPXJZNI(l0-!
zlY8c&Cg~Q83x@Hx8)B3slrV}riBGe&Qn&*!T+Z3(K*++Kkn1j=J73AVQ|$W$e4ovR
z>>~Ofs(1Jh?pgI?(9b`9{CEbEB6gMMHmi&ZcOgAr6rAUkgXA47jfM8;sn9GXpXL~-
zEXirZqv&|>ts|w9L*aoHQ{fe<&=#4-W0?2klgF-GN~@v&<6Hmhg1QIY-hJT=!Ob-+
zLaVw>HNdFii#+Gvg!e%nCf)SFx_@OP(R(ZuP`oo+EZ{lRFC-DDzt}`ZW-PhPw`-^K
zA&=szeHh$5whj!G@*WFkvS1Zz&$yYQ)Y;lweg1KEun{L0*27sweonwaQf%|l5xw-p
zqz1YQLrz|cORf(;3gBH|khZ`}ar8#DvCCHr$S=O2beTHySb)<P)Ha~~7J<Q7guLfs
z6AI106`b+tP2boLIoRrG94N#1sJ{J2|6~5fXQHNuOn-gc|NOH0^hkezK^O&$O3CaE
z(9S0oPlaWM83T06o_R#H(oK|Rv!zalz*osM`?h@9=Jy(Pu5m|9MdkX<nK|+=@-CkL
z?Tl*51HCYldHefC7byGI%-NC6R8Uam*Fkt}z!(aCmBC6<#lj+kQlSKUFE*JLAq?@9
ziR(2!s3;cQq^SMzh2dkTtnc@Lf(kjt*@(r}Ah^|IQb3+Izqbqx@T+W<=}|s&rt+H4
zV_%<FuROB=J(Ga{KANb`_i$3QvcNa$zs9nk4_v=YF?7`W*7qV&nOEoG0qP1zcynM!
zbmWz-FcTb~&nkrv>VsTg!Xz)Arv3`?3$F0Gn`OR{w!;-K+d%`WQ>+eGu9Ncy#gmT3
z1`J(6f5_EOiUl&Muf_oy@@HD(vj%bI<A#CD3*(_#(hIyt=jJ<>X=?pGq-=r&j@iR^
zW~IVB<y~!kB}O=ciA!pxae%fVCA!_rIY^>~+|)w<zX##pZ=957IUXiGhO?={ZC4~I
zoxAw@Yv%1r&R7W!iSS5;EHkNV*Ig5IJi~(pbz0aV!57^$Sd6&>5%w#3vMZSpd8^CC
zsC#HL!(Q;$>2OU-8<aQ|<(lYr;aZ+n79zm^E6l}+Cs^>AD%*?p9|wrDkYElk7<z6i
zOVEF%$aZby`o;yjae&eA2_ilFWraX3A&w9Tn1NLnS<im@hp4>FczP#&JD%kg{peLT
z9rDMN6bWBKZdOAMVv!%XHQU`3MJC=i>2ZQ_?SWu?p)Rn+VGGwS+t^@7pfcLn%pdP5
zEk1{w3Qgf<dQM@bp%YvmKenvK?3Wn2-buK(M42wvF*(;W0~d_5bf&3yDxXK7UTm)%
z$$!fWda^8ND|tFcw`mMzX$wC!D$hRkx?xO?WiI%tqGRz<L-P-xarZ+7kHacKjb0cb
z;+VE-;yo}xwaO!VJxdGm#$^BNC`9?$FOQr}Bn68w&c=`I3h_6{xr9gP{Oc^=BKN-w
zX-7^-zNeebuBWM9ronRfHs5zUOS(fZ^40rBCF8?@@G!)4o_Kxxz4^i58no^}3pGa_
zYDq2ict6vXI~cccZl2w*;<uoXY;FlwKkSN{Q2Ps^D?Xa^YurLoYJ4P>BIScI4Vh(r
z7c<uR)&%`#O|x{hs+20{qWx``qBmB6si_)z#`xX6Ca@pG{n6XZR^*z9b&q;Pw4^60
zkcZKH2Q@d4ZMsXnB9<SZGG1c0RGxn4s-Wa1M%3f0$*#-Gf|y^uP96~w6xd6g++YdZ
z9AixovPWuIP-Rg<zMjcj-quscsL2~$!|}+U!z<hJ0rL~FJFVm#(0$=L%<zCx!OoYl
zxyev4_o$heGmCtm1%yZWaSqvYR@p)Yc&@Sq)>h<d;HBZohv%^cbAe+IWWGvL?My5r
z%-r6ii;%pR;BfyKvOrH0<@-{rx1BvugY=O4a7VEghZg+k1WX^WJy@4qDWB6+KCB`J
z5BP8H*6*cx)zxsN@9{E7i)g$P7V|$40kdw=tlRt|(K*d^;|N64do_)&M>~c0v5*g_
zs!I_E@q5y47yshAUnX`I`T+j)0Yu=g3QJsv7C2xzj9iGnmfrZCV3H)6)g_*L;caFl
zKa}rMHmEj``Kn^)Gj2*@nJyN{_vkPb@V(wPr&VUkPPrkwFZ3j`L&dPdl_0T4DKzN?
z;>{`CqD(bwq_CeT6~ixzk1j0{VGU}7F==~{6<q|jPI8lrZ70!v`iNSq$hupl(+TH*
z#k4{bZ#quCX6rR>K7={*A8?^AV%`D2j&nYME+#gw*lJbXNcBq?M7Pg55e^qtZp{#^
zI~fxMWcXx+Tv<HkgWTuPGiN{G3W^=4lI%s2prfMFc&1(rKyKMvY}p#USCWsnk?oJ<
zLhf0D59i&td}jnNP^oJHQyx43<9FFOPy3naw^hb-fcX9{rqzx%D`3m3j{KADAlZO;
zowqj@7>jH24&jVycR}Od-AMr>9BaM3D}fjG(Eq+-Cv4_e_C~7jX4Al}nIqUhnv9(7
zVvfN|vtWP%@NBZL0f|q1yoBR_o=bnGsb+6E?=68jO#2&T8jTxm8-2qkBA;%C<iF@e
zrUm$YR$Ere!Yo@Uu{Mwe#2H;7GIgs$2ywK`@+sE>F7sJkip{)wLsPjXO4I+h$mkcp
z3EWV<#S{GGUZGM}!>M~R;DU?PhVm|7>~P_F<2F?R0Ke@Nf6blu38P|>kP(1zK=*j_
zi?=Y~Vo)={1wI;M4}``NdJPFe8*G<VwWxG19yJ`+(P!1d;_~Wd$M<HbYammuof-y2
z8(`XQvCCk~Uc5MQ%l*3*g2MG^Wd$>*)#Z;%gc95KLZLqD*kz>|#Pr^$(X1%uk*oxO
z&SC5P&84aR2?6dmG=~!1U1#iUKDsZA6d@J9i{JB2c_)isfqy!zK4d*|oH-}xXR^t>
z)|wM~^m>;q?Er}*;AaFhW-u*!!n^@EN{H2HM)afCgw=eLHxHXjE^j?+g=PVocVT1a
zhN4G}(ecC%K3Gy6Hw{0i7UQ(gVW>`4#=iXOzlVeyl%VBsSmci73^gI9+!BrG#ud^L
ze_OgX{lMz;t22v=IGS@B!YSVKK&D20m-fp0D5v%p3H~&t80}Se=ley`67%m(k8J09
z<%~CW7U49PxNZoOBnNfL_%t-ye{);v*(-q8K&PDXCARyk6KLDXsuVxf%?TR$&G_rd
zgQdBK!RJlVJU1ubYz@|6zalaP17-(pH^zroR?B0aEp*VYAY(4eO1O3$T7vPnAAv}P
zg=FbQHO@DG`R?2LfPS*|RuVB?q4m>Rf^o7XaaB(*%d2KL_vq<4<wbJoZH_y)Vba&D
zHWOABlO5GfLkAmdQawB$efzO2JzWrxW8`gz#RBshMsf_|v_##q&|k79#j0d*)Zo-D
zeZpQA^sVE$sx8=7_?{_o|K+uL{iDOpDP~9>G$qun?pQ{m#X}Q|TatZnRAupth!m(2
zUjLyD7H;|y_R^C6PM6XBUT3+U_@Fb~{I9-t-f18W#qL1D#`o4fz@H)O$==kVMT;*C
zBruK*WcekXa){O)2>Fb7)}i$Uv%vVRj4==dN))j%887ru+a&JiC!GCIc_WqBr-W>u
z&Y*=@*>ojJrVApM#A{u={Q`d&tRR6|x7i@;?xa-fmV|bdaz~4%R~}D4`5zx-GCSdn
z9~I7*i^dZl+_`D`Y}WLnu4auP*1^cdrCY2{8PGiQni@15{*b{;hI}H2VsO`Pj*2)3
zF`~Tr4VdMfd1)Hm7JE9cExI=CkH$^CbC0)Ze>*o9fl=)36{7<NUV9C^>?K6(!JxS5
zV*lft6;+}n|2<o;|0wtV$TTehmm#6}tkrlYbTBrJ7L=vJI<4cQ+8kW0@MPC4q%Gm*
z{@ck+1mpbD4aX{6c!*%BPkLqD5T*GAni|bx;Zs4wXJyXxv#%ti?k&^Ui`@WK6fZ=`
zNVdc8wUV!h!rtk6L}h{6p;7e|6wWolZT-Ge#{?I#Mv*z6P^YDs+KDm;HJdb-UXb)$
z{>9+I!3Yza_)+opupW_fs&sY4ecaZ|sQ`R=AVH_}^I-88VE@;l8K5fJdb#R{(#O*)
zckbY1cT}|0ws50m9~)K%2dCL#Fn>8d+jAdkfRWTA@?6CSQy)g{$8L}2+z!e&g{oUv
zp7y@JA_`^Z?Zt7y-)5`*s-#d?C5@&L8emKfrIS#cBB~kVcpg5r<l}ru8jjH#ADWe>
z&&ruogBkbHA+lJ`d2S=n+9uya=N{DUVHWPptM161{@4g&O{Zlw9Z{^JIz_o0a<Ao8
z08ePN>?(=s8AvqlGoRM|BE)zsQaeC(AxqQfd$<sFTr)*v<SEE=@b+`JIn5tlHW|?H
zssJdlLhBQPh-<CzFRMzeMY!EdiQC*8><t~PFB+T>^ta@ZU6I(ThUQ?u0Hbsp)p48C
z-Qc&ET}P{?x%~NR>mB%sB0ZR3KfRp=;(jx7m!a2JJE-{8w^y+X7dOAMM_x&poEn$j
z;GcTd;juRIso5o{A{K2jKb-BzEJ8F!sU2*(A;>=-)@`M(RP^FI_p(h*;__>+T2?y#
za{q+_tq%!BP$dfN@%kZ-tC~j|;yE;X6{JZKFUuKw-#X*dg-V@#9Fj{wh+b`uqYiy7
zOXA^pCK$^vd_VbpXyliKn|mTRu#|Ue)H~Sw_=G(7?1YCv``H5cCr2x5Qc$8wRWn7g
zoY{2s(aL(!R*VU@aP;F^UJZ{6RIt(ZA@;TH;HONtUVr_(HF7;6=PSVk3*_Zw`cZka
zh{=W6!2!VJ;@Yl}<~!jlGDq!Ny@zLa6<n7P#8AIXWH0O>!*8SU3Bjwbm1#u??yZv~
zZ1wa2%*d!*MoQU*Z>bC8<7V6c+`43UT^Z?@c8FtWj=NaxLl=V}%pb4Zp_US4^_rxV
z>;wEG1})i+KVAcT`Wog87zp0j#wBQ60p11ayI4fXY0Uj?KK#EQ4?w9;Nz%>7Wp<I8
zi6GJfWXLGjS<@?4{&jSXoR5WCUY}BDt0B=<Wf%@$&y23IFw1&Oq78XjK>r{jYJIx_
zLC$(Gf44W7T1xf%7q+h{rb1V*E1E$`*$&IIKDNppwA*$rPVDYenI55+2DJjv!5y2O
zzzA@kgO|N(OS1Fk?^qVqP^!SR48$k5pl87NZMEHma{PK0H2nBEELory<6t|u!My8n
z!Ee@x*KRaVCHrB%dOm&vre0*zt1?mQps{rf_gajp9wlRvNg|fj?ML~&Y+fVIYOF+;
z`(nK6jx{P*zqTZnCmh<sfXcXx!8pZpbL`ECe43UYO3t>Ijc`*$sA4gRkIwYTp`M_(
zm0#FYUa{}t=H7y!X}o4sRpgb71sIM_KzVI0cBeOJPqCJ^ycR1)yd^WwL9GQ0;DGVH
z`1RJlOqxV~s+lhym(fB&RH>6t1NOR33U2^~6lt2SUzSC@14z=!=;%kj#E=3eJww2B
zd;nCn7q<AV&p=g%H~R9&Ad8IW=mfCCD#aO#AH|)4cbBh`>8a901hBoS@$*h0Wp1v2
zb<_J|i0t=_41p?YS=^i6M33R&T(2BOVyfP&hw4up1@T!IR{RrEL_aXjxh&=jIt6rA
z4b<10VXH>*8l!q_&OZBK!2ml{9$=7!QlOK4*%4+^%jj5~&G4x=@r@_B_BgInJN<(B
zITxv<?M$~@rA{-wkNJr}5{XXeFS&)k<*_;>@j;pfxzU41Y2I&8yh>~6mfN~+L+}wO
z`&E^Hiln!0d2#PxRA8BxaVf=3vl11~SH8RZedl&*qmxdf`Q7T<Se>kS5J;Z&)_28{
zuY6PmG~=NbqK~4CmVeyjZEgsM4&$5lGJ?6TTyh`<4u!TXTK`K-*|~S#(0o8BHLx4e
zQ^=_B_J<WeaCRT-WVmJDm!Kt@&9V#%)M>ddt!m+sgm@OO5`F69-2SL(veMBDh_u+9
zZO?0Cs9>6mql6UAsfqE8a~58r!i-tQx4a%c{x)v;reUmvEBMyV44o<aX!QA(1VP_5
zawc_qWwURLVdpo!0#Js(>JB)w(>y_gr_gZnWFr4=)4Ks{s%wVtgTGxr%LU4HeZHsA
zCwEb9fb+Mn+{+R*=X8x}E0Eg!s;S$}uWs&y@fE%cSRJ54ko&GLD|O(Wx=AtmzeC7&
zay+jG0&ONHs6=ECKX-2WStY$DIbGAQvXzq_MN9DQjSh-uiWp^8neAvPdj8ttd1y1j
zg1VL0aBr+BRVV!1aKqTW2RMjiESxqimR4KcV*9GN|5%?Q{N7tVoIvGQ5ph(=Ti(|}
z1MrMJ(!1<73bhv5r!7J#PT6-L$KqPw6)3d6*w$vlU9>YgI%*W`{18|lPA{HWR<n;7
z5F5pDn&SIbK63=^G$b(oQy22aY0^KU(r+Q-(J(72&XA088j3L;c|`bF=EZ(B*1*IE
z?CzM*oJ<YZecj(~+qWqh3S}hu)9V&6=Cqk>;?qa<zYS*y@d^ZtiI6>3os>6|l&AS2
zc%y9E$IWNUmvF^Y>&7_!*@f8cx!LKNMN^j!$I)MXus~IFTbv>^`-Sg3NRmH|&XJCJ
zC$8|ri>x7Dv!k%iixAc1roz~<_gUPsL2RiK+9=Mae9(;nD&}YXu13qDS!3SMuU>KI
z{7pXWeS#&^y@Ro~_y$WZorgDLm+3<S$kGGnAgO*2P#F?Pn$s-9s%>x?7n<%5{pem5
z`13ZSP~(rxcNu*_O+(lJdy@6DnP!$k5zAuDbQi~EDisn{uJJvT7|WJNi_$CIj=zAi
zODu0zJW5YeaEKe2Q=>8#xsz;!(&)r}$irycUklW~{!)|Vje2lKG|lVN*G`vSz9>a@
zSNa0~*Wu@)66>9}o_8h=#etn4XO(~GI1&?B(34$f1aEY-=qZw34tYJKGF6~#{-!OY
z@1o58Uu8OsK)QT8CgN*(Goy8TRJ=UD$b0H&9TtcK8*Wy7Sj*581+6gD_d(Ihxuicj
zvViyLp%Dg5(2H8g!tvO7rM3*83A#r2x2HZtpK;*1qjCdOx3|*=`CxkHJ+-!aNq>8S
zY#ZQT0fx!@hbtx9_()?iMs3Zb-bw5&3;=gY8}co2Tjm8+ntJL#0F<A-yOR|RVI<KI
z2<HRSNGM7uv1y)FdxUAdH}I-Rew%k~@6LQWL!Bzr;YB6YhDC^s=XRP^0G4~K4{pp9
z65#T2Xw855nw2AxI*8^TwdVQon;vX$`xTezZcFt?)Uuo}Ek4WUfO{=W<)Bg7^+kxc
zj>2qRsRPdD`^)Cl?~&v^7ikjYg~u~`#2X;dQG2E{Z?=u_AjAp9;<BIV#d*KSeUAAg
zVavG}p`ST~{LE#MY$a%+AI20*%8cvl*P0fN_Up6E9vf>bOUBK{yJ<iARe<`VY`5g>
zljh(z(Pdds#@Tp3)ni!<L_wL7TiUCiG-aai>D~HDKdM@Do#Xt@wRA?Mg0`Xlh+>6&
zQclPIcJf<C_ejD~iejS$qrn<05mDpe6CMEo4Kwnewz(Opl>Cp^D5#|-%6!&zR`<$s
zbB*fg-M;h}W4X+rkLSsDySQi>d5lzc6k-!g?S~<YNpH(32uQh60qCgwRi2}ZbVTjl
zW2)KPZT}SaB5!A%U{8woT;j-I676HaY4jl2#1k>tU1WUv{{){{J(>sEf&AvC$5Fc6
zV<3M-zA9~-)!Yq<X#Um5^ZUl^1CanhK4S;5{T06mZEhBp#OR_|v;(k(ecIt<g5>+W
zSAAAVX>GF^Ieqstoj9H7)q)!|=kr#PFMhD{*15W;0?b0vum8MaE%NV=GF@xtp|kR{
zw~t$3iuNv_<~iXKdgBxus`ACE+Lw86s|=;j6+3#rO%RNc)8bc^DejDE?$5z}7Lm9R
ze+Q&jTl{4-@b0Jz;YMe{Auu%L{kLEBaeg9KH!ht3LTfKzFS4W)aW+{;vwGgw%=<EF
zlu2)V<Zn53o7LY|(2(^*%O#RTazj=3F<#z+j}cF!mDJf*=(Px#t2~}aImJ$RDz2yi
z_K#OGBUO}p?|rwNj<934i<nx>|8&9S(Qh#?l@*qQDdO*CQ8!)+tfx1K1UvYVp&Fv4
zq{tvNoql7^mHL0+Iz2Am<~U>rv;$0;`cHL2{~@412Qjh+E>h0sVOm4S)ChDv#d=50
zOX0BY7(vQMA2?X&`8{}$T!EyD6r_^;zGM+?T4C<j5@kWn;k@7GBcf2C5KLhvwXxoj
zzZK~>gMZvu%QS%}SCIq}bSEL1k2#NKA2+Y)xPHE*Swj0JU#IQ%mDA7U$I=DKmB5wg
zH`fbPUe%!QWg%4hL%{ya^m0C`_K+m#-G9O!PU06Uhco+8ugPw{bFTAOX_P^8_hNgQ
z=-o5C5gcdU^tD9G?iG7?R0U+lfE~j8o@78Sz3+g0t?1bYZJ_6%Z*a)6|HGS+x^ugF
z;X@;=bPm|4V(@rLkuN&zk3p&_G%N~a8M-%EjW1PX>(-vX?Xs=V!8ngpRKMjyHrEiM
zRJzB9*c(vLleJQ>0}zg@n)luKRsT<skB;;Q3+S1e=6ItxCyK)Zdx_QP6WcgSkvB|E
zCFSi>q;+%{m1&q?n-UdnIUyAt@)f1sIk{{Fufv5Js-)7i+@Xu*kRq)iQ{Y8EkX?<b
zp|yZ8yQ`C?TEtquHg;bMP;I7rlOrpjcZuS1vV8%^D2SjV`F>e54c6a1B{??!5Bq$w
zf`-P6a_e*Q1$okl;4YlyUX$TwG`S&0b+|xD51r&eh`H%WyYL_^trDZ9+RP61aJ|NW
z|2mf?q|>YOw&3c;YW3%I>5sYZD4Cs{5e(nenBR*UU}^j$E=0D$--hVVXCc`P(S4tW
zf^z}*VdO<yK4xAExV?MJM$?4xv#HDz1OIe;M>I4<ih_utBc+{>?_iMuE-_<312#-Y
z^<NNxb$da4DM~4`i5lidgVq(?jWE6L|5;B5@<JuA;pq>F(D%(CX8Hd&-G6Y_tFUI4
z4mxCiv3pQG$hz-VVEfHqCn+%({~yA>1FETY-Btl9Dos>CBs2k$-aDaJ3DQwY5JbB4
zA|;_jdXbLO1q_H(5s=<{FVcH20)YSl67s@6_ndd%J!juH{xQ}_)_{@K*Ei=k=llaD
zeY~s!yp<8@&M_;`nIcCbr*4tro|ieSr7!PQ9j5MtV)dlI>1Wgsv%2U#1Nx(K*a7Wj
zC<Aw^Mw<<q#FweE9L&Ka0W2h}1e~|%_Bgf^VrRCttY5T$Q7nj@dZ3EpBgu=>2hn6*
z&<H87=M|fXL;bEO+LFmAx0dgWy;e^9U%IM+YLT)TP?(<*(HXH937jKd^xMm=zbI=n
z^ivNK%oK-=&$PBmSs?fUSUp^tIRj;gs6>YACN-#E9A&%ap9epY5-S81sww{5(KUBh
z@6NU=rAgeP?C1oHJfXdRV?>Ld0p>HU442tKGWGI~(xf?T;+N89#XwOo=dKsi!+(2L
z&F?V}2jj<jTv6`F5yj}4usTj_x4OxbwK*{(H56A`O}}(~m3kc6gv3b!jE}OWk{lf<
zw>grU*4&bSbeyudx`eXQl`Y_LLGGs9p+4TsXCaTgJu2D6=Z}qHM(s>Q9_y0<N#JXW
zcQ_eDF??sWqP#yk*k!2!A#r#;e3$&2F9XhQ9^fw!)suTO9LoG-MWBK;!_tq>*+LJ|
zIUWBbLJ#_IL}*!J9{25^!nQa_n`n;A(WRY;=;q#K_E&nG;<$I8E{G<ln5q$VxWqz_
znJbbDZ}d}__JAGXF32^(w`LwE9xq*t&@`|3b8IhQhp?p|KmLxuh-#KomW4Lc4)G1j
zT<#%@o&4>sQ8J<cQ}PyDvzlR3M1k2s0zlq?-0zv^;U{FSN*Jr}&ykVX;%-xQm`sh%
z`HQaPdvtzp6v7kp_gsmhb>2LUPnKcj`J?Vn`vSpeUs$Ah7qDW#a#yc$yl1);O*u14
zg6H$vL?ro(3m;j%s2S1qfRO+9qw?Pllk?UdzMsKr(#&f$#FrI563#}q3Pe_Y-U?Xw
zotPouXYS04HT6G4RQFhld4lX(6A5&g_bAox5kF}hju!japbj!ccvOh$y$mI7+zOAT
zk3GtPgYH^b4g~`wJ9HakyGWMhvM9*jNF>gDIT-GH`}cRAvbif`HgGA*TIip6TZ{<}
zM>N~JKJ)UDa!yJ=&DTq#YI9Dov*b-Hcq`57R|q<@P`FD#FAtQs2!mf0Y{(#2j5(}S
zNZ8dMBZ<qynCf)2pjN4L2z*OLwSvCzT0+GpLUo<#gvSl{>|cB)s0zE#Pk~gTkscXX
zGAp)(|4-?}hli&r@N#XBsRi1pw`9-}6wzn37hka;e`>)vnxvD*oyYT~ne{zqP}S=Z
z#@KBYUdamrW{(RB(s(JKt+BB_^x6;ia9K=c+3c%YQpV^|#8WUwDG_djz9vA+p!{jf
zND<Jz7(PI!CC$xJq9*dTqL$0xMcfAnLkQ*J<<i+}Z(-!snF4KHf{&YY#N=ArGG(k9
zG4W(iH&j3wrI+WSE$lv_r3t#t2E#$$XY3^+r>qnvBaACXT$RmV6jjvrBy1vhrCo4p
z5|7R=soKRBJ+bk-EQ*Y~_$`|~@O01L&EF>MbA3{~8waR9+xSyuzTlIj`xpH9w{sV$
zKpfZ+Ney4`OL4o?YK3U_YSoGuTeBnH2}7<Z<|mM+vx?lC7>Vps3~lfRA+56fo-Rw#
zQhV&NR-}MrR&@1y8$Z}6sohYdY6%RLm7@4LrK-iev!yuqj6-5?J(6BztB?J&J{giY
zL7_J_LS<U>>hYE=re>*7OOxSzOXWxb^CG#t`}Ntbv^|!Cj$w5SVkJ~*#&A7YSeDM(
z4!XLFSgx|1{<OQy|HhaBPlUCr8f5BadQV=I`ucnOk54L2pI#hZJe^c%*gxU_HK~F*
zepEDHFYv|quj<YU;;lQ=FK5+P$^R6`gH-!{7CU0xVv1n0r9@U*DR8uketXbUbh8IQ
zXA#NOnJm`c6@q(1Jpk&7pL!py`Zlix-N}qk<~B}d*a@wO^0--j`ErIO62ULSQW`TA
z*HyDLhubJK;J>!D?XqZ*yomt<R90?22wjYgGYo}7QJBL^7i-+QG~>EPwiajsB8$rc
zfT%nyIxOwCY`Rs_qXd39BeoL2KbTmlG^LY5YABqoq9^jI?et?^yZ&=h7!8sM$y9qG
zx2mJIS237sLoT9mp~OrT8G6M&zdrth(BN#lml$*djI51hHqML0HZ0xZRgHYet&XD)
z&sNSs5?J)H+v2F;U^gbk%*Xbf0?nDGkFyoQ9WeRoIJmZV6hj&n6+5YNZe}BWy|p9n
zOuhYuPVZdr2^w+;)x})?n3p)bTEgVa*A8E<oGf3DMTQyjo%}PR1M)woq2*WIEfSB^
zA~;!Os6<v6`9u2@pT6H(UH*!X_)=-r)nWiJGoKzMvM!vZ9A4#Qa9CFe4?E5?>(rr>
zv`DsW23aNoF1ct@bO`n7*$LTOLS+E3C94cbN0QkUbHIZiQTo5bIqA-yvO8Y9;Wc(A
z##H=b+^5L=9V-cA3ifz}LLU$Ht?|A&v`X>kF+H6g`s!gndFz?Vo3wn5lnqFjxx>g=
z^!@#tOzGN4^1o#dZn8M1G7Ue0ElUEa$<x_9=I4uQz13%?4$T$l26ggy97#k_J!T?_
zho7yu5a~H3oiBcG^Ez%N0MC2mnp~eb6+CLUEfInahj+^b3abTCJeJPi%Y8)}q&BSL
zswk3p#1umazqxWv!#snguF+65qLNxu%h<`jhzq@vzTyx-#Ygh0eQfJXHcd%3o%A`P
zwn&BVZ7T9NZm}0_@p4ARHWkzqvpPuC1JE+wz(Yv(qUi#8J;U|KB}{f;z?s59XzriT
zF>63ZjQH|`?O;9CD5WlP$hbk8hdrX1{_^x|ahhS?&uX(zp6|euDbOY|P*&Oow-_ra
zD2uu+x&i8a$?)~15T()Wvpb}#t0%)pGKZJ0Hj^8b@7tnnZO(o-)|Z}OyuJBjiVR#+
zt!^M<>*T{pv)p^MEAAxvh(IYjroz$Db{qWVI3j46#jeP~hR%;&+`ZKZ4fo6v0Ltv}
zcBN{KK4WCfpox#Vm-FA4pf3r(@<}~dyE5&WD9)d;dG?ZvRp^@dl}*$nW>p;(HC52A
zeg;{@Xz=`6i+3MUqR!8^=5l26vSrao$<&T(XNEF`h;#RItn_fz=jGQp;*Qb3p1AG2
z+y^PFk2~9TTXu6~n=gZ*;QM_om#eR9frF_(`7(Susm8t;LlO<p`w^8+2QPkcnH=22
z)BQ@8$3nfpol$`#**=@}FK7PHH%v7hOGLPtmz$DK4-0-86E;`d@XJxEcYWi8uh(Zu
z`cb+Jut|5<z)U}`l{J9sJvdzVjMvgj*Qv9xrsI(N*GPOAE0=$NdNiI{ya@T#VcHIy
zTT*?dE{)akzc{JU*x}F&l$Lwg3P;mllob2|0^<wZ&QmN{l}%H7aqoFMufG&hZENzz
zmco5qNB5(Aa$Fy=ql-a1Yh`5P6M+0`%j1=iB^#OluQi`Vh&mf2jXhW#b7xtS%jI6p
z`ws*XAWC?9%Ahs~#DV=RAg;2d{qN-}8xSx3Zpht*ny(0O{Kev{25kTSR5iSny58x0
zVAA*Vo2wCc6`J~oH0i#%@)DoY4U1GSd(1cR>4U)Vk8K0E0QinzOPJ}}vR+x<2k2c^
zM==e8tO^i=B99NE2sx%)fGaAeUdPhcTjNM(5)q`OVP{U$8--neq+yRM3na0fM<QKF
zmh^_S8s$ZzQ67&E>1T<msga=on`4U7D1|Jeck5j2Y!o{XKiT$;xTje&(!5MTaTnWQ
z5ZUey@w{NY`}THt5$iL|E$TdtlDfQ2%N?cW@Or+6?gN^Ce+Nq9<C##k^q6Dmim+K5
zUp<=CBDMU?hsps<pNY#KVzNR6X#(2_Z!Q$~)QgIA5e^m5-^kP^;P;v6fR4s;JEAlZ
zSz9<+(1r?!(%v_Ql7!U66=_5+Lrx<1c|J9}MjBcQ#bTFoPA84f-TQH$W?5Ah7Eqa_
z$0~6PR=`Sv&kpbb1m2t2Y3K7G1T|UoWyaUECz$7kC$H*2_TFegKx9-zBaa^y12Fe{
zG{j6X&BB!DW=mqET%)3AUD7S-guf^5A(w;ysK{KzC6Bd9KU#pbp-O*Kg$&>PcgEm+
z&>U2Dv1o(=-=*EG$^A8HbS7bjjdLbsakgP>=2(U_fvK3%(=4e<pJq~CQD*AADMLN~
zd6R*z+sv=S?f0sxR-w$wN>Nqsi*>QX5-Z3Kie>5>NR5kN|9(z%W~kW9@xm&Je8V)z
z&enU?=M=Xln*TxDt>o5d4|wdInCo6x<W{YCW;A)4KHz76GLh2Lp=O>zR+9CQhbj?w
zQ2iJ`q~PAS;mf0*0^=vGHE()4RvdU3Q?BpcgW&%F58CV*3JMZBD_3usQxm(`KCUNY
zLj#b$Ku4}o5{y(HYAChPdn%rb@CI`4)y%KqpA?mqOrE>S%x)Z%sn&qFX1+!BZ%Y;V
z+{Py(%1>#Z1OXAlKl@4(x<*X-|In`=OwzY92hzS^_rmkC*P07vy0{bF*LhEbtTXUz
zc(?g_90dNqTeWmJOLRo}6Wwyml81OyBSdCKF73^5f${x`VA9-zgDyPVfy!Tld!bc5
zLp7AqO(S+!urO{V$GB={>prz`+pl?G8Fd2l8Njf%p%f_|1KL(MrIgrWniI%hp2O{0
zGlpIsm0Wh`1wZamdtDOy^g|KL4l`X`XXWvOdz1=>pmBe)w{?rq92a!w=wI78_n)`Z
z{AeHlLBfd9SN<0=#S|%>ExYEe2XakNtnkBa7{s#=7}E)DEjmrZ-lr~_P?M4F1>clc
z;doU4cpRR+RY;|3oNW=dcZ=`ByMXhd<IYt0oPI_sMLo;9Az5$9(KX{&;^#g1BWuic
z9e+~Z`4)j<De)4GwVhXW+5RK8kdpLf&kEHhto$m9Ytg8EAa|E1I&>0OEdNjZheJ9E
zZVcUf3J|$-%2ArH8mmhu!@*}ci<f4r3Xc|t*j^5(A3VU4u-_(9?{7TJqBKnB_|?ra
zm?R=!caL~hN1f%CMYa`1^HVi2k5*?g5wxSZ^i8&~EonfNYj#^K@5kJ{Vwn}jhymN>
zmhZM(-LYV4;GYIet-uP-Hf(=hQKP}r_#~m_e9bu>kSu#Y67}Ha_p#Or7u&y44E$AW
zH@B!{s~NNbBd9(kz@T|Br~9#mRTnlasO8u&Y&%hAA`yMn*5Aw9pZrtaZaNu|`Q+ZT
zJelQCZuo0s&_@}V(YWx9mF+k)#9C~uY_maQ?s^yKO8Za47RWs5O#rF^#+w#t&-(P3
zO0j(H1yj&2G=BuO>+^GdQC8M_Tw~SJPd2-eXZ*To#*NDyOtzU1^t!TZxm556znHyj
z%P9v&A;qKf&New`%>A-To%K1ScCB!&+|b`6!eOMfd4?}LO3#0RyM@%3wRx@dCyV}E
zNzy`oVtr~a{Oo-iy5>*&8fPp1JHwjYT+Z`6)r(X||9hpw7N^z&g<AEn4-6Po_?8m5
zbKEzoWZaTBCk9MQ1O$Nab?y8TD|<9d;Ze506CQY`u;a<jPwhX&Cb;tUNSN~A{aM}d
z1O-mxFg#~g?P;p7qf#RgbaepPlpL^s!b3cYs#qXX9XWM0a5S;Pu+kY)NdEg9j?9hV
zAwBe<(sP}c%<Vqe9P%>oY>q`s!kNmM?Yasq^B5cO&nVx23ebvY)kx060i@O2?}<bU
z+bYH>QP0Ixk@srUW>zH1^U1tk%_s?W=>c8TArBZXmV^sgcHq&{cuo<So;?ZQ06Sc$
zry$)4^?h|UMq19N{-1>sD7H1ihv9NI&Rd6FnR3ii&hz-e3W*wxquTdE|E1f<J!m_c
zmEX9g_eL5pz;v5U$ZzuZr}Q(`GSt*F<7K?r9v%Df=M7pwJi45VDYTEe+i`XIr1^A|
z;u>vUqtWZ4kb(ex+1y0_*FyQipRqyxfEqK;3;WS)wp47C_~K4m(fsxQ@r|72tYdcY
zv3i{h)}~K*&@AY@nZsCOie@!eQv&%WBUP8gUn~&wYu!KUUYd;ebM<K@;jRSI^9eXj
z<+fpo0MMnQ;~9??E3<q4u%u?8T$04jlZ2-?eWdTgYNq0z!%B9LEL-cr+#UpyJBjO0
z!o$s|BJ2RU$fGWJf4J#TKC^%D;kq3$Y?p;G;MXII8h{sZm#z6vrr`D2W4RMC^K<As
zl0PCEu0~Oz2prDF;gaiJyyS}txW?BwpxyM>PK%{4hPv*LV`PwL{#%j@KM9I|gb!6~
zVSc<lVvvJZ`iF|amA~L3uoMp#{T?r7F%a)nLk?^vkUmZ0wYwGHk7H}vq<1K-|KSRF
zZ(GQM3e&QxsML>u=4;aDWO?He`uAjvlHW8r%If8v6%aj@ipUC|wK4nxV$BP#B`nU~
zVzSuQ#dE(Mm1#sQF)<=2J2Q^sGhU>l@_7!we8zZa!j3FiG8{%mz<3V_u1MP7sqORB
zy?e<9<E>c=dd2}32^}_^F(6DRYX$4D*2CV>k(Y)N;z1a$%X}nc3p0GlM2tEMgfjfK
zaKE^`Az7M&Uv1_S?G@7%`&Cxr?$F!R;VlnrYpyl?r64^2lOW-%-$PY@>c(O+d`D|f
zW?g&ng)_~Dh7ga4AMa-|JVm-e$0gEadsN!-u_WiWu}@8Vpdk`>BrYh`T?!8~@-s#J
zr#NwZI=yt&nnhg>2(s6UwyNLi4T`RMdXWScA5V$y0BkCc(XdBtwSAI^4dTcq{33#{
zXKGbYk;pGZN!ive2TvDUiY23qX8ERXyeh{I#=XwI`So(ZGla{&k$Vv*)D#nZ^0_+S
z%vXwhxXznmT;=f6_(vlLZl=k_Y!CB)18lff8*&vi8|TX4wzpF0wAff_O`Q4KwO3n(
zTh+<?xG9ecB*uYR*#vH%GvaRSz($4Cv1W~!jI@oRjLeXb)BM@r4w}_Y3!k#26@14s
zr7uTE?!3MAQtD&KmqEAewXNK@`5*4Q-AL&5JqwSt8<26FNp#2lW}N$H765wXm+eet
zq3z`$e$&I)J9`_qJkzT82l4UYErEr$XE)mmAH;?KY<3;o+qUhi>hxoK=y>#AYeN!7
z&1=?A-&$`z$JB2TQm3dss?W=q4=^JG>@D-?e+kwLImiQLp+`oP^Wcfx{AK#a>DC3$
zfa^-3!<}Z3QSG;Z&$*R?<>7%j3PMkBy}7ZqmiwfFm*^RtyToXeG=DFDH_!Mb?tNhS
z<^IhmNAW5FEagw#&8buU9eBv)=kMe#eNBT%rh0{c_xh315nP-f6n%({QG;T7C-W~C
zuyVHhbMI-#(vq<<{!0x9>fk!GMgrODCqe6cq6}XMMTP=59M4yL*ld+_#5tSb=m?jn
zcemBUt9JeO>{%VNMQBM>n1aon;QN`<_I&g87Gn@k%NS8Mk4fDa(AZZ{54NMP6xt*+
z&yUw)-1(W`{}mfM{P{G1AgbWgC^K;;hsql|?^Mqz?udjTikW!-IIpK+?^F*+s}Jsa
zs=3E-)pEALuuI~bF%0YgQDC(bYW||cGV5_xM?dO0#Z@08@r7yKSza{%;2#&AOIhM$
zT9Q8exTZyMA57z^ZT$+*O9Q{dM2bo-18$=l5b`j&BJe=ZG|#!mekGDzo@{1HEzywG
zX9rcF7ZnfH=ZV%meZ<oEQeEKThoIiTd+acY9`E5e7|G~Ank$5+3HjtLq1V`zgRLCb
z#>3q!Ihuv={@9o*HpQ!L1g>kQ-SLNrv=|x_af2=cmNItz*d3N_#?`d=2cZk(4Gca&
zf}2>G!vp;5MKB1;U_M!T;+moh(m1$kW*@~(LO;e^`bz+VW(TUD)ld45HthR1Aulu*
z;!o#s)3vM?f%lCe8^8ZR!eR+bYEKyYGN+`wjPYZ1U}1U<?|7wr3;<Y7&UZr`_o3Pe
zvZmFqec6D&J3T0+*t7V62}QF(Qp#_#=yEHqJB063RJYz9b?N(UYI#A0(_!E_9xD-v
ze0dP!75Uot!fSsffdO=XC{sN3A$NMlS7rZ!+D?6%H9NYjn6FV&Lo}@$VW@Juf#d?A
z4T&!pV#Eu<-^FrQ@~K)wFqApPLa=SyS9)8=sGsxb&&#hmfuf*u0F|3bwTmxXQ~9=y
z)WEN`b3VYWgK=oZtbGn&mdv462eQlfmaDf4=2n1b4{*nF+{ODOjvPb<O4JEzvS`K4
z?2`@3jJM==?1)vT{+dMYakL8FfR}iqn4Y=if`~1@U$>n2WVg%Z6gzd8r<PfaHI<+6
zV^9MB@S8-rmepz*;j{haHerA^GCj29)}l}u!}0L-uzzC{1pX77kbBnUDvorJu1DpU
z_P;rVLJ&W;qp_%3KU0Em0Ja_ewFz@6nwL_)H}Q!g)8R6%dALUJ_esLn;y|Ik-}A+C
z4vB25f1KuMrBWIF`)J0u6?Xi0e>)AaM~HhANq*1(`_25^9Qc$u$%GKIeeP>d(aJKt
z8M8s|Zx&IcBT~OVwe@qc6nJ-g@sT0p_gFMB+*v%@cdefG)0=_bjabhs%acuhp=c2&
z+YG}=1oKo#v}8QUdWiIUOr-te8W~Fs6OHm8p4^?P2slWZnUoBqITjSg>)0!yuuvM!
zOvAseF9J8*CZDc)sP2aM3OwP*HdQJn{j@_cViV?e-}?5;sLWWEC#BbN;`dv;B*xy)
zPuig002ALpCa`##XGvKy=wT{yi&Uu!?&A*<yBt6G0(BHG?6L{sY#8k<gQZ#hkF@FN
zF?ZGb-Syl|+j$V%U7>1>R$Q7v_i$adFpVtNQG=3n;MLNw*eU~kayjKN7+tnz#Wm~U
zbVkQeN?w(9x`JbiL$Ar#KVC#w$jQ|fX5<ogQrc{xT$8?~r%gC<y1h^LITR=Hm`-1~
zN*2v)@TJ2>v0tr&&n+$ztffT<GNsw+efQ!k?IwCFw^A(y<@}n6($n7dr+<QAXTfl<
zMvUf!bR)0-`Qle1sV$~$O()c)`?6bB%3$N9KTbv}`W5Pb34|ZuW(=I@@|Z)gvxV7Q
z;A~`>C6^Pz+w%uL#ytF=B|PkKza}G^FxrJf@0^Aus#)l%(9skb>^A1g^ySJI0;-Ns
zu|F%ICy?_hd5J{F4t?>st51Soty)tOnmk^frv1c$c%;>pqss>Zus|s91?YH)L?^-i
z(eEzXiCZcIQB<XJpJeNAz5jwrpOf}nPEYqbSn#*iHQD}nEUM++OLotzB~Ea4aEar*
zZ(rnHgl>O33I6n(E(^aCNVh>rOzI;;qsNpm+Y%L$5ot-#s{GgenO~yC^JT^BK6gP9
zZWZ1a$U@u6l2ol@0^#ta%e>W1I0vQuId__XO#5p4$<k7#x6|qRSgn0pyE{D)*9^~x
zx>0P7iGuFPd%w**D=vCOq;P)JWchGV-K3~xuDUDTpmhH8fp>^Abzu`@*xGsEbi}L(
zd>%o&RQ(hbvN?1ZgUh7xS|@tfN;!(2QgS=;?=~@R*?uDfCE<^a8G6mQuR+)}VC?l(
z*j`+FK^711vfx}$pwsUZ%^&bf_3hB3Fd$if3_^?4<Zv;`F^sivm8GE<flN8rRb0fD
zqlE`a5<RZs$ZyckvB<XAMyy5KJ-i4cl+nd(g#hc7ff9h5JOE+6mtif+yp4(Xd=(`S
zrHNB4?YZF7XWM<jy-6G7>E6yd8S#pVVHfvlGVVppO(@>KBmG6>G>ok$`$iaKr(L-q
z#Syuq3(P;-g*jUpUIyb;C2LbGu|CUR;JGZQYkI)DIu;Qy89J%58)4)49@pBaED8Ia
z{I@IUw@$Q&44tZDN`64W+|tM76|+e|tnEydqkUgf&*>g5ZaVDm?1ry<&TuneXMpN<
z=SSIPE?WGc2V<FtbmWlJWi@iVOH_5;k{U-j_ft0^M%^7h)*E70theWm0iUmy<Ey{I
zWtPduI-}|CfnS~F#6o3=;VsV(@14a#(I{jL^wNB=`slauXrGyjHuI@h6K24D+FAyX
zchWXykKJEkTqGQ|2A-7LJ=arief^{%o!lLYar{;-%#*bGXLBZmUh+&Y?+&6y*V|x=
zl>&Z(`j|Z@$<?5KKCWRwM)1BbiO3{a_POg2iTp?1I#e*il$mXfxqV}hh8o7~vm84g
zcWnK&qpQD%VC9do=LS_-7x%{CLMO?xr=>QUudws39I35jrL_})>Z;$?C%xc9*g}J^
zlZ^D;Uw6vuI7`x&E(jecO6me?*4B7j3OGf<PerZNDF$A5`GJfCc=vBEq#2aXK5_%}
zD{_PTyXZT^(0ZjqA0S6A6+X%oh)Sk5S~~DfjSPq?n0HFn*{w?uOwgT5^p$i&GOQ(m
z-$L{=7@+WE$tRX7xj%Nu+OYnhZY)j?E#OtQ1QRecI<)fn&H#!~@ZlA6HCPMNT_4F5
z^-^vu2^t%n4RSW4u#|j<sINTUAhms3wlsc>2)r}t{XJTDbBU~n+_Rd{#Z*09tI)7v
z7E%oF&HBI}G5%-wtL4e$A4!|ZbCntpN=4lzsnRMGkV$o9m{548Vu(|UStf^ChO<a}
zMrf$XC?a}2bK$Q`T{wW2&vq+{@zj}ulHZ6OE=9diDZLq|D3|+6^RtA`scmzj1btLA
zn-bYhFL)zwP%sX?{BD~d@Q7Dvs>qc0K~ag}EQXW-rqUoJ(@8|Ivn%gdN`5_>{?!{=
zV5kR<pWXV|0DLTS*@kl~d}gnc0AXWJ&X1MeO=5O-kTKPb{0+PGPHG45C-b)>oFKvj
zp9DqcF#ru?H1M)8_NyUw;Le!6+0~b_^H(yOezE!18z#_mpjooN8FZv?%y<zQyUp!{
z4h=ik`a~dkRv(&=OG@UDKG_}uP4d=>Skyl?J>8DYH&i0|gx<t1M*fs4(pfbqB>TC$
zF1KsA@|Hs&&#d=*iJ@;LMD-Pn_gR88>l;3HZ6=2IA1j(1I6GA_)8Y_W0Q1MsRwNu@
zOGCE0svy;cw4h-Vs<rKdcQZ8YcIDU*ddn5JSCGC=vFKXi;;_0X(S^ofzMLT?;RR)T
zZ}eKgxYQq>I|6EV<ZA6se!soi{*<`ZH)~Kl{aJ+YeS_;s@^hhJB6$)oZ{s=2de?~!
zKf}XbeHXB^E-ZK^acmXI**Yhx<Y2LKXPGMwtZ&DxiI1eH@26|Mzx)Qh(Y#Yd17vri
zJ>D1V=-UR{e5aS2x$UIt1qwU}AL~KMDXtQggU?t*wwc78jDLvlRpkjU_oeob6Gm-@
zq0B{Y?QcyI8MNnS3CjW7g<GxL>cunsW_K8UaucpBsRss6{o<IQPt6}kB?#XPH@khR
z+TdVwHre;C9l~ZrysEsD|9r>ir^-$W1TUXZjPi;KjAN;0af+J^sfH!sgRBn&L`FEr
zd5Dlf$g8&JLiin@ZuY$V%euz)mvv2xzcPL;*34s%Mu@*#C2PeNuaeG5Pfy-_gciu3
z$N=uh!|8Q!qLBiulF}caLL-lcnSCclMyZ{ATql<C1(@3Ix)<#2kHQQ?Uhp;mz5gP#
zavFIH{$Q35rx`@vnPjm`Izd*2zRLKj7ZW8(dOF1JGA*P7PQz64o8C_>vij}&RFD1W
zOaFEJ%=do!UeY3|+}_nlE+8#N!cMMAdN<RWh*Bi6@hk&7=(yK-ls~jibPN7rWFQum
z{wUema%V(^_qmG5s-DkOJ;gem8g%$lxa{pTjYm}7@8p-JrKjE(;`2RjI)3lxzN1!z
z6%jjDaKz?7My3|r^_k~PWsO~qTFBckVloLVK_7#~Zk-josFWPdQFdwKnp(CNZ(gNC
zJ_v1G;FU0bbpCKl(dBrx7(D@ed=P_LX%l0mgR!h_MT<H;_qBYE9EuuiS_>UsBPb>)
z`IyiWrhcSG15VJI<K-1e&t4zrGSu#m)%_v4qR7?08DrXpJ!$MTO!}-UNa9mcX6{GP
z)?IQ4u6_-k>yV;(vXkz|{QmYN7=}nJo2NG9Q~g$>*>pmua>ha^<~aMChUMzBAkFZ?
zy*J4HdHe@)K-P2`2KLAw{{3-OP3-j0H#4+Z)bI%0E^KykSpB{^sp#DLN`OKF#>v+^
zl;ZujSCN!eg2V3{FV|LRZiY4$42Q;i$Zjk!z%^vgwY!uNk0RkC%J7teHHAXXs*7+r
zNQSI|SyKB7rRX#Ng3}ZUrYQcwEf0rJHz~gJY|(}hsx|H9sf3yr1@co~Oc*?ls~br=
z&Q*E(K$P<{aJ&?41)7*WPvSQzWorJyi_0U$vC#O&`U?M`mzK_2aQuM+#ebnP95fS4
zZ6bg7>gqE6DoSww6ZTJM=98SONnBQcBi;&_*I)Nl-CKR1Ga{K!rG6+gipIV+ua=+>
z+v8*V$)@Uy^L1YOmvq>3$uC#5f?}U&2^N;jXX<iYZtG#{$;XK3*q<9N)G}Y&lkzwt
zcOqCC)R74n{t<y>rKbkUq2gh(g&TrozG2VR>b!Syzn|^CDYF>A>^qIx#{blP>!7Z)
zXYO(7FVC8V0Hcr5CUpVMcGXCD$xwM^Pv-!`PD%+<MTKrT<`t+T(|N95?5C78w49zj
z@Q1WYoI=g3Kwr-eS^<?#*vBjr6JMqrgP~Fxb>dCB)z1VaZmGg<uh^WKTtqubUV+3|
z#Gxg^knz<KURQuX{Rlvn9WYrVV6l6e^E`f2_g9&Yrr(2mz9eUO2M5$3#7or*-};E7
zT-c$~QyVw0Lw=VgzDb>ckrF>R>M-0%Mz<toDfXscr%DI<y}_KPFG|Q;dBMxCXOei)
zC}9bF``qV3MzIyrh+UtmE5@;~i}BF=hP_0rkOas~qLge0%Z)(I)A42CO<KAMoH;`y
zY=kMI^zl{!%Xgvkr@W`cju+#+(*EKuCHH~%WuHABVR|;=@+zh3Mws2L8<+qXDdsr^
zeNW*X;)_D6P?>d|%oq9+JENBH)ZSQ7dD#O?(EKP9-cO~)BiDPa7_J|$`ElwVZ{cf|
z1n%NEXye0ib7+~nrG!|>zt%K(GeEA!aPek_bLk+dbDr((p^Gtehhwkv(2s)*k2=pk
z>Y|ItOJqTp6n}>IXwNqA3PZn*Iq<g@soOeOe0m&%^*^gyT=*DciY`Mo6J?|{o-Bg<
zuGXMh9|y8fTSTL=(8Kxfbaz`(Z3j@V2UuLi1|UF=*xLKuT=-to_=TsTIX7zh*xTx`
zpt^CO!T#9F;?8PcM^$M}1M8~M`3nABW+znQp3SLSFq(iNY$~Hem}HKj{{b1&&GAFY
zi&QGd4CQse!n7RQ?M1&ur;qPVBKd?tpX95U-Gb-1ttt`b)pi3_?mImQB_|iVl(E`$
z<@pEfM!FwU{I+L9P%Cv@lwrCJTNIsQeD-!S<==N{Xc*e794cNTf~kH^IrAcFPkfI_
zHg&bkJ|5gN8>^gkswefVjA#viDZ>uC3@Q&b56Nz{T2J<47gRs&kH^q~D^!e8+6)uq
z!4z}iasAX=2=N51EPQyK?Qusy`e6e{iQg18%6Wxait<7nGoZF7j8JmtYpm2F#!Hh-
ztj47qsCj~Xou(=UiBAa|$5vyB{6<XaHCB=YmOV)q?=c)buQZME!1MS@;ziO$j8#n|
zy3$@NL#f<=Wp~8Xim988j;hRk?cEv-!kIl|WB!}lb2Qc*Jkvw&|4?;8C(%TWh5+Q6
z-Sn8CQT<uKFw@k%P{_*g*BBe~Z>y2!!AtORTLC13LSr>In%;4pok-@r3Hrl-c2g}4
z1~d;3@B4)wq%EA5AV*WMjy}V`$fN6gp-KBL7oWCe&g!6<D@|q>LoOFih9B*tdHW<*
zzx#d#5?7#*HB_jPSbvjAKEFfYm9+F>%O*Uf=>obw)+Ks%RlPlwiETyU6}@zcZhx@t
z)%1%AcQr2#ij-o&DS4cYhzW<YFWB=4<cB_)PmRbAL+%;J&aP99mRgN=fmG=de~h!R
zt&Hc44ij2wyR<dcRaDC$BT&5sIMZ*vH~2X*(Wg2I$7o+iuXWxyNdZ+&V(RYITt(++
z+J{_oh_q5>V%Io{HynAcq803os$^f{dEu+efLTqKjFuqOJxOBSt;ZXEYGyOlozlOE
z&ubc2rVeQzuSJA28f^-1q>#>_1LjOBojtEcg}dik0y#c)&(mAdXr`_%FcuK4_WfpT
zX5yG6(jKr53{(7IuC#G$uof)Fxq{Q%vK+IJ!PA+VBoS?)Lv}qY;x1UH)rHO64bkq6
zXnrCBGB5L`uqYxJAAt);)Y+7n++B`-VaAIut@8?`pJPv)pD($t#Q&l->~>UjDya>S
z0-EHX$CME;8FSpcn;AzA7>pw)peHZAeJ30e*Z!>tSo@8J`Qu3VVtY(YWq6lvr}f>4
z!h0DGN#OIad>0krJN`-LFCy?b_*vyB@7dj`w2B1DOYLptCYtApA(@WG2!w4q^o=1b
z>yxlBQJt&wVW5P9EcAoRw9&WD7O}$(Z~E(jlK!Vq_Ag0j?KDxD(na|@2)gYcAJ}vl
zr1*Y=AwA;?$!qp;AKUCU7GeBO4SQH?$kxahQ;)?&_l;GTqI`S~6#&T#n5$SgyVSYu
zHYfJ{Lua!caCcQt^a6}I>P7aZU}9_f-0d&=s2hbEmItu++Go;Hc(o~ci`di2Y2*oY
z1G7KEElWN2VwF9w`l`=&OfU<xxm^T4*YP=MYB0@loi<Wx=u%SKIZm~a3~+$$TlSc?
zP-LAWZMn(c@WU0DA_YH9?uFh}22-{QH@VKG$9x#>S6t(J@r#hZJKPu)?izj5>*A=x
z()V;OPR*#h-I2eFTh4-6y)E@TUcf?OV=yA2v*>pxhhF&IU8`b-(YRj<hlAu5RISJj
zW6|}?cd=v^slG5Ki%*-$jFGg>ziV7AJScihvdW%zYm~?u{ebw&a1<RrDi}Q=33Bs@
ziq&mzmwLOL?w7(-%O&u=H{=mBeXHLqKa$6&`N!~@N!OVwTcTh69;7N=n=R4}>BA3f
zOKZ~oHq`H4G}|$DZ-LN<i*(-KBY$y=xhiLJ!nnccPV1lmd_$SX3|==F7z~}A4PDs;
z(^f6}{a((^iP84^kEgG^<+{L=-7)#pvgwVEfB#8p;isFEU!18)ZVO4@?bxe&A}W7i
z*U=DT^s0(riMJ-(5dOhao`loD4PcU_PHZ>Sf+e%^Jm+;|)41fP=RMD;i0J@3Qp|62
zKc6HXwZ%x_iT5$uM0$5-Q8h$pXX15+h={C*zut+E^Sj#nA~m(z1x?AGLRxAqh61j-
zt@~?tc6Ptu#H7O!B$|m%wUz(Dz0urGVdS&83AY0JF181`Z#6iN@Snd5$rzw&@u>dg
z7ifaE#-=$f>K*LVYJTTH9CXf#Iy&t3o#6S=&R?AD&YYfUOq18Ar2D;V3aJB|5HBWx
z!~}MkfJ`Q{B%Tyqb5_2`5t_womXe_)TQy|Ni>xMd6UO93E}cIKFXDgtU=?TDLv9p<
zO<#1v-h5~uT(g?ySI^+}?>l?b#(bhGU?3-v0x#XonH_*r0XsNKH$U>Ew0x8^I#|A1
z(%ul7NqW@YgRmr<H=h=W;i0RZM`C!SYXuk64s`biRet|V$9&80wbWsrlmvH_8G9hd
zvdnoT$(F7PyRo~6u>*yXKT5MhC3HBJtT90+>ltfpCm8>chkH9Ckw3A-_6VgGD=rJb
zz&MzhNgfy*Bv<i_!Y5wm3zcor(pFgtujf=YZ<dXL_%I7zQB<LKV*8E|5W!{2IE>a%
zMKguPdKrzEq*N5_PIyA`Z{iy6(Xoh|ffuzeW_R1J$3f_6u+KKGdmnr)#60nrb37nV
zu!PcVyV0lt<A$8(XN1oqh&#UON%eBOgdQXh{JgYH!!B_CQ9j~brMx3hvkw<hq{DfS
zPjtj_Ag*hc7nl@b$XoX(HeAR=kBrD>LaPkwo4)5jQSXxFoGvn8DBu2*BK`L7ZF7)!
zgixb+iD5Upc9NkLc~{qb^Mr6ZOMB>H&znPH3{?xcYZ6t(OXV<dTnh`bx^HOWHX@|5
z^G|D&m6RrMAK}Op{Gjydv7hU^QPCqqNQHgWx1ALF{C&FxUa0JNv)o`C!Wf-IC%Dep
z`xwmNoin68F&KS%wPRPFlBG^7Jp0$JU|9REZ^L?;8|z(mJ|qB4=WyJ}uDBKA*(Ik`
zWf7K3Ankbm!VuU(No-y|HN}Dqf0+pMZ_kO9$e(FnYEi+AEAi|ioeL_4;h|$KYm98C
z)akA>FUJgu&FCiD6i<cs$7v57&h1P7ld_yGr1{J0e#Y<OdRGg%JzO6P)9kw+$L^8d
zL>;0a*X$a~`)2<8r?DgbTPB9tp}cN&(j}TTjwi|JTMiA~+ce5c=1gTLr^XkbYd>Tk
z2#n!$2BSyoealaHBSRI6oHGuipD_)&>rhJqE}mMkHzvf(!0wSH+><8%5?nrR#haPv
zEk(>Kz9fZUdU)DPH^EgoQp5n<NutQUA8-4@HJK_#ohzgJ<;;_K01l3?Ws}DNBmw7R
z@T#NSHba@p!eeud=jc9?UPBq*ldkBpAMODGSGCN#X4$nM|HOS!88ZfMU%PW3T%mil
zjQIh%m+h^9zHDm({<VnU&dJ}wU36_3w$Os1j@`PZ-L!$cnD@V0+@qlwY@aOOxJNOG
z&nS5Q&f{`%`lz+B=3d|^&3Kmd4B8p0C6gu6Euz<1&FQy$U^jVS{U?~Fuj%cA8r3_>
zOv+^?*o~0jL^CPdf(rWdXUw2@33PsqdWSsGVvjIYd$XCJgC1wbQ8o)yy2Oto+;k&_
z`xixY-AF{1hkT9uaJw^eKv1?yXm*=Qu=x$vo8Mtu<&-UbjD6k_g+>tyg=&_i^@*tA
z*w~d`Ek@_An*2Ki-hn%#Aj6p&D6~Inh!5{teco2|8v7Z?zII&|Ss1P2)Xx0%k4{Uk
zdD*?DXCcD>{F9kL6NW#oKgW`C-LX$zH921SOZkP$pBFwj@sv^Ws=k`77H#Y=zCE&v
z(l^n63|6h=jn?ut$@_zs<>_lGnIW$Ws%(mykTW%5^?O2|&eF=JlmS7cjaw;%XHwN4
zrX00>jZ!mpd1_Up`J$@w0bK^poQ6|_$$Xor8D5R-78Tur@nwYJX)|xFt1{k7lor{t
z5hT%+`Sud76Kwu5Ah%^DGRr+NOns+U=`LmS7Hj*`2)})_A%;g%Hv5YDGnt9Qe{!@s
zQXDpw&IF9A=no-INq)#cUXl6NunZrc{X7due$0l>C)lTKjOR^h3u&wXe&+UZ=t#0)
zKcber2$NIGsu{vLI~*@Gq|a?5v3aH!y(*SEO*5|-7!BNT<|WWwHRbRZD#YD4goz!5
zpOV5LXmz?B^_T`#oAr;<*P`EOEYBByxpVWr;H6R;l&ib1j}%gn?9F!|K<GRAhkQ0c
zRLa<&<+BcNZ|Q6ONA|!d4xr;75M2wQg(wdHQb;U!Uots`BWP)}%nleZ&5|<Boo~Ce
zx?kh4J;k9<>fz<^0R{&qyn8pM+JP06%|P`XMJ^x5hlg>j;6e#ZdoHZ)e%4Df1v!%o
z?{<5O(AbqRoG5p);H|dbx?x&84e_~tY4`LT6;SA@x*~oashWlwAMq=^?Hnz6Aik_2
zPKdw9dc;cPiQ;J7Q@m?0kDLr&92KqQ{1~>$$s(I~XF0`{<1b;y|Fw<W>ASQd2}K<G
z9Qr(^z{#-|sXJT`aXqYZ6P$c7bjl};{QLT`+pKpb7jbFqL$O+a-~|So@``BEv`Ab8
zr2_jvex}+}XihN5e;lJNKiq2B>J;IuFRAx{`dO<X8ZKt&P_WC#<vG<H9w9l=CwdS2
z44{8*#lZ9py`x~r+82$|CRB!#j1x6CQv}%tq;KgvZ@&qa#@r2)Am{HBL*5i&WI^g0
za_x*JK~Q%)bL&FF+r->k#c-?~<<=S4<}p~KT8@pDd^N`_0W4-lemzKWo|tQC`n6^y
z2gjj^jYApuhz_iY-T`-s7Gx-;(C1baL+p7k-;xI26#>Wxlh)ZwT{Hm6$V)C?xjC%R
zlH3?7xYICF6a#3CkEbRiqcV#R74g~Gnbf$o9a+H8sM{{!fuv|}SFnj>U<EoVO3bux
zv@mEJTiV*B0Xt+g!YN~{<Vh8&K1SmSxWtF`D-9{!?Vv7?1kkevEAjfOyK(^d%SRN2
zOGagCIdRbkI1BBp&AGJ-u@LsQ&UEd7E8WA@*HR&d3JzvJn~3ZFTt5Z=B{#av{~x}d
z=U0p5pVsW?ou@7E-lY)J#NHz<jphHX&;(_ugwV|Y{A?LK2}@a13eAO;!tC$UekZ*l
zqr*(+x4lW(^~_gY45YrovZ5N!n>A{7zKiB;>{V)rQX^Az%O=Ni?dTb2j23AEJ&;n&
zjt}(k*~|RO63AI)A|mNM)TO5q8%Ms+Ofg0jqCX3rKPY8YJ|{|h+yYcq%0}NI4S8q3
zEo?3b=*;yCtOs0=e+lDJSm5<NgtH~l-2BU<WZ0H-cA2wI@RX{M>h8M~hEfE=XUk3+
zd3mO=Yu-5#1YUc=N%sq-<*n)xuRY+uBB7s*W*1rE3~$rj1m<&IB9^sz)(;Y)tf6`R
zyryJk!e8XgNo9S4_-@>?Jd%0@ixC=&<z+UWsnBO|gyBr~!7Kn=`m@J3v06booOAp2
z3WA-TU;S6^6;XJ_*a_ypF0E2!d|%v&=&c^c3HV!f|Fy9S=&bq~Y>wM?C4@6vHIXNr
z`PW!3E(m!%s-`201eRX;nc-CYPY(Bm8{4u>ei&T(uTixYXTcGC0Pcf+n*)uHn+*`~
zF5*?EKqH}_br;%l%%J`mEkdastiwQ#6*s%me_V*}0h8c!{6n5gThGSoYQ*)^FHyBC
zEj%(tR30Hj?01NZq(6^fOvZJwKQ<;xF^Be{D<bzDiqaz@7X-)%cA({jq0UXocJ!Z=
zXHhg+r<`rO_ylOkHHE}4fOqY%iK>^VhhE^myA;$j7>kyw9zRU~Enrf*c=a9ZOn6|n
zTIV~tkv!yt%S<Y6a2WQ`w4cQkdygA;!ednJFF~*&$bmtB<>Y}Ar}wH|3y}FR_Aqh<
zsD%7|uH`UI;H`)kiA`+s?)5~oLvT3*K9X00<G->hGMmtm1XpXnS*{*5aea=OVb)oH
zu~V4a6(UQZazFT{AQR#9EW%QwM|V9xKbF{OZ?DeGf+&h7W~q(AQ>Ta>jySI>%NM90
zbF;AU{RSJ&4aL*HjEY6jzV~PkF~mmN4ou;^Q9oHnMv*wBsm)7@pCQ-XOh>g!p=$@%
ztA~ok%O@jsC*|+f^|z;}03Tya+<jIEI4%5qLwUV}I8i}@-e->%2k742{Vi9icy&Wf
zvLXtBJ+KU5xg1@EtO`ED^GZIUJkWzw+qwNYxir4BsQ*I^bllo1+=|P3k9Q!hT;_W}
z9uoQeIO`~Bzy@tyV_k^z`yZ7?eez3OTg{1nQ3|`6qVp)+&nn1@f>1ZUv9?04`6<BB
z;pghe1_zOB7NOcZh=z_uFt`7j%JA{WSnR&CBad4qKuemT(YMP7+}in{UZ2X@aN@nW
zMxObaJq_Ct#91$F9cRMPn$7$w{yo@5lYl+A<^5#LiRHc4`5@s+U;9^dipTZ0;Cb7E
z8$=2>2h4F<<K`yB1eEpmn}0stT@b7+-aOc?=@bgmO-SG1`{s=kpW^y^h}iKCaI1a<
zJj!lE0HHD^cAqFy&xE59HC!4hf+5aVwMIT7FHelrS!E)0R7dxsNBZTV$(}Gi&|UQe
zof}93rC16A`Y*6YLNIO!a;$6VqmBxlbS$B!Lo|tTM^08P8|}n1pu~C?1JHtaso+(u
zT)>ARu!6}WqEh@OqW{;T`xo=j*+edTd+{i(6z+eC9NKz!W%YIzM3E|ROP#Sh=<Rgh
ziTYfFZx#Hc2=WQ*-@iH4hgtwPGyy=n;b-CJ%=M)hGpzWC7?iK-Bbr5B#98D~4K5;u
zU{D+Or=%doj{`H6L#3tO;1^cxJw?I5;2N%xUo63T^@vJl%C*ek*H#;0;qD{4^+WGx
zZ6W7}TBH@|;{5EpcuaA!IRlD9&YB@GsfyeZF`Nkj9ah+)J!$|rd9A|G&c{DKv{tC0
z6`qZ4Z@b!}6)b7osQoU+1-V<CIxGa&#DDvrLIj@Q4`eIk+n7(K8gLW4j5ODoCg(zm
zpR!b0J_>9j4TLlnu_pVTHiyS(4T^83yLUV=lts$00PtM!Xi5@@a!4mR8pL!!l)3O|
z?#83wzC?PT9VyiYZa|WbmPizXbM97{iUZ<1E**J|V^!tHsCKF9#GK6)1;0i@Er7J*
z@%_D=cpE--E=fX_yT~m@C#9oj)a6QtI?o6_ToWZanpNN-I3heTH2w;n^<QX41G~(0
zX_vC#C2oJEo|`hp+Q;|M;F#CwZ$$Tj@6K*w==!Wy7e8Z~mu2fyqUio%t+)cX*Tu$k
zL71^tohu!YV>rOV1mle)8a0$+Nq?iZ&?-HutoMaVdlm%*{gQP1G8!q^kxV4%`a+%E
zSUqE*UF%eP;B@OSLE6V*N#}vCL@$?n@|VD5{A_T`2q#So<xJRx5J$)8jj|k^C=v{q
zUdqLtGI`^Kj)xSz>CE{Liqer|K@<R^YKQ`wUE<NZnD?8Q5qx>n;GG!jw|}e1ceYkB
zuZQtr*U|i4kMWuALeICo8DB9yc;9ZTEKJq0!Zo5%kQ>U_S$!WFwxZo-=F%s&B9pJn
zqYkjJWbtn(Nqrsf_(rA9BGrurGW=2^+xp`=V?l0kSUwj!T<#0|!yu4Hht6G`U%tj|
zC8d__!Gy`?MX0Modm>qY($ie_D%TSFnFh<wL=N3pTl%*~Ml;OWO|_MOD*xAv1vSd0
zCOn!)k6uxY&C-&inbUK-O~o|aSL6$G74%Y~YqT;RcZSGhh;?SF$eYTvhZ1!(u7Q(^
zxb(Z42Ae{@_2$U9JCeLc((n_*nk#X6mL<<`NH?1+s2Sr<fk#qAAU)L>?1u8$Rd4d+
zDUPoz-=gUuQ#~mX<W=!M>pYz#U7ekmQs?V_b+!pS#A~Fp<$}#Q{VxYt(cIaY?+-3Y
zTBARjC=h%9Cf5~JgZudM^X*l+_MC6+28v}h8VLAds*gI@9TooKtLa9UfzF1qN}3c(
zcl0e+l5B5s&`lBw+Aj*j_RNVNf82g`$`Nu=#_92#fIgVH=_2>lw6-B68jftCW;V(b
zINd5^<(0>DYSK+|Wr!bdReJ1JeMiQQP#%&jk04x1|K7}>K^2J8uznp#6LpH6#>fC_
za8YGq${9jRMAjse9E}M$eRJE7sa$F>Nhn7X&XWE!JUD|u8lji$GCX4N&ilnQhv7Vc
z&V9;?^8L3eiTgCtBI^qBGf#3#*uOon*QBSQ=x8TnxWU*6gLEWvV=S6`l#DH#mCp;0
ziG|K7$d{aqsxN+jI^Gym!^hA28TBDx-)KbbbqZI$QMT8$S?KSL{?~a3&2JWoaLni6
zyEo?Mi~|{xqQx(Ny!AwxGQ^_PYE)#rrB|dBlFqe|Q;g%w?7ND2ejT<J8h$RHnKL_}
z7C6B=5Ypa7O-cO?y;Z;oaD;g$b-%nFMN8~6v7KAoy!C)UI#{9iO}p%nbW^|+is9up
zg}WDs+^ia@2n7a_(W1c~b98<RuY{kCrN(<ZDPDgZZ7ga%A5z>^Y+B9q*~^s{7pFkt
zD(}5BUf9F_ft?^X<L}dP$oTNkEfxn04HGSm??!n|YWTQcRobkRLk{svXua*FL_6@i
zdho$&Bts+zs=kIlU<Yf1ueUjv?8+(MbFL)IoanA_&K4N_YLDwRGkM03kfXWdBlcn<
z_Z6aKJPE%^{l4sNwh)TD3am+Pw!CzE1!F21p%UbX)Bs$7)R}!*dw!M(KDC&YLq~f|
zDoQm>0~kc^h$BlyyN*|_Ca-L|>fgHst%ojEM}-8KJ-+%Z-{5zcYszb-d+m22jA_j^
zdxZ0=?>CG}ApY{wOkvMr7GpaPEDy-9B`@C4VTjTH&>~#(CGVjDeUEr)`+Jsf)BVA%
z`jX|2uJ|&IS6>S*(}qLuV@a}JvO6zxF0*+!KQJaRUSUE;p6T&)^b>v{#Y~NrBD#}B
z&dcMv&3x8}Fn7P*$2;y;bJWB$z6ICg(}X=i*$5ylLjl@ZdlO&Za3!LiGI(?_f-u@y
z0h_Qgi)WqWI4J~l{Od`d*I<^{+$VRZ=?dX~E*7TdjpjRV{<ld^yxtNh5<1P`tR8ft
z?@R!0A1Fd-sK_}=wBPVJZsTT&Q1@0xZz+_ebd$yC;T|rA7tchm+LaW4k95MLVjH}5
z*4ZI1W8W$$j(^j{r3Lf|iQUSNHCG4GF%X+l{&+;-KV^5LV$6KY(8RrccukRFwGDro
zvn9Da#quLBt31%NtVvhI!AR0_VeX~EorgT)A)J&UAt9sQ2lvmRe{eI+y`7Gq@|gWB
zei|2z>#DN^e*93gOy!JA;9gol*%8)A$^&NOi*HU75$rAg*v0O3&womKId3|z@6Vi<
zLCI-08PQ;7QTlyQ2JK&Wh`kDRs&<<FG0^<hT(FFG>aGK!2!2}NzkL<`coQm!D#fK}
z1BMo{m_=++6K1vv1CD)%;q5vujp;J|dZ`+)?=m@+WxYivXnOX=#?LD`fLzMa@6T4@
z|EccHqnbL`zF`n0wIXS&6%k4FP(%+(R1{=L0!5`(AZ_)C$`BMZAd?d2Oww3UL4#5Y
z$`BM4D<Ja>35ZMr35d)?kN_cs5JCu<lWzz6oag=HTkqfB=ZY?ny;#ZK_kCTz>DoI@
zW0jngMQvUP8dU`oJ8s(ejWz^^N;lq$Ie74(9{Yy9xI(z;HwRy$Ul!HW?kU)-I$@k0
zglVgk%FJN5JEx|~I#zc<5o(H_W|5_;BdJhowni3ClEBn0Bn?SbMp831Wk}$q0BM$>
zs@&!d?kkcFbFS`>hHuni=<#U$|LwzFo#X{HBEM0M3y2ahQKMiX)sF9hn^>b2)OOY9
zaP@4sx*MuqN~GI8R|5}<rXo+oFz246)mwcNT!%YOwu<Kve%JwB(px^IKN&C{!#I7}
zzJpr}?Y1BsP6zI|rmi@a7oc>DD~1?uH#zI!Q~LGq)Upxo&gY2;pL%YcM_wl?9wf_A
zbxy4G^wDj+(z8I-Uu8QIE1J2bFBL2ZQxof`=|d}9(CT5546U*yX^cp+LCtgwU6ZGg
zQ8mK?O%hv^x2i+hV=JG=%a{`U*i0Fm3wxl{D0wJ<sRp4y-p0z{nzkEj|E=kmghOLw
zA*gt^rrMxBt+@_gX`y02hi;PD&=-k|%fs0#<BPfce|`_8wT{=oVOvr8r&uatxhk8o
zc6@JaOv67%)Uha)EYXcL=IRUN4#8W=mm>%gMeiyOvG(g++2i7gFGmQ7$Pps5%?B}>
zst&BLoA~F5ae?coKvvy}!F`0@j~T>$IfAB81uDM0S$VE-G5((;V(8FN`j@vvIx^uS
z_~(d4$^VbvG)c*ZYWPB>g3WYMw$T-JbOi<!t>J!GO*dIUYig<QV`TC+w(jD-3SqD4
zE->F|u=!e_GdUpaUoCne<=m!`m5Mr0w^5C&gX0yDVqZpt668nIw>rynig>`&sSDxu
zf~KQRw)wn!RQF;-tj|y@leyCL09tPq1z!G)GNDpKNHIN9;XMfj3_&Vq=t-Y7@<|oA
zO~f)~qJb9#MaaWJ>9i!>_b2+om4S}&)AyODt!yBs%xMg^n93$vBD{9B7JZBME*9Eq
z95h6kn9d8AP{&CU<*+D*$$|r4s9w^MmFgk6KaWzl_66HaoS4*26{+(ZI1Mrmu^T>F
zkHPWP-P^~2IRdt<jxA$RI3&d_&2>MUY^%WD6*#_b`+(6Aw9ig<U4Dj9o9x&S%7G}|
zpLShB2FdP_U5gH}^^~oy3`2dqje5~Q^voS0rpy{oI@d3gBeK|E@mo%&@^TWfMuql9
zu(5#Ggx8Ldex|ckn<lxb$(wgpOE*YE<}6}l`QcNao2JizDf~ZYHoanrF5+qHmLpBb
zj?<vkI~%U`ozPpAcNrNxN_{q*demk+b?4GiG|_SUbY6OhGvXCXdOdonm8E3HeH=T4
zidOUGqbkl=a~3J5VcR%jN4NxiVOW$0k6g^3*$_6dAgdF%4WPY9-Gt{2&4?25p!S<k
z)r{dK9?D^AfJF#yKM@sBk5(v}?ete%sEeG7s?)DDtG4l}dr(!Ue@!cjg~&UG+d7R5
zygx2)DEn-w8rWj|6dbvXpJ5{#{^f8U<)to5Xqhp3fNCQf?b(8xf2J29xh1wmj7ePN
zGe0;+QPUp7(p|}i$Xqw4daJ!1ACpMM*@!->{cum`E9b#Ixt=Doxu^Y!y2;Q_+3Cr!
zU52%YrKD_OYCmTmrwTE{^Ml9Adamk88$s7s8pb<s58wOTtKZSlBMV)Sy=8uuGeB7(
z6|%P6(I0;H(0{}xE4zu4;Yv%-h$<P9<0*P+_fh$ALKf5g#D{eCeFc)Q#?JanSXkJ&
zh?5EC=i$`8xIel=R5!BBy+|Rd3NdGZx|+a9T5T_+GaH-{s|vQg^{S#dx%%2YmHL=S
zh{co6);0GQHmsV7z(tkSW#dZ6A(Ux7!%p633tyd<%05t5%WphMO3PfZ8e~8n*-6fZ
z@09<^Yh%8Ot`(bJ-O`mF%jYca?kMkc78(xpxk?^K&h<ItCf1(}cW#P!cgbV;cr(%A
zKg%Yc%8NvsfAfw|2J|Y;!zTlz9fr%g(#9({VC9F#*&IEjCU!(8%L8$bTIBnbn4(+F
zVm#|}2QdU)->TP#R$A-ZJK^T;urHDG=zDA+>7`SR5oa?yT-&IJK5%yv-|yBl(Oh|;
z-Br;lzPd~yh(a7gWg3YxheaHF492%7o1tMy;Uvln{5ot9k78}CT|7sFm4(PE^_U#X
zV-_NdM8Cp;b5`X^!nw?k4$h+w9}QnVl`-1i94N3^Aa<)g2}3v(=NtG`32f2Za!%S3
z&}p%&ncmixmq%|Yibnm#a+$eQG%kG?;FLj+L*L=_x}t1kf7FqVV{j=bg3Ydszp+0f
zRBplz*dyBqj2T-Y_6DG+;$3|faPqFslO|b6x&BtoF6bfd%4C9i&p{RbU3jnRE=WGS
zbDC`Rc6)$M_u!wObyZ>u%lViaCPg;w*%11DWL)TS?BydROU^_oCY8Q&?{u1*!)UDX
z>3e)!d&YG!+YcTfd&#b8%L{kphAPdBsZKN-;6!zibsGMU@&nWxdZqg8mJk(Taf3p2
zW7fGLFnq4=!%pFXWKiZlQ}@ApSin@NClranRO!Sbx)%C`gZ2;9IQ%8^7nErpnq&M`
z61XYV7uW2Jn2T+>@oNUM-YTwctVK^%vk~uTBfCt7g^{+TKXAn#t}Tu}EDsUt5QV)r
zP1{}BLCFEKU}gWK0I}$3ZT<3NcfvD`Ub-`Bm-78jpjo#(or{>Sk1wtpxXBH~xPaVQ
z&rf1NWGj>`)*VTmUeJXri#Pdq<dOyZ_GtXn;JNZVbZrPP_t0|@DFtljR(0dnaD0h)
zBbqdX8%og)Ew$Um58)0V+7o?c7M7X?UJ~sCk|jHEJ9-r)OG(`z&cknoLfsVi=`xlq
zrm)V3#8DS3n2U6r`oDE3J4!Ub;#^E;feEMuNt>Oka!gRf!wqWB5^u3lna;z|=@Nwk
zr&4E2PAz^|r(9$_<z;1Y1M8@VqmLN8!$)393eS>465z_Js=%0yU7ocquQCp3AfXYZ
z*~)hT>IVl$Qa2Zj$6gaXoNz|qcepq%%Qux-U|3|zZ34+;OV&cW6TeK{%CxdzeS;j%
z?Ef{=^t$dn@H-4|K?k0-|3SiR;(lV*Op$Y+Ia9y;HbGc720xGTq3OVB?_E*EjWG3Y
zqRzPQ#T%C@WiFEELmZ<4m>l9%G!!elohvM3Q#J=CcPu?>T9E3u<c^Y&Y!q!MK<>yE
zVLs}~rz1slAthjEF>s2izN{mrs#x^QT3;Wh_U4dk9;U%bRX`^T2KE+kBK+y}w*r<*
zJthz|kbc>%4jQAM7liXk<CKPI&8HKEiqeId<gh3kqEYpD_d~r3&(f8S5t6Uy?qCDB
z>#aKVN-CW!o>C;%ON%)bBGSMgN)f1M_|~}RvhG!MxrsFmG}nyTjiH{Ia?6{?!xG%<
zm0$hj%UQJ7ce0>jofd%1i@~jqgwuYFt~N`5w&ht<Lwp=f&KP}|@_>%CZ01l8w7(Jt
z=5mwb66<JbPf@kgH!1jeGtvyH61>{H=ZQ^i2?qq-+&(u)z3Yizo=Rm(hf`AfspK&!
zHR3Q<TcKMR^x$#6yv%Ds-RE1Y5M(29>M#}1s^Y9dR5fBr0br@Hl_z;P!wEsrKW9QZ
zAwZAex&_q5jSJy{*!p-KcO(6f`_NZ<Jx;)*kWPVTU6Nx(Kb}93y?I3MV?xIzRRRxl
zm{^t%YuU_V+g9SQ*eZTbgg1Ix4?F<rMaZqwq{`px_#LK5V;X4P^`EL9*re=p(aU=2
zRkwYlw*#a225A-8vh*=QcN$a(4G6qB>tf=bX1Fl*SIB%%l94-b-;F;GnK)S(dn->F
zQLK9OD`Xo&*45*C1{qb#lKZ3-R6K2IPUbOm<iavlAb-e`j_BBgt@f=3BG?xGbwZ|N
zsG2Do%^a3tTI#)B3hk70J|v7)wC0dyv}Rm{VY0Na=1uEDW=MFX@19Yh^a@n!Apw}R
zQ=zJ0p&4YA+L6AS)*=uL%sF;CG;<_WToFSW(%yID^E_NHzJL9QEI0K)S7l~kt|-w1
z+8slR_%VZ)XqaI|$^{SfLAr0lO>%tjK$td3*MxrFX*7Lkno=ONKn*CFz7D1c>AE@F
zXQw-Dzc+L?JhswhSdxTU;@%qm2zy|7l9T4B;#v}k6*$A?6Z9pnc_KM>q^P9`IW0Cr
z$L`VnNuTFnIz;B2_+gXe$MRm;3CW9$BA1nSo~hqJ-O%`AJ#m@Meuyf_I%svIg%SN=
z2BP_e^xz8c$gK=(2Teh8Fk%5fIT#55^;VVRa{mGE)QSIdgV^QVo)9pD(ZD9*WqcUZ
zVYpX_Cy?GXvU7BLL(v71n;a_!J18!T=s10R^y*hbdb3jQREC+8TcqOW)ecb~A`_-m
zGnSH>jMQ;w+MObI>VqL{S8oV65Y*zwnfT2My{y}or#Clwg`CC=7@npw@>4$NzeBk(
z=K6I*(q3;cvpgicR38Ff){PW89VRL}zmco|Q)JU%b?vjVX<BU#GmYk&PK!v=0cuqH
zxdMn|q;wZGTG{VvpR--=sxKdGlkE!L`B@<?%SyMJbR~A`LEwn?o*5_w;ze-#D=Z!H
zB<~nV7Sd*6iRgl)<YEl)^=oBT5)oRy_^wVJtr=EH?87rnbFdcm9A-A%i<BuI*Mhw_
z(8d9lLUqXsXh=2NRuz(x0}B$#!`lrcDNz9Jx_neqpyA&bh>4nXMoh=@NmkflF=4Yv
zxBcVhn7=c+-$&|noii|^D}zMtB)Joc5WlNo<REgTL&sNGA?sbuN%De}o{oO)7z&(I
zy?E(Jhfs$l>&q@*-ISyJcJESfZPbg-u66M>frsW&jKI|T)fEcZPq%D+u8xjv->Kuy
zXTe@Z#gUF7juil5s5^Zzv~+3)1|7~Ta<?EJ!4X%Ej$fX7Hhg58JP=H)q~&s?ecysM
zFK;nrR34fnFZAGfn@l4Q<)P~FTj?c1c_xHnh$DWBr5C;!*i_P*|1Gm?Y(d+u-;R{n
z-{3LxZ~wK0Il#g|rZ3ZxzOz$5br4B}4^2dpFD@}ocf_+-p{ij~S$&c`Sv*qH<zGJ=
z6@llmq)zr*QXP<UIdIv&zdDC$%#YkKOO-UF_a@w{HV_qGQMd4tyqc1L7xl(bTwNVV
zAlVA#RbP5v3zZ#~%$+S7swnG3M<}5;o$En%ue>alt|fNNwmfSbk!(L>fsER=*z$7l
zL@+<HTxJNJPD=7BwTen2+rnaoXDJ5bC&GxAob)F{t~IwZw=IcBq<#A+D>@`$Pe{ko
zRTFf^{<!K`*(u2{1RYvi?DOH@@i{Wvj;V1rTe6fo(MpfNy_gXi&RFf`WN5NT-5Y{I
z<+pqOSv(iF01Zfd)4H;(3T{@<5oFW*w=o_TY8Yi_t(-7nc5kB1gEv2uD95#&E7%?A
z=$!B<*XkWF;9DoOyo+&;6DUrs(e*>w3p?ydLf}==AzgQAC5zRv*EHJdH&GJj6!7G%
zSE$?iDxPn=4#Q%h1Nt;nxSY!Wbma`4o4^ITXCF{Kp~z#3ss1j5i4jSj`;X*^tiDo1
z{yb}%-)#Eb@3rfX>Kuzp_dQgapzA39_>$^zq#^F1R{>e2g!Y=JZPk%1S<57qvD4SV
zSvVzGoYL2yC!d*#HtwPs-JR8QBeEA?esAd`kJN!QT)rmie{ZQdLzLhswxfypuF1wG
zMbbH7TTw;99M)U<IEg{HAz_J>R7G<(a`4H#cNT}=z{j_YiahsN4awObTGptQDvDR6
zMS&yo&YEH^dst-6%9aicvfezs01hV4v*u}c@8>DXu3hneYc-FayrzfqUmcN-2!lD~
z0uan69^!bT4B6iH@(_(E=InXIAw$1Gc3J!+2=O8Kc|vmqY))sN+#)ZZDua2ZQixl&
z*Mru*^t7n3v)LGRkMV*stM`%2y}2NbxVy<@s~ZJ+%p@8PlJ)q5UcsUG<~|#H0I|$9
zs<$07A^O#F@BUqgY{@%A0xu7T+d~f5-Ym4B3%M^W&%wTb<uyjeI}wizdEkg2kadB?
z-vc8e3Ad7{)G5p+7CY%zO&J>pl;s$87BA;0Ms-~9zjYZdY1j6s5xJ<qI6t>ajgaU^
zohfEPIkxHeA!~^un2rQ+T`h>4ffYb$-3kzHTP$Bug@t*C;xA^hl2$d1b&CYlm~n5*
z0c19<O0M5_8nmqnxlvcNv6Sgb9C|^8@^={{`#?JyTW+>6!ERyu#kTljNMoy6S|leE
zV|&F_q$}I2sYs<aS`Wk4=l%+6-bvT*h$`Q7u89W>l}3GzPoX5RK}EeSW?S@Hlc1YZ
z$?81p9Dcw;$a7K8J!1!BKqesLo>yM@NH82#(z9YxWn|-@Qr7+Ud@9TX2BlYnWW{8?
z<;y29%$P0u;U9XlrE~HP0NJ$7(D?s|UndIqeU(AS-cL&cz;EWzm!8GIzQ9Ij=dUJ7
z=insf(*SJ|nzbL6^WIc1Y}xY04)1?F9Kbt?;<EqJbH~?=OwJq8zYy}^eyVaCFy{kT
zH^ndcEe}I$cR3u%uC$x*O}uKfxGV<9u~f$cxb^&zF5q^H9wpC%`wkF=e*V#y49HV+
zXv7}(yc-{{xE76>PUmjctA%p|)2bG@w2gnV$bXYp|J)v#5E<=z3)1a+c`oHjeriZL
zuXz2`OumgnWMwL=<(g4N;)ofswphJ%p=)XuU~$v<t%+|}gQH_1Y!vh=`&(E$#b(Em
zs|Y99`3wU$){N{=@3=-Ls0*1*%*Cy2zOyCe`+P|R1+6HQx?e}ws%J@Gww4ywaO`pX
zyEyfmZ?w`4FB3!z)8aiMDU)}JPG?l~NM04Jga$uYkZ>wI+wW(_t}1W>WP$P00T%sJ
zTh%;uK;o_G=Fi#{T>YxN?tI~2lWn;Z+ww89x5Mz|t_AoX+Vn=I-iI5EsE@C|V-c-7
z$!-=m919UPy+AQq{6RxAWOWv*ZF|zNBu%=)lB<s$FLKfKP0RLnUcdCI<~#S?2aj5c
ztV5=n>|cxKE+>Kq*gsll=v%{{2&Jucqcc!eD!jm*@qko6T?T7;XC3y<HY4bRm=xxF
zj%$HJ%I(kF^E0h|jw7+6bLeW!nGEV>*VGnEV(NaxIKHC;j({L#|Ms=106)eQ%!SN_
zDX|Oy1lAOb1l}<NKL-a5vKEnbnrwv&hpmOgZ_M79zp)*$4jy&oJo%k*^$YVHllNUH
z6-x$KtG~yci~K7@)u8=`Ga|hxjv<}9^cETQ^yslcbcAY`L`RSpzRsorRyuIVpxvnw
ze-Au2od${jK$-2UvL+j5FeoAAP04pX(h7*%Pp5TAFMrI3PRoMFE+JOH+3X@#K(_LV
z5%_AFhOFHEi+t~O{m9pTR+c7?=*>MX*W#yF^o~GCbMnS>Ce)qNfKFYb+f7&DjzAGZ
zk26WiyRDYrF1_e*#OnhQfu~v0VyVy0R8WWsUERxuZXK=exk)UKCIFH^H-g%7_*riU
zch-~9E4Luh?xjK;*}+WdoU(b^MDx=-U2W^CQ@>R;O-z=wEdZ)TQBCm|#Iq*eMA<+_
zr$m|Mu3;(yLDSv_EGOAP*s6l}1}0I6#%xy=iu2n+00au>C=~cyj<S-`G^Tl;1s;D{
z^9$cMxxS3O3mW6AJa0LBHyluoM1-%WP6X$B>K*Y}?QKz_K;Zi<TNqB=ay&KHxpWv+
zzl&IpzXz0~t8Oh$7EDB)%Sw5(S)#7IEM*Gw7_kxiHg%_DS`Xc3vYuw7&mN@3+#|*Z
zaE}^4>eYMXY_Ur+saH*$&OqCb48McOV~EkRXKj$Jpe&a11-K7(J9@>L7JG=>&>9Xr
zmH;H*^VWh6l1&=f)?H>qSAMpOUY!gxqI3g-plwXFy1_fGPR$^MFWRm?8V*~$6{D${
z?OCLIJk<hcILAqG5_|c7)=k;SB>)6P7h6>VN=_f)N6u`+gPt({ttvHbpl5*f??NhF
zy|}zmD2q7>mlOro&fZ8Vl=0zD=w}d|hS)7vGdAPEPkn+De2;k7#XUrfxll5pa{2I;
zgU0RP+M!F)H?62!mR(z68LP6XS5SI=6I^*xB;4~$Jb3-OokyL>udy9|>K!>A)sBCN
znjjQknpWBB!_bB%#Hvj{)LuV)gZoYlgVTiX7f8q23~zA<=u(-bKH_yzh?D<58(;qf
zq0EUX#DJ0>FFGS`x~t4`)52u^d-TrG>zk*@Q@Nt=vxUOOl`3ITW=H?5CbRR4$|V}I
zLNBBN8w)e?g=yYc1bdOPj*>&p#@wz_*UxJT>7>}~MM+!5)m1J3UR7Y}$Z>N5lf{z2
zeMYnT95sy8NpHdZel@4G9Cs}E(mHrV6sP_y-|GkD)aUPQkt4!MrTe%tHTRN}Ex|ty
zMpTO*lWb)6?HI(;V(on-p;8w@y^dGO_rH){c!_!!*}UORO76+4zqp^}L$aLH4n`C9
zPUiO2^d-*iMinJ2|GK|^Vd<U&I|US3+5sE(Ix-$mEEMtg8AbY<AQ4%`H%i$SPJr%d
z0fPnLb#C;?-se)7l9i(>F37k}37xi{eF5-pq0N7bFQcJ>fc-C>;=vrIE_jBi;s|Cy
z{a``0jFPHQHAsLh5$R!XvL{Q4qmgPTfPhdW>=r5>TvJNtRwkzhzO^5&f8DZaPN(|V
zNaQt?F*2Ydw^?=Sp3BT1C?)N#D8r*#7|4Mc8_dI=di(-u?``?lU~5~aKGW=KJsEGh
zm$>!oOm}C_r1ZN_px#@N!_RdahG+9SeU#Z`{89yXsk<%tVHl0`$3f%q$migJX0XX&
z)g{o!Kb+O~D8MifwR<PhH+1`_wuSPJ`k!u0L8tXf2j{NjmgOQ7h=-Pfn{y6*pNC*b
z^JZmOHd+ubB6SyLkvJnGV%wOcVEWxU1+&7lvtyCY=^7Go-dGnrgp-QooXp)EK-R2O
zzaG$%%pzLo+6Eae7E2rtRH+wnxdoqYH))9j?GJgK<n#Dh&ATltWg>d##KgWQt~kVa
z(C4F!6~h4$?Z8tv@968%#g%2ZA4qkOKFjz#G#*chwg<`nMGU3gPenEw`3*jCZ8dt0
zns&C~PO@KSOk`9ar~iF${mxDA?P_(Wg6g^o*im0WyP~sBSKaFCqfX^;ix22$8rDUE
zmzz+w1f~4u0A|&?#QpHHd|Nm8=CIBY<U+jh<s*<taK`ejwmoPW*LL%C2XOv2p@m6k
zYB>fU9SdJ@ykAF5p>NapA?52pEpJ%(_oGs6W##-_!f*-(Pl&7jN4didd=HSxxPK%m
zX2m3aLE);pmEBX-3e?t$86t@<!31AklkL1zY8zKRzigl+CZWTHJX=o4_DQ)P9o-kh
z*^n{yFpumx{scyx>Sdd$xB@@=oRMj?_zCcwHw@BHn2TDN`+gG@T92RZgTF+qq~!Kp
zN$Yk-NX4HgV&b8{8z5gOPyM~=KTX57I+3A=!Ny~L?WaFDBdjo&ly=qlmPDDZIt&K&
zapKgakI3il0y-r@-R`7Wj#=&%{f)j)?oJL*4(F!cJsP!xL?92duu;X3gQ2}s83xL$
zF)85Jg+-|h&`V?bA$K3ulax?<6OxE73fH#bLC7d^7*eAUJT|GBGkBN>C%t_d$YkZ)
z9C7`S828<gn2TOo>!1YiTA*GeZ%hd83T}D;>KUd5Hu*c=0boz`rtD4CEKPWNLUTtk
zq8eNv$AIQ@2`m{4!Xf+~;)@$RlNd^S7sCBCtH*RfzFwS5tClXz^)r<}utkfx#}0a>
z_}pM~(yX%PS*_GeA~DaPd(mZA4SL-={ivJ=EC;iV_Nl&l^Q8B!DD_<Zt0Y^fP0so2
zLgD62gc=_NKx6Z>W)4HCsKYs$ScncP<B>rd?3K-qA1D@_IXiCr-!VR`Ev{v}phqPg
zgUK3Keb5j7ZC6`SL<$A1v89D%{<7F<zBsFS>hGX=OSnA9s<|4iiL1c~)VM6t)jP5h
z4zuQ*y`}=_GuTpb+Y=Dr5L8DLiv@Nt?fxm-5zG@5((Ceu1QaYOBy^>lCYBU=k?N=-
zk4!HezHZi)xp{QtbyAviIF>F^F)sq9E#3zG9q@FS3Uv%7_70U06cQ^@R1N%_G#A+$
zS=agLBq}F^pj1xttWW~?uF2ERZR-t}pOLp^MBlw3<C%9S^ashq>dgQ0v6lwc>ld1K
z>)&B_JYXrOU6j7>KAq^}Bw5wfg_gRk+&RRyy)92c5`<%I%or!5tyMzKX_M|(r}9h-
z(Nmy4bj@DG_%ezbR%uO)Zb@L>qfjYiy!4i=li7+Cm9A+Ff-$3oZ|gMPIL;z{(73M#
zI3IBgfehDufA#)6wGjCh{$i|A>z)iFYPArJk)qY_C~G1fXPxvYjjp^rl`9kriJE>N
z6U0ST-aw5@bZa0(PeGMp$MCUpJWq@{q({HwW1A~GiSiaY2NXPO8f}7&8ok`8i@X_1
z=+(?Aq$VbGWgw?nTISF$Nf4&#sO)uk>kG`xJxtuZm$}cP{><FG(0hY?!nT+T1-rR1
zTJ@xz(et1CfM*>d;^%pu!sbY>_yq~r8mh}LC^m*VZLUlqJ8w`59x#KrrPaGS9x+%R
zJ^zZn;zyi2&J>z1fY5mRUG>7EF(y7t&5SDr0IVedL*PLYDwbYsKT9n6BI;%bzq<&q
z=B__f-wjz-s%z&Ng-B@MWu68V+$>M$Z~@$^9FpUB;W(hCEJzaJLcj$m&1g8MnXHgB
z--nH<{*+NTx)Bd)(eZP}AZSm_T|Cl%&f_Qgu`*I@2S@fE0Y8#8pP}rb+RJqp>+P)U
zWp7x@D<)tohBFazSY1D0PB=|pUv9?@tSwG_0M;e1pS$T}Z*GYT)%zJq+9Jwzw@~4y
zIH~otXB~|%`Zo9dEdbB3LB5q8mu#|qKRF|GDB$X}WPKrXfNK;kKdQ#RusuX@O7!u6
zuP6IAVj@^5xDgz#?A8Dru<)Wo%#b+dYQTT3Y90j(oy!E6&KqpLrb_LINgTN}`@H6`
zaDe4S3I~vT49hsn^0QR?jS4=%k{fif6*YO|G7zXct~w8UR<-e?bJ@&kRRTIw8Y`o-
z=PxKPyYHl;ez~7&2r*S*g~==;gf#zLw<}M|wQx8OPLGcKSOoiX(FWW+NUZ)!b!b=m
z<QC~uaz+GRhe<L`9(3vrh;$Th4s`;2#Y1ykD21qrTW><x|E+t9a*r9H+%GwM))Ait
zr<Mr+yk4qY@zRf<?zjgY6evG-!bSo<WTPXauOqmRIEgHEoIN}xENK_AqaA}s09b?N
z7({%QVS63>ZyAGbZSg-ECF()pRE_6?44d80&z-pnXi2oQE}>ff8}%C@A#5DjB;G8j
zmxd~80?rlCfC0r$v~vDCW<!Mb>)O+$sNZR$B)$Slxbc>LPQzt8YP#7B4H-Wasb8sS
z4skjht)mG}rqk%rn)A^2gE2A5{Win>EO|D>q;!N^6223!L*#zuNOnPwD0fdv+nn^i
zj(PYY&9M7HukcfEh~YqPS;*!_a&}{@-lJyx%>Z+~q9iuH_Ziy3s}|pzsGGG<<BhkO
zmd#!1PYXEsx|<}7?>*>CaPz2AcV$8r5{a~-yHxN>a?BBGXrx*o<OMIUX|;f~Kh{@X
z_|S(0lVk$o5*#mK@#=##bB@>ejW~6t=%t9nM3+syL227YuF9Xs3Py$AU+XIcHG9V6
zM&*Bxk0od&xGKfhSPT!Gf0+ly>MDN|d&YPcb<@i%1|?PSO`qCk4?y`CtDCZqi^&Fk
zOjlOW@T*iMAPSn;PY3iRR-RXVG`Ane-_AQg6)iq6+)LyG2Ky|iQPxAFm<XC1dnpO_
zU-O)@`W_@wvvp5OzPna-BIaSzKoNcq82TKv@~@wDt{(av7;V0NJn8$kGpzS+;c_?X
zft#Y-Zcx^A>=vn;M;_~3&l6(&-?38|J+fS%rRq85u`LIKU-1%Rx=w{FtutnfCY1C{
zS1l;7KtyZoB%6>ifF{sZTa2_ZT2)pY_DD&cPr870vyW4BYW3`NTdb*eowzE<HQ$zV
z7S(ke6!y}hNo*EO)b%8Cd3I2X=YgXje3__^NsXh}45E33V%tH$nVId~Lm{Ogt2Ni)
zeR>rw`&;XiPG=`)fzUg_!^tL44@p?eo$Sh$tIEY6xzkm`&k53n9>3Ns<r#SbRbTDz
zbP(LrJ2$*>qh(3UsWgb4_s1PulS!z?kW`K}62!aY`F#J-RL}PoP-zFdjAz%LXl1a}
z@}$v%NbG4zV#X|!@jbEG>iXkCaUo|HR45frCZRL#pSL!&M}uU^4s4Ng8yT#p7H!t6
z*C~qDE*D#)r>=8Zq(S?j@jnV*`jF~03%~~kg#E!9;NC)j;0hDFps?%ofog&HP1wHS
znzp?bCIOL!_#dr+$ij$)V)3g{Ah+O8M-n>(l=(5mg+Ev-Pf=+Z9ZQ^udDv}Zf*8@1
z_wG`t@h%Fp3oF6GeCIM4#DT^(!c1uTjo5C0$H=32)CUfwy3^R^ZIVE}^zcTT9Ud@h
zB*I{Ww7BV)u5H`Ae>aHz(X=RaBv7a9l0*1=K#lx4);>MeMygCwaN6|P-HDs;82R9<
zrIEic{2U=Sua$<}Lt2cjG~2Lx4?<_G=u#);-=ZDvMbg$?h`rlt)oq=c6<g6$$2$2j
zac<HT<r)rS-Ww7R`kEQ>&4eT95toS(O(_t3aWuP1d!7+or&*MhX(el%dgNP)l3(yR
ziP0O2Q-Ao-8J@3F+XW{tud@x;ij$}B`*zy}iQdynwL&fWBI&6s|3EmOekM<bd3yq2
z5KGe6YP*^=2y%8`T{gZ9F#Du3=G*jcu{3dB@BIP9sGt09+qTB3ftXM^JYd*}v|1+G
zdDRlpKwY1y-1@o?pW~b!t~Y;T?nrGyR}*A`GugZO5sduFYMb{u!{tjLBU^9$VR?3d
zc^2!@R~E?jMD?GkGkSYEQGBv^I*-yO`Q&U=b*dnXNyhJnQMk8+vJWxwpD#D|4u9GP
zMb$|wzytmd-AOY)jIY&{n8K`q6TJ63MgY8yQt$yTL%e`k1%gpk@wp9Ut6Df(fsD-d
z81t>wf>XZfmY7zpOyY@s2G5OFBt>H}OlmOgPil>T;mwz5h#F10$ks%(sT@++Fo4EB
za2#nE`80!JxYjP@LE>zt`(DWil7~bo1Z}c3^DSyjI<5)IBd;Dg8F}N9P18=jhDGbo
zQ!`2Km0~?XQi6#3wLOFB=8ZU=;xS*JaC2%ZPRFgNY3lJ0hiQ+V!F3j^w#+?AnfjhS
zowtSRL%5Vnishz$=79GIo(ZV0ITl2@nBL)u$2%eS?(vdy15<V7VqGgl?fJ-$%(jr!
zHW<w&OP=U~VWVYZN`Z1z9K(01(_|_%+R(u<SQa=tZUWM66uQhfcVtKu^FP{$VgxyA
z2Dr-h$V?+IQkZJkaSeA!P^@N&YgG7A*iJ$bsct{wEW|%Q+lEo2v4fc)ebnuJZF(}E
zTa%?tt@I#qbwqah)n-2)B|LIje!Vz5tztNm*34}lxx5VOIb(sN@oe2lt4D{M)Q5ZS
zQrFpUip)uXZ>PrEUwkz8F}P7WY?~u@p>(C9<*EyJzWYnPJATeR*@{S8y60tpxQ7Bm
z14I{<@~CUs$i93O@X%x!t06!YxD!~9>4fH7-VI@v${CSBtUQ!NWerZT6M*#)o}F$B
z!1D&o7wvFuQ)rh!s8(0KU;;<%M5xw4=g3;xqI3u_OnqC%h7^fdk4WNc3yHerXFJhB
z0rbQDIIKn;Exb4}6peleflTJ&;Gs6LEzV`S2N8_|$I~8v(Wm-!uhaZ~p}y}D1Pg_8
z9t}abI}@fzQycl$<fUQx@6^rGO>T(%5&EYYTbB9hx)%|@eYdnZCk>Rgw<9y{)j~@S
zdO4~2l{65XlbC&@Cp*9z0hMJ6^WduN$j`<|1hmDdNSKoP(lswORtZFbnCems_9hRb
zZFJ<TEY{^f`u9}omp$;7Iq>N%Js6s$Xwyoj|NYoe=iX_rE+A<PN+wEv$Y#Zs5#J3i
zj)r^@b+kDXlu9vrC0|i^?VdssBYVQ4Cdx&S<WLS6;ior3DlFS|A!;Ex(H2G;EgDYk
z{lgikV(^=kK$cre+v!%{3}!1TW)<^+o635oXmijshc=P^J)L{}@lL(Hx&b2rbNU(l
zrucS)pT3*>J+eXs%5$L_-b~t@=lMJLJylrNWckc`8)6de{mm;>jQj+rY~z1e(l=<l
z8*ta4QeEygq(f=sdyt@|h$7pHYsJvl@{eyT`Y#TPF^M&+2UZr5rPs5KmVjNaEIv2=
zPS0Mms<gv?%r4~!w3ppSEEu4Akw#4bS?gLp<Lm7U5|((pLCmqUSXF4cng>{{7*!}m
z(XM9If>|6=)N#=>0VR%kwe>8CDfrH2WjTwo%39cCh47^fZJ6p(xYFL=Oa*-GjJrtu
zFQj=_^=J8Uw8@cHW6huVCRCQ{?_UySLEqThHtDn*?8;hL)Vu6TPvH4)Y_~C~{qD8<
zxks#fOwSw5!+-U-%*cLwe;<W*fCBx`E=Vp*W?FfrJ7#*+w<d%;DtiwQRd(m05135X
zsiYENkwhCQ`X?`=HF70mpi1?z!FK~_Sa8eyNfFyu^FQ7J>%nqQ6~v$*Yru{76^V{q
z>wrK*tWv5j(G~j?top_Z^oZ-|Y4Gw5!5^@b!FL^flsX3nAt@d*X4^i(1<eZqF-7Ai
z2c%^+7xhgR!t@45Wih^T&)MQBAGNNDXtnoSa|+tDploTOIN_+2j6Wm=F5XcE-ra4m
zuM^phQOb1(6Q|nzJ(oX+7%m5;hB*rF8|A?F>_z9K{l|^JoEpkErqg<#9O~<qypL>x
zBPIYwXW80HpU}(#BUVqa9b<>ljR0r{*QtFMNu`H5Zn&Xf#hM@R-^G2*x>612G&v$I
z_#xx+)7!KxTagLUk_Wf|-F2@914x+v@oGOIODRM16sMuY5WHZZPu+&{|J^y=x3u-m
z_?9BMbr-0;vUYt@%?YEeP#^l9S-q{6IOSBgf(bn1bHx<7Q}ZWugL)sLG_+^Le#iCz
zy_aXY^ncbLTKVZ(yiKeVtY#H&Ck^rYW}AO2rWr;=)q;3jbeDW4{87&nW-tDIC&<U9
z&&X6*>cTVgi5An3fp{Bb&n<{4Fgy*Q(eAY^?X!i_X<3I2T53Ws@D}{$Yoi&g9|kUV
z5j?lQRKaXp)r^yh2rp{-yhpwSVJ-rC)Y;CkwWKC%um&h?1FU|xtZi$&>7gPo{Ieq0
z&Lqr=6r`dOhKw)a$7_O6Pc<VTSv4q^YC6%NcB3mC>|^BydI%j;NAO5r!=4=hxv+(M
zP-H`Zkc%UpdyPe=oyi(FMcn+t`O^)4V`KU0-_pb4WzTu$3BLa}z0p2*1;iGD^c)*o
zQw?jYuOHt2L*KSEpH%TKs<7h~L6t?k3hfDy71BqP>#+qb>B8af^QG782d6|n_{c-A
z;E12jA-N$+Q9}n4kW_-P>IJ34Amc4Ee|oGB0A+w~znZc-R70Hp>W5L4q^sp0rJ8T5
zm6?7mJj$fR0-7A>^%xLaoqfjyC=$GUNAO$f;m09blGOD_A(He&j?MOBlmb88=Th~c
zp-7p-$xidAy!?I>v;aieZ#P_ktRuZ=B9oC4!-!qki5~2KxwLgM7rcZWkD$|L9x;U@
zNaOXYi#@w!;l;fp`iDW=vrN5zQ}XZU+!|oSsDCDg#>e)#@^Nnbh~MzF_ze<i2R8?P
zli(Mz6`dS%kII~CR(>wa5>jT(!VgZKF2E^AB8hIw)-QFe;Q6Kkrr-ZGs=l~U8F~~^
z!V#nmBDEi~3aDKgg{nj=NB0i4-UYh#2f)iAP+91C2horSkkB~u^lKqyel!y1L@Adv
zz?#mU7a0Rl@<xbJBOh5<Cnwy2(B@`P`<E^%7w#3o{jagusiLC^z6ZIn$Q`ylQ2ylR
zX1l%ru85*FJ^t!2_+~2R%=3!jKX0!1Il?Z>|GsY<TGq+jO}vzbRQl>0NCVPPk@7tr
zH1P7XO?ga^B69f@X4QctZGnZQ8%&!l+8PDsZ2q{9SaMal;wMZERa!%5;QLWIV_|?{
z&X+q#N&wQ=a7n_l2J;`{)b$0w+WRy2XJIzRYvWx{O|*Ub3ZVQMFySt6x)z_VVH00J
z(vVy<W)3I@gDq9wq!^10ECGGVUh-}t1ltf_qoNq}Y@V|r%5!#Xa)*qu>quQj8MJT=
zzS0_DoS__WU7Z7hNzQp7royA7^kx1yJ{!?a+$Ozf^v*u78KSrDlH)<pn=E3a-k{YX
znPt#-W1E8aM=tgK;T#dEUW6SpHnG?7Ks(Sw;H{r$2J^`HxjtS~urg5Heh<C>u+uiM
zl}BlW5nb9BUUF%vMmo)%@n?5_kU>6_Rccdhb{Bl3fw%y@!VCtuc0148)@j<`ZNz4m
zGZ)p0!?r+5o%-w_foM?{j0!|+Q~Y2STI4;hW&g7`Yk{cxg=3fArp^}>BGI$2>Kn7H
zk5sCaaXeJbfx%_qsc>Ghm_@I_qAU%5d{DD;%Eq4*rY<{eHBo@fa<C#hkPMgY&_g{}
zz<Tw{eya4$Hn9G1^JQZZ({Lv#bT8LDat|N~+AN$ZB0j$PsNdbuXSKl~ewgF3zurlK
zxVub7MwNX|5*SkpPVFTwPbKw{6ZKm-mbi#jYhvZ_L%rIm84w*mE%Jl==d~GrI!WIK
z1^4iJC#0qS4S5Db$5k;*D&YQ)1o9|luYR*Q>+qlOP?fpmAnopiT%;r(vduJGE)h!}
z-qM?u_f81F7yc0k0fn%d(aRc<v=yW>Oa%o8Mm1TR)E43W{~6aj%tsD4PwTXjahWCk
zZ$xS#Q4P5UHmU8S%RtftnqmtUNOseh3QaM@kxu^gfH;{eILNluuS9Q%oDO!mdvo*a
z>7cYv`WH#%eE<=GBvTnH83uoyKQuQBeTAAe&j}W}dQeTB$Or9uvW23IWF-W>Gv0ms
zsx?BL%yhlcj9<q$MrXiouGW7~dJqFxEdL1RH8JNm@y&qoqtD}{fX`iRi*$@t=I(z|
zz%`H&+bVVZ1yTmIzaygTzuSD)2{!|{DhDdWk|!X{zOMw5w#O7?zW|JFLI@|MK0}oc
z-Z=Qx<5Y)cl%mbHg6AA18#F|3Zyqks3o<f-vvY^d6P;;!XeDs}d-~UZjulNQQ~Qi_
zr@Lb}N9@t#?>n@h1G)H-E&k4Yvne$+4X{yl4#x+GnwYjSAVLGA$x(FkUHMdNB2A!r
zMm2Z~Yq8Kg6}Ie~1#(j*Ku%T2plfM3zClHju!5ODeBr}dU4Cu$Pbdmbq7O(o1JJ=I
zz|h6xB&~-eJ;wv{jvPe6kuz#OQPUzJsErcC%8AEgG<R$Tn%eO9lCjYRA$dibjw6OH
zUoLGL%q!9tm97SF*r%(%XTq&C-Tdz+6k%Duoz<BVcyn+%W&cf1@2gFvgae2gL_h2p
z;c!X0P?xHFaR$%Uk!DW~?y*GJ6OORlOL5A}4cn-K`!KR6qEiAGpl4=W9z?5sc(H?2
z;~Ve3AZ2Vea9w;W?vGyr(*01t2gS4$khIx;939Ds`W1emVa*V{R1|_pH(!gI_J7Ma
znr$JH8dRz)(2Cn1MqTH@wE%-&XzD_0qyR-=dupC1h{BdjJE3qU91+KZW+5`Wvk=F@
zCdW)yJoQYKFB|>L>ztb(>9;wwV@f%vPsEHO2y;m2O)xA`$wc-Be0L!^$fO9-qt_5p
z8z6fRJ4s}lKF>?eqCGvfk_5;&+ew67b!|oxtguD)QR+S+FBdXn%GV$w^WW90Kyqs>
zUcv|Tw6)-D?R?%fHnX4ZMWQM949OKwfff_`1wSy(;(*NGg2a^to&B-moM<W!$WlCw
zQ(q%5uHMsQo)>oiT8qCqI8VjDYzEtB!Y3Rx4`y@St$YtFi@uIp$=5e#obK6~gZKo#
zyH5DCw_|kZ_P_{)E;01fbndOeR!f^qx-os|dNfG3<Vq(UO3qf{4iIS{`>evM?-K7o
z)RPOoNhB!J2dJE~VZec#^@-)MY9<PH^R_O?9k4yLUp=~>jFSNSfZ#)n)~G(qaA;Q`
zsfPvPu+~P}J>`$q!Kt(3ss$O<{4C&N;^qL6XkyKa8gNPbiNE`L6dw0eg{#;RF$7=<
zmm16P>X|SJ3mvXGiliUW0F!PdF~>Nhm|H80B0A~QslP%M`=KjBXFT6nFmbinW*4&!
zPUJ_@?QQO$zx(-CwfVEO-202ad(wMEe|$dm9b_S5n;Ucl|FF5?Q*6t?YCtDOXi<ci
zOz^dFWHZw|HIpl4gabqZ!BV||Q6r3~#Q6IpHq~xeNfi+pfaN&o+k@!2_-O(l@2Pyt
zI!%3pMxYh<cmYfnR-@Irz`>Wbu;vXsKfe;7GF`yb$;C53aDg^^JN(i7y+V4Gn#fag
ztK_O@w<FIDZSkvEUu;!Qwj=UxA*9}_hp2SAOhqjadwQuk#?eQhH$9O_XsGxJ-1L_M
zWs2(BFF%sFhCi)Kxg~Q<r^cFp9Zp-2XHuRx(c*Ojofe;gQ$@DylSbC6%U#ldUA}z$
z5_;kCHP=*}lg;O;U=h0Re8@c`7%M=V9kc~IVc*(aUR(gg2*5)1k6TdVUNlYg^u^^i
zXyv=^#A}=Lukyebs^{s9bB-(81mP2qAFl{Y4+Ny%wfqw>7y&q|95UesqTdSudZYsN
zTgU;52<lfKt^Saoh-iNs?O54BUg2&Hr&&f4yF%?{Noe$P9FW5O*rYeILb@>*AvOX#
zuCs}~`>6dp_}T1@R;RAhO)nY!P?QyZZ0^dHv<G*8fJ&s|B)C0#hOxeVkDKjYkHf3k
zQb7yG;+)OFy+q;?z*&1@%R-eiPcoAkUToHyKU}9?*iys?>fp}1vh_fU;%+*pTZ>K^
zvf?k3X0(F-D)ofc*@{;wfGQ%<#wRq9G$aAFYC04AqgR8D{KSvAA07FS`U~N+mUd6_
z1m})iPzd0NVS>8F;W!Ezh)+Qs$&U8he+DvsjLWgeKpVvTElt{hH&1Eu+;!Xh6zgZ-
zQ{+BwOAvXbccszI3Sts(4om=T*$o9uiW1S%1|!z=i;Vp$vY0H5Y;<KCffn}-aHfnv
zVGGxLhU5qIpZswhip14lZZ^?$wE?BktEihKTHgq0Cp#S<MJNH^W)WD3-kf%=j<g`d
zEv76V<Rt?x-j0yjmf>2C;Hc-c3*gwaJ-mflbH<Bi8|?s33#gmC@S}h)j;~`uSNC&b
zB|-f+g&fr;Up_NS)4yQ=*|4g+DiIV-jj`$HNZ)I&ix$FHW9K$<ji~z}_(5tV{j1O(
z*1A9M_+}y==NvSyrRZ08Tu(vexTG0u_Xm>Ae)6ATSuRSQP)fJi1=x2K7B|B%aB8dn
ze3z8lEzL_5ao|K6*9ht}cAaReev;9xIZBEFiatH6lqVPo_n5yndS*m(eJ13KEfse`
z=b{N9l)f84W?8NQP}C4GT!0ca5`n<O0Bal>=>aUql7oh?iS}L?lW;on?HG_G=dq~$
z7rV{)1OMT`h6$RNslK=)@Lhvgbx8vU$?6!Iv7n!^fTu%DkMyYfoiTLty-&;ytb)v|
z)vp}33~%zsn00_NVpV_N4Wi6a;SG_(dlcK<8uy)tGa52K@@>Il7`3Pc`H6KO*~auF
zG$@Mbz?I^{kr|{i{z&x)N?c#&wYO78sgr&j*5mwTTkLHhvA|<Ktzl9CknMBaw;*-d
z%oC_3J|tiRGE9&XWzE3PJV5L$o2~L#n<CIw6s-%H&qyppGVL$(n5>g30-coap{67I
zbtUq-LK)gUDEfGF{}x$8XA-K)?kFFFuN|*>l>w*I?LXC^8_bF#8<XlRQlAEpufvkV
z$~!MMx*AoDOv~I@o1W0h0cwvNPC=O*8Ll^I?K_wLgAsk>FJm~(Rb?c&ED?HW`RJji
zi-3iEhM}Fod%CG`d|+$HI8gUR*I!JPAU|v>);zWhjT_VENaGfdK()f|pzm5~U;Uji
z2GBllfB^OzMQ8^*sa_-iGilQpX#|}}<Zbnw1QSDKY!%<GwA(<B(nx>_5U@nL;-vV~
z#&mnp>I(tFo?|G^JFsI~6GG5KnlE{6xSP4F*J;@qrtAJHYjds97Q}g!siQv?_UVWD
z4G(jL>*{ya`PvNQgdKfx2WbDY-%DgS!StcK(AP^>*g>iN%#fu;pia2{hDcDxw#{s*
z+u6B$Z`w?4bm=l=4+<16(nP5EN^7jgLFAXo)x7UZ6h-i7*2mA;pPmfpPKzB0xLzsL
ze#|`kfw3Wx<fnHQ|J7~h9V-q*wvJfpj@3NfPbg)KAM~{WME*q}i7u#kOI(!uzpap+
zPP9rA@B|eK`T$nIJzt5MghK19)Z7YnS=@GFF!F~PobJX37f0CJv;lp`D4`SVVHj**
zrr}PCIs`~9z91iBmj(UnVQ&Va{m~$Gs)t%D#O$}%wF4+TN3+|JIGGTj+#t)g2hvoX
zl3y9`GBnm(fU*%au_O3FBR2GL{&Zo*-&=sx$Xlf7xvVF1qd<+l`uwQ5XEt2(bhkw|
z?sU!1xiv?lrnK{xl(=4eAOnc$*;)5KePqd8M0TfaVK%(<e%U+r)Ly6^>S(JEL>$4q
z14Qj7f$klTF%s(4_PfAH%G-~DVeVP6bsD9;f|*I5NU&LGh;<TtHSQob>}vzh*16kW
zATHW>ByD2t_C?5+0#WTT1ZrvcJ$1I#EzIGDJCD47yx)@4nCCDv{B9-wAy>Q(7?^t|
z&jcn3ChoDqq06U@rlBmPKj3vDcC<Mo*d|~EG)EYO1D<_!;o}xFAB3)=mFgp(4p{SN
z1Q*eTH3O%DuMJX7*<=3Nx4y=Bw6kpa*a+=3TmEA}hARO6`4R=M*8sY+2tQX}?y{ij
zjMIFQyvSTp9k2~t!cNeIk6FvGlPpQcEH2&>;S(>X0%Et|a}VptPmPkVzc+EuzW3n5
zoku~q<nQ%|p9|!%Id@aw8f$b1ItdskT|g%>D>t5{&XGr^v-g-74@of)Kvr`8m)R`y
z3yROg%>k<EMIiUpMTVD_eLo?Rbh+9M%bN{qX4|zrc}+G}sG=72IE&TVI2?g-3mD@R
zgtNAZ)O@cx(!n!XpBwRo1AizyJXSBNk|gE|O>&bUMo;v+sE)gWv7c`dr|U@4I?GQT
zyb@Rw_%8{lP}oP6`XMd8H;wM-Sc)(2AYcB0xtJ>yrDolD?(7dt58Bf9XBNxov#;!i
z97kl55;4p1-{Jo_=ic9E*=d{6sP{oY`kVVy%}58PGwferBYBkIF#Mt-_sQ7_t#b?v
zV_^RiIji-JU9nAFfR%iPZSPOx$eW3S*_fRZ;hbj=ZERLP6%x{d0gbH5s4h-D)el>V
z0X<ssS`Yj1gRt~ntozeJX`*!F86yJ75#glnbvIm=UW$mUB<B9^QFYe~%GK|<#&L0=
z&b9tAOJ7|GuKeG$6bCW_sZ$6l_GFsnjAa&{AtKMT+lTi6pjB4Q`5E_RV!vVa>1sM4
z>}3wQI@j2F)oE5Yn*mY}mI0~(wtXfTC~0j+p_S@`W^Wq+@W(o*8dl!MsB-xDn_0#k
zzHI1}g`3Zc=^}^eL*s`Z({tB9R-0C^**lpHDD$=#9Jjwf5;7m9Aw_zwMwpRV7%$RR
zE%yD8w)1gOY`7{S*YRC%h6ejr_t<0RnTVNd92SGFh(F}|6oxfC8nY*?yQw#Z)LkN7
z=yM0;0-*OKI3|p17>;8k8_ML|>~NQlXrCeykag5CRM_lKqAQGNvyAuMX2;}<MRwb$
zgxZd&CO@`7jWJBO@RMk)!4hhr*|FLv8|+~G2gJCRNU}Idb|3Liu&-;ZZ-~BnKvM)i
zXu(j!N@EWWN$WHjdb1mcRDejY!tlO&5SG<FR*_wbk`#*5Cc?i?OJRM=2_p+l*3pe`
z=7#?pMND1yYLmj<?BF43(C3#)Mw8ulx6-8}k&D03mp1}|6ndOCR({~iO8TNisERMH
zaX#XQjsY|Va?xTLutYDQI{&bXNCaGDyN}uH*4jxr2pDT#-1d(YC(IM8J`+YYZ%VT6
z(u2}Zu*2hX!VTUUWev66O7rz?w|vx70n8JM9#xZ5iB8~1Au+ryuQ_aOW<-0dg0=^-
z{HoQ~)v;4~X6QQ2ht|$b6h$01Tp+{F7S!{#rCjUcE&`A%iLr^pcf?w_Co#14e~9YJ
zQQ$A>t3~l_LxULe#GcbVK&5-AfZmD@pFt(RS(0rrS<Pq;{qfeBOnzWe%(l~5tUoZZ
zt0??YKAgy{{5D6|m?edTqSVV3z;IZ{{Y<xX**h3Ux+{4P4<3{Xh*kCN_wliSTqSx@
zQ_c$?q}us~rf=CY8{ZVpm?R&38X|!{Ip!P&kW1BI?NT~8TbrvcK~<)$^&suLJZ7@6
zam#F60xLTK{4TJxkRC9#z6Kce$TXV0jgJKc0opu;{TS}|HY$1K^O;~$*#G;jasKZ&
k&iVi7PbUYv8Z}^#>67T-9oX|az@JkmJdVHp(eL;F2fNHC7ytkO

diff --git a/docs/img/database-access/guides/redis/redisinsight-connected.png b/docs/img/database-access/guides/redis/redisinsight-connected.png
deleted file mode 100644
index f0f54ce2f1d26a7363bc62588c299c920470e86e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 181286
zcmdSBc{r49{|79DN|qMXU~DCo{mwR+M1~SYLUux8>_*lh3W*^~%1$K9SjWC)3n5FE
z8T;57`!K^S@3`;hx$paVe!t`Xy??&1<CtTvxvulP&hxu}zTfjaMc&tioIZK+Bpn^y
zX>BbHeLA}1VRUqiPgs~}cfRp(c+t@vgE*?I-`7@G7r5`?YVYW5M@M%h&eqE6jP~^_
z->t2!tiJbL6FceQqaP9RM&AnF-qb44EYNP%E|C1e%xs#6W18XNH@d6`&6Q59Zv+lX
zCB7GI52WXr_f_hc4#fptdJ=~^k>hu+>D}AM$*kE_I`_vOY7b5@FxZ}qEi|*xr?c^)
z8xy*H6LM_K^X8fti$6m|3ZpgfSpJC<9!#aKbYt|L7b0)U@>tT1DQRoXE^9e|sTXL%
z&aPmyIG#Ou_H^b}Q+0Oe+o9KIIB?09_e~O#QXgbav#@@Cc)YLfi3;CwVFqDgCZ_uz
z)E~mx7{f1Rja~>drU)@HMIl*Pf1Ks8(U!fygQ}E~(i*=Nk$2t7YTDJ>Y82KWP;!NH
zovz*WdYfarCWjp2ECa)8J(UX1mzFBlv$rCEW~kJuC<>KY%kz}N$MlN9m##q9T6(79
ziX4rzkL--K?eE>AyGpxep*t4tNXJOKI!60kq<!e<7~a03W2Swdp?x&c>Hq!ocvw2a
zzpoje95qxkP}kO`eH++%*x9*wK6UjHVArdry=v6)p|O|oJsl-mSEz*b6IUBMiRVza
zqb_vH&y{GGP&+Scf#*<X7f+?<Dnh@vP@-KQ-If#*_`QjjlZue>z54>{t{!#*auQM!
zQbMXH1q1|?J)YPr>1$~It2^zNiqKOpFE=GgNgp2{2_IPrR}TkCX+=dvNhujg85wa}
z3vo|h7ccAQ;x3-Tf4t=1@6oXHwDoXw^Kx``5jc9UwT-K{mx_?k(LjIx{V`9w=Z=4k
z<l^}+vS<WK9zBtimXMPC^WC(r%13vV?mIrWb2ia%gwohU8$(rETIM(9-#h$|M}H0Z
zx30#2>-w9t%-_5I?a_aCHT1OeP<MsW2K7??OE&-N{P&0d>ZmMvMEl=(@du-Szf0q^
z>PcnEKc%L6a$sQwNJn>*PFq9m;qzl_^~`n9+rInYeUDRSUAHwf)EKiPu5g{ZUl4iX
z$|%N3*f>-A(U8b9QpXvmf)apjz^{nowzpr(bJ^ToYt}srdU2(G;vj7Uy;!@S?7gq(
zkmfJx*1bUt7*0xZNcBxknzC>jE|^NHhl#}ra4^2O$-zReCcwfN^8fuGRg)aXZuPe(
zNeq>vg((+%zkSTKRC%YH2jY_(G6)~FP*K`mI$ZwvHB0=!JyUfn6yDot22X-(?p)jX
z?D=eAY8>uC<tq><rSMEQp(A~dEhB5MJCNVu9fqfTDVvH;Ql@VxU;B29QX98P?-r5D
zaC2&(W!9KtbtLDgy-jyvi`xUf%TaJfXOT14{jrb@bw+QNJzS`|sVhjIJn%{e2Gs!?
zLtV|C5(&*yJE1!)oy5dd$(_E4s;5ZAkH%0%q5ZURco~I9rQpfYu(d@C=<f&qZpcka
z(jtPB-zM&8P~Sk--WX;0JW;kU?bGazsHgWe+yS@BNJ(FKq4~BcCw;O=>J?n;<Vr}W
z3?3bek~^3dF(|Ll^>^O=93zL0cg4SlswV|Fsq<@-j<J!>>y>aKr_*-&oH{)-RV=?(
z`gNoFQ5AxSxdXs-)07#U;kvTCvZW053B_GvEBPssd%JM56j~02eiu%HGbwD!@AT1~
z>O0++_ye2-Prj=xie7ygkYDKxfSLlfwHDH7WAu<@o4$Fr>|EN>TL3Pe>5JU+6P#KR
z$7o`PUn##OIs`MoWvQ&io8y}SCTT>6u$4z|cjm_4hGW3ey!oOhslNpJPGI3DN5u*V
zme$?mbF3B8@8drZX1M_d0U{K-P}=k*M=Tf8el%87=P2D>=?Mj3+RR2Oerd_7B;rR{
zvI@Y=i<-kz!rLb_0@kH&CoUqC;cjem#A|()zLc&bkq!q^o{boc%g*n7ca8g|UHth3
zPzcBy1#Is)jgay48s5iOJiAgTPHb3Ws1N!MNc6+!6zZ)V_@S>I-Ar#`&IE2pf)C!b
zwUxL1MnLoe+-FD+hT=SSkDK>49=n=qnczX5KiJ{N`dXtc43gk7)ZM<QW@i}!CiPkp
z-1LbiVU9xM(oTf_I{1hRS>rN4^A9M`XX`Yg_Kun=9W||{qQ1Y`>?HdHzg*<}JPxlU
z9ZK#TOOp-X(dcoxP<n~;8xF2ud`>VMcY9^dMa53yDF%fvS9hLTfFgB)4e)|OZrgy>
zcvwWk1m{qDWs0K{0uJ3$3kcw8v=0}}$DIWe7D?DH9_^yWX5J*CgPX2Gu1uqn>qnaz
z;#;EpKCtiIk&1plxVG9?(6~dQsbsU#>&9^)#`|F^c!!j<*w>F&>s^dghM#tGzc<kf
zkX3<4X0N)gCBq#Nv9F~YOsPW#?`vC7h5Kd|Dtim~sg;PSl|0N^tC}l}56PFa!5b9u
zCZw)rPh&Q8HWc#sFvR};;t4es=DqCHCkH#TH-c^~Gn#sh#yvACn~2N=u5sw`AKELg
zC|<|(p6v~KnhOlLn5KmLX`2OH;lNy?&^c{!8FkNck(d|XEWT6l<#*SeCjrcSswpzm
z=P3#!N{A<v<8kBgWO+|&4>_^o)#~Yu{P!vHr8FW#tG^w-UX0vf@q9LHX##f-dO}vL
z(XEoG(oBYwQRw3e8k6O<J*g9<Vc__x!nq=+4S4pZD^BHYAJ5hSFo6l4hgJTW>J>O_
zSuVU+#ba2%92FIHuQ4}^pI!lI;jbneLkZJ61$`R2+r5&v)6%MGrXW@<og=DkcskI!
zue0*mosokfeslk~j<%2U!?zp<5qhSxOGx{(K#s4B)MWS(4NoY1KVITg+753YDULl^
z`Z3ry`a@}q8#xhgG@NDv_q@$o#J$1iOX2AOS~2izrGmF<Vxt+r9MN`%=GZ8`^*z1;
z;|B<(UEVqIPsp#j;f<=)FRo}8xzcK{VRnsa%u8jfN?^it)?n&h&`nhl10+yi^*+`Z
zk`yY(t3w(cE3yYA=>=da+4)C|0y^RdBYlfN67z^&Z(}liq=WQnRdNK#@`Tb!iYG4C
zSW@jNJ)}=GWukezBc99eTN34~q!+@RKEXdh$=1%q#`k*V6VvM|iq!9l4cbvU#GG+$
zRgN(Bj7twXcLd!9vN=#oj@WSfKtpf2H%Wf_P;FD{>_AX3H1LL{s9eo^DHkk=Y1XPt
zdKMeS;QprFwF7w?HYYz!psBaN%RC9Ya?zYxP0`#zF0v4g=Jn}NZ=GsFbtW9ht|AK>
z>niQZZ7V{nNM&ktgkf4^y`}=Vl=6f2u&>9K+<7r>^<BBSq)dn4_)gtMk`mP&H^^i%
zwb~esNK>VTPXz%ZT+>qEYXDV_-9U4r5;0O7Vf@^|z@D1aaRhsA&!OPXF+#Jc<Y-X(
zn||$JrM0Jh{V{1udRNf;IjKX0@)DJrHUsY)7xoa!w^YJpRG)_akZ-VkhFz8aJ!p9&
zsm<@+ulD&0(flbbYB81FT5rt4cZ;m16@Z7$sftK@TKF(J(pYJBf!=qa`on3x@g{J4
zauR;g>e2Uuof=cPM{h~{%RyT<8&xz9VYRXb;Ib~VLDFLld%pb=M|1@%W!=NE--N!V
z|3WYNbI-sn4?;JgjN^&N>LX5jC-Y_>i2Q1oGrUor!RLn-I1qKMl~eWAYZ`9flWprr
z#Ac=hu65+bP^`cP0V{k_a*>v5d1pwF#rKOJ7WI1@n-#xVmUQCf11Sujj>1NYtOD?0
zzwsyl_Z);?vn|)`K5z<#3|nSZymVq+94KgHT4aH@T|SacRiXmi!{rH$mR!%vi|WH^
zS>CU9=7-BE+lIoar`}BXi!Gj@m-r!ARtPTtm0J2-i5k0C0>v8WIb%nhMcZ==<)BJ-
zFtRAy`oTtLI<vUd)5liCU^-6eshsl9KbTvYe-8heEiPd1aH%G57CK?$JGdGb3Ly|c
zSA6?ONA?z<-f3yxD5XP<kA(O@N;BL|mF6&Ce^ezRYAN-@#W$vMlJ)+u%N`P_^Fa7W
z%d7SmDBXNF_NS^-!Dddu?}&0e2f{RBz-50ZRiPt!nS7rTT~d}~BcXvVH+RL4ObyLs
z-79%eH=-{$b+AWq3RpWJ^Kb)e?`evt7HzOqG`(eh2xi@8@ngfk$d8Hq$$p&g#pxPU
zv~3PsNlcw|L?oXb>8oqt81nH1v8h*XwEq>)68ZzQ;n8VKxpaG*Jc?XFEmt3j0sjev
zWT*?2_(Rv)g{M0v@F(Op;xu}&;t7qxJKyl|;i=HYH_C7+C${1D*%q?Cl#9v0S+$Qe
za71%4_T;f5MU3*!V!JV1YNUKe(k_hHafq6iYrqc)mJcS9w<(AQ{EZmu&g9d80Q4(k
zsPc9Ml<D&-(G|0`nsqIBX7=nfk%RGLLtMuzW&CRal=p!&RF9)MSEb<!2)5mtBGM4}
ztTGiNkNr4{P>P8@-&nIEHTGc(L(zQ!-irj+RLSq|uv6kK;fhpGvctbD8eEXK@R)k9
zl+s1>F;m(j)FZOu@Q`8P9~T`JWt6vzwzzgPOwrcxJ|zlxTQ%m~GLm{Zvd_=Ds1I&f
zVKRkx=;j{iSk>Vf#a{~eNe<cX9^DK%aa~O5xPPRPsAFKcZObbeT;AeS@{o-v`D_Ov
zo3~w_Neuc0%Y6CVE;K+-2`%i|mOE)2gD6#6;nZKnZ0(cxJ6zN7gNpfZUa+6-GI$H}
zAp(#`V5Ig}9G5UVd#AT?c}I^Hfr&HTbG}CaiLr|2=97hck=4{Uy(f?W{jE;2=svKQ
z88HrL_7wX)B4-6sx@loqasjfD)qBna&K66Tc%)%-7u^GW%?leN2UFp_zjj}$Tbu@k
zQ8E(YfJ#bp_zt`WMsbu~KXApy1LcDPo;n1=$xtwcGTOd{$L@ExR_nfGvj7T7wO8s`
z64Dtj1YhyjkF{Ctr@x!Zu67@4V5sg0b-ruo@9`!IiF4k{lT{_Jc64;;Y>8fIROPFM
z>R<>r9?lxE60X1d9j8q_jiEoaz}Bi5MyewA`SzXj$9%A-T(CYBGaW}{7Ga{Hj2+j7
zseazLBe=1i60v`OyP6sUr!de^9Mj@S<LA8}?8!GinpVfq1WR+tu0>%X&XKFG8_aK@
zZ;8l?3zd{x@`GgVbJ6lHl$T`*)IpRA^=VZ4PFWNCEU#_@5IEs|8Mah&a+Fy=cBqm}
z_gh%aUTF69r%S{>I!qZ^s(d77h#lzP6#-i?RZ+smyJFAQM)$#)>|Z1LhLJR#dl=uV
z3F`W;vsLoRl_bZH!^o8Uyrio2MudPUe%kl1xXjA`xLV?J5*0&~+i_h7<A_byKOMRr
zsb2IjV6K#MaV8Ewvb$JYK#MHF!JU5qs>OvgG=5=$L~6$CQWs^Zp4=%=(r~mXyqalw
z3SN@pND)jWx5l*aEX4(x)T-g8ktG$bt3?&cA}ijP0wN-;V(-kprGIqlmN*+Q;S2XD
z*Tc&UsyqRnyWohg7Y}YU$Yqy9(1cbsQtVTQfZbO0rTneD4mQ3#s1s^1!w6#L{6=pg
z0E=}}-OBgnPW$ao*TA&n^RN7<Fy7cypvb7oXm<pBWJT}ri*u`Rq$tftmr;5TK&u-^
z7q7rwJ00VFz#oZ4cW0(9o4_BH={9kf)bCr8-n2BzrXHvRMjF3t{%UtH*SP>#+(jV`
zRpx*g!d}`Qxi3wwaFn^De;B%}%vV#S!NG_q1;&Ja*6mM~Nf&;R%ic9w@j|b|jvs_J
z&Y6_S3vxCxY>Dp;x)>fGp^W3uU%dhdt#iMZm!$$#DF4jA+yO}>FeJAs(12|>K9MN8
zBk2?VN2F<~I5raMbalI^R;TQDRoXZLMc4Y$d@1}B*IK~Ek6EatV%vHF5(OAD?7eSP
zg7Z>M-%!O&6%qJ}La3Jz30XcRhb4p$KLWQ34_6Tgu{tOy#&zXaB^J5jq{m1^M@iAe
z9us37sAA(07&;*|zZaTb539>m+oVgA<4wMPAOZ#RkoU1!BS>j+z!WN**RxGj6C7lC
z`ZjzwscuVZQ$)=*V3$QHMotxah)oj@0#RDoDT-7NvK{5Z4+ih6JtR}<&4BM@2QLdZ
zmpKZkNnjPxeB+y9+#ldi4^B&OI)3!QX%2hBV27mG^bOCoAFoVxATJYR@$yEkS~Tg%
z=Kk=aK0p9liIB#nR^Alf-CoR+IW=<?No{ZIKx6{DMumbV=SnKZ+jC<^Q5kjpx4(I1
zfz}nzF?M417zFeJPf7Ij3zzr5k`bsNbN!~)nuGrg)JKnT<FxyIJz^oni<{sxs1~*q
z8xT3qr{H~FVsSfiZ!X%^^66lEuCf8i9ox|WoGMuo-GcBiQ=5rtJFadi?qpgL+5?}S
zsq0Up%1~L|JXDWg6WQ6=ZM%DfbsfmEA0a7{RT95L^~2vGx-_@IQ8-%u7`Y?3y3tIG
zT|_LC28TCE^A{t%iu$IAp5r^*N=V@mOAFIUxHjjaC0YQ*;Of03CQL9W{#+orODNMj
zkZaSWW-mCwcuq}JNO&!w&ygxaW%bb1n+0dJZf-MV>z;wx_3Ws7Km)~L!8<cnwb}fE
zT#a98L`UoKQI;hA0+!MeWTZJ~2f24ur|;{TVh`1Q2)9~IKm&5B^E9NyrYEq1*#b1S
zIph%93nX4)^++`5=z8FtwCegB)$U*MtI-6`x)4&(cmzE^iAF5<foULK*?{=w#yYW2
zsaRI;Bi?6tN?ejgBrTm)m6DtzIxQ?B&!11LCP=QBQrOLsJP&tV4ZUCR|A^y)?+jt%
z%jc<IARTI~Hg6NDvJzsq_-@_7JnE|t^#BY87_vuNuNB=WQ6JHy3-DJk?g|!^YK4Yu
zsh6b0i@=s*VVt*AaGdyr=v>#X1q@-%F_#_dln*@2swcZ1hSR<$VTC~Kr-9y*o}r?T
zUUJZYZM4BuyDN64Rva)=4g^|~gYxf^`hB@bo|Ji-WX+F?FL2NlEgvA~ssQUYJ}yu|
zAJsqTnLCw_MAsa7#%aGTG%efp!p%`W9ZHTc^cCUAIVq4%f82)!ifqj*4{DyM*7@G}
zy}Ad9hpy|5fJ4f)k#<G7DH=SEL6HxEHSUWgJN#l>Xd*kD1s6LEw(EnV$M`XirYz*!
z!>`EEYBSm3pk4H9X4ul3EcRW1A&Uo;CG?3@PP_ZfRuM$(*UEcF52!4xcDTo;CjMwg
zr>^j^RFQ-9=uEw?KvS;+p-Zp!2u*N6BUf%<RlDeMW=7!pZ^Ma>03e@Dz&13%xueY$
z=kR)i5bgAlkmV^y@NAzaIU#e+;8{e;KLGr2J+*S@_IhLJjq?iSM<Bk&bk$8f2|rS^
zN<D(UTA;MwaSO=khzqW1@TZGWN6gt&gnC-QPp^lS?N}zSYEelJ<G6!C#j~ah1Md3|
z(F%Pl$coR=Rc}$=Xd~}RQ)5uz0Lq-Yhc#$_f6kHY7}Zcgv*fVgkyk8q4SeSqgf^^7
z9I>V&XruUyXjHj6Dg9VIK9WD>7U-DBMtF3zs<z@|Ff>&TO?yKQe{(wl<roMERYEV9
z+2^)FrVfS@Vc9WLB_<>7Mh<3!+Owdb!&_g$1FgV-SIuy*3AdOz65t0IhhOz}__*r2
zPNSZ^Y;C$BmI(Jk?y4rxQZVqi|4~9%S#NYiFLNKv1YY9DGcIrL^YJKo5#7HxqMs^?
zQ${b8QFyH{*_*&!Mi0*Nws|xx0vE9gq^-e5YGp$tq<#nJ{n|SLqf8UFfmg%Z7pp93
zEV!SQ`#`*fUUqv&s`4$1Pja+q7$Jrl_C625>fKFtVTEG@$_4Z{gc^>&2sl*RTNQCN
zwUolq2}#`mk)|2%HAUo2chgF07cD`%qnw^Ogkj99A=rV-p^i#}0tdA7>=c#%z6%D>
z$mawKS~D#XcLb{jqNdRO!&|lp<0GKWTotUh3AAcf?C0)F`6GLOv%p#u|3}>l^pU$7
zLi1ia@YqfMkNA<N<P`kklEvF2i2Z}p1nyIbaD*p=v}vUGTnJ7$y8Y?fLA+<&YJ7vh
z&P?M|8t6gR?{y02%*_m3z5qs*(*WKrhk%2^bO`$S3e%0y(Su)H0Me*rS0Vc@^wVQr
zkBC6(P+?`c+6YE_kfYeVy#E2niMNYxjE&zP{Qz=@Z*PusSDfd?LiA4*;r34_^`t%e
zJA6oIfmgWiSy{aec<kWh^8=Ue3cpdyUEK3%#63V3Ufpa3y=8z<pvdtPQE#H3XK+jI
zdbT-`B7r1DR}V_`LYf&IANGZYYNgUpJK{uC@*kCe+U3kznkVP^@yP^kM-%q`G%;!{
z#6PFcSd}_Q6h11{{h(Dl)sL!7%ZIQ<KgvQw$aCP#_>4uj@7zIrfIk&)q5k!>FWM$b
za`g*jH=Mse2S0(x*l0Lyw*f~_8%<R0OcAnKw(xgNz;p7(yt_=GuWXxbY7Wa@pM35c
zsuZ}YIYavm9$n88W`CaiTQ+LYqL^;DX0N4a#X4Yn&p-v$t{!fjDo$zg*tK3xbO%hS
zdeGlTSnA(4-7Snr!Mc-hJQX83(RvoZ(H^d;pk>4m>Ohy&KSJNCQFoo0+K*4%arHXw
zo;r8%$(PbilC6?dNQ<?n)o(8K79Q37up`^bqIDM67muvmUqT_=BlXDOk*lowFFiHt
zmGt}g`f`t;ODEZ($?5sM=k><DN14r@nH$@@@&zC2%bky2l$ZM}mT(VysE*BY{0Cb4
z<(+CY(w=)dvkxWi4GmcP>F6|e*p<Bng}@(Mu4oquH}GVx?sH@CT*pjYneVBCbe=&>
zsVh|(C}6Nefsf2gXv-tu(uF#^?V)^i_WLM7Nyo=!6WYNs6HTp)o1yt*5(uRG)>e;o
zJ-Gwyn+=?bAFe@7?zKL{tO89j@enP(d|V`gt-sM0MNWr3oa$%<0>Qi}QAF%z3SIa#
zSb^Jv77V&cgZB_g@N29%m65{^x)fT@46jk$qDZe(5Pac;IEdEo)w!Lf9npPS$-|Rs
z2jiWv+$PDADbhC`!t_$9nmZ2bjjP-2<CY4gln=c?JF+*f0E{_IT*V~yf`@6aZ58On
z;<qgh@2ICU)kyPr)%tCiF#4ebW~cIW>NTDq!i9$hATOX}JK)zwd(WkPIM_hEd_Ekn
zzwq=B+3<D5(ycUOHvIytZ@|ejq0Bs9{H%=4seaB-$ejzOtItsRMjPR8PTK?=%Ulb$
zCJlpO<xnj4Y|554xwzlSvTQY3WK<|7t<?5%kiX4LE?=WG4f%+=n)krGZC+adhvP1$
zp~!?i_aeejr2@b}#r@3hmDoExEF(;BX`le%K*M`uz0@Q)^N7|uILn`T=jHzM4eF$W
zb|Hfze$JE1XMII3JBe0F_v4$V<?-yE_Oyty*jE6qQfDnXk!DU?+$fYzmN$2JLYDs4
zzN0B2vWkpuq|65Fe29k6qH);1#n38>@CF%ZN|5h$MW0~+Y4~FwgqNqu2A$hE@Zc{=
zh4q%9{iyx&C{#--rDChZ3H!+v-;T^lS;A~7sID%)TXD9C_G>2;$9rj}W#htwPb-C_
zkE637;dJLRi=wTsd%Z}nw?jX3;MHdf*j5_@duf5+2YyafW*$J5o!+|O1h53@<L4Yh
z>;3fEbcGIWUKirCXC0pftVJXE2GCC7E@lC1M>V|3qy-w7??|4Rsk2?FdrJfLv=nP_
zM3$B)4qxj%`>(|0_wf09janH_9Jl+pi0m(e)TYt^F&+1ap=s9+cbc@!Adww0oXTtg
zjG6LS%%*H9ySscAC%%^)Lh12lbquS<odGsW+9=N&IE+;V9#y$;PB1OA_zeWJDK>t^
zQn|bmPB4~iCccWm@hR}BkFX`kFv|^{lJRA%2gb@}AGly_5ar$sJ=2mwn|A}qws$8L
zhH$0`(_h#ayh0WK;gIdVACHgOSHv?^j1|I4y$(iN>bF)`!9u<Zuk<)!asqxvf}2hz
zADkgEN6h^zg`rWKb%S0uYk%O6YP?hVBY{Nx;%-Hi=j~7S<dh>oI8W?e{L##+bdaz5
z$12B2&LOGIL3Z$9!>3|>5l?ua(qM>?U2)e{;YiJ`LYXi>FRaYdxK4>y`+Bbj=DYe6
z%kB=fo`hu&CHYYu0|%HMjP!y-Kl)NGjlR;tXn!{jmaXVLb|L=~`~r&|b8oM?s?;v7
zHYm?hpB?D6bsH4&WvocY6!%7*54P*j=r`WTzmI`dPH^FBHyVsK8V=V%6X{(jj7zQ4
zuf*f0m?q3>Vbe9@mA=mBcSrXJQImB+Vu-Shj;GyF3pkdvWCXxGpm|d<Vci^?u~`vV
zPy>|Dw{?%~bswaZdxe=gJ(bFxYLv>2Bfc^>b=f)inS;mreu>6i0XUd}ybDvH_^IJI
z$eR&8=87!o`?{oLD$aMtciy)@)pfLDUJl6)eGE<wM~}voy0=#tjG)IJQI7_Ael);E
zhWXY$;{T5ZIKUNE&AvV*Sv~hQN}_7|#oa#D!?n*h=0gvjsHoDUzA7khQkHV_oDG9~
z=dr1(O#abM1AQb->_U=v04rCV5bUt4SsjQ5aa&00=t0I0HPe-QPB4m$6?k!~m+Qp<
z>_v<WN8l$VI?QxS2u*DVPui_177NA%53NbP0@5q(j0%;v^*z8>9Y(tbU~4C_{QJg1
z_+LgFzQp;&#QdU~uLX}Qz7|;2*MPp>6ZyyGWpS1eC~7Rn?Yc!>)lhVX9dUc!ZmiU<
zkw{tu!~2PgY19g(A?nwTJOlOj!SAplFD=8~KzBUeXO}m>@@suapI8dT_@S>311$Ly
zym+b4YJESy&DnYOkfs@844(~H?AUkFC+O_9(Xj(urU$d>g5G>?J#1vF@TG7$Ui8}z
zO?dX`WG(-`!tPJ?4X>YS%oBT=Q4;9oZ>J=$;~VMi=DXhUagI|K)6ts$xLQ7XizE2Z
zR{e^Z06;^scCED3rtNhKoAPGU1Ptw%yZvd3^s17rNjw$9YEpD2hLaMf-oV-0AJD^g
z!fHFVX}Ht&?Kj`9=ri4Q<2jCn7hk)7QNQ9piY&4j05e(u1$mf-q~>spDYp=C6E|;E
z1>XVeW`)9TXd%Nnj;^I+_tRPhH=chHm5@6e#x}oWRbA7Ruj$Wt$10I%;pb>l_G<H=
zSNl<NjMGeluaMOXA4_+7K~r9d<}j1{+SXNVmLpgMKG-SDR72!>r>(G_*oNaBz|MAj
zHt*ZG?evwWEg=?-H!u~=OmUD)2whNMW}30ceNh)FyQdvuXx{*7tF{o9GcY!r<kK}=
zbcgo-D?`%8(EbMt3^J<T?Mg)rl7uTTCd+`Wwuz$Y$J{6WX)}V=HApaD%Nl<XGO6Bi
zo~^Rb^<1z6NmJ#3l&c}>XbQ2Ql-h@fiTi4-pIbj;`uy$yDn;4ekR8(vx5;In{SMEx
zlynU383_q<2AB!Gf4Kdq5jOmxyd|bNPV}=b@I7DM8|9#ier`Lqm11?h8cUURpH@!D
z^~J#EIw7Gm|GZU#<Cuc_<Q2F5+Nr?AuOJjZ^RTTxg;Rc1X#0c5dj?#@VFLR*hIiBi
z`ImjIniht=XH#q%wJOS7GRvo`wJ(mnVjH{w5(7!l4aW_<QU`QHJNn0l{nq*)w6jZd
zc8BVV)nQvGR>(B+>iTrsyZNbj_8b4lgqDQqe4ZZ}<O83R>Rs!W2yG(7tP^qTXBYf!
zA~vDwGpnnZ<sA!3yfVqY+r8`MisjU=g0s6jTuRcwj2*Am=ARF?S9tFmdMnXs@QT<u
zEB=gI$+EAN5ero>7R^CL<!&!2L_k$gyoHS|`{SN{`Bp@u!pDaBLjSp$#7c>tg!cLm
z2Vk|TNw?0ywzVMNNbGvuidz*N`EC=ZOcKe9g81Gi+{vB?&&%A)OKi~yr-`hRt>_#)
zJANCvmn)Z~!_yiN7K7q*#>ns}u|9=;@M9J`q2o`7y&0~crGKEoXQN_=Hqqk?QjB=X
z16&v(R2G54e3GB|Y|b7()z$KT!#HNry|#4fZS&&uz1Q#N6S|A8ikf?vn3zmmk^!2S
z`5zXyj3i{al+~<N9;V~Q8cpx(lAGn`vt6%WzefHp>Rt0x&BS*uvvlR>OS_(XOq<u0
zU7;qsDL3r4Mpj~tdXVt=SJCEw?x-oA7ralkw%EhCHhN6@F20lPRj};_OkWp9J0a`4
zXaTYtsg+pPtCT;!5ww3zzILpqi&=Fu#G~_4;*S9jaz2-Y*=T(t8+%=v#D7S;*ionn
z@xxHUJse$&`K7+DA2jficYOYJo}cf)<26QrG1&Qg%LD!P#Ja2Fmv9`;b24ICl`8Iv
z#ThDM%ngpAY}BQNO9~&592x?=ymo4(q1kK+%C|1KOQ9f(!MwlOseP`ev$^Zv708q-
zw^Y%%bri#QUUFL)8_IUOM4`l78<t(>n?Bb7M)^x|1K+lSQ&5t6RNV3T7ltsnz2(pv
zY7o7hgMIXl!S$AprpI>+r*1+2!mIm@Eibm;?2BLJHoJOV_>+5eMK^asKINIVNiDNF
zpz~urcfxspBM)N4OS@X1f-9#alK5SpB$@ri&P&3@RLWr@U~==-JWb`q7t`RBWc9+R
zagRgHRKs<X(mB6NVau|C;SuCcy&xHfM)_CG>$Mw`(R^>YZdFk}dYROCIgSM#;*jTW
z5yH;uei+7`zxF8Mltfi}z|1MjD{zu9*n;mrT+rx4j%nrvE=h~JfUn@~H=BuWac4qT
zv<3I)WSmfCEnIQbu%E&RaWRTW$ks8cql(;;!sguz-%7=8qtXX+rE6YSQ*<177EAeu
z&VCPNV_~Y8+Y;-(m)dLH(HzXVOSt(XUMQRGgWQ2f>`<2QugZoiXG0k#dX5-AF<j8x
z^W55DQ$ePx;?<R)yO-W1UjI$U6r|GEJMI3&&FT09(n6!L;rj?p)3LshlxFPr>0#DP
z!b;=g#}E}CDjL?w{O6`FQzm+5UbmaoJ1HAx0w8(O5RROw$_9KPveG5ZYe0Lx^{n3Y
zMl#M7`AfA}nD|4sZ_UECoec`R4Ec|cCnwH0&9S;LF!2nzR}fATPDw}<k+c+}Uh#?K
z2l*s_4KEJu_^ohELeg6MYM-{hhN=F_{GGg!2E1$SW0gvsTiSc|97DaaSJ`x4e9-N`
z0M!!1sDUO9vcN+aNoVw4#pth7`lb#5(sEW*g<pkvCeh1xX`63&?1J)y&3&cxx8K;u
z9K*Mpqa*=FDnlx}x=u%r3Y=w_heouN=VF|?n5p3zKdxWfDD6=Kg?5-A$FdsqGtm;X
zZ4_1!e{FFyJw*@U^L{wykQP`obE{}_maFm#@Nl%FOBaM|MT#V<?2Tp>a~=Fb1{u=s
zlza5t7<u#ZRZ2}|?F8-)nKRm>|2Fr#G|F!7JZOrj>u{LPtn%f$WkVfl2?D-aSvN0!
zmmKa-#3SJo#M<qyYaqaE>FS5QqlijulMH&$u>B5sj_Vg;o-i*7H-SxfkF2M!M+nC(
zp(p1q%ZqgY;Q_><T-6)cqA_>X$-~Kgu1P8gqi_N2K6<`q-SJ?!D~&vs_6{&U%``8Y
zM${paH{h0RN=xY;;h^yhjN*^cQSW<}W8$TP9xHjdFi@-@4oLhCfk`hP#(>t1`3X(T
zu#Nn~79iy(?gM3mO4-;B1(MRo=OuiWEnJW7?eg)Zbx*9rD%U+J!<7xc0xyRHgPxDL
z!j$1SC(CQh{Lif*<<vC?@HI>7!AQ6HhTljpdu=+=xpBXK!yCub=e*dd^I^xOUh7ZO
z<zPf<FkWQi4C1sHFp_OjLn({+J@0sA6lGqG6&8CKf^6kx&a_0UoqU{A6djW47iqP^
zsrZ20pM!%q{5Fy{Hul}y)OHHx7}~9YlJko2xJ%K`DJ%bMF~H4ttD3JMC@)v{@FO2v
z6_nv8FQ0&CeJ)NFB+=5RArpz~uS`h_SZ7XZh5h2YfPNwa#B?gRU;Pu2jt+5F5oV*p
zMK<OWEhjm@*3r*oum?VcNKn>&8dtTNOea<z%{Q|LZH~^Y)$dQvH|*EDLOzy8z1xc|
z@TtS{f&5vtwG1L|vrOKO;_}YMmUQrAehsE7&t21yMrH;-tnUk4AN(b0iYjn|V=$Ab
zyUVgj-SkElksD9eoU>OIfUQZ;WRCRxMk@K##_4u>?9zrN%o(2_Vz-#$BLM*hdO7S*
zYy?%_WEpgbTrDbFB{F~GmEqgw3K^XbVYuG>-n@kw7~lpm-U+=7KgfkYW&^Di#{`6H
zg=^)wt}%rVeZEI-j_>7uqH4Fo(SG+rGLctcWmVGNM?;EnH;qb6^JyiUEp{sWsHG#G
z{Ts#+=Lr#$ctAN5#3^{2IZeBv??GlfqLs;1WBsA30enbZ=$UA<4uJF}9Q2DBdWpYt
zHQzpWUaapb;|Ij(F{Ru04e*4_ECQ6-u72-K^Qb|%ikNDlY@eJHdN~w#;qHpyW;Uv=
zm#}oD?<%u++pi}c-6x#c(V?61o#L)amAH>8m_8V+(aA-w8n>3J5BPIp&JrvESisa0
zZ2T5eY3T0mpxy=yam(x0_0lLWwZPk4B7)gM*$$SY=et4PM=8-ZP0Nc9ORD{+4kwSF
zA!4Q|dp}7uC~jZL@NR#d-)G#N@7NC)YmBMhS_hc2HNifjR(`b(w66|4xDN@-v@Hqz
zA>H96A_wx~gz>1mp}rLvea0W_RKh5188&W@aAs}5sfV>yi07@sCqZvJPBd^tJk~Oz
z%}zw!V&5(&sJHyW4F7&r$Is)G(UOUiI8{P3J6F)*i@sSs%A8)!3Ia~T@|gtXf+q5W
z=b8_qEJ-#-9SS_a+M=yahf_1F`Rb#e?}5VnEKHkgKVASnkq76<1A@$34szSf%m@Cq
zXV*E8r5IL3Ph~-ldgLyB(O}<T5j_!ijd}$f$>025nNdJF&zH6gJ0_T@ZSgHJVYIwC
zwWa1G-!`qSy4K=lK>h>Jm5aS1Y(M-`27R}O%FwxQeqO*RJWXS|V(SptQ#7bcWqpj{
zqC+ca1?RHaC&HE-2cw}Y>IH456Ab}GqYR_S;a5J;>E`+&K({67FK7Gd5<N#4ORb*Z
zP16#WWH$N_>LCQ^?KAN}_0aoIm?c0D@SQGC!hn%j?vH{|roc6Rmxfm(HT(;{6`>+I
zcPui}%T?ci1{Ib8M-a+;PQe%5r@<oIK*Lg57{~5>1&;P_>`i#fcqs$0!$sf|No0O{
z-&(tUqJ*8B#^wgQp!&eAY;07@V8rM^Dy+`pg^yI(>Ib|;D>V+nKNh#SBv`%-0;P-v
zvJ$(GZT*PB((Ki<r4M?URMUjli>j{4{u`hj)#v<hzznVv;<fDtf3y3hcIR6cxTZEy
z2JexUUG7Nidd%DKir$}OE8Iu}*H=BYx<XudsjuM(l(``yQJck@?*v`y<D0x!t}FVk
zaW-YV;pk9H$GQoOVsh-mz2{0Ypr?}eP|{3I+DZlvbstkqf;@U&dwfUXna3{2mKjO4
zj?IfUn%rj_i(2m$cc8NII3&Jov@jiBQ>o;$;7XM@86OkQk^9THnQ>01l(Re$ppV<9
z0ix3G9Xvb&yz>0?t!o^09MNmacFbao!k~MH;2+(+2H!O%K~Z4Ff&M*?xW!~oUC6mI
z&v$LVA;s_KaE)+<=aDtl{7Dr9Zwm?$)$PmcbAX8@&50t@_Lknsq%e2*@?Fc7$=Xx=
zmDN4au1Wum3EU66O6WCDd|AaMb~U!;?&ej%_}HmbEl|;2$@+5P(B_xsjaDqEh*1(P
z(ckcjU0kEQB+Q>bTelGEejmZHL9^UVw?(PFx@Rv+dR_vv<p=f(4d(Rz9#gCsjqe(U
z7>Tsd17gnh#+{=)a5*ES>rrJNPRfOv2A#1?!R93dbo+dRuXLAxeFa@&-rGhV$h=3L
z-O7mP_*VLcNyzS|S8q&wr7he0bEcRF!$v)9xPJGiu6$y&qJr0G1*5DT)2i_r^Zap7
zaVx#*wXcyUteqF%8o-P1T?$i_U*MwsxIJZJ@Mx`vW0A{Q_)leN8V;w+zV5M<5e}>M
z5M&k<7`x!t=RaBI57`h5=N%ZUTU6Ot9@t|?zMg(}mULx;=C*&vwH&V3x<alTK{9oN
zpgGpG*!b%SWBn&*p88KBPKBIs*HL-0r~|eMH|Vs{dJOB?#zJvLW7g9bWY(5aXklcw
zZu^+W{sV;HLrCd?(o1)VeOl^K1gyh+01oY>v~!dPT00<X{SUpdU8LuHwzdUUtrrbt
zs$AKR^|F84T44?Pi7-+jTs&Q@De#3@N31KJ#|ymiNekS&FdT0!DuWf`5<!W87k`)$
zykoXS|I{-UdQ(yQSohebb+*rI_78pUcWuYs0ExtP3U7WKvPCqxcg5@H=-#TF2S>i-
zV}_RWBeuSj6`}~~;(pt*CpA4!=$_DgJ)O`y&7%@pnRNrBjo}2jK%OGfM<g9rjZ8_?
zpV)7v6@s-a$<qwYG0M1M-I9YFAPZH$WxM$wP9*0JOu9<`x=1@rg198l{a#jdl;}T9
zJarP~**S|Wym|^Q%qwduN$Od70sSiz9X;Tfo@lOn9Bf|85gwa;g#T)M8n;if1R1k#
zZ_mZ+@l#>}SG3u-KZXtJf(nIo#_UdBU=1OR^##E$ewd<C_G?GPH@~t>UOQaYgV*F&
zs(>ts*1uW!(rG)^Q`6;tiKzyWut1-=D`fkTH60sMgSCZ=qKs=|xykwhUSpSZ8hs_D
zGJytOq;!4_De`nmBS&6r0Tpjay^Uu&fpnTKv+}utEVf#d3#-|>cluW2GJ7DC!FR{W
z&p#ZZe@bduY1oXNt4HpqZ;YOyTI|;tEh3~}w3rdbL<c2|DS!E2HLKN|!7ty3C6k2n
zo}?yU5~D|oEk^d%)m@U~Gg34RcO~2Q^+R0>#cl-ze)F6S-y7}kmAip?XWDRXqTm*`
zI{UQ7O=eXCkWx1t$M)O$z)jvN4T(MIq{341rO%StLneB!C(G@_8Mo#6X&`g`duY3J
zDJB!z^~tryRM9QZHTi?fX=_sXl*N4s<KrmLZWmA?EyTMRDsEo(@;48W3OexTes@YD
zg^{8}m_OBJ2(QR4m}n8y+dpAlhXWOfoszf!bgl8e^Eb;1YkGU>?nxwnFzJ(qfWX+V
zYhzlUun2I2zme2NvkH~8Q){GG<&WBk-)nvAygp)SI$zyh?X^5$;&ZK%Y@;56eQIgc
zk2W*%J@{7pVX+M0Yc}=VoFz!0v!m0Dwv2!FuMGZo+)5A)GT+};XD2Bkvz@^&i(h7i
zT^C{Rgq-wssJ5@&8@-Q2xcfr$LZ^jqf4@tp5c9P$aRqs`CK-yjINbR94o06l$H(H!
zz{#rlt9NMaH~UX)^a&{gqVw<Ppxtw{VmzPU;S1e3?T+`hTOy!~0)D`q{Hb^0l2awT
zWrL-qeM3m=G*cg&fQ5l;-4KcDf`a4@_Aa$u)jeEPcMH3v!McC#4ZAcz|Ac-onfz^g
zjB0MIx*h$}ZvM%*#|T@d&)Djtgm*p@IRy=anWYEqtc5S!Dd^Ik%17_oEDL)d`RaNZ
z{s;17J2oi^0?wT0C_CYlpY+`d-SaC*ZVI3;Kce8^?|mCAVLMmB`RT>a#M75TFEBGw
zb)HD!J!iuIqsnW_KyP4{Ny_2PA_<G6k+8v=fX$3EW!q_i3+yTlo5GPJ2id(JvbFAB
z&uYot+ESZ*egkwJ+s(5y5=V=YN)S3`?PtvHE{nXe$4Z*t>s}dUVew-}r&qSLH-%3x
zaf2)cAC#E~w1=cnwE7EESKo2|$~nt2#cmeh=<@{=d+yslgQevtA7IvD6m_N{N-uxT
zRYmAe1-i*mCBaGf#@%p#RBZ(jYo1tg_S)Zk8LgdJB8!fDB!}B3Vl#F-&5MEZAZEzp
z?r^hqSEN4Td)9z%@7Xk7w5{!R+D3tH<&D}lO-ocIU(hb37Nu9AV18LJ%sW^%tXGgR
zqn=Non9ovwr@Rd7#ir(vD&vb5B&gASQf^>uus@|*(h&~*0=Z(qY&@4JNBkK5H?tLB
zDUhUZK)?bqxqsJ3T0TB%#_<6y$SN;JWua<YOb(t?vFwPC|BbfHCWf1XIKgNWeD8O{
zhM>FcQ8*;H8@fk`2UW1uOQR{XPLBk?XWz<QV-(|a>@;DD=sgzy)zdBEycgRLj9@3g
z`duw<AVz6T@RgY7)4Tj2jcF}zoxlk5+kf{b|Jz|P`&(Ae!lgdlpSd;zxMVy7>~DS`
zw1)m{k(yA-`&mQW?6R+~{+d|U$Rp}#`l3LCoH+G$bhz|dq8<6+;MR*~vs)0wb18#j
zT1J8CM(8HA0R*tJt9|u^S(&=P_pFXa=1}ZUAU-&hefPz~vMh@3K^M!#+y7CS`0pR1
zE1bb$FI$qM;Mo=pXZ#hr-XDfxG!Dkal+d<Or^Q~dYt#7C>A14120F}5g|R^G&x3yZ
z#Hq{68{@4DSm7=3_WGd)y5d}X+co#+1C%+4Wv9G@AK={YIm%2nGR*B@N|Eypm1_HY
ziu>PlV4+vD5@MXYKEuP=<?%5#8s}oQ>sGL&So{(=AKWqo>2|PzjLBttq~E|01#S;v
zQXf*zPnEwr)%IR_`HfAu{cm5+7Y?H0S%=tuPR4u^{hZ2nKYZzwRqUgU?l`=<DO*<%
z3)<*cET5}dMyi~aJZg=DKRB-OZ)#4Pz<&u#CoGsZtJc$D7HCQtkYfz)cGk90)Qx=N
ztVr7emo4E(+f-)g@66df*KZ<s8~n&kDX}~yV<*9VZP<=UtNN1fCA)tA^eoTOq+#d9
z+(1bwB^xUTXL4Q#)8%9tAS?dOZGUv8Fzl}&`#)zu({L#<dXG0W(~3&ao(Iy@)%T<5
z?eavb$V--2$b_<jv6$K+N#)Do0iu4}+sN(Ya>y40QR<i;sKp&lv#jOcY&f>rwD`o7
znAM)~@qJcLh+J$c&Rx6t40U$R`7Vfg@E`+vNU_2Wut`4(dgu}ip)iH~Em8Up6FZs>
zm~mQS=CYu@_Ke7R0)%*{O51r(Bk(N!-e|Ke3R;p?&|CghDFyFQIUGNWXo$6eSonMK
zqDR(hG6%h#G%xZBDao?57KNfxL+)<MxT$6FXPl-JAgJj$LL9WCZ>JJ?4`>xJq_`a;
zfK-MV4NzPyDC=6zO|vlk=M|Y3O+Q$!KOXA;y!p;8&Mjp#fkiC5RZ^~j{#GXHYmFa4
z@A(~k_V?Jb<gUBCXYa<G18t+<(zY^SM`nxR2au5kF{CgJ;xgHCL<o#t&=0dBWbvEs
z(l4fKm9#K5M&P~=PU@<!JsUg_=?j7D2cVgKPOo}?N`Z|b$E_;Q|9WyQ?p@>L9j1@g
z|HQoLs3uy0EL*+$-g8X?<hj=NCc^Fg$dJ0lTV?#xjQot|{0%4Ahs5r%hnmyiPA4Z&
zwXXh(&b)H|GcBe;=13=K$)^Wis#$7<O>w<T<w7h&aUI;v3g11YSd@OjUMTMchsNr+
zzYkRocXvW{W5ZkgpkFF!_-`}P1^@WY|HZyJmL`>NlBjXf<gDb+0U~CiendURyHyW%
zSx^arF7uit!hQV*t-7=tQz*0;8?1M!&0ffn;f>SHpAG6M@#xg1_s8$Rm-?6U`B>y$
z(A^{qih4tnV7w8&<deL1Y}sYzR#71m@X&ugKwBm#&==X`OcKVIBHTWCykDBX+lghj
z_K}v`PMb4TE#m?;rz-gxCIkw7P$IuYsg|TY_>I@$C);~JrT#m2hci1SalHv8mC<yu
z^lYezP@9`9eqIT9y)m^oAwnA$06Wc1UD3(E`X9>!|MOJu2cBa@h{AVO>eK3Z;Jm!H
zV9?Cf^J{Yo{kAO`X{hT|ll*XHQQxozf*(s4O0<m`Is=)fEeD%t$jU~FNXYSukKF;R
zp3vavV)Sv#G5l3gDO{MU^qH?}>q}P3%{ZTQwljd0t<~qnYCr$kE3?ph3KhdPDJH~@
z_oiWUFA-sIXZ&1Ac;)Vwv0kQn{L<4YkAm%dLfDk^>N9r>Qhs1D9BLMD`sGb5V|{HP
z-_xnykh6?{Fy(L4JqGPu03}VdDD3zt5Sr66EqgD1k2fMTvk<p?_s%C2dj(I@sSsMl
z&R-&a=&wS!+Vo@f=|wP=Xgp<-_2%WJuD^MPAApcT>-rmmJfg>(nwQ9Bo3Gc~Upjfo
zUiT&5@zq_KlbI2#C>)Dnu3*ipJ7agg>h4bYyM2*1=1llOCY-42d*4~5Jfi>{X!z@<
z$Yb$Os8>+Yp{z1-hD-()J{f^vX|0ut&jxeH<LW4Q=(AkDCpU16DoU7@vnk{z&2%R@
z86cxX-R3vqhmOB8courV@ep&L3GYW>ldK;n^{)O+-K0e6O<Vk&illo_41A|6a@SUw
zR#3d+*#!Cq=>lhF@fV#5?0#4D#jaXscSv|UcStaMY3}x~=EBUDMn<WvU0bt&EXW$b
z4v+R>x(Iu@fN1~n7yw$NTZ)~NfO);3TPkUb@$04w9hD|)&&{^L+Mxz39JaCC&WCE(
z+0cdjYuiQD|5x<mV$89)aI8{6j2e+LemS+LFPxfvx-OS_YsPS1ab9HxG;fKY+D2CR
zeV^9{KN2y;++nEH%@dVMal4PsF!+K^*9EQcGWycad2)u=ZGFkLOt@zXKNu<ccsfv@
zSxpDjx%gj@>A#&j2ctd2YULg0Hp1-<?`z&mb;7<x$hLUn7%D?tIhXeeihnyJwuZ%h
zOa1jz`75U>vlxmaBzmiJ&_#3EhfV!rR&GX$%oJ=~d5_fsR$~uR+Xw-(B|*Ch71->h
zXrzi9@4?qG>m+4b?&O3B!Yx$*&;3;b_}@K)31@7Yh~e`<29l@}u>)n{Vh}SRgF5ql
zGi5t@p(OFn9Ou9P7r+QGAV2w<(oSnq7#xaO0#5vvk$L{~63Z<WX0_8gkRe;w`p|PM
zYXN=7mDY+KnQt}VtuMH7GTi}$DRmKUb@Zd4(0<I+|4R<hfG)!0qerwy#x_Enstq9C
z4RHI(R+3^DX@xc(*-l$hm;=+$$fJAMyIW3x?e@!U9rvZ4wY_><_}lc&;?G$_f=gmf
z>UUE1=C&3yRMLN*(0{2!`b3|-wHvPDdpOMYgNHr_PCKFZe_;a<eZ7(9k3@J_Z36fu
zCgJ+!FMh;(iuzr=ECD&N%})n|ug(E*k%E%XEc4XC!eI2<(qAq-4;``<nnO~W6#24#
zq;o)ZO4N9R=L-DR6r2&_-U*KCW?`_1Ehyr2;9?@>fT3I*x}D{5KJ1^h_pC4-vsj;)
zWn>W+;B=D80*<s|4%g<RZRSfgup|Tznkm{rl28re#~K^n-=em5ur*hbrP_4a&ZnSS
zH8%5HzAVWYzzfQc<wXy1^3c!<2x7|YC|a!k({`1P_U{USfwQ4XwsHEJeHr4E3R&8T
z5HQ_^y_de>QpFno3y}N^$9<q}HP9kLJ~lnbbRzZ%QX|yPJ1hJYc1!d~f?n+q%hkSf
zeYd@Na&L*YKe3XO@8^ua?SCAu?s)C~<GjfsU0d4@mZ6g<#%znrwG|nuN?yFMUKs{i
zRqwfbj!v`<!S^~n%ePEppBesNg5soi``{KGku2g{b%$l@JyiqwQ?ux73Mn`FO7iER
zJawIZz$yRj?X(-16LO<i2VUwOfNlRUB^~gZ?|w#xTK{U8@-b*=VK2+D3)BVr#nWoE
z(z{)KQK0iK+bTC`o304j1KaAagnoCD#q&Sa`M=C6iSvWd+3<0jiUd*I4q`J!JZ-tx
zYRy#QA;o}gurz4-&71`BG|k;0ByGy=ywp8V*M`7sFV1CfhJF^FQxpm6cb78ey~ZSc
zTMxu&89}#X6k90&nU7N8gtb*q+1he!EZLZ~1R~#5wG42@pyU5pcRnf88-TBNfPy%y
z^(;a$+*R6IH=ScusgY~|-#fTD$vk0j4E47L+&nnnSF{~R=o3rX!XrNJ@eXGI&Xk*H
zP^=v!Vw9cJJwX{Ny=zvdbZW^-C|rzX7Y!8In8=ycZ<Pr49ixi~?tfKBb5<6$AM0Hh
zg$UxcMJqALjgnGj>)c-x?h_h%34aT3G~Zb4E#S7>4{_yVn7E^v)aTiKkiO%)urprD
z@%<@ElQ9RzvhS-&?7MXS><J@+j<y9+mw2~}cRS%mEgMza-}$MqsMFzly7peeUjEk_
z+W8Ocg?Jeor7OQ00|yeAVD!TD`j<cVo=fSqt6t`z{1j$w)r}kAq8%FYTT|K0Z~TZu
zOWk+I1o5Q7+Jkvqz~^QySLsiX2z*9~?zJz{im_JTvn9zbFFd+_1y&*P>zDp_2l{W4
z&I(CYs8>yl-?^)$Qq^((+}Eaix5_is=dOrhxBx_L+EGm3d)4}i`p|n7qA}xFN%;X+
z@$Etg*T6Fj8E;Z;wOIEr+_}b=Fpst$<>3oCF$&|cRLBwcV|HMEoL1q-!t0B<fSh6i
zto%Iti9tH1X(?REnY-Y&r}%eg4L88LsZo(wW0jxbSpF&mxIQdH{P(o}JLUR4B*`6P
zoD-M<TjQrM%?Mt4B_=%DsY)w~K7y$HKZLz^R8!m5J}ig=qEw|w2}MApgVaEx(glfv
zh)RioNC)WzQp5&GQ#uF)K|n-$?;WJ~-b*N<haO1s<=o#r=a%u_^Nq1a#vb`2*?aC;
zp82df=ekj#JmLB<L*F^_F}E)jaH14BuU?SWQz{3{2{D)ch>_Tojk;ZLAsV$wLt&k@
zd6_$HCTwU!`EY10_K>+_W3@%t`b>#;@Fy1jC@-Act0+<wJO&!s==0iag$L|>zahna
zd@PvVfgN_}aHe}QoEFtdF6Bu0|50BlO6CF_dgJoeUaVX6n2*$r{bH@9yIBF`#LROC
zeaUIcF__F(V;+cG1xQ+rI@-LWH#vFaq>Zs~@Zv?>8@t0?=%puI9FZuvNu8QZf3MHL
z2C<$g=tA)Uw2D?ae^2|MA3xN3d`J!0hm!rniQqJEJOh(s3TJNCN|3;#_}l-<#{5@M
zf51%!vj*)?6}6P~J!DY0gs`B(YC&Zk3xoHSBe8!()rZh;!8wUG-Sidu3xf(1&s}D<
z=d}+$Ks&}f?=?M<8lr^(@ALG>hYj_AR726f?-5<)qEd$Qm8SKCMP$zS+v;}Qg*!4D
zp5<GWJC)fYpd1CD8&XN}y2(X*ShtR7y3X(?G;5~f1^}wR@znL6{`EuQ9e1Z1<T@TS
zg2|xFDm7E@5=q3^{*r|*cK~uH2+%<TThDShfpm~jL~fW@Yo<8~0g6%H(7tBnWzG3C
zNPtQ}`K}u9Q<$%^8t@%X#>&xzzm&B~ru2A+Q3X5v1<QGE*8vV6xG2r@=HA(@=1j4`
zvH8f-?9r8Irts-QEG~-kda3VtAZ}$cM}%P<`9O<C?K0YJxY6xG+JACQ|0QGI*ERf7
z2Wf6Q;o_q-q`-QGQav8|p?0Sc$5DFyV$97fEn(wZz0Zu)cvzB<`3{SN0896=nBqmS
z!zH%+@ljr50#VnnKn^XM!N55##bFBH#1yU9Z|S9ZlQiIEdCk&DMxYCI-{N4;w=xL5
zY03>mD7mCQz;ksq6Y1dPrsOj(hv{UC#sz%P?MM!0ivfxkokpI<b>ij(9oFj@p2V6+
znm#gj8!vT_&jkIgvN&+~XK^>WCAmd^$0ab<zy8elafzG)DPm;o-f4>&e9RjXChqIp
z2l_m6d=79c#HZ17%8v|$l@E=F*Y+G2udCyRWkRn6O7~pbE9DDJYW*nVw0Z;dJG;ox
zE9Hr&{BbkD>4z-Hn(#0j;HU(@a^bMq+qj_M=DK$SzE&m`f3uqU_@@Jwp*e@kQ5)Ik
z7NEb0?>x$tAa{s8iMAdlc_n?#iDd*~S5G}@5`8-|M*)4smnr{pA@!ai^?z(x2l3a=
zUvarfp5L^rUMhWw^6p%v+8nun=_a|Tr@on@BCH}=zyv_q#^dKWjv^5P&V&CT8QO)>
zDq_M#b^`UDJ@Yo&#6N09M(uLfr_vNQd$;k}=^^_07}OFqW=;&FFfTUG$M<etc%HAn
z!H^&OyXi|ui9t;7_bUUXk)-D2<I+LN!{U|C3WDLQ#>l8z{?@zTDA&uv^jtS!oU3p2
z`@#x0+b4A<2Eq#84fIev3ZLWj+sEql57Glx@ukhC%0|YKx!|$>F!><};-g#{#Q@=s
zsS^nk{KTW`qr!W3BHlWh%G|JhE{kYd^2A3W<=t01!{2jhVU<v&gQ3q2U)Qwaoc~PY
z#_XAPEZl?)-cak)WUAOYmt<;Rtfdv;<=F64F*fFlD9;cuVWVVhXybC%Q?Tv5)^ow*
z`>ITv%f!liG#{Epy;h{=uxQCWam~EeF5G!<eR_R%M{-b^u)&giJExkKb?z3^3FP>p
zb~Q+8o!+9|Vxrx>5poMFNI5SR`i<MOSuMl{Za_crVicEmJW%@z2t-(}+%*$sE{XB9
zrMB(E{$^4CCO~y(`)=FLWJJ-jPF5MWH6nt)xp<JCl^awbZQh-`7(gDYG1l*#c4=wn
zBV*I&hQ*fwpPDg;@Wckz42Sl)4f>fz(A4EW_t@&6ygkPd`Gq$hM58T{aQ{|(Zg_8T
z{ACIn{@3W<EyScAE8i0nO3Fk5#yUhHqpC7i(XHD#0bPm))T~3-H*GSwXYp&3P6+~&
zXMTdTQ^ElX{a;GX($0Qx31MQo1jALkl3_HKPUKE&ZeyKiXgBmw`(=BV_^aI1_bxSP
z>nR!IXi9N;QBGPv>*nd9ml;J(_@h<A7?UCbQk*F6*Z>VZV{~?{ZA4fiucnOc1{b^j
zE_zV8$$5x9XAH=x`)Lk_%|v&0*07CwYdo$vTEHU%qzh}CrGRhCOztRTcKSIN|4gj4
zygMJTT#LBUH11~YF7S>`+}sp|#MxmM0fZMPW!^Q`!Gss&N<0IQ7cRD=4diPH>#dr3
z&VvtZi;{B~i3(5hSYQP%Ul#kPL#W5|*Pj=BNtWAYQ#$d+6|p=><?H#z!lp1_jILzG
z%bsPrpPLiDvs-ka(rM=^H_SET{p=AD$!V`ix9;KfT!am-ChXnKW%V~nSu`tJqKUfq
z(QgdEXpfa7mxmIy<;0u!UtXu&Vs#7xfa!7<<8gzDdJoT$M6q&ZZi2H?JT#;IPqVfa
z6Mc=XjaAp=fLoRO>jlT_IK#Spkh3%UWbDlV8tubM_bB(Kb+)uj6^zIQ<}dE|zgjGE
z$aKbTo933|J{8&v4rwh-sK4p8kEn=RPj0I4Kl@%t-pXo3xJUTye+OBWwey{WwNa30
zPde`DCI#ol%oWupczWrdZC#G8`YzU%1(^8ka$?}onyK$L4tfgt^g`fUVCZhB1$U_x
zt;Ih3IHR!F)ubf%J5qgPzttU}MoBY|0b~6fo4W!`A)(~C7k4s~3kj**7{P-(&;6Ws
zO3Vx0`WM{L)()NBqY@I(N_&fO?}j(LTR?}P`6~p9%2NpwL&YAmk`(xE#|6xEtn_zr
zUHNM=$0Gq#wE{rYS<|2}rO)``WUQdB>adV~VSh;J_^YpOnN8aU$h~!FG?ai_;q2a4
z)Cys-WUpACCVeM&5h%akQA|mt`+uG>hlhga`n2E(>dk%wbK?ud%kjd^&LZOS2h8uP
z=^|72ZaEA#JNMQ$e0{wWg;)cRx|YpSl!>ACs@Y;Wr+toab5>hQzgCdMeU@b7Ezj+=
z%F~nH9;NK+^-Yo~5|_5k;MBEI*qMt-&+}EQSmRL;t*e_m!!h)to+y#LS3HMN2gNH<
z+2o$Fvso14>$1-1d5YiP4*@ic5rHf82N7S!Twf#kmP{y%48u;&Qyl+TOn%6N+iCMC
zp~DIcwWIO2(|tQ51tc-{Ma$qPFtft~DsQjTy=Prf=&Nx+9<LQ#h)rFJm}z+mQPw6C
zHw#tGsopJ-%)>Z!w1NF5l%31<vq<~G`q+`VNb{nyicRhg2hs_&<Iz#|V&BT$vdRar
zcG1~~=J>{y7yxk&)#)&E+~c<6<ZRO3X7phth)(hhF+JyIS=Menb~C<!#z)mRsZ>*(
zsY_0|T|pzPymPu^5DTw{XC|%7Vg_(6q%+5(3fVd>c@U-Px@j*WHMw^fRt{mcq6^ZS
zL{=dgyr=A7u%20h+Pu5jvvvX<3U&7+)41ApgHSRnk1>#sOlm+rb_-@KaMn!MFQj)i
zEWAeSKhL>e98h&5y#_{jV$|ks5Ob<-V^Z;OVt%r4x4>w$RTDB^{yl2bp*!sNaPC7A
z`x}{$JcWJoLh0x8muR@}jC$2ml*kub@J>V)4jOZ?LFWp-@$j)CO=eq1GJ@+s;9Eys
zn|Ts>Q`Vjpr=<=Z-DM`GVYAj>3rE8yV`u4M4wX`7ydU!_m$A5A-6x)H`xEWDb-z{<
zJrA&jBy6X!OL6>D=UXqOUaM|CLzyI>4K>h*KH#oR*DVv5BxNeZf`Qnv_2O({l}%bq
zMK657^SW%qpJ>ogpXRvlx7sUF@%T}!aC_0>>VeD2s2jO6CR&)A6d1OI*qsGus%%N3
zpND~#DF#jR<$bWS#8UWn)oemW=1zohb*)6=XpAs;ixd^W<(G%6fS{^Xwt`S*$IFIL
zB2J|D=IqG`$)iC3v@r`K0zo<36mE+jN_vBETbSmfnyT3w7#Q!lhPj@5G(xmG?JrDq
z%wOx5s7tLdd**EFeM6rlvPDhK&gb7>MfV|MASzpY)@a0$DC+c#t#{~UcE9e$cbhk!
z<}yerRIDXqS|m|su<2}bQ=YvYt4;v`+(YXUm@F3K+)8YR+kOrGS1%O|ZTKzGC#HtA
z`zMB#ulFimof3d^^(LML(8JWa_1`bnNt@7_=Ud)GUoaF$6@KKOgBpb8xz}50O$}qe
z%koN1DlIU4vL8f~P9<Dm*(R|oH9OXrE2RDK1NU+h*nZQNi8DM>wPO*zzh7(D!AU`(
z16}DKNw4~t_3rmJ%4=0HWYUXpHe0uPZ5lkzL#zj9yKmOqY9LkM3XN-A%L{(Gpm8)5
z=4|~uX$cRMM_0h}*G-5l=7z*U4c1E6vrMjx^R4s^0Ig1xfu{Co04g1FEN~IDLCzw+
z&vJye%H0uO`)Q>tNTI9xG7ogZLj^;S!7#_U0XAjCLZ`n0q^%#u7<t}r(WI22*}F{o
z1aHJa?14BJ9wy+E=L~vsa_OH}mvWUhr4}BgmRN6dIvPrt7yU}~8vj|SEBL03ws{Bt
zThL)724GrRDQ4pNVB8DA<+$J^FDP?d(d+kU+z)Ny0qypk4FH*$9~82&dR;1VIM#u{
zo{W3f5jp`_R3CVMds_s3+9lk|@7F~DOl{Vd?`|oGfPtsKaA9S&xo4}?nX$mB-5uPo
zmD>EoV<JlYNa^sdbsd30Y$eh26>N~x{8<lZFEc5RbLRCZZmDu|xzE1p)n)>2(*<6$
zg@>sfm4GJeits>u9CeHfYOk*IJkMER?lb{#w&T_dR{hCE`a$hc^>s3=py-HuoA~f#
zNEl?`HA~2_uCngzaKNHOY&cm+<1g77Ews3vN&Kqv2kq3NoXld_YL|ws`%^VA8j?O<
z4J3EsmPXPh)+oCJm5h(al`7Q9S3St!i@Epzs=pjVX?D)Ft7TOA^CkD`u=cV=rfr|T
zDRdmC$8@{+4DW#amN~$=RerNilaEL>)rq)x2)!9{5mjrj-7Y+8cHdhPg+!lTIq<G(
zL&wxO*LuU|XH~7rU)6_MCGIOc+_}Q%^|deqwhpe#5XfmQ33hg-dd}}Q;C>GnNc(=z
zPNL#u<}~J1b;kljdd!SFVmr%~B{cygHb&k7PL@{IbNd*s^`zw(oe77Il`0lj#^Z7b
zdM7QqtmK#%6XV{)1IKVN9~bIM=0HVeogG<{uhrr)l3t{<_-(mK<?0qBwFmGFx;wxY
zwN2Xgp7?2j#B^N4>~ABgO!wQsQJh=8Y2QHc?M!dZEu)np0;Ae>FZV75xtOV7g2E+M
z2#2Fdv{gE&lRfk>Yz7^V&a&QLfA<EhLvpu}&|L9PBE6Q?HyL%wyHd4@+TC;S)B+vP
z%xCl0!Y5Wbp(@0@%2C;zU!%`o2H!iE%cMWR5F=A9NV#&eY|Zb*ugJmoESu#z*B^gV
zr8dp@gIpBDei>m!J|-4r|3cZmqvr#`7Sjas>PCb;leA}^x5nL}@m#W7ePLhfu5E9#
zan38E#)}o@F`)l>KxA@cBVW%P2tTMphXe30(V@CO!3&YXAlO+>*@hw3c>mU~?K3hT
z)G6rDsp@6=*eiDiP!8`4HIy(jipe>we!4AX)<l<AUg(%r_MUJE%;)kPTIIXo=3`JH
zk9@r~)QhN`+Ujen^j6qCXqzQ28(Zhq9Es#*L#yzuC{zhZMYTx40ZsOKvB45}wG*#t
z>A_3EWj3Tu@X)jjX<}G)$s$}L558&AxyVCE2@9OI>irrmta7r3i6rgL<AU%r^TNbo
z+0JZxf@^p+>RE-QHS9rXlksm5e8F#BB1z-GtR`ICZ*-ay;x}Lwun9T-O3FLkCQ4#0
z=bMk}s#NMg=L!R@sPCSJNuQRyZfLwWrA3~0hKa2^ex^0nBcDM!!5eqX*3JoH`he3F
zaO@%=*9mFPb228pnyc$Q>2#Efy2|5s7TIAD0C;A;e`XV_>Rf7!xN~-jTf|2jdf(P_
zi2J9>Q2FQ3_!HFxs=|&1_YR`J4vos6ZEVPXe3_5rjrWOe?ok*^H-+~DfCqZp;!A*8
zo3s5k%ow#wG4UP#AGPRNq?bHr=M$3J5GO}Rwb_%=UF)e{&ugnyjyND#qBNlmZ2q+N
z1PtB$nyJD-b%X19s%!3Y#P4L2O)%Fh`_6TcBH+fmk}7h)YE>w`0$G$f35=}a4zdJm
z!JyjXlip#M!<sBV@g^d<9fGf{O0BFS6%d<*KLTOn8pF(A){g!n+8z}e*JYgzb`rn&
zJ$dMI33frJ2ELM1HQGRKJ1)fKxWK#r2qnC0lX=St`<36rPLL87X<r&wJgb0HS+(>#
zzvpdS%mzXO>dXD4&|gU}1(?yhia?JdMDAJB{-&qZV^Mg9P4aFeo*_l|xhKwwakWmO
z5fH~|RhgBw#Gy0KG0(+!ab5v-MCVJ73Z&4F^!3rhaqavRw+IFVnw~)RjN}{xAn&gN
zCq7>%&s%NICkDQ|;xyq?GPb4z{Pr$q?rK4r;-if~YaL4itfLhNd6v-CBwmd!Afv&=
zxvK;CLOt-RLmk7hTguRvQ50L<md_jZ8D1q@3j*9>yB7WkA>J&n+wll^<pr=(m(3IS
z5oLg4+<LJwVo1#QvZ$D+tgOY*l1iRDw|qM7D8c}?84XAc6#**}sxY`tiOrdI?+G>%
zbOm3I2dE<B=9^LEp(Al1Oc8p+>v*OLd94US1KuF1lrsNV8JTW+$E}P$9t-IB;$3H4
zL2mPS=JWcVzS0THhXB#{d2eg>qg})TM)Pc3&s$JaLphXB3`zaNd*+hn(1uX;lchGW
z!3-(c+e?F7M+r?lEwV(7pHvx6&j;sEzVoKzUwQls-rXdN9ldCCeGr1erRCO%J)hl;
z8TEETdC$01dWVKi8r2yRDBce{Jc-@(9{UDQCsIctfBneQ4*HX=8k=Bxt(C7>Zsh}_
zN^#P0DPPaELS5ci2*!?%{>YoX9l^MD)rz=LIT>2z9bj&Rs$PwjB%C^L?ylDPSe~>Q
z6Wo>N?ZTm%7f4)S;unSubIE#e+DU*M=`wN|3aATnx*91^U*WG;*kqh1&avUF9!R%e
zlw>#!bKRW-T)@lJd?%JqNhoyXKHM#rH<Z_{UIjo+cuvcO*^qZOGQlSn(;WD(p7(g3
zp*f${omR%4m=`H7wXK*F@MYdhd){?>p`Mm0$DNrfMZjP1O;PAn&GwMnfG5+O@7^$_
z_{n71QbKdgx`zSmv<k98gNGnDnhwxj;Dq958_WK0W-qQP%on|sSdIoPoouvrcMo-I
z(i{<R=OfyN*9qb-aL>A17!JnIR9lfvvT-iA>`(OZYCJrV)89V(xP8H)aX(9bX1AHU
z#d#I`pBe3kn)mm}$R7)`!VETt$-^J+KCd0Boyc7us(0Lp)#SP@1G#_RpjnwaO+f0v
z<2iXtPxT&mz&RxvgLA22Do#u|Ck`{tSY>sTxZTtVyO#5ngkQ6>o7k`yf%9MqQ-dud
z@5_>Ts^vBhwx3NCdNI0}ns>xs9aB^u1ec$bS;k7L?<lP#KAXYEtdSl}KGyUu`Z`@L
z_Dh%!2s5d;JN;qs5)?gU)mwv=n3lshZR3wDu92=Rts65pN^D8Zi3<J>UC-uXb(U4M
zhPc%B91sSnp_`TC=6<o{O5L*_uPKIFk86e~pOOn;X8-E5mR`Wt%t?DVO3M0ChojX3
zx6N+`2x+E|s8w`U&y&|Xr~0;<?TY_<BnC`G5Gn^>II0P^|D|=G7(Z9<c`{v23ecga
zy}+Xn+fi@pNgLNzoq)QYV5aq7;Bt19Z!UcjT_z?4IjwIq+>x)zC7$=)Opu!f7oObB
zDy!Z@VCqd~eom@R;e~n`+A6~44xXcr!x@Inf=@l`tnz;nZF?qX_7m*3g*M9|Fl9>k
zGBXSOFfwq3<uF2TNomI#nJC#qr@*woUPdM_d}n@D$yU3>;y&`d&Ni7Xt=?(Llj!|H
z(w;YR-RMCqyAx~u&_}Z>>+OSyd!bFFqYB8CI@)~D=thFC(_Uyxo9db!#sPXVFa|)s
zT5Qt-pAokLy67u5zhQJxgf6_ETO<xOOE|P6=vcftH=5(_jmq`nX&Z33cJIr&n?Xe{
zn#-JCWpxfWdZ4=5n+v{w@h)JzoTlqG1b4!ReDxhW!IQ$7>EhJo9=dlcGjC*lTlau)
z`bC`CKg>AsI>$@;DS?2cTSm^#WGafx;2%FwuZ^gFDK;hOi!jgvPNbFP?CMaz97w5!
z<_;(Q5FXa*T)AE+o57MZ=IU{=h@xjg<$&su<9e9sJHuJ}A>aMt%p~sbV5eFDi=P#9
zU8n`TZD_=3upI+4mXJI$R~g&%+iqF(zKf%uAC!FdsK+F~m<x0eHZNfBtIqc7nP6yM
zqRQNp7boQLK2vo_tb2zc`f%z&#MR|#{f!w6HSgIiOxQsQJ!0PTO7&4tk`e?lVD)hr
zj)<hrQ)A#vq@bR`&Eck97>I_w@7UbtKd=q4c)fnUg{r^Xq`?VW@?Ig7Iu->EmYYkJ
zNEWrrCga$qs|fkuAmr99E1Q|pujHYcknz3FrH&kWQ1gcJTC`_C{~r3ZSYmnJyVgPJ
zTdm=abQ{5X-pu;1A}AA4N@gTsS8e&ENlnEAKi8fs@cUwWEfUyKZG+pv>(ABZpTFuB
zdwOcxD4OTPef6*dvJMV~rPn7Ppy#UfErsR*J&df|S$V_0z0@G{x{<T$EjeaM7>2VW
zjmH;FX2cdpTV+ospC2$^ij2@;)*CzOW#~nZ=bt&Lx;W=|UI8)}nlTK#iuK(xeNCLJ
zX)HP!dycL59pHWwdB&nOwdEBK7J;5(V?Wk$Hm=lff2t-m39}`ON@UMIRCj(1?QGp9
z?`4)qmf0O8R322kI(ahxVEt9JarJWdbWwZx=<l6h^`4#C{9ZYnPkDA%7u9GOz5uMt
zU&W&<E}F=UIk>-6`t52~>P7JFB+p)OsMsF}?)-@div8v|_?iG9?9|1s456xPh{KZH
zwJT<)-#Nq1q0`;-&<^X->rl?EVM1>N?gnL6ugg~TK`7~V5X>=yajeVhVs9(BQ0?hV
zF$TcrZrjGMhcw_m)VnyOMw~kj#2wf7c#ReB_M5aOo3-LIb3DiRjvMvC-<!*jW93-o
zZ~kFj!1@u6){#izK#V-Q=W!FYd|=Y;o;$$RtDyXJeN?fU7Kco{a<lIl2l_GT@cbmK
zb3!Ayv%hmB<{g`p3CQyq;cmrN3GaI4JoPFPHZF%LF43(zx~z6dYeeJCD9G_Xc^)~E
zknI+r#vu6z6Qpbz19+x{tv%W{pRTV$z))MA=45X>J97|2#;eiEPl!cZKFba-7<^X+
zsz|M~2V1D;q)wCet&hCRNeH$fz<zmZZRR#pIMUSrA%=S4DLc-JK3sW=b~^8h`}z56
zS5?jsWR^nATV<oi>4yZ$Xu6=O#|qz}HUS}1dp*77-n3<*Hk^Yf_|kcDk9N;3@2ZuW
z^{O|hhdNt(>&9xC+orY%)us9HwHf!rGEeU&hB{K6*(~ay6I~|sSHtqyPsTSlR>A6*
z&UtF<Zk)WnG(Y$5$DtE`+67glLX<?0)LefHxL`<MN2aP6u&U*d!)LP@;OrwGWMYix
z#~aP^a&?<tlRbD(*V?zlKghJRy>;_(f|NvF#13~O>KTe<epz8wVf&kte=_g(3aF<T
za@%4uS+=yl&2go>VkL39rVd9Y6SH^DYjxzfxL0irQ=05CbOe3Ks>*4r0YBz6bQI<z
z<l6)sHhuu%=v5qxx>M;<GaSFT%+N|cAGq@z3`dR<(h0yBJif7vWRCx&5VbN=q71~_
zFfX4sr(lZ@d-L6bbbbH2b#5j-@a2Fz<)m>9(P=vSTpbPyO&Mz+j!v1iIOXnG5Y)v%
z<nNAa+mX2IiHjq>UA=u3BfW9GvF8hYA}Z#Og^8Zy4ta=6RV0|k%a<}#aI@x@Bcpl4
zS7!&v6+Iz(`-~MsS+ePaZV5~C;#q3i2f`w{@#lffrR21c(j=T=LG4y}a2|MKLU_@5
z*rVacwJRo12E$6dmWC&FJn(7nmc*?l0W{nt;xNlx2;6es1SK~~G1RK1P@rNpK8yi)
zKQjxP@_H~1>u+?Mx>71~x>1fO<Ma^{J{=iV|Mj#YwR({uyHheZ;Y3Kq@HFSHqzF9N
zgsX4!YAvX(%kQg1-Pr)HwTx(@L}rMiwh=2|F=+E$227y9w)xCy10;s6di5Gc7phX?
zCv04YCYjeIcn$>282d=!=TM0TTcnhLXz$w1&_S=sKhpdtVU@MD=~1z9)h-6j{OmYm
z-TXl>%%^Jysz{e#+w6W1POK1PehsrKh}M>KRet*L*{XFvg7c%9{lg<x<Yi0dcqctQ
zXGv81UgrnTSSBbPAz*@GMmS{Xr{@wFYuw%QQ?dg!Sp|AX#E_8Rk?H#Zm_f9n9e35u
zKgmBTe}gc^g~0i(8@qGgBB>t*Uf_9X6H(N2rgQRyK%rRsv7?Ii%jC>fA1)s+Pz=D=
z*Lh-q+{jqB#@Xup&hXQ{=)u}PME1&jI6l~Uy58lI$~R<AB0yn*2NbDtY!QBoOx0)-
zR<@5Sxzo=ca;(#PmG7oKJ}Uysa8Q1}^qH<GsQG(Uzg}C(mmloL0rdA4-T{0du=|8t
zc;qQyEPm5#ak_I5O*q4!Zxr^-<B!kU9Qi@*K$AKiRspI5Ig{!4*h+wN6@sv9|8lK#
zGNx^GJq%#^N{yy*eI-nJnc|>K8`K|7D5@P5+k`#w(J&ij3HKx@@@-KZXl-qg<^p23
z_mNV5iG-2woLU!Up+)Y+f-Fh^73lK2-W3QzPiboxk_&8dnUZ@~jr!dLn63dU&z8qA
zL`06`ly>9qpB;Li7|xnc!ZW(4OZlAE+cZ=Ui3}p%xwA_!qC0w`#@R0MfyY-cW!Klx
zdL{my5E-G@Uw(VGqdLAZ$Epm3Lr6=|O@(*!`KCo_n=NJ*ScXt;-doqn_3UkRN+L~<
z>E0)$@w8s&#Pa!F(dPl~4@I^yaLdNH{<QxgkjDc=Tn8k*c@fMrU5&}`RM?4K-}XBD
zHGbe%q~Xvh;5CzBTKekQ$%1uu#}%xoKx=yrmZ6itKl`1N`ax#o)!JGpV3&ZWpKSvz
zkZiV9<~GHC9;njV?MG<S34RN>UYT<B+J(Ch?_AY*l=qbJ(c@;yz)No1(OwmAEvs&&
zETDx_ZZmzJ`RYM)<Gub(3d*&UURl37=qr>B+Win@jgIi%Jv~$?de!}WPZhYdRBh9<
zp*k3#y0g|fb}iOCQ37OEwLF@$kUMi!<7fG4{sX$worjHIN=t6&^mhL#2?0@DKdQT=
z+s1$t4c`l$X`n{PZ1T@-NcL<*PWw#D$(1bC?Noz>DZGY$v;+%?-)>E^lEBH?|C+Y>
zL;(Tq`Y5i-o~FyWO|>K{6%E4t6Z}?V86L~#tF8SOpuf@-5Ux%7d;qyiciTDc4J~<z
zrBdySW=?g=`|hv4UXHiPaFJrVT5J{MqH^%S2Btp)KBU%quU1P;dc6#l2qMLCGoz+`
zeDMc36PH@P53aX|4}lw8`rw22mB7du<Y~@McODYN<+@a0K|20=e{Z>m4gyJH4kK<^
zcrNNFFLR52L>vNnxz0`?->;tm{h<!TL0D`{9)S<}6R(qmj5AAEjeUDZtE%h96K$&H
zULBiz>RKl^eP@(xKAh~OD*80qxhfnltRYB~Eh{avKG}qj5KDjO{hJhFFOO#<!x?5(
zvE{{kk?#H{udx80lbqC^WfMo17_(Ou`+VIWWaTSyBu5Z>TR2R4!C}7mm_r!Odt)}>
z1vO%=ZzsMNrG$La(YH@%>{c*iLvq&z6d2L$kP^w0{lgx?ncoI2Y;SIjRk&JRsVYRd
zFT?B%837}RMNi`ZbP{fMT4%jtlkrX$X4_~+Z6dT9^=ZDB(jCbBUTF)n9sr2<B9aaY
z*X^IUuEv5{luyM{5@>^8WWr6G&y7om^aOeZwYG0TJT%wBkEOPb`{eqy`UUKCw}-+k
z@y+)qhg2&gzMO|{wP_)6Ut+m_N=`>6{_IrLg!5#=jwAVgE@v#<YUGdmP8+fk{37?$
zB}P!lQ=F7O558DhT+eCQviU{V;KaUEi0c>K^)v_<VmOoB+n!f8DIF&FGTN+e7f>(B
zK+B>jrVZdJ^DylWh!s4@f8Da~ejXrW;}CWS#q{A>N%Pzpt$p(xJY{G(bJx0{?CQY0
zVw?7DtFuqBJqpgRcnY{x4Q+ZqkKVgo8vhUFBJ0=t8@N*8K5?EF#SoWUOl*vy?gigu
zk!16@Buv_Gn~!1%r_*hPs!5^<;8TXWFq=qXsiGe)<|b~VsI5oNPFR&_dpxiL;yJd!
zy*-B70Q-+asCsC6HoHhbfiuA^<s>#z_h5hCw-xuPT*kiBX&wezdKyNVAZF~!Q4db!
z@U1(Ey&UUw|6x}uG62z2BS6N<%AeZXBuJ+k{tn|e@!f%>5lIrteKe`;qpCN;7?f_S
zutyTp(%-1ud(vWh-Er=?8B}$xwyBQTlDeshpk%&sK#C1x;H^v}0oHA@w=sULvn_y*
z*SlZS;M>E$`@siA<C8QLGe9C>h2Xf47;@QN?Y-ycd7PMXv|X;@*L0|G=MMktXI#!N
z>~+<CYH4bt)UCdUW(3`QtKa^N?>OD%J}F9DPs}N_jZDd**U<xJ6_Hwan`G#LAknQY
z^Xag$s++VvG^UKM-{{?QMg-+vOTMl69l9Iz=nx+auX#(L1^xY>t-JlLd5X((i;Y@P
zhIIT=pXtI-Sa-2GW^P8H^wHEo=cLbcc2QGEi{|_37>*d$a);_YZPF*;M?f;ShSh@O
z6{g=B^Jd<YvZhSE81Bm>GxW0!JC4YUEK(HzSpFZVl<`6=Ogi_}l;~ZbR^4NJl|6e;
z`(|*%r=_xx>jh^DU#<s9w(;su`UccDPy-UFf?pB!ZdXRULe9<F_B1e$#?KA1^geSL
z)JcO?ost~WJh_bdK9gQZ&T>p~!WHlJja;XMCuv+Ana$fIyw(CXJ~I*}I@@*+R^5j%
z{@~%@Gkc^gh)=srFjN-wF4hfUpGXiud-R+o2bUf*!K5*ZJ>X;Zrj7%QK=?9qlORGK
ztp>NanNVS8aqDLzE;6tbKP8QOm<V#07QaW=Abhj=X6(XV%Rp<O&5DaTWDj>X!Trm$
z>%n448**+dS)9Y03JUlz9~%%t1Jt<d^PzkoDTasD>yw=e!d;#DV_Vza`znXt?p{E8
z)i{0y9@OZNXQ-4|hsqtumid1YBY*lY)9i$1BCl~2+?@^Nmw#dXrMzMzj7N{^%;uZt
zwooHu)wwFmu97Pt$}`naKCYkLv!i&R-;U~T>YjRa0R9{2wj?5mR1B*-AteA83P=*p
z)96rQt!%maJ-oog_uJb05c*HUkmYn^doI;Ty3ng=d_nxa!Sa05?H)5<5v1kS%(LU5
zv|3QPSZ~wQ<nWU&K}{!o^9@nDMk<TvG%QA@A2>RP?}v73CBm14g+ZYXe8)o>`ZLsA
z{F3gtf-eQVT&>0OTNU9d?6tVPbpIan+S8Fji`e;VkGx~&4;ZL;YF>DiqwpI$dh8sf
zX7*2?Ivl_Cn3WfV@^1+tvx{Ur+W=?<u_+aAb)OeJ;flvs9>sOOq7-`Z&-E_o+^i`-
zX!lB{7u{a>kGeH3z3oD@bqeF>b2s|)MAwA^oL)2aq3Ng^OvSiNAr-dZD^T|XklNe4
zHarExw$gSDX_hP!CT_O=%1>r_k5y$T&6v6$Ro?L4zh8WxeC$HpzE)UdJ%meI**(&g
z!-_d>_sjV!MoJuppw`D<s|TK6GZ_KL2iwuZ$^$z`8LONw7>XzIC*0v2Oce<c$+|SJ
z)}o#zq>04cWb?Mf1*CVU3i8PIz)#wnK7=P2+~33Zn}y8xuFH-To5@jc!oHOVUk(o?
zpQb`s{<V{brS5ZLYngxLxXZ^&Yk{q9X{>N(V~AW)P^gQ49wzsfl2EYNa#IA?<ydXr
z7wTi8Al>rO@?f2oCRIGWJ>y3O4XPzpR@;(C6YNH%3kdXa2o4RzY~5^N>o&0bwGY7$
zNHgJ!v)RDA`xUx$(dArbcIF_cT)&Q;RaY8Fsr-it6T7H%@vhZWd)rxK2UZ|>c;R-u
zrJjMs84j}`c429h|F^~!@q5UHa?NI4O*EXmg_@=`l-ZpgXR7i9v6Ud32L#+=+oPgw
zni`jzN|vhjQW3J$hXYYO;5W|Uf<93_p#kMEXAK{a%^`CV<n{YMP{#kg?zpggCTb^{
zlA@r>B8%E^+qk&fIukVSC)RW?e`Lsc%rCv$6@Alm1ibk0C$uM9aSMb06n!V&A$>`g
zPCFE<3%bi7^vy_TXR&EVS}QoESIyS+!ZUVh6{+10j;|laemz|X%<Sdvk5gJ|Z7Y|^
z(SZeJ<|tU$LX!DHZcfEZRlA<Os1P}T#0Pd>^5<?CWV?K&tl5gMe8#*!ZA`D8>VGXf
zEd>>DEp|2BHjMpxx`(dicjH?htEiyMo!_l*2_w{BY<09Hov|Y=(}N<|4AIh-t1GSr
zUp@NaX2(}`t3r9Zcr(<eq|XxKgdeL&f3n_f){Zi|?0weJq!>KX7%z-o#`bVw_yVZr
z#>7JKrb`XBkyULuOcv!esVlwaDpNckUVQx@0woLjPTh^q4sj=x{ha-xCp*%X-<?`t
z$*iGqETTDA0Zwi&LcXYZ+o40UYPXK1mYFlTTL!>#3VC@xIUkTR?}w*oc$r#?6(`tf
zpQT)4%+{E<;#(SQw3NMTp%*LwntheD@;wL79FUg%TlXvec`P=Y=it%vH8$yKRT=(e
z`%yQGxRk@NNFRRWL#~3jmbv#0l7E@@e_!-%(>w-0&h2Aeq;z+>&1U%wXk{BUpt$BP
z4Q6}0CaRCm?4ihjn7iGCII>o7w6P0FjB4$QqTgE|R5)x78CPx5TU-=*vqrJH$2g@U
zG#~rYw|-2owVbt{JtGmjIB43+7!;p*_GvH<*S~VlOz>iz7o9`*l7-l`AMSTxTv4vh
z27(_cHT68WTlBpJZ3E=^-2&FFXz+i(bryeYK*w4L^tPs57@k)t#v~2=<kU8X-5n<n
zdT)9*V9b#j-anFIw(vWryYOf4b@oW6cM|talLK6HV!dFOp^wBo7wB}{tRh%{T#(X#
z6e4{s=0`9zIOBnsYe*3<`9*i`tv2|uw=6MeepSN2s_!l>M`R`A#VZ8P-1r#t<UE}1
z%f9Ca|KFzc4-@nFddD;1b*_7=?0w$WywZJ0Yro7|8W~PB=Xp5_A)>0@n}w!%M#zq;
z#<wZ9niUMiLKDOgc3DgHL%r+9nhV))mw0LBjWq9BM#bH`bzdyQr=h-A<5vj#GHr;P
zOs>z?aZq}ww3hpY(lmTW%TzUp5R>42q3mi|@LzE6zwho&8SP_l8eQWk%`EO}Yl7i|
zglD?NVJT5Z+%DyLCVVx+^g4M?eDm<N_e|!3S7qZtnw)j&CTF+mlLA^Zm74A7y<4Ld
z<PE?2m^ClC2R(wqzUIz;wV^4x^Is-#$AQ)qd4kCiU$w8fU%zdWx8MYGt3!)x&17F7
zAP;Yu3vbU-U5p}fJh~sCfzp6P&&M9#f`;A+X0a&aQjbvK=#Y(7e-ZWinzckm<Nmd5
zX_3*X_F!o={1`i|^}$#lD<ZrH{5AVY_Wj~@$NyI4Kcg4<`*-i|7~-wqFYTfcsi={x
z@SaaPbvgS#^JoexvhrGV6T1QT7o@yf<+MJW6WV13IAI3)<C@_3VmUTIhR?9Du=Ktl
zy~1;_e!>5g=pQz&MwKuO01klrjr>eVQLLTh22le@ELJuq#DA*T=Rsdw#6so+{-Dwh
zz5=!v%x-p~v8-x|&1NO-LG_d7h+*5x+VGIT$4-Cq97)VSkUvZzShQ`bZAwiBs&#5W
zFH3{lE_YuV|3Sw#T7bdet?7@JHs@)$uw;P9qA;7c+5TQqOMyvOTK7WnQ&tW0?sQ1i
z<x5b31FNSUs=Zp8ZyNtC(Es;e_i_ATU2>`5RKvq`;<znh-zc~7sfY88h;tz~b*0YP
zF7_^7%N8GM=0E4o)X5ESy>(yW#8MU`ARK$vk$KYfNPppXfahbhVmG7#DgAGu^q*+;
zuW$UrXvhkwkP1F5A&xr|77Cd3-4`vG45V8b-&z-QsO7gXz7}Ma4F|b@YztPLIDVSQ
zyL=F6;ay-a6*D@jrs3V8#>IA0@DY3ZJMfZNUBds0ZEt8j^inF-%0&p$uQqfDEZxPK
zSl!-eVge6{%~nGV)ckBhg)#Or6T85d9-53^OX+SyzRgRo^zIe7U5Z&|jvN)Pv*Zx)
zHatMQq#FA>jl05Zdmj~|RF#Ihf4U^Gu8+9=%&u~3{Bdx`^SEYXrK>4G+VUG?3%zV@
z?6qeGVih8q)!4pQi2;@&u#kCU`jZNl$!WawhwlIB_{d@KI)C4NLQ&>{aq*MeMiOhk
z23`#|je4X~KZ?1-%1_QFt&Z2+F*bybOxV74f*Jr^@#d#eLHq<4;87lEugVa8CjV#F
z@Yj3zw+q|%Z#+8v$>uT$?KeE&lI!hK!+hiocC}${RS#-7j?y!U72L9qm85&fvup{Y
zw`UeePf`(BXyKA*k;(PNb+QEvNLaN-2LNMn&96FIrvFCGUQmWI-f?g46Cbw=o(a?m
z7}_#{+s0R}>T+WAdA63?J$uF;DD6rcXDAJ&UEE_gPQ+>%e@j~~*%eJbNzj^U?0751
zvj65%bHMy)YPl|am@8Do{6di7We^V)+HJ|<p(&UC;#4%`USX@E=`+S+`4(oi96sVh
zrH8j|tXf0toZqHB_zPF0T%bC0iDJFuMf<04{52BZkZO$f4t1;4y@%Q_GQUl~D@2eE
zOEc*SV=GvVwr2^K9F^<D3nLa@{>%m<CkDV3qFT9iKUo*;Wg!mVlf>ApTyMh6-{{1B
zdc+6_5<F~ubv<@W7x2*c>9S>)g@TkOPYBRhg4tnysG--)*c<>rs4^Zzqwx)ZTht#~
zop4L-q13>Ef2qQA^?H(~9g}VBUnceRCGGL7iJVK#zSeuQU%$Zjg&*LpxMJmX#PGri
zH@!LbqFD&c0@O}x=nyNIn9_HYy{UU(I%pAwm>6)B(>hXo9RK<HaIDHx%L1YNH!2mZ
zO=eEZeIu5FI89?;_Jj7UYFJNo?R&G9-F(<Dd$-YQ--E^czg5lz{=Of?o88RZMP>Vt
zob+U3{HSnP?QJ6-MHk^+)=a$)xl1KNGXB9YO$${%mVT0k6fCh&bz3F+utLmR*94AZ
z)>j;OCGr4OE!QV=wgm+0U&{WQa{ib9Sf!*`i`>M9OWU}tp@$rckrMcUR}$+Hxtw3G
ziPHV@l@h#p6rWz8!f{U`IFhmJDUX(G2t01VPL@H9S7NktFFoZrwR*n<iRoN4ObicU
zl%M^VLj0u}e_mYY?TaF^?=j7C;)P+rVQ}`rHDSWFZllWVt^N`z3v4r6*7#K`nOLE|
z*4__~)Gw^c#+ua@!Y?<(z^0gx7ia*mA9qa-)@0GarTFI87TrU6T|3$T8#?~OWr^ag
zpk&Iy_!;%}Y%0rSjm`ZbxujK#x9?3=siaN!D`MMp?lX0#qoD;~m+knjH$hBVQ={Kq
zhauFLwuX$a{N3Z|rAYW+h~BfIP9?S{tgq!cC9`~!Q=ob-v^eSveLqq7nw+bQ=6+&)
zC!$aM<V|j2psfiR6iTkx&l2&ED|M594$jLe9bp+9zs@J+JXNmQ$Yu4f%u%S1-hT^u
zuZ*NRLjSbtUqVf}OF4aVH1>I7&n6v`D&3P6liA&Bw6CRyuq<JUan&Om(}ZnuM`T%i
zr_cEJU;_ato$Jsj*RWB@ZS&C1-s<AOq2K0FcO--snmpPRswX7Rr<_})>1dYfIlo{P
zQhLX3erdS62OFt%P>~IC!r6xowb?jC)EC<gCM3?k{?oGmP$-%Z4%rN?JIAwDs&D&s
z{z@)b?^3EBY!?LT;{~p#QJJlUPiTu0n9Nv`A{8fWqsBITFz(+?u*q+KN*~;QRBS{h
z{}MaW4<152jSR1g65u?<mw`nUU!oQ+WpuxM@InQuzQL;TEak<VaEyxBCzXBjp~Z0%
zT`hqPahWA+7VL`y_}?w;uFcuxrVU|~b*%SBwBw?<mn7`slOtl41ou<AL;HUT?@vYi
z=gp>|S^nT%$isEN$onq-^7*FW77NHRz-M|9nS(WN5h72DF}(*5)^exX1qhMH@Y-dp
zzJANk+J*M?go5~xg2o$_9e4RT{7)=z-aPl5x8V3?vnciMEzQgBKQdjr1vFi|`kUq=
z$AX~;WEbpeuVwr^&+WC#sMwFv;MVj1jTrs{UHRI~|6qfpM*%J836ZX}1yj;%=mY_P
zw}<{&rKl#tsjz#`KICNJk)0u+Nz252ty7B#*WZx1E%;fh;kYySC6nom!MIC&1NTqD
zx?f&j)CWnN!ys@p`S$jS(hC*Y=7R?g;e^2W|1%0})VjR<a~8m#+Smu8*w<P6Qe1)0
zAwDxh7aOgSW4}qL#WgEl1)&!Pr5r0AfJF8a9c@lPW3Hu@>`C$0*pm<@HAiHNvor%(
z$Qsz&&VEv^U<m#=`Inyj9~UWBl*0l7WGI-PbQn!`d$FKS*|`;SE1F*wI^`Ox!&DRO
z?TnvF(u{SC-m~}YVyZ(-e-FRC3c0KlWDz0{6FijBH$mdunIK$?aX9IZ{eVX`D+e4!
z2fY3~Dv4Fp#+b+d6ndXBC9ytlq`*t?-xZq0R?vUo3)5=o>X#|cZ$O-dD|_XQ#R{Sh
znth>P@met2r`T|7;9iNeeB~vA;hqsoQj~l~;?kUfQ)}S2aKNIz*)p5v+o_uwEp{?N
zao-z{F`X^XF8zjF)|9ZfWx}zveRw091_3SS(}z?oKSayNj%ce$hYaV;&IEL{_<W_k
z>`Tcic9CGRL4BKoW%WEIvB4H_$6Mz=Z&93LE&Q<tO1)SkoXj%Vc?{dehjjKSr(3wS
z?R<;Io?i{rnvD8)j$tV#=6<4O)`xHL9ma|VY53H;59V@paF1vJ-f&;uWh`F_O?L}K
zj6shJ$pMRsl%D9wf*)5sp0%OTa{C*Y<F84poxL=(eb8I3xmNh=nptTw`7p?9ogbd5
zsN4{$+d7uhw4Aun6Z-TL|3a$0Y;v1aKn2dh6(<dmyK!?p3~FVT12FtMRzfdDjnZrw
zaQd7iHma4U5sZOdikuUrra0d3JGRpu(?}UkRN-hTE{We&`6x|WwKNci8xa1ed*JT+
zbis{FA9lO$8y+M>>G*fg(DRR!oeXK0Hw+0ykD>Tm;R)+``;pPTjIVa7+}du;4a92e
z8YIzO=8|ZA86t4bK>~@nss~T#WVdmZ3Rg}5e6>sNp%u~}{XO;y<mqww!$=prb%4ME
zCAyEn5<aGSf1b>mHL>^%{s!p%7Yg|=)%Oj!bD)OtXqCJ!(8xdf>z8FHk)5#LFD|{j
z<kUL0^ND<0i~G_O1GXj7F^W!IMhK@?YkDOPVToRrst>ukRVp9zUT5gT`Dkf9rGqs3
zGrKjU@$6QV?_Y~{vZ;w7#FIgL`6>(uRS$DR2Ll9ceRG*H0KEGRFEmj6w^>;g)lcC2
z5?FNk;l9>wT@M5DIhMWT({Zo65&nqScHgRR^cSxh39a3It@{*{OPv<_=$v8ody8wY
z9?4k71%$g|mtnW5!37-;LYCzX!TP!-<$rJehLpqI=>u}<k4iI9%T-?K7Nz$|FP)wX
z_i6ydqsbw^;F)bs@%p7knmp!D@i(u<%OitIkB#m$ii5iO^xezPYrw2zOM*r<^gyxf
z2hn9~cskbn+y9kU|7Uu0Tm8kIHS})K_omdk)Xa_@UBBo&&6JiP-{<uFI?0zY@w)s{
z_sc)Yuo+t5KMlu4IczPp#6dvt1FXB=dp84!Qv9q1flp1FTy95oI7zCnH!2O4pZS$r
z$F)-XKXJ)EqkqPJ+f&2m*63BVCpN9fa==Bj2AfSU79(pM%JkxZQ7?v9)HM#cXkcnY
z^FkT&RAWyi1mkWiT1REs;=aN!d{A+NKD&1L2WtU*l}jEPbjz&n(3q0bx!TTWhj=<6
z=F)VNM)sA1DtU;{r0lPv9=ye7$*69N@B`o5rmiP~^Sf;TJA$QY|35X-H}D*ER!Eij
zqb~V?5t8{AG?wzed!Kg{(0@H0x{SBUb&2sDGA&z*GqYq0m2UklFm8YsUhGgqoPDwe
z5vpq~ckEQ;4Y?2)en~{PIH*AaAHnqFMsdl*iMR-nFYvDUh_P&HW);<^=B6dT?{YB&
zhCf{>j|z})HCs2RZv6pHy`JXV#M(8w*vvHfM&N~X`GE_^?9J`U_2l_aq7qq5Z<qoG
zp9Wg7el#JqmZ$zhx@6v9fI)UN>r5(=7T(<v>e>aK>&hy3`ZI2kLn<%jFhg`C@#%;V
z)Ajxv{WASp9GT)21_>hkh5I_w?IQkc&|JG#=Wic6@~#wK7f|r*@D)Xf<*9KUyxgZ7
zq*96tT;s!iSg=Z5=rUx=ni6|bJEq5QlV*R<6e~+z=eEvr)^QMI?EHfF%<}jLny&v?
z%B`1E=JDmoUdi);=d`r-#%zm<7p%g7(uv+Z&*uG4x4G{?q;_Hw)MxcB_n_anBm%&j
zUy2=$MFZg3j3ImMW&cDgDS0$pxZx%TWcCNo9TSNY2BlMbr(B1Bdo-!ne|Rr?f;5{;
zKcJtB>3X`=&pc_nh%PJ8$E_@-)$gXqfr1Q9Em9vD(#&$nTW8q&c$*DT;UhP~>ivuZ
zK?`I3t;;{+)Ss!ILq^zJd<xCI9WKop3}|>lmnmuVL~7UKIKGX%LDbO=e{a4l)g#U5
z`+H2xvLv?}v=;|f4~l=msYu26reKfc_C)3W!pu%T0n8l+I&97-&1?e{8Kln{chJwF
z(MW@Ustm@D<En|Z4HBD`Sge3CsW2zL2eK6N%xhfgcJg^5`Dl`l<iTRBhf@yd*O+T4
z2A3MSG@;T=W%8L$&*SpvTj$ZnW;2E&>&x@7Y_RJu;LJ4}Kc&e%?{rO6d>U9%wL8B~
z1wCp(Db&YBLAXd)ghgCgbl}uX^u8c`^*`v7)i-wz{2tiFPWAJUdC2>ys4Wq6^EA7G
zZT!H)^x%l|0PlUsazubDnQMHk>-!7Kk_PYkmb9MHtaC9s<`x<&EBUO3yYX@aucUhZ
zCwqG7s}BvjzvTsd39qnkdnIE@^(MfY2XQu3pDFL&{w*N1I|{<^yBw!`c^UK_CnWQd
zQ=4jx1HRE8zy^E^P{hu>?)gBXf&WhQrakHbj(6qtVMkp~giJPbbM4C*wm6=c!-nN4
z*I+9|X}!d9qpNS(=tfNu*7&s^TxTBRDPA-)``RR00p7fm-zC#o3g}y+={?*i>V1E@
zRU_K1{(H(U^XLN7eI7b$er-8Zz$roRxiCCE`U!2-_U^ot-GJ46C5liaWEsw|$<2d2
z_TM?SdbhY?6Njrlo2IW@8-!jVk23T2vG0hK>)i~ajjK;pODURtzP2@*r4jHQJ@juO
z?HuLs1MSsM?5X^X;t4M$@@2vRU*1Z4=mnMIG>ix2)1d=4At3jBI8Vur`xi72)SU_1
ztN8wPpfxJiXQJ8i=es(opsEi7^0##~Zr`PSO0~D@0CH+J>BfYG19!!k1wKwUb!7Q;
z3tj|hB50c`!r@E2VDC^7>b)OrK3B~je@b@ZWtuyWxk2QoV(<XsevmGYLXUc1PkS1B
z9^V9RmFtdKv>kmwa~;*tFZ%lCi!Mm;<F0)>bZpK2wVqq$EU7*SCtewarqu<yd)t#w
zq&m)TVKoULcdeqFTFC`zk~g<!=2b0hua@W4ECW=9F0MaY=}BT~4Kq^>N|&tONt}9z
zLmo|ge+NsFYf@;ke<{mvRPRaH86U~^>TT}8)(P=hE9+80)MWF<U!$n?T2q6pi-))p
z>J1mU1YGfU(X;9iz25(U^=>lVK{fZW^^+@)QO)1K@?WwF(S0AK8GmtsuHd-*>bqne
z=e4-0YiwUd(3U^)q%kSI<@T6^c2V&sunIPzyT<ga8t1&lZyoi=oa6i|@{#h`vw#uD
ztR>O9C%^a<6z;lg^|MzMrR~O?M*XRK;lU%Ptu7IJiMTwE_mdYdQG|UOJ6c3b#OR)W
zquvsyTCjX^PLA;%lW)PHx<ycf4f<d`2Fx+bt6;TJKJovt_MK5prERpzpnxJ>2-2j3
z)X+;Pih$A)lp+v{(t8I9h)6FH=`{#aqy+>7q_-fw7pX$%y-J9bdzkrV#+fxU_x`wR
zxm+iUA9-`$bDpxFz4v<<+libL5kw}9N1};w6e2*RTUF@MWGkB}8V2B4nRb5Xg)cyO
zkfx@G9lYZpnV}0prByz)tya~wIgv0aHEC%c{t(jw=xJ!p`;z098qR;I$xZv%%^+gy
zS+&NHFtYI2V#B&1*zVH|FL(9uqq#OJD1POXkDTY};i^f%4UubH$d5`CuE<B06VtVA
z@lS)5&wVxL3dY9I3?;KIOe)LVuX>cv(7F4ldoC^}wERLmrSpFBSxl(OFmMRRBw8@e
zZl>02ZmY)r`u5b;^xS-SuT2?Re>cVcvzG+rFYb^@;K`tw@!5|QB1EvKdqN^;Dxc_z
zZ#BcLCc+=qF7=_<Qq%}rf{EdU48<R0%)7%(QtT>;xeECuYL8Ltmz~Z(<gyhQ^w4Sg
z#OV4>V@%Yu6nN;3Ja>;BCyPW`KjEsSRz07P>e-qlAQ!pjcQ(Xey_6v7ved068Gv}P
zl~l4eK7#XV=VKQy)u&0{;GHOsLJIS~^qXg}S*f`uymPv>)1)Nn(~6vP+DH&sVB>HO
zh9>qXCVJW?!>pC7_HbTk14!?dx@M71Ry=|hy%B!)#p;r+UF+_%xGEXT_$xl&q6FgM
zp*vA?QI=laKfTo%N*RSROA}cKid&Y+gG@>JBKN>{Do*9B+H1V0ang1Xo@>Cca(RLi
zjo%n}rf1jwlr&|GEnWFoOW@UW!lmnt>QMQ8d8Lf(OW<S3ga8mK4ZJzpoba^ku*Y&-
zRJ%7ukoNmgbD#Y0e*<{CD$97xxGsz&=PP+Fc!SL4dR$EW_xLjTn;pJ7gFQQA**jZ!
zRudYmw(>Y6i^t<eQbe2=@>po&Z6N1UE^}v|pM)$3$|flpiGY)g=;nF9jx?(Rw5PTi
z<)JCM`C@~wZ<Tp(%GY`XjTym&r`(q9oX4gTbWJ--R&$=dUZ3AuXfX1$PuyKfnG2}d
zzIkOKtg&_}*(NYM!6+xOtoQSJAXU0w{YnDONp_HIwI_wM3plYVYV=3<kXB0&joqUd
z`_mgDgniQcu91A(ki9Q*r8Tz+#;T!q?k)D8zb-w*t;b~Uw@g*L#3U9tVM^AqrJl8|
zaXM#GbYrDI=oud3fai}RMUALNp?>#tVUfZ^6k?9rS6*$fQXv@VeOAs&%phcD2Z<gW
z&wF6&Uwn%yMhV6gKT*jKU>6f|1Bo}Q)pzNc$&i&ZS69c0qJ}M7#U8z8W+B-qJ*r(k
z)%@lwXmBv*(o$48r5iGGc-B3<ADxwT#A-dUdOB-9=@HnTDJIRC{voo-zN_fd4Xqpq
zHE+$v+eThH-4bb_h?d<ZF+SoOjc)AHJ+@x5G2AYk()$@$xq9hxd3(@dJBX|2t)dyd
zzIE3@pKgH>Y&2szq$dz1Yi~&f@}TTt1?v)LiE|8uG$m_A!R6#NmrS{%Jh!~)ee%gu
zgbzEqJjd2-+@4h&D&zdv^fUg}ZTuQKArRWUL6{>2B79ew&N0Q%YTRlFbD6dtrLilw
z8uyqz4ZqG<#hfB+WA2HLT=h3B9m=VrFz-$zC2<~$G@a)Wodu=)Vn6H*D)XVHn*f8g
z6lI<Y*J%4SEv;s$qbX`5uf@gY1kv#;FIo<Df)mV)+<RwShul8&>f0bw)@~0o>6?bY
zLJHwh-yPF4bL!5pG(o!n#OI=N-(o!tavWM7o|J|h592D1jq3CK{`LD66Zg@*lN3cw
zkKw#egv;GY<Q|`lV%!J!?!w@ZJ>#i|HKsk@q~hXmDqmtLPrq+dOEmUXBD={a3-8O(
zH!o98if!rog17eSB)6`aS8ir$zDd93f#(2{NkrP>&y$Nxv81JS_dXjJaL}I$tldSW
zP|lUj+uQfvUD{auZhNo-Hc4|EQ<n@ony{HY2=Hg0KknG5@)dA4!xP2<6M7-qTP+HY
zEOOG3Wk>Qh*dv%nZrbX}*BB?Y{g~*1g3=|r%Gu=CTj`J(eK#M`%jCKbGPq<C7x0o7
z%~&YSUAuk?4~@8F{sxsB=h)?YH{#o}-o*nGmGS2B=P4;{-?TDXry!(e)fy>qPI|}k
zP%R^$iNQkJ<69I|Efd4+YBuxI5TgZ@Hnd__)8@;ogLkUl#7>h~a{r5BIkaix5{e|S
zw2A3bZZK!v1B$cZ+y;$^5*yIFDx~|>vNz@)Dvb1^lDVGW9tAA>)_(3vV2r}C93|l;
zy)PP4WBK(Vmz>ZN=rUb6|K?(XkoJ+Z87f87wwU&v>?Lui&)jiI^Inz~grWa?vB!37
zl!7koP<W`6Xd+FYj}eDa(z<fSyvA`~b&QHJvXJVXSKT4od&4H1q6+(o>Mm~y0rwnf
z8o1iHbC(@DYQ}HmH4__O-NB${$utXh>B3u+51uSn6`dD?O1QFA>qO@@Nd$aCa>iFY
zRd6ks%E+I55@P7ov4{lH0~_7k&RPMILui`R_v;AHi|Ux8;Ht&>9~};U-RV-2bS6#F
zj3LvYdpwH15%i}~`~vjbjRT-X3l;y(TG#LOw~ftCZfDvepKp+)%mQ51azTjwgG!*M
zKVZheVn?)~E!cr9FV3HlMk!_43D(b9Y9e3Ml``}P8PIgoWZ(eZ1EmU9w&l;}dgt%e
zQ&rsD+SQ+8**z9Br0uN#K8%sI&JWYXWeDX|U@$W<<%7wtnozeSG9TXEuX2eF$4-T^
z$4eYkuQNS4tR5QsMH70=wbn>-&-OI>5(7nh?>95JbnTL@@%_0bZv1_t2Na`8%`l#;
zWo*9L-xsue<;z;24bKfE3nZ|@hV!?CecKoYDkMd0F(sZN+qF9?R(L#2E9*!;3i0JO
zGcpN*C{0T<O&?k^4}@u|Ru^?+K~cSe@fg3wn)|b|dGSx@ReOW3Le1+#xl|T7q92Xi
zr+lAn!{s%dLiz1a^yh$lu#%?@cK@*{8eDhuRR%)qacNmZntp7j*Q1^ba<UU(Ma5;o
z#cVBVgS`&Zol@-~n(`SF*z|rSZ6UF*BYDrB*LvUAkv6!H*YC!Y?U;G-_M_<+Ivq3(
z-&!FxFh?W{#KrZOnhYKN>W?Yas*aLT3NutWqlOlAjJ11<g=wblDZq>({8IZBry$2N
zRP_pFKuY$K=buHO?gIV;zu~Bgk7r*hQJ6be^gTN=4a;PotS&=^LT4q<+jw@k!3JhM
zX4&vgD!Fj+@(+DJR#}+$$R!s`s!uyLJ7MAT`h}FexCG_*Ndq(^O2d>MSqUnZdV}ay
zh}+WS3G{7q>YX{FYVm8Ps`>ZcG#J5p%*ObuJ%h>v68GutPE#6x+2z*#8c<qf*t~aR
zR5EiXwk&-`2ky~!b2ngqUUbYSW_m!hYr=43EW9tUZ53G;AEj%&ykzs0SKHmE{`C9g
z4Zb)RCsIn6CWpm19UfoHyQ=q%rFZPVK2Lxv-aaWCn%XEiU6$d4+sed7349Cqa!Zd-
z5)KWy=Y@S)%~9)|?!=4&Uj@!Rkus_AsF%D}a^1p~Ql@`%6vJpwi+ox1v2#2yz|c|^
z{)(&J+)?{gMAn@k;<3KPg&V6<CblXNXd;^98SQyvQm>SWS$i?P#}zofU)Sq>0&;6O
z^2>R5p83}L25dK}F>|Sg;6Um!ENwnG*4pFK9lFS2Et&p}!u0mPWI4#?)rdjy0ov>&
zCQ9_Oq(f-!O5#fFfs3IamF>P$z5f$iTS~h<)2WWEnl(Wb<YYk(6h9Njhoq_rtXGm$
zRf=4@{t!&YuX$a^gsgK9G;s$7nJ`!|(>!LfBqxUK38*20ImY_NWDSgD+{1-GJ@sqy
zQ5wfGUnXdxrD?J^=_Ni}IYSVoQroW6;P?cb><_6cSr9M)K*5lj@#fWDo%^)SPIaY_
zV$n$llo_4a-b+D0uzP^>Nn>lzr;xMGq$V_~=;q9idP5uc_wJwA+)M1sdcLnh^k17u
zk4G}&u|1a8UXr1NbLcv?#kItGDs0wzos5iBm;RDm=IJrvl~8gIV*PI5P?`*$C%dv?
z%kJ!T<w)_ar}mUy_W*&wnTP=smjAVC)YwXt6sQkmZf8>n=H0!A?>oy|6BwtXSD~uk
zYS-(KUUmG$q<S%49evT@gBnIB=KS%_r`hVch|(SILzqlU+c0~N#684in5$1Lf)YO>
z2aW=(0VLPIp1ptL_{e8-J{a*=VAt~1%YzR0!}i1iU}|a&%+{#xS_vk&4HOS(bIl4X
zI*i~i46+=u&XeU_3^R+v9Q&x0XxqSx@jG0)++h{`YANEN&04s+Svhr!Hi9+`*}6E1
zev}8rl3$Jrm&KLFj*}046jSyrVW1j7V8)(auPLMlkQ<io*6fd~YQIOAn36;_IDe@e
ztQ$zvJ6v-cIoj(QdfSL8g~RTsr0?CY+70q+BWA9-V_SI|WrDz5c1z_8#}7rgyrvOe
zx_#|!0C6Rnd)&{+%_~vdWscX(owhGkTrjMhSU6dvO^O;W@l6ip?sdN9M74f=qbQ+5
zBb?aV2IaXli4I<44C&gcMUPfZV(Lr+2xwTNQ;7}NqnwO(FIfLc+ay8qr0%^_;{MZp
zKKzDKHD}lYbo9+_q8Bhs*6Qh;WvET@nPN}WmiPXxLn%5N=32kKmwoSvFD=xXNz-aP
z+3r)3f-3q&?V)*M$AAvizn<9<YsG%m_hrXeL9hGinvK4N6YNN+*!CxIsvnLYd#L#O
z3a^m575w04J6&3gq1j4`F0TSVv0P27dW3u8;<1ouU&=ZHv+ujX7K5m9)(~{iVG_)x
z<yH!hepPryxt2A)S)UsgX2m;sm?#HPFyRSve=f<u97h|5F0NiM?-JV8$K+Y3fUT`k
zy)X)>aEVrv2*h#MK4pZrz5W^>8DFliL!iCXa+MQ$KA6>w(6&1fJe{xUAW-wVl!4C8
zvxgtB0i5z25;;r0?J>dH|MkV!t=6k}<BU@YnfzV%Gteqf-mm?hz{xbmhj-2PL|<4`
zaxQPgN79vUxYhy1e5ah@8qinTeVUeDtmUCU>?cPNS-##f__h^VyIGo_kg`k%bg&ZZ
zl{20munlda5@X+<QU<SHZ$I<3V+n8Qo{v4BH!enEeA2Ih*IT>htQD(&|El|W{1qsQ
zG(cQ3k-_}?cVh7IKG<t-p;$&E_3M|0_Ro(SWBv?D#w6q`TMg}OYN?>&>LtKZoesp;
zdbRu!Z`5<y7pc^I2TIsm%e|yzKzM%*<+UoBN<vm23<$>s=&lyDnzRD(M)DSiTPSmS
z{n{$MAt#@U>!OpDz+C|{%@E^?q?ZF0(Ge!MawDOzn~!LZzuYB^|1pB<%j~$z?V=6$
z!mKFcM)jDc(&qOWidPrVr4&^@Ek2g_G~Y}6uru!TH0Ouptc&A1m4NIWY0q=mFVC`#
za_}v4cP7>krtuCIEKaQrpZn{cnQtGq8atP?e5x}n=^4FUUw6p#sJLbeJGbrEkjG`U
z-aA)2l};JJIZR*R9sbSBqMdkhou}aFox4}juXl3d1$58A9!RA?{H~{j?bAS2GWitm
zy)WBgmrAA#!jE92C`%dtD~l$LG|#t}aDpX>o->kkI@-ZJJFS!NR5RI}kaKCk+~AmH
zVsM#BCa3zqio6{XIg}&K<XngCY&S4<Ycqc;r`j87O!gqsJmSimLR*Yp2xUjr{6c#$
zX+hxb?TDc<1MKj7X@K;on{~LKY)u@QGKXy?32><U9-;lB!s#iy31+pUl704*q@TDh
zs2KK?B;Z)K+S~kH6@A<p8cnl1Gh;X6mo9R)c+-Qv0o%zXY;o;q6f1T;i8#1Rh6Pz^
zEsngvzX@G&HVBsn2S^~qr}C>d!?J$Fb-sTV4=cpDn4XF5_v)D@9|fthcwmCt<XntT
z?iB;1>hb|d9J_;HWsc*9*`R#(yZNlhhtTYz&-zFqqs3Un_+MB8?Yl$=U6&3nag1KD
z1O$S?6XIfvV*p8j9EqKJj1cjvK!uq`RkpdWfm5=>4qwmi`*~<EQaq(F!l24M>>Xd6
z1qx0J_>Yo3u-KpRbx{s;_T^9bjRKS5gtN%Zd<(Jq;Lmjf43#{_+rUs>^HuSIqK~e;
zU!i3>etGLVC#CX5P^eFotMWA3QNVP~DpSHJp>{!=w<s8!UywYgySlu;!!DQFquO?}
z`(9!pLB!Cgr|s|T0WnJXe-aOQQ8P!?uW1FGbTk;(D=Dg9k4S48uScA!>e`)*ekhu5
z-k_LqU*-!ejj2@0+_6S~x?}n%1NyfK-p?Pg5weG0@K@oM5#<9k;=DLKZ);90;|4h^
z_7il49<3s}b9wxV9h5u(g4Qacb$MS{$Aci<3)U8+ENmu7Z5BxSCMC>Shm0~nQ{&PK
z7bPOXrxlDcREXH)53-_nbLC_|N-tEeGpfu*7<jV0ZZ!^bcEzm;EZz6>({M6q9g5k0
zAl>kH*6L4FuLCLnwP;dc%Jx{P{h9yi<MU^cD<2XM#*~l;`syU+0%r!Xk5k@96sV_!
zPggyvHxo=kRmH%sYl>~hD878Gg^n1}LQy+pO1~?r_#XADAFqp%mYHNdVs5m!cjV{W
z@V9G;+x_p)bhA9Z`=99z_X%rR6=AG#AJKJXEGL9<Gd>|_#a;Kj8d}w@#dz#&+-g&d
zS``cytN0LeM4FJ)mFi=Ae?u@B&G@@i!=z$amff!l>b#pEQWIP!S+(d8aQ$DYi?YGE
zfGR12D^px4VWBsg#4^qjE+Hbi3LgQVw34=bZ30*%cc^1@yFudp58`6Li)JbnNeEyL
z9H+J0-6n+BVC{k|{dikNfGz&YQ#PvsZZfS$H=BbsxWx8sqQltP{B$R{_2<Fp@<n!H
zDz{KGT0nfkk0px;RXzN1kHj3$(f1jyWRN%?h*Y;G7?I>-aqzeoWWM{?`sFXYEdP2|
z4G969I?a1LcD$~N1obQMh-HA;V;Ull*5>w|A5i<B79#NM!*PD7ni7qcnzQ2v5wq3@
zv)O%OZb?v3@07MmXlyKqty7(e&?#QL)k#y^sWj=DKyMrso0^h`En7?bFVRok5*2B*
zjIcMx5C~~)-k$Blgedn@CK6>rb4GRb`ns_(^iN6s4~oj~7pmkJT+OdPw9hv(q;Fa4
zo!g<`V8X=0of0^>8JfAJw=gWd*C@<n8-)@;rldZhEqu&yX90z$;uV%BhK1^%XMW8W
zyK_#*Ti?9n`p&2CcGPY5Li0s!5&t?qO_ZG_ee<LPc4-Ci&>`+D|Hh~1rxh8YvMDLU
zS_IX}AqeGWZeL>#X_4#EqI^+M@RV>cM4#3UARb5)bbc1p@%qAOA}(^B8E<!?X@$?S
zEt<3%l)8<hR`A7$B3Rjiz@o)ISr$$X5;RwVFT39ROI-S6lRyi&&Nl@8v{&I}nK2+&
zRo<in_2Yp%;;eT|SK=2MK`qFda$tf4_3#0?gbsnpAD$Ot=XoMOP{JaYZB&}?1PELu
zc*f)rA))}L%xfbpkhfyQujuYFvn&wXJ*IAq;AFQO!Hb&rlqDEzwKmL0dbe8DhJ2vK
zEm~|1p%)3Q#jmXfb&EGIpPyxX9_cJ~3&57TOq5%ldb$}U|LdJ|jlAF)T(bk4cT@}*
zgk)d(U7)}K(?TBrRJ@q7z(saG@mO||@ak5xh()Z0Gm2_aj*4e23$CfSdCyXnc{i|?
z(7D}G&|jLkDUFHDml|#QSCN7rAX4aV7s~NDs0J#sV~k$-63YDYWvCInl)j?3)mU1{
zexr)#7lzyIbY1djdc%mA|KK3FhF`20^G%e{j<oJ=xM7pPYSb}Z51E<T4BJ&ks)mEd
zsO+bMqvn7xhMj0y5ZRX)0YZg#?eq8QKVK|e&;egrZ040_v+~!!<Qrxh@uB3t;fcPG
zooT3<!7D!Ly+tojOlMK@aR9+RFM0=(>gs3tRQV2>CsOW6_N(X?dmv%I1l4XY`wp2M
zrhfSg?)8`Omf>+B3Rsq4m&n33J+W3ke?}V_BaO{DP(J~tf{bL!<0E4F?BdnRN6+Zd
zAdj|3P+zN$2Os$Aghj%AjTrns0>OnO@L@>woBFV|D0Ko-YtApt9l;1?4b!r5uu4jx
zVDVJgvYOFeN60|H()uIVJcT;UohSxxNKo5b3Zt)1xD<l_+SoROfnXpYFSYYuS9+Du
ze{Jc}YS<t(Ffrz2y{g=&jaX*BTAENjDBk6@uv`q@6VQQ8XK^jw_2^k2GM82;oS5ne
ze3xc=u<H`dt|xU@*IM8Rq8n3f6Mg)uBd#ynvfzp%-?eu486DLTW|^G&iS9YmRPp?F
z36iK0zC9k@MiMP=)EdBg7Nf-ZfrW2vCf(~b{r8a4PlfwlhG|DhJB}z!J(<;sj3GNI
zQ+d7xq*&g@KK&7rAiX;%$ogzv2j;3XqC-CtDQ6|M=8|9qTg!c+M`DiC=A4BL)X=yi
zT#8@D9pS{2UgOLmeFTQS5|H%XZ(H+sg|~20?RI|f9=?y8gEVaKZlS0#{zAf2C(u8w
z^BNiz(686HnASAivwi$CYWBBln9`*>(i>XXT<J?uzBH%c@R7s=t<{V{nXj4=#G8*w
zOOvn@w#ra!?pi?~#AoXIY1tYx;<ZMbW&J3*93{POs>E*KLzSgYsvMSqv{nODxw0r<
zYZb2k#GQP+_i)dYzIR0@3#}B$iZ@!s*HUYLWqRQEjQg<WyT15d!F2U}aQVs+_Y;eM
z<@Ng4v%Fb{lbHcSZvJCS<*`^o&d9gYpIMpsvAOs4d|Elu0oF8yGVK%Y{m_neuB!-?
znPA&M!Y5@TZ1Pi|SB3|y%o-0ZZQhlGS+$ss6I)nIb%<F!y-RAVtfK?O=t&q#Tb($G
z?ILPMvppj<{q74Z90u_uBHKfmrHp~JAw|%bOJAlJ9Vr-q7ZXV>XwEMcg=qWNr}7q)
z#;Jz*D*U+}**j8IG9GeRtkVS9Z2)2cDI<o{Qpr4b7n995DE0GB7L194;8Vk#>qQ5p
zwM0$;59_p9=q?ePsdtFaI}9jSY+w8S9ntGCd?G`?T*EnqBw)LnkW=`b3mjwcVkS|3
z5?`?ChYOlU39j`Q4SOjIS}OmCxJGtUPfRLyZ$kSXuTH8A<*2StUa9*0XB;Ke0JwPA
zOE7e;?Vsr&??O>Ri#6k&0Yo0+OhQWS+EBAWmZWwc!f7p+{)g2&q{{RYVJ3tO3N;2$
zr|yxsgT8Tqa<PaVh*MctZZ1xpqSgS1e)PU{!ZOlKL1Sn|Z^lh2^Qwqa4VqtQJm0b-
z2*2LK7ngF3U)ODtYIghJO{pG`47^}VV80MD!FTMovwf#I?1N&#f3EcJg`cbpv&J+d
z_vTy431*Mi&{g=L)M88(jodXJty}r7n$F+QQD+?nd;GxviPi({+6d618PTSJD65)4
zUb*(MHo~i8K?5OsV<`}nOJX+hScQ~Fgzq*u{<wAJu4x%bkX1}L-dGC>V$33a^d9~E
zK}l(nvxj~ImW|BeUms3@JM8a%5iqkHOkwZ*GK0Ts!&a*Yp+j<US4>j(7<&g55*Ob-
ze8)yQUoy`+W1W8OVVt=%*h?+6Em=8YFFN?d3+AIb!XOZP)brP-?r*Q@4bqG1g!)${
z$p+`?P1Pq@E{|4Cp^;{m`p$QkrXM!4Hc|T3i=lQF6HGf)!Sj!UMbNT8=}3yO*Oy{Y
z|F`b|<UK=JE`6@#I|;5&tjbpBY$OH(IFxT+j~-x;0-qdIkJp8(ckFwW|4&My^wep}
zZRzS}t@I}E*v0sh^B;-0zX!>F&daOuzuY^IP}foigkB>q!w`PrI2s&2RN6xjIqOxl
zmVjMad{u#AJ-4h^V)&wX-ouDk_q`oP*Y3GT+~|Dv1|KJmO#yQQuPPT#bz79d!GC`p
z=(3O^;q=>{l1HFyIqLv!@c&Iul8pT9Mbst;-T(3ws5%of@K`jc2>4Z(dU04d1o04*
zq$wY6pFx7eAtCeoyDMt@yCz=14~OzYm5W&p|C_#l&$w{~u`BL;db5s-M|ccsBlIm<
zjWE``6PL5AbwQ_CK>5;>!qyovR=UeghT>LbAWDt_DulC!Txo<duEPDT!uq9(BAM48
z{-e|e#K|GDQm19GQ>S-15BFvUWoSmAdhFiTdVbICIy$X6o5(D)xeGwVS$Gx#E>{!*
zaR*zx<grk&?%`wR&tXmzUa+X>Ms0>to$8%}oHdfMoU=D414+;S^YQN`5PC0z5*p-w
zp>;m2Ke2+y#<rHyTjiJP4XI_`QA=`PWXiH;im85pV!fydLHiWS(xHvX?P9y!MsHUB
zC-G4K10p^-`I=<<pI;b+{{UgD;}@alt$hC8JnPVfG*-l=;`oz-R?({VFT0%n^xCIl
z+7WX@KCcZZ6`}jW!IEv@J(IB99tfd-l>uL0!mIi4y}|9;`bzxpl<mL0Xg_~UBezuZ
zGpJgP>z4Z9_c5yXuulor_CY$iz*T2j4;szyHXlB08wO5NCbvXWk%Z;R+U8Vm?8Pmb
z;Wu`pqjtFbL4Q+uM2_gVK97R_33>gE#1DMT0M3A-pc!J|O2Vq07Y--XcS`i@>Pe!?
z^3rJkzluGszcmmiIaD7tQ1`RjPknw@7l#L@knr87^bYl?TGhfZE*Z4Jg5r3a?)#;|
z9CP^CQ7CD2{(p#lGPH2ytlL@*_PZw+Rz<NEhwu6yXE#_ESr!|t<@Ot3RHHD>&j`ve
ziSGe<bCAv{e(j}3Xa58=bBIZ*#2vL1u^ug7%A8MY_jTs7A`u{7XP3VHH##mKWLV@|
zgMjbN*d~YoRov4xS?p=aW7UZWpYxlQZ=-yjBxpp4g!p+RO6|wVFTOiX{doufcg_EX
z;KIn`zTf-4z_UCv7eGiO?<mi}N)#CbvURWB6CdPpQ@=X`@~MU%b|@M--$@vigN-~^
zwJJQ=2OL~DHDGT|ujQn*^Y=D`*a<dkIl>!}&8^_#;CGQ$26o4i`F*-Whg97<R!U!i
zVj3HE$#f^*X8Ts#x43z-g9dMCQO<~4@cZSZ<2mDhe6&{(7hOFe$Eo1k?n51`>J{Y2
zT0`dVWVZ+6YVJS1Z>SRLvik(bjy02sUN8#k6hXjbhvMg~7#?U#ECvu1sS8d61DUbK
zPV@Qc4@X9rzW0L(#_3#TN2fn?{2%?^uNey-@urwF?U4lAK8eAPth0_=16tr!WSr6J
z<FL{xTtR9XyU>r;Lly?G2?N?+-c2`^CaGMw5(HMI9(6D`=6`TPg)A3)8|L+CUwk)|
zJdc)qV60%}2X?9dXxm@s_on*iy+|XGMa0rSOetVkM+D9!BlYyT>TmhS`cJ)QveDs3
z8yp9aGs|>XqUFXP+uE`*WC$gIO+$K+<2*}q?Ia1M5O%W#^o--_gbRRW|N4VT^NwqB
z;iLTwoyl^3o>aAe*q{6)5zAA|@P2k5ko|TK<zg*9)F0@j`@1<I!8p#$51M)MuaFB7
z$lNP+KbX%&g0{$f%*sf-uH4^kee={5T)Mz01D>L0RyZ~jT(tjOf5oK#Vt4=Tp9C`i
zbKLW0^DsPBJCCsGI@DP$uq-HyE4?M>*%Ns?w2UnH;XNGQ3Cto5{bb^`4&=Rs%&Sa%
zY%)#;%#KeYrH`ElM4>{5NqyPEWa@-wWU)7?3{7Sj{ObLxj_UEO{+n(th%?9#D(AN#
z^vl76<Lnp(oyho(D#9YITWlVL4En3I5(9vgV%UmcQ222$Xf0v?PLyPIhd*hquC<9}
z&fd+a;k<fF4e~0Rw>}ij?Q{tGkZSJ-Joj97$-90b4~8nxFFuR-<a~$WjCbUSXzoF;
zISx!E1G`QMs|`ETnt@>ZUd+Y)y<EG{Let?4-l;x%aVl7>`I*~BKA|YLLBXTV*@Tjq
zIJ5&P=^GiHC=%+z9RDh$DsLiU8Qg7Be4?M~)2(#_fH%-%x;pFa6#tp;R^G_!9Jbew
z%5)tL*bJC@r8l!+I`3YRmJ;%vAaf_R6lPaf0NdG_L*OPV&Ain@Ikg9&bB|69XydDB
zgSF^;9P-X^ic-IRqGxQ>yCWAwROIKS><;JO>R?$t&EK!zp`W<e?hGlMv{S>`tug<N
zZOU`0A^PdFb*O#yqTFG3d9r-*Cv37wq!Zf4XX`KbpwXB`<Fv>ql<meUJX#L11|-Ho
z9j_P8r*Xa?_o$n>(`C03aSgC!RuA)C{QX<n5+j^&jeFXVsjouSU8sljK*Iw*rhkGD
zZh#=8Fj(zKLP9sybe+gwuHm?D=Uv@*RnDL%4Z8>#L?!EMXu7Yn*!lS>xZ-qB20wL2
zrh(97+RFwrl+>VleO~Iv8F3VGIL{|tv8~|Q8~aO(=Rdx~g^ybAj6ywZbxn@5TZ%j&
zw+@zFB1dLOQN<Dx5G+P;Zc%4uB~+l-1ScR~*1~UWyM9^P<WLxuy}Z0lekL>I!~s2S
zzHGAFmVnQmjx8uz?|phhUm;+%$^EMv9B|R~VJ2h{fpjNJ2~Igp_RJN|o(k0NoVcul
ziBF~yns??}THsM<-;KR(Wy1eb`<F9nOy36Vs4n>6)#lHegt2A^L&y-bn>_*!f~X)J
z=ZDbesnQBhZxxB4$bz?$#>UL2R(KDz=Jy~G51F$K>05Ltl+!Seo&+VnzhZs4b?-LF
z><+gkRRg8!Q(2J3-Gk~c3CkuCcrlnRF}p>o*L#qe+s-Z>x;irnvq$u|cN*B~7^+Gb
z==_{Lz1Otn#u_jP`Y#(4b*e9?y=TwP;LSUv%*}AL=wZNP!XUIi!qZ{gq$aW%@B7(Z
zVCw0vYqycOvmZlD6qD}BOY1v)ekfwSEb4z*J)^8)eV^g%6tEj>-j%`nR&B=9ge}iJ
zE8_|KL<5i%T6sPZK_QqD#{-XgN_yDByAlkU^6NSoZ0JEtOG`cWxa4-&smy7g*}TmB
zo}bS5ZHv9Nzr>`B0^EEW!~UBt(~oe#z7^SinQ~;x2tOg^U#%u6UzPsmG!awds=fq{
za?;^GTud-mLSPNL+y7@ZF>E1@Z^}dfCL7ezoZjVRyvHN2D|Wo&LZD<z$;4+z*<0nz
zl`iSk!OpBeoQzaH4Ap`heic`tSLxGOJ+5HIt#?^~x4ds>xUqb?xRE*2PK>eD^*z4X
zOr4uX8znPW?zs4zD!Ay=SKf_-bmG@KP#EjUX6Ak~U>mBp!Tr=XaA3}67Gpo|(`DEE
z)S)g8)pv~E4l_)bHx*50YE-YPcWWIm>0nKWGToUA1VL=aOLnUHe1vN~5~iEKXl4Qa
zaA#bpyJa!WG!C`&5-(&@^ks?h{LowsL}SwjvQ_)(?UFsU-Gkx5h_jV4E1jL__B6Vs
z?n5YX+C3K_YBe&+y-b_wgGdQO_I3hRlV+2_%qP3V4FptBPx~h02DqODcg4ZrE?#5q
z)%xOf(Ljow?~@L}Ekwr###?yORTh|Wc4_h_`d)E6I{`<*LubnkEwLTy9K(NQM6Zlp
zNRn7-A6VS?yPq2i;+E2arH6uAjh2*_xtF66HK;FL28V9&;#j<CVWfJ>F{sqqg`FzM
zJ#3)8Pd@$GEp2GPUO}Ij-H8DOTj*QsIgC)SSkD|_PZQZQ%w|LdJ~l8N)|ts!|3PTN
z|Ebr$;c%&{U?oO)nRx4X4xR&*dVZ6uxatw6a}18JuHwz@v!(Uo!YU7H(xC1mu~9b5
zKE!lffsQ#p8vAg%*;1d1nr)a24%-#_mXJfRlkjzHUX!7VPe$SdgEvd$vb+|o$%t)0
z;9|AZ#CUzqC!sgGcxrsan6CZMwb-^8y1v>(AX)bUUA6AvnoAu_{FM7-0S^xag)&e_
zVVbs^Qyl6IyT7_r+BGLNoS0YbH8TW5Q%~Ybc7tqkN)cxmm$}$;NL~nyxU(nbl#l2-
z!{m?Yz`h$7<qe1%7x;0g5`fj3JA3=9^SVcnW)`J7{5xuWXlTn=qKmu6R#zmQFT(H?
z-qq~X?!#`_evbJ9@VN6Fk7xOmOm}|FoHy+(B7M0G9Jdh7j8KfWCm?HRQCAmdrel1|
z_T#T`&(*7!g}z+Q@<Ua8G+G6YN5W*+b?Pwp&)*;C!HbJ|2XT3btDyG?AcNjfftKFN
zf;-`HqkQ(}3Ur{7aJ1vQa?uMtVnCsr`*cIGQiJv9wkMN0nSkI)4<zAQ>bOi-Ng4i)
zM!jA$_4{DBreiJmWGUkO2E+M+#SkV+a+?fQYnHt;gocOC-j|MbFGxR1D9gO<BMY95
zTq5wXM8bp8W@~K3M0|gd@#t-4Fp8w#kJ@P>hOunU%<I&B?Klh{QoA<U@M5`S?@mFG
z!c5<i&d?!sOJ-Hg)JNr<>(MVlIravj)*r$=HTm`{8|u|{9X3lJ68g@yjfK6Da-Wvq
zcZW?qKS?w5WiayEjC8z5@v1$-h;7Qbo!O)-bp5reC_Q4{W8623-?t~OrKeKLpxdM6
zqG-B$-G3SJLd55k3lZs;%S-C(xIr*C&t;F#-p0^t59ngt7<RL%pbu(7ziQTcLF`|h
z1umb9xB0G>K?$i)$lU}Z=erl`jkz(4)LZ8!mA5xA>4s}dAOGqKgyp=vd0_XzFQTs>
zsQ1#ag){)3QMbl*&&IymIwFsYG@*mci`2<Vnbm?Q=iViBBA&``iZqt1T<rT4d`^j}
z5iSpDpTI&p^X0h}6^-?^vX{q<*k6u+;boMzUFn^4AlRVzd@>jwMyJ62ZKh^BPp=(z
zG<B1NEy2kAYl-{RyMxiEg3Y4!Fm2MZ*0;(*H+A&Iw`6ZooA-3~ZS&rnT6x`Ap#vrT
z^kPhHPC3|zIaOckJc-k$sLoy@->eV5K{ejNlOpxv3ATje{;S>@^&YD>*gPA$rK6oe
zJ5~a-UxQa1OrLbC-gSI6P{zTwuFcy7OC#7E&ZpWpJ%|3WL6V+~eN=VO*@<Ys&Q~p-
zCVo=vp@yGu3N)mFzsQhCe{7d*fgQ<EyU#xFay){?G!I+kj4U{||F%b$eO-cyBhZD%
z6=QmQ8;8;GKytO?=NP#9b`0*UcV9Is8QsE8eBvW^(1ifbk2;p<*(Im3`=}@3r|YuR
zmjd;<^v<UqpfCJc3CYT^1Ng0F<RD+RaA&*OH@ULd^xqI%$^As6>PJk7Cd7jmun55>
zt8?$K4x#dpi9Ud~J4A<f&-%1f@0`$t)#NQDFcuVGeG3;iAbY_XK|l}V2@;D)wI;_S
z<cXCq=#-=BTIVt{Tezhesaa=oA(btvXn^_{VK()agKs_o#kk|{a%ENb@P>XKDbvHT
z__}A4kE|8o+2W{YMUWMrkIC3zw}cd5?!Rm}-;`^yYLMXa#s3zYK^*Yv2=Hpn^7M02
zy@yeUSu5?iefJ$z*;wp7B~~NAqjfdScg8-%!@ECKP+Z5}o!&AVaJX58NGFey#174k
zXA$Ago}4+Lov8N*quC0IBqT!T8X$*nOy}1fYHy+nOH@36Y<`_{(3ztD{?+D3$;`1?
zOMD8F+!q6ln|6>dp}A<F_#fa$&@{MXCw^cLI!Q_4?Pm09XRGj*3!w(N=&ZyEI;^3>
z>(Og;OT&*A$ENciTAl)79pfRMuDH;l?S}323${3g3nsaFj2>v5e%c&D+zUyeT-N<_
zZkrguGwrQq5<rk)hy*l+_X008g-PK})j8C`*Lbvjo%!*!?AKxspI~*3fJE~=!q+7E
zb};=T;%Gh!1~dfp|BhC7Dk^9jm+!?9=Nuo^c?56My4fZkjAsE#m~<qkjP#aL-S;)F
z>kJ6{-r)XPY-g9rS}c3Zi<wHBs=d92n>AsI5ytHU$uo2YB<uR<uNFB$3_eFCuJO#<
z13aRJ3BGAmnwaQddi)qfsx}LK!>Ghu1;*d+ULVba-@O1XG7|X1mB^&BC5jr?<#zSD
z<;37#_stov?e{xn&{G~-_Z_2EiCqgSHb&2hE@ZF{^hKGu#qM4g&&`>1aY?C;W2#w-
z??1lOG&?E6?$nCF6eRRBufSKxF1D-R83*sIJpoO8nLT*+^z(O79zfqhx5W1i@yyO{
z8+HV@xW-4-i#<h#-R-6I-K@|V3Vv(kwAvPkU=BH<k-kDC`g1vl75865$se>E)B-|z
zm-`N}Q6K72?;i@lk3pYvmoj3U=a}Om<u_Xr&n~O|fz4YJ`LxEaE9wZKV!)iDR})*G
z@r2=JM9RQ*3bn14R+>V37~X&*49Y7m?XA9r9t$DFU&$6OxnEc`!Bw9Y5EwWQRIdhf
z^8T0%v{M2K{+ZPl8_+j7+wURm%D~^eIJedcc-0$<Kl?$n60?}bg-?$8=x)h)ZZ(Q{
zZCIu^o}SmUr|v*y2o=wEWQLHq`yaMF+V<0A4wLxas|T<%FN>Y8V6>V6J|>@bY1E8*
zTRFDZe$I-oVL;>S^~|atm0b?RFE;D#CJwvacb$9bB$k}5naoyQ_sqVTaGfD?ej9r3
z`V3Tw4dYzi=c~PCUv=D6vZvIQYsNaRXM2IL_%}Uxi5#INEj@c38P-1Oc2qYw7Fe@g
zRkZV=bnlK?i=WSK!76^{6;1vn8)2&NWBX^c-^Xoc=TGKJ3ySE~&JP({fOjTq^>3l9
zfen~IOog0{k6|s!4zF*;`PETPvwTu|Ag>*FNA>kYa=^=QU1eGY#HUu>tv#^L=D3Oi
z-M6>urh>4Oy$?MG&W@!tpcZ!jq)&T-y^t+ApJ(^q_v4}LhX8rvb<r6|yOg!%)YBTr
zFJlelPpBnDxT$1HPx86W=+Aci8Xh>&+U?Xiz*v3IAz3Y#5#k)(K0h{hcI1wNW6pn!
z19yJqmcLErinRO2+8jIk2{)~C|K&LhgP#noJ0^PW$Pa6CAqa9(+|inQ&vDBo_H|*_
zkrue9p22PEt7;r%@t`3{_=%sQ*g-hMHLY}SaO&Z5K}%jVb92HOI$&<y>1anwy@A5_
zY*HEM*`y2?>bCtmOoBH>i4qJ(pOA3AngWV3%Y;izbC1Vn4F!E?puI#Et;ERkLk676
zS#K>d^g&EBxIG<231{FAuG?uYoBN^Y!$ZfaX|yVe9<!WR!yuregfO3N;@2{WQ$Lf1
zJWZ<zI@Az4YEI_lJJqV_BkNbwe=52!w%Jz+@bMBGWB7VGf-TfOX&sIkkfD~Fyr0{;
zkQJ%GdHPn`>>w#%asNvs0-*EnT1f-=N*ly^2o<Zd&P=IAcM>?_nr}pANrn#7#6gkR
zvW}w6OJ$d=iFR9^ETS<<T~5TEALNIqESJ75XZ9E@KBiy%#>-H;&`;}pwkov^l#wsC
zVEiIfq$&HZmGrJtRZb=Vbz!=*X(51E3bKf4>r*T2I82dArRhCuK@LTe`Ur-uh<OyB
z`F$X`q0C+S>|0CE1PwCM9a)1Lbc2CDh?s`HuMbwBn*V*KPsD#y46{0ci6pkPD0i5a
zLsttZ^9bLmJwr{}QSMC+HBkDUdMRK=qZ{l5N9o#Qj?TepWna^1(|=V~*WG=ItUF0F
z+_t$Zc!*IvxDbrZ_>`5-E?Ba8_`&G_PDmoe%egZCtJXRF`Y03R>z~lpRSy5Hvlq7W
zt)X+tHpO>ok8Nws+pb5F?uMngkhu)V4?w8fS#F^dUUpSsr>bL>J*-NmszXfZsk}L=
z`=y0ZY1IPrp<4DQt^9adMO@;ZCim=Fv`x44FFgdK;@(K3F?-6T3v771`En^v^a^eO
z#e{axg+2aO=hrx_)90c%Kv-NpNzXuZ7#03ytVuM5F0}4KMcuLsNtm2w=lAGM{fr}<
zwQX^v(=STBq&SzA4yqlvYV+D{Okdc*b+rgq#;<eX+3GKSyK!u0E3Ao|M$=1^BH+h2
z9+#gzNc?9Q|1eK0*Z$Q!jl3vX?cjD5*_V6I4noZcWnjGS^YdDJKJ<1;Oa1NYycvT}
zXgy*NybqIR(|%j)g|K-iLFTM}Nv>1-JgkfNA%j6y{q`wBR&m?n910uL!7N22&8;9(
z>FjHtlVWcK6r=Z4{sEW;so=hUN<?v5mVOqNp1+*u<=~k&Me+>1rP7@E0NPymwzP{X
z=3+S3%1P`}3c(W&jUH5^2gXH^HUTvr-s8pa;_|LU@Zwyrylu6w>sNjGm&A9_`4-FR
zF6L5|u+zkg1<4q>S0;!&UkmsD+1vL|oVMf(>2D@%gj_|M67NO6kOjnl2(K^K+*+7Z
zqn|M7Y)g}Nd7j(?5>9Ndn%9>3{D^*}$A#lJ3pU3k6fRGgtRYLIP?F^JHyPcuKKl1<
zDTxyS#}quE%mZArlcB}xz{m{VP-^*)Q275~YJYQlLeQz8bnL-n*T)A&<--PkMFTHw
zB)}T4_{dqZ$zq_G)fioz5>voO?VT$wuE*m09@^g~W^c59nwWiHkQr+I&#7l5SzfN+
zrve$&`&-O@fN@yl8nW<;l(3GxaKa($J7M8`K3wIDxQ~Sd5S25>kn)I!h1or{*j8u2
z3zolF+KyKRUA~W{W%lPJDiwwItlJpXVL2cAd5Z7lF}Fzn*qUUBpBGM)?IPgTeRIA&
zxwm(klOcYPQrUd{FOlpw$lAXbUnpNj>0m|mRLkZA;2d%on#HFYXVE>`=5BhGf3s8m
zF0VR^p8Z5yR~ooSlY!xw1;?fROII`Nyt4(-E57(;(^5dMWMWpvU!*C#>JlwD0te;_
ze3>uu{PQGDny=ECzgT$}+;U|Z0d2i~RXvgaowpr{uk)087+6%rxP%-;R=L*ay`If)
z-4S>7N0vL*$MI$GKMsA2Wl1>J;V$#}yAR9m58V%s{Y0H&mFjRdAQ)<qDqj9P0<GnH
z5|$N7niW}D{^21+;VHVCIZB#M_3`fK+`AIhoTb`mXM}DfCs_L0N6?-VIKI7<LnZtX
zL|O{>W#{3ZPpfIC^3!#ldWdw}VfmJTNeh7q0`@(}y@d^od3BwaQ0BNp{VhjCpE*uA
znZH%v3^nE9bSXrJ_Ma!hr^&y1f0E6=kUM8_09wO}`uX<_nbk@jBT}F5+;OwkhU!)g
z+p-SezFo9Kxrikf&{f}2v&MZoUu^>sxvsmwO0TIa%t8VHE{EDNK3+FQEa>Cmk0DYR
z@1`qMuY>7*@`fU+L4|ZJ_$?uwAzhIRE9D`-s2E=&xtL4s9GE2pf(z`aJ+2`^9vy4Q
z#LFcZdtOpT&!q^e7!br_w7_JgUw-*(O=$1XKTHQR`0y97S>+E${m;Y%jRxu5EC{D#
zyjru=2NQ@HFZIMZIRh?$cFrWZUO?GbfUK@Q`v5MAF#zI($C?d<hxhw+Go0|-8g`si
zUIJ{EsUq^jec@mQX=joEaMTC2Y#luc@sOMNOOA795iWt$Eh~Zw(pz4DXeT&ln*9mD
z$f_b}HNI~W-UQqGRAtFP`YjQ+wcmox5coNK4|EuKvKOCwx%0j@2IM5pC%l%wPy2rw
z0^J~&EenZXhYv~&FjzcpUl>Xg9~836(#p9%QnU9kHoH%r_BVdI&jmj{Q(#|P$79i~
z*k@`zdHC54vIjUP6P(>R51xpeaNh^a0-g5IEg>V#o+PMM8(x^T^}F(<0O8*(=(IY9
zo5uid-X^8}+*^ZATx{&i*BYBqMQ2wgb8W02J4s1;R6Kn=>GpGt{m1n!b`5O3A(rJ<
zR_}Q>4=kp2jhqYo8_RsqAP(<T%Wg@)NMtp0_{-S6)Pu(p`2`@W+D=ZHQag8iv=+_;
zh<w-NGa9{uhkbsD!kG4M5(wob>k~0R$-$EfNmhL7W?H5S+sl*o7|B&N>WMR@H!Knk
zZz@{cwEiVnR*%Gx;{Mzq)m#64bFb__Bk~`&vBVOv<PJe`+||Kmi3}?F-5<NZ%n~JX
zi&aF@=$Ljj{&Q}IHDUb}61%|6CmyG~{;qy4KS$^Z_84-~L1N*;%o%u7C8Z;|(X&2e
zoF|Ow?Aldd(~g$RFLDTxoWKu7E`g!{YD8D@h5KqHet8$+H5^K1ytc`e;6KNSzlE-g
zY<pKO<Fl74;FZU0cc1_$jlvgrW%RQT)HlDgQbuZH+4rr0BNI}7J2HWN_t>XrBrP@U
z@n7iTWKKF{Z%rvEE@8vk*qIreBAgOPvmg;B$%=G_ogH=T>srXM9#cmov-|%d=6T;t
zO5;~O?bUPkrxs8G0v1LV7SiVArYjzoHD!k{KZ}!>cN%t5NSo!i7vv3@&p<bGglC=I
zbTZS?p1MnlOM!a@C+QLaInFb7n_S6<=j%UaeC_ic9FExPviDQ_mN)Yy+}2X_9V!zc
zr#Z!cX`X*;q+MzJmlDR_+b9*pMm?Oa&-eSNc%ZF<wXxFPt>C$v*oJY@d;)tbfCR(n
zXHao_X`chFqT+oZA<f5$5S+r~WQ!<I{gHxd-_IY*6m7TsUCg$os=<C|C;g|5$9P{B
z>kArQxRLx90cphrx1T**ad3IH3~RA}_P$6-W<+<w`WhECUWe+PkFRxkv@_>#1(nM(
z@!DKbtfvL->KAyS3K`X4YYS$r&qqJ9AqteuMjfSIe^*HP@g-oc00IRMq(MmnNne%5
zs7rI&SIwb5%1))ZrA_`>A^!2o{O`he8D9uW?Oz<S#9{b0o{O>n&H%le9iVww+96jY
z^uROgRxWs^#@8jFNF?-V@tN9jqL$t0GM3A1Q5#|dE^0zfl=Bom;%BA4&UNJ}rPYw_
zPrURPfR`@A4HMznP4vR<#RLa`ZUw_R8C*bS1gO@0X%{JL{3gKAoW5<#^dH`u-(H^*
zE!;cB5wZ@k8p;T~Y0X!BSmym|fG7qs{oM^u-wHVXC<Zu#*}Bd;GiI<oHij0G-$M%?
z^q>}0Hyllf#I4p;Nf|OFD}4~S+m#SrM)3v#iZB>9CW=9b(c>CWo9&eb!HmoG<zQII
z1oLhy|Csq{I##3lm^in9X>hX9WtslXC$iPG5XBR7$Ggq{uDdW!V7h%8t(qmnG?A&;
z$(JTnt#6ss{i`wFped$bi8K&AKOn+-O=k_!s?i{ToVV=Y;fWJ#dvsk+Fb?UceXTk9
znLp95?)%E$+S+f~y#mwp*IxSwHqBG4b<VM$(@|SwO4rrDZ+5a^PFLz(&c67#_BP?h
z2g%n%>D-roY5MnisYc|o6`(kPT)6AA!mMHkxo*mZt9__^S)rz%BczE6X)NzlRQ6Rl
zys+0F(mkXeN<e@BcYP@4i=v8&Ex#xmm^HI)$HpXGW4DzfzK5Jy^9i^d6Bq0yk{Ma1
zCSCNn>(;OK`olalhoS7mIfAhY(+6$~U!uWo6T@m{e4eg%bHPOa5PW`*LMv`K)j>%P
z3Rv{g0*k^#j_G^9PWY41odR7~WvjgIIUTM|!RpRi`QQDC&3K%=vvje!qf3W3k#+pM
zg^x($#gxHzQPK+cMDlQ2t+g=Y_{Zg?!#o-Mxjm$PHob|Xci5fsiD}z7`D{W)>b0SV
zAwxdmIW@=#&t;htImr2Oa9JhMX1)XTX2Z!MpJc@D`+o=-|3lzpw@EF}G^#&-N_2l~
zlT}U9#g+shabx!ro^`i)AE@>SK1n@L-=d61)GlbG5Az^d>CJe@WUgCaGkpMWES^K~
zS{@X?DzNhSdT7%7ww1D%;NT3_q}R|T&%_uo@&<n}XD$j;9xpx}`0k{zT`1Ql!Ye2z
z_z-jWspNYq!{<q41m?W{xChh1V6Q&8GJfXThmauJDg2KGBgudTi%;){pM@-aX?fc8
zkrHbLNFd5ubz_c_<i51=!Q#A7AXr_wGVN~byBAA`Nin1?5GODCrR?ZIWNM2J?-Rno
z1cULmb|yOwnnrca2=QNi_EU1yxt+Sp7*P<wXP=)v?y2xTKx1E&sK2|g6#XF`H9cCa
zSH{Nu-JQmWUF7$T{`)iFPtV+c67+||em&rQH6TX)o5Q~E8YPya=(S-F;IJR_<TLwv
zV!P!{W!Q0chd}S)s1P@NAB(vjgDnK#rC?)JxQDuvPl+I78h#WT8AB`s&v<Wt9BG2J
zP4!xQ0^#{}?1|TN1kl_#)3LP|V^0f?$j_MdscO8d>O~?RTbC<%S9dX?<m}%)RjB~`
z%fGMmf0=8B4Onl9tNd!j3VbD&EFjy$y8Bb;-Hqo(uDzX*y&>zU+QJcCJLj8T{f7J4
z13frtfizDwf4No!*q45fVl@7CH%qwXzA;bE2;2UR7%nLDz!MscUWzBW(ocRRu$N*B
z=S<Rt^V_9KqJ(*u*ViOpFUvq=miiD3><FJncPh=?TW*M6^}^=!7=A8C+V}kU=`b8=
zRpZWBPMEjfOzKZhgzV$La@sLgzj4}km?!3A?DeYS!2qXSFJSI>PW$6RRJp*WIy$q6
z;<cV^=@iI@nIcw6mAjdn#>^-s_c2l1vh=93#!@7JOh~+$5Heg~G7^6bPY!8}I2;A9
z^S6oI&_FJ1zeOVISB4DVw*P6(`}YI{(5`4NA1DZ^tRk?N#85>C?c7gX2Gz3zl+G6-
zO?^1x!&IkD3lr?9mCv<dk$S=KC;9AN<$P9EVFTWq?1A=F-r;veMuRN9bl<m<Sy&}?
zUC##0oa`R7#i^$l-&m&}%5B>LIE0IH{jL3YM8^e1h<pF#(a)xF(_jBkv0Q02DGtm2
z+1dl}Z8jCB{gIJQKVnhL&*nU|R3Yo46o!xvb$zhdZ<1}UT>F^UE=Vl2W-W%?zp@US
zujz7HTra@1Iq>h{n600fK*%r80LTOvX8}y-_~rb57C;0T^*pBkjw1bg+-i+*c%|FE
zsF&9WwM@0;A%E{Iw_3}d1lCq9<+;|vh(79o>+W1Zj_)-tXNS!wF6IaJ|IwPSKyj0S
zvq5g1lBRtWJ?yhy&qD6SMyf6=FcCC{e8m0brSuuZsMI?!Sr^xs-qdQBG&ghMEuUMs
z&%#19^te1-xbq?HaY@t~dG4Wn$$zQ)0Js7-d6uMD!EeLvv}_c+XvUnngt|BmVCnzx
z_MTBqZu{Qo5>areR4GamY0`=GmZ*p*RYY1Sk)R@7dJPdldQp*%fb`yb3kU&ehTa9F
z2c!f-3k2?iYp-*3pS^s~d+!)`3_nCZkik>t{Lfzn>HzSu|EdEh4Fg&3y_B3;nl*KJ
z6*J7?R~fABQ(f0U5jmmAI^+5|Tw8le_wM`0`@fOr-fa8vP4|(imunv$-w|ESA@n(<
zqv-uHXP~`rDD9%aWHWEsNlZC!GwaC3qs!D^<8?$FXo4cOipruG=Q$|%={lJk;+79O
z$cuib5zFCx5OEY^zZP=DyBeWWA-diBBputg`A{&<V)TcOyPR|S?c-p`6tlzLrc&`-
z1|tBGB>{?L=9QQejI5ugwsc$T&tFNLp9vk{^CQJ%o^4FQ5Udy4`^YV=R5@OdVha97
z4!AcZ)R#?XVwy2AJg602aK5QP|CQFg_A`(2?|)6fY*Skgni0PY@Sy(VdH-+WTMqlx
zulBmVknujC5Wp#n-fZDPHT!3HnZPH#>mbIYci6$Ffwk_P(HE~%TK<huCD!1J{FI8j
zauW|X)3av;O&22lqm<kpR(@8r{LPal;%z~mEDc|Zs{2<Vz<A|e&y8)7C<$d1R_NxO
zjM)`>X<V^RhB#0Nuo43l0`TbSD|K7W>dLK@ht)mJ1=gJ8(|lBHez5qI$h{o#IIX%r
zX)+l-nNJD<JRTUv2`!kP6ap+%ofHB{o)iL{Iw=HjtPi~`BKnL{4z$Dg;vRuJd2yF*
z{L01R60B|Ui*dE$3T)t!gGf@#Ka9i4P?A2OUKXcPZ{Nq}Z(bk8Ec6O8^(hFr16#&y
zr<2;yOmkLKj8yD$4q78g+#-@=7^WR8wH-Ljie>QQkW?!YfiT*+Z}jtk5c1gu0rfIe
z$s+S<m@9u=KbtfZp;bI4wRQ86^;pHSB@4XNo?)B#(LV4V0~36M+UJOa`=YBCiq_}W
z>&EU;DGoEh_x{uJ{nO{~I;0kTY_ylnBW?omXA$xy`FPA+=SshlM&#YNn%9ZS28<+@
zHURXcScQHR(mdDhV5fr^>fwos@`Ng|hH7(EcWmLe2=1$owx#pzsdM9U6bucv1IwM*
zPfcD}v$Z`_`PyI9Ugw`4)kd59$xy(f{?uhTX-vg{U}l^o)!O%HzjdB?`w^NK7$zRP
zDSvZDj&t_yJP5BH;uOS{bmwutX`-uyhVjB>jy;_r%<f6D$i+?%tICGLkUzABuMFS$
zE>t1=!O3Mmk?@~nz`#-9!Rfy`0(f;@fR2E?ij$52Gr@y*1@SdpxtH{uM7Xk;OO+km
zZulBX@UX{J%Z1G_?u(%N%~<?y8tMyUbV<{NJ393a09>jeU@MaP(~#5Z+J<w{^Hp`T
z!Pu`SzTKM|RE%=2FD_h3gRtW7C=UPo_V1l@ZXgYkk=L>!EM=69d{+s?HCH#xJYqX3
z4;Y&pODtkc6ShkDBd9n=>HN~{V$<~$k`Vn)1E4*CqAAL$j2uPc8!nfVO$gD)D8Ob}
z@{=BpxCh_-`hqC8Gen{6<R5nBl7ioMXgyx&oGy@gCE`7Ht}C$~*%ea^%YE&zz)Z!V
z6lOKQ-i2Ez{SurS2Cg6<w?#?gHlx`_N8d>-!Z!PK&w7+PUGy$CZ9@a?fb^+%Lv7x^
z!F|IZHM`<>Uoiqf5W&@+jk~Y5<?u=&Swu4q%)ey><7vE&G>`8<B9DSv`KW>8@MW$U
zD;x5PfFh_WEI5`U_T_bn>OWDfT`MN)()QGPUi0v-jP_gdLs^LwjWHgtW1Gb^DBzo*
zt$kL;arc<UE{4#+S>X{L3EPn?;}v4)SK~>+vJFI4<}FM={7YwRYjV?RI6jTN_!%!-
z9i!dKyau`hy^RaA#e@!OSchfcX^X}45BkeHXS|d01mNm>8x6&W#cFmK@y?k!jdh0p
z#n7Nmb;R{65}T{xj1Z^i3H#_#yHRsWI@1Pb`w3rHoPLDq79k(>?4ePf(GXRo;pP(o
zWJ&|`ERZC6a?jgHzesHf7B417%xWbOUgYUD<S~aFA50zS2pH}?AJw%q8_3cGc^$Hr
z3-Qmig~wBE$4k%?zcu@}Z6&%qmfL8omwn$EeC-Q(kp*Nql(07z8Qsbe{{9H%cub@W
zahS6AnsAv)f`5L)Zntc1);1rFV2=`TE1|pL#i~=F$C|5K7$ncV223fK0Ly}EnKj~;
zQ9gY2mq*XL;a+mK<FQo%L>W-RPb9D|%xQIMrkVFCWx**@wZV9e5Rk_Gp0S1~kej`o
z<i%j-fnl<a>;mY#X})KfH8lOI>eX`_E7mZHn<dK4n7d{77wC8(K$WR=hz|&(XL(sm
zizyv*C2x%2rnX(4^pG353L^3GyAXgn-V50q+7G|<YW=16>6sAWt{^TX6AP-r@jmW5
z2%(qYg#BK1h+myqO%(M<*UX37p<^i-JXoS8mk}$&yW#WU!)<;3l4WDZe%hh95(l2P
zd|d%+asSx>Q67dAoXceW)#Zq*AuOKXeO<TG9cK7>AdCh~+Z?*8`+rGFZ<3MH3&gNx
zCTuQL&1?!gQE49xz>W#g)1%Y}qZk`LVTDI`-;`Z7y!%kgU-D&=L1_(@!`5pc920uD
zq%@3{cbU?x(k+Bu=BYbMtJ(|_UNo6MvaTfZEntvEjHso6X!JRrgy*-aRNGj78uq;#
z)F0pMJor&<AtAB;p#iUEc!f5&r$vkAW5r5RNP0CNB_WfL_q3sJBO-}s>bzYaAQ>-!
zGpYnXHTELBCO2>_5mvs+5R5aiz+E(F)g?*(W9y{d0&@xnQi3Iy*=<@FnQgbH63TKk
zlIq4%FKx}0Y>Rm}Ih{6rOt8s=X%gyh_g7?8Exc+YF{z?gXfdkH195*BEmOO-x3(@E
ztea4&JK-@Kq<3J2RWqGm3?g3;(y%=b_~qA{V0l5n?}6{dG!=WLAGu^|6AR~)_8YKj
zX02O&OvV$V`_Xv6VW(k)WQA4lx+h^O7I6(&Y1Y^`#-|SD)MbeiQcKASvmgDB#&XDA
zNZ4EsnPwG*J<Ts<=LRbVvj(pe5RLPo<tf@$Yc~VrUaYa(Z4XWb1bV0kZDEcxt7gNd
z(77;#A+__@@+q}_zZRy+7s^0Khs0X_Zoy3c6EBD349*7-B3=u(#6j8Sag2S%DDSRn
z=-A6JGmNU{vZ>wHb-TPPdsPHbhjLCNUV;J3{48<(_(AaJQ0&F;HF)CtP!?J6P`*K~
ziGTj&<eJFmh+n{?9?28S$j!IO{6x)^KLx>#YL4nNOR1Xh0PX!N*eHwO<b{}u|1SL?
z{;Tw3)|2Jv)1@rXebAYHjA@LSLsx{am+^bGX<d_<m|=FTX`C+XC~R3&*MZn)F!{cC
zoAXpbpzHU7a`bq;u(XH0s`QH|Rw|H-1`=EOg<o7dV{*ANSZ>^?*RN~nRy3ruThzw1
zYOcriS$NGfq*sPY<_#U+t@NKjZgqUUePN*zdc0Avi;i0yYH2%~Jw_`g5$=7Le`--D
zL`<Lhaf~RZnP#{@oC&-B!G2jEEgZu)jKYOxrg`|8p}C?xuN@In*#gdle+l2MU-!Yr
zd9T9Z^H*9GR{UDCdedbssUtJhzw&&Qm%Szg$Tw&GR#0rVvg<~;lIR9L@NxC|S<$4U
zU8(7pKC?Z|6v7WfnWg#sGG(o)KNQx@s1$?GMKT!geXJtxqO5b@BUY)TzHRfgeQ-Gf
zZUdq~yJdSAA#A*zV>*-PxV|NO{4L3J4BS6!2KjpQ%z2)~>nsKMi81qswE*x=m1K*C
zO~c0<Ev7%cZ$QsPDQR3`$VfUKLn=B9OP^o3W;kifzOxznW=UD)s$hyxMoYCTzjwtY
zO`7o7HXucu^exyS<_>&$$wXa4cPKM4-~Zg<-X}%e!LgeRw<^;W9wRA^$^8%2Ae)XJ
zbr;Yxd!xfnLI2h>s6+;(dNXCi<F`B=yB8|U_l_J<8)>7>rX3U1f*DHcjLh4X20=}k
zNH3j)BUowhVh^qJ_l6F7MZ(_Wg|1PM$tPC3t?<I&e1rb+q5IdX39?fG=wP<>S=rqk
z;9yJO^Cn~Syc#8_f(npbE*Gqj5+Rnp(Pi0>+xtdY7<7?IqNT!m{8jF039AVze@?q1
zdIi^`d10@Ihc3Y@Y!bGU%$4sfn+bZ=_HJ?slj@UZV-122H~lMGTU%!+87^MDh#sRq
z#agEFc)1J<a#?G_hAzV@E;q|J9=@_ugdZa{gu=cxD{*R8aUFYp>xwPy+dW)|?<Dm3
zcZ803Q?hhzRoni;@yOp#-tQpC#`W>0o0ia#4mV`|gn~z|Fxhj&yk-uHQX<RLnDNY;
zo4e&^D)6{v`R$F+syxQ|hjO5<Z<tv(@hgyRP=5a;Bdr4QP;M_CYJBiku7Z`LaeVZ=
z4NOb!lKk>lt(ng*Yb=roxTe3y^s;|p9kyw@dnTJKG~_kXidgY5@#V^OFON|zwEy5&
z&)%8Mfw)YjKL4R|PyW?{^++%|b|ZqjHNb8^T*XZvwX7OfrprEYwd-?~FjB(x2XR=G
zN?P^l+biUO-h>0@!~CV$HVyL0wfWO%dyfU6J8Chly*ju5XrX)ib#h*#8k6MN@Vu%|
zkDo819zUuZ-#NG8|5fyhl%!4FH!|y>rF6=-vOM*%#9q$U=z=5HxwmAqEQ=_~BYC2I
z^8RWd{TUmzPbF(q3w%Mr!VO}q235&bW2uVCWWO#%E+-37r+`@Nz%|anOtae0B?zJF
z^YXN6w4v|B@oq~hmXQnDZcuD`w!x5TVD5lIc44i?mfYOut^1-}cM;|V?d3+Uf@iV8
z6ls;O^gpMzTmnjR-|<S5X<04P+qGB<I>^XL<I`;1J}j@4f05&HkbRhRSi#CIvh_Ok
z{3$8n+Kn&eAm_p;5^FGQbkS?tPRqabsPKxe^q|Gz2-|RLlwZck@#odz+{6iH1;2|S
z_e=evXBnm{g<SnYSuf=#&LNwL<2r@LvEXlrXTiv^ZepCU7mlB>+k}t-whSAtM&Zb{
zy=H5>zWZkHSLC7#GMb)sC1~&T#=ZeBg;KJYZmW?9yM7BcMG+TT^vzK6U<X`uus@7D
zad&4oZRNFkNPEO?nD>1#<46Q$lG_57QPSr23nL{n9as|hlEhbBmpJXOCZZ8KaxoPC
zB}HIVdnx}?QuR?s;$?@k<=M4g$v=l)^&~HT_)$OPo6_}X6u?<ohtk2VP9k*%s$mm|
z&Ncu{VV35xfGJF?GAnmGByiAE2{`p^i+G<*DeP_Q)TX<WLVvKmX&K|9w8?Vk8LyB)
zV}y*E3yF<o)2C--N~aEY-??I?$ER+O_Z10#6+Tq0TT|#asJke)yM%i!(#_IF{K|^-
zG_gzK-j&+)wy!(q{Jpp^+`NAWyRNjm4=fKgv5gp{mqVA^<PjDc7pTZp;8wMmC_58l
z8YT?hySR7@7}+Cs$7HLXrSMo03Hb9U$D|i#F7&%C#?Fyfc8~TGU5^jGgoh))zuNSf
zMh;e@=u!8kOeZ%AG;FN^+**lFY35j|O6Uo;kL%QWSjY&mpDb=Iq9EFJvt5zpwfmP}
z&b@>Sr;eE8Rc}8kC!~r!K$kWE=tCXY<0dQ}eDJv7HGAE{U8-yR!Q@f*R7hB9W-_04
zX<z)?{^lmKA2>T&Kp)jQXBwKk7@xtq;#Q_K6KEndmAh=U?cc$5qyF)Vu0*R~wA|%P
zq>YZ4)fl~k(uE*12AiNHFK0WoT0nVhDo3alx5Im6(C^DYRgcb8LKylf$B$b3zC!eL
z1|SEy4k^VAyvuz|%_~uoE#eGv^uTmz+NU{W<WW#u%wBMht)zwQRJ}}~*hF*nQsC>8
zQDmf?a^dSq44cfU0;ei$tL03-t%t6g@UXFiQ-brDG!Cb6XqKnOrrtXKF&eh>dL(9z
zdhJ~5!dDmK$1Dwxt?uF7JEKN5trhsdLb+<(T~ZQ=3&u1Wv5lGu5uJh_-nP40!|y&?
zVm8ykk4g|W?_D%|b&#;H$mueSTrtpXDaGc)e?2>YzYRdIB~S56Hlov%pEpw#Q>@{8
z=}#Bnv|C*t^`nkn7(sn>a&p-M%<^qivIZdik2HU9L;NfJItQr@o^$-Z11bH7iYYk@
z<WU;0N6OxPR>}qYKMuVBxyyeFDoyQME&*$+gL7RGZ7mcJDfjaN7gpznxp!lm*O1fS
z#OmYqX5W2~Spuf8J_Cq~Y?s}{bgpbdVM3k?T*P+8W;}&0z9S&<^6*7AJwyJc__p#9
zOl5+RifdA6el8RAFg*!1_rt^plwMw7mb$*Y?04za3zs2tVM$wZj%PZ5epp41!&pwO
zonBCP2bW=nz}~!C87(P_!DEzJa6d?RzMf`HX?4&G|DOS`C!|1JV3ih<HD1!zc*1=p
z|M25(9{y^|)x2xd*XnL$gjcmFpl+Pa*8-Krw3rNKVPxR#xe`vDB*I>SdNeNOtfBA4
zuVmWjC*Kw3N_2z5LG#yx3%Fc(-+;Y22S{k<6gT+omgzI}BszhB%^{O9-%SyXi-RT~
zJfXQ!;vEV$q_Cm+yNH=~A5cLEFZbcoMRKc9KT@a+VzK&)#Iix3o0ZGmjSTzzR{euu
zaWShkVI`dO$qp}d%6Ei7m^`qB9Lszf+9q|K9sd>Ptvz=Nn;1Ekf>*jj50Al^{-CjV
zn;6-Un(zENn574l4^#_E)^ZTj&4A)m8faC6#t&l_x8$QFA3V7Si{aEXR`uubyJ*qh
za>HNShBMqG%!v^fr)AvQvXKRT!D!0-Aikg)08XwmI%A_F)sQQFo(SpDHOHZbL&V19
z|Ag01ev-^X4#3R`_)eqS$Et=vcM^fG%AQyrqTwH*kdoJ;cdqJT&gI2F#f~~EowOeb
zR_puEZ!c|So!!a-hON&@!^62lEsju>Bc)?dnbT$O*W)(Is4q*$wlKT9Uo8F!2^^6>
z`BFom%2G7exF5p5tTK%Luu|A<B6tRxP!}8gCRgcIev46HQ3!~F?<V1;^x^&rre!%4
zcCLZs{i4Z-$+ORl#mjkEt}-N#=Y}V_8c0&<jpOf3)NgAQ=V2$kcrO4!{Sse3>;EI3
zUrXk_AnDsH?eMiko){6W4T5_>0dGER^z>LRUUwB{9mjWh#==J6<~=TUZj;C;>GGEA
z(qufK$DjR^{Fz_f?u1@Q?nsw|HtSgiJiUl3+ixfns_w)Mu*I?3o5(1b&lMUe|M3yu
zkPrLbm!SUZbMW&lP!G&m7fntgkJ7D`8Ka`IK?dA@(MI~6o&`_&!Vk-Gyw}>Hp@ZDI
zZ+}?EVEd0$iu+*Mp&;(4Oo0oQH}?PRPdmIKdY=tK`TBlJ+L#nLpIzPZxqfP0wgEnH
zSV6TRiZL{@a)HpGz!>uDmia4^z<2KZLxP!1gyV>zz(N*afVv@c!OVudHu4sYgE{EE
z8EatU^(np%sA_QtU9NO1qhNfC9#A!9JvbcSW?qw5rmH>WLhjS`&wnZR1Flo`Sc6Ca
zEZ@mF8oi6y2{k`X*W4ObzNKdxSV?2HrEuRo<EgRbBl5>IzPMgpu=OkPJTq08B^MRH
z@pk+D3#Nh1gF_lB|5*+8uZ#MFqiGAnYd8+B4MEb;_ELDQWvnJ*;ZM_RlGeuO#WK?X
zmEpaVeEWOf&&2o|5<1emsd(&k5%$+MDs*Au76t4495mX$uG2rSPBAw#e~=~o+Ztk;
zVm&tf5G@<?jDeIeG2K?i*^-~Sn#XJQ<Le9)Ly`>3+!+^b=`&5-SP&AK-6g!67J{aP
z$m9)eEy!!S>PkWf`Gen8&B*{P=tuj(6H2i@8>wT!hKS6xvXYUcx&O!A_gsvB;Bkw%
zph5nVvgR!+mEdqGI^f&~j5QoQ;XqmQcHV!LHRlVzBK~T8`?obg=GqD03fOXOSCYzy
zgxQ$BiAhofzX<~QQwgMEm|qF{z2q;BaSG8F<&<yfZEIT~1r;h?uw}?S>)?i9;j0do
zYr(x?%gs4igPJyVe>uth`nZLi6GO2Z0?f$`=k%k%XJgvi>5IxpL5igFWhv}zGXe;T
z77hi{)_ZBPuP&GBtFAn{XM0AJ=cAtV85K()6Dk5$-1W9LgV6AQXwc*Pfy*Yyp0qWm
zMXsv;XlpL3J85f{2rRU}epB$A>q%R)WE*qCq2|BZn#~dwKy5M$8~px<Wi4w~#P`2z
z(tb>$O}%uVSepA+TQloPTXS%8B_k(gih#G(oz@tsg$>b#_H{y}#tLI+nIFi@{*<=m
z!^$NG#2tfeeU#{S`|qScCxpqp$_Z^erUI{vfAk?09V`9FhP;GPFj$0M`9f>v6L%;5
znS#m9r>8rbp#qp&YVfqOh)f~*yl<KUTPNu{<~ac5;5PqpUK3Cp*!PZETorlR@%~B*
zi^VSozMmH*V$dIP9DX+K@fAy<F^>1@5y6y#T9l^dsbzB?xiktKGECmmvROWbD#%+D
zg}I@#z3d~M2I?fd(51#JpA9OMZ^fLENhSdby2^Q>frZdiX>{&YyP&4FTN}Je4P@wa
zEId(XpOe!vtTXb=Ee|aL(7=^x%E;4-))jDc&=|ec*iX}F@>LPLnL80bKRruqq-jPe
zvdhm-pKI#7dY%aCPBoB7^9Nc2wgcOuSK<J6*7T&YnI3|`CY5!(T`9~#*Aepi|HZ{z
z2RXFNQJ%RR5z_!%krv}2_{&f4Bfyq_Br|$KHPq1-vt6f)O9@c_k-P~-1Tu@6{2zA_
z;G${MJXbjevTIbO#gzzaK*k#Fkn*u=Lme1_e`KDPZLm~W_L{wH;cgKr)Ym{2Ev1^6
zQ2r_vY`H|Mq5`bdI;Mm73O414b>QK9k8?04k>^nsITUu*gFHjOSxO(1lv8EtAm2Y5
z{Xodv>5KZ&!CWk+{Uv_)ye3`d1$G97TSK?$H{OIOMYZ+lf`)jbJZZek!`x;@<=kS;
zLZ%J$AycRA+=yZV>&0JB-XhiC?F}qfuOdo}h@koJ0Id`^ID}Dz0T?H&&q=HDNhC=w
zMFwf4sgAjjhTogc1x`}Y=r&De4z>(eLS8df0RPJTeo!)A(e1M3aYu9;gI&Xo+anYI
z7={Xvowt&K67G4923fqurgIKbVpul;uPdgDEwG5N^!NmS({QglgE82x>?PQXHRKv!
zV@!G7Jb&jRm6g6y@CN_Qz0V342|1V;fXEQ%_9M$p_cDL|yWaQ{px^n<2_daT;5)c!
z8hNuze?VCME5NS`ym^zWK-Js~v>_*^UFwCl?nn5cWvuTw>|r}c%IqI-6ov=XiEe8*
z=l^Fy?yr5L?EVQx|GfY}P!=oj!#az3mwdT;t~GX0S&ZM<Z-2WRsBJfImgs*-UdtFi
z03{53FCg%i|CX^G;}J=o2Pme6*xma*!@y>zjV&DGkK+$-%{HKU60E-S8cp-euJoR1
z`JSH`X5M!D+6JHB3dbX=o6EG#sZP+;&|+ihhn0qq-QkBx%)hzyK-O{8O+f-j%`@BO
zqyZ(<r<mtiWg)oSq#7<@KP3?{!rX*}Yd&1KfA17UuIru0hkSlXZs+Ropzd5@q|$aQ
zpn}8-+IIYIcT-J9kaX+bO@6v|gJ3phS%6aRR76J36Y1f?r)Z4KxyI~W|CN=)o5IN|
z8V+RDox6ru5D9D<=xt6&Ech!c=O-HUm)-j1xiXcXkSvO(a^dBq@6_^i5l7G~+MeC(
zf9i;wmwuFfuQR5Fq)D&6J(d3&X^5Wu!wl+ZeT5Kv-bBWQjYV8d+$;B(p=_`zJS!=Q
z45`&=33=Bx#6@~na+OJRHWc&`n~d+yS$UU$;A*dU9-w`iHHc@Xt=Oh<rlCY|{fAll
z-?rKxv$q-0pYazClp;HnsdVM(a@68ds@Z0;X31SsLLW5U%_339-F!J}TW_Z4KENn1
zOJ<M(daCHfh-b<ngg!%k17pJreGGKH22BEUn(#kQ;&$FA`0z?N1xwA8M@h3JGP^&l
ztW)1U<v%YSJN}lScnyh_Aqi;0*b-i-S`ljTp(`-B$a^VTv)Pb@!GBtEiae;E1B(QU
zy>1`G0XQNEm^BL5mmgl_yej#Mb3*y`(6vKybU+!SS8JI&=N>SuD#dHs<?~dwz~Q)v
zB)PIK>eRz*gMmT!*1;j3p`q8LuA)_tKbs;0eoJSwp6EMImbtSzu3~+O1CT8sZ6zB6
zj<GZeD6GEUqfN6=9>BTD(FHdgY`ik#dOfRZK=AzMS1&0!!YW?^`Y)<i?fEkM8IjS|
zIV%SW^ECNF5(R-HMpiB|D{Gtb+tU9*mVa_0q9qZ>hVwF9c~*!`Vi{0U=-wU{vs#@l
zVw@4U+j;G9lf7#u70qL(lN@vUkBssbs@%#~xX#b133JJX31fJQ;a!$bpC<m1LuSr`
z2>k<xd@na`bqjb2QXTboI$&jty32*_+9jSOl>R`PTrkXmGecu$A|U<hwE`iHFQ$6U
zP*1tB1kXIJi^PkXf?nOL&w){8h>3LBZ>23uGRL-1+HoM6@kXBQ_ooL16DMaeZzG?^
zJbg?s_TY<E`KW$r5(CHGkQ3h6j(}ZkeXGQ(<=Y(t;y2!Wr|Vpi*1gXW=IT}?X)sI$
z#0^_9yH2x%><6;w&t1j<l(7`PsM&O>$V6~q^VHP&p{*V^F#Ha9_19wA?|h`rkC1mz
z?}tX22xd<az9KtKi5;y>wbj%&uikq2rR=3Id0AP^JJ7-{Qf{`DO-6#7T|sQ)=gtKC
zK3znM37Xf|p00Q-dO4TXZVql3hKr;QyemBVzvqt46^fe;gpqtYLIvS2o*p)NUKS2w
z=}B+$&A%oU7|~N6K6y&*@X3ESbUxfV$fH1?o(JiUiUHd`GIU;6=q-B778`&Az|mM(
z0!#FVod=+WPWCpn0EQ%SX^FzAE2i9o=&`34?K-(MS~q$29^d=x+;CHzR9$*IFGkAl
z;o+hggq~kVKv-CMd!TeSj?IgQ6?us4Y=Fw9z8jIUIrN1_)8S@YL&FIKHAUn|(KnFU
zms7Y(6!EFQy_;rBtgV+pSAsNu!+vNdyy?~c8Jd`e{k*Li?}K9inH@m4^CVFpZ$V&z
znNf11e_n?0<mwaz3|i`-Sv|gAK2RN(EI@rbz(pUdnbTSR8pMfLB<W`3(;cGkXLYc?
zM5OMQb9nx~PwMiPNVs0QTWe6nQQ%c>h+F$dxoiVt6}eW!0wnzxyyAY3BL51gH7nJN
zeVTr9L74N|JNi@%Nvpe0G?2F(JIkAGmmLw}X8lqcn21_4%e&Z*O2TBINi}GhuUe`J
zi665u?#o3C`D%bZiMhcWSXDUXZU5g>%JHoKPASWL{=cD=_d&&f$!Q)bOe2qX-%8=q
z`e#?}U-+)<vC%~K%1r4y1FEXJ&dQS}QbT^#>inmt*UFt-Pw!PP>a@j)=NbrjHZx6K
zf)Lv;;uaxO+IzZ%U~ri1&P80Pt!KGn!dVoGSPAf%>BqLnrt`+kZEVM9&wqL~JM{B}
zi=jOc4Yw|Yrhrm(H?3@TdN0+ODhAsG7IUxD2EPdg3bwaGKm>R5XsMaN{@}tKOhO3b
z!by&_MqQqL!A5S(E9IcryW^CNa8|Cg>#cs;dMQF))^XtC77)h$zZAF+Hh)pz+IYk?
zPS<#2Z9WHV^D9Gg)yCsy;?A?4_x%RFK<)Ciq&21p(<5=_TP+GDU~D&OY_}fD4__@!
zmkf<e;=dMCD_1Wl0E($5Ll*O$9ljXw&Gc*=A(Ajvsk4o8UYqcl4Mid?Lf9nPb@HK?
zhYcOH1)zA>W7#Z?CxD%PmDFpu7S<L&>G-TmZTM6da?dt@*^Xz!GF+ZL@%WHI$;ik^
z!1&O0!nK(azP+rS4|gEDJ$K51GKdYxp}`8y$<OB7B3ve%c2}{=fy0+fB)g2GJpaxD
znA~W_KU;p|`t=-7>r$`jc{?0X;7j4<fSd`;M2lj;EazE2u&ulAlEDYEdU3_!NC}(T
zRbAY{6p>qa){BhPFWvHLnCwv~Zm`f3e1xk%9=m1_r0#+^5s;^*tzp4VD?=6|Cb^ZB
zvKKag6@%m1NxE&xQ$-hQ(n&cFmsO7M_;W^qK1Bmb+sm0YAH(~UM+W79sBQCfkCHIA
z5S`+I=p^?R(F`!9sp@Q<mpL~=`wcTGdtJx97@mwbK{Ua<#v&VARQw!%P9&)bUHpmk
zkYYS&=y`slj#g5+8=|#>m9tTtI{a&Sg=_6DmzhQwFIiZKHCDFdX=wxEgRNg>NHr8b
z#?H|nk6sx!Y}BT9G2XUf-Y($HU*K6Ya36PVwji!sd3+{H7ETDZOgH)Xw-`(kD1R`S
zK!+^?mkIfLIWrA8Y5imSU|}zMs$x3fI7=Bp?%@u|p#V8dBGz{}=@Ot)2@&@C){kq~
zI0S-#rj%yokM{~+$JEN_I2GC~_1yma^sJ^^$ACEqz8A39m3hqJ<=9_t_oaG0fB`i}
zhnp8hNPu11c}$N_Qv@kc#OiWhk+y$yfk{Rn@C*Me6YN;oN)IIj_Q18xP*zUqbRDQT
zk%q~xh1%^JA)jk4)nhZ*TKSFb9AB(&x!EE$R6oebZ%UT(^M8+Divw=}vIXt?J&*<Q
z!r-JMd`1UV_%B<3GKS{4mx5kRikLF-OxDBWE=3;m82NN$iR3D6VhHu5>yl+c&C~oy
zulQFl3b;$(fbIe<)G2~qbjkBQdu4u7`5&LMCWU};?g8z?G?~SlC4NffGWqMWzD*;t
zJG18*(Cf#G*ccJ(=LwGA09%2}LTeT8#7=K<XsjW_v3=)9yQacLwB~v&%`kE<a8th7
zI=>F`Rank^XCvlD<viJNNP>ve^6<iOZHN?ct8@l`9A_lwpID@1fF(p0@*1@q?qiG?
zDKjPa_bxIVb9xlkLxUHI%RS%_K*dx^GmYZujD{F^dFZ0gW+3S|J9JrDBn^-2N2=@;
zti~$@y?~o|3DMF7wOSbx#I3-l-q~9T79gKLe}3KGdZY+URPm<+>`POBYTm%KBWJHL
zF$F^&QDLA4PNW&?Uo)vjk;7k@2KzJCm<~U>K82$=zcR^r?rp@#Si9G@1D(StslDlD
zfN1W%U(DgMq(C;Vws!6pWN7K~$-rf<(y|+Oq_3HT_&gF_rn}#<tM!@PTiX=+u85Jt
z`^b-rnh~w$KjcoQBWJp=7oMyVEc5xwP`~n?cD&)!7-*q;-Zydc*0Qcr3N5RMbt<7#
z*wDfN+z*<00P+jXJpS$9XlBoXX4it$z1620bZj~<TZ+M*#g>US_t>D7#H6YlcEh_-
zbX)#OVxYSrxpkoQy0R(93Y)K2$XFcp>ZV@{-@knyt9<be(~rIX`-M}JG+xJKV8aHj
zC_~Sx@t3E3;7<vFPChDqg?VSf!G3MI3{~yrz<!<oMSn(U6UXeIrziO;R^?9l8iUE#
z+OV*9Wn3v+!fNX3!@izt?=&tAQ)t>XrBY@h5t{{78{a7DQC4{qXHeulET0S&f%nY|
zoapLlBDbYFzDv|C*d6(4YXMk^KL7=NnF=;3fUnxCoxYP`y3DUL#%UTt&jPsjY#9OZ
zYL}QmD<MIwwGW~VGadSt+PyNHT5*RB{k(oB;&ufYosU&scmHP5y+CQwGv@r~xpe<a
zL+>Dc;gAumiYt?2hHiUnsSq#OteBIC!lY`bUT)Q#UpHhj-L>HDS=fq1tdX%wIz9h>
zoMRWMmERgpw6nG{e;z~(pJ1(BZtn&?8EK3WvvigA!XZ{(nT;&nDqe0Ul%P<~6so(P
zthkxzOj&jaL$udEWOjV2rUb=0xCj^<mTr*%qg8P2T8;eVhM#0)Zh?^jVg74_=nntE
zQiuv0z9J(+*4IE_BU$Mj^U)y(yfsAM?rsgmOhnS5Ax<?xO8N_;Q`X0llY70~1$VA~
zU%m$eK2XJ-e@V@u<XkgMAP{bouPuens7FZsEtdZ480VgNGoQc#7$LiqiL^%A@Ebf>
z3ZfQNV1JZs8=nPscnx|RFHv|VPV3<z{(hPQpFah^c)Z(xgUuwVKimKa*yXobJFf(h
zbzll<uW-iNUFTDKFFA*V++HXQ){a(`^LjbsW?WavGS0A34aX7}P|+<an9(Epu_!-l
ztk*ZQ87H>5$r<bEYNc>tU-LDowRMSST_Yn!CJGx2_EwWq^+hPQ(M4eGUScOf5#}-Q
zq3=Y~!@a(3S%V6zK#%o${xF%%a;(o(>!sT1=!X$J>nxP=hr_I+g9Jz9Mvr5X2-{7w
z+^|L>a$oCk{LFe_un^(izJ9rdzUO-FR0!;7GZWX<uYq3h>&Cr{ZYa6;nF)x8oX?%b
zrfZ}h#Emyh!6E}ch%Ua2sled(P&^Fnt3QuE!1F2Qy+9ec0$fG4OBc(=@tF4palGYO
z9Nm$i)+#IVit71W%DyzwJhv`<QJm_~Xwsq>n*XzmBLAX@&PC6>S=$$7A>uq-R1iu)
z<o5K5Dq@JbFlIoo)u4Y$(W?IDV`4{Z)%-i2Sv;mY$WLt?z7%i^_x+O^t{)>*U@ob$
zXd9x0tmF>!!VFx4DFwHqrgs+M1e4Sb6PM%1`kKez3%>-m5;C$>Y%dfVOi~RSZs=KA
z&$Xo^$6;&74$O8fowHNNv!d7}1KS{Aw3|9YJWc|r^yD^jt4TvPNcBEJ>L9`8z2&59
z^KS6U88D$&qs;*u`pxgsR(YY(m3Rpo)Y?bpiHjeAk%FEr5eV@!d_M+h6@+a0$2$4N
z=Dv2dACD@4-<}?(qtP|SrAw`rIh<$$G}s7|B2j`K5`fvOa6tu%2Ois1G~$a7870LX
z!n)!1cG*HKJ&5%eDC8!Lt1<Xudk<TBpfWN|5edW&fyOuytRYT$ZE467KZxtrGzUE!
z0xjZCnF`Z~+2ts9dTl1OJQ~s{_*8~UNlqwJ&hx>(>3SRDM&Wx^^#WLxsYiy?z&gQg
zvxvU`3UqTCvpA=+w)wTO%R&FD!(6(Cy6@x7EDdI&3AU-hW580K&H4B=W%S+J=HXT@
zS*H%5dZ8tVPH-KWr|OEYu+^!NVIJlJ#Z)>~TJs)HI5AEcML0E+(GM$cEZ7O|jC(H*
z(oFK0Dupn{PSQ*c%&30>S8Lh=bt1_yDn_yA4{%WhM^3jj*n%W|_aD?Me=N=1?VVb-
zV-qpl?*SVeoY2aQ!SsR_kmR6Piz7K5#VbGY&VYLTvDvYl^N5K*8fbcNh1ekt-0}V}
z`~zQ@<9$zjFXukbD7o6+7Fp<f&|R46CRMm!w&(NMy+C%Jt$}0>iUk}f{99_cP=|~?
zNLb4YI&>r49P+vmY9HA^^O@6I;K9cM!CmU7Aoz7<<_v(0*Wdq~3NB^@4R9pgF&c~x
zXC&lt`BTK#%oDn>A0<Telw=!q?{fZWWQ8q!g^e$WE|b-mEP89Jw9aJ9H*Aqm4jE|;
z9fS?`vVB<*1@1Fm$h%@vX0@F~Tw-&P&p?-UNzfaWi}~jHGqBIyL;ZvHqyvd59li3-
z^0jH#BXD>Tx;|Q`M8G$Dl`cg*?~IXdrODoOnrp=<AfNyuju_gSgWFw++Oj~lz;k?1
zR-9R4`;UA{<ZiHp`395+MK5PM@nxx%CNf$>-2#W9@b{D`Uz5Q$T`gdFJJnZE4xnMn
zW4;Kfae#>iA6jn={Rb%Q2NV5+tO;EOtTZRq^2Lc*!t;_om^rmi@1ss`oHoUoEUr`G
zqy~rk3o*^nkRUEebbu}kq08a=f?gZ5*ZiBLsF4pR()pTqjkLH~yc(9x_KS1N>)(17
z{-?F3AyDva`$<Cr(_0XCnDk+Yn`5NUyTz5If3Y`_4KvT(x@+<Yc~h|j^Xh#5b9qcf
zQfn+P?D7~lqW?GCGaXQwP#bhK8g&v1<50G@VD}>w21;)t@I=5wryajs(qdFUuaW?~
zSDg+IA{cpB=f2&B4sBeIa<jmF7KYi=*<KdSlq-|#h^SE%f*LT;-n>q<Jah?kW>|Cv
z6j=XYP+U?Z0bIT{T*A#MlJGwE?N<WeGFADI^iXA$^b=l(MoHZ>FVg&?!@y&ftspJp
z9N$X1oAqIkS^d!4N-HS`Q*VlU$*eSwp{ku{Ij@(Vg*BYApTz(`)U8WN7#^2mR<@|&
z$!`SUFiWF~JPGUhhksddjY6r&4BB}Df1Ci+q5xIV^U~nL!>eRyy_Z$N)De*C4uMm8
z#WWuJnc;gn>Yi497nSkoOy+?H0$ViR)Nf^T3!U<pPY}J6nDl>wes7kOj`cyt2ide9
zcE3f{;xQK6x;w8Dq1mXC%1=~K2M#@w{P$1kW<~bD>G4Y~m->N=%jWv8z{Pb!=lC%F
zm=%Xm(hNdCeaCAU5V2iVu}u4WXA_kCQ7%Ne^t(Dy%fnpdxNC*BO)rjbvHRe4R*+Uk
zrM>3=rTZn~Hx$5QvcDP=RHbWA8WYO59eSg|mZQ;*Uk3#B(;IVqcyG<eXvcL%u+No9
zpKI!xx4YE#*`GHNydpw6)8X#caP2xm)3|jEwK<PdOehSYlBoP;o%pYSiXR`esj>hc
z-G0D21u>%T!*WvhHqgdJ_p`U<VJUAboK-M6Jc%qd;7^ffg0}k|o6@8PL%r7y|D*zM
zKJaN+7JVj9i3kn+)?|?lgMKUg&G&KlfV^3H**px6-#2uCd-S-d9O$=$wN6OY^PF?b
zR4p4K8Tko3yozN}c1LL@#p+DG%wB{W68X#npI11pt*asiU;GHn`ls)(rg_fy6;jI&
zPyy9~#PUID{xc@$%E*gu_>NVmdfCq*;M#`!v5V}GPeQHS<xybq+FUQ?A4lMSc%ntT
zcg|gS?glt9+!hctc=3~=kdV6*w9t`iw;V+}ni7F9DfZQ$5a`nrY+&zp*f*#ruM7G{
zAg3dJLulD}{$c33X`XJ_fZ#BOSU$k>pYwVC9zk=s9sqXjg3)*a&vvigsOS|wLDLg_
zp*`kv=pU-XqCFVX_wU_k9=>emW2I(91${F!CJ{!cZY_6C0YV6i0+@Se{Egp|KF^bG
z0!FCkv9%#bu{&`qg?;wDu%~XQs*GE-Wi(H)wD(9T!eN2t^D19UMpTkq=dY@xN#9zs
ziwVDtVMG`Exv_fI$TC7GEgj2!XEu0wwj+IpDo+29b)C+w`zMcGBdN3X2@`Zrw`*I8
zMU{|h?3<2GLt2D-mMtah4f5SJH7-GC<<`YD3$sLmw?Urx@~C3ZIm~d{H)jRIZZ)P<
zDMf8PFB)x|nC-b<I%<*(wdWiy_wRAvt-gdgRi@7p;%cPUWGwPO^vLSx1OT&iKO@=C
zOGz2`2~9qv?(y?x<tz?_^7nF|4+WJkg>7Ts-i@u9mnJO5(g1=R5W+maPflEezh2C#
z(_O%>&lE?iM7(>peN(P$em^aiCbdCKcPNU1!3VEM2IpWr@Af|CQ_E+K8(fQz0VDIZ
zFxUL2>i#_bC%FJx2;Olw^#$iN@c!?(XYL+$?*)F29(ETl;)yyQV}JIr&!BUW`yXf-
z{kcKEOBxrdx#($CST|`EI+;NoNi~ATvCr~6bJWIl5b*!gw*~QY<P4s?m|ZKSKu=_u
zcG<%PC}TwR{Re-OF$2GnF)h>4)NKZhKqV4+)11x+&;E{1!@(c+#;D&cZ-CwMgo5Gy
z|3txj|MjHt^L<oJ{u8J%Fh8gR9`EZ$QT5Ab#+8ZXp5Hx5c>bGe`S^os5wbnLk<?b?
zSH5ZKuvx4w&Url-U0D6Yq4&#g{QKqn*AJ5wNMv&$I~7Oz`fT;|f>B%V)m{}clTP=4
z#PvrP1>ejSce@dU^_d1_fH4t8Dni}7!lrQ7M-T>oE}=~9weTT8Po;bJ<?kA#dM=+F
zopOPdS=vMUI4=u`YDirm@Xvm7lnUkQ=!4U|pmxM=&3zK~GCKXX=5=-!G$F5f(;e^j
z$j5C^m)T(svm!|o6B47oa?la*D)M)}ZO7Zm`wH`bxinsD=LDmH)d;N_BCRPbd3$E&
zx($5|<!P+A)|7pphS)tgHFJ95$s9X9hmP%`@&;Y99A&XPQ;gf-K%(PI!<RONV6Q=*
z!r$EcMp7A0K!qeCV^&~Lk%`<a;Tr;|qx7Q=)*fS^eCF6<)XXF@h4;K86$xjaa&kHq
zB1BIWN0R!fr6a(E1-y_Qzu0@_u!T<&1m!Q<uMzwD3;{H9wf=s+i@v$V^r??7T@(1m
zW$rVZ_nU!6u84Z`qye)Kn-0K|IUs16k2k1SRJr;o*B2fdm>v#G5wzpG+4&J?e$fu9
z&{?;cVbjZF4Afym;bJ<IaVrNDCL%woCjRZo`1`*(oJ9aEgH`P_=>=@pe?^W@U<_E(
z!bm44lxXNpIp1swP&0BFDwZ3+ro-rghf1Z#K4MKSu9$Nj=BO3Gjl38KO)nPOie_*@
zRzwCZHd#J#T{R*)b-j!Qc}xcux4l&8lPoRB?ccR%$nT}%k3XV6U-|WtWqjh&V0~59
zKMYPlx9CmVJGJkRM&A$s#K^DXzY!xNEdr0E!1P~;(Y|=~&w!DHN6V$u?J*5db~2#Q
zc>XWMi0ezA4!v^0?c_nfM~3@l=a%P0Hca;b@9pM`=YxMoE*Rba1GE=#>zF#?tQ-VE
zONeH?!1JZ$|LAlcWb5TiH`7^8TFQC;@oP3xIe0$41)P-$s1Eo;0w>Dc1bY(R&17m^
zV|gg;sFyw3)vtRJ#=zS8-(d_t;1}m&+_M+RORxAr{|m(`kjl_^vsUd`b?WkOM1OV5
z|2xs2W4@hQ%No44U*9EqJsV^Gp9NW~KQd)3@JfyylLL_4{P2bjEeVMaOo5z#aCFdI
z_=B*w<%(XWvw%~-bPGsFD<uTIQ)w6w+<Y6M<Tc;#K6IVOZmwA-M<Zc~q3Nj4iPYJ@
z(nm2Dl2Be?^IYt>O|{MbuW(WI#~ag4pyzMAP!lWTxU>Jhx+P!zMH`6pr&f2EEh5im
zbRciKLFi&1fs<F!1nalOh<i3N+2L`;(zm)+sGG;pIZcMfFn{H>Ym|0!b8R^}fWT6@
z$bHN5>&D^uq=)Qf8H)!OE)PlW^hI0}s@rfV9yZo;FG;fmXgRzBNvYX7o9MIe!^=<p
ze{wkkcvSQ<u+sIj{v8|fJbNw`P`iFD;c(*Yy7r|{$rW8jMGdGR%Z=O1qv+WLaW|Vr
z{z$r=kr33T!KS5x*esRUeH+d^mpPbVUlb<Zl_|-wZ?SR_07k{Q!%&ZtM(Ru~t;YK<
zowq>>t?liI+I2xRf~AF-n0(Gs2J}YwwZx@+J}_;`kA~3kGYq%MHpolrK+2`#`dnUE
zLU%JQqtT}!`uZ&i8{ZJ7`=;?TiI!35_M}PS3=9)p^asKNF{`<8HjvkHkJMIh>1;_q
zD_^Up^jy_B+)OEV+rqYiX;)f}UTq$`P4!&6-q9U|bn9OpSMRWM33dwxaEv@pTPAq>
zn_jV}zBJ?UE^0SluWF;Wq;Tj<mS!saa8KUCNT($n;P#d!tpy0p{*>X1^6QPR)7~B~
z*P|H}6A)iy;X`@SxN?5sP$gDgA`*Laz{a@PFn?IJ-T*<rVON+L=>HPdDSU8SK!5WI
z|C2+xJi}r+z)(czp*kU&p^-!lFosSO2aB~(^q9#nuLUCJ4+4i@LjXA2?*2=@`hg(s
z_Ra#vt%vOCn)I~T^H44@E4nCZq7P(F7hR(WMn8Z#bTk3mPsd7xE;MhmFG}rI0kc)m
zA5d$)-QLU?)iWC_CLD8IVTLr0K>lNMp?FIl&@(9k;gk;S^?q1+sHVvZ9hwslECu{P
zw-nB{Od&n*dafKQ{n_Nw*m%mWmEjrs9V#>o2CGSP-H8DUe5rACHuNGm<D4<E&G4_A
ztyME!{=qDiDz@7V+baicn{6wm*k&f^2Y7Q%tLtcW#Ox4%R7G5~T}x~PQ2Z&oZcMd(
zpQ@Dt?0ma!zfT$$8Nn8kA9@(`uMCnL_M*p4hf?$JCEMttk=bz@Ii^R1VH7DQYy{)w
ztmSq&<;JVDGv98!i<7B4bvO|>_&O$DSPs|HKcfTzHtp(zuut{wgB>R}O?0HLr!*!1
zt}Q@*0{o5-dQVZQPC#Ai+Z}-AmieXl==(KNzU?+ckM~FS_%(HKeO%N*Dz_iq$GlIB
zTS?4|J_0gt{E|Fr@;4U8c(=$KfvieGP`4#*AvC*|co9e{X?Xtd46c7TBk~fmKwY%8
z%x>t-`Q}Wpm&E5708BZBW<ue&WbkfkP!Ch#md`vr`!a+IV@{DOo5vSar?LTh8g<ir
zZ0OPn{(AMoFg&1YB}%;27vWdIOFl&;KE(xX?F4z)8d6&(3D%qE9U4+MP0VAhO#+*`
z<oANLK~*+4FR+P94HXUu+n41aD*!S#ytEI3nRMuz(@UKEUVBut-b$+>Hw2+v(E`>T
zAOLXcXkpQA3=qZKB4fEiDG$i@oT_N|s%EDch26iYnBD{UX((RL&}DTOKA1!I7eDRo
zKpB`@cyw2F!r@^8@(6-vaXAz+CN9qg6#?F8n+{1%fThra1ECFe>-8>lwp<RC!}0HK
z67c|lo*FL4yiUwK563To?0OYp0kGqRsH)W=*!<Ip^_PuBCe80&cs%sPsw9Q(qK*{=
zuSsS|7OnK{YDqYM-_xtK$@gQaaQCQfzN+zywDRT@$IFV(K1YF7XbxBblH0{(FHNaW
zS!Gb>)dt5MkW$@dnvMQ>F2GDP#=9NZ+?D{GK88~@LheYyAHl@Ml&tKsP7Fp7Wzc&x
zt(=W*K80y`Yu!99ypGM)*YvoKk3RRRxhavIj}w))V|3;B=T)>65r0R)oM8m`>1+SZ
zPk)3J1fh5H!!y}N8P!4w(%(Hf>YmoYYMf6P>e<XBqlpEQf}pCc9JARh7qvh(guP~P
zOyEJ(q{L(q6p}NZxsIxKJcD-DI9_9M8?ZcKg)Q7yET1xa?FG-UO&t^hWSD2sGOB0S
zRtEe5;6BSqE38Hz9^S^j*TMuTu_2@w7k64E6KS+E)@Y**Hv>n?%(dz^BMZY$tkL(A
ziO<C(Dh|_)8f=~uHaay^Ra}Oy@oA_@-wk1;X7Jkd!3vGJ;VQN!=``dTL{7ZX!3UO8
z(WIRUl(KTHRmYQ#NL&_U;#!%aV*`*VfUcb)dRJ|HqC^knAG)>c2zt{RBkd>L7S~O`
zjx9n3tAU3ueZ8sHbP6kK`lM#k=fD>Qh<u>vc93ano}=Kvbj<q#Mz^E$VF5`Ko<14B
zYGxY?ZvW9uJu56v^Zc@k|NEPNE42F_nzu)+B(!`qnK8{*wT$_XDLT!uOy{o$P-pp*
z#?bedoN6%&5#QUq_=X9|+I)o~WzQ2_9lX6)RJQ|2+59^qAMdmdv%#vadmTeG+I-Cw
zX4B4_waB7GC0o@lk70FMRSSZV)$=`7)5BXcS-Yx%E0E1Q`-$Hw=%<p_7!t)iTvcOb
zQ_%R&=X_GV1R*x#t9T41sQ=i~8OQAYDeS9mwfuNN{{b3fE7U?WnNhntS!;@$;R&KV
zJLaT5{Q-EK@pL4V;Jupy22ozr(O$jp#~bmO+s00FmNWj4Iz9=j5vuVD>+=N^BSm%!
z%=Vw_<jVTNx3`3mxQN>W^929yc*(Z>xv?U!PJtmSWo9K1Y*%3$EO)q@UtC<g=W|Cv
z!RO33dPf;nRkh=wCxCRNpJ@<fCHltW<^JPPx<KNwe6^GxB^!1Bj(Ix-Cgre@hnGLD
zjgim9f3)Xto>m~+@?8719z~dX<S8E0!ZQr(ebW2Tfmr_fY~EwL`DD_{@;{PDVO)2o
z(f*)tf*<89-SbU;9<W3z(jm*Kqg}?Eo1u81Nh8<abr3LB%7hR)U=wEmX*@qr{=(3*
zcc!wCmsR4$Ky7Br+w}=q8$wG8#cuN;CCshg2luX&r)|LJZtEvVg_i-ZMx)auRQ>nt
zndW7ihUa!}7Tx_9u?j2r*$4Jh+x2~9>?~e=EsUUo%{COkXFCC0QU*Hq#52wP9aQ`p
zbNU3k&5HU%SITh1mMz$0t-7@C$>H9)rtx~uWIY><TxnTV0r#%c&{SP@1J!%FO7q#)
z>9=&cj2Bi98A5_w#=)n2C;#0x4c@|rbAuWjx7#?v<rvqcj_Yyj*yz*bxJYM9nkXlK
z5nW9~Ph2`~<kK1SAZuhX>#tXpjq55=^LU{6A@aRCbSWHrp^sadB91$SHa}#$BfF9z
zJw3&C;ff_IKjIO1vp7*)&+Ck0d#Mqud$>n9p1$+r4C#HreiDf{Z0c|U0KETL*sVOL
zRxs0ZWs#}FVPQLcE*tFMZK@rivoe;WVQoN38?*nZ_w^qM(MGO|V~n-Y4f*@3<3ADE
z)?`m6+m5OvD#XOlM@lx~M%!}>j5n+vtHz1fF<0+3IAIAvP9Q6MvflO+#OTzNETHnU
zwQIp*lZZg}Va|VFWYnXYS;|WEeVz}R#+wrkmO)1$v85eg8QMOwdK~+ciiZ2sXM{cN
zzE@5qNUeOYY%>!&vd5hm-4g(}bjwPgf0J5boy!H)6kN`CkG(EYjkYQ~+MpE~8Ch)v
zg79F(v2Cjik>NtW?Dh*HzZ6UgU^(gfDW=ZRN7?md=_lFbrUGho1#YN3Zc*?1)ptMs
zyNTdcvQrl=W}&@P&XjbjgRsvU(76Kmn!;CyY-iDQL!*F?85nS8-^}g?6noe*yrjGb
zUwua=`N+s^d?;gY6dgQU&K5)OdDGBrC;r%&Mp)j=UfN2fxdO;q5XIF{s@dWsHYQTr
z7(R))Fs}>k#0}R8A+A2aTFV^iZ%lfq1){(&rq=8|lYoY(WG3=MIU_~UMYn@C-*f3m
z>qc?P-3bRJW``~unhd46ne0Ou-0rc;Vkp{6Tj7NuyoS|ixPE@KdOX!n>*O;3pIy_2
zl0YuWHa2uM8g-a86H}+z<;1QMEp*P+<w?sL>e#zjqsDlqorl5c(z5igSF@8eO#{fB
z&**lEKDys+v9g#Vj2J2r#@1vT+_*D3K|a@eEtG49CbwGd^6i44o&_c@b&EuMl|4EE
zU*nxma)_bFG{8_3y~{<F+i=Mq9#n;Qp*9ev(nFPiP6l-;qC;tlNq+^S4E%vy?F+41
zp!#l-KKjcPWB8Gc8Z$95Td`qhW+MXGw2DFFo9{+8uN^g&q#TXHKG244t7%40G8$Lb
zu@_WN7mtj^9AA%&#&>=>jU=iZb{-$xBfQDb1W6%!Fp>>!`hedO#Xcd78U?>Uho}14
zEL}ZQK5WR6`N3J;^N{xVvSq)21kQQsB)Lc;!^79(Q<fVb$GX1UKk2!(EwAYuT~KU2
zKIACxf25})^XKr*s~amm`$7lHNc3g12JtZYo$ddJyY~!hy4m(X6;ZJu1e7klsMJVD
zASg|wL_~Tg(m{p1h#(NKK!5-W(n}Pi_YNvW2_Q{GLKO?Wij+_cB;1Mb-uLW%&I$Xu
z<;%U_c>FTvKQn9ATEDWOykF1s$ZD9{{GPto+tW+CrMSK)zc^SNbtiB!;=Wvi@t@Hz
z|7X)Z#2T$8!SNEd7Usk)19wftoY9W_*m0uthQK<^rSg>e8yx&(xmgC>ef@1cIUL5r
zdh9dnZ&%>PhBR(Mn+CH~p7+!`Ucqwptx&@IQ87e>>(8fnXZlq(*{buz?ye6n6)cKd
zdlyx3?lCPXJKcu5>qRZ?i!pe<QwVZFmJO0vw!?G3?(PzcEl1)K9_rkk^z0kaeAGUA
z@`&x%@qp=D)=ZE5EPcPQG^#W>{|j=xF77<U^eq<=#=yg!D(AV-|9~(9%IkZ9G>49!
zy0&-0{wg2cR-5a6bv9__jkzUY^Oc)2cC<U}@Y>73n$2T+$rpuK#4YeaYG<T({XAMD
zKBxB>Kfd&@eRN&{ppwF+6W52|`mIk4THeuAR+Lw9Nps0o9vh0x!<~IK7mtyJckw)T
z^^<yR%k5fRRWxMLHkZ<QxrksKZi>6uo5Vu@{51~JYqo(01pY)>|Ft>?=;ez{hG@GD
z^I)h`T(^BnZj3GB%nh#JA1<Fv*coW=1^!-Q?l)t6w%K%P4Zf}^E8fJKD7p^7tu0L<
z!zn?H{k9v0215X~w*Eg+>*UrSWWra1IT-%Tq=qgo{nfCyDKEEKx_56Y{+G<1fIoWj
zfA+}qUNix2?2lVjI+&*6s|XEWU~%P|yQYhJo|Al~b8$|(Gys_Yt<OmsSac<+dKL96
z2QCQk*BaaYHq$N2z<YYqPHRbpc8c|D$(o2Z$%Whg9_9rQRIxH0=fFROHpPW>MIJ;;
z)9i(Hzk9iro4@ab%KvYE_W(=!su$e*{(}b)LG)4PV1H+dkd=rQekXUyS@dx76DGHT
ziAn#X7SG*;M6eF8%#0XAlGy$g-0{rz?=tlaoba^1YBye!`dPkouPLyVU9pf_H`K0H
zpiFcg``Kzl`t=3z6w#m!Ah^<-(mIec6gNK$z1FFG?0oPr72OTd>NLQG|8K~mMFp;(
z_GKqY{{$25v!^qgI@f|C3;F1t^6FyMnC{-+y{0E>yO7XoL&S+5^|~O8wmR|BPY1}O
zL8oK=NB`lDZ9lWDLZQ=PaK-#muBw{b{K41#zYj{@GrE^c6%!805cw3~`1r3@D-_=8
z6>LG%%t8;iIDY`wJKVO|L1sqC67#yVP;vLO;k*$~i?*#hdzUsjK%e8bywFqaciW=!
z9m4mo<|v-I@@nAAyL`)}8JCXsmXI~5AFY|JY%kYpRROSPN*D@ywV%)p%sRpzAig48
zB`OD+?0I~{RvFLda_Cy>+f&p|EOs|)l4m;@3^2QbuVNVNP0RBww+V8Ri^&3^!@D}b
zeRVhK`A=ZBGL==F9dx{wnoT1GWumx~mSXaZQP1y<Qk)WPDUuram-loZ#941=KXiwb
z`#UDfZnO6<Jo^FYjn7Oufu+t=f|;I}-v{_faU|{>YN6)7V@mm2zMLn;qjBHG!u}zo
z0U9^y(%y_d(>{~FYsv2RdNab8jdhZS_+vlBT#uyJVQ@!JzI-upqgITU`H`&_*PVm2
z8>@V@ah5)7`l6CZV@f$7WU)^tJ;dz~h2xb=QbP{v-gO>&aD@8HsvosDpeuo5b)_pz
zDl&!zi!%>#ICUUtkV(Dh+wnF@ff(=DM~&WY{g<qOhWtdO<-a|w|3)GRxj^@?BAEhK
z57CXGwet02X<T4_4A8(lOHzH}{b&00TT)j5sAmQ{OM5!nl?I-^C}L@vxmOi*&7PVo
z0cE9-Q^%I_$irVKVikf#mDxulxnqsqjKT1*Hn{D337X=;sg83w3=a{iG4=+O@zc3)
zG2!Eef5uOz<wPo5*cww<FLL|w5}f}C$SESnC1X-$W+TBk8epuL6aC{d3FmYpb(%Fl
zW%tINXxjFn*8oNpnQmScr@9vVW)10QjDh;?8LagCRlAE0fMF~uaNLCK@NfOGe}lX~
z9s37F<Y6%4PIT4`oPS*h$`Qq)Y_-TZc_hSp<7!!aohT#$+IIOcnjtCfS(q8dtYKC3
zooVozGH${1#~!vpKBPumbn$`d!P+@a*T}}B^XFe_XaBl%8Bcf3=6FCa8*{vJmSoCF
zX`3TXQ$i~oQG$|amjjpQnP^|dH^w(=XmDhUD!FRDIJeOAeQc*`@yp_})6f1f<nsDf
zRQbo0^;BEwp<fvfUXXn=s?FiOOXnG`AD;6e0p_`n?6IqAG)zx}X$5%?{<l9lk9EW8
zvXCZUz0=7Z_Qp%+2)*ThAfl`$r@i{h-rI=2=Z}@?4nj->K7B?*wZsy(gLM!N2;9@K
z7$4%GQpY>EhZ}R;Sa7kQr=KHgw;G1jr?M2&(`E~rb>{bdXR-`S`eEzBhZi(kl#PiZ
z54u$6d%3<okMx@HtovlazBL3TyxTnyLRU&xIVOFlMUyW;nU`K*_~OTouT$3_L4Cz!
zohzsP{DtM8N{fh8=d~y)jtK0ay|HQEz`2*dcxkk{#HaYI^vT5k?H7ap#@-z|Fj#mc
zs+r^LY1;vwRo}A}U$e|7T2``BP0k|Iy3)4ivZm~|`+2^~k_x#k5S1~6oFj`q(Z2*Q
zCml#JMr2ILVAk}+7&_X_dS~i$wI&K<0@mtmE3EMyGiz$~wb?e2+ju>gH)BXL(m7pO
ztelm2YMlM4bz{)@3EN?zF|+^Lgb>A$LSXDx@h_XBKsxq9KGRxjZ}%RjDJfROYA(hz
zZP+EQ8@fD~(g*Wvp=m5Y)VN}2%f#2`u=7|&zwNpq^7dR0cR5ZFwlg1jY$0w_Xx$^@
z606R6F0X{0Iz!|Jy|cP&hW`j{-~|fRSZsBy{{9@{=&6m|%{wns{+Dy{_h|{yp}j}J
zhq9cbH-I>{>Qf6Imesm;cj-}3{by|TZLynOGjUI=Pq+3aUGe*X|Inh<<CN~@<|vKx
zg7zk*(7jzG=C*$%1v+YE73feqf|kd+VK<j~H+o%Ogyo=W!XlimNfI@Xj?qwCv&Vx9
zZr6|Be96L->$9k16Rk9v%d%zFz1T4!XFUaVLXL=~X5RKrmgau+UOpRjVzF9sB_8tP
z)Bil@|M)$gv@<*x<iWVeT;*#dq#KH0T=JxR-tBb60n9mFsRL}2rK{mR5DElTkDiW>
zsgubz3Gf_VG>j7^<8@UP^L4m3%JfO$x<L$^k<`DMKJARi<J`Fz?PApOC~9?>E_dL*
z+2flS*~dTF5QB^!P}(tc>l9QZjN!gOG*nfN6<y5(O_MNS7<AiHzKPsY!g(3;q~ZZ^
z-EH^VnA&w3*0T$`a$kg0ZmfKj#N0!8LDcSzB9HPk9<O={0oD%)ZnS799meq7FFL1>
zPUTbCh6aZ#Szap09ulp`;mLTom^=PkeiQHqP8I&|Vd0;_LQk+Pjy&wPti6ZX>`<w}
zl3gnL{;EgjvFQ8QLu@Cnsx6=X5n&hEbURu$VB?xtwX0SDQOYSj%ppp7a3xo3cP#wt
zojsE)asT^81pg`(-kgtzF<789-8GG-BR+C?*1&c@zw%>rJa$U}I)f_@#VVQx4&4dp
zKyd4xLhj;e+`LE2V*CPe1>~t;xv-6WVw(}2My;|nq1Tuw>hG3;m{0c0a|4bKzOhnF
z0!Jow%ekzh>r#yxJ$QXSw7SvzGcjkUD>>Iha+TmJGJ;myhZ2bA5ralymrNI`>`Pm%
z_xTY|{`Ps$u_S1TDcv&oKB3;#-Kso#&UfK%uEBufm#QJ0_H8jmLe^2gA`uBvs{6~V
z!Ef8l@SwH4H&ST>S3ewLN{Xa0i><E=q3fLbQONm1j?AHciXnFU^|vt<9v+hizv`R7
z!F@Du`d^{r-}lV!Vo1N%o(KHqhN+Bs6~3TJ!nIj9j^)E62SMIt2OPezpc@j*%vqkO
zY;!OqTNokNazubQp-b;Cn6QCvMt}H16#4av9F%93l}q)e8XYV83>#XADRvpmLzxk0
zZ<690UgSmtI^ZDv%W95y5SJ{mTy_Q{p6IdWjwG%&oOiB`H@ZhzCB?n`W8LPgEE8bK
zZsxF%33@yeCL1Cq)IVw2iI99ELZ%A@oXSLFqVrEU*SbrA@}0B3hG(3`asdf2?kWvy
zYn_8^s8`CfM6(4=S_AGyT&3Sa#Ye7pzGF?xA$6lo`m7JEzEJodI#gHMRO2O1S&+&H
zl*LGK8Ady%eTmTeCDGTnIX`-cmCd}nVW%u2>R!!uMItqlvD+dlOHoTjY!%Z1EE(EK
zZVlY{##a*SORx>MfEYmadN*TD?YbtZ*@3${AV8KPz!z>0z-CFztbqI{``UfE$H(xU
zs;h0LQ$OZbiJ(+l?~^`3`lPt7^WV*^)ysrpF1^2VU_9%T3R^A=xmM5SY;cmbMt9FV
z)K=(!yyySCxE{h~tfbYvjo!J!r9)A&G|=8yFVsS|&iYeEK6!@ACs~oplRgoj1?#&P
z2Xa&-IXgIl+Msgj9E3a)<k?m~Oy#XEwRp{Brt{<d$c{5y8+fCaezt}Ce=O(a3Sl`Y
z7kd3o=R~g7S?1K4{9Yy24ahyHT(VUgLAi)rTtzj;T(wgPkxuvyvy|;s%4zoM2Sp)B
zK1y9mtdeWT^`8EGwDx3*uCh+2Q`t8_WX65trX<ZBhx>sV95m+;4t24KX&#teyi1Gb
z-op26n5+!73!+A2bZjXTmg&x&P1Zrlm~3J~JJS`(m@jvo#BK^4=vriF8%jFunEp`a
zhdpx)9R}93Qpp{X2u;|)On%2>tJ8OS4gC7Gs2(K2vW(_k3fV6=iafGuu`%RQKUZ3=
zWW)5}7<#T#B~zRsCj0K0I|83R@;gmH7q^+)EqE_F(MMj@!&((hD}5jn`l&rz2agpA
zNueAy{_2@~-UsbazpD}rvL+39Yi83&r>s&#%%pJAtzC>jCoqTH=w?T*lE0^&y4`Zy
ze9}Ng0ynLcYj7afdC*)S;{oyK80vR5PjT#iyK#`vG4~8p4+g_2ez&a}n9EJpw)C`@
zM!e)WW(J;+kH$P{N!#Z?u<^XV?eL{+XYI1rRHfF*@(s6sP41wRUhIXk=2_fZ*2LPo
z`=o+SH0!2XO9e2kODY#gm76iDUD7{h8*kCxEPU^Ib43smc|DD}VLKVwd*)qjJq!OG
zx##yC^3IkgnJrw$vMm=u;)tHZJImRy`hBvOC|a#j4Dj9i8MosF7$0Pgz%!ol4HY%F
z5SJAgp7R%pg!8Wg*8`DJ%~M`hGI~~=612A*R@%{%r|<rZVc<&|oi~zCe_f=%{41<e
z)`IFnQt{0OM1*KWsNXH(Y$(|Ul%t;gac7mqLKPytM2?{X=qdr?8L7Z|z3AWpT?r^|
z=B5;x&F4lO2gXP`^&1lPosX;g8@0O}a*Q_9*c-M<bpC<>eg-LrY7iu!)nT85A`IcJ
z*h}Oh!z5@_0Yq0_!^&W<!UpkyPoC@{p}O{2;Gy^Oc4f^Fx%lxuyDbpXus}&vqIa@}
zGF#V_PelIUJbG|@?b9~9_ORv)eFJf=$^b^LMcL45x;OYvi-n6Kp`xTh1un08@hzne
zEG0_`)~9+aY9L9dyfN^33jJOYXY)Y9#a+En+WlsF{9??xuCtNBkuQLe^YNzbbq=)L
zQbJDsq##2fi4B>3ba5W5Fqmh%gN55kJJf7$#Y58LZK>Um5OGRkR~tuGkfdxv9_laa
zF=JGEnD~h*1x4V4mn!<u6ZaKe)(z#B3EmE_XY)a~qI<%>(={HvxyYE>-&~aIy!rfS
z9u46&dAlF`n(AKjhD1@4yFSIj+w}%}Q)L(KohHtjp&S`pO8aap_r^w?Ys+1(UEzKl
zOjihTamBF-u;>Ofzk-%S9X_<QD+RizPyG;)s}9$>-8}fV=4}OxJc_N~XM4m$ejgj3
zi|9KyG>`R*quI!`&$s{xb&gnqbM)=bR)uvrE0<ynT!})cbALS19qx#M0YaT?b9z`?
zBG*K0OZo=hvqe={l@%(RnAC0LJ4>cG*irp`QqP)Qvr#q95vL-7sDh(~=cjC=Pza02
z`(*_*e>GdDw5f*O^A#B(R$atQc#p+%_ho$Rhg|MPW0Ie~hTCUJ*^ckSlp^d3^%efU
zEgZ#bR|&mmNPXtzbG4NtyP{V-s=F(HqboOF@}ELFt0=nCmZ596*>Y{<E}#0{%`U>q
zldw(56^3>ToPz)Seq*0FA4dn`%56$>k->5g!_w9A68l-wlvp_!^~7x?fT<!ObDQ1h
zT&Aa+#!^pMqvl)vVvo=|^c!{~<`7@&J;HE3$cbHUQcW!FL_>aub)J1i4i}C%;_pIq
zE<D@w+=dW7)5(QsETb#-!oN73cST&)U~w?+Z9o!NkegR;>)Q;m+aNq5<Pw2z-GXqU
z;w1E3fDy5_%w~rM^f``Gjg-S$cI21dMikas79N(nsck!L!IoO0^^)%IkwQ>12X>h2
zr7+9Eq)4;nZM3eDTkBA01GjAb1iWD?E-nRU$nXV^t()4iYogi(U>eq-)DjWo`*`AP
z35hi(>aImp*j?w>b^r7N(7f7ercM_Pb)tXAqTU>3rpJx+HmHhJXxkpP;vEda-F>Z~
zVpd36zuxn8k+EGf(BlTmmL2+NntHw}O*z@=gm#lvUSI*(|7d|nMV{!6+P?59R4V{o
ziSgqtVdIz5;=_&OD$T|GT%Q}gE7Ck?(9?WP0-CRVc0nXTHsI0*2n%*p-_4M4+IydQ
zEPF_E*gn<z_RW4CeYq3~-%|sb`4VCi?p(({q|;bIJXVK#%0o+S!n5Ui&~To%qV?-V
z&)PZ2cr^A>`OeSp*IfRYRQ=EICk#=DC(d48EOjY%DX{7@&+6F>vrUot<5?%zmZmVc
zB0XF1ix?&8*Ny0~kH%W4=^JovLQ7-J2C%y%LT=+eSO0j(TtaRnx&9hT6W)UqQ;}vc
zroYTGX~3lAfU^rYpODoB@kMqf(!V-YZ&rL6?vPn!G~0deSxdaxV80}Jd-Mj(vD<&)
z?(DU6xuxnlcj`YPhw;x?YemW^A<eMvc}pP2t54GAoHjVSjL%ncPTfq|{tzV;7DV8U
z*}!F^km7&gM>$aw9dK?R*3e3hV}5EhNW%lV7k%XzFDG*a_#DEw*&;rSUuLo$N_{gs
z+2Zy~Wot`)+DVFZ;opmv|4K3Sgzt{dVSk1fkRya66F~MPM1SA)GmYPM3@xBlB>5Z1
zE7II`5ZH`u7v(L(-|BW6w$rc;$iEzes{q;zh@a)&R671UL%chIYGAOt5MoT61*!g-
z9*zwL-MzGerV3U99<;l@z2>Vj5m2D<d_FBRX}{3&j8lO<t|iHA8LxY)JULezDL%+P
zM1HG9ql?0Q!@tL7%&U(Tka2F*Kj}R_DPt7I$uEiMyjgK=uZR?m;MR|yEuNGpn7~Zm
zlsN9qr1K+_&9taZ%0POJNw)#r+<{031AMFplLfY;cZO6LO?PVN9b(*fz~C$?S86LY
zbJJ;HtqNf^DPh^D&q%ku3&e}UiGi9!o-N5yhX<9-j$>wTITo|1e{e)X9-0?=$+YK%
z31vY2*l1SkY>S5;jV9t9Gf25MQNMtp9RD!&te=@~=@qQTAIB3)*7;gYoPCR$$OJ>8
zwS0RT>Lo4=i~Q8Zd!#(;j;C$gu9r%Abr9*TIL%q;PFFMKrM*qh8-Ra#bdum~pvpSg
z9X|g4-aM>prI30DrH6Ji6UJRlW)F-Hd{M5&J7a!v8Qvh{%FV<-HN%G<cla3i*1#}D
zFww7Jv})E-z`Uhbp)JSg5qC9=e=UfZ8wQ-=|Lbu5`=6r6tP~#XEzMJW<cx`nI=zZ4
zj|G5_TpOdCsrfEG58=?SykS0@sY($o#dRfRgbg&s4^qoKKyEH_w{305xp2n3{j|bu
z%0xTD(9)Tnc+qvav||;4*BhU5*|W&&B+o|w!UYs(ENK4FKUo@cRsDdY-bvH7*tn=?
zSPsv+Ia|^jLT>0j@!&#;HFyPjz$-8x)7F{McfDS^9qYyU5%a{2*3M7m&?HA(W|7g;
zBg!5VkdW0}_Mkz5m5Xf^8D6`o#L61v-pKhoqx*!iLFS~Ui!|cvRbYUb4ak+nSxK@c
z?Yh7{4q{!eT{S&ke!67BlXlb`r>E?67ByjZLZhw79uhtu7g=p}bOakj^~L86sivI)
ziFgTn`b8ySKf023!@XNEbNOb3p%D*)Y=qYsZ5#&cr7;5N8X1ZRiEn$U{qH=7#ofp9
z+n>}~&Ek*!AapCa<B;&C^c~5j%`D^3`|U=sD!WQ7bf_GZ*gKIm93+`_mqKw5N|AT4
zE8lLge&G=_Gwd+?r24SF2j@Lo)pOASgJ`}Q8_(AtT4MMl5Y@u&_{m1yJ(d!xjSwc#
zdn0$EtvA|Ta<#KjgXBJEzazV2iI`wF<GQHh8G;Uw2xKNJ47ps-zb!X(WvVBX34XF#
z0O*Cz0_VVVS%(`<^bfu_5JXI=X3m0T&zk4rA$`(Wf!?raqVs@lR%vE&1&}^@h|$f4
z+<3epXeb!;*nCOj%?G~d$k1^2mM6h_C&_GHX*4Ay05=(33S7uBO04c6k*?Qk=~7)N
zhiO;`<)PUp6{EK|_KAlc<maCL6_3JN8J(fag5v<8W8v`)fH)tDkUe16Arv~CcD#)z
z%fRi%BQH0n{s+szpXJfW8)|o1Dnza7+H$+ip2q`>M3)V+`Cd_z1os<>A5(ng+sJmT
z>~ZNFLs<t`G`efvcF_H#;#3>9r&Zg=U*r16v#7z%(WZE+?c9UMJOs;3|Fk*0P!yCY
z!`U7ZFv)wsmYV}MN%w}Xsw2PEB>|vJ4Q*vC_K6ney4EweyV<BSVFD7h(>5Z%<A{{G
zgw(^U9L+jI{1@<fWMgjbacuy}K$Zz9-mg~KY6jw1kAMJa5IfR%oE2qrs4w*EXBpqL
zDf?<3L<zx8g~Z&>vEjbAe#}Fwdyw3CF|%@wYRkCnN%OAyG{{wEg}^3&bxI=NER?R7
zIfBev1i(v3&9bOEPDp}c+oL0lJW{M#r^?yN6<0am$p^cgbwF|?Z4kOM)(#j4+YIrb
zh(`M#s@=yx6Eq+W3JNZh*61sHT#Kbk2Y<>E-8Zq9c9!H=^mRTwVq~<Jr4f%}L*N|3
z8Ioj#<+M)vZJXuZDURdX#pTFBJLrc~h7wFS+iiEGhxWOQLQ*h3E^8>qv=T}B&W#r~
zGTlbN4ybl1j@;d+4?0=jLQfROuj=Hw9MiZTbv;e79J8ujB_u&#xBh86R^7_Gt}^4b
z=Wsi2mOp2PDb8<Uc?=X6j|{1vWnm@-FsyG=ukVi-2(g{j&{iw>X+mT8>`}v4Eb4wU
z5p)=)jGQS4*KXx<^GNTW^w(^^@h!Clu+s3W`owJE-<&%;r^dCeQeEL6w<XJ%JDgmf
z2~!efA>ETpMQNgo6a3_OylPZ$;_R1;L`0$vu&lE1OyawQKk#7{C#NP_n6PBLV5lE%
zJfCD4u}_=_^Wiqy^}#!`V84j%bMOPs+r;T>sKM9e*TqxeR|apKh9Qn?R_RBf8-9PP
zMc3xX_b{@0$s^qOS4tMK+?TdMP8?N0bpa0{slDs<kMOWQjXpI7{XLKBtmMy;s(n_;
zh;CMvm$K0u&uNVFTH9T}`o|_R#I?Z1m+O;;;#xs?M0C$on9FH?ox13(eB{ZUYkMq%
z?zTTf1=L<rjg(*L0Jw8If{Zrsdrq9iljjPpP9XXR&YeEUW|&}iK&s7lk~vj?V!4fk
zbe-k#a=li(Jz6%DC2YEzpBUhMBTiw#K9$IvxXZo7O8rSsr2{A?ypJcwVsET^Z=xJx
zP`FBw)VR~VgMxYP6iE#vvIAl8G5j8+osB2;1a35j&44xcsCzYvyP*ET*@?Qm82tr+
z13Q)NQq564gu!Wk3-FK&+@Sb#^1n{Xn$<%6WUxIv`Uwptp+XsOXMorCxyK4=_vIpm
zB%{19BvsS3=Chl12nlcGsgrOOp?7jYD4_A6`c{Jao6;<)=OIatifj!B5wkk9`lmm>
zw2&Eiq8Sh+aIoGeSoEPd`L*KU%7AD&K8JmEz9q?rJ3@BNtOd)liWIrmM6x_awVZs~
zEJ%}kV^7(Ibf)->e!QrXd({YeMK^Bd@^hi5QMe=!w1Q@=HmsXgg<|}~6uVcAPULmC
zwy4f*KnjU*P2dRcbKUj$7{9Ll)dw@3FP+Qxi_UhQd07AkppNOhzlveQNVa<ar8sfh
z;CDp`o{zOqc1}m{`Mrg-5ee@)rY?VCE03+^LN3M}es<X^zdy8r#dn_{ar$oq1`*Fb
z&hojZiWFmQY1Va@tg-x-bS2|ikA53wp8E2sPcht6<r#H^J0(w|Egnq5m4A0+Ex*5O
zBEZLR)lTBLozBe1BmC#$9+ln>9^D3SkMh-tMStX0K!DlLhFJiHjGfG(+G7vtpf%tm
zRjL>c{9z{-l3%|%D5-D3%MkI5V!mKhT5wVOfPn|jX6^oA+JqF$$VpDjT%@Gz+%vO5
z0U7~*U=9BkJU=hJqcW)8RXw4yYkQRRKGQslY(I}R`s2KyG-x|wDgSuTjaK_bR7IMT
zvR<Hq_aPC4Hyd+Tx_<|s+&aOfq*ZBh6brnt=VOLbEw=lm1JRZPShIaTsRV7#LQJ0+
zgVA2MjmbQ=8s^oVmB04ZXH3&Ltvsz$^RfZ|F{{&)5d&;(u39z@`K%BHzaqe4&F@k|
z(th{adwq1mZBNd6$;%T|{s)Drt~7ioWG>Eqqupe^i~#pH_-U(Y+cs5EI``UBp|ZR=
z<*07RYFbgzfCF8<hr|^rciHF}wv95Jv@nA@FZWjAhX3`Q*w@{ad-%dtm5-)cw5e1x
zeLI>EN_!z@yX6xs|Bdlp+7{dj7+??0mDI}*X&&Br6&RkPFCAMS+sp=I)rym`Gmyv)
zK={zVOHf{>YdZKiMu}jTM(*yIbx2c$S`AB(oY{losREg0$;~!|_N+lzR%r!;%pe_3
zS+|XppD5g;e&z9)GA-1qyFO;<{I$5Li>0Qin{Pb?-M87>hyQZ>l(ng?@eRI5SdpMs
z8(*~(3OV8Y3#)Q=1HSq88cJnevHjs)S_|4?wktm`L}EF7^gL2>RTr)B+QY5Gx4hZ=
z*UN~tpQ*+e-jEI2k7hx89s|mYNi^;Hdm5%u<dlZYdT+;Xq0*OY7&=*F1-d7M&##ZI
zrYDsS7y*xk@bL|ZE8Ppg(Ya>hT>)J)%A#i_6`~T!_<gc7aC|8S3n21~kp4DU@SWL~
zzTJ{sem&}dSgEs}72?KopW~l{!}OK;rN}ZZz5cW|ZDxbg(I_L-;JszorD=Umst4(5
zvp)qxc;T2K2YTb~AU_5qyS9b<I!i*lnW9_h8fE2#_r`Cd)Gh(_OMB5IoXb7rLz1i*
zKQz$0JYkV{ryoxBl@}~apny4jvROu2?Sc&NHWdDLyN)C)rA9SsL8DXcVppZ3&!s|<
zgVN63tve{BQXTyp$EZsib&QFNX-WsvGR&Q$?k~^RBKM|;f~v0VyBnWGva~PGDAf>W
z15kY?Sy(4-&*~>Vps*9PQ#{kHWEyzaVIr3o5kU7Q+_Po5>uBq<UJfX3uuz}XZySnp
zEE>EO<v->-|NTAHrllH9>alKH_VPk9+fPCsp?4HU6zdJf?!-c_7ay-Rd>5x7cE!tp
zFyZ`B#gz8@j0O7b$n}Zvm-m44biR6^LtUko-a@VYuQ!S0seRfWa!hOu7y132s^H6@
z#w#MaQ>+a(J4a)q4v#Bek0{F!jKIZ6MW(y3D&oBQq`W-q7@vl};}M89YOaQ<KDKkq
zg@65Pp+b%Vb`QBwPs?x8T$+z5KF2ZhY#z%=%z9};s@8|!TcJ2hx1|g2t^#N2$!N(5
z54G|m2gK@ejHyQNwh?$8eK#qC9uNOsQefC!sRvZpLBX`bjA)Y%((oeIGp5gR#QoH8
z^u|ytV(4(1vLFizKq^}HZ88N~V)PI%MN*f46kpibc4htc2i+LD&icvTQJbAwrhRrh
zigvSr(%Mj5j<Jbk=~@>Pdw2&J8g!{oI&;~xhR7*av-PZ9zFRcJHpstpL)1OLD~+v$
zP&#oJH(fKfD2SpoRu9Tiy%m4=iz%OH=Gg)^i`-}G2gm>ye<g%<DQAlLiqS|slt7eR
z*q!Kg=N&DxOqq#}Q!d&>bjNcS<$|I<E9fUmHKYeUG74~=zf6LjQ44rAjDG_=lW(WM
zCV+K(yi7?x+%;mr$>5g6mD?qBH4tBc_ZQpme>wo13>@&l$v{pdNMQTO^<s4ogF}@W
z86!sAFOGj&Bu>In3;Q0bBrK!WY|(2_M8vfe3>(g25u|vP7Y$md9x~Dy`?W3e{4qa9
z8vY`!7ugU5#!PJWU|bun4b8{Evq&iRiG73}#tRGAAGBN_UF#%oyQ60I*&fiU5P6&>
zs+DDxi<;3tj*krWD<Hr(69PYD6<?nR-K#HmUshjKoj)xO_-T*`X^{jd8C`?RKIqHM
zVe5_7J>@%SR7<~;v~7jMTRB{We@zDkg}oHj-`A``lN(PS$vCehMxm*kL{$xKC(v4?
z(Y=}Ejlesc>$QS}7{2d+ZY36#EF$M_SW<7qDuDIhHrbe!h2-lr;RR6$03eRh{ioaF
zQq?H{QZs_Kb8F`Jk522QbmapVduIeb4u(Z2bf<4jy@E9Jf15z00hXBJl(ci2Re;$<
zKQ;v?6{DbBjneI-UgqiXmlcxhbig~J;z5$O5Mu}ny4GYh-)kYyQsB6*^T8rw!ddSn
zx+Wh|F3&?`S(U4<V4vV$cGA<Q{pLgJM*vLfVy58$wFN?oDd3*(Q=&-9IgYuP^Vs5h
zGDiM=A}OLs%<uR7Rc(fkZoD{Ny{%Ae313^Y_ukHLRbgHCuc!mz5i?>X*Oil(YBhst
zf3czuLZtuC69JC2=cu=dIVtdtejiWY`IsAfX`^6Dkh{IdYmO)Uf7=AKZMz3JARnig
z(b`Ek)K3aX=;xoY<=phgPes5sV&MjEOxh|QMyQF{?~h3Q)Sq-_3jA@NIBB?ueY0t+
zEcf13mYap|41%6dp)E<4*7D>*c?YOpcZXu1#01+U0vTeq18JF`AlMae_NvSJma22H
zZj|c)Y8~!m0`(lVhjN;I0S3}aDfsjl3Q&Zxxl+=2p&BR0D&NP8Ga+>j=w`MjjA6{Z
z|D7WCirXg-Yc{y@^FKhm!hiZlvRhdwt(__EFL0F1h|B9SMKBxabs4(UOOV(1_+8Di
zR$KXYjz)i>gi#p*)j+n&kLu-G-0s^(0zu2T<yw>|^%9aPN#n=O1?<t{rp)Thd~Z$X
zD7h~@L9U;b(G|26&)AR?W-YyGg^i2yjZ@GVp)kcDw}Y~ZplR?{)xj9Gw$+a%?sMJG
z(`H&`NDyZ)kj|*c_LdX6m2b+@nqw~Mu!Tb&t!A4=OK6YvoVS&Gsx;+LeMBWZ{Ify2
z^cT%jrVi%trtL|0UD9*tA}BgUeL&SZu}{Y^iJ~)Aubp}&?k~V{_G0dx)t6vEA-CuA
zOFnf*xeIBYqwW&|@(EnTzDLS~%!%Zl>Q9F5cXq=?V19UOwvTRtQwNWAYaSHq7#mTe
zb@W~tpuf(E0&mYzodD}Q%Na2Yg$-L{002pSN1)nQmr8DS%|g|P6#VTMH(;A6^CMg5
z#MEUd6QeKGVZqpVhORk0YFL-MG`RUj95mJb5hQRm`-lpt&ot~braVb;zBf>?n<ahJ
zA-8;5P&`o5dl`2;OpJsqAa~k)GHNG^K3EL>WD)g)uF5c>9}||(pndztExl6+hk7GP
zMVwOxcTcsMv(?Tz$1yPy<blx%lz$F`S0RzPkZNmzY4}O=O%gO^+I|5$(nTSWh(!Cz
z7-!T*zsZY`PB5xJ_d!Q6B+|jEoTEjd=Yy`;20x8Rj1L&y<74g|{o~TI?UtI=&+j>r
zDkVQb<=^~@>PioI83VnG0S}TpfvnS;Pb!@2O0wEKV_i${EXQKDZg*ZPBQCz$;v`>U
zk0zZ{aa$i(7I(t^wkdl$++<L-4TGEQjYPjqtiNny`|nP)-8$7wUyqkUw_Jdr*oY!N
zwF}sFayWqDXE?sfZq2;Tv%^+N8dkb$T{LB4o1A^`5__b(WBU1>q7uI0*!HvI^1&;H
zVceL0tm1DgjI>DTi7(lEVlAcAprc?~Ip*O=3gQb4s5V2|I6{(~JL+H?fP8rs{WLX<
zH#AalYgI|pHP&hdP<t{Gqi)f|CfQOA=>73z^oN~!EH_oo3IIg}?~X5#Ds!{Q9T}h<
zAfhsB#u%*@d4N+r&)RX-C@VT#e;x0f9!aDO>(P@y_;Z`=nON+Tk7qQqcm2W^r#PQA
z`cXFz%xVDL0!%Y10q?Q!ht12suXqDnI6=pZOO4Fy)&2#nA@b0-s{Hf^pF^Qm9l8c`
zT0w4A<C&<9U!SoY`^1BM+It}K%Yw-N3dSM&Kudl4BNwX8Q$d=g01`aCaT4RM7g1qw
znPa6aT${EH>$Ghi)7-_@<=?h?XQ6lWBgr}Ut!oz5gT!P82e<)URX2sI`JkBSUS&lX
zGCM07-axDI*EDxuLRkBax`<kci!(%eHOXf;93jrgUKy$h29`(+dY`?8B2s<jgJ}nu
z0D!~)+Uc*(xuhw+I&KO*FEiJn&(^uJZ|Gc`7qi~Qpf-r3w9`lb8BG2Cy*ma+Ywc@`
zymGl&C%n^*M1uRJ7mFahDx`bMO}nEpCe%5Tfa-RDc#Ckg&8ppGFYTA)s2icbJFB>+
zj8fRqise2upDkc8(AzzI3&UV9U+y^^`1^&znmLg7_*c*KGr&UYFas$?hA}%5B+ELg
z&5x^gfFd9&00`(=>D=*T^BryMH2VtD_99Jz@wnWD`>|-vb05QPcDw6mBYu3bI`K@N
z^O`ag9}UDkK6&tyzJq8TlH5|@)@Q60)ol4`vldO3sg_1Bpf{61jc1ICYK*Aqv@y4=
zDCbQ(dJQrdr}1nX;#AK3lRr#Bf<w53o|WbzbQ^*5I$pQg9>%EmlaQZkU_B^I0k}ED
zsV<asjl%vs0|XBjNl0~+49LlA<~vStv#6)F*2O&r#gBQw7_g9}KR0+FSSXRr0eOK9
zg;C1ap>NAi)(7n0UyP@meo?#2&9pRq7wUN)kSc#dUyD8HIrycV{QCaV>)^OB+(a*c
zQO<QIX$_#W`S>MrQRb!4Dd15c$I9b354o)9yKDZ%eP50?0HSO*D6NflQlC3$NM}6J
zT#0&gAi&QBa1NLFKMCiuWSOhdMQ?DlSUk3Na}@VUW^Rcm8*@e1jU_xtpMp~wtIau7
zZ^hp|VhTA{`34DzhY>HtSZtWid|kVnto?jCS`+Aaz+~hnw!4179sZtf|Cm>7*gz1b
z{_~>^0x0V7rKDbwGIppXfXdMyJ0+=pB$j`GIcbTMO~6xpTnd^#wj_XAscGGsA9~Kb
zlbg7$VK&3Yz@Zk<Y=u$6IpAh+cWA#KDDXk|xY`Z&OF!s5bn~FUHEMSrZcTNsDTfN^
zT;|e@Ye5m=ZFc6;aT2nqsp4qW&|K*VYI&*hi<yiNAHx;3#{+a#G7cC>q>!rJ=cHja
z=+rnOy|LQBdxbf56elQe=Wb(ZGs1)V*=w~=Xauc_$9Ml~b$Px>=zXgb;@>9)k0*D0
ztAG=wwdJQB()>6js!ZBM(ldn^$7Qd0&EPJ!@$@Cs$^7`JKB;@kt7H75|3ZyD4>LA0
zDMeRrCjSkEk$6&z>hDXs`lAXM!b)p~X##3W)OgG$$M;yZNM?IqE{$gvC#RD|`K7Mi
zPl=7phOXnB#5-ku7aXRH7`_*f-wN}~&L^f!-B|*lAtxX875=_0Q6_$Z#Mub)T#*^!
z%ZLa03}21K%t!!kgm@hiR$rNsCPQO}vkbr(Nv86K1<YXLA{lf8h(>X2GmtPKY&pMA
zoc|+ik*B;PVZ|t|$m#J<@cBehlKEoWm1+;wW9GVsyO{H*`{ZQ#H)qtp^MA`RkyE$A
zeZ}O5H@_)C`7e!u@>r&T>H=l)6hQCPjXe!!%|j|Oq{@M4>Z%r1y;HF2x>*MsI7=<C
zEQF?ZIgOn5iR(&RWjoz?o@8lO8W;jp8c(Q3N)G`Fq;sAqpfqi`fHm65D)kn}=$mF;
zr?t~Ce|WH&4HX6Vh`!Dod7xWU%r^j+eZG3ay~QRb#cDOzX01a<e<Cl;a{+F(_MnU^
z!xCVv`~dz?)<h}0k&r{=$aXD-;<gt4R}MvdwC!w_p>~mcKeWVzV-ytupOy;|;32{2
z4s%ejPU9{bAp7ObEc>7*Ggaj%f|I0oYgBVo&_~^Uyh6c1?o$fB`O6zI8JwhQSil(<
zbpchJd7Cn$=}8D%7URU-i4n1cw=$go)8{{(>trXCn1s(dwZYuQ(U|@pU|o$r{iB&6
zLaz&U46y_3G&uDWFNL}F-DG81m5rvIGB^nO7u$<7W-X?rxErZXxLgLrpx?Q{4+wgc
z8?HBfn6!CEh-wL`MiWPuc8#?D;_q3eC38i6PCG4<`YA^Z6V&9G5C&ZCfZ06YOKMA0
zo++P_YKM!z5Y7cngCXsr1voi~Xk<(Mx=TG#`>U&8bI&TfDKmFQF(D&4tRR$^LNpeD
zI!HC1?&_OHzfqj-I&ve-s%Y?q2-I*iAL;bw!}v9^#d%g#fM-7TqLYeG9Wom*(JaRH
z=@=T(y-;+ROGvBIyo1YBpCO2=R&`r-XGMAEp7LF|nO>>?KtEurEmj@o|FqqI;&W3y
zi;~;VDA?+hNX+XKE#^^=m3c$z&jkx5U*bf+&^y)m`k>n+czafO!%G)?zOJv@S8rwP
z002ZfiF#jMm|4LS0J<8+D9t!c-D2Wm?2)%Jt|7|jv}h(IwDcMZI=K!iltUhLOrBvh
zbGzsy?ID#Z*@%Ck?O+Z#{OGsEs5OHH3Vqw3>Rko&?F%F%Nbe(@qKJS-WiVhna>9QB
zkb3WYWwa=SaD~WqdZ(;PZH#}QPs4QB>xua;2!#!I_h;3!EMnYIHUc5pFo!#C<M3Vr
z-)&=*!#<z%4Pz3ZyjLpgk)$7(Q-~utXiQG$`k)u9u~(b-1=hog;evM!F`_02wp@0<
z@N656A5-N9%Bi^$i`|fbcG4m@x{&ncuk!Y4Q2Em)Q9Xfn478c>k^#VdZ21hESFA>z
z31pA!YRp`$8SieRapx90+=i^EFo^`V*7bDniUt%?5cn3R-X!IdA@|2h2Ny5@)LppP
zOExNP+fuM)hj>uU^Z`4aLa|htU{K$CwQNE{euH@dA5N>RH#6U?SkEj0C8C>L&()c0
zG>Ba*HvP}RiuGx0Q3IgCu~sLrdxTMS;nO28qO=GWh(B?6?cWfvj@wifZ%><@Xde7Q
zc`<+dtOXd?#n`uUZ2;l&7{q&>5qB3lt7?;bPCvHmt&QjCdd0J%ac3?>KcESY@<9Ax
zr2ZDFJQd!Mcv^|H2Gr(Xc-YAL1=7Z=S*{cBAubR*1YLEZSdbeYTJD-bEJ7Oc*s~(y
zIvn+STNb`w+lN*;$gF_)O{z3rFG3vWk_S%K6p96KvX1xT{75^Zdd~K0v{Yp3t8Qew
zuS25=9LyFK4js~d#TR^0I8@ZHqoeHuJW9@rP)fEY8maFS58|68z+llC5cvsz4;CFu
zp6soocW%2POH=kXBg898$8hlc)kEBJtLWzK{*$mp$bEK%d9MOlpJe`}esAfyyeHLz
zq(-wy!3{zZ`~W@EvlQgV36W%u!bzd>#9(yEn84`TirI0~RXLiUVh+OGmC-P-qQm@%
z!7?<C(9vp9@@NSTqx#DK(F23zdkAB|el|{-c4!h%^0Wyz#fXa@azu_+h1(Bx+Ikf-
zJ=(g>d()t-zxI0Oe*lqy>@t4xid6}6f%dMyQ@ZR#eeU;<q(s}Dz6<+RN6czi40lJ;
z;xH(yNt%{XK`DM!11xf&uzMCfeN$@DYU5paIQAiCm2XM7hW?Et&uMK{cO0W-DNve@
zw=*V|Tg1sOczp*d(|r(dKoLMW;!22!s{X9cF!#N=O65aA%eq=>)fdLJ4#Szs=~@;0
zBC(2FR*-;HcfK_z^>C5UQAlKX_Nk5V@sAwP{O_R+zifzc`?Wo;+7UX@bIE|x%%e@J
zTqvdZ5R8br>&me_UROK+-aqyn6YRa%y-e#Vz{GCBRgYg$6F!2%C>R_BGGWGt`RS@Y
z{rO#^Q-9Qc*;LbVAeRD+&rFvj?HttYxtLHu%9T?YdH2VIz&CcKo#H`osS#ayu$ALL
z*%T9K>K~qrF%*%_f2SZ@IS&}WXWzeD+D8t@Yaz6SC`Hw%XeBz9D%xEdv}KL4X1%-i
z)NB{PC>&4N`|~);Wi)Wp1WBMi;Q|v9W+ntARrt@%M#J16?9a=VV;U~}LuRjo`HO>b
z-j!u^jb4nwk_=H;ugBK3qf>YXnXaSn%54y4k!8BYMcEQahq}*A5iO9!FW#kbyOhQ%
z?J(6_VfUv;{1beh6zu|3G!c;U4GYPgZ!Nhc*3lJX<#cs)uQBxnE0M6$5SNzQt|^xc
z*2+d>pr-z18RT$86tQ~mH?5q2lRLn2`pkc8Qqv3$U!joy0hqHM3pN3)Gt_FmG2}N~
z0c;22>gnq1`G>W}qUgG~CNCcXwgZudz;<9bZ9D1*r&{%?az*-Xe}5;qU+@LB(#04U
zDS!V%6?BCyy>cO8kpMqc=%D=)MbUKzZ*q`icY4zU?{P-v2u@w5Lzi)cBxqrv4&}I`
zdK}E00-?$QMg6sdI;Vmhj8c=Pj(GIAcZu#ymXeb93yn+w(upo%ivq3#$@1r~OLENQ
zgOT5sn>whOxg5~Fy3_JxuygyBQ57x!Tdi{+)6Cko1xA??kBs@b1a$C8D2|!KzsfBk
zCXf&#WO#?Nk1vIV_%4s?S!O<#W<qp+kTX{{2dF8~-9DR1OC}dD{-x+g=Way4R7Psj
zY8`_cd6&yLWegW-*3TGNV*(b&0cB!H<CQS!M%-=`1vC_(-Xr|SZRxuZqp@ez$CG|0
zGU!rjPZK}Rq)Rz9M!}Nj!i1FXU|gKmfyn!jF<uLf%u`Q$)4aS_?Ze?HH>MWli4{Cq
zTyvi|AKqL-oD>G{$VM5^%9ks15zmvnvtjOE&GHg@MEKm#M_{2(_(yZJaNh#vEOB4(
zolfY;x>Tqv<o?hGJO<!UooFp%steRGQ2@Qm3s{%TzlHdteR}hnSeKG+=*)@8PaN9x
z*FrAfCnl?It8{dQb&UW2Nr*qI@dk~+#Pl3?_^Ev|H?sdx^(c&CV5|Yi0`cv_6p@Lv
z8TA}hjv1WhZ-69vh5;0O(kgl6K4ezYW>_hWrwcAjp)2X=L<AoV;`9|Rkjb^iCTamp
z-{SEE{$$Y<Q=C8kWsrk;ORdrVux`@TKkDJJ7&1^ZKJb8%`fg>-d(U1MPg!`+-`Msn
zc<g-hnRhIxub{M8h&OZV$7~bqyOkJPIsA&o;ZfW5%x}K$F9c)?G0I1ASCJzIBXT;=
zq|1(aptgZtn75PZgO)>gID#IAEFqSB-;QlpPT-o^&OeNws<P)<C!&o>9p3?hyU%sc
zVMO2ddp(COB$yKL%I%+}*RKyS-U8%edqJ&}ZHW$wuerSBa|1@y7M?~9a1aEAuU+!_
z=)tOJ74E1)nusYC-!N(`0!2p&-nGRh@(tBG_^RFUgEHDDzsAPZ%te{~^&zdXH7p?+
zjJP*k#*Z7M7a(g~OT%Nv%)IBc8P?3;Rz&%sE84{kt0Eb@Q-;3w3Wd*}9u<^gJzOS;
zbUp-m-to><Ud?kCygl54t3D0&4^&l)Hi29d5E_s4Q|+ra-=d)?fHU$IN?j^k@{Li}
zpMw*H#h)H+y{b0Wiq1DRP8K*IBIh9K_m+l6SHBGm<<TOvCUOw2iY-FGP@dWi_&1$D
zlx^ztlpH3rY!oHE?<+FgD<kyg19;^!{45~y7IR*4mwhPkNz2?onmb38t3D(Ss)z}n
zHfWe)O!f1Z8FEPX`q}F)SVquZ(ih*IPgcbhFTjiT`J}8gMu6s?5SEW}k}L$o5v;;Y
z-%Y=7O3RrSKAIU!XYz_Xqm_v8YIQp~DI*|Rj*p~EQyvU=UdKD8D?a>Hhx&TRs~VLm
zu~}C`v6_gZy3$gJ8lj__A`~?vim2pnmS##Kyhlv``YM+;VrJL#D7*Q-fytm7^s$v3
zD_>GIhc*)9Z#Kam7skgJvoqkYk{76BJu`w@7}(~X6%}~cLp9Tv3i(5^)ZVq9!{Wad
zpg!)1NB}_0{jZ_1)Wyt)fu9>SdUDu1taR)!*b`Yg98w~QMvdjKL+y0AeII{6@Lv0@
zzmx%LW(o=Yn8qgIkw~sQ*>sJX*o2}Kko<%4_L+_x<#4BU$Pk(YULtWbe0*1Kb3bI0
zm>FwdJe{rMojg>i|G-8rR(2PI@KBPSGu#0acydwx_o?z!1j}NZpHy!3W>D1NV5UO`
zAq@zdX~bzfPQJVs-wKaX5|-;R!um)o2rM~xT&%~;`<am}UH8ey{b`)Vnou=v89sU;
zlR2o&LO`*w>9eZ8c&8<q_sh}g6CDsIuej%a%i9LsLksyfwBK+mM6?X;^)}pHAxXs%
zw%_@Ep^@Z)CS8=<K2j6Fp#~N#L%@P1j_gvj#7-Z73AxK&JKk-Ur*$A<NLs1{dcITX
zuxoRRFc5d4QpTNCXe1G0i|p-9`7rlOTiEoqoG7XXiQ*>!aDz`5;eej`6Q~*bz|<Xt
z&s)JwCdR(_2O5^#+`8izzG=Nk*X+h223JL*tJQ9GbFcu*t9r98pQogG>JAu8X1WyN
z2k_xJpM{7G`{B<8D0%3N2u)OakCtr~Tf4qg2M|s_?@3ZzOqQORAT=qT9Sa3Rpws=W
z&|N+T=?4sYiz>C0w+Nu{T62e42<^KYb8&qF?8vj0BxGZgOJN^eI;Ljyy%Q+xn99<Q
zJEa$@DnM6_o<db0f5p|<Z%sd%_~0DH<^UWWfGscE#6=VL3N4l8H-tOmRGS~XA%G%K
ziWvrKwR`?IfzJj{V1jdVZ(s*qp2?Fhc|Uacfn$t_|ElzChUmjPNO6sC9_LnZ*DpCh
z%keK&p=0I(!W&=8w!Z43y!UB)a2~_hutQWRlx9%lnUG|O7e+5UaP;hGdw7@ooTeF^
zNpnIwsTBxHxhCpdlIrBF=sw_n#6a55{}|=rxgu5FpL<)$$2^q+aJyGgPs=a-VSJvZ
zU;jYpr6=`WFC>rVh+MjFcG8QYn*_y=)2dfHtC!phvqJ|GtQ^oi`F6X|g;&C|Y`IQy
zfbrX?u8`C~)%b#$PNQ%tXlbLjrhTqrN%p8mJ8^NMe38b0n<)|oV3aH=1c$LeLMXZ}
zjqKRa_Ei1$?ub>uRJJzl^w_GiXX*aDY%Q7x0~7)~*OqpvX5_RV3(GtCQ#32nF9FXG
z47y28v%on0=2ZX^8F$FN{P=3Tqrpj2qN$g{gtz6gPb};|IQjhDBc>2y*RO8$8t%;%
zD!UEXCi`}^IC2{%Tw*!MdN~nldM0RfR+bTHuk?}aI@~5Z(3xutgZ-eWH*DI3VVj+B
z9u%ltNtC*j*zynIUxegkvj#Q+tn<3AkgUXD$>QSWeUX(<-jwzW`VGWB8KLZQVD%sp
zy1*C-No8(=1RTm6<de${`Tw?c8TPM;1hvOQbgjwEU2G@~%Zbmyml&b|!9ghO(qjIX
z&_KNa2?sX`Xmai{u*C|KVxxL#?D#|aukCsCo<7S$p{9hwM%@E+X~Yd4fAwP2bb~&3
zE<rb+8+W}Xk<ix7oLYTuXe>YS8C)fxkhq?L#=o+4i)|_gpyBPu|LL~KSWG{g!-^8K
zDjoXnI9L8QeLU=z?7R+fUR2lQn)&GO{h7`Va%UB4(BScqYb{yYKmyo@&BOH_lC-%p
zMw_ztiSxn`5Ld=tfp>(vhRiOW5T*{xwk;tz7jvE%sQ4{-OI&kRI_J8^7d(16l_4<l
zeyYXDNiT@6bdE61uh-=HawMfZ&ZAD9Gob)_mw@>dn0ZV1MCdiSlybgdj=3jZu`R$J
zVlkO_`TX@K76EC4#Ug&cr4)DZ6B&_yD&}J#JhpjAq&gbm^(ByPi0j)qggf>Pn}>li
z<22PsSr$csbaLim=ALWkqYQomEm*aboORR{NHE0l*pUN>U0Ky~#Vh(^G*YbPW2=zF
z9DGD6{R0&@?^djThlq%5coug}KFq7**E{O0O2M*l3jA^UkEYFfN0OU!yo!S%@@YhQ
zC?gl5o8zH)XfS7alJd+{nhUEJX0^Ott%!sk|I5q2%w%WwWy+f&AO$22zXF6hha+9o
zb5!8I!u*~>5}lwFd^tx4VE(rWL*y0X7xYovjLz)qYF1DUJIobyOSp5T+1lrG?>Nnu
z|LFw)@O|LUk`fYc<!~cLiQ*%+eeXX&yv%=kNhv#hFra3P`I!q#@sP1z<|@!MvNppF
zDKI^~bhwUxc%n2FL2ui@r0bai!Kz}+XJ48L#K`XELtwrRTVMX05b$mltqrMdOHA&1
z`-$8`|D_EInY{8p=wiPm{vTj3WxUO$k8Cz85-q!PPZ^{sKzAc;iPhr~rf)yvpC5|Z
z(VpF%9DmTXWpeb!mXrLO)|JO1yK#r|tMfm!O57_Sx7m8Vw{oIsMKbKt_utE@SKz-#
zFR#5_jk+VZOMvg~PO#tpD=T$re#gV`$LUkc51NiLPzF;l6irU@>>0Hb-$CwlY}`hs
zR$hA3zWZTPcs8vhB=I#qd#CqVm(@%~*e0EP{ruJ`_-;PR-(_QQYjb;t%$sVnqcp_H
zy;Uc25>A|LQp#Vtyr*|*u8B2{`~8c_E4;6#=QB|ypTWGWbuL}2|5t6%q<HmI2`^(f
z8uyMaO9$+H`OeWu-YBJ?&Dd!ica#k5yZi1i*Q*f^=QOYKabQcnc{f}avuEUn{C2s-
z=BL{bn}pB2F3(k+$N7cUB#xsu+>O8h@bTZ=-%-EDlbhD7#=C6EpL0GLHQsxwEa}&w
zOK;lLCd=BpvW?nqI$7#Jts5raxLSSUyVqH()#Iid68F5w%sX~V1*UI^QpPJ&J1Zio
z!Mm96WO$3;Y#`B2?k=Wq1&PKAj4^ac_~dUk+()Bo|M3yA^UxT-rIlG!(DDk{>{~ZR
z9+8vpeL_hJt31Bk{zQ%ZFw=4k#rWxeQ6ORJZ$w@~dIQUcC~5+vRQ`V!n!iz(|1Vg+
z*|9C}1&5s)YWPMUirV@`-dHIO+R$m~4_eH(mht=ah}%o>K6%J?cc|rOZ{y_Xx7zxj
zBQ27owI=g7L9fNec4unYRCmW=JgUDtnwI%@4S((!#t@ITAh?kW1~16OxV?du9C=d5
zV7tn|&Xqh;4E%R*%d~{=@8SoS&K#6~-KYNrc6zsG<sCzi-S+21a!&17+tgpgH|0Nn
z{m!?0TijmqAdT42Q2Z;$=kd&<?VeVP<@dGF@pbIpQs*b@t%eG;0YxxR@p^##i`Rp~
zJHNlUpZ_pEw#~ntBSj;rit)kO1hAC`zX)=hKuD(@X^RE4fx|M@=xm0d<$5$6wcOp&
zGKVD+cy_NVp8NMV=m2d=pTV6Vf&dS9BSGGFNv&}$UXr0{9g|BBtYxjqYo=^Lb?MjM
zxbDO+0)O<>melWr|AV+UkBfPK|NlvdLkm(-4WfifMjO>|LgyS3(xzovXfSHjNM&k9
zIBiOt&^}{1N_$D0mWeiLnn5+~O^X^e)l}0g&H8;#-k<mTb3WfszW@Dx|GD{NW_mrZ
z*L6Lw?Q!Q185M*q%=9zIV23w!i@isORUn#k4<TE~HFfEcP>MO)l)Hkd;VvAeucz@E
zO>QX`WRz3FAP4(K^|`9~pHF*;JK$kAf`@*=5(#&N-2_p?P;PO)nK}OpY~ZvW>=q9u
z78R7(wb0x*5vP2a`)3%es3788j;-bZhiW2UaI52_fd8sD`VZ_biH`|!bfye0;m-)^
zFbwZLkvF)5dwQy59k+(NB4RImVNV{tX|sjOa^xy5PmEb#R?{&R0e~DSG&6~C=vHUt
z`<agre$h}*XAOC#!2tW5@VEE~<^(oQpo1M=Q)fq*`-c6R5)fr#d+Te#I$KPSoyrSM
zaU@I_8ClsswYv9vEO~yHWMm<%K)9BN#*2FE>L9a8*gsMe-U=7YC(go*T_vkbw$$*S
z6s!XeaBBo?A;D2zg>1_gwo8PRh#(?Eqi)Ji61HN;FkHfJ>d6|BnD@;-2-1-HH?~FX
zc!Pm>#RUU3K{?AU*sVdWuC;fs30}}g(-6OjZtwD(4ehf{gI0}9q0|N>;-Io>w*VgC
z*b1-bGy;>K-deX8K5Gq*P56$C=&#|AjlqqJD&}7qwBcTfL#C3agCvm$m8K%<bS!5b
z>xv1Y*aq&ctF!MCa2zzT-8R#5oFMr$lVywb3g)-riVX-~y3EVNV6^emK^pr0vnSUT
zU|S&y1xTScqXzP(X1qo}NEjv-bBW0EnM##>pf%iNnknudG*VUwuC3$4=0iDElywG}
z?)!o@ZT6T-b{@*aeE1RUtNU`6MO~96ClUMzc5j^{k^e;V-4wm{9bJv<%;uUKcGhqL
z1(Zm8oO>^}^zReXK~*FD7xGq@5}=OimhGq8u`_q+K3O!A4wn*Z?B@Qtr)3(NoEd8c
z$LfiWUYdlWU=S=u^I?-`3b7~yqpJxvuE>2bNXV`g1&=BwFB!l>g(J9btb;`m?}LhE
zC%mPOt7{13vWR`S3?U2<$qL5nvcq%+CySW}`^rR<)t~GOjH{SoOil4%2+<^ze)zW&
zb%j$DW243(&fEx03|kKu^*FA^KJfM8cQuJ$4%rdJ-@eiy;<CZHDTt?oD0B-q0J{&!
z>yjk<<JnE$|8~P&JDe}kS#Gn@<}n5c^`(VD=U~4<^)`kTU(Gc#=3fp4;CA&`F=(VW
zW?5@K#SjXe;zHII&dL@a6_VN%Az<L+qbI&~Y$(A_aCWcAiSC8h1PM^<7LnRUJLY^8
z5Y;%fPYkIT0<42smZf09ScvhWi6&|^=l^hg_jOoOHJ$UY`QJlfgUs#WAaEX-dfc1n
zXt@A0r)NgeL{pjUl0%xS1(K%5WAZm26!N01ErF|$(}W`>p7EbC*o`nl?4JS^{Jeoc
z*P*^79y@OkDd?kzPdSboSPDCuU_G+8Prl{mT3!qmG2s2jt04<t2<pMOvHR}4zMC;q
zadmorA*q~!_Ttpb3mkWaBG%0^5D_bg64DU60K>i>mqRcz|NcH+eW2Za`|UHB`!0R&
z){qOfy0az{xf}noxFY_u(|Ow`chMGv(H9o+M$tE5{yrG?hw4=W2@4S>RX)6g&YFPo
z56T6measq#X*7ORo)(m-pItMjY@p%Jf1?r@{$0rzf(mJ2*xu4xwPVBv#i<rOS=BBa
zf?y|S4%>K$ZjA&y$#KoQAIs#ol?85>gWMU5w7lU58yDP#1=Glbb_D)0+N{R(^~|AM
zq<hXU<!m#>p#0F$oSU9=f5zDjD_sUaamEclCWcn|E~(`T5f(=8jerU7N~qm1@W)-w
zbSfxR^ka6`zjW!Fqt@lX*>A9OoTp{wHW*P;b>v?7Xm(vOo*g?h0ulU1#|$7W!@fp;
zn6)GeNSW`B+<0gnBC6Lz1@;aF7GUhHuQLVa&wj}#_<c~6T)+OLl#&S(nY?=_8nM}b
zi-Mtb6AShbCUXuPtM9Lmz{TFyQFj-=kyr|^2%wb<t*DL~6V#z9K|k~LD?YTCaJYZm
zuMSFBfTuWd@`q3o4r2;4YdnRalSPnI;_vb9U4MRo@Sj68EN8;G^F*E08pw_p)DuCK
z0)<k#Fj&GGc--PX!CkP1&8b+RHYNn(OcZ+|f-dwsr$~<`8nelAI&CPyM&0^zZbX!r
zHI+`KNa_#@2Dk+r3a8-rMe=?)j2YHRC9FurBS<oySRpqp=#iEK)>g1OHE_{Ev?D4+
zQ_L=j5<?G#70vvWSmnXPGb`q<7hq@wl4~P$+0v|mY>OTHBz+VKN`%;mLs6=}CD&O&
zIN$ZJ&!OL9QJqYIjVlAM2742R>(5xjBTCW`@&#d25Cz9_p>iZdusR+xATBitbbEm%
z)X@8xlQ?`yV|Ew|8i!M?blQl5&%dA>J(p;S5cNU&ywj58$|*!>9wmvWf^eOT9ioUQ
zMJtHE2i)B{@VCTjGYn~BXyHFh5)+kC!J=4LiQ*SHZ455_Fvs12?0LVTYhKcnapMpp
zx41_#hE?}vt(^Kb^B5xbIP0ROr%L}{{$5}7qFbug3(^iZ9x`&aCX&k6s{}@QS_IwN
zX>jN==R=wyL$&BzBLJ6Z7AC!2-t4sHVcL(8|0E;L+h9T7+m7cI8%+<-N{?LDR}L#0
zx0TNP|Kjn#2`ep=RU~4WTruN%Lh3+O`d>nox&)j^G68XVtPpKgHTrfC-P8PsJL>v$
z1=ClCzBd9hz^c(%zB4j`n3gi)*l(7{AJ#r{{m_Gi3gIEK1v7*=L@dEZZ6FBxLh62j
z^8}*#UT1_Gl6Pw3PNf%0*_N}>@dl^gXDIFHS4p`(lg=Wxbuuc0%mQPM-0_(EOEP<B
zC}8S5^u;<(?af0Q-lw#c5CoGUZt7OGL*3Nwjvj$~NaS8%DMnkj3qiK<8_ctLfc6#Z
zE9ldf2LWGlAcA+Jvr=69;v3g!drCrzw;=WA76Ah;xS-M<avHxkqOip>q*P#hR$v9;
z7h~6^bgl~hd(B<SRUPB*)jRAa^YT{f_zlH%HB>q&^}+h@jdQE$>2;C4zmIP<+J58O
zNLVN<6;~!_b{T*F!=+k+0`pf9xUh5{qjKemYy$p3XwDj8D(A_3)-^>H82^g`_de6*
z^x62SJKC|c)p749L1ZTF_yz@{0yCc+#b+foLzpP$m-a4>sBrfiuR>iAb;-Za`<`kv
zTd17<9BGkF@WL@Mk{g5bun(r06J~64<70LMT4cgXiBm0X+3Z!BYrT|k8wzx~c$~TL
z4p!g`b7{2DoT-gu<D7<_LsmoYSi&G)y%TvoS~@*S9SfF&h<2pAs7bV9!-933O=&c;
zb>y)=>?D>MB%z7X5wxDcgC>%w>jj+N^&?C>EH%!zqbB<3d>9#x&BRIOs%ryBw)W>{
zq6Ebn+>dEhhsy|DTS)=&3(gPa%^%<>{34{vN<K&Q53Vwq7Vz(Lpr;S(t@)wYmHBI#
z`MO2P;g`=FRl#tUs=<})#LEw^$_DJxMQ?#N{us|Xy>UA5W&Kc-legxONnzI}jAy!`
zq3Xz?rbHtkzcg+eSI;fy#Q#sZ#qgEk3RMz|6)KtYeqE<A7Bfc`Ao!Vjf(CvLBJsr-
zeFzjFcbG0HSDqKd^Y^-qf3mQ&oR)jkWijnf8JeDo**@o9oi2Og-tilxXeX+(pq0i`
zSkuoE6%#6dtG7}YTo4!q$!@-<XSs7a!X}g#O$Z%+A^uYZTgJRHw0p%p0=Re)ZW?MA
zobgcG92)GNS6A?W<=WK?XplqOr&jP4%ew2>J;=5A*;v{H(vEojgTc*yh8r%Jet00|
z3K6|WP)VzP#vOFz7g2E2FM^_XoG*slW2x5cJy?WQIs6-*!LJcmFu!LyDmjG^4oFPH
zFPk-#7Dc}nbaN&RPj7*PY@M;AJ-ah~Xa2z6)x!2c$ksw%nu5jU)<n^_eBF@0Qi+sM
zgAb)!Bu8qSPapg6X}J&libQetBvFVI*&E;n?!Ai&?8VBfx3h8utR7DB%J=4tw6pls
z&c^d2CW?L?V*j<huiUTBD5wZE=z;P=@5baQx-6~}B$4;U{@O+CnrLKPrGsGMLynzd
zV9qSPVXqs<8_xf#qC#XJ)u@RtK&LaffAxy5v3hruz=+M)Io&~;SeA*TZurR#yQG@D
z^c!Q4R$iq3X&RJ5p<JNN7VX+EfK+yKK5zM=S@GHYrNseT^`IN4<*QD_U9>o%8F4e3
zpz2k0!Jwi<pW(#sSh#knG`{`!xNLd`E*`P5<Bfl)E?zdK!#`ywtU_n(!9m2Qh-f;V
zZ9MsT$J&h)?AN=q<vROi?%gV}=F^iWF8uP(eavtoMK)M60^+Vn`!n_p!Eyv93}Nc)
zP{drE;ITd*A2PN}fSa*aU29NZS)?RLXQt64-o*SzExInU3b8e-^<;8$nhJE=m@jS2
zk59&2vQ6$htX|V@`I!-6QvN&a5?FfN)^&b!Y>4klP8>?;3kwNKti<AQ8nQaWHQ+|Q
zE9`4^4RnE2%DwMqE>XL6_K;xYiCobyDw5w#S-D>CE3XF?*&BVN{Xz*03*j0v-&Rje
zP4AyMw9;MYPVK$#)vema&a-%iZwZ6HN8apW$&}zZRV|*Ia5%rj@4+?_*YX3(s0J6@
z$#7Dv8NBmLM5dTPwCoe#47ygZP~Li-Y$hoWE5H>JZ9{;MxqA!$OQ$fzSI~Wq5O4R|
zJV-g(nZDpv2?PUouqZ-O0)Nd_tle#5P7qOGQC!6V)?hP?NeM%DFb|8Xc$hLs4*OhY
z$#^NaThFq|d;iD}7)2>``o1`jIZ>p0YC&(U<)-<$DfZSfluj&x->%d7=0Q9x9L$d9
zT<rWFFI4apM`{OAdH1a~XTK+qMn)nx%Is&f54zdc8)mHXZ`ShZgR#Cjh@i-Bosy`N
z8q@QXTQt{HgIHPPqaKY5S1#Ot^f0jTU~`qRcigS^ZL7RBP7=DWmFiwq+^YEP`jB@V
zVQsD_Nh;%f2-VhL1^uV|T{w|0tGI@D<^cA11$LQ><>e^5w`mW}E31FuYA}Oae*L@r
z*v1so*~1&P4Jw{}{Qdl~aH1b^m{f43$<&Nf!ikYR{mK8=1O>wITlYy&V{w((bJBt}
zeo2dN3G2NzT(0$Xhr7^CaOUu7ZbR^&D+TaNX(_^fPPUw-M=bYF4acb9yXPdKEwV(O
zf*wB!zjbyDT!;FvlQ)W+XGS?OkuY8zLQjZMt9=N-ia~yJ4ElU-DED0Dn7T2gC+7jG
zd%!>x&B<QnzOgotYzBk&Jx@OryRGU9JTu0opBZdED)3B8Sa3(17(T!0M!&00>^beq
z(q!J6m<I{9JIstgq<3$mxuk`L(GSzU8i<$EReBHShFCP05>{YB@b5Y&J^RCYDNj?H
z#zV0ihf-{6TO%*MA^+ah)qX25Uih+MH93qnQ^oPT=5&nR?ixg^f3op?5sNI4bYUu!
zT!?Ia<Wzf!?;8BW6Y|e8B4p(Zb?aX%_TJMzXSB&K>+$(3d!DHd{U(1f?#K$>*$o@B
zqGdPkJ*M>c30>9Ht0yaSl2qelb~Ucppf~Ke?$+yCAH?B&1Q|JvAsf*{2@CmbF|Fi#
zpw5Vfci)Iul~TeLmn}>oV62%{g3hr1P80$6MZ&_0J1v9+ZU~CemqOroaxQ4n{uGBp
zcq>ri?p+ThaE9arZ_P7|M3^Zrxxe0WXwFt0=kdUH=ptcN_y{g*Kim4PHQQR8YHMU8
zA|<70BX9g6B2n!gU!rW2hbCGehd;8?jQE+TZN-GTTi;GgdTNleHd@Q=F8NFyceZU~
z?lLRZRJk~X?`l~+^kVEy2K^)({;F8+*ftrZs3WpF6vO3?4I&OLukmj|$n)OsT=$;U
zDb%9Xgw_2eS+InyYTAkvZV@`-*qzsQd@Rf7p~O#UbMl9d9lAG)T6hYt7MX5ZPAeP`
z3vGxCWqt&+K|ysWl;bGMhF9OqB!;y}8W^~>qV>dire#>!6XvTq?EyUjQ9>ZT5gplt
zT0U)5lOx!RZ7|W>&S&<W<B{rM++In83A`9PKl60^PDw3Mgvv)OP)&%zqR$!;`&+^!
z`RtdrRc>n(Ec0f6!M-;*^km4I%NxosxS+0VY#XVdUo-P3#H9o`#7RFb4m^5o$a-2V
zU>7tG*zPs&*np1`2$5Bt_&U~wDLC&wwwZt9eSz5;WYw1m9VjrkNT0j6qaO0mOd*Cj
zr^XQqh7L4|&;bOmfGOBk*z88h0-x|5H^M(!4S!QIhAEQ_!shcBt6StHyCS)sW5jI>
zaVH;hVW~I<pSx8?^BSH{uYE~jwd2V2Y9|<*^0Xybd~z%H_9MxhtRMs?VRjAtYT{>G
z9W-6uu4ZX9f^(?x4`XuYrjQKEf@Y^$la8)9k}dL?o`S7d7??H?T*6WK%gK<`=Ruv!
zK7rqSs*a?j`U%;jMN*FwHkINiGi#n(oXTp5kC<B%yAT#wb5s;Z<F%Gu7?sG$@tA@U
zd&^y5^37h<fnnihRHw_DQa&)poN&K6BsEz7g+YXd^206uFp}ACywZIW(#te6zSVgn
z0?)2ULJIbEHaBg78Lqnur5tKEa%>2#c=HcK+9rb<5PpmoW|>H4Hmq16%!=c7$%SFp
z<l$xw#PKNc41|AotLDG~VVQW4OI&yWm$;=qY>7WDGQf@Fu&kzdRI}TGZ>vYJ{RM*c
zs2Vy3%hcYvJwUjcv6>vZb(SX4g3XNeN{Vp8R+z*<IBg<fZWt63cNvSG<LC<4P;=)P
zM4^Fro^z5NwSp*tOB_v(Ughv;JkQEqDZ+fF2$U#`CH?%_x40lpxEssLS4b(sF;If3
z)b9;j>#82b90{WY=gh^6zQBZIl{E|kmL+1~{-C7#N`@4~k4&n*2swwr=@Vil9c(QO
ztYkn{TtNOLBuJVh;;~H0SILbr40+5zGD;Z0-e&fSzc7PYzBG=8OEhuD4tG<eNQ2-`
zSLB%CrYYhw6n1>WH_0p90(ce)xVhCdp$Q`uZ`+Lyai@x!4TRrQ;Q}O))ymDs>4gYl
zA*}*5PCQcwx9w+G6%XajKm=bPSXMtx<Wg$#2}k3GF-HSw-Aoa;?r?O=Y+7GtlB<BS
z3U-@wGtB*4rKA}*Hs5>?BAJDliJbbXwn{2^LlE)CUR?8RG1cXL)k;1=m?gO^=p4(!
z$(!@d6D4MJ;_Z-6cs`<qBpH&-N0#EqLNbjV)(eYNEM4GEnPA&Y2p{m-K_N{B!f)|4
z3wjLP+1W}Qg;*Nqm=3vC#U>swHFCa>aYd*zVDGS1tX`t%aHr(ZP|!8*iC8+JAu10u
zH8)^8YQZj;st&yuRL`LaZAGOfl146$#-Zd${o-cI2i(G(3N?sfBs)yxbc!cZVJrmp
zS4URU$s;1AI3>{|ixnazNCpr{injbi9qCm_tZ5{jExR#r=Yb(FgC=f&sc)1w8ulFp
z$83O&km`tPk!@YQNgh<v&cclFW@FE>4KYMy$h&RqkME<rnYGsPfysv6AI~1cBM7t?
z^8UHe+&;;tKG!)(HGDxq$S+u6!PwC6j_O1nQB%nR#pf4D_-x5N@e}&4L}lPne>hic
z#716EfvAU_F>Xs#`BN+@;(p+sIe=>0euRYbCCgMjX)(EjN~d%c@Uw}Rs(pp_CdB70
zlD-rO$||<prz)()%}<T?c~lcK?X`a3`ip5H;R=THU06)*ZRng97vnfI&RCF;j2mrb
ziY#cw(VFqpYGqqkjlDTecG6)IExdm8VFf4eiwoOwlda{^4`tp3B4h>K9rD+DNzFwP
z%8YhPJWgaYBh}DI(dB8oQ+^`ET}h}`{gk1&m`sG^ciTzSgTI9YKgCGQh*U`yu9TEk
z2Se2G=i#QU&`#Tq$|^1O1;j_RxHvdI2l&5MZ!a31V4ujvvr&1{aOW`aN}_2eX~~lo
ze9T`haK^PHLbF|EUB?H*B$6T&F9H?J`qLmZT=G)5m3m~g{WrGN0!gmuatbNU8>^C}
zE*#qushv%OhUOXy22+u9t;e}<O)O*42hUBMqV?d@i)gWfS9Y518@BrLa1|-ZpLcM=
zpPcNUrsS<b-p~3zQmD;}oU|qG`%k!&9!_oaGOsU2XUWTCUts8shPd&QxRDIiP*cfQ
z`=cFOY@?6K-NZ1xZ0aMpN=~_Tp*HIpB`vrG6JJ6@*WRi}#ZBM2>dUX%`g#qDUaPX6
z2haKN^Kg3HK8DqsA<g)h_cN7j=4vwjjWrqs4hC#%ybv?@RFzb0&ZdN0<LOzFG`Kgn
z9p>UAFS%vO=FHl$^_g-_bTML9voi!WL1e;m^qCe6+65SRFY>BRO7t>>iOM)8jSE~w
zL1$)6#w_J8YsmtX<w7(Me|fneKg%KOLGwyW2T{Udu&F*#5ZT{AL*4-+RGGUODKFA0
z5v_y1uFBITeI%&QgrVY}bo?Qi(oA}q66G2(Qcxf{XMX=*w}F3O3{<v(j)#~%g-a33
zyxOZKy(lDT&!Dm7&YFc;n22C8zb4j}A1)cIH0S?)YbUbNItQo8%q-2uPPqF9{;3hW
zIyoaIR}uN*&nWsSr9{`E@2Ry>CY@-`H${4iB|5(Rl)f1&mU8T29b!k-R@VI4)pbD&
zp}j|Oi<gpr{|xZ8qBX*AD`4VzaewyWeWh)CE%z>DL31vXbrHv+&GS~7yxWoT^4(4-
z;ogy)W0+%=_3aR|I$L$a(8H=Du6ch!;ZH|nw_N_4`i*oetvgkiMSN41G5gJHY_QCP
zm8^6y&Wl$b6?f_btieO*{@Cbll^Szpa$K3QS6*T!SSRruixpGhEqNR?KOyz_fBR+s
z{Ac;e!Qlj@iDc4)__LDpci9iV=h$7d#Q4Z(E*#lB<of054!)9);XwPYNYhm|aV{+h
zw{zuU6|_#j!l2c|<leWJDuggQaA7IC{;#9>FORaLFmYMTu+B?de&vhj?rrdph?63&
zM&z9C9lgff-MI?yRUlByA-Nc+{_W(G>xycWW8p6!fHjhy6!$HXVm^2M&~g1GKb*7S
zOwL8|cQz%^I?#D~;+N7yK4ZL_z8nl?wJ~F9(6z-GUk)zH3-=P!D5?P;JD8*Mj}Qtg
zFCm0@i!#ZcM?ZZu75ot-gOK>I#rFhV-o&<L1h7R?B4t>b6|1%?h8vO*>kw-z+viB{
zCZj#Oa4~f;EsWqCZ*jgj3`l)C|G2LH^Px*Gu``>(N8&$O{0+-bDagjT&pU!8l1%X@
zEEGbnez6alAw{F47=pET>?$uklj1BW*dghTH>%T2>!q2JU&92foG?{GTMjcpX={%7
zzh902@m;oxrsCIqR{W8oZ#m-x6;Vf^zpaR^dQ%?=b+x+QbB(-{H=Ms?A0~FSvLbAM
zrgVkGiN>>^QU083m5W+|_OoSvTXAYR-vKA&WcqFXcbxdY>|H;6WGh&Dw=1i9g`0b`
zhqHxGe<l8;@!7otUQL8@`zFsF-1UC-_9LG5V1p#r(93XSrMI`2k(7&K7KYG3&um2c
zdXbbTNiI!}f)RqK8}aYE{y+X8>Hqp|Fs<31oB#Sm$Vtik$+hivb;8_v+vzcjaf)XD
z<M%zH3;4GVRA!YFi<0we5ys1T#PRJe@+y+~K}&QLG%^{@$R91$9ym%O?P{zJgiO;+
z?!8Z1(h?4@2|dTB-_j0r0u$`#*AshkYM_fyluL@oeZVYM1Xy@4w`p#;MjCLUoX=1G
zF^bj6XC=!azfw}Z(Wb!Xt33Z7?)*QltLx<8c9FlbeNL#di1i2VhQlclr|_`&cvSk>
zK+9e-Ir5yk&sd-O*5#*wrZAEbvL@gog3{v}nl#G+M3hP8NG=DiyQHBhhP%mXc0icY
zZFhq_Ts8nWe$SjocM*zPO_Rn(ZDvR>c+PgeeW7lNsTO}v9nLGMTIU~AnGbf|F*!sF
z&1ssB*5-~Se|+#?wX@cvmOpqXd@nvdJ5Rdn{<`8#Qy1aXbNi-sZ)!JPot-V64oyge
zNCky`Rtpw<W_$2+PG~cOmRGNl`WR~Bvze)J;)l{6_(X!zvycDNy8dkenR4p5^M3I_
zP<SDQPagn+!m$bd<5xDFTXy2{F4bkZvy@=(us@~hT&s#myr^Q`lKH$*hxn9rA}W-i
zjs)UdlkT`-677y)<I<+ADK%xxd{ZYC2ARU$x^}Paiut}@_cW^gTG*HZm5OsYf*~x<
zw<@>0rc_>enj!+`6<pb+nbs<{Y!5&MMtPrs^mY(!PpEsaP5v3f|8wZ&wu8Kg8Sr9e
z^R`O~C<+~L3m~C~;pu+<!wT>lk(yD@f2@rd<6FGOx<8iPF|*rUno$T$7Ho~w6r~Me
zUgHR{%UqUxDJOT%JQSB-t%(<Bahh|hfi#!1k(-Y@7`w7a9?p?pk)~UFrmz8K(4<yl
z7AwV{lqn#|A-l;RN7fOI=Ajz}H6q98B@aHTR$qqjO1$v=$C`V@p`4yc&I}@TRH`L>
z|MFz?$T}FNQAjPYWOX6O3Z+}_DaB8FQz+K13|p~aJ`=m-4?pIiuspEE_PC@f18lkT
z)e#hum5tTIh9n>*e12Uc!VvD}(8tz;>w9Pf6gl6;*S`kv6BhDe-TtR&!FXrcgVM5C
zvod*T-63Q}hZlKCYm%GXetRtHxyxJzkmbsdAMY*WeLkQu*>NH{tL{{K7CL{*0SF1F
zERq}3wjv~>hsIwQn_x$pP2%6_)S1P}LLMGjy>fp-a>eaC2h4b5D__Uq8Xwl(RfSO!
zF)dAztpk*4TKp#s56+Ti&}B22@CDYn(MF_fvso{2q5!dFrrT%b+%wfRQI)EO=u=Oe
zmv=cexX<xqWqoX@t`WcN;SU$DvWOjZ1>lo~Eb&-%8xiuvW&VF=wg2{>9tPn^KHUa5
z7<Me*;1zDV16~0Z+<|lMH@3Q*exgt&@6(&s;G~7?-_|x6ndL@b%D|h|zbk7BNGCf}
z#Gxl-ieX*_B{RKkmi2B7+iOdo+MtpQhHY)slGqNbZZQ&}fg)FR${xz$&eYd2cC0+t
zO&2%*?r|ped8;bbSc~E`p(~TxWH#%Hf0tHlJySgiV;<?7B$j3#9+(6!r}puZ{+P1u
znPrF_&eaJ1hvaYI1nlN7+30i6b-K0Obz7TjnY2=$dojcqY_|uP{pmsWQExSz@N6uW
zN(k3XnlOBiGU5ZfF*rsmPcPs0L{y&HQm<&&QK?@B%*I`S*=PyYqXb(sfgV@(^hA{_
zT({hp3h9tSPxgl!VOO2lxV2Cxu`IMCM7k*g{ZOzd$CW!p!H2Fwa_jdOTJs?X_*<8D
zI+o$|@9_n|KNkcj9CTReg>PVU+QHkj{pj{ipvLtczc82f;-F!oNF7-@8lps*DW;ac
zHTrG{_C$!bILtxofBVRPU%aIEPVm3we+;%nGAY;?zD`h02C;^fmUyQS?1|(?oWZot
z+j-|lmsGIL5NE(<`^aDad$sK!pIx>lbXq7VwqvCs*M?pLO7+?NoS@_AOXcvEyW1-D
z8X<ovgEf(F18TJ1k?znOmGDkgONgh{vI^}8PrR9XY$!5!G)poM15#W+30l>%no=n)
zxZR=@SI`NoOFr>5_65z@yH{jAu=sFxY|(D|roWdfAc1%=Hg$;Z8lGr0R)G|8`Do5{
zNuA5U+vcTT{66jL!i%yO#ul%or$zPvcVeH)fEFb#JMQRn9PEe`&ul^|Ush0BJ)49U
zHu`HHqo#Sr)X)20ALD@)k;El!Q>py-L0+?5piST(fv4saU12BwTXq9i_U@O$PD)<n
zA~}osjeuCAQS~%6r16x+s^PglJL_7`d>V8(d5U{o!lGbv|M<xh>XrSh)1l=IwY(r=
z1;a}0*>>EkIeRBP)K6(GXXSa2)mZPNzt|q7@)U2zxwW*?6@YHAnqfV;s5EnNKg1Xr
zaKd8DnqM&U6CWQY(`0+XJR6psUh`CJCdi@8t>YzAVsBruE4N>1676))i}t;Ng71Dl
zSm~<ssPh*!06J0rvCs}O5LHIOD3xm_YHt0>QS7=t+bqXERbo2^Qjj!$j&wUDXmpaK
zztR)(aYtI}F(r{)aaXSq;G7(_8lleZ+_v#9T<byEZ3JK|f((RG^)}F~w_oZ7-~P-C
zM$R|cgXNHpdCFn19Fi%1SIRuJxE$iGy@n`N;3DxhAyzi1E!&Td-cBvMGmC65(l&B(
zX*&t4#L*NtqtQ#<<qPlLzOajBU4Y9!oZS-O2rsN|hug+mD1dGDBrHfY&L$bfWh^op
z2gIYHU^OHkYmgalj@iBY@CbLZ;^$G;O@`6|#PKCnlRp%L(@wp21c=7a%fejcn@X2k
zlN&CNDZKZ$^ftBYdi4}Ry=1$tPHd;{;OgGwqQMGcg9O2&Wy#0Cc%hn>y17t$5$gpJ
zsBawto8PGm*Qb>)B^$1Em35=W>I#RsP(@@#vQ0V=-)hC?s&NMU#Et$ZMBS46vie$M
z%^=tD^6nt~PuKJBYW*6SCdd=aZ#eU(p+?fL0peR(M9n%f5Z|f-fJVldLi;}Zdza#8
zpUDib9y=&q3t?;}uC0+t35;U<dXT5a(?f6T9-&RdgUZ;?jVaVhH61<iv~1qi-J!wV
zN>bGhuUOHO!_VOcjp0+>VlsB}w#n|!-2;I3Mkn_9RC!!Gl`G|&m}W9_y}=%Po=t4U
zo%9d}?<!7M3={n1-LR2qGP&2G+_4)qPQU`?t*c1{puE*zr6cNonR>vf65f(P{lrf%
zlj2S6ci#k)^1_(X`tIAwk&Os>|FQjOzy6XwYW?A;<cj+8vgtaJAY#AjKieGt&GCBZ
zgxdlf0OjvRHe>dXBc>xr`!j%>RIhvSabLt7=?qw6FVn3^itFCWNd9C54K$p~iez5E
zS#I>S;X5Y?E5YZ_>{vRiV%C_0Z1ly|Cj~EX?&I;~m@Jy+%_gE;QClA-q@jD^OiUdq
zE!A7=wl2^K_O&noV8%)3)cXq10V&y}dU$3)y!U5ifcv#C`6B>~<Hml)wk>helovh5
z$_vn?YOC9-s@CA0H^Go=b$c#Y6?H<w?5awhCT>6N-)RK)*HP@UCh%}B*1t$u((l@C
zkmk9OKe#6FQxeyb4zRxtF>>Un3KDeRP9z=OoCK(h1JrcX+?=;mBzV#TM%(A!Yp03S
zr(der6xe!+!r!o|#zN%S<sdi-a`#P3`raS8`;=597{sT(ULX?ee?Z?N?$@<HsEkHp
zHB@fFqT<%Jr)m&?<5y2>O8O?wCOoIz8cXn&3U2i?Y||E8uK!<kqyHRupVswItKfKm
z^5fHAifjRt@laeO05O_c$x)rqi-KEwHYYUU)5?&FO<N#|8;2*Y*P&E;?-qB{A}>tm
z$@{OH@UG-@o1<3bickFKbN^W?;I2`pDPn)axhlh?R1^MlehxjG=%)Z%dEv@;tF%k4
zD+~|*SOsZBJCn?}E;#H*tZkrfdRkHM1hzj+o<c(v{vR$TT~_le#Icq81=eAiT*3u%
zTR9mmq?09=vvur3J3MbgSE{Zp<<Un?>r5gSktQ6^Rx^bLwUD%-vIwk?7wzX|8c>xj
zZim7CwYq)=VV~NsDZW-L)dvnxinH)f8$wW$X#5U@CZ<)L12)&sqp1Ndtc56~s2K-_
zk0?v}Mvxvn^IORJPUw{8{e+Q8fRMie5b{tU4;=HJw{I+`C8n}wv}I+kmA*0ZbAsxV
zn-ihf^#Q7l0e&zMpZbOK)R0c~^l?Jym0ch$X-$gZ7P6n!4R4$rkV<W}Zx0h}hFr+F
zTivr88km#?4J4QJUmezRgf0>o(Ib;YR~?N&P9w^EVeBmTqG{%%!4(_6KU?N=0IG84
zjP`0;)v}UVQ0fX+9HB1+pcZ(A-GXkB;B3VT($Z#7xhC`gC~>^VBED#T@#?gQeQJee
zZ|)JzO<K$SRkVB_WF6SMY-<jX1}5CD&23I;xqkFGJe2w@vM6mYfSJHLXjMUc?#qDt
z?n`C|le@0lNUE}cgTbGbyqc#}^Y;cFwFQB)qSr?*uT9S3nZ0wVngSH^z;&oxJJP6#
z)DDew;&Pnw+sqi<1j=t79P7!F%~(uNWI0k4{gW7A{;NlU__fc%U;NCViVPfCTwmm9
zHyT2}wb9=HYR!}TcdqSNvo6N)ty*1=&o{M`7RNnUraJf*yF@fct|n1L*N93Lb#iVr
zr2>~Do3!MOVo*)CT?aK0pEGuHoG{<li;JnrZ60->c!vxrJQ?1xy0~@}zmMVrHrDks
z6-nK(Qgl2im@1V8P89i6>s=NV>0_9vYBgd5yIHQtXvquwVL7Q^zEw}W2iS``Y>GE-
zq#bB%b-1M`GWM=4YvsR`f=tx33mYl5m%UbSzRf)?Fs3M8YxX|DQ(lzVDiL)jP&}sa
zs;fA^NvuxbwEmSD{8xDXk8|kLnNb(bmauKv_S4~w*+)pl<pX#=c$;?a{>E3V-`@p=
z<Lw@6kG&yy`<9s-3<J#Imc-Ik7CyLR-?-zb__3vK0NZ37*Mu(2h`MdhO1_ah=R1S&
ztaFME&yL^jP`p}@jJ--SDl#s!q_2~1tGj-6rOt<DiF0l&X->xmjl(JFINZ&vc(hG;
zyp&>Mk7MUw&R@qxhA3VvYv5VE`LNILufD@07>s!;3g~NXsiSLMliSu=zn=tcy8j3j
zS7Od4h^_f{T1%FfLG8L$ODeC0T$I-uC0~9`nw+h4Z@KHgKW-U`0xiTFZXQjOLgV9r
zATSClOxrv2rqMhoPvVXvYfj^WTT+dG^5XZ(J|M&%X%SwWrv!Fp5wiip<SIH$o3r8B
z_fNT(Tk5<w<A?KPrnV1n(?mZ2W#4-rQ=q57rn)>?9r6YyTGBSR$(XEBhp9c!&pMs;
z;CIbCjHcJP0HCdPO2jU#<mGtfN&zOt4vzy{@n~+YTBxM6>~3cOl#-Oybi@^pnUL$k
z<IyL~i$&m15O>Gh>n{C-uBR^h-#aOHuk7@wQ6`yrgEe)&?#C^V5BWvNiUr|w(>XJs
z1#Cv;JdT7|xi<RPkY6_mf0HQVmkjPo(qdV26qqR~Y3uw7L*UrX_~kIr1ljMqwk&&4
z8{pz6w^sAIp@%nxCNg%;-P%49{k-&FOX?)hRuh%<@hvl96+bzON?CnNwdZ(HDFZv<
z1UsBP{J6_#ep-6>t8J4jobRC%cE5mlZpKuuGOIVde7WxeUJ8px*3WL9nOua$bCMHF
z^%0c<sTXuu(rhPpNlS7uFFb2f#37lmEfekVPLA7Zh5OsdUZkBvol;dTHNtT2Gt(8z
zd;lw+@30>mcZmA;DkSpOID*UE`oYWZ!GDT~|9pXOD*i9ckfQ(ZnjymNrvHC6LvW93
zFV&lOgPQBLT>g@!UGt-Zyq5tA<MB;@6=X<zE}ab)>`w2l3LvOu0ziuzYfED)V+tn?
zHP0Ur)~21%@G|rY8*zN^c%)dqsAfH>!lF7sVgJhSE~439!n>au(*u;;OY~{5vLkM8
z$?igaCnSP+cLW1`l$hLyE<X9?u`J}?vOn!tUf5F97}XG~5*ruYA!U}(=hFj8?`?BS
zq75Ajp(qXbR6LG@ApGRr00oDL!gnvWjOvNn40O-fu4fg0g;k_-|At|1*n#2`GUV$8
zXCiB}6j`#iVLJL!9Q?~u)2;gfWRbL;tnNe3s|01);MIoEL{%;|tQ_RJtGt)C;GHwS
zj}sWl?Td^>BjMEoK6w#Xl6Z7ea>E(CS`1iBH{PXEY>4r;u&eON&_7|xo^fMP5Ib^z
zhavyMm4VN9zqh380_93+qJBPa&VHV<7Xac7!RpjBPi6bf6pTTE>0!tp{z=Jb^flT2
z4KAU%dGuWXuxNoq&w4iY0$NF-qxwKE?$yPAS3my~+WvL#y{Qy@9#@qKw$f|finD&;
z;VGUtvhj#VN}|bo=>1`Y&GzFi$lV<NOH@o5b?!jD?({q9PI{i06I>1|?oQ{I%+Usa
zm*%+wsdO!1mE0dE<djNx(qE2!()7k1_|riH`ccLX&=q^%v25J2QsLhujY)cH0}}Je
zyLGf`U*e1Wib-eqoeyQ1lC`~8aapz}Ztqyq_u_Y47oM%KkP82T_=Ew%zXwh?zREoN
z+Yh>8VIyoLj;(yvOX;>+{eclJaz^{tvZpQ<R}aj)P(lN8e^+N0VnoqU+%MC%OI0=$
z!!feJl$l?o6^PKcl5qf6%v^*kBIMq0L6Q}(8Opjgc+GVsux_p&b{ZK8_%#h|q)&Na
zt{V#kXIiQ|K+z`bnxn*0&Hr`>ZK>PApry3s0$$9VVQC6?3U(gHc4c=?4P_qLyFM(c
zI5%WlM1)-ISvmi%VEy~a2rb&$u~W~xQa&6=RArov<TnOHFrWXt-&&YZD{ZzcSn@M_
zbc#8aKtikIMsi5jW*hd!n1Vy=u4gQ>dcRpxrH<f@?U!Oo1}t;U=+8~H;-Nz7XUeHb
z0SCToNvqu^Qz;kvluwVO!oOVja$apB_iAx(9l`ghRP$H=MUl<}sBlsZOg`{Q-UZ2Z
zny`}FSIHOrkd_etJlFygP)dH{O)O;F^<bbim?DnBPoUEP3f>5y;6c?&>#U(Fp&>NT
z*}t<awBmN)#|EGEw>G>4kP=G4QTaM2@>C|AcBp6Iz*yfQ(mF=&sKb4;C9P>kVdSzD
ztq8y7R3M*~bm(ssZP=>iMxo=@OBwRezzlLlsS6PNy*h?VSDO1TEdVKD(cdpkl*st|
zC3%1sr$aNJz^|hp+z@(1Mq^X$DW5T!wV%EXrm8$M7OPpwD|iXb;nR8$h%p9~)L?sp
zZg($f5*{YuwkIU6wg=gc2c6%xXA$vNY7wc*AMbkY+&1l1PcpRkS?S@e45WWIDkd2@
zqt*0Zf4@)JG7nln#{sM)lb^~xEy14m`?7THt6DaHoM6IkvTuh@5Fd*x9C4%i-?OBS
zx_904z%B3BzTMMeJmNW4_h_$r=eI)br^&a*6d41WErEv+76O*q8j?7wn)(4{D^Lu|
zgBAVc1g+&JJ0KnV;O8Xs`knKXZh|T2YPLDk74>4z>DID<vkz@{h95PIF!pxpjWzeq
z%9OjNNv}tTOazcM-*ewcs#f?HOM39r!Nt;spWTwa+5GNp{x{I+=?K*Yt0fqL?UzKO
zioTO>L3#=|bqo0(o6GwWM!WY#JZu@=bjK`p5eKhENddCIyf?JmvXyx->LsQq&t#;m
z+){0O>5`XukJXDlI-ZvZ*ouO`#UYcZG@zlC^Dc)K5cX=Y)EReP3M#3SrSjBNZLZbg
zT?ghm#?<cUg^=WkGExbx!crJ!PA#{8V_mK0IPT+j)Y1+}Ad7zqt0@&{)qJw}?4%qO
zvbnR@4!l{BvVXcl?x?Q9jJ2R+zSg^P(797j>Br6MC>KV)QlB+V#zzS)MN?nYm+raj
z2{(Y$zy!JzguaCoF`tZfU;AP0Te-q5zfKvo*~V39Q^%<Ew4-77++t6rw4~q-I&e>Z
z(oO8so~d9lDW_Y}`MNVj(ti6y!2m$P4`KBb?o5`dF3zjkNas~i@d#F)yR5r6FZAB}
z<=;|NBSOZ44d?QTo@R>MB){RV{v?2LHUu97@>!uai}G20Kt3zk0^5lU*)N}=bbBFW
z6&2d}B25Z{&y@=P`bH4YE8VF{^n5mrLFuj&DWF2yw3l`Q*Hdd}6O=9|6Jo^`)1VSu
z0-%|``ILHhnN4oV%Dy4Nqz`sg_RlPisn>gxXSX&bD>|bibT_m$y-yyo;$*^?w9R9K
z+TkNQTJ1(1x*dkiR@X(UY};v|odwFkH&t-<v4K)R2{q<Tem8m=Z*-R_;oqFO;5ViQ
zWvfQDplvml_qL(QQHWAnornSx6z#dRbcpu@V!!9(FShb7vneB@c83nz{+zu0LTSz>
zO9E|l1ZlO-3D`<!z<@Wpsb@lf0j*y|z2e~}Fq1Ij9o5p6+pNY;f`EC1B?J978BjQb
zsm;C?zrM-8z^6|ZShhe15tdMy44WYb<vu9_KJ29m4C51dhZ&H5%-!H3fRi}v(|&rW
zT_++L>Xl1;>O!N>>zMrHC=zQMzypJVsu}1ap(hF^axUleJt>A(Zn_t??f!MY4aeuT
zNM5MUZD2NQ{o-uasdd;m(*YU$A^^VElJ%83dM#+t3w~O%$^{y2pgec>Ajz=}#+<jd
zO6N0rY8Zo_hV{;|$vcI7pqgbkVwa}839+n}v@61iwzje0Y*R|Rhp&x+Xi^+z<wR;-
z>MUyIWv)IUL8^f*z1DAW3wzHwhqJKYnAbL2dGXU{F(*8!2U8YViXnnT7KjiP{OUBz
zxyk3xCSz&E^q)uEpf%=>K+s;qdh<i&7kywQTtjw{^&DijUB{mpAvV8EhRHT9#15ST
z@OQj(qJ`l)fvvxje~1PukVKOXXx!FY^6~$;TuHB@EPFQPzIY<X93*SqsIj^V$H$i%
zHv#s$Gc;r7K8<oDchtu?u<>_IV?mKm*Il$=Ym*uqAu-rc9-E{i0QJ{6`=!ggI?{m_
z(0`eAngfj~@HOwsGsU;o9ag#QKj)+WYrfTc2Y*MUrxuNO*G55-+Fo1jJCTbL?%}Py
zOa(ovaI><^pt<E4%ffPCSb^QojcInh=M8d}%fMGyh_f<gy@+)VH!6R*0Qe|cGRE(w
zZpvSScNL!%W*<4JMO7_In!QtGShNK&Nk-CYiXWKqqDzbo$JX8)%NxlN&4NYWpS&BO
z_&`&1a6JDK%!2WEt(?g6#5#cHGYdbDi1+*CF@@E$y|9-NG$2Ki*gx;GD9WAP+p__&
z!bfup!K^;Hj#LrY8Q`*!xy@&6!^prp1!>;vL0Zy+(`7AnMQDqJMTTN_1boV#mMjI5
za1TW7C|3OhwNg^u)d#5W#y+TA#GX!4d&9>}%^IX=;nY2&afHnrlLJ2g{+T6R*T0hX
zZ2OuRamXtGeb2yRx-=v^>QAGYqsj=nm99J#?e`#VSq9MdEn!yyfMPMiSKpEpEC4hT
zPD~v}Q1JLCeI$LE_=$M#yzPySL@KP~2lCx)lG5#?eu_1x9qe;fn5+BuW#sw>cig<q
zEcJqWglU6YXZx|i>JFMFcsL14_pdJb<IO>O_%Z<UgGCZ%C_;BQKwqhZwYzqEPugaD
z&h}pA>;dSB!7f2H%`Nd#Vc+7rqR`@CU)zw}inPShbL~cn7L1c;c$|5-r^}Q9s8ya>
zGCI}T$v%MXDYM2M%LMTWjl#{_H#V2gA6%>ZgPus`A*zaM7FDwDI{5&U%i{}tYCw*)
zO$3&aZ2Leel6A8H=0ApdFN$8O%CX~meC_P|A&bS)%y<sW!uZ4ZK`A_OWZiZr?^bZj
zh`62ObV?HwFpz&#9U1C+I;t3ASmkz2f$W2WT&*ZORB!k?erf{Dn8+6{J(1C;1KKY<
z&=|EBE|N$hCkpU@@@*m9boteDfO|JmsQ(P6Ki6)T-%7b;$h!8;<$ap&CKo%Wu?^l9
z6K7~n<Qa?hpSzfw8-hXO#fWAtIWM?K9RRXexheWkgN_$j_*1j?k;}=OJa%^t6B0+(
z(bOBI7?R#dBf9w}#5ey4+7^CtbQn#Xb8N|jKjxtlPB|wLe&+AJus3CoRl2?JO$@KN
zbxx}3d;B1$-amq1;f-ZD5<(`8&|M>$o6od5xA?Zwwes0Ik}$p<Y)Rh;Qia>^Ml(U1
zunmYvg*_++sP_zjdM5!%-#x2FijxZT_fGSl8mJV?S9Ikbwe>pRlf_yv`sk_JQX!gW
zxLEhPG^V*kCVQrr^j$Ul$)G1k@d&#9vtCHs=4vIo$oVOk(96m4oU1QM?VcIrcC*f#
zInnX1t&7w|a$K<_ApJ&r_g3QUw^Zx?grT$(cNBhmc2_2;ndExpXtH`JOQyXM=KXQ#
zXe@!=Qaw6S=feagHS1CN{emS2b0)QCn!ghm(HY_x?fXv;u{)vbdDn_%Le9j>*1N?f
znPq&+U3M)O$oYoK$P{ZM_3KtDhs`?Q)ocvN2LKY`c^qqC9E^bJ-C8m`03~M763+lt
z!CNOpiC<ydiGseB7Hr_0{ZhBTJ+0*w?r^Ew$D9;u8t~^xiaNFafE`8MtH0N~;xs)M
zfwR;K?}ik0Uf@k#feeF_GhX`CX5_-FL9<}=<OE@0GzCm^Y;1D3c|uQT*qm?3T5!-`
z`zCtl{@snAebymUA0hU!H-)#3qy_8Sx{<rJc<vlR&^A8~ythpQB^^5USo%hRP&`AB
zc6w64wAoiQN}|huqn(J!0yDSo^;bGTNHU3-H$VzoF`y#t*Zl~n6!E@)#91ok3+JS=
zOP{fu-c42$**?O}ojO|e)Fm(QliQ@l)CncY2Ea=sw8P>>adx=lX#1c*_xyrQea4J<
zDSX5ysdfu&#mngRT?s8NH9h85g}dU_h8&OZURx<pIS5<JyCoPe)h;cOf|@99X{SS|
zMK4Z-b~sk7-jX9@NEyC`nE-Fo!)Ff}R*H2Vl+cjVXH$||un$W5=c=L*JZGe9&zAWl
zk<uetCeb2g>7I-0u9?v~E&_HOObWr<;It6($)ir;o0mISy{`7*XBl?Z_w@18ps(W#
z@B9Cbc5Y+6;um~f(wr2-du1(y#G>x35VFxqOXDAVbCoYD4)hg_9(~xqc|@UkZE^YU
z0nAwD)a<pIj{CL9b%glB?YCVw*6pXL8=R;yqRzGB_z<8j@ROkBE)x&L5K{`Wa9<&D
zPY%C)exSICc}q{B@%=%W{V+=HtwyKEXer#?2#EL+TW8SuwJlp%eI;Uy$P8018PY@b
zEEz_?g!e{M>;V})mUK4KEmNEgup`;6?BuSKw_ofnexauj?;IRcw)Smg)ZJi`8Fs{U
z;|?Tw|8XzAsVO@2qj-MloL{bQCz$-Y_b%hmt3%o$a`_N|sMPpkXUOiXn;tHRDO!Y%
zTsTWL!jSumeP%>(n!I~UtGRcE<_iCi=`1Y|%q_CoEQtgDgari5;nh!`kgv@5go#JF
zYLGl}NEM+co1cX#=}^82^0Y^{K^vVOyD(V)J#!lpaNQg8N5@!^!yoCfs$O&_Fq42?
z=dYG(WcE^%r6qC<UfRb?3uii7V7$BIH2kC_P1J!1StTSPPSn2D?aRKC3b5`)D1ddR
zOrDu>%TM^o_%jv&M`9Z4&qea<_oGk5vO5D9f;90rpQUc_M`Wirl=Cj$yOq(S!vb9-
zFe?|P?E9oL;HD3lB2>7jM7DVmg}vuIIkg4wMxH(QM}}+wQ1=3*CYRb`z%}%^+KX`S
zd6zaN9fZ}pu%y`nF9^zWdtxFMuJY;W;>)k?aBjUp8s_^VOz#^e+=D|t?6dR<jVZn}
zylz<%V7fD0-t&wmoD#O==8eB1^b=8X_bYxf$ay61uZ5SLuuhGROBFc=UG5VFnN9fB
zrXjzbB0{m0-K3NgZHs(FlqA5?`{Q;;Vq%*$-eS{ZkfU(=ei~&5^~32C(!ou4&JX3@
z(;0&~0FP*S5KCQKDff1a<aLl0IcQ2SOw*k_*8*j{(TVVs=*sWaFBr*tupk}KkSkm=
znf-C0;x3MHXNyC=z{8$cr}Os;T0>2_F>gpoQl2}qaT9h{pcV!8q%z2+&2>I7>N?DI
zKir7vOYx-SxJ;rF>msPX78Ok_S>~OQ{ns*z=1FN|>I>XWh1(8~_oM^K*#Q7Y4BXwd
zXL`?vH%-B3md~z0ZwZWQh+@aVSHhRK9;)XX@27L-Pg~Y*dWK>*p>PvFH72mR5lc1;
zY;oc1802^rJja2v=vzJoc6$Yf(UeyG<8~WD6=gO#C||x(zeQ^^)P29Pwu6*2lGYYP
zHCzoVqG~s~z9&}&hL*s@-Gs28yc?k4u=T@4%+<$W7L54!5ep*{<qyd>zkvkt<QE%I
zd@30I9eGJac9CL6_H3%ud1{0`?lOF>mSi;ojWk6knUzh0678@?J;~Lp&xJb#a$VKf
zr7bw2RtL!PBhD>y5j$pbswWO_ltM<_SDn4M*($_mx6I3Xy^mc<jgxWgQ==)#?^GAs
z>p<a<5M8J(%Kcs34?aIwY3Z=~uSC7%lj9dy!8`!Dx1$s)N8tCmu1r@~4Nr#dZt(OW
zw-zbYZbHo#mEsct6p@qL+7PLRk`hMT{ew}GCx0#7M*?#+XGOCBP?OL9%Fq0Pafd~U
z%zDAZt^0s1WnT=z=+8~QdC$8T@in>w7g|~rGs_t%DRNb1{N54pa1MB#U3w}*XN@$^
zwfeyqG04E>_gu}Ge-WRu7ZWRL-gF_5wC$Hu&o@I*46;ecf}xqP-Rou{0kyecN;lpp
zk@dzk=H1vEMA(|OG`x84wH(naOSR=OOZwj680k(5M=I6};?uNLtk+a65r1O)${$3;
zEs|Ihs^jbE<I8*$TVmr)Q_r2GUGQVSZvKq2U^N$M`?uFkvvtTqy>i%3{Gt*t<tppN
z3d9$2CIBL)F9H$Mw#y=O&8!L=6t64aZ}zq&_Zmfc$Hlj-@#knol--|t-#y8+(&IXS
zq7A#qO*+=L++pd741u)$0t53OG13$cDmo+TKzG2)A_+2i2j{nw-;9N;ZrQQ_#P)j6
zk&1mj__)x$NzgyNkZW69y>hKJCbqVy)kOY3T+C@1Y2#%~@SSj#K<W|9TPN7JT^f6J
z;b2FCZq3C0+GLq^D_w-FfV831Iw@KtSWq~Y7C9ViPM&eGf<cRzy|^b!Z|ulT?wE0&
zAV4nQjw6rTU3y)d-Rh@+D|Oa9<}6bY)rdDG&lDp_DA5EozS>6~BW#z+HbYkAEriyW
zh`)i!_KBaS2WQHJ=jSO%{@z>J6n_rMy!{}+w<qt6J=Wk6x|!8+slkmlH!4Hju99l>
z{r6Y^7O^C*GF#_uRz|>vF)m|TlF*F((A?suE_!22T2oZ5rp)CBs_%B8dR~}#O+2g#
zyRV?v_TJt1aq=Njd-5TAkDt-(qnzYL5@Llv2cDns;1FiS1Ru(JjX99k_S?+zH8;*I
zgC-~cvU_*JU6lLn9v)(ynR(PKE3~34G_-3Hl+i@5`<DAGZ3g|amTI8H@dXV2T>Nql
zRERQ`6MP-EDa1UwU4CB)+H^iy`F5QB<gR$zBOcU?t(VH5y)dvueg-WdWdIc+OrQo1
zOGm(t8!VX}a5j`@;0D@3C6Mx30@mH!MNcZ9WlEj1FZ3SuitOIc+5389Ba;=Z^RK%m
z)TKE2Oe9<7VlewU$J5x86vWQ`0xiykUx*e{R^XCX|C1P?xxLU4Gzda}7qwNowt;Dm
z;jWylxhiyZbhfDx?bGq2#*buIHK_K)dip}=Vqf8R6o#a2q>N^@m|<jTEn=2@eXAIW
zc{kE3ZTOv9(jU*PlbJ}6c6V5>=522QEsEoC>bC%c!2S~Ru2;1acbx|VY@Z^ERe#k_
zw38dVwuo)_F-OkrmmO}w77uKGD|Sk(=9Ue_(*6&7Zypcj{)hjUR9cY=B~z)i$kJrX
zGL_OfN0KCDr%XkOIre3evSgXc$<9>Hp|Uq2S%xfA$1*7fk)5$`V-~~A{N6Vzb<WKB
zJRZOAKfmAO```KNRNVLbeZOAUbv>^x=A}DL+&|#A%`H$hx-5@_4#Ws1IUDZ;%3m@D
zGis}-k8ZcvvGk!rk+mYm-AJp$*-O2gJ*tf2kOH|q3R1JH1z;}yrJvcu?~z%qdTW<?
z{mI#pgy(VSh`5JCj?fh5e)>^c!|i=0W{!G3;BDHl(b-49Mr=4nj=1kP5mYlVJJ&Q(
zbYd;SK1|2dUlNDdIXN?xcZ#cpUC1w$zu23>9!>#HA+kMlNR8;RPvF3Zoh8=<avDz~
z6#HV0<4m!r6;xqY1=*{z_MXM(Ifh5LK2AG<kU*}*Bh(a$`N<^&s7>Sr-V;=|2h8NC
z3%qQxncZPxy;=F!(S(U2jl`NfPht14PKvM+|9yKKvA&q@ig$UH7ZaI!05$lWM@AP!
zCxuzU<`hM$9y2N18F~1;9gSh0*;}d-t-Yj=EN)B`3vr$+Y_F8!>&_GRt=;5qVw+e%
zLT4h7f^<Y-uWlTV7ymkxet3M@7kDGz4AomUfGUxkd`%IrRcC*{eBo7Zr@|V&i3@%-
zAtxb>D#1|#dHhn1c=9i&VJng0g3VZ8uFs~BUmWE8I@@?Y<vd}RU@6tM9+5BQxj&ih
z*<?Ozs6c{>L`)9+{l<=%??qZ$%o%Da1@?Pnb-nF&S)zsuzk?o8RVuOB7yJ`A!-N;y
zP2Iw;b(i>@(|D-Zoz#H9&<#ut5iXgzZ{Ds4bJ_-ZAfv}Cz~aSN8!v?kS~oW3w0g78
zN=(NKYYj^PPeK`Hhpa7b53=6Y_fO7h9!6QPEStSlp2ST0JYYY7#o?JU#9LT^M2J?p
zYif8i0#vor!YpQoW45g>u5#JnQFI@ah?r(a8xNkvirLi$WwS5d@WFn<w(|H@nDdE(
z9~cpA%GhF5BJj#(K23Kvs;wP9Cq(m;d7J<1#yX6ANRhd}M3>m%!#57<K}GF~UG8h#
z=Ze~|&s6J}M&Z89oq`9rKDIzy11q_cb@G<LtojMI4g~V-XEOW)D};~=b`Qsgw4y5r
zp?Xdi&c-iY0_-w2J_p3`+S}~U`R6DWP2pzf>#P-&c^EmL86HAUfoCb{jf@+0d5aE<
zI@Ls3A}ts^;8r;%e%IvFmHE!Y5ldjCQtcU}J2T(m0&l+rGfE=wTefxgxEW;JBv!He
zb3i>D@%=_`7ol6kz)IppYf(Q^yh*4XTS$To4}jk_zvf|QPAiumMpRf=^tu!_D4-#O
z#?oA_KmPd-syQ3CQ3FDbnVLBX2DHog7(udyex$eo)X`oO{Z`Hwu`D|>uDM=Z+M{Wh
z5Nj=1I|AN{dMpe7OUEIbL@3v%bb<S7H*q^;XaSmw?Ry|bfj?%bE0H;*Fl_d?;(Z(_
zJY2urw8H$PF-=Tx|8`%iGfC^S#j=YhQacVjHVHItU(wf^*!F&9G~ZM@n=zvIh3mg2
zsKgvfZq%u!+yDXcp38>Aic>@#)+4pYMc|A=BS-U_|GM(qZNcNW-oD^F7-no+Zd19Y
zva<YI`Tal)idlQ4uS1&jxjgznQ%qiXCXIlY!SQ-Gc7a8*vAKR2@PZ9QZG4szFl{n`
zZLRV8h}C$r&p!v8hgZ|n+C4%*b%@bj8+!T6%FHV|@#~^N*<qg$ay^_(GOxO>Tj(Dh
zqZ8^iq}d8)U4I3xPq6C-#-CF}>gmC`uEQ<9IYvInx#Ezj?f0r}_7c~gwEE*_+{2LO
z=%Vbz=VovNQ7Nn^BZEqY3zPoDD!#|Jfd9YTajr+#!l3@*!t{P7`4K2*k7kZoyUm6O
zsnrxk8O0|E{-sh~ov*6I7u|JGlSHCy07Zw1Ir$9v?h()$(sW?`*a-d{Pah3Po3(vH
z)EQb{<eZ<cW+!JMka14(HC1sPF()T*$@ib8D{k~+)hSn)+Ixt1ZFDm?5b>j5KzpgT
zf{nY(3$B0p@m<iI>$A`qQZYp|G_Co=VoD!%8Iz5OIi4CWe#vhiXgR$8WqOYsVoxCU
zV)c3&rKT%Kqc^+H*&<R$ztN1ACU>l}<rDhu^&EV?wA4}Vx09YQlu40f2`5Y{Qi(;Z
zIwNuE?vJ1L{<$P{ua5i@<8JIkC3Cf6wm`{Ro0th<q`|cT)2ehyMR8_2Qd5<*E8MfG
zh+Q6oUrv|i7Eui<(SROh`doBW^D}3vNg(BuyYZd#q3}CaVT#}@LyRxOM!{qFy+^?c
zr?d$t)g86I<>Ri|8Y*!tpJ%;ogJ5Z+nVSlHB`PI@TwNG9v5@2fiJ=qF2$u{4?@0!8
zh&FEU_)!3;Whbc%X=(9S?!BYppdM9GjeFp@9F=_5LDw2Qveai<KDMf5^s~H=n5JLn
z!nWQpmcdAbi5HfA<>j?E)rIFnl06Sq7;RgjVsPt;RS4Q59PW)0gDOHCVWfD<+4u(p
zabNp><Q|&OOy&lzzjz3OpsB;6XbojvNx$-9t;>a+=8;aKQkDN+o$aD^O(Nj`LJOTv
zxAf`DZmhP(U@sn31gQ;0Eao){J4+wXWAQjmB>4s-u|OKsMW588s@8%^_E=EK4z^Yg
zo{5DLZHnKdy&f_xHY+*OV*`@g!TMKIYRN#fx0WH(K4m&?yY48Cy0OhJzy&B_74bX<
zbgd;d!diJfx~5awr?-8~bDVf``AAc0*dc?!m?H*cvzGKdn$C(SsNGOSxt3k!@=+h@
zI9nOvDCwdXfZDQ3bGzUA)mD4psHMv<JCE0_IlGk;x+8F<f^VW6JrW}rR|M8*ut#bo
z!(1POthf>=Fe@Dk%sw&~fgDae+<~iE-E&M~gOHnoO<(kW9A8%Uy`r9pRRYzqY58kK
z&rek#*LecjXQ%wmNds1mR|>Fw<@IylcUkZOe^eaU1P+Q*LA<*)74IxMRSyp5g6jbv
zj)Yk)zxe2K+=M)(^WCO!duL;js?!>%AQwkW?~w#tB5OL7-ws`FVc(gT;uBOr!Zz{v
ztx56I1~Jzn<v?>v6bQ%<>q&Si8Ya4BDC=)Z=`+pW`)<#}lE-3NaSCbIwG*@J4fvHX
zsIGi<7gZ#t!>bwH=J&c8eO=G35HcO#;%<;nJa*J)5~w@ZivM8$3J!sk{;F8B(Z4bZ
zB3Bk{H1?5SV>bGJ(qXgKyI$wjrSUa$RqUZiUCDr>-p!7rmfIxQ&`Ua-6gOdNh7A=m
z<@y1i<v-_dJT<EWdJTQfanxzbXIPtR48JsZ<QJd2*^-8M(R^4c#+uK5c5Ub$B`ZBy
z$LVX7wWX2jc6Th7b|$UYFmAzWOs^%423uQUrVy8=xH1cZN__Z;bB@sSmc5c!(pHzN
zhYXE82XB+s?c*7O$JY95P<mBQUbT^(Q6;%nQFbPFBGa9&+JCU6ojT!*Wz(*3wXpBJ
z`KTmHupP_V2;4#5x@aG=s@!tx<rn#l*FB-d4y06?iP)otP_>UW-^y0*uDPsBj2guM
z#$!crLxj;fO-H8msWxt8Gy#p>kZLprYS?e$BUc`CH4R1VI#AuU=Y0{pIFEpvz97e!
zso<^oHeiXf?%FbSRH4{3$+*gZGl2dRp~&OX0@2B*h^O|&$?RXzhcAqV2K-$ui66>Q
z7hCyBpk!8k*^s!cel1kOPI5nCHLFxc%;%G{uSPX8$Ef7tPIh2k;nfK4FaB#?C{q5a
z8uCNBB`{Mj$}&@x8j&_~OYdb=-^*23x9i;3w*Q0V&h=diWJXx`>7X>#vW>w5-5u2v
zJ7zv{pZRy*jDXx;gRz5u3`Y0tc<mbsTpB0zD(Wo-3qtVwE8nczBaW~?Y0@~X>PCz$
zrK5e++z%>KLSsDFmiOkTgx?w&P(_x*TgE!sWGu`05s#lx-m1rXFHXI*^M1u7PxxL-
z9ZVT*xM0)-&1rmnKstx_`HLiBZ>NF&^(_UFaYWcXDJ<M3D8Ux^5Eu&OmmNqwp`O*4
zDa%eCXFOPzVMBqv`@EXZL4cny!uE=f!?EH^KPBHxU3~+pUoQsr>l!$%Qn&mwJ2OQO
zC5l};uvtWB+n`8UwYUO=%NqONa9Lne29zUJsu9)jmEq{$%`xVy-)i1JsiGVV@v^e>
z?C)zy_y<&`_x=jX*YVmCj!TJi<?Gk69#@B)b0PC<-W6V_AheR(yQMF60PDs~dUA&4
za=qPUJWH%grt<U#UmpP+BYI+A?dp5*C02bK0H|qscjGf#-D_F7$x*(poZ=laeLT#Y
zOLKnf!&rc4>3mdgMzNI_@YYItNp|$?P+-+EG?L`)x9HCG7#6asrojzi#<DmA^PrtQ
z>smS1jN*OE7VsygLS{{mW?0eYgOOy_nA@44#&G%rm}ZA}eu#yK)K$Z7cY9afOwQ6d
zNKC6r6boRbsHD9v49`2#HwKw9N+P+w3G*LRb2jc5O!7%I)ld=)Xv4~s&ej8eAF^Ey
zde_s$4Hy+;$n7L&c-)chU4n5eWB71sJ}ay{l!@brt}@fEj(~Qql`puic1uJc6ARE>
z++`p!>Ll95yww1$5s<Lvm5K*kbVuV8tJK%20#%aT$Cj51R$r~(u~~|w?7PW(`Qag<
zp_Y>PmQQNaOAKxmH^A_$=e*f#i~#u~<obgkKwg-3uPA`+@f`2G@|6)dqsFQ=lnXZM
z{yKh4;H<IX<G+OMLyfE5OPivN!^9@XozAqI5F}>HFUE<Xma9=n6Af$z5>4arZh(b@
zqd@9`7y7{e#d^p`t(Qj}U_}&o=rM7plrLww;v=QgA5qmD>ox?9zc@RbXiQ>kx*m*M
z3Kt9`N_16Q_qDzOYuR8oAvh}7$?;1dH0#Q9-SU;3;llz)b>gpc{e^~QnY0&Uryo}Y
zXL*UAcwn-&H|B{z=!P2x&I(&`$|U$Bd%HoK9s|Ml9JcqKx3N>WJ=1RB|KE9XFV`_=
zVNh?_ZwV+tA3@=|0bXM`94%~<l24z!hod~%7#O3fOwe9pP*_3u>}dhY3!8CDqA<Hc
z*7IN2dR255v5bD>t{nmI%qc3t3&2eVb%wCl=IhoaXk-WY`eY9e5p~>NU(&{NuW|xx
zG7-#Vcl(2KTJc>O_Sbffw+%XCzz^qr&`CwEfB8h9LF?xWK1V+de(F~o&Cb7;8uKwk
z^IFER0!`ZBN`r#Gj67&AEKFBx@98D<j2nbBm--f)6asJu$*i`@dEa1cRU&owUT-gE
zW>z{aig}5DFW0lTV;_`BX-PsnH30Whejb9kzx$Gz=a#!0=bH=dXW?zemQVI<UK)K&
z2CmuV@Y_KjfK5u;qlKqdOA}(t^#uzWu_~0j4(^mW;n$}inw8|-2IABV78Do$K381m
z6d;tA-M6-MvsQ_r%pQz}DsZcYD{9J0mp5a?+GKNAB5`=ZoL19qU1IeFS13rn(wMso
zV^jo4F0()k-R}!VxSA;~su9r;{YBDu^{bB`K-GHeN}DS|C1Q7l0>j8Jqdk-+0R?5_
zz4U!DsNif#muHSLNQUHp95HHh5QNyVB=ifPL-u2zV7eD{qhg}2)t%Q%X1pj{f?O@X
z(P4sE<rLt!-uAgJylbQ^7A1KPKB-dXxQ<m_UhK#*<eu2snH5rke2(_L!rGL+N%zr{
z+80U%8nexI9zvH__3Yf@)umEKOjN*AQ;F)dSk>VPgEi0k(t30ID8h}Pn@yAToJS6<
zN$cpBNdq7a4rKN}*CaH9n)OehX5H?g{Dw{b6DHM0QJdU+s-o5y2bwvM9!o3iAE}?7
z-O?i;+S}^Oq^2j09JH-XFRRW1v6P%>9_CIjfyb&g{gH)NL)wC#YcXjDHD8@x>6N2z
zHz;p_9E`UwXed9GVYi;ue@v2G*^JIVb7XKhtlfRGCTaBj%`;M^D|dZ3wzT?^o$TYs
zr`H#IEWOr^Rp=StUP+|%woOi0<LF?GmgKxLn)_qmD#8GPS?UR3_K7&D1N_P{E4*_}
z{M7eq^L5E;S4$XNzOY2;LUxq8=2AbC2*s$*+xLnYX~zU@RgL(yPx!vTdyGv1+t=nI
zuG0ZnD+3uEAf`@gB(Ze{uwGQ7(c6ih;Bd~X5xSTnoOU$zr2|~j4m7O4b<$mLZxizz
zxjuVzB-<<nMZzJl4@!nHP4)+8X|DvG8kr(I?f~~YB^E#+nA}a(8*|nL4vt{k%;di*
zwbVT?y6U|Th%RqFu|aI3?G<=HPR%=br02boKBqJ4Q7N+IVPS8%8KRny@=WH)K)5nE
zas=eLe^I~%p6NmAP7QFF4dmx>Hu{)ER29{`G)`JY@udpd`BiC{B-Ypn<eQz@5sedv
z>eZts(%zQ|1<B3Sc$$7-+M3ha+CAaEAwv<uHuhXU;9Z5F1u8WNy^0m_MsE;HU{?aB
zK>mw@BXW&Kt8c^sK3JUHF8FDyFsxr)`HJE9y$3C?C+=u^NC+K2u-&`<$x8bfoHVxd
zGcaopKVS!ja%UDmsbJMP7wBMW>#{IIzi6aWkp>mKO~0IdN8J%*orNq`PuZ(meHlUc
ze8a<{96p<-D0_XKCy4F58~fBQ$<?-gls{twW3qDwhkeR^p8#H{F?I4^+tZGQEJ@u_
zZvki3N88(6zu{9WUVo~o;`N{TX#>;eSVjX}AE%&_>wH)>4tuy>ogB*tivt?_3-+LS
zotgM(<K*^tH$o-?FWoh1-IecFNvF9hwGW=`Pz)fRY7#n{5o{fe3>TGZ-(v4Eh+tu+
zQnYzoT5^7;rcV7{(^!ufz*PR7P<J+_x!bKMa%H#GmZi~Hq?LxP%-^a|vHBK_Kxn%i
zL)EC`a+t^HMNSbrUZa&W9;tkt>ou~SFAqvQ_(e`be#i_Ekght3Zs=p49^QSl?vY7d
zWFSFCy~1?)XRY#M>U|P;r}$M56p_(86?`P(RW&c6nOvXEIi9EQq2uNT3Fo#&sPi`h
z3{+2e|MO_(khR-{QH8N`>8@^MI$#28kVj4640fjD%FJH7L<Iwk-)nVxy>OO>207H-
zZU+1lW^u68bKHMI9ZE~5ex?3G3dLODsJH1|H)PcpeI8t`2IjP1N`Q2Zs`S2TGi7jJ
zQS*+uZKE?~TFa>irM)&AM2q$bA_88A*2Ko^W2PUl5Bw87{4LuEEz2T=fu;LeO6Fex
zKQV|?U*_8fm$Lf2@rGfkE~r#*Quds{Azk+}WE+3&p&qXk(Yjt?WAj|g$0k};s*-7+
zPxU#2cII&gyR9<wK6G3IY|5sAas>Qw#rJamHdj@{=^SfX`BH$qNB;!ktqjd|opX@w
zhYzoF)K`H*^~Rv?gB{Ith3X@4x$EY&u8{e4b2`_@c7aQJvJ7H2ok1T4A-s%{g7uP{
zwc;TZW2T_>W`ORkFgfP5VhOOw1X0tiX1BPc{ko1sn)(RHhst*<T6vf^A76MsTQ`Iq
z3Lkvg+92v6M{WFMOI#MOzAL$19FN>+r<-)O{G*U?R32It+z|Iu+p7koh?1-S1~ZD+
z4W75`&8QL-6~cGQ%_KEGt(a7oHW+U>wnP)Q1z~^Joc|)qP9b($>m~pK*KTxu-W%i6
zEK-)m*%-Jfs&V21VHPrF@HcUN6Xrjt0L%&i2n{)f{h7soC!JwEV%cfNd!00~I}LTI
zE84EcGgxcOFW#^-K*sl2<6!my8Y+3<t<Xo)I6M8Sf;?V=ookaZmFsHP{WfG`0h$YD
zHzY>&XJ&+W4Q3LuPyjva*tfIi$VP`vZkw!|ZPlOMV)&_s9VxddXI5t3&b(!}&BkYI
zG|J0U8fLZnLmsm`58=Y|VFGClZF2k@5Fn3;GR$uLfRF?C-7Ok8qgV;~WV@)R`&MZR
zEM1+t`qg2ZFyRn!IkBxGslr;4nzaLJL(%?NV|x+X3@c>Yk>bxV&M;Av>xb{$!eO1Y
z%Spw*O_?c{=N>0+=|ld7c2*wy6;10;2Fs_$$v<;m`jQV`<P)~obnlBu)fW8IgHB3T
zeNQH0wBl8(<4xVbT6SW+4WJ{8rqA32v+mkT?oaTq9T6W9jqvAXPXS2u8l%C2ny~7X
zim<DkKO0SJTi*0pCbP;bFm}`~K>Tr<woV58w_|93g+I#AUc0;NX{4BVzof*`l>&83
zwj4XF|L2a&ckF(f*zoYsZ!5}nmmU2j*>s2BV?Mw8J4JPt5=Q-m#5X)Wp}j)PFaN`7
z5@nP%Y=K0RU(%;*r)%l!i1=#>IV3boZpi0N$~`8vs$kzCQLd)2@6aw3GzT5yJ_oJe
zee(~t%DoqcZ9#00d3LZXt_5NT&&x6Y8JE|5#rcH?C{f}>hcRnH9in!<`GMNCWhIXH
zAe0EgDW{-tia+;oirFt#GfB=y^MjB@99wnKAfyHjLMu(IHqXI>XBX))aTT@&Rg3cS
zWBza5e&Gn`l6-S{=H+E~X0i11wZIkmcU(O}5VD0e0bAH2Y?takCL!B=(&9--4N9kE
z@=T{l`i*RT8`zIgPDe|&py@!6!Toz+zC^4%yOPj*M}@xN3u|o;+%lRo$L(4PjY3;_
zj6${2Sw32fy)38mg}*_g5MXcuZdZmNV$J_N3Wfj2D712e%5P{1#jz7}@s!a&zsFNX
z7spc|e6YvADl%tgFuW8Qe}PtA7Ujhvd@yrdTB+<uMdruEym1DUn7@dg9QzYN<#D71
z3Z2a>w45S-ng@54gINg2EuUhxzz;4}_?l1IdTQuvJ|)}Co>x9)JuiN+30a~g=Lboq
zEa#Ixc_Ai0x|Zy)i*bwp$lhBq)z!;4{_(z4*%COz$n)ebN~Z;7!WuQE1KrU|JOU~b
zr#p)45CoB$c}*q_pZMXHo`d!`YZ%6a=QLFO4DXRg1%Jj0?$eOUA0<~oDIBwVFA!xi
zbvWwh=YsMx%mYvU6u0@x0&p{3_ryi%_NFU_k=HBBs(<#0t!*5Qr?&pc@%qGbG*SsD
zc>={%T%fqhVHRq1L7}n8{3$h0$jTM>s63}9+@xL`OrEUojn}w6=F6D|Mllw_)r|oE
zkJ)H9n2i#jBf?`FL0*OOfsI>`Xw)LNwunL!&F~nIXk@>}=DV+i>kGmY6+OiGCVcVv
zZCeg6IK?FJmApw_D}|spiW-Dp4~8SrL2S#n;YhF%wY;&0@oywAESKRZnjOb$I8wou
zT%IDtfk5H+z>3eHNL=SPps)vL9w@9{=~}Z$qZ!2nc}w%o&7bER`|ORT`2y1t<tlUN
zIx%1Ft5qxoLV5i>9eJ3uPVt(Kn)wsmCTDQCKGn>9H!~Lp=Vg>{55I|K-%pbdiQ7f5
zWk@z9*8D5WE4!77Wf6FeM;&MR2vB52`NznLjB;hE!#q-0f{RK+1j+e2mhyij=au|M
zq@_L_8r#Z3wYrez&0-!t#~05>At1977Zmo7%!=7%p7T-dt}ND~%nBV$rSqAUnj2&P
zo>`HsYFNmuw0&m^yZz3Iz_P@6$u!7?==^IWl{oS>Iv<`D<|My$RWuOwYoiyr#j?$O
zzPiQ0GZZyP^Xi)$kfPaAyapsq=qD8pg;pGY<HRpOh4sXi;%eTe?|=Pk`Ob|q+H$_M
z>h;UpJ3j{(TD)_&d6sT`TE^v>-dZ@a+!!s>SR6H=$E%LQjL&PqE><i`C7OK0d1d+h
zFd>zQ&8Jpu^F_X<R!|F6VQ(PRxZZ@q^B=f-^0ih;{DlaAdL>#p8J!6E#YmO}n(P0_
z^8#l(PoCHM?O;UmCJte{7e*vHwegEB@rT$7?i*G({3oU6GVj|LwaV-Qy6`Fsg`ZE)
z<KRD~=Vi6wXn}Bw>JNso5YTSY?VfJSKK36o(oVh>;3a^*9~{qfT8E$+sTSl`8h*&F
z$jottZS!O2xx$O28WhKEgGy-h8fcOJh(~;WjerA)6@bqm)5%J}l!W5*NS4c1*K_~r
z7|UNo^jh-)`Cq}6+TGxL3xI`52Z?j}`GQp}l;xuQd`7MukNiC9d%sD%a=0EqdX4g&
zlJ-E~kWg|3`IRi}28?RolPj3sGxnE#T6iT_z^4+FT$v*a*YPF`cO2!TKVqx?AlBT0
z0`zW(pq(hL1t%%rJYxum=_SdX=><;SQv;Z!XBT_J`mrhV(G}%_5fEKzo<|G+r&^;m
zgW;8+KgJJE6Cz|9%QRhV8cTJOkK+yXGGUE4{SKT-3eUJ}S$Fw!0jucIJk%>^0Gsq3
z>V<~`s2A$~a=ZEL$|ANf-b6jOV6j}Ixz{^z3TACTf&|+I9&*k6n*$IpDTTkXz}E<<
zI7x6CXkO$R`v=uaInw?IsuzVRf@E)L<%;9p&PNt*D&FB8#CHD#{OT+>2rj%;Fy#Kd
zf9N%Wp$i#$)Ypy^U>obS7=mnLu8^fG+m8p<%bTx7`3~kI>{LZ6g!Rgtw~aB!asNBk
z>ltsX*UjyINmB%U%9$y>96h^{Gt8v-F9r@#&K-;$tlenoBGz$wX~6A+>}e>y@~?E^
zu~(eE+%0^<DnTV*>JgcX(kmH)XdC#Cbm1Qbo6z1jK(I*xA^I~sL-aQVK*`C>Nsjuw
zZ|saZ;CgMn4GH|(Pi^EiL#78`c4atDJ1-r&A5yarUy+pXmk7v?Z_&dSJH0Bt3_uyt
z;w15^oXsd6OHUzQ@fDZaY;*g?cwvN@+BTQb1;wWJX6-*x^iazQxNLxNOcOS$2w-0H
z;@_cbav6?maG|7>e-wNcsn?~=@r7%dL#x&?%I)~S)|^nHdDFZ?m~n2Vb5}9<WUtn$
zcyI@U&v*zh{AP*>#6h6hyvYQbO@q)y<hLCC?9V+XH%CCv$&c1CHQqQcTLB5sh+txo
z!X7X`^9e!zN*Jc@|53C-{acWJl#T^OC#`4)H#hbF;CY$d20Sk?cRlkkXG&`bjvzu7
z5W}|l**<fKVKzVv_kC4uR2L=b$LMiG>BqVknocI{d7H;>E}46aFpMDp^zwSb&L8;(
z^t!2Gbn{E-znaIm0KLKo@b7s6y(qwh0eyKG_&oA@oV{O&B9qaWqM0rJJ;Op@$gtQt
zG%jKc_W{|)?ITaw=FIN#j2b#}>=cO7W0Uc1wD_5CRVR>ptng=|S7QVE4<1CXc-;;U
zX%J$uPo%{1(PJ0sHUwv>cNrlA-?Q|7Bh9n_W*-x)GUqg-PxC~2fhArjC<66}U`n&<
zjPv1J_QSnqGYHPM64eVS7H*W`LU#PNFK7yH;RY$vG#93a_5|k0g|d@I>BUShoO|lg
zg5ahgLVUM!IDE&;zO@Fsk}>{pf+26F*J-{MJ?&@qFAQGTJ`C*elmjF+VU0}&=r6-G
z_6xD0J<*pyOT}e#9Jy7)enmTnI?|DCRx{V;7)4$bV>v}fOgCfnxw|NL-u$ZEcwOMM
zep7A)TEtf3zNYEFx1DUOYWUW6V(Z{GZy?Knpk9~(1TUx;8Tv_e8ME|9rjn<K`3pIg
zJHqlUGC#-Zw`C;!OPrqIJmM9@GfodaB!N;pS9jtC>Q25n$X2z8E~a{cdlxJMw`@_4
zR9hM&HoL{CaJf325GZsS1X&=^@JeVew1T^K19mq0U}1AFz{8eFRt0@0;Ir7l(d~b;
zkb(1@r-iIz354~c7qV3suwJf~=r0;H?^_Xp<x`;2B=l|C)x%q}51%OS1xXgL(fXlw
z(L9&;jT=>RnF=i~=nLYF+E3z5-$J1Nhr$ya@Q|s8Hy-JO{RebsehEDH&7ciT`Ey*a
zH2h1;nm|<M-m1`j9XtD9+Evd*Srj5u=c6pGi+UI7XlcK)p!_Td1Z%=wy?K4Bgm$Vo
z{39%Hx8rGO00Qa_$uiGc`o9}b7MaL!OML#bc+m{{#;Q|Aewmb+lW*caAn1$bn`<+?
z<eSFtk$R7AMm?KB=1KNKZUEnnbIpri!z>;kT)(J!(RdUzFXk2TXkHBOeFHTw#zSEi
zNeJA)Bh0dX*G<a-Z1-Z=@EHL}zoGl@{lD^w!2gv`{;z!Uf8~?^@5(3tzm!b0{zwQr
z8u07rCZ}L3B%0WZ^i4l4uam&#zRk=M^2}dDPJ3UvG4e}yT;u9;n$ZqvyD&B2DZ>xs
z&1zozl1B?bGe+nmUkcp0Ac04%`DU0>pQV=77>qnDa;ol+r;r^~8{d_Ekex{K+YnMi
z9k)e&G2xUW#u_`W7rLY=4CT`-yXniV<!YZ)=ss>L%zc0H%B%w2FTJeK!Q*UKj0UWV
z+PU#=Fj<pkRn#64xLJVOCrP8n^x=d(KW;d$H+e;r8$&paAH@69A1<3B<b^#M?XMPp
zBkfV1r1!EhFg$okwW=axM6t`*z+Z(D)I2uU)@s6;s`fe;qB11^shyJ0ujZZlpu@jf
z^g?yQN#nVhhisRoFd1Y`^OkWFB*f~NXbF`+lq#>H!FZv^ks|JmeKWWj=H4y6MHwKz
z|7ohRMRK#Bi_&s4L%Ukn!3hbK>F3s=REN<-D8TPCAK<qz;^^}V@GJR|6K2`NX&$xq
zt6S|C^*q9=!nPO4CVz|0Xlk-b)bS8VEVRA)@s3*#XTD}<{^#Kb?4kZ;^a(H?iUE#8
zD8Rp+_OoZrgQcqWhSSHJBUZZyC?}xj(I*KVUQoLboyl~2ni=>lI%5KG#$Qf2oVfHe
z&UioX=nUA=F2WfXiGIZy-*ENff-^SGSil)m78Thi&0uGT3D0;W_*K3(tZ1a7Z+z>j
zzjHm*zj?v5Hv1hU7T!Df4J4)j7Lc=IU5At!q3jG{3dSotLs{j35O+!gJY!D-Cb`wp
zClXmg^nNQ4eSP!KuC?`zXa2>tW}8ndI?dCyM&8ggvp^CndWHtSjfJMiJ0oirhi6t+
z&I66NRwdl}3N)VS))Gk0_348${Qi(X*q?jHio|anKoHn?vaC>nMTrL}F&z6yZl2oz
zR`qE4hIiHD%_UHJ#>;{uv5=lA$i$CIdTIVZG!8S~va@TFCPzm76yld{LI1%6l@qVi
z@sioCJA|ECXq->@sc{~);9L8FC1wJ;9wiC(+bDwnVdxMQZUT8^Fcv=ZNCJSDx%dpp
zvN`hyq_JJ6C?4x4R@LAz7#gAOFuEwkKZB1bu`V}j0)fXg9xW?oM<G)WSopU*1gh95
z6>3=-%52Gs_-~llqOwPmTblpLG?s;AlKyzy4UhSn72SR;FeQAiS;_I?RkQNlxkfH@
z@&;{>D4qct_$r5asImIj()mKbFk1vQmT?16;}%{}V}i3e1U0UOO6M{EQ98eJ!|Ti`
z;>6+{zw}(s$_(gP33;Lp-{`0R_WEzKcDA%i&t&JC)8?VxgPmY;`4uOY57j+x=YFmP
z&e?lTHtcsi!BL;58W%KQ2UO$Q`PTXW4D!Q1qyOZAa9qFhW*XZa;)!{FS<DkN4fAj2
z-S<cY5t<}O`8&ovLL&<#as7NqRX9<1G*g!&v8eAc0qT1M5t=n~SYzKswevMy*<ThX
z`RT_x)&ArNnA#&+cqaMh-<%y#(~9mOHjsA8^73$~4sj7sOyVDfkJ)BJiwhqUpbSkT
zuMCX}ri8YxQ)|w&ff>Pjf!_J%e~<E8tzD>EnGr5)si1W@jE-roqhFjOiups0kL!3e
zK7t(=kbZz^aKFW0pz+ZYkoN#ltT7P#zc)Uf`j5uPWpk={tlQJM5RKc%?;#qu#UUC9
zY^?ro#q(Y%tW&&-=a2D^CbK;n7J-d@7{J-`WAXftS$>&DkmXkaT`O)Md3LR62|P1x
zlVg&v&LhRTK;>gIw-imr0@=7j>}!f9EQ$IxMPr=7Ger}~i)@^R3Lm-nL-Ty+=YeOa
zg)qNc07~iSf)%-=*Jr_H12M&>Z)Sqd$9(!<&^5W0M~r6uo}2Cc*zRDv`RaL+rQVei
zX(g%qD=U6E+FB75LrCLU`e<3-Uf2SaKKgSneFRtWVHV{yxQ#*gJaAV@zL<;i`+zuq
zda~zmqSamFTH{X+mXEh(d^tb}$`Nw{@PJNwn3Y{^O#Viyw*ZYK9}d@)Ds_;sk)sBe
zzU!>kOoKIz4iG;#Wfxi$xC~vcO2TNoQOb82dSH%AN%XvCj+h3ga`9$v46PCky(M3q
zNUA2OF~zoNs;9^&^2$F**GV<w?5uEB>ewXo7M*zeL7VFOo4E*Nc~?r?Y>NY<&)2q~
zVC4{XDXD@ccv3;~&I!3Nj16wz1~|$t+{?SZ`&_+ErSXB`b1;OeI=@n5EG#;nrRILh
z>t$Z!XSDYrK5NG3(>siX88OJV*Ya(QN@V0I$^0C3X215XKEB|$jWo=Yw_N_puh&BZ
zPuBs>SEpX-9M+xE&8f*YBi0?Lg9jVIs3EI?tMFVphNwakQ~Y4mpc4~Jn0k&sB!YSV
ze9Ks&r1SIUUu^F8#Kve>M<X{^BDE^aVdWPY3iNVY&0SGlvhlcNrAp7XZb~RfYp^zj
z1)FqdP$GnbN-bv@SW~%@xDw>5VoXt2wxO7|1pA(}g$93jN@G0tEFfLN&xa*E^1!d}
z`GxmwDt5o0Ibp4MzE<(1*(;sd^1a)M)arzxTBbDH1Cg6LfXuB-BY#G(%PrYMRrMoX
zT0KW=mTFuv>~n?G<h^IRourvx^hGEawA@C{0Zoq@LHuS}v||NDNq*;;%nGTEQhfID
z*Y9*FXYd^&bIrfr)Z6eH2DMsF86CdhVo7b>cBQ<z`TVn0zh8e@!QZ7ieb|YZ?+-s=
zeyw_Emaly_`D6X|NQs&0CBxGh0mpIV`YZ%ak*v0s-Vl3x%s@{w$E&+h*>9wLYiY4+
zVeuw)O(}2tpm*N(j2LN89pf|Hl0~mY1q$uG(XLH^#-Q+2t=PvanHVFXs7vaPw0|<<
zpfRNvs^PCv4Hz>>rzq65x_0IJBSQ`v&Qt~LHU1jA4w;Q!b*kYxzH-4tPqX`gTTO@E
z34xkvARVjthyml|Z~}tULBH*>mGQ}fdUdF!jM;xiM%CN#b>5xKQS7NlTuKyfZko5?
z(Ie(Ht|H*Q&kWk=fV6=42-0;$a82K|F!A2cUG;G7ir4^w^75=b0oIAC7NOqup}iTL
zVMH=QF{6Tp5Gf@~**%DcMYbrT+;vpAMgc}aRoa|M`bGX6w(YRdoZ>}^D{((PNd?cr
zu<BiPLSR#sq+b(e2d4Mp8U)$mj$+?svxty7m=v*~4%Y2Z49iiGx-p8uGE;#FMsG5I
zGC`8-8gnRQsi9ZgR=x%E=pjkGG#w+4uD|$W@A0B{O<CJ&2H+J=PiY_4CiRDT%kmw3
zXo9%-7n7_;00i2w^Q;JO5)<iT@a0j=kwI)Zak}qFYECUHEG1Hd;H+5dn%w`wf9DoI
z%H=D2m&pAhqZ#IIFXRZfdG`cM?i03^P>qL=@1u3)AvB%CP#R`KKIx_2*Ihri;FYx2
z_N^q#14nc0L~{_=5W{OX0Wg|9$xs=>SZrWLpzd1Poo0QK@By2T!GuJjm*vZZp;&mM
zwJti;H?8J!CgyXRp5hw!EAs5=a~b&p6|F4-4=(h2$r#On8<x~8s`m^ZMNi^jNgp>g
zn>cdLwGodw6ia!}U<e7)do1gy`?(e=nuRZve*W7?dOjC4><FF-^<Dk4GBC@2*m$&U
zTrmoQIS`sgLBY=c7L;!75~BBMj<9czYn?RAeJ09r74|YY_&u_>2g41)o)J|-ix4IZ
zLdN>q1<<whTCn7}{mb!wML)#=7?i6zcumBHv01*oD*CRO+@(T<_NleV`jiYCIdU4+
z0DDZ`$=9*TGv0a_)>?}~*JiZV&h#vET!BT3uBs&Wx^gv9m<jq70TQ6{(^H4kK5T1O
zSP>xmemV^eSkCT;&)80gU|j!B+dLSO4bEajO`i0TefHI$A*U%0Zqw9Fh#p8S4smpQ
zeWMZ<XY%f8e8e;CaX@l_ibSuq8fUBnKd!LgZtM4T;}b{ga|J!X#_A>FHOFQ4S*wBG
zjW)K=@Fq;UXbY!I`Hpx>vx#a-MIZOq>IkIdI~8ngKoAEo0Y`>154`gU>^cB}Bi1ek
zM{I|{5i+;soaQjva451BHHzK_%E0?#QbaYkPV^^X+V;%uWK8-y`<`kFyrjKrPayGE
zb#S|qlSqqRpCA6Sr05ug+D>dl5Ef9|qeGc$FDXmUNN)Hv7TOM9jZ3a`_!jH>3AOFo
z%uXtAh;dvcHCyYr3_+RNYLxBH3GBY0;9hPMTxvuoKKbp3Kkoap^4f+kssZMBk<&Vc
zu?X2*MHvoNc123vI(mDfzwYDheCcn~Dw^Oze$P*}NtAis&_pkbhTFf)MRa93k+x+h
zlDwMRearPjSh9UbfEjF1u#P^^dmz!B%2XOppU}>7WMw!CA|?*+Q0q>&Zd+UVj(cRr
z3w*|(>UI6x^|~`H>?y(~5fz~Qyz+fwsVXy>JRD}g>1lb(e6F)@D705L$~_ck!ZAze
z#!x?;q|am%`nx?h-834b3Eow`RB0Sh(x&Ww_33z(xIa7$C08PDr%Pv4_pY6YQfEdZ
zBJC5~_wA{j_+T8N2SaFeCcGy*BxH6+2q)351>t9J#ov~DDu;d8G138jYE&}1Q4EjN
z=y>ku3>`94hQoZzK8V#xh&#fx)Se*LOMCsU6B_SPBYs@gmugtsY@6nDHA<x`m{MUh
zgGv@IQ*}aZt8MtjWDMKcqG+nzO_Uk#l6t@9W$t!eg<6NSXCdu6xIK|7weOL{$8BbT
zaKjs3wSs%@u+-U0_2Zs26InU66zT0s?VEfrjRXqB3wfvaACTm-Zap9cOqlK@)jIJ_
zK@$ZRI6V?!5gN>7rnGOPZT?_V_3DDeB$sm$CSM}dYZdHl2Qn>nBUx#A;UhN?bOJth
z5a)IK%IRaFw}-C}h7xZJ<Q(qpsxKo7{S8hiF}s=y)x6w^>iWMDwL=Au0MKl?xE{Jq
zB6)ou+`+YR)=0l;I=017lN*T*Jb*xlZP?TxUI(k&x5>W&{spzhM#$^EA-Od(3EK=G
zd^ptR@tSm`KLdp(_1Kobu}j_@;Ce5cKzv+#P4W%>EZ(cuq#OAmdgo?p*L*XpbDCP@
z5Y)_yg2HZIzjKC|0rFAYEl_T1b4Jeo)UsL|1<qN3Ab)AOj_e>%Fmvo)e)W74Qf~`r
zLaKZTs2emfcvLymg!G9y(>I~gwr^x56<_NpfQsSzh`8tN?1(E~Ie_VY4{W_)Ye26o
z<k;o03giR|j0z3o6JWpn6*J$?y4-qEJL{&Pusnofuyv-2_Z7|q9uRV1x65XBdqCU`
zmmjzritFuu>O#7;ujgfMWYmr`PK}C+!tVdamj)PVP>BP&kY?>Bz_n$JQkARv>zTc*
z7is44__mMeJLx&tkqF_(+}C*_bKYbj2>-W-O4NetSzRmtLMGkklYc5xy2J{&=>9<=
zH_rHhLS8$h7e8%(lY4!bK>R5yu;$q@w>2ct+MzNe2X&d_`zytdXH~|+`Ayd@HOh`w
zr}e1If93yu?PsOap9FZN15OdM3379nui$|p2ixIxAx&WC-joSp$csQUG=DI2sEqg%
zh8!<komgel*ZdCD>>2FMP0p&`Z8xe1_<u<>{r_-`AD#0E_a)3@$P*S}$P*T0$a_`F
zlm-8dywP@*qtAo9aZ|{z;5phNhkcK9FZu7YNW(aD7{FA!|3KbA|ImgcUgZMXkj@P0
zu@k0Je7Sxboahh&06=;O+hd`i)!k0=ni4k-x&4O-u}7|h>MGwj<lR?%7C7YaNPC_f
z@*VsiBouzvX?u0jvAlkV&&+1n#bp1Y&wJr6(a+&S@wNq|AJ7}GU5^a5F4Q3<bjFAA
z!|oqlxm-RXCjZv$L#m8EhyW-t*UIXx*=nz;=`iXu0D;I?@BoqfuWD6hlHH%0%(FMB
zjUrpdgKGr7ApjLpt5=s)?x#H@NN<<7f7y4)>};JVR<R$z4)2u&y%VJ>kL5yt#^Wfi
zlqay5)a9rfpd}#qhRXmJG;e`IBp2YezmdA*RjqawU;5uKYuux!e`Wx7eg+J{pL$s@
zqHTEO1PMYafEI=;JOfbVz&%>~mA)}#_+ukdpBPC=ifBBzk1vj(I$@UhCLVWc{L2`k
z-S2fir)hN5-423VCUZSEU-K`ezK2tRPx%dCkxPC?Z(hJ}0FU3y9DaiZ;WxfkBB3N|
z6b7v;aeD-{wzrKbH=6oaE>Hlw8+kXg0%sQFw3nP{e1bklKh8q6w5xyuT_YDGa;IlT
z#~X3*ul;8;D>x=5qlJB!-@zQ2vbv6@^}vk_qyzl6eL_dnaV_WtCUTM2p^$@o5sW-j
z&j*;JckS(A3YE(@!N;%$f9&adi6t~;Eaq>3PNcCvd3GYj|JGq1H%4s3fL)HJF1lz$
z73jAM7{J4zn$<%$ttOqQ>dzD?5Q{n-rKpja%GsO1^^p=*i7TO;@kP6m)X9p=M->;9
zB4K*9@0*K$f<4@1=M>S?Cf>fR1vmX~-K+|c1#BEAnqANR#1{bjE-?s4zUK!VIi|N#
zB|2<LH4&bb$c@19|3b~w3o7E@`{vMr&y(ZPcaeZc?kbWk{0|;^>aZT3>+=~@62qUn
zm`85$l}G-jd4%=vJaQ1*S>TcXbD-pf;BZ)|MWUy%^NYULA_?azthbX|N&&zoamsfR
zpju?=Hxl6d@Ce#j%_87~3b0S;J3O$DARf)SRGtk1$#n;?C^Xe1aVdhbO3EtN<h9{)
z<zVAGHtqct#Kh(&9cpH34;t5q>#fb%6cYT`dTOwBU#Qp+ruQ@b5bHhnLKA^_9V?L0
z9*hAfKoH1N9r{|&Dv~QFFmrTsXX~ze{imWUB*hkp<T7sGh~%Rf!5z_`X)zFlV?9)i
zw2pf*(#^ed*6fYzC?Md30xUpao^NU!{ondo!FkTRpLHpJ{r;FS50F^YH;*h}-X1At
zzwsKL{sBp@WOFqrsHz1YPyC6(QQ*M)#+CJ}nw!=~>GRD<u0J;;Rb1&4EOpW(EQSFh
zp@LS4OqXiJGpOv^l<T!?c49$hOzI08#CowBj6CX10FylS2PXMl%URzQHZn%I=kPO=
zS^0}F9HX2we1XC!Ybe9=l6y7M&82=Ln7_CEg}9;921sp<P&HB-{zloE)&EHYZ2aEP
zYPXb`_Fqu)eEwWVfh1Jzn_iQ-ZY1R=XfQl~??!5%@#;p(uwCzKldc<@e>;IvIq@7+
zw6dCcy&${5C^bhVmtlR9+jmxP9p%OkRPyXrKqYtd;z1?fR^<Xw$yKAo=p+qDHeX@O
z^_L~_OGoiX1mOn|hY(bbG`dp%l5D_a^;v%HReAgJqr;lF4#oVf2zODKd>%OV>KhM`
z40W{nbMI(f5d95P3x!#fKjyLIU@!q#@;EQKOcgc6A6@cra$l2x)xA81u_;mKzLusJ
zsjsUn^#Ax^@>5BxMk-z-d=!8!S2S=ve_!8+b_N;qC9OqDEL8pXl2*3>ceNIYOFP<o
zc0WLscbH58B4E(vn>W@?+AaSaNaGtGvA&Kj#S|gyOVesv-U?<UhGEz}BXlIk0RUzm
z9<lLcbOvIAWDj$hT*oA#cv~R**`9lQg4ypv+n$9Fw1MH!qsMj-+w(Z$(6}&YwN;4k
zEHfUXD~FpAUZBH^6l3T!f{oYO95=bT970*aWsm9`4T_n4WdXpJAWjxVgKb!!Q|09e
zsU}Y+T7BuAV8Jpy$z^3@2bz1NrXH3}YuPgH+vbN*El}vmcX_fC&3^oCvwg}iF%#qO
z-mj9=k2zVIpRR2Cwi6gd%uU*|F?EtL!oDCytU=v38h$?^@_E1u+27WASNCIk&IO{T
z^lFFylC(#I9;Ed{Cd#|dY&(C@5X*XRsvGFVrxCx^>5NpZcWU$=3)dTu#dI_kG~XGI
z-mxatca{2xb&=UU9-@On<g)PIi!*Pb2-<n>+Jf+$4I!=x*bn-j7&TaG7_nS@p7|UT
zOM%en0=TuhcVmwSl~o>Si$zKqUY!h%vERQrZjOx3%10C@L5l4$8Llh61;k5RF#9>p
z!w_H|(wGO}PnAHx&AY`YaB1-ao$+DYbSs_p>t4(FuI$P<t}q=R(S32kt(M{}<q(FG
z&dzxL-ZLO+?{!Bz=e|T+FZyt{QK5~;aQ3Oj06op=`pKRlOEf*UaUYi_MEJD<P@uZg
zG+rPMC0%`S^5dr*tbYko0&KE3T^E7*D{8B=Caf9Akv~xU{lMZ@T<I(rY8*(_3o2Mq
zBU(aeOWySox%b1zqu9I6_I+6dy@Rm7RqXKjrJs-3dUQQWKUw{R_1vj(tpZTT5={c%
zj+@(CBz?na34Qy;&uJGOXI4GdkW2#ctB+BI1?lKS5>|~N(Q1#Bs1C3RRgn7p;xLYG
zU41NAd#w@@;VUr``!K{wwJU~vgwbRg((GA1EZ2hm(*iT0G;WWd$XP>4kNR>^lJk(z
zs7+L-RQA4?#+o$_Z7pj-*=CZJ47oOfX51=CGi?)Ol4WLJYU?CWjYw+U2V0s?mms%m
zI>?qc%hcB*E0={UI*}^K2Wm*sV^*yK1?dQ<w%{1d0fVhLe9=TYAH{|BEFK%salNA^
zt|Sk==eC}<Iz4i{ug040^V@Co32x6E5Kpc}^@sa5Td~jaMOjb@3Q4BLwrg$b4wxU<
zLwwU$%zmG!Qd3;ZFiAxpGPNaHj#T8^PZmlIHP|U^4y+)r*k!Ghv_o_C0a|#kX9mz%
z&T7i!i>V4`q}EiJoWmSD$b@@2F|&}a)vSqZx?jJe4^ys@n&d1{5LBw?JuNb{^)2{e
zO-)vRB7Sg21{JR@w<UUnM7Q#HZcFB-yuOYSc!t<HY%{}5Ix_GA5su3F)us;EH)0eg
z(}R73_5E|eX1Pg1XB}0KShFLN9Zv*Tdb(D8ep+KyddLW@+(>Sy;@7i}cZZ5qSIOI!
zKd_bYwaMQFCs&*OcEvV-G~HSvTcDtNZRnAD=@oG^aRk#chDX5kx~}Y^i(Xy9(vbuh
z+M9L0TxN7~Kwy}Z9yM~pirA>9)A~kHQ+lGl!6Nw@m)&wuiJ{0@<RxwN3DkM`Ntw#b
zEVW2AmdG{~NfB8Zc_c9j{YJ9tOY9plxJ&#9QQU*^JWxKZ?VjVPa;}=sBkJ|rSvK;^
ze>oqzJJJRxtfdY|_Pr($RHL45hF4y+j$$(2ckal_C(V}h47Zo6eU2z9BC)|1SD>uX
zE_J-X2Ogb=c3f9VSKaE!CpckrEIRK_)LrF}7_MV&hop2?CSqrCmzLLwf)k%kw4ZO0
zsG>>~ZP18tr|OfokgvsD%c`tV=uaK|tGdUE33`pLsu~z5w#DFD_%GZwl*`6T6X0vQ
zlb&q9Qqn9zD6^_B3q_7-ExCe+<)odGu`?&dTa)6zC^`hdv&ZF=n}%BOg{reJ5K}K)
z80$K}U}~=4?IuWiIn<1BZJfMG6oyzRdD847Q+k6I&(Jq!wgQe_lX|!t^T3dKsSBL_
z?D(h9OCY@a6<9x-c854un>FJ)Zk(Yx_`x3qp&~nbO)PUczZ7lJV)%?G7rRonb&RCI
z7^lmb<{jBsyi}-h=+SD^GT-0$9z?S)+SYT2Ie6VGVLd~GVj=v~`B<XSyC59y!Q=74
z&-@{)%2AV7yDaKRDuep|Vh*%|O5$J7kIAUgC`+3t=Id(ZiO;RkcJ_w~B&$*t(5FYi
zIno-8pK)A6OtAA4!#i$le?$ERA*<|v?fXskqZqq&&v?cJtJxaIepVSY%Ak$JXd<2K
z51S;JX57uiQ9mFQXluLVQO&r-3iI0MC(#y_yNSiMBq<{p<+=6;hZVKQvqclSjfdzD
z8EJ&&CI!;2oMW$_0XXFxekE1$q}2<_N!<?H?o3*)A=leRcIS9uL_4+!yTHm%KRfK}
z<Gs8kW;v)0X8ij5SSSW&Z>yc3t3nOc&raUKr=XDb4N_^FKZKaUfa2f-aKv;;+*@x=
z8zsaVg_%(O!*(1-cN`3xbiq~4Pqetv>mZgw;PgyBfzjTL1R~unX4}Sa!z@8s=(|=f
zuOawIQkdIwUdw0|U-wA7W)prWyA=cgg>OxJ9vV`ud>U_Xe??Hy&rM$z=-Tj6yhl}>
zl98?Vq#rEIt1kvg($hTqh<H5fRKMYpO7!QvyDXBt;;c7+Ha&uM*NBr+<>tc?Y*Q+p
zmGf=L$4uN7ExhTGDO%LuDz@HoJW<Y=U6SI>oZJDM{J6#z(V4Ah!KS%+w@>EbSzb|&
ztlBY4itOqA+qqn*DMJ4i$Q(j$QMbBq|FZ7(<?imYo9##-`<ET1I6>N8Yj?Z{CzN<#
zgUGy^ES&kw0gX6lEdgMQXnT3fI8e?))oq{fcNTaH9nYy^g~h7sZIUFRdz*YWh4`2@
zMbBJk$Kt0AtMUp*haxeI8d$zJ3C5c3RYZ5EMk>#aBQE-~(-Cf?N#3Q{>5qmztYJ=v
zL2a1Y)VL+*9p<9um>xU7cZidU&!5$6XC+isAtoLT#Z@3?{W(_C50o{1uEccx_&9&N
zz_T_qvC)rH57aV~?$pB?WMUMkdZ;OdBvhB1Ql*Amv&~da29nXBZ}JINM)+(-V?INW
zLq|{nuaCruCaLOPPs1Lc5#575;=A*>mBrf-A;Pi;dZ9U?<fSSt82YD;t;^xWf^6vk
zHigoGZhTMlT}#{))6Q>43+xv174|Y}k5(X(sDoZ-WGt4AmLWKFy;+9mkZ2L3s4<4M
zl|3PtF(k++5wtk@Im)Np(ZZLR!om0ESkhyA3pi{y8SHrffv9$xnx>schu_LbM@FBc
zd2tVs9o&1+aXO}V4Zfc!hwshvotmWO6<wcpw4hU~^1MGa!cO;)(QI<05xTj%%8gYt
zX52<SfPV>oUaXaorw{`M1pLWadv5m3j&uC=u)0G=VIbcS?zmMe%vr__nO3K?>B@U2
z;>Gk$us&6s=RV(S@F1;@m!eKnXtG$7Ss*T7QnhD8cdUj&Y7O81^>OYG^7F$~4a#>D
z06OywjQTv7h?2WaRP^a9>XKEZH2b$m@LP>lp5EqDUphX5X!pFi3GFV@l!u-^%)fJd
zzW`-ANWo6cshIVOAM`4?;ph^eD(V1d+CI{fdDqgon3>6G=xt{xqgy5!STuE#G|@LM
z$oYUU^PS}|vwJ(~GdWet-XlhG;3tKK9=Ms=-Um^v<X$=7=_pw|H3?0aZ06L7%5a7R
z!OOG8(PwDY;Y{~l*hNNbxjmk(C_Rf{>!BU2XJaiX<CCj089lwWXgc8_heG#loJ=a(
z=6%~B?%RX*!<S+iWSa2H2<m$#`#w}G<U%kl$Tj#m!Z`q|V$-IuqB8&DZsh9fc>QJT
z8e-#3FmSJkOwzS9#V~16_)2_Hj9yc*)nLWdx3T=B=%{1`JN>PlT7PT`_Z>72iHV-J
zHbGsju&p&2N?Gq;T<#QJ!}@YSOvD~C6flmdoaiLrFHx2`9Uh-4p-Ar>znXVL<ItUM
z)2f0Y%zK||Jf$F#?uEC^^B#@zt(=_N>U(8+3{Rz2DI=%}Rno;>22lh~HCYxxHQ+dS
z^gjuV#B&ljW%qi<!luX6sRyettp2T0SVl1V&8(Lk+QH+!4!V0%&)1!jo89V5Boujj
z)P-1h$88^;o+%ug$*>vEL~{hqd^^z7Z4;X({j1d4CR{ObTng!dP69a{5c}(2+C5g=
z&v=S()*QkP2k+P%_Q`m*JSpK&>fQaaf{kZ5huahT|4dT=<#*POwL#Vxm~FD$v|3V$
z!(oc^9)qA=TY*I?1b6s@-dgR0p6;ty<qASK6>0TSfnHYCeIKxjWojGr)*>~x<5Y<j
zRLtLDpHoLpwC`YOPLzwJV)E`NJFa)s+?s8IaTLIet@8>Ha~RF7FQ}RFgH7$IlEYIH
zs<vX;gaV{znUEV|xXf{cM(K(|Pe(-&S-0gb5@GJ_KFi(Ztv)kda<ko46fB;TIf&9P
z+&%lkh|TVGV`pGY+kf%x!xmbzPFJ9W)47~pH|3X7Pi+uN-{?e5jd0eqkGb}cQFo+4
zK1RVi$gI9B=v2%3jctvH;3phk^X_Q+%vK#a2hwjwgyO%Iq#0Jb^h<U!z-;txV#Bb9
z0P*^}il8U336exrgQKqfQoq36f_H@wIq#)Noe60=>h`0ziU=;gXEs~AZFZYJ58gpr
zj7IK&CVSErC5A)|4|*%lP~ZqkU+;AH*3vP~QrN569u7rh=#$So9g8EyyJzKYc%5V0
zS49;uGY=w|QbZXnd!HN(%kpWP)Xn6;97D<`<l1LHr7-d1A)JWiJEjk?-->3E5mOj8
z#)Um@3VX2Kdw+KPzu&+sh0dm)@VW%>?^pgvYuMXxAk11j?)*{h?(>9r`<Jw8&+2+Y
zsG-PTvVCprVUr>073RMei)s!E<F>5AIR(vC94^<}xWig3`*6>sx{$7GSY@n)GgYMO
zB2+K(!3ETdK+vj2$HJx6$Q^A7h;>ezD>x%7i_xs}Wq8ghcGKii7~@z~6+!SlE1;cW
zT}Ahyx0@UIGA(E8C+*Q+GA%V3S{82#8Aa_#4=mlIy_X|#dz@I@d$4K@JuRJJ=sGQh
zrFc}4S<l1z)mE}79J+K=yK3>)YQgtKQ_9}`lUK3R%|jCy_Pf57tiC30HW!uqiz4bT
zK>lM}g{KmqK+ls+{wB5?Pdqk^&Jpuku~VM<F3#4NSmQwv6-iSJ#sRa5O_t01QgYF-
zBcjVaE*iK^-T=3WXZ*Dp$932(Q#S@@$(&*7D7hI7XP7A-1YI_!ZS35<gYC0nmIdBJ
z?bBl<>Asdy4hhf7u4?q{HUR&YI-;=!r@i>bv_F;|7^TPjL(jCBGgCZsdOwW)?o?X4
zP@5p5uhHkretC-R@7~wCqI?HLqZ(O_X#435{LIMAlM!x5!47EkIr6IFfxLZEKPH+S
z|3v?({ZrGI$eZEC1FBx#^@!=*EZ@O%Wk+oDt9DCvhrTv}RXA$Q6d;ok+OS6ZCk+KG
z+nuJdj3sG4{!ump_|5dC)QGbD{CL}Xs}IY{h_UMUyHAX(V{8;PQBxYPsM%Q5#yc?s
z)X!+T8+y`<-66=@?`b=gfKZj3nWR08D!k-DiEH<s=4(0KwuEiO8BDJ#@V!hQ`<$@{
z>BySKn$qRGJG~APHD{`-TH1YSn38lDMH2gmO8VxLZQUAewjN{p6teFqGHQf##jR+O
zC$Qkxj?O@sMcY)e@)!N8R3@G<+P`7<_bShsKS~nV?Y6M#2jI(zNcSeng@Qv`fibo0
z^X@l$`DB;bYI~jdaC~-WfbmHyZ_35eD6vTuTdUf%U>x?y!HKoCK@|w1Z9yV&=l?_A
zn}<W)zx~6*U@BXyCBrCPv>}n*3`r_Q<wDj;5<-@-n=zzFwxm*#AxUN5WtkyaE5<Hl
z>@&tPgE3~tEWhcxzW49GpZoq^_j4T2zt3NvKjt`$d4JCLdA?q+^ZkCE;I%>5_Jztf
zq<TI5Z~^3w$|I*VPo6dT9zT2enlvus)|Hb1S&_2Hx$nWc*7M5Qnvf?qhQDuzN58B2
zLcOudD(|@$9etnTRZOgev(30$!Pw%%6ur_2Uia=dXu1a>Fe=URpWY{5%KjEt*^^+I
zz<o3wTFm{J(xrg1=In!M^D}%OOrs~kZ0X%XQRIvc=I0I8QUOG7d9meY>gO#rISReh
zM1SYmu%V;6((lu*B(x<-i$sZ(AJmxJ+5S39t~UvDV^~ISVO=qvt`hqHW^T60v*zgi
zo``vpV;ztYarfn4?q-$TE(O)+En}R&JOm7e!uYl`LOpjY_{U<DMvsr}^#DF}{Cgti
zRjOCf?@2Voy~N4-<y11dCozBUe;L8~U5IbQVE(p#!G?sPL2F=Z6EWQHe~rfck1I9X
zZCA5pA2%PJ*8W4fQX|sM$oli0g{Lyi!B!9S?8mm+`^6Vw-cQl@cx#J4|53$#)SUa*
z7hS8qw0ZfA<-!Kdih?j_5sz{D>@_yWf85)aJ`|$8<>C?$5_R<XojW~0%J(!sb6qR1
z$<9!WN79Ra9C)%uFHqK4J`msKhQ7wz^S_>yiT-_1rr;s|<X^^T>V@d+5i}gV2_@&#
zZjbV>m%jYe`YrR+w*9P1+}ZsdR98d83?Ug0vEkwM(_fFR9@nx?pQvPw&yx7+=B=y$
z+~^YB`P*Xe_@<TCH8ZzOEBf8{lZ*W<V$F;C;~Pb|>ljXt&%0RBTSDdUqov(@r+l4}
zGLcc2Q(if=*V$3sQ(tww9-9lhNPdmxU+VZ+O|Rr@sr&y)*E;Oa*HZc2mbd8ZyL>nJ
z7A$-drz*Sl9?N|X4*Z^0Lq~`+h+(g1HV)jqCD7d5o0O`XdEJ8W-%rhutqcR`hqeEa
z;~w_^`{r1RM9}%oOEin1OCnL57PlzxxgTvKF7pD~k^|O$))_uL)w3{?V2=<1B*mW#
zdP7+FgBYXn$n6TBg$I{^hG;Z8`$+aIa36QKHVq$2F+qLj4!&B#koZ!+?f)|5R!#Bu
zAvQSr&x~`ax3ln&4laLft9k}ldFcLa8P4-a>(p?MO5;Ln$dwx##$w`oWb$^;l&$UW
z_+Ht^ey^s1_&rq<%b%+G|5-aeeENSiM|+~Hl&Z-d#`j)ce)GRyJO=Hl%VZI4{>x0w
z&1oy2IMB5h#%gcNRZ=wB%d$}htuqJ(?;l_~<0J6T;dTu^sTg3T;|LG}zvunGY+A5|
z@vr`j8+^OPA?+>x3Vk=-w7Sbbq%i}t;#KMNhB%;CjlYA<mmPwfeRztUx4s{7JyO1P
zOKM}t3u0;f)xIMRAwKiSwf)1!-}iH}Okmr<mdLaYJ;I=3$Bo(eB|516)f=ndc^?YP
z8Tc<WLUU*1+#l+C8_W1uE~VV`;(`CX|6TI1xd?Vx#GBEl*rzQkQ-7q@sM0}sZ7$EP
z;*NiuM#G4C33TH_vK0q$(oU&k^84$xxlH1(VHu&}pBG-LH@^~Ii#&EmVX{5@GsL_h
z?yG%<1t1zbcyqx?GsTEF?5^%}OJ+yQ!a<^GN}hOQ)SnXjJAP*Ji_+}g$Nw;LrP;`M
z>Nt0nP1m@?*^qCI=bL0bR_l_DlS+_G9*{vs?Tpb}A3WO;Sdi`z@9@=&9^CFHj~rCW
zuvgumJSaoyx@@Sycbb~LAw3QgauvEJqvWN)_&M;P+U=xWd4^LGsH3RsH5ech+l#z=
z@S9$_jO5oz1E)a@*k^^`xAwjH&r>3G9|2f-tRoSBL<U>9gxHKv@Ii7z5x<Agg-qjy
z+w#)tC#{X18=Y@@(|1$*{?40<6StJ9r=YrgufCEl*DEJAH^1kmL`I5@STfv=wuqX0
zUvgrKFC<|=#3ZN~>pMrU;Ggdu@lEUbo_CepP6s|ZGS1;Q3j(8Fb3a1$Q|#o^b=&!F
z)?Vdg41!llvkSg{t2(^Nr5SifJ@w@!#C>^fg_5Da&ikaEfs%K+p0u0I(ww^H*e7L%
z!oec9_nABY;E&_nj>PbN93RxZ{)bw-J4R{ehqP5%ds-<sL4kiVEP-;BGr%IhBV(3_
zV9vcPm8H)xjn`|Wk443wvz5Ag&hPu}nc)1}Ghx9rV$Y0*dNJvnf|7!gOY~$LH+!F{
z`j0b}!Nmoh-+vw)QBnFjj4Tj>a_38LK)JK<fIF}JwrfVz3H0Jp*hXV4+(?K^la5+k
zcZGy3<$zWRnX#u1?Eil@QuyLjT_)eYV2^LVy7ULPKxrfbTz>?M;-t$|ThOe6|3nRT
z&>Z(cysNME{6gG;dUL+hF`G`+4!1%v4{zwqrb>HI+%NO(6zHeF-kMu~QCg}$o}~$S
zbVhPjHseUIXkfboFUpE7!J>=^u$<67l{=io1-?%8vLty^AKSR!MjG#_NU7|?JSN#C
zr}O-&O0ad>dIoO&n?%H&nLSS=lVKk`P5uoLnb;X)kIs5%N4pSZX!$E>)fKGCdUyDA
z^&>lDTT?TjdouQ-#4JBgk91m}X!B6p)Cf#gk;sz>fW~r+a4YLaj#gA?$1E(r+UiZn
zP56w^9F__HdTMq<Fk5njTp6dRt787B=*%tQv%Uwy0>N~R0zJWzOMpI^81?NTi)b{6
zkt)cI^zXa8oa?ubN6sHh|4)qg9~op-A|{mYoN$ug=uoPEH<thUhzB{9^y=%W@4rtJ
zChhSSpE;1wWx|_F+H|Mc1>WIL9?!a~_40=?->d=oLGK>jx>aWB=Y$bajJ$F4<r8Y<
zd!h!1s85%cLdm<ma+VgD^!bxoPgeLF>!P7N*Ew#*w?}->s<lY<-bfu5wo54$`E~uV
zl|ILp{Ea(+Y!P)SW5?KG?=q((qq^KJCWZ_N`*EHN*U|IpXr^<692mXr$9p+%4c*jy
z0a6I_|GZg&_Wi9r40CZ?vo2WVpgD@>++dOXKUwnD!5Aadf(&PkAK&KKyPN~gHk{z$
zOMMo<N}CS&H0{vj>&D9$11U+8`6;rezKfA%XXP5S&M7WrRi7;mUkKA!FXkI<1;q8r
z-2K7XS%K3)Vg=zL$wIpupzKz7i2K`9yu9tvR8G@3yQq0M97~36zn;f2<ls2=M;Pai
zZ`(K?sKhEJZ1Z&~^S!lMA#9BauVUw?g{sTErJB+4rj*Z(WE*stA(7y~CBwJLYej@I
z<bp?3&pKb#rM?}E<g)YCIr#Z4b~Yh&+z7VTXIH{wyU^b9a7~&q^!ZQZpjSJ0KQ%rp
z_#j*g_^5NgaoWY(J_#Wwl2;6abnc$`@a+#0xy81{>(I&Fvd>Hs@Ke!MHxrLae2=}n
zXUCC4PXHGcj~p7XxP>Y0+2&UJHPvtZ+L~<go2ec76iNR%`_b8BwAz}9bF(wt#WNhB
zj9n36zI3~X_kl*$4He&O>Nk41hi96gy7Yh-{iQcC38wMI?>dG3It%mihGdHFOs59)
z>y9P@yI5KRMva9*ch@$>s6ZDR;wY>wEBO#7#1H@Vu3DLFE)5RGuE|kguOmpNxM1DQ
z!AMH-Ptp;=1mnX`cKr88yqggFdY``XmZ$2z36=_yi~%stZ(4a{s<{`%5tf({*djue
zS)j1X*`V7*+RroIAtCPVQ=o^UOl9XTh*OklM`pfNw3uMf?c9B0%Xpnr67SQ_M~X<x
z0*r7n?Kl9$k&%{CvW{PK<<(ci!*wigS|}MGT5`j!^_An#7<!Eo(SIhN9a2(QdpX_9
zV^_DDL)q%B7mIIhz9BH5O)vI_El`U*peTzD?DO^ooa*K2drCQ-9Y$}$W`4xOxOo}k
zL=5j$%we)McUDrYLm`w+ZRkbO&y%O+1^0Y_i&!)A6;CDy1Ap-R6;XNP5tK-R9(yyB
zpqmxAG%jX^B1?+z??m&=a1CkQhbeNaD1v}vY2>d$bFRA4l5DFqmipQ3=k9$m=M?u`
z5Ze3S9;G!qmf2l9$f<+UA6@TT`!&`(4=Q<0n}C|9tuuta5;v_DhjscYSMPfJRt>{9
z;T&Vr7Z&y0GGPq%>RLJJc&u%~)Q($#JiKg>d~^j~XznxMP3+Qsc_tp5g+wa03MaoU
z({Ya(4bU3CWSL3wGCdd=<C_BDDM|^KpqL%ymimiQt$7em-86;A^^4Qt48fC>pp-^L
zJi39)n${q2-woM)8AqOQyc^XNmK8E)8gKAxQLQ!6g*Gv5M2YGkyZD8C*;(u#M)s#^
zbnr(vjA|gq-Lg*^F1x1Qg~vv%P}5S8{<^b6>JYVt<^DC%#Q`f`_H?ozdtiFaDr~*(
zsmuCPqGYHaY>4{7+$f}u^{FsU8pmL^>JgEF>~;E!mBKMAOeCFJ=7$=jGJD~t8cAE(
z22p=RP;9}5{QoqL5IIc|%Ya8Q{b%I}w;5arV{Li~$IWg%vm)BBgIg4D%_OihT6d~s
z=^D<;_8wdVK}m;Nef=Wi%Rew4XYjbq=ff*A-<%=`Sb4nJT$`@M82OdXc4n0BZ>I#8
zZj0GfZ-)(Ja&IvjYPmS)WzIw|Z{2@b1*)ADwvisUJwc4h>$Stqw6%IbHx}23I@$P{
zb-Z5`<A&}Z?WN%>h3%!cn0sG^A*X;8S?nTKQYO3MN?YhK@S%$+ZiD9upv*!H5NyHh
zki60dpP3fwoOS9){^8ih)leKrJQTa(-0^aEye5n_J+0iKVBmz>9BRd2xk=O6sv%ZU
z>!GP|KxJHy?(Bit4PFa`rQZ6(O5ZE2xm;3qH6S%oqL;hLgR<wWxD!+r^m_MnECfk-
zE#pT6zd)8;vsC#vG06{9-E&H18!AdguwniD(A%8ysF%A^^$UXkybbW28r1V1uUEQI
z`|`5UfWwEH-BlsG?)}&|K1J@&h*PJU;iE4<%pEa#JPUTC2cIjKA_n_YpLHlm>j?gW
zhU_>6kjPP5O&$P^D4+tCT}^o@UOtj}7<b>=Fn^%18V)&;nKntUsfCD!^CA|^hd<zW
z9ExldXCx~8<O6=+zBz?Aj`lsq{^8n$KDiuH+c0}nA2$NyRgOsXhSSjy(Tr42*qZ>>
zBH`Dr7T#(0JRBRv{zCJziforriUQH+947*Gi#bxu1nm3|Hvy(cHuwAVl4Dw`AX!|F
z2SaXcr9e{*xbKVWSmJJdbUz;bhufhwG^g87(#|Ekjrsz|EL?+VMczJf7|33w$Wy|I
z)9&i1X=;pAD0Xx~<zR~8dS@SDA0~`N?Mp>^GDzky-6WX0f3Kg+W)!U>>Mq-tpo3lO
zZ7+QT;Zn_0X`9@ucqBenLEmKy$BP|)#OX}se${QaYh<^zI*x}i57Gy%8!*SiHZn02
zyB1O*q9f|OR_SC|E_EMlt#T!_AoZZ=Vk&APR1Cd|=DkJ5a6qj(zbG*)-V+1n!7~B1
z4X9t#x(-gmbQS_;bLHN#RXf~lMvGtAueZL#-#TDX3*-VNsfTyYJ*J1&wZ4f<RIB%&
z+YQQwz+YkryVhzOIP&or)<+CP&0BbGr0Oh1d@SQDY&<IDA>m_G$2iZmZszfc_{v_W
zcUY^O3k)3ab<Zrq9s0vHk9cZJZ{!N>A0q6llCg7uOX@prm(}3)^!<0`_c9%L?|Oxe
z&0k14w0U#(jk|QlEV(tY3X#5rZn%`ZS4;4zl+GU5QGmobGx2GeY%{0Z@>$OjA_Dls
zr6u~brhv6@%#2z+$rJMe6K@Psa07bgdx7+4&#9GRluk)C$IT0lo;TH7Wz3q>hwR|h
zX`?1Bndp_z1+g<O%nCZ$n}HL1F?}tSMW6m|3+Cn7HTmqHDkM<0xe&Q~gk4cz3SF4}
zYl(!}vEIvut7`;}Mq0kQ43<4_A%d-mngT-J-q^0E^-mvIS+Yk?E@f}Y;*|5R?wZ)j
zR48MyUf-W4G;Nl~TcKH5)AvQ82FQ(C!&`GG)__N9g<s^jV|(dSW&{npvNYyMVAZq|
z)pXHyOU@K%)T?gkwq{ko@a`KA6bwYs*{mj5m9cz#DT;ZTQC%8tv)#{do86p>H}nZ>
z23mT<x!DbgJw#||OS4^f^8q_24K}TpefESh!8eT2it}aQ<0oN_6cpuPIE2w084sG^
zwX`n5L)%AT<j%Y}`1TN70av52bDY|t{(zY(h%~_|Fb=FmAQ#zgexdaP&hg_D3n8tW
zD}~{rJyi92(#9-WYnr*f{bi&oe6x|rY4`sXJW|cOfLNg7(3_#{=nE;OP1C4V1W}TL
z?0`vh)Xp&WQinDpdSiIT0)JvGw9i`nkHYv@wUlVvLB02@`Sl;c<~s(#AMG4?LZBj;
z%YgqpKG**;#NcecX{$&`b%LsQ7M1o3Z^N<v8SunR!P!`T+5bmJ^mjF3>jzhFpE@25
z#A~Fu8RzMr&Awj@ED7@MyZ)|NNAw=GEI}M;taEDgejFGH07rKA9R^D3*Ky?zjzae2
z0M2WK<;{$opJmLnNvAG1RL#u9k5fRR$TyevEL*@?Z{L|>IWyAg3OHKRH|Nz!ZYWQ(
zcs0Hh<~R8`K-z`&kiPvzMVv=VMdM~rZ#jm7{)vtgcg-4>E7VgN?iuj0aXMmevwJZB
z`Ms|ri81O&dm}d%y}XG+$T8VM4=YBTLsu9GasEMpH|^@advwX3855_tU|`jW5=M8K
zTgRE!K681a6zMS)7<1?AJq#}(_L7TaHZu`65cPJZBJD~5b0muMSt%+p-A}Iu`Re;f
zx1gJoAhzUyTHREoQbhknl~h<jORp2vdavMCub&R^Yp79XH^tjgv_|e{{rE3R`JTwO
z2F6TcoFw<#c01-zCN&;fcE>0SK`*fF&0q%5e`3IiEk`%Do7ofR-sqgjTT;vnmlz`I
z-#Kgf4{!AIj%S#po6Cc;AFUj2R<GVzdOLiy7;P&{&e<O?ut@vpczxij1j@gerBVzn
z7sZ=PWbV)L=2UjyQ1LySCl*yL>6>xC%u@AzKl!^!1cFw)|Crm7qJO7iIq-sciUlf+
zE-s<fo+p92P4bq8O1n*8mwt6ErGDg^xxAiJq-s%fh*>knVs!l0so9xYpHdvRo<9D5
z>mYa83SN1T96R27nCiZ~f#GG&_5zD!K)dZ(=ChOdD5;y3X3YqP7Ktepg}Ww<V^&P=
zw7|-@NetHyrjMLI0hhfO++A!JdW@TIfz{2Lzyc=k-fWF@*zS6W=w%L4zr)#!wq?*;
zVRS@xt)mW{**%~4UDYqRn;h!z7nwQk_rcucmAAxxwHRq0cOx#8-)vFBB9s&uyCNhC
zvH~*?EDo<g9D!<|=PYJ>T^qNZ{U9!zpE6RkeEiqkRhu&^$Hk)#EnA)S(b5Uo+HOgD
zPKaG7Fntky7VE#5fis+7s)be>Ow1|k$fDKmhgaH<lJq?DSkGQ)|3h+qrqtYfbybM`
z80%w=tMar+9(XHw8o&u(*{5%|Bb;p9nm{jeHLA&VL+v}5q0gWQC-;B~BpxSiUiATx
z?-#a?=9JzH&M-K3`po6Ty~XEGV*Aey=&7Q7z5s(d#f@X*!LeE6)>3+cDJLT)wbrRs
zzwmu8Dn`u|#>eUzWAb)R0dsrIvx8QS$0f`0r)yHpPCZoL<sf&UQG51@dNgm^*H4}|
zT}k0s!A?sF`He)`G5A3B>+}pg@*^KL#K#*{V}Jn0n?JcDq0^=-iCvtX+pP3Gl<;1I
zIF%|w6>2aKVi0vKvgfl$EupJv#GeN;3}e3nKF;T3dxQAxUzDmf6?rTlY*wTFDQiG@
z!ulpLWd8%^UWT%cUWjfj$MCCrhVyXy*4&kc&oGcFkK@>RM+LpBqy^$}%O+xzPQHQk
z%nA7FrsKHZZp^^00XFD9obiyS(a1jva&U4os^^vj(iJu4MKI)k73L`(!X>glTD>{L
z<*w;WZgE=;#(EEDp}FC$lDy7=I3<Ue$Of*!XJ#F#LBSK#7u6cN2uYC}>D`AzjE*q>
z<lwfNC}5%(E{$DcyC1zgn>~nCz($4fwkMt2w7=>^NcfF0D;4Dq?$G>)*Da*f%*)5R
zb)=|Q<!%U<oVh?wb^>f(yqh+tAQ0eQbmdY(b@s)?>@$|PbNkK~<YRXp^=>+#a1#=K
zyG&TEDYvk`5Sw$TaHX8I>ss_q&qq?xC2wQjSF@6mDkQFEYkTzx3=T=v3q9g>ylJuj
zP@-KGixU0Td8uGXBFM)%Y;(wNf<|&nfi9B0!%||3Q<_&Fw^+dYPseTUx>*{v36aRC
z!I<RKG0NhN0@;MAW7;@YD$l=;Mg9o5T<$GXH}=2_6I1Hpw_kS$@6;Xs<oay78Fd!p
z&uWH|hqSY7X~=P^ibrE0c#Rjn0+G~doKB8|c=K+`$@Pa5-xxGb3FC~ov54^i3xlzP
z%uIUfccT)Hn-5|5aW5s3x3KF`QYJx-I}PEMwpK<h+I0~2FVsdJ8(cj`onIA&GYnQj
z{dpUFa$x5i?7j_Jh7PuGzMpRAgFLkbC^cqFEH!M-Z46csLbSbsLo#ABn*7=8j58}b
zj}m_Ma@gw0aAE5sQS&EUDiXONyBFX>sl4)cC?m^jFH1W|PKfy}oS6QRwB<};5vS+q
z19GXp-g8|A=-wMe=tT>cGS=tRAEW&3>~kJ=`rp#?gyvkCn7r|hz+&!KKc{uvDaUW`
zdPrs~X%T;z9VfrW7l&#GC8zKO^H)x^&t)+RAvpv6we3Ig*DQI@Q`Au84<t_u+2ARG
z^_A3f4?B7+5BY;sEDKG8PJM~a@9VF9GL8@M?=&gwDHIFZ9xbjw$`&aEsR^E2s>?ql
z%D<}7zO=o{3f_WldZ!pp4~nWU<E#?#uHpvJN~_w?c!P;t)T{6w=+DvP?oo~}N~24g
zUg$+l#msE&8z0Ha6hK4o-)G!;JcNAp%}SkNfExnw8U*F~pWC_Eca6tcUuY^py|Rc2
zvvTF@KGu#&u|!I*;dlOcw=809sSDvuRzUj+2NRAr=yAseLw+b~mhng_<;KPt=0r~j
z?ac|?W+twJB`eN0#_)QyQIFdYKT-11u(Xzg>ncX{;mOtP*2%GCmw%&q@K?G_e$Qye
z*ziS_H|Kn(l`tgUlL1K8+BI;l<z0c{TRTyAbDgA0o>i(t^lxJ7m9?U@zl;^Y4hi(m
z6w}}J-HNSOX*>=Re^TP?PHL5lxqnv}bWT+9(R~RojR*TkHDc$DK@H@yBZu?_b*1a~
z2bCA1NVIA*2pAfJGieyq*+CNs_JjrW5n%|P0fAGq5^9E<z&6vulLDEDC+0U7b?!*c
zJz>Im9NFk%g?L``*i+|SGuxF%EnS2C{#vZe$kP&0$8YT{X?np4;<ZK~+}}x-I%+Cn
z#oo&_4w<<=p51m3yOR^S4j!Jkq5lt&b!fi;wB2B}ZZ?ijMALQdwsQR&ifpbU-VI;8
zviG3zuRZ#0=a*jL2Xp5uToS-_X9l|~U+fge76;ocBZj`bXLT+C4FDBivUK{1!mc2j
z=Zz*}p1TVGhVqVs4<(XKfSrn^>i!_-l`uC(j3vZrn^g-CgN*-)q$Z<Q_9$YdprstO
zmEaDrQ5KrL*6}8=&n%N?{`~bl#XX~^1eZAA^ENXU)6MjAQ##ojuyI~{zz|)A&}*x@
zi{eomknum1tbhGV10{d{Uz6+rBfc}?tp1D~C%l^X>p|s@u<N1kL>5Opq{7o?E3AI(
zmG>N0m(!<vsV;XHEF@fUP$LcMc?meUuc`lfeQb99ETk+IO+9ln&GzuwqqlZ9#{kzv
zJe!{M?E!XV8~WVXKYU&(Ic7i#IX@j^ipXJfDA!Essc{qw3~eGFH+Kpo5i3_%L`@i*
z9zV%kmAu!M=RF2{5v<q9kG<YKqu;GemMha`Zs-U~JAd_Sgh0z|aEFkLb4Nm-{`()c
zjM)K>TrLL+PiyuXrmOc(4wr0<xuc%G7*l@el-MFJ@BM`KJnwu$Qt;)VB6sZ|A@U16
z|EKl8Ei7UsYjxZ6&Pkxjt>!PFSA8#;g7h<HosMaZ?Ko{yA-NB%pJ8?*S>Io*(6mrO
zRi8u#gN;~YAM1x+=#N>~id=HgtgVQjG#I!00%@9?u|m-pvnlc^Mj<2Um%ASRJ5BMw
z#v3x&toau8j|`{vX?if#eEb&<;UQFXX0?QSq3Nk;8FweN)OVPrTzz#}l=>`wRrp8!
zvEnoK-XA*c)$<=xZXB%t)JB#YJF0cqfLG+Y`pzcriN6G%wRune$of#ZcK%T2l%@w`
zG<W_wL26uN-)oz|+nmb>u>u;q$?#p2M0g`Lu0uYuRbFM1J*)x=o=aQVdJtN)ooaK2
zX)0Yp4B1k+7cr1oLvY02rih>WhYI^I;ZN6i&!~@YB0=o;$+h@>mb$KW?DcQ3z+roj
zH{)^amXK@v7c89azC^BBB$r3Y`ozd!rM3LY&&g+kHigx-?!M@>LCpyun?X54nCCeQ
z2`Oi+d=9})2>s;(mfk;t{;)a}vh&kkHhG6qbUXOuX#lVWFM35UjJEbsLI((U_MOGK
zhzJ<b#GlgTybj1H?B<ccERiK=aoBp16>^T1=^WIOObH-+b$~<J<poY5i}S4q>|D+)
z*WKyxUkM%&AE`d^KlR`L`mT-$#@h*{_&^>h1P@*VKAe*KMLIugbxw;d7^VCcC5sGc
z7~iU0GFqva^mOifdn!onZpt7;73*;I0q6?Kk%50+DfL*s*;bDgWmtIf%r(-ekjy?q
zuk~q@yi_ZH4j(uGYyAqJ0$&XTd=gWQZ81?jH9n$O%pLT7*C(OVEG%!dJ%i7m2BP=B
z$sM?xN!T5?U<NT_RMq;90LO#JuJ}b%Dp}Rf`>Np<*Hj3kmvX-tjJ(wPzJz2b@=E&G
zW9a4+?D5VU7V+;VvS1WDM?_=yYC6vwMra=Zas3RE$1vMPD0eHp`Dd40zLpm>3R-A|
zJN{B*I=uC*hOemdpT}@RD^E-R7_;3Tn&dxUumAu1V^wC;lpyy?o%8f-?~>1T&KWg4
z18%pddLy;HIA3hbYGuabaF4fi^;L3;lU=PSRLg;!D|Npmci{S?eRgp9<wrU}Re7o`
zfHr`{C$1j?&bG$aoRk`fH~+D(IW<Rua~Cn!dnucoR4k$K7^vo1h1XJ+&!&ULRD%H7
zZBCxgC9JUZooDl=P8b7EiWHhd6lTAu6|<`IjgvUzRZH}hdW(kDQMJb{9kt&g+tfn9
ziCdDtw*5$*wUUy?psO#W4yw}M9PO9$np;YY2l*NCy88lG{CKQHzGeJ|`cf|^+DP=K
zC4e^lxwr3L8@B+r4Eu?$;N9j0z&g1D+M^;r(UIUl?i~9HH;sLQ=>gmK6iwvJ8aJX}
zr7u&M@q{1CJgj-t$1cR1>J8Rq@6Ui;Wlo*_f`e;yB!u7K3KjI@th%m#O{a5Zx`?wp
zt!Vp@sNxdid8~w`@9u1E5|CsZTX4C$lEzMh3w*K2aZNrPt3eWz0T=9d)aZP8GFJE~
z{=O1Ocj|HLz<Vyqd!Kz`3zah_-7tkeDdq+@qRQ1IYM7)Kz*tVzkCIf?Zqt6^50s#3
z)Y2qXWY|}so5-bKu!`ud$w+5AgCu#!P8s;B@J+${y-d=~zVP-o#I4J;&106LrTygv
zX#bUg!w{b84)MLb@3<nI7y723KfH^Z&dK=vWJ87Mx1Kr&?}8OnrcLxAo@z5gCt>T{
zwojy`!xT(7&ytgi5sgQ1+BSQbD*g(Ay?`M9$v@f_H+qu6!Zzevh$yAxYT4V<N*&1c
zH~Z_QwE&S*PErw@t{B4?7LIm&q-O(Vjkc>)Fo-8^87m<DQD1=XzO_nflV;61`P&_m
ztWlw=n3LN0j1l~v4ycx!C`$NL20&lBN61}PNTliA$l(N?SnHK&giUn3%e+Zze8p6E
z-+IMPNw6_Q_HkLXnS&>_4zSHS3z;~piHsgjj1)3YvE_-&2QcxQu_uF822@h2@Bjut
zH3Fe;IG3!1x=k~OfE&oCp`0AhuR?lXVaC=_XCcvOBo=gqNA5t+^fm%c^D4L%yvy4)
zkw<;$gvFEV%Vj^9nr{vjL7G3$Hm1GUsKsdZyqSXxOms0bH*|=8J#d1Yk?B+P5#H(4
zn`&VpW6HeOJ@`5J?bnVO=(~kIuv^O$dG6eu>!b$1uDng8wM0X7(Dr`Qa&i3i#vzr{
zn|FVu@q?;}evEp*)f58F0f$T@1X$%mDS@3NbEA<XD2{Fj=cjqQp%uzUu)61wLP*nH
zf^JTwXik}e=Ve(Dz|AKn8exx1Y17Agn*pBt4bl(;CQ|ag+CdM!3#DxPX8V;Rrn=Wt
zJ8W>Iz++bBc9@hF!BeNl@`{Ds7svWt_R0C061jshB`G0G93{z9QvSDFJ_8)u%^gvP
zI)raph2Ks%QIpdG{L~mwF!bK-tW;Bk>po}&>m!{esm|T^S7`m-WqOi<+$u$_4@CDK
z!ZE80+&-fDdTG?1y~(d5Ut25lE_2^(r8c6=A%IQ8AKSz#j|Gkag%IDpt<%=IxegoA
zD&ABXZd}6U&MNTV@2V^~a@5AWKBAL6qW<v26-Uw`bJ1wGSg3R${TSKSepz2a6pIL7
z71q1ig`3SW8xHUU88vHM7*VGX@b4Pn$0<+&`Dh7oyd7nQT{v}crYKe{?pgl)7e(Mk
z?gbBjeP7biSg^KFu97Ll$U!X{YB=ALA5#dzd?^#QrKw)M`e8^}OU>ARIoEOJn38z7
z55Cl`Dis|>ianv!)L&-m<e7``D#*=KV|4<$w_JFl;>HrExHeJ>K^+gkTE62m5F^%o
zLl$BpGR<6$XB3yf)AD<z^9pT`{)uKOP@)#2?q+gyh*mv>Imj~Tek72im(BKmeWLv&
z(_`I=j-MlR;ZS~e{5rSIfA7iwY7@Fl?T0s#=k@MDUC5z7!S)*vhiKbKTFd;kDjUe_
zjMLR03gzjNYT@{n+*}YeBOfm+{z2H)A7DgF>#GTw);P~vm#bd~u7<Vrfu0<YNvG^)
zwI~M>Ve9z1C*{7R(~4!X%^Eq^XgT4gQ~(JtvpWX``rz_>Ks#c;m%x0Z>#ox7gz>|v
zC`J|Omd8iQD@Jq8LtZ3uB7EhL^@_&%pq!5&@rG{gpte}sSpi9VK)wFdSXxR_w0iW#
zw@}pz%NKDeId8%t`q5U#j<oWYhmiS$`hpw=rTo+#8b3e5hR+Yf;d0zRlvl6emj?uY
zq9ec)78Se&Hh-V7m6&$xy>o<c-YF}x{n=FWN!;+lW!gIT`Ih?drAZuXj9N-@+`w*k
z$3*c0of>(kqzGskNZo8zad?{9RrhJvc&Idr7^}rk28N5H6_TY<YZmbEIhl;p{B+?E
z=G6Vku0t>xTWm-JZ0~>ilUOb6oJ|=>5!TnDWMBbT!hP%P4qLkq*;gxQo%kYnUjwqg
zxTn!%dvtH@5I6!5Ym#EJBxkVSUcj?6r_{)Q<)YuaK9S-^2T~ix?fiRsp=1~%K2EHL
zs&0uR*Q_3GWuW}2@|C)Qc;robU(0(*TLV%|Yo2h9jj{CA;e;JmoRNV7_~yQJiIk{K
z^%Sv2azU`&)y2^i-Z9$*URB6x9_wir>l;6j|0{yJaPKP>`GMm{&_kx)w4CE8QQ-Uu
z@sr0A%pNwPw>)=CZ;87--J+OoaK^WkFvm94F&{S|vdxAE^>u~+bPwm^(}Y1&;TO$8
zdbpVn09+~n0GqgY&g4%sTZbW2mq>B>mB2eY$*%D6P9QD+P=T{&r&7GCH!AyKvex<&
za}j8<G^@Y*;mJT+afWu#v%H5cu9KyWdpcU~2-wRb+@!7*?(?fyZ<g29Zq60x)=L@d
zux+vrX6WtkVWdlv4ujwv*1R9*tu%DjOxnoNcLW>KL_8jgMm3v<s8L3}$G_T^1L8qB
z-bu@HBX{Ar%ZDikUSD1L6D-RD^xlIilUO4d?$D6JmOL*3y+EkCXAg_^ez0j1FtYpf
z?+sVMqa#K)QiIbrJRGE#<@M074xn6iOKuI!LAr2H(Z6$(-b%vkd3$>29LCz`k=Z&$
zL2}{ZB<#K638sqX+g5HjPOl-sfLW}n<e&U{YwR?<iv#dqhdr)?8hCcvGKb{_;H3U9
z9U$Fk1%P;CfBwaSRBTk~J>8J}V}7{u^V!-X8-A9F3a6_jlfMOM2Z2uz6=rjU!E(B+
z&V8AW`8fyxm)5E;F?REu07Vx83*7O>@&H|(M-oVulUUr_6M&|%qKc`>mmrwdif19&
z?zL{QV)9Pm)w(&iZ_O=R0yenr{?kz3gTUaaSm0<8ay1?+`F_3p<4H;9C+C;)Q9)HP
zDO<Ma@Ac%9%+Ql8a~Iy|zA96GVmi)WF!(T>kntNM{a_A^ob4e*LF;v1YaZc|Hd?b1
zZ4H?t&j`xA<s}tnXetoB!PRI}q`*-wbDR?t_<~G0Pgj=!BX4|ULbk(yphpLC1hRQe
zBfPsEPESLy+_ZB&?8u(lo&r_mec;S!8_w-xam0FgZ@#6exf8Fu)x2jLGd`CU3Ko~|
z_;SOWb4{Mn$tn?+2XA-Be)A(evfIXo2<#65b^3dW#UEI11rZOIRqaRb1e@S3P3?gB
zx`_(K^%G!StpL_cR9j(V{gvB;eacWjyqX{|8LK}P-R8x_ubGNUW(8P)>_ASDQ)H8k
zmYW$ja#F=^78+KpPk$5@2S1TWxe_G2B8z4*-kH5%Xet9<*YlMSsG%CNzuTMiSVF>C
zj+Q1ogX?$|c7%&^xy^OwxbwQWnHwI4hdV0!D>aFfXKwrzBf77b&SAQ6+YX)E9qZfh
zN!&WuOTxr9ZHtoan9ue1ABG%FD#_rP)=thF(%I=9PPOj^d$=8yBBAp5Pa}964H<jf
zf=&F3ZwJLG1<`aFbzNx7(7w=<W94lM#&Ed_AXk6{m=)T>u2Gt1?F>lw4W!m0c*#wI
zK5v1FiC1p7$?5llK^*7inB^}o_dJ;m^e<bCwAPKY1I<r8NtY1MI=e?#ziRBhL`qY4
zt>l$()LXZ-y4(}L?uzQ8f*C(|`WufY31?aSy40$klRaw<a%qChH=*Yiwl1E`30Rx@
zv@-16W+%HGJ0N(b1YZTR(sRJ1*SVP}M5mxTd=eE5OBtA%u`f><wKAvd>i))3G)}H+
z{4&m9OQ;u2-?5ejGm_Fn+aEKM>ViE*zY68!rDbm=er%cY_nU5+Utm<3ZQWBee*iQ0
z*NC~JL>De}b?3sw@}3#cX<kiF+l}vNx%yAA^3-sy($dfPqz%WW?)dXqz|B_96I(s1
zL-fOvo<{#fBhiL2Qw6X*Ln@uWB&62(0w+^*g9%WTz7)#aLe}xNuxIDbv*sA=HVzfm
zJ!A{!9#$+fXqE-`9a~2j-P?cgw3Aqp)RPpkeSIb;5|j4*nI(m-r>XW|vc`2^lWBi}
zo$4EbYS&4#rpUHV_6|8U4Eps9sBz-SpxGh(kddykicsL$wsJQ^uR<f1g`&JYExEj6
z>;dJ-KmqiLuw6~fWNOrtVnw6>3!qRC|I{G$AN-i&BXjtHE?5NkDS8u};dz9go>uJb
z#~abKGc%F41ikmT{tbTRD{Vy2bCzyK@hToUY`_*yPC@S|G-D~q^Vw0)1&B{e<O6-e
zYdQf^;Vrp)P8fs3J*&nvJmPyE`ZP@qfbf~pan)T6az^`ei4t+7qT{y37UA6R1QE&W
zP>xphXN<Z?pA0EEftNWLY}`2$9VPtulaNRzNfC&Th{aETLp+(()qe6&LL$1gKvE(H
zzG9rYUApxiwW1%w+Qi~pVC&t3(4Y<gWFir|FLx}R`1Okv^qqkk<<<5Vks$v${QTQe
zdD42?{1^3faeX>~G?pVNuV-vDpB5W0IaeiFqEM_o@2&Fp>cF<rYix?>yXgCyQ9=_a
zQ|52DiTD?ZOGJEO@0~!zYBN207n4(op6is~;3*xQX;oVsSZ$}wQ$9GLC%B6BYFy`*
z8&M!%Uok!8A0u`}_k>H}zYy(T^3DY10|~@GF`2rm?0TN7752;-pIJ!u=X0j!m@#8p
zG#)=4=!3_Ds;nARi0U<iX1&{>jtn~4s5!R8j}?vb&cNsXw3T(wRTTt|%aiIPuFKN`
zzT5;C)kSpr+wT}EsISH+CaqVEJ{iW_q{-+b!#B60+R6*X*6Bm}!VKn)RRR0k$01IT
z-(ckS=c*WmEy?JO=sw`H{89)+OrLzvJZO&Z6u_`^91XdipsDR%=Ec`uN6%$Tz1~tH
zl<N#1)vOhO*rWK7cpI=iHJ17}8&==8qQiS0WWlmh2AD55YKc}~9~j-rHa)_-z_mg2
zJT|a<imr$VaW=sJz2Dxj4Va<p6wY(>Y`iFyT^=(3N|jJ4XMg+q)>NJaMyko-0v{#_
zjOD>g9Y{k^Rp~&|qDAJq=XBrc6o(5U{Et%dSm&iPlbkarF<3coVOGH9Du8OFZq3)i
zliC7qOE>g`>C&bRz%1RX$$3i7=J@8c+yj23qZXp46vKzq-1^>|U7ve*CTK9vtaQvo
z1g}=COFJm!PitC^Jatyuk95fnQspG_tK1k^D-0^50ON^Y?-$7Xw;P~8tb2?0*sOTs
z(##c9qqDeeg$i0h0_<4R!aC$KpsMpvgEice;UU}hiMqWF2W$CaLGPx`h*R6V2dDh)
z-?cA&BXmXYH6Lom6P3J8FK~y5X6wDjq^-CsWRivku1L?LZN35fo9JEOYX^C&d2;h`
z>JxXu)TapAFZd{8N~3lHJr|iWewW{ppMzwt55d|T!mCLA*GmhzZS&(Zj(l#K%gQ)k
z2npV_b1xGP>z!H}f)pP+9IJq$(SQ<H>es0{!pD7%6p5X0^J@ESe-CieSZpwJ*4tUo
zB1Sqoz6ePgZPC_>h6Z`jru*y^<X8_<Ae#sE*K;;D)n{YjzBl8`|J0|`Y&dx!`46XA
z9TMx&P|r<oWZ5A#+!!7dlA|Pgr9Qy--GMiegUY%gX#>);hq){hDcO=sb|5+9O~SDO
zL_Vc%2DaAAURwHN>30ATvS8Wy%ZYmEkp<b`8T*gFnOybuTaWX6<UM|85>~LqQ%Gw>
zSDqi$i5`SRh)J}uM0@XHdFj$;L3Jv_u+3whs|gD!^l1&1BDc@+he1~vZ4#>7XTBuQ
z3{1v{pyk7P@}eF6RG=d9q57OmV$}12Qe@EAv=LZP@R}Kc5yr!V?M%(7+`f6}bR=vC
zJ{0m$!gzf5sd@waE8x)4dKa<B84$nA`Zaxa()zlpIle*9V<aF7ilsBu+!OI7ZSZ>v
z&JJpG056j9h)DhZI04V~G|+F%5ilpf96hW&I>jCGBdO^c(tP{!Q&ne=!?WqRi8?`F
zy~^F$Z<6prD;HWNuCDyxwAxu=Y+S&f8CGmf9t)bj*^z?ZdXREu`vM)KkhYAo1{*pC
za*K?330Hdv)q0QhK;chy11|C7MTu#?E;+gJ6kV>Q%sV}DL@GP4|0#OU^F^_F!z<k9
z?80HpOGt?vA_!4p)P)<&b#_4G7dCnWNEt6SoaLyW!EjSMGuK@uodQ)hpx5;^cwNmh
zvlDNmn$-c4S!<7Vf}VB6Yad<zRHzzM6<f3=2+uBdE19Kp)1)&97Ya3oHYDqBW>E!n
zv6Gn`ccoEz64>6~5j-t)Faza~(|s%!DKAqYa$b&fw|2eS&e8Xy1z(BCsuA-X64){s
z&<~-NAH!hXa&18RAxlO%dFpcj)(kyY!19*zf%^7K;bZzzx1R{-wA$HbR;4(<`efZ<
z&C#h2C?ey{)wu;>%G_7zVAa1d)3=L#y%OVDFqCuHi(w-rBBjcM51g3KH)20eXSu5W
z!MntL#m_^vM6ch(ciMhhFO8j^ewwNB8ECu|H4XlVxPxB6BzbUCoH&|ltYBo)Pb@Qc
zYv4v<M8;OlPiCs2-DW&TU%`JxJLoxjs2<}M3lHvd%c@EFww*zgA$f}$Frq<!%5`?-
z+0=~1N{sd_Va5icGO{^sQ>%bipWQ@+bT4Ef+&cAkhY8)c)e`{{uoWq>&>GIC+HRfo
z9qTmVv{FQ0tcaSG<LCiA@k>Z`+e>h25T~$ILKTV^ctUj9<U>jx={}IQsbqNqq7YIB
za+YN<-lZBj80%}PNY%}1a=X1GVKZZQ-v#)PNT#nosY`}0u3;D+-15WkjUH5|ZH{d1
z-`csA{=3k<5!FMt`?|4bnG{*?Br+>4{yr@Wr^hdV^x&@!7r5hFaeN*F)3r8KF|_)<
zKLgc{@W@0FbUOd2mo4Hl@xm|I+#dDC$V~KGI1$2eKz|}i2d04Po9%lMmHx|<B81mR
zbnEGBN|xTf;`$+AkfAYFpV7gWGDssWJ-O`;Kd(dVee8JnDPVtfjHG8YHVK9btLikc
zWl{(2EMdvjV)~8?A)h2piQEGW_SySRAM(q6CV&tixtT}eX}L*Sn~i%!aieVz<k(}o
z*XyIiz@(|@kdw`q%q75%RSe=MI?X~<F)=BK%H){N9y(?ria%&~yDrB|R9=mJVg!Fc
zG4*6Ipl38KzQAfz-rTL2?d@j7+l<2R<7cYS)j_>9X2xa)M`hcu2a|>4Bd4er?84HA
za~LCuIg16}!qqNZ<mE@83<@lq*SU?^R#`gVx$Q9t`(?0{)wxY<S>twT{yfT?{mIPk
zbO<pr<)6P>+IUcMl3z%)Hbh19vz4l+5>x6sWAZv~2zgQ`LaPc&kEbSS=ge9&<5FrC
zdnvWuA0@@FN=0sL$EO-f2hNDguO0VemshHhf}CU8uf`3V=y}q>J5)j1I!OqYlgM>F
zkz<mPoq`eya{W^S=96+2y)pnAz#+<9hBs#1q0wp{|MobY^v#>}!4$$>Wh<4U-OCe7
zw$$Y_Q{ZUY=Opo(Ck4HA&ADCt>RAdk^mkYu4J2F+qvZle@sPk23m(~y*FS^yZQRR)
z!ZiP-Y2Kp~qT1*FtDw?o3i!Pw(ukJO?nZRVw_8c^-mP1KtVW((VIyA{Zz#!VE#}?~
zsOmu@K%T?>tjCL#3F>sYwx__%m)EW<)O<DFoaD*Op2M4Ek}1$B{vl^8i1B$xMm&*^
zf^SgK!40%jXJ4(LX9(YcjCfxX4K+E0K_X{>4NiCgCKl~lm?H3soWVVO6R8=k0THSb
zsG>d=XG&bxLpE1Ru8Ox<XG=v+Xq}Ema`Fn~#~d1mU=gElQ;YS_(+bfXMM=q@tS8TW
z=lay?0CyR<eCpOiBel7y6F^9GO7W#opT?`Xh3XEh=qRt;X~>gO9yva;xp(5dn>7ep
z!2sptN%O3c`_OmJW8(iM%|&!_$7iSPpKcU%#BLn^4~aY-U5YB`+U^+J!u<x_niRrE
z82H|%bRZ-;^u7b^<2LM!^3s(_nAVaN)~Yiv80SO!U;)unXLZ`}Muj}*50&!jxu4KJ
zd{IZ%Ky~x119K=;DK+p6FTOX7w$lpb*=V(t0YwH6YARPT3WPtYvbs%)f?yAdDtl;D
z&|7+Mh0JZd*xnD8d@dL4Pj1nPCcBD)UrHWS;PTn7*-d~^uxE9wVg1?XF(A)GXvA2*
z$Z0vIhZC7GMUsQ8xE0*jPMdETuuGLXRWo`jyNc>1TY0+w)4l4hFo0ti=~m{&D-dc_
z^YlO}PeIh}PSIbYE-d7+msK}+V78^PlWXwCE8C!EHD3=M$W`V8py%vLj2xfmzB18T
z=cfJUB78Y_GrkqaZPpYaGd=o-h<@J;lnu%1Rre_~qh;?!B<npARBHzR;0@Mjdrpso
zMoQ_`CUA$grG`^1s`h&6y?u^uk_M#3UM%HmC$RHROy>Y*-1ptD*tigNy^A@m^Ec&p
z1KoFvOhADTN)+m1?~xAXj21e}*hqjC_MOdS<;)Ax%pjOfL3+N;c*+&t*!A;J?z9ar
zMOq)b2&6yH7bbIJ5j!nIf~lg4Kue!;(Gs`=i!6iQrVjd%c4d^H$9^z6?y*()wF>p)
zKlpvehBi^%zFiCQUDHzlv1hRh_P&mvUG+-5y`Ua99J^rYXifFs64Gt;3*0yCOir^V
zU#k>7pAa8D%s%-X`->^<ra>%ZOu&}HvU!S<y63Z1Bb*ilpT~)_Sb36l=J-qLmXL7T
zhvI8TMV?uMWW!P%aoq;WtRYxk&GE_3yezKQXC4_S3&^H>wJmW$#bdR8<D(6r2U|jy
z+dsL{<X@Uy^&DL|pVMXTrv|jbV_RB8V&Y5W=hLpaWD4y!mQ>*8bQMsf+r^!K3WI1G
zTas@?8=RuKEz^Ak2c8s$G%s;tM*{l!+)Y(^M^HFPap{2%sS|Owbssq0tvod;uss0_
zt$O(8FU0enUzsvE@lB_<DM3;du&_H}CH^5{lXL9F@>2?5J9X#TE9Hs`U9cNx1{?&f
z_(5`lIZ~x_gkRFz?0>i0q$35Muo2y|-%lhYG8bB2qcb=99&6qU%y!`2VlTu|)6Ci{
z0ombCYdldZUZh6@<}d2}4*^F<6ksYbU?e(yR7Si1XsTGWm|<{LA$ny>ZgK(#osI!c
zCh7*Q9HnrSfW46$**URGsoZ-lITTy}0)RvvSeNBAAvTqh-?t?)6<g>SZez9G=~~N*
zCMLIHHa^J%i{2<>*GnZmJ9F(ENyeM=z&EfR%im1Rad-gIByV1j1f-=6#1&Uqijk&B
z%yE@YV>|QAAs4q&Bq`I@o?+wSh);_pA|C%=(nUa2{!6!R&Faefv|xQE^%B=iE5gOA
zh%^!=Ycc;jV0yOA32y(%<FBH5w<P?6xRt#E!<g^ox#^Ncp*$*JW9MAokOZ{lGflm>
zF*ZbrM_R<?y7?w;?35294V*=Q#hsZz5H-=~xt*0k=fzfqFnRU*4VH@5?IIi*IQAa!
z&`3Z;<WJC)ghW;hu>1Z#Fz&lqT%rkZs@oQPP@2x@9?3*}r&m7|tJAJZ1#2;eBvAtO
zA<s=9S>?SPH!EI}r2TEA=lVe}p*eX;q2L_EwE4uEzB1d+nVD=TSo6e8BulhRa@8n$
z)?*c(N&PyqQ7Z1B_!n>YYI5gnq7H5MR!MvCR)|WPN`Ln|IE^of$iIcx?8$^jZEQ}5
z<^!pJbvn|vBndj}+@USASrdve7X4(vXBgIdFN%B3XWj+iBLH>t_o?K5Zk`@8yu_on
zcth-cKaO8eN)7;2mla{5o_(gaJX%`p`>ZX1vphx;<$fZ?2oTx%_JpF!2kVuVji{DF
zHBN9#ri<N8d65XGNnKStd0k+>y6#agT9X$j^$J7CwZ}ScxG?vG-m?8%u+OOAh^?vJ
z=_&jPI4{Xr-bdGVk$h(OC<yZ{GS-DcSo>4fpA?OB@G<CmlAEd;Rx@P-(&NMcX-yy&
z{&OS5-v=-z_!l4dbJ%B(9>At^3VIWlaRV&sawosBSe%uo$46>Mc(?uty6_wMQXm7e
z{DhiqT4wOlG@8gSHvDF6*6>%mRz7aY=Is8kL;#O%SrUZ<gL{po6{=NlFBaxGvz*%Z
zfj=Pqm#;SqSH<`mM^J*Hx`CaZat0{}vP5OoIzIS@MF)<S?MVJ^sE{N{<$9%=LVn)0
zviC}E(ijw6Xn*=95ttQWE%7C0yw*m+mqtQ#nOjAxhq-kMj*Vn<b7Ku;%N$ou5IXbF
z4#s-476DXOdWu*E^0q8QOGQBPs)MOrx&Zitc1v|~lsvG4Ca}m_!%oHIeG|sc;nM6*
zZIz~eM$gT)q0yH7URZBd?cW9WeQ+8llrN44GqjEntzZQSrbccEu4TByMt-|8vtz&H
zhT#lwj{W1WUTf+0S$@kJvcWQi9b>_J#CycXBHDjfBiHP<%O4S@Eba&N6kq;EFX%_Q
z{NlYN1b;8)dvaRBVKo*Tkb_r!7eV@TDqn&xAKZ*r3k0ZcxkC=3=35>fcML9zH$;{=
z@CGG{`OW=Hexy}_hfM-BfAY<s%h56?4O?3D%06}UUdU<9XsQCRqTNhW6QMEFXB7;%
zmx20DEI-omu$eJ4$t)?}Sf23IwD&4RLBI1OrEXD9lwyqvYR)e#g?C(D8a-HlUtcQd
z*@y(n2a(`rzPps$GO{6AdX{a4IK*e&-&jlAa6Xp=ZA~omF@Bb4_UEj;89j6X`xu`<
z^0noGNJ)z1vi$OaE}Y};UB5d$knaL~K|Y+<y*)C$$u)BgZQ4lPC|l(jMq<#uY10!$
zJlF4ynMSRMAr8=fb13&=s_I-5zxRd;dIl<m_QjePS_L%=ERy@K!;0un+LR*>;Dzzm
z;)d&5wz3yk2*)cyD10Al?>BIkAi{$#d$cYV6iO8mz~SpYscs$&f0p}@@?+ebP~Pk4
zGfenD?VbBKl<WWhM}yfVX73c0b1J)>lCzj0MQvr;?{+4_*dgZ}#vz9>Bh}P)n52>%
zh7MF>B1B>6faEYWIV2h9!C)9OhB@8ed$ix{v%YJ6|A6lgAHP_ZS=N2uuKT)P&*$^;
zx-R{`k`KNfsZ(_?6twjN<D`7XeueI{OQf*2FxGB+O$7RbM#$rL&I}X!ruH*MBm@5M
z-fbj&(qH6l{mvqk$seGumIm;3mKT69Si5Wcn(yueRxX&duMx32U=#t<`{_T-{CLn5
zkdo*7SAtX~X7NcuVY`9CDA$!6o4D`~0=TbtI4~}m6$K!-7C~E65IHes9L1?m4PlS|
zguNE(C%9Nuol)8$+7S|Y&Tom-SdS5A)NsO+uQ%0dD3}qNqGBYDlp@=MnWdb#G*d#O
zT#Ux=&_xFyI-<_<_aAv2ry1kV!H}g=^)oTb3aKQd0!ZtnsG34F1u>l?Un*0=0%J~O
zp7ZjU;4)~v@7mmWXyJg&Gn8PE-&7Re(|(!0X~a{4mYbeFPyD3%XA(9N11`zMAuk0v
zDgfQ{n5eY=?a)VXH2fR#A$13ovHuocrawWAUWW0qB$v<rs`VfIw`_rOz1fSu@aK(W
z`m|!r@*C6$t>4l#g~nE#>Q&WJUND$pWGX_E%hwhQp?}%=Euj<&R0?Lb7`;eaKbh&-
z%g|wkI<{Lofxba-D^tmgfoyKXL{!+xYYi0cPk{DDYSg7JU(?8kZ^jQiv61b{ONBSb
zr4Jrl6qLX_+pbjD`qk_?$*3N<X0&igEvVWBW9O0N;7I!Tr_6oHr6O)UgiGshGECCb
zN(yVX+&inoOr<2GYs3e7a(j#6(^P&5bumlst4u#NHfRaMW<-K42HW=M{hQ7|2HAp>
zQf8-slaA08fQk8O&s+HNE>cKEuIS&VafW}T0l#8u#%9C=h=F0Md)`E>XL^@NRlR6(
z7qe3GDATt8b$phP8at!=NtENn66)2}G9_vulUj$)I0H3(@+X0jff9I;g4MOzPfPYt
z*zM9Yu-8cu_P{E%F6WQz3OjI$EicZ4ZDuQusFzM3`ZauWB5g-q>VI0Bixd<Q<)Uj9
zO;JbtAeT>{D4}=-uBOQQKntTMxknWgtt0FicdniEuk3>M?~QW(B{UuoJgHLohj)}U
zk#)_EfItK`2DJT?*|gJU&>nuDU(vX~3_rJ_eHt^^KJYP5=-ekPZ+e9G5b=-gmC!xA
zL@eyvn!D?Ympy3yIq?&d%uG*w7Er*=M_K~~%2J!|R~h~$4rf9O=L)(jk<x-aO)L{}
zlIzWZ_c;v%{e75DQ@hih=8yD%A)Ms6xV@%TUH1Y3Th5R5!k_6|#g;(xS%bV>?ViU5
z(Gf)gGW`Yg2`bIVCcUPQ$|WgIFNTOIG0yj+CtuvK4byO8Rm{d^LU&r+@i!Q71W$g6
z8X2VHb;~b}(0E7j^i!~^pvN(?8doe+!Xi9U%a9lEDJ+(Z#4FFnFE4&Q>P?^+M2CJE
zgTJ<&oMyc$*42h<5K4^$)z+Nd-Y9z69piE-<%7-??_T5z;TaQ0f561eV!(Xi^td8*
zr7V0tNLO<1#m-+zJ1v7+KW*P)?3)96DPZ-{SiN8wqml9^Hq_m+qIeEDXZ8($4<0kT
zJsX@|fo$MJVjzb!GbepK`XFLp%%FDZ1Z&D%91hA8VFw+v@!3Ipf!O&~&43fNhk#ac
z)9mXX$GuMj=PT|5Rz||*$aDE0l&WUGw2=s!NkOv?P?~Aa6ALZ{!-i^v1`(SiVL$M5
zy3k8tA}SQLSX$+b)C~cT*ng&F;ZhPzH+S2A8Pv1dyyZX<H|tN$*H*USTcshuOve`w
zb7yaxC{XDl;HfG;1_Lii>aR2ZEO6R6Bj_uvTC9=F)KncAD3GnCX{7Q0u}v7*(9GM@
zefIGT8FUNYIadgXC5<3(fydFthzdgr^{ebiy}dW^7#G8>Y0FYljudkXEJUFE?m4QR
z=A4>+H+km7QfJRPYter@F)DLCcG_`YT98QB7FFI3!pjr|9}<KkiH~T)SH+=6>X)8F
zB37rUwA)0c1dfYiG5D??5U<7fdH5So$iY>*YF&;QbDJU0+2^BtQqqj__jZRol7qY0
zGV8a+a$8%78g1qrS(fs;!-7*NbB!;jejrtLI+3pQkJ_z^Y0sl0ra5;P_v@0iJ%-Ag
z7THcIg)-&ihlhQFNwF7UUd0^_bj^daIuG$d!+Ozci&BgDrgK21E?n_N%$C1l-yyc+
z5AcDWE|Qww0sY)Pwvy61wU_Vl_uu8>pWg=?shw8H$+dofM$Y?76+c}O-;T-wwN3@$
z{@hDkFXOR~)Pxi1urP4h#WXqY0sM|~&2LFnOijiFdHmKfNj(;0b(>>c==p;lBB7IK
zqb2>G8w-V)UgAaa-L#jEG{oy|IV9U;&(kzR?qO#Xq|Ksg@baq(>frO(<}5Tr<<Mo{
zw>h=Fr!SDsZ4QO~^=7CuDfMls<qZQX%cCEDsD({$G8h)T_<Pm<4h1pV+axKDFD9y^
zd2pppUhz|C#YwTFvbq{>Zl4S0&FnYka07lqmN#?gTQjR}Mxnh&4Ca=g>kz$e=Ytz4
z_ieff`ijQqv%~>|=YE|2=B)1r6r4W-?h|Bq6ZAWDnBioFPS})_w8oN7AqEAd4M-VK
z@xC-)b4FU;opKq*3lm1eIh3Xgx9}_0kq4NJxn&pDH!)+ELEM<6EmwOnow;1lWL*+f
zJ-tK0@5M=pOaa3F(`54HbeqAi)T-(Zv*<IX`HURg{4~ZU7UIFCW_}Z*lck$*+6<~5
z8n&(7oNpGsNl4pn8&%yAm7ST|M+k=7`Sm_cxp{%c4N+*!bcp}ns;PH5nfDMi7_1O4
z7?_X&0~c@zMc+>8k<)(HxQm&3r{p9!#=Pc&VD1rOv{xjzvT+A6&|=IPycj5Ar^6~C
zTL4WM^Vk%ItXyH;k7WJQzP{4N4O+UxU6`1kHsa5$BkbaFi625vX*aMCdB8~;EWX^!
zk$moP<)<~^dAPAt2|%>cn^%!AL{G9Miw!K+qbK9|qNUNqUsy!k)}1dVFooua1gmEU
z@jIZl{>>UFP+5N6>GkRh4f+*E;i1}&mTk7+o|!B|PAAG*4Q!%iLIY^qEFrX{?VCNV
zTM3)Rn+A)n64TElK}*88H|Z4|1SAZNq|s!)vKqmC6g!F&qu<=yJkX1Abbf)EY^f|K
zuZiQjCWS<%*ji<QDj*vFZpx=9PQ)_Fm2Rid-`9=ilPn}Fe9&-6w+i5j3+o*Wh8%DF
zwZhQMUW*TT9wj;8vNvL(t~N?CwO)Jo^WiJ77CX=o>t@)f+B)9TlMav<NYDydZf-PP
zV^$lbZ!AwF3O~9r$y36-8_2}|A*5M~$!n_h@ZcDT5i_ZhUSD<l$GY(5@u58cC%s&v
z7Jsr~%3_qlWC;5~rWMzgj-O8mf9N9|zc<g0OaqTtfSq93KOS}53E%3oc!!;4Y8wF!
z7)v$Cu`jCLS1upi=Gx?NSVeLR-}ax>9!F<lB}CBY%`@&Y(Zz^AS!R_|K<jTg@iR3!
zD2uMr1mU&x%Jc*IC|gjYp5)eS1CBgIlGm|e3I)dhXH7DeEPXZT1*UJl0~z~%>jter
zW>Uvm&N5PpdGi0m@5o2e^A|fuMD3s+$uY$?Avlu$euYSxba-VHDrLdr4~f(d1J{m3
z4yqg5H*%p*YdK;@6leJILV3T}OZt>;K=stqf?3R=^v4x=fhQrM!%Zk~zPp@L*-mVg
zRDn{d|Eq15`Q8!FVQ@NYHi~YeKNYU_x6D7xy<?L)b@1#~Oryz_&A(b%J_v0Lidoyz
z@3RYaKyd>uHAOLU0jBQm0fcO@D#FjZxv#AfN%+W#O9MP_k2rJ9)kXC*<<untG}9|@
zu<B^*l6J^kbIL5{zQrgg^g~P~ES>ED-PT1^y4EA=5aspZ`?O5Y57L`o0?&T{KMjpH
zLXqAY>`ed><c6t9J;y=4nw{U_3D#ho@DRD~8w~*e{>D<!Sy%eOhjTOuf^Wn5_-SK1
z{9I-D+qm+&(y_LrvSQspV)vJ|G{unXy(I~KT1z+b*Qiyq7Jb1D6+wZEGtkvGjD}@&
zs7!6|1?Jp4jC{kL<`EfrR+qI;peMpANzG@P_rYExl|Jy$F6@b(R(x|)l;FWt`D5>>
zR<@ewHITMOkk=OT^p5^oe$m{QNA%LAKXZTw1TCBnG5K-L!Y?$!Y)_NzoY5LsYm3+R
zNILT+nCe;2Pyd$NuNF4qN~cX^de-Q=V>`wYQtnH|NBv#am3SRPX^{|Rz|WijLV5;4
z(g$gW`sm=PH&@&={+iNpS~EAFN_Y3ozph|a`Ef0KndxJTzxS{c)mO)g4-&s=(kBTc
z!wD#IylWWhY`Da@7wknhij~Ek*J{oge~J^c=q8{01bQ}D%qk55THXq@1d8t8`jXHX
zhkGXOf#u`N7Xs^VB<PL|4S8Nj9$$t$ffY1=ZhM8}6|>OZie^^P;?#$__UMu?AA)!!
z0|9UJEk!cAk8)8rBY~@-Yj{eySP$`UsVT(^HbnIz8#-WZu!E2~#GF3VOS9bf3JNJH
zW%j-`xg2TY{r(@91GP8sq+=ja*LwYzrHIS}#5xF5*(yokjz8USUBSmQUA1y-OL|xz
zhIFh?`k`Zem=!JlFDt(qHH&4{5n|BhNYF7N{P&N6?ER4{z%?ZOI>?$ySeh-GZ{_O9
zAVESF$9WjPmpfq8nszpFW2=QQoOEo35tQ*;*8Ctom*m-fbi4wY1YMadbJq7sMI7uv
zYhuqe@hn$qvm*30H<~vOj&hG+;ne1l?LlRO6iHU(^AQ3rnmKZBircsl?(8s-H|ZoB
zRIL*BScmzD5D=lEW?QkQH^ixYCr6cBB(^;Gu=kYsJEn&^9=BnX6zK!a<M2=n)Q2oO
zGKu|B_@rSE(C&a%#R&$3rgsY4Tlf-74raV0Ken>P?md2tydFT6vg`lLrTks^^*@g$
zFoyE^aBrze%oIN)XE&kiEru+MnBp?IVwp-4*H*osp#5lBspPF@^ZfuV$bi~6g=t6F
zH1=~GIdJ+PHev%lSrVvfM^Mq~V{jklBOX13R%lvDAbz0r1q={NNY^qgZa;S22&cgf
zN5r~mID2p#7jB4Fy`hZ!ivk~?IvFilNfC6|s=RuqL3n;1zqkmtT|EMN!xlZ+LY!)J
z!?d@g$}eo+`MOF515^_@V*)e=Sg9#)XyT&u72OGlA|pNpKh0Sx#!t7S3(aD(;yl}R
zP+Fb|j%bT9d_NO2?%25nXhPg@0S8K~C#phc40<vF90_EpgE0V7;jY46!re=dp+nig
zZori2?`?%Vdq`>kRw5xEk^L2lzGH*OCDsL|($!TDK)hJ96e_cBe&Ubahlk$=_PqiN
zE1av^>N9Sm7a-`>Oe|x<tAkY;5Z|ptxDV`y&E9E<83d6qT}QNxo}*vfcc6V<HoQ6S
zovM}P*;MF)YV)@6i8~Dmwer8j&xa^edtW7aU<_{aMt@V#y6p=R)hDTg&thrWB&FIK
z6y}Y9BH9DQTrLYq%c$45#9Bkw&YJ9Xc=P_#aSh<KK{_cc<6)1<x>u98V%sm5cw&Xz
zl=Bt$t}&+%w@1jXW=@H6&yR{;lrOi(+y!Ya6j)9m=U@ckhD+Uyd}>2~FE%w^=TgOP
z;9mC-C}s`vwQ6HD>wBbNNu}``Z27u5Q@zZ}Y;`cMqO!Ey64)7X2JeW{SbRpzUt!(H
z^dLC{kgwQKnmRmjpK1{>e2#?yoranqaV4kHQ7d9|<EyLq`X%rY+^QWO+R`}ecPA#v
zTze6Wp5WUPA!hSm$>EELEIDWICSM1X*BmEe|5uRIq)2M67OsS`&X(bEGi0}&v5-I)
z$>@AHmG9|4j!!_e+AOh`4Wvyr<}HOXe(U&SDMe0Fg$Q<SiQi;U09fPWGR{b=M|0x~
z;m0NBAGDe5!DWlJw!upiqHnwtKS}QXYSg7BO`|nEzD{U0u+Nf;j~+2`4wl?FxeQ<Q
z0PJClqGDs}6wvXvDuRIbO9zIizA4^}a*w!^<$ryrz0zoSIv;f;V)GWusjeMnsV!EI
zOjLNyy_7ncBNg%m#3GH*5aQjY+S{NTD=vecbpP(OGpxBxGAg9;DB@seoX46AA5NJK
ztHIB;AyI!P6e93}>l7?wWqutNo)V2d0w-@#K$zrXzLfP@XEzwaP*!}42r{6*!WEl>
z>j0<<#yRf2SdIi)ek0WoIN&^S<3@Nj(1K0w$NnXLET$|}wx6+!pB`nbYQqo=yhdJC
zr(sb0hH07hvxh)BZvHY0pGjv#`Mmh9INV@);#b*JC#t-IO^fzDuHti<2WOPL*m5>S
z6`aADp#?Zj^A~WFK6De}#A5I(0VVk}T4@Kjx-=6f4pH;+>F)Oq%kmwHnTt^$EZT-{
zOBN|-X=?cfP`gPx<Ib0cuFp`G<*@#%EdM5;vi3T9g}hHkdv6S?k}M9eAs3)(_PBn-
zzXUFTGxNC~jTJfmjeMjybg3bxr<yDxUzc`Fname=uP^;WT6U=5PqxP;@r#q>sno*A
z>KJ^gF^S2tu_P9e(z(|v5If6zFxLKHZo>P+pNrBuMN}y|gVw-(?$@mPF0b<Et1btV
zxs!)EtzpG2mXK=MC-R?@Yv@Outdp_tDA-YjX(+8OUsiAjk&{Jfc)fzVKAoc6Hj7E-
zk)Gq`ebEsH?Uw-8zCD0oKpBX^z6%$riEFUC!2xQs96sOh1T1bTl!7^A9s{ggR;;s^
zDN=dUjnTa+3h(%w4MGyTC{nlm<w6=5VkY^7O@Q-rKFBgRFpx=TpZV}uv8m}j)pqFA
zw?e%s)h~BaGSic|Em>ufb8*#do98^_gpBy%xiDHkrK(+@2p;e|aB4WwA@;j{+xID-
z3-=%q*#tu?Zo)hH4X<q$#g+bn=1<zu9<0oj+oi^g<9~`<9<uK><Ls-s_0^^2PCF+@
z9H7q>#}0unF68wo@k91@u!BieQt)D!I{v*KfBGC2;Et1jk3J>>FLuFy9Y1!*13h3a
zyJxP@8ZQ{m1sjtdyR5<0u{-+UH$@NIQa}&_EYUUpCAQYlzHm-3c5k<Q1*J~_Pu#^v
z*@eAiW2U!Lu2r13?m=dit*KV6?vi+$OR$;;2Y(HJly#x;W-{(BCrC!j_wN6o!nH=_
zh6VBC9PTyC@SN%+FK_N@z6_=HR@Tkl!yQ{}k<lZxJhxqKe~N*YV^%X2<Ml`@U;B-4
zkshJTk0WYQHbb-$T_ik~A78>FA<THZ`a*o`r^lX-<J1q$tG~g=W?mi#>(4XHi&I*r
zj~&69B6$c6c4H+Pm_&j%D@9}3)fNK|?pk1G0_*|&&805IdS4N*QCqs0a>WPP44l!6
zgHt?M-;Fh>RTAT99ADCVM0FX(;dVVoP6SK-QBoy@i*-{CdVT{Txhxb_(B_1bEEdmO
z9;g#`jk-F^(~2A{isV0z(6*RCokM7(;p5?5?fn%vt)k>-VG(SMoj@hJ3<yR6wBPMR
z@>DbkZq}ju!C<7dq<aYYTHvfgD>O6{(P3Xd-;G*VTRihyp!B}+Kiul)WdrQqWh8dr
zShlE)Tribgdny|Y1uq~V6+8NGE$^0^E?^>t(UpFK3C|BxYp29zeZW-x+?Tb}A;Gq(
z^{(Qgt?uM)W&NI~-c*|dpH->|QM7tOFugL`l^N;QXLoowIb=t3itOc9xvxb#tWury
ze=jYRxdOkq;ep}|H=gjNm!27Whq&NkT9w&y?<sLJ1QQ>+4^<`+rT97?a*;HWgF_Y=
z!oZTgAtWx0#Sq3NRd>8c{>Jh-p$s$?f?X&L+Dh(tJCy~sifvCSRQb2|JI;Y}600L*
zZ-p_hV_V~8f2`dW6Q6MJ`2#bR5yO5!Zj@DjTFBGZ-+!_?^!j%RJ_U77o~Cm~3;QZc
z^N~mPFyYJKx?#1=jn!JSp_e!25f$dp1J=?3rr>YhTl?E}twDS0dueC7%Ez9g{PXbx
zk@LZMD%SpApGvY?G|lYQR*HjAo&YxYS(>q6)tiHfseHp|?h2z?=Ub1pHpY8EC*M^b
z&1l}I;H@Q#^9zb!<=m#!KAur<2isKxGd>L=ZHokym78Rtvr5s?+74E~8&FMK`HF7@
zN}4!V%fTo-7v@R8h6YJKeG;)M$BbD4aqDs#xSoqO{K-s8L5UNI4+28F8Jfyt_9sGf
z^*<s#evOqTSeTDU;rR%|d#COFDMf6dW%UI4NO4=s*&W%SzN~jVVH+2Um8joa&Z(oI
z@z@2MoUq(+wQ~GwM=&(L&|I}zFq9**%=+`1+qoLA9^^qn6$lH6{~>LHjgc&qwUdn3
zc7sAm-LF|DURLvo%#}8W5yxV<HZ()Q^UWD_Vn!pU*f3CZMYc#|QX|JUnj2C^-2*JD
zYgt@LFs5<gKRzWE%N6N5D-5&(+@W-LoC+ucP-JtlF*YDb;>bUEHy3}pvr1Be(-We|
zs?tT{zGYniSoB0yO1U(5_%<md`v=%l18y0}dXvi5tS)>U58OMSEo}f?9rhRYawHB)
zqq(DqmW~6|D=33>q7Zh_960r=kJBu3seM1mP{yOzM6%f1QaYZZq!dWuD=jiogAW+0
z$mZJbIHje1H6)@!KqwOKNN{xaO1-F{VOKQF{_>7!(f<ySya=9c`$k=NMP1Fzcp7^s
zqq-G&&~sQ<lp#t44*eQh#7+Qcyby)38OgX5bd`oIrt_b^;Y*j_Vc#tqGf@ovD9J%n
z=}pYmhjV(G0#?qL%!6GWrC4*e7B2Qhz%Noq6fJG;05SZT{DC|^C0?9y>3rK=?7;m|
zC!ui^Az^HwA7%?cHEQ?6<D0SMyOEG-nUxlngc3dt+d2z@Pur{Hn_3uMcGuedz?>l8
zgfR1arerY!ZT}8K<1>ZL_fE`$J3jcywY{3aScl%Ug3`c)9>B9jK*NG`$25ht=?}1N
zhXuZF_036;0cwHXPwAnNbCg3;xi*2ZD?N{&*wvFiJ_o8)sQ>|!!gwGs?{AsqKaQ=>
zDgpk(RHXvGaZh!8_i1c#21kow;ttG)g1yTvnnfr<Z+E*b4L_wOPSNZcqNbQd$Y&q9
zqi}%Me(d2<w<0(ukrUK-Q%-L$$i<!3Qdd6yMo@EAufoU>qG31h&=0GNs_sP|bgjNt
zvG-K(=Kv6_>6V*v_JaQmex;p#GXb(fU$9w}ucHYG<B)<bN=HquC^3OO0@hi2L#Cb9
z%V4wzXKuiP7a!7p>?hjK$4I*3Cw5FGSHD_nQz0bd!U<D_X#OG5K4Lm9u<v{`+(!GG
z^*~GWj!PcdX3)9RlJLc#`e)v(%u|z(_Mx=YU-XhzK#zX!X0v%4>t`q1QoJSuukJ6y
ze9sV#$1UKENN{mTHdsOBDuGcoqd>QIdF?OedY{w^xkd;iHNJQUI;Sh{<5{3>dIcQv
zQIbo;-QU-eZ!N!~=4S=ytrOz9YcL^1xI2-VL=6R{ploqUfXgs&8n8OM96t5b_hC)9
ze8JkMp{sjwO@Ir!_Qt|zfirk2mtfTbINVxUS2%<ZWJ<F7FFL{zBdto?v~S9PZx$Tb
zY^yBOu)!>*IE^mwseJe77Klgsz^!q<@S>}kVESlK{^oK$UNG<<vKuf08UOX>Rk(dz
z{_Jwz-o={Z`r4%Ym9NgNN4H8F<uDkyJ08c3pcehhP6l~Ri00Rha7cyV+PaS6N{7rW
z`+htySHA&l{VEVR&Kf6r<L|qjLZWNSB&|K|y#h3j9kaO!`0|#b%0vh{u3LWDlq7Mf
zMIVMK94>;N8TtEHKXCGKJ%{m`6xxqQevUi%r0k@y7V)*DYQK_xnRvef{K-o3XT7Nr
z7YR;tAgV!8Bkff+%}afWDiUQ_FKyAgxL%(BD=2^RXEhecU6?;4$G4U=e912aev#cR
z1!_PZ{aY5lCx{#oUc@VSITjCe3gc$suv*EfWxEKY?ijvFpT1Rd!d3QK&wY8%wpo3>
zp4!1HvF(J7BRZxd2Ty6K?A9tIn%f!)!M0wWH;|?dzp2oq_8Q(xWSrF{H*MTyHu(%G
zUdCwORBayJIF`p_Z(pK#iA^txKj29(mktbrmr4%FwALx)y{Z?3{5&J>r*-xn)jOdj
zRzD6VP4uL7!)%JMT+F^L?lfaw*;@$an5FeRCmzgS$_9yodyqd)cOk#Il=D;io2r%t
z@aTz^Xuv;XQ!mvlR9@-UFJG^|y*WpZvWJdbtl$(oDo=p@6z=gIU)=JzOdD{ot@h^`
zcTBEc?0lb*8||+Q1bHj#69&H4b^2Z~U{<wmeQh%~dkkF*vi}713|1qo%fDu$mqujF
zBmHw?ZH4ACZhdC$6xgp+ky&T+<xY9>O}UXX0#E02Sog5QXlG9_qH;sFZ&=)qt9V#m
z|J<UuOt&I4+P_T8Pv+7cME~bLPq#c;?{8@5*HyjnDoDd0WL98^QQ67q+3RJxUf*V6
z?hx<CJu%hhIlX(MW8U{>RfK{CFNE@iX)}2LQ?T;?Uf%ycz5f||it6Wo8*vaE2#bFr
zQkAO^G>a*lGa4SG>YtmLJ%3uQ<I8MX?bzZN{-39nx=!GfjZRls-UCWL!rARP&#9UU
zeHkV?i1%_&5?w!x>ag?wW67ely+6A{b<F>H^J6e4mYAsCGw$99Zf>mgXS-w^arj*1
z`FBZ?sK^Cv&_9^TsJ<l!wg>15;n<Y5v3#FoKR{;_-DVe}V&A#3JG_41ks%$6Z}^h>
z^PV1O-LP_=2`h{_YNuRZ2KMq=mN@746Rhj2b?m_{6vr4~a(DwVNY=A6#=)iR)!dN^
zqWz?!bIC<{*My1cry79-?kaofiAnD7^lP_PQN)N0l(aqfr<EqCn69@WId?M>f_DQE
zg}Z_KQ&+)Hexwdrt`n$~2t=Kew3F+CYv*!CJRT7~ZAy-k)ZHq{_j_=HWhe|^VL&T^
zzWPf8V;9|s^NJTat)i~q-m_ZgoKCXXmuXcu=v$DH;Qc;m8Rt6%%EZiGxmIEnCQ^Q?
zbOTRbU%2NK?SJS?6<K+tj?==&|Jt2dqBJj)HNAlM4MmWymtZemoWfgIDG>YJx_J;X
z>jAoZllNP%Zr=msPaT&!C&a^&NlB|fZc6NG*9lY=!}^?xTxBCD`_K5F(9Y$0#z2ph
zYCaiR>_xY!#1oQv;M5_YU&Dp{o~EHKN!)xL{jcTP)=0Ob#||C%t|b5qxcIT$!=AR`
z>BTtTC(kQ8LD4|8z6rYbFsY)bro0Xqd>!zmXU+7(N7Jiy>)h(g50|Wn>36Uj5$N@Q
zS}JH+H;vt|jOn6*;`+l!yQ_6|4D~r-I4&81_L#|}axUxrzc=0gzc*d_|Mw@D(FQ=P
Ypl$Vw{iu6A1pGRF)b&WkVV}$Y2X#Zw6#xJL

diff --git a/docs/img/database-access/guides/redis/redisinsight-startup.png b/docs/img/database-access/guides/redis/redisinsight-startup.png
deleted file mode 100644
index 3102842af9d8e7d9d9dfeae8f133d9914a08e8d6..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 453447
zcmdSBXIN8Pw>AudfPz#N5Fu0nK|oMyAQWjLM8SrXAVow#dI>EQ6_74ngy;rAM5+|2
z0Z|A=ij>ehgkBOtLP&YT-p_OPe$M-y>%4zIuPbD^)|zY0Ip!GmxW_#w#NIYDJahWO
zX*xQ(GsZ?Y%<1S(zM!LH=w)G|ox$ujL+R+~4P5l}ZX4_A3E%eic;e#bL`Nr;;$UaT
zZ7eH=eEitX4*5$)`m}d|c}z^axgD&d^@nhWFxwBd*sh-^6Y1%-v?bUSE}RQ#>}X~A
zLw+N&m%AKv$@@FG_13nAM`12u;oCV2&C_!?jjxz7{f33BUa5co=|x1u)sx8ka`Mu2
zl^Wr0DWdQ5!#CB0{ncMI)BiAwtVjwUdBLd0Fs>5r7O@n6<2`@8e7IY#xcHv0xbm<q
z=bV=pZto7ub;aw|o+5MBzjchC>7R=6@00%|+kLBF>W(MlEA!8h&bC!~iIFK0DO?N;
zQoSOdLClfuZ|-ce>B_>m7@~eYU}9Q1#Zp<2&Biuq#m^`HT;#{y^9l;PbqWe@8j$3N
zX)FPBiz*ol*Br!HaynxpB5*TQDtv^GZ%k52ft0&TrS9lcsZ<-bYgBfI_6Q)I`R?QQ
zCsR%j(hPgw>7nrxQ&YOjv||=J`e+wAM%ocQ?Q?<lq1pe<D>`P{H#hBb<Nb+$Up@Ka
zJ;T3`8G4Uz)UnVrHl}@BICwibJ@<L);mbFBl9To*l*`?Rz7I`rsXKVM%RP4Vuy>LR
zboV@NLI(^~ryaUG`92m7ba#91qaLU!`sW?$wBzH`@}k0j-s0=3Df-a#wy>Uux0A54
zoPwN!sMcv=VPT-R;}doB8wUSsPWzvx=u=-`Pjz|ufPetG03|sOZ)f?dYHDio3X1ZI
zidSfNT=9WE_kA3A<++d8Uk~~Bb8a~KIC#5w`nq^L7e0ROV|x!jUrkZb;}`wczrXtF
z6zKBzo1XjpYgn`a${$~mzbdC7|6k9hH3c4@Rln^L=;UU3!^NFu9@;y!)KnCKf8PIp
zUHSWs|7iK}@0M4uUHy-y|G4zuo8I$r^49Zkr@hlx>+h-g*L(kY@m~#r^2bB}hbjKD
z^PgvFhSoX_l>e_u(>h&7e{PSCPMgm7hR)qU`pss`WOu83_<BX`QvI3CU>8QYQeoRN
zmYB$~I+4haWA6>5!uH0`p1X5rUQa&_cf0%^_#PJ=XU<{3=fsDzyl>1Y@;WAj`~2&t
z@59H!MS0y)?!WD6p7Jrvb9+WwnL;$9ZR?MwG$yb1S*oEg`dss&pf(SX>8=4b=Ay|g
z;wNIY|9|<_nk`b{^CVBcWpQiu`yFdLqlW9qc1iH*uJVsW9-$Xy-i04U!-R*r=kwD=
z;1nL}MVK1Zo6KMO^-J8BoU-(#qa*9avdhjF7G5U1EPIm$AD`BqOFsf{gX*bEl+@#c
z?XR1xOVi+GW>=%Fme22sb&=KH_0&X#lVZEwWEK4E6wHVEi;O2wST7lyhz?NSHx&>+
z^6+w4DBG}0n5nAECWZ9WvGtqS__8mGE}JKvt-2*REQcA>uB*`(GB3|C2%EPueEVNr
z>%ytv;d{*~%|p$Kc*p<}YnX>H@Dc5YLn(dzfWt!>5Nz~%ijr;^MXvM3e0_1oWvvb&
zpoJ4jWKq61dngg4a4EMa5B)USIb{8tl#)T}33>+jgL7=m@eKKzgz!@#feXWO-oqLL
zDT`G?Ey`jV;v0hDrR<0MpzmA*Kg9RS^*({Zyh#Zww=^=nDa*w6K)Z|8!*I}6mRD&?
zbY7D+?DFeSk~g^v*QpeTeRT~rYYh`*_FK+s3afT_)#OmD2|yoefM81$4Jd{7<B`%t
zjW`}Y1@oqM^@F}JT)}}5`zW@Jc^@0Kbq0S+de5j`1B(@Vx-9hEDKEmV_A^aCOtK5M
zyS>rCDH+FXD%8So8;;BdQ-#wA8hNeX_fi%;t`+@wd6v8U9ju<RM6^QR*an@8o`Q9v
zegR?e2g5*Wf<p?rzu`$>-upCkIq^`uAHKNp=}5-m$KD%sKM=NZn96_ktqhcM;W51&
z?dMi8?>y-z`H$QJ>&(2dUO5@4(i&VPb@<nmz?RNKXgB-)!1dPD+4b53q*bC@isVnG
zf-9KPGaGXssa$=r)Tg})%HQ}PTVq~Lmd<KFyh-%BxBC!W?1@SKY_VK4iy2^LQE+S6
z)Yoi*vdXO~7c>vFr&oIEJ?)BW3^?usUt15(`C8wxQ6*9E!R$<21TNo3V*>Z0X&Jdf
zWM$E*r^b7FhEzKk#na44R_O;oDW33bUy6OH=a%P{;*uT-!kU5CVB_x@?dRO&XOag6
z6sS^jJxRIbXB1Fz*n-(o9*{>NN>j*NSG_}Zg&zH&hMf}>@;r}|mt(+HijyCxa#PjI
zoD*mPl3%GShlbeH{rFx}Ws0h&tPpzkm`{8ep^eE)b^^+*oaRHh7Y{@$Jb&~Cegxa5
z_GSX9@mjMAU~7vkKs_}QNq9TCt#3b4NNY>%;q!t^GkiJ}0sZ9!md~kv?oR4glP3I7
zRf>IIpRA{UA?dHo{;>ygKM1wSs>+#o>Ec=bfsK)JD=KG4JKT`p`+Z=3(_u|5lUw?|
z8FhC>K9<ee2KV>8)G@T~D-&28A)w;rBNusTMu0{EVb|q3c}$D2RKM#?O);V72lIHw
zPwREtWfG!pNOZ)dEy|-IWguG5XwmJF2f~oj(fvV+-Piz4Lo_-mNUOIWa(Ji&f;k@t
zR1q)C{+AQr)svsIF+X*>Yp((cWz$O^lqvI+4m4otk=0Tuib?BHy_7BR4+h@YrpHs9
z9*V^w(3!yJZ&luenZIg+GBFH3$PDVXp3C1tp4T;_u1h&&2bDRI#Nq_qlD%svHKuPV
zGG_K~2%Ya)xRd^Zr#~^Efqi(y>wp6PcQ3(xxBrHK74%L6do}!u5+!*rGwwXh8x-K-
z4CFCd>E(cKi<S3Q<6v)_8Vcs}O)Dc|+iRjHUo;noubbwR!;-N~!D18D&0M?9#w(`H
zDM*cny<&?spJBN3d*xp!gO#DfDfl|E>XKhpfK5@u*KDD`*%gzOm&KSrQeX2wto{~}
zM5xWGgKi9-d?2+4=)Bqq5#&{)u1_Ix&ei9Y6urs6aHwWgJbbWT0zV6c1-3lvw|1Wi
z8XW|}B6RaWSW+%}#~<*kAK+($JO;F=nmu4B#s0bC0|`v^U|bNUr-M42U;cFk<Tq;Q
zPq1WzC;MmYl|QfXG=t^g!z)zS6}lSVTRivR+wB%xUgrT4O<oHg%@B9@JT073<|D!C
zU16@BLCow<>!>wY3S|RiovA$Od_<3MuOlnxj!^eGg2Yb9>}}7&3g#pz!dKrKF8PoW
zIufvb*U+<1e>uMkXD#-*Ql<CCu=}JMpsT&-keOTTVi%eukidh^m3HV*GE77aexuKv
zqGoG~ar2nVNul6e=k4BXc<`TZ4~;i3L*zpj8eF@xx^Q)gDaXk7*j9l(i?^Q2#BwI~
zlr(SJ(GCl%LcP?HysH*s?&GhH^{0(Tk-<+YUWxY~^*2Lslno1N!B~L&A5BOSYo&;b
z!<+5ft6!AZlfOPUoCVG4g?FBWGDrotPY9UVHv4;KJpfqkUbGH*9O*YB>p7UG9CdHv
z4^5|u1L+br^%a+|j2>LnvC$`!9r{N}h<(V8(?b8#PydPpT=+Fta{qDCnSyQPrJ$2u
zGq~#JA=W3lvXI!Fr(xgj2d)%$gyeyaofMq}gzfUH_d|vjIiQqYY*Fw{+O3qz)k9Vn
zG{;zt^Em|@e`=f1i|xy3&<<RALb1t52Yp?*H^I$A)Tv9o8>#wuX-M)ppHoyVCi!03
zNP0QYX}!|H#xa`0cWbONPkn2>WCsvD+?FX@SG*;9y*$zB$k5V;JY>63Y|(Mo>dy7y
zkyn@l2yFe~Xqc-KIcYnS5aXQl+Gzp4Se_dY&)R9+hfvS7_IRh1kqfD(#IM{gL)23a
z(9s*lIqI3-RQ_MN{(|TA%(3=Q)KKs}tQ=v9sB}S|2GuiH{VzKAY9hUJ)H{rRp$Rgc
zXZAQ}&kxZ6aZglBjdJ<Y752W5$0?_JLvHcA*Bdxuy{Vq%hy#E6Z5`$7B~cA`ibMNR
zd1*^xVDja!pJ09?uH+ODFC!iLC0%!{Q4Zq;VUeD~-QoF;y%@FOnH#>+V$3dazAADj
z8gIK=Km%7T{r8f~J-Wwudh}@nhG{g!z?}90>kedE?yDk@!6YBjGO5Hh(=`s;SyO65
zP3xkC96W}{HLMH~pJz?uA?0Z4m5wji2iu5x>Ix-?=3g(IS@9hB5n5i<g1x?zhrp12
zHif^FJf1xKJqqcnG^IoR)GYZY5c`T$fR)6?s+-HNWME~h9D>tBLT}Hmr`EaI@^3#7
zfE7@BW7%_=s|3SEZ(kXkIotN}*OVvS)@<PZw}JVE4l(qLST_;(8WmkCai}(Iu03i$
zNq&DgcLk#9E3!0lC7#~HoXU$!O4<h<QY0yfRc~o|<uG#tY!jW!UpD`x&aV9}y*z66
z_0J}<{IN4)NhxTK4m#J9ndluL>?Gfr<wKc%2$a%|<=qHRL-%*>!GSRJVGg#vx*xEc
zt<e)kv75P~P6ZAHCW_#EM3wiGOr7TW`z?}!Vj7G$V8y@^09km=vO0=EOy#U6<CzNa
zh+13Aw!&MWO;#1-NJC96VT^UMR){&@Eb#%88fL5w<UfElcm_{neMWWwhpr=CgEL^E
zpQ0ck3+?K^TVReA;Lkv(qa=1-$D6sVW#l6EP@~W-OB$Jz(VA;LX%Gub1a(AUe;)FD
zQAEEBC_HAKG)UNPuBTSqj6Vp(lmW^l>#3tP*N^jgH`X~1WC@_*BOHXmJ_w`q_RsQy
zD6RF0*KNE*@g$S+qp1$mlV7lPVc#0fEi4{LU4LA(0|8WXJll}Yk7`jiIwWxb1ec6U
zlQ!4hXy=xp)=lXih0mS3Hm5z@BRN}}T}6K`;x70o@>lfpK*sQsd1nQ<amdF*^ajn|
zW9vsA4BdBZ)(2h4`5qeQ_mVh#g~|D#E@}Y<Po9)N0-qi)fArbCkh%ui>)(6etWS$G
z-sADmkYka?0uZ>~AKBk)6#D^-Xao?J(7}SHq5tSt{XB#ujM9CK^kOtti00tjy_Et7
zm35#wwy}TgsdPl6Jy5LpyM261mCmQj6A*Wvgczq;QFl?-DHW`Pwj}M^5#?1#Si1U8
zxVtCz?DY8uk)m_q1Kf1xh60mk)%>gkx84_-IYu|Eeu}=86F?_Ai>WjgTr&L)@-BtB
zzxgAo>_%|1hkG4#y<Yfm-PJXZ>O$^(LOhP9gp~}R^m-kwzZij{fPoK<slGO(jYT#U
zoy5hy{c-D1z8{j$Vf*D{8KC!%W9B%d)*gt&qMpKk(dG+*#TtfDXlZPdE#Get+x`Vx
zSE;x^Wnm2-DeA*ALyau4eIVcJShfNfVc2KIqEM6S@^uFwxQTan)ypX@<pc?MbLJHW
zsLQEFvc~KRZy;GOK#gpi2C=WkGtWO<u52HvOJG+7p4&K+usKj(yN{A@$3NMay{kd2
zzB2J%lUPSRK;5-;cbPo6g-z1R)S7Hko~PyMI}5Oo=L#zqWtIfxX~``@_h*FK67Yo~
z|Cb3h)XLAhKxs6M)OGUN-_kBjJO{0(@CJI5ixt>Vxz@1t23FZ)delzr`bk`Ccs6rA
zJ*eaK@)XQa_2k8RDxGe!!^@_{mq3Tp-qY7#(gOIHO)U{~j{1ps2!7XT6msAna}<&1
z+OVOvR!xAbuSx^Py=@honmtgkEsJt3=%ifIS)pQd67sy&uCO`wW#t;ccct1$yD2-3
z{yTflZ=v;X!j5jvB{B~Sr|$Y8dr;?{aAH=DDLxE_X8f4aer3Qt{Rc+{$VszqB1%QN
z0OsfR)ydp(7e#c#-ns6kgjp}7a>>znxwR@2zls_~`|%6YKE&Xo4%K6RO)J>EslSfP
zstG0M9A|35=D5;vb%owchJy^Sq99m&-`L?{ei_G?oWn!bvjz?{zg<Slg96@~5lK3N
zOC-xBQbdz;YD<fArtxA@DBIzEW*A}nh+}m3;_!qh2afDu^<B%!QP=`QL`gb@S|F}I
z6R5l@$<Xfq`Ya;cKvFt5E8H-*D&-0zhvlS6Ud{_(ajQAF1t-!k8C$%l`v6feya9o=
zUDmpis#}^zncpbEl{ZmR49j+ADYrXE*y(x-k|~pv_M*H7OUk7BR+ia1!rzKyb?9^i
zr(h{cW<I2(6)z2V>nj;FNCqsiC;akJ6K#G2!&wR8ri~rnqtTS1(b#;KGU_?KPJuC<
z3?I@x;Kbe=tUMa9NZ(B}5~M@7u~R{AZkeJ)Z0Z4aVLb$Sw*duE3KGlg6D0$pGO{pm
zbC|DQ&PBv)WXt`Ab#iXRVzxo<xvCA$I254ME)E35B?pkJLML>c0cf3J5yOe?gznk{
zH$c@JidCMUtEtOUp)uVin>5{ku?II$&WSd~vL#Bz&BLeoq}5N9YDwSFTuMNn9OCwW
zbTlLG=LW|VVo8fujT7HNBtHVL$z;TI?O$lbn<^@WhWr#cF0y?7s*n6Mm(ZV&f#{bO
zElK=2!Cy9R(O3-oaq6QXEtXUti<NZUtR_6L34KN?7lgedPhbJiQK^F~C^vT|S0iLw
zG*YbRrJS_ZH>3rJi@;0)!I|p<vZi76&S;`Ht^dQ9icdy1ISqwLUYWeqZGFXaRkv`7
zzT4D5fE=ZcSx**?j;|H7>K3w<>c@gLYxm1-x``?;otvfo2<_}Q_|=T5-K$AK?#YlJ
zAk2DJA@#>><xkb_y-ch;3h+etqcv<}X6Zu85qMgUUvT@wk`Gl-Fp^(vuFdv@LE+NR
z-fMqWf$p*MG}6{8jE5NLemvG9oY=k@EFFsV1KtS=_j4{`Nq&d@kay>Jv#Cf^4VdEn
zYMsxr(3q;lxGKdhA_L%ACjc7NI)Tb4_Am8t7h|w|U{Z4{k8;~tbIky0@cc(0UyT^S
z>-TSdy5|hvh9@mC?v^bstP0-A(u$l;OHC<+QBX*jQrqH`d#G!jdmV`rFmXM}+JqQg
z1jAGp;lP{?IFDfCW+K_WM?^VIOx_ezZc8k8NIZH&pkdIV%A;dBMv%#yTpApA^y&y=
z^#s8si5L1k1v7a1jT&clOl7=R{)|@)Df_SLeTbk(gI>~>+N4hn+ThSV+oI4rp9ejn
z3iEjt`2+{}LPUEk9iip>mWDiEa?}v4F8#EHC#NIp4m7DluZ)jCAxAeRYD*xA>%TZz
ze;2Y$`oHLd(#H$4^0}A{i^)Tvf#JrlLzj0MQiAT3x7d|{$Aie9c<=qxD)vurgHw!)
z4m*``C4^2%itzrG)aV_DgWC4m@i22oD{3f7YRI6>n79TCKXvm@!X{A4^%p*Zrv<#J
zr5oQ1uzLThI|mOz{j>Q#;)^uUSwfeSNZD|N5=DXNHqzlyW=?w9+^WjTr+qM6rC6|q
z=IBOVmV7nl;MS!=i3T3^R}&z2&wYR5%B$&C41OJIK6zpM1BliG5{APZuIRoL>D*{s
zS!C0l>@MQhm-gC^+Df<-lQ<w9V^*y))tBDg#^IO}ft+-q&+q+c;}ms|P>>vc`9ZxO
zXX{r)ZD&xZ`Ewl<B6_km{$hbCrq+a7z)4)fx!%mJ>W;~jcHcPaM2pjyUZIowWXmYX
zeH9NU(khDwG#*YXuya|zu$G;xr&M?+mQ%~>>M5gMqCzwc;{euiYa4Nnqaxhe0vWum
z@ax|Kn$xddZ0FO`UMz1TjWA3QqR^#($}~Qyi}OG@La?MZ#qZZuQ}qo}v|P{|@<?Hb
z`&XED9>PWsoeOe_K1ynH^qs7I<3Sc<ZmUZedk^da0Y7;dLj9hWROvs?1#PyfyW5x4
znB?_HY2tii5`(^W1)mb~yW+y5hB;B--fd01V{4g@$*`h+P~PwVWoSTM!tswkwx#Yi
z86(#LT2Auhc0*o4Iil;VaW31^$5D{_m>YR<$a@1ozDHg(yh%N0xNG#U`Bv$Tr71gs
zOGJ%FGW-Jd)VpjM(^Ohu?%(aE4bp7+FyDS2n#uL%SY1q{=~jlWCw;{5v#)iw5q=4F
zw-g?X8GbAL3BZuJ=GdhA0r}URY|tE|Yxg<<bw6==O-BgmXj6ui2DLsj5w<_E2M&%$
z++h~kAxqX!%Sw<>tw2Mh9u$JIuQP#93MJ>zPS^6x#2TX|m9Hsii-~Og=88$Qaz@YN
zp{pXSB8HkOy*b+T&0H9qgP=M$aOqJVgHdqz0>o-}pMyhVc!NQRS8@Gz5jzz3h`K8+
zR@96<{~M&pS<H|DR4=d|8#UX2<bKLq1!$2yw%Ve0lT3}R4#dckl=xF+f5{nYEtJM5
zRj(SJM_RzBI(@jamQsIZ;ZmOnc%KA11uOAy!cVI&mky&eBWmdEA)fv3H(OHB<;RYY
z!+&QD_yd+zhh2blt0rkuQ*<%8)KLfCsyvEW1GW3yJRzb5?ctYlb%z)U1UhQQeUGw+
zeR{w_EtNlkM2_1!SyAuUuxOIsGpzAw`Wm5h)gQ)HMx@kQMA8Xk&Un_^eOTvh9@jB9
zQp4;%{Tfbp7U(Ax%rJ-z6{};0uHyjX_R+OE$O$uFE9!*g)=|->=@3YIN%#i{x>4zY
zm>a(j8?v*xduDlV4WiXRhz8ppO<4Z`g_==2I|1KxXX1W<Iw5_Ch8b1)e{tr&3Y<R&
zM^j7VwOBDw5fIGFe6zt44#Q%d!zg_Oy$(P;br1SIi`6w6`uhM|hfX-aGP}lBsxBpf
z8YmCJxp15LlunR0;k~VS;$7;n&xaD&R^a)<7Mw?;QSp#mP};c6rJvL^Jp*cr;8&gL
zM=^b0;wpaXGmCd$yU&UAS*tr~>{*<@n9)_jJN`kFkQ`nUG+GmuJi;C#H~A6tdo&S>
z`y=QN7@>ROIkbS-mbjG;uHOMzO^B4kEH>Msf8=<V80I#_5m5%Nh62P(rqo!_;)(9P
z2VS1rsvh&|0p65^(F)5AINzJs`FtxxrSA&IdT}-{ttvmqjABQf`Bo-aPe~k2w5CM?
z^Wq605T^0UNYF6x0}cNjq-ZJ<UpG$Wl1Z{pCseGzKdz6K;SC&UBI$9WFUGd{<s%aJ
z@sQp19nhC6p_<Tw&7Cq3@znkKMxmMzx5KmY-m9X{pJ6=(tJ)JOhU)zYG{^oCIXwD|
zoH2iQwX3_Mq}j6pc88+bhZ>P=36k9G{fVu0g5k!R#UXylE)gP0vbd@Dqe<=q(N$y1
zD)gm-<o8OyK<dd_!zg*>FGE5YLT1vJgZXjg$qQc|H<P2IFOpyEyS_GEx1yG6lEo08
zV9OP!K2ncoKbN&nW9To%I)@hdh<w`849EaIPOFvrzU0ZMnN+|c&kQH>_BD4eAAW63
zMel@*^uzsR1Gldoml`y}Ld$+}ArwcaMK-!$lhjG<Sy#K@`|o94IG}#X638A~QBc*(
zWW(8S0>#S6;3ql;!3CkzVcNvna|rR`jjU2hhPW*10VxV#WL3baIEJD06g`)CCV+So
zar-xubV3wz=v!@KQ}`rTAZE+A;&gdB7mFiN`Q(T6ot{<0-3q;y<vL2GelF&~B+L~;
z?RNdT1q!;2pzbC|&k|9u+{J(9QN*l_;Ae@4qaeQlAk`gG?flomhF{*uxNk^by_teD
z%_AzhaYcz)G<tKPTm5(6IXq$twyyfP<=f8NW6i>YW*W_x*$Y!yY5nAY7w1%I;`b7z
z{lc5SgwT5#KPm|(c_72AZ*^~<V@SsDGYBXk$t5nB|B6I^9#hShc=?qLDKV4W4FIs4
z7+}We`ZOnK|C1ir`~h`0B?T-row2(}EV11H*qmxne$-fM>NMbjop`A3o*-Weyv;e)
z(lR&5k1g<>Nc_xDekSJogAC;$m$)kb_?b!G4N|G1`h@?$sV09b>bgwHtt|c-w?Iyn
zd(@X)phuyB$kkb`!9uNAu8@g*StoLAj@JHc9qNFY-`&;cO_L(Qgc^%*c)6Fn$Z^(S
z<30@#3~2HbF~LVr1m{eX4K@E%J~XYq6)hd++gvd~U#UM91~PqKUZnw{x)KHp7Gymp
zu#&+yjv0_C$>le+J8MW^9i~+H!37N<exE><!S;tJcwGMHUM@WN;I3o+BTGzoa*^#g
zlKm8wvkG~86cjX3U`9G~!lKA@U1Zr9Cl9Z}jpB}GCvNQga2(hdf8{1CE%<8led}q)
zIqmS5@$aR<r&GGynabTbLkLSQjan%pNt))4`=^pv`RU2sNDv=Nr31I{El&_NwD`N6
z*mgOH*m=os?DwT&e@PtZbF{k-$8YwA<SqCLyk$YJc^^*WegePR-@)>0l5sEmUiekm
zcp&SX9KFe>I3rtshPGcHt9jS(Uu6E+2J%M?!8BdcKy~R@26_hvDlOA!{p{hP0||RR
zn2C2ujYgvG0b7@^X~8PNI;p$VySr5BGDPf#rdOzH87ziXa647n{W=ZFS%s9>7#v|~
zK5~52>hh4Xec*?9ILOK>jI!VR0fe#)5#1ri&88a_$w+ggG1k@S=!tBm7U_lSL@(*r
zauWS3eoa~~ojjkH%AysNA!g;))0uI=w#v;Ib_QhuCk{_D3kA-tknyurg5=5RQ2aFH
zJSn!ire;J?aQtJes6+4lJktF9<GSW%8#g=V8O7lVs~hF%U@A>6Li~jfJu}BEkBH-H
z3nhv+a+<&vG+DaH!2e>ue-<<Us$oKHL9mcD69^IC&m6j*3MVZ@1A<n|z%b%a-C{ge
z!>d`M43SilAj8eJq_}Hxx+bK1m9tTt607Nujug0k_titE9MqGFxHId6ItIE1EkJYk
zx~7+y(!G~wgLIj!E8F!Meu+(t4jHY}clMckRAhz-TuZbcEXoU)BU&SMh$)7ayQM=Q
zm4$S#(4(QegX*1-Wf=%`cBa&-KWKl@u+ggSxnG^f?Dhd3Z!)Ls_=Y>;hA@{A<Nx$E
z$1Tz-U*hlY->`uy4+xm@G7Q*h#`_1%_@NNw%(~_+Ryb+6h$7WMl=LEpS^tnskme4!
zw!%05Msn3eGh|)FAvZ0-@6An&lmPWEuf}dn_V@M-8Y+=m^%8rUh;5G&;~&Zw-TUZ%
zV^UinkrC&c(ILW6BaIs#WRi0%#=F=$73;A>Sz4Sh!>m7WNR#0%Y6}w9slpig%fuG*
zI~uY3G8l9;-tWI>6~WD>rK<XH{gj=c<J<pb0UZsX&wI2|{xDEszav3FkmI!hWrnw9
z_a(R)ofljSI;c$IN)_)T41SyVCVJJlCq*#WbA%un;us(GwssG^9t-;}_Ua~Q7SJ&y
zwW*=wdWs8K0G6IaGJo;)UW~z9+N-r;GppJ=1=h(4Me!cyZrT_r*2pl%?+2e{V%F^q
zEur!(GaQDpgmZgAF_|FJPkDbxd>nmp+W*q)2ORYFQ7RrYn+FF64U$@WvHgL+Q{hwk
zx3i*6K|(0!MNzpf{ki*pu<<_>r%09G{lO79YGv5;CQf}L)}yx46oYJ6Y2hEw-g~f~
zd5Pgm&*fS{?aYque7E+s_l_-Fs_MwkNngBc6Yg@3oIATdcS=tBLCFzdA+)Vr4$K51
zc|tF%uBZM_p7Jj*ntLtQ%G1tx0Ukyr_Y*eJS^<VYwOe#q^6!*J$2$a<`IE$-xP&@J
zJF*RB6<#&z9yb1=kl^#?GPpTpx$*;S{Yon2^`+~9Tnwv&+7}+Tjxr4zZ6Mn-2V6rB
z07<p%ntv>C)&@EXSZ<xVU-4=O)tYqB<)g`oa%~|`wrrgOGWE%b{%<}l%*7eeDf$E{
zaIyv6h&VECJ8Juu2SEL?XSk5g4c(vMlXO~qHyo_*k1Wa?ljL=LH^e8S+*<;MN>q8t
zNJn!g<hNa8tnwMF`MNY26jd{7A(?ddk33g%fh|>xudQXo`&*ochkL%ef_tW&{UJ*!
zhJR%JZ!;U)s(RuFyT{g+Ce{TUe4#vHPGm@bG3kd`EaU=%gx0h8R6YqDnNWmV<)glk
zoW1stXR&;EgD3kV%TFg{;yBj@H--c|hyGSssJg6loFH~Ae4tKj)lM%v>^;9$6=SH#
zQdbE_5~&AH-gKT_>Y5{y5BvakB_;mbE|VPnaE~f2R&^PK^B`(J`ycMus?I6wZ^X6-
z?GK(Qt-!yIFlF~)jEU8}0J{bb`3)=<hmRE;JD6QkkK!J9@sm3#HHfgvsWj48O_0H`
zTDUrLNnB7YZoAgqXCK`$aoZx0(Oudhy05)GPto@x{~vYL2|<C8`nFo?)<~nJ=DB79
zrATvYFG=$t3uiGjU0S+bgP)piUiS*{?Vl~J2-!af!yiE!Mw-_KI~ykVOkea2Jg+9y
zKwynWGrZG@ooO4P<kh0O#yXg1UGPwFK;z`hf_{SS<offFq5E}sKYAqjo(nqls_5*j
zUqG|QL@mPl=)7N!_usp2JX^S85HHpV9ZMPKmuu9Q${~oE(4M*wlS6%C;|#7W4EIqc
zDs{N?HbrsGClC8>Tc%|}rU7<T2ip(|TK%wH(z0IC@Su79-ZX$b2=Ig99>A`nh6|3A
zAGk!eP6y0RllQ??U;KD~SZ(m4z^tl{{X4&r?W4e*um5zGRu=je$8E~d4nk5D!o#~~
zBpP_JR!uc%^?-A{<63?YUuqgSBo)Z3J|=p78>)d}6sa`Htr}hw(9+SDBTv4vI|E&^
z(pt{GD+X86zjXh?fV;qrc6V99ibSSV4}nYXnP4d{ZCq@GTCPwhWS!z2S*;3IOMI^?
z=WM5j_LD&i|Jp`KNH<R-uQlpkde|OrI&tHAQsdX7m;E6vN4@mZSzs`f^cWAf4ag5}
zBQIj)!$x&FaSZa)8<b8ezHD15X(0E|H_!v6Ng}S!DRnsE;XGneWjT8qaYtbit=ZGR
zyq0DEcEi?}hI7mEFeqMdc297+6GYkDKI0Lnx7M!`I;7$^OZqiC6*|WNSe>C9)bY;X
zLuc`R@*(rAjR;Z?VsmCMG2qq~UNB&4FmxIfYI9h)j1}Sx^A2I%XW#%1XkLU|AO*ni
z0TxHsN*81h7@0-@NynDsL2URg8bm$Z22kb!>cp0t;i_7|v!vR(IumWxmePhrW19)}
zq!#KC0uj91#@ratg3X;in!&d~7nC-38aB!jS*dXYqIkhCYqSn8g8XTeqv-tA9L2wV
zDVfDul`-%pfw;XLYTBM)b74b#%#f6FHZQ{3K5J<{Rnp&ul$tgt&j_(3q={hH+g(Fl
zEMTkSmmEtaL75$5?|puDGCob~D{j3CY<qvpd2T*>RT(H?bXsI+B_(sX#&%#X6|D;}
zH-J|!s&R3)Y|PPpxx@oz0-t88`_1^8if7?NP=??e2kc&Ixq*s-<_h0Ngm07LKz{j0
z9%0K~(?Xwm{|Hq4#uT+R<2B#z?B)jvA>YTppo&dofKLOMrPTgCmR1S<IS3U8G3j5>
z;JG=MqQn6%)`d`(A-3jWK=K+`{t$MU3FF7e1-+URkJw2H-E@#S`65(3%Okym2|Utq
zw9p`_xn_K_2SjQI0k7VG9XP{ABMv1&{IJm)VXj+R(tD1(<>ZNSKj3_oTu>XU?SR+x
zH!m@U?;9tsZ~eV1uC-n-9J_B5FiReO$_GBh!+4GJDJezKt4o<;Je4{pCLIA;Pm6Pl
zwfvkU2VE@aP#wHVVCMM!O1*S?6m&2w{Tdr4E5KR!*mg|WqunUs?vO&awf{{{<C8K~
z65!L2?DJClS6o?VX}eY;G=00otlDD2cfN%0CQbREDkY=z@O+w_I`e?ADVu2lKsK2e
z3xJMqIe?h}O6TL5^ZduiyQt~y8G=yQphE8R5C>nW6D`<P;XEOOgECOIWH#>K=F}GT
zwB#i07lEetp2<dLGrpvfXQ{a$FPZ6J(jowo$Jy++L7N9j;0FyLaFa!NHh8Cbxp=`@
z3!A+h&zLkP>75#b5(@c+3Nfwh*BH?v4kl$tKCLvoo&Mm~?%Nkf+l}Rnr>QF*l)|Hd
zXsx>;6l4;~2+AP<PHS1!mtSXTS%{;<#X(353)FHdvAi(=aWwt&`a#RqWJ?0R)(=1B
z13p#2eRugB+ZC=XQr`}#@B8=Be#&OQzegB0r-!FyXkuu+?yx^}+h^K?JnC^S18hwT
zrGELXcPJr+rC7I$q9n5X)vzuTTk||V$|Qn3x!q4C^_x^=`||{LDC3h*#-6jp{Tj$o
zjUX?0DQrA5)Uv*ON@kPOuEl@rQQPTF0RCHNdJBR|-r3P2v~gqv@4ZDe7255{h_z5Q
z5G_E7zSMRAWjDHq{Mfn)SL$&^$Cf+<*j51>Ic$Kb`{2e02;#_cp0FOLP)Hb71!j?c
zi{~Gl_uDm=G(P)KL4h{aNdFFgX@SK8L<gv=T_rE}9dx}yCz(&Evb$DD$jj8+?Y46^
z5YtU7*NQQi6ss)HDz<TLUpL`1;US~x9kqUu%t<}$AELkH#<{JDV+fV)qZ>JQ1yTgN
zy~O77J>DNFn0>wT&a6BUr6YSY4%xCUp+&DXyDnN4ET3-@H>g+@XL+mmZ!)gB!$KI|
zQOetk-?r=zx({tgM@eY|uWSyr!3jSkZ*pQfVWiHUlJhK=F|S{gQ`XD3!}bkfzV<56
z(i7!5!pL}lElhi0-wJ`ViX-7e`tiQAyJu!^+k&+<y^%Z>5_VlOtWSC9Z=66e7N5Gy
zeen{fiEt|2qD3Ai?Stlt%mG6!Ov)ce6R4JhF&SPKTM%(IUq6v_?0MX7c_VqEO>-Q8
zORY222LlHH;s?NGKAzP}!e+^h5|BylR-uI&&SR%ANzQy=;R&m_8aqIb$ZXzpTAuE!
zK6UY@kXAW<PTKB7n_bV*>r={cn)HyE*8MtK_T;_DFTi*R$2XzR9U*TvnPk~1;9rN6
zRKjR`!h?5T%7;8Aurhd}XC(ek8plDzHOGtBVX{_}ZBq~$$HZFd4j;b13|xd4AT69j
zl&TysX({<amU5dZy2CZJy(yd_8=vZ~4FCE#c*?Wvsn-cQCfkG;L)!07vxf-iJgavP
z(NSI>kO((X$ToW_R`qgVo;$>G;Ofto-21aZ-L+y>scUU*yhzhBLA2I46AR~|C~#3@
z++Y;GKXV$!G|f{s?vIDRbo<9fUTX<P${L(f%t&Bi;rS62xSobz#7wY6whVx%SWxDi
zP=v`$!a*LssfaP=)J<-rMBr25YN;O_CmJutKrg2k1*V9EvnD+d;C%REX1`D+{r#ql
z?cQt5@Z}vDN-F3u)jYcV7?$P1Qncuzh72C%&K~AshIck>@eK<(D9~=2Y=jAmjjgG6
za_RvW%kp&=?$G(>I?yfy=yqf(;;0d!QKtz!rxDB2Kp9IS)Am@tmGlysF}?+Gu8D44
z&kdLv=aOB<vDx8yKzlsxbR=;IF!#)10WNs<XvQH6k6V=iFGg}f&Kid23YXQ=3Y60s
z)!E8?fgW3&W6|G|fP1WEAiNLg!3k37#lu-b!t5%6k^m=l!DT~59`;*I*tG}Fo!ZrJ
z5ia*o>G>NTX_@mZBh##ePI74ih`Uj|52?SIBB^_7%&ScdX-ImbUXIN8_OY_(ey4C=
z@t%cm#ZZfRr2oSt(3XIL+Xk9hfSFx1+vG&JFjT;V!A(53E~?<#X-jo&e#^ic_oRJX
zc*CqZF8L(~4YQUB777JN+FM##dA*IUJ3k?BY8_W>?@09wb#I>=ZBZyIPjHd`yHf5`
zIl;&#lE-+-&O|#IrM{~k=}fCbB?gQ&BNowG_<BbZ?UXqu6Gjpda^8TG`we&(ix1nu
zpH9+Ve@?1;CoB$L)oqbMwO$6EXk@(d0V5%}clI-cV3NBu^d;>G{HyjLZKsH_f!75L
zNorLNTGeZsiJ+4rr(UY*3?O5cu9G7Jc`Lz=C6k3T7=T&ZqIBlov04-U0MS-zzCa<8
zkF_r%fW>59*dDKhYOm(XLKG|5B^Wj=c|CA5bZO)~<Hu#0p47e>0n%^YkpB#(kDQ+>
zZ!EmA{=p}*ki_IG&C@6@WUP?bqy5FJccV>A9-x8DHb?82046@%5>(`L5rDl!b=)0{
zs<tpu3bS_;8mAK!DbKGJ^S#aQ=cXFM0uA)fOY5OifI1qV9HFaHuKdufeD0#T-#*|=
z*FL@u-^dFw4ABa`=7=7gh1nMc?|p4Tef<a`y5xXtwkJC48p!Bd<sPp7=cz4k?q9+F
z?HryFT*7p>v@;~tpb7N!rZEBi7$RL{P}BWzyZ1Wa6PdJZgRof&yiN~(hY_zVSC%@r
z#~{@9@I?DqJB23E{O0yuF}@So#>jSRg<DoRys2B}B+Ctqt^J9-V?JqZORw`j10^@m
z>EhVRO};mw_ddPI9(tXz{9fP;Ht&J$phCH3m<!<B(31)FnXfS@yKu3<y(Ojc$vI*x
zvzCI1yS*U&v`W+bnPnG9-tMK=TRDNBvmq?iH#{@tdyc7O94t?9MS5QAOx~-tubtfs
znjO8m|J?MS$wD8MHz>gn&>=4^P%bWU-}q+p-p#<YSYvZ$eslr*AM92W5)!J#rVPo-
z`j*`^A(2U%_eQh&*t?r?j4!T!<`S^WzANBA)>o6z%H*`<&R4AN%anaz<#jvzo9O+I
zg65Mi<djoHUY3_5%?f9!ze`^-d`I@>(`u%G`EZ3Q>?-kS(d8|=H}x|PdFgMwZ5`1I
zFM1KmAy01@6EKW9`8XNOh5hIVOgGWqZEV?S><)emb(Y;PK@dwM++my#L*^owUkm1C
zN$eVhXB9m<)v^#3G=uHoMWjTtgvgnU4FSMQm>Wvv1;T+uX4o#XAVdqrP5(4TSaxS+
zd2KSaIvT%=F|)O8)JZ<D*$G1R9)v4_ha)?|<YDkRV5{?my|5YD@)~a0WeMNB6Dnbp
zBn#&4KOG4E+IbWSJ;w+>86`mPg2Wrv1x?A*o}!%<e1mRs4l1J}Q*JXOVwxN_YVqsq
zrlZY2ZI2d=SV`wn9wCT%88FlpTx^Xud1J`Vk16PoNVvnjdhb%z$C)bPZbIhwD5Hez
zN71H6ps~U7Abq>v9O;rHUG49^`KqVX3uaiZ2N_g#4c*2KE=LX+CRWRfC7p$8l$K#8
zKHd^^@?{kM_L(u@1bH-5XhUeiHAh27>LDPuC@Lk_5P@r%-u?g{|FZTQaJX+4y$NjC
zm^Pg5>qHytpC$1a3RW5aBNT9)!hxr`&R!$*@U$^qSmt6|39W82i<D1YjO$8<_E^oB
zw-l68Ur6nIlu+m{IYan<E%G~u=Kk&Z`5kwUV5`nXDAYSk{<WC)&G*Sg(KSx5n-0Tn
z3KnSQUAvTJ>X{KBh>vPR{$|d5)p1_OYzAFIDL8mPWR5t)Xaof--mv2nn8+CxvTfAX
z1alwxDvxQ0PEPSEEcvmANasL$4JoA_p{{MEQpzBr^4rgEmNf@~Yri%`TWEQwu{u**
z$^G^N!AP7($f7`x>!ojyV{#c?{z|)6zFer-Z^|O?23p#ifm&+4@*mXAk%iN7@q>j!
zvTu^&RYRIwqAOybGTasIoSdl6kTmSjA1GPuw8d0H(4JLa65ii4&hAllcQg^iv8FIN
zpW1lwN-9b3!bss*Yo*{*fm2DVMY)xUis9L{4Q+Ci<mE`l$flIQEm1wq8{N2V_~9D7
z1+51layAw3r{!*K^TIJdwojs5y1hj0NT84v?6foc)0vQ<?nRD9>VAX3H0w587TikU
zrNA2-`hoU!PbPu!I{+vFXEi;q^a5s`7rxhw;D*^B{`3mV_@}Ct^@<Ms1%sw;1&0)M
zeV5ekE|Fw;cMvOYmxF&6-O~3(@qh)${Y6<=&7=hqFtIhyy8V3mEj81zmgfr#w|sv7
zbI`IMU`$L~Gl7MK^;JNK&#}%2CLoW~Pe$;e31Z)bhvD~-n*`|ZY{nhYlSl{qcmN}#
zsl65-<dfp;-f>jFxv-gPcq=u4HTAogQ1LBC*8b?HrYWfd*zddz1-nQd;0=yOp&wRi
z7>t<JQjH;0^s$@J{6jtEPa~D7$lD%z#<aZ{!@P7+^}`>)H_r3RZC<cRax1QD?tWU1
zd&yR7M4c=TT{8(FD<(>T3py9NV(LQHp5Q$hL*Sfk^TD;XjpT|}i#960J;{%{fd;Gz
zsr^{8-yfT~k8gxQn}Z1*_h~YUO+de(;dIzOK@2{z7Dfh_2T&)i76!sn3*`;0_6`@y
z@E!QYQ0ct6Z;~h4176vVH6Fy4HDU#$rx#&LbONE0J@y6`m;W|J*|igl{$#~!{qVW9
zS<5!db(FDWO@KK$4Dw_==dAe7MxB!<<bKhJ2UaU|3PXgRIBYt~#-C5c5LxyEi8)2l
z|4kt^VA;J{L6A_7o}~J;N=O;W4ylT}VK7J^F8H<Zv2}uiY^7OLQ_7VWXBOYCKAfG<
z;nZS;Kz8@tKMPe^oSN51vag-Zy`LE*5W&{=P{Zyu&^x&SNqi^=^s};DI(1PGQ|aKD
z)ztc3&maeOpajAy1;C^zQ&;~%RsQs?Z=YFqPlkqNUj)CzRx6Y@8r}R4&7aTkJybVK
zeo6Sg@jwRQ($Y{XQxtUK0l#_7UFZ@U@w>&Ss+7}mtk>JRyt`Jzi{%h!wa+(gN*H$d
z_*FIU4=N~#&W{<i=Cchx6mS=tONrib>O8gko1US5oqOP(a+SntoFI$Uu+=MPx^KVo
z<=ubg%dRMy{zngt7|X;@0OvP(*=>#Ks)qiCwqzFBXl;Sp*G7%3Qy+@c+nPHRjFvbg
z^JxJW;7IOC@q06T&nh}%f|jbIFW#`sDJ{bl3=g$rJ2E^ut^ZL_{9}8vVCShbRVl-R
zbn32AbSG?Z()r~ufs0@4nbq9Q4ae^`uGT3|v|jQ<F{`JD|DERkhu^<bV2&VY#R)HF
z{16ebPrl0sySDt{fqhC^Y|4e98?&uf{nlj!zC8Ytrp{txq)AiU;b&pjnO=u}N-udQ
z4Z8Er@Y-oLc>yP}HDSlaUjmGUZk(BSgLi8pWD`8-b^8>92qOB?O}Gj6`zewylZV0{
zFD3n568;a%G=-wKXO*>Y4XR$+>vGvMWT?qfQjM2&oEqUPq^(s{cub`#D*n(I)B!Xu
zrEhdXQqa1zJce|zK&0f}Qug$AU$!?wci-vw#x6CaK-=`!UC@1aS3wau@o<(SUY53i
z!3Jds#aQo(V8-UE@_^(IX7Ci#|MZ^!kB-?rW{kJG5L~dSSM@_kT5mX2@+FwWqeyXS
z%?Juy=b~QokWH<+dMA+6$pJo`8XaweY{&qUZ|MdK4ceWGvb`2*Hlf|UR9u&uA{hBW
z(2;cEnZOy^>Sn}iw@UqFRHATFe31VP@zZ6$RpIDg1^=s!&g-}GiC6x#+%sGfUnp?D
zIP|Spu>&OSFr-NAFzu?V98sox2D-?I0dk1n`|duv5!12AxX7t)%VfVLn>hbLujS0l
zGlo3OZgRfQ?!+rss~p<ql~DPKh<8bj4$<o7*#8%ch%m;eU1%4784uzX``D7;V*cFN
zh7fA$kjvyhD3<Yhil&r@EEfL&#zr43mbYClIMdVlJIo>J6k~pR+lO5J(O2K2*w%kb
z$t}~f>Dq=~Fys&a6b%;A+|*uLc1h~{!_~$y4$wWub#@>5e+m2ljHW+DGzCBe@uT+-
zfXHG}hlFvg6-~!izIjO0o*@)PSh`p5fgS!J^EqcpT{WL68z3fwZ}tv7{IaE3c2lz{
z+i}h>gR{?zanPtd!vkHcm!arbM0clxjore~VdQ$a$!DOTHj{QrzFW~gxE@#R=F-kg
zQ*O3HcY+}?{}1sc7(tHWc6E2i=@5@~C%(T7wa@t>InPfsobzs`dN+6NTuQCi9n24v
z!6J4+`EE{Wt@^ZtO$F7di6~I|`BN;D+VKNY@;wFD7+VtFM9YO-kRIgknTU**4RITg
z>*j>6TWR@q8`dUcY9p!}@y3vG&AsB_dkd#YO=x01D;~4U`7m`fq4hrLQtU==@$4(&
zm2Ao9qj$!n$*f0CZ*s>L#syUU>qcLUjN{$v&!_$TS||4|XAijAJ!m)V?lB?(Q$-OM
zo7WoD&usKov6oJ}q8duwVW6NVzp~fAx%Dx`7oE1jyw1(tdLG=lc=KJw0Y}4R9bSF3
z6{~GEIk_C}Cp7WKU3Hcvjca2jv?V8q@<_$OWBi6gPhRlHCkJ=xem&|q_b^kF93opO
zGd;7lRk{k^+^K{K2?_bu9X#)tsRSIV!R!CnnUuWXTImYV=r!B^ZrnK*`&O;q82u*L
ztd{5#`%7KmCx7TipOMoltDLzfafR}F!@b%4XS64+Pz@S8O(pLn9bURVyWek%2s5-)
zsjNW28Yde=OC}Majg5k?XUH-etLrO8&*Y+J?~1vW+s%H8(8Y6ViDiU3o$&<W>*eR>
z&1Gpzs7`ddB568y7skIwN3(^P_Y`(pbXp+N>MPcm*`wMDc2h>4II`ZUWuIIz7V&%L
z($}wl;yYjA2Tpbo0Uf=`@GBuKYU=uybfQ*{#)Dr!C|}enVAraVe5n6^p63qU%WacI
z+?yx~zeXQXs#>iO(tYNkr`J2XOO~39>mB#Aos!`rUB%5s&Lgjcl+iU~kQd#3=FT0J
zmooL&vc6xfWbKj)-AG7Jy?8miOK+x2Yqi=l<39V=GlbDFI~#|tzf(y7;%4PrmospC
z$|sE&j%d`BC3w)M;nBs2_IA~~9)=b63dv(ib#(y?Ge5ZsZ6LfV*>7T7vxQr|1C}BK
zFI`bZoAKmWH0WI4wdgw+ao8u!(wklKyld}k9RzOPe&4$t3b@=BO*r`nTH-`&otUZ*
zCpbe;P>{V}rj+OEQ>e*uCg0cX$0p+sRG%9+t0<P4sh?T!M#&GTYVHKY?=4TQ)uk&@
z)IVq`?^Mic^qb-h6FyXgnIvT<C9Vh62BUEo-T~#R#EbfF2;Kigj#*aJGO6ghD3mOe
zQQy$jOyLVVuse}>-(722DDsT7vtS2X;E$H?^_r3G)xk02b78zQx(PDhe6U@fTu6z&
zRlDS*_>idj-HD<oX}u1^8rFV-6qFEl^M!nyBxSq<Qrdorl2YkD+~(@uDv%GQf2{sA
zO5sMkRBGopx*N5_cV^cI_yS9XaI3l#!sS;sU8BwlRP$&_14#lb9m+RuHd87R%zmF`
z?A|L8{`JH7k-&+Qz4U*)yYww6=hsBY6^Bo-Dm4!GM}_1fxt^sg-J#EN^o36C?|yHk
zk1^a*eSa&;oxf4ZooyvAS_5_c$gv?Fk=ES6lE#6F-pl0NOH;_t+-o0#M0@S}#@pEV
zR-t*%L}a_7^*3(S;v+?GqXvkmGk&I}hC^{`>Kl0#g3t9?U;X=U0Yq%&j`6a)a;iqQ
zk-leYpSk8*u9{%`08li)7Rlb_cA%zhH%izSN8~*@(EM3WZr=?G9sBM5JYH$Bh7i|U
z6GC@^Z)X0M`cq{XwAIhE6(Vvm&F2{+sn%I=?b@USOK2fHqB%NclsY&a<Dvg!_o>XN
zy;hX>D?q`?xDyMapPn}U5RX;5fM8_rF7RtBkBV*bGD<r&_g&9SaDPtk$MtA4(Q-{U
z;V4;R2gHinCWl+~DJ}uvl5=h{-Y(*L)%27OdT~(7SV-E@**IMS+-`hktoF=#1-GXH
zLN~HmsjK!;QW{mZDOVKJDp^H3Ps+Q{GZG`-STbjw>@C$Vm@PCm=-1PbtTD0WPma=i
zJYUIa34L1}w{N#s($y7t0f%C7{+%;)<GD0snKv!LfZ8=&xPH^IXVtSeS10LcBT4|A
zof$Q4KhX4aI=&K^|7`sE<JSyQ?u!g!u;167c2^aeQ_gZqImF<Um|g=Yb%E;}XG4nO
zXbFAn><L%vVbt`EgI5)6YVOl3;2|N+Vxz{e(dsWn?XTV~248i{&u(KEQi+DJbB{d%
z%udFEP>Bytb0zarjB%@;chZtV3)e<A9tSn>ndv`sndE7D_2DPbY@m7R%j>;8vkV^{
zA@)QDA9gjIgO`o#(J!AVa7+4E*P~khfB=X3ILW&vFB?LOfA-+k>~tOWJaxaQFh=%_
zbX+*EQg^?LazV1g)vqe@>gZBwTT2jfLh~WOB)QT?MhtYweok&dYt1BYUgueFiXznf
zEK<ghjYq4^W*zBc+@YJIv~n5@buW&~3o|N?9v%S!*IlBUM&)rYJ%O>e-+0>VUAMnX
z+YLJC=_U%!4nlT}4cvzaF7;ZJo05DOs?Uv^8=eN!c16X(<klbMN?kJ5og*+F9Nc=N
zrD=<>3GM%w?pL$+AQz6Yqp#9oTW^zwj20I;ZMpJlKdN9%#BTQ#2dt(E_T>pKvnM?o
zmdSW6Q6a?N@U8yqMfuJU{EFBoc8|_E+cO@PJ_=c({h3WF^V)#xcE9KyF&})5d!$?Z
z8NVsz>oEnqrv0H5QvFVpb+FZMJDPa%<^KT8Kr_Dwfo2h2kHNKCsrya*jNdT#k7{dm
zbPC4U>)3}&K!lVa>Tm}<g$AtAh5exU^ozeBIpCe0ag{F}8XhJFPRGh%fYz!saJrEC
zdN4joYZq$fB@`;-;u7}ja&{@s-D7ifkzR6#z031I8E{r4AUrztFXCf{Ot{|J;r-;a
zA)<dJ7#u<2!E4Oq&#<tus?ws~8dpBq%!g@XZE6h<n-TZ?U~u2L{{)Cf`%~SoTD=K*
zx=PH^_x~b79wPooEV7NA5{vA|KZ7;K(-wLXI@*&*H@I4xw1@a9ZQ_FJ02zIJ!7e&O
z7!Ya+N0SHzjOo+{YDmNA;+#fP$7>v@Q=bN6r?sU`d9*<rq?FshFg$d$i5@=SlW+TQ
zN0cQxj-8fgU8b`TU~<f=Z|b-yqln6&VxYh2g`l)?u=p&$s5hNB<!ou|5*V+wd9nEM
zyhgph<?gN3d>UH}fl0_OI_DPikWz~x;MyVnZg!Tj<Nb2xOtsxAO%)nd@F%A6ho)st
zj<}gSR|v3Xa>e8R+<y+-e9_z%Ph$+~&aAy<JrD0^wV#|>$J22lZ~_FDT&GXq>1wJ5
zzGbf@ZQk8@GT7OLPiA4^o1vS*#?P7`|4UzJ1A$<^xM_b7j2WIG5Q1V|K8-cmW>%-o
z&#4uS%&hE5^=H|>3U#ya^DsFLhe^8gbf(!#{)Q3oX7z7SEwlFVstAI@>mi<Otq&w%
zue>TE)*6Dr=k)=Ff{^QC142QFb@Gf!+_vJC5@nq~iof`X`&II^ZP4~!OX(ID@kax}
z#2WYFQq;I;u!<~$z}O|J!CvGI1{2pbZVI2WA4wxyh_VBZdh9^NU-d~nb|42IJZxI-
z+Z_w0q6neH)jHLPjU$C{sBv}Fvol3-@WTdCR8M(q!fQdYE&4b3OR6lXy2!O;J6m4n
z=O6&+PJ%h2rP{-gvgM{RiQ;aQps*DiNSU-yzYQC3wHA}Mb6Jen;#?yJ5iFCsV4s5p
zx^31)&-WLk(jT#2q;q*c7D4GmGOi&SsVhp9+Icd#k*;Tb9drwiHE(D@i__Bh&Gg}Z
zxCw>$2I8dii2zgZFkTT+g298Q+sgYQcjCQm<qLx*&hk^~%xFJh44sP0bdm^M90Zox
zYcEc(&UH(HoV}1>2y0TwuVHaw9X^%YS(ehen6k3d{_<*wNJ}92_FjEY@Pt3lM$6rR
zd^r=Wdbj3uw%X_8@A|3se*Jc@ip5#@IX-4#(br!@XO_LJTONV=n3owiFl<b2<cG5v
z>&EV`Uw1XCTP??$%DaenN?Zl+JRQvIYWOm_qxb^k^GLJSK+msd+U~(R3wotJ@r%Cl
zN{K;G*kJzPeej48S0rvp5SKEy!gyqR6ZlZaz%a(COt6YPvTe|ovhmM0D2zTnwMSlE
zmkLtkxFqE)D?^#KaJBLi1HuU73}I3owu<Dbr-90tPI6>jh!;IlI*u%j)>mYUKjh&<
z_@|6dE;|X|S4p(8+KlR?D}w-&niJy%B3tVOJJqK5v6^%EJk_?Pvqa#WBH#hWxob1a
zCRIMM!eI*<ZJedxk9M*TjF7Z!MKe7=2ykn8n!5yr`58B?1cl=uo|FhA0*S!YLZICN
zV==7%1A?vibLQCpHgO(5%}uiOhd^-s;wIkHdFvMM2)<o|22*bK5S0y_r%$u{Q@WSz
zQ$Qf^^C^J5X&12&5D4Yf4h9t0;S!syNl<w@ID*0DuM~J)L<y6Xs*Ceu+B(^fPn>3t
zqD`#hd?_eY{t_@!&i@TDO^H7mxHUCCiEw`^W0ntx)Oo{{rwpM(J$zE+;Zd(W`NUtz
zt3z5pe2)0R8V(HnYeRq34+(?Q2uBc#HkxwVDV$ShlpBDkN0-Y6N47M?#!`mV<x%Ul
zu{0XL>iYr~_{hn}9(jElAf^o2`C7`KYexWpd8gteV)1H!JH$;H{FY^s_=$Ms1>sEO
zSV#=ooXFsYl}j5-0BIbf4ZEFdzTC?)%fK<j+l9Hecsm*A8cl(P5OC2N6YgPd-Nc2h
zy;llmx>f{S&-^nZjgQ~Ex^?ysf<<>skh>V~qK%y{-awGMm0+IJv^<FsM~eD|9&s>_
zz{j<top@S|SAGNy*7MT*oQvo5E@rbX9RgGK$V=DHbJU^X89T6#hv3R*0DeI>Mr*z=
z{4#E{RL|n<)2#9A-?!sw;Ky#<tbYm8IHx5OTNCSkeMLqiyl8eFUQxeJ4Cc98wAm@Q
z90IH0-q)$;jph8N^l}I|zsHX3i<*cVwjF=<x4TPdOG}F?AD81eNtlJ#Pxu++;P7??
zg%9GFRQ#3UO07KZ=oC3+4ebx?fq#0ljy|me72Cm6*fc9HHacGuLHzO7fKMQd%O{5o
zjG;q!-5@bUnR;~FPk%PqfNdK`B~Lwir7@A>AAib4b{K5NhdTO0Umy6@Ph_jHl4*V*
zjB?+Ae2t-EqmYF#t{#o1EC`V;WkI4N%C|PnqbE@M)(^JG!>0|{6eLo0eQ$KIk`jSL
zAQ4Ce5`oh}z=H%S8x_B_@-SCh5M2JOHt9klz=!jlh~#^p`4(gTY>z)H=6)w70*OE(
za48We0gqS#BTC`J7#Fpl?8(F>wj!Xtvwf|s-?whv?DirU%qxLP<wfmWwmT6>1Wp}+
z@=K)%-X8lU*@`V;ec~5X*!5wQgMHo`9P85s3<j?V!+B8SXix0X_+$BK7iHp*#zT#H
z@}MkvWQcWg`OyGAfm}ZT$~T3N4{XAdPYNH>pY6dud2LcAublPRz(3_NA}HIEjkf_B
zvJpCiPhO)qHIF^&?GR;2zJB17he%r;Wc90_{_PO$SH`E4k&%~sd4O?Vh#OOW&9%V>
zm4FMY=OV-h__JP2!#{xp25LE2FVgN!$P928!vh@Ss^P5Tn1VG=hm?R9Gj0jO8s9cO
ziB_>U$<AfwO@y2KRhGW-o)?rSDvZlr#S*aiR|`JT+s*;TcpZ<+12|>}KQYHzUd4Ma
zHq!VYnvV#d`{BnDSq|Va$Gl&R58st}t<1kcH$u4nN#A&YxW4CYFqY6AjEi&M`D|b!
za3%=E3@IDfnK)0U1%Y}3<b2Bh#hO?C6nePcUCbL)pX9Ai1JjlL2(a9^^=SFBIL-v^
zj=#1Z4l$cQwATH3U<udr8<!Giia;5UQwAmHl%&%@0H6s?jfh(Um(LQryM(0HLGd{|
zJ}dkBiTWP%csh9S#g+z$*Wu~B*kF$#_Rx}_(^}rVd~4yP(_)}cjI!L~NV&lTb#X(U
zr+p#n;c@BKJSjE|&T7v%XjGL!W&9I;Wzj{>vJce;YuFa@#!JahB78b<ZC8=&2ZV8i
z!`2}AwiDD-hObc?ZO0>9>Ph7z&jo0t_`x@M8YdA^=MCK0RhB%mwu_Vt!hWl-A9-z?
zibDQ4TLid4o2Es5oU6gXF5X)JH;vQc_7_ETaf>OrDFlw+E5`Y;p_Qk`!3{XR3Y5dh
zrfyHqE+4fI;wdCHyQK4v009vW;KL{5qREVx@_w<woGM97Ljn#vI|NWXGSz!cFa71f
z@m~;}e+;sPiNL8LaC|#EHP`7#1nMvTS<m>hWeyWHSb1@84zK&+Y2fHg1cLdJxV^Fu
zAMzI-<zwZb@5c^KVscvP#l`rv5K2FZz<EJ{wS#r?+O^$SU$)CyQh)7#vKDg2^nn%D
zsPeD@UuZmd&+W;qpHJ;}<vac<?eyC`*a~QtvB-Y2sN-UnB*tmId_LyEC#H!E_0;+P
zVS>xpZl5gnDPrWTN2axp9eqW%*pw&Vc2U+pvbL3c3AC0>^8-h1W6fg(qY!x-g>mcA
z>+_IThk6KkJ4Eo8&cn08$gxw~5d+6|0y*-2b)&lQ3?gH{_|CXTAdxf~ffyn47V9zy
zPiYWM3J#oRaOxOHgMJ@tgDWF5ET~{O$XCwEelBM(wqRF^lesP0wQF={y>{2ow6&Tz
z>fNtWTqBNaZR`e(O&V+cdALbfTz?2C#>efLOuZYkp}yng*u375ughkZ@xc4Uwytsa
z>Jw%h&$x%913C!TkyF;Et(xC1Pl68+DXhBA@YF{MMigNxs(ybg4m2}K1TGl@r?c)|
zJkVGl>UwZm>vec6Fu6wzfBEIPZ&-UV&~!BgKmY8SmhbJwm&6^!H_As~g#b(Kb?wtC
zqp{wf&>T~43Qe|;9975f?+k^$fqpquPoUkmmgNhCz_cS|8Q<+7zd(JuI8Cj;Xu7sT
zC@Nm@aKeVO^!s!$>jQhi!2w@v8DA!MLEjy`3M2)`sjt^_kDP6J-o032Y9LBn(qJvI
z$A0{iGO<ZyxsZX#6Q5L<R2iD69p#ZFkBnWQYz!41b*&zLk)e*OuW!9JLZlL%YN-{l
zktpjF9z?2>)&@M}1p|A?lD2_g?F75XQ;!ej^@ly{;7RCv88F5#JUa`2XWHTzbxBto
zfl0xjW01rG+z!@b^=oAGKl~p*Ag<Bb2~3rV*v`htx5X2fuBuDeJ1UXQ_1>YfW`y0-
zyYnYTY_5Uh2u-+Su*!$ex#ljFfb&d@N_yHj;I!aBNKXaf31i??{9a@yfmz(Ect#_F
zzp;aqZ=tV2;iLTs>JGX_{I`swQXUnKqGBBNun`LmPZ4izkLu7RxLjT*G}wd6{&3pk
z@*>}=Z2QGQV0=<soOW-xrLG~IM%H}Fn%Z*C#br&3KT{^X*iQr3_Lo3#d@|&fJ-2V)
zj-bkZeKo{7*HhN<KB~tUeF4h|E-b84risA92r#-_PZm~6!KDyjz1)eXgSY!%u(_0#
zMmTPozr^DFS05ZWDC-vw5L_h+XeZLTmhdI!hrp8(Z#3pe+!HgV#yyEe%0t#Cf{~@H
zj`G1OQ`LBCziEEVXyc>kP}UYH_LR|ou*Q~wG23l0w-vObq&lJDlrcaavNJkWzU6BR
z9&+m9+aPgd3nA-eAXpu3s*eIPmaRv={(7eRLoO*1SQ!Bp`AO6d;7*b`DNi5M+Hg|)
z3+eY)T<~C)PKIS6lj{;HO<1BGc4f*f9d#;fE@Ae<$5Ds3v)o%sSA$AV2ZLhRYX`|P
z5Cm?^jF-M?4tnJtl;47%#8TgKmN$U_L*#&`gyVjdi{J@g`qBTB<G%Ay<UW_N7C*Kk
zKuj2Tc*mK4gRxYC%}BQ66a9e=`0fw58RoGOG_+Yt`6CfHuL$HwJ<B^&SD<JC>rPw*
zfXjK4^rEgJWf`R}@v$)a!7tYiZXc8&@WJ58I)2$!MqcUXl6PQ&&N8F8;MyoO*(Dn?
z5bqi26<4#FT9*%jX#=AiNG@M@Ppe13$~sE$wtkV^G@zGj5$o4ZyxxZOnDZU4m*cM)
zZr>(!mN%`SIbkgxo`si#``B(bhHx!#V-4^caHYmPPy8aoMJ$pFB0fo8li1iB@Y=y*
zy>U$gxs<6x7GL_LY##f{xBj(7eJhXb81)0fDBw&%8v&oo#zuD7LHH0O6kRTzB2REu
zyYRj21Z4?1<f-GLebl$UwIwLX(N5ZoF8m<?F^7^8ft3-M6^LDR(OI-H+Mm^iMQu%$
zi^a6i5)*}XRjv3rP@igl(-ox&i#4Klu`URUV7iD*#g4`5;x9DzVA$^^#>A#?^IGjQ
z=7)V752~%|hY>i$Z3QE7)Ej8Ib**3|RZbCsI&L_e^FB)MKOY2+;+?_prY{F|ttvlj
zw#Yj7>YDEw)pRGuYzfp1Sjvxl)%FyA{J0G3QPca(UN{6|a67&)T-&c!gSk!h7hAE$
z44w+Us5j4kbmcEG20@hl+k>Zq>mKXc>3+S+Fs+!aqFKjQJ$A3I-yfmtv(&eo<;#S?
zv~jY5KeW6|u+8lYYYM;QxpwVZ2?}%mI@vGN>Yd`ti+$SI*F@Byu%8#^Hto_26r_w}
z40>zqWUZaAw}kj3IX<Wvm8VRe)VL&aT*M>^{I(zL7%tpEWFc+BBj%}Hb+oM<I@BTW
zc7_bR)+X}W(^jxbJE?<*zBY<*l!v4M41`c3)fmob1Rd8PDSUVk^~ej3oum#~2zl%x
zLxYvEGt}unvISISDMRQOY{mw8{MzQop3N&GUUtV(_ZPQ>gJvXMN(5YlhQX!H^|CB*
zF{Dnm$*ie;(O)JfWP6;<Wk%PkbNSO-w${d#`?8?L07~o@)F@(QHEEZW740nJbKSDT
zF|uyM%i0^v*WsbTK{06_Teqx_CFLi%Ued%u;_VPxNFjx$BEWb)JmiZ#;@A;Sa+G(y
z9mNqQD$2_v%1vDzamPeiZKF`vfLL*3Oq#DxqlEil&>nu#!MLt}PB>Vn;SK6Yq{55B
z>Mhh#rinlzaG?;0NnhtZLE!oXT3JLcN+)Q%3s_{!n#j6Xo(PVr_)Cqw__8?Ov&lPx
zUH=RMFWt=(oC7wpzHY?m(x{}uWkR4orkeS6nYu||PS&*v+QHh1U@-3vUU`k_fsCEH
zHgl}24;ql}$9h)Q>c}UJBd|$C2A>yoVce5Aq;X4vvTgj4xFk;uQ*Rye$Z$c(+$y=_
z0a|3Vk6&c51HmWWX&~4g(K0glZT0m@9n`mZEFg>!N(OXMXaS(k&cml{BjuCAr-5AL
zmBlWBTN_VVS^dxfWUzxAq#Zizm&s{^vOchZE=0Zhg|X=$1cLwT#~*a0(62l~_agnG
z(3E2SxFiVFcdOOGH+tf5{hb>uL}8c%?|SV!>82T;=+2EOQuR&OwHdCrm(^OuZeov4
z>~7(HhkHJ(EKSk)_TCo@-iM`)%~r5=!#=Ic4|eE8+Yy?wF8edOWnY|2q$MA18P4Ng
zJJ3;YhUv9b)h{DEoqeKwXkJUJud<OC8_|7+4DY1e*|`?iPWkgbP&qoNLD~LLUj?!1
zX`mVY%GfPMXR6bxj#oZJZ112|T3B9f5n9KB#HTUuR_Sl*oL2-`yU%OevRw-yFt~-~
zN!oZC7%Hz-SV;MN2-P(;p8loz<w!x`geU2?V~yMIZr!?7)@1kkVXH%t6?2s#T+RYR
zL(6B@y5|n=;qt9WjYMEF0+Z&%=yWkz=OS~<+R!`i_xm%u|Ad@c+K#7#?<n6XvDymL
z+N$|$*I3i|D~E_N@X8y$05cvyD1Q}(h=<EL{Wxy<a&ov|qc3${PamBZ*dBZqG&V{V
zgP;xQ;*<|@#3@@<_{KSjPZHyVFe~2yWdN6Y<;YXdWz19_{tY@~5C7Vv4F#3~FOt&U
zNq(uD7!cNo4b(x~5Id_ZsU0!ZDSoIINbOQq#sDy~^07mnfG=`%T*96<sUweF+KL`J
zkiKeZ13&vg;MT?KA79;*{x6^1>fUy<?LsS=`9$F2Bfvy7*vUqgln9(P0tR%CeK<Vp
zhHcn?&b|!;+?eNGl-uPU(DjHjd{Q`MTn`)ZjbzJ*g!q6kyzeC+<-s~kKw@{7Cjp~P
zu~3(wa<mye+COS1tN3*Cur*yGYZ8G(;Or6T&D6odz%M@uobr*0U*`|ki?eU=axI94
z$FIHW>w2P3JPCaB=8Z_}m$uJd#g=omy7Yxbcl9o(W+Jdw1kT4yp4TN_6;a;xJ5O*<
zy{k57NY`mpIIkT<Fqm~N>C6$R8)%JB8mDCAfe89h51%}n02e&UT+~6_ZuOBduN)~s
z!<HY#p-prgGRlw|vvu;=26VNpt}@h(1z9OmsRPO=VL&AuDHGXJ=M%X!oH}G68vzd+
z07Bk|M7Hoq=>&ECh^Zi|W4-p!)4zU^(KqQvXjUM&b@-mg4!eK8x!*m9-W}^+E1CI=
zia>e7Fb<{lLw32*o9Rky3guhp!+PB;=D6Y0f6z%<G*Ne8cb0d*0kvW?OY-W~ts_{@
zEil+A*6T)cc<+bzJ3c@TnG?JX<)V(L(+nD`ZS@8^Qy1<zc84yp8L|d~4<q=+L?}=C
zM4jnSJ~9i<sa9c)c|M%4lj_)*isCw5T`gP8yIzk8!<K+-{3%~~g+mB9miCYK%NT4z
zwLR_i6puZD7Q=}##gobsPnVR|5Bk6uDSzhJ^oV&<zJMtL#bxdc=3B8cm`{9pUeaYj
zV8VdDEM2>@{ix?ew!rvb_B#H0p}$6KdQDmv{B<vj50UYgRjfS(UU+Xi>(kz?y?7${
z=I~ssPx`$w1#te=&{8%4d;_#0vm0n>n!HR1OdEIgEO0tKEuX1R$JI(+Xdj>FuHSLJ
ztW7H!87O(i3PWMDuGidy{r&hd%=jxbz6_I~@G+WpqYxaN-;U`dV`&5iP;#4yKSHD~
z`otZH)*Fn4??G8Pbd`^6sYjk*vNp>wpfbq#r#x*VYdhfS3m#>t^`n2&DpBogr|=B0
zDqyMu9n-K@5vP<PQtBD0Hio=lz%#E6>~jGi0bT0t05asYMcH<ew~P#Wl#!*a%3-%W
zCA`l0uxJoCe0OhpI3{m=3;9#G_T%chM~6+LHYpKE1QLNnVBHA#;gL-tDG@kL1o&`3
zK(&6wT!dTVgTl_yc75mDX*Oi0FMdffIK1)dnh0VuXABmVHkVgl)T31WK!yUZoZyLK
z^f_uJT?zy|bzh3kWG5;D1T^DARLpCBF;(aH#lO+luSd`&`oy13-+1gs1WEQvAo$|<
zEXQpkkO*8v1UL)r?8K`gI76MV14ZBOqA0(>;~}%bUvZVQ*J1IIpKVSE^or_niy`1Q
z-U!Ds?*XRF)jr0}L7I4|x6Q*das+}&jei<%g@+IH;89O%y>ZXBY%m%><h9wxQG;D<
zkm93_)51FzrNkJ55Y8aW<Z%K~XM?Gy+|~gCeC%=I*uXD($Z9{bMFt&YsaKa&yXMuc
zpIAoiQw|&W!p`B~CPsF3S|$*zmnR>_7Yowjq^pAfn?iffV<hr{dJ|Nhc#HvtJ2oRS
zoAGqA)|dXb4J-JR9}QNuTmlWq_HjH}6E3}W|7n);WMGT=+7O5X%G5`M>pdL0DidM6
z5oNTFO^~7VvCOz;Q{CF-iJ``x`AKuG1iS{{Jl<H_Xx69s7e6faFl<^!js0ubGqTfd
z%}~0URRPsH(BicV2S;(#i6Be~#Dvvtf~zr@hfn98A;M)VqNBaZRRhHJIJOndALL3)
z%k+vLsFn95ms46bP=duJP+Wt=wT$^%KZfbR#u;`$T_*w;7J)LO2ET~$mp68%op0<B
zH3%FZhhhSb=HMu&-nmXo+c{73R}Aq{E&$+l5Cnk_;+I(E7gI1}{W)53ZK-F16QB@&
z7bWfy=d`j0&rw>!>>Nv3od~QSfimi+4E;sM_cAT=>|D+k%P4L{mXlFE+h~4!>sq(V
zyMu>eD{EFy>tAzJfcfRu!NKive&iSO<K7qWF>Ntf_l;VhDVq|ZEAD}t@=@+a1>g81
z@kQdA5H*$=B%G2-BM4Yh0<@Sw*VJHez0tJ}d&pp~9>Z%niiN0y4E`d6KB;x&@edz4
z2z#w>>TEmpLo%o;!^U7hBh*<oPilkhtn%2v835Tx?UJHLJ-!Ltq6gU#^6)5QgT`Bq
z?2zEuF;d&3f9!8-e5kcxW|biDBBp=g2?yQV9^39dxJQ$dE)xRvj*jkY{nCq7N8lV}
zirM%vT<}MJ=V+d4^|9WUjY#eQvFJm|MM}-EOQ+h>3+$|a>xFkCUFtiV<)kOuE6&oK
zT~`e;P7IRLWdl?UpuVet#%#0euJzDWocCL_inDdtSjBJZEQUag!uVfa9}y$aFLvXA
z&wxCPzZg1mI<__p#?*j6s;;^6b1;tM#TaG2Ip>&Xd?D3#oU)F}Q7w8Gvh|(B^~o0P
z<;XqrJD&}>;0R2cOC@Mh<{|;q`kwHz;9SuD(jS7_{3$j|&)(i%d3WYv2?Y0oA|bmn
zh3W~k7k0~i+oB_jwDmL^v~bH)FcCOw1e_4AerMgDasNBlcFS5d&RxA!-yO{BBI-Gk
zzcS}F5&RNty$FEodM&Qr>yv6mKL%&ilUiCpAJ72LfGR0G5BJ0$3HHJxehCqaG&qZ#
zdE%euv15D`UCPE#_0irm{TY9yjK1+tb%Ryff=viH^4OwX+KFssl+54<l?Xzl3gZN_
zp1M}fjwnN8l+{M7BTxWGqqIfmC_~5yj87M1%TA+X9$9T5!|NhQOH3}(rRYE2d9(ZP
zo@^7BQk^UOs=E%mAA8(k2?!Gye%p=h?n@#xS33nR5&~sF4i13?t2RMHyMqHKhw06D
zn%?@_MW-Kf5g=Hg5hEE6`RMbrwbS~PUkz7X@_Yzt<uX6QWU>2j+K4SMG-fu5+s!?%
zV}>*+2E;OUhx4Y`nmm9e$;cZ9#qd3aMlzG_kExZNs{VQJXe%3&$igxR1mp{#zKq3%
zWm%hQP&f`T@vh6^J9pvpl;1J~bz!d?5*)U*&M*45)&7-0OvH*a>o8Zm;}b>%bc$+S
zsAGDv7V+8%(m_yXP{*CZ`tW`YZEmPfX*LnKhzP`dse4M9gz>&|KK{h4DgQkO4QJ7X
z>S0|wq7M-S<{#_ity}Tl%<_a>tQW2swa3f%ZNi$e7*bQDrm$%k?dN|>6o*S`uc9Z~
z)@D8txKIehG@D5EEHJU^OqkBm_KY&WA*0T*9`VHg^<7>U5wW6a9iMM>Ou|?Ez^t$6
ziob>^zX&5HxJD`q(x^Yx^28NtjZQC(DS#VnzQfd@Eg%v+G$;(;2p@V})WdI|5{7SZ
zH?l<rJudyBqYYDIpx!*>v9C{4<&i^&6o2H0WbjpnN~9`k5E+!)vhvE3s%zc`+X(nJ
z*e8UogO5ICQp@Ba%IJH+=h9|mhn=+!-ct0U?OWYDKi_qq-M-#EE54cg6?fB|_0o&3
zAI0O*2i=Re_qzZ2kvrFGJguD@1PlrpNZLfhitPyp-c9(LW^;T$<jD@E<Ro$`kLs%E
zKt8HliE4)@(W?A3t0QZf^Ija)N7T;^AnUq!Whh`Q22Ob`!(i+ezMWs7*Ne;>WQKFN
zxOAMBBjrpl>dh1yR${OI8=nC~fy^v{K)Z%4p|&PbgP(CHV?6StaQ!05IKIS@E}osO
zCzdsNI~_A4M8}r)DAXCjJgNO9gEYZme<SZ}ZHQqN4fH~h`NfB;h!ZCz0*SyB1j_7-
z$y3%7<`);`GSj9gT@W^X;TLD@djvuD<4>gb;|r9y*0n6u^{Ak@94f1*6rBl*6FM_N
zYPt5MbRuv85MZ2782)G0@>p_$;>Ym(vPe@<syayXg}m+S9Tu@LONL-DujOJrEN7y4
zGPnkXdw&%%%g8cy1%pQ6Jl&wCS?4S(N~COB#6t<x5}PCss-)DDhYul30JxQ*&LFS$
zf;Eg`s;f`^S@sU9OA3!v9y$;yzU0#mc$A0K4+v9%0K$;Q>;wkU(HLb&xmv1?Le9n!
ziMDg_eG-^@eYKs#u8oDSU()hragk!rc9Eyu+CW$TkzI{=5Acn6RrH%~SC_B750fXS
z_uuTgPu<$@?hgBR6>}L7o`fnN95;F3t-;3XnMHV$w2b|>T?@B~PuD@^XLJSJDraE}
zYZY7u&Oy^-BOFcO(wJcf>PToCSnc=jnesh0Kn$z;b*<4$nD;)2v0apJc~;ujoh7^O
zy7Ajp?;`DSj*u3a=n$jC8@<SUTUJIt^l`jh>*)3REv}<g7skdpgpaYwpZk@$7C$)f
z7m8EN#S9A19t~x74t_94x3=n&eMKw!&wS$_!QuMUbe*%jdzp#rQ`P8FZqquq>n~?&
zH9xV5Y*Hd{c@P*4>B0Ce^M?6U1HxtB3L)mwMWwP9(68tMGnu*1pGDuk9Zv;E-ayUD
zJse=RX?$w?R%qo4Dx2<0+D`;Fia>wNmyLX*9@lJ~2FDfsh!@&)ySv1N`kh+MCF>!<
zWzUGbDq<K6j)Tx>tuH5`)tsc(i4b6~3NnsKN*vSpC4<AkVEmDIC4?Mx$fC!)g$Ex7
z%Jvt<Qa>1ACEjUllRE4mPf8GyI?DPdkFJC-<g|ypdF>!$n<86jQiKyl1a&})5qJ=d
zqEk45$m>i!$~K<7erz~8kT&R;fnIoaMj6WJpl>}XWo<>akZr*x`4dz5g1E5q&d=|a
zr-n}w82-~oA_#mK!QerwZukhziCcLI4RH4ybsOql2`CL_`i5K-v*i%Kpo2EBwV+B7
zGe}l9j{xr!`ZcY6OZB&Y@()vSv)lV!iZZ58<)M0+?(|-r+Pb=hsy|*gt^JpQUvGc(
zH@e<GMih(|h9b0u?+k#knY6+A%J?#XG;GqKo^h|vu&$R`WPDDNnZ)avUa5%PYI|PG
zS2BO;mCh$>F>fN+xgP_!Jo#}co)n%pl*(dLgxrq?g)(=C%SeoOpBiSq@-E`xt2Iyv
z%!+KJ{1pK2U*-!f%YC-4tZMV;dhwq>5`hbV0HeA7H39npN4WB1tmT{9gT|a}q)_)b
z+FyS+#*=VI<%{C>BM|I<K3pTB4dho@+wrlAUIBf{zOQmWR%+Xl?Mm@P;5;GFAM@wz
z4;UAKiq)w8QhI0SdUq|Zbx~atYbc8~vA!y&J|WBs$TlF2ovUQ7BW<0u_Ub{b<y^^p
z+!lzR#2tw*Lfo`EFiNrfplm&P-h^P>6uxoHHvS0@g4f*bQpN{7QtYT7*)jjf;15F1
zvbHUgLi(?z_-UY42FB{BtiqI0wvig7j1w;FZM05ogfcb|d3e}H7O=D%*;2L*wntgy
zAls!+c-Yhz<zi!S6DhBS2o9elFibFb65SIme^lfq2_$bb2solPV|_)d(Wv%4jgzb}
z113=n__ATJxR<`2%MOmU+!mUSRn94t`OS}^G8;C_z=)`t2G>Yx!Q7&ThV5C<?uNxq
z+MKmwII*u4*zz%M;A{{Qs(((-xJED1;RmpCfa%?k&^>8iCpPaCnDpeLw*3^~xqvR}
zU@WgS;Ys1advA`vKEg44&hGvun-g7jeiJl5;tQmBG7yS+U7jKy1c`T|d~^+kkc))C
zQF*6mDOc>u&%uw%sixYWo9s^O=R)NHD}gz+TL#pQ&oS7`UKSr(cnt*Sm#DN}`B5X~
zC^4!zm$^Y-hCz=gAH{lj`}SV9XCRn~9T=?KqXB*=>;HW3^CeE!g49j~t_%V$V`tFe
z)m_)mm%H(0a%Hhv-B8nOenD3M`h(qpzm(vNLr~aXk~P9J*T}Urr*%f2MQ<a9`;Jaf
zcKv4`*(`BL#R;eoKP8|?*_dTy3sG)^x8x=2(7~2^)WgH3K1c~>Sf<_!erty^Z9*2J
zj4UZ+{FOXBZQ4%w#{$9#s)#WhpkNe}GBP?wh7OS0cy)A08GVD#$nq`??AoEo4t=4A
z4i|(BJP2OvAG?&HRt6npj~pimEK2{=WA}Bh+>Lid1if-M-tRDhRt*gEMDSe`f_=aG
zl>P3n_O?2{XzsnY?D_=9SBNzX{A{St*gwG$bVIF*0bK^|>@iTjoM=W12nufxeg(VI
zB$#1)-BkukR<T>58pn!Y!EsWC<tG-0LC{#)x{uVlzOLgCOc&j6%E;1X-{5JNqaF5P
z71u?VzAVxI<@}6ruYsWYr7~q#2}8v-1_8fW(EIb`yw2x^u_*lmi}NyY7H)Y8PDCK?
zB||pq2zK7y+bd5B6A)(2+u>*vOBG)l!rF3@IXcn(37E|^JAsv1s^e>EeQm@*KCmc3
zbdPk=7@i=8Xczcx$M-t`YzZdwg;Sx!g&rTM#@349LF|J$vkDZ=k2*#RWAit?@q1OX
zjKMk{c_Q9DY|<I1N*%|k&JE6q)Sc%M9eriaMH2~laPbPAy_>hXy;uvOVIP~Zw{(v}
zx8hh#F8-tOxv)~`@GmJ5NCZ|xV6Yvpro1LC&I;v>u#7!aLY}k8wQF(yD2rG5v5b{t
zvYco53$l8KiD212e=Wh8aPsHaY3IZ^0WIIBW38FOn6_4)gPU1D_to1`?(38;tcl%^
zKVp_az|A6Mb1-H}nTt3jJcGW*Q{gE?ifv^mL)s$W#yauG1y38cO&teNUk)D-ZPia<
z7^E$Q_<^EA?s_y{9&$Rx5b~r3g>gjQ4*T@4Wo5NZiVik?tXf<8L08}+TV$!T9v(W{
zLRL_BRvoXm<2OM6)!j$kmmlqR@3^tueZ^J{5aX<+HZXkBFQEJWyAM0Af85{d{=dhz
zx?g#Ot|TP_t0BN|7t7{RW}8!PHCq>1tF8fcZ6sfi*dCO5IxRXkZNF>#?T4F|m-%%d
zP(L(c$)FAaH1ZYmt2=hrfo|G3KL~Kp-`e7fL*f7v9|XuBMByO5Kq+Yo0<l0xsJB!e
zmiG<E!IQN?@xagE+HU0iU{!u;8oC6bjs=O;%`_1>B?SCsXMGniPlVO|?v&i0x*PWH
zYw^WP1iM+^9=q{a$EzVu;Y0hW_ca|R0*S!oM}S{y?d}q)S`V>Cj@}&{uNT|r>EQa^
z6S+>V2jewcG4^Pjk%KAm$My^3$P<G!fLB5cQ6@zeq8{SluML8X9BV0)B2RtGGwz8D
z_1eT97xn1C*FUn5JoU6&YvZSllYsyiMlo(41CX7-QCnw21gUK_dd?tpXsr5_$<q#O
z$S2h&wj??xK*&&s9J=^`XIrp+$f0Xl`tKiiv-^oBU<%spem1`O?Vt7^*S-6Z{q7mv
z^uTcY1$0lY%1i(Jm+0L?HxIf84tO&8zNPgqlY$@UGAMNXuKK>kvT4+a=W(InP+y)D
z9?SzL)kNV-%B*WZ1)#qk@L^?zCE}7IHM?7N9x|rtxSB0JzZTrf6^AU066Em^)SvT|
z`2>At_X_`Xd_y$)ld&`F;f8vaW?KXp-}~{WfICO=1tL4VH#dSN5ftYB^My)0Exf($
z*`w85J>OsRR=0Fknyd@szRQ!rLsnGwrcDjL1-|j#W<GHF4Hf9|i&6sft~b7_qO3i`
zHHKjQ&_QMrfw>5@!=>z3p+U;ruGC0GwhZY@ILHWimq2jzk-2vBv0L@2w|0L&j>v#B
zKk+P}WP_@#$?1YvW6%3{+|a__j;kgo5l95iJp#R>MznVjdyDmh_Xh9qbnq}db+YcT
zR(js!jKkBx*k;}ApLyna;?q%oiSw^X=IO3n-*?y=TDAkN?h5&`G7tCKo`GiX>D4S;
z9CVfVqXAYncH)hL0aD_R26btUd}5QvE!Ah3A%hJr-<klQ4*<wP)ag%O@E}rnT#$O$
zZT-X7pR&lKj~sP{`T^lq2|<X)U{FGatL583_{jDh(K&pf12{H<#@SeOw5fcsN@wqg
zlzL=aUHzKkpV^9Bzi+`>jGlgUE8Y{_b^qA?|Lna>&oo_k-__Ugex4_>-#D3pkQ`@%
zaYhVq7&%CmVqgF>81WGp=aX>w21tkr0|XL6iIH*;5)vW^2FM}=lnKT-uk-r3uOt88
zTJ^8qT~}9kRd-c)b@yKPUDrOXz1G@mpI7bP^=<XrPoJxQ?JqvAep7eY{pN2xtp2}`
zpH_cIhT*@gyM(uaKR~xFZCBi%YNPT$|MGqH)7$se54#X=DUI5!uvG)@oK;0z)l(y9
z)PM)zLs_uda{CQhEPg}`!%Y81EC>EWd0s|7YvnSetx_JS0WD53NV1H&=gZRS4}7&6
zBg%(12y6x_?9)JJ<|~32c0b}JlZ@+eZ4$K9x8gqrI-aL?tO)}#*G^~+Mqb}fyibCf
zUNvA1<YqiK<T1ZByGQ&*(=_^Zy6RsKdYQ$~sTtqCf7jIzx+gfU#8HW-oZY6RwY@Ut
z=dhh`jjbA}8d#zRc(E5Rx~3Y*Soeu$?s@W5Fl&)Fel4bT$YD^9TZhs(jPnw5m8CD`
znL-mymDtwE0^aP1!*BZ~?05*{V$XCsc1gmd**FUhG%yN-XMEyqBPHGsd3h`gu6fx;
zs;HJeG{AwL?XBhy%@(>wQxYv4elxY;5VcScF)`=CC6B@QxCYYA*R(8fDYWx|OS)yD
zK&07)27K*;hu<>Gdl>vxod*6{RrH_!@!jfQe*Rqj-mg8b{*pNVyT3rB$JKxR&)!x)
zy>B-RkLCFP{PSO}ej1zU%JFR+vU}ylJ*arO@1VJ>6ZA|XOfsQEZG_idHnP+|RRiNS
zpk`!~ZeN?*Ml@Pqvr&$8wbzX|*k#%_0;h_TpiC$wAbUH*lnE30^Awr62DgbQUoM%Y
zG>17f$WZ;RaT)hhCxy9}4r2-~Cy04D5`9AmIsXl86G9t^IY+UUL6e4qVg<1n#jEc&
z++iG+``NhpDF+O8pYbuTTwXT{RQ@<Y94CtNj%VlvSrjZ!vIyd;BT_FPqG*?2jLAyi
zYK?hLm7L*xsQ{C<Zz{pK;adkLlf{JKX*nEsa<?rnlB8k7#*LSkpTii8Q8-?(1V&0Y
zSS?Y;9_*gzmc!2U#47);^;yQw>(9}tY%}xntJJFoss;|!K&%&<)4>lu&v+m$Wn<mI
zdV#f`*Zo`*@%E~9pI%J!F}Z0#<8sefhzzWIW(5jaLN1ufnA7=p%qO{r9jprqW&5LT
zjdmfzLm2xbxIEY@jbqnoN@@+j&?Oywz<%35od-Pp0DgE92H$>Mz<Dy1IAwm)joTV#
zjcgafWCB1g{lu9FEtehwJ`eE#eypa1%Xk}ttt@Ce9e<hMLKBaIc<}Q8xLDLVJq(y9
z@%WGLxlk4S_PtJltE7MUCoii%*G~ri)~{zV{vh1PI5GUc>Vt5<1Kxq~$DjABzjBAz
z6|8|=Y&%rlZ5oKJfqKm@!<;)zY=GUvwh^mwRRaSx;JJRt9PfVIP9n;*t-YSCX<GP!
zWd*J6LnHExLA8#?<f*uqtO2zs{m+ks%A?iI1E*TmHlMgx_+4uO48u{xll6>CR%k2x
zhPFIFp~y(!j{^BW{rcO!m}27)8$hZ;8!BBn5t}w;W3FY~qR#v=I~(mq;!2>=&y|$s
zm|~!b9G6w|ES_i^dVtoYQDs!bcmL4rrUu&KxuMa5^q?16`jrFv;GS+i7Wek1Q^CCK
zYJ@yQTJkii9#_-@n7J(D7#)dyjB<`-U9(pWR1J*N059twxDQ?9U4lFCI67c6t}$Ld
za1ekspGL~~m6BedF@|Ck&iUnl!R(7TJv5ll4llwNE=!LHE%c}&)G$C7&3t4`T<o7z
zAg<%(4f`YU81!t^BOSvbxW*^0Ojj^~I7<r-v<R1nT#1JcG{GlqAZ&Z7ZLOr0amFq4
zZ8ZoRp>z=l!X{`zEGWbgm~;bSXn@0mpM3a@hf5eJ6+qbhDVz(9krzM~;>hECxX|-M
z*fivw27c6uU<||mufB5qZ|KDEFC_inl>0YD{vZ6=^9sZ8U+eh*-82$ZDpdp9HQ-Ik
zwp4c#%{DRFOx`iJF|Bboqk;a-8*i!op{M4Zw2d?;)(&mHU(U5K{e5GWDJ2+3-yI^{
zTFlGzwFA*^@du*qCUOy}Yz7ciOByvi+5vaUJ;)Hr(uU1J8dsWD+21%XqO@lbQaa7{
z)ZeN?t^Cp0^r_8KygVgX=2dp;hx?ydwZ>=${+GvTlr}4@thRnBz&|&XlAc?Z3Hi5k
zPNRM5vP0hMr%g8z*SKq6WbXt!Bo7X{#eN|$6TdHf`Xa<1*>aq+K|?2VbpQGHm+#HT
zF|!Sg5!E{HV>?xR$fQ18p=zLNplV={2AK2p(kourPh?WU5X{3+#QKkq$;HcNt`a-J
z__T8zWIZ!TF=LV7IuGTsl9c$?MM&1J6H1Kq7fH5bM%D%sKek5zQmpE+Q)1sFjGuhC
z&Idkz(t~}+Pa62(nHF@RLmaeC3)j4$MHpP;SRO^SJS{J@12C$VKxPxcg(!~;;j}WJ
znF}rQ;<|vQ2V?S*55M!6hoS<&2TUK{;G+PaL?+B*fR^)>^vHV<{Ow=;V)gq^dD{2)
zpZK`jSKtoe|LIR(R{!+w+v<0lJBI&;+`kd1KgnqPtFM`AOx3_l8rZd<c1K{s*@ZWg
zXqD^@XdpJQZfKqIhQTDQUY(Q)gL@WHOcH?I3?1;d%coc+96+tjLca_hwlP=eQTym=
zB3D@0F-1zF@aN~7#%Go?X>ef^^6{bYoi+=cxKmr3YpFg)+DpTYp0%gpMe;VB(78%%
zw<&zgqx9MM*=IAZXmE-9hrtQIjm1sfb!arC7Udj0J}#;>g)q&yomEV|sarL1#`5Ve
zKJ<8YK)wZzmS_h3JlyALxzA5d1?#S0oebs*9N-}B(U&6k$UmJr9FqG$PD4mnoT`DU
zfh*GhhT!-x?O`L-7H#-fM|WD^vG&skZZ&qsi+@ePrx~C6xy-i4i~+u9l-JtmT+prq
z_N>pEsfGezf6U1)mwql3aXi>dosLU7F8T2Lu3+LQxC_tXpE&HFwz-lA`=@E(lI}dX
z#NnDAE^z>UXpo+pi;OGjDJj8*SBEVGL<}XtQV7yr0EqLDALcGN>Ey96q&rUD02_M=
zpeP%D!2`&{hvHm7;!G1hmaog7{H8&kQSkZrwEBaeK3Bi<_`~YI{N?BBH+7%zHsAwv
z|K~5iul~;Gx435*qi}_)fn{re?o)QB<E3Rh4~o;0JzlU%VO9-zKNc;jX;v&XVo{-R
z7_s<?wfvkEo&{ziJBzFxqK(Qru@@S=;Cfhs#%T*__<fC2!ts(oeda+%M{Y3)g9{%%
zL)iG!NNv5BaZOTnrq@7@Y0yoDx5HZFiH`*8=b)}9kAZn7ar0ApCAMQEm^~Y!<S_MY
zJ-trmqBx{!8z*H@sEBC2ZQW=~u!%C4=+{RVy~VE=nkypo@uTnGf7a=?*O=!=6}as*
zqjGhS+uH5KZ#02UT7RAn;z@$^?`27Jl44gTRRhb{Kx}F`9sC#{|D9yWQmON!wmKaw
zKWhSC6EWT0!N;mLcW@;YuS3eXYw<_f^k-xlLC3y`%@UwGu~h=tB@N(Uqr}D536R(9
zZ0sdm8j8UKpovkjw8=WZX@duUXc1TPS1@=*b8FJg+i~CoY_ncMtQ4|jYC<j`M8HRA
z(lFfGZvk<k0pNm%OFVvLAWS}JnVxa24Dby$0uv_Pa={;Pm~uES5{CTw4}bc3_3!@%
zVgUE6|KK-PtAFzL7gm4o&)!xTfVaVK>6(ZaRp)=A577OaKb3X24ZFrw4V+#BeiIgZ
z&$2fiDN62T)#XI9|GndpOltN;YGB=_(om%zLgmS;c=Men<I=EofcVV{%!By>6eiEI
zO_rm&k~+^F_lO-uWb$GjMDPlVa8S9Y$)uLmG%gH?+#yW6;O;t3<lWz4gt=e6b6QyG
zd732i#FZ@52vMmF(16FhFQ_>Y#wL&Y0RmU!815r=`G{Xt?K%|BhwcsJq)=n(Co%H!
z2fTo0EG*M9VZy&%UK5f&m{e2lJIRJ7VvMma8lvrsM#ZnkAo=*;!97@xo6pFH7awID
z;k?f0>QyI#<BABiUAM`#?)NB5b<)<^9@LHG5p|jMK3Jj+HYW|_5T0%Iq>L-Gs)5sL
zz|+fVxgN)jaq3Zb2ebZ~3NSF|uTgRxhd~%)FeiomE0w8u9YUu&cE-#*cjfIG+h^t-
zYpiiRN&}zml`K#Ao*4$hX3-XQ)DqWrPFw){r0th4@)OTf+Fzj$4QTQ(sS)<%MmqQa
zwod%UbG-SHhct(wgTIv#VM-to!>p0a)I=;CE&xOOEvT80$7$dK#=(V0H*Ef0KF~x~
zD-V~v@Fx%WB`tUZUH%!n=kLFuI{m{xS*`x4IQ9E4J$|nKy}$IZ`sK$@tN-qoZ>!(X
zl@Z(EU(tu<{_*x(Cbps1xT=9OX@D+5m#I)SaJ&XsMC3osI5LKCnvse2+FRH$<;zJb
z?<Xrw8OPVg87Lg1h%<<L2`s~?s7As|7JjxEch1Q;%m>Zhwe;cMPH^7eWnj^X)aZl4
z=iXbOR>}Em8AI=Sz0JpBs2Gow@~S?co}OYO=#3Y9lel_9u1^i+$Lq3Ep%~D52yFy1
zeL;W6x5cInhpto*wf`6+6`dQ_b>X^Wr}enTsJ^2#Af00n!7##{{{8!R8H0b0d44$E
z@hxCD?K;+t(N)E*8n_${oOfP(WNzlb#zesPAv}Nix(McOjKNEVT_g8-YiCN0QOez=
zX<p8Qgk6ye<FPRn0uF;?JlqloKXKsGux!A^PdqfBPrOx69@4RUIvre26uWVP3m%X2
zK?gj8aR`%-2mBUbP=Yh#f{bh8Wk&p@J3lzaH6znfQk!PF#8EKQFfY@<wK3PUjZZxM
zacvlOenkb%GECe-;8VZ<u}=N|_VZ_aJnq*-`QP~kY#&$u%|Clv@sYU-C(r;psc~;{
zP9W5UvS{?k#8h_D3oT6*djT4_=k8OrE1z6s(DuS-r+D=10xqsSTK)sarcX^*clZ8Q
zYN3dQdR^Rwig#6F#lnY=%Dv0PCBrYLN8;y;7{`=|pHq5oG7P_b*V<5VvM;JV(f2SQ
z%Ty*;XI#SY2n{kqx58;Oko~2jag7yWw3G<Cg0)zYQ+e?}>rMWrr~H9i+3y%?Y%rED
zjC72foHQz7<K#<80KT*ZplJ^=?lxnXrS(R*#myY~w?ofK&g*cv4X#gxnywAJ8@Np%
zKj0(XlqaXRAu7(g+(_<`Zv&?Wc4`2<QlF2yKJQUu4dFlk)vw~t;GG#eiL3(#tpz&y
zXq!U-tR<YR8zO5j4t<(L6=qnednwg~s)4J~0CQOMi*AW>!s^CO8s-H&FKc6OGXZ7B
zz^5ml4mjd$TmS$-07*naRMvd`@fO$Z@Y0v5ce!KOj`5r804LDRIZ4F2M1yXwt9F&9
z9hr@UA<#xyFTSun0uJLhJ}&8`@z{<^JmC`0c1|-T-G1`nhd+7nI}Z9~SiudtrU5+w
z{AMwj1S7Wj1G0rO5*ZQB@wlb12!%BpARZtuc%+#Qv@NW>0nY1u7M4US0GAyzc>(CU
z5V-b}*H6h)(Z|8>=+rMI{KG$aS^e{e=hYwlx;nK;{w=u_@$c%y@c;HAqcM0Dss^eC
zss?UE175`NhMSX%6^3gdCaW;+d1@P;w_@I&2G|^7^z%t!48A}9@Wbj&C-*ol{Hi-W
zKeWlvPD7iE=H#$8As@0jvgi%NjM^K<wu1~bx2N)xme>Z|97X*%T^myoDC;ioX^$}k
zqrW^hqUJKV5gmjQnjyN~X0r<l5MurpEyg3g+;f`U1~YOHC#K#kW1vnlVdiZxHyx8f
zRv_u5&r(E!{=~`Z!0V<Mqq=izfVzEn)X88OgL%>Wv+fIieXR#z=GJ?qUo}uQaDELu
zJwG>d?KHA5udeq?GNfuuW!{Wmf=$DsQkh=^EJ#=&Ve`a~?Gir=AXY3q_<3?6)hu<I
zaI;WSDDz@8EbX7o>L~1=;DB#CDt_~~L6^K3rHxnecRunE-<5~FrX%lHgD@GLxl6$D
zxCVr<;g&f2VN8C)F08y8VT3il`IfYyLEdg5j8hgIJo9tDpzlSf(kFqxpcBFWy$r*D
zeD}QiJsE`mvbg=;uRX4QPt^b6pFM|R_^;|d;bY;Sew1oEmfGd#r*ioztWPaOE4}<;
zZ7o4=#5kR?<IUXGoZ}<Qjb@n}Jx|?tO8V7*=^AJ@{;{Z`t$0`-SFSP_ecbKQCj&4Z
z^qUyQ@hY*WYTvE=VdcosT^m_)?D5NRx6-|^U#H?8{2F~T8i>sUouUQ$8HQdNeD#$%
z?ic1Kh>wqXa`;gOVGK5}`p6T5_njId|5#=*n?x5?Q;T0GHdeVX5-TlE6U$Ki`Kgn|
zG0!&ruHjD~Y>j@cJk>L)213^x72b}0)S^>ztj$5D{VPwN=R~569VVM`A;9_yU_27P
zhM_Sc(tnynw+Z9;u3w{-u5m108!nL=f3(|O2wU>hsHrr-*m0kCXKH-GIREp{KgY@7
zA@jUXfLj{3TZgy1!rFuAwZZoMHMVM?YG8>Ph+%voV|m|8&aU2gx%wFQrDIMy4qSdt
z2Pfne5pj2Lvwzw<_#G$0Y`Js&xSf2f>+Q*x8e6tx?4LZ$Ts$nCNXK}G>(j&F08Td!
z>Et8K1K6eEc}DD}JKl5&^W?%UZKmWWjB7l?;6V>OePvjbUDz!!gmlBuT~b32NFyLE
z-5r9|kOI=(NOw0#Dcy~9hcpb0bO<=WnfLq7IoJGs{_Sh;S?gYLlf`j62OCxlSP8lr
z5%xQm*+>G5wzpe?bT=c{Y-W+uz2<xO5h-ywdtvAuW)HcfFb#j$9wNt=j*7`6^MKd;
zI{${J=W_m&mzVi_%%In?!|@ZE=i~8{*CnyJo`0k?x;=NdWak&CG5PLU54r;x9`!GO
z|Bftf1$;Gm=DtY3;oDWkx4{vd1RTO0SrbUAk|vWYVope({TQW_<3xJkb#{IV75Lf!
z;q78H!AND8-=uANZMzCbRwsH>R5WCr%ffQr3Z@4){P6wVNhpsp4kOGzn^=@@AKuDC
zT@bWY&;G`|Io&EJO&Y&`v)ARWHm%k!w`+cPSw%SD%*_k406N(cxmmk&_DhLk5B=Z~
z3OB>*Z)1!Z>L#}ZdUa#`VAH{-stJN>uj6E)js3_B_*K!JX}JPgnsh6u7g$p!FWBOX
z2XUKY`Oh}-iw+z-0!+7XoM0jNpXOAV4B__|qy^wv;<oGMUXt>&HVfU!$}t|E>h4_I
zEgTV|c8Il5-q!*-<q+sR?Z<!iOX9AaYgruYb7_{4<HIM;fBCa2(ZW-2Ot8jO9*uZZ
z$g%sK|I%w)DhInQv;*e25Y}UtMA|71!k(LCfGCB$#mAGcPbxqOiJYgC7R3#m;leWK
za}hPC{+`o16C~t+B*KldJI8;tn-ouDM2hs76TuIeklze+bWx?)dugfj1wpX=!gm7H
z&vss)eqL1ftoa6>o2I*XVZl}?S^lwH;8wrF&PEnruXwm#fhOs(r>N3omzsS%z30H~
zhDT(R%uHX*2t5r3FE@-&t}eg#Vr+BnKjK>KD#_LeH}QTiuDZ|>z#G<FjWm#LRPbPZ
zU9gjXJ*{H@MU?n^*fz?rz^+)V(va84f{2ArfXS2CElQS*-K~+qdUe&m!o!50-#!<W
zWtcsS`nCDM5EDP<F)d=3P9ZzG^)40N@!w}i;o5M`sLHvLaQt@3_anO6&+4XwUIS$S
z8629oUl-K6Ot+}l-ktQyp&Q39F`UG%ZSQ#>F8BZn<qzJx=m&T%I{l;^7EJeOed5vt
zEU<Hy^*h=H`lwl6%3w`)>h%NHsYpAX{ae%88D{Qtf|&H3a5A>CEVj&!oon0egIeqY
z?~I27GDGNhmHr6QM-16bm~#$k3nvHJh6f4jn0lY-0z;deigT8KPwP|M+kUjRIcq1R
z_r{%4MM7g#G>iG;;i6E=hReD_<EMhm`o;hQbE+9mNcW(KBe>=W%lEoQw)MaWnpSZa
z<&4QhZzt$J82YWJF?$zHnH_2EdjiOHm<zujLD~SaYo;hpS~Ou=hRI|bf+h}AM|wEe
z_aa3$>J>fvi*GRgUVKCfcbn8fJ_viDHHZA159?LHn6S_urt_L8F8SB_HMHU%V$kc0
zA$i{G&-DEJPZhu#RHK@+{>JY|7K})B*lA$S(tYn$-bu!+cgo*dR1KH}l*1Z>gpxT@
z|1jAGruABlGS(F~Sz>LjskS?g%a+C6S)IpxS+a+)F-ZKI&RZ&uv}Zj^=befF(HT3P
zlN6bsZpUFkmlo5|B-Lu1!=obr)u#9x<|&uqpN$3IHsLR5>XSypW;+j5&mD2f{z8Ha
z!(r&m<h;A9B^;m;#IlzeK;6rm?{9y-xw|_AVYQ6Q|GZ<Yg3QET8jKW#ja|K=Yg_~+
zxJZsSU-R>zMDNL9qUK{@&LA}X(&Yb!@<CfR!xV63!FIrSChl=JG5$pr)p>2266`Mk
z9r>2TUp$JpaN6(ELQz<Ksv*faSz}+YWp*^hlMsI7x}G@&1}{Dg+!4A+>lKYun#GkH
z{cC#BJN59q6@T_~edFpZa4wtCiTIw=_N?96nQpjQcDMZ+bZGvik=+^Lm?+!}K_Xk6
z3yMZVDl!;?NqwB>e#Y&+!$Q5DB!2thrxH1?OBuIwwiEdviaT~c6B4o)ty5VjB4&g=
zxeZo#Dw5cBMlA|I6%&fzoC2Tt)wZ5+3E~u*DRnQu3#Zz6z*rZ$+z$Lw_tfH!KSR%2
zltb%t-n?jT%>Tu8=R}^)|K|ZIS(1>q@8#ULl}?ph?2WSzY(QsF!zyZ>iy+~9<Uz(A
zvZwNk8}0LsYv3^b;$-U(hlVNac_dZGA(~!ODzl(&8_c}$t-ud*cvP<X;xBkHH~^$X
zHCNe?He;wa`PL>Y-~`Rs6dcVVT_E6w5-XL)m<k@0NQ$MXEuph6s9B0~Wl8~#1c66Z
zV=p}+_<xg;7;cx07_J^K$+*dP<99yA_J65fCRN4kIsWQ4=Vu8wob!uN^)q?#SJ%Ef
z?;^=fkRw%h9jjxxcxqIYZ5!k%W{ww;f7(E(*#N%NOc?D*zHDOFm?xg9Lexf}ICN-t
z6EgeUaojN>Z}FEd1m$mHPmg_p&S9~svm{Gv;u6KtbPAiS&(0Z>F5&-z$$MMcgCFMx
zH7vNxmSQIiUF26jpkY})r{TKh6l~#EA#h#HhcA>(r@b${OU^|0i1xS#9oU&#U$W04
zv_Xqem{l}?;vcd%RK9K#cQCsQ+w06m>#ylLp1N;x`Spv=K>Ur?RQDbC8z@W2MqIX~
zMi9CL9V}}Ja|6d!iAjU4T!9j?2p2Y!M82dG!P#j8t$}K2>9@Ui(BO93OI``1-kl`0
zha4h7iA&}%y6_$G@YkX7gz8tR@NJBF+rVhFF_da3ul2^NVb0`~V`H|PjM|aKID(hk
zSOv;v5hC;O!Qq|5n*kuKSy-5W`{-Vn@HFPjQ`<VxJL?v#T!pRKkoB~=NF+;#3A@jD
zF+&V(M<Nasc;?UOGDX8=s#$)%oyXn@gaiYa3wREx>-j%%nV@&1g}YhIO4T6V@EnD7
z6y#oCm)Faja@jo=%JQhM88e1IjICcZU$7I4ydIMW)i%@)zg|+GYlk~euV(C_9d6$8
zL1M3q3)FQDZ{G+-6BY`x27Ek#y002-9LGa*zL3d-Js2eGTI0I!;cZF_QyYnOFPX-G
z$#yeO@zg#Y?7?QR$Rf-#x;o30aDBr?doaR;dKCDb^h0>a(^h03=(wdg=J#gfsf$Y}
zxwC<3)8+VV;4(ld(e`LnTn%ll(<A3L*6#b2_t7{on9R_7bXcTSKbCrAkKXO?w4KbU
z-IT@GID>1+S{qU3OjK!<AF)IC3T`c&N&DPj(T7~s75~eIfG2m59m18rYgDHoBOx=k
z(F0US?O!3T+6dtR4<~F7jfT8ID}7CRnN~TRU{*Q<6p9d;bbv${5&UZ$>bq^3BVc^}
zNH+!RW5@$vqTghsJ+fDoT2q(&N2zinU_bqj>iMx^bT2#z0!na)f-to#Ar<B@8Xrqz
zvbbf#Np%580qWetP(4Q^dc&h#z;Nu#+DG!-3v#{!L;tw|yWW!a+L3-1Zq!-O%kV<Y
z5MnvqZRbzC0|5Ec7u|KWj=dj;NO%mM{%<md#FiD!_F|J;a!LSMu7>PKXnOX{11$fP
zB#8O$7Qpziw7<qj)62`t!Oz!EW&gsm=L6K)#|W>lM^L~zX0sN6#-ttLSTSBaz5o^)
zLF73mKS|dnN5!bbO&F(ay<VnCnO49e{MBh7{{ThdcI0>J>9Y6rnw(7j_oo3%<k4Q@
zoV5hC8r8`Jkhecw{AP(hK}}GBiW^}0wmby;biNN5K5eKo-bmR}jcXI>wC-JM?L=he
zjO^g%4%f^i!x+HkbG9FSy=s4h-e=vkyJUo4@el#Fg8-bZ$>){x{5hnQP>SW-9Oe{+
z@{ok@HANjYTW|J|(1TkC0dFGkfx*r1Lu5K#96V4*9uDS9<$(;fc9}h4{Nmu5koYhb
zTyqG-Td}R+Zbqx9^Cl>+3w{~{&r1Ve?Saj74+$p`yYU+0A)g%He);H9yb?4gn4@<W
zd=z(Ct1M9Sd3%_DCd2W^v>n17F}~fLeTqwOZ?semGR4OI-5Kxn?sKV$4~d_-|GdI?
z;^{Cc4l8ZB6OL7M?W(?XNRIzZ<&T!X=?DCS%j#|NOvR0tsh<<O76R~%eS{1PH53c8
zU{1+)CXO$kOM~M0bUxAdk0zjr@0Ag@HagbtUh<58<5pHgKe+kS#rO<H;jr#He(yOp
zw&9gf?F`4q>MZ#@7(GXiGf~8u-PuoC;kg)_++RtIqcIX*kj27O+FghVFMsDScOUXM
z2wJboRf^d?%K7hTFg2hee3g7goqa0*kI59EK4dly*B=>v@kvaP_!N&X{&XqH3;4&(
zSR8=MXgK@d^I8k1u!I(VZ8a79<c@|<i7v5zxJJZ05G;y*90On`Vm{WvYOR-gUQ98a
zl@k)neXzBH<>qmwuZ<ICDX_H1E}LJoS5PV72(G6Y0@ft@%tPdJjMF+xWB?Mi^LyA7
zpWOjSNU-gYkS)<Y$45h)HB}`j_v0AM#5I}bXbuZCv++fVIZ~6N6f$_zJ1Ds#-G0vj
zN6e6d5KQCP4g{CbC?Rg|VubZd1gd#PYEg_+SUmKIGfWPL6pxhk=F>!M01xcijP|AG
zU(4n6uiB(qxXfQco}mlK^0oXi9Jk|P;@KjZs}S{7r`*UlPtlp}i$5bE1QEWg<f>3q
zeVC|5fwcN4lf<!n4lo2AM4J}d*Y*>?#usvYJCjICn|4@&iO<Jrbb_AAWYYLfwN_LV
zhQ|_aYSL3@V&WgKq6B=5@h!g|?(%sO-Z%bLsW}9*e~J{+`L(`iuiNc*+QzPit&7cJ
z4ETFBj%ISi<G@!oYFj9IU%FbHW)h&?{hycu<qzDsSD@L=#juzxx{FQ&@zfq1Z?7wr
zW`2IFnmSd<Kl5j~UY}eq-r~z1GRU9$PudC_BD30vWihg?)kD;$0jqzXobq@l1$9Qy
zYlfO87hEn|)K_6DKlhvsnv=;#u4dLg;|bz3&{Mu>;6V_eyQ>7o<eyYR+^?Yo5!<0P
zL@8EGU}}*E9-I()DXbYDmAT7wSndcc_rmI&UJZp$B()dg5~<)g@-uSnNmQtl;CYP>
z*LxbmRFkf^EUc=5*FSeL-~=(HinBr!^7;vw#BX&$!FE)<v16StxKa0aC--e`+?Al2
z-jP__j8(mVv*t>PV%u|J)MScvxKW*vOHe~HH&aiy?{spnFK4Dp37+5afGwMS<QWo)
zH4yr|jp<GQ^mO$$x57zSIMzIaN1#^mqp3*J2+;cp!gJr*J$Cd~AN)I~Je)>HV*M5P
z-|;*|F4)g6bt#_~3mW_WCC6{7r&Se`HB35umZ2Grv2NajTZe%8Ac`Blzm#=I`gWKf
z@7%{KQ>su876O?$hLQYNC3}3nj?X5#_zSW6(J0CUUfIx|IHd_?ojkfbr><A{e{M)G
z4g!j~z7g*DDE{k*5+3A1JLy6#-y-MwDbIt}FMYm`oBMk;Ov?0LF<a4<W{b&Q#h!nL
z>W$jgku9@79!5`GZ?hpm^K+uRLuROVFXFfLhwYUFIR0D_qcWZ23xKqH^BjPCIw^h-
zOv_MTUpIav*N@^y`i0=60F)c1%jNIUp~J3MGT}p+4mW{d4I&Z&+l{>^wzxWb`NXcz
zpxi0&Q_%)=kyrdwulwx8LnjEya@X%QgHg<h0t?u&<`JIm)JDVi!MG%+Tzl?cw-24R
zJX#pb;Y$jXhm?njH2@8u#Gst{T4xdKh`!WnvWL%iuC%5|-Cg4dCEb2o!0`M$xG8})
zWG19Gu^`?f?ziyUmOcF^3iAgLUG><P+P=s*M5SLX&2jBD*Vpv0adqF+lFw$D<gCmW
zUxw@SnPI`ByiFfVtKioatOKBMyKfjgn4Tuzk+L^hvTex82xQ{#>K@siAQqh&7Mm{m
z94xI(u!%O`-ypH8QJA+<|J4F{m?_t*TzLJAio>MuFq9iC871R?LqFL_6>&O=Vz)Ph
zGC?8XRi-_>#;oKM7$xkGu1uQ^m((*u67WijDd&G$5D_CK;RM?6Y$H;8f8cic;MUjM
zGE3Uy(znw<&<+dP{MHm_tJP|bJrijAf#>rVidcdV+=Vx;b;|9m5`?-4)+sIsk*&-k
z^e6cgvk0l(f-mZ};%`WtXNtxC*b#kA`j-l3wrpX!*UaT*>QESq630Pt9gY~Kp4VH9
z6^Tg77R{gR0Iv4qeGlWMLHRmgIlFw(Zm(l~*eFvaS$g%r)5e&tH1oDFcP79@;+j#w
zwC-S`K3zB`lkZ$#F~(Ot-StAks?|SQB*4cXXW;U*T3oceTG9gRTj1{}eg9n2Yb%v8
z{4)U)Wqw`v_sb5d44(xmYD^|R@muCIr?HGBLCKW{k5bipc^GEBn;`V(zh_Ict1=1g
zV3^qs(BE=vcdMk|q4Z$uo~IJrD_$i-UXykp>XI0z71txjSWU+)Rd%i3*S(sS@Kd%|
zpV&1G=4mOzq_W6eF1Oe|!EIG3LW8SQ5dO_ZpLZlZ3G1N0`Ml5s>VfVp_air7@bi0;
z^9uT5vlTviIAqHbk=7!K2kp6ld&FzrAbP5hRyJA^9FC@TP65OM`5_+|XarSuKa6;^
z4=@F+8I2}v@n-ex2cb%u9Ayi+)F28WJz1K+NhixapD58cdqc=I-+4o~8Ow7LEF*4I
zKDzdn_=PLbE{n_SA$PevtR{t*#x7LiNhE8|31gjnOu7ZL75$xx!fO(2Nv%5BWGC)-
z3`8CM-}qPcp~`;h?}(0=(8DD=qpOI$q;;d=>R~TF$pg2)BGU{bIH??xZVkU0n>ZrF
zI8YV`q|c05WVbeZMsyGDaKkeo=`7tt?|ydZU^%8?BaYXu0DrBx2D~yttJCDgmXmXI
z9#*35QcKt+r3Fopk7kcoohO?}*Rdx@FV%8?86%Z=X8%)Jlak8or!jfnp<=mN>saM-
z0(RdD9f*cqTo6qka7NaiI->6zrC_l(RvkKMC!I)WGx1yYOO@8d?a?;Hjk;IafaJ=e
z4Fw>vs0(FwONW85wBRL616*Y~WcwJfGNLf?+Y6j2(>UwLDeXBo+b<H+N^^2Q|NeZQ
z^;BRMi{9}PR9unJ2c3TMG(Y6P?%57e%ISM_EC>r1GCBZo`9qXMkAmz)Z&;`YKxR(|
zaUC8~3ENB=bjZq~?h$7rO}(HnM6k^pzJD&`?$?R&eM@r2-V9UM88qN2d;bHO4E~4Y
z1d!cckhn`b%1<Qn72!>Vm_n9ksY2o<@|7ij_Y8U>Pwn<OTT+UBkJ)NxE$5Xb4b{?q
z9?k}K7H^)Uz2og~dX9Adf>lz0n@ivcRB_^fuX1|CGUxq>Me#=Wj}>6-SN~se5<kk+
zmG8L6fjvZCG3<bAcU#!|9({EE1K=y=$}aEntyF{-&FbRN$Ray$mH*Kp)B5<N93%E+
zW0(VO$E{$tv=-fOw8xB;GJy^692TQ%26peWFxAM@#>;H#{3FRcUl0Cls}aJqKA|y^
zIMw~wAByL4vpFQK^BaSqmJFnpW_&mVEa(=E?!}I~@uc51D#(FlK|saDb5%5_za8GF
zOHL{CQNH#${H)$Mwb~H-)SiiJ&o9J>DR5wF%$qozbK#+<dOM<+d#ktg)5<J2oh8IE
zi(F0O>2I1Uwe^~I@6~tJ42Hkd^GCk<D>|E2W4v^03=I+lhl(~l2@UCB=i7SORWN4W
z^NPgThz)x8@rs-xVkDH#k0L;}<#-!h_n2Hh5kb@5oIRE;`5qnAgv$BmnE8+UoTBKQ
z0ssPauQeKhUW0Lu5u#;K=Zk66M!kuN!!08m89k|YsnED!>io5bD&EdOACeR&I>#mm
zX}`!dGjVgzg9_pBmE0AxfX8!~(`TQLQh!^rrL1tIMHE%#K48(E&3q3^o-g>k#^Z1s
zONEBsE|4rBR7PZo&dL0PGtpx?me3rp`^No?lZ!B&!lIjW5}OuFum{1d_VicaOGY#W
zM3{0Dy1IRjq7rSF7Hpd2L>KJYr?8XI0<-fZH+*c{)pSsuDhIUa)i5?ip$}9Rfv`r<
zuJhcAZ;BFH%!zD#BUP6BFI30yOW6#;lc(in61)7B4akZE^(P@$AFUH0>TF$S?Y)(o
zRY7(Fy%WAgZR$|p#w*~(T3$mFSePm2Lv0Pgx>recxlUi4P-qy@)|m_2F29>^9avG#
z5@IKEGPId3dDRw^AwXqmYeJm3W!48W`p$npM;<KMVwy1)5lIF9<yic@tsFt`<C~+S
z|M70%0G_HE;D4)%Hjp|tLV~VGJ{R?O)O<czE=orHa=UN76z(tMq65ze)fz*C(<!=B
zeqXcuIQqr~zJQa-Qltatu_?BcdtFR+b5zAK6*`HpIeKnH@<g|x!4dYf)S?o@#WTPl
z#LHZhgSf$`Pc5h)jq>L{@ZIi!{cwct^DT_Vc+m0{e}3M!;V*b0@)Q2z6~|MNDKj-Y
zN?Q9Mr!qGWk>Zgl9252S{&Du~iJ1K~44w?m2qVMP$w%1mBC8MUZ?-UGF`VgnAJ<1!
z4CRg`p$^KsS*RCe_L0ZSPPX~YCnv8-n(UdCO{ThVU}vrxe?xrkEOFE==I0)tj_MNk
zo*(t)==Tz+jKoRKr%_;Rl3bru!S<sv6zG@M-Oqd>^}$@j>1if*S8GnF3h`-c7(<l7
zW>Kyap~$)#SM)M*RLJ<J239u<p83+X_U?Z$NNFLE6x$P%tmQp%rTka#o$N1YYJBZd
zL#JOuEgcW%`x?sPW#JX0tMHzL@9{cbc($PiB@P`*zn-|OK)UTIff3}}eF>aND2(Pt
z<!d$yqNrwbvG(t56=X&!j%Rqj)%kWviub}M371{=5XU+X5-?3L#pBlGegTlA0n7)%
z^jO|Tto?yk9JIA@Z8J9wwlHz#Gxr-;6Nq9p_zDMV@gCKPwLEcJGOv_!=!fzrml3MO
zv{fU_v}S!EbFNd-x9G6qpA%>FviiT>Zca<LV(|`Vr0SFfb~wm^mIwcQ6kV0iq0xWC
zl2;))c%_`x+-|bH8&afazJ)N^nY#U#;5mv!hUtR`H>@rbxvvDf$f=O<&K;8k^&~?U
zv~z2%fmV0wZ~RqIkb{667na#N{=cWPufbblvPwG7rsLg)23c_)KPWUSr3?bX1Chb<
z&p7yw<T(p~;fI7}+~ZgCyW5BLycOz-QoHxR6`4$l>NBH~`+?C5o)^$!w}k4Jh)zTB
z`L7t<4sWuS)RkQZ%`I5zzC1L>&N!ltc!F>s|JIajWbI1h=&-JQsJa;gEDaD&%d6L}
ztPH4ltqN08Y;x>k9Mq$a84h1K%x)1Jtbh|IxDRbsvODsG9qZ=O_p-tzK7Bo8x%TUO
zbKi;dkuT<0@gBLuAD842`BoG>CkbvoJ16k^B&qk6)*jojOj1T}5STHHltp34ZIq5x
zlK)9i*>Aa5W7fX51TqI?CWzu>msMwg{Ee;$mSLmN&TCY>@SfwLx6SCu)3?2A8AqcF
zVO)TIJUTwJLghDzlPkgaa<=T#!}{!qq#$gF;}O#of1Hf}H6Ct&DLSIWO(2Vzeu3Rn
z;>TAw^2TttzL?x0--^-0|Br){lm-n;9;vVjIq77`07Q%{RPM!==G`RgRb-aBu)Zz`
zEz9`6=7n!hgN_vH`J!61nS^-j-X}n1W3jHcJgP!*r^LkUyk!j8R>vQ!n6U>OHqY;h
zA_+r*via6Pe_vmNuFmeG(*D0I$oq5l_Kr?+CflF^d16xu)1r&epd3<B;1r3bTK3!8
zLTkHi-{&uZ)JF-T1iU6s5PE;f=4cJLjP_BWo(LPuSf~EQI*$0}?|TO0?=kO%!Zm79
z=6!-L>W!)p-Pt@uaw#WlWek7m)~eTK(qz*&e~4{IxR>8m7FC~rv6Hx0T2pbHU`jYk
zj@Q&0q~oyjbc8ZeiCli!ObXEda7l?u0|AnP;;@dL;bS?(2}-Met7ZuE2OzVkDhrJ{
zG9pK)%XhrXs1QMS(0NvEC%&i2xTVoZGVX79C25JU@#gJ~&aRCVASIPg2d!px<<cQY
z(3sL7g+jC0;~S~~+wt&NPpSSw1tR$`6JZ1w9U?(L?~{ak3g=V(-XptzZsP&uQRRhm
z7#=*-Brz~iPE`}{nGF4>A2`e9r2IRd3!jQK;gpU$D=@pV{e7N(EzjOX+unoZuX|s!
z13s%58@d75DaG`3gSofw0}1M{4AUtid6&3Qtfd@Z?*h(o+Z2hmJ*%7K*nYU3rBY?c
z&s)PRp>tu}=gb#XHo=OF^CL~Uz0_{N(Zck|KYQSC+X-|>e43r3Fwa1k<*s68R<bm1
zpkuFuz?h%`tln)F1U(^N<o3&QifLf1i(^}T4&Lvvp6%Q}B6D)q7ijv!G84GAg|2sI
zjc*?#hQt#$WMH%<lku51hIDY!&eDXk$IkEDvTUb)yJ&(!>pSW{>f<IGCZf_@ds!aJ
z95!;qQ9k=2Ye>wp)U0!nEAJCOu2K`ng6sy9HyxVy#=-MJsAeL9)X5|6V)*ZH;5Wox
zbT`(%I}P)x5T$J}NM1Z$YO@a2951)QDjJ0%kQQu%g@e)?hIl0kqMO2f>;ps&wBy8I
z?P1qL%48T_xJsZd<48e=pzB1moN1?#k4A78=Kubr0a#<5Gq$EqM0Sf`b5LQ0QP2v?
zG>T1cf?d9IzahMw80|$cpH-Ob=fG;w%`JC}hp6OM-d?Wvio;Ptqa<H0?NVj`^#=|r
zB}BA*?XrEKK67BZo~mr-FF9t2ZTG!1p^5SJoxmNN82vd{OAfz(7Z=_FSjp0zdovj~
zSB0da4WNt=%ToRSxdadc?0PQmXwudBnvbr2`TN_wvOrw8N5odS=DvJ>=>okq^<HgF
zHWR*)vc&v%yrM5h=KgB)as5?n$f<8xX$AMa8l)E`0<FEw{CA{Vd*{v<afoA%9BM!3
z%7@c8kwA3Pf|+;*hcXh3WjS*oT`ckbd=CzVE-T_p6XKI0REYBdVb7xwo$w+8#6MZS
zr$*fk&@i{b)*Iq^5C-v0GbMgW+%Q*VGt3KBk}(lD$kn(Zol?pbIDem{M6tU^BjeJ%
z6U3=+>*V(6`O@#f+whR{V>gdC)|w~GrywI^TF13&`Qc-x5tc6O`zw?G>NFAeipG$%
z<0)Sv*I(|lr0YLOn-BRv6g@|OWQK2_B<BGApY>6FjTs6xTNhZa^Uh8ZEqM0XiKutO
z0O22VflE;b|D18FTSi(IPh+rFyCu|k|Cw9^x$hTZJn;Wu<i(ptQw)6!gUr3;=0|m(
z2$8nS(PKYwNT4(h+%ER$Rs{XL8&dEX)hi~YFhH8||H&;;BTmile6$eIytNw5qWw5H
zD5`v(eZy>HII4{uyCC_3k*I9CWP*Ri<jMHFapd9*F}iD{aJGGWO15O(x+#Ap7N3AS
zp_Af420f^C>9ZV};Y}E_q;Ws)MSN4MNVsyp;&9Tx5<QtDt#M4dvr3{M8kgm@ZezZ(
zDyFoajx_yHhEBD+eX1Hf4tQPf{UqY8Xi|$XB1{9HU|&2fI3eGnA@hX=J>wxn0$8;&
z<wS!CoF$HJ!uv>Qam;I!=OIDLq|2gx0+QKY*Fl#18Rd^M+z%HgZ~7}im8d1IjpBdb
z@KsLC<GT&y#P9kmo-_XAVV7I%H2}EJA62^+VN<Pt3Q4MzY?3ZUB#H9=T%Xf#qmxj@
z;NMRYv-!^PXlwWVVYdG+wcIPP#ORZ;{?l%Umo7nBYYdg-Pp%cK`o3PTNo{N(1rIM5
zqK2SxexSoD(Qn{bMCFQ?OHxMi)Ou-4<x$}^ceAVDB8|m?+}}7t>CQLp0cqkZtWHHs
zGXkHtG2ZGsW{`p%eAuw%c3Q`c09LUQq;te|4IYcU+So?Ps8fO|w!Hp6OB;RUYpavf
ziP0*S5Q3<$Ap);A=I3Bq!r4#kXNgSNg8xeG=?(_hL6$v@#>wHKXK=FlCt>Rj!3r?}
z?*GQ_SdR}B@#+miO_1Pcab6MZL;Jud@vzN;1Ie1-aTY(orP-atB}csukvBjHpC=eo
zrbPmU6d+RO@opj!;5wz_OZUf!zIai#zCq*iH=5_~E<%bBo!NIm%+Xa(BqbGL-D(}w
z1~;I>G&sod1b$$rd`R+l^cKL&?jcNPamRu(e95Em@Dvcxz?@qQoJu;B*!1E}8Qzs0
z;G$}%JF9Y}`rX-Xp-dFNWIA)gE*a!Xz&%W-;)Uzm+J7N^XqB^nz$qvvOw!5mVQbUs
z+q~KX4|0q1aWPkikJ9fn{Smhl$M+p+;?v9R*NvBl6g2GK*p}>$n8k6WyZZz82Dxeh
zqY2GZUEb}2Qpu5P`D*+T=6Yw}nj_6K-ra>`ke|7j6_@nLmS@+shOiwDfAg73rQwjZ
z1o+$%iDd-H=EwtPH+vdKH2=1HkD)Gl^%avw^8Y>>d9of)Znlr*T*p@>efP}DXX;&-
z_~WqR)Gl>dPbuA$x#g#VBEcX|`3kwICH@TeECY8HwENZ02hEZZ)m&}}_|8Li@Ez)o
z7rf5X`$-9;HkQs-WA0|v)Y#7(;1Kxc>qa|%&x54x;Qg3mxb_;i)E-@Ij2IzpELBS9
zg9?E1Xq6R9T#<n~$H9tB9?l(p0aiRQx?Q4#{EWs`M7$1q)P;>h>ceP%l0k*cN3tW0
zN#CT8nE4t3f@z5){i!jrs2>x@y?dE9MByRVzEQO-<D=}dPGZ&4AdjKq7t|u1CAMY`
z;qaisUe8)g5ACG9>t>WyKD#C_fS4)jTF_&6(U8t_^vSM0x_vBv;JzuLJ1ki!yEuG;
z>Wuf$jr{&c0lRuUBenh%8+$m9%12*YdLJ#_xhQK*l&krDaAF0a$(7s7y?dEzdb0<+
z9i!sX;UKROZ5xkIq>jf@S!%eh|5EPX1v`8q3QF$eiWN8QV4`Bd`zzJ8<ea}Ebk)fd
z4jH~ZpdZ~`*P3IxlMgb)!kv;6CNh;%m8IXn3x&z4Ph{dgqx177*Hfcib9sgU;k@a|
zecxN*vuV$mP4_xnZk}>c@yaiiR5u#s{rv(nSiubwhOHIao#P9V{0(KfDw@FqQHgF{
z-Dm0Hey%UO<_}p#`37Zs+<~soLv`$6ufDE6mx%h0Wza^oq|$QdsjU1C92(9pR{ff0
ziPfbKd?oEJQ3FkrDPC)!{W$ks7~UrU$bIy5h@L-Zx$_qqHCLeh%fT7AoFW|rUb{{v
z317Z+e*qKDf<h1iX+Sa<{rIex-V;CxIpcooPAF@I9e5*5V=jDVu$YJ%mWG&4Jcg@6
z>HhsA?3cCoUJXPLyS1zZy@3A@aR~d{Z)ldzP;kKd3hyMhIyagK{;ES91E#K{vlO#R
zs|AxSFPABO{Z+A26P_%MsehSoKChYqy}_I#*`G^?OL5v)oVjvkX;NSaPvj)_tzkY^
znF$X`_sM{ZH+`~Q{m~j(bkE(i9(ILJ#7mC#K^es`nK7bk`PUQie%9EX@aq|%AnBH+
zk~gKeB|5y7U-aKncgcs4irNmZnT`IszlzJx{gZ52aa;jdH&UTCwHX@zO~fx<r+bac
z`vzF!y~D?hRTYCBtP)T5B|YoXl%+183BjMZ-&G+1c=;j*_iA{;1pgKE?Vk&)VH`eZ
z90eZAQS>2D>7@JzaWnwb!sD%kk4?;DrlLm}<xzUIYH0S1v8Ercei)*f`~BT9kdt%Y
zKYoc>btQ)ph%wTi7Su6Mt*CmwnQm|X&C;>gD!8{hJ*hL-Yr0CWaM<^vKurz*PcjF%
z=-^$=&^s{v>`bH)nL+N!-n!RVGYFeo{n+9D0W(mKRJj$NXrs5WfG67c@%~G+kq(d1
z(fC7m+P6JNp%Gw=Q)xq!8<venNa2WOn-Qw4Hn<7(J4{bhsA;dYi9->BP0(hZYhY=e
z<eKj>(7~oA)W~I+W=CaWnI>yIk~cznUFb{#o3lsZhfErZDYArIcAa!qo_lp{9=oA6
zg>gRf+9o(?9r%6NO#E&mC13Mp_5DAV=bs?E$T@4v!nJknF}5&LcoOM+X)*Ua#G%9e
zG*dIDx-7SyvTQ_e&WQq+ur!k;k&V~RNyDvBeCg&!pskeeF+?+Y1wzUpSvvTTdEwzG
z?T~jw_ynSUX=y<t3xAAEwbB&^CdZ@2t=Zo>Fr^Qy6LmHxZABWTqZ=P7V)F#}PH4iY
zzY6ghDfd3D75|B0n}$dg?@byVdw=#iAMf8Qxnvo})<?e1n}}Gvx#>DD=^0OcIcZ6D
zUmMpL-~UiOOn#=laeMD`vadDIso+y9AZB?7O|D(Zs$h|vMiXb9|LXP@EM8Q7DR9@)
z{lkkGqWAC2v^uvs?hiYfEAbEWfcFBWK9`nX8$Z{l@4}})c+51lH@{!d^KMf8Wk-0)
zMX#k|tOeW^-<1bTCA%L+$aC~%^TTEkJ^*mZ1EB*mS?Z6=SZ7IzBVix_h0Q36IRs%2
z5z|@(#2n}QkUMfqM2sMA_B4Y+gYv-m!;bYWg25D;*ma6akk)IC8ld)%6hZ5~Cw)Ru
zYqEyQck)(F?3q3<0=O_A621Ngcm`T7IjR*xdJMaV_3Bu@%P8Fg_9$9jW@ACb$&BPj
z^tHsJE3#j@l}EnBy>tBV(6$?s2Rou%=Bu}p3U_M>17W%CeyncooC~#Q%o_m1ioPm%
zdtVh+6T3DzI$|wuik~@^MTmPQ3jUjPNDc*iJeK{_&$rUb{%k1{WtRG3Q8EGbDEU!J
z*cfpjqbOb2MF`$AFFL#^pzO+bpG`gc+5JB=L!3Qrc&?vi!jhD)CWH9!yTooi!-jjC
zZOhn+<i3}T_4mqYs%0JVtGc)$;{zwQ?;6e;LeOdAe&s3knmQy27SX3Q1wF&lEail#
zkWsW+?6K`{Te9PFaA-d_G5#<^i$hUylOe%%?5UKwtt5IIB}CN`tysUaXpV_kgxG^F
zO;nEwAPmEQ?DOa|mc*24hr(%2Lpp-4<jN%`wIsFp+e0J*G%@OjUYd2TfL&#oO^m~Z
zKnmr2tkc`wGxd?8eo3tN?!U>OBDr|F*<?s8qL6elYYhMfl*fMFSZT9|3)D@WnT5Y@
zEk%xpvlq!8zAGGjs}}}E{v$WnF+E9428iYs+8a#0wIC0vY*EWy{lW8~k_}Jr=zz;n
zi#Bj;kOfkpYtd;lS3hNA`!Cvi{wjo1aGtF+O0K(2wWZLLnRvV&J$G3_S&n$QHco3#
zX&ARUto&vpaCy?YPyNkT-J;)V1u<X{TW)x^A33X<5&ckq&@WGQZS$#Wu$xNKUR|z1
zBolSl&<ki(oRLqtwI@19dzE^AP`ObxQYkTId#_YG>Fuo|<+1x&_%DCG=)P9eu&vp(
zxc^{(#CMqkho#YJqc423)GTp*kNs3+*Vdh}eUofEJWrig>)h3>vXtt%HE&&~AHv$_
z)LIf8!hW9>zN<&HoW-E!Z&vKR*MM!WoJZ9V(sJXPS#q1(2AOinjmG3Q$GW``kiN{&
z<Ge5hs<k_o9-Ot3q)!;LV#>(zHQ{Zi_mkzjW3>d5(VInKa?UsA_wTmM6&#9gi^OiZ
z=hjx}JeD{@aaI2>F<o0kkdaV(Q4mXE_&hvuv)p-xvv1+sA#;<9h>H(pFy%#^#;_R7
zjR!8)=hUd7+E>X&VhGhB)|zcEoJ~u-ezzxk2sGr%>V$}-yV_>?I-m@2<7Nw!ye1^z
zR@3-DxZDjSNDQ-4tFGkN&@t?-d<vEJ+fDkHysY#aANlR)#a?0lf<A_)+FEaO<-P~R
z%fvDof0+5**%~enOOxLrC9h82e`8N=Kq+ctcVrVU_XrEp5(h5scXfW|F{CW+LGfGO
z>{E}auCc6&Z)o4zUXq+0YKK>7l#JFyUC#2?Ui7aMti1--U@nG7_e2Da8DZa=B>j?Y
zpd4I*earrk(E&>vRZXox7f9a@4^4zp4A=z${A(<PqjiRrbGNMK$mFGD1Nqhj)gQ6c
z8I2UXyLST{x6w^U*H%|Vm2-O3ZnV+409Lil-)L*L7h2!XVX|wt)i9|oFV5CkR>vnV
z99>u3{lMXz9oPx5p1dlik~JW>@fwtWy|60S|74frn`7Tvv<c3Yr9!$8@pvr4{dM)z
zL=`ok0_Rvk=Ja;mIy**!0_&s+`TRnZa)vdVkV?p_FVL;U$3Lkrob-)P;x`X>tmgry
z@tmaiuL-8YoZplC9cr~+<hwq2!;Y7kE|g%D&s4<?!%?+P@%x+Uuj5|x5qg7%sE`aU
z=%;U2>eA<Ci*|Oo21StED((th=fz%E{%zqn&GSz8-ICX?ZrNS|keb>S|6j3@n7n17
zN%@nG+qEOIf%Xws44<K-Rva~fGLwe4_Oqy;X?4z=yZ|@KVZ$PiJ5oKvnYLJpmJolA
ztTu^rESpq%OOWJKP2cgbSMAG6?UuSD#|M6QxkjaX50z&PD?zi?6`GB9T16Q%206-v
zv;5zZ7Nr!&iqWMs?#cuFeM~f0Tp)ghk@I8sqkr!kI)nZv5H@l>y0*I=L5=&s*;|18
zX}Bqn*~Dhh8F3UB#~U*FtC482ER)Mchd??z-EP|;v&>O8&|cpGo(N-d+*gC4!tMg@
zwpQPm8f?=%C%i6}Mj7qbkn823inem9*1w$@vfWmV340*(wXDdMg$QVgkD+kCToJ<f
zQTaI2G|xEJ*=I2qBpWd}ee75o)y~hY%{$)6FjBnj9^(WM@|x@Q`}w~x>(f9PcPWOM
z$P(%>wAg?P;#x1=*i+i6EhGm|`~`xsJfVlGG~D}xl+Wp;MGq2rsb!~(*M|#_t|w0^
zAC<KJn^;<5KTuEroy$Q>*K^<toTcavGJqRby6{^PL!~9TR7Yv-*5(F@ACf~awqMH}
z6ZiWUA6lDDgW*A)t9`k65d67!ETY};9~q!Af=gV_yx+~%MB<c;*top`?WpE&645~f
zWJ*eIx_azkqJq0gq@r`mXsaYTn+TWcIX6L;AX6hQV+L*nWA;V<ouIA%LR6+ZPuNwZ
zZ+p^SlPr8!g%wLyoz-ZJH0a3n?K*pf?O9X>6{3`rG?i2Ii<BO}s!ryAkcaPO>pT*b
z%+Z+#jgB1*;yKoSM~(Vceg<(nn)1}A9X)M+YCA+`YU}nt{gUVEDnwR}2j)RhuAM4d
z&nb(o(&RDOGKB(Mf#XXoxFOFdFKj2Rx=-FGwdos~gbu7FYRc-as#tC+eItJpK&uZ!
z(o@o!5MW*XHhFGXvfvXaZ}00In~b0lF7AYqHz$VNj_$M822?uU5c)Wo$neAvpao1Y
zm3b_oTUS~wY$FLh44S$b4SxSFjMXW@^q^7`WQv?XDJ1UEbJ<b*Ez-2If^#oMy=&cj
z7bQh7;AHvn=Luzq#X0;fA)Cp~o~4g=XOQ+9q~X2Uj8y#0^ToFJ%sOf47mm10Qh05Y
zp8RF-*w=8n#xJ|J--F9WIEDkPc1m@po@>%PliJb-n;UBmeVJ~IG!*N9=28kBf3zTR
zTH(C1gilSK>_P@@6o8_T?@Vi)#Ke-D7e0#r%Hc6&$q`R2Sc%NYF;l?hM>H?%{~yb8
z=EYFEiHMzAXWI5M0w~kH;WCqmjbixIKh}XS=LOAnR-ho?J0mF?bm{BklQ8O+dTnhd
zO;rl1HY(`wuH?nIDAiVB<Bogil<l)(MxSDTUzwEr;9S@$jQoeaGGaZsqHCapfnxZ$
z7EG1mA%o%~;r<hMyeZ#_6lzjVHm|p~zcM7sp-dB}(o9l(6d5PPA}-O0hy7;Y#k?{7
zn|<WcK~)D+N<cN1&R8hQG|IJnPUp}E!sYCvh5EQ@!+o%n6^VMlU4BQ{Z}%FSF5B6t
zfe17|esx`i!2|ZRSQb17yqK~gQGe{Q<PWm}P3AR_OmfJwyKdKnhBAW(`TK>irr(MZ
zeqe0Y97=!xgQik{gAHIjSpb+$E#LV?nc+hzuQH(N3TIw(ND;fWi$j*?Yn+I0Hm!uo
zyD(v7&vn^}c4V_yXh@bh(URV<QZ3s9hiq5Ko}O0riXi6SH!Fl<6%$cf8oe(cfQViz
zDfnfD^{qFlI3zR2@OZiJtPHt1buSlxPF?o7*8?EbJ4?m<l10MY2#Sx2>vJj8-HE<I
z%$7Mxxg2_#T}g%)&I*1QKwu}Ojc?=vZ}LOD5iYM}FcFp;jX~pPBBij>{M*3n(+Vyx
z57L?-+w|Ki48G63GNZ8^Qz{0sSOYI6!cXoyg?`*Y$+V&TensKPIn?V!OjGLjx21VU
zDo6~{o3Ps3pD5=Nj&V(AjRL_dstd483eiryAs|c){zm5_DjT<#w0HL8Vr;Q(6Cc0F
z7E=v$X1mxFn@tmKBz<uyx{zV{M=egBbsuBCGG1RprbaM|%5JUM^TS+^+bHk6RdrX2
z=Hp(7`_@g&rUt@myJepO@<u<SDh_^6i-m1|oRkA*F1fY<WR(2ZW1{B37Z(w59e9o$
z1;E2yu#ixEI2Ji~|0VXV%WmyPGkUrHGU(QH_FH#Jdy~P)M6FU%&)5$m?3t0DTkWaD
zKhAR*FxPoZNB~8XKAHCAIFDStf}Wl0WA-ktAb6M+_gREng0Y-ZXd$S1;Xp8zQ;4go
z-q5^QaY*{Nr-DQLW~>JsAh>U%<B$su@5&?m$tOV;y`h~7H$uL+7NUCimxXa1yo^>R
z<zqV-S&E+uj$Hd?A50QkKTl^-xE~kX3JRSJ1ylEn8a)SMQh7lmYHu`X{Tvx=DM-b)
zvwG?hXcMg2A6Z3?MB*V~>@$HBqr^nAvLENm@1_NWO(K%wxlrDA`v9$ouONA=Z#3uW
z-w{bWjy;vWwC`{Hjws_S(H~M<g${@)r}H)Prt*+B&n&+$SGgG<uNGW=DV=NF$6&^M
z=9BAKE=hGbFjTCQ9uBv6_bc^$_(x_sWMi2uw-fR2aOF0ZS=c<hSvl#<7_}$?*S{zV
zKZ;NSPAbJpef~?V;{FV~Qt)zf?{OK@pc)E@HIi|a!``d<qI8E-_|c^bHLV8mDLBuj
z!$)3dQHe$3*6zStTp6t-ktrZN&IPQ7_i43&i&*O<U!B~RXgt-|14v%l7Tu`^xPA5m
zYnBUP>9c^QK%`$<Fe2)$sHS2#Or8$zz>jAkunfwc#x6Rrcj;8Yno}4ym!{PoE`^q$
z#R|>nnfxXKq<P4^gOLUo?EePP+T61%4WPaREVIO;^ZiW1armFiQoe7fisojdz0EOy
zBY{3r)YJ--G%&CLg$0Ls&y8*jX5IcVSkP;GtqQx_8$V&!2oHjI(?~<v%bSR6$%`Pi
z?X-d<mUy}a?~&jSFB@t@H1@A7<CI#j4vk-TD`V;be%3YV96Iv$kveJ{|1Oq4?C+&4
zvudRw7^=)oQfRP(1Y<l?L9G|spvtLUk2HZ}PJgF{Z_qJ$e`1%|<}WotUbBHa2QuNA
zYMdPwP=*sthmv?Zbh_m43RjjlYO1h`34)Vjww`M$mT-?D<iECV33giEU;V~_XOs;4
z=H9=hhrvG_cyQT`Cbb3XWdX5LK%e7^FM1I_2jueaxg9}!gTFZUj$Wy=e~~_t755jr
zXAIJaqAaLtvljbQqt;3Tes8qg{q?v4ngV60S35%bB%DOeCi@I1(|K5GJE92tyWe?D
z_B=Vs0sc!81(^p7p4%>u(dLGK5Dm<a%Z=+WqG-s&TlUo2MSxtvOAZKeCzHfs3jdQN
zvi<~Vw__D9{3_l0J`e#nb20^FwgXWai0y09D3GU~Zwf3cE-6qGu^VQgraS^qy0l*I
zBP!3sCNYJnr@9)@(bXQxwf><0=88ytn<FwE26Y`YNMSr;Rkh_%tSSzRQn{bidK={S
znfBzHRP3xT(vdx(uxdONr!1$c@P5>g_-aJt28pg;a{k3ng>Z4qkKHR%U41-M&5<2#
z%4};+s^f|(cUYPl6Zqo<0rmV>8qTzW!>QtCwN}l0EZ?}fokfEFaSCdC)0c5CcV3k?
zCUHC=$Zfsz$EZpcahU1$`zKW%zR2xv02VhWO}^p!lxAl_hFeN)J)bB#oT#^hV_y~V
zqxumpc$Xo@wV!!~no<ap>1A9TV+i-y&`jsUdCLcCiR|(yvZ0%l&8+kO=uUSREi`Jk
zbWu+(<G5vJ(=`>+kML>UKV%JPoHGMI>N<4D#MBK?qZe~?%Cxli5<YUJ%oW@(zG(WM
zu8fdijX{RlN!c*Y9#EqOd+KEu9KF`6cTA6VI;(E>5OGcyH>Z9OmT<D8X%bBf;fI1%
z)z2UaG(I!f^*qbwEZY_zhXe>C=nxnJ!I&Q?AGk80D&yuxy<_waKHE=p@%*I7CI=Ci
zV54h<{P}?cG!uCG0%1|@XT^VVIV9I_XYje>cZ&G&&2cQ38-hDDMATsY#~T~`F||Dj
z_op2TL3^1Lx817j;@a9oW*SeZQ>VOmTE)B|&|H@QK=%K-0D|bWMbgD>-!{;tIOPAO
zafv1i5x9Paybhcgvjm%Lfv|cS<%-*^ek-+TEp!W-?4C0j;ipw2zHQez;JFLA7v0)8
zE|It=G4a_S6;&m6(?}4<Wi}k)N4`1DY#rC+3b(L*-(vsr{dwer?u`z-W(#Xx^0w8y
zg3z+5JcNZjM&J2{GsO2X4~j_>Vm(m_i6M{l`GnLj7`2l&#FHr6EW2ugPVN7vyo9hh
zAC$cEmpPulw^2C(Op!D>4vUjn@jn`v|ABWvhqWyvZjJEeKj6%p5=qh@YK|qD!cUq3
zMrPqoxCu&dS#lpei~!%DC3x-n8Y8=uS-(Vow#!7bd)S#y#h;RSX^mEN3S(cC+?2g<
zf?yr+e5)olQf82}HJe&?*-a!g`q94L)8d1AJwtApfefUs1N46wWR*b5I@^t;M5%gG
z&H0!@_qJ@C-Y$K4!$(N<g)t8IV(<BrL-dwz9rsh@(nz%`c5(+9jVHc=q(MA)hxPv6
zA&_cH{rmZwBo#ZWkSv+{C_B%?U!bg8;v1aeXz>78RlaHW>C|Rxhwk4i9%p5aWn0&z
zpf;FHc@PaF11kO4{q5lM2rtIX5u+Hl`W)!iy6aumK77wxn?L~dR<fZ)=HXaoHA0<s
zIF_rf`u3!>m!rZJ>5PnESVzG}L53$>>BDWUc+HZ-++0PHsV=-5{;Mt%6S2DU{MJK0
zHNpTh#wB3TI5&+~=4x%F`L{jG*j8HN-1iF<7gH>=R|0&a-Yw;!PDWy*5pqHs-ghOW
z13*Z*0n1@sNx{g<JTMf#G^(uZG-9SY_3QHx)yMvfoX*7N$yswD3=&V<IFOwn%tmI6
zAI72D^@blCdgJyHK@?Je;x;GqrfuzkVym@G-hU2Dl?6wC&7fIoDN>FWivZb01#5@(
z4YErVT7(zWix@8PPnIhsfKbimPoNisJu?lLdvsXXMtK@swj1lI_;20*zs?^e(7P8L
z6f4X9a<@(yRQx(9fZxWjgp`upCsN~WDWUStAS$)jio5{Zm1*EP+dsNe^U8O|kxjBk
zQoJ@HGI`=eC}(|Sn(Y(TKn|r5{mf9}PwD?=fnM04zwjzLd#hb>i^;(gt^EP9BDKMd
zfS9(dhJH)baBEmY;;oZwCs08Czt5%l1L-o-`!#DvyJ`y}dHij$`i$#dNi`nc4oC6V
z^H{Ff*jcj2;RduFStY`QE)J<BGH)aj{tLRiwaZI|^r4~kc>h{kRpyLvEKftDyiR@G
z(UnfO0kPs=CZq38bXaX8jv-ko59|M0XQ&Hfp>%68vd!QcHVy<o;5nOI%OU#CE%QgA
zCG?B*K)Xj}3KIcYp8MGCt?*tAl2XJkRiXrmg+Ch9*c@Q%M#e$;ufxY(Z9o+^cW%zq
zVxhBef|5|tC~p~SaZPooS%|p9-7PF<L)%rk=Ihb^^!$0#5xnNYzr9XVbs3`z`Yl|V
zWc@IZQddwuy;wCRzZehTRrK|F3;l7Y{C(0{skiVIUb)M~h2E$8Uh#gh-*WP&pY~x;
zaftwBW`B)ZI0{vJvU}{ROY~ZdvPg?>WJ@jQ6mlt#_;Y9^{8J{PoV3~%K0gLxd-?n-
zWIl`rXRf%rV7UI>baxk~D39{seLau&UN4WD|CNktc}}Mmg3C`Uzj?`$eYw@2uR^sY
z9c52egSgx^Am29YjB_FS@_!gR%ci)Zc1`0FJP>FcLU8xSEx3o^?k<hHySqyWE<u93
zH}3AzxCISPrr$GXre><<!_@u>d+%CnJ?p;i3o)GkP>CH_j`MI+OZ%Aj*n!I}FwA=Y
z`wu72V38Yw1LyB^8c<(_w8rW|+J^0tkbSkbph*MQ4~FwNk+Z((f&M9C-t1^dy(*kA
zjJ%-HOBq2i&kjFxB9Wkz9j6=r>st{2E$?J<&&j&54au;CW0ly-*H{_Y>x|%5WdOl4
zB7Iy#sTltgC`!Vqzco}fS#u;l0@FWsU`G`j-c=!m>y<j-h&|w_%3-k=j$8CL4~wm^
z6i3we(45<ll4y*8<$dtEVl7jvP<OO`X8#Vh4Cm-n)Jy&A7V*SMi3ee*>9tpr`i2@C
z;j>Bewhk`$O(T(!by}|uUqJX9j>zm3MyA^Iv0NRNpA%-t%$wg9_n5^cr4rh9t${g(
zzuy2|HSW+waDaY|n*5Yr>~8yief{V}R_*RD(7xh#ePaK~YUA_!@w!e2@rJfJlg^o_
zJx2~a&UmN5U>|Xi>Bde8Zpz$KcpM>~x~v99t~k83d$#-3WlCBIo;OWrFzU-rsTeRo
zwb#276VC76N$uLs;B|)XY8}O{gW7nVT-NedCKH(?aLU-%>3kS5!Sy^pp7kV41i0DR
zyxM+Cs9F9CeK5&^WR54cIy4T3Bha=FWncstDtjBHU+a9KgL2i^P^h_u4^2+6d6vv(
zc;2?4)h3fY{k@J*3e#N-)WIAV+tH()o~n6n4NRp5xtBMLbIJu)cc^MJIQJlF84VGu
z8ho@Wx46Y+E)p51|91H^?la~uS8rf>Y(b+CPi(^Vy$MgkJe(V}t_-Q#hcGW|jSb0#
zA9yK02&}yG^EI6$xo;=;NPRU4h-aU-FJ!bG;ZVLk{>{)IvG6n+#<ZWeJdVmQyanFO
zO-R_-tYZHfx1z)EHF_f2sP=YCS~QZ$s?`YeT~a4lW9sgjtu?rnly?Pu0S5}!b}Qt`
zTRak!Ws)x}qva8nwG%*VH!G}OY?RNooca#hh-Q}|60sj+KYdTF$)@WNb~#7(`%Q>_
zT;`3@`5aqNh$eCax(JOOtj=ov9c<5huay0+Z`xJF@MA$8ywIZ#zXan)p&Pv(qju;a
zl4HnxkjsxKg6aR*fmTg@Q<?R8--~ybAy@RPW2xc0?8EpFa4J)>V?#H$^y0FNDD}}a
zhwiU5R@{mZI~*igsdJv>GP=JM%U9_!7(Nxa&&xWeunuZ%&PtXt(Ch8I4zbiR_jTZ3
z?$k9gV+i_hpe6;GQbw8&e=1t_JBkcHOifq_vgbZ!*C6F2BK)?L;VT$1Vp#6@2Fp9-
zOed5<uM8=h+kk1KrXlo2UXr%3L61o9=R`)KsWlIOxDI#~dGvR>b%i`EvD0IgH9f@j
zX6VFJ2|Zd+#6Do28>b-m>kscW@9TxuJjYyrn-rSVTc$EMkI{hV=6d;TjRR7w(jdKb
z*N-({A}K?wh=lJ>Vx)!le?}-SP_}1(rN%I2eH$>kE!ElC$7a>N6Rb+u4e;~S?}DmS
zs|i?VM@{(nqwoZxDE9P6u7K-WztsY>fmKM(X5Vrk)O)M^{ne74EPL6y<EvlLb?g^a
zgE#=ZF5Llyp-Di4pAj@8P%f&FdO&r{HnvYIRemp{x~-I?N!!qwdW!XhFIzzHX@s*!
zBl`a4%g_XO2=X->lJvHQVTRA5Q@mWRVqt!08PoTfPzquWI6+L)1#Y$TYzw_L_9z!B
zxMi=-J}L~7xsl<|X}~#9-lfy%Hjm~Fq$T#y(d!3nBEj>aqMmIpGy|>$=r@-t6X3MQ
z2lR)Ia}j$*@tVfA?<8U^Ti-Oxh4r8rWtXCn`5%SlA6y(#Veog}{Ziq^CUVlP%NsKO
zNa_(+dDH**cYD9NtPlMK4L-NcBZnJ{jv0^DEZkB6k=Ls4B;&JXF8b0}Dk@Dt>Rx3e
zy;r5mtESMtEJB)W11b5yp5>Dr7h%qfC|-~Gg-Qhs3U#oW?j6100R>-X{<?<r)QBM%
zg9Z?3RaBAf25uuB$ex!mY~jIVeUJguN*q;&FSiJa4bXf0H)n<KPHN)O;*P{F(Cm?q
z>pwvn4edzS^-KXvZ~f0&2Ja*!3Pv^0qlSl9XfVQK$p5Mks%qEIYk$`@sc2TfHtpVP
z{Q!xjU=$5JpVCZ<R_85%O)n2Mg-)j)M+wTpbqCm<*gx-<lIMl(wyAHKyWx*{YJY5r
zuE~dnM4LrmKqzw90<k6*n*|y76g}^w9U%`8ESwjyo~=;=(K~g6o8zdnQZ{LQT7{yv
zvxP~E3URe&5$}|NM44cSH64_i@jD&)y22+v!1}oJ(bCDE*s5?B$x?V{54mM9gsc_J
z8L-EW4qxiH)jIPCCp>$Gz!@4Cm3Ub9)`|}(WrG<;H?|OQ$WjuX(<WRmXLKCYCcA|n
z_L`jbMM*&lxWS=`6P%${Y8g{6Cz62%DbXS^ApA;VeQwREbPeNqlHGwl3iqE5XJDjA
zvc7)hpNx~Yzpn><qgq+}_<LZgFuyqJ8?-zjR(kH!o26X-=iy<Seoq?VL@;)&7*Ltg
z>{la1UH9AcQ~vk~^<W8Xn`F*JO3wE6eqzk9+V6v6J?-XeF3MGV47*0GpIo*ya_eD;
z(W{?8u8;A!`<2rV9>SM@yS-m`Y|_d+qnxK;I~Uw?%``YunVU}>J*sHU7EX3MrS^nt
zl2lNoG6J-ao>jWF`my~$YS(q*QUWLo-l<M?V1~Up?wQWiB|ye)tp4aPv8@K2vT(0@
zG^K8*F+wAIbZ~jK&(u8@yjrz=DDg=&<lkOlQoZ}1q2&cJIH`N3HOvGmd_OZ~*<+W9
z3e<HCeIFFpWNk;<uHvC*3iSS06UQjD$@o`f<b<lqkW~XKDchJyjKH@fpriXrqVYNP
z6fqA`MO?$qYQo#RKmL!ltntp!)$)13=zzpC&wI4Pd>;rJk5JCS5^=TXP2=tB8a2*r
zx75a-Q&>4EPV+2ILE8C-{r~1>etkKj+yd?N6G%e*`BaKqKeW`qHs#tyJ`uPLN-1s*
zb{#T&-zRha6jl+IsRVD%X!sCxa?Bd>O?$5E+o!jGg?yxfzYr~jPU{}cZjTkIz&o$U
z>IH-5Lc7S*Ak06^yQnzNW9;=P8e+14zgEkqx15(T7v1m*Z-pBJYmz*pGsx!u77R3=
zGk&>rdydEuoPB6adM!oPHZ(B!^77D0%*EqxzD+bfAE%7LxmK#gK1zf^{zwC`WV(nB
z_=wT!t*4JT&#Wq0*{O@8FjKCZluOqVWBA4X{<5frTP;pd3cm6)dMC_7MS!mnb~>!K
z-v*X7`%>s`G_y6_t>Ciw>dJSb@DQ4lA7HHov$d_dT&+!Lm!lQMdceC-zMs5h(WYaW
ze2<CJz4g|GmZ`~YVED-_t@gN+Il}vgjM5<Ovslz+tiRGfxX?`#_FdV;jphgOQ9Xas
z<arj5@Gx6Jmo0cKvgUxX^*tbY4VnVkaZVYOltE_Jd(`&#S_Utp94ByQiP0kfH|wq^
z5lD`xr%v`85(jlDr*8ymA*1lZES{}MdwsX2f*&pj34F^kygum{+K6IQZf2J7aFmz+
z{O97gaJt}~z+pq_t-ZrZkU@QKE<0}Vb)ZN}Ne7we-|GUs`r9~ez&M>^BZ3rYr`*Es
zv#ibXHrI$8H~;lOSNUv2sUCVINuf&~pfkpn?i<e~#*~1f{7J8w_d3$1r&AV#yb-Bt
z@JZjiZ77Fd_4ZwEZL#h1i1rwNQ*PT+GeWCZe|xNUc)<2ZIy2=z7KuHaZ;$Ybl?F;{
z&T)e|mjnLa$oIz59%X6O187E`@<7VVy5%DCwSPozpTi>}$`%tu#^_!vU&7jSGqDa&
zH1XO(Nf=!@o2B>`FCm&pUi`pi5(1qb%gUD9dizuQTqWX2o_F=%`0^Jq0o1<ibmebN
zkJLY3bNDzx<SZ8*1tt+<7)mv;39Rk|y}I9v!~2{40ch;}Pp8==1Z)hvWs!^iTjoa1
zeE^P{fAkrjkr~C{+N`v<Lg*J`32I>1`ZDS-GCA1YF|GEm4tl|m6b0c+lHsdQI7-AB
z%Y4@{Lg@XS=Y*f<RnMnWy#gzzzpP%{nW78lPw;%0Jx>diKZEp5OGU(CLFpV^N0I*%
z&e`WqoQ_f38$r(OdD`KR7ZlA}eg*Z}_LYIwQM^P&t$GLbR6;2e&<^y={tr3_;D9Qy
z*$Hi@I2KQd@QeVle}*qkTDIQjOdO_7Ak~C^tn0IZKJyo;k34c~OSWfiKb<oq9^*~g
zj(uhxzBro0oRpQ(E0fv%9>p-m4@4vc?`Y<!=#9&*@i%65gd<t^UYMddtKVZY#|<PY
zu~+&B%-(bHC%qKM5tF;46)k4A6Artv@v!;}yMF%n{$9k_=F{Wt?~VEI?5s-(Jz)DL
z*n;f|NmWE7&XDlRWON)-&&BX=Mr8Hkb#_8c%8CU4%XH1&edY_O-38wLyoRrkOu~Eq
z?+G#wg2N02Ht<a8BP%O^ddmbO5r+w&;g!A^!ei~2usK*!*v74r|Dlwuh~>aJ3=c9m
zFpwu4_=MM^@nh0xWrsiiu{Dip+&XuRCpUl^be5(2EZ1YR^Gft%+NlZt;YJybh^Vkl
zm~<m|%kdJvmelSevmtC!ri9;3I5>h7_l1heiSI*5<XaL~?_XtnjQwFYg?A2eFA|<f
zqjJywN6;vi&@FAk?HI8r;Jp;t@MYA}d&i#1Y~=qYZ6<<onrAZvd8TwwTLY~FZ6#Pi
zrPd@j(D(Fc`W*?&e-QQxfeDREQRL%k!Pz{F<5JKoa6T-<ak$jPYIJYE(C2hU!4j<N
zXgkF;B3b9igM&OaRvJQvyBr`TFd8R=nMNj#^~K+*`OvJF;_unbcy$BWJ=&J61$O;s
z0)ssMnYW)F93~~n{G+%CO_#CreT`l`ULeOSBz@(iVfQ`f4`D$kyWY>6MtTS{`kDco
zf~7}xh9}>oBr>ugyk*`dc}I+0l=Dvj$a=C8u4RS(-zN7fw~22#QS#{4PNVW)zMHOn
z_Y3e!1Knwd?;csqFE%3a51_&drI-2b`R{7RE^!QUiHJaN$i*}T1y53M*G~^#N{t_D
z9%Aqg9@Cb4jSvDBVoK)IuR_Pp%}d(jPSr;(S$qNWUn0)9z{H;6D2l`qN?z=h=AF%m
zI+jVu=;?Y-II7~D4g??cGg*K7!G09z4Y%YK)$8F`jjBsB();=l8^)1G$E@62&x6ol
z9#j@tC;Um*SPnyGdUb8-tIM%&0<k@*^r9-gcED?Y@b&S@HDBCtbU=nNP?_~cO!=){
z#(sUV^%8AgnIG4VQ9S>$fMpXG>qsAD^9Y0CdUgf#F-Mz*wpBJ?<qmanna|Ttk(_wI
zGYe`<5B3KyYR=X+BGE~W*P9W9k(>GpT(QbEqJ5;n8~GeGi7llch?)+xCCC_#Ll%ik
zqa@SY8&xJ_1(KANN1E=?OtL(o&w%{*<lgg<B9W(!uV5oUu(#8R@1LzuQ5+8`aA_LC
zIK}$ec0v44C_WAi*x-8cURunxnZ8!r_8X}cFXjXgsj{$HMA>cfp{v(?K=3uH!GBkr
zLIo3xFjTKuL6VdY$p@(%U2M5lkpw&pjI?x+DRsiI9yql%ycy{-)-Ayo22;aszmw8!
zx0jpyA&*-_AAr!^;;4D*oB9KqY2X1-l<&#!#P&3u+k8=Gn)@N=XDgxzH~Uz0D?O^d
zl;zR$@{rG{10Mcwdgj$=Gpj^&B2~yg->+nrRWVxQwt;7-+EA3WH@c{4ve}qYG5IG6
zT<TMZS}_A4J2ImO&`)f1DQgPqt{hhb>768_JaJs~r|t9`RLV=(R|Y=s4`_6@7T3)6
z=CJrLF-%V@t1jd5Dv{d?8Hd!z4P;bCGk7eDYQo1FZ;bw#@7%nT=x1k%b_jgd1BA2*
zJYt*3Pr9gw@l_>jL#;b<rU7Qbk{u-%s(mOaQi3OEQ9y{o@L!Gj`s+-=(j2rrbb+nc
zu%$g5OTF7By%|S~^h8uat2Xo-e{PhNRYEZyHKr99W2XrK$%jBR_`SRcpvXQl76s-R
zfAAGHj}~yAG9O4Vcin0p)awFx8iB{OErOO@XjZ}E`_-%51z-PMdyz!-S>j1`6U;-&
zW!s&qZoaTG-5_Z$h#zH2b#4$Lw4M~6jkvqjjaBEfSCA4yVed26+bhzr8)0VwakO%q
zDU3tQFYm@3w$H<d>rW0@Xy0~Iq4SIM0r^mS>vf3xeFgO<b;2dkr2{p>+9?HmBK~ll
z6545)>0VIg+bSpCqooo6B;cYM6a+my7rxU=I5q70E>s9!{)fXG#hO0hGMH-7_fqHW
zJXhWROMhJci!=R9@0nzPz)x~LJ^v>L9aDlU;hL>%(%*`wXv0vam*9X;hxS2dPF*Qh
zrfbG_DJJsmvg9J}czF0bB|<jqrQ+X|TBa5%B+4~t<*8Pz;AwxG15ZObxE7K3T-on&
zFS0wWjSNJMYYjrnTj<QSJ??NMD=ROfU&Kr>sdVl`lVUS;>SL`Nq32ga&x6fD>>#B(
z>=egri3L#O51Lz<;hUsilzhqJl066*X6qmbpMlAmzRJ49$4+E}6&wG2q?-)f>d8%V
z=rv5dW9?H``0Q%=x$4R4es)B?4LefdJqZxLVD8<zgU$xpbyA2$a$Y`o8)&&+IsoRx
zthvof|Je=I&A}3okR4}-n^R4l+=OpG^-A)<5TdjgQT?K#F!`bv*bj`a%hI9KBMvhT
zWz$Gi{>N{pSBM~*A=tW2)MMR;T*tu-y!Mx&-SU-tAGw}s#JXbmj-i)_WP&q|#E?JE
zK$h3tFNzWRyL3JiS*=x~2^}l-*w;!8jS+FMVkn-{q!P~LuTg`Pp?Tj;jhcufNA!?T
zD(AJJ(%+M{Rgkl*%fqOfRY+#Gf#%jpzrHLM^R?^8xMDm+qrMu%f>@t!`4p@Hg_b^I
zdbJ?3=VC__&s6z<I06gj`H>fFRuJ&y_4>W?+F2idwdWqT3uvqm*<Uk{#<Tb$3BUSV
zqJYDo&}S`@cOQowWQ{$wI_5*s%m@uXr+^O)`Mbw0J=C`B(iGS2NPW!i-dg9wW9+|A
zX-;ShtH+M(?|}GgM}Nz9g<C8K-WkLT9Y)k|`$bSo0-_HJKY9B4wI6*TUZR*Jt+=KX
zxG~>4Rvcbpd}`qpiqYAWUlwibi$d%B(F1R_4&v8x6aWOoJ6f#Dxail^D|JFX&@a(U
z@J`k$yGObb%62Sz6Pg1k4^X3R*Qr=0!;NussB7#?TAL+5{yB^u-$Sh1Y#8)Y737ll
zoe#ydzH(y+dF^0zK}{8ydy_Gpfsowk8_UXf@p1(0i3PX}IBewJ5l`$Eiotb5jsYVy
zY-!m4rlSbjVOo)_aFvCfm~y<bMec${QcR&&1cgMAVX28(fl7!GT&m<BWxOPJu|JnF
z7#(mb!K>!oYFage>~V}1?Vx$dbL5jR7;uWWTb!Ae38YJo4Y_=2g2z-W4{J=5aLKE*
zn7gCXd{44#i%dYQ?>a4RSXE8>6YY5N8}$o0!jvB!0;rqJA3F|6b-~@=GB3a1@jMMC
ztPa6-{f2#6h&bBf3mca<X`B`KCs^uI4v^W)SNad;CTmD-`fzYy!0Kv-ci37o7QFii
zYZ~K(dpNsUN|Qk*j+|Lgjk~Y@%N9E}rMq<@;Hv-`-rPJ!ga}LsE%ttA&uIDWyW11d
z6DB^`wHXJP{+B0v9U}hHhY2qTmat*o)puEa^T{VGC7aV?GL2sITi^tJL6H$SAmXR)
z?CMc;j0%qEJ`wqzdDr8hdZWg>#<la?-lA*33C%38O4CMgyrcQLEU8siA1ZH?1|mkF
z^9ERR+8*MpqB{Io?mgk&5f&n}Oqfo=ImiAsU{0FH%FDJxrU~~v2H&$XzcERoy#DWT
z$JHsn{Et&l>keqGt#vP7W(P1-XXp*vj}raA;Vp`g;gGlaaD4~qAKw3e@Rq0tfu02%
zP9Pxy#?DphHGZO}Q%5ZJM}z(AVMwne(CHeIU3&fL6L3F>B>`=xGdjAnbw=z7OkE?s
z*b5bb1<PVYrMtp8(GpLO@g1xQ<jYLff5&L0oT4sR<0TI2xL-aPj0$)C87|VOM;ZSm
zP59925Kzc=XSP~)gzb?WjZAD-bF$J}V0Xz+RtZ7eAzi*1+0^u4qQ`_;o~)n=PWtRF
zFQ8t_y;*VWN1qNz&EdP8gKpL>&Ub|_2a8$3@=9noVZ9SLeY^@^bl^wm{wg7a<AI|N
zi&AWev7o&92ivU5zq4DD{0&waV!{l-yJWE8NwRS9KVz$e6iu%WXqy-gma44R(l&tH
zGX#e5ze&0oru#Sem5et*5Y3E<A5KMvRc*5_x(tiUJ_z4R>Dr#*-nd`v@@X7ub5JDM
zV|9Z=ipyoFxaw+hCl!eOVuV|jEGCbtM4j!%pCK8K*WZ-NXFbxSsTy9bNe&UUo>Mer
zT@<^nKfQh~<q2YC;J5wS;y=YO;eYtbACv)ZTn~j1f6vEsF!1Jv3SPogCRAU{b-2J`
zi+_H)t$rYoYwB{&F<$&DkL~pz8yW&i!|E4S|9KeXcAgI*%J9(4!n#ltgpxHu0G`G8
zDvr@no}4H>$MtF=poq#1qaQzb!XkD%SYYexdAn$<AQA*ZgpE)Lb91X@bTyKoHwDjf
zawsO4fTrX>cP_robpRbpI<+EkVNsWd&5o2JHGefuA(m^!8FAL`EL>&Wg5$<c^W4iW
zo{chh7)|l8J1x#%=`HxGxLOf@U**5y_TJ=J@L1ujM8ZXjJIZGMsXRn{into+H-K#D
z%ivHD$eU?U8Q`gSskXpV8Bg3V*($X?T&YN~Nm;D>N-v1QM?GJ0a=}o9t_Tug^~m)<
zZe%WVcl|g^>p;JB%)c_^=t%^j`dtD;Pw+q{vVG>in-K9DnPE1SFqNk`v5T0EH=h=q
zeussoY8v?=<eSSFn-2ALQt25mm09<ckkP%7to^OeoE6nRhH)P28mlmCZ9{4E$z#`U
zx=je5-`f>|OW0r;psXdJ(o+J;^v^x}jvjwXJP|dS0u}i>m40;WnBi`o5&bJ+Uy+mN
zT=V@q>;eY7y_#lj?m`vo!Ndjslh&{i9+KAh*8s<7o;1Ls){^<J^_fMtSL;)cpHr0<
zRBV&}7(s{geX&$(FlRSfrjb9C5r?@op3P@UBv#*8x|kZq0y2ME1vQKCP+7U6B)ATW
zt@5bt*$<>H7qJxC2@ZM%p>A4Te*N%cxAV~ay%mN9njKyTMX&8h07xEPZ&Usrj73H+
zkXwF6=R|>dgyk%z$Q?l}7*@D?Sy3na1N>k^q~uYUx^TlAZ%OUM1kZwhPo51t)+&5V
z8owFQEwtIe#;{T?*1(%j*WIEtD;*gKp3K>&KUOD-nGt2_R~Gnw&@cCkAOE2dR6N7R
zC~<v6JMjF9jn=RC>C&>ad%4F|@Q11M9;-jk3B7guD4ca>WUFJ+`<PU8ZP+a(pFhoo
ztbIVCBY`PDso3bkh7!pUw{B1V34v)JabEpXe4jGC$N1WIK(}*#_Le5*S!TyeH9?j^
zQNeMF3#jY?{sFQ1d0W4kyXnNQg7=xNEQng)v^rj~^7VSQ^sw>jZev<GX)TJ+Mgp(#
zXMoLltTlNy=OZEl5|v~PdzPkNM5VY5D9^i_Ump!P7?FFh6fC&)kuQMv{Lxh3^Upl)
zdR~(TFCYIumfT5_4hf8cW+k=eNOckx`(Peyk9`S+cP&Gs(AmzI!X%EcD#2@bCk_Vw
ziUY&n|EZ8zP?q5BR2046KTftaK<%&1z0v&W;ZdDsR`H{jQTp!5iSKD!j~kXbSv`$i
ziYs)}Zp3i+Hy8FjuyAB{?Pt;*u6?$O3%_SHh|-$P<JKf&ro;d5jwAA;xpdFharvm4
z#k<-A*%q@XFaz^iJm>COVoU+*QeclBTjJC}@BgOH9L@(N7_%#J_CI2gS_N-UCQPOR
z*L4msAip6f@aEmWkc_EPS>RT66gv^?e_%@)g|cBILHB`21CD}v1RE@#{*gs>EUr^u
zZQqLp$XV_@nFw5=+q&2#Q6|0gIqxqDEX5lO(gbA|P^+U}p8GUq(Hby@!vF6E*KZdY
z5Zm-XJ6(<{4{xqfw!xE1sDpo(7H%ewQZ9!b?+9{6vqi23{KA4UvsEq0rUf@{PM5PD
z1)Nma^71lUqwp9V$+Ap2iR+?E6%OPm=b1BSbct<Zc%Li3uHtnDwTLY;Pk#>d$+63U
zNB1Ft>$pDX$P%)Eb#OOrJAVZcl3jMS8yjhm^~(+Y^peai${0z2Y<F~Lf>@W7i60`O
zd{NS4&uGK3YGbpGT9Wsu47m7i-dR0>a8;9l3C@;P2iy<yBSVN-yH`siC_ROw2DLy0
z2&p1xLhm*I@Ti?hX$_K8y5yI7a~Dhg-d&YrP20qmboGt>+Gk7K*8|@x#|oVL?RDE3
z*x0<+I7Ja<Ho&GoTRj>5D<(`=#DR*_sAe;-Ok)sGQm~ev?EWE4Kgsp{9C$}1d-^dX
zj>cb-r`GpFw*7VhUT^O_0!b7gXay7h&jg!CqQh(-L^;tLt{o``APIEs70<$qm8By0
zKVlb>L=42r6n5>Ch82#oBZ~e2Ri}w12%76rEJE#*rd-%DWG$!cgvfi%#nu(;ft!x-
zyNvzuwU_3$6l+=nuK8t5Opn?C!mEbXX*Kfr%>$0Rn%g6`?d5WhS;7MRoV27>;ikfC
z=^rbBN>~*lv04B*Hq5T>5>VB?x=nR#!I(%XQuqi*c>ef~pv19&@=5%trGfdoqR2w$
zJ4mkOy>O3OAxgqv@4<y~dD;J0x|}JHGxg2)gX;6Kxhxi|<Cbmya+PoA@rS5ZLoM=r
zpSig|vEF(Kyq!Cv^L2N(uRukjM%S3ZQ~e$U&t+sAxGB0n>~6Vd1-Zyu&>j8qVSA4K
zvmvWu^PLuVh}DbSm_Mle`wYtq<3-iFrpN5%lv;<=%UoiiK=|EmK1cV0Joz@u6wjNs
z^uTbtumkb+8B+4BA^=JgwDhv5y;1+!PiOkZ%c`DL2DwyOQ>o@2K~*9Dbhyx)!ESI5
zX`7JHHK>@s`%_+2%?Y->@ezu;o`leN3`f8!smr?jkkW4{xR&H!zRoS_5L&B&GTmhA
zT#iEQmV!b;v(an#&avl>o6>}tegq&r+`bl}ehR%<$ze7=)h*exo39+xec|}W?ADmi
zw%P34R}qqdapiRh2yI*xWOKQfQepDKPTC}U;8@z_yhy2da$;KRLvvp%Z0Yv@3B>im
zPh>ng2h&28#b|*}sQ7SSC1kOG2I>Pc>Ci`%3-z4{X8IE^fnM-Xby)8wY@XL(<V2|R
zr!8<$3|fzSh1@b;0Gv;3`A>G?KTj{SZ6Kn>>w<2X&LIpBFCZ7g%LZDLGIx3b42h)I
zXtCLG=jz?;BnM~>P&_qy`_Fx=(?iWy{p6+ds9t7%TehHwb6bu~wUi?)^-w<$=`B^?
zQ|BNO9Z_>{G;`>k1LPZOUDP|NH~1SssY+FeR5}|-qjD(MqhfrE%;wRaw`UozC~+;0
z6oPkK`Y&8ns>4|cx95xiLDjOJZ0v$B+}Qtm*DX;hr`*=xZO2e^K`oniGqfA;T@}33
zx@P>-A)Yc56w*utLGN+hJ*e4$jw-0QjB;pr<OA_fPogm>PGCX`F7hYogO>bd+vB=+
zUW%N}O~0_ZuW?}N-FgVV79#fCBYlU3Z7mLw=Qr*J5zcMbh-D%~riqL9DkzSG#wE-Y
z8@D!X!$DKNb!@GJDaeG-e|k%>^p9&lIHM&E8QPd|?K=;@gG`6a@gJ+OcCC=1_jc3t
z<I6fK=I2N>ywGGc-Tvl8>jxMUl#C4u7Iq{05B>NTg}QsxS4bP~8%7~fvhtgw7-N!O
zT8(6U7dI~fCc~m6qxjzvsl$JaC_Vi1km@cts&HJaTvPYaywLaIFI(bkTE0^_(>4`q
zvRT~2$H+}XTCwN4V{h~I`&T`vAG)duPt?_k?I6QmoVR4$YX*!P>I|RL8nl&J%C6ui
zPUdvv&P5^-(a$2ae9YfI5S{w7W{_q*VUR_0*Qko7fZp#S@QYQ#!{6_t*D7BKh`Lx=
za(dD|G2hl4+sH(UysJ7VDijl8i?%>pF(su$=0t&T+xW;wd%qR5tK~eDX`E?XKn!Ww
z`6h3#&)s1=oROH<-=+%$<>$NVg~TVfcJvr-T4yMCmNKPXi2HQn5mOXJ0#xsNr7c4Z
zLGf3c$fIG#j}G@g8+dA0{RT10+=qu|1&K#U85ngw!G8xfNut{<GByDGlKz~Wi17~b
zX;AC+{}Hr9t&fZOy@A^PM#FblYdqH2?Ic^v+LN>7kg&P&KuA8v-F|v%tCmM9>cf?v
z`+cB{`vwO5D^s^atLiJ&fM~V;AO~>os136E{(CiKk$D={%s^&|Xaq!Dl;dz-rN7hM
zX0B-VRvdIG1!-H#_bApMp4#=q9)ai9x9*fDN80DM9A9S2=oRA<CAFxvectkq&2GVp
zpyP2t#tK~iljFWy@as~kV~LQ;$t#xlBKm9uvW_WPUTKUxfoN`lks244BYPgpWnmXb
zURBpA!)k2pxk2Z%M;-fyyAi=a>J13Dt}DikKr&{Ti?R%v@_mHtIBJi0v_EB)LS`uS
z##f;8J?kL(QWWw0uz}&e8DlgX8Wsf@4UzD^i2N{mh(_{Bpd3K^m!PlHj$@mGu58lM
za6#t~GZC;0$tsVOcY1J{vi<9{3_QB((Ft3n)4(TQjg1L;h3?N&%Y!atzc+?iLIgg%
zUv_F=f$+5j?Lev)cWwWvVmG&w@&V|OnOah*WsI{?4TLSga@AG%x!s1J;<a{nviNJh
z3g@y+_#_-no<Ig91g-kmCiuF2(9s&`xong@>~j5lU8q9B!0@re=aHrgaS;+kA9QL*
zron!klsX3IHK`;cqf-aSu95X697}b&${s^+p-9OuLE{S!Ie)<NS`ov&=Ww>UL&_L-
zb1uA&M@V%AzXw(rKmPs1MBS(2rrxCOo~d){jZyTM3`<078oP$_FRpE0etFREIlYMM
zYZJ-6pezquPK$3bCoUvd5KDft&XXWfP&i*lRKv3XIz#MGjx@ZB4X?F*(TE_csWQn0
zn_+E<_0R(f-j09ou;gP=<gJx$;f*^t_C-3mUHl_Y_ct>n7Q2k@U8?P7)j3daVgeO9
z={%dFQ6Cj4fCRYD3E(Gx-cqeLQY6-bh#><zl11)XnUs4yq1;Q-HS>?CjL4F}9XNQ*
zZo;he<Ws?U>Pb0qt6L5XU&i^yUy;ADdC-Z;+x=c;4L69FM9*uY)5lEqe9_hzb(l2J
zvV4M~U#UIciBzZrkK9+PMEzciy418n=wr$N-+b8J<rK&c?&_3~;O`UHQ+Y#EI{upF
z^2wAGv#$sww1IXvjL=yxo;+pR#}&wlO2ch0xem_9_zHZPxSvT#<ZGNZ!0M18?6zph
zjaLn%MB$pFJdM+VWQX}EXxEy+^sy;cE~{^z6nwmG;DBp1#)Y56l|`fP>{H*0HoF1{
zJ{yVQ!fFY2z#6dBihXaDH$m-I5oGgj+==UjZh@76#ZhkbRd&Gpk&=^|oHE4fg4fr3
zw5OzyYHDvv0e<~#;#V8vV`TcGBq1r*+G1uVRvn*zU`zIXW`K3W2NSD(SPYyc7-PDn
zfiJ$#L7jn!_6nLPtp}DK7>z_>!&FH{4h)sXB=PN)r^<YqB%?*pK#l9bftCe?%oT5`
zMD%-+HR6@PyLE++p^#bGdd8TPFI4)JKQEyl@|X7~hQ(aZn^O?aKoZT9yTYOY61#E=
zyRBbdDGKrtkx(bm3oZLPYy^*5XYbKz-}|v*#lc><@7x7?!t~eZH$2aERashte)fr^
zKjF&V14<Dhz+wT6XLG$-eEoU414LfEWeW7VFb?cUb|hN4{fvGcdb5;xcmn?Y|8m9!
z?*>YPzzua~*{s4;@U6gOor+Ratp0Afd^v*+T_`1@^Tu{%7;0K*Ds~o#i~nzqJMrS`
zh9O;c>DzE{ZYKW9Y>!11p6YtiPQ2Bkl8_v@i80L|@ljoUTMtZ_yGB3q*#zVWRn1fT
z9h{95&*MK|5j_KlhgGcErf3(KSEml>rnL9er^_tS>(1YgAP!zN#})E<QqeZjIp9EO
zhLruotx7ceo(_4l?;H-UoBd^Vth;O>siSBlSvZb6j44Ts=0#g!pPc@m0htYlu15N1
zQ&a)OqPXq&Ny#!rw<uC^_?N{`E1cZd@BIfRjJK6elgbyu{WtepO1(}JSpwmF?&2-U
zAK9L%-=sl@w<c~|(=M_?u}FG`VtGNa+6m8;LF9xl-08`gj>amMu`j$UfrxNQ@oup}
z)+4IKMkHVU)iL8BSsop-x~m9k@twp>94%NcJ-t^SFAH)tn|gQw!m1*Wl|&f-)!7JF
z{k;4Vd&j9QnS%4}cWZ_%683q*3Ui@Ukx3bpaWspj#3W%mloO<-MBMK^h(zU`aIOqR
z!i2tIR0%ZxDb^?Wj1V(oERwm7n?PIs4>Uz6-$n4r_E}(Yhgu{=QQ%@+0N`RA593dE
zLpWPkhq`m&NUfXVscctAa8s{WQOIxA5<~b8rQ9mN;LpN6o5R%4ii4gX><)5u>wYhP
zd;Tu&#MipZ<oOA`CDmTgOw#J}8}qqx{>Af14$Yt{EO(-NrIRI}_7yern-T>-Y-4&H
ztH$<k`C0??OYst#W!%IdY2GhPz${y~UP0kgrYR4>YlTY@Asr#J<b#|JYP)nVq#Ch)
z*9pZEpqZFlenX3OhIs;<Oet{SK~=zS58|*UR{BmR1z$mjA#fX~zx2#g@D%sWIMmP2
zT(H+EiM+9G_NhPg)>pxuPRu?R^OOPmt(pi-F5Whelbwr5!rOU;4|<2g=aFEE!Z@&a
z*7%$=yKQ?3Xo{<P8(-W3kgBvxoKkjZ4~hAOG+1eRGcx4($KzeANcwTc^^ego!OWp@
z9Z-<{WB+65FqvDsudT-C&hBq<He*#95g2OtIga1Ru7m_9y1jjt@WdJpyR+Anq||N5
zx3CdFFmH7JLBW4!)O&Kq=goX6a~koN_syC@Mz_1iIH+8;A}5G<KbsT_b1$g+*g|)P
zME2iuj-VhHkXG}o6Eio(HHK+URGX8FY>(?Z%X!wI(Bq>FGOyVYd`MifOUNkIR9FKR
z2E^?)?-DGZi}nn3YKw#r#{->aLV9*TDMZXRx>Drub)(|&sBuzYsv4oJ_f{F%7gOu;
z8}+ec__E~A7ly$v{V$%<JoD9wPZikw2>mVVjXEOxD^NSa3`09zP%9`yRS`55C)|Q9
zFDHKWRUVtwR&7yiE1s*^gQJ)ONd=`@%igs2jLA)D)ZIe%iUIHa>L&x4rY_E~<o6sE
z&6|PX+deH~OXLK}ER+m^f0_MSb{gb~bC)5|&43k`=)ddM-^%MF{_``7DA{@C3fX+<
z%4XBVXKj(X#4|Z-Rk|F5@w+6oK>S^8UN2s6Qm$^LDOH8Z-Yszf-(oUuNa-yhRk+!1
zm}PvMOi>dUoscH~F_Rc6x_q2@Epcxq4?{f_o-20G*NHWDqWU(*UG>zvb))9UIFj0O
zwwDH@^&sBX@h!ENJI_B-NUiFc!ZX$QK0_wPpNgtJ!n$t|2lxC6>yadcP}9UNsm~LH
zJSVz{UH8(wp2|5_b{M@|gC8C@NJe`LtS$a{wk`^T1u;^Y0WiVW*O`)BQfaCAlLxge
zLwVl{Lsd;-e|tm4d2?%c#kaG8MsESy>4NmE<Biico3)p8pFWXHB*2w@#^7P(EWvV9
zfQ8M=vb(I6XE>$8FVlan7x0#3#jxW$LyHHF{8ta`pLXDQ_Z32Xt+E~Qetr#Zjq9Yb
z>WdU0|BO%Mi?a0f6Ax|~?$J#l+e{%$vDk7eUZk|d3=fmB(d729bfD>~oUok3HEnk*
zZ)K2HQ66Zu{bqJ&yV`|S12)D8UlW(r#WD3?Z;DffM_1bq&FgR}4*Vx3%#NC#rO!<w
zRq{JO_XN2!Xo`^uzpI23u?Mhkd`ob%&Q{6eVqlBq&E<@Cf-jak3Xj85+mF*r;Z~+Q
zIkMe3$6OLm(QLe@Y#Y)KN3xo2Xlj|2%+IMhmZTLDH^%Ndi?8jiLC9-Gug=~6_3l~L
zT`SNBKn4uNL#h+q{5P;o>khb&ftmoS6pi&*wNCBcEQr@Tbutg6nm!CCI;mC8C<7O4
z1}3o@j+cJ&nsQdv!KF)X@57<cPZio*!ub+E?uAuIu;5V+8ym{%3VfP=ob7SGOn5Kn
z>hUXHsC4|m@^Ae@*P1rdX-no;nkkZ`c$QxcAul2M3%I|U_B0wfoX16_i7#9#4=uw}
z@4L=x8F{rt?&ArriR`*6`~rjRUp|seZfL`a1tyniehI5>O^E}+!xk6Yuc>hwai3&J
zhFA!((0Ky(U5OFU=y}d+Wd{Tc8Rw0AZ0=bTMaO!CJtG}%4r^!g>&&$PT=h{oWPgw%
z`n%!;(CLU*pmLAG9u}JkPC>%G(u@4qGeICT16>Amn}VQuZq-~gIHoB<(!b@#S-k_9
zu_0tr<b{(fH!p`=y+6<ONR#s#eAVv3;vbHvGcK^Rq@-AWL_V|?Eq<S+5sbVWO|e$b
zg2R4Vrp%En;Z9_0bD^~HB0ULKbB<%ux7sa6s@7R{sx(<DDa${*VP{fysmHcOaZN<#
z<aZ+ed5r*LiY9O^_{lDCn=*z5Tob}}PB#IULh8K{%5>?>CHg1t^sjB9#05^}{JPQ<
z>$y@vyuh!G)3>4450`p^LN%#HV_d6iGn&h>5M>VZvjvqn^?FG88gr-NX4BK%P(NK2
zdRGa9W^+wt>PHG;rm{r_tdzvKoF&~jHCFE&$^`G3Nd`!y8CKdbAXmx^9jwd&BO)v`
zIE!6^Zp(Bwao=9mp!D$verx!1Kd?~lB7Oj9SnfCOeC+P0FsV2@R5+$TufAP1u(-#z
z%<5L@@aNV)A9=csY~&puNqUMZUP-~0)rwTDFk?!-lBJQfq~iOU+HafOIFiF4Op6$e
zDIhO9?>=zC`C9Hwillr3RDJRTvN@O~O~lM?O(%Y%-Ii#jRFA1IrC!;C$d>UL(uy)!
z4?InbC|f8yb7c|kn91t$cgNZ5+Bu(buP6xOW{I&U`qW*<c%Hyyb<PN2L5@<Oh5fy=
z);eB~Geb$Lb)~4=$FFz85nv?$d__Ag?4?KTCwb=kC|cyMAL4|H{fzx(a59xEH*A0x
zgOdenvt#V-&%t+f>V=nX-~EIx$QU80H%h(*yzxys<UrWmje=kJ&#CMO(uNJz$X;gg
z=F<jR7ZoaDI~pr%a00zyh9<Kkuc=Ayve&@S<!<RWs;}vD<9SGD`^35TowtgkqbdV*
z2d0sWM%m-`_`_uWWg|UpQandWJ5;Ld%^MnMeW;lb(OLM8m$_5i7<u%59;7&`8-v0P
z0*k7PhsqJ9wvz&Qeo~oB>=owIQ?9?1URlx?1D$4>{f}`lhd)-_#xZ_?;lLq)vJPma
ze>|~~2Wu_k_SRttHJL$}*on44c&+m?EBFJ6Bf0PMwNHEDFL#`(4b@mq`f(6<i<2&w
zlRuHsyJhFDF{Y_<b<hECxJget%W9SXy6ZNLt3S1XbQIvhawco!3dDYxq&EQJb#=+h
zfZW{Q`)wRusl@xh5#xJB4g)XS=q!pK>$h}pX!GkuYCF%Kk6HO$w)2E(2p0K6P*#z>
z&<EgMwx&j((tR?<Vz*gGlD!X!oFH`pt{|6QtMeb|0KI0A_b_X->YwK!UOlhd3ApLj
z6_z;p-9S!E5X&BTxaHz|AJLX`q9vdVR+9nK+ie4^7w9zAE3M*-b^t^$3Ux7_z<ZpF
zlyA3gqj&@|Ruv;xvl1*I24y_$LP%J>V5TpPZ{Zz4F-Y!nqQZn^5!tviz!jH}F+_}S
z=F8FXi|lN5SAF%^{pMZ`0vR#oBO7;W%&o_b1iR6QCiJXWq^8D{+wJv9Gfu{$Y0={H
z@UG}S?%k(`<K<ef2Djd%;HXL_E{vsKwP-vnjL><vtc8?W#Ep*$q{NG7D=pV)Ch^WI
z1r9mC+}RfdUbt2(l<PPFA#s^aVi{Vx@HR|5OWY7e;{A^%e0$u<`4Yd59@o>*3B5dB
z0I17k!BNVw5pgy&VJ6iIQ7wC2-G^}oon1J$se5b2y6tps+@eG9#FM&i+vZ34?|+k8
z_M7B^FTuj%^i-@6+w=Ijr~Xb3pIdKSM^Y!6n}=>%i7QTGS!c47r5hcg^Uo7@K!aqT
zlWl3Bar?n>h~6C7+9;X@i<5}UIr|+ii|E|CkY12!nG18i@J(!dr;PnNt4fFSWpI@1
z<1K|uQ6iY`xo!Y`Ih55aKDVaH8gNXfi1;a=2oCbZ6|p5B+gVG0G_FY)!`T!BdG(0R
z=-dQ(WFYhwb~_)@OFs#M+X<ho8KsPjB(B0&vcgP|ln<sp6MEC%^L@qpwZFkMKdHd*
z)9^Zx`&2ZomuTlHtf}43fioRcuCRHBTX!CPMYA_ss-%)!`F=de#KpexJF&3I*=yI-
zhuSH$3;XjW+trGQh=%q4uEID}Z%Mh@IkC+)NE$9I$czU4u7LgFW$3-l|2go9qgqia
z0KmY=<RiG0@SPoJLM+eNhElYA*0~9CAXEyG56pnd*ph8@4#mifA6?8sLA{1N_Ohrk
zx?FXN@NtwWHN`dM3Cx}x523=N#~pFI#FKwm_Sm)RR1TKGb@GhfO1%uQoS&;0_3K^4
zdHK+PAMHEiWTO2I87bLwp%NwN8~W_Rj#S2xzAXtaJqPn9NcPPb{ctYihrKC|z(c<4
z^%YBeQl!70+dkE(&>&Kl!TrbG@%xxq3=-;~J~7CO;@AU)51S>`vSSrGj?Nqb1``p`
z2cxbuI%4#B<%^Ku(h_^AwO&d+`;sQdM@YJxNBOQD)SCXeA?`H(-syntv<&vf;(izR
zf(8>FbV+8R2|A}+(wQZ;iEVk*QM;8Q?+CGU+9)mV%YO;XITgl#D^q>M1Md(<Hzh)w
zWh-mqyKpRXiXbcGpcQgLlE@Ux0Y}WkENQ?xeI0O~%~$wMnXFedCMet&3kV&Tz;D%+
zB6mMAY8|Dd!xL6GZ<1NT+`xoVbVv2Y2KQnYxEjguqMrbb&>e;Ky$9K0a+a_IjD8@K
z?)L>rkPtoUmFUg1(}Qg#2_EpdMDxJ&Mm8_#Br(C*2MYUy-=Z)&yl!)m<j~Ur45N?}
zR7+M1EEir}?u^>c=cL${1{;*zB;0vJvMi#FfQoqSt9TYx8tZ93S5o!H*$FGEWMTa8
zBT8@5IT`;**2yV`*fx&97ud%G8`R9`Lf(iuJbH~g`Z7&UKP0&q!A8`AHf4SDMFtW@
z$wfbP>Ew&6U{6MV4Vube{Ot7ht;A)en&HK~T>9G?>fH8=dD!FH%d>&hab@P%8z+yX
zJUohB*)<i%jbD{;q7>r;CC*~}j?<?%w(PG7Uux6RaNc;hPK!|n1<M)`+Uk3{=A~%~
zr-SiVW8H?``UJ*?NSFrd+)L`=iP~zKOdsEc6FNK>a!{bt8%mFOUh#f_KU>tMQ~L$B
zvBVBWG!c9QtlubqCQ|dF-l%6mx6uautK61LMA?Y(>QQ>%U9f+XgXiLpEQndWP^|nx
zb`B^5Yk4RfuD{&`gT^G*T)T$8qyf)yBtu-6s%2p|_QWM4g^zub<h$`jjTV*W{Z%G-
zkCE_8R-j`mSFVA&K=c5R1dH|-wj{ww-Wxj(u3UvWBzqn#8mEfP6YMy>Ar^k|bsf99
zD(lao(<#}{G%SteElIPJ(Ers1aCWMC<{BRhJS1{qxt}gf2?Kj#%t$?-*4PM4{hpiy
zYn&&9x){m0uZYMtOp8ZDFJ=y%^Mj2gsHX+5f{?@OyyyTYu7Ghd0ARex$UcDE--B|w
zgb-bniBtyL(hNQbO%tC&jbl<=gUXm$5X5rz!?+#b0V?i`aJ~J;_Tf0MyHu9n32*69
z>E#EEoEWCnnkL)v9_!^V>mPQ6v@E)j&Qdq%6-C|GgXKq9pX+R+Q4JfcZgJ{)!W?GX
zuX*l1p4kM7(d&^K(G3)ic4`ggc8oW)+!1Lk8dz~&BN*71v*;L7@>u+(JWoH=52zUP
z$`a@FxI7{G7UqSRiuHX^{2c}DaFfe9Tq~`n9X#Y^dxk#VrCuz73A1kHIMdzGoK!x(
zjK~#4Wb_?|fx2{E{^HN?Mn)uUtA^eqc>CP>9I$43QJHhv))znvmDd)fz|;*m9m~u=
zF_(m~4~H8Nakf08o1Lxp?x3IE$a?_W!rW8b6iR^6sfK}P`jM!7STIfz^VUKmR(-5Y
zlN|{R)Ouofzg|$zT0KkeCKwZFCaSC#I8}9%N;~$2`?-7St;Vc+u|RCQq)CePRS;eE
zrz&v_-<gIhO$Vt8&21(Q<<jEX;BK3r;oOW^%i}SthwBmMMZ4O?xEcC;*y2Fu=Pu&R
ze1FZRY3C#v3{%I~?*zusobEWvzAF~O7K}Xq)L&&{#J~`wDQisJh@ScD-9K0hSt2J_
zEKkJ4e^m#7`a7~ra6<`E0PJ0qj9{1$PNr_OU_%aWlE+>#w7w_^uC%O1@O+^J0K(=p
z(-?x8VchW=2jKuXUK3zUlm>aj72W3*`uxh*pt97vzIVeX)cXhwSZHhXr1WPx>PuIj
z5pZSk$Fybo>k<^naLV&(K$lPiUQ*KSpi1*zX%|mNa@MPhT_M3y29=M@Uk3h|b!un9
zfgeBkwnNY8=0l4O1OB;j;;d4B9{%|)n&%T9VG(~xtJ!8vT8UaSNR`#``NzW_UW`SH
zSCG!#0il+s;CdXHj@d(vzsK>i=_y5g(oCRlNjFJHs%r?DONr-{if@$*t%#!qx#_ZY
ztk7?^jhkJ*ytIj_U1?Iv>*^Ry<0oR?JRL@sJcvHd_??3Q(`~ya1R}$RRdOvzFk(%V
z`Ax(@bsm^Yd&ie1a97D5eNFMKusUnHwea|hGzsXxDwI2X!d7ERb~5S9U*f9LrI4|v
zlhHN1;Ju|s4~3za{=9}c_(Fbu>$2^=rMk)uDiF}U%?wEmbBSu31Co$8#t@@KBCEdz
zlAwPykJz43S9C;%BgJcJqF5b0lj398le*Q$|CuAe9B-4o39b+zd%iiuXs=4;i91F*
zW<OXD>^6&Af`M#X?I1bP79;sle098)Ec!fQp`Lq@K4>5Cr9cu7#A4)>I&#$ujKv~(
zaz!u8xSJr)WT~-lUdl8^)EO5gdJ3nkH8-PnfC&UW;>QAG(Is*P|Ex5LEq8~(khNY`
zev?fKR}KndjO#AW>GAVSgUU|8<owVzovj1OWUe6ZG#BB7#})8&%H4^d+acIsnw63s
zi*vU(coGw!g~8>buH?SZZ>x34?xfK<;IUtK6I(Pjry4*s>qn;COpNh|Au-)3)r6!X
z>xWg(6V%8n#EDZgq9W|hZiHZIoYnDwZ+exhGi9;Wcxxr5h@6$Oh&U@w9;ZaqH#;@q
zS1ph=S?V*Yj8i(3!W8N9Y5411TF>lYs!HUnn3Din+$s24$HmM~f{*+RbD4eCj7*9G
ztWJ6ms=Bef`Q{hvrR*(pfAz?|r7>dumuHP>0K}9Bx?0tkVP_MwgVM>{U_XvoMB~|B
z;(5_nwM77_aYjOYP+RY&_KDzz$z*Z{S-CZPmMzz&lPw0WsqHIDtK`Jj?MM+79)ozn
z*Ub50F*tP&Z7yP^S<j^y@R6MGazVZ-xD_jQ*TrDwFxG|uw6UHA3{=x^EUJ(hxKi!L
zaS^`FB6nXJBc$ozMh@}Lhvbr{)_CZ;pvwb7Taq)8cA|5`n?(Qo2m&0r_vWCL*i0?7
zIyw`&ZO*nm4Wh&<3!hB6bgt`Y#llWw8X7rKqdy)>=35J3Z1bqy^bQSY@fz<aR4GLC
zjKk|GGJPJxl7Yzq5zJ1A1yMZF4fkua%YA?y9nRvrYYT*rc>NeINPtdgcSmifHDC8%
z{=-Oi*)IhDgRQrIi}H)xwSgg}L17pMkP?yZ?oL5aI*0C|8-_+&y1Tm@fuXy*yQNFi
zm+$ku`#AOw`+vCCTK8I?>%2}k3{XyQeX7jSd#dV2Vr`8<HfVNsyvmUFP)J6t|CD6O
zZ(TkYiZ||AD7+$x<XU+pRAn;nNa#Gfv)AG3HmcQ`Lve+i0;#^H;KWi+J8o|{{)}4e
zk?bEe_XLh1PD(YhTa-4OC_7Ho8u)wHdu-!hS-D-t)L5%W2F_iFvvnNqZa&K0HY;=P
zG@GnZgS<Ee?Y}%pg>n9s>Kf10PKh%IsL6f3%)^uP6mU#TRuFyG@gERO%s4F5D8Zgb
zJoY{c4=sY4nV&TfhU_f`X?&ugl#^>6?eOV^?iyq>WgIdMOq4x7uDQ50v9<>{#w#w~
z^ZDvO-P5nqtd%i;*v>$Auj2Nix}vM^oFd|C&Cm;?-zNuowQ;&dTd$+wHg}dYM4_ya
zj4pQ%)r<hschjU9`yo}d2pNOSd1%DEnps=LIyH>Hy#t(&?Ta()?Y_Cs$;}1s%%>dk
zkHn~PXjsv)`OSHpQB8c0#!Yy`q>bcj&UB%@@ky0-<XejnLJIsk@Zg3uqESNdcB=)Q
z?6j!S6BvwZgtd{shI#U2`Ci-bHqm#vY#X1IpJF|16dKvK+&EKpjH<W7CI=4*2Q2Wm
zUfP~j?!jb2QM0_gnQy3dubamcy?c|UUzl*+c^z`?Hwxxa*TRm_Xb_;Z#zmY%ds>ED
z;pwbKq#hXQY|?s$-Eg<802j*bUq~rM$4D|uEgMW&f0)TVraVeNsrK~ib)c%xwgWMW
z5>_!wDZwkVxu(FKPCl}pBakzSOQt5x9<%gbVSJDde-Ib6Nto+ZE>xQn!>uuIIA@}l
zO2-%wnO}>SsN2wH0YL|~KQGZKlA56Za!PPW!_2HuT4;6RaRY*-=^4AKO`W&lp5EQT
zPJuUfotD=uQ?s0SjjeFacTComnToreq6&bSKN&(JPG;YfrvEW~;FH;(!JP;xW<ID=
z(<CD3&f9;P<|B$})zP#^o2#~I5M87yT(eH~qG@4f)#UiQ=W*a6IdOj8xzpVC<P#Qi
z=#bFY<f6!&|A2QSS#q?k!k<+y>(so=XR2e-X@u>3Fy@#M!It|BOhb)OLHa`<Wf9pr
zf3fZUzSy1XfQ|eoJzZgfXRZxd<GJ42dh+{36UuzJ(F%5IteP7#8|oJW^a%=Ub#mh`
ztitZZ);H+Z>mwPtjV+UTAtx=M%Ew=oQNBnG0tbt=Gq-A%Us8#$mAaO`yxzpDx)Q`e
z-9q9Vamx|`D0hY+m3=#X9;xcuKll_fR8gbHYq!S#O#FSOq&hfXkZ@l;O9Ra?BJieQ
zI&Mu6jA=UutzsJ;{@Qg6=bh!Tf5||gYJWnkbv8psB&6JghF&qTDjFd~lJt%ly|7aV
zUXx(h%zb5@VT^h5Xn1e;s%!+eU82SCdTfbib7rQswMYR-IaN4gsag=X73;Kr3H9gV
zQ33(l-lc-g$TDbrgyF<&u2Tq~TS*Q&@Qk7+au(GqLKnVK#qIJACs%$}Lo1)x%%LKW
zsEbw4cf7A?{Y{M7y}ByUiK=y#+Su266pix1RF#AkRpgkOQj4yh-OH_Sjp(3?@91j&
zKFR6Ol9o9x-tv7J-D#M?L`NT+nMuwy$3nL27Jt+|J$VPV0~5f8T#mZ+d(%9%DgBjL
z?`0&Puq*q|5H`A~g*B|rL3j5X2Wt4Ggs-!*se_jMGA`8`SQ7KkgxEy^rz`y^Z1qm=
zu9j7V1zQ~gX#WVUC<f|W`WQ99r(^{U38tvIG~?`8(9#v#Dh#S+p9`|sXYBK4WxSF(
zBRjTAH;lzgPH^^5v&+6e?>-`DDn!Z!d77?++D(HM!O7%KK__dLarn!snW3M2D%N*D
zHtjY3VnKCWVTf)vu~=k&=xPW&080{q%!?5pG=EzoecRoR688RRUULNd4)LQIzn1~M
zAJCtvV=H2s8PM7S5Bxo54P?D6l307~u5B6mwOhT%PXXLb6XB&LH)?A<FM3l{kGKF$
zY5TWJIG9><Gt96(#KS0z(&NT2oD3DO|DMll!YcH}I5o1ofE6rYM@tgwT#Sfm@HWce
zr$^=GYnZ2jGd5m|;n<i;aVzaFO?6tUClcY->8P5bzy4Te1M57}bpd+^#sN3#q5H%|
zBUp+Jp~j*3f`f%S%>3X=enQ#kuSJMdCS<L(tt~1OgHMF=%Lren!)04L#2h@^{SuvL
zh}^r>%iFW_19zBdV9Udqth!M`9`ljUnsuN{ybrh=@mLz@W16|akh4Rp-Yi*rcKjhr
zETi>18|8jPdUK1`Iy0z{X^@CDCvRftmvWU3u1^A0RM+I)bq;RZ`pA~mu55JYykSQ?
zRy$=XOaEb!M)HA=e&_u8&s*ot=gVO_erdG)%Y1Uf<0#Z9y`u=w5yPRK<1NJHZUvVs
zwoL4S754%4k&LyqdOX^w*}k0|4uSDyqPiYapq<wDdtyf+QxtA<*t2&DLp<hy;wfxP
zs5?i+7uDA{pTj;GPK8sH=!fLDbSm$Y7?^9L;Z7gZ3JcZd8nD$ZnwVt1E6BGip&rS5
z+CKQ^7VS}w*B)AW>V1m+w5;-$;kk?oQ=B@$gQZRjW6E65$IFe*Lvzq3grbLAGzF0V
zCtR46=WzkeX?KpReTvxa7?h$CPJSBleM~d?A*~{(myPDpkt#$_8%K>dDs8=|uhw#)
zfq7E`<Eg;w@U@&jKL`<**WJP87>K)Bx$uH*y;<{mNucmeGUyq21mXVy4r9qv`X3Kq
z+kfZ=CUYJJh7#aKJ2UKceUJa;>=3pK2(>roHEhK~(~Iop-O4oBkv_Ptx7cE`=r+JN
zbMy(<i{N~6HTS^W*BzN!Ku~A|O7Zn>1qbU1{8MKm(({%|UH1)3Kn0U)%PM0gD$Uhq
z`VciSer(10`qFY0=Ln%vUCwG~i42BMd|?TTKqbNs>JjEY&-J`ObRHWIM$LRoDHsSK
zje@e>tMkmGZSlei%#elfygj{tgs~(VX<~Y<gCX5!Yo6{?sswE<#}9UA7+6G8Qh*55
zjdoPdzqLd=J-o!bybt6+1x<$e0ps&W8}b>0Dd4|>Q=W+&^Icish-R_*dO<Dk;w<z*
z*3rK<J;e(vIz8tgaSRS40W)5hU^S_FqW)l`XeS#WtxGHJB=y93#*BI>h5={Y9eM&o
z2Bt~8rxVJ_)mEj$S106_xD|SV{=?MRo32woLVoBxEkDVQJ7e`J18`+J_8?EPyS>|_
z$u;||Ook`xE%>Fr2naxP<31xCu?C27A2g)i|B?GZ99Mxex~5r9V6!6<6U#Yw*t9E1
zZZIs88mG#rryhXDr!;#U@h_UI8@aiBwvCQRsD0;GAn^^G2m#f8Y^u^{;bk&OKukoW
zTHE)3%pg0W*c&2$(tSz~*X`EujgBAodD0SN-dG7|`t^{(mW2byL2Jy);$Oz3hsl(%
z34)2@e`n7l<}Mk2BvmW4DRJXJ6KX#i&o3;uman6vtI{1lqYe(30jDNAW~*q2Oiq5G
z_28mR<n~$mS780-Sf3ixtFjZY^Souw$XO^nqFrFVb?py_l}JaYiyTz*oBs57E7^an
z$sUL;_*|6(+Wia?7B}u+=0Y>jFYF4}(EnZYz_96Vvw%FDUHf=-EXEFPa=0+*>TESw
z_wJoISbcR(oMG36GAv*fGm7bb8%`WRi&QkHRApMJMY3CjJO)?kCPVOuQX=NM6S8Xl
z$+k#IMUq%KU5YWkEJ-QqhU_$Wd}M6#F3G~3^p9v_ssLB7obsDy7sqc&xZ(48*EON%
z+$0!$(egFhd`>*JT6<qD6jbu<M&u;CdC#uYg6|jA{foKe$-=e`J`I+@!MFg~T@rIm
zC`@L5PwSuRm$(}V%styZD?<6yRZE34Fqi1>jQl7?2AxO)VBq{;0i1T)XcT5wB~&3~
z#^8cMf6evFg;#8TXA1&E{n-Z?gw9rY>Q7NB@;`1YN8m<7-(kss|HI}(w=u~KTeNx5
ztP9_XCL=<_{3GjCJ_Pxjp+>^dt@nFE1sM=2%t75NQwnL8AXIM$*-(*u42LOB+{af?
zx+t4(^j9A2wV$0)@R|;FkhN_X7`fY_=r)GQxI%Ru3F>~2*B%0K7BVjXD6>%}*gB<7
z`t|o1DI!YkHw_*_0b-q7J5#JICpVa>*o1qc9wwsq?J!9mBWs-3>!@ME0I=@sSLT}T
z*z$`5$C*~ZPp^sAL~%<Rrl%GYiN^l}mcHsmrU#cOsCOV3<>?y=G6KTK{&Y?de|r&Q
zuh&_U&Zv*|P(oihD{M|`6lcPCUB4lyoTwr728m@EmOEm4jjo=zafG1IopEWQGmJn?
zCvmQ#F6{mcKl-MqvWnF^^(yW>l|0TZ20S?X>935_6r@?rLo^S*2ODh$iHN7VBEG;8
zclV)Asgc<;Ea6~EXvhvD4L|7PV50JZSYAbPhwF(}h@ty74rxAf^n_?yf8SwUZ4&E$
zZc8~d3h--C;+1^nVfy0;#UR^dSlYqO+DDjxZb74WcgI8^&*z{ZO0xq5LbT=H)c4R7
z2R;hH9rS>DypURPe>&{{1<&6|ueBr%)+nRBnk_ALuQRF*Ly~{Ht3#J3;$_VLOzV{N
z$oUgB1S(`P>bi<<;P;#2Eqd-mas(W+TTQvB(#-Yr5p1VThB>wnMk5G;!d8`%x2yO`
z^E77M))OrU-yCWVw*COUwIrRkIG>~sUdcgQfJy(TR1dIF2+*&?(dy-;NnI+<eiUDr
zCia=Q9Y+PGCc%N;`7ECfYc@k$4M3QPp6_1ZKwa=)9mRe#jLi1a%DjVz>$w5^?ZYHS
zYQq$RUPEmiEHRZ1OULhz5QMl#*DguPsfD{!-6)!aocdT|yR2!4eY~erO5%2$V}>?z
zFq&u$2fsO05IHn`Lnd=j$0xS9EF)PXbNcsn3G|p-Kd^J=Vy*2=;4%Y^Hh4D-liaGa
zt4Q@xyKa3GTA!a!v*T@)c&O+$KA9idtYkW-X@i|{s%idoQa85br}SIsNo`>H=^)t`
zd+|2)eTl|K#a0r90>Uo0MdD;20|6^A6vlFZP1_>61<<GS_tuuFHU6Vbe4B7>lky<m
zH7?FBJcpO*9}}75%(!@Jb3%0z8nb9B<&lpnqb`{#!GkwrF(!mS5nqn?@CE2h!o%xJ
zwGu2D<`l>$ps6utOTWOMU4(b)p)j&<^`3O~+f(UZ$IPQAy2zfk&s$>i-70XZw1}kO
zKXKDoj{0vIfYH1jk9&ko)Z@-MFb*=(7zxQjQX*jScKXj*7&Ueq?@j-p*k)%BXYMXL
zLcJLt>Qor*D>l!IjszL#RzdJ)2p3F=J;3xP&6ayrY({Rs#WLT{=?SJD4|e7kww$7(
zIOM&KLmgW|8%%6!d0pmQn~^`f_flBD6OCKE`4uPG?Eh6T|G|Q4Ui`ZpALwULPqtD?
z>YLCK^TUFYsd?Ris2m>q)pTa}%f-p^Z+5M}1JZ^wZD&huyMbS~G2WWTOxxMULNvlc
zE?W4)C_6%9R1}CBJncY^bQ=|o+H8}H6EjN{a<MU7!*%55)pubJcJYFLb#su~DvN9k
zh&40fsN58U2yCe})6FJipP5{}8Y#I6RvGF?>4>~JuzJ_tJBWRnP>tkEF|E*1>QD8K
zB8=(C%so9g_*xAg`8bB%A5KQiICy)B!0h&h2lBDKBP+|UarlW+xI1v$9hzJSvs>N#
z(5Z95-4eg2aWkSd>Q2xPj;239w0QpZXUEF7LY10Q?ZvQ+d#vxV+=Z%L<cZohdT?kC
z<@-+Nt+{5xHW(9(Cvjs2(?<?2<I9(?nO?H?UW5oqhu=3E+W#^^En5lj_;n(I3dlOt
zUWwg|#t7u>oi{f*8!_$ist0{s5jf{|LpkhpY|m`wR9O+RB}Q4hmq`<3<-YuZmSLM7
zO&Z<8vYVPzw{Vu-jev_q?5yB@^y9!Ah1y2YFb*4y@oHsR_7ph`h)yA6lpzi7jRxR~
z{r_A%1qz>?CM+m08heVOtmc)AH#gOGnDL4G-1e0461Q7a;$%qtAkC#Bat>u!uFuG-
zU&FYk;fZAS&;r#S_4G^1$A5zto)5(9pinJ}W2=#lk)#oaj_|~T(DpsbNnHNCLlJxi
zs(-awr!y9QUt4-^Bd^qf=O)3rx`*nY#i&gnAi-J{mJLMHKvwa#5rFg_fXC+Sanpt3
zU()cdYcW|}fkRWXM-HD+lY=h!+h|hVVjJy3Q7-uA-G($qz6H5qrtK{0^K=J4h5a36
z$6{HDKr)}Q%L}5^q4r8}oqfOdL%<~v#u@!ph0}EzwRKE~BCzkPRx3j|TFYlp`O2WI
zyRUr#zc;#`dLc%>YZ<~WYx`x@DU12$+EK=B@nB1;>u+443C5ka4KuTv*wq}w#_qU8
zkgb`T-*UI<A>-9((+Dg37Zo-qul3Yl0y5xo%f<2BxqWV8Vcbn)#fg|j5B;9Y!}|W4
zZE9N-fHM6%{E`L&1%Fz>dekXbA>EP-P%(c=8Dh*hkzg2DgJYT?Xg=80bHT?BPcC|c
z42(-`1p`?oP0?EBq~V%X4O$4HC>^A^GbC`~LzKN(kJVCaV;(t`L4w>0-mCIgwh;|c
zZ#9=7$$iTgTD`&_*B$Pa2>A<o7BdmDG5=2OQc-05Aa3C;Cc*Wbz(hb##6jR_>@Gwo
z*#4NX{oYPY)~&_l)jKK!>V4I>Y$K&I3p+!*SHxanT>n~|1Ixctn15GKHDV*$-Lc>L
zcqi3G0)b}RYJ{rRQO$>6V?D(o{si47TKrKPWTgjRk-7KZ87epwpnkcV({7txt4Vm_
zGAvV~TzuCak}oCKq)b}dLFxk<WhP@HZBpUV4P~TMtSie_$7<~36yBfJ33&kU9#ava
zTrZE0^<K-#NOdg6+)sIah~YykNs@>^OJYmER}m0w;9NacWBDz2SeUR_vg&~&R&bG5
zSW?^f5ASGtcJb6j(;Bhd*M9u~AM>nipHX~3A(6?ol+76*4&9B-y<j=~J-BrB0;(R+
zKmG71%|jZ9u7^}Va5}B8eq*!|KXIcN=s-^0Bf)Jq*ZOibrs+5KDKsp1m$Gnt+&Z_p
z2&Vo=H2+-O`aSr9O>fI%N1tw5dZ3ALcZ|A6+%z85f)CA}keuQZg|F)1U78xjv~Lp4
z6UBK@Q?ENwG;7Ote860UKnCiUpEjqLb4zyA-z{;li}{Dw;gHk5gy*ecNX8IaI$!g#
zZ3^#)03~o!CRx=U=04oYA0#~V$lNQI%qG4o?PH+D#nIgMcLoLTUV&7V#Jxsng?SkJ
zL`IL-AGX{3*AmWLOf7k}2LNC*`&lUWEEH*9kKqaj$-((1pDuYQZbFHV9}C3bINmcS
z#%|cXv;_XVDT!`7-42PzM6u3>|AW?VJ?=ugslYWsS4y*&@^63+IiveXKn*!q1TI;E
zz2*#&TQ11ZZm^Zotm3(_X#W!nHOEWZAy&b&oUEZqH2YQl>G$OXXQG|?cTa!bqN-W9
z1>z|TTyb^x2B&Gc-SN8#l`BKNzyKZUJLHq$d29vS*Dfh>+!-9XKeS5XP)SLIZjPse
zaRU&8_SsOh_^4)iJ&Qdr<N|@&{^NBdgrBk<37(U$QMuVh>b3i4;Z7y_v#oL`)nS5<
zfUeT5E@1iJLgDGX;f@7LjKM&ZcV%>ef<ux}dBdmAUthomP8<7(c!Ls0rLilb!jcT5
zhqW!@O!W)BlPk0@*Co_6S@z$mjhvMLjL!mv`MSc=RQ4ew>%G9xyJ@~mmNN*ucAY$8
zabg$kI00V{>c9jxoA#LCH&i~ZhI8AfT8j(<9Lhu93Cy_+km1XBKM+Qu!4oH7#YVq1
zzD2m}{Xqr7`vTDhR08L(S@G=qNWKz;>HA>SqCahR>_8JWlNvLNg-fY{1A>pu*w!8%
zvZE4XHb~DKGB#U7`R@Wvw8nKj7!io8VXhp<Ov?TxdP8r)yOJGH{$pTTj-i*SN1%mQ
z@p&?WBmUrERyg&=cy*8x0BEuF(I%hyxO?eBuKWNg850Z^hHhb(8!AzNx_K!!Uvf3t
zU!gHYe=%-IFVWiZ2jflNM_t#D!Db1(&Go=ZQy2_D(HaS0d^!;0PsYR%_PEcrPkY0B
z@r8@E<zrz}c`9rx!!GtvQ8CR@S0UcLB26HGZ7J1Fa6hZJTJzmxWemMBW6ddOsLY7>
z1X^}ud$-TsgLl}kf?KF6x3$XZ?K93g+!uxnxQ@zOLE}{aboI7;C@NbwOQI*YO1k&;
zzp|R39<xAV;rU~lUp6b;Qhbm8>bx?NJK#+q-XZEw0K~z<+q@sU{Pu@a9<e$<RD`ej
z+S$vhSRwN5qC&Z_1Iyit$F0bEKqDaw%>qcGJZ`|UEip2)yOp77rYPa;s)R8QI?|Bq
z5M92)q?;+_OP$Y3@iUwUU-FN76@9Xsx<@jWbVB<4A0eoZv$8-q1-Y<Q*H*r>tj>9o
z{y?PK*Y)W~Wy?d(==Fh|zdL&^3Of0Ob{BN1og_sE?DZL3>uzs>rN>i48Mb*E{dS~@
zxIZlf*fcFOOD!upVn&*&G=EuL<Xd70ue4sKF5@uU+f%xJE=XDR+PMGH`tweXpzLh4
zWX3A<q37+;QR_xHNzIy9q{}+HN$FD<+08qfl=fw^j5~vQ>sVqNVjsp;l-G<To=Zn-
zUgl^@w~o%$H(0L#Z>)`90VQE*htEuy7o}30ZOWSv$|O#Mf@K6OJ%`SzkPzrNrr_2k
z^zp!cL)odzC>$^w`dJ^SPd)X-Mlk$pZ;fW1z@kSNaD*MQLwbQO;mOC!`8h?~-o)}+
zOu2G0^twSz0AZrL&t;sibbin)o&T|=C1SzfS}!<^zK8mcUFNe%S(udU*QAbR<Czib
z8SxhrT3!Um?G?FKnM^mJ#F=zh7yTfXZ{j1k(~eYYpP0-A*%{-D@k}Q~1JOMCn4bBX
zdmxg)da<U&Llpz#%FA<)QHdz2eMXQ@kgMupsraBQ;G*N28`Mv8E_qYx3Yc7d_z+&p
z!MfgZhBUod?m3<=8y#$fF|4U3E<GbCLJ+`1omHmS?DpKtA7aE-VIqLH88?%UR&{VU
zELctkaCM68gK&Mw`nC`!rQID}2`lxXJ6ME#uCr=~r2mrJ6L2l;d~H~pA_*jh=(Yge
zw0^T8kG`#Fq?M*3516l-SLcrkIjT*!V_Fh~9q)V|{75S`Y2?p9=!RqNV}vyTHRulA
zyIh8OSE8lO@z_60Win*kC7Qlp;ibxawq;MA3bxLvSnpVbBzxYe$eNOR$*igd>fm)@
zw+59Xe#p5Q;MXBHx^4xUbZ<MRU4^a29fZiWVYhIz17!G}b1cc<gizagmD*OCBv>Mr
zWdE?Q7F$9nj1g`6mK>m|5~k*VR@ldm!^o;TKyAb8O}r-T&?TGiz}z5X%MjqbyDbqj
z>L_LoC9Z;LWJ{<=AE*)M7Ei&nvx#X1r%hChf5=00sqv2U?Pbdye-?(2@qdAR!Hv@2
z@U)QkXs@ZAp#Ke*G$r|W@=0V3KVrAc)<sUrYrWUHdDsPb`h3DIOf@(WU>5dEzR3&h
zqi=8p;%N_j@}Ijo*;X}wwx>V50LMfe$5expPgl2yBEBmd7<QaTuO6ysv-sX;;)3{}
zrjyt3y>V#Q^g>El<{>Yo{>zig_-o#bKcHK&7vDdZht6siuQ%bwOhRek>w3P<(WLut
zw`&}+5~urRxLr96ejXLc*(>Uveh@b8n6=wR8-B?lwO?Rn9CWH8&ucCCNrBzhW?~H8
z4dSdmrrWuAqby(!2JR|TZUS4GG0ZZG>Ltl3alZ-UI=%yZ%d8!n_4viTt9uM1V;+D+
z4L?T0VDhV!@5Qbrp=ACxl<zmt2b<aDc_OQ{oW|1J5k7Fcux86<H`XZ(sKIAM2E52M
zznC55ADTz=?m$Xgvj&I!ywaIs`La9A$>?EWEG&X+W502B&ah>q!?52Pl?7qGkXUrP
zDEdWpjqx+A7|z{x5g7Xwz)YzXtb$s#qN->pyy%TU#L>L&j{`U3Ob!DKaQSHbH@uf?
z;W-i@=xpy~NJc~0>@c<j5X5`E1;EajUBv1&v!IY<Cho<uNeKo9!FoIrpt*`@1Fs{&
zCElXq0*CHhMT)lWe1u<;+}O0ifk{_6Xv(QXqN9^}uzYJ#rs--Xwq;ffj#hTfX<0}d
z)H#<ZBmxzLy+;+c{UaE^^7@haIpnvbOOYCo7RLmuD5zCsE0Ke!<7^A^U2825_D~61
z6N47<bP|?-7|Bcbe^J?UTH_57Q-iOS4)A{~ngrSF3;Tkqr#Ji_@%~y$Z%F4x2Cm`%
zJVMXa$n+T-pB=x;v@5Fm=JsIO;p^>L;mYroy1B)Y``_y=5w>pID_-nb_`AWpGI*4Y
zZxFtwH<V6jY1VQ(L$2?85W|T&3CE=NnTk06<c5~cJ_u&3<{@_Dvb>DCF{b{-JYx*`
z<|3l}D1|Ek(_dSiMmQBA4V?dY@Cg`HBexPJpU(yb;S+mIJQ!n82pYC7_o1PB^9Z66
z^)B%abFjcA0y(dv0$*PypYG-0sVv9jEsBG_2-gsJIUysmzbma+*v=WeTM{3^`^|Yk
zyFXEgcQHM1VnCltu&92Um>10Jtv-Q5gYBt%2@|Q&`&*D25)je;7P}?S01|r<r=7Wq
zT|?*QNC4>v^MrY*(cb5UQl^OL>(NsPNiS2`2c(Fn)pro`vgDYT!P>^lj3PY)e&&Lg
zkbu&bWmB0unhxhDGpN&Bgr4&n1$?{Vi$6bnXV=Ce!tf~40(Cux5tzp&{&D84B}5uX
z;cDzv{`gC(-fWE7rE=h8{l}q7Rae){ZG|sJ4>Z*=84Kf`jn=mx0h*yZAVs>LR4%eC
zgUpX#M23fXa#)^gR^wfpUM-_*jF93{FWFS?nItTBRW$V7`@xt=(CICAkSi9oTLmZ&
zToo2IXEv(XNizvd<|66n5>($c+0b0y^wV75sDZq;FU<BUarz*v#h<!xD=`M)yb9Y)
ztxgY5TobF?Pp@@H-RvBdNRDy1;0eyuV;QO+PrlnL9KF#{;`H4*y22H?_`Syw@?26+
zlpAosELP1YzdSG#4$aJ_=55(i1#ggbP|PkqqPu2Ejjd!F2T>A3?7kKqRJLUN(wo!h
zM4_LpMYhn^UPz6WF$Ro89k6JnXj0ek?d|hj-6&Bd2|s;fS;{(8^!oXQX-N;ekKfiN
z^te2z3|HT2&Jb_W9<{CFK1zm=IL^EAeXBY^a*1|*I^{@qaBv}<dh&_;o*<OSVTtp+
zyI)zSh~#HbVZsy@cDu!~KOF^VFTHs-A)(3|@54Le!dP0hR}Utfn$rVlN7m&3IMuBM
z^q%PvL*3cxY3ID=r|=EYs3`<*!FHc>FlB%;e6f~Ldnv%YiFb7Wl?luy@~h$oBY|b)
z2E8IVwnu}&?sYUX9Lb#*J0X9ET-VWV+=wW@51J8r975`I^sPF`)F90udg(Z~A8CM?
zh~f<Wio_)9Z8Bk+fkd*}Jw$$G-sw(g3i6$mwEAPjv(~EpQ1!#e2YV;<@9hx#qV??2
z+o9jw4)-q#eg_}o79}85(E<0n*))wwboPR~n8z#>rf<6<AdV*Ac*8ZBipr!FsRTcI
zZ3DxB99(uAMbH#IM_fVK-LX5O9Re-R8a;pu@e+<FL73hi1k8W`=ti*LVOj)u(5Yl&
zCLX=o9(Ru|vnoD-{KXf3@Vs*PylV!cce7N2%i9gJV{ymUQ`{p=-<cdAm1&z#e)V+D
z#P!M@LQUeFv&-~X-(z%9b9K-&s32$0V8A$Nvq4=^s&I6mu-C__CU%!gl>t=nyE;t&
zTI%_{srGy5%^Ga#LqZ#^Q@)M47rpUo;-_R(s{5~I@5;n6N>)^7_i0D3=A#%coOMjL
zStx;3gZuC8yUO#%pl#gGaQuPPY)k%Vn;>hF_E+f<{*34X0+wvO!y_+{-$v}e)@j5D
z4lLnYdEsasxgr3$k;#4lvoPoX&A(^DP)jPBAX~QD9s<7vAy1s;tt8{afo8>+xWxfh
zYEvJHr9+Tr_(9?NhWg)FKS090W7%Hn)NA7#77PM2d`iP(F#Gv=_>Jaw^2F=jwK1j5
zM9(%&d%fr;yauU{FV><7R6{gNhzAT^+f7BX(szAt7fu^OH)f1H6C5)Nj&KwIPS*a(
zL3z-cq#)4{nGIO>K%AEhNkmh03;2!*kbVafPVuAye-NTY(_8eB@cxtY4&VR`aLFHZ
zWE-Fx<q7VQGhE)k&2#cJ?R&lAFY55&#(CB~pRiMC39AEfn`noks3No19P}&|-mwd>
z3l2tayTf;e>X^=6TO;C8i*BdEX@cz8YV;F2NmfN9w0mp~={H!Af)-0*abdF@8%(}M
zD#k0`c-{m3fyoXeN>!(l>`%_!pQXg}oVm=%EF7gPt?MXBOYc+ZW@`8g2dr*4L@U-!
z-%2x2)cY-vijFC@^OhPY2S@)q@s+crueA8)Leh}91Sb4}x4|{$9VJ+MhW<S<PJ26O
zY%{0+Wh@_NQT}4`&lp?tfsWT?e*#`!@WYmDU<rI>>y7gL`+%!lAWh6DPhG*TKQxf`
z|4{YoQLi4LTCe{%Ro|WCEIrWtYTu<wLJGje;(atT(Uvc}QB3A!z{njR<-C0DMQoxP
z5np1p@jkl0qVs_sRv^x|kgmk0tpA>-Y=IPU+z0h&1fmcI8jy~nAetf>Mo0nxz|1Y7
z7TC_u(7een166+=H&&vY8(Q18@oNx^Ec;yU?HE048+3610E&pPE)EXD0$fN4Q9=;k
zNHE8sre@jh{fP64WDI3-5@dU`8gX&5gtXX~Kt?W#Pd39iV`{R5uk>@B8Tyc}8>#o<
zGEbKgcym_f@a*k%N-__mHE^)qy{f9b&`Kjo$b$l_)6;ltWm^t{zi(La2JUd@z!>4!
zhID1LY3>t5@A?f|&jMkkc(|&nEG|BMWIc2w+U?OE7JnS$iiOOy2wO?)q!L@=+sC5{
zVj!vo3$5>`iPnych?Tn|N)vCJk*n!S8%Oq=#3ol^@a@0vLb;&qqGZVBLFm)gxslY$
zBPYs_2YE6src$%@aStp`2U&HK|0xsHqCuLLV6f=V-*8-yb4hj~y8H0aj<P$7CxGiS
z6@;)ll^I6D8M`j)l6(J-6iJph#Cl1kk@qZSBf;uFQ*gm533;|RQAzh|v^@V60nTr_
zrvv%_1I~|UPC!i?kJ6;+S!%Xlb!Yxe2{2Jcrt$yb=J6WviFLPzILIt?G*RG)F*}jw
zM#G#2-V^UoiP8Q?6fCx+F|0NmA<&3A@*P_XC?>-n@~ueKB64s=xr0Pzp+HB52;z=b
z;47XcpTi3;;eu7<KNKQ&;#d53z|CAZGV@igdX~6OF*s4kD_O9lh6|GwS<Oz5tsj`H
zNG$m2uo7uCcNl;8nOUD{bem7f3Q7gm<wTNUYI`5riIW6ssVg6F_gOSMkF5U+nfaZY
zJU45ZqZ2yqD>RfTS#easrx7lKX|CJ!(bwGW4$Z1;-S?c7ZDv_@betGfzSnv8<2=kn
z%rDeU6+JPOnuWEi?zLXN%~IoSbuGERe-wD<1CMjmg_C0cd+*|W=GeG=maHo0$e<G%
zibyrJ|F{v0oO0OFXrPlHX`6lLT!^Nz4=9CQpBz#!auv_Ek<K{t0sb<!mSo>v<GQF@
znXRd@#c{0>9NxrQX!s>^by9WYqwf%z43?DGvz3{*b`}|9U<|qFbL3Xa4cDML3h8GX
z8QEJ`TH1pu!!Q*d`KUH%M;YCCAoo|;py1PY7;i7I27mRG<;!q)wq_~p(bcyiu8W}1
zY>LmSce0D%Pri5w=W?j98>phh<SZ$uR<BO2xj}5EHXMK!*-x$9M%DsmQ(Y0kP7jpm
zU5$Rj{PbErJxsydfDBH)>Za^uz-=kYH>8rxc}AQb(nC@nY!0MHhV}DdL1x0*Yu+^N
zpj*4&Fj-0f*6b+dfy7|m8#o>LZGJU<UCXRxcND}NqvYy+9Zw+_{)m_<Q@!kvbaFsY
zCAR9@anfvLMSPhdAhpg8&3eEz3CiG!+4rGk3bxB~c}yY2+}dut1<^7t5t}&pli6dB
zF4u&`L0LmiY9cqfuyCN%7l4w0p*d^B5PK(Vi6D;xiRuZj7RorYXVMTBgJlRL1Wa`H
zxvSo<qaKD)CVCwMWab`Vnw9gpE1J_CxP31EjJEPx^lGl?zl_<W?`uhDBE@>t(Y)bj
zbG7kiYpe`meQS#St(*K5DGvAcrY5R{+h6=3M$>bcxK-qLsvXJ1=L7Rm`{TC4tf$eA
zgG^O#nec5J4g%dZG%{M<so^!`ZI)m^&%JR>EVw!A0J#PqX0sF^pR<PB+@|~casdeu
zw<xpLVHxb(ouxA4u70R77RF%52Ou}w7LR>jpAE6VcMg*vTjA65AG_R-Lf8GTvp2BE
zUaKFjW6l>}isda1Z+MAk0o7MGd@1^}-^7VrQXi4SUBXTkUBX}~>zj_2U^6$T;6Vx7
zza^v={a<T5KKE!RE9K@#&HhcC6Xe{E@37XkkHw+*^hqGHs!u}l$=PT}o%ddb;uud#
zb?vF!Fn@2&@H)(C`%D7vzV2NN`PYYkc#Vg|ObmTZ!=mB5Dvdh=j`7<59}NDhcEF|k
zhutgS!&@wYiB@6RZkW{LEdMmh`m}8ZidVF|a+^m8+}M~Hcd!><#c<X%6&NWZ0SJ8l
zxDV{3Q}VW3U!~<m?{mN3r7V5}O2C!zE#tKZb(J5ecGk>lKzfXs&ec53><l<lFFc+n
zFSg*kt_*t&6H|UOsRrP8`0a0S;SQN6-86HR=`MY=`^H>Tl{d=SY0bJ;a!)MT>G+<B
zgr2-{U+;SI8150sc`&qSw9g#}-%fX+Y>6p%3dkzJc_GaqzUhea6Yl*k4?id}BW{8f
zq#7GsC51|QU&NGu&P1?nNrzxX$8LGMP7s+5vhsBN&rV?2hI({Tz5ZkpHa0UE!s(=X
zT+ymk{^eo(PvL+{Bj7-abm*hH&}QiI2iCfZN<OOirhf;#LUs)oupc&Kh*4v!e0G6D
zPt2I{H~)?|&q#mpMYffNE~$d&`#l+Lku4%zw2sgqeihcABx)l2eEmV%U;h*vRQggO
zEfx^G=>2rjFVJ85Ox+PdsQrb8Jm@G&S$924mRLT}<#uPqHQaCs%=Wy~c0Z|T`)`FA
z1Dh0rp$4||*JIpj*%C{`ZtZJ-Q9}DGT!f^%6_Q~YYfp}-15%aq=M6|iW&%oP;Ns7;
zI-sBT;_>_k-tQctc^`GBvpPp9z#hMlJ7X&VHE$lS@V8>oqJG5WRdVh`2;`xb#3rpe
z#qIQTM-@o@7R4v+0e1U9Mojjc>l<yNtDok@FH-8NhgE3bThmV94fV_h{wodUb*G;U
z6w9viNU2?}JZz7WS@m1k3CV1-&h+N^>bPr>NCX_%(&;41l=zbcmyD>R9=brG#bhRB
z&G5q#d0uA&G6_zI1J<95WLyrTo{-1cGW$7v*gfnoGR7<wk)fl|Fy%#!mWvb$xT1N5
z7*UUE$R+LeXnADr3RL@qg=fu%8Ip~jJ}b_^B`d#>RE@0~I6<U&DEC?l^i`FD@5eUZ
zpn`B0i3{0tno<xM`o2dr*uKZEBwa%|EO}7Y0hJwfJ2W)LXzfzDg)HSZ-+5JCL|x!c
z^SpE1C7cPgqy>2WJP0YJBONQ&klXjTUeAj32J_&M0h?Sa-Fih!P=z9saTTpQ#6vaq
zz6bh-&&Tm+ni<(7ZbPUA;n=&xSPA%6$vsC9<BA~G+TGtAg35hWRBq=jr+=9g(TQU2
zfmlpPGSQr%Xxhk@{NF{N7hHxLsz!$RM}8GMWE0#CwG}^Wu5+}9x8`+#V`wvS(uDgX
z>={&{#D`x<iB<)+E92X0L85<2<^)a#iNY&?D3j<FUGE1wy-REq2l2FRLGd4?z@hfP
z%dz_|{V8fTpo(D9vSS@o+SjfP%MeOz!JVQ~Lt716aL5AsTM<@v<79Lw7@4UhHSkb8
z;n7sMWe*WekeXQj{dkA043rtYhWEx92+S}=dKER}c=D3ZG1^Ucn_%x<P;)VH<;>uX
z`S<xZz6N%GX#lXwem@{$p#iZqCCQC5iqfw+$yJZxPxySUXyv%&$fI+YzB-rv$sK8d
zJ4S`Q_PIiX40Rw(Al8m1I+;NCG;)jS#5hsJ_T81(bL(`pk&x_YsAa0#iGlFPhdlmW
z_bgsq;em(trD30ZvWXbnGhmT$a@@n5OXH=%>mk2oYvJ$pML2p4#6yndG|>(Y(W=J1
z?5w3%IA=>qgnM6HTy(+Bc~(3^r#Eaf9=5fb)=RR8zuCmb1t*jBWpG47w1^ej%epR{
z{St70!?tbyHpm1St=&~T<L0v>>sAI$E=$#`rB_@~LqsGROSd!nt4!*d2sX*W-n`11
ze<D>TA87SxNi1>NuI(?OADP5|_P$=9B4hTz|3H>@iMHrHEP(@$|GaejuHr^1u)*Q!
z<8W;V20h+ZKuapYU@A$MWeT+PEim9UagmbrT7N{B?F^4cBoB7Zn!Vf}4dzhto*82}
zl0HPTf}+hLe7EPrR!QCy*YyPk(ee_~w`)Cj8MoaHG*~$}S-j6q(EIU$Sc}B~uwtp=
za+F(a**e-{wLRb4&uhI;y!1R_n1sl9@5r;98-h7eABn5_>PXYqtIBGFIHcwKRV5|{
z$y0QCDD1SqCbm>qokye$mKuA?ZKW0yCM6OEOhYT%Y~wp<ksI&52b2a8e@oNH1S$PJ
z`#Vjg)(*+a5-E!@<{WD!zHIWQh0$-z+Y_p|&K@D73gtlD^B9s^*T5oz77w>K@RPq6
z@l)B>%=Rzw+PLWey4rTR0fY65x`<TI{fzB&uXCHO*7z}8XoBSC%1L(s?UVWz=ePFz
zMN3_xBPoEF_4{8W19yLbr^!u1T8Fz0=_ZF-=DpK5o#W(swJyKPYKiD>95g?(vJco9
z7aGYL4fG2V3~ZBP#pOMvImbE4x8{7~Pn%{kU#n-v&+W7bXKhm6;5CAy&+)n?^RY~9
z`cT_)f1^#z8?mJSUQB^AfFA$ts9vjl-GaRT(r&O5`~J=8$3=%HZl~XrqMQ*YgG(Gw
zQkib$q2n&+_c`t^Z~GM2Vw6IZHNPsqjoN`uk6(7~E|TgWrxcJ>o%K13?t+x%tZ%mm
zQ7W#kdML4F)*3E{IU-HfzD)HDBBHH3a3AnrV0k0=^AHY>ql1YD6k(yY!8Gd)-5g9P
zr|UhmLWVx6A(%)kH}F9|{c8l_O)+I(#FiIE5O78mYv3uKr>{0bDykT?Y?1T7XP+LR
z7H^uWMt7}3qOy2TX3w#<Iji0NO$0=5{!_$a^|gdd8mO&2(MOBvF#<KZ0P!GqK$L&8
z;+F7Xvi#?7@5bj$^CUIKLY!Y8WjgdfWpkK`_`ay~a6YT7#XVAV1%)1pDna94jt66E
zsUI%7TIB=<AI8Bc#N=PI7Z)d?YLit)kth_x-gRxA?bCKfSn%_FQEoL|$Nv~=P0mYw
zt{S-aCP(6EMcLE00ckytG08NQjwVA6_4)x|@u>-1=5u2faV{B+El0rnQ-F{PC)Y+~
z&(srh=J)Zop?&kr1ec&9wzE;ZBG2}&ZDvKk?>A9zNyDc}WO#zL3*m69IIn6~Ca$`s
zSr*QanOdc16TsZCsZPOpVmE#hc0vohd$#5OX4oT~Zg{Yup|3RAsCdRGm-y0U0^(AV
zM9B<H1xXv7FoX>!Z?CnxfReXGcK|@XTX7t47{Pgi7VSLat&42=s+yKBdsR()1Z_`#
zU*g?bEh^sHdDZ46&bfZ!NbCAI$gsO_Fi!}<vwc&qzwlR_yPbN__;yz73o$lW65u?I
z5m72vnKF+Sfpx?Hj{o-_5qTP+G86gAC^+zK5(<U@=Cvf{o~Qd*3@PPdu5OZ7%~q&!
z`&1_@c10uML#8sHfByMSGLNNGW6kSA*7_6XieZG+^qY(%_}>XU3JZ=++%`6+gI<%L
z@qux3H)a&@)wS99ZJ+7igulx}KxFQh$j~*>y|KD9c2%(qrk4)Sr(3y!Z=J@T`KC1p
z1Vu1GU;J0Z)g~s!Gw~^$^ran~ekH<+CRjzj3wN3y@A}^B%)a6wm>tBK<_X{p?lQHi
zNuJ7s-OM34jV?7+x}LMW2x2;AeTgEOXqxmCH9S~agl?7}=RN1y%+cvU<;s~E`PWE7
z<B4y$=%LcJw3XccG;iaZ2kxxgYG&^*w>^Bmu2ajRx^@i=%6Y(9Xx0NC(?x9`q^xMm
z8_IY_WK~Gc>IT-=d<pJG0EjcCzugr=$E+q^MaN%8RoAZo3E*9+kRLGkW1%9K3X*dk
z?Sg4={`-rtCO-Zw%;g4=JkFiH<;(PUusqNzeUp5KB`^y@<FJJQU`mO%x4pmO=`d2l
z^}f-lDUt$R&n4OfGK%s7@KDhMm=P?|2g#7Ju3%^b(wZpLWE4Pn`sZYF=*60nb(je2
zRA6*4S|~5)W$Wwa<1))>*iXds6IGY=Mok#lpR#8G9I8@{Ek@-NJ-~jn7*N;+RhFS#
zHh_55c}%<e_jkVNa-Xpp_ViRCXS1Y+T?wpyX8gcF5{nV2=AC22jROy=h<GiPI_$L0
zS(Sc%E<7xL913|>cvZHz&C;N5QN*!5%9vtZ@Xz?({&v)}-o3Pkfc4SN^X~grudic6
zj(@arKkr36n>L=BFIqN?=gI^<#J+XOr}z_kbtfj!U1b2#xL7mr+LX(rOk325xq6S+
z%KCn76GF3~O3D6a_QMkWMfz-}dnO7&CHtp+#saM%O-|MV82#?yOkQY%yXCRvTb$DT
zFA-^#0Vx2Eh~L|s!@8D>gr{y`^NkS`onSViLmA29hGNl;OSK6-7Hx*UKPX?mvfGII
z_-Qq2gZ2x$)HUYef6SsxQ_7+XD=Q!`O(#gbTZublcV!80!Z}_0T`pJWHbfZ({J$Ee
z7e-YsQDDT|nM104Y!de*0$G!9-d3DfAHZ-0S%bzUdREM=_-q6k1-tz<cHq^{dTBj5
z$gjHbzEXX>76(&AcG_9Sg7m;(x(O6=PDP$(J5!LiEDsAxKElSaby@*H#whAn1MV9Y
zi#-QKCZ}-RmmSwR(Ms9LHv%(!!fELNphoEq;E?g&tY}f4JEjMqQBV9AdX-BZnJIRj
zz+)BSM<a@7pWCDcw=zU7n&v{)*P;JZEc1N)wIBADc7%d!c&&fN{MUU<NKIB4#Czx1
zEsO8IB3PN(;CNT7fxffT;EP3*F3-k@E>#3-2xkt-uu|!pK2^FmGIbme7IhmaHh!`{
zUJH63H)c-^+@D*XGgn1&d*DbPg6z5F-9t%bF&I0ZmxxGy%RdMI`afL&*KnSdVQrFt
z)<lafrQFj8iQ8gVXmg)b!OS&L_usR7Y&EojI}KWyyK}B8*CSlX-ED3ed%=^JA>z#S
z@<qGdj^i?%2l`(KqtnBY!;}1TKcIXDP*dR{r@d6-oeVcutWYC&&gC1V0wYgY%hx&~
z{=080nB93W60Rwd$tKkeP8l1x-t}+Jsmv=J4p&a~ci;WSm@CpFGSG{cL%4(}gyH@I
z#_YcsG&7SJ-DOj(-I4w6D@gZv2<AR27>WXvtmP`%9=NM2hxr%Y(^_PTadN!6S}F5Y
z7M2A{)78a1ZoaeE2>5>gREGJR&Q%@^R34NLzd_YxU>EqZ!ZX~AnCzfs8PxhJ?iT(}
z+-=dj$*J(S$W)-zC<CWcKd>eoIE5uI_JvCc7T*585W2uQghr9giA)#$8BE)QcIbSB
zH^7SpMyU;qw)`Q}vS$yz;n~>vDS$o2IrC%|CKqz!B2TO`ucVf`@y6}i(*1V}SN@D}
zAJN)>wA)tGH|DeF9yjaxqDfh@KbSk2e|wcgQ2mcW+iQ>CEenAqZlYYXdXl7Q+9xz?
z`Uo91O1}$FQq?DqHAu3tZCZw5-sZui0S#Zr@)~F(O^&}OHOlDpBMA1RzwrD`p`Ek3
z1H@2hh`j$tp;x<i(sZ-k?<ddX{wyu|2#h2jD}f8ut7S(IE;bxTjIhXKtdcM8uLJ7r
zzr1N9O)N?O`^ND}DFxU0UIJuHF5>)2|BOg_lf~PIJm2ALMCy38Q8<R?k9rEJzWy><
z)xADR#WK?vTDWm@O(f!HXy0civpu%k1(x&ZQpi_u$ZiC~dbGUO6tfm!x<DqHY;`du
zxguO`DEhuV@XbSYC`jN_n_iO3^zdsEP&}Q>EwfWY6gLinoh|U=22g*wvl4MBAVFRs
zcx?3EKEZbpDwErZalU9uw-pgByCiM6$`rmjBq<!>wWHfQH9=(SZU`Pg!<nx`ck`5+
ze0hylteBmau~mp#lgLtUvhFoTR`g*bu;Oe6;D^Q;g~cC|wR0b>G~;yx%q6M=8gIz(
zP*AHlpOH-d-fw@M0oarJ9WmPFp{np!bw!Dt67Pxo{&7$^Mv(`Wan=S^*CD8p)^R69
z<>^q6c57>`E-I_hHx04GNde+HyFIPa)AOa;stdP!6t(vDPkUM+4miq6mRm@At_)Mz
zPIPJdVhf>fXL!Gol$to~3bGebD-fv<d@MHRG3zK1CAOdLPD8bDt6ccpP8<BsY9?h0
zym+*VVB?3KL$~es_p$C-gu(!hw-(=-Wb!mB+$WgsqqOx2Eo4jM9QlCPUsnP>B7npr
z>Ld$8ESch}#xPO%p+GPU=ZVcLBT$rS^L=YpWFDhXt4@5uuU7{uIB7a@y+trKev48W
z&q7@1cpP0+&ArO?dvPuQWKKtW7jB?`RBr<{S3#RRPk2o!jU7SyWlUCRw>kaNG*>OF
zw*tr_iX|PBXxuLw!=B?QVyJV@$loKVHr<*$`2hnM1YJ|;8=NwJF+d&haPCl9)&uZq
zV{CG(p2g_9PFb)a?Z$s@y8-{=Hhv8)*Tac{x)^{ik2v!cWq9*=f}q0{^gs#7JNs$Y
zHl9`_Bb?8Ug2sQmCBovMn;Q9*L%*#6(gyqQ?fN%5Tq59ruN8pTx~yBa|8eMsEfqn`
z|8gEC4nd{nZ4#xf9-6I?!(X9i&*7wV^17s@79U$KErDy(wvJL=P#%~7F6ZW&fbDC6
zMTR24s^bD6!9FKsBroxca>44Ms4(tPnZjd~ES9U7{A~S4&QbLe1nU5x&?>-7@wdi_
z_XEI1v8(TQStfP|rD3M#Smj#q=BLeXK`4gPqA{ozGPTZEZxeisvl~a|*1Ppem);3Z
zyz_alFOhKe{J=(h%is!_{nx8k%UG^UG+V2U=F+PVlV*OfKG?>yV`)o|-EO7-IhKyJ
zy4A|4G?IWvozDD6L<Fh}k002^g#sp1K8DkXu;yd31wXxK^d4s)wDw7m#XXs6$-xb%
z%h!^I71NP<U1c0%4zf`PzU81EJm{+16Rbh`!@0amiWmQAY0@EC1-WfIx_Qq<D&!FP
zcbgnOJ5x2i%x6I<^SLr6-_#~4?CxbfGur=@)Dhsff=f|#gD-Ben~Ga_lDmz08abY)
z2x$;y0WIkP8YJ!LEblIw`q)m|=xQEaBACuo3XI@=h}Ib`LSHik4Tk_R{q?q4j}vHF
z|6?M*#L$txX%^ht?hfwqi2p|FK%GZ{DbXS6+!Z%m-;MV{|6qAYp^XGGhk`2TeMk@V
zmJ9q}6FJyu*R#1M@ykw}%!_GNk9@;Mc=<|H`s8vlKT1?O)-Z?%<!i){hI)EBBB>Kq
zdbX0CF??Ctj<B5eb&+XV7#@()cz*a3KuyZJG;kzrE!HpghjVgxY+EGy`xL|A8KaXQ
zE_EV}QL^I@RmP%cvjd0l?RRb{_^7a!rb`FA1y>UhsBD?+vPwf;%o-SZ--)^O*P<`n
z-|q^3bK>XOq5lVwf!)*jZ#mY9)7O;0_qUIDJW$bK%6LbDV;4AI=aw=!@Ed#%5n_;K
zK$N?h!kt)Dtz_x#R}l?qna0Nk>bvCp4&h(vGaL{c?pHQr`S<^^^_Edlz2Un*2!hJc
zHFOFhHH0vPARyf$B`r#K_s}_%pmZaMbjKjg&@CMU4BaU(#2mi=-}#^O=B&NeUi-~{
zcklh&&-L7&>*5nMt!jgr+l`&G$~aKrf};PC<6D1tJIYN?IpS8=Q3Rqk!xWdq|6&f7
zY^I1>ppJA{I4ZRdRI}T9V-tZ|jQaEwmu7g*uv1eq)o0jF`0}eR`P*_zmnnsc0lsIo
zabB^FC~6^lhn^p!Z5dlvoi5!q?S$nqUG?`99*V;6iffgMw5oEw|1TW=Dp8QesxxZZ
z<2w&8EvVy%(>T@-aauFaK^tAU)da_t>v26-#vh{qGaIG>&m}WIJb)Gu!#o`13Tz+7
zjrTiRwg2CEIHtMbxd6lZM&~2bv=M~mKY8(Iv)6tKLkZyNoK$Yp_}es_hd<BjNtCXR
z*ygFK*HVJ~lyfHyT3fKFWr^+$xoyy+(N~5Fph(zn$SSh;*ajm@)$zvYwd#`CVnyB5
z{=*UJ#7x9W`hmXm_&M`8i4lh<9-Y0m@WEQZ0F(|l9VEyS+9`D+Ty4-4WZR9W1ELqO
zAogN9s}M|>ivPqx`2Nf4Ya>gW*R>7d=-AS}X~-G-){$zr9b^af_43#ceZF_R7c&hx
z-?g|D&T-Tkdrf#BmerxIPWYmB<69|CVy2wGsEftnJ?Fv$^FL6z|1H<k+=|vrJ6BW}
zr9>lYOSpYmO<b>xBS!K?5^`cIaiQw|^JYcqHtt)&Dg65^xJ7(~`{pGJJy=_A4J^%^
za&wxXex`}=^lUDrDgenR^ej}!Q!lXmVTK>-1Qhh?oN2rln~a-<g@^7aj;T#2O(fNg
zVNA&!oqhWlvaEElS4o5T*zZ|6raCzPHa^krfI4RHpkl&f`_6;!t-M1v?!Q;)(oy^w
z8c20T&SXTm-lVo{v4|KrK6;gDtuH<Y?!{m(O8DX_C8WAJ#Mwxoo?h;@sfmd~8P!UC
zVkpKt9h1AI|B~{x^&@DGCr1$v^i@31XD}#?t?dwj-cOlPjBj=&H67-xIwd0dOa|N~
zK=3yZCnfPNz@LVU*Qs%#lbwG{RsGh%q#hF9FKKVWdy5&b)%v#i32wk-5r86jDXt{v
z?_}ZTedVmkgd;)IwV3=<dC0MDRSXP_ZzY}k&-qhTulz?r5w4i<j{|2gtJP#`(^EL-
z*9aG2$W50s*9&*jF;2K4&8?&yRxI%+|E={8wa;*fX%Y!v?n__YTL=DgG+)g87dj?!
zhnzNnv>4r==PXqO9E7lUbnjouI~eOqx}4Xc;_Jfi4Hj-s5dOMypMTVfdIU;b&nyeK
zJ=Bxqm@VbpyGqvSEb&5ix0w$!5U3gASh($HsLHr%BfK*up27X`tP=Ta%z;*MHP;jf
zp-P$$3J=0U&juWpmX7&t_3237b>~E7jh^DnN&VD|<bBjns;nN@6J@OQeaFixhl<*e
zYPIE$wlA-%0=A_D7~Yr1XETS;(SbX|&49FBpW1726unnErCIB%?y}Xe1o=&j18Yf&
zILtkJ=m(BW*9AXKIyq!+BpqdS7m=4*V{8WgACQ~D7<?{V=HLAUm)q|#`1~mi()Rs@
zIjg{{FpMG^;np+^bHm9@!fZT+7IK%$D(5T$f|KixwZ%k&Ox|uyD+BsK&w!}Xjo!SV
zPaLi*Kj}5=`x!`s*svU4q`uoTV$n`Z1*L-JM1m$vUyMMdk>nS>k51|78&`~Cp;_*k
z?Y;?+q+cbq_wG|b^Li}ZZEa(OO=P@;Xv%^MCGcL-Sho~)9YYbLen7C*THWQoNPMO_
zXiHD~_;G+1I1Y6GN>fT7tW$hRS^ck9&hm!4YGFMF56h}A7QpVcc-2cKQAbmIl@K3r
zw^O7%d*s>AD#)*+%XSE=4s~*Bc8P8s)DuS1f@3L^C23up!*W?K!12#tLZ<)@K5;2k
zr6BA@AmIHG*@J3Wph0=t=_R^Fhyr4LS^EbEiLrFbJ}bb;-mdxuK%<;z^Y(Apl~<*~
zu~#Hq|4*Z^XFVoGmQS%h<yC_77=xgQ2S8F>qR+eQ00;*{VeRPm!e~$a7m_`x4Cl%m
zAEBr7#-1E9KpG_<nyzehp}<VGQUNx5vd_7(c0J8KDk-kf4u+!~;4Sl|-W*vhzB98s
zn%(tIw8ES#2B-W#+CQkm-_U%2eO$GnYW@8qs@TrR;UnW5I+fWq<81f4?hreh3t098
z8M0zhM*Vvpc<b#%cf4ct`<!VN_8dl6OxG7}W`t!mVRwsD7^<U`Mn7V}SfnvZ>(_<E
zY|CbVjt#1r{|NLNgPYZbpgxRM!4sz*Wr?0FInj!qmv$m5r8v>=PO&glj9%3|Ln;&#
zfl2EFUz%ZGj+&TOzt3R1Zcs5G?nn+3D6=N%Te~`CAFB$5-6<L@(M)1|rz4GE!-7ij
z>ASNLP)m7VQnaTFrf<#S)wA+Yd)-n;wt-~$WFw3$t6`k|-c~t54GQmKpE8I&(VMHD
z;`T_^#_KLO6jVE5<nZW!PKi5m{Yw)Vl`_GYTyv)~i4ksk{46`P3D=1_T+-+sj=ox+
zMqHcoCjDd7%Z101n+Kx?5wp>U?Pz4*Gy*M;Fk0>hiaW;hq&8UCHMv#t*a@$M9V;!w
zUaciHq>WNapl@DGIK9jg1U71U#8;nR69%BKbW9#5$KqKhd8erPV}3QcnU}j#Gt_hL
z7dUhoz-nd^7M|zaA6V+N-@*|3_ozy=l9+i#>W1%(syGrx=MNQDm+(6?yIeCSq$~CA
zc(ebRDxe>Iw+-=Q9753`2@~|b{imp=8ey6H6!rzpr?q<q1Ik>=4!0NR0B_;0JX?lG
z$obUM;l+T3RpPie3f^CB?tID!O`2BCDZM8Bf~0Pw2=Tq0`tK4Qv#S1WE9CwLJuQFP
zWMvwPgF1+J2$!>bCR%jwN&|6lX%@j44L2kFSsu5Fq{7w}!@v;AjY<fw)tr(0Oopuz
zC7-%tx2Z4k%-rY2Ot^*VJU29?!djF-qN%VOAur9C<o%8^!tvn;AO8w6o)iDORT(t;
zkKkL4v}6{~`d1qGsALvE=LVmd+mc517%?BtMTFtEHycEMze!Z$h#Sqmk-+n|alS8H
zQmvQ7TTCL(Yu8#wic)y`*{vJ<yTDyTw7uu?yjya_UMNIW{<W=+aQ6J5_>=bHJYRRD
zqtw&A2K3#T^@CPWpEjcFu<XsMkWRdcP4a<L=cS5N$k(WbvYcGYe3|iJtN@w=Lh*oP
zGp~A7#O(P2wME2qUxd0Y`W;MOvR`lK>Eqzk;l(R6v8dE!!Lnk^%-nCHM@-KqE;n?P
z7#vJK;aMwVXX7Ir{r83U>AEuc?nWE~<Zn*qAkR@hdG8M>^ij1kV?S%A16$cX^(ACd
zAJ0i$UZV<6Kg!J-JVNSJoYeXYMZ@FQOWP8pg&+XKFq3DVJOBqs<nVX2^2mj!BXZ>C
z6c`^dG^cP~UwOaqBIJbdVYPjZ^@!;6^88G{2XlX8`H*8VKYLFyNoLB1n04p5&%Ce)
zvtS_h@`MdFKDfh9@o4H@-Hwg%(GY`@7}`B&yZnCpI};tCNIAzZ@<MGJw-zTy{KWm)
z6n@@RCS6%pr_Xtm$SY{)^YKpVxQa{G6Zb!V?=zP>MP`0hRvVlf01IKe(E@6-zdAhz
z!6IDSFSorMjHWJMQre^+xQUDA<!JopHS@Z2yQ^sTe?a%EuJNon>%kYF1O?9y7U7B#
zZcz2s4Z_y{2kOql+D|cx9n~E=bhAn<Pm~!3f|5TGw>}9bfIm8EgVy2o;^FS1Ui}2>
z$Zy+zPX&fktH9RpeBNnNZvLJ~Rf@Iw_;n_r@$*xIAG{RH9d45uXSN-V%rw#&4yMAn
z-1-7mfz+>U-67wMY>*2b4}R*hd5fw9+_>A`oBJlyg8Yra+Cc|u9nT{8QnRoRo|&%6
zFRPgspN1C8bXiUSg|G65m^D4tGr8l-J7jdnr6IidJ=bduA2dI>Sqc}8q~8Jcu+#Rz
z&$l!HcIZZlqccmkALIO<6a4<K8u5(a5l-Qg!fSDz9H$Xo_*o{`gS?eZ)Z5~B)&(DA
zSY#wmkMB34=?2<QzMJe>*hd+Jzko{F7raVixU6V__z#?iIbH--3IbA8AU7$HdMN!%
z=&3Nni>=X`R6@aHaY++fPl3mA=*)2u(O;Z%Cr7J18x3CaeTy9f@od%A%y5k~LJKA0
zQH6sWGA9frbN9!MAI6~iH`wsdcKecRceK=oY0Ewf*VOLbzoRz()qhed$}+RF!q7E+
zwwcpvF+E#?ySO(V)Xur3I2s;&G=j}0&xn>qLpz&-FX0K`6g>=gzZ5tb?aCzKzmyLd
zjwN;lL&1lMF>*tykFFHS9~S7zW5M1+CdB`t>c43=)8k_M#s!T`oz=R9A;mIDg58gK
zFa!_t6Cc=CbCLY7njDC5=KnXV{sS76hj9&J%)w(Tym^9vTTWJ0V3~uTcI!W8yeA4$
zPVQcR4GMInz3IRVkJoMEoF$_)?|VvVM7~|~7jE>r?)A5vi|Lmi%~&cs3_?nRBCwYK
zeWnWM`;j>`^R6*`xohx)yIJNe?tbgkEtC68)W7O?U*`+Jw4LuDrDK#K$MhFI_3S9?
zOjEB}7QMq~F_ojbVT-YJNV$3%#=(<M?ZLzEKMOpjKi~^6YVQFahQ@BE-bo1dN8r|e
zZ(IB&^yW+FL;a#;GfFr6ap7@Y7-$|CF#{e&&um_8A6M!^wzh08CH?%2?wS0*P&CHc
zW;`Evb#~CoX4$Ga;4wP_Km4QZvcjkpXJc<hy`R$S*IhBm@zR5zir=Jzb`<mTT<r>+
zDsbnYmsJi8r3TsoBSqwxJu-~;V~MF^`9K&+`yFz|DR&<O6l!z`u_k}fqkdar_$X%Q
z2iYuFt*{pn%~SrEsrq};_9+t&qJ)5ca-~UE4lH-Gdm-{Uqr|x6PxIzT`%N27N7Jy6
zga=LOl6X%y5v@FhVrAbBl@%Yf$L=+gVeF8IC1}>Vyf`9OkELIFrk@2G`mcbHv!<!B
zB53kq_bGU!|IvO56Evq;;5~pl+MqfaNizz%h6`}NET5M=ZxFn}#5J0#vMWsNdo-7)
zuM$#Y!TKL|od`cPzV<{;P;0#dx%dje5?Y<#dOPdf{eqQN+%E7zBTN-f0_<dDwO)A3
zOrUzsaTDU|dT~k}HQK4jS<&H2WcdvM=#s8t0{`gw>$3Sdp#sODxR*ytHh*~4^9;Xn
z1VQddv-}b*{$~7;#eXP)2dX^zSP8W!FTE~UFSG0$zq?iDxx{fRx58<*MQpryQ2Tm!
zs!shg<FkFN-sRBQP-GEA-C~**lN_E2#L~ltgQe5?KYM095sTx@7;M<cYRAb}9jCW?
zA<!7)(7yOLJ?I|SNBg1D=zc(Bq5U4UyN8=2vHYte3%|SWCYDa*C3@f(W_-VKRjz~Z
zd8~?f1`{2~zM0nZh5R#Tp`5;bx+;_FuI=ytME*>o=l78I2xI?E%J$#pz?s;5bj=Cm
zVY^+AVb*ldM1Qe*KQn+qr0s7WmSkM8)$!e7AN%Ey2`Vk2ncKDwxViNq?L1JjvgQWM
zoo7ln;55Z&$kO447<PFk);@N8W*T}dwA@5>BvnLk0DcI@4S+T`(=;yd8Dcsa_BcLl
zA%w2w5c0}Se|s9+?;GWj^-&hL(jG$JG%LpZkNR}lFAX5<8_1%2{cs#f&@g7J>RMej
ztvtM+s3A2q5dMw<vuH6;s9K!8S$MEy_=vIfdBAAvs@S)ipF6H<_q1s<$<6*&2jXS@
z$nBY%jsE(REDu~nsIwdW;P6Y~1t#cdnt^e4DP7m6S%zh8WO}{9EVq9JKSiGkPm>_g
zwkQbD)2a!4k|gi-1tQ_YL>Vq%)zKjD_c}d{?h%=%=CQtRkX?{d5*@*Vv5tC-k?5Fc
z0{m71j_Kn}_-*b2<y|Kc^prQN$*mo|BKSFYKBHPy^Yt{u_ZX%{6isA-g0x}$w4vP3
zb_r63L38U0GJ2d-f`*J!y%9VFdSX^E#tuE9b3w??Q#8jur9iV4`tkf1Q1^YE3fhcW
zg8Ox{@gr+eG|g}_YEjzbMaff-iH><|(_yF8fX4U}zqxH853BFpml9;L8QpL3Dwk9{
z9E|-1gXv85u;66lg>ooy!|13ezLFM@+->P}cA(rhgAN`|tm&Q(&XC>LhzXe=)_C#9
zx(_++zQ*?%jl87{A7O^&ZIDaEAlqI1WpyJ&&hi9bgeDw<gq2P+?3x>*4-TjI`XqLS
z76mTz#t=s35)jW?RD6BU-EzeCGz7KmBIl8JP@HUny2&YxE%*WRwcrU?1=I><Qxjkv
zq_|y*Og6)T;q9lFCMHRk=_i}PYAK#6#cP>u1dx{@r(@ANx8kNJPLHKK8!Vq=24vy)
zqNSVosZ2i#zo_UG;lIQ(W;oPii&!&x_q&1@a<lFJQWd$5?&7_BY1B?8A6ccW!mc<Y
z-0r7wRBCcRJzbR51q_C4Sq9jA4FL(ZU&{vQavPeqUH9gEx<4T#^grQtzJ5x9+q&%8
zc5d+B8||&AQO}1I5P^9|WV5s@+~kH6y}5UuV>@;K2XQMVXLLWwd%xZCP%9ch5ai)F
z&!ahyY>?q4O8JTTsry6s_6JK%noE@FyWeSBGvO%f1q`?W+<y!2)9PR6lEfU1&*wt&
z<4JL6O_Acb5-UP>ESai+jGodXv6K4~Mo)Y#G7s@>J~<B16=CQ_5}GP**g;Y)>-~)W
zgWci>w;$4D>}1p5#WwX#7b6GPX%-6(zX|Tdw>W)#<zzS~*~t<+MI8KzJObwt*az=;
zF{!8DbVgLIWp4W+JNxd|WdE~jslv(;JnNe1R@P<4j0~Z|J`7xYJ;lwq+u=c_3HAy?
zIwoPnICYS~g;l#bIZQi(cvA384PQ>b2qqX5=JJja^TfCM3sw4BRbKJo3(eQTItQ?6
zOO(MnV21v0V<6A`@p~+hoz3G0=9H>!u+eW$S;)f2xRyd_rWlwPdUQc7B5{_~eNGT6
zlsm3Iuh_BQdE)z5B$1GiAw%B|t0G1_#TBcp_A}t~1Unqqf-E5Y^7^jK2v7r%Um;5`
z`g6TqirM%bEX)HakFXk99BMB&y1$Kww4!v69d*%PUb2v(%hfN=2k!TTC05EG5b6xN
z5T6h;;59`0emlO7VXgfp+qhmAfzo2F5ZT(apA=L;r^G?8O(bpf*}5+r+iNm8Q&Pq`
zDtl_BlJ#cw(ur<{9M(R3tAzYPL>jCUHFN^IopNZDi<4{P31BgYC{y(66<XMm5VdLs
ze5i#SJ%&}bP_5WQrRKtspof4>-s#-%-GZ!r2CB1q+ndS&q;1goWAo1m=)bNuFmUm|
z8ImkLvFv_zr%JUwKN1#%A%j^Vcp)c!YR<x|xT0vsU|xaW0!$X3;7|zXoAWA?mAICC
zK%yu2bOScqCofanp*<1Pu@b=-cNav55x98Z1=1q}#5xkPeE@o$%ni|-(F+0X=ETr&
zct-kuX#OcsY9Bq^H{&W8;%v_}gp{T;7{BUt9Dd7=gU|iR^5e5}o846q`~5c$(zpWV
zzrtI)^nU%^v(rvqGoQi=5bFiGH-qvcUSDhpuVrlWWKE)-GVx!>_00Euzo?6E@_gqA
zj6UTQPr;)O?Tb4l-!1SN=3FBE<0yYqAiQWiZ>je*@F{VJTt}mGiXTPqDv1!jX|8Pn
z=tK~2GAPJGFli7sWheym|2Pf&SUgK>&tN_&Cl_<Z!{j#;s9#kRCcfn%l1Rx~J3Y*e
z(g2?{bAg;z3j~oE%5B~Wqnp7Y>e>D~8AZV{V)FROSd1aDo*dj*V<Iy%%v1S6?)ab`
zm*oLa;F@5>vU`*N2O#@8i+eu9-S6ej$C&avnPy<hZ=-&$11DgS$wlEDER3+%H_z7(
zfBc)3qj4*XR7Hrj_iam_hiKM6!X2EwM)Z#LCE+E;mO8|x5j86zSci7+VmQ)8B${0l
zeg!^g834M`g2Do#>>dnPx9XLp2=sMb3&g98(q5{Pm=iZTQN^yc*UPdyYl<-_vC-D8
z_ZcciRHy4i2%DzOG2)bnjs`zAragXtP)Wb-rrdF82Q~5vSKcBS?z9RM3u-)V<ZE)I
z<ZD7)qh^CComNy0C%;_rA0h6e(C=E?zw6ti6ZmeQP__jwA>wN3n{Vo+zy^HnUw>}%
z7}GeQyG*Wk7Z@`EI@P6fILH$CYMaqO(dCrnJ*95@-85R-a$(4d8`(V)p{^r&sU=yA
z8%1d5b?pn`^~6DMs6RwdY_8uoY&B9^qWWvIww_c!>W>|Kf=*>CLnyJagxNu>hG3~F
zp};vhLw|))kHC3gR&)YI+>)fYwj&L^<(n`0Ov*P7KyP}ALUaM{<qtIj*x_7BboGhR
z)Vq&4ADY+d%O~&{{3cKA1)kFD^~K7xaL(hHI`DTsrN@nPRu*4{#ymC`hk{?9X8w=&
zz)HFlnB>x&bscnzp7({B*k&KJ+2+h{-;6*Lv#`mOqx!0u3&Dm#edfd_Kvp7>AiRWk
z^yVO8zG(LB8~H$QXOhs+&ud;5WFX2{Bu=E*-<&PZEEt_bnc3h{PC*0Uxip09%1waI
zWuvG2@zKhktD~boS0dWm7e_w&^)tV<wM&2N=;{_vJDrhQ29t%-HFvnCfdU*Uhmdsg
zQnB5;Jjvf|P~lRq3_G0Gn#?sV9RUF+db!tYLwEfKOC<^&SeP%SbVo7-H&AbuMgM^a
zKk1I*Z-c%Rr~A4#Z4InEIFRNzA4W7r@j81vd)y5O9`P&()QA{U?Lc6!2i$YCP5w+q
z_*EdD_f_b@zl*S`WeTu4NgQ~fJJg=wGic|~M|_368XOeqRr!d#t5cGEYtC44G5av5
zJZi4QxX`vYW!dFjL!e%$x;@7+xh%<8%gY@X=yh|1+-tvcdXx*H9q1Yh>1@RZg~!T<
zdCrzPLj2lM^niAOCYnRCdr8Qnh5q3X>o{(!lK$9Rv1kM_IUK%pz4#S468onRa^xy$
zUXzFjqCK)Tx$T`MydNhN<2dpbB_7`#w9P&bX|HItFL1z``0=jI7dU>I)}y<A<yfdJ
zrX6%^0gUz(;{;|NoX{=kL-VeWA-52`Zr2p4)U1wv5_7NLje^2h!bi#`sOZUg5ksn&
z(#w$~iZd{M!s);FHrs#S!dG+3J<%RiAuI&}et$#p`{IsaShEqleU}XVukN<dNoX!;
z*NN-T>b-*a3ik%5b*ek)Y~A$iTEgvIjo|*(&L+c%@b@2A<542QM@H9asbPxavI4+)
z3h7LNLAP&D$XQjNYnV*U>UZ^5E{w)lknZ6&iW<MBa>}4Rpj0{!uIpr`Bkx>fqeX8O
zEd1++WmH@G4AeJOTtxUXUVP5h-KCr%TLHfS_=v5@Z4|gqr}ZeN6jzfSBx-k5TDInY
zWIxDH+~9s`Gex{)-`|^~UUj<NpfK571^E^+<UA@r7uVFf8yIuqv;OTY1UIvz@w}Fd
zF-{!*y^llGFuPLdLNpPEc_#MENWqlrnSc^4i0DEVNNY^qPjj;Xc#?x;iswDk1K&>K
z$~(*dz!)5%j3(ZUPyCALJxPqw>Zg28_FSPGv9zLeTCi8_!Fx*f)&tk}TPR;@0rR!b
zoo1#Rc@h{pp)x$VZ$jPhI|`xc_4+;Gw|7wa=~6!~jY;e~#$@?{;pWbqyKC5Ehc)V{
z3%OyCtb8!L)OJd}F&AaIHo0H9DpiM^E$=bFsRE~Jt|4#vv@=FG;mbT__ACwzt+6nX
zxTRl<@TsTAt$vTHR?0CLhtQIt@ez~Exm#*qZ1!!$UnJl1TeTmBUm6lDo^9;fnmbV#
zXiJ_q!C-{W#*V&feQGOrdJ$ZnhrJ1SOTbx6fQPY!PQ>l7<-<I9VO@%ln1SAH%a5yz
z_d*WOSN5AZuCuf3lmEH6pId#3XG%pfkMC;5UNk$WMMR2!++Z@A9OI^6c}Fz=;h%i0
z7H!y7Zlm7gkh$Bk?b77j&o}CyJa>MHQZV$=DL$z`ut$Gc+wbM|T$E@gW$Ug!%n|Xo
zt86G9G&qluH1rjEZ$V?6l^8r9xnC#F5Z0if&_`@(Midd)ltkEm4$R5#l47vDqu?iB
z&FY5}2cr1sx>kocgPYbVeqbnZniwuJghb>1`0*Jp)k@Yu374N+P!KwM{H?X+=M0^g
z9Gi>?ABICpIaA9GO9RC5_xY2gyK^92pTcL|RGxwIp<2#{q|o>XF<sG|Q#OwgHhS2g
zKgLylV%xhiAx5K4O62hyMV}cp`GqGiQA*dm+K&=POFcv1*#_o<dCe&c*S}Q7)%H-B
z|0Y_{e^O`gb#Rfu%+MCBl!%I5{)Y40oc-dx$>1{uZQ9AWhp1b^()RM&Ac*?mS-hVc
zO9*JHe0p!HQP=rx>r%zT;^T-CVw#u`!7%mnerP?5YdHk-Yks`N*TrXVtQSqwww~xq
zpp3MonwcoCji4Elm2^!-YXvWdF>%abP?z_Kmb#zd)9%H9@xF1p0212dW*~17gTS2s
z5<72-qkkc`sF3p};#Y869CLt)adutc^k=D<MO!M8R^%+qBewWBj%k)5eLsYX6d@>4
z8>u$w=d~J%H~RM9nRIb!EBY11`stbo72C%baw&XYM(Hh5giqD>v>k9(sw*1*I7qGf
z!NwPY&%PwdWU_pvwz2kEcB`ooNvQVW((*k6dN2;Y7Q5_~HB!-Kcy4Zkx6^4L<ag1!
z{E?6U?8o(Hr`Wkq%WUn%VJ*FdYk-p<qYrBlN5_ZfeP-!uEyx}HS$;yl#7=R2#7x15
zgNh%<N{(DM2|8xqco087E_$1BL8BK4P%Vu4T`-%s8$*OiHg@@73~sN3c*8=GEKr=-
zO<=tg74R$rD8O^4qM;zb-5nAFp3I66b6!%s$^vKZk{my8KE0+7yeqSm;}}%Iuu5UU
z<{0&S2IK%F<VeF-d2-X3mYvVSYpYW*<loJm;L*m3|9?gk1b&9&K@wH=s2-|_$9VOZ
zm^hulXPm*dGF88!pZ1+?zt3WUgizcn>-_o~bSyCrZmHq{FCYx6$kEbf!UkRms%TdL
z+y`~#kv3XO*6mW1W9-CZeo$wV;srjQ`{+Sj=o<9~L)->8hztKTom@asVQ@!7y`hi!
z?X!yCipwXb=`@w{vp#W(=dP%oWvMSpTl1_$Nfz)TwHMm=4O7@l_z0XO-X%C)hOe(4
zUl=5}HUxe0qc%wLXKxSsd>J<Vh#4c>Ott}#t+!e)RV&_~nB0aI`L{d_dgkaLCYsyP
zg{Irihm)~CC(BqQj^^q?olWzWtF+3`n~F3W#Mt4B{?^X#v2j+#+r5PkRgot@<i<Zw
zd3~BF2sr?46}V=89X=%u6?S$&J}-#y@Y_|{9edb`$3ArQx4n~JOb=fQnCa_!Gs;S_
z&*e0wR_ZP?#{@MtZS@|H*xtK%qaev*nN_2V@Vo2+@249kd#9^f6BNiE84LaCw}3;{
z{?Z~GHBuLLf<2$Gz1^oGZ~2i`O)D%|Ufr5>y(`DxzU%A`TMK#uYGDzWp;K=G!cK}g
z{k_EKf@b1tBmP>{J)5}@)<XCI@;loiM@S+%s<qcs?F`%=oxh^WN#)b0><?Z7cvjD!
zi+ER0Z8?wTbW1ZB_WT@Z6aS8t?Y5|-y67CfFPOR&##9iM{+xe%m@3;1&<G|C?WCnJ
zgj-97^*ZJSjd=&U1KUqUjWp{|6!-H9Rh;n@7+=c|DlTyR%G;1xn;o<p>G>4(@@s>d
z$asnZA+sV^%?>T5c%*g8dn;84w|=mZ(tgd+n2CW7OjDBED&;Fx#oy&gY&`XN0r}g%
zgkm^zbmHphlDOzdLLO7o>C%t!o-K8UnquQX>ba<YWt{Ya)-J5->KxlK1l<u<ebvIu
zqzj?uxWBW8<V~&Hy0VG4>X)?eEHlmI!{S5divRE$`FXtb^#eR6uBQ*W)T6#%Az&z8
z2g!O=IbM-m_mS^3MB?Gv;qq}ci<pL>`R*+bA9~dd%O6zf*iYXc&s2_AY9$>rTU{t}
z4>V=56Vh~DiK>3h7jG^dT7nWJh;olr6-Y|9FbR)3$kcY;HUQ{$B}-i6&W-wUs?Abe
zqnl?OUi`MTTl51$?xjS%)>+&#MGoR85+&bse{|IJEJrB|j`xn0GTcu<c!Jyi*&?8`
zrc?Uei<cLA=8pOGw~mvG`vD!4M;v&Svh6VccAv`lv2qjZa1#^Ql#i;&5*ogw{(EUc
zZaD?MQcD8L-O&AU;qk|}|1|c6?H?)|VNAWQ`({v(ll^STJy=L<4w|%**p&QOYdNZf
z8K%CyRYA-ijnPj$Face=BhaPHTFO0rfo2}~lI2%c8TtYe{<6(TE)i<Ql(@{*heBa0
zs^iyME<a#iVlRoLV{=9~xcD8bRJyWCh8|M87q$kLADaJL57R-dTNkIZ6~r1`W;7N9
zRuK$eK=BMrMDW%9d2+KzS4{J!%y2Vkyx?}HBWiUFFBoEi8vL|WMxwwORu>tTz^3ua
zFNc^`9X-Q&*%N(M$DV?FuBZC2bd5UU>zO|9k;sigTDQ6ylGch)iKe(SgpOt)t~y;`
zcpHX)^)@Tk`Ou*?727KS`~9UVt2+q2_sIk?y^&}Rq^D0^T4Kkl3QtC<lhR4rrH91Z
zgYBUf#Z{hQjoE$ne~X~x3lY{p<9O$n6bw5zKb+kO@=4bL{+i!|h_N25wFYuWN`H*;
z&7%?S6-$m*x=18DqOwh3-ELJf*H4$>NC&bj#-IbyXUO+8O(<I`H(opN07+9Dx;N+5
z@m#wbzTReA`2~BUcMVWpXd?)*bRb$;x^Lm#I=z|WfSNVMd+_%><P&`uz5gnfUBFft
z+a&}b9gXew^WtGsD@h7#j0)07_rGafW4J$vfA9OpGV!+%jcezK$`JgE>x6t3H&pXU
z8weY*v@{61<DvID3m;^%cbJzRQRKE5wkjZoxSmzBA89ZSilHQOE&2a6vkPzM*uN0T
zZYPub&RA!r0^ha*yRLq$zDOrIzs;aY^W`@Z`Q7pM-Hzr3XBJU1EoIQ?rc_?M!p?w?
z&IDGvdAiF-b4SL~Etv_p;1RPtpeM6$_)2GT{$>}(`Qu8ww97i$!;fnbrB!&29GDlG
zlU$pQ+e%9x^7)pws4pA`t$J^0b>x8bmb)YBdIuF?I_hzyN@-mahEmlrQE{7jO(7j(
zLe4QA_0FI8PYM3vK|SGgpm?spp@|75YyIx)yDmA~v+&*F&K(#&418F+?A-?SLOzh>
z8ke3{mgo<E{c8>T{Cx<&%Spbadp@eFrWTvzk@Zb*jursQ19LrCzP;)x)P#|A&2brZ
zHFsWW64O2VY0vr>Z<iK_ND=HtEJpjo6}Xe_{;{W5c43}Yyh>}XMdNDyM^eWEMl0<I
z$E)dbY<0n}mkml;y)s0Hk=r|D9@BTe!tte&rzMX%>zV#9(e3z@0?>tv&<TT`xU!=Q
zr8P=#pmKMe#Z~e&vDitqi9?$FHtSb@EABshKr2v>(5UY7#nRS-C4pnev2tI(O$f-X
zJ=ZnX6?J{HLkmZ4xNxj{HaYP57ygS=7k_Zuc)X=8fbKSV(bDJLo|m~xsss)bQ|hSe
zRXn*snzyM5)l6=!BwE&nY!cWh9u%JD84@#iUq_4Lkt~I<c`8ar@?Vt`h&k)tZuy0@
zpKaNfYGYH)=1a0dwo%!NC9|rRDnK4PdaWlDhWvCQy-mWN-sAqWt(d=Hv!}Phx5)zZ
zcDfk~>)iOe+FMt4MZdo9Ej=}OhOVeNOXa8Xoo;<$0GJK?LWfM-o1($%GXB8VQc_v|
zoqgM`hFLAx3cW7Eo@B`|W%}rwk=C<Fl`XbA#~ZZm;MFBU+n_eNoT<==I2~svJdMLL
zq1UMjngzQA4A8_4Hw%EAF{GeSp`Jk+XCAU$izPrBRYcHQSK2(8lDBK;<^?z75gDy0
z*lF|PQ239~egDS*i-dPT(~nHw*H7c#5;DJ$U0u-4YATM95`vw{Q2<$*LwLNS#blmq
zba%VYI+z#hDBu`BjE?ekj!TmElyd$tmRQ%m^dC$;**CXG$)ud@k>Z{G{R-QF_k_{4
ze5z`{zWjBhQ<KN=&#a0){*pm`dwv>F3>0rQXks^r%GP)?Kr|exTV7mRqM~5S^U->#
z%y_O0-mrtazy$HUGIK|tNZm^_glM&2XSDk^qV^fYi<N2b6|?Z}9Q_fu)91IIrHHt!
zKi!!R5{J+`lYp!4Jz>dfV4c~uqSj9>p{?gE&o*FwNJHbS5m@}tX@VqL&xo?E;=(9h
z-{Im-0H6|Bhwdl5uPRt?6OxEv)6C@Ho4(v^lA9U8it5XWL$V4bPR+L5oDi6KkQb*U
z{G_?mKuR&ZZJkQ_d;hy?QM@Td2nQy<n`i9fKMxBtk65}am-v0*;9hFf4Xhs1scy=R
zS<=d|8te7xjyb8rO;ke5Wo<va)%df^)qK!!W0IFEv~VAl!Y4<2xUu;x>!ftF<;~r7
zFi2Rr@1(F<U)*#`ufrnVYg{KI0*>@kO^6uul%epJ)MB<}m|<(pa~(@0Y59B?+eo8m
zFACpiN}s3%ZD{8m7eqg+vX8rtw?~U7OL$BzXjUz4e#^^}2BeD9x6}3Oea9I3%EIFf
zS|@=Y3mv=RO?t;7JikWyneS|en<6WB&4*q&h(6!I%B+)n<(7<s>q;*(yLoP^_w|B`
ze(vJCYJFf&c{kHwGcq+l_#2+mtv)&&#Y9_vj1B%IV#C~5fqAGf?1``P;cTZ&h3t*>
z-~0^5Bw}Ol=t@FMaU3gL&FDKW87|R&v9^3W{gpVoDfuY+3mFERK7Am^OJTR7<()m}
zaF^qhz>U2uLi!X`kh(zcVGxB&iA0C(UW#Z}(DS<pLWW9-nO^MdEWw*eXl+otK^Fd<
zWZfvvLsWc)4m$ktVW;4+IH(?lYx*?_$}4jJC2miX+Xdbtx`uMu1hdZ(r5;NSMk!KF
zLsrUdJmyX`2#xFg^$A^uOi%o)pA2FWhtv-`er^>hl+?~1^RMoDc^~{(@O)4YQgUm9
zj0t})l>LvKu)InFMVWmv!fGgop)!60Z{rfZ8ifD_uA;>>%BQHooiD0vjuJEvTHGF#
z=;A@!wf#8~4ck*acRL-SoyzT-Vc8;=;Sd?iL1?JjW@=>dUTSuU6`44awL_dF#E+IE
z?~M-s=y}zTv|pA5NT)3Bzh<(Jp7byNsV{0!g$o_zL@!!E>_4)|EiNU_udg3{e-aSy
z+cEbnrgJ8MCXk%mxv-wDs)q*GlP43I7lJj@#PP~$tJBNn!Buj1t){-IV9;Ov`CJt-
z{(HO+9^LaIu_s(H=f9a}$yA%Y)$1~x{qqX3N!$HFFCPS1iQq)|pE9{K{&sk@eaNU2
z#SCaSvR>pk#7U&_cwONkGmfPSSz3_H^rXpMTj%LsoVKT>oY?w<*<kxlo3y^<=|6IL
z&7Da%O}sN-|HvKl8@}Ich0e3_Y8JoZe_AIMTpUmY5HD?pL1#yoa57oS8mtp*N=0yl
zpq=^dOfsGeVMS&o!3N2VB7?qPGV``MZ|Kv$EB4=NOBffl-gc;&)_=!?c67(p2I*$v
z->tb^Mm<V+5LsC0TVm9(uWE_gJ$$*=0~1jxQ6I798Tp{G0Ghom{@lO$={Vo09Q4Bc
z6`KUgl*>V<G{=#yF9Gs*1ZQ;V8Gzo@#oU=jKI7b;AEVvc34M!rh#hqe#m9Q!ZG^7a
zr*j-wyL#^NRQrJmt~M+E>Lo@$r`$c)X%P`%1~sB4Q`%ZkaA64;YMl}dJqZxtF%>b6
zAPn8ZPWC$KJgVjmI6W_wye~%oJ^I2vk|+p{`BHM?H58KNazJ5W7u_hqQ)x~-(zlZz
z|7ll!uy0Z7M`K#~Pm7Uiaw~ld6a)r<UiKa`1^I8;ey>1;ENIqfyx$tHGq0440G?jg
z%paAbt!*<(WWcaVw^jW*b0PoSa}qVJ<3T>2IPXvVIOj7t7FUzyJ0o8G{ub`S6+O37
zv56OJ^;|185^`@(oPI>)T4ySU-zx4Lu!rBc%B~T-W}=H%lm9-UdFMkHaFE>8hS_nt
z3gQX?PJa1w)ZdYYW8EPgU#g1m$~~T<=*Kh65g?fC)W^eSZN?ITZay0UDr6FntT#I`
zmL(24GRLtG_imRphu|(;ckZ{6MPi+H*y`PNq)VKR%20z{L|+K4Kcj3c#&+p`ilyiO
zoFSOELLpaS)m=GIAjHut44S1m^Ouw&O+*Q`8p;N(Az4D$%5PvM$)35eed!WmDqzuM
zVup4BA!&fV&{QLm$yAlD!C>b?Mgvnmijr#3(FXDZ-ho}P^ZV!pT$qs6x%jiZ!y_%B
zoW~!@uAQj_{}nQ))#yIJLeWL??&!np?KIjM-HN(|6;EGTTlR~HLEGE!h9G&G*nmb@
z%h+yHxZ}{f448~3)^^j0Csp=5_d(qf5pAOU_05*>)F^`Cw%R1RfT_iU6LR|4ORZJZ
zN&Mh@VonBUyo+_b>pg+&Dw_;+cn4m!qFVQk&LyvEODh8|$0APsq6%0Z7EEqwoZt73
z-7h^J?aoWy=2(cA{}D1YG%l*fejDKH`;snz+x(xuD8kt1Au!KIwd^_?`@buW6?5w&
zt@96hzg~bXiCQX>^-+^D19aVJ5+^0RQXoiv2X*Ctp|zix1L>6y7wA3>+A-1eU?uzf
z*&?=_<hH;*{$>#Pu5XAY4s4gQfn+|20mZ=%D}{(;uzWiBo%_bZ@TUb~RwARI4R!`I
zWO5@stbIj=Bxny;dUQ@s8i*?`pho+?e_MLv=G-j^+hH}ZQJcnVikZH%nXzMCWh%hb
zX)DSPnB=_LeQKYx{xA7m8%Q-AS`XrOD?|iH8y6ocKAyFxmNO7r${p>WogK!Q8?=3C
zo5RtbOi2v1=}ymM28Q?X;oHmMEX$G5$Xl>+Zr4i8!Lbt+r7ymh=#xr#j7ej;s~d@n
z2aH!#-#)V}EBmu|q+;lN0N!yu5Db{4(x((X2Cjsl!`MV-6r7=99$iKyhAL2|u`hVd
zpK@Bb{5QQyPyccqV%~U31z~V6{@hqMx+=jxlz%gr-!Qm{e==50v~)v#@n;k#z-JOG
z;aw~rc;e)3n8)qCgz6D`RMN-rJ{vVd*w+3$1O$}u_obQ*DbhtRd%ACgLdPK*hqYsL
z%=-x`3#~?zwfFbrO@5XY=kCivw*`=koaY5jZCXuuKbqQKU;BAF5nRcLwx?uu%7p7f
zbH{1<DUuv$I}ALMQ(c4ko`@}9ESjyaxl$ICI{)P0)!JBIPHDTF?!O4*^)vQ+_@K%l
z!*^7hqYBGh+h>=&nj&sIWZzw^+fQw{drFne2XHlGg=+?k0^w%j4}|CfwAW>9CA#;S
z0DYi&#SIL<>p-ai6J;5&Wy!hF_LDCPX#j?01nd)zEgQEbq1oczw9JOkdVJEHEm<+T
zg=-yYDKNSXD!kvxFtZmRnV_i3ome3Di}rKifZwnk^J|R$RIx~2`6mResBW8AN8{c~
zCvKtm8xNSLR%!&cE8>Fi-i|tpqu3%Zto$h7yN2+&1{+^Ef;#J$cu@a@CPya#eR}1u
zPMlN_Q>6P6GhfTHQoFeelrs!fX_caVUKcjVx_H)u66N&TGAMR6uHMr~3aQd~>K_D0
zc$o&VEN9I>WKsmI2aTM{<Om`Zk<6plo8?onAx%zYJ+3KOfq{4%Y)U}OttOg?=iAbl
z4BpUL0CoJgCz88`RM}ppT(px;qqs&qna(ckqjjrD8<J(V_l_e!2fWgWBG&1N0y!-)
z3R%gYXGUT#luy6jd_O0~Bs7j0@cmWEymealcpod7=q|@)h=)>*GKq`>EZd`)ZYtHr
z%quhKoxL&|NXFBPyZO@)D8ff{{&aPoiyjuUU+AK7%T%dk5jy4Lu=`-+bKBVWDuy1r
zXX6v*=ok`7KM>hdO;p5J@gm@6)8Z0Isa~o+tCf4?mousF-+sSbJPo-&o!+~ZY|;0Z
z6AN<|S41b}B%n!;bs(F_?djvCw`C6<fo5R-*gLbBZbWO-<8=0>y~=QAd1dIq<X2B#
zoN32^{Yo0YzxTxfdx-c}U>FS0z4}G?v~nOpWMdW6+;MT$wwr6$qk{+`1R@Q`g=UW1
zi$S{z{qq(EmV|JU(8?|0nKuJw(hhVNE~$J0&@RYj27(M?%?|Q*p>Mz2G$DcvBrL*l
zO@!!$r#|G|d^=m;X%~7yGYX4r7J#R2^@$2?E|<q~d_Z5#oo_!FUa1))2agv`|8N4$
zL9>kFvATVRRT(!@IQaB?)p~J{rCEfllR2Q!t|t0+yYRX=se?zfNgb)u7t2@A@sdY9
zN%!3Fs8aTcgXN)4lfg}DhM~z2M!%nJV_DYtj?cvx{#W_8Q%9y-;$SOUxN|OtWQ0;~
z{b;`0x*0VgSldz@J64sGyGdps+dJR@8W}C7I-i1Hw{jX|{}&d}Of%Y`EIa*Adr>s2
zF;?<-QP<ktlD*i|lp8*VLMpg(N6=8k1o`ugxcQVs>V)BI#qMKR>zZBQ&y&Io%vGlz
z5q$9u<QaJ8l^Rxd6`qoKRZkFUJMx*Y?g{L5mY`|#!#QNl1l5Q@qtHu!+#08qGyZ%3
zuKw|4#DemO3IV?&Q+q9e_(`&=pIZk`pPONa1pG+I*P@<SGr$$-pE~7fFFte|l)z)x
z_AmAT%Wf9y$YrSG2T)YVGnIp>o-RJ!ScV!|$1VOF#1?17LoFO0vj1L&YW2_4I#H4n
zcgzjPaqc*Kyk?m237|)difPZdiFeq*3pMHm1fVh2eNL2r%bZ_3IsoMInQW=3NXD|D
zV}p|%OvM-d*i_!cQtxfNcdt_E$g+1x%`=BcmN*F+lpoEt585<t{~eu-izIu~OePGl
zjT2h^zC`kGI0yj5wjFI7?~Z*R2eP8##os7%K;$g}=yt@tX%*_hAU)XsaQ%J{;eAtu
zlDWi*5cR&K<ar!7z4!4tuWa{gMWF@Xbh~o-%m4pg07Q3<Zp+=r)LecOEi|f`Z3~fL
zFTQk|FxP^E^nYw46dA;Inl(chi%%tmD)bk=IAz7j(fE#%Tg&W<*qs^RgcfZj()Cp(
zK|53z+HW!-yvzY7xaeIFj)^rTkK?aG;m(Ef-)WxzG-R`9{z&M8Whaa0Z{SpE(67LF
znROdvy+lS<r?e?|(CH!FTS0ms)x0s?#>w#z_g}bv;+rKm2WG$Cvjok|3D#@;a(C;|
zYy9&aV*)-qOfGAaQfiYeJd3j0I=mf!1banfTF)(3M(};a9x>?QRa}1sK|0)&Yrs)D
zmqRXBU#WfMm*Pn7b-EtesmPnAJ&?bKUj`4&d(X@s4`0c^7|Dk|^xS^~H~R-W_Z&t*
z2fiBSb=cnM`gb>4>kcPO8EX8TA-Mh-v0N4WtCy@S_1drK7i<wvd6T?Nn`ndsR#nEV
zqocjf<{gv`4?z`M1lS^sk^Oc(*Um&NvC;|QAslBeA`B-$i`dzx0<}einaDu);je~8
zmA|M{tP{c+P{4?+h`ZAc<EwQPYl1a8)#(>j@5Qs-%cd{TeMNEBmi4cJ7dx^yOm@kw
z>|8;u&bfR99wOgpZ#pB#fSt;%1ik~L4;n*Sl(Lnq*55i)pc5i~?$=UcAxQ0-R?&up
zk&n9X{>9%95M30`{*%=S=_Q7C<>^kXx|f8#`$LKqu0R8R_#6W?mgS$$hIRr&7iC2&
z1E|D0N_7uGWXsEl0bnNdz4c)7V58=+M|G)F@M5SM&SL5G0%+K+4AIN8N~m7i?&evK
z>N!+hc)3K__U38auTr#}91^V^ZVFRXo7&*feR=Oct>@9cEw?J}c~X#5Em$lNxMgUE
zD*ie3(tT>_4_aj?<3>R|oT(|~=i{zm8w*6ok>|Slh9{R|S0>Y(0p?O*LWStMiniS9
zJL&m`+)b<II;4PK6IU)s81>300cS;{n?X~K-<LEXRzqJFKJhm=(?UaD#9`8v_AJP9
ztqH#hvRGU<&o&x~@CKva_*eN-^OeWbD4;T$---$dpWt|^QV2(Sp29FcGFv2K_&_h`
z!}fTfzP!}ib!>hx9%@c3$x$Ks2x4M_Tb6tl6>1?hKsyDk^>tbqR*V2a_u?-AEoe0u
zy!#jgbb;@vhh&ko_E2Nz`91$!s9)3$qYEQ={3#>B)~jdFnz0B0r))dg&q3kBSwa$B
zWvtNBcnQ!d7UA7$zYLIesoABi!#z_tO!k^9Q+H+W!p$%9*#5zm1w@iPCpBN@mglh`
z4lm(}etA@`7${VfSE+yS&#nibFT$pK!y4~q*|Ho6>u*q+dHSKxXis@>R=D--k8*|R
zZJ<1@QaD#8l2-dBja9<t3IoPI``aI**OUbQe!rT+l<aAD>1fDf_8X-DvGIbYuK3T;
zp)X)E^EytNaK#v*>90Ve^u?RqY2=IYSkdU5o82QNCL6AFomyjNrAu-cM!{<iY@7l&
z9eUVPb0#vJLW>nO`u>$8PvY5dWBJd(2b663!(CvJtmMNPBTIF$*`Z&ln?scZ&y}Q2
zI*RVF?GDqz`YjLiqD1)(V;i^6d-QVdq5?Ig#@k9|jjtuBr}m~S_Ovr*zX)1qvbw2?
z741_>WXh(97COFZ8OQD6&}d`Vmzw_-V9&l7b0%rJ>vjbac_m!kbsR0$X+;@zo3-Y?
zS{0E_9LEKgX-@M_%Wro9X}5VM$9T<)L6r*ZV1fBp;9l;dIg*`mygyv}@|RD(Jnzt%
zej6r-_i^1lc`<BE^BIDg$i*Y)?NyCH@c~aa9^(1Lqo-I4{#Vf&Z+G*gp3wM4k@a5;
zYoCw04M=z1wWU>+8jKM(ZX3FAAx1~6-_@1Y7E=NEm9xPsD(>EwE_Cku$7Tm1jtO&l
zQMLSJ{i>Zp$}|RPfygl$5dqtEzdjvBQSgbYi0VpJ-Zu;Cr663KcI$qcQ!dky2>aqK
zT;SQ}O<oF2Xp}JlYn7d}-&*<0YS-pd1wM{Zm6pRa?=Hg)tcX(|&gahKOe=L8u}{2;
zE1gLQX~WzD`kX&vhlLY5p?Hq-_VCFn`|H_Br(XpzFaK82Ce>20p`IMRc4o0HoW*3D
zbI<jP#(q>vVX^jV`5$P8Y1Y|>0Z@C{dExoR^y;U91g1|s{Lj@wB;-ZvFbDwQU6c=V
znm?b`7E;D+;rb^>#COmw^chJ;9Sfb8tkgl(lXO%Ky)mkWLeD$aZQYc_PjB-FPVvMB
z-NGhRug1H91jQ70ozSr$Mx11&2k)HpkQr>SHv8X<#Z*3=ZJQyk!0fNBJ~I)395=2|
zN~y$>(OHKi_+)FmZIVis5FLE2a@SoI(6tEY-guCB8+l`7p=}iRI=_Rg=JUOyZlClW
zBHuYu*(C-+9Xs|n&Rb5PBwVCts)$O~htt2jqQ}|(gh-_EJV28nxqI4@s8n@x`qumr
z+1uMULI1?o@^|8Sf{Hq?-}U{RLDvWbR%~8zmQgk|iFALsQet>FieqviEU!3j2_|@s
z#V3ZOzu@}`0%%2U_O>U#AN`?L`-Xs$MH|ti1b8*=ZE*Yu#w*c{S-asa7&zZ5GHNe4
ztvuZjlf}o$c-xv^SyAbx1KR>wI|vwV@Rh7W6+=?h!%bHT$Nf^8591t`3|}$1LlzTz
zGM*IcA5RtalkSs_P$D~vg`V{A*>p7!w&{mvQ+IIvBAwKDannN+Jx3$r$o;-hEEXYP
z6O$ommkf3c#CITXxSz`E#xXRdvy?PjRH4K5_s}9HRNJAkR6{h`F}#5yzjKqbiO<I;
z0>`mk<fQor&Gn9W6dW?&5KIn?Wr2a7n9o>PcUEZ$>F*wMF^d^JR{7K>Pqr_z`Yy66
zmuiEUM8PBj>o%D7P=ZJ=Y2m;MRUZsD(eS0{qHaA<77QCMDBe9DFgo}2cF*hdry2K`
zZ6_|v$^H6)XQ+!`Mp%A^F;V%OV9d35+H3nC?Ee>CZyD8A1Acqr?obHs)*=B~2oR*W
zJB7Bm7I%Udcb5XiT}qMSTHFa<oC3i;xOejY@1475t(jTpb3UDQ^2mOEdncOgQHJyl
z#CY{^h$62UYJ_&^o&vU6ZWsBuc^2Qr7J%S}l#Gz~ep0okB=}1oM*Y*HUTnxJG;!Y1
z2mw{K8kobw2nhwvC}NjCeE$`@(Glj^!fcOpOR_i*T#Zq{{+Bv>`7>r^{%>2y$LFGq
zWc>GMd2$CviAQ&4r|K%gc0R)2zBD+tdP~92-XKHqc2%}`{WdRyf(hp~x42B#{Ehf9
zV7&hKZ*&LHh6f4d&>xoSJ#$Lx!)E(3&{{P5mNs6;vD*ilb6rvc0UxVtW*vp;h!A%t
zGntT@z11ODYY~9eHVaM1a9&wqg`xgx>aDI<=EHiL(zMq{kDRoHcYBXmyKA7-uzL_j
zSH+;gu1COQg7B1p6J(#URf0_@xV`gzVY;_b6YjSz*<K#dIu_T@*of@SEeAm6{%USK
zX9(^0e`xkvX2x}~I*W1}2*lrX#<|;UjAa~Al8(QJV-5zKc5A*q&W)dhXNm()I+~U~
zy$*l%WdhZum^!>6JSnXf8EMc($UKzM0?=FRJyiV@t1An8BdESWZ+)3KqNuxjN6vUl
z^)KYh&fRcxoVeF|=~$Y%AT~bgc%qEPq4zrDVx0}QpN?62jNEMSNpKcFbTA!0`L|g+
zk7U8q7TwGTyBwprNxH8#q@qSveR2s5_}F4p<LKzUDJ3^T8Qlj(KFgQF3`35q*A3YU
zElDPE`L|L<@irEN_|>^A{dO{^db&}FmZ4M4*@2geK_uZwPe`73AmN=hNw%82yNyau
zTL9PR(+5%IJwf!x*O-HJhx>{Sk(V{zwROg#r?wE47zUZK?#;hv1+sm>syH+Wh5(4i
zZ|7^pozMtx+LM5Q*Ax5=d&1!0OzGQq6{Q+_ANNj9G_J1vZat@T!}(k!?pyPW>Xcg?
z0G>wBH!l}@T~zcnmzaxQDMg>J6{T$ZxRmlNzC;qH4Bn@MEsD$B73WiTJ1-NHnl8Cs
zcsvXbkVn&?2K^f(=6R<H;I}g&8YY2Zds|R>l<6+d>bH$nx`Mi$t29M+1_$2+M4b3a
z7AB;kPLcxWLu|{3l4kOjQxvBg2r1Rw4f<1g)?=r_G0uzj{5;P;Wc8t`91DDn^yo%w
zn8Y5q5qxJr^@;j#f4*A9Swp7f?++jq8w=aF|NI}i6`tPdt45|#BC~0dvy;Aw?Oj!5
zU$-G>&MZb`{t!Y(R`$oYg}7&8S6o&d1X%H(R$WTt{$BaB6JYvZ5Ya=2X>MpOkWdxE
zJ>^LCv~uE|V<&?dY4tB)Dl|_9-ANHwG~sV4@aU=<&#C`_xIzV=yPM~>jr?*-$It>V
zs9{9M)2o_M^grjq&RdncPdp7MvZ@=H_tEXd{QoZT#R6N{&9~i;=QH|cROl?o28m+$
zGI$9uzx$tC-_KKigBK4FwTCtO-ghr-5N?8?`^ibfs8U>1y7c2eV4vN@JRn$|tQVzj
zgF1DumAQ)38ANd7`o*rd>fv<s4KQ9$G>J;Dd9$y0CppW)-B(jN{2smkzLkD7P7gYq
zJ@oymzmVs(DN3<++B`@2614I4I+@~U#?Mow-_&RK{hv<v`rs9ApXezV<vN)GxtJ10
zdschzD~l3i83DA_)z`YdIS~^pbnUn41pSzDd<(k<PkYv$*kx`MHGFu+&NQ>;T;)se
zXk_j7Arudi7)m!O$=#d_hg}``?qey*&j<YGBfMOSN#^UmZobrnKg_zk0~5!^>Wdd0
zs(d?w*h3hd)Ld9|?1xb!Cz9u{ry`zo5J$d{Ag_rqJ}h&<pvKTNWc<>&Ip$&-03KoJ
zHH~c}NAgq^`o0>km>pNsEkbzb+|-;bCoU52kh_{g0Dj5ta;To_cA``L`;<s1Z*-m|
z=+cNRgz~^h8rT9xq%~QyP2i!bFGj*whGYJQ@*Sc`i=V2cG?Tx+GDL#CHQG2A<-Hqs
z5~a7<@D8|k&<V2#QDi8VR(qlR$#53TXYLMk-p{WMn)lPe*3n2;ZfMu~7NcC%w!|yn
ztl`5=qJNwBlB4=;iC<)qHeUStI<1Q?1xfpsF1+INmE=F`twBjBqWg;hAf51bn<#C;
zzY`+siUcX5;d*~DHX=wjCAyB3G1?pI9R9T|8#Nb$8%~w$<Az~@a6FUYy$J#5=2{?v
zO#od<6yXp3?Jap-u58@Y=Bfcta+POouhf+6uq`5~i#)S0t2}!gPahxK=RD`XFB%%X
ztC>EwA4R+0*3N$Sdj3TOID`2jQzVKyXjE-HuV`>g{<3EYxT)SWPOHPQmUb2jU!cv}
zPH$UY#N5|b>hCO3)>Boq7MpN14|AP~I7zMO4UyZ3R_N5ufLAP(xb016f%7*DsGM4y
zyUsNY%Wb#Ig|Hf8GBNXyiLCr~0(^hCiCT83!5D_dhk*tMH^u6!IPssNrTqA@@s74f
zhL7XE(7((qyE-L1ftkg?;;|L&rLSBs?flBCa;~N(<m2v_MI0dXwhz04Suo`?F|qs4
zIMO11kWbpX=Ux(_r1SRAU^IxM&55Sf9(j4ImEZ0AqgGt8t15bo@wIP1>Ri3OBSP)J
zUTxFxC2x39iINh<{=99&+6y<{2x5go?;Y}46GY<<kYeZ;X$btfsR$&lqK1I60s*tT
z1o8L_xx$$YSh1lh1S^wkc+zAj-5Cu1$9uVDDGBa)O@fCA@qTycD$vDfR)Ds*_<f#V
zs3J4rT~yZ6DgzGtVO2Mg!v8+qH6$_FoH(sKqW-bYQ;xdz)}}ju&?0Cgee%-|Gili_
zkn(a)RF#DC(>I8slevt7XxL_O7^+)-h9CFj%$I0Di2pHqrrELZ7_tKH_9)T#G|};P
z`{TLkb#auFPgVY>0)rtNrlKQrY7>5fuS|HocQJ2BK-Sp#?Pq7F9}?0DsU{ucodDIL
zQKvV=6nb3QmSk43n;s79Seu*WlN93C_Y~_f2n7NviL#&Tm1XuFJJw2>&)AH+C$mQ-
z-V2m2j^gu;v|FIOf7Ud~1DjB&!e+3^Esw$}sfxPcBx#X8s{Wan`t_jEmVL3Mivx_y
z`NsTTLmoQc`Jg#9XHF`JXT^Fa4hY$UhybB>59i63ar7NcS)*A7D>z76cGv<a#l)gH
z4KxVHTIbb|hRzT$gl7+ah}zQ=0@ozE-0q0R>8tD8eg}qZ(Xu;D$xcm4{1J-WgmJ_x
zy0iq9aU3+Zz4NV3^%xHl#|Jt3JE)upJRXuyV{mOU1tDXHnzAk5iMLZ@5YcD!OC<=>
zhIe+UO%?Wp;$V95gJhkP@~((mKf44{<xH{i^%J0ZN;8t<*&WyV%|U}SCfmQ}SUO?w
zo$qWX3QVw9a<J7=DHKx8cz<Ov7*+^>?`$K#@;;%D`l?9rAYyHd*lDf0WzO~6ZsJXx
zU(50{FJ;Z`u7Ve*5c=m1`(b?wLf&#zX!qm!T|!?T-gVE%Ejv87G{5h^oaIh$*dwjV
zGk@^T(TzQBgm1<0d1;F%CJ5PC<kb{AnbA?q78_hgxqM^~v_0yuRTD<uHPrM1|GX@q
zuljeW;OmuGYS`LQiU?nzEar7`TrbN}#(L{vjLPdN^m|{~b7DGvitoUIjMl?t40ZNM
zUq?W$_iN=p&o}z9J5uEeCNXG$H_d?-BUeGp9=~H_X5mb@M`3+rq-h(`fPymgQJTHy
z_FJ1%!6bz#WALifyRstJyF{7?FEn*hIFOoZ<jr7#A=cD7@gSvebD@9Bjhbl{geFcV
zE4yQe-Z1x@hC2wwAeYNDL)QJR7h3nJN$=v@HSE|x_pOgu)PxY{ZQwR40hNIR*xN`i
z>wx+X1YzpKb2=sP@1i=chIlGLzy%`5jK*diUAu{Y1nM<VW2cuwqJWcQMa&7;z(!EP
zkd2lVVnT$mPY?w&kie^K&zl)O|1Wm`Z9R4v<(Z%miUoCavJnfB7!6;xfiJ&wdH$@Y
zitE<9KY;Fmqkb;T0PfMB<csL9<Ynjjx_d8N<|PH`UX`M>FYe9;oA8e<^`<gUwxKQb
zq~KvrW~<{qCz|u)2uy=-98E1=`GrkcB@&=yAUo)-l`xCUsWtY>Hr1IYT>gY@R+e#b
z?m2QHuce!F{EQiUX%WYH7FHSsU^nd8it(|X-S;*q`yVGa+-+8@o5&WslNYJ`Ox^n3
zGJ0;6Ucx`}(9HHwV@?cf6qYRRu*$QU0=^k7APlSf)z#BYHB9B<krhvTxY}QSdt)~|
z?B;_pL{ChhdRZVvObD%gIxkWA<eN_X{i3<jM2GQ92Q&+4mACdo291clsIm4rkexu;
zi-Ky;_|Q-(%cR0?y|Awnn$xTK<LR!@#+lg4wZ|-|mID9Ip}ybvB(&1h0dv9yt15|3
zCMp$`0>f-5iO~9CHEzr$_iEc4-p34qB|~NzRA`WpV6o%qVU(WdRFtOKo8t@+#ED<}
zC&k_qhZ!{??mcwz=4jG0;O$jOicCs}+8C}J-5L1X?TJY0wV=E_9cnXv!t7<V^Xf{g
zQ~K>n(!dJ0O}m6_p1z+eOQl$jX4%f*n?^2$GDvpKCrZA?;kc+^@)kluh#98GTHoAN
z?3G!p5mj3f`@O$OaZk<Yuk$z8yS(}#?_*QaH1)@;s>vb@U^oPiqd*70h9g@Q#qXz2
zSG4?bHx;gTRaQnGejN*$kV!wWOu~X<x#@q^%B*^?=nZnJiPx~M_6}q$K4qnT*N@;&
zZ;)o4`g5>R^pAUU`MLv7H+}pl+_K`k&*OSErcDo&k@Y}skT!>}DyNlZ+S!}aTw%Ya
zNoGaI3a_a79f7#SB@zxQ4!yf7#-_6WaMI;d-j%1+G5MdCOga@l`CEQFxpkaFrXXRK
zd~u<+A=!T!AyH8-h4NCYblSX9D|+>QM|GTVd3@mC->r&&alS~M(V_eRma4MOd&2iJ
zB$gQLXQ8Jplj1{?z6s0vU)F0AXx7xVe^4eM-+gfdgf&)K41w&@It@r>j6Uv-ky*ln
zGkXB-r4$XVElB+@3RKV=brH0CKD=gj-EC~*L&t1#qfeowUKb&gS0k{Fi*NydSV;Br
zwt)BsRSsF{O0{YrP{DQAWHj<TD}$05Z?<^TKD&{q1s02{Pwf*Wpw^d|2kzGf&|@Qu
z%?7eTI|66#m^XjEG_X&lj1<f-86u}_N{Gscs`x;w?ZY<LSQzFl;woa{C=<Q3Xs(pF
z_&2lA4ZFC7;EW7jXMT7r?_~6A`aiAh?F+qsU<M&+Ff;?P<+@iG2uorjJUKneM&jhr
zdG<-@F{a#ZgIQr%5(%9`WS))(g|Z6I8y_345n<8VMEPO58r!iJsT{Mrop-15p4+mI
zD%#;WO8O&KEgZQQc+&VKrM7>g>KWZx9ptea_B4;sZ{s7`kjh@ER5f9?M1L!De;9Pt
zX{RLNJ>i)u`bPqI`21{OPV{7ah+23|KDggjCHR*M-|y!Nk&hUy9%+rS-IJeBTXgd)
zpcQ-3Ia@r5Hj6U>$zn;(fWZ+B4tfGdW>KX~<Sk$R9T)a<Z%El<C-xbp$l=?r_e_T0
zb!zD<kA}0n@?WUpqd}75d^cC)xC<ixkWg?f)|zdGR$^>1DJX2R4Fl)H6lAQ;n0hSe
zig*Yf&BggpB5@y!o&^a|mBIJ3p)z#BL!0b$(|eE=kfJs5$y2D?gLm4}J}#k=A1FtZ
zfC_&>5G!S=ADJy%z&f<}edyT1HZvYGNWc`Z6@;7%at^_SRl`R==TXG|eFFRejbNS)
z%8S^jr3>Br?nW2?wp}plplPoaYlAP^J4}^zX5-dSkN>{Mn!_USa29u*I9Y~Z-F}lw
z2Q0S7yyr41nD_S?Qe*4H_)*pePr_Ek6Mh{WwWTP6{o|V+ZwSqFz8kHu6%+JoEw_kb
z9vS<X?Z=JL5RZ^M_?^NJc<2+-74-zG>K*BzHnn<F8fj*gT~rt@@haQ|Yxm9Kaj!DH
zL{zUEcu24xx%O4%d)icU*9OJBtnrnn-!IO#dIgOM!0BRDRRObOE$yKKk?{hrXaY8y
zE38n9*j}o*;xUi#vwAvx*Hcz=ll{>9uuT2>c<k^avpVX<wy1~-8e+7s{e}a4B!Uf9
zal_csr0Q|Ch~*<x7bSL9?Afbc!P-)M-QwRyM#n!0F84t7-t*&xoCrWxs18?WREVw(
zZlyb3aTQd@92-GPlWU<fmob!09#O_7<aOex%RP9Re@KT)OaFZqi~ML}nsnp4{>cbm
zUT|Ka3nSHW!s0vArp^pD6)MP#14Ww9RxBnB2v!Hr01x7FL0wi=|H3PntK&LK$7nHM
zzWB6}Vyd0D;9am4*?LvdBjxb1AI^iZf;JsP$&mDW``zA$f{eGD;hCVSqi%rOy0aD3
zE0P6@;sS=uveWJXpNKKXmDPW1&m2L_DN@Zh52M^zMP9qc77@tJ0z#bS0Av@f=ORS_
zDA_y1zpwYQqk&EAsv2yRZ)>WriG{gA?@n@&Oi9uG*-yGvQe=$${pY-^OzUVQ#+;aP
zgc~}4mkADN<$9l%yfp1)M%nNYr8was=m6e3$(~-oztvlhBnrzMjLB{ZX==)`+?Zbr
zfOx={_0e&9d1*B9XE4}Lfso_1CbD2xM%wtu>``|lkH{4I8Rizpl68utZF;5MgJG;_
zebS+<in3__(CyZVnse5TPCK>jf&S4}F>jNiv>YM>g5Lmae1M!4pJXyb)8^=@S4Tei
zN;I;d-P_rx0u}_s8Tu@^>_3FL4<xv(V<TTeXoHhyB>+*Z^m3*k(qtsq^&<Q({~n5+
z=Kb}<)Mq;M2Y2J~z~ViN+$?8OEcvtiqT^)8Eibyv#AJR?tyXK2bFVbnFd^GBw4L2Q
z^SjML<1NLm;DfeE%p5-*u+Md5tCBJGX-ShiN(zHaFUzo}X2wl%<XaQ_4OV=RNHh$K
zI^NwFYHgsjT>BNp+^0K8Xp+!qO99sF0ueXaM8)LVTwYQ*!s4fj6orn9GDqU0g5iQV
z(pXkp9A_^ci?t}&m~<D;dnVLRgXpw0-iBX#`yZL`)MiHxQX-1T|9-n<nZB)1I{O2B
z)kQiW(7349kP-HCfJK8dU-mjN@_MSh+EaF7I_E&NBYN!AL`S3@NKfad(@#T2@uNRl
z!!maM&WAIEi$~S1avR+Ve!XiA57Y#Rv-nl|rK2ZjMcT2kIp~;`pe5)wJ@@ZxmFsLt
z9E-LM<s~n^y6dLw0ce{A$Q;P0PJMxx+198uu0oh}0~2_I5GTqxzYn9>EgNq@U3b(p
z4V486s(5$%DDh_98>9EV9n&+-`c6|B0t|J9KR~153DBM_{66p;li$~`#7=@5n3}lk
zpI*5|S8VW*D3F-o(f>srl+KOuYfi_)E)W9o6#k^U<zywB?NIv6+}j<?qe`FXyS4aJ
zPweJ|xz5GgOy}qBx<|agH`X0fza1=MI=LxZHP3YoT)!VfO+yXCs)HYJBDm+8v`+u?
zYB}sRPw!7sGa&Fa9w_1Y7HXN@G$FN+lPgMb)iWe3;vFf(eX&Ke=cg&l$@v`20YP#O
zn#0?}BZ>$~+>~^bi)@x)5APwDrx_0>{q52sIXFh!0Wvx1Rt4V&@;Q~-JZzxuwyymq
zyR9^QFd0OXwa130@geV~$kqJ~HVHM|ELML0o>6a`uTmZcYXeMDP|b0Ax8y=cPm##G
z6yJTQC0z$%3^~5pv@pBN&*|Z6(-UciH@3u7avgvz@FhjqkM!vugD~UkOtc)$d0wXX
zRND+izUpYLMMEn`XPnc%h1=}m&<p5@#$E=UHP);Bs#HonCBUZ;h{F`-3Q!kat)6vf
zi=Y}@PO3yv5%h%Q^J-oy2KqQnQWsjbe4UUN0XDA~COqUN;&SlMpSliFy9qto`UEZv
zSYF?$h)9Vpn=PC?A3p3pA7T_?tEcQzm{ENGNHer-VquDKbMNyR9+e(GvOBT*LyM}C
z%{{JWogpUjoAPMjGfQnEn&6|K#HLr|dY)e?r~A_;G$FRy-O*=;_GH>D!AxKe57mvI
zz79Lcn|!D;F4y<;{SCK;%_MS>C&hPpype^URxKr#fY*=2=f{9D{6R-o=26MXA?k7S
z-{b5rDqbxduTu&|4MBlHFtce@@huQ7V`U>wz1Id)t|$TG5+qVUY=1*2dp7&jZ;H?V
zav-P0FIX;MO92;ATK6)M`rmWqJtOy}4Q0LG3UVMVbe>{Lkf6il8b^-FYj>eC(nOY~
zJ9lkGg8nG~B)ReaE}Zpe3sca4Pct_%{&2I<htAoUU|Dy56{RRU2x*Kx57~vCr%K=w
z*D-D1*f(9PxQtl4Ue=;&{Jvw19+TRM`|I~?1uBb$)zDwPGdirJHJ*2cH;|gOZo-7y
ziyr}l+4%OR-hW`ut^X0$*)?d(&#m&m;f&es?d>3?;E2+)^J(GGcy6RVAjJc>c%&XJ
zdr(kBM0NHweRxLhuN<eHSJ3~q2M?^k>b^^0ln`plK{5SG6IpqIT8ayArq>K=<Kbt#
zap9r5hBzI?ud*a2alPTON7RC1Q;yJiSy(BO*9H2ALp-}j)&qk@f!384<&1a*qo+Y+
zJdiyZMsBqn7}(@1cdMPzVL;9X>FuWeuudfb3Um>H%sP!HE@PMqytjH{vmK;$V(F6Z
zMuQ_bjCNX(DV2NxkAOYR`40HMh{1lh){SlU3CKBhS%=fOjVXQouz!qdKx+rdt*q|F
zE9`MzWKU#8#xHgKod;D?3X2N%!MTc&Js$PhpELCGy4u?2nQpCaJ3eb%&b-EuJ*(<P
z8miuqkB{~;_4D0P6AjNKJK8ZC>FHbMw^XYXIk0>Et)9=V2xwr!5n1!nHqAjw>f`F7
zPSEGNBNmZ$Pd;gsO*9Y^*`9D#_*`Pn`1Td>IKvftXxGu{C{Yl_qQ%$WJhXXk1)zL)
zt-#><VBx@faAGO)QSb3n_(jFM@r;MCUIB$jXwbOVBkbTl;M#rYO|^*J*3F0T)Q0i=
z7dAJkftDyHh3{Ti0x<u=XO`!eV)G0~r*&PQGg}YeEOBuPLK9&WX^N>8IKecRjVwxy
zI*JR6%2oV{Wzm={{ThMD8=1p<Ll&UhRaq%bfr*)8KuLsrga}=O+spm6ZsQ6m0ZTb3
zJf>YRuy_Q2**)~f)iTzw5H5+^wI3a$V(p;FH@68#J8y><5JuFEOF_=zdgM%?a9&d&
zmi^a;pTsUilWVlIg4$aLegvX~a03u^U=J<<<iiEXDVGqmx8wLwdIDlaSZZLS&Zgxx
z)P9I4yN0RANaLY_o<O9<49COhxnrU5$0QxPGZ2m~jT)pNb<X6wS7>k8U$FDg)_GSn
zY65!n*Dgp=*pm*ev8tS6x}K0)V>pg+iV_mH2?G6I#Qs1@jpW1>Jisj)Gt)c6pIN=%
zfzzLjKA!Nss$Y|MdHU*`!M=g2&oXI?rDY(T0l!S}<`>osBMH^pikzz+l`?$yY|Ewf
z5GqTPJzPjEV}r0b*(<S}5lh79{T`h!`Qpmoie(e!1B(VrZ86$wkDjOd)4qs#(wa~8
z=65=tf>9Fgv_3hsz4z6dKg!-5^tyKe35TNJkZ_QEQ8qc&e-U{g6bTj@9Q@YC{S$ng
zfHwq@@*-7cipIyBNds5;(2|TP8$4+%F|2=@^Lu6^kI`-z=4_=7dE@0Nu;(bv6F_d{
z>F}8a@l8pL^zDH5nC;WaT{vYr@LTQ+zk8hrk|GjdSCk#>UMV<8JHQyZX@-}fk(Z))
zLH#o0k(B6|GfZpoKv3Xjue$hCIPCP>rl@mQWKk_o!~Hw|nVbaCyOwbZuk}=4O*rh@
zfjiP4<Ks2|xu>vBvY(sO3Qs1AOCd@3)PQg$@1$+VA2jNY<SDfVx^<*n7A8vL2;Z4)
zQ6j<IUuJKWahDs3os+l1Kz$r#VF$X1mXQr1dmc}13$HmZv2SgKPHALi-w&^IdEz#&
ztngROoVJu_d6Do6ZgA9@=lU6kmq}MlRfT+gHpwWkPlaoSC&|Z$CFap$O>c92B6IS6
zj1ixHgHuXmw}9J(v2+zRnV(d09L7Fo++qDXD88w7TaCWC{iJhC<6iJ_!sqo@j&+-h
z_Q@jcVvtYbhe3Q+3GrWV^lIAq<A1d)K47XQsEK`p6&U;Iigpsavaa84tcF4BhxGf@
zxZ=m6FfIIL!Q_`=j!E5=3X+Fy(?cn3`v)pWFs4>aw)e+RcHH$*X=FTFg4&G5OIjV2
zUIqBnDJ_S`CW0A(&$8AS60Qbur{?h-D;qtoD+++f{rM$SZzD~u226*CG1|+&FLhiI
z+0eg#c~nCLmyFDhq+!bqaF&-@Vz!3W(<VEvGLIVXftP)PFXY&>e0ZUqWWV3U0PkBq
z`&BTrg7#pJzdIOZHij{ILUHJ}u&5~@y-;<4e%}TrX8hZY?jScmz$a~;hj;J)jtuWe
zWd!2aZ=>)5K{GB^qh1UuRQKni32@HWH0K}~Chs{`w`fwFwB}~_j^75eIvs_i)4@=T
zhUe*kS`Z`aveqb8HKJ^}C3oNKWX`83H_E)Bh+`dYQJ{s8*Km=WOMy^%xuVT)gWR!1
z(LrO0QKlW=R(d9n;y>X6q$lgy#D@5Bn5|nrHa|3;(Ht>Qit1oA3K)I1kO$Uq&g_zX
zqOe&o!|*dM?Yeu{ib&R_iMOOqOAa6)*|){Ci*q4h1&qNe(&wJ=6(q8F>leRunqM<?
zUb6W25tF!dIoqv+KZt1ehP|Y?WC)A9`O}S?Rkdzc$#wpDzDvAf@uT<U;kRtXt!4_k
zXEhN^;;`AR>%>j6l>DhOR)2rQ9+}(LHuv<k@FSLI*c~wAynrI}=#h#s$0p`qcwOr*
zckm0jN#txxU)c)2)317QF<y$~J<P1)xN@>F-Qee>n73u5gD&j!wOpTCP)W_EX(J@D
z%wa4O4S0kETMC#2h_#yHE$x3s2!sJ!aYGPUR_neWeO4%v?KF%EE{F=Jz$g=da}wMh
zXcg{0G(rs>G(xfGuHU2p(RklcCF3g4+_mJR`kSm=MF|ji{|)a0^kpWw3-XA?M6r7x
zaB3O-Odi5kvHdIeGgS-9jy#7HUI0`-l^i?_eJVSfq0;T}tUXF@A!Ed4b2_G(DRy>c
z54LgLU;C~#GilSz=EU0Jpw}p`n?aDM5JKJtx|fS#s}$Dt8TPT4lfbL;@Rj$aj5z{1
z+t|DpJ``k=1KNV?sAXdkuXdGnYdv9SDQ?{kNY=9UrSGIE7XzEW`Qz6UeiLzncerA=
zbZ-0mpE5On-sV3nP@OL^2yd&{fs}T|rr_%xtjHOl6{na{&<rjN&Cd(S1J?%ore1ps
zjAZ~`{VNe!wpxJq?3+@qZ_zxak227R)`E6}6Jm^->GFSCcJZpt^4$K{Ld~Wii3D{`
zK*T^Fe*E0^+yphqmQZ+a^!ItwAi^~<F0II41`M=TnMZzltPSH?W0SvQYTfo|)OimM
zu4avMq8+_gpt0rBb@TSw8fM-(rFFZ^W<MxPT%>p|ppn@e;Ei#_MFy;hb^5YWB*%63
z2jSjzNGDN<I?(Ms33FZb$Qt-g6M_#m7;=D67tZ3pP46?%5_eQ~W#Wb-@d;;(O<NlO
z;<;jCLdTuibHV458Gci{`~hX8f*l?Bn@EH-3y8M!2{ekV?lcS+p&T&eE%%NSHWHXs
z3kKp9=^&EMuu}7wf&@~#1GqB{IQKq9<oRqKv@?5?(F|@Z(y9m#?NUe4jld7ZNoBmu
zqyRPXVSHX@X3X9qoVEJfWl@APSbYhhR;W`PMy!j8#qN!t4^6sos^N3bG(V(vOswDi
z+A{0#F_Ew3F;cCHctI|>V!a;AqscAAQ}PB8=SDCp*(OPHBR3Caq|DdVOh_l}AH7mJ
zN+>Cw;%%*p7+i>!cmLIqV2U;keMM;iK&2KDk{2F4+Y<7kOsT_`M(heBEJfb(c;dQM
zBdiX0F_`0_<bP1IF>Oa8>rHW-nBElp_X<-I1LynH#`~uUzW+Ol%;H?v3c(z#yb?6|
z&d#^D7fm=(K$h-q?oqPs+yS=~4)UVw*=TT9oeQ&9YKw@eTwi?M2a@p>(H`m_h?g?4
zE}mMXI(z-wkvOk!8G0~)flGCqx81oQ3%&#5eJ&0a(?p5)>P>rV=lioTxXYW7Rswnz
zJ8OErQR8h-9jX|rh?>a}ON3w#U<_X*Y8eEHFF>m6&f%K`UD@${<jL?vVu_AVUaLLG
z{+E`k(a|kD55=9>6nnF#872@aT-~+23WC(T>AAryB7e^9I+pIDA)mAe5daJ?qD_Br
zLNTf<C$`7WdC)Se)<7yseA8TTm`d!jeBqXI!@SWT!JKpktgTa#d#~FbJ7P04@JP<?
zBvfHl5qp==rr`2uW-OAYByIc?CrpT~=|Y2G-E~tR3yQsqr>;aPiq}Nu3TowTr2LC_
zJywz%c^i_N$`tgIB=SZMv)sTvDvW$dW8ym6+biX^ia_h0HIrvE)X`^Zaj5VQeU7r*
zv4)YMH#rFh3{D!3JP`&c`snWVyR*$uY>b}X@2BUD>9``gL33x=BA3N~aFbOs(q(d1
zmQ8F=?eO@U_`)PQWFe<7CAdXExB4wLS(G_-JPF(h`WtQ`(Xq^hvdi+@fnV-jEFU!o
zb``n@^#G<sB?2ZtuDWd>%S5q(#jx{`Ay6!-{sr+_P$sz8{MKFMZAX#*dLVlI*nKyt
z%2E8-K}f>bQz9K&ul6%Y03z^Z8$sz?C02DOMzmv7rWYQ*g|R}Vf^BB`2~NpNT|N_a
zf2W`h&oNfaxr+Mw`4pwE290;Xxj=73gN!1ZorM`bTTdsKsBe(eZI^@;lOI#&rJ76&
zhtXD|Mksx()E<|{GzX>#i3jvac@SW}fU;uOdYDX#av-g&BSJfb#!l0UJEQOvcbDWI
zWMe<8WK6AoPV=wJ&(o<Mg)Vfz8%n;^>wcUugL!+<)5pyEDLhlAZ!fNeck@A!_qx`{
z`N*Z2DPT5cRm6q}E2wrQlOkHaZzs{)NOzu(#>qFx_UhSbFRL;Kd_O6(qzYQE27`?Z
zB4PHR&vy@UqT!A3t&EHM>W1lX{(h+VLD!ET)M-iPELZueu@YUw<r5iN21$}h-ET>1
zNixfgKeC?8C?A|vAq$c%)3Jt%|A_Wl(Xf;@&X?GlfeV9MBtBB~)}u8$Qx1SOf7zSn
zZTrv_m~p)eSu{55(DkXgJpEgiV4UYFx}4e>Gr>gN$Bm1-BH$3ivJO38RUBGG>NqLy
zCxvbzOv6qwRN9{7BgDNUAvAZFwZZrugGral>&^~8kh`r$B`wCeCyMvRKXEWL5T|!^
zCs~0v1nV!tQR#Yw^D<ed-CNzNf!;0~jT&*JRCoS6Z(luo8h$@7dEMwdJG9GEczGD=
z)J&p0(yYutB_z?{(R_8XR2re+@8H@Y{pDcjdleiq(Q10Up3|pTbu6+Qf>hf_z%0&^
z4ke;Cb0)BY5?b$X*;4q5d9P?8<nU@ws~=t3FII=-I%P=)b>q};8sC3*5E9d$k_w?^
zpH3yPS9gmXjOm<BwAkF5SCWitUJDpAIKgUE6>GTCcoX@{Oz%{>5ynZ&+%t%~=%BZy
zK^*Iq4wk;tqB6gnO<BjELp3-f@9NmLpT5E%cDi-u@ztpLTDoH@nvPzGfGJIIuxl||
zrb9S)^&+m!?3lgG#E`|q^QYJgw3F8}g7<>W&9G$#nr;8d>=DMQF4%sy-rlDI#;%b_
zG%0%??g}c{e+vyl4ab#VY*Osq-ieG_eX-GZMlgP~uOtpOTzu5%L9gjr!1UgcPM6X~
zu%u?+h+2VWVi01ImU+Mb$66vZiut&AbOo!gW3%S~7eoUZUg43+5(gt$`>bMPzL1_^
znmJJp#hdhxYj@4Zc$O8cvQkZ8!VCt1T3>|zvoPD^L5{U}yoJoEobC&?-^N&6jlu07
zG8;Ar!2>(ETZTNQNQz1cwd+VNGeeI1umaU~embHE#zoPDk7$3_{@T@zOw0E<re6@4
zi`?pX;vCHo+{ApMAWX&n5nK&?IW$s-M@h(23@D0b@hO~3ZoX{7Kwm|~TB>m7U+1n&
z^2o-6#awL*=)=B=D9GJuZlEJ%Zzt?2`xOUqxx#16<{U4Z+k{i%FYKve-6wntCXaEQ
zP_cQj>stdVsyd;={O`<>mUurPaH?YufaRhW-v?`e!}prKw}fx-<>fc%gxOHmE1hur
z-)uCW=`ASz{{2rQXF7M?!t~bdlbY<G3vI*@2>gI@I&8jK779~ERO8t9car^D$RmOb
z=Fy(ipA!nCL3Hs6Po-DV*tElYI!i?WF-u{qoKsD4rOgM|n~Gh+SiC-h!;HUyRfB`M
zcn$P|!L=hCOC>%?>Tg6SkkMIam=<V#*-Y647wP?rL#V&a2EA9{%2i|@54)tLfi9>)
zI?z=zaGyXIuEe{Jpx*8v!iVs5A>j-tZKi5=JMpHFCMg4+mdW`__Zz4Fq(7eBBu<DE
zf9H5i3IctYXU}*DeEVrHV5X0@3J|xydREy3lvGTL=uy}))#Uj}SL1K5=04fk9rh2g
zsA3Ju${GcLrRyjgK5qQ_jARHuccu^Tpj7A#NTqFSG5o^jeiTDXRZzKNVolmr?)hyt
zz-!_hF&r-%z7#H0j{*Dz=k)>Hh)EcbEXn1X(t~iZY;JD$A?;PpE{MG>8<5X$sKb8F
zqB}jDcOATfoarSj%zK{z;?s<HmG`WFXmB8YnjwYqU17}@pXg79G~A|ZL|Sp3tEFr3
zZQoMQfwU`JF6e3C6*kT5pfB37@)1m*cz!#iFEZ5$n_Uewp5$>h-5;r;5>T7N&5dQz
zR$aPX-iLswU9p=Fs0pw9RnWbIj@$;{x7ncCJIb)4Yy-bBzcpuY5mAWT>+Na4m0pyg
zQO}4eqHp;>%rx(H&_eB9&^v#6`uB7*-AS{WwZ!r*EsLDlo=6?wgFfv~8O)#$Fs*wM
z2K6Teh%Q;uE5tfZg*9mIhujT!kb`JeOu%9D$N8*A<^#j41K~C&z-2={R*`cDe`#6U
z?J{lbR|@l7NN1-vZOVb!?tFkqJTk!Cci-x0uM+u}oCJm5f|D*e9a!s@2Ga!s(L3Q$
zbW5+kfqDLF?4asi7G?b7ZRW0>*#3MpXPO7n_&jMSkXlCeHL3fFB+}F90F!Qu_h9uV
zy$DCP^szPM!Ifq^bs^wN3a5nd*H7&~;$CwXazdUn{&(lKZGSM=K*pdEO;E3SMYS9B
z05@l}rKst$3jVkw9JdoN>{}!h!^2x`PT>MR#s_@U8-b5{{m-FP*&Ad!@W4_JX`Mpe
z-m1%FUT*GPcMTnf%?#D|7P|{U;*%690Uc=A(3bzs);;RO*Yt_6nv;(tv`K_rU(~aE
z=uu&cWA$_`lz1Pzfs#y2#)xWB`z9VLBhF*uS2Cax-TXX{VfICmQ2z|X7K=YWKPx-t
z63!@bkA+wY5@S|7JA?p}SVYXJu}x{PCO|GkjCr_8dy}*1BrQRxbPrgl|KB*YVYd6D
z5}4=iP0|H#0q~<GCTb24JJIbuv&;JcoQnT?R%zC5yZpM9-ygyv%<Om7F_aq6LT=6d
zDriDHe)Cml{tj(p=|2C4*G*zOM}MI*XnJHp=wNuSE)?%NWd&l+fZs+D0uCxENMs&t
z273ko%td@aRXNYe>2YHzSro(u$SL7VygA5AKi<>GOsSn_$8_nG0sWxWD{EIcr~dcL
zqFuXvA6c0)BKL%f0qQ(QAo&O77z3}9d(FSZ2^D-8t=H#m`|*F8fDxrY;f0f*s!S2}
zBY1O{Ab0evfvxgL`E>@4hYe?J-k6^6|8(Ru)4S**ytHLu3HR;~QR@yd+m7GrB+MXJ
zYgH-ni%~<HL!~w_o*}uw|4s0Y|NjxZ4k6A2NGLpsSsbR>nJ`BhwrpH<zimDvfiGYs
zoTuUxE3d7fI%kDGVS4vg=fRO2&}?wRn}d-pSL{%5GN7-V*^)jSiyZ!d;&M!b73QS5
zml^Y0VS`%{=~c4mk8H5xVxG^myMM(8Ybopx<gReyC{w{371eg#CGT#uq^OM|wot!F
zHXZKqW8H=}GD>4##?gzsbRqjf66sHYWkn#sNE?gW4C@cC(whx2I=U}ho5x3({<0wd
z6Qdd`{!&1>=CGVeOL=d*KN#~bC_C17t(v!sx~)Gq8g2Rd2FC-(KcCf+Tvxdje_5G0
zUQ0UX7mwch=~e~7C+(2(5V|I>M;^Q%gv*hdC*je}Y*P|H!JGi&C!&L<hW6Ga336L|
z0^*4I`(8de8#R|0O?|@elt<qA5qy#O%vnF3z8<n#Cv_hvGl<PmZVQMw{9q=uD);ex
z_YY+7RX}|Kl{V)(W)vi22TYZbpm3_Q(_Y+|B)sx2r&qskPCYw8L_K$Y76s`Ft7_vA
zCO;qTx?2TMeFb9WMHNX#MvCHh{|_L0gkQ7B5+z{3LxiK+;gADe8C1`})!*B5T&d`I
zC$Ssywhu%AI$sQ`Ay~;cl3{m_&^%>eN$I;|40SVAA@f3*tx%`;t-6qZh$qxH<|)TT
z;hu%XyMfA(!3m=(ge_bA*u`ob?~7I`Q{BTf0i3p_F&cRuP3DNd11CL{58CXngZ7(5
zU~k0lOguo`HT!6I&<=5WQMAQ_C_a5snE@8nPRx-e3r$g{F~#a+&h{X0tUYGtnM4nx
z<a{0*_G1hy8dDWhcp&oTJ!@l{&hG~YJwM&K+<pA_l7$qC`1n%_u~HzCUxP+q1hMF8
z*(EhVBCA5n_?juYCI9`MS7V;uDW{G-G@)c>B7I0njQn#a*wsSXM>K)958z4#<!GA{
zLMp>GIp0Lsl3ES=(leXB<o3g!`wY*Y*}gBk7jkDn4N%<WAtNt^_7VG|N0>7e>L(GX
zyBQL4#uI~KJU-^Ij8||Ij@_3TX+V&7N+9!Z0wJS>oh_A(WgnkOTX4yYns#WDiI0+g
zP@Qm6(~kHws{i(WA|8#v7xNa&O;wh3homMwlnDA2j)Tw>_Somk>gXTE8Zdrw)`f73
zS$_XMq9*#MskgkLtyr*g>Rf(%z&%1S;olCl>WyTKMdh^N0lHvCb{If0!Gj-Rta-d!
zD)gYODAZhFx=UtPp{+sbd#ZqaH;d5A#IGxw*(lz9YBeW=vyzH9rkd#P!?={3EUh}&
zRA~D96nZSq;w1U++&<28b>B<9VZGIRVA=CEH2f5%rY{$TKVoXHhWp`!Xeu;OPeGW!
zciHT9^wdRed4-Gm04%`kEmx~yzFt_U+tLi?Ln^ro&3p*+wMw==zT>7bg~uRj|K8AH
zW3TNdk)md?POnazm2g%;)l-xtc~H7Sb%38_qakmcpb2(fGukTGx_($Qg{I<;KH&0$
z&F8r>EyM6-0CwTgA9MY*zP7(uSKnm7O0QN5cwco{;qB=zExM|BFOzue-k%*bI)`&j
z@EiRZk~i45H(dr0-qU%+fAQ0))NF#m!M}BI!kB`%Ng|=Y+j%}w>p>>7b|pv4sv!fX
z8=xZyZk~B^7%!CR&kFJ%#e>bRU5Gt{`Dw|8qXhiT65(K?pCNF+*Z=U+z1YN|%YxHL
zUjS^!-H%bs93RxzNR(Vax?%6;o)O0PztGL^_`kbh3VjJDWct}IfLwDH=Wb+Fp2(Eb
z!-GO6uRbdJd&PP;5tnmqJ&%>|CP@4!Xi^k`po}60hHU~cus@3d4l==W5^?Yg<wK&@
zqxV0%Lr=(LCp2|--W$C~(G%vElG=B>Rx|DAtvGDW574pHx=ZJOTQHM1s<tT(PrFM=
z3)DqBG{GK18GXA~c3Ws>T5ic#ae{0Y2O_p9CKpAM32EhNM+IV(t@V_z9OT&93UjI%
zhvUaqmcOk~yNHc&sC$z!)7IbWgxWVEJ4Kg_jFa#^H<n6W{nnQLnC@dU{zjXDx;w=e
zS$1_Z1x!@;RjtS)Nc+^$kd_uy8pV-R_h&QpX0V74r?;%)=bhM+7TG#7=9uY%egm@e
zRGg^l$*}Hh213}R*SGY9w=NCPYXJ;ex-K(-<K9P}>?;vJJKp+O2|$>!5s9(*zdNOv
zn+VJtZW`-e>z$AB6H*ll8&@nF@$E|oqTX@20x0Ayj_D6{M}cqr8)h!Y9T(wsi%9y9
zzRXw;oZ>79qcz0>-Q6~BAKQ`Zsk<3&BuZBsY-<@Y-tHwR3y192#}&#o6O2awIAI&>
z2TjZ#ZUZZ(x`~;=56202QO$iXirHse1`6_3cdglMPKz4aLu{!VftcZ5vx!3IwRe2<
zcR_p-7k_T__9Bc<mq8(t1c7-fM&3K)JLt}ITjRyPK~bc;C>Y?u7#9k88u!S_6*}}Q
zHDj2LPPeB19%NP2dl;3ThXG=cD>0Dz*9bdw%1kq1MsF{*?m!k*ZJEy`>Bfo|`#&4$
z2qnoi`<Al0^KHMH20Lrq^Z3=sU(O*C;#%w{ihsYBivvS`bIdU&36_`(4^obE0V*vH
zo3VvMF99~MB7h&?$t{*S^iLCAm;t@~Hojo_*NKP!MZI4o8kUp64B`XQE-B4Xry-q`
z*iO~xqi8CL*pqoIU3B4NC)k6r`l`#QfL-E;6F78D7u-necbk!Ha*-fgri;DESZAoH
zoT=szu*&=^k9k2ZwAFe&sBRygJR%cI@PB&&BtT0D!%8nVFHv|V&a!`TwEQhaySM>s
zq4-)*MzvDJMkp*iaBLTd@#rrkOdTi@mS&s{J*nMZ1(v7B#fKVv^<Zf(jAv*g$E<m?
z$UfP1=dG-Mv??d;U&Qt&BSLU@35PV+w7#K8W06*3zjrc?+RM;+t4?#P)_9AZ!1|FL
zLSwVhEes9lZORlOczBV_Irv}XAv=OR>{+lO5+p(GrFqFtN{rpY8(Tx)%q7(YZVVIB
zw3uWAA-z~5QqEwnb8{LDf^5%?O@8~VuFDoYsNQJ^$wr!>a1+Cac^B`@<FgLILdwD!
zL;sLSCA0q)Gw~!Ew>YTB8iJlE#S1E$5m&Pn23JoOcz=R<@xDg;Y^-iX_`<K>ayE)r
zXUc6&y|vzvvbF^!Glr8mS5sTpZYC3ZjJDx4)c=!Ftc0L?OG*j@QCOrA36pW?WIviK
z4YF1~sx~b1U!>;e<eC0nY2<U4PFob>4EjRzlRS9F-!dLkGnItaCwA*&@1+v?YyXE$
zvfc7Z)YywTY5QMTPM7SjBN7^s8$KZr{JYBL0LN;ltswhYYF$G?0VuVSLusX0+#^?i
z#y_`EvYIk;qOR7>;mWIN;dMGDu`Wd>{d8X=9^4y**1{r54-mr?3s3&JF5W)#K!bW(
zKp;)SBgm(72SgG0r!L>Wm}+(+uEKW^=u#WyS>hBvooj9Tj)3bOKz`+f+AW^xee>jt
zOXf}Top_9=WZ#W!!Fm11SJv&Un;o+ZXuSsA8yr=eJ*E<n4F&6hvpbr+1JqgQSpV?-
z&QI?FbufkZ@R)A<>abGrf7sw8vGg#oIAxc%JvZlG&4?78An0wRo=cl-kfPnC`9qg9
zE(j*Av9ga_+>*n>fPIOK*9j(h6`2H63PD3fn<+y<D7jvuB%mDfgrp?gc#Y^3Ve;Iz
z3<K9v#`pvU@aj?HpOo(gDj&9Nh{K*(L`MjP&4{eR-9)&p{aix+Rf?S>1@nUs-<f(w
z|K5MqtJ8IePck~J;;1KN16xb;3gSgfxEv(<8Ym9_3q|~VU8^>^ahvZv@y7PQ6CB$!
z>nGku>j1+0KR+zeT%u7%zN2XUbDbYC2<OxMgN2xT$*{*+f*QB-|J8|l;S4eNzx}6v
zmoei_3XmT}WIj@TiB2Y`8B;b{vud8EBW%T=r8(%KmB4ddt&?c`JmmsJabwT%DidDi
zp~H39SlT=a5{O{@Z8P#2=1ButQR$I3It9%R5@x&Xz?(*r>HdT4a#WDAoJEVGPzgzk
znQ374CS<ShlH*bTjK4<(T_ooACGG|zI~DN;^r7@wGBzAwcKQFQ?7eTw@eG5veaa9p
znmOXYBUgE`AWSsXZ|_U=L3D^UMkpUXw!d<B)z0@s>qm*zQxX>P!jPx8c8MtZ`uFeO
zA2mfE(jh7uE-7O!g@ub)qnMDH>WVAk+;=|k1WgZG7jp4BgEKYQyWOEj(N5^GV7^?z
zmBup_g&9YD`5fH>zi9@YGvjwpYB?=~_SR`(o!SO%U!f=T2Rzn|5$rhcEP>cd`w)qu
zD=%l*MU>OSPlyYTW^B`yv=i5R&{brG)3hw^`7B*c1f)O87#pYkaP2u}@LSpZ1h>4R
z7lJ?U%VBv-@*|<xyGJ{gn8v9G)xs0+?|Rn)fmuB976<kOHCl#k_w`g%gA6%#2Pby1
zxO*g<%0sL;#J>;Df8sqCuq7iuK#j!DFW?9~+iSss5?T?6@2Ln5RwTJec)`JLzmw_s
z(ucMLzT4^h($AQsj5uYlF1g=vJ(AL|i;Gc!8F55tk$EEc4!_$Re<#nxbQIxnsX%4d
z-*aIX#Pb>+>Wu--w2H1FLb3i2SQm);{{-t&aMP^a+XPaq!h_he%a(?fJFv~?(8K*!
zbJ(1?b@tnl25maJHz7u6<QQN7hpY3XPyOAJ!`i(7`;pU|#_&<c*aT1tGo$7C&oIu!
z6Z;M;xPmRvAv`nneqO-my3_ONd^4jy$FC6=<dT8yeq8#eP`}<4-xW{VU~fMo@Sul2
z1*j`7+H<OVdrb6onlkxW?fk)7B{FGaW6gB$_3r@eG=!?b6jXxHaa~_7wPX1w=`G0q
z-1iCzWrsqjPCvF|<mJ&@l&fKw4)$i*-ScrB;1@jrqAqKKXNkNv3l$hrBp-&0R9Qdv
z=B{V_6G%uq+>WI7#H_zbz>F**JmZ{CcF@B%(er8TzY;QBSx<`yxZB5Sl33;$u?RsM
z>I2`X|G$7ULJFw+F{WSyDt&EuAEEzNr`P|+&EyAHgHp%4RQgR#;IMI^45MTRw$yk4
zBAn!2p={7$4squ@o^XH+>nODr2~`XczsE|EqdO;sD9X4zDl?pr?cyeq2o7!l1Axxp
zp){!c8?ANYUe-N7lG;&8RsA$oMTe-e`3k4C{U>p#O9_j%Xzn1!>1gfk)g4*Q*XqIq
z<%-_kq&86aAJv&GKJBsMI6}(e9J~XVNcyL%(sP=3Go|9{86#i0&??ugvneQy6Ra8Y
z>zUhg#&GejyE8O8WwlN|MD2w#0?(a({D42tq_*GN4r=ibJIQ^UT1l2{P=DpEBKoBd
zboM4$|0?`X{IC5!+_c6u>Smj88yTnPt=8_h`h-0ssz2w~LDB3G7xDHhXIBc5>IgzG
zYah@Fr^L{=xT)lmW#%(mz`SFwnR#RvZ@%Y1GyY8cCIl`x8{&ymZw?~Ae^)lN1@R0b
zL#dHO>D=>&q&YBlE;0NRLihGcAW*oRlskkXdtSgCJ+9D>kb<ukA}ari_*?f2SW5c#
zuR0=0n19mFB0!>Nt|)mVt!JNb5gR=oDj70yP3R$N1e18eaomx?AVg|xJP?8tQ@0S{
z-A8Wof1o!C@3<jBt<d*06o@t5E5kBWSjU~q_Q>TXX3a_I1)DW$RUZ*Lk+s}8b=|Du
z*rozI{t#^u7i7q7&y{Y*1&e?#HX%5JeNR^h5Kr5bwD_MkQj0*|R$<x_Z4}KlXqD*x
zR2;0foC0W*YDk``Vn?|Beo-xmQwt$Z<R43|IJ{3Cqpw6kcGtqRe7kI1yZe(MPc&z`
z4bBrhxxb4O+>Wy&XJ5e7fxI3vXgnit_P8cpwgT#CaUr^0?EmVRWjyG$Z9br*hOcsX
z=*U#!yAtn3iTuI_`{d^@688d71yEFRE$FJanON_XSS62y!<#bovQNa}4@wzhlO<w}
zTHkpumwSvY%T2rDVhnw?$^c)gdFVYnIS^T|G^-r(9u!CW4-}oMOj(V1x(7vW2RwbX
zv3l8JlXo+MKJ+m=Qq2k`3MjOlE?9n>Z)uM{)L^nP{OskYP;nDNc)a(JLe|MdI~kp0
z2Srb)R?FW-yIXNNrJ4eJJ(@ZbO~<XJqsPOb?;?Gs`@b{)UyQwFQ(RrRwF@+9+^um4
z?u|DN!QEXOcZcA?-QAs_!Gj0a;1V<tXf#-G4|#d^uJ?R8r|SHHu2ns2tvTno$2Ep<
z@4}z}u{RS{9K~tMDJFfqavCHbCt0QEBPJ<PWGh)@K)*y-ZNk`_J*MNci{38`G_sBk
z$=R35ZoXa_aj_Xo1OdGM)}cs#9JBl^NM#xpbwAk~bM{C4|C2dudO2l*{~U<REkq0k
zz7<@KlzZORB^lYlt^NLe-0PSgAdL_w*UwxY2XZQSc(8+W9OX$B0_1fp>#d@=dITCO
zuL`#OAx25CZ-*ayXGXRpo-c~N7|@@#T>e94bNIB72WvJnz5B<Lfl8Fc448JFs=$)9
zeSoZ>vM;B~8eQo$qvM15MG-SM;o-e%KF)M)9~nkU#&;M7A4y1f<v`(;9si}`c;t>j
zE3@E)l9J#*;#Zm1Y4J3ewI4Yi&xzWiW=0FK{+psmLnlu2b5#Z0i;-0B?g_pj{-@q-
zgv8pP^ZdxA!TYs7lx;|YXdgeyM5T8w4Z~Y_r8xIu@*>tv`+m|UP^)G=V<XAG1po47
z3R2AHS*;tSPvn}8J<37>vA|ZzO6;G@wjes24RPnd^{K$Uc&VBH+Me!(5yug+aK6oB
z`YSci(*21~UhvR}<pm;?9W+I1Mx&k&%0BEccI>3+T1X@vg9E4ZM|}6YZT+5?G!SU@
z!!Nw)>>VlI!8c9!0dBEg#$*;uYvNU84<w-2<(&l_{d8kn*a0N{ryN5A`6C!xC@}ys
zC_p}#NJEizIN~B2&l222%8&2^>pyrc9y|<<6qb<z*+96*H%E;w)&_%rZIl-{8_b|7
zITP?36OAL;b*e?u6_NXHFG9#o&z}{jyyH2krB8FJcz<^<3FI;s+7N@9(*v0@-d3F9
zeaQJT8D7QKn#RY%9fU7LfdXWBc@D&3If%gJK(#|;Zn3Hbb)0<oXihyLfTtx~LoDyp
z$GsGieN!-AbFy1Y-iksXyUAej1SiQlMga9%Wl~Dcu`dQQ-^}_p_HEsWK(|<7p>MQt
zr`IJJ-hJT_P|2QS;U8zrP{+>iD)-t{6OfSKvm)LPh~J6u9CN*#86iq*-m(#@4dKBU
zwen_Eke~2oV)h{c8~%ER-J{Rr&PB@kvW1ffap=4%K9r4a=HsV@1N51zZ*SXX{=Ppd
z+R^I7)SK6Sy}m4bm5Gefc%%VqPsHA6zl3{N6~t0%@N|42=cPVQh%!YLVjS;rQs^wB
zp|nn3$NL~<O#j3nJ1_sw#{&-7X%VQjULkUN{%Av#xtri&{By}|In3#=DIoryR;#ip
zq;i5c-wh+7vo3;|)RID2Ak0;cu$vB366CFXn&dgtGl>xWcm7U&LyQUXsBgKEeDJ0m
zQ|zLL#xleg2|W(jJngxe_zvMj_FhV?1YHqRx+Z+5(%krpf(=B;d9$=do6QYRfuPxK
z7ymD~n&ew8y!b3naSS)dHqWaZqnM^#Fs7l1$P(3{DH$d8zc~5|g{8h)I6r4T%{g{R
zEaE|?c)iR)#SgK&MVo~*f0IKlSxxsL#JMqGKN1?xOtMv0V``W2@O2q_pi)A}@6ldI
zN9}Mg{fY_v?Id}w4{~UyqEOb!bCsoG_Zpz5M=pqK4U6W3_L%x7!#F;;WMrN-_poJ=
zT-kAKY<OL}3FNuq4Rl_0z7OhR3E6KKfmQYpTYr12GSYSL^ad=1z!laX?7(>InN3N7
z-@PSPAL}gK_tG)?Sdl*Gp2I2!G<emdOCJ^BCLX?rL5L%6>2X}}zL@@VHa8X=zQpFz
zk8`{o&|o`X<isU0y-g-4b6x*kN0<A2xS&MnCykJSSVKGs@$Dc@3@b#BeY8F85SvpY
zJUt1)coHR-t>gvT%lPfdV|hUMoaHyga)M>3%_Dyqhio>LB~xJX04_mvH4=Y$jy;s9
zM|fSV6W~RRj)lyTKQ}U&#|>A-4ZX_c3mnWu{GAUv&1%cTRSmjw-64xAg4D40z16V`
z`s5e6suTqr03cBzV**p;Hc$WKqykyeV}hYvc>*-F=s4_eh(0)ednz2tioG2J;P(Na
zlQi_;c$-{X=#8aeZI%4)DHkx_+G|)Y36IPBfbc^FTIQ#I7&s3nO=o1hRbCly|Esbj
zc*^R{6d#`fR}<*~&#=EFjWR?V7$a@c!Cnklvrr$6c(Ua0ACmOTz+3;jZ%T^s^u)i&
zW=QyChH3e2hNAU2xs!sS4snFTN};=)qm^bAt9_v{m0ApmqqI_Lsf7In6uJvau0;CE
z8#(<wrDJCucN4CP27zl`ft)Va?%_5{?tM8DNjxTpZdZ+N#5KvWC5>c`f5{qsP9@Q&
z6!AX9rQ_1>KMOE})t?V0JLOyiPHcHcWwOi+Mtg##+Gu!4C2i~<Kb+G|4VTLlEAF}g
zLDPIe3;70hB=kRsNx`1yedu*$6Tu-2-Z)$gMEyT4Tu1Gq_zPsegFIsf46YL_m);y5
z4>A0ykhW-YDEXSAR!aYS++wV=1-OqP1;ua@m=<6cw1ozSekS|?^i>BqPq}sK{Bxlg
z3leX_fmBbMEVz$O0L>O5)x0Y`oYf?gYS*SO`NH{g9bY-=RoVW0yKIVvmEtr7TQ`fB
zxNnq&;?O7fEL_XKa~lO<=3lP*I6{dDL1S+GfnxyKd?MffXtp5!fL+9-Nw}#<36QwW
zRE+t+Xb3h44;YEy+WuxpM0V>PH`V8Vk9i^pj!fgv&jBD2B|?Z6E`P=V#C}7fc9I}w
zko5~E0orEQoHgU40u;9u?@uDOKi!f84S#4UbhjcNfjW9;c5V=V{1pOz7CK~a0`=;x
zR*=_p?~x(Jsocmez<!$D{;IUmy20E(!L<;224%aks=`@W<EAO4Cv$xCW_LS;kf|0g
zH@o(t=w+it=qVXBp9notd|f?2#_mNZs?pvTEoXc_u)<|7gf*<6Q8b_>rM$!7{rJVK
zQ0wJCiEdFoxW0|kSM({=z3Zxg;4{Xz!w^2zxm{83{jFak8=|0yhI-!mh=tjmOb!7o
zWK$l(Z?0`%EMzZZx6wulKW;4FCD}tC+lhLZW%dd4ud4u}*#C6Dezr#{;VJEi?E@M5
z^t=2cxZ#@t@j8_ESXN-<4RFA!<t5zb#Oxmi?x}(s6=aGy<!AZRpx$&f@9L`H>9eA?
zxWT%!Bp#aoWzaVG$oa^i{||x&5C$7<PhW?<9h4?XgAM_NTW{sP^#uv7iEuF?9lMP2
zyU1ay&}|9ZGH|%rXz10sX%q%avg>ve{FCuMKl{-(s}i?L5640be?h)zfKh?+b0sYv
z#2d=FW4`j2O9j?9XErFYT@z_(+qrN)S_?8ul|TUL{^BwsV3tO3K$*MiIKmGk9|E5k
zIhnHR_~kZbayeaW4uyP(qwA$IIcxh#K9Nbr9MnTk|8g<);dIBO+p|@2+uW1#2jW*=
zPOJB8o)%`g0+<*Tx%<Dl>a{7|?mA1gWvXQ-bmOefG@7p=JDXpIqu9CoQ8wA0Y?Dx3
zgJ=bdQ2q}6jnXsQZIA16r<Xl0%p}&AD$)(z41k2Rib#F5LDyGk%rb&;pkM5DEeoXj
zA#*|m2>O1X9ytG`Ym?iy#kIY!P~&9_^x!%8O!M>nQ@U$=f#>ses;4jazmqiAmVg54
zuV32=6Pt7f<unm#33$UkB&}iC42f-ReyJ~dpgMboD3s#ee@Lljck=X$b<5aHj8_c6
z|D&*bG0p43B%&o0xw!hH(1LZ?nOc(;oP)TK3(Y?`4lDilhBqh~F}RkfF5Sayd2p->
z?}mX0PN?!WNR<>q@YUQOsH=xN&Z9K&n$Jf@!WlnG?>7m{!~!1NCXXCyhXOkPt~++1
z6f74H2Eire=`kdfVE1ApML?-1Hvb2H>uT(O&v%*%*%0y26FoME{7S$R9+udE9nQQ9
zyl_iVDa<GIbxZURy%1o7TV{bF110cyhXeq_JB;c7f6+IArw(D45l%QL`u1cmb;vt3
z3K=@>m<%josdo`g<3Bp7BqQEFSH$wcC@2j&=E8ZC^ZY}rtY>d$w?c}=ncxbq5u<(5
zK~fp{7(TxF87o&xb2C`0qKIc1`+PU$r<W!Z(&ae*rbWY=K9UE=etC(=;eF$Hd6KN*
z>W5ON%8}@?8oa_6HjcUvO>fG@Ti87n3av;|h_-j(kF&Gx<J0-wqkrD&bI%u}8>}nB
zFUtXAhm?3@kkOyR7P>;8P>B8$bZoD@{cDjJ@d$HYtpO6Jm^wuPn>I+Qj6I>p2?|tx
zRCkJ`>iSb={;kHi&$|WeWc~ea(0{a)ZuyD9oKxOPuC6$<<VY0TZo@ego)@Gub}Ao5
zkFwuHB7PCq)f7s|!r)hoL0@_}H*7!&IoQazhnSXPm5&+~iS6oP*R6k$tns0fv~q`l
z0K5m!k%hM16I=5Rks{nhZ(%Fl0(azB1Z|8u6*{1PVvSDyn>%iUiEe|1L-SY;IKT_E
z#co#jcIV_y?LRnQ85aIdzgWTKKFrbJ%|||a$_cD2xaB+Gg<>LC|0_f2&!Z33Xf<$c
zV)W01zl1eU&z`p~`+YWD1JM)uMWvCMX$Wfxg_cY>RNIa5h6cNeB?07;($mlMs%|>P
z{O)gj`ksopL7c}?&Q>4-rSlI5vD;oovC{x}7;uCVjKPZP6Fs}z{Z|<iS1G_UdULG{
zCP5wG9)nY0kYyk4`lb_lD2RI`yK1(5wQc*-<{;>iX$Ac$|7p>NyP%Z{EAyiGJU6_k
ztv(F)qBYiBcnoi=Xvxh0{=Gwbh<3d!Cm6;Pm|i3Hi~e(`Iiyyrc3XDKR>>yE9Ms#{
znIM2FOW~G|c=-PL^pWviJm(PBx*bT48|`~Y{ny8?z-0bSHq2}PL7yV&$A02U_V?6a
zY+^eZg)(&))Zl3;CDpe>$v4FlmlWS-|F2?0CT&EQ2sKCXNdC|z<MqQnmZ)RHDOcTk
z5DFC$^qlV;cNA0Mf3P?or#CE4NA5o?4tGr2gk4pu0}r^>c(wd60PU4Wnz<qU^34gG
z56_Yh`eOa_QU=zIHe4|I=D$2MqqQrO0+3mQAXh_K*KmqmcG$D~p=ocq>H{wMSG^Jp
zcHua2(n;x`j<poWL+pe3P}9kwHPPAG3KPdk5ue`vOdF<<rB)k@f)Ua&P}R_sq@)ig
zgjA#<x}wFXl6e)>i@{AW?X0don#|DEkSo_fJv}6Nuot*gu#RNYOWo;Dd`0Q??I@e#
zOQz(nL}ozRat%CH#E!vHs;2Hw#_t4QZ`8o7@b+;XkjbZ<2QI#F@$afB{V0lN-CGdo
zfo#k2vd2)aJJ0$A+{Vi-wTi2q+cdyTL^ypXswLvl?9BZnRP+_pYnki^WxvWl!_9<3
zL~AA=2a{_36I<8cfY79ta(om|#Wy~-L1=g0Jg2WYF32(I*C=D4C?CESDCeUa6n!R1
zaU=53tFpZ!(EjP4mtvo~U=6Hw7)$m|)>}r7I!K4Sjel@mNI&;L5ou<K-1y+a?*G~R
z5rK1LioN^Oo3m%ChAp3pPe;QnfsV{*2E+%KF;X#R6X1+snVNFbV@qq@@G9zXzNa#i
z;)+!ulxW@~_5P#VckFv`lOysth2sCw{^QJzr>?H{if3K*Z)z7KGHH_UEGBy%i@62x
z^&_S|1eKok@3wiq|M@K)=E{k;0uF-{2VqO1hRU)l(KfylL3g@X@EIv#omcBZwURHC
z{eYLG0YO#-&gd;=O~Q&LDPSlxx;4n%`TG4*bAHcN7_o(R78iID&hRD<KND?}BN=3%
zL@4?%gdw^T6(Q>O!Sx7?%hGwme(8VlQ(;!rT)4k~uWSGt{&h1rJQ@??Kjt>J#hR%{
z-(x%nsWKU<(jBp<-HXwupYStx3L(5Zg-j<=sLwYR`pW7TNv=(HYrY!|>rg@*^%jcb
zXxX4lyOTzvyh<AGq!wdta6rkvnSI}|c)kZMiG01Q!~TXdd<l%?%y^a{k2mx&Yh?&&
zmpfHi9~>TI>;C*gphW_T2KM{~?MrBL9r=xMfAK4t(Q>ki6LG)@%*OJJ-5lKJC3~(k
zuv<(%z_R-ZiaeV}=l<3O_4;itjKDBW%I~~V9OP>WsMr+WIGPzn+|q*$FnCbkJ=iFs
zj3PbDef{=s7puwF74kqT8p+>?Tdj*R{3w;CQ068+OqzfsO}5hpku8jzgKo(zaJs+@
zg`d=1(Yy=j^!b6)w%9T}XXI1-!Pb7==HFJ1*m=~Q_&b#4;%NmbySrIkB=iynjBV@0
zOK$1P2tK{U>7I}c$$80ZS<Z0n;i@nogloRxdu0FNdnJ(lT?6s_SY_eXj?9#`&_YVV
zImEtf(>skd0}Q(M62jlf2XIaAqh0-EsG_4|5L1fh#LX7o8P$R{Fdvc8l3GyfxqUsc
zWue-(6D+UgER;4!ZgT7y1EtpVJ`A#l`v7CD3?!s#%uj3^&ZU?8vo1h#ocPD=w2@~x
z9ywy>^$eikf_NOexm=iNBqx8OukPpbI+~r0_w#%CZS7*{ZfiO?G+aR05baUIE*HaQ
z5(F8ur%a#GV0-ZajPE<!<&oDGUhIDSvX7TP^&CeRQLfW-^IH##{w~W;_Tg_9gDNAo
z7!CILza~$^D$UzsC!A#y2UoZKHx1FTm^(h*od^XE>k{EKl5GhrGOO8{Ws?*?sdQsj
zeGBc;Cd{?&+tl!{FB@jW_f9Xpnb@$|i-+%_wv?f2OLleHf%z{4Uj3%)ZXg0H5vvt}
z!#O_=1oH~mEVO^?w*U=YG#mf&n>Wd*>;zWbihM{S4&2<Np0sA&BR5(Wjy8$EqxCx_
z7luZClB>5@`?ivT`R5u^Y<F5n*uD|L6EkN0Fm1?uCtI#SM-zXhF1M<PvbYUbKQX5N
zX!#FO^>Lw5y8ADl@RdXyJg#7M!6JJB{qOHsSgt>|Q6vFW7{a!2u^%NJ;$!>FtGI~;
zw2(QIp_xY5KqM;iWVKR&#lpC(p0CtwDOo>~6lK?T8JzF?xJYRMamB}C*+QO~6zkI@
zUgmW8Rrifg)9=mjnD5+|oUZraUqE7c+r$iI1;kF<=5e1g|GCXc(aX!3zsmpuzl6*$
zb;4*<bo$Ga8XRTI^d|P(tceohtZBc38;nP>+OqFoL9GIov4LS3-EqXIACo9X(upu)
zg6Ib$L*&xqUPF5E$OS7NHpJ%NM;QDf!dNf2U>%`BRdvp5+{k$*c>ZJlda%-2m|Lty
zd3hQahp4sE8-K=WKV^SIvTu&gWn`k=x)I6QVZGFFPgp-+JzxJJ1Nb=#SoQpsPgKP6
z+~m7C=`HTZ`O1&8O_^n@-RQa-Fj1rWuL~bZKd2n+>9F`h9I+x9ruzlQ(1&`Yhe13B
z(O9U&dGt;!)T8wA%lT`j+1KV9Se<Q$)tUKSSY;W#Fwtq=Imx1Zw!WwUWnQb+BUNAQ
z_bywXJIHB=3#;#3>8uBYKo*U+@5spK^fT2y*M0il^Jy}*6sVEe+Tg5tt+5m`z92B~
zm>4FtN^2!m0hgLO5FN%-;SdZ{5_Ppw14g}QAcS#19rMd$vMx#_$bNqx%7M(3pD2-0
z^$trG`OMF+mA)UpsBu7nFQuYGRu{JcMKi{atCncH5~vL(*F(?*$5$uc8H$fzpiziZ
zh%#3q;3A1&KJ-)meE$h1H5AHCRyR~Od(A5bFQ#Nwtuv{U;*V<c8NH=$kAEoKtWPVF
z`WF&+gNhZJ+I%g~oD#s3atOfNnNAbe(CKmdRoNtoOkC0u&H{cUM`t|B;DX0%=!R+|
z&|o|h8XrtG+*?gogWJL$$2Hw7O6we^&ZxAbq2DdykFhgKY?&6~Ebkd!w8+=FX)$z;
zSE%-sop|jcgYwRrOHe_}c9Md(;jt;Wts`+aRE%osir-?zxaa)Ok`WW>cL6&bXYARY
zL69JQol$3<ro0ws25{6Auth{5Sl;?A@e_(*D)`S(xX55zTwBzNi>=Nim!*$U#lhB0
zPQIw;Me-`T<ms-EP|)1;y%%MFK)Hv04%V;${D#52QE59E$ko=_$VU4DW!f5a<bF%D
z-|7T1PuZ2jH`MO`kYIca!~S*HjVQ9Zp7$ycxV=l6+TuO5%-Q?V)fbjUb%8B+BP42v
zpm?Yykwsz_zRb93@X0IzFc$>+h<jmezp}~-FEyfr5?mF^DUrO1XUHI)yI^&?Phzmm
zor9hHhV+qCzA&-Blt>#D6nkTc{%+2QZHKWkeVC_GVjb3?*8KdQc5qPEb^-j8nH63@
z60nU<Ve_`_0#^3I_@j<k3LJI}8&w3h!^WEWF@wS40?E~(Qh*-jOn-!8CLSR<Fa_Vu
zs;T9kx4DB+z-3`a$BJt{To=*L;(cOEeU^2LI(X*y#xW9$f|*|AYfSIQei>-7rGMr}
z8xxSstvrASLo6D-YL<J!S5TdyGJ0nr@eLRH-^jahTsd7AF<)+x+%)3Cxe)v*Gi$uU
zVIM~Y@iL!3MD9(!&5{CdY+~441I1L-S|$$gEfj601V>9<MhSAgc%OTOZZza$ePi!i
zBc$A1c2O4NMEV<}Ks;(Lq^t&wdb(<M#S8s63&Bre_VdEa_X*A<fYZ_uv>~!QhKH>|
z;qtr7>Nu4E?21;-iF-^wmmL9*tWg*0i{uT=H^e4$%6%6MG(Qj^;Wkvd08(2?d$98M
z)7HFem3K~AOnaJg<{?p!zBY<)xAH;iE?y3|W8t#p?2F&1U(L<$%($PWaXvgtH}>;u
zYqNDHQn1m*$?qj;baPD<$uGgMN+!m6QMl6};cgp^@UDVdd{T0=I>e_Y<XaURFttRw
zoErk44!L_{V7Nk}4-GJMUf8}r4r%&?!(ZYl8%svLHG#ja?E4R>@=8!~vZ;wF;^2}&
zTrH*XG9Fj>9oI;c@3JczsYl64;AREi{1W(26Ljl@`)&yjX?$e^-vG+o0cN47=W#AP
z5qH3M*6`j#Dl)&;9=lh4I7V02cE`eDwJa?^&4n4E%w62N0AbI@`r%{2$jV6Z4co5Z
ziUV(?D^I3_(zDB4Yikl#`umSg``0MNY{ziDduN7N*$fADYnxdmVo<>ea)tpW`cZid
zhgAZfGP6vlFP!gyYc9%Aoezj{r!Qtr-4IrjR)`Yo@@j$S2tL`IfJvu8vzai#!eZ;p
zIiI54Q0r&t$+;&?Qu8;u5|Bdt2KD;{1Pm>;{WlI~5S@$O)v>AgtsTky3w<g0=}Gk1
zdBuR`Diz%rkK`BneD=7W0>9{sciugNq^7!?s6>u_n-ZY$X*{sh0LIi~J73Nbyvv6>
zH9!BEM=<sZ>|%jAlt<g<yrb<$rf{0gpCl5wE9>rC3$!6RHZ*dH*Emo=s)p$=28+l!
zFE{voT>4bBG?8CEPWL6{m8zG%F~XdZYit?ln5LnVW?>TPmct9rwfjcaWMe7HK5A4S
zBN|w9ELA>=oZ19j_0BIX)z!1LkmOUpYk8iecy4hz%h@!~MaRhCj^pEXBf)7?1O~z&
zmj7re;AGPf2Ip`v<`J_3hHIgzQJ#eT3Q@hnv259kK;6e;nnw+?!MWXJ;b8#)mZjMD
zDSd=kpIlCY<ht$Ts1{I6ru4pDsbYS5_#BLmB)>vwKJ)#;hjDP-%be42(E}<f$;HfE
zf>f1b2e!!Ig-+{+1CkA}?xCr(^%z~ZKK3o+AOy2U8;LQHWxPEWl+L+YJ~Xam2%DmS
z&JW3KI{kuSMTp-Zv^DFkSW0t(f+)33)qbEymU+WDhi1Lg@8=S*F(0rDxHRWRR9y{&
zKJ|IiMkUXDSf|WhJyQ7_^8rJbYm~MP2c}tm4)1)b|ALpqubAJDB|%IOrvS(RGGk1M
zW6X`28yTCMw0le^hmV01X=o@b9DiB{_UBtKP&mrc=<;|^=L`Yv1nx31Hsl)LMPitf
zG}~;8)Wr%1@@~7xTv}7&N#~K?0ru|N^3E_Yl})jHglb5TJ${z{)33+~vNvMzt&EBM
za>n`E6p_j+W7=R<p$Xq8X5L}tR`ZSzx)4KzT*Uo*RdpbXJj176Q~0!~ycR%Z3>_JI
z%MxV4eER*>czK>6LCfSyP#pX&nJztfJlh~wUNs^^qnPHcF?E1O*|V4p%60@N8mlRa
zqFDOiZfy#^LYT|YkjA43_bL}=>k5@2F>~F{9tlwoO`5tDfa8TNLK3CL%v4P~oGuO<
zS$-WZY1kxH@LTLIXf^HD!WZf3lg|!>IzKc=KR`zuuQFhJ<DL-tE!y5JD)ObD0@q&(
zYbQ@46n2Hj<w?y;!Z{P%Tfnhsv>7Giy2f4>xkItWu?{sM_wYJE%J4H`%;1BbqNzOx
zHqBGbOV|ApBA{7(Et%3VrO8brhe1MdT1k&S6+^91hHN@0*m$Oe+PI^oc&5!ITRZ>#
zuu_*QhWrgq&ZPB|zN4XSBjhTIl%D@~JptYt`-0CY!2LzkM@OFpqe{de;p$(By;Pw1
zG6Q<XeQ?gmtBmIT_>{<fq}FoX$7w}@@m^jV7(9e%%;3wwG3VI%cQ#seO;7{_J<)T%
z)$2<KO;J)r{c5Rqly2&Td~bxAMfx{^;f{XJS@gkICtOlWLN<e=>%tBrvV#1fMY$0>
zJ(8pHfA-6>QVrXq)jj0AHs?K%Pc~#+JkuV2ETj&8q6XycpP<u2l3qoUR)%%MnVcRQ
zNQ6iyQn<IHkN&vx`f5CpJoR4mS{|&^zp7)Fx_2aPgw-pxgtUkgm<k8tS^6d4u8X(P
z@6?I$NKP}uCHgh95Y$s3prcOUthS?#xc8(F!FBUUI6dm#JIXmrc){i}T*6Nkl`jKf
zKp#8ND{RyBsGd@bf$?#`T2eTJM@n$CJ7GV5=r#iCP&TAqTMup7n5O4qguem<<BAY1
z1y;4a9YbkTU+~IfS44k)L`CTtaQ(RR9o{AWtwx-BOA6~bq0CR~?Ow7r2Nwoz2z#XB
zE>_2U;!5r0)T2xxbs&%_V|p*MYf7fFkQh`q;_{wMHS71}g@K<BHJa8mX|5$G?FeF>
zd*_=CcHr7d!<jhnm&_G+Q^z}rT8T?hGM6n6k9DdD`S0bFDThBeiX&um2e7=Idg#;*
zuM*@KElwPwruwC`JHz_yUF>|&uYs6Iz(!PNjP%bT63R+e;mv+Vgu{=X<zr(+frbPQ
zSW~rRz*bBq#n;%G=Bf}0-ePyp{S!~a?w$1TGy=mXwk9`PL*2?j?nc+?Q0+U}dOKJ2
z)b#~wcH6RVX`Yyl>8GShxiHov=**m2uXz`Yx6y5yI*iy?pyPm5xPAcd(~hAQVz^4k
zl=+N)IC5My$W^(dpZXN|Hs2mj(Lo%E1KME11q{w1^b<G{C~-xrFn=PU-z+))Qy#Ny
zL$Af>!9{z&@-@v_@+9DI<!E4-ufoV;AO#Y1=}N&C_OOg=MDXk6sK`wkO1u)hV%H!)
zjkb=Wa{Y5!GrwNj@R(EFp)}|^!;#q0!MLF8<~FR7dxQ1i#ClYD)QrFCYk3{}4?`ox
zsb<{Y_KZS)7c^)>f9r-ax4y#!7zLF;KfA#!X!rf?Z}THOMZ$HWpH4-5dC|3n`}@pI
z{?b<Gzvtwsg|<)H`|o|Cs3_=8`CV?8>wC_v@2l{<19yrwk@X^ST#4&~49Nsd?ETU3
zX3Z%#m)EsS$!e$GR<AO|y!&eA{U1&l2HlDL${XtCAd7!`TxGyL60c7~i;bCru4EJ|
zK>H)XSQo6}zY)_H_M@~tl~;i(vU=$c-*8OAY@X?2zxIzIwAti}i3Q1_(PY1+$}J_1
zeXswjWd-^MG`OK#o{eW14uVGtJxW=v$~rc2e_De@?b#yX9T=PDabyhD`u`r~MY^73
zB(>03;gzxIusIdH?_jn%a#t7Amz6IV!Vc~p`7#z0<vsM*=5*T$kBD{|jf5qVtG@A#
zj(it;Hw!ZS$I?y9V;N8PmXuvo1Ky57a@+2*^=7{!B7bnmL%j-JL6-{iJc?}~dOwZm
zhNy_50FGuPe?RO2hdmWzpr?f2FxYqtfF7yA4bEwspblp}6|)!(ZpZeuB~fA7F>wrv
zlMq?d{Awe)kQb1Fl9bgpI%VQwHygSz#On#q$G;@-kcaAG{CLD&)uy#h2G(g<{iwAo
z*{I;3UKORLo8H!W)~N2PzT*)b2`)9k7*c!d>-xqCI<97|9xiY{r<i>vTtpiEW?<Mb
z!AZu{mDR1E2)VSr!fmI3)&fkvV%*g@UCUd2>6t$ACNSmdH250*ambX#!sw!@gk{1{
zrk*ABhaLZGu9;i2tz}BY<shZy-PGsrdUj^QyyAdt=K?5FZk@x*q%}^Stpr_BFTXa{
zHoa58uEdU!|H$Uysj`A_ovmp%h?}B+)F~HSKYjN%$yZLaY50!FBs9yzsk;O^p>s)G
z5BzL%(yY7mSRXxYXI|ORTl#TR`p>o;(jT*Bz$-bhh~rkZ@8iU%NTnyYh{HmML%YS}
z3*QBI{&Rm9euLTaJlvU8(>LO>FaPBDw~-8K+Z0ZdkSm8mF>wV6^8cqKcH01H1<q#8
z)QTz+>7_qojB^DvBGpImX(zept;*)}JCAPW9VQ?YW>y|A{oV+GoxVLh5FWrRl`E#q
zk6(#F@z87^#$hsC1|dK+5*H=_A|)&B4P~Q?W10E?MD3ajrq@|U)pN-MR&23H--MH#
zRP&40%DBzXE(*r8>JU%qk=06hN&0KJWK=s~+*|~#Vg!S0ZiT)E2I^-ob=B67*yRkg
z>z8~nxOTO0RW+2Z`jWLd%7rykvCKw_c3;e^Ps9J-fY7N9_lH=i{S)KAhXR7&7(Nq)
zw6^UVd47UowR-1P)W1xKGF2$tW21sjn{WH-)pM3HmL%VzonsoK7|FIeo>$R3RWiy*
zYPk`MwI9JhXk4n6n%o$z)T5pKQrwdJ0K}=iQme-{ULxZyJi@}$u{0GVZ`NQ>#v~)s
z`OW@VyfLz81fjx&(>#~3A-TBLbhlMYvu|dk7>_WDp;gC?<IoY&Ukp28^<0iCo~c`D
z295+ZJi)-8jDxf%lXcb;T{C-=C&BoES8r34A9Iz3%Y<bB1y2n#m19|xNJiz`jSm2l
zEF~MwKL&9Dv~HBXll9N}dxd<($Ln8%*3;E$hoDEZ8*v2TZlO)_)baedYxJRQ)m-%N
zCkZF?Csrw&gpOG~7u2yX-v(vyT<6VBh@R0%M8XR{pp5xf@0El*m;xWtK6BfV4afAp
zyY`%?nt=~<L}fxigix`6HUi)#w%A6y)!-kc$a>NhAL*qoG8FLa;9(`EOOg}^T<pV1
zrE$B#BFH>CIte^0;fvxYHM4a+qTpxfw@m0A&fAK-#zD!pnU^QmH3&o4H84(1-Z=+0
zmYMdKY8o_LL+}q^C+=7KGx}Z`Rls1}f{BNlDjcEICfp-Uf&u@A@~cjVj{BeJGMri2
zpE^etxsjq@h_0GDY-)@bbvxm=Oh$Gk`RDCP(B@p3=cU(19ZqA1oX7}IMGXpou)woY
zHM(MrF`G-i7`BV*rX_}W9A|c!{<m%M=1a)x`ZN6^2YkaeO3Jz5E$!|D@JFO3N|YV8
z$|EL&Qj9=H&f;n0!7V3=Jh)M1UGy3+&BJ~}4qY~8x^tBleGK<_ZqE^Y`BM9(v(1=j
z!@KEXwmrpckZ;;q;yP59DQrocAyDI_W(ktvB{3}oaWM-dpj*CPo$Y7|omTes8Ok$}
zQ^(Bel_GndGHAFp!%VdDpxeL-oZ`a7|9Yx{*^t=$*}@3CSn`F=mID-~zXFf(RzAbU
z$Zj*dL=E^N9JGHCtDFkisffd0)3rL$+Ik;YFHl_al3$`sM&(P3WH+cz<}-(r%-@&E
zsT-rP9bcS3BDI1Yj8i-q&Gf*WjY!01>;WvVOQ+}%)KVirG=Yr~&v|_Z1oT9WVD+GO
zEd>MnI@&pETEiCm2eNK;&_EsA^6ieFtns~Hbr#8JPAtbpY(Kmsi}eH6|Fa4S*~D;`
z!<w^b`)nZ^hW>met-3&gXrD{B4B-dv`Z{8S@SXVYuZbU=wI7bE*G+8NN_W_|>yvux
zn|Iiyj6&cOz?{XTrOwLDZxJl_Qx6m@`QItf-m@)_EfY0AvT2<Ay{MZ$?yWvqyO`F;
z=SmHwt(G@-C7xwHsct3#p?Om|5R-d0V?WA5BVJ>z5-V|lg?>oYG_E7@oLky^TO7hl
z-ytTKrXmoAE|VqX=g60P?or)57uKdnL7S71O^_AVNpRI-skQ&%va-r(NX1mdDg67L
z2h_m7e7IkuI^&7d56jX!^RBczs)5bjD^+Vev5GB;%=r_%HtdC`!avz73+6uBbHE^~
zvDaF}Vc&AIhU~R+N!d*oZC=7t{GxZ7DS6u0^@J!eBA5c@l}i9W*1lQ&4fa4$p=+z!
zmMn*8bKbk^yEE5QmJjj8?C=?4_{F_f%010MeNLrS)C7H46?5`{{p_`usFWm;B@=gu
zw7kUqwBz~(e6z!$-*JG=HaJ*`zP&8*rcgxUtAB_F$HPab0wosU@TE*J_W_i<bw{bH
zNNzAJipycUZe*BLoDXJj3v6JAB<R9sGP<i3QqsDL+O-_4TIE=3!(9!@X*S$*k?>Tm
z?nZB!+J)O@Goz%nfvVA177i}k`i5ErB@?UHOjm{2%hh_?$+AtwAF6)4WpB1o9)4bP
z^Ijzo%&k~f10!7Hbgtcze5VQ?Kn-h&pN^ZB`)!I-D46OsV6y3v8*#UqpaQa7qgm}K
z{qkqriyKp!mrVx=O0@P&@qIWjQP8A$^{Hr3<WH~>d8`9T=_2x#Ze%qk*|^L7dK_nY
zb2;8BN?yPE*bDfTweEtdEkOtd7n&@Y>OitNs<4#EQ!MHdzg`t*F2<g_cTxpjL}hZ>
z#rMo%qvvnY-#qr7BA-9wy|h5_5$A_eZZ}~iuLlHf^*r`kH^zOYBg-6iq-+{q=A4oT
zr(ZIQm<+WXx=lxgInI9CkU`jOe2ahTvGvxCr1Kc56vCL3-n*V+(jRL9Kok0ZB1WZf
z9Wpj0THrP@B~K@<^5?bm=}S-7GvB9^EHDrH0~T{uN=*)4azEXrwr7~pmHTRs?>TG*
zDVQx0pe!2<RhM%Cxhd3wMnmY@60M#1wGp$JNGk35WQ`}OBL1e-4D#BszH+{d0*M!q
zEri|?VPovHBp||3K;}XPerurH!JraYXr>*dNECJm6?linmAJ8)sMN`r?-2#!K!fVo
z$nNwMWUvTHVYtMLkxIEF2lW2ZAMt&{K_y|raK0UpK$}D@c3W*jnQYuA1P6j1`_N3^
z!NL_;9uZoz4~L^r`YigSKO^5ue*rst_|Vl0sR_Ex7rz3Rcw1*z1+4uIZb2#TJixIP
zypzSr&QfwINf5!WLZc11g9euc`rzs^{dkVEEO(i${BMucc%MK=0g%R3&V0nL8X;Lj
zIE+!``Z&KG2-lE+^rw<;;y0iRvyCE>X$1SlaD*+8$>;<P1s<PUv;P#{ogU?lkZ_4_
zjTrPtN)oc$PymPGM#K8_V3@<v5R2JJ^+G@TkKm7ezx58zd?5*fCr>t22mT!1Jm?&r
zyC+6>=RW{L5XGYc*CGMpA>#H`l~AN8VWlDqL)diTw|=YrFi*c-1{K39n?;}Gb4^q2
zyQ+}auKa^Q0*?oQwvS-o&u06a#k~ZHN)YA390e!v+2{+83U`b5ktlCpEw?7eW=7ZT
zI5YW2*%p4s&xG;s;9OST2rm%{p<Glikr2mBt~T>ew5-nzYj)AYzo%gNp2#={YPs(M
z=aq76h-@wfs97lpZ+sB5$ifFwgb8l~>|UoJ;;E7;pSjgaXDmZI&Pj5DTj4n0#6CGY
zwLy<*2~pc<_EF<t$OATq3E>UG_eEWv7^I{@<~|sqUhoH+C{)Ir#g}c}xe8z@!mVJJ
z$ltNm-GmX1$l^^~pMIKEAJz59Uwkn`M?C&*+5ms)X$D^%`fD`OSYhLuh7XjPz`BvK
zt_3DZFPs9{$LOq-5%E#WhRgm1>MxPDDH29g!|X|X{SNH;oY5Iro{MnC;1?(R7@WCp
zx4x;lU&q4lgInXU0RWyu!^PE{=P{PXa}mp}ekI)C%=PK-rmX%ym-|~dxW(o*v!VRU
z(J?5sfCJ)#+f7Pj^xmo<jw?Z;zS8NT=m)--O_sfWxa7_50YxphDjqN`#_)I3SyqFl
z<K54X1b^k%54-fsRtGQ}<C$Dm(Nk{W6o16GW(F#(_%xhg&fc}AKMI<3`fSb=2ysjm
z5dFG3NgfoRgQ-DxL)c!XWvnA1X)%|B%lICLGwmn7&iH2RUsrn~?Nmmd#jppMOT*^H
zQT|e2|5RBfn0}6cxHxKwA23{>g~%Jxq^mF5Q(RnJpY8qxk%{~|@n4X^)pq;Bv;B0f
zQr;rS8IgHVL$@@^)LN;H=w)m@X#Q*_5|beBFe5?8Dw<r9bx7kLr+>KiE#|BV$JC{)
z+Kk7aa0hEcBAbTyB30tjtx3xxn2tgmep?=ATLPe#KWH>$dYQk|fVC7Ob~&f?$dYtg
zKB(SPB5O_|7bGPWjV$|iEGHB1$k)c6Vba`5p%k{IhOFdwj*hd?F;WPIb7F=eDZ_h0
z!VUKtgqg#xv=2pj`(a(y_~&VQS!-pLT%!!a*k1-M{VT7ue$jN5>z3$}fWm=4L5^_=
zSM+|j8eDqK(eOv0T~Qxl9%9jsk3(v}KLeS{e^I*j6T+p@h}KG7ONj9pPDQ!qg4HEh
zFdkqN*gVPYgXCHy&(bQn67T)0HyX|OlP*iSP_Yzt2{!*%eN_4Z=Z!VGFcNn*O~O4m
z!@Wy1y5k1lwqo8>B(x$NdAV@on%~ZOaD9AH{>|C+&7jcC+usu|IHsN%m@J4U0>5F`
z#Me*L8~Wd`X<$q>Uor-5M0uf6rkt23^qZ?80T7}2+VE>^oy*%2f^7=*0{!p-kIps=
z{puz&+bM~gnwLx>mq?Y_St{a>Y}u0v**=(8$yqc}OK)H(wm1+{84jf-TaaHwZYY$q
zxr$}-;o33)Bf;QM(KkzlVGZ0p{dgi*Uw2&?3DT?KNfP_$<DttkCD2nAvVEHqWPiaZ
z{@g#4vAVhB2Qd?P6b;0^|G?ViZ%?ZZXyQvZWyrQszNOd(;GB|@iL6cbA~|n!{n4iX
z#M-t>>Da{P2t@Jh#qq)T74LLMWIC%GfFa4bxD&rL-{DNh6~WF40Q&<h5D&HtX8F8k
zsqtOZf}Gr&7ayW>ah|th=q{Or1f}Eh&3!;4L;gb#+XRki0hiW!)I}G*Fz{ZL4=Xo`
zTEWEn>uP2#W6>UkVMsU8)N{%Q0bgXEItqciSKdw}e$3(CmeCmO$wG<Hqai~FtqeW8
zg6kq)!}X>pPd;6J+h;Ux-2pIJfgr47Ltw<6(}LIh6LgDbxEnVKYO-@E%rMo$8O|S0
zm?M$LAI_+}6zQo^FHG?DoVTA0q^5jQIGF5_UHlq|lb1AABqlba{T+Lt#?o_Xu!Opo
zfS_G0W^2HzvC38suu5*;!PTb7u%Ex%yMCuOGgjnoOIQt#igx)kddq6~?$Wh!xsS->
zXx*PU=*aVp*IF_Q-b{;t*et~8=GGSkkD!4p2gZi@y)AEzi62KMLj{~h+%l)}1?LXY
zqxqp1QY;Bs%9)->IE!E3P$2#IIN}kqfN(1E{pdn`3w3s?-*6qcm=xP7Q8)NeJOt<g
z#DOSiL}ZvuCF8$-vxRw>vs@j)R~(Ku4k89NE<k-66~fimAHL7^f8G|xxs|e)ejCQi
z6o+))xeg`_0BXXV`-kIxe3v0LqhfK<S(AY-Z@H_km9#zbx!)$ArXlzjk6^<nam_xM
zJp;H0YP-GCTS%k?m%v{ajw{#}rlK~r9R6NM3tGOZ5|!XMS|{ofELpP)N?zedCRH?t
zhL*NCx3RPKs9(meuT|1D54t4dyp69w(#Ywy)xieN?1I}}?yFXHq~j+Wyisyo^A&FU
z`KN<_rCF!Y*(P%oj&Bbz*P+`LD;`;Oal0<zEl@S#T2BO$=cU(Mx$FIx4pC%qPmA|<
zSX0Y%^qEEE7Y3gr5&yP8ve}t9qBYsW7l|h7tja{u^7>{4z~Y(r#T_n|bT)a$ySXcu
z6HCP1-hoRCcehsqiiT#(!Y$9aL(f{@-3GUYu{u(qp7Gbn&ySZt<gEd5e+X*D^Z(5P
z$V?niUMZFiucv;GyUMFApdm!>whD%K%|P;lv)fLV5hY}9_I1}0d<fTky+}9CY_!Dx
zG$AP(+%rey0&@q{o318>?+8v;d0NpcBS>bS@F>fez(zo2?2x_PIv%tGg@`^>s@zgE
z3g~`Ddt-X)0ZqcmgoF-jnV83bwR#X>GdMLT=4RCq*<gS)p;G>?j)5dHfdNl|0wgQ>
z_1zQ|*eH6`zD78sIn+uM@EDfdb!<gJ&-xyW>|d!Fgi##SA{WvVKX5)RNX6@q5}z|;
zt{F5T)%n8RJSs8$;l<FmL(C_WRo{_fpiO)~sH-yO-YRq8!qZ_QY0!Z!FM38CtM>aJ
zbR%ZG4;t^2V6n{=kdf8_BUz^$lWC76EL7hJ>GscK5+97l$9^MJ+*Q7|%@qwZI!2xE
z=j*%GQ2AaoXH}}xJi<<f)$hDJ60Z1T{kP7$qsTw5kEF3bPD*D;bflz?vdtVfN@CqY
zzT}OVKT3Wxw<KOk)pY+T;Su+xkPOprvZT;rXE5pneUP>4PVAz%@$60&>(j&LpTQW@
zSB=TLMJB^_i%phUr}c^>KcTjsw+eMNoq0R2&r>eKN7K;m%0Jkzt~(Js;k!xKT(z<+
zwOJw$bM5<r4?k^0b3oxK>~~I@`{DljxZ>mnbp%WWKF3paeY)T-K87ekw9AM#*?&eG
z?O9PrO&png{uRFrdkwgov?GWEa}1%NL?E;+9bDF!K-{X?)_bvXfq^8FpmDyXAOvvF
zm_vHVZv<$2tsi4gY%(>AVshLxQ{CkqtT~@x4Xz8VQktcYl$S1w1M29^Ju7cVnjFYg
z0J+@M-(`a%-&MRWKP{;k>Pl*8zAqUSj(3XN9>^~`i+|WQx7qeV5BGc}!LEi^5sYI<
z7@daeVvJM7=p)f8BUr~qPd5b`*t){O%D^2=6gL{a!$m&mL%~OJ{5G~qA?6K;9$Y8M
z;I2qGs5rt9K5#gWdJ6v_|MOejq>dHWvBBIfZPG(XSr3ds)F=)3>B>!+#J5=0=yf4A
zf`!o#!1ukx)j|EB0$M;*Px3P*B+SE${k4ffFvW3TR)EB(3LWF*rN5$<H-fscMlW6p
z@H;<^d3Fr*ueM}uT$n9lvR4`5)&O5JG~0c52~L3$X-^L|0;%8Hme$zCQ|ayxg#svK
zbAy5X)zKT<YF;3vZh28Ef88r|iFP&E2yg1VEQLOUj%5J<1Jg|Uu!QuHL_ROBNo&D0
zOh9v#>SVEd>!Xy<4EyY~qE~-V11A5bPuZqJ8%gYYHKOEwnxY5K)rEMIevY8KMb{|?
z(ab|d082x&!o&GQ<)Qj^$bb91GtWgynHWjin)7p{J|UYC$hq%to9l*Cdqmv7m&%L9
zqI_bCj(@L_9p9u0{o}T(7+3f<oQUq${Z0Ff{0qh+CON(hqYn`=b{<}He+*E8yo{G!
zy_gCgEbcJaEU%jssv(yL{wjVF`u@@!XtI;PvUTXT)2zsW+1J;obKuTv#8_<lxq|gG
zR?QM@F}B^cOQ^-&4Bf<05&+brKpaMLF>v>mZ4f&x59s~elre<Zuz4LE%0_#z`ZG@V
zWi3vWB+_?!wa<8ga+mqz8VO?yQ+e78(EV<ZnOBaNYE3iUU)Xxo3|UEOT@vk}UCGaA
zygcZBxa9ki5n#cI<7<h)4=bUH&UzRLQ32oBZ*BfM5m&W&l5i22Z^sH92TJ5Ooc=d(
z>a8Zg4CEiPXcoz)F{*!oKl)k?4h`lIG@5*sCqw$3@L=d!h?#g5E9Scp5U$>Q`gSoX
zM(>KO4o1ffZ>*PJ;kB`qb6pr8;<W+M<R67%C1Z{&u={PJ7AuOvh8Zf#gxMbBN}_cR
zuXwRB8u<n+;BLzTC=!^sz6|g6hni{+F{6z_313Zk1$4o9yyAyLC8k)JuNETl7+fAs
z^ToO%idOKxLII?xpU9>^&;_xUX6RaQaLwsHLD7kMcwO&4IHdb(0e_ha=P|0T)B0YP
zMg%o-P^DS_`iHhpNVS~v!O|PWuTs_mwP4r}1-<FAlin?NE56<}w*m`HG1PcFnRb9e
zXbMf|_h!MkXUCGs#pl}$n0!fX3uS<Fiu(4<w`I8~?BuY~TSDyECY=C;NK;H-X<xqC
z8-Mh_yh9r_aA?3Q?77t(B*la<2Auedp>k}V>=#(OB<Y@j*LS^x)yasgCzWf$dctJp
zJ1RW%UtT0MKCsSkq#>i#RQ~7`^-9)->0Kq<t>IlC-^lqA3~gqm1o=)3n_n*(IQrkN
zn<Tc$-Fr#hmn%%~03Fht1}!amvD=AbfiU0egQ$1cM5_+}4g?&p(fTgelv=c?na!1X
zx9@Eny=GoyoahM$tQULfZ`t-w+4`=QX{Q!<N!8{ogLeIqKDr#)*PJkyEc7?>Z138K
z@#_D3DdU7V*WzxVY{1<@mdgRAiqB;eo3(#6`IdT5i<BQG8R;!N>rGgPnabZ)=+anB
zFYw(OJPbw<x*2&e8Y_emUgBql&dk=!>k9jJ9K6|=LN26Cedb2iF@qa!cp4aV!~hF$
zs>@E`K?5%AAw9e%n@)a`9-FmSs<qxhop%qryd3oTT9K&Mr9fcd;kV3@%EVW=(g5<s
zkS5SAL#0loes<$@h!`9bbbCrjZvD$&c;9?e<swS?KcjH*_{$8BEXAK2VqzYkAP(iv
z?I!lJ^B|30Z%?9i&GS7`6o&KopNcUXlk;Rl4^~@)u6I~6dSb?HO)@VW-Q`<UJ!=Pf
zQAIiJRv6jH>=>%+mfZZPEI~hh=%Ag{bvt+bjwHp;DB@Q|A8g;eD{?(yYu~feHhbZ9
z9f!JLsjgWY65Y7hQjP^&?OIUZu(iJkW$mgb`Dy7jnsvVTJ?>{=A@w{ayWSgrjPUq$
zeInf3AnsPTJrJ1G&xgbCZ~M6|5W!H!$hNSV=uWQsr{hTPn&PUgfaY(;-HBiSOja}5
zXr@S??unLq!Zds4!+-A!^kiXl3%lH3<o?|{DrIesDt1}_lMxuLUB_VHP9QI{HL}{a
zvi8s)V7(wJb3Dp={XOBAdGLxY6(xU;B=}R~*XewLwuErv;N1Xpi^jmIb@bKO;I(#s
zrek}a=2_%=Z_`o3joXEJe)Y<~7CLk@jrtBJPy*wEHtqqik;V!?O^v4Z_~l%10|t;f
z_N&;(n&!4BWx0)-R;!GeJoD_xFEr#n#C465xC}xJ&^Lc{Jb=}1FoQgu$CYQh;`cCG
z^q6xE<O=@#q<$-Y)`FJF{2{BsoLd$Yi&l(^iigUanGtc{T8U&O_=1+ohS;NoL6HaA
zDbHfulTJi-^dT+G$Jk>u8a-LYq#{LCoMI1Oc|`XR-o9TXBH`81!L@2jnN+eHz$bBm
zldOx7`t95H>>jlcW6=6&XT90lg7`X)rxDj=`oXomVO=+dt54~KLxl8F;v=6_oqTF9
zCLt16eBS(GGjth~hR(%EYD4?wt$!3$l2g+ovXS)9>fMm5DAfP;QM7rB<DwC{lRKPH
z`Uv~Wy9nm$9H8FAbKn(+gnrfEGg}#Zg_k~;UV)#!W8^#Ywe`n#)lsgoJwMWRb#Uy+
zOa>h}b}S<3<m#3rL1E_a78L=tbyro5qa+S*DS^K{H3bH1{dMSmhaAH{e;a+KZ#HN2
zd66NF_|mp6*mLaFaPRQ6|FP%!+s@$itjC`T3O#gIwB0$~B(deB5Kg8z*QT(`rec3s
z`Xh_!Qz_-<A%$}yfvyo}U6Xa)HJX!9>QzZN5G-9Kw<tp9bb9b5)%SGM0myM6?&iHL
z8<scN(2cx|HN}uQlel4M79O`@H2g;pJZnaZl5Y+ZM0_esYwuprUR?-Y`JnA0edlZ4
z8%FI@c=w$>?*9PCKsdj?^=-TY&tBI6eN=oCtEz*2-m)IDbC=_d?fmxAKXi`WgHU6Z
zrBzu;Lx+Qa_|QZTPI$P-8!0^kc1wUphg}o<Bf_VJqZrs9Ndsj6#4tvFm}^i|K2-*;
zMN{hFnlNYbLr?s{S6&M`a1DRbIN+-=`9u#q(sCfN2x6dkuEFC#7>E%TAt?wvK#UPu
zg2*@vuIPa)8sH)vKwMftuKVE+%?gI40VYm7Ew_WkH4Xro6To04Fz?`CM;sKh0nuua
z516yrL_Di{EC{H96)eLV;0AYhlkqpuLj#?Q3Q{~(2=J%=*&cH&TH?Y*-B`rw^*8de
z4maP5VySxu*9@G!QARpHve(S~iL6DGBXw^w^_+|Q5DR0TJ9ts!LA^BK74`7L5847P
z?&<Gu5!mDzFIm-$R<$GQgoWtTqi0zQ8JYSt{wpAsbm?k}$|{LsFJ#a<4>N4L4qrH1
zKivzN7I`kS{Y(XqU1N>#=toE6u;Msx^^~Wkmmc2Q;`{@6TxAV>#g$eH>#x6Ij(gc9
zHQIS(6_|k<$a)bC1bu3NKK*Z3T@}9fo&O8p{l9PK)YwX5gAE^_UzZxdP?{d45+4s@
z^m)E*kd;$sFY}PZi+yf3L=A-}9GT~G9u%+~<0u<wQ_SJ*YzJF4@G(Oc?rtRZwpR9N
z(Rmr7MtQ>o!|$R@uDGtAV;{zwZ(B$#XYJKL7Dl_OU|MP*&bzbqW0MkOy?>L`LiAGR
zrFguv1~oHAX;oOpU_Qu*dBm(l<|sm2!QeH_UdNfw@SnI=;68NG_CeJcJR|f+<)>~=
zZ3MJCbm;mhSr>TG>w}B%S+Y2;KXToRZ=>^6SttNEnlr$F3#d?>Im)zu!ULY1d$GT&
zVsb_{RZ^9~q9S0ZO#x&TP<M{ZguVLO862)5E=F8SXaojG1B637IM5+ZbnqA^j%$Ex
z<&`|bRXqHVUGzvNP3abl;gaU;(5s+B4S0oN!Eb*ovK#HU)*-2$&}j5{QSwAcykmzD
zUrFnUXqBnbK%xQf4BZHsb~y<`pFsx4xZja+vfhnJ-o%m;JcAkZfb0}6rq6FGHf`JY
zue35PG4C8-Jn|q4g{6qor+70)Quh=#FX1_M@Ax2TS+|RABc8MKF1a2z-C~Py-fzy%
zuOIP<{}&$r_>KIUSMpb}*Y$zTx7x}UZF6kgu*r>$A9#9gw)qxy+aERBKbSFQm*?#k
zHrZ_Ru)*UWA68v;weato{}pb$;rejakIxMM`1{pPzn`CHJ!dET0N&PS9Nf@6|JDk3
z-F0WU_22&vXaD+_;lkgZ=ZnBr^q>BWXN4`d-a4$m!G>XN+pG4r|J)j`yY|{})s>fr
zU;pCgP4n;lidTj8*5ANM|MjXX!kMR?8a8_3lfrg8JR@xV)Tf1&%wUcI{=(n>HvIXI
zzt2V3%J#zDcKfG?O*Y-!y|vK=e184QpXWG@0vO<*|H2oC$3I~s*Chr~w(+>`+H1n8
zKl(wq>&`nHWosDsf)~9cY-;y!qbF^gr>}4Nd(Zoi^y`Ps*!1~Ne=<)?15eoKiQyT~
z-qDS*l>dPT?splk`Nu!PS*3sQE#(}-6_;IF7x9EAJ~3SVx4+iKaS`j?uCd;k(b((V
zzi$pVUT^izWNcUO(CrIf{8HOXdlS?56T|)Y-xp{*m;B|T@TWi2?&TE57D1bN(?N&i
zN#FU_N#S2N-I!k!K)z=`XXmifbDtO1Tx;!s*Xo^j-Vv_5=AYrmXPj;Z@GI-^JGo$=
z<yXCSzZ~_eUp~&{zTZFAN1fa1$y<Bc4cA{6PW|Bz!WEZamgCk3W`)PD@z}8E%l8RS
z+IW+&`eWA!4?XlyxWhi|cm8kB4Zk?+r{Tc|9;nMgnGZPlEqUCxPx{7`GLyIfy}o3R
zu<@pwdRzJLfBzdUw+BfV|K-o&kEYkBJZ+os++BBbI_zQi=}-J`PP18nvhl!*J*Ij4
z;Rd_M=bm$R`1wzN;t#QvZ;LIr3eSJhivu6}6U>`8FTC#qN9i(r?SwB``~OdV-CuxZ
z*WiG8JYzbZw-{V!@o?M+in2zFUSzlN${sq~#$Ep0aL$}btLt$aiMiRH!tO2XhHRU!
z!J=*vI!f7lDet)D8El>Fue7Obgl!IQ{UB`+hlR2M+8h9Fh3!^Y_f{}M4OsJ*16*1g
zMkvuVVa@*R*1wmw5~vlMHll4zd0@g?u@7K@$w5bs{gDR8tu8iju1VuedfG6F6CG#(
zqJv#iVbKK_;97_HD;}D}30HhM1JEQL5PxW?44we<6hKr)ki`^hH^4PGVhj#6I7>;&
zL!1usix+X+5d`7jS|H(|!2uAbLMom!apWZ(&^7WA2M%k^842-;l}%n)+}2G<hNBLD
z+GBSoF8s|ftO3!U)(jNz6wbguW;8)ZW3QfBMX*nQd4-7HX;wk3=XUQwWhn8CF&r2~
z2Unt)%M7Wg?fBbGq3|ee2Spre5{rPj<{9Gkyd8mV)2XZ0UgokDg*6vE?s=+-_j@Oh
zwlGS^b>99uAuy&mlp}g#TL*8tp>J8d$h>uyEUfi$Y2gjO-Q9JXgYJ{YNS{$X^-5A-
zHC!>{VtL7uxS+<kFWLGTvoD|WVYzyP@Rqh+geHf-_}Ne0c>I{v9~+imeueNvGag=b
z<rO|wOqdYqb`cm+i~9$!^SH-_cfR-i;fZEcN&({$#>m~C{~|Ze@p?T5r*7e~w$;Jg
z-u0faWoGD7{ztC7a=^H|{WG2!ZvNN5!Ux{_&MC5iyV_$O6ApdHyTennJ#>{H`H*?H
z7rfAnf_sF|e(K|H@Kn0a7^0q>c~jGW+<o`m;qW7ms_RQI((ShU3&T+#cwhMA?|&Ee
z+<Tw!#sd$o>lZO%LFZ}PZWliGkq?V}-FchswhxEC^W9TCx*zkH)!m4Oq3c^;|5`Zh
z<R8}MYj&~mW}AiQ?DE{YWW2={_kbA^iw0r#@qNwf_YZr#?B#W3WRK}}*IPgAxYI6{
zws$!0^T&h>%n<LOxm7=vwoc0Wi%EaLRUhZ|?mdS$u6OoeVz=kNFr4+%Gi^(U;~LgG
z%JRMse8`Ob>nDWQa6>#s((iryTj8F2?oQI`gDb4CVy;J0esbpNb;eN)`=9vC=gg@8
zgu0B>TRfh3wg)Kxchc9xx9#W#$glfHz8`$=+u<Fi2aK#KP$#$F;hEu^U;C<;B~4=<
zxa$jE;O!zE6IWhk72jrIb2F;GZ0}cuw;ghj8;F$`gZ56lJWrS5C#RoQS7s7;;PCz<
zKO7#n-g-G6#%3O(?6uFnUfz4}y*H<`@ZpEs8iZf7-y3W{;5X#-2&}r=W4z4IeAbTP
z1MhoJJ}+2ft+jI6%0L-++GST=h97+Q+a(!<8_h+u6wBFV0WHmn@olb?x%{F<4~50{
zmLDH;i(a^vx8300hJ3Hdn)5BSZ7r7AL;BgajRbo3Jz{N6h({=1!~T%kyouRrLZH05
zuFl<Pz>J>iZ;RQQ#TW4gejVEd4-IhK)n3?|hnK~kdZhk~bpd;#`iGLugMC!(qO7t_
zXF9&#w|nDr>anSl<FC=#v*y~o+f0O}yE1_{!=cN4@ofa{&67TPU|&Q?8oD}mnzsfy
z(!fcLy5KQ5DvoR6kynTEiIydKzSybM=OK;*x@mss5~p+vdKlWmLk<93;&K2f1&9cV
zGa%uWkvuwti?NrmjLGC7j9?PPg3g>c;VX}Dl^<TE@UPk=Y9B55(@T3YGb+H_OGdr8
z?-!kfs@JHbs`yS<4frc4wjbD_zOGKq#G@UEPc(VOCB6>U)x#Yojdm;xixA48J^L6O
z9(w3O_u|5Xs4JbgR;!=!(Et-Q7BuV|X?M2IZuw?2kfxrbo0)+ug><`!i~jhB@RvXT
zIZxiw44?w)8pa{P<;hkQ#Nmba#V?<j8|Ci5@4j&E*}ryARy-`@f^e35>>Y6MTScbh
zGltM(PdKs87>rT*`s=Q9eTmRoYp)$X^6^gxjAbcc#60eVuh$uaG4fq*9;kQRetV9(
z(UYDOK7afPZVb#L8w8$UMy>ZAailLoAAInEx;96D_}&kE(2Upbb<a`yn?*dRv9_7Q
zvv=A#;H_MQou9XB`0z(Ro*RR2F;7>#AMr?*cPvK80}pv?ok6fjC%wktiw8Jz2#|+3
zKkmLu(SBxe{jpCU6ZSHLwiepx`>*E7ikC9?6L{34A00mM;g5tDy>w5%F8gPTt?Ku;
zzTUiDQ}B9s{8#Ji-EXLOKXlLDyxy6ob?VV78pwal7mf?5G57)VhQ0EN%iX|9{(WEd
zny~u|UZgBtpLu8?WAMXf^yEPSUd!B9!K-brWF8Ro18;lhdvas&fA6`cu3b<E*^e3H
zc?vwJ;US6cF`msoIpZ|z2mWMR6fAU99;AHe=>JKxwGCtV{oJu%t}_PHC*Y-g(~UQ{
zY{;|w3p>~AuDib=HwNPgoz`UpLVwTOefM0pg%2;Zw+HT;;@wP~j_K?{$iorp6I)4)
zQ#p`ju|2To{@@)9U<jPQV7_f5v7DV3SbbwY*XQ8ol&hcVqJep~O~f2~>xlba_MNBy
z(pC}7f2o7M&aDg{)1`V;awZyJyskNgBnf>6*<Tylm>&7SINPf939@~1j)ZIWOxZ6x
zv40{4`N_jUN1^;oHq~X6VShDp4$y^<WQRwcVNPDVj%`06aF9X55stIr7-yGGRCuI;
z3!VxkhGI6)(g5;MK&6WYa!4t}K}S5n6@Wv$a7b&!Uk2w%uM5gO6VEg>lwbqJC=Dm@
zX5nwXl`fBeQ)npngJ*TTYCmC>CO#=*Fy&wn#mkT?G$>Eup%k%V(zOP(z;Bk(JD<!5
zkmFdTWzfPiIKBc#H&iCXt}SjA5$Q63`DCxfL{Cz<%$CjDd)DzOtxPG0Maw4%ULNb_
z&6|J8M7H3veuVx+<?Tcs(VBugCJK_*>J<5`kb~~GwOr{=qf;d9Eh6y(^ZnoLjSimb
z`~B*1@Mdd=9nG5)Sbu}Z`|Ii$y?`fg9rq7@=)niw*oU_)p0b{1UaZk;ahBy-zRpN`
z$;E$(_rYZ1;RK$$Ec5}kG<g5J-x2OH4_X1<#-BLm^Ns`k-=6y$H##Z3-TAP0zb9Y>
z1u%dd_qor8U;g}OCc|V{=@E}G56EYPx4!*d{yHi~;g|0DvT%}lL<$ZwV;Oh=#!+5P
z|K0h&RkC|9AO69k+z5;D0#E0+9`vTBuhXq*-iH{Yk1;xbzxr<hgEhvjeP8`rr-`h)
zKK}*bUVBCUbG8-3?=Cn$tgzw=VaMm}9QHrxVDrFU-tk_t=U)DyGzqfu%B#4cSJ!MS
z@!3y)qD~HsuLmFcHb;5$TMzSX4KV7qf-imHbAjUnM;#q@c-FHW^-{ZsN51df4YTdF
z&nv={HrdqE7#qI*t#5?yeDfsNH<1|F5C7nYZ5xcu9B2On53+4C{!lY=s(<dW&N3gt
z`*ojJzRKzIgCX(n$#xO6i7EB&J@1@a@60=wx{0UoZ_hoauHL=w4Q~v~udssiU|jk7
zSHBWY`Qi8TK8BBx;XRC3YcD{ZV>=PS5hmYNW^5LG%w*d#GkViT+ig#we2va{xu1T@
zkL*5uBj9<<KAn5MeDCo3Hy!Bc)N8hHpdJXGVRZpr0~cTP=Ww{STL<fBH?!?!KJ~dT
z`XyV9usus^#EyuKf8YF;L&JjQmh(g&JbdN2FN8BrJtaqGKXdfDaaMnnpy8*{SjKi1
zY&G%4&mQA-f&0JBw%ePR{)en>#lB&Wz4rEpC(t|R>|goul0EhchaC2HXMvG>-#uR}
zc6Nr7mQ-4vCCLK`Qc9In47%q%Yc{fD{K6YDe%uYC8~2lD=Q?bpNU<EyIW~FLH>@*o
zKAGcQ%*aKZ#27qhcKpDtdvRL3<6chH$$$i`$hOr$?s=?!yg`oURV%I`J&P}FXW6(s
z-;a2oNh#L<1`IlgLOkjfUh<r^uJ-wG3)wp$U7?Ip1F;ifvOh{Gdg9%=#Om|NQJ;&t
zTqZ!B?Mmr;Q7z+ze}Bi$9?^ms>ml8a6fJWi#D1y43!$+|$}WlBGCoy~4IVrW?4L61
z;w2#kpb%(q5HBS_2Yi4y@q-Ux;VDh&$|pq=4=>_56Aujm`H3UVL4<X!1TujLNC1d(
zkO#aXVT;O{3zs-Rg@YExTJaSP=n<!aNqH9Kd`J_`cKo3)T=LIoP|X+zC8UE_tqKl7
zGCEm1;unBp6=R^r@D@7^RrMjrQn45d4bb6mw1OfIbq3GfICu@B&RCr^Z@X;Z@h6&Y
z3^qw!Rz|5tBUM%i<ckwfhO}A--l~k_n&y*UAIxokU|RsPuw{D)_DS<SUb__B@0OI3
zp1Y(oSoBn|EX-+{hNP9zN87>u%@=4rls*0U8-{inVb~f1!zO@%mkA<!rt0AkM%?Ay
z2)oqxp2bU8;QNu%_DnVmS$G->Fi54wVB+y?#n2|;mGMr2{cE>=O3kQt?B|XNY;S?F
z0l@R{mp?nJ?sfQWY|mc74$pj6ooDc8KJl?SV=#DEn&;xtM;@UpVZ9AD2ru5Vxz{U3
zuA@Krem4e_>9*Vc;|A#BKCNFk=2LF)MOF;aY$x#3GtbERthLTMd6>X!_kUwxUuS?<
ztiSe^<LivU#GiTEDY;P*Ts$Ys1h$e$U&}w^w3Ge8fb<P7ysD2d;~}1?0NYF8vD_<s
z^pl_QZ57yB;n=U77=Cc-nc-b#l*fPs;0cLgT^@(T?YPs<VbjevC+L8|x?#Pu{gwrL
z?Om&PYpu0*c<%FR9;K(Ba&kEN2jBBHC;VG%Z|b8yaJWB&P+T|X^*7is8-wgY!~^%|
z_f0g8{p_d1*H8GeA6H&+nWB3-<B@;-7eDXDU<gou*b*T%K(l{w3h77sFh;A#CBRz%
zpZ(;=y$(_j=g*&?W^EdN;>H{M_ANsAuI;Iu8iR>vyO|Fj{$AhnSa|Ku|2B{65550=
zZVU#OzVQ#gzc8F;MsNWSgW{O4n0Dv9#O)AEOczg``y=fmhUtQ~;UAu}`;N0oob~ia
zyWia0Bj#-Mm&nI8YYYs8>@Q87;z32Ld0f9TRQY?*fZZp%Sv_PdW-+%T+cVhrymlj3
zIdwke!rWMG-s_vyeVxlGL&~iRR~l%pf$myN^R~cTyX^jZws{Bp0B_>^x{)!W#rnCv
zl#;b}UK+g^o7o>hL>;m{YVkl^nf6cULQ}R=3+DFJM*K+^uF@$3p!j%Yze-Sq3Prrq
zIFpeBg5VH`VA7W2IkRfv5HoP391D7y^64yG=oW=0FX<>%e7fOp*=7z<;l0uqD}EN=
zd4m{?&b)&70A_<29+*T74fxO<Pw}JSfy#&REq-0zs+4^Zwu0%U0jf_lmv&H*sBYQ4
z@1&IKoP^6njE4y2x1m@HjKOY%vO0+|f&~QwS+hx=%a^okwS9}49*|AKqn@K7938v&
zwR!X}T5PX}E_&GZPhMzxutgvDu0_cxcTESeAJnxb1}(Dpm=vXNoLOm&&XyyQHx8vu
zsATuJacY^dlCw;jozmjoW`B0?m--edc1<1W5{lb9$au@1xPpuR^hXckS@_R?T<u}n
z-j?=pIe01$34Da<b~~t-)K5NCCt!<;3+$t6jR2#wV7>J=P_XTJ^DVZ_ac;Tg-{Dt3
z|9O6$27djEpM@WO?>m05{e_H)>9zxW(CxzW&r7rAVT{&zNeVXGyvA2?I$wLuKkZ|A
zH|sJ#6EC2@`u&9$=rTX^Au$2QSB$BGl;_#M{6*b%AHw0B>T=!n*H4rB4nN60tj33b
z0Pa0|=r#h3w5c%;kJ4U&d(4(392hCtcUQnZ)`uN@pl{=#IL>LEy!mFUcNcV0?`pc@
z19j<}2tWG4cT@6t81L(|fBDP&ItJ7?aBdFlwJlh2#g)Rl4nM-TkI?JQH{E!n8*MS%
zrVk2~r<?O{?4yc}01tKnUcM=$A5?q!zOVF;-r?2krL%taXFvUMF5eB-b~=I7n;K&v
zM)pQ<@4f%^2RV(>q}?=)k2O-~ijbBMBO}{@^ahQ%_C_h@($Y`oR(*FryhWdf!x&!|
znqk=X81`=oSQ?~93XEI4*%d!@tB)Ar)wy8)a$&jURtWR?038MkhdBQmsmNo^JkA3e
z&IOns^e{&#r?^=?^xH?J!y|mIk0riFXjT1t6ac#Q24V9^w>}5Ya|b5D6^vX1-n$KL
z-ahi;b|`@Q?X+QJ-<R@wo5puYvI!bC9p84*Nb;~SJ}_*)KGZrfo*NU*npSM+)5rcP
zc~vNGf>+PvtTgx5%`cJwnbOfJ4TA<j?jF4mGilvv;sLJl)a6<NSTK*nz$+R`hhCZ=
zp2EQ>%mEGuz<IG9tS$&chdc@+m*`n=W`GYw4T|cDuo~^k8`%JAf*Eg@L3iB*EBnb%
zgW_jV#@YU@d$2dqGsC&1uvoEYuJ*w>CLRb@!Lq0U>Rm5YpSHt7+F#SkMuoEV6DN8Y
zo8xO>`Bo7HMtO&3a=2UrlBd9SaF>)LJLn16=P3^0c>TnOH^isl{YM&+gh!zcq_a(D
z{5KJ$Aa$COgxd;ibiMeo?@Dr(9&|QFwNY70XV#RUw^EnEKS*kY=b@csYnm-dU|&#-
zT5Jaa$dLBrr%W{nll~Voin2#8z#hYFcaR!o^`SZ+TTPbr*WbW#`B{0DmBR@qH8vpn
z$B!~hj5c_;-gn=<dERD$_02#i_~+lRZaOCY=hj=@n^CwrYyVcRulZ-q7_0R3e9b@q
zk$*UD!zVl;O{xq3$2=Sx!GqaW9Hikzi&3};>^Ypm0^3^?&py26@Ng77b(`(NSHJmf
zUDlmfFyo@28{@k2v^uByy6dhxr+D3_d9V4$-}6fho@@nB{McZQ&?3MG`hXQySia6c
z{?Y&ML%z*JqpWrH&bHb(;p^XQgy!Rv64H9d{=)(ugtXdr<EEQ#5NbTvHNd)yIy?-n
zJZQk%9@zQ0yZXTvE&s5(OxmApPhs}5?icW8ZUpyP*#yfi&+?!KY~8ZUuDf{z{lmKt
z|A4ixrT(yk?K%E>)fM44zy6hb;Wsou)kx)`^^*SJKeyh}(1<H!wgKrBZn@>=hNx-z
zKv*u@s-hus(@5?iN9=E#qIH!}9GRQdlQMXVSDdrkw@H2OFn8{P5Vw&KkFE+(Dl+v4
z!?4yAJaEKYc<x*tEZTf>$sF%5*#bk~I4M<tWrUb!1mjm6)j_LkHgD%6(DUZUElj*w
z4M5<yPQc8;S|%F0cqqc#uied(1|VETGSPtUMrQ9wQf78gZKkFLcY>;2mJ;H_o?1)u
zQTEus#_=fr_RK~F;LKzfa)eXE5#iJpNje8MQSxvoPWiYN5GOH-hZfgzoVB3mhYmEs
zFXorMRJK+_$!(}bI;1&3tOz2Uo)HKlVj@8#C^Qh5bb%BF4hQteM_72ARdAib(?J}C
zRiP!X_>-=DoT0}dxl{&=sz4g>g{@t5I^k8mGS88>-JVG^#d5c}jk=R%GHOK222zY3
z9CR8!$l5|5nQUh=KT9`mLhnN^Rlq(-G%CT2kCR^O`@u5Q5-HoWfg0E(URy<|?bH%`
z4>47U^}_0*c^+bPCeFWxYK9fBgIKT=gP8NTYoPX<3fsFp!_4WjQ)bFyWpqO@o(^_s
zU+*YSt&~}TTZkEPTOjn2)CuiQa0()De}U|t#*0S3Mmr~Oc?N#Vb7m&Yz?n5FuvH72
za@d1ACIH$-C2b20Gi8yNU2<{YBW3``DLg>sA&gh=t>$?vxY#}@wa+VG?U!4dK^R>2
zCly?J$tCWcPF+PS>#V!3l5DTxmHfyfS_IZK<LA|Xy{ZL9Oj>un^>dtCn;5-vga(0i
z*IO@-y~DP4Xa%XqB>Mv6y^FE72pSKI@#%H9OCR)sx04`xI=1(ABwv}3>idq{Zfi;U
z_JTgwdEC1724OXowD~lk_}YD6=Ek6nZQtTgf9_cC`$60D<@<#5e|w%U@Qc~%>)ndJ
zH+B)H(Y5Mbx_!bOx3@0mop;>Ph*XSgQ8wzy$BsTKyzj`Pa-%Sr*tZzZbq+jp|NghX
zg`+=oMBN7tn=@>j!h^$Zfe+lB_~kE!SMT@w+z?N@=D`F9`#8VhfH#M4edEM%^7p^z
z{jzRpGhVAas#a%<#@b?@;=_?*dU}nKXE@O8hPEqtJL$;J0sTfi()fOO(Jx!?<8M_h
z@-q+Pn6ojbioJF_SqGO+n}|kV`-aM#2{#=2HWKsM3l^hrW*F83@P1S=xMGYK<q~w{
zBsBl(rF6VP&cF2^)VJIi+zYJ^^Q7Lv7`fbOg0q!l)b+f>B2;KIP6M<w9rcAbcaQ81
z?fUqBu3~$P^Gf>ON%Nl9L%DwFCS3*g$8_+5EZ5i`)iYr)C9DZ9*W}|2E&x8^R5@uF
z93}zakq=s2Lx(u7MT;}n%Fi{p!XXR|Ks=!VDBcaNF)IFwq0VIFP$9%XhFNkU05|~Y
zfP@kq7?Vam!pb9h7UcjwAo|b+9|hp?o6@jL2WTlD>Eub{9I5(=8t@xs0~pZBA}{6|
z(68Mk7LhpRx=5K^1LBsDrFt-dG(C7tiPgtDl38=D1F<Jc7>%t5h+{rTy@K*ao%c$m
z%2(8Y^jeJX|GLf?Y~*I!N3LeuhvcXqwXUvzK32i3e%WNwj3RCru_96DmMn?;<cb4)
z^V*Y!9bs^K5dX5yUIy1;O^dWO|47Ud7IIdWEPV=3%N+GTC1ofPx&E7QYnR?I8~58g
zAQihc6_tO`{q|HT;)9BYWf)i_^*U<D?ZVl^1D9<|8<;8t+eXMBj3?^zc6)x{17^TQ
ze~#NlDA$!&T;WDgjG=f@KI2(Cy7#KmFT2D(D2H)|x@iv(@4e^0`M$Rpp3gt;9HF*6
zr?1nuLcGsjE&qT2FYc?W55u*>FQ(md_dU6MD`j+wIJ$mBlFr`5jf}y<E&Htfct!WD
zAD`hL=+kwxbJ^Z>_uNza7~o3Te#XssYrkWq;}u;G>W`<kqI$e|_1CMe3}>8vO5j6a
z03Q+~eA>xBj0nju`V#+3t=?U5-nmI?^PuY8Lk~TeBk>@k6+H5hE4NB+nTE&o+ic4V
zJifPn>Qntge0ZO0OA|70^rR<+4}bLI;jIV0(dSz&36`Arqwjw=@bN<S0_P)v8*jFm
ze_T;)@VI@`L5KKOG3TFq4ui6i8lHJ0L9o`^>nPap+%CPCiCWZ}dof41*KlZ7S6NQ=
z!#&O0jE9zP`I@xb0z`Zt6QZ`*s(}Z~cx=wGSNLT_OJ-5M@#rI$uO)0C<JEq~5`Wvw
z=Y4E3!2HjQ!pLoo0L+QnRJlGRSyr;9b*uL>buyP~&MCGXjQTu8_N@n-Blj+3lGE1-
zcFj}-*%=GH46WwQN&YHWX<+yoU>unW-g?ZFw`RVZiqlIBeW}(;{t-`m&=$urIQ9;-
zIRk#NNov5N#fvZn<sePzDm-WMfr~wpvjkJG!C*)jrI03G!iNTNq$`j3b0%G9@Br~8
z9{R+Kj?NYp0m3Or2oMD+L5Ko6!$3q~M1Bgbf~$ZMhIGYQ&_TvtF4zJ>hF|ai^31nG
z1tbo79PoiZxJCZNiG~F$n4*EKhUf8(W+B39l$K}gFW{3UBY`2#CvEAS?vHfa+|JuN
z3_6gwm#|eD^D3a~)O#wnB~>8|K?5}Up1?D<&n;uHFsT#l3l=>T%dMEyIXu*v<UyaO
z{P7FgRv%T!)DWh)X?9jwVtL~g<>d8p7H$r)@#iH|o;+ftf$@^YhdNbM=|vS**UQw|
z7ClVr7>jtL!`cK7Qd-@W%PzgRP6PYA>NWZGU$Xs!6~P{lmtT5m{vozky>34xnNjH0
zz}5_L_%kJ&-mkyz+Mti4J@n8+;m4<+=8H1jf>v_ngj)ozyXG46R$Rw1R<|t)TEQMK
z+uOa&z&YzDXZnZS*t2(?$34!ot+{6X9;!uJ`p6#f>3+aPyg^*EWx>7wHRJaqAL-=T
zU-rz?P8|fRmNc(Rw$)huv8%g2^M0w2bB(pu&SR)IO}7A`GIUrGPCD^~u>I4Y5gxPp
z>P~yV{om+&F{fVaBv9|P?E_mdoOyb8x<bE#RaaZBbvfJA8_{WX{_`JyA2<LW%4}jE
z#Cy%__je;KaqOK;dD!QA*g)Mo)jqz*0r0`eXYKf$@P;=XWc^FLaa_AW*fE;l%<Hbb
z#xeNe0S+ITyZWzx&Ephc{M&ZB?R7Z~&XifbTEF6oPBT50$qTXLN9SnA7=_~;E_)-X
z-=g%9pHT~$F#66mgY{f9CNc+{YewNYwx{rf#rX&6Y<`p*`kY@gz4al?*k@Ip88bn(
z7PecWJ%eSaEv>mUDzfpDv5UGP$ECPVZIq#kt28hU8fezH;|wKJVL5U##%c=+dXGul
zF2eiKa>%DtAdh_!n<YRYZIR+Yq11VSLp*0}od9V{Cr%227I@e+1?0s}o5m@BiVF>B
z5eNSiz$aa{Qt?(?j!Whuq=g})m`VunQ{jY9I)+<73=uHJg_dY4OkoL2Y0y(1aCJ>s
zbd_#Vp02b;{K2W9fd()_r3a0v2uk<GcrmezYa7_2QP#Y2%`=j)+lF+f%iz(327Yg|
zX0i8@RVRCTKRLPB_}fIxs-kx+)>&Z?Y;AgILcEF|kOtJ$J16gxC$DGC^HB4Pwcob8
zx5b2g{KE`TQ&XGM>NLefa@ujL2<!B0@M5um9Bw4e48=vcI;B5yJPK$)TcSJ|@+jZK
z3m^24#rcOY^2T0&2gu{Ed)ngM&kg#fvdTyMZv9slr*i1HZs?bEOsTo$@JXpiKWW_1
z!q!IzJLs2fnQsqH;yBTYKgKWZ(+b{dk9mxvW5m1k;@ZdFMB^{EZG=F^SgtR#?IHkG
zKfJqA0}!wLue6eVl!`ur`c6ONIn2mpTQKZvhG-p~?)7<{8U6&DZ?Tmdt8|^7*WX~n
zaKOQD3Hu-T=CJRpUlTAA0_+Pc;G<<}c@)nXL+sOccxE1z=F1}o97xOhl&5Xel-p*T
zZ;|Wq`7e5LQ@mCQEZ!TzHD*8;;KjQ0^Wq+}ic8PCz2JrU<qg+g?+>-|h`K<m3wdRz
zORK-&p~B~n`BWZ>r}|;<cvpU{z;)Nw>II&yY{Sq9yx!RsDEnrI>Rsx|%A#q<opx@N
z-RU+<YnXvZ8i*a+Zofk~@Q_3O*!_jI`?P4$qHxJyE()Lg=toRvT0@2Kxb@a+O0w((
z?!RQ?jGhEM_`!4d=V$#yQQ>jxuIJ&{-!>nGd6=|t;le!MTMm0i!+W#W-us$oblh7x
zNA4h?kx}Okvg9Zj8RPsVkLn@-N0wjd(M9$gl^)Uh@Rp5%IabO?Vd8rLpI0zu#E<hX
zviq~djI0h;EcNF-P%b44bJ7WG2eb<wj5Dq<p3k$7&C&iB%wIk;mXyM7S`uM6^$!UX
z7y-bw5$8!;BZgTMwpX=zciVVD|KNy?kV}&r<5}%3#kgIB)$i=X?9`nKmH`c9<LEL_
zlB5Xg+Zj&`teq^K#QG8+f_af+N}s>1Gov}t`wm-c($89B&5l0F*RnI12^gqg!qLe7
znBt-c@Hi_xX!~c%A4L@TBS#K(7Z%I446|eu5QZ4S6GjPKGs1!oa1C<~aD<og5RT}P
zraXkjANpxQ2=~h0vQ{u1G~k9iYs5VH90^#hWPnXyNp-`VEuQ2(JQBGorbE{N1~7lE
z&+h%8VD4Poo7fg?Oek3pu#YZnz>Q0TVmbu6bktFQd_W~`?$4s<VKaOzv<1+}+IN{{
zkA;k*65&yU<QcUbL*P#vp}nwJYz6ulT#Cc?5Dz~*b&uSOFRB@YQ~aW*F&xkO=}*D~
z*~io{s_ys3H@T-5{e>?MGXe)6_O|f4{omvVdy_WeoAOflS3f%|H}3K(>RaFb&anLQ
z%PZN>w5x;Oa%dih;actLXFvUM&^8E+Ux&T(-T77n$}oSyf^g{D-<2D#*xOXzlEN9r
z`P3hNKWBqM_*u`{DZf?#!{_@xcvP-S4B?%^-FM%Wqdv)u_jsxnfqk9RhXk*E!~S8t
z4K^sEg_rH~iogQ^!M9KPx`KV5FEX$7U;pCgIUV-9-tGA{<1+~uE7N-ShBqEqSKpNR
z;6oeNyDKlhEZlYHok9!y?SFuIlCPUz6To<kF<KvFtV`_RVuck~2ru31Wq!Q*t%v2?
zv?!~8Ov@K-G3GY&z8@Aa25n;=x{_~?m+w7=^}KnthX(2X+EWmd2=-(C&Nsi2$6)mR
z(pSF`UcASifd?|Q{SSTQqv1_&KBUfYoM$LGkk)w~aPaV8e1IM_J%%A!^rplp{P4pM
z`9o<W7zd!w<^c&_!Lk32^G^Dy1<Tn7^6Wg_=Y!**=Tc<I<{R{3^XD%JjG?oczq@Io
z6b>zk@DLB<8Ni;X@feqy9ObHhD-BH5fcpC^#p*EgWVT8iB+#EmgK#-qGFlV{!D)%p
z!Ty;l8JTr62$NQ4Y^%+FEX6>*iwez|j6j-^FvOH!jKqXA(Xyb2g(CrFNXFtKeDUKf
zON{b?FI>q2fAJJQXo;Q$E9g`MG}3fIo94q)n9;}=<82n=X})g4;;n|vL<qj@<2zi4
z6G+zwUc$zF>1?ZBR_@9CsgtQ=wyNQ9rK`Agrh!;jTjS<cE34Dw;l4A`)1HTMAc*m`
z?yxo8=BZYPj0gMM#n->gYt{_Gi*2z=z4tbd$<mz07^b+)JfY3JflaY^054wjaP*?1
z`D9{yyUG<mn6eCdlJ55@9~voJ>>qk9O<#4)>T4`-eA}W|89K=)y~cZ~JK9Oka&V%a
z@D#STGGUbn;}Y%Fjv`<reb$aU)kR}?YXsL{cbyx{;)l&@80-<80$lF8<M!~?<Bv5%
z>w7%u`7e4&;KO9+o%5S;n|*X_{q;BSk7wy4b|C%ajME*rlOJfDaQt!M(9BEpsoQKD
zjy>UP;oRSx9q{se^rKe|yPC03+dbf6`t=iz&q=cl!?B<JOgQ4Gqdg9z)E7@U(O-Z6
z*G)Ht$J#a&+nZ;wwv_<sgfATzZg2BJwVXkTfj|82!tk44{nCwQkUjj!qrx`ZZWk^w
zFYX8Kzu&hRc$!^PW&oq!FV6a@hdcR6w<EyV`Ngk%%{^7o!AFidGGHX4P95{fkA*Lt
zc#<35;q}>Lj}K>?Tx`FwqIrOC_2jL?mUak!^Xp%Q-(7INE=xIo`M58Jt<5OD$|`ZM
z>o*>BaQM?7ejo0<^A4xahu*$w^#TJw@WPk8)D73?oc(Lx+GN8GAMY~O)w?s#a9n<<
zCntX8`0(z-kMKCQjrij6Cxmm)Ioq~vxWT>Xx7l`kuOI1F9yx&y0<<|Ee4uL{W*m9+
z|Af;|`BC`q-FJr#H`*vXd&iw^-W1y^_m^!jh6#WC{e@-_ez~)JzIia;Z!%nE4~bS>
zX~lpS`m=Z1B^T$4%P!5s#emOElLhU`Klq-1wDQSMd8(tXvF4iL5c3pH;omp^E1dny
zU)Trj-jGK39WM5Kc&?}Lp`$+<E;#=@f0N-9+alwtD=tryy9_fM26~zMGF}wN4Cob0
z0DS>zCGgBxOkjY0aEZ_D=Fhi%U;UM3@f!X)4qL1@Cc>h{_I8+kOJT0Pm4>lo{=5Y?
zPn_?@;>C*>nIW5PB=CAhW36;H{BjJ9V+nI(`ujMK=tAl&5BFuka*v4fjbc^qf?T(#
zwK;RV@BZOwn_u&`R0ZR#0p_MrKCgG<Eb72yD~uK1fz5Jfq0(4dM@k#fTVQG*zAh_?
zNnG<eF|~YKeB|3Ss39^~k)FMdQio4G=_mwz&cf$fbU9<|BwZan=?W_z{@@a?IOwI<
zc3DSPG*WrV>j1$NK$cKKA|t{nz9_7e0v+%G@`6X2=s;V-TF?P}6sLR=mPGO8%)Y|p
z1)xh9x}vEt*BmKNyR2Y3X@DEdO>{3X8-RWCL&UJa1Yln#Ge^4t*k8G`&c-XRd1hf4
z#)wzJm}`KF)FsgAbH6dzdL^{{B2!Kkj88`Ov>zid+bB@iol!YVx-517=;%xX<`OFp
zuS5C=R7#k@_b=VxDR_U?51Vo;SwE6Yle}@Nmp?>l;K^U~?xkQC{qYY?%ZHb6x?O<w
z4{ns<XFvI|8PHY_d%xmUJ_+5_j7c1g;EdBw31^&oa-*cCaeQEH^~XNey;A8b*04QY
z*?OV~7&JfgiT|~|Y;UYfI^RAx_T^*0;NHu;g3Rmjd%k?1Ivg(WO#AM)P6|J>{f9>d
z$A118_uSp#S<iM6xCiNdkX*dI^U44HNchL!uU1ss^RLY7cAr<iCOmr8Xi&xoE<<?w
z5P^N7kN)5h;cf4Juj>k(?f!xnHKc#e*}pP_`==YG^%HsDefNehec`j={U7|WlUZ@a
z6~kNJ_Kxu3Bj2Bs#rvD>PgL(PVsbQsM)mIOU;V-!R%{h^-Teig1uwVf?z($j_N%VE
zBK+Qr-ETPHpt|@@E-+qWT*t5v;GNpYLzTtxr#|*S{>r=~4(aFXCww_<w#Am=@lV*u
zJ^Wt%y4N@4{5Sj9-zkardPAfnk_Q!szw7PcC40Wi+S~zk9{u!D=bF);dcN~>cg=H^
zxmeAKTHuE3uk(i$+wbrUkACFJD+i3<z%T9XgZ^L?6O?j!GEZUqh>3@m_!bRw%`1E?
z-T<^Y0PSK4-oj?6_79c0H>w$kZ46jq#$xK3ze&bc0Tm2Q1JoIeP4VM#)W>q`WV?c}
zB}Cj7f`<p?dOo(}U8VP{0o9eN&AKL8V<+{wU+tpRS=Mi+5BGR*hVxzo>Azo2o*#CY
zg0Nc>#&*dbSg8#X#$1C34hO)sY?EA*cVTws8bO6C;lY<3l`!ehQF_WBJZONI<|7aB
zMR~|8Iu@*X`1*zYkWrb71QgF%08<Ep3n&a@;<$#XAiYL-;frrd8ye&-79zz_!NC(h
z&RjeF8DfvH;tmO{G3#cFW7khxm9fbg`Z-MuWi}~tb8L}ull)~w&teZUYg7C(0rLUb
zs-hdcFc{h~X&!3Gnb$G)y7U}VC8$mQr|NGib`?|9Kuv$el&RNVckITc9mQ0vEGD~o
z;F6C)W%e9<{xmD?wwmVdB7u4my^QfZwr1o&-D2-xKyiLCu0IGFmE{8az|JFZD_dNw
z#QpH($wDzw!;2TIw02w?p*n4Q8*fXxfMA!Nk9wEYsXC%Vxv;*4(b7O|AYPUKOX;mP
z7YKLM;tF~CxujQMn-!B~iM8FtC`>PVlX*R|b;8OkM~_QBB$e*}Tjczgi~d|^h}8bU
zMLb=9>+2_m^UP}(PtJ`u-88JY;z~;LGq335IrzH^FQ|*}^x_*|{Yp6J*S|FShdBKe
zR#-95iWepxs(1!B^XxtC<R2Q&Z^N4`KSnSNLxTJ7yDwn)!_&EFOcu_t&UlLAt-IaR
zcL=Y1?S5gs^*8W^xA@bq{Px^)!pXMBYq$Fxv#;_I?|G+hyOA2~{UKbTx?XJe|G@oT
z;~zfT;hE3&kGy%CHbF4FUw7TLfo&r2+U*>uoSkD+PVTFWdFTW$_w&q)SMaTGe9gVl
zz20p?y{pv=aIUa=hcWZ_P3qleKlO?5hu{4!?0>+4=4HNi?6)i*b%GDoedk->3@><b
zG$4v+H)lNM@n+^;Zk>6|ruo^P13g~e!UH$OFEh-Zt?zyNVd2Gl?iKbhPhow~P(0AV
zsn%{z`_T`5JX3tzb2fP64b8)!we7(J9^16je_VZaxZ{r7okaQu!X39q&+oRhJ3vrR
ztg7~@kAE~AU|Uo?IwQ1=002M$Nkl<ZZ@1^?_ZKqxKDr&yY>ko)G;uP}8ntC=ocqLO
zo=VXygLo=WGrTtO{@sv>vt(kSds*TDP}}kcEw+=T4UayOnLACG!FTB*`yif;X~-4#
zf?nWZ`a_JvcsslL5mh(755D7)mGX}g>Qu?(!rJy+d)onnaGc8yzi#m6olm_@oC#Ym
zxKWsg0(HWUQfn3OnWTaC)eelt?U>d>eJ-=|GEc)P$>p*ioRSC+prtwsBMneMv4Iu#
zOs*NIus>obCM+?O4h{x}MOhlx9DvSgzGAxQNx@u;KQze80YA>d;~G5Z!Jq3o5Mf1v
zB<7rzt}w(21Eh%=;ncuOx@d6*z(KIo+n4+t;OH#67UeXRpL`rjCk#*JTVP>8acmZM
z(sQ1>&+?aCdX*>4grAk>-#^r1dSzi^GC-iQ^NOA?&ba$s0>**<!K#@*)#B-v(c>_{
zvlHWs?`O&DJ8npB#jPA^T5(tw)4DMTr+YxR(*;i!0XLx8J!SIED|-&vJ&qUF(fD<*
zbtxKznc!<H3XH)_?%g|BOve3eIzR*7CM`_8=SeJ!ljym?7^5M=@WA!Kzx;v?swG8v
z`?$}2c<=PbyQX7bRMl=nEn$G6ZrW(+Vk~8Uy*Md^w(4i;d|D7()jT)XSYyrb-+S%}
zcieuv?HBrRoJ?68DWi?!<-6MItNZo<(C_xa1N*{a0KD~<Tg+e=4OA_PGqNNm_G_)Z
zc6j6?R}Qz^{;ZT018%>t(jy)b)-+FR77Mr7>-%h>&<ZfX^U*VmguL!g|JE1y_|X@I
zhM8Ae?J>U110PZ3;Q;lnQ(%AQb*+r-?|$>Y{^cIyo#yQXkG)VIv-)FwPvUz_KKA8Z
zX#2R13#@G0bF6OiF~8)E03I53+pad*Z1bS4A|`A+|Kaz((^QZD^T|(#r#@|4FFuCz
z|FH)lWkRvbUtk{Kw0Z6Wx=;5PE{88|qR6!u$}HnL9dpa#DLHK>VGaOn2QbHse$3GZ
zHMbDQPS121d?<-|Dg7eA*uG@K-oUcDw!}Wf-FLs#sW3yrqkK(kR5oAlM-<w3vo@ac
zr8c5-H_E#)IO@M2-aX|tLFUg}&gDRE-*cKb@a%~9zSDNo6Za}pNg8NbuZuiNsOLqJ
z?XJ7&N78oEm@XKN=Sw&dvBp+^);NE6u{d(Y?ILVVYV)*(wpAf>ZnqhAJg&6nx#^~x
zgwsy@9+RtA+o6RnMqhag<Lyg42ZbjM;7pvZQ4ZJ2CuQkOJn1xS=qPMKzm{T2Ck>!;
zA|C)9u1Vu8eB#N&L0H$E9Wb7z009iJ5K!+&7y@EII@iRfjB=t`x)_Qnd1TOq54=TJ
zc_|Rq80ZR@u#CLqBOY1ELmD*1i!hMJ#hB`MAR2ImXA7NXgKWQy-O#{djHjgBdfnxI
z33rv>s+bvk@rs*dQ)Bz5L&GC))>1qBB*RcRQyr<1fO`$cVD;O*2BgOBbGFG*9B}PM
zGN>@|wo#;Z{}M8u#SH$j`o-TQxlIsb6$WSPJ}oO=!4o!__Xi4=vs-Fyn3bBWdw@Ya
zzP4ua+oXNc79{LpmQEzHt{~xGX36@XHC3=g#*%|MucRO7kVUMPc#@N$_wv$H*6+RE
zy(}GyoS;cw)tDq{;6WC7Rwqq?QFWT8^rOY@gvJ<mhaECT`#z&a0*P#huy&G+4JM?t
z)hQSD7Ut*`Fm`c_JJ6rtwR}^!u~bnp?Ed}gzjaKL5ACsaKxq&MknV4M8v!tybMyju
zQ2*_!!8uIek;}f<95qnQA4NY=lY$UNYL0#(-FgCV!f)Bz0|L#9x7qILxiOfue{@k7
zMXTLenibwcJln6mMwbIP7dfUZy1BpL7V)jqYzSrX6mjd9c{tBp#^*B_hv&t)nxW8Z
zM~<!didMO2x{UZXgKc5Q+iSMw;F#z83}Yl->_%bVp3C}8X>e5XmRtISTAUaq5#0yX
z4yB`}6qrM}(aP#UW(bakrKULsn!uVD5Ag`hbEvP;5ow@|E8>*~O4UGYdC|E~^|=HF
zwphZEhBit!;p<TX`8uow9!4S~N7st**ebC<QYal3bO5JO9JWjHae$+PYk;%tubiO)
z5BPzLL76ZIwouZ6M!Xa!9P*QoYtgh|PK&S`T0M~bz(^U3M7RbZD8Y$?3HelrG=G|I
zC{7zZ@G<nF1n|X+coe6CfD4GH!r%asiG2EmH1q&D0LH88cOV+jV5tGObS734n3Tn8
z%;d~&x$b)D%$gC*sw0DOhT^aKTQ9*Ae4ctOH4BUn){eu#O_i;nR}DlxOWVCtX_QYB
z{8}25>^Zho1cQ}BgZkxn9&zlRH%P7#YY<{EanBQ;AQ%lcy~n5ubW5uN`GG~baSIu<
z(a;US7_<EYCuoFj*E(?0^Md37Pb=%EAF5IOekgQW3MM8Ix2OJ)iHw2wa{Y*FLZsOv
z*+I0WSXO?;Z?Ify{OUs4gSWiToiu6C0XIW})nzFELTr2tF!Hl`h?&U{AEe+#&%LGH
z3%h(dDvIN*0b0ilzxOKsNIHu0>&9QNyfR#W?X_XO4K{G%`@Hg1_5rt*!o?R|6xbJ<
zj}$)nsZY)KZ3gMa>#q-|ce$^4`I47Gk(;R-TBH}}2F2LM*Tu@vj3&98@q|W^PGfFU
zVzW2<d|qaq^n{HkzF#cf!i*s!1@?`NM|4`SvBl@B$i}>tH_c|d=O}M#^)&AoY5CeP
z@9~y4qS{P1V!^$3-I^hIuHSo^5*kq(MqHFfZH#%G&o3<CZ>5?DqpqF9&_cyy`fGr?
z%Q}(vRc4pUN+-U(8+GJwlNp1yFKhR%QYP@J{S!(Ic61gx69>>d>0UG#5+<*VyKEZ)
zJ>tOyPqZzVhtoxa_=B6$hd*gLlg5$Kx63>oK9Y<0DF)#b0RcH6E~Z=q5{@%QT|kUe
zr9h87qALMKhkW3ZPMYv7m@83fisKAl4nQ=;U%Z@dnH4XxtA3klKoh5CgD&|x!D&X{
z4RYBc+j;=I@pj9(>!Sdx!M41&T8b1l38Mq@Bl8wEnGls)>~beEs`8IY^hA_pDj1Dk
zt&3FDIrkz?0@*v*?wwuh{<NmlX{u49UN8vSL0#bKe*P4*Q!+!ulTKVOCOg;2%s^W+
z1beY+&9A7~(&g=dfunSQSGsJ?2%0P|j%g4jju7lNng|FpdRYdo2CuL7u!Yj{pw3;T
zX@i4ioYK!0Y_V@K8H|6N2(z%~!C}#xE6rSmmuU^CFBoct97m02{n0pz)`d*8<qy68
zz2URRec89hU`r@IF2~UbFcKeq)CX+qjLx_AXhf%zxaq55@5QqscGFObxN2;jXiGSJ
zG}^ZES~O|KR<;nE>vOl%=pfADo-qR2TV?h@e)eSa6h=PZPQvD{I2`biQ0A6AxaT9B
zapF<b$#A9aoLevVsy%hB3mQ=;PTJxA;t|Y#(u~!4LZgiB*_MLA{K4NU%&0|U@btQ?
zr6^*VAi^9pR;CeFsgY@tb~cN*9GH`r2<{zhbOG9judPd@-+)wR*>M}B7t3%s%RnoS
zUpc%Y9C5;x?b4!h`>G7V%1adiPkFfJ;9B`Pr}k0dOAgY6qd1GoDj}grFRzX==EkHN
zA_&|y&SIi#1d7_P6-G?KSHUE>Xz7|WAZ4ZWz}2CGsvz*^0G~6U>y!uhcn^yocohsm
z0}NgOH^W*czf+)wW9f}irsT;ZJc}9BjP@)Hu|8-=o;l7C12Qp8+T;;nA2OcUyAi;2
zG0P?vZu~QOIY%VU6nu1YM?sdcU+PAaI;WE68c*sSalUsPTR9jcNq*h`Pkegm-oZu;
zPmi(Q_l<gMN?_1tpk;qx_Bm#dwV~GPwzWM|TCU3^)Q_&zminQARO(;)qf<_9$<nS~
zmcy+b6?7AE1}%^7B@aJ_58}x<VGH94`eW;tc_1SN3{fa_&4ZM<z%<R69CK~fVo~)U
z1sbAE6{}HeKy|d%i;h~Nk?{B87j)2O3?GS{9WZ4pmxK0yUD)GgdxsbAv1dp>0IBQ`
zJaB(F)jn2t$`8ID2oDPi8Xifn+*?_*Idi_;Y)6HX7E7!7cDuaw=?oRjcNW{+hyEKw
z;XE_+dp}-}I@|yTLHWKb))I^<CY#xXJ&e~db2awm#5f#3I%jg56PlJC!xgd@ZWz1O
zFZPnZc^;pKG^0(t-E7tXZ1oc7=~*2bj5y5&ZIHs8CB9u06RC^-7L=E#Sl1g6sG`P3
z19AQtodL#1s9_3X^Kjm#PU~}j>}eaUuWfE`fAov&tv-lVd?F`}4r2jEAMB6x5*)Hc
z%3cW`VGTfBD-1sNPxc%pP7PVKM9-3PL$Y{@zi_x#7+Ua@EL?MN4Tu-`lmXm2C>n&x
zkRnP55rz<e5TvQV#GxSaaws487-vP7d^(5|fAEMWPTNIDXlRMQ1#?>BK^kHBvt>le
ze^6tLv8kY$2Dp)`D9v!<?QW0NEI*B(1H*9MoSGpIDc-jLKql{`;^N=E!YqzT3b@=c
zSd+VVHHgxTKX<G`yB8^F-(Vk5(uBUlkq-tS_u#NWi`NnHu;n~{z~E{fsmV)wa&O>;
z$cwC*&S==fhAwz^fjaC`)Y`f@*H^<S=>si`h!<s$Y|GF&Ukvg<11|!V-O88*2VP>|
z+t~V^Io8N*gmA;KE#rN0$Cyw-rGZKV(^~`g{`bG(q!UjF-#+Q<Vb#@E^N;EA(Ym|u
zyffT->n-+i#5-#3oxxV%&A;jcq>icQM!HG#H#I|fG0fdL7BBLL<MZs}d~>pKggN6#
z!PJ8BclK=d7mgmn7+dDe!!SI@=5FRO>>nTF+b4$HNR1;cK&Q+HAh@+Z?jCD348eE>
z$0j-Ad)h`N{*arwOf_d{qp2#nQw<EDbv0y7A652S7JQe-*Q~~oHh}}vfI+4l*&KBp
zy#k~C5tVXHnhd|-1Edi~P;8ZeXb7KeBmnThffgMT>FS^w@fW^uMUVWX36xG8^5j)O
z23a8rfoqT;r~(j&a1;cBoWTc&crnx+0Y~`aQ>4c=24K-@#$O)4(2?-u;Tjs8Ia0Zx
z#rms)A!~p^mcxyoO$ILS7~0^p6C1BZZt`rK{P={YU4{Xtv()$MX{Y$M7EiCJmL{Wh
zhOQH95_k){i8z04SXJ6lXY5Ze_mJw<ZgP}&0ZCmXk9+IQTVTCLymMtL-eoenb9j1b
zXX>gOS?xRyAe|wb57bsaiCba@>m^Hga2dhG?;HAAIC)-^v3p?Xp<PMe6a+e454XKd
zeIjl(J*kT(kk^qYA6J8f*f*ntq6}qo)qRiJ9<I)7WuaHG*MHgHeIh=rqs}|fC)W@M
z8?yV22A0@_m9Y;QTnrkR4HofUj7mp?EqX=0i3ZdMs6IA9n^Dn4T}VgMNC_C}ZoTCe
zKN^YcZ9hrCry;)HpF|EYs6KD-y$xe<BY^Y&&)%EIOH&kizxAB+EPx9Lq9Tf*xUjl!
z$POaA8!B$&@{Y4PI^(=EbKkl1-uuseKli@(z3*(UuQTqV2qKH(0s^7}?ji_?h^Q<A
zB8tlLJZHV}jjUgFc6C*Eb$3;tKIc@NQ(ak^kr9!RnUPshSy>vFi_-IPdE6Q%C3zMl
z*BfR!T3T9ONVeHSay~e>X_IX$VD}x^@|A6(b|;Z8G+0<<rE9u{1kRV4Ew*ZSQ!+O<
zZ*xyuG0Zj?+5A(jprqi_5M8rk>35p*Fz02(cf1|LG!(f<29p_C^}UhKoVL?0d-Ajq
ztp+M;fL7G834=3@((0IdGx=ppM%r?1z+Ayr9kalKGH{R08@NqDYCFV0K1(@Uar6+D
z{}VA70EyF?fsAx$5av*t1>K!Rns{&q9~{EsVZqF2DmhRrIFbh(^2Pb{18JV7GazFO
zWP&&&1{pYjxBww0#7RhvFcO|?4)Q@mbaCzi#KDJn@v@*7Kr4MklX&nbtnw?)JUX5S
zIiRUC>2ZFpTUcWnV4&Q<2ZZcN(bR!WXgUMAHO6#sXCmoM(+s7rK4|`_*3_wH8U*4s
zv8DhgAYTS%5Cm`s@xhO20p#-m+Rofi@HKK@4Q$<rakhn418YhHHZ$NcoKI|4uz~x;
zmA+@=mCt8Q$-Xs<$u~)-(3+~-wlJ**S`D-sn1BXw3M{bd)*P&SbdD9ndhj^`_5)ck
zheO8jke^qyXOb;jwpiRImmAr6U{SNLb)a0+fPh|b0JHrEtGrim8ZZs&Xk}<MFcA%K
zI~lfYtM`5zyX%W9?2I2Jyv^ENk?`Lb#D$Q*k&gio=D@jwpAsO0;&IFZS^!HtApfVF
z19IRh&5=?(aNsXo&iFg^fjaRg-qmhr@mC)CM}?z!Lk+|{5dEkSLZpC%V?kUq7AIWJ
zDhTJ8sa-lA`N4x0LUPTSYm@{ZK=IHajB^+~XbPaiA>2HF<xv@wuRTvt1KxoKjk=cZ
zc-EoQCoscFXe|Rr+l)C^nf&lDYPx`C9DpZTi)<HQtrA1lnY6LjFi-kJb7hAx-zUoO
zr>;0EOpWKTcCJQ(c~a@@7bC(<IBer!uhrSau<lu5s5h%$pKylyBW{sN_)0s3>1(C}
zoWXR<McagKZgHzSgi#G~<2Se=+AQ)6Y~TYCOlXFIA|P)*t*DTb9ww~ZsaWMsz^3Kw
z$RN#mH%a@7;_5hu8VtYC^M08A)<M4#4fejquJUU(*dNX<*_6ZgeXm5J7Njt#3=axf
zpUkz(LPxNJJ}C{=!muUMYG5^MKm$Yrc4=DF;+8ReIPG)b36-^Dk%K0JU7nOy^5gO_
zW3X^3L7q-tesJ<7RsKBg;A?M={`q>|rkYC@x6YfBakD#z8PY;?&GQ>fcU%nT8z#6u
zpX1|m8_a3V*uvhzJb+{?304f_IN@GHj%}PN0vnAKoX~m1`@RzCD2nbUC<!IwJnP#+
z-~_hzViA)sXNkalqNzI;tzZ+7S08kyzB)D5hd`UOdNmLXi8bKWR@2DaYhV3siW(Q~
zdEeL=9(d6k@R{%i#DoBoqJzQ`7IXP6xt1bGXQ1MmLrx)-C46uc<_sR`_&pUL(-VJi
z@_FU6B@GZRVaY%o>B1qc%gM^M5I_bvOE9isBpj|u(~4a=baj>x;Dd)kx|pYNcJcy~
z7CU{37k{1M71KjegZM+Ig%#2O71s}xo^Kfa^7N#c(WHTGaN}tdMYIQTg(D*4&T2KB
zLH?00?^ZVW`^sT!;HHcv^K4J@=3s?2(<pn|R@@|*T)D0_=+?^JsN2BD>RSdatpJy^
zzgAY2iG_y`6qhy?ULUj;Xg3ARe6`yCTosMzV~~(>%?!frmtICEAD_P-%kuOSXh0fr
z4B{QjItX_FyTas{J_t?l=w)1`<h{A-im}#ieZXI1vzskjA8&-M&rZ1QBLi=@g^x6b
z6~lBw-YRhW&x6AjS`D-sSQi?QC7z50UTKx8w3Cn{&#OKShjD~?ynVdQoUEOXl1-vq
zc^<iPS}~c|@rUD=@r{KLe1Hk3FsU2Op~75{j~sJ$$8de>$qQI|T{}w#P%AG^sEu~`
z+i>Xvmr^07HX&E9R&On|8dy~tpfCD^n0#9vuN2(JJ6M<Sds(}m^#?xVkuA-QSux<3
zn+DEI(p4z@o;ZOyhntE{nyv!{Lr4LiDEO@K1qX<6pe<gciMHZ6%V$a&c{u};i!gYi
z701gbOS*%I=~`zp$)gREd`2+`U+E}E^rRTl!6iQcu7raJc;q2H#vx4w17A*G!omfI
zLrTc=cY0|h8d?ietpO%1senwhh6c-n(~VWPSzi#rp@~f(gB8)IYixO8at2Y;CT|z)
zJxeUA2otq1xug38{dn^RV*<iXAB(Jw^eKK(^>471yEFa)iJ-r_OGaJtI-2h-XT-Tt
z&})2k^D3l=0BQg6n*eJ^A<DivZL5^&BkZ$;Zd`R1pyzQt8g%FEzUrpvPPcvtUFaZI
zM()Zv{Ds;=HZBfNVx%0Vcd_m%E43qegru|LM`Bu<iFQI`@#d4Zp;F|r6I8c-I`G&$
z$_Rw^&chJja)>^{ihe_%tYg@0y1&vwpEQ}M06Y9OI6H?|;8sFEWqNDl8__`4*QozS
zIIMo6^o^db&=axh%juRW*9Nk=PQ#_kv2|{f)3C-iI9BBfUVbd36h$TR;-o*~6~_@C
zhIc1#Se<6`@;M9PgiN<2=wPg1$cn^jVaAmW_K<OjvyXQ;hr{aO*;&RR?w`V3l{unT
zqh>Xc2Iz)^^*d&HGkZ9gPS!Ulm!Y!|gME~J?&}Wlv^{Xj3Nx7QRA5+{SlJCw9?Gg?
z)s<x`6xs^WoCfGzI=Z=dU$kZ%T5@;Vs8?>of-$l_5x&oZjcXFb&Ui3@z>I@JbB$A1
z0^rw_wTb<h#A(0+S9vrbkp>QF<in>)9O;~uuIre;e6Hjt436knFp~!w0BO({Z{jis
zu3y-XgyA~QsB~o}O#(xh>o`qLUgE_Vr!F|;<E%6bI$z@8A1jbJ4uP)88y<58`uTjM
zL5K0Lg;k&duO_Q3+@9VFMvys7YRtiE69K=u9)ZS0vv_ag$4l)`xt#w7oWx9UOe;2d
z>%3_JF0XqTKKmv+&=rVZe=x+n(UpTvXKb>FL)fiS11jTz1S^DL;QNKz<T{(QHoz}W
zGW4V11a=wH!IIZ$nD9$y8l?02hrL!StduVZR|z##&`{JX(#@lZ$4d1f@z2Y}bu3dq
zyrR6L#04Iy6&{5^<vc1)T*Atk$3*PR39!2+0YYF;vALbZF}d{5uJQ-lZ&%#xSr+2`
z4Fi*7d71sa*ROr=ufaBT-D#lHX+qIg!gw^S^k9BE1)b#Fq2ZzpAg?kHTd8?`(J5os
zFFjAIj7CvBZ(fD17_ix_Ol3<lUl~_~KIyo0d<pHz76h1#at?>B>zFh0-HS~&?gWQ$
zSUkYPN;@nrn><ch_7Z+!4$GJw=G@^yYA39@u4f;oYD@Sx9UWRK<?C?rGOfb0bV|^M
z)}{t%l*J9x?}?eu8b;KV$4~?J@#YFliQy0N@AJ?(;?6P#hoY>hJ;4Xbq+EVUq@ZYu
zCk_86&el0QxQ-pa;Dbw?K>6jMB@YK6J_>^y<3SHx;Sq*E@i>M7(HC#d(C7g&#sE<=
z>kt!NgG(5Yz%YdY@nQ%wg*nIR<Rcx2t(>|R^f<{Qe&8st_=ykKq`{wjT$4r~=o1%x
zBi623SOpsB41l9dhCNR<6X?)d1qHXpn>O)u)c1y-8adgyFln>KZV}!w*jj>SZ+PH)
z7f|^@5QIcsO~rW>kwVcZZ+Q{2VyAi#DwA`zifG2^W0P!FB;XLXKiVM<SYO>;F6!7R
zlr5B(wr+<xqXX}BB99Dq*nTR`OYJDlGy?xjyZ!SzS{^rl9g`?eBSm!>=cqp{879MR
zbonKxDAX*klTUfbmWWmD=Z4EtL0&8;tA%Zv>9Yv852<~vkbQg<t3IzmbWJ}s-mKyG
z)j?*n!qzU1F+Q)B!W3)3>R2B^$ajk=mbw+KK@Akxp;6|=qe`e|I63Phj<LkUa0izI
zIz_Z%y7_R7KMc>5j@fQ<E!o5OdEP#;c^3{=Z65|!n6;<)D|n&}h3{P;Cv!&}!gj-q
zqs64enQiNA9mf}-m_s-?hRJ88w1aCev8$@1FG8^<<6?HO(%3j64#%0)2hub1Y(Q_)
zg!w#WAhwJ%X{!%9_bRF0tq893tc|a}GPM$~6AhS+@Wl=E*U&j@DR{Wg4R%WRx}iHv
zr0>g0$sdXTkvRDu5e#Q9aludpU!<I~;3<s%Q(=6T;ERrYq!fxc4$_PGTXdEVj`E5>
zdE$J8p)0?s1p~+dt817_s}h7X5mq{BF&^op0i1nxuALRnnL~L<2T&X`h#m!zOv-Cf
z?l{)9oW#mQyyC!xKZ@q8>9qx0SPdHR29g?&Q7692x7sEM9h<3c!q9Jhm;baogA*oi
zOf8uNg|4JBdk$U^a|oG~Hcj=PN;bSmrifG(L*?~>31@IRnH(x}C1jgK8*S<a;KNnf
zQ_D*EM?kX1z`of&K&Fj{Nje{}gEvkt8jl;wPU9MZk+RU@sse4ZI(BD>>839VoJXnm
zZfgCm;2>`5KmG7mGA*>Rjs!l`buPyaQFjorzSgYLGmT5+&{`X2DrVUkew5W#8d#7U
z&9DMN?IA;KD9|Y{`lb(40sa8X9`I1RJXmr&-gJdDRKk{QRSl>uOsefwm1_#|^5e@I
z>>J(+a^;-H`CNUigA&JWpZ=geQH6_eV;WWRfg|3-@(lDtH3k0E(ZT|&hL_AKywMjT
zus?h{uvQhQAw20QkVjU{6>U3VA9t9?2IsI{`@B~78CDyt7B*mSV#`T{jaj0Zj#Gg&
zN!{QPQKYF{vr5Ir^TzC62Rv7B`k=I{jdZi%s)uhc%GAfi^ZHOnojCxy8l{C#eW6<c
zr&0szo5Ki)ZJ06t1oPNB+p60HD4I~%S022@He(nWhrx}8VTz+eH)FA57-PxmVARIV
zWH6YWE=xM`S~)CQ&>#$eLq71}!I7t<e4JH9;3%&JyYdJRTHwP^@>{UueDw?a$uo$B
z04IMfe29y%m=dRS(j+ADQpjctE3e|o13qW)I17jePlxbO0#0B6e5J>EJ+b{+MH)~K
z9Ab3WWZ5g8#{p}q1u*flBH5M_wD6#w)OlkU;m_*V_QM3EizU8XAL+p-agG5}2z13M
z&CXG_D0aMH%CZ^}Ay*Kj428jB#&p8ozV$<>2p{y^85~|;VejBZXQk9P2M%r%fkAPB
z4}-uLNYh=0GQ|YUdVfdaHBzQ}<?f<}JZgAd2`h9VSyn(#MJy%G3TdM;wpK2)uy(LA
z$_j3MNYDu>rnxf@bKI7@xw6T$^>N$g(O=tjXYml@VRKTplv@q78dwnx$S$>ZppW{C
z2B}F}aTCqh;XK80%BtZc+3Ztu9ym5Lv+kpgs!7(Sd<<l~@kIq;!2xB_mJE=>Nz7i!
zavJMiBXe9be@e$J@TK`cGejsZtEsd-2j`BZ`hUPeD#k>oAJK#M`hZMJUR>#JeU!Z|
zW!)OcT2rHA2#cg_5?ga))my&7*6@Y{?!V?CRTZk!LCH9{#uteoTyrLluzZ$;aR8Gh
zTxR&(u*Wp)vMU`r0`h^cIPwAFFP@wgM;;)~EB>6p%RsAfvj_`-APtL{3W_k~QK3@r
zgEO;eFPP30Rt04=1fZ>D(n=SvxNy*gHwW>$=8O{=AdS3Aiwi~`tvt413#(BBVd9iF
z#)^hZPl|kkVtF>KDW@<_z_cdKDXa$Xs!1>0k&vz$)@oG@Xbk8^Ml>v;x6Ik9VqqF1
zOI)_s;OtkCW1j=1iu4eR!kH+Ps~?ccDqtX6tzgO`hJAzi&_pmLVAKVn9NLNksyK6+
z{)n7Af>Y-+4&a6KV{tqv@Mteys^hG|j8o=8+V9YI%z->*);swW>Q~G8w6uiETH_h{
zVt|u|sW^U8Ve#(n$IWxM+RW9ZRtGi3JJfObEqh4S6mPa`z}8XQJXi5nn%a=%^xPQl
zh_FhJ9ob-;Ug^yPJ~T@I;^B|m#VAi3Tw@yWLEXxf>wjykl=T)zy7GacxzV9sp@*k7
z%Di}ZF5NjMH}-b(4Rf~qxW{-nsD4S0aVSB)6nS2{1~1Q(+st9X_&ZCRZ(DHN+yiFI
zHzk`knPb>j-9oRbOvCaX1wS6|gYH6?vatP!?a#toMC%TExL9#QiS(PE)4s|4lwFZx
z2pATV1>)2Y_IV{J>f^mAYb(Zd5to(mUWbnfIUTO8!ndVqTmxx)YLXB4-5ct>@3y`l
z?tO!yU|)0I#GMqRrbhz<w+Hw&5rEzp_ecc9;UMAU|HOEbAIC8H<9y`NwP=Qd20Da^
zCqMMWpFGNIK?knkFM1j<xh5ZUz~Kl6-2woa@{ngBB4h?6ln5c97=xoQLQ8q_#z+aA
z0nq?gj$YzKQ#j-&5ApEVmJsk05BLHxf6)&q?eDtMfbYF%EyTA~P|IB78t}%S-b}Kc
z0MMCOpbU@jSJ=`-KZUQ|s|#5tvVFzKp1MaIr<R`%i^1f)?htr1z<|qH8=T|AFt5fF
z-TJG5j&2iwX3DAFt5K+q<u?(&BAC|^ZJ)aN@XDSh%RW(b^H-hb*qEbN&)BS60xP5e
z)p`BhX@v?@%+~v|m6cTv9UEGV+f*!L*rM4Jx_y`on>_Y_kDEgr#x1lOXf@Dkpw&PX
z4fGqZG^kafGdj+K+3cmIt!~4EV_38%!(ZH*IQzW<cidK#)OnJz$sS<#tAY%>4U}u3
zRbaVp+LUS10QcT{cv+WR@m$>BHpsTBsf$B7o%FUI3x_Wfr!Ij1kvMfs&K&qO6~=!l
zzp0$L<lz7mN0>MUgZL~TC+X0Ezw*ZX$tO9$(>3^jt~mpu5w7ev?+}KVn1jqUnI)VE
zat#v>rIU|q-K9tf;YcCi69;YR;M^5m3;MP4N*>`Vo_xp-Pvs>|=@ty(hI}*7Z(%|j
zaHC=~jO+>N5PX--V6e)S)m2M8nx-YK6HrmJ$ry!KWKIVd?-+c~T}5orZY&`JCk4=<
z8{+%@dfgd9x`?+6wVV#Zro2+Yk&6!B1BRNd3|8W@4M_G;j}6&Y5rsL0J@gp|4O>yj
z1TEMGY+89eG_fdyS5a!X^m+`{vt(OB%x&8m96?r;jxI_nHKI98utdYXB#<H3ZhDc3
z>26y=U-~W1Q6*NjS#Rl!IKxS02<@>5YvtmQEw6=U<Wzl!KAY!RuLjf(!$YZhX%D2f
zLDLwU(AX-3S(}ywJ3?D%w%mEy(DkDAecw6)&#*yw5H;I6h4ac<YuB2<<~=NHt(<k1
z#|H+D4k=;ju}(fKOiS}(iQ#js36(RaT^C_;RuS$TaIDI;AFjrBFGk5v9;Y9@5)u~8
zTU_K^SYUPAQnJzZ7Y<u56lt`a&NQa@c%2qwLd|d*)liE}c4tvIx7N1=f|^%<o2f-v
zYmvy5bfBu%HLd~{lVP6uFlEP1#~7o9)hF1}2AK4la_JNd<{WfBZvMGZKu!4pf@{(^
zlis<Z2yvnV4M23{JSLCmh60Cc#fv|Ag-4ul#aD7cpLBpY@W`h!Sg_Y245BiEET(v{
z0j|LjV{j+{XBZH#JjCfBKX?Ffc-IkxgKL3=6CL7-Qy~@4IW7=*x<)?ofWw=fEv#b=
zcmuSFmp7ocF_gB1@H$wOoH~7NR^rZwC?#_Q_wQP{RJ+uQW$MIJRUZuve%XrJSoj*l
z?hxifAtryAsL4!?$HaAGj-RmSaoCf1VQ$V=ZHHIIGyRRnW`enMZDE3(>tjV3;-RWO
z%JooM3p%bx6HQR@)d*Jo;Z@(2(KQd^urNG?!uIg)txuTPBYvveW)n5i(rh)*YG8e8
zK=yZ%<FR;3<KyvW%DZf<h3Cws^RSQA!Z?OoXf@Dkpw+-?)<9S&g&VG3VD8Pq0+C5O
zgDFYsrilHY@{2MUXcEpq0gfEJq=6^jrmls@wGQPIElcY0e}V%(I2_Q8^Fx<7rCZR$
z$_Fm80pN0-L4E{+h>$n~6h?7eLs-|~Lr_j(7$J-lrPaT>7OtT<Kt~SfEooS^-~&jR
z5}bG)q!TYbF@NNkZOGRI-xemV0e4OsQ>*dvRi!zhtO3wKIMkqX80}?04W#-jLP4kH
zpj4R%!<5yq+VE7Nlo09ETnU0jd;c!z<m|i2*PXS>u$;p1DHKD469r*qvVU=TKzYhI
zk<HsC?VGSKqh?j$TrzJTB%zT0XNdTL{F|+wp^V}%@k0<&|Eo-1CcHbt5FEQRmR!a3
zMy!Go%0<yC6YYA^pm7`-;!+pMAvu+XX6n-p?U2S;*8jw{p0mnYpZvqh#i|7MPhMVP
zQfeR5@v_^V!>)*7sf~^w9Mk3q_I=@bSjWeGHkhpl@{LZp%{kQ?&=@!2_BPcz8AiCg
z-lWfAXiPb7ct|8$8HD8xxjOBBKNWOyo&;APgwpbjGd5@}hhBc%EGw~ildk+_xV`c0
z4IhBT1WU=>JRb$N_fR%%vV{N}eWY$;?%FF!8#8Shpk;)<6n>E}Tm7$QGi^e*@~l%0
zMECcp256$$qJ>)SIjkS>pN`@53bu38o63_=eE4>X+j#~E9WIJp<Fh1DzEaNeMM^>7
zq8j{?fc%~@?wrL7PiN7D4sr0772wPPf9P?LPM(;T3m(NOAM})F!Op5(zpx(=#8d*u
z0uTpKDB(d|f)KB8%uMf`6Nj+SBrF;#kmz!TE&#3o+QgF&9LXl0;txG=mh$sJi)&$(
zYJdu*T2pu8P^I9B5)Q%^Dr%s%j-zfYzII*n%~+npj5$<iH#WHMr|HJGYcM|CaPdmH
zwu;c8rP5Y8<6QDr@vVU~$c2x@EqJ(R<u(LEN2o%&63%ess$zpz6}OU@Q-HLZ%9EEh
z-%G|-XQ02qR;kw9oqGgRN$M^^52L;jfjc*5?vyoL9ty1lAcKE!&g{mFIfii@%-EX>
zVc&Ng!z-()mC(t$;Yro1L#&%Zw*{@Lfqc_g+m;|M?W9X8-u3Xs;ouMTZ2mVhyOeCQ
z)xvBM)OPl&Er0FfwZr<_uj92)Lhfg|2d@o`6x6u44s+Y^*6bwv16Dq@^!P93M8!bk
zdz4=i|Km1007M3l1OKNSyX=l2a^OINgLuvWbifCQ6F>M67M{|Su6(Yp6c=8^b0!`d
z0`e1=7OmGI9A^R%fEfe@;Bdt85|DUs^Nc7Q-Z=8;<8k039Jquzi>B}`%5lg8T@DpM
zc`Yha5Oh$!a7k-n9cVy~I2u6SL*Wi&S{6^`&8W1{v<9dJuZf6}97p;12xW+17!2~X
zaE<VhH{0*i>$&E-Hg@i8wu!p$-)BPbpdoyGsv<AsN=GuBz%Hjn;bdC!J%|^=*PL06
zX!^)ESIRdY43XcMcVU-b6o}M?T#(*ORGw?Th1AD2&k4%SaT{OmSl)W&^og1mzh1h%
zWsb|B)TVigkIvXJTb;nAjVbOF_CDR)SCylQGZSMuesLW5ise}zP;KxPXP)LlPFg=r
zl(wbWYM^Efq<ywSb#3;OFn?eXg+V&+=#;tHkgWA&G%IfTG7ZBWTy7Kq-O`4u{=ecq
z46kB}tQKBcu<gNYjA5lP+em2N{^A^M?Aq5rxOWPDIXFPpewo`6HlYE{8Eddqsd&AV
zn2-8VLjj=9R+D_cLw0a+iN#W+cxnw?@+9P|$jAG&{FOzHRrxO^9M^>9+~rz}UkQr_
zIM9_-7<>j5;=z&MlQ<6Ya%hm^%r*GJwO~eHzEY)g7Jm(1;Ja`hNPi>*48)kQ1XsL>
z=nMnWICBVu&sl&V2n~>*LjsEiN>d(iNf!^|IaF}+lcqEDMbm;UtP2g;Xi23r>5Utp
zmpzSOwdJhg^`x&01x>n;-CFj05&x-6jv}KS_86MkAoEfeuau58FdRTyxxwT;ysBOO
z)p0$z2!k7CFdF6v<^v<XN3h%Jj@-iU#Ecj6K2ni{ZYGP-WuA*u*M4li{0uwO4AeXa
z{j$4njwiLz^#7v%I3DGEZlsT)&Qip5`-i1JbG%xgb+C@&4p~z~UdH~k#!p2C-<zEY
zv#rYDfz^iP*<e>(K9i_cyF0$jErnJCQ=x&b&bl`HNj85l8?Z9=vNP&5SLak@S7k=5
zu+hVmd>CBV#JqKz9I>w)jOFJIkOiMxV&6Az+!W@WVM11!VvD$zG!VDTxUH<EGPY%z
zga+gk9*<Yt9y^p6Z~Pt^TUEonGqiNk41AW@9&IR_-jT0Lh?4c8k4W-A%GXF1;yG);
z(O^Kle3%yWbmDXnCkHTep&<tbG?Z7o$Oj&0fV23Ex8js8T&}?>%1@dncp&#9!bHOi
z0uq*MfHNL#F(;28W-40X<LCun4qoDvPjoFRQz~KN;f-Pl3y*UVf8t~QcG<$3(tx!f
z3{QN-<?~5!!Q{zTVb)-zVqVh~j{E(zNTx2UZrdxDFqD$NR($cfgYB=Xu(xJIYUntF
z%?PoQ!zSy#w@^V_>y?%E>bw7XyJclD`vcF-ZS(zymw4)Fe~^lgUOF|$psSc+9PVP}
zh#;p&SK`!OOitR#aq0|%y?rXSiACY<w%aaw>)Zcxvi%MZs=v;x?L6U$PfA|%M{iEs
z)aWdBd-U$f%U}8G<j?-{9itN&A}4zJ%fI?t)5{J+<VxQVu)e!wE4r8f_tr=?a=SeI
z;mNMMKB5|O4vPuCzp3E%$W-r+;aPW5`&elB`L>WFG1BGcEt`|Sc-vnk4|-5&OM5(S
z&r14}EF&?EGHt*8_Q~V++$)OdAEb_vcl+&!spI}MM@g-!r()XH!bWXm#RMlFJE;5z
zA9{Fl$l*s!T&__Wsy*vGDxElAzHg0VA4FI3z4A4$OP=`TeH2~m`H;hoNDe*X$R3&+
z9XU@PM&U{)%O8Uzk4qVc2jweHXKu;2DKtl9YqENrImP_i*wvx|wae8aZ!70&)Ik4f
zhU}Y47TP3ZjK4M4KeIAbINN<Qi?Hn88PHspxpsZPyuI@`V16aWoaM+REI%e<#r{Xa
zq;pKd|7mPW`Qt;S;)?vQ<m*`>OdNs(@tN9?x0-kqp;f#v064=?z%{t!<xoDt!jpg&
zmAP@i(*X?>3NM{4nDHl_1K<oj4tQ`4ofg)Z2FyfsYCTsr43b09%{g(bnzH>CoklM2
z>b|7hH2diSpTG|6g#p3bq26gj2?l2BDk$|nYp>V&Rt{Y$<6ndpwISKaN9v4^uj;i;
z?b*i@NLyTvk;SG7oI<-~Rbj}-KEcTbOj-wMx>@_}M2`@P^*AWI;i}J+qRO0>BD4u!
z+0-=cw!2>IR}MTlyk&KfKjEYoC(nA$b3Cpyi3;*u@Wn4AKe+Py$s-@NoAnb7!Cl$M
zxS$;+2~M|%@4BnEsW4|7t{+Q)6JPwY<i;C*oLu^qixky!ru0DvXk#=!BFdyQ=%uO+
zHGZ~#vVey}D1gcEvYmr$N*#PY?8u|szMOgbCk7)IU?7Q)Z6*_SOP|IbVt*IxIMf_$
zhaGve+aFZ*zyl8?Kf3PP<dQF6kZj$$wSeN_s2Q82KjKl3@_mfKKIPO`CtttxE6I1h
z_07JSUvcVdl6&s?ZE~Tt$8lhv{q|3edf~Cj|M&m=UzNzvA6#B@n6D&M)l<2QR)JJF
z9c~rEDX+42^40Qo@{or<#M*GxepsUdq|acuDifYW-x}9G#AE!!?cvk*J8WOMe8V6<
z<e?8W8`!^Hl1lTP45%H!ahP#Ak1IO;q%Ol5mUrM0nxj4JGsp1U{CqNF^G&vp*vP)|
zI7tj`$fnv)_%>~oXuwVXDv`AnbM<MUnr)V?!%o`l+cIIVnE!@*@M=`5XotB#7{B;<
zvMro)(*4JnDs+Xz9C=7-<p_?2Ak0mbNXh9cMR83&&dLWqVe%+n9JXj5w7?@Dv`{#7
zh~rwcICHK1T!Skd!q5Q36B>ZxdmO@Is52QkR0uJ^K`TH2Z~)Q)2_-r(CXIZAl}Gd}
z$^m>p^q~tr3Se*Gn1)?CKuh^ZCr=#bNbOInflLExeObg>2~aRV-7#EE?pOR9=9pvS
z&JUX;hbNP{#5zQ=k#5!ox}a88<AskpF_6SJS}`l#TY9=(;H;Uqz2UOgUD7I=cunOP
z<}TwRwBc2#f%89mZo&b)`gN~Q?*8?!lMBD}#jGU5t$@w4jUG?~8=_lo*|H^h>>iIx
zKJ|%@CV%+-??>l7;hf>E0h^4B;1oXZGiR0Bl1jxuzou(!63*#huY!YmmbWG>@n<*v
zH2L_4Kj`Eh{NM*CM;v`ja>}b-lbrU^4^?6@2<hGb^3TcqJReG)41E8)-$|~y`s!Ml
z9ect_UVmTs+<Ap`pR(_M$&seF_rCLA3e&4Z4y&g>`^&eR1NGA6+8@?i)+(}s!;0#^
z`-gu_{^|eyzmxm!yRT}tQoMKnYp0#mO}mt7!wF6It+DMxQTa7VQChgu)|H?C+*Z`{
zkms5eYI|M6toTLQAf`dCNde8Sn=@q2oWe^ug<1T7W7t_vf`5}`YiU>0KwHn%^weVI
zH6Y8Sb3T3eYf%bkS|$(NXKd@TIsmGHCUaQPOz*qhy*DZs$vtX*7Yl*pM3txz#Q(@a
zn$o!jIERUN@MlsyaL6yA@M99j|4AA+<dFj!8pM&VJe-N+OuEj*0pd$M^obW8oh>SW
z9Iv{T5FiR-f)E9ChJlE}i2M{l1y=zj4C#uqpo5&fT(AX%9KYZJ<l&=oDj;#t<A4wR
z!Oin0PBbjoLaPC5EOxW(jl~^&ag$o@+EJIFOe<Ng*mMl5)4@;b*i4?1cEAP<8;F9_
z!(#I{IUU52Lat4t87ALh-%wuN1InGj!4ZQjd~j}lZqA=<#w!ZR?@v-|sH)2A5sjBt
zjlzF0$gB>=oOX;@&E4&%Zpq=qumqQJ`a<1ub<=y)ZjVk5IqWsb?vHtF^2=Y|lAQDD
zGkn!1SWmLoiC=i^@yRZ`JUsc$-M>ygfBt#N&whHN6FB_H7rMiYw*S<pKf_m{UjDU9
zlPfO!S~ml`0_Qo;JILtmo1Fgf4|^Ya@k>uhp0dw=zC!h@w)*!w-}**ZK315$<<H;d
zah!j5&ppWp-~S$`b;#jICQpCHvwe$#n{WPk@<nsn-EHy#M;>*It(vmEbFFVa=lKUG
z|NX!HpB^9oAkQI(9hp4ina@dBg?P)&Hz!{>|J>wPcixeqJ?hbqP7XDk$2@kA<hI*x
zP0l{^^h_`0KQxtL2iqp$7Lx(Tp=7Y>s+H|2$>B%7$hUv^^<8%*U%B|p$&Ej`A)`<J
z=RW@hrni~ohgba|`QrJX^D*i92Or|At1r6XOLpEq`IEnRYx22s&+%91cYn-dtd4$}
zoOjlzGg)vtA93^xlLMamG;3<hw(|Q*w>3BlE-{`shJ#Z$?5jSzF{~Q4S}|FclY8&I
zH@W^t*Cnrd^=mWP9&LP%J?@0$k-P1d-1D2?8l4N1AOGk_o%G#zPmVqQL|<k5%Uf?v
zF1_U9ERDd+Uhztk<9o^V*Ik$J%KJ&S%KOPr*~eEPf9=vslJ9=|TV42ER4MC|_t_^o
z#@gdU9=fCH{1?eNXPuec`-eXydp-W~$)QIcoqY5I|L%1A>g1veGv2iQ7aV$+wf%0r
zzVJoIB~N?CGrX<s{lq7l{?9fi`b}BBeasnr!i!(x4$`;(&EF>9|K4|#%gj+ryEyo;
z!;`03e+cd37s;1Cf4=pdyR*D;AlB2~w#CZxUvRL~I@n}-*v>mA*I#>`J=8hJUKd|T
z-uTCVlI;43M<mCcc#^G#J|=nJyZ+6b?(<1kUHz82`f^rRhaGX0_fZ~DJo~xNw-wa?
zE!nhrbHdvL)CcljcilC~`RAT%Z7+;vtn5GLxZ`arfv0%8x#9ZjlP`VYe9!lv{^ZY`
z-dq0st;rp?-);|TJ{}jxcs$Ry?l|j=(><Pgz={32bIwj~x#eb$JKXAt_)DxFUUrJL
zlOKF9xy{;88Es@d(%ScdPkXxCm@B^iwd5O@U)IH!i#%`Q_T207$q`2#oqXhj|G{N~
zUZ3{#XLjnw%B8y5?|=gn>Q%CX|NMgwO&)6Yfj26=ehzv;@||yg)7sz($+>5rmE8RE
zpMh2iMSY70Fvpwz_j>#jl5Mt46n%j*`I`ks>CprFR%{=t_ALZtI~V8sgeREoxF@;X
z+ADw+(A!kB-RC^-`N?+X_`mfRzevvgOt3R=ddr`Nwr6r5^`c{w_x{_zc-woDwUHMd
zdt9>fE{qR%n+;`r_^H#?&q1cc7aVdZgMhWm>#Qw(E}7dF9u^hlzbVbn+a)i4>B~(Y
zk8#?cvwm>%&wuV@(cuXvza)9Qm1WzuZB{4WN-qD}S2G<RW?NM}@1TQyE_n4-SDJ19
zY?c;EJkGe>Z!CvylaTWENsPVmv1s$jr8z6-#$?mRE#VD~W+ydG7Otf|Py^w9!n#su
z#%)~>)L4tqtpVnP>C)Qngpseh?V&q^H}Em{nrtEBT6<^Cpf^rf9lWqOpL#dk7>*=8
z-;$~UAi@nYK1%?B!epv*14ukL#B;{i36NJp$l1#^w7`p%OJ4l6ah&qUxbTM-arsIB
zpLA%DF5Zf>r~oA9L8B(|WE4{gL3}Kn@JYvU3y2{C#<&uOv%(aXu#^Tp<$;c_N9AuM
zT4*)UYG5sDfWe~U>}aNhv*u{Rax$p;D=WMnUII9dIT&=fY2k1Ovd`v9GPTjI1}3Zl
zZl1q#@kO>e)Eu?;K;^g-U+fY*_#qETPJQhkCExqbw~}}L>;Lqd`B$F$I-i(<fP>+=
z&p*ibHvHI!KVYlJE=gW=+=&TJwmdvx?<bmL=0)x>z`2D}Xb0Q7_`UD?XLER+?Kk%i
z&+VIg|9$r-=bFP0_^df!aEt-R9)D7D;DJv|&i?f2wmS2llV9F;Tk@xGeY?r?U{Bw{
z&d+@IbCR9yb?7rs|G3BHe{ksF7&`l`)6KE=FUfCz^XuddZ+eTbwi52)M;z^r(2srO
z177CiPkM=xT!sS<e7ec-sYnL)&<!%+=zi%brzT&!^y1`S|LK1u-?-wk<Q1=eO@bbP
zy`S{t<XO*sZt{tbeJJ^;Ije9sJ^h)_^0Xan?_!*Z0M4+TciF}Cb(A|@Kk>1T`o~a@
zJ>f)8=jZqnPd3NM-pQGtJS{o%Q=d#8{_tJQ8FEnaAaj}k!B+9HO3hINT^^i4pH&x6
zf5tOSkGDELj>tFv@t-C?``Jy&zrXiA$+y1wjpXI8IMp3hAndf$!;&}tr#~_0`JKs!
z{^R|=-Ndoxq>SOA=CIwed5cFKcKA_N*E=Ndf6qIU&wuV*YhNe(Rw6Mz;X!4^Vf+eP
z#eDIXFHHW|yMr_IMaP}sWHxTvob0sYjv2{8IuRnT_~XpZ>y@o8ZoJ`!<fk|O#2tjU
zn-e~UpPM7_8<&0ER;~Ze)35%)m7a{V`T%n*o@);K_rLpH3HjdgXK(es66aSq*3+g<
zn|w9=KKt(Lj_%Kz6ZP>=+}pN&d9I^>;r!3qLy_Ml-@M{-=Se>*tgBOAl|0(^-3E4e
z&<^&{<5`BcOLCSy&;X8p;fs<-JmQfFefE<d|7fz;o_m=yHSnMgUiXGKyQBLf=3M{e
z$3N!n@8p-hEV<uS1fO@#XPgEPC@#M60uRSOxBv1sbE@u}P!`}Zd+g!7o?uRO!M^+N
zZ_ebP&xcx_(N6l&-tT||?2Vd*<g|}`*q!b?penL4KfeA)$-evT=Q<Iur#|f&$<5~2
zqz@cpj>`iMc&a-&-~S%f&0l17!`lcCwTDnK>|om|U{3(bgmd!w2OVs0T6`h7BiAP4
zd<y6L7B{tTu)YJJ|1X-Ol7|P_QJ_lSitWQNed`Tx{$qd8bjBx6OTK!^MfR}lpk$|q
zJ<R#?!;1Gq4m&(K@9eX@uksetu_p#Q^LcyN724iq$)`{Mq(7ht<HPH1eE4?4N^hLK
zuQ>I!+4um>efK{w+4Yf+um^eXOFsUg57<^bk8)c=+MxU|vvy3~z3X59DY@?2Ym!$P
z?O?BF5**Y3w)69*!>5}qf1Ww(fhU@6<>A1`Kk~ukBOiEw@<g+(&v@3eJ#8)i(6)In
z#CAW}g#0pzwOHo1Osxi54NR#9d``*IB<_^!0UlWTqF-e{5&!@|07*naRECt?f;oii
zqdtm^8TZ%$Fzx=&SXK&vA2s&B63(FO!eV2`tem<a6NVVhTf!)TYaG71<KP<R9N-8q
z<{=!>BTab-i@%(}7UclWsQgnB?P)z}fJtQ7jGSiE4XnywLbbMla?*Wz%iDZ8>7JMY
z&H-4R#L*9!#8#civP}a=r`Ey;*k)$f*O$FADSLh3+O#$lzVK{q$-+2;wW0@3$U-}E
zW5z0FTb+jv=I6KCYMA?zWn0N1z1Uh|yJ^A^(>X?~sxaurzs95(ybsV1(!;L%gG{i_
z{jpbTDq4t-X3F6$$Vk`QF1ux=<<alrqZ^~_>MIw0Ir)V-xHzsbCs+75*G#fy%l65a
zFZiN4pe{3q>D|fKzjmoR_HaT8?!4pn<f~t~IQjKmzj8cQ*yca(#Yd3XjsWK@tBh%b
ztp57RPk!v%SX^)W*K*@NXAewbppV^t`)wX|hn?><ClV{eo@+P$pZ?S*e1$0c&tCH7
zFD19$a!Yd1A%|tzA28?D*=K&rS2L@B$R6UfWz`xqZvMs3lVAV(E_YPlZDqt!Cb;CH
z3zA=$Q<US1uYWb!bI-jz2^m;@_UTWZmfU>v&wZut#i<N0NM$(snB&ZG`K9FAYpzOu
z|NGx2SAPFH=7hP}oZ>HZ8oQX27v~wyY@CKT<|soM;IL;kBF7cBI&zOa_jFWNQ9t9^
z&rUvb#;2SXt93tf<{2F_jBTl1Vyl`(90q1PA7v|lPkrs{lGncBjmh8t<A3#4rrKWQ
z1*RKTOw%szHr;&xyWdWJeEoI4!W+T|9dbx=ht)Iqzq;cN-zWIei!SQ$%!P2w-)N52
zyKMy_tBgNpjv*e7l|flqcid?w+dp&89Z#%AJl|IBvQ<PL2I?frP{xaP#g+*7-+Q0y
zHNUs=1NYzWs}^y<P=~+&-S50@;$%C^+8wK5p@9xr{mQD&D!@GDyt6;!&i3oB`C;;-
zYp%)a8eK0~`G5PH-#Aako1VHd=bYD7>R^N?va-@sD>v!0pF8htZ+EnRR);_4v5$4}
zp1jY#$&L@($sTl^;eGQ~D+eprAN=5l(2UFpdb{I6<1Xv-d7!M@wr<O8z}|a5$;;1b
zSb)009^hz?fj#)kXy0k&W~&1F>9@XdMRJ$5y*(cHxH!9qse_-G6CVdSzzX?&_S@I`
z-gi57V-Ik$y0MkiUN<kORyWYxVymZl=z`8@i#8b`x(n!AuX^q4?Sq<cNdEqR@9tad
zb^XvCA8M<MKkfR*iG9Uom$^-YNK<`_mCw7F&HdCTPjfp@KRm<2d<#K<{XNGXWc>6e
zKQViLmpOXBlRWmZdw6nad-G}AyVd79IMBoRaJi2Um)QzkoYnF8u+{b_XLa~*%(mWP
zZRRYqQ?xPKKw18sZG1ti;9UE|tCD+c)jMO%XU{vwSN!g~{{il}Kj$-N`r8sXqA$Pf
zYnelse6p>)O>vq%M8lpHgXTB+b8o#C=g-H+<1b<BG(C{#)q^l(gpF_}E^npG%{`Dh
zhUdMGh9uOYPniZnE2Ite-aqm1KCJ8?wXIHBVOw!lkp^g!vUL)hb{IbT#yxVe?Gx@0
zXQzeD4BzaryMMd?hBrK_w|)5`I_DzWTvaa5%TEw&b@)G#RiFx@41`JRGBTZ+LC7L)
zsnE(uYMhZU#FSr*#Dp}_vS9F;q-P08?E*M|g)e@bi3da*eBnwK_=~6bK}+;3*ur|%
zfEv#FDL*Bi5>Rg}5obVhNv=4Wr-!qCvoOp65mOix4tpY@Q*#F6Sg`@gA0*gd6=E&L
zUunVI7>+p#=FA!FICdu;2FR4lid9Wj#wyVut+eUYHBeRe)hX76iK9jEt6%-fSMIX1
z?e1USom_eEcYWpRF1zfSY_?a;Y0q1>Y$tSc3U%@ld8avRa2^TB^V-+H$zKm=Z_NN3
zY#++2l9#^xRqi;t$(%#iUHijIdjvmfx7}@viLK5@JUHL<(;I!2t>S)Z&Q|Yxiipl^
z1%ZQ4&SsKWVfCSZf3IU{Z)Kd^f;;cL-9EnbAYc6!WO$%JhM$-WPxh6Bk9g#xT&9rU
zES&w{XpR=Pb^v~2AIUq?Ui*Kut#l(E#}H1oGQdG2z#)d?h1G_vl;pK^94-RNjbkhi
zZf7lxhiQ71eP44>-SgXfk`Mf^_xeh2@}M7955Me{ugXa5yz|4Y2*FZ6>e0I=H$_`t
zfOOlfH)pu{0Q=p(<mIQB6K_v<(DMPie)~a}mGv%bo4>aexqtEYcev9Nr{YaF-k4`M
zlupWc#Si;>7?eb?y~ft954bZoM)}!IH)bot<M^WR?|yfWw?(DhX{)ezv-&85L3KsG
zU)qC|xG%811zThseCXl6I+m~;-n-j&1-F=!nEoKR-SV>%yb8eQ#v5<&SNYi<g_Z9-
z7<tvJU+4XTSNvJ^+3$fso=<F_Nc+{V?sNxl9*=9bUpV<CFY`AZ*pA?K+tz}I2dvD;
zImxQ_7;uuutC!=nqA=}m(B8@S*+T>#a<Q`cH^2Q&@`3lg*ZN$z#lcxj*-w1&OEdB~
zMt9tCC)ZC?eQP)Cvp1Vllr5_Stjhka$tS>u?)0#oeYG+xw~;Bf^}^GcJ?XE!_j@)z
zJkz!m+SRud;buF|LtBdb5)T&9A@=b{w(7TE{%fxOfvu)~i;WG}CO@~agH^&jfRPT_
zhDNa6b{!qw@Z;-!OBJ>tp$%Sd&hKK|+HXt_wodfxJNM%`4wpce{>N5Hb2dkvnGGMF
z^S9dEsWJ}zHt*DFpsA)bbp>q&S{)joLE0iG9#q)elyJA}Z?sZC1$x{=;|%88JLyz(
zXo3w`b&<sXxPYj3$e&4=bm9fV=S({OOYk`hpX(S8UnlA6@uVxPc=(ftc*Q|4zP8IQ
zx}p)wOI`;#baf4~gc1@N5l-=(V_~Hfi_V<5<OPp3(Sf#vwV(rZP#kAK!V(r=&YSEY
zF92P_&=pOEx#oy@+GPu^2D&v6ZkEhx*VW{@aoVdv8laoWEP!hhQ=6RjgOJ)Er(b^3
z=-{)nn;LTlyAff<uQ^EIMwxK-;#7h82E^y=gJ4KsSg@@jc!Ft@a-WAo1OU(f!sYP4
zA{26VUv*P+2XsG#E_4tpBX{LoYZubOc&)OZRy1@82Tsj#6PJGH_=Y{k+tpUfzVVOW
zlKj}58@Jr@3v(uHv)9+37o%8z(D2$7on0)LV+kkMWB1szYmeX`UUii_XLzOf+0Q#D
z;R9YD`uF$ws^2VgL15En_9mmhg}x>fK43<gAa;Bxj=IIlYb%314dLnReOwpOImp1O
ztYR5>lYq1^DNZw*p};P9+=iv(u3z1eyz`&_XR`l+2il6c{gT6NpVKefYv@ILqe7uf
z&)AbLJ}EmKddQH6(9)KZKiF!@AAJA&?lAfDzx*qEwR?a6SQM*>H`}Z6tN@Oktv4k%
z+RD$ZPHsDUAn;pT{Tjm}lk^g}=IX1gyuY&5n)@fuwCxYrR)IZTS$$drWo5;whI4H{
zTOr8)wx_=4^|sRVM%%~sV_js1(McJvE`k*=*irzE_qL1qWTQP8sRFFt?ty}O6i(l|
zO2^-PUpW4xlasw{#qRgN`(57~o9#)q-+p^1x!JaF7;bNQNzys9)y6@#A{x3o*{W{#
zUdE}+n*)!3!V{AlfBfSPa)nT#PD;ir9Dr<%!nOhIseNU-g53M8<>{%L1*;pYx2h03
z$~$?~&qCe(;Sax0uDa6tmOb=&>tFwkZ=rFmt@Z}c@4bJxx2tav|08pH0!{TTRyP06
z_5#mCyp7EM2R=19?u3(*?|$c-_BO^HzPJ06e4pub%(7y}Hl;H@T<7D%+}wQf>~wn*
z@tHUM=7Ijnd}>hs^UpiiS7JZ;Df=cbI{t*PZ}z+2>Gs=o_|xuH<~WQ29ss=apUt+~
z)-Bjp-pXK$58i&M4&IXuojNV(la&eO?ILvZbAbG{h>ytI#usufE!tKRX3v*Q*NjQC
zvooENj8i0u*PbV$0q!~CIU0S?59>#rdo0<YiHOuPnS=%g+&?!d!f57!`(4_mTzI2V
z$(IY7yiIE-d)Q^pK)e4Q41@g-gJ}%Jpnw=}1R_kq8SpUr8bI(_at$6hQVQ4c;6Pqp
zo0Ia$FI;E<;LDFnm~`kUJ?0M{G{B4Vk%#!aJmeJ}3kC!aq(5YoKoB59o`}-P0#gWr
z%R!iQ@*o`7gh>OG4vvH&jqCWZOV3w@KQff^U%~!G8CsZT4bb9Rs8<8(#r0C{qQ>jz
z!O0SvmM)a>E_^TwPbV=;yvFXUgWW`#u}S$eSP?&GD{y$NmsJ`*f~Dq2%?rHD0uCve
zvg+J7J4l%+9F#-p@wqScHgRMP#5z`ZWMYkG<mUbcTV3^8+b{IW?|si#Y85#j`w7AR
z*=O3;43D!{ytSPI_&D@fq4t%FE^M7sc%)JH<&&=1HaoVHN;>SQ<8;(9I<{>a9ox2T
z+qP{xQ{VTWnVXsWx~lV>cb~o2UcV*1d1w8#PiORzXYvuEhNq!W{lrY%9j?cvv68Iw
zfn7uwG1vg-_H@tTT99EvH~HwYuH8z{mo##Hyg|HIRVQ%W{Q)aWszN>3Eh(3d2^?`=
z`<NMdZ0tJYs%++cIS&3LYuScBqLOQfPDX@xUcZrA8nT+{oB(QMRzGceO6Wz~Kz;P^
z4?FdM!rzcypi=<R?anKs0@@T`Jx^UpgypS!3!Xj;!#9g~{WWG)2sV=&&Q~2H1&?8$
zZ<{YwjmpD_hcMn|xNfGrbXdgZ7ss?~RY}O+p52cWo}-;_&qK$%(s`%kg*nwKqGvqb
zQAhF4E2oO-+4cT7ssmE$=-qH1UXBSzBd5+pryl2h#Pz|*I&wCPLuDc>P=3no?W82S
zXONFs2l@`mJ{Ll&;BGz(H*yoE!EF9bfJfHWb4SlU#HBx^Y-mVGXpN{ldmhmnd$yfj
z905Fzb?(?&RrngV2+U4(1)>PZUN%pT>4||-<3PI5muyf_Vb}7L0aR8KlGD1WxHC?f
z_itzmeE+(ZlFk7YzVicoz{AL>cMoYW(Iv5mK4|XI@07+@eUrO_e23M`Qr*O%A?LB!
zXr<@TT{7W89VD*)BgFS(TFrC(bl2;})E?-t(z$!r$T89N9{qJ0^)__z;IdT;L3k?&
z-$}r$+y2p*E&NLS#;>mdYO%eakiXyh4)6Hb9pf+>ds|FE=+ocO@C>>11@81ekCmQs
zyC;wFuiqm#*H@=<Ol$dzGMI5BRVH{Qm~~r7Ekpftzj*}<W)_2A8$cBxI2j7``X}(Z
z6CH!)++lj{y{k9?v>EQ=iTG-ef_zcmSGUDT|8^!VmK@7SMK7yE6H@JS|6RV_#D~nw
z?(-B+6X{q{K0Czw*NKHrPs20BR|NB_eVMNk04GIu&T?V49*So*v88zMH^8r2ZG`>o
z4Qfo9+HkxM9*1)Bd}e?|{7ttEh7#29Zal{f>Kgt5`rAS<rSvUJ9oz^-?MO;w3f4Ul
z96!ACw0?9eiU%o)(M3(gtO=Han;NsinTBcbS|I75rR#Ylk5d^WW<)<CoS_8KxhH$w
z?h#8M{n$0pX%Q!I4=3`PXSsCoqohl=YU)rGeuK=zu_3QE-bWQDj^n0qC4Bb*WF8__
z?rLt-IHxHFG2kQpcn|E9qbLC~JT)Q9Za6OK4iU0ye&w0RkwqgBAARpKXzoq7=r+{p
zVs|~P%QUXa6Bwx?HmdqdY(>04M&#Z-)UWL}N@vl4@1D6<s_AZ--eD39`6%-d<#~UR
z&`5mkbtt%_?^x7%8NE*AIP*7R4F7w$z9@4U?uvaJa=o5n*VBddkBp*a?W}pks(Rr&
zTlb3ta$5twJGH4AWD!Uz<|qTpz?lKI4wv=?WV&oy)}Yo+6Gu;TRI{z-z(Civr{{-9
zw^zofCf6||`|7Vj?H**hq=c4Q+4!7&kLV8BsbHjq&pVTI%TYL070+*-;<c6^LTb*Q
zA~u~nU<blRTdYS)gxC0cBcqbw#P9lJ{<W=ejzr4s3*7pP!n2lI%gFdc72Bz0Rh&cn
zeify>qZ!HZAKQIM&V<#oI9glYU!EhCEy#kj0>(u5(}~C+-t#`yiP?6Vg*g=e?l3@E
zB^+A_b5-=^*484l2b6*)oQK(=wn30mhVL%CqX7!3A$OS;7FY--cJ=8a>R$l=v5Dwm
zfueOx76bI|aqGzmcJ0cQBXArK_YmdaPCL~omoMDlUEtS+?tW6$a2zZB-Ba5!kbU80
zGkmxO^?NN(rdV#;Ync{)TR3q#(l;6|jEeZ*kMoec@fnZsHGBkxr{~#`Dc*1==k2-7
z%l#PWHHRYZ$*Pu9=)yikSR@MzblzzGL)A6!7x|%$nMV_^l$FH`3uSh&D2uaAIX4Bn
zSt*`1M__MvR_l;)<QM=KzZckk^0f0tc>g24_Z&Uas*g_&^OIqc-6Y%oO8<#yk^Cny
z`^a(l9EmPn-@G}Ax$rooc#y858&#ax^f_CZKL=;TcrIODgEhX+x$K&SimHP$J-;*E
z%ob4ee0R%z$CK%v2Z}#}TZ{S8bx?0MT<|6rJPK;>_eU13Bj#r;&Eb}z<lpZkdoH5P
z5J}mzyi1b7FgLU$KP8yqTWc|fa6O`APH=gyDUn)7$5<^A$p!y32lQZi?<NGZn}lHN
zkwn3>Tv(U+{sQ#Ks|)`Q51n1rMaPrJu98g?A`w8@MtH=JS*4pyW|^t=r3QANv)Me-
zGF6o}vn|i|@=NR_R8*TKN4q4$-f|k;EQBZa5m@>yd7})9G%{!4W%saih?HPP87+6(
zt{9G-Z9W(7gJ{uRuboLtE85k-a53;lEdD1p<L9A+&ppp8S<ugxV)ta-ByO|5#spSj
zy3*g@kGLq7H0>MYD1`-*&O6p8`Og$bKne}}OI=e(UlWV&mtrGgca9<^NCI_O8@e+b
zS^Ipw8t-xJy83W?H6^w^YIsDs6o<!^Wyk$|xAfj~eTi8-$$B=S?BkkX89#e3>V!I?
zS46i*^L{{klb_>as6R(CR6*%_sQMhV#3@T;s$K}l>&6CUyT9qqF?rHK-s<SJ@?Dq6
zT{*(FDTl54t+3ROKR<D6Kz=SZeKl}nKRsIFWV`l`FiB`z7<Px+^hJB`PtqRO37jrD
zySm&K3VfpLD33T1VryMftfA@3#ky~&CFvv*IPZ>({P_IrYDWDETxihFxe~fW?+F_V
z@AAmuF4~H*FxDVgH!rJRF#^2Y$!k%)q-UI&mv`KOmvwy&eUY_HtNgA*V}WWE+6Gu%
zJ->ZTJaHZDsU2lHs@T0tP*HflVp~f!rryOn*$$p$U3*&ZwdVzOJw%Sh#aVo<fb=!j
z&MP)z-1m3aqZitFY-^r@Q?tslN>={j;nGj=HSwpv8VO&8P46Yv2fd}s8WwUoDx83G
z-}lgHujQv^&r2cbx6C?cRc-;0y3U)iz^wxc2^*m)>Rf%A^{lFRX7t0q@c$Q_dKbO0
z4Mr@TFL0gH&RQ(lM&Gro7U>1zNv}DfZYjrSO?^l!aT&4M2xi&7Qq{HYAo^E%KhTYs
ze;r3w2CrFlOsI^0b`ym4)GUjZANRJYtac^GxzuSkMiZ-Vy_PwX3$PoLubHL?d0A%d
z2_ygL6_9pbt7uvdUYfKG13jW2&p|@@+_+H(x$92N(29Td!M@#_ywQ1j*Rdb``aj9F
zTq!N{M_`c0+8!x1al!kV_w$g!<SMs&;23z7$Dh@{ybhu-h%F{UW45v=SAB@-=i4UE
zPF?-m7pC`J?DL-fnGu#D!mEqxA6xCc0`tE%L1!;KGQz|`NEC&1<cWMYrTzt2W_u2m
zbCbMHGSW!tV`0=q_Stauj_6RX&hn;49Xi&{=I1V!uA1&qgZisfz{YqLk8FUDn1o&7
z)%(Qc0@h}m$89YwkT(GYOguW<;lZro?>N-q^>w;TMA}!eaIa{{(v^WXX+z%S&*alK
z>g;5yUbg&A*LxPyTg1{AN_w2+WwNjpku;lE@WViKw%OR$Y_D>p)@Pb~vy5$NF(T26
zjRxbPKL(TiP0;yY5~Hv`n(>Pcw=jU{8jw^$17p7}OhHJ!TL9dN0oj+s3nAIm12RIP
z?F2?)Pz6O`>16!;g?WrIe;S96?qX01K>w^6_w%!rAu1Tbl_m%_K~E&(rk^<mhKCNN
zARux_3OGH_RIPrNmQ~diKY$}|dR)Cyn+zz-GS{UIrQ4>bAeJT3#+pG*sB@N)3_`d5
zB6KMI_1#_&8*0}4hhZxc?8;Sj&<~}A12nq4fXK~y+aFoeMgeDVIK%`!<(WDB9wfDx
zSbAkJY(J%Q=fK0#!XTxDn-M#6Yzlp)@yy6n|3Jmkw~}|;D1P%qn*}c=A-l+C*9ZSJ
z$SeF)8%30Bv=my-2Z8;N(;6DR1Z9JDBUE@@s?uRsdmA3i@Om7ZwEn7KMD|LZ#Xou~
zoetU$<LWOb(N7EhogIc?VcSzW`aOHgYQ1@YfauQ3{vAAiK=}gu{A1MYq)N*zl>67$
zHvRJBj`hTh7f5xxj<#^TxzP974&~h+GLna0Tcd3QZBR^&Ygn&ABt@_7$TQVFuw3=F
zMxh45C|;Gj(D~&!Du|GW<#}!c8R*E|q4(~i*K87;P-}2_hEK&kVPsQixRACKLQXSV
z1uwmx%ex0{lbvscvY=}sqD4&$-svbKq~1o}&f^HY_Gd=kw(cr_M){vYZH%j~*i=SC
zTD6TL;#elX2(Mf9SB-QI0GNoBFm6P->hrvaC&!xjj%T7gJVK~UX(KX9<|5OK;2l@_
zIz>`uNiM3(8QZN_g-3I1n=KnSGq;4(Sc7WHlm56$ckF3zE3%6-)xJC4HolZUm>QMz
zKv_K628WtH{4UazvXo@Q%bu`W$2kpinh;)ofn3X+JQu$qI-3}tQK*mt=xOT8qW*+*
zkg_lZKkTNyx_M-7qKzNjpFKQ*IFGDLi&Jx-Rx;=*y`9*bSY0%%<0R5gYyR47ojBwg
zWK11(N$hkRN58NqG`NZf<G*jhDNg)&+T!9qN|$2+_pBhK27_k!l$r$EV;c7aghJe)
ze5Ws}B51M28>Oh4gwu#0qRC{t-)B2Opw8$Cte%8}mkZpL#*6bRP-6xv^2L1i!@vyW
z{E*V}hhsq<K!rcX^MFO*yA5Ro67<7%Q)Rg9#6clB#1{f5LGVD4ID5@sMQLS!rlvp3
zi4k4)e&K`D@#)+6|Ak^Z_k}WoUtrI!#IDw=;NDQlQ;axxnAK9|$6=P=M|5Nf+|lpr
z>|TT_ujtN7Lxds&Glum?M?$j-N=j5%vp(i#`4JH*n{t6`ghn)~(O@~M<lJu}oM$SC
z$5gR3Gkj>*6S#wTjF%)l5BGTs=K}qg8#5dcN9IRhS^Y5+fBc$3OEkkyp%;NM^K6~r
zw@IsqKKZay!;<g9DQwFx8ZU=OmSX@#y86VVK7R><1!XYt@yQ=ovF(Qs*3y-qJx_dN
zosEwDo=+QRZ$2tHqy$V2BYlg&Wjqxli-rVu;LtVnTQcqfwBy{AEqN;s_F@BCFmDpK
zKdEAoY<AOx!!&YOdam-Ss6eX!?CqrP^&7WyM&{|{X<{pm60xBy(1e8&i+d-1Dp_D}
z)@#x}>*@_ADU_wyN|UM8kd91&ViOwai$!?OT=BJGhw=?e0|e)5#hov@vy{81HnpY!
zP@OthY1}j~@^#)zE>;niT4UXa1-lwE&(rK(gF#15y{zX&dAo9hJles@&NWDP+@n=3
zL$D>`oX%RSjps<%kEBB<IEN*otnrE#im6LrmMMU3f<fc72Gzit1u4@ZbM5-XJ{Y{~
zR{~O<IknMq=in*})Z`v7S9b%b$d6-^MU-BmlnJdyE{BSVH^1_7<OsRWUn&;5L<)&7
zCR$_9_Cfhb2poD7<kyjCMkqV<?Jg+OGCy1cjfJi@SUlsWz!49Qq=|OH{x`SsdY6{U
z+KIuK@s|%8kc`@xWrhPn7owQ?FI*=aWsj)TQaU&dT_JQO5~dQQZ_=|Zlmp=%m=0aU
zzcSG7{h0{B0U)SFuetC<_xkX={AVaEo$N|=ScPQNj?J`6G7fZ|-ySwJESq6;lf&+z
zN0;s{Rd#SWTwS+KpjnLuqCwvat+}wPE!FgfN^K2u%V7g>F|xXpQRn^pimbpzUgOf?
z+_|v3d-L6+`dU%Er&4%2sp!idaK3H4kLi3vY|kpr_I#5yXleHjSz)hz4x>_$YEG$A
zCGitacVQ0{mU>BydltP?*oapw1yDU{g(_@4R-(hVSL3%Ebuz)X<ly*#R;+@~Uns6u
zrON|f)dG!SDNB6+zV+w&R_m7VtG#>u`0$czMjp!G;<>-aI&8*i<CoW5r3a+k$n0(p
z=z;MBd;Gio<0p<oOn#zCH_q`Xr$UHA<tqXbV`%Kj!;_xjgUthTAmv7SIiQz(Tzutl
z-Qv@nVd6-|;!(aMkb;r^QuGatqe_1VZQV|)%}`_^?e-J%?uG)g%#mi$yu(LLLZM9q
zcBT?hM}<EZ?3na(8<|}ZujdmAh37ObvKjL(m7QJNe>kEJ{QF%GM=5rCXD1zTsORkm
zmxhzLGKX!<Y?K3D%{smukjy}uj9C{eB1eInj>8+W_pno7$i@OGGr)1_uPSqk+hevC
zqI;@tq5ya~o#dK&bvZhV)w3k9+J~;Tmhn0Mp69aALsjk*O0(kjaifHaP6rdrW7Gzr
zOOSz$LX2^MoYdP+UmjbZ=HQMv)ng&o`4LLM8TMg$=e|zsd2G)kp{=Uw09~iXpLPDG
zfy-tQsY{pQ`ipZwzD>5Uxm-BBkb=pS4>`j-jIFx$sh7#q_LY46Ox=;$Gd7AI70Gv*
z#^)hDKVx`pXhh8#cr<jL`E~~9<`{|CP1hz)dIiI|GL+8DmX+1SwS%>ssvB-i<xkT2
zI)$0GbP2|?whzUQq5{Q~f}X{IG!eH27M-{sW}ZD*1Fis6JPWjPYaB`507ZYklw1M^
zkAgV%GSg^)i!>fZ&`p~tBz%SX)|{LyvWO&rFSt2x8b3d>^hye9|8M#6ltWb*2LtsE
zQ1FN(xjncZ7aF2OHravC`DHkw?}1F3Gh|)Q8q9g31h+0T5;4Mw%p?%KBtr6#BuG2d
zFbLfK$VfMTi+`gM?1al@5-qv7iGajq;Iw~K02T7m^!7OF7-YrDd;0k9|Lj*On~;<%
z=|c)DcKe`a;-m^w+d)m$DomA!ruSUFTS<l_T9x^#04ks~0XrNmg_}V*<p%a$X?3oy
z{u@54`{~e%pT5y*?#xChHNpSaOWnOX4aVu2b}<nJ0L}mVmisCk;OFvv8^sDsI2W7f
z`I!t*l_Db*woZiVfc3!}nWLh%!CBniGMrlWPDMHC17s>%r+|=;=x3Y*ivbBC)la$R
z;gmAAIOExzow*a3A-|L_WnQ4aoY()r2PJvzhMj3$yZ?PDzud(=@yZwr4&n?$*q;3E
z9e_mPw?&(MuwME*$pH<VM$uw;AVcEs4^M*Z$W}k0OYQd;*Gtf`ePt%JEB1-yo<#Nn
z-BxwPh!S5~IpSa~T<Iz0qK6o*=DI}zC-%Z_iWL^5cGh6w<eJ_LLac2G-oDT)-=c&b
zRK&sbo+<o11hwjZ0$d^DA=dU>FjuKt?3^asNE1PhY16XEYL?tmYaqvzWxE1%1OQ>?
z!C&Bj%kep&Tu3?FRwFtND_ckmpk%<P_hxdC+tHw_NXW&Rr<N8GN!jZkDP2^cMx?Sn
zIbIzZ$Q^WnEDpX?jchrsGMI;0j)aIXgQX(wtMV`Y<@1Qr=-^x$J=OkfgtiK&d_v~b
zx3%0E`|UY*rg~KC37A|YPBS2N#5;)s$zjKPsj)9ywU)R(X<d&jYPk-?AM|fn5DAta
zAI;5mx|EoAZbm{jDM`9+szqyDUuuM^rWwe{Y9X<#8QzS_jVq5#Bf~Mi%<U){6nAgS
zHn{Bl@ZBQAv5V%V^r9BB<<8D3Fz{upToD}=hWev+^J5iSC>;R<H0djXKnVsSafjXL
zjM7;2jDMB%j)Ir7PlBBgTw^mDKi{o_-R#Qow(Eb6k_nX9U|1jfCPU{EqoRI?BqxCX
zhD7qefrr<_$VBxhnvmOg6g|-LybdsX1W?4O-;QlyxTbVmm7osHr~Y%8^Eu#d1~Mc+
zwnQf*c-=AnV@iR2&}_cx?%Clo<pjH_K}09Fh$U_eO>X-0+f}&?g@l<r-VpZ2u;lO0
zR}zAq#-oKQ-{wm5bBhK#F*{D0J#rU_0qH2kt}vKZ1D%~}G%|~=X(sUv)6xkWVKa0F
z6-|Svok*v+Q8*;Mg^7-WB@kYq+ibzdqIh3NK;^rR9Y{8`-*|scu3d3VgT6zIEGURP
z`RrXcYGSrUROJh}S-KRO4VJik|4X3#7j^9QL=An(bF8`w%3~(JX~b<cdzGW9xxM7<
zVspcbkcG9#+HEScKsD1&N>!*6jvBWL#U}%a03zT3B5^C$oE!PqP>9_GI1-rg4hY_0
zeEn<as^mF2^VvUciY}`{l2TK6!hj^oVJBwsz~Dd~h6IpKfwRPnhP0G#I#5Z_$|D7H
z-4l1W=!a{PpVPfPAgdG8uVd^oa6ilyBH*B&jD~37pX_Kx>qy~ygW+mmq9TcPVo-2!
z%qXxCp%27yGqfRfZ4A@pNKFAmd|m&=P*5hnK+>vPosbHh<1&Lr5QA_0vo!m6xr$DQ
zNxwm3Y<=$b4edOw_<O?<tT~Ae9S7HprfGi#aS|<%yS70`5(@Q_s>-G`YXLdKY>!KL
zBC$ZBWP(vo4rDd$Ux)Y$PsM8mrNt)1<!<_OOsK<xIFoE*h*3OOM9n80t56MaDo|g7
zr6L9>-hBPdRo=sou|hxL*fzF)p1{t_J%P1xx;R3pzODdh4Xg}4g1TU`u-|@xJn!r%
zVQrh)N}byc?QZ(Wh=;P7hTdR9tY%0rx5Dc99o$xt`4%bxyLelY4PKU4f3{=_PRm>w
zz}hZ-g0FA-R@R^Y4J{mTe$Z7>$eOfI?9S`3Q}Fp=TUDShk*`9$R?mZb&pRIY%xC+}
zo^nI9354+Gm5She2I3h^>l2uSBtf#RhV9X3(Krl`;l^kN^q^M&wf&(^kiHk1XN*A9
z;vBJsaX-Td@r<JK(G2El3eJMtP!RBTlOdn5AeqwQJlnmZVSyg}3O_Tu<`j+D+p$zs
z0ZQ?d0cun_5-H`jB*>8_17HQy0a_uL3FJlJswy-!zoeKXz2jv|Ns}HXQV<_ex$U9q
zoC|~jW;cJd<y&EW0XRO9RZ-O)^Qsxxg&J5oPcnD%_c5j5kn-DDW^-U1>`HG{<7y9E
zRRVs(Iw!%3DLWw{v22sFU8Rb2g8)v$ATlF9BOFead9|=)tF3CQ$w+R>QK|_8oKdg)
z19_U6F)JS9h2@Bm`~^~@f)7ME6$c1{s&q+qjr{*qBWZx5o=Iv2EK@G%{65kSI1%S*
zY&C0C#hYR{;F5}xj&Kj_h1nwd2Wjf6yBCGV4l%TE7kc%)cXCP^aR+Av|0oB;jiz_!
zi#l>5rEyxb;Z1uQu+57XtuB<8#@0y7Ec={mZ|zS5Nug~op0;SuV&HxiZS3zFNkRQt
z0y-|B-<XHFoez=A2H|QRNDvaHbS1Fg?#w}CIZP7lisSHVjUA10=#5Z+_5=0-!|<Lr
zl#KS<|4GM!6(O0#`OA|c5!bzK&(Iriuunlh2z2ZrB{l~2Yjhaz%3w1XTGudiRVwhp
z0$I`Q$MiDKn<J`?@`d2msx5H8K@yohVV4pKzKZ>Ad`@MSORIt#`;H6Cto%|HbX``p
z`dXIX8hT$VXfw(ifgSh<Ovf`RF>WrF+aLS9`$Wll&gL>Ff7YDTABIV{sjEx`Ft2H{
zCIg#pjW4<$X46f^pS2jD&Z6alHG;c`fL*wD&pW7?g%>rCviy*g$7*li`x*wTBHOIh
z?-baI(3L<F8F9>E!lUibhBGMh=$59Hc@s*2Jo`Rav{_1|w#ljgpT~n@A^4#d_rKj2
zZ^n|xF`~@|`(yEHnoAHtSBQ|;vZw#{XRU?18zYnb@=ru>ccyl&C5=48+WMP36CW1G
zk$bB%D!w02WnNRKPe}9DKenTCmr6#^DODOm^0-%@`?K@O#3McZEqf9Vvs&hJ7?m9w
zOta?9iA>1?xo&c(Im0b-!5u_iC|gvhlz2^_1#BB9S9%=JpCO4gcOm2{Ws%fxZNU2B
zL2l#!FFcPV2n7Xo*0F-w7#2Yh$A>J4Suxo@U6y~=RN3xSeR_{P`nlx5mceVckHcX{
zj=xfZ4Ea8^PA<2eSq6{VuA7yHKFnI(3Sm<6+Ok!1Zw7f|oa(d$k|0{!+3HolE6wLx
zl67MhwImy*@?c5Zy%9XJBeVuXuhuYaxv#G>$%0rfy+_((hevyjI)%2#gGQEGU6a4J
z_Dr|FdX-%eadz+w+WH@NE#57LRseeRTfQ9HeBzy56rHeFtqETXZh^5M)I^{qT59P|
zgqmD8T(IKuu4h8!3XJ^#)SFV7=eeFHPR|hkE?=N6ibXZt_QP&<g-u_=Z)#=y6*FB#
z6Ty!bQ~$<qrFQtGw*~KS6Oexd`-4=G@REk~G>pu5N^Y=Uw-a_^wZDlCo=x1oI&&UA
zPah8&#Cb-n2+$tTe-ncZ<a8rIWUgEt(z-ZXk_{YST~Dem9&oZX^VnpII=0*d$17eN
z#P4uBH@ybOkdWI#P7B5?Kq4M0cUnA*R>l3qay{OU8%DKI7Jbw&)$)^&cqR^=lR?5l
z1p)6^yPv-wq(jQ-@ig?V7yB~tXpVhJ5I~=ZzBBMhL5sT%WbxYa_u^Q-$S~jt;yNHI
zg5#3I=xN1Onomy0Z0G+AHlJh`1I|DalMu!vY2J5Z3MP5<hssHdyT0CH3!_?2&E@zu
z2g(ME%#jR8no%6exBzkZ#hE+_;9uQLtxsK8tmw~&2yu;MaY8(D6JihcY{P;67Z1iw
zxaced=z6S~yQ}MEnt-#MNHtuV!YE~J{f~j68@xxS{vbq0fPC;j&YkUWeYY7ar9N@4
z3tz^vzzedBI$n!0ZqL`GA{njUi1YK5D)k5qcME0U7NQ;jD@&&gQ%VxDM~lCsb*<he
zF0IqnjMgNU#gja{rWQly^EUXEqzCvrYC8SM`0@2aEpiqFEAXhTlz<io?G@pK><y5(
zQL7Xh7TF*EXS=_#GfdRav}TU&F3-H{??D32ZBEp|7yVB3xKH}b&ZyT7$`A@R2A!N3
zw_eYf4!lnDHp&o3@N5CQ396hP&GF%Vs>47W=uh0X#e$K$4}{*hhN(#Ex@|n7ne}mY
zGph;A2A>PGy6jtQv8}UKmrxQpKFph!DjvL{Mc4oFqphUQ+GaxZF=42r?i*j*-IB{Q
zzo=73HM6lSk~_blT|_Nwvah8{^-@J$=*D!)8p2#DctgOAn@GYe%R8bUEzsX2B8?H3
z$H_=D?B(4n&fuR6NR!#9oR`!~ShXJ8ApKF-V`0>4_N(N;c&>{}GD4GEWg%Wy+!D_?
zN_Q)0D56>JQYJIdHO;(NfBXPP+0gVxY{6$W;2`?aMXX@)uuK9V>R1Ey7CY7TJwb1U
zQhEG4`tc!4tnmXBjf8N)iqG8OW^ktQCU2I-YCHFe32`RA;byzr!w>F}6LemPLti=&
zG#c;`Wb3^`U;^rmaKr%q6@G_jC2f<e*Qk1pYWL8eeavV6XOBq?)UzYhmKyvq{3~LT
zx2(vFE;_3x%@CM`7{31I@j<=KvY1DDyAo8Hkk$FHf4ruXgD9K};{FKozZZs)5tDrG
z_Nm$KgYUNQPT{sA1f+|qf<Yvg%IBj(g%qLqgh+NLGyCmYBzC*xipITb#_5Dr>jr7`
zXSECBde6SzP<4QYE)`IPN`TK*TcdBMn6o-HwU`zeuyl&_Y=WF6y~A~@3~$w%Gm)wt
zyY=(`K`NVY$cICz7L3izi?oKtEX(RJ5Ilx6({=W2+8pF%r+zBu%<ldluvT~JjE_ua
z&4>M3BZWqj<pYcE!f<CQ#DhCVi{N=D#YW#s)49pe@`4g5^-IOv_`zG6k#~OjFOr2s
zGh3D{M}d|l-bYq58xX?vi|$hc0S5T21sW{A>0H!02Qu3lgrSNC00m{$xI=%V0717M
z=vlza9gHe=PoK=4+GE(j45l?R&+#%M#rv*?h(N>|3he+sxyyvhm-CTAgjk(a#^+F*
z`d8Ga)T;Kjg;aeBK<h@_5sskWUb1&-hU6F(=hO$44!sy@UI~xOvYNWoP_s`%J_(;$
z39Wj+(9`%wWS^PQJlHK!Epd}-GvEZ6A4s)9R<i$F-Cg?vFI&Yop~lMh>Hgzzt>sma
zFBU2-b2Zh<UlG|qUb1-Y`bPv|xiSn{qaLMn?h6{PVO6JkvzWws<C+F`<J3(=$HVs8
zZ8AevgR;If!2iP9T__UIIw<~CYGTiZt+!IR^u_JBX9cP9GXc#X*~Xhx3~8(J$!P!O
zp#?)SE(4uo*r=U~HLUSNYe`Pa{XTmY{<0w!qw%=XTjd_Ad*5bHo2~wxrs=X=gfppM
zhuOBCq6JLh(ef&sA>olum=>{BNR3W~$TiV)Y32i7$y7ngSIfw2UgJpmJdCbWI_N2k
zY6__cVmQ{8&fy@y8SG>VAgi!fI^ck7;jikgiLPS0sG*n4EKU?~Y{*oo2;hAX`Qp#S
zy<KFE$k}>`5F*xGt3yir?JqM4|D?1S5@rnZ$u?XxFAHCwC_Fet`D``-5rcBo?$b{=
zeUj|PI#(}QnqfX0ykQjYR|C094b*Z{@sgUlobS5OUjVWS+z?`!uVKJ;wTZv{Tvdv*
z<j?TvXjw^oGmh#<4wNR(z%*)(`X%(`fK^H!f&wm5#8P2&F3LOUQ`hZ7-G%M|P~OJ-
zWP=c{`s{yN#&SeN69d&X6<)>zJem?ji15a$>qbla#*F^=un1A}Jm~wx-XZ6$s+HOD
zmTKcJ;+9~l4(_$&glV5ck(-V~$zc{wIXbY#(58;m7V&7yEeCVD3$tfZs*5iSIgYa5
z&vD{#iC+ok?^U?l9+BYv%XQM0|G<$sw=K!|!hO?Q&=g$Bd5v$wv6ozya>jZZe9UkD
zNRc9~g4y!)XE_Ki#rp!U6E)mT)lG850Xrw9sj70fc+uHoB~pR8NP8HBMxyBi7#+w)
zewUtCECh{<TIN-VXYX~53O!jC>i<4y@~e=LDEk^vxS8DOIy7=G%e2ocafk)m{=zZ-
zY=K8xE#}Dg&2>UYb~7(7Cc~h}Oq(ylB!1fK+4?nx6-l!1L;r$TSw#TAF&@$TqpzX{
zQN+y2q^hKXggt!pUEPD9CJ*RALf3%n-VxZdhFjNYhr`*9HXO+iwTD%x3MkFWbYdG|
ztrDM65-6?WC<buJovdlfczg1z=xow+TGxPb-e^Nxk50ofTI*I^t&T2gve&*2C^T5w
zK|r=f%)T50!-KTeSm_Kwlc*cTs*ATZ!AF&Y*oz~A%Y$jpvaOP`W>}d1_D1bDjKh6=
z6OF}u3;p10%MiS=-o6Oj&Xc%T()Toe4vbtVw1NWZV6}k9OB3T4Q9UW~eQ7)(D29Q+
z1xSc7)NuW4DaRw%P$DzhoMcj%0NP>ieH*370p1N~wO1GkOmmktCQbzv1r-gne@mB#
z(aZ6iet;2#+WYIb#RV9l7W`5!!7no8qyOQF#rz38Om!jD6jt>3`?;T@)n`vJy4f3o
zcibUC^l!R!Tr7#kC-(T;_~~!4x)6Fo?J{S48^|^f5Ngk9z#wd)=aZzHa2o4Khn*po
z5d#@lJkX|!GvwQezl~Tz_QVn>>%c_tqN|-aN(F94#@@b8oeTcoBrMK)79z{o%_!rC
z(R$c17c`}i+1cyWUU&pIpCN=evdc(h*AH*YLacM%D80J-{<WEOdoPEUwe<fwrLv$5
za(c1s=csh}&`RPT<TXrbm!Ad<-37V1lDJuIjW{`$bWUz%{RH6Ed&N7(Q;hUaYWb-3
zEDjdlMBP!^8`Y=D*;_eXo;}J`#FNw&fP3wRddeAKh777cl~b5!$=O^27l~K@*ao_x
z!=_^EJPOhe!sDYcH1qqIV27`8_a@cauN|;tj!~d>5@Ok)-*bk9cwGO2JT{<A?P<kS
zGC^vn|Ci~75X>M*&?}jeoAWJ{(fIh=He9w0?@RYTi(Q(}Y5PyN5UV8ykOz$NGQGeM
zG-od>c|mO4fO1Kyk|0%+QR!F~&NkwD7j?yfdGCV(?W6kMs^#48K%OpV^n@EZ@n$C2
z<De4sKdNi|xe1ORm<b-A8$iA!n8pc~#h!Wmi)kX*u(9z;N!M(EvXl^C(DuPaF2RY*
z{EAo;!zk>EXFRKy6iBVHj5TEWgDav@+`Y5%$MLX9NdXM*p*(nTtNm)zeh*RF0@sIr
z67KRcI%?ZG2vjW?=U=`hT~mIh#(pa9*bwxvO-XAOZly(~blL9euxYNkl!wW%E*C%x
zhj(Y~M4znaGNV$rDyi2PtZ%4$hC`&%XEB69l;6sRgP59Ir>|<q;8o_UfM}w9SO+xM
z&uFrcszdlExaFLM+?RMzrcVTfbx%j)duA#id5?Z3I!FR-txq6<0bq!rKjm&whc01+
zYCw@f1pW3<*#LgQ^yi-7>g)JIhXeoU=e}^4$$lYWL9bobhXcZ1TS^r0WFdJlByj>J
z@K9*3sgT~DaNbuJf@T<KM!m^g8jo;0f?L5PVMuxH@KFp1!gwalS@q<<h|PM*)gG+B
z(u>e)B`Qaj>O*j=Xj8M@mHq8%5ul{u@ZaG&)U2``R&k5^V=du(%I0q}HKdh1(ci|g
zqGs`^$AFj^XZ8d<3#a)5W*pOUfcoxc(Z{|D0mRGLY*?D(GNIGLKShNW(n+*(AFH$l
z$(@a54(CL3d7tjxzGNi{b(wW4VHC?ARH2H?{M6>}?THioTw25r@%aUyRFN<al08b)
zF)H0&RmY>u7OY17K*^eKiJpOy>Y%-F?y9&+)wE?75yBTI%R3JjhndEh<c13J<gZ}V
z9G>8ZDBSek&mB$0z#peJi!Z))E*)n@4BmWrFo>b9xSUHzQ7DzBVaM!hIAA!)ms3NW
z`{*WbreCpLwZk>EUlg-8HWO--T9pmY3DqV(04?soo+T7O)O%*XZA_9dR6N_#G-@Rz
z+v{}9dcG9rZkrj$6-pwC0hWF*n&!>-+&Z}a6k!sN$!`#H8vb`aK@d>U@52SW+p&y9
z{r1J%`&2T<$Ds8I4b>|=6KmkYx82H;=ANS&JIuL*&Vi?<@vUx*JY+(tp{J$d*%3-P
z;s*!?E{yo#i|?#uzyF2f<Koo+2c_Cgy9g#m-C*X3*HkhO!}afRN1F2SFyvuK8|#uq
z-)cRT&c}L6U)mpGz2E8==PF(QvQgu$>6KC1+{beKg18&r#B#jGw+g7iX)q_=Bu^Q)
z0qT4ny~=h)hZ6;(hktQPj7gU8p`vR^4yIl#D+cha`xr<_ve$Lvib|y?Xn{9&MwD9X
ze_wBJ;&0Y3or7MG#vKyO7$oA%pI&kie@*5+wK*wp%#PjtO+0>@wc9*I4Qfv;R!{fQ
z85Br7=F}(=M&r1ju~*rqh%=BbPXm7+{i4<(`;Ib|0-U@}L1Q8=gyhQr684XPBWT@@
z3cw*AU^3nM4&iRof9_TQ3*eK?ZNhHj4x|1c?|a3Enj{N>ksySSLh6Y!J`?<v21PF{
z*|zUe7n@LP1=i*>=7fsV5Cl*FjCoJj3T&tU{e&e;+ON@tKl=^9$!Hf&PW#Oby_6)o
zd#PBlpHo*draYz?Bx-ygjnJZ>i(uaFLMi6a?^k&>sjC95fv=0QYg4^T&v<*U*w{!b
zcc0xjmzr3rZhkY$k*%U6hfH^*82>#p7Mvh3K_$Lw1xTK)Gnn0?Ou*#^T=v=|(oLNv
zfY6f6^PL(kH)RX1RzA+{Xbktf|JXKwuiM4{mavJQMH+#bz0QC2gs;B5tb~}BzG)E<
zy~CkFtdFUyWh@JV-ZVRL9XVDclrVa961yLznS};pMSb6`4<S7l#T{bDzC2uSVX4T<
zv+BBwKS@$FV5|7q&R<>;hzvG(3x%Is<LsrUQ44|%SgbaWJPvG}_f5XGQ-wRS1JfC-
zSd_Sij@JhjzQC5Z&l$w}@VdtnCvVIedo0>G;FKCP>dR6PLFupOQ!(o@T>SKb#8c-^
ze?>Z)MPZE$e+kiM7fHhHg->bAI7MTKPulIHMbY`&oQIQV0EQr3fuO3Q2_K@!fr`vf
zxra}>n*)%!zI!=fN~l_pXC*evL^4GZ<zVQ&!PQgx#VU!477w&R`3b!=4JPg}oP>??
zo{Z$`pgR2$)klm6YW9ZNt6M3FPJ>dO$sl$w^UocpF)P+veApY~6MEP@RC^gylbiM1
zA7&t>VRRTD7K|w~2~dP)zk%C}9=G<t+5}`(=D#wAofh+-G8Fu$JG;f}rdHGR*#Esa
z-5@~FkOm{5(Gpbe*I@Fkt;@vP_}PiC1S|sf^WmO(r!r7ZDt|$+%-69Pyor=wO(Qrk
zEA~4wft>%&Pz$#)amHHf1voysi^<BQFZ2Ql&rj>y99t$#f?m6t^8RA}U#FZMsE7uQ
zjF&bq*Uaf{Z&_PaMZ~(qL6QQR&a7{VdU~HNCe~FI1R|cIW^8)$=Er|DlL51@Ykn_i
z)yg!(U$_UiZ7?tV+;LF;36I``@4ubSEfU+Y2*IxG5DXIc{@~Iir#DN6-~BfE58bJO
ze#W20bf2u8H`n+#(l#I$S?jt4tU?3}G2AX@w#7$V6E$l3vmQ?nfKYhOAQk<@gr$*=
zcgb!xO!doD4tFZF!YU<k_8x^&=OHmwLXum{9%{<s7PHr8Lgg%q?%Qimx@rc9F76Mj
zrpjzweI?U>rpzk@&A{9C@LU;e=^0S%aVgD-Q8WYXcux-3;~O)#{#~3&FRiW%D$Hyn
z&FRacAwNux-oIC}EO2I6B>5ZIgDjE1jIu<|R)khSElD}hMm8*US*<MO{UXG0ZEop2
zR~JNpS1Qe@>D3dpd44XE>%17$&--}Mj_bU-aj0)Mqflp3RiP?PJcR0d$Q>U^RD2j9
zw?y=xqMOKvMrU2AH6u?U_yaVvP%2<u%1VdWUG*H42({?gGxa)P*6*q1BUx{)*R`&+
zkmR&p*(J_AD_qi+03fVLjlqvZY;=#Jj%SXyU-WY+xGdv&xR^zbu4FEyLK&Qmjs{{5
zKQ-Yrtx4KozC(-w#m{5kPF$jJjtD6tWVR!j54$hvn8nMWY0=8uk8}I)(WEgC_IW(c
zmm3>d-1p0F+LB*Cpw*aLTX9iw!|fn*MP}oP;_+sO#l5)Wdu$t>pps+kBctQkZ_xPb
zL&yku1>d>jD%n7Q;%f?`*Z%ORNi0mks6Sd#Fes2LLLuLH`UFMvM7)yAwrR5iNVROS
z9AfH{;2V8n_ON+<cs-P4A<2>42(Envnq5EpLxcWXl&(K)T$CFEL(P3EzMI*9JIa6Z
z4N^8bIU53ccn%05O)*V$SDh=4e9u{J{?DZW+5Ke!(jM3oSbyWr((nH;_{x#g3^d;U
z?Xz1R{PttgNkF=P!^>G_uuQ?~Mjf$#-kj<GumJvNdZDXq+HJvCcAeP7_=Zz$t7v>P
zTuLk6*UL)2E2v{cthYyDjHM5J68QA33^Ftssj@_LX{&w2AUb7NRKbc03{;z#z7prS
z$8`_!gGc371?LsGx|^(qnbHhvTzUc1g$rkc&7vUrBGcp6h4m-vqUx0OX(#Xj;j7N_
z>{#q?cZ(wT;)z$of(7bB{Jjyj<B%9nKqV#|F2)%K9ll0&IJpESwE7w~m7SmoPD*fc
z8jKvlcz47fK{F0{lOVUsp)%0AM;bPu2Rd3moDfXU$Bsl1Byaa>*B<*O?r&4}{8VpB
z5UUDB*YdHN^R0IKqm_rQg8`?CX)DCmryfC=2{$=zWntj+&-N%`Pj@^i?j`VrUU~&*
zdADaGOCAf8hXmhB?Jxe8nXVn4JRAMxpSXX*tRZWXqq8Yu%{~8qab!-g=CdVu(b1ji
z7Nb%f+xMzJj93+`smwAkt*HE9Ym6q73UA(npwxw^Q(z<I60(6pr-J6-Lg<wAzv13O
z(Hed<9$;tgajN}ms2Ls+&J%lThnTQ*<Zi2$k|kT5E?P)i=NNg01LAn66D;libsSVI
z2<C3BY@KTSm%f!ZF~O8<?=ty_y=kG}OPSSHMvlkTW?$JwHz=w@dOqfB`QBI)7hG1}
zov!pl$6K9=$#!llkNQaS4;&|%w3n#>+hXOt(RnjLb}%2(n&|C~uv?uaYTTV%{0;7u
zMPJ+AdJq+HQ@=P#u)`m3A$CR4Lnc86n&)?5fc{X}d%=GH66oEWLiZlcQu&^Kq80SU
z3&K)Qd13SmBM((aG{5I;+n_Lc7ef*f^Mk#^!pq(4Ql+*AA?-*Hg37)KLEX<-9$mro
zfIWn6c|BNK%KhJX%|13jVWz`8^JlW8W7X-tehF7l9J%)h#VXc;t>`<5nVVtegD=Cw
zgP4aOlJimyIA-ub3}m#2(h#plZkkACYi?QSIhV3{Fe}jA-cF$5x}Kp%TcUSYbwUIS
zEQq$p_+J0-zqdvcaGDf}Q&Z1wB|)iOJHmE;jG{QAf{1^vEX1u(MI#pzU`Z|wMV$9g
zn!7Ln)n;3rw)NkrHPBp88GuI<uvOy}rdDR0;Gr%_@0x!FZpR|f)J5@je78QEK6M02
zog-Bm48rn*vVoZzU+zF+#0rv7q?6^167?QkGc%jT!<nw7Vwi+^|EY7pt$v*lA($(N
zRV@5toJ&Rn0`J>%bJftwGQRO5RkHYQa}!68uOp3jQoVRB24N11Ncw>XWRmnVV@i4K
zAn6y?4Hz(W94#oyBm~5cAR{6W?391clnm}v!SE+r-KGV_9H7Gln?KwBBHCT=IrY64
zPvMplM2%(}{1%HzaBG7_Hd9+nFXIpz7mK3aF5+JoPqV5Zq6xztltA1n`W|YnM`$W2
zE5Py7`==o~oK_W?a`KI0i6bMEXE#p7AK9EZzu$*s){#Je8IjCoNMoDjIGEsXawB`b
zgIV{aA>imT?pvc?6E`toxU+NNm;yP@DQe@YpgYQw=ia4V^0<y{9K$$5$79$mNgOPP
zdvSX6i&SDbklj&oUTp<~h_NS6LSF5ZzK{8K6|s3m)QUC*tyPf|pG}%GlnY@5)y8un
z?&iQz)#_Jsi_E$2Zf(VNcO&#a6-jY23==+skyQ!xWruPtWKo?ThU3oH9Lq!HT95Ip
zTTb}p(?pwyw{ZD8!$MlJa-N4rYub>I58G&IcSd^u{<K`UlRQF^SjUWyV|1C~+@~$s
zP4}z68)~Cfp&>mr9S>cSjQ_iQ;?cf-$ctN0p7K96yywS%mHm3}DCrMauD)HzQ;5`W
zsp4GpY;M?~r7LweR6^8%t6#UOj!kiSyRlbAX{<)M%<~5<_a;)Dq3;7SUJg)D^rYC|
zqk&c}YDofd%qRWu0aGas0f4N!>z1gSYwuXb#{a*A8fFmezXs|r@5f0%cVh1Ho9ESK
zhX@M^i5M#!ZLCPY54W+Bd=CVayb#K77Cx37lCT>ZS||iL&*5NP*l&L+sdIOQApmI7
zA-x^W&R2iBPG6=@*r={jxR1^+=P%P`7nBzk_z2D1+!UnPPD-j3;2aG4DVSXHLy_t!
z%3TS&#cfBa^dvBJG$%1BK@RPAkVE?g*1mw3LA6g|UeF4rfv7Kwv8cjaf~MaJ_cFCJ
z+qyq<ezy#-)zUo|IY`%W1(*cP1k69KOPuoOjAw5HLc&f$X~g_^v8o{O;qOvUzRe4!
zR3t4ffvDw!OA2ces*UWszd1J!p*ZmvCwSL_m$~)g7}rF1;#f4)#8yHQ;xFtIG2y8O
z&ka9W<j=PL^$cACPmICGhmOsPIpoc=MG!HpuS8wKT~R%Em!{L!&<BBG9ONavNh+u0
z$|kf)k@Sxktc$|J(2=-pBbK4`hezYxeZoB@G(XfsxR7c*D7&4jQ)#F|!{^JidYyCw
z5@I%bJg7OniWj&B>1XYjmj7bDW>tbPn~4u=g>1gsG&g(ak!{sw=^x}~NJ&%FD?TV!
zZ?d$uxIf^{;&&0JJpO(5A$E1Xab14POjEWNyqXD(v3aEti2|_j5T7SLx4bNuq^*+F
zsG&h26Tk{4yMViL|LrYWKl~nJlLPL<^n=!GHYe{sUchA<jA=rgXgB;e=8wbpnpbc&
zD>f`O(H}67Cl`JgS$`L%toqOrj;#GUrv#oC3~!$SD|eU}w;NqRvsX52P@xZP(We1Q
zN6G2b6)V839Ca?rbmgUDQNjkLg#ya|Wu3C(NyR@bDlBAismI_1dd)dz<x>CnElG&m
zx>lKFE|JUU*X-<GoWyQF#S?X|lR2VvK2#V(gKZN>{{?iBFJC&c_JsjX)TxJk*}kEa
zfkQ_93`3fO!hEq*f)FewD@M5A*o#@acGLQ+BvG!)t&_N~G0QKm$z9^Wvv)4s;F%DC
zW6QZE?34K&7L)EX(Wh~o=OucnX~FYINfP!M^4(aHA3v@7KSJGJXYQ|eRm!7gY?$mU
zVa+WU8;~sKg0pC>+jKUVEyVQJIK~T6CJro}wtn(NhNvIshhx~2KIf6r;{~$(>)-qC
zLS}CjMc2vEf+ETK!un{YwlW`cn8Z=#WLYsY-Zp)<89*nGiNIFq^fi!icq8Ni`l|Wc
zXZ=jmSnryedC;B$=81@~aVeG^Q8^;*RYmzQtIu?gx2!UgAU_2NwqO#C2DX9;OHt;8
z<4{%17=?cP7U%f|RuBh`PjLhlC#LFfFqpQAR?9xH7nX^@7toT89Fr8zTzL%>PW&Ed
zy$J)8@hwHKSSo-VqQ4(ZK%}RK2~g$A7ghh=N2=Xq+YUS|7z?b@q)a#8HdL0@`;=-!
zh%2YJp{<@B<p&uT{Gs!@-<;2eC*IFvC3is6SvGSQ@5QU5L3(QGAzhEQ+wmRyI*%tp
zdpiDjKQ%E!Y%W<iyBKVPdAk4~Wq_G=g)i(J*o7Ovvt`OaG6e2!yr8q|7=dx|ZfRD?
zhi1d73M{!z!+L+g$^&e}1o}#7Tg1;gsibi2dTL$!#oM2Q!L@TmWOD4%b=lQSC2RCE
z#9*~JKKgCo#k>+`l6SK{3*!pwwOmYEGP;yqQ}A4G-`l6=o92RDbXbE*1;-X{gM@P!
z@9b)&D-+!(OY?@ru&}32v*W1MJVeqO^vQvElbZ%L8NG9KyDz;NW68{y`9Tnddaipl
zs8$${zW*GT;!mLVuI;?njL#R^sxeko)VBgxIVnP=*GxJO&*!&!I2?{0rKFw{P9u3w
zAXf}CD^tdF(YGd}p!8PF*5eJGEpjslJBTA^H$h>*oHw;AnNzTNq{*LtEndPpHQpg;
zTqab~LG;pt5{*(Y`u6?D@E8|aER8RJoFq(4a{P#Amj#q@uA8@o2%4W;!rn!pKY0rM
z+P59Q&5&sE5^!<kqJi5&NWn@nhfouK@3#ksspv()LLWds+&zZYJnqI9a7ak{c2mH6
z42Lbyyj!(LHY|+CuE39F5k{ujhc+W<@ykqB#l)QOrQiDZ83~R3!T|<d3wM`^$3yh+
z3q%1V=}>ypklX8^RSl4I_klVSWft`w$`QMRWhngLX=PVz<e$ydH*zyw{)&vmCL4`)
z56N}o3Cx7p&0Nn|)n6vk>#mcBR9AI<{xqt;p)s*w9%^yI#ecD5(Tz=@R6AA3V18is
zz@4@A)-rg_!na|oy+0@>RZ9R6;eSS0sZys-p9(7DReSLg{oNYR-oP=p<-9{?V|$$8
z{-Fcfx(n+LKFTF6y92{?&v$}IQ)>+3nX?!mw3H^ud+F9>Z@!t1zxl`Iv0FLv67O7Z
zh{Mpd^DxuMVQ@54`>l}9ma(r6?-vK66XKR2MDotb&X+Fk+FvrrRx}x|a<(G+$BIJc
z%{iMA^qHO`85T~eXMFuiRbhFZjmGb*VG5E4M&h^MafK`rmWltVCV>i@DR%HhtcT|I
z@ppvn(N9_c3vacjUm4+0ZD23JWJt=kmsH>dCcMy<Pgcy3s~#=oTj;1N`A;05YzQhO
zN>;2rxx1p1#C_BKgx@$6K1|yEc|c4EO+nrRXy_Q}{k~)bLF8*0#u<$-Mp#5us-NQD
zo+rPbZ7-MCF873|C$yc`HaZ;R3b#7)zcL#pDgUJSdkx11Kwvg*gIH$R7W0=~Pd&}_
zairp;ZpiR(%4JD(Y5gInrG~K3)c~b{$j))aPI?1x9P>k=c{DA?{02_kRUJhPFXt`r
zt%x^t*Fc`4Krqs_uyl7OOH4L$tJI}oS_|uq7;AHJVwGUs>4;HB4=qJHHKxg+l+sUq
z-$LIh=~|Dp_hw<)uv5O+q`0JzSt_)Y)~Nr&kfy}Nz)+d6R91Yj*-dOFW_erqE0;rr
ztdU2Dr?k7E{dZZ?I3C?j@rzLv??M6FU_Q!Ob{uEz&B$QDLYZ;z{5jkjL;LI&!T$m#
zLD|0ak43f1W^wJJQ=Tn;hP#%?$%<fH)GlFO$M@s<>@49q8^disbtdejmtr(JrA-am
z2GCry_G}iU{;-YMW9uR*+YroIyDwj6X0<M5Yg62|QLbZT$qmfNhB4U8bUetnBx(XZ
zvekfp+OB^<(u}~qi?~=(S-3G5Z>^cO!jvCL=abq$;eh>-4oog_074=;@c@4E%DBt1
z5zr$ZT<}EOytyA7(gE=YH>D4M(&UoHmD0Cho(><$MSP1vI7L7}E{KaMVL-y+YL~GX
zr%Hhyc|=zNijE~YebPx2KJnm4Iivx~2VX8gG;xU&FXWgip=}$P8Wx%cyrZ$o#~pkK
zSZJl440&DW><q35xWV;G3xkL63^s#s4YdYp4b&PKxdw`}l93BAI)*GXIKz>Lah%;a
zE^rx)KZfb$Q*nHsWdUJ};u>lV)EcNYP-|cjX+UGFiX;nw!kIf`Zwd0ykPptSSYgN2
z*{knM1sY?smD%*Q+;*#SjxggiJ1d7V5-u(sc4$033dw_tq8(`nyK4__)h0J<pgF`b
zjKy*eD-ARSYKP1r;q1pp*gd<(cKLJvdL&1L$;?;0_eE&@E|X0!g1JbkO9om!g~2w8
zA0^-lFP*H)zA9U%@)qe6=7NUu<3gJ_fG~c^L7H$BXHilxUdM;7gN(TfD*+clam7So
z7^;?47%>H31(V>Sr7$iaWu^4M)un=}An+1DTtMNJ2l(tB7C-Qo3~-YHJSF9CK7cZL
zgcF~{%!k70^Z2e+_0kxEd4<ESMP&@OiebkVP<)y`AB}rG`|Z|W?#^F$k8NdYnsa^U
z*XDXjKwF%~5RlQInXw5VTh|5xN<3?AW1vhma;<?yp#j~Q@xJe`NWxX#Zn=s$%G)hZ
zb!kY$g%njt5{;42_A#ak7MXIQUNudwkWt33y+bKkbR&m-?VYzYmT8LCK1bQHUUCf6
z*7y4dg_z;k7(cyiI?OG%-B2@3{l=xAvP-*&=q2;AMO3P#S(M`ZPIbG8wBaKM{aXS}
z>x(453UBQ18<a=Wqp7@u&Z!%6mhFpk{Ztz^26bp}adfo(uru+kL5`7Fu@b{D-x)Ct
z&R2<^b-tNdr=gX!3}tHxdgz5+!aT5zW3s<VW4kfe+M0=ns2$W+g)pVk^qrz5Qf#To
zR54ar)Rfkka?4_`vb4wmgH(>P7$$UDd2*k}*tIsN1EyA*NzS}wv{t8qKK+7vw)>Z3
zUaURx@Fqf(A>wCII9c8#rUGxV&qInXrH`+ggTPIO;T8fEfD1oqvRBG4MH7}EeC(gA
zvN+NJ(Gor4WJne-aN#c;!tz5O{*r|-7hwRu@Sy>26BG@?WJnPugb2eJfGBAYBn?1t
z@^UF3_!wtJmwdX26MyiCCk}kVT%tuh7l5mHa0tT>{u~+6lveS5X6z;uq|pf#uXM4p
zijEzSnpo*v#!qlu^$OpPV7s;aDJps|AE1h%*$<~Tzdu>z*az<-%I8;8tTj+;V4-V3
zeNoqrtAs+rr)nN0h*=s5o7nqX8EgIZT%Wa-M!Pp5X&M>U+L*K4zN*fc@2?%&;x{gg
zHC60Qug0h~P-~#pz|z*hsK&~QwanmPMWHlnX4d$w!<8H(VH;JVsjp)GV<eB!JHEkV
z=8vp8F^2PzIUZ)L9eDH17z<Nituen4T}m)F`ep`5SDpDCDli^ZS(bS##L62V@aIiu
z-lWouzO$N*c~)pPaIIRs%G#)%lrS+$$m%&4ns6~LPqZXY)8tY%M}@IJ0@xoZAz{*F
z_yr#z4L`P1Z~@T}KF3G^;DG}zn3FC6+wm8^a7B;&qzRNx9P;EfB7>|Dg+Lf22&w?Y
zAshvPATIde5HE(r1K<c>e2Vl4V*nPdPW-jw7djH2JcOZv%azInttEG4ggQ96rh|b2
zC1#C(;Jl;EKts?IW0e=9q5PwiWu&~U;MytNjW2t;fZ}8*#>U@n`Fp4FdIzuWPT7FM
zEm{GXm^urZr>Gc%XKW`}r*n+EOF+wxI|lfA{lWmcH-PTU?@SNXKeYzts{ys5s_y{t
zLC&gqb=Cz^q>_NCd#ZD;K~j9YF&0DZMCyYfrJ%=chB0W?M2N5Z*-l*>Z@D5^LQ%YC
zVM_~nsqLZQ>?~&{A_HGor*B6V`^c#8K*{8(U}0BUL6#CB)q@t?OR4OOwXDUuj5p?@
zD{buKtv|6gtTo4|3Ym7P)%W)5%ZsIhbM@SdT${se3W+hD$68iBW*RV2>26l9v0byX
zc8rAW7-pT)&}GBd%%j|pcX=aPYp_EYgWL3U{FD+O_lEy+J5M;C&&s@K+;upZeut9Q
zGiMYE{gl7Sn#HxWgrS%YR=)9JQ);^?t2L6w9IiZxn2-5=Xg@mMk@kq%tGCgpAJbev
zD{tH43Ab%x9+~y~Y8|p!%Giqi5kK()8FS?#4C&Co&!sf;`Xb+Jgn$8l@WH_^9_ICU
z1eYB6!I3=X&F!zsFJ+Jh6lpqxnAG?s6U5OV8MuJ705K-UNl5SkF;@+c4;rE?%Mo$#
zAzr-9>jl(KU(qBUJPND)id)A#C<Qs7Dc8J7|4(QMK=n7;gelQST$9Oq8Ok0fZWAVB
z72@cwtb+CcG<jv0j~G<d?z~QU%4l^<k$DO}$L?U&`v9^=RHNmi(!d$(47CPo4J<ef
zq*I8hgcpzMJ7sZFNvh{4POUDxakcTN-8p-$Im(Tp?0hxYUY51lp^Zb?!(g2=??&r#
zS=Q8Q4b&RwrU5#radt}GWE&z){q7<xTA~$|GKtE)lTvcY*g+nTZlw9QM*NI<d!vPo
zD|W^4Aum|<o`yJ;^1>9(S*(;#W1t?`uC+CkeRgI3%ce>tuZXxc6*epZ#r0`1+$_O}
zDy*65h(nG0$T!jD5A{nF1IsUif&Ftt1X|5%Blnfatqm!aQAx#cuXv?LH)}K4ECmz^
zd*dy3;pa*XyqN+#9vdZq{SrU8fb5^R0BO(w6emAn*-RA&e|?}%{6#b6FIuvX3P<tK
zYike|5g{TR{!|cYR=Bt-2yV*Mg5D0u4<57-oG>n7lq4l69y<6j4uc0x0d%;8TjZ}i
zDueRX?jq0tjiG5|!w_r(o}a5rOIX6-y7BTid_$?j$S~1p2k3jbo!{tsZ-+2s933!E
z88vvb!1r^E2QdaCdfp}o&?Ru?k>;<V*1*!!K=BS}f0vh|7xAi+NB@#mBMtpjOZf)r
ztNJfMf>}*j5(b^U?0j;g@SOM2z7W+kPGWV=T}q1U8>6sY?BHO*PdzO2^Np>i&*DpA
zRud^l16C&vR!=o7Mh&Q5TYAGqP+0nw=3<O;$8dpl>v+>FT8W_|XGo8)eytYl$e^@%
zCQC<gSU1>ZXX?({$JVB8w=f@{(-Cx?^QH6`h93hsM&T8#hwTr8FvkIKmhhDIyEA^=
z)50iAPboW$BR>A;nXQq;e~;<dL~{J@p271sR?may?JkQ_)&C4eA8fm<GxLWA#ZFDc
z2XrNaA3=fQ4Q6Lo+x^F0&d9GMR!+P1r>Rr0<kUpiirp(FrIz^d>XI>m0s^vI5|;fD
zTm+Hv0UQ8z2_GE!als`WyQkt)dg2dGF|Ta4qyfUkFBym<T{xsQ8CeMn0b~GIf)R$1
za0rv89lJ8<%9Rk{gQuD?Zw|x(6d1hJ=u5o#%Y|1;k9@uOL#Kwtq=96S7Z-m_(yS@b
zN@_3-aEp`!P|~<tq!@Pw+wERS4{vqKjxU~Enh^e^-_9Xw46j9L`VAW~e}$`VEd6S%
z##<U1;Ew3jb0~gs+%@U6qs+Qx97^e7q)fx*`^BzeHXQ^vuG#Cblrul2fqr|$gE9Q$
z!YF=Nhk1eTk}`v}&w$w;)v<MVC|(_1tp=zPHQ;JF)zn9+0o5t>yT~B+?<!!{qg36=
zPlOIBbEDj`<YTO0tB59PT$E1oWbsx{bM{Kh8eAI>_(-)MBSEEh$~qCcA4~{d&&MFg
z_{W5Vhor2VSVJvikhbzKisHtb(TbS11d80;Hd5_1W2Py6`sblI8EpIHFff{n)S(aR
zEG{X04Bm`-tg*Z3Y*2yFzR$g~JCyUh**H+Fr$OoVhp)N4u&ME(Yu$-uDn@ZkDRHqs
zia2&pjKH|0r;HUYRtLg@&kkR3fD{KB;zgQhD-KsSQ_{$b3rH^f;E7fm4}bEI?jT|c
z%Ow-YVqDB9=HNq+bd)1{QjA5pfTROr4t*~0$U}OHLz)VP3^MxS7p`bX2}S-+ufu&}
zWNKJw8la+^R@ii6zWB6wTEh|s*G-4=x2CnmC~NEe(jGUS+gRaI5%z?eCztdXOkeyA
zqIoUqkv}#L?=bAAwTvqLB)e%nEb+!Z$<<WLwtzIC`zXD)N*13PckIMUCR`+!@hL`+
zFziQ2m?~{Qk}WcrzL`u?an*8o@#8`tR?G|hL!`XLGKC!W%AzfXt6rQ{UCjB?zr*Ht
z40qdN3*RaClOO$XzGO<yXN`qze$?F<;5N6tZP<SMdpPHdF8pa&y;|RL8G|r2%LS`}
zqM;+sFDo2V7ObYK6Pzw&t&g?hLEj>Ov&%RzGq>8-6wCc=Vb0q1H%!OX5jBf9bcivI
zk9e(E5g*KAoMSY`7>@Ce*Y_9bA}H2SR?iwXiud2p3LGT?Z=)R=>ImdOcdWCe%VAkU
z2b!vr_*O5bxiX+EDf^S9$SrGjR2H^HFRHl;W7Jg^?3$|7)Q(9UHcS9q<#Ai3g-HX4
zH1eT1**tNT4nBVH#9ua7!uTbl_!AG14<Ik}#hbX?fa?MKkuZeQj7nE#(j+j138!f?
z@)9q`7<IuRAFk5On->cHDu8H;E_nErSG$F!lr$e{gy*tKG;a+HUIRAJX+h^54jqpf
z4r`DGbk8d+w^O{*6BivP!FFDI=4?-$<11HHXumN?*=u1YPyATI{00?X8RneHyuJ8W
zDd<`j8c-`-XuJxoFEoAB@>Zb%wX9BkfZ~NWs0_t?qBkg=GVqt#aW{9q%U!~@+ie>*
zyTcvA_19e&{&4m0!*725t1`$N4JO8sl*X-+2)B@lY;<JBxU>piJLBCKoHkKoq2c{)
zi@4Q9WXkprj`C_O{C%+#cS$iBoU{0<>!MxZR<2wbcHVWjrX=L}```Z_uD|x$@Q;7|
zy(z8i!2KWiz;Mt@4hd`4tO-wi)We+orkidSj(+no;otwhDg4*#Ul&%b;wZe~V5gmT
z3G1%AZcYTl#Gn84r*Q3Gu8Hj;Pm#yk49!M2ilRs0-eZRy!yDi7Hs`eezWan5uD^Z+
zT$d1wVx4-o<Ufl>3EuA(%IP!c5fyWi#?!G@s?|Y@F06lT55&i{<Z3g?EVn*tdU`rc
z+2tP_YoXMh%B04k3C3W)w=!i9L*vnYQ(i{CzrwgP+fg@@RVvMEBo*tp!tJJ{h3Af;
z4s?&`&WLj~#g?H$XzAj?#A<JE;x`<J)D$=zC2|j1>a4nCf0Qtgp?HeNxPbi=g9T5R
z38#i%@WCZcp!_n>l1D}g@c|b<xG5g=z!e^T_!Ey|7!ZB&#)U=;kTC@@gn)>UuCV;L
z5*Vg107ndACO>YPPCn8x*vhDDUXPPJ;s=iMil6upCJp}NBTO23pii8AU$cfu*Fdq3
zsMHi%(tS{1U?^gyxt5y0sHJMkkH(iL=lWK`CGPHu{Tq{Of1+I~qq^Ocs?M5Nt$_um
zfqU(ApK#=Bjt+O&eDfB`F$kaZ-yaN@T=cV+w0TFQUCwB_>UoPgbVe)Rtew|L-#x`x
z%``17|IiHjBfz-9!$5W`BLi=>aI|pTwW8@{f3$|h+UVA|4sU+jJ3Es3#m_GZr=0wW
zaLL6Nb;Kz<Vb}Za5w^Sg-JR?`cHA*seBtoz{m>(h44dEaPA#Hhi2lP>zYm}N^vU4|
z=bzV-UPsg#SS%W#tMlEeV>0+G_Ti=Pc9M=c?Udqiw&BF;Y1OJ#VcHC+Jh;o>IvvNL
z)py}~Bl0i~>nY1*jKXZ<Sz%>mESy`t%8ezxsf-RItuAr(w?q{fv)ir-jZ>t4<Y9|I
z*36@*-Wbg5(;qfU$&NT&NhAw($d2^LbFDpqwqqX0&<_q*ny$H3R81hUKN2VVBMQaX
zOPrL8EfPEcJo&MI%8$(we9@7O6qORkMS45_7M-VqqrBozo-`kR=*n(t-U!N|FiZuh
zAovv~U13~k$Z$&<GzjCu7~w=0e1LR7R&vn;R{&k|5hp$=9p&lDUkpXGb|*^%bQb<9
zr!C$(z0#TEnCJ`;{#471lD5K|tip^z8oK+e%dePw>{BoX=O6B=fFrd1bz`eq>YW{3
z=9xDq&dq9MXL4jaoAd5x-el{HwFVZo1~j-<T}bg6Wl#Q`=RQ9i_ulurF?hz#H~Y=6
zE(_;>@0@VsjW>F6x4-*6!rR~Vp0MLR?_E;y>32r6TQ=&GC12xjK84uq4x5J)KJZb$
zw%slo4ZG24!ry*-D=#~dX2KeK4WBnWyc4D)o_|-~jeW;7#*ld25YtFo0NMP3F~%2~
zERMzif4$*`aOp389xnUkrQtvS`L|1OuY2zljyd+Yu;abTYID5{_Wg6u3Fn;k-SCam
z|6jP&4ANx+yN!Q)`ESD2W(39<ykf<Qu+=u(`i|T;z4aYo{q;9!X6J3Azs9lWUJnTG
zw)>Z>-W1TR#)%Gj=VU+8LKWSK7I=Qb(I(?@HRI`DT+Q<neSlnWVHuxZ<0)@@q5Bzg
z>2DYpW_`Tk<5#!ba<lhWJTx55x~jeO<;1dnn#teHkWm=JFuS40URz0@@3Po^<MX6!
zjXx>IU|I>Hj(YCWs}0C*k}q&wf9No|%uM2Qv8*-E%&xKay~^iA+`IbtZZBRv(@jCF
zwP{q#vCEj39qQ~zZv|?bego5;KxVwOKPmc!+rJB^PFMd_S};?R5}Y`I0wXvst%eRp
zN)Qg|KsWoRXpo<L@JZ=NhWYR(4<KW74B0Oh;uORLm%^k%fL9C)U%22XFL6qj&{7hG
zrJyVAQeIr*$pb#F!sc}#9z0#bgD%!~pvXVQ*1rp01Kyaj&W;99!zeWn2N_<iDtz9z
zG$DK-v&jH=FoPWfitq9&jYCbS)<CU+rL2J+?|HAV|MOnpljh%F`MdCzHy$1S_=i8Z
zN?3sGX1gYjdB?lVfVDEb;lJJ<_S@%)Hs97fZ0Trjot5i^d)@m!Uf>Nk+^}cCyW!J^
zW0>^^xi)@}8kj5iF&5_X5h1Jm_)ybinq?Q&h~b>G&I~7g<b%$Y1@L|EcR$}fjM0>~
z`I;jR8;L|b06F%pZ>faW)mL2=Uh$HHoHq5o^|srELk@jq;9<-C?!Q-f?tuq|51;tn
zdGWs8?KTegl;NEA<g4|0k*YJ*8mKi;YarJE;}j1uXROa!VQZb~=@mX#$PpHpCmtO!
z<6|#7H@R5C&CS`k$M|P!tZ}WS<HI}|FHtQ1s9@@$hQTy|>d+~=^JBBDX4hIh^8v-R
zoYn6T^$MQPg$ODs!<etb@tyJ85m1N^;vv1rYLepUa+POcY>_M!h?AWYKk?Es24K>J
zi+xiDUvP*A(sbel#DlLm=mW}&OB}A^Qku#u`ncfbP&5dW0D@LPBBp{ukUT0BVL*5i
z5Ld=r=xNrCU)!XWE?&wD4s@Z(MZChe7?A<e$g4E+3CM$-qN(`WoiGjfprBEpARB`j
z=~SW?as<+fE@W9U!LpxT`%c;}+M^y;Os`|gui%!->ezQ4TLmMFjKNG=hO2J|Lny?F
z2Rk?BY~WhB^9{;Em*;myml~^+Y7Gppf#Th+dr@vNeHf0SCECN#YL}P(<*-*B<zouF
z7GM9GBg1ueeyf1-=Epz$LHPc;-wO|T@ZRBe8*d!$evci(uP(b(D88`T>wymr+ibgi
zxcw%Znlbq*-(C5OpI@Bg;K8`}<flEu<9__Z3&P+3_P4Ox9`_6P-f8D>^MC#m&Oi6;
z@XJeo9{ZuJGkWBs9~b!0)$gwOKRd4CLO*kM=UsOX>#et*9VKvKIOohWvc9Z|mG8XV
zb+`M5Ew<V^-1v`wgv)>Pt8mWQXZk}mFyjcyxEVFO^DevDPSl<3{N%fae;WR!zqllP
z|GaZ@qv?Hi-Zk8J&%JUcdq4CMVO#t7*5$vxEL_~?7>(Ze^ug9^%`FQ%-DlTuPct;%
z#du$T!}Z~c%P$WXeE+<hcg{5N@DTDzPu<7s?f-szdCSoTn{KvQc+lPt^&F>v_0;?<
zTnv%--|K;4>+QA+o7{dAH~e4r%U}4;Ty)~Q_>A@j8*CUJ@#x2R{&UYhD_nP7qfOj?
zlTE_j4}G|&o$>8&y1uAe<N;_ef4Sz*fg?yZ*>uzJt*?L0<NN*LVZ)DpaDneq-`?8V
zHYO`$ZMq=dc;nl<5tSXb)Ztb3AmgkvzGG+q#@)q5UKm_=um>NMi@N>kkA74{@i6i}
z_#qE-|98Iijd0^X|C!@$yWRHTfqOs1%Y@<h7j~4z1$NYf4C^^!A0G1j_BX!{hrjHl
z;lz)8ENpG%c)}B(62ANGZ+W~(tXyXu*Y!4LJl^nDw+esz>kZ)t-#_2(lV1oWJp7T5
z4!i8Odmi5B8T-1fE;#>OKdV>?TiU(wK)Z)I8+_HO)#2*jUm3pht#9T#vW1trw4+Bp
z`muK8#T~<+{`kkh$M@LfTm<Te2S=QjOx>V2c6*=qy|Y{Nv+?b3A0F|j$N0U*N9%rf
z#c!?d&S)z~qn@|%GF^4$mEo-Kwy)>Beyk6=@y35z{aoDhJ}Q=DBEqIihlM*K>!?QB
ziQUXi>1=cu6*O}m#kvWOMXoCC=*lgQa$`LxWO`s2?AYF-ob=19?R9r{RI=`24DtuV
zR-YPA8x$woNB_&4P#A*I1rH&or&n5eY%PQyEIrN)N-RgNUuzFZlfcWk+#Z-GB*^WN
z7Dy~*>7dn4@m)&hl(KyInY);6-+71+yK(1cn|b;!VyCP4I2XfsOFb02r!EroN^0B}
znj<jBj$Av{H#C(tc)bsvqgNTar)RptZV4bbc1;%J6jKT|ueW&YkE8*zf6}>-AHy*D
z(|i<1VbN3(3FF5lKlH?(Jj!cc2g2|dJ^0E`KG6fOsbeNn5sC~5LxjwLgc2bH6f+4%
z7@?&+_>d+g-~yrnt_;1ziKcMKPafjok5L&sXo?3s0m%YQ(f5S<XEHUQhE<d<4qgmk
z@me%vMX{h05Z2ApP82%AICylbsdl*ri;MK_7B?0QC_bpnW8iGhwNX0S5>GK_?8*4T
zhDMndb~$S47qSLuh1K;6<!a_`TWk@y0E~O7G1w!spHH0h-{H4rcm#MbCD>xit-`Bc
z`$jX`ZLg@@J?E@5!in#BSGeh>n>=o%?XW%QB`<S7{mtW^^pvpKW_QT(pZfHD!~0Ko
zcR2mD|82yXack>swlmqj5lG*Ck3I9W$C&|b&-*_xy!|b2$m1|@zwpI}gngc|pC5&g
zCz$6M&)Pq{`RJqkV_u5iXro()!(aWn@PG$BL{aWO&GNHb`iMhcY6j20hdm$gpzyS(
z@0a7i8~DnXKHt_L+#7$b8Td8|haP@Z*!y9R$mz<1(e3zS-x01dqg^}TEX4clvTN9F
z_xqah^_uX41D=%|yTO0rlb;%%X1e3-=P!Tp^G;%mEw>Cu9Q8Ug+;7)H5~J@2-~Zll
z^S}S&dc*Ml!WX~P@sK4o2;aeu&QRLVe)3~C2y@P);{Nro8^bG)JSyDXK2XLn5Q7?o
zC0u$=z7}|-J@gTe3<tmbu&_a4m-c@9KQA2jj<<#jfBF-V@M9QW_1dEYM=A&&`-CT&
zA^hs_!wbHzsNB87=6B4?f$>uY;r*Zg!tkv9pPS?1LB~J+@sI4|bFcL;*f%Bi8DLC5
z`J|79W8V2L)BCcp*8?Av8-$VNxc7Y^U_ecQdi~0mzGyqDKjhI*+2`qDtF5=mQC@J+
zi{1aHKmH*%2tWV87lmi+_v{=;p8cM4KsfZ^7l*&t2kwfnhdlr}=p`==>#WoGAl|bN
zcwYG2XFe59`Si&-I(7dRdxK!7`|O;@;d$ayo@x&Xo)%vH%0u1wLLBY&O>cd>8DChg
zG~nsad{#L86$b~74iP-`;nee?ZR+{C;kb9ct*M^bMc%f4tbGnsKa!<(%hNzQHZJ}d
zTUy%kbT~YvX1VNfn;Qwb(#_T$99g$&Zk4SUX3Q|W!rm;A>7r}yiAuzf%{0c>K3QKB
zcM78iOSAEnzPZfy2``6i?H-Bu!=WFXiBfM{VJJnJB|)2<OOES)!qgc?V0W{5c&2ts
zc4#L9M>?><uCrlYx%+piZpL&jHjOc7Yw#`zm6PohpCe3^M_qymMJIq!7r_3Aol(Wb
z<--0bKlV!&65tX~e)7mZsW^-BI21#gT-i8DhmP_SPWgi`Ilxm`otDD5fcVFd{UT@z
z5EFBd36ojEi6CK^a4DU9gb@Ug5W<l{z$Xsc&|$VDy5{w;@=6}zDxQ4E4o~GJP3h*1
z{?cqpP^@7j8el=>MqnF!V;5+Rg<7t`ZW?ZdlE6syqKE#M+n0D6uY#1sJ0s)uY@-Pi
z6z*gOISp`SaiTr(+KiuVWJKYqC(+B6m8j3M1g`1S8kkTGs2i^Gt`QHZpe$Y(bOo3H
z`q%QdxEvwz`Okhji--I2u-^LXnj!0WH|kz{?O(#@KK;pnd-r?nXvUf61$NQWhrRX9
zN4L;>?h9Y!#?FtQ_95R@jPd7IW*~jxiw_Rp{mwW2+`@F8^3aDrD*WT`e-B^!!YScD
z|Gp_a{85h$ce?Xk!b2?IX{UZU{L*%P0#D!fId(leth(iv@YVnQQaJm}?}RP3+}ez}
z``V7)yN4sqczxty2j@FgUiF$cg!`MZm)%1D^ZC#EPU7uN{>MM@sg`f6@cK8sH5~cM
zL&BLR6T34HddbV3&*wjTvde$<Rabhr_|p&m5l0>EhG=9x<ufN6?_Y<_%?S9c1D+Sy
z?f7OpSN5d`KF@S<OOd>XPyO=$xPgt20Pbo#L@`bR7{wp@h)22q8(;f>?yk4~`r*Ic
zc5GnBCq{qjGS<}&Vc%!(A0G6Ohq@v7oyWY{7e$N*g4D0LZZ5`Cc6QR9F1@6Amw2~)
zY1+=a?iO~~@tz)a*`=4}NyNSCHAnk+b@rLxHDmMXzEkZnk9&geU_a{UH-;BIe}6Yp
zlL=Wc1~cBBe%h(wCqMk585lPRPkGwYy-nnVyLf14GB$q9j<xvF1s9mHdk1@v@LJy$
zyXRgH^qsI>NOVp5mF>_L-1V+^lQ$gkn%B887~}P4KlMp(|4*=oD0@BV!6y4NeMdAq
z=TH9l$9(56yKVuDrQAE($;+-?8G}##@|SEU{yBbJ#k0-8ee2uYCcNn2m-#U<IpfUp
zl0#nZ=P956z3+vU>#Ph<+2<MI9%kg{ym1~hsJ%V&S<i7}FlQux{G<OJ{?8sD-1mNa
zdb<Mu@lSek`07`_<Wvu{2L%{|&$Qj#U;4u5{EdUdj(D}V%YE&E%?D3B!SP}}zplBS
zZ5R4u9`|^=XZ8+9z3vU+MK3tO>$$mpKIFU0y?%~-jo%;C|9Rg#Co9zga<~WSYIA4`
z<gp9c<GqaS&P>7Q-)ZNcCYJ1P^m38#;?r=S3Nu9%`+0u|*G3_+e(dPFSu?)b+Jy6W
zr>D)BX5&tCd+n3=SkU4dCp_Gy+{n(lj<R4-^z{*K(8}kFuwp|QKxTHXrZjR=?#V*~
zP+Tgg(v8)F_k~)S^AW)4XZJ64#hTS)%pcv(Ix4nvFfjx(Z)%s;nNs%@Z&%j0(XQC3
zyk=%~_Y8fcN+W%smVy%X(V1(eFK&|TMsfQic1?PY=8ipvNh6+g`~u=c2OB0JI@mSk
z7hP}x!nzPtd4)%uaK%@0K~sejfAT>imks7AfT)ZhizyatfG{{>3=TAKr6lDcP8a#b
zi#V+72*O2JAmO0F1rVn~Djt_O@{$fHjC{m_;~#r9w}u6z0d73M`FwC$K!R5+YI>uT
z#j59A)an332d^1b0?^L}Ck7Hf)5<3%<&~B})F*s-0T{N_y_Cl%CtrJN4J>jE_~5$0
z%81cZ@aI4ON!}iA>?fYR|MT-5zDFJYa@&pgN6&ZRPk$WPCHnHiUggIY>|#eeT==ub
zu1%1xw<8E%df)+hAN0qoud?%0kMLLeG4NdRf4}ufz64>ye%K)g`B4PKoo`22eC$)7
z^JLCo#UOm!+uqI$fCqXUyNplz$Oqhih3#zq(;u%6@Bhdr{FU~d?D&U^FZ`()t?uu}
zV36MR_P5xp=-+mH3}zUA4|&BAwhMPRKe7U2?JYOok{g66<3&cJ6ZFD|w{|6e@WkW8
zH@<e7_rHAL?U$Ec5<dFLQ~U#e7~4MeiIdv0VJ9pfD7)+3ws51H40OD@e_K0d<KMP3
z`+H}d<$2i&iZK{??UAp{caC24v!8lh9rB7-x>50)Uqd%P^M{3wY(MCpt98r}Mzg#A
zdh7dHxiUyLr?wAawA=iSoBOy*ectwVw{t{}@4yHvIM~kIWgf&a8Si@ATNLd_lwd^O
z=+?KkovBX?pZVm+-6)MQ5;*IOZ#SLK`~7pz4JUp26hA&8C(^;Q^|sr33Lm@ssu@&y
zIQyqR{=r>#xZiZszdGdXFPdX6s4I3nb7Tp?Q4#3;*O&d$cjU5L8TjMXSGz$N|919(
z1A{PWn{K+9AHzWWS!O85P$Rg@UGExxZ6Aqb_w7eN9PbH^bJ%jLt=+)7-QC-NAn^=4
zPU6H9juRO>s^a_BE<f$ZM;u^=cC|NlFhifCLQel`+}-~xlbho;?sTU+yPOc==ocOo
z06fHD_dD0S-hPao&An6jyFKs`9Q=yI8ue`H0zUM|@h)D^wnO_fCx60^+aTTR#|+PT
z{g}aOGi&oV{p%)WUwE#jWJvBiKo;NJtYt}KMI2Wt7vdORPNPm6nkcrfg@{Qd*)ew3
z&2YcX&DjPSJAYx?462!tNJJ*uWqrlY&1oyt^5s!>$|2(-hM#!$Y=6Z-H^uT7!~IdJ
zvGV0;wlbw2d=6q}EkCNnnxO4z@^-jvd7-UZMZ|X6s>jy;Ca&ihZ#(5_rP5DKX0tKW
zcyvW>W9%n$3r@MRwUF-^(W0*eGfTq|f_O|iWEZ7E2;-6l4hrxZGZ#E;l8PfNJmKIf
zpJ-WBi~SQEaKYh%u4qU$;*@S)_bVT`svKk>oP&(CihziaZ~+OgjABX{d|c?@!U$oc
zDDD1LSh$Ab01xuuu9Nvi3qAmORcOM*>mm$I@k#lUXR4>c3kpjBP!fY0FiD*@5_v;w
z{Fr>i@m#EiGBpsZzkjV#4?b{o>m`R2(9c40`nHSLo?yq_!TrnFKYM6qbhB~|GWqGB
z&nPkJegSorF;xH78W@EJyvrT|Bk>uwSKtg!0Utpd1n!-^BF@nYfBqB3WTc7`{owoO
zxj`6u;1vzR-}%<peR5Aakfv{HMm7w>DR6!;=h6y(f8`Z^1~G<1@PX~jkjU%nz;(7$
zd9MfU?S6h3J8$~ezx*6l&TGXW%-O}j-~RSj+ev(eV|j%AU{GeKBQRs<CYBBN-f0&n
ziQ(>o@1Gm}raQt{{_YCb=N<2Kr}z;&RH_Ou2y&_!zz#k9$Z+5L?wRlYebi$f>sai<
zWY;EeZ!@?7zqd13V_kXBe>ge;gD`NfopuTrnel#ZPV-}9ZDSD+D3L8a#=$eR`C(V`
zAjV)wP*yGhi}bJmzpvUZ($AYA^Lmfw+-Mz*0DX3Lr*NgULq4n~oUOLm#&-{cgRwFN
zc7&h(-S32b%~0M8uJN`V{P>CEPW+(nu)X|OzX}(ecV4dFUNpL;^I&<Mb>qGFZ`=J2
ztX{P$9P#pl-OtXYjqSYW+t_a271q9GJm$P(4d0H~;pc0oeKl|a7@co(o7?(*fB_Z2
zNXvtW)QC*{*G`Xl@B`@VJKy|zc<u`iGGp>qJ`ZAU^4{a#<>|B&Xy4|xw+ZW7UEOfq
zb#4%LISu2VcCIiy*I$1F+j)PCy$SFw-)YQl<Md4A=6b%|>iL0AUq8iqz9xH+1znEV
z;9=3_M)QL6%c&pn9lP7;UdJv<)dJ9#d?XpeVs&(C?$D{ba)%w+%cvof&qXv@I*F6*
z%$&8InsaOIV{FzRu*){Ck&vNV8OxAyNE%iyGiSR|c*V3C1g$Tgvc52Ij6_!EwYCOp
z-aOObNjq&WAx6MPdhJ64ZeBO1O(T+y4a?Q$Kf+@^)X3}WV6PO5%V}ALVfAfw?i;*H
zS~DV=w+n9waVI+Kc$c|L;~2IW1Glx7w%dk67kLwG*&cBz28(cPmbgrwiNlpGl6Wea
zcwFp~0O>_s7AV4#E1J+D4!(^>6aDaq9vA84NqLbMP#i87^ps}a#;#ot*bfL|DuGi0
zhyy5;@E|Nfh?hTQhQSsf4q>HC(NKXz7Z<t!xB_UaAmB(g@f3gPIsg9ZSmYP6Yj>_X
z7H;541K)v~h^5M(G&vWxJhXxSN<b4~;NZ-x;xwQ?3cazYb0$-Wqy@OzXz$#EVNh;p
zYf=N>Ia`Q(FEJRY3BvBPGABslT9n170ky)U`<}=`vg1&&+2+x(s&FrN%PqHdl%M!f
z1)6rmlHYLsb$$l#7F%u=II^J#*ZjF*+$Amj7#RIf1hf}5c+E8!oSOmT83tkD-_3Xl
z4t~Yq^0v5lx$71lx8>H`xceu2C7(ectt*Vc#gF2(5E>$4%dMkMe*4?s_)!22QgJ-`
z$&Y^EA8EVWmRs6bV6w40FcmP%aMpLv2+z0UH`p=x*vCIHU?A2x%U?hJw4Ce~X21h}
z_LJ6+soik>^=>HM!gz79qJ^h`al*$48~Xr^huz@ntFG#n+&1l;v%VWn``@pGM?L0o
z;n8+103R%32egdAWMU^YasV6=!PO4f5esOyE&dB_Cv*|6GlOM6fbsc%?abb%*as0g
z0)Y#_K+1>gKK%aobv)LiANrfvNBVT8?$x$aUckrSp8JA>!XEd(zZ+2%-|RN(sX4wm
zMBCu(WFCg}3)fzAO$+Luv-=i#c@V=x8g?`9Z^uaRp+P=4*a?`=yzltq>?4-(hzK3S
z0Y3GE9yuPPxt<^IyO`V2R6WP~`5!+9q_uv|2p|5yaP`xU_t@gH_Mh|T=3Hc;dz?Ob
zT&1Izsh)SIeiY8tbMMt`R1e+OADP+S<+aVWVU3B6;f{w`T&$NS9x|DIr!a<K8)$u<
zH_cca+n|3pAr6F1#fis3G(|1yz<jzJ^7L~j)8dy|BLdg;ZtaMjwe6tM4U%g(psqOr
zl6o%%jEtX2Y;?JYxF7gF5B^Tlmc)4=@!_d^e4va?$SyhdOH~w|8n#E-B~k1uy8w{E
z<KjjmA90+HfNH!6m<tUq;?+q)2Yi4y@q-V3;VDh&%IC$+aN$F|_(4NJesD>1z;K#E
znh8VzW)KvB!<EKMK;pqIGNN$sB2V1b5@{eDxa7kXP2pRVE1Nvf<x&BZ*P?O-K?mgv
zm$VwB0lP_6sfrr4O9iDeaFhCtnnsRVs0F|ey$uZW$`rZy(_@?DxS@UsI-O*u&hrm6
z*eL3|vF0-ZcVbY8XVBH;jU>wDJB2z7!iDU0u+~7WfiY`91OI%*NDWZ;wGX!azf&6@
zbW3S&v)y*##1DPcqd0$-SGD<A+&b&7n;#pI;$x(}z3plQ{$U?wD+PLthyPAq-9Pqi
zZ}uI*?f71A#%ka{_NqRxt{rhugkkksq*n~H%M;jSlg)grZ(ek-&38TXK|2g1ae~mQ
z0CtjM_~l55M?Lm&wgdA&ZcOE4ZX72e@Vc^(gK0Ol;&EeL#aH?N@sEF|N$!uYXCgzk
zQ0`$6#!xya{Pl*v`tb<Ax82dZ?6#ZB`SMr3D!lml2l%d1=urj%=g<Dq%GeH8nN9%h
zj&6rT+=hjZ(sjZk{$n5hpr2Q~>+XAmd)jX6op;^UjkJ$612)z3-s6t#mc45l=Qj(k
zvK`z2yLM0bz(@Rn$M0;nJP%!{Puk6quYG;Xht`z8ovRP7`3~Q2eZwEr@FBuoce`(R
z+!LSFE{n&p<2HRzLnOO*1^>D+ww1TO^WA>r!{7e;S33&gD}D?F{-^Kztgz!f?<I71
z&pqd?aLL6NhCS?z;T<du889O6V#j^F<?Y9Y7wo@Zb3NM!5r6sf4)wfR>rAU3J67ad
z-#9&Z{n#$?M*Te27E){TUCd3w)PV`tfc1C9F0aD*@PsR4jN(xb*2$$%2sV;fxA0b@
zoiS|3Nbu1)#ur~RHIOFHXXRlnG&?(EYcM-H!v5GPyv)umcVMk#SFt%xUO^^MqPES)
z6rQ#rTXXu65Y}!?(^2J|2SHw&cT@uKH`3ldd(3GD;ZNJ~wY1TWYiui#8HAZX`D9@b
zV)Mo|UiM!-cqPhS+0L*k`z456gmGouC5#=Ey!b@}9O%j@3_c|y9vs;{iQ^(K7kL0&
z!r%+nyg7YnNN&=>6aOa76%E1?g3Mx!UxF)MMC7VKxLg9^;|dT2p#bu8Nnr5Ek6g+F
zF6rVyJeLYie$wPZUo_2I0~&C{>m;axNsbSiRz=iO4LvnL<8HpKdS-Ei`5lQ6chUM8
zQ`};ad4CN1z=}6&{Gb7Y6AaeaPF;V^q>udbN8w4Vabu!mgB9ZyE^#%~8mKiee+`VX
z8yBzn+_oG~!1<qdzsC;#Avs~iv;Y7=07*naRH&Woc!x_azNn?(&p+_R`Rn&O&y@2^
zIX`r_-S6vZ?68SbkhNh)Gs<jut6Mpp-(B(B7J7q5Xp*gb%?8vMd*u~ZDA{)>{qTbG
z^DrKE9%8`0(axm>kZbRUJ;HaAZm_|IX8dXx9H(s|_=(SaF|1>|AK!HJtHZA@yVUdK
zKXjIZKmq@X|GPZ!p*(gtZ-4h4tPXyeQ{&hR3}gUDXRuK9MT>>KfA*Bd&)4i|g{SYk
zpTDmE>;s<X3ExO|2NQvAFf#7C`|e3yIjS4&R99D8odTSfEZ|J%OD?)7Ti7qNGi2|q
zBm`>sOYrdlz4sme?(nvE9q)$17rgi-;R7ce@02;}0s}ZZQg3H^`_T_BXyS-rk#nSP
z$&ShRL$dpwbBTZUlOH$X-y{2IT~lP60Og1FzwF2nK90u44(2x=^LE>feLpuow#n94
z6uX%Ds2_k4^;=*6n)~l}|Gm6zaKyr4hrA@LSrd)y7-Xkc6qhKLB^k7-k+d(+PU_E`
z{7L(8;wes_pKZ3?F88<dY;S#n9-b(D+wHe^FX#PYEM}K3=l=r7y!rKJ)W6LA{Ot40
z{c=AZK48Zi1MC$3j-5};1?+3*WOEF~=6AfKpXtn5=6O9^eg5c&9qKvz*kYr8Zfvff
zx4bRZ&o1#^a%PL|NB3V+|BI!F6pemAh560jQwsh2n>jb%Q~gt!4<?*t4p4rU`{Mz|
z9BQHgaR+B3ocOZMB=kSCGkkc?&gY$45mu~N>0?)<mEcd1mj|CSGn`LrJLs&B#i+O3
z-UiJ~!u~B64Bc8UO_1mlEeb6sH>G=k_M@W^%`|2D=Am5?mMu@)TrqX{F!jj13d4W-
zJH3&e9l^8KrdG$&8NX^v)X<6dof;b&(N*~<mh6wRHBzC(;}VCfPK<cjFwN`f#OWeV
z2H<EAX>^FtP+svOA9%O`uK0_$;*>62!r-*aPnsvVr|=`fM8gaM5|%K4%gjy8$s<Ua
ziWd0H?!c#@gt?Rtzd(5i6Ay0`qdewye>?u7nHC!S8YVyk?8@{GDQ%(?AlIT3A-$Uh
zDqP$dRsNt6g`nDb#U%FMHiX#IM1MtTAQ|U}>>YzG&;(Q2Yc2{eTvy#<>Mq>U)RNa4
zs6qowia+q)_xM?D(8mz>lzpD=A2h=lx`%!I?C>LB6Lz-`l>vN=iZed}9Z9hM1{;JY
zKW!h6<A;3vJmXm&{^vjc5!e+t3b_38Ux%x%{GGFU>=T~s#$WN>+KgWx`_$*dhd%Zx
z-{DF8dEYxbaE3BQwu9{qU5tE!{hsq&Gf>^h($@D6m=T|TJPadlFX)EPnZ@kp1)j0r
zb9})pdiy-{*)BVEbNZ>LW;>T`0cGKKLl}m{@11?NXUCX)qn*{tIjSjq<7=mTkX@gA
zbWMP9^{G#PrU%J)-uKRN{|z@>??yQSd>m}O_1E*oJ?Fzd?U@muG#1QdFY-Am;=AAe
z7UcaHjC<{LANR9hKhw_r1@^RaWz*fx>zbkeJ@5Z;IPoJN3r~LP(;bI1p!K1$17Cb_
z{y{Sm*-g!d?D~P-_t+!6^Z56M<KFvz`{>~Yo`r`Wd{_?n&wp-qx7QEt>vkJ&?Dy6#
zyX_v>x%<J7eInoO%Lm_dt}jP`0K9h1!wJFTpY#;Fzt&YScW+7_W~3j9BfpIO=tw}D
z=Lm^z@caW`<VITIVEBE+qaNeI^UjIwZKI8%oJ6j>Ze#Z_26)bMPJss!?>z2=aO`{D
z7kKa_xXN}u3vRyoW;Yn0X-A;|dp_U+R?nL$*?3UT9||Xa_@jBBL*E45<4)*QKk+`x
ziPWA2tbuxwG!d0YHKbPup%}x~*c&6ath(98+Eq4&rDlu{nZ_KA5t|2aJcwn$<w$`Q
z)(6KUFc!dW=P~O~?3owHsLR+L^}5>I18=MN$I{zPXhdKHu0Lou!+#k-QMe*aZjSii
z#M@CB3?`C>_s6P5Tp4olbF&NZ%l@cN0Gv_SKarsme{84}qMiMfd@i7SlApA|L=&cP
zvQ`sD5fn~^Hm@^+p&+)Bhy$MT;TN6+B#&!5!vmL#I0^?Zx#rFJldgQY(BqO^(5PYD
z8nBv4&*G~qrN0Vkza;LS*XAVtRJR9K<E^Od$(rhf^M#f#v)iqtfkSdYpBt19_AuGt
z?w+&PWY`_dV`}jiepN1fn7H`>PP?@7Gl)esAmKs;y2cdf{%WW-uy{3~J9W^0<MQA9
zI=tuI?+gdO{7^Ietsh?cvP1n+pCFB0ckQ*|zuxe=yf3}r{PV)M?ITm1`}(4nzRZkw
zPYTyvcWu~etF7(BQn&R9|B3H;SK*9YQ5()}XM~)wMcljJaZEV={T~TC?0B#6$y2@*
zF1z&SW(eFQ+<k`~e4_qaE9(X4pX<yyuk@ske87yshlfW#=J8=?dwreP^Y5_v9mCzW
z*wS&{cl@#TQMonNPcQS2&;9vNf3%OE-8mfi;zPW=7um<@PI&j*+ZKk8)pf$>qjw*C
z-*MqpN4-8gXzz#FF3X*L$1+A}=mY=z<u8PbF8YxV64WURs<}Da(PCo-i;lHx8+{tP
zRv-3=M|!^R*s%cGQR)%)!$<yzf8?Vd8xDHO!6y3?tgfyLd>o7qfw4GyzwN};@gCGY
zM!Cn>dA|2HgY4(Oa+)7CaJRc{5&poL%NZ=UF_H6R+tr6~=Hq_!LmvpcnxXHu){YK)
z)luQ42R_dY)F*xTL*YKV>>4(=I{L`RPYyr7<YFg(&wJn7jI|ruE?#zt{*T9DT>SV)
zJ``T{+M@$!D1ZF3pEDg_;k$_Mu=(cUH?}jLU9i0X<NAL4KQC;w(MI8upZj9C<iZQX
zZES}!yXt{+&pxvk2~XeB?u%2tbZQGOM(dB*Ik)GYeO8{vM--_8jK3fF?~jK|e}1vG
z;T;3JVX0dT6e;}1K5`e&z?=^6HpA%kR<|7Oa>lp68Gdd%{&%%q{Os7}gL~|9+j-aB
z)9h{iJk0s;Pkh?zogIGEJqvu~{p_bc>3Mid;Kmzobltr64Q~!V{qYaoP``uizGk;~
zYJ|Sh9@g+ciL_(vn2BFl-BA`kWC&b*;m`bG2L6+*-tM!@F0r0ZvU;}i1NXewPHvQs
z_53A|JO4cD=ee<dPWgiEX1DsWoyB?mjOc-s3p1{tY|h%m-rCP%12#^?S#vBI_XyW0
zK;vu5Yc!nUsJ<SKqvM*Ewc%&;O0zcnHUBnZ#ZyzQj%+=#X3mVPYiH~jiFJI;@WoG?
zJPkhM^06rga}GO&8Qb`-%QE|5?Q&b2E%T4eV&EKAyBn7ly78s@RsKd>h?|;-XZ^@-
zYu{1rW~#Xsa<K`GZk^jI0PFe^=PuqC8JDSef4C9ccFFr%x`lZe5o}azz7NZwIv9=o
z2IhuAm{cJA*dB!>qpLbI!sNqMKJf9ANBL5}MSFt+k9^RgaY2VT!lH#sSosNqD;)gL
z0K^j-fZ`oFM#W!c7NVG_5D+B}1FZl7hyzF$V=*BN;6hh<$wQn9VBTE#6o)*j0PqLp
z58WEZqyaim{%V+P4bY)eR~T#?gI<X;+g<MTZE+tVp1)-yZHY{JkYW(C!8?5w4}(J-
ztb62LP{||I>4MTrEo`lU;D+6Up1*%M`^@j!hoY|W$-er$zus^|_|zv(3Z(!2Z+~l2
z*YU@`!;G+R4ZP-kr#s)-k2=`!RvX#}*)9n$d+~w33%4ml#ev`a`m%7)bN34z7s2ku
z2S4QDz9X2|S5N=ySHf$Kc!ixU+c<ml)GvQA9Ci51?P!L}!|iPc;~snN<;LKv%y{*N
z*BlYfJR|N@mDuli>l?#0R#pJRZP73%Jh|QQzx~axg;yMMVEC08$!=xFM$SLQAp8gW
zu-GwgdaZqA>jaU>-MG^xE;8~+^RP1*U@`X1ugBfM9+CW<@a|*7amT*h<o~nFzOxxt
zIY*cChF@{;ivotV6h8jZ59hnPDd%SP5iwr#|CkwTbD&$bsmxTeyE;!B!h^x@!zaGi
zDctc+cM1nQ|Ap>n2kjvTy}&*|_hmO?@3H6ot<K^{*M9Va?}wvad8p~{>YVeLXM8)n
z<&8%N4Dc9N`RLe+l`Fz=?|fT0*LH~a1AKJv^{+m{4VbsO)kfg~58m5%zp~@)bDusr
zeBqSO_CqGeVRzJ3zrWJ&jZfQs^`hrJr^y%$B8JlszV8G-2b=P9R`JS}>x4JH_SN>G
zy&G~`^6+uD54`vIaC3HsG{-LpsCSI5)FHa!++H3KV07&U+}C{U599k5TW;xRgZ|Xc
zGJd(;*VGSy(fzG&dcE(K#$f)?hd<JfW}&}e2Yw37GmbIbGr#j~f1trGY2;yN@maR>
z`<-ulOOEdK{Gu27nZ!J-;7tXt_3eQbM}-`9_+fcHd;J{ssz&`hD5;;%d@6k5bA#1S
zE=29AH83$6V7<8T*NoiDtE}JTSRX%Ebz=0}DhRU1ox*0eG1W64;!I?Y>|rxk+|ae~
z>!h{hy<>dXHyvng%)A35I&&*7-n`QB8Y5lL_7*+IXso@<t3%%%oZY8v?m`EP8(eq%
z$UaJOvss~+9Qz~}ijXo01GwX`e~LeHVtkS8l!G+lb7<E((l}*;2pL6G1V|?i7iK5{
zT>Oel^Wf)kzw%)CMJVFPm-<uTSpg8{B9C10B2L=~z$MJ}*@ryhnJX{8q;b}l#Vu;s
zaOF)SDIXO`=ck2q6H|=9sg;eEFySysM(g=JNAxF{Rw-UD9dw;ngVmdWeA>M|H65QK
zVj<0Og*b25C}qSrzsPq78!dMDFbQ$F=S_Ql8EKn(Wg1;GS&L718+w@^<w?nf!s#L>
z6Uu8_lUcr6s_|)HK6fy$ly9=>X13GtS~vRiBR#u|H?~*eF(}9LgvnLpPPiD?5A|+1
zk=|N9LXrS|IL0g%b$`9#dh5?L4@{5}FGpQ$y4mL8hU+_*84e8NoSlq;4ntfoy7aBR
z@HrL$S^sLrM}KWTm#eu<inhm;CWnnp*~7{sZ5J%YxQop2_qrnw7g|S`y1L!%HV)VR
zC9SLW=-{$b7ejJ7HhGU~{29YsN*g!P1y>wS+sodb%lu+DwhtGsyY4z>@V(aSxf>OB
zLa)EU`rbZ!)mbMx?0DV8jxfOR%7^eU&{qkJ$sC!$dA<M4&c5!(kGTZ*Ek<VyrQTSx
z3>a)Ty7g`Rfd=!8ej(mRoBOU~?xl91HV*%5|MHi1C{1yc>-L*$>N}jSyY@Plw+W#T
z;Qm?H4Enr*&`Acec>P%UZ@$^;$Bt6L2wg*_fn<)mSaj0T!&pSs_jKJ;aHU-rF6^YE
z?%3?uHafO#+qP}nwr$%sJGMGmF;<d4@3(88{8jsO9j>ZpV$3nF+n8&+Wqbj?BALTs
zFr^Q5PzX7q(R^klHof?<gYJ?Nr|-po3;Gg<p;#onKBGP&$a;y4+{i|Kie1&ZttkhF
z%j%L9{}S;pOc}DNh(>>`WMQYF?TGENy0jMICRV>Ucl_IGHor?<OQ$8%qGcgPNQ{b*
zk`ncHe;q<U95w85S&TI8De&BcSGGpiN2)eY;G8(^3Owgdax7=DDz@*G#|^eD=ZWvC
z-aS^wTG6E6B#{7&!9tlgZP7tu?D$7=DG)V=yXv~o2}CdE=UZb8G6LOeaxVPaJgHwL
zRY}mCNaw-uS|L#}7Frk~+MuKqvw-|yL<6+Hl<qIu(IaxaemQOoU%ImhGCD{daI!da
z=s0`J7YIFrzb;olQ2iRQg4gQc1{EkxJ}Zrq8Id-X6Tzy+x%0;-T&Gw9;I$Otn1bdD
zcs*wV?x`jad&C&|T*hC+KZoaHqbO7`njye++a8%QV>r#MECLzDv80ArGk{f{s<y>K
zxJ^w@$!!M^b{2QfB*GPEROBdkt{fQ$D~h!GaPE0*jCaH_C%PukCO$p`1lnYe$*Rj{
zteUj3%sFE`myB2AKflZC%tjk#eJ^Ocpl_}0eGMjMc2r&)zBej1NW<!-0YMIGq5F-m
zD-Vz>{wwl4?XZ>2BN2Hs4j5+ph81TiV*teb%!Pa{8OG4qTr2hnaVI11T|-9v(-yZa
zR3p)Si%}%5IyYocBMLEMTJ|9Z%Q1q<jqz@eVeE;u&#0r%!Z%DNMXu4mG$zYKx~8O?
z?ZHf)YwFUmeVMz?xogg4DyA3T3$urp5xmMO;sh8x`%z~8RibWFDS&M=zp?16@d!KF
zt?wm5AU!U0p7OkKZ=DAeIE*sdUo|Tws()ZXFnk%oY+&zjj`}jmctJp;t$nwcfO_2&
z40<;y=leP#<Qt$I16#b$IWAwt5Mc<N$Rrref{9$03mbYDB!!&@E}tp#=O+}#Z#sYi
z=I1ym=ZOoSgZ6kJ4BSf+0&k(sPApKO%HSv5IAV5Uev(C?U_GUc0)%tiBb_~0kBG{;
zJt31!rvz~g%1uAf42}X3&oc&d$@qZ@2d{)i?I{&5<}W|_HFrTi?5yhw>blgISZ&)I
z#(;@oB46l__2XEX*;I`=BT6IWN>eQ>{RB&YFB)piQ{VdR##8S}LbV?$R3w(T2;T!J
z@K~hcI|Kzx6s5mK3m5b0@)Q+)9mxL;;lEO_L*6@d;A`9WB8na`c{i%VPPst(uqbZb
zp7dKK&D{S>2v=dAVAX%Kv*cXOT`qRa-fUuF$&a+NM2xCD(-kDEgH(yDsyHat7*VO)
zClYfQt;zM8q<zF#>!FkAVofzO43540z8Sa^FYxADbg`9P*Gx}b6vr>XQnwPjPp;W2
z^qy04`K?Y<0j&L!@|av`sxaIGeXBoEGv#&NtbYu?WYtJi2;nu_^RfP`5ZF==&`5aw
zxkY2LCxfo%*EY`hMdb)q%fpdh%>0zE?<(6mrkdGNtCe(@UO0Le+~C0}DQu)a8YWe+
z!ZGfDov0PWLASvd0o4!CBEJ_BV-ZHtzC)rX92eqrl`9d#4`KrNn+H{S&nI|O!u#Gi
zNZ=i02Y5B&n~XwWsSPhhSNI!4h_xG%Xckk$r8)CU3Yr5X0mae_sYLxLG)%D6e9nL}
zg9A$n39yl@tszT7Qb4*h6ICsng$aGyut0IzEi4PA>{5Rc84K{t-G&V?Wkid=*LMO%
zUW3z@z?97`H*k1dFU!*#IYp}k@huys4IJ&8hiX7-8<Fy;4zys%KuXRcyB5_GHeFg>
zGs*lYwDnpjU$Xjd#JmRdpHttL!1V(8W9ceBB=?vfhSvnMgk);zko$a|>)V*+npm0|
zvO=WxuvCMLqUJ8Femu|ha$WG0F961Gio{M$W*iMdy1%`A&E4ucQzRh<SIJv@1a@Ro
zM>zqUbt8a<KTDwso5Cojd!9Al(rzn*=3$WaXf1m;>Q7-q%YctEFO?FS<`E^cAfqp;
zK@ufWl#Bi;RXrmyN<_=pl{HIut<Dq@^6#)=cnO1O!6#YnLfGE#=ZR#6bVgfG&RRw@
zGq^BfRHh*da!C{vyMqf}1I06|zN??%f3`lRzem2)w>s|L=p?(aX+~ojr3%F{gDtd1
zD2;YQEQ8vAdj*Y*z0OCsg|L}3QVm_F^G5s{krWyg&8|dzCl1w$Ccg+b_9D?G@YY^z
z&<p&==K#S<+*f(UQPk&m)Oepqgt`v%azp6Wh1A#;-A69|`p^VY6od(kEi6g7(9|XT
zVxro2fnu3w{91#VYoOlWFg0?jFkr;woyY_9OtPZz7Xq+TF&ABD$eWe_^jtslk&d9J
zgQs>u|76OD@Tll;>LyxRzo$0Ef`Uv+FGSFSpK4KI=ZB|KJZHW^*&e<q_3h*(l@QHh
zDs179Qm;E?ye(}>^6?}l>_@x$lT(lfxX#HLi=0D6-=Cx*D0c0v^oAgh8X0s=R9-o}
z!>Q6u`qpfKgtC)vCiZP=`lHH4P^6CvTBd|n@4ry0mj^MWMP<^61vhljJ}UGNG-rL9
z2x_>IK#JCkziGYplF{{_oP1B@_)^%YnNBJAhCm%tm<bct<d7Zz45lJh<oXD8r=Yt(
zYp76*{+SDBnWOv%E8{9w{*h|L<(X?QXI}TS?*rAtA&&woi)eN=BX!qwnbH>oh8b*|
zl*1RMw%5@;rhKP|V=SQtv)|`gkr>x~H5FvTtmq~(;zLHe0pTKhZf4gEtPr#76iL23
zAK~k2D}{xuBL+Tf=N6RHG41q@9Ux}sMluOl{fKcoqnsLE3F*mVif980;e~Za&b`*C
zC)WjvVktG7d`7Ad+>GZAztg*HBTe>8?K8e*fBryB0R9#!my5y=td4pO<k---YD&}n
zavB)S_%vcN#rLwRjf4FEV-f<?JSXwFUxLz3h!FrH9^=%UCpLXT>KRessBzT(l;8sp
zM`4T(!7A$aY#~UxFZ0U~cpz|h=r9ULaj<(4_;dzk-&c)6)@dOyiY;o4xSP<1crjr^
z3zO*};E~A$3@Q(kwmXHD^dCt9Pqiq7vyfmC%$SSS^_Wz1@(J9Yn)VsR=F+xANr$uU
zGH<h_*hupce5%p2rc2k!T<;~_lPilR_!D{~du+*88s@h>l>!rP0TErRU90aLH!NLZ
zCiT>7$*Fmac%iMmLJ>0d%O6w%v=>B+AU?Pw0A9k@v1WQ~5sCfHzecfvRqn;lgi5)0
z0!aW4VHGV!+MGsB+5(0|_STpOi~~m2Ar16*(*rEIRHJwkw-lddGi9Hg;*m!ul54_3
zR-4l~p;Zf*m#28pF?Wh(`Bq3}tp=48nVwSieeCgnQ)HAz<Qu3h^I#WW_m1Y%GsL2&
z0>_<~qGK+|90n9tsYP4d<o_tx4vTBpRks+CmrT{O8jG-;yLFjM0Kx4lFXrUmX(lvT
zrru)}HP@*Q(*7myV<(NQOYX(SqK2Cfp&0m+oxd^tX7Xn?QL;!K>7-5&_J%L0lr={}
z5a-<Els(FB=YNCoIu$wkKS_TS{rNPNF6;dhGjG1a@%00a++5Q@TJ)EaBOTduaD#@S
z-*N){V)WvGKtwi<G`0a9KOIYQU3#s%Oz1Bs3kLyRy218AVpzO~J$mnZQT{X3ahj8M
zqF_Dg5r2mNw_}(n;H>zn#CHxqw9->fW1BXKCjJWjjxr@3!Fx_Y^wXhG=T}ZD3kpZn
zK|6?Muj><oJIJf>l=wU-9d!NMgO1EjgPIZ%%ZT817bK3bI~Db|>X3u4@-~IF%k`M4
z`iCK^X@At?ZfVbS+zh5u1#DFDb*w@X>*YRc{^~lDm+`T}&^-1Y-E#<1GJ3islH0s)
z<jA<DSNRxxDbUC+*(bOklj)Et-64}NdQcU46cPXVqLpWGvs~l9A-Fwk3OZj56TTzj
z9dNbwi8TlLB@kRBj<z%h<4xGQ@5dClp&aJ8=ILk?tC@CARy4Rk>j#a{hJ|ANGzL*4
z`j|FGLzPyh;p878-<hCh2u2!xTR|H5PK@AP-PQXofJw5S#!^j*J$i_jzJRe<3>cia
zC<+Bk;>%0VEaSJ$jf)*_Ql@lwMNC$6bqdU^B3@XvW<O0unDK9P4$BBo#DA5iNaB9*
ztr0c|7WF7wP|5*&5eTPXwq^5~;^B1wk3UK>^rQ6|Pz4yttDVCU=OFkQ$Sr*t6}}&B
zT!n%21t2d4Ro$rOB|7tHbiVc@dG5!Aw8tU%;)jOPA6pt=u0l>uVnKGLf>;4F{H^r^
zM{PR7AbKz*(aGUaOkQOtL1CE$=`-;-Az4Kj+T&8@Cc3tAuxVRRaMo7VA|~OYE9Dki
zG+V-Bagh}ENuy)igX!EaM^UY_wWdi+nxjORr}OpA+A2C2R4wqU*k{E7)qSKH@3ath
z6{)(U<#`pUQgz6vH$tThq>@L6S#h?!t&fSO=?@2Bi|UaElY(_HEK0GD=zbv!@mx<!
z03$oh&>9^yI6}B1NpHHQmhG3;2pQee_<_y#omd0kef-~;qU<T*z0Tp4c32Ku>YUKJ
z{G_z4pe->F%E7vYmN`iWBRSp{(k`FtTI^?PYxk^k#0Tn=>6~=oRZtnCoP8aEqR@_S
zI1$xpt1q4wo6&>Xym;taSD2AwTMW$13+t1%2GN5{OIPM6MJBGn;GqVv!Tf(~aXy4T
zM+=+sI0H|>rXet&%}%E=XE0$x<B@ZZ?8@ubb&-eRb*;f|e!2DEuxlQR1GG-rEiChV
zqgzag4#jKGs3*O^Fg<#Bx_C+qyu~U*eczKCsG2Vz1mIYRtWz?(F>rozTpyIf-Z^w|
zGN&>4OF{kEZYB=Ef7x`9PREg{>A|HR`6cFv654AE{_RDZo4d%}ff2`#|A!sM_qPuR
zNb#Z(&E%EhL@q%hcx$u_V9*~ZWJCX;Bgnn0Dv=_)GmwVNhoaF6Hu9m-_}FTLbdOmI
z06VhT+bc3{e5y!zmazsUb}V}782Fu_&$$qzWShVMdHK|ol?}Q@_KUY%bys7qivlwQ
zYsH($hAzm0w<Cjnh0~}eKojggP)NB3bQFWfIl7KTb*3SuS1!<|`mnsfU0Kl^C5&-I
zRDc=PN^&c+Ew<uY{L25YTSOCVVIFJl)C8_^5N?RcEn1Jy^D^Y{5z~tC=N2zE&htTM
z9IGB>s0?*wosve{20o<4>c8lFO(mv(^lfn+tHf4LUG_$r=XM}kwCkOihkQ<0dd&1P
zU|H4)?My}ben*h;RnUanWuY42zSfyc{~WEsox`EhfW;_K<9T<3a@_5dJ}*gRX)JUH
z!n@rbo#u$A{sL?vsGvWz5iyho{ey?l;2337e(>Cd*Mg(sN;$q2Cy{v{3?w*;gC!&M
zYWtfXAd~BkGn)8F!1b``vvc_IE87cMIG9DLAV*pYKNoVmIr~|nK}3u4P)EQKz+yTz
zRsD@IA?_v2J=O0&pO+`=7>`kWxNMsJt0$(ZkRh<1B>@C9HJF-R!xVo+vWs%tk+W@t
z*I8&NomSJJWIIve=*(b3RBNnZs}Ez}ex~^jy;=Pmp%U=%Y|(zB1zi*;lCgN3*@BCk
z@N(+BY#9_BQ#2=^V~B3<U#c!vfFJouEC<+D!PMD^!HEO8BPPN0;f%ia*g@vewRBb7
z=m?1>_0<p=CXSV1A2++sdeU{_qHj=-3RB)`Q@2{NX>*rUOEc!hmj8-xi+M%N0CHnG
z`E$U-F7YAgs%~2r?Q4D~Ks$ut>WQ?8hb>kFGYrvd59aW5%siOKdU_-oVXsaLgHd$x
ze88oX>E@WL;nZypR^P0TL@T6k5BAzR2G!(jPmOJ1UP>o((7Bd>06&`?m0aKV?+){;
zfy^4OHTz^%6XH{+9MN@Dw*M4{Z*8-)T+5VJ|5hFXOS#@pl%37}On5NGmUzt=-8L`&
z%xZCvS;^@3&HPaQt>{&eE`xFRx4s-A4ZZA}MZA7l301RBJg?n*2rWY)=(En5)GEGN
ziQlK<tF<mWnK@4QUHnVTVNXB`<c6EZs1`ZJKPtZ+ktAvG#Q?mV!4SF^8WIoi|9}y>
zWl{KUEzc@IRixyGBZTLdB=8li_ioFQUC(%O(%ejSIFTfK>!o(}Qf{HC>)w=Gxz?Sh
zHM&9GmX-cuGHzg(f;C`8yYVi@O&)Mf_8>mW{r9P;Soq@&-V9Y@N|We3MyVugH>=!I
zxraX;wMRck^E{1oT#R<ojfhNjXP%6yr(bfFTU%!vGMYrG`H5Qs{?~%??d&OI&zsk`
zd*P)t=BP^Gls@#BmvMLP2d+`~2uzJJM_0A-?pqtU!k%7kLvCVvJJ`&qTNR27)yLRP
zl^wRJo0{2F-`kDl--mC>inAca)M5twNhQK#G>37M+PhYC+=%PCrl6?x%b^ncvZdeT
z3AxNu`IQb3aHh|AHwzBH%48~f0Zvkta>IX2F_}t7Mkjy`(LRY$<w~`RZ%_{m(c@4U
zybg?gc2GqnVT(vT(EMR1iAsBc39ARrhm{!<PK#jn(|b>X{QsRoDh3CN@NVr%DBe+x
z1=2jagJFE`g9xxZhBWhtK9S?*;UE^^?dkZ>W5O?rI2k5a7_hsz*`tHPw-9hLJJp}L
zh@B5?@eJwJEjfQ|!AoC_qiSE2TclpmH340yB{qpEaodW3?y@5bORXahQA1c$F;q0e
z&b$l_o3tLZ0iAJ*z}O081ji^ge-8cX6@P0o|31hd8dZ2Q%4CaK-55i&w3<7e*^pNu
zwU|&B+G)jQMS6HRbNv%MtIiu9Y3Wl4VGV5agDfQ68(i7lUkoLb_{~cpfCa9DI}MHz
zb+5&L4A?Df@d~Idq2o1-4f3hP?};1;cV~@0+J=lqOT!AZ28DmSRk5}hnO=fKt#*~B
zN<X>{VpwCCR(cmK`YkC`6@yAvWZ<OK!Iu3RWST{3+#y~$=2<RO`Bo(@uK(4er@(YL
zWBk*$zZzy8GN83MWH1t~0;n813-!x>W2f8Rg=;2%+Zf^SterEPVq|?o>G53-uXkFn
zTXFgt7Y%J1|DAxIWwN@4_StY`w#o=>x;J~fPU6otYPqjM9&&6IksQT{+QyEAOSwd~
z`Q_ng1{;ll3$<k{Drp>~iI)L8RF-X;!p)1>38enw{*4vA0opJ|qdH-3vpY1YX-y*&
zNhNoITVRuD(`^@1fMpd8zJNyKC?|gtiz=6-aC|V1Sc1Y}7~Zi7ApKxanhfMRlNMuo
zFN0`2cS&UOoDSnj>@--$Ar#<)1OoC91n~RD8vPLXzYj*@-9btRG4hCb1~L6bs!;r{
zUqWJo$q@{`<?aFI5*2(b1856~<>q>UAeOr27kF88T~vv06Mu|<(7z)%K!79n5j7@T
zrTho(djpXw42|<zwZ?VS4u?FM3qwOuXG`wO%^ma81jY0$U1_M(>MA;$eHhKPmx00B
zE>WWHhjW45)2aoZZ9B>=5tZv{;aTs4LN)WIJmmps0@W*vXNF^Y^OKf^gr*d6EheXR
zVEXs!xZwsjF|NWx5P`F2BW>(Bl|Cq>r2FfM1&?L*zb&=j*gW5Bj0uYgo-zc3k@9pA
z%T&cY2H_g@SFBDoj!$iNNS3@v8Kq-5|JQ?eQ<5Ld*s8|V=|QbFbHAuY7@|RXb*ZfC
zt^%7Du}07xR6g6RjEqT^<%zT?m!Ur~g^!K-As)WR=~;v<Lb+1Su!SKub9BGTk&MaZ
zYVX@&jw10G0jdw}ztOEv_s2m&bn`dO9bolM&n#qOB}N)ePd(ll^IG_PH@Y%fBlG{2
z6R+}yCrlc}I9YC;C}+BPMMz}0?FXQs`rOmk4l@)b;WuPS5jc*d?lH)-L^5anqbcJj
zPHRsR17O5q5RDA8gOzboZ+BuFz2^~iqPxB`fC%xl0R<qN=hT_#$L^@AuV`(t9^*m3
z=i{w(%c8o91tMKYi?MUuYv#FOy+;jk6QOEYfbaZ*W5Y_K%=qpd*g2}x92<QX`bMXk
zG1cGA#!6eqPb?i*TLG>in;Wl3atJlZ?wwtxF*&ru)LoDc^=%V^x_qfo<RiKne;}f=
zvO^=LlY`23YWvJ_;jOM=x|+K>)c}<>e*b9_pj~5U5ba-4JpONDj1JsGb;u+_E!v(b
z{E9#8v@OmoYs{DrMBB6%kvSYxQui?_+sa8{k?RygaFe?E+HfUd1z%$;N!BR36(GH;
z&51@w9KFT6R*Ad=LJ-l~t`(A<1n%QMD~i9_VHz|zbuao>_q?{aav*It_34)84y2TX
zk*#mM9dS#NTu1T__Yca}G_B&q19l~2T&5|qa@MDO2Rb~6@zIo@+h@frQ_o%6PpSX1
zCx*e+-L(@Z*m2p38CPG&I%S?-^4XGF91}+PJ!wK0M7r7soQLO;PE{p%W2hyR`*bC?
zZiHnnRaTFV1Gee8hi8{j+@OqFwG!j0QZEMT9iwz!I@*6VDE%;(1}qRPu7gN%6TFw9
zLg(5VkNk>b0HVdg{7-0%2y>g%^DxFoi#>qjL3Wb6BPJ3Q<^Wa@?12o9s0i3Al@1br
z=PU@?54Hz0-bwz741@QL9@-O70>P!*M}MV`o6Pr?np(l_=9ike<OCTNrb;*M7arl8
zHUxtSg25%Q*fIDsJNS~&P;?QIhJa{_*y`pXuh=nZkUxZJ9R$%8L^)NR^K~R9g8Ih+
zs_OG9)vTY0YBkTNqSbmM5(owBrBUtE(1cy%@hTl=ds-Va2xi$NTE{xC`&}OBHj{kw
zH%$LKXd`FQFs$fE@1sZ{laW|n&@Fu%<L}a+@yD0Ka+|4&Waq<8=qiH@x^O+4Fb2&u
za{r@)hx<F|u}GkG8A55Yq6a@C-XLSbf7Qi%m}wLPhtK0W^);HXg<O7Y^}n7{PdE~z
zL}tC<=d$OV5XVtNy4hX|EygEvsnV1L48B@7Er|PtqCcC|F)`Fnq172d>;6ryp1Am1
z2U!d=XGO3h9@zMUhX$vcz-#5`A#PY5yA98$0&XqxS_7UDH(%+e$rM_p1S&KLM+@7K
zzHnyz8WX1~ZfdqDZU%%o{frE$7YE$?z3+Y*ouExrmni^#LoC<v8LC~d{C!}EwmWyH
zIsc0Zc<Oc{g9XSr3*Dgh9*A=7?LY!P2KQov7Zq;_`R5+${iJEtD6zKCj0r)k^M3rQ
zu`wwPcs!`~x56MgNGP4@dNr9(ttRM?ko%AA{)GQGf53oLOz&`1pSF9+!}wa%ci$>r
zegiUSNzv<IcY!ecJbOU`j_K@p$0!9S5uX(Wn;54Cd!;Ise8&h5WlQzvNBK{`PK+`E
zlgYhNQ}eAPealFQ8eOQnHm5Fz`;od5rQ?NkYtX7G3Rg1kG++w32AEO?5KRw-GIvV&
zk40hg(EnU-%oNBov~`8^eh~Q~du;Kpjmees7WVA!R4v2O!e^;v3})MS6Q)eszstFA
zq)a5aqo}G8S7(7dho{LoN(jrM`-EuPqOMdHyl~a9JFGFk*7*N?tOsK(zLV~rpW)Ve
zZZC-Uu&`+7(k)=%+hu7rO|DT;m#Pgz#X1`rDVkmhGKStIw7Um`kLuIGrecPbT@#;n
z%S=9-0uP;d%c=@%3W6C0xt@G5oZ_L4Wl`eJD2keq7uan!IQg)HnxNK97}V`qw26Vj
z#LCTDm98262H>NlIqoHtG%1>iU{7+l8~fBjf{{YL046(GEr<5T48gGOc7OLnD7ofE
z_YGqSH$=ve<HTRajC7``PPa&b&e2VU<Rj|IFyfpbwZTD9?ni_?BZM*#V0xl@z(I&G
zDM^YuH%}>>?R5Hd8AcPq!wC7-c&a3h=6YDo6+`4<)Kh%&rm{Sm_;zd{u~B`1#Fhqj
zNoKGf4yJX#j;&s?i%u$~Vr#hQGxwijx^iMy$hsB;yay&o;>e4*F7{k78wWOx@F2Or
ztSY7B_k|`oVSK^$HYS?gVnw%&FUDKJdae0<EbR0(%Ndq%(IQ|w?3iYwKOjG-1U{5j
zyx*vUN<}kcAJeMXRkisULa1WvdhX#vksc{)29eU^TvM21xvq=lB^y$PdpF;lZ`RJ2
zJklq!hX`<%HW#S5W~KC*>ba=s60vTkDWU_`KY@qsss9MttO+eWby)N}#Xg9wQFMYU
zlE@^$8k)>g&5?GBu&r#4S^I1|HH5ykMMdMDJ^t4ew|r?*VyV#A@m(tDWn=h(>4d<N
z5x=NrBa)Z1Y#nOVYWu_bJ`<@YM{o%&x98It$kAw*-wp;P^^CHR`^QsioqndKoYk#%
zv(xLf`|iv6$CM^IA_J^$g4%<N#0CU1ag4{Gma!}O7h~{jfjU0ozmH?h8?X=Uq9y!l
zTCamz3~Ev+O{Gzwo|WK4$!E)m2156H;W|nfbql?*;h^^wF^g=K6`QRp6PNc`JjNjU
zRq$8^_v1x*ZCww<$5c88Dg8FI_oMWfBKwX4Ao+FAqSzfeK-a*&n^6!0Sd5}AjLBqv
z1j(rf1E$8K^r9Ir0)=?BOETEisDLUU3#dA`x72m6FhYIlaV%%kv@vX!q&jE%Xvcm#
zU<US0Ysk~>>n;VFYPRp+eFUyG>J5wAPvS!(j!Unv@}?ihKM^3EY7P3`#IW|ox3t;W
zP_XIcc{!1HDXj~oGYWF(V(UK8W8e={n)Uu+<BZmA`I6QG{$q^yd{=t38re2oAkZ49
zH11v#oPub?#EtR$4VEp+f?gGFs4*^%gWA`VFqQsNL|Y+@{qeM5tm>nOh{1_~#&pQS
zbW5=M{4eKW9*CjH7u@|&#J|>3WJEKIze-Z2R`(Q^V~aVvBaG!`W(pVK(vw4kq?#TQ
z{#b+)W;1P61lJYfF@)-7(9$WemC!O*IM5ZG6&*Iky+?<_5g6zx$bCY&psz<31|cT(
zBu1&JQ+#0ZHN4)rNjF%rkKt_}fs(I#V4P2ifI+}}7nF4%fS|p<KlUlv4a-zWztcW%
z4$4#tqQG>Cj1n?1f*`J+KIrex7@PrYx8QsgAJeBUs{M}4xC_VUn56bS5K3oxNs42z
zI11o(_>HADL}E$cC9)`Lhu{A(59*bZRF(ycechj@X%^(u^&oKQU6%3aXtH!I1`qfL
z<wo$kZ!0y#!b|W<4hCxSFF8|``Ig7;8|mE7yUjVOu6O6CCy6ru(6a`&0$g>RbfYz8
zZ3-x_y9xc%ByQ1Cq@WvAw%)`sjN2)-;gGI8N^Z}Lld>Nx37t=`3KdQ(*c3`&7YOg?
zQ6WO?4CA&@uj7|Kim47jH;zSy9s%U-u?%~mKMt_6649b{3SIYJ<)zx(qP7Sl$?AT<
z%@&$j#uM+^00GyMnerMr8VBD6-O5#UKE8Ec^@}ks#+?m(7?arxBX%da!$tq|-ttez
z<~WCx-jl5|$YnD0{hrDO)yzFt{h;CUe5GC8BfaD#=Y!3F6YT57$yh6Lfd(n8X!1io
zeq855V~f#rM(;<<9l;FvCD-WTW-J{Ee%eFpN-G;}tsc+SF^=dM0Ol{QlR@5tv37RW
zp3y}$5iWkRv&Poc-{(Jkk|CDW$vd~5clf^6>6TIroHBT+NlqgBGC^Ns^-o}zo7Nn@
z8l8uPWp^J;=nfWgy?Gb+doM(-kV?)=mB_<C5;$1l(N{eS3q;sj#j(r=lJMWlfYRav
z7`TIg&=`l|q@CFB_Cemoj${lz{{Os2?1Zb*lNf$sXa*Ij5mMOj`b7yTfH(#n9mIeN
zH(lD@S*(!5IDsdsFcW2+NXNdq0i}dTxZ3abTakr!U&Me8R_S!eZl&hf5J_V*iaH{2
z__UiQqwM+v>1Ymf=MFe%OuDKcXG39~hfxhytLwI<RAdpW=<XbQa+GD&2vvb&Ad;3>
zsIex`hmz9_u?^{QT+9Ev#{6XEhbp$1{kgGPjh+X&o?u0-pqKp?=>aS9z-}B}*B4=E
zHzo~8@ya4z>2e&E$6}rOKLtpdA8-u5)eSZsPOY{^WA;PY%sYb(t%rj@xp`s?)>l<p
z0bx)@!9HX4*UqtrhCB<Gs#?AeDj`<BS4=r<7cNOw38fQH;nYGfkRaF<S9w?PWYIE7
z93b8xUZjA{KQx~6;tu0bc--xg&dCUB?BOpkYPI$QLFjZql0FZdQ8k41IHm{zDsYaG
z`r8rk-^Zk~=SM=neu{OYHZs8^)w<syjzS=)5pdgg1Via~a)Nl5lzH$pd}7Ih+1876
zm2Sw&>5mX@y1udmTwfhwfYs+dWH`*Zfi-n4B8F6Tw=bCgMNNVXeI|};iw{|nmhTbz
zrx4tsn*M@43%%xsR&vLTaLtN*;Ws<WpWT3fwWs=vJ0rUV0ii!>;s@k67pF@4PPWPW
zr(tvwWO{J>gdu=_WXYzfsOnfHzx1!m{|d6U*!tcIYpa*u?l-&8NqZc;5rXWpL1lmX
zNVHhBks)<@9s>MNycm^N>qd3)(+>Bv(a+hOi#J})m9I&8i>-vX;{svs<9|ZvK0%*e
zW#<IgIidMII{r3_KHu0CX4K&L%H!M{pu2lPLQYu|s;%5yk^rj=;&8YMRvDugfkWL2
z-kc;_40+Ba{_Uio^E+zUE-hcWio7f%zS3AoN|5gnT}lx%LUEbSw;Yx77tidk)ka)8
z;#rE0RXk6oQJF2W)bk3LzaU&YWY{5xXFaS|)`xK|RWCK@T>tDhXEA17yK7s&tDavE
z{mn)VD!|FVuAKBnpCLLV&^@X5ERf)i(#&#*3842F3mHOAe#6@XfSSK8-4Y{jt&qz#
zQgDF`tl~xl@M#>t;i)*#be8=|c<5a7^ft;IchJ{z@R0-rd0p)V#or$OEOjr3k*UNM
z?6pvh_=wAsBGM2dn0Mv!mV|>z{_RXBf^z7@z)i9mXMm!veLjo~-2vL@NH}b~sBTGu
z96#PQx2pDaYB4Bk&E$nFQx&q%D1|gR3Ku#T`&=&U+d&UZz(M{tgp0031MEkNu`X=o
z__76f8CaXuB;<QL3tgY~GE@*-3c@4n6H>>*wQggp@z)i}=^;PB$n`j_!7L@?vq$Bg
ze@J;B;g2-EbmMou`ARIye&v7P9wK&rT$5KNK84|H&xYJ6M2r%R3t9+L+y$#9Joyo7
z$?O|QkxzsnO%&b<scBq{k&c;SN!gJj!1BcUX?|f;%lM?`x1UgmS5Q^x|M@7R1;9ph
zT~T`!5>6RLY{jflO)y1IR=ckyK~;-LdVOV26h0^WY<3LFPO-U|EJh|%dTk>vM^xd9
zq8eCJBCgp$nZrkkN!+!}sQy#+b_K5RbDG!{x_p<b9Rs2`?an;iSLbu_c`p9&4%1Dt
zXDhSd(wzul9$N6Rw(Fp<>iZ4XMtmehN>Rr}_J4|F6TFi{5C4lu@CRD(-citG4ub{*
z4ioV`59IKUS?j<IUZU{4kID1S0@jo(NYDjfQROhX>4F0=eUXUZK@bp)f>Q~YW&^1`
z_aY(Ne?lRqp~v4c01GsR#98%MO!PXVp%TS}>U&<yb0S^NxX-1c2W*X-b<1+N6caF*
zn7gzN8lba>hHDh@US_Pp0(YBxxz^G(^i4-~p8*1a$qS%z@_&LXXJ=`j;yPamN^DJ?
z9s4IR&d&OQ&3e&*B_$2q^(7Czwm4NDFba?yv^vnnwQ^c)dHmHxhJ)}PyqCTDXCZuE
z!&=g&qPdA$0gCrppJ;RLcB)^ke=RR>zbEz5l)5g_wSpg4^>)cArIk4aG_DPL9#>(s
ztUFYo*pg8wvDZ2;YjNN`M)v89!lZq~#zX=ZMwR}sOd?J#W$lk<StEagi_BueVskzN
zQFqdF>(77o@wl$i!;T|Jk?2R*wEc)fpnNB|NnKCivR_}GJo|$NgYfU_b2YG-ntvw2
ze%7yz>Y@9_bYhC+JfONs5T50_&b)*0c>|VQK|j97?s!-4<BQvx-}g1%@fk=`o;KPx
zJ+ta>nx5_QI0_mnxgy&3LvcdIxZfD}_tJ2&*|uq(2qmdU9(kPryG59&3pPc17eZd4
zb#G_K@WO2ftJm@*Llo|4uS<fEHl#8hcOjvx0@J^&&B!lFw4CNP$k1xiPB=IRM_aM9
z_-Zs=nsmMxzbv(e)OW}VMJTIa-rdcRhZ*C(kKp_rxM&7lifLO764`#;vy(1E-~SYb
zYV9!pv{s>lQN<34FQ2VP2@<=4GG?3Q%hy#8RKAKx>Wxks1yy9^A0ku6Q~$z1Oa;c%
z<<`v(FV9Z$ZjYPyw=9pFnXEPDZ5y$s8XMK=KZ(l9s9;n?h5iJX@<<6UAAVJ{n`U`F
za-FBSPW1aU9Bwx{UMrQADk@c#sx_Kir6!a5Ss2UoJco5?1E>4VHDuvn41w?`u;)KN
z$SvZ@)-)gLhD+EwGCKv;`lk@{9xy~~u=$^U1YRX{#MRJ;0$?5F!p-Jbupr%`IN<m9
zikU^ZX+nPy(-K@CjouHfEP;o4-TixTzj<BwW^wh({$wp#>sB4`+Xm_j>Y}q#%)F$O
z!(#kXNw6hCbM%i$5j=phc)>RJrW3aOLUB0~Yu_k2wyJjx4h!fI?rG&)Sw*FwP7D-z
zXVQRfYZgb1XHVvjIJ3m9Ln8c%i@I#>YJUP%Wx~7X&#|N|tq9F%q8=mO3(qo<738pr
zpSgz3Q9tMV9>(*uNe(<l=&K@h{V06UwW5{D{veR~ICEtwG439pXt!MC`zri)%ie8F
z8Y4#L()6a`=wrPIx%o_;Cje#0+qqSbu$PZId;(n8(M^NnX1VZ(xqfuNs9l{lGt9y|
zocIvpcpvl|)>Oi-oA2oiZs&^z`@Xj7B8LlhOW*$~Duvp$FN`Lxu|ZHFm(dCo+I(qX
zHk0aZIV_bBuqCoi&Mh{>b9sl;V%mLd!8MX;(mv?;1%Z2P_xeatjqubciWv45g5keW
zIW((Rj{P=~xlH@FK{H{xfHRf0ctT8vePZn$hU<{MG+%hT&WBq5PUZ{?^?9uJW$N7~
z17?Fcoy)UjJkWL1{hdL-cx|}tvbJ)v^tvzC_hpm*0T^RlA~968ZHZDRbClEgS5x-c
zLNriemQCrw&CdOFE0lWu0nb5E-KM*1zg6Q0qv!LgViai@XnOpwhz8U;o}Wx*LZon6
zs8lsWTZCm!is`f*)997oKaN**{9IvL`CrhrcXhL~hdk_9T$cgkUl}@V`R-A>IrR`%
zZBXWzQ0^r1Ch--nQEt86&7NEgqw{Q6;su8enG)j~j^`^&db|ubg>vZucNMW)%{zpg
zcc-o-{oWbRO-|QrGm?Ltn=;-Z<o$)Y_*bG|;v-568xw4E-S?yMHUzRz*#1ib0ejD~
z7~1_fXlio1LlR*OV~@@qKjt6E1To#`0ZeDDErOWBap|(lGP#65W65FRA@(GH1m6=Q
z4FbiyZ$SnbG9bqQ&Q^OFPMqM#Cm|2^wdX$qPUnu|IQD3wf>QpeV&$)cSlbeWcbDl?
zi3f)ZzL=@~dUOXe!As^+<GWW)XfUN?U0WJft8?5Ay06bd;EGul_Tis8`n>Y<0<ML1
zE0RXqBj=5YEI=hwiCD-UnM?{|JO(BCe3SjPS$N4Mwpelryh(hG(c%{W@^+R{|29-y
z{WDED)OJ!u2DRA_T1|t1&%^@UZ~NK^RnG}~dq|QCPLSg>LD5VOB+v1#q<QWNQJCY^
zNt4zA==H6t)xVkwgQu~LkBRnA(Z|5pb@LWTF0M@UP5HefF-S^YUz}5UOf(D1N8qTO
z4F*f{#<br*t!_|7Y=>f?rT`!)XG`(3e0Xc78w=o!r3&y|rX5b$UkcuDsQCkWXrd2$
z&Hgo~j2@tej2LCFP#Zx1qz^+7!}aQ>{lxG5+Bs%$d!^CwdrUFd48vFdPK&jyvX5j7
zxBb|XG1!E{Z}z$XoR{T=etpz^)zLin&XBKzx^WR4LLvO}18&=K60{r>M|^Hs<K!-h
z?w93xH+mbJn~aN?MpIBxF>_2QHPH4|05@(&v5UY6rm9F(v<_dkFfU#k(by46fg%uz
zKSUY|&wQd&Jk!2IS2UXA?FRBOQx(<8aW9)PvL%Z{wb&lgXtj(T*=ikh7^@%85^D__
zMg`oo(skohl9HX49Hszc4wHI0g?a-|@0JxXyG8OwDTP>^qT&GJo8x=64=t8I*(_`^
z@J<9L*tpA3m2)O#2BnXAwHPI(+F#;uop>qszIz?EOL@3+4(*=YWhMElZ*uni5MlVv
zIiaUBE~VX2-#^<c$bcLLoPujhT!IQalhlHQ02p$46y{LX)S#0PGaN)a9_zk6XL(pO
z$hGwUYXRhc%h)_l&$3a@AZDdz+4f(6Tzfh49NyQn&dL@eCoF<klCBW@a!`<^BF?1B
zsKKF1MM3ZL#xoFJq{Rx*R`d`CN*2=<sQuZ1U<AwjoqDSYiKy7+=Ju>W&7aEQMlDme
z1?a=2uxwCY9wy?`UG>$8io=}chZ>E|Zn*SJvP|(ADYjJfF1?SgGPs^RneRVKP<&{{
z1U5ITeZ~pLNTqu+>nH8^vhV3(QFMJsuj&tD14d5Q^yUx{cHHFB?{<y~x$|k^xSi$K
zedc<GF085vONN$jZ^53!=88!`?7;#;z@ZC$p7<Dm_!`l7-oeQ&-|j|NNZ;G!i)!;9
zY_I8hl%dt{IrzeTQjO_Ytk-JF<kk(_F8e(Ju%UL0Tm+#wUbeqZYq<MC6*uH8u75rF
zIsOGF4PI0|L-T#U(ht6*>9U9zmUNSWJF;WwJ@wqS(=_n{^(#Z-Z}2~_PWRucYGL)p
zBirg?KlAJtCkzf{*kSUjx}SI1iM%;j4-&tO;`j(3k}gBPvmOY)jKpG^fv4kbo$h@=
z=h@%XbE+S$vZ#aq$=3X!Z40AW!E=0HG~ACbMf=xnJCf#Ctz)_SdqVJVR<#>k-RvHU
z?rw|4N4V@may&fUOrOWMPs8jcDVxNwT!5qc4|uLn2pIHWvs~ZBJ2gZBgx_x6S5SPg
z&#~>)zd6rt>(5QI!s2){kwpJGbZH<3$#G$MJ~$ZEw5+l5Zo7=x80@I&X>>s0GID6U
zt>{J5baQ!+Cm5)$bWrhh7jiz2{7s^Yl3SqI?H59rDq+>J*fzD$ah@<S0PE1;IC()a
z@$ha&{pf3@_rw7Z`8{pl^w+EO`R==FEdH@xsp~@(7Yntj0~R&bPir&(_IydG9P2fh
z9cvm=lH(@o?J+t7bKT~-V$n~tf1hFZeDK#wYFX9f;s)v${BTBD`TE{?Y&<k+HYWO+
zfXmE7(-})c>kGuRpRHTh`7c4=nJmDKvpu522C@1<(Oy+@qq&|v!^atbK^U$p{72ii
ztdEnf``!-He$R7vZCVJ=(~i^w0?cJ~lWaQgwb0`T)DXFoDYe+<%TmJ%aVYFBuA4@!
zvjY0IzWb-G)G)i=*U>w37m`odbr<&U^~BdA{Eb<7b+_xLBMlB?i-P_+uAQs<>k}16
z%RH>>rXlTU;35_3ZT>XRuh#8Iz)Yz*-R!CWw?B+{C9G}R7fM6f<yX><Cl~kK{KqPt
zL=+pxL%I=|PcCPcaIT15!5gamlLtod8d<lYjfd4l)vKN#E?%<Z)5r5p({p=QecW~g
zSl7RXu*I`d-<N926<7g3wgNj!1RUFLhxGT2({COYALgd`ZPj(_2Ge}%!R_sJNshO+
zmtBFILz8=bX|j9f+t7NyK|&~%c4$;oc81yQ0DA2Yc-^p?RQGXwR67mg)XDs`>jikK
z>#gp8uhZJ=&i6AlyWPNpsQuT5*CbF39ZwH;U_w~ofhu@;5kBz9Y(LbhmJLhzwSt_j
zpTof6K8D?$Nu=&Jm)jTc`q$sk9lKFx#*TgEH~<O()@Rw)R647a&DSrTSjsS8vFoh1
z)%pC{53^Q9uk6N-KEwWK-bm1H0{kp4-kYo&^Q!e7Z@)hvEO=+U=6MG$iP<sAmGNb~
zz!dF$!z^!e{q8gQxw?DI())}Q>x+2e2teP5D$4gB{fa5_k7z5t428TG39tPWucd=j
z;;y-bIF6I7TIQ1%$iV&3?=#{4P4GAZ5U`xp`z0|h`_{<2ExiNFK$zN55w-@CNQyGD
zVCZ^DtlJktSMlL-xYcd;s9FN(k!fV#zwbJI_NO*&BnHuhVHMZ9^xAI-cW;P~zi3MM
z6h0b}{=9Be@VV}os2y4%>jAm=53e+>9^vCE=N9zTIOValpeILw?juwsb2y3GRopo$
zO200Lh4q}iXGU*Q=(VgcrgW}^swXQzs0A2V(2$9-{r?;jby(~@m_3*9{BZoKySxQa
zK)M>rmyBj*kUTU#+g)O>wk_pRvs*Z_o7r-kNO}<SN$PDS#5qhkP)JqL-Z{BYaHd>U
zc6Ci(VMnfZV0qYZQJ?!kLls0RCyPb%$xgWMe~H(jIN;3YoT_~o%&KdUNo{HYvV-{(
z%v}!C;Wx%e<l*azg<xL2I%6jie;WR|P!Rr2giw1K8iXM4^r67q?m3%iYt~<U#20~Z
zagbje@dOcnkmi2xg8+a#D2G@fwEXE~VZ3wmdpz!c*H}M1T~Uv1I-tHJ%Y=o6?x0oP
z&*gqIAd14OH<m2?fZw<2HIcwQxrFkSiI39b3dmHvju&qb^Tep4m3Wy2u^98-QvvIT
zgn}Ec)K}uv$5NwOD;dOzuPG$aklyo~B$pORz{WHmi(dJZ$kS8gt1NPT2!uT0kl}0{
z?_QVdv)Wl33}{*VX9RQGw&TsL?e?g$AB3=jK%VCtO35C%AVk;|m29TY^Z6RN8=Aq)
z3%&cXgD{9~Rc&!b5%K)jE3ZB_wqwWRat7V?!C~mfs*W7@lX&|_YM(_zpDsV+UO&lO
zpcGxpSf3?f6a*1;=?4P$_+Y2oje%q~7y_sIWC7Grbq2nNa+j=+UnHeo-?HIrtd=c2
ziX-%?qz5fQVVKL?!>{d5W;+M-|FWHOC+G!3^Bg;q^YMdszfRWnXV`atmPt^Ge>DL0
zfI3Nk{CfUf+}0oa$x$N1I}4iB@f?eSgd9c3m2Rmw$G$i%xY4tV%<6sGi@5K1H0&QO
z&BA6`cUCMI5c)khj7c#*RZ^OqNNzX<CsSDP8%!lwfRJun+>ry#I(~V`OI{g;<>*h=
zvhY4zmn-ZH!Q)#;24&f{&&s02qx(1hYi6En@B|Lsd`_V@i%D6))pJ}HvEa%#KHT)x
zXpruda^6sf41+@9(LlIblgEnf<faP#E5)g0jLIvD;~LN{ILhLBj=KH3u3*W`em)GP
z)VO&2v}Gq*&}F4A_UgtT@LI6R48yRwD^ZqB81kO9@7DLpr#Kh`U6$jLOQ|^!re-De
zniZ<sql!>vb~p8|!E6Spoon4-!Y3q#B%X6szvNHy2G8}+I8x)s-Ul`oC*4HiPZ8T{
zJIMt$hl9)g&8n~8>)->6C@_@zYunGur2`C<Tw<Gmk2urmpQpO+2`vVb-dBJj>!i~F
zubW?fT>#HxgGc+pTcyNgdFezsHXK_uy%yhyAALW&Uj|`H#XarrjFtFjrXL50k9VCh
zD6=<;U#D*Beje=)-sqC4f%F`_6e@%?<o&__ILd~hgMP^x4SYQ5+d*8t?$X6{U7ScI
z@;UE@p>J(<?lE47S<@lreTFy7^AkuUPWH5>>tS^$q?F)`|Ka#j;o%Vi+;Hmyo2I%f
zy{t=FytR1M=NV;FC1{NOi>v*RBPEmJbBzCms2eYpl7zPVjt)JsUzUSDDjoqG+x=8?
zKOeyutT4;90q8A<qC!tUll9?v+$t3OE{rME-uBx4NCZBeH^sIv9?YB4^-6ze-d)J`
zz1N^l5(jtHp}GqxzW6*mdg?_YR`XJN^#6v=2fifdFuxz(9v#MMsF(2JSS^_(&9K2S
zm&!3Kvz>%Sl8>iU4TD`I&Ooun`bS<1J{mhJJVr=!JU%ofr-=>a9Sa&JupNfs`9v>F
zd~Rsq(9QemOad-zJD8?dN<p(k;jNzj;mTsvZOjYx<`?rFKQPy9ORH@8**;Ko$h<7N
ze`T^U1`JrjSpOz;Q;2=us?=LI>*N0Nde)_e<u;aYKb_?o%&UFLp<JO)t`^l*iHyrT
z>UrMg1Ijqwejia1caLn2Z7uAg#xT_*!)*2=kf;Htgp}uf@vz>X9gM0c9``3``n~s0
zS_a>tYprb8^sY(L`q75AVTr)t{j$sh;B()rT$P=+;=`^fj*!?%O$l2DB%6xbT+H$L
zE!uVOGIt)@Pe-yZtp!O{nm($ON#$GWP*tUL2b$4l7UwMJMhtG4!W2{O-Fm_y%`k`Y
zg(w}P>6f<k_uuE>F=nd_?O?`EUi*TwfrS?eF=h!#>bOoqc|vXd9EjTz!Vrv&rDZ^9
z=DEY(1grg6%8D|g(4l)rZ?%@?CC>GCR;OQY4Emw6ilhHq>*;@qU-B6!GJcTbj+5gu
ztQ-c-IcYuSxvQC1eX`2h8+x8;IOTM@zz{QA+-8y|vWpM}K`HoJkew~`pK~bvUfUf4
z2hpsC#?5mEIY2srfY@Df6KPngPUd~URcot4pHIlx%RDY`7}!|%<>ima!;LzX4Gg3Y
zqSJhlQSTNPlf^8S4?eyHYFbUE#!fZ?sh2D%3SNxy#g|&p{pVV>GPS0|0WI;AIAN{E
zwwS>ogMJOJhG`RTUD}#QgT9egpPJ4s6UrOO7w?V{cN1c$<4$4$a)A;ERz1b^=Jp~L
zNEkWZl)1VM-9LaA9J#c0+T~`wx>$U=V|RKm_;Z<*m(5`^9Z|c3H2Kq8H~rsF|C0{J
z-gCT<!$yjM((F={V_&A9-c1j~lj$53JRF8IM82aB=aGI@2eU5DP1D8(o^v{FQ$&x%
zlt0KaOOAd2gfN6lm)do`l2HckSi2}^Jk*mN5+~x%q|@bf>#29H9I;Laqp`QUx+~ct
z$s0#|zfIWpRkNNmtEU#WV>_JMNb0?=3Hn@}EgYyQn`02i9ABNA<>Abxp{>(@ZTYcN
z?==vMZML(@r&j#F4sFZxW+MMSk#Q_!o2OdNV>`bf?UPcT*_Zhn{uFu7s_awrcUkXh
zgg#tnR2@~vp?iDM!U2mK@py|ElX(sQ;aHu_ppO2-O3EO%gp8&BXP;c^Fntfp>`uv-
ze45vFlU%!yr0B)aC3no>vm75Fc=4@&5r@muI1$~(p#j||uS&OIKwS~O{N9bc2lr{y
zOHW8B_nKr1@O}28SlAKC!V?Q4$BXlRyPKk)zH?n>mXqvoSN_u|vfHpOGO(rxO$0*S
zGsl~Q!nWn?q;VixqWNXh+QdmM+5f`_l`3W+OD);2T8b}q5q?U6P4}(Rj%l}_9pGdn
zTH(`8aC|@3`02wBwzXJ)ILr0R?y>$|*J}d%&X>}0w}G?&0s-Q?WO14Her2^fXHDZ>
z?CY_1-8h>{>dly6XH*a^LMN$*emK9bmWAiG<6xCec4>TI7$EM`lmV7ky@Od~0vA2l
zJI8qmSv|?8(!~~KYLlD)(|AFAXH}U`uw&YbMl}KL(yl&01J<jzKE9-9Ni^5}0V%}=
zPAT*4J&rHe#ODx2W2fjLo0zZdyB=QBb8={|9<ewoVbr}z?_;(5ad-j;J!+;5d8TBV
z+`p%fhUanXlFmmz2PU^vmkrC0r~eBMcHM?ON#pi%PY5!EQnB1<V=@BlZS5x|6~b?h
zdDJS|qD7a)qp2oGcA-}(P}SCP3>uHVDtue0JJscHCEaMyeFE(WhTFI|82`4lHLB&k
z+J*@<BTTwK&<7|*k2bSP7=~+0jzYob5+#UJWf7L!xGIvW@V&o0WhCDb&-Aga-b6&}
zHLq{tf8hE<J@0zCrB^rvCE=<&+L2vah2bfB#<pL|a-H*k@VM{xV3VV7Sfoe-)|O01
zq;ul;lEEMBde7@tO(WdOCk1&Gbj>{0(R1B-qjb#XGD)%8$K3_;geH<hDelQac$_3H
zjq!ZGQUD2GVz9i6qwx`&-NFg7eE5%7O`HDX)cZ>hn%nQ)>vg1J(W;DGto@?UEoNyv
zY;Dg>%1+nIf7^H*{yzZ5KsmpP<m*ts=2a7Ir<ad`;@p=;agE#3f)NSpXOz8Cd@hy6
z?h>qaF&w0QF4249rG8k4miT#-GW=3FxeVoT6d)^PK1RoU<eLRr+iULE`4Go+J~W4n
zL22z9*=*wSu{p*CHe$M&{)2TEzv{tbl)F|>%`u_Yc6C&&V^m$`%7C6n>Mj~mJHh)k
zv`Cv(ynld@jfW;A94MuKj7-Z{HkA&*yn5<Cp$pA)rzB4R;ojIheZn2r-#fmCgJXd5
zG!0%TZ;5CJxc7)2?k&)-B*Z(e{2Uygs{=GWv&82IeQ=ycT4@X}?>!C2Bi!Tjj(e`q
zcbd9gHGy3o+uajKU`l&|!4R%$yfT2c@6<&B(%uxB@vG*5>H%d5M>b<quR3P+hztz5
zokH{lObW07w{}oHl}^KqZGVY)<O5vCX2mAV?5v81@C?6PE$TB&X6n-;JGMN{)N13v
zC!fTl!o+6b&2e9|Xv};sh~xbnH%H-;1{A+oPdTuFb_E_E4r9`mcJTln%AmLb5oCS0
zaabq?<?$yBcM|rop+2%+c1tdlcwb8yRV`GT*J|m3_r`0lhV!Jr#hRL9%x`I-&4j-o
z|HvfCKC?K@<sYlLET9lUiGpGQCDOwW<lPc%w8<u>AUpZAGm>cQuG?2*<TBg1Szi`$
zC^phCU6zU4@32!kD7i=3Km6p=OxZf+y_jzl1f>84hr?_soL66c4dthcDRHQWAN=^I
z;cY3=-h205Q;a&UU*SF0Y$)j+Xb+Qe?ioCcYhhZmlC(@VrV*>SANRs@;lz_pl@jF9
zz_EWUA5l`#hTz%z@4Z_<1*Ps`Qkqb<wgO7IePoIHcz8(4%I(eSaeJk?#g<!Hnbwl>
zeCqq}wUulue3Y6F^XGppzS1{)hwkDnAEzU|Q)Hp(fFC_v9nAZ3p7p`KrSxS(#)0<A
zdp06tznto??3(VE1uu#`(6<*z9%Mf(hT;)rxqVblN~|u+PzZN5D_rQux>YApd!~-A
zz4FgS9aj!mH~J!)z(qRkgVpWEn{1l67fAC2dG)p0T9j8&V5Q$fWA^M>Qgrs_Hqf__
zJHt;q-JbbV(6=_+(3G~xOWkDqTKZk~9>w8o$w#bkQ6_Wc!~lR5vRk%#Jov$;`}!Mh
zkhqEPccrc<2P?q`Q>TWnzWP!YxyQ>5O58{z4t;@-Pj0rwmIXY(x{r;cuhhTW(k|xA
zo)f;5EcxD#eq!<rnNZB#5XwsWAnt|IK;2@=3gDagYi&+q*^jk43KTXtdghet>3DvR
z>j>QIpln}58w1><e0Si3opa@K$APx@p*93I+-M^UDi<GjGWaaM=#op#Iv#obv6Qrt
zhkYXtPd&{^n}sAieC^d&tKvx#u^l&z9m7r>ZW}S%$+~@}PA|C3>#Mdrb;^_i>Qkmn
zwhhHvWL^QG<@f=~QV#{xa$LlY$(k7H>t@F9X!WbpjRgi7alX?r8Oo*-)qt$=7f31G
zb#XVFcP$UTg~=)7-%_om7;BM#@RBQ=ql|}a_Au6EH+r(ATw$Npe(W@OoeKa>2eV4o
z_!(yt9=gh3VF#0180ES~v|`RC!gzL_DdDce)NK-naDD&^WA0u5>6HKtkLzhUp2y|t
z>3iB9rdLMSad`%ZbUZALYu36TWx*p6PGUZ*=N@n(6a;f<@cDTn+`G0a9qwTi)M@y8
zFO*&tWSVf8!jF5;16Njqm<w<Z9cL)_<jeD;+f@T#1cgRGGC7x99nJe-2XFYb4Z7MQ
zJhBlX>`Gv#L^?jORYTbqqo!=ECPEX(IAFtbj_C}_-MZ84>)*Vo<G2%U9;j?0zC_lx
zIPWh2;b|>eF%RBO)JQCPl4HehIA}L{i4@tiH6{u0ZCT88U6N)ZXT?yVS}V$P@6`8}
zX^=HbYx1DHun?yov~=kJ9@M3zO(HdOfK7ocB%L7tqMMWnlB6a}UE#}H`dv3!cR64g
z;ebWNJSis9N*>;^xNwCq3;(aankPj<p~4P@t3xrRs=q6Ctv0X4;+6{I=sgx_C|>b%
zdc=?;bxitqrno4~e`Fqt<5GYk4A&M|d7XLAd1k@qiVOU`&XQ7Tij>Z=^DZ;qELiZZ
zj&=7m{$r(_hH{IFHzrIlpSe2?7!dZ+adup3;OiG<6hLm%)$QY-y-fX~&Nya2K<*Jx
zKAb5F#L2RFyyd1FQdn_Z$Ko>!w2SOwEv7~4OpEyWeUUbqC75}hECmk!1v&PQe@`qR
z0b7Jgrm^8=GCn8QS&)&>T9hMLBM&?26tiIDX!+f@-)iaL*LH1L;7-*h$zoYE(qAe8
zCFNHPv)Bm|hAG-NfX~*sW-S@{g_0Y~R}`R2RK7`*-V)DcrNj6l3oMkipU6^t6DdYf
zF1PBJnv8kBv;@lh>E5G^JjmsbIROer<OPZ}UlcECk@c{`S<uBcj<T{xJWiWQ6Zztn
z*St#09!E{{xfstJFX>xqw+>Un<nXPOh~&@wRf<pTftSaP3w!UszbUu*P^52$8NXBy
zS;&?z`#$?zjVwf&$teyt4-P%z2q|mdHkpg18tsP@2yE^+V7bf*0^C}(rClHsuKx2M
z1MVQ`cW0b+j(h`8maCW>owQw%Tg*RN$t}fqz!Lnti@qbj(r=l?IdhP`w4qTBj*(lG
zep~l9tK=CvNwB(<!nh=HD8(yRDwK<lVwI0`;$s`7^&q*@dHm6b!>dwS(~hToIMo!t
zo)(*J@UU8*c)a#p@ds=&Pn%L~KD;7}Wx!;f^4KEfQyNU><>q+l@T%^uTV(o1PL@^`
zza2;>-7;w*(;5PFkTk@^(;>_KJ#s9n$#Pj0@3L~!*Tfc1TQT(n5<4ejb+d@Yc^b?*
zIK!Xx`;NR<HoBPgmsOC~{Y!O%WwDJT$XdpAa++y2jnAR76S)|ZS|Us4r3;zwG6qW_
ztY44r(Z6svDTJdXF^Xfx!-86?DX(5Tkt=N_;e9Go?`<Gs>FVR<G^B1l<CyPxY6F>8
zs8*L+AG^<J<CiuA81HK<YpWzymH=l5S6Ae6pRQEyscaAD$`Ab~ark+d$K%<7Ft1j^
zp~Z84K#%dE15NO=@m*i)x>lhiI@By3-WfnF3r;wFB|{MLL_8y&QD~6i^h(9rn8Lu}
z2R-6(?|59j;C=<qe}qw3FSO^^)91a%;|e`~o-Z$hf>sSM<u3zJZs4^=qBs*fc6ID9
zrsm>XMM!z&ir`jU%;B{PZwAzt15||7t2zTaqDix_Z!)wSQ`YBt743<IE$t^4RNn+U
zfEtPsYx$B4+9s)UidHctX)*~}W(zYWED}rNFAGN&HXO@JPi{&QX}(zLIe>ct7Tj3!
zVcF%dv6M?3%Pt0=>FDoTvXsSQHvLt4tVmfr1AGK)z^=R6LfaQD$dA6VWGl6xFP2ui
zoz{|9e2?RE(xJDGvOAC;j<j>c89$<rKJ-BN=`a2vY}s$?qWMR;gav1%{9|d11@EvE
zPm&+ZYb?1rvI<3!G(jJQqi;&E8Q)iv+YFBEV*$6mtiLz{?EpVZ0g9SgvfAdDJijx}
zIakVq-4caxsd(9NEVgl*!I6D_8_7Zx%Rqc)rU7L)esi(v<j6I^Ns(=~*;b0}_tL1T
zdmGVn&nYQxLNSF_=9adD`vlwq^j&{Lxf{6Iu(4{#BAO4qeJl$)CrSQL`Y?7_-Dmu1
zq8uv)DDvk>X^+oNEU0JBoDq8VT1|dMkCQLzb;G20-YONfF5y_l(iY~cY`B$()6rlq
z8F00M<t`u0!kr5iyo{G9dZ{y9KX4?U59YP*mmAAcGxp138TJ0jJNmrIgH7>IJ3T?i
z3YY%pVEk6yU~P_~o&{Z3Z8Wm)sbz6E>)i8o9RCK(=N@u%fs&rF2Vkrx&*e5(Je_K;
z-nU*=-*TV~^ex&6mhIcAop4;=0iWpb4vSwPEoU4jeSKXg35FhftUhFRv>o4fp24qe
zrMMd>R|5|CiKef>8z9>b(=y28wB<VLnWv<z9S{yW<PdYC@y$0_RL@sg=S$w^d4L-c
zP6p8z+R`q_KYpP3FeyK*#xMWDk4z?Dwdat?Eh&8q<km)cxwZE``{^TsZ<#9|;?WLH
z&M4>8yzeEx;p6we{^NgJ|0WLB@4b3$%B{gVa#2D*K)LMDPcr+tv7>D>r(Aq2x>-{^
zKX#1$@ClC(Vcc(UT7~vfjEB|o#PidhD{Tw66$c!2u#Go&-*KCfOJtrltI};5f6}<&
zDJApPT(h*yYfnDg8`nkz$$}<S&w(_ze9S9|Eq*!<?TF2}WDV{S9HAiM^7;_Vuu$V4
z-)UhE7B|2;xe($da%-_<Ny`%4D8@}!d<l2SZ9;bI)>VcTvKH2_)P{V=aJ_!KV$7t4
z)sLda1XBp}Jt)<6Zll?oYRB+rg-HedBdkxepL>)G&N3!h+@p&GcqSfKj|V>Y;Ca0C
zy@E~u2_EsFg+3HIgt?wmw?>C&j}KjN9fx~p0G=i^01r<x8-w$a9g&C-^g=+CFjvg#
z)-pgCz<W>F6X6-)3SEy&9KyT+x=k{l#vzVZ0QhZ9AG)gy$c9&gkAGN843%JH!Ofx(
zzrs1Q&I~`|&KZo2)}gvHp&$!O3IC$XU<SO@pqC+7@Mw6B@7Ds1=0i0cu=?pDYeD=5
z)fpHB_|aa>+Ew+$vnhjFK)Sd}rOO5~dE!?sBxImZGiyuaY7;4jC#CRGO$e4r35%bu
zjsh#5_{fJAtsm(M!x+%J&?gg-*HJlYrn5Y900l1oHu(q=$A5vX^?@2bD)qb;*u{Vk
zz~Sd{s6IYsn+-zZNbu&HZ;_z$^>(I>9Q#E<g(6_^kw@9r=o6$0H&~vbup~ZEQ(mP6
z+C|o2SeP*u4LV|Qk}5Lh;6n%LLtgP?c(&oC$>}T|5igeiBgp^31C#jWZXT0wR}{Sd
z!6H6%#gTgy(DcF8lpmC4TlL%8$e@JaC^HHX0L3PjzonqR6tR>AzQ(b(yZPbF;#U%L
zSTdd|WirR20j&Nw=Kbxr`6Jqdqbwb#GMsVtIc8ml66~yV&y#FnYE&(>$glF};!8Z*
z?Xghc;Gee?y!_HQ``FvWH(o1H#*Z2Oto#e_C%$ec<!Jm+*C4rz7(3=!lXbJzM)7Zp
zwJ)%Vc)Fu}5SN2@-g!F=I($f?{Ke{$qyM;&z#_9Xl;bc<M*dX~^f~H1_N5jbvtK`4
z_I)Yn^)WmYj9A<cI{XNgYi*5_i`AZX&<E1a(u{Vg^+{a69H|e0dA~$iyIHDVW^+Ox
z>nnvGb0vVf=NLVflUR2GTlbedkgwnu#^#ltgi|go)v<;;<j}(`kEDys6hA)u#_O-j
zb<Dyrc<4|&{!cmsg^MyfeOdr|wL-dYkv{U`3|Z)J*{`3GMEQsBW&A<|C`$2t%cd28
z6+at2&I1d~{9zMl!Yi+Ye*OCwC=5{~LKmes@&iTXF~f#QeoROdnketEz>hMhYdBQ(
z*B)Rzzwhq5!XbkW59=%6z_{nfguUcOWYf(yw`V?Dcgf{HFgfG$`pBcIYZoYyu?oh;
z1JFZdVv{8+6L`mo2*!>?Zb><rwg6@>hmUOM?S2OwU^0uifXjGuB|!jlLA8<IId>rV
zKSqA1fxga1?x<@NMEJJm)QY+8s1P4t=qH|hs^LQud51eB0Hr>8$3+DYdH8)(gqPz9
z`8Yu*3%q?<<aYkS?FBxvC%*Z5fy^5_W|Thgy0_%zHkJbNjgNSa9X-mPaczRaobdr*
zV;3L9Z36LM71pLGMUjn0YdW+AGyV|YT3w40YDb{j18pk*%h4iRUQWNZBbknf>T4yt
zk|5QjO}O~uUd7ZnU`og(e3(s&NVBxejX+lBj>u_!({TUB=oc0)S|B-uf8l6-8&k@a
zufEAvN6nfRYb>mS7sdII+Eer|EZ@RC@GsoUPXCw;^tQ&e2JkBMYjq@;qiHSO2C!_h
zahJ=drKfwwb=qBfff}P*Ld<C92wIzEt=fbv2jIGxp8(wRnt)+m$zIXUM6Seh<qdHN
zvntRPaOG_phdAxge|q|)1AWhXI(-F4@Pz%DLO7y_c|p<{=N=#d-V=u(@kx*$&%F0|
z-1FYUbZbCiyXWpXm(D#j!2^gREtt{c8E~4U<G9)MiSIOsvx-2h8g?Toz76^a5DoeO
z%v`3U^l5M$Bm)B(6wInJN{TdUau2iH0w#pp5}}EkaDa&itsg}SLc3AC#Jb37yJawo
z9vVbj>pRJOk(<~;d6A>)#LKj|B4nx#%9Cg3Q^#QRuS*vfIaQNsAEL@;N0xFtW-(<)
zE2R-nZ{V~qk!I`_nFD+T=~x}py-ZeMSgLZ=nvcC@{fK%QkqdlW>?AF$`FI+~=qKs8
zJ&RbE_gFLCc>T3Hf<Ih}i^DXLUnGme55xT<?shU2uUMj@tp4dQ{?Qi3C_&nq*QXwP
zG@Nzb1>x`i>A#s$^Vz4L)Pj1SByAM8he@%D5)F&97oQ)SSi5EO|Izem;r@F@Byr2#
zU`h9od;*^^{1kl{?Va%9)c3=K_ueaI(Fx&%?x&cN48@y&Ea<7n9}UM2J2Cw1@BhIR
zFDPI}J^OU>VXSOg&q)Dr%<(6Lzx#)O)YyqX=P6}BLYIy2&sfDh0gt4dMoB$SR=0fU
z%w)eK<*pAsaG&{y<tRD82cl4>o2<^^l)toSlVPmd#7SYl{SOFN{^<&<lfgrd3ipn<
zvt(5K$zlPEVmJ*bPf-Y+e%85(VtVw*r|pA%;GrBHsro+m!ta=M?R3>2N~3cAOK}^4
z!qTmQS?F<09}7Wu|B=o^z3)fL`jexv7kuYZ>sOTfsV5#ul$UqhdXu@e`0?NU(tIp_
zCd=P@?!H}ZMjsT^T<cEtOWNEo)ZQ1VU%so4&#~En+%E=Lvh%^TU;NX*gvTC!Q0?($
zeE{xGwXNgBrQiEuln2@zxb2pk6N}e09X|f^x9hJ9$H^L=4?eOe#$x+E)h8Pti}c0#
z8?V16950`!KmPeIZ6S|bxk<8t4VijCvA#w9xuxe=wNu*3S?8TEYu)IA>X|1Wm(TDi
zmVCm4f6npX<-C<`I)7M5PkQGa^T+Pt`2M~7j$6Y~+8i5t^l=u<M>08W;J}C0=wCno
z$A8Yrpr=f!=kIH|^1(l>NQVtS+59#0VKH2eoOjX1YBx*5{Q2|3GfzFPb`$+oTf30F
zuBKfe6UZ}4b(0D5KaX35Vln|d#*Ux<-7mrdwLvUZM~{3)a_ayq7RvauC4c|!m;Yow
z<vER!K4CFan~TW7pZ@(XCF9?ae7!q7`NU)4LizaRBYjv`vnhkcw*#^ff9*f~$<L&S
zUPC_ezYe$j?Z(6(eYyB->Ts&ydq4b%^%v^&kq2X4jT$K)s_)_Af-wyX=x3gKBJqh{
ziYIJ9?6A|0k~cFGS0bL*TCY*&&6m4~mkLPm(L37msb`#($h<M5p0&0BB7KW-1D-Pm
z&6qyJK0L<<Tss9McGws$0IdsKh2;?1wtZGWwaN!p0h#<%8MD*Ta>}_RADV}0c5nSM
zE@4<l<DQO%Q|^}_uedj{*m3nn*%nLL%|>*$Zc9w@ira?H2J#hk9~i}PD$_UW<A=R*
z_pw;xGh?1v!K&su4r)m&_7R+vSZw;N){s8GuTS1ZIVB5d%f3#o5B-&r3e`b_j}w_F
z%%m(aKriW)4G!U4eWJxXfA7j(o}mRE$~y<*qNh!VdHggk4Fy_+k$xJ$=Y3QP=F|4D
z1UI&}<k4<O+%ri4IG%Z~StTqP@B$N;d*XOzxhEX(aNcpx4|-0ME6QIoP8{&KIv&ri
z$pH_1f94uZnDXJ*A2#Il)nA=3QLk1F=-q36uAs0=3`8KZWhp>dqLi|u>bfFiqL7c)
zpmwB%qXJa7*SN)01w_Q$Q}q{%r`jtu@u;5C%7JN<1Qo^Dt2(F-Q0VIbs4QRH$4|w0
zsxPzjt%w*A$Vyiot+D#j{o=*?imMit>}=Cc$^yO9x@fCrQ#P8vwCFrk%@2=R>ox9%
zMg@568?{pMc-}w!>fz}tT#T%W8#IyE^hexBXb@%-$5^dD2~*M(I_lmN=j!+MOS}FQ
z>zB9XffAEFEVa_df-B{#N6#MCebUEwvvF83qnz?1<JtF>o>>6107%DgYhJNn<4Arf
zpd45-7K0@JCX*sYx&Bs+Mmh{jK@{e(%h})LHL{`SYCX&5H9^)5R*5Vy(!5E(FLhs-
zYQ&<PX%`^rxa9eWAw$D6Qn2!YLV%6JU;NWQn?l)--lyY~zF#J*JKEU-S@`Z_7RNVS
zdsRtvtf~(?;>hr)-~Xm04lW+}K%0Y)cL+9Ib+DnyM-J-^g?uc0DoiU%pK4_g?F%Ii
zeX%uFj;Ly(sd3ZWtf^RR!4?;yv}ZMof@AfC`6+y&?oqzw`NkZsZSnvbl#gSyaqdUE
zq~FH&iS;bPBCQZC%tia3yl)kw1W%CzDEf*)F&?DxF8%%wO+omM{NWY@(x(5EIv!j}
z1{I^(*06NDDHgX-UaPh$G)TsSg$pb98|I1d54RP?0EI3tPfGD7E91@DT5=ybSq@6o
zccu972?ctwajPN^i|~ZLQmSm_@?YxR_B%%Z#((+46{S$DEteY8C_f*%a`{k_NVyj#
zcv?%Ja#50Z;xBvziZ`+1p*i(aLI!zJV-6yXie*qfJS!D(^Vw?DUCcr(G5q7s*FoH~
z`OBDQ|1=+o@>)*{rWo<et?oPUG@_F2SWsChC;Y)h1MAanUGXoBS_b|&c*Xj2M_gmR
zPyn+*i?4t4{j3UNa~Xv&KRdO_x+?|gu{RZ5_BLJG(ujrW6!NHaEPF%$v&IFlyW3`z
z7@u^R3b9MR_IzWUg#TqkMYOWkcWy|p2?+-V4A?o`d(UkQ!a53OI!Y>(A7SV{0qzOo
znS~7ZFcO`rhx5$6E0cK!mn)rzV}VhO#4xAfde*FdmS=#teouVAN67(g2k(&3<sDZ8
zSJe75FFjF^JR-z+M}mZN1xV2E!Q~x4&w#&Ekb&cH1&5!f<Iki|zMPJ3?Vd1x<b^9V
zNS}D5<Fs{KGJW2yA^`iutfjI*6lZ)=5ZwWE6%%12PQwv2@gpR)2trGw#2?c1bW5PD
za>3Rs+bC$6<aV(Sme9l-0}PhFaj-<~fkA<GQB{f*sw%|dc{iRwg3$<QBY$F~w*1w?
zSmm>cf(?R*koG~+cghUX&LXU@nNKE@6)6=$i~6e;@bPFF>~yZQFJHCA_Ow06wNYut
zs*M9IXxpL;CY5RyoTZeE)#kF80;#QeEwym=Jd`U(I{(%}%k(v;SMKUc4r}EudlUiM
zD0VC5HBGx#D@)S$-sbeu<@7MWlIL~ST`!z--i10QE(=QKduJVk|9aln@-sT#(W<<*
zsGTtnZ83TO(Eaz8jkoXq2eq;e&PGTpgL&sN9r<WH(ju%8kd{<geio+ZZ__afG15=u
z+xucR28&_FNq!E@tK!BwAuUo&!r$tlSlzd^k2wvS>uF}pm9eg?S*xL(W*y>us6KCP
z!SudWEDk&^r3?n&^It43E<Dzh|M7QaAzTW|rA?f+^y^Y-R0>bGn_{?ya*n#lwywfh
z)hL6BVREa4GMM+}_|E&RjCaKe@5(_bo>z(wpNc7iNvk3cizvwJsSG9$`|fu@V)e^&
zF(}ubqRcB6s|{h+G*a!ux^A}r>U|2usS{L-+9(^xT)U~RY6i<&Dub<PrTRcCTvBaE
z+BIi7Mx-5*KI<ZY4^x{$m^phUUp|fK-1)m@v+;jaPqCcQhc6#^TOuF6-L+O_<2M>4
zrRu!#IZCBqBeCS6(r3LTmmb=>)qF(bpp@3Q&qM*r2h$g8{9bA<w}>NX)izUP+jW~=
zXSQxXmB`aC;VtvNdT=(<hz3ed(3IrL2=6+t*Hz*~XS|QCLn%{{JTUQd7QrqAgjXuz
zuK$dJBeInD0Qk^x8cq{j;t?LJC(`6SdQX23eYYsqt>HqOpT~oa=TEl@4)@UG=lLPb
z60n=xACJt{Gw8(A5xMsa5)~ZcaP@?omV%OZPM0ue5}Ee2oCa5Crqgytfa`g2#jwZM
ztD@->zDk0LICd~qHD(bhE}&p!kc*2Mu@wObm)k33d^D_r(_Yb4psu<o;wMU4e9gwe
zwLz>P9oyBVDaa3#{6f`xV%^r9cSQR@G0P;cizW;7iP#C+n$z0w;WLvJIq6W^afh8Q
zNFR)DTU^Otp|vH_?pV}<Lucm0^U%CDIZ(&}o4c!N*0Xg&YnhK_4O<)(mZL3CH{W=J
zTtw_HpR}8sJAgM{n;=E)izO8+)zIcccI5y|H~dwbf6#J>CErm=IeC&6D<$z8`@*wO
z&vui}v5hU7)AM1s?8dmKoyKp(J#)OJ+GJeDhBED0Kio%9X2$o}v^y#{^(i41uDBNH
z?D<K3N|U0Jt%gQ5%v6%i+wvT6nTH?h<qE8A6gCjwcq_=K4~_+awLf@@*``_>MW|&c
zWghD~sF%njNyc*J6SuqEACsZTN^&dTxe=SSLT)&7rdY_T{RdvzsZxzOSp7$9VcZZJ
zw>pVAQOUbZO5ep=bJ<B-l+}!hth;2r-*rjXXfe#jE_GeQ+^<M$E>qroTPuT<dlhk$
z7)l6h?8Y=Z@rpTvc);W!Nwab$S2YZ04f;of0s_JHnXZfU1w6cQe6GAle+j<pQ3>Zc
zjfeh|_g>Y!_j?Z~ec}-AVbD)M>#=~Y(@5u+xCRhR1IV5!M<QZc)6DyHW}PX}aV0Ks
z!Q-9NfwpH>w+7(DIFIL<<)x>~6?YKC1)%Fpb(*BXz5mi_DtJ|fIGDvRc!>`ZcD_JC
zD4Ip0)s|GoY3|p+GNW5<JSHpcO|aUuRxmsoxHW9;U~(k2=wz>6Wl|m30HXvM43@}M
z#8T~=N-J5f6so2}xec=Ig0|8qkV2Sp^D{n60pI8^-FbZ`gRjIHz9s38Y}zbo;W!fo
z&gH35Wv@sVzVma@TQNctp~-=c;{g4Z_9=^<QodPh&5UornG|fK{80vd*sWH|v61_V
z{6zDs50C?&f;mN>FUDsq-5z~7?~m27s=Y>;r_C<oWwj-(mU<yx)^?`&(#G@P+%Ke2
z%~Oo&wqQ;#7gN?_wz;Y=pR)*!vYi<GGPu<wRs#;H*tmvLSYv8j1jnPjU9{+9;TJzf
z*fII3p$M&_;OBPbgiIY^k{KJ=%30hMpj61b#~yijxyfnL9MqSyGOlPQv-9YpNYw>e
zdPXnKm8*+Y2FnVQlqe!*$JvhP1Ei_Bx2Y*~%X-*+%N7}@eBPc{X_P77D)uVjjW&I?
zij;dBDTli(k+rbgNa$zAXmxClRk2s~nU<=Ick#Ex*42!MY>?Wx$aPT{eF$)o4r>Ze
z^>1;rZL&<l-kQ^C7DumsZ5^9o%nR(x&m)RcZhNSDHfvt}be23U(%h2NDwm<{DXk<i
zU=0gmR_NR_amG@YN~H<#WAe;1c;GlYc}`b8ad9!>lW*cWu1~<hcReciyoZjzPp1za
zG{8&8BM#x&{1Dga=(f0put&}k@NljUBnm-r0lz0<!g%(=>bBsS%sW0b{RbWZ4dP}C
zkxidGfamFP<=N=Bp+76iN(|zf_I^}Aluog_@cE+$DFGz}Bm|q#I1Z#6ZKYJG9bddr
zKaB$|5=GzJ!x9~n=Exum*){_mtx<V}ZUZ}Vv=r9DUAx6heEHWNpsuT>5G{q3He${c
z!V+FmAS}}a#dd1jlaac`O}E}^OIEkUn}nJisK5axu(4e>rgcI!-3KaUXQg=Ez%pkm
zX(eVY3R%Wg7MN_jGOl+tFm(Dj)3qz(oFAQKE-3d<n)|s=%#O}mGrcAUnj9$PKvq2Z
zTjuFLS8w2S*pn-H&E~K1;=BGSz(=Esd|r%vMyC@uENv4_g>+t*WJL2tSq^YIWue9v
zToCk--+DGimj|9krSL+_4>}M|;oA2Nuo%|&0B8@<)s5D|4PJYeWnktd>r(p=c_zG;
zNAFP-&+0`)2s76iohe*uDNM)4an_M4iV~g?iTu!K^2{U;{iC~d;2q%a!9hnE{k6q7
zPS>x{@OXrII9CsMMGepVpbrq2AJ1GJk7w|pLHdrb+X!Sj4Mg_DxjG@w1jIZ6?jZ^e
z_ojf=6(EdvS@3YD!Id8XKKIZ9z;)VQFy8TVI_dnU?|E-PgKvU3V8=D%-VeH81hd48
z1fh1uTDnUB;wC_w9#tv>Eq*(g+vx)XdGA2MSFOUG$w=33J#FW*(L90$?2uYVmk%Y5
z`*5$uQ5$cRch9rYX=lev({Q>)>nz(2YpGYoS*nQuo2BO4H%qh1vLyA)j%x+klaxuc
zP5CRw!laGTpj%gcj7Y95*sS4Qi|#uQNShx8s!*uT%Vaa<RhR=wzhhISj(mtm?V~tE
zHa8MH-;GVB+7kG*jHy)pauj8rmz2C{PSS9`#`Iz-3d@qWg{gfTFj7yK$x0O&ZGI;8
z%))qC9BbWuLqzC+zm~O_Ka{`xu-w8j$o&y6(Q#-j<B;!_#;p#>aWe_}oHx~Gg{%_o
z!6k@U?3E~SgGFVDRMWx82hV9PTx&*es%gwN-#gu;kf}aUB{9#3<xzCZGPO$_!`$-M
zHpdowo;?N$fY0(LQ@$$GZldKm(89QvV<Q`)-z->cE+l&BgO~oTnml&r+~IG1*&?}-
z;KQ({2a&>B*RE<WoXlk{W*=dex{0D#OG(;h$L5(f*`klhwdmAvJpsCulVX{oyk32|
zo|#;}XfZKHpwJ|!43xeA_pV^&eKGKGXgDtSG%fU>E{wqQGzbHi^!R1dcRHkR=ZbYD
zE_kKDY4AR2+B{@i7sOr3>jXVxJo|fyc&2r01@Xf0?1>P@k7s_ke&7ln(&iqz9+v{?
z6Uau}aY+YUPv6}~5XbYDPDjB;*TZ;jLc#$lzSR4za^a9_00k6Z7hb#=1r#i8LT7Lw
zDuWrER67lxl*EA`zh@IS1gLu&#i|PoihNAZd@VM(4q9`WzNxBbBC9^hvECLf+}W*G
z&uop}3~6$p$$=&ZnjBamIKcRBA8e6qXME{Qz*R(xj089p!veiU^FOSFStQ%$WM^is
znRb%{s~87tKAxLzqMT_$Z5%+MV9GP`QnP5y<)fhs>l#-G!{*wz|7y$EDj!RYnsp50
zAG(I_vKU?->VUpxe)hH2il=hp>6vcbIL#xIxvq=s)U1u$o!T)u&5Mx{ExZoEI#aaL
z7RM;=O*32v@+&b3DggBvx=L4=AhFX@8=PWc=q`!J4;=sT3~+V*D_3Zc2I+z87RNlJ
z5b!jMrR8CcLww@#>@;<2VTp1fs}Kf(mmV=ogl7PPo^irRgm_+vbo}&tp%`uOz$bl}
z0KTV1IE?dxfD3q<eh&`dc_JRlWB_^qx|JqmIKb{5Y*{S-b_fKNPY8!@`Z_4S7*P(g
zIB>=i-2_p+gi$6x9sa0tShKM5<jUEAb^=KzB-KJkSq58vRCbEb;%~7A>BWoX%0`{V
z9qL<sFGrmxsUB~X3h-O!Zx+YDVdU?tyNZgerI-NNt}*T#@MYFUVDV3Wh-tj6HooFv
z!PV93C#Flkl<~6Fm9^ZqXQ$fKn|MtQtk4|D_q!<H>Q)%<kM!#X%SG?ri9D-YA!;FH
z5=;@vO(Sxoddkh#jIWJIB3JCl*WB3Osw{3RT%TpCQ*o;CgjSpjm}Qd2n675=<5SgI
z>ZbNM%u8s-@H{SrsfRcZ#EnGU7;Ru>)SmTKFJ@NWFmY?bip7Ck9n#lILAIJp;Vp0B
z%x}{z5~<OyF*4h}bBr-*lwy+4tL^G1V1>kHmu+fcr7HX=#o}Kl?V-yXFIU?9Sp7u3
z!y*}-Enc!vis7DSHJp6^Ay!cbvp_9@HlnmK1VSm=9X*H|N>^RuN9Zt?<GU`4qHZMB
z20gR&&bsRjZ0)&B8^~IR;?5%WwDzY)`JxLCSJ~w@tGz(YYdH?ME|RN@KJ<?WcfWdk
z-cw<O1Kh)OSMK6A0y>0)3m)$Y1N=Un7WagMo2F0tyz?vX_z~vxb(_3*8iW~S6~bu*
z2=IfrC(1M6nd9m-JmEA`phq01>lt)9dS&!^&pXE_92{p3?*NZSy8HmA$(1lqi+rG0
zX+kRw<k+YS%BL<8a7<K82+DE=mf6=r_09%c;wx~4XJxK2cq58z$(4#r5kVhu+VQtA
zv7&?`-*tpj$5a}UhfJz=R8;j%)=VKRR}uMi33Z;NYP=D=$>giLN6%9^##Vz<JT;FA
zKWxVoZnU_FD;}qKsPbp5OehvdD;BD>*|k=}+7;FmKqQ!?prkfsLL&N#MQ(;QIj{<I
zz~z*6yBhjl3D!BKa#E*6)D=9~OHMHwReDdOQS_IWD#(|QMJVHo&%I2@cVIR>C#D!i
zfntkJ=77<S1oOc--uN`T12fl5s>y+shyy0wa%+!dZoLwfuXUMRy40(Xa4;I~xWS6M
z-N6+PYnY|>acE=}R>6j@KTX*sCM-vgYZtmO{w@6W+px6TQv2wf`L*|TXD8)2wi|s|
zZP8-sL$D5xA9RoIBXS?0(}@~%BaDp=ha9`2@>XMW1NmbcD8_(>muh850Kr1-M1d0p
zAVSI&v~KZ>;=rwbxq`zlEtp)t>bg#ko2Ab)zjS=)xb9T9Nq#&ZymK560}nb5&`X}P
znht-#m5g%rLi;lWNC@!4c%tBY!93$m%b&Rd&a5;&aQ){6^@5O=r^glW=X4t2V?FHY
zf!Bm$9Izc!Dp;&S`D;qycvPZWcNPSEY)*c5mSaKD7UNBCcv)7kTU?tpX_ivko)PqM
z0fxV#T$4^Fj%}k=4K~%tZmjLd>Ygv^vQxWM)=GKa#5+1vK8y!FRnrb~IKGhporVC}
z5#fS7W)e!;h7il)WuhgISjjKZM3btC_2XhEL21~H^*Ql!iTKXPh~R(p_o#Z4gtPaZ
z(P$f1;wIrH2UY+Ms2^r!Nu$QcY&vkKVe+&p)@S7()4uwFjTtI*lzsK1o23L_^XH$k
z9Ch2V*7cmFQ{A)IVm2Mh$;XVan!;}(M^)W=xjM@A!m=S-^S>p!!B>4W4qyR{6;aNO
z1W1NhuT-0KYUY5~gW5|ImOl>o+}Crqs@0N}H`_MVW?M@@=TPC*`9(7~GFr0`Ij+-C
z{%YM~LytlrYP9V}54qS*q>yxtPfm<9N<k?c4=)za>6ODN7Oy>Fo~F|%m$u`U!*M#L
zu1+KWKHm~pe@eNkZx?YIlar9ihv!;H%M)nuU9=QtV*xi38k;ea(?)5xZj6V~&BCHZ
z3zc_UhzYOS%+@krVocWhQ)6*#+SR62o=M0k%7XTX>{Aa-sEPwH4c#P)TPDO*2tV$5
z=lV*&r_y;JnVrW+|EXiyiGEeL2`#5bm@AS!El=NZc=mhJB7M&b&-{1>xOaTY0B!+f
z6~aVFBYGyBFbM+?<sAfh2as{%^7DA$qnvfR#Pc6vo<4Yl6XxzB2y<G5^8>hgI5<3$
z9_iyUqTpTCeN_=xJrMigy4sU1kl>^QMHCidqwck4$?b+2;_|~Hn<=y{J2aN%1&qfU
zX!6H48lN*ulloOs3}Q>A@JH!yBSH~=X8A?@0_fDvmB~v%#{9u?vL*5N<*yby$ETnV
z0@<J(J52eAb$n|U5aK%mj{KP7KzCS|F>z@^lLJi-bQ}jvCS>Gb^$UWI%V+&la#>n`
z%6W?EG-{LCd0OS~Jf+g9@W!#q(<=AYDMSTyHZ|s5`nObAdSzBpnYLAqcHQ2^<ZVvS
zqD3z4Ii5^m(J0F#EgZ3A<_qK~V{E=qx5S%-njBa;IAB(*Nm0D#CjqO_P3z4x<XqJt
z83^}?!}o45RzfD(IE%YOHqi(#3Z=q}B3BjYHCdXn=eIaHkDq><rd8~H8n<5e=`@{Y
zskGC$rEr`^xoh!pFBRZW?&AOeKmbWZK~zI^$#+vw<4~_%yYw*E2%Y}nImWwOo3rsy
z;~-;Uv>J~0UF1RnOW`H>^P^3sidFo!GDbEY(*YE>ti9V)55?$0n?6SQ7~9*PyDZg}
z{n=^&Eg9fCM}J2D2%vw2l|1v#6~EvEyyKq5JGg+;aD3cI0N{ZGEfVLwH-lp7JHF#O
zJ>v7u!QT@`ev+zpg{&hw0?!~p&<j8qnWG>O<O)7GgnNR71K>Emr<0|}GYVj*RVsbA
z_=S#Vo;W;1gDbyuzM$1~86hTA195ysJjf!_s#1U1nlgVnvKCHR3d7`TfQqUXw;FmY
z2aW_g1B-SZ`JfA8-WznI%7?%=WpHkBrx8GdT~r3!#A;=)B$bc$-JW7bR}HxZGX0`T
zu)4L*#h_kgqyjXx501n!A>e0|l4wn~L_WZ6!fb_uc*9$g(m>pjR!xObye2d`&@mi{
zvJDB_Sn!Q9>*fvagI<<K_w?#G)|lKt)sF@z`H0L-9_x4GWpIjl&iY*z!!g@_wUV`t
z#-f;ZqZw_q&J|v5gGFoFZ49Bz%TNmE#v3ez8FTD|HnNavS<+%hv{}3Z;Mb2oMzZ;*
zS`Osq6$yH?A`(_K>L#+d1f%IQO1NR7s!@gN2)gjb1giZ>M#(%sP4XyQ|0G&?imo6~
z6za*M=}%GC7Y%GcsmiCr+o%A|CtWH=G2DEtM&6amQDK_(&0p~}J(Qu2IyM(YOXNmE
z#y9xaH_KeJVpZO({tNTi5l=B+i`5o$N?_LQ%2PLe?3)c-l);O;MBl==-(;<3K%orC
zc<q_T6v)Qj;tfBSM)enRf|SDI**cQ~mdZk#e%FLb955a^qg-d{%2xD`+!OBL%3QzF
zICu{Y?)mvU-J0T!cb*1U@WJ8U)6lJjQ;D7r?!oc==r+;6di-4D<ds2|rX}Dn{Ys=<
zYq11~1f&ZPLt>a`(tCg>&NDyaLBr{y+yw|D9m2u$bSR)(`Z`So86Ji8_#W0%H^d<y
z(D18njV{+FROCPu34Dc*#Ytp53b5$RJS>g7VTr)2NKXi&WebaHaML)6Fii&*-g{#y
z3|)So7+9i04@Gd^MMOuHBPxU$2xMI<%hDxwREKU8Yr2|zWN};((wQ^hY@Uj@0F^N<
zNmLiLz*3IY$k!tECx_1kBumnx5Af2mkj_NO7zHo9D=;~>Iy72XZD~^hF{zCj`%117
z;j8hD2h!k&m~TRp1Is4|Y!RufS&#Eh)S#@o9JHR^5nZrB<!C!urf+~x@#0gv|Ej(U
zC8apqAifr+6D3<d|DI?TE00m_ol}T2E2o=_ZE{=lF0qkz%bY8oMyZy1o$<tfa!6hn
zTe`@E%dC`846})?1@Tf@HQQW}ilKiss)FiVw3Uxssx5KbU|F~F@vpiPnM6`EkNwzt
zb0)6%pQ??_%T@c)`Im4(^1^u)$4!hIq?p3e5?NyZ9Ye87u$&hqUnPmv=cbx;s=@Kx
zv<27WwCCE^^xBGFEN@lONUE8ZAO-6pxsuSeM-N#Gr`F2F=yy~Y?b1J17(X_SQJ2>7
z-BA$7adEMH5A*T4<P=RJi<1JjJ-brewrH&xRb_3DUMxm*8_C=)s^2=qA9Asbte9aw
z=_U76Ec(U;xqF_eEcBEB&7UxSC|dwGfF%rY{U=udJYQUU7~$OWi<L%5d?tPWK%J)#
z9%-l3cUrC=bsP^Ddhu4~M93J(WR8T=jPS$=;~mdlV6GnSiSeE=u7o)*aUI{8;Bg5D
z*9+k96_ga#aVw=yoF-Ju0o4iu(EQuw25uH9?1~`_<D?Uo$I7pk?5c$4lN>K|wCwB_
zd8h%TBLRg4=>u_*$KXcyqWd)nY*ObN3k^!6R<g-J-F5=-FYaV_v~O)Kz)4$L1DkLt
z>$X#^{uq5+(H~=<Y<sC{i9y?GVEd^hOU*d#=0Lx#`-ij7yP(~4oPa5}s+4!Dt+rbD
z{*Qhddab^?N3YAZqgtx<K9emS*$+#zs8_FEVXJ;y8$$Q)-Ho?vt+iI^2)Q@a)Wd-X
z4-7{P8CsE6H3%%I4m|jf@ZHOQ6!zF_@8VHX;*Bz$f6;dnywlD&C+xV>&dGE8Zd%t}
zx%PABIp>FMx7)sbNv2}Qc~@?1QNpQWr?5)jQs-N4)vq*y-W()eA9~mkWpUCk8E<Ud
z!E#t*5c7#{8h3m?7&k;(^DRxIdEYh;95k?PbySM_7F%vrR-PVw$e=KA&|#&bw+gqp
zr0PG`d8^ko1@!3IBYf`%KMrfGv4+L3l;@ffsUnj1wW3#Tg7}BbsvxzBqPV2=Yh*)y
zNF+QjC)iM0ESGhBq>C%=>+I+{Xa;#)4{2Uk1rD%!)<@?SE)3r;Tp%UuBGX57_IiV6
ziD3>(Uw-CpQDLmVdUWp@diIPzJ^*efeQK(zRNqnaH#$|$pQ}lZ?GuyXhAb{?Jhu<Z
zRTFuY$4TT7H~w>>hC&74>Uzm~>Oa#;BTw7Y;ki=!9w)1R^*oYyQ?}Yo?vJ-dA_H8B
zKsbO>)^T{|om=d>!q%^z0r0`|%<DD*FC>Kl59MzfJbk~CR+=91Dy5&M*SxQa1Gy^J
zW$|KJhe+UAWooA??%1JF<b!kC2$4XE3gW5=SA|6C9SI0YD<Ea510ZDi88CU)P1kNc
zjgJ=Q?;=LS|Hc6Tg`%W}EJ_*7Viw3*?T~QGW_*!_2{kXHuD*Ck@Drqty-BC<dCD=O
zs*HFXKC~F{Wrj$jZ%}?&4mT1ai(`E;k;YYo`<!H9-Xb4R)+a3!X_4KiT#*Jqx!c!{
zj7;;-a>0R~tMv@)^<BSidD(aW{lj)U>=^!f?bQ`&vT3!!MjOS2cSY>#5KImui;%-P
zIaOWEwqrq`o?y$Fw6JMAsfsbOJ+4@CJMFwn7(Dc-@bCZjD=Yto;w|HMC7>R_E%b?5
z7^`>h-eHY3d*=dO_SGhLw(h@8*mwT}!|gZU7{2)8i^7ELDPMP5zJwk<R||dD-yp$T
zw{PFFO0NX5ikrySXdxS?nnZH$X1N~1dh7KKJ++ZhEjay1)#>J9^O0WxA2ZdoOBP7@
zEYx(GcBM9)!Olf0yzIF108`Ze$N&1*!WXHhHMJ?wqlZtMQ!mQg(vSG)9A?b43&tL<
zHXp=zKzVnci)|TG%Otr<zgn|5b;Lo*HUf2&f>TaEGmLun>G0wU&!<B3x4qZut$OtS
zn-4E_cix2;Yr|nHH3KX<mxV9Cm>XVxaa?$Q>=;#hVcMl=WW!0{<UVa(P$|#Z`0ag8
zdbP>#<f)LXidI|c3dyX@PqF&pQclX{Sjo7EOhfVH$Lf*eE@h1;ie{r{iv2k%D>KWQ
zWh=n}ok6iToKX2zCo{Wg{cInd<AjRZQ)hHWYmfGawycwx`nd%&h7aAlM~mie-B@EU
z3Ve7j8eVm^w$BG!%Y(*v^%H>69%V3dfO7M&^7Kl))moLl$~S1(h^dsT5>!^fVB-{j
ze4>l~F^Z|E8^to1L5%l=`#XQmvYLSxd@OupgD-5^#P_sxo6z<!u0ElM4)o(7nonCn
zNq)fhJP}U%ULKw;z-}^sh~$Kc;4=o#2+!c~^Y>}yz!<^-=y?2e;=~0H;C&h=ojz&$
zyEdm^;~a%NH6h0VgffG<P54!<2xOE{SRL7drOBzH956m<k{bt#DqRc|rPRK_s5n%I
zRA*Sikrou1O=uSfjF<F@PU0o$V@=`ERTCv9CpKB~zz(~*sPC`@n+dG|9AJDnXyBpY
z$;ThH++xM~{U85q1<3izk;Ru^8W(=^fB${CFHHY!whQmSH#vOt(Two**Yhgpm)T(_
z0Ls=M{N(Q&pR&!WISqnqCymvT_0>w)@h`m?e*5eHXlNc$2Kw<>ESm90hywF}{D1#5
ztSx18^iSB(ER-aE*$;jccHU*zlJCpCXir?HyMtuh_jJl(d4b>m=0C$r<6f}r^y;;G
z`0u~^x5N^+);vD_<P+gv|DS&e|La%(Biwq^jbY~jyPBM@m0mVpI?vg6jd-TLnk62J
zrY6+P0occ8qJIPn*?_`n!MERrZ@*m-7D_=D-J4Y_&1%ld@*R<8R;j6#!twA%UMq1g
zopu&C{f_%O!6GSGX+w(^E;3z2oyfME48~PhGMh1u#%bgTitC=*wC1E0YyVoI-qyk7
z1Df<tAg&>sx&UKF^?wjv=p((Q`}1<C|5QHH`d3QnN(1uWs`6dC3?e|`yc?$@+DrXO
zD`rW^nE-D39dvmn+!MwmfiTaYzf+K<%RAENJ>WE*E@9mB<DFXzLq8jjchKQmOigG9
z2U>DgE0ADEDahfwMtxH}wcz+&eso%7DU4z)er+=<j8RP0s+{sFqf%ESK)@QP>|Jp>
zFX5{@3rgN~aDm8!!&3QyHa}g~T|BgY*K~c=TKDzKO?gV5*Cd}_cjcqm+a!*jmPskQ
zSbXi0`v^kGdKP^)RMaWzw&QCPZnNNz3mTNdz!I~@poA>eEvSKi5XAs#H#{**srjdV
z9N2A-J;T9=92(Y?wdZ@2Cxv$>O)4P1+G@SRQO6!<$Kq*k@4Wq1c<kYaG&%p)@Xk5^
z!Z6|0SHccE?il)Sv#k_*^TUJp-4mur!N>9SCmwqw%$PPUpiDdNgp<PRtM>{&{`oHg
zimOr2JYA5MKWwz|CgI>i2ZhZx+dRyWlJK58ZVz+ker~V(%6b_(n{Ba0Sn$m^Vf4sn
z%sOrV0}l$DZN7Q9^R`=^OxS3njl;>Ooe}>0hbwHtzN^a0QS3hJtYdk4_`&<boY}Jz
z{PfNGvOuNWn~LVVufCEM+>1(Qv`wPHJNvu~!fO*=3ERv1d25w>{?}iJ2k*aEip}@p
z*r<-T+n#%xD}+9M`h@8pei$Blfb>32CzIR{JoK=z-vI}N)uglm_ny1%urgyUH+|ZN
zRz^qOYv29CmRoKW?!M!;P>dhX$yyKSw{`z8=!n7Lx~u-;QIl(TSsxxh?8LDBjyqX?
zC%*Z5xNpRWf(<ULUr#;btg!j!TZB2E%(1$hoM|6UaLqN>495;TAz<xG+jw!@^I^=$
zXGPEV{2jCKdgM{ZguV9J&*W4;#eMvdhr*k0yk;&S4n1tJS*ue=Pd)i)m^|qn;W4I4
z&Xf@~>u<0@IOez$t&M#3<(I0v7sA-lBdzXEKJCmfbLK~3?5JlgBb#ixnJf~|3V;0F
zf7;0z0?)nhk}&SMF>31*b0g)lfVK7UC!VbKyL$M^-~VG6FPbBtdCF+?R3E`@MgMKL
zGllj8_l{8ef7jme2R9f84IE_c&f3BK_k`JM2Ud;*D^6lLHh<i(ldLa&K6kG55#o=3
z>80@QJ8y@fM;{x$`0|VJ+?dfxOzLRjn{R|SUw<w1>$i0{<nSZH4cA;{?-~COAADpO
zu<LGmUKU<`WqcCPZ#LO%vv8E?Zn*KrVeV(2iPw*Zciwu-UUQuPc=fmKx8E@=Sg=54
zemcCQvIC5DEQotc34HN)FST}b@nzo&AJ3c>ZoBzLvj(Jn9(ByICHs*PO8wb&_dUYF
z>Z5DQ0{y+o?}mwQyb<=<|A6F#0hU-t3^_9Fyz8zyrrTY0^tR;DgW(&=f(yR$-9X(R
zecbVe^QS9*D=RIGZ}QN0{q@7J6NiV5RqvmF`bl`;zI(%mA51M77df=A(npy}-Q9cl
zorx?$2Eb1?y0GSb<>i;cu_v5pxIg;Y&%<~<kAC(U%?(QDnVeZ2sZ3T!;_0ieypqpw
z=5C+;_77XCj_<tnW_v^2%j9n1{t<VDX_6BFeIBdZr=EB$3_s;m(R(?}m_8$1eCcJD
z)+LvJKg^mrGu-;O8x5cN%;AHF1bEN9b?m5-1?|g_iu|GeKlx;i`1gL;s$V~o#h{gI
zPxgM3O-;6Lu;E7GqZ!k~GfzEPKz;Zrr-fHveL1{6aiUHGlx}|okxD%<=W<Xv5gY0G
zo4-n<d06wB=YVZVi2$oWRKH2aP5r?SDPY!%OfnU=ly8$r9^{Xp=XnoGjFAt^Q(uMd
zXoE0A3@f=-D1#H@Mou<@YcWsd>&SW$Ww7>8h?~uyx109n6^mi4$`>ud`c_6(lDFMC
z8L519X5Y1{RN)pamQq+Bp2H}|d<&b!@M?PQZVF<?p@oYyXI5q_TM8qiq(5ls-fE7}
z9zIf2RzJDAGb2A4H7T$?WLLGgEOc4)#>I9NYp~YCd58XUiGB<9<C#eaOa{lV>4}NQ
zCr+A<9+PzZ9^5n@^wRn9^a=OLx6}8uxk95Ac%l4-KSO{Y5&8MEZtb2c2?K5o%(Ev<
zVtx-z7{oIGo-+f*t%DbmXK=wwr|;>d>3~}{eMbhd3GL*7n8|>FV#_Ut8623DrY(l!
zpwP~=R>0_#8*AL?TQ7ICr4!3xi)YmhorwCv+6bji6Y9(X^@qfos}gD9))$mE7W~w$
z2=mdOZkmK})M!=hhxO&}%1aGPI+Q1`O?Wk2E2ZJw&*z3Cj?DXorTv_L@ptSb2uj5p
zuD!;TKW9q`?6CIQeZpYHdF#zL!*y3*6+Zaj{c!T>XP6B9Qp&gqIR(_z_otYm;Y+y$
zxZ{?alW?b#z8-qm;o%usq1|-Db)l>BKpq`VJL~N5g_Og8y5cwC;Ro&uLytMm6u(p7
zf8Q(v)BcBd+GQ70WMaLs>u!6PGVQrBW5QK``hzJ2&%N+sQ#d$nznX&UvdhE!%JZLo
z_uFv)JtM;2`|cYKJ7S2VgtgaRTS_ODTS|)?uDM#}o*IUq8p{pRF1zg>hDzD_f|RpY
z=F&U=qT=bHP#QRBkd(l8hQCO8&En#y<BqemW=x+JcHeWaBwcQHm*NH`F;I#hyu(7f
zkMdazh8%fR*kHpAmG>*dO@F;E^y{~^6kq!npdK&98H&f>{O5m|0{`rD&kvhyvPl6B
z4~+j8UUI4KT1*l7;QjZ7J@(i;pro$^<8+jL@}##-`FHy*H;L!(nUea%lTWjw?pOTR
ze}osF8y!wRQwmpE5?2E1?z`XnQFwpK<nV{z{8~!xJ5_fFgu`?Gj%R=Tv6Q<55;EIK
z(TV$s&9>Om!q!-0&9IFWyUt%nr2USO68TFhV{g0VMpLr+JN)rZocMaU_Ub=}52n5!
zPLYC^IRLQh?t7|@9xpzQ3V;6nZ^KM&aGZbfrD}IQJ$iDDe7xK&>HhM^->DBg77jRQ
zVAx`-eo{C_{595G!xWB5B;8Qvo?0LS-E>XYIhz_gNa_EStn_b}5^=rt)(g9-Z91&8
z?z-Wk?_4T=O$k^2@%Q0{=bsBFpK`kDc~e6<bkN~ag0B(&^2aN}gAd#rjz0c)+l1gH
z;|;&BwHb1c6s61!QHG<4WFEB6I_ri@F8^Nm;KL78_A83^Bj`9FkA_Nl{N&@0g=_xu
zCn;X%s_zd|U+d#2w&~D++ijK3J>hSEy}_(qPdNEhd;gH+!54GCu+5V@Z@VQ?@F$UV
zbCTNChsw_%WH~!=;+wYNft)KA7i-^vhYm6&@Rce*{c@=I>3|Fva@5hb$wQu}s_vf~
zJt};qHbVNZX`>8aqoh=xd4JTg$HzK)?6F)Ots8dRJzq!QIM9A}+-WE4+l0|>H`s6k
zqwhFuUd+;_2e8&!YpZSav<<6!r8EYRXHPyBPi^qLv*hF=De`W*{yI}&50TtrQ?44o
zZzlDIVi%~?p8E7zCtPsxC4qi;?bUyg{Cv~OpH6En@s&IS<=S65PN{q9)_#&v^e-$}
z^UF$KUY3g83{P_aK6aI&%RVeASx<jA3rTGNE?oGnZN9`4bCL?ob6r4iZNdt{0eVE$
z&?e-nsg_2h9jOfhi)59{2IV4s$ZdH6PHe`LGmFdsfev8)g(b@{j=*A=d4Va^D`eVb
zmY25zdR4DY{@I2)-ILR;O<h1$j4MQPY39r;tAA9~TJ@jkLw$fEO;4|u^vOdyo_Cr!
zN!3dS5Yym^5=Lft=I0sn_x{Wk8kj+H4}ilnS297t((&|Y@432S*y(}m0A1oaWBi%-
zj$bi-&lHiGP!A5MO0*L!HIxL31fPCP3>g2rbkXjZeEoFQLbN4ktr*{VTdXpDn@qGZ
zPL-tViH1P6@~M$g-mW?-!j2%jduB=9V861Z%3_=o4;eeX{reYEVQptXCna04sGhH7
zVwC+V#wdZHKCx83uILl=jdEZcDyj%iyBuz{@2o8{z>BVZY)*X;#W22&JFCvC&3hBC
zb2u>Q@FT)YFT7w@h*+*-&5M<x0}2s*#g4f1cC!Qn=Z;%%2^+`?Fa05{SH_PIZz$f!
zvu4V|^I<7z)->O$PKWC^^XG@pKKoP)$R(ycKrvhjo_^wSQ>>v}8!H71J}UvNFUa2`
zvIzY2lTTzx`nsiw6)y^q&p-RzER_vee^C5+c@9-s@pC!;rE%etIkI+r^bz$9aCUL@
z<jRMZrc9n}%8@VRBa?iLxbu#1;J|^J)b~p8unvSi<%S;Co$E^B2B6e_;kmJ<Nd1)b
zq=1n`w&T?af!xivT1=0S74+nHCz*2TrE%kA9leFUg+9s|teOGp1MBFwWD#15A6QDe
z+_y+Y{*dSUq#*j}qmROeQ>U6@n|NtJ0g6R9R<`4$D13dwgrY~ocN(yZ6i;h~5qI5g
z^xk=EVi+@eq!hvjiyYH7e#K$#=bxEE@#}f>tX*JfJ$T4b=4J#-VHB_vUL9|iso9U%
z#jj<f@Dc6YLh+D6M;ITm-o>gMMeg0V-y$pcK~{H@q<r2?7SFDbr5%4HrTf<Xx3vtS
zxcg}ObhGp&Ao8&#%%}Z+s`je|DEPDsBsensm6u-(Z@e}^ma!k1g>$<74?28scwS0%
ztdu{QGdn!?$b&X#;Fx_D2*c78E7VVAz53R~H^P1Q+!<Dr(rt+>t<C>tHd2{qthV>w
zXW#JfgZJ5{59PY+_S?c-<=ue~%uSPm^l4cI)2Fc9f9IXI!oCL_XejH-N}P82smhMk
z@L#nlM0-sG8<I0WnrT5ZXUqt*)V5F*9Vlh?6j{taH)>R%erHH&c<<eJnUy~MC_ny1
zE*~b#R{9Zbj`UDkvLWJt;u~veEbXxt=iQ@{1)NSm(Kvh7EY;6K$$`(*mSz~AJ+5EZ
z?Yo}!S=z?Pr=KzfHjDORaTiL_MZbUV-FNLI!OPY!3;W0<<@H(7p+A|7qm8KSq>qfN
zlxM3WZ8kluGI8P{sUs=2i@^-l;kQzR_=f|x*=AeuVS2#29w5E-<Wn2#>NKz^Hfsh-
z;$_xO(<c=^7T-9nfweC(YtF~B!WLU@nT}p?&*s|cXPu*sjZ4BW{`p@d*FTeW@JPd{
z)Smbl<t)*E;67Q&D_wjWKclu+3aV*;>A2?KTC%{ei9)!dL`+j@-qTLf@->QAj7k<t
z2`5F|;svq>#wwEaABHBH^I~j5r_Oim`Z7{tBFU31l+8*xijI6bMR2llI`uipZ_Izu
zyp+N55h-8bI^R{nzjRm1=0BT1+D#Uxn&;A`V$6;0jkdRN(KqHw0)reHUL27d)c{N9
z3MFssBg&ofVm^fB<^ufy;V6Q8_P~wA>e|fH_k_?9z(`x1Dc9;d;5u-^LvQN_mX8#*
zXw)a3#Z0H(G;gcm09E5ZCbx~yf4UBphD}<eBLQpRX?u8E)AtFvD~5AqqvdY$pqq3;
zw9a%Uz{@^6zT<*J7|;CtJ@LGNgmX_pF>CO+9!?zaxuy%MM+*nfe~t&E+}b#sKJl7R
zR}P5%)PTSQFq$+#LJWvIQQAS~!&|O2O$j?gS_%G8PAjXF!Av}@c{(pTv3!=3#1cYM
zM0Makjyft^x#rPP$+at;m{)JZ`L^8_qA|8616mwQ1smIiiLfG6yf4&gFwW)N(#8UY
z1+E?C)76BoCMY&xFOrpJ(5lG+CaCLgu%X;L+*`na>2mL|{SG@>*ruCqCd=0kOu^wu
zSZ08;@ur)~y~H~f{K+SIw+kpmaIvt4lu@C$cLXO@@`_@@fur@kWTA+hMTU)f_SvxQ
z_S>7K>T0sOaLWtu-*|n3DR^Ib`DL?W>>~?B6gF7O_LY)kb16A+A;E$KSgJ`l%9AW?
zqO!SlpTEOmln;KaFKfJM;t7Ca*@1GS^rGC|r6A$Md|2-dKkal!u}Oci5B8ya#+nj~
zTCC%+h{T!%z{+~s2UD$FV@HoP>)8*L{#W8LP>vslP~y+aQv9Jv$5jQ2Y?Q$Z7JO5H
zjn#D;cs}4Dl)Qzokz5VnCgS)Lh9@sp)5i%Z2R`(&$MzGXA~)0(N6GOioCaJlV4+Pr
z$b(Bhzv{TU+Ux`!kx#?4X&;!sb?9=u{p)#Ohpqbcmm++M>T^T0=EM^5De0xKLY^dr
zXd0ZlU(@fnpCd)D!~FSQhk5g8|Gm`?J~iv(&9~gj+)_9W?GD!kS=dyr8>s8F<<7^m
zJ~E4V=39OWBpa{PGam-T-|q)f_@{xk%oqVscen`{e(Grn%DU^Wmn=@%bUAVODN+z_
zB`f0h%%YPGf>OX(YMbO5<2Kx6<M6tyWGSyH=u~$zwE@9<HaR#=pa*-#H2{5s&6hM#
z7t|ZDp<S1SeWXCeV&4HJJ^XaHG9F&+isJsf3%_IKm^x*ODcw=v76aVgAVc<(ay;8F
z9UsMSIjEFpc!6bEw%qADO4A2_vXs4BZ?lal>ak|WM>`5y`VKBzuz+@#KIyon?$h!X
z9Aqwv>QXRg&c~*-$1)!O#3-{JDz&GLbi!atMp>O!`a2!JR@46ImvR10tWv#HuV|c2
zD9r(}&bi0tr5hR8HD}*N`=ifx9(WEt2id&vK8xeH%iFb@d{%=~&vLaTy=ri)!O7-7
zTc@e_>9%K0QC8~avQpN#-T3Ie);=0%YDqPfN{zR<RFy~jC%L{z_qYr)R}x)uBN;91
zyDna&c{RR=u_l%(EK_8x@aw6pjT>Xor28s&=w)gw<tiQxw)u|==f^V>Q}mELb0v&>
z!u=itSl&6V>p{~r^t#|ZaUF<<-qgd02k@Luhi4BX97xCI-t*zK45^jLutGrq8E|4e
zlQ@|njuYb<a6Hc-S6Ajj&u3iRqqybS-+Njf7aZt9lb@%{J>e*k0iKELxWscHPHqdv
zgPPZda6nu~_yKMi*+sr|qPqfBgM>3OoP~)AB6gF(Cy;1Tih0Ewk<=d#2dxp{^erPL
z60u<NYRK#Y;vyq<n<!+JvqZ6%r`U-6R!tM0vcstCkpIORbnxZq^;9*TRTR;5`d;O2
z=7G4ZiNLaDi=}vyh|6t~w3$qe5$Izm4(NBZ0ap$yOSbUT=jv;u+>Ev|aR3WR<k#HK
zKQAbjO-^$m-FrmWBLxV0-~%5$r07dPvb`0wLlmYJVrjbgjpMj67IOGZoh{$8ZYc-e
zo3Fhl|D%WMgC0G@jspgmG8ko~xsgy=QMO@mniJ--qMIB(lT~CED0e(sT=*tiZd)7|
zqG*`lgR7hp38pxX=|v<IzgP>ycjFl2ieSKQyUFM639{CH-h6w0Gyfa&O&nu|@Vcyo
zchxcfv7<*8SUp$bN4Y9EPX2@Y_3v-Kk!Q@9W{T`yy`mD@)8#AKX`oCjy0XCW?s;F$
zEAX2O4t10VrfZb9NL$Gx#UqtUs7p>^>8}>69(}RrVc9Eu#lp5wX&kXo`cba{N=E!$
z<8vLQ;QLZG<C20tLHI2<-4G*{{Og>}l|}XFrSdoMs+$yaz_btEmql^j;uGu5Pg9#7
zo(%c-#ViV$2+Qm^KYWv9w}o7sJ1IpHDFb}i2IX{C;fVqgUIO&vSs%|dOI|01RWE%E
zK!J)iDL%mWlC?2DpRd2>s#Y#FJZ}1mf|5Lv9%E{Y7NPV#^3!v*9y-CIudl;9{aRY|
z(OuzCe!4|0T1&x^VCeCk3i@pt=vSW<>Bngtzh?ssOXuz6`+LaI$ArU%3<+1tO$$DV
zvw%<EqmLaXpUKagUu1Cb8J>npn;n(%%;r<kIuftEj?(FIKlz<Wc3NR|ZRGS>r;jP>
zaV3E)L?Jx+owu`5ia*0>{!=e`rsr@=w=I<V6XfUk%P+nRXP$ko+@XxoIP#grtJI#@
z==!|Xm_xfL4(ax{w|uA5{%*LI_BSnwU^$Hq#>$htXx?Nv5Ia_3&FV>WLbp)l6ao;}
zYO!z9HWX7mm-zO&_#f3l`ZaN^U8S*Wz)45X-Xk*$AoE!8Zn=5zOd5wu<f<B+5>Z!z
z;B38G3oOa5=>A}tHU^h2!DVB2n?IOQjCet`!j{<)45I#`Yt7h~v?+=*SmRqaDTZ;q
z!WB0}%x(DiqW3v-%VOi9w}JNOm-#F_g`&APG>hu?(_IBA_ym{<EqYA!k2JA#>x9iH
ziFgON{uAL!d=$gk32|&Nk&e^!2EembT`oTKJpI_bi>L4TB3-{Hp3{S7!QdM;TMA7<
zHUXX?lFl53azfmDV&M2anRe#6a@Lu^6>u8h`U;aUr|CGvCl28hhM6{aq~~dnE|5;&
z>Bl$Czm4U9EI|N$$|~xeG|^zZwuKH0kle%q!Kal#A^<C8${STByqe#8%PB#?1gQin
zg|VX?64nJ!A$|dFqaQ4f;=iue5j4Rw>)@oT!ObR==0J`=C{AmrSD$#eFE!gd=pdyq
zbq=^ftxH$htJ;AkA3!|X=VOxvHUF%l9N=g^KG?93Ok38aeMjQwkt5nnWMg}dvK*YZ
z-gvVn&c&r=O;N)(Qr7Wtr>p<`M;kk!vY$Tq<nXbMB7Y{u1j-)VMeso<z^r#wUKBc5
z4?C<QOUNZsZf9YR%8e_5aXLQjfVC?h6vKM15`6Ow*243Z-u&?D_<VXCYv(AT_0!x~
z2(3e8rTa+k$T-jaw(id*fwyF(d9-|&Vr|F=rTCZ}P>CN2fy@o%;Nw*P_uv1gxr5*}
zesnjLaw-iQ>Z5#ENjhw$e5I|TJsb<!0s6?-t8yJ;W4m5pfzAiT@(MF#6F=q%r3EW>
zgas=6=NP`j#<DClmkm-T76;LmteZW1mMqA3unzz_9(-q0V7A%^z{lARms^VN-Mg84
z1oDVdoR8b#_R0OBdi?A)N?A(bcVKv#@?o?)`q_MIcP}PnusX%HK^90CpTj5-oo`sp
zni~?^$XjZbpID)jny1vegf%Cw6U>LK6y0fyQLH#|NdfS&K<X;pPEj<jCS@`}J)msF
zr#C+=Q3uFpY}UuJA!q)eNVa|?cOy*s_+!@Zvh2rQ0AP!D)!R}nh(G&OeOGmd>k8*4
zb?Ja5D@uLbDx~`%zOcXkdY+?|yi!g+qBv3g2{#ygjPA!j|E2m=Kl^}LHsZiT28Bl+
zx?iqRUbR>Kw%$66QuNu%ntM|z&!5Z1#9ERqY+|*lqY_H)$&)9A6ZNsUU8JyPbAj<5
z>uol8upAye@|mLfs&^o1z9F|R!%jRY{PntPjC`f`L?5QU(m;DG1>4d7<cj6lr=AQW
zpL)uCrVrR<H+>XzdSMiAFomJbrwj*dEu%0~KG{{9H8LPzZipp6r(lYK%bKKP7C|zc
z+#HnGtU%Iz!NMX^61y6l1i9#q2qu{;im;pol37$4CJ;;Hts0yXQCEuKB6XT=NCoAL
zZI(9et`Va}F4nkgG<H@4iRs3C>4S^55i4b|<%#buNpY>YHLm^Ge8-PF1{vht`)NTj
z+woxZa(pn0|J=q;J4mjoQJKKffqmh?;yOL4^^VO%)$h??qPGN>aN-k(AK+o!6Gp>H
zU*iIvw~>y==Q*7|@nUDlD}8weAMp3FVdm41Z}ry^J%Gq0KzKT`XWk3wnFZJJh?A!0
z_f89jcxL?_bf5vloHqBo=SP@d!F8Of(=RJWL~vyTTaY=IJF9R^EOI{-2~hyW>PG;Y
zu-4?9ql(-U<~vv{>b#O|HlYfve{qr&#341`RGOBS1!+f3N?^;c1h)?`#Vp4<i_NXl
zRXI%X+isxV+5j2(-wL-GP>}=aR#FkU2m<Y%-B|iU6kQo4+O`t0HkWzTu1DIl2xFOL
zeNQQ1EzE*ATA-<cx3_SuGUx=;*H%c)faQn-D1rF8ynl#o<4rczaqRt)9KQbAt6|}{
z3&Y@{L(MNRvgMFLhnW&*;+wB0c-7uujoc@v{HQig8jqHRn+V!5u(@0^;14zpZ_1((
z*9+@Q!8s{qDaXg%_R=wP+#~=f*}i-E_hqS=_GKC=JvU~wS=;Tg*It$umbk|Z8)iOq
z%N>`GvE$!y&*#$HET7&bm;b=>?|A7+`kHI?wqVMJvNjF4hro5mu;C|%X*%vdPp&C|
zYWR_+<M+r0(#9V#!13^1cWwO<D}1`*4;Nf4Be&J@^cQtRJPRny*a*W<FN!V3%)$C-
z-GKuSNl*t5Ju2m%gDIo`5|rd-%;;ysUVHB+Yu)WE40jrb9)6_!5<i>Zl)4!^dSt*I
z#GbNd?IwjUb$9HrlT>%FB+74;Xt)sBY3Ki+y?2kj?@Q~u&gb_1O=%ObGhmE0v6T`#
z!PdcwEg+W`5eBApT1+XVRH3#uHK8pQyj1`9A1_U8;w9E-(;^@#f*^=Y3pft;5?W!H
zN@B^xKibq_P?`CCKUd$cXYKbs>+G}lIeVY8_dffa&syK_{;b<`ThF>bXYI9rvy8*(
zdI(-)|FSRtoe_^UR11UuTR%2n(4>rAjylQR$3FT~(Wl%_-}~P8t^U<N_HAkhpOJ$_
znA4E7uW$N;-x`M0e?oV)e*N$Jrq!pa`UZ%5ia+-^{zl!I`&nuL&(hOBz4}ZUyxSai
z`SK&lSLq}y<38@UeBcW<`pi#%?4$Z1+2_SQyueVlZ_uevpS=GK`Vr>K)eflBINhYR
z5C-C=d;9iX-Lw2F(eIoW{pi>KhSdkYAnQjTq96TCd@$}&n_o^O#wlSTeMAQ5-|>}S
z6?Y6{*!&uOY>giR?Eb#q2;lVcmwv@p#GS#U^TW?KeA73lQ?82tlExUW!fA7yO#YHD
z{jxZ1PkzjYniv0Wb^mb__eDndU!$u(4EtNZaI;@VM&nP6ajF}C1aP0sQAet$ulky=
zUDweUP)BLpXpoO6KQi#+0rzG9f=&zL(91um4>@8`fM=Uab@VCe=X2V!*J}b#;q6cx
zsXzL|KOFl0z!&`1NZ;3<xObg4%XKC=uB&03!Q~@@!?Zv0IZfAWf80mh94mv+tNfFV
zJW`&9?CN1pV1;O1D1&dD5Y!Ja{3w+SQR##tYsCz)3LCfbqhe~}4fqBu(X}8c+yc@I
zrVa1x(&~z+BoAdO+~&J*O&rpjX>It2!0h7byi@rq&qiD7mV+NQc$@29*PC&jP`m*#
z{w}LqfQ}s26<iU)p#Z)Kz}}B}m20)QQ=ccj;gsH%888gDatwT!sJ-wH7yCkNGZ8C)
z4$uIbc^(uxm;KW`-6Rg-500xnEe2DZGSn{Ztm<eOU$NX#*wm6zp|N1&NQW4{89)PA
z3u#4Jczp29i#XPG1mPiWN8J3OgCh;vIMV!>KlwPvk&iUsUe=SLVz0pQx_UBNs`zN&
zB(AFZs%ClB5l8guDgFAz5#lhoa#xPtCkz9!s-CMQd>V~Y#5kREjK5UzxaMKerGYSL
z>b~RDR??};>+AHoX9(awRe2m;lrQ1=$BCQ#RT-`ih>j3{7bWq+g=y(OF}V&C`$Y!f
zCr!X?X0Ftx@-CSS51ccDSDrJBM-$qVSQv?Y@aAMY?c(a@je40rdZ2beyARkneb%Hh
zG*0KpI|!65$xvDaehv-%xbB|(T3sFRC;!yHq0?#a#tF=y{3{<>ec^BWqF|3P_`lZ4
zuMd6r_pH9~JH9A3kbh67XE_bld=0&iycm-H_9s5R`V-&rZ|XXM|84c(=>t<k-2eWG
zPsFtk-}!I<yYUJ>r|+7lIe%8yMtu42{O95$cRpnakDt_OVNMtROW*RZ#7T@#=|tg=
z>*IBtV#MH?_do6h{l4${uGLq6@atCp{MUS4i1_m#|GCwV{Ll~f7MHtyxia9JzvWw{
zw<j6P{=d~<{_+2@K4BX?D{6dj?!!9q_k}V9GsN&QwWh<+{dK?l!}<u;U#heE=mX%q
zClY>FCsw(4^jrV%AB~TrQO}>$bsE3=*Zk_5HUT~`^)LUSKOEOdaJ>Q_`{Q(N({ZZz
zzxpr#i`DN^JNYvGU~tcg+yC>E`e@zv1t|CW{`TMg#qnXfw0z7d<YPuk$B4=)Sx%#J
zss{H{Kk<?HFk6D?{!86`?|1)&)d%&e|5tzTLjlMK_<r~Y*LP*p)<5~lUyS>w{c%H1
zLUU@kd4F)uDcbMPe|+`r-}$Gbj=ul<zNck`+bj<sw~Kc7hyF-xPC3c?<3IKz@qxLV
zHen1h|M`FNAFsanOTKLN&wSCBgmL(L{+mC)`h(x{N2G_e1pn)Q?PIHd{Qd7=ecQMH
zDP7a?|HQQ%e5|d_F~5B8cm0Lc@75i_-|=t#X&HYWSHJKJe>+YC`yTC2{^BpL{(H5l
z4}R!h5Zs+M(QkFt$|qJoQ{BVN2l2k<>prAD`<)Vy`-uNee9W=Q583HsU;hoiKRy!p
zXaCH97#~)v`_Tu#Hc)>4=RU3v!Tn&GDI{Oafi!ycLE1g~`M?MMDV=ux+_>_EQ{8-=
zkognC@%MfAcdfow{or5w6W<<pUUTIOA4l|f^wa;#|E#;LKddqAx5b+ToJh^xkNyuo
zwEBwQ@s+Eu)YStR#Qy3}f3$u>qKW%sKk_51-$TC?EktbVmpN_1oMug9+;>LZ{DAsE
zE%P7$ldE?bXB#p{9sS;aQFZk1gdu~w*?&fFGVD5hz(@7I^ebc#R(;~QLg9_Zw~zna
z_Sg{s`m?U1Z;X4i|LmXn51du`ZoBw;s(NVvZA7_u{D*$v`_*=SZ^*K*J$*vs=uf`)
zeKD>u?l4C4@j!lnU>y`!oxy>%iq<SY{n3xEzFKcbeA~bN9U%|x@8duFvmpZ?fP@Ag
zrYkO=!kEvJM$oDEROv%f8c%f^IO?}jS^`Zt`MgASTBBBghG)L)<*37bfPG;0(Kv^E
z6u~~$j`%+17>53s=D}_AOOvkY<5SPLJ}?P#4V&|H-s${iyF`+<wn@5=l+oVrANT<T
zqieeUj4|a@&V7OF8=s%GPrrGtf9T>((s$l)SdMRH=nxUMj}Z*F=m?sr+*h%VNCxs#
zY2obou8mRat03H2@ZH%w$dbn5&9+U)4M*G$w85jZlZI>BKY<|+7#{L-eCQg-g9g6w
zfXxR6^HFjVJ_6Yv2m*wUa~K~+q#MSJa%L7#U~#nruqXrz8#HoD8%APi0K>5h!lXeD
zI{0~*Yb8kcqhQd3reT4B9x#9L%fIsXz4@De>*ET(4)?2Wep#JggN^R`V=)k#=w0-{
z=nZ`spsI!1(V`><c@5B#HZ2^&D4Tx8hPGc{!fX|faMEeZU7TrRb}+)_X~a`{+*_A~
zQBq|bBbU=OFEpn!a;kIwU0?Gg*_l|_oO7RTaffTbtw@SIoCvj}Nk0t3UKv!>Qa>2K
z?}fA>bJZ?*RY^Qa;*<y*#PqSbW6IT~5;(Q@p<16^s3m<?4RA`~9eo6hSKPZCCoO3>
zxskOCc3(P+^Ym(;*CqQfHuE{fNZUO`7Wx`@tL7h2bN_=&vu*OxI$q_5-yyDzUmG3f
z98QSDtM3EHnM3qJkLQFWb%8;5mqQ0!FVeLE%W;tf!(;uUt}^+MABOjz_{$&3L8~y5
zbnEsr^g%&Ro*v@3uN32N)ZK_fT(kWq(oF`N<9VNUz$xP2^#0FZ{n(HGaINcq=-2(a
z)gS$1e|+^H{rmskh7p;zf}Ycr3oLbaJ3iV*v*M$WU5<M0Y74X#8<x88NoOo!1KRAH
zJNr?n?j?T6;bVe)G%>zJufF<?f8d)}4{sk<|LyncniLfv$&l{Xy}rF(-M{;`RUGP`
zHrwUU2gbxUm*X;DBm1xDRPGShY$M?EsxWtOck%60M?+-jg6*oKR`|wRr4^<lvDu#T
zv6cS7)ioYhswU7uDUDUl_7~%}F#3#3orKRh!wN-t3P)8bj6UKp0P8yr*vPQN7RdVI
z@Jl4Ll)Y&%OS+BPsh~Bk9nmIQSiX`Z*21o^p+!djo+C}ibqLM&b#}r5cNa`^4QAM!
z=TLd4hL>#o-?L7N9ewqYciJrDufLs<Y9jreTG}Rk%Z*HYXXZw8OzaEg)3rFn#SfgU
zTT<VpE{40n(jVTGy4E$9G5<fjO-AA2<X%0-=YRhDSKt4azMDnEAJD_0RvtPc59!2F
zI|diRG%)g5U=y|>hEB&r9&m(N#6cs6gBE!>V9CRgPMkc_cubGMfIMKlFodtuNh6O3
zJYZ|*Q@c(uagfc7FvvIy2T@?1M>=8B9nP8A2uzxV%XuLOc&2Nim9#P10po%I)5RZp
z!T&YRU9lk0pu)m0wk2p{F-}!jwI<}$@7FpYoL-$z>10y1s=!L_7|a<wuhz|#U;lC!
zgKU-N2IBlpNT+uDkXe+<x<y^*Ahe9Z`GPJ^%{271Mkt}a8gTom7s3bVl#}f*Pa5y_
zL&LRB>DII)MBR3yjgQyzf>PCq;PIqI2G_KZ6d&|a;F0ba#x5GYOWId61@00wfbnjZ
zF_<#$G9(SvLDN_?6hFUfb0{wTAU6hszpMXs8OZwbZR6L5OCS8S44)YInsZwle4ciQ
zJ{TJq4}7vRr`HS*(LtLmzoh$WKl)QY*(6)VktEIc>*eJd^iX3k6m}T|*Bpk2n(a5n
z*=ohWIG>zDu>y-W)@*l8&fNL?TXZ`1eV_f=aZ2~Ie(gV?>kU4z`kO!VH#UsH;F;F5
zeo()akui3A)mY!8OT5bnnZxd?=RWNOTIq@~mg$>r7wx3F^s%|G|NY;%`fDHi*y{h)
z>F3Y=yw8j4E&kkp_MgV)m^qV;GhbjwtLfu-xAEg<a8uuozO2Z;y5FUb9G6Y`P-8H%
zG}{Pi{6Nps<#x%`g>y)HR~@y|YOZy5w6P|BJ*NmK`bhYxw*dPoeLS<TYiob5>%KJ3
z70xP8Rlzz9ed?c7$!NnN8Sdatuc0f&Lr_)V(71NW>%9Rf>w4Iwm$Xjp2fK^TI*%<o
z^lY<O=d43b7~s9t->_e-QR+||tmzr3jdvG}=^6JFJ~DWYG=JpX=lZ}j>6&I6Pv^Di
z&w11O^;)eL8~RFWFLVh$-1hY82mJ_st2vX8Dl?DZ(%%Tq@MmN1r?vN^P7LF?I)anJ
zH@Z`p!)nYu@j-aWeaKiBrK%3xK|kKYW{xCM+@TtvvOEaU!I;o_P%E9uzfhxo;CQfq
zf=8N-#=sMY1`p}(u+T}3BBhxhd<Yv3-#ioy{^n!;mdpI|1qk@Skr%FQG%z82oC$(#
z0;D$uBMk=(bn)#Bi;r?ln|#7Nz?&Cv&>)>OEP=#L*Z77ZAABC@lTO-)fBir9`L}=f
z@BMuRUx&N9uG*ut7D@^uq1Cld2i3xDAJ~ZbF*tg~Q`4=QPBnP3S!O`o^|*xjz?l!c
zHR+xK)9VR-dNApbUm7``!%C6KgiGp^qYD*xtOiDD6RH~)_H1mMj`n&?n{Co-jf**_
z5h+XJmwuH_!|a&tBsjE+Fp3^qDVM~efg?09NB`>~UOtEQ0AD=FFaDkXBj%(1f{r=<
z<lLsBoAc-j_g_<SpC|Wv^U=6}SSN#-BmTx;{a;r<@sa;Yi{P#@K);$d)PB#|acv17
zo8x1K@6$cEd|d7abR9%|WKJg?<Db`oip3R3ta)_sfgd>Q`SZ;6u;@A*pj)pm;<_sB
zLs*v<H(Uc&8*l%GQCDi@<lv*;{^Q|ChG$;`(LGE={}|4FYz*1}PnV$ZYr;5A-Y&cx
zH;2vf^K`;?T`<jb!@p*KUmYx0H>|DbFC3cp_=JC2m)cmI>gUQ&$-_RL1AX2n#{AF5
zagc)!2Y}e)aa{y&g{tg(`_LdJuLk&YKIgM_9n{ZZP~|Q(8&|MZ;_w}IgL0Z-!NoR-
zBhSWJS1fUGeY#k|jf1kOp`<|&eB$6@OfU_?ew>!W+Ga`~k7ZRb8BHTl{mB^+h7iOp
zIAPLF#6E<{GZO{F86MvbnpTQwK_3{?uz?pGV97TR!?|G4aKZ3hc+0G$*XcNEbY0yk
zj1lO327;>URI{mprRGEBcDb!Q4S-u|UC0-Z9w%q0W7RqJo=&2?`YteP&AL6s0%G9g
z9POBeN8s^651rtT52a`rtJ6mnx0P5dh;%I2SBv25V&PaYa0-X~t816El|)G_8n{di
zsO__Oz{RWhDLDJzxUxuG>5FN+m`;Q=zorG$bX@vUPV@YFUELRNH(ZR@E@%bn>!@~P
z4$s9ni(9X?9CFTXnw*IKDc$4UbjCKdb-q&6PGa0<9yxQz2mg3BoXbTyS=FWgRbQ26
zszVRxhz;<q)DT?<XmI@6yokC_r8WT|oZ`<0%M$6(0E)#`b%M@aJt?F8uhH6bOKQ?U
z(k;5GjlZ;EZGU-<oDVSi{?B!btwNR8Hr9==-9yG{<5(KTs(s^C8%&dq>9zS?ux)fV
zWzo9`TLjlS-^v;_VN;SsdM@7m3eu)Oublc(I2Dw~s;B3N)$_gHnAB<9yW2NmfZg97
zCze{3%nFnrhM%6edWkCruXLJOCx;d0jjk|e^WzT%=@?X_t&k^>WDEurWAI@ojVCVk
zxsj*wGdN&>w5<`9la5aszKt)W+lHxNjYB#Q&Zl~z3oh_DXc*VLzyZ#<_~vikPE%IE
z8J0LOZTRHHDcT4${uqg5m_YzX7-xnQgcG^I^O!MVjJm}0bf-~J({R2ErK}C1Nk=I>
zge?O;mh|^jY0$Ak2{%t7E9sRv4GN(!28U{ZI7<ygt8&xYQv#3pd%!L&dqX>_>tqnV
zv{EjpJUb@jeo|6LTHtFK#F)QPfBgs?0VUp?xYDo?8xJUP(n_bSQoCW)D6VMW6>5M^
zL2sP5LvASAtY2R*bjk6@EWPPk&12Fw&C~g{LHKkc%)+_7)|ARzR?Wv4#Qd;njvsb7
zZB=by(hmXYNAoZa&m#E+Gl{O%>|YmL-ieAv^VKgKLH$Z|5QjRRpY;6?jKH!Bq_(QI
z-rfn;Qq58yFxe-_TBLO-Zzp+p4Y3(&!ZhQX(3`Pcu)Fd$sgzio2AcXiq%E}3oimO7
zk9wAjtm*0@y=8K%56@{2bZQrJ#c5vd%I69R&0d`Ht>k-rlrdXJoOjP(%zb|QQ&XhI
zk#rT=Io8#wYh;7J6^L&`E@5nrc1>F(`8?P^!QpY5@rc`z=1xYs4Y)Qk14lY^pb2~v
z-}X}5S_M+uP@8nf3kR{LGvVAvAc&ZW1+k#epa6MqA`T5;cnE_>*l_qRxP9RKkVau$
zXv=H<<QoqkdOVg3I<MNH00slj%cj>4q$X?ZY&7Hkf#7E+{G?i@e#4*`D@r;Ji%EV7
z%=>&2A%UR3WDJ~Cup@{sT~2f!tx$hFz#Mk{t`_<-3O{SOV)9PI7QX0L^%;?g{>0sL
z&ssEa!b&`@tJiM1Ym2<&M2L~6l021ZqGA-XMFS&iAR8am38Jr$%%KmtGzR3{(<Y`5
z?ogPV3%DNFhSC`a9%*=xVj4*p^B}!@Q*}&ftWnF)%#1s>J+;y0m2u4?d<gfrLHn2j
zp9~khVnoBIJ_$$rk*bom_|cWn+Rx`}Fu`M;94=K9sSr$LscCos06+jqL_t)v$Ow9g
zVl<urzN9}co6A%wBBCiT`c0MHgf>?3n;J-ZjPcz4)9p%koTj$Nx?Qa*+8{>Y)Fy*c
zz$(OCH2G4>4642mJ*cau4cjd5^5b14+9mlRIJ@W#$un>FNXK{4FzhavbIXhFqd(Cl
z+%Gx`fsQzElU%zt)ayh`doaB<$zd2ip2~MtxQ57UgVbeBr-Rw($*KRx9m3DdTiPSW
zN6Bw=*D&9i;K~>ov*lOH*pxuxra3Q_JN9%MTiUg-iCSWNHGut*29Y-k!q^_IVhk{Z
zJxCG<58rsUe*$N`Jgnrfe*y;{v>2G7liN8J4VvT|A0EJx<}fsH#DRkb&go%jO-bpm
z8QKSt$AvHh8)m_RFfcgsaTdySU`!r(gpFf*N(u)&&h()RJPPnhWYbVmIA|FUdf?<~
z0rYDBXwXC%XrB;+M8wZdA(q-r?d%FLjlinkq>=PDEiSw63DSa6V0-4#Y2+M8HOWbt
zT<-%3Obni+N;*GO#;V5Rb-)*0)4=u5F?^};raV<KOg}y}@RT;nak5Ga5507oUQg5y
z3&*)-*4=SsD%h_<1MAIzd&>N!4$c|-a~QYB(UJ>2)%a1-$0|4xi|!J@(7D64Wz00|
zTX;5)TH<NL$Gw9`kRLA4LNKfe#7SZOP5-41jJ>Y&G`FHJ))+D8DG>J&lVAc0`ZO`H
z)hasW8)hB5j8Iklbz!y=s;0G_zQ!q`Z4F3Y{IA*<b4yyMV~k2h9om?Vxhu{O@kF}Z
z)VgodC*Dj$wzjk`nU|G*zLGCXkEf9))gFB$`ph07fZo-c>RbUm>3&`2&>IZHcRDRx
z&!yAv$GVCU#%jry#tRw4bZ7_T@Qr>Mx_)yVM(igY;6ZNYD9Rfe(pVGsjg!iFQ;fk~
zDju4Sda+5`h)VMcmCMKe$U~m<iR19W1D1_7J}}_(;IIG?#>PpWc^MuWq>*nNeA4jA
zw@(_*d`X8s>84{}Ny*vp>bQjf&@LwkQJj4km?(_Er_e6A3us};cbbCXZ0se%6%aQ3
z0*3?VjUE?}H0bfb2mZh|`IBZE3chaV1qfQWN|vYBt&j^TeS9E{g=W<|Qax*8P}~z{
zwGK51EnsWWY1k#HC5lv+Ye|wdWns&ihQvzTCcvI}ny_Oa6M?wzTlf0n4x_h+U6!5d
zUB8g)q_EZ*v54@Z<MGL-rc&85w1GiNhNCo7mnayOKScwVrvVoERjC-~r*t)+DVgl0
zZ7FiVG0QFbH4D)llXNYz8LWvr<eVDxr~oGnbvJwzs4RPPRffLZU*r={X;eRJA^Bb;
zDKCYUepA(ufCI}u_%%H^1vLT{-F3W9i`?}e*S#SfUqkE<88?SKgwDF`4Qxf7;^MAT
za;~pEteT+xP$8AVtT!|hZAA)vqV2_1UG!Cq!9pOd+CuARiFjM9OPg5}?E*O>J(n0V
z&G<0V#%^n)reqk$4ckn2K7JpV9RAY6yL8hmt6{CPX8yQwb8Awakh?ns{b&q_ky-!Z
zDnIql=eVwcyL`15i{f>aaSZ0|G|Z8)BE9v?xRH#)elwUuew=Q`D9nSquD%OHc^;KF
zmWtY?e3hv*Iu=^kEOAs7wn`kEcQ;C4Z1?mDEApIgV=r-N0q+g7f`N;jHcvBt4hw&1
zk(P`H3RDhw@}WV#c{@!>$u$kaq(UqgGG}T+CTw^LOdf_?hb<sJG;kIMpLB4LfjD^Z
z<}rQe6F0nq8_EG5IG%U(;0WU=2Qn2W4KS$0FJKx-Sp@0_>Eg~@1L<T-+6G1^hzS9M
zFsBVtH&`$DQ(@CQx>@;#U6eW`A{#c`BIV1Km6VF0d1|k)%b0%U)i2aBB&I$Z8;xF6
z4g*@Z1;&Q-27wnEdO1nu;RK6^^uu_FNQJoB<_@J+@QMarqXwe)Fs@Vh1IC#{bOulN
z-b3(@!-0D~W+2J9(s*v1YJRcw%@e&zFU~zqOU7oy_@YH!D$}^M&Es7Cu2vH!fM`~0
zi1a~8^ytzmKsdaV=sA0%c?LKecW5Ozk~rnn>9+du8m|+l>I3bN?WvhK8)Sh_C&@OF
zw<2p@Y-N=MDL3`G)P|_iXjjq<ZQ+HJhtW6H4%W@A)?2hCDR`~pjykL{#ty*GTXfTI
z#+|<3?<0L5nEjjzL>~>H>y~EM2el^*9J*?hv2P0Q?k|kDJ;mGwCS!130<K+rdeC0%
zS?^0~Uvzt`4{z(lO!U=VbVkq1rAm7=_KE8&B-U3+U=-$x34U}+W4drLY%6`5IvBmM
z3ny6DMLwb1UP>#(*7#PBTO{_!9M*PD53W=U_D|sN^^gud48t%Z-S$wzJfuU@!kE93
zf<HVBM;K>*rs+6z2-h+;4Z>t1q=C#72BcXyd>jlNwxDJLj`M)U83rGEIUmQZB+~(p
zFtS>C_|SmA<uYw0MOqtw@?O0QqwoSQPd}_8s8$@+U0mp)QUwzMb!#_7L$Mf@YOP(<
znA2a&yAGLuGv$<WTBbH1xtg-J!L_Ebc~Azg09|QgpMIH6)DEWE%BVZ>S(_K%Da_)B
z`?PelB{sEF8BMySDLF+0C)NOcvf8Q7)dzc(*w%wlc0;{5UO13yxB05}#FLE4kJYXi
zpE-GWbJQes;nm!ucu9TCd9E2wWwj&v2ZaPl8%oztunMTVXlzF^{GgTQ`g%^S8JMTx
z+ZY=Leuk4T&_p#$YX&Rc&Eygvpn+WHffkAn-FpqrI;yTxDn@q&hugv(z_)-dR0EBE
zh?MKfPcnNj$V<?K$@5D1^cqn8Jn;cH?Z=*E7{1dr5?smT9}G_^Ap891=ll5X%dJi_
zV*qBqNHZhPO^ZW5@uSo!g}oTw_2h}ok%*12l#r1f+a&`%c|5j%l8yt$1{%W9F%8oM
z7Ch2{!GS|Qc2DO+-zSO{tZ4&lJm>&tm-B}nkL3v%805~#_!iK_bHrRg@PPpb-;7L4
zNp+s-l4d0#w0W5ZzLja(RzzM18-|S!-8TND7bgvPaJbT-!7pBQ(>V+6&@9|U+$_&R
z@X3VabrEZV%|N~($UgwGPk`9iK!^!sAMjN9n$6nQO|aW4i)K7edQ*vW5M33(Ei~{4
z2<gowcrVXdh-iqs){lOqW0Z0|A0*cRq{oMc>KADJ`b>q~+({luQ@xf1sVm)iTwKw>
zrE4GzHtNG^e4MKX?$#<&c&yNHEjMjnbg8H1vb)SF7fHM<^zyL}-hP;*PnT5i%r7JA
zHBqikch_{2Mmd|5ao#ViAlm3r1~!A&GCuLjDDL!i7Gj*$pZKsB^KB@ZKRfEDQm|_h
zh1cP(Qs<TJ^+94*_v;!JdWNYJGXjZOmXqbxsaYVh_rPS}C75XdwMpOBUfN4>2t#YN
zFv3t-8N7o+=yM9&;N$xqGsmIq^7o-OHtZ03edHShhOX=R*z}$oeHOWM7@Em;zc%*x
zep7F4&2)UOP{bUQJ2>a2q&#m~;q@MeYb5UDr0tFNLSY!zwVOL;h1m+i>E8z}0&n7a
z3yi|L`&ixG_X;y0#n{7Jp3x?0th0%Csf^rxus`}xsu!fTMUrl3czp8d0KnUhN;>fz
zjzODz*B1E>J01SuknS|-=W#_h=$b|@FSy~F24R3Llz~7*IH%+1!dfXxu2<{e0!N<d
zK-<D97!Eop4j*S>37aoI_X>lHgRYfon(!d(C+Df;;x;s(fdS*rO&Ak%m2W_m$l^7y
zt~<v1xH!JC5E)zqNYcZKJGlm8lc8ZS{qno6>p2ATugo_re6-@dj$faz(tT7q{c^aY
zam`zn!(}a)MFR`hKpC&6s~`_kXEq<6nYh!{-$E(-N2U<3G6bj1x>CGpuVvr<S;Eb-
z1}T9FHIRB!81qzDT>rrxqpXk8`i%Uv9ts0dYvr^iPAGFBT{KWMFt!Hb-fvC}YyX2$
zm=DjTo_*T>o%U+Tl}-t>UrYvK8G~gh!ytV1$UVc4Wov(YqhP?t{)pX@Ft$rh>gF~`
zCIsTZ0mFl{-7>`zE>}$C_D{ollMNl)Q3;a|9p~r#fuk`3m*as$dQ%>7O-I4RC<4_V
z5RKd<;B<UDm_pD!!eJPbM%;x}a3hZJhBx1wHZ;I(79xjn!GSYBeBwd>So@ghT&#Q1
z!X}*(mdemtac83eHWfFz*GQv%$Sf1T4)^N*ApH`U{}Mg4K;S|$PCw*5Z787w;LQ{M
z`^s=iIr|jNs;kR!;6Rj43hTrd!&#c$C-17Y%$f@L;fOIJ?y8o5tIEM1%pF_29_jYi
zM<;2H0++25?W_zs{q$C#POX77Hl>roOKP`qf<Nm=mU9YyHG8YaxG8w;r^&JqhZGY?
zBAxON+URsFmvor^u1$UGkohFujt%o;%tm_N04r{|22}Udc(c6^C)AD+b({6sb||MF
z(-KUh_(L>6)zEj+So#!eAo^6>I1{kdY5XBP4uhpdx>d6E#ZA-4%_Z?T?O*2Gt~obO
z;%a=}1#=4Nx#M-0i<)e}xGcNy#>#8f?|3uZJ_+G$-M9_!!#OTLl{Nj{o@x8jzKScQ
z(tY4>-#)A!9`%)#+xN&YjHyXZN=(CgQ@bg9s=tXRZz}L%IqnhGJ}piPSN`>Fyz%)c
zqwwP+--Ma3wx=rd3F+p_qX84A!g)MN(7<UFzS6-B!ujA}qvYOT@`#(ReP|f3neTLW
zAmTjG$AQa39N%!nfrB3W4X<EwRZDg>kj)(5gb16d84!mkFodCH2BeYKbWS%7d>$O|
zgrS84*0fzP%V0XW{CSxCaH+F6R{UH8X#!fmUYO^V@bWd_&VZ!p?lQXRYjbGfvdbM4
zy^6^FRr$TbbJaAzK#O@8g~Kqc*ORoWSUo=LuH(6cD13?riUx`XY7Kbgx$LpOE^Y}F
z4HOMbqJc0rR>MiU8cU~tb!`^LBMw;9>&rz9HO=*|$H7TdQ-~G~OrU`?Z?hT)u${c<
z#O?FbySiUkr-gMYH{POLz>bJ9>>&<^rTrq~+pWF@bFH^M*+V{t+!(eOF`!M*z9uDU
z+a-+{n<GYF9O2yl8HtTQwo5|8u!N}y?4Pa>;CMXP1522v$=`I~?`tZ+1+L4P2KnX@
zun@@|#BJm?K?_FQ`4F+t;8PG6hPatHoj4CyKj1?L-h`oRTnfaO`k-xC!oZrpua5x7
zvgLe~yuqJ%acvr4P?HAr+fw`@o_+zNN|x@ZZuf(>-yN1N|MBwGzligThw72nS*Xca
z+#XLp{o)=JSrm^za3T^EpEEQu04z|@T6OWuREjmfUDQi8+L%1+L_e=A@;Xqw1~gMw
zg$;`gS{NrEVu5k<Mpw?<tsbh4QyPkUl|=YaTTs(8Qz80^R-lRoc4~kjMk8Xh+Ofvk
zoeYO&YMcqVB<PqYTie8N&#lL}HlWGVkiwFf86(wLPWoh+k_&x~T3E}yO_Vl<V{RMn
zG*4)K6vM2AA5P@eW2FA0dZ14oR1dFSg$q(Z)t_P=hFGdmbuEk{>13VOH<j^sW8AFP
zl<^IVL%L#b4M5xsJbqOJPb-aGd94U_qPf%wGX$o3TOsDUx=v>($b>BFvdl1dH;a+C
ziS5~_2|ZT4*@odfANPYxA!TucaB|N&b^BHypVMjF+v<MdIQi}TgSi}s7+2fyhUa7K
z*={5o-xYZCMn+;8u%C2N_)*ti#5EGt7#9QLaa>;mHWf?5#a5Y&E~(Mx4HuYZV<rvT
zC3rl<{Se3D+x}_;acsMl4y;cc!yf~fdA9L#nqj~PkGN?n7-=@9g`t(i+>vR-CK2K|
z2wHH`U;>^Ck>lt20two{0dK1|@a9E2igQ7L#hItWz~C$sco>s$(8FE1t*2=D+tdJy
zA5H+q$-lCBXsT!7aX0;m#EhOBe<oru5?P7J=GOzpNK_{v<N7*O($rTOI{9$G+#f0l
zqp-#c7WX$SdbAL~(J#+@*dYBNF;r#f!8#d=Ti}ZZPN9J`(9HRf$04P3Z$iGge#wL9
zp(EOmvbDpy#Lk^U67v|B_B2${18r1~8CW&NAEW`-c2VOXwJi!b*$Sz_WB_Kr!}SkQ
zw+a)t0XTkyiGvkgMVPuJK;Ny-GPLn*OEdg({VAlLg663-=(03hz^UY!p07)6PG?l|
zTJ$6{KP)|9V3jT9PR7?;UFSIW{>)mm@3AfJK9-ogUCIgJIE1}bRNGP4?G2<j!3!aH
zDOM;NAh;Fx;tqx47TjG*ad#^YMT=X3&;Z5VH57+prFaj|^M3Dlac<67*Z-UBF?RNv
zYyRdM`x=r&Fzpui0=e~V{U-K&V(7<4DeB6r^EKjn@ej}OX8sqpuS<|v7Bfw-410z`
zX`%Ywr01r5E0^4SI%MnsULbP6bDn5*hcka$CTY;Ni@imKf+j*Jpt%jjjdBKC<+7ps
zZf4e^L#RKZ2V4yEiX8On3GQsgVw%$A+HR*<nGC^F$X?*QT&P4Ppt^|>`7_IUdo*Td
zme5i|vvrpvMLBg2&cg~!5&B7LEc$la?>xEifHZ-NnXE2DBn9>0Duc;cWow$yQG(>&
z!E3R!rEE?*8)e|0X}Ku%pB_aufzXpkRwK^Vmk?WsdV&Vn3yefU@S-%EjZzX8h~s=d
z2*RC44T_aWFJt5fS0S3_V+cmOme3NfJ*Iu~wJ91kZBCV3V%iGSw=7cM-n$uC;0<tY
zlGvNADScqsReP=Bd{^$r=kx9JYeat=+6Xc0DU8QgV^8l?%xa*)f2NsWO++MiVk;AV
zvokqwnm><MAXQt2XHB9@>2PQtFSvTQw0#mg{K#Yt>TsqV6w#oF(#d&!9$$qZ7K7e?
zslLk3cPG}3`q)+_DGVuUN~?*RZnLGq@xcw{cMqt62MLYBNfzXX<g8S2o_9x3<3ESv
z>C{8_#96TaY!<%}=byYAs3Yk5kTR-<&dkX69AOJ@QAP3}knDwIoS!=iYuBd_x+YqK
z%26??JL9TaxEHc82ISQJu|jvC=AbPj5HI>V`nS!pUr@2}pFa;!j|R~_BsV_>-arT4
zXnNgz7axMzoDwjgkL2a~LgerKuu_lp`FiX8%!z8r+EU(v%w|}!^i&T+yPoj6`(N`J
z^TSDSy&VqL2JsVl=g@P&s_k6u<(<{>FKw~J?&1i@ZMlg|o91%RIak?YvxL68Ib%(s
z8A4oiz==ggV5>WaPkS5&u_R#YX+5C{Z>$L)=*cwG`w|VFw=!OR_@lxfR%wP<0j;ve
zW$e{BLW7B^;>{|14#?Ehr)L#3Z7VT&MIz`5O)w2(wo4Ot!(lHlC7O2p_8`|U*g~c4
zlrD!Dy~B2K<3$$#?g_imW)KcVJWJ8tK$e34JM(fmps^KF8DhxEUuGR7h41J{>oyJ>
zNB)IrU7Ow0;rTJ>!xu3{hq)fU9#J^edUWTX{uUjJ-tySkk$VR0EeTc2Be?M{`vfVb
zucE9=HOIM~s;IuwbViPfF1PJCfLU7<@LKU!D?UYW`LyT?#X6??Z{w3#!yj4{83?Qm
z%H*<v!@KD04?yWv^L_Y6BjFx>JcEO`je|#RnItHjYEmkbD;7q`ND#WSMMz~tgG5b$
z&AazqN@w3bOY62h9HEezS9zFGzunC~!3my>C>oOfzCmcbykjXJjzXXD0Y})Pc|wYG
zH$ODgbJ)+W#RAvt(~Q~gdyi{awQKAbuCBMSdh0uPj-;*eK|fn-hs~*w(xC?4BBlpD
z@;JuEx2`PRJ*&m4>P~+ch;g2W0=0Qt7OTU0c^T|nEkk>RhFOe7Hk-;2LIj4T_I*Le
zZ=klq5PUK5+0sq|j2A4wHYvd7@tK^CeH*=xVLL?~0U7WlajjK?v>)Px=>Y3xR6W$~
zzGzFPFiqo@{8jwpZQeMkCma8lD;FjHsUKu54Rqy0NG2mZoJjh*U!62@sNP=)oJUGJ
zKmSJ?ZsvNb3yy<W54)y3kFG_f+p`@xoY!XR1u*YB+vGb8B>Gwl6W5ZvV)luA3;;a4
z`{K;b1qHvG1$^UY+E%%bJDXC5nm6UnC_lYP2R%=ypjxT1y|4;7Okb#Fq(&xO>;R1I
zxLf71?SDt9_q;-|xW^%?X>1C1oB%yesEC33JZq8(3<+E<nr5&vbMM-uUQ|rHCNtF@
zN)^f=IOY6RFZ0CsZ3(@aaX0@EcoJm*HM9^{0^F}bh_wwMz&o&#7s3a@bJS93V0gV{
zb3Zni1B)!S`sne2{`p26Hfd}OCE?w*hgauw3P21z!Wqu|YsEQ|;KRZ8+tS6-ClBk`
zKd89ojI$WgSvcKdL>V`&4K?P84Zy<Z(Ui91x3UF5U8HEJ7Xd$J*z8>ena?aOK)3o*
zs(w1m+|IjHTy(vhbJgU$LGZDyxO`lo|5M;(?aqg-#Ai7;@Qv#<*Ql|<u*P!7fcEmT
z+j#0lZF`#fRPPP=?8Y!b82JtQc{|;RH!kMN_V4dv92c&}g%>8tG|D!BsXJxqi*rV0
z3)(%Hi}6*i@X2D2#w795q{OTQA3-P30VQ<^0#?T?N^qI@_@V+!G`HU`aEmm59;_j_
za$MXxV8HmN(eV?v=4K!AJhFbU5P3VQ5n7hIUuSU0_f64X7U&Qsz&p0(C{sf1>E6nJ
z2AJszT1;?S^QNAU+|s{1TeG2@J87ELt!mE|+SWRq=~l(PL=~Wj{Cx#$g^IwV&6}Xk
zb^HSEY3sR@3D(4boQbqrnyyX@+Cfx?+Qhc$#h)NHlziRaQkXj7&)h{z<2mDTAFZSL
zzt>}8aoPShguAf(P;UK1Ynq#0fb`<?-eq?t@)1c8Xr$O|^ViLo>Rbs0p2R4%JfYWj
zOzaGDy3!H|?m>&yR`g{sCUE9QTMPqGtRyERR70ZRice)a<oU7TwJeOIZnNWp`qnL;
zz#rBL>7^@r;8IW1?&VO)W9Q`C_xNVjA5GxPZC00JokEa)>QJMMuKsAYoGohm;m3-I
z=TF;0-m8N;f4+1;KX(J~*YU-mrNmMh{cS($n3$`EP^GzB3jUN=7qeiqC#~<oeOw}4
zmazm=f~L|0rLrc{f>8otp|A>!)%@`<t+WP16z7xW?zSF{`8CuSWOyK<xw7Zjdg|V!
zS6D3(g%sRhn4iMf+aH+8$_egk|7<7EE|*i)VVCJ!QwHqvvA$xfUO8gzG(B4<3r-m4
z_FP*V?(%>K^nfDXy68kwgf)20KK3mV&13pG={T<&Da}(FbDy(>@gvN$7WFp9SyrU<
z&A&BCQ!i3)%t>c53!M4BqNAo{9LF?MfG<5|F*Uxx1m@0AG2sW5BjFpg6}&;yTX~lP
z@h2sbu#R4m1}w`U<$+)<IVkxHP_Fs8WAu33w=zkwo0}4PD9nGGWmwTg$Q{dq3L`#r
zQF0J6%#i#1@hxTDjUR+Ch68BOg*J}DRc>yZVDrstrosjCRYp*SP8UYZtMG%`b}HgR
z7imQdW#T0rcxN8L=lwUtwlJ2g#wX{CWk~?%c%^Dmm6Lr|Y;%(dl%+1xo-{mx;;g;(
zh%!<$QnfjaV-w@FL4ypx3qLLJQO5@)zN3e7?n``n*ukMPa49~XrLdaoflUsK{SpE)
z-0zH?a`Wf{yq4p?)6djeJ;yJc!Tj;)^MT**or1-b??F4J|J2fYYN?P>Qw8}OD#xXx
zPfet5Y~Lr*Ce+#8e<o(dDT51|vXki1!d}!aZKurdO$QjL)eI8e_!?oKH;Nk{Pz=Ry
z8ZkCvanrJU_cZ2i8IC)|btS0{aE&jb+h_7#ibfe8`zyOHr}nJuLoS789q~T|txVj;
zuS59N7?#8oHoKQrlgloe2D$Lc6FSa$Jin4#$h0KfY26yp_VE!VGz1~-aC=nT{_~s(
z>PR!c5sQWAx{6g+XjT@I8@Jv~q7czI#NOB@D|*T^p=`H^C#!*BGy-;DR`ZKs7>E{n
z(cmW}T8=3~z@=ie;;@E|$2Mtzfdof(0U6j}JY&I7d9qk&ES_|(NWr29L5nkeFlM|I
z$vCww6i3;_>56gf;RMcBj=3)OG|B1|i~*X}`((b#T5D5iv*`~BMop*1u61^&)p9cz
zfpI@@lXEXD7WqXqFQ0>wYZGno|B>Ko4Us>0#{XOF?*Rwdtd4}ukj)&d1U27g1ACB6
z)4j!tp3#)VbM@ZZZyMCO+~J$onzsdc>lu%XyL$OiA{H1^3E}kv$s$6eAPjSg+TTqX
zopYE2v^0#D-44=5yc%mWJuix^Q|PbjTEw?4f(H1b;iu6=pn~X;Yc=#EZ$i2vSI}bc
zUU(gICl$g|tvrjrzGQ3V*%D)W109iByjWxgTIaAIY$=bz?g;@PiA)I5n32AR*iUXz
zwn%@ozQJ}v9Ws~A!~%HY?@;=%xSnvJJy=I7C1`RaD2vDmCd#)-LMYltj<U<I(mVs<
zn2{MA!u!KHAryD}MJt~qmsob>AiU2hfYR!oe0I%yJnkMzdXCY5Anku#Jk-ZR`u7!3
zG9NWP1TVwVoxOA}h*8{nK<hIkd!FJ*BA0aj(U&bi@>(%Ps9w?y$m7dWPD`7n>1TNk
zugo`m>s{M)W?nof^{P)6TQ;MZkR8kd-Y*Z?kD5!6eaPf39r5!U9O7rZ|LhqXu6=WJ
z!SooNivvOUvL3K>znvCrTQIm#*b*wj-`^FF>yGWR5nAvEzDHxQrJL)#`WiU!eY=H^
zP$=2%D{Ul|>SY6&x3@o~Gf_kcDj$w$Q`^%w6&DG`t7HVzBs2Dc<!IVdf7qob<i~sv
zuv3+S`11##B$O=OQ$Oz9xWp=>QZo@X`IvPE0~gM}+=nrmB`4)J*W+^7E~2ab4YBIy
zn%UkTOJDAJ#g|Q~Qj<^ln)E=7DrIB{l?D$kuuNN;FdmY->DDILZ<|{v>rwKlRpld<
zDsx1;>5WirN85bhg~mnl1Ybnzd8&t4lnGdbr8Z7kL7(+GiyMmHSvHrv!mZ%OfIbh+
zcNhXhik#KkCd-QTTvAWmuI%E7nUB~!rDKAjE=A7kC36_7pY{_X=<^wbHimZe&9F!&
zE**9l*J8O3(Ev0(m!x<-C4C#{Tq-l@@%69(gGI&R^C5<(<93OyZC|_Iya$84fQ=7d
zn1|8$OEFgG%6GWIj$R7@>|KW0kk=pH8Ptz|`6P_V;m$%{<-mzm$<7bDoayeT8{PYW
zNA!;}kIV|My^rN9i9}brd*9K;EvXUoB`~%ygh38T^g1);9iJ0|$Bn(`i%+A{h49bK
z51y78JLizirPhir!}5nu&K7`;PI=RY?`qxZv=O*)g;I&YLmKUjTDq78#oTxKRBbQo
zLwOr6&pH)dX{O0p@9ld3<hE}2w2=e6A|nQa|5Zc*c#ku-QB<_b?5|!lGl;s{yb18;
zSo0c<-dda(?(n?y@AjP~AXH0OJ$Smx#)G$rFLNj`P95fsmr>p`Bj)`?2i)MCXT8Z*
z*8Y?>eOrB53Gm)smr209OZb+WP^5Y8L5_eJq=o8Jdl<`5;OGF%3>(SLrED(ILD4^I
z{vbjta>2d0Tv2USqEB-PK(y^ziwz8iiF*$W12FGOPTHE^xBu|4mk2`z%sP64n<;Nx
z-E7pM;N{^wJo|=vgkHs+dGD^$h!Ih+VR)=xYU**W!t^56aY(_N6><06_mLJqcO}(<
zua^7C-ZHr@N0|Kf*>0*oeOWfj@t5p@6uW8SCQY#WjYq(b=#Ot-SDB_uUt?^@{ArDJ
zU^IYC$^n|p5ie!i_3sU7w+zfaKz3tNUEOjU6^g%mHxKccCTFym=+F!bp8nAdN#`!m
zdXD*+8hlw}_IFBRwABt}w86T8_(-#Yo(n`!MMEu=_@+uAoa>Ft%XdcB+JBP3WMp5>
z-?ZWje)Qk4Se;92&Dcf#3ulB<%{)ZiiO#!S;?5NlzLjcz{f7>M7w)OUH^sND(=T+S
zEWN_K`K?C~mbF}U4h1F%tJU5Ag}wiy%MhRy$wJ}#R}c@bcARxpOd)HoN;+ut>Y-$T
z|KzmT*E<lLK0_1FopMfD%w=!z)2*Bj`KNjPVKy+H_VxjG-wyHf9**yKKksrGc#_XP
zNr33Zc9*oDe~4*<kwK#xf`np;FuiB!Pq9BkXf9T6*xJW2pHGZHHC`?gVcA(3I-Ha!
zoY^tAMKYLGe>ps|H6*|;hTi8TB$fbM6;`L>$)rJVP)2CK2gOsjCdW#5%mhbpen#xc
zJlhK9P-2XLXbqJr#qgq3oOK(p{7T&Z+N@d^6S60erbaY7`CZFwaitXsy@2&^bBw}q
zv}HMg$jUg?nh1q}8x3X{v~=WI$!#I#4?G|7D&-@q7T{4WM~}1=wq?sKeS@2_P=@+f
znt;bzJut>@YC>X%;oTM1KG7A{`w)XE!)b*r!r@;cE&k|11sJQz+w-*xRi40C4Lyky
z(0(uZw!<SqRn$SxuO?S{$}+Vqe+>!z<9}E0GyYPFrrhRKXyMRTee3dV%dshnqiBMy
zyK?(7e<tUpr;%~ya@SnE#$vAF&csC`Zq5k&v0Lm%f7Dvl?|LjN%m}hCNT!B_OI!1w
z#LjtkoL<!cvDG;LfH)1k1WUOmTraH%+T(<_Rjydk<e5G#W_}g60d0A)12I7dgUKQD
zUI0E#OVArVIEY|F1x&S{Qyu_E!+h(1qaTRAfLM6G*pf!+$k8&bR?n=^VqpqyV%}uQ
z?rb}8{Rj^sXfF~F<t!)U5{M^P#Epgw_6m%r%=)Dk1S}l5swSLs;ozvd!~GigGMd<_
zgO|Ph`RA7=V>g#bMf>0j2~qio_j%5(!N%!`FNtTAP!JQFo7-hNi{Dy}lqcX!WzZ`b
zpLrMPLmAPn-!=7W`<IOL-<Le43vuJl*1TccI5FSmC1RQ93LD&{>kHrW{~8_PYRMei
z>a>5L&iTzGsssa{<}}8V#I$oG7GV1?-$+C1pQ10D3~%Up2%<b#i~oi<pur`+!1L)<
zV-HRWp?qa&+M$%=dp5Dgv2fq-bsOJ)7}aSfq+6qe?COc2GzXIbEy0uW&ug`qopL9=
zw%-MYdF+WD>0QUR9=s^LyXtWYVE>kXlbR>ZMQ^A^)%#&$U|rsV6|un8i&$A!am1$+
zLSw=7(VO08&PwjPJ3Qo21)7eqJPb7l-_dhX>nJIczo&-tB|6_}W`4PeKCIbRCS9ag
zfMZ5-9pGD_Fiq6AgrQ+7XFKp;Dzq}t0vcv|;S}T>O}XhaklI^h4w?JmOdC<<6H4$T
zl*CPve%}JILo`S+j<&s$i7QGQ!*pyhJubkBL<1PxTqK@C#bhn1d^Uv$M1)=ZFBWZo
z&{m;(ppg2Tcwr0V^i4`}Qi=&Fh{-Fg?pl67CjMG_8R|8(UBb~pO4Om3BFv&S(%Y6P
zkQbY6o{23i!LxrGmd={NoAK&Eq0v6<dgxtk(dDiId>@1}O5qV62DFH#F=6P|2vecO
zR2GLsXtaeGW>hAbe31b>&(9Lb&A9{#Dv!7awmb0RO;aa^b|e!&?v%FKEm6^Ccc=2?
z$q9Z~|Bx@e>SmnzN6X`i2GPP&F7~ma8Qsl?2g82PrL+~-%^-jFvMCx4`p|K-^#TpZ
z@_YXI)c!&W_wOLN1iQ<}#fP04yYGn>ULv^<r++Glm#0?ZWN0QVpUA(-N3FHXfF;z`
zT5hVuSc1}F`WU;Ko$ikWUbyA=5f-Mpc~(91A+)<8a%-HqctazVF~}>j02W6B&4>>R
zmRs_umr`h-9;adySH!u?LlT~8>(TQs2RgQ86nJT}xm;p5VoNauK;#=xJoG_@wg(@+
za23o@=SjzBoPrAb6de0aohdxn%Bt@Z!`C!x<kz&|1YV$-<38gU1PBm=mcTc3rFths
zHlx3>PeLAtSf1h9U|C(EAb-#oCp64SRu(z?Uh2v4)lF(~-GB9b6yGJv(0ld9cy<!s
z*DRD7okgRLqwH0<{ITYD&;`pPO{#6QDnFKfpLzKPuOF<mxIYm7N<8qRZ1y4i#SDxy
z^;vW;K}Doixv8uTGO-q6_T#Ry*Zq+hqY|!<k<AtQT0x`a^w#LR`bQKK%4EV#c0;4@
z7aTM{ft&q@5<j*^4V{90rm6eHD0Z0yd@Ap`_5m|X@$pipC145~O)u%R)&D5To7Y|%
zZXJV$_cIkvgxXgQ#spGE08Q|<oPWZv+gqK#xJS}!u<!NeOjPBgUk+jzG25k>9tpi`
z5=Ki&;JSCGvnPj)Vodp`WU`*9G~FF`pSgVet0`pA_+?t^KpwC~S_NK+SVCNLc!TM(
zlcLbg=AzgEgi!|kQZYYZ1v(rRe;)lj3vQ+A6~q@AhxzB;mS;XadtnH9-GZaT9JZ7b
zp~~L51T?T0efn5%J^J1h499)5RX$^M1}CEt3%&BNsN*vThtIe!R|KbBSFskei#g$Z
z^={Dt$(bpd61b2Wc&ZgYM&p<*$aH!*j4qs}E_Y$<Y^H)`Q3pQ>{3%EDAl@U(E}e_2
zY6*AAaudLlUJ$!=?P~9D{&|T0N%hTKw8H1f)ak|EnyZEkHkI{1oa21!5MsBFFE~_R
zT!PcKU!TYD1m1D=mG#Cmj@s_L(Tc$+n+rzZ=AB`+HY66LAAx3z6Fw6njbr012u}*P
z#7@OFQ28|)Gve9b5@hsR*gkdayhC$N`ejsQvbsPJVCw)xQPY}R?2OPNW|~5IJLD`@
zT1~pz!E7!-Ib|bz2k%Zw{e7+xX(mQo9VEm+b?J@8s|3>*kL~-^Ly*_?+mA9=>xjr4
z&q@8NExV#%ctgXz`>e4emPUY_<CK1TDss))=G@KMYBg%L9G_L1QZ=^Kg2d5cmM!jm
zna|>VzKM-+Fbi0`!#upZ8~GVyO4q=yasCh=jlt?i{tEk??)2cvpX<uns(!sV2QRPR
zL-M&|EI*_6{Hs9RWST1Uqja|WJR+(23TT~7FS>%YxTs(k&*n#Ctv-2PYBfli1(F+D
zM!DAXS$OTC$QnA0XWx^KdsoXn9SoTGsP3{thgV31%CE`32;J_@<mMtpp~WbnjDm=7
zuG}bt|A$7m-cpWopEi<zHeH~jjl*^Tn3?1Wzj4R~A~B?@EeNy2B6G;3OcOinx7n+$
zsxSf%gyvt<Fh|VE)P5wjLMxbI42w?v8uw9|<!r(1@#3tWn|_p4b4we-6@`(RHtyzK
zi9kfBK?pLUabai|po0&^rexjBlTTvldn-r9mUF?sT0bvtT42=*+>V*%|E;tzeNw<2
z;?7Kvv?xec44mo(frnPA{*GEqQm0_>Tqlmn9H0u7xjQyxMmoE{_f(cU&qTs|-xLHG
z=8nd>cAi<d9xKJn^i%myCWIy*Tt|vBmS>$a)?M}bZykj<%^Ydw1Y}KMldouV53JjC
zveb-S%e_GbQF;#p#{UODO*mIp(l@+TGYiIy#Ox3hb60Td2_@pEsUM02q<fz@lz5=M
z!wXL+=2B(AHy;d%Dvayrk^-^)EDxd<_$tvaIf$|ERaI}>hiU!sdDi%tsMc}2^N@tx
z4Gr2aKK>>sbWwBqsWLD=JMQ;ZtPPnH4<rH?ri|w6f43v0*sKu?6)j2%=~-d7epvol
z!JU+1H&f<|`DlD`A|Wi9zO1lscVAK;v1PJ#wUq%0NuiNN2Pp4<3vQcc{YXs|F9Yzn
z-yO@D3nRm4XJ7SWCM`<j0B33g&UG-U;NAjkN5z>wMmtny#*xJ=r?S_C;{QOKAImdZ
zI)51%aO5=TEEr*F7X29ef?BKCpLe2Q&X;zREJ7PL*Y$9{)@s0OW2lp6pIru-KQLVu
z3<wn}R6}-L1E>S!K+?WS{_pItq=wwL#b>m(qj5c6-17%O1}7PYIMJKi3%-0B6J5}1
z+%>lRC-S>zNtCm0V?1Oz@UvzbZint&2>Z20hn(?W<`--kf7OS3)gUCL%yB;mge1bI
z_?|s8Dz>t)P=Oy-cb&UKD=q{R1k3Z?;pUmX?cKj-U3hQ?S*@2+7X7Luc!zZxuz%4S
z03-p7_mbY=*ZfNU4r$LS2iXCJl2EMZZQ@3FcinU_Z<no96vVp|<woQziiY5JGttRp
zb34~cWM7aIg)UVXWpoy84=ph=ENP3*NmAYmY8}}}CI{}9N~yPPlPHTJFs7>aoMfUF
zF=Nm1$rir~_Q~(;j^2|IV#3a6GmZ34DrJv&1NII87n-`o0pJG@%n>u9T6Yl1hwQ*o
zV_saUpj<>s?@@Ky`|U3w|EV6ZJVw*v=3g0B7a4#br1vR0PGqkgn&uf4#A)G@owj85
zQuo<J^q=C&z-W<MlRH`S)<j~!>+w&PxWqEv8T)5)-k>JkB4x#y8e6Zl$<-DJgx>m7
z>zcW5adL{fCp=EeY8@vy<T_>yJl*IJ;G6vioLjCRIl)pcY_X6Ei*om;at|I%vI;z-
zcYy8*Zg`*Z2i+t(1y0rjo;9@oXIrfxaWFJfauOeuFS3S~jPH;_6cI)aee$NN$HHVc
z_n(1uC8J?b?O(K^Jhw45bo+(=@MPUp5V&5_8_ysD(Fgv7sMArECSZ8%;G|V{tNi33
zJO5o+=e@6%LGYyGh0nJplye>;D64Wzl2}T{uTnZ)sEFuVwTkU_j}J-M@ho%16fHA8
zjGZbUf>^c5{-j&roE#GN1K)?9AIlZj4vk*zRujUd1pw*QS5KywpIS?QTtTM|sDt68
z`LN)8!#(d6`THl{{79lIBb*8NBjL)|?UO*;ozNkkZd@hn`zO`PkbUM+%jw(s4l6}O
zn5{04;`mL7-jw%R22gB+TK?O)S(PD{UB^sZz<Tno(aQ8|X?z~3MGHU5%9JNF%{yPi
zv@13H!wCzUAe@mXO9#8uls|tDsCl&9<_{v4*idDcj@Yug4Bk0WIve!1c&l@22sF6N
z#+?X7P^u0U<waRjm-OBIEOv(PyNt2!QDkczv&{wO7u*Izor_$5L<CU8(AL2-$0+x8
zbZCtoSj)4x6gKdN9qJr-zb*%2(<M;W#B~ldgoP?CLV_b|<NAANl;ts>mA+~3-e2e8
zk!n=l@HcuhQIWrxHX4)gyO*Djlnl+1m&u_o&*{~*F`Yk+FdVr;-=<r;d8uc%*(=9^
zL{aMTNgPLphN<NT?B|q){)j6@4UG6KiKt_Wm1&!#s6gfWdlf{tP7ykjl5w1U!A<;j
zT07KWy#-s-w(In=WI<A2t0eBIDWU=DVh$fYdUv3EYPo5aXf0t{RzzJH!v=;*08WGA
z#uiXht>lL9zh-fIE`AFpKPhjxz{{DISy24ua?0TNSdQ)Y)7zi)6C%~~${Y_tmz%4^
zogS`f$55UZHJIET7C(4h<KW(rrbql4gRD5DWmnKMLHuj|Na8lvQo>->QADs-()#|W
z`xiR#chAx@l>4jb>Pe01xVTAV80%~!Y)@nX;A#K@z;MJx&$-`s`}F^bh`Bj8w^pb`
zU7>ZfFL_m!T?zcwl9lX4$rS!yjts+WUkcZo3KE-xM71{Zzr;kC`x}i%{g)z(*y2Nr
z6PJBO(NEa>OBqX((17Ypge;j$)_B{eV}_*yciVse*9}>=duqRQCT3KE%%i9_NN6)r
z71XY**0-?raAd+#>1OVl$+4Z`eEQf$_UGGjz$BFmBuaPT^_QJr6Cz-jf5-u&t3IE_
zcm!kK^~|q-V5vIOY0hUuXQVO8&9@5ksouI{0d^Y5yo)JWOrhIs<%rJ1myj}y3!e@e
z;cN+|gz6w)9hGvrLGrdTaj^sZ&%5&1XBvYZ6yJJXuJE(6hYwz;^KAM=uZJ&@)Gd5^
z<7~1cYQuPs1@v|#d}EqC-TpWEHoaXpho$BZEiLV|eYbB|g^Ac-$BCsjm+%$?b%L2C
zbG^661gg_EW@~Y^IWrljX3e>5ukr@|P<&kclxttvvSTvw@n;p~8QJ0hHvdU)neoI?
zvz*`402<RpeVOwNKSmo<lahM5HN;~$zpC#Vk&CToyK&3Ha5VD`ufB>Ce{mp(2Gu}w
zl*k%eQ+z0oW{j6UW5;~FJ&^f2Kuyhv5jB=?QhP;1>tB}4lU;~q-<jhOqXPp;BcW#)
zqp}#mwVI3f^PRu#S<?PRK8ozTYg!=+A2KH0=Q7~P*<6zrEAkfQ5A)uN9U;HODFb1+
z%4DdX`X>giThD<aR6GLnv;QE*=&b~~w9_oPxN!-*K^JjR1fnz}=y}_S>ENa;ui1tn
zRkgvfUX@?ac;tIw)%4JAcAz&kq2mDXqvR`t65qaLl`e(R7kv@`)Nt$siDZ`+>BrUa
zeOWB<zJrerD;IMw?0GK4&MjjiV7`}l5pUQ(V{|}zUuB7qJs5N0su8p^{`08?cBCp*
zdROE@m^>w0%5fL=F}GSZjmvdTWJIPDtdDZxQmI5CF*yc+O1^VZeAxT%`kyW0{}_!#
zS;0Y63-8QW((4t@*0;;PsA!1Us7khaP2po)f%NOX<Co1!h^To$aA1*Bz;3q2=6o?Y
z58pdaLyr|l%L!7MDUr;uj@2{ns+j4b1H7c+o2Dr)d`4X)dNW9Ut2evBk*jvPUy0D)
zeY`wE&<LI|SZ-{q$T9r4<dN~@K*kGqrpMm^x?5mREk7;BsfzpiSj|zWLYrT*a5w64
z3OMcm$>MpQcKyB|f=LBC%f>J`3+6SU(Q$=%?}uW(6+&@$6)yimPjHKf;;63_EPIB&
zcCnwwdaZc<RyMTnXvq8V95N$7XeeQB&dus&0E>%W1_!Dc&G*nvSQ&xwrbe*ZtDMN>
ze#sH<NdU7NZsCPB74Y4UsubU3P}HH3mXt4dadg}8_>ayrA4l-ngG#lq+~A|yL`T2m
zjK?2bH=faP4YG9J2_78YyQ9BI-zk*eH+rbJ5lzTk>D>Ne8#7m+H{2uNt$McjX<vWt
zBZZ+Y-(v%I0Ymp4q`cYHl0LIS_LWD;>pBck$CZU2Du)H%i8B=+byQdHS)|WWb^}$5
zn_Hp@VR(Wn45o~Njx`wpMO&bI7Mi4jxG*_&)(ROw%(TQ+gTolLsAqX!?f09>ak*e8
z<-b?_Hos(AE|wbwK3(s%h0L>|oe-9gyHidwdCDfZ9+;QDl);mTcr{%}YAeM0ka-Q8
z5K0<}+PfK|v{zO~)vsFy-)PGI$fTv#XLbcvsy@k=xqo-*IuF;lAu8q~khP?Lr_WYY
zo?4UQiPcN%kj(#u=_M1@ae~N>U;z}LR^-f49RuUpcIv6zzX%=X<%COzK`!FL)WBl5
z*9!0~&VxzjHTPpSRzXS=>Q+LO<zFx8KYt?tkVFvOkS?Qpp}xhtRn_Fmjq85bhSncx
zy6LicrXl!$L0e=3pD|{+HT+E|iYN0Tu#%DEns=}LZvF7V^%~5+F*$3YFIwf(c>`M<
zhsc%iySL#35B(pu4Q774ls>)U_@nM9*RH8p?9GE?-@CVXrqZGF!Iu>$>Ptu#M18E<
zrTTtH`Rm{Zk^mjbIFO-UFS$S##^QjnExQ#7U%qCZhT~FMkjQexdrg4j<Id{<Q)+Sx
zE&@vDQ`}willOmi%l79$d<Y>hSj6GdC4A6fM$&y=ywX{<?|p})=#RI$02*OVm!}nQ
zP9xt4=%v)m`gc2&pNW})^WztcbHB?{JCfvD*Xr%@@1;ivM@Nc1W`DXISw*~<@PC)y
z{vFKg_3tL%JzSNhIRSYnDt6e?Ba3EmKf?F&MdSB@>WVwP%5^D)OLZPSH;<{yOOH{R
zp>B>n?>`>z+6hCWtL_?2ZKhH{z+Nddi%#YiRVttH)`pBW@i!R)4lWHdyS9j^mYGT!
zo22>G5`dam{Z3BnOlqpp44v|u0atprGA7IZNI9Deu2mri)bpZ{Z(KJeVPSX!ePIF#
z2f_tyTQ9$+Nr1dJz1OG07-Ea5hOQ2cSlDEVD*Kl~O1QQI)G^D^`+BT4Rc&8FDj~hs
zbdR5SUPe_O@DRBLaWY2NSq`=(-;K?7M{!aOV*Y|ip9v8mZ~}kr>h9d#eTo4kl-2%_
z`ey`jA>!5S36nf8O`utLup#AM)IoA!bd|*?Al2*1i$mIFQO-3e6}>Q4KwpK!s_kD%
zQERH5HIJL`xGqF@qkW5BOf9Sar^2KziUnb0J^vCyVj}_UUYchv*b|jq6qjsR(Tju{
zwKIg(=L5aMRn?t&c=n1dz8%j>Gt>|@iyW8J6nMmiU%Nf0gz5NIzH8S{LS+8jAWiJ1
zVv@KT{6hr#Tch+dsK&pRODgTStS{eiTbX2$;lzPc=Cwnd^Pe`CMOrt#6~Q$LmL|4M
z6Z7e!DD%v1$-)29Oe-{1W;<|9%%J{Aw~pJaGUOz^(a0hMD<wJ+qjB6^B0B;;*f(j8
zYsa(+CD6+?KP$?(gsm#_P@iEjRHsD|0B;OAW^~?{G@mp7o`aHxW+NbS5it2MMfTS@
zfQ==a^xbf2X$2*sw?UsVWalN0DQ=3VY#wp<hLq#!2I(kj*H`zo)bsYg&dPa5r0RP2
z)A?zuQ1h9{SX)kfzZ<NUzWXS0+DAOm=B9{?&R@qvQM{TYNbV{FD4#-!xpr~jP-W=X
zFiKi_oDcu<j^TRBh_kL}@3L6W4j3CSHz-!K+VE&4sv?3&c>5$c6GJPmjdG{9ju_<B
zJml+>6K`si+YA#UNcfARjU?c)i5FcBQDQB`6z?~_>X;@;CnWzR<y^i`ewtIh*<AtF
zYvUTbgLS_(I;P*&7}#YgZN2}6Uyvla>!C?kF6{N`!J@y%#V+F<i2SJYm;R)|!<4Pm
z*J2v!rXAcg&qEju9uxK{YY-Ki4yZeN-BjM$=~w)_xxQn_R%?LyEYrT_my*Y4BY(UE
z`?pTj9^-#%)>XTw1U{xBT0hdze00;k?ah??z(#MmLy+>aC$0{K4yQ#)&2wkvNkIrd
z)6O-H%Uu}`2|-VACnun~SaKJpy%W>;YNkS|hm^#GcIJv-d9$naCMF6qAcZFeBq5E@
zgYghPjxCW|o4kyf<_lNvnch~Ov5m7y%Ad5k+yCRX|BQh@8ytk^>o1@2L@U4R0(pz3
z$F&IiOZwfV96d=h#`M1}qKiKG>=l&XX({ru@i~W=_c=EsWNwB11oDwee!Rxf#1^OZ
zf7(vBISC^#7g;yndqMo!u7LZ~!;{Y2zWJF2l#PU~Fz-M^^tB$J%d)`JHr!kHj+VR&
zqvL{f@{N?vlgdR?dtK_wDkKW!lJM`<S3tVkudjwMX}~55-X4-PE<0KH^<1qIIP>W)
z$X`CYF%#YWWK<pDW8ws16DgNkO>G8%!*@EaTJC$C3VaBi!bkG_xAn>Y?Qm^_+u86k
z4&BAjo0Na;H>vYU81W$@o43+Tt7swdB1f3#?g3$gsly`!uVm{84#4IIyf8S+s4=_?
z<430K#Wm+-ijoe96c}5Ds){4$XEp9=L7N8mAMl^UdvrbSIcUH%RzY@MT{XIbITW6{
zNZ%|eZ3h&Sh&X%(T^X(0me>>-OaQh;gfGc_Or(h)!`Es5i1tiVsJ-|5!0XZ7@jb}!
z?+C~~9_+ko$}Z3YKS^s9Zl$(v)N*&zx@Asrcs7it9F>qJGm)2$migB~POnMfeqspI
zbg^v%0lwZvq<hQMDNjL-Rc#abXCbR&LoW%b9;wiTV#aTJUblHj?o8Mxmr)EM!4XXH
zED}%QEthT@y@R1^GAQZe8y4qqk%O@b)7#k@9BF$a290y-o@K&jz+r%4FXZ1dh;6=(
z|0~KRu&ZR>*<GPbF7$u10KVMb%IeD7d>_O_AQLA+BCX*zDuu+AmIcQ@JckvGR~R(>
zogBv4sJr}$usPCiR-dp%@WIecM>$4^r}2qf0A|pptB8wyR1gP2TUoK$2hxzkgb+z5
zVlIvU;6;Rbx$x7M1IBuL!v9Mb1^<6^ku=5(1I^W*J@fXBfzhml39znovou!*AZHh>
zaY)<|kD+rKFg<VUF~Z*MmE>Bo?&^L?wqk#pBlY?4&m9+DhNSp{&a<0|6iD?I72|kD
z2my7*Q)5%u63f8odiUulr_3Sr!_`2P1#(c!O|&IdB_!wE;(+|Q)A>*RvOy_+8@XXg
zN~6hvP^D2eCTRy<-(C`zySArqU2_C@JIx0e+n-y4tm3!fy9=BhLQ+EM`T8W?N&iZs
zGzUOYN7eHN2eIjyYROtSFkRwnx$Q;v2Jt&ZOts)~ObklKzZfZUxtP`){95IL)Eif;
zEUr(zVIu%>fB2FZ4)BI#!v!l(I1%;QLW&FxVI=|j(o5J9qT46WQ1={3y#_h+aZ!yT
z!`GYf>>EOI=NUbTC<nF)o{;XgLpH)@E12D8Ulm#}E3vtW``FB%GB`y(a;X7jI;~PF
zHW(RkezBYyLF(76r%PHPw?`@cSo6yRuUk*4{bxBB1X`V^^?Lhl(nGay(civ!7=d-u
z&4lji=d3>8Bpi|e_wG#lU(N~C);dxMOeW46YFXoi!W_kyHPUk|b{F6x6O(u;j~uK!
z1>cTcMXINEmz7@LGWl;sM%dr5e5}~-hV|MDv>tbD1hqo!lvfA$`F}0At{kQEtCh<A
z81bUr=NxLx{(J>0-@6+LGD)mr*456~ti7pyNEXY(_`(bE9YCis`y?plY%RLyXJ6Kd
z4d?^B6PR^>xu|+8)Kl3XC1~O8h^~l?SNe2AvtrmcV~B&cr^Qw7WYL{k)N1joGS<U~
z%7D0D)A1m#$@<)HvN?D{EtkycyD7A0O$ghONAy)XwB&m(sVw=ZF$_f>3Ej}d0&vTk
z$0GLMbn2X8%^O$P%z7#~#DfB0D)-ikYY#^e43I8KMrG87AcLabEKFPe_Zs&qPi26h
zjad{97vpirP*mBiEWPXNPYimhlcACWw}kY0n3#Rp75!G*?%N_pkHG}gI1-=^M5%;7
zD?vvjBi`5B`#UU`p)lETxv4nF_K&!)Ar)Le4!nojt|Wa@S5e3&Vgt|=%>E8=D}<et
zS)6fTW1JQfInQKcP~q~gkonNJ+;){UfHeU<m>lasTMfJVpAo&rGkv;b-wSx>wh4uY
z`n<EHR7f|aQW9@2;a?m!wanA>b36E8XUv(?bFX0VF`?*kwyYmYzwOZIbCM2x^3)6~
z@G&61`qlLDs8(AjIuJ44N>=%r49Knm7!$kh-`w^X)#%?%z2rV%`7+2Lcl(ZsyiT$?
ztJ&0-!d-?T)?wN>)cL(F*V5;fJ}=lj6-rNI76Fav%_nHN>utq~<Bk1Ax^*6p2Uca$
z(T~Wj3`@|iG;+Zo^gCO?_@*ZgZzTm3DJ}faM;2X^T!r26#?%CAmTSToVb@?BItYlR
z-G=(Fm^#u$Vm<`_iMCjg+6u8p{(``RpJ!GxTJ<f}#Opj*DF}|`Pb#klV1!MZC4B>k
z5B-9H`E_5101L9_sVH4ON%7l8gl4eagXgf1kry-wOR6iEF?%jeyIa35jQvdC&%z-X
zvN=X-bbjVbUr<&5mGm_2bNou`Dt+O=&PT^0$DFWzrC~7I6da$Q%Jh#Mcn7}Lr`pdz
zR#)fDeY;cW!lA5sYcaR~ne&D9oP-^slG=1YVN21^qK=`9j_Uj1w-?kK+AH-<!jnn)
z)rYnXlW`Ld>YvA=Kl3TTQtWyS&n&ET@cPb~;tX=e-<Rq-E*Z%D;XC3=*xMTW;JN3}
zKSm*Ze-2ap$an8VSvOs<(!`?y7PWa;vU_Dtz;q<$v+AFapI*%NlQ>Fa*7SoB&9pO`
zwPxPDiUHv3rO0)iCO$5G{sJXmMEp65em)n@k)zVJ*91@R`q>z$MorZKkUYX%R#33?
z`yg=Zr%hge2Z?@Eh&Pmd;K{|(+VFKxx%hFyBK1j5sj$Go^UiIR8H90dTrmDYFPimA
zRj3Da@8eVN?$y?_B6#8LdiQz$wgsL{7N64EK7vY^h`DX0NM*fsrUH+3E0rLinrRL$
zEB;!jCgu~#Obud-63IQ^90}u9@t+>W6?BTcQtKlZkO0)iqOzc0$pZ`Bz@Af&NuP}f
zeZj@<7%Xo*eE966r$eI<d#TODf_+!SUPN{wCC6<mUWh&cGR|Dmbcb^sqL}c*fXZeK
z@3+p_FM+vv7_%+KdzGd>lJ1@#D_-E=YR9vvjd(YXx;iHK6%VmCIy6orh{MiUv~ZJf
zrzO_a9P|WByv<uaVIcf#;+px#j;>|l_V)h92PczJLwrK<ICDD5Q@5m{GJrulI<Vcm
z!Gx9AvFVxC0Qat+Y=89b*3*wl`pPQHuDGOT)!!ubs(78;h{0xli4xdy<Oev-snYn@
zO2#|m+2mSQq=g4?BZc3q)qh4JDo~ZLH!^<`FVuD-`rj9}7ARKg`ukr(uPv{l&108%
zfN0|J@Nq0||E7aM41<E3AN+@!-)|xT6XVy~D?)KAC2F~tV8meSiB_Kh&4^^ac`gQ(
z`*ES}pyQ}V8Sj~+S16r)JV_+ccm%iRnGqMRlR-QZ`SoiqO?{w|I{6Ee-KYdNkv&wA
z@~AO_wr$yY6r8;qzCakS9ZH_xyH;_A`+hqEV4LD#PA5}hMpAPza*!!yrXQ_sx}V<B
zM07`uPD%B>A~M4Q-_Q>^!a3M>1tya6!lF_Cr8d<|VI!fkShI-yK_S2P_6u&qzGR)@
z!<HbJ;2S-6Y+stBH?$_gY!>KBe__-F(&3L71y7Ij;6?@N@QJdV5#=vx$^9F#J$>zd
zr<_1up0VS~xVS)d$KN?JHyO?--G2YZOzJwq-5FT_9XrhBH>@qkeOBn|#rEk-gzEQz
zg8?UEVOODLO{EJVTk8HyaJgdv?RL}I$w?kw?Hy50!_5GaTWGuL)85`Q%s)z5l?zgJ
z{>;R1uI=y5kw+#gqu=gn;~>m-R)Nl+26Ac;Pad)`EICQ*B|`8kiov3yE&ll%mL^5<
zzMWwhi?qDt34#-Pf$q+l*av(*A+ad)c~Cn41G5vlO5mFJb0H*CMaVNDFEBF(y?ZTk
z`HasV60M$klT@?oV(7-2Moks?-d@rra6Pp1^g}l-Xjz<afbtC$>Eqs`(GjfgI<>N!
zd#Yu}%pTs=u{u7ysuCHiu2P@dBM!2I@y0OXJ}=M$nIZ8|>Oiodx(D}z?@_nmJbz40
zh(bjXW+qA9Q&Cwux(ZCj(ansPvlpayG61BVL~+=C9$xh6XXHg@6u8mvu~({AFn^Tc
zN3IbIw+E9cATZUG67+ECd9<|EHPYaJ&|OL4`W@0N&87ska|DYo(v^?-`yJV<iFOAj
zj#wZLO53%tR||xH%3VhTC8?A1f?VCZWPe}!2R)Up=!c5dsJ3PLx=0{C(|;(xb1O|4
zwvFNj``L+7e^B@{VVD7~OaoJ&nu#@-tk$i54#a&Xk!rOrh9n-Z*O)0xZ}(RnbAPJP
zjtc8_6%(>4X|Yq&()>xUc-~zIip=``oKn%zG2=$9D=z~3gMPU#`N*2ODQlfmj9jFJ
zK`=<=b4B>Sg90xjl|U<%l<~HpeEZify{Le<nJEQe*`K@wjF_=oKzrZbEb;nrW}yBN
zj`Qg(5QSKRa6o`NyqJz~;Q8X321@_GNt@+nmCYokG=pkB7i@Mz0K_Bz`K`4(haxRg
zke(5k6kxQrep_<p?~0g~N%>b}LM>%Lrq51#^F_#unWlv<Q|+n0(x$Ku<L-K}=SmfK
zaLCm>Cds#685Kbv%L>|aSQV}rm)i-{kAuDYp)6xp(XUB4AVElptQ-*f?6hVsRB=4=
zTY_y^2Jq}Xszt2>9($1vN)OP~;~zf`b06E87SX!-IYwS<I)qGuYG6WZAvu8}>o2ma
zTyl&IET%dASn<9JbcmtBT|kX14$3tzm=seL^P!3EobdYCz615i=IfASRBoJ&0o!e6
ziioHncabZ{(iJOP3$|;y{+6Kk68r@vOM^NJVi2rLs9IlrQS$%Kw|sRhONX~;jsWny
z1;rj*7oPDJSCoD_$y^R}Gy)Dz2}K24vT5VVev&;@0&rOjj9d=vFE7A}UW_7kV4qzA
zkTZ|_-Q-1DI5~u>a*w0BpiLj>#G%X7ScilG_BXfdD|VWBO@N$ECP1!J1g6yN-fdsZ
z-<?PEMjuAjRoR8$!};={o1aI-#&5NoQTFeAnPak|?$riEw+=hN9TDGX{FvStvzM6Y
z5FApm<8*Pgb#~54MVdy>tZ9<KI4xr^tfo*douL#I)wNLE4c5$o%<>RPV_h}TeyY)*
z7Nh5>_(Xk5HfvLFu5Ko+Jgi=cukFL02=PY-iY~y(d46yQQfpR?f0@C)_oEdD7S%^4
zlC*9PtRKHP?>t(ty1o=NfN)vHa#%>jpkcn&50Z8l3x0SnAxgtnp4jZa<GzQMfgsRG
zuDuaxDaJ8z7nRHvqrN@Kzu7E56!O;c7(1BfC$}#-k7?!0cukfQTU*<7`t=Q)>YCX8
z+1N<VTpk{LNH}7B#eGtl*Yx4WGj?D=<mH0lz~K0dHnFa6#1%cOPp<(lPOdJ7V&D2r
zEls}&2wtzbE#V@>|D3;M)?b3`_tm@|aO`C?dV7j3o7v`ArW*ELT;2MqEbCI>?TQ=_
z>AtVcHj6bMr2L`}r6oi__XU?o3H=Lma?r+sm6e|VG#+m4mZLU=<Dj<#WnB0D8Sj|b
zL*IW9io$1%!b}#(1$8544OE$bt?ci#$2s08Z`Lq$^zK|Eyd9nO;Xl%cNgBonhW-_7
z2P(d6Qj3M^s;Bph|I_1r3BjF45%2jCReeho*zZ~@z^>L{0XC^1r#ABSZZi$ITl4y5
zQD77aw;4w*^yW>4lT>kC2YPvVRsZd}r0MSVC69_|;-Y-T)f;%XNE`B_Hae){k;Gs4
zvZW@q&9SPb95LT1#pO>Kv{Olqm|v9~K!3gVLLR;ZJ%$eWe^|gUyeC7`+hp$wZFZw)
zec__wGrA$x<?6e6g5*rxE}KRvCpC)JJZEud1IjNb6FYF+!q|lLx`#^)Nxf{rn_2`6
zG$bp@_Ik8FD$icM+9>(m<~Qwo<(SR-6cO!S)po6J6!Kg+$bK#c*6o3M%gqul3y>><
z^AuJ4i4>TdfgvI`8NYX^xmQ|*T@nY=2Pd?;5eM`*#aYbkt6+FE?)OpNmbtU*xWM_1
zvCALU>O%A=9cuBj%YS|Wetw^goUR_a$4<Z{LQd!Nn+Xp7GOEZk0?+{Nuo}zbuIOP6
zTq<jLQ%7j2#E+fJ1Os}rhJniRITl8`FcE~uFWQ3fKuPDPdI8ElnaUDO#9&(}TK3(p
z!s<e`0K4$Wni{p7Ql=t>Y1Bb_1POdvv5V+4st&DyuiM}JyC|0nmO<rL3m@l|$;}=5
z{N3XpX*ZhtSp1Et@qD`i4UFxdBmc{A19bN*KiC;)izXf_nrj}&_V!OKNWcF0^^(e&
ztRRltTW>O??-$o3Kj%d-<0-^{MR^!NPHWwc1+X^o5qdDD*|hsWH2f6&qMky4XpD*!
zD>=cHJ@;jC31OmtZkBWbCe&qU!hFcBFR@S7v_Fy$$W}BgzW;~D`CVHZ0HRLnA3Tka
zC|W|!0`*>p%Z%HymOpe80=cHQ$c($!q-x!!?M2v2G86asjYLID>#B0Ra!CVK|KgPU
zbtGqxY<vm1oC(IjL`3aIo<HEYiV-U<fYv`$higD*e}6o_B`ucsT?gB6;EHT`rd45Y
zpbN;{i7l0F>f4Y3jcPIWHOh~t;Cx5iW|_0_LT2q~oZj`1KOb?Ko!as7kS%}sjAoD@
zj-73_sfXcL_tz(e#??hLZT{Y>Ppl(Juaz(lO-yKz5`;WIY|ZC>eZ%{4tW;2N6-RL(
zT5GZV#w8WyJ^RHcP$*P(4J9$b_}hC#By|eJAropAhm<Kkso63AH&AAq!`yQj!kl~A
zI`)z#{B7|`MLMPkRokS1^Rykn>D?9PYZRE^2St5`6zh->W~cse#~nro1jr)<m0-gM
z2g7uF^EX;%*#Vl|Vw>1oyhkP)pGhB%dj?zc59DDwP1!fR+^q{LG{(#U%*Lk1_WhG}
z2ABV?uRD&+pQgW|47X3?U))IbCpYB317GO-_q@L+{XS4;YR8&+S@sqkH*_}WrWA??
zH+bP<kZGEDJK4*VCRC$?^JipA!oA(jEYlUvQ;BFi4{krz8n;Mh)GK&ue)n=<xA%B-
zTYzu!>&TbZvPjvOd(3eNMjIpZ1(E&y51ZWPt)r@i+AAU-^7rJ0A@q)y&8@6LZjZkC
zN9(-l$dQX9!2o&Ds3m4j%#RM7))4GR?29n(ohz@1TRL`U!Jh-O98!uj{e~B=Ky-YI
z*Rl%yGPeJRw!dtP>V4n1VPK?Fk&Xc=1*BVGKvF3IDQQpv$)USTX%Oj7X{5VLI)|>I
z8-^ig;2OWb`+r}r;M&%<%@gLyoUC=8>)4Nd{~TqjEW^tljOzW)`sk(+*(wK6J1~yI
zmv_JnCHv5^+J)iI2H0^?P3PP1?CXbjWnGUj;ayEFr7b)J17tz1qU=qF_0-I{W%Z!K
zzwfnVL#M0t%^rK_JuAc9?QY}({=bTs3>j!IZ&8N_sA);tJ{NAnT1GdiH6l*@CE2v8
zHfUlv{w_SJFB4}R3q7zr;zgZS!9c+ywZK%8Cx0t0eB_Cm+PjW+>pv5387kt6=PB~e
zg8y>o7eS<E+jsBdz93%6>7at-`#ZJX0`E<IYc*aXfgKZ-aW7`mIPL@wOal3K+rBEb
zF>j&e!F0H-xU}VW)p5vCBH#?QrR&AJd$&<|Hd?MN^}=1e75TH)ia=J~)#d%bz2Q1S
zE^Q3&JzEO!oT;a$XjGD7`U5+OwTOe^PNuUb?;E1QXDRO+KL5oviCoeFSMqq3E**S4
z(S_LRMw|MUq*+jfh^F^;W!GX~x;(q^aQbP@?2N=LFMe=`HP6|`^ge`B+xYc<{ZXAH
zu%uQkw<v<2-ZKxP>;H<|x<4=fgZv$oagCiVnjiJh@K)RgB|x8sRvZ`Nu`0YhVK@+L
zVAx9gU-YBF|Az9*c}DcOIqe1bB@vbKc&Nceq!MMHs2x)^SP?Z>{0x)c@34WtfDDq0
zP7a<lyCX8w7ci*Pr(!YvNT@hIqh7Zct)qQgVlk6;k0>U<ug3hw;Hf{mO?2{y^w%)I
zYV9-;`fb549cOKBzP|@XZ2j3o3UMWC6ULcve4$C_PrB1M2$%9F#-mXWGmO{4-#GFk
zu;i!xg_(D)v(^2|1{!;Ig<@WbhSUo@2kw(;_UML-Nq!=1bA4O#RC`aZIzcdaW~T-c
z4O4YMgTUyNh+f)A>$PK<MY;B(IX*eKNOWp{*8HhHj6<VdbC=U9GQcR=nfEKV`nCt%
z9OnBwYVA;tMd!L}1|*AnTzy3M?+ebR+XmbrBc&o+Al$@1Q9aqqTNEdlYl%nM_7kuv
zf3A@=P@<Ti#{iwR$qv3#45A%$`x-x6$HjpTLcQkue|WwG5~Wk7O=GnZA?-AJ*Q`dA
zMlRq;dFCI4t(FjdepW6I6E6FI6Ceq^LMT2KQ;Ia#6Nb^ojnOBR(D)tivkw^EadsiC
zzc;tu(9v$*H09__HZycyP!cs$27px_UezI1O3^v&xJ~fU%*n|#mVZ(!(rkGLZqy}m
ztQa?*eA2w&uBFIBhYNFyUR+gC-ZF;|1bLD!@Kp6{NXakkHZJJ|wXuHg5E9f9rGz?C
z6#Zm*d5z1&CaGC94JjC`e&1+mvO)d9SP98JN`;?Puhlw_ZS^z4QJ_CsJ6Pho?P1!E
zdne_G7#**@#3NpT?8SmW%`Y+1RTF~(A1Vp?kn(<iH>qw=m@aeB$AFjA$?AZ~T;eUa
zfbs<&uV7J_RDo)^ydh9?Ei58bO#O9{{&ijIAcccsa}m9NRE$4+r#qcJ_b26;h8J68
z88yGwh2gQjo;EWvk|Ig#@uoL=MRrZ^16xAuFVnxZeR*{brT(rk#O5=gp9hZDlizHy
zri!W)_I8g9lJWnl_R)}Rfc!gMyugwu?o$0bN&t^XXdT^8@xA!yVc6@!X<m{ygyQMo
zbCqE$Q59&aWV@9#o9eDS!#x1)EmU~~GbB5PDnWtPLIfWb<m0-G50K!!=C#^QO9BUk
zaS3=Ry3qoe_@c!fGLk3=XtTt%s~TSk#&Y<+mkbd~U44*?>L1fQ*l?*QIiPo|fRDc&
zsNAYrH=C{V8zPgV-zM%r<Cif!yu-P<Q|b`opzUC|huo<rlf94w)O_<_O_axpA+7mi
zOu+x%UgaevfDraoh9hdvtd~0w)rQCmumMjj^p;9iN2su!aOKDU&zQ+T$m5$&TKVLU
z^ghG!QUACT?2NVaBweME+3OQG0WD@4^jqFCrL2ci931!Ytiga{n0(?j3YF=gar5wC
z<-+lJb;3oknX^>kIQAiQqP>GRPptWOMSNq^T!Wpn<IM?|a?Jc|@JC8lm7|!^_j%9f
zfkUV$`}ekI-UL0ryCI2$(fi4Tb<+Pr858_|4w0oMBAaKz5;tN5nfvG#_oacjuP_#}
zSOJ?P=u{Rt$~fqwBY{s9EIClfd=7M=1$F1*gi@*%HI_H3$<t98?4RY)Not{&ZFLu?
z{-B(X?m~}MM>%4EPg?DH{2AJdP5Q&PtAvh}NNv)mJRb7A_|)8tPv4}=I>j<iq(9>M
zkB(Pm*3|BT3LU+U8tyK6a@|-TLwTf0@_0I)!PrU793iu$0SZ1Y<i3|ps3Ljn1K^=r
zt|gkvYsT@pR+iL;OXqgD7W0tc1g)`z&K3`gcQDozBJmCbD7Tn7KFEQD;*e3yz^0{~
zmPPBIC{Z`0{*g^uJGmYp_jvi>!U6#wemiz?U+V}{LJ<z!;-~L6n)!%Mf`|F2)DGba
ziS6ok{mT;yEZf6*R}QvcIeN;!*BI-iD!~SJIRCV9Xz7*S?w;=(xxrTtYtOvQ)+m5?
z6_>nkqX>0kWEG57Nw)JG-5Tt3eT&_$LLFby=`+h4(uPt_adM$NWeQ=^wJSfJ&$_^v
zVk+<ALNSJFvZ%ZQqt63ST{L@9n@bi{Fyr<{1g6G|6wD@-3Ps-+{S$(6y>M2A0@#Xn
ztE?EaLtN;cvje)7m->xO6l;jfOg&*huht}jzB<cJvZZ*fc-9Gj_~_POD7_?l>Dxb+
zCPIW~K?8Y_Rq)b^8t~i}hW$xGyxQYtK2L{HSU~e-6_s^v6+1PhI$$K`OEj%|PRPuy
zb@l=20Yx9#f4Ou{O@Pqtym8@Anfww3gQ&J@x5|E#_k&t^LA1RW79<yr{y=(qXEWXY
zje#(c<eDc#^TaP8Jw0s)eOD_yxmWd|5?b?l(8d5%)d9y3n)hkRI42BQ=W2RUVUEkw
zz&Sl5B}F5$$(2ntpKQ$-WxjFVCCt643&|OlS&nYJmBCh^t_A1c^7>tXqnUtKowN3A
zFAbKTP=~+Q9(cvJ$NJ%fC?4S%(uIc{py2b^mhJdPcI_#+-cp`CxEHVF0_Wa&6YTAN
zzu##5!}u%I_ch^e&5<EXg4!#mr00K7w$8`z)7^<9nd!eupf7YLr8EKUX<U(cHO_^F
zPr~}lyL3if;8qq18luY-hu}VsK9Dh?yPZg$YxCzXHMAxtn-cBK1KIio1(3ufPM^5)
zf3%u)ur=;xro)l4SL{k!>`Ie%whAbE{Io-S054yx>zn@KhNC+&Bzk@(-v!_Nyy{P(
z&*Z1*>;_X+{oM?{t=q5n`3|hJWDr<^H8cH}f$;kfQB=3Y5KGJ=c6#w6DMa6-?AP#d
zR(-_OPg_4(GZSyLU*hXFOU}y<y-3RO+Mjh_9-m;jo49AEL1mHzb~z|bq3G5!Ppf*Z
zu|J$Jm@#<MhJdNT4hRuCb8b@_r!K}w6LQ%u6V=p>D05vX6SGHS-VL{vw`$)jzli@R
zem}6Ttky-1mNwY2Rj@M&uNb4^E5G>rI(#P{9t!hFC*NVhL7Zv)0~B-~QCrerD8jI;
zT?6oXas!;E&{|5q-792$Z#oK=&vVi+jH^S{^w}L)C8mX-?m)&vc;BEo3vgn`?o)c@
zE8Qw;d6IHlOb7!9UCk-9_6&(!nhz6XP<>Y5J5Ty|;p)3ufaO8G#iH-Rz{9KBPHYRl
z`y$I-8tu<@Dnh@;ekkN@h2=3c@sr3Jh;*N<<!><HmBAF*l$(3D(x}`XHWg*`I(J%Q
z0pinr!fGbR{)}`6Ce1f3fj5>WU^xIqQGm#C;>!2IQZ|9BOOA~`vWDlD{#a({Ozy1J
z6~NxRP688AoEgB4l8}(Sp_MM-GAGf?-n!8HBoqOG@J^HXKspOkDmAd;wxnumlQ|Jl
z%JZ@4_iKjcpW=!fn5fg6o^ax83Y!_akc%;OlcG)T4=*{?a_NtkjdJDG?;T#=?p^Px
zJ*JG`OeSc4`|sg1NXA<1AFJWW-StX~-{D3plBMFPBc$x>qc=3SYvy_p=RLWvyJFz=
z97)+vWA3r$^()3~nUo4{>nnlPTRZS6;e!Nz>_=5R5D0W&zUEe{PuDNHjlwwmbP_;2
zO0tU-P-Tz8j$6oXpA7;~iqIcrNzVV}h3W<lV`EW^=eJbLV7t>=?O+2@cB4#K6t*F(
z!Qdu;JBq-2Y7ieHfU~QJwrTRqb@ORCenOGH6u&)RuEQC|05AqXzTwXjX`dRZqtWRf
zL?F)P4^I5Zfg|>Et!fLERd4`Phrj!>5~E}Dvog~qB$)LVYMY;Wxu4^x59Dohv#@81
zOz)P;2z5j}XZlQWA@`(*GlGTiBGJ_Kfbb}_fi<5857cKCtW#_D)QtnDA||}mcEK=o
z6NNST9nj(?X${xQf<4T>$vQWR8`a-WHoz;-4S*B}B+Vj={H)-^kC5?7`qhVv5O)72
z_E8-h2lLT+9tH!;E~V;!YSNenpvZWaN7j+ya|w%%SYyxZljM%*SN5cC9$pE^XLf%P
zoEhSW^u|P3D}yh+X@JPg3NEo0oWLSYrFxy6Q1YcWwjGzUO6gT7!@bW<VwDvdfRH96
zAdG3hbN+-%<0TOnv51KGW+#nySE{6dKUlK;R;I?4b?*tjbTjOXaS*_0qR4L!oo}e>
zgeqdsMSD+O3{*|jP3#bJ-M-u>d3eiV_nTTVh;jC><}wK(bDl%@#A#G&?H-?VDQX!@
z(6vVyUt7j^lvCIea3mkM-fD=vPS2vWbKH?dOec_I-Ss8Ag4QhKjL19#L7`UXD9HL|
z@S9L*Egv3dg{8?`LKA`q?8iwz?f&)a?@Ctoq$SO<zKPV0pW1G<P7QsoKo@<bs6~ct
z3XpId9RycF7EPa580ob)VkBYwJ1{s=okp{(%Fi~c)J8w+v^E-70<Y&Hlgyi<{wTGI
z7+jboK->*BRVL=wqvV`y#O8vLtUd>-@}|f4^uX1M6X5DBYF5_XO><zHqGtcopFhMX
z?u)kTR2Ppb$4aBxUEY$R4YlC_G0(QNq$neV2ylbU6)4>=l<_Hzw@sjq(F*fpBE9e2
zFiC`HeQErroF0CVH|P?|MqRKknXwp@nb3st65c^P3o?gFQ8q(Vq|}%j=SWzP)H;O6
zlJ8^I->w$Vc&XQcmj3GyGo%Ks+x?ihiL7ygx`--An7VF~?jGcT#>b(8GDN?mlsO9J
zBEl+?<YQlWTlP<@ltB@&#=Y0<7Zsa+D%wPv5tWiJr8-u^^S+|?mw(qI$jctXR$ph<
z?PRI#6!4L{KvPyqJ)g8H;zfqZ(ck1hxgTwEQNja%B(;K`dO{pub(zTDr%JEQBZ$&8
zY^tOqsmrtdvrULE7P14w71=Tb*1Q@@AMGoUYZe(kcTQKUyUR`xZ~L{`QNdjUC%98(
z%~ibskKb;Wu2zhWHE!d()!wu9*qHZA4-LOaNK>Z1LqA@;WGpf@0}2H+>-CNxXTE-J
z`5T3GVZm;wx^u8`KtzO@fs!P=Z{8psKU$^foPVt6e=$lZ3>u0Uos31LABLa!;oP(F
zjclIEi;q4~|6wwrxxh$}N5#ry87$>ulWt~85|o+)+;=g@Z_jAPG2#cDJ7F@kAwfxo
z9(gay40d}$P>An9Rg@v8ZAMDKj=&sl*e!HNXv49jv~psd^R-;mj0CRuiNaTSDef1h
zrwpxTaAfu5PTKFhflr#kc^w5=F4b|`4GDb2EHcW5%Whf~*89~M6~g<@D!uSI=~q6J
zog~za;3O}?uCE;8n|)uA)1Osa&rO@0$T3?)7wqK}LahEBT@KXYK1WkW&#p*%$i&T}
zD$lFy1V4RRv<gSW3)8Dd87o58*i%B64AbB9XycIC3HG_M{WW-xBWlb;(B-{;yt(<3
zZgAs+>hlW2{-#KwceRWnke9wfLFB9QIyP}=rWYGx#%&&v;$vaf9j&I<Phz|$x{2`U
zHf?r)3R^yN^>wc$?3qAQ1Q1jELwhDtbEk~?Yn9~x`P3a{_=3C86|p&g?sp~&Tx__}
zPiuZeyYb(bq40j*xzZ_0hzZEv_RddWi^0#oD6%wJ6PWPUjV7-gz}m1x-fPcmWU2~C
z(WKzjW__hpqqLz9!*a6ON@oY4xG+vi*Y8bZCB!ph+q{}yr?4`<mY*Q(H&MkNc*QZ}
z`KuynFVihYSAZvPjlAz4qsX}|0C{3P^m4?Lx18!$SIt}6=fGg8`Wt@Je|kH*l}T-`
zkr5rQ>}yfg0(IIvjw-PRrHn<1nbp7y^(2Q0Z+tn8j6+RFK8Gv9QQyCj`O%ErtNcrH
zCyp+mDQfcX_M<%xKaBHwRf`O**cz(DQDDt88(Il)^2_niPo-xDtDJ8EAXr}<22cCH
z(~*Lrq6J`llC|MXD;^HtdstSuz-Ztz7W%v1v}i*)mMX^C4Ohl+VQGE_qRp>TVp7d8
zCbU{4rLYbf*dIS4i-Q4ex>qgJwbCF2B!FjtOW63SGPvr^i~N>2F^2wEuTSt%KR72q
zuO7-}=_Vc2CuIN(2oQRRVlCv_8_%0O`wA|34D&o3PjYCIf8n|a<4dZ|4ImS!ilX4>
z2-o=#fpvwNZo9afT)}lY(BYi3DZ-L&e{xm9rxfr%zozz#)KSs2ehrzEs=~FZME~N~
z&bH;%`3Qnre#4`T=r5U)5bSpQmF9v|@2r05j4I_TZo%2_)qVBv1)3tR)IQ5<Z^>vQ
ze79`327s7&YF7hupK~wXj=wPTp0b~DJ_AsCmGg9y6G40<+iuiZxh~VO#fU10jhXR|
zTCsHV4~j_dn@LWU9w`ei`g}Y|iyLyw5U5{llO1pwD7_n+@*WF|_$tXPGxHrf35TSR
zo2wFAD4Z)Urd`f&uj5z&WX}6cN6xZ2p2xcmxu**<k6-F|l5qEu_kTOxzfXR_Y!7y!
z$<zi1^ORyyp>i6F9d_LR{W;^CKfEPtA(;2^jDQ$n77u<()q>W)R9jR6k}p?z>nXas
zf{|`u)M5y>Ph{vv+#US5!;2WhTQsXv<*AD(M*qh6pfVw9vc^)Alc|(Ktu}6_Eqtns
z5=}{$WTOe0Qk$!Mo_T(JPBvH*aW!tBjpv`<ge3C=n4|YSt2do1fBqRk0#pC;Q;IUE
zvV1exbPOO#>@G?SO{TXR3tB@AB~d(iY(^y3q4oveZ~nL;0{{k6BCOvSasY@Npt@^T
zf76L7C=AQK;&z@+>JgfM7DYOTrL2efzklq%Pgey1Csk9#Bne8QJYoM|I`e}-?A*mN
zd}&rJ^KjeIlfs+X3*YOPPlbNPS|e;{)ZI)iw4j>9WJ=jpMfgXl$>T_rwDQ^WKx~ke
zdD>TkR#9D_Mus;`A|CRH{5Ks`Dc@o7#5{D<EMuilX`<c@pNC^B(|AKak>8}Td7!&D
z+$y}it<eQg3ZN0t-4p*5Omxfm^GW7VQ#b6;Jrj2|wUdZgjom0Ss(Ic$^BFs}t{fl|
zmjFK!cZr(ZT_L?NY$1N&mFeq0jrG#P2&~+JnuR7Y#W)QV@MZWCrr#DTIwN7q#x`(A
zHLa)oE!{x=J1Mdba1|o^AE)d;R@nu$A~vpoidEqZa8%_yKy+oa!!pw_Q=#i0fa@jo
zyevS7l!dxFv$6rhXW`{$(qA(-Xy}N_Xkgp<Oi!NMW9iS=$0+!hB%Wl;lR4Wxmj+pU
z!8$j!#i;t30o<eKVL8a1a{f^(w!7IKutCAX3`5$2i^<Q?$ZC+;^RG4gq2HF6&at4-
z_%UXD$%=E_UH5shcfvYT$8O??A(>Wac2XD_ZJsrCQ|lHXgA<WFD-m;Y++?V(2h&){
zi<Llq27D-wh`4`<O3qJV9fPqoyzYYaGxY34Si>4(5y7PSFHdR+5J+lWP#IX<){RsF
zzi;GvclTp|mTQ{puw}5Gg^)9OP;W3jD@)6wS<;NgeieF$R}ot*JnOx+esjYtDNZ2|
zfBn0>>h*u?@o!D4u*@_IUCjC3=L<UAy^P`gq5q#}yDEZu!hLr4O1pNt?SMadB-|+f
z_f2v-QAAbLhO>jyEHuz(^hNVZfo7E;J|u&LPJQ!iN^Y6Mn;M0bFd<4<-D$R40yfw_
zF8>6%PGj-Z?vNZlk!$>7V&h^^TtoDRxR+<XnQXzn2UQO`4kd(b*do%g-O&UF(}tzQ
z8?kO+{$T`#3L<+7OdqnPK-A%(e>~V|NXP6S?m#OFnvQ<iDTXTH4N-{Shv;E32K!9u
zm}0a3VNHj>=iOy!*eM_Kd8mo!zAgLm8*~uR&pOol6<h?$uCdLgu(>>eTlXD0MKHC}
z`$QTdo?ox8E4tyq;uPNbIFymz@9&z@FHIffD@fz*|6fD5PN0)Ez8y==wSB1bi2sv$
zxt#L=A8*kGhTslcVjNsZe&goAXF=px*Om;7s$A6o5pEhr4PIF%Z3CO>X_gVE0V84a
zQ8-^jMW^P)?%dh#{l9YaBt7*WDUGtssD%pShpn)fQ)zaoj$x<7@*f5mcMno}_YaRp
z9Gr#Qw_4iw8}W{}xBk7rE5g8$`Hp?hWJ-+^c6{bp5j$JX4pr)_Q!>=1^qpJ+>6IBL
z?!su@;uF||!!nc*_uwuRl0S;u9wXL?hjDXo3nPu8cLWU-;);Go6M0%?IFN>Q{tF%5
z>0$jsYAsL=TDj%_8_^?g61jPm8?a|!s9sn<jWa{mhv~fRO_6=<>}dN0mR&9nbn8B@
z9nsMg!OET#@ev%Zs-I!^PE|-CpDV2S+D}RSf*Zm1MX~yoWX9aKk!fMH>AeVkn^VTK
zt5;u)#wLKGE}ar)|No84RR>^z9$bBi*yQX#-xfM;(a+S2SLZtU<a|pMBcL<Ot!}aX
z>imCuc-l9UCM}OovuQefgfDj;Q!;E>gsJTN+*UPw49ZyciYV+DG_bDN=$&>ggz~IT
z5b1|S(XhqY*AWHj`eP!3!9KEC8Pno!uAZMVGFMBkL!6w(-q#*KyJ{Ncy<QqyDBN(L
zX7JIxFY@Z<L%dcS%W@QmC1s3X;Sbe&(vW>KBs;$!{M`-x>EFPiCEXl4V#)D$$8WJ$
z3lCdSY)FWEwzUCbJr#6*GbBST;3$a~-S?Dhq6W(#K%(Z=mW3sQnE%&QrKnYB9KFoV
zpAOCMb7#f~>dI*)rt-rw65kmh3D`Yrc@vq*E%n*s4!i%<_L+3K{FXzr_%Z!%Ws>Gj
z$PQxaTj89;be9A!5(bfK`u$WF5nyAgySIjT<G20a-8w2j0u^=>Klsc8!-l$flZ2nA
z)BO=jb$P$&Gm;uCM4ETKJR;*AIlHaYADfq)g~*v%4S7lM?*O@a58$Q!mL4g17pW2$
zHqyC}GF1dNDs_4H8CRGh+Bl8!1~aG9-FeybB>d~&wLI1oSie-O=V#&mZ@)XA-(GlA
zhAt$$ik8^uE4VVDXdYAZ;v+gL`!LIs3pObwaEvVjilVP8NA$S9lcaY*kYG93`t^li
zi7!+7Y$iMSPFYcN4{TukdQ<eS)oKG+<Dd}y(22v$hl(6xkxT`WVpl}<-M|nY&G9dy
zT7~fPo}7(FxIf3HLo?_UKgPzcQr_xGCXgZ)N#-Rln7L?pLzunyT{`d0MT_zf;VdDT
z<Bu7lBujU>RG*g4+H_o@oO50K$r4+kHnYAoR`I1<*84^qJxlXWNBgFvg60=SUacu}
z6J&0_g+s<{S(`d0sfeWo?X6}3&x06Bzv+P;B9_j8yREKUX#<Wf`Bvw#f>}M1|7lmD
zlW4}<QQre6)9MoEzscws(jRp6pUXrR+wgB$&~+w0vwBY}-_F&<qrgY;yH%Y!F-YZN
zJLj*8_kR(Af3I`vNOVAvn@Y_eejBdtl*ERZn;w}gErUQ$FaD>beV^MANdf1>(i=H>
zqknDrlWuvn?d2zb_8UfSL3#C8uA?IOToyBC0?iKIV7-I(p8cM2DZV|{1v2g?@$$wr
z{9Q2HX8197oYiaYm;d(Y8Fr%wDRF0JtI&y~Z7>Is!I`rDYCmyw0ZO!Yx;tYV<+2hN
z^}$SYzR~5{WMUMD14#&Qh!{HqNw7&y2b4!CA<Eenn1eLVio$f8B=q8&O9+)PfzI0z
znj`@b(VI2(7DkzTDPn2|Lbz0Otbr;ZFDs{*?-C^WjBm0pDNn0v2W1_f^e#iHeeo_h
zykD4oR+NP{EK;h1++_LIP_Uj)Mq{UnnO(%>`%B-LagsB=<%?eN|5W1VgqPXqs_ue1
z?;REu&ELS@>qhl3#P)mi-<4vN(M``jwaL+a^H;>cm`;68Os9Z60u}RU$wBXrl<be9
z)bv`msiKbo+uI7NQo;F|X1J&{AY5jjKZ<&lg^hmJ=Mui}bfQacaXI|z?H%p00_QIv
zcgj_c_btOT*hJmATca2&ovtd-9m71G``u@VxZmi(LtTNJ@jGwDjzlOXOpElXxEd4X
zJyj!k{%$(+h+u6ZrP8pspY8HEYj1F0V)%SxFzi&Vdp=)}B@dvsZ*{ice~P`YwBoGK
zO`kh|Q{cBU)gd;cD^*arJ9k2!nrh8tWNr~rX%HcnP}<O4)U0q&D0Eho`r*QgZQy7X
z$cA3K@%21_F+lQfvWIt>@bp8c^tBCs-@jeq^*4WCzw7JfC32Q|!#N#I;Z!T4TDpzP
zDt|CS16U^7(OBTIEzo~;33spO>`vjOklQi53rhENH}&Weq$;y=ew!R~+UwKZ!fYK^
z@K1Eu6(lh?Z+&SlzE2{c$}7a{=ZxDr5aH6azi60<YZlkw8=Js8b8%t&^o9~+B_PUB
z`Ezo=!#(ET1YgE!TM1{Dx_p}Zfpj6F8FVMnj&*SqWz&td=j>HSamAs<M->lkoN_b2
z&(&xw7Yl0cFYk*yer!|v{WV!)w?fBB1f)bMioeF+_&$!SDKd4C7~`FH&%OL&Xdp=L
zuk+Aum<SAe91rI5v^V9~Ek{XC;&3Ps%BLeQLVVlOR3aCQH!^`%S5G13gkIqufEoo;
zi??IaiB<G9Hew!C$gX>S^UuQD_fEnaCwq3n(z6#h6n<ZdcE=LY4^1%77!ivUo+*eS
z(j*R1x~9Gf^}BDHO^`f^lfL2T*tsuRyYK0sG{4Aryj3bykVF7poG9xwwqDt<8MGZ#
zu6;mWj&~H_AqlQ^bxOpqMc3xH+F)b)v!%wc{)6$y3;R-_?~YR`r2S-6<<n9EjN$m$
z-cJYqSEr->?t7MpG@PcxLm_Cj->Lh}>iNlmrX&osCpUV*Cw>$J{NQui;G+jGs=P@%
zh-gPV;%c}x4M!a)wVx%Fsyze~SK4(T<>7b2t#zK~rwA+fk+C-z{-eXad?BjI`0_SO
z*Jt$+@iW{UbP+1tF8CMOO7Wl$PdD})vP{s}H9NXn03w?YGOyi<Z9k8dJZ|hiR=?Hh
z<o8=IExm4e^nxTOj9K_T2!|-=muc9qcbu!(M>P8cT;6&Q&4tQc{+b+B5I@P8ZSaOZ
zPO;K$*gt0OejLARqEJ;?`pRtX=H2-bhF_0%5N6HPLn75nhOYV!EH*En#Dq-$_2(Aw
zTPL4VZsdQbTOx|fua9&b&#QZl!SU3J$@)lbjVO+nGqMZu7ChdG=Tu!`iJk)Gx^zs6
z8KTch-($x;p6ss({1Ipt@x;c-nev{=ANiE<riw#oEX}hMTd`+cp2VP2z@bYGzbP1-
z2*tW@u9JuYf!ApumxJ~X7ef2JjB1+ZLW6-%DA7TRB+lsJK~$Ilj9fSCB=(`bfOX0>
z@5M_Tb2OoHJw#Uky)&n{2aXINi7g5L)AnDSSEgjTvoD`gI97I>uz{^K?6d_I;GNGc
zgO>td;-<x$ub>x&v<kDKhSbj%M=r(N`Q2Vf@`dG8vJ86IPiL*tmKOYODi`}@!|pcy
z*ov+YPA>b}^!Z$`F<tfTHb88j(AQ>F|Hcq&<!z%R#!#aWMmTqi_1(q(#s{PPpQx#x
zEtLUF_HTYm-Z6n>i#W$hNZZysd6tE6TAp{@#)E#ZB2V;ZW$3*-4!#5L!`*r2ACgY*
zE9G&Ms-a1~a5tCktBP4{zlnRTtP5gLuIE7lsO%2(2vgJQxI!dFZ`1=Q+1C(rZXbz}
zo!8~`$Z+g^4+prQ@naBKs}lo)e1pnvb?Z~Z(=v`89pC+;Fy5P(lbh0mTW(Jecvn1B
z6Lij08gri<rt^rp9hKl$9e&s0?}o!nZ?*W$KxgRJ74)#Zu#do3&^<Ouc=c?@!=gp-
z24wFizB!Lr2N>FTN4ft9F*^IB_yAvX*K-+f=}@@Ix(HU#p)~#O1!<X2`Z(KS-E+<k
zzZ$WS=(uYU?r8IzmjPzq`Fw;EgC4-M9d`$(6-IX#I+!XCoHF)gE3Nydt43{GZjWU-
zF}qrozCF6`$x>dfKrmd~uM-&zrwhsN4+}EWPw4m9`PCCtE0>a<D1TXhEF;w3@0<Uy
z+w){#fbIN?tI&wgc-#_~-^RcEYZZ`M5qjj9S3a-{h?*R=1VV<(EAjV&eezescyxL*
zE$7;q&Fj)<^g?;L-w>uj)BRJ*ycA&pZbB24!}AiQQ7>6>eJo%E$8#NsjUcC@A_Ghp
z=Df40{%qsZ;q(O|B^v#d<@2S7@2xgx;WbJuu|$Ljan%H2_9y{ZCnk^<vBPNJt2y*P
z!!yzC1>#tK0tHMQOa`PdL=z2l0=6&}d0&maZPwCt?-t(*3f(tb#taW4KHp)nf8NRF
zqmtl$_OcB2=0wQjrGTT<bVaK)MFUEufKT|d(zF+N<iun(!p;&Bok3&p57Mu`Om_02
z=ux^V&(5U-zBoDu%K&Gs(8(zkno+msA=768k*F9c&%ejv#*CT*Rk>K1$PqssiQOb)
z4GCzN?-x_m$Sz8N-_1alzR&7(mWITJIla2iq1%J^BBItY2zCMTb?KGd#*Ha?IDWjl
zJlM}V4?gGsof4OVZfhU{^A-odwM#z`N4IzEc0|WnLdp2U2%DDiIm=`5UHO`-{5Dn-
zD*vkn>ex8P%tFo_WcjVKeayP7CC=i(+5J<iDC<B+B|>#~uIA|suW(x{Yd<*5R9~@T
zs`+~+KvfGuR1;@dPwdE^J>HXckRyN>+4tIOmvG|`5(gW^C6dr-$@)8R;_%rPTmJMs
z=t^_ERMPm1_a+p$KpEVzi|xB$ISZ9M0`xE-R@NSsNQ+8!em59<oSbU;o&SYku5drb
ztCc<s6@l74%Pe=XHsmg~XGb|658x^^mUzyX5+nRJ>E?NP6tSq2KE#bYIqULF&TdN{
z)o%mt?bdDQpN-9Zdiq~qK!q?^x=}K_n)Q3g!W7-HO!={!yRTmH?_;Jj75^IkE2|M7
z1+hJbgwGnUgp`7gqukgrKqvyu(N8o{+L)+koxb0*+&iz-4EzNw(V}azs%#6R%>nzw
zGbtTbI|!BGD|M&{y{ELe_yUkrnkUwFeUuEHh!~6$u!h<1(wag=kt70*humlf!k!UV
z;IBK&VS=U&LO~vQC^=V`^Bdr!$$&t12%^dN*YJ`e65><9Mm=L^DQ$dEa+vy~p?!2-
zGB<OTk6-rO0AxZs)Stv_hUycAE41GB5s!1O%MINwsGty`C(%D7`SF{k-CqkiZyrRx
zDHY+RO*@@z>#oWrK-HJ^IRPyz@T-GRU!ev9@%{4{yjtUlSu8iizOl|JZ1q%20%3aE
z!NbA!$?w9#n8ZEnUQaFadkpxX#cw^Sd(f-Wt6c&9D(mbiKX?h3yFx8__0jj*hOPX$
zk#=ayvaiO9D>UD8X=zn&W$G1akDK?YQ%U877PTLOt<rVo?KQVC{O%yF18IRljCAMh
z^VuAb{NuTDxTXPiy#DBf9Ppm$*>t{on@iQ*48QU;v_N+Nnh{0px%^H`w}12<zhH9f
zO&BUbMrs_Jd+%;d-Zq`kNKX6owBEoP?epot<|jXG5YBTQpK?a4d0lCipQ=Yt{;QJT
z6r=a!wkK5Ix_8lvr7A2;^oQkayP_v8(i#|5y(|7Qy7%IZ7bVC_tpP(PPU~tuNamNQ
ziQZY{AI=9e@vDbhK$xVzC(zH;3P1h5?eStp0rt)j|0ty4vb4l4M5UnLS>Ax13=;L6
zLXPwl^VxpyMuqhwa|eon*u?3#YXxhFlzwCJ_DQb?0hd42mNpaz{G6V)6HC8^++W}f
zcenO?80coAtHe(70&5GAQ_c05YJd_=D#EbL4s&tCalflR2R&LhAHXNN>Xp8)RtnD8
z+P8>hlYfQCDvQ|oexY3L-)AFluxS>R=)4@*gekfud%{*Sc^XQGyW1>H3;+gC&#Qq*
zo(y{A(t%4e$8|^td?3ICx-N3{d9P_)4MOYC*7L&M&PS`4uW=%m+Xq1kr2G8%?XMO9
zc=mApTXHMs6e1pRlhCdh>UQu6>*P)QBl1Mc2h!ke1sCPp^1U&aEN=eo<=ezTMOTi|
zf%K{@UcDWAQ+ho$OLg6Jy~1?JBzYNN>iihB*36{(;;~EV@lW%iq1`n68L(DhU+eH#
znz+^8fTC-b?(s(RQ5vpI)e3tPoRrg0Vt3*RSxRlr$#kErvR+^4JMq4qx?+v&F?CRZ
zJ_zk(+&a$D@RkFi2lxb3>Qa&2Vy_H{0ys5{-*Hnn&Qa^yi5nQoRnx2X>>Z?7Y$xBw
zi6!N_f`0`M=D-#B!i(;=Wv*CYG`5((#`t>5hhwoWs6-6qh=;6QQgjlClz#Yv%ahiM
zJmWaBsT)imgHM~U#yzeeyfi#T_C@GofJw{&dpUpmt}{|Ku{WQldm8bH{H+TMH^k6m
z#PfGW^51~?Zi?}Ip{b!{vpc{`ZTDA9Q<&PbXo*$8^_^M|E6doH?4;J?0sS!<NfVZC
ztNEG#V*zY@4*q-Eveeoeg5g4>T<JDI&9Pw=(ZSxlR#tft+G@RW^V7j~)VwPDD_5NZ
zw05qKg|uB&x_U#)Ab#0}Vy_J$%?+-sN*#!+s9ayI28{Z0vTAy-*j*5<L@<Z!xy*GY
zJw~WScv(-PW3{V!E<#IU+->;yd=K4_-tZ}q=XS8C<a@Vev&c(@C8NvDHznK;fof%$
zmp2L@*KQ-vy#m<yI5r9G-(yYPuUuz(TJ5u}3yeHHxnF%WntpmPUwQY(kM??7@&<6C
z-v;qot-C`#@+}AVe(o0s5tX-)$Ip>t36k5^6q%dVt+3BGcaN9mvyWF~kDBm31<B&O
z31W}O^{%i>-~Gq?l>`09;TovyDJ2v$K)ChXb~fnL)eGLv#|H~&X506~=@j$Zh<Fq^
zq28G}i!c)RRlDGvDxF(;d=PxBW$bf@6Fx#>1{6+dn>gFFoMGW%5><EY_K!MW)sgEl
z$m;`a-z}ZAGa-r0p`vl3Y4d6AcNzoCz4Ds8;I}GnFr&g!<|)Hos}s|Q1y)%qEeK^<
zlWU}C+_bT$AyrzN$c8ew{?+G=f74^DEU3fdz~55L^eUbXm`{JquU3pvjWg#Ak&3LP
zUc8AO*eOa;*n&EP%PeBG9tA=x@VNqDYTVy7lU$riRz9TnEqF#zRT^v8$m)`09b(M9
zV>CDFw~K$KS1dn0)NMnrG8m>$CirzAxQYg&aSR&5ZM7a7iX^or1m{D=R!q-2*=*7{
zOcA{)(XA>u+32xYK4;Wb=#Z!6p$?go`(w(fn4vry;-m6Lo1>I@Tq0XNE~%(5uB(Ze
zq!udC`tF8gZrkoM5sFb*p~Y3A-er^tCuCt?g-F5sPpFyEw#)s=FIpGOdN$BgDl;ys
zW1W0HS_??p$TdrR7HjJ_d{kZO3FPLCA21PYd;QjsR3#)b7(9bX+Ai7d-Z?%{n+*Mk
zG?8dLsie5Or50{+Xd9kXKWKSaI8oeuT~b}Os!!N@Cuko@{8L@(q;i|d%xy-8wiQZu
zn)=C3k^$S{@wCk)5Oxah5|G5|$JJB4Xy4>EdLx*{ggmbi?%1X?b${<O_8VFOUb}Sj
z17%L&waM@;Yv~x75bOjWLmt9_)b|W&lN~Us4qfD|ag3x!{Rn>Pm(Nl$#)ZTcEB8Jp
z^jI4TzI)igVC1yqeqKpKar$_&S$e(l^s?77)b44N5xTQ)ktD(OBBV{!`N6{PLHOw-
z_;G#X{Oxa_L>cD#hq6!h-ak)gD?KzR3qV>$!H>v}+oEqw*QM>(*pK=jjDD@MH|HF0
zHG7V(wf@%nVT(0wS+-zi6Sdp)IrVeix!0CC-LJ^*3#&2Fi7?yl<k(dlRVIE*1I52q
zU%}fS&|w;Uct8{Z`#AgJ`PY9(8blg!OPP|S!(@Z7SRR40A?YJ_b8&H7UXR}>O1`tN
zORjY##!uuQBkNU^X|fE%&bcF3_8uv5Gb%kKo^&)(&6*h6%d4jRVUxz37DuN>eWg}7
zqVI{b8)|&k#WE&^Nn!zb?ct8LNqEyWdY+A4aemg5<xbG!kD7<UCBT|(OCltLlZ=x>
zTMvX_^gPE}Pi7oB8W^1(QV?sgrE%Gg5*ar4U5z6Z0>Kyw3~v%*c&xSpP{CZ;=X*u~
z&QCoPii8Fp*@=w>M{)tV^7HHc`_XrQ5c8IUgMH&O+&p*+>V_vA#@`Fj-c$sv@DPk^
zKU-nEi>$C0`M5TDY&t6Nrngv1ZHuj$GM~69ObM?hAkufFCUWwdE3VS}$xa(W#Ihf<
zoHZ_{3VC&kyj|98A820OI_G<f@wk5o>KL*nX49jf3I^Wqg*_1ilITC__nF05K1Jp{
zvdWy&lmc%vE2mrtfx2Lg8#Uv&$U@PWq?PlM9jKEBLj3UsmB{`G9Lw)@9*-N^f0cbH
zS>|<j(mvjIKRuuMJbLjMge*1W(=v?y^eL7tK_{`-9-!oYg>5AakpQ}}?>}qO-sFw(
zRD`$qo$Z>RA9squ`-eUg{1M-K1~@|%c3@Ky)csP@yz%MBn)i?+TjtUiTE1l?>CsFM
zv(S_m)XzV!Pt5!Mj<Og@sBWKoHkwel@~Y`R8gD<@i#dpB%F5`o-4wpksJcyaqp??x
zOQAg@KJuSfkTEG0`8|TO9-v6$II_`mL(Sbp?X@WInMeos7bkI^H@_X^mV5|(@y|r2
zu~3oik2K9xozP_DB5XchEJML<U4UcgO7SSBci|zNkj$JLe1mQiw~oHP5QCidwfVK4
z7Hykf93?_ORdlZ7oIn%}O9gpcc;Dn$xBPC!4Ie}=w4);rb|!Tdvl6A>&qr^h`~s$n
z8HS4I1O9*cim7x8&=041d9z){Rq%Q@g}1?@hVCjx#y2Utv@G{OBF;*OKOfe6ExG*D
zzT(;5L7KrmYd=>@Zh2qySq*qHMB}f)VZFt*jxN0=2L?2tS-(4dZtl547cKs1@^=v^
z^RZTcA;{B|?~C-?*XN|%J{XD#s&~b~+U`Ez1#&s`Vox=Iz|9#-wmV(|rz{@x;}l8R
zkCEL>E@W%2f@h7y_nik4Yf!FPd|%l1tW(zYlzj62>Ms3k5(1`Hk@+&n!MD3cx>y2u
z8GBvczV4Jso&)rngDno3Zxl&v^Ufw@o$Vc*uAy`)(GEm>b*)u^8_ubIJ9M|i9&w$e
z0~YM1@VRv>eyl=uPJYF0NQ#jm2p_MUO4p`+x{QCv3{r(-uinkMiG9oQifLIZzdNYB
ziR`>T&+=$Lq3*zu;d~0ZfOfD3!49dZfyk%8GR;9CR|d!|N7{Yb6WZe&so>URXuL|!
zsZ^=7B7nKpJiz~+Yw)t^MPKxk#+X=#Di%$0eB*Rx*6)65eJ8aoYBQogB$@_B@)y=*
zpYfWK(?o{Kn)p@%KrEWy*-=f>Mpx?aAbicaIT>~{8}E#vWHL!F-x0;>fIl;Nm(IcB
z+Tqv+_l3NC(#=F%R0&Ci@tQ{q<0IWcHWI_T9%Zj4udV{3a5TlOLhB8!OH|7Q40N3B
zC<~>*V#y<%ViHYkQ+YC_^B^bGpb+q&g0K5o?f#a>>z5*D!WD*46kE~&H6_FYl@URy
z?-t!I@}y5#D1KC(M;(fEi>tC_g)q~DFu%y{w??xO-!!goP={lW$DGGLW#U0=pN6%@
z={`6Yqq{gfH#BJwB#CgLO5_;?gI={oygPXdis7Cp$C|LDawb0%fJ|1@zg0cNGKt+T
z`U9A=Imp_q^i7S#2%9}W2UFI?a*!`a%o_0gz?z%tRC`23lq9tyw47jfss0uc_j2c5
z0!*;!i}5=ksKRpsaH=VBhCDTF`&8sYsP-7i7OZ}aetIuCn@9hEe*OoVGVbXMf786k
z7-nu;(tct5kau9$d>2644n#<wQb3r!VGT%S_^*a`CWVasfe%P)Zg)NSPd4$AyQ6V$
z4S3JE_X#D}pVr&gP>330PYvM-C(lsEoQvCtdAOMcA5b#wKc1gTHrySr`Gr*Ix!Y$H
z`q*49Af8_(^SG>^1Ccq+-!|Jy?$@r3$bd0D>ks#Lmb6$V{+bYB`wVu(^1)cz5!<sf
z#ugr&L;4MS<XBeL8_6<Fdo`~MbLZyU<5{0mpBNso9{4{oi^urC{mWUvmLaU;W*G7s
z{+40fNedZyjshV(M@>q*!((!(EH7^{H;Okn$N%(-d?7aCmR1kteED}>76o`VOiUIs
z`hKVA*T>muiEn+9XKo)c&nHw=>SDG}597H%oit5Ow-ffwH)7TiPWQ~_Q`v4Yq|Ao}
zU222s6^~+r!ChTytw_#!MgEH8Y*9j%n1Td|lq9R(KpZhcI*jp1WHUgV+jrRXQ^1TQ
zqcSrN1AtYYatB9-o)m`H=}t}p={MNB)fMmsCb%|xh;oZegs{fkZn8<zDJfcQ33A;M
zY@H9850Ev;5b~VCMF(A8eq&@Itcq2GhXm|PWk8F?wk`a<is@)hwB0M0a>z$!HI(D+
zibMvOcYOP0-&|U%J)Ok~6LJtbHUj7|{kT&kIu{L(;5X#p1e8T~r_ZPq;X0N*Ach!X
z?_OGKU%HmX_+(fMsa)grcp2<G<iGk^nSj-Pc<%?c1ADwX503GWg<myvl-~6uwK)<b
zWyN-^%ej5bdiV{b!&0W<m-f6EkYJZA>7NB~-;BN~$@0CzFQU%0I?Ot^0_wLNt_b&J
zkNh?vXf`mc!t-8olXz1Rb%Pl9{bsOoR-zMgLLmQ32+_^`sA^7Pq=2P*=C|U9*f{u4
zO)8Q+p9H_BreD@VjIKS@;H#aQJ@IXnEWAQ#>nsGr<M&ZXS{*l~9W+oVw&acPEMWE2
zXVcuViFf{zx7FM~tRJ{?u5+9#=f2{3pFZyCxCNShb%=V?FQ1Kh*s9b4<=^QhqF$bw
z#@kNmZ5g<6fK&QA!S0zBmVRE6<6o0`)u&pgM<nCswno(mIJPz1hNtU!+WClW31_&c
zTb+Lyef&n7oi#y}{Qd8{jq+J#Qxu!>i{QFCPx)6|kI0(uugG5i+ADXtD|_qZts*eJ
z_OwF&OMf{Fk*9wc6?^}VTq_kY<QN%w3UhPs?a<GHTa+A6iTT#29kxbc3a0HZTBQYR
z(rrC&9COs^JRZ21fi=>wqE5+Ffr(;A=nxBvydZ3}1bRh#%S(^|8dsnXQ{n#}ySL7k
zi9m&bE<`F@(StYaJ<sa0yeH7ZER;87x1>ZYq`va4Q$s@d08e^}{lnHO62p`puAt5=
zAvq9n??nh#NRPeueb;~#0ca|GfLQV*Msk}p)At^T*r2;GB5phc-<=IM7Z|#(Z<eMj
zC=@rbeHe9Y7(ZKQoqKH|d}Q~VOCbt3%Hv4UP4eRES$5|5XFV~{ZW7@==BmG7T50+7
zaShI|?S`Th!w_LCTc-tZ5wTusyQq0JMMBygA<a3IsUzk{CjMP&m;R*pHd2u-n9#s#
zgM*n?XBjzz<^x3nulDct8YQ@A+fHsX!GEZFTm!&_M}O>$Tn5xax=ai<;ctg4pUjJU
z^xDIwI15^~(JRo*CBxxhevi8Id*U8y86F)PmTH!^UeFtw41-hSAKf|sx@-`Es*|?O
zguE=<Z@+`9)sm}KvkHP_Yg9zbcdJb~y#|A-JtiglAT5me)|b=M(;*&ThuYqGx74Oh
zybrohUUA@ebaD)nZq(n{b<lskuO8$18IIp^=H$i>0ZsQXhnbRFox`%34K^2b<R@a^
zu@Q3-gT;l;#FTvz$~O}=j3XY&o+?2C_jFk;6EAES(ote~ZIALx=EWCSq@+E>>hzm9
zOgJ$qsJC5A^fN#|BR%cecYeCa#zGEz^O-(-k4Wp(GX>XarVN3i;WPwCG~E_Ql@x%I
zvcbH}kU<xFh+tFlcmlmC^a<hf>>Ogk%w7@G-0oSBmFZjY=%ItRZlv1SC-pK)5Fp6D
zH~z#BfIO!uIx5d7pi~=`>7S2IZ(?3Lhef|w?N&msj-}NlXozGEl3`-Z9sl;CX@aiZ
z;y`B7-ptdKc8hAm^_YKuujOu^Din>9?|~kewHFd?bbylAWg&G3|C|$1f)nlWX6Auj
zvg^%z{Tu=6vmX7xzIli$RXOffDa6tywTb9{??XR924!>-LiueffYpLq^JF!I!im_)
zm9m&ugCpAGyLFV=*g>W(%DsxJkn^Y&LrsG9ZJ9q2dcnF6ZL0d&)5?D34a_ea9q!(f
z^-ESlUP<2Dowg-GC+L1{Q+}#U`^C_<C2ODi+)t=r-ow`>M!Yx~D|q9HmD5sQ;8WHp
z_bDd;KDZD-*y&tly=dROj**kNDCjpJlOO_3<>o?D5yppwWe%f_jl7k5{<#wa8fG#!
zPwwcDF%Y=fjJBRa1g_83w}d{GcbJZE7z*?I@^DN<5ckhus1D$jHjES^v|*0+kohDw
z<YGhAqVrY$+O{XKy^}R50gjto9}39Aiw=o*?!$f|8b>0(xzYPF{r|j&^@RbohTW82
z6-htAJ|x_j4d|2-u`=8oP?Laq@64plt+T*eXPOrjng5D82`h$Qy*(8XkXN{&3cgm=
zcfW#Yefve7Vn@8Jt`@gL<{N!~5tkcr3{S68)^Oaj1zy@cJ|`Aq64G)<CxYhgRgW!7
zGLDpVD^`%XcAz+4yf`w0q56BtPeYAQlYQ<WrVfso6Ls5n^^5kOxX?Uuth&BmGuij1
z5!a3YuPud*`53NdL!8;iM)Qgsi|YmRvCahsuSP1l`nwphG~I$s-LLYy-u>ZR)e^cQ
z5_*xNPkyp%@eXoc7rUpCuu%Dppsv{V{p<FyxD}33t+*Ps(QW(^$=i`UpA<ndFDC@g
zh|%gt;8aF8_^*-ffx@%{%scJQXVJg(1(7HfYY-3qQXbPX!1k}pTGgG1mjl%9Z_O6>
ze`dT!UuqM9ETLStYG2B>pAAM9qx6bAUdQn#NoqyTb+5!sRErzblrdzal!XS1N3+R)
z9X05x@d2y*x1z_KBm>{4I$*_r3y-Iu|F_6G9{|<6v-7p04%pz_XXZ5KIrI-!No}N9
z8&~cT>4(z##&vBb5@z^LIe+H|KPM-Njno57mYBFSa&cG<4VK=6Z6lahHGy2N?>b$_
zX_Ks3vs0jHtj>x-m1F_K0KdKSSXKJX(TG-mX!`g?(MM#+2O@^#-<V^V3`G8M=cpki
z;SHdFLrNHkOv{z09RidoD4Nk4u`Ef|Bpv=Yqa@HzfD;qXIS(Cc+Py|7*lY!(cu2ZS
z#pXjHYLR5($ag6Y=qZ0vI*Wc843ub_tewJsYQe)QkW>2MPw5K_V=@Q<M@d=Ep>^*#
zVC-d~;p!f@tm6~|{jQa{E3lBbX6Wl(M0IjPH+K3ZNUf-EK9S;|+40|{s|1MLIezM+
zpU3W~ynC!mmAowh2|5??*=~Q0{PaziOLLTcWH~;7c$k;F4?C?^CV_j)VwIhnJxSB5
z>t8Xjrv&(8DqudhCDK6+k$q`fkbq*O@)-FauZz)INmz3lkA2b`w%9|f8Fg~`{f5Mh
z8uutks0!t1VEWp^e5K&W8HnLO5QLl#HC&693g`^LQuEc}aYi+x`9U}9Y(x&J(;39g
zJH)`vQDSPWiy+8LNO08p6TSc(U9|9vSnO6IQ#rZTa|c2$+FG8u)JiL<7!it*znUM-
zO@vnD5IOb+7Zkc0fC@y@-ZwHkN~iPpn`7Vn<!(bxa?IOvx%3*HxY<D-?;Pr^lU>DI
zUTfAPen%{)kuK$nUMTaaE;d9a>_cA2_gPH-a;`3T7IAyznlIqOaB{ZY-m65fV*I-v
zJC<U#wHK9#=(9-oT))FnwGc$Qqlw~0{I5rEogE-RaW3rF{HhVc*_5Vf^#5>mR$*;*
zU9?7uySsaF*WxY#+EU!z2@a(cr$BIuYw_al#e-|G;t<@ucu)HM&p8+8$whLtFS7Su
zYpyxRJ4RfKO@533&EVJ<VqfNTg5wz+@w54z$8UO;M<3JnOP*Qg-$iRF|MOHeqQl~`
z0m*^rqw7WOQph7#mq?57fGK>3Swc6wjG2m*E?MKvpVUFl20n7)cZ(gsOfLuhtKW`w
z#HC4ER#~dlx!-M*eP?{SgwL377AD2VUcVvOxi`OCepN9_yVE?7g*1QgqxgIz@LEK%
zcqnuuLY)l<Div+jvg&cQtmPNW73kptRkA+AB)sJL_ST7cD36=ziY@}kX`a_S)R&W*
z<bg)8*pW`8)R~@o*E1-U9;oco1K%7*oM6xb9QlDzFAL>^AC0SUeB4}>=ctzH#B5lE
z`PiC$*8A!)ar+Fu9skLfl9NZbR+>el5*41DLf#w?v4vM~y&hs;PrD$KGP15bDnI_f
z)d+dT-}I0s(mAQX=8DgZvUlr$l_~vyR>D~@ogEEdzE^6GxiqRUCGN2|I5E!b`)6AO
zs~Bno6Esl>Jp~w?3{HfKg-S2W?ZjN|?6@qZr65aFY{n+o4w9s%XwGksx1YyXNQ*52
zbIW`n?%SAAjES^o3}u2jix8y3|E?r3O??T*5N6k5P{oWTm$4}T;gKuRyMh#`;-fCv
zWn#VSEECO63jR>=^lKpAysN&p*E=2%{9G;O@$+w>??hs}YRQGum6N0Vw~r5Oaj@~>
zK<IJpHSQGRJsgMU$T1e9U$*cRO78V`rj*DX6hV}xZ&Q6t(||Fo^mZsLDuU+?M<v;o
z`}l8!#GwR!LCy=_n-Et-Zs4SCdvvr&BycO%;$r_2a-W=gty?S2LasG2c-TOiSPn+e
z)j^z5X*3&h3(M;jI+L#w#?@^y>fjLe-(#!IM7F?dF-Q%pwOq|&)S%fe6uUIfIrxw)
z@-k4gFo2wuJleSf&x4Rnc|0Ih8g7}+W$7jL$PJ5p`?t|O&IB!Dc(b&PlP~H+E-~;Y
zRE#*ofb^%iEGjpo1dd~m;pGqf!c<hH;t{qg8->c@p8s^|IOL?U+V&dl)EFN!lo+-u
z#k0*@cb_QMx@eOneoGTunsi~u5BfNngz;FO*XHJ`Rx2VNNJ736Y~&5a5-dg-JvUqS
ziMB{>v*g&KK9w$w@5EyfIcqd@C%JB8n{VS%4jW_EH-93Crw@o;oDX&!YwqkNU0qFA
zm!$CNtqZ!>h?EHYCRcD#&+giv=lPF(!jV9gE0tCv|0XlHeD-bcEO8{u?d$9=mIuXK
zLCrvSY`1etH}`--u~=^1r=MBh)>ouVNEsV^HwHbc44+~iu-G>&{35^?hFjCC?G-&(
z;oem;;49xy$64({QX6gvAxX^SZpCk_Pd<)0o7p)zLn?ngo!?}+e3@1ve5q@jk4mHb
zw?F;+Gze@y{64g=9=63Stvmu0@=6vIB?MyO7Y$wFU@vjmBQl1b3^KLcAI14KD<D!Z
zC%moxD2x0O68@0<b;w_T1kIxQox@Zyoi9uluO;BdBp^-m$2@G}4YsO>%7D91=$9Vz
z0LOmswzkSt)d4t48oQdvz5CnH?O73Ffb0sQ%rlwhlKXIjs&JAF76tm;EajZ;<*bSN
zbJ4l^-MNN}6KeC3@-PNq>HpDGG|_$W^_8!yH3wSszB{4Bs^PGb%43wm6IEQwvsVy1
z&<+lk_|bD2oDE~CY=!8_qCDtmRVm+%2Eh%$7iHCDz%;J~$DKQLlSm0Ic#=bO@$7KV
zIuCL!(kSGcr@ycwsS;MS@%=njweiFWW6(Iy=&J1bhU@j>RjLmcsQ5UFU=m$@L~_Z0
zsmSh>zKQfzCCQ_<{v-V_u_rHW6xqjSv)lH0M5d#kVE@Oz&-8*csYwQbRe*Juus~1Z
z!*F-LilJmislF|^Mz8Y=r9pjP4eV{-e6$PVWidWo(8+)nPF^OlYg=VoX6K;uj$aN<
zeXPW9i$kt_-*G&x$Av@bM8kvvp#Z`WO@*F%=$_=cfQF+u7wZ}L?JY47C}7=`1d2c^
zCFXAlGa09SL7uvZ552o|ai04P=D&fe=singy7zE#OxuynFtNYuLEUT=zs5aj+D*39
zgNEEX0)-<SM!%k*lR6LuZ8{q+6R^HR@6P?VRz+m7eDhw^v`aajYe>aB(0vKy{8|5*
zHAVBWD0rgZP->To41L0jH&19!Ks1*BM|b*}POsU4J%ykjg_J<LCBxVNvLUG$6UXP;
z)yAz|fcfGC?iINF>&|v5@cn9Hb$rjD*6M^x9G$AR@Bg|oMx0nhM9};8x{3$iBtWK4
z>Q*_CN#!oK1wbq+lqz>DVwUH5Tdpj##ThkDj#<pE@6n@#&YBe-Bk$iX*flRLHoZ`#
zVi#~?eJa(aStkqSF%}Z6mEQnkh>bzK`DZd2!6&zH4(a=FPN?rf?u1TXh)ligE5E<g
zDhdiPJEg)QdCRc1>Y!j>ww|EF&t{+XSBDiK<;H4VDVm%#`ek45w_ZdN13z_k!fz&H
zW6e&i0Hal<Ehw(~5@ysn-`uykfmx{fIn5$a)1d~WMo(-Uf$UiRlZaH2i@V(TNJ8^)
zu6@gh%OwJ8uWK{X0c2wQF4`L$%MTf*|H+W&1#x{u+?ir*`{z|Eb3z^IH(ePJboH_+
z^W^hPvg}4$-(gu<Uf+eWX2&2`2P5CL);#R~6^gAHS6TI&iZY*y9oH1XHw`8J6#efo
z#8Zas$s_yp`&SSf48nZ+%iH!#z_<8dSu$$6!{zU|^<a9xi$F{FwyPOO{?aN>maFBZ
z943@A@E<J29bpv2Gw#>JYckm{QlgZ3y(#>aBAAE>ZnFK^5r6QvJmT}5?9jLnU7e5L
zj3Nm+(Drvp2&<A4@pfr=JEF?p`!-P@bQ<b|>0f6-9oPv+4HcQEnwHl)lsOctdM_$<
z#-pA2+rJgrvLwah+Y&^oK6`tAD9r;{)(yv`(E*TnK6;SfbBOy9m4-vnqh5)@r^M#(
zCfrx<nX-ui2N?O2o<yEr*K4k-c)PCu*83Xr)@x(e6W{VN#zZOOsCaw9ziAM`ZVBve
z5b<(-PF^0kd^J6$)&|q*P5guO^#>zo#`5%<R$2Nls6@a2>j<9IBa`wi=uatbnAVwr
zK8!4>p6SRqvIZ8HmS$0Xp6I4-&@1HaG(Ertt2#dEt(@L@xqt>98h-8(NH&M+Px%v)
z?5ZByEKD9Ay2+NpzbBn@CpyU+c96F5k$NsNH*}^|VxH}q2xpE11!1+^K`m&7%=cm4
zzWytr*KDo`E4#h>$<SltiU$f)6%D%7UCmqs3Onhwx4Yh0&eF%KHn%@SJ+eMD4V)sD
zQ69cRJnMOg55?F50)FI?-rak9Eq>gGw_V(E7z@pAu*xCYC;=Atf9m;!!M^92!nUc0
z*)XALfkMrWf9_ez6B~{+TUVX1c}Q_*_3^||gW$%J*U%M)KREHNKewkj5a|er6;$GD
z3rrUyuP%xejYuR&HQ1hNWW<3{uCoAm(CEOASrcl7*$|H#Jd7!r8frGB04w8*GnvbO
z53%t=kQgUbTB%P^e0t?bv?=Wk?-@9l5V<;NKFkq(K=y?4q3f|)ZQ1*YL%*ieXl87g
zCN};!YT|C3?j%q2D<R^}^9Rstvrjm!cmwB<RgthLbsEp%rW~T0s2Ky7{br(#*yej*
z3`W<@<i&?8f$KpS?81)Uem^1gCpnL0zuYX?kKAo=vM*{---N#b_jB|g!xjOTYA$6-
zQ}ZQB5oM+bmmjf)7^a^^7{rmW`dAnAx3SErsM?ms7efQKb$zI}^9k(DntegauJc2R
zbd1+jMF!b0q1Rq%sXc-AylL(F&jdAI-7aM6rdskKDF?*r!+ARnu!-p};PSQVBH*}!
z1B#DD@uRz!_jsru9oJY?phC(yHqz?o56NSOlTjBz3`AgezF$6m_KL{g*OB}?ragzI
zRGyrP(9X)s!-eOU+p+{IIt}*nryt}pjbu}523>CC%(2*whhs;RKHY8p6M27CZ`c2P
zRrh*YJA;gKi@#5&SDfjYUkG|!>ezUQI68m5!>MR6bX9{|)i60s;os`j(oG52aL9z!
zMer)dl?2@vYZ#%GR<0@6hhbhM!AaOttC#L#-z0zY)FI>U|0LnnLb(#616xCC|B#!3
zAdl}OY44T&KMxpp-`j^t?35Y`&I<slG-vJ*KA0I%dov2{KU90A3-HkRw9TEd0iaoX
zB-g5>BX|5*pIs;wO1J9_w{01Q*1DUO`rc$Q!IT7b?M@XRKf?LB9*vylfy0sEs8+Nu
zld-8v_n&)1rF{J)uW&a~BRfkN&WmKyL6fV@o4!Vf>U5}FW>TOihLgTgabiVZXqGF0
zf_%rBgnkItiRYIx>XVW3;s{4qx1%L&3k%_)uXK5zW!4fXkN*)15|KBrd>FZ#NJpG^
zW&Wlh!xHr}-^@pF6iwVU0k4qQ?#n~tA``IbHc~)CTOL%$pL4myn_`aOKmepkYNZ<S
z9o)_qt{iHY+*ViQ41CRvh%z7eO-!;FdTedz&av$%y5bAj_UYm{<>Mgm7B;Y8HH=tQ
z6=C?YupAeA=ZSxLt@l!?9vTN&<xfqtHQ>~k>IR%B3unJ-LaDxxt^d33)y4Zo)r0+h
zatz(?Rv+)Y7%6sxCx3P-wbhhx>vZigH6e}CcqB_IDsOJn=b*=tq%|dyK0^#$t4y9o
z_raY+#b-Yes`Jr*?@YJ|+W+bf8C+&aEYw-_+F74ycNC^w_<S3-<wbV9s&@=l?3NO(
zip}o-)Lw5Yt%7ser-i^&Sj(8rY{liK^jfmY_ndod=>go1dx=2qWHA2VQxNX)$aZ(u
zm=hOmGW_58qzXRP@=NStuJ8|3-ZX*2->SvY1wzDOg-&&EjpA3o4NpF?wy}__2Y(5<
zPuHnUbYFzH=CYF|;ait|K%LbOviN$Vv_1a&aMP@?vp7<quf&mrd~y-s)5)UHC-I5i
z&kq$!9?#=D9ol`ls}VFUn(%uZsDav@kqK}9EhKaU*~E__u2CpRt<!$<3N9{^7_QpB
z!z{Je)BV9i>JYvvaPMH7s}P=z`-QPjr(V6pc?)Dk`7nDJ+WPsMg6kLh?W^|_<?EQV
zoUtogbuzj4Uea$MLNxX0R<S&OyvV?}^j%GqE32yaYMdeBiI!Bqb5OqgRwn$zUHl<@
z_^bckhj2Tt#(ksDN3%a3IasQgnwD=`GzIUBQzflU<;8E=YwORtSU>C^y0D$Ldy3=?
zzpJP*pSdXo>^4q@lQAggF>gx%-VT+cUEU1|wIbN+54M3UchvG1f*g|3tG=gzp9wEy
zyMc1MBU&`qgue;X4CFPWf%cNhEc;8FP7Plc!;MA`+r#50G6<4<RYViD=#e3C&WopM
zkHh_;XuMg8VhP2FBT()ar(?&O-|zpV&>Jh$T=ww*_L)ODzAPLk<&wrHf5#k`St=I|
z!(|C4Q}r??;~wF<Nt}cAB^3~#N`hVXBW7CTUSNSV`y~a{o<lu5`f?FJ7Xs?p((<!s
z;`yS6s(Z?IRDMh_@efY0ah5V%@~eG97;CWRwd`QT!YJep+93F7`4yBhLo+1T-)cf>
z{<o2EGXn*<NzbX7)qU8rAuO0c(y4DoUL*$zD8%(+{=az|hq!dPC_!d&9|QS;66Vy^
zfj!~aNIf{l`^D12H`0r(_q~E&O=)DPXY&)UwcR-4+~Dndz$%2z92W%p74RIU`aKJ~
zA0e%C2>4JnzMg626m(fEllw@?`rgIEoVMT6xt+>M?Eoj~n_eNzb6|9O$>(yevWvI3
za~YMQbZ9YWS{a(?mJ;oq66KSgnWqT-{?*eG=hP1$-hmt#1PdzZyxxC;P+T5{ImLV%
z<NHPBLT5Z<cGQ<$T?DtVKOLSJv7(cH`<D^x<?YM%!RCbssG<MXM`#USTUU8tiNXAf
zMfy{}WoLFm%U7y99mCU~2i=Uko-9HZE;=Qbl4K_7k=*5B#J=dNXN{g9#uV1#4DXn6
z;*kC+9fnYz$JV!wDV!fC0QFXDa9XZ&G>!!$ch$o(aA=#|6R$hejo<x5I}kXqHHPo~
z2T;=6Ur{01%j1qxfq|T4Oa23tL{bl_61Ihx9@yncAO9`xq2$9)_pQD~;{d85W9Ae)
z`!_QM7+?M>LiJiK#gA(Rg!IV+2d9~m8z=d_+A7H!Hmm(I<b;!_97Srd9=Qv=D81`;
ze`|jXvqszx$55DxarJ71)*2_pqfknP!5giZ0!MIgxKjdPprK1Z#?S_z-dT3Z@S9V`
zLsEkkX?o0&C1zPtX=MxmW$TUy-4%>7)Cv*u-CX&3iqMhII*9~N!lU`r3(rAt!^4a?
z4UgSUg^E9Od_^+oPF_A1T&=d&wyh-4bh^+pt`Z`mkx$SIPu@jP{R*%lx84ZhCPT6E
z{0<s1i@(&7r5AIL>}*;+!$TY;y8`~T`&L-Z8oVuEu*%Ol&D~d9ht!KaCu8o_B#_{9
zY3!1*pY8izsuXsDz$&)C>6;3JOdSeL+GR^wbQaWDl5!F3XaCF(Z?m3%mH25QRu^Xb
ztgd+1h-@Vh4>Tdbd%dN#Hj?`5Z)CgwUf+hLI=B8!U1K^5uhQg8MFXd3#B9*<$nB7O
zmq`T{Q{P9)Gl>3nN*RY2cNa*rlM+<XM{3o~Gkwu_VuXUdt;+%2m%QGo+heLaXEG$0
z`}6*#SPLdLt_nVj7_esL4COaAzU+#luK9b(k=k0rz3+LrQU~hyS~aPeV6)n2cRK!L
ze!QS^tzcFcV$4@5;6)5#Y&KnfRZhZ40kM|5?KA<?92xQvmE3yyo&6}jPL4hIP8@!w
zvrZGp&HfcaXA1~z4QiGlm2vOI!{4@X5Y!hjg78>g6a-_uyGpM{5};xd^erOG^L4AF
zoQ2yD<;F3~Y#qqZz1Zk8K+dR^RL(Ll%4h8OAx~9s>xB+<mv*Nri!w`*5bq$PaAlVy
zS64gx#^1-)M!uPaRBdqofMgja76B3nw5rn<EV^=)^CaFXg#}o9RuaSxGwTBYE)|o2
zwy%ViksVN>B8pU72c@4eX2*2)dSpVoHUyJ8T>a`)Wg(d@-5&rJljDoP5W@&-Z5A46
z!g3;*`?l(6Q!%^G)oqAJ9DB~)>}F7J1kD`$*h>BFwd&UwZ*OAD+13H7F(A>1im=At
zv{%A8ksiMACC_MvK%JRtM_fnJqPPhs%f;Qb^y%3*Nr8%wnR$uCqlmBdetRD{%D*@U
zG5KT9Wu?8EDEY3)Y>*?&O*TlPE17Qbz45uW`_nA&iY<lSKppEBRYB2+?R*Try4zbY
z&ZrZR_UfPNh6Y8`TYxwt@%%r0r85%X`G81Hk@<3@USy3gu`mV3l61uUY9tJ0pD|FY
z`#qkjF|#z_JB)bRcw{Ja?eD9uF^*OCgJP|QWvJ8WHeoHlQrmfStWydrzqz$beXNZ&
zu9*+H@qGG5&xu+Z7el`8#g}1|pj+}{belN`Ri)KW<_Z=SvpHX)nT}#I8LviNk;@Y}
zCX)%IEG?_+3&vT4qwt{eM&JtB&W!5E4Z_>(OJ}?1X-*i(B7RU;Ti^3^1K=1*m28Fd
zj6J)-M|x0idiXCr_psMSBU@a4NAA?Azl~ONM%N<*Z-3;2RTs*(rNT;xMQ)@5e~|QU
zt_HFIU(6T+m)AVIw$#Y}Fpj_l1i0fHlyCud_Dcg+rF8%6w7$bC%FDLjPBHgBnDA-O
zO2k=XT5n|`H|0gYu4_YJz~bo`P=wRf1kGHk5pvR5=bO>t$N0Pw{%-=&`h(nzBPKr9
z0o!b%1q+pIJG>mTZ;1CXLOY#TFRuV{kD>VA`Q=A&BJwu2d*IqCdy%8_<mh^fF6TKZ
zkeSXYnbg<bOkG-{Sz*}(jXH2e8f^tfvUxGfi_$*GK7$%4#F&-#KoME{G96iJO*bw_
z+T$893U@}@h}CB`jK>*<)=wJ5YR|<3L<N{o?<3}Y4?9en!U68#P+txNYo-suQb4q^
zU@0J2QvXsw{Dw^fAKo&7;9aGr1%e_BdSqjUT(=EJ5K(lhZoy&z6lE8Hb9P?N7+g7l
zQ<K1O$D(wO{cP`nzgvFZ%!mjmku-tK*5Tb<0gfY?99~2PgCvMW6cFcHc1^9AV|3tR
zzMjcPcaF^{hjr!o&`0~db|twlwNXuUe_oEpI(^9XpwU}==Tz*}Lz$<;COeZE&d1$R
zsB1?Ocv~)a1`FA0JJUW80W!7q(Q>}t978Ql?y^fDdhf2zk{i8n;&l`mmsK(`$e`~h
z=e%#O*sDjk6mrU0NIG?VZ}iWs?Qyt(UBC1`{o1`OL#%PtM<8y^Bv(Gp)OPhsf7~sI
zY)h-VImfYh7OXHUY_l{&w6fSZCAaj8Ep|>*lr9POH6Ip}I5Hm=^qDwTkJw75IF_Re
z3_fggd~hfF4_Z8R%zxMH%B<bsGn>;Ji9%_>_cC$N?7`2xBH8!;^*#4^dPW4C@8@&Z
zK=Yl<=2D)%R3putwFBnH^|xp#9R-q#z80~gxpiAm1(aBftit|#c;Y--@rejiVa3^t
z2EAL^`G54H6rQH<rZfgpf=d$ss!4ed7JPS=)!nHf1{{VEP9p0kz%gv1poMV30eK2(
zc?Muu*!IM9g}WQbRnpl%j2A9zf#Y>k8b^#cS0bz+cr1AgiL+XPV|pP-a4Bx1xb`R(
z{+;vagFV>VD;g*pVMcqL-@)j0UhkHPQ+O|vO`00`V+3b)ScfFrt})T%J7Gjo83|}X
zgXGkhO1u~D)HIx{iD2}t?D#y~AM~NVPg(1Q@K}AQgX!cxN~2RDX?1DI=0IbR34$@p
z<|64_sA4;-RC|<Yq+<-JhvhJ5SKz!5?}d8PPhX_373Ap)Vw7or1YxI?PvO6a$KMHm
z^hb-3>1*P%+DZ&=J9v+RxBVu6PYKjFuJcNJlyF68@~@K2vg;{SZm|@7n)OWYyAe(V
zYOlLkn+}}%m$n>xu&(vDY+1)UrwTP&d>wFoV$lhINfzl?daDwN97tU{va)14fk+bI
zc99j?89OoOzU1xT*F$HTOA{#CXpbC92``mF>%ytm+6lJ_KcKI?m>SM9j)*OwP6FkU
zrVRKd%<cET<dA_-CG(sOV9SVHL1I5r<G5eo1qR17oFW{tzWtzZ(c`Ahbu#7%ZY6q^
z<{K8dvY$FJeaFb=pjz*utZ6uw2rq+hnn@~m3*R1Y*}}h#GSlUXId+XRl4m5Jh~hXW
zn|w9bl8l}(&)C-*r+Cm+jpcGS<sNxF6^Oh(L>O0|PTPJYLjGmW6lPo-Cz+kD^k;ZL
zS`ttIoPFK=7RwzmBCrUVdPH_@*N%(r%O+PecoaO;CF1Y{>Arnqjh16$NeC=JJX6q(
zn8V3QPKx&*nV;#u@#cTm9Qr=$0@vBAxrhVB<HB7i-f+DelzT;7FR>fa)`?se?yaF!
z17{dYCtcW}zi?t9L79KW_F%U|7POTvHh4~Zm`;+4;?L$?<j3~nZqe{d5Ns1Aos#{o
zH~fz6y{f@e95$nyLF+$zAL&2j-<t5ObSVRE3L(0s#U+AEVoVo*c>Imu#<Xf4(!Vro
z9+U_=2?;MaE_vN7D&?xzM?5zgxZ?Xv6MT-iQR@vrlIE=yUoS`bAL=HZ+5DlCq*xNp
zk!TvN=X$^zk?VoVR?7TdoSNkIRXXQ^0B0h*`+5oBKski*4i5w7cO?%}hQHho2|^?#
zSw!lc$RM9$N3o+5F*oXCMUxDI7KGA3VP{2wp7^0w=hsOnpNJ`N-;S2N3t3!}E36L%
zW&NH%>Do?9Txx%Rlux#HcqLjo)X_{x4%zRBc}R=W)EI16ecLuCwDVGUL998i5dcyx
z73iB!%l8u>Yr?k&2EKb62ano1TD%s?S7eZWowgP3AN|=QqNWOOD8WK@x&(XaCKobf
zg*<(W$IAsU`$IsN3KTAEElvJQ?h`j(leqQqMGQpyQcE57(-ghPyJwFfwqWKno4A;d
zLL*c3y*6iavJbCB1?$UbJ5}{dYPr@%F7oneITf{Pz0k%M7{P-&&axVUrwjg?qcm+G
zKxTcr$ES3%Mw6tByvKsIR%dE9LAI|a;KpFei}}X{E4)__67*#3Ge{lFMj)`ysIj?#
zx5ORrjjrm-*4%}f#!-2gwiKM@9I}rzmS95ZqRTv1FU4ixB5(@lGA<3Xn`vH4;<1PG
zO?N@P4novY0iz5B8eJ$4ogLn1=UT&+<}3;s3L`+#n-YUXW@F`+(-Xhf;z=XBagv&o
zl11{^OV%Ch1RG<(OZp0}kFErr8WNIrt{z|{J*<T50^$Q=?&V5*B(U<0?FGA#MAdyT
z3wPmroR)&dO3KhRW7<4NJ*@(y2OM$gPyq({)tEDMp8n_3ENi|VWHfmdBw+AiKNi}6
zMCx8Ww$jUBQRP#(CE?~9UevyEz}79@SiL~jU9(ff_e&%0y+*#^I?NJ_pO#TwNXx4n
z3a*$aER;-@F>PJ9lnCPs&e_BHrfNN*2U_<2<L!Z({{6~7l}c+9c)%&`rZmTMd|A%9
zzmxtjE<{@$A5{%eTbHQ2`$k1X@|CoHTz|c7w}4NTbyaO6yaOxux=2nvlvAi_5%8q>
zRZWX9<R<eLHfjWXnQ2nLR<+MQK5lN3%5Em5gRWUr2Y|nu^zNQ!O`XVI;Gb?ASud8C
z^YjUnB~5G#0$+Tc?lmIv{d0dv9s$>(pQTnY=KoDM<^_Aw=TBR|W9IV#2G@F>BtBCH
zS@@0}Hh3EuV|48eTY-3Mb#0FErUX&LZ$B=T)Jqmyt7;$PYdaGRzS_~*`NG`mRan;T
zv0GxIV9_>!`w+w(ksV>~S@jiQYjZ}DqKQ#Y=Vd4?GNseGz6d2fz2AG}O+8r)f2Qa?
zs*Knu?>lxyZ93XRxK?6p>dnN+8_Gxl63hUKFP9V~l+^466H*7KMz-I3<of$$WXKzN
zMKELSJZa4cCVz;%Jac>zIqeiR&I}ul%|nc8YH%`2TZl4l@7*m1d^kQpcFxW7`-AgS
zc%J52q)PjeUs69jF$!lx2jyt_Xln#cj^Wt!#~|fu>k}UM<AimcL<|o;6Y;x}F4m!v
zLubjg@75ni#Kvo6BNTO7t(Z>|?%ozTg=dRutBAd*%DxkSB>du7+f19`%j@&a>1=W6
z5ecq)X*%*9bdjPW#S3oLdu3OF5R4I22YGE~tw!GV_)6ir*hjESCEYWV%@5a*!NDqu
z<0bAG#s{FU$1-M`+;#0HzgXxs+G|3CdhR&Xk~->wc&QR|6<`K-d;Bro(83~M7hWWu
z9>!II16u6wc(n&Ih@bh-zxMrlV+9Oob!VXDK1Skyb?Fiwmgg$Xtzul=K2KoI=n`b(
zo?wpR%D(da>wsz1vaG}*Lu2QnrRkhv38m^PaAmY?@z{j4c9X{=lJ}_H+HA3rR%pOi
zJ4uKEZPBkYh!@*)I8q~7WEPln#^bx^`j6L2oq6WO5rDgr-RO*R#B9Zzrr~ST@>47o
z=eH*&4e0aBjO`rA;#D+u8;(2{@XM0z-9X~efFR*?Uq3eT+^jq(hfXRO<PYnbl^|R2
zR0%)xCyJ>mV^z9Xxbx5=aGczm4YWy;4^d@$?H_+TzNPEm34@O!sz29_;ZjyQ2yn;c
zrim|j{n$nt0Sy$r>}S=`xb`~mWYshlBZvEXN5%T^E5##kbk@P=EqO7b*g197$<oFE
zyP>R&24g#z^p3TsNpwGRpNt!7Vt&g#_O9<}2xj2SL`id1ph?54dr_^_uO6^dO4Hm>
z-u}Y@Y17KV=_(vv1i;sjqKu0iR?k{1M%+OV>qKwC8yiwrhiuby8H;w#1hZ#hKc|Ku
z7Xxm)2Hh8S&ALeX>qbZ0abn!6LjW=2p`;FRj=MW0h-mnsZAX00OflNN5!<SsGd+@a
zw0D_@s{AL&yeD^(cW1x0Exhe&ynH^2uH=mnFS2|_2|kS<ar@pJ&nS{R0W&58RkhsU
zPGWTv5*ck{PP)RNr%rob8n?^PET{~Q5p*k3>XI}99wO{&WTy^C=E3uidOE~jiFXV(
zM@MuU$F;eG?j7zh<osS%G=_QBU8U2AOgaYc$)yYYKj`U^*(F$k+zdCC8>Iy$UV&^;
zxw}$IR&hb@tW&4S_`vE|lx5ON<V`fM$Xx9Ljo2IG;AA&3yQ&VUhx;LwBl)?SST;v(
znyD1zVXMwR@{}|K@BgSRek$W%aCM%#xt0Y4HUum4#X*)^wBAC?itH&J;uY<$Q!-F|
z-eYl%-SC|h4YQ-|UY6uu=#F-vyF<u}hQX!;%I7-uOKdMGrf_Z+BqF4~*Au=7$LZ{z
zrVLzv(67OQ)qgVRU5y(9DKBG-zrNHl#5)Gq@pB@UG<X?nYOcL3ZB1})4|npi)?$X2
zrg`#cf~f+an_d^bCyiR4Z;)&ck~ESXf46#B<$T(+elRwc5cu9g(ztmlw^8i=b<5hX
zds*|;eC{oNOQ0XX0Vi-=B@^X7JUt+iR|;1!NuwZ8rgHl;`D1vtX(pe`gBt=ewDlJz
zn}2m$AcjF13D(IkWMqo)xpOktxH!S}n8Quu&$S`dy8EZD@wJPTMoMbYlTLLRVg(6P
zPomHO&Wxd&la_BLT4rAvCo$6zc<=D{2icmHFW@dthF<NZl3DLd<kI`JShszZ^T4Jv
z8e*_p__{N4y%h<IhPh&<rAJ8*LDj>3W<K$pb(fe`L3Cq7t%d^qvWJ=?wi9}9Sif1j
zn<#{DEt#{A_<i%CY`svJX_f3|bqy{jpZ>wtrK6PN!t#Mv{2L+n<#kR9CV-S+@>anI
zGYTnnF{o)5dwx<yEXGVROYRl{v!Opo{nt;mdyk}qT#ct6q2M0@!M!%5WInMmPwUkq
zUR^uC9}LQL-2-Y9Da^4S`hCUB1bIzp4g@RqL9LmJd;>)IxAT}3QPBCf0+-MQv;HDu
zKwvRs?3PV%YY@RVWl;am09C#jCvnwg>P;)fd#Cb?@Kc@no<^JF@D&|Sh(w#9$xs3I
z6wam%^iOA{adE-AM<5ZsemYG*D@Q0EHy1ZlT2?n3J?BU8aY3+4M5T2(M~v;-^=#yn
zA@gy#WsJBc;%St<PR>+em;N%>qGgF-XJD-qLb`!g(P>^bHZuse0QNBQMB<(&_m?2W
zQbq=B_J)>f3_Z9RNA0;9b%2p@3|h^plUAfxRCm;E5-?;+yqE565aO=!_dTx)-h?r%
zqqk{Ca?)Pz(1DI?JK@2h5q=>k#-JWJ^HOMcY7j!IAJGn$C*RhswNXBKnV61UmvTqv
z9Li9mbbrtEAC+jc&Mg|^R3Z8FkI#e?!NJCV<>Qci47ucGprq@;F&?qvV#cHxJKsJy
z;MA!8Xz)YKM-ugN4AoX&W)UXzdApKmnjh|K_>jCT?vGynIgJje@^vE1{OzN?GH(*Y
zU~xA?uluU@NrGgWd3%7I>MRa-pp7b-pXmHTAPFT!<{85_{)PeJrQ0zxoC&0qH@cZN
zPzM;O2Hi`<Y<Mis24Dy?8nzmvkX3LW^Je{`D&>!x{qej|Wmxz@FN?2wEN8FurUC)*
z*ThY!z2viGzP++#gWS^&wxC$7r#CHh<PL7V5IF4^A-M}=A8orEakX2H8Qs0Y;aseJ
zo<=Z?qU<CZfwtdhR*%`NnXVHpeq20smEvELP?=A{Ug~h@DsN(LNu@eUv%h5Tv5&3Y
zM~i{<oN!yjp@(XV5%zZdnNZpC8)UQpcYZ7gwy9~WlXS|;l=;?V-F21~JR|S8TlqEe
zlD(-_*4dEYcVk^uqWd3-(<VNLm8O1Q=kG2Ruphc(cyHyL{c*peNX6)qi<onBT@bh$
zVbT<lEqYI9M<fl+jyTfNBv(R*QPR5~HpSv3q;nUafxV6}>XaG&%^xEI4;j1&39gR@
z@QgOm*w#x;yd?g5Kj5DwnNK~hM=?;0eXnuPdAJm<f&{L_IJrsv5@0i3PMGp1d#)+C
zHfPCNuL-wb7=xel4cU#RrY6KbgzJIOfM2ku9F4f|xiLcFQOg+dmpSIAE)NuYBgvn6
zex~0^;Q5IR@L>iTmBF6)rXTVj7iM}QB!tk^JIDJjWwb`zpy1e}k69O9XGAtXuo+qp
zhD((w{4YfyIai(Is>vPcTXb#z9oS%pww_4`S`+F8!$H!87TR(g=K(?DRrc{^-M)MO
zcFu1f^@y=z_+{n(uNMH!47e;<kI6z4^=U9-Ko#af$s~aLlsuDV4GV!5{Eb}4o?-J9
z#Q8p!g@suT#7!D8lDDsxl}l)wxqgTXj#mrJI~lx<vm=LD^Z^{C0yJ<ko4ZHF+jHp<
zZu5i?`*26X<yZ;&Tx~X&;%kfGg(eNqT7&F^9ObxyCH9n8$&tS3P<FaaTj~oW_t%oV
z_tm|o>~!Vk{=xcXK!cR{IEAKmo6<s8TnzKT$;9g7Aly=&sYxqLlPitQ`f(+2n6=0F
zkl|j{!T5->wc(w{egIp$N)<{yt#?63rdO=T+!xpR+!#*dY>%3(W%AM&y>wlrqa(g6
zM$7nw<76hk<}Y^;njrmB-}grx+1gwXG6UUI?pVP>JX<@_$88dpa2*bTwM(9Pd@>E2
z$BK-$?j-zIGFi9xdY>R7iN!5kGcDMj7QU>gg|${t*>sq1{07U=P~EaVm^B;l_x)%Q
z;=$m%gwrckjq-`|PILWXPoa<I;`{so=UDw;_ILGCX&qzNkXp*-CcSkhtC<W-Iu|q+
zJ6qJ^lUmd^&b{fXv;~(7rte4>>-Z$vL7y<F`1L}JV0s^J$UPCpig4^&EZ8>HloV?g
zU!Az%o94K}qe7Ha{diX&<@-&`At6$q5%)x8CYVddqF_QqS+!DN4g3O)tti>JJKob^
z-9o0}d5dv{-DU*dqa)dTzc;T(0JWZUo#W!A|Jz8_tfaAetIz6U@EH*xZIYf><?O+}
z-MTtrsjT{D-ZTjtOqX?0+!TS1X5ibm2SLZ3qF*mKBV&JsX{;Q=ZgEipOve##CFGHS
zX2@zpz=*{RBPVIh-@tQ(0V{DYqC$l{dCoGcJMp|t#w?A7l5u`-9d;Ip8n5qc6nMv~
zzx3lH*_e;oNTk}@)o_>jE%o%4Phax~9;thIV?J0kAkK~{i>P^x?VL&vd{^G7uSfkg
z=evvJQYml8Y2~c8IYME4q@uW02xZjHCUj}PFc?rP;j|ATUma{-j}nV`oBb%))5!~j
z2LxQ4s(<)#h8FJ=ki%*wN)Ot-F_+vJrO(lj!nnn_z4XXAbMC&sHo`s9S;shwcO9)>
zkPrQ-!)F}Q<qU+xtoWT6?Rrl-XKxDm#jCxST{K2KZ5A15waAsbSPp;G*xkuQ#)JUR
z1IF&BTT)_6yt-co+s0M4<0;ko>R!K3DQ^9;X1jq&x>Arcz4S@m`v}~X%QbujInM5J
z6L#P}8ce%QwAN0fAAaj{TPZf`&|0GQqy6@R*TMXD%sC!iF<oF=WyqCw(lZ}EJuY@=
zhu7E*erPMR8wx2(J;1m9)e3i0_2xP<4hE@&$&kw1j%Qf(BGaN`bIFFt!Mjy4VyI@*
zT&>)zQ!aSD*`jl*b(`LV|JEQ&8SnU7gow>R1Kc$7=jQy|6uAUaqccyj)V9L%sm}PQ
zLES2f)jP83`=J}mXvxqg!P~(#`esUpG#{E;%TTDqZr*R^nQKr=z&BMC8~mx1VeWR8
zswgr;+s39O18r;=H-dpI9I7CH5GlUqS+8}f6`6XhAewTuWyU-<iLc0F$9!DL&&-cj
z{At#O9eM!BnNv&pLgBuTKbgus)Q<idB`H>ZwI032-c_Z+FZ*UlP=tTS0%~lZtwCV|
z{u8_$0nXc#lRTON$=x`M-p=#bJAg&T1xe86{QD~eloB`l7W8yCGEDLh>!?yv#qv}F
zZ2F=>`WEnW>~L$<b|}3WUn92ol3$wC(@U>Ak4?Vpwi>sn$+C5@+uvxuL|t-Yg*Zo0
zMXWR}8jGfqBz;FO1(IDm_Fs(4s9rTGWJh&Gzv&}7zu(PUwIa2toMV$SHYe^@k7_HQ
z2=JpuYOve<=}3#EbhB6uAI)Dj%N@D~x=|-wNUd~*kPEAk_8H<7Gq4E;&e^1Bui}Q>
zj4^m)!KS}#g5Ltks+GIm6()Y+e`(qOQZ`Y9%12*&-(*a<(>S7HziFl<NO$41!WhRR
z(8G^ieVvi|gZU(H5)m866ULPtz$zTS{_}uMdI~tMEo7%6uQ&3bFbq9kTY(RKo6u!e
zOop(!9|16)2a3)FN4?YARdts|8~}IKJ{=bIM~*aeFZr5fY6iR6)@q$xzPP>zT~pJ-
zF2zbKDi1FP$#oOjn7-;|?q|8*P6@tt?yH#rD!TVAr4&2wRIxyGb~JSIh=<a{>u8<k
zC?yKGe=taZWbNN;ng)TtR-SzZD<R(+vFIu8gUu7Nu!~3?#T4`E_9P5{Nw)c@8ESaA
zk=8XbvnZqwkPYrEfp|%P`_&~%LhYBcuKmAq_|x}mo`m=)4~zIJMF(Y8Bp@gk+m@0I
zLaPlilJU^*$}51G$Gzne%~mQOrk|y#`T|;xW+qQLlIztq?E^75mUr*=8`X%U+Nd`W
zt4%@09?UP7YN;3YBT+K8-vy6nEB9!T&;4`7q%Sk`?yD7sf3#GsM#E5l(MT<ox8zHP
zSUk+duk8T5{r&7*@;bGvo#l#qkw>9L3Vq(B%a4U8Nmn(6kb-M7>ge0-(G(&tJ6_}+
zVNo@JrO9z$vyu^?#ay3FR1AEmh|vmt6bt)ht5Y=G$~%u$!)W1LV@Mb_@WQKU^Qwo&
zUjh~Yv9Dm#1Dr&8SBiuX<__1Z&gll5F-R{T#)dV}4y@$y_nTqhM%I2R@oSSViHVv1
z{}~{MRdga$tRft^iTB8ea1LstS>b~0xt-=G{j?l|a;NW+(F5PFzUnWi#`L}`8}Rlk
z1o}us`O>>yXBwL((F4$rcdChp*i3)^)%O#M^=X5~to+pV?Rz><W_whjVG*=&pSLNO
zu7+P6D>9+91W7Eqy$boL31+{^a=+q%09#f+Rz^K9I2l4|`H*?m-Q9ybzVM=(f-&0B
z_`2kKq`>~&goIz$?mm4T(UYP|y`cMJa&vAkI2~g^FjLgphPfKCPd}mInXx)5?QJ9u
zt-Kdnzqzn!D}|i!d;j+HO2o`9CD}3#ztQ(fZ^^CDifgP&XS%Jt$5s`ZF(0f@@>a2M
zsPbV>9z|=;q*<ar+NFJoGR5OM(QS~=nZIWijUSYblN_$uSyGHhWIK}au+AYSnAfYu
z|JSWK_=I@mJktW5GMZf?-lh=f9LON$-?urX0~)P!#+JNGVNbkywCYUhsyhy=Ee&z8
z5)zcB(5~EPgRw|IU@Q{;7Chb)RO20-d=Iqu)xMvrg&}ARHnZ@3E)ew##lDC87sB*B
z01xmGd!872=1hB#>6Z??P{y#M2)kCNMc@fdgs04vSVzFeamm7y?Te9k^`&e@Md1oG
zf(ZQjfe<M%y$giT*40iVA%TT3wGI#^AkS{c$Pgj+N_@|kHRF0On{hvez)eP{jBd$8
zlaS@jmp-^D|N0V}u6I*Uds^E{J-~85zLj`W^MT^XYyUA>@_EmP&4bS+VMnY~Lq2O~
zUE7}iWx%KuZAyeqeevwQI0b4agFdXo(N|JM5g9AkIqf_N*`+k8))5i<QVRXm7L8dw
z(&l%B#QWt}mCt?*yZOOVCblS2@#J37`r7lPGV!_6W7%|XRLLKRp?M_$Vdpq$UEwIa
z*NwdC{tzis?xi&)dgwMZulTn>I*}CCpQ9l`Xg{(-)N55>$GLPxn}0E-fyLvsuiAx}
zi$rrr!f$8Wz|_EFlHe2q=VSgN-uCfxL;fQs)K>Y5V^+!NpH2Z6T*lTVX=zGg!+qT3
zzZ;A~1KZmdRO5aGy9nS~u7Rr8_Grh#?@9w0LIsB&zx>khDXz7`0vet`mK1i9!u6vL
zFNU?F9pBw)r&Ui?0+IoCLGu2=>PT(c%YiClIOawaK4_L^bliauI23Xr^p!F-36bW{
z20T|VimZnT^A~W}`9KblvJ{#rB|rhYuT@BVP~i_4XTAh=7>N7>t~`>}@R_Js33)>Z
zS;+39IITrlD3=mkA`dDJ7+)YMEpQb8<SLW%wP4A=dRz5N$-MLcWYgndYnc@}UD0uf
z&gRdI{Vw*Yj$oRkOAkrOcI}OqjP_|{`Ltp3tdM0MOsPNz>}=qBkw6nbStNp-H+oOG
z4#S69)wy*?=~!B+9x)?~lTQsd+|@_$+mFbxbaG9uLi3k0qMVx<K5;iq9igEs+u>6g
zCio^gIo^hHWK9KcnJq;(Vx(W@XD5k#e(}+JWeP34Rr<Vc8sftX;4Cbv2;r|{GA8=n
zk;pI5Lvu>Nbx$T@*bcwXl186bdM}8@Z)McPC~V?1X_%a)420D|t;mlQiR!=49HQw-
znlZk*+UR=Qbxx{Q*sHWo2K>q-N54C>3u4MUjc*oI<kykl`q#e>aiu8fOax@pY&*e4
zaQQjYghyOwraeFrTK8Pn<2>4dXrYKSL%Xf!RmkO7lkyVdv~Zg!>R};n^dte){JrsB
zk#5xIBIpj}0H1;s0cL?q)^L<=>z=_MfuE^RsMram-1VvbYS@$!FYmI19SwZ-{fr&t
z@}h9<UrtOVeuUiY-g^kW>~cP-3-XWb#`50?SzeO0_T@$LC(q!c4dcyzgQxi$bIfo9
z$);=9%q9ez5tfn)+EHF7;(W0KobF2m&h7)fqC%X)LcGb0z{l1MN$;!x&djc&!`W8n
z!E4Km9-=<lzx<F2yPL#qvu)DT>?!PT)2ACF*q|sZ;i4~J{RULbZ|%WUqrz~Ep#qEY
z_a<BYM>}C1u{b{=5KmL6^p8rTWoHlq=<^C9_=!>|**cvV<^$O+wZKo7B><@W^uBiS
z@GFO1O{R8hRmNIYas4O=e&b92hM*EA<OBG~DD&4#xy$Uv>G+h1YtA6|-1g+>Q@Yvb
zM%hE#LtsW!F<1s4@P;P(Q~QeE6Il)+c#3;r+rNQG{%skIj0GS%JiSx`4~;26&uKRb
zzf=lLspC0ETguEm2W6N?1}-2cBtoov#A*$?l^w<&(i4sdei?a+u^G$FbR=InW~6Z&
zofC_$&Hggt#6z>=YlB5d!hMOMVb|ekm(#(__ovUOYT3?JS3*K_LR7N|B~_0aB0hNF
zaK=I+bD5}yJKV5HSV6=~bJc|OMz~atTIvdUL*rf!x{MIYint(_l~A0*ylf<g#}fKI
zIQS|%?`7=NHbh_b=Zn01{7IeX97QR5q|qDGgUJtoWd06tP(k?p<%mir(OF&DXC?oj
zy*eMU4s0aVh~J)RPeS0GyYxP_ycO4OwQO?gs?T?w%zC}!u&?`K-+yh54CG}?nN&}z
zE?%XB-Q9%a$>!V#1+~ZZ5xeejZo};~$1&3Ml{adwcALu%w8C4J<!@pWjVwtQ(ZJjG
z8e&X_Gca_i=iW5*G%t5B3hcVF&-Gi%<B6TX(8Z~_bC@Q`OB97~<>DAbIHzb-y8EC-
zAOd$7q=X0w<+b1GKbI&eErYv&hqNS>!{x~f#Y)f7*oo5I3?~n<`D(yha!SpA53c$w
zJrU*dcvKqF{`8%o<h5L<CgR`>qfsZ?4sx3!St*2%!T=z3FPm!T(wEi@#jAF(jU})R
z1oohv_xE4>iXZ#uf?YWP?%=5bC=)!B0rqCpsx2S-5S2E1@>4oH<6LsTUI33l5x3Iq
zqZyNP!A~nKTT~;Hr<dcAS-tjGQSULC3EnQP4~C$-HO`0Fa^Bxab1%%#w?~67q6S0O
zeCQtJ>|nf{U!>@yH3!g3h!mJ<#O=x1r^02uvpjI>rn=$b;T_dG^u4<!h8W=NOkl*U
z;Jb~k4G;O2PK_^}35(o2ZQkF!0G)2Ow3+ZA_)~&$eytYbwbWl^EzQg`9N^Pe{N<eR
zPWJ%vWDn=L<BsoaUdaXTs9j)TO=gwbJbeXwOE-@FGpkLCqQ?)e4wFbP!yY=1#gvQ6
zbB-16!`45=)U0NDcJw4ak2{$>s@tF|C<4A5d^4q@p~*X0a*3#uX7~;cA*B&Wr993Y
zyyov3k4~xBAYOLFs`03{7`f74xSF!_2IL+tK#&>h%$I55MH^I-^;A9DNw!-5myPwK
zZ461z7Z(gx$@C+mAs<LQvq+cXI`sC)aPkP3yezTQ)ka%p&-141p-;w0a*suq37mx|
z6_vU#dXQ0mZbSHnXr%XS1P`Ci9C(!vN0K0Nm01F`y+rwIAZtWa7oqK@Z(V059-Zf2
zMCo*5$vfXTZ_P&3IVrfg-o$Lq94x}wJF=!@zHSkK&6x)qfu`OOv4qEy0nlOHBz?pO
z%tmYN1#6m@OjEZ?NX??P!M-Cnr4?N<@n}QXW%bjVNZU;3!E%Da2sOE#@W;NG+#l@~
zmBHSzrn~h{rgz?^zkkUus)XEsFW6(b!(RznGOB;Qm0+S<+AqSPX^7?g2iozNA~p!+
zN5^9ei3=BUM`i$8CEbLUv5S>QE9efe4^Kv8WZ7-_E*KRsYU`}hU^vdV%Hhb$voEbd
zyYX-l3qo3?6!t6OlTp4lZ#E*<DKco_)rVli%{0#gIz)3j=@=BcST!+o=$QB?)Qf_C
zk1XmQ_dc48YAUzoxl)xURta!>KDX|^thL0zaKiGZYa3I0q)&^|h20$N;1o&_L0y#q
z^g)23m3>j(*eClASp+G!-RjNf2S|3p0?Mv$yv);f0C?mwR-|C$i%a=&{P7PG^J>N!
zSSEMNyyM*Gn%(9A-Imt?!MLYSHAhDwzH9N8&t<|(pjoHp_&6@;<k_z$FB8n2Z>9*t
z#b5b_E@x5xq<r4@+PJ*G$=x>@Ja2AR%@uST1Y2H`w=E9$)uSqVoIbbnyNuS2ZUi^B
zL@SHOsAbv6%h~ofhXcR+zEZ|d$PSm=>YABQtWdGde448?Dms$mn}B%f#y%c~A`R-{
z>j{G7Ngq<je~}qHt1{lQVAhj75{=E!Nn!7jFkTysqdVE&!Ozs_%a@1yc>gpVwLgss
zjuu~!_iVWc2XI?7t{4A;Z5J30Gd*z*`P8=aQ<@@VlrLR{k{i}hf+9S!b)Rm1Xkage
zf!Bz&t)0TVM)3OB{Q)c!LQaVs7-PWkj<gz5*VM?6h}w@DftFAwxL*0<PA@qWj*3h~
z&>#OLxwGZS_W;O4%p1jm2{Ys#An@jeiRyYc>J#E<c%&enq+<6JWGl$#_?&K&gfhwv
zZmn>br!Dz5+kI~=UWP<kryF?umQ?wu>bI3XvE!skz%sf^s>;4)f%6)>kXzC{#q=;p
zV5SImL1y`8W}TZ1?tG|OI_U+J2cds*Ax_7x%YBd-sJ(rxf9HiW)}F>AWqbwB<Ni<6
zpkt-SFg#7KKN#V5mX~#+WU<(@!t_&<q^=n15ZEJ=E?i>nB<#Yt;k~=`?TLu(&9!tT
zjm1`~YIZ!)Obxfbk6Wyq|5j2h^8Hx)4+1kx&DEJ<y;Mo&DDC@Cwk-WdIxlH<tbmIx
zl_v4Givq8ZZAH=O8cVD)-XRo~ma;pAN^X6W=|l9&vS6czFNaeSk3YH%5)*C2lRzGW
z2Ym%$k~l3O0YukDxoGQLkST=HU72n|M~Uy%sEivgZ>pR@Z17*edF@Z+_va7;EnTGL
z>Grp=beGpNune#8yUHgqYEXQ1CPlNb45t2|W#>_Q@iK4NrUhv)(llzbn$!1z%OxRI
z2{`OSxWI$-2>TE<$?abFVL35x%~H8MEXvCu`_SWn>AC<>?7*u_J?iZc8Q&wRNe~8K
zb<{qY2mA<n9B^W|QQ3!_>oDkh*!13asD4I?vqF%gz7wf;;KBA(|9~-tv_9}kH6~31
z)LSi~`>Grq9o4c+8VWJI(&O=y6OiTjRV@%Sn&lz_5I9nbft1xq3Vpt1<~s`~b_^6-
zq_ia?DellR&TS2pw^lVxAM|BhPh%NLpTmTADL1aur1)H>(fm^Fd!u11%yiyf^0=@q
z@pu>xQcZcCk~`&a{!~>GKHADb(4NaDln{>-^d4C<I~hPaxjn1T8-jcF;7@mk75OLe
z|FCtJZ*BBl-{_&Z1Sr<vUP_T7!6{O#xVr|YxVyVsad+1uK??*Dyf_pq?ofghDR6Gi
z>w50vKK8TsACOm*nOVOz>$ARr^q(t*g+G24TS8+QLbw->bH?WZWE13`+&~yh1<(w7
z{DZ*C4+jl}Zh{X>Z{jp0>u2$29rZ=5QA;<ne^iP`f24aP9ttU0QEy)mN(O2yU$bW8
zqcma5#dWdJ<C5=PI@Y4Mj!$>Uf%I$=H<@=ItWzGQp<hM&MMe!hXqUc!i6Mfz=<A}N
zup54#mz}|xJgE#>8R6|$<*{_MpI3_7pE3>fsGGaf$2sRy%~-iJNRpmJ?qS)1J7!vb
zJSthPX*4q6uTv*iVMybl;5ySazU6oMV;VH%tPs}rajso<8vuhd<pThB?WKe&0&wWF
zT-Pw;dLSHHC^96B_u!*Dz|~ceGOn<Jgt?E@62VPK_Ie5d>1@)DEun}L@EKs3bT4uM
z?*W4GVxeekY=JMl&zsf<`B1;Q0t^2!(6u18Pqg2ZT<rG`-cD_V(K`Dl+!bz29;C6n
zqKMRu)GMNYnrjT=z@s2Zlnq8jg+Fp&&yt2_TkjK?^jU2~NSpv#gLJbp@gFQlmq)fj
zY41E@QpxT65u`qWwz|2OQHz;rMki)dCH++8XgnDUukv<d3=L_gc=b$ET+M8Bj*OGc
zVgGMMm4$W4ySK9I?smC+>#||-yVbaPeY2YEGkQqjYCtH6a6~mf&_n&iTX7WngRkK?
zuV&9D(hT1D(i1}V&UQEMZ`*Ep+rJ{w*Jvh%zcdzzQFSPF=zVC7FlDoapQ!>rI-2y^
zK280tN&LFkP8hN77*l$79=>7ep8g)s{Z&$0m~X(lrCE=%TQrNRm@FqtVB%9!<d?u+
z&!H$ib7~l(-3_@p)ezLgK>isz@vt)?FKFGMb`m(bzy=IET4jArt)Fds8e>OvJszT4
zD!1=mlYOC#^DCw$2jK-@0-TU|>QnK#c<WY~cMSblj7aP11f)tMgD-O8Jp>9FN5)kO
z-2O7(1-~KPTuqGq^_X99g^>iqGA>9G8S2=hYdjheehP2m>A(`8UP98qtf1z;gk}lM
z8tVGM2Qh#5Okbl=BLObkac1_Da5uAQIJSz!+;9m8ML#|0X{cLe?nxfuzQXlAV$@ri
z_`9*m;X|T-VjKJrGd1IQeN(iKyM2<9WSIB03U4a6y$QLxyhWYb`vJh_@F9MXTo6(d
zo<Hd5WSRMXKV5bVV~^D&iv*|tAw97p8&BOap^5z*7yvKz4{}+(10}Y7`iwhEg6I3Q
z(l6raW|!oheQ*tz0>#ml8-gTVz^7a^Q1TYLP_B86KQBXnQ9*%>!r8F}-FD8&4CA`h
zrvr)-tFG(O5OP>qmoHSg#y+5T5;g_Pb{t-R{iR{S5zbTvBcaJvVWT)<vG|!awvW2K
zv4OH!$N)`g`!0BcMtpo+{=v}ZY21GJgTb=r<#-!Ty`+!4iCz&rwda8R?w_B+_(%pB
zCFegP{eJrmVZ2Hz+kGdOau@JUj*&$|oOqOsT1{NM1zD<vR*iswF~(H<H3Eew)otpt
zCO78q_4VGrPeBV;g>%+_@;=(`hp$(!3+C6<*3|CIUtiC|2Z$RQ!D)nJ8?~KWd@a>t
z<q1~fjr5C;bp~EH;_puB$uYK<F}J;aJ)&t%_@zcMbpA-pd^YY}rpB5}?rgFqv@+{|
zK4hR8i!?3|3rk3K3zK7*KwDNyQ~2<5J6B)?1#`Z641uJlDgeJDFmq}C6NeW*6*9qj
zZTX4xm6=sAP08kFM~KcwG($b!CZQ8K#PDU16D`<og#&17Sdlhf_*V|UXovdkW;Jj6
zg2;to0WyUSNm2elkK@FvcQgb!2diq7vM5?qRiei?G{O$!iJS^voJmyqS22b8gARQg
z8lyGbYUtjG$rO(^mnmY=W~jvTiX4#0xp#iYrXFgmj1r~s&pFY|3AsA*nds;AfNTnI
z5#6Ok?K4!M?;BKh9kk#`srKuSpreE9f`zf?C1eJ6H?EhkCn+n+hheYKj=Iol9GUCt
zJ*}6(r}UaC4bQ(9l^$p7$TC}$xkuPWABB%Vx|gjkA%SBd@a&iQjLrKqGl+v9$R=|Y
zGQaLcmP`Is(Sd1<HPuhYeP?Wu()h^*_Q_%p$Yv^3W-=V6(8tB~=5T?1PHke;RWGhZ
z4r~OMRRuSLKVgO#O&YkpZZe;>HN^r=f0v2l;B2L7I#>S{^9;?kwa3#9rH`k3DdnE~
zN(XGxoK8l5pwLf|{xY|u2-~PB!PV#Yp8Qs4nbRJVexG$=yIX@8J5*3R`J=LZyg7vo
z;3s-ahCSQP^z-0v_eap^<o~Pn;F>R55B&eH^>BhsrT?q-8m{}iN+e&xdK#|OX*Xn}
z8e9-zcF#k?__l%{9>u9M&ANV7gT#l66omp$aWnkrJ>3y#runrb)fy@1+>>%B=fo53
zr$W_(JQw&ViPYFgVey0K(@GaDSuTmWZ;kXB-D^wL+S{N_pd2PcH?OIwGthK9x=qSl
zhw!cZgO;IcZGB?ysRFcBf@XCAzVA(xh~I0w>15FZgndY=>^apmescvldxerX@^0d;
zr9LWYf**OV%7<p}EbZ%^$M<}6@@etjpADMba{^5mCE_>gX9LIdRtw@rH~C}cjusl&
z9ic8x+*JWnHMdWfb`55tW*-JqHuF6N=@owGzPFWDZR~p*@wClH-!BgNf>|x1<VGct
zrCjXh?Ph*4c0(GgOPbbp@(EU4QCpAYd(#Z@q?tpFlb$XLM0+$1@7Ep$#283yY?gXt
z+Pc1q{x`6XW3Ues1=9X~MI1ND;`;DR;O)e&bwP%N8nR%}4uP!bU<Fo-?ba`Ig0~!#
zEiC5wm|&z((zS`vgHKspwmw~<bV&bdI)JD*Dc*1=?dGd}TQLEod!)mAXN^N77gXCz
z&+l_KNWv5}ggdc#1N71P7W(nc29U75+5RFq+aC>R0Q<d7zVwT!?pg+l?J$~S*vZ4D
zEZ)XKRd`L<{?XjS&va^Zn=xAY6JTPihTzn<Kk$#&@+L%^Mx0kXF}!phSD?D6eHI$Z
z*gBH64~FlJ=_Ut=w1yT)<-n(>vQDkPc3tByHGXw7w_l@2Cw`f61e4gS{FIr=;-exl
zCEia6RuZMJMuh3O&YZO;rqkAUfU@EhgmxTSMAE>1WKi{p)FDh>vY3FTzbijPy^Urs
zZE2~`=O6rqeC_Tn>J^6UdcuN}NIz`fEO&w0z;4M^ZqZlz%K_i%GU9vNvc)S#Y@_-k
z!_6!d+LGPH4#?kmVMA|FWtbL&yN~#qMKSobH$%c1L!LX@+szU$)fDVCqcLi8Y9Cd-
z`dk6T?Qy3d0`j6?nzz;($Ef6gC31d8f~R!^zcAImtnb8Hdl(UA`{#1V%^ub6HjAO0
zn1%)_<T29PDKgkWi^Z!;bCUI%m!Q4hL16SJ#D}ACu5p`%FafxfkU>F2a5_dIF0{S;
zE~KzWR5{d~p-55$vYFl9lP-2(`MkM*y`_?4Gz)Qkz}7yxXf_;@{p3CNZ$cm@9a0IB
z3lgGlVm{tw64h5bxJM$&eU1)qYk;9|>X-Xxl)N83E^=3UO;-+-Fy)w%oX~4zG%dC2
z5vs)45mF%~#L;101v=+iIC4~egxmX1E5lik88*FOni)sfGM5N5nGjz-dd1700bHE@
z#~gzLG7TGx9dkEZ>+>F8&$oGZPA-gUr;i8T<Toy7r2B8pkY_DIJvNk4^3jC=?&P}Y
z08W+W=hGlb`{&dM+?)?S;-M}!8nPUSNTm*2t7nfH7sEh+bI+$PlW(@x_m<Re>6}n)
zfbvCsKO)O#4Y}DA-h5vn2QEF2a0u#0p1nANuC}5G?XyDji{B@~Ppc2U=sKt}s)iJL
zRFT0rpDDr4(I_<LY=Q9H3@9Yn3xkO7qjNwu`gMOu=Ka<yyaSPb>)WRLkfniEa#M@B
z2=2KO=ASDkDj^k2PNkUFIVFPiY#6+SUi8IwRt**I#tWG?Ep~=K{1zBI{v1*glgWVF
z$Vf?NJa;eYYP{Dna;jF?p@fo>7*J4h>s({$#(ClM9T?Q*Z7W_=)8VJ0KBG+}uddbR
zyH?wIs1e_(fJ8UkFm<@G=omF=u7AkQ)Uo<D)LJj_adn&Bz!@0I6#f7aeb<_SyKq!{
ze!TOk4py>w9SJi0`b)?eu#`>SK`mySwKk4>Ahe{Hq1U6_PO{L?|NS0X%}6tEvL;zc
zFQ8G;^ZVPg4fQN#vD&*ux5>G}aI@Lo?*=XJ>c3Si<P~|mbUjFMvLS_8Wwd}zbsAw{
z#7%Lvdmk5#_~L6q->Oj=^4X}fcBkL~*^;^bP>}d{8uK~@DxM8K7*OON>XjbfS%SJ9
z`c{Q3^Qm|A2eIbF8$V}Ka`Ig8X6Yi23uJtw1?^;v*c5YPxU?n`2;jobDB^6H4k@}c
z{ab@h45;9j{j$$KGGwykrur4Kc}ba^ADjaitO{UJq9Rl(S#g}fg^w?LKh{L6D8fgR
z8T2uUA_<VxW(`fZ{h!h9^YQ)Tzf~xRnha%&c@Gg`h=MuhxPzp%S|`Flj~53cm<M!X
z6hPrDeU$P6fOJb0ix;|v8dY5)`sKq|H_Ee!Lk?kz3Dh6=n)0ZkS~bqqW1wBwSg`Yu
z{W8mchwZ&mpKKE4LN^dzTCc28z@btZq6ZQ$ygc!a&z|eA3veYb_`9!WVqSUi5IOaS
zou>aZ?w3tTQcO{y0*?slw!JyBa8~`vPuUi=Pa3SYttVi-+G;SOH?Q_IchR|H%+gWA
zlX{u@D=87qdHcaLAFH|5O2epsIWNx)d5F(NRkPuP=`8>4J0NXVWfto`R)Y(!#GM{S
z<<2B=^1G2miOLYk>X5_OQC0HWsB0y!EG?brv4LFVZhLX{PP0d~U+_C0)mQ-q5+7n?
zAEUC+yNW43*{Ei*SIaak@4>V7cW5*($}kQ2Wkv^B7~t^onh?i1FEhvwyQBC8sgMnv
z#Z_j;^Qoz6mRO9Ip~WRcHA31ZNDLJxc;Q&l{E|O>|4raK{%-;w__25A&HoU#^l`NM
z^O2VXK3DMs@}BX=Uh_2tlOnGhC1n>IyyjTuh$c$p`?+%OW6-Oh*<Bmmy-7uiYv%My
zfPW_I(q5f^QOvp7!<;fWzosmr$rHPyllFrxbnc+h)nJn7r_vd5B!4$Ay;4hkz0Y!1
zPiw)V&V5Y#cvHu9bz|jSSt+$+uZD6XwAWt;RG}HdOVp)K`829Ra}qHAMB9?FGu||N
zATY&`>s5g0?iO0o;qQ_@4U`uynspb(X94{)gvUB5w>L!?Ke%S^<ZxwqOuAoQqwDhz
zZ3}e+0sIoO9v`trM}-ZThvQ)PDh33l%71n}s5fNTjplM9eAwC64|Ro5^BX|D`<S@(
zVAcDy?)9OOfo}|^fh27z4Qy-l5ps=AzfT#>PYr3>EzU$H)4Ny}U(41}Jkh3OWX*}b
zb8Ogi|0)ECZw%?}?G#PC;XF1EASXIRuEy7dOI^3be;6S&hv^NfD|jSA7AtHsn<l{u
zY>z!sa~}nRJ_39AbQdes+8yGobITLzmuV0OB#!0{MnZT;)BQj8Kt9k&`5d3kP<*_=
ztK^QBY<;{{Wp;dl-SI2vhbW;*(`1HCW}=~LL2hScA7pjK*l)=Vwm2_0q5m|eQG7R&
z%LUy=&u+pi@5)A7LVW57k3cw8TGS^74A9xw>e2(I7iR_f@=+%&YB&7Hy&;>$quFv6
zBkWTgGJWIT>(0Zk4jXJ*MEbbK4B>js7AN)Z&BHFcQQ$*W4&7|1HTbXjM&M;@7Kaxi
z`NJ38aa_9SrOQ+$JZtm`ZlBE$ou`hB4zqt>Ywi~kb>5;Z8BtXlFSbG`r0bRUkRr6)
zZ>hS!a)3%)Sdvay+la|_C<OwrP+l=5{yj#DkB}N({_xYDxI*d(Ge$55#mNW>=L|BV
zW0F)k>eBG>myHd|A)1fM$dkjxi4C<7;A_Cfo^gAhQzy)&)XT!iBJ;zK1nL_YU9Xuy
zHlco+$N`tDm8}vsQ9CFuozbNc7c|k+qsQ$v?LRE3_!PkfM0uSHgrMfDd7qQaa@lL5
zKz%#6zcK0y(_9S`7=9!kouweL4H?qSnXP28^Y76`tDIOPau4{Zr5NvTdlwfCDP&u^
zZs@XfB;V^|3mS`qEK{f~MHI5~U#RQD%}Y_YGo(2X!Doe#U;yOqUp2R?NQDs;R5bOd
z#B<=J-=0JcM@&=L5b(WbP#1sfq;1gN+3uq4bXf#_W)|akfycm1PWe#$P4B}^xBxCS
z8kaa6BnK_L@}j=->YG~EL6NHm`3I#ug?s8%=;W(jZ5JoxmcP>z<jfY$5g6HY<<paK
zkL1Wk_44_sd>%RVG#@Ln+*&=y**41AQ`(;E**-47w(*r`%45!=KCD0<OEM4TipSuG
zlv@MY(q>={8HV-u$MMXJc+xM_H%7a*rkEkUj@9vfi6gN*Jt}(NFAnd&)v@kbhSW+j
zGJczqig$}R(5cw0_XSH87hXMpC$wskAjp{tZ3&h8R(p;aEAqTC%FF04gN^xjMo)-O
z`SjG0mJijiX|@LT#=jP`RtAQ!^3_C8yhpEK&sWR-M^MApv`zLXV+^@EAMsq&+1GE&
zQz{G(Af)JfU${BkOFOv}c{PF=lCu7p;}~sKR=$j>4bRCmRLW>BZ4)Ao{<Ay_Y4TF6
zl&JLMT8u^zm~8D)eXwejb>HmJDlI&rOU8Ts!Ly@%yTIEMuT~oDl&i~rf18p~yz+)m
z=5dVxx!r)U{VB!WQ4iBC1ZA2k9zXF3vYC>&K8Fzec!g0}@Z##c_+MOI>VI6Fe&PS+
z>Nc9~!W#bL>fV(l`H(R)V=L-AUNdbxo(-~AMwQ4QqLeYrZG+KpXwD?oUjdv~SK)J}
z6%cN|a`w#*Uh~+oqk*`XlOjnw->=)gt#b{RM8c<xj0J`JycCQ)UH*u4wOGChjzQ;P
zPXijNEp$4vh}=x`X5tg*aoKFyV|COw8w$lAUqn@fBYqB$b}wh?%76SCXO)E2$ybj;
z+MV{P(Md7K?f$|?^>fh5eCMDYg;0rQBK@FOWzYEjeh!zPhIQ2MLx<qAONp<>6hQMH
ziDMsmQCTLBI&B@4I@#nvtVP3b@40++9O~j*(#=onu60<yFJ-LZ0Se43S@BQ)h%lf0
z6j^HzYM6krD&Akvd@RfN>p6=C>&71IEP7v8^t+~)-OHbV6AiYJE1tcRM;}5Hh?+U1
zBivH$VoTih@Iuk&Vd(X?Q6vtJ##G^U7M$pI4zP#1H3HBtuIjf_hM`?vvnaGOx2+WV
zPeyhciTtY@@)Ym(>0zmy*=6<YF(ZFt)!I$EBAA^|lc@Kb{nSSxWkkP0Q71;RXvlY`
z7ibtSQ6f&pW!ddJ&JH|G2|bWtpB;=Jt(V?+-6ES>L-ff{$ygRV4b~vH7V%{FujX5I
zK<S9!G88Mk0FH|hN#8`t9Gpm8zK3o823uV$k7tSBoA{q*M<#;bR}-MSkY<uE>((7s
z<S;L5U$fbZ2v9PXj<7ulu=&hIVJ>8s^4BuW^yzc>b7R}ly`n)V&=l*ZHNOi|A8+Ck
zOs;jfcdM>Q<F4fF{nc}zw{cWXl`%Kl4e~?GOTF^n0LdoLZ#5+vNWvZVG1&usrU^S%
zPKgU7e>EISUlG#$M)sd;hQaq4Q6jfcZl+7#yB`Q@l23DLiq_V|p3T(7>Pp~SF5eW{
z-FHWH@y^8O@_+4})8i4*4wvuBoO$`(2kVEH(D4PHMzb=0JH{|v3t;TFL<Qr|8Jb)D
zh6?Esz7JIH{@Qvdj>R03AM5U14S)OjjUPt!C)~IKBP<ob-@=~-V99>5mcDboD>XpX
zoiMqCgyq8gW~Z^br*M7DbR`PJEaRY5>JU@B+LEM~<I|6`tX(C3_7@j7sHs*Ff<ko(
zo@<>X${c@096UO>F;RWD1O;s)Un1{D^!X6!kU29H(cnl5{5W*CemnU}GRwKZis1vo
z>SgYk@^VW^>1FNPg%`5oocjRuch3g9efjSFX9oY0zH?1O3=hDNQB))cyL#~Tkp4LF
z$KD1{oTV#80%e?*dFqo$lG$SyqU3YcOhXjA<9%S_wcLC5;JK)x9vd44_Z3ZG#JIGV
z$nNsIb5V+!fuytIid}p}+NUp2+nhqs@7BARgVxT<(Sy};*TNihYdGT<T!^i%^=83$
zf4NwfK&EQXJtY0a;l@9ha_-v-qn)o=6JA#vemZ#z&?NORII5^fo7NhV`_>~psGRI^
zM$B=LOgsIc!i_!mYG=)P)J;kTtZ(P9s=lKvuJlK5sAgq^O{%LWA00Lu46Ay8vXG^b
z+fSLx&436`dV6TNV67kHb{`E3+I@0<81qlc#W(e?*7fSn!9RbuWQb{dybhPySM=Sh
zr#E#Wr(&tH*vTrT>TPZ>_KA&(E?AX0aKMAwfjx1)DF913wT9!^{cD*t1*)3)m_Nx@
z&-H&Lf48KecmD8Lwn5^sBD}>jFS%{WlP}|uPcy~%=0x2m@lf)hd4NL`GO@FJ@#WJO
zSYvy!=p%bv``D_~D$U0j1`c{5YBcaayOCEAj=|2Ymx48hM?lQSRj4dC>1lKSWu;gY
zV&Z>u#{M9M9w4c4|K%o%8W_g!2L`j?z7)7wKa+AR(~{hA+xd>iC|ok&kNqyjS3ER>
zWdnu&;c^W4*D(gnC1Eq<pK*xhS(xN)f%A}PCtSjN*a)w(&BE_ia-Gj^sQ18y^9E1b
zB6FiF8*H{F*1+x2G=0-tp8Ohcc_+8$*9;Yu=OSEYOe7a8lg=sxpxCK^Naj{J0X>Tq
zGFtzz3X-ZA(-3`}DI+oQ-iM|FBlcP}mb+Uj=+`ZeK~3)D7nfc~s3)lU+5qq7g>_tM
zKzY8eeq_cipY{)t+9V$=Q@JshFBB9&L>pGr-Rvc&ijR<SlmyBg9+KqcLg_*ZC+aGu
zFAyYD7hi?G!y-&L$Iq^pNj+mwW2>}sg8=6kJa~6JTqbhA<Z-=*4Vy+bF9rHQNo{x7
zy#JX0(@K-e<f8=VQ?Fp&hJ2<OGMUkOL2Yp~v?>MoV(t$7>HHypCOqi;RVf<XWO%-^
zexj_9EfPn@8$<YxtDs8D1miGW*wN4A+N$>-0*S5lcX>rQ5Q%C0ccJ+IJWzO*d8y6?
zJ8ieor@*cmd)IiEzH$K{pz$2gZ9DpQ@->w{Z894AZNvaauW?^*eg2@3+dS+ipXMgt
z@Fqd`8W*W;@!+7J8&Cc(&&PP4);pN^8Mqc8_owpbb6?fd{gMWI(&UZjiMP+Pz*KJK
z<ai-&w;bVd4@T;-RG{ML4`_v}azXZ2#n)R|*Kdb<yp`2sA0>gE{x<XIH!g?y%Yw%C
z)k#i{$GHv1cIwW&TS;j_q?GPGwZnh(@99PXRN!V$DfrM!n-M79eGzLTCi-+{EjGbX
zKiB`rOVDk*uy|DIW0L=!ani+IZ@Zx!^p#gOK!EA?#swC!rD-K6@ygM})yDH9;V(ym
zd!IAnDTS61UI`A_?<Q?jkvfxD%(JplSCgDikh4g8V&l2?a?sM3fSN#~{IFjfe-j_*
zW`YmmUE)^7s0oj0(q?_TX>f=pU@$9d-1gM+0^PJPA15?uz5|>!otP<?BFntP79gzK
z+y?h_Ilpc9>AGIxWNSJ^;2mdHuHo;8@Rx`LB8|LAPg73+m34DeBaEM!H-w{<@W}=7
z?)$?qbn+9gw)ELI#eYFO6L6?oowuy-_v+DzJ>Mo@97JlPv3?@h;qJ>0mNYEDW9P7W
zofN#O>paH=n00-=1KcUC-YbrKdpu9Ac1nW!Lq)`dm#um5Bz~6&0~G6#Nr`|qJ-~vT
zX;iYG9>^-*JOa}jNz@-}h7|(5bAxT7x<KTc6*^kvHwsj9?Nv@Dw#eO}ZEAaovY_~;
zneTgr%>C>LD?oXa_?I`7bOVW7c>lJc4na-+<k2KCLoKTr;nTlqmyqy3L7P%!r+)r!
z!)}oR*wPWf7~1i?rfp62cuiSxFRLe8V3+Wn46R-1kzvB+Te?yA^bO7OB)HNzefY7r
za(T$5BaEG9DUI(L{6}`XbEP#%dGMF3Fuo&N*!frSCas?lt*<kM*)Iv+CUBaHGzvL8
zID}AV*dTrHkP}|-$$OKx_FlOM3RwvxMpC&HO7KU&^gd|b5$b3_Hbx}y)T!Sf_PiU6
zZ<cu6x0F%7eGy*=d1AX!#!ThT%8D+w)ix@baz=k!9m-j!J?Vim+#WWY54(JXE2!9|
z15GNZWeI-=koBT)1LTjqD96Twc><4oXG>ycEX&^pV_mBiAXEMvTVHE<i`$EU*Nii^
z3Dj>7ad^&v*^Ox#$p}oFU2!!ePU+LsWjpr4#ADtkda}^6s90IErIBdENybc=bq=y{
z9UpNb10zIlW;-`G-GPdB3gA62%VQ|~J|CU5Bm}hUGp#@mLi9#O5LZ}`mzv*`f8UFa
z^0EBoX*ky)yBFxdH)(0;+n0XnFax>&1CJ~Ixx-WS-hLHd9&SK%`oSx=+W*%pY5U)0
zoh3^_jGYwHxv#R?SNLUXsz1#>fHoTB>ba<fHQN=jcvYI&j1Q>s0M|)D;Sca4kTJmz
zV7Wp<iicKL)D>i*ZQ9ok{4n?qcj%*&t(%?(rR-;CyemU^Zdb5Icz_9S(tRgKfq`z2
zU%fdm4aW&)H<Nf6Tvuk8UY-Mw-faGJ`o_1Q+2WBOQ>K>(_ai$^wp~@>h@I45!hSBJ
zJ3W`^1d-p5%40Ypw(NX2Z#*s~GO~nT{2LvQX|W<E^5k;pYZ+Zue9<z!{~N&F{r!w-
zlY=3GJpM{)E-C!H(gX$g3OIeV=59|);{p`2spb20^QIn$y&7F4dU~VXtNl7Q&v-R$
zz=~SI$T)W`Ch6LgSo!QZ+SuvW;$4s1p!o@7ta+77%-c~fPL~;}m9Vp7$oIU(`OW#j
zwfAK%(P9b83xGN?3keEr{W=J0dhrk3U1ir@iQ#WxmG>|3j1z%A!pmf0f~CdG7Ftc7
zXm_-3&rf^tj&Q)>OxpW-nG!!_c{o(D+0TbKfunb>U)@f;J{P?JimdzXCV}p~L2tB=
z3x35f@_vVw>k5M}36(WUsWj?jN||Puxkn|EOow#6TCKIuJN!(Q3<3%q7Sp~m+ZWs9
zu0y@qQ>0dXvF7<!biek_Kut;LFbeEL))-8?v(`=-tL!YVFFWI+J$UAXPb)H8tyoF?
z$kRspX;VAq4ob%#8_y6c%4usv^_@T1tBaP2o24I0otJ51zL7h3+N<^_J<WP*Y>%o?
zuQF3rRz;WEl>KZ=NOM0F5ZlTNY9PFzM5l2EzTy0bc-Cp1HvYm2j~mQwAV9>3OT_U~
z4seDdkq!!IW8Mu(PzV9Nlyo+ZdrTiQ;E)PAQH!X`tJHmWpR~fnWeFvey$0ce(}>p*
zI+YN$#i@p1;HI5V*XC!y&|C{)Ew^&QgopQQv(4$LXx=lRvO~(bf_<DS$FtthP>D={
zsoUA-<_bDNTwN~41TmX<7-hnYnXNT_{zQGX=-b+KAx|R=J>R^`26xXY?sJQ(YB8|p
zgy)kwJ^t}LU0{;VTZKnOrr+HB#mMn@E@=womwe(5w<bg)k#nE<?_1No?-(`$F^S>w
z(~fJ2kwi!8LV&t>^qLzuGWkDdjJK`Ru0i!b$bM?J2J<B=%q22TbVzhs_WoIPKl^IF
zKZdmfStO%(|6~Wi<?Ct7(0+ZDo~?w#+-gp?<Ni|E((>R!yLN^-DFYsnZhmK<G%#>#
zq7>j;ISf>2nDS3Ief8|TRLYo_jKrR1y0#4lXYd~^?#1-6Teg6a*$Z@k;>*iF_}8e%
z)c%>(dGLJ2yLf-Lqll~ICH`yR&j=d!AK7@TqP=!mGzLX-L|G<`_g+2kXnEs{5Fd3K
z+<gFzGRp2bu>&y#*|+N~`fc_agWBB?-RG7(T*4ie$3kk46uP;YLyLx#$%!!Jq?>wk
z@8JIy??gxdmd4*dn2nb*)R~+J=M9=gj!H=qaL&>ZKAaO*2kYB&0;>moUQOc3q1Pyb
z16FcC{ie%D&aI2;9rKOXZKe5x?s}qp{P^o?vcRAnsD{2Xoa0jfat57wl#cfU>|D(f
zEFe50ey{G3pfM(q<pH>H-rc$RT!9s|rs9F3Dti+lo&JHQ)HP_At(=O$<gM4#8Yr2X
z<q%Kj<NJjT!-T;vk_a$<IzK5YTi*i5-Q8%8MU7+AK}AxcT4l%|&?dr_+RetV{ID`F
z(j|dv0^>;zLuAN%bkCr$B93+CDCmdC>Z?lH>h$I{%R1>rn(Fyh?w=MUyBOxO+0(7+
ze~J&<@L3u3elf;9FY~eKZJ%YhCbZ(ma8%EUAKNChlH4R6wx78C*e!(!k*G8vKk&(H
z@%94x4eSsXF`|hkw`FB*Psr1w<<teGIfV*eZQdrdc5aERD#yGo3>|JIU>eig|D&=h
zEz$Cna=N+PuR!j-7Ala~g!p{B=U-7?HX;igxgvn0t&4~W487pb3&~aQ5#(S6Lo~iw
zp;z=WgJ^6$Jo<Fu1MoIApbVzDw9joL6h<PCBr+1_S9krtJWcw)JPltK%Tsj@DK5`D
zLZ>SRpY>vwEN{NsZrRA05Wr@JEEwZI9!t?U=Nv9~{os12=66jy-?~OA9Gv~dTnQ?5
zjiEH=?=O$*)xOg%&elBu_3e23wmQij1rzOnuWe%QTwybp*6|U5G1I@*LWREMz@#V$
zj3|9!^Gpa@Q&IiT2T^v&9G-~x98NGB<OazI;nEBLnxY+U6@U%ySwe}~+O~+$53_|O
z?E;#W)MEa?wqY=3R|Y-&tae=lEELps{$@Q=PK9~8#Ld>B>OS@lX)gM1NrnXPOhsAq
z%MN)me6{QjK7kFDptW!HE3Eqt$JM3lW#~3X)TnFQ3efWNbRlzRo-Sqhn=w2F*Xy&U
z(ZgbVxVNjl^-3L5<A&k+ij7R@pQ;JJg2a?gP30aga(#t83I*#~vFRuUL#b=C@f{2Y
zzagd+3SIjQNPGJB3aKpx3&fr6G&T6FK(L|Dh8Xm5eKY6ni#9d!QZ?kblT3<pza(%n
z-bJH4@Xrt{KYsH`Fxa$$RNzgp0Fn$W41z|t@tjA7ZV)UG-o~v2MdLOyJbblDUZf;)
z-`{M%Z~Hur^K5Cvx-5~kR7PMd@e255o7ab3NL3r-n{AOO!IaF|#ooq@Y+)>*P1;lP
z>v|u1J`7SsVVx)+Bb|sVbseV^DV4yP_M2FA<Yuqf`%#UaEQ}~nE6OGC+q?mJz!~10
zVY(A=5FB@FkwG@etd4wNIVt?Ql&~|e+7^wH2Ki*&;f6n-rKfXC1zl0n`%<K}jfyPT
ztFx2i2ivb{l%iJFFmt&z7<1+N-b?MMNM7|aRv7WolP#@?Xhgjbr=(-5`bP!A?iH9q
zI>K+>R4zT0UszkO<HmE&hO0(>*Rq&#GNYU<JB5Wx%VS%LJ5riLmF76JkIWHTB^6MW
z0ACmB@fdFS)Z0bFKiFKLFY^RoReST@o_u-LH`;~m7TiTN7ohgC$YtB@GqDv*;Fy}!
zmwofpyqtrb3BJ3H$i=E<%Nh(Zauh=b1-fU^Pg0{_&KND6+!{#d)Jrcl`;xgM9(LX%
z#%+EC!N^}g$%Fa#)({d&a>?eiRQD_%cjRQ6F!rwh*#&@-g!8u&(A|Rvz~OK%8j$wq
zo?u#idxzxmuS|ov<;-n4iT-a)maM+`I&GfytJlGL<Ye@^ByW>Cf~}0L!;>%QlYXNP
zNDDY4c5*5ZBqRd666hRn`h7^WSTO&UX=NS+<jE^v@*^rIj?B?|d;RlUgaB;nD2m}H
zIdn@mT!7$=qmU{<=eArOrX9KVKht=)@q-J>TdoKGPCfRL;Up!a7edAkWyLZOHmkAW
zU?=Ay!bJ(D4ufvivX!v+?>!19h37v8I2r^Ug*l!2=Fn(98O1q12;n&IDp(&Xbn(4u
zxMH<}zdYg!(ak0%&GvsDaJNtTer#|LXs7Gtrd!gNXI~~LC82|+NOm!;i@v@>4R|~C
zC;!_uA~Mdq;+sKrsrv-k%i-x;gF)d`r%Xofy1P+(L2U>3!GK`5E=p-)`&x}I)=^g9
zHW2IP03w^(a9@EJ)H6DklWqiE2+*w8j8_=P9eHEjk+={X{t+BvQ@sF(j<+G5ku*)w
ztNuMIXDaA*1~g;KAlo-mTIjYt5lV3kLio-JVR-V!j}^#x?heH5YMI{7_P1rKhP!+8
z_`wQ5|D7>|nW)IUw^SlmDzWOQs{EK~Hd_<GPo$J$h__}-KF*!EFgPzQ<|pI|%a8#E
zvHt;Ph8zN*&o992F+*<yPc<gvwIy6G3`e*^RTCp0Jwpy9&w8>C(|E~zX8hH%3L+<i
z=kN<5mgKe2flxVftL)u$9<GdmLC^3EfN9asS34g@xNX*y`Mf>R>k3Tl)OG28(4~#b
z78=UZP+q=i4S?>lFh3T1?`%hlkBA1VioRWRxdd5Hx?En1Y(OA?w@x#)XR>6xrVRJA
z@&SZR@;Z^=E@}+;qq8lICADtL#mY}n<I^uQ-OUZwy=6yZ;|11ED>V3@h8+SJMu!EU
zuehgXmrz(tueY0QtA%{?(N|`~TlaiT_Cr1kpYDGm`T4P82v_5S2~=HICoFOzQZIov
zim@-?i>FcQ^-*eUf_u*X-`Dh$$){@H9Yp8i-cczq2|r95_@+&Cl-J2sRthOiSrE^@
zCOoB&pTtoGpULCv`j6*TC>j;)^KwqP(EAxE)V+*g*vyNtSqFSQkFe2a$8Vfu1*5T)
z?96BK?haAZ#&g-Lu1trqP%#ZOfY(*H3jLHT3rG>kUkGpL8S39VxmCXeddHY;F2c07
zgL{`*R2b*U4+T!V<^W@oF_|L1%Ez>}gzfbyYaAsQ<|<P|tC3hF2XqBEO~_fJX!`f4
zzk7T{FY?|jJ-$TL$YYD_5TaYF2G0HghBK&(O-TW*3eXTJR-Yx7Q*cBx$#&pX3Ia(l
zheK{aWw)w)%^d|sxpRm)nR9bhp(acMjy;@Ym?66X1zcC(CFiaAZwjvIAIX1@Cy&O$
zhsOKfMZSgl1T*Vv-@9n%t|^I%GVQ}V0!8p&Yp2TMHqDZ#w9F~xzfVZ%<dbN$*b*u>
zSU_qVC+QY~8}L*24(rvjv2MG#)kl(>`0VfNqjSr>KJ%QGjDK%_a0HsREt(U5`Pf|%
zvVpO_t!Oe;WP;ShmuNK5>?7fa>C;qdXOQdH#k=(C{cdnGu5ic{_Qs|#4k{|!fpAtM
zI_ER2K|gy?;B91-S}tPi$^v)ad^8?q2l&qc>%Ft%OrEYChP+_lV&sgmepjxAqCvr*
zH?w+_h7_&{b2rfZ3pjHFzksvM|AI5SNN);f2MhEh??Z8-N8i9z1qVA4c}vOqIXZSE
zGY`(KHEG)DtQfTBqUj=}&YQ>=Z?-k4BKin}dJLR}9>fV?pL{YfzG7a#cP@rob{4r+
zfpt_KL3u-I6{=rBE#nDy!TEks`f5g7nKCE~pQIX3n$waQC@s3M?(-H~n-EP>QfVpg
z&(OgZTc>rUcGmCPJK90~T&Ua<RH<NTmGZfZ8n^t9W0A#g0Gy}_6b?xY+qtbq*aV@t
zbN`?U&^>Jyg6B(n!oF!X|J~!A4HWoWE*QkaA&hgpW;n_e71DJMk9h_<m<4NoijZ8P
zNuJFYX7}`A(s4pLwLi(qVnE0s0VV}d-tm#|<({;)xh|3LFZuEWNAS^*Y|}*<n3To~
zo4uU&>q4%PR01^kbFYq_97qIVv<Vc=tTxNK^8{`uHKMM3Qh}eiCw_=4>=2u~=xu^X
z-#R)xc9Fd8<%sh9JJz}HXM+pv0kfE&<`|cogoAY*@&scsGF^64PysrK1z4o$R`<*Q
zVSs#O>35)TY7}nWiaxbG2G0C&B>HTCBe_4<bHS#ABU+~l+GnxBnaEeO=0xc*l*a~0
z7Ks@EC$Na`mLb&dbB2rDA4c;L=FZF4RNwV=Qkhg#6|w)&`}Kv3Uhtz<%gxE})R%4T
zzljvocm%S<e~m{QC9OVeDojoCK0u)n^U3>g%PMqQxS5hP2B*fR+E$lMmqnr)oKgWA
z?ri>6GQ+|r58i=J=akGglC4C%%ftbr^G&4UAonAG#$fw;)Sm^q-14HH)6hh^3qF#3
z<4?SqKT=U#h4g<M9@;GUsd#l(qEl7A$Fpcy>fcAO5enDnC}wwWy-v4Bg>#<ZO6oLq
zKc~le)2bFx><_{X3yjh`$0N2*ck^Ak3MOzyI9nqtGMA%sMuAA*(VsH0<|^{2_dt;C
z!4ZksdfH4Cv(}c2^ZQ-NV=`G;^UZiI>oCncn>pO9OdAu#Ku7fvV7obp(m{9y^w>5V
zjbC+GAI=+~7|oELssyZiX`@jx0=_!r=!C-$x5o`H4IiNk8b+6V3V<ZOqYrN5<ctQh
zXpyb?oP?D|U16N7iRK&IS*6z*apwq5Qrq+R^@y-VZ3mqB8IzBIs$OS9ZD7dWWydAa
z;PJvBQq0G8Ryj$$+j5uR)z8XLyZ9yczhW3fi%>;x?YwW^N<a{`&XWQLGWhO_UZ!UB
zs|u-*jAgmNWdbmaq3uJM3#BoDfA;_*w=BVico<Fc$goWCqn1=GGYy3AU6^EGZ5V~)
z<FbGp&xak!IDy%Gj7$N;*)u{60t}PwVwIkwWi8E@NHwZ<0$Os{Py)2m!G0;QRA5&3
zCPz^O-MY&q`tq_uFazz&3=KXlK25qCa!eTY8~;sw$9yrD3cBB0p{+au?1Yd}!1T{L
zk@fSUxqf+@U@R#jESz6PXT-)kJLo64da)}1B)kceU_^g|*cD;MyJb$SJdou}8Wrdz
ziF4kK4F?92zbOp}ZT_3tqOO02v}oc%5H!TXKIJMyyrqhf@jiE%s;!U$o{B}s&c~z3
z(q5t`Q+h&qeB`5lVDhs4x6n6V@BPv`E#<+{*2Na?Cy~b&Rz}p$b(J?#j-N@;&30jj
zJQ<cOP^z{w$tT?0g;AxgaX`%p;H<G;r+v6Id@!c)ozI#PgR8b1(>SG;!#~W~N5xeq
zxu(3$e3wvK>Y7l<QJ>L4Q2c`wM}Y<ODzl_*#O84j9~R$XH_NdO5z|?{da!kl^fZHV
z*7GHDMGq4PWUddM5}zlEevv(hD<i-C1Vw!Z?{e`4oV{I<?;(-?=TGe;G};RhH!mI^
z{WC|Pa4`$IM4WQ`F`+19!L4&0l#K64SHPN|BLhwvuF&mj>%bY^d4z%TiK#!qN0hn`
z-=iL8mPqgsSZNPgVX2B!EHx?QaJ|TTvlG<MZe0nz;ZJIvYtQn=@zgIlZj!5re}mjE
zejxkLI<WFO!L=YBVVqb5;}H|tImuWQG{tgIXS?rcLlNk~IMf`7yOa>l`^`zq2W4h^
ze;-z+O$-{52J<eYN2ERR3P}w8f}!BwMuBw?P@tixppZNE5q6I&c@ebsb>-A#815PI
z#!KnCEDeN82uox4(dQcj=J9aJBC||5vB$NU1ZUy1B4`~9(&L(1MG&7w@6CbPMv4Vy
zPX)7H0g=93*Bq4(zl>x3Tzr@FodkI~mGeWsb+rE-mkbgbXl4_xPWtf|y}PS(-ybHh
zq<etPAmGN#>fG?(n{<BVx+SQ{N^AjsmkQtp>(-?^eSiE`HsI+}Dye-~L!hK!POUUo
zkJ=y-w_wQx0~WNt+P#b9tV(xEO-N~0BVM!<X&pKwvc}HjczIW#Mb#gWlaw&<y#Yx5
zrr@qnn&r_DPDv;dxn#U?yhU^pmz#5^p#Q0+(DH9Q_Y)oYOP#*<R~1t(k7p}ku%R+n
zBYEYohU~An8Gl?6qbjRv^CZx+F*dV(g7qP{&S{ch!&x2#iBE+Md-LkXce^+Wyga)~
zjg9vP(H=EMad&~dne@v$k^jGrkCp6YOE=-`+0O(>rs8=KP&8AU?`XV4mjVF8{ujtM
zelK9pl#O?P!BCqXg#)-V;F#0a90F{stP~@YV!lI@ZsI&F0DiDu&=8xS14p>LsdEw4
zk58v;Z7gPLudhnzDC?PbayJ-N22be|mjVz*tMezjLbo8i8|z935q2~`J*0@Tf+R-<
zO%|3>GJfpAmh-3B*G$faH=5ZaEVKe`n*18kbC!Bd=r;H_`<qRE_zo%`c3^_H-M$n>
zljdf}$KsJTe|s`2p9hsRdU7hi(Jw8toGzV3t|c!VdA#)bYpalx{z*SQ#yPLlT8s4-
zi8^D^z_~1CNHS+nE=(@7tFw)fS}K#IpK;2O)|wTSiFHU&8+LJ35rNH9)tone6+G`G
zZCXwJLzQU}-C<DHb*+Cd)2VDEv#!)|2F)oY|6ZZzCq=yw<o>ePum@SXXyZFxttbAM
z&TpbW?xw|@f3sXO)`OGoy>dJ|WkdPs-)U7uW$U6+1vUw8uiRm40m0oC<g^LnFKhtW
z`7_3aBpjqjWO(@+A5WZmw%JdJ>S05T%}H9gf{q?_8u>@^RTOpR9u_5VcXI+l%K2st
z(iuDyB1vt?!_6+OWm}<;_b=<SB!_5M*c!a{q5BW(!`oJQEDrUrvp&$U#x<TgPEsB;
z&CywQja|vnTrji7#bXwLiR1HoOFHJS4{`|&{{VI}OL8qNv($lyt=kat1+{j$YI2v1
zr56_0tI++M51!gQin2IqX@)04{76fC7fS9Q11*;2$zqo2D767!>zm*A{e2;(+hDYi
zJKCDA#XQF*cAS7AxRkToWCAb0DkU8eO|HSpuv7Ws)SRuU5a4BgjV7mm{wf5EZ6x8@
za7wP=c7>FQ2EMY-n<uL74Z3nzbUu|+KX#x4MBI?_U=0sIGDKAz3KWzBeE-qEe{eq~
z*7n<pBiis0{J3!B3hOP{#VR$K$j#|))lQ7c7CAgM-2)LQ6zeTg?nS0w7txZ1>)gKn
zHKz6J6<R@S21Y`c<Pc4hGBC7r`S6{(c0-nwRe_u$(%(}4a^I3R_EhgMgp0#>)L)*O
z+t5^1E86&{G<O`8uBXH(G06Y%cwgkK4Yyr=Mk!v-ijvWa!6_rr&WZ5Jh&FX%Dg<N~
zEeSLi(jJk{k0kUC?+p^%v=5TUs%VVVrCnn?i1NKLud)Q6h>-+Fhfv4hUt)G|rd4K%
zl6zyMmnn_H<vsB-cZ)+9sXPOY;^_A&ZJ%oY+2_}omZ`Gbw!E=sp*uTL^E!6bCiWmV
z?6b`c^9Ki;4!BZi889%-u#c`iZpszAcY^26@cW+99q!lt9FOW@Et17A{0j!gK4H#d
z?mDBi5nXG4w{XXnv?=KiEE9a}WNExCe1e;}r}l>(74QycRXn{{pcf@#jum`2R!Ft!
zROJzQ<0TM2l9`!vkhtFmj5wd0@38bf`!J&&G)kFd@^RS(u=m_Bh6jJ_pJhenwKccq
z#aXD7gZ?II`p&~K`n69qv7N|<m0E6+t%jJr*+tJDZ&9rSHMfVzeiiZ})1J31m8@`l
z)XE7tR+oOExe_ITHinI9<^2zBN>}qBi)47xS!(`^sU!SP5+0ZADmw{@xN&0E$p0q^
zuQYsf?|wwm--!A$C$T3+?PbcJTgWXxc*h0689@sPe&T$a*o4FCWCGkuaOx9uuu1MP
zj;4g8Vf=V>#=>}#^!ibuv%G_XqK-sxfPV6*rK1{q7Wi^q)IRL(_Ofxe(PQwZ13YBh
zVPT2+RIn{0k3S5yTk9><=9v*=n^d$S?mtCR;|H%+S?nb_^i6GuPv7o%dt<rcoe&s(
z*hWX|%pjTG=00J3+pTXD*~8_`SdTXxWAU(VdZx2SI!N$!fXpC1q0eaMK%zq1K<Ha8
z#Y(~rL)U12p;}h6rEJenhjdXsxFhSmNB9ud3m51yzs}H-X7YJC_BpG92(H?N%*eg8
zzqS1padiYn;za|rbd4nAs0_w=KdsTU)5a_s+Dgx^Jvi#}dhdM``KI-~%udLUdb;kl
zQ)-=E!DrcAz01HyKFRB!0<-Z(gKDx}bc-FFcg`n#xhz>%<9B>}hc+FJAriegT<?yJ
zZVF+2p!W;#ia+Hi0(D*JHYQ5z-5(-2jy+#Fa>Jr1v-eQ94jo;aU*y~D@W1kH?JN%u
zk57II@bXRfjp<8zosNo^Kby6@$aWEaa%LQ7!~cuDStZ(ix}zJiM8BiM#tWqI-b)ae
zJx1a{RD_J92~g`JK`PEdQ(%@tosXS`*TKH)!p}ur2;X{aC5(-9x;t@?-7tMyj3z@|
zV6d<oHt#LY`f^(>S3>1R?h1<`86?O2Ta>!LVJ!OqdHZ&o$W0rAY+~$fMjvnG4qMHZ
zo5~`LAvBXXfjU?sAb?uPw#W2}aakM1p$d0qilQVvP4Cj|pk(YjX=Bf^>6Z7CM}cs}
z>#|$VU~07Hxr(0AZMx*7j4G@(G+_YcXMneHrE@KB<nBU>LP6#`_|YSgUH_LeP4XHA
z8m2{gE^7LzD+wz-w=Rsjmy63~{jhV#@KHYjBgeL0$c5dDY`-c*u3O!Gz%_u-?jNWX
zQnvXzC7yO#dp}Ae$tuUumt{(>hgTkdtz*yrX)_`u=Yws_jxLMU+h0I7B`6_xoyU(#
z7|$DIGR7B?A-2hm)FHVPYB9kAp?j$8K&d>u*V~;);htd3+?X9Kx8{7jH$oS%|76Gc
zv*35ZhVdKjiGGWeNiZCgnwn5<NunS?$;{L%ywMW6+9l=hg=JXZ)_iQF<;c!cC~qYp
zhRMj|-8<L?NwIkg5L*6)pc6;FtWVxvoTYzf6Q{6}KcNf;fSRWli>lY(lsP%@Bebjm
zw*GZ^y5?11H9XAOcNTOqX75&uHq0p{0cwk?60;~>s<~re{KV7~2U8tkb5-y>IOtC-
zakn+nRRbaEQA(X{6x^9k)vvb)w$a!_qI^Bm+vVw->$p&-@K!USmRZHzclqaftWhV0
z@7=dPncoz~=b!B_nD6XFjg~rLM*?qed~O2z&8Y;i5pyp{0Hrb{%T1jjsiirRf|rjy
zm+;tJc$f^7$;WbAgs78y*qM31L`1^9Lu^-3(SOn~V3$?_5r?0Qf@V1o-nG)Xe|El9
za&*bje5T@4;jb<fVqf8R>blqh-0=h<KH_>3xFN?S*K%0DIbRYd&yBpDvAN&#ro5@_
zO8A|t$yycYYg9GY&qyBqw+7l&u!oNQ?yovF?gKz1FiWvnYgX_mvTqlFWUWfsu5jrR
zvh(6S?EbQHfHslEoO^e&I8peI`e}_5dGPK>WtTyF2@nw0S7drO+8MGKIKDV)3DUDW
z|9qUA=xjb5O$KvzG^(%%CW|$cD~iyL>>;74B#H`RduBKRe!(E{E^j-FI7ikr&?zIC
z7susTX@KJyd0r4YzL~}I7v)a(#H>i`6sU<<x=bAyk=%1n9a0WrUoltDD0Y?Y4(<(x
zpNSF*<{Nh#*4BqybHdJo+C}*i-X12M`#B$=vl-(wWXQ~^o?ZSsTk>zms$XIr$xWti
zo%B(Szmdk_&NP7xU8<9+t_s~^B9@<|dc1*Jr<G8+Sw|6NXN87^v;zz0TaeXbN;Zxj
z@B*=8=2TzQC%GJ{PcU*g!9fg0G8@{;iG*5(+CdwRLe2Fr(Sb?cJ84KCD5B(0T%Rw{
z6^SwhuCTlKp2NI>;tEL+@E**ErMQNmMm>@jhYZ0ozX~`S+LfvKB1kTo-b_=8!&@7|
z`T5TmTa)e6wF_kwQWo)fE$=Z9ZhM#O#oSqRWBHyp^f3k_GN<0`7BWS#E<%oDgf+J#
z#&$)F04-R&vMT;i+C=(rG}?m>1$eSJk**rRNg7>c%o}com!IO)^bXSK&0C+;li!Io
zKDhJ{Bp=lb#a(L0D(SjCC0s5E;=LK^9@&NfEaSMBzAZtSIzK{Cmg6I!9J-o<wBPj%
zrk<SR{RoUsQe@w2xI<+$Q``O&Uk|>k>zg9$qo5EH%ljU1?D4KRhLBP3Aqf%J9E%~o
z7M>j>QbksYM1*j_@AOD-WA>HxAp;eOs^<QLQLJW4{82}T^#DZ<SJ@l0ub$f}p;G##
z<*OAH@1;wNM>81bQY-EWOMkTDjsHJvy=7FC;n#-?4yCko4u}YfbT^1}Nq4t&cS%YO
z-6<)J#L(TykkUCrcQf>v{~Kqm_pI}MK0WiS``*vq`}$oLj=9Q8{^WsN?AL@lF)%%w
zs%AzQ6-RALkRm3#W0mbZ+mp6^9=Pm&E^CIcX>6t%Z8rVaY6YaM?`lvY$~Nu%kLtRw
zsE#ao>!|eVr{YVjNwMY2b)?iWq5-iS2?ct<E<vjB`;EjAk{h|lwex8E*|q@Z*fiFx
zbmpJnsu}OYtJki<hmXw*f<FPDLEALrd~pC=0kjKE6AIUyJrsSE0d9f_S|qyeFm|;w
z12#+tT^!geO-+P<&4{H8^A+o5A1WopJ17sxiys-WjSf@ylTku#`jz(k=wVE~gj_bs
z5ct(ETuu2@;^bAVO}-{}-`;`!LHT&go7lrMF;&AYQg2<Y<KQm1b-4B5uQrikW%;($
ziEWeSUu4s#rU_MT1>@MoC)6K3KXX!E1B{-qF~Ith$@cs)(5JoE+#uWE3jEQ+&mX<R
zb1N&`FQ~u~Q$dl=PFdY#5ratQIO>D~!-qD%-^^F!?=iIg{O5~&u-pFTkiN$cC0x{T
zvtP0CUdnGcMda7&10`);!>4SJj{r-ABw)K;gUEB#8*xt|DPwud3!gL=5Q2*BW7JFR
zTb4HxtS3N8V;sd4KmN?Ys{S-6#eus^-t)>grMHb<mt#j!v<YZ=jXSoFf9V)oE<uAL
zr;>hiJVz28T=rqLR{ODCC~W6O)`)C=C-(;-c-eP3Ph=K*)vA&A<(=5)CRr@-iW}aD
zg<jEd%EsmpkDP$X!)vn_p~4u1a*lb14iavD$$<cJn}GLc4WC0>FaYpaWwP$$kXG?@
zEdF0%Y$l`tJo<6e4>&y|W7~ckX4%{Z7kBR<k3Dp`d}ps+Gg9xE%70l<7a>#-ySRe5
zcO4%U*ZPp1a|`6+IB?02$Tl*t4td|BS50Dm0%0e){i+jpH}PZDzuB^&Rg=m@cbDmm
z1fk;m`!46p7!x-c<!hzqE8U=$KHnmrSa>-e)KiW5b*`jGyUZE#QK~$L%HNKq^FZN_
zw48K-%kB;Dam^d$fyLscxbjebAGV|2Z<sr>bWbX|e^^#O?5F_gP!I9Kzti|wS51R*
z-Q=7{TUhn7{dUwE0Wlw&LjITS+~Z<vL-V+98rm0qlsfNl4EV(taPMhJv-fk1={K27
zV?1}2{}qi|oAZ3bq;7xTUu{QQMdG1~0T#7Y5qbObML}lcmI#HRcON;P!1+Jpwq&rs
zswv&dcQkSmO}9mm%fh;8&%V*KsvFTL$9Ki)$)Ei2Ctpxb@{f$*!K30>?Z35)!!Zj)
zY3Bcu5-MB2NkTy{Mjl{S+L^$C4STpYKI;x9{ws@1yOn53eG$I?A5+_z3@2X>-`4N)
zH8dSMa>RLv=Y||9!T08sxc*rW?Hblk^ltXfyV-sGK_olfKDh4?tJ`NGZwv`Q8dDmk
zE=2?co<H@LzLKN)hw$q;%OJ)jKE8^|5Q}(!^1{kXb$2Z$nFdAo(XuWV%ZbbQiA~+P
z*FSVIh8f#CI*MU*To`9Q`pbae(I3HSj&62)71L*Z7G5w#A(4YkEf@VxaSrB&Q=F-U
zhb0uE$%q5g?DB#TjmaQ#lQkT~pAZLaCu#Mt!Y~YLJv2Z1?<*(D##j;fTKKMVmsLq%
z?Dqg~=h@Bg*xp>Qr9pi|acASgzgO4hl}r3R5oFx!-!Hr4x3%<s^$Q5DStcmh4A}@o
zq=F>>NGTqw+ct2s3-n5G;bnRjGOoH!IC&k028`#-@x|8;_EAL`Mz}6;<Jpg3kMhV<
z=+%ir8P<#un3-Klkpw_AZDtFb;*-rzFs29}d|YB})bcyOonWKTMm*~TZWrYNSBQ9A
zP@V#w)hsQ5B%Xw3pokB1UuCqHVCNn1|BBnz_H8r&N8C2FRWLb>tk`yOvpWCw#8{SV
zBg!2{PEYKWOA)b&2C405>D1q#m&D?bn$tj0ngucYxQF`pK9C9LjB}9ApEuW^@#OFc
zgyEYd)r)X{{w;JYtf$N@VEB4gh6w0`*X2$Y#!Hr1)JNqHXED@?U$+2Pq7Ps*H@gCp
zzffJcWIySry*4|;?Rp4<E*rhXQ~R8i%(w*m=w5wX!$5>jlzH%hN`~Pn_ig4ImES*n
z8mJrll*1%+@)@iza9qTnO>X^bVvD)+wU6Sze!k0-{A(GtN9n1NYo0gYJ2!_q7i-;2
za};bGa-ggBI-h1XOel>N;x`%=RiAe_J@DdpN9BD%7@%t)3i=q?kQ)|@$-p*TO~+(A
zd-qpIqemUL;g+CM!=0Bp+{W9hk2!~FMex}=<KCJ6<&E!(!0kZ__t#I_tW~>uo9{p$
z??pbWFEz7&=)plOBAb&(LiVW-DyPuvbjZcJ*SuO;9`zSQ>jaR@orHMgx+#o*qT9V(
zZP@~<XI}m82MqD3mG%Wz#P9~r{JqQSJT4q`7P|VywmA}@&>u;N7sw)GE#*8o;4bb0
ztF(z%3ebn*WwWuEB%=Vk&nJ68&ZI(bOoQTV62nDzPla|){c_qqlQY`JM)e6|l*3&-
zDtpOXh^#0TNhgntYteeWHvbJ8Cr4H}WNWjXgz$d;-TGVA0*j+pips)0btWSPY-0jh
z6Rx8QUoc=sEED5UTgLp0$*Lffz@reKGc9GadNU?N9|~(lz*yx2hMd_H`A{G0Ai|uQ
z@~#hi?p(yx!AXs_nDCRpK<!;1OCCGv;zG_uNAJ&^)gPC5{<*w1_7V-A?7MWHw)e*G
zafA0xNlO7&OWg&6ZRPgGo>zJ^-CUPX0ln#K9F=3`?jr%OfJ<BsV3)HhU25Lw^>CJ$
z_$Rk?t<J(b)DX6|P^+-nxlwFvwJKw)6yv{-x{NNNq(GXuh@X|IW7iAmgyiCdMrXn1
zG}I0UJtcp8NB;CUTgN)>M_$=<=g=Iq@d~KEL|X&=|1k4S#?D|?2lf3GL2L7u780mn
zMN@p_d9~~yyKo~touQ8?901+@aD-<8lX`zam@03EGtlY4+rHkNHil_d4h<^9i(}(2
zrP(WmMAqGC9BN`t*<0j2RL#un!HfdmSe#^XL^TZlW_;#S$SSkrNMgt@d=U%9&H1mr
z>2ys%ov{kIa98n-`OGiRc$MaNjq9(Pb9W@wQ@k4@25wFq$ZL`kQiZTS9wQ5e@r%6k
zFsQZtmRl$thc<s~AEPCkaV$4wcz08*Fok2@bHjWcthnWFNaKN4Vd%Y(pnLk3nBT!p
zhuFIAosOqBk!PIg^y#(HQR?7^dAcD}lbbn~W_<C#WlHzix&y?SXH3M^J-j#_xh>95
zcN!6!>!>L%p*S+^<D`W-$c9#etMb=<O>R40g^!1Gui*O<3#H>+oi87RkY&D7G3Bmy
zvfyW1ODRWbd~Bx>#&CgXaw#QO;M^Uq?o{i==K{3w2C%Lhime$H%vC^3_`}!buPswf
zp4%T@(*aoa`vu20$xCa0{+Pfqatfl1c-)c9v=PLa=TVy;j>b&q4LDO^0)Z7%uaF2_
z7g#dvrov@~3o}Aa5x|#^Cf5GO(ivuTSO~h;7On6Q?Kmo6UCQWj5H(^<uIv)mr_qPV
z2OV7(pxZu4V@*uTB9N{Ks1qZ4t<Wk0@O&F(0xzPTRqH@1-?idhrC~c2V!rvLpj{)L
zgKQv`LHgdb=eXcg=~|^I6|i6)`FhuYL>femDNHE}X*rkSWMFg`DmeH+9CuD!Pa*)+
zTqhtn=J*_o_DkuvzQ&a*q>6pd)vT>hbGV{LS710_*eldVy6Q6}+3g%`94YS4q^*+l
z92AZb7jNB$+oV<=_q{ZDk!!<4bfS|ltN(briDd~kiDL166zua)*bETrD@fyAUpS7;
z-q`p|3{D1Zo35EUXwQII&EqX%KNZ?_ZDE%M5dKV`FVr-B8pMBlj*YY3r`?{N^j!9Z
znML>{us_!|<M&u|X@Zhq{zqmD<)d=T6z*@U$z|ZF%~2j=&4Na*dAPlB7L|v4obO6q
zs<-cPqE4$PD8Q7Y&Hk^Z+r}P5C;clF=_oT7>MHobIaj8~of;RTC|H90&RB_ZzgfwX
zROsyW@{SxSVt7aANRRNOP3PkpqPkZ^h9T2V>|sF^GEu|XHigEe458zsg)DqqeeRj<
z8U-79On5>ws1qg^UnVZ*E)&qGs2x21XInu#$nJ0$O)7Sr?z*6c3blB3L=aWFzZf(=
z!smuarRJir+ef^SuWTa%r5k6uP5vQa3S!k#Y~wt6AM~{E!-cS3K|dHdSP|m5yNUjH
zat5Nh5(E6jKg{g%Dr=6^(~kMDP{zwM4SQn4I!wtj=&&bQ-yx-OC27<GtPv(q7qR~O
za639X;6~23M{X=36Ew&k6Jp}9b=*Oi5s-p*bdb(#JfZjZpc-%#L9=_KB)}a?sZ2hI
ziefxZvbl1GDbn0emc5Rqd*OsE+nftrp~UssAjcJb{5iyimEP$MOMMe{bx`U+6wH|6
zpYgNLydPKFIK4N>i!(Iiso7iLPG-p1wh*E9u=4(kOS#J}dP%E5{x~9yn0kxlHS?7l
zIiQb~Aqy~Zlm1(12-0nj^oWmeTfEEK`6G8VJ+m)INAOdLg@Px03Mk|1MSUWmJWsD6
zG?4X2$<w2W?ggJLOqnh2`>gdL(?sq!xEMMv;|zKY*V#TCV*{SLgEd`l;{Jv?Q#Lgv
z*a<&~(GZ1qJa8g(l`AB5&s%o-?Oj;BqM0nY=6>`T`hg1VT$~4w3gEu>eOuV>#|kfJ
zvl_uYuj|y#9{wHu7;zI)sa)hI&%3Kd*;$)>GVEDt%sJu+Z2g^9mQ*!dnL|DC^>A*w
zkB8N3?>fjb3(LHy>as66E|I}Ctv_SI`sSpD>&a2-=$Q;F4pJ%3J8t9hkIwBnl)maG
znmb;AEfX-?rPeT~a*HL)f)~m!qq(^^h4YPjmR;matoA}Jn%GSD+KM2SzV9*qsZFkW
zQ$fp8jc83|HACaKBp&Y6dhc)SkQ)9x?G*Pgk3V@=`K0)<87e3CH(_Pb-bi!kI)(Nv
z$Y(Ps+9mKneprd#C_j*0_3%>lHU+*Nl57ookHyzD(}UpJ82*E7g(Uosh%C})wwGIt
zz(c@>pL&0ApqQpPZfM(udK#H90;@z?{BzRfr%zZzIC`=WiFR0b7;Ds^;*FHI0ADt_
z(-<hr0aqkKjVLxP6K7AQ#2L!`*8H7G8eqt$+VOp#-KU=srNrscRvbt@oE=gDTNr)G
zQf_2np4Z~#|8>JyYXaD}4ui+yg#11X;hJY|bNnFpH-cdo%HP)(ue!yA8ktat7t5dg
zcg6dIYZAI-El#iN)0D|;%3FP6dMEZ9oAfeO(Eq*8WogW<&2g)yooV;$yXJ8bFTAP_
z4pkKqGMKb`uo!8W+nF18`PT|B5MQ~1fe(QE8-f7xOoLgY=zbh(PJF~CGFkd|IxM%A
zc}83=qq3fD%T$>3(EE&GoGyv+=7(_NYENiO-7U?2Pp})b!*!t{KLHkxE9ABC{LwKC
z=GUwlbeC0X0Q-T?tPj@-@b(>?$JiUn_)A0bD%<D(s~YPehqcEs;KG|XHpwH=C(_RI
zvnrW<?*tupJ^s^ADne^Oa@oD=7K!mY;{8^G+LaJ?jMA<%(!+}u%Z4?=>ZwP(>3&ST
zvam%qD^<k%VI5DhC}jWolkweDoFZA6j<mx*BPQ`n?oPNlE~;uAWjud`k54X7G>~5n
z8>ckUDZCV<^gHdtHYufG=8}uC_I=ZLOXuRh%l&2S#wx1ebNi=)L(#FT*w-Bw8TFx_
z;|(lXa5{9sko^aJ1XHC)!q71DiJG{P<?9fl@pWNiJXyvE4rnoUpB>|uA;BcB8_d;X
z>AubQI16Vbh#vgw(X-^3HQ`oloD*Yy6ad?+<35hjOE%#fKTb3&1$$ULLuI0K?Cpp%
z*GKssTBnuLFsW3cRYEj;fB!oax%4~w7U7;j&rdY4A1c7rqM8HDgi`PPXmw;~xeeY$
zUiu=(Hu^eeJPVMO>m#))L=QZeiJZ?ni1%d>s&DiarJw_E>x${~xo%pSD*U)U$}U>8
z{0RiG@eMXoag`Qqb-Gzo45y(j6H175KQa?k!-fG{-s3=$_BZVm;HY?Xl=(kDTk<g^
zs7ay_AQxt&tr^Qz?N<Q2Lvd+;XS;nvj3iUPUohs7*}o`Z-e!w49-Uut<~+w2gL@-f
zh3uWM%XX_VAq8O`%<WkO`|EDv+8_stB>mn{y(F-B1dw#DG?>2eOTfdICMG!C#KtV?
zwUmUM#06?iuqbKC)ti=So`yp@k+PwRBWOp5zdokJP7KyyJOit8YCX{@DfDmuEe*~B
z3xTit3?W}qR4NOC33I{CJGgEAt(51cH>qUu-AFD9bU6$JX3kbK`CqaOQepL-cMrcY
zXw5u9`A<=`;bhxguhXV$jA7?1;w-z<5|All`<88FI8!6=Z89#+0AK+1FMa{T4r^Q#
z-V5Bi{7u7{#Q4HyM3C#8Wgc}yxU`i<wyjt59Mi1A%%`tp<T-(S+aY;h6en7ma647g
z>Ov1@R3=n5NA&00b{SSE@)F^{HToCZbpWzM0zrBA`$dw+*BUOCp$zm~6e1PwNDp*_
zfFn==SqmB(&Jm~xxhYW9>%uij`B@0)P06E(EA}7!3h1+=Oud`J8^rdg$f}|GCTZfT
zo382=$G-wd5Zl*bENw=DFJhcc#-aF2qxH^na^0v30DTIdpPY)YctkE~9}x46*BK|S
z*Q-?2%o5=1RYcfN0XZWHhr?HgBZ>1;g+1(|@9j@?E6IdubXjAGX^!#c1?#Hw5KfF5
zYOSdhh-v%?aqi^E{>g~^*Ki|ctKczGsv6fZnK6=J+6B$)&_`V{PQJS4UHv9Sov^vN
zxDx5eY^u`vmEfi&6FlGrXZuQYyk%rO69rXc*PrQA26(PVp$OrVOP7MHeA3#rE*WfC
zNyyE_GbxSUmEaxw7qsga?w0JI5I7MGsT$h0+Ur^kiZei1QKy2e7PiTFBR&p-UA%qz
zRDHiJS{<jl=B+taWqs+}W?R%T*bg@FsB@Y1N#HlDMtVs!QU56t)w7baQ^QRb=Ic{A
zcj%66P})C#$gQmA0@4Lxw7-4Ni#j7LZvM@U?7*VD2%+;mT_E54=ff=D@%(+nz=@1o
z441{%nNR096}|H2p2cQRvAUu?3Uu|h^mDcIP3HRjd8&$_*)Spaxc3smjDU$-oSO9)
zfXBO1eFzwfta&8K;ldZqP*RdIgu=$d9`>F}0HVydi`%)4G-0Alh-hx^<bAo9oTQ|&
z+@T@(P#?xA-pjV>B5;R6hha<`V-^;qOxaKn;ymxR9b0>;OAQmq^&7@f-lZSkzxWVX
z<NWqtkI5WTEJhhIQ3!bi31!H%>P<#~1lm-!dHT;K7jq9CAA%7Pm)}PPfa|3WOmNR#
zH?RHWs~P8O{hpo_17*s$O2D&?88wb+YmCu5tPu|P2Ak!x`d}69W1Nr%Aptcnc{I8l
zCQ4vmX6E=T8T0xqN^1;&yZb9D<w{O3OTpN0B|Z~T1^(rG#f$UWFx>Hhi1*h>*0kMx
zWwz2%-`C!X5f37J=&^HL;LAZY^gdlPe^sHH=_?ENX*&h#;1o)wR{fooF=U$6?wGSo
z$Y4)+j7h4WB+KDtm4wPDj44P*H<HjnMv_I$y{a7k?AjAn7flC<dc27a%<P(uGudfK
z2ZyWcD$idOzfmHjTad3>SSUO|>Hza_I~Xd*xqfKtgXXNc4s|f>Z}aVSHYoA$6$_nh
z7aFO`#Mxs2ugUQ{9;~TKiP`C^H46@$ykDZW5=1*3gc(oa{?6|U2WX6aw|>zu#uTLg
z*!f>F%Xc`H7pgGCOH*P7WA|1d(eHL{-Z_Q4!6rE`GHbSfbfzd%auvWhhTG<8uzqpw
zDAaui;Gv+;qkKea4*j|N<F#|=FfO$iLP+Km!{8Vc#!2<==l>Cs^;?RzP<{T5R`xzf
zst(K8J03OT!inGlwPP)E5oKh%puk0?vuunOvsX@=HbqUnX}Cg_N%=d;y}M*`l7<5o
zPT)w}C|_6vrystrD;={#;}Z5KOJUTJ1fA&$5As^=g$gVa${jP;`_@Y(Zg0?gPM+RB
zydCQ69S78H#)x&#?=(wUpZ;C95`HO{D236D0^ZNw5_`~<AxD5l2c+4(<i!Fh?)TmY
z3JSo49BRkd9Y4Cwzn=QfF7qLI*_=w1>-R))dDT;$hR@5P(?vK#1!3$Fyt3&U-t|}=
zhl$aShIoe#)VdsjQJ$26AG99AeQ%Ly^_1V8CC0ee_AV`qkqZT%;$h(HOk)F`JKQB>
z)#Z)?h9<>|kAj;YN^$;9OG3l}eM`Ro%(OXg1XR6?qVF*&uz#@@XDTv!GvgKtMSQ73
zi(YxQX=8lT@Pv>0!wkS`v$5E;Uwe-6;36`kI!*n+z_$_7_a7$9?Wb#N`=+OeQvx<p
zn$!QwWHH9TFeDaC&S<R**<$bpqb^R2B4U}6k@gml{Qn!uVw(9ua2o9f9cS1DQBvsS
zA%R0IW{?_7H8;?>anD!c+mWUiTOz9R-m{gx(^LC)ZWp!jcIvfo3Z_U5Wnq41ZMmdr
zAkMU}x+*ius(8bL)5CrY(I=Y=xwWPb<BHfH4+VOAEXbn=LuDK=j~eo^2c=7jFd>$L
ze>@Vs90ww5We)dEzI@<zyR4LCRbfj>Hk>!_();x)bz833w%Ri7cc?5exRKFJ4ZAtP
zRPOd(w2mpnmXgHvE3WB*e1Q~ctYT;#4xm<)yq}#z`pP)+JPvdNj~Oghg)I~x;t68^
zEeRGse$I#B&Z&3!g}52747ACNg(a^L^Pu`-N07foJ+`6S7k*;de*8QIMgHYhTXn}2
zM>YLe?5Uti#8rHc?^b>%{0XH1KA(32;qAo|qoNmHTC7=8?buPM=QdvT(f?&Z>OBY%
zEkV0KtsDG1TfnRixMIA|^-UX+fb3z1)KE{?I`oUaQ3Zc`u>NM}s82;d7FD!-6B!Nt
z#=(pG-{_XCpN7VTSsIGn?O$gQ6Lltkr_GlLE_iFAQ_BXfFw69aM7wtaiBtBa&U144
z`n>@jhUNEQSL8^5vAIyB9v<{~BEzH>HBv&GX@*OmW@aFa1*sZ&sXqyqa?CP!2e)HG
z)SOzy1zo-nS*pR}H)D;QoVWE?s=v~JlQVu^L(weWTA8J#wL}%ohb!}J3q~6-m9-0r
za*W6bO;L|x&7T^opR@`!VB2B+$#eY6xu<Udg`c|Xd%wMsBc1KO={ub!pGHanXODsq
zzZv;8#CCpvSY|mF|0O(elNoiV*F9%<P#doX=5Qc?;-knH(|a`h&eJ}ZT&`9g0c!mq
z=Nsam(9wtYk}$8mblz6xU*!x}*>(f2U6h!rNV-h(FI?O4YJSx0kMmU4X)1<shA_l*
znyqA+@a<M*1x;@jl$83<fyEN5WM7Ba-PYHjjlNkVDV5jP#Gdt)|HtsJ)Ng(GJcPlk
zP~A*?BTdxIZPkML=Fe!@)3nrUggBMjKCNHdDV!yU90|cxG2BJM+)xDGlbBdL-ATA!
zgxeGN1#w-5;08dEO8Kdtcg&s<5o?e6CN!d6MX2eueM&S0kwK_Ij3nOO6$FUYMGD;c
zjb3p~v#PsHw5v$h9(_hhRN%CNCt=_oMcN}(We{4sae8SPSF80|OlD(367F*|;ICRq
zNH0@os6KTFTcv`69eYa(0mYz^$C&2)tC*gY%0!z(`2GNd*y=7-D*aQP4k(KnE$=wT
zo-9ChOy4SPV=Bp<bXsY<QL%C8O74#BgcLMfzs~*n^kQg6(~H~r^k0%cWj6H<2i$8m
z{)IV2L2*p%A&v(z*T)4w-fxkk><aBF6Y@51Dn=>Bsb{>cb{@ASBI)X<A6scib2D_z
zUaX?(o9W(W2@He2R`zpo4r6-y%e7dXbq(FEab1O~fL=PFN}g>IABxjcqHGNhbqD%@
zPYX~S&lbJ9mfxPl>L=rh9WCDu7;5EKY)IQ!|6Srl*TBY^{6_g9?5vucmn~zfr#eDA
zue(G!sW7s)E3KFv0><=+lphOAi9`dB54pb7%f2INgVRS<7+t;`$zOQpU2Q>cJX^;)
z`9j{Zdeq4ig4@UK(dZ>9?XMUh{<)?SPw&Q4eN{kIf|}V+M^@`u-=f7Q7;@ZHnLV6)
z9z@{<0|4OtGA)wX>UH3LI4YXUT;W*P2gzO!$FAvC{64FPrL&dx=DAu?tC;GMvvOY9
z29LN?)&A`G{cvxswE5+f3h(#S0v8)~?OyWCU8W*9ih2ZQ&Ga>Ht|?od)f(1454L{S
zsx~-Bq*QLjDT4<o``z;T)rWfnf89^=u)HfZK){!}Y9JAUz^U{d<edH26jpkwk_;0+
zfT0`8M>B4)J<w@LdR}ZrVB+mkL?hgglVK(Hr5Bnvv*M4kywx-QA=_R~uh?>THohbv
zcg6NV_PnN%+Sva5I-`gI*#?!QNCvR%g_x1IOp)qOkN0`?3yRvnoeLZ@FA)7NV;}6Z
zEkWHB8Ma}BXc<jAA7#Nl&dn?tzL2fCIAGaQ<`8qn_T}?RziWqI7!}=VU7<Ah9gvme
zp^wAkJO@qF2*B#QeHewQf5s4f`1JS>Dz0GoOK<JIX~1#iS!uwt^YR$Fdg>>g%a!_)
z9wXBAP*h5o2Ztkc4kzAeokB+r0tGcChn-%ge7h|W4gKx!TCC6Oq8%2{cJt;X?rI$&
z=oE-a<goykc>QS-93n-1d+Zp<*dd%>XPk2x*0{HxunsKFj{42<w7uRg>#D1=0{y^y
zM0dVI(oxjBH^8E~^7x@k{c$hw1<Y!n8*J1uZXdn;Jm^SlCAysq?dm#@g^E5O8%2=_
z-SQ7K#m#AJHeXq==;_O85u9atw!1n<>#eoI)4)%z&V&1FUehSsmewn$;$0fw*0NUN
zXo;s+!Cz~9{@JP{v<w)H!(&F9Q3L+KGn&S(Xz5W`!?V(Xtmm7W=&pxDUa9m5S|P5M
z?J5T~%75)LK(9l+HGQE6GUW<$_-{;uX0Ldx^0dw)<%*h0l9$W%7lZaK$qClAdywM^
z%p>;YGBDbA?e=-#4ifmhunJ$C2x#@%QOni$J4njg>&x=oc%#*txTOS`BD#*>F93O|
zpC4#Fd!Iu|gdEp?xjkxr1vI2Ji%tbOggCCC+4_O%{Wan`#*P-|Dd_u+<)sy~@O{FR
zZiQC;m6hpoYG%Y9$YszrF2+^d^><np7>Tly8lI=BT!k>c8zsj{bfJ-A)roV6FV98N
z(qZR+jH|UT=?^)qy~LY9t<4{Bd?-ErG7S4)q^+k8NJ6vP9NI&coYx>ME%mi1Ap0j<
zC@s>K!kHRg(_zqr#UPyh;4K73B`q!+5<YXjd&m4Ap&O<sNzfRNE%h-h0>}GEnq?*l
zQIgDw8LCuoG;NK0qk`;;32Tf#Cc3t0iw}IUQ4Vi<ucz30bh5+hfoyDor!Lq@XD`#j
z(Sh5O{?R8Mxhv6DVRYlv?$A=d4V{+<q=AcyHbtGZCBx<AU~fM#el!^FfhJ$N@@R^&
zxRh98#sK@oJL>kpu8ME=?yEtlK=@%l-_(|_gQr=PFy45kteNpL-KH4+QndPYZ4G7_
zHJW1gv3t#3G~15S13AA`MTE#+1GH`ZSyRUOT;8zNYm_rj?eR|DNWc9?qb3raeR<&A
zE!Fcg?*}{wv{_q&ht`A#m9D3FD4cBM49u$}m|=l2*eyw6GQ`$KM@G=BqFs`DAqevS
z;#{0}w+Nl%?b@H!Z5irNW^!<@(2J-$?Kln4a(>3tuWeqXI?;aIlNSB-e57o|$G!T2
zbL~;f(O^Zq%?Nl`yRO>ysGU?4GRInGfOvg?tN|~tLH5}m1SomW(t)IcTJ~7Ejccq<
zJ($FS`Kyz_`|gKm@YAJUwC(e{?SMogy7kZzZs1u6^!Vj8uaESv#4D_Rpx?_w6qCW-
z=s>LFJ(F`^j8IzhR&i9R$l)SlwEY|lwP3wdyS{cLna9hC5Wbii_+6R{_SzmZBA4tM
zsX?5uFCjqH_Lq*+kA}AgU5pU75>BEnr`1Cu<v@sQ^t$(gL=<lOX@_E&wIw+)nT7hL
zOqvk*uqXXvZh+N$1d5w?|Ce#-(D1T6V;?LZw9Fnf^*apzQ%qh@zNfzU8=mJw@5N9x
zn-azuht~P|a@8W$=X`_etb(oz*pHxQ^qxW*_WkkL<eh7)_2qXPZ{A8>5RiAS1aorm
zMfBbX_@-z|y5-VOinW3=emyY<ALU>OV^6NCzL<N~%y}$O5qf_aLZM!V+N=E4-AHz?
zYTzD3=kS<}M>{BdF#bcIDo9n0-2zvWEUt9dd%usE+K%*X^X<~v(LlHrga|&GP^4_f
zKK{pwcm3Fuwlw!Cc{E(NR6-Z2|G>DnC0Y!RodDBRydb#Srim`Omj%lUJ`%C+)y&dt
zaOQ_EZDL?Oh7dms0$Hw_Ka;o#AZ8ER0CID)e2ua5>EYFK3Rm<BJL^iHOn2fOaCUe3
zPdn>Ddgc7sGXJ7gFFg+8eHc|{^KvL@L%*kVbZ{eg4mJs9m^sQcH4a%Y+zZJbtoTv$
zXH#j=lR1x4X~R>)tj`kGKc~hDqx$CK<CA=<z;#BEyPu%3;mdUBJCYV{#E~Oh(|jm=
zVvsFg6W{gRSo7)mz`f=p^<%9xp;pHdceJDbVb%ap_}nuZ6!@7;{lvLuCTb$^xqhI+
z===}Vx$7ljKxe|I2|DlSDNUB*peeM`>B$su_H;^;)^fBR)rJWwr0--7nKpX)XG9!$
z89uKS?SiGyjuu$$nkR@QcN%#5JXjd5e`Pwbdg7i3RZZ(uIDa|~tbv2UT~%Ipc^!Pz
z_bU(2xRr)&FR<N?TCa(=H8N>axQ5?Q$2UPU){lT2gH!L*_-KRaz=uKJy?Z9IDBdWF
zwXKqYnw7`YftlRLe#AA?7KUYNgc+huaDDe9t-TU{hAyh@w|SYz6!66B2prOUT<+@Z
z@OsV@YFkRN5ji?(KloRplI?dfGJyGVG-1*2TY+`L`kL;+-qG^`>eJ;F@}p2x<T68<
zgw<y)4~whFg|Me8;JAt7&9mBhGQ(4_EJ=;mVxGqHN(eq)$U24L%Mx@NkxJnBn(%+K
z0PLLIj~^dL(_SjPpaj%f#$s(xIVZZ=K5J^xfpa(~R-&-|@}UMaE0U|#Q}^|SDfy1a
z!{xOPIUS4#sP`<lBwg^k$>T+3{s^oDM~sjw)&uSUw;pFe*X6>HJZ~N=^;2YohN*!H
z+PUEB^~v`<M4A4O>q(^Sf01Mg=H~UIWO5FnSd|$f%+~kY>H~htt!{7(xC|_B_sYFq
zAqmZexTMyHQXA1y^&VOZe1Yx<UKPCxDLG7sp`5rb0iu|mj#6OA$nKX=5|J)=UCeHG
z*_GHduKoS4MQA{;SwJbghSi@vj<MjW1GfHB<+UGeL}=})_VBRCWK`Vz;(vmVSjQ%+
z(O!W;JR=P{LJn3N0=J35D}@rJi^W~efBW>-9&x7}SqrH;8+<)vUf|NAI1TcK2h#%)
zBJf}+DDQl>StsDscby7tQ(hmcnh<dMAWU<0-z+VxZ@)3-?0R+^c*{HB`f@b^-6Qg#
zs6TuXIq*CZ2;7nY>aV)Jz(m`BdkxsWlsBI~0o7NYl)7x{KBeUx+_s-SMddxURP+Nf
zZaW@U2QX*R%LKta^PLAN-)(o9SxWv0op@4H``_VscG~V;S6T_`o#S_)p0!(vR=}6E
zy571?`0dma-uiEZL{;b`oQmMiyK$&SjhFWT?!+CdQ!o_b*=BVv6)R5K4Sa&HgFKwF
zjJgcY<#{`8&h>7)9FGXwx;$)+?slumfn<dfPb2lY__nDcrmnbu*%m;|OhTF#O7jL%
z7S56m!W(^M<F;$~c~=8d#zD?A0w9i0!UaWcPpw<O@SKxgW-tHsC8-^`{FMOczD$HD
z4i$1^PtNSY+Rss)l))VxDIS2K65ur5?-#3Y`l3=KnPLF7GJ*%X#fwTfS@SA$T^bZz
z7sPhwgouNG+~7Al(Q;c5?V$rUXt#ff;9KV3#uf<80k&?Cql<DOU527<z~vSQSI6wW
za(tN#3u1KU`8!JS3J*QrVbJmmX?IxlWnu&$iP)MPoH9bF8tIH-8+R2)Qyfs~NB+lU
zN@iMPn(KH)l7Xf;FLdHnZ1f(EX`<YqbgRv)2qthE9<P@3PW6?-y~0Lo`ZQI);DP4V
z!3I3oVUb+v$j%mg=A4qy_pq!NU;H7%T%qPoF=q_>2dD5o{A2YUnb*wp(;5f6#=J|j
zxt8{7>i+HDx%07Sm;0f84Z*WG#H?diZ;NQbT7k0#4~y^BCjxHNqA(5M?@*;hkxFxY
zM93alG_r4k)<20LBG08(R!_Xwp)IUFHqMAoAsxSsr&DGx|HlN7_m`scOEr>CC+D@x
z+#0wMS(wPpCa%<DTGwMSH0R~+RDjd3qIp=7)llddlvi3Wt^8VI$4d0__bWPrHauhq
zW<UevUU>bE_1j~#$LHK#p;BVfk?<bWz>Cr-tH+T`I-nqB7vkC_0;jU?;)A^X%<qm$
zMKt_w+ty#dw5{Jkp!FQdI8kk9lB~Ky+d30JVFYZo0Xs8!EGN!+Gf_sZBdifD69ujw
zAD2S{AMgkMna2wov=vOT53v|CW}~vW6+{!xx2#=93yyZnl6e(BmvG34?9mDX%Ju`L
zw(r(FyC?*2)}A0QpF81U6Vh*M&em0|XzAwl)-OONV!rqFd3weh6@6i>E>n@eVsHcY
z`l7Ykcdj|2I)&n1=PS5xJkDeOJ`y7A-n;oI{J9xX?o@kCtL5RhiHV-qfd+AAj8Y38
z1?IZ~%u5aba|#is&ETUt&O4|dY|jV4JUC8nmfmbz&hObf_zDUK$qZpU4j!K}hU`rc
z8NJ-kN3#a*%ZneveoZ(7(I7t0$I>F7u$tEA9IkAidfmUmc;DT9=z3)8LC+1Wj(DZj
z3{CkWwcGg6dE2gsivqqz+C+%<wnd{~<|Od25|b~*r(X|hx&1`G&Y1A-^ca2CKL>MY
znqjqX#yY49!D;ugmQ?n4A|8ra18DcuL^fQ~x=blo<MWLCRu5lH&pS^2d9fyT`LAd9
zKpQv}p3^Lat)xW~(=Pc2b+D%fbdl!fMdkqRgST{W2GQs9c<hykmpMRmgwRIAXr#O_
z;xl&=y|*JjF6*ubw-Y$H5y==Rf_O%ffz3f4nR&N<ySO1Ir2`X!wPFt^o}FrbPqs!(
z5C%HCquEi6Z>7qCH<wXH&5-M;7x;YO$F)1)O95wRV5ip)hzuHO(q14~Q+TG!Qypi+
zMBpS?B$EBMG4MQUlHoYf2buaQbbUr5(dg}Z&0t^f4E5CpbY+)cx#-;WXs<3`e)VNf
zn!H}*epBXQRI5|JUHaHmZ=H`%5$&kL@R)pHjGLwXxaviH60+FQNoqVkWUm`A-i$+8
zNMoWtP^)VgtDJ=;*!hL})k@}tLBzAI!Md-pe^Y0`S0MUaqchi>9Rk!Iyl0+sl8)OC
z9%By!N%?GioRHdrY3DcS#e1YfP&JylD1A?`z=TX+4+3yP(VFWw3bq60gBkZsn7(?8
z#<&NszKHCEffK=3#0PV8WIp*|B4C7|U3o@jJ9T813j_2dcs(P1B@!UCZ}Ol|{J_A0
zJls;v1U^oj<K<sID~AWIoE`FUh=;~N>`2gx+AN3jEJp~XTQ4^m{zItOx<I|q5sbPY
z3aS^9cih3BX~d|@s|Tn*?fTrG5#CNk`2jn0s^GKJn$v+mSyll0s?*#hWs?)>X3^Kf
zC{%gww=!hxq{&IEJ#&fz>sshu<>{HTiywu$#il}WRxGFdv&||o-~+ay9B()qj`#S<
z(9A?WIBn2!|KS?FRYXln6|zayqEFMY)p%0YZ7=TMMJqL8YgGz@+R8pf(tYtm+GPj%
zS(8%NTtf~CK`&1XLoDkNB4?cmm$J(KnxyhdQzuFkhO)+5z_y<?o*@)Or#?enB!SO=
z(omjrPJEPClWRyoKK&AA=(N|}-X-9~g5A^So!CtdX`!RwTPBgG-{zqKkHAM0(!C#I
z$LMs7LmfgJYqw>P5B~5%YKri|F~gG!)V8;GUX)S?B*Lfs8Ye!K;f2`8C;>-wK<Ys{
zyv5D?3h;9yRFMOPd|}bM%XiIymt-h9TK2?u)cSGz<zCe}ZJ8mY==_8GL}gAnxb2#`
zBBxT>d#B#w{qq1cY-xK8BGs4m@_Y&fSd%syo~>9(bD^zKteg!Fv^`%^4HQy8Pewje
zbotqzL({tcG>-|N5J`#b4q5QBcC*OD;Tl_=vaX#;4Rk2A1!fmKwrb%9Xi(D~oC=>z
zCEVVz2G}?!L>pFm!6m5G@g{V@N3Bo$d7Xae6C5(@cMhH)pO*EG6Y93{k*nb$q3Y%v
z_Zp+ehJ)=wplmp=hrs&zykj9chG??M?b110kWU}ui&Dz&1;<|J`E{VqrbGlxD7OTL
zxo|u#J#Kgz-i4i6RA-jKo(01SfcF83^IleVdne^}aVVpmG0Cnw?^9T{d>%8Vzy0T=
z>1@7TJ^gI9p-EYRxMFfxJyd5>gUp7Mrg5NIM65o~u4>Cm3{Mp6aG!yjj%flkRS({J
zy6aJ`7P(Nw9m1lXErF}e2Kj^e!d-J8{Rt$DD7$R>+~A$JokNV90ml_av8xkDYmNB#
ztn2WSA5^^)e)np<WqDTlMs>^NbQhveFwuSoeGxGkUtTXe=XL4lB=yqn+bg_$97KN*
zo+PT1{SNTC?F^f@b)WUn?h=!D!e<Gnu}c=>Td(*0UHpNElHaGOxzFB_XwYI1o0_qG
zdpr=h{R%zgl5Q4K?S6bnXf#{xa&VP%3I{>iw@)qt)nD#lyIsRu_xksX6tj-izE2eW
zWCwxg7ip3LxC5Q}=&Ut?#}zPf?r?XAq9LXB;bmfXy#=HOne6M_Ex>~S9qwE#``7A9
zbH&!Sw>uTt+UIQ4*XNA^<lnRypvtrHjUPtQ_NJ21tcp%c&GMW;&>fF|gOIS;SM0`3
z7@oD|#XF7?7Sg?6SO*KAk-s8#R2B@QfRs>YgOM$F5{9_;&;nFy9z}q6-OP?NBoFol
zpxfUgihd>wu9|J9(%PKE?tL%znS{gY`<D-PexV<*`>LLZ@kq##SiGA1VbW;5TOqt@
z`+_;O=iA3>IPeYU;-Qm~8slU@hJZFL_O~e{A_0u-+)`|g(@<J9nWyL$A+6mS+irnq
zxc*c*)*+u$xQ0^B2A9crB>$m}Ow1^!MwW5O+*j(hC=YOy0a>Bn;3;E(T4`1(F)k7!
z+h%=Xi|*ae@7J{P#hh4R_2?!RU1VA8q^EG}V!skzval9oI@(fKTp;%DyTKTR*}SnP
z8x7y=40lp~39Azyl7n55hm82kq&&DbJ*%MKqVN!oAVpYtzld_;R-(Y%<`t(BNULuq
zwi9wH;!(*5#*!snV)>QRdi3GxZ>gxp_Ta{F+_<>Y$e6xVc=4(FpqbNJF)q}E(bV&3
zNUjf--|oFa@1~F9QpdDl+!9C0ubVUSi0gPS7^^Hup2pLg9?2dBqyB}ebBDK3dWt1y
zy6X~9i443p^E_03nhkrv>P=<#<o^WdKC|eyzSZd93H&X8x=Q;u{f*z(HWB_#qz&ts
zw61&i0cHy%pd}te6z%42!k-7LH_mmLFAJ-oyV$J(1x>V+;1=T9PKVVyY#VYW-4IP_
z#<qcuRDz!X2;h6k;XyWb>*w1QnzR7ljTv4G{2N1m1BvvnKd^i2HM9P#NE$NIr-Itu
zSmW8j=Sm{lHizs{87DV^-J3l#=CI4OCt>-QoiaA4;5J+!GYB{5{2Qv5mL>?F9cuNK
z%0(ZgZPKwQ=M>z0Z4X_*ydRyr(LCQ0g?ET3-L|YFa?kQ^vqj^mM&G;S)?s(@UyLy1
zef%N%xQS~X`63Qi7Pu>-q<<u>A<K#}Lm5QfSbyF=j*Ei5<KuW`T*@DGbi{?m;{02k
zmox@=>#H2Y*R|T6g(E_jijE$xY#Slm*2@qK3fPi3@7~^?Dp>;xj*7yAZxz4%GSQc!
zFrJ$dRv|l`7i!Ts3Z{>o%~avpo^;IM-c+v>N9=+JbsS1=9v{fP1gpKUpZfTbi2Nl#
zGnf?-7~b9YpKLAKo<}NtZ5A<v+nLjIAEPM3;Nf-2S#=_e#vJ(bLqhyCFYfWT92tmT
zVqHh_Cbb?N5czx(M8!SSn8T^~X=G=_l;jcC8W}+yZW1Niep~==i3AI)ugOH<A_XFX
z^V;t+O8O>yj7HKm*P=cKfBlRr_2<Oo|3A0_D{za0%DYcF`~N0a=%S;G0n~Yn`+oF&
zY<i?}vs#XrL_HwSpE16|+H>V{&tarf{chU@IQ+xyK!8_$<?;nB-GyUbaj-Rp)qaH1
z?O&YDuAfl3_O82cOz%Y$D}WZ5*(Z~e`QUe8O<C3Wi-2fC{y=@rrlnS<knmTN&?kzr
zIrUzP^%<dWSCN$mA1m5Q+#t{;JlyYuwG`(M>~cR)$#1@ABBK?+hCqjWL9FHel>@f^
zMt2v1sE`us-t0<{vj2<kdd&{i+ki)yTc-`pzkqxaX-0DwCnff76?E7ux2E@L7PNU!
z!`o6=tkigQ1gN(<%KmaIerG<WF*@W7Si?OK^EIJicaNs}oR03v6He=%UG7K9M>%1^
zchbmz0HX0d?C9{kL;c;<+<E!{Wfq7(nurE9;0Lge-m3SHeA4`JLJiJCBWevn_U;xZ
zc3Ik=7@nnI-$$&u{nsv3{0{LH!27YQ>|Nh6(MNyhdyq0~wd?BP06Xsdr1ubS`?+G2
z@7lJKzX0jid1s+`wuQ-`4v*qrmQaC){TsrcR^5(F_pBnWCLWJcFd;5G?RwPu#_ykh
z=J9DAbq>UfzK*Goz$&$xNdQuIo%54jEs8%N+5~^R_L+>By{FlUcgDPDdFRe4NGlh~
zY~f4uow~J!Eo)MKSb%*|c)<6F((>b7vA|N{fCs(xa!7*5eFnsB=WHqR5Z*ebGmCck
zoaIAvw(Wv-_i~hj9%Lt3ck6q*CLdoZqVkPh6lV2B(i^S6GLlhN?8iHrA2jb|@bJHi
zi%TNYV<h5#QxPACM1K8l=PV{DN?H8d$V!`U*S$vGOGa)zr=YioCHQcy{=bZ|t~t3P
zMdvQtU=P$0|5Hy<X~hTPCo$kYL5}9hkf@(qGejx#QuW}D)i2@cVAEprwZ|&@?dRJ!
z6n19{49?prT433z#ZM4zXQoBVCc`N<$g6?$6EsqaS>e>+)p>>MWtEPzOTXMk%Vw38
z%Ic^^l;4srN&5UgB8X{|c24w;t2fE_#l43Z@lK_8#)qN-Wc^F|kNHId6T9rDxv8-%
zG2{4JgIbq98h^-4Xb)Fc^cDG*it^twyPZo&bAA0!C<!Z3VuV}MgIq*}5@FW7a}P{K
zWG{$8=1u}6eZhx=|B;cidityW-)<6oGRqzf!$%uZzv5!I;&wvOfh3LrBlzTDvZyyl
zOf=ep&~jlEXgs0>ANXPRfRja%f{5RC>2rhb9$^P&kr}8$lF7TL&2G)_(vhI!@OwV_
zPbm`-E|S<O=h@x&8*d->kBVCGzjs*XLmS?UeCEHOWW#sYhBnPEKT46(Ys^?7#}p&|
zS#?@<H~FWbg}Ix3ZS!EgROdne<+1EvO~4&yTi+$*4BWN0CpCgz`6M>cmuDqni|AZl
z>pNaG*Jz@BoaXm_?PMU<<`hC!*3z{3=nBEf`%{7B)#<wkK31Ay)RG+<4K+zlleQCM
z8*~XnmV(jmu>3&>uvrYqgl)pRl6?K<b*v0t(#g=I_R*JC7_!La^6b#Q1TkTki*+`W
z{gAIESeb8mxcaq%(tMZ(+A27mB~>6F<UlGcLZai=qH}^aC9rFI9k=?SRC{+k7BF*6
zE88F0=V14JxOQFe#lg|*+|e+MApOz;0#j_P83hrH=&$!&4n&KbGWa|G0hKh$-TocP
ztEg$8mJmE?kM6?D_dlQdx)pGtmZ$4EDmb#U_Ps-EMlY;o=SPK1^LJWQrS5fC$756^
z;1#SKW9dcu=zAPtbNCPb1Y07MhQ{l>JB5e%<=AKAh5^P0_>d@jrR}@~#$H<XR_C0E
zx)$obihr8hV`;8?u7C2GvxXZk6RwoCNd9nN$JC0=I6C>YNlWqvds-@{^3X=1nRLnf
z@Co0}`P=7*Bci51JOe{$d3Q%vX*zdoCg9p0L?a9$ygMTvz6sgue_rRqHFGSq`oN<O
zHA5qQZYiL5Zvk<N%nDDKKBV+OCFP-JT6TA&d*?+1L!xtsw-@A3s_KTk%cS3J+xS?x
z6WNEjtJ^%TIqKtvI7?P9O1xk?)1TdKv6IaRVQTEu3DFffaCee<FPrhnOx;0J6YR-?
zVCT9(IYa$%w?Cz(fy}|L5U&%**q)q}heFg4y@CLIvO5#IKSx6W0OFcLCfRvA++Iwt
ze>cr_J`kH`nMgN^Om(jOw6!bit;^P@{XHnw;vHYeZyqY$o;%qf6b4^C+x)4b{#VUM
zn^m${goVkVpYHkDKJQPCoqsFB$9mrbvFa2fmn=ZZR^}jz)H3Xo>`ace757o8NW`wO
z!HL1>Z?SNZa0TpnPMK?ZQ^N0340Fe4AaO7=y~F1M<K=Gg3Tz&O5I0D;`{$l=8Cc^%
zwGO|>!v45>^sb}dG1K_Bwzwh2NaqBQgu!j8Xu8Vr!CA}Y1oo-OBj84*_BIrALQt@>
zY4Bh(2fckr<o$Jy)4*+))$L*cv(R8Q|H8|LM6V=?Azricjm<=4=^pv(i^YlTLtwJt
z-eli#d5G)k!nNwd9tp#Jz*S!bxrGhsEoz%!GVav*6ra*pm%Ky48$lX<!(ol_eo~+H
zhiW1v{!7X>pUu+E$q?K~DFO<nNnxoG)}>YOgx5}e?*r($cD2XnH(A>YxuFHHs8{Au
zXGY>pjQwe2UWY5_A}Q~JtIO(!MD!&ihxExcYA2vtbE5%z*t9Z=HP_W(i(h?RL1uW?
z8+*Ka_HuJb%CmlO4cUEkoybkdJLJnBe`@zVMw|!rdCv=?rV$0Z)2v29fUYcz1E}l`
z=ZnM<Ab92H!?3jQr}mX<sg3fVR}7E!Q*%Ub^?y471^IIge@=Y{-p-ud-FPlsqen!D
zK5ya%ydy5W7fo#Q%i6XloVdoXS@j#ME%ZMFfi#?%M_C-bZM7{@G<sPC?SZ<*S~jMP
z9owmTkC5%LW0+0**%mA&%dxSs(8bY(vuw_{ZN4CKZNBqj`|Lo`h~lOm_rk#W?)C}g
zxUDkJIq@c&Q`xhjRL=-j=#xDvt$8wumYSKpQuC1E3c2vv>T~m>JRxrLytVLn>X&1x
zvbz-ls{IAg`rRid^=;mWHy6h7&s{P%fd*Bisvr1HD><_*?;|`Sa=~E19xX&RjA+$!
zs_@N)+H(wDYbM=zU&Pk4x%=a<w9b{7hL_#>zV@XP${j$g<Ju;6fC0vQt&`EkIPdBf
z@S|VONDw5e2YY^iJvwQ7K1+qn?8%kK&%x_4DVI>htACRPk#9FioPmE^$8HKsYkz-a
zavOEHlx*2RF%WpQ;8nvfwK?xtZ)W{c#5U_^nk$>?u2yI9c^8m3{ryr`|1>^Dht&Z$
ztb$up05<O;<?)YA&GOJY=}A&izkOS`fjGxs*xGo|e@u8X^RTiZwy5QABVWb~<@cbv
z$eC_Gq{Q=|{-j-8W}oxYKmS$P58{sa!(&$UBw2q&c}ku?##y&-&YDEP;Qrg(5pCxW
zG6PnwGTqLr(CEPplZ%TIK_w^lu5dzYq>Zt-D5J-e+zWJEvTpgyga~-K&=wKZrIggk
z$7dNYqR;d+znWjAf5Gz;3%J0S)(+!#G$7p!W9|Hi$Qj~I>G|PqR{I7g7ryz{<9;8-
z(V1*e2C!}V7fqYHmi=vDk)&eapuqHxxL~Ikc0Y~myd)Q0J4X9|>8cR{qXYNoek6L7
zE_iuq<pw<2-?xi7Rny+PHbJ;+pOggWE$;uZ1{#u_{67HUKpwwG;O@Kc3g@2nX)|2D
zJ{)QvquYL~&BA5h`nsPI+~G~Th7TWiqJN<7$3MC{oc5^`o#iF=0k?I`(DaH;HVp^9
z=e=%}I^T>?JD5SP5nTC$%fm-Lcx2fAO*@B!-gB6r+T}FoaUcEgtcIT|ElxwOW~XGg
z+i|Dx!H;~*uW<OWordJ&W6gjufYT{lHNk1&<%|>d0*MU^<Hb*|{ZTmfm=A{Sc6ejh
zbhFnv8H|C)ANvtE5T|snG2`_=?8NDQ2fo{Xj?Z1VN0|Yt5pWOe`ewM><t=--0Ug8O
zp$8ohFw$*iMzt;M1ASa)aO{Ua6fXPrHye?#4+ZWY_StuTH)e5il)B>XU_Qpy55VAf
z%uye3L+ZQVd${Z8M?bteeEcKFv|TTJ@a_lpl3*jdzxSz6e|p$v^UYd{_BFfH`3Yvc
z+jaLn%^18!_}%aR*FG9|eAk92PJ{BHK6Fbt*o1PY?1^@-E}PL-=~aPQb6s=wm3}Af
z53h=+g}LjP_QO>Myj*Aojq1G_Zlib%%I`hoz_9bKZwcGHVFyQ9_rVV_Bk$Sv(Z^5w
z$^1hOJEA!8zSuqtxJyZf>rF5S-)immt-J1QM&td%=38#<xai=>BM$SA2`a-?SN<Tp
z`(69_UEw?Lw!7<}7ZD$|{?O<p2d9hQZ6AJn>t1gUd%a^nC-Zx|@As$!_iK8^13G)p
zLGKE0+h<?r!zvad_HiHmNO`jUeTN(z_C4TWFE1~r&OPgN|JY%A0$4KR-feY&(HrCR
zyG<86ZM$_i+jK)24nOik*0m@6Zfah50QcIdG}=MAmiE}r{$Lb-R&i3ebEEJ~UM8Z+
z$rjBvcOICDqkF_jSw3A%%HSrzx~tp{R?-r*?9Cd;8ps+Lhz2wwF<xT~=8j-rZ)waG
z!a%rZqC?XF^%(0i-4SAcB&<~InS`-fVt>??4r&ET2Zsre`^ZQm%mc`UhVoU@6%T)a
zFc0(r^70VI6&_*mpa*~9n>T_8D-4pD<0@T#h~o!H6Epm&ftPgA!Ue!Vu=KPq`FX&R
zE4mitG?kxxJW9t8Pvu+D{D9)PVEOcoUcA-HKly3xBQuUMkN>Q?Li_;AJT77`TA~3a
zAY1MGMxZ=FVd>sU<BGX%GY~s3c@iR{?4`F`mv?8B<#aLm*xL&B(`<&OA%Sg#I3bK-
zSergK0{Mbu%GyOQ6+JF`m#$6TK5h(MpG6-Mhf#FPK0P4e)_dIMPWk#@U)XmJoL23n
zh4w=reolNJJ5l+cfB!3_-Gz^6{o78oGWO7~b#E>_$-^mKeL$)mIry;Mop;<Z<9^b1
z@}@Y@iT4<5otLK8`;l|Ti9_on^b?FRlnFoO=hQIw)6(v}?OQx>>9@Y;AHu^R#!1Q*
zS6H$9&{{pW`Va=sJMX-sjz9VN346PGL%ucFvJV2<hq^Sr)pO}R)N8$PuQb2fz*yHV
zxX$mhN?Uqtm*y&~tm;2Y#VFheTBSG2(@k8Xdhe9Z`gU^twf0fDgZA6E>v~^8TeW+-
z`B>g;fL@l_N9&qhMN(aRfX}E!Uv3v%7Q6fU_S+k;&uN2q+o|VfGF18am}TuJy|Z`)
zyE=+?Ri#0n<K%PKP|Shno_o4q9kGp_6uzQzr!YE#Hz3!yYKiiSRKsXK=CAXpS2~Rw
zf8W`M7Clq`lQqzR24b7Vd{6_f37PBlNKKmT8&wUc?MyDRLqIm}P1y(Hm_w$f>|^7l
z{cSMPkIAlVFomBBs#e*|X-|CO6T`({`aFxg?d-vr%22_?s?)-p_9dQ&#knS3T;dca
zA7SMq48C0ANvD|+FTZ&`tc5@6qyY?M<O85Xm^57B6YoveT>J{-I@FJbHO3&2MrLIa
z1LE)#pE4?mTD<ZRr+DII&{Y9bT9)huA`ZG3g5`%_GydWsK89MypKyk(fd!`l|DtKt
zphY<CDWk5Hv63~O(B<c=gEC&ss4lBdKLKP034j5UdqTM{wABZ2Ji{!1pfwgi8yTl|
zG8Rf*I6~5Y(hqg1<ox^|L!Y0xuZ*MQY1gPJdVKJ$C&NrZD1M|)OD|Dx?9MO-8=4z@
zi*otbuFa3(7K0SVBgPM&nqj9#o0m;@+|k&mRl|xtj8#?s<nKgpY|uINImq#}*LvY}
zYA42Ev_pB?)niq!&BD-YW(+1ztMq1cJB@Et@14@P!wjeYyy@ni>YcvU${37X=%s2z
zolRcwJ23`B%VlX|3?`j6*oh22W?BDAfx2%*gFe>{F#luh(EYsIZo5;s>Z%`xbI$p6
z*zh?Uly~v^l~ufyHe4Sw%r#G3j3kVG>50LuGL|MN*_$<xHIOwh(i*@Z%P*`JnK77s
z2V?F%c1JK{avs}8y6Somu9(~6td`n8wfjtWpiG_Bc;W_O|D;Ufg&%0fKeefX!$Vn0
z;52O&WL1WVGT>(iLKu+2R&k`04~F=qFfmoSC3zZn;KLuQHu&O2Jc=U^04^Y&^6MC$
zWFjA@f&mqBBCkE7Lgw->gQP0ce<C)Q!i*7b=}isXMQ5Q66b;)$7Kess+{;<u@KfOk
zs)ZsrD9708Ev9p9)Co-{Ni`@j=7g?oc&3-x&or0Yg26uI<R|dT;b<@tq2p!t^HlB>
zp0I_A52j|&LBaOY+CPxe%}L=}uN{}VGKsydm6LZ*3iob9-$KES+Hg<QJI`FJ59N*Z
zLO-hAwmzgjE)jZk-H71wQ+GWQ>oI%OW@90yr)`<SSL-=ZJK+A@V=-E0*SPC_#guNB
zNdyeT#LM{Ox>#iKHm;m~=BMpv^f%P{KsleZWR(%J2D;L~ukFKYJfi@OMg;YtQIM~c
zAz4$!d60P_LY=%t|5aS|#g7cTjK`v*#oBh;y)m41)~WvB$3R>{t8u{@iffrGd$I=R
zOas*qn$DRZnepgqzz5OzD_ji09JJw^I~@F(n!48y43xsBKQSvKXY=Ioa5n99o5puA
z1_-i6%Kix}?2l}{<q`)V2rY<s06#WO-qM24&$*yOJh<SIP8=YA$_qd7;HLDUN19yH
zc!(2y^OotNL7YR?Ae<sVfCu7YN*IuExS}D(;7cjcBai4xK+&-zr%yU*!Y3XaDTg#b
z`QXa~h$b#^;)NWGTCGtGC&Mr_pxu71kj}J?-b`oJMY~@Wkx=rEAsr|2?rj!d#mnJ7
zXdoITr=~F9P1`9N`xz%A(Ez~*N2}v0KP7B!#U?}Ai{Ha%4TGODVfLB#pxMC}WtuX2
zDRrcQF@4m#5R$6+y_9(9c~woLB0Td`gUXKgb<?i~+?j`70kj)azFpnHJVQBg{W=MI
z!NeHCN4A)6@Uwxg&OLJ=a%Pz|kTp=z07I$PiE=9_9%QIZaT^W2F^(~zo&xdPnj!dX
zGYapy=Uc*+sX@3NHHWeWMp^@n+WklioQ0bc4X`9+-KXy_@REEfdn#Ki)$OY)V`Xb$
zZ9Ul<DPwe{fq`lkJ0rsfE{ycZK&z`8bl?@6ByqwcpMVVo@v?O)Z<Rh_9&nW(SGH60
zmhwmr(uAWp@Sr1rUKy4#SBXl%MNnJ_l1X9wFalH<F$G@*li;GIFfJfvrS!nnqk^g+
z@De{<K;e`J_&S=6Tp8wC12&?n(&t)~apSLry-sSBF5QGyKL;S08nKpqO7nVWM(s1C
zGE{l?nN?ThkZIcPm9nLSw|(yTjl*bH<l4&wPe19$y;kvVE4%E}*xDUewt$Joo^FOj
zOh&N|`(Kmo6|GY&wTZNybV?(|hmLo*2FAh^Z?Jx8Umd?zFOjd}2P?&3sAFu6^3Rou
z;qDsdPeqlqC;tToGO8K|qllqX_2L#|wD%h;>y(B0c@;A^Nq+r|t;m+!l53KUkfmW5
z7JeyoL8lC7Pu4)zK)nX&TNdL(jP;?0P~g<1Rr*%LVW?3)@hXV5dS5!LTm=n2GWW5M
zf1*yj9LO3NDGgNnmUoz<zg5!8UbwuzS2gMj4cC;#+QoC%^;3RP6rtoXQcB9g%+Nrr
zbX)hZ_K8>Kun3wqL+~=YBN*4$J!Dkn&LGk<v0;t{6=}MQGvSz&I*u9CIJQX)w`}TZ
zEj-%b%U%f{em2~s6PBMa_D}8{CXO^fv_y|M8Ir|I{DnhUerUl{vJmDW42T!_lmXm2
zs2YUHkRnP55rz<e5TvQV#349&d6W-)jI*LkK0U;VKX}9wr|TjlG_=Iuyd^F1APqnK
zxiTW<pAWN`LgpH%Sl?C7wIE}{U!4qbHSx$DlOha7OgGY17Is5n+y)bG^Cp`wBFtTE
zADWw()Nt1Zfi6*KC(F$c9VX3mV@7B{>Bs$kMvptL_^DHOpdq@u+(XUf9mxK~fu|3w
zjgbGx0M-X`U6SzPSl)UO>O)<Up7U&R4^>>xQ7Pdtg_Aa=Yw`9ll@CHSQAlI#&L|S&
z2oGgqW8{wg^$ikBEc4n};-_SUi+(a>4J-f+G;8TI`cVU2I8M>0W~_^gKIBHHI4G7B
zM7tSpA+}1__|+0m1S>A5gMp8I?1V~64rUFEjt11e%e|AYeTj{8TPkS{2UCK2TCvtD
z`lRU1y!OyiCgQr9nKJFWevE)$6;=9j$~*f<O#{XC5R-hY+uDNF|CH^W{G)Nx9PqKY
zS`%q1d>bfD^DdZ#aq1UQR&AhVb5t1nBf#RAp@J}JGW>!MkcJ=IX<SH0JPVfi`YJGZ
z;6RJ!1U)sYM*M{@T=6GAX#%AahdewERSSg>NCXLjDgbc^M?oNn3qCl+iy`p<IKmg7
zDm}s&fJLhrf1UV+j)W%<VQAp;q;f$kUm0Oa$S|53hz;5Pszn!KmWvY$r~bA|VS^T(
zpjU8_SO|4U&lf|zGH)}#bkh%>qSc7C=+B1JC?9d;@v9u{gzlonaj`h)pPj>VnxB9h
zOxmJ`I$UH%VcexlIo+pW*ikz8gMlcvu70$!4jA`<s?OCXiA{$QjIK!cAYFG^kzvl5
zcPDZOxujx-pSgjV`b8A_RjmiijbwAemGQ(F`v)1Ua{Qldlzd}s<4UQU;^eTxrZ69K
z=0xVqG;5%r8mJCN8l(yyniV`)q}9bGvap`en!-9rl49QCq+xwz4AHOZpehrzD&*?$
z`w+kw%;{jRjmVHS&=(ERu&eFX<B}HNsI3>wXRgbcrQ>`J3NJ0)EzKDoto<?Mm_t!j
zVH6+TnWxN*ej;D&+mS{z2v5g@85%RpK<ugZC&8*`l0!q+K&%U6YxTtSSX39kxQurN
zb1K+ZL8`PC@|DzD;EhqT7ik`rtF0=~VHF=*$RV4hjIG!o@yq@R4)#yt<kEmhXL!QT
zqcron4b_J(0tWcO2M51+n78CFIb=JPJm8Qo%@4m6sx+NJih!R?5U1u-;nD(Fk^^xP
zQY}To6XpR2I--kl7a$Hk#EX}Cy#PAtE1JZEM`4v;aVwgKLL-L?hzq3oV@&>=H827i
zh{gp3v8GzI)|m^N&IRpPgI9;_7ro9)GJ6i`s(y1dd!AOQqFKe$=FO`qS@>1)nuaY8
zM&ad4@3E7@w$QM9g$D^*cSfV|lz$PIGGG*5zI=t^Yq$)h8YVlDMtMfHWh7-WQB|iL
z(&&9UU?U&ti*CYgXx=D7P5-e*R4+plV<3#8eywcOU03b1Ph!<7Iuf)#>>uZxA8PJc
zNo8w85By`rWy>p0&|nz$7f<%`iA@uI!^b-|;)NdPvcGg(*qkA2z*~1s4Rzh#+O+zE
z)&>z%u`#pKlGu`9jb6=HCbsL*7}YL*k9esuxb9<eJ<`qD7qAAb`7@vJU;U&uSI{@&
zQ;U<X*zQ{@^AT(7f<`2Ssh|Te#<d<To*m?OR7tOV&_NoTD9vl16e$2s_F*#r&WA<%
zRdQxBv2wTus$`Tcy93pLtKHWzHDmqKW%t-e<Lp<J#S4W-!)>kI3{<?4A+9-XWCR+T
zAXd|H6X`q2f-Rkvf#_~~@bh5*WOEJBtQ7AnW((^8Eb)NspBl8lg9e~D`3cKrsyO)T
z19jprnkj$LlATmIiici9gRqDQ5#jKsf_VS2IN{=|Ah;=03pyV8!Gjip6UHTslB5L1
zLkB<B6Y!uZfDVsvtNfKmWl+BCHqZdd1yEv!!Dzr2ERZ&3yS`b-un0&t7j1EFG%K~0
zu?wVO^6El7Wf^GuO>{v25HIm=+oiq@nQI%COxkegoh|mbLG?R0)}Iu%L6kS&_HWrT
zJ`Sa!xb0GmIU+UCt+pG~yht@j8goU>z4+*M)b#3oc+`ZNyQ*URn3(o6P&SR3pSjE)
zjKf@4qfI;;DjtPP4Kn`$$ru|W^53k19yOr0B{H+LF%9EFE!`py^QGHu$^@D$TMve)
zq77I1CAez$wJ77*lxYoXlzeY{+wSGb;A{*YrJ5N<S;`T<CR~Fk66rtQKP+7*Z@o`B
zeqrcUAFENbmyoglxq*s)YWQVeEIU^drU{*)dnqUX%(~%o<}?OK=1#lbjX{PxjK^$j
z7`hJo%+S?sZD^6{pE~f5#@&0bx%YaT8apFsZa;l)Av4IKVLfc3@yiG-yCq@SA4zAx
zBFqC0zyKwDaOB4Yk96#wicjf@KRDIAve}Xb2p7L(AdYn5kXC18B`gGx0bB`27)HV&
zOqx#Y%AhM(LVyn*3aMjW#F^s-CM`Ak5-<L8;g!-uQLXqxC&O$SV57@|)&|9~8~kP~
z*BqtI+yGbyK);PP4d}jIIjNs^ar=NbOkUlJ8yAzkw_VzOtG3?`j@~A#JdN@!z4tCZ
zDZJc<Q~%i9fa+ECCu5ARjaa<c_)e_oKZTl}PUkI2-P)bmYKPl4TT57v;U5IEsJM@i
zX6kX8hpe>46&%9xyTz<G#=hQm4_5ZRy0J9TFgJ6G?JKLH65|vNpqCm$WnN*Xv7yn}
zUO`<j!SpUg^itE!l#MTO!#=ra((g}?>CrIET<E8|Y}{i`RBxQyUbJAUZQd5Nop$6n
zb@MIre!WU!U#~^_Txabxh4}N~G^T;SlBWU2SVUnAe%qdJ@oOToF?cMhY_LMAU6&n)
zZFmBfUYiSI{4|D6>q2EOvY(j5i-?kZ9eAggb0`j@0zd7yxdvJMq%eF6E)x~GI-ox=
zRJ#&JD>ZodFKRH4n8?%17rUXGJwZA8lsX=mL<^H}(MH@5Z)=qJf?;{M*9^f+mvP|J
zz$&4BS5qH~NTc~z>#xz2Zk(i&IkOyA7+ho%Wq?sv1(D4(F6qQ8P2qC*vowH3GWZN;
z-~cHO`NfMg(N-L;Y^J1<7Z(t3{NRaJ8ZVnH=?-z#u29V-lL*5^coKv#I6O*Em4jkb
zFz6^habiwh@Bq?NoRmNKO6!=v<_4H#$Ql@y1~@(CPjNb`T%-(3fXruPHGqMZlftzj
za<HN@2J+UMN5CCfOYB2;ekwtc+07cr8fd72t+w4hJnZ3*@U%xi=D!=_v=h1d8f%os
zQsKXD%dNvB9{DH*`{J(q;0K4-Z?}Edv}P;gmapG7JY>D~W~Cjkj+idS9evC)-p$9j
zvt-E%_AK!iV^u=$JmBDJ)JTLW_j(U|cuQH({Wfpdp(S3s2+#SS=Y|cR`@DA1#}04n
zZMF*!UGHHH<zDN)_YL>E|NTAfS<ik>c)>;+yFZODGn(-PWA6R#cfaso4_Mo;O5!Cb
z55J7znKVCh9(Zo}wVg)&%M67%(H@_LymrgR;IegP4;rw=r2322l&od>;FcclTwP{A
zwND@6`inpew^#!D0K8n(Aq@I8FDc!iTD(l|1B;=NKu743518q+^w5|uKt{9|<_28G
zdN&3yjV~G&pgMAqTWG+B7J!ipdn6$qg-6o<Y4WA^R}0qJUuy;dQVe8hjiFe$SnT?Y
zN(Y|@!>sbAN&$~FtkwvEpGUonJj9cpP6<+~Tub(RxZ)#!NBoOQByWah8qg$~mDNl`
z9#7-sw1^f&a#@h15AnQ9^nd6Uy%xPn8<9q?m^VuEI3Z+rWHk^MqqgB>)5+7IPZ1AH
zEwi5_P1(@s8&BHRV2b6<&lf$*eZd*|EVs?^q#1=*u%AlV4Li$CR&S&l{yUY$dq&-$
z-YJD);Kx48hNKf^n`XH4E!kv<PW?1Cj1n~GLCsNz{2NDj%N}nJr=RoLaMt->2$z2Q
z3ilI!{ze<yqTNc>VX-jae(ka=!l%!^Ae?sA`QfC~&JHhs<*VCLO&sfMs84^!v%-DN
zFm<2%+$X%}eIE#`uC`h&v4wAi6;=ql?eVs7;%R4ucOP~{IPY^`2s`igR^N<}^(jw#
zdTI1(L8|TKHP%=&tpChswT+)5u3RZ2#<#_0#1%Yk{bz)=*1E5Pv%A*Md~Wm?QnuOk
zJNa0L+8k*W%8M!V!=ugFi(dRvOOE~1tGuJWI=eW%q(1HG>$|bB6^%94Tq``|SsS!M
z3lCU(?UpzoJp2)l?E4FYwipiyDYmDz>PD?NmWA-jO*Rd$e$8vWt<awz^WTs44g9NK
z{hF|;#q%@YHS8tJ>Z`3D4ZRkAh2_~~)7R9|t26E<?aBFAJ8U#h53cyuwvi!y2FI)?
z%A5%119JIfa8GI+erBJ*iZ<pyz-7#B@NiOh`7&RJvKF1TpULwqyZ7!ewe;?=%$}v`
zWA~~qBOSbH!?!2)t=hhbvAqg@J;J1!0_<v`@~I+q6}GjUm5Yym`I?TtY;@vZ?zB(M
z2VF53TBb=(51W1{57!l-W9r81&Bh9ii9-`;9y5wB3e5~<`lfx~bMKw5?@)KDoK}?n
z8<0Y*Vzs~Mi`(f!c|gS)U9yY`>C>L1#j=5n*fce;&@CD86eewC?4KqJ^2qRutc~oi
z799b>Q=m{jl@zWDsW@;o+QSH7#FA2Q$%6p$<EH5n5W#c>gn2!W<Pkq`lvn&nBaSdG
z{K-d{H1fcoxJe0X{tQhtfD$vb)_^xeYfx2V5~i@SR~VV$ZZ2BOoiT=|fp+?maA-#u
zNEo9gC+(+iiNUeo5{oCs89TdSr=_?yV!}^MajP)@r)@(3-n<?&RX8c6ZADi!BRXy8
z&xoxw@QLF-5_lf+(DlLxKXQE7VVl>r%F;6Z=9_K`J8rv$<E^^tYT@{kP78nf(;vcb
ze)Y?ic^e_zdFP#ByDeYaD5+^2M&Mum{AXdeH|}V2$Fv(i4>;t#VTU)pIh=aZC!6M*
ztAx8MWkmjyPB^Y>ou%dA<kJL?jXiWBT>b$%xrv_>#QxI7usBsV-%d;|w$st4opoM#
z<%>6>xC;tmohS1Q^N<;GIlWs#F}|LA=II{gC;tpj6V%yfd^)bPEN=6yULWqf<Bo9t
zdFMFpIcJb3574D9d+=mKa1Y9x)2zNLv2MU&6}HGV@Nt#yVdHSQcQJno;CMf^epw99
zX>t$#dOkf6DzX;zD5rVLLl`DM*8pH%jblN-`SvdP3<@^9MToLe2Yl;;pZ_oR4^e|K
z2IWvOM$korKG#^gW-YdKDTa6JAGH5c|55NtaKNP*F1G;}W`xP3=bm(}4k&vhgDY{e
zKVtvn04#B`pJI#DAPk=T*gxgRW(mIN5SIOuI3Cg)@wezQ9USEqfAXaH@S_CTP0brY
z85D-8fD95uT2#8ixX_T`<OPQ?E{qW_&1XSR$JNPU(F0ciUGfnpJ}DjLnUz0C8L|c%
zX&^3)Y)QmqPyt^mS-gIdq!Yl6aD7Y5#<qAWq&z5`Mrn$hEx&Na%~hEO?v9&c3VD5i
zv;~QOz`z#nG{r`3tY5`*<BKs_W+(P&(*O%3P5>@i#Qap95*($2KXH>WvqyD6VkoGw
z-*={K)1FQWkNm`<>2WB^95@qB4L|P%8;8$){u2K=_^D@pCfsM0RZ70Q?Xj1gBz{pD
zZsfWB_S?cu|M*9E@IxNz$^88P*yB$MU;OH~!bgug$*%*D);9c~=Y>z(sp8LE^yToT
zUEgX8kXYfkr<`$id1CgByX<B-7l+f&yCCqB_A0FZ%nbr3Y|lIUOzYRNzwy&V46OgU
z_0}qSSaHRb!rS)QH=K3B=fbIHof}^Bx@gP>@xAXqs_x1HP8t8t^PcZCIMut~f$z4{
z$6pK|KJF9YVUKvk4BA9+y7@^@eu}5j?@v1IOw;EBJd8dLKk`HFR~h$w`@Z4Pk9kZu
z#Eimkd&fIHjX#fg<RhKWg<tw|c<WwoFXL0sDpo)H9dwA**_Xn}r=Ml|*|1DL?d;El
zjb8X7<9|jt`@+wKjbHLoACIPsYi(Yz@y6lgPoEji{p=UQ%U<y+zg~i?CSLr~mxr@H
z^Vx9GC6|T+4>{CNh%#s%`0hjfH0iO&e=>ajlCOq6_kKsoYsHnKPR}!1=U#YG*uo5m
z0<J1J=3~c)&t3f0aLlpC)m>fi><#}XoMLjHbK&R18{fREtwI}jdUXG;gAWN8SUdQr
z@qc)tdrp!ce&h#T-ZRd<AaEKMIPR0Dc$p~6OJDv<kK5QzM%R@sF_3aH{QxWDXHDP7
zpY*Bl*vCEI^DwXO@|Hcq1z)%%T=>N=*OhJOUEkty&`jGVS5Qzc@b^FH-C>ngR&`p{
zKbvj7g`Ltr-|^mgz(M{Z1Dr=$dpP0bQ^Oa&^7U}+2`7fN?W8lB+05GNcH8ghbs;$)
z|M(~P&$uz@zUZYdv(x{d_4=VKix+eMXY5(@$q#@01aB*cS{q&KzH1r9<>8ff5_pTP
zw}EX9j2S0{smB*tyV>M5n+2}(_{7PlF?m{^P0Kvc-^OG*<Gc&KPo>wWJa3~HdOZEN
zpI3a;1ns~VCw`ZoGSr?9Xk^s!(*O%4>f5)<%nv+ldDADx`^U%ZM6Vs^O-}T3s&}cK
z=Do)sPWJLFweT{3?BiI=?8IsEFvcz~)_;5(fi;jMFvb-iWgGxG`Q=ybq%h-ke367X
zA~jKrLwTZ%aVW4u9CliGYMK+n`J`|+wa5HKTUf-LW9uIFKdi%Wz5n^t&Y$$@f)n#u
zu}5gzwLBTB8bBxPMfJ3+BjGo58_{WoOMDHIoOtzslnyQo*8Q-5iUtz_yx;?EK)e;-
zDSs7A#^^}Z{whHcVnjUtlo2?@Ywo}mK7P?6PB{39=YbaS6pDB$PIN>=d2q=iy5@Di
zXe*y+36HRF@Mp*xXsChINGSwg9I-&sLJ5ER2r;|uX~245s^>xa+Y@MXuv{02W9^GY
zI(LZ4Xf!A(wf68+cV-aw1*X+eGzzcahAw@<xi=XYf=3v9hR`(8iJVL+qd%>Thm`H>
zeQmoFbi?O9KkT#TZf4Z|d-&5Iejhg4_{B~D!_r0@za;$d>MNQO<V5DPpYz=CgeU#K
z@XMe5)K8!udGxX2>z95dZ1I{`gs*+|5;J;!!21Cwl;6JJf#H-Bj}LF!ZY%GX|L-YJ
zjrDGd<$hB7(c_=+#PI*jxVppEn};J0J2dQRhFtn|3K&j*^Xp%wQSSfSjeiZFyWlf3
z;&<O`Z#RtYw9Qsl*4@JkUbwLv(m=eg-Hl3F1^iSVV<)i3Ui;X~%jxjeH@`8Q@`>Z!
zkS4s;z5cpCg{ME`nI83+$38AR_@NICv1}nc)viRi{<`ZtO=ZMz{fFQGK78=~hldl7
z`*=xegAJb>4m<e3u=nn}+4Ts|4o`Odl*#VFn0)u$cZD}?zfCy$14o3t-?^U|4<G1h
z4=^1*^3jiRc}d&-ZF`56tt^a3z#|^@=<wEE-V}~G@`$k8o_mFrS6(@+zWQom&$quL
z9D2~Z?DY7S0UERcPL{4|Mt5{|=)nhsJ$KtBJadB$!jqr+G^h2}J@@wOD7Jt77UAvo
zaV(7NPkq|@Zje3VgGYyNe*Mz$`psVxzW%kZhJz11%-aA4%DvvPUpV#T6T>b$z9F`O
zCqLQgRsX!rWa8!8ZaeQ7PBPtZvgu|e3I@_!|9MN;a<fgs$)7x-G*s`u&)dvsvo!4T
z#_hv5zwx!O+UlztzkS2O?|Nt0ZmZXM8+*PPECnxn<*UM_U%ohO{_0nTvra!P9A+;E
zFhp<goDJQ`{H8Z-6ZY8kO<}tob_)0ZuLp$3Kk-RkubgIo|6%V5ds|s(o9jL7Vd3rj
z?jMdl=0jnJ*KZl_x%-~*#$C+VT>*^KJbUl4Ti9vatpca(F`Cl4-|@}^!o^?seAx0e
zukyBy!Ie$+Dyyy<UbofO;nJ^u+0r%%oZ>z7{YUzXo7GoeBfQPp!+Q?gKWxAC7UBN(
z65@F;cwsq`qO%Vkad_C~b(@A8uD>qq`>umrB3}AbuV+C9#b5T#Z-%d4a&frmvloPY
z?Bi#E((u3hRhxuo*wrcf@3U8UhxI26<Ij7+M&6Hhw|24bUVDT$@35`my}Eo+M8461
z5uZm#M^R%cNnwn&v75CY22HL%;NdP=p7L&9PBU^>uUzv_=>gvk7AWs>3;Sa<jcDbG
zs-hoNA1Sdqk12j+T`x#1r{7at%p*+H{^2nH$SFwU1zJw9Kk)m7saGpo9u?ZJM{1q@
z&E%y0D$@RWpR&1ksyGm%NvK(0XrGgI231P!ggfD~P;jeyYp2}RJdMItI*o7?SHms(
z9F86#5pHIGB%WuG_RmiEgNxkCgIj_MQAU^t1gz2+Y=w*;AfAE&<RzXs@Pun#XUNV4
z#sHRR(Ih`%@=GxDmbi`hlNV^lpS0Qdlb&ILYoIjjT2o1<R1euC%W2>mjx{J26+B}O
zZg}*C5sM@1a$03rxvFUjmpG0dthZvM002M$Nkl<Z^Ob2;eI&G-;#Bj@ak#8!)%hID
z1A7*-euYG_=o_d=R%hryC*R=}jlzrlr0~Q<@h;BqVAC+(nMCxQap*nW_4A@1b*Gxn
z6xkCt0;W$-#O5^fr%w7rxbd%l_Mz$GFI{9ON8^3KoWlLdwLkKojaLQa^x{RAd?Q@)
zwadbr?Ih))2k#&L_O~0|D0=(tw})?i<5E9mdfB(X;fAMm*L|?j-6UM~gUiF^-@Pnw
zs`#waKV>ILmK9p8RXC?jFh*jq`n6p_v7;H-ye%a{thv@&;kJMOJBexT<#aGcvXeh?
zf*T7tL44XNC;4f}=D9*x$qcC&Mo<6L$>E>>ygB^pm%j+#yX@Nyv;64ltHM(XLn(LS
ze(yWqE)BxmWqi%mSJvgb=bpQLjJW%5yJye*f-imkv*BO=x;6ae&o_i?et1=QxEa1v
zz<~Q4`w-gs=bYun)EjQNKK%6BYwcd+Xp9E;GiRUar*wYw!>j$|_Jh`0w<PhIv(9vW
z*O<JV>R$VS4+?jg@p2C{5?^OV?K|v>fFE0(KlEV_b7L<Xy^FtaQMm0t{|WzR#`bHB
z<|FMxeJiiDvgzhU;giRGEG)GXL4W_--@=hc9A<{ly8`9E!`i^NzxfRx`@U;BTh)x3
z>sTA$)b0<jydwPI``@!RaC<o0t}b9hUIldjLVFoOJ^k}$)BP`g9=`MKZ<S~leeS~W
ziQ_-!<@~|-zw7q~bARC-b}a|MRR_y#bINI@x9q%Axb9DXbbi-f^TWE+%2!?SgK+JS
zuJQJD#pT~OBmM8(&`G;HaKC-RfBy6D@PAge-~RT0!$ZuN&6PllYy*rTm-eu|y|iF0
zL%EQT{1~9Vc+uy=|JaKb=50<;>DhF%*M`%~82)c-gXsFi6F%;;Vfa1zs3XGHF8!+O
z;|kLcFHkhXTz$nA;U|ThS6+U(zf4%)?%$?-UUz@|lb7$u*IZNgVZtwb{z8-gMsF);
zocgKoI6GOq#+qxEdTi#wK!#x*`doEV1x}ZL-i*bx)&E%A!1(_hJN?g?NLki29{;ia
zxr4nd`0HQ(T+KcjVNIk}cQmA1cvASHhCgh7(?=Cl#Bo|xhS|cM#%OC#X~>m9*T$A;
z{KWtqAJ&5DqeBB2vb1i~I+ngY2yn9e84USBi0pL|PYRp4!0N!qrecp0%?_9z>{(u$
z%LgP#|H!(iIyhp#B$P3;e;noyrJ}u}GM~?EoM&%CBj)7%Qu}txw6%+xiOX9^=jHco
z_Q%>*?dhD%c;}Gr8o9HTtPy@SuA0A^-Y8tn)4wp)Y{14Cpg}Rv(~vaqo7Vx%VcI`i
z@lWMMZe*77>PGh3aT70x{{aDHA>u+Ls-tF<g$aOyz)ADrXZ0-QNjb4sMtYX)3dIH2
zzHH<GUC|_hF!{+#JcZ%6&BP;<c)$~oEYOsUo{;}6Yz?S^*lgg6s51%=XhAg+8fP(-
z3Swn-4U~(dG_mj(IOJrrm_pU)L24_UH2+-teSoOcx0kR|&SA+Z-T4WTDNc#l*Kh4a
z!=eGoqZ)N1wDDnZWzmEzeCUaxm7i0^6U$}K=};xgCvF{P9|pRMX#K%Ntn`vux!39p
zG?jDKEOU}r)qMQH;poaco04w6`5)ds8Gn9q?KSpcv$gyRg%`f)CE?2#f3acKzyJO3
zVVf;p9k$+fdpptlq;S<0mpdND$F(2$!0?Gv&M5QUeb-%Pgjy@C`{0L!D=z<D8IQq^
zJBO)r)jNs5u#?6={qeQoc>Ae3hO^IIc)p!h{8E_@&p(X+Bki<nBfyx5p;hppbsiLM
z`R70D46lE=;fC-aGf>V34}8#r!c8~*-3_P0<IdtnA2!2)Ncrw_pH;$B%piK~(H{(l
z9`OM;sy_NL|7~UZnMlm)-get<WjY4$mCW#(!rCSi!<Vk0P}*<*_c!u}+iv?$&2I)x
z^dXp$w&IFz#N|Zn^Iy2JZHSlqiRo{D^XtXtczL+ZjQ1G%*aY5g@^Q@qWxeH=Tf)8f
z+*51{gWu;&8`|`>uQLPf1H<tro+7qh9~cSOU3cAZr5Rxbw1NNq^{*8y-3LBso$!x}
z?tfvrf93|yb{wwaInb_0;B+@eoW(Y_Vi2z0iF}W>gXh?(>lc{u8oc`%{x`q=^^(tD
z{`}|CkLSj}{?$)glaDJS{`+x{^Iw^)`;dp&>DNWpE`Jn$V$UZ}J>9P+`MkBwuU!14
zK)c7-`n2`eFX`QJ$L(PSyR+HvQY>QEF}-0RWllg>7}9wdPdJ&)l^nbf!SJ6NV*gSY
zRejvCKY#n{U)%`J%Y+$qXD6cte@)7Vk@u#X{^50_^lse;uCq?q(eCPg!;Wt(N&NBm
zzc-`X((uWT9~<6f*N&{X!iwR$mwhXI>cmepH2Rkr=giY=yml?mnN$msvGs+xWZ*Ab
z(Hdx7Y$yhX$37zlN~9W&BbD*9d8)M>`&Kn}HVQqYd3l-ldZ01PtoC8H2<YF`Z*tp=
zzy`(sb3)YOi#jp$s-X&hm_l~WtG4dou4LOISle1;W)bGQ3=K43^^VT8r(wQj4(IBP
zSm&Lr_8ZVIqH6Wh9A|!~FfcS49Ozfg`WE<|w%cZWhN#_G90m=9Us`a+{+JFVDmeB>
z`Poo2S%6DC`N_irC=Ney6gG9qCxDLf6PNNQpOg-s!cw-vxPbV_ko`r_6d)$%AQL9D
zgcCu+FyT=;`3P&4ln}y^Lck{u+R(wcE4t?Ou<}YC;VPbd$PQ2CB~9t(jsD7fOnioU
zqyZWRKqC++PGK#|TE10vA}OVkLg|@3wM3g+PdlqO7D%n6Y(j@gaE6Ynw933Kxm0rw
zCtS)m9CmGSK_(X9W)R>M$%HTXqW;>bt+rS+L^7V7K7qIYtO{fF;>edlyWV)wvgT*7
zsOA{a7GZKr(heo8qKnK7P2`APG*BDAP2tv7zig+3H+}6EcAxE|+yFKk?F-I3JACp}
zXWE^+F9_fN?q%WDTmBjT^v6Ghy>@?dlFiKJR(CJ4Q<NAJQ{X54)oNuN<P_zpC!H9c
z^0cP~KE8&5nCl<}7(n^x6^22KPy&9^zt4W}3OjGVt)kp;iE)<`#~3sLP8ee(2DnmY
zg%$MP+}@zC82z{X=eDrY%JuTDYVtM$PM`h!r$6zZ&ST8O=y$6bv!DC?jl%DK`<pr$
z8|7~|?q9du>eKF?yY5_P^lmqQBRo!a@{@ml=8u7Qt8KRP>j9>1b4=aDanoL6S-oh}
z|F2tbal`-WYpiLfful}20ldm;tA_vl>)+w}KmEz+#TQ>SuH02j8%Vo0ZJ-LbnIRiJ
zdSQ#i)vW$JY;BY)DEM&T)ppt#xa1p`xm*3Sp`E6F)^j%WYeMd^vTeQX8~kox`14?-
zPGwo|;SUeLwv)d*?YxVha^A!Aj1rFc&@r|Vjz5p()beR3pH$a2(Z{7<xg?x%>M2zb
zj8TmPc)ZBqbT&X4IYG{8<Gt<5iM@B<HT=V_Zo#;`>s$9MX;n}4axXP6AsW>kcT5Y?
ze6(>4*Ywd|fp&Pp$3N=7AV_J^cR3x;3kB}m=8B3J+7%gJGu@00(CBMbHa23<y`Ytm
zyb?sdGOErKjfvK+Eghqrwz{!I80s9-JcU0Sj-qOY`PWr%mBne$_@dCv1B`JzRHB&(
zeCEJg8j^=8VfVavX~^kkH-K<wt&xf^`@5$(Uvkpd;vC2U7h5-(uDE7p$`0G~RL>|m
z!$Q{pgFFwdf$qm75C;?UB!DfFG+fft$$~i1fd(Kt*fr%BU2p-ydc<Gx&?HW{;)@GF
zQ!QBhp`|i_Q)fU`n2Znw8IZvEA(%48vMm9XM}p!i4Ls2yj-3&%gccs*zVc^4$S{vJ
z;Hxv5PXylxD$ZQrBw}D=0&NL#Vx`G6ds>p1V+1Bc{p?e2wF?Mmwnge}I7%z&H|S(#
z+8pbn5qtC@`Q*-~i$*jC5$A0VUD`7}#r<&iSi4<nYgaRJ_;5K0u8}4^h=tRXZE_HS
zdxSA!acAiy*GF)5MAtvD)9@bMT5la(c{-+SLixSnoa*U7*R&fJpS6ct99{4>W}{mi
z=|)%1*(CEWVw)fgTd&&WHTDzuZ(1Ljy;WgMJ^HBkg+2D(*Y7(0i5YGm_V7ozF&SRm
zfBNxHp6W)xYwfxLjKVU$KKZFnH#|G#YmCz_z@57XzUMIGJso~*Ka<B0%vY;Z;0l31
z+jR-M?7l~NLKWlJ_B*}Fj89)qQT?auoa}w&CYzQgTllaS25jK(|M$1>WHZVEtK0p-
zPkJ)<8V55Z|I<!^-V*-j`7iJ={g#hzH3P1A*k=13TxM{7X1dsJ$DP6tuez#X7L3zw
z<ZPJQIFg^}|MB;~^LuDDwjO-w;dYYs@r^UI5zC40Kii3EjKR?4?qhGy_9yLiS_9zT
zYI@-g=a;<f<#ADKac?l)uf6tz+%Uf0!yjgb&qw(<$DPc46b{2LhW!^?9!@@U$_QiV
z!yoa;@&q#T20Ss=-)ct3=f2>D-aZzaF*ChG_<?rS#qWOmTQ42=S1+-<tdV`%HmCRA
zdygBmp#$EZufIN?WVUqfKQ_m4@jTb=y<Kaq`#OK_0p>c4pP6Bw6Uw~UK%Uj?j^#(0
z5tn?N06wTe+r07zmz#0+x#e{X+=G3<A&0trZX}@}*~3*CFM7$#%2V5X5bo)A7w`S=
z|6g{6#O-bjCX?D@BoO??!kTu<9(ah|Pwg*juD#Zc^3}Ri9$fD5)&1C<0H@Dz1xGvJ
z?X!Wgp1fE7;QM|DH+lzNyX97Xhcx~Dq|?uGp4a{HkKvcrPq|WrQ|hnS<khA_wj!er
zv98j38+D0?CSTExqi&3A8ul$FzkcE)zTCUZeWLNBUGDnYOIJA9sX}{^w{+><;a)z{
zW<NLQ1HjW3$KE1+uqpau?C8@z%UWmj@sCcKK0{N)I5Tn$Mm=`%H?Hkjo6%3~US>|#
zs&1?<{Pd`qCC1T^N}24;tGC-}`xtdkhR$(rB8lv=&zUN0zMfoU<F`fd0-Sjk9ZgJ3
zC#@*S*tVCxoUZl9VUDO44w*5<>1n47Xjb@Dm$XJOTb_1!HljHaaR^W0Fevq6|D-U`
zVo1_MxUcrlf;Kdzba)ZgP>5Rs*60){B!v|+X%t#<gryL0z{iCSE{td~<N;WPkyl~i
zk_M1Q9^4fRzi6od<b@`A0pj%#CSH6}{@!v~2V|JP8qj7_)yyWasd0c-mLY3kOf<kt
zjOk_e(=dK!JZZz(pxdwY9Sju=qLYj4=XJJd=4Zj)w`^g>2TL-vp#jyC2BkK#WR%V|
zfFbloGs5z*t#;sl%`o_VI~BOgTlNee`OpW#5r-ZejyUSWc6GsRe){&a=bsbqw0lUu
z^X+f=N4ZWt`vNyg{q-+5xbe^zK5Xg>;GWlwUi9Mdu}_}t_djwM?#(ydq~y{){E&m~
z6y+Y_lrzru`&cn(au4ih&!72GxucJKe|X3K2ZWcsauYvU`|Dr*B3y9p*-q<%bI%Ef
zec*$EJ8}KK*x$q}44Cge^#1pSci1V%*KM(t<Nna@-hKM|&nRU`J=a`)wSAmzU%M|j
z8h|l=ZfhSS`;i%n8^KrX8Vn5DeAMrwM<3M)rC}T&qTBa?gTrPf6Cao3o@eTyTi}jg
zJ_7flV~_JW{!TMYwgc#9-*+7tUh(Qp-QfBotGCPSWGHad`wk0-9DanK$mXR1_sw!=
zFsDZ!Yo}jNJneKpxqahb|Ke9oU}TWt(!00)Ip!#<v;7VTTWtM$r-@#lX1d1+dBJ(-
zgpYmVBtMCLvt5J0eYcF|Qxj9+OBa1UeB9E$WOpBb|9jsF?>qA7aLmU~uodlcZzqhu
z{uov6=H2&zgWOn+@%UpOIoj`wh6W#_d&$dR;hW!^Z;tJ+S=*$2KHQASC!Kbt-=)pZ
zXixaqM_ump&v|x-^B#Ne6HYtlGk#SBedMSk4)Z&YxxV7~lTY=2Lzz;z+OF9^PENU}
za<-~Fu4Fm#n2*|r1J`iF4fWD=9hWjR|K;ENu6+>l2sfg0ayf-_?CxjU`swFh;HRB=
zQSkx$$R1a<Tx_~K_Jk9|-PRvD>HR7D=-)%vdsx_c*WJB;-g?U|DXHuqMGefDV`GHx
z1CY1a4-i}X6+m3asC^kq1BlyCOp-uDlm@wS)Cg<9+k%-aig6W58DF_lA|ALHzgqTR
z$Jk4aI9J3rJHj<ESkb6UjKSv8w{;gcbz57tH4&jDLX&(sdckO*7#(DL^zDEZ9vdh&
zOI+DXab=4no~*PmT<nqn>BObDoF);TT+xIMaq!hZh06nf=<$$Fo|G4P0mUgF^pxfZ
zM5I7ij|3(x0>Y(G%1as`MM)^qi31Qg1>#BPH;?3(5!j8ml`v_dMLKyg0P~0^@rpCA
z(<9$m8@+g|m45Qm?l&P28z)$Gh4wZ{<4`6o*n9#vfy;0reEBmi#i=zaEZ16)7I%so
zxNAH)X_<om{61ZQGKtxfA#0$K259rX$XT?4yXp&#aQhYKJk21?hl$|FrV3-pQZowk
z;S+}JiOFUitrIDR-Xq%+uIP>~T@QWJH=zAcQ+rZ(jTJXT&9krfxXnHB`d?qz9BB?x
z9{czwh8^FyOW1Fp+E3QI5reA%Fa&$MPU;K8-x9l9_0GHQw3jkVtpCNABy7G?;6!fx
zx_jN)Dn%*%e&?#)Ron{rz#J#j=yxe_LS?0uSE{?WHBIMd_;=oUS7Q7~Q@i(b?=9mH
z2F*@^Q<q$W&}jbdlot5ul^UJoM-FWgtNB*8Hjv(htMu3gmV~?7sIz9eU%~D_26z!r
z1x}$OlYYU}s%(wg5B0)H<~#4aqe|Y4*NxjIZFohKE4{;dMrMnk{5(}W%8E`TH+i>t
z!w%j?&N}_Hc(-r^owY1qlX_?*TQ!dQt;#7J^gy?5)PAW0K1wH`kJXHaiXBt8GFFXj
zDT+1mI*)#pi+JPjzhG`0XH^&JvKb@~+fO!p$SxB77gbJSwExu4AWdYg7Ptx8P@=6J
zP1vt;<_7w_PPG2*zj{jwqkWmJbS*Yn1SB}4>_tP9>=Eei<I?B*sZi@H99~&ubK#Vo
z2IiMqehpr`JZRq|rMG&!L2Q$)+9mz7RUd7X-VWV%6*+(Lp7f+AgfD&ZLN*FJ*uy}<
z!-AMiv5c@R@=z#YHUxSI3!ijt7KjIQYXW}K6fa!S!Byi>8ZJQPk}s`f(!j^nV_paB
zrqEOV8HQRCAco)~N(M3tL^O?01q7Ec`Naq!G0>7nm*9~G9|?;qn!>jz#~}}Nc|=!v
zEvimI7>0#QT81&zKy`rjhF4uAsfCSc8MD|~1FbZ`rkkIKEnjY5j+c?PRi+-({fpK%
z)M9L4orLQKVx!Cb#<iinM@FNVU1N%7z)_Sj%M><y?Uvyymo)yETqo*@#^9MbWISY(
zQJsrY?DTHnG`^9)9m68|_y|`cz&O&#a4Fn7?wDy5R9Y`ChUuztx?OtBjCAehuj1)`
z<!XGZ@N9B4)2Z4(E83(t(|sdDu;`_RNa9+Rtx@}7erRM2hF-I_iE(~5eUKMuR{myX
zjk!Wo1A5Ey`HLA*>CBz2Jk9g~hiV<j0NEM$jNOX{e9BGM_KY<O>P6Cwdhz>vwDpYK
zHFftQOU^sbHDC>kgG9{fn%DhQsTEsoZrn6LyJyWlX-3h71T4|1!}yCvGX|RuFa~q=
z9WdTY_*D9KN47MNtDucP-Q;P5?0iFsRUmt1Y+$jB#GyplFTwOKS-5PN0n+K9<i#%<
z;6ekVFfRDeBOV;tJ&6+^@`DTD5(Zzm<}K+%101E}ia+#9sE!^Ig3Mx!UxF)MMC8Ii
z4Dkzuk1IeBga*jZBY{N&xs(T7(#3;#9u=JYq{)T8Xqq>}C~829JR8l6inA(ATaF1`
z;uHn&<Tht)P4uHyc9)CRSwdZ)jLn{`0oMT5Sb#gw_$Y#P60VR?zwxww|0#H~sN(b}
zMrck=Em~x<SlX01ZXEJaS5rebLe$Qt#!;Xf8iUK@()oB(+c<Q>O?}<RvC7!i37x^?
zY781_A!n%J>@!adH~!@>)+B2m5u1V3MubXVoqxz`=kx7k6sLo2$)Ud32F;9;HL%b$
z@a2npe>t<zbT;tv&bD6eW;_$U8F`sISfA9^?OKDI?X5Jl#TmwCR$I?FuHV_uI9osW
z)V+KvlIk%$xBcm5{ox|a$)A~JnJGp&FU?FE!<g<%(|yinYC`+*K4A`7&`#ljyJ%vu
z8H+959(N4S?;vhQYGmS(mpg@7uiN=KgrCtzM@HDb2vXLW?@uPeGBXBq1(JR>Jfq!M
zgvO-42vA2v<|;+f#&{ZmOWr79mbh;6%t9_F&CtM%_L5*EH3^#RkFqtAOgwJfq}L`U
z;$_1$ucs5Ihd3F4p$iS!N15D|SG>pv9xi|@{^G4Tr3;rZIF0g?Hsge_N7^4{A`CMK
z0Qdnhq#&Hg1)oQZ@nh5_oW?7Tf{KRHRVYg;`3nc7@PH#3aIvVbRK!6?3dN6HlE=Im
zMo9xR24<_xnFe4YM@j15Wr+<kH_P5NxiBcyw-h_s;BUV5M!Y_?Um6ir`Xi^$2=jA!
zJbq%h7}`0JFweSYy$V%0DWpENjgT^mP#an10A)O+oT-=_uD{MB+4r#j83gE>2sT&J
z(;)a{npp$mu7Q8udh56sA<N%F13t|12P-d*4ZLya<!>#{6G`#^4A61(EZ6vUhc?h`
z+-?>h=`N7Jtqgi&q@>ZCJ876m6;BKMH##iD!H0OGFzva9Gx9ACQLR1jBE^nu#245j
zFLd_;vKsTf2-lccKUubnEA99IH}y7~;b)L7u}VA2GP9K6RdHux)yH&-U!OaN`k;YW
z1*%kB8FKN*$uF|OpV}fx=fVC-9v;OhA7KG;s&L|Ez)jzN5)U0{f?v%qd#P-#hEm#4
zt8_?nfLIkoICT*SB4Q#zBq%f}0O<n4&;W-AKl$(r4_5`33!Wb0D69%CdBvY}<->&@
zkK}?*hB?xJFBMzVfF~D&xCZlP;?6K4H$xm!{HVz@q+*wB()wzqi*|5Ig4xqj1N>~#
zzbeeIX!n}>0N85d(2{Bsgo3VrxWa~i>X@I_O_*_bvAI+BEL&!B(24nyvwND*Y7t!>
zCN!wG$Tp<pcv=Kz&D!~Ff+$Zr<Kb*{2A?LaS8HSNoJWa6EIoI3$17T>KWS!^<jk^U
z4P*^u4a}wibe&aOTwTznfriFi)4034yE_DTcb5Rc-QAtw?iw5#cefBcxI=&-!~4z5
z!5qw0KVh%6s_Lm-_d`5+o>1VrL_#HQ$~uLsBs-FFwg5LAx#2T2coUFRAFfXR^+ljh
zJrM~UX)9hW9_NT;Hxpar`LS|z;^``}T`H1Z+WdNPjYoq5qhf%PiauOvzyIe{&V$Q&
z1Yq7DjdTZPn;JJf1)F_k(5DJ+nN1R+&0UJY52FR#&WcBl7(bG_7>s;V?AWN#jF2p<
zeL^obpp-EZQlremDv)SByx=m@8^&c=(6?UpUde`el>VWndTsU{3kQJUZ=VEVa=S}M
z{PZ-S-n-;9FC-EqEo9AVEE>VH&O3eP4o5HSK7ftlZw;{rk1TTIXdS0|Q;#=6NuGc}
z3S^r~MuhB#l!2v4J?{T>h27O6ns26oy@s5RV0xkvp-z$<`aw`w>N`iS4EiJUJbTT#
z6VkX0OriZCP_wd*$r?!Y>s9K=v!-WCU3#-Rx<7pce|5{v>U33LNAAF3MNn?^ZY=1)
z7S6B@|1IxZI})4mhULJEsPOOPl}s;^u_*<sC18)Yl|Xo89<kljm`3K>U<dSJc>GA}
zWIqgMSdIId9%27u5jF`ZDn=Re+q|wmLG&75Bim5JUo!eFcZr*DVX8td_i*BWFaVjA
zkY9A)-VKbLnjO&$@8Qbze{6P<%|LQ?N5MN>V6BGhq2weff3Z()rOHsus7=IQI6glu
zJbe*7{GIrkNIq$s9p==EL}}ZHxIc(h-Bfp4mTF%j(BdxQ*Dr5<LEPiR>OiQX*PiB?
zl0+90s#>tC<){C>F_NoLhBU5IK2KpIJ9cpZYqmbB!6|$Ar8%<8(`n5i<2Nn7#|A(d
zq2$IL>es<ZsQ(CI8!);|0&JSHWGrH)x^J9(K&p6>&Eql-TZc5UQ-X}bPi11CTN0IV
zT_j3yVq3D8Am6q1m1<qTNV)rXthEA;t(%U4R0L}Wci=1Bf(gkF7Bb-ux();xq1O`n
znQj!eM~oc=xG(+#fUzOz!>=NHg`)uCrx3kE<y`AbZt*@&V|jUU9ri7>D%coR^IhA$
z+EM)7#5gFMA$$|rKN2lvhznw%RfElx+gvOYhOC9Z={cmDRe3u@S|LnPjBV-7YaC^{
zSotmB+daw{!0*ic%O=;wb!t&Owik)2fb98T_2{cWHVc<xzK|ayV3b>{B~hC~P2%mN
z8b{ns!C$$dv&A2U?)fK{|6RViARgJJvgqvDI~UW%z}7%znxn5QzP<50ZHlJvKtPGP
zX`H$)sB+l+UL9)~2yLKH$xd++7oN5naKaICJ{2hz$BudAJ%zS0kZU`KqBopDdea|*
zn{fq;)~A02t$<RDI5tI!j8ra*N@NhUnK~seo@M`gz?#znA659vIaOh>3>!qt@2}OF
z%g#AamMvwV%m`2^JR6B|Gc*lZo1Dm_+Uw5PWmGLD2{S5*8MBGsS0+N^v6wurICXz(
z`cHT)8Ol3tpfX=aNlg151D)71i2}p08mW328O7kBwDkhZ)&w)8OA(|Dp8no=2vX=c
ztP|0^7N5y(PWx9V|LcK$op~Y%VG-U$TJZwT9fXwvQ?z`Oa|=j1fLy^dY79YKUD~{x
zc2g{<!1I0qWu_v{j^LokfDP%kh_}vNyL))MSVuVaCWIdHZC&`uG{$^;fq4+kp_@7#
zoWOT&60>o=8AIR#$2?PVFIExYtyt3W?5TnO3#B!0X_h7-rt$0Hde-}ilLRfRq^hMZ
z0d?@R^*-6ZMEy^Gz<*(4TbPUM4uffDEmdZINt>~BC~MdzjaP$It6)#c8Dc<K;+BQ6
zZ(sggh|)6~<X?;Vy$G|NwUQ_scY$-Mt}Z9#gjbSNgOa0~NJ`|gs=F9dsu)Z+i`0Ld
zgo7TJcmwUD;86D5$vi$x(X?LwSf=Q&H`~CB_pK1xamRDNJ8k9)sV!x|cfaK6AvmLT
zk+XAuQXnk7yKU6KfSmH<slE5hsrexGn4w(x(27@rAc$ZMsl21ft!iL=4e`C_5e-!k
zX{aL3YhC>24vqPHg|{G~5X5UMB&_ny9(6W?IBWo|+2{8n6GMQ9f(S;V-gSn=n_w0N
zON6-$?<F`p7iHY4YRh2|Htk7k5*_b}0p644TNo$yK{wQl;=~+*O`P-A=%<eDF>x{t
zsL38OgU_Cs)WufFv5`Q$18uCEw%jxF<CG9C#Kqa?%JjUVdr1&=7%Rfi_lZlac%x^@
zre~DY#!1K$)wZz0CUjejucB418#g5nr21g)sxovsF&s)e5<BAq4i&sqxz1=+i4Zy7
zF1Uf~7!LnS<YD?uQ*#A?G&BcY<AVvX>B&>M%_n~5y}#Ar7NeFO$1LiXqpF6Tna-F$
z;;*`emuap0jasBLyHhY*-A_9^eg7=nRlf@i%)8w#bw`Fcsf%6LOJ?qDB%rrH416ke
z$i-3{bKjpX#m=wKv%ae$tRD*}Hjy1{y=v~dqyPXWkBvZ690qD2CiT;CM7(t*RmTCj
zA!Cj}iP_(;eD@wd*19PjoYPSGcHq_C=k}8X;sGI8sb939qP?<Nu@hf+5@EGsB_@AN
zaLiLG$%$FtU?A($s<)IzwxF>geWon@8)_kOR8R$@6gm3fatG0v-jFK$S(u!a_uIvl
zfY<j8ol5pc-vx-CaPEW2i<0Yw6AP0YQzTu>s#ch#LJ`5VurI>J`}=zCzbRu_(Ki`d
z-7E3K9*%msd0QAF!g&5lH4=Ar@_&i6z5L2VFKe-NbH?>Ts!eP&tmdKHCWOFZtY*me
z`zgz5@CEs=%cgMq&xUmf9!O%pXQ%(xvR4A_3ibb`@AK@#xIvxmiOH5yJ6d$Crbq~x
zm!guS(MYDR=bg%6jnY_A=Qm>>^DSFAQMZo|$o4*?7+zTXYNx5y`WHxFK{jZ=Rb`i;
z8&ZpAgB9wGx{UArSEMjW!C?d}#GhlSCbpxv&bMOTI*KZ&?MKdgX7~G}3%=OEhxTIk
zDPz;$ctZ)1`Bskyww)Ny+(!TR_&2o<vfzX<))|~flRIwuoIgY*UU$)48xt%!Ksn^f
zMYDhs)&&TQ*<oeA8>rp=<e6b)p}K4MaxVsu46gdZp_ahwrw`#?VMaKkwzL+9n)mpb
z3MX6$Ls6)NRH(XuBVA3Z>3k`AM)yt<72jNX!;wcIO7sv61%v+$`0#Je0Zd^Gan}!8
zVUzsSav1jeD#!u|e!ZT@3AR78p9%U{1h9o~3Hxoj%_6+ko#G-;s=Pv<cwnt?ar||Q
zNW06v5^RTenQA*S3&QILTDRM)co(sn0Czv9a04-ky#JMIv01>iz*L|bf0%S;buykZ
zM8WrIy}i^;bY(8{BT4aVULP4uj{!b@9e@s?$EJT3-re=;U*qgwDHrF?P9?{M_`j&v
zzGFL~+!MV*^jz$mW)0M91@kL!BG@TWvuQwU_ch{uy(sIS2PKZSA;XrkcmmhUDi-Z6
zG_dFS`m9MC!eNNW5PVI=IEb+2)$X^^!d?tCpU5uJl>Zmm#ij)xSpiLjs6YzGL?Rp;
zMP4(Q-OdzyJ&5}|m5XCck5MAJI5>pbzauoyzs)3@N;eRviB^}h&QpmQY`f?L=mN>)
z@UrRtchVw2J6ItXVna)=KjYzwuMdos5y*)UxkeEDPbcyQLs=2_nOeVxmH!f(X8Fbc
zb+k|wPh*c~Jk@+bJL@ORtlfH^A>WXPyfeh}+_zQ~V80~|#XPsvjy00wr|BQGa&-vZ
zWodqdTE`T{=R;H22#o$m<xt4@(%NYQ+pa%ZzVEd&AFstfuZK~4M2m?xloI%z{?3SZ
zD>dIXJSbw9;A-nU4*O1{wHvPpLP#J7_k9X?`cJIX%UP|I?w>j?<$~F&G;PwM*#~Oe
zM(iu>qlW4Bd7|nwW=(-Lx4p`D8h+}~H(gpiqwjA?muJw1ELtx<^{1z#0q4J|I(q`M
z4}{FEi$Yi-N@7>PH7ez_B#bgX*qv6yWc^*eFE)q|Qlle_msZpaCHgSt^IcenSH~7u
zV~1ZPX%s${gVjh|7#NTm?-?jTKY~0E6MwEciC#4p&xCz}@b-q=M@V4tnhWW>p2mkP
zQYUH7+>b`{XT=5#qQSuSA$=NA@GMk8Fx~tJngq}g=|Xh;s123{&dVMuzm@REjz3Ym
z{26|bW!Y7*nAJX{Joz7f42utFu3t9b=zvMSU(!!!xSfgqZyKwkF_tBHWRXKu+}NZ-
zc%{uzk2ivlw(fe#Yh4U26xkYQQEp=xusiPdb}*g5KHRF{s_LQ0$98~%+UmdZs1mr~
zZ@^zWsR>11R{HX>RH$?Ra5%macInt5DMviXKDs|f(0o-)#$M@fUD&1SXibuj8ds+A
zCHvkzA>PJ?W5>+$1`WatUW<J=<>Rd)R%lVgK3`Mviha{@oRmt+Sa`=2GIl`zB0KU4
zvQr!Op=Gqh_(AN?oR_Ugn>>h+OFFg}!vBl5{J-MzrFR-4&>&d3*mAz;6UdG#5DCB)
zR!-|X?l)TfnuyzNNdhW~iP#sTfQcm6mQx89l{i5o&4(4S#tv`Dq{(MN)e_zjgWY~A
zs_w>$WIhzt>UbK!4lp1VC0Zy<x@|NzAlQWg=svxeTa;QhiSg3N?!=hDOnDq~>qAh;
zIC#A&y5V~biP*@epORVQ1zQm50L14Y`~<dd@ax?gh~uB}<}~|`)r4^Dh0t*SOS8;|
zroi^nHsi~ES(7Mkx15<TE1gg&BcpR2vd5YT^~Cg{DW^l3TeSo>LYF`97h7U9Te!f?
zxex`MKfY0XY}n+La2Br0^3MZO{U8J}=Y#Tl{P2Y?YDxfcNdLVrfH{#Z)8Y9tJhubq
zzH;&5n}jS~T|%Z4A}#Z(cs)x0608r~1Pv54o4wqpo)SO(dO5cqoRQHr%i(M=w@KI7
z5w6HzdT!Ait@-BD`nY6UW~~`XF7C?G_M~5`{Z1Mhly9C<@wE9F?5g3+$aH4_p(mNt
zJ{2a8QBt^-wPEQuJEW}dlFnUUQV{JrXg0SdmlU90#C=VaDc44;GuAo1{H+?k?67wI
z>`g(im9h@q8<pQcSKEq=Qd8*rO5G-7pXSa0DkZw(8y=}HD#VGnNcI)jIVMHgnRurI
zunO$J)+rH8;#6G<;0Np`7WjrrE_M@Xp=fG^u)tB!nWe#*Km=pt@?<6|hsoTPpM>wV
z3;>AVX&`-X$cVs|Bs)-hw8A`rpKPNMa|oY)2@8gV#=B=H-5poRsKy_f){JDftapp;
zDmbin&5y2?KFbh5-2hSZya3mE3}O}7WoiyMHxFoWMQ^pW@XsbAV~u21*5s(!oaD4M
zusGESd^_7HkN*p<qMK|DIqv<a^WS4%M4FZ!b<IN{b(r4AjT`&rZ?o3O++uRG*5MYn
zRu8T(uLsL*pa*Lv{|E~js)fV3`to$~|GuN3bzuHjZW`3cfDfkD1vsb96AnDvvfrio
z)=Au>-l7(DG-Jf{=Z{ioR<7do+Z@Np4yS`Z<Ym*d<$y@S%VMvR!;qdm?sQwWq?=WX
z?_+WJXsOiMB%jF{?@0$k&<eyBj3c#9DgC$UW4UlupUQ!Df%MHu_RqD3liE_Mms8O@
zeK&MrIh)n#8$~R3U~@zfk*$i6bnDakBnU4WXdW}HVK)3O1DirGDpP)gf%-Y9pxtK@
zE(k-p*$I~Ba|wK<WqutF$ytaHwsDo+Csn$i)+>tvx}a!;I7dT362*}rq^J(=Mu+2-
z%LNfVOK3r1P(u{BFN7+Cc+^mA0&fR0V9^xy_l74=Y=1zzh>EBhV;v%zD;i?;UMKVr
z)s)?N`kvdd;u^z&jFF5@Ea>U<te2JGtVJ%`;e<qfl5WswDIr8y+>|(P?by*=l|!pI
z8Z@oo^^BL`I&RRoi^rLCGfWaBY<~1UbDNZEtfExcbmj~HN~QiY{y$CofBe2oMF8Hy
zyWd^CmH4<#6cE_ccZk-ze!R!Tzq?87<Uz?5$!S7Nkym7%vM33@o`i%8I6MzGF}i#9
znN~vNw@Z_CBtAGvgx<S8gI5}zrjd(i0R}tXlHxL7;I4}s``B(M!H%MOjA;I7Bl|{@
z%rigWhL?Mub*sV=n3seSC+{{-4yaXnJ?*FGlHCiX-Yk_&d(>FxOKX=aU_s?b{r{4Q
zz=hF>qHMIW#8MD07>PXB8Z6+L^w0mbQYE!N*+k+5Hgs^^!>G6_Jcp1%<q=@i?l3^u
z4Mf-!KES#3(f5ULJgb)Mm<BknH!pQMTz%S%u4E8Sfaif+0+g*wh-@#_y=v?tT7s7b
z8U(@|yXq}5HYIGj=z5`3)8f<{*Gpc+eJrWrANYkvkNLfAM%PiC(=UP=d9Fv+N6QO!
z)vSb0qX_Kz_$Jq#&c9#va=yNGU4?R9erR(e-7OCN&lC3F@z(*o%|V14D*?@rEPKc2
z@_`GShTnNNhN_HQ8_-VvcES5>jF4jzoONRG|1I>;R>bJJ&X~&W)zHyb?{%hMky)wp
zL)MxUf)!dxl;MhgVO%od+n+JML^;w5Ki7I<f>#?2Yxsw7aBhx_WCQ>U#fHoLS(yfc
zI?Q8IdoToE*OUiH8H7#F3%2^G|5bTUiYB@v$Fosj;t)O|!gk$?BjzWEu_RbW;Xchl
zw4+o3P1s5zF~mYip-G@^=vZ9flnjXu0mS<?$H~g5E_<j%H^V1gaPY{CH{4FL@&YnL
zr~!4cGS6pn1~G<sDmgVT`rFod$L#Ys2S>qHq-vGYDM8^`pF@59PhqQV+H&$~E|(FB
zb>a5zS@cVof$~T~kauta#6MH!e3c_{H+jY|@yU6b^95v$)@h!{zJeI_gw!;HgYc@_
zu~@|y#emKq2LzHQ5h8h5N*&{w_9Hf?4=G}KE3`0#@TfU*<3h$kvD1k>$Q>kEug08n
zC9ta=C(zX1^pZ7oo@g((hi$J^J8=oZc%-RSIOA-2y%ST$cyf<(TW=@dRta=Jh1)cX
z8S<K-u19;nns!G^KkoM{w<u1k`>b=7v7$t=>PwcDXWP}ieQb;x6&ljBq(}^L)$VQE
zk~=af1NQBe*0>pXWD4nSDyW_;m(lx3R=i^8R38$C9E?1~e8sSFc=FPqA6LU*`RSty
zmPcubf8>O@|1pC`z{(0k2^U!UA{?Rh^$j7gC@t36CDl>MR79V<Ro7wkKA-)73ZKiE
zE{Y7>7=kKXsAw=rT_h<1Ob`jv%?=tf!5*Y@D6^1;Pbe!yj3)a#-wh%myfV??T>qi$
zVerZiRRRdbx<&vNzx~dS_f9AWOZ{Np)MADJNuWot6v#G9vq<AsM&Pi_@~fvql>Pc<
z7I1+}K(J?Odsq)KOMfrqurPM8h4^V9;k6ho2KQfZ!s4L(M9QFxP|Sr!ZCi7bN4y|@
zfmBbW8%qArTB=#(Z0xUvbXHc*26tL@;%4vyR!*L)+-2~9D<ggjN2Y8sL5yz{`h#i=
zW-o=BSL)X8a^BxAu93g03rgu0UZA;5EUG;=gT?Q$R&z~47v<v$Wl*D6VFeCr3gB-7
zq*|i_FFgCE*(Q!}?rB+O<69G{omR;1)j?7Yo#%H3Xkqz_HJ*pzEg}oP+h``~GPkBo
znaFrNdw6O?!NlG<^~AOvZ#R;J>`GEP`kam=ZQk2RSx5ybm~FjW`z$erb+$XE@BvYp
zI}g&yo|Pokgb<=zj@9J`nuI%@+eig=WF1VV&+e~iT+|_c(Z|k&<UWLviK@-OjTI5r
zc-sfE{{svf4bv!@2$agz_aQj}jlt1RcW?8{VxsC_4-7C99WgqTC5PlA#~(mO_}aYl
z7$;#A$t`}NQLPI{e!>0X1+k|Akw7zuq4uWwi3}n|<&ePLXA&U@BQflrI)j;$HJYa&
z5<sYajox2u!2<CX(yn$Z;c|a6Nn~0D@VCX}%-BGsd6QxbeoSZm9Q{Asvs%x_B|S|u
z&Is^=`Sra#$Or&U$|at}Yo_c7W`XfiyI_+n#`y9wBs0-_b`H{G%l=k@-YgpHk^>3P
zOeRTdTJbYiTfo_>O39)8#2z!S_E$qu6m?+A@OfTQkmmA2m!@Un6uMbikS;!p5u@=w
zqr8Qlg4>T(%vbE-XD^#w*+*$jK>F6_ws8{>rwYhdKtCZ`0!VA!TR@&hS^E}e>uNWx
zhMtsC2a+UJhW~YJb5mn-3ba52qF_V9&eRhE&qep5Y|DOl@nt4NT7CjJ1d*}6r?u!U
zer@F5c0l#dU+S-pSMt^OT1M%|fE|0U1g9f)$hnn3p%OeH;^Mx)h~zzCUWvzd4&Tru
zoEHzOb{9#QUdp~#pox_PKB<fLLx#pw2k(?Agh~5f7ls9fQqo8nK0!oBp!mlQ?TD&F
z5EAWbKGP>m6#A|^6b5xrS|_sLs^Y~0tqX12W!S`8Vty-kdx=C){Q@21O&hnhSbAgC
zceAZg{FE#*|AxdF$cl6Q-S?u!xnZ%(*B*uDY(xC*c^}|0Uy#9MaQbPSz!gCdL#^2$
z>f7|{73#*IRQeF{-Rdh#bW5<~h@6tpQV?w^zQMmJO!ATxS`Q9bf}K$K9oO%E8%q<)
zee{xU1Z9>VP8ZPyDn2upA00(iJB#$Sm!)_Kx$n27mg{y5Ez3sS7xk=-1pK%lmG(Oy
zhSTq+7{zr&>;jnui#?0WH|0t@QpMZHj5%LiU2|%yJN{$c<pS-`cgkP!SgjuU9hSlQ
zwS4^*B}wDt8?Wl6TGK0$OlL{%oM@}mNqr;C^J%^sT|HsNhCF_HNwXR(7Qh+WMZ&&V
z`9GUpY8k3pT7T}TB+s^P_!$3Kp9a;B&uIv@9xda9pH0ScTOzF(7T~7oW6#T;$=dZX
z_I{zYE0jn6>cgX`j2eRMzuf?6(!*F0k>CShnGhk%Bw`Ek-0pvtW}eF6^7~=pTw6n+
z&>^=IExrGq_n11ZW>3=cg8V1XXDgK@R*kIWWVlYssPh0@{aOXiTYZj3DM(g6u6HM@
zPv0wu+ULLy{9EM{F89Bq1mqk7Nj+j8GzLo;4*5zD``uTYq8Tq&drJ9?YKtcJhHS{%
zHgKAhz1|7UKmswtA^fBh=n`T+p6<v=K>cQlsWLRt`=74s$SIPLQWS)0(XpF>%=s4E
zAjnn2w}X*K`Y8ka7sg(oox`3tBIfwzk(JdROY=V*=VHJQ4>D%_IY|?w$A><u+OV2j
z{l}ywk;d@kH+0;8#azN`f~-*c3!Q#ZmQ01t9@ryg_`XU{wjwevg`(Yi5_&EjO<Bo6
zA|{f~>kw*Pn{NB268^}{LDzBUCOj?nXx=9{QN9UuLE4cY`XURE&XfcK{p6@8v?w-o
zcu#CEd$>$I0%~GueT#a>h$d8ps?ZsB5*9h%{o<7J<~t$k>%+FQe$X9(jZPO~&G^9$
zzFElCDKQsuJ;-1j;fj@Vt`_^sUuO1*q8}Z3H+lzu5v7ZrZ(=M{LW&G)o!q}}znV)@
z`>@j~z9gSjNFwtnsmUr;$;}G2;Xn#Pl}%Ee-k*VXzI;f#f8<Cca_^ojHXJX5sjVsH
zNvTSjzs+!nsMF3Mf?fP(D8^&;Yyw@#-q}dHa-qr|c^-b+M=$nq`Txr}FT&!__0jW?
zu?ANcoG@JQeL>f|t&3%4ykQsnPgGPM=}uP+VwE(L02REjnlkOV+fh12tKZq38OEH{
zqduQaqD{lS9WF3(j_|Ea3%$<Zx$pCNKDU(K1#ew@Q91ZY>DRz3;0^_LTrR<SMGQ1f
z3~5-{1)vlb!uAc$)TQjh9NCNXewKc2m5^N>kjQC}vpKF9BNf$_(FW?se7_>m%aOly
zOcX<Y%`sdU8|@b%IO&kn!V?%L&!IPYO;&xSMCE|E6*KCNqDSr^Y7jPuLYHA5$<(!6
zpkR3lmBj0d?S2B|6*KW13~6M0Pl^o~!JsM5!=U!vp0=>uS3k>y%($yY9Zj>Sff}M!
z#qnu7kHj)rtxJShWM*(u{_0n-+@0$Kgq)jr8?2)FDIJo+lRW48$?(L1fWQEi!3~WA
zJ4A^Ti|qoeGIq|8HXzuC!hv2b*^z@uTKlSJqnW~5HSw0B9+rMkBUtt*`<rI24yGMP
zlT#$9fv-rHBOf)%&2l*l*zM%X_xq(OVR15DioBsVet+~go}zS1!ZNCQ-scA9f4a-P
zG+^0(ZN$0AL+87jM4D*8aGh%9f>SX>>y-F4_N_~SGx@x4oFay$XW6fgzj5CX?(9$$
z2;<mLr0#cJY#D^hL*@f3OW!ksyagAuO?W*iI7Gg4CVpO%!n>5uG{OF;99#Q$L!5{6
z6UfNq0(F=XlrA6;_%w#<7!51v92P<RK5T{ulrZXcDPjeTWkN}e*GMa10da*%f=mzq
zdtfxn|5z&r<b;zUv7dV%Jmcj4J2drAQK%*hJIX?XB}uR^!_VFbZtO^^fO$MtesMa-
zy1=-!LPDLeP25!k!+j#!nNp@MTJ>l2TU*gC()7EjTA+4lqj771y84vrBP$X=<J25q
z#Y2`Mj0<0&)5NoZX)dUNAB?k^%3?tcEIWtJ?K;uVx3=zcoijF5@y0LR=oC&^;lUa$
z^O0K$VJ-~Q>-ZrZP;**wU?cVJJ{+}m`Xg82Kzml}zL{T`bEnn7ovpR+S!dyfCT)ds
zDQq>OGxt5OEv5hc&|}2LKe#4nel%$N#hze)Qnkn_`cxR)8<h@kf&96;#?spXw6&{I
zBW=r!{058qZY(n1Y=*k9T5ktRNgOY9IVCaWOjsE?4vq=%jXxttibnqWn#g1{AK68v
zJY}W*qHQ1?#!!aPvbtF_pQmDI*EaKwFbiVx{O~As+M$x6(ZEw$_|F6gFBrI_&)H!d
zK%w*~4W!~)7#{ckv~M5Lxjq<urxoUszm}BdQtN_t5jZK7##8Yx4Jq#4OJJzndMcv-
zS?NuVmINiSOic-QLRRCxpeC?DNy0?_xrXK9ohsdo938U~kx3<9Cz;`WQ_M3@R{yk*
zQO|S7XLP;Gyor7DCA<PsF;?7sos0hJ3)eG><VeSUwg%V3l1`EoNh6ij`ABB}QjxSs
zH-i{1==x>ox?h;Tl|O92B#BYYVfRSb<t*5;n&A{<jdO1{&y0VMW6M-n&=|`;dtV&0
z)ut4Cd0w&nH^&vVf>8-B9&+6TN!%hu(NjZ?)sC_WUNmox^R?0@g<>ed=m!nePef6G
zy$G$94T&~f7|}1b7oX5B<G_~aT`eqi^}k(7g*OqqFY{Kr++BR*$rk_J9WB7=75KI&
zzoT~G_0Q`tLL-rxgcy=;GqQec9GfhXym^W=nMNvpu_D!nQvk-V5&EFSd9B@}juTT7
zvEnou^Lyk_S-_9f0`J<_3eE`8Ej;}c@hZDSL1_zQBn?2TrjA)oi?Y*9dN4k>^E`_@
z7a#MZj1nxS5_cn+DBsPRu(~eZH+2H*AXro)Wa~lMJ2~?k+&cZ;U|2@|Ct3eHDYKgI
z(ZUm<)v;u7a&%ZGyNFsYq28%VLa7jpd!>ok(GAcP`2wLX*j)7?*Ahlvb6_~6MCFqw
zTr4E;81EoR@%I$hVi<R{x!9$Zi?vs<R2;J+?si94+yr->#ki|_P8&&U7=zJ2@KcAi
zX;hEu5CJbqB*XrjNgGdY%X~fzxiIZwj+_#L*;C1Hq>4#T%?{0aJOiBvko;&7TPe+y
zgtx8)ZT22UV?QSh968}WM$M<q!Lbs+o%PB@_EGflU+A>hBU>438>`S0o~paEVe$=I
zY{CV{zo*1vTajbYC_j>Uz~5ZX|I+v+M}NnDNC4}*bcjKhVHW@T%Rnbz*K_11>R_!6
z))~K12d8<=HsWIRM|8{sV|m#403>oso^J>b?UwFKuc;TK3YW0CsYNsA8<y4xSnV-Q
ziz=OSP8fL((k^e6>03|>S<g4!%%ix1Iz%WF{Zcz|Y2R0PM`SI}xzzBYv=*6&cnICb
z{b9UY$UWx#j!)`&;t@C@wqqx)(C^z96C$+kgQMt7glLunbk@PZYYLLO*v`2j4CI|v
zR-4k8jN4#<f%Pp~JqweRc_7CvU7Rn}?eRh5Ueiwzj=%x)Hpyvw8-wZ!eTXHR667Wv
z{sdpT<`e!QFS~wNqvdksYX5|*)Gt;#!|TNZodu;>%DM@^Y3&yQeklQXVOb>hhsV_L
zEV;v#fn%Le6qXyTG#=O?C%;dhez>ljB))1=t!LN?!qxC86mXiI*lE-DozH@f6#?CF
zRplxULl2d_OSs5ba(`K8W1$@3^4rc_&%^ZhF$dta@X1^WDPP96|0}fOInXj#ZdOgs
zr@kn=2RD<8kw<MA6CNG~Pe^c+taEa4`*}N=X6m%;T!wVkznBUgK^=^Cvl4j2mV`I?
zwp2gSbL%bK{a93j`y`j(!5~j<4~2t0=Kn7X!1l9~m~Ahm;>H&}&vrLWw2gEDM7*gI
z>OU%j1fN-vQiP|aBeb+Rq5yFFqm;t;!vz8pc80Kn*SLbn6rtnPK0C`E5^Nep6Cx60
zNHR3&Vj`^R#-ZrC6Dcm5a{Vw80R1mMQJ9LK0<ggFkdc;Hzp}s%ybO+YbT9RRu-}5n
zJo}48?T2|dV}Xy<hkP=vCGu1j@U^4?xn4-y437)XTs=YRxN=Y2?FR4-6O1an_kgYz
z7VZ;<-}#oYq_`YLw8ya+>Lk9B%uB`fi-v<NYrhE?UJDtZgT84ybo9xlIYJkff^yFW
z8GDhoP1Qy0d~I0xqnhNV`d_Cer3&a}pfw!Ku**@!a(|x~?z#5=bU&-aUi<^&HkmSL
z=w3@aDvxSN^pA#aHIb#U@$zAac$s@{U!#WMLTpLIzIhF69m#A7ra>5^93^@(<W1H8
zJfkTGL)riK8X|f~ncx?dhs8bxA>V{D&!Mu=IAs3d4gg^vYL8g_vE3FeJTo&yA#(~t
z2^xMVRQfX+$C3nwqQzrD3AxOLql_5LbJl-q(zkG0HwWULUUbYha@<b$e_UWS?ol&q
z_VlLS=g+ArGwKVVt%^19@@;Yv(I;FpfL?losY!^c<agCmm|OyPqU1O(DU;JIQ{hE5
zXYXlgkoxYdk$B?!pML}@ZwO+<II!}XxKT-&7zwo7n@ctN{C33Oo6!`?n73Y1^57s}
z>jo^T6{ag`Oj|FH()XEHDo+>H1ijnz8)<6`-*@^$`1J-P$Kz674Kc_$DCn6J&znDY
zxv&3vZ}sS*5c^f!Jpy8mv$7fe+>58gABsJ*2NfT#p>Xzl?TaTN^Z3eicxE_6gpL3W
z?3kutbrs`+ugCT$4O8eILwK&Tz0LR@qYoX~K`=U-sYTlS&U9<auzIXK*Nsy`c(vYj
zigI5V?F#LXkqR>wb-a%=*N7YK2Bkt`yb0k_!sYq=Azgj|kVV|h1*j5^M<B_<v6<fw
zu!&p-v5oX0UP=Ia%0g)an4gj$S{k}JD>xV#4JaKu5Cp7CEfE+#A?@=*kMJNA^@2mB
zAmI3vEWXNs_c5dm7a+ru5_p_DpxDL#o3H*C86aozn!|?-MsYk99iAp@{bAUnwVE~d
z#<en3w{mTj^hMETs4xDw<p#cFrlg4LEx9<{4hhoiKR;QU|HZKwAeIr6tB$n{Qa)qb
zjygn#$jrCB@5FYE^|s)@N1!HX;By$Q4fdf$6%JW+qo0_31Ht4#*D(3!Hz4VbZgj>r
zLLc!W4c7c=ts|ZcHZN)h{s5}|D?k5%l+z@<;4zRCl)-UrzWG(#EA)Y;z*=Vk=^r)E
zPRJ187l*KWlzNx<uX^7dGJFW8T@3RQ4QPqbP(&3xFnV~y;EuS8lnEYbELQ1a9|Gd4
z3PB+`;66IcsAUHrlZBD%C0K&VEJPb{pq+}lR#72{mp)J~Xd?wj&xw+yZ5v5Wu^Sm_
z`Zwvh!X#(2rUbn*WgC2rn&8}Cid;5{%gD6-^j-3=Qny$Tt4ttiHn^mKh2<N3jJ&+z
zNTtO;7Vxly#Y@wDW)8cgf}$T3d3NM7><@R8>2U@1z(H25a&5(+=orUVyJZf|gpAKw
zOph%|KAF63?%#o}y{-lNE;9jk+@5W>*}UHLNHh5*oBMB)f>xh}SqG3~2qjl_un;r9
zIgct_iC~-~Uvi@PP<A-;+cx}W)xVAC8|&>f$2KU|6<d_EeZEFWd0`KS8oVpLo{Kw=
zw$;!#wpsen&b^Q3zeIseSRTCrdEaMx%u^XuMMOk`bwpW1Xrv@qt$y8eJ^#L6`Q>+6
z*XuE~`EXHpCbZfzQDrBBjueURCL-#Z${>@B^f&+d!_R;DcYd~zAp2*yS<akvwJU49
zoo1Y_roC`4FT42h{B#uG?EHD7*g9~z!L#w*&dT`+sjc<Z_wmsvDhs4y78Jz5qK$e?
zA$K`-d#jM{n=p(-hIT_D$6!R;=$mAUz{IcsD`ZT2DK&|x+~_q3i|4B0V9Inro)F_|
zt)?@F0gXxc`t=A7tsD}XDK$JYagPMe#FXqX5VKHScW`XKff52!@O6AB#PwQcm99_6
zI7c#PPTRN!rx20bq*Ytw+v2BLtQkHBXKZiynE5v*z8!{q&WQWm3!MA`c7h<RVZ;az
z&p5+oDKWDkPV1l>k2ej=t*5e(+yQ)Uhb9=V5qqSr2}gJJJoq*Ud0-d^<C<=?j`%of
zclv1_BLQ{$L^h5+<K)XXP{<Wuy9ckl8<&%pV2zNXH3Lg6&KMW{cz`UY+6Q&q&#4bt
z*t*4!@e>3PmfACrDJ{WBL&>^K;C8N<`MJ%ep#e-M9V`=x7E?rdr(usE%^Dm_Hd-eI
z5lh3|B}62hmD^uZgs!}cKlZ6Pz%t#-*)X294EMA4ItOtUg}^NQ@`@ik?imr^+TCCi
zbNL2^Tm#?3NW#y>ANGCIc7b(k+*a;I2;&R_@$P6MQ}2rZS9%;Nd4+<$!Ul<xl_Qyx
zXCCrRy5%Tj{rXK00`W_^>ys%00n<G@m11dBIJ>gAK{d?zE|Z<}J-AHpfvawF+!Kh&
zoPBfjhx>VSAGH6_W)Q+!1GA!wTC4V(EdKUws$^(81G}XCioPM_^XzEjRLEDKG?wV&
zb`VjKOKgq@BVH=xnUp*8{oddfe98w3(~abTvEAEq&i{THt+}b<99z#hIhH1~xFd9W
zQLHxmsfo`yMW-Xe*oWcDD0BaYpk{_|)ephz=M0dFNd8E6WnvvEkR_@A)m;Jx=zHy)
zQv!+olgaz2S;m8i^r0Hf;c+{jFhc;s6Q%ghPlrXHG)D|Hc@`U19DN0>YO!H`gh6Ue
z5tmdlky*;Hfe@k|2>{b!GGwkic0@iK_!?JPo~x)BW&ys8d;vsz%pzJA=N+g0qs(>z
z20jj^n6T{CsV#Dtc1kR@+1KG`UBMmyZFbf<xReK`=FTlFX%cIvAiG(6adC_@%Lg)>
zro5L-5k_+cYJBMT1T8CL@;W8<H`wBv!9B4@7X_k&@=}zz{6*WK)|KI^rS`~TUtd(4
zhkC6;B+Z`kRtMDjb_SNpzXGRVBVpG;(<2P3_=?WjAP2_n-|Xq90^JXME;8Tpn6v$3
zxc+b!HHu&()+i{S%hM6cyh}fWOdxW#3Dx3=I(#$J?_G_%0>>edjJ(E#5m4vlaNKWp
zS21wL<a^B#%Uo{}c2eiRd(V^VQ;;RF;GxN2QY1z<kmHi7ttID&b9>S1v(V8I(P@>|
zjM<cMIL8i3>hhuOtNs=U8Gr@tl+4p}hFYvTk5MP3BZKx^?B`3Q%pgC@RKX@2yW&PC
z?m8ir3GWorm*6IR)rh9l86yua*o!@}t-Kvnyl1TWpn*hV;-%&U#|CvTLTM=$%C(LW
zpOi2wJ6k-pHHkz!kbK%aNA6&@yIBx+Q(zpU(8$4_i~ms;XWrZz{%F;j6Ye>|<8#>4
zh>=-2=Pv;{y5H`(7{xUZ6^nk>#3z~}jdEoBuFT76FT;GD#qs*SrBxVxqDg!@jj={m
z4m!_X#tU8?8!X$S!~`{5VVvIHZ*$UJ+UNLW3{821?<=LOu^=}oW`gqs>>VDZ)zgb^
zPT}ghi&8<i<V6_tbph15Bd_lXc>|YIj#S-Dns(8eD^RDX+x`627@G}=k%wcH(|`)G
zd0bgu+;?T`j?YKV8^*X&tx>%7$`^`Q=o-3DhB=_pw>CWapGpvIiTjKKOmtY{2n{qQ
zd=i-&mM)!0CzQ8W;E*JUZ()#J6O0{Fj)<40Q5prGtlW7VxjRbPv$F`@9Ee}_B~^Y?
zY*9vTS`BkfH~;N#n4BU3KG!mXNP$sR(JU@*=CwtnVUr{su~$y(?ibkF^a?}$y8@a;
zD!^|C;~2x=v;vq%43=yS4&UmO=Os0oL1vcR*-18Nbxj|c$a9f7#)#Id$zNl|6&KaE
zh~86)z5&_&NAd<d9a&Hx<D!<#vw50D7AZ7)Y2AOqhD>GAtCO!-RGM!k-gJQc3K<w3
z7Cu*v>VFoz$ep$*9mTfhEP8&IlaNU{7MW>iZvM-YfU7}BZL~SrGYDFn7%uGpnOCNw
zO}i<1r$8euNfM#Uw1f1hNC43_r<weVq!x&%U`b#2ffnt*47dE-yl0Y}dRpMZrsPJj
zDjJER1e`12KKvu)15;qW)CTZVZATQAIW<)I^iNC8-I53ds(B!yf{hp2SO@?$cxRGe
z5TgQ5j7dWb>L4>LD>S7nw@@w$HJCOezQuZYR)naZI#Rf4U=(5_ih&4t3&A`;pqz%y
zU|O5hC;4X@RQaf~9E%)oDM7Lty1{5{`2d!?h{X^8#lUj9a!wrEu)CfS)OJS^FI=2f
zbvL$lGkE&VGw&jsg`8o{l$S|lIpe2}C1`TNCvIhA(K>INul$kTxLjFPgV<0)eHd2&
zdtTB#n(M-bJB)L>%;R=|3dw}O^nCkH9LI__naPf5(f>F88$M#}7L-s$Y8=B#rIb)F
z*|!5RTTT=Gl-<aKh)T|99)Uo?<=)e-)eGMZx3_Ami1IJ!d>gu(RG62I`Oml)9ts6|
z3{pz|ZO&8o`Cj2)QEFTM<$81&0qw-hAQ@Q9??6T9rCEEfsyf2OS^FuenAl{<Aa^CE
ziLXleB1nWCt~4Ql9%y!%&tH>dv&`X%iTY`9ky%+xC$ItJGEB}-09;})Fj_QT>#!6$
z5`k7c69bD}L;)RIFijJzAxbOWX`FsfV#WMryF6tdR{)B`_p1^%G*Fo7fP{GKhp+LT
z$#^R|2X9T>#)_7_->U+#cy)r?5Up;1mz5ss3fjV2c{NP*HsEgu7EP$Srlv?O|0E-r
zR-mtAeiqY^`=^jm;R+-DA+C{RGo&GLc5~j~c7OU&^FH|kEkkMUQOhaEyG?DucDCo8
zY=h_f<U5i)JYrQW{V8JyObp(3S+lvfxw$|rxR7UZz{rnnNPB`ReOW+Qn*aOZC>zkc
zEN?7wv;O<VADWFEtWdG$OqpN!r9OIv%YVP`bKyN`lRTC`HfrYHu^I+u@6#;z6{@iR
zng6uGy(Mk(GIU-tT+F9P*HbIqkBRZYdLSsEl3Dny{d~L>yA4ogsklYmZ<`PW%uaJy
z>@V!rJ=ooFEG)cv(R4#vVT2S`Y2o_Ry_q}43vODyB<zJKRws=Y4Ghgv@*%{JJFA#A
zSRg}Sgyf-yv>yX^{bjS@2%ZIRJTPd~J9B#uc47Rh&|02s)H9FO^$&&+wHu2=lz9bc
zGVBMCu*By{k+3W)lPgtNG0b+0IV^Y_)6#>7uSsOSnC{FK0=$nCrzzj*sF{7`+rGg1
zUUzUc$B1N$2+mc0CP_M75ygn3mCz&|l8b3_Og75cY5Bw)v&67<5)N_}<QS3fP^{Fo
z!tn<o*A+g=@d-QPZeF^U_R`yYWvDrfEiqou%eiRj(>%-nq^_OK9R_AIxXx<|u2m((
z-c=4e2Z^)VAsi<?t=D*%OcRtEnj=`x2w}>NVX5FxIH+Qd^zvHIeXX|8&74?NoJM|h
zBYRTW$bk@RP!MY*tm?^{d1#Q$9iW#7tw~OPMg2f`2E8B+KP|pOE&npFF5=Kzed;;#
zcT))A4r|FPJL#e){2jjA0ar3S4JuC6YJW%WYqbdq+O+l!jFcMsh%7+2d;(p~F5vJA
zfYS<6G6QEZKd4*qFQ8C_35K$*$A$m|OgjfX5qb>I>F&=9VXh0%<Cw~ayW)JSjmKzZ
zXp~_TMKn+f6X=*|6&xKb>1ftpEoD&$NyClkq`kk$`jSw@)v*z=3M4Z33~!2{(5EQt
zV1f|cTSV;28(s{hm&%MG5RI4d?8oI2C>0{b+36PlIi1RYtOxQmx-DXO7JeRV(H#05
z+)^!BA|i58<P16d;`5|mLvDLH;LFgmF{bhD#AOh%y4a0?p`F>4lxLnAb>mOzbTsBo
zksfoGDFjqv@*0!9mt1rOgcZg=#1NyHd(k+z*yB&#B}qAhe;uGYbO!5oGAw2UT#%lQ
z?olDPm^>srv8JzR8%yHs@qF3rf-Kv`#yK_Ww#stjsQqWF#7^Wgi!+V#9+;c=){%WC
z5arRl%^qc2YnV5+<>TP%n`R$ZlxLA1E1Q?ZpFX_ub-OG*;hAuK$*`ei*vm{f!fJHs
zE4oT<QP+IxY6m`e$HJoNW!}SioR-oN1}eFA+qFORbzC<mPu8jYAzNt$Hhm4o-i2$`
zb{jIKHFR2vTt~P;Dd&OvK34FKP?}sZG7ZF8rDyE$tNHz(M_XA~;y@7INAc81gQT>1
z1H=gBM|t|&jx`G@GVu+XvU3pt1qBi`ar3>3;C(~YUiQ=TMBe>6$v=I{MP?{L{sqDf
zGJotnGE*BN+FMRW7eNdGg<}|l!VowyIgFbb8@iB8Ni@t><~517BZtcyF6ks$dK<+3
zS-P18jX;U(iJ;^beW{fKwvpU7vpLZ9(+b4zAgZKH>I}ZS@aw(V22DgTX0u4*H2fQL
z4eGnQyV-t@H-zwRh`kj!(ViQXFDrGLFsaI<=9+=N?=nw|@fcW#OwA+~Y+-O+I+`uf
z>%XiN&fFA?WAs?ScD%P^`0SrH82a@GQ1{l&SshNfUr_8I_4w8*doEuiCt+3))AwM5
z?G0FKBI)ig(WJKVEHvk<2W%KvYGAsJB&mE}b|7&_89!@H_QM$HIuc*gXXb$nVr-sg
ztb{P3Lk#)Og<x`G&`$7x@U&iAT)kJxi`ZGw(=bX?Dh5U<4K<HTRZXnv&Q=s6qgQGa
zYIkW3rC>ko5ISZFgUvYQk-mvF{B@ct81qYsM=2ZfR_F-Sn+}OXr0vt2i*>_y9T88D
zhzPcx$QK$Xx3+uH)o@#6lTO=4kEh?FI6^;MfJs_8Q%qk@_F@EYPJ;W?BxBmt@u&&o
z*Gs2Z2?+Hc>?rgY)*^DWG43F-J!PkKhjcfv2-!@e)WzOzwc^QZgHDpTN={s+Hr5=S
zn;Q@rw~ZczTbf5PhnfRyn{}p8<N&yXY$8Ph<CebBO_;G!3hAfxn=)pz(tmhJJfRq8
zhCQer4<fNXsHH{NQXy75!KUrWtbbygJJ&aZQJ?55r;p7Sd*9&j>uLYSzKarH6e}hu
z^+f$q_~|e>p&fW*{s6SoAuN+ANU=T62e;wttn_y{tNZFl)W#LRfAY}HP8(YB+AN~{
zwFME%7{;5@UG{aiiUv|uYI(*I;7#gG;yK%6ro~&}{Uyr$zW+-^w^P&9yyb>!dgPvM
zbm?`hl$9AOV@8ba4Y)6zsS>qRmutfq9Y#W87?$1tX<p6*fEA35fg$$3?w@xcB_>X1
zFoD#K&y;y97z~4j^nF&9RYxICE598O7xJPd<miui5uq1KkA?d@{US7B#t@=OQ4^%1
zG)M!7WQx2TG}8GT7SL%S<Q6pK1%~M!U39neMa8d{_JgU4$D2?sBUG{DP%D1Y4TW)t
zWa(242{D#nCe*B+I$!H~H1XU}^y56|t9*Ug^<SLL16%Lw6wxW^gs%H=JcVy&I8<7H
zeI4I?+~j6;dYyld6wT44HE!E?%@AB72sk^tl)0^g1$SwZrn!F$2<%o+M_3WK)wIJq
z;R=bCtAD7i`9}~AEynwoH7hSBb5}jdD*O4Y+59n(0{7DY&hy;ht@+)5wOtF2h4Wl<
z8NE&|CnjuOqi^=Gzq)hOJLeZBUi3$;K~>O<^ifV%DxRkzv~f3lfJR*|W)&OqkYn6o
zFFz4d5UA9+(kz!<_U<$^L=4ay_P=i<-tt(Qqgk1oEUot(;}CuVd!z;or#}C#{_!XO
zWi~~V|DHHmJB4FrXL*}<#q(`%E)fNdp-F4wgSY0j?R)eh7jorYM)X-_aEqn7b70D-
zNp%ZBKhPD=0t``?+g-9-N-aOID_^MJtv<?jxR-KTP)7TA&W6-~jJ$v`wK8`0-#G3_
zRr^PDzU;jb{wSSaSm@2QL#^UWi93ZhX&k5#2C>9Jb=0n^_Ow@&E&6-8=sfOTOPUbi
zkH)|Hc%eO;wdxUyv<rb)g+E4G`z*Q)_E$Kp)E9dTRFmu1b>tNGDwp+b8Xj@_xVY!5
z`ag;NL!q0FEQel$b;jKxiLS5$%&O@Aj)RMdvTr%^a9TC|7&Tk(##sT{p)i6OtyV>Q
zp#sMy5glg9zw(>i+;;Q7U!oKUAF}U$LYor?*|NW~-S0hz7U%C}5&Qn-r=4iJPuFw6
zCi2-C*tN6DC0e*=8zzO^v~P}E-ZlJIF=*TOMhvR!Je_b}WOgD*cKbM(^&W^B{5JFI
z({ZpDlaB7x`bm)vj3C16y;)}0weY;+nDNeSxBD4j=`765vWa~q9PEPIfqweE>u<b0
z4CUWC%9`G<8*Rg!ghMbnBbi;^Zw-uXR9BuJ*3cXQ{MsZSh2pyk%Se<#{01G7{ixX8
zZxZ{Vfz>RJbm_~BT@Le9Z(73maIS-=W}-js&(Q10;|0TAa{ic+5pjMk3t)2Nh&tsQ
z9|1!y%P>~B3pc@H#z3!peUoXLuO_}9z&cY*d&7%;6u_KXQ?=bTJkLFO5qnL{^^YyA
z9Vy;BO=-~NRTRV2?P(kB64%L8Ixv_t^^HGAp~8AAK;L-h_LCVZmklIF*!@T~-H`=0
zES>13G7F8ZvSQD9o}KTRSof->>DNPxz+@I{PpCu>NF2sa_IJXuOl9e2yADK-yEVdu
z;|YBY<nWc04|`H0_6?H<>5s!QfhKlHbxPoA8N?6*MlVztBMZ7}ev{zeYfTR69pV?R
z=w%g(p07fkzJ|2b<}#hV>83_G^}XDOFn{Sp!7xmU0#-#IJ6I<ZM({`LCUOm9Pgt`&
z<_#Vtwhj?&c&4w^rsqd(RT?WzN&==fLNNb^8w|!Ak(kYcv@TLCs&^gci-oqC_UXgC
z`Nu7tgxdzN=H3Q{E>Md}1s=z!Khfwy6t92&y$f!6tQyo^UVgv)V)$6K8lF&aUvwRF
zR!?6mHnS*4-2GQ*_ntWy<oL1dP};E%>^)zuM>P_7Xx`1Pt_QUrTigmg5nt&5&ww%)
zbln7&iUa=w{hY&hVkkUNVtDP?dWjtUhCU7%#cHH*7u(b>kCTtIM7wH*wqn{4>Vpwh
z48zudAogX)wRgN1Wb0pHr5bD8lgJAzW_mP%5y#yY`g$u4Q75^sFuretppk&DRxJuw
zlV~p<>6@t%i1**xb1gA0rJLA8L0&jk&N?9k_nJeK8>Dvd=EwV$Ax(D2KVX2?E^#L>
zZT%{mWrzC#!&>7DAj>X>6UbaPyk7a^j&4{BR&S`r*Lqhpa)9^F8M*6$&Q>*<MH4h;
z{5=(Oe!BbijpzUyk8Vtm7_^wSx!7kfL5qT<fBZEnRfv%r>kl%~)2(gwU=>Zcx@144
zOxeN?S_$T>GZp5J_}n*L)4FH=2AHieuBZC(ehOmb2CC}5?uFCrN%<v0SQ|RVRS1+y
zw(Ut1bjE*rNtV1BKBN`%%E~t|dQvQ;8WpP~BaD|Mk$1oNHXHkgsEUaBc}2m(Ye{*7
zQ)C2AXnDq5jM_v0&Eg1pr#6b!e*CDru$D!XNscEMjB%!C;B&6D0{y^8S-b6}+~A6~
zpDI>%Y+JY7%`__@e7_RzX8#5p`qyPw2X7?2FTdOIr-!8b>i7TR>n!7%e&csf4<x42
zIS~QrlnxOQlv0uI2I(3gV}QhHL=ccvDV5IAHM&b+^k{^UGDdBO-|L+Jd7Ve+@%HE&
z_kDk_&vm`8752n{t~X%8ZU$?(B8FUg1)?W&b6UK`uYkug!W1!!0xh@C0Hxv0^&Ovw
zc*i;a_8UY^?rBRUx*kY1Yw7QXU365UcW*vR%Pta}h}ojA2n@y^+~#_r(4I|bd&reg
z2%VDM=-xueSxM!oFz`+v$9c;U3fLm;7^BpD*rp!PIAIRyyg=3D;Udx%o#0D|iLnof
z6Z`i^F9wWJ(__$i6r2C?B4h4d4BWi?d@)EDJGrgQC@kJ&GdGb44V4zJXgZ1YL_aYM
zlE21$wFFjtSYjRFgqmPC6QpIB{o3cjkMcqe#=0nY+Z3*`>dNGXnYg*Dz`i^y`7|IE
ze9_wnyKAico))2lw$)Mx(^z^RN1`OBj@zydD1q~SaL+DHOOE;lcbF%#kP)T}-G8L~
z;$!{Y!?K$?_D;%~L<a`+=zNESt@3AVgUe0w7QH{CBeiy@)b0~U?<K8b6`q95Kg?-4
zS;HBXNAaz0Mu}4zd3AY8`bqVy@%6fIN+_4K4ceCsRQ%a+O8$~Ww!07Z<IZ1dQRz&^
z**@zNS927#FSR5~mSxGb(SB6uPVZBr(J?N@Chz>q<V$J|&qH5V+NyxJxa!`sc~7Z^
z-}>R+MucE9_j@&QAjUVuhf!*_VH2iLbG{cO!71P;-gFlaV|uipdOd3e?nK!H>X1zD
z1NT}<NN6}E$7ToltKw=6Vu18!(n^YWPpTIoZHVU9<{IHJafCC03L%;3!;VyfcmlKZ
zh*zRj{6J-=Zo`H(TeZgU3~>}8Kppa!D_W;IrYFTHaN^kfJI}Ngp=D}@m?1)S;lb9p
ziPhctI*pY2^xw{Bc5;Er>273omOm4Cnhm;^8{4R4z{#MXe!C=dcm1$>TQ4u`lspMj
zUn2wiH>A3>L}k%6`m%ZnS1R%w;ks<xsETpqw5@OzzhGY!?SiPzLaCVPzPkBp_ts;o
zW+O;(dR|sGVz|xSw&dJq&txq;=tx8U6^|<BecXrvay=riBxsx6pQPNTgRr?o)__7L
z9OR*c%EMvRQLL61-mHHab*@SeANIby*wuvydI}%J=|a@7`^7l<meUIS!)zanF{;iZ
zphnhbiu);RT)Cw5Qh@CoK9o4e>Rb^+CF5`&*bmKJISeJ<XNum5pznK^H<owF9Cl+A
zpM=}KLbT(Dn)l~o!@Js;f!QrtQtnjvf9D~zN@vITJ0dcu?xPNXd-_ze72{=zCBEqB
z<`61yjb2z`7**WfKPo6z5OQtnVMv6J)B`=)#^&;b;EVI4)QRoZ9?qlYqYgZ)0rjTz
zxHIz*P@C^OAIeLeZPydG`V-n2r{fF2DC5uzh$3y)k+9(G^!0zZUc*uHkW<5u1CRlv
zJ0G-n1Y`fuAiD%VyV^aU0|?C1qoaLb(vguD321a=A!9`@Pjf;xk{mZabHhS-=v6(e
ze*X^)S0^sfDN|zpiC#USzN%aF!)DL(fI(?54@#`YNPzh%{h^7+MG13$zBa&2`e(3!
zJ96}a#BgxS1l>x3iDRI!X`KwjB<lWO1OIW2-vKhXwYLoUiWuRUhgtbW&RX!lRc#6Q
zs2ZbWISl2ps5rAjidQgi!Oy-|+e0SfqLp9D$Nr|T{0d2*HFKHjnv2VO!${>v$R&j5
zVzqFl`S9}|hbSo->mVO3hy7|a(4J)CW&K7>#mSFwOOcB;G*K*#HN~TupV4<WNmJGa
zOW3v^r|>`iVD&1zVyUx(E_CmsG~;!*<;i8T$Hwi%>otsYT5@l-?!H1n2#dPnw6#DF
zjs<GgP#xfAE~r>~dg}P|(=l^w-{Adow~x*yPBhjgJVyRjnG$zkDMB>~tg|~G^Y~m7
zUu$U%W#*VOZVihK)37nrhm-Cualf#FT1qH%-l<~XV5_K#E(cfj>xh7*d<sP;Wj>J7
z=5_vkr&Cv#Qx|mDdY;Cx>~pweT|=F<IXWCCqM&T%iEBjRt}X)H1zhKy65p3d=;)WL
zD{dXvb78JfO)eE@fY_R`ORt90QF%AReVovbXTMoTxYNz-XjV0bj61e(_V+6f+a@@#
zKix7J87+OSS>fPdUn-+py7MSJnDO6;^v&eh=~54P$-R=j8NlxCgx#8Le-E}el86d{
zA`7iUe3*)@+le_?+*>ypR*or`8@I2g{RxU?S|??qfgxBfgrN?;MSc~j5^rmaO5WNi
zbeEpH$G+$?YO93(glNeCQn@*dI?i{gE1z_F&H&pFJ;AJ?>q^xg8{>VUsQ?wY=oo+i
zU2Wt>DO;6v-}FdDiO1!}Wnb^**IE;`_&nq6p<WSqvWyqQ>vm=}1+On|bo}s8cc|c>
zSLuG_9%5yuXSFH-i}X}YbNTT#s<&x}_6htFx)dw?cCF7HH~p%9)cs+fHu&?xZ^LNG
zn+2Lc`WGI0iSEeWeS3oiZJtKxIHxkD<MqUURZjL7)0~vO-6AZUBnZ13wjLVE)R193
z38L62CDj?fU>uL5F{y8ju5eIgRzK;arGlK8t#MzF4F<j>voA;<1G7#%U5VFsh~S~}
zAY>_qYdjpI8uR%q(=EXb`_oUQ7w!fTat-+b`sl6@sY3ao;<?&Q*>726wa;`y@YD>W
zaCQV)`@6{Z&MSOu#Uvj73M3bm<_RsJ(gvpl`N(|Yj3sHANVm)mozwkK@o8Dc>86#%
z<o=&G&xf$7i`zRIE{>b`so<r8J%Uq@4oxm@+}=2OEq|O&Z`$0-LSW?gUk@II0T-1P
zZ)x!LdQar^J=$+DZ(AOIV(((i_IGDx;@!Xf6VpK>CX>84_jhff|C|@Eztnb4ccpt9
z(uoQeei$OMUwNuy9gcpx?2jkza@4^+4>)sKw#q7ZK)5#_GMBfU3|?n^e)m{CeFuAg
zl@0J+0hEnkZdt;}V~H<aTme2T<!WOa7OwCc4C;3O)qb<csUY3=xyWR0*=`AXRdM~3
z@{O6_=2$RXJn*)z$sz~_Gh(MdfUiHC%ehut(7s+|%)Xm@lf4bo6lt6rQ;(W$$E~lx
znhz7VmEw33mb#4<JzoV>O0ifHn;$hzwfP?Z6*tPhW8t{kcXy=f=uAo|_%EI03yV3Q
zFuBxtpzS-`uRnXWTZbQU0lLNH_AI&5>t{$sr3&jEUf7RRO>(kI+=S<`AtfC1oqqFP
zBIgTS2`eXmpL4bw<sTb3W?U_1&8$@aMKIj_cwtKIA(j|n;+O?;Z7P4V(O1E2$R_Bj
zkx?t!a>i5kB0=fQ*y<;S-{u3olKSRLTGu1YgsDAN2Fadpp)vI+L4v{TW5C_;F|qq3
zM;&2|s{ETQCPN#PmJMqFMf*GafGDLv|72Bz=w}ar_o?&=t!_t1RvJ`FG9BD^WeC|&
znmWm#z}&R%k`##NDgeX>qz(+Y>r?olvqV<BD}MY|X)=1C^r?2?$E*+krcA|-(V0xb
z!lra%oipM5bc?L5*W~CZ%9W*+eeO6~V$L#OBCKZrZm#WoB}G4DU8c#PFP}&p5HQhc
z>U+Xp(NKzi`4%pYDt!lu%K<2~J1bQZW5j(Vi%_2sG{AIAurZByu|@7)cEb>u_|QRJ
zJNtC1#=D@bet8~DA)=i2jNE_8Ua}c&@eSDvp0wDP_m>Sh?+B*>^BxFEFKx&t0%iA6
zgndHlFe;V<sm4WwKmJtt@?c8`;@QSw(<f124P*BoRsI1B_q(~ATkiO(Ir*dUwps>3
zw&0Z$B~;DD8)}_b<LY>JyD-_rt~rnL;6e_ehI0;CZU~9Io9v@_+a$_7+#$Z2eav4N
zQFiCsaxFxeHa##j@qKV~zT%J504jF)?`mob+b}tyaY?jXStB^G5dGNnMJ4SV;~%3!
zh;tPf{bw4&FW52Ik;GZ!*ZC-NVAA2UU`?9euQL7UWJsEKeRU<T5T3U;O~O#D?bRSk
zB~#Nr%@@RP|5@esz7=pIJ~xiN`_S*tAKVcpT&Qlr606|D>mEyzEUzb|Q!KvvOVla!
zdjWq80iVaqVn8n`4dJ%1O#kXffOiMyPomXn&XuoHAuN>B_Jl0<^P+oe3qTN?>5YZL
zFr&!v&ZC7qy!Om1nQ(4Xx%(BhOY+EH<g?$3*`vSsf2nEcx}~yQm6bS|_<Eh&+9P{j
z#mgk+3O;5WM()T{_f}SJ_yw>{$iR-Dt$)guC>9;H&i)EDMt(*WrnkQu+xu5kvNt4f
z7DWsSscU=gfA++#dud?kD$kQl?8#`8PBj2E8$-ri9D;g>H<}j)&OcE{s9ZO2<ubKh
zZVt=tQjg=ty@rJI--XDWFZy(aVZ3SquJBd_xH_p4U9}yK*xZ^fM3vwlXzlu-f07he
z)dYp1Yfpu(lN2%HnL|%cxj1q$@wUS%!7<wvqS&dtW32_Dpychikb}CV4pY}E`+JLN
z>Z3Wg&)7D|62yV)R}X3pZT<J9f;wow&aj-dQd79C|8I?Xz<#nWmFc_~D~uV318$nF
z&jCHI{<z^d6<uozW!u-8`@WV@#f9dx0m|8i_OF8%@99QIV$y-D>~?+1s|vjPXRED<
zn2Lb9;+3PlcKQZonFNuRRRwtr=fS+vza#YsfWlE&;?yC?Baiu>Gmy>ECfEr&bu*KG
z09SJLPTMLo!GtyWf&ct7`8a=G+q$(G{5A?B@f6LKsY=r|4DrLIe9&G*5_!4SgQ$`B
zED@W;rjA}NEzgs}ofiil#jEmJ7|XGi%o~wcP|M860}mn7;NX_(y3oCLyGtrr;dq0K
z%LX6mSi|5&-aOhpV*hUjSXM&?zv+QqA)mTAemIST6s!jn;aE!TBQkX%J0tSGZF1Ly
ze?ipPp5dGR+WQR_{(>BeqLc&tJO6h*6NYX2e;+omMt0d8wYfj#e5NJGO$K{lW+Uqz
zgDR1?df6Awp%C!qg@ugweb&b?1b{6uj6mcMy^`75n^X~&Kb@~{%}w9__go;wfsi4M
za?5Is3AVT^Db9`jV?|RIuPpDkL1!V(TLB6V^+_*z6mQXf|2r+gn!;iN7;_kBiMivS
zXeE)I4hlGIMpWGCd-U#2deTJj;eun-%5}~P5We)G1bsh`8h=xj6cKdTSj-hDlBqeu
zc|~-EUEoFrb{fu&+Ou`ZydUaH+K*pa&%L@ns#FD1=3PvOq<`P2)SZWI=*S#zqA1iA
zk^7$QvN<Buw`^@c3!RT3mfLLx|3u+zw=Y7~ZTp{ny2X9yhnXbTb6L%=cSo;#4G|@l
z=S7|wIroMq?$4S}=>Tbh!;)rN$&GcPcOF!X;kF>>wSP8Mnh!Xj=RzTD?yYAG%7^Fw
zeG3oGJsAdU%iOYxmx^<|s}V^`7$j;BldSCfOX6F};oWKw)sNHRH0!U3aKHr5T$w0u
zlk(H%^<s#Y^ZxYh6(wL;71Q}{YDp;4L$3`t!Y*OK`Jiv{ZF%N65_y8SD7!i%t9Z1q
z1hdC+ym#xMoLrkR+~nYmUQ#d77r}27(HZJ5ZKQ_oZ@?c_^l1$q>wn&k1(Hlu@IgFN
zdB~Dfh}(--`IL_uJNPCC9ZOWy8=^Az9+;qB*Si|fzhw#M{qEgC#6>Wh4E#W(5jjMj
z8e=eOb25H^RW(<9hhDXhn+aQ>w>ToC+d)AkT>C?Q_m_HJ0}{DyX7#P^Uj6d;MQKN!
zb(q++_yXUbnUvlKQuHdk53msxS|nu$?O!KuW-(t{2#Jkl`4?x&nv~{Ej3u1DIuRg=
z|9HLrfjyFJhDv}|)tf$zyn7x6V(r|^k|M2=4_MCWI&aJ$nh?J#F|e01Fs_(mcZwoO
zlKZ>uPuEwsD-&<A^iO!9qZWEAvOlku$n<-~LN;YnGa>~~8ed8m|NE6AqA30s*kgUT
z>^^p9p(Q7MxK%KUeIK&ImFxKq`!Q#8Ncc_H;Z0{=ghboF$lFd}<x_?8;PB(eP~S1i
zU}ieK>!mKVjl8F(U8m#d0WoMtfb1Y?)VGLgQJh1q33^(FQP0vjXoagUq}y#XPD<JG
z1-nMCLgc2JQ#oXEe(ec#^6ad6kYxBQQh~P6+C*R%I5g_7rG?EBF2+!{XJ^^seQ8_E
zF5Q)w5cI-mPG`HdhW%ZpCfYpGkuQbjDRwuoiTIVW)!yt--?USf4BXLgpd^*I>D8~O
zKVN#L=`l@HH~Nn^4c2cQf}Lo_Rfxv~*6#=oWrR4ON2HZA3xqqR+DDsGki}0d@nY~>
zBUZ<TX=v5A_aLoaOvJ{xDv+W$2V>0f&cc}yNM%Na%)S>-aN<io*^-;y%MarU=r&uW
zoc*jrEX>HMT^#7dhgjiL4CQ-F9pbw|l=m_=L&5pD%Fb>prVGTWO0JT87gj>@o2~P)
z`coB8@@}spSBmtHt17C2v8s(b6Do<e`s8NEPn8<fE=DUhj0gW)N35EJzKyC2?U1|h
z{H*>(SX6WpE&$y0)aNk61PrtCTBGSW3RCpz|E=>6|J>WR^*-nj>pNOxt3U`vY0G$u
z7h9B_IX?S6;I-*r%VTk~Q#%08>-{G6Bs=obkBrOhZl<`9*WzHHsewhr7g?)FMEQza
zeehH4*~;b8Q5<VI@M{0`ljn`!Y%dUHuOV}9FsJiD?ZRo>m9Zm{J8a!9LYLS4t)uA1
z5If^j7?6Ddbct+NyE4kJP@wk830B~116%&o)PEB1IQzQxjp4=wy>La2Y_B$4P5z)i
zK}>GKCHvHSsKP5ezVh-{S<t^Bv$#|q0Qlv<xRuC18L><&3RGeY)+4(m7a3G$FXKxM
z>&y*o<n%Qzj-{T!9|@Kejcmn0XSDU~J6<5`+z6u*M-c#SH9S{fb`uLE;OTwXbP`28
zw-}+>gdHs`Jxuj0B=aQjzRyb~=cCm0u`deFyN@qAD8}!7>v7~qc6bBI9ruCHAKZW2
zMecl0k0-K|SERRKbAwx`Q^v0|EYZk5ZCD@@qW@H(hf!hjM`YeVp~*L7d1};FY3^Mt
zbx)7OWN;rXmzZ{iW&INWPUrV_%Z5^cjS@{}9vv6ASsa(*QVLA{&8Ktu(R68C-3Mi0
zRF8>&I;xPlOggUA>mPUX$7uJ*J<#;^-#I2~o@{j==>=D#%`2Cv!CMyftl#x5d<I?D
z5(ToHJ<WTTx}>}^TuT%5jGC<qPbyjd$z!MlD!zmANCTc;&b<WP*{9nYUiN^ZOKy9O
z+{-P)N|%b_1roUVI+-S`@Dj>jRegI$nd%E!n`KYgeP@0tl&LtA=RoKtjATjjnlzj#
zuWP$2hm!B@F*v%NC8Ra|{aibEkwF-g)Y>X$(D;R{)Pfyc(v^Q_G*o{lPU}N~OX6>;
z=UJ%qx*;kl^7G#&TGY8b1zj17)zp|;0lu-J`$nZA+-A($Bn~0^FPx7#P|qIFt===j
z&Au5rS~sFet}ynoA3~NsPOZ5<TYpX++a0J7wBF~s>*CO?&OUqoq~Fy@k|E<YWk3FL
z`=fBu{IFFjIjpi*{mCWA#q=?yQbPyba}j`$BumSqTd4MGQNR(gVL(AL&`jRH+p;<a
zRVDZ|gNz~~EaP=~%VhUkrtjng>O}X7B)v>%*f(WdH>c|g5CusaVO%ByDQqXHoFKWA
zR2AY7tNQa23YTRfg)j7~%%#zKpYv)l1$BD9iD}a{1vDjubRM9JXL?yLn*~}0ORuJ3
z%im&4iG#c}CnkL#(LSGJ&p4xCfM*B6N%KExzqtA#&M-$g164;Sz>{So3mr>~gxqh;
ztWEzlBVuRKGg&m4rt_A@*c+z^aIDhE`p(oUm5%$!1ASMgVIp`2ZHCL-_>BeKe13K2
z-6(ns+F;zL(SWDzm@k~b+2d*&cLa-OJ!kkS=(GCB#&pJ|kIOY1N=?aZz`TcC`=<@z
z$f>?3Yc^Eqn`1w8_btR@iO=fU)MN^7HrP(6B6KI^?bAq6@@=BHuv&qW$3y8qO{1hl
zhxZQFvs_)dzHOTdo+^N*Pm`<ki{4#FJH3B-Oq}03aw5fe_NuCfw?f1xAv7`onJGwf
z>!uYfseYC-m~2QBn|S~{c(<$aPQs#Pm&jvgaIsH33)t24{nm(}#_+l(UHLwqOY{Q7
z{LK?XG-VYj@^;ktD76>=OET`+Q4g%;I<KSQu}F%?Y6~0N#49C9K6d99fD3IQX5vuE
z2k#K%Vu2r-O0uizlDtv(_3qhp#xy?9=Ov(m(X6Sf6{I*(ZzS4o+CQ2gV5BnJuyI;r
z!Q?Wf^Jsk`oj!Rp&l<yXLij%Uge4SG`l!cm@a`Xul4ZmlJ;k^)P}<?o-9Pn`k1?t0
zq}0YkrW5A{#GDeN)uf)!7LzSW5%0g}o!k|?_eM5`HqF+2duz>$ru4b~;h@&#^XEnA
zO$lNjBy-so-HR<qy<SF>ew$(NpoQ1J0=L3*&z`gQbUR~2Gf(4|{65c@CQ&TU%sp|9
zd#33#U4AZjxc+D&BbFd<bcRVE4%;f#IUs<?o?sBE1~FM;nXA;(`1q(0L|r&(6x!7O
z+?6TU{#x#*5}lFvpl_jIB&Gl3uqo~Rbunf40dWVA^qX4hKES7uKJZWv;-mLR2x>Yr
zD?mY4wYtfL)1JJy6_L0;BY7_;l~3Jpf*`*2Rq<v)9ftv1D^ve^2rOtN#yI)n&ZeWo
z?Y5FrcW5b419H3<REJJl;lO!LNYR~-HGaQ!&_ARMa6zZ|7yNoU(D7}^up+Imijt3*
z6{i6Pr1Ta4>eL~=v)NJSV|0scTzd-O5O0WuJXaU2<F;&wjilsgiB9Id5kh*medxtS
zYY@HV?%>;s6yaQrX2=-)jv#*wFe5{$dj6niV>ycH<T4<j$rVO*GV+QNLcSE&TFhO4
zeMpIY7STL_79{yX-_herVSmqFe<MF;-X%-K+dz$aNZ^)Y@8?r;Iep`hQ)kUE`31o5
z?gg}~`*@8jzTws8<%x9oN-W)JZjd&f_-KIH9)qgZmI93;4NyowjQn>YUv>6?KUqtd
zw)`=MPADW|saX4z)y<#F=aiquc;QFjFY2<j`SRbt>kiVFS~=ELcOh~-E*rL=2iBQa
zlsBAi?qK7CBN7eG%Vq;}KRi+$&yXxtr&{N>9T2ot@LSL8(_S%gM>%C}9+8QgQ0^Fe
z-Q`pG;CCnd2;EzelC82zmB{iS?o`%O(dIYJ`lQRJrhn>FnOt&H1LCq|>*)Z4Sx+Zf
z3r2JTplfmsVz7lgQ67q5Bpmo_{%}FY{;6zKO?9fK9K1FeJm6$rBBLgBBCzGNxcEZW
zPK|cYHD~|SL28AnES@=VsT8@gwzC626FaS4g6^j+hkv(!LUsGmZ9|x_^5<({-m$W|
zv(rHnQ))xM1k=M*1u@adjxW80T3<ak0os8^UZ%3OcgDq>DahEvApEcvs}2f2A?ICA
zi^PJZhTH*MD1o@ja6cED{kMA(BR{)RK6ZO=bpdrH!)ohamY7vPr=)?P2Dlpw!q%Vj
ze1aJ?jPpGW&t2mSpw&$wZSvFkqCID)puOehoAZ`(93v3#N)>IQd{r&P&Pl0%9+`9b
z?z<~@4P?$OHz{KT8Mk>L`up`UC;jLcet1+qC#Q$mtxuiFGJCr0B0xhWMdQHD<)2h;
z_it&rgcTyHmmh9_f)_5vqbK3vZCJve>%>^>pMBGZiv4}}61!JB7YQH@-UCSqRs(W9
z-<dgzuv>o$Kcx3`cRVCRA%BU1*Z;&gSoIXgRoW#c1v$|++r6BzEM*U7tjs&lKV~68
z8Xfz7{hnUmSR-M|$he&^Q=Y|MYUc6r-<s^Cw|jUljDGfkr#U#@<dO=dUV^Lw%|!>g
z`_+fC#LreT<&*YK-l-Fyz;h)<2yWfYzT@cGjsF>$d!47C@GQxe=`vM^m|ygm<i!Ks
zOr{UmmrB?lbp?Qve#Q{R+RreZ>yCUu;9YvvH=!9%wLZPIiTHS5u%|!2HXg<{Xh&l6
zF(6bxT}1Slj^^JufqGkFL};<ygOms6t9&?%@oVN}QppQDT1P{^n^my=w8hV?6&mw}
zMm71pn2w0Hzv24H66NH-&!?x6{}TNNp@E0vpEe~2_Ur-#HP~Cn4<{o{6_SLCGutBc
zKf#ho<?F-dUu>5~T~EC0L;tmWGYY<wwQ>87B{x&=A$k+euZUy>#ac@zt<W!l%Iulz
z{AJj`r8Ct*83`$cHP5UCnd{WX!<MiSW*~V3>rUbM2RiTYPe+-SX*{{#Ux(uq1WidH
z?k5)m%V49$pZ0v3NN1{%#AW9em$SdaKdW8sn4d*lK35im{M&gto?z*9(}7J%QZjCe
zo>Cc3{kZTxE9+jL2;-iR{9)@ln%+;EH3=yy)eC-WI4?Z)(}&dOUGbA;d(L_O<o5w4
z(qB;UCsl7FI75qiKg&8fUfh-N*}7XATQJ<Npx2SI9fK8oW?r^3M@;Dnm2tWaEq#G^
z^e=D{Wr%wIy`S+o)cL`Ktu?|o&e!QDSwt`n7CwQDFt#o8k;&Mp0dl1u0Oc=-=J&pl
z9;E{EzA1>QoY;=y?z|!34<%UTt4cK_9nhmGKl=9af=|feF}b3O{ZSZzjMhUoq?53S
z$qe-_&C+^Uy8d?5^PdXQVQ16<Xmmvts_`B_)OlrIPheVUSjN~Wh&D7xORB!@axtm>
zww$&98g&tQENgRN&1t@KVpeI5AoF?UGG9{oUa#ws5&>4VgMdX9zO9<;N~7e;*!4Xr
zNHyS}-tuJf)FriP)cVT5$jXbfh4eMosy~USDqTEnAJV;;_>~vSs;_CNSd!SN2<ti%
zBQM{0k!^?-g&7Cr`o+0c;GP=hvh0kIEM?SAwg!=it@Fetw}0Kv>i%c??Ud<N_|Ngj
zFYG=pVU)xb(AW^xd*@N;0waQA`<Au*i;oGqSyFB%afjT)3v!z4e+qUK20l0?jIt=?
zRa6I3GHr4J7pL|U>fa<hm?nl*R>Zj}CZ=S7WQ~Di4$6NMTXGXZdx->G2q8&dZjz!{
z0mz+if1ch>hx7Pxx&slpE_W}+={8f6fOcsQRw3HNu|>J|y$t04=yWXTQwd~!3JaVH
z6vY00R^vF7gEaOFd`gETxOA*)6BKEl@bNxQf_8MQYbWx=&lBBf1>CF}OqgC@D@jW?
z58K_!aExL0OeK^>>=U>ri}wu5{>;0QPdzqph0Q3*3z6%|Y<!AMu=zDsPJO5O;Aww!
z8YIhWP}{6X=C;R@AO{X$JlMND+jHwEPDCO`$ba`Pb}HJyA5vO^1@6yOB#G1<t#;Q=
z1$xBh>u%?{n)P%=IJTY?R1R?@)q)<l7T3%A9X9Tzqpm^0{pCRQ2#yf=l6%F`aC)0E
z<g#^)2EOF`a?X42*1WSdji$qj4r1h$r?VX|C7;S~Avmt)k3!Ms6qbq?ArV0bEmf_R
z1NzlZz2d!o>_-K?i+vsASEiwa5pu1C_Ui<XGD>0E<SE3`jKg#Rht+-gT~!s>Xjy{&
z1<o16gBJ8(&!L2Em`~ejuIF||xpRp!a6&=~+RQaRZO?{+weVXHmHF5Ie!puL`LI(=
zwXy8}YsHry>}QoG;bs;$ux*$KZgvPEQgP*MiUxU2A4af)1C6kQ#mkFiAVY_ns4_RL
zr69Al_n#01`emRC8Ps0nJJ;+nz5d@XU2vmh1TzWspJQy3gt&tx!a#)gX1~yiPbYO>
z_cSHg{5z>@K^l4R711A8??Yu4kLG=U?o#V0T^GUK-d=<kEIAZOD6d{M&C+4u)YMye
zD(l{@%0gG^>h=L!=XrgLl~OeI!}kA9xf!IAMe8(dFP{=DF%q7{O`7-9>XFgV(gq42
z9lgBs!XluHlOZR7xqtWF*HkhlMo5op6QN!sx1#pfBT45jpb<x`fOZCXOvZyvwa4E#
zI(gIdm{cBfsUAxLK%0>+4}hsEsx8K83?dtMzv&ka5YMV{<bF;WggHpD!&Ka#sZr7a
zPJ2JmQ_p@Ylck&^--vs_KkAekUnRB|!skROt4$`<_xtT!FZe4><mB$irA;b~xrjtw
z$tIBxQEI?e^0(aj)}l%21=&fgw4!;-_RNLz8q11j8olYfa#cSpsMP!)7C?Vg<taxJ
zxq9BwAu7?d;?ArYZY1|l`^}61A_Rv(Ad0RI|Hhb-S|<hPIyFHaEJBCq^~YJW2N|sR
z(jp(p-g8^LWDZ^lnXC1Q3RX`Qp)NcMSXaBsn0z@?bP;B^faYN1sGYS%Oz8&b%4|0u
zQYg2to|aQ_A+*Gmtlon4gpk-ygpauXbUCCYcvrjB{5hhss)Nq>+Z<!;1>f&iBKmI0
zT{62guNVZCz}4YjmfA5`S7O@4)|1Lu^jiy5mCDlEK8sY${Nfu=Ah1x=+<)|99O`M%
zhsSXh&2-fA{)s$;w+q>3UM)J<w@G~XnJL+wKzdpC)V!>{#O#72=3X=~6{cdtp%r#-
zh>;J(=h;LBefjY^m#-Wx?D+x2A*d~wd%I41x9-`CId35T3(kgWGSrfEMmH8H+jFex
zm3iM&c~<E8n?RK4V+6pKkH~EIT}J%{fvPdHp29oMW9}#sLNn5Ul837r(gUdwY$If=
zi-*c8Y=hH*;BQq*CEsN6<Mx#iZIM>O%<eLm(imvxvmR<|A%r@u$D_ic7>wxt;)|h)
zHJg5Bdo!W;_UW{CpCI@C+{^b5V@PThGgKzS_&UCtV`8s?ny%+?e98GV@Nm}u*_=+i
z@zr1PUF|G~YfhJB3EdLOD1FbMIr@vZ66oE7)~l_`O{wO91dJlKq4GRzjLK5}!vBPY
z<FY~8<YE*Bu)J8gMG-QfB0XfDWMfdY!Tw%}sodbjvrk9ZeEgz6>5A{oSeI`5*_c|Y
zLdar?()$1a3(gdgpL>0UI^}IuaD}hqz*IeZ2vX&Xilc^N{Fvv~uUlEUVM`qqCV#+~
zD04a1rPHjuxM^`crJKQZantL<=Q;;jIQlr7cfZa5a-oYW@zTxbFPdFg8SjIFSzeiL
zSFL;(A<vRpriEhvw2NVXHC{^|uM+2?)D2zhM#8%iW^?J=E*h1G_hz**Gr&1Tg)4gA
zNZqz=W~q%z2n9+dNJ&m%%Q=Kj=VmND0QZ%*P1)?j!GQH4Olb;zzNy<X0BWI;UmHP%
zA}n2-OZ_qCQ7g*p6>hU<g*u2gEb1Ir^_2_ZNuo=KG>o_nTa@EUkcTiLnd|~Fo-yGk
zw+*>lA3i?Lm|ogWx*#?T*txb&C0v9N(4BQZC<XjbVT5L^Hf{D&c2$YsJsWnLe7elx
zmV5l@M*P(N9BhSrVg6u9-u)&Ji}c3}nc+_l=M<~pY{Pulq3jr%q@dos$Q=KW=W_vg
zcGOypvite|O1`jht0z>ilb7Rs)br3>I<lti0%*~;!YM)p4BBTULhlysjaAiOVvb6(
zL{6(6vyVVC?#ir~dHjwj+&b>)kM7Nf4divs9ZJ_ZS5uHFcxC(Li~$202CsmDLT(OQ
zEcL<=c}J!*xNTS0Ir06VBcD?9YjMc7W(dQK$K2o!Zo0Q7xJ#rQXMvr$y{=Nr{;=7v
z$G6@eyxQDZXA&H=eL$0LWV)`dl%Vne-FEl}C8m3`Uin9=Im*%^1dQ!u4xvA2K=T);
zYt3JWCEePcu<dLpIfav#?I4Wo4$^w2_rgWwDl_5xq3>69#qGncGHDAZkI#_tUH^b_
zL|01gDG=oYg0zifDd3|#Zv{w3;cBm}OKOgP89yCY<}As!rOi{7*6jDpXPzohdg(GU
zL@RE)^?znqgXk4TQ7I!kOh|*D%S?Y)nyLKU`rbMl*%}+wFVt4gmc;FoaKb0}zCSqb
z`&5(Ee59;sxq8XYYkGC@)|-rnv8DoHRAj2Gz_t0g+(uXP{RfF=LoTb|wsdX7?wN!x
z|KQLwr$Wn-^_V*!TfYDN{kuelw@N(z7}`wk>vYs`6!HuZKXtET^C1u@yjr#XTxpdy
z^d*P42Boe&zk1t-M%%y7Ext!E4uwI5=&BR`Q1a&=>7Ft%O0Lo~v-YEIW2vt<S0if-
zynBeD9q+{S2cHVV#E;S3AY4~u8-+_Z(fdl5f~H`@6rCc{=PTWM8XY!L!cL}xQ!iR_
ztfDt!Uozx^k13(ZP5V?{#!3!D%?~NRhlu8~mxR6gG+O|E#|PcKgSGXY$LvTVh`W2M
zENmMhwix4XgZleG-=>750$44;y1k9yIDPLU?nYle0tTEmi5*G0*7p#1F_@x1g*gnX
zRHYvlX?ba^56c~V0iEVQ@?^5~J5EQeCtbunG|9y;?}jiRG_7BHE(4Y6+Av>Ny!s?*
zD%kxMCD|_LX0!D6a}F{P#y2gqP<}Iy(Y+M(&sdKT)Yx#$@mv3g2rBi5a_rEJ3fN)Z
zG3IDQ58shJ-xsyrejou&Qa=Aq+ZE}ULznnrRKAR3C<)&2{koPB=Yu_##_7sjC@0pe
zYaK}RE$21mw%V=tdj&m8nb}|5a;MbyEphXwP70m}HJd}PM?!o>Y1VIm!QW+D@S+e5
z@!0t~MPe`#2AP#Q-)=C3P9L{nCk$bSnK>BcVYaBG+uXWAVsN?WzCmg7lucdw;NpwW
zo!B0bGgd5W=*r&3O`hm`tMRg{vcqr|7xc=U#&<*UJm`JES`FS`=KSiAvbg225%thT
zR~It60y95XdN_=1sQOb6yfYR!Qrsni?u*b<I$Atx6~WufU?(c-z?ZM`4cDXVL$I_V
z@(P}?n=a%^AUqu%badL4pNHX{d7<p8T$^o`2&e246S?>%Px8I+M&a*3h!f44CPH@%
zV(78S8Xr?dU^^uya`P<#ZhG5*xv!5J$_r?{A*j_1=#5*++H1IAScnV<oxS%b$-^Db
zW}afQkER)~HD%T^;9u9VhY04pfN*&~Ke8wC$fVoLlY<)qh2-44KA%N#!dg1!7fQTy
zP3MxdV2ZfeF1QlD50wg35?ORx->(u;9tinFMDg_s1b%jVpy>`d_3`j(>I0p&ce!6F
zboOT9>Dx{Qq+uibi|6@?x82(LXtZC)MDErY$CVNiN`RE!uU$Z}*I%T`%b>N}vBrrK
zM$dxPrmM!fl?rMH4RnXo0C-2VS|5FPjVn5cG8-_=GSH_!BNRTp(2#XuaPmGOJbcGe
zCnf8LUeDmbtMAKA@kwky3pFS_ja`Pf#AniR6ZQKG^ot_q6oIDqE#?47{Y|*o&(A6%
zTZVljLbE?=y=QYAi?pn>5j8bsQpjiSZxcvgI1?Uf1>bqCUh;fq0Iy;AyaAGQ5<*lm
zg{QC#81#QXu$X7Uljn{4oh^5lBuVxv?o^WcHyufV*Z60K@2g&H?-QoUf5c~Ks$jeC
z9HmyRB1l6#ySe;W!ZjQ1$bk(zd|cX8A;-0Lv@@Sc8;<WdtJ0Om<dZ_ybmGOTd!9ec
zPb*k?$MAqzx*7Es>&BHt5C5C7N(_^9eA@f$v&Tfw59g}|w8d|Cdl`!@j8@Q_5=<f3
zg+56!vMqbvC5y!EcmVmM2JE4I{?jQ-$^Ohu^=C#^njO$6&WmV>0d=dU#nd^9;5j+<
zzCG-l_|{0#R4Lq!Fefi1cYKuI^|kmWCU2$0k$<&-K2<nv`-lo(+1D<%csX<%|7icW
zt@B|)o3WW|Z72O2cJ79X6WOHPg0${|<>6;hKJ4*x)L9<3G;4Tknl)24Ohz$IrQu+E
zrG6>x@c4Sk-{LTF+A(YDUkj*BWcEx@{?2;(Yz|sRCjWdMzq^%j<uW7^S>w^R=+99T
zevvuUhLX9gIje8}N{h|){KIWoMJ=8+jJlqwT++D;I!38qHw|rJ35aN1!N8j4uk3;P
zh(GDjC)fWL@PBt?W`TkGd&6GXXZ``i*KNB4#)JL#fWHP?B+8rNUXDHuD2Q^&1xgpI
zU2+Kc9lK8{;^sI|b{N<9x?hS+lm=U5bybsCk(>3fYNTLj^n1ZSH3&S%c_fJ~LS13k
zKNx<c&zN^`F(e{0!d?dhU6`VxO4>kk=wQSjWl7${_OGK7%Q~Z%TX+h2rJcKdvw5wc
z52ZJEJs~n^E|Ds)EhWJEPV-S8h$cPz^yQc;{1&wxT#2%9kRPJBJ;Xne@A`4^I)l~r
zBTnHW5N~(>CM)KLO_tm7)0Ita_lnz8O8w&d;-j7vi?qXno2_lAatl_v4J98?(Y$7=
z<9kZIZM*_)FCN2Tlwri6<H@5O5u9-YZtzfMe=;vvPGQ4(>{QZ&W%b=wAMr9|b=U>E
zBex&Da&)??V&i{&`-=0nHRmXJ=(6FrrrZE0K4m$<M6Vn0%a#}Aw!P}hZ#z`33zOOg
zmp@^v(((OZ00>_+)e1BVy7-F0^c*s;2$}OVCwbs{8gb$M)U(&)>!zhN=S#GGu8!l!
zNiQ<o^AkPg#Et1mrzdA6rIy8TJ*Vbql(f&_@jBCy3=NGfE!MVrhslCsy%E#;+e)se
z>_=?ws=u8JY1Oj1=Wp^|055Gnjm>Oa3%89)yaJ=dqneY;891}cl!`pGHQ2a$kouwi
zXC~8++ca!8KIHkd&5^U4Zl5n7UGo0ZuCD4>WjLCdm6k=<z1Mg&9_qYxYtwWoV3N7b
z-$T+!R#*9Ni)PJ8*m?_EuZ*aa2w5hId{<-Aj83>sMFqSSP@e(C@wwIZG}eH5(7j}J
zCMxm*iu)RBb2QXS=_Dz=zciI1DPO4dsBZpFrQbY>41d$mkxbL=TC;ph|4=96POzBl
z`>bt5%b;O8k@?dT|3#1$P;8$&3h*k40Fq$(^t!p}1-i0}LQ={&?j-zVcbN|C-+wuu
zyuEX$p`EgxwpXD_X}#M=O>>?oZi;2vlcT@Zu+@0~^2cnz7_x6{?hn24hrU|Lt#L;H
zM*--1RUl-&PiVMoWpPw9IR4OLX)CNb3$cga`r;NM+PQ@RE;#n4w~{<aI;HG$dlfV#
zGU}B(UU-!D;B7LznCkdI-d(h>t4vl&K1xLXuqKeBC2ODF$-;jbT1?zk;oivhy5Xii
zFKB<)w4!o0|GcI^u$E2+-{1-pt=Qr^RrA2zmY`>M&6=>6H?J*>x)k5G(5-VQrJQni
zsuz43Ic8vkzu{iIjyv_PMf)rDTOitQBPV*I9-}IW!w-%IF)tQ!E^n2TrPFI<C30pf
z138jtfL!!C{m6O0I-a>cTXR6hEYXOIu28Ey=d<(8=e)>$OU$1$mcn;7b&cpx1?<)9
zS+=TB>qJY^-jcnFYYUm-#81&~cx!Me!r7p-(1ko5x333{iAoYUa5=|lf^4OCv}vNw
ziNSMyiC+Wk0w#UdkMGePIZ!I!eS8blyd!CSBG>_x+|SiUK(~%oTu%WqPJk=Izv;6#
zkNnAqvsZj8<m3J4dU}V3Ifw5(x>MVDg?5UTcWrswfasNIE$qa0iixW$oL0PZO*H9+
znYWe^wOl1yZj4%;u*rvVEFc4Zg>o6M=OfCrm8aPz%<jlEJHz7l&XGXh=KTw!6;j=h
zRdm#?YWE~h8oYAVe=S5i0ZwH0Xb5P@N2JW;|Ke5zy81=cIw<k7g!&8z+LrAP&rAm1
zW;LB2=N<ced`o?4CrQ;5W3O<?@Q-Soy0}y@Zzzqv>2)~E3&#TccL;*PgY-nl!93dn
z1M%}`Fyi`pD`|6uUrp^o&Xqry=MOYyUhjP6aOLpk*m2H!f~^d6%~unC=(N^L6mHUC
z>YUg8BEPfjzP+$2b%s%**<|3<*rdt0b2SkF&ns!Rp(i(aXZ&XnA&fCl_KVPN?NL~<
z9RcsB^!9gc2CIDW3Y=d||K4SI#*%+GzUOtU#v7)5(ak#>`pnFL{{wST&A)}Y=>5Mi
zmv;c-C)OiIp^5HgVQSB(2!1d5B_s^U<+E6`8-Y{SxF9VavO^nNn?uQ3Zx}R89`TLt
zW<F=64Cs3-0?(@GtYz!`rq2@1qNmPt##rg%KLDm&n4e0LGU5rtyjAo6-4Guj8_F&#
z!6UIkVcoJlSLpgPOA5K?*MiwD`yh*!dGK3xGV=X>m*(mbvCdHua2C6}JX?sj!w{!J
z^ry4>nsXg_k0;a$I~Z1(YEJ5G(_yhYJ)t!pt0iltsX3x2-)6R+CD1uUsrBh8{d?%&
zePFLn%;pB7YaShqQe01I-=dlGMxG0$ED8ToOrMD{2a`YpqWidN*S*so)2NOXYa_le
z_ALG4D=qhZ|G6oEW~dKjWo>i*7^4eqAQb)J=0)bwc&2lZnw7J#dLFy3a$>dK%i~fk
zLAJh@TUO&mtmx&~SLl(5reF&`1<rAK;`rrvDSU7$Bh3D{5VUP-n)R_WL+I=nA46!{
ze8fNvfrr!)@f#NG<L_);KHzsG>I!tk&4>#Xo$nBc$TQn!$KiF@<9Q91@}`ZUK!fHn
zpHN;;nYwvTIi3lqEM-G~ih^>%z4F$z;mRyos3Tf^inSb<jDOli<J?<g4uaTWFC9Y`
zjx&`V2+MM+2Y8lc4epl_yi$1B_kv0}BzN+!ZI-Qp`WVT%_W0WXLB6f+?pJAA-nJ7~
zsn7n!Bg|j7Lh26o?q{uBHsBS{3ed<+@6syg*~Te*^k>P<9s^EA#`r|p1Y4~|G1rwv
zg2se&30IsX0~4HdI-D$R2tlE(?1n4&TG_)E!siT0COH|WXRjR(<86|3TU~6VWN$Hg
z)CDj;@iCe7;}rRT{V2dTc}w^xVqp3x;zO?a&4#@39R-C`8O;x()w_>*HTaHIMD521
zoW`T`xD`Wn?}m7G{0|c+RB)mbm`S&#F_QPhfzTwhj^s(y6N9U^l9Ct&Vev~IP;5v0
z2UoT<SCzh-ALp0BLkwIrHuP+9r3yvt<JZOxVb>NsanhWP!C&~gmj)wDNFCJ<XxzAS
zkybS@^vno{Rbj<K!TV<G?F#-yPMxtm3G1zCl%F4)u9?KvKjd_Ma|v-4s+0R%#{QM!
z3qNJgX!ki+R=jl-knZ@>lf^S$pTd6`Tz8nM?d4y&<cf$|aBu1!D{bkpC^1~k09cF^
z2~sagJQD+F)RC?7`#irwsHe*mp~M#`hU;#G0g>w~0huAC2T}_+@IKXCn+h97dk@CP
zDXNUca(yrFen9RSf+0OyrtXg09vlv%1p(cpzPI{JI_l(9$r1FVdC>x`H0sY2r|hWY
z<G?E)vq!^zr7_P_f@y5}5}qfkiFL|S{Mrl9^QklzVUH}x-o8D@QOoyk5CsY4<}7LA
z!c;6$bQczAFe=^hA$|$1$jXUq2W2=HK`xyzZb03wrINJjroa365iqzr1{^V%C%Y0f
zJb<rD2@y~@?FL@L_B<aghpeF6D8Cx@sfG@}q3_8j&whF8_*<~!z&eq<^WMUxmuqid
zMv1Vj?YE|*3DxC?4U5Z}POKnT-U_x((*+<<CUFXM-}9a2r(nAB$5`+}7?o1r(*pTi
z*{&CTPt6=@Q0i=F@=)A$U3v(@-b<?+2Wy?PVy$j_yOF(hw#Yx{bX8eUYBy|#$n3Fo
z@az=_8#}10bkkQ$?#tY#{4RtEELHw2b@_6*n~(QbD)+@3XkEnGJc32t6{J**eB%r@
zdn<>g(etpo0H*d=UPR0C)gv~|nvIP{EiD-r7Ua51Qv#b4>z5M1jRj<rM&D>C$BSU^
z1F6KdG`xRwX%Pc)>i?Hkgq4Wt470c+R+aq!#T9**sbLTxOk;XQAex~`ut_qgrrU!m
z(`@)f7<%uW@#KeD1BEb^a6+;#z$6|?hTBk7C(++j`qwV1)>Wu<zhmqrtEGA(W89tc
z`VNiP;5ts~WWJLFn0|8FwF#xY)DB4rQmU3d(alr+laL(X&dsNbuEqIch6V#&C2=@Z
z5tOxVw*F_1U_S%kW5Ry@(-14rIfpgysdPW>P(&PDDNJaOy7vM=o?6_eKBJqeAgImU
zGMhb#lH|XB-Wv<<d3Oy6lEabA(QI_o-LtP}Jt@$%VeO;d(wo_Y`d7%VuA4RiEa4U%
zPbqxK+kX-K1+?dR093jQeu4zB2_sE2*D-Ejh0uX|2?yjr(2645xYg1I_;T;2?!W>R
zvK~zdUhv|nv^%gK?GC1aq=7;RJ)oaf&F0T;SJBaeK7~zSmvvH5_?|RIIULiTNx%6$
z4JdFg>EU>NeT^-9q5`I(s|{?i2W-ET=Ha1vxQ#zjwGMG1-v9Jy)l+`)VC6#j`rDrG
zgf32C|90qev%hl2Dg_78*4NkLn`e|fd?7cDNTsH;@QOArg|kTfU&p(|?MJ0aMpqwV
z&Uz4RZl+h`vpyC#e0Y^-zS;^o4A_gvVq{Y6d4#&sg^(17yT_M|sw7MA;eI*!nwGkJ
zc;39ZwZg^m$)~<nF%XF3q5vKNL&9X}=e}GsUA^WMOI!{I-Mqh=@Gu3zBT{<VvQFbl
z+P0gHZCO#BV1r{lORW2z$FbMZWl5V0Xnb*Dn>ZUm;zU#9Gs8SKZP;Q}hPM_P22LU~
zGo<rm?#Fp>H*mShIQE*r-SzMs3|4i&&07^;3(&7)&yw0sTpXo%PhP}VBnWspeY)lS
zR1>(ALOEvSj+x05SN*`wZ(h#E&|3Ijzb(>i_)GF@Eguu|gZN||XwIFL@!&==Jim^~
zbL-X1=*d^bTA{QZhHBD}oayd@P_JZd22n7Y4HTh>a4Mbf=0>E)K>e#wAgFv~|DlHN
zM!p{H%n#CPz*|}S>Bloa_<qkILmHo`_K-U3|6UHzj60@(Bv;kya!4`{YphKb0!v6G
zrW7i^A`tsZaKA+k>SJK~a_(|;6Y~5e<*Uj1Y)i5-)e3tp0fL5fj(~=rp_YuVlqX+U
zvx1c`gc}=Wed>Eq?Rl4~B2#D86u_N`K+~g>V=9KGxg2(eJ@g+7@Es8(pznn5*T?XH
zw|#s{lTkIXO4SpizgsS=ZzW+U+M^Y>AG(1s>dVGL{i9F*V28%=*@q9n5yBy!w?!}*
zWCix8yvke-ct#r6Ihq5}V*I_Vwr_H^wY_|w<2)W7)u(u)n?qo%j2)E!KzrU*N#=)d
zg-6wlUibZ{-nuj=!k_RiYoq!s@$${*TMycgTaFU+v@jDM)Jf785d!FNzgtNjExUcI
z1nQ!%XWJzJBdo4{JAc6L`vYmvU<->hY%d?)GT<YcTnRT~Np+s38n}MrA6Wstl)h2b
zT@Be?ub|Y0VC09LuT3$Censfk4t(F%KcD=4ap21DdFL13wHR~D^Z15XNo0NnJg9rI
zPbbl~xc_XikQ{d9g2O^sUDk9gNB0yrZ^nFJ?ft^n$LhmX^??B=l(>P7z8jkDo7EfC
z=Ne^ay}`E)$C))<=liy?GB}RYTKuk^q1n;JQOzMvS+lQ7t!0j)<+i3ZWd8V&#<J2U
zf9wVqwB&p~oDS{plTS=rMcC|<xOLr5;*;8Pj$>wFTzMC>s18ef)6&Y-{>Vqou5{(&
zC>c2QYsKFE3dmXliu?-o5jY^GB>Lh#ubkjvEvPntHY};@n1>Yf>1uwUJ^2tLL>qKF
zhq;UWj*j%W{G6cff0<;nQU_e{N+q#QNqDpWex>rFUZpQ<^)9sgO?y^0XmNRFXruI1
zM#9&&nfkvq&m6SO%_=?U=1goRW_rr3*7cRf>%aB9TiU}s#Mh<6n?EBJrST-gKBZ!f
zvrs`|%EZiPuF3{_>q%75=y3(*pX56z`Xpc56q1A`2aBvIMuq?e*OyL(WM5{+%h)Lc
zhD>7qz5u*PjmIa4vDgR9ZD>}#@9oetljDc#_!&)Nr8^y~NobTAVyUD%21-&s0dy=7
z$s4Two0^P+Pr@{E1NecU$;L#R_o6^LhRBax&+f%>61|CjN>$EJm3TC1^o0b}a8l5t
z`r@Ghi>;3<iHhexA{urvPa?4fUd6K=T50*KY|7BGn98%L=9%Y;SHJBrN9w9B&z?|P
zi8BD|BDtI3Lgk+IV$bJBj?A;4YSU1XMZPOXl(oe2@BxqiO6%Ci&7|)NoskG9Xzr#o
zeYu~&Vl)BGH^`3<VLva87ZJ4-ToCw`y=hW-<GVIR{l5UxKrO${;+Aeg^FW4wRT%(j
zD`Qs=uj><ABM0bZ-TqW;YTa0@SQ$qY%$Xw|herQl#*ai`=WMiS{~S6|a5g8-Q$CV3
zim-meR{p`JlsC7V_T5eP%*?ER_>EWp`w2KBk=cokGJX_ky>8wQ_x^D67QNErTt8~_
z3agC^>t?iM?1y+TTshc8O+VLeEXIw^%>lP@<6U8a<7Rw!B^dcyU1TNkjQ{Ym@%}qX
z${NtLTY#Oqj3YYMp^o}g86R-q;zX_*c+-J%f(IM><NC0wtZBz%ov3ls=LuUA`%X&U
zVqmT8g;n}~yCs~j7`GR#xg1Aq)ERQKPQX0Jc)<F0j&tg59;++Re&EYGmA5tLZFhQ|
zR>X#LcBESjk+XmQgLZGBPFYb#^LO=HfHu=_i?OHq0mcP<0EZrWNcj9|r*QV#tL)-I
zLe5_~ep47}6eQ-7qc;9ZYJdzTxGF=;1)T0e1xYhO65vGuj^h|OX$?=JQ(guV4!kK7
z9r-*ISHmf>2*fxgBu%;K!I41VqP3(4l@U`$P{mTmaEhl<PQ1Yvu5>|uS~>WZ$p_wq
zwQ7NE0++LnM%IMx7I2gC$9k9S)}6vi4P6dCJ?Ofvjn6{%HDu>Ok2U0!Z<=<T>`y0n
zilcNtxS~-kJ(W*mU%I=_DYSaJAH8J1>fEbfGM&W=3{j0Lg8Ihk$2LXgy&U!NA=>6&
z96z=lVaA+5{;*YKG(;X9vf+j1A7;$)yJU{w**Tl4OdLCg!^~#Z);R)Y-gf<PC!A^s
zspBPm<6AEuufRrH?H0JecB+2&^taW{7luA|lJFlpvXLeSQZRYJk0#>Bfpzi0Ixa1v
zp1o8*z>Xj}@>zd1d6nv+(I@`x$+mmB^#Qsb=uL6W7U1}rV_)`>nz^nHcDLPhX*lHr
z&tDytDb^xeAoyAbha2Ohy(P!-R(=dbzJSO^p6m^}A{*tMJX_BRmdBH}z{?eD617^u
z8o|u0xjI<W)(~idtdDU9$G6^+^QviZH3eEYyN+kkJ>!c^KKSfM1L7F2QC>}IH*6--
z0<=pmT2(f7cGA-tIRE+y5xbN|K>Uw#*5aQe;D4kXxPtJBDaU^azWk`b$)|YuIw@D@
zqg-jhkq-@U!Qh|fE!)OdJW_q3^&p3?@*qnoAwh_8f)l68$|weQI5D)~Q6@g{ma>-g
z03QrTOpvmqC6}0=l%OTRS4I_2WRTXC$~5rk!$Akz2W5^w-US_WQ0s#@C!hQohn@WC
zPmf-SMnYqO8ZAIaOFLvw){fkw!1={4U^zL7eNhbK2@7aFfoj!bC9hakyEU}f@^)u!
zjxQe5kk{F6O#c$K-T|z`y6{c{Ip2jkzhtj-+sExp?kqc$=d$U``-7&(gm8kB?|a8X
z2GWkcz80EW-8+#6GWNs}@pFfDH%$YD{xK<Px_YKtJYU#8nq%Elud?>i@zS4t%8vK=
zR4=s3<*B2nwL6P*kJIz>wSKS6wn3aQ3*2z^55tH4_MsD|)i~6lx9O2h^Q9j7#vy-Y
zWcV1vK*&63DzF}LC$Nu+*}9l9Xb|<B`5=T1&1$f~I&<De$8BA;@mV{zRcl*pqNJ^6
z(7J>;A6h&=gfQ>P0qtu=8zNX4^W4~k#sa-9ph2*AdvT23XuU<Y{Ezr8;mAbBPTkZ8
z$zqK>lO8ydtVz&79-w8Hu_i;GCSp;(VHQ5}qmqUfe6%1;<%0(g@KQQxfEV?FR(vek
z+TrUN`y=HcE;0~PVg-c45L|-N2nI%8m9=DB9_58ExhZdWKwGRtild5yCwau=o&TuE
z7CD0D1itXX3q!mv3I`o@pgD<OXsX1}IE7`26^hjuytVqD6;fo1#9D7FE?NBn)~X<L
z`i=+BgKXHG;p%h=k|jlF$%zb;pkEz2_yDP!gQc?vl8H3>5K8%DR-qf~$A_G)l>_r5
z8w?m1(gmU%xxNI8+6CJQk$)h@7VsRUKv=NO!B?Suww>|2RiEIA;zT{$6{@3sw{u+i
zT<<z9x5LV7Jsu78+smXjbB!0AEo^&~e3z8>S<C6IilU`x(shm?8n0Q*@+2PL*tIhj
z*{uZ#$FLicA5=kVLSunxuz(tCr+6Cb(7%q<*5?Egwifn{5t(z1AE4rtSeO_~#KgWX
z+m#?Rpsp6sysR<4EAo^SsxBOL#0H1jW}@U7ftDHHpy@ON4sR^#5#=oUe5W@`{dhO}
z4E=<~V>96mZ|qge!B<SQ)^XM_6@~)jeaN>Me<pc+mOSj~NCyq#DhG$o%kdFDOIR$v
ziseJKA}<r1So~ywR6h97av_gcc&Wb?`Q+O|d_rx3AV#1rF_IDpmH^T)1&6ddU@ay9
zqpTPN7Y|}C0{EoiMF3a4RWZuA#3$81O;he+l;a7`;J3c@tuBY1z?~ev$G_-B?ij{7
z{Em0LBV2gFg_(9u)L3A$EkMW5hpJ3f^(l2!pSW%EUgUgWBS^pIu0`2o*K&1f$9?hp
zwz{e{SZy*x_)b6;p|k8tu!)90qYU&1Thz{2?7JXL9x+Z~`UJ1d*|OI(SiN_Ou^<gT
zUTDxr3#L4+@vw6>%(+-JMrY(zQPR5g*$pq=_erw{bC+43A8OXQZZ<yn19$oDXw@&4
z7pqrJ)d8B>0-io5*aujnLy579w;D{B?6?^mO!*4A1G@&?SYR?NK(9!9MlnAbTGpjS
zUejzs;76uKJC=qwNCp}Io3-<BcSiGa?NiOj7+0?^b3&avguQ24y@+Y6tX(~*uGLkm
zhMDnoS-dsJ`WX31y}YdUn^#S}25VX@P+W<PTyGv6=^S(we2zGM2}S>Bgtq_9I+go5
z<&1?NmB9b0%77;sz~sn9W>LQQAYaE+Knq@{ARd%^mltBuX^U_n6AM|2$T3Tqlov0-
zz~v%<qdes(O&*2i0G1Av0|y5>V(|n=aME1jt5`5-biH7oha9s0h8u4(Q2pUu?|PT-
z27d2*-y6Pl=9#$w9K}z1(v!Umpzj#I=)$nmPCNOr5*J$f=9_NL@#{=%m`%^Du9NdB
z<3+3SkS7Fa;(`U#!I;D2`Dcb;J(S;gwRrHI54>l@1nv`i_E1~k)nvzG0UjpuYdj(+
zLW&$I%aoz<THB<(dVBU)?nsR=m`o-zE|+9^U-ZfujXqvFLLDZEwcDNhutoz_Uv{k#
zTP(Zl%K(#M2&OM}$-JrNiOxFKQXR>0B}|s(*YSYNScPbG%atSDgvJ7sZUJw!rX(#m
z>0GfzPrCBU^`md9pJufp8)tf}A#=Jp)BFQ*nKL-nyZZ=1sq=wXes!l=u3Q7@WP#+C
zbwcS0pOm}7_b}GY#*GC%mF|H+kECAyF=Shp`uf@0Fzr`8w+D+_is?6m_{^f%&K9<R
zt{-KN(fnyFKwHsOzco6w`(1X~Ib3?l#rQx!YZo#8N?niv6FG451kwcgGjZI~oWUhl
zIdE`@@n;g?A%CXIMI%|_qrAEbe3d4K4*|H+#G=cAASp-zA&D?$PFe~}py=Qu8p^of
zMLBe&p%p%r1TOx-DVKc7QMna4uHaqeXX6YswFY+m5>7t(<b203u#^7lB;Pg6ZeY^F
zV^=V^1f4bPndZ;fE#Qq(t!wPkr%RwOq_Pz%FR;2pm>mx+dgpETgI(?nZtG}`ai{Ap
zuP$vhA+*&>?UUEh>_N>x@TOf5ZHP5ykeOZn3Y^KKXRzp<vqgQ}Eo{>mUlnh{s<uFU
z&`Exzu{PijU!{$8^_hZppI*K!%;ps{1f60cD(zZWpY`2+wkwyoN=WNQdZ3Vv6>UGV
zvLo2wJh1a29(GW%iy71=G!~d_3#7dQO_k?SZh8Y_M1J`=&b-c<-<!hx!bXo-W5~%B
zv3u0l7#8P<9u!S+MGLg-T9Kdwnp$s%;<14F_}V(32YjX)UM6#$ap8wYf3~xX|ERG7
z6O7M$ys6`|<NC;tO)}lIKB%eI!`rRlu!0s~{-D*4GIZ_jC{V@!h=Md(n5~HaGm($Z
zG8_+_q>0-WxWy+?RnqXh5)cv84|NyBoR~6Q%1a3Rpb=l;iH{YzQj}9BJm4}SY03zq
zt1N#M&lx%bf@31m;~#WhFvmi?@)fW2oxy^kd~^zb#?BT#D6osT2`g*?Z%zDBvsz(&
zCP=(GDqYWaH5$OrMYY#^IFB{|Ix-!sc;(%7f-2OgQr!Z&`HHJkP7da>Hkqkra6jYP
z+przmFlwi8CYD8R`jIG(kC?UNBi7sH3;b2uXVip<S7{ZqJ3MF<cYmgKDy9eJ+|Uhf
z0e?8<M^AUi+H#YJ)btvhbtTFuKN~ar0ofMHHfH$lFm`e^ovD%?8>C6GKyi(&b$1$1
zh_34AZR%t@6>a?>2P1uS-hMRNv}ryb0aalwQ5@TqZxhvIMrHx*J<TDuJ;wj~f_QmP
zv^LE;mA1VSLGx~OQ^(`h;t!#wC2RU7G#2Q~0-9f{5mjvURsE0YsRk%O1LjJ_;Da5R
z|1*;%ziOHMwoX-a2uo37%0Q;_$_pj|%BviFoWT+-!%?2{B9F1OJJ^yQfa`)c7yN)J
z51)SI8~SKMdS);VUXF%Hox~Sjc+oP!qG@&sFEh>90p3W}+Qu$@as@_TT66@{=@xOG
z*`k+^WaW-vgZtuyxa2ZW6Q<Mxakl_F2I9qip0-eIlUhthIPMg70n(;7`VSqWtRIV9
zzi=>FUy>7=A6n+tuMZp6Z!l+%y#km|YopX=e7t>p;B|LhQ`nA1Z7m;bWuH#*^mV_U
zX4ABr#@<IKq>aP}Z!<g($P1fntgy?LtCs6oHxSZ#k?uFdF_$sQb{^Wi>u=<kF2HB)
z?SdIQTX@ON8upJ<_RGA%Z!9oY3(y1f7%9PeG*m43<ir|wnWt@NwmI7BVPD5&4ZO+L
z4eSP9v^7M_c?N~9@_OWRVR5XVka4eE>(v3x*CV>IQ&=rNBp26-^;81CFF!PTv-P<y
z{<xtzs~#!U42?{82%`tz*swQI{mnXq&)R$!cME44p?DJ-3-qu+eD1QgQlY)*M~Jw3
z>&Tb}*pL5F6CZR+(|E__|CCHBq%`uWgM6!$c|fT&Kp;fm_=6w@E@qbW;e#?50w?I)
z3+P1$?RvY!7o+F`Ci&pWVBnMI5-)HiN4zA1JZa=_uuC-1v#GK6z^-4MziD9i?>jDd
zM-IY4e9%D$=J_;Hq)p43bYp>)w16Ij>5Tp`%CE(CHKDP<YP0|ghWYtTwo`Y#J6lFw
zM<%2td!Quv0+-kvJW-FhV>vEN9HsfwSfH`M3R=LIkNl8h56w#pOMYy_N~nVq%6A8w
z<A~!Ue7S66iSJ-u356P&jRjV#1?Xe$1m*`9`WTKW9KWoEv&UC+3^$>%z_=~IM@IdJ
z(-8>90n0qYrUh^R?kKkQz5+j1(7P7wxF&iV>tlYA@$>Z2Wg#B>HUbkgEE@~-vVfc+
z@;NGx|B-<Ik>;z-uJ}0bw+nm%Wu$os1eYKl#Ng{gVBmoRFS-Kd#Dp^W!WXXiK~I^2
z%7LK|mj^jyl@|hekYK0^07E${0z+c(!2vFT@o6{W2w!rF{K(?~7Ozh7!9gZ`q&zg_
z;X%xm>IJXaQH^C~yMIld2b{rged}92&G8Xsfny_@Fc}u0(dZW>&S+X|fhzlC>t=|H
zg47Aj;$Wpid<d?lMXGx>iUupSfOfEAbMCy~{~m3C2PgHRl-H!By#<%n!SuF;=lrGx
zJHlZzce=zGM$=5aHE=!5R=)5yM-xXz5I8;pJ8!aY)>7uv+L*f?@=HzR8a97c$^zZ)
z3lDLtCFC{98e!i28CzB;<l~0vK$<i2<9WU;ZCi^`&vf~d)*!D}7yPm!AD8K)jLQ~t
z2Du;O#13NgV+Ugs8VgLN1$c}j&^z=f>44Gwq0eMvP3$>~KL4>Jm>*@ChjB`=9>{x^
zJA(6EsczlI>r#RSI93ak-JgEu(fsabZ6_bkM>J0%k7pVjqwMC*<<(%dxI5T5n(q9#
z$l2Fn#(wxP-h5b&ux?$pSt6^i1IP3SJ?Mu%+hz`G9U;MYKs@AnMSZ)g#@JG)1-naY
zN+;g}eQv-}_ouPZnB;8bL5_6V2x+#!6f?<D?%m5`@+z~W^P@~Mh`|Skv}9N^_nAr$
zbOA^DfCF7huSu3NLXoEnh()cx5UJNdz(oMA3OFFkOG))IDNmjY8hD5=&Rqg9<Nyax
za;SiI`iiH49FNM1Ua-w90S$V<L$M`C*Yi8={za&cgWw$DvVb$WaR`@Lrh$#q0^UJ+
z7mjXX3j&>S>dw7P5iOX<saKh-bRZ}zPhlEJQdpB7&H}ycKixLBC4p67-W)4T9==E(
z&Ro5zO&~U-&uOPHI{^KcPg~&nYwG!w*qdF0(O96dz<4asdQi6IYyL1g2HDw|VNdP8
zayHknzshc&VSmN8wS*pnE{%xB0#j~*=opME8~$?q3Oj)p=x4s5Q9R`pZPZ^C78uF8
zG+)@$_SpgN4d3mh6pms$JT5v@#yQ_*cMUyo3a_(H88@l$qbT04*{JiXxVudyro;mH
zEEQ;)JTl&A7iq54!RymX2FFK9;1Q2BxCHq>i3ya!gCLmF<mEFJ4EeT=$l;PNo~eBC
zl7Cb<g2T@%<B8;tm<SQ&NT-Tu7!fY9DngtJwXBaN(1Qmr6emwi9wW&Jg2RV2&SCK2
zsQ@1?;TGkKMs*NfEpe|SA8__^mT;%g&6(VZrh$*g0yHE74Q}-Xb~#xM?Y~d&Ho5Z}
zoG%1e0sBHY)_hVN!Gqj`x^zz+<LFVww}>-{zLQEr-DnN;iL$z<dV9ag7K>AB6WblJ
zFmH=uc4F`)XP;iYW@%OHOPhUpJx{woury9#O?2!|qJI`gqh9x7Pz6_Dtv{%$4P9n|
z<!xd0I59N#;B<{6k@b)`J+1Klj}OlF$(#HEb%`g`ilJDAenuFdrftbQW3R4r@45V=
zuQ-JnFYKXyLX1?=8Vy=wfz$%@4j%ow1^QY)y{4TPls;~<6H;?9BMhC(<97VAT%0S*
zb%<qUR1K`Lz<?HDtoI$V1JW1BXzTghVP%U;99PDEyX7tue@0}^F&E8@{b&;VPI=oe
zh^Z}0&*V9k`QLX*XZAoBoW+z^3(M=*nQpjorZeBBq<;%|3#d${vAi-te~3PX7zr^A
zikQwrkl!-xOqA1@z~#~eN2P=hj?%>7QO@I_;J^sr>H?=oE1xZ81mTjF4!|fE4rTeX
zr)TVs5I`mnOEK~Y5)OIFv}0EeUByxYeDE+xoA3-~kyn^9JqrUPNWNlZrTj2dFZuAP
zJ#^dQ+i7R8l<4I!7G4uK7O2w#OrAcOXT6YzN1sf6AzY`VmF4Ai98!fip%j?dC}bAQ
zfu%Tk=_*L5U0A#66=d`2wn=;_T(Gl3gMGYX9Up#4?sqR63{sB0xMJTl2b0;FbK=au
z6J{1z?Ak(|*Z7j)ccb?$Nhq4+YPCSIYpTnxmilH>l~pHe@M`xfSkb5g=Zf0#5%z-(
zA9$PT!y!D}y)lc#{}wY&Wlm{RiVyE_>f(|;+&7`IKx2WH1-#EDgC%qBqRp-R&=lw3
z7H-v4!mcVwgV$J~Zwt_NXKaIlrog@#bR)<baoiMS>r8~TCf$sZJ_6i+K(YD8-J~nf
z_+14yNZ2ms=oDtXjDwhOaPZ?!iR#_z-juCk3yiEW&<y1h<-yFS7K`zFvhX6N+`FyC
z1m&Sk16>JxcKCurNO9mHS(J&lV8rs7QU)zCL3)t}PrOpNe6o~#08kbn5@Uo2Pl}KS
zhfC$DaWIT31|QJ_lW=IYa-}@QN#%pDvcBc}KxPc;3@4v_va>t>MK3C4>mQV}bA-!6
zCz>+cL14bXG1L2khec0KS6nn{@r0CB8hln^CvAI=n%3H?9x=ARcH@{laRl?aI`@^z
zMu${%7|Xdgk~-TAUX)cOKN4NKF)h(^S&JyKTa~&LaeP&SE~PRHN>;%skkpY?|F6PJ
z^{awAkvNQ*)<67#(VelQAMIF><6w$A{A|Lrox+?e9M2YJ`lH`?6Is>_C(?$EQY&PE
zRy$F9QM^J5t!lBp&hmb1OIaRP#}#ahic1ydaJx({PHCLN>(<$M<i3I#mokl<#scHC
z0Igk*f(5yBiY(Z4na!EN=r3_j=Qt++q1ETy*pEchDb^UOxS51IS!z1rt@}Dz`un=u
zRANjIOK}}oi-uNVU#DlxeC?UdDV_NHQ@`~g??-%O(dIp$ggOz70&Y6Sk344UWs@<(
z2j@6jnR$;NW^EU9G7Jo%g~l1in&w(r8??stA#P|Lq$r|}$P}aeMEXBXztsOq{k2F%
zcXVzG@-7QV<v=8)gb~v2m_?9`04_!%kcKaL(h|&0USLvCWd_QPihRlm;wiqsNQ<v_
z3+tw&bd-@_WT3A*TzJ8Sfny_%KmLUlUl7PE;P8#`3&T4uc!$6q<0z(#<0MZ0^rzd(
z>dNR0APia4s2Ei%7}CvJfYnupiQvPG!la2ACqkkAmEiU;=~Dr(hfnx6q2`X@xG3nK
z^WYTd;W`b@Vl0&C$^GvZymfR(=|<iv<Gxs~%r@?@Z(%OO@wQpd>L-!Xo|Fz%?wfE#
z)6Qvna*U%3EP7{`!rZJ)XSQQ_l))GN*?qL7t@jaL1vihdExco&wJpP=RH5O$3M>$Z
ztPX=xHqK0QH8mG&oT+t<GpJ$AuKal952dr5R@Prool>d}cQ8e<H1h^$Kk|lwUA|M<
zUhK88%D>Of_~kQ8fvm|k7MN-aq&;SNPtn*wN!&STj$q$GXuZMuO0RWYnQ3ZU>y<HY
zU@L9`wHfA<v~{hdV$y?lysqZ;C-r5%BKX?V`bD<<bXfVHXd7SKdpDw27$1;(JS&y+
z8vvTg!6`h$g=iOVJD1rhY)2_AW=FxGC-dUqVHn!Mr8blkZ2|coW9Ny@kA@<+{GU9m
zZM2I#JAl0#CowPu(L<B+p<Hs51~<inuY9HdKYQ=4EX$Il=dIg5Jv5`*0~rQo&e-4;
z+Kd8Kn(;uO0LbizXoxuaJOYG)1~kklkUEABKnk1&$QJ-?AVQdP_PX%@+~d!R%2k)F
zs>rOYTH$-=ikpYKhsWJ3G7=o~C*B8cO~005=Vr2I1~G>rzykpuhvgl{OBe$_4NTaK
zVP-!xF%T05z_T(i+!|a+!r+2e^Ebbm4!8&T8yUowFq{(p>8A$_y@oIl%UH~Z<7!A_
z@J|snmoXUPgJI$L=w6F=)Ni^6UHBiRbVCS5hcv=lg6K5*6N^{`S2-{O`=fDD7EP=d
zmy5~y)aRBIxumRRp)+O~3)Nc3BZR2KI(?sil<(Z2`~Rf;`()V_KZ)S7NHGb;NqSC2
zc>0-F2K1Xh*d#yd|3xQ-d1C3U(+?fG2F}vJc(^``NYAuS1JQ5e)YLL#MaZG?B8^^l
zb%lk-j65mKRTh1`*jHaY{ysE73+I;cTvjMVpHM&K6!5D~1HW?Z(r^gkaG8_F=Vk5X
zi{-<7durFfXAR_TnzzM<eb#5Bvtr_~ff_p|-p#ivP9v3j0iD!kZLB`GG<bbJ^liz&
z31JMwd8I_3`<AYgTjEFiIiuA&ix+tZ?T=z{uKg2xXijY@rum)29~tU=HWZH!1P`Zi
zg&#mB_aa=vJhh?NLK=@WAD?m_!lvbdkOnTU@kw(Wu6g0-F@Rs=;U~_tD46~74)<#O
z^pF3^U%mY2|MK_5HHH8B_y6_bPydlq!aqIy?svZv_s2LjO#I*ehrbQK8FFg)_rL#N
zAAbAW-#+~O^Un|9%mv?`ewmB(C%QHc*^Nm{Sa-JxQQgwGZUK;!Cno$@7^i`WNwY3P
z?LW6%)N_2$2K}7yoXhWC^VPZ=m$6Q>e+rIqaiiiHSzAG=>qF#f{>S`>=v*_+eT4Ci
zsY!39NtgAsG>>#Ko<h3lnLd`MIr22%R!5#kgiiGiH8AdnIWXLKL1TQ&`N!*zYnBM(
zY#OJy-_Rq-<q}Py<aHPyAM(5$b<8WYthD2UK$pwXDRd27Qv)CIqiDQGQ`Vi5h7<DY
zB=5TapX<>0NY>^@+?cpQD$j1|b12!pmffAB$KIU=E?Fn5dC|g}0kWu3@`f5l&X~U&
z5#O8+etUTR{%c&ra2{z1$>gGS@lf`L^WIUJ#0$Q;MlaaJm4`VmYvq!PJt{><Se*u@
z)b|veO~L-rKl<~B|L_0(PZ(4Gy&f`~0FBItV12OFhGN38`jQLak0vYECx=bPMqt9=
zfNOg4Mi>_$9l&K%TIazwN?yRc!E+vOVry9fd2AteCR`Yh(S*q`4jbRN;5e@ZBuqXF
zNj!cE%KLTB>v-ei+UP590Cd3fLl`_{^l4+lPRBnRa8(2!kn=SWzAA##!9V`^7s1yb
zpW})NP8HYJOUx$Nl?ccEm*UMm9m8g*4A@r^>Fcpoi)V_&035%Zh6dCfX6*@IPtCo=
zUq}No2y>_KtGdz4xABxYj~*CH<Fz;$cb?0ueVh^oxC4=s9UZy`x&}rX@ak_Ay=0Ji
zm*s7oQu4&Bb<k44SS99~^R*IS{3z?Ol&g;$OVvZ?Gmi$+Ft+JW`Q{r2VA?iY!VX;n
zx32*kHMt|VDO7V2eI`!$#(MHRJ~5-PUga*|xWiX56_2K}A0TF<aFn9VdCY@x*YSaT
zJ?Wk_F#Gxj27YL2JcOBeY+%JDjx^%!#{f*4acu{!X()LsoxBF}VK;Rg`2fN-AHt3!
z9;ox;w;ZMwNV|5oAb<>*7-5(r40%k9Fkn0jh-+gm^n64aKZaYvPB$;-1qZs&<S}3T
z#QTyq!sInB`3&SiPSbS!EN*=T1V-W72>cZc!DFQ|F!O{_7{3PRII+qkq43Q?k=aJ>
zHI{%i1BPH^W8=pnnZ}<TApc&Zcaez6{vskh^EEU;yO_GDr2Y7Zouy>;!gmTk457X!
z9b-q`vOVrhp>qxnAKrNV{tt0|!-wv4iw{^pXr?hO7Pu_5Rmx|5Wty;!!mqE~52}=l
z?npaF3q8-hXn^V1bDGP<eYCd-8>uzcc~F?CUry4G?(bFC)wr9dyC&s1fV3%JBDsjW
zvM^3?N-_-6jFGIrc<or@$a|caBA1u$yD0Ryu7N9SKn<Rgz{B{YHcXpm&W|5UnHS>&
zSKdBa-f`IR``uiB>`%X~l+;senREOZk3y}v+!noI44!MA5rapq`-VPnp?au2WUlvd
z%oD^Ce@X3X#!<h7M!Bv*^fnVQf%%}8o4L<MBlx2`u1|W`-NLb+*8RdA?o|Vuz2S@{
zWFZC6%&=q9foOttGo(9VfAk{D_D>og`7sQWzs~0_NStXB2V^Hrm;BH(fAF1G-T?DA
zefZi>KGOqlt3&KF2-gfC1QFr@h#`~-;WsnqBW$Cuyn}JpO27q716&(=i8D>(ASZc<
zhd)MT@Zd)r08hZOK-2UiVa`7`3frBN*Uiz^ARVXO$^d<H@~>FnVKK`lPzEcEW$p+o
z7Q2hqHE@#};4}rs*yk5bJDw3|EJ+%7aw_#}erXhbl+ou`_4VG{XH<VD-8FEL2I5q%
z);+C13N%G1jQdYo0uNV6$SBNym>-KfbPcRp1Dad;!Idf21~J<0$M^5Cmxv!>`;Vck
zuEH+dWg5Ut%T*C`0`pTCN*gg@JqpeEF;es1HNfRJo{~lY06+jqL_t&u?#1Ttthq1N
z(tYl`MwQ$XPZm$uBK;jSIw*18h}HH-`)wQsm(3jc$>W8X;}jKfG+ol{)`I}{Pv@6+
zu*Jd)e9K{@FJbTjr{e<VpCSDn8-&Sh<{+Dig)>3IFySGNF!=~02w)+MLp(U(69;Yb
zVca!cc_Zw+mdCh`Cm*t#9_gexUEcK1_2V53IvmzO8Y`&U0##*rk>{kFaEttwokn*p
zh)%?WtH&oMwkE<01&cCXX+pnH^q&0!4McC%DV()JoMkAl&{ZQ#idz<clVn$4c7K_K
zZzOek&g_1?{-RU6oQC)o8`c;Ls`1U}t=w3+i<qyEz##qj_(Oa!Cr)(tlMk&_{blGx
zbDgoxUQ3a~yj%u|aE8dGrP5fTdrdjb7;iMh9psmfue*x#X*|>tn*-mB58j~r)bOkB
zzhV6AZx}4y9y-5W8pyerR?UgXJQb<)>|y+Uef5@7ZQ0}1=f=K^><|}A<=AEpQ5(;R
zv^E*n=*wN#F3Iv7=&qFGai~b6#c{-=7`sNUqnQ>%;7vMyXF!W?YI~U<McAA3V1nB?
zZ*@HCO|&$R9LzE)k=kQlM_+(P{J_$@44Uu6hr>y_$vzC)GHZu?OVvDlDBmLw<t_V}
zI8gEUEezJyF*Th}h}i$!xdyTgUepq?J@U|<=$uSW5F9V+2$P0O`eqW#IMaa!U^+G)
zlgD(y1ssQK{*H$aamF=YTmbr{1H^#`9hX7g&jw)-ov~($1si}MIA#nE1;B*?@jNgg
z&JX!*d?pU-IylCYH^9P~4w1yUkdDW#3k06S$VVP<xUHbWwKPCYM-xZ^;%&u<Q&{zK
z$pR%Qe%-%Z!NH`)eSw?Ft*t(K*J-QITcNi0dfzACzW7~w_b{|8?P#1b^TC=o^}mm2
zu5);ah37>yk1(Z=W7uJV8y}1kJ_c!4_iwM9n(`ERgiufJ8mKfdXPd3qT*+IF2zb?p
zmWGsoQ&TZ$=m#Bj*(HB)W89$VoQxU_ZCZ?L%;I%nUiIzJHE?YW!~ulZvZ=?Y!E!xQ
zyoOHuZPjh7;o#cky+!^l)YqyiXVo7CoggSEEp)Q0EV0hxLvqbI6p3TqD6>qn&NVIt
zbDriFDJhKX;<q$J6{>s~zT?VD3BZp{&ocVw+=oOHDtc+bJHIt+ptgV7E=nV^{gH+a
z4ht*ddBC%6(_!No2iN&bOHrTfpWuKC4i9uq!?F?Qba}(?eBgS~hYW-Vu#wgg5HS)i
zKw%t5*i0=Hu8qPlLKrK`r+*zbu22G?OCH?c6u)V~2e2|NIPrc+C*FK&{>bq>+js}(
z4yS2AHI>^FWy3n0|4*Z_25dK~g(o>W2@8cV1Z$Fu*HJIjM=r#75LvivJ0xfx6>YDK
zB74i-oNFhzN)4!e)1QEIe^7~j`1UF~dNo@HmYl|d<UD^g?!*s3l6~vM-^({GaQToV
zn`lpycIOeLQ@wo+MEj3%zM;`&&1#{**X$PbUrtWR<yGK3t>95;M#aHb52u0iYxS%n
zv@zBS`AsYS9RE<vHI*}C`8(<LXrSC-O-p0wVeZ7^HLW~~Q9`(Glc)EQ7}kavem%wC
zEy?NS+fC;dVoxdS^5fC47F?e7rt+kse48Zu#U`Qhsew<`q>I9y$KMk9;QnoyUYu4@
zZtCTr!lUlf58m<Jjj2+%5hKdS{3mjGVwkrNWI*CBa>Y^KL!Gx_*{Lk0ftVwfVm9!x
z?Gcy8Ow(fXhih9Yu5FRT)6~Gl#V!fh?pfphs(9nsHO*+kN{4SW>*C^vKlFG=Cr{0b
zyny3yc`QF^0T8MI1RjW5;93CU019P12wM>1?XQ_(umy-iSZLxm4Hw9CaiI%<Yk;;3
z0*+-fPxFUf@Xv*Tvv+qb8i*4soRm>5O`qD<BK@**(2%1w<7yD($&Udj`jQ6D0^ySU
z$a6~&s>@;JOO^YU>S!TZvrn-drBR&EG)@ZZm2gNr=>t-8x2t*qYol<UIMfuYzWn}{
zS6f|Br1O>0bKaH)V(yj5GSXxVzAf>mO6$H5>kK+RbLhel<4v&U#8R%;A9dZ#Ft0a|
z=UAy?<12$SV^oeEoR-o~hVKr9f#4X0210fcUswb5g6s+LSItfD*~I*tZP5Ex_ZC!D
z`=_gJ=<Cz7TnY1Q?S4+F&8v(?VtN(6Tdhx8DvH`?tc>KTd$&>`(8)*eT?ZNFEomtL
zTzGpe4uC06d;YoC$YS{!2IFC|t4SG1$X}VPCFAvL{j<<L=8y)W#+I))I*unQ?2p(U
zZI{IU_=_HZ<^>)P_D}K=#|912c?d&;hj?57I^YAunIC-c8_#J@cfM@ei3=a%%?}y|
z@`FoSz}O&MX95v`83YaB@YL}Zka%#%j3^wu$m5U4fs1h9;>R^j<0~p~$OBy-7r=QH
zH7E!=DBrlGby%qe7=#&+KXh{CHkU;-H^5ybL#_UrswYtNReuD)@yGa0#XCml=F_Fn
z+iYhyulW@hKrO-@ZI6`E%MUC(NRQX!<mL%HPltO5Hi+iL9~XqiZ)z&Q6Za}VYKqn3
zJFbsl0S-?8@J<75-#LjG7q`oJpt)}&-eQRU9-aDn!pDbqw6u*Mb7FIfQGR}auh#=U
zh4!p#Z@AHdTP3zP#!E;vf0;Xng*8w&n__s$NtTY6Z44t(tY<M61=N{J)Db7BCCSg2
z`{F-i_L$XbfJ!{QU0hTgv5cl8w#PVM+QdB8dOU_7H1iH^y+LxMAkKdTEs}$W7rL6<
z{b5l@4KyZ{d%!)xlLs%<*O_R_)kQ_H6R2E{iq3fWL6k8GU8mtG<CDWN&0j7@r*N|x
zpt;aMb{SS}za*W9Fs_Zegt3E?7r$wM16>=1!DlES9vs^}V|Y-QygcLqvI!@?afvs5
zT+2<mWg~uT7#kaeEd-hIo2dyq-bC!WK)5^x<Kr5jiBJIfc`Pt^<VP;&0he_1AfCqs
zCqHR+p>LY<c37<jG%#mnsk-w2YDL{8m~AZ>w6n?W!n!Oj?g|zOPE>~xNIC<&h={<k
zKVFm{!@KkJFa|R+bm$r=8i?lbX;nN@4~xiA)K-vm#xgxYPsi?NZ)Wgg^n6#V*5a0N
zBJN3h(Ql`(uS!8CrSo{8+7h}4x&}5H_&lG`em3d%;B#@d=7EI^S&ujGyh^L3EN>Pp
z_OT0%6X+rCRaDvI2Q2-V^i)1x6j#zjWrJmn-9zp7GAyNm5B(VF@g({hjLTaH{^kX*
zt8c>@Gp4eb&o-@VhlWyLTacUPpDki{yEw8UJG<O&PeK3K@aJ{o8FL8q2ZOHYL@A-e
zI!@OK#dv&x|B!b|NuggJNamp;cHW=+&!lok&eQ*}VvQnF%(7-ZoyvJR#;Qbr=sf0K
z&3#-T;X3&|Hl4?_=ekP`&}?jfq!UFms$Ak|Zl2&sw+&NXHf@oIcpkt8VCa(9_EBg!
zZ=DZ3=fx!tu6a97Q3Egh064qyN8;EZ9FbKf!Z3pXfFCeJ3c`t8m{?$W!w+o>i3>Q6
zf|`c&xlrKMLKBZtc<@^WTrBE;R^pt8c>Ks^zVdchr3N%G$K=K@b^=extCaPiP&B(X
z&COKM1-fAZAB;^0WhjZtcdwA0|5i_w-)pTLE>|ovg>uu|q;a2OWjg};YJOdrMLn;^
zdD<KyHVnqtsqx{1FH(yxM&ZYomxot<Fp5bq(u3b;c^it+N!_6a>RIG|T8~Rom+pF%
z7eDmUQ}v@wY}&ns7>_qIh!}<e(PcZF8+46VT4isH!ZR@KB=1@SF~>9aQA+*s`jvJ*
zOqnPCK)H^dde_y~3wM?VG?#cfIXS;tb!pghw{PeVJjxn%zqs^Zuh{ovU6K-pSFSFK
zkLFppLBdN&PtMD@MAfBkRA$!ATCWqE2J^EkcCri|@mvj@S2yS7`Xr;t;M$OjpY4_b
zKbt?t<MLqtBoB|{oR6@9IClu*p+(q6W_cq&bf5|TIKS<swzUdnu%V9WkQM;3F_>`e
zA`nE(#DZ8*Xdp1@2Es0kl|w%K#=~{N?UKh2aTL~tw!G#~y7S>ekH>Pk42tToW(~xh
z!etY5Yer$OZ(E!cMg_T?<~2?&qGKUlP99FEz?|6JB_?FJF_b*@D4|uvTWcpbrs^i*
z#z4+%Vt`Jf-D1m(K9waH{>EwjA++((U*A5yYxB!Tn{-;2h2|!?t*<O<L&q`zV}uTa
zuz0@6K>Vuocgc}PVPQRb?a@|@PVN3Q5MyiIaMgS^KQ7!>d52=CKMdf=vgX)Ws|Jk4
zJly*oV+<#Sy-8kzyUK2Z9qNcjanBk%I6?fbyU~Hir%G=T)Bki0c#Gw|DDxaYf~rk1
z2hx5%*rrwBK37Fe@%lqpQ*h_UnQ=a!U--_Up$3>v&TP`dSUVPHj+3*oE-VMGShw<n
z-#)=(I@BNbwENb$W0_A6=Q@<{;85P@>f0Mj%{0MBx?uie%;MsR_~<HSfBHd2VI8QT
zf&)CponF$OqrC=V9qOu?NIua|%(S026PuSz#v+XE(M+(H;%A}+2$K)j!-nmj;5lFI
zS9I7v!6P5EXpGRQ?VJh*P12no9^lp!H8cRyz=H<h_(9l=-efi+86oIGz<@X#X5|gS
z!~vx9fNv&*0bJ-hFL{V_0puNouW`uZ3IP99{?P5vHL!XOa1ZEHIaL@F5~uuzJJwb&
zeiyK7plg5yr5-lLoHSU>(8NL?eg%->MJI(Z?%?mxHPAJ%UJbDMWP{AOu{797Fl>M|
zUOdY%-N%llYvR`U6=MoN^lFOX?U?W1zw5>#U0KxEt+!U0UEV8eAPkdqq?y)h7+Uyv
z<1o%&xxBECACK7QYTnB;yGXe#<d34rkOpEbOi$&FyJaQm+-^VvY^H1<MO+#zaR7@q
zo;BG&y`V%+Y`K;lnMvE~a5lUuKA<-II*v>bA)_<fg#qah=OI71JcLPiJ{y)Dr=$Rk
zy<G1Aa0P^~pa2hmCLfi9p20NX1AlPG{E0ISc{{9K12G|#mUW9pj65lv)7q(%I%@z<
z277ZBzk;d4wA9{NZTzyjJ7p*O)goi@QGSJOQKw-rzlDM~(s+I#Y(oqkw$S5-;=Dep
zine-h5Fe#DR4CQc$NP6}lGU$uQurwTAzH`M)W19-b5#Vq7&qed1$iY)8k?vMVfK^4
z$28j0M;c&$8jm|{pl$&y<siTM%VIy&Oi)ma>B5T-ZE4JS*Yf%4*-PRH1R9~lk66-8
zj34@8+6Lj=tT$rP$=s+0at^2KaBzXsbgWThUcvZFmvYI@Sf527I3u4~wsx66J9G^k
z)BtNd5Y!Kvw3eJ?HPJ%zAm>Smka%V-SPmIwf5qG~0VG3wlR~Jo&GVF3AQN@GQShjH
z#&hl=9@EZpfUaWxm9@$9-t+T|%Fdyz<>cs`Zbk#N3MNHtmH>?wTO~l_b*lk~cwBeB
zXl@DvKI}@IKPrb!(?DMAv~`^GL(}o_hZb?;&I3N_;F3-la9oD;m&7sDg(0JvS_tqh
z1b*X_j^P$CLj<gGEex*x6c)dg20iD2j>G5j7l{rxp#irVge{ZBO~`$Lko3r0U_Zs;
z+8^CGMv{CTzJLbmKJf*LdyhqYdwY!q@9brZ8PX?(v*BPAe$m2~=N=97v+J}o*sFm)
z2klkO*$LT&WoXkW%WIq#hCe^zvN^^`$4RL;E!8Xg>^i-NjQkLvj}9&9S58g=zrO0n
z3r_Z_(d2A%4<+qo=o+|=2ErJsA6uFM9TO-d^CYZIE19&ezd7&tFw`|<i}|lUDXjIg
z4aC=wr}JE;2I@|<cKc^7D<c6-ytcpMA7Fe!xHil}$fJ{q*f@&|VDPmcT=MWhhdfS`
zH^4Z!7Rr1at}Wuk0pK7j4|H*%QCq}KThV*@lXllIoPs$}%4-g|2gHgbWaD|%!vuMY
zKtp7eOhesg*ajyaZMr@*0mXg6$`h+=^6h~s^}8qQRie|buabTd1Al8Jf2!}I$LJ?w
z<~G!tZ>QHz10NqcW$>ygOh#Ew9n1%eIcgCaN4Uc=Ce&yzdGbQs<5$<=t@M6Uc)qIm
z0+c_EO=^8iVQU3MW4w&HXoZ3f`i$4@^M{?d+c1m-^yZMB5;TXQ+R7T_t(vc&9`$1q
z_X@x2N()~F;14G>m!uQCng(=24{$#zQ-|uD`9$~PV<;gt8cX;p?8rL#&(PLOj;gs$
zrg1sqeEsQi**b-_YoJx@;RiTq#Yx_evB~6oEzrlH32laTPP=llznp8HOnBT^833Ty
z8iJ<&d}v+z$Rh^9d*Q)>IZiLy4X2gS;q&uT{P>k0T$K)6ReozFc6wVH$Y$EKu|kZ+
z7%uil6Q@OByTn#W9FIFQ@c=la1Nfn18m0*@`G|KbBM<3p9-R(-pD31hpbf6`LC5md
zIQXH*V|j=R2H`1xoEg^wns}YD7LcsqkO$X{OiNKin&}c}B_XtVnFg+vY1&pqT?iY7
zogccp_!HmZhBQC}aAUY3vA0BZ!`+H30VWh)OS1tyX4qr1Y)tS_y&Z^G?`})vRVnxL
zVyqI6#gl>uaVqrgy`BbGWU?Tq*Ux%CSv7{l{cIXD{GmDcvXbRnKi4>Ycs=cR&a-GB
z=CBRrs_AVaSLPem6imRtYK4}hk}ZGO(J5VC`(0=rMMvh%-14kPqlm^Wj0&t-ymSY#
z!`)~g`b4bQqW)Q%GG{S&;ZGPh!g2VxHpt=bcN}{@jMF8bPnJ&k3u{1qE8pJ2bkPp#
z6UVv!l-cHtAM(b1br=fTi8@g7+@l3*3=-Ga+jyk2p`N)nW<UlERZ)zG+jg`;{_a_u
z23(s><uXz1j~H(0xLy?DC!KhM@o`DVehR+rsKgVl@vwiA?rDm2`yCH|@(}Mh=+|Kd
zx9FNiEiZWkAXo#)7RpFuL^#Le*1}pTiXM!(<OPp3(}A{yl{Wx7C=M5}u=vdvmkZU%
z3qaROHBETn_fzv!bcb34`v%#l;5kS8T8N{5NrNoo+30A#l_6N4YMC~UmL+%m;ur?u
zJtFU`r#<L55gjJXXlPU|-L=D68j$X~_RiAW;+dkJXzLmaKG<N(`-pXAMxcu^w(zC}
zr~TL*U>Ig``@(5IrN4(^2kA<OoKc=m`u;VL^INthPkU=DH4;Xjl<Su7@S5Ze*~*w9
zJ8XGlN=skHk|hA%dSY=cp3K+WNy(jx`QsKsSc6Ll)OobfK;1X9&*t?YF+UaKZyJEJ
z{?jkcC$_u&=nJ*qPs+L$-%o<{h^~Q+2GmiSUduzrQzysBoGqR=Q2AkpRbLBWF354e
z9!pwKHjS8d#KQFXL6Z4r(b-1Kx8^?y$2wY?)jFQ<{n*Te)Qd`HHGL^}n1`-gYAPE0
zBX&#tY~(npTiYOGd!;z=z;WZS-BM8j<o!jDH-mIn<GQm#*LGC=q(jH)HGlA+0bZSt
zJj9RXA+PDkyZeN&Gmi;49@hX<2!adP4`bp8yRh<Zg%RHP(DVZy01fhv3o+)84B(j`
zF5#f>0Y%{sM>K%qYULh5@5vK1fKCH6nZ@E;0phrOjprELozYYcECzNd!TLC+gP#6b
z1JSNn_;pyl2DbaK`u&?0nri(RS7w7U@x^$~!d8qv*dVCQJYkHc?dZKY&{ne0noSj*
z@Io5!m`<Bo`AQ=C1#0may26EGj_&#^Vc*|h88NiUCpJ^&u2t)ZQ_74R{y<Tf86-!Z
z9AydL;dV5zS%+F?#{X#k`mu6Yle%9BiMn@NaGoh{tnZd-s#C;SsMkyqr6b*e2I@X>
zNi%0mZ#k}qEMW{zsW4nJf6&jXZhdwQBn`%YNYq+5o8*p+xq^7t>ukACEE;Z6fF0a+
zMY&|WO~)9xc{Bqu55M!{sQ2)F9^9qFc5$kWY;f&Jo=3^eg4|R-VHzh7jesy4JM53X
z(xEioAsrlSl)vgBjW7>j7aGntPItT;A7LIhLh|wu#x)*c@Sq2O<I9_X&^3_R%yCT!
zznPi=VTgi*-v(ZJBaXB&fJ?k-;PL>DhZX>?X}e&S!E|c*Yd`4$3yvRVdDAX~o`Fig
zS|=29ri5A^%XNz`lNx1Va^Y2!_!x%@veCBumG0ME#=(Fjd29Kn%6u#3oLZia*EMj8
z1{l}g^+BG8mzOwkkbUT!o-~~+V~z%$<fnf7%q!@6@rILr+?TeQ_NUYAm|X)qHK3+E
zZq4gh%kPvnB4e#1-&pSbIhId(Q%B`a;rty5B`+kcDi8hSyf2^FVieX_9%4gWQg<k1
zA^CQ2?ombe?sz2_&XA;<Q+i$tvC&vb-b5Vm)$~50okHkS=GGBc5aytAT9<E3PyN(`
z+Bm6)SEYfcNBz*JC!j%{L4s?3JekGa-@Mi_19%GZFw>ev(nWS1UWi$z>^Xz+LVa37
zg!T|7^vWEpHMH&(e&BEi>2d!$>8&-;>8(ryY@BSD#O8?67Z}?=Gj{v0?UK;2F&00~
zivb{-nOyM9gE(+$Sv+I@rUQRpQ$b$v_JL`T4o&loLe!Zcj$k!G3kDIVLxgx90D=Qi
z`OU=fgn7970T((H06%n{mjeBu2fD_^53c$9`Uvun2927Jf?IKfJDi~bEB1`6O|ryd
zRf8=CL}a-|2-&MyGYr8@EP`>FZpBcV8^a>M%QmrcZl#P9i__7%22R%i{a+^w-t?il
z4_)7oC-0czW(4sJqp(=S-E!);Pft0m@+u)eROxaFrRLZ)qa>a57tp|`abE3j)h(;c
zW6W*id3g=hWqp3=q!*uyj8pzvsxPueE4s;(!rGP-jyQhge%5A~J7%?XuPa#TCEFU*
z_XTBOyQC@^PO!0#PUD3lhXV<zn5-*TpWRG5@;92o8hec8zUJNmy<SN-s>GF#xUQft
z?|L0Zzia}`VWr(cF+NzX*3h~sCOx(9ncEs_(TJr#c~Tc+ELTXRsj7*_4il*q7slU^
zMRTx<&Q%}pZ+XW$a>lz9SL*VI3(->>X@J_L@nNgP{zw<|BX0mWyW+52l8*-*KZF5X
z+h1)Uh6nt>^@(G`^=54sFUR2m<R>3t)08*jpcSxd7fPZtj)@QkAZWpfg9-Uuh&q3r
zE|j1R9{BJ_3E-O-@hHv(0T(b&`@sP$6ZtSE1JDDwLb1ao8t`D)6?v8xnV5OPxE)59
zJ!GusJ;|$zM%LaQR#hcknA_06_H>k|v*=6DFBo?`mCaWc#vu$l+#?LPG)6zlIGwKx
zr+nK|&L>T${ADyiW9!Z8;_8kKDObJd#21Ik;$w5By1*JD-f+?p<+wINbqas}y=wf(
zLsE4m*M5YYe|)nlx+~r5KgJUv-UMO&$w@)hZfYww8g*SA(7**v_JXVj1Uez9l>llk
z9olOEwNgcK{XoP0)FU53)58w}aR5pEepa9mOSKW{DSqR6()?$p3(R|4`U@HKrf=w3
zrfHoNMudFp7hNx<j4i3|IIuc>+7^lHQ5O3nc1OFe5BCn@0Sbdn)5cw{jc}s@7d+C5
z1MIJP;U^y4nm+tVvr8Heaqz_tINdZdR)5C^;Tiz~JY+Ug!hnUtH4QTc-%5cVc}y1^
z(~>s;eA0<GJ_+Qra!3Pe{_qA&6PGyi3c5>=6$o@sFen~HHk`EXNk_ZNVnZ-46UCce
z%^q5>GB|x#-nGYVP6(}C(go!k4>Y~6EU5h3U=_w3wF~-wew;!>g2o1o4jK@?$17;u
z6Pi=nJY_-##_{iZ!YGU^Jl|d(zU!x1UQ3S^_oJuRdF1F+zm^7azN6`JN^!+yS6@Ip
zuY1-eEP4du<mcOWU1O-tXx<?qndcolf-(G6fqbMW>NM^n*CycGpXsEOuAjm9Kn2IC
z;i{sQ&9Vob{->D+qCdr#O4G<2Ekq}_(LO))RkaXx@ZmNzQ3B}Y9j6mBTmfyCA5){v
zvW>h!P#w3>$>xOl4eH<wk>h%WGxD99#cRQ5T^qL5K~E*L13#`ZpzUf*U`%HJxtY**
zWM~lOAD&EVu6drZ4BC%6m78md9P`X~PPZOMk>NpeV7zT7<>K<z4*Ps`jxpXJ-kVdV
z`=`wh0JY|)l^Ffc2yBjEfE&|eaj{nt_K9B~cx7QmoN>u#V1gl@yv8GKOrJ0hxXzDT
zFZwKx<si*Cj#Jc@a-av@fbneS1Y8RWL5Cd&Bfw#&yI{B$-1!{_m&eK?-QYCSgFXeR
z!_YZ}ziD^3YhW1-uox?gZVW7GWLbuF=h8LMHE??x$h&;Ckc{2^0`iMbjC8$aRGU$|
z{)syTEAA926t^J7p~ay<aWAgH-62RI#VKw@inq9Ha4RiP9D-Baee#}jX4d(ynOV=*
zooD64v-iH``dzomtIFMtdz{h*gb>37)o~8VO2OsUI;S(dpf{hs4Y!Wb1~0Zz!{7y2
z-F{)upl*NBAL^-|%Ujdk)g{>x{L-}?$ZvKgwp|nUFf09+`F^NF6emXOtw!~v%u}1-
z8)_@sDIvxh!<62Yj{_Sx6Jb`UcS6?xI<g(sbspf2NBKKY;(ukWmU4~GX$?sE$6lFu
zimwSG-hPc0;q$Y4vbW+oLn3oKKL^tLwJ!F0YL(J&j?+tQ#$I?4kx>~ATp+aw0s7W^
z@;RBCe$_~re#m)1;&{(F$v&PO!Q0`m>NsDD-wQG;`wTU+mGk0IXjD>GGc6O$`;heK
z-1L3&D-T_CKBQb+tv?xrzzon-vp;^zi!=6jvtD@o;7Rvr`FRnEfvVL-BJpt8MkpVW
z6+!&pA=i6^cg<{s6E;=5CkhImn3KJ<Aywbs!GQPlr0xSL9+MccSCmI?&gQX}!N!Gw
z!)g2u+T%tTXqQx6Y-y6HM_zi5w&QR3=G4}eMJO1a<_O&_NP|P>_XR`j%HFOFmEp@Z
z>zZZtJ#fMUKa^p3lCw?6{IYjCuK)ZTV=ja9L~t}93T+?#aqeaD4uzg)N)pnT@4w1+
zlYI6!n!p2c7T~A}gsd_B;X>*+S1C}Fr~lO=?6m-(Ra4;Z>yx|jN;_ntN|UC|pa;L5
zs=INLe<tN0?g1t{u4ucf5B(V@$rcPI9ju$A=09~_Vj>trtz|Esn*kXDN7arTHmdG;
z?iF=}J)Qdc)+`9{8|VPu!+XjN6Ehb1I5tD_KN(c1geT1|eUTNZf*}a&&acsDt%@i}
z02;fQxDP&#i-T*oFrjznDK>6mpqa>A^N6Z`MFu=3G!vvv!o+ZCLh?Yj7!kQmWH*Sb
zq?LapA5!+5<ny{TKx`QG3z%2X&Cj8=;1&H+>e9w1p&t3Mad*@&Ddy@ZXJZzfAIyvN
z4JZ*q%Tw(6UQMi)mi)CEtzH_kL_dLiszh!CH@7fwvDIvh%?jYq#2d_nMDk=~-x(})
z?dd93{}lS`FP5(rlg-q*Qi1I!<E}lZA6tjl??{JXm3V1f&oA@y=o^aEt+~FZK4sM1
z{oTw+nFZ<>Q~k(`UV`JA&z)p9`lAmUBm?bY*yww_2B?y16j$6P7yj-PG<F#hC}x-&
zLKobP^tQKY96Ow8SH2S=u*{<T3&X#*rXn;R2lA|ql2fO}-DMntlzQZ;pp9su0L@D~
zKMv*#)kk)F0iEiY2-3yZOqdwAysATwWulr_@nOHB?}T&2(t@b;?MV5lm)<%%4L-+o
zuk!xQbj+|O-k&kvBKFSenDJE-02rV4_PWxYD@x$L8w;bS8Dl;%5Ai~H^7EEb;yIu_
zehvo;AXEAxZJLC}uv_5nf9)T~zW9PkRT>W>XCROq$j<1{lFq*rQrqk;uA4k*SsRY{
z_ysk~d)vfa7q7h*`3$!tjw*hpR%<KbTZ5!D4k|8*&exdSPa<0p1FWoB!A@PQJCxIz
zb<xr{#ww_wQ04K)jBcZtqJ;at6|!sn-rxJn7tzn+qjLToCIuvzQ&aqP<8}5F^`EEX
z6gX4rt9q$Eo~P0u9~!O7-IULQX{V7?0(*qMKF4sp**^&>bLjEd>XPJ3o75Yyq609S
z6EuJfGkMpDsUZ<F+y;{K(&}`mXs{p&MKtDro?selh%JAy?dj;hlxyabWR~uHq@5-_
zk3Y@&I0ruvp1f&EpRCfQtz#_B?K0jg0wB0G6%(<J2}<8u21P5K=8W2Glk9TreeAu5
zjxDPD{_#vHrC#&y&CCcx%lYr`dG!NLa-(p5k6gUwDNXh!)YYUCcl>bdH^q139|zU_
zhy}}QF)?sduFzKgetuvsw?{Vn>p9WP)^!IU>Z=PD{Q?3v3d*!Xmg;NBn@JBpfbCiT
zJdxmZh8VVwe>(QpLUa6=@KS&&1<0imXOU(R&zr=$MS6P{dX#TU6Sf=H3xYA@g$%*_
z*67OxLN+%{E_~>g-Y39)3)$*VbwX4JVz9v7WN0)!EiK$wE)&0fw=e;QSn3oRyvjd_
zX#lj36yV;7Qe-g+7%k$L8NGLHOG4Aes8`W*xYy=IpY|K(R6D;GZRCrc<))N1J~|c-
z_3&e=7E=oq_9m!ZK7}uF99`y(`Bh<b0_iU6c~Im1N(Y;vnWXgj2NkYnrDK~(vGwuy
zv6aj^dK&&$)RVOi<88*9{1`qN*>ri;f1Uje^Si|rjExJH87dO0b;8ITGspB;%a`)s
z>#0W%0>l?%T;?#iqbkQ*X;_0G@CJLAE$+5h{CaiV2kt?A^0a1p42Q24SWV}VO8&+j
zp9XA8BPcsDAYJyiX+Jg%3oU7ClD->UB~x8KHYnW3g^}rI3L0v*6)}C9@{bGVvHx1B
z*Mp5>^RgXRqc0_>9e=<uH*Y}BhsjH3_RxTBSy4jYe<j0KejxwbSnsDdj914-j)z;l
z#7olO`t~~3Vx&)}%IrO6@#)=Vz~n2tP}U>xPV^e}>m@GirRNX+4WY!C1kxuWlE7<t
za)xJ<d1CGUS1BO8qv>xlVkV80pl=NG3h>;8+5npx`7_ddI8k&G2rFfWq+NJ#v5{~+
z0xa8<nE@2lGXDh=H@j%Yt<9o~6N8ztBP5tM(>-=SEM$Mw+b&2<_K+o`J|*D^)VCY_
zfFrYcHaGpU^Nep?THJDY4PD}h@Wr&3j;lL^!3Wto%Vh=z9<IMDX)V+jy|%J{o6m1d
zM+DCxt3N#rvRlSfzE%6QA+Zsvg9vJC>c2VK6k(J|1Y;deo1*S{-GbO4eWw)AuD!0g
zkfUbRhkLOGUzlLbs5p(6Iw#rVy5C#B*>}w&3Z6do0!#5GMD(*}D`FMDF-fE})jt)_
zWs>NtoNHigv={{&=Z$-vudN&Ehm3acJd;=+#!ynUciA$mv|XA-<Z*23o3!v4Ycam*
ztH@QmP5D`XIp;By3d$n3J2tf)%Ix*xpN$er_>1=M;u08kN=nMN+rTSTvt6u82Poa@
zMgrSNPrwWf-OVqHOnvi!3tBHd<bjJ#5e$ChAwM+Kjz0-xe7!clc8D41!y<nu<|J%q
zQ#3dJ73-7L58s@Y=-G|r0ZJ#x1z#{tG|++_v)|Zn4Wf@zOZk@S4lS{&_=m=dI%TLb
zWS;?xzeYd_ONwb`e_E2hLP;hFb=+7-rt|wy3;N*E+tWNl-VN&As3(R!Mwk+)_8lNv
zIr^x1zu)PnB3or5QT<$E+8qhuJg-FK&RM49okORBQH<dE2-+#sb64?HZksOiVyN)V
z5CHx({<^)nzBWlIEbT9I<-6PVJO64}@5?{pPIYuAO1=FPq73Dc8o=E9#V$c|l3lr8
z1NNxIo1k^L-~E*<knb3f8K7qvN?}%l1?giKJtln?#Ap`;3wmP>k<1CJQ!tXgqP9#*
ztYr42N(2-H*->gdK8Qc$9|eL-fTH-%LP4<(xjCwi>3DnUOC<YD>H^Hpx3BJf)j}du
z?&bmu%i{&X+>(t^1~{Uzd&XDE3ZB%tua)0tX`v1+(FB<*B9|uD+^=98G^L-sznB5~
z8K&!9ws0U9ot)Gfc3BYEkF48OC}Pc5YAF7(Qx#;7M%v%;eV~pFk*S;Wf8-r&7L_G<
z`oQr5hTUdn*BVNZle&df@sU+oN)Pu%JF{`7cY8LJYqb*mEN3L>soA&DT;hw3KT0!p
z%Vl#)W5K8SHT<5fX@VqU=<zgSx6ZjH^2|u_f{l)WUfOgoTLct=EP`?`$4VF`W(9NN
zPq7K>WpnDgb>13ug;99*GSb(~ZqeePhmiLOs*y`PP9DzoP1El(<BJ(v%vo^b>$h?q
zw0OL_A~9*^Z0yh<fAIQnxTPIUHzSWa_kd=Jha-YbH{<g0mitnP>eRR16;GFWCsJSC
z?f!#84rz2hBtia%Iay+VA4S9<mpaba&Ap*|Rg^qiS_88WzLR~A+}%XttkE|EGX_X4
zgp<mu1y$nG`J3$?N+I-jRx+iWq~rpU;~O4I;G3$@=M0|S6Y2}@FAgDdCg%jB3;E79
zsUN*nPU+}lQnHG=%nwq>&~8<?J;tqRYBC=Z<J=XvY9bpsJm#-3+S`tlUpG;d3CiK6
zoWUaReSQ}4bs?@6`OAbTBk==GN!&P~?Y46g_7ne20j*@1R>SM5H$vWDUuzB32WQ~P
zC?6LGGyJiLhqj=^v>mwBV90jw+DN9ll5aQ(H%Zxe5p=rLseCM4km754{tk9?zKz21
zixuce08-nHz@sfB*EcbnVG(pKuzo<uCLbPZsq1RX^ex)ws$M)sbEXn;C#f3r=r?#h
zd~%t8p+;pXP*1!j;e%0XQ2Nkg56JXFfWEJ!H$N~^i5YMidzjysM7)EN3MjbbLFMr5
z>f+Kvhmv?04h(&kTg=cJ7)R$yxz=+q%Kq_PsFjhc%|5RcVS&PhuQ@2$x(-lxV$=x(
zaGkG72KVw;l7vXfKVXqesUD$P5mU#rwNgZ2dn}$9utizF;%3v7V9^WrcAf7*!ymZa
z;mZTmFB9VZa>3ZoZGt$Gzv*tP5yJ7onaxPj3%Z?QOP?eo#K$vSP-B6J^J6;-JU)+_
z^xg5gy_0$>Xr}WdzSeS|5Da$4X3?VTc8CGZdpPCtM!d-RyvHd2XTU}=dZjGVh7C{n
zn1(U8BNzI0`&V~x{Lx3TjP0o(CW=;iE{o@~X)W<VP{;4cuy0g9rd)28#GV$PJq+or
z1N{dCi8`OonNs<pPTsv%SkXS@+jc*&)uw>yCA1e8-Z*8I*_Ir=ei4}nJ8K$+H-E~?
zf2-bL{w7RF(tks4=B)P*8)YS&ie+vli0hp}A$pP(=TGSs8x^*jZ1qjsQp89V=l~JS
zny`PtvAe?}z5zrg@lYSK2%SjoD3x2d*4XrQ%1`sL<DES5bju-^3VkaPy06W@q{bX3
zCI1`AT}!4V5}CwX3@Ajm4;%c((2_W`4Wj#nOu9RhB#2}AHAhd&0_eS<`~z=5oWS_D
z$j&$<P;Zssr+rW30jmgg@hhTF29)c3zkT_-nfBY*|C8GKlp>SeJ0)9+-c{MVA5YZz
z^2JJynh%9z`Nk%I5z4y=AIAmXNX;jWdFlC{VEk#X{W1S@E5!$`>@vIDfy}{Z2^cpF
zkif#jAIBTb&SJ27w#cWh`2N*a<_PBsMdaTiuZSINuE_@o$q&!pHDNr3$S?!N*;f=1
z^JT8~(RU{%rA&~zA2|5%<7LM^WlFvm;`F!reVg!!sSX+De!bdeW$pRvb5tAE$uo;1
z+do9F(p{CJoyO&ZKcMlBb7(t#t$Xh-mdT4t)1(z@%lj+#X2fDPTrojT@^rmdpcEe1
za*EOu)&)AEBA2k+=$kqpYv=1yln%)m!E<2jp#&$mvaSOWpdwp-)azB884$v7-E$}f
z%**ZDf&mX3vy#9`AfiB8+xJ@i@GoT1G4vQU(2WCaVvTu#C%|B`I;9s^o&BbKuG88w
zofMC@W$(^3dtM*Fy<6w@=AHt6g@_h<6j8|%>SdR;-Zn=y>s1SV*7WtCvj@*qWYPZR
zj!%}L@Bn_keGGqNn8J-gtJa(>jcYJRYU*JO`@Z{}MRf|rKN0c%=&NnCD481TkXidl
z&~)ftHJq=kqnqEw&Xh~9w`4iucQ#Ywd92_KCTi=Oc_r(b#Oc82qO-#%IEy;3)i^sb
z#_@7U_*!`)H>FAh>8N}f2aa=A;aBY*`Zm<yjtzimpW1}+C&P5bJZkRZ->l6ysLtii
z<)10F+`s{I(#CuqsOX<1vKOgP^=SV*rMlsUhCsH@8Pq!Pe}%g-Q>A8{#cnonT<jM)
zUrs_nJp%N;vq-smm#Wo+v!e5&bo4^x?3=o-Ljy`@Ek^kdS65MlBeE-ljPcWd=Z&>(
zsqJS)99BZk^^W-F>GI_K;@_9udac6_Q`JnprL>~3hDlaxZ<R`Z#q@iLon2cYu}-u!
zMI>Y9nDZ*LtxAhwSPr#ri1F0ei`JCxckDnN4bOvxu}Cn(jf!Ji3kbK+YH<}Pc=ON)
z8u`fm|Kg@JL6yW;I&#PZ_heJRzF-g^6KYA)yuDZNa70e&8&_~m7zULl=f#M*#xZ`m
zH}QYAhzV+n5Mf!A(AB$rZvJj6Nzsdu7}3VA!>gwE>bLfvtpCA<6l@lnMS}7EON8Qv
zONCV&=Dn9MB5|QSWy7O^<9Jr1Ey5RVhcpum6z+@f0%@L*v0q1tN9p5QniIbH*9X#t
z-JDpUy}3Ts;f}CH{D+#bekzKass06#Bq}(qRP+Q=d3>`jxj^}ZW;BZu|NLpGGGs}G
zzcf$Bz|Wd6+J1ykYSKl$z;w#3tB%S0hn%Q5iA}s`_W&V8DuiNnNu%Bfg~5D&;F)4Y
zqb5v=?t$4JksB>=jzBFkAHBNt#ZrN@mzH6?!N%uuQ;&rk9p@N?(cSy~^TFp|>3o~I
zN3*~7X+Kd4FyImKqmqqA5>Ai5rLc%>I(N!xBz8ldMVgN`-Bg_gZm|K*PH)l(PXz$J
zDCy`~rS#Z{gQKT{Dh4}3MwSw6CVF-m^;Ge_1CKrzR|3nLLGJjL$j3IsxXI3iVA+5&
z03=LRPF@Zsi!KS;D+%*P&O-Kb&maK^ph~P=o)!E4QH$4KKCRSqXDi1S3+(wW_n&v4
z0;qEq*!!O<UX%6G?-U5(w#t#zN545t-y0K4x-5rwMXfgS(N5Hevm29bgEr)hB79aV
z$41H}-c*7j)#^V7%nA`>kMXPwv5|PZrE?G;pgKnV#6BO*|F%FIW|b=$U?t&A)H4I0
zg=g%EIF$W1!TR{}m#kjhU|~&~Fb!nJ$1}6m7q|D1ds_OMvn^HZ<DU%gq|dhL?C%ME
ztXGLJPxgM2>=f9QY5$cax8nU;y7QOOj5ex@&xQDn3F!XnDPp!vXin^LI5lf!n8dZ;
zIXwQpge$l)z!#CU&#5%Dm*-e{0C1YH9p4K30rcGF0D?azGZ}PJ_@D#O24z1z8v5MX
zAZIHKA4<BZ&Iw#f-Q=sjwLS5+rZ~=qqN(@!v5JQJ?+3W~$_Y8>i@8Ie>T5iQFU&(4
z@+ZC?l@6rjOVk(-z2Vq2SI;t80xE$MFGy<cA^;jl65thmS{VAcl-#}es)FqJxD2bR
z4X$l?q(vXx^PEVLut%0+2nRVIXeWmWuh}1^w%BcyfO$#WeWA^pRLPp%R(naP{+rY;
zHxo*|*7!;m6}1nm7(-zJlr)V{w~f~zHv*|l=%;PwFNG)vT8ds-IYlSp^o4))@xaK#
z6L$jIpo4zBWIncDsJb)Np3Eh;0@W+zsT0D-IaJw#U8&r%M=*k1zZog`RaxR9EHQau
zmW?!QRQ4DmLm~-`-wzjJGU_AovqJQ<!j6KI+ZUG!f=XtjKQH_N6GhJuTGe6sy0AKj
zE=tMg?b?4hkU%Ebbzn0UR|c~jR~-J9HhF0m+iCi3zFYGTc<en%%lI=-UU|6p5$K+y
zXq|&^;B)$pEe^yAqneAq->aJow_}PD1Fw(!u?M2hcUka<`0l7%P{un|)ov}Fyfa;U
zxJdq?g~re8Ivs4#IRwQBE7UaRn`s#A3G8&MFa)IIZ7$Z9cWchK>Lv4KN*G;S$uPa<
z-?;el>Y-SC#rHxXQ_wgQE<$K4*3_Jpm@u@p!N=`~NV%R9F`>Xcl%057X{k8QdBH+B
z|M0_K2D~DHIn{b|R6?{NNN*uh%O_&{{}<9C6M@Mv8RaR#4Vq@6b)&e8K`py_AE5A~
z|07k*sAToerdMhml+t#e>ldKtQjD(;-MsL9QCVe*6qSu)@7vnk1h5H<7gZa?|LWSC
z^GcFdTvNvK9dtM<Z`-U5-6DnaJ0*S-;z}8kRreX#?>b+koqzAkl5)c^%NDf)9xc6p
zp&H2a@gS{@zP);7;w=8q?<{iR8}w;0A*FA;(3&pSXhSsbEP^aLSunj$%W4^ZQ`&1M
z(aaFA7ouauew1{UxB)q2;6-9K%X8{mA#D9Tyi|LyQttA(eR*D*AZa+C*yqD+=p(`R
zcL(Z1b^G4bYb*-1bNbH1QS4v*cbu^jK=v(N@_i<LB33i2!Ht|tjc~z*K`JdAhw@_*
z6_yqItMRNWdx`<=th4)o>^ilNOZB@Mk%yA<DxZU*&|ID;?PljP=c~cZyAu`PM1OxO
zQcy~I6ySB;RWdhbrC=@Cq_S@_T9R@m=Mo}UWponfIFnfa+q7SI28lQf^ooKal#~B~
zV)jcd{^o!^k>>Au8bMT)SO9b8YUW|P*T$iJz{I+*hU~`FQ5KQBpHekm#GH%^(WK`w
z_WnPam`f0^_;Mb`Udw~t$j>zJNDqnZTViFowhC+?;iIbfI?V50N`F340fJ|qEd{+*
zjU;my#RS*uhknUBpX81Qe!P{VhMx09X8y=+FEsi*Y-ZTliQVh2b9tz@CS)}<A{Tvp
zbfqXKBUTacM_T>HK{R0L!Aqr!(r;{Bj%`8SRIf##b=GXH#FzT>)N2pRrXS81Lb!tz
z;|oJ5`D*^1*J4S&sGcw(#k!8{iwF{5h0>z~vh=KQ_`f{n9^YjtFf7MUIlenb!TWq{
z-xJ5o7&YUviS|25D~$BQkc;wLALLhD%RRtKAyK31CGM!q0CS}<8>S_S#@jVnaGCNs
zN=j_&y_7=*J6}!^j<aqOnc%MMPCMJ5Z?zxezViN-durOTU)A%}U7g*K&XeWwR}`%x
z#;}moAq+b8bSb83dY4W>3;X1hu0z<QOofNwVrqb!L^SQM&D(7g#)kAEwuqf2M-y0$
zWK4G}2L*ec|Lz#Z1y0@->^4Y;YT`3wR-o6QGY}ML!XjGG8CRdPC^3vefsu{;YW?W^
zCdPXx>r@455_diIPCNF`)40!~d+fgp9oNzDeJv)Dj?`k|>I}158NWl>$o;#_GZzFX
zLf)0@Xf^MDgZOA?E>(rId`o0CVf{$~_2vZ>Pga)dNj^q{tTENc*tcR*US&mDdGw*E
z&hmHn!8owwrjR=83BK>;#ZqYoaIi(?_R4kiJAzi)c8@(g(&im$zDip6uzT!kX7&n@
z1PJ$2aZ+%PwhZ150?)5u6>Su1Hk<f=zX$Tcc3RS;Y?OqZr$w=iq3zXk;bxX0#0S-$
z5>{&7zYs04Uq~0SkXLHi-Q$r|!1IJen*3EM-mqnkR6o<vbBQ)jrSMvE@*2)g#vhNj
z<5~Be6vO%&xK6{L2^K$&d)smDbE3fp%YG<#n?Lb(oRPM<eKW11_?OWt{o#R`cFJ4n
zAGDj4fENvl`M`D;1NTOIy~_x}PZ^@mN)d6&UPmqY4+%qp37ptJ6`{WX1I~8z0Hj-(
z(1y@@nU+a3CL{qYs-BGsI2Xg&dLkv`>;GR8=9M3)FycHx#TXHFr3kJM26x>Xo1Pm4
z+W?hz5<6ykV9^B|>yrlw$OJLpWFe7>Be%~t!9wexHxA1P$_(^$?-Te|Ilf5lXpQ7C
zW}v}*1NzqW9;mxIHi$_jcz0fiF?g|2F44+VrB;@s*liW$hrc!5xuWb?yzEc<nzDKD
zxAJ8Z%o@s7Rj_9EC;zJWV^!(5tz~E;?t<Y1MbsMI>Xnvg*Y(pSMBVx_Mm*{wwdU>5
z>aQ5k1@6>)OVb2L2GZbJ%&Y@{Jp9xv`S``C-vu|<ERM4EnXkEv(j3!Tm!=e$uE$MK
zf7*p=aqUJ6ALWB=1zcim9yM9ChiR<fZ>jE71;M``@2crsrK~3D`vup9V6!9_YNi%~
zQnnt$qTEue#=a^tSww%58}iopaps%e?RJOE8^u<O>Wf*f^$s=iVYCz2PDdZ5A##x7
zh^63IJBdh8y)8;)(Cw@Lurc@uHU><0w!UzzlymnbUjnJdk21q|b_gBQzXYBob%{ao
zUtr7xMfd*!#t@<vBAs98o1YFtjVDpL_jhC@pt$P6zy8Ut32q;`RZ^MPt16hHZh9%0
z_O}+{&9mREoK=bJ7$w+qy0s5}dg!=jI`B^O$xr^734zMnQzbyzrWI|_Sl2|<XGVhN
zEFqwWI|W<;$~a`nz<I=Ww8Wq85gY%G>{<eR#W_|rXLgZDn~zg`mo@9sb;zTR<0#<=
zpIrT-kg&e&Ev=Q)Ov;&%_902ibnv~{+Ss#NAUXFFo0qZ3X5TOI_LW1jQjcy*{FW3`
z8S_O4xogl#OYpkGAM}EhhI1ackW?FZ;|}Mb%{E<>+)~|AO+`t2S0zo9z$b>q!@P-E
z{>y%RtHE^LSB%ca7m(i*GY4C!wuk{wzmxNT9}b$p5`6_$pId_pjfJa!41#G{<sBg2
z1p}!=3sp>)-Xr4o9R<l#H)P`r5!WHnm6pifziIgmydBZDmqTA;qAAgk9z!WV5~^>7
zPg%ik`3{I{;I!{$)cW_iQ<Iw_S?Ru=t~cYg=>LAH8ju;n8H5_Azh5N~`G)+**z+1a
zauP#Vy)@M<V}a0b-9S2W(h?iLya<e3=qr)=wzrD~%GK)8$i%$<$w|dKcP>tFU9V8T
zZZXvA?1#Z&Eri2WZ2#u;JVJeG1jrc)I-~%r!Hq>U*bW6F)NguuATv>}2K^4I)(*#r
zp1d*Y-!3S;8oNKpL0^1%A=9Z<?xxn?D{X>(%t1_0<N2%FHdLdccm8}1nHl>f&+8oX
zYoEFJzeaVUh$FeY=WmeK!VN1~|5a13Q-`0cKM9)3GeqaE+S9yWe}Nq_f6!B%oN4Ps
zsu;2pJc{*+^QjEepQYKi^PrTr|LJ-4$zw`8P?dWqkL(qhm0nKd=eM&)c=z>BronFS
zPxx%gkKsqlWH{}i7}_FYHWLTlMCT^b9u9LY9F=&v^oC<r=g=nkhpi)8WY_gUK=Vyo
zX(<ZYoZmm5P1AMPwpSWr1-<`5TVc_Cqs$~V_^r2x2@?xsN@D+^{!S5B3l?>Z$3~28
ztL*<`W26!yflG$lv`*z#VkPL(PI#=w?O13;0`&}Jq*PcrTxpuog~$Ye;PVX;x*A*;
zatWycEq(IE^DL?TNigm^x-s-zgqi_Uh%h0>3?$UERa=cY6JUv`>mVvSYIdQAGziNB
z;2VhSLO~q^yo9$0>d)ur=)_Vj_n!qvb_{cJi<z{Gp%Wje&H{N9Hx_Q|iFP(HAI^7r
zKX)0fzp>qV(F}&**IJ;>=?|8Yw57y)4g4pQtqHTIIt6=|S@={5IWX*CRoh>HXE-NF
z$H9!Kv$~@_y<dEG<aT(!t#E2eUh}MV1;yXJY%t%DX>A?qU|zom&M%)?1$Zjd{p~f2
z#D92m=Pt(z?YW+6LvfS>{x^AoC0Ewu!9nrk%kkqdDj^-N%>V5Lzzw<%KvkrWutQ3O
zb{Z;fn+Y_iDAJMl;W=fpkVp0+f53d3y5Ey2c)sC7H><6KbQ`)aM;=JJo-$loSdL^T
zN`E=5J%s-2V@UA5?aRN7vi#>=^P3^5=LfLVb9)G)6Ipo?Yu(rYJr`0oG0C$+;hi2>
zA4RIfjD=UI$I}$g%)08JehcE)$J1mr1kW#oH*Yl-tUM)CQNXwxw~a}UH6zq}Iy;}f
zdme9ZxtPJkYEiw{MPmA525zB5u?mNnfhub_5qxGIJ7c<tZq~65YMyw}N=EC>T-<@=
z*n({S4qd;+H>oU6ql^i*s5=n$)gX$QM622D*&X-`8;p`-2>Xp-UbIQm@dkjBrFq%M
z1oiA1)*>HWm22^c=d=lsuIRV;&9SYaoPQC8R!If7;rCYoD7?x~;}uM&ReJZ`aUBJ}
zMMyxh0S(sn>(5OxEi9BdrYhw6CZTf+z{+cLrg_jYSLb{O;5XyY!bxmi=Ln_;S!=$k
zugmy8*Z!LC&u_0$T>=&9hKrV2Q?J^qfW7zOr_bsQ=yS`N3(>IFNS)pD0%*dbGd9Us
zL}Gqk<K}u~=MATp@KdV`<;En&sN!!zJ&OVz*%HxQAW}x)R<jHx4Y|Rp{th7wW}jVo
zl)n{$!M(qZyaQEfGdV@NV9A3S&houGMS)fO8Do7>oyLoaXrcT<fcP><Q5J(CMx3F*
zp3&Z^SA?PVn`{6aV1|?+87ibV<bF1Pv);m&Zzp#K(Sg{?qK-)RlF-bRuSYZ(jI~h5
zi>@5D<BB}z#_S66NPRqh3s&;s!$+vgHZ2!d6aMn2kI?2h8GcDh37X=W8p{`SGALKC
zbX=#wU+&GMfrIY_s9WJylcLIEIcyMmYiF2$0*Tz&Tz{eyMf@$8C`{ya@YD0thAx0D
z5gq~3&7;Wv?sk(`jO+;dmnT=byHC|pgyEEC$0~a`^J98ef7lB-AJ1`O%apQk&OxHs
zS5<19zVKq_=yR5I)mnwmPCwE<%Rh=NfUC_3crRGFp1GVKq`8&dCDmuYZd=pl(Q1j`
z7_O+f#l_OoWpBjNS3UC_3n?eR`|>Ai2>opc8t-x<GMw|nTo-mYCJ|?tC!HNdzIKO=
zeAX*@I;0F=<DuRuLAM~{g_aUjAt~Qb+{D?l7e#=1>vLJiqsH^WQpht;NPd07i#ydV
z;N={!$?ARo^04;uywTkKbkx80eDqSWD<$zCqow!;`j>Ma=BL`1`&wp5uP^uQ_2rmx
zNk%be(D~TXtzO>_3R-@ZxZx3REAd*60h@0nqLk#L&==y6ZAw%10meNVPQ?z_eXJ7-
zb8gtRlg~H&6}ddCSpXp#QPXB}P~8UTU7Thab=ADn-LW?opL=J|u!QRvw#2O)Q!7R9
zdntdL9!HuhGB5wO!!MeD+*H&Jb=;t1FeQQMP!7_^I8|r*JG0-O-+6gEHgLH*-->Q@
z${lS)<(cM<$i2bP0$H-t!C?-6aZ^isQWr3o0Sk&aU^DE^7eY)FclwrH)*eP^9zMNK
z)bW>7mJ0QV{)zs%dp5I7I|X8H%+RyayBzlXDwKa{p)<Nr@fA(9!31aa!v;C&zxweg
zV0fmjrKt+7wNtitMg!H;l}*7Hl`{{Q;9zys)0D1Pr{&^5F8&FKUCn-o#vOjV%YV7+
z54nfF0E8z(D$8_av4#sji7^Q){mO+Q>-kJCdRZZ7#4-JgsGnw_2Tk{~@B|z8ZS|uM
zyDm265^IPFs`Z0fc9f`smyxKoX<27vvqbGDW9kOrD7+18;VCYx>Zs(r1l&N09XRh}
z(wOHKz7$AeIQ$SL1t3|<bz=HlB7|&)9|jW9Kndw$4d-MQE{nX_s_Qq~=ZN(nRk!9w
z;Vn|Iud|eqb>mx&C#@3@)kAf3#uS{FX_|Q*;9?Nawe&~20i6rWpaiDhRLkzbX;Jd0
z;b|NutC-r#0M>bS&qBt8<JY!rmquGFuDVKOpyeJ<AbfeUo1Tc$b*N^XWtESK9<E0%
zM&ur>b1!SoSk?DNbLl_Yo{8WwSkP(0Kfv+hLtx3b>p8!Af9h;-Gr=DXf#8TMH}%yc
zi6eIB*`vZ5WWfT{_VC6kaGZ*KVOd=hN3qV&0|numzQ=l6k`eN-kJl;(-_lCm>69H#
z+M;9V+2G7>az_oDo-yh*+aglajB*VU*1t^6HFZ7&#7zINPv(4`Tr~yyM(hE68f5Jt
zwYC08PKz%z1&a;EuPG@Gbjt8l{^jfR@|q55D3?siQ?*~Pmxcap9jPhG^2Sr_l8+{U
z#CCCAjNY?HfC9{W=ld1_>fc|)+Jg$f4W&tH1?Eta$!X5lvy$xJID8N=*{pgUDa<q5
zgUCFW;>vL?`s*&_e8@vKvr(c=AiYvAmHG6%1TXs<AvdRG-Aj^p@iQ4^>bvrMe(f^8
z8eVpu!(q-E{*?%?eM>ye2I1#ZUNNsds&XMh{1QBO2fDwqO-tBnc1odUAEX1g&bdaq
zFWR~=gyXwNK5H3mr2Q0WotlC)s%ALI2|xnqhLQwKLGgTg(XU&lH14G%OA%A0hz_x1
zQUGkJ--?5=@&7qwHA`&y)hy)6xRi0o1;dEmfeg9XiWG1NmqvQ`#*~U^`dd6GjOwkk
ztt5&=`#S<k8X{=KPrrP9xsXQfE53J<2IUobe>XwJbud?!I?eib7uD}yRlOKCuMLsS
zc0{!-u^;+;l}d5)bKFrM)lJq&8_HnxzDBpSAr&Jooz7j7w0m0V8B0c72_NJWy!p>i
zPUwp{CN^j;<nyT)Xod~p53*p}-Fq*!cDiwtClQ$u;`7DGR_D9OQ5gao+H11i{2y${
zwjcF>VM8$awx`4!WP?pw%qOv`buyFL@@*DZBs52)zp|9Ekj8IcFAeqWT26&GlM(V{
zRm?@QPpe3$BZq-x>GBtY)$jH83@b{p0gu5Bd2ucPsh7u#e){KAFc@)C4spS`E!KzV
zU)*_#mu}-NZincjYE$}eutb3-pMI22qbu@Yy!DMLEE<2CjeYZj|8n`JGOX7|0p7~*
zTR^vXMD^)|-rR_u)d~Kv()K5D#<iuPo0i!dE!ba!0;(bV%H<8pTHg!hOm(!=nOCJR
zA~jHoIqjbxe#Ne~U_|pxZWrJ$g=p8X5=_yGh?yD%s#nw#>e<d=@JPh}MypkMzwO~J
z;d>bDE@@tIgmF{Ctmi?IV6DA(Qf<n`<bEX@HEIv6$)0t0wgNlp`Za3@lp}av^9&3L
zdOp1~zN)!(Q9@?3RYu3eYSHQpQv#KoPz9I}0`jY&sQ4KStZ0Wk3kSNtqc{F@OwkQ5
zo+!-Y*CU{wNB_*}__L)+NtOwN|16r}@cB#oK+2D3LkStqm@x;;c9vkVw%X`|9ltt*
zA6Uo$8uBE!P9P(XPltaULoKKfIn-60BluS#{4z_*cN(d7@;%+=(D|2n&#jdp*@dq|
zXf#mA&^Ktk=>Nccphy#azvezH*Fd{_WI!l}-%u3A#e0m?aX^OK^jbSRi7YNwzpE(a
z_`Vrl7xlD~Ic115;ST9pKPp>1$QA`k>_Hw#aK`mO)8LpDr6E{i^jq5`{kS_319nsj
z39bK{EPut|MT;yx&r=viG4^|L($39-H2rMrPOG+)Z$gop8{ZFOn~@2Yr4Lj&Hh#VH
zabw~p7-LNUM<AjjcPmb)z(!ex7SPX`e#@=!^GuiZuO(?syy%)fO2(sfj<4JK2a996
zz?qiw(JP`rX?4Wt^8)Tesz+z#vAw0>>{Z1kA-mSGX+zYqshhH0Ak$AQ;lhfu-8aE|
zl6@y7pA%f`C&yHupZk<vALEHCrp$c#@z2n_y%Ei|$kW)D@bIVYoZ)akV`jg*a{>bh
zi8&I^@y+=w4~Y$cO9710kT*5k!~bO{JBD4(@u}tckbhEd(uADGnxxcCVnG1=XGQPx
z9w+Sw)Eoi=;Zd`zFN&F%b=lO#YB_L_8sHhpf^H9WYnu_`DABj`|6oOw(ZQ<2veM&t
zr*fn;kHV)2p+iXmvhk)GY6hm8L<5qW+7dc*!qES4MSp+?<*eM%<~=ae{O9ehy4pmB
z#6!m5$1|QyhginvvV6MW=l1;UVLsMPKz$TSIxXW+Q4USwXl`X+oS?AcblmOj2SkyG
zjB4Q#sZ#ixu&R;icdxHgb#@)~!E3TFW=R-Vv`4D=>&t_tru1i(lA%RVQC{>ZiRWLR
z_!jCkgAz$lbB>FzJryaK2~L7s#b))Y=1h065y^m<VHai(_T60Mxz;^Z5ODnyF4M-E
zX=_FYl@vvGba>i%qqm^?fYcFz9RO5TFR9#bVA1r-@BLlbyQ$zeaXpT%>Y@iHJg~tx
z4q&cq%gaBlOMQb;$7nUh$c>FZuPvMd?DJZj3y>QxCYFDP(!G{XnN8~f6R>t2CVb!a
zChzqQ3Yqq(3g(=lX#Tz)Xi6#W!%rL%41u)rP|5x_xwx)tHis-d5@xl@NI?Tj)HVP?
z{Z<}A)O`9e-ej_8LyVBAQ95f*e?S)>;KBm9W-n2Mez=6O#Qg?a_&ubnXW{v4{Zfc?
zMr1TO>#Y_o?eZ%WIt`s%W4E&l$XzzUV~{qgU+)rTsZ5(6+A%PNl9|F@v57&Q4WEXb
zup5{8<V$TL7~`aLGb?dlj0c^GppAVv`1TBFHnAq5DraZ(h%JH&=?J-SeP%sD=GK#P
zQ<GoDt*T4t;vLY3gk@^?cPWRH^hZWS+j+556_g^V^Z$O{eh&k_c^jclVbxEpsqyV1
zrf*YF<CcX-{g1h3oZgD%eID4gY!QJ5@Io<wTphpDJGhbI<UXQ1*l)O=8{Y)Y0F2kV
z{@BVN(5$Q>Rw33QzVamJj*RLNKG-%;<b}$a;AmM~ZGK8<r#HdHo;myOi|>wnFt4*!
z4!5%gzK7%F9|S&lJela#al1mIne~w=NBbZ2xO^+S|2Z~m!$LB0V;eX`qPL`jeW96-
z>|LG7+t$`IiKJyzHR2Re4gbKFU%l)VYzH)1{SO$_<PhO%I#3KGM>Fn`IKsq42)DZE
z`<mZ;4!kHD5CT2&wMspoK_kw50u5Vibf{xuZ(=Rg@u%)Utq4_=`abgabo+$oTOpP6
zCdxWt7Kmbrl3;LsT&*F8S`z)em>uHFHxMLLY@Fy3JY`QQ!E9peN*eM6OX_Ud$v=;M
zIqTfq15Izoskn+7MCSP{D#8)m^%AEK&Y|h_F1glugP2CIePs@5@J<PDwE1%^4_vSe
zAFg}(zVs3iGCv4?an8TacJ`Ipx&L@Trx-#3%c7=f=6ZNIG`igI)fF0zTs=%CcEJtQ
zB=8L(cira}?t*agtsUTC2mkYb$-C$BaO0BMsj=d|(cXLn9ey-~K$`LG1vB4|x%f0!
z7ji#w+4XSw+IbX%#2x~(_#pxItpx^VGKGxlB)Jou)h)&x+hXSet3|a9e&cUa{&84q
z(ottF3tQ6GR4!O@bCkaACK4?BtRx;4FVs1=5V|WrHb%!*8!%c)%fHsu?Z=cgN7iPY
zPjpd502)Thp)Z~6@R?`QRX<1_D!bJExWwfAQgX_km1v&<WXLL6uEMI&40g)uQV(}z
zE|8OGSx<67O?wjJc^rr^ngt`Qf0W>ilb74HztkdHkof12!jVx3Q5bLtF$qtGR3|9r
zqreDAX}+bjxTIHFHR~(}bI22Ma87lA)JWzncE^MmMX4hadcNekvz=DlCJY{J{l|>-
zzn^P|9^B!;KmI(1vymdX9OIQt?hd<PRlI?>=7^mUh>q{86~JSi;Aj{4G!`Bu3w3g*
z)Nub<IS~aTQpXi2wbN@Z5X}9Pj!~X7H$@gfhwvV#!QiEOCnfS&zA(J5y5Gm}ULvTX
z|GSW8ZCR~}$(f>QM{f#8zvrak62`xXxYX0}GQZp<s~nW)4KTf6?Ri+sL$3B4%EM?|
zTAh)nVa<5$BPb1`Q+Sm1Ws4GPWJ(cyY0fr}lz5a`f;=gbCglk|6FEXO92uRWTd?9B
znJfDn*9V9&hQ{AS;(q9`r<_8$^>kAM7)zBRzjIr+4sHqU7Xq9H2~t0+g>llKo320l
z=4d?jMLIIV*uq;aQR-$EZg5C2s|l#_$N5_1t!7IZ)Kx3f@JJ4#oo~GG-xi1c=t1B#
zDf^Mw>AlB<c>6M(a_uJ_V)E9s_A_QIIAYmWfeX5$>m+HOb*0|coesu1P<8=03tQCM
znx{v~qC<{qY%SStiG<#Udws<{7n=m{awPKmpEu&J?w2Wj9u?0!`}~r1mNc*qBaWHW
zyY=)@?av8fNmBPU9MO&BSN;1hqG3FpL-LF+kPz3+hmtc+jqAN_8QR)_kQ<=@=S4h^
z!H%D3CqYjA%QVfc)uO3ve+-o<{B?u8^)oPjJV66`Us=C}H?h<O=A=Hx%(knyj$1ob
zgiwUcwn4-#FHn|V?Zbaq3QryJeNFPv(Vg&fR>wJEn+P0+rbZwOuj-gO<n+>{d(gJ|
z>L99_-P1`Y<lM^V9kk9>zf3lR<C|ha0{V=;(>z=)F<G+@^5z#aU#2@oH=oo3x}VPh
zbttcvUgKhu33|%YA$CD68lc;`Ao2*4{$ZB~VNBc8pb7<=6+4>lxYG1p%hBhhNAUtI
zkh;&_$O#jC#G#n6;19Ly{jkgEwAms}tFgezbv|!Tnj=vfC4D<F))E&7Jav4YuJp?v
z=)MXKMZPtAya-`LJ<0Fmg-la~VZUquLVW9xGjC0Na35+c?0&;OpLPpQbJ&DaDowox
zu_09a%BVim_eOxt_d4;g1)9~OosY+3uc7Ewcx?5^u_?%^Ll-it*UNsNE`B*cpp)Ct
zdq2*{+5E~nF!0Bh#O5{omXdnCh~9mI3(o^@8;+B|VF`S{6-YmWCcKT_cueBN|IM`(
z>wa!KKN~JnR&R#N2V!qcI&5msx6s(9S|~(L;HzrS`%JishbDfio)E{!c@nhk$y$4N
z!9)F6G0;U3j5n^5+KTt65AeGV+huCiih4M;NrVdPd>$z+Nw4&#hAz6r=t-Urd%5JG
z1kYd_5ZIOQwWRuFp4yQ4BA?rzPF5bW3tSD0V0VSQJfDv7bW1$mAM&)VCPGD{5e{7s
z#RJ{npDwUM0QwQ>L`~6)z_DSu4NxqmlWwW*0x^DKLeKib0bb(Sgsm!+x6Dt?kv=5<
zwy|E{fC-wGFs40*Uj4TQvQA)u*CYAr@uK@)6w*r(=!ZuU=ZsjjP!^SNk!Awm-<T}G
znk^#|SiIA#qty3GMifaLLn-f65n_yFs{YM8&neO}gC>)02gOHqYy;c+Fksn18XLZ7
ztwm~(|7ZW)+E-CA-;Tgq*{qdO28c^!464X-<AFm`bR%VgTKTIdbylI0*f*Tl)99Xy
z(2>h)US#Fl@Jdv@^n5gDLPOY(8|YANCl(2@`#&qkFp0&>xSLr_Gn4s7VtyUhx$tJ8
z(h@DZ3=|4c@tj)ZYs}qUy4`V?X~)khJReV+;+o}*S~zk4RV(Rwc08@S{ucZ~Z7Pbv
zs#hI)8PPhmOync(?^uwi^jaA1C(|7rN1&rN9^mjIx1#tbov(fTYYL7(5wV`swEqD4
z)3o<kg?IQFtI*mxLzhGyZbfaOMrLy~|FFlxKoF#D<A@Q`)$y0q#kf8!mY=f`Vmue_
zoG$rh{2ZhEDE~vkQwp%1keQb1)-Q+Eb;00&BTT~TV-`yl+sNR+|ASy^$!?0O#6_Z$
z&WVETRM$nZjiV9>s?O6#F#iw0gd|CTNjv+RP6FrfG4UZmf|N?sSbEHO7qgr4R^8m#
zj3jJ>+{$%e1U-lBIcA9>9(9A@Iglzw<E=KHEZfdk$fUH9VQ*`#md4H>qIL|j>7G@Y
zgxJLEE?gQj)_xOqN5~j<Ktgi05$hpW<<jg%EdS3BoA+3yo9=Pz@;GdT;8aF81LA>&
z1TB4S@tg2q1{Fk{5ilc7S^4hs+QNeIeE9p!1;MnQI_?tVgE8Zc^$D5Wn-r-_i*JF-
z@7^$ND}{MR^QfN%rRsSH@oX;0dl5(IGHOo>`y1)jrxUYgDK({$z3t!oRcWP?c6D2q
z=GGskZ#b0S6h)Dh2-7fy53w7MgDv*##*PTeD-N3uJInU_1B-*pTTnejUHb+l)tsYk
z`T_kl^Rq2^@oE7@Z2Yn#XylF$r%H5@g-F=kdXd62>RqBDaiNU*$=Y**Xc_b|)`W=x
z$#NpxS-5KW)-Gkk3hx$ZTUAh`04g-DI>YO}PN|`Q9%8`4b1d#cX#5)JnxtvsH|X>R
z^I&{U(DAv{TD$^81L(}fupr@MLLV^0CC<{y0f9`uECL;=N>b=EfM{$G6$+MKM2_Qm
zYDI$q4W}ru$|~8Yy%UGtiJJ*zX!l4yjlHpe^jHw?++)2Ha{880$<o5VS&2&fD>~l5
zb0bWRE3&s1p`KfDH18ms86IBW>-I5wensZS3*lYmdTVxSwSl?@TFPX{#a-~J2KjD_
zb+P{gd09SdPrqg3PLVoFpB1SGPFFgCs^wElp}U27JTG9O$VJ)bm-9t^S!B7XN?3{o
zBn7E)?flEGiPQlv#!S8k9Qy~KqKiU6s{1EGE1cRfcWbl`I0qF>;fQdRQtuk)qs?Rx
z>P^?}&yo&_SxK)N)$uW0e@;@WW;naI`ayG1*w5|dhV6tCCrd8=<7yR{z$Z@p0E4Rf
zf()x!>a~wCn!u+iZu}1>h4n&$8C7j2A6=%Pj2;P)ZWdDO;RBkkU(vJIMVzU96jgs3
z{~kNTxvULC$)fOAHWRN+;%w<<^3O4=;bK^6@8*&t_+jpbN@3EW;KW!*=DMTwNav8(
zxya$X03gywDtej+P%krWdl}r(fBhmgnE<%HXrn@9Zv2?u>z5$6n4Xlz8*3w-sY(Xn
zg+Syo1@jjY-evcBbD`a?7ZN@SZRPRcsv0_9qE9^@^;MR>-+-Qh)jdv!wx3UVyqpK1
zcVVJy0An*EEi?KvI5dQ)<;lwZn^@*$`Crjcna~u51~QD+0Ls0cY27lvW-1Cv*4<z-
z+=*Xo$4$QvIVj{bDP-NMLmqK^P9w5m-Cy8%c^2y%+?oa&d1k@WUvd-njs1t@>$-T?
z>t;4@9*1}pJw`R7b8lJlE4usj=B2&MjwU9n_XnQJk1H#=BZi2L-=!36#X=8<>GgX5
z89l~s-4*|lv`^lAXh)p(uD{({G>)06zQA53xVEbOO)~3W(G(F+o`2QYE(yflVd-hx
z>a?;~&UQ7E{j;4>KEC4I+9_G4xy%!v;HX`$+FR%VpP`S|gDn7CDZbu}@kL#~gFC_O
zF1>P-vz#GKI-3MC7@`$=2Cz|5QV&RNk^^&R$(tMG!?Nkulo;leaLaej+9rcXrWj=V
zbnk|ic2kww5+728rn);rpogcAu$DuJ`jA8`z#W}viG4}lKoE#JI)DXH5j#`&@HPJ?
z7^;k%PtvuHBt&pG5idCFO;h7sT9QOg&g=TP{`J#;41m7SnOhPpv5*YgNKD%8tjm4z
zOttd=1Syi0{)H?6mIU~2F?PZjC(z|EsDsX^=LM_KZp8tf5vz&M<t1Yly!Qtsr&Cfd
zG-#qMIc(sI#h4A!`eSNuDwz3hr*YiUH^LOV7!9FGv<Aq3!RAzc0k$ol1k58H+o#2U
zzGfW$>X*iKOuFMZl4Sr^;M&^Jm;a$ppw)T-Apuf=tp~zd`&_F^ked%F%aT6-eyK4*
zB^N$vBtQ9nu3+{y2>-<#OS1UnCm$S#B4pipq=uT_Hu>>!oD^n0LhsJ*@-lRip6b@+
zFnQ*g{T!6))UJ9%zo?tiuH0F=n9Ffd<6b51l9+GU(X}}d{aEj?BBr11+3={_&|(#C
z$2}ea2zDIIl4v|R=H{x`jBEV4nm7_4!5850EKn)#Hncbj)tbe)tj$52ob560OlG0q
z6)lYp*RXMlFZ|Tnq-6P92qE<ORO_6)PNXNy9d;;TQTf(>T^bztoR;Nz{x!OP-GFY%
z7{LkJi^WlGRouy~b@Wo=5Qd#&GTChTf^#WL$tWVYReS0SO8%a72p=pW{gV)8N^xnM
z1mHgsM99$ywu(~(8uv}}IiLDIU%i}4J@dS*yj+Fs26f>~5&T!xpe8w#hz*?4MYY-e
zveE6F#us8DuXfQ}CkhN3+>t#Y;a5}m!?c#*!b_n#v2^y|X%wOrn=y&`_N|{Vj3%K0
zsycOnY~>e-ZV>2UKF^fp_;$1(<z(M}Rn(>Hm)EEoqA*8@F;ps_!J-%dIEB&@n2lWB
zPg;Q!UXjQ51N(e8IbU<L`l5uLe|I{~z)PK|g-Y&mMNT~Lqh*Q2iGgJf6?H*Umb0~&
zRp{p~ld~oD8#@igyA~eK;}&0toFiqw(3jKafA(Ilj!;BWQ+Koc<Tt<4TU-0%B(>FC
zDOZqV^3U*ApqJ2fJ_Vrjtf#|8ZU_Ez!Z?38Fz)nmJm*!gkm_op&BWtlB&BLyQ9T2?
z!^ON<Lj9yw-ssEond3jes_B(Y@iq2LNF0IUiti7Gm&^R;Km9Lf-7l`)?EO;ns9(+E
z<1NUU-{N9!B0;KeX~E?KNmG6!avdgnNLw4o0P;GO9Q@WTs{&q=3pY3;Edv1Lov>SH
z4@OSI!>~n}87>h;pi8kWyomW{R9JRW+|b#P_hRUUjl=*#TR1OhJq+Hlqc_Wl|GdSV
zD|i8b*Tr%M6P@Z3^Zs9aeP=jaZP=||qKp=uAwr1gonZ)xh#pChsL`T#M(>&EQ4*pJ
z5k&Of&FH=NUIwEx>gdP&zTbD9Kj%8v{y%f={p{!2>%P}o_uA1_eD>>T@b`Tu`Jc;#
zoopI%^!vpQvcJ<LA~fhgW$emH6GrRdO!r4z133Fkwi73HUGW}d6bHR$JbXz#b^E?D
zi<-pevN)q7TDRpr0bMkwv)>D6GdnZfnXG?*b2)+$;X%2iHaw?wqnyh7zCE~5$Y_=u
z^xb}Npz?<(4p`RKj~QJ4=>d{b5Sn-3a9i%b+_lDCa6M0aee-Tg;Sk%#kc5)a)Nh1V
zZ8#F|-T`zULO|Nk{%{@YH`=LxxZ8DW4Q8T0RPPdh6QRNk*lNJ=dcPv<@*04F+~ux^
zs}|la;xU=9eBt>Th~MJas_~?#^ZqGdNdzp;(tLAcMX|HUJ9nFS)3gguh-#;`iBrh{
z&@l-Tn2=cJNO*pqJB4jMRVzHLJ#e_$HS-`LNCPw{@E+ZloI+sXPA93~n(;sPc`GW|
zPsqsZ2c6`}VJ1~%G)6worG*Vg3Ej{<f3hq*B9aLI-ccT{Tq__T0B{t30N--ZS`Ie@
zZAClX9e0Rk*2nrF-|iywnkVy9O=q6N%fFHoFRUs>U(inZInelN51aKs#hvKoT&O?3
zE-W7+sWbFKnaPxR<vB;0wVZ$SQkSWwIF2a8+163Rf2V2?)NUAxWR$$+&=}v^z1gk(
zt=l#%FLPs06|Kw~|F?`DHzZqtAG+xf9TYFn%z4g!{IanMtHj<xN|#imv*Xb`brADV
zjjG##SdguCvTA|HTUCaarZ4bVZ$vIPQMaT<KhT`B>hsZntj~`cPoE<U&`aEZ*b>Kf
z@Gpq~@^^kW#bXG^k`D*gELnn_9{I;i*g@V$z;XJetfx{i4A;Bok9#5`*=nmy>3x1{
z0?fwxJ6`59gsI$@wpQwqlC4;hYaCz@q|<G?kzZJHkoVv{>tRa>E&uf)zyw*q(fNPv
zN69?@*^gMk_%{l%$I=;~Wn?hamW>qz?o=eE55hi7H$p|XmteXc=&R27<P_#`)ieL&
zN-<W)l>!>b@s?sD?)7b1G@e(3Io&p65i73>DowLG33$L-Io|=+LZ?HVukz-^oPdmn
zxuW7)+g(!x;vV<W9+~h&wN&TAH1Sc(;}>S+Kp6YI)CVzOZSuNekEty3uUK@AxQc<&
zQ{g;kP2QC9#qg(TZ(@@w_G#YdVs9ue`X1k$Rev5~PEHWiXa>RC6-d(w-#<&&A8I<Y
zJ`JBY(~@ThlEN=ERu#lK2GKU4a27cKvW3zovi9fWiL()HMico1C@?};36=(P3Kd!m
zC2K_|^{>|29JVEoutRO-e#A+#W)4O!xg@`5izaJT3dRyP`4nmzBe*6c)EbC>##S6%
zH{3==wtOyRotK()9IP`YW=u!KA-w!NC=%vNaKx5pE#2HeCZ@&fOQk<Szyu)>)$~p{
zQhza;NqG(m_wVMa`A6FHul}i;;M1p*PGr3En-UTK#+}gp^BO2B33!xrZU0_fQL5Os
zCzHCx`E{TaXLIs1T=Gbzm|d-mG@_KF{dNac+&0FxouE0Y0M!rhZSm$V7m_V`1aH>n
zdFwIH@~)<ath~v_?{AUbqp{M@HjfzzlRvC_;SJk}8gZC+eATEFo}kZ-_OO#TUd4N}
z*=uGll`j!1x|8$a{kROC`HQ6$S}_XuZ4bZSSlWFSO-^`KuW6y-Ck1LJ-O{zv@beOb
zq=%igFIm_&c(>@kTZ=~MF13xj1j?yI=@aiv&M`i9A+yD?;jwwf>zMc9Xj!q?T8yE?
z7ti~i_-qLI+O<f;^N5k0M}qvR=B;Lk1Tsb%A3W^RDznJ_CV560n$$OYGtBk!L&baL
zk!e0`yO?P){bDwGK0N(0@NA6r)st$CBQts~@Urik5X)F4Q79T2zx2e%xd-__9-@{h
ze@x2%$3s+g?;#3{+3JxY!Yw9i8g@6mhs%w_A@GvWK$w?2UFoyo%BXw8i0GvJS!bux
z&=V8^Bblj1dAjl6jEesb{U(A&iU_h~t09r;!<OXf#BR2oE6E`?5vj;7Pg1c&_S>zu
z#?KOv?O0=SeWB#W`nbCsfp!90@G5w!!_Tm+67O`8{AU&->!4iEm@G>wI7!?yx+lL+
zSP_;}&g=_{Gi}_@LYWDx28JQI={3cyD++k&;8r~~-+wFBK*A8>b*U?xP-=)8g_#(4
z8&puXM>PIfmo<+%(l|<)y3^-qK0k%Y+Fh}8!rlHD>-6Eq{GUeLsysIhT+~D2-YlH8
z@MZO%`#p5)NHY2Fsa050vrSuwo`#LZ8i~c}89&$=HW}+Xz&o}a4SZVc=|@7_IMYD;
zWX>pVP)u9w&8UaYYLDhL$%B79Jm0>EHdH&uYsekR2v}oQaOL>1GTN4L$&om@aqKrQ
zh8fu`H^iu~DTMxCNj3uin`8sJPqMk6jrdQJ&Arhi^lp}AsnwwG6zA&0HDR;RxBMf}
zBLHzUXn2Bp{bu|7;;Wo=wSN?Xe%68E@dKT-QNbUrb#Q-O6o)bCTqZQvvmmeQx){Ld
zlS;UXym{v(q)0<V7MO-?E<u&!eQj9fwgU4sYR}4Ey`88Fx;5x_cD;)#vm-6?qTAj6
za^>W?zVwjpN%Y@PL(t!~2}oQjp!vdf>!VC4!*8V_Yn!}>)*o>Kn!G5^g}*rK*{U{u
z&%Ck5uI6VcpJH*$=@P2vpDMyWjm+9R_#s;3A)z()w5z%9lV{IsJ8dkR?sC?4IUdTQ
z4rN#NXL4wcD`K#GT)?r;N?e4rO1aDnONY45-aFoh!WWK0vHKy|lBkU2JJCC~y(aku
z>5AH?hU0{szpY$Y@UDoP`2v}&f*zJgCH0r(#?Gb|#)sUTicSclkH3*zaZsVhtCjKZ
zlb4>=R!2@+4+jy*OS{>DinoFZCCR6*?~9Dp`;s2iXQ6)|NVFVBey31frjXn}s3&5P
zM~EoBPo@!dGL^5#=e!T58HkiD+#&iD*2|<tVrBGCE=^kziIOEWE*7+G;F4EazC>8q
z!mVbpRszP%KBost_F@m$OaCwJ<vS^FCvM63xGHGHNI;ycEYm{JL3sXv{a1N=t2{}k
zUSg<razZQd#orpi6oy=IK}A=gB5vhoxv?=+-s+VCFL+j@sUn|bNAmcYb>Y=y=~;zd
zUhR(?ZDr~zV2rM^W={aQLzJ*Kc9ba&DdK}}dGneP5`Z`2L{+}t?Mj|1)9+e1vCjZM
z(4zMI`1{W)@u@HFyXc;LR=K<h{dXRnIDB>=XvNMtqr@(|a-<G`!fk0L6uG27^5We-
zj5M>o*Z4V}UFpslHbP)%m16!WX61WgWrEY6M~iWF4YSTa+Z?i8tn}Qo&N8N+|7OP=
z&%Q{$3~+GAhxb)6d?brA-3c<Jc7_lk-!MCsW=oTS=ETE~w>};I<I2g+`O~dTFKF)+
zjtnZc))QY%<9Ec^8i`{m#x~+kzuF=CN>5CeDHy|HmrMI#>ZK_?JE<2I?ACp{_GgM)
z5AMy<W{cy8L+nB|5{*WSQiBcT_29AZB?1V#g3&T|YfC(>!LJJuotO3w1HRSK+-2Nk
z#H`+H*Nzw(eyK$GOifS@`}+>+!d<*!iKkfcgcwFn<Wb1m50KCAGA-QcWA#F@F5X%5
zQHL@{-bKa0-zz?xXyTnh+-~{lUg>$6KFc7<vFttjY^6fL{G*Y>=|i|iNDfXmM!Ptb
zXtYMEsPEv$IoLrV->h+%C#UpP*Hc>LiB5*zQO;n4t*ru&W5~pyINyk8<;EPhR?<-d
z!5?JNh^=u>tc!*c(|QWHw!~hTpgk40;u)Lhwv*;|c<1s(m2(NRAmTlr*5cFg-@^{d
zuqjyo+2N2^nC&ZiitsD?jU=u|2H%M;Nm>4+<&*RlO5PB2IQcSbKvf{TDBLl_$-uH9
zO4iG{L!M7EUf$hj%5!XGKR;Epzktx29(K@f*?)Z(sLIU0h2<4>RdBslf>s}^*2lz?
zFCQU*jG*5i!#6aIundm700MbEsiCbpw}A*;?XPp1mVuI3zuZ&qjX3_J1Ee8*^31It
zezvc82B}Rwmtmn33^?WzDF2yvp(ua}aG-y^b)QNmcjr=(%KVTb^L6r0-v~2y9yZ7t
zDfq7V(L2xo>b>Sf0=-Znei6$-F(a2wPNR#-@!P_H{+6VszetPrKYx{`T-A=oKw26z
zrL~qqSfA5*rmK2-!+7#p929X~t7bS=4>~Hn>dBPzp4odxnHji$5W8eoR)UVuEV0lB
zLS1M9oH>IRrl>6yuyAy*T&E-B4{fea6?6>Xl?wf2neT-x`C(Y|jQ4I)QSRzIf0^Rt
zj6+||$4-7J<WRn%R&|u(9#Y!-X8b8HB@AXh_*s&?g|}0zQ|h9P-T*E04%bX^_Jg~x
zP2C1!$fnTdqY>$mYvA6XGf?9AYw>%Z4R0~hmh70ZQm+B+MC#9@j5$Nx0)$FhrTk&T
zS(F*E7%c<+CEn<i<r7&a6~6vj4TS#|8S$BNs}Wx5I_3pHo*jW~xg}<GrjHEIhJ<Fd
zD1!LW!`MK!!RzG^m?YvpuSRY&1-|tYC`$T|M+b{EPi*|BJf6u$(?e4y$To!J6{yzi
zB@MaJ8oCRKcp-U+ZgApHw7`Xea!HKRbz2k^+OvI~yrc`|aUEXqQshMb!?*u)l?D>D
zYUR8D5+oWd4}z(k4)lD(^>>&xXyjZgwJ7p_&~dw331t)LE%<345<GdEN%n4U!@9hT
zVY!*+AsF*#9xe35J`)90d3uxOsIhDP>;lqn-%(+nNq!W;>;!j07QUTm`Uh&$eU@)~
z1ytc5UV2?2Y;3w2HMZU;Mdzv~lwj>&r#UPkyUM4afpeVAulu|a+}OOu;Vk_yjj`q7
z8Ug#w&h5uJAfI)9cMI3{x(cm}**s^IA+-;;Ka-U;)-Zxw&4?*Bye2vk0=^fx00LF%
zeQCKj953&4Em@|nqYM5lJPB3c68UOr(;6c|*)SN=XC^3DjGZDr84v5i2~qYRO(z6z
zwVUnY!$j%Q1g$+<IvhzF8d-|7unDjo%{P_-_7c@Tl2W4380mrk^!Q~2$!tjTV1wpm
z8PeZo?W(QMa83oq!DciYkK5Hq;L7Q&Yi2ah$n@M?;$ttcvk&`@Rr%SBT&rJ!9!i-v
z{0`jdi}XgNxt3^udZ#l!AqEj>ag~%U2|kKbLb$&I<3AFgwLQy=8i1eMKUho@y)5uI
z@qT+}35tss53jf!Zq^Xl`mDRi7WX7Q`0BXEmnoQ|t;{gx-M0pg!9RYa&9ATIa-sL>
zssy?H=WSo#bgrauTo@bqY82g5mqX{Yt)H^M^DOh1p*BByeAbaSd*!3^{tk=6xJUJ6
zW4*{T#gADUuB<~fuQS}r=eP2-4MoJm5`A;vYbi2hONC8KqNdIMcTmZ1aX=`q#l3pw
zl|TRE5?5DPIv~jFewc2oI(5=u7z~P!t%al#=SPDA$q>_GDo}AOvg7>YAXH=RVF!Mf
zzd;}bNkw3#>p$B1fhA)EX!VG(l>*C#3&TV7^24E5KRuWuFU+kG$<6IN>~x=3!ZG+?
zRLnh>tT$fgLk||siiK~KnEcy`_-|E;gL1?WtI1Ps$-`27jd<<BAo`|z1yTZo-G(4-
zfXT$x{p;>Q_GgJSa-n?11+w>RhzIz=)U|G0PdM>KFI2*;Ta}>;v$B;wX2huT`XSlo
z!r1)|aRM`b)k)tzaE)#$)Q3<93w3_^b~Um{$3vVDI7{UC4P+DZHH6sI<o0gH=bTlg
zdacxv_1tJbqM@%Tu~uA-5r>=p5{rOzb8JVTt@MsUtxfPVLoT-Si<H$Pmlp~3K0py9
zrlZH$@~y{vciDylpGTJELsDqDI25Iqbi>pA%_4$9me3z{3dUP9X7_T%fPTMtc>mQ&
zoLMVnl8n>o8@k5GMAkKz#cs}lW7XN!d{?>fewuG<P;zcnmNZo?$k6kh5E95qrVf*~
zdgh*2zEu&$Q+@`da#d>YW4&H2Rp#eq58RcM<8p9Mtz*TdkEERbawvb4dp#>phGoAu
zCM7elA`-|-9vr6~L*-{wIYBw`MU_J^*vsJ6jXI?#>H~ZQ2zN&ol{k+8m;TgMI`S=1
zZW6iSWys)MXi?13+H&p8>&W}->m>J{p1#au+&nX5IvOf+oRk<1D??j3ux`EZPjQ+?
zsxy;+35b#i10O!IbtF8{X~*Q-t?f08$Tt24Nc|XM9wdFZfh!nbw9h#>|MQt_-{K2p
zk%mvj?TQnDJWJC2d-W9=>6_%|Qj1UjmR@+JP)35pSCZ5~5MHMWu@|`Wp%Bsti7<V|
zqoII2!j&5I8Qpo5#C7NKPhmqNMr`tKR@^CQ7be9YNJ;N`g1+)5b5u5RoiPo(9Sj(7
z#_!Ur>0}gsUwW-tq}R5%K^Kt@Of}o+dpI9(`t(SBrIxJSHT_K;N|K+5Kx**n+<0Af
zfJHVrUf=+=L!>*HlV38jQg-+9g6FIW2)_R2v;2fSXsfuakBz=;Y&CFv5tVuTHe&-J
zE`f^O`oKPRW{|L-fY6Q~){3WRQ_e>n>Ocqa$EEF05K!j&&)I~`_U_s?BrKIH-=Wgd
zSoYf`7(&8U#!97ceHxzwaX%;^E3<GtUdz&d`NHgOfygor1ZsgrF~ot6kH$8rhI0%i
zbWeNd)_+p6bpzgaaJVfz((YsGi*?&3dXkdEF?_#zje$f_?&8dTtqTPy_3QB;0AaA*
zz2@$<3yCvQ|CkU{!3+Dv5+~}qby<+-g9#yzALI|`%}|5eT9my)uf01$P`0}!TRSb=
zZFbK6^U=v_&Z`tZvRYbt$69JNS!ZJvcMoNKA;99JbS0!~I&3hzdi?%R?Ua`pRc$QE
zr;N;2*`gJzu+d2bWk1j!7Hupq0_Q4b{Tt07Dt^AoohL%i(If-ig6vJNmz{pl@zPg^
zh9!ZH=&~;8gqiUwE)2_d@M;OJBmNG(4U<R%OKWcxu?8bo8{bNEy1icebEV(1{7vE$
zDYH{rfcHj36yfl8aB<Wb&%_hsOv{GhkrIKbP=S^Z-8t!?=RwjMS>H%XD{;9|&smLR
z$PJ~ow_~?SS<iymv{<iO0c>qay;;VHC!5nFa2sHX?pvk|VH}@;Y}b71vIhepY~}mR
zp;Oa)0;dJ*GB_+jF^GqczU?s0Og0W1Dr^xyHE3{j7kmc@8>96jqwhGCk)?V|^=|a!
z6<w=V^E-M@z1wS_-xOOf?`pO2G`zIB4duSHPS2`~Ij&7p=d*CkHLDeEtr+hXZOqph
z8kFEy4^4Q+7`(Lkz`@$BX#Nc^9Xbl4S?s!!$2?c^wE*2g%+kNF+567S)7M;Y*%fjF
zA+|R46(xrPl>AYP6CJL8Qh%yIGR$kXtG3|?(4EHCH&>5%XM4*%pK}jC1DA+ZXyY^E
zO%^VsVDf=WH!=#^m}lxT@$Avrugv;O2wtra|4Q9d=&QuS$A#y&RKn*SwXq!AJJVo?
zjYY}L>N)O(yZ|o?Kv(nmO4pYC^0enqE9BB<4<{wPhroza!ROVn7~>2D7fWLKwL+?8
zgZN=D0v-XYbSzPRM4Qp<X(m0Rq+9u6rlJ<>&1zXJzteQd{fzaSOtP;`MVPv()~rHl
z{pi21I=F*@d0Ea*wuXc}BiLH4P*TV?28&hda66%fKv9-}eL4YFeb%B)xJf7{))-7A
zXcF4kV)o?WgoSeE{ksntq3m8e`stmySHb#Q<B;J7xGK_lWb(t2eef;Y`}2APEb~C<
zef&GQ58SuiKFP^c^PaF~A_Ha;lmMMN1MAr2iR&Y$(f6`|uv)8<?P{eidg#Tn=4rEx
zL<!;Vv4n!vK?Yn@H^`=>kOAo={(}-`IV1%6t;UQb9c+YYcW^mEJ3fY@p>1W=Xnbww
zl03ybjtTL(fk%j&ry=W>9v{$6O3RFW1ss;Xa(}x3N#{<RoX4h|;jt+zCVWG-x$f&Y
z)R%=3O#v3{ib<)I(=1@;yie*t7%^xPlQ(T8&e9+xTvN`YJV{fwjQob-r#Si%3q<Zx
zt#umt%n-#$mJpU|fXu>GJBqw-yMH01I3x!d;jw)b_ZC?JR2u)|VX39i7-q<+DLLq#
zv349K(ER9`nN5h0bH8Y})l9D*QA`&$^<yK|h8Ad(%8yCC#tNAf`cn9ES1r@BRAh6t
zT%Bhy#PlSSNp}0lDVd5vbA09F&Ks^*Fd(K>fg*#-CC*%^?w2;}x{euly4XSSq;BQp
zU+I5$4vGak!SFoJR@v<Fcl3MU3@{ZRKlR}$I;3}k?Yu?uD-#zaRe*}zXgyLwR_@C^
zAKXFLlw-g*Pxo|nSd_5!+Uf9qI9Fl;1$Mn4!J=^WFOHfN9YC;u4yb>AC+Jp2aku?@
zzF&yDxp9*08p{8elIo(bxONKEzN||gaxG<Zbs~D}K`F_3WOiDYE&waoSZ94!<@2?p
z<tkmOS0QGs0Wqs~ONn@j4ic#MlS-Z6x@po4r~eY8ba1FwguKQ3wCjhY^Yfx76+VAh
zcTi=9!n}Yf!@pY^GXaSy&D^9(Su49;2T2to_Tm;oCey8W892ryvz80v<Bv6~Ay`vV
z4Qug+a!${4@kRoH^@O$GlaAE@uG!MCe3$)j{-GDLccFxSn;XJWNBB<_SQ)30qXABU
zMT(5eG?r0?@45=x!?Idm2=!l+<@0KZkTJUj#^i@krATvck(xXq#cRA=Z7DrE(q(mm
zu}~mX#go(5E)zG`gX8-)dEP+1^0Ze>T`zyIfSyf`$H@P?Q6%|rj!gyU(9x6n_J<7S
zNX@31@}PxKx8>qvkyxwEH_YNOYZ)O-yU~q2OQT!R@*TV@96ls%6d`$M_#Vkyxw_9>
z15%TaM&{$q-L!4B19Xd*M{Wd7!<QJ<T_CT_C)N>51jfW?UuUQ6rIp-n3|ze1m35JZ
zeC`05x?vXHXOISe`57`u)Ltve=pxE8un^Vtayik*sc>)(P3G9;?ZU@f+;@;GFuXP#
zU4>iQ@rOzJCiP3w!#mp!Us%R`y2xX6Nc>Ikopbb1uLTQCj{Gw$J}Clr*2xUi&SSoK
zzx%e#dR>+3Vg~WECCZ3P<XzX;{itFQw|P$up-)1Vy%;G1=;_7v2(B)x(fqt@WFcWa
zk#`RX9Q9}Tvuz;N!g3U(h=VZWSo40064X-WuZ(wr+~>o#)a9UJ`(*dmT+C(2!>vMs
z5mVFzA(<RYjE!_S`oZRUVk*_J{x(5i{LsUfwCM)pIaA~<x*^)9`1vb8C{5y*K+7?K
zA3c7%d*c1GD~9B7%2FCKmku)%!A1UE5<(ps#dVaI3zHKL%FR4#OP}BoZKeQ+=_ZH{
zDj%?4JXtdJ=j+XF%*qPUdN$6Z8!~u~1)YOXKrUgu4Eaz+?Z)*$E%=2-{g^8G7vwE!
zY(#JP$n5dzZ7i4sdND|Nsu3VJ)M@6~U3cU467}%Rd+4&?&p*}pSBFsBsYw*fI&rVe
zPu8}`ItGyuuD-9#Dj5)^zt2=+^<!)=eQ_Et|57X{R^sx|w2>HO6thh7QSr?esjpq{
zJa$>0xI8gn4m>!`&?={Qa!^?i>7PeuN3)@_Dp#^Y0h#vc;^j-~oO=(_99ttBQGd3d
z1KhA!W<vm1hwr3L0;ihg*a|ZK+_#%7Is6fS4nG7zzO#pD11zm|y141&nX-f3W+h7s
zS&Hf>D)yDuN1B7QfX#WgMz+MKV+hQ3<<4Ahh$U@K?eRs!-{$-&fQ#+!J%W|S;l#1~
zRoH|Dt(FKGR>!%FiM>ybXdFBIbhYh~ClI=tlje)HTmiliIXK_tKWL>R4^!b}%n-pL
zt(!l9jfKlrcNNkriUE^b^(~1U8%ZS6gro%0Q)hQvln}LREl!2JGjhjSXKTqDl3!0b
zSfdyHSLdd?*m2F)bSk?{#bWsk$j+I9+A8RtLSK=U$lxH6#*m?1Z$t{B;{&3DZceV_
z6{C3Pkk5i{3EjHAy4j6b$+Fxx-13(J=nX%El85C>BQqCf0`wsx`uD6o#&4q$h!m{F
zDU)&%{Gczf<Nvsq3%wubGZjFbh-YVq&+%~0<cGM`4^l4j=zJ!<cts0Ix>F7yq9@yb
z4eO%g<9o)M_`Wr2eg0Y7E3Y}+yJbO1r!CQ(KtY10zX^;JSoVpnis@LGTtP_;mYV`$
zyDrO7mMYWH-?<nCU0NRlf<KdSswP?z|2)@wB=pZI;smGc{w=n6FQ`~?@&T81b<ho>
z%@K;TK8pko#=t*9n&x~)X^r0Cb>jL#`Z3`Wb34k>ZuMSZPhlYGYU#S!bvzHa;F`yf
z1j$^#jB6Imdxs|_2)v-`bKB=(vHAE9-f~sWJcpv1aogm8Q!ONR2YIn)47?|P7!MKw
z;gVC40<+@_dgE=79POv;BdSzc@z{t)RBULZi1Okg{-3GiA*Et}2!A;Fpr|^4Tk1}f
zH;_v}a(0o`qAGUaL+pm{;A=mUU0hM~s?_v9IP_=V=-3g8`Yh;WT3>hX_ly`DJdi!Y
zxXKiY6|7uR?iS<N8)5{$#a^uPGcN^XykVIwsAZF2rVfg0Wo?r}AF}!3T=5iMl*Zg{
z6$!C6ODD*21`o{rgU8#6AbMWio=c)q?XG+u{0AMm`y|2~ol{y?K5U{&ik8~v>Ml0+
z8>}TFWS40V#ZQm*t$mI5F#Vc~Hjp8!&Ze73U^$!*Z76zdm*^444F<vpsVBIn;X_j)
zdS5!ll>Z#3jKHKcr_Bu(`NzD|&m|6sZIui8fUDTQur5XZcNPGokO#yM!WWcW72<l(
zEbw$nvy;+OXi@13gEp+~;9k|vTj6|ZGMgUb(uCUAHmy$%9}jiEe6ws8aP88q>b}?A
z#rSQgf;wKYE<M^Ddf^d$3ISO>TN*6jwcem}NO-Dx7TmwL7$8>EAy}9#NZd3W+#CZ6
zg~g3&z=<rF11?X@8rLWsaqj5rNb1g#xo32aqQ&TI#Qcq!9)9#bLodnr+nTFM28-c<
z26?s~to&sU*>9%>#E7U5O8SZD8L~ds@xHYQXT`iSXohWmw91$z{xJjJPLf7=IXn=k
z-*_AvGASk>O59RKHH-DYou0X|_l4N{N)T65wR>=zaj-m-92yg*fhB`=nLo!KTo9|R
zF1v|4oZuAJr0@==Y&{N+UGxz67v{?=FFQPvFJ~lv**K#-+M6W2;H}C?=;y1a^q8Ha
zLcPKK@#E2S#rc6{$aCdKH&*g$A+g|{b&<0STDA1D*G((&L~C86ptct29TGxtp+y;D
zjj;{e8P4O|vtTz9gV=k7SQ)xTok|F{Rkzk7QYxKUJ#iypd9RP8CTG#>E!Wb6$lp_R
z0AajK86yW1-;ON(s1g7=jshrm`^}7Rsg~$^d2Wy=HxYG;zq!e3-(^Ad1e6ir!bL11
zIRxgz{f@=re~8sc`W&ngtZ1~kyb=bezn)wfDN{VlimU4_@jE57&MjavXuXuL70wLg
zg(c)l+sm6JZV#7Af7VHYh8Q~;Y=_%yLpA-a6A1_z*~rp|+jU%eV)@9UmI53i_pbG0
zpU8DEPJf+I`4$8V-W`xsX<^^EriP*|HLgF{W(Yx*QYQcHA{hDNz1q#yI9x8pFZ}xb
z?bIsYt&X#vpGgBF=-rCYwW-?)@6%mg=k+=FZcF*7UZLKYweTStE_Y136}_^h&@S3)
z<6zO35-JIlyQZJh{7rl2H+v8>zGx@Fj^pfj%x--o*469?CERNPL4Ip)N;7fI2+cz?
zNGb;$%wf4g*K5EmK_9f*cb;5djaA=a5u9s0a&#>fuNuw8q$#Eqv&`{$u|1_NYZ&6D
zQhkelz=6o{c=k-@u8iuu&+|1LmQ8mx`OYP<>`Uyt$&^H_l1G^;$xk7am4UyP{l#XA
zNsqCh#?EN}x!rfhaAenZMV;z(vQ9z)1Qt+5t@6n0qrVbPnMDz&GxHs6V4;99qmxvM
z_-0UURP&G$;POt6D)^w)1RmnpZu8*1yXELR?XK~ui-DguF+%Q&8BvS4H*?c0;#?9f
zZt)zg>kLnzO<1UuWp3G$(2_+Wx&&_zhG!N2Tix7H!xOFNbnUhz4a<N1AQOsyT|j^<
zJC^X9Pha0~+>eFDmbVgnZQbQY&+KhChiwcizFa<TC1}K>0k1%lR9PmP-7tPS^m8ye
zHR8LTbU9sq(jq!&g8jk6uWcqLT`ztD)&yMFTduzRcj~{z(>s23Le8ob{la<joCl-h
z&}s027?*CBgzh71kKp|+MmQJry9qrDvlh8oFG`27Jx)eCNsh*LKYmr3m%ce#Ty>rP
z0>S(R{BV%nbE_6UYA{|>5N5kQbvhMM;02+6Q5;#A2ckKwTWLSDZpLuYZEs<5Pf{-G
zWha@!7#)9AoJEDKq`JYsd*Ee&aLmTRbu-yy^<2BuwU@IEW}lT%LO>5Chw0&1AGp;Q
zEO6I*+A4#-JjLZ}l5djI5ih>mVLExT_d%*scca0w(FRidz1MHnVy`XcZX4<pWjJ10
zeFdpTku$jW16OA<**nknvUs22F@lnyt>Y^zRK9_MFcI}7@-K8)2kLz^?6bXN8^NAC
z*AE%<$*zw^Hhz(rZ&P!M4`=QFA=d*EacD7Uhn7aT)8=JnQ83E0A=ovES^e#_2)n|b
z(Mie>z$D2%tRr>ku8;nZq}5A(N3qeTAF_ktf=s7hY?YUP6g=PD;NmJ>Rt|$E|F-~#
zGfJ6-Au=lS@3B6mn~&iZ9}8AI9*>=6wJf<5xuRe>%3L$_t#)+SsUw@W5%?M^ZPy%K
z_-N@@6ed=2CGPLx`ys0J0*{*S3z9hQ?a8nEht&Ghw`NgaTx~K)EF6k0{uYVt)y<mC
zk`C>Uz@LPZu%P5buxc-yy^I|lz_(QFvDs}KUA|`DPQT->K+=eHAr%A0uiC@KVixCf
z#GL{tB~irz)yEgXb6s}**40@YQ+ShK2M`%T658J{zqF1cj9C`enQO*SQSH$tM!4UL
zow__seWeT<1rbJ|8>)bL(W}zFyU`CEQ^`m7<If41D|b1V@s868&|HE(UGZ&E$Z|#P
zK)U*?CF$x;o9W6b!!LgW?a8*6e)zuL&HBu|M;L^!^%82W<8n*vByP==LI_{R2H5e)
z-o4GcPP6!>$gm{&L*SK48<(%VY(R$uWa0^#oP2%rUygK^XUII#N|WcN?os5!lr*zK
z5CkuY(YK`#D~mmDU*^@nsw~rmXMR^Tto&mthuy&?;=>`aum$CpN-!AShKfd_Bi0`a
zthcps`8L0H{sl?*-;r;&MvsH*Xk!X@G96jp59}N(?6)b|x8*FhQPpH^IJ$G7@jF-S
zARZM1CcDx=j-Fc@0KG4XyLmsl6fGB@hB@AUC4ot3L`8Mk|GM`2oDNl=-;mC8iINqD
zr|I-&sm`m0FRC7&&pHn%Z+lU+)0-HY`ggtXQl+0|fFMmmy3kv))d(`+VXQ!E>Pr;g
zg7tzYQ;>nF#>sxQ*}0OHk?2(;?XDp}0}eJ@__<Gc3<ey$)Ns{oaiK|HY@0i4_2qR`
zx$cH^&LMoo4;yNjahu*GUrIN>^*BK*Hs3H2B77ALc8z!DE#?&u)*h}>{be0uq92>9
z9!=n_udrVivWrRXN{-1IQ{^9eCRMoJ7<a6^y&R1P8RU^7%rS3O^-M^j{XLGm7=|s|
ztJ6hr6nK_nrs}^Ph$=}O9w#BwdLm5)QmRr9r+82oM&yJo9pQq_EUm>2?_|N*)+(u>
z19>3Ycv%b&Hx=JflZGC#jVR1z4tL7cbDy&RCA)egKdgaGN7$!h9=mEWf%+6SQ`5_w
z^XKP(O^Lo(c?a{taBQwFsJGa$`E#$Y$C4?wH-+btWd%+nJA}|y4mRBpc>d#)fZmX$
zxL2QIB(%QbIs#&q(nOKBY>GPb((VBQzXU3!y&F%7mN6Efz4jgu^6N#s%b0=hU#u+&
zuaTG~&2<ECbwb&|RZlWxcJt^xop@EMBXL)P=4E1=q(7)gwFIL9Uo1|q=v;EqOGgg9
z@O(l_p4z4FUwANOxY(Am<FPA(R3E(RXK5sCN7cT1>b&5x7^9uKg4DI*AnZ%Ri9)##
z$Q6jMsspKWZwHWqXT)Ht)iy#n+df*xe6e_Tz=izG&M%3tALL-I8#=jr#aad6G{XDh
zsuK9kiL2)V<*CEOjEZR<Q5|aOVVbyT9K}btszb15@5QTS8cbJ5qi5Ie8d0$6;<E{S
z@KI$}WbC%qkMBo{oWeF(A*;*SYdOC;4yW0p37%eLwm`{0dmwO4Lf97NotGn{Si)_B
z<uW7dy}u!g%*;<D{*vtwQPjEu431kM8ED&qyc)md9_aqHu#|6G6Gn(HCePMB{NFFl
zq4XmY7tj8B*^)fBn+H25Jk^er_TrGsc37A8##Mcpruj1mlf%6eD=*-xYlzfueb(m?
z-mtfiZ$SshbCd&2;t=vjl&Ah@5Z&)-JxODFi9wS3GBJ;D&V>g%+h!+zE=kL$GFNV4
z7rx;FCEDUkG%+#JU>T3K`P#g-YILorzZhjez_;^Lo!bi$UITw$rI=Cws5*2y1b@5c
zeMQ?s{X_})%agn-*Xg;ow~KW{TW-mG`NzA9$kk-1$P^{xd4=yKJ$$>z_;FVm!LiKJ
z?GtF-oz$K{{w|A9Gf$}Zub78t4F=>$!gJ)pl|TsX+gS<s)w;wn0UW{0ROhc;0-U~4
z62aj1ImE8Ezwd0Bkr9XPia)b#U4+?Gso{9~TfboKR=(B3cvoe_@$1=DS8ipd#l{?M
zVf1>KMpK5@8z_`S8o+c^`}vQm)a;R#w`FP#|Lkn+cHu{sBY9Ob{h$8wYrzbe<3h9a
z@lbKmrRfeSM2KN}AW$wnkB?jN31aL*jIH1psbc4}$suW8RlxGv>x<G|BM7G^>a*eQ
z4tL%B&g4IYgBzY)AJKTu$>=)M#oq%doO|_mxU)a&_<UBKi+fV(3m4mXDORml0*k1R
zOstcJ3x_=q@?>-zwZ5!-lu6BW6g(Inf%+ZGUF0Rs!|VqOq+LH+2;B~PaW@p{l&CiB
z^v<38O7>GfkI|G%O#=t8#wyiywkwQE(oCjGm%)bN;uDk*d&;j;=Wc@j>mjlpzhcpx
z_=RHoI-001mX9e8UEMjDoGT0`XkG87vmVkVTZ^coCm!jkL9;L<uBC!IBLVk~B3}?*
zmlY*&711pC$t|sJ>}B0N$7+}U^hUiwTlJz0g6i?$<2uRfssd82*)&C$4C2MWNf9+?
zg+UQ*j8`^2Yv!nR2pyq-y>sGn=9F+sh4J`G8&K5=OOAs?&U6Qh7N=FP?JMGg7E&Q)
z3s1q1fIzyj8<#OJnhf(T%g`&6op2c!I@s-fS>&5Z1rVr*h|p)o#Pnyuzv9IbPda(w
zIaGz04G##~Cs%qNiYV&-Pg|7%8@?OWept39xV63l70`KoA)?sjZTIFfc~3+g^z_R@
z+_SDML8!zo%k8_K?9n`-wba)8)~`cu27ud_lE%903Vlilybtqg&C72}ZrJ^ys9V=1
z)7vIgGnseh+!b3O@k?Sx!u#DXO6O_s$XusgNW7!}fysWwN*Y}AzzC|lkpf%QUr|}2
z89eMT(;(j}YYuJ&Hor=!A?+#=y=2&MkE-<9>Y#sz@~-fwZB(19GfLx!!miFj($3eY
zuIM$y=wJfhebjC{w7D%BB4lk?8gwS)2;p*LVIy&UjfV{*m=3<XMYJqgoK91s>_zz^
z)UEiytO+Q!7mHqZT0*H3csb##8Z{tC{A}!jEIVoQa9{mnhpJ=NLy{g)xQqkNa^%JO
zkHNfFDRD=OgGd3;Y(E3Yp|4gpO>@-JHP_tR=~gng=PMToOLFJXg+gs>=7}f-;gw5F
zE}i2x7xdbHHY3^wnC88ftwe}L#(=R*_K`Am`(pX<t-L7>yDi1?_m>NbM%#=VT6C<^
zy*amk2Gd*RL|@B%ZS-d!;^g~FJo_74{bRr}60mf8azl3zFhSVLkas)s@4oqG73qN3
zRMWmXlH_5IWRKY%Pd%PT&&NZzA9EeFdfa-QD>YOBivpC`fD!$qxZeSa&HzSfoTQh5
zWr+a~4>OFf1-moIkNR>~DZ7kkP16;h9-=dp6#rvG9#Wb_uOCVT<PR~mTuf22-Ze(>
z@4J0sUOPH-E!=jFNV!tGK8ma0X>ON1PXjdvUsqlY#$+!*D6l)XJeO|v9YYT74KjSZ
z`K?uOdOO&1PX>$u{&o4o+%3f2KE*03bLKy)*~qSrvPq0C{`eG=05km|E7^&(6ZkYV
z*$Om&@KWq|5}%&f8$d*f2BbNY+?c<_?AZWiE300peALG^NAYCwKsBzF37CWKHX4?0
z#(=&T>vZtT{f2|=8F@S+yXTLa^AH$&t<dX;$cK@ukXj}<Pa90fzra1>?%&pm8=jF3
z-q8?L^J6*C<9i$V<c(gNtQ(~JM6y#%rhHb-4wzJnt?XvztDwr<)9HAqGTRB$bDZ;*
zxsf^(KNXym2-|XOe8&9qB{S^{QWg0{6lxBg0|d`Mrk#GZ+?<Y^Fkg6Y4`ubw?R0Id
zmFIE^WiD3*$f0$W%!QEw_XT(;RFDmfLQ?{6h$5r_-l6aw0TG<K>aZOkI4U;6G#$@#
zkw`|2AWB(|H~!S3Q0Q~!?fza;9FxelSEKbN5y%nG<)&#E|A&1Bwj*(0v5@|ZAQZ3$
zFsRFq1=2N~$~8Nhtg&3jTVD#7Mpi8vwGfTG%+wIw6Bz$mBCW6L#e^}u4SP4AetlqA
zKfe*qzxX4)iQ`$a2n95DEUDEGLjfaW_90bKJCpYB*RDsWO>c{4tOAWwm>p1n>tFjB
zwVdZClFAeAe6ev7{>5Se7ZY@j%{OPTTR7s*;}@C+OC%LNU8$VfU8kT^ViiB4W&{Y4
zEl>hTFBf@Bwc(8e3<+DXXK?`OB+TXG*q`6UNH?1r%WAWHEmQ-uwGwId7Jk|qehPGx
z#zBOLBrfyi^Ww7P5k<iiNXb|viT_Z`K_=ZG2<H|OM5HWc<TT)}E#P)8;AY7G66$!1
z2HvTPG700L_{DW9d5X#M6M*wA|J6Xll*t_5`c}oJUY-T^Us_T>(cQPGV^#66JBMDn
zb*M+qeFI3E#uC07)nRp74S9CN2e_`?D3ZSDY!t>`?bG7SZB#k7Lttz$zK;-~jTHZj
zV{?{R(;psY?I^`D$fMZHISJrW7#Or7`cJ=8HyYux>E2<^zQKR@BWn40R#C638#;{$
zcWfqOMt6%_80j`epJzS0ly+$w@heXP`qRTHFzqOuu15~!UO@61y7_Fs!vxs%$$-St
zH4F4>fDl>|!ZU@6t(2Nm$|CI49%vztIo71ohuj0<wfC$Z-ux%db;leWfq6yGKpF7h
z65+~`Xj0B*ZCFd2E+r9!=g)J<U!Cd#N++yxgYD-UPY_HL<PLj*5OX&wIeEj`sf|o>
zmMVeGP}I_09{l3|!RFmv!u^g1mhMmz;M+~p`cH<eQSwUP21uPMD*d$f@qT&hwAc7+
zd~=-q4|~mWd@FEz{8OH5MtAeD5Ndv7;P=8~(zCdjWbIxt0T{zBa=iE^MpK&+;Cy%$
zp4`FIGX|4&v0a2CQ%jM3@{d-4dE$95+&4BT{$l(Ro&v0~_u&#Xo=Q)0SL{1m<YB9b
zxp$MXT5cS)W*u#IZB`UPjYC5FpO`mb$D{s#ePF;+spil7V|kJf$bpMT?^*cUr9;3g
z@8&~&lIvhCdYk-4VmM}3b*<AZ5&UQN`uB#O?+^4ujs!^h3m+Ln+D?~=)}_yii|{qg
zI`s1w0^l1%xEkRt%3s=z7Z0U2<vS%OhhFTwQT;-P3CW0IeG%QPPB(IOVtx6kb_>aN
zO_D8@P&Yc=<T34Ww3at}ATCoTD_32X`oMCHJ`RbB0+qL-2=A^@V4vf=>yEqAEA}Il
za~awNyB6t{O~75`^Ft*S*TjoQmhc6kTf>HwmFyj<3qLFK^<Sp6^6oz&@g!+yJl}I-
z{CfY|`ZGx!iXgB=GKFP=o|7B#ykngBIYh2K%JAA;Dm*9Jfjr1w6)?_BirFJ|-!%ak
zt@#V^Z@znPj8MQWJ>P-fT{+5KFX}qpA*bNi9l*Oi$7Yr1caj`9lr!~-uq;#fD?_(N
zpR2mm(f@#20}*C8UUltZyb3k=G=o}8+<<Du_QEX&z(Y;`?K29SkKdWwz*JICh;Hh*
zmg_)qH_G{qBD0qcz2=bsHkx}+&fzIiZ+dd?x%cS=rHI4k$)=K*9h)P4y6Q#`*@Df4
zL<Ax^1UdAXAz(g0V6yRJ>u^Tohh&E1Kx6Od*pg+<Ii#-USXcV|Xzb(yWvx11%n}n|
z20r`DT+Y~4qrw<Hmx}cUYcdv-zVSKG7rQiuZ{P7b#XQW_uYcaQ7rH8liI3f$t@KoW
z^-1*0V7Ej#E)W+jL>_YU`Rnz5I6XdPoXpX6Det}~w9Y}L3HJHsC@Fx#u^N8GJ4lt?
z74VQwCn!}VRivlr=RioH)z4<)U9a3d6BYf}C;5a;vzfmKu-a(vOV8?cl5x__BYgeM
zO9d9Gla@AodxEs$Or69)`$WhLPa^IzHcLgQrq`}kQqr4yWmet^zSmCTW|r%?txO8>
z@OX~@Z1;_h0r;*f05br)o(i}wY2F}PIe?>#8jUbV3!YOu21-JCoSZN#57~jbpf%k0
zPosf$nb<>c3d6F5qQCzNdFI)0`ewcAj*8r6Pk~x{xCrbYR!<B?US7$xHH$T=Qfm@S
zGdp%rygL(noJ6EK-5zy0eeT;vu#XBnks;k#+ViEqc>%6_A*ZJ9aXii2CPf~YzdH1Y
zGMbw0DipirszQ79)ymt|;y!l+qm(;OmicW17RBW}w2r=mu7Kxv=AV|cFjn``8u<-#
zp2iy2KVqJE8L~K1WW~!bG*X8XVC>+b9p#OYlfwET-{QWDizReFGw1OshcW0I>@<Gd
z@0S2B(C|-_32_7<q}%ulJX&DJ@6O*BrkKG{E7ug2VehSf^)#dozea+6pYQx1aUA40
zh*u7n?2%!G*Vfm^f9Qqi9<x*LE_k@PP)~bxrDng7<k#51;Q^jXX-#c0zB}5H2spF4
z+n0b}oz2||ZQkh^ByVU<h-loGLp)NI_(L7sBZjkB_FJrn5gcs8+#`K;c?xfUoY%wL
zby%uvShLf*8RG8piz5**?vEjz9UKPuMP^DyPL+GLoje`L%$Uzf8t6_z5YApzqv*PI
zc8F?fb(S^tZNT-yLG#V!dBCO5(%mlVZdDiL*0`a#qDa_^l50oR1eEJj&G6zxK26QR
zeF|42msw`|AKGkL0Z;8EkfJzL^8H=iRnPZ%-?wB9-F)Zq<1izqKn7!Zi`jS|dLAN2
zx)}3Ln(dZB@iE}upgqHTpM6|#iJf1&Lod&@g`guy?x@r+f=O;I)mXAvqECkg%qeib
z-p$)}$-bC(a`kYgx6H=C^*JHe>q9R`heh3&rBe{r_H@aPUNNYC;v(W`9<E>S^=wvN
zneEHP!{BdMILFDcV#&9^KCh8LtA^mU^C-m#O~T*QfQuH}i^GGck0-Xz!jUDvFrOAY
zo$34av3KI`ie2;0@GptcWA(5;2mWSL87E)XLx3~ZuEL=to@F%aRohD3N$4%i?CE8X
zZ?^!fdI+^C#U|3(L(j=Dw_F8c6OUsKk9EyxLs!6Vb_amht8|Y3$Eom(rGT5HfQtjg
zE_ifgEW<JZiDXMq@p6kGgryL)I^5Dx$7#qKVwq+rZHIW5BHc12qA_>)*O&#VU_NE#
zwB6b)yrov@DgTJ`HRZ6-cUwIWXD0QjyM@zmM+<62u%7qr$K|*e<i@3BENLEykTKnx
z0!Oktj_W1gW0?PCB<yYt8gMIci_tZ1cPzaQJjiT%D(S}N`$n0gb%!u7VGU?D*g?SM
zz**xczc|mtCpQb>v3QwdrzFsEa8~h;3h5Woyh#x=;Kd5q_9V+;9&yI*nm4*(7}m7w
zq^a?)sb>f^kJG1UQ5kMZ5J$t!N@bZBf9fB=+=%X~m8CfxBgsc&2?}06X9r*XB;-A-
za}C0BG`L{P*4S4ZN0ss2F7^pQVvgc(SwfW=$X`o1M<6ulv(YrReazRQa-iYZbvob}
z^J>Lw&cR^AEuwh^Jbt~6Q#t4v=T%rlu8S{eU$UU?4AAAWqvbQJu<Pe;y02(#9RWfE
zxuZjw1zM3aE%M=uU`c*CuE+x&2p_`lgSX6OA0s$6f!?PPI}M7^_WwFW)XW{=6@mB(
zO#c*_W*wh;Udx!Q<F>bwe(Ep`vu!^7*%E*`opNlxZ7V?vV(xChx7R~=*8;6g;K;}!
zKqnvnpr8~{?*1G?dq7<K(aO0KeZA!2DV9`94+$%)`5#y8jPN%lBU6N@qd#IuvB>3<
zsA<w57Aq=R!{VH3@9JWL74xCRjDWY&>iMRx`N=I;^7dPbB-e7Xm_RMVPqt>sM(u#C
zn?{ZAND(AtKI48@m?`bM?NrCxvjWGvEeY^N(%q5fUEh#DI`V!l$8jo~$X4@V)??Cn
zTssybScP60g%cmT&f(yV0IZ?gu-EpI;<k})s_OJpl{%nTs#}I%;7q(4$rAKY2_be#
zTR-uWI4k;%T-e^H{oU>9t5r6S*`dMrZlTM1zh?R$3565*%ul0Uri2I-t_$F+6%RfQ
z_jDVNtg-$>9fA&Ic8<8r`R1IlUvxhGW}%wLk$hTj?xzzhSNP^@{oWevGhkcS9dg8H
zC#&$dc>6+@o5K>&IV}1Gxa_zs=n7R%i_13iS=%~rc`a11*qposS`gJLx*mLlz(#WR
z-A+suX?4%{xF_ied9gOIMp|!PKUz%g&~4VUyB<xrxGXmTrN&-$oZ%e`QJn1EGzgTl
z@&cxRH+=!ldlPWm+8C`lX<POCN7V#@eKEHKv0z^qkVI(llGSUVNttaa_?(N?D?3V|
z+)C}2$FCSeoi&z*JC7|@-UCIAc6`qQM))}9s83+&`XmqRbsTAY-I8j2GXiY7=mB5#
z7~jp@T^{%!?-<{$-!XXH)zsc5)qeTd_n_rBD-#;wHQa|9b@|b=hIQR<0_osn_h-Wu
zK*3Izr`hqNrK@>%a=;lye}N3!o1yT_%^B-VtEO>k6Qd9j1LftG($1A6WwVEQI;-5y
zYVxs1%+sUQiirlp9dp<gpR;3aqeBSf6Jke0R>0wxcNA0bi**6G|D7`Y66qLlkC;yr
zO8k$m;F#?K*zGamiQomxc@=*;6>73&u8&0Iniu<mk5G5B8F8x#Up7ndT$#r;Wi~R1
zNg-pN$0o{20BnZ+WE%#{IRS;5WqlLin`-EA*d^|5YwG3HZB8)StQ^c3b`WGR^0Qyl
zG2pT0*oIQ66EQ~Z5*(Yq>vj%52p|t-y(_qY73eK<8$QZ?WwG+KCb!2izkfbP%sFl*
zBOu@B$m)mA$XhPWaXP~gHh9jbD#M*oo|?mtl3o{7x#%#*cYV>@3^nMBAUobbz!%^}
zwG^{@GB0JC$$VW25v}w{s@vXC)}KSU;e;<gfGRcmC*W_q(g`<8SDU!Ga_bUy$^qM7
zTkGF*?XwH7Sa&Cc9+`DQ)3aQ+`$GI_*#D}~N%Zt%Ml)m+&O>iG-W;scM9!d8*4b@8
z6s>=y1Ol`;dAq2F40lIUkm*k&G6<a$bY`e8jjxJp*LB+Oi1(;ln1dSU1sALuyszSY
zL?^49uU_&GV2?ux8k-31vpAey;~mijTg+&CG|hf3;RGE&s1fOkJPC0xw2=ovo?I1Y
zAM6AjM%)xyCPVHV8nZi-A}?}2S#5dqvwxxy8Wgjarm;{pFJfwt6r%g%qho96%~y~n
zJUr#{(f;&pUDfUf4Tiq1J=ab3=59KgV_jq9aiCXUYDPtM%;J0XE2mYSbM#p1>w>)x
z%FxoVrPdZ0hW>o^u<?a|A7Oo@+TsPsUMF%sFEJ7jtFkgCoXd)APP<+3gkLpaqLu?N
z4e+ahnt+?BfYYn{neUELX*aOEo&VF^yT>!x$N%GFvLsuF`@SV?9d4lmDaSP%DelOb
zB&SN<l!RF3xS^;VD^ZF~l2ci7D8jfEqL?#N%yDcEV}{x3cdb63-}k@o-{025qaOAs
z*L&~l^?IIO?+bJ4%<!RNqiu%!r``=HWG?eR1|qVqIx*tBLI??&_qt`7na@oXVQ-l(
zDa!WTCJ6LXENU=jzzXS;_XH2$f6Q)QlKmpe66KrBeDeniLPl;@FoC;fOF>BB5wfq$
z9vDnOtzhjfgVdW^D$O_>U~yezF=WG)pdzBfCyF9he4rF_pG8Sz*-mWaeT-I8Y;4q0
zs{uvILU!3%HlQ01*%-~V9t4v&8co6MWO;%XF}#0utOS{h$&d1PL|cf5qet;ACaILN
zlobKKhC5I;!15xC>qILXJv<i%u}-`yvO<H_f0$=iHbyowkU46=zho07aztER#MFsb
zL_PdY<3&tqjBTB$y1B-4p?q<-V7O3V?JnM{h2A|r5F~8*82Kr)+(-+0z3wFvF&P_o
z6F*gXCEG%A&GJQUjHS`+Oe|uwXyOD2UpKcC*$B>2b8x|gPntFlHk5;%KknETAAizn
zX1oZzy9m49cL<|KK&y0XvfT|^&F{Z3#DT1QRRrDf36JDa`3Y71hhVyF5O&4MXfF8T
zVW=nXNN!O=&4z-$Ka*P90C*vD_$Oe<&yRax8ju`h{%yKqdVXCgD^b@{cHc&?9Mp)t
z;>f4>`V6gR@^_4#IjXPQ&rK2EyI+<&w=}>Z4-h@^5n`o?8b9wvN;W=3)W`E-jJ~<I
zKR}mQHOEMe7VQbRh}xW@Kx2ht@JGsy{VNpob$WFQ1z*nVibGSf#J7OSfh9}Tnp$d6
zuvB+pFm4M80z64g>1vd`qG#ZrsasvXctecVi>w~QvOZq$;<%jHdyM6X(J@u`*COce
z8Tr`ieM5GD-GoFfCpJL>^+et8-Q}J3okSiWn)^DofD&HqesF#F9a%UUY4+agXOlDc
zqS;UOa7JcT=KFM}IV?bME_$XFhg0d}DO?Vuk?v&5hh3|x+>1~nMPHdQfP8fm+QU%&
zePw@Y`_9NvE!^tHpFB3dv9vRC)8sq3hCGj{s`V+;*R+DVDqH28s?nuIU|j<IjAywC
zPs#^INATfdy$>@2?@4PnR=&>V?=u3wulV~G4C1LvVI54tCn9EpS3<<_d7p@sMILWh
zukA<tqaQxmVrm9NNo(!n1x8xsv~+9Nzi^F$=qY2F{sXn#qfe`r+5e<oU+y~RW6a*v
z*<yAP5>>&<_o5}73tCU~wDcuJrMcATE>&=!Fy`9S-=gu}ihG)A)}J>LPWnaq=QSv6
zVxWYkG;@ty@)Fz0h`R~7MC}Db(;z4;q^@>wAfsmNt}R>uS{+i<CaN79yaV-3bWj1C
zL<cU%Jx<u6<hy<<TbXH{@4?G^hH9glpL0v6T~2c?IHhh<ck)Z#K#Y9qYLPbt#MpGR
z9li2vRSc#rIw_ubCQ`Y5V(XusHAAe$W9RNAMEEXZyjwr6Ijo9?c@_*W7{_bcoI%XS
z-xdw=)LGt)Q7fC%hYyB`j9!|$4;moFp3Pg9K4L}waJLCqN>#8y@d<`)k}D2m*;%L3
zPA@EZ>~O(pCsm=)3cf5GR)Xk#Xm608S(Ub_!EFGFmL41ftOsmhuPVOE_|sO0ShNOg
zhta~$XdH#=o$a7Jljk8MY1wkssW9LG43hmHjfs~O_Cet4A)8eqZ=X~esn0i48Dy&H
zYWb5aJlMHCPzRTO2h4T1=#|(4>+BErmhOKDYXmRTRuwL-Ja}y3)msvIBsZu}<Z5AH
zu)U6+<m2QhE2K;LJHsz0XfNAeZa3^HB^^e!ULVDoC>Fy5X?74pNL~f7V&sX}Er{|f
zQVbi(vV{xhg#~M)55*y(vPp%7zp#i+J}Fah=~50^jjUf#8pIOB*}o@v7jRNLFi7!?
zAW!lKLwtCLAknP1QusFbZw{jW$f`CCPN*SQk2Zk`5XL47s_im`Y1V8NeFZg_|0-Ew
zL`HVf3|d=D|6+eI5v4n~p<iZbiIWPeVALyEM+dSUrQ3R5cWiR1^&d~6Oxidbtf&%}
zw)y^prXlaRTX*Q5noS;%x;mHEVK!jTl#z9vCz!>@IbjJqCpW2U=dWr?T{#rhjz+D&
z%q~1Y;1JGJG~OPHdts1KlL=Hlq}s7@B^0~c98T)&9;+nMr7T&_naeXfdmXv^n>IP|
zq3r9Fk)8fk!W4>kZp-K~mk3d^Uj6`aJ0yB_<J0E`UKih1QihWBUINP^o)-is-S41;
zt|di_l$MS%78vAc(XGQPoPmW4jaz7)2yes~qYj0qCwlh@5TmP8n1vXstN7aU<2T>p
zO><y3i{zIbUdlhG0j3ug7M<JEPpOQWZ9KMizlJA|l~QHWmJv!F2P(e|KEV`oo@rol
zuX;QOx?s?#boW2g7&PE9BuC7%@5a9me^(r&I!5nB>LShMMmjXi<WepM@3r_EQ2xeS
z{>3qSYviq&$=I99t{@}-Vn>f|4X(9ndhO|?sL8P+#oO;pDF;<+!{?9tGeNb|`gJ7l
z$NI4LR%#Wz@0Gpu@&uxmnQN`;$^`kd=u2hNAuB}|&nw=#L^J*I_sfEgcc_Zh^ppOa
zI9b=?CD}<&<>Xg3hJP>AQ;Vm;SfFMXcwZViV*Zx1sMZoP^3><HsP1!o*Jby@P|;6b
zC}Z^7olQt_bdKP8&_8oh953cvSm~I`qc*UDl2%9g`S!`=>(c%pCFZi@fb9F;YLeqY
z3;rj$R45a4j7rbbqCnc2xyk4&MTcCL{P@h%@ioX<uc+sSSw+uxsIml9wBv4N+_fgy
zo;ZbuTNURp+rzionfv@Cyxm_A*PEYcW?*P?g85&N76{T9p$Qo=b787{K4?~?#qK?l
zmlet0lUjeF*y^XLO>{_W!W^1U&&|s`fBu6mdKChMERI!F?xloSO>EZY79)&7V5grM
z?2~K%p|S17iYlvpAHG0J=R*Y%g5)p<hLvP_+(VB<2t8JFYKSYM<Kx}@#q-CXYD+qs
z^IA`hr=cxUJome3=SeDeTpejaQ7GUp=TK^WrtxU)FK?~cMyBYrY3bf-F&m`vvj2q?
z>Q=Yrlm!H98G{ti2O{CrmrdXcIJ$*RWTlj<XQ1cug?-wEsruN49q0{NJ9W?LlXOs|
zZb~}gR@=Bm^23eCVM4Q9z4|KGd$U{Zcvurud`a*w^K%Jl+y~dC1#G)E7|dUbsnUI!
zSe5W`d@8uS5K`j@$5pCf3}IPIJ8MzY-k5-Xpeorbx>#}hL`{h~TUrCVEUu-yx1J2%
zc4_Cf0FRLi<Hz5#Z^qzoX(g*;E-sa}s=oYoWA(q9i!)TkaJ;cNTo{!7{cgEn+bAnQ
z0(EYSx_ATUA@2LW=Oe}L%i<17%gl_V;}-@uR=&*m)#sD8b8f8tX|==-5n+b~?dO#v
zECb#3MD#-@jFCXmRn;0s5WNr#JYWEQTF%;&$(8P$k_wz!`;lxA-v`UKids(Wak-km
z$Z6EGisr`OukPHC)h1}Q=nFt<A-<LA@R>VUx5y0m(S<!O3V$>d9IsMHgH+M$s&B)y
zB3sSK1W#!xuO|sDDKQD2S092?ZTzYIw#-(m#OrM?s`LsndZtwx$c3G&qiuriF+<Q@
z;JX$5EwSU|di#?MgDuOa^|&Tx>iOX>vnqfXF8!{pu=h#cDOu0i3huyYbOWSyc=d$H
zSd<Yq`Qu{r(bT8f#^PpLAIp|Z`36~2WV$c-EogRM3kEU~MCm@h?Pmfue+@tc5n_-2
z?E~>6_!Htl%8a0dqkZdM2j&E@u{dZ>!1Q#zfQS_ga@707iOMgL#OmBQu;U^IH8>gj
zI*LsQpY$4rkfD~eH#%)a5R@TEndxY5WEsdFPYu^Fa#<1B)-jzhxDK5scNc=4oftJ6
z4cB03?!EvFeMsgh9Gnh97LQ$b@)?UGRvAv^N>#Bgy~SFB;H5O##l|B6T<JkV3)t;S
zVZ>>@S!Nt!w|@v#F_8J#yy&Lox)hTTZJ(K0Q_FU=z(48pBsr!$hmzuuSEuatslkH#
zCnEJkPf|RDcOa@WGQHMC-!EjkgblYj02LdbO3A_3iITXzdNjQ%2{8JBi2zEpcea_1
z{`C%L)-p2sMyRNA^4;&&@ADf2d>t9$84NYP$Bghf3HALP^@Y6*uk>$z97J%w$#;gw
zbT7NT-7wIYph%kMW$Dt`*AwHeK!eNL8xQZXePXYu3(GRTWB$6ki;P)zxULwzLN#Ew
zUMP5_&=BC3&D8T;ZVga2YKV@79JcVAP&b&`bzb@Xd~*^MdS+fF<V97|b?Fec`?5m;
zcwAFzwm-kAWF-8kl?UZ|QGF#G2b!7bg#=RH*?v8JQ3?l&GCP+Ac1Pyxa)-=eSgr}A
z!Nrs5zEvfrD*PRpxZyBM1%(yE=gln4Nl;7(%ej;pz_+?_Le%~=C~|dOxxAP$+Jt>G
zKrFj`^kleDmGk-him3ce{^yr#qd%9%MBM;9LM*(^#vk#E=fn+ynhQ(!OZW(D9e|hL
zc1CY}YZtupWGEOiToy6yv~E@anbM)eNMN;B^I^B#RqCZXEan3}n}5i3u9s_hU^M!`
z+8}a>Z>&Da&#R72aO}{5bs(3!`{YZ<^PYt_$gSL!r)puR4yvm7cX|zAXESDuwxk$u
zYu=+;HPNec&h$l!85wH22FfH{`_z^@8t07bx(mg9c62#VeEeQd{rhxKzWzL9{a}ID
zRuJx?6a<E4GtCloNYL{aKKS21d~9nVYxx}N_DW(6NyT4qlALL{5*U-va@#31<T}v-
z%_Yw_HK`dF`(rL&oYRz=82k;bL(xYu%&dM^=lSPAp>Dp<w_3!&7?zU0Z;1J(hZLW`
zb=3QE{V;#=ed&&!q_xp9#(PQ#P^=&v02N%#4#dw2SYsE4cmrX)Orr<E$=zJV-Sq1F
zh|xW&o-Kbz_DZo^3!giv<YT#(q2I~ju~AjzBUY2_)7xy7BP(Gx5rYZl$|Qx4;@APj
zz~$T?eKi7{S?W06cdZC*sb#Vo8`yeIWnI-S5K?{JNlha!`LW8NgEYOw6zZ7o9L8KW
zW#sMNnxZ=cSBaaDeic#3YC+vASlQ+pHaY329XZp$Aiv(R+tAlJb>5^iS|ibuui&BD
z`!KFq4ezuQhENnX+d|^jO};OWQ^9sGpAY5^?6MjtMLih}zc)V^+Td+vmuko@$@|sR
zxB?c}=grg7)Y9j5qLga;HF?&lq^K`K@)}Vm{)gW+qm<7^^+}f&DUxk8%nw+kc+ZDK
zh5Vcoepmxg_)qP($1h8;WC^D;NVL++GvEXoi$CiaWEYHU)IIHaGymgLP4kI?F01TE
z(XI(Zt8gbyppvS}$wR5C>mW-Swb0ERi>CI+hxoRc<&|ppcY#e>&<WoLrRIFNjxXv5
z@yi(hui)ewRDb1t&%g+&{8TB+k1|irsgv%vD5;Q=qu0-RYWC%q$FxE1ZkcTH^jLm#
zwO3o!^(u5I;egkZO|Thl><!$`YfWU2n+Nu&?gpu{%`eHTY&`7JH^jQW1lPPz@2|90
zhKIzITmQW6<WsY8y{NR(gT0*VO^osd;E{n2Yh8P(aH46+sU42@URV>j^_wx$Chq9;
zvN~5cycjNIar>^z9(&;g{^N<F42cfVL>mT}ODJ%I@)B7xe*XaXS~xSS+S4mS>^f}+
z{0%oN3=K67@(9ZQ1=%~*#21fT{NX6Qptgc23?j|L&5DvZr<Gv#eG1WaqT&JLVy3jZ
zXLbg?FFy%w1}=`G_0>n6j^CgG#ze%zOpS>frb5oz?)63~6qlBJ<R|B>l`nhl?)4km
zj@#%xu2$<`CO`?*hToiF(budVBMKr<{H205`PmvQwM?tJ<Kl{o+__6>r4drsowglD
zk%~un`m!Bw$@PvsG%t$stxR1e!QNTR?Xggef*OVp;>-{CDcGP4h50h1y@^TDt=^;8
ztP+_jI|Kdrt#9T_$iU80l}`sG5=l9iAj!`6Ej8w=q7$o-@h)CVtLor!RmE&P7NBni
z$1lHuO+FF|x;njtf@;1X0NvF&DiqA0C&_q@b3(bp!ql=lPw`X<OG<b<HSMOdD*M(m
z??y7J>Rn?#9D4h06NCV!g9}pWg?Z0+7-@l&mX<ZhnDk}8p17+F{hIWGQfSC9#%i{z
zFZZT50eY=fMdl71{N$R+Gd+0I-__KqFGf&Lx%i601KB%NTQ$wTnrhynrUP)9bmssO
z)#|VYASi@<3`)=%_7zd6WbrdKmMUu)=|0?)68#^T;E1U>2!THb<qK^-uYg~KkD1E8
zSjuyPsrh3Yfv4B3&VRTSlV!?Jm&VSOgc76HhebQo$D8|>yryscPrHlC8yGFqe;=^<
zP3D5fp98>Rkyk{Yvc*R|fkM@MhJpCKQlS|93I}53j1jN#T8vS6&X1<*p?U^!&s4RX
z8XZ2(d)x_8d6c#IY^P%^WbTka8u<~I!%q7XeWTS@6&}>v#WMAGdc3e#Cj=B`f~Iv-
zH(h)z&u0&1GR;V#kuk3+)bt|Ju!ZFfhvJ>1`H7scExSR{+8VW)m-ZFDL7KMcnHOor
zSw6R_FYM?b!BA?Dcd{w^#|*8r<uBUBv_N&|?O#G_4CnXCLmT2ra7&!w(Pkf9b;Gqd
z<VISi*QoRpK}8u%dyi_gmN4&*ECHhN@M^;zGBluKc{Q#|ccqcMxZHgXW_V*CIm$9j
zvm}Z}&@V>eXx+5v7Rqm0(!9||Yt0(`jV+r`Z7$@QF%bI|SwQizUE9*uLCItQ<6i4Y
z_5(0>MLw5fAz86sUs~G3MRe2y><`pEVQS~nRjmOoCW{lk$W#0nZunrUKgU1B$^t{@
zJk_-Xp$K!KL9>q|TZ5gWDvV`rBQ79TY349stl@Pj!2AQEpLsfk-sp}W<(!D@MNBTK
zBJ)K(`YGvbP4agW|G3!U-c5<7PwWlOw|Z|?*Oba8q{{C$@MwtwE2>h*3ZNwL33f@R
zK8k%ZPlj&aZ00r9ue(B+0G)qcF%N8-xi|By;Iv2PavEl%X;Qt`_tC!TgAjG%yvcW=
z1+k{racapL;rA_xqT^t&@haDX&;GizFFT^7t_rh|xU|RfHxO?|%>dd`@Hfc7peMcs
zJ~7fQA#)wc65h`g1W$^y@oSufh`)_wuni2%t#8pHCPTabezeHF!}cDqVs$wT^2cns
zQv92+lu#z!-|?2%b$_EH#Fu|EKb*dax;Gi+6lMv0LK;&AGSmqvZEPuX;DY%lCUn)+
zQ)NQYXn6glN=;*rx(R0f_^lK?Ks+P=NQDYdrPM6j8*jZW*p{h!bX%Wm;JDwrCtcg2
zP6}|r^1=4KMd5i_$RoLp<c>CZsA_D&+YIW%scq+<k8704!Nr9oR$jglySApFNuQSO
zEg&Q`j_%wnYTuu%&!xezt|#LlCzj3i{FxBkdgX_VF2rQ7BQWI%oxgC-W2+Vov{D>*
zd)RBizRpKgyj`)`I+b!2y%WaJ4Y~w1T09&fI<my%7D!;{dA)G))u=ha{)CeYdq3v^
zkN`6eXmXWEvC2g3P&be9$aXs*on$fs`t3M3+kuU@)GZ;wjLFfCz5UPMax-hM3I**o
zGEaL<81Me@V1;cV^Xnj_bb@z=gVD8CI|~C7507O(#hQfnwwSyWuXMsjdckKOoV#O#
zR7Fvb1xR(nSJf4_lDCRb5iIXMWHsA5Lqy9k_wHfuDopPVceZ?gsi0xlh(!(j$90D4
z8wUx@sCr-dqqwPkQ*Y<ya|y>}r4dEmnMgH%tt;<Rll-SNKQLo*<|78(cqFj1LCE|d
z{%S*9o`)4*1LMzh2TdVGeoBkh-27%`RX;w>m9=AZ_5S~V<K14PaI*k0ZgAjUBHwEf
zv)>?)vM3Cl%WrN%c^hYb4i!C|wP4`41AHZ19F%(1<2+fZyJ1aqe05wxWv-$>j!LK?
z#IInY5#?8x@qltplwXe&xj(PieiK0G>~{I=#N#JMi|@)3K0v=mzf%Nd(2F8SexH^}
z1+-TwTlF={I!$%nO~)~G_|8P3nc{nC)N1Z(GIDjPDMGPN#+R8_fi8@QemS?RVHfFf
zRpYg@1r7EP01IIWDRT5FM@W8lufdf!expD`xNGY+BI7$w_ZUuqg>S;8H{}RlLX#aZ
z+ysZ`?4u^HPV4a+^AaD)tGa>Z;4$HSRuTSQCziWBhb_D+$w{kyny~tyzA9`R4Uer9
zs%fc;e=Z@+{)Jm5AzIF+V)m7PyT&;GTaWYTPuiV0g3pMG$M#lMtc|K^)rqwx_8B}~
z9|P{l#U0N(FwHX;6^i_BFc7c_dj@PNXnvj>nw0x%9X)|AFsI{vJF=cnX6<LG`^l&&
z(nVIvXv>a|yDSL)thSyE;v;#F*1b(W%MVhoOXH^Uo%u&&yoN(P%towEFip>)1DTs(
z+L<+)Qh{xM?~5+%JZ^Q>a4}sL7-y&VrjCv;?MyoW7sU~PqtkD#>)d;6m|Jdd4SCfV
z5ZJi%JQ5V`OaDCKE3~GlQeXR927&~w{D)9Fchhd*{J^fx=bs6>fwVti7-YqV&iY%+
zJ@GEjD^r18)}Wp|xF-P9psXDQb&{^BlsfsTnWzs!U?+>rAQf>bmX4|UtCgAmEj8(@
z+3}X1>w~hxE2ZEn!W;ZgWjZN<n4lA{5|E_Ya66T<Jr(I0F5+%9;Xo37Gog&iUwkT`
zEuMT&<+<F+<#cvX_&o2>fTO7uzrBQnl`y|KxD_CkX9#;aS<xb-n3u?HURSc+=iWkO
zcmj-r^(Umb?M%Y7;azAwtw?v^gypU2@HBZFH~XJPRwaVgYmoZz*2Majx&5h~%==7%
zip9@p``wvX@ilp7tRlu%IxhIlHk*m_*wVI>1KW2THBoLO<Uz@2b_2Ek`60r@yAN$m
z0m@;fMwVJv#`+LfY8x&g(6Gn;B|As1k5)x(xy5{4p$#NBlG7B2^fdCwt6rmYGLoJE
zi6-cWYx=2%v0K}e`()N-LK@xX%}z9nX#WCb>-7J&!QVQs*RcnH;&%RWm&9|DlyjhL
zCo?Yen~{i^77nUxa7{4UIr_;59wh<-;;`wcjHLOu0?0<V=((90=h+rltbO<Nv*Aa`
zg!jzY7Ax0~Mu2>2;UaG*z*It*?#%SR3O@tTN^!D}a>2nu)@>yfsfe5Z>MiCr3Z;=I
zU+-#JG1+-mh4uG`4{t~RncgKgIe*WPhAa%G9)ug==5#}F*Blu;4#JSVo3fE1A*SHT
z0k}WY&lSgNJc9Hk&$ojqy8ba{n0nx3QLAA?JFkg(jGCSIX=Ol+0{IsztAwjwVfXYS
z+D(k#!M+cg79_u+{?<}>-)m=h2Imqy@y#?7-T#rj%k(8B=GR*Ae_WbHf8DsaK<z|G
zG$x`Ie5i9YO2jtGrlcJY_>N!QOz4j64&U(_F@8@e;T_0uRWStot!PV?=J%nZ{U2_&
zd!zGg<_{(qk7~)f%<l(dKyaiTwgl#RW2ownf}4|4TpE5QuE%Sb4d3)5$<d@Gy>X8s
zNa0;FXQn_Q8EL3eRT_nx+g!^$&wAy*?PXTva;epgB6)!Kjr*~4<H*Q&W^NHxefCRj
z4${jSwqL)HzLa7uuQs@BOI6jLVVk-QCmhIe0BR0Ca9nsK{&s_l2~=G17QS8q#^A8`
z3VKs+`BNr3p9Z?Gth@EU+HBQ)*Wu#G3P9x&g6LlcXSg5M5Noc@VDG#&uYF}ni5-}X
zsEj445Ru;HZeGi>VC?wziMWqW7k>aw!CYNO-UvPuo3Zo@BLK?ylb+f)oKztX(kYxf
zq(Ztmk0~u*!05fEyW>@Z$76MgR{mcQ&w)9p#-bMCVp`OCr8aQtl<K%fmpsPAm7~pE
zZ{!smW5+?R%hfS+-)>#EOq~Alx)jc|h-pi?obz->#<Wc4ZO#P;#_}{f;|O+gt`@1W
z2}}LU7F6iCtOIK;(JnsI16Qk+i9;S+w!mh@C0G%QQISm3Xn&%}&uh29q|Z!MNTb3g
zmr~o$zqEJ<%|_np)tsdqOQ+^KQz3z^t+v_d9`pG28h!8+q-HL8z9)cdFHx8r^|s`I
zKnISWIc4gUN_o0@Q@AJ@o0hh+QT`^gPP7VGvx|>{fmQh|(E-4Ee@TR<pPh(Lop_<3
za?(*K__dKFH`F)#&O~^GC}{M<6|qHpyZb|KXOq*4rI~qkVFw5%XnTy0(D)WygI({9
zv0>(nI>V>BT5|Pk*_v)qr24AV7b0K83;nz-tR?q)+^wH@;T<oN6#2q%$aI74UFf^H
zw2&9wpc{Q%iTh<>XdH-L39f4FvNwqilKCSG*^uW_hz(mgvwL}PT>8zhxjN)6VWV=<
z+D;u+c@xoClKOtt3qv<0M^;suK1XgmDG*mw7NOJz{_^B^Yizo5klJ651&Byfll*wo
z>BzUr6Au>GwI`l_Tv<=tbJhfPkh;J#=*M|?Nn}ciVQn_j%d=(R=OAuj8P%KAGQ(UM
zUfK9Eyy3qZo0`vTqDctK7o`~Q7yt$V0#r60Wi6Ug8Vwiez;c5SKYE^JE^ydxinemS
zReZvRW*xmJ9vhMs8je#g{2b%Ok5y5;=*nBMf1a`2)V`4i=MLj7u?^m;#?%ITMT%Bj
zh{_(^7T?WE*{^Q0Nvxwd6SOp|QNs`kB74pK)%Q6JR|5AhZrMY!QmL&fO0>v8Dx#6^
zG`gCmOaq;ER=^a(OtYCTiYVt$uCi-XAz0pZ{o{{&?;s{%l3br6mjy%ViF!*$d#j71
zu6&sDE||C2CXE#BhYIGFK71?6!MA5kBYRk#?-?r_pT7OspE80s-x@Af4Zfq(C2=FO
z@hLiX96;OV^YVz4!M(q{+7?5)4+gJg#Py35y|Vo=!4+93vqg?HJn>Ki@7t7-q8e`M
zWmW(u7N9|6#XdnZ2MnAGkPYDRq7r$P>N<ZW;eB3Z<SAJkuB#|2utKv8X0nr1gg{}}
zH6BX&xP_B;R9xj>EP5Ds_Rz~?hSKzVQsu|>T9FDiO6y~lJMFErP&Crtmx@*6U4Vyo
zI};6W1YL^TfsWCy0u=4}I7o36bNsQP(4<-Ub!|Rw-ah=An+LrSuo`!GKn<5-vbZLp
z+caR%VOl}2`bu|yJ+hK~b{MgiJ25&zW{f_SFa5JDa%JQA7t(L{T9pM5F>jAK2@zZN
z4ZbF!VlQHFE1Z^_Hh`7yeb&%tgI7+(gpJHF76*ia?<h!BKZeZ}wOf2e#+=RPN4AZe
zw1L7*RM9j~_Le^(+N8rZg8vMc2A$2_s8l&m_r6UwN|rcoj6U*7D)WbV2M4m0q4zJH
zu6KYYjo01wDi~z+qQ#JuL(^0l-_~!#JZ#7WshOHVQP{XsMTgZ;?8JgUdXufO=lC;E
zAYO0tz*)7jBhi~QXVX`cYea+|?T{HvzW$iA_Q%~Nz6Y#Pk)Rq-2s!A?Q(v|-pO)K;
z7K|T)8ku+sZqYvow_3O0cOy<U>FDe`-t6%|EM9o0nvP^;wV}cH7P+CHA3Ozan?J(E
z*iwnE2(%?{>!SmgldnXB#?1jW|8fryf&kj~ZPA&WpS-o@7nf|fJ903%1OJUWawyxL
z4d6QlnL_o{!p;j=nBIX@V?3@o0p1`~tR<w>h#FX72<*lcx2W;hbP%G(Nc`DWU{-Lu
zR}+fV<(|ee&TdB@V-vUTHg>j4NGpkvwsosZH#FY{Vp8ig>5X0II-moqHNmZ4)sw5j
zU)i5jAB<gPE1+&u3%uHBRoab@YBVanf}CxX=7(+9=M}lvT~P1cp)$;MckRiF7?pP!
zI}={47WqNKE4}6`fugDk!_FDygbQ@ynj>G%@jiUIskE~t(YtVfcy)e(8#)xq3hx2<
zCkBi9c>DZqK(F4LEiUU>`DNxKu%jV1KqjP<A{0<w5P>c8=){j64kRIW;SyFgufzEG
zTCfKgmZrXi-V3I@U)^auZB?2${S3alWI(^>Ne`@p3kum|E9XlLuY^(F(@IuzSqATC
z%7DQ`XLRuiAHX4A|9B(rgwp2T>Wc}Q3fpQ5BTT`84n6}3<y1ePLS<c6Ypa<YY3B+4
zT$9UuQ({t7{A;h?%G0g^(0UDUvb@n%%|4H)qDW@msm!Xn*$Sx{LVzU!k|5ebPktCp
znCP~ccNw86@(G?e5SB@PKWITDys7oae~v#NgcW4&I;yW?_Bp?0^nJ#PK-tfCYoaH9
z^GSl=buy(r%kpfvSZS%%bO$C}>@jW0K(xEh3cSA>BgLw$Qw*>63tf_3f^L_1tOnko
zi^(!bF`Un+%)#7K*D*(!RHMcFR`o<|Rirrf1M|&VT6oks(h+T50}Wl#GPf8ZGU-=|
zb1?3$W}69_q!mF=w1$-{&lfynk|})T#h-~e&}t<&|2K8!%*n<#;MR#<?@C=PDjiSw
zB%}wEsMG(&3upw3aHq#DHp&D&4-a-8MAe-(05vq>6~mO>-B!8Q#sJdI-ocLdL#XJo
z>2vZQfp1V7iVhXK4xn*-8Eby;ldk%jeE%Wx#{bcAGAes3%Lf2tGIx4GuTFf}`wMWh
zoam=^V9ZOWYXRx~60kKGk2?RyTF%CYis~kv7P7PPJMU*^;vaKBa~%FMf;}x&if`TA
zM!S8O8jn{{*?c0Q0+tH-vQSPhzKLUTwql37f#($X@d054?Zoe8J-evOh-N{SH%f1M
zJM!MPoAG^3#_|b|x#oqojM>B328ZbR36xaP9&KO<a<8}YPp{^yjNG8E)wh@96aZ71
zD|3*i+2uM_f}uI4=ws&txGkeHgZPj`>Uh$>RN2iT?N)$4U(MWKQ&!%eP%HAo*p+u2
z5mnjVkqr@KmYqBmE=UgQ`kjbs*%c^eN#YuBBVTe-%X|QAc1!N%C7Vxrfa<3*aTll!
zTHbeYA)+&XZ1BjO#SY2|adaKefDeCHDUK=O5NiOBOFGg$hie)vCf$)u*+Dv$SuN+U
zg=>_j7i-OXTkzW)ipgzG{F%EjQm+Ng5C1CWL+Oz@C(J{P@>yEvxoxqxRV=zJo+C3=
zA1Bc7B{IL+M*ZxfRrRD3)Hizj6vVXpm<)(fVAWJ+=N`u`>su*mx}MiuAo&J&YN9Q$
z&2e!MK6KkkE7=%V+Yr<hPj2h0sfoMVZ=q`PR~m#*_YD{t$hlQ9A6n_kVnX|?5ITF{
zu|c}#|7#V`0w|RTAkWB{^B@3q3cG4^Ib?~)xxgSsi&%`&jc*<-wA*`pc#er`AmU+x
zBmu>#CSsI6fufIk#zgTDs1&Rfj>S{<27EgC-WOI5Ua9!mCtfQ0)r2UXBIh4htYd86
zr1YF3j(_ruGHpYkWA_!JpqkEZa+zu<Y1$zw*3K%3OCf4i|1(34b(OwUfJ?l$XZ)QZ
z&p)rAUjY<ZsfECS%~VZt0B?EeFP+sTaM%nLBrHfj7XU&r^Pn)h`K{m9HFF-xBL;*P
zh&`zrPx@dq5E%ZWhSC;82Gui1d=SsBm-qKc*$ywRudTCq0|1f`m1_ZElsAc=%>ow#
zF|$G+1MyyTtj^`Aw^;AZUW=4=!~HfVJ1J^f&3C%XCU8t15Tirmxf|u*{$l(ifn>d9
z^xbX$04Bna4^TP!QviS;RCa1=S<n>rk6bTL9a<aQ%h9%4GvEg1F!pL0u1K+mZ@c>?
z?%0iLyRL0_|HE73`9t!Eim26GFxz*u2ARuxEQ$qB_AN9(N8b>g#%J<Lk7ZN4zxUb1
zPP_zX*#E3nqRXMKZo2Z1Z=<(-c6xuG+=z04@Q6pFe!JP)wEda^Y~~NrPIdp-1RJ-o
zK!V6Ga|c?=gRo4kkjp_H>u$_-<Zq}6&+|9lRgt5G{`}v&z}?Fo5iV3>;mDMvdsm|Y
zFZ1ur&sRr9qkQcy*UOcjUP$q-rC9)0kUIc6f7i9E6C)H1NQ&a5T{b=y)hL*)oEjZX
zU6?l(Um$wD<p+qapwE2$IMhZ_wQ9w^F09p^M2QobC{b@w)I5;jc@h3_Q}IZQ(#9A#
z%|%w3$q?)`fxi&OxVV3TY@jaY*8M@fWD(@<6J&?NHatohl$yMzymj<n5X3GVd_C<|
zz)&VEyT2>n`ift6)oK@`!R)Ur;nDS~xb%?qu`i*%y;30u_os9lnv^4;=5zZYttB?t
zSp;gPrWZh@XNG>!*US54B%R<S8RLBzK$LR^-tmY1r`xI}!rJf1#Q!1mKs#(L-2iYU
zW^kt$pQD&3e9F=8sJ_>d%hB%quXpyivf4#A<2eI@UkV=<GEHRQTQxsb!Qh_g`-B>T
z4db1mWv762$=0hOLL>(TK@f^0uXOhf$ajV|(<i3U&<eMsyQ^{{tx@XsNyhwU-KqIK
z{_C5OYQTB3#kJ89oRS-Ld)pFbwsz-Ajhw|&`wyt?fhq}hcJ6t71d5K@p;#zG1BIBV
zF2m+7TcO##V;{tAp2O(y%D&b8yLRq+oFYDkmIGu~R)<*P1bysZ*<dk0CEW)Cp+Y^y
zU*%7tNPnE>xB%VGQxfh&m^ZwrkbK;w+4wNuw(}7;gm>$!Y=_JBnM`mCj{D>Lqq4(z
zCk6+}q**|XE5<xh@iT;~!V?B75S3*@xCXGHdv0gvLsP118Z^Nv@_3Ce!`gw&2h1=+
zw_i+$@(tuoNU?%{f6AcJHD|>HiVU2+XV=h$0h=S0#Mq@g=3f@~;l3lA0}E&g2x5h8
zgg?gagdLw!1@rE^Chmgyw%62F_SWBacqiDFYBTS+g&8}tYT+c|3&x^mclF($|EqRr
z2S`J>q51cPPEWi!N+M7sVB-XF4uMBzg&%;>9i{mVkn#L1sdp5ndmy>+sssxjGyhip
z{m|hrO-&zXfoz_3a}52$f9pVwG3L8>3u5ASop>+IhN#+^f^Vsb%y3R!9jKjoDPDFc
zWiiW9ef5G?dHOrYYrRtQZjjD!ybi7~yzJ!}DFYDIh}IvJRh9kVI=uPT{@S26Gsl!2
zn5n(HD)Kp5y2$Hkq#)jw${1&iKghWDDyjZD02UepCViV+{2dfwss1Z%ihW@X|25r(
z%POla1L;FG+zO~_%#n=jU(I#FJS1;a+5(|yK%N?15Cld`9OZ%muiL2-5z}M!%s>m!
z*P#Qvf!6)c_9p=rgrvf!P8lT&%ZU_oXyfj#PNH`dKn&3M8BV4e`R~+Y2^YWr4M1P7
zQe{2yE6+~t8v*l}nNta!T&(B}Z~(y`KuP>~zJ=R!9L?*s9_H`vlc7mRw%!t1XaWYf
zFPQn|0KvVlMEJMohS~m1X3_GD6FK|UPEfw?iOUy1O40jKey(7doJ2aw5j`A}HQOu2
z(`1>x#|E6|+SjGiD{bX8_Ip)Q`tURCn_RD~Rex^_VILZZP0zL-q+CT@_*Kc>9$~%5
zB7;SPrJNGR==&J%MvugpdIOc*!#d5T5@MKz2@x5uS`5gxMT=$_zz1p+`u2Ii3H*)n
z_sDppctP;ItjX}=*$|PE>E^)b+A2XDf9oKHD+qlH_?${OC4@611d9utyC9=roZ;u{
z>s(M9V`DVj=HeOFzxuEdT5ngpzqlOH3*@$j)q&%m?qcLVSDHfnT>S}|vN?OGRj;6f
zm!wTR01Ue{YSLF@Af2`G5()88?Y<V#2qBsM{Bf9T$4oWYp|aWt&R}}6>=Qz+Gz3Y}
zOQ7>s1JOX^?(Q31J^m(4oP1p87~1ZO<L@5Ua&}j6?f~&8w~<>}T3xC2lbb&<s*}Mq
zWJ;7L1|%<UZL~xDE#L%THUYJ}%;%UQvtF)W@N!y3^5!Qy3d6(2^TL6p#=#jNM=)CO
z1Miv$O~%Z!d$EaSmdbR&_o!H|ZKQ{oUcy57Z^)%aj$aq|InOsi3dz8KSnA1(@9l;O
zGNx<6E%~q+;P?sHi}~x0BZ-!Oj7ZNp^(mx4!Lnyxs7@Ye0IQCY93d8NNF3PmYreaa
zBlN}X&%iNSBsjCRs691+aP!9GT^O>8Yc<^FCTqp~jNSuRB_NAjC?&$S66^W>2@91`
z^QH;^exels8rG^>F{j0424WcL&)+ZGocu8aNCxWQYgKlpgVuBKN)M7Y>GkW5kE33W
zusV;~08zpHs5+62_nn~ek9)Q1L|T3@&gQ_nT;RJqU=uwOg(Ydzz;-48gE^n0S{`9v
zam3N0Sq24wKmxxZgY$|f#I=XTE0KxawS7?u#w{F!H6~K@qkM=`o&I5~(|FhZJ$csb
z=~(_;d!o%%mS>^ArK#sSH?ig-5g1#z3lsDk6|8opdNIjW;3%UR`cxMD`q6E&^~gnQ
z(%+lA=L!L<XkJ!9C8jYn$UZx$x1?4;BlT(_cLma4x%`ajpgUSx5Djcp^5bG^R`ar!
zsULwzQy`n8bbwl1T8Yw~U2PFTG_TFrb?nFz^r1ue@A|}*k-u&cZ~Y^jBF5-3^<B!6
z7yzsOk}Cs9;+*pS_Dm9N14`f|8&FU58U@7*d2bXa7qju&)$yIjf%uY+r0I9o+zb&_
zep46#1k538bN2;Ju{#lOlv3xFu!;!-6ohMB(Wg`zzAcJp@kIS*rT;>FJ(I}k*kQzM
zJqQC1uk-anMYc7yY`Q2<^1!MsU%(7H1<2i`WrU<dhm2?h9B)#`Q1)(>RGCx%?IXE+
z<2<pa^`sERQEAI1W)Yg(FgJpa$5eLcsYcO?YU!Wz3O1w=Cihh%rRXl0xXo!$g|t%q
zYJ!6&Z}RkC${S!f>CG`9FcQ#$NoYl(0j!TRECA$193YhRCwbyS*LF<b56+ihUdgos
zmp8?W`&rIe{AmpI_Y7k|A2E-f<y^zylW<QRxttb>5&J{TfrLKb%it(g9i#5zv0$Nh
z?IHP*C2fzW^lx%uU0<e#vT(fb79L))dZxnh5}T+}<QsA)0$}E`d2hXzNiLY6lcR-R
zs(~y0?-ur~He7m6kiPw>o3vAfCQFgkrpnPjG8^nXJpj}1zk0BRiscxjLCTLm4#5tf
z-!C^MXs>RM#yVaH*mdewlIqkv1s7HUj%u%8A~bKZs}fFqFjEy@y|J?1uG!5AxO2&q
z5-uE4RjfE~5Dp|{0V@^0AO<`yo;9EkDg63OB}4|uDpUeC#Rjjbu8c@&hJSql+7Nhu
z9t*~cZY77fZ~K$!{!OWqa^CUKh~NbEs|6q`&vsy1o+EE8CSq{7S0%8p5LyZ|B??_%
zRVt=R3GGH}6g=IxxN{(9zP^=Gmbsg<>q^|!0<IKV`m~(JgmqC2;Q*qxw@W@p-jlmG
z6+xA<^j-C;OW#oL8>+v3IDg0-s!Vgiglz0TQv7wlDn@F)i2}e-KbR6fbxvn>tVN5u
z3TWNysY}#}fX}%MFER#5OI1Ep8q4Vd@*3!*3%@euVcowC2<=Y81*J&`ceMDPkMNf*
zb@9g01B7VNuApD>SK!M}2JGKv%}&JJkp*p*(C6Fxy9+r^1BkUlxcoc_+)`?Hw6m+f
z*<-IL<|7F5;}&|=0!3frtxI)DpH8&jyT^k%?`}VMM2JzhlXVCuJ&GrGPvzesK0kTQ
zO9d5UiHf9B&t%J!zHdr?93FDf42W!Cu}yikfJCBjei#@-Atzs_K>zSJae@B?=<%@V
zo>dERd$&Z}+XWGXM9px0T-#mUB7~~^^NW~v0FE!-7WMF2cI_`MnEp4tl$@T8-<B(Z
zZo4K3#16m;&v*e06Q}`ld5EZyW;e>zHSiIVMkIJHX*)qU`Bab?1imqkNm6gwrB?H^
z{6mLW1y4Ol<{{M9-wI$#Q+YLEqK|0t9b56+Jh#z?pIf)CeBXNZ!7M5JZ%_!7l=nn-
z#AINP9VCF=cY0Q?R?1P`pZQ}O*CE=dGViI7l%h2=V&WZVJ(XL8Db@rN<#!`j{sf|2
zu6!6=Nt?$64f}XKbDW!S1bnoJ7Q9kKQUM&_F7Sbajm1?1K&0EoORNNpW36tqBjqIn
zTB$5w$tNlqR?6%Iuvv=ndkF`3RaAm-1z)1dJ25F3{AKgH3I>ex(s2QEjKD8aGwc-i
zvJ4*)%WK0$ve}hS%NR73KAA|`Zai)6upK{rP?1EQ&)bPo1gRRa4IoHPx=9NN3B=fy
z30I!tNIHZmpb+g)!tS;M-#a_6?jQCr_~FuY;ZFF~se(JUK%}PFhO0?VxoAaFfL&D0
zrYVw9^)7r`{Nj23%wH8}hQohVU1d&VSQjVYbKdX4E7wQwNATbOmSpt&=C)5hEZy$L
z3t$l2U+6IOJCAz)lI{ls-9sd!G!wa;#j629sY>OqIH{6Q8vGq5=a$&R>fulu=G(*o
zpNyOQ_yWJs>Fn~B^?ajZQ3dME3Cpgf&$;z&g2S&CVdSVo1+w7NbUEq#>=wnDkw1Vl
z2<RVF`_jP)wNXVe&IYw@#f~pfGljbT4qKR1FUxtWyi+hc?zMvP$*bFP<*A;P+BV9m
zLx`;SC~lQ-`vgECnt@Vk)D6fch=DT$G*5h{upQ8gj`w!};(_7O1NRcV;~b7MNd9$_
z;4~}zKin@&F@kR?p8X*ia)GT`w%myTEcR^t(F5N;9d3+*@-jJ%O#^1a%(ZSo&ma(Z
z`t;(&IT}*5EbBI+&Cpe=-B3fQ8JgD4KhJ=_9O-R^Pszj)Xkk`^xk1~vYO&bhicOOr
zRaEFjiR79z13JAVX|?Wa-@k8Jw)fP13z*}T!6v)aZqYKQEvyG$-|?B}?B%yr39q_`
z2$cRb7KMwBc$5BTERO$9G8X3@brcTVQ<Ck**acpAmW^LTQ?{jUnRJx|;}9u{(W2eu
zzorSAbm*QZ<p_%c&a$9qy+*uk)QklygPbp^8c#*(YTdfT87rJtg6Ff`>oRExHmXzu
zOHeeBi2S|-?YrC+ee9jL?Z5AK?W0O(8*G*}ukpu?<$A=~y73C96(&i_o&htkZPE><
z6S4nNpODq`eM`Ku!ZkOAe3b~k!BL3Jnw7CM;YC}qMu{rZz4gIBslRXJxA>@6bqf?k
z)Am;~{D0+k7@5@d|E2@Sw8KTl?f}{QrS+8A{+4{bo>~5@^|gk|V=T{^UitRvNF!Ec
z{YM6>9T@-nmDf7Vc?mQ`?qj{!GT`F1*LY1!wOEmCvV2yg{r8BQ5iHT-3B1`~fus3O
zFnz*Xj`qA+rWbl{fP<kiW7o<A5crjxO-G|`P3)>Q2?k$l{4KQtWI|Z2jttpt>ro~R
zV|Np33{3dUi<hL{L0|$uexKq@Tj_k0I_h5pdLyt{XeJEco8x}~$_C|^<MF%P>piZU
zcq$3Tj)+f)ha^0PDQMpuBEqlp5)CCIG60G7{_?A{cTm=d6dkLl`wP(c23z-P5N-Mz
zOPH|g4G?tj!eX9YbaCci*ySrL&it-O&+~{2=mG<oR+F&=|3KLbNL?+0L(MVS-8BZ!
zYeIO{U;A?#t>gw*rw>}qsu96=s|2(!ve95>!-0<*ZO9PZn3P6WE|Bzi<;m++hxv#7
zT6@ItJV}=l<N5!-{L!p%s!=Rv-Pn2U^1Z@+?e_Z~%@$qoKKd~O7F;?%CBKr%8&$P<
zmpb0roVV^KvKKjvTt#($fBS6-)^wZDj9R*NlWPIIAQ|>T$ty<tsAr^$a0-x@ST6PA
zCHUt9Bb$zm7Tldv?)>q*za@-=!V{NL(VgxS&%T+8bU(ww^ra6=mH(-`K{#ZcHnu4z
z2sgdIfZP312A3Ywug4Jh&4}Q^0sY4nPeQ*Nzn(kM$#~HjjR{5~{-_s=hK>t9EW|--
zUe{;OU$YhWiVU>{O<tpk=vVlm(b>>B20nu#0~7o!3dPe!*#a2eQJ^XM1OM*M=`W+>
z<fYXciIgv1<5zhWyaCEH{Equ<y_sia&oUN6UdZdLx{6pWuG7mV!F5rcq(xLG@fc$`
z934C~u$C9Kdt8l}4En~9Q88M)A^()EUIwLJQ&J4M(9bsjdnPg5&DMBt96OM>3nJxq
z)M%Mir22I6*>6(;C--y~Eb_BiQC=7BWvpGb#au3r=dO(HWi*9GuNUCY|Mxy|F5uEb
zv8xCpb_0Icg%|OWrU%96jh^tFcrH92UMR5IE?gh(n&@5sT0%Vq)xK8njPj_Zn{fj1
zmN)!G)V*fFDC>w4np?E5VJ>h-QA<01-pBSUCUrup`B4?C^<Qm|cCMS^#_4yZUxFf(
zV(+WGT#VfK#@YA6jD?#1m=Lk=acGVyp)PFZQ|FhFKT`X73tv(9>f2_Kt1;8=i<fgc
zBR7&7%WtN5{p^6;N&HW2FYckdRU8`aP8M{o?%ddVAqpi}A@fGZZI?a>@&qM<a>1vK
zybYEPW}nyln{P$MqW{p-1_~>2(ZH1`)+~AT6Gi)va$z1$m}`5neOa()DDQrJb98_9
zsCZZ0(?!wB5abr3d3xQSJtU$&!wg68(4J4{(}TBrrf2>$nkW_N+u{1??bB~li4;XW
zeh2nj{bKBky1ktiulF^WRiF-P92@Q7bkzGjlV5zcGUW=WD2z|AV{3uX2dJxaO~_~p
zD-yx*Fw4eY+A~ex3;Xx7vPfQ@t09c2&||lX;5uK$llVl;m(k_aWo=IUa;HaXn%~Ju
z==6(~sdh{|r3A=OIN_b~v#_PqK4NNRe@P$lvr+4(&-G(rlRWDmMz4hX;}Yn5qb5iD
zM!#Y4%l2P6*VMaQMo~TWejS{s#p=$UrB0FQy3E;4PZe>?Z<a#C9v<B4-I^Y8t!>cj
z?#X7uh`n({*hHJhL^Ok^F_E6lVer0H;>*@JV?Pl&#!k0z{r|j};_u}|uI0n3iMOKh
zj0DOCA*E2vX39ryWD2M78P<|(SU+0?+{Q6zx*}<r{KVp^OFCYw?kI6b=JF!&<S#N)
zTPWrEa>K91Ua0ob311%|{3^T*{_$Z0hCwuUNnM$CWpDG_Gi@^M#V(CgAL(Ax5gm(9
z5_WKu%oeg9`v_2@Yu<B3UlsApOcm`GwSPPhMByP5o(EC4w7;Dj(pw>&ZFN4{e++T*
znS1*PYDJYY$mhLTi^Pe!Wy?I9H{P(Fpy~h0qjT`}j*JBSub*4Xf~P(!=9aH_2?CZ1
z);|ee-L@B%1)p@c_;ow16&n;|iYdjI5(-~LUCRs=h)$JSzy*Da_&1k;EwLB?Jnq|e
zBk8&0(Nzas%)#2;L_GVw;4kf;m$V<rPrQ#*vA9|GS*->#KSyM}XhFY8NFTCz9h}W5
zxtN6KMvj0TG{=lPIZ*-4X=SfDYd;gj-SR8@h5Rg`58l^Wq%Qsx_0N*e(5a=+*;Blh
zs^n$za_9f9r2u5hWuyRGqK`Njhp_*id+q!F@3|F3prpN35WT_7omfnwtmKoKL{_Bj
zMh+ta$xw5P{`{%S^-T$=wHg)2sr@I&WEyq#;2(yKd}^rHTgJPN%DI9c)!CGza$+kZ
zEhP7}v3&v+5hClbW|M6xuFB5F<($8YA3`7>imR*B1)ZDX>Z{f%!Mk-D&pp7jpKJIJ
za=)x*-A!;>o3xy2fj_84vjo;r5os^N1}oy16lrIcLdW7t)A2VBH%zP)O(B#Y6Yo)2
zw@2u<3iArlZ9;Y5qq`Nh#5S6=&6S{J)K!mib`7-pDuurFyFt!X?pnJcvvB_h5J0bw
zFwDemn?QXlm=~~JLVJ~lt&DG;!U%`MUs}f`t{#YA{X(sl|2hYY#4TfZUMr;aa^VAX
z(>bCkM*JzLyC61Eq%ZzdaT?XTx6C1P7vrmV8s8NsSX@0sOM0ts_WMnQMA3o&%bUbv
zI-Z*=SooUQWc6Wj-E=)q{@H`J_1f02pZ-$XqBZu16Yk2g;TCX9b!T-vcKkbX);*z?
z(}WTBoXkkR7W~gtIYnSATGQFybNvBk*!CW<Hhb+wx#p<pSj%=w8}O=#UnU>V$iQn+
zTtyzgUe@&?(JjcR16`AS%ZsVe11S#zTEk2O)_bB^>Pj<=%jwcn`s+HcZ&bb6WUJ6v
z=ZnpnYutS$jWhN{2mSRp5<j+C|MD?6_D)+Iy!l!a{?bE{fA+`T@ltK}jNF}$vkooq
zDRVH4bkWZ8)4%|Xl|@4=B+{2dkxvvX_TRTUval+hnqxBa?Qj3X;^*S;Vy$-SfqxT)
zf8ZZr1~=C<#6?s8!Y5K@P6B)NzI@6j%AFRQJ%L%TQjdsnqk@Ur;05viA>iPh$uoOi
zc5b&by5Xt=E<JG+jbLm`!)nO-w486>y^&=4Bk|be8!S4QzL)W4WMU|#>$aqMwL{-i
z<_*{iY4!WW<?L4R&1?;z*|uYVg~DXo9u}913Pl&f9)(RXkMK>Vk4KqHfJ1%xh99GU
zQ0|qgGyVvwzC?84(~-z2pAur$`}J*`WBy<Ny{;r90-cbL7_k_RJO~1QojGlDs`TW=
G*#8fTJY-4$

diff --git a/docs/img/database-access/guides/redis/redisinsight-tls-config.png b/docs/img/database-access/guides/redis/redisinsight-tls-config.png
deleted file mode 100644
index c35add5405589cc78db80c0e50f6f10605e5754b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 326444
zcmd43cUY6pwgw7<fQodaN@!A~2`VBbK`EgKNJl|JRS*#Aoq*KP0s^8^LKP8diZp@H
zQIOsd=`|n-p(G*YhF{z6d(PSW{&{(xB=eQ|zL_;^*88qCYk=L=2cJL7eU^fP;=Hz&
zx)BA%=|~C+Y6m(R@|iYHCT|J~O0ct<+FflmHU7Jv?hl<^9VsZpQtWMPShOX@zS!E@
z*nH`e5I^hbXA~QoU}OXBYU$u_<?piT;?H_%Wi`*qG*4yHMp0ncTI)iez>oVN{pJ1M
zaBj(if!aHkqbVVm98zk|ya{A$Nq>Gni@uOV;c?&dmf;yHD*Lm^WmeWk6n1_TQ-T_*
zV9F^k)h%zjAgb7GYFhwh>6tU0G#}h4rcQn3f~j8RgiuT=YHKZSXt};^;%`}6L@gCC
zJ$88Pv~atnzA)nXXdDaE&n(E@dugw74D;vd=!;BF4>UTcTs$pAB_u>cbN8j136z04
z=2F2VSEL0|kcK9{f}Z{xE0dk}RW8n&TDdD)Gq+<)ByDWw-ED0qeVh5K#F)1!y4)o@
zox3!d<l(GTRGUpC5~x)6N~OU=8;sHdi8L2aB#}OIIuS3@L{kM&yw|stUHBv>PnN8i
zqlNZEJw1xc<T4!vWsEZgHMvAd{&15&6ckj?qbX>~zbxdBdhV&eubz&~rTV)}?QnAA
zEn_upZSt?Ny{Dt&6E7!sZ+=FDdh(+tolPvfE%fdv+Pk|++d8=0IZFGxJw2&Hq3o|n
zF1k5-+w%Lnxjyky^j8u5;|@h~`Q)^WApak?c)O?wTIk*7S9AAt<d>JeB7H>=c$S}^
zU)j^)p`wwx=3mvxM=F9&-ri3YWn}#P{G|P^O1pbLl99c6^QO!dIT<-QDe@gsUI9<M
zZT+R5cnSUakiVa!?&xLj>HO5&+5HLs$#ZS(+<m-N1O-oC^v~a)?R4~a{@0tHc>UEa
zatCEjuE@wrUy=Fe+2pFqCubG!I{Q1i-cxsWBa4Up4xp^8+%@GtD*TU2|9a(bRV{w2
zdQDdD_o}~L`hQn7^>Xx7b9W=Z)EoG(vH7d=?-&27s4R2R_upjkr=b5hOO`b7tg_5M
zqXs-Xyt)9OpirgIR=;K9Pq~#%TlYYto+#SH^nCC(BX!Aekj$yGVs^J~nZ(&41KD@R
zT#kA^1(}vll6*U(-{$TMHtFo>@rSWFYx5rnV+Y*F1CEIOib05v1KPJw1t8b%J$l%T
z?fLfE{1xG$qp!{dAsgz1Fy<?#G+XF6DgXa}VDXra{@&wP5DZMn_uS{=tJgBt*ZeYm
zpz_<JLvc)4U3iirF0h_|^Owe)PN84u(hhoH0<i<?JC-=o{b3wJIzV?1%soE6Z~%^?
zauMA=rxo&}sAd9U4Gkpx+yUTnOn*qdh87(i$v{bae|}XIkqD&$e!gY))X_e!^}(DB
z10xQ*@UX;K>Q4vr;0hV$eSyht8HOrIXj)u6quZ99eu!;45|^Ki=7DAdvcRzeAPBUX
zbPX2oAA%uT{t&|BchM7@@YM|V3S=WOVe@hM`3hv|qo^DNkvP<$W`Q}*KteZgZ~GZe
z8esq>SzSOvJu8w}CXnm(Ne6^0)Ah}~0xjD4te0jd3-}bAMr3$;oC-Lz99X8_85~ZE
zz3|3-$q5`Sl>$tU7M%C#z)J99B$T5Pf5{PnByXvWtk|`42XD<Sfgcj(N0}i|b_V>x
zfw^s-m)ctV4yc*5Zk_KXXe~2ZVC{zeB0qf>984;CI$yB^V!xnx!@C(nTsnqtUs4oZ
zJh-ib8hZhEJ$cCy;w&u@M>PKb{22OG;)uG>&617f09k|DP&=n`MMI4Fc~sUFT*j$c
zwioM=sIl@48!?`hVZA#T77m{Dj;F-4RDTa?GYN-XT9c88NNXg%CAV(eOiyp%^#nvO
zp^^B$pDfYLW!BjBpcox*B5`2{kVQo#uIxbm`WibvHn%d^{l<m>6EwuLsAc3A)RrUc
zciZv)^Fx|&eS%NO_G7K;B5RIL)e42t^o-CA)2^43V+R=Be5r$mTp^l#h0$yzmg^ix
zI<xW8oU(i5xiz@DqE1pnE*fi|myeErQ9&N|z^?ViyId9Gb5ODf5gcPb3UNFG>~l~d
zIlW*!zNB(6K)rVW0D_Xs<L?`!O}c{KA&{ZO@qu{Mllz3kwKxQl`IQJTlxSwLuAINJ
zwi8dn_7cJdUa1|ytU^4##KV}9NNuh8ba@FJB~P|d#eJux<|g3)L6SuV(mO7X&~1mj
zB2r_w7$a6QOBaV-DVCdNh17KLgJjb{<~*XM`0P2%F@CAXDXs#E;@dbj@X=q-=^>aN
z>7`q&2k#Ol1_0R-p~OJK!a>Fa!Ww#f9D{_KZi*52f)h5yprrj1{dBbkjP8fD%^@#a
zRli9(O7xvWMi!3GO>Pk5LAS*dU>BE03@m3Z)>J{(-r=jvAM6$+;SCMu&goy<;FxJa
zhjA&z0M%DjA2j$2?%vvM6&h+DHVIJ_SYK<&F%o^XxUpzTbTy*3^qw^Akv8vz<tt1I
zC<a`UUnxMSxnVaVM-&{26*^2paSkzjJe_%rDG0Q=#X0wdcQsG1631>9pmh{Blozx1
zu;vf^nu)=rA)ox9vTdPe(z93usKFhF-CUD#IbU{T-^$eT=zImJkvMOiw-(pW`U6~7
z97tF>;8=^9K=f@!Za#BSKQgR9s&;J3{J0@bz=tf9f&9lkwCc(a@CA|3_yH}Tz4`=n
z>>Y8qJAgl^r}aJZmylm6@4cq2_zN7pM6FCA>Zia)|65n#xbpzUsriV}@53X-jI2Bh
zZQ9|9o+#n3?=&U1Zekl6d}QBj4Rxm8k-zNaCj<f>;4#m^yPjiMN`d&@BkbDdz!6{$
zS{h^<{AN91VGWKzT0^f*7&K^_d`KF^4Q$F(fSQP_ac|2xRFv?9f&dZ)&o5Oxp?wbY
z*Vj@MnxHn|m*ds|uf0ziiphy+n11)jbcng4A9Pv1S%xzpkKPOr8wNiY(2@j5YXOS}
z;SVS`bma(fYF}yJDWeMd!Wn6Agl;WolxomChY)w;yN7!!0u)HYSbQSXhk(JOv9;H>
zkz|Pz!oyC?3WkWrS3t=&m@sh!Innt8^uz$U(1~nK^f0g(##=%*8CNclII!wiQ-hs;
zEVzHy@qR~|OmD<8)h!H@AWSEl5k{34S*Zbs1Fs!CGOe=h-#6}gA=kwry-Srqm})eC
z;+=9O345J(&*r1T9&0?+5N|rDA0j_#2(dzw;h@5+cMV`}j>a7wOf-^Eyp&`i2LAyH
z&<f~<5W)so%OQa^frL&}+a?(UTv$qR#4?vibo-{ki9~~K--GT6c{Uk!9S9yNL_W&N
z3A*e<TAJ>r<=Q#`pjnIiNzAoCnmw0q4J0Sm4%NX4pCbEv7@<Y4dz`ww5iM-~!3tI7
zjIS6~0gbrRHNd;8Z!;-ECKm>n*9;K)V!_TM1|@jR7r>9$?PjZMUEqs(fZMM)G5l10
z6*oKaahv$Axi!enCbD5Tn6Lp{IEL?#t%Zr-X%IAXGedtIWDVW7CT%pMPP$<Y4Ip%e
zPz*JFcpN||IW9bzzJY{$KiC_I!NhSyme+fah5b5O572!wIy_;R@UKs8*d{Hjei3cH
zl0)JK%ibR+QjC5O3%fi|UEL-AbOTKBzz6>_b@h^p{Jw|h-OD0HuFI*W=XvmhOA%r~
zA8aRn)aR5Y54N_~K(g-~D6uLB0qlwh`HbIpk^bO8q}RDXHk7sANgGz=shBN<XP0j#
z2F{XNx=vKtXJ9_~Er|3dHZqnctaA5lR-9$5K)!Z4S0?K%bAT&V1Y;yz8;N_k_(!m9
zL>A9UcS?dp)*{H0(<gd6qjv<SYnixiWwRal!ZU||zD=dD;vmM=(ZJFlMO3@jEx%ff
znCU^3YNP=mQym|^yKZp2o*4#cUw=l&`I=4=z{D^3uA2oi9jqEmQ6+PO$E|a4W-JNN
zjI#?xO|qE#92B(2_!eW?3r6s-4fKaz#(Q(K7NPwPu{<PH@FBLFeGI)ihr&&KiY`M{
zEeG!%teuQcGs*V@@fVqP0CJi_iF@h?=vw3s;J!;(I;v_P*Z${B-N%h=4y-s6O4jl)
zH&**!#{~(n^w!P3t3YlDX-Zb5tl!hMJm9n(fUI<v1Cz|KRhAFcJGzJY?oz){%tf{5
zCgrXrThHrsC*B2|Rix(e9s+y4VKfBztniEaR>LGh5{f)lwppl@ur@J_HwQbjs&YPa
z17*Rb_@1)e$9PO${K@3_i!1#JtnOA`9SsuzYp4g%>1W9&vi9_$Z*M}$L}iDINNj!Z
z@xG-I>h<nX1q#o^mv%A~8wbS`2#-Fl%^46!H!dPbuaPvYSw~v0FZ2CYK_+K-Hr=IR
zG$15lERHnt(GUw02Y7Y{k1}IT%8Kwe7=oSYPhY9VQ2PU^Df=eh+N))U!c-GN;tJ$)
z_)h_#c0=PcC8@Qkcy8n111o!D>-3HSxV^{9K;BuA_^VJ}cTtS}4!$ow$Pffwn!_Hf
zq30%$CsyZ#B`~_YBaTC}-y=_KPVLA6@}y(_WK4_svry$Q4q3!neD<hFbZKk_LSaJ8
z05EKH0-C-2sA+I+Z7$u7<})!NSinAbHWDT!wGdHm&^X%_&3LE9C_mLkX3_M9b7!nq
zd$c@p->XBR{$63|q8R8>%$@}8CE)%p6)VfWEK*+)pF-RlsjzwtaNAf1i;V%+AaDo*
z+4WxGk_E8<TVO8T=|>b1X-hQ1aFSL(otCy@WkEny$ekd*L#s`s^s~-EFAKMH9?hY6
zhX`W>h}D~Uo6$xX%t;T|A{anqJP?OA5r5%?LP=;`@21Q)JTM8Rzi{v<in`99JV2ro
zvEvy76Sz#}UHnMX>#C=*=Iso&!RwvKPxnboYDXk1soh;?A3`^N)Upr3`N0?(LMZd-
z+Wi7Xm#$URenmH)rLy7{v`K@wb+yr6N~Vmh(Lbx>>Z5K`f)=1N!8(|#<tGMjB#4qV
z>%&h8P)N@J28D$UNkc`^=6CuY0597UvwE;sX@Xy{{Go0TG~ek9GfGT9)ZW%MkPTNc
zOAz+$KA{*UrSL3f2gGj(JDET@;`c@{hPb)LIH0dSa2FLytRWI<HLam0YiBLivkW&5
z%+a$wKFfbn6t7Drdv;dP&488}#d?xPrrD;9_s<+;?%Uw9ZRFDzizEl00Z=frH%>A(
zVx3RFDF^TaEy6vBPOoGrRDBLiq8envEz)XR=H{(IX#7<y0nuBI;1Wha&~)sU2|Uod
z$3SIO)bHB>lD@jv;2WnocFF&Pc2&wnx55XZTQsjhtL>nguTlNjTlwN$NSKB)DTIi{
zp$Wyf;U1r%uLRJn`-vMOn!`BbNWdSEEkMO;V8jV=Rc<7ru!R0i#tIO>&54~G+1w#w
zi|b~C1)!w)z(;thdJ>xLrwb9~@`*UiT}Z@t*8CvE1aph}^7e%DmDD<#ADBVYEf1^Q
zVPgV@2$=;nb!wU-Ei0XtIR52_OYtm(Q}WMx`ob8aCwUJT1xvX-(joF`7$I3u08@w-
zMjRBlCy-!@-RNexSQPB_X?;)^Z0(wcXbxW$9ar6Zgno_~#wH^FbZ1PC+~=SKvL{np
zuW#oT?$p%wF~6C(`=>!uf{-=?^Y?MzH{C0cO~k{K0!9c*S|=UT9_g0pF3c(3gFgHy
zI3NE7G5}euZbNeVky^o<5R;BL>^+W=F3qETh4J@Ke!*ptU2rG?-7Ol|l^f8}+-dzt
zbs&R|Ivi{XND|RSs2^5SUS#%<yT$WatYfs%q?-ZoX~R6z$YVLfG%;0w$%Ic|5QPy)
zLlu<qj;5Pm3c)P33s~Y(0z<v~Aq&C@fA<DM>>X)6A>vKM!RfHgTP~MT_x(!t$#ck{
z0!bj#CM2FPGKb6@&_Of4zwiwy8INa0oZFNy+f`hE?*F*E2~5AwQ`11QH%1`K&!w~^
zoX#}Et5uuw?xmEPhT6s6dEw4`gD~8UeRS}gHN0_I&V)iv;7qECwH_ybA!}^)5^Xqg
zYcl`VJS7mwn<W{i%?0A@tXKnA)b*6q?Db|mFF@j#->wb3ix%Uve^VaJxh{OG0>94e
z%_|FPKENK4NzUAFLlYh>aX`3XpNnoK8;O9{`h_+3sPGBE*!8xXfARPuJlPup{6vzl
z$L8o)s2v3Rh5PQi%DYF<3Xl)bpU}rXl%_vEH)A}l0xc9}$UlZJ=CiJ@n}92h<pay0
zLt_)rvOQLCzCv}C#(sctx7p8^2%u+g%%L3z^P6~;r&779OaVL~3e-OMsRtN7FT^t)
z#?~!0NG&KY`(p9#VsX`%9F}Z-1{B>PFOK63);3085Y(A!?PZ!7$~@kYuHv&YVet!w
zb*}B5drX|1K)XoCE#dVN$jp*>j4v&}S`L6f`;Gzr>&=GbP7sY33XjDt1e!^QR*fh2
z5II5i`QL7HSaF;f`c|(oGR`9FIQakI4A)u7oMCPZJHG=^!4|J99A}Jcr4d4i4bU1K
zF-m_TWgOB_vyU%Q_a=4HrU3kPV{+tgE1#*UW<RI0drhR%43@oU{4S?7(Q5rg-Id%+
z;vMi*<LnQ_@V5r4r=9~<aq4aTy*{B@(uZpgDYF=9zo%f|e#G1xvzL?wg>=|AuEX*$
zY1Ln0$%v}l2@YP|u4yP?@M0Cyf}~Q<ON8$?gKRZXCV~gC2e9j$0lDcF+x4fLwi)mM
zhjW=F1(W`8%uclR?Kag3&)Yb-F~=VmO4>bwqm<H{?LXm&#lTAA?BSCMC?rGfC>gV{
zEg`LQ$Z06)b>{8{oRkmRgU<J;)P|D!-U+U^^1?8s`XE_xArcs*$l#fr+JFJA6sfPP
ziR~r^=3K0{*B|@XaEso)wnLrjKFgWdGPTsA^PH!m8<{yn#P&w?Sd_fAtRe^DAVC$k
z6=T=wcVrORHKt$5C|h(={xE@A!o(KrYRMou!C2G9;`&eMUXf0b)ne%&oIUX+e6p&n
z@$x1XW(uhF?w?a0Nch9d^aW*{#BQLCb2zf~H&6!b&zNqkxuf~o2qrFx{y((VP7vHm
zrok7Fce7RsCE~EX2Q7XRm`2!<A*#XG1cx1IjK<@?ifUcxPxYVGT3f3?Amfj*66J|r
zuDKJ4Z7<9?0=j-bySrh>@VU$^DK=(4rUO&$LtGMtx)uPfZ}c!4zHh*brQq;Gy=MM4
zG5P^)R0KQr=aOe^pWo3e+H<<ST$prMM+PyRLZaiG{t#bd_j5P3Ob7VQ|G5|qkfpQm
zL9IryMcQ(*ifk+Zz4j2!XpR+cr4)#sy=EqvE(=mr$Ch;CCu@2DKfkX`;M2{E&^HF|
zEe&w3p=GQMnu)KEK!5ru#Ybq+tPCDsHf}P{Gy$@Prh#4TrO4Q~L*_G(v70PAq9?k}
zyu*GX2g^0UBBAXBOZHWMMl}-O<wS;{Az7PR1pK2}j}zWpGox#%V!S&PVz!$v1#C-~
zJNybP?fu^N!T3(_60SA}AzzcGl^|-lKNNjv$I2pohMA&cyznKHkKTpMmynPlVCFSf
zhj>6fBln>Fo&9xT%o$Y_uCmJTj!qJ%==g4mn+nJc$LyL00m{~R4#pttRv*Lh>-Kj#
zpI<Cmt*9@NS<TQ7F!g;7K~GqSvBQV4r2~VQ8x=hL%n0ZhLDU-Aux*0FZIXy<$Bcec
zsQUS1DEeN>S~3C@O8m8T;ycb^-v1&44rB9ovZsT}3w-kUN6GMsqZaVwu~ZRScouB`
zV{<^ntnJ(8fQBXXSwSW5I<^}-c^0}jiXh3#W7j7La3Bol)UD{2O}aeftb4Xx$W9QG
z2Oj`z_^23O1|5zvqdvf}j%u*C9cCd#_8xdx$Hrpp#AQwDlu)TfA*RtK+Iu^!0X+7t
z)l{)zU&p#=MF*)lZ(iy!$_$;ljNBTu2lxA8$7BFHSaDz8tAvh4RR`T{JZ^$&dI*AD
zvRcAd!37~bfuUXRJ$e}+eSjeK5Dy|5n@$0{kZsSr@}(91g8$?X0R!`jf6e>MBaIy9
z*a?6NQfr+HbztsA_<8UMeQ)uEfzJpv5~bmAKB)Ij;XdwTzyO8tiRWr{f$Z|dTOkro
zbJ3BaAfMMDjfW*dmrL4<eB_|6yJSXjyBMEf`HT;SEi4UuHxnme=^9($F_a`b2u94f
zK8-!V?4Q4HH++lsOj1~x1`pMkO?r&HYS&kLI3Of#-`3#bEkG-iQy^1MMjc(?)L<7R
zY`FWy`Q>DQkN3W_D>;54fw1fL-F}k55t3E0XU|IJ$;(AD{fJO?G#vZ3TVB5HT+^@H
zbCA&09efu8-L(cm6PGq+5KQ;Tp|kDc-B4YXn!n<=o}a}gqR4O-GV-VQRNf5r@SA^C
zvSWcGE}fXVl^q0;__e8Z4n!arAOAc&B4n=7<gd}KF$~=A7b*jlbgxz9Tu=Lumn2iu
zVFVz=F6Mz9SnVgg#C(55*W^Gy2$Xx5^+Q*R)xT8KRkO$71mi`TzJz;H*m+#Bpt-pD
z+QjSzPAGQhf{Gh#di^aGpXm7_yn{?7g;~gMdp}Au6vbV<KY1CTsQ$Bg&-_InqpruR
z+C7(qEQ)>B3?o6yeZ$D?)dFny%^qucS&&a>OL+yJJ7dwX$Gj>ViJdzY3HxRAojeyn
z2xy;6EV^R?a(qmVVvl*<I%3s13H!jd%R-45Yys&-vDfX1`00}w&oglPhuTep6BoyP
zlV0b{TI~L?A!=p_yG#xbk>`v_V|4kM2QrV3$?-0CWe#t~6=mlGd=whBPdv9{iX?Wt
z>daa;y5l(<Ghce#=q(EZ#@cB@$j<N9;8!y@6?4Tt8BiCiy|zIKaPOR&_rb26k`pt3
z1OpTAbsL@Y*Sa#2XdmM#*lrUVUj1sdE#+K))i^!6k-?y%`ZcCOYs5-Qlu~h)Mg$ZC
zth18xvHR3x;L32|g6}9!8bxmwnnJcRK=t{^MSBS-imqt&GIXy%jSb@U0y_46t6~W<
zV8F|OH3o}iBimXr=4;RXWT9!_3wDrP(U@;z=z`lPE;iymVjVk#!on}c{3=Mg`$ueV
zExe!1?8sajo$=Woja}RUsUQICisT3^p(22^kFLEzYC%V}Z^Co%DH9OghXgJJ<o;ZZ
z63GHI!Z86_XWAbXf_8tTuvC}r<a&P2a;00-$8~LmiX?^-6{%l`V}1JO)v_^$m2Me`
ztT+hb9Cp+|J5wkLf_u-`$mC$Ck@`?>6egbhQn@8}q*a}1YopsNG_AVI6jJ^obmKt4
zK0*vhkzdBBhP4mg`jv=<!Su1>2et(nA?1gP+LapDpwq9fVwYeVSqjjV7SYw>@@6Zk
zkT$j^ySH#7>~7iG1m|(D0kq@Z%_31adC>s@wK|jj)Q$fHJ3Qu~?}BQ!NzEj)339Zv
z?-A|MIhCaY{DjvFqY!>k6(4fsi1REDS*b!uV?KXq%FI;)zO0$-(6_SYH;C;2=p2|^
z<yJe=E4$iAbh0ZzYg)xlK;of<PVAck86wQ3HVK4a%s&A5sF13npiB6!4BknB59UBz
zGUg_kAvV};0P{of-iY+F98g?h8NTvSuq?<|7Kt*fz)w}j+PMH<BXG1PmnXxr9(Q#N
z@^dBF8FevI@_3(m=35PhGf;}DH@sA<A3Q@nRhn3_l@{|n;$`q%Zh&H8j;?(XLXnn*
zu&frk%8l+#G73atY-Cg}(Tb*Y<+E5G7@svr?}0b%*~h2{P35_y1A^9W5EXY!aCr1V
zw~AWKw$f!E$S$G#Bpex7{)kK>%FVqICzv8r0Sc-hkzJP~#y?hqLUxQcb|8H_d>$%f
z-pnq2-@M798M@0Q^s^u8U+vGgjvK^}N#EK7WQ#V`F6yf6MSUn^?Ov}Mdnxu6&ctB|
z+#4yb*&F{!4kdjU7^CsfYXSmX(-B6yQ88QBfp+vdbj@OdP`#}1ym;24zVP#eQ?C@C
zSp$+?#n_c_cJPj79b>{J29K{5m`NjZKAilQZe4Vh8c=?qJ1zKq3ge2K>19p%%}bL)
zlgTpu02M{o^+!ZHAN9a7M;=|E(^^I4sp1As(pfUJo<zV;U<9$s9j;W6Q}kzW-`uNA
zwQqAE$Hn7^gx$tLEfV_YDpb%zA6hqJ`s|4V)H{cK@nZ)PEdO&H3SVtLMtisb%fEJK
zW9x1J=;n&+YVOgl--j2)S}aP?7P)$U8Xb$t@sAz9@U9pB9GD(R?0AXcAMQLh7`xhn
z6t-l8MMNf?R!B#UM5akRN8X975$VtT9Bi|`WR2X1e~W2eXE_I=Oern;W6XhDoCDEV
z1z|u%&Nb)ZU+3i~Z4S9z-phs-Nfv<N*4H;jk_E=Da7e$u-R=9{Ug8!!q$z>$PD1*p
z+2H|i)y2)YiOWfgJ({7_*~ow%I??ntxkcfveQXyH6^q|=9Q&?Z?8F0I0t}qXHdmBc
z#6~}G?QXF9BGNS!AjX3oGRrXw9oA67UJl(VND_lIy${Uv%KeE4l9mGU&^l`x%5#<R
zKP}AZr#ciA86AZ{(>)_S1`ST4kWP5WDDz5bhN-(3Lv{At8dO=v+j^rhc8$mPq)`Hy
zoZz)Q*JZF}z<sPX$Is<bOch))KltDS%B?@V27Qc&uSNAsWOM8Ww@cU9Kah1`U0PR8
zOT;@#7)XFN^0R~4L5GImv<hpproNklzM%-xZsTA;5n3?EeX`T{y+pLD9dCBbhZKO@
zit~!-gX+|Z#cpz!_r`kP)!w9??%zR!ayS$#ysbOX=RZ#-`E(}hB^03V%I_7FDf=MT
za)P#D&LeMB2$&_f!O5ZK%5z54XmHjG_~$)=CvxWTs%&;tH@;HNDck@|!ioza^7Z%C
z8^wV8LoZZh{f)U)JlHJVw%(>%dN_H_>mqxsF4mcBt+f!A1@12LbBeJVx~9Jl3y#f$
z*}!dBqvQ{HCzHWp%a4U(fYjda?BnNkv#9o}CQzjn&E2y>J1Vw^TT`3L$6Ftr$KT&8
zDJ_-gLx7OHQ(bodX$`w2o-W+BJ^E4-vyf&X-p=Xu72Dg~O1@j|YuSFYBXE_&NymV9
z94kv(+v4$I?A_XDkaS!;n~Rd-yRFfo>P2)`(|d^ojLv8Ue({#L<!;3u&t36hZ&m#%
z3#uZAeEPF_WmHXD)D&*04|yFNmR<SUYN*F;_0zEt7xNV`PrtlSl#c_$eiE^hLB~I9
z=R7|4$$!Uf6eIXZ9jpe0_=;1`vyA~!bV(%7WH+h*xC-B>#T0hD6m_>w)tV_=)?V|q
zlHWE)Pkzc_7_+-H(#{C_R!;Ra{wPX3zBJN461vPZN4NGiuw0(b29?}`Vufp;SrdPf
zX7w)qyUDB1-1*A;0@XfFRz(FPAYs0Q<OC|_E2G!xXrgj3cCAIJ75KsKGb;~;7;0YU
zQsgD_QLv{fk6s7hzQ*^_VEscxBK+>VeHyD7aCrI}7!r8DGHm}prxLulK|N0+5WV*8
zRjP=7R^51yM1`_&YTMIz#+9X#;FjxcQi6j1CH6u&MvcWf!6qCa?XLoIM#^u!F;8>N
zXRM@vll+T@B?YP3cKJIN>bbsKgKlrbM@HviospMb$EvpJr#d-CNT15B`icN<ynOFE
zG_*=(6pBmReA@{5McK%O|8{jCt@fE0qVqrHIfSq9QqFR&{#<D6+q(Zsi8tGiE$mU_
zWq=RSSY5_(t3aA4XU-ET<)c0$K69z&*Ne0v1LcQiH}IWMyJF5|W)dv)E=%h9YhiR#
zFRj!ii@sQPl4&w4XzL}fj}DGa%}vibLD|Exz@qx*dOL&4N;KC0K>G8RTsYy`lwjL`
z)Z#E^rc+O&x5O$Ztb@w3d}!C~Q-i&GKrA$t>dJ2vdUd`p13P2lsMty3vur?Cp51qg
z%0t@Mq;;lBDhfUT>-4jh+rzjLXvBT3DBi+Z01Q)aFVZIIH>0}wF1jryvl@PWT-3n_
z;AT9G`)C-d<gfk^JF%el>A$3epy*mI_UEVs{lveyQn;mwT~C7wr(q1~?(ZT-J3Zp+
ziq5->H>WjV3{bx^Q<m5`-eKah`{Hr|l~-cJ=^`HSzow@ulFk-MGu5CCixtu4v1IU0
zizAzSy|2qmTVKV$Gym}M=3O=e)$q#B_HVxb*e_{8EH5vgag_Z%U&X(QzokOm^54@~
zS{79)wwV|_nhwS@GnU*k89fpu6-(L;j2<&z=3{GSf#Hkm?xgR>x2wm*lGH1Jbw-PZ
zzCFmt%2P#GZCR+8X}D=QLtfES(Of(KGE~n<_zIDtE1Y3SSe%PBBo^nqR2+(n?Y$+f
zj<pR<hsNWhf5l}tUR1XGlDyw_M&b>XId7^w@4b+uqi@+6{jX&uvX$L5UuPV#aK$Ek
zDF|8WKQ~Ni*>Av8Zit;luP1vS_O%axH9xP1-cRx4_QoV%b3a-raXHR&Zhg(JtOmIE
zG8*!kKe0~Ipx(u1Y4cjy&wn}_&T-?E+8%eT%E*0fNJ!aM0Ru$)GX}L&n57)xIc*bh
z9&@nfee}bx*c^!)bN=Bop(mQ{ZS-2+?Y^kM^z<?Spf6EgXV*Z)ZF1Z+D;56kR{LNv
zqtv}_A-co;zQsSUIY|wAp+}8LssDB<skh*}2td+lL9o-{@esY=&DzfpW#=asT4}}^
zc~DQ&s$rL`*|%9h)I1)qs)u?Z^;NBi=Mj^bTp?fs<rzwv%fie|uX)|V3n`5r=Z`W^
z(;dDJqbaKq(X-55l%eqYgc&Kn`U{hrK|qnAJqJTJlMbdqudW4KD0-A>JEt0+HJ^HN
zJ<w#)zYoJcOiRT22R7=qy945Lw3j&ExL+Jgm%nFhyqR<(z;^nvr@5lTXMv45sI0OI
z@ImGNMfZhB0q5}`%{NglS3kXxw18^8{v0Zj;m7s5D;WBOTdwR;^P3`<-|X;uVv9%j
zMf0@U8BblsqZzLtPTqj!6z4Hhb3GD%4K%V7di0qugm7Jc=4t!w$sUH=7_xEKCt<ol
z!$ld^(=Wnagp_(FULV)`{^YY8x1zU`KqR_Cwb-ygvxwcy!Zt;F2EWwq{AtWgm;7)8
zaMj+9ahd>;umjy$hvvC8?shr%U7xr^9zn#J1v5ao&u>k$&}5pYUDZtBl+6oLSmas&
zEy!um>lmD=7nQzh9-r-Ryo+E89IYy1%Ztz9{DnYu(_EzWa8|SElCPmt>@-Ol9-2es
z(Az`DO+hg4D-_|kWPI%6R>nIjmzXFMb2wvBX>>&*32-~-=lcZ(>M@CSLn5@a4L;oo
zTvwf2Pu;nH&Yh-KFrwhP`flx2TV>C;!yU6ZKC|>sG-$vQv5TzmZ5^Q~&8_zn=*-r#
zFY`_`hRVk(1$*z00g!#KAHSJl{>sh^mX*KU!YHw4xe_{Vgz(T1OqSc9akK32b^{EU
z>Xf!B)uw}XnvQq3-ybih8t5a52NmaRf4u5m{5b71@qiWF;kv8gC;WT<T6j?u1+QIb
zy|+<6QXkj>lH=WdKH6y>2W9hv@hM5YFN&#*=r(y(S|r`}+(=oJ80#v&!C|h0+_DeG
zu51&FSam+|MHO<>7pb$d-ujlyncyns>=MT9ozU&SK2cW*Bi7%;oi^G^W!z;eSbhzH
zsI@f}H`=z<S-aC5RlmK@^T-G@xVtp$p7Uzx-RHcZ_M~%xO<XhU^y!Icd6t;%N`Ats
z&YNND)t~b3C&==7&+$IHHtkD|ko0PzNBnOIc{I^2Z!({}e$tFxU9286vpjejJs;9*
zIr}`C5nw$l{P25pm3{Y{b_S*QjX#gS&k^POUR^DYVN5K}3A{|e4nU;?YaG8Ir?ag0
zo@W%ElWDAE>I>Sc0>74X)ZxDI#42!q2s~nH{=l>*vc>l2rwRQ=SSG30I&iD1dpLnh
zWx_@VitQcIktj>k2NCx7E1(34-4`;JS5=h<vTlB48p^Qp)P9y$ey-!%A+|Hzd*XrL
zfnXEYNWaofmf1bW^u+<oVGgUOw*q)DeeR)NLNl4O`)@v+r?%9qM%zlVtX3ayf6n+R
z9vd*E!I2L6xLWpTZ&yUtQuoS)(srHDgMgLv&h(qN3fBM%;`UKC-R7ioPYM#{b-ufP
z)Z19oa}BO&I-E`lzAm5f+qAfH>Xnb1XY8-|U(cssQ!>cyC9f}BERepT`}tSOwGS=k
zEb&x^R(Sr?V{c?uRSl4_HaKRF{J0ncUa%}`$6(IY!QFkUz~GLwh}`rQ{^=BaQJ>9j
z5u{K?G152d{o=3zV$183?7}+LAn)m9;^BKGr_QR54K2kgm8YAB%U&wlqBRecu6*iu
z;IGNns80W9D1X_3!!%?zFU_)O`fsw^$r1Tw2+5zBDqU&A@4S*Lsz%Gm)(S_&8^(j~
zJM7fXg{~yp-kE$SKw^3t_+!)BT+5;+Twys`jpdj|ZC(H6l{{HslzO*6=S~NVbtIgY
z&tj|m^LE2+I(IVSMcsYT)RWP?U*tTXawO@liY^dfY7gY$=K11$C>kBxd^8)xdi>>9
z-S+35=F_5I9-VoqiaA^nveeOne1R}L4gTo@v1}k4yk0poI=@43wCmb=2O#ZodPT6~
zeJJ7J+}FMup7~Qix<DM4%(DD<C)Gx^K%o%q1uD|N0rPse>WvIBB1<T9o;oc;yQ$wW
zpA`T*UlUtry!$E+3=+=YQopjK#=Ehg&rStlhL5sKm<NqIABhWd#yU~Z#}!^K61_lm
z=}A@^&QV5?GYD5%Ec^y%vUc4C&lWMEthuVzV%)=_v;qcyHkfi{%Tr9%Q>y&o>Ne~r
zl36~6{Q1mh@zHm`nbVuTPrmyJA94Sa-`acb6jQn1Y`~*us*ZpMHSu8%D{c?y?tCTl
z^BgjtPTgyN(wMF2*poIK)ts$5$rreu7d6ke5vStLtM*JV<ALuzfd^Q_8?pMc{Hx%_
zJ?NOk@lWDj22#@fF>fel!4WWPR?i>9{N>?na+Haqwb$C7B|s$#L)RgTZaI2spCm3U
z6-f7_CVxJjqENw}ydp#B{a)L#oan&(X)Vi3pG!&oi4wq0=SjoH8*d_ZEu%IJ4#chB
z4vk=rRB(Tg%J_j(lK)G95a;uZ+Gu7vSFOi~(if^2@)8+kC(q$hz<lCMQJAiB8AxJp
z(Ld@(&hu4e4d4DbFb`N@7xIf^*wa(KlqIZQjsfqct~0xqs8O_~zDwe>oPza!dq=Yn
zuR_M{95sih<?<L~?|p$ZLTcianEu&r-+WjJq?JqA2Pg2vS%_W}xIZ#Z<f^VRhL#`h
z83&6<eW#-Uz7}p7q5T*S2n_C-X#jQ1Sb1;sK<F<Nd!H%mWH;F{k}3C3vj4|xljNYQ
zG^LKbA}l2={2ipKu6Y|nJl>Is6n0<wklq%!S!S-Ky)}JC{nGLWy6<EhEo16S&Sh!Z
zcqiW>8%nqQX4WKhJuhaOrHv7Yu@U$r@R(6yK5X$^2|e~Kj5}&q2*W?AhX6J;I^GGI
zth8PEIYW*g<jOMahm?sc9lTQXxtym1+<PXpMCo4BV&f7k*7J3oqw(PLQj*dOs{G?<
zo+n}s4Y9s-HViPkgB1zOe>XOI)D3e?(dLo%33#D+69ui5%0<9|uZ$b6GsI|-727l8
z>Z%s5vRlQB)V`R<=B4#Dyquk+6MS(<rqohbG_vy484B_qh--!xo~TKoFf|?lxJY=C
z8f&XHuzq^IAnANFv%*v__$GyZ;nk3yjMASghc~@O%nHzqAAI<azB$H)^!{XI)V9=n
zSV!npfuFLUliSaWa&E;DzB4<n3uUkTR4NEc{5!=veC0f4%`F>*bxmT}44GW;1pRF4
zZF|||Jaz7+6o+OK@4Z>GmBeY^Ju=FQ9CAE7J{A1t&MPB4zYVsPA$ATx{1tPFqeC_b
z_u({^!__vP-btHthClTA^+|`d$f8~uWTPvIqN>mA?3N+Eg^F?iX+&(4`ih=Y4a6qs
z?Ch6xS2Bz_D$&w89V)J#|E}mPWjRZ)sdykzToXB%`8i>Yy~1BZAR<8Gc-+!m>N{B7
zGou!Y^#FdcpS75EF3#?0<!N=bYz>}VvT%o71rXkPLYkLr{>@9-SI<2LtSqn#EYDv&
z$d|Z;FR0UwRY+;CpPmP;@L;v=Jow)&89cxj+m)nAU0Q0f#+TZObI8YOG#P9}GKp~I
ztEb(GZFQa>y?#aS1&bv)`19V%ZL(k~xd}&J2_>vo##3K)qXZ+n!uyh+m;pj`Z@P57
zPda1kdYt;vo$tjN+x|r2>F-1b%%^k1GY7BiNYBcCcR3?&QFx|=gfJ88tW+4>F}LXq
z$hP167L%VKeto*;`xDE<>8Njw`@_2DUVWQwOfG8-`39f9<-cbpvn=}ks;c*%&=XfU
z#j9!kNq9z+CnDr<YR~>LMv!U1M}XtI=C2wl*?`mwELQoSgxs&AyQ*qp?t)gX4k#OU
z>GYGMC=ISM;mtAtoIuyqW=6p6FtslqI-|Z=c0~YJBmF^#llJjBfH+plfy|NQHKyjt
zk84+gxFWdRZ>TvT0#PL)I60BusY!yWE;av>|E`I9%<y>c+r?YX@iE`V+6>}oi}bQX
zx0n_BCk+sEKfXYppHpH8t}^6ZDKKdMz>bW|3AEgZbQTu-D#rXwj`LIj$JKJ;`^WU$
zJm;;bS^>8z>e6J(U124RVT#}c+Kp0$4%N!Mq`BJ!^Uqf9;?S2sp&!@52sho-{6;0D
zc7hvpFQzo+&1Xe_^wD;Av@m%jm@`(ImiaF5{w#|DDuZlYeuE{|Vmj5(IEtv5D6JK}
z1x&j$N_3UgK-rK1<?7WET2rPDye!~d(YV)RcUJbBW&NXUAG4_!&)isjryMhGKeYDh
zyABKSee~_6Ax^+MK$kOU_Pqw1@g>EYvM@=<xrL^q+0VPtGC|Z6Q5e@+ioBl8FO8k_
z;_*zZ!<l6l`OO8MMrnNW>tr`)lk+Y6G=BNJ#r~QQWR|$1_h@$hbnl41QrU7Of6TXs
z%1leH=>oPvvE;$~xUbf=(|o*L6xzl0C~Y8~fCxzCN)Y%i5Wz)W;KE*x(fv2#YfY#6
z0hY{4(h`?rB&H}{I#nUw&zg-|l&TW9a`XdKu>*pV_B>srnfD|_ltn$#7(v+O$1pX}
zVH~WvY<>n|Q=p#q+FuFu{3>N+!<Sh_|Bgkbl+02URF4{Ri}RctZqxu~?O1++2Jpia
z%<It+CpmolT)RD{h;`z1nmkw0MbW_fYMe+C0$$wxxupjB>RPBRZrt#JbLw?2U-$4U
z#Fl}W;_l+B9Yn`}Ib$w8Dk1y{U?^0d?1T9<=Zrt$`UkExZRY8IU669G<O}}Qx&mIr
zw8|Y8KQLJU>~tqxw4^g*E|y(=Yglj=%j@$K)$vR@=emp85_n>I>I3^}OJFr_;bySE
zamEe5gC)1J#blYJdSk%W{gt2Y<*p^IFZq`&&v+FZ97}^UiNOVBo4*lBiyUT~&GI??
z>W!;cX_Qvg3SFBbE29b`B?}q8g3kmL`<7pTx~`iinE6Z%)3$<PcR3a~bWzJjNc><*
zu>rHk_hQ5CQGPm|2dsJJ>cSC*V>X_jXg~H*Q0hb&-I-2VPIN={+!9yX=RT(hd+F_Z
zQ?o;(Apvzsea8|IeC?vVZRh^GUHg%=MlJC6Qbu9%z#Sw)UZ{_!g|X+>J|DJ;d80C$
zqtN`xM}EC~i3_X#B<|P!b+%48f~nd_V}ISsBJGgU;ilI}qe^rUR*As?ZT{#nS3>uN
zH?|YrMa&tiHV+g<buvi5Sx=iP!CW^kx*p3<jeVaLB0t?H#LU^v_%1)HHq5qYbp8%g
zeP1K!xKipSI{L(PeBxC$uDbX8oRvVs@$=@VTLZNfb=y}@{UgAZy-3v~ZUg)q1<hS}
za_}NRqOD?4P2*b}>HSscI!uE%#a~t=q(>X3ZpU>|HXXq^nl59`<7OvLi?bd+Bk*lr
zD_7g-aTxW){563~9W<6S0<D^1xf9`xf#)r5#tJ-T<51$X?7Rd*x9IPR4fXA~_r|&!
zQ@0%zK6;a()}SFS5Nyy8>~!<OCH?jrtj$8w-<I8hlK-?WjM=}L*&n~#-8)Y0y41q>
z=~Ljj11w)E`Zv8J?}-ZUOeB+7I!am+9iuog)#Mj^QEM#8;bK;yf+3E1_bmp778Z%w
zsxp+`pG?v9IsDwIS+y(!S`_08^|(_%WvnO=$sT4y7on#03`wJEcRtvme5pA6sseR3
zs=8z;hKZKa71hD=tNwK?OhtBC4Rkvb*pd&tJnA*}Z{fg7F}liu^26x|X$pte|0UuR
zSnriP^~0U6T`vwANh*|{HNJ$a$1;hQJP$>sVPJs1F&cQB3_&n<L8&C(rHIj%7sF~W
zQ-T|m0Q1UJ;n<#gU#8cI$aUaP$#Q(Qe$7^A<J!$>7Vp<@@v*(?FOx+yV1STGHTsd&
zWGSC5CQ9(lLLvkk7xlZ={BJwQ9@BXv1-|LN{gwVJQP5%mFw|-&*!W2o>2EZ>D5f#m
z=4ixW5U1j{|G_lab<isrBA){7)Qs_TvU)6`FYhMBxi3nerj|cXe|FeZc2L*OZfYck
zF(gh~oJGN$NA)h)Ao${)B(>djT3)+c4z2oWUiV^4&3T94%>3Vk=Qkr#52j$b!0-`7
zObOjhpNua^m=T>3F<R3fT7XN*r_sr(v$XrgWxX+w{WXFq>}G5&HW&)S$qB}afNf59
z#{l)rLg??Lju%$8UTC6;N~*yx3Y&BTf?O*#2J&RZLe1D!<kuZiAxv+a|6?;+=)5Dt
z6m%6dBWo1&zI0*auLLTX?ek8y!981SFKaGettyZL=y>GT-?zIfINXac!b?=`vU9{q
z`SjG}Q+~Ss<)W+;uQ2Nv#jlAL)8aw|<zS51g%*CpioO(fS_s25j>!RGdfr$0*=-O|
z>s96)Q+dlT$nW^@FNyp$aEiB8c?)Ly-MT@VL?fVZSZ{)Gm4ZI=*GW&USb+9}{e3Xe
z^l(z}u`#%~MrU6tDwm+mOCM3JXVcX1joKOf+`LdS@ZvfrukU5APaUx1Qw2h_zCC6B
z!}e6H`k9Q;p{s&H!9ywE|4pC&=dQzbHcF3#U+`b?)#9C?)yENNlWdlhCX9hjtPMuT
z<3;`bI^E8wZt|iAET;iuzMF*++Se8(ezd;OZU!Y!GOla+!lTy(HpGUUS<+DUx%9E}
z*lV&|&Mt!W_o<bzi^X3%6fj+ch;$B+dOg0tlbw&~@{j-Vn+g0|nOj<z!ahf4M!qbH
zOigP6#Z^RRc4%h3^}XG~r{w=_J^rHGhRH+Ip%TbU8BQG5Z6Q`wARXk*OJ3Za&ChKL
zdd+=G@a!95rq8ddaj)v=tVN^;*TKIiDIyhOb?}^$MV^MDpqRzg$0fZl<e#124ft+x
z@JE!E$GuUu^milmzwFEmKcu4vSg#vlbn3L~^!;@rpR0Aq$WNcTt?p))9*QyW*VzzH
zp?Ng*fWzaCv`68jVTRNtx1^V#8$3(K!QNH+pEJB~(@Aips!~6rQG+EX`0v}tTemnH
zrA^wZS*eGP?oQ+i_&T!M8?EsJFUek~X}bRYWqVgeqwRg?;ThKt!C&eO2P6Tk2a^AI
z75_t}5?bsuZ4SoF&DA|Jf1QkK^5_C!L2_+btx?zqH`MOlmKZnjZA|lll}Mr7DU$Ys
znmyJDZEb{(N6x)5{s^v!SeGfg2{X3FvRm8y$<Jh+V5+%r#VW0?TiFrXSKcbnp(f)K
zl7!_B_dUei%U>vZD2&SR;KslgL3a6>$mAElGw$Ck{@=nJym{&=S<_OEBfZ!ji33^6
zS;>m#@#1L#*$;MBn~CG;Od>N+Shl*n2mM}a5*09=B{NA_#A!u!I8gO;aT?U2;&j>~
zIcK$MQN5CxjzV3zvrwjHcS+U6+=>#MNhMyRwrse8pZG1t`M<S-<5bGgRy<TVdJ<fx
z=ka2_GsB1j(eu4?GL}@xhy6Aq`Aj8b(bRApW`kqPkn8GbF8flMek)6oKrg5x>@s9u
zF_G<TF9V=dJ)<xw_?nIN_FzFl8K(NWxK3o<q+Nk>$E9ZP%O89G+r;Cf+=V|)_8}Vn
z`~r%bD~!ZMm8RK<Cb6o>^Tx4$Uj%viMXVJjUAf@Kc*~NQ*3rTdYSQRjet3aqL|=W;
zuATX-S@5WV;PXL|dXZwe(l{gy%fY_(Vn;e0h^J=r(KAWyhz?zROkTiS|8I(|&&)*P
ztk=-8#%N)>-xepSG!`XUNy)E|!5K(js^TD*MDP!{diyAME4U-NIM6Jm0)lsW;<nFH
zC0`jd%ZIV5$;Wjsmv}iXPR_S?FzxRZv6aN<C|-JoK&8ENF<OrE!R@Z`m;V>#xWYs|
z&n~paxw#0a3ePN*+GbV47<lvU$Ip#24m+AINQ*P$PByK)$x;5mJjaDK-}+iA`{jjy
zlR72pB6afo+Zr8jLANDpm?%$E^EV2?E2Bb8dnpJV%DVueKyUn6z@=UBo3ZgW1s?4G
z6-E`+bB&42N|-xMSvpPZB<=gmpL~d{(yZAGu0zfPw!2x28Y=*-c~_po2Ud5T#%P;K
z9j$y|`lPrRfm-+`Ynn<#GN0xCzCD=7hRM}QA}7}Bywz@{Y3M<oF$1cju*`!_VQWo>
zO}XCozhKsW1Vw^fF}}cGJBn=p)@)2<1x&@sL;=_b#AjKXjq#<6VB&SZ8+9f)%eXJ&
zlO@ZtVg%ubOs~_n1Xpwbv>_jQ#}>QinaEqTQ(_wSh6d`KN)vY3Aih)YnNxvPyMl;~
z+W*A}{|@4cw^Z>$GY-oJorY~nMjRw9mA%X%Q9t$^V_vZu#g3S`8<%7}#F(c{%TO{^
z*MU<*1?2o=7m0&b+t{mtyw}CXmRd}^bH2uB_m2s#`!K=PzST^3jJ1dlNg%hX7VeUr
z{OS^+Wpmf50*FH7e>EUnrxr!UFS*W9kYM_F`z?-I@gyTRR}KDlzhSdr)T9JoaH)bh
zIfY^F42e4=?c4*#JfS#xPP*G5TJ7|g;acz}+;#0Ormbp2ImN9?7;7G%{oC_(bgZ4U
zd2sovK@asgr+Dk7KH2&$%fJ5@fa$+^-oH!c&qcaiA?kU7PEgzk+k}|33EqAgw95?D
zrf0x2VN0Y0IROV6MAnNj7=wea@_q;Nx-ba<sz*;dA=-vbBT3NGV_vn=F?U~J-MKgV
zIdIBYG>2h|>TE=A+8{VMouVW-E=I*CQA+>LO=^YRbddRfPE_CwPh#SfB+>ba6WN{^
zJIHDmaUjK$(&TAxTTivRU(RtAt4dM1*%2QnQN$Qx8G7ychpF-ulUA`aw<*p)o2O5Z
zPrdC>z`~=>%5+mg#g})l`vq_slg!b|Xc&sMZ=VFO765Ny7ncC(z5M^aLiumYmE?nU
zPD%wW@+6TMVsDnsAj429o$u3^`vRAT;@3<h?OL4sH){$KD|~hN%WI1629xu|m@Jp>
z!m<@iygytLy?tkcJI-i>SfGFNZjZJi3waH!xOJga`!Um`06DXZy093o5T{L#ON)Ol
zAILDp0`cuZm?ko+(jVX55ulg+Kl33ZA5hou$x4Q}wXJ*izmq5w>b}i<FQG*)o`Sa!
z1Ex6xhDq-s&J&p<BqyKdg6E|>9lMNpixu>AJoC)?wpQT!HL}oUNKv<0)vpYu3IXn1
zHdIHrs^@6#Qi~RoM$LM97Ln5!*fBI;d24Zbquror&%W5hP{%+!l);lJUQz!4Y#3*F
zQ6z=>FUzZxcf@acZhg6P7JlbOe<q?o_=$Bxu5NIKq!o8~Q5*$ca7Iv6q_IFfcy;D|
zZbiRJTxJ?y&{k|rQiFHeIy)=mOyJ&Q-eLO)Yj@@mk@7Avz=}C?daC-XMTRC(O*C4T
z%O^67KAA;{;XK1ds&Jbw$g}eyI!R4hPB^B{!XyUEmIXwdofT?w*x;g}GWIP*{v5|;
zUB?~d{{o_a5lLOna5LejDl4Bpt`*Tf^eOtJH#?f=5wsyRIDY|sw*#6VL3d%|tC+^w
z5!$t{W=xaqhHdFa9CP<%HbgH3j&(vGnzm<f(uGXINNk%Wb?ckh<z9@5d-BJ7=8-Ml
zMuMZKDOlAFSXjhv685!6Wgz=;Fsa+TDBk_C+ULm^L&8eVh$9af-oVvZC+ezX8j7kM
zJA4Z+yxClJ5(^OiKjke+OGh6`XMNrHM(M*lIhG7h$rkY`o$8ig3MrC4=@eA_*#(AF
zs#}aQu)8tB3BH2oJE3i*ZSI1T3-Qvc{e8n=n9WJlrT`y@_#AkU=OQeTh!<t~yiTWe
zg`9(b<%TW*xDOlEsJLbPD6C_U2U&gdSDyMhe4fpb7;!#?nS#9eW?$CB&WnE?Rx01H
zrosPgu6Yr!4#WG?v=6L!pRd10=>ESbj0`umqCohP10Y8U#M+u4`7Y;cd-R(UbY6g@
zrp+r=)y8}bn7N~|@Lhv~Zc1IXgj}WeRu4jZgSwk9PY(nX^eyr77$wZ#ACi^sWG3nG
z02o%xc>pLC^{tO-+|-oJr&zS8Oknzywn}H{IXl$gPIpJETK^x$-a4$!by**7DJ{_A
zt_@n;i%TeOg%&7o#kCYInv~-1RwOuWad&qwu0?`daR?BSFYBDWe`l|A*52#;D+#%-
zygctS&&)kD_uMa89FF6~`~htlbj$8^LUuzq5db_S_`D$#b~C~K_IpAH??NTJwq~I?
zVvugHWWl{5ul8T-Isb%z|7A0t>$Dws-Hu7ukE4Aa;dxxx<59&+ih)!`oz!$hoji1I
z=e`(I&zj0Cjbmazc}P$JrJ%c9dw!YBv&_i+eZa^$v1ThGN?5x$hq#=zOpE%v!#k^~
zF4uU4Wj1&*OzSo&LbQ@3fg02Cf;uWfIa5zZHgmH0HM9E#HN7KABB3d2-uQ4+CM?FS
zQGb8_pyS2utRr!RFg2!Em=bnWn4pFW=XXaN+Ar;`b~+*#@*k7xc2@1JxD>&jb|1dB
zd{i69txvW^*CrR@I;vVS-Xa(J&|APaD=?>Dw7KdvCy}g-NOiks<z_Ws@VLv&U3CA8
z1W-4cK$knA9&hApidwp)Pi1z+2apQP@g`(jP2bBw6hwUt=e(;rC~GeKu31!w>V=f`
zo7y6Oe`-I-@u?IF?2WL<IthmYdOw9DEy7O{F+D_ou4@Vp8q!bq`mw1o!<j))(cX4>
z1b<(4SqAK9au0m+a*<COi}FchZuYJsM>3^Be1|VPt7xDgy^om<4{SqWaHe!{O@&4*
z36=cX@?G@$!lt%4&9+8n2=jXMGJG(vF9ms&^5C}mI$t5k;_iG@7fx|+!T62Bfn{;q
zzFop(FqPvX`LtvGN@}5c`m9a=5T$)t(k!Ivy^Q<DC0M=MYSf{ItN`ss*lv3FIbD{Y
zhrBnuQehHBC-Bs7kSa33OX!`{^*I{cduDR49d?QM1W5YOep&dE5uyqaK@{8m8aycC
zz8`0vYQ0{r)pe<TR@HBOS9slm>_)Np8uvO<IF0D9lFC7Tq8AnQ`Cv)7sp#2>PCZrC
z<zKk2iVQlQN}qI$xUP`M;~NPO?MKyNr^l;_O50wp&66i&15{mr+n*sr#B`tAZ$_Px
zMSH$sn(gZtI`>MMD#8w{hPk3VAGtga<TY<S8)C;0AM<AG6DOy@mJb-@mjb}#Lz!_s
zl~%9|BjHTT3?YXs1a2rHf>(P1&02=HYd|L0t|dxR<9!T{*NnELGA=q*lnR{1aRJIL
zDWp>@TQGUA5QZ6;@T8D7l^{@3`PMvlnd4Dlc7ggmuNtEh1$M$a-~F$VXB)%$B$|Rl
z<)`=ol`K|e$qk7SjF0HPB-tcAz7d~L&G+?BTym&4zl9aG|0F-+248hwR0I6#C!&)+
zwOz~DLi|i7-n1TZmaAw28p<b(6Nf^8w|h0SiwAYs4|#8zO_1XEm(#$SLleTG+PSoh
zEANG26`LWZ*O=U4BEp6L+THvoB=TqS{~Wp=0m(|s8g#nFO(ZvF#oG_It$vz>c6z=U
zPri9hOoZl{&G?a;vS%MkZ)?8n;qJn@pSslhTXsBsIs^cM(Z8Qn%6hmM3eG2{c(%h5
zO_Z4mJpHQt%Akcw6mFwQ|AU>B3F96rv;K-iA;Vf*ph4}7Ul2YG*yxO7BXzbl*Fo=R
zA!oyM$4L~;HGRrRBS{@z6vpF;CHkUdvqySU0rEsS6ZBfPE|Ge(|H)e=>J{>6P&Y=i
zWsj+%>60l4yuasWuOv-os?_zdE%>=gJMy#6^LP*<;rQB{0o6R{FZy-8Y#oLdD-?a)
zcn}>Q;z;ZnK#>b;i1B4Bt>}6hL~aZX7{Ge&ed2$SZgQXBLg%|}f`t3#8*Wl7wBJjF
z36;{7tHZZb$V9Rp{Uz+iM<cU-fl}QP)Yv9;@yzZykvQKjItsqpRGuBUdm1y0G`P;<
zdaFb?$Y&h1MqP4JSh*tj+#%8*_Bu=4i*|cBf|HqnIjcblrT|lPqc^ji!b75*BvT-#
zA9c8lD)guPw_=E-(d)z-RL5Th02)$nhtA#T-d5x#vRK;=zsf|H=FxD$A*Q*<mM1D2
zwd$L9835|2P#MG@;Co)ED14uPpoqQ2`~t;5z<m$|ONxcmN%aJ$!o~n2$pi|~S(z)%
z;gj1e5pRuotzL<`1w9VJ4<?tipZ$43U2PO>Ihijoi7WOyzN~To?0MeuC*-54P=eFE
z-HFzDN<6hzpx^H5%1S5(1^ftr;Cr3Q!`ph4iA+|zxmWsL95H1!I2_Yv;>b|B$<LXE
zeNZOE<k)!W5y70A_m{U46VotbwX0c}ALv9Q`Lc8s8r9N?-%aOB=iesgtlGqs&<mem
zzPU+#bTB3FIh9z7N2|FIEVU$}NcL<0{^C-u%Z@6ffwK#XIRjtj>RY`}x6pR4f2H&E
zDobBk*+CqwP{k|J+JoV`cHhixwntCFw-HpTDYa~}nwymC00LOwz~*}yNW-WhC+K5t
zTwXpPvq9t5O)#QAzf^d>7ake1Onp|6Ph*ZE+Y?yUFb&Ol<_USM$-3ZvVSC{HC0haW
z3vP}Y;E|Lm)+v#*Dz$9D+=HJRMV&chN~K};8uWfisHqj~%N+BJ@bu!$;cc0nP4M6l
zQsVvYK+RZaj%|M>C1{8DwtCrjvkN|saXv*Vvr{-eN)AVe-f!tmBNU!{370l*FYa~d
zwAPW)`F60IXm$Z_2Y^IASPBa$yDxaBttaq0{Yq8z;6l?}=MMs%clWx&wuF~v6MQm)
zFz{F^@Q8j4egK(FUpcFjR#aaw&2zgpsuz-uq!wX2Y8(gI=0yp;-so57IOT3TS-v=t
z!4q^avrKqx^3`M6>-uc=H1pH)qJ7rH)rk<m=<6Kf{zsp|FpH;sn$Y(J6VKlnje9H2
z$BH{yuHIj7mR%=W9sTMhu9VW98edbUfJc58QkARdn0V<K7>H^cd(B*&Ju-QBhC?MO
zE^#{^GPPihV3PO><VMd$Tsn!<za9(ZsoKw<N$5lLCxA7tnB>RX2E>l4e7qt&lium5
zOl5h!_~ktuwU_&BOzGL}e4bbJXuUG`((z~U6_WF%{!fJw2#*im^v4H=DSuE1{jPy5
zjx~c;wuYcQ)R^mY^%NtQ_f1=c2M2|=8?TMOUaee{*iP;jr$`hp#N19saNCGPr#Lh?
zFM|4wrV??CHO4B%jvF|QQu_^8b-vyl)$K^yE**I&Z=3^ZW0BBj<J>;d*OZ@0{vv$w
z(4t2V0w2^Pch_w-uG3plJ<)_d_pq<F!Qnk0HJ7{`BM7=D?L_)#Z(xffUO2gI@}EBk
z`EGu$A@L8xxm3K8rk=a2>@J^4Z|&LsrV>eT_j6eCL(osQXfqzkC;}SuNT=V>;!|5V
zerG9Mfb^EOm-ViSB+i&QIj`N!jDfIOQhwph>`piUy~zci3anJp?^O(DO+1M{2~UIy
z_1a56aLtt=|D#Ya_zHqjGnju%_^eHXH>@Z%5f=9>om?h^1B3$nkpmc@A-S+=cY487
zcKWk-j%e&TitjGtFyru)UfNvLoW76k$>ySQem6ctPbq$S(rJ8S%Z_^wi#JIaoiS4f
zy#Q=X^_9VDVHiJ_XVNP0PD(^r?`@4QNe>TR*z9NC)K@o2B4OL+Hzu`x+c5L+i7FLL
zi1Q*~s`3~iwP-$`Vkzw?z0tol3ptBN?PEGw7ZKkZi@fcY{T~UFVykzZ(m#KB-q-HM
zfhF_Hq@~*KR-;v1cgB>gv0V;=9-mX~d_<hwz}Wql?{!y@y0YIc6aaTw7gNaVOyeaL
zYS%-bDT5f0HD$b#9lFM+t3$oLexUH%GKry2t>xYid=IEh?C`r{2O-EaEL#|+T5BP7
z7S;h6d_2J!rlA)#YGCYpsA;lWdD+)l?j=K4NjGeOwRvid*ePyZ83U<g_3udDL-wj7
zkje7VlxZ)u&7}5=@8_n}SOa-_Zc-4}OJNduc`d(j6!PcV*GKmn@Tk+9w)X%XUrAe%
zaID@&`z|$4=}02?+<GlXd8=Fdu~u)C=!Wx--YZaNsv(ZJC$HP@qk?Z!Kecevc#Sku
zI<l2ZT)a-pXy@?TZ<n0+eB_Jb^X$<a-&|kFBVOg)@h42BulTCo9x?+nlup5<B#{1;
zwyUF>U$|n!`H7o5hOn7&qzPUt)nC~&5Bh8xKX+yt_`!z_)%o8|T>}?GBnn9ncC5`j
zWvR@_1DKzVPU)5ToO=*lTjE+;j6Hfg9Txf^sG;Op55s-v!0WhrdR7M3NVR*I)Z#wp
z``%ZpVJy)DZ=oMqLNM3c%y>cDB>gOBwTMDqi;qQhUlUxOJ?kTORRV+=&1@BWg=6=J
zRPuPBdLG{--S?+0o$=nsiQ~(|v#B=|U<zt-4a$l{x9fBhotpHMZ$mnu9nW*{#C&6S
zLvXwg2f2a0qd%bP*znz=XcjKsZxI}t&$s&P*0m^qfr&8{_8He=ZSc_p>5?P@q&ABJ
z=h?qM35P(<xK|Awdt|t&l+9!fppT-@*iA;ppM8no!0)C$1fLh#enqTx8B3af_!@WJ
z6ND{q#c7EBh<f>r=$YvCVLK_5)Ws30L%n<=a`J9wsdES7BTx5+iso0+6#t&E_0^&D
z;;WDHA{BR|W}%xDQ$@XH(fbM7CJZ#5C-xDX2+ia6^67;s*f|Pn(*-y+ZxvqLAQ8IW
z$CXZM?Gk%Mwy=uzv~0v1FCuLvkJST9EP5id(_<ZzILYhpNL2`Yx4lS(OBC38{0PZf
z4H}N|g||PWz}D`6?qzek>wK&fBXO&!?-wO7l^)}*06{nn%d*_@aE~BePIojx>5>S@
zG4}@OYJp;}LWpKz_|r&g<(?+wPMI#Cya_saVFCa-i6W)|teY<__7o(qRxKq>kp;*b
zi>CX!bQSECuENn*fV1tqXif_r$15^KhflN`^F3Ul;JCoRA<6i>sashBq30J>JBhO8
zBv9OSqE*%^Z2$D8bP3E<f$XtvOV!r*N(#OK`<=n0pCqJ@LxDh8ncHB{P7*?>ZSPyn
zx_o-#t>{779BlwySd1i8AjohV$8zB6*EvvLk=9jYdn_{@I0q^C)P8irSJeEwh0`&0
z6%#qY9L?<{VGdq<6++DCxjnKov~ycm-&Te{aq&v3zcRP_FHlNH2SI9l`}o+f#SyFe
zxH8yBu>D<%WxFc&aqZ;%ONX8lH>YQ2Rx?j@W<IrvoRbxXSdVa7d|XYI@R2jq*zZ8g
zC3GPS6U0xbA-J`aF<4T26S9^F+20k5BiD2qVoM%EK=B`a(J@bIT`W~JTKLwJd^4+L
zcv&3S(yLur&>z#-fAfty8ODl%lH$bIqjpT0XlfW5082xa#w*qt_Z0BnvqTe8?Z?eU
zW?22Uo7af(s3CyT@d6#UV&Kf)hjM(-Jb2=6rPIKPeCdyY&xF>IdC^TTQi^-!El_|H
zJF;PZUA=uj@q);}yEk8UQ-($?Dj;>9#iZ;i992KT^pJRAP!j<wq7U9lK4N@w-glDv
z_*UEp*TPVKTQ91`dQQXf^>`qA&(ScRurQ6=iTxx%U6S>c_-|ymPLgwG)++6adrYfO
zlyhI?p4YR0sY$vtEpe8Fdf?r}r(uKdhj+~fzmx7w5WX(l?b=VTuo25-#q~<e>c+s=
z#^3-mL0~%*9DMWIXyv8+%GXsMOZLZ$5Ckk_l3yM8?jknGf%ie<Kun1d_-IBBeAq1c
zMtOzhejeOX9$Upy)&hsNl=fECtPbO`-TU49YgrUO-c)Bsiv9wxwr;_orw~O0$7&<*
z+wXSRrDkiN1`d9_-lj{~h-rJJjD*h>T`h*252*;U8NB>x1->6fW@h=Gg%Nstt_VVj
zAom*j&hWq*Z4m$UdPrg6`Iw}{AJqoi>XZ+971=bFGa1M_11Du2BajkZ-d^)jGS!si
zT`PTQ>)0mz35;~2W%}l@9S(#jlVyCe$~!KkDpLU>wphdJGwCA0Cz(z!>cSt$K#}{_
zK-Ji}foY82!%JR=Ci^Y#LF2zZC6`LPsc7wEZAZRap#K6mNpCj=(angY;8#fQA02aD
zPMtNLBinS2W@IBn02%sMNh?-MG*1Udt+8K4@<>W*ZicK%&`D&DKilT@IDC3@?nQ_E
z;FuQw7sQ2REOhOS2)mVol$1RyTtM;_jS$<B<OhpIiJ0Go@Ze+4>gGvNKZn;aU$tD4
zi7+*%18KB~5#mz{EVU?-U#6I91ocC&GSmt(IV*{U`s@lK?o0Qb$4YMpXXcjaN)K`y
zXD^38ik-#WY;vJkBdUw^R+V{bSk*<MPI$xeAiZ}D%8TJ)G32k3s&vu`X)vU*Iu+F#
zw9VcsRLGIJ4(ps!E&<m*n@TbJGfra#vaq;g>fa_l$b@St7YQ;|zSLdZ%t!yWk0iYq
zkx^Sgk2dc%7CmE^k4%{fNQfEDh`j>5jf=dC`L<G6qCm;PJ3`fI9?Ub6bv8BAG#TX@
z!U(eYee9Y#R>gplSpqzzYw1)GRC5@tIAbd&af$Zx5z!~;ibTYu(fVE5uj+!}j>mo`
z#+XC*d~qX7eaMFEGPi?KA&-|zSKoh`m;3q58-w<O_VP{OEWezWIC1W^e*v>Rt}{R7
zbDn`(-qu8QJV_&$myda#FnjPKxxDRc@(Be8q*@K>st|aBV!9cHst)`d2O$pjGO7{r
z{cf%lI>ml2B#?L^3py79#RV3JnU4q&>->7^`{-|6fkzlCep(Z+n#$tpzohawo8eKd
zWC!E_R!3Y9L)c%m$OD}VlBSez$TL@^K&U#;GdgkBV=+Ur6~kx?p8J-EzTNI~n-YGX
z23>zB&WpHiCm!+bhWJ{>Sh`fy^YX$}b%uf3p*Bv|Jn;5o1jq5Ik8#t+mBA3A(>t9)
zY)qoAQR+GPFz)#dy6b1*?bntAV9fWuzfje;Gg2xOl{q6<OE2@=%~g2rR$C9s<^P4>
zmFh<&hZO0prk-|uf=*=4Tm1Y}ny51BFFxLunQ!Y`9fyf~)l+uoIo`<`HS~;wFV2!R
zF17RU>3$HVd+^@T%bOo6=JqYa>KVN9fR}BG@A`C@!2*Jg{1dj%p%+OJl{MXY<<3`R
zM5~sHw8z4<A81WPYzwBasIeq3t*gz7*kzo8!<+M8)A;lb&OF)qLA{#@5IZfu1Rdf#
z$g-H_!H04r9SjJ&c6s9&UcG$dM!oxzj@)L^EY}k9POe;ox5AvKia9#e)L~N{h#|UX
zYi|gfK+(lZ_p4HHDxWZ&2gfL4L>Z;d8VJ+hJI?;B>5L7hEyIZDImtyl_{HAOrAU44
zj-y02LLCnh57^`IYuwtV8Zsz9q#B7C-fLex_xNan_I4mWr}?nXdIhw0B8_QZjHS4(
z79?zP(`7xBo)3V>s1w&?6iNOJz?N?`eh#R*Nj4}NchqZrYe>94{**nE9q3W7f#?()
zTrF>uo{`65T?{*6uyRO00RZkCywU}J2lzO?p!GUPIjtuIeOCM8XhbVvfaQaDemYy9
za>Pw*fWeMGgu>KqHOIqvs>P+V>2OC9ogVMj7{F}+zOnV0cN7=M=H%$u7wpAAT~(iX
z^5lB3{oc~M`@NHr!@Ev@sqph|-&Mr6&QKlWt?%AlJsv1Ax1eO{UdFrV{^oiMz+Sgv
zbysseY;2564a@0Xy}z~I`^0=7S@>6d>L+0xy<W|s5&W;+-Bx5ge~~&N%QC`N#R^B2
z$u>(V>&JbtonHFdh`PadFXr}KCt)W`QUR*%J<GBg@?UCc(kL8nsbZn>(z=^3{q~Q!
z)r#)Jzf&jf(z-5<7ER3$`)4-Dh3d9O4%Nu@bU21P1c9ghalGNEp7*Jak#qHr&i3#-
zS!NUG92kLt<5s_RQz{io?WrKYv~t_dNm>_cH-Szxkdcy@>Cqdr%kP=Z%4WWmnubq0
zWliV8UWw2H2p1*_A)bT|f8=v<kH4J#003NYC`Mw2{5}RP?45)?m7u3d0N)%T%19=Y
z_?ss6zf15^gFlxwCa}ru85UZ({mw$E3cZ8~B`~}FZV2Q=dhY`!?|>I3mc^lQ3<}A9
zHVeQ8pvcyzb~e;B0l<RC$>}W55#KL!sHA1*?8xijVYDMZMU&2p>y^~&xz^n;)l;bC
ze-^Vly(l*0k0f67GG^4|hXc8rPL|*Ag_hRNhG1{Sn5hzt7z5{Cc`!JsJrnHV#o(Uu
z>zd8!#c{>?hal4++I#4nnySKc#C|fJ)u-dFr7C`Q9UI<Y8rQ>d@Rq^WD3qPMJ>Qhi
zec#U(#fwN7IP*B&zvTws`&b%0tIJ$-{EczuK{ma5k!(ImYT#%f#C=4vh~IqZ7^w=;
zKEfLHAZJFbky$>&t8-i9JjD2oRPgrbi@Z1;_swacGo)@p34$$|s9VFgV!RAueoZFd
zygokqG+*HG%J~ffBNTq?0d?HosVWb2WUomIbYp|S=FAIFG!p;_S?LwMR8-nrA3x7G
z9^t66l60K_Itv3Qf%9V_e<BtCgW*F?j&=;-r$5S!!IELW-9ChyyO`_4Q<wGAI6#cY
zkA3wJtC`%xPS3bG{n58dO_Z-XkJM?^<yOK~kH(AIL2)&akNCWt`<;?ZM3N$eg44hz
z`5%47n%<3U$uc7n_VzJ0Wq*cubHL4ihpcX5bT^RGl2jIP@#z`bXp<16DB<EBG7c3J
zwnDQLxC<~%T!vn3_Zpk$8|Q;a*jS=}Yy`4U5XmbL#)kzKm{_2AL1Fe)7j&=(v1U2l
zkO1Ay{CtyBTi4hGhHV`KbK3S5!NM%CX?Xji1Oc+KL7$a;Hxu02h0q||BIoX@+itSL
zOC8GOEIl4UqtvkVq-HR2+4D4^U<`&SQVvz2@l;5k$EZ>s29YV&U53xB$#6{7-s|ym
zK8lg7^7}#eIpd_?&DXzsR_f_F#(_H{(Y^+~lDzGlO-Hz5DWwl3&rZh+uBm-w_xDlL
z<%8AAp!1Yc+Oj5S{PQKL5}pr+`lv1h6C+TukE#?_Y1v)K{VUf&9sk_1t#`I^p-$2n
zs%-fI{$NqB2%?W0dDAI)#bSjtUrBVlv^omFTb>IYCjX<lDW5*HZE&%Ch4$;=4aN;Q
ze;ovFQ;WfO>sY@UmRmXvHga|WMI=i^$Bl!a-9fs^=j%?A`ZLB``7?7IjK`Yl5)-=&
zSAFRY+Kb*)-l(b<t49XIF?cS{5@~}?8?AsHgM5-m2xP0*U&;Ccz!cxQW=;wad5$a~
zB3zPiNEv*;2|zX!CBi9^uk$9`IyBUb!OD~pcB)>F$Z33-W1jOD`p&k)_wWe&VOT^%
zp#DRFRzJy@{W~`H<iE1MU4VZWJk@YT$a4cu;~4YDVE;}3W^BY+%<!*;T3Sba9~Gy7
zWsvDrOAq_Ujfkzun@0<*W}a{5vxPHzI!MvTT}b^Sx7JXjUiuc!k>Ann&J`LdFcie3
z8_JJpiA53fS#I1_gk=Ph8nOUKPZe}}<>ePW+_{p@Uq9xOynok31!p!aMCm$_HV*i|
zaWQ=cWJ93lY}W#C3Eq~%cfYY4M=F^Rh!oRA$&n7nJ?vRS4Ug{gNK6apLI*>H?KE`^
zQIgd$op$V)7nljX+Qi&mv8fQ=xpT6-PIy}U>XR%9rw_NC3FlLCY3TAVws*@jd0OE5
z+avEU>2P1DY@PSG@;{>xhheJBCe%B5G3ZRLdJt6Q1#ZgJAnl8QFLW~Oz_j%3pP)!m
zPR4Trh388Z!pz7}nyOn$`@&yW%SF?d7-ujaAi^E7Ud#QW&T9>04*|L)DY&Z*X=8QL
z{K@#4&U)4RqIq-CdN92Lc?Slnt_q(jZ1s;=j4ai~>+xIvSj=lV7+azO+Fkv=rkR5|
zi$>y#!rX1I7pZ@qd$9ApAj%}fTo9rL<$skJ+Bw?^E@|%!-a4{%k3No;@ljn-*XvsL
zlBv(Ekn42@+-u#u5?nZuak<TDkKht6`X-=usIV!K#}v|nsCa4THV!_Uw@s0F8oUZ0
zQzz_^K+_w?8>Zv8)<&Lm%o4(F0B1jR0E-N`cf3d#SyAG+u9Hx8=@ZCkzvN{Qv>UKu
z3fdps581S;yD_BfEBh<-)sE?qs<iU>ylE(AFf(NpU;b+B?n%2nG<D<=w)!<5f!`Fi
zz;``AV|(U|kJ1bPMh>SD7pWc%wM@}kYMeYnf-q%NBinx_y3TKg?oCpF1{yEBt-{YA
zU|J>-v#i}Ez&d-CzO4I20T=fEEtzdP5jk#xMhh#P!Tl6c)9YkbEa;9adp}JQA{iG^
zMT88a$%Vtdt%M`Be4(Za2E4Ad3axX`yHwHr-Acs>Ii3p6Yfdr)Y9}VfKZnVMeJdN(
zglh7ZNtnM^r+$$=n44e|IX|Fws)Fz}v8#G}Mrqo(@Y7djIIkJD*J!K#!XJ-({Edca
zMPm0bRd@XkAaIGg`PERuvyj4f!8{k1ItZ72);$so8V$w9r4M_D80)E{H#=ErE2k@X
z+m1Ne%AZz1_BV7*a%o!&))~p*lcOZd@x}V*m(gxY2m-!P>9fPeYmn`@-<3M#u1jb#
zO2{xh%j@=gRS}QRCf5ja_c$2dDsLCMb>uPsy`}aRyn1ho$Z2k#`Uzh({G&m;5)Pe(
z3+^T3EP0Tu=x_C(&ey|+O^|9$r?>XQOBDuA)iTbFzmIhUR&-1IP1z#>zB}oA<`9Ih
z*Dx%l{a&T%I;(k7xws^Lb_7WJ$p_&qy5bTg-Ewr6UK*Rl3__Ca<%B#}6g#Z3$NM6<
zxavD~xwkgglH)LOa;G`2Qf)n|+`r{W{CjjsSStFg@31HaX}2)>klybcZtm-_*BSG>
zmJlQx)0z*yE2^HlM>f>Q&bK^_;;BQGpxUR)+kfx7jdWd;OkUjqZycNU`s}AvgjRpF
z;D~c08J+>Tm>V~9&k23F`I8esVDAM`fZq?H;j4k59UUZoXI7WVJ=A(qsQo^nYW!pz
z>}uBuno%8cYFZ$@siyi$8^zte>C}5%UX-bUc>h@_2kd^fhw|nhl&LJtGQf&!fX7^j
zrN-Vd@c*Viq4*A_r?fnLsLbMYiht???($QTJzBMS(=Q-L3>mjd+P2-;Xgdlwa<F|W
z%WS|Dy6d2j+Q%y|-9SR1ta@>e#aMEvA6GjxWs;$Gw~^jIEhotS34GIm^@X~Gc2Ync
z)4^<Q6$_LZt<%%cxA1-S+?2U3L2G)Q*ULUNLC-KBMc&4`pO>NU@`8q_IT7#J1*k-k
z1t0DzguYrvj<0xiD81t_YKhHwC52B+z)No>$3(%ilL6V|mz?6?p@xX;z=;{ySgeQ{
zLm#@zqoXsj>M?@vkALxB;8r(R4-@vVfj%`iH#Pk@PD?Y|UT$&^lY?kqO%|M1zLLcr
zHg?Rghz+NXcs2IiyjVm;Ucpo_0EoM-A*S}E6A*GZvB&s;Ma*~~&j7uBo^G)nKA6==
z4rEl<{x+Q<#*T3D@j9bUH*7d}+}Ey5pnO+n=f8RD)yAf+WixNtMZw6k1^9NUPx_r$
zQQI=?3cEIxUD`92s>d=Z*3bLuaf(5K)DwCgLzn1Zpz~Tm5L|bOWjgAYRWpsbgvtKA
zvByN3e5(l-#W!XepKpFtc0>u5D#@&tOj!q4fxrCjqWIV=gLHe24V*5p11+``$3D#D
zsBpZK68U1!1#IuRbZWo(VdT9Ib~sF3rT0=UwOmmUGW1g#7%)z)@GV=~ke9IL%cwkR
z+W1gO-5a#S!2*bT;(J|cJiAe_L;p~}NX^K8*@7vr<*~)fyC;uA=gY*7NR=H+-p7c4
z)ER3yyRrV(?t8V@zZ8?>ajt(*LN)w;ErPOV?>X(@al=-V?oNF#TQOzr=i;E-F|sVz
z@Yk5NKAIH34<(tOww2;K$_>gvB?PaN&q~tx&C^1PvV4Wj#~ufn$IOpQ9<I*q&)DOe
zm<%|dtcjoU^OwkcGr&gV$s;JSu27hjDZaBk>bdQlq4TTA6z4-4g${y`=+qDY^y1IQ
z@KYyJZC3d?xsc~1wvY3Wi6Ec2ZkfAh>hh~g`<~`f<TnmBX8X6#yF2~&{2vT44S5HB
z;|SBTz^&pZqx;e5fSlhxi{OeXc84k9UCfh`=^&;q_ludL&6HB=7S4N|7OE^?`cJ>R
z;_tD)lB}8=;`Rugow94alFrbo>fbYTb`}N?Si&P-s?Tv2w0XYnI(VHv3M>@7&_pD-
zR~413t8k&-^bB0}i@GuO&V8L$b70{m(czTj@3Er}1eldlR8wTwJ~Y2vP;7d8Sd$!S
zc&LG2!z!3)b;xH$^QCn*mpLewTomh<bu^8A#f;=nl!reg-WhcKB>W8}i^<`6qMJIb
z(xlBvo7ALTQ1$xs%%EU@wymP?qg^jarB?7*sTtl#iDSx4hM53+<tSPjZ+pBEZ(dfW
zrt7{mMb{2e&&0~B-u;LA(2|D|g$82n@SMAP&tFyCw7l%p-%W*H5Pdg1ifSqFbVIpR
zPu0<2e?FRqUsQ%A**#{u)v-#WI@MC#<B*&oua;vndp*2QW(h<k!4_Y~RLT_asi1Jw
z!7%g@ukqJ6g*i$Ig}er7`mKba9~I4%#WsJqax@!qGD+#)Eji`UuV)NDQ5_J^l63qU
zXJq)b=iF{~gr)kSGxoZ1#z%r|uX9pC``N>j&kfE@W>5BB|5^(J!;KyKJe-{kk1>VO
zqCYdN{psZmA6jPjr{OW4m%Rh!>vv1~{=_Td7T65sYH7Byeevu5FDQtA?@Lsith-IF
z3Vdp#(QJ(OquiFnF~KXc&HZAaI1nE?^3qVxVamPnmSm4T1*yfHE3kU5IyX7K!frlf
z8v1gq4k;G1RBLbD>V5geL4=+<))Qac;wF6eee@^sw5}2UeyXotq1bU0lLw<?<UXD%
zv$-KtJ;rrVol2Ps%Pd|_=db{p0}A%6#q6PzrjiZCBR&g`V9aRDz?@qSsT!qi{Lv}v
zb4vEu!;=s^hghw0NpHa@JO@1naEVMmIbo`Z>^ba>ul`N`JD}U}i}UV)a*r~B)kW>^
z?<ER@F@}P?yBY&Aenw#mxUAr%bslJ?I~hE2nJ-{L^ZD&6rFCN3lm<>xtspaMv|-qP
z?z+if(HKpRP?0R`U3_z$d^mOXbc<8?j6iX%>X2;tU4qc1It31&+b{!)I2DQKz;4T#
z8k>_|-g8cwyn66JFQeRP$oyl&U+lyhrj|IGA8Ie!{0ms4$&Hi5-dT@Uhjc&MZPFf(
z5n6w{oxk{tQgPiSLCh=5PET>NYCf5?joy#*x9)<^J%+dz*A~F*nM;S5^d=v3ChA^&
z{Ccs@nI>birJm1ej(ZrJh*uCpbMR6f0>kfbgboAjD`yCro;{QQZW@^nQFE*@wdz#g
zt5vevjKP_lBVRfsdY`AS0!iHpQ|Is<HrbW`JPF%9OP;d3x6~;Wo)eu;wZ`cpDFF+V
zI26y}q@~kQH3-`p*%ppIt$lm^3@@8XQicpWyc)5yJ7-*9T3UPMeHuu%_1*<Z-2+#p
z`Lloe$0z@GW;Fb69SpP-4Z_ADr4owm5Trn}qQ}Rpv}nwcH`iY0M{R2gdnpTolE!e%
z*oPU#fdLnXrd}hsWBwc&3~1vlD}-ExdhzfgVJ+ySLe)k!@U(ofKGZB~qbm^>6@C)X
zEBeZfV_KI}w91{LTk9F7W3(5!y+bN9uIQJke%#g}$+ZxXUX6_Gq1|1Tm`q<bNzsR2
zIKAC0lebaJb82Yzvx&cKwoAJ4coQ%r=x)q;AmJV@kkMaW5M<eUV%oT_!iD9rj>BR8
zRX*zLJo_(5Z5Z8o5=MLDU+y>Rj~!=G4|+Z(dOfaDRoY_IU__9GuDv${O=2B$JEIR^
z78>*9^K_B(kq?%6Q6~-W;Cae7s0gc70lj1*z_KAM=48f1AY#dQNqa9L_PkWyI`5ET
zoF6POxs?400st7+8v>2E?kR%u#e|w$W|YYQn9}jJKT=d<k=j2z-+S>fHyaI;<_jk%
zwI9#?HdL@s(w@Kpf7aGXlww=>q~M;nFS-)S-v^#P`1FQ6Mek`9X!Q4eYkVoy(5sV^
zhNkyIJ~RF9BtEV~)EjiJT)hlD*{gSb>(D<rn169MNDg#a>=Z4vFSniZ6HOcjn4vHd
z0$-GT)|QdI*Mew*%aJ^sfttZj__d;xr}F+#E{Xz=&}8JTyAS|0RdV|cfuVR}`tVSs
z>OFhgfQh~vY7(-yo9sN2$rdQnWT!!87Wux3La-FaCSX1X^@tI`JUh8yiNDf}xajS!
zWj`gV7E6ARPYeL)M`YgSP+hYFYDnlEWoEg#%~!*!9lW>f>RemdoCCyyk~Q~<_=4LZ
zB#P#ThW{&;{>gH~X&>yR6LwdY^yFHclAQhy=na$dxL@m~u%|fVG=3|Nl2SlNXo@p&
zE;FI{+NE)7;?|3W`JCR0#<B>Tb@?=zstuJ8KxuEV4BVmV$z5cJO<`^n>o+u&7=~NQ
zDS8;4u=y<gVxZs`wQN%clPYx-Ke;n&Wc6j%Yyl#PhQp*J>U{lG3JF`SjQk0PKRKdR
zL*RfAbDgAHtvPUHor`WL+jfSYx5fJ#bIZ50rIrgV(wX$~PyZVp{J$lc?lI7sdF~ze
zd|Jay4E+pKXi##FJ%JF1zcVX_DUWtryL80mP6@j)m<)-!g>KvSrsVd^dz{5Q7lR&j
zT7Cy?Yk*6vIR*Fm`(7vu(nS*FMpeA&BuQ;dES+v~n^y_}`{quypcdl?%{TuXuxa^P
zv|sa=Zg<9&eER-LK=!a?yYSn^m~&)_lTk5gY?D#(HW%iy4T9s&`;3Fia;DTTlWn$X
zAEo>rGiD#;V3rl6=Rv_&AC8luIog&s%-Zztj@dt=UI(H417m`*w=ImEzD$NFhNqt_
zoMDUcr+G+}-3TA|do^@^QQwZ7A!gUJ{tUAX9m8UW>KpZ0di?+Z?%||F;Cff!cR@9L
z&g>YQDRlWwE&rdLW?fq53=*Kt2-5Tmi@j>wxc-r9V{iD!Y=*+r$(Nuv*4saePSe<{
zTllGdd-)S9VAo?>%E+sw+xk5PNY%fi4H>2vV1F34Q0~gUbna@mSm9-9V3Mr+;o#pL
zqJKp20{RE_p&k6;-wL=_-Uf1K6b$H|LLz(3r7u{E$t12KZF_^l4RL=oa2b`Sp5$K;
z%zn?}1%(<&@sQ5{REYTrjk%;4v;r)Y2p09Co5!K$rEoD>W6`z>`g5Dv5KWr*zvZMR
z?1QOnR0B%sB>iv~@;57?Q+A`va-0ebW~s>~>(J130qL~Rh4rl#X7SG->h&{}_qvp@
zGc={df&9hVd(W1;{x1&we}?u4MkN(Og95@5&LEQ!%$Co?)zPbjl`ilDhc0@byu#37
zizoM)4JRJk26k&jLXLDiY8Fl{*}w2@DW8%F;fn<UCm)OQ5|p}pc~0{sT3`{~Tuu7?
z=|Eq_dSGSB_|MVU(W+itpT3&dzLHKM(QS7d^|J^GzgA3kEeo9YitCf1>zCaDTfsYJ
zd<1ot^71E}H|+BvIUMNykvAFP5&sJ${fiI#uiMYTfGIT})*c8Bbd_CW=`}E8Xwwj^
zq4(9}CP-n0MAG@&ZpDxyF})pn!=PjnsUi;KMIP_Ty(ZjDb}dxEbkeCxve7mK7y7B9
zi4uZUmgn=KiAgw|-Z$^FUfXY!B&gZXRLO%*=+K1S_@#Yu;j|a0M(go-yoQE9$*gB;
zVjdA3{#zgW5AzsiL}Lv}`+(m@&=wyO^Pb@Yzgu1?GV!^AbHVQJ#-sPR0J~m4z9N|2
z1YJq58bvP@SSuLC?Q<05OdL9+#nVC1StD|biMx=EW?K9@$D9E+)h8|Vr7J@)#P6$B
z=52mCj6NiQZ6ihUw3fS9M;zK+!#6h1VK*4MR;;TO_C7M4otgKgI18>p&)^zn0P_DN
zB!4o5<ag+N%VzVYLs5mY96r{#(Hhju=D4#(vOMMsVMr|+(>_!ng9m=-6FSFqoiBj1
zc;66JmhhHdsrg>IT4C}lJ&<MYNKMG@O$#;2*h7~QdV0S2z%|s@E>g`tEr8J~6F#hl
zI?<_*JV>Z6hDc|#PP+{q*sCmLPtr7HuW)hjg6)mGJ_M7K5{OR&h*OA!bVUCzQ2rMi
z7^X%0ar&&EW$Z0pym_-6tiOvlgQ@FlO$;tQSu5<_HU+~)QcVO+TM|bx?9g8XOYkIj
zz5tXu2imh9&lyIK2snAf{JlbvYWhhkGfP(nS_Ep|<n>fPso3@czBw+u0OV$t5$P~V
zlsEqM(7i<pwjIlo)u)ml1l#&d`=PZfW8Q?`Un2BxY*dRFjddJroaGC7>n#+R7BXys
zjf$p3t*F3v^H!gr`D@5QkM)pGRkT;2c3n@3aR!IE^LLokOSKKMkw6GvJQ_o&4i;`@
zoH-gROI_&U<0sy@4oveEY8?a2=T${=F`RyZ0{ZNxD&gEFC9gO5jdP)Tohrm1@V5V>
z<3jycP?FxaYym>)Na98nL+8|pbR=W4@S7t|QBO_WQS0+>^IMF8bjEVT)v3JFfL29=
zi>Fe<N_kV1hc&^;UN<<u=KGB?1o!kEUM8>d^_ye}1TJL%?RnL~gqOm`Keu@5!gOF-
zSl-U%lO%LDZ>0~dsMZ<XpPY}-5t6?!e5Dt`f-*TfwGjbM)Dv|!@Qlh}6(?s(;x`t4
zVW%mwIO`P{WPi%5|76Dhg%flo@mYwF<Z60`TN>*?*Pak-xt>+h$fscGp2FNpL2eg8
z3D&soni2abw1=q!25uKy>glF92NY9t`fj0zBml@f52;9o6TG6Q_ix-MwSNmf3p-Mm
z5Q$aZ)NrHjT$w=)XFYXek#v2VswkH}hc-IM>U}FrXv+?u_j#x)%jI`7X;negSS%??
z=NS=EPHq`}%*259gX{k!h5usfsPAIA(MSftU144RT!ILG7^$@~2Q<{xGLmNuGtiOk
zdmJ@uLQ2qx%#)&grz_2q%>Z}SN2Lj~PsrJWeGjlekpdwA^mb~CXFAU?x>8{!-Nu4B
zRQ;|<TP6mSmf}cb^WVg5DGCCcpV<%D*8sg?;o$rrFmcRx-erp+rK;%5P?-8`M}kXs
z_j4M*1)dPx90-kxM|c73yShWw#s*%eq%xPZZs+_1=I=yOF`ACp%)9uvBb5(t@#_|a
z&Ed3YL^NNr+^I3WuNY16TT9*>N>I;lkj0f=6$tF=G4oX1_YYLO??&+M>@)BGXRBsJ
zyF8fd&umc9Z&1(=H93ueN)!+^QmOJ877A;f=E9^Do*@VI;XHWA!3?vo7?gm=W{kjv
z<_fXcRdA?ElG>>rncUMT-f0WUP%kuIX2LYuMF&bL3yy=ziLgMFXDW>0Rx@M{@S}vd
zFFpfRObrHqxG=Kw<)(P3^>@4Xh7v95=@3qb6TM0RG7zuy8w~2&+uoNj^dj)BGKPo>
zz${sYKA2J=w!4bVtJwW1qxRR!`Fu$^QhQFpvk(Bh=yW296#*=@knQOIJChuWkxGO0
z<6FH&DFZ-AdfU4O!@&hX)4`gfp#wUs7TKg2)btJ$Md{|aM&1LYtLWXv&b$10iX)ZL
zA{S?L5}b7rl)#3M&i@vk{-d%*%Z;AQh}4^avm3H!u!VSPJ6E4>Mqqz=qCqMnNdG>P
z#&ws%HMTWEZEVW@f=R!dT%zqkQrn@;JJ$dZB?OV%gEwsSpFsV8eK+vz;b}6M48c!^
zd<yw-&f+qep~Z&Zg2@?yPa2Lb&up!nN!nP<VIoKiERoXy^z_K9ih(>aY3zk9hFhRY
z+(xP4dVM3qc$|Mkt_!(?zl+$>Qj(Y*BJ?N8jNM&A^iaAa+6Y`OO$>AAyc$?eulkT{
z@cWCf=vu;3y63#Q{Vj*Yz;Arwc9c}DhkE7iuu;q*E!}LQo;Mh{_?(57kLVNi0=RxX
zXqzY!ELoSefQ(_d8^+)&nWu=g0kz5=s3Q0Nqd^O!c`=;SuLHX&3gGM+9ENs7?WF6U
zQMZ_mIlSV53t8t235{eu^a=;LtEy;1{7~OXYkr3}D7nuY+F*w?GA!&cLw(;;0~XZ9
zxUzTtZs|Alu@Oj)WH7dxKnSw87rZ^(UPT6*c0eSx%K6*8er!%qW0p)3nV_T|U5lpR
zH~X_cnG~!aP}&zxpq1uzYwJ6tNE?o~z;3cjqUl^QOad_YJ1_kaedvo+8$3^VxOWh2
z$K41Ue<|q^+56q4%@!E{gN12mDCpI!H0j5+NSXM>pE^9VgQQ@3|JrD;!v%3rnl<)%
zIt}pGBM)0R&&XlrJj|F6E%iU9i71Q8rp63~{IN($GBTvni0?*GKDXa&758aVjsfig
zda;@+ZdHHDq~Sg`eadJUrWIE$gYXxi?A3){h!nnczskK_-iZu|!X9~+vZx@&O+h!`
z;{Klxiof`Og(CR-c43%0Jb4IA+Lw|E(-GD=Ewc--^Y0eM1ol`FMfOtbO93P>r12k{
zj_6nUGVM_Zavs>wfga<F!tn#zp!`-67=BTe>rz96?WRFUxBq-m)Iu%Lhq{4WjtEUS
z+udh#l2;>*-vHxH1GF}}wDda6{x}%si-%qrgtGP&MGEA7?u((@Kc`YEY;S1gDFK9D
zZ=vkL^?wtQ)-X3^O+l~j7up$+gITVp<<By$1?f1xkfLd$y-ioi?^jst*Y4bcFt*(4
z{!<IU3l}bPNbjIwzenWi+>2NC_a1=dxxcd9!FXYY^<sZ#RUc}OI2=4<ylyD+689IH
zw4g^kfP<7b;;S5Gv7AorN3PNRptU5NEe2xz&(r<EG6yyCROYR|fgfIgesHV!`u=sv
z?_Yx-D$ZJ>6kh~VULcixg|)A+LzIV6;0<LSwl8=nIW@eVP}@{)JLh}3p|Bbz^pLV^
zH*HRSmtisTwnQ#8rb5k!L9)xR3FylkVnhj$K;*U24vR%rS=_(&7@dT-2AkmhzPw(n
zIG+8Fz(Ti=fQ5tNVG7nNX1^k!&DlzLjo!8(q?i~fB6dOGu&&q(uF7h=U~OkzNg@S8
zftBiW_NDsHrMA8c8!Egg?CnZHu*ddTjgh=Coi6*q&nJ~~%qU&X3LPE?T^aFFdm6zi
zbDVSPUD>N#9bdPSq|Dn_B!5(5dc%o+^h$3Kp|-vvgZ5|PYbq)}ivcrW`qx@2g9Ora
z{mffVhai$FWC_RB$@70i0#gw=)0GwxLB}%|D&W3mI<H@si+3_e|9|YKqJ-{^E}wLZ
z*$~jK_yjT%fmtZm1GbBDt2xPliU~lXlPuD2XTDD3`9T?a^2%!?3%Z5wGw3nCCi338
zY3^4OWZ0HS@jNhVlMxEvwmI#8D78lpMAPLJ7^l9f3D?<%$qj?h)&CiUNrE3(oa`SQ
z*<MnXZCiW{%Gr<pN1&1V91)3n_W3b3*y&H6LiY=1hkAHS{&?lc86@bAsGbd>W$s+u
zSt3=X*{J(DG;~H<q$^7#u3`Qu^`1sY#hm^qzZH(hJ`ppG3|Dosz@A|(j};EniyEOt
zEfml)LMcjPA=m%gxxeAXjHMVMy9(O?S5z`QS;!Cpzl$`#{)an0iBZT_PNJNxvGlQ@
zw>a`-9ts7l!u!pk5B|p}JD>{L6&C0%^cg4>6Mbdrj(1%WZ0tI42G`xnZYynJ{O#U%
zd_@*|+b0hd*dQZ=0N3!*+eEM>2c*iHGgn}jB)u-wH1X-!&q{*Flk^v?6p_YM1>>Df
z)5cW!Nv*yzvv%jOPM~1T2!RPgM(CDH-FNn%H5`s7=qyD3!W1p!9quXrwV&{Af;D;u
zunGQs>rIFZwCG>@87dF_OX3Nj{I>3>r;HW}>mCt+1enqzX!|YLMCnA{8|QPX<%guo
z4NP0&cu=D!8SPqOTEuni;ve?7DahsE(vz=-cQ?s}n=H$0eKGk*@bH(Dl@bV$;P)i(
zzu5YRL5UFjTqV129kkt4{?|N!?fFC4KsyeS;_7M0*9h<yb=A#k5HY<8odbb>T-W3)
zSZ<yi^G9@ISBD1^`VJNEw0XR-K$}E>i!IG`d6P1jv5YY7|Bon1TNdw;wgc>b-aA~S
z!!&PoUY_Qv&iuwDKJ>zF!XCH(0xR)p9eQ97(_PBVbg)24l5u)Mw0k(6v>vDTXp#`<
z<G(M>{`0^{g<&S9fDISn)*ikv{RZ7JW(IoSf{q87YLpUw1kLz0`U#>8<cvIBzINRi
zp+>&8Y9I>p?i?7a2#1S^ssd0SqVoqTb@=Cj_~-BbpSBYvS`c0mJ1SH1<$8zUXK#bO
zQxn)Sp-`9@wB^u9CMEEHmZJh;U;<4PW6SQ!zkO57q8E~Xy6ejF<UE{PZ2JV#xAWZ(
zQ?Q`#I-Y=l{ht>9=fve-J{8cufxT(uJB<nAN})uik(jh_?I(gcU$QIz%w^;!qt^++
zG>B`ae^0@X@$CWhp(`QWG{Uqv(uAN5jpZ_+w8}qCNA*aFIhOEeZ?8f*4Cel~AT?VS
z{V9Lox`^gVl`tZ~;+=)<31k7z?(^A)1o`8>*b?%#N=cJ+SC$9AlI=^f6w0*{EIcEB
z+^78o=in!=`to$lY<9nPTjhlQ!}PLeQz9FA>KptXe}7rsKQ7zL9-hY$jnra#3=iuz
z)POVlOi6}~ldmKOwDskruj}viyI@yp!XC+l>V)d)N683nVA3!vN)gmuBsCTbz_QgN
z2CO^3?dtN@YSY?}P~LRmotI2JUkFL{DGfVq4gM%q7^zY1L1aH$)jIQIX@u?F<gkuB
z^M~Ikzw?Za2aFKEbKNJW;x~&OO_c=Yc<KC)NBOfMbnyA3ip-cM1SQZ{69sUF+X0zi
z?F=SSbcq(*A#<y8%g9#P+c@W462Qv4Q%%X2wKI~$VjN+oQ@l;zA~U-H<Te45L>UP=
za>8MW*jDDEwzKqAmK+A7yz(}3@T#o&U6<aS{H+Afv%y=!4IiBK&u=Ku`5N4pT1z}y
zx7D7cJQNagM?ZV@`5A|A9W3%x&-LHkUw=zNf0XsCWB0t{B0=yg_{MeAKu!3iBIJ^#
z%^i(59lSN@Lu}LLC?BKo#MSTa4nqVxDQEc$%WD_2|CH4;nV=6~UzM!+PPm9EWcy;C
zP;69h|672JD&tvh0aT#C^><`KNLDUVo^|!GBAL^)h%Q;S#THT<HMNPU{y0U08~lZ5
zrt~g*!zqFRnFB_br&yf^hQ7TluBg*U@P;$s&5N!-k~dNy8bZ$iPVR&LukP!Aa-r-J
zOkzo`GWr{J;kUv+d;7poR-vjW)luiNNP<2Jf(bS`J4OuFw-M0}zg{M!gbe2Nla=E3
z*;+Z1Tg^^byDoC1ca_ib6+&=`n|z@d)w@1rDUlDt;l0%X=lw&RH2!k0I)L^OU$V+k
z(A6Kzh89IBR5`ljbgwSq2Rvqql$!bR&Jh*k+qsh3!WP~4=j)b^Et-E<s)zNpKt3&7
z#@HlWsTgWKOjvUN)%#V@s1Z#(=~u7v>vX+ZyBQZQhe->jgQkr#ksZVTm)>wFp+5z%
zrQjhk)f->ljQehMm%CUn-hqXM2_K>~hIt>L9@V)xtj#(-j~ae8Rf)hAd)%AimP2*F
zo*?6WGvz%y!0Z8&Q4WvEoK-OYr<*ysmjBGX)$7N*6Y<id<>t)TcyHcI%)tK0eYjbC
zrzuKsVfjPr0o{^C^;r_8-us}TI#fSq0rk9LM`nn(M`WBz3O|gVC8E1Y_?|vcKfeG+
z$Du~?AZ63c7--xd9@})ezvLeRAO78N&AS8&F=Feo47y!&o&G-T!F1cQHHLA7R1+_i
zO*c%iFRP8Fae+-V7Uo7@vjl1;vB5v_)oYa-cT>K!N%i5I_~JVHRe)%8@+b>@`p#p$
zV6N}=Nptk77yP&DcTe=$Ra5i3aS^hmc6G72G4X3cvAyZ)61{U$FN{UhWKgO0(V}35
z350M?in_enxcR^De)ORC<-Xq5&@)LQ`_k&NnePVm)LEo{gOYbNW~Fnw{6%@Fom&(=
zD22F=CH>R?cf`wP^T-GT5YD#e5X&ftKLPY5i5e+A$$MOSU1^BOy%QRmjs@=ld3CVU
z#{7gr|2DcAB_35(1W7>S%QiK(Z+U=2;R{D#`5(C!?7tBd?2h4NdDv;8qZ7Ez7=$Of
zsn~q@gUWGgw4P%wZ1&sRsShnj#$w00#Y44i4RRJ@j=!9#>?iYWonJ8Ri+QZfmbI;4
zNg0>gv?F=x7PlvpcJrwdoGx#AR({{@NwY(I>lA!(?B>d<e=f&sQG56BUiJ9^7N}Y=
z7TC+LqXJ(mp|8a+8#q^@6v%%rI?a4<*yGzn9tUdD>j_v6S==3zw-42LD3L>aCX%jJ
z4UPpQb$SQ2X`0aKIl$162zI1TS<x@hc;0NzRNWP9ihD`&4iN7=9u%LTF1B=w4IlDu
zTNuB^z3t;_JPW1|{7^hISAhWlkF5Y;L9I84{@D!_#{osDAA`LqIu~3rxYk*%{?uii
z{Rzo^7-sElp(wV%5#_P*x*n4(r7kq5aiHh8B>-2##n!>HF?#U$uvE;g4&%7>*N5gC
z%I3ZQkFEENhP!RszSD$686t>YLqrRrGek{Dh)DDj3?fF4K3Wh&FCltFi|D-%(fdR%
zqYa5shEYeE_Re{~_jz6K`>bazUwyF-|Kr%VecOK9r4VYy$g;j5UTG+^$yln&({;w5
z8oN0Hb6)RNKB~1^($xCYQC0hXq>r6njCi){Sr$lKmhoF?P5M`cuCAwjFiI;*y3sMF
zNjQOQM~%Knojy)yP4#{IyZO8}j2?!CqQ|Bbw?^grO~sI=Ix+E#0V+@Cubfdl+2pC!
z(&N<Ef#B+-XAl6+^OBitNOio_Xe4>z;ne@CPH+7*zrhU>7G<o0t@DC#)-AfnRh{<p
zr2-swB#VnmYh{OvSsRuhfJ!1qH<sj)$Q?i-8~wSQ+b%gu_&){Co1@p(#nLNzY(#Ex
z&f(7DpDv=?ov)U@$^BZA;}^;fnb*f$I*Gx*h2p`aqN2Kj1Z)$j0AXyu6FYm<Tz(*x
z_+cOdH8({Jj14@VVPe=1#<Kg=p`rL;Q6T!{_L&78O;yLbs#%TxhKeC9YM=4c%c{Yy
zERh=j?i>QBZCZtlwSw!y0)gkYytdx&x%yW9%F=Uuhl5drwz~D{mRpR$05IdQHmU>t
zMA~QEybUu<X*-Ju1SmV(2C=e7K^0JEs{>|8=hnr)Mynv9swJMF*##7ooQ*}4%EFOE
z9A3@!U*|4+Q`WdweY~Ia6v*42n+JJZ&BJ91;tW$}1|bPZKI~D<uZg+ZBL$}<J+Pnx
zR{&&A3DZcl3}|_gB`sB#Wu-+`*JOou3_$xNE_)8V5Wk*F$x&8sKGvVW%6iL|86CW4
zJ?qghvo}ao82UuOr6^r&UDve7as;4VPj_YNlRD$8neu`k9-nFM*233k*#eh_X3si&
zP)Kevrl&9<Q6gY%1rDC<jh+Sn-E72KV&Q6M%SrA7L58<F1rly!FEG1edlwG5v7U)=
zP=<_iW9?zk4gu2i1KEyIICyF1lyi!LZBJD=aP@Rj2V2z@4QapF3kjnE>}J7#=PNH%
z@qU80w|MU1S6mlr5Z`B<lv)R1th=&jh)$|Fw2=gkoEpVheKFA$&>2S4&@kuXM9&{<
zwsqV<xXHRu*@m|DQr$f8Sq*d+i%>cWu=~4NHlMG><}6e>KOclcv>o_dT4yO`Df0eD
zVfv;@7ZR+##)J@%`V_3*o3)cbdu+qqr?1(gYDQw)hQfNAe4m@rTnyxaqpIXC-i|8T
zE<OeZ_4N&lIcpjx-p=Y)5uuT-XFl<`*XsWN>Z0e}|LCGHeul{Zi!4e4tk27XSUq%H
zv!v#tOZ<iy=HLZ-UQHrR`*$U81$0RMj#tE}mzk8MS@<oBV7&A6D&R3ytR`8>!FfUP
z?3gOsikY2?z00h9X%{Bq+=Rfq<nk(o)jF$sUE{9nyR)0GwmTA~&Q%k9)}65tMhP2`
zbZ4LHlH6da%g7r-A}Nh8xNbG?5pw`HNj#g5IHezrJXS{vUfV2q;L4tz0=}G5B%LNK
z8AJA~Pp%&Bw((Wp7x#=oiwB5T6;nWV3tjVbGaeo0vt^PHF|vOUAaGo1-NUdE6t9Gs
z_I3FpWYlPzpxifj1-(o>j&i+hRWIn~OyyaV+QDOXy=RJ$3ud9;{LVw$$~QK5H~GR^
zPQQ8zq@1jeRK=L&1C$OSTrW)LrQv(`tjc__f%eExp5LZJ3Jd4RSaZ$@p;UgDBAJ3!
zdICPLneAi5bJZ2)xp35e7TQ<E#a4$A8<wEN3OjAh+8=G#ih}JDFWWd51Fl2s;rl_o
zT;{cZlLV~lHABG`1!Ja%OAiEJEjc}xyDBj{R2+1=cl8k8<BUq4+_WQap^k@0)2<YN
zb~%ENm?dfq#%1Snw=mkmGu2jI5pYz}x}}fEXhi<zbR~O~U{rx+6%=F@L~!Jr+;2Yh
zCk;1v@SvWux}-}RCvICSX)x?D6pLXk2+DDDCzq34B3RYgizpyt>3J`(+Gj{q`BZ!p
z>4PYmOa52u=bI`Qha4YAz8YQSi+cfwEhVU-0ggwag9oHXk;g6c_DEHW9Ml`<a@DiL
z+aItGMFt)6{Cd%}%xUrRC^UBSYcv~>D6>pZNutuFcmzov8b#lIy8W8#{5+@0VlF2J
zpVJ5RO*m}v-^J^#W3ypdI)@aGoo7c$g(o%!{CcK?@1AnKH7lQ#*tuZW%E(V3r><{W
z^{t3<PDsydn&1s?D9Q7k&kfuWcUmfZ_Q2C4R%veURvT`;&iP>Ni8n5~B=QbTUnk@J
z3TBequ@NIrhISH7d&y%LCp8xzu;%k;Uc4Y?8AdWzjg2-qHzg@ut|@tA$L9K|&ZQ%O
z80D=;SyE1E%WkLlXZL~=dOJO-Ss6uOY8SVH#7=gxxfXugEto!syxz<qNPnXLDa&0!
zef>6Xi!#$3MGnbf)z=k<i3jzrT)D_dSAQAe*~8t7BT9s;diuK_K-A848u{+rU`#OL
z`?!X*0xEj7isHsG+!gcLxALVU85|r_@g2H+lhv%FyK_z-q5SWwI#ffA3vWv;Be?R)
zS>q`09GR$RBdiU9F0I8}4`K+WgdTtZx2Ye2=<oCk+lc%3vsF)R{ZX{gvidF+JFyXy
z@?A{9^qv=PLT_WrD)rpD<$sr*T}QDhVV|g-PiLLWHOE*EA9Lf*yQu_E@n>XB#jko!
zYf3C{hl6;rCn*5lXb%l8bG`~gSNgj6;ul$IL#@0*V3i+N<(x3(=MmUYl|N5v6@6Ft
zFg<6hnnzEYDm-<t)J;qDx57x*)=XwZd8q-xGj~aBx^nhsgA&VN2kC`7x^nBrY~eF{
z-m8IQ)MObJORp3T6IM6mF$Ze03Fh)qA<3A&pkJHcM=I+o6r61(?MI{jFxoMl-1pBP
z`&-(D)(!n3kN89E6@F1`$Sok&e3BWVSbg>kf!X#u-qd(Ll&vP(j#_*=sDHV3I%iqq
zHEW?vTMYZ#uF>hm^@Oe(32FYzX+vD=xlPd~n}G|dw@#p~0Bt6*lUuvZ;S;phFL&K^
zWSEO-7Zvu~waiTxcR$hreJD&?wb;BMC(-*~6N}n4urwI>R+2PiUhD@IF%LlC!(3cV
z($?JBnkWEwpSy>S!u#T7FVAH=&w|JY<~Sve^ReitqN^TX9$mb98Jxvhd%&-kdDoqd
zelX9xO8mx-T7ohsXV)zLqGTh0>W+rgJDn^TSpGv0vpiq!@g@S7NG-D>3{tE#D-1f+
zZ9_4y_IPfN-a_NQNJ^>31S}s;xrDv&uo*Oe*j{xIFn*B^Csim2(E?9-5#ttDdx9?H
zGD%l_lJ{gy<fk(xqKFjyZO;oE?7~`tjZXh&>QIUr<3_dYEI^`}JHV_FY&WJh%Uz@u
zC7?WiD95I>V`O$eF?2iP`ljy-LA9&mdiJ1BXoqu_oAp*2sX0sDk`00PIM*NOoAV#f
z{&*vKq#L_d9gMdcwg2>ipY>!Mn;X?DLqZ#Fi^A=iI&79;%Gl}gj<wHE6U8H6SLyRY
z`Kh~+ZOyAD4h)vz+-9k(&)Q)fz3Nwk`taojP0+D(Pycbp6Nn4faT3XlF9GRS9$D(h
z*GMcqzBck~WFlxpS9+@_NL=!(e|TQdN&br*`TNjK)0E}3`cJS_(IC|;!E`H}&Wm?x
zyPdm{M_AWR(RI-P<xCXkN*U-$3L;jo)}`e^H+s;gN29656G`Ub7fXGM>BX!`RY=IJ
zsp#bMuaAI)ia%#`oybp2L5y|=rXvmxDKBsSB^|HNHx%>!!mif{BhI!-&zCzxUT(X@
zU)aNL{^P{$>9br`Lariau;b8$?!-LyebcXxlpS0Dk#R#cRIUUiZ=kz_H`lEY23{N*
z-_{CWg(hmeGYPLwtcfy_;~in5Yta!>xUd#UzU1PE_I}ui)afrrB#IpOt|yW>vHz?J
zhyKr1;Q>G`L@XAW<LALw2c*&qK!#dQn@7m14t6a)oQ@8EuCuGCI<0heve9^48KBv{
zHxaoXjRDQ7-puh@beDbz3g%9fP5emfqIIL2+-AF1MSGi44lw?G#ZeT&=mUk2UX0Kr
z<F3t}UDue55LTCZ$7Zq%GTxX5znC|uc(clp=E2z~s_FG&BDniYlL5U?0(#-^xsL~B
zIe_3F?9FHK5`so%B`!*E+miUC*Iiecr%6n%$Yo{;*<Y`^FAlCeu7!R8f?AU0<Vdbi
zOr8NjEc2t%LN`cnry&{OvZvJrIVcH3jm-tjy9A(EceX9>Qha3S79jve>YtA65t(ug
z5|eNz$5k30d3U%u$&x>TLA5S$=lbZ5iQO;8{@)7c{>CKcf1bX*u!-G=I`h45q&CT%
zBfkdV1gr)-aEY$e#mOuyu4IY?%&JJgg1&uAgdXPGgZ4i+|49puV%SMjWyG^dSaD-(
z|3ceb#NXQ|;JkcqYDLlW1;znx+e!JN6QAMVCopY5;#7D%u5MJq2~HM`@ciBj@y@u<
zPUqqe*2te|drLNDHLd=%Wiv=gpQKf+{w&-_R3f~!kCSh)^ciD_<Sz7i2wACYS^wyJ
zRTD4~AOsp$HC=WaD@vNy+w;Tg(k#>^4t7`u%H8n=T{#YdF_PM;g5$c$2Vc-IIn+kP
zFeeVT^FI^`8_UJAy#qN~2A|%qF(;E3-Dh(<pc9YD5`R_kUJCA%E}CS%c}yOPGllIR
zwtwYRdJn?kTst>JYeu^m&Ag-jNSKTcmT?Ch)s$F$#-lj<@Z&rRnUrG7gtH${egvM4
z8A*GiTo*<Hv$+le&U0pd9BN0~KS_^?P7%->P32$n8rNcpG(EB+TbKRfzR}++8%&TF
ze&cX?zv9A8#mZ^&Ly=oe{-+9N3Tt4Bd7>#dZmb}D{C8d?2$wp2A;}FDq}CS!9US@5
z1P|I^TwA@>ACM;ve~x2exL|uko^K}A4m<wBz$z7;$DnQTH0a_2Ioj97z$(*dSTP&L
zl=qlu)coz4w+Ade7r?{`s8c!va#?ag{uUv-HEN^1J%5~Kr(OP*cm3B@9_qn!1sT<4
zmh5$9H7Y7nojfx7_s&}?baY4aYg61>iW>AC^N8M-{p=$xs#$R{g+9Q~EiHEg&RU0#
z*_y~$5Pi4s?_$t{$gL@Qx{IGunJFFDYy?<8WK+na9H*29MSpB4R^Y5llqNj<a!;c$
z{AM3|f8He!|K0H)0MtV=+d$Gh%J}m@Ft<A2(nA_<^UfzdJmJ-wb!INl1Y%BO>qLj2
zCyCtr^^E^v6I_)RM=MdmH{C1}PitAV_vw&QY9T5)DD>%{*#j@Q3#~-K?I^7=hPkvx
zv5J6;J_kwlo4wq8)|nj-+maWxGl)FG)!&17neCH9xwA6L#cFvBRE>`vNBnq}yoE#S
zSsC7gE1QCTWuMg3{v1T+MO@Z6;1w`dko|3vXB~K$MzRwkc&Y-pOox6l?)$qwra)ik
zTb+w|E=>ne4qr@*g7iL#=Uh5^zV|%*Y<OP0({2{RT#NhRhkaFbws)+j9B+bJQng@w
zX0_p^RxH(xjef;XfqqkX%HmvJf00VdACn12zL0k26!Qny*bTS^oW+DvDRDt(6Dugx
zeN765?_qW>UX7}*3ei?ahQ}UkhmL-HokPF#$%8fMp+khib>BGGw(ZPOWKwIv^!0JZ
z<@NEt?~Vo~{o5=NO&ukTsac_~a~KCNU!MT~Q6(gI;I2^VrBA`mY@Wy~syViHI0MaV
zCbn@6sD3kaOyKhJZ~r){IJ31R06B!#EXXbLiV4DwE-2FN*WbUEfvCEdy0$7rU=59@
z2?RF<9*C50tm|Rt26cG|s6J$MX?Gk<!*ds`;}a8}=g7<1ryG<Qy()28jt~XCi*GEH
zGM8n!oYF)1%-j^W%~<U;S6^4<VLl-BS-vTQNQk74P`G|*JMAyC_4ahPY*wj#5|yr<
z@+GscP35<~PV;*N+Npo|XR%mlVx?t8>!+HEH*Mek+z2bR76Tb}((SVirHLbaknByC
zOz6Awfv`Z^9P44Tkg)$a;9mZsh-wS>$!4c9rTcXWQ~ARgmMbPyciVYQXl5YSOR#Fl
z^aF+XJzD{N^M<YMI?W0QZ5~jZK?j@Kff-zUKt|k{{?R4K%eY2G@_77~)V-Q0LcDG*
za_!|)e&emWn^!>et>W>J;WWRizixeDwAy9-%qi;euZIhFoo>zBXbAH8?#+DjP`*{M
z<640%_u29cX`5cLjE$To%NRiJ#~<Zy%5-rb^DgnnFy#hFKBLEHv8qy~rg~mb&|jgV
zJ)Iza0V(mJY(CF=haX-UI`iaMGix%!4Y5T3(8m$)^dv`WotzC#^Va~bzziD{duXhV
z-BIc@@d61f26q_2JTTm4Pu+W;k3!0fd&~2gKbDB=KD!dGkt+O3V0BIdaM3f+{-?um
z?eQ6G;p*83v2AP;c!F|Vt`ErkxJ&x>LZ3r+puR9!a@-Ra7}?^9)Tb`>E=}}8f-(zj
zoo_HPP_?|oViIDWjr#_EhQCP-J{D<|b}<O%Rh$M$1g4BF4!mNfy-*Y`6HXTU1WNWy
zx~dvDsJA*$KF14KP)I|rA>2z}3S}R$g7{OIg}6t)q6ScBQBOT2J`A;LX3Dtc+tu7Z
z=B$k|`_qC4GR)knN}c|ui<}Xtd;R?k-&|uWQAN#UI9Odw6}qFidv<l#w`z+!@W{Ya
z2lKf1F|scrw5+miW?Y^)IhpoXYPH5zYr}XYe3h~)BE~M2<6T-ifGetLr};&D%(rsn
z^JnDy>Mz+XS3E_`DsxMNb4IKjouEX*?s+ERT<xmk3z5AX)df~<<v+>H2v_||N}h#A
z^FJ(79-wB{w`IPEk$xPr^R+WO8qc{$TH1=$N}SiPubwM)S<oaa6V8`^^u<qC8VtPN
z*E+5@f4A=XEy_+J*pDM5oP42zbJ*ym9xEdL#y-sxUHQH8^UJlcTCs<Hs<-&HpZ+&5
z!w??QJe*3LW*UwlIm-+@!>!Co+bmV>7?|a`M0)La(~(P_g_hVpekWalxUg<l-HA_r
zPfbI6zCs5r!5IUbS%r4FX)h3Ztk$t2JPMo5$S6bae^$;<S*&({GVVm{SvBVW``sql
zN+Ls^n!5b@g1h4q`4{1wpzIO68L9?CdX!z9Y)^sz3?jsBV=nuKD^ZDxTv|cXN8w(z
z<lN+gcQr@~Fn6Oez$7t(k>Ngx32oIU5;2%5z5(OmYXNIf5${i{T1tVo8)Gu^w~S00
z>>yv6v5deincJtJp+rWLhHZPZ@8gM1?ui%Td2LC&6CnUQw<bW-KqtPxY~nNdHGQq~
z5|zZFaKV&SvRbNq%poseg&nJSP(^yJ+4ehYKk6Uy!2O7t(>O1u9X9?WltpesZ*zgG
z(~HjdZFKXf@>{Rw@l(j=u9o-D3LTSJD7uq%W}2cXwrhS>)8RduQASMpJ^4w1a_W?<
zB!@ZeIY}o(gqmLO4g)mBs5>RNQTiOdI`I-)5j~@_6MgVYWhmwK&rd9ck`A~p`iEVD
z?;{Mf*E5AghqtyNY{M^AgwgHr-2Ur-X;+*SeecwMy<W><!+7WO5iNv<c3376Pwki|
z(#_0jCz1Rla6cj)ZpW1S#hGKElL{}_SfFaLuHf3ijVX<6{X3guyO7X%8|D~ufDNgA
zKoNlS(eS4JBg-5l><be)&uQ56R_KGFr}Tg}UTTi%0(pDZ?4)s1hEY`2XeD--hFyN%
z51Hc-u-{TbvS{kTjYUoOv%gAtrm-{blpEb%Sj4f1__m`fvm{Mc?Bpi$dV02iTgR0-
z?&A@N%EZ+kWSa*caf;GufuL=6jBi>E&-@+fFifA+@|^tyO^G%f#GE0z05+P+0H(hP
z@B2ej#DE7Y?!R)#aJuYwL~*eX%3~_M>eTEB%RWo@YEOI;GKL^7z*|h&sX4e61=sl+
zfm{}CB-lC_C(ez;rk#PC4ptP;4+?B=u|kNnJDgPvgFZJrvR3zy;jl?gdj9$B#0%Wy
zF|1b(=tRzOB9>+47}Tz_R>VYk(zXvx=wKkEL5?Q6-XZ_1KipOgAx@Vl3Iv`%Gp!~2
z8i@>VQeP9l&||i}WTU{9@a04jQ$>z<Hkk7JB2D`oXv|K|dBu$&LamQ2@7ZIXkn#%m
zN+@WIf4nH@F?l%uR&OMG_FZhepLB$nX*e{>0$1QbEf87=ous#af#Imv>I0P<iwB)|
z-t4XZSE}&%*hS27d;bZymg-AuqCt6|;hblwWdtMr7?Kfr?vE)QKxGnFtkW&s!$?wn
z&!ORrPG$SA<~QxI09P%EC^O%xR)S#wKZrm1bQ(yj*f(ULr+D|4H3x@=J(rip*%G$P
zSRsw2?n2uUJN!5DGF9xvS71q#;QnJd0Hw+g^9oQ*n`*}AYVDoA4Er()!*@@u4H=G!
zj=YouX|4LgJ7)0_4&b_%wrTQpitd&m(;ZyffnD%!Jp3M@9=j6*Ti@GFb>Rv~Ld}XP
zbFy*Ndx2wn!WwHM${#}v^3HHERkyvum1{{{;m5$YKbpZvFlSMm(7G3$V9%~eoA<IY
zWn+CaZ6earS3@}XO3U?$7xpEhqN$C*fZQWGa!&8moO85fg|;sR<KNr53dbL-^W?p^
z2yLd0#|s25NDzRz7DPhgKdv3+w(#vpOdi$%b?zq)+0hMW9jH9!7@U)#b&AV;Tq9J~
zu|RsHSG7J;v9RTM{M3+;fC%&$q|+LpO-=Qco-PVnpCDgH#*j}nPyiwevWG0O9QQb$
zzY$XGMb|#PSr@`GHcf!;k~Sy{2Xa45i{3-dSr>*9ls=$U;roY^o^%cz<%1D)6mUsc
zhwL<OrCp-`LqL)!?qnlWe2V$#b0qB%RCz6tmnYxn0II-RME2l%7unU?s3GX))emni
zv;SP?%=p18lgisr-|K9=rLY_MK7)PfR!oD39k$e-!^qS(F3tHNgZmQ&10K(Ar<9I8
zDZMWGT)&u`R6J*#9JQ5BZRalAj18MqyAx&jh3Oe~l&R@cOEi6OQ=OjJV4B@%MEQqU
zQ3h=&gjJirl<gM!__ZZ~nV5WQV_<-iLGgro-H3_xu^wC&a+9?GTd{=fmySlXd5X18
zu22MvC6ZuR^Iy`lSvgvb1M?&I4-?gHdCNq!cDBo0Wa$V~SUf|k2zN3O`j6xb7cR^n
z{ZWB&+@G`Xav#UPUorc4pZ=DPHpD5s;4X2Hlk0<9!q!Cs3(o$MQ+l%|64smR_koh&
zE3)?Lukv#T)E4jgnlf+iD+r2iySH=FCM?RJ?`A;5sE9g6U6h(YsW_!UWbH5J?;+W2
zp7L}H`C5<rIq2@4U*+1|rsvGhi=S|e2YN=W$2{)mU-TP_ib^1o>M7O?XZ^jL7XAoM
zrEk;;ua?S5|Lt)$vGM|Qg&Pb78SBX#tq@`l)>tG$0k^_g00nT@ggsm8mpjy)KI@K$
zzZ{pwU(6ypBCN_UY}&PbzrjfRrT23yz7FNe7w0`^i_Z`U!<O*!u`*EwWqWf=pACy7
zw|jSMn_ZeWYwtwofvu+bMI5abFz##wRn=5|A<6WY9BVrxV%7AzKwf)$o9oPjOg<Fr
zuYY*Tdyl?rThGi|-#fSZ)LN8o@w&da3{`qvN0Yzz4{L{iuke)Txa`C~3X{rDcIQY=
zKlAdk(d(_BdCkY=@i*GGCY`QjG#EitSWLzfrvc%SHE+US_wGuZrzDi41JLT<vqo2!
zeNYxVvzEIPN|x$t*1?Itreixc(soB)xTrin`UdqBZC>&X9?O)IoGpUx6+3NU%jz#s
z)N0dIY`<k@3yX9gACa`Rb!-~y07f31-N7e0e%k85f4udQC!Ab8*Q3A1`-GUoW>mgd
z`-aO8-K53QT(*|)BC|>_Sthue9JJ|c%ozR%y;?v69}uNNvk$&Ob%h99a_~P0od+II
zZ>SE%Q|?Vmj#Hk)V)E>wip`ni28H_x|DXjZMO)-s^W)D=nAp>YGSgif5@Q_lg1+Z4
zQ9NEhShX6g$f|5pOfd;2ED#$<DqF>Y!c^Z;6XfVye@q*E57mMurRUJX)pGZ<dn$aC
z?()38T{Sm=Sf5gJXa2*|v;Y$lE=jo@ZUP8CFFrWZz8$8fExj3|^UPb2**w`o-Y8dU
z+y7KBlJ18ywT`pFHEH<Q=MF)7IhZ_3@QEw0ni5KCBckU7E#4{Vi{9jI?cqxo3Hl7z
z!R&@r{C5xur6>$GUgNw_8|L=-;@4kW5P=N8`)O5uQW;vVwkA4Z%X`gaspQ1^XVhvc
zkxy5?pD`)d@Gv?9Qxn5e)DPCqLh!kLr;cgwOY2$`w*4RG!|dAxTD7e2dG@GvHSc=U
znA}uHRD;&->yr-g#+eT6^10e7Y$)2zym{})u=fyx#zdrQ@50~H0aQ}V2m9S7t3>DO
zr}2za>t&+yORXP-eeaDhBbDEUb)L68Eevo04$WG*HvGtvbZ|M>+u@W(&ADT260TxQ
zY)1C{I|3|IOt5oSb>QB?Lut^KD@MI(McRLqGouBi%M#WiXh5j9(u{3zXbXOezbWcl
zWd|RE)jLXp=dM>qHBoK0MS9Je_Hi`h?_v=p`rb>9KAJ|P%H=xxgq1$;1?#Cq6aBIN
z_$*Ku@Zy){w$xzIrC)tFgJXh%hk(NRnsY%sQ8Iy5Suocpk6>j6n^QK8^5tSZC@K-H
z|3tkLPK<@sECX64AiqSo5?hr#;v0-x^y!G(YazT<2?44`X>-)rLwf#!IZRlH!)kRC
zSa8e=I1g?d%Jd$Q8nADR-%!{`JBqb0DI?7_9(HonyWIq7T)Ivb$5As&6!KVz{?X}_
zWISsTzUzBSkSlKR$8)E;JDH2oTeUhYj|Ny=G>E*@j$=j#S_{$Z(37-2J$LLd<`+<B
zST<Fu=?ia*iwLLexfbhhbfCg+{f2EZ<EhE%H>nEPj4GcS)Da@lu@i3We_&YYRT{sl
zr#MQL&BS!8`bQOI!`o65DwFgoH}04-bD-?zZVF3w-L(sVV788S7ObIIvDLgPzyyE5
z^;DE2`w(qAjBiydHv}+8r(S*Vtc$E$(CQUsz)DPe)A5()^n;e6(~E9$^po1$<7KtV
zRg;;YMgU@HWqo1-3N;Kl%XTK`ey)V*GXdK85zSKKwpZ<*7rTYs6zV6h^O)%SPx!^y
zl6L-GK^%(ITfU)uNW4wXCSWc|zR=;8V1622@VfYs=lqkezdg8U+u25W>&xd%`wucd
zhgO`wArV3|9G+8>Yn!909m;**hdsQsi;JHY743iek@uQ)IgpaJADm3WRh&#Xk^H|s
zoWSZQuR1Qb79Inu?c&yJXxMF&y7IF!1|rv|h6O4v^LLMYw7zMc{+uNdb9&P2<U)Oa
z+=)hjRgICd2L<RJrUR2%|5N)}zum^ekm?TXukTIghkbjeP09_Ir|%a`olQv?8y9=H
zYhAuY!0|E0a`mI>m!phj)z<`Z$IOZrO;7kY=Q6i)7o-*8E1d#EKYdsZXmj*rKjeU4
z1j#Wj>sa;lW-xxwZC7E9)l3Lw+ms{S6mM4HK$J%?W=S;oUb|-FXUtV&Ryo-#z4)!c
znPYGwr*U<j;Q31}>3qggPHgb)qbkFS&&~`7!RWB6^%E=}TKnmAx0leEBTdn?Y$*95
zm|&tJJNkexe&ndtD<HoLPZ+ps<}miAdlx?Lz2ri#aGH%pjktbt)JaR|tbHqqI1|K7
zlqlQdrkJH|%#&&Wgcb@FWBZg}-^9fgtvh6`UziN8P2w1s1k#~}fp+i`5Ex@FFB<<t
z+j&bZ+s?ts4*o8i(qMK|=jH~vM36f@t=%sJWLhJrB<;<4*2^T&qeGozqeX}bEMFE&
zI(+VpecOJ@@tiWnOQ1(VEeFZ4zVzDlSB6*!=GE-kThb}(v!EC}J2qW%;#N|BRCsWd
zEm-b(+W6pFYWmuLqfTiuH_ny)Xq%ti0KQ`5ZRahFY&O{br<st7Kf~)JBV9SEF;?y%
z;hl)><$R6q@kulwI$H>et6?-_&u^>l;xG9qPSdL?IdIc0O=N2!N_warRj3vDwk*z_
zXH;_5w7-`RsG2AB6nZ%Ib;n7WEEk8Ai0l$t7H!ORg@6D`1jEvRFse^fkoAle#4icB
zX-UQ6qVw6w;6)K_mMfH%F3<&Dnq%<+^Thi%GzYZ|w3<ItjvwvKq~}=k#8-&*9^U2_
z+C4AuX;cGj*_7lpmjs@>UoFiRAK&>9P~*zquOI2+I>1&FwzuRp6+wacAZ8-EUac6w
zMcQ$Tvd-s8+An4>0YSmhAR6RvDcZ#>mv;N;aB1dW!~jgky-u&PVsHFkEt9rW(*<Y%
z*cldnoD7~S<zmHdBeC;I2sQ;DV`VjpRpKD4MBNK%bKX1MXG*wB)rA>5zvY!3rTHL&
z-Sd-x#pr-}LV#CwTo^i)R&>nDq~^lze10^5%TslQWc(!MDc90Y=z1dm+U;t_t7vek
zh`gprx1+o&5RqOn*W<JC-^f(Vrz<{t_j!Wu#OpH$oshV6KgAn)Y&8CmYQ3IwjvE9`
z0-a)R(AcWCKM<enctlPtmHI5i+CS=OdHKy$Wv%}S0w9+dAF)N-u=N0~QbzwBwh7|x
z&kR}Q3IyMH-KxndB>GQi1V=k=XQJ`VyMo0~WQjjJ;luWC(aa7OZB_`jr)suYU&+ih
z=Z%hqw&t#<SRm~ljj~&o%^osBNaalF$e+*82y8syy=+})<6I|jlfnLL<x;sd=5<E@
z#eTkh+)u*})0xB;S*4|$<*VZMK1#o*bOA*qqd}1RihCpttCP&igwkSILeSxa_lkcY
ztEBh$q!tB*)V2BdF<v&_-Yer_)_zt^HTl_O5;BRH($vi=o|<PH{;U7EOf}bj9k_jy
zu|n4zggcS;;A@<bA=;YRq#>Nx?0H7-{htU?=wHUr+JgigQWzLHoQrtb*Ye#+`B?SI
zXz|CZ*Ln)&8n*tX`mx=)Qfq`s?Al_WQaYaJKA{^c6AOGsf+~38J_@^bH{){XzNz=l
z?#<m=DCk`H`ckNg7)hqr%P42O*mAmW_Hr}ih^FWny89K~#r%5A==z?#EA283O#l7c
zhBrpF4RhcmIg*?NaSZs%F)Z;C?fchWXtARy8x%>#<1-bvI6wLlnQl7t_BG>$?}1+a
zCc?^4EOp$t^clXney>%8cY6ih<7&%)gd~wrO{K~rkM1}hd0WiRRlFG~t}(w+q<~p*
z*2%g{fv*4L1|$rBeo<jMBUwdVMbE_YpA{l0HHD&hsnZ-x?6V5%L@69I{A-;2$1nXS
zLB)EAqIvXx5(b$^RqGxID-!agSkURCVYqN0m3!AvLAtH!wyKO8W^#a(wJ~@U`t)J_
zrp6sxUWM65uuz%+(y}EXzM<AY`G*bU;+vPrO*+}Va3z~%)5e>>nmp%Tfa~HYpZ3G|
zsr7P*m+2AS9U4E}DVa+n8>#P|RImq6>vCi3E0&L6PPBGWiqL#^r@u`xY5#(i<vyAA
zodsztzrN&A)TjX_{?x<Bs-kqJ%xpvxk7-lF^>!DDjT2!64cv!?(~sG9qOS@d7`F>A
zJ$OqA+JUuvb$HeyV5T{ne7l1%Ug8a3uIi0lnRal*yKe}<cN(0Gk5wd&Ls~`i6>sp2
zVgZ+;vn>2hzFptGdnLyllm5tiwa0*==5?lnH^e}G;EC=q1pkFBt8ur!o*XUvh8tB=
zvf7}P3sI27#Q$qlB#}+xuSkU_v66<(4;yw1Jmy<SPKjVB^!uMqg!UK1>Y3TaaZTJw
z&<`)*fb_O+?VGBZ-#4LNFLVXol+83=*YlrhRjzL$IoqwdvrN4*=lOGVZvmT{WOC)k
zgE-9+@75&d3#C1{);>N6fu@NTQx%T2X465NUN<JJwE0Ennze*&V|LhlLyY`@dVg1R
zX1kYZf|sC#Eq7LeExMeU^MBw2iL9aB3MG9)#kc~-gUAp+_q2Knw)-T4One&A_?wXs
zYuvM1jaQwSY6-5<Q6e8s8q#V$oa@bnBd&#-ztCXim3_is?9XQB`t|f&Kbqod@r!r7
z^SADT|L9<{L!`^-dn}6t=PAE?Ewb8zqw;bAmlv09cP~XpD6a8p#wP$C*eXm{{pGe<
zWlWR(D!m8GZbMDhgk%>ITvHN%$w?_bii-?Q;@06u>nSIUx9Dms;ZO<DQ|n<-=dd^K
zJn&ncdLrX|J0%fH)3@)7afJ<4lcu<V7{$aFF=)RZ>C{B8Uuwg*s~$VbJ7mE)x(-th
zx*GW7cC}P}@m@wTe=a!`T<JJ`rN%ghpXef~41a)sfAdC#3SHX_jv()e<2csp#SL&5
ze20=|Ig$}sNci<Ix2`?@!R~Iq+J$CpHtn<RW!1EUA|(5r72Yva=)g*B?(wM+BiI*R
zXdK7ZaFAY8K6RA;-vhx%p>i{Y{rN&vXB#R2r85g@z#xcnb=R1U`ifs%i~%_hLIUaH
zA%#H&GtN~7xedhSS@GnihFz&TQaFvNEtQxe?b4WA@lp=YQr873pb;?b;dd^do6=f1
z5hR0|7(d$WC<;}HF*I8s2(;UKB1b>-A^#``)wmY`o1S#I)(&+NUs;>|q+e0^(j9Ps
z=7D$z;ajQ#aVsJkjqN)uInFTNwuR;N#s}Z6lEZGs%~rpc!ijd>k8T<8xRFMGqgT26
zg=V~XJ<f(8#J2uGO-53S6KHTl#OZM{fUZy8JvXz2!HT7o8OW$`ShH2b3*7;f1bx-P
zM@#l;2D(>1d6TMQS57~vIk|Rw)O@(u(R0#TfSt8ZKz_`LcWYWeSDvwDB=bY1DT0OK
z?Oq(C@+5-%$=TTjB})?yc7Ax|#A&aa8d)8v==(I<1p4OZ>qeT;aP`VI+~BCG*C0qF
zj&{X2Y<41>Jn9R7ExY08z3T~`%uy?cm_K-jPaf1x_cFSbagX0~pIHSe2p=D`MDWMx
zr#6yH<OsSRIB`XkUR4b0{$p&KuScv>y%n9}+~Zxwv?14&S<6VxO7cNS-#CzWs<at1
zeE1_0w`7ZCFi|&&j$3SK)KlhsrJkqs0Jf`XFA*+GZmfC*U61Eaq8*<jUH$pOeO(Dh
zBfjH6El!1haUY~~>nn+7tInViGPdh0t&2B<-J0H1zFIbPX=&LD>P-pVVtwBe<XbX*
zob?#t&~|oYDD7lF6irqn|M2m<mQ87lNoRob`gt;O^-Gm<Q`x;6n`1f7J{FV0mXFtX
zx_&x+s8u4)i~)B73-AYhF%0y*9siq*5th1foBm>r0l_A>#^T6ri+IS~W5Kh|nUTUS
zUH6r$ThadpC(l>rjq5aTfEg*un|HHL*G=t&{y#B05Pk8Y?31m!5a9P0^!Jhs$W+M%
zh1?1U5+D;cDY?Rd(jrG+{VpdrBEy>J#S;n-r5LSaE7m2EM>3jkQ>f>vTfN>dl3(wv
zSqX%WW<Q(y!ZIH{fU?QC&Yf-VYfp7s!P!)%seopeMN6;qw?IJaVDoMx>w<KSbam;J
zy)jG%_)sF<>5<6%vd7$r_gInEy&~>-g+0*%aL@OrzyM=G5Sf+N1VUPNni9yXsIL2w
zBjd4S>+7OM>YcepPu*3SMWv|@*HPRX{{0kKI}-(xY~jJ4jF}LK+m+>!tJy>D_8(QO
z08Bx<)))(<eC+7dC~3a8i_r7mD60pL+ln93P9iLwNkUd>qQ%pGaWEf`f|YJmcrV+#
zzptRi)JQv@Ra-8{4}Eo+++H<oTOrM;PE2NBeoF2AHdt*!qE}~%^(<uRtcw^~P12XE
z8Z^0ud{KkHq_>ud_BfCaMj7fb$l>CY<I}d-xZ@w%alV$@XfxHI#{4-Lp3VuhVfX3i
zUhzY`W|abet7x7y{e||L{V?;QCum@Cj#Jq>47*GZjTmd%k=lWCmz*@71>`!Ifqmko
z-c8FVrimGM&WSbYwprTkf+63=a;26pPh0DaCF)LF+it*xDs=Ii(*E;Y0lOC|5=f(0
zs8(vj20Q_67l2C>0TbFk5_x4@8;ZQ<FC+p8P>XfJ6n*^ingcklvCVAeeM9-cMr3#-
zTh-evZ{XOXi??rAV<}#G-F6qd6T!XPy2b-6dfd3M+yAt8JX3BA%5m~FaPlnvc`R6%
zY3^$+7ySV7Zi0IOv>KlfEP^_v&ysNWrCRXsu&BU$JD7#_JA>DoIi1%O<`@Odepe4=
z9(tMiHH<lL#tva-v=T&8ty$S4;Fdm1#LAEh*<E5kgMPz4f8>o=UGYa8$GZZvB}g*N
zKr`pMx#;taUWuauKJy1H-2u2ru~zsdJiM0qOIbhc*1`aMFEFNJvbEqv_JM&ffB@&m
zVZ0Q1!Hp}2JZ4T|fg277>FCvJXqCmCM-~U>U*6{{>dfKytEJ$3cEP%=u2vCeqiaDv
z1F$F?`{2sV%3AkxoP}+ik)<-U`1)$=?5Ci!)<e0Ki*MwpQU&>l=Z6{Y00j=Wgg8$8
zm%v%#imXe6w-H=6HP&w%@eyq@LU976CJDcT^#7z!4-#;61v6LC54xEMNf)U^P%JgZ
zExT4DL1{^_qWNXg$dfM!<pxV}#ItSQqi6t4pFIt0{}!F;dM%Jw_G!f1#calnD2>~(
zmaVDT_d`zRxz2e$Npq9B+{vEnZQZbrRi3Q|gc~|V>E)>f^m4Fndi2BeyB~aQ6&9js
zpSKMOycny#)5Pm>6k&9;m%MoBYh(+1v!0gIjK_VamiP3mbhTdh$@k!b$*pCNUBP>^
zW+JJwKfueDTTXf5lQgBTZxsQ?W&QNZ*tL}t5p9N9j5W`@<C=V$qEm{Ciu*9!KUcA9
zLhwcd1%;Ck(SO7*4e-JUCw+{4wBjiWD=iKx=J~tOGq)NSWipUhXk-Ox4#X|!<&UZs
zB)({KKMy8Cbn2>Oz{PIA^YN|u)9OlQE!&^_dp5Y1lqmsmVOKN<TXW@{yziYgcG@2W
z{8aHxwBQR@V@JUEx9MyhMcYJRyR%+dajM?OcbygspYY`zF8FlGOn5;_PipFgiFWc=
z7k*n`+eIk~o!bAC492C<hEQ#Od)|Ab32T+>`j-W8)8OGp)EepTW=Kq(aU#EiUOqoE
zEVCSVKWEi4sAExJuU7WPnDL`nA}Ds9*NkhQ%deA&k_$k8sjKjNp!C}=VYhZnV&g0z
z+o6q}5FUsfGLW_z#3uE=Zyn}uoP5Yi_I<nX=~g^(uT15uG^JP6YONl2$p!sEd3i?)
z>}YY;p>*fh^;M{JD!VcFespGi;!mmf74P8a05h&xd9rTo^?>~q_6<MpW%Ri3h%(6J
zA?<J*$7NK<1?rYGkk&27yX_&H(LiQ@QC}rnl>EUr(K_h#n^G3-N-|+Subrl9nl^Kn
zRZ_Rx)5iSBN0xy(?0XeVx{aL#9Pgd*08aczCGV-?q?2WIb1nwkjNU7X#8C5{4$r!$
z3#q>9w-V1X4NCu@usNq^Yww$~xyR!-@4uYG8;x~2ljO;#PHNfBPgr!)V`p}HK355!
zrjftc`x-~s*CF2eLu_qS;|g@ZOZ7qToxe=lb8W%5gq~Qz{W~Fs(^VZ4grskr2b*6I
zAG;!xWLJ^%`<UJ_Gj$JTreX~?(Y_~+&95s=6(G`$ROmDJ+2f%eTTUL|SA&y8Ve>yB
zw5t%f<aI+I(<X(cIEUK3T$xWX+^pn~@p@(ieiCSYK7Sa}R)M6Cv>X3W#xB;Vx6(NV
zgkW2JpV$xJ(InInh50}K^*dGb!!)w_>47YwkK3p4kDVsoJHap3$WamGnCe@$(CECj
z%`#_Zpk&}WnlfsW^p$-^fneW=_&9pA{T~G&Sc~-Ds`WY7dTMt5bh|I*<{LUugW#jz
zJzk%C3N?Noa*`#9%=b9||HyUcjOm|qz|j$18QM$?3q*qnKFSX^Jf?qdbWm7+D4*cJ
zS9f(xh>Nx7lkfb9!<J?TWS9vvKdH)6Fd(yAJ(I6ARD~kDmYqK$5!=-PID6>s1B&uq
z{8{lL<ESL?a7Ii6j3iq>4!gR#XxY|~aHDwed2HkMyeRN>+~jpmD%`9kq$pT-J%d<}
zZX1}zAY(I<Uh)gwQ%#>FvrB@b1MjEB$sYaQv)%q=&C57VWiPgHw8NSQqCgy>tXJCo
zyb)jY<`1>dV7Si;m;E#PFw;JnmBUx13vG#AyAhG4aqKeUcSZs)1MNCi2#@cyJC(1D
z8ahtM0-uZC5Btlx&VG%9(<)d&5j(x!++GE@CU>EqgVC7GZuINbmgEMkasaBdO#YeL
zzGO}(phHj8eG@H#%<J1MXrd>b?D~(53L-go76F+D&N-cJLU)P`8VU;WP_sOy>fGfY
zkVl#Z%qI~YIH^&t%6MaU0G(-roe<o*WSNu$Q!{)nS6Jw&c=VON92S6{ueJ&jjYLkS
zn|sg1dH3B%rn->&a3;@Gp5-$!V8N?7P1`KN%FtD81*-I~jrk<DRDXk?JFGhS#XaS5
zd6MMuezx3^<Xz4zx&+f|XO1+Ux(`tZ!$6N5Xqbn%{g8bIwj$PXBk<%gIYg7&fEjnG
zjP+=fwAbXIv6WQ1-X?OCFv3q17Y5M>r-_$Zc3A!pgnZzO(syBx5~bKkSnZTrTst01
z{MANuuhOj5r}V34FT8(rEK|kYYo4b<o1%dmI5*q4elQ4O!}P#S@0dLmm57QAI@2t#
zp!&7&W4qPeg)}ZB>D!`u*utznx(<tQfru__?*)`SedbhDf*HI5EjzeC3zgP!hNc4b
z6}-1_qs#Dtz&KXChH+i8Gj!QR=L@ZU!BlZ9O*rnSJB&7w_DDH!nK!<Zh`XppGd9l9
zFlngz)+OTQAA-K^wwLH$N+sqPv6z&WmbVac8&`@W7wXPXw5x#8C%&)Xm%9mhvBimn
zPOi;Xqd|DgR7rto-{XgAT?ugt*`VEs(Z8<;Gxdrdn}e{rzIjQ3I<v=`W|1*;1)cS-
zzzeJFV%<aQl3-fN;Zo`)@46nFn@S5u6bqL``P~g)chGPzoxTiiz~`F%*#NNN7nU?I
zz~UwR>y(YmLHCp(FMX*gMHgQ-lD!Hps7Q!e80!24Gar#^Q&(-);Hnm6>Twz%0|1-K
zDq5V+Ar`b77XZ>teh%lkQt*Iqhd?(@7g|s#7XJ!T1b&AQ<c8Et$h&784UurthJ<&A
z2@im_5DzXEA)xK$r0sRF&mE+?98PKd`L_?B^LVJoe4Fc@&PUZGiDV6E7M6qGO^g7J
z!Ro9IIUh{R(xi^U0CXfBpKjeYfm0p%^3hRVu+9xG;F;q2Pn)x#V+%3n$UlGTZo5oO
zG&iT!(&YHabvAF`Ic>2ysBT>bwAT){ntN+db#tvM9X#p)n@N0iZ9a|gEuXJ;83liu
z7k$P-<&_|(otziUT=%kknsBh;svB7oyrwU6cS0n7u0j|c2C3#YQ)Hdu5kQ35-42x;
zhdxLI!cD(Cd;=~j7J_f-clP6#0|#DUNDh@$zbaCycPbasSQ1AvNVn5U1Yp1cm2mpm
z<G;ue6seW8sgV<k?eC9ec9vQ8?qsheR!U3Jwp~1J*qPZ&oq{!pG@{<72)w8_tbosx
z;&|}oCZY^vJJ%`8wWa}obewqmemJYN`9$N+?-uiLw~EDvm~7q~a8jIs3YSRw-FH@j
z7Z*0X;XW(QRd&g=vjHJ7*X}=q&dWH>Dnj$LkNTD}NjYS5`tJK3d6*USTH?f;nf<n1
z#*Jf=<u>doMagBW*KQxB@Kg!Y(qYQ@mroV2^jH-l0iQlH`Znj3yhAklFXPYGrPd;b
ztMZ^cOAgl&;z7=?-K$FPqD|JtgS-`?TEiR8basMarJ*05*ZCUV=9@mtQ!)e1e0|v%
z;&C%Bvyy&rg>z%6_m-N3^vO_jI92?e#b@-NG;O48U(Z|P>xT;V4kT~(Qmr7APviL>
zO%?U&o@MOGup78Mne_eJC@l#ZA|b^9zch!aKx5RH+ZoMM;I=?U#rAU3(^l?X-!D|m
zOw{S!38oEM^Re5V1A!q*b~LZJvp$SeA|uQ9hG*;h`fEOD$pa9Alk`f)<sAqpMpf45
z3s<PypC@5sM(}QL`5z%`z1}Oh7JWU=XW}Big$a472Iq)lrkEQ%w*F=8x1;nimMo&e
zo8Lcai$5w>@9kA-);_VUWIk}22gRv87;W<2OK3cWbKXyB=Ezp3NMMualGJjT7Q1ef
z<{D>82756?FqblEu^7Zv7~ZfQt{BY&uv;H?N3T~j&SEedMq*}V4L(tTB2ZN#F*V!$
zAHBU(>K{mHZWM_CaSz<<JgkW;IdS_!+gTgY)JxvY=HIXm%rJm7Y|+lzl*HQf_f9VU
z1JpgAAeEi}xE(d~(ejrbzq|S)=Xl^pHR&H$=HDA^%~PmXNHex(P&<0gm)P;Y$~$4;
zbOQ-=K4I8!vie-*J71&R&&-PF6d=Vn{t=&1$#+NgqSH2d*|I!B8mUBENH&02+Xlmm
zy-I9eHU13MI@rdh>=Mgf57V6h^iK5XLEoxH;@+)7I@WX?O+Mn}0$cZ>wvn~MHLNbs
z0q8l3Ug2@#p!w5KE-2=c0;<peR@>$x1g!*Re0=@Q9V55mHllRsbs?YFCCU(Xg%3%o
zv{DmqR&FFtlWrjPPjF#eQs)%pqL&Ap;Rr4adGrkFA?j_nLLuyWpT{HD_xz5y118q^
z;dk8!L)DJRDQEp#))LGbx`O-w0im+d45@;_<e%Kv>t4m*VenMD74dN9v%LeO$-Pd0
zhM7ODZOKYN`dWiIaFdVlMl}|p$Fh*LG;T$h*Vq`(#XD%~H<;$km&8{OHjRR|NKY}L
z*=Gc=r+Kg0YjdqcBrGSdOJtS$P??y>nLmF^B(;&4bS;>eyZYX~Au`_S`|(DJY>~?0
z_rB$vHC^tf?jHl(eFS80=v06ERq^z2T{k?jD>%31tRo}fY-KsXsCMBXmjK1vk7vs{
zKpl$yEH7L<OrUu(&*89inA~Zm_?a(gJ=0?I_b;oysvZt~Ma$|BmM+!<dz_Q|Z^HeV
z75P%vM=~B37obu0S|_41gaylL|7KbfNQQxXnoGgaV2{;jx22vzx*na*!r#X0hkqZ?
z`SnH}p|j3!Y3E<Ey$Q04V}jLfzKg=`#$pbvm5cq*1GXSTbM%StjgeIMl7rg_0;^BV
zz}<LG`~4PkdHIhU#^(_D^R64M{GsbGZhT@IVX)_*hnLCbFyHG=&)0AZ$f(xpv}|CX
zdx>(pZ;76z#{)fZ+NMN&Df9&P(I++c=jAXg=kng^wCJr8N4_8~@n1{gN+EY9VVrEi
ze_fW_AM`z9c+JV_ETS1SW0dFj2e!N0nHl9+6VyQb5q%8ie|wGeV|yzUzRyf+XzthG
z=FmAXwU5|!X_0v@@eIM4qPT8}WoILGB%j*nVFoyZDXbs_ldmlU!h$YoCJq25bAJop
zgBoPdMY=iD)<~K~P?4M3Y7l~S)G6Bb{8T>d5+&4{w=v|Cl^Ql@^T;kYVhFN(?+lnp
zD6}~Cvf6PSDN=Ur#3dhV52#ZSFOY8ir2`SJP=dB~5jLD&_bv@#t_D#_e)E$V8X^mB
z?ei|GnIhdSd&#L`4weXXS&?X)f5MKZX>%1(@{lZBCSn2kRma-S$6H3McFQW+HM`j}
z+9BJ!l~gLt{?#Gd)A9W-a{wo!mHJ~C4pBHYPD#!gWG*<z<~f$Kqj+*oiO7p&dvk=0
zQzp1ix}6-BL<C*WB}MGKgN^N57<76dKqHI5y+563L`hGklj}>C0)400<(}%G^Ju1?
z8iDMj@pyq;j6bW3q1TH?N?X4RdX@n+&&}n&tIaM}T^&QNuwkDGWGNo_*>(h?ITF2%
zNNSlAwqH4vU0G=)a~B*XH0>|l&mV8KJHQs~@4J@t1o7F)mGT(x_he~XmJCYsc682~
z0B(Rvr<+;-J@FGD3~uOBLvnvE@SA~IT{_BwhXc;V1xUSnv@&yw#}PtRoxCTU=N`>}
zhO@3K<kY;7Ugbyqc1rlU3u<pcZltR~mTQX*#@inS!X7z<#Whh-K)>)4m1j+r!Oh!g
z)@6I%G;=E-d~Q$OV^<Gn_g;})a$mLG_Uy##wxz#vFT5S}zSbq{RxFzwPws$%$u)6B
zj+_vcY*wDPN*KHhx@bAcPq<A0{=WU4bDG>pu>P<(Ae*5)y}F_3W{a%Q7mL9&%O<tv
zL)^?YF|rLXBJDkZlVI?0%%n%6<C`9SSV8NCTaf49iCaRw>4RgxZKInvF81oN$xIXO
zir40XEnDwH=o0R3J-_<@@bw)~O)cNoil`t60!mS;bm`Is0*Zii0i{C(r1v5<5Kwwm
zdJlqtbdVyUMOs3S^dh}C={1D#UEh1Z_Wtj4t-G>r0?EC1X3oq$=j?rEi*I+yd9!QD
zlhoKk<Rk?BB<94lViM;Ve6{5mi~vjCm@DD8ozzIZhi=f6ywLmgFRd9mjx>o;eD~8q
zTLj49o2MdMPjC;0zwf(Rimn4+$}ccmY^3Ln;!UU9Y>0fHB(yAfB1ue#HRqfX8ce*%
zezWX}ZQX%ExqsM$Z$#fTrtHw0_v$;I-lS^6ZVulLrbdrm7!ujXH;s<<<NE7kf>JCE
zMBKLFPdvAK&-UFM()<bC1n{t5O{;<rQ1i_0sW?3i=#aE#_u;6iZnNHc+qEv?x23#K
zb?D{qmp#?RP@Ca>qH8?ql;xJ^_N8o<1N-ku_Gh$NM7gquj66*v3J`<olz>iON{iV4
zWz}2();X(Hn|oX#Mjn&*!|Pzd9y2)gN6bkpOQD2q8Tr>h+WWiXA3AA15ph>N^E_>T
zY=Y%LW_WGo&P~@llG>IwxYe$d8py)p(9!i?NL7h=9|m_j$$`1W^6_g$A!HgXy0skH
znwKs|UU=%hYL?5ct$V6#d1&5Z(s)eLnDgEM8xub8=*0D6)Y!VN@@OFjL_BKz#+p+t
z3Q7-o`bggN9Lmk$KIy(t-eqHZ?J1vKsx|HfdG?yRz*790%FBuC^e%1?>#j1B?x;~>
z%M5SG?Ew+gRGZk=Y?(4o8g{?$V&$MXf)_VBw4#3ehW2gdZlo3_@GEZLTWtROdFvWG
zok7=EL&?!2*x4p|&5X;ta<|)!2|2fK-3#rM4IxpLXpDKZ37h-Q98Ef?Ds6USZa=KN
zc8Se4h?!J^k@gnMCp(OtSG7z;WPDNUQ~KFYxS6hHwRzn8^W&Ge56ddz!$WJfSre&%
zM0|&XHil~C40Yq9&g;5PiywjQNxFrq;48U7NO{*yvbzY}dQtgAxN=}6T8s%vpOUxL
zG^o9+(lcj0>WT1iAnld9M=@gTnBzIr*=v%pL`9Tj=;<yd9G*weAG)c`4R;&!%t&ah
zF(|(0zFBRF4eE3gMu=EOp%NH38K6BTCg;LBq0mw(q0Jg9#14mO+mGReYOTfU<_WH#
zPPPn5yRQoloT2E2UQxq4+EKP%hY3_I?u|F@bG7U(8*D#+lfff3BcEnR6D{@{QI1hk
zZp(Q#O_<IcwW|zMWalDq>(sz9UYs9K(KsLukxs3`N%`AU!NT%s3(Sf7-th7tY6gKB
zHREFE#3yGDY(K$h&W=I%Gy4(NW1dq9TC~|!KRuKfagr-4Q&%tQWG8*cq#vJPDn;kv
zpQHw&WoT)y2%JG|N3O0OJ{}D^z4-D5;xz{0%%sbO^58gqjR<Y<ov*E{RPto>rO17I
zLTljnGcNX7ILEm5g8K33<a(D|FdrPr0F8B<Y(q<5yzc|smma-mKs-|b0OnYt^)U;&
z;g#gOYH``nv)Pi6g^1Q8zTr)QmGF<2lFC%Oq`OH|Un6+yb+AE0pPW(lU&{{)Lqg<|
zII%s}ydFL=%|5AXE9&>RCW#zr>EVL(QO~gy!z&DD9?8&(l7-Q(y#j8qsB-ZEnt!#T
z1uW*2`4f=gW%S|9Ev>(Hyy;9J4STZp*$AP6#pbMNO$#p&U1N_z-Fn4G(!kM!I2qZM
zvx)cwQlPP`J9}sHHZ1SixxlHcvf*7L353imojtI&7$e=!7HsBz*&T#MSvbN;L5YL9
zLF^jd0_bA?N1#q-ljLEMuP0|_|D;*;ok2e7F}a@634H@23X5=5M~9fBPuNL>|MA8C
zD;M9Rxk{5R>0X)>?-I!f16PRXWs23i_~8<P{o)1#45yD<EnY^B^_M_3)iLacaF_F!
z8>3PrRK(80qHG_YNsF@<yI87tn6hl`&9cZRv%+qyJP$SDz4m-blfL&O-}|<QA)Z^O
zbwYe~%DY1_M&ren1LB}e=~REhWPifQYWzMx+dYs{^mWQxcFa8H9PgMl(U6VUdu#2)
zav_LLN&Hfvg8L;k+ID2jyk1M=@eFgOD%M%oJLL|ZL@-%AlEx!_=ll6_aEAN1M9*ZS
zg05@E&6aPd>wyZ_Z{u1ozMPoW^nRTHsi#d4^e;q9INUB~BQ0w<c%tiZXr6{WU5M9G
zrD%#-*&Z?5d~L)T{<5f~{3$hk`xAG-&W|{)L-wXTru7A{@=fT!IjnA}v*k`QZfYm0
zrQh^Whai{Idc0g_nN85X-s~6T8khW51AJPuBY4QR;FXTI6_bcZ!LDB8=_VTdi^&lm
zWkcEodlb%TmQ_c=cbd+ZH{7I7+j2fy-fp@sb@sxVcYbS+tCU>C*fD{_DTZKM?!z|R
zGE-&c?s4O3-ECB<wYxI&BEZ7UH_1!!j_=bb6*=k;*$ycY(UWjOW%{j$dD8E17W9VL
z*n0m=NNRadRF;CTXR`~J1}43EgLQ?r6{EUd@D-j4#BLo|i^uMym5ub?&Xu{<1vO=`
zAVz=KcT#M6vQi3Xb+OYksQ$^)*X^6ENvrBKfwH{G#pz>oV57$r$Tw>D%@Oim8QTZw
zYe<s~IL)?ws)KY2s!o1NQF*VF#4^K2Ppkk<#`zUwSJkOKHz}wdW_py=`DUUM73j5M
zz*y}yH{-KQMFcV0QIXhgD$5Jf-+;_lT<!(U-25=e&H#<yGj!@(Tk}b*Og4DfS1qs0
z0K%?((_l}i>BHO$u`R6?gHRx}D}1)r)0%i0)-GhI*>9+7wS!q2a1-piNsqc;p2r<_
zLAGLy@Due9!9lLZ3!^P)SwxJ)IVK3TE%i`paTJCi^ZYnm_hXtG>b&PWaTBvlB%0uU
zOH|=4^G#2tiC~GDJAS8LPLE>WCWZEjb;tIq+B!#OygxRY;o7<{#cLb{{;sjnUr%E1
z>>zbH{fZ=i(|ZyDyA}>H65MX(PFtfwJM=OxF%ywHL3%hPTHG*)XuYpdzVs|WG@HL^
zXXXatS>a2>OjJF-JH8|Qn8I0MQ*=#buD)!X?Ps)k-_In+^uAj-Wyl9wzJ@dI@I2s0
z^0n*SkC~rr`(j6TT~Aye%_L?t>%f{`jCWrLhrZ=QkrV?Av&RbWB#%4vcIBLO@(v-G
zX2H3DG!Ig!!NTf6vDge`cX>wzizyUxFZhxM=`ATE5zRn&dv1LY%=VYm(1nKln0Ht(
zQFL2*M$vX4Fr_~~kb1Z;TsvQvA8daFW%C8Q&>y|~x|!i_$~EH}lTMRpP^6v=Db!ma
zIk3LJaW75kS}@hnVGN)D;zqdv7PC}#W!fhP?8)QD`<kE`h~0R2B5Ln>0>ZX{{rU^B
zQ)1QVkbc@3Rlv)+7BFu?zZO0~lWU(XZ94F97^OhW&c&bPe9+w`x#v1cUB~V^JStVE
zN$)n=0J2{;Yb)$E!f;g!U{2s2amA^OJ&bX+E6u4rMiD(!Dy0w-@z7zsc)_~ZCEwu}
zQhR3WMZL7V$dnxK;v9n!z9lZ)TM?3Rz`X(vq&6P7ZQtKKG)7BR{LQR7PAANCmCo03
z==u2h{t0>Qn^9fR`S>Z8h&w*e7|$Zzdb!HraL-o0v7Ef$HJsx~ucT`XiybFf_TWZY
zQ?bJuu4Nw`yprkr(9pNlXzqt2f&|cQSd)KNzFe_8o_|5)+9##H^`M%JV*D|enJR%3
zd<TQ`*$z&b_fD;(u}ByHnJWJxq48ke_2pHQz>O^_3&na4vZrUXzR$1}=R~odV#f{p
zAyf;3!)EXfRiA7Qixp(*{7C5l+3mYN=hYgtUK$yZB9gC%k-#2tH=v|N#dQ{tg1$0q
z)Pb+FM@jKSD)}HEf><^r^3m75pvOU$lb)3&Kd{2z$<G|7km?E?<@IU8G2MJ*^X(2>
zlltB@q|%;zr0R&tWQSmy)^hgX;KqdyWcz)HSLD<6$H~G!{p28JN5CSAy?eI*mMEWY
zK<Q*qT{<sg#oL+@mr{==pN3u-1+g&E3DB7xdv1H;Uq=h<w#CI0RtS%dx2*8OP>(<{
z(5qQfi@9=D*#ZlI(^TrS$>2WmW_w^0z-;o~kLQ89Yjn|4yFDB`s<)s4E*@fM2NZ*R
zH<SV#B8TxE8a<~dVUDxssNj4Cka)(G2<ns{e61mYf~53^$`Pn7aY+V}ciD_$tNoP=
zV2}zO6xRlR)&?zJ+%<2maP3Wja=A9{Ph<oX4NUu<Z+&Yg(ZCVozS>!`C=kCGd3DUJ
z;~<*;RcV^Xmdg)Ih@;+5x`?fYPp~{rUp6<}EMM%nw0Vj`t9pQ5fS5tiPit2uehzGb
z-TQ3l&8Y96ys<31<%$#VgW?Ry4T*B-&d5HN$68j0Lr5~cPU791A=g{na~ls`X1)O>
ztkPAxBQBX=+2Y2=YM)n~>1KGYBoV3~NU*8!H@{ZI?+q?|*o%_LHrntBq1woBJ&DYX
z<#8@J681YD{t>@C_-fP}CqA1*>0#9P2J4u(J2<Mcbe!9S98*P)QnZvj^#)|&VHdqr
zj!INBItk!+k<h(q3iFL`qsIe>@L%SDB*6pL`?((IryLCzg}65M-dHj0<gQ|6TgaS3
z)p?00nU*-P4Nu!GbkLlRuba*=JFwS{Zi#HQnQm9Y@op|%V}S-%<`SW6PTAt^MJ9gJ
zs{zhDf%PsNpko1;*W`G=GX1ja=#@2kBTlN_E<%EN_^p67SIcy-WK$>??U{xXCg&F@
zNd7ja=ua2+5ZADB)Fc`hB{KEkAl<BQ2QtYtnGR6+Sm(kw9F*&?T$hAECw#lRmrmk#
zl?=>E4hLWhE4WTJnB;bz2(-&vZBnkYpFD!6>9yGI!G0_O%K6q8(d<ig=8~0(%v>(b
z_RT?*H$&*&JQ?G_6(EQOJcDU0l_a8}*txUCOz(B;79FtfhY4DvW}>y%6e|2CHf)dG
zvlSQBjyu`XvWv?|B+SNNcJ0z^rpkw&EpL<!_AQDU`&8RSr4FY0JYo>{i>?{B%Xrvd
zFANt7p+gm?p~unEq(nb9%awcg9fd>Qs7NnFnyZjWut(I_(b#T`$|!H1r9-qacWF*e
z{Hs2pU|vSbT=icM>=NqD#kWrrk}}mz*(IjtdXC%lR*W+DMlchLDch?)TCb=aT#tH1
z!R?hfE6SD*6sYL!_KPns3cXgzd<Qg`VC~=<M&50oZzj1fsz=5L_EpKCaOMSDNM1@^
zNEw26Q!No8?2)+;PZ50s4U#IidsP3J-g`Fl`}VZNfY%RNjS5WaM*9M<!-EJ{%T1Q@
z<6YIO^%eVysOfy~wa$oEe+iP!^6Q39opgiFv~=28@5sTPo3z$c&ewBE8%ca5GR`J7
zPU~H!xzr7^l{Y81x*{9hDOP3hR->$v2Bbq!BKn^Wy2og9rI9tJxvB%G+8o=5F{hgx
z$fS+riZslGoiZ4czg~ovgiI=9Ec+GgZC-`<LrU0hYI2CO38Zj=lVfjjIVbv<Ga>aD
z@p$sG+e{8<x~UWlPCLUmGbO0R53`C>YSwL|ZODqCcNQvB{(zp?K7z?NsFJl@L)x|H
zk{1PR0e~nk7^FaVS553N-OcT?f{GK8hY!3UY1$_(#hl660A!$pEf+NK4IJvVCVqCq
zFnr`OFIL4-ld3KkOJ&Nrl?p!F2p^0qP920}q&s|nz3DcZ%OYtT1k_DbliE#o>!Zuo
zE1NnZ^qBH<rB98f^xO@4Y;qnYLZoBlt^vsd4=OLw`|UK{K3=;3DYgjKL-LbNyAE7x
z+37c6?su3WCDh=$<DDzVth*^xw!;sjJ;zK|q?8m)iNovDJtoY{*idp-pm{f*06l>O
zkLb8p>}>b%DLmad6`zZTh7^_7a%2`@HO)PZ&es;A$4Kuhx4pt|l%qPcJwd0H2}>LU
zi&falWYg^tJ;w!4i+xsWy810Rbd@0mMCFn4_0aYb8AAMM5Y4Y;9fc+Lr|L9;Na1K>
z#FIT^TS$H+W=2u58N19O2Fd6udmb6g+S#~YzVKZVeuD7aB!r09z3zjrsGi#T+JlZd
zWY?}n0=6PIIgC?%WSg9XqVt|Lw$21OeQLS8>l*UDi`TucBC~NNeb*}H;;Q>?=4)oy
z`z&AeHx?temq8vI?UjBE5eij1L`3fXl@h1jd>}LsX}-9H0OhCK45{@>zBdEwo+<N5
zCN+tE4Yj0=p*^*oC7?9!L!CB5E?i5+W;Ql8!9N)`kgj2l&lF4-;gj?}1d9?RsLcGm
zxGMI`_?El|;=pU#A5KaTzRNjTi3TROO8(T-Z7p>`Fjr$h;p<a;i>9Y~kT#A?2_4?s
z%Cy?t`(d3MT-RVoGr{)$q#9*oOzMx<A^ZVKPYj51qc~H@J5jW}VU6C5&4cfj+FwS{
zw(a_#gtA5}ds&%HR`a&oMq;qGO8dzY##oQ{y}!_j%B+X{C4sHD7-?dUDQ9IP^*-mT
zn<Ud_uq&;EC>$4dW7fCT+R}*H?_@6IVC85O?CXWu_vjloUs*W(I!V<&!q*bQ(8Lg<
z=~=261r#ckEUrO5Qq+CYG0#282V!_r9K=RjHRE711Es&~&~zTalE-8P8n|d?dHz7&
z!??*E2pI;w8J!Wz_;J?N%@@eUSI>CURr-80qP5VrnC>F*BFFP+t-CXZx<h$pY^k<g
zTY_!o8#_HA)M(F9$-rIVmOKI7$q92Ox*tzM{_#ntSbpl1d-qL^?;w`q@`1v++MM|a
zxAm&l1?84#$*p)d+}?Z7*R8G^hIS>?DxKFC#=ma*H_mF}FTd9vsf=fiup61N+Gk<g
z_wr$+C-bj9w9R5Y(lPY*`xVBVSKB-u6z@#;h^Y9HAsE9~j~Q`uTpJflOG5KW42$Q@
zx1Ahz>-CGaC)LxDgUP=h)!ma5I7}KC1(%emHi1@>T{E40XZ+TDET2kd&Mhv)DA{&N
z8@l(y=f26t-1rrhjgF9U3mTq<`Q2b>x-hQAASGIXGzz#dA6~rQVWu87fAAV0)UBNw
zM}b#XjNRTOOX9Mxhzz~8mlBzs^ZON5R-Qj_-(?Mf8{L&VcsEaU-?4t>gB$Tx#Ag|-
z{Ni%EXHq+}nONz<*>)3=Wrp9AWZ@<^$1-1^d~o8<e!Io5nEYP{{}DL{?s%DDo+2B%
zE)8-$CsQTo(ORg=%~ukX<F|0|`=Eu#hm*A2OcYW*?QEtcW`GySN@2TH8MI&m^Fm1i
z7}oCVPO*lUs}w&4&5w!&y$F=>Gdd7hwvGfXh%>fVUNa)->S2l|f|_)zeC!nqj=@I8
zT}SX@BKr}hK?$NMtL;gJ7c>^M3}>53F+UDe_WAmYRQILE@l~??@XA0&e(vCN!HtN`
z@k&e2l?;z{A_wz$KMS{mN})Q*KK!lf4Un~tV~*>-=g)y2-zqO_T8T&d`<7g0tFE;8
z^(6aW4Rs<~QLyQ+@iAh?{KwsVt%GWsm@m#q8uq45%j_?%2ExdUj6T_5Vu$0YsD`Y_
zh@>fDo6R~}5j))}Jh1ZVIAIa9uzq+iO7A+#opD-6-vDu~Lnop!`e>HwasqOffZ2~m
z12bX0HeTp^9x2#YYi(I%{5)y&^I>%-$p#^NdU^YTB*53eV*1c^Y|uHqkob`(#}H$m
zwn}XjAyo!cySHpVF|%xBB>>Aq1Dol3V?#pgxoiVQKuE^uxEE;l7OWSK8y5&83ogKe
zyXspv{@r;Qk6(QZqP%f_cFaI->v)gP{dkY`>Xuawx%t|P{een*md+kS>`85M8NA2D
z5Hu0#Y#B+k5RL3i<~8N-WfB$WDv(^wUSyAs5K}p3siQOuiXrA#40@)7M~t{J04Rhb
zD=uLPYN}FXVUpDF#he&$M2>oK;Hzck_4UhQ*Pf8lq~+?CaFwAYn;A#`98)_I_sje9
z48C@!z+|r_A-JCrkdYLHh1?yLlD?<gq<`$)_G)>VFR|N|>BX=<pEFh*sz9wk>r{=j
z33DsyY)>BvZSJvkpsP+EITMz_>2DShHn*9<Zz&>jEsKs0Tlwx6hBYr10WIqgy6nkM
zRdk50&aCF=`qF1S&(3iCM=LU+HHxMt_lM?XO1sbj?X&uUKY=(D|DQ)dMTCrV2>)GH
zq>(<`+p+_Nwah)mNb~3_6-ct1hRa+Wj#DGWd6_>?|3F}vUH<g5s>G;jn3;X@dUrl1
z7h22Iv@Fl~j-`W$EGIivmiTJ?3)j`SclD5-ml7gzWU^9wyX9>~O^~+l7QEsI<rOIq
zZy96)*p&ZRdgxRqXt7cbFI~Bl$nsZOj855qTi5_aHoG|+BaO*gxFJ?am@G4ekC}Gy
zovI)a`u9BpCjotI-@xzXWOdqBtyUa)%O6HFkVQdfbL^Gc68P$3<sY2Kg3JzBZ!GSA
z4uVAhNZT58n1XJXTq~>4>r$3nXfrK*hj@+uA{FxB$z|RY`sl#W>TpZ4<mG}a%HCwk
z!t}|oQA5*sQbeH1FlzMqdCSWCsv2(s;?s&Xnxw-X*GS;b%<!>|Bh+Q`IbM1OQWBo`
zdN(|Q8$%L80F^>O_kT|*ukegQWn?jCkkXn}7+meaQ~QD#wumMr<E_wUt3uYelLsMq
zZtRzn@C~r!mMN{&O;}BCIA`8`Mao3v{_{uyb)pv}r*MiNBN&085@S4=-_DB(Rzt^z
z1z;V!%l>WaRnzESdBuNQ!k;H*ECKxm(3-Ef@R9JmF4l}{l`Fg(ZH!O#@bp3>LC%qL
z`RLpn+IUHrf<d16!EPMU=c+p>BTI+xeH()g%I9KJ+I#^Y-yw*%8wNzN2j}dR!5cx#
zVicd_E<NF&F@VJEHd+Y&ceniOoSK>N+1Jen7)#;vJ5n#v8rM=nx^DJUE%dQOhLOM9
z<xHvJRi0cb6<adlO<c)hi-;dkqc?s6EaB}BOTG8HsX_*L&5#Kp5=nb)7G3RA+U%G6
z6lp{ji*{y4w^bZ{`RG3xt=NSCXj4eRf4dB8!#iU3w<rJeZHD}%UNYIQuLZfinc3(x
z@4eprXuh5uv!&P|0(W6oFLgyagg2uMQ<nK*cYDkXoeLR^tee)C#c!h_z08iC53ZW9
ztzN$KIWU3r{_acHs#onrjLyIp-pw*+`ZQf@m-D#0QVJoD6-Lf=^`NRm+UIi;!4Iy7
zT`TeQbSE!Ow$Z44>`x*Z@Bsh7xBdBaDY;G3A70oWDEXH=_U9q9Lh;@`Z0mE}O%{CR
zcPbb&T7|E)^n9lMT*GYi;8I)db=W~zTtVs9iM8^@Vks>gSEwIZ)GJx?!TpP2Wc$ZO
zugh#E59A+1Se7rZnMEpZ=8|$qahp-Qj@^v3ruX1=(SS+pwrPfdJdD~3K^_=y#&s^~
z!<?NK1%n)Xm*xkKqN%9ee{8>BAAWBqcm{ns*8bp7;kE)q5gO@X9aoVeq$;FQrAkxL
z73LTA;hhM^qO@YUVnAUj;$yCORRJ2?&~z{iA^90Az$AKy{h4V6Te-g^yiIq@Mlhs?
zQW@0C6oaWs&{^nz>FtSR*?d4E<5g_qGFn$O9MdZDues@8qv@}y>W{Zpp)!q_93f@5
zp6CJT>O>oir7=tlGw{M|wjra<ApIfdD92E02R?7CbLSrQ!~>*cd#w5`p%~|RJxMQ`
z{Fqq-J!$Y2XRq@yo{|cS^O-LCB+lPn?{kFzL1!w)tY<(2!!8VLhftJNmC{{jm1JFL
zo?*%eV*UQEkRe3L%<EyGAtlPNca(PPHmW0pGgD-rAAi2f+pFpJZD|fZU!=fN_kvb>
zOeDvpJ%#`O0|wL)2z`=9Mgpmr*spTumAYW(0dT)zZv8sFQ4V>Y8kSKw%~WN10Ds~H
z&L95ylJD|5F)`+p`Yq3XEi+b$5vf3L^Ih8))3cIY0unIPWj-Vl#P<JzcmIgV{Q|!K
zd!({|zk6O$d8octRD31sC7u8}+ueKpi`oJI<0qx`Z>f1PlUyi8C9>XJ7`P&B*_!EY
ztGWR)JK^13FW;w&HA6Z#f5jPrAD#H{tqeiwM=Cb$Nl{~_o&WI9?hC-Xe0~vuyFeQL
z=fYVzgjj7cXbsmotQek(o50u0W#kT^ysRDk+@N=nU16F{yFCHs%)7_DY09nXYOPh7
zvyK}2v!4Qv*meewVV~j$-NE-)8GimWYCZk)m;GS)Cl_~c7gq-_X0RZ|lY&3*3;3fv
zdw_I2Oghar(<_ZN${NF7S9qXPa;G;z`FxB!w7lSh@2f9?dXp-eU=PStxF5dprC0E8
z-8BNH)C!v~ohRC?GxsX_t6#F$DS;+V!shOa9!rvX2`6D9e-TN5<5B3hBpC4xXgUPR
zzjV=?P)hP(q3TbALYU!gk}O|1{@47>pGpWAl-X10Cv*@__r!I)g^r<)4a4DF71kV#
z;({?xX&&Ex5!sw{mJ)(f1ntFY!K>&;KGqd-MkV-xNTCm}7OHEiG*|6YBlV~kSUzS@
znUkHoOcp~P@>dB&74bk_4{2;`{Y;WX&HuXUPt{kevt=zlWiw=cCr9sQrC017>-sEz
zAzp+d9`@qK#YM{ndgns)zf6Ie4nJH$-i`BI(53TG#~Qv`_N5`ieaptb9$#+)Ur7;J
z);3AzeTS<;v`$G$*na+n%B^axWanOHdFLJ`J}S^W>jPkm+T{moKUb9w6W-PT;dJ?Z
z#Rud)8U1^kSmyKAub8MreO}Xl0q=h!Z~zJ@W_i92bZa++zR)|+MCR(bpguuuq9K$0
z;<+9+lH0Z@=S&^fJ;^H86U~^K<$<J_$*Q7Ma;xXfC;M^*y-%LyHQituu<>xRV;iLQ
z*mJ(ju^p%2|59rqk_>GG?CJ*g+f?Xz{f|r6zi`n6{&)6Vg@NU}W{2o`%%>71>6hRM
z8)7c%D{z6!abJ4Hba1n69qLaePHq7kQm5t8HKle_3$!ikY$h(xp+4EIh|^q=JeFTa
zIsM`3{%5xT_q6}ViI6(*q)&4&W|kW;FW<FF$t!+a=JGNQ_=>d&H%b*x$il00sHA<j
z>R3+Xbrcte-`-XyhQB$uQnAP+Eig&LEPrYyIBc)#yFBsdQ2giDEIqtC3i8j;@kgD$
zDnrt)=Pxl2CLY+D7x&x(yAEFABwR>+N`6XaAu#QRqMfhh_*^^2P1w;kn?#1<ooxVt
z0$;flsWn+GnHO(i{0a;|ng6EgJ}3QxIx6A8<JK5U!NdONuIIw;X^%X0iJd6{0D#?N
z>X~1NR-Z4H5x90q#WjpcyZ-HNcSlb8Vpd7IzFX188L^4U(bV7PssB7!77$B)0FT+l
zSQ_TI>5UZLtVzJwu2t+`PM2h1Lu{Q0%bQNz?uydAaew~HS<<d#uy{`bI3g~_tB~oj
zo(J}>t^Ij&%m2c&zb$^f<W?oPv2l#0x$l8~m2PJKYjVgE<0TmVU1@v5dV;FdIQE=m
zV|<h+{V&3pi?xc^8bxa^1}?_!EKZUynF`kNWuUn%@|%vAQN|DFOR#+gjTD!7c~ShC
z&o@D#_fQAZdEm6J9KRH;_)YG6Zf^n+;^YnSQ#&>-jVb4cq}?0+%bGWlFTu`{AEe7J
zhywZnT3J&}<g;RI^KY8#Dqee1m+&WPO07Q_FW@@fEkh_zZ~{@4*mz3B`y%DHC2dAw
z<p%=vFZ?~5(<3F@OxtWwW%%IBUHi9+roKfM<&Av0-f?wR|8Tbm<n<TV<!?>)*W2&h
z0rMm#ZheMdi*uo0^zLjBpI2%^&2L(j4S=itrt~boDD}q^df&ohDOSqLy=5P%tFnui
z)6&)zYC;b}7No88(_-5mhzg`~m7g|<8CHXE4Itm&w4*=a5X<vPCT=5*yXHLSTI`(f
z)$cB^4oK^zjVStJR`U$2hGTkTN0jP2dG+zgj9G6NsdL+7$?e0mE^kQ+0Wd_(wN|jS
z0RY-<8~52@%8{6^A5Ok7CSv*DTvR3lzb+m}15<p&jp6bxBt}%}oOa>srxVmCJZ9;P
z`zYzEh%Zm5qp@uIKm}ZJH_oLuqk($AGo(!4H#+RO+Bzruep<=4U?4No?=I4ae|Lbv
zOw&3cBO9t+5Yrc~h~PO0XCO0m)dEK(iKR)$x0!53+D6~FtTN97n&`@x;}1DKu(ss|
zsq7Z2tC_AU(*os!(@lS4s{Fs;MxnGwJ~X??y$Z+4lNcf^otw!!Y{^Y?1#Z2YnkB&6
zuAcUk+&)3pw9FX8wyO=VqMm2jDpXa&pVmKonKOq0J-n}3{b$_wALqELXIUqj@S`E=
z{-^yi5-Jyw@Z1#5h(`m4Yi0+^Y#(1nOFkoX`AEr7|7Jg<p+SX28eY4R4cq39o*Iyx
z;8u$;*H|1j#8h!To-4}tBUXkhU^)n%kNsyh_+K;we6D~0Ii$c)3d8)!+;SauIHCYv
zdO#D=7xk3fpUj-_+9i9eSA%JFP^vEeD_&Fh0<)T2Co9-453;xz3qBQsiFYZ|o|Z4K
zQ{<m=jxqe^Ix1P>c<pp8hpRCeB~TH4#K9OrK76;Fpn%$pp!wlMB-5BFK`nViiULf0
zYF>`k9>T45Yu~%Ayk1wBx_e{eW46Q+Q*;DY*XYpq_0!9Vf6+Gnu?>MmqE@z+>0H3V
zPW_ysx2kbn8J&Pjr3X=2$;pD+^d=;4B@vTRGn37i&+BpLc|G`K)EueEp{>?D064KR
zl8ZXrW+!(Gx0#v0{j<OJ=c4yH?$^xSGfsJ~HNozoXRw~rsWiCMm!~f@9IFUPkiA?N
z=db*h2L}Nh$8Ns%*fi6&A`*L~7Y8yKMeVor9wt#?U&5gEyUtO`;>F9+y0CLRzf*EY
zH9`4NQPudtj(NuF<9OEhK^?0Uzz<;zPxTOc*7Uw9%imGzyjeDCc6lNwg%?F=Y|Rim
z;?L;q|LOKWdupADaq3IaDs1>b=ir5u!nol6b2w9n>10ZvfQBhQh;?wpJgk0VsT(go
z1g@L;F178MH9MewHzi3jrO}Z(U5Wszj|wbwwPq-LnF=n=JN(voya}?zO;-~)tK=Np
zKFQh~^MI;Uj1F?6T-ZrH_7)#mZsw(*By$bYu4}yWisVu|%qjYmvs}H)m3f+~FdaMB
z6GiAPgZJjcrNP%*+%j(;y6!9yF^b}V^-3~yet&mWZGYFq>!<eUvGURl{`22}_$&uJ
zBl(L+_4ti4t1ngsaGZYL<)k;JjHKZLmz}AY*$^%XdU)lgtVa)Hm>Kz(KJ}XFW<3Q%
zx*p$bf5=NlO$N`!q>g@S0zaTy`zv+-kHdbQ^||Urae*}Q(_Ln$!W!&wy{!1ER5dWY
z+joAVFH$cL)J0lp6>DZil@27DwdqHSg*EoHmeDm&(ya7lcjSj;mC=TqMVhhHa*<Rd
zVcTByn5ew5^58luP&cTkur3PuHjRR6sVAHL<JEtCm^Db4?zQuR4t~uIWw`Q*r`OHX
zPB6MJ%pvTfdbYwqes9pyTW3%-u0VHwh>Z`KL0eY@GHaV>2jd(>AYP4t&-c#V+kc3|
zkC7Akj$b1Jsqkfzh1}Ir#dQd!0HT!R-J%B8_eB(%mL9L$b&0emy-V0Cs!$PJt$FVG
z8o#By<T73o?Pz0wRmh(ttADW8Z>#L(tsfbpqq7q*%=28JDupU#A=Lv_>$Hj#WItEG
zU|15Ukm62u(Wl%8(xCQ!WJf@gQi<V3<W#IWhReg0-@348P#@0TnvzB?NLaMFFqllf
zkdqZlBu|fOeWf2iziTaUsjygqcZr!&%XmT`vA49#*{2}y-}xIz^PD{Zpu8r>okV|^
z?);IB(<?3$TPw3F9WZ(mQ>sCz#qRh1hN=LYt2LfI){t86g+IvEl~s~Kw%nZF<0naU
z?;<m)FtyH~Zl#~?2I}^IIST*no&R}m^+85wNIJJH8<Ab1#JH?Cq(*8y5=PJVtRo>*
znV8CVD`A1$MOY`hWXoA8H9u(4Z{i_k3GGnF2J`)|xlJ}F4*%d0{2Ok(B*appVNoM@
z4%J5tRiXBK=?QPk@%8a_X`a{%$H8d5(sb|W_#xpPG35~z&w6uJd!q{(wEl9`{&{3&
ziTuYs#5YUDg_S-ye`zb{x}+&BLiE<o<~2hyw+W?a+|Vc;1E1|e=JvYW>`P*l!e>VR
zA+})UeIW%RvnH1|ivqtb$4?;f|8n*I%cc420iN>($R8-U_4W-(7sMdDQv0972T^72
zc9f9;lLX(~B(MCGlvku-XS(XC+s=%)pd)~d1nL4uSsU7)rWK)eTMvoq8#v8=J1tH8
za@?}a-D%DRONB?lxl7rIu08jZF=hX!I$PxSUY;spuDjZJ_DtD~^n%d<m?XS!kK_+)
z8|rUQE<Gw%m--DV`2%lBK73M_=ccrl+#~BmM*;LhXlA$~l;_|9NJ$_u?G@WXK97dB
zJtne9JuPA%S}h?a5@#JLaawyTX&>Z;uPZFvN4-1wvTP2sgz{@s`R!2pta`~;)0@S<
zR6zTJyHtIm@IdP@w**=KR^a_T3jUurEYi84PNs|OO!g3h`tYdU#leXAWb}Xhuv<wL
zlI&)S3)9ceseeD2FB9I5iL`nFjd!2W1A<Cm3^&>z=95D9-hg*f>FOwp=|6g6tdtbW
z^m`Po83Ly9(jr<@BSV&@zg?hGS)V(<4m?n?hE1ZLo(lrqQ<h!wMH|^wta)qXKaN<1
z1F$AJ8{U3lXqSlp+H|Ko)Qrl>n1SI5Kl~-Iec9eaZ4Y0>3*Lb*zd>F@%2@zpV3TXz
z6gsa=!B~BU<L=h0(n)d$i$yqFlKY+Bve<P-u{&#LQD3=~2XDJoWYm0OzNn$*@?Bev
zr*8PrH@KYt>^H{v{Q70<gh`YqFwQjUxNV28{ZKluJ{UW_q()C32L?PXW&!&fOY+=T
z$(+Z}y8&m3cDbvpy%Qxl{64E#!Y``2#!toMw?o;2uu2=cX?I@v1?0`6&yCi4NZ90Z
z%U_)|3RV+{C@R4Is}_I}zJ70KoQ4YDTQkWR6O|TTxKLihLD-z;xgl+0Ep3PveQ#M2
z;3{28`%Uj;vHs;LA=5Joq1r=9O<g(57_Rfz-eQNWT`nk=+54*l%UwZW?4xV<MdAuR
zZ;7RZEFD_87F=5>EE7X^z(y~EzFD<Z>CPy~vuNY~ul4`?lka!|^U6yAz>naR02bBH
zd`46rr3lK_uB-a#n>}(J!>rBP^QFHu2&4~W8eXZ%)0+yIRxjwhExWYj6*}zj3i(pY
zcHqh)o?8j#<Rz@(w?<@@_$$Tp$g<R6WI%enIQ&g8POkv*<yw`_TA4m#t5{Gk*QyI&
zir_N2HtToIP!W0VJkJ0P6I1gxeo}^oq27Hf5<k;~H0s_vV-RE7Qhf%fF|6q~?f4Df
zhMZ&TR$?hf)R#nDLEP;Q_M5J5Yp`O~jZYw7H!a?Yb(DpoZSK@-DxLs>GV<_Y_CyiC
zu$s1lOCI!hVavDj#V2WWrpHw5f$H0FXjXaOCHvYY^sQ?-zqx3Z8lI67P(hW2j`CN|
zAs9SS1Tn|sQ45^vVvJqve4Yts!OICO;&2tXlUJr2r3hbEGmbo6Yy}h?sHYt4hw*Wz
zy(7moEg$}(2mB+z%reHixfUZ(P}QZ@FI_aGVA=j@hSIw|hM)poP}Z)T-pimg&+ma0
zRtUPpwoA!izchG1xfOz`5~gCv^BiVp7dT)g88whrtN4xCCd(M%-yLR18<g&UDWQK6
zPubo25vHl0v@VzktPxe7s^61i=krzXht+g3Rp{{f#(5SQ>JvMYdknL&<2jaK3j3Xa
z=mS~7?*c;lEWdmtpLLj3wpA8g9uzq_pi&@5XI**#WUpl#dU;4S@BdshzrPUL3}5Z;
zUJM0<^y0}$T;IK|c>J4eIKEELDuB%vo8!}_S{B&Vn-zSQUykHU4=BjrR($i}$I#%p
zIQN&HX_Mgb#G4CIq9#T~^a7^3Co@onn`miw3qXsYv!1%Z2&BsdLi`cisC0CY&i{!6
zB0PSX<40*F3c0wa(8cI!4mvI0sD4y33ZjBxcm1vi-yw^LsWGK)4e2ih0L}8c62@|q
zi~YC@)1RQSq1;lMK1uUjfKo<N3fS4p#w0wdR47J(GJ>I5n<!tMUWI?x<Rk?ZG&h=P
zx6FL-Fl3i-J~t$?SF?B|Vbqd-KOxEU2esNI4Xa*zhXMnFkp)It514BL%l(-*?bj%S
zt|C1sR`Kw$zB5-ripJUh%H{kkx`&M>xa~opT)!B7)Im3=gUNAIKV{iMzK>1hy!o<@
zLwv_s;o>!~7d7yzQvC^42omT*(N4e}l+xXvTNmsVfc9fMKY{}8_7DlEF(IpplJD!=
z8OxXgJedA>Z5E2ud8)khhNQ9(W0;pdkyq$oE7GEC%Jf&*sj$>!lepAF$Elj#l=lxX
zV)Uzx>-$!^xP<?fQVE#3@+)3*pjs?=pnmZEsE|)e2V?8~S?Mu#J|wiVip&E3TJy7F
zpjfeI*w@tjCz`n_>MEI9rWMQNIgmvrs4)Xr_Luw0G9njgc7MW#XNlS}-TBGxz53$Y
zO*XhMS=S_n3g3JvoKDqJ5r0`<R?@8CTubOi9gx^$xxqPU7`@ztPQ7PaumzBSY1z^s
z;hMT=@nw?6i#LX1+p!x;P2Tsa{nS=1HKjIK6q+)<ZPoXo&>Ix$l8TLUH&MMqjS8#N
zW+MX)oD1km<NBWzyiN0Y{2O*st)Jr5C@FQV`Uh(7{Tn&{b;2Kf%L<6Q**ZkvIDb|)
z9_R?^t(8rZRrkM8&YNm-;qaG;Bkc37VjV+Tgqu{HykXi>;;;ZM^k^8&JA%|BB23JM
z!(RHj4D`*F%b)IJyn3lkH*Vlhe38&ak7`B}@zpa;dhfrP%am{&j(3w@+yTwiZ#Ugs
zN%zuBK~&Q{jk)KDkXF6;`Bgg58AT_G#n{eScFs1-w$v5z-K&|j$lqDHN=0~mt6q8d
zAy*kDh9iCRo`-4-l^^bOWoNQdJ-CRskr9GB&40P@Qz)SHSyt}$xOZj&oYuCq(nQy+
z_pk-120YC&oOyOc!Ym(2u#)-4C9Wco_Ttfco72yiNr69rO*w+LsxO#Kz6+`c7M0bO
z=N6bRbeGjCi5+x+<iK-D&oFws07)mPm2_MbNNEJkojz6%vMp=)WXDVAS7SG08&ke@
zEiDL8T?7Mc9TA}3><6cDpf30a=EE7jr9nW#U@+#8Kh**dneO?~i?FCj^<D%W&zw2d
z&ZZBx5WUOfBy})zEVB0r+C{+_Y2S=p<{Z3s&ymJr3#2Tz4!$4;Ll4b${c>Nnk~AI>
z-z%<ua*xZa?(Y^>#TB4*u2Gk>HNf33WX)x4Pj|gJJDC}9NNp2v;V=<-$<rN^6W5>d
z&ba2J4On5B?nr=j<79$#Sb=rb$>VnqLepv}OFo^DnbK%ohA2hC45>lYyOlB+AO%kM
zJY7mfqD(f;en9`8Et5Pbpl_wWCTa;EbUxd85IA_O>k{cR;D|V9D{j~{wKl3eOcykC
zJB>2wO-NE}agd5I^8C;a>=wU8K_X>UwsQoXCZJFia@KXs>1|<BI3PURs*t^%bXcOT
zE`kC$xw2XP+h-_xFOJRXna3s=8jBk+-1Y)FLEw<NjxH;$`}a&%Fmu$;8eP5{<+1~}
z-N*VQW?(t1a45O>y-vZ|xw9)&HMrokpaktxg|Wub#5eh4E@^bFhOTIanwX8bB)QF#
zDchNMtu+#xcX{DEn`~Zesh;yrduvpIRA30N9b(B_Lk7nSaG~){!dR0CQ5kOTV)t)+
z|3z8tZ1ARyQxoy3UFr*IMQ&iF&fi9fvmc9p+2o_8G{Tn6Ed$aN2Hz7urB1$;Ym!5J
z)ju#M$Bm>ac&B>#bTcC_G9CZ!&RInmuEIjg4EGe{I}a5g>#j+Og<ky$$bM-WW@9hY
z%1=QLsY<jaI1j^GQOTua+`~DlDy4|RCL62Bv4MF_cE9h89)Sj&y$6T<N*!0M11iQ@
z=wXxqM|Qq;#j8Udp?_{D!^Q^FQ9l=J7pWnWxm~xiuG&HrlhMBw6a30$l?)Y9zr{dZ
zil_#^3i)U^>5Pha@^gA_B5nKT*Xdzt?EY-d08G-hp>a#_4U84Cw;M87A_^v@wE(^D
zn04yCLlx5My*+5mnvTM+qYW5=%s{E2;`=RGD|iylt_H6@%C(e#eAk**hDe<(DsIxQ
zJ?Tno%^;N|^H?;#<=ykpfU^PJX_=o<ym<q(^{FxzacqJL&P~(<{VZ(+{xx>hYvfcX
zSg;Q+<hCK=SG%)!uLZKtr`z>-;g|5ZyQJJDrK}_a&@T}2A%s33BwYbYYsgLd`pDD*
z>Z8KEY4hXrY~3@}+LH#sIBFGu*1xmrf4y~F<5`A#9gWida;jyM(=t4Xl?|(DTY%uv
zx%<PrJ_8sVTa-29ek&Y!$Lh4awFh-99ht7X)qsYHNIFe)!mX&hH@ZI0D?h{6Ik{wo
z)?~Digg|G?$?{~dYVfMx>6@M~%fvmkhn)<qxW*U)(W%|%t3Jp6PP0r3*C7uBZ9(eC
zAgoI5Vxd7xO9XFb@Ch6!iD?^>pkpAo#KtF5=Vy^``gg$0FG2=5WKYi)TOP??^lS{u
z1GAgX1nXdH=SRW=!l9s@aO;O2f%-3OROI&N7m+X&|8*w4U4Tc*?sQV#;0|Pxa$T+_
zn_*D%_h>it^PV!jr83SdkePT^YI9Y*E1*)$11Q<=G-B;Lztu9mrk)-)<#X|_bzYg9
zrcZ3C)~O@FCzvxY{UNRAYX9&+Rp)V!mU>{OYhMPwrTdVoSpQSbnHXuv_EfX|{f$mD
z@&NfJogaI?Xp*5jIAdM{KE!<C$BTDC83kM=4e~M^jfZ)*tqu})WYc~dQBDJEE7$$R
z1JBpg2XpDpwh_k;wL<jm{^v8WyqgrLjI$Z&v60y633J@`L0mMT{PKHpvXnHZXk~0W
z6%`939aNJ5>atb1d2Xe&fJNf3O^m(r*kwzzr>L3sOXB~fV{u*}6J%D1CI&X}k{#}8
zBL=qTDKtBt_BE*8I7%C&mMBDvt$f)56g6yYz6<@-A+&ywWY<!!0WoQ2@o+N?KwmeD
zk^D>;5`pFmZHQ9^0YZXs&cSp*O)CJwja$wo-YX+P(K<gr0qFUyClo5w<0?r=ajw%g
zfQgBC{eut3+V=7K)*XvfxR2QEEc4*W3oUhu=yg|{+LdU7`K{%{R)Bd+P9m}QiRH;m
z|8d@q9TqOmvB!FBu*=6)-hU`4acBSf|MDaPDxzeP`lXpq454yy!)*GQmrMTSGd+IG
zk4NSqV7f;n?MtqFNxQghS}Z==f3`HeDy0>V6*I3z;_@KT*;L@^V&b~3aon#Irs)`~
zw4saPaTSpmFazEwsaU%CkvTdd*?O6NZrt)(Fu*|LCyspEdf8_?9Ve9TDx!0Ss+-#!
zRKJ0iJoF@o^qn0SIFC;5nb)uH9oE#GpITlJ`E1u10hDdUmN`^9?bhb8uGms>MC|O~
zM0%zro>72|0%XS3u8q6$NM-&$@h#OPJ%`+#9ob`676bcHt^=M-o<5Chz`nKG6Df$z
zJt!ZO&x6cvpW!7cKtz73-l<^L77A{WaHN84BhR2SUR+T#UO!ZKpM@tV*Bj^<njh|r
z<&Xw7zk@zVn;9WNkF2b|8&orJ-=B8hW?oxz$2JsN2=)lMo@7V6c8HEc(sm}e_<{g_
zw<z7VKY_$f*kzN(o1%QVOSNGXG2+}A5{8{~t)$aj?FGAlG(BWanlwVe0}_kF1c<|V
z8hdV-OsrWFpcs6g6`o>j`B31lj9YopPxvK#*`x8!<(w@ASH8JoQHP_3lu$2GFG-Tu
zNDiS3KBpI?md*P~cbw=mq$~GVoPPXo-ttv3qrb6U0d!=D!K@hRc>-{JHip4^MBX;J
zxUPv<MJa9AE5eG%{yg1WnR`Zr;j`cKc`A~;WSAN5^LQZPl^lEhs8xyx&S-%Q_F}QU
z_b}>6@yG%a`@TDQ>b?`<QK|+y%;g;q&w^JNB&5PxLJ>K##KB||TO{H2eisejS`=4h
zoaUAkBKRs^U@LcKTJ$#@sAE2iWd*vP?96@iiP4K?)NrYhy<!qZB@iXpCuUMJzCvtU
z_EiI;<?fF3J#An4`MjA^<y8;!ce0t|%|vs{EtlOff@otstGV`A&rq4pQ#h8~YTC1*
zwK;@A2k+s-%)#Dn^lQiSl{dm0b%^tkw7K((CJHpZG4o{qG4dPlV&%ftTy!}*{k>bY
zo|KtpX|)C?V-)Bc^;_k7aW2w+7rwK_Gl_Ob;>+QD@9rTYJ0k_%Nf9{Yg*jEErQPeK
zugk-AXyIeX+;9?@L&Ekv<LeBu&(Avh)E2%qU_bh3H=#Ba!9xz*Qd`+Bm1RzJe1|Jq
z<cv1w(9+%bhyC9TFxcNsel5l-dO!uxmiW1;xhWI-l1s&c?0M~mr1QE^{nB@o(<c_&
zYvW`+hAks?u|sC4r~~c4#op!d*lhYwo+aKBX!|qvjuMNwp9G|_$lW_*VB(Vai7Q<U
z$>IsN-|xPRYqH73>~;_Ynix>Al<#~w%X_JOTmBYu;)|eX$M=ucNqS20zO!hUG;Z~L
zaqVK(ckbQsMVk997r&jpUG>i68CMklTp&gJls!V|)OBM8=JROF;*7C-<Y<|@vX8#$
z6wnGI+4<hf-WLD)$*cuNWylhyM|x0S|5Gl#86PQwN4M*XHam(z$vaiyz1`X4ayEQw
z;=!*#>GYx*fW!b*(`ATH|D*{gcGiUR8Y>UBcE+|$Y&en|N5RE)PL`;y3#aG639(<S
zqCEp!>m3mZ?hjlkcK{GfNHF!aO|VZq=Qsi_&7~ahIhAPYbaqo}g=D`+6#7WSH2Y+K
zYszEhhSU3g`iGw7btYrwA9LM(gv9QKpyhZL3@ve*^PPYkd(_yMGxM^P(D~a^ZR{#G
z#mM&N5m4&lzjG6jckluFUYicYD#j|wDs?q&K*UTiYM+$$KxIBRW*PdRv$jgbx;#8W
zwlnlGIG56XtEYJ}4)-7<QNX$|d^Dqi?Ja*8Jo%G|#|>wcP+r@~i|6yayI!<@D)2DW
z!F%o-GLeH8yz&y;3xm`^EO|J|N<}5yc6lbzI$Jt&9N)z`G@(Y0*aCNfJJz5Oz}L7M
zun0&qSy*-kvVlSg-?(_i`HU0}#d$KN>-5PLZ*k-Hk+uPqPt7a)Mg$u_DV`tIy3%t%
z>-@&$R^oH-0ixwv=CYopXu`-h_!DPm^fKy_6VjW|?{g+2wYCS2yH-GL%;^Wt3x-?U
zP3IyR@E_Zm5=z`&@VlscRqcQdX!-!JI>Y0K=p+?-#U4FXRU84PJQQD>2@r&ky){Q*
zHBYvQkX-gM7uQ>&8;_o$z>J@lYko{$4<udSYb_^TK*N4HE{iH`F_xEC_&mE;Y82AU
z*tE}3kJdaxKQI$r&;`Bs!*Z^)QQ2%I81IBp_wb?kqd!o47@k|om|PV%+lwlNjR&pc
zto|1o^HY*_3{&Ce0**S`rK?s2)xgdG<LML?Df9wqj=6q!g4NHIg>mInNEBTJJ^5@r
zt>ZVJpdkJ^<?9^-@)t|*Wt7R;oUEIxc5NTu))*M$mJ+h(W*B@6-=7_7uG0NQ4CK*0
z9Coz#wHdGDxZK7RI9n6mEQ#~=IJ%j>B)$zHV!0dIY+%=DHrY7JBZ*s;?L;Y0){L8s
zz8$-TzAJazYom8`pw#3kmGL7KQ8s@cwNxQ`&18|Fsp<!MtFg#YSEA{?O{v#17pu{m
zsA{dL6<87O$!E>1du;rax2(|HK2F5I#^RahQv91|=++iXnD1TC=}8WG?hgkzFV^hm
zp|YhLni@SWb)0S6!oZ$Ue0wkzSzcRo5^%P4BZ9lebJb&;qXI4rx9No+Z#9_!nt^M^
zwZTkTM-%q2+IL4wJHRX_lrqA1V-W0nD0e#+&70xdN3<t0Wm?a_GP(bWYC|AQFo7z9
z@4KOQ%F<v;_peZb*m9s?%UdFz36^|X{$)cGT+2scWU0NoxZ^!2&ZYROG)#2HJH+!s
zcH*W=A7_4QT~&l9uvA8wVcF%HL1zbX{H`&2gOZZiT+}Ki#mMlj<KIFKW~7&eo)vSg
z!3K253cdpl-9EPs%3_eNMdkfYQ4JeMioaF5<ZTU@vr*)S7}~a1sb!C@IzIMfyIv7l
zkV)?kTCw2|woZo>qK!`Xg>N}-wBS!{EIIQv?HGz(Y!0^cv!~M_?>SC>w{LKmLtOYu
z985!x2jB@`C!OAm`NH0{9QvLG&CHWX;CjwJ)E1FQY;{bVz&JRJ{HA`c<;uYz2am-L
z+j3g?5KeX~3&AJYSu?(PRjkgoZ%f?nRqYj+t3Kr8B&W%IEf>w1ByQ~(0Cow{u^ef$
zfC1(L_i|?Jc};SXkJh_wcMc1MvFX%-eTH*Q-V(ACv%|a|Q-kb0PjF|Bt#^_#lib&m
zuGVC?f+-}0cXoGrN5R#mN1r)En|^Fpp*R%mN*dQ^=D`B#47l<IhL&8NDRMD1B>QB(
znkv(WEmOJ)s#p97fVC=?dq)#*U`~B<Iw;t?hGP5Jlh_^|K*I0ACAH7RC&kbw30EJp
zMaZ^DGpBu&4Q^ZU6q@uv|5O@Y1i7?@I`sl^5ZRbVoDg86X_Jr=`HbpmmfG-ze3&0`
z<M9ukO^;bb3+A5Vho`TiyVoed4@0IP=P&0@w9thAkG=PdYHDq}f0d02TNDAMC`F}r
zB3&>bRXRxT0@9^~4pKx#I*9ZdrHV9>-a#M;q4(Yb2?6On1UM`1s?T$H-!aZP<NxJ+
z+Szf8gd}U-_jO;_oWF@X*xaw4?>lg&I<E^Wz6~$@EMK|1c7D^@+h#J>=XuR(rxxd*
zirBxWjW8p;)&|keU0Lg}r3fs&R8ls!|8ABw-leI>zH1$UR-t{UyH^JQm5VbZ9^#~G
zEb<nOir)eW?zh>i514L|c*kBSy+&B5$K!M3?xj`l^9MYfdb@m)9%0}K@9TjZ@K@{+
zAf)^?m<n{;zv|no$a1&a1NBZgFVSpk{LSZ7swpF`tALlNbgwS*lnGb%3M^W6J*^)r
zUp;oa&dl_zYo|Yjg#JwcTxC{T0`r*t3ct0ZJrBx6s~&CSU#n`p@XZ*JMT5N=Z2VO1
z(VBp71;e|rEjPu>#mI^SF?=cjN2P>+A8}MK?2Db8eT4tIeecU<t{O1S1Ky2I*>QIB
zE>UXq#z3T))^Vby?PCS8ONoNkldN5#hs*pCPD{gfwH`3XmB>l)Q6z=akW(fq3`&o`
zWCQEz1bR#{G<~4^eiqvL(LTT2S2U7O0KF2CC9SAt4U@6ehX4tH2YGm@OKY>A>$;14
zHwuv+?wBWXD)gbp{$Z(7E6ifqHU*UL*lp~Yd>Eu#9sSA!DeutQ78`0*dLua!6c6GW
z|3s4<@EQ;Ve<bRclHjAFd&%z386$96gXl7>&6Hub|Hr&H5R|WVJUR2|SVGH>I)m_b
zi}%(Vy`2%g@G{9O))uJ12<a;-%L+q&Pyz@U&gCB`)=X<y<^kvd!?^HLH+^O%OYW#v
z<WP#vU@yPP%}!zxJsu?MinXgKUT-)mNA~3FN$X*RztzgLJefbN(pCCqo^OP(G%BD*
z3)==YEubtdHU%+RP8r*lZn+<S?Qa^Uiqrp4llB|v^4?@~=hMali%k>dxA1dB#ad?7
z2<^u(xku+)jQ$!glLhv{_zKIhT|<`na~R+A6hSp_u6XT)v6Pnk%2GME<0f=V_wixK
z_2+IgY0gMFe)lhKsXgzsZGPUo04*^cUh5Smt3;d_#TGcK{~;PSB=zBE>5HwA(x;_W
zpEszD71s}93Hla>(55zf`6wBrco*dA0?N*Nu%g~0@P-UG8~C~!UwCWUZ@d1@YZJg-
z#S>2r%(wgtC7(PysYh{aoF|@{aRpNu<^ELT{HS+MwhaClO<$AvWi;(HZEugy8x{EJ
zx-~jl=k^l2u&0aE>lY+>3LSj&_nd>&xLV1YDNjU=WYtxP2SkT*RET!BQB9}%G_vh5
zo{0qU7h-g$$Zc)OhFj$-erx)N%nfD3-$c2lAN5QD%8OoCf`g;_74O2@$3GX%=gAIe
zNZy_V#U=8=JY?M$R3@_2U>4S40$xlMHyND=b2tk$lX75H3f$pc?`RdM@5bAZ$oiy;
zrJzhWdYHRnD9f^{WVEYZ$Qw(SzOAkNotKFuURW>1yQRHNqCHpzp+^8N%Z=V=T)W3i
zHvmUodr>B^wh$F5N?C7kTUptU(wXp4r}Sv+O_JBami11(6~N>v>=1wF!OHp(=+t@f
z#;-z_#&v&jwMYqVsrT~|whIxIp;~futEAB<-xB77<}Nr>BKq0d@AxNzoZf$6V>at(
zOR(WJ*2^=ERp0Dv<-62i<IG(m-=uLlhro`h7glQZyP5naiGyqA7i4|6SSZ|0w*s@e
z(iv%amGynM9M$55V8yld7}7AHqYis!_*y*c<HS1_4p45WXj;5A9+PSSFuBMRFNXho
zOvFin)CsPaWgDEvsD_faw<h2l@5sWOkE6k$mUIXkx!9&v&SX}Ayg@|ayOZ3*Pr=Ia
zx73xL9CHQCT6)_eAvs*z3NkMzS+ZNL?*%7hemz)(x9a}>O@&B?%f^aii>xi+1$%}H
z82R~XSPfDYDiA;XNE8&NS+E}8A$`wql;gl{P9-hg9<P95cKt}}<u>21zd4Wp-rd{B
zQQk|DLFG$PTMEqKh4(n4Ayj%fe2Qz7;L^uZCSe|>O2J=aG0dRBqRu>_wS~Ai`4rRK
zfDefs+D@4=o3AeN``0kF%ii&x+(i2)<OL4i<)aWQ7UhBb7}CS6*mJh#95j9CSZ}qT
zE!(<X@a~AR$PdOZA8%f;^krygWQj|Mt8;$t4(QOetq4Rqzyz^xd3=q8LNodQGr2Ut
z$4zVFVKRv~xT$W0X>rW;<+`e15YfyUi5$@c=H)NC&d@LQlKRgd<>U0Q-O58^?8^$q
zi)zltvA*{nq+m$RtIS9pNnEU*7r%1*()>n}+^(VFp3>R8<yBgx@d`2otTQ+WXV?`}
zy?j6dd6)4FeT#S~e#m;6^&>wHrd2>SkzVg&I0@+Kh}bEtAYXVX?q~xZz2F*B6SSG=
z$8(Uz;{WGj={c;lec6sIpMpT1Y3c_*EkIOvepM5b=c4_STH0ykRUa&<^*XnSPJnJq
z7$tJfET!6$wyQ}c--#@vDts_<;4$ag*)o7AKnC#HMaep*Y)2(EQ{2cpAw%KxshuA4
zE;=L2sZUExKtYdvm8r&xP|71#H6L7Dx~WjgsC<E8a(;k%o-a^DHAYZCJ=w#sWx+XE
z&Dir+As}LIvN}V-0VqlV4h4c&E>PM}S|xTaevi#KQ9P8)q~cx>gXg^%ORnHXmN~W#
z1H}L|yO!DG!m4NrGw|VtW?m17q(kn(;#1!eK!)PTaF$o&Ps0IQ!58(N9=6>+T@bn=
zz-W_R;+g%j?Ix+^cHldq&QwU3+MO42wXFcVqLcve`+@DcS_4^)cH8BMe1e;Iha=U`
z)@@Pv%j~uxcT`-4B8J7XTDKgRas~&oFky^lw*@(k$oR4|53Hjfr589o`aYyE!!XSj
zPcE6#Vp!H5+^C;dZ^LH*T;o!o&iH}+$qBC;vyG%-n3Gs;S_Pt^pb9>98#UP^cAqfc
zc81c9s7tI5xd!LWD(vf{<Kx@sm?_*1ceYboi}jOalUuEeIYMfa6rgU5EZ)0=ktVGB
zkAPwD?`K`>KRgI|vVKxI-xZHbrZG!-28?EXRZ)-dc+xqV&b<#8i`339S0xKQ*D1~6
z?%k5hQne7;6%(0au*D8V^2!Pa)6)$b_{{T(T{wF6pL_8?&+y6O^vkq3n^}*{N<8hY
zIX*#J@;f)oi0<gfB!lqviOy@Ag0`1<bM$M2GQuNU2~CY6DcvaYE}D7zJkW5-5p97)
z(dFR;JS>f8+UEcjmpg$V&Ox`D>zAHbuI+=a>Ng%}M&T7$eG3#)NWL`x?hc+Ag9Npf
zXlN^+N<b-l0*J7+gH<O<A#5uu5F27n^kbxrKYG^X;7W=cAq!8W`^g_IaM>#O@abAt
zPmXDXX6xNs-2;@;lZlFsYZ;tP0s`tpp{+%iA=(n4Z7R!%aZ<l+Pdx)7_B^@#<>+X)
ztFq~(HqMsHM!arzhW?Fw1BwGT;?VrRY|2u2z;QNK_|J|`<EZ@m$9|n<vgpXkKE5pJ
zuM&33((l7rBiyov*^Y0B*@by5Bbql*<E#h*Sk+1HE}KA+l4$%^e1u<6{nMKo4^v86
zLs(hu@bzFC=b)qrW{Ni|c36(LV7pexrNIMfW1~QUiOe#AVToFAyl|CmtBLB{{!Ong
zxi@J(Z~v(T-#EI<)6Ni$t*0GTvHejEZak-dQT{F9B>13%kq$#2w-R|Uh~nbZ+`b-p
z(oVVA(M)M)oo1EVubkUM2_EWMk#fIh3SbX+H6_hh6Edr;-_|faeqB$V-MT5BaNU-$
zF81<mrk)R%qMVdyUq7*NWQ~K^K-#&DU9waFI{6QkcF9igd%H81ARhm?KV;gZR%nI5
z81YbIPIU?&>x}-#Rng2N!oiZwEk6vvGFOnGLZP9^!goeVBd{V5q%Ezd!W&*eCe>^7
zsuYAgO2}?J1{U5+#`Wi%5ItrI&97L%bdhU(baZhe_O5^!ukhRe-QSMGzmI-@KUik!
zHQ(tukg7TfVG4~)S}8KW>8Q(maqB%L*)`nkf?Ye2@f^FBDfjj$UN|eW9r>S=3mcX=
zNN{7&H_oAvTBhCO$5oGd&e$jcc`0CtRRUyxLzIUi@~8RQe&(D@xv>~_TZK2hNw=Cv
zt+F`sD2b!RsGTp!+97+H;zSPl0(EvZ>8s@trP~;4djDLoX_3>Mw$jj@LOmbTv+X_v
z{$9YTHjXCO&xUhor>7PS*~!Y?s`V5J{v>2R9vk{HKUi`0E>%27<c9*&PIZn$20U9@
zL`#Xs);(pqriw4V^%v*2Fva?MW?g`j1n(>{sK3^=w_sg$oMTG<G}EGP*SRlVz*#rm
zWonc|C#&((CH0pb;1a$#X31~n5Ym@aa0E+46tTLf9nyrLC3bhqo0Y{^)d=&qV45I#
z{ilohZ*AU>2d+OvB8Nfi1jo^}oXgNwOi1)e2$F3|bARb(ERXB_rQEUWX7}QOBDW_%
zP3poDZ@gjs7jL4bIL}EE-wOnEo*y6T@1l93q2)laV-h~d-MMjw@Ao{JRhqc%PFpvy
zw-kN3%BMxxA{si5&V}FaYsM$6@**&;Tyid=W@eS<i}&?ywFhL=RzzZURH0f|Z5DP(
zq9z_2^W*5E|0%})^BMn7_`d8ZViW&oWYfkK^E&l;6#m*EYPt_E&pl42<mwur<_tUR
zAV~&%a}80Lh0kY7;s7&LA6*~6i27+J_$IrpjO3y+UBh^>F3&|L`f~%DM1UEV(LCk#
z^;we}kpyAJtsA^t{_z6Ykg`RGLa^DD5$^9>*<oj>2LZ_<84E3yf7}>wlU5EJ_{GMB
zp0L3u%uTt^lNwejlrGMJ7`t2b2}=WlUV3y2`L=?Xf=a2H8A#P-Da@+JOTfEl?H5d{
z(c-`m1K=C6W|`e1ZgK@on7Z^{Y)r>xy?F;LtvdEE6T_h8Qo3bm-a=rS(tSF#Han`A
z4O&}3NEmb<Es#7J8Wb{Xan`PTvl35tM8bPk#jp5Y;QWppI;yk^rgL0U3AWDbR~d>g
zzuEjdOx#|v5!mt|h1jOxDCq0b%{$-O1O%d0xI@eUr^K~nW1yG_q?0s&ZKVLc$mjIC
zW|e1tYe~$iqW99(j@8DkEzv(2SgRb_Zx}=eNwW+`7-4s+R^H9tGGvU>zWi7ev=FDG
z$N>m7h}>a8YA2(LuKMcGsxvAh;O2-EZ;c`W;7~qJbY#0dz|T`3Qr@9Q#a<%+P=`2^
zA<ULkZb3GowYoJ_xCNr73MtkleH+}wO&?*{=;`B4(6peH>fP4?*O~gUg8l;M_-Ppc
zR#2Q(;`)`6ft?<U<%|zVjO}*;*NxAV^Bk~Lxr0T?gw{41Xp64DDbcwEB&lS++XX~?
zl&o<3Lwz9W7_jS5ef|2q=AYu{-*Xt;V{sb%Oid>`#BNWe4EjsH=B;P!yCeN(sNaM<
zA1V4yZQ6#ll(NR$D!wk&V!qFf@Fa3hU~eF2rrXw#eE9`%w+@d36p*uj6vke?AGKBo
zW~t1oSX8B*;h^K;Iq(BMUtq*WV#Uv_A_J-;hyc!dAi(a@pRm=>{6=Bd8KN`qM6K+}
z*HDOCi=UnGivW8nu2y|}Lh0=G381JOW7r~rEo~<nJvSK70;h?75&B*snVrISbA>Vp
zxQ^4S5l?C3Ml!mxZieO6&r{O-8J$w#WsnTu6pK+hhi6oe;+Ow)%5r4mbnIuJ$TnXJ
zQ+Wop1`S0R6V~I!pa5^NKb5vpfgJJM%e`gG2yLIOamDv=vZdhyeU=l|<*lCiOaFbz
z^atTiOaE_+rU5MXlP~Q|#M@mJPjsI4F@D_{=+TLlsIW%_Rw2{46@?cEHQU%zcNg+g
z1|In>Y7P?(HeT}=obays+*2R;`T~U>hs!$1_5f}iXTxAv)6&h`gZ&dVlkuuCzhsYy
zw`(#(julI$Bnlz(lNA}(_Zx`dn#2Bdi39Ny=Kw6MD1e1!u|-4g%lXGDG*cU5m~98{
z=c>?6#Q=L&v2MSfwcwbv!tJkluT6J@v%-zjIU#I~se!N@;TG$w?y%VZauz%|;;Z-9
zHh`3U-sU=bJ@&kt$|9-w`KT$Jra4Z3l@fL<G8~!ltp1RkAla_mP{(e!OjbCr^k%!R
zxtHb$E_(u*>h9l9$)BBOlf-j^PsU&zNm~+-o3859(JmWEVeBEGcyE)gc_CUwH^jk?
zelgW6i99C~H;A7LpdeOP+0Jq4<2rGC1}XdvS9rZI!yh)X%;?P<nKt<p0##qhuYn}&
zsSH#I*fnokB%1H>Ou6vBUYoL1+Sj#6ESRHC`?&~U>Rlvw|4@E~8h5j54YMD|*8FYu
z6@6l^YX09&u)mT2ae|HX%1IeiS4Ilz&sY-3N;IhJJGGlPQ#*H)b%R$<$3!kW)`a9;
z;SM5udC}dS!2ZfjgUi?T3_?qVq(iXcm#<qxSd}61rkoF7=|d{!N%8Or<=*;D3-61h
zK6hG7Nq)_+px;xno~B!3Q84CUe|4e8*^-VzaLU7V(q&+1bA&7+3}9)B{zwtgAUAqi
zd@!;q*ebfsam}#C%}zke4fxW#ZSx+WGovry1%??bRnCW8Hk)Opv!tj=5<7Nz!gt&u
zQF}070*F*ASZbU17yXJKcM79KSG(6Is}vMPAw@dAhc{lK))U96jeoc}{QHz<!v&4P
zT}Q^OT;i>H#l+6(o3#3Zb_WM!X6o}Y>4G*JIDT1F{Gr0Q<+epaZ;`T3O#kB#n{&ZV
zQauowG3GtOg_lqJvYqrPiHWrW<48l82EmiZp&F%~%{s!erk|a%=WGmvn-`v@D9nFe
zc5c%M9qkzI2;nBizz?Kf7#2|1I08D^wu+gnxnR-s<tqS-9{}i@4UJ^9Nr46wOIpq2
z)95a9*6MU7M@V}h(ad=W8@_kW?Jk*;GsgL(WV_#~*6WYlu-n<T?>-*MO{2?O$wgXT
zoOf@%2`F1f44kc>RilS>9j8uT(9fSN_-!;jHybhB4_+y(5zSUIb!-?K?iNX+YB<5L
zr$66c1MM4Zx0a0<#l^$A%Unk$gt8MYswn}gTK8tJ<o;rDRrKxp;qhA*B-oOki;IWr
zwZ~fd71K<**fg`fDznxb+M$R@5z)4a^0ocx=ga{7cZvbuJ=`5o0*$njVOw!6QW<*x
zOKS}x!^WrDpncKpHg@g?9tlP_Vu#W`2U85%BFv;YQ07#`J`{+RVQB-chjN2Mg^>x&
z*-#UhxB;>xp$A@t0>*6ASm_fY-=kGQXVJFJ{OA_cbX`sefcodKuUUn8tPaJ`7gQKU
z#%deUANOuRK@;DdktYO~i<^IL)6Sw~-Vf6C-OMtM!&v4zr0e4TqwmzoRU8DPG+R)s
z-BAG`Pnd%naBqycPwVV}hYeB)(;*GO9g|y!28(X~SG;5Ff5$sMTOAZdy6r`g1b_9g
zQdbt%Bv+eJFa-vRN8NtW9}j0fC2t29doBhXtktZ~k6EUL1(56IOFyifPPxoA${c(t
zugyH(@ET6YI<8q`djFGYpwQ|dB7NX>>K0dtumzO8Tlgr3<Guklvczn~&MkuM)J+4s
zA-Py&P~_t4n4_G!?d6q4Q-%GsHKc7!Is>4Y@7J5;E{!?Q*Pa;FF$L4OO+K)%JlXP?
z3$Qf%l$#x#>OReW@hVnm8sLSEdWWtew&2`h+Qy!sIDOx&(I>Bzw(r~5?P3!6R%3h-
zyV~=`ZEW*$`YUg`3M!_rk!7bsrrzEDaq#trzB~tgAUNY>m|wFd1KG0W&gl_9c96@$
zyt!ph?vO+0WaxN8b$H1~Wc`b~=;_x1&_c4q7V!cy$#%MO_A9TM6{cynXrNg9`I@UL
zrndH8Vf7YW@z>w;U~d{GIh2JDxeqDRRx4&W3+s?yc62d{j*9ru3G5p{wGM4VsEEd#
z)@(@IY&SQJyJD|%82ow><lO1qxi#KTXImx*v^nKU6;J%%?Y6nJMKZB=T_;H_-nyHE
zZ-i|z>ug<$_jTgAq;79&yQ_ssumJ@Mb(t&jTWMcLDPz7$h20+4V{vCR2XW9g2X=HB
zhH4p9sd^_M`<R$PleyY2Z;oMD4KKt19<SB|OKQjl@E0@rmyPW|54|nKHJ`|UZ`Si*
zU*q;|7u)*{6)CC?-R5ztw^T$oA9+W)B|yL%ygi~(?n`%vO@jzeu_%6!Rd0@`Pjet~
zPuoKxI`A|6DF0o0QAf+#Jx_9D(?pNeviSK!6trC!d~(oSx$w?;yKsrl4|_*hcyZL@
zFblO!DXa83lrnDt3$9nd<Mk{qAMUzZt#Zki6zaXD#tV9&vO|G8u2F{L9}pq7Ee{v9
zX+LyaL02%XRd1JL6Ze`ft!L2y->^m<JG2a6>~Mh|#6nZGy*pyuR?>6Ae4s=KMja9@
z1e$m=xh)T}0)G_R<EX)5ajJn#X^{7TW3fU6sl<JYQLBM}Yezj2_1|t#OUd`>IyuD4
z6V?ahBzk&mepkyd?Bnd(Lz%bX5AU)LF-UyAaPE!qJf~0Vr>=w;h}&|%MFe?#l5o8D
z4kLlBT8sRm1z02^w@0W={Lxe8u9SG4g1r15Q6#&A%{Yu1@72XCiZxcxk=rkXWj^rX
z>$;8l9xl#$YczkiuHdpW;s`8Oa0jY^keq%otU{h3>N+~WF{o`j(^xJJLdzqo?tQ$g
z4SM=bFys5TfN8X}Lr`f}-67I;Xw7?@i!zj}{3)r=VU?0}SmD)SzHvQwrH?hZLT4kI
zv=Y#DnT|~D$wA?f{CRLVm*C-$mhRwUpgy4ZfY`HJJ%T*#t&n_!A0O6ZdLkPcAGUS3
zCpSBdseIgq`3mX?AKgIl>sGZHDn4-4gijtYAGx>OKu7jJSd^5Fy~@g|UUPky__EWZ
zO6dWdrN{EBS-%q6?2}5^7AVjyH<?sh-xxe(X;dDEZ*oyimHe)bG=Cr^c}`}Mq%ko)
zo%4`#*Rz(-Ji*nS08kQKmZ)&`!804AH(qDumI4tH><?VgLkE_x2FBhJR9?>E^#`u9
zIg4{~y4emKpJ(qLetUC)VwsG)0qcD~X-;e?;e)j$Xxrw(oR{+#$?yzjTJMc%8)g1c
zMp3o~=CJ_L6%J<>pZXr2=FY<u6R8Lw5=5Z;{<Z_iWvMrTfkqP2=r1b}$|+)3P!s0-
zL!IesgO}2D0%%KNNw#*XoLvr29GOJgHXRkOmao?bYPH?6-Z*TFm{k~X(D{}80CT`o
z0<unSfOceF>+`igeqv57=EY=2P(=z^R4B}MmT$=Hq4YsMSroOIL){f~_fAsrK{|to
zr(y)MYg-1G$kl1Engf}i==m4aNq%<(;5ZCYm71cVjeIH>%B*0es*4NCwKyx%0V7c!
zxc<%Z(Kmv(5q>ZgXZxx{49*NQa5(_keeU4$12{)Xn>^Zk<`P|{;1Rj*(@l?sxg$hY
zd|IB-{`7<x5<t{?PfE%aPN#f-qW^3&%WSJXr*j}jk(*`Qy+Km;Th8Q+_qHp!V~tCn
zWw^|EgY#f3pdZxoffX9oz`Rx*QX*@YhHU$93!3u4E^o^pVe*Ph-(9D-b(u;+{WuI_
zuj8-PAI*R!o;hdt46`~38;!U7A%qbWh(MEQ6}7|3u852E8@l&VDbA?v@x<XO=lD^d
z$lpw}6D{p-hf4m^S@e~`(P0LhBg0N~mop`V?(OzH?bB|D(|{<I%4`S<vsiI9CN7+f
zDcd6Aj<By`Pz`BFV$r;f0+tg6)RwinN~W4nKp@Q=%~CKvnW#Rjk-v_hI^W${x79IM
ztn5Wa0`RS!()VZlnC)xlKDi**1`Zh|zK{AmsM9GZEvm=d14v#434SL5{fE(!agu#T
z$}j1B7W}=RwyXgu0}B#w>vrQ-wyWxE@e7BA3g_FIX~TW?9x%+TS0duZ-)bGv`RqJ2
z@NAVX288RV1j2rW8CuVU6YR?>`>E<2ny>H{U%!I}jiY1__PVEqd~V7P<zvHrmVJ!#
zVFRb*$ZEJJF3&5WG2u4Pv(etl<Gti96d>ZemC&;UNCBlz!r%7vSA943-qa0@+cWVx
zzr?R?e6wN9d&1>eZzOPcHzRUSMagkRR^XQByPuEijY2B#wfs2#?yzt5+N=l>c!y*d
z=9S6&wW{2rPs1GWV6)shgkC~`)@NOaISplTb&QzEmel~oJMBxM=dlUz-VxAU9+;0w
z0f(xJ@jF9Bz~Lm!bChB}-L$YB@xfWsl}sckP@uTeECuYlNT0UX%3f5iyPuQhdxyV`
z?AFQJqX$cAZA2m45lNnzPA)D^>(h1Hp?>%8HxzhMLtotaJ(A6qn_1*tjoWG*{+z=K
zTl-a$I`P6nLjH#-YFNAb+$HGz<YlYKV5Z+Anm+p6NyYQ<Pje$d0GDJ3;>RT!Mu>;C
zz?a=zx{yd;b1@=)wq)>+)^e}F`RNgm<7{L3E78AH9vO*^S1&ctFw<!qa(-3Q`~+lM
zLiVTJ>5<Q3xk^=A81RkO41x-FK)ai)aWz~p>x}0%w0cZ-Tv&h?m@M2cU&S788qIzb
z)V44}?Oh5&_G{64>+*GlXLJ9KG-4WJ@LrrxctfdRLRik$Lg^b;<Mh6hL{bzcDL=_5
zQyi9;hTY2gAQ}l-oa>h6pvcC=rZq%V;LBuP;|N+^lu9VjCSuAl!e(Q`r#&A&RuEW7
zjyn$FY<=P#Ua0T+qcQ3adiZ{?^#kxhL!0OodbfYNp=K=~0-(_7S@r_8`<X2UroD8o
zKy$exRdljleK{pJc~`+Z%QsheFyrDjrFP0PvvyihwfWUnUgPa=`ur(bpohed-gA*Y
zN$O0!piyq9g`6F@`<R!4L7S?XnigMdbJ1fNd04iaJ2i*N*t%fE(R)S*f1`w%r+W#C
zR!JW;?t9+%SmC%V@#18DG@hqw7~$i%VAi6?=5gopb%N^_dWWqSTiSkwxzu5j1SNco
zgwBRU+$Su}^eg`)mYs5w{ulse{VB804YA=`flJuh^ZDG-!7GR{SDH2H2$ak;S2X1W
zrUlGDrUj5)YiE<2Ifla{o?k;GzjK<w0e;M5Tx;dOnx_AF@;wRO?s8;5hiuMCZW-|2
zal648+)A-1&Ix*gum749<cIy&NkO@9)y4S^Os>A6Ssvgx#ZUOT-5R?uK>rsD;O8?u
z&F$MhUo?+Fi?{{{0Pr*psmB34Ggq=LT5T?9JxCxO+)K<VzDFg&6&ii5Q-?|x66T#S
zZ_P_AdAqPc8wr1i4&CY>!NeAY^+3S)Bu39_vwwVrBPeyqVwZ57mBN!TjlcPwX$GeX
z2_opw!Dk_$L<KS{1nMhGI^IqqoXc2O_{|fz=o&!--s?!w!S@B2ox~n#eIL`x&oax}
z76*AhFHS!zyGxbc(_;_`KaC9zbCX@)1rm}v?Otnf>_ZueC_fId;yT`vpAuEM+(-E*
zZiNNFtwbvN3~ii&+5>1>3>#*P*fEIO>C-MwbP>I%Wx-#l&WU&JDiL3l@<Z6g5C#jf
zqpdob$o_2P(kJNSvvDh~cw~HHe&vIrZ~;P?z%iL2Aa@uJL3U*M+Gt6QPO{YV=zis}
zXUZ)SspnGqLF3G7gm03x@I;K}&6frbh%Q>1*yJfYY5J6Ik~K@)ubI<s*>LSrRfGrP
zV|G^rX~AW504=={-}fdS4h3EifZ1CW(c2cO!hMrrJ@^-iD0#qQ_0YdQ`OQ1Gk4eHw
zj-$X77<#ZGhW>9HXI5Sc4#!D7c>Pt;P9FI1n}YIUzt_j2KVY1~#C`%TWBrfhO)d;r
zd|~1-;=1daCrx5?;Wx431rxP}4=T3?z77Jycp{i+ff8{uW&E%#7c7Y0Xm>MO?1;Ul
z7EruRlTc2*Z1uP_Nc;>pK@DzH+5JuMGWm%cZl>w4rqU?pcxzWN^$+~hEK2r08ki$Q
zT7{MN-3rXU%=xYcYZVJbedGYthMT!ND#(GjhC#us8Ykw+9hG_bVN#xm@Qpl72y?tm
zwuJ!flZ?2ve2bynqYyRKb4%>x&@k^75X?{}YzvSW)4IB_GViPDLcM+|eSe-SS;dME
z0L^&*EKT{gr_-aK{JzNSXeeTAv$VI%7#}9IA1DCymv{GYa|}0x{2@@?-b5&axuoX4
zsL-C*QVQpl5p^E|0HxbzVvm{5&?megELHxK{!*-U`b-a6s)^27R?t^6xncI6FZbJc
z7hFjD@E-_ga?;o(mM-%!N>ezyYu@&T*?q6{&UVVfO2Nls0cT&4c6ds%G5`rL!uq%*
zpW7$SvazQwkwo?8LsI*!m$sz7uT58%T2-JmT!i)Qnm0VlZnu(2+6T9`ybHv(I9i5L
zE~<1HRM77x+MYRx79bp?rn>V0fUE5ntDSP}YNPY4^73PgE#4gHCDA^Tqa0y)_brkq
zbn~tt@>-kp!`3VdO>w4+4PioV=i_%b@8C!4yLL#kbDO#1m|&!wXMA_!Kj?w#kNG-5
z*?#3}bXUp-jn&<yE)j>`>BiB}jKQyU0bQ9~$_*CSxfj-4pcWf#9$zZYm}u(KSoP2~
z90QS~v;G$w$-hS#gAc{^825{fP8DrqxZrwaP32mC1z<Pf7tw(&3nMfQut$o?5?Le)
z52Xy;PVX7Pcmk`oY$0196@CVml?Y=qngZzKU(X9a?H})z@MwnU+DcD!_37%!Ipa{d
zN%+RX1dTa?Fctl;TzCb@n0A(IiY5^7+W(f7u>!I(<!0gkm8^``Kl=w7Gdsmh13;VM
zD4d)Cg>&pD3a94pKPa3w7JpDU+5bi1Y{(Z&X?)sJst<^Jo@$-^2g2f?wtMf@Ki^6q
zi`opB(EFgPD}k+@HNQ$cG&;44psJc-RDLp+K!FbN@InwpXZtrGbvEA(E5C8${XOF1
z@hhE`Ha1FLFCM?JF97=vF&CXV0UBrMEtRB9Eg9t0AHWe`!U>N{wEm6ZEY~{=!>Nz_
z2gA8o%QtE2gEjZT{Ev&mRTJDq0eDB(cX)@HCMO!0e@_&0b%*q<0Vr3T_-k##)@3q<
zTMbhB^BONih{IK!g9fPA!hog$Qed+>h!sVeQNJZ%0QAjY^_@{F0aP=H{Hfwk$d|4k
z9L}<b46J8xII}R+WFLMs=PPu9H({1I<D>a|5duW+?96_)wxE+S2_F|NMT}k6$j*&B
z<$Swk9>FDxl5*6@?n>mxYmE%k^BD!+dic%>D$sJ|eDn1p%mTxk`j$Dbm7M<xGcKNi
zG1CXg)XPgh$;-@vrS5-_mrdyT3|Up;IItRa8L{H1Zo_ni_^s5CE_j*XwCH%97lF&_
zFeg)jINjylPDdcQ0N4W`y|*1HgbYG*U<&}5WB&bvf3DOY<r9Jtce#ekACoCvzv5Dg
zhO+)kj5cI*Blg}SAb=f5?S%hB?KEEFP@Y=;H?`CD2etEecvZuG6v_L~{POSjH3nMV
zDR9#PJ*twa++>G3$!9f)b-i#~huWdw49Js?Y4uj81|3#RLA`RPz>xu`*79({a|@oX
z(t!%06LsN=aeLI0I?B5n=L50A-J<(nbgW~C%<3<YhXA2>8##I*E5OIYb`oqP-W%vF
zkwJB1IVS$&60#!x7UhbLT#7M!e41YYCXS&Cxzw!VV$JaGTo{YO=Lp+IV;H-Z{>NbH
zbI7}KBH($A7=x`Wi*8wEuESWB?Zk|fmMCJ|JTN2)`s%n9|K^>I<braQuL!8=qOYyM
zJ-hr!Y3#vn+(a9MIqgO$N3~R^aE~`+W6m#F@~W8IYr}5%iD_%+lbTdLiW=G7-}b)?
zLpW-%zYmq>yH}$vf@mLjJq4@*T+{=~f<E6XcZ=rNL>waJm=Za>RQO%_>oda5<BdUH
zihOFaInUF8Gq8@t6S$pQNI}JnIft&&F`QC+#PF2te*aJHco+??8MD%dTT;iYj+f~q
zR^upXwItZm+0s8N+I2l_l+I_onxUd^%He*<z{M_bW%2$XJ+#GQC_b{Rmx)-oa;N4H
z@E}nfQd!dO6M8?DN`GP-bWWr-&Zyi0i@=tougf3L$0ZlqS)Ghh*G|7lZUL<HWY52U
zQNp$HJae%NE13h_L0tkf0$f!~Da%{hI@V>C8<V{KYp5w;Ktj8@S|Rz#EF;gqvSxzz
zs7;c1GF}0DfFK4;aDkfeE`g(z&8Fw;7k$4+1zudpyV=_WqdlU&?l-zpvAHJb;Lh_Z
z2PbZ~#`Au2Y}%^1t+Gv__jD7mNU0-QQP5yHrc{pdG5h!g?qhNE#2v}`!ky+!{Q(q)
zSWE*f+u^!>*sz(c54#6107hi4;W=p@99%UAwaci*`b#IqlYZ-|#j_Hjt&ibcbgwS?
zk+{!5^e2J9CA4$y)@dj%yX#q1R|M!NWxECNaFg#(?ygtXS$n6aJwOCysDwCoi-LSp
zhmWAlbnu4Y{{CvXYwm-o9p3Cok=7LFo?A2C$F7q@r{xEzE7~X%-#oKqhBw^RE&Yj2
z2tdnEk>)Pry-#zR_ba{?(7p~_oqO!J;DUd0zUg!)<DtA?i%K%6ROz^<!n-||Umn}p
zOqo&S_cmrbsHsQVXYGIw3Zw(Pqg1@5Zd6dTMI3WFq;^cr0TFahs(<@JjxC)~k0ta8
ztxs1@I6+<&5S#+yAf?Z?t&UOOOi~~MhhY{h?a>)v;cq>LW*tqUNS?G4wHEDU!a<cM
zeXa2kg2sM~Cq74F+sY-Z+23hifoXJ<K947@z?hQlZ#?K1`+mB8K)<;d|0>UnZ~T__
zhRZ<DwM#T^ikLR6<|aJcFFI1X60w(zm~4Qiztu5Yy<(c7B%tyVmbnR}WWjWEj`_hJ
zr&Hd~zGe_lLEYO)YYp#zF+JEY(R}ER=qm5LyOtHuIFYNKGkXvqNjzG@X3s-Gg4j`y
z0LEM?$@b;J%xgEcyDP-0ofjS!OOUq4>+MlMW~SV&D#uc52|#)I<!(DE9`islJ8C{m
zJt7i^0cb1RBl0={GDv~T$0S||eIV8bzC=qKtt8-S;E28gIp&XV#pMn&r#LC6U@FY|
z`^cSPaT6y3>rXAPgJh9}Zr8cvS|X!Qy<7_UZ9@)M3!ekM!>*_RI;Tl*1i$CAO~&|O
z8sD1dJ851?wdDiKScTe{VXt{>)TN&1JA{@k&MIPw7p%H(OnDs{Mpu@~yCi*97sbxL
z5L*AP?$m8Tybk#A%<&_@$e7CQ?uq$shU?|#d3*ZoT86F#2Z)EyOK%7$hfl@6*7g0!
zXMz!d&m2X9y~Pf^F$fdcw&&}$G;K7lR*K-m7<2_gdFXmSYH_t<Qt0b;ag9g0Fj84!
z8I3MEhL1kUFm6+>S&bEg5~P`iOc%EbG$<VwMXVH7@zDr^6uy_jjW&;oXWAO<>sWCt
zC!y~uZEan0j^Oq01E!x!(^dyiSKEkjDU%=*OhKS^cA|j5j8|J_&gtr=BBpbWH`{HB
zo`XY}DfwB*L4z3dZ7b?>_k#yOFl^i?WaI%N*`YpI<kUw2yF8-bw!_;+-F9;Lmchb3
zbY`tw1!G{ue&RDBrY~;^{rS8sK7rp$2ilR|k=yN~1EI5nzEUC{-^o%#`tJnjcpHQ~
z>|v;IQCtgA=t@xm4UQx@^;#N~bzl}^$@6L_^O!)ISIMPctO4vl;Wx&FXx=wPwbvEw
zonl{d*}-%(m#+mH3ooFQzkeH6VSUD=D&~JfYmH)mYCtU1PepXk5o;Qt`6+sge{Y4e
zJhEh9tuVEGn&H^&Bv|KpUHCF>(Zy^TV036UJcfKU-{?}@RyYBBcy!FAW$3f&9rGIm
zzHcaexxnwiTF|J)_7x}22zT*WkK>{ESM)Sb+4F1lrm1qkw!Y{9%b_lJw>a0;ettqY
zH{bSv=VBJce0j3NM@;-m&12D%QAxR{v}w9KN;PYGyi((bfXjXF<an=m)j=T0ecG3O
z?-UUwTw7o{duW+vKCDyOV+xtAZ-9UO2EBSD>Al&CDu(YhMChM-8g_#gW7MTlJN@<N
zt+l6b#2a1v?q!C}EiEb3AFmPx)C4FYqu*U!yo9gUES6)3#vv_tj+o{wa>Qq4XCG|z
zW*}acA`V9y3?2kCSHKFNWAF5cJee^><dy1UHpJFwm}yUQzDqXF8T1|Rj|;oac;+Qk
zY8Q?A=FFf#ejxwi#B-)R65KBxY?(j@lg`R^oKI7B{I=R<K|(&h-iM16n@Au(`@_zP
zjwyO^>oNjRT4Z_vrsaW%N!gP3)j-&0<VILf71pAKk>cb*+DQ-DCd{^|Wsw3(5t`NW
zHn+cO>x(7S>uzX1^a_SA&2zcEa(OG%G<8>?yLrX#vz+K@r#i$LLyd8nWkv@o_q2^!
zrd+ozI)y)R|NI?5qI8J_9-5dbtY{f{8VfG^f_w^RJXUXjHlic9EoX;v1=9KUx<wpd
z0jQKTXmrmG^MK_6wRQZLUuyaHlK8!B<{A2@45#0KgcOSK8;FSPj$O0rUIYHPB>vPv
z<`?4RcQSeyU>gG{iBwq5!lLN-y{-?DPy>#4<@1#pA1gGVhxF=VN)?IXKKP@WWi9XE
zFv<OyWM-mAUma&|9BDFd6K~ZFbc?*6{~+1W^>zN1wP1069i$a~a=bs&x)`4V_04kk
zsNKZmZ9<u83)Th=Esw)9{Kj|rHxQ9#^J#TkSEq9O*R<RMAQ}?T*0@e?iTNx?C@{{>
zNx8o&Y8J@Z@FncM+D+3-ZBnH>w*BVRc2ZI2_a_slh>0ozaj-&}2W$-x{7~M)I+X}*
z50cHpck%{!susRF_ZNX?(%jHWly(n(YbOaf^~D5l&RtqxbiH!xKHs_ylget5u;1zN
zzP0wu#%#C8sxuJ0SbaEBMCUa-oq||Bt*4Tu@qL0Rvq?K_b5Vq8ZI03tFMtlZ?yWpK
zJp7oL0s_Vb953iAi>kUWLJ+RnnO-xCQ*Vw>U7ayt9sahXP(nZ`I!YDRJCVd<5Yptp
z(6@uK=k2+te=<kgAYBY!-|rd$g6L!Y=wH!YkA)HYAA|>Mz5_T_R|HR7i4<yrbCeqT
z?mPz_TRgPpZrJgjrs{OKxsgo7ooU7<{~V{C2we9IqOwe>S_Vi!BcE2|Zem~90>rEi
z3R$Tq3%*>zU0GAlM`#YM=)6mr6`{r}_8WP%za`SMdkt=y4&H-K{8FoH;`MX3-8e2`
z{3C12hv%lKhBd(#N_Qp`#Y}D!t@hEyP`N+TwzQD%nW}=?zBM;=Bs6E~z;as|8@$^!
zr|uVsPFBSPQV!+V@%p<Fa#RgE3BRF9*Qr>WGMhf6P;BTHQ5uihRqK3v^03GLbAOsr
z!`4KZZN+yRhuRd`=Z`R&#`wx(vo2VC)UN6GCF$$p@8dRYd&u^a7}EUqa=ir>Yqz<t
zU(TGWqPA}ABM;5m_9qb_i6co=kaSt(=!)z9O{R8nB<j+Yn+XBo0Y@BZ6SdE-n1!e0
zdH1BAvZ*5tom2Z0lh<>ceawT(#-}ERc^%7<+GtPNp|O_FeuAsYT&q=<C+e$QWu4q#
zdU^Rao33T(-#f_{abJ7ajmFxQ%n?uf6-m2wy_^JAkr(GAxYIWxL^Q!|F5WE%Oc%Fh
z`yQm`9UW3Y7kfIlB9WW2bR0ERT~xK+_Hoc#L>r!PRL(Px0m~o^R^`$g$_f5sL9?&Q
zn3<dqXc0AffPXQ5Q+O=S2Rgh7U@aD|xrv%h4Z!)CQ&fk(<c(28)Fk-%2Oy?hYKg@@
ze&=szK<lI$b(v0re(tM%On!0FMmt41Cv(cng$pZ_3p)823a)0}#Ca8R28GoH+h*B!
z6}n8o{0VK9^BQ7RTi!#Q&MZH8@}Gv-?ke{F#->VWOD8p-hqP)6(SA68{Z-_pCRx#a
zrz;@}YogtThd~2LmF{vB+n@ra;)9Qi@f{DpY6+h2hA%FPFG4OyGm*rWJawo<ZXIAt
z9-`^Sq6Oe>iSGdSiTNIIn0#g`LgUNm(O7r9EnLkR0DdPm%NVC8K(6<+SZK3S%=~=f
zc4&hN_cgDBrX!hzuSMMSHhYHFL$mqw{i9>G2KUqF8-3imWHmoW$5Al19}KPB=vPMT
zJ)}IJ*gT9%_4D7^%08u0EA}1d_nzn)Sv0n_U!@vF=g0Hpc7K~ZEVGR$WU(u(LcuNF
z-Q+~hYa81hk2>_Eej$kT@a<a^jQudQXNgYqRpd^-&zPz<In7nS%pj=vgo9p{{r3`4
zw=4A5Pbb|k#zWcHb9!pC`qjktXWZQ}wYgYse34f<srGMnnoCUl2{;hmZWxEmshah=
zZR4tK2Xms6^t&DNDUfX40SD_zV;U%T@Mp<4-qDeHvw?1x_jS|9EWgLp<;bIAR7ls!
zh4Z3AWvbQy!wiZyFm#UN8uu5g?MdvLZym?OonjxQHfFZnCl*hYK@J$SWk_0y{xvSD
zYP+Aj)K^IVl?T^}F}n%m!Nqa?nFp6^JN!=`T(qqF;(M^2%_nk*4OtO?fA^aVzAHRY
zPboo*0Z?$T^@@BK$KE}Pfjuc;Qbc`@<suXrtzN7rgb-DIzROQstXt&_SXZvT2C@xz
z60Fjfq9bG~_c|2j`vU1c8WFSveHeX3JQ;0tZhxg#J@kayxhpzAV_fGsBK9Mue%c4M
zidLL+HBGY4=^+!kIG++)*v<X8dDHR!-ir(xkK&sWzlp?>NKq)iJdgT5eABeK$}*LD
zBHK7sMx&AG5x0=3>{xcP!!1EWck{i1%8q5vK!^6(BzEp@Sq;@ZzHUmS&K3M8Zgghf
z+14sx_YV&O_R>CdN<VkJ@AlGJK)5<X4KaxVN*N(?Ia4B-@=~f_g*$i|z?9{5R*gl4
z-@(T3d5#x|O5e|;lw_zDqls=R3fX=q`fO2iM3LJWV{4CF>e=xbe(w>ONNM5+2Q^`z
zSYdW1Zg`iQ5a-Z89o2wu@;~rWjENi@W2p1C>v9#Oo&zEe-De^I8pVB@S0&cI?YGV=
zaMgK#ubOE>k5ZlNXPL5R^*o{xZuZI29RAj}z|#@Bj8tgQ>=*QbxyV^U>3JOLrnokH
zU+rrKjA!$8*_W-@3ycoVN#_8k5>-r?;hj_R-x`{}Y+C5I0C<!nzaajH0}fu-x>1|=
zSi65|Wb~TgaiXCG%aOSuFczWe9hKqN;qU#JjCG*`UZ42-2lJO}OG|{3Zz&mPGTADo
zI~0h+g-*vwsWGLvC<w@wwJZ-}NB8>S&b1x(Q>VNz1Ztj=uuPp7bw^D2^A|AKbc{a?
zidnomKUkIsRMBy|ZUH-aO)4m7H~1qr_*&V_ox??k@1#gZM<9|{Y5K~Z@3@+q3aP#M
zYB+mgnh3WiVsb{kyPD-P;dgNnRA+SF%5zYvda#GrsgL`j3w7Pbp1#9Exf{pG@Z9%F
zvWUZmQS0~zX75~vH#Qi2>rckv5LkO#>#O~l=tx)s>*}NrMl4b=xuY8u-(QtTKves-
zpp;kn0oZNgm>4qMI)bEW`p$&p+}F|XX@pRg!4#6d`R!fM&fbo8P(qPF4R7_^KrI1I
z)G2)a%0uk<UV)%tyt{%*On0AwPuK4Jq@Tep<D99<9<dQDb@xhPJ>T9*^M}I#k3gDI
zZDjF8+ELqKya64Q_~vz}FGeoKYu;F|U=<K>=@Z`m9avcK<G%}oEpr*>(;#bEkg-<O
zBArgEV<$=RlyZZDSmih$RID35-z|nJb<!*Ik-1OoQ$yn(+JIf{#7^MT`E2;6xDT@)
zUNZQ-`Y_wpG}O*LB6lEhjT*i&>$4Br)i#a`^h~6&{Nzx-8&M3TK|iIl>^8<kI`h}H
zK37;NyyCsPNP$S%ajKnpR&4mJ?zqr1fp_54^H}q+)796}{ToRe?ETKfZOJ!RgSCx)
z?*K>tSJmSNYrk~(2bIL{)4T7;2G>oFT?nH~B|9dQgfc|<=GvzFb#y>>RDgg^0Z+h|
z(r36!MNckvSo%u0*t`w^<T>_ev9)eNwAGZDl#3TrrByXHuWROePqt?WnO<|-B!e4*
zwiHG+Ih+|UvJ?9dIg<JT|KfeBlRINE1@%P+3{tB+JE)=GegB-6m!(_81{u}S*VkV6
zd|%lVHA0g*{miJr_c-0}^rXu><I8|>YBIc=+o*r|9k4C+rwn^jw>NeRydGAw{%+Jf
zx+uaHW{Kojj2j+X;{7a{kip%t9eYccp4)x?xm?5D!m7IdLwG@*PGo#Lgx1No-CzK}
zn^Z=J%co<phA^xMUuGZ0Zg8}>dh54~L`yuTVBW(!x}HS8S#E5Zc8pVKm213iI7+?m
z9`a#EKx}3IBSKlJ?Z6;0GVDnp7gW7q5h2KS@X%=WGLQZzW@CkwVI5BtZ^UF7G>ST~
zFH2!W>vTc`i6h@V!7}iCffg~ArCFPOZS?<5A^xw@ZX=p(bZ)i+vG6LJGRyU72TkTa
z<0Hs@d;FeZP$2=cRm@UyX;rTj+L`$c1nG$Ck0L3BA0B{OAtPAPxAku+22vsDj|U6P
z7wuxf?!$Kt$&H0&A?=1FD$W_`P^MzaGJby%z+A)t)3{cwwP{Z68wLUtm<MIzuMJ>;
zAzG#eh#jF^9mg!FdPi(Wkv#blZi7c~ZpLTi3#DSg9_*Gb@k<$nySDVgdLcBL5}%#4
z(-M0=k`(k=QtF;BFQe%<&W;}~vmjtEo0s<m8N(w7^==*kf(sZPUQkxq-s;;sWrbQt
z*r_5PkfohtfsTR5^f)n*EuzC$VTG%0$bOYKg5II>=L!E4JbEQSlp_USco)$w<kJd~
zMM+7&eZzLlTlMKK7mkdTDf9>)BX)%!uD=W&WIbvz-E!9UA#4pBC`=;#cE?{UTJAkz
z>87(ur{;N#m({qAFq8PCr=uyzDJt-0siyH|EuUQxJ+Z9ve~f72ZG?_e#N4RTf1dg=
zeaC($3=75N>}Ue;Xf1Sozj2<QRZvNmTriWWos!nQ^L;|wtm$AxHKpVrqbw^PyvSfj
zmrppzJYpGre#u$%^=pgpXvy6wcFU?a3qQZzq}%o`4fK2BFC{(#-#<G81>lZv(pS^B
zN$@a1*F=-~l*X6h!b~P(iI2%LdZekdt9Gp8=eZCI@9W)e=M}DXv>6;$R#@T3W;Z@&
z8J2(xjc?gT9mGUl=+}adj$bnQkfe~Dl#%Bvf3|&gm~ewO^DB(;&pAEk2c2WA73s53
zRQ{)LTOc)wg0%w=`Wx;swv5bB(@Y)pYyJt8<1LQXX-F%RPVI=n&h3Th|E0kX=uESA
z#qwuBon)O`i`;Cq!u<OQ8cQD}x>03hhDE={3#to|#fKG{9#F-<Rk$@!Ilfh)2`zrJ
zlCuvv+Yo1n8}PnoiQvUp>H*MOdAPJ+Z0xGVzukRYICo!cP{_aCeM66N?miiFpXIY(
zUK987k49pYS!tp@2@1_JPTFtwse{l(u|{3mtS~3C&ZpQ?#*R-)P@HxKa#G}WDaS$}
z9KuXTG4C|S9C<D;8%9N+R<q1+&~R8x#~S@hN8o2&jUMw0FzbVN0wX$kegXx5g`#AC
z4gsm&{38@4&-<TH6s4~3e}$sNX)kM`=GuTzlzV@MqFg^a6s4SykA|x6;|a^Eiy|6o
z{%1aASJ;bw`8h4NN+yy})qI+|1GMu9W0N3o9~O~kdYFFWEKbnDu{YPkNHVawi7RfI
zVCS=K#7zE4^z@mQfSDdFunf&QVe`3R7h863xYOo>$%D7=cnakhqUcP>SKe{`|ATSG
z|C57pp|2nK$W?B;E8=na1eY?H(>`$lF_}@H*Kyut&v`OGU;q;eP4FD-!veRxi!umO
zU7aPcott6CQfh(Zjavu80;B#i`Zfy5ymy$XM~sHl8T{;9_J{t4n?7D~@FM4v;gc==
zpaiz>+G)!MS2My=0Kw687L!jbWS(cd->M80CuG;D>0<{ozbZ_{T-X_1t!WtVwn|xV
zQ#>hW{OEBK?F$iY)@stWmzp~1T)v!10+$&gAjkpKT{`zL2+ZU2V?{1H#cMXG%}Y}D
zT#3uM>otG1j~j&~o;1EVkN75Er}*n1c*{SV=4)1Wa5sxTWy5&C7?ms{lY29+ey98K
zsp8r)>*brWD-6u;=(GhBYDA&VGMrl}4$NPf5Sh!(Sw3%vVcXSJewpw{BJA~!riQz>
ze2}UF3Ar*DYw+@2l4exAz-3E=svAA2wF}WC8J9RmvM?>IX_)WSOvKriA9t{>we-D3
z#toZmiN}q<>=b|hFAXyw0nn*VcfrL?$p<&}^A6?Q20e2#FLdc17u|9mq4Z45t6yu6
z-F{yaw`<KyN3UhKw(zxA8H72g`W9UPD0v<-LAYP>C)SYbawQlnQU{moy>QC@{LI{#
zUo#S$fB~YsLm|kIv@7C5S`A4(z#N?o@nLs;#!uASM(oR9-{Q}5wS-2N+kn=}UpxJi
zi>h}&M{skGVG?UK1DHrGofC|XD|1GZaX*L_rt}?>b=UM+R5NS^MvmFLxzKgC+stI8
z;)gptlOWocp*pX1$z^C^iJ`1<^``tXbO^3F?a*dGg-EL>oST!fii>gyjyq!+{UgeS
z6^L>HrTdku8mE8WnXu?FWGBeO1-Wq2{Z2v-i4#F2Wk{Th_5fl=wya4yO~5|mNuk8*
zwE((<5<?mY#DQm@tzqH93tx`3LqnH70qxv>N4bRi_x}>*Lh*#u$(sEiYRtdK`hWkb
z|M_5*)XFP&^5Y-*nzG3!iB1Z<S>&#nRsC&C+Da06)aGwVV<b4iZYyyjp2DJ3Kk_yI
z$4UJ!1<${QKc#>KEz1drz5Hu@j$zXt`g?fJbIuCEjkuA=IoNXdoHGfWh7Q6e&vp2i
z7e&t;kL}1g>{L^p{}x!L2^H$<X*x?W^90Y1#A^JGLF9>0HVzx3O?PXql<&V|V-%|Y
z#K!3UiH$J_urW@kf3Pth8@IH7zK8$ad-DhOxz%g-kNgy=WV23!E$)B%BVd!R{`$`W
zn^D~a**&J9F7-P=^q8VVvD5EyNK*A-<_1$LdUsqB%KrizqbMvZa|#488w%h=`&now
zOLfj9n<0k!jt}Ri<Qf^9$o;B>U>mXVrtM0gdCfopgy?m%PBWqgr*A!}qf!5(Y>Ep{
zEbB!0)2?=@7M~^;I=|myyIF9BfjFJRpF>Ip3cU0Hime9&=opsZe1TwJr}LW5k9jME
z!Rc9;PP#<Q0uB-P?;rf9$Knt0Gxa0bF_sFr=-admT*7A7|82r%;vWf{DkCnSK!v|l
z+_mrooQyk5G&j*1@;|*<FEz+T!EHQU(6s+f*%3LNUN#q|U#2QLP{dO{mDkl-*}F5=
z`s(h-CQ;ap98A0BkQ#ja;6{&k7rn!fV;l_s!EOKQM=yY!0P@=p6NL{tF1)?vhf`%s
z0itXt)ZxMBFK&UjoPZk%Cx0p3|MMPWQWf-v$eb#wXe|Fo*vvW^SNzR>Sk7OR1%}^Z
z7?!ZbrfEUg7!o@Q7maw)7!xfJYT{4ov&nji|2n)<>WS3C|Ha-}hDEurZC?=u6iMj@
z0qK%10qGKHX@-#QE>Tio=uYXzp&NyPp}V`gVd!{o*WPPAd#xSMa~$v2{cYyJ!<!lY
zd0prEJI}T)=8=D~2j2cK^p?2O0W~-*Mg_D=rgLT51aMnK6iWaEx)yM`9Y&6O!(go0
z?wWACl)%6PtiN24*)G72U06ogrAh(_vN!Ni<lvYdKyI{oA(|c281499N=ARyMu%bK
ztNX;5@bbYGOLC|I>7ydCmsz2J%~XFTy+We%S|+&#C3dY;2Q>reV-fzz3t6GyA4xEt
zBgVAG&=JYQk`ldA-`aBTZMBI>^Iy?J|4GgH1_@az-BQ&D82<5h(tYkb@tG`E>*dT_
z^#z)c55B7CxrkL>CT7KQ0TDgRFA+J^I+Td1fYhw%-ZqRNi=Eg@`*&BFji*)KYYZz6
zDdC|QTz{pk{-b(un|v_hF5wtcnD12axEeSnkEy2smo@dR(t6s7d#rVZD@x8}L%H=~
z#OaGV*01>wyw=Nm)YZTglkDOAtz{3EfWXU-MM8iZX-F*{pSd{lDwg0s4G>_l!rlz}
zwNfc=6%{`UQ$=7K$aMDJHc4GI`0S@Gh{&dWS~mfXj-gDFZE1YZJuo8rIv~9|RGa~c
zv->KjlS=u2<G0|V+-UInIBNso5C_?-9pnK`24vX`@lUZ7qt!;o(OH(*Ma$g-Jb0Iw
z&TO~^b(ICY_1k%)|3TOWP&HD2AodNUGjR@-%YTN*-@jFly(_HBtg|mjPr?!5;{M7a
z7sncsEWN!0E|VS6sQZ@ym&l~CtDOJi{cea8mVGDf^;&H_G@v_G$h%6p!Von^;z8~T
z!N+(unQk5wx*u)yq?q_EUzbd^5m>C`R?K@A0FxDAsovC@JiwX#(^~ZBWvWu)mo&Pv
z_t!+V092g6(MQYY<aVjwWHPt}R|^Q_LUUXhe5<jPFvAI8KwckWBo`>*t>N~jq1;6N
z|CW1MDf651`VWE&0KES@!DYDUlKx*4Tt<8UPH<uVGr@&h_>9W<KSehtyxBn<q|K2W
zUMIAG59Gq7wPL*sn=8j&sIfhf0U_i9@y-sh=nA1XFSEnY4b&k8iC*qX#3uw)0h55r
ze_P-Nf0<ov-6+&^mZ%`T^*`UexO{V|sDQw^oK!H~pVZGE=>94Al15#1b?oyCMbx@K
z1z&PH%z^*6;LGWk?;L&)zLdDF82vr?GD)+9ycp>{RtIPB%VVluL!IGv;^o>``L(0P
zPdlND@t82?MW7b#r*B`RQ1@}oxOo3pd`G77e^6Tg4G1XnHGsF{bbt#$xWrvqY=bu!
z4cMTXq5RQ@J%Owt;rv3u6$tJ44_N!C12p!YcCb)|+edw=wl^Ol`Gqy~pK|#R=LJ4w
zsiIY(@tt(Duwi4(BCg5t?Xoc#Gm`CbM8Zw|$^?F}nR5PXL%N`#o_)QJ9{hDyb#EpG
zq4k0QL}P&PQk(@>{!e5+K>046k@cIc!(u0EBD4KiKou}2Aw9e}9lS7;ofOX)OJOHy
zKc(aW{_l>LyHT>BZdqWN8e?fU2<|cC*%-R1|K)}J{-3HA(^P|}@9O~gLX1P`b~-0K
zr|dXC=T1gAnN-0mxO|okr53rqvQB0RuLbNY)n`dx$gi+&U@SPTUHG$h8vsrp$HN1$
z6G9W5cdk2wdb{=harynr>uJCO{@bH+V?c7hbk;!HWkCy<Kj*)qYW|twqO$%!43~FL
z2TR6afTp%8@rR<!F9oZxnIPW38wmJrznM>YW#`H{Z=?GPCldyRE#T_opU!}E-<^q6
zCzB!^`NRw)iZ`u=h##K*jjqW`FIW6`xTf(Ra7_fQe%UsrahTqCo(+*AiX3}aHsl9F
z2-Glyg=9pYyX{rp_v!7OC!F8uaue8{=Z(uIK?9FKzm%-K6}`B!OjWb5%BFN%FW0qL
z|EZ|?$6*7G4IFkEb(9E=Ew1tu-e-Jz-J34+JDoH67oC%{2%vL%5{v!vW??Mh7{oPP
z6==%)g(GEWAZkrd*A?-uX7rIL_sf*I>2Y$ZM~s<*fzqbk`p2+hvF@hz)hi(}o=5`4
zu$CVTWsMSy&CuZ^06DOF5T~l9$su%e*i^d=NM;%ix?3vXBHQy#lD$IL+DEO=23Ao<
z6YRgv4^?T^%pQ!GcDZh(-glJLXs2H*D{@-N@olZbscopteIMh3Cv-h{1JFpOB~-3t
zIhXt(os=Px1Hm3^wc>a>>}l@XM<1`Y)RG+p{}O!g$FU>=Mat)`K-3R<k{5af!pj4E
zM)k54(7+{0ZYHPR>AF)OJiD71wPic2q0qY^Fb?t|&^-FfQF%BEKTz3z_V7c-&5I3#
zT9Ck7x+fK^Q5^l+a*$J;BDO1h7nGI{#LaQrCxd^(iYEWUic-E#n=bDu#c=2o)Jt*i
zwzC@vQ-{fO>yY>eE_EhYmUn@2V$}~YVx?(Q8M!8HN4B;7#u-X$S)X_x+nvet&z-W_
z>gR;5wBx0R@$c8>5H1XLuy9|=pPEnm&#Hm@QyZXAX;j_cFe#Gw`@=Z`eK{plr2lTf
zO8v6*DmVUqA*Ez>*(xj0WCPB97$(%6aR@BY)SWWK>k5nxtT+e>FJ9r`pk9T>I=p-m
zt@li&aa>fPqwXbIQS*8}E+lp@>0V3OehRSQ@5ZdX3OpGQ7HqzCmVysq+S=4E6()FJ
z5mcZ*bPD4f4+Ee=uMbMSj{Hqm#<gsM4B7%D(kmOB$2Cm`_S`mfSea`VdndgE7mR;8
z-9G{cT_ernpbNR$?AGrH+08k{=VejEg}be5lCLLt?Q59jjIG2(-$x;Cxq<fU)<Z1H
zniwaNou{`zb8s#&Ao*inBZ+emI34tIv)q5FTUK=zp!xl7w?f1YkO)KhZCY>|ZmnB3
zhd`N=W_g0kecZY|2##7i-Um%C%YZUTUetEN^*pu4K9&9f_g@y7Ki*DLz1t4|7&goz
z3v4soLyS45GFjQ-)?I83P)b73MbPiukt9XNldX6-jxsnef>^TAJ~F;}z1r2tFN#(A
zSxy*TB32iSm^rw~o&4v>m)Q2M0)Gr7RHhgn=CyBOb`$k4%Gm6WXju9{)}{c$>Q!hU
z*KfkO{?rwqK}@=|wIDCaXKP?l(j<a$eO{p;BPoR%4j*55IsU=oOYKodQKptV8*%0#
z$$c~L-Q9WgGN5h*huqsaTQ>Fe+bu7Ezmj?9-@x@ZtO0#sbcCmuT#_?c%h46X(Ig1H
z{cx!*(<0t_sA2<Jr&gvL4Fy6SNV&Cr-1zL5rxMHy%?vkE&%61*0-p7M%@$dyR1Obu
z=ojKe6F5|~Gr-CQ_!3#p6MahfLDSd@tOkxd^Mb#mQ2+Y8_2wEe2|O2br%@!IDV!;t
zX-tV~e9Ja>lqD_0A^z5+xUp07>rW_XSQ04a2=gX<q2q>BxifglRV9d}th475Ru(<B
zr}Z+Rl)$iJifM={$Hxs{5?fm@6=x{bekCM#@)0Pn?2j^tgjwFklp=HkaA?CD4zT>i
z*^Eu}$C=&hCIVz<%!;CO0Cp36&~nergMJYVBLn;6>Q)k-1KOR{qq3Ge`t&w_&x^y{
z>+i4gD3KWwgeZ?(=<p0}OPHFW>|4Z(f5ms8t^W&rM-S(S9%M=SyTq=Q%^Z;TXyVCt
z7|lp3dr_(ra{b5J{g)S1zm;TaGkj#i#WSMfx*v@J*Tyn!)#%TRNWlqjv6vCH9_U|C
z&kw5?PlrkqnC3BCt$(xwZo^%YdY`}JiWjR`uUD)jT!lKI`n_Er?R5(ttM9(*1vMY%
z=304DvVI)=QOQwb>L}mf$(saVHB_DV>~}?habj5IZ4uwbwmIVKM%q8na#1`r+3Dzh
zo>pJqrtSuCW;i)P&5n%ifO;+Qv3^Q%1@#KG699TRbJOZJ_={@xkF)iUAjBkR<SZq_
zVd1(8I<?<|YzLKc#AJG)fzpc<NJ9G`lX|JqS9%TP>gl}X;K52l>x0Zr%FE_EJ$YBX
zJ>ya2z2qp}qKHNL>lkgzF)9w5I|i$u(&>W4F#Ly$28ohnEq=QHmU;mw?SopMu{3H3
zq&eTlRrj)cfqWn11wZQ-<~ZnByIDXN_H04D)Js0-R5H@@ywl{1b_JVEnIssjZ>E8r
z7F|RBHQ+*ZqlX2lrp5a4zs)xXuKYlWck?U0J5?)Fk`di^b}*S>G$5=Gu05t!ALq@{
z8#WCUa`<kqTXH9jD%6)JbW)c<d&|jL<dzdIGxQ!HS5S$RbmdXLSd7|Qk_xgda>eyE
zOM7ZQ6l(UZyDQbTk6PmLP!?a!%k%jd;Eo|DxerZWpS3@MLpqXnV8jl+sSgkF+~ZE8
zYGc)O1xY;@=RHjh9R>t(S}xkVrDOIYK|CC;$&M1X79G5;$hA84n-1TqIx%kt1Wt^4
z0kPv4{JV!+6Pz0i@D#*>HDaCPE9Mu7e^i9dw7Q-bL3B2LXa$%^$0f1nFEL+#RK|R{
zezQKwQDynW@fF~5{uwecy~hxUP|K0HI4r64*~(lE$M&Wk!-e_<hhF<w+(n3<LuKu%
zxmvV_VS=o}bZ@kDj2h{FFP#Pb`1w)jgN;L7x3xnJ)48x?Ow5#)>$~d%Xc)J4Z2yrL
z-$?CJ00XG)Id{k{I*&l})o~C0%^IHFt&@7C%-6X(MWLgQyA=l%m)-!GtddZR|4@l9
z{GywI`D+;WlmNPXgznW@C)N1|Ua!;6xZoa!F3s6>+kFm)e@k%9u<W`_gU=5gNLN{P
zsN!&48(wyN4`=;8`yZY6KTaaQzp%o}A0w09Q@WyZc`a`i`BFs-CbFnZy!W9*^@_oJ
z8vke%7P!PxrQCrTDtoKEqsqARBWNt=W-3xLxjCYdPXl!k78CRKLL&h;Z}n8u@2Vj2
z8ZcFa@}R(gw%HkLE>h+bycssmaNf#bW73t=BL=dgN)}zWs=j(*`029(-n7X>7s+jr
za{-fgDK4YERIyoE(Ev=0M9=5eNiwg7H=K%q_3ctzD2E$wMLb^Z7-$!xwDE0eP7Cv%
z>92h>H@<7DOwm{Y;6Qx+R?-M;LXdv@u&~mG+gRS#KN*CkX@6YvJwYR$^v<CA`(~>D
z8tZ>_2sl@N(;=MK&~2%0iC&1viLx&D`%lt8l=kxcx>g!uH;w!zDKJht`B@84WHbR+
zzTfZ8nOyA_T4uZCL?W{at*eYh(!-ViB|`XI7cb3;qF2Y0OVROO<8#SVwg9q~QsP$*
zP>k@S2rQRiCB~IP+7?f<R|6nzw_2c*>|fxWvr)Ff<U8)C|4?Lht#Cp{sd}E*cs7D!
zA!g3pqm!HI8s%asknFw80sZeRfMeC?3SklxI{i+6NgDj4qnaU(@DU8;M*ufD3hH&N
zFM#B-xl(C=bx9%Z{f69JvEK48$>lfFe<itGVhlrZe}mv8O*dk+&zMoZSI&-<jvJX&
zM_$*BzkW!55zGQp<{l_3QQSlOW!e2<{_oCy00`>iryo37KDnm!aP?E&%F*{eR=E$k
zce3A*z5soWF*fWjQu#X|nzz#F1Md+8ANSP|Ub_7|F-WK^qQqP4vgY-$cMB}BvZsF)
zPW<Ec1jqU)egCTrC(S8wH<aTuUer>Kdpi2zHnz%G>?2c{K1${LIMvWVIx=wG=PWLV
zkJvq_o=IZGSA~(<V|LTVUO=$oRZvs6c=3NLjQ_1L{(n^%G5=Cwj3)ENd!RvgXzz*0
z7D{zi$YZtqTJcgdVY)C{Tb0ZTaN0*Edn5(|AqQR^Rx1>~-nUm_fr@*QTz_m>zzd+2
zb9%7QviBhT4~BlwCxAN#bV0AQH^VPj0o!NNW)^ga<_S?;sXf?HcFy6QGHUZMP*$K~
z;f<Bu`PRH$nEP7oYE9r~3d2;Eiq0QLF1ah|hihHXXbG-(1`g^C;QJSk3~crTF)`NJ
z3#}VM^?OIAPgz6l%)C|&LwS}}$%HQ}TFQI);g%~T5AO%|UC$-=k^b@b{P^V)w|wP8
znAqRv=HT1^avlE5b@(sW;lEsmK14#AA4orb#bpc9B;_yFWqGuABwJ&)Oxa&+1I=gI
z4hl(PE%mPcRDPJ5sUB7nO=2bC0#KSuuso(Kyq%Vibub5Y1MFlud~GVwcbnJf4uGNZ
z7_*yx0{KywQbT{aUZT2pfEv5XIA>-HSIhP`Z+C-Xk9*h+uemqXdAS;InUl}jKt`xl
zLEl0+aCfMA9pkm;a9^ggG(iZWzSi^fT2PFZ<I|MmF}Q~82|8G;e3;0utvS2>HXA0;
zV8~gM!>^s2W-`4woO7e-L|v{eE9+q46;0F6q-jh-bvKuP>tG#ImKH8RQgy$U?<o{}
z%Wj%w!LZ?+ty7v+J@>xZy#=O~6jF9JkXcphe#6nr<Iwy1q<C!bgR?^~ugk8(4+Fbl
z0z4Ja=wL<R!e-M36nn$8z(sd&`gK`380@1*7yhSU2Vs_9b>K^wa)DNLu1~op4%J!S
z_-~cqANPy)L*rLYiltvEN`YSS9jCmgTr0gxha;^-mzyotqX17p3PbT~HZkO(N?nYk
z!=?oqq?aPiqmH>xcHdk8-jEZbosjlz_(UB$Kl;J_;=Ef;69@vhdCQt_*mD&!4*~uz
zK9HYj-U!%foJ<Is3;@`Is^ft!<`VFyH9bT>aku;?jvKPn7SJC5rKQvGeBXoYg+m{Q
zo+o$Xah>ye0WB1ezmG7g^5#vwd6xQ%HAt<#K<MdeeOXima#fzk6`gUsy{uIR{q(<r
z0(W6DJs-I0&3TJW$L;w%LCu0asJkRQO6Kd9X#$;h!;CK5!OgSw@885K7U82lq~Q+z
zJakW<6XFA)0kIVC{v12#&+Cp6MM2#Xe&8Q=7)X+m@!QmB0?x`s#+UP_Wk`kx3sz)h
z&Bun8)$PuZAD=^hrMzpVR`g#H!Q6@N=+S0fYJORVRDEQ_=FTRC)$}ZyOvJEhM0S!X
z7NGqz)`aOkcbeMna3;H96d$l8nKwD%rGsT$CAc3Ucn#vi&#_;3qG#8thi1dIQkIv3
zU2}I*zj=S4m2?>{u%4~qc$8xZ*tJ9B_1v4M@F}~W5ZT~blwJ1#?8T_w{Sn`ED5ts(
zmdl)-7N?q1%YE}D><F+Uv-R_=UEmU^)8=)^*PsV|YYWId_(EnMR<q#F!OVBx>&ka~
z*}Yf|2=zm9;<YFmE<BEaSo;n)({#eJ#?#NOh3E1<74m?np4o1x&J=irt~Pw+<LY(k
z6co)dzv{3xqywFEgV3ts^2yOuhT@L9b9eQ*i}f*GZm5pS0t@a|g)1tl08dD3c+Nr1
zNxu*^;9+lSJU*^75CrU$E7d^Rm8h(V@?M7qnF7<9$g)y1O)R}7{JwVaV5}uN@9viD
zXke%8tIwRXGI%Kd7LAXxS!&_HG~Le7Id<XvtJz-Z!MCNh!1i$A8+<a)L)}Ke!eiH-
zv!On*Fg-i$bJOL6j@UiS=dw-wXn3RBPLeDRb~bsw2owqnKqvC!^lcIr*S#mqAzQiW
z5Y6Y%>v%m+=ChfTnyH1&bJq$Z&eTWfmkypcM}c<p3yLKKW{o}Q)Rzz2*nIeS6iaU%
z)~@%vU}V7zEKT1vkI$M-lOInwUK}9Y&n0<w)2;kMEi^YAboxvr-vu_&)DQb_9MPte
zurwWNrvPb^V+nN|sls5MZJS^2XDBV1j|#lO;7@ia`DCS2bj_{MVJ-#)8F3#YIj<j>
zZ6@mL>}uwT-BiLZV{bO~ORwr_)%(Bfe;Cgz@hr^I2&NhB*u?Hp#R<^D@*^<9I%n62
zuCs_-`&{Lq?$9Zs_3T~$YPZ^%s<J~@ctIJLLoL23c)XJ@d)5NY4tw-Qi@(m2W{}U9
zz%+>$?Ro^oZcjD7gU*MaCIIc0tNwfwv#7M%nb>K!!0v}og9+q292IolS>98Ik1k}Z
zh&yq26R&K4-6?kd43Xb&p>0GMj6Q#V-sfl2SFq6)r(s_A%aokua!>%Q7IDFnq=fGV
zDse%~O`9pd{Km)D>r*D_9QOppjoXBFlVs=pfCeq@gURKjbKu<aaL7Oi2rR&J?*=gb
z%QhR{xA2@nD*)FoTAz=ux{kBKZavKV=z75#2e1qX9H7pxonLoQ7d$bv6|C-<CW2lO
zSra1doi{kQ>mR3jA44wRTi<>8{K~@x%NX;EkNNf448_)f(bgM%kGrY7X~qEs3&fK^
zvRal3#>WPT<ac1t1i!kr=*~O9>1dSZ(9fwjU)3y?PF>!~<hy=-&>Zr7e0#>Esrm`}
ztZB_JRQP8SUxsYq39)bi=IRCeEc~1H4K{%00>hNNXF`bvvbtuND$pUpbK?yMUi!24
zBTjC`y)CWXMeR*4xBSBDCFFA2f(tIj&5>q$o=a1g9*tGRR)P)dm2em9bxo5VA2oGt
zcM;<Bw~F3x+V<z+(fJ-X(x#>qmV<eZ9OwZocHYe=vx8goFlL|~Gp2q+6@E|+BQv~O
zy+2t(>UcIFNTMt^#P8iQ@enfMjRXsZ-AnfnFu61bde@zO9Rf%ajA_g%P^)I7vf9;~
zT5goj@JVlv-BHF+Z9E-s<vWp1`rGlZV-vc<X<pmG8pc)W3aBO`4VL#iCOgYDoC??1
z?RL}Bu?tt5oxoJ`%Yrxzqe$koTr=S<awDxL+Wh3X>J$!WhP{{?KQA`?P(P6F{ieqB
z%DZ8+kz)n0J%{|lzIdnKrLj!7thp{WHxw#kOy(t&yTBd5WcDepvypbkiFoZR;X*I&
z-IgOyAB~Yh7JLIu4Q35(aZ-u?@#^3AtGBiooBt2JH5VB?cj{l-ORECVcz=$f02|c7
z;6jybP8BXISQ$FTr;<z@8t>&fhENyXjFIuUThfj+fWJe`7BeK>KQhH`-SBHpnMT+U
ztd@gpWcjd4B|T70VVlmh0j_lolj%0#@Wn(X_Pl`D0mB`MA0P7zn={3n{YaJF2doR4
zRLk;3WPgrf@W>^uMm}G9YS#7rQKxyjPV|Phqr6b-1H0o-l?+9dde-G`yR|2zQ}Dpo
zHn)1#AJAY)JC^v@yFMCc6xskj$lC5_4mZ>dPY+MaazuM_5ZXQhHW_ys3%mU?ms-`(
zkKrCC-S7(Y(j>)gJb@y3VM51C6HBV4r{O`mv|;Bbk1H78j#Y7tn|j8&W#d%bWuhyy
z&Mvaic@ipQZ~v}_Hj)O#nxT~5<wu^;4-SahTgj<)tpj{5tD1`XG5&@`O`^<^h*ML@
z2y-k+!_AlUl)SXlc*ZB213N`!&7m{H=}Tkk+Ar>1M)fL!9Q$J9S50R()sr_GcV|;=
zTNS8+{Kqmm!&KGv_!F*SFXJk9G@cN7lU!{l?}xUey6fU<bE<jhG3@0Un=&mMYjvDI
zYi*C^p2hUIU5aRYgdTYk>cA4>wyu*gr2^%dG!*nuAokcjfz@7gC$Ah^*bF!vbxjh0
zAJhT9^)6wIh?bn|V}@d^aN%S9s|H)08vvAZeD1qE8P)?k-J&InZ`Z%soi<U2v-w<s
zdRrD-A^T5~UwOvNP0`(TemUP*p>sbg_8cIwhw2@JSBZud)DR6VHQW`PwaKnG#76p$
znv(aPij%K#Kj`P%D`PvkuW%vNfB!;}h{YaDE`iMuoFE>V5yVSQPnm%%^P)?-e3g-0
z$zI|GCP&66@+WV9raa0F(tq<Zugtqiy=`}Xe}4aAz`+7sz+q%WM`!LtLGhq(hLaPP
zPVO2{8})Vt%}Z)b&8mSX1qqFWHs=LPV;@Uhv5J1_?AS!zA)|7dyYz?rz}>Z+ZW(U)
z(|$0N-=!jYGcBvp3YK<!vzuo$&oF>Af3<^?C(VbpZm!$N{fzur{r0da%8X%_64Uud
z*b#q*3!dbYXqeZbMvL|Pv%;tL$8>qou}p4n4mM`?^RZNGoUW~vP6BbtZN(Q3Kl&6a
zs&jWx$YD0B7H!RT&hm*I_)04_FXBGd7!0As({uOVovah<`k7OHno2$V0q<H!1H$-D
z-X+Z^8x*duTX`AD)=Ie&1Q{U-Flh`+BXjMD=6jx0Z_(CD7`2bD=rU`}X><5Q+D1nk
z1pboWT)7%6Qp2$A6msqXoxQmTlD3}T<Ud5I!N64+ep}Ag17GI0>)4$znjJO8$(#9H
z$S5P1&aR8wa+h>HXNX#!K|u3GX}u4;1LuCtSmdoihuwkd@{FYSA^Nr!HABli*GMwv
z5}(i><{`2xq5uNv!|+d%Kd26c!{2<k$;vd=UK4Kh=`bUk$2G9IDe757e`~3+JIQCW
zYI%{(ion~GW?uw){xBi3W;K$_V;p7sT{>u3ZG!LP)wmGX(9&e*lFG~ky{-U)Ce;Io
zv;g!Rjx*ufT6E}&Cz4UBa~-1XYS;DVIeJdd=r!&#8t?f{NKC@?wt&bp+*hvxaRnI%
zsg-J_FnJFbr5a~gPMtgjBHHX#FLypqoKjSgle(!kn@&{QSGo%?(GlU2{x}$&sJmt`
z7<t#EKe5g5(={sq)R5*romlQRLUU=b=E7`*2nV5b^bz*|K*sHEb2==9uEdq-4JerN
zr}uhYKAx&Hqblr=CPY^u9Up2sJ!W_$;M(4>ij(u@4r6|)7F!|e8FS<4*qS0;`(bif
zGctIEdfv^#ZqQWVJ;gni|B<V5u#JEYMaR)o(o9m9*rIV;L<)*W5~y1TqL@$%+7xvO
z>HY5W(RTw|0iqg+*qy@2GXx_vd@L<f6=^Sm7+V>kGD=?0o7}^ux8V~bm?MxiXYJGP
zRN2|OJ9kZd{OIr#mfE){ku!5{%fUo6Qxpm^@kQih-iOUpx}<xT3B>Pezq_+e#P{zd
z@t2=0<y!St&Pa+{ONp{~#~eX*GA3*<J!G98z6?+KHqnE~B8WWU`Wb1vJjbRh(KMB)
zj7Q6@?qt<@Wz&^}Mb$#!71`D$*7gH*D7GS>_;oo?sZLPam~csyve-+$jdq50SAQ1O
zR{l^^Z7PDqB|F&8#@scU-7^V!&Xf)n`1|&ivtkF?&1I>V^E}z!CH3h12wx}ed^Arg
zMy&^-{$|qS3YMCg4%~trZ!$f=m!ab6Yd!O9aDDWxkodJghWTg5tti`Z%pO$%-NAmd
z<hxH1FYBu;TFt?J_o{-S;e1yK`8SSewUU}|p7neq#G);l+;c7ANKaL{d7+LIb#Rqz
z<MP(0h{oyls4R&04!S(tsG9eEi(F@^K6!17*RN&@r#DdK8_jU)2CexfYBCutj4*TJ
z%Jw`L<?ZUVJK31c=<r-#FD-3~YdO_c+g@aVrQq5q$85qf&m3FYek~}Hb*k~F)4`Ze
ztyYA^@S?Zd{#2gdAzAf<H;h-VN7?t<ExH?J`zfDMNe7h!wh%(4%h^H{VhcIPPHKW)
z53{1RJ%Pv8KTo17@NP7WAGsCcKoZMWOgKw9B@&?jno-S#wP$L<6HTUG5<}{Kf1G?(
zd)5~M%*(}poTlU`2wTVDT^EY3W4C=igm^u4KhuZPtj2|m6<#5SIL*^*Boa`kzYbsp
zCp@R}co@pgHEhzu_a!Z|A+Cc4(I)e(B&>4goPz3wDhnNjezwE~TuE2C<?Kr9^K(Td
zqp4x;Ig71qH~6UvJo8GL?DYT-hp1m_Sy}OlLE_gp8KUOIc2FgS)P(d#^9G|MgmVaY
zqdx^p@cmUz2mAg=R#wPEg6ij6q35J!<7Ju^({47RadFQvVbrp*k=*f&j$=VeSHP8m
zXTXT6NOABx>Lwnt+o=Ceu`(7h%e!g^8SRYKL6+m$VgeCvW@YwAWuie;jWgswT{-b7
zo}A={5pin&blb<r3UT0740b>iC9-KhUx`pxpjbgS`mrP_VcXik;aSq^p1p-+fCU!H
zO<=f^YJ2(S36=~(6l2kM6qV0@mgDu&Sc|E1mwaLbKIE|!zK04~dfMp(%Cu6P)ZU;R
z?>5|Rf}3K``#ElixDu=`#uB=NCAixR`RM(LV15SpAkR-(h99G}auuuSbcVH|3lFy=
z1$?@aTL}lh!&=vG$5E8T?qun}^74BVLK`vR>L<E;T*wJYrbv=2Z@tAM@sTvvS4h>K
zzB_SPK;_bfD@q=+rd+m);vo@=x@30*NNC`TM1?)<$k6d|WYR`7dqyO}$AA*f-<TJy
zj5_pqskdlHY)p%9H%v#hX$}@ny4`6W<caIB+|FTw>JMSd?7NEIoGlTU5;UD4ClE3T
z6g>ByQ4q}WNQb3vaAaSP5MmQ9-9amO(u(!&8;FaSsP0fS^Umim2~HmF*^JgaqMTTh
zygW;0$*~Dnkin1ZUPY0w4SB{wSCDP#IJ-OPAZ40n`mJvrwqxBm))&?bLk2CqqE@#V
zkKm{}?TZk3<c>%>GfwkTfb_c<65JUw*rn(an#Z?a+*iE*TuAo{IE&N|^7S$_@}7VL
z9#Vqc*$p1{<DS=|EqI-%W~5p6W;!}TK*ov8-S!I@_CfwUxb*1b?+6<;?aP|QMJGv)
zg+ClM3k-j2=zxK5z=sd{xmvFepM;Ze09;!?xj~Oew_5@){`GX^xfQ<U`+wNoe$Aqr
z9n4N-Uu4O;vI|8XC7ySd`*;9bhR{?-s}hvL07HiP;t!b<7*KOy?7wp3ccemJN?7dL
zg|yFefgggObcq#{n(>*YiX%0sO>9FE#NFukijpdtMgl`0JY^{$Kg`1llA6>idE+bE
ze}Z?QXDD~<&hgoWV!k5c4Rn4D#A#EMw_LZOx7mG!wZ^%sf><6LXx$hZ*)v*!TaG&%
zH(A$6Ln5o|eYXWu%JmsSUoO79%p*sqJctfg&!_!xL|(SKCWFkPi%*QLe6%Qr7ReT!
zX17H2p>P9l3AGifXh}l9QsSf@OW6O2@y54i*tkpyeVZEm(a#cEG%Ub6w6Y>fJ-UM9
zi;>3aT$|!}Y}Rj)kWiLV;YP%t!{dXdV$%xuc^gD0wEaXnLaLT40v_?1#?>Lp)J};>
zcqmQ%D}~7pmnE(%cUH1`Q&zZol<zxS1I@d;_mcZ7;^qj6?#0^*W8wP7)DbS8_ydTB
zll_rL;?q)XJ+iS*^OKv$AGqyw+MHU{Y<A+pc6byeD`065KfD_+8HtYQ_k`PDEL6Y0
zqi|tb@Hl7kMQj&Cx2xT$m3|p$ezVEC4)s~1(y4}zJq~m93%{AuUa~JJ<T^awpRx&Z
zH_)SRG4&h`XG@XN*!|x8LOtBRF;$b*z;oHaeN{=a;V31)c`Xn|LYm^56DS-5LkPkw
zbA3}@do+a9Q&K+zJ1L}*s9tI%J!WJK?w@mvnsZ<bB1eL{E_|4qyhZ05U+@HdbFU`d
zYF)=*AVSwRTIpzU{Pt@3mRKwNM*hQ{BJzAY7uleY1F}Op$}^glyZUj=PjRp`f5CNa
z<XfYtRJUeNf1*^EyKFl}#N3~D7b{+KFqT9-(1ybcl=jw4obxnkK9E4Fo#|Oc61T#r
zzl>oyw#5Y3eC>}Dfrco{Uc>0{8#ZnTkH}_X`YGWNQ6h`*0xGWCS>l#8<`V?(Vt2!`
zLEcGG@FC4pqLBBEkM&_o3pmR^?i;UYB?+<7=l*#MAw_7E&x?9`kF0p9c${8PJ%Cad
zy$p>IECoe^P(`MX-?n#1KYSo66uW2E<48v(pUAf1#xXn!={IA45G{asy`&JSnBI$f
zUos*D6L^l_ndIm^ROPKnV)-t-Ibx%oDgq0^wNW%*WL|`jqLFg0PKP6&Ms2;MMpEbj
zV&sE|&j@;vz~rJWsw}Sr?$(=c8mSC~RP8BM-E^9SApnR?S-V)Nkv;OWjJYW4${tZ%
zD!<EHH*c&oO0|R^z5Frn@Eg4?%RXg=AT72zS-f&{DlY0~I6EIJ-avlAzC7mp!g92@
zq<1{fKEy7VIs4}&p3ZVL(y6K&wiHLJ8pgu84!p4Ww!aV@+D7EwetpnAq35+PpiklV
zla=9TbdtJv<N>+tSTbR_T4^eZ?i|tmRZkN$nl%OzjaIc0)W3gH%R5uB=rfeL!=l_R
zSz)-zfoQ`xj$2W;>svMpsfB^T&1!$_%$k@Sr1p*6JAu$PBdb~ko+jDg6S*izp*W)j
zE<x#_|CfW7>krK1=-cuZJmUpo_9N*k#=Y3#J>Q3vImeHS<y5<0L3|94qMdv*E#Ezf
z{OZEJL`YtssP<mPNKvPh4HPx8tLYa+-Obc&qt6<KIPodW|7oj+b_S%JqV1CP#Zl(g
zv-uDj=Uam7_Lzj*tDXTJ%(pKPk6goK&7)+?aCBkHG~nvu+UvvG6?>?z3;h&)tr-+D
z7VHvkFCT3Xy*pb`zcGGy9OC}XdgS`zBEOxIUqrOla_q<)@#QmQzxGR~y$@!2WcyUi
z6-?|R#m5kiemXfnP>A?bs<xVZTGPgN=zb3_ls4kM=pug3-V5K=ZcNW`2AKz1U>-;1
z?I!J54{KDeWR5PAWb+TKxZS*Ik|1oU*TMKQzq^g$ypr%ZT4PBpoDn)&q)J^F6b{MZ
z>lh($8JAK!d9vnuj>XsE=a`^hb)#~o8K&t?>l*UKpJ$zSnQ@|c?j7k+d+>o{znCi(
zC8O+uH`SpA%}YcCx`8GTEO&s2&h%sGN#KsTD|OhV?pCRJD-vGQUv>#sL_^HQdug0=
zT9C~R06pmt-XDE^83%jRbQIBHJT2BN_#G4tFd&mg+tJoWzx7VD3*qV<53+fTQjo06
z4~1AQ92a|S^FmPhC5E21Jy%i?iy;V>qZ*&GeI(KGo{WSaQ@*~xLh^fi@Jv?*nRUAR
zINolCDQ%IoDSyuy)dYqU3#soavTfUd4}5KLiCyjby%&?PTt1d!t)DxBp6iftKL{To
zL0ze=7OQ+a^%KujvB5L6G4;|m`yea=1B%x_=(g?TZY%nE7yO@Q+?Z0Qq4VDa<)ha`
z0s~5U>apmo9_f4=f~M8#ma)v;p}9v#_PPM|Wj+a6*B4|HG3KF(BBs)hmL%Oa&3kCn
zj_5IF+h#<#qOyl}xnH?sf~UPN-Kw-b&0bm}La~h~pxhU461+3A58XEOb_D{DI%H{}
z6HV*W$+Ji+gJ1H0FvLw{%LkeA8umJFz}*z#AGSrV&235KXov1ttHPmCBoW;@e3gzz
z<`$!c2ae=s<QA@b0*virD{fU$rqE&W!&iFW5TCBDHDlmDB{x5+)GbOIz@SCW=FYBX
zdJqwKuEkAV4uU;4#@JNc2|PRW43J`{u<VYkSFJD59(D2*5neW)pZC;1+O{YS|4O7K
z54s*7(nvRDfQUC52*{tuFWOm>#b&WUiJzytOz3{`<0)}bDP`Unzg=$4w*_Og^brbS
zIO#UMCgpmo%^pnR;!2X{wSTEZy5h;xEBbozdAFB~Qt#yVYjRC3%~<~d!6FZ|vK#6U
z-28as^@;1FG@IE*9hHP<79Q=#E^{zyA}%v4&EqEbH!F71LB8KH82Iv{ptyv-5Fa_n
zN*jHDMdKud7LklRlz#M)&<g^7VbN0)YL^|!RgHI)r=ch(vKogbOofPyOP+G%dXW2$
zof9U8Euk?tQYtv9btwf7Zo?&$<qOIfTMWU5N*sZ)%fn=p^Q|`d>CRduvDEXXwHcu?
zwzO2c__4;H2MD*x+#CM-9+D`N8j8+47HZeU9gJ`kj>^061>@rj+U%cSRCQc)hu69r
z!W&A57O=fpS`n&UF-)m@G2w(<@k3Nk8pIPK#jY)8Z#_o9JE^Mt&9i^Lt}NaoArK67
z9VR2A_h}x77gn%bDqakFjR|SfpG_hmpb#;{)o4AFauBto`SeL2*?#ggtg*^{9OJ5k
zCj-0MOkY!n32oN^>3Zp`OSb41W8#}CFk7RjSlwD*!FdF92se>FxemT{B@fW1?EQJ#
zwbE(-S(4$UX1_Ks$<#v>sg%K)v7J}M!uafuTjM5XF_C?v2tQLYGUt{>B|nE#>8D%V
zsO$DfHeX&bY`AF`DTqN>5gYeCuLw;2i=IJDgXM#f$mWx3REmp@6b<kuaNB#zUKPEZ
z+Yuo#6d=ve_24ugbJ*x=JDyWLQ2%_PubEH!;b_|yZS0_oq3y}J6O`R4G^p*`zH9lh
zua|7&H#b}#Ttz8EOSN%l#*_|wYQG*mkF4EyyP>m{_0_N)G#iNbmo$t{<Yk#84D|SS
zL{4Pp>jL3Nl+?SA>pd~dE*1sJILi4T9zux7*6J3*<V}YGp*XwF<})g#W0M&;r7cr9
z11dJw%d#_)t3UE&;7RPtAZ5x`u|jO&I1KD1Cb?F=wHNmo&JS4Bg}{=#X3-OXn3A;c
z{1q=)ojq;VWlp&*j9~c{EIN^chW|jJBdaUcxVz`Q71j7N$6#g+46e^?L4o9?dvn*Q
zcJoL2FkUg08ufwUAu1%=#<+0>=QCG22lQCRoM+4jO)GL36$EA5%rXerxeu2>X0wv9
z^y=8iddRmU0|GN)npDiGnRlAGA$*eCP9O>zHLNgxT_E8uLo8m%T7jI|u0ky}b2(B0
zpF_KFUR`V9RsQaB@_6Zj##b2QGPF8=muJ2%&wfCjn0wgG`NTjb#I85+g1qB!n;KPG
zfI!eb;(C)Rtr8huh|?=mYw?E`p~1Jp(rGulGdaBXpBs5u1oI$444XHOT!Gfa>}p4Y
zI#K$Oiw!m{_7kz!I23m~OOnJ}!w{c@kS*bfcytReF*~`&s%U(;k*?~UyL#9TETtnQ
z^t=LvELy8_Q58>b_Bd)!Id$WbNngZ|^$8cZy$!kRb1}w>LrF^;A=V%m=X-IyQmz|#
zUUE^JgP&K%>oGQPi6cx0*wEOPk2*~$J~>eI+g<lJ&3#7R%V8)8)m-oMC=^~~&F*V-
zJ2Be~9MDmA&`l}{`OICv@Q%H9!)6d2W!feVj?{Y9NA2N#(AiS*9>-+?D}=;=S?B1k
zoE$Z#=hWwq;@<B?gdybYc470erX}I9>rjEWZ?7QSdu?6oqt88dmyDNG9{Jin525>>
z$KJgpFpSSGg0!+a^Q6w=EgQVVPL}ABsMIu78J^EIRCNZCPI9NIw7Fb5YqLr!UGP9G
zfBPU4sVtjMCL@&iJe#V+^>GsZPbR{#xCL)5yvZNY)t}tgm_7Gm$-`NZnf?3%Bw3em
zJPiGv_vaV9PJ_^k`zF*E`g(>=$*0IO1JSlYnljG2_GM(;)<gYXn`T8=96d2X>mVr!
zj4Zj7b}}_@2C5DrI{(<sxx<b0Vb!J&mmkq6a1M2EY{eZLwG6fAwJN}<Wc)hPtDej+
z9<Z6Z?eXcR1`^iTlclsh;$VEfqoV#f!|!x|o+4#$*!7j#Fe@gsW)<#=TuZ+_1w-nI
zV0jH@u)@ycRzq%4(h(*{)KmyU6j}_(`=CMY{;|cmsS}=Q*<koKR7#35=%CoBcU3b=
z5`_WTOOziP^-Yb;hF4U=ad%pMyjYj1!c-ytMy9#OdP3Ft<44q0GwQyJLo6tct4J$m
z7B7&5(8zz-4Q7&c?qwLmsE*iubnX011toImD3WH{#6nUOi*SVqo+gJ|hUY2qoNU$5
zDT$)9Pg;hu<LNg_`|WK)-Hp(ryCzbnx2SIg*h~rXJQ1J17a(qa#2?{1&=-7mcV{++
z{yxvdcmfsioh2{n6!e3*`;O!TmqKpd5RcHu%fi@kk9~KoweP*_%G7kW#yuhe7+$R&
zw_IMy;=ypVF@o}4b$do(4kQ9C13U-C9VBUcB}wBBcCwdJlQx7|ap;21TbBuz>IcS%
z%jhhyW0`z=ZyP4f?1>fG=ZW^=3^l^zaU>NRNd!M*H)m1eBf14)%N=4>MGOyT<vJ7+
z*8ok#Lfl8jBL%{zwAMk7_a4<gpYTtY=p!BSIAh{I=yNwO+?}qI<#XC8JJLR}aL>Db
zw~W}tBA<YL^yB5KUu33V+}32SbZa$mn@9;s7BX*D?jON!O?9JS<O-;*Q7@=r(Vd1n
zrGeq7sodw{sXi>WWb%HtYhh@u+zD?!#?d>(R@&eMKeoB-IxFZsVFW6{9^Y&u9~m#7
zc1}WRC};y19(wvR8;yEoe6<LGD3#tgy;p?ODu((oeFAXnmzPR&`byuYb+~f{Ito&@
zYbyfElemMN1l|fKbRr<Mi1;A_PRnhOr-^W*qEm0byL;iY3J$dm<N1#U`%CiZtI|3T
z_%dt_mbil;Jv^RjV#%x<0sagAhm;R=?_B0}bUthzXlY2Gk&uf?%G;fPR3m%+eB#9H
zx1#;;^P1H6o&eGCQgVgF$|i+6g~n{8=CvQ9nIB(AUWa{&ZSpE4QeqHB>V|x2upeVj
z`ljtBuga!=sk&sqWPvjS{^+OcJN(uCtxAF_YzSJGc}G_kwzFKK(^mlov4J4aF>ikn
z(PuO-2$P}&sr%?RVjb|%Qi5kipwL$ET4_Ow&*fLe*O$VSGwOR|!Cc!%$)Wqsv$|8A
z)@zyKA%%HU9lL7bh3d_oZi(DBx+=PANat&PbZZV95pMj>Jr`CDek&Fy8<D(PE}gX{
z{Bw4eZhWw+r>l`g_G=NmGtP)-BL(+wzInc9hV3)%uyn_&OIS~?;JB|a#m-vXczHN~
zefAJ)Z%xhGw)(D-@90oE@7_n!t8{`vtGWj<)tPqQGy27?exls1nbZ45yxo2}#SIq5
z8mlX@((xVa=DUKl1-TNR>$vBM9g2l;tH!-&xBk5LJx~(f)&04dySO{X!7Z1}J5<%7
zg-k6pMn<IB51Q7g0!s7;vsX2hWX-x0>m%2y2Q2#&&3HPm;;pA%Wi?+=Zo$zf6d&KC
zqYZ_xtJccf%aInWh|jue+P9jqpIz;&=Alrn`G+MNOU8b%-~AlFR$L|gc*U&S3TJI|
zKsW}X=To709c_MZu{v_esHf{@ymQu+Hej;O|HgXZN_}`oD^E(K&VIu=vBAq!X5(6a
z3E{m7-c`f<;qX*N32mp?l*VnX#KXCBb~kl}f=HJ5n5ibJAHr()E$+QHcThd8HQig5
zykjNF&VXku@!cHh&Mk`PFZd<acUn9JTka_?nz~h&a5e45A0IoUgQd&xT3C!7cBATM
zmi5Y}-Mva@>zJMnY{M)<_d$v=d}V#;)3QziCjP=L@oV<`3OuCS#QCdtXG|hK%XhVx
za==I>XGWO1B;zfm=!4c7%+(9_V+EgjHvduGKBGmbnl6p;wZihT6yUdtf2Ab4K9Jrb
zzN0qrocYBu&gXbRBBLU=j43v^+@5)^Zs|6U4}!IF!<MUB1ee(bAZ<F23gh~uwc|la
z#)a(&Ny2Z;W))&-RLVM(E8%n%fkwt{JTQD(tFS2)tyB#!)#rR~b)bAdg)EVX#?joD
z&L9okd!T_3Npe|4@-GpGX$h$jLXgWT-gN_yiPBW1vk}Onx=0x>(&;vPH@fF|kX5*?
znhIe!jFmvnppnl&d+?H*)S+n;kF@A`TDD({v&h?C=dj}oYX82Q)rG@t%M<htlr*Sj
z>UlFgOHqrSD-p<Mq@%@X?$oZI$Ww1h5r#%qU2zQ$QjD|M{AzQ?i?(rpnH<xw&R5rR
zAx#)kov)&bRcbuLTz(rn^>BYyF&0f&MU0G?+J)3Rq0($YUO}sAxZO)(!?T>9bY%?W
zxx!|1u`4f(ToR>v`<}nL{+g9Rkb$M-1ef%ibIN}61^NQwISU#0s!&j%SiSST)m867
zug&R>df4M;(7ppuWFN0fv6J*P?wGS9eClrpLpm+zLqE*)rWCx^fgI1E3B3!N@`lnf
zd_Fs;p6~7H>Ud;iTPx_Y_}7Z7E8-awg26o2GM6Z!(YmbJ81j@))P1FphR>!=f)6!G
zP-=?tyD0?>@fjXFD1AjBP1`d(h(v1`(NCiBZ(zvmWJX%7#qdM?nP#^2n7p~>`+VZ>
zZqkn*3M5C|vv}}t?1xv|k;Rv<sGJ>b-%Qy49C^OH+A@A{@9uMyFM0QTLqy|?*BrXQ
zAklc8dK`{Wr$6H5K2(|0`sf|O{a(#aH|%l4ahn}ZZ3$-0BC_C{yK5Wc-gv#biTiUW
zpT?%n#->-Mq?fY6+xMITt>-h-dfv_}r9lDD4QDa2{Ou$s!CqlKlH%cx1~w+Q%|iI+
z_p4q9d`ti0OAti3C%98qoV!qURprs7f`s{mEq@C0d@d$Inyku7awgz51@XmlBMf<M
z;x^8jDv};1(9Oh%2uI%g^e%2GkN~4^^TQ@mH^kU|cj{G5rGJFJ4Y}MA(8dXSz3Rhj
z^p=p-P4&<F!Nc$$K4=fg*q4P}x;z5~|JLLse};Gl>I^EGcI2Gf<+K!i`~9bS6jE6i
zuA3KARCwTvwauUYqTNw}q-Nbxk^%*1o2^z!g7SPiXPe65_C-Zq<l$W3#d$wJKOXcq
zT}yB*zRma?$IE6+k6$1|2mwoi&+yyw3Al#G`9cH<CBB1T*?pz4S=iRXa>U9e8Br3&
z@@Hx+y4MO*_ecNOc>ZG#`&%FS_qS%`5%l*TZ`SWtg-ckDE(UC`H|;EE8S;n}Oey^+
z>@h*nO4ZLnmNW(=!{hkRlbFv!5v$!}vJ^KU^1LvNX2_n_hCIt`b0HFK{C6)hc7%k+
ze=79+)A4xf&5w&NzniS-S-l%ttK4a!n*tQG?Idig7kPwE5#OZJ2)<)ifta3lcUD|s
z)H#AdMK(^8BRro4p{LTy=)UA&D;CQEx-GJb9=o``jqkW6)xgR4pPusfhWqayl++jc
z>r`Htc-!t{$Sr%vk>xeQ!S$kl%vF8HVx08L{+oOJWO<N^NyXFbE>p3OP{PH8dfZ1}
zR%{6nS>cmnH-sW`q|P6|R8|eJ!Kb8V*!V1^`1T~tFIxWkpg(`Xzx|Y)7h!6N?B48d
z<U;l8A<P_+ZNt#aWn2j<N$fF|{ocz#gOvm?OI`^x=(aua{ORCW1y}=Ea^*KGr!vB9
zuOm7=Mw+XZ&i^k@Vn%47Ix@WvxuNv}!&*%E1~fz`kv|}7U<XaR8eUE!=M7bL^a-t5
zP6kejZ)T5C%O_tKd2#Nw|GA{_mxk!y-oBI|mvp?DV%;E604*+b__P)g-kW>*I~Z4h
z<Ry?b<B@N_m19;IDR+Ub6m`==%fG9$AeL=m2(=O-lFMebnZS#|PN7#OV$mYkOE-?w
zumHTj&Zb`qi9h~efBPOI=n=LK!w-{yJP+w>+u~CKv{*sds@8{S%x~n3ugG!Jd>u7l
zq3^*Wgo{S<WLOEF7NMTqVT;sZ8g)5L!kX7HIdk67o@A5%!?^r4M2!4GKlR)U9HviC
zu-=<%Gv5?R^N@(2W$I@$cu-mKx<OF`yR@i2QW0VvC)gj$hqFJ5d~F;Q39SSX8CUQ1
zoS6ap+dqAVzkH-cOsSwZ5}n8^oMCydNu%8{O7A7^qJ>)XC_7ptz=n5(Aj_#&%88!C
z65St?K;3%@uZfO)`uH`X6^cUz&nC&^+hCJypGxEz@=(3b#&xInBm-~X$pTssX^h3(
zfk>*nnW+57;+Q%CriNX58J`4%?4yWX7ey4hri0WUd2Bs(K3S#sEL%D0_Oc=|pHa!%
z@tFts<9)^#wE1XE8R~N5%K#)8gvg{=z=&NcDU6(o%D|a@!@-L~ugu5_Iz2hFBDKJN
zPSN1(u+~joGp8heg-*(}#xR?ZlL-1sLJK2x5zUB4ZF@sUWA|~WEnEMmC|eyRq?&^c
zYBcHeb^d_gvbZiTT!21aM|T?S%PmFVi$2GLw;iH4LN6Jfg_=`dd1k^m-NPMsDe$x%
z&1z*@9h*Hb{dr%eL2YQg7eY1#A~{TNF55eNpt|c<M>9)}_EO(Ok!mkXY?mmH>Jwfc
z^fw&D0%{PcLhLeDB_Bg4-UZi{(SB~VbdV)XX5RC1HRB6<a38qHLdJmK<0_dzYecbH
zk!!zo4_X1q+w0x%_oiPv+Kr0mcOmWScjESNCTaDOauhn6?kW^IF@#_5)UL~D+d?XL
zW_yy(JpMX{-_RrfP&`&_w2LIZx42Z?(@IdR5;`IO!8@7T733#ODv5@JL1kEyNg$fe
zPGvX5Y0Johihrdx(aoES<{p=uddRlQ?o@!y+*1S_^}Q``hM;d4AW^WK-DvyXuV6~~
zy_uN*vbO6W(^;y+Zwv#cmYc7+9IuYr9Ruk-riJ$11*TFhKeJX>(Boy3*PpY;YDtu)
z)UEnqhsc)BMlNa8ZQs7%Yeq7*y(c~HmaUMNCnqrxYI$R>+MqLDtVyy;E0f~0l=J?6
zX?@@K?o+G(+8%X?QD??{xz&!Ey75_0h|x}Ui92%xF=pj)gN^Y`f<gK6t&7g(FP&KG
z6Zy4f`kJ?#4-2>rcOB~*3?E<als#86h9I5RdAF_G7erb8>h<8D6U|D-F?sdmD4RWc
zzZo}k@RdDPnN8~+b}(I|m193fXtop!Tw)SmuZS<<gqyp}lh4%Hpj%FqE<iEyfxF1l
zV<~Nqwi5dhrr6bQd}CS1=Wvli5KXG{0Fzzhtg8d{)>Ku=P5oIsW06{c+DK%EV11>N
zhFt39R{__B)bgu5RV62wVlopT78!!H46cdYsgx;cl{TMAOw}7#5ZixLGLQ>%TRzg4
z^S6>D2yw8Dn+I@m=+UYCm(o*IC%SIBPtZ5(XhCGzV7}Z0Vhl>gvX(8b0<|o#<$PsV
zDh!bRbpL3cn{{p3@0iJMg>%bBKjGx4(mwxY!pE{3K^q_#SHPGuWV(n<=Y3qT#MqU}
zP{a7)q7bN*hyYP!8j{%(bWmbjGA`?R1qHs#7u*3py0=*Z<9S7%=X(<h95^@RVh29o
zeH(-eVuXFXFVA*Zj88j%9=DsOBQmkms+Q==I`7VYI}htD`+tm`WmME}+pa}WK%~1t
zq#LATq)R|RN=mxBTco?Yq?PU*I)(=6ZWuad=ppv_*4oeWf7jZ3t@#4;3Dz&}`@D|h
zypR0iHTAPtl>q|U^2u!UW6LgXtpeH{Y6-KIi&IT&aRHC5QhR)QX|kF`5-b*l%%ips
zljgvI-O}e~tD+hI4T@B=fCy{#))k)0s&zkTaug-c7g5+HjppgzUEPH94GdEdl&R|?
zCzq|JBR^(^uQz8HN=c2LSs$;aBqZTxGD-svX_ILq37b9LA7;!~we;?<NzHmrFhzGh
z6LVV@ufRvqPAeDmt&SbOFy6&>>!$L#quW`++@bm*<I5ZvXQ_UEU?h9HZbrlDdvsU7
zd(*LrfUhta?~#mL|Acr6+*q0FExvE_r+T&O{-mOhw-Pr(=h;R-Ow>g^2hbo|>y?lg
zeQR6-ZmO@upwX)3CfmeUa9u!+E-E6!UJ>wTExOH{(%}*9=<WWr6anx)Vx;x1QRs?q
z!;jCLvvbVHs+2>9D*TYUll?1)vetP`u>9$(Q%3fGe-#IO!5Z|K`>r{fUUPvWPVyrl
zlqhDC4SSoCkz2&2QRSDoz#R&&2TG%{O;>z|;_xVi>3+dT2!&~}HSec&ipmO%JDdHQ
z*aWQ}JX)ryFm<YEtrANj&Vo5CPfr(a2Np^pvq%xa%|u$ok^?keMta-31;YZpO9q*q
zljR!hf&H(rB+m<!!l<sD3uOjW;Wf_`_%J+ps@9g!v))(1(|>U}03Dci2v`wc^LT7%
z&M^)!`q8&!FgMuVa5zL7xo0ldI>7C?qXOb*?}bxtLo$@WGhq}R21~?lv_Cdet(Lxb
zha(e(lL*MN2erGeUgj0!jQdwU_kOvyGHBB`mZ@L$pRlc!lIw9+&}ATRy>#r8Dm4Ku
zs7M5{ve*i`q~`iPh@s{VW+h|j6Y4p&(2PY8i0HO+uqQUH>*Db~#unYUjlMs;y(83r
zN6F%^+3^H{N;0Y3#WG$HgX9F|>91d4&f2wVK{g|93iT_PYBwjY>=3rM6sqE4^zP;7
zl`3}N#W5ON3?j=y$-3=V_sqtb%T*xLst%1)AWYO#lF+f^`IHpgVxV(IdJ4s`B^kkK
zr>Dkk0Z|z$p7XZnU#bfderPHWg6&}fh}2&n2>2b^q{HVnzaAu!`(s3uysjzPrs-po
zWrXS{`%}<WArV|J;}<JUd%xo;g{))CP_SmV-K3@(q|su|R_>j85-6M}*(?+`06Dyi
znd?MZ=7Zr-80qhMb31{%r0F8Lk!w{rh>^}=)=X3Tr>$s94^GEg7g_dx)v&D+mPDkH
z!)Z9;)0pCK`q&pzq(0pmv+@?K-D+EsQ>!%88+x>Mgfhdm%OtC=7j(2z*@AN)|0>_W
zUk|)D;#NV?Xr<y^={}zmXfi~Kw!#yN1ONlk3e}pPrW$u8Do^?apAEFHt-@)8s+w!F
z*b-QrZ&0OMl<@5twg=A&V%SnRm9LX669)!+pjO2T|J?;}=UlK9?f!xowzu_as$5;h
za<x1llTf?)`^NEXg)fjv#j_%F-u*H7dzHf@>r~zP=ilD`rgsvAt8wMSy#u8O`IE%v
z*=6r9U)()R$C9Ue_hHKnq4TX*q7@bt*+zz%^o9U>)f0+SJDX;r+dSm|jxqM2r`cae
z;7$t_%dd;J5&N9g%%MY2-2wC;Oa0$eUCS0s4v{E*NIvhqml?Qw2%q919M40Xg8RLW
z8Ekj^&~H6!&7Wyfd6+i<6&($7C9*VTxTH37yr%mOpG13d+*ak{1GEfxER@a1;)si~
zB2r?hk(^R6@<GxC#U*m{RJ%5tA%D1wbrO{Zw}Yx}Pd>+fFme-6YVmzm5eUtGPDDrI
zwO!g54)m<<+{jnRXIXKvrtLmDhE9ma41-^A72Uj`bv7GIu55ojbU{xrQ3!>fsyc`)
z-*xUluB;^V$U-b=B|md?948+eo3?+vjey(&J>fHGJ=Ec~cf;JgySjpS{J1$?Rv<vD
z$|Y1ypjT&fzjB>&-;kXraK+&NS^buRllt6`r4ZziBL14jTH|?VN%nH7N^N)xlbVB#
zRa?Hj>pIR{dlR2GTyx{Wlb!hwmrNy#vuiWM?gu2V?LAx5o=Y%!{QOT9X2#FeKg;|J
zyl|SV=6S07U5W4eOavZB>jHt^Ge=|k>W!n4#;@($*hDB3(bzji7d;{Hk3}p9X$wWp
z4gJ*rXMh*qdVb*-Pfw!<wV3Kc42tNeZsIxvSL3~@1kHq#!u$?tbb*wZnbODV^5;i)
z;u8IoxNel3eU`Ad-oPp{_+yBTeU7(ku?e2JoQqR%9}u_H4Y#BA67VAu`)4#BZuET9
zqPUqk=bX+z4IN)a9;8jxqYkBXEEIA_5l-Zuh1J~{(;RbH8K|}|u6tV7&;&ASRYlU^
zf?}}3TsgqEfx9DI(b>-9?H`*b&dXn&ofCB_^$VTGBOmtB6H<>~bolx&s(#7FoB50u
zRGW5xIdZx(F7*74*=cP=p&@o+EMxP0pf|C<Ah>EQ-rIT(?J|LO$@P@6YRp&8OhklL
z>%~%WPF7rGdut;haM!p!ttJ%tLr%T3zMm4?%&TOV;2Myy>kM4`D9wUlwFAsLswbn*
zpfd#`8eK8owo{4h{IyHsCLA4Aa~ur2!v^3=PBbNLRC`)Hp=%`K(zO#7d9j@i-ZNSm
zK@#GqXmD=!W+mT_tuUk83aV2S4wT#clVjQjbr&3M!i)7W`P1Xch9_q;NU@haPiR8t
zbudy&*^x?^n|T0iCvCDQxf%Z>28{xPLSm9ja&yl(-i8Wvqun~t>Yq({qr4-UIP+^4
zM79s&Fy}<(xK6J-D|IsXHjmTEh$`v};g_k-E$!s2Nl^D3VwOjfbh#O?AnzV+mh>nH
zmTLb?-%!|HhmF)do$Cx3O{q<^(;<e&C<uIcqdy0X|E?))!U2Jw9x0y~YW3QrdgK!n
z^X9b6aC`NP`xd0%_F>G^^<UT40nh7yxA07O4rw;eD9`DIzWg&Hn4@0b`^+3_Wp_Fs
z1}VrPtg*N>u_B(*<0PMx5MCI${t+YWAryfqRvYs&(%AA=OfT92^pyFJlHi%a#}`vq
z<<8^IYo#G5Re9pyq9{dXYJZ6Ae8Ifx=z&(NC$^rt!UW}keTjc)C^c)hUkhv&CUWC%
z&yJK;1_g5nz*eByd=NO>L=D_~yBY3Iw}aR>v<S{(S60k5Ikd|aQnqu)0OdL)e5ttj
z2`!hObtXiNBk@d@<aNp$K)l+8qwaY3-$$qB-4#;X2a<6+8>N<Ic8lQWE%%Ht7GIRC
z@XU`8=K3=MUs9x)c%)NE;vg~Sc*mKi>id~~G|N=d@E)`Y^BIK7%+z624N1(_RjSSV
zRWen1OGJH+$@1G1aLU^97Tf=tteS9;`8H}&j@JwVW~Ykdc4rEh?sO-#)M{%jf7~^{
z$q=x8-}V|y;mpz_<|ehBrhQfo3sYZM$NRTC<Bodb>zfhh3DI5syU;IEZwLiA!pu*&
zRBxRR56p*QXYII}&Zi?2M?AT^!#$1E!`_$C9)8=w0uL8{PFFm9{Or@sA>!#l`OUf_
zMv81xntPGt-oPw3=^&Tb71C6GCxSDTK~NOFt|o162-l{56utk`UCBq)U{g2)sQXA0
z8xiM><%=a_$cX>$?hV{t=u^Q^*nB6o(-pW4`cvt!ItDo;>q%Rf_|@zk;y`9QQvlhH
z)sThGWxsSfWM~g@iw$0;S_#Ci*nC*{5J^a%;}SvBVLZYgl4L?nPr+z$PdnbpKP_Tm
z8h-8Zv+-y~p;(z1Jg7DBNJHLceH(7B#~%t`qp+|pyM}+o>pHq`-d3KxtBqN+j$VEF
z6{?Y~i(9iTgwO7ADitOXrZ6~LlV~p2TWq_cgR|);5fe+nDNFHdnV~tgcen8zTS$Y~
zehn|KIoB5wkCyDb*-sl-`pp6IyJSSivFGh8`HXLz@o}{D_<(*>i7Z@#9~|T!o1KL@
zt1QJ@0%%D=cFi&p-Yy>Xv7>%_a(Aj=xx_3%drn@8@_E^2dg|`&p#$?A+E*?)4+o(A
zyIGgSWC>pXeB<O-10FpBxp`1(qeldoxw%r}63?kq<XfPa>O<1>mU`?k4Ozdz62=W@
z5JXasqf1DL>{+-}{0*`crjWQ6)?t<8J(X|b9{f!8_#^vPk>Cvde+!E?{P7UBnHHaq
z;JaO#mERXt=e1-YNL2=YyaR$j)_bG7M*8*P7XcqadVjE?Pu*gyGGHEk4sA`b&#n_b
z)Fw@${`-CHatHT5Jk+ff{~oG7IM&89cW5jzFl>J`H}nwY5i;ZZ*}yPIz_=FrKB~bL
zmaQJV5GC>Y+O5j9lLKa%F1#78#p4dNJ0ZC_pEx?G`9Z&!(2w^1xIF|+s{ccpsa@1R
z$Ge)&j=2vaPn!q7!axjazR04R!qD?c8WYJ{twa@kZj61<27*WsG#_19Q3joo=vSrg
zT?JINqhV@Q^<vyx7x)Rtej`mau~+JDRQ|qq#D#tO$@gLN4Om^STz$(HGVCb$auF?l
zw)3VyKC2=rdENhLs{;oOk6nN8P?40cHTdPR_(zG+v{3pWEDE2vdb**3w}Mzvh)HkF
zs9)F%4PXZ0Z=xsYA-Z^;WMWapeLH4eRaX~%+>uBx%v0V6n5+nq@CIsSEhZPlG8VtT
z%BU|js4V0!Ja|D{Lj@rsoY;Ta!-~(0>=st02((&0FPC1MP3ypN++(yNN*z4Ue`Ou!
z>Afq$ktV(sEmbAZ69YqqP;O-eV*tsi!SQgMYVg9Vow^9irLwuU94HE?n=et5g@o3)
z<P8*~djkue4p-o#x7T}U!d28Q743npZ#RFFG4GJ)=OogFp9=~0wh1rtY_Dy!W>oKY
z17);OP@1{N1!Z!wc)KI&R&bSpzTh=Gu`sP6l=)caK;RDkb4gAXgVcu<?nnZ<pk6Ao
z4`}MZi^(P#`kRm!H=mDhLz?*xpbN5|ey5psnVc}5k(7MFy?r4xs)cuJ&>{NV;!US}
zB*Bz#F^_WL7eZ&1cG}%fH|u_`IlngycL0&@D~VX8DEhsT2L3$5nZPdxWqNO2QC7-L
zR$Cha+#h{;j#`O;9#qb@w<lBs4~!+*#A(z|Fyz*K=Sk{Ne&zL_R7oCIOOl$gal~|^
z0lGTC9?FBs-hQyD9mi1V$|X^*b~NMKn`&5!*Mr7Za?A}Uxc<DM<@Bb{Cdc!-r5oNQ
z_mRvz=t%Z9p^e9n!%(61w<d%)Iy@E(KvSmkxL)S}HeqD@Zm7r}Tez6BO1paZ<h7r&
z_W9M;|E;3@%@Sq5e{{P8`DZ*w*#b&(D0NxDxU#2I_;NqLzmq@4F8eNq@|DJHj0j{C
z*R@cfuNCUjd?D-=MO1BuD`HIvr@cnmTqoh^Fl>&(OM_znHV(UMkCq%MMqODFi0=6l
z9FP^Q*^iAPw&i{O2UDUyaZ6q}$QZpqBCB7L3pym{G}gdpsXP9Lq|C`MiKOsNjf*Ek
z2p)@esm&zYChFHxKD&_t*DQMKAp9EqWw&F-&9pQhBD92>Fwu|Djg`7}tjAj|*eBm8
zEB?I~wa{HcbGbx<6Fu1GZJh0rdn%k;p}$%6t@ExRQ8uAiptN1@@wH(e_>vM@QijYx
zVJOYeuOS;k*y_RD2^+^@%r~URl9d(ymCB;O5u<h|ktMIMg5e((6G!B6DaLitExfgx
z^7)MGIxZQDAeQ0U;}WMJ`Cb~ul*ep;nq9sT;>dtIIHWA9zbQH=rC)3P&DF*~--~Q-
zC~@91>nlYb*6pt^Zo3m#M+Kt8DG}ttq!-_PWP5GX&JF2BXI^=Raa7)=We&kxGY=Eu
z3gg;?EW2p1of_>Y#@Tj)82*fD?FpL8gb55^z1u;2kAE``J(L=2=EX^gW!%CZTj*X+
z{`|`S;YkOpjW63xTQ=Zl?4t#xek+|v!Bgcm^)yu(FXP3~JF)VQ^|mwpD2bA{hG+s>
z;k_K;R`B`5NB?Fc?KpMGSoS}kS)*Xet`A$$8Bq^tOlI%H6y6>P*+Le6hVgIoDTYJ|
zw=UGgIII@|hJ!!ohM?X=1XEC9lER^RjWh+Lb)0I!W1$Ay;z;gz%<W(RTdFc3tH~8g
zAj4JX@p@br+!2`Lz-gh)k2(@Y{aCdAQ)Ov_uy>J7<Rf7)#lb>vu+Sanwik9{x<Jp4
zE3HG@jps^xc-K1&<JYkZUxKWwpJD+&n)uh|YlsPY^n+e~Qkr`;qUW`)TVbyn1dzA#
zVoB;7PA7p9VtNxqNi&Iccx+m$Fli@ea@}-w3rgdn_6gizccyy2k$DQHS+my?y+8MD
zxw>u(WLbNS;$P^fK9EVRD>Hyfna1tZ=H7(CwR@0y$p@7t97d!8;&&r+DYE#)lZW0!
znZx#(?pCZf4*u<B)kT99`Eh_-x{KASMdWj@UJu}%h7vIut?79JS)B?-r{ykLCWUuQ
zlj*U*02}XU3|(Mr63tx4MQ;3xh)-#Q{q^FssJM5E8&c)S*lnQUn?;(!-(8&a-4w>s
z52^#w>8QJN2*X%)mY^MNy<rchpE-*qqDH1>vBta$NQa5a2IZA>dKp}hTZUFbxCx5F
zGWi+N=L?$#3Z+VwA=*u_a}OUCmTljkV2=Awa+F)ptyuyBqfj~=6eMB0BOV)yU6lw?
z%+@}rFnmvM3f+r7-Mifn+#R2R$FD;=3i_D(%%MbHPQxCaMm=h5<Lp5MJ?{rz|LOPC
z`x(TW6CXF1d6l=iwI#S41pwa1h|qkXaeLP|sum+`B)RolTLz#c3BabP_OwmI{04us
zLF$)&KJm=2?(~QdAt>u>C2UIhY(shGxR()KZ~B~eb*ZeH>{hqn$G+tu@tf1MLU$*?
z@H5ie3Y)A(b!FcmVQK)2sdMgr;^cV4t5sT{yn$G}wOq-Zfg-}|M!{031c;xsR<^!|
zR0Sjl-*~i${}T7fh{G^Y9tjohHtUYM9ZZ?%aM<iYpu_TpUpBa5>(k@>%qXOWf|rOt
z_*O87Q&{xBF=fTkOx&0p%LQ<1{pb#rXR4UQ1Yd0O$*MrwT<z*)1jc6GUitW5+@-6Q
zFI@ac6{386x5wR=hbl=qPb7Xj%(cto0upAHx1LBFkS;$S59=fuZ>lDY%MYb+^JpF{
zy1<~zlBGgD-xf|oRMObuI!3j+B1-K8>D@iLr_cr!>~|2RJ>70I321_)_V5T^VgU~?
zc=vi^f;7JY_57!8#WLUbAnASnX-s(rHmP;o4x!?8(!!jAgi>})=k<5K!8YVXo_Zvr
zEiy(mTr1y*MiOVmI;CUrU<K$lg_OyN?m&D=dWn0Mg8E5h^?){>-W#{L$_egke!UU6
zr__PriLinYyTMGp+?~&7v*k~QhJP@7d`D7PoeX}&CU8yk4+qus>W!{1_y~=|Us`GF
z_N`YKP2YxrhCTKOhVPa5Ydnf$bq4ee20U_Bu;IJiD78pzo9hK<^7Oi>w{)>YlcV$=
zv6<(~iH9<(+iVec{y6CJoj3nFSw^9byRc~#p+Sqmc8h0yI6w7}8ACfe5epLB{2+)$
zzeCz7F91TZ^hOcK^u62=={=DdBpmx97V31_<90cDl`MjzLy&xcafvC-VL_U_j|VDT
zw1_ee;zG2T@W1_&EjF)2aL!*$fz#MqlkL*1c$C<H`Ek?hVyQ&*9zOMgy+tq*hEyxs
z{P}BpqdO(fR|<rX=~hUNJA!iYX7}X!m7@h?M5tmII0H~sunB;BDf`S7z)}o^hk>nE
z2tz6#+mW4jcQjULuo!%_n4A0@*y2C>EXwTq>9@;=cZtU&p&U_GJ%V&*f!7|78S{m0
zZZ@>QDf_Ah38M`?;-@r1H>&fn&4|LK*R5D#K3H}+1D&7XD<UTC(kPr&g`zEV)BHvQ
zKYdn0>$hJ`8giV|K2^K%o69QicwcF8zndDq<J=Gwr=a$DE#bGZsAz#wy+soMwp>vc
z4o&SKztC4S9sL%Isi58bGA7=6yp8HS?vo4pyNo~n)D^d%adOfd#Xc`0qx3F$1d7{{
z<4RoDP6njbcsAf95*u+h#x8hO>l+hR@!F(*c%(7|m)#q3A0c1Fg-4Sr;PlV!dMpar
zTSZMo&LYCNLg`&QRL{n(t2(7X9{Pk_FGZjz@4tkiO6t7Z%-E=T6JYA7JG9O7$Rnun
zNo(Qz#~ndjX%j;R-99r~Uep?_6bA<65x`Lv&gqla_SIcV@)X4sGa1_e(;sE=*M;wZ
zIR-^mW51+cmAS7*<0tn$=nXZ97%G;tw87wMBSXtwV7<laV(?ZMhNI5~ymzNY-|lU7
zSTeWS+ROE7j_bdHvESDQu0f2%STVC7NO?wD)oAR+SmuJc@W-4*7=6$c^|dWOfrA|_
z>z(XI05bW`0M|BgcVtF?Yjtzl^dYfs>8LtMj;W*kcII7<)O!?DSrwGYg>&90S5c#I
zT{v+JE{f%Yk@;E&*L+nZ<a|;xREdxEgXAgTiU!TMPhh!Mtrr?vhS^f4EX0=Pl%Zvn
zX-HMSJ?by+e7+{Vftl1yRAdEr8sO^6OkezCD%iF5F7D#(%a#QEXB2bGowu$2e9v;;
z0<IDkx#*{}x0*+tCk+hmG=^e+f1?-A!7e-g{Yjz_+XZ`?&uETBdLD`VkeH*Mw9(jg
zP-fnyz}R)#(x9xRal!in<ro(!jBjD1yHsU)ngkMn>;<_nd8f4R%C~~!!+^nFZFM7(
zW(uPT!HBcAZ{|s)&<{`j-NagWz7^G+#n9ehk_YV(sp^xe#Gt75;P<;ekcrU><3Vca
zMm|IlGNeTAg`rO<bZEqas9q8~gH~tt%4K4x2}pUYnF~VDUG)933}_xBgpn9Ic`Y%O
zc_N8X5!})f%&`EnOt$<|k81J&wpWahcrOBT+Kcmdx_$6n8JBvnY!hZsdy7Y&H|ui<
zTqp;B=h{TBWYAN({f_@KFCY}seu#>4*WIGgQ4)fqE$|XXP}fvD(4?Dz-TJKsr)T#{
zeUDte7RQ}P&UEyrjLpbbc~P-yXV&mKonM~~36HoJd4AfJ3-eirK#@9+AyeZNg@78p
zu`&@2|8a$h7NSz=U-_}2JoA%bgu)EeF+y%fVB!24l`kS%XTNk;`?qPOZOYG80KydT
zAIGqTuw1@<y%=YzDRqpcmO|xrXo-0=J!FmA2=`6ZM;kPvK_w2=jeUdFFF4);PUu(A
zFIp>TApL;dljvZpz40rL(lp2d%{zH3Th=4)H3{Tpl|K#W0CXcSD898ULm4g<qv=zQ
zh3Wn0hbH2bV59J#ixGC=qpd<njqIu7z^gtg${TMnSbD^0nqYS@>OnrGY`qi~itq84
z&dx?Grfy-FT1{$Ej91k4bgV0R9_3!IpQKwG3_S}Qs34FEcV9?qajDn1IE_1Rj}tde
zkO@jq+&==rUxK`2=FU&e^z+x+NpcCR4%lbZ_;afHISh}(zWYca+s`0gjs=hic8ZB}
z`5i0=2zK;DBJShd+!)bHqi%QQ%e>pv-!u02v8c#mtBr<p`$V7#QSQ}XOhFy+=O8{z
zs%UMN_bxA?m(|_AtIMQOk9mQx!K?esfY7IP+7)x-OXFWxqzw)x0O#4MrgfJbpoFwi
zQtZ`D5av>FaO}pS@EgxhVdO9rQ!RGhF%i(?_!+h{dQX=0=w`oH^gmrPIN3-%!7*S>
zB4dfkUGreRU_H-2+8Oy=Xg{Y+wMoR599>UtJyo<Q#OZD#B<<K_C+u0%WUTl)WN;hF
zauP*nYOlrGwOVW`XKS?BOaPTqCsSkoW1}%s8tb8o68RC$Bgfv_;m=f>ON{~wFZeBI
zfOM`O+;=!@|7%04S>51-9N?7}f)ggZLvKYsp=P88K`5v`5BLC7hW_GXv&0Q6&6CIY
zU_09#-x$QzrN(oee71%dGNM$0Nr~t<PzKpVzV;(Yy~-P?Fj@LUE7s5{kX#<H5=bU-
zj`HMrrF^f_p1OK*%h_wPu>U)TU#!HtgqO|jB8iy21seR8{K*3#Q`qw6p1zFtQx$yH
zY<_>9lH7l4eDMQG7`B3Qx@}+6szAURCr`YCWk?-nzw%Q>;kP!7TBh=$!7wmVITFnD
zl6a-Vm4=$`Fgh{Uam{c2;ObzqI2<;axfq(X6X>UlhE$6>VIiuKRC#X59F`luo#Uea
zo%HEJt<}xqU~6BznZE6HjV*R*VC)ojNTFk-o0n+jicGc<z{>0@XNnVHQ))S=zY7Y}
zyJDayp8pfXxsb0yE+c<MDm?6&CqY(6HJPVq3>LHeE9lg0(<rXq{^(mR-A2o|KQ|Up
zq&=VzhhN@+FT!t-tD<pv^S?$fiOFJccgYO#&o48n$MYN(0h9p?Zkc}j968mpoL+t3
zZUQQdK;&med*b;MUS3vou3;SnvBHO!y}>|1Wv%q_RajZc#cM*QZyh)rd%m%3w;P;G
z9qI)Rvq@7ckz<s8U91D2{35*Vn|jmIHh=rcVv<H5tyiJ(y7JicQlamD9`uCb8aKid
zVn}pI*us2I`*ee`!ol+`(Ut78JZCmtcI#DY_;l|4IcKKs@sie=L*;A>Et|u9GSP6~
ztJB#Ay-6N|el3;^L8vKu758B9abES!ckF-|+S4`|0pT>zweIy)p{e)p!bt4CWm*Eq
zR1DVqQ-d;N7<`ytvB|<@^(*OJ3T@(mNS=ukIdLVW(DvG1t24UM1Okh;a5qg(6S7fo
z6JJhdon)hR7?shE6Z+xNyL{H>p8)94P=fMVJBA*tbsZf-r%Xgk$zrfKzyxy;)+cy(
z0R$Hm!o35DM|<oof^Ad`mGO6TZ0O;VviShl@d!fa4DYhgCkpXG@Z5Up5U#X&t3R%5
zmg8ihDe~i3`rejR-S<Cb*02pl^uwB;$c=`EVy1&#`kO4d*Z;a?JV!A>M%bpL_KE(+
zLy-jJc$V$hrgnu>^>BFpyx5R}yO9mFPYRGH5Aw05T$^3OgytFQ9fdYTqYw9jb_9Ca
zu<s>|4L27c7Lz2HXPo1xiG-(Nv&Q!CtLP9NAeI?|hFqz*l7vDwZZ@8m2=3Cuzd~)V
zceIxd6<ORBcOOPHee$KAX=;6E^|LJsC_0Ds?La5V(Z?EWU+XPqkP~aIL%nuKQd2#l
zdqt*O9YBF1pHng}dypM*r)}!-*hSDuTai-y52ya?3M>10{bhx@+<s5U$bR&4q1AZy
z;_35_-eKNXhTNp34q6>Bz*Cd0BA3tdG2_lz;SSiclgzq&!%Xp8zZ3b=XJmJU)w%Ih
zb|LqTr}K!lphWaqy=~QiMD5Ydm1F;I7(w=Kg_ru({ce&}3uJH*J@ZD+dwy?(rphLI
zz<b)%)MW7hJT#|*STLXv?IW<e<l~wB1PA;R8v)$@hAqy^bp7_4^4q&ZD|bc1m9`jX
zU#gT_Zw#V+T7r)7y*q}MB>cx4`{n^<cN-++6KHPWBo)#ox_;)xE9E)BQf}3C$?-UA
zvb$|`tNy{3TAKqxi_^SYdXw+-xXi^kIQ^wm;nW;_&Hcm$Vn(Li3oUbfpl_wXq=+++
zKU<2Q^J%R*T@SxMn}1yDti1>5=0BBqi{Kn|wmLVBjv7cZ**!T|Rl2`}!RntqoraGD
zAcMI6wkfU11PL%@Ha6v|M|H2N2bDuSHioNlQH2nHNcdZWPL-A0<=@-vq@AIOZhLWG
zUqOeHg_=(I9;WZjyP3U_p0-hvCI+4d!<Ev5CtZ)O`_`2U!O;JLbGvA&0ocE0-HP7Y
zB;Ia=7A@N(!*RI$pL{y@^(6R2A3~}_drj&-NU{g9dMotmB=9O54R10FG>YsNE*98l
z(&;VPblWF1inx|jcpp-0<chSq*$6t6E}$Y6RWCS}i!nL&>=+{j9#>E+wmMzA<)@fO
zFLPd5go^OW)yWJ>7%hW}8!*MPlwb?cE$l%Ygh4_RgJaL4n>VzY#KW*2{aQb<Er=I%
ztv(Qp@0QSzI4XK#u1*O_CK?zzHfef1o?))@4uw*Dn#<K|bCX|;65vkPcU$7~23I{N
z9}+hoyA^_Rj7KKc{7Ssew1ti_Kc9ino*oq2iPj^AOWMnvcOAC(52LjCb=eyMK0nd8
z_;~?;I4Oy@@9CM=3GXh2u6^oiN3Imza<pf`y$(?Y<(JpRK;0O<ac_V7dpTH~B}wkL
zs&T$Hu-Gqz!3~ouV#=XP8B5x_>1^ej*~iGxho>Cm<9jE{AF1TeWjBI3@<-yBJ!j-O
z6X5blpUdh`13+yv_Z@#FzNgwd@4-+pnyWfK%&E?D2T9OBz)7mt0WNnSlZTS{R#@V5
zRNUA2M2?OWdQM(z0Dpg!O#KGDE(^cBD=I;mL_&Hg16}D26G9h*F^z3wIrn~zqm8AF
zDxV5$PI~DC7Ka^Cnwo^w<@^S|H1Ay(z#!Pi6F5r-Kc_g#kj<DsYgHMttv%^1!Gs(y
zZz?+NA3b2^{+%cjhBwqX<JLTtqOj*4SI6xC#q}dbG4ZK0Gl1ki7{5hsUB6Xsu+3t$
z{S)I@8Sg(#1Ii%B#_JI`Wuhwljih2NT`v6TK3}54b`I;R{8M6Ome&H8-t}cSFB*9O
z1?gSTkB_oyF>&TdT)cx#(Z<946jjtTZ{UG#gk%JylZ@+~R2VSh-|^B7K=^k|;)`6M
zO~>?qQAu$~0gpsnMv1&S5`6laJF}nR9zFk1Eto$m1d)fFf3%`C9%L4eIcZ+70+BV2
zZHLqUMVtJLb?D@MheT&qyki(ZhU-7Z5|}mZG-fo~@tt_^$`<MJz@2Gq+-aVzl-K3k
z`(Mo`3*Od@Yav&gXSz-vYx^F?HC|WP)n3<FUh(`hbo&Padyev6hN@SBAOGnhcMmXa
z3*f)t=vJVkM~jd6{F>25JcA2G2kGVfpb^}&Cl_}9L!(HM&5hN2l4m^HLYM8=>?_1L
zTrB~!S&&h+S`Up1`@Z|^_5Xyxhp-3Z5r;WNo>Z=GXrEEdGYI}pk++=}k#XoOSf?RW
z=5l{6>9{VG5UNnc-0^oB6C_+!--e?Ycr#z8%u0d&YSP6D#GaN7lr14&{u$N(OV`_f
z{>`<LRIE=b6({J=mMiq$iS3q@N^|^r*BmPjr2#~DR>Z~Myx&$68!GrUJ14~xu6-h0
z{t(j9Ad%su6v1_<BHgiA?Q^|<Y74XK`Ns|NzktTFr~#dc&nxo}%(~23Oqmzu17od;
zv4WFivf6kDVW^;e6=_kB&8Ajoiun~kZ;c>XVl3;&2Ehy$%O06N>)d<qY0>L{uCM<=
z+)%)IH;y$(C%nRL+h9}eL^yvuJ@E}%5KB*vJPLmFTe^v;^rPDNw!K{i<WUUQ_-gbe
zNl=>G@y=|tpiQwtON04cN{Q6?NSae!Z_e1U#nhtF**}8X|K*w~{P7}-=B0gj39Ao{
zk#M2sdIEB)B`Ihix)y}teH`SeB;vw5R8Sc{n<ujLlVZ2n{KQ(Ls~}{VZvFDN{Z%z7
zO1fd*k8G-lM#C31!^a2Tv4>}<*;f#35-I2MFzAi$H=V}Zu7)IfY|Y!?WKRo9+EdlP
z-*5l;r^j*qhj%i;0B>F$>M07jn`gk_Km3R<pc3>Zt_?+SlXaAf6v3ud`dT#>3oC5#
zy`uU4&-jj=bo3<-z2Ru25XtdU-?G%-e^DZ-{||f|PQ=4S4Y)r+(!h0m#{R^u{*>I&
zRWbmnx*S85wAT8}`(rN6)H*5=HJ8j4olHS3^h4`$jX8V<WNa-__rqyw^BR>VKnoVv
zZWifdJ-s9bw?+2hyPE&ExN-0wvPjnMzsMq4Okh$aA=TthxX|HXvBrom-+GBM<+MWU
zd89?A`*Y&EG-91D4}{$q!9+cLjgJnLlW0v<p<<M{jb{?lFA`I~U=QZ8?Fu;UjMme_
zMUSn6ZzJz*<{>@ab+~hA^O#2oG5egCYN@iM=|@4!s7;jCi}ysC6E%w{^AlOG*GEre
z4nge9y3Ju^E|cBq8GYAMsYyw?EomfA6hoQpxp-_&-x^7{eST#Tr-~S}sc##4ZwiK2
zI%?5p4UBh(l9A|kF4T_tM*BbZTusTz9Gf?$+mssubnOn{zg+PL;Rz|lh@2wLS4iH*
zQ8F(?(j$}mg#D%IFCu;jA1TDuVB)@dLy+Wi2RUo#&k}H^Bbx{x7je?ZF2^w@rff1H
zA5WxLUV#Z~XS<AavDoYDSdZ(%U$QucaV>i}S>nMMSmU(Ja$pj=48&erygwIdLhgHR
z#AP>t+qnPW_WgV0#PBOcOfLp}f7Vmtwm5@RXkz%8>~e36>$-v16rk`W;|^pRc$>-d
zo0t7c{OUc+{zdB@x&Onb-o{dWdw7p2A$;yIDxG2L56P`hw}PFQ(-r<kvlP$pd;JpL
z@QAlqo<Kg$Vc9p_Gr;dS9KC|>jwfPlGunvVxkLK>GT2E_mb~wKgE6GXQi#}koyf^0
zOFzrp$HwCVrBCXo^;x&mX$yFyGA%ji>#TjMtF?c)4tO#@bO_6Lfnu_x4A`)9^%2}C
z@2-$u#v}_bL{5U&4GkZs5)RGT>X^<~>h<*A4xe=-Ul@lBMck~rx-x0D8<eiWzB6M+
zS>)SKDAihY107PboDPYn?9UnQZhLp9iai5=)tVq@tw-FX3@56Agm~`%0A1;2O0VGz
zwGseIb};LoX0ufPM}&WRJ{F+G_BR3J0X)C|on>8x&|7pnR3hz4<6gN^Yq9xv2Y#jy
zd}N<Ohi)aE?ED$dY1bNqFg%SGj4O{zA@d_55y+Ukas11TcF6~714C$axo*2M<i1gG
z`COTzR8R3QU7Fg|`Sfw{gUymOTgRo-Jjh_aA{lh)<qwb47<oLia5yD$(^%YBoRV!8
zf!ZO_Iqzi1^;k;T=C_<1=7B0FzaBi0;o`q|>rn#`4zP0L-yHLOfwy4R2tV%Zd@`*e
z{;OJ?{?gUsJ-P}R^tvCC6BAkb#=_y&%LQM^n4W*n*(|pynczPn`#Ut(ZoFhYxRp(0
z5L&^UJ@x(^^7fdOUF7-G7h<jGY+(fq;eD!>llv*v0uA4m-Rm|Z7pI|nfL|)CbcIR1
zbk^m)UM!n!k#<>3t?N<BFX!glDQ1@kp5(8y%&&NfoTqcrnXf3DW&Ge!dYjDtG(2lO
z<Pd<%)pyR1Ug?64^`n_k@z1eHuJmIbDsD%@swd;5CNQ_ipLj(na|lRt70FB^=zQvU
z12jY&7`ao{*Gns@Q?;*%?>-l3I34V2w!*C76AUi1op0I?_txVWjj*?5jBsW~#Q~t|
z0H==R!FG?kn_f3VaDo}$RwQ@45I!$=dUlVVX>A}sGSK<t!~}=V9gW}R__;wMDBPMq
z*e;4G37oujfA(wM67hs*%U+L9VO*N(Af1au<wQ8~EO#tIT0{i?E^wDeSFyWq9Ftt3
z!`s$kI5$1LLz4~tG}RuWJr=OgP%|Q~-T}Nb>9%(MYek&4s`^>?533$8Y!{lR%IwS=
z%(r;9!}AH%8ddxo@1XI0?7(2y{aGBYlA!kCfv$f~c)w|H2)fh4rp#c16x4JkOw3OB
z>`b(Ieetlt1T;?W<sb3Tu&JyK84yqBH*2<8AtLs_{B4-X8-J1Dc!oi`q6wdRRd=?5
zPyWq$duYQ7+okm6H{+&Abc#`o6%nS#s5;M-y$#6lLRq1`+y5EaWuGBZM%t(#V0023
zOG6ufZw9iNG~>5zt;FpPpex_rNq0Qrc->=ZjilFim=PJlBTGy!o%?rrn9Xuk9{AnJ
zmPpJ7w1D^)5y^X#7v8@_y;&<8^L&IYix3dLE&V#k^37okLkNej7HTiMC`{51W}EH3
z5FGSl1ugMiMdn;8{Ah<yZ^#|KC$Z`1F9DWxtTft0sOVCdwU;|w3kt`?nP&W(gMk<K
z*514ALD>Ui%W@R7RbEUgW{)f7LA!cQDek@uUJKYx?z1FQrM85YOVt|k;5P^q1i~I5
z<?IvLx~k5H73@wK3fCx_#ZQ<o4<n{DhYC(I+sa$zu{K5Ke%q>PU-jO|8|}=5LZ^#d
z+w8_OT@&;R{^IFO>u%9BRb%5%OMLdz+TkmTPG_r4&Azm>D$55AZO=J6byC-}6`t;2
zG%v)xeflJ2RHg8bL4mccT8`Ue$%O|JJiDnp03l%8mFG&lG@8C|e*;hr_1>cp+Ht6H
zP&+>;PFpR1&=5MgbPm2}m?nK*qMBz$AW=XuaQI`I(D^aoqx<nM>K=j=Uh>v9&RXvq
zHqUZ<K5~ipsomBW&YH>Iy`?ex>|ZY(z)}yr!)Ln0ku>nZLm6p_N6Oz~hy))>g@St?
zUD56PW9RWy8NsVKpF1cr8vd7#{e+QSc<Ty*&D1;`W!teayTPO=fkXPPz6Udn=|b$M
z;fcxuWAUrt<Yw84nlhT7bykQk8_n1AVyb<bPkqPdhDx&7SY4vP?4KvG16h#J_aA?~
zCF9j!^93vZRSOaT{s>JTNS-LfWX$1viCXOo+e=p@BM9;i>;GW|gwMdOfM4Jx8Irl*
zY-RrUoEjo0#slhAPrbW~>C;8tVBQ#%a@C5IFRf)6QNCLj^(Xyh4qXVrMQS%sTu!q7
zp2mM(sxPt<>g%dr9R9kQM?B@DUbRjeCPNWhuUAJtSgmN+(dwJdZ8=<n9S#55MAXw%
z(DkShF6+B2rPOFOCio5~og0LA&h==)1|H!qGc{Lmw)zbe`h<51ZM$-h???7KA~Fvp
zQ~h#Up)KQuNkolqrRj=h2CKtdFvF-`*M_IR@^Nq+T3xW-@|fUj>or;7dw4Occi-8T
z09cPI+l9K&b|iEMo>8u>uR^c?Cu{i673`A;N)Ws>g6@F)VVhtz%DrC1RC*yF6EIY>
z+ifiV!kCcM10zp{gmhoKUF#{)=O}g-9h$2VLh*z3aumaRsR{D^a#ooBOEoU4dzw61
zT`VhzAzEwI!MG6nFt2xQn1?v)t)-wT?^_g?-^NsCO};#v@OnUBq;ZX^P5J>qvSn{C
zcDDq);1Uo=$GR*OI|mO!nc&rQ1T?8eIs>?;aKUTU8eU_DAHk~R<uhH8e7X6^eD_cn
z%YAV1Rk&~VQrp?|HqBD?BE~yQMyvc?6)N8s`^FzjZdH{hFS+<N>{pj~YK`u=1PU$w
z{A5^l?hiz_FTY7;O};vezX@0hj6)d_0PAmry+FB|+O3R-S5+qKuPzC25sAo(4Bubx
z?}sr$s1B&gsqpNY@7!d*CffJ#^!Co`hj+C0pmRyKyO@vqskdH}ya$o{=l?$J^#d>#
zoHWiH@m?LIlDmPk{o|QKZ?^@-?<KUhPQqoD1LQx5C5WAJ^Zw=P4~q5Mlttie^kjlc
z;av)dFm2ky4;D<$vl5s%e|EU8(tK?8wdU8K0%b}}Cv1eLYGjHz(OP2hzQk^HKHX2p
zcauFsMkZoDDDvPTP~(1WI@>$n@}c$?6kd{HYbnRuBQqTF<uJas=CV7ilRsYDgPdR@
zy>l&Aq+m8Ud^fbKnN*Yi?Rl-up82;|8uSx77mwo!dK3RUfh<C$=_Un*6jdkgtri^>
zk-Up1Nl~q*O6XSKGMu-FWKY!8&o~J)91+r#qk^tgsh8w=;n+Dy61?YpsZuX)>uR|U
zKY87I;2h5KkM!I*b49xjyt=Wtv$jvbHZB?259coW+lX26zHoXJOgQ*+6L+UCQ3>^U
z^_j{Z;n;0$iY16@1=qmu;`im}i3#orQB6BI7?A2;#P&hVE;!h8BR~+dt=zg^?-aHf
zd*g1xk<Owj_G{j<8l*t_((#9vB3B7^%trTpwCV26x)~&-*su1k@NaXx!z*}m{80S(
z%JK?5U2xJTy~k-Lcn5rw*_HC?nwd}92IEM3=HP3JY8Er$#|NKujuU~FqAd#h3-1}y
zBtAwn0Jk0p_L^_vBT|XPYiD~*avoYHJS6DLNdCBkxQJISY#!D_@2)<sodV;uk$#n|
z?UM3J5(rGSg!~>405<e26P&SogW}6PqN=7^-e5WuhIX(z<a_Oier}4-MAq6^ZnVvO
zduSd>+ZOD7%zhOm@@d4QE)Z&>&)rSXN$W8NA&?1_X04F*i2T;IZM@Q+GuvEnVkRF4
zHG5?X7b{qPZdE)&BI|T12aP$Cn-I@U{^|+o{EwcS(WHqcP!jNPCZ?fbPQ>F_4Fur#
zJf_Fz#~x>NPwEvFQ<BbI+<X+43h2}Z7WKZ&AdKzmBo0tt_od!ESzpmy=ldVp{b3p2
zjrcM7`Q5Wz?)F7hI@LO~51-M=yj;#WeJJ{2o`MncxxvRKXnJ33+bq|K_gLcooy*i=
zLh;z+Y)8g5JXjQcx$bin4DIQ`jXVLVGw*uSp7pGW#~xW<3V()vA1xcK%k|_^3;bJ4
zUX_SDQezd3yn57k;L$DSCw>aY;6EguNMNus`67!@Q|=#42C4i6%&&S_e+<%oHJIsj
z7=RZ3r%plWX42ZU5uEHE)?IfM@VvKtngs9sGMBQ;9d7v={APZYrD}Zh>Td8ujm4&L
zfG~;zBW;+00mr;)HoQ9izVtrSQKX-0bqpE}rLvJ!qBTQ_ceqR5MVc^9gvh_}hx|bv
zx5lww_}V}^Y;%PZ^zrU%m3e9oA|kumU<6#dNaVYk-Q;DZNQeb|-2_r!90uMNjICd~
zTH^{2bg0_5qTjbVD$!Q%BU97nWD6)-%{MFT0UxrUPAruaS=vKIv{f$DAB&YpaDR!H
z^4k4TGW(Rt;DI}lb5%%VaIvQ#Ll;Ai9kuKze@pImyD27%(u24&nyx^?<K3r+DU3!f
zMA-Rcm7@4@POPgY?N5c8b<=G(zrfK7jw(lBRH<r1F&?9;B#EU*fMMXh{Oaqm%h{`K
z#AU3?PD}5&6Ax5S3@RS=I{09r<upXZgzKVk;`7-m-@1oLHGU?8``8r(?gzEPlDL49
ztb6QhlPk{P9QVAkf%ZX9_AJ1ByPtjI`Ilf}X(gd;8&BnSlkFiHdET!?xWgB^A(yWV
z#v`lWt|-&R*_!A0=6Ln!Z&YV;+Wz=pu`(5Gq*d$D@xk{N;ZCJ}i<HmaT0QGY$i5w$
zEEM;f<X|-Sgy6g>;TQIGjzvW?!*&d03ZH6bfc#m!ea915Go@bf)13zNjm4@1&~A@o
zua&|#6a@`$<)$XVMszb{t`t^Hlj5oK^4OaB;BAWq*U|6a_l<o#hYh~DGy^*IzB8Ud
zq!(lP2qu?5=Jn&}#tug^c*=?zDMD?}_qx97O<HJy^_v_J87+bY^C+7&fA{vF2Z6KQ
z*UR2FK6)F8$N@t+kW-=TD|Lg20fS`2y5a_!j7nIKz=MyX@S_NdH_%^JdX~;}%nHN_
zggelofQRy5P#iexXPrQ#h1VuLodIPg{GB>+xmep#+PH_Co1ci#$7xf?QAa^^w61v}
z)o(n4C$c!Thm$*%v{-0fJ0SY11=lDOWx?CHI-~akOv|yDECyy!yI(S)VeuWd*l0pX
zs`O5=_s$X{a<@w9GUuC>g1(@R<b_fY#O-YQOl2W=;u{=ny)m+9tVY2~8M_Y|gu8;|
z<B)&!N`X+$vv3no(rZF{3kN9}o@^iJfu$E!bM{IhV=+9$iVv-CA0<p_%!UdQ$d_|~
z!o+u2z!%?xQ1w@S{>dY&ohPA>&Y9(gxr|QD#hAVFEF6*vMPEMdb*r{^waj&b#{>0P
zUAU<Bs<>fqDR3?ZB&hVq`JpzypTDWAIl=%R^cgv6&MLGuGkAQuu;W$Ucul%*;EEAo
zrm>RFqsPd7ycGf5j8VnT!yg+~@(yn~dn5#M8f#t-)#!@!dsIt%e5agji}VUdcjRRe
z1-tUC6;ph>+kGm<&*sx9&weRyG3H}v7>Dk832&Y6<_!NbjxU08jCR#)uWSPB__UTF
zg_b01aRB^4t$JSHwl!P}3B#!w{6nJSesxHxCpZi67-pT;Tn<-`(xgEmla$_$(&`5m
z3+qfEuzxmL`ISeqen-OSx~m=l+Aec8aB+;O0RHe&#lif*E6UktgnuPSmRA)T8hm6F
zg!vw|aQwtwBUzLrQy?CXMQbqlnP{O(2Mda;H-J@$Y$%2$&cD$e3L;zkF3U#Cb<Pou
ze@QhMUmYq~W$H{G9cTE7UA;ZReQg`%fF_9{>-U8PpX~}!T9hr~l*@3C%3-(OKtC<5
zFiO=OO)gV7z;3usY_%YgoOxshH_m!=uF+J&a5OWCO;aCrTGrytmco4bV;qgGG3c6^
zU9>D`YMYEv*~a=*@v_N&*{Yc9L^}v&ov-E%^P0gS%HmyB$FXq6y1IDs?N}clZ3<W9
z3t)`$sNv4OaYPG@(Wc~hcD^;OBIRZ;VSZJ7(p3K3A8se`nSbYe&p`eDFDzMV2Wa-k
zlp)x1^^Qz9fS-abRejE-2X8X+edGDIBdXWKkYsd&T|ObF(pi<sshW+fe_*^QXVb5G
zt!`x<rEClL!?=KBPK!CqI=<P19B(cbZgxL2X>8vo5G>)ghK^a&@2CfVr4-5*L@Rk#
zKe>f+LqaWKqrd%RmKPF?7lip+tfTXM<x{AD@rh10T8m$hSXb}E+%j`p9QHG4P5b+Z
zc9yLN&bzn`q>^s(h$K~AL{`<6B7`5kn6KpHw^-Ly3!8N&srq>WUi3Hc_h)~kqQ;s4
z+#HK$3V6HS9OvxI<=nJ(JW8*5uHT&|?+6PCtvkw)XG!{tGA{~l-<N^>D6B=3$AJ_c
zPa3fXf(Ku<4jxP%ie4DF)Oc((H_uME37rsJN4(@W;J5&;t-wm_OV~L{Ju!5k#2(jo
zn#B|CZQJItPZe8)$h})@M+O7x^Hw8OvClh@BcwHBi7h6><Bn$4n<i3QjU_dY)muR@
z8e7yn#5JB+hu|tYSI#F-t;65Vsr<Yv)yyE(mZt~4os*J|poA^vAQ_(?6UWxrVx3t^
zx;}}NUbUpWu0OB-hL`dTFEcx6sQdDeJP~)B4(j+rWPowePg6GP`B;6JG4X2c3~_jG
zU7W-{^E+zVe}6s^BNYPjIr9Ok;E(===!s8ZmEochl%_t_n-_y1*`^r*0eoMJk>%uE
zk3QOBBTLa8P5s?Iz|A!OQX=*EUI=%1au8SGhwo25I5l78BR(<{)o&}1(MgdVCUGi$
zG956w{T4O7;=+09XyMlf-^x5B=eli`T=y`YY1O5F%tp%b$~Q>N{NUKjN-VzJ9r{SC
z>v|VFX7@d?>wMXxm+|S=tYK%lq`lIxh`US;d&ew_nE=~gInwCF(qE|YQih|f{=GP-
ztP!cH-`u!zK^baPBwM4T$A_m+B7AmUA!(e?4`@XIrvr&kFh$*fh!^hNE#`ZtzjYTR
zJRZO74Vc>$ISi@uh5EX!cf5Z;>s*2K5h%g1L%+%8*Z2rO0<Jjs9D)pB=EVL{uh;YQ
z7WW8(uTP?L<YSK)y#Pvo3|=gLx%nM9>biE<TB2UG@==-BYi9qw((jmkDv3c-B5<F4
zr!JN>P?TlBL$LBaTjw7GKPbc2!%ahKJ{Hfl`FKQj?j5l}+0`v-L)6_kWmDaT`EW}+
znbc_Z(<JkWqnyx$brIOUs+r!prG^&a$IN;RpmwHTKfhdmHxdC!Tmu!N=I1xeN*zK5
z?t64MMMNfORQR^bUA7IKr{}EyitVp&9@?iqt{{UQT0!VxV42KQ2Em%a3fD%L9dFuB
zp(=;4t+S`$m!84z1ss#p==}B9Dnx>;cFtVBcy`Q-IF3ALWX|L2I5*69)#&mQ&F{#z
zr2~8nyP5j=wuaAlw_!Lc4{&o?aSKaSSLe>!si;|oWtsfEpYsR1PV)xHY95^H%cMtW
zjE!~IA~?@3u`*`=0dzPuA^Iq}Y8lLtoW5lR$}@P%TBEER{i@~q)oJ)mU4MH7_R(QY
zZvHt)e#2=xXY>->xJa;EH1R=nSqmX|g0#~rm%eY?_h#KgZFuE&>OEmltl)K0z3s;d
za=+XhL=Br<$LoH_=egc(Ue2n}(^W#0l}YBNrfvOkoS?=0&AH4<MP}ngwe-x#8v2^X
zEkl2Ejn8#l1je)6oqh{;B{>Hp(Ob&hkaPSIU3!=*bZOVO#>(e$FSkEzH?_~!lwV73
zI8_(9-=EnpqAbW0{hV0y%y}VWqN{>eTWA%@wyIe$<K+8z__BDt$+8SWruqZDnZbex
zPLsAFrcvVzF&+T<&gf{T`KC6?K>Iv0@+AM4{!`H}AExYZ^(TrS(@YnULN;r+uW+7U
z%VIrUZr9|3E};VD$@4Qc^10T*IZLsDTh9GeVspA}GG4Zn1e&|hr_>sM-euKly;o&d
zHL$Z58ec~`%3Q@Rq)-3-DYkjp---M8PFIz-H!;Qe`rf<&)cHo?9vr4MaJ~yjznz@$
z7`D>P{6B<!XH-+&7Oe#Z0qGqi3er1BheSm{I*N3VCelmj9Z`B!dhbP~OYc2M4IKnT
zNeH1Tp@tB`i}&6BzUv!<A1C?2898U~wdR~_?zN8eF_CIHK(eI+6jOzm2x3%f38BT0
zh#h=&ltLP@Li03Anwo~a_KJ3zkdr8EO&MUr2#i($l!DtHY8Zia7h0}%4h8?C7XWzJ
z?8~My^~ZNt`iS{LJ=TM{KO5~u0B)9o$VL@Vgra=WEh0?UD9-s(nE|{kl@Pe|KJ-b!
z6$^DG!6zJd`r+Gxr1$)~FX2jVf!9I0N>3Ck72g-CgZc>HTDPL=jWMsV*waueGL7@*
z&u-O;cDa>JRtfq++wIusZo$@h_bMru{dSFhg~2)NlHR&~pOu7X#svGy(w<+D&lpCV
z>9l2SPIj!dwDpKmnG4CW6i9>d5+_0Y0MG0bsX#Gc*~*uvgnXurO9=*6(f&po;L#w?
z#85iDaW+hHRxV$oSd*1Wr@^>S;Qq|6nvh(3lv-JQ&f|8Uq|O6mBKl70mT;4NS3HH$
zD7o`MDsx4{>B_Gk4O+-r3k5aPimFyksv(~$3!>x7yGqFdhGPY%S8beJ`f&YNkM0$v
z!OlYKgrT{C2$n^@D7h7epPwBt1OrBnXSDj7*N#9F?fk2*`x74gjOQ&=mK^Ou(IUH#
z#_S*KF$Oc7PFBC}*f0<oacIiyWNICkURc@U+U!VJ^+)clM++xB>{uc0=G_CR6I$*G
zeU>k?J3qJMD%K4{LQ=Xq%+PE^&jQ0z^y2-SSYNaW27&i?boI2@?!$$#S%zT}oj8hq
zIzz`{P6Y~aN-hzCc|RATa9hywuKR;1MeBJV1<}>(*KY=xZd*CL;eg`?R<sjaUD=!5
zDo%Xgf|TnQz)hdCPQ|31JARHN-W_VhpIL<4g<X1pZ^-|;q4yA(+C5>Q7>EH0MVs|G
zQFjkSRmkEuaYw2(Q5|3?y;c5nEJ=k1$?15^WHygF`|P-4{|d#Crg=I1VR1bAM}TYy
zUN@H8dvxx)LLV?Ux1h?y<V&`5LHY{kcl-VNw-ycJ?&psxH<WT3V}*8t=)da(s0?)V
zi8l56e!eWSQxyC)#C3k^aPks%Jc`V3vY1*lvZ*dN4)|slY!z?@3r%Td*`Gs_1TI-d
zevVy8s$4>5VjOb1<BXkZ>2Y6eaN>c!176&%A_?zKz6r2U1mEx&QBmev^B>z3L4{|1
zUw0P#kIdUk5Pf-?+{2b5da2;-HV4XpZ^CrMPC%2ixfKW946d(*_mXcFl9Y`->c()p
z@9XoZzDa~w+UtW*QWV~HIyq9;DzmrC$S=Voc^4NH3SZUpj|p0QDfogpt{^^8q-?ey
zy{(_o3j2EK`TaV%6Dr~0*)#J=)h4-@z8SPNk-m{1u>)z>?`7nD)_I+R7y<;n|LK^Q
zfIu$n=0!7nU=H5L?V;JH=Lz_f>prEThCq)aHw=F@viYzX+_g+&eoM~RNAa0LeKGps
z$t?9nA-eHNJ#*Al_gU&P*G)tP&6dJLA7STPy>vvoBIoPWVI4#)c;a&ATOaRs^({kV
zY!=JC7w*(`CJ(35&)|*g5Z1=LAk4GX7rgAY0FN)v!t&OXdwC@X`1Phg&nY>R2z~Zh
zQZ1TpL<S)c7i1V6pA(Q)a#N;uaN1T|seGs|GWN@ibhWnga95-mP3^XvWT>>>y-|vd
z;7C3c+7Q?`LIS<uS{1Ini+1aRO&|8BGS`^O`2B3~r3&DS^1#pZtP^%vAxvIq3k^aH
zL&rjx-Q@8@r+nS(MQaFGsoVE_A5sNz0PhjiAJBhzeoiQco@&YY68_AVGpO|*CyLrj
zPpyWjdHTmj)S2fq9A;D~anc0Xv?^o#z7lY%xM6ep+0<*9??8%w@6dEn=d5n_*gbp5
z5o{c}Lg8;Mq%4vx;6gF$1{d2n=El@xXccT<)qtC-*3{mq2}<$dXKw;BcfVDjQh-{E
zptQMfd?}srlq=RburzTZ2m;2@>U$?Kt%|fQt#h8v#789TX?MfJNYKxZ3b5@1+3B>a
zXY=<1d}~*Tt-8l7@8SYZwnr&$ShdqOag@KRv_!s6ti+l+#d*S!YTb#p!?#JvWnnF^
z`_b79rZgBlrp50cxvkmYRA<=7b*$`^IPumUIKA3jtbDcMz2LDta^lDZ#Lb~&*pAZ$
zdh{Al$K8sVrK!MNE$bZ|xPWo1E?M{{3r+#mM5s!>X203}W-aZ?u~8#bJZSAX4pVcK
z@t74zC>VA5`WLeq(x`Kc?*7UfaA}5(rm^m38av+*GCf$#@!tom>d;<2QhA`#pgF>l
zRE0Cl&TG&eH}tftn5r`OSchDx+^1hNSd-{>4PYqC&$d%oEQu9TV$Oe%3JkD?CKw3B
z72TN;t(Pl>fjQ|2=?5~JRwVV*&Ulv9&9jN_YO`R=imppOv<$oBN%k#0vc0BWRIP&3
z-^||^`_65?7WJ$7Q+gUmru7jeU+W^UfWxXr^+_Xklls)(T9LtNw?GYNjUR1&6zTu{
zfKUQ97et8TiK@bs2jxc4=3y(*`$by3-`?>2DvNdfJp9^NnbI~MJ+!Y@-oEN!4IRQ=
zu-bjDdIMu`t1Ucz^Dg1(*nt2C`g-;rAU+-heGPreP`@BpQ7sw6m+A5|u(9ufEIZxj
zXquO2(WZJ`ZtvtzXa^}8p)!}z9)aU;U)Y-G&6*84NyJ}{7SPs2+^aNsJ;?I?KHF#Z
zw!4)tMD;SsabWEw=5zrzRb`W{xNmf)ajyYd-=4(JMaceaQ#SH6;Cb07kq)-%;e+2s
z9A(Z$kC)}{(w|DL@{CC%SL~!JSPaKUw91V|^?rDnnfKmjT2ph>8|0O68Vf8lJyj2E
zV8_)_rOoX|e$<kmB5zKtOFSHJ8N7AgkjlJ#O^zja1ZZ}8cAYPwf>H7=yJpZ#rF~ar
zC4O#<CpX+PGCv$WG0tcmU=gzEKW%4Iwm`PmA=r8bIF~nL9CV7^V;iZ7@fuL5iY#0G
zSobMM_oyt}HwdG6Mb4$Y#M@-NQ&Z}sSga3`mYvoW$tEb-zJ6TDoL|>Tcy2dppn`?D
zLkFs~;)SaA*YydF9qX-H#8(Hjn+E4)ONBTa#EFgNI}WBvP`*F|L5+#u+wPY)GS|OM
zJ|N9FsKmpnIZR9>?ZW8me5p;%g{q{_dQ7n{EbWOF=-4M3dYi}lXR8gyGUleUCgdDk
z8K+|W#Dl-fdr{371v_WSBZQ}2$F^PVWnRmGCg#A?WVHsML|vP(<46?ZD>3R=+pgx@
zIt9RoY!P<l89J&ZEHoC%>^uRnsUiItiC!Y?_<*ckh4yrTW9|aI4SZw3IvP#o7HY}Z
zg)5oVHXDQUGF$^t(Wo3>kad&hTHvfmSB-DbD@VhIakBPscX&7R?$mA2iOrCa-?w`o
z4-tK2?Yp^p=P|No2A^+3y}t)#0h{r2Gh648OA&yMw3p{?z1+q*wPEVwRsirS^)564
zWhfT7qGZ*K&RqWv0xo+k`kvxjhv5dT8-1K5uTl&D<1by5h$eXM>qnea`7u;3_#CaS
zjb!q0K3KoIxDihMj>1U%ji{3BW05|-(tOp&%-spBlnEx;9PyT5NJKhXyG-3=<FPu1
zry>W<f`%)DQjz*O-MhBX!x<Z~5HMTMC+?p{&;rn#TVJ4%h}(BEPe$a<LfKWN4eodk
z4kAlwy@+@#pY%;cf}B`sFNI$tWGsoiwSu{g$0H-X7T#&4z_eQ~b7lL_klCxnRnKqS
zga0aH1>DF2l`=E0y=(E_3PZkd({hS*Sn1hBCtb3V$>;0a!%N+ovFB5;bP<&YQXD_;
zMftp`9q7szFy$*8Wpb#YkC!j}?DNF6<*pJtRr2!SB}RFv9reCHA?{phB9Y)HUK*8g
zs_6mj&&37?TbOoz+MEB9K^w9AVf2%Hl}Qz6<T{EnsU?caayqVAKHWR4AAXzA@HqUQ
zOdckIB++&99<kSgnY%AW#Utrz-CNfItzVSKn3ZqMDw1qtg3C@+i)HRhEgU@`hOh#$
z{MC!Q)Tb(l4XtA)O9&7ZLrjq7;KI~yNjK$Qle=8nnMx^(^W5^>5+7?~BVRfHHM{zp
z%(-E}!Sd3_y+{5;MtJY)7(ERj_{hR;^G=}iQ$D|%4qSYL;x&JM5DLw1r$*kS|FJ<7
zRgSxuZld(Y_fO)9CpI}B18bS;#p;PU^G3RwB!I1?omq}yhgLT%Af0GzeMqORC$-WN
z8rm}zacTC0)2<`jC&44qtSx}LIZb-!DCwFpg>bWVP-}oxQJ)4uYjqXeCh}y9<8_e|
zYnM5UB;zYGov%vMT8)0dtcxPC?%-_0N2iTiOPcRx|Bro5?DR*Mm0Tr0EJ}87-Kr0G
z4xkcj#iSnHfc$v$uI~mi`<Y+o0ivhr8Cn*baL(;0Q?EO6BkfqzvfJ4?T{by5_ipmR
z%N<I6{ll*(M>-e%_@*^kU6GS5I+{N`J$yC;M*~B2OWBoUiRcGUyF)P!HEmLXb%R0G
zyDr#4`aH!oOlIxY#&R(QRQ~XVkC-#{)cO25RYU{wNY;fXfJzc7zmt4qIOdSOfIURr
zOs1zj<#;Vi?R;~H_}P<9f8LH0n%JxxY>r;BX3pBFs4n@nP4s9Sy5fCjQLWSiT$Zrk
z(Z{2&slUiy{&Ii1;s?C$(tQl+IT1jbxtT64XPnBMXPLe5>Q@_2O8Lx{8=$uobDB+3
zqvtNezIyoU!){Rm@TsKHiyWbcWWe3@_5K|)I3&_>A!KtrcTb@6=OP>IV?WtbGuAy;
zkR-a9+JXU$Ll=>&{1QV{csXym#|cF1Mfn$*d5u@u<prMvy%yRwI;pAGimBOQhVdc@
zXLf$JRS3qJ9qm#JMoaFkf4{w|6CD35466n)Lao?b`&SO1Jh_$Z#27LW$vSLE*j9A%
zQlY*W5SOHYLu)I+lZArNMLBM%bf3cN>dK3Q?K|8Glb%Cpk{DP<GyuR^yCJEhG!%!!
z^Qfx(GwTeMud-<$QWwVEGQVF0I!yxrGYNu-+6ExRYVO4F{Q`2pQj{WT&Q||{82*4}
zj>$pUuTP$Sj^7a}`a745mMk+(P6K7|2bb@(E(A@2+)lyKQ%k+y+C0^~&z<+s0VWBo
z@_qQJqS=y-20y=+2X0OknELpvr@J2SPZbC(oO^6DH8G-e3_xA7OPFK1`D%q0XOHvR
zi;or>xp{%FH>plcUvIfi?bJlX5MCtb)(F_-a5NYP7uB8}FX;N>mLi7AwipEOVBJ%2
zki1K-(k+&t;AQr;pH6<EbIPQ*FUq!P1TVn0XoVp!jg94{g&FEQGHKN=k2`>Xs64c{
zx}?=24Ed<auT!{tG?<Ci%NZoI+dlhzZH=<1udb%s5Vq{1e(ri4DN-K%c&s~j;k3d3
zLZlMCp;j<DlaP>h+AnaYlteb3k#*iq(ywE{;plJ!;+4}UxTjo#t?|s_;}67y6<p>n
zhc^zz@{gA-c--mtn`s~+Cj%J54;``HfCHpe+1bYJK={s1LjsVeleP4#YyJMnG+($7
zRIY3I+$zCNHk=hDh7KuU=biAze+p&2Q+A7-l$mn%rCprsiX};ei%VCjN2k9A$jLw!
zcZw)jE8>kuUYssZ-04?fR|@Bgi02)TI9vT{U3%o3ap<sj-spm@Y%9@8tDT$d)u^tK
zds!ox)7Q2)RD1?(-<)3C)z!a!-MQlv?9fvO8~c@`tJ{9u<$Fe3_?$9X%&+b#-J0&z
zQ$QY}_il$88rG&(0R$ixie!GB?!bcwM?f`mH48(|Ic2w)y?#!*2E+*^=)e5#5Wdy7
zRHQtB^k?z$a0Ill0>3+Q3Ug4}j$eMLFa?=OkTD478#OQgU2`!nq}V)8OX!zY*6qIK
z?Z8=wJs6F^w=E@$vGR_N7<lo-80Y>p=bb1MC!zJx(<PL`{vh{ExE%`)JrW@kE>sHi
zc-~kLSXjcV$DcZK&`;Q(klw&2VZBr`lp4CUn5uq<DgO#_I5jmpg$+iWF@SrfOojX2
z9-3_trraJY6|DlW9(>WEhdgEN>)Ul#BS2d*W>HP-D#S3zahQ;^5lIq_=FvNUZ0whF
zzoBPYL#aq%igZM&g^^tV1n1^}Cvu#X;?dA8)Ttc%V+)4_p6rEKl;N{XXc}&Q{%{B1
zi)-%SQ05F+4RhSv2|Gj0fCtTR=Y4?iPwbf+7xsAuNP*WGJbTUZNairw95}m>ajvT=
zHSFx8O^_pDK6aE0ExNnlFm#`8<FFu4_fsQ0?($S2Hz8}*Nq)$2OP_XmLd4(bPB)q!
z5Rv6)Hs|<qN2xa{Fz^s{c6>M2O-%Y2da_NTfv%w)1Ra!jPiLTZXfIDcoE~D3?wruH
zQ_1NGPg2$+g>hdBmmG9!!5My_n1e-+hQ4lK7aHqe7Zkuq3-U1<GlqIPwV+-X1a=eJ
z0|9fe{WiYKj_QE~XqFMwyAgfdbSMp)$m{>W1x*_Nmy)J#{)yvmRpQ~RnqY{uYMOO5
z_v4hKg+-HElk}33{Kz<3$2qNb43T<9PwSf6W8CSOncfi+7;90vBre@3qA9)E?@?+R
zST&w^4bw~TiP9WFxpBA-4ap0_Hy5kiD(mp;G8i7zYW&53?tc=<3SboH+$$UQwGX}s
z0PQa~6gs=X_P@8hO%=G#d9w4kW;6<{l%LDs%M|z$KObn+b;uhO$_US`{LbJ0cq#Zi
z+WR{R0D|xDZrznP<fN6mE44>+9OUn6@aR1&y<i*=G>84lv{ntcsr4*iD8=FJ8sWd-
zn{Y^Z+(U=sA(g7&RHSl^V(kw<Rn8B(x2fKMM@ElyhRm$)|9D=OAYyctA4D~+1hOV`
zI-`hD*;hPD=?>WH*Mi$Fq*9<A1e52KV<!fIjb?iS>}(%yI@+&_7G72N68{HG{EZhw
zB$RuMl^R;h#;7I!_PuRLPw1kkWh)|;<N|XHM-H|RyvyS#@-2MlCWuvUtwmh-)bp;r
zxZZXjm`uV4B=%gAs_lqXQYEv?Tk?7<bz~83_L0_&g85q#kP&RxZ)?*5<E1;EX5ek*
z;jtlA4oHq{6I9(J`b^9kqmjtlMfE8jU`>X|*EmBc15k(9C9CUzC5MgERLT$U|NY(n
zLr(p>u9~lSZ7^#@yck6HPE+)vp1<3}G}HZ}aZ}HhU)S=gA|qHog1~s2_ze-?)pQct
z`~ZXycz<ZWWa8C*G_f`-mseU-X1<xUI2QtX<A?p3oqiB(>7R=2UtHvKUj3;|c{@jJ
zL7-wQZ?l-8i`w{-f59w6p}N~1CnE-Zg(&2C=W$Q!sX@v^HMS9ku5|1Tr6^R&TEA4t
zJr`DGE88LcI@FXw$oSCU&*(Ed=%G$?#y=`S|11gp>*AsAwL#jxY1)!!dNZKLq-&^R
z3r+ruq*lA!^|E;9kw=Ed2K;ta$yrr}gOqE!kL$M4&r3}U1%gz2GGa<KtoCOZCXV==
z`AbD{GW)|ru%b4YM0WSxZR(NN|Aq$4|NB~i%2o$s)4{Y=yIHeYF1l3G`Kc=Ep&EOi
zb1U_u19NUD3suOozLey;bSj;+8ceZ?JEtJT2R5b016qE<&3Q(Xgc3jWCtrK|<qx;f
z777VJ8e({1gt$Ki;#*g?87%%zXFsSMy14RUVVz@QgPsGNE_T6G^yEsCj~cV};LLr7
zexL1R@l*+Q+=!NXz(+NfYRO<0OR;}n$NzO5(nj>)6KH-KG^NYcfa4KJjZpw`<dGrD
zgc$F%+8r?E18<b%h=$x>;td~o`RzypR%K}?idI?C%}6Kem^<K8?mz3aeo}1zhkMw5
zc!(->gX>&Ap;o+}V~(+j6&O!8S^u!1dZ*~6=&dUIFF7=K>Fw>T8lAfm)3S!AH2EiF
zJ|g*ItQsH0izdyy%Af&@r^+DQv>WD<Ky4+9MIF`z-2WlC{0q4K?Ntd-a<9IqX1$=y
zaeKa<cf6r&hTvvQnuvQy^@h?KeDjL+l6&x({Vnk>q8=8sTj^~O2S@6XrN|&VXT%b%
z7M!st9ZgAIkpck4X-x$ElPvzlMTikWG+*e>6o9J{_th3RZOxv&0U2Z~wmiB=Fv>j>
zVIFhuhbsST7Eg#rEMZWxot4|$bYy?T+~CL~vs^QJ+AJLwtW;#eT*`N2B^vXyI^Z>B
zK(M_5xa9jRQjYAU*qE?Y{Zzp9xoXq%*AXlvfgQVi#%dQS%5w`c#?4<9(gaPjq@l8A
zr~5HKNgg=l`KB5wM37-V+Ro=NjUe0i$byNMe>E6eBNwBCTWQn9ZJz(kS{Q7VOWj5s
z^426A!_Vw<jW6PI52bNun@N4V6;-<4M5a2dMN8(nL#j|~@zgok3kSUF$;b;lZ4j#8
zJ+LzXe!un|>uGitc(>c$*Vw)WQabIa?|)I<hA~>JDa*NY0@~cq++rHm<(ce@;in^$
zhqbt#+|bwCu3psJlHrw+m^5H@FSkx55gU`z86=tmvh&I$L_q9gZ&h_2oFVNHNzDiZ
z_E^<lJa{RkOnbs?ly?D_%^mB4H|y}Z02gi<PSlj=%FTFgQOS7cHYqM>NG!|juDI9G
zUF`nnK23Ui<x)9e{ymQ2VyFxk^;)Lups0i@!F`zbB8AO@jthe*3W;pumM2JpDFA|E
z=NOhYk)$+BjLYQ)@n!4K44^5uRb>C8jJoIwspwuqCp49URpeLyZ?~I%VGsCR24F8N
z*@1V;NaWG8zxohd-heWOsyi!H#?8X7zPz6&a}ljpPGHs8uKriB`db_e-QVvgPoO8o
zpLxA~{U#}cP#w#_-*dN-TK<9=kPOKp?%)ui&(i#NNQR@4^^O^;^~o3c%<biaik;{A
zkP@UG^U`i8P2`|RQ#QhKD^@QWyrFFZDU1-M+tUfmX5{M!fCfwN03hbcp2as=DYV?#
z^RFctSm$hUMUet-eLeyUUxmSjq%en~7Y4xiAc*D2pdr0NMml=)t))nau755F8kOh7
z%P!o7E0RsII7DRrk0|_L0Z<~l%|A}1k@WdUHH9*g$11j$eAH8Gsib>ald&krr@^8D
zxx{lp6>T@9b%w}7Ld;q%!Mm@Xa{wnZwBC4at7d9Ff6RXiAAg^v+L3w=PAd*4h~@Jl
z7Q$>{Xt&ucP}`q#j^MSp?Sv$w%gSUkOOb`?0SaAr1&=`~F(Rw?0|rYpq#R61Eu)4(
z(M6%Yq;8@rJPQL;bQG~kLKh=tUX6p*#i27bQrXh`0#HEKpP~xqB-_;o%B0^C2WzL9
zN)+rv_<^<=G9QclVbBbz?5L!j?7GYVTdPWSD+Vnx$dnKWk)UDMaj+q>4)uv+cOJGK
zi@VzPkj0bY%8dDh`op)M1)nGNq%Ah!q1W2u^}N%e4Udop3*Vo3P^^I<7QV3k@2vB$
zD5otMB2g3!;Tt*De_+@!YZB~KcvZ6eiSn&3()XWZwSv}p>j})yRCnVPrs*iMX_G{g
zEZ$ND+UbzGeMt+7>WTa!fLLgGeMTaAGnVqtKUp+H6=S1&Arh_w_`sEnGpxalm`v)7
z9_w$Uk`{<dW^+uc8tRD(a&}8Wh~r0M3u1+AV0NTkpZJs=d5?7_4(sCxO0kih(TeSE
zyyQVC2XKc!WD4OBC8F61kZOJQdraBJbCt`nL%6bOChtO4TGB_=BJ~QlXYa+|Uu7YH
zzefO*Q)0mf9Jx=-<B9;moLVNBa&~ko5{i6dmJ8BTbFa+A$J95&f5@+s#Mh>|Dz+0u
zHbSRC!-g(6lcSO`gAEQ-Njefe!P@OUn*5Fl?qftRg<D2;s5!<BlxQ{3zpj-5X1E6S
z?UH-x7EK<lW_qaKu>v~t9VN0j{Q7Sg{J(J+*|pnS2_mdG>c^M&ontWgc?{U%?!s18
z?>T9SxZCNxs7Lk^!wh2uSCj3KJx>b>W*J9$%?wu~%txgrh`O&mVFrJBWO!CCmizAW
zHrmxZZe1vLzvy2kng0qh_>Z%klS~)j=R0}R`Wb{w6$F;miU^N64c@x2t5j~DlxSCN
zq{*t5cA_o+F*b7UfhP4cz+SSox{=724@l)FtZCShwfaB({}=a#OKUG3jb}j_?i?45
zUp-Sv`lxIv&8>+VQ`GkczKo)ITVXTMM**Rxu`2fb)^3^~u_6tBfT}$NpQvpYJTAYQ
z9FC0=q^}%ldFXD{Wb$S5MQqm@P`uK)=WkvcYM9Ab+&0nR$$x^V@T2rW^q)|w65UNf
ztxZbBO${*AFw_~0<TXns<}pb88&UW#)N_^kW7<P@413!~@hoUK0Wy+3r7f*fW{NQ2
zXSmb4_QuZt=16P8+i9(bRIYUg$^@mR!?tB+*MzLqFL*0D^@1==6J`bo4W_I=J|Hgb
z713(~_2Zj);ObT!uK@jpZfaUqWT(_q4+Q^IYRnLg6uk?_B%K^FOyr_rGy(XiSRKIm
zAze;pb4CPsm<0X9;x)gfdyA$y_I))^&T|<~IE4w9@<oz#VVUK$8A;=3Wgdt<B%`-M
zCzZQG)DxpyHr9*lHoC(SGdw$#;lmO+>idt<Z1BX$f-A0cIcVVNpP!fJmB8nI_pRfH
z^)C4*w3a>{>CBZ>DK)>H`oMf$xQe(mj~!pnn$>(b(r|BgM3PP?%b8}#2eaQR39`h)
zI4@E#<EYiNvfM=6dcw~?-$^6C#rjDRrl?^?r6hRctOV+IyTRSrQffVwr1^QTIFVVX
zWz}X$j*QJ6ssJk;mG!yM^#t-d4m!N43kL7c00z*2=yX=+*KI2QxY+EexR*sA`;|6m
zO(YfJGInaF^{4bQ_yRR5O(^DX@DN=vJ)vl1AG5pz?`6PBJ>~8;;J@_+Jt^3qpxfgc
zv_$bXs!Hyxm^Q7e?eM(R?L+DxZkGS@Z=0W+Y2*G3$YEVsVf=W(z-hH-&@!@~!RF>v
zwM3}llGF?*STBF``jyf;^p6VN-iFc0qV$3M%JfW+3OrY^usHd1c$wyv);hu1WEXiD
zZhX4Ygupm#eLf^(YJIA{Co@wGyr#qX%o&|XL76t!{U2=qKKG7#JH{vr6khvBqNQ=I
zYVJ4AHOvKc(g~#Q@G$aux%XdH&c1)s;mTD?TaGba22Zjl<}eY#(}HX+o2*;v=Csrx
zgfdHN9!&J6*|^$S3OVRFEdY<+7nkBa_m&#>)aS+igJl2PHcc-iqH*EXpQeKkB9^!@
z?4?1NN$x4}DUNdY$%L-*pzVVsoOH*ga!$*DcD4b3TnV5^XaS^S6`(DL(9aP&6FI2J
zCRmv@3b-qrlPxkrnqN)ZL6Ees1|SR+#fV?U2oJu<k%%iHN2P(+r_cuK@CGfBAQ_n<
zQTT9?6ZZof$V}SAswi8cExUwy&l?F*9j%%F5#7yI?`wCIuSCKc3q%T~-AMVG!1je8
zx}D8b2CD<nE~3^3HM5dD870FQFBBe?c|herfuaGMLqZ7(-4C9RAOagwm~=RR6rpcq
z7zT<z>TKL)^o#{wosNFFbU6G&&2;~x7}+RXdqENTn}?@ei4AVVHo#r}m`B@)X!MC3
zP`p;3wi0YpH;WgGCqciH_Ivy?H}%w{MiiJluzoKX8g#27+tVUhq<s7!O}KJET{WB>
zZd;Vs;mZ<NaK~&AqHM)H42UQ($#(h|`1nth{rme#wh$Px#a8AtH=gvLeKNI6r&has
z<($d2pm;|h1)s3$45p2E^l3sVUvkihY4eI&FL5kQR})Y<+s!awAB2l()8HcpWAGjH
zx)th~DVTZUmwafi?H_*O$E1f@(;&FGN`zvtqE^b3;GV9N27wV1rPpW<Q6iy&@5Xzg
zSgPvc*umuVwtzV<M5Y*61VWwAq<Z$1^RdWqS$b?u#&>@r<;Q=BMInB-9u$Kh`O~~y
zQ8>eUAQ?W+izaP8Altx3X&a{ySfZOdsy};cfq~;%`hf8gH(xGiF9SrUtg^1b;y^#h
z5~g4ZbL~8XQ~WVa%qr$TyQoXWMODib9BbLtnXq7Z&OEq5fy0|$G?Ess9P@DFO*Z$Z
z^hEBTY?r!FxzMU5^=iSYM+Tn!s7f`HW}5hgSFLpaaF2&E1ksWy%y}5DOm3!4f*FvN
zqh0AbTfzhVZHD7S6<b|}pT$>Nwbhs_JP%VkR@CFYEWz`S<jo9ODoVh~8QGkp#gP?t
zvpi|<3afIlQv!pm2m$to7Jqm>wo$(+|M6zRW^&T=%SuTQhF5tw-NTt6@k%UrjMx?K
zncVYHeYKA$#VZ><X<|-j9-g{cx)>f-5$V}#A0{Zn;6Q?pK@}El7vOgC?oUZ}mQCB_
zo=L*r3b;y#X@bma4<rTY?$H*J-!o9k01_CJUe&i0fqxV$wUXN}QfE%09*_e7D+Tq)
zFbCMSkBix`A487<Dyy-0$?wW&!XH+7<1PG_lEklv$lp?i*d4R85~OOd27Mk$Lt%l$
zfZ>P<MFc4&13Lw*7MsCe3RW%F?LAWA)>H4DHVB|ekQzu63TzNh{*6k<|B%?Vx&Eg5
zxSJel+2v(h!xI4-dYOVYbaRE}sp_x_ruBTWt5WwDr*pO9flCJpT?3qqxDkbnAi-!L
zWJ<Z+@?(xz7d-R-7tBowI7@NTUB~(jdJlBTwkoGz&kRbI570d^WXXt(l?ghU(#&E1
zzN7ENq-<I$GHb_0r!CG&r<1YA&Wo_Ywybk?{UP1;5NzMO`|WepW?ssX{?Q9l<s^rV
zLN|r?f1_mi1LjLK>S}2mKkZY5sI^%jmUvPIV=u{(%7OJVkeyA}1la2v@2XbBZt1g3
zutZbG@X+CN$^VOQ|M|_V!j*AKh2~c!0)FhAcb-?c*eQ(8J~Cb6wt=~FYF4{L?4wnf
zt*n_8fNsL^L1#R{j=WnReVvyOe@)9ot!ziR9y%_$10b&V4xr~&?o3+DsYqwfpzklL
zugv^uiFi`mis5C!LX%*{Bt<oRlILV{O;Yt(e=KtI?oUhfx^lIs+LhFrftQfF8w924
z$r+^7$(w3fmhTn1j?@U0o;dS#L&QgaWsNBM{W&bXm<IhOE*~+Gpn@Z)A3m_Z%{8j-
z7Hxh-RMoo1AEGz%IT0*!HYlR!`r<XIb$~RrmeszlskEg|d7fKtp3{9{gz~N~|5A#M
z?|wxx!0eCD_rc@*mlw}65uvjn@iaUe%msk9r(d+Lc4R-%WwJI(iFsQYLi*z_Lj?b6
zLFFqvuSVU!=D>1+7W0KoYu)K>mJ0?FVh^x&`1zl6_-%Gg{ZGG5kK#ShP&YVM1Wz_q
zCj1VOg+kU4QK7B2I)hrb5MBDxD+o`eav}2Y_oM6g31-sHKd`W~at4pY_ESWT9wJbQ
zIsw`y+nL=k1a25=tVEOr{lk{_q_BM&9E;k|qrh;1@kA!(48e6lJFeSSF;Qpd*z+Qa
z{CT|!#GLGQzPc=-5*0`Ogn{1K$N@g8K)_09+Ph1U3S=WAS~)0|WZj{N>kjvWEkXhR
z?rHvSg*;y(WPbCvRFT{@A~$KkLE$dITUO!xJW7D{{rifTo``oc$b+D_iBGJ`k;;{&
z;LJ#jZ5hASbo8TmIS|`H%ep?<e|V<<pa0JmA`*6Cvs{Q9&gR>y8LzH4p-6ogbA?ag
zW7R8rE~S?c{bAa?ATk*HuBG~OE1o3x$B2Z2KjwDroQLhD=g^Hzo0ptD>!rbk6{^8=
zCQ~NTFA@gd-pwNZdi@>8*!0-lInUB6t2!aGxtJb4KvRPD<16K{<Pi|NSWbw~VC3L)
zTu0{z?7*KPW+wsD6ktl6s|2SK^gwSTHhd&QW{-EsviBgRr@{7plg-^XH!JcUZkNTy
zl*B(Y>535EJ91#dpW;x$pW;{_Vkm3<fJcFOfV$0oA*hxtO2^+K#k=zB5<$q<4I_!l
zmW^JE+^~7#J2L9V3)#x?EKI=QOVqyQrF&nqS(n}dgY5qT!0NdKbOx`=IjPV0J0&w`
zxn7mDSQ8j=`mr;yTOUCzP!D6)E4><2xANF68T;wuUSPQ3JQeZ_k|phKobg9mcq;`{
zMSa7(TsJnVB)cv>wkvV%eO98I9tG#S5878gj;2X4qV|gt>PZ2E1>`eQ2b<dJ6L2xm
znPZal)qx)x{wKG-(J$9Ji=?YPmU>NU74^S!Z^%3aw=?5CQyrrc5B0~I)fg`KCt8EW
z-E{WW2`K~?H)nEVKJ!v12hH)g*D~pkc=L1W0Bm63yTnLO7*Va;r@SuJ5vdDLq)XeL
zGK*c7<E>iJmQ~%}6v4N3e|UL4Qh(b?zQs10R2O2Sc@Cx1Ms{#+d<j8Cao+wVM!JQY
zEYu874~73h51DaHY5*X5L%A{)G8J#P6D7wPST&5VI9eQV^+-^{?F9yZ80VhsEtgrD
zxHo!XMY~PzjY-XnRo!`cDrIU@BKFAqS<^GW`o&nMaTA+#aH;U&Sp9>T1$<K>*RONU
zq0aTt4;W6mnAg-%w@r-I7R>BSN}8xOamwgp7rlyE@!qA49boV#@bWG7eW0V>OY1mc
z4ML#XUu^~9<KK@ogzRhT5!56&1vn}`Inf%Ga@m-GcZm6kKO`32BN{ZCs>oNRYM%!7
z?WTPoY0Z3(^%Ro{*klKSIZmdv4EF|*Jpj<2WTnrM#jGqX6mJA{bb8a%Qb{(CXrzIU
z)eGGkt*U*@Aa3s=b2H$=x@G5k;N!fkYLY?8j>j6chjm=JtbTZlXUkzz7N<eH;p+_X
zl>p>B9$dP}Uf+Wmb!w#q!2qb}t1ns>F>&+6?MEwo{Ov2zYtV?@Wk*)@ue#F^i<l~J
zQqU#Vo#CjzXMZ*+A&gH*8ss)}Dn1?_b~~tDW%H{;_hjo~LxEM9rUkmzVh!UU$Y<)%
z&iz2JWxo*2;j`u>Ct~m*&zeY0sNO{Cw6LPTUJJw+kD0leV!~vf<<j-Dz+qvFnMtgA
zqWx!+_vUQ5yA&!N6zA~qH5{4Y-Q_xxfeh>Pb7ltmTz0;`aQ>@;3Qx*IFp6P`EqwKF
z)|<e7cu0ZTbly(hEUFg}r_<E{Pw*NsG_n<J5EcZ~WN#KHiwxes8R0e)LGHOEGBJ?U
zrDjb0o_LUuLsxi$!16s6^$Vv~sjPF@yASVGrX$Mnv6`qwbbDY%ab_amK{z&9djB3L
z4n3(a((S@aKdfGGGN^p1qAziZt&s2t(|_q@u^Bjyu=Csu=uQW*pwha-<DcbsthMnm
zMb8)^zj?2UMpuFwy?jjJH_5Pqj<xfu!`=mobR=mnJ>3^Q-p%#ba!<}%;opZCf7gJh
zMS|2qO&5l(YEypmeNmtDv)xW?;vsLi)aGPSU$*=Bog4Gl`|(pE)AfD`HVr&qTTGfD
zt)G||F!9|w8;8Vc(N(JcbYCd4Xdm|v{nZUv<kw%Vbx!ymrp($VSy{gtZg=A-AJ7GD
zcSv0@aOkW(e@PhnvfbHq#wEZ@Z^U<lhby+3b|THh(<(sAgc2ifgr-`X(E^fXU3kUq
z&uA$?kk(SEe*v``Xs=BJGK4Vfg#v!XOC?E=Qcfez3(*EmyYy_4rAbxK>oV9W2@c}4
zoxD0egirz>Xkvi#W_Vt}a9Bacr>fcC@59snip}lk%u%**^(?{2y0)hpkFD?p3=&9!
z7bBP^2{;m6?$glB+kHwAzh3%Kfwb$iZLeSL0_uD`SI5S%cF?GA7F!Wc0^{kWGjrQ=
zow%VN-p=YLdaJyms?IBkrSfg(Zl-a+llSRud<jj}z<uwy|2wp`c)fpQrX<a@>jl#0
zbYay)Kiz$zRcHCP{jjoWL#BL8;(A%0r-eaam1n=W<Z6oE?({PUvhK~Uhne3y6XcSb
z%*>a=P)^^FX51Z^5fT+r&XYGTU1VIW=Vh*kxApba!+MA#x^rA#Sw_!nP8IbVyI>`=
z-C)lwmh8$Zqy%k36smS`{Xfq`zn!drqUsjD`<b;Mz9)n_HGSt8%&A)5U4!xAeTxOq
z?n-Z|t=a7wk|qTMS>oOWQ%^ge^D4<}mJZI1xu9xPLIi+1h_cz?hx9k_g1o9iyE;fg
zY9n-}Z}0SoME|&py>h=IMJ<p<VrBDm%d>xH8y`~04uxv9%k$=1cARRT4Wj1UoZI`W
z3y`_zDVF<fQhNaU(00}U(WCePFN{LXb3oV~@2~7D9_Q~u7RK?9uHnc}Zl_}uW<rNQ
zIPdnVt<<h8M*?Uz6CP93A#&?1HjEKf{WH*}1>QB(KWvlDypi*Z-h*Ri$0z4FI16%d
z9>Ud^hxc1~?4}1Jxm^AVwwQnB`ln4LJ}Tl!-@|YlFIzeC8mvAdp^qvzwON`YBp4x>
zxNSz2$fBEtTZs^f)otf2lYsCL2BuFmRMa${={yACvoq7z>PMEs`k(tUgB`sd#SLsv
zmpGVkV3xT_yYPL`<)Hy<yN5NTLY-)n#qNcPwUd^r{;8oHCOYGQ;o0t!Hs;XlWH@&t
zQ@<}EoqhUd0hGV1n8N2Q?kO7~`=c*gIbv$iz8e>ccA$B@yHm^~qgriSiQ81Jy71fU
zcGEr%daM{0-(g8X&Hdq%z`e$_>lF@w;N1_dD=Idz%_)VMVtk6t-|KA9{jBHV9H~Z}
z<AJjupIPkxc;sg1_R@0Lx^L$)kOPa=IZT1p47I-WS^b`cu1Ku6-D>+f>JwAdMBX1k
zPJ-X$W-a%e73-i^Bf`Vz4cV~!7pH4uI$BRHE`1>?YoB8#o<+Y#BJ|L@=%33jeM5ji
z3f92Qu3Bdr5%-E?Z0ErN$yzFNwaT?Kvjh;E9JWWkq@evt?@`nc;C95F4sV(nvsg2_
zY$K{C3*XJ*wJzB^PR&P}H5GW{tXMV*8q?=tN?h|!8n$Bt4aC*J(Du?c*>=0Y@yZ_H
z<@C<A%F`9kEY}H;<}G8FcC|&hgFcE*O1#>2jIK4SxdT^4<@MtT0lAn7+4H0QxiqtI
zprjdnOX*raT*we6Y1i>umgbaV)#g&6&u`~aFdIAqw#fU|ME<MmP*3VIai?z#>_8Q}
zAhPUQS+~))*3ivLjbqJ=F}v_f**_O(Qn~o6N_~igQhp-_UOW#PJuF%%9CVZCNcvH6
zlf@Pv|1~qbNJI3j4$SY*Ouxps12Fe@sni0a)$Rbu5YR!3sL{H1)Nj7x=rkh;YV|j|
zkqrgXzmr@=lumAXQ4Va^t#Pgm=u8j?gHESgmQZ#3XUM$ptm^LQ>e>rU`J#^}sx8}}
zNv2g7{NcDhE%~oPj;-UG<-rRrs>ju`&bK8^{1wrg{iic0w-Sy8uwy{!23UdGihpXL
zIVJU3RFIl``YHXleyapI3dIiS46fr+?$D(~-q-j;7wkRmnJo}eT!cTfh?A*O3ZMBf
zl*?ieWjt&kfH~GT)7$>kURAQgIeC8RFKH5dY`xXmx;M|<7Xc1l#vlFw#<EDWb<hub
zkUqOp*PL0!95$}Z+9Bk58pD!i>Kv9>Yv>fa^wkK4KQ^mUxFrkrL`j+jmsGo6c3x^4
z3wB(t%07D!l>GL>r3-Ch(f+f`yG4HDbhX`C&Alv7NO0b$OgRSbfS5JcyX?Zk4%e0{
z1XU{9^3Jp_UC#!Q;Wy}w?zir@$y~S$g(LGWwEVuU2HND+u0J0w?ILHJS?doE7Xn`L
zyK3ME7{y(DY+msia&^O>{@8@lv2}n}{SJ?7HB3tQ9RQ~}O0KV=YeVPq+3{u&`A>g^
z-6m6sXy}<#yB(=9HtSixHU8e*otl!e5CIl9E8%#&FihphF-?^WZrI7!QUYD8g-lnc
zzg5YCOb@+eiB00pCi!y2!`j8d-~CE%Z%on3s_s7T%={`|!zp%JigsY7dbxWEy-&=J
zizgRhpdxC;A0rW}z0uq4(#?V8tA3v>(6I?aDVgT<JsZlYEEWFM@vVPTq-e%oD`+El
z6{N*?{LJU@c%ko8Ma@ic)rS#Duxxk$blJ%LuJiYZUs}dwN5R;seN~#Pc|O<=!j?}=
z=A?7?hH)3y2rF{ZqANiDkh#8K*^8Biz6QCud_WM97(_l`Xwaz5*|L66*%=V9|1#Zr
z{_8<$Cc>_C>wQxbdZzb0JmYmP2e8I!`f#X;)cYG)ZM;svbHiO>;0_w^)3*%=`0Mry
z2b;!4_wg;uefbopA6zA7>?C*aqf^7=XXp7zPYB*7FJ@8Qio9*?RByFOr~k2@xNSA-
z2daaV=|Riaal}i%wXe0)BNeG`LDXTefP`&wAll5%I&gUS#$VLr(#LM$mHsmMAUyZu
zlMc7m(Q31*MA|%1ixu%@1kiO%3kIeHZ8KQgH5f6(0NQMF&0@e-?jvfTAYT?t@y>I>
zUqw~P{JJm&!QE-dT@7vO{2Y?rO&wT#U8R=>6JTk-$n33<(?AmF;s|U(6}$x%Ql}Uh
zLJ?4ADU=3$I$ybYtFm_fp4~iE7-eYPd^M@&JNR|bLhvT89S+5H69>y5XS?obEQASl
zqxn6x=z}r1?#s?3f(K{pr56ugJ>8scbXZb59&Je!ZT?VnaB8)xW0o<O(K?rT9q%RG
z|9$e1sMBi^*`ol@Z99($JYB5Y_9FA$^&8oxZ?|1xg9rcWO43_pJGh6dOKi|uk@St1
zM%p(qp=Y!}#1%Dl&V&0iL!F+@tIlPU=SzHiClz%iJCK@yV_v7d%z%lh=iexV%knHB
zEuDSh99-4(7Ct67)<mrN98`KhY&kMoSrd-PeT{(eVIR{#3`+S^xIJ8rOq{qDF7t`e
zUk>22Pq|ht>vHQ?_o*|3oUOKjbz|eFR!O^GET`1Y08kEf*)CJW;DSJ)C_}0-3NUr>
zdf_h=4)f0(cpWx&;v>joijjk2ruy@d76w%k-!=Rw$1BB3WKLS`>2px<Bz2M)p%tSt
z2x8c^uHXK^a65MGy;QzmF35{seY<{JO62_;hO6a#<r57&cOMI=q)VY}krc@W{81gr
z_{LPx0>Kjl9J!<bQ(K@AVn_?OZi5g83!5qwYz#@L+@%j|eFLU_=T0Qlxo@(0zIlDE
zmOY*%;u4%UdyE<aKxq4N`mdvqm!f)!pED04ei4S>QwSm@8OU2ZtoQwjcPmv}%8*~2
zm2n#Lc~pEJf1LEluw<UaptEC%X{R_34musv0lTaQhpq<xB<YSlhXK!gzVoZ@#6(t?
zW#b3MHdDtxeO${H$M6i@QE`9d<k#ub#i|9IUAKkv{WNCFeHn08ctuT%)K5h@)780R
zlbyCKsd$AO7DtIB6J*URJ{mm4#%wDdL+>o+Tc*+NEuWfmku@IzKM|5+?gfBc&8c<|
z7v}IJA*sopTcbGaaaFeChq?n^hhirln%8wLlE<Z4F4Pk;7sa(YE6-tX-J$CKW;0N|
zyW^E_^JAdO;1Z!<S78X~9$SpSho)Uyx}n>DA&pIj-=d+HRMAhKh{Q!|8d4}jw(~x@
z52Ej$i0aAM__8#*>jA)w6>SrBJcEzC#}9SpJN9)m#Oj0_bYf-pSO!!|HRtBaz2>&c
z@RC{7t-}0FDJQ0Pc@Wpvu`q}wFTCb@UI0Jv6Q6VcS%odjKvN^-wa7lAUbqhFe2E#h
zroQhQi6D!_(yN%+0bmW^#p}6ROy*88b2)gXwL90#%fR`}tR#q_^PArueM>K6)0aZE
z(C^Aq0?nsz)=w)R9m89w8WkeqEz(+o9oh99$X50phD=Y1c3f(o5l1~-=`uavUtM+)
zPb^gYe*Uvn{%9$sf>Qk-y#UTHuSxRt%Xsb5oUC3ZfXTn=&)l9HxnBFN7tiyU@V!C5
z_y3k5syGE!YF+wUE_WviygRO%sOjyr88fMY&euQdUWeLnyrYHkowFk)Tz`1mecx<^
z-M(IznhQEvLU6j8n00z7=P~zjW;vx0xI=1@2RG7Q=IQY*P#2YCuT(m>(&`cK3@+TL
zk#^Q=KF=jg&aDtZSxE#726rR8G^T?n^}j&P!j{YO0$6Z|>sEH76iw>AdL~<v7T<it
zln(yNCS^{1|IN*>uaBTo`Wt)~DfO{lb~W}6P1d0VtBDHy6rsHgSBszH#pg4<=W+U$
zXFB@K@T(&kw4JdQayD4hj5J-AY3zYW_+0<2w1WwMs#_e2weN@R`Fv*9(46}m2qz_#
z?LS|>rlp)ik?V_z+F#-m3U{B7<6!aFoLbvQyQA}hF+6e?vv5?ng?Fi|{!720U0L3v
zF2rhsQ95(%H`hIc#bK2<e@Qzmv87GoXQTg)X+m*UJh-SPPV(F5+3(K_N~BF_6dj*z
zb&^XxAZ5n5uMnO=IQdeIqw`KLw-+ixBhI^%CBv)|uvRUYgP6zd^2=d-)q6?K`Qbh2
z=|d<a>-(Mg0m+)$X3@TV%3x`pF}a<}0v(zUty3&~Ism^Pxhsv9ttC6vQrr$K;%={6
zfI#|SX;f@W=6U<1!$MX4Dn(HJb|wm9mzUf`I4nyUMTz>g>277ab>@!;{fQ4pMjY{T
z@`zVbD^DBsi}z?J<d87ofX&}Nzw7YmEt0IgC=&rqHR;x`%Zz0#^e100-ydP_PZW`V
zOLOi~KEva7Jhnevs6EqL9(0m~4ETbcxDQi!kzX9v;YFJ!a>AeW4(OBRt0h2U{F^sH
zcPqpb(VK#;{JxQ&p@v*xbrBKd@NJ8~67khT2qu}Q1WSV54ogkC*Aq)TRWFm9Q~*{Y
z6Px+dAj4<s#?@93`%m?U*Xo3~@<wW8;I{B=q`vb;<ghYaJa4u<q?`)C@Wk@gXMEjf
ze@g0jrdopP-lXM`ng+6Pwrm)zCkJsDy|u(p)?}bAV%M*1b6im^LNuOS^V0j>UV8_2
zgt<;CWie7~XzMXK@VMReZ1~#{kCMa9LwEGI_yEajXO?y@I|mpZl0Go;Tq?AK&d<j}
zhid!0@$AS~r+jRDcu^;P?}~wE+bJ$0JXh9PZ@a9A*HW)CJ_es**#zDmhe|Y&puzh;
zgg=FJCT1|tFP+V`{Y<S+Lzd#(UR!KVmimh|KdA2L#<!_iLWlK6QnE9{`k<PNL7_ry
zMpnn`+4ojg66U6f)>}2i#vg=q{enkt+Cx?r=}Iy+W(pL{yJ7Pa-9{$O|K1tl@5QHw
zn&u&jsUsC@{inPR{++l3uoUv6VHP^x!TJo5Mjm*6g1G6{4tWQvmZo^2yTKpA5Td`V
zG#OqVFE}EFmtf6piwAnSN9n7QWNenCK3aVm#f!(*4KJ_<^_J^<Qzbu=@ydy`Xu5)u
ztP-;|r`BWjAc8dEid&*0gN1RTK`gVnoTURMXFSfkyomg&g5PW<AgTLaa^Ok#5X84|
z;O;!S*4|RMj#8QOox|6b=-z>9@re28s>ThI@`TPLX3BR_y(<vwpvLO<X_iBY4Vh|7
zVU&>{?#mQ6eHWU6UZgQMyF+kv(7f6PPgunV%>(SCdU=#+GKQ>ie<=s|tgGkykmuoj
z>pt?0_zGtJK=xg{*A0Xk9yHA4^NjTycAH9ptf*W)h?)-f(_mJ*laeJ?C$*Cw@5+yo
zq*H@)i%ADOP=VQ3LM9h7v0#H}d3!m#cLVhr=GTPeg1pSbTpZ%+2GSQ#zLw>Mp8xC$
zv@G)k{spM~+mQ{FdVb4ft-xm9w3YF+*_6Jts-6l(>Xn#(l%SK6CG@WH2~+>b&k@`E
zR}Gqj6khRvi_qkNO1&WL1EBOdUY6e9OREW!tyyFXK+j*?zSU3E8*9NY!r4@pupPHx
zCS5lpllK?e+3%Io<HPwMRqChry6`q})u)Ot6p2#HD@BOfBOB2cvpj0Ch)Rj5(StZs
z9`duup&OHBSbHnM<R}GFvOTRzY_=!GyC4YI8Hum=he=olTtED#e|ejHr9t_}xPHL(
zCMkaixWVOnP=^!!l;v~Te-=pp>p~s;+qCX}@!=cg<ozjusk<ehY0V5^gNDa*b*JPh
z?#73yGJ&&<?-1}v4Ozl7>6ud0x{X}KfcZ!|%svQhIilb{eE(-ElV!*i(&tpSwXbmY
zN^LV~WsuAoOf=Yus#Eos>B!OO;Fw~_ofyudpo<-G*nzu1n`54va0Z278Y16@#v9iL
zB~7TjGF;f-3gf84@x2ZH%P;xQkNGJClK_z;#UquuDS*gUX`2Ph#q)b5&p3w)g`8Lp
z9zpLnd8p&-#9DG^@67_EALRsXXCGn*Qs^pLveh^r>EBi-CY;E8v8t4DUz8)?l#u$K
zV9-Efe#K|OSg*L=G|^Ig8_k&eoWQnx1Acj)=>7~5Urnr|Q|QCikIRYN{FJS6Cb?yH
z|HFzad`8W^0C3-XhGDmPpkepHBxQtXFj?g6*~Gu>&)C1)pNV=}aph+tlF+zrw?Wt<
zZ5KYU&X$KZ=y39s<|n&*X3CUCiG>?5IPuO*5R~hr0&E`E!P4AvBixp7_Z)_lov!61
z6gfIr5wv;k%tK!9ZvBTLyJuDnZ&SLe^K0;Y<p1LHQjcr4F)W*Tku@y#qsP$2>{yAd
z57{Lp_AHtW$YphIvcP1<cjQK84LS!i%FKZ>mLe(AR_Jw1#Q|RgCQ<B>yAGGl?faCT
z8tO^#x57O0RDPpeZ?sqy=-CjN|A)0V4~Met<A+O>N`&l0*>_{hJ{6HYWM3vb*^(uS
znMBq>+1ExGvS-T{3PbjNCo$RgEoRJ&_tO2`_wVWXJ&*VO<2{c4nABnBy5>C3>-+tF
zHmM2aS8_W@gc&n{)jO+c6Z-=<?i_?1ZuCh~>Cv}0H(VS(z03b&H)y02*LttZcv)1J
zO#CKNJ$iiO<wEFtQ?(4F5Q{F6pvzLU%m;O*_=JvRshXZJRxGDW4Kxq5_cqXduTvWX
zF#UwPJqCqftxnAD>dMxxWN(tfv&e}aF?J<iy#K(C%mqUns`+B0nO;bV;0trsLOV9^
zOcnJ2XgbX!Z2$k@ZUM_I!<EQI`50~(w_4&*=8#uIm{2+gAhJ<rJgsM1%*hbAZ~Ar@
zzwE@1bxOJ97baDJ7`S-)6D3h>A%4q=r0~!wU1+3J!pyDsh`rOO)caH)vS9|ptkw_q
zDPeb)5&J78T_p0AW-wdV_Nyiy&BjDUakiXjtDOkz!XF>H=sOOda=mN)QBeD|B}W%L
zF9)8y|EME+tiY&(KX>PcAuqV$6d3(1wL{SDdTf?>=fynOW1;vxfO7^NLgqcK_mvLI
z7w@Rxqa!gs$MEHj2)XfwqH#MtH)Kwgcti@jZNJk3aMfP9`4ard59cv}1g9+@Q1}oh
zopx<SY;68z`2>1vEgpPq+WtcCJxB-K)?&cRy7bXJQGt-g*^X7XF627djl_0U(j4If
zc4=if4MH44$c?Lsi=AlB+{29OAqg0&6CaDHf?t*VZ`0zxPlOe=K0wleo(137)1LeE
z0Y<yqsg31NDeyE*w;mjO3GAwDyIA;FX2#pe-sEr&wcF{Xg*)-{{-mGaX!sWY?Fz~e
z=D2u-3|g9}Ad2F`$bCW+Dfo}Q^dCZp+b%>!zZE{b{_(yUrD|*oCJ(g?r?aU{>Dg`=
z(gjdl@ambz6LW^O>H_X9nrLy#{eCUu)@+(UW?!h%Pxtl`W`+M!JN)x5x9<^IUpngj
zbPpi#8V*2G&FyR01OjN!8U#NuZ6DHte}<RD@GIb%TU5qSN!hKsT#G>+tcw5p#5`Hk
zG6CM22Z(No-p?8@+cl4s4C4v;HJLR}KU|L>xg$wacHz8w5;FNt{;Gy)n-!!XpDw^q
z!I|}a&>39@R`SR}dQJFtIAsJ9=lg;ka|+rF@HJ0Ja+%;vCoMI6EY6{@i{VPVnAe1U
z6zYT-OrG?~J|pdjhX+s0ah8rBru1kc9`23h+|q3wDk+<An$Inn#l6=5o?ZICkoS{k
z*KIE%lpuSb=p>xLu$Tf2@t*cWY<+9O#v%fh411_tYJ4;TJhlypT)t+pT_4o01I%ue
zI`%B7!rHR}6<B`b=>MhD{fEZ*0Dv4jNdfjEFVb3+{HxbffYHwWoR14%`GEgLoK>M+
z8iR(cZCDwfUM|F|gL&<^VEAikl7@d;SX)4K+GrU2mySFrc5AWF@5*o39By+8GfpI6
zg}9F!siM1(<h<WIhs!Qf1M8blJoe-Vi07a)gZYoJ(mR*iRMv^JHJF-;{j5Qi%gXNX
zTnbjdU3LR?v_sp~#8Ln&Z$VGpCoH+1`c4zX;ik%fx=&3u{UJcxfnWtjZ_6%n1uMGN
zJmIG?3*5TLGXjuI^E^gwe7z+ZuVkTlpKy59)C$zlazjBOZMj)x+Zr_Qq6uyNZ;j>O
z`%xo<E1*n}J=<RG=%<|Y3Ibrd`_s6@*9?rdbdXq@zj@VHa)($)wn<<FbRGURIxuJ_
z0u}QTPO&bEGa^Y_%)N3WX{;kw+r)jjK=uTKbsYbnwE#dY<2>2?fti*kVpe6SI3RtA
z9A3C$CJ-zY;cj<z{jp*aGE&Ti%AO=#;mjkT0%<Uz(fF-5Cj$UR)hZbPU!=7={doBY
zlRA-3n>;ctZcGr8-OP9!(K1vlw!XqHVoNn2EPRpD-59S91D-dn`R1{DOz1epS7m=e
zQr4vZtrh#H3LE0+Gx;sdn8)-x^;^}vi&5RuKSy4%oavY=U`h8cNFwsbQm_9~>_>Hh
zeO@6iKdCq{T?nU8+r~8&^lAsd`21pb%6I=4|MEm|vcNG6?%Yv_%<FpK<DZL~r>#)g
zN?TJsq4ebS_}L`9K5_mgZ7gqIkGLp#=dRAe19EIU1iD8F?gbOIIUH6b0dz$Uga3xC
z{7uz%2soj70&j(S6RUA7&?#)5xL^hotd*c~aI~=%x?4<s@e|cE&L-Wq>IY}%&U=W?
z{fL+?plPJ?BjJe-EHOAYSdx|!E5t^ZQ81rtjtM(mACz)Zy7o(ZOqZn)+O71Rb(awH
zSbmS&FM#t6v)UyW8y}HF*7y1co25RHU>J|}q16r@J!h-o|3zyikz}Q-<6p>?@712R
zBkCsgT<W`_Ar@)T)LolfeZJW1aqV~Bjf;CE|Mgtbc<{IASWS*^^h9>-5fdz3x~IL6
z;~RsJspY+3J8WH=U8(E(DV$a%$nYX6AFZD39ro#v_pH58ie%(hZELB)lIqf=j>FY2
z+^iANE8&w*pqn?yTJt9D(%f@C?hSOlrh)CJiX2SsN(Pk9C&&g38$h@#y%4akA9p$m
zB$g3xXoAKeo)9)1cC;XvGto@ab7jc)bB?JaQorfdWg*@0nqM+ZL5k$^T+S8Sw0SOp
zS8iSTn4BcJ>O9>v;dGFc#GBp;JSifne(X9mK)Pm}e^qFYBGt<QuF=PN16hrwYf)~0
zmc1gFt0%JO7A_WAJdM1*a$SXCr39seqtck*vzzy?lg%e9-V{*-=HRq?Rx3ODh&ZR7
z78Jd<+yuZGO(jKfAgn|i?0~CezNm?8y(P0+bWr!Pw*f{5SmzlfxqaWTTr~ehR<~Ab
z|H$@9jn}%Uf0AR4aYw4DKIHi_B)BKN;PPjWE|B5a@k{XQ{SmxNl5N5`AX+V?B$r=H
z`ZzYHUdhKAxPXAYfBAzi6)<R194#KqeH=p0(mdg`Pr8VJ*;OAEE1Z=q@179!%m=BU
z^1R*w5d7I2_16{S5Vi}(&7Ze@jXX;^(O$hKy&^}zj@3XCOHTStemwYo;TFd19BRST
znQkG?dLvBPHh_ed+@o7Ud+EFXS5J#a0k64CT)9R6-WGpxTas*u83$O=0!V#;7gc^2
z>S>^Xb$M^#Ct!$rI!u4ofbQ#~i)B<H(u2M98ewO0@Imq7(TWg-;IcV&wgj*}xm658
zaqi=e6a48cKc|*QIAEg{`6a)gI6kOtw@03xj0Nja>lf5_jvS|FWIuhSxtU^mlDHjU
z;?PR9hPc!WN6ltN5Ez2}cfHD=6cT@TIlwphAAF~@c(IPu1s4Q8n{bSNvclUIWZ4{?
zFtI9F*w897TYvDKyca6V1~{C*JyKV+kGQ)X`j)+^7mSaa7^7HhWh&v@uln?HEK{B9
z1{NKy-~b|?+huerP9>f#X~c;79j)IIj4B04+h2w>f8Y;huB5t_=~pkLsB<xp5~hv#
z31tDoJ0oTu^;@`IZSAresnS3CgrqM@>~B`19U=#WkrMfl7yAv0vlePOCpAQ__tR%Z
zgXXc^_;5uicD~bR#TSa{%OMzPK!<1|fcjA~tf16Fl$j=|j7yC{PlQC5$yy5F%)cUz
zmQi_UR%7Lna)IuCDsD@kxx?rkgs{R6%gv15@!CqDe3XhU1co&Mf|SM8bGR6KGLoP^
z*^O%HF0o#}?hJvWP8uR2dxS#09xFfOR@hyos_IL>jsX1NXroT-^TCE`-sa156ci^I
zZy_#KVlKS2ra6QaCp_i1TR97?J2ie-Zfddmm{Un$(}m5(Q4Jq++jxm)0974VBIDw*
z@@#CN2wKiX+_=~zIKMe_{I(k3bbfX@_b8-hA&pz0;c&om_BE|KkbvNRH|;24b~R}c
z_?9ld*pp#H;dd#ygXt`MWaM_X{4E>t<X5Vuy%i5v3WVp>=87%RK1G*>KRZlWS1TTF
zIthoo*r*W%W^JOyIUDq!#-1L1Y@t%mjYpMy#@(%6EjDcyPCU|ID*f8(SSjKD;-KNC
zAGTe^5%q-A6@cOGjO1N=zxt_=v0iWBzchOB1MA6?I)f;H8?nSBIq5vPw;J~BJ2Wf#
zLSy(CAN1_4-l^T!v+ThrVeCf4t94imD;j!e`3PrbD%T~p>37y0Qw*D7l*HplEK5-d
zmjW-~ue#RnW48dThU54#qJ|ZE*!a;EC((B9V1|a)4Db;Ej_N-uIgxoPK<Tel>rf*Z
zMhN8!TL@E71KUpY^B|LN(yJqel9S-5#7|~}@ZpEOlVM-!HA)#wi>q|ocH|Bn1^kE9
zbIv|~#1>2)227)r!E~)soNqfK8v!Q(^9;5Jz1Dff%;80{hw+PTkkWvFt%!bQf>~(J
z74?j{rt6ar??3u9Zl`^B-W~y+T3ewMl<p|fYwJM@(vHbkMa%!9@ONEj`R;=r{-PcH
z>^su%QRViRfSJ}JPCN2WfjU34N^kcidXmBQXG;u*jm31=pKonES>{{}Vvoi-Rj+hh
zZoW0+r~i)YA~h=wN$5@w6n|Y!bN}bD=Cv%hh`Iel2-JdJY*%0we_T)f?nN<Mu;=oC
zgsUmY<yv{;<<Zt*FW6Fz_Ti#2cSwJhuW7J|;uM&EJ8{?zI9{JoN%zR1TV5vBqqXWn
z_D5!T<PN`>TXt8DsE-~Uh-qJ9k@Y4!+IV)~=V02l$*H7)-Y#@b0-V(_pRk(gBX`rK
zMkkU9f1sj+Z>E@`P#3DyND2IFCD5L2h^v)_N>?uDn7;Oy6J}G6<nx0%cF~$Tvyx0x
zG{+m7y=hpQw4YIIT6Oyz1HIDE3GJ_30x%r@l3Ee6h(@Y$%eLv}uP`~jDfc7I*@e{N
zi%vzAP;A-il!sOUW?aId?_d@~N1(RwpGR#e3hchN#>k2P=_3uS$q9wCo-qzf(KS91
zgwTc1?>sDeUi+%CHq2<yD@QU|-;=&zVRxR+5QPbmj(N;{n-PoZG29FF)9f8sl5-F@
z5H$2HnfyG+D0YsBXHbhO*$=5Erc4*?1`XJ=Y{@LVcvbr^p9pr+!^h6QRVo4#Ig&($
zWh^qD4%fi@3XkDmN(``?hk!X*?EUbM9cq)>S=C*9#>U5Otg4yK8Py$Y@rD+m{6h<x
z=IqMwP~icPW5oFu_)}|FFkU?SbB${KI~=fxo*b@~YsZKLNCouCJ{|fdV%4(6ReEU0
z-_4sIa*JBDx^%irM?<-bt0x*v9(8y3$}B+0RC9k9O$3k%%-<Q9h`AXk_DV0Bg}L0=
z1f)1}l?(DdTNxEdlBO-ElBj9Etacl7&`A>~N(30SJwNpRa%-FJ{A$8}5YNVU`s@Bb
z8}`Qc0oynf&DWWb@w#r~ofq3E`+*Y5U^0dnXgmmjxMmxV{iQLx^W$kAJuHp%sW}Vw
zbO?{ouVehe;F&eCiny--!2APvU)^?p{Y3sZD~G8Y@*K)nbT#2k_=l7NM?NPqBB950
zP<pQpDr@P2$Wnm(ExL0i(T6HE4*(wG8Pv(h4bE9ts6NUmJlqqD@~HcuGoEvoXvY5*
zn@eC{o?fnqoU8U5rh>ZaaYiCr33RYic`wL*%xknhrMe=*+7^6lHkO!#)z)!dqW2iK
z?utw;&=)mWj0(?mmB+wBCyn3~t0OK^6$m$>cjb*GzYgbX0gs<n2Ky+15E26jjH%>(
z%&^#|8hYyYNmNNX<$vG;oVpZOgd1^Y)K%kii=&d08!1ZW4P>cM?6RJ*7MSiJI#)p)
zYUlB7Y%au&P}BYaT&IMx|8r;!2<T?bU^XNoDI9#(#o&Rc2TH6HIR+&8f|8t(x>!yx
z><6*)oo$q<-sC$TIhyG9ULW$XuK@XV7?&N&N3qTsTW$I{l!Qp+zN+}`vq{A04^DEn
zN=A|M8mU~(93a03-TzEvIms4XesZ7RmM+i+(W@w6(X21zelOpNdp`JiVMAx{b8Nr1
z%%3OE&yA2T8lal^#0-cbuxVR;f0N0t4Na>DV^VTPW^W6moZG(iCS!PagStxmWY`6I
zW!(-q!X5636(rG_`sHoSUG5EH@g5VD+ufsf+_Y?Ut{En0oLG|sElvy6Fai5C$B4-9
z&i+)n_Ujp!3g2bM+;s2SkGnnfO^rRW>}2#0ssk1+Ls(2#+_Hc47Arf9kNz>m%eh3f
z6itu4iOpVFica#>Q?i6Z^WF^b=&AU9Nt7hVWY|-g%5d3ZP*&mGtUJKPei$q<^M%f-
zMd+LLaK<L(pXYiV*hBn-O-i|r2(XFzgnJ`g8uq$z=Rpoam5;)|f<Jgd8ZBFlu_m1y
zQhqs)KbZ1=ak#!I8FA~HiGaDn%vKlp_^xHT*Dd(1pcjQ)F@|VDb%a2f(F7}<ifiF7
z*aa5KF^l)tttVeI*eB&>u6Ay7w}IP==srz6&jr@%;?KY{on|l`U~!w1DS-*W9a;~k
z(QxZJ{|r`B3?|dM<!6m#P8+eX4-|Rkei_bS2XMVp;YXh4wMs$}iA{L=wr&wL9QoX7
z!JKjJ)kzUG#MW1}8EE;HgzjQ_m+s+fk{86gNZ}VaE5A~S&cgEH&<FLM2=n3b>b5^`
zq%IM)-ZAqGmfwUwg)hX@z_EOJdFav%pnnN1(;%{Eu)UJ0J#UttAdF9n(aDLdreCLm
z@peXwh0E|mc^7?oa@SeQy#0n+QIuk=D&vyz)IPi2qfMH(B1uzQQYlOC5f?xJ;(6?o
zMV4D3qX3nRi^X-wdsT3>Ewx~s_Mn3$)-~zZj(YEFZ3V)|1t~9u{^R~bu?6#{Tke~)
z{OIoar;3FQYh}Al%1mwy<VS<0jxfk4D<A%iSl@kpy4-qS)7WFoB7%I<?KtEk?h^m&
z%RR>`@5=0e^ox=jYz)tX%_LWN8!eNWJ;JA1X6=2*hHAl<(fhXRs2M*!qcD}3Ngy-I
zz|>{^$st0U^cntW#OKN}3%6@a#Yy*fo0G^->pSeYad43tKjSaU_W5wGe0z7XWiR4Q
zz>Gf=%)Gz0$kSvu+0-%WKj$$?R-_q%PaV8I(pIU#e%|%KQ{r{KdIq#5v<MhUYWQ2#
z%eDe0+$MasJA>Trz?#*t@A!KHza=Q0qvm(pNMH8~hg9ITB=3o953B^J;}ET_IW{$<
z@TE>8fZ3$M6#Pxy*~-1I_x<)`?r1E%dNML0<(z%1+3xXLI!RL6FikK8)m<v0Yj;a&
zpItFA3#^l^sHPd6+qid`B)qQf+TFK5NW%4aQ0b3u+^5PusIQxOVlP@JOYKN{l)i{L
zn5bEtI!+%S|CuWLEWyGx&{Z3}YnAU!#kAA&WO}K%&5v=BMPm2~ihiWM{`tO|tp4P2
zS*2xUcaNcl%1v?VkZ4YrX`15rl35SmLTC6@v&r(Pxo6@QOm$A9#UO{ijERlliL{z7
z<EF~A>S!VJR>xSy`n2xiy7wd#?I&yWG3iz<>VRYj`ra<mv{|#!TLRt@1(bm4X}6>I
zR3i!aRal7<w+edlFIQjsv&1>cmY?!@+&-H?CMQ>3R?Q6o|3zC*|0Ne={fmRB7n}8o
z!r2oX=5bWkls<iej)U6i3Q7=cpA@fSmbu#1OidQNu65iYIyWiLr2QVaw3^;th!97Q
zPf-UeRDf2NG7o=frxsWV@);wIC6XT{ab0~F#>+V%Y7x~Axwsum;XftfAFfk;2kIyl
zt;csAYC_F92XYsg2gIL0cM?19G)cyN87GUe1d!M0k0wwZQ&VZ#@R@!emnln{z%acd
z62EXf&@|-=*Bvc)CILfIiyphtBEaMMq|#;}a;bNfpw8OccQRCM_WI)qvNS}TZJsH6
zb4gb%BmR8ye%nyAYuJ4_#dG8em8-gWxxsOEBtpYie?Z$D%Z;>(!xlVsOy3!040{_H
zH6Whx1wN~1!I5oFltB^Op=r)nZ8gxweC8^o)eIF^LK{VKRkowVS8@Izu_K`GKZ@{w
z2B{}XaJI9K@kqjW4k5|vF?@?%{n+^-%vNwIuM*4e)EV4o!q@|Ngt&q@(RLlF*2O<Q
z^e_XCY*gAFTl%Kbx`wuC&yyi-fY-t&U33WV3C<x5^ZrHg$A$ifYQ*8y?JO+%Sn+ts
zWMvs)3&lC8>&<(2KBv`Rj=S;GisxI(H)5ez?(J%<D{8HB7%J_X9~VGT;0SIZbOoiK
z({7^Emy#|-O1#9UWP}IFf8&t;bA2LY#M#=P^1wMsz;$uhXJOQ7;$%FG>Gt_FEA#tT
z?jwknl!vtx<4Z;9?+Qg&7cV%GbGC!#EO&By<j4Z5B_RyLvPjl&^;CC_ZMEaIMRs<R
zGnm{zyWf9Mfs>O*kvL_5Rj=hO5=K>}h%cA;+cHK!xfXgUiD@}x$T<d-tWN!5u=n*_
zrHc+?fY71rDcRQq-#F4ns?cS2a_JBJV3!3C9YZEop~7UGpcw9dxfuK&=T2~o2w>44
zM!?9DGIDW)i!D<TE12Q}#=MY=fM*Q#;gkNHLKbcwRq;e`U!>i;+}93p=!z(95&ch|
zUG|$4+R*tY{|hSpeHXnh;>Mm5)|NiN$`+nuS05Z0^OLG)+<O^+V`xNdpE|1$UGOu!
zSBh?%(i=pZS2NTuUAB|kcRJ9O`h|XYu{R;b-kAGK@4ujqN&xD}OV1a4<y?FXoFrhG
z;L4R(6w@G7WIbPOL2Q9};ul0kbl=ObT3p+sLS%toIp1I>5#RljJNQ&tGb3jo97vy%
z=G)ia$to?g6Mv{Su~+aeU(jHKI7cPcQ|{bZabq;`fRz7~fD7^5gjmqBz1ijWQI4Q|
zF*<f|t6Whej^2768;YWb+Cs5mh$B;P-`s>EJ<6rQT<zRi$V}nMYQTXn?yXNg%g!<N
z+eWE8_PcO$xCQiRWI!6B>6l;soB!&8`)&k`umiYAKT|(_Ue+ygHGo--#P;)TTl?Lw
z6<Kk}9snn6o8yrUywmY9QUl;^;YFunHOC@bD27^HT2F$>nkIHBpZwLgCjxYechB|_
zZ6mdV8?Ann*c^(4_%V*k`TcBTZmn7B%yi{jHiTl6_`$<^h887O4<=+l0dED3Jgq7k
zfKw<yOXJ7!esC&Dgcgotw+O(x;NnEkW|!>uUXOln-2lkdlTVt>pMcHUpu)$xU;G-E
zw5Q#z!^$a>yQdYI=;Bf)h<>ca5F!KkcIb?nO{}m>?$_p=VT=>Q&u2cgzd@{L8g|tY
z>6iOhGE#>s`toht)RSxxMtd@t+PsqtY`>J1H|EsuZi4Hj0<V0G%xJH{v9mdl$grII
zSlv|9Rj~E8qsEtPXR#jr?@|gY+-zRhtKRde`SC0bDV_8RhY5y{4Ho*NRmX*_MbG<m
z*zIsXJ9WBWp`Ee+E!1wmO$RU~Ju$DL*wZs$AV<z}%o^}jbM;3*C}gSM8_XHv{Cdkv
zU&%u7H|C-O{&C`7qu5Tb5RS-~-u(E}zWDUZ;e6m>6SSuRaMHjk`0^nLvLv&p%%C-&
zY`ao?`pqkmVpU=taFal5;#bfGun<*;us%PLsKQ?7mNngzWQ0P{BP)LG8V8hZ;Vh1z
zTcgx@+M&)9kh9lz?b;QOxMjpTU|%D+KRU!*8<>i^Y7bK5>Mv0UGRE>O$4c=(fS)}x
zXy&&yT>J=Y+oGdk^}tX=5C{uCBD1vgKILTSI|Dp6;=nKPVnsT&0#3u{Cr$8`PbcTk
zq)&0=K;!qE;9rJRA2K#@D7Dxg2&0h{9!UjIK`s9-J@Shke9NO_9~ZQ5oQ6<y^$7)7
z4zsEN_BE-$?Q4$ml87N*KW-yjQ=ltU-jog!xn#<s{*=tXFSn-h4nu-a$ViIBoy571
zE%V}OXa}ew#@~i`?6fywp>)9O)|}ibkGK_t1O{31v;av^lTCHiatSMoOCmNSHeWGA
zZmBm$1>7HYR?CmkTClWLSTXDPTD{X54Vp{Dg#1V%Ly+$teGBdC0G~|P{>L8~wmvNK
zspfKY(G8Vkf^jUQR%jYYm{>6o>>FtBF$*#?2XqY^YC*_I_bj3ox~}%nK;hsLZ=Bi|
zO@=6W!^D-Y>Zgx2YXfv&y7GhZ9olB6uW9uRuMiO#`#jT6NLZOM4HFI4zKGDl*k^%k
ze2nKaw*O?(A9t~ql9{7WErXNNiwvScAj)bv?AWrr?hlWxf@ewZp$o<i9g4ps><&Dc
z#_c6y98U+Z0k<L9ASAz9mb3ctkm{wD*kH^tz*kHiQH4${<(Lf(YYm5wsQG^|uaLU=
zS&hel39_=MUV+lS$W!Bp6~6%Pes5#ut|u|NJ^ET(nvS)SrfM0dphyot<yjJN{vzA}
zYhTO#FIQJA;Obfeuv4flt46}uY(?Vig~Gn@%&K*mX@og;8d~cX^M*x$5I%duoxLE+
za8(7A4YUs9AN=IzX#lW8+-*Iq^(DTdr*TUNubr%Ns{uDtlOiysmAam3M52`G_qY~I
zwN?q0urplS2?{IWx%WguFco=DLjFlWGGWqTUxL(>13?^h%7%SJbcNEv0OqU>0RJrG
z*xU*uS8{xuUu_(s)R`<U2j%pt^;#Tsg*e8cfS&5bKJvGzOvH()%nD#C<HFzgR6Kn~
zMVTZ2w7W%qu>uOX9u0x}mHKb1q!5y=)WtaIe6wo?S{)2E?iR?Xag*@8Ho=Y+nQr`?
z@BF#MO^XzonD3bzD(uSYnX53Oy=T^q)U2ny<{$Y}+g1A4fr2Q}wNGzVAFY+vDJ2T|
zVQl<Y9X=BZAzGW&Xz!!>DflK}l=-NFQv~Q`+Z13j0wsV?L@T^zF<H2kQT;fLVZW*p
zE%c)8^RBS?3f&ydKZxtei`(4XCtD`+#FHjV_t;q+@T4(B8F@PX?Md@t5Q6PAH2v*K
z)07yafQySWT2UWnj!rULF_i1JkFuImkt?hRJZYdOC8<O3?Gjb4ND^q3gXiY=tY$|h
zw+4M2bTxfq5BSvGVOg_Z>|kR;TpJRq78sjYZH6|)Q|~nBFHR6Dt})Ws9wBC6X4~Dr
zRs7ioc!ENR0^IAoqT6#1T^iyc+A_v#rM)-u@TrLIBK-5R_N+D^G~Rgx{rb;Kvghop
zRjj7OyFXk-bT5?1Ws~M2-OEYy=&eb=imt$Kj9HOZQ$-}Jq)I!-w?xbM3us;K^gH}m
zXCzI}zq^{F`z$JuHSv>`WE}8izw8|m2#A!N6#XT?6>3!58{Vz8E>4ht4yU^;T&pw>
z9e2OwOBGP(<up$Dd8mxPg<rV->ZEh2D*%5?f(VDy$|b5$^KI6Vj;079hUwa8tRu_s
zekUqy&tBL>{W5i>-~5bUxc?sX-A5kX)aj;H@`4&3cgW7av{bwC7S-(j7i;aW15buK
zV1%U!INrjBP8OJk%0p<y!#N!TjX75&yFN$P%^tNOTQh3PfMgZZT^chF-sP+oRv!Ax
z^xWp5HA%ST+^9Sb@OHB4FUn~8mfWEvE0Jhvct|w-<*OnFBI{^*Z=CBa3O%=b%org&
z%<Wo-skO^_#t3Pd1|+cD*L{}){CdHJLq%rT-q-jegm*2&+;Z;qk_y%r*^nn!O4iHT
z2&D(EldZClMv2ew<z|RAe$XjD+TqQC3x1ja*(JFz9AXPf=0;LWBI`D)Z9mj8+ou(~
zAC~5}>V&K@Az%c@>j?YrBv#$~l2N>a+>8piANcBxmCm_5?(0Qe=FaW5*7N$K9d6F}
z1F&!#k}jQTvq5YRh%RqT;USm79nu3ZD7r6;!0gt5F-dzqrz5SE1$y$%8_QrF+x;mj
zFDF@2fw0tEy^*hu&f{k7bYDn&@!bfB)|~5^bPJD^92ezMLv;D<$HNvIO#zez`fFCR
zR)5rpn^t>uBROdKID5NONRC^)VL^te)yO)E2An;*VQXl_Nj_ztC^?#b4jb}E*WxMk
z_atuO_asiT&I+!+8K<0lVSvJK8689MoU0URtqas39w#hK>+n0N?(=-R)P^R7bGiob
zFk~qY^Fyka5kKhhm+q&6upR1vtr0C?Yn1Lzn<oeFFQH$_ZF%Oin|oD~+9B<W+%8_o
z;&_waeKftwM#nNU?1jFjg)2%Q4QPDBBT8x|yl0LwZX59wWw~Q+nx*|3jW~BK)>|)7
zTsvDl_PowqJgt+)z=D0TcCJ<y{V_|s*zdFN%(-YdG7;~1u){j=mL}D;RMU1thRK;R
z^_t5SIQVN&X<NgEwtI$CfI{+x3YF(UvCMIGk)H{_wD4zK>ymsg&b`Gw7ZpTJ;1jA|
zYX$V=`yS!c+OoHD-r3axiJkIR0VH%`-BnXJqRUh1b*x6^kF$|2;;JGF*dVbTnV!0z
zSPrv7Q-)NxfY+k21#T-$_GuoDU81YZzH2|ldMLa<viQ#>FAMZFd(23o;nb#XjZS7h
zC{1_O=NjG<UNiJnUWrdRGx)jsR7siryBtfM5%DsgP5rj;$nl=Kbvne}F%S9uxdl$T
zbZRE{4_fl;531T_39&iW?5)o7iq+4k0;?u{d#mvYtJaP3&)~4VdND%vWW(})q3y=a
z<=Bf%F4zzbp&8~7oMW^PI&yT!>A|Rb8w=mBFT#!R-5v$`0|aaXGMB<H)U$7A^&}g0
zHsm@Jpu=+RsCqGlKQOgE0&ma^YRD=^4OgyKgQm&E+VY)>S?v+NYP23;%ulqO3M|%W
z^KOIy<zkwb8gs==@%DmKN$U-j^f+(9XoU6Nnlx0PrfcV`4vqc0=XWbAH`dlz{{RE~
zFr+x}elKNFV`gP$-cwb3WQmo2<PgC2X21Nlzcm_!b@X_zHJJNjUT#IS`@JT(^rf0P
zG>&Iwe@6`Fvy;30dvQ^zAB0`lSY?`l?rO?mdR44TITP|U7QmxSInzeKM|<jAj;Y;V
z6Vq<(C@7lV@<D<0TN$0!_7F$Qu{<E(wX)_->*IRwaN9(Pw10m;Zrr6Gl^AtJlHi}_
zi34!XR;Qn4q{My~sp<x4Eu7ocsyP!ZgvNZith<k)+tLyqVP~H9S+=$1BKD$-Bu!<#
zC!V7#cAaYll794AD2&Jq4-K}M)h}vVwQD&FYNIGGY_dT7wtWd>5;reNZnwm?j4faO
zbyab!-5bTZIKN%ez({XCnAoW)^0lOFri3d+DoTN{S3TeAWHq>N5Y<dRC3bl%ber_^
z5sRm%*;bX9b#rAx^oxyJdGGs85}!8T$+mpCw%W(>Ce5#jvc|2`<(R%P{c*~eebxG0
z^rQ<ddVh_<)V18>`Yr|ak~8r}&0>_1_jvpS&1=fQZOmkiVCKB=Yf8uu41k2S(j;2E
zi4Hnk%%VV<x;4BD8cde?jM|r+l5?&8wd1ok3++EfM-Qy_xVX>MKSP?=3VMv*uXEh2
z-5sgkWPOGLl8&eiAy6Icg|6t*M>0+gBMnEc_dmxITdx(}f^@1ZJaFSW4>KIwelabP
zi1gcR^*_ML6XGrO61CmfI%<)lLms_y(%*gX!-t1x3Ut$6inPzSH%2zw$XB<H6HG0K
zrB?T-J(xGbj7p9Vz@=6b^8!aZooC&9AX-s$2pHFdNtK`ZA4JjH-0Uw6+9hh25c?-a
zXVWUf&25_T!E6yaq8F`ix?C*3lv6Z7^^A8uSE>uuLI0D3mO$?=g$<B4+p$eE1Ih}>
zO1^Wt0kfJA>Z=MSZ&D*ekqGU%&ItH6JW2C!MU=ZWa*&mj{t9*nye1YU>x?$nU#QTA
zFW)XS%RB7#Qb9}K-$oy8Hmc8|Fx$Y?u+3>1ymI_}XFEwDjII~A8fIj>@0ICB#fgRO
z>A**`?B$+pPL~ptO<UZcvR(?$E%A|6q)}Ce>kkJPSlrRbX^S;JCO`v9psKPb?AyHM
zwMrOY2vy}u7Z>`DF4+cBhO(noVF}<?I8S6{V)XuvONjKKK(|Ib*HLUp;K+q5SjnnR
zR?^E|45Btqrrm?W0qtzB=Tr;cmoc+jCuD<8@jQi=(-Fvf99k~$ip|QStA*Co1=5}z
z)B59UpzhiYV`d1*-x<3V_$z8N*e_8bQ{G@tQ+D~+#Act=ZUuD*XN@aS`l~PU%lpgw
z71W-qE`+4bL~lnVJ#ND3m^VcENTx)Vd0TAJY&S=nO@q}>G(gyK^<9HTu{>Jy!wk+Y
z--l3RpFbrevspN0mnPf}P_2xujw&LIel;I}TWpqNuYdkpxlB8`u+giqj);zV6WtMI
z^-Y_zE~RZlR7+psyWCHo3&zJ4>`7T1HlK?d0Y`=H$-P^d0Ib{grKFK@1#S~GBfXHK
zqBqw)dYlSr<7fF#`}fe7o;sfDlFga7tOjmW-bql{Q!%f=gvb&Gba}({R?_m4{g?Rn
z)w?Yfq?6jJadBX;c}$0C>l^T{M07Px0ZmYH22)%X(a87E7Q^oTSMw!7hwUK>u0aYo
z-cE^c!d{E+YN*&Zg&=Z6JB6Ie_C$rJk+Z__=Ux}-5HWkaEM2{ZMt>pAtLI7<$6q*V
zP7)0}ZwPVMxjq=ZIN)mRuT+)g-mQb_9);M?K3qTRST$1ZI7%mpxz^Zz_Z(5>+H}>7
zn(U*tXu5YVWE$?j+7Kx3W&jY@XL8sljXxYBd;y=72qbA|C_7S9dj8?|cUd=kkP&{(
z6Wuh?sZt!^=t31J0W(sUs^1-9(jNpex*+ktUR@TX?aVfZ2gYng+)y4ByH4j#q6U9U
zA-nQJDs!ZuT1fMeC)>-u&W#xpox?<d^Sjkg;7!mAEDSRoH%`1O+82*{hMrGpyofeU
z<oF!*w&#dNtp2QiuaEy?ci!=5oGu~gwVw|Qfz4lf`e3;-LAa--0k?DcieWqp>cdm5
zD;x9cdyJ~&4Et^a+=e!v0}PxBJqq`fEk}#d*+;6!q-u+#9u0NQ4^pxk4fmEM4A8%a
z@&DGC=ab&A`w6}*Gk*K-NAYik;2ig$%Y?U4!ocYLaL{lir4q~Sg0tx;h=H!O=;YBO
z3HfG+c~Olc_vKBCIx;hCiMTBH-ohgkh&%!-K&^mZ)cH8q1Q1+$?R=}aHYn^KR1LSy
zN#UYq4$KT4R)fEl92#G7LLWbC2Ye(Isf}*>hfT3mO&fVlH4!goRYeHaXiWL6(`;kx
z5eveLy!Kk+IwkZ{Tb)zG{XWtqSu(8K>(5{_9UDJQU<wm*$FDA5fCzc+Y^&JZN!$%>
zJl?3|xC(x-`VOos2l!Gghy{+DN4THg!l@GX%D$a!Z!5O(J{Qe{Mt7HU-l(f!uuqYw
zeYQzyKH&O!-q1w;*MwIp$C_XIYu6sRV*9n$BhY&INzmO~WCi~K(6aX3%`mu@W7wvI
z8}L5A3bJ41uX}}Qd1+CCEv!xno)nNC2u8atY{<iCE$6Er%0QkK?gdk~sgT{jyZI&H
z+@RBrJY$sV0Fy3hK9HSoA9DMdBeK!rbtC0E>O*>Ss)@PohA5=h^OsxAWX)&^cXyLJ
zhBwl9Fg55|PNU^!_AQDRztY%Pd_jtzf35JxZw+Q!zxwWfP^30V^C!j-AbIgV4B+0I
z;B{miBfjj!N~+!#*A&-LW7wsk##6;6gf|#JE<~2>>Fk4|F<oE3X#;+f{sV@c(nI_?
z?JEzSrg6|Z5nbj96iWoD4JRv_M{vGd_)#F~g&Ou*$)Az~MojZ<-3bjHs(D_corqu;
zu0BwJ>vWyUCWf|a<|n~N=7laD(KeO(ulBRop-T-${OO!|!h)#^{;~L*%Y_hQ74(i%
z_UD6lvV+M@1ufaJns29b@6Y(bHtvnud<~3J8PvI?E>LOa+PM2G^{bYx(n!q!LyNZD
zudN5X7HamFU_cl&h7>NeoCfiZDN2mW_>sC+8nrWgo>}Ba#M1XHl_y=w<*f|e<=r4d
z+DA#9uHV<aC**y|xKe!PI6nHlMLlZ0x~z`=5D_+Dj2in<F}eN~deEA(44TcFrHA-E
z`}UT5z802r+n$R}$7jOPo>a*D%CRo$M?xE>ZRwrG1t0%ryZb6~fQeD(s%fXsB>4DU
zgFw`1im_d~yzGr%PtD$V6TYYSP*~LVUW(rhm2Q}Qlck;i`TD3bVIj37_N5#fEMLjG
zyQTVQv#KR+xyxH&|7*?m^gt;c5QO}wD@~#FCKLZUVcMa*Xh*6J>dRjA;$VAj7J4u*
z7Kh3HX0qyPX575y@hfUZu*?UCk21Yx^`Y#0ZOGH7|5s-NWJ?SP^n+9q2zix5gWyiw
zVShqS2fM)tf2Q!cq&TN*D-&VF{8w0UybOcPmCM#<S9w5lWlttvwJ_(QZ3S8#^;Yck
zDy>Yio(?SB^zK1ON_@igeiTK~P=C;V^!|0?eb!!ot}#J_2{7vm9`DK3FSvQPH7aG&
z!^wN2tuHIG*6KZ{n*3F(<GsX%8kIX_UF$(yxM3yt35alqY%C@kTVtPYV$3?D5Y2Y<
z<J|GLS*h!HAU4@7ownC|aPtvAyvMDN0W+}3-Nc1@+`z8;imHlz)vq0QWxFE(U(4JW
zvUv}oYQA-m26>_Stu&KF$;raqpe%|o^8*>SBe?WPlKWBj=wf>J8kL2@`pVHHY7}MY
zXgGbj_jvEEV_Jze1YU9U{la{@AHZxhP4ivZE=3m~wO|szUj>xkj(#yc!*cka){|Z9
zXQ`Joh_Akcjo;kTj^?s2IbNI*MnQV&1z6X&2uGVa!a7Hr+T`m)8}}jbaS0Zd(j$cn
ziymX{^@Nnpz)|D1PpQQ&n5NEi(Hf8`Nh!cuCZc+FrITM}!zOp`g8he?v<C6m(VT!~
zHx%K;=F~%YBINlEnCcX*sVm~U=cL4W<mj^=^UY^7^6>&EJuhuxG<beZK%+bm6Gt7@
z<@RBAqDAE1-(CQo8^*aUCj%UE*@d6D^Gq<s9;x{;pIh|-V+q5i&rBOO{yj$)fIyTo
z3}7~fLjJ&75%0f=bjf*qU8O{+w*>*@vLu4E5OagV;1zm>rGf!<-tD#_ZhSlyOd};9
zr@wGVdR`fOCpALVR`n)VM~5$xH6lk4wqll2keV4SL&sHWh(F|~wWe<p@@E`OE3+|l
zUxu|0bh?Oa4EBCbs+A49;%g6NI*wW^MD9kVJg&APTm5NK|D3aQx4<&pLZU<)q0nFD
zHk02#IsT(_N(x<SAZHL2)jB_Vzg^41JH$V|2gR(@8fDhdr=_A2=bqXPsHUUxZr`V;
zWpexc4&yG|Tf?E%>uDhBhsn$~v2J5tw7L1TQ%arQvSw{CNgbG8QK~$$X>2GPK+!?u
zu=}gGG$I!EV@BB<{K|~c`@rvzM|XOXDam)1L@&pZL4f4W@J159aod^%JL@N8%Ih<X
zQCQ<=ftn|sXBXnvkH`uW)*{5HdQY>PXLnaYl`F~vzz#&7Q`5g29i5Qfd@ISdw>i`J
zY0~9ihc^9<zhHl<e~10K^LJRjD{p?UM}L2@iI+r;3z&y~CcSPJT2s-lIXpr?N8%OM
zgbPu673`;LxRDjvP6tLQG3lo&nCF=+C-$f@<F?=G*qceyx2Yk*eI`VQZdN}AT`ER7
z-8s~?|4bHa)M>W<O}}X<p6)%$Aq~197R`LfzQD)2KaqCG&%NEj+#!6YnpwSAlA7L~
zxIvw0>Di3_CWlZKK!3n`KU@^(qU1dvTT(A<>LfX{b?M{2w^(_r@L=LtrEREuC6OnA
zO1}Pir9?j-=y4l;h}MEw4AA=}f}o@%%zo(|5Iu}Qi`#RPd!7>ApU^i+Rm5rWLgBN4
zB>Q>ls_(V&y~sZYG*m=L0#8wlsR~R<AYtP}3`ognVK!Pp)zp6}33nmD-O3>m<Yo0E
z*Y|K}!O+x09j|9?!d<$h$E>#FBzH@<&Pt;%GVXFhl4<xy#uNOvN<*2&`np0KqxNt|
zw~oC|_>HTFqAFKIBw&~R&6_l!AMxcRp*bpgNftX3y7_N46ENq41{05w#uOT`B6k;y
ze*?n&2YR-;vBT}%pk(NJrQ(Nsp+yqdc%@6_xS<khICbLX{zUhcLw<5;vF(Sth8k)p
z&EarI3kF4KM~Sy>4FCU`28hT|pSb7kNUvn=%KNPUpML;Q=q(S<FCe$qst6_PAxz^C
z(rqqZvcVzM3~oIDuDnRwt>@k$<555*Ce46vS>zjyNulwNuifbgk=(wfhd&&lF`;3T
z&1TierqEMmRRKR(3I0$ng<<0vRJnWc%a9j!O0KktktwE=V7HSScgp-6kZ2~|7W)fq
zulWrnhkeU8bWIBwc=F|{lSEDol*BeoiR1QKJou&v-t2IoR|=p-YM}EA8tZXziS$O>
z#9NN1p;26YfZ6Z~JgmY5z-pBMLO7q<*wOL)-rjJAlA&7IrzyFdFGwH$fKRBbdrEd`
zPz;DGbcmsugDO^q&bn6F2D)>a5=$ckfM`^d?~lf5@v_AFk`@CnWUR#R01{IZ2{4kr
zfXSX~P}@ASaHWF5Fja=m-ooM8lYF~Ddd}_YtBIYG?!-pY5<T>UxQ<az!iqImm*aE{
zO7nLBiB~bAh%jEO;8-xAJ)H0<Wy%B|Fp%`p(NF|!HXn)3f&xrF3QNO=yp*Fe$Qt-;
zpc_C`u)U5?YUnG5x6^O)q_!ibPGx!YDV*H4l)u2jg+zr;`95u9TdBC<*dWuqA1O-U
zyQSWH1KO#&iNrHQ`jozvY#6kna~SH7D&+9+foO2_T<+r@SpiJ)=}IQ=i$lx|H{|su
zfM`XXV}X6c<pPI-!uV1?ML$8!TiI-IC#pL`(IOFEs&pP(=$r3xx|KKC(29*@VDGbu
zm}Ny$u1`C05e8<hfd9X6yn4lHOCgfVK@FyHr(XoX3dgko)toL&v-`blwK17HZI%rc
zeg#m?MaL+Fl@p=p&xmxRE<n~V<v^5~0cTY&)KF%KbYm}|noIm+8~wwI`TgR`)i(yJ
znDSBZAS1G~%)sSi(J+L+%ACBfUDImCP_?m@R3lvp38alGnRy?JT3|&&YF0+)hT7!j
z-((cVKqId>5w10zifFA<(Hr~*Ix7EC%^|`8)!YU0z2%(cT%i-yoJR*><VW`v1pIO?
z%S0naJ+q0!C%iCTa&<GUX6dMfTfb3`)2#RVC<8`><DGz81yad70adYlRVFJX73Iqd
zLkT?UVX9y5^&xxoFE#G1(uY3m&dKImwz+Pwkkx}^hVwV#=-HvkFw&^@t!0tMX!y56
zT=V~gZ#6Q`5fwrBM&k%$j86ej9l(lL2h3MWid+S)oRDw%*180Xt~uxNvsnqZMv8`j
z8Xjrk_il_>?aj7T6GOsKJN9Xy7Q3*<mh9rgp=C7R;`SNJRP`Lc$93X=3y|m|Nde)=
zTvq?%`iK9~+dwXzpex9pupXX(B<L^_CK_d+%H*$y&E4zKZPRFu@BYN7vdUqX_kt?W
z9j*&Fbv26XP5k_E^L);yk%56pZ0vLua<)Z@$ci|-2)GG)w}VV#K0cZ2@8#slGokd&
zD}T~TV@inoZPhjHP$Tr)s%tYvXzo#MNJ0YapBWmQmiVMxFex02_~&!~MejPCr*xRU
zAz-c}1Ee&`AX^?SCqF(%#41@QYA9px!o08d7+&3_Z)&^J;ofK7i5p6eo-L5!{Ov*|
zi8pI$H_*On_eM1iS<a>R`0f0wF#Vpl4h1AUc27GEKE>-{LZkDFWIO<FU(`-1d60D_
z|F&Q7lgt6tBA`}E-|O+8{9jAG`Oa-DJ5h;}{&L2iYI#dERLwDGDQ3@dk9}f*d%Db9
z$OVVA7rl@L!StKQL)_yG8y@R*R47z>07NIT02^fg$ld!q@r;llW7^hgTJ1dg9pR%S
z;XBDJ_48I<ihP4lqFy&z@v%x%1~@v6f_6nPge9>c)0du~5P&>s-MMP*=zrzq(1T8#
zengNkaxJg00>$O%*Cnml2(=6Gg!U*aY@ZN7X{jmd{#1d4@ik6#Wkr`|!an_?)MhO9
z6Njv-3W0$lw14CkPfe22nH4H~UdO~RT`^&!%eqf-B7(1^yK)7SfFqS>Ub`Ko$q#-K
zI^#h2d0ObFNI)>DcmX(5U#+)r7zh_t`E(L4nrhARa}bGx+gfLc3tCW%=Va{ZaldiZ
z1$mb1mNVoQ8<~(nsh;U`=LFdSrZ$Wnpofz2C)niw$6Y%)2=15p4MvZrAP#?K#x1BZ
zWto@idLqj`bzka!Kt@m3?paohuV|<WsF_!ErlazVlU34Dvsw433_XlFyjp`fVJQjL
zuub;U^G%jQZ?7hHM3Q5<Cmh+a{3l3q(nH1ojxTC8BkouB5(zuQw2z6{&v?wLt0ID?
z9~Lol-(gjjGvCpd>*j8>nk%ST2lm9S-tg&19yPEBra}o)`TM<gyN0gJvlZg5K(>i>
z;gps}I_O{7Cc6$|A;Lb*{{!Bo+b#{>0q7*OMugM&H^4LRH{QxS_cz|UTr&XK?M@^r
za`-^uo*;9pg;SBZl{8!Im1DV)#%>%bti@F0ZmHF!goQc11?~nv26k_~|5t|0mER8{
zP>9NL+%HvLrgu1pvH?%te%t<s{9N1mEKeV(o)NnEX)iIt8s4xIBV4K)46yO-(^9SA
zzJH>C|3L!%_rE%XemMr%?EQbS*%MFL?3e|B!gxW4R)zLvRwS$S-rxdXFIFG1(4XK)
z?t%>?dDyKwY_@n9`W%xCmcxXd9<8KIdcTU<97x^3@;}et$Xa<<lQ(eH2H-(iYQ)iN
zAYM7HmbI9#@7SIVZ#FB0-_i2RuAsJ0^8|&cH^BK3*x|(B9U<#hnvfWEcU_6L%-<aI
ze`kIE`|I26#C^;lPj&B!zsAK!2?`Y&<`u|DU8;~6DP&J_iZqvhSG*%R=G#}f*7;mq
zUO{G7Ld|mGU(@2Oa&fMu^X^0U&S=E)8owmAUFb6udO5b2sL(a5{1XzDyCH{ADD0B&
z!r+ll1x4_ua6>aJiLxRI$r~SrApJJ|y6X5!wR6RfIaFM)Srg3(1#A1p|0{CR_PWaL
zN8zgJsE@b98uob4OaJVwR(hoLGit}_`-7AB343=6u`NS~Xn(I)a=-1`L+ch+W2}7^
zz#G1!4OA1xrjkJ;15Xle^V=G?S10c*B=Jk-i-pKE#I+1E`wbgJ4e2xFS}ZKmU(~=*
zzMzSK&Of}4TbXYgJ#~w9Uv+p0i?fp!-PbNcz9Sefv_*ds*WairwAYCT{DJ2)*_>`t
zSCh7K^80__XW0FzE*JJCrA>+;@U9v@sJvCw4Jkg`C<=RQFfwKbWo0<abxIBUMFhw;
z`OS=u0urjzA{T`3K~}nK%?G^nDp8L~45pKahCU@D|6&ivUhOhkR(T5dNy6ocQ7Ez%
zcN?~LYAuJ%4UAxEO7?o83Zi$%%>H?j{=p0Ry@JGVXYk@dsAibW5~5}O!Lf6<FnGDd
zp?JVtKc^T$w4jW=A(3jMu`ocqvgcvRp+hv$Wt&)1$gKF$_Bv-%$(eo?=BEz~p%Yz;
znZ=R{W=3KdQ@g`c$jUD-R%kym+B=~=szGd7915vIYv_h|%?%}VDX2Mqu5fM5W@;MC
zY5{?hLhCzf-E!KO`|0sRfc^pWO=kfJoO}laP7eI<iV5(3pgJs_$Bp;v9NTp7?~T6S
zC^z^g+{Au`TiLknB;3SZ=p@`kK-VKL*289A`}A-VphW`Z_aX!(ddsw4B2s}2E<U`z
z(>;%QU0Hoo;&C%xsEBcsz_f<0DW|`=Nn3|`J?ZD2*+WuJ;x|ADr{lW?2g@!)_`{-~
z!bhp?+GMAE`7bYut7S0YDa}0|t{{G@Slf0xe2A-9Hk8*l1sa$qUjXj#{(#CI25z>C
z)y5chqQMfIJu#txM424-;o%tzXlqK(Oj&2D_~{*G>h0CHln%)!J9Px8Tz?y-*w(A9
zq3&ezBb7{Duj~EL{TzRLa<2d8bulfVWTjSGf&Vs2i2#|iivoco|Eush`FS7LZx*kU
zT5eoayBzT-B8$+@*slj#E)gtBLFmGVBgJBYVqC|-YXV-NnI5qVtCW?}FL#8;_?U%u
z{{PI_t>8~`FWzb0)&ZZ*8w~l#Kl8BLADbz)AQnu~Fdv^1@4IIm+G)fP3!2lBj0M-6
z&NlQvX=Q<OMNO7PA8VfsIHeri2HVEZJ}}{(QX?7V@S_Z`%u0k##MN>f<`jp2D<ElS
zWwlZV*tJqEZ6PrrAaYXQ<GW>h@Bb^0a^V~4a`J!zFDwdcpVz1cxo2uy1lKn%Vk>0Q
zz1k`f#<rr8gsRPskUn&O`v3}5({HxlLxNfBUUuSuOmS*c-;R6yLe^In0U-vb$tjB=
zK>4CL5}cFakd&oy?92^je4N*qv(U#fb>ftwBN_(XztJ_IqKarS4zMCSle91wSmI4G
zD9j#ZMHN_U^|-$|ZN{GTayc;F`@5m|&ldsbN$(eA<HlDJj*$bl#s!jNBP%8GlR_7k
zesY2K3$h{B#5r1-16!OoZVJ`G7=-<kn$7l|+*hpMJ-z?H0B8w={~Q+m-|rLPeUYr-
zcl9%YTdH&@ozg~e9Oj?9fb|^Q(@Xpqal1g;RwQN_pbZK8)1Nq{MDhx`_*KU>UIUy`
za%Y)Uc9}YWO72vrl)oxD3E);GWj#DDY!~*AHx=ABoEZ1?c&r|WY~lC;C~6k@UPG{6
zWJ>vVdb;tRq7?kQI*YpGt$<SsoU*YCOx$L3=$Qo6sWt`#%RdF`|K26{o&8sP>3l`H
zW3M*_H{i7_v_EQ4^*A6w%X{JG&y|=*{O*P~1zg}vG;Bc2r_AgJ@~cD}zA8Br@4hwc
z`lvNt&uQRF9FeCf2H@k*o$ktGe!`&bmsX!H6U4`M=Z}5p13T>-j=cN@9C53L?K0)V
z;W@xm?_X9aAO6iMWp~Ls?XxX&_j}fp1V|5(Picw4s|&e}UD}g&M8~&?&~UMyW5Gn~
z|LTnbJc;1+f0B1O68|fCSDv-)4Sx~%iIUH~B;-R`eg1$Y^m$dDuL-r@8;{9BAM~uk
z#|QFV`EwU8l}&W%2+WD}Fc-b`x?eMzcCt9RMboERSz)gZ*WGf%iqTO_fP=Nx=VL-0
zd)&9Doh6LX@)N@6$qsLFr8vwPx#7Dr?R&S;uP*n5Uzcx<Xy;0oyAH$6Ql^w=Ju2^!
zQStU&MlQ-e-LL**Zu);7tG6Z2E=Q9#P#GZu2MkxD_v~3j;|Bzmo0n8>33_!+)KqLI
zDs(Wzq4O%w^a;8Yg8r4{^IYfAwy6#8i7lD$8!)<%aKDeU_p4F;x5lqmuA_MQW)y8M
zlWubGQvn=}9wsS}R3kOUeZg`E-)~P^b!Hh3_EoW8MjD1<7LLt7<8~r2<E34q{H+&Q
zKQkFxxLf)iuxO_*IR8Jiy=OpE`?~GDL=+IEs&o)(B29WPibw|qY0{*F2uN>%h@f<k
z8hTWk^xjL95;{olHH6+mPYB67U3;H>_B!XTbMA-xeuOVc=KR;^8RIwRT$?&QMh9pG
zTF>8Rsl<eHZQVh5APX3Wo6ZPOr?W2b-MabDv#>1d%9Ph1%#oM_Y)Zgs!^*gUdCcSB
z>op9v{eoS9k~T}gFKSZwVnBF^0Cha7{dBvFX(n^~@!zZhK^lJy6YuI^)|XxioTz6!
z!~g(OgBf<GC@NE33>O#gFN3X=g4EfWx9Y~2{KKLF8O#G<8H-C7wLBaKm2i>wa*L0U
z*VOo^@pE#Q0||;VPYZbdymNMr-tX3J`@#a)=jAzQ#7nS0SOc@s2}LEsRE9pw9G37@
z+vrhkX*uWC&9r*-n&V0iHF+!v7gmqA=J>EZ#QFmXXO!rK2~3FQ>q#$<KopJzoOr>R
z4vN@Vgym{=sSC)`crOMRcY+Oh97|eW9BW8tN>^5N?NK2(1bv2;AUF3|Eb7&176ks5
zOD3Z7#psf<M90sz1UNNB+?4`OkPa1d%-i>%{75@q25|%W1S3Z3@9MJpzbb+7*B(ax
zM6MZvdp^}QwDZkwxnG-g>4G3~=p@%(lUER|=ra>C=W&^ps9iQTs*hUsJBi2#p+`e_
z_1`#^I|Rh_;tM{W8iJiJZY%^_H+YKa-TNiAAFb!oKqF^eV1n1lnQym@?#(#lW${ni
zrP{=R2s@IEcN4Eo2As<BGVh$l`kXIcScNj3hHaO@?%y?eH=N?THf@F3w2jD3ekG?R
zeKN(aGDIajAmM1@J&%-Jv`)~ZEGn(l(nyPmqm}V_7lZ0%BVVmZjrVC8>2<XIiK!Zr
zi)L`H7g`A1j-GPOZ~10iw^uPB*3_|G){=H@<8<P3ugRs$f73n+uyy{%g0QU@{PC{y
zZw`3Bi^<T+WL#KlSQ3UUjXjO4(P4r`H=I8_w!=WIPDtOZ!<xVK7$T@!_06FWO56YQ
zc6vjNACHqpLrO4oP3T#ZW!e`qPD_cn?<NldqTH?eb*XBl5Pi9=F9*aQ5LfpZzTpYA
zWP3oJEhdkPxOFqcJWB2m@<b$nwgPq*N13XWe<Ap%dd@1A2_T(JJU_!}NsR=N8ap6G
z2^OpHeri%rELDnYF^v@?YK|S6;-*ZdqcrWTHx>gXOI!gMZ3p0Mz5_7<X}xXj^m09f
z#zwFNE^RXTuJ0LIMQ4VrGFX17zBsSJw^HG;>uiG7-AlCj>XV?Dcc<#>H(Y8?SP*cA
zQWa$_8JYwQA&0kh^Ul7?sO>VmxY&YqU;Ro1DMG%i`F134<ICa-IK~ye+11sso<V=H
z>;2RuWsn^QDB9cyPbUUm(1y)e#R%HUiA!o9{GD+!=uhoFBgTq*0YLXjeiK*gdTDGm
z!k*d%x+(k8og%(|qa7kKhHR$|pgozv9$J<1TS5d;1q0B=N{0a7$6Gnp?^QJ>zSUpZ
zI!<`XX<jhWZ*k?-yIso^WnOIcA1j+WuoVY6_uJIw15N_+foagf+QDb<t*BcsPiNU@
zw$AMB33iBW4fYku=V=zfc+&$?{3>-U9AMk)x&pf8v!inZ^IQGv2V`_YIW>$KYX`S4
zdhFS#zz|E;>ytB}BZ0)hD>(1wgSIM3xH6D(12MzYH3y@+SioVUTGISxxHD4UsBF$D
zr6^>^rh_~?$wXKSQ^`e1oms3l2At7pMY34q=sNp1WAU~9@9m2LNTX28m0yXi4ZnmP
z1NE1>V*bnGIz>bA58q!EIutsRiTB)E2_4Sk7fjX(=+~3gtBNBs>`0i>NDn+I7&Nhb
zSHVD=t^K}$M-I`S&DajuDQ;x`lDn)1&!o<>!Bv|;l4)N>2*-ilNL@OtsRI}$clu6@
z8W>}=<u{@0!)P=OR4@9LcD6y8xq;XD!$Dx;7QX3Ei^)v^q~n!;XmD*8+ksR~{kKb7
z7X1Y0{?yw4A5QO&ME)%H;=0LRi>QXT5{pFvmS;f#_N%55Fb05f%tvga#N5l>%z$-F
zy8s*yMVn9s7g$B`1l%^)@ZBg&>6lkjE~I#`s`icK#*c5m1@{H+!D&EU>u&pfL6F4W
zV?ktD!}+h!IP<o5)5?LC6i^+jh@Uctf>~YxhockI#5ZXVl<wUa5}j;DJ)Jo*o_Rvb
z$NXC}X7Uba<SWj<jt@Ne>7U!D?U|*?*4=uJt@7YR9qSF}Ww;g6de6BYq3-_HLt;;g
z<-5K-4z|P|UvmTKG(JgX^yYz*Ul5*s(|>Jt{@bQq^&jlunm^gWVQsXC-|XPEpyR9N
znEKV=EY-K0DT#-G%R^gkbuz{Bm#s-d??2$diFd3l9e8gLB@r&&mv{yv03OqyC8<9F
z5q23$56P{Lc|KvdQA`V1?vRoy%GdsQr@93Sp5l5x4f#tA^r>&C-PSROt2$o`NCx}s
z65YQ9prE7x7S1MnuUDU323@m~6k9zXg3*F-j^Fh7*$d+=#WVSf9bLf_kx~7L_C4fp
z<Qo9ZrI+>B`aJaD*-iMG#uG1xt3-ix2ribWs+e?BZ@Rv}+Q9$wln$Jp|0;)05=(b^
zB@J?CyHrTDp_J(R?nq@-2-&Iz(RC$8Nd<ItZa~h}{}e>;oadUYea(smKfs_~u!t-7
zyD@tjb8-EUY&I|zW!E?I+yy-)T;Fd!TbOknjW)=42SIy0oSRXFhVBEmETIA9(Lv^c
zbXQxk_nqr;y<$BT(r17T0pQulJc9h*chg&IuCnAEg_SiPegn8=(MP{%H`N!J{daz1
zueqBx#W4I1F59U&W8KtPE<;2gbGYZqPVKW)?D?g`yEf;RNk<@kqD^~3$=m;j0srTb
zdzVVVcy(m&wUcuau6tDn{1o;wT?bRJ)&rBV{U9mi@U>rQ`>A@aRv?^xZ=~yEK~9Wz
z0qh~n&Hm<Mgq3p+3vrQJVK|{(Ji(|olt3-YCg^Z<ZY-(fb`WJisya*H*k(J0Z@4Be
zKfFQ2{Bm`e*1f=66EdODlMxB|UnvO@Kmy<!!~8mFmz@e<weqIq#rCh!!oHGK5P^4&
z9aF4xha7GgQG4qNZMpeIPnS!fhC^@hZ^mbPg5RSB+N}bLt4yq_ws8*EO8;^I|4~l8
zbRmT~+n3+DBJ&@WycyO<12?PmqFYgK0-Rimt}aCAo<YC&diyZ^HyT1Tg`53v8bSvr
zh9dmIZyJL2|Nk_Ei98Bkk+3F{=vUmmVt^O;0#JAL+2-N~CQmM0&zD144)t8Ml58hU
z2R-NiX1NBA4kP@-OaRc5<Cj`+KgMcHx$Y@DoTx>|lcX-U)TjtN!mq@Q)Jy$T#rg0u
zK}S&SQm>&}3+)))(f3T*f&Tex_yM;7)d>HUU!khVJpMZ-f}2)ke}oBGm0I>1kaiJ;
zF(D_LzaCzwBNhIqNP7Fv@2h(OW0@|{J`{a+4w&}E3SpIZkH=nJCe_#|+VkDABdI2?
zONn<CMgpq3cQ5V8JVD&y`I6^_C5#0{LRu~TWmfEo=Eeo6_Qc=0%n*6$i@&PT{&Qvf
zM~Uw-kQ|S~e+9qc1B#|X@`2R=;kn61HnPy8m%>f(wzZ};0nN{P>s)eA4y!CsI2Wbi
z5p5T=lN#bWL)=<}?h{=ySkoTprJwD`TaE7u{co1Se^f8OMg6mSsrUSM^>VC8WW4ZM
z5nI5GFARFpxAfq>uZbIYV;a)RBoo=Y!a{qXQb&&fFFeSmc_%UO0lyPmu#@Mq3K|<_
ze`OW=ck>tcKVV@5I<b_1?oM@%>||&HdzgTWSbI3HXS0Rjehtjg-`UL8{F+|?!qV?-
z<^dBgbZ;-v6<K?6AFFmRFIHmpODVQGbx6q+C<>I@9@h0AX#dSc=Fi%LJ@iNUMr`(<
z;mlHhhBFHkt~Zsw$zkSH=^ocyYFA3H^vd|cK5Q}r6qtOo?tT-*6!aNZTYk>&j}4QN
zK_|8U-A451>l))Yu<AosWdl{SwC&9@#d*7ue{r6N#<Zg<V}5g<5hlMm&xSc`I$Z1B
zz0fEBbK%N~!0IJb-uO+HP39l+;+NE>dYGb#h_&8aufkg5$_5?m>&g(L#?+izHB4i5
zOj45{r4O<lMX5%7ZydEeA~P`DmQqFwkWS1`#S@^k|3f_qkgFsDauv45weMr{J+biK
zwBhI64x?p$g|&ta)G5rGBdD8%zpSIFRS?InRn?SXjzbiAP*=VXsl3kbgC<c}+M{Z*
zL#wEyZMM5s=Sk>IuE0H)X=LWBS}mn7zq_tmfdN&284bUPgIWVF#8zxs{`t~2stI4k
zMk(|?b$M!)6SE-kz|=l2aZ9-<5huw$E(jV{0UFuRMvQuZZX*weYYuqDd~nhvY2;NO
z_K+*tE$@vO{2}MC9ur~QvLXMc5P~n)R@9+4!JR+Mdk!qf&?2S2=iPuy(0v%9H2-p>
z40|kS5LlRB+HBVOrP|Yy0N3Tr6?hQvmmNou@*pq#>*xCaX!L)&|I5!h#G_LOoG1W9
zKvR9-7TkoUWy`5~Xl-WF3(U?~8^gylgvdM(tyZ&38>+{Z-)?zoUJ-d<hv`!)7<@vU
zS4+h@qK4KQe@mau&P?;Z_y4U*Ms?aYqo~;xG^VYvb<DccE3U^Q4HAV2f)4n~e!Fs6
z5-LsM);A9l2UfNB{^!8}{atAu*!n$Pc#qVfNal_FVj)JgcGb3$m+v&cv3xa@_S?+Y
zEKvX8vQ-$?{OU6n#abH^_~ZXk!IW;r(V>y`nuSRM@wdPbqbPx3E3!ZnVD&82C$t7_
zK$g4smxSa4h<|qIXSoeW^clAQ*?LMYu^_;X)ZtbP2I#D!4hvq1zN{P8XUw=$)M?j0
zR|?T>J$KZaw^p*N+ndjJoOF%M+InN`+KYQOVa8O0%<84BK}1*2_RS81-0Dn_eHyb>
zZzgBVoYA%C)p*11I<qymsK!#iR+~j1#7R^|*II7Hj0nuk$nQ<_PLTmnt0J-L7u=Q~
zVp!H?aE}cji$T+vNO(KmN@Pj}ZKFknU<=KaW!dL^2qyX1W6%SuBDv)<&ItLpRqh$C
zgSo$tg-B;4Q<lHIqZ1M_YKDD=Rb!baw~1v&C_(r!xJkFCF#JjCxSLMX>hMGwDsy!*
z;d+_l$xc4)i95tSv2G{ZOhCN#q__n4${hK|$o$d}$%y63I54m=$X%dv+@L*~(AhV;
zZC|=@1Q?PszONDU`JXa^zx!A|8dKQ%UZ;f#6dmqRj2=JI>#v=%Z?1joqItNx(4zcq
zd?sz%`F8rHMbpgQT-Lo7uZb#oCO3_KY5e}ytxi7%XJ&@C*o#K1tzz$er0k=GiCo&h
zxF|kF{&vOphJ5;68TC5M{z`TNMZHQ2O7CRf(Gd!dCq;lcZ#-pj-^k7x7;wzc`2)qu
z;?$`zE@L2gC$dwGk(q1!PP*^;)=1iIi0^sT^|$?EIP*!NEhy)6#iee9cC1|%#?B<5
zQ^}Vw=xy00S#$-Qo+m~gvviL0Z=rc1T#?r>CdAWGE4|A+dub6&d(gR_H0&up#k*$w
z`s)<9EYmVr6Gy?|)M#^){@Cg6O6%oXy3hB;7E~Q9i(c_lHAoOS;C&kTIGCuDTps&5
zV8IV@Qon(%T1f@Vz6kFD6Hgl21snQ~*L=XIRILG*P{v8K00%5$Px@hCBya7@w{@e;
z6`jwD3^3m{(CGy$JEWx%w<cf70in`DZ|J&x_ZE)2ekx~CY!^3HH@Zm<N+3FNC+C<!
zIlpaurNu411wrsYB4#?4faAv*-lv<ld<>d?kUW#eo-2Yds`%d_lPh`KWf68+xbOtq
zV%YHA3Uu;p*GI6laB0g{{M`HoqNc~zxYK(P4B1ER)-8msXZb!XZN#>nuWgqdf%^p-
zSMnqP9XA3RE1Tod@N`20h<vpIY-zCtd0ApH7e_|i@Ff{I0@vm~wAz)FQVGO-iqy`#
z#%@UB&bd!%Q67F~SzaT<Xu&7%nl~cSt9Yzr*8H3U0Z<&e!n!=W>-sW+e0JwH%-A}d
z(Q(eTD|!-t0hQR#7)2z3VJR2qKixe~CD&qtPiJdJls~R7@OjJLZrX3Q!LB1A53PuO
zNb}ccr|oc(XQGEP@QRibEztoF*R=*nXJe57^&^J6jsiG9?_VmzFONI0`dubQZSmk^
zcm$;77r^`TUq_e%`?&>&K&0?2@SN1|3W6TOvAE_jcCAjgvqBlmEvGu9+=;_%mmOO5
zxSxEqgKB}aV#wuv%HBBp-;w~Xuoo2wz|(Y@bs1R16ujQi!^KE>f!!<zyoRwW*kjs>
z8FMOF<PhFb26J%radE)ulpGL~+3>JVQ*2SnHpL-X;`qI+J3dNyfL?mP)m%dm>0<S(
zZm|Pq?kDHmyw~f4n+79Y=Z#?(7`Ur4)5|-N@P!MOyXw3xCOb9TVyJx@=+F>{+mA2R
z)UmQ6VL_<14ln6F=A*pH-rtuonAW!go=vnTt|8xGqNo|md}|va3fQ{B-31ysFU?Am
z&Bd#;<e{!+bAF>Wu0y7EMLc3!u!{suK^rW(zMUt)Nsr#w$&O#6Zr-&n#imx$>fp;`
zqjzAbmRhL)8aHY)|I+<j_Dq%?AHC$MRQqH9ZuGAA0$c6OTP9EBVkVDEy|k>jSPc1y
zd)>sj>AIxkeWx1H$-Y=Fm)oHDEcZ!sf2HHgixSCeH^t^H(<Ls4x;hs3?R`ruUuTq>
zA~44LktJfL(sDrL@lNDa?;_k~WS_`I#sq@%GW9;O@hu)+clX*`Quc>cC1}do>@-eZ
zLGQETe}I61Hbf$ItQzcMfAu@H=2($h^|~hn#^G4p@|Zb4VBJZ)vy&zx6L+^(rp_1C
z0QD0a?r1rL@oYsGl%0CtUPh--<Kuk~&vuKC_{p={b5V6m$Ybfo$<o>6`O<$+^|;A!
z1?TYKG9J9DN)bQE9UU)-URGqtq_PMN9AGn}OOQ&p;YP&?pajus)K2KowO{nyi2fuN
z_hF?z&tYYm&Oz#pM8PmhV%^_jNy9t8drI-2)0aM}=%^-c^;?tzX_}>SYurRuDQXx|
zv0}8l0{#)u<h$p!TRRyv%t4Yh5cabJ1{i`6KvH@*U&0h8LjL`>Q@v5fCFE{g6pjmz
zwl9V~gBrS=*dVkou!0okV)NfH@@^Nq6;`K@yIX!cX&#5NK(A4+9kHO=V<jc?H1MdW
zKc?+7?*Oh~1C6#{aTQZ5eI0xLEQ!}1fRvL5U`zK=@NIl_*>y6FrmuJDjU1$+nikEZ
z;WI_NcP@4ttmfR$b}LY8#x@nXUiSeMAHJUFu6d!h&G+Fh(hA#>BuLbNxFO%5)NTiF
zZ>Hbc#~{OS;se0MqT&iE>Cm$QoYPwOaS15odjYq}v&8@if@1rOp^Q#j4yD4F{?u|e
z#6+lsQt-SDcF7@T<c*wqd#Q&Q5I2iNXyY8CW=o7gxas@~ctj-95yDj4EjVdxH9hxi
z3Q}`6r6DzaJLuqKPuit(aMn3(&taT*gAI-qBzezMTA9}-Vmb)>(WZ*^7nA1_X=qum
z0L>Vefj;H$JZNR6F=Pf(4J&{3m8vnvj!X?m_PurQ$R?M4ej*dE4fwaZSJtFmU`dO-
zU-0SdmfPL|`A%X39~N7Q7{7Agf;3Ck3}Vu2H}MKodNk&4(_aJkrwe3U{cicKpp<7a
zjHQ3<9V^D-+)bca)C?spPy9+tDS-fPN56!f&kFYvTwP$sKB({W+&v60-3NqWa}POO
zoHx)#I+l;VA;a^tsE6{zjRRrB^c4elx8c_v1z6555&N!VuKDYeD%a>2fakssK-;4l
z*0Ky(kNC$O^3z#&oy~KAHTB}bVptJ<@#w}zO{O@AOy+p%I4#ilZQR0xCy5KTktZua
z<XRMBWM2|Y`pC?EjdwzMkpO1Q?stOm#CjDv*xM?;#O;h~Z$<n(q>DrTh9^YkOx6G?
zhXP`T?hRORyQJ|6vJgGGx8jR$LYI8UlKE=-4=Z}#Y<DnkYI5v>&oXPHlJrfblV5p#
z1lYB*(AkSjq|4=3<;>f7zm<w(!{TI?$b6m4Uu@dFE`H<27coscnNVuwyo*Jj`J@kv
z4uM@>>fa8#9|b~UWN_73(Bqr%+C{ha!bLV*G_avVJAw2?aiQd;l>fYE{G$8M7ITfI
zYalPj`Bsq9mt1XeO&Fo^7IAeNn;;}Go|V8V3L+P!I>nI;zYPK8Fumpx?NpG_cSrw_
zybVyjt|R|uc*ZQdQqM---y~pQ6p%S3zH6Dp+Fx!(X`xc<I)l!OO~N6^5LV&2$&u5x
zP#$uZnq3wIOTd2rN&!}{vgx#h{rvK59Afp&OrC^~KL6>vfSqNcqc{rLk;X?}-iMBg
z{9Ym!#0hv`WUd6~u2zOqOoQdP=)}M!+cpuwcFSh#9!xyEST!tOv`_u$!P(T=((B2T
zx1Z?j!eLopn{nj{a%s$}!b|R3F<}%t)p9#OT7<xaM08E=(*fs`!dhz5p7}k}$08H`
zh!dw7ZuAxy#{@C;aGvw*;xn3J1$KiA_!EaZr(Nak<-;EV-aLAGJ!Gg0ysP)ZyzI%?
zD6+z7RBNwK0B3wR1qL|t7g$wFSyffc9Fl4Z*Xkziw<|0LgF>0oy+2pY>NZUgkux*K
z%444U4YDK>Zq8d_=xpBzfYPl1+>EtMe8-5N{=P3S>~w;MMJ<cm4hq&=xKj`q^Zl2z
zEJmVqr5m9&`i`F=ddPVj=q(95!;lyWj+TbX*#)BO1dVTpIg-P<nEfT3VJ8?vfTvQ}
zF=?eGB}{R<ZXs~8`r>$IL$oI+O`rP$jJ23)!C8;*OO<gMv!iyf>MmhN{0(wqs!crN
z8cn<>e&2d%vb=4JTX3A{2iH!LkO_DYJA8Xu*fz`Nv{D-HEO+?p^5;>(3#&=jI@hLL
zrq0X5=KYbQ{R(AFCz%7y7R0=^x#4kfkU3em^wdRh{TscF+>2t`SQ#HM?pR@5K|1;>
znJm9+3o9=0LKE#9%Ol<90sv_w5Mv0-4<w;DAKZbA8DQpz3ff6&Jr*<f6V7&_a-g*E
z)p+DpGbq#d7OlxNL%bM<HZbwFJNWd=aufaTV3{jtGP{$uw9>C^w^_1#F@98AQjA&6
z<vxo3J&Gh+dZfkN9jWB1LiL~r{}z*YRa%n^02OiYLxn6R`P#~FzG%8#4B4#GDQCkT
zI_`HjRrgs@oZ?28D=@FN9pCW#UJYAhz3G}bS!{ZGu4@vYyVxA*w|gR1Dl>%cXt#we
zis7A`&)cee$-wUCISLKZ=p=}FlwHD?7KcNpzQ%l}>Z?R#VX<=9drb%2amVX*ZpSa!
zhSpt2-4n%uKG$+-{T95*3V@`Dj0sBbUJf3L-yX&QA&Ub;ddyY0OZkY>d5OSqaI!uF
zSXo~U+AWDbXIlYgcu(-oh8!{{`vXk8S#F#jr7g2Nw^UP6T{AH+!QZ+yQGdKOdkB;C
zX)l}bixM{r<ZBXWiSuo*flQJa%zy|s_No=r#qIxM4{29^52of!2vog#i(0V>YqSL|
zaZJGVrq$p86U97V-s2jMUL8w~w$S%u4ZRHcP^Vw1FCPkW=&7<Cl?$<W@*`iH0EBs3
zR38?z$ScRRwl04c;Ea6w!}5R(JjVkjyqIDm(|DrNr<)ZUE6}__m4yFZ$rhRU^=R;{
zN$tFIB!=7Tx)pJ?fw`~iPW`r=k;z7;oLS6wgP9bom^dXqTzePz_H@#x`d2ekrtm?z
z9l4p+v)R?yH`{DGRk^V!wxx05n9SFZG{Q|kx%SyEu$d%VTxP{i<K_JQNQ0-1w!TS@
z%l1)95qOCqXh`fL)@v)pcj7K8bKVSO0+X5elA)a$yAC^;8x_=LjpB>*x+V`WBvkw9
zKgW3b)T{k)UPToSJib7A$Pj+Gg<oE0LlI|%sR?zk$bA@c9;toXz@BqUjfHN#o7jtl
zO#-#1P||{$DcWRf)1B~|bgDa>`fN3`X{#}mNwhtvbkpX{x~H_%DsvF%#mC1gEgOCq
znek^vOfLBKNsLiC`yi|*Cd7>?mS{{ZH+kWG-niomzdgkX4bZ^XRSDu4!c=Dr9nZW>
zEQQ_FX7A--ni;9JUA{PjkM2qyLumwJl=8;TTC%J4H9OEyTulBF;<P#S-fZByZ1$N9
z>1t+A7jvpyV^)@Km{*NmUu$XybBxfRyr7!Gr(>Z34Of{%J0Uv>3)Kxxy>;2wVbuFM
zOsmR_{%R{t8iAVDWHKJb(Ux<rv(XhRy^b%RDq<k!t~K@BgXzc-i*Wm%QUk9y6T&e+
zHtj>*t72)S&(_l}xE|BSoqPps$xLX!K-BqR%Kg=&IBfQ4*D0mznM&736W2|2g`bqz
z>(d6m{3<)J)OLN#<SCtPhNMr%o7nANvPZTzVx_yT+)F(4D-%8RexLb6CYh0m6%qBi
z!|G;`U%JQbYfXjd4nk$&x2;I+^~KistkFLHy2`vYw^a6p?G5UMjw#L-){gyYGGnL2
zMFqwB#IXMD`5(tpXWOb=k=Y}H>JawFM*wWfq{hnV=aBSzl%W?o$tvxbQ&kq>(glpd
zBqfuqD*s%zXZ0{5mU^xx@k7uW@t5BaDl!#l<#O~7$x%du+f0ecE8ujFwZe}a*U>%p
z{FtO4D>^y-2u9~Vyf|2RVSByl3%Z(UD0IZfDw@smjd?cZ>6!fb#xdtg-)3~>1&{7|
z=1O!=fcGLlQ&*L-hV1Tf#bj%!KD^*S`sWLp<{sa9J&1mE(k-uzs-leb?0**-zdk4V
zLdwA~LSMjoSusw-L~RulB}HSk#r3$vS;_=s7ZJ)0ZVgH<&Co>~H@)hZP-D}ZN;OX7
zeD215FA}cO!3b~6QU8|#$JtPv4-BVM^i4Qd*Vu~CHr;;kZ~mL0PbB5K5mhho<vp+T
znl>fc54X!&)z*UsnLru0SrgrL*R@zUTCwp*1k15UKKPSWM3Tv*nXl@Cpa)=@hXZEr
zH1GF%*LAO5ImgWIm3hnutn=wLHPcF<#@u-j8RShv&a(zH*e=Ge-}o*bkX%8Mt<_@R
zT%gGX@!<j`j+Q!(q`CMIHyj^ca_vd;QWkUIK`Us@uB!PqKD@dwj>$gEXNT<e_CmO*
z9i)x%C;I3ZHFa7HmQwev>;cbA_mB-!$H=j3KmM`sAd|G0?nh+|vj94Y!_Lk!K}*b+
z%GJE*$@Qjf_Avh1j!L5x<uA$6se~V{j&ya78qmT$9BBBPm?g^&i^{IAty2V=-?r0s
zWDd|B%b+W$n5k^(dL}pn-UEFO*;{<sRymtdl_y>K8{ZchmVpF@$B-3v#@Gd*z`Bgw
zgP&%32VpPTd@I8s!t9Sj<})(7q_pX!&x&;)>ZXUAr;fc^_U%AKo}{f#q8aTM-YzrF
z0S<Jo$g&yko;{h4OY#M<!2X!aEz0>3;Phz<=F1!h^+ivvT6lr^p&{RQ>*l_=nW0F!
z80jIV?&*03NzD}=gC7mn7lYjlzGp}T28n-@h-IuGMZuJ3L`}B)_zfmr&732&pHp6M
zfCY~>3~#$&FQ#lSOb?yc>lQ$=rCKmy;+0(1vAt?X3~c}vXOHl2e#Y|QTL<)!?O=&F
z-oxYC`lqU+7f)WHn^y;fVqkHupS*o*%P@VFsa=uo@G}kN*Y`dI;-<OK#XAWxvLgF2
zKxGY(*RZaj&Vqykrc?VFxOO6tq=f2@`!y}ulTK#p=-UJ^aC5;={<Q|bq4e1MmNbXd
zn+;u(6=B60FZ!fx)udBmC0E`z6PisPY9RnRm(yVMnkMyA#haAL;<q_7Jq~&ARv{qb
zvp|YU{)pqjfVhdKC{z_Z>}!Xtnv^X4V&K<$s07)0&2>t<89h)lIm;dc*yg8B&$bO>
z;1>MfxYw^7ed-GI-%&6~axKGaxM-9ldEH~P*GlWqk9n}{5?Y+SF5D*CMR+MrQaY8b
z>cQvT?R_lW#~8D<#E3W%U$~DqJMw1>%0P{r8=LQ+&_MwS8!wZz&Lub02?&pnf3|+R
zOKJH+Z-#R4NM+ptni9A^qzRkEN`J@(m1la-3LNg6Y@gAu4yLh$!5J-F-^_gNcZB|z
z>0iA^!SAW%@r<P7xQHJB5Lc_sY^0CK=Xxhg+0vK3tsOs4DTqx;G&!gKr{itoweIA9
zumFC$-};v=<^Jh@)79GQaNrfyQB?rlPI;;pA;1a#`2|X9PAAt-P1|X0f=fI`s54o`
zthup8uh}`LLTd*I>F@s%Ad$J+dVarl&TIW4IL1<ecu#i!Ljz0P;R-1(jj$#4s8qg#
z`{`Gma|B{~GRL$nj34Q&aLv|x|4p9&RZ&^F{ftws-VD<WTa485&0Fj7!go;9?3udf
z5D&4X3a(3z-596or2f5ja{yD41fEWj$P_M!T}i%V8b=$Rr{-rq_ne>ebGDF#unA`Q
zV3$ERuPO_cBVKkr1M=58ZMk?Y_W}J)`nA}CQDqOxc~55U4^+O=LSEAWDBnH^Mic6V
ztVmCocPmc9@37siIx?IXMsUC?GwvaOuv5HSLw+C?(4XecjE($0o!Y}f;}y{Y>0s|z
z+QpSyAW3T|K2|u-H?CJ=gT8-9Rl>|#TDsP%CQOTV<-Iuz{PxQI8%`yE4l~r${<^<e
zALgN<P*QUy1Fvg2nSg&Ah`WUyw8$`>-*5F_Ihn*Icz0;Ww}!lpXFqTyD=D5nPg6FM
zi@mFEDPMM#k*ob^1E44lG}%dpR?8wXOao&ZC<d5)4_bM*sH_?{?RurdYmT52SX^}t
zLvr>t{)U5{=Ij?;^oc<2X9Wcs3-;o7FBMg$R`H47KbbU<8?)+77tBTZ`)FYfr3V|=
z)cemz%1uvYUVleW8tyN;z#806j}LiDv%HA#)mIy%dLV*sdxfR5&JFzJ<SHxo;JyWw
z&hvg9Pc}yhO!~^2{p2DPt(=kuWXzgfgEo5ONSiBuym+*ub~%|4+exrFMOiEpb7eR_
zvn8xtXo2v7(p$`|ztd3J?50Fa?aerd6~*z)0P6mZU+2`%e!&~f+-<JcK!+ij{rfE!
zS_?*z2h!s&M_1SF>F`L1*>@52$S}kV#1Flqu@0d1vhZFN!Um@%+mP#pmmo~_wI>f^
zZ@G|FK5OmxJo!S7&K3KDXq}B8V4>a7EJ!47#>ypko!L`RCTk}jT;CZ4cyC~p^_T8D
zWad+x+Z*WqMg2hXiP?8YSZs>J#PsO?x=&hGjHd(MJ2~@$EB|N=Z9L$fQ599zyz@Z<
zEwFANNBNQ@`C;?*N&f(ND6Y)dyxl<nHu45N%G<?R(Rz9o3l>NWXs$Tu;bK{@3QLVd
zJtJ{>GP!r|Lg$3;8Ga!n*UbMHOZu~$zqL&mWtd2B?Xh-dj)I#*N`KOz(bo6l0`OD7
z_c9`-E84}$0&z=1qk7<8t0V88`5?iyiEr}Xa8LyBriBpdWdc1A%cUYb2aoMm??23;
z;s0h1<vvRbUZhp^u1HnTC6pjP`gQdzEJ5qScp*1i;2kTmC5iM`3fC#q&Qd|SnIZ5L
zMgCTJ;$q;1(@i>=2c$A5cRxsUccO@Ba*rMlH5{a2KWbu<eWTeVDtTNMJOWqmNAe|I
zBW<;hGL54Y*MD*pcf3E!FGU#ake4a953;0qtY-d79}qxfA!4DO(K_AFQbuCxBU}dd
zsg&9Kh4CNIGg7<EiL8m`*X49%d7E#CHaxQ7qF*7DMxUxm(@%?P;9rF93QUTr54yGF
z?=$%_KK`7ULSyQx+X)6_gj!Fmp}b;6RoPwYfe$6s-p_-=cxk2YQ+}Oh?Jhkm$j{_w
z;b8^$vWyO@%i#uD=)80eZG!DG11-HC^WJA}nwbhPq?blh^hpC}1cs-No+@QYgHWka
z^C{-Ju^-y8;tr5BuQ@>+^8FP>S*|xq&-aL29q`B3z%>&KNA=k!TT$aeYYD1h^S*Tf
zRSKdmRGl~wb{S22Z(26y9u^=h>U;IwQU@WQn1oz3?bp7;u=uZE;Z#CZqo^J$+@`ke
zU=(~!_T~M1qZg0E)ySv_dnDI+38<bbJXWF*yn6o&!CD5}hkM^s6cYOlU<*aL-p*&v
z`wH@xvnMj{!t<s~YnfRK>2*a#>W=bKr{~m(8a!4HoxcSM{^2-MOn8%`IF&V{{6?OD
z%ga8zbq7DSYCW?Gr+b#~h*Rsw?eOo9Dt?AsWv9xaPM~@#LU#w-`fUDghU?n2>yx`h
zMl&auY5OMngP*&3Q@aAR#*oB>2ZTU47Q@ec*G&Ixy~amY3Fwm3I}?R9vUg*YHwh`I
z#fk6c$u?DcO;SYMaVgy@)xGQ)II={D@xF5nevcIYaLwBy;I!WU2QpHVzub*?x=PJ9
z)geGmsurA$5DSR#&hQtjI3u6D@_9s~?cVuv=abBe>*7@Afy`AQAO8rsXWL(nN>lBW
z9V@w3qzGCT|4GAH`h&VHZjqXIJ|KKS`)y~&LQ~AGv9A4(i(VK;{R_joXCM84zG5=a
zz}=uf-rzF4Zw!8I(&mQq^MqIyiC1n9Mc2$#jR`SX(!x45DtD`f230@qEKFC8>5&$>
z92h&bo%dfaYldok#t^thf}Joy@`CRNuh0X8pJJnynT7?)r%-c`ofylVt><5UPK9{i
zj`TEfz<%d>C#To<&OD{#{Q<m2`SW`Pg?slXD2Ry(2?+?U1kK01N5x`=Z|!$?(b-9;
zu7GfHK3$5oIY%gE#wRk24_z5oBiCvwRh6MvSr@j}S(J(vdn^1jC)@PJQHjXV@JNFt
z0u0eL$1j~PB*pvamN`K}DW6_QY_2M4K*~2?(OZNFBkxa0ti+EGX&R@F+1bn}su;ln
zI_$IVT?wkDd{41E+R|ctf7`_bP9(w3!!iPzvYc=4l440TBtt;F3<$pwPB%Tb-G0vF
zoxU}d=k~VxWog?uDtBUItax65kH}bBKG%>qZKzGO$Uq7lLP6PD9!K{y)}>%IKfkfH
z{-s0b(yay{iJGK~+)=+vTzckC^TG(n2Jb}|hS~(}gVT|ZL7`H_7tIE3o)*?pn(JIj
zvJ~F^K?;Q;!VJO|C$^48UG^1DP`zCq&K$8+0=)Uqqkig`u{yUY6EdopTU};g8`q4K
zY7c2e+Iit(SfW9Zl-!QyJ#TxMK>d?<flp+M4CLowTI<ulybH&_Z+Dyb^>Mz<?bCm!
zo<IGP#IYx%yXQ?R(N{!5f5G9!r9|fGv%a9HSFNDbL~id~tv5UC#4_)si#mK~T&Na1
z=Mr5`^h%5-H8Bduh>@j7vJXuS#J;k~W~UFO+B75k_WG;V1J+HwR<pH)(COzE12G(+
zhd=LoXYfDnlKo@#<;#26cP{Uhc=WTO4+JxG8=mvc8*g8aeG#-YoAucF!a*aV`RH_e
zq`)66&c9M5%|*aTYMz3?@^JNee|;76<lKg%!PhKm*>LGeX_}sxldnP7`OHbWl;s4m
zy2*G(X^v!q8K+Y0L(WhZqp=UFL%1n2!7xvkTk|1fgs|neiQN$&w=f#0ua4Gi2|*gT
z;ky`#A!ZAZtoCJ+Fo`8D*n#VAai@^j_v*t~JsuD916BW(o_xu+rgJ(wX_lHmshnzo
z^GBZuKixEI-EllKrka<D4yQ?{Jvwq5*ry;AAL@d%j1w@jw6!XPtxci^Aulgez45Q+
zmu}&Iex5xK>oSd0mD=Z}&K(x}3=J2A&wpR)N^gzks1i5_Tp6F`oexd&G#j)VPZ?J^
z;{yV4kb`TLu&~lCG=IBkNba((-_|P0Nbcl4@o7s`^Q8B}_zTWOakwl^B>DP(omHO{
zV$PLI#_N0WG&o_^%L?+)Om;VdM-&CEhEwz|tHoel>^hlbU#dr+)txITadjQ8PDn~l
z7GDYKwV6Yz(3IA3?bHnlF*k{MjHo&=X9p>NRPOD4y$oTRM*R#wsEF>=x^t3w{_Im9
zL2=)`<Jv7w=W|S7$!oo?E}^~<BOF5#?PHIxCMIen!ATyE%ez+;8y1&_V|Y6(Nl4|2
zOB=Vk5FMzq4j|e#I+w3c-ROSg!If7=CAzFc?hg$C?QHV{-C7QMyFO#@YXW<_Vc(P+
z{4K&o2<Ql|kQ&{zpuWSa-@qlN@Fw@^U6x+MR|sXg0K8&mbE5l{g)%$uaCCAiZ@-%Z
z@mx?lT#9!fe!v6e>x)z3U^2pwd|T&}+N5(F1}H}6dvC`DaVF)=x!OT&XCZnb6XiSx
zys^e0E<Rp1p-ekr#mh)%1IvQC_#d|8q0nDzGcjs<Z*Evic9?6euEg6^&dJ19#-AWO
zX3~q93|Ef^Q_`;{m$G;s3j&rT2o<L!AIrCo-pstc50_;EkKav#r&4xrc^+9l%}j#5
z>=ErY;3OWQ46AZ<`JR*9AKFc{--6)fg9cjWvFZ4(trrv#ESU4MRZ)p)hWy|yV)&r+
z(VL?zhUk{3`=hxfc7OA4zTYfV6vYO4!AMUOyGhw2l8>Yj)`xSWRo60K?%j_^q7Zqq
z@1RxPPK9!xf08WwF1`9gTy`{Hlk?$YuM^+pwiSw+hoQHROAZ&|P9gCf`z@EY&2r@(
zZLP-pKTBoLIb7yj0j*wtLiFxuG-M-(yw%glm0(j^S$vH_%I!nd4`%<NUp|>82Qm%d
zs@I$`wU)Br=0-jtQri_&g-N!4fcT3iDdE>ah>H*Y#3~LL30xSfUx3BRfSArIDA$>`
zyGp5iAx{?T^%@za5VK+jsyI!3DWqi@`#eTK9l|@JCq9mN%B8<~US1cjF{(KZHF644
zIu0U&V^4)7+j5eB&!r(2f;2g}PoG*S1CN2bYfmwbj>b+4{Hr1VQIuiQ``p7S?ZMvF
ziS?eY{HF1%Z+VG&-hO~0`ufawKUA|o`wbHik#Y||&zEhu@LW(X3Da5#*<bE&TMv`E
zGr8XK-HnM_JhP``W&GE6_2)eMY(?nSD{tEgZYw(cNn96>y@Snntw<!dcoN`cc$p(P
zjfOh#YS_{%UoY)>Z}>G(W|G+M@ZD-3F@vtv5@juXYQWeuZB@nW$GySh2a~<1?MkoI
z*4!8TybvUt%L02w+%qB);+)VwCZ4_hG2XII;V@pE#YV$QS;S3Z!?LzBHP~hS@B@2M
z+Py$qnT8()3b+G{!9)ASSKhx4Dk`I6&34hC4#fHaT2i|!l1Z!_GW&wba(PLSOn1eu
z$v8gnJ5?qw-c0Bw)2~s=$k_h0^*O57108Or-QP2a`zp2Nt3qyWP4em1<_ZYJt8MAG
zi-q*@nHgqRWCXCx-|XAFT1P4BS=C@&DtY}D%esm{@{y%xXeTWpD*-Dl2W?oF=v95M
z&+q!UV!0lw|Fk?R@Kw)@RVmh;-r0OHzr&@LVTlUQWn8_EwBrKpjDFgBBS;(`E&8Uc
z)QQQ6@J0Wx^HMDWkL@X;rf(UrSr4dYAE#%IehYlW`<Kc(EUnE!I^Aqp>VEzQhM=F9
zO<V)Xg)I5AkoY?{=x&4`tvRZj2<=l0F~;|rkgeu`c&U9`jS~-y3iSO9gT)-4vpJs-
zqs2v4<%2|evjsNjwnFc&JWO4}PcL`|&KwxeYR_lAdv-8NdYUW5+io|Ivev!9M^|(`
zK1p>hha}shs$3^Ep0xzRZ?+ny(A_mh%x)2@Rg&|fN?(n)ZtTn^J4SOhL~}{!#1XE9
zO%?i@ptd7>I9gH35^$!VTq~y6&%hlw0Qa3Ex|<<0S<6S?C^&VvTe|+SX5GL%ptKL=
zjhW7k@%FqHBJDqvSkchp9CO{m2LL+1@dtYZw4S}ET#+x@fqSXI*0zM}mI0b#4l{;n
zq9lrIxaSXe8pBvLfm~6*PuL!b+K-EU9$fCe{lv39D5jpFNPjy;LKiGvT4Xpqw8cry
zx`4XHe1~}Glcuqx{I;QhK!&^lvrgrL^=l}<n?aMa+kS_#36r4$`Oc`G{>D_gno98T
znw*9Y^q#7+X3E3#YVb0Y)_iREj8_lrg{$U@riRm)h+-R1<m;R^uuIF<`OyHoCU0jX
z+*mBh>d-n`>&xk{Ma#vq%9_-pomBF^Q>WQn<wc9qf!P}9NGQv%TK0q&Y}e~aI-W&r
zZZr`|CZQWCnM>8qHG{k17$y^461mx?GrEUNO(#hgU9s_MbrT-WJk0)n7EkUj%%;_u
zrBl!VXUV^8f|82&+P}chyB>&>;EB0N)=6Bp&Xr}U$+;X>dEg~EXd;_<8q<{kE!|*O
zt<e?kV41Ka&4mYxZ?L7~O3cT+WoC_!?6?96C~s?B4{^Lv`H9M9^QCpt)UD69zQ-fT
zDv`FFxS?LbfSK1sAws^t5clM4duf|EnOFz8Lc;5U-Bj6Ra^HS@cx^F2V4EYa@C?Rg
ztiLzXQoVt%(%3P63+e54TDz|l@!e+N)10k#w?Qk&H&q@S_+$>u`a{T;*n;?@ZX}eI
zsqr}JnP<`W*b#YZXDInQvH1#{UnJqI2eD87aC}t!N49=JQ&XIw)gf*e{BXgf6Rof}
z^HphP{I%*#5&qr$?X73Z-wolf{E=~ozGt7&#@^kD1G5|<!U$Iz9O&@kT5e9e^nT9?
z48L>ms$MqsrO$?g(Lz%uBYHX%zkfcQMd!cEC+=c`uag^kc5x?O$5^}v%QuUsyv%nR
zZqNN7R~D*Y8sC#%+kgWFEC;NX)1TyQ6&va7UAVY^99n5c+srk}=Xl{{a|cmfJ<=b^
z6O+qYYt{GrL;`G2ZtQX7)^Z0*`r!8-1g7=R*DE!G4^zhk63u&ohcuM`1Ev)uoBO1-
zS;%`d+0;)?U<1})MS3@x0dK;EJeIG|sD_|yhGS%e0)_~59F9JjEW4bHFLJ>W=dD8f
zXRAebFP1OolP=0W3&iq{fQ|QO%N-zD;s{6JG$Td4Gl-9K^{@8Yo$)BVCH1eN(=ABQ
zmGSP?lPs53jltdV?dB(Ydnwb=W>3}_ud5|KU?rvD$0}BhPXy<tQ&eT3^GVwv!WMXX
zxlxZLVe!q!j6`TY0bi9miBeUB20c+5T}*<A^smRf<Tlw>Hm@WPz9q&o6ZwT@n&uh4
z+z}wLuKXZrd^J3uih5LZ<*uotMB@bQv5I1`;KU!jRaco-N@V)9nM+Fo`}$HPM$fj-
zem+kEE-m=$1QemRB@v!{3<FPlUVr|P#`F0nK1MDm_t;$XdN5(K*IIgF^zDnYtwgr>
z{M<&b%uF$E1aul#K8r4Ah?2cM_uM+;$u)-l)IpXjBJb6_EA<`;Z<JgXa2un6V%ZLO
z((Rg@dCzATaWd*o)8FxQJLj|8n&U1*W@lBi5;sRqBZ|r(^h&WF&T6&&0V78K`MnTR
znH+Hfx`?v*`z*~ZeM6b9%tEw1r8s-cH0*NqFlnJ;yk&IQgVekf?=%eN%a|2DyDU2O
z9#qll<F4xR690r0F@Fg=J}r5JZsJou+26Xf3LqG4XxO*EFlAlV{>z2&{SSV&&lap1
zWcY4yIo$jk-unnDSt1{EtD`_bB#Ys(O0bdGa+(OSVMw}2<&<-pjN#h1E>S6wL51UO
z#jX_h77t9|rI&8bi<pY##Mm4?7!JzBe(wOP^oNk3io!i{;??T?{;ZQQ4Mu<Oyu$Kk
z#WqPtM$Q0qO{24~hJL0;<Lw8}pC_;J+^auMsgrzm`x>?qzQ5l_)Mte4hSlujbg;)%
zhXWN{J!e~M7QK}=O(jqS%^8}n0^Er!y*S)PBiEthE6L!WZT{PcLzf@zvegG%|8^k;
z7O~e5%Gc&3NsOr2LYOpKTaMVv;1a%$VJu_QYfv@6=VWDWCO9(w^^0qAoQR4Az1`{~
zhYdQCeo@yP_v^P;x+9y2ct(jW+q|+@S+jy24_`It$0RK`#VA08fRQMd!_Rg|1fh(0
znnq>vEQjRfbJBla#s9T@V*4nF`Ppzb<h&x{e||G;DCId(L)7bOCPuaishwtLc*ViD
zcUcuSzS7ZV;mV;hImRi%p-DD&h}V+tUlirY&Y$-RRi=t~bUQv_^wSqZZG0xGaFgu%
zc(e8SmplE_^a@{zH}&sXjD#PNkLJGZRao3wPV;bvZ?Q)E@U*W;W~(#l+d6Me?mYfo
zBKX($`bWj!zy0}&7@LV*-&-?ZezmM48D%HxJTVV?qF{B;<V6lEXUH&Hv`-tO;R==A
z#|w15ScObTcs{QJa^_e9A$Q;Ca&<8YBkKQO%M$<XLx3^(`7Qz67-xJwWR2wk70xTS
zX}asSDs<n^=n458S58@_PpjV=7T08pjLb?>H0uxumKqk!%XI6%Mu^sccx<hd`$UdD
zu(Q!fOKMNOI&XhTe~10A@BQEFBLDgV){%c?uo1X~3l_UZ!xhtlc%|N@dQpfukJY~%
zOhg=IY`oxfT@|g6$$3G9RuPviGS4;%ESeN(KkjisKM?1CiUFE?k8kgO`J+R~J@3l1
z2MM7Pjv;1^H^R?6yW68vTA`)G{PM10=H8{-<mtVgKW>7r{;$uxn(}<|0P3eKhrh8%
z3fVd;BVl~^MBz@ui;$ae-fRSmT;E&5@=f|_b-McZ3dI_w4mWR!j6fuKf~9~5!4||C
zS5>rlXj3R(EBGau;{WO)#3~5kggNlvJB{c$@OoIgMl6q0kaqN8S@i(P(;|Tf438cA
zEA`+5=i<s{SG!7k+C>{PxQ7nEI9e1bX0L3TT$~`D5maDU{Y!XPO0<fITC7j98UAlR
zd6h881FekU#jD{)XX2yq$J@%W<*tQuW#C;Ez5AN|4{5GX3&jTow@GM#m`Y284paG&
zbR=)lD#}o}F8^i-D=7Qq!bxGM%sdz+mRBraAN5Bbu!#Tb_5RJ6=BIcRC<Odo8=M}N
z%QMdyrj2paG@G$$E;WO*tCi108(kTG)WAC+aPvL{PDiPcR;G+3MzZD&iJ~cpSL_1<
zeYI5ah7BPlm-<;{`^O*ph=chu{`VIvLeWi$|Bn2MH#mSMrt{%bU%)o$@Hf`qG#6!x
zzOf79{{oI0$P*HBH@sdNzOL}S<KaCGvtp1YR)pC2(Dl=~==-p2#;v89EiR2fvQoY%
zGNSkdjFn{D;{W!0e@`z_f`(-lJPfUkFmNDZETROWYE7G(w219*(nWRGq$`95KU%k!
z`lu6*<k(@M_dpl3CO?yz<P@3d{Xzx{R9Q7GSll9BfB$1K=7$;jNIfo?JW2Lc1vG!-
z&W!T2Xz0U>J!6SJF(z=E>PTULIGv!aPO{(dQ<z+-F4Hi`_i!~XfOMZGT1&b)G!1#-
zc|m98RL*K`r^Y)p=mRT}u5t4k2kKIi>&>L@$=r%f9g^$nkgTh^YXf`JnO+zpZoxVH
z`>Vj|_f*?RjO3W^*b8EPqT&9bX47`Ew9OAZma1EEm~98kD8?9kGdn$5A4nINJsaxP
zIAJz!%yjVgiZ^W;zKH$k-O8fhx@jcAwQgLvz^_+0IVePGI7(jC#04)0!o%+A8W|zg
zlaux22VU0GP%_CkvwJ&8aAXN1!re5u1fA?!JA8_WqP9fr*WgFlv65Pq4D!6@jdpO-
zJ;8@PGZ9)|KIh1t=DM*<F)k$9#@t_#qu@nRP-H|>9NN44*g@I36Gnue5r{pvhB;10
zBg1VDW|Ps9=Tgg3e_gDWz*mEq1o2g;Lr_%0yA-?!E<ub7VJ<978>VkwFDXRrGSNy=
z(}UCHT6nljFDM%s+qqYLko)#Md#2-Y3FDT?hZIMigsP+>h-(EXkS@>e#8@JW+k}u1
z$4{swgMQhNZNwn?ZR15HYDj*rYa_!h>oXBobV4)(-XmmMu!~v1e^1q0lh0ekh0O(q
zPSb#jN!IAFU$aE^G^nqZ=6NC`hveh@x#ZYGSzd@dCe0j@LqDIXw%=GG-D{~6aU3?|
zZ(h}zZgxnhb<LiW$1xjWM?Qprrmy*(u&~-e{e!BV&CKO4j<X3*xYnC_9Vd#DIZuju
zlKG5R9BQ^jT{}h(ezur0`lXAx#P815NoVMTsx<QEz-7&6gXt)lX;Vhm)fa7DfzH<Z
zEu=khN|Cw!H@u8wn@%(R`?ATk<Lt6P{YgKCOLekiOguG}rfZ$jcdGVVEBERaSC@&n
zda=Gk9ov%UpA~b_rc57Ot3<Ct{rBnatJ4TXY_G1~&$LV9pYY$UfoNo+iVxZikCGj!
zvRIr5s-$kEy}>v1i&iKE5mfFJ30QwS{W>InDN$lOdN+_zC=g_t1yrh4v!(P_&{bRJ
zc^-~6uiX6S;X>$EK_Pcc@LeW(;TP|WGoL+S`O4xv-E4H1FNKF(_MLg&Mem+$3{4?T
zQ})7&UE=4U_C3$b4&W_RX?Lf@1tVTe%f{AQMnqmEe;ALP(rxH<a&tU+RT=F4{9+%7
zwmj_*rB-Wd#*XV;o?@H{f=?egYk=)5x6dfv=`sgC*`t$FSnzRDebRcBOh#o7Dy8mR
z<`-OSewLmys!e?(jL@epVw+uKl8o;@_x*x{4EZyMNiq5MaIVaUiu(=Pa+oF4&8fTs
z^-8R9?OU(q#mO>=0i>0eT!VglM$5W0y-;O1JEG_PLgs2dbfU3>tq9eAClL;<M3%-&
z-AY$&ZT6k_Igi1S$;g}pqL(j3`Ojn#%%Ag_!7tb3&a9s}I7yuXO~6Yfcr0Dk|Hs%{
z#kKi$>E9Jvpg0tFFJ7RyyF;<y4yCv|1S?kD9a`MAxD|J4aM$1vTmpoD`pmq~JM)`4
zn8O_9liYjXd+lp|uWMoEGXEAB<ZbgCbYCo(ge1laJDQ#F82KN}u(22@6LHzFkas-C
zTtQa(bg&q<NA!V(M;ITj2wh{d-~lbVu}_)!qkuMVslSEbH}_vQvkSAib-&*u>qHYr
z%{CmaQO>Vw>%bl_RY*Pjljn^LnAPcHQ!DkFik<`%XXBO!a~<ohjzRoV3gWK+D2$)q
zy~2`saVLWi^Cuj&Dti6br=I=R$)zY)P}DQcDz6q3B5b;9SixH(yjU2$i)CNzgAQ5w
zyem@Tmjk?NRralU15f{o7m-xdPT|=Rqp4UiuSDMzNPNhb;OCJgvC@C|t#hBk)&~8v
z_rrDqATpn1V^;v&3WD!gcLe#=${*(Pc7!6{&F#-?%kqwP9^Y(x={)2nfxQKO<pLmU
z9LeF~;vCi|Z?}Zp<gY`OpQ`k@D4Fo=@&|-I<V*Ke7}o+xKAK1QmLZ&HN81d0ly@fM
zC<{t0G1h+mv9b2bD<Q_1)^o(Fc(h!>FhOB7X;KnN{q4@zLOq)i>S;O)9rG}N(#|NG
zaI*NrF?Fhyj)4zaLMxYpJNcE)mq$bz?kX)!`j;?Qmf_s4fGe_(;<Zn*x}Qo<hA=+z
zK1J0Rs>i|-j3U&-&B7yvUrUdGXd?@>=DA}q1-C0)3gA)&sKub31c#Q-tLVVkZ|zO$
z5YK350+kfH>gZAAPJ@<V47K0BiA*z4XfJ&cRAHiY8%2Rsn`8^rLhR_$5!dAh38Sce
z$c9OgrXD=pZUuQ&VMrryW;76wl=e@$nlD;H6)Aerg{~Z1cA=Tcs97Jfm$?(KkLFv7
zcCUoi46g0f^UAhnQ@<c<0Vb(OqpWDwv|BQI<A(Ea*L^E#7UV!SzgO$LXGiW_94c@$
zH|FwPm~`$>oGo?!b}(eaSpDAg;P*ri7r_6xQAwoK_Fomsr|n>**{rMSPZ>EHw4{QR
zHJK}mfRwM9`E&O>UGR?81plvnRhhQoZ}uH;6_!(Khks$i!=&H?XTrB?sH~n^A_VLE
zTI_=gJ?0zjNtjEv&;F7>cKlaU>#=mFJhVJuy3y&MN;o{7ALShTXL*JKewr23D)(r#
zRp!+Hc-D~H%6jMbV}X6}&;>}Hb1im)qnPxBn_#_CQkM9J{v)4Wbp|yEgVDJrv&4dG
zJMdu;hO2~Z@%CR$!+%#3j}DYCs*#?N29cg+(_X{kdHe2UJe81iubQP1yIcDv&DsmI
zv(-Y;oq+ALDqcwn>421mFleP=`7|$}2PnLiot78E@SfeG%8wLeMR4%Gr@@FJnqrMn
zI@Yy~unJ3|$tH5L3<z@8_wOSJfx?%%8r4)j<g*Nw$>w6^EoQL{Ns1$8Lad;$O3mlK
zizIMOB6$YOG*^{j{_Z(P?L~XJffk`~NfUgcYUVk{?d*DG5|;JLHfQiVzO&y{PEWnD
z%#41s-qyS7C_AU@iQD$*cf90W_GQ$Rp({e&I%qk*@=k;<>k<iU<lCx>6!?@Ll#bKM
z(n@;6m+}|lXOy^A?aDW-8nOd1M7u-ATNGyWt30|yTpf`=va03`aEivpT(fi^QBx;!
z6H*OW9XcB|a{Rngk{JEGK;VW%`k44khf2zgq!`<~Cl4>X1JgilmIAv^e6YSmivV3U
z<=m(CD?(m1xlT^~<pdUkb<12oi=iQ8XQyEht3cXp)w(2|QYH%yc@~(tivk@k{=89p
zIQ1!R=GSdJNeF1G4#Q=b+&H6-as5-d?3Nli10wqAV5}M5z?I^N1n9X!8zM{0>yL@2
zo*i+ViwesE69MWVT@NYk?O!|fef(&L%K<@Vbc!ywR$lwTC;ZoSKd2o%rH$hzIHN7c
znq@<{hU2nP_9o-;@frV=0fIYS5BNm!1fR3U0BWcxg68$QtDUezY{G@&@{d@rO2b7<
z(1?TqUxYe_SZW75q+1h|pBde+YJ*0<*XD=H*XGAM0e%Bu{j_X}<y9T3(Cgz3q>n?!
zI}Z@8w$9GS%<7$qxomxX<@N1V&FXT&Xb~MDj5<!T02h7;V*R>D!^z<q@<nGUUWdWb
z`oWNKkCETK*GfX_M>iw2vMAK!<^K5YKK6qU+PgT|YN2RgkmT?v+r<3sMx7!A?P;%2
zYEmHE70O^PWLC!(C8Mn-^X1epnZ&?It2TjIy?kN6>}?n3+OUI`?{>ump+j2DQT5J2
z?O-;=HF1;UHpXe7;)KvM)$N2Zw9ogpZL=B_5HOJEyHap)>QU&E`xCjGx8@^E*`HH;
zQ>?@Pv9?=h`Q~(P;``*ySOIDm{-gaJs7}f9_5nQTG+wZMWtHd#Vy(_9@G4SHrwE3+
zCC-*>4QSq<{4`4L+FJ5l8E?|SACNI3c-CIrszx}Uc5xnG&?*M1^B9VJy5#%$6m@Vg
zq{?4qdTs}p6{&nurPmf1sgNnAH5Y+n8LN=9D0-tfn1u8wWf)mX9N9mwo6jr=9DvFm
z3z*HFiXGDmqn&irXtdwez}DkYvp6$@bTiTUcdGdnLDM%b(u$Le)G_bm=*O?FIFzYe
zl!#34O9s)I5-(3Ha{unvI;ntIFJZw{HltmAfw(~4ig&dMCv&xhJJYepflx7h`QgbN
zgQZrBL9H^T02Ee6@QBFiUE&Hz18KJ8vB-Q;s24gqDFXR*V^?NRl#_NH{;9&Rd@S=a
z3Hwj*n>w7-SJYwGE>bneP(#}04>)y@V;8n4d^GkTDdGYpe&@~p)OQN`I^MR<cbhUJ
z^R4aVYJ>PGk7nu8*+w?^!BF>T^75nw!>Vr_3Q<ZmI|c<Q>5$H+Q0%n(otbI(g#IFl
z9Q<7&rfcF=D^<BkuS+m45}L2`T*<1a@C@x}d6yp8wN|$O`$=+t<j#b2(<qaIVUj>b
zliN4u(Ph8D$CHK1T+`e1X==0}?7Vk8?_Wb*Q>bUM2hey{Gd2*D_kgvBsKg8Exf1?-
z4_PQXhe!4|k#Jn)*1#Lp)jYZZ@*@}nuwuHyg}3I=b*)?EE9qMz8Pbw$d?1KT>j2a6
zpk84c&GdgfN94PGjLatUXH``gjZE5kOTRN#KdDaTp7>Zc+CS}8#F_{jerMzQ?mhE9
z9b?U1-vwS16@b2A0lt3sQ%v-{V1!4ibP^P4ae$N7;X(2a2=h(K;pNd(p~_N$A^#If
zb}F7Qq{4T7Y8W}UJ=7O=*L#bwC6I2sXz#~e3^_k7<I!o$bAs<jSIT+{#?*2*hle(z
zHsE@*)lmTi5vm;|{#E2^Lo#RrglkHEWH9hu_xf~-{8VTwrIS9}H^Uctj_AbXnaZ$@
zF?rKj>(Mq<Ozyv5bMwFq8AYbg-U49#NKzKDh!F96`bb)=IAY`!Ej)Tls$=ccBE%`?
zp$<OekfJXK#baCMLg+kTkJ}i8#oHILBEIm$Qg}5wx(jwu&lL2~E`_{q!q2|YzG+uh
zKY+EMXiIrLgNx9|Z|{6+>)YmAX!cN}in9&tUk7e$@+r&752@&%5e&y%d%I@2zoEPD
zEkG?7dh`hBbkSL4+IdZ?k~qvzj5}Xj{$p1U%Ohg*NbF4br#<5#SLbv?vSkq4VS23K
zM)|>=F2C>^9nB6^z;Z$TWZP%yb)nDRC2gTS52PD(2Gb0OV0<G?Bpc=+6@KuiCh?Gn
zAM5@`xpAaT)K|}B*?I!mp&os7;y6j-|4^qkM1n;_HzVRv1~iFck<p(u;P*eGTC+zR
z&|c`nTcfCOa1ld5uYH!yyPIABFW8t=ap8r;JbHjQMXJ)^2#24mEcM#_;QIv6Hp)>;
zJL)L(>xWy3$C#Suuslo}86;6*!L9g0^UxAMsbQ*}1NtxWgH?WoVwEE?KlE>|@ztOg
zOj*_P7pCVZVsTYt8SLXaYIzuZNQ=&wEL`R_x?jY4sAfzgU(*mNRF$H1t2qphqD)gE
zpIwgB?YD*9xWR-CUPAX?(6WuyO>gl^7*ivDFcBxN0Z1rM)7}=B*@V-fSvP<5|4!l?
zPMy4_Miq>4+7G3S31LA{)hH?jFWwEuj_Al67hRx4Y5qbk_}Z2d&GI3+e8$zh7pK0c
zjn}0m0PLbcwDJd}vlBxuG)60yV+MB>-FmEfulAz>$_Ms~{Cvt#!mtQ=#VR)Qf58cp
z;Y9hzG|@D-<0X|GAE;A9sBd>3&V&rj0fxnh0mJ?62>HB^#eqVM@hhfqtD1p?6M_ao
zNe??|fA6DcEs}^nXJ4ee#2Joz0oq*^p%X<*C*Q`_ufN5K<@VCWNvL&9l%P`l5odo8
zA$&ndTSPVj`gl|Ll+*DQP(kQMz=pcd)sWZ(qX+bt+y(q%!hd90Pt%9}-lzx(L0}SD
zuE}4l4()V)6&%<edfZpd5;VENRo>+?KMb2vh9VZ|{Oed`J6Td^p~?lql09*1e+@*3
z%K;`|lMZ0`{*LMNi5u;ae}N>YcWn%I95^ImGVld%zh1x}+UN|HZXG6NmWr0$ORqL0
z&CEK#&YvGEV*|<!zHC4OYCiC)9o9Mb5Crx!B`Ax4{XCDZwPv!rukF)C60x)&nl#7{
z4v;)eBWy16lnFN2mI}lYQ>@cPScKPf+Ouz`YF|WZ)1?yBr(qI`eEFvERu9VbG%_HA
zeKQyF2@v7iMK`zZiMLHZ=?LLG1voxC?vXZ-Sj7s@H7jPU6ztG;R@dq}6q^INXc^N#
zb-Q7tR8`c-&eQXN>v}fauYdZiH^(D@1+zc*u<=xhDte~I3f85O6ayXw%ca=H#z9YS
z?72n`%F@00OT)Ne+lP8f9;w|B)I_$|53aS0D}-HZBy=p9Gfs(Fc*^df+SQJ;*AvB@
zx3P*dKAT=!bqHB;8ryHp-gn6~i?uW?olKafBTIg~S^apPX%2P~@n}5UA3^i~he!^a
zMk07dN<H9}7U~tSpXue5?}&m^iuBtH8CVV`7sT`OB;q9VS<!5>3R>LYL_DxWsedF{
zxKT{Q<OsEh7xHq0Qx#FN><{cl;=0hgWOZKL#4j{(-I3VRX<sM!PqE?_^D2>emVpd0
zs^boAY;Gtai5EpcrCrt&?}$`*eiU5ZB%ypEhKmco1_4U@sfk(Axjvk0i;=lbbt}K=
zv0e8=$@FftWQJErXTcr?TjQEfCEskqWta_hq$7_4BNdXJcASFLzQ4!>nk0{?85+SB
z&f4k`Znm342_$5B0;8<{wAN$e-137!TM7*EqAkriqHDlQO{*f}0<kPfmZh2rZ^sK>
zH<>^389c4y-(`90Dar8ugrGq7n0MZyl2*>O8zlGnjq4ChczL@A2^Z)jVTOwGOUk_-
z;kbRl40+4*aMvV$MvqcNhnXcT_LjjnNZ0-$$X|abx#E#h;+M?B>jFhegNw0mxaO#%
zGk=JMOW^YUni0>6xBk8*Ql|&yE++i9WW<bOBjGcD6nQ>2Yd{s|kwz+~-8}2|%d%I_
zu>xqTFIZSG4rNxex$R(>&{0#wq_7&&beU^Qk~wY!)^#7z@277xCBg!XJ0c@vweY%1
zU=8cemej#=xv;7CmR=KF#3&gB(_J+cgB+v@NO|w{F$5lw_KJc$lH`(KC!HzLK9tf5
z606vO&~RNY$RO4o8^Pe>`|JVB6Fbf7Se|Kaf?wekIf(qWzWqL1C{F^6ioBxc9=5BW
zOlE@)&SNw>Vb0fY`~vGWz)!!qhFY%=Vx8C+C>I^hK3J;8^fNw%;$qPq+)P`#f!-v<
z498uvF&_Xv8GGf#oOP}X6*%Z$ry7}7>4pEUd`;ZL{xVg*2EBP>OU)kDB(KP&ZTECl
zp-|-!gC9shsF-%Xw;j8N!<}!wWzrE77{$=J;V^IX^s;nP+P*oJ_w)`YE7xW%8!o?%
z>Kd@b#k3be7`M4tB?(m0MWgKBk06j&=@SGGtP6<KU*ehTT@kDvCydLtqzbR%tZHX@
zY|>6(ugm%~p+0vvC$leN)`A*5pHU4Jne|;(m7E)tchaX)9c#_LIhHxS_M@ZbP5W*3
zM$|2v#*`NQ+b`tpVB|>)qo>vG>b56)ZCzf(e_TL$FozroYYiZH6Y;OB;yKNk^=aWb
z!w5n{2p~laQeQ;s0%9#W!m~2GB2<gFTNVjl!0}()@?*)Y0A0x@&>bmejB}EGC*`>8
zV;N>5S`M`ciw&Y$X?1qf5M8N0u^A#>JQY3wo~7$!COAWS8gB%yo<<gvpdZ5fuYJ|)
zJ<<gEHrI)GG!${%uQIvW7jdwjD6VPQlj0N3i)tkCgTe~0m>FW^`!mZ+LROesQ68&V
zhv`Wp0(^&x3jmDwqCBO&e!mGVv&(m8-`?i=-T}v)88ykaB6C&6pP(r&3fKAGaT$9I
z!`R8M-OMP4APqJi2^iY?u$yJJbZ%s(%7V>Wd0l;Ht8`EHI2Y|%X*q}YyMmVmF5Llz
z`Wz-Nc7Mwg^1R>s;Pg8E<)1gws`Hr5^5G*Hv*p>dtCV4+r_6M6>w3c)zW3rE?&|E8
z=Mcm_efs=Dr$f50&1cJ!or_wJWv?q#4H_==_~cW!A2`fKG4T7Kb|bwi1C@Yu^X7Ud
zJ3h6_uUN9*b*)!#r&UB+KOzv&;AD>19=xYv0jkut`T!@U>tdB9eG^RLvlA^daOdt0
z1s~c`R#c5rBQiznY9C3N1dw1jNxyC?5f)J~Bh_U4@(wYsncNlwqX_vH;yLk4W}P}h
z$HClggP^ULrE}Vqb>;_-ZnTKmRORQO58&0zi!+=QrAq$GRwZN|bo4(i2K^&d&*qQ6
z2d|rdJXh(TM<00{bPle#*dK94QFNe^+kEDT^aIuTkVP5YEpg|KjVzbJH{g*g>XPpQ
zou50sK)EZZHfU8PbthAgcz_5>h@)D_+OdMwvu>3;0G8+2%wb&9kor=B@-iI8Cj8JB
z?WXAKTQx63?vvGCCH!3pbW*I13tueV*1$Cv6&<X_TsIQAMzz3U7X9%JbfkF!Bp@)o
zV)Lno<!zn8gLhXBUp;{mHyOMAx$yfBaYh&WT$0ryI-!NNElD4Ws+<Xm)6zr{Q$?H6
zO{w-3NgwdX{FUi3VUA|8HU+oEj+;H_$h35XYg2oJW!S#vx&EqhUIq6wDtbGCa%PF0
zF39q7ui^@?WR}|9jwa+JDw>Q8pr%D6zi2hPCJM5!y5+-J^tcDLT++zwBM9`A5~7JW
zj-WSMM%E9F&B(%lf{n(nhf$W<0wqdt?O*Cl03SC;>!1DFXS!E}&nVDGdS9C7PfKDM
z@$b%J3nXxzen=3IR&DYsrFvd%D)SNJANtqCPfj|xU0^WIhbPMsk^p$D_A%+mHWj^)
zpEq==-i33`y{i+Kqt5SF$9!c2CxLiNX5e>A;OqT6+<Z$#9&aS46-)~~p`C4_T4&^9
z1OIP>E^k6aUIuny2f`o449nyf>Vgtce&fv+6A9avPX{tgggYqY4@_FDxB1vr_ee%%
ztW@%by3)v?x;pdoJOs6u;NaP37E?T3TLjl)-J?3iIeiu0kSGzzp$rEr#pC#?Y!5bs
znwEg_8M9)H!tuQH2*=vC$UTiLxr&L2$3UGQD0n%;Y>BncAp;Y2j#B4A#~fpxo>Z>M
z_@xA{*%F2XMdH+DRRgS4y^MJ5Gr7US2TLxWS6bbo6UuA}2I{^T#b~Zi^5N=7R)CNL
z8cDtRo#}O8Zze^UwDjE!RuD_7UzgrgV#g6DCj|%&R$l-gAdqn5dhK40c)1seJZ=ZR
z$PEa>x9yQx{T~rN0#gn!nt#_=CZBRPI6u|LUiTNu+q5|J<(3Mqlh0Mm!LWKsQb}j6
zXOt*rYR#D|=ZcfdS9a;%*C>Ar=oL@87$^%dS<T?F(g)Huo0(^=zkTM<hV^4`1AU$R
zjO}&=KR+3AVg-Gyt;y9zPi65)HfnDh@IHeQJ48RYD&GoC*mdB4V4rt5`zj-EPz-sW
zd0j|-AQ(H#->rVUzm5I9m)==}!tdegD_gT>?KtH*A^OjlkODT$@sI`wDh0Q(Zj6t@
zI{B{%qsj@^4>QNXo~O2-?x9SPILwgglj11+%N!q2i^lH}m*K6DKV>c?UwpSazp|C1
z@TR%;bRf@br|$vI9_)brm8f*iS&(aol$JUb!Ta|L&X(MU`n8WX9?`f=iD9ZHRHJm|
zo)a>7Li}QHu;DuEU>^@6E!M4&;*80`Q@-w1m3AjHrHcKliWpDp8&n?3kRv1<pv{D;
ze^)iD-(sHo!5G{epIhFRcYm1^LEgM~$I=T{DtoujDFj7#NlfUBxmE(XP(4;HIan)S
zyjlIXVEP~JW`CAf0>8jkm$C30$ng1dkN+1{k=qxRnG}DJ?D1-!6ZrBa+WVc%`kd${
zezX6Oef^^EA}^Tr8=H4u=I5AXIih($5f}gbHR5ZGV7{zpR)iYKAWv{`XApLvFGVIq
zj+yyfCJLO2>>a0psSqdWt0;o+6lUD&{)Lb`GeYduMXkfDO=$ygRr?%^*dP==(AD7i
zfq#z}dy5HJA{^wlwd~MNS1I7?VMmF6LDUt=N$wT*gZe@D*8xraY!?;S^kCrSODC&?
zi;K`!+m9R|iz$(qX86om<_;w~X1TBpW<6m}F-s_BA#;9ba}surL)U4ZjyGxxs9DFx
zav0I6X8<^iklUsGAu}_&dR7;;e91dHV{lnhnWuywJhL@iXGvPjsVw0(-6Ao|(rxEP
zL^s=S#8BW+{gOKCno{0)fbN_2jdI4vC2;=waej(lgWGGiiqqeXWl)U%=$960#+Aq|
zDVCFhF;{^rzl-<Bo93b(Fr<01Ev+q<_z35;yWn{Hkj9oJ9Tf#Aju1m+L$+*9{uO!Y
z-0z|HZVVv()H^LT|H-&IOdXQs^0lgO$H~fw9K5kN^T*thipBofc{oIhYNCP<L6F7X
zq^#gigZ$^P^ZWw2$i|7-Upi)W`km`Pd`NU|gIXm;L4L6=dJy93j;*1>KilL<vA_IH
zH?w03E(Lcd{iLf}ci(o?BJ>o+aoKRm>I(W<KJIUVS{`1=D4U%;73pqsgQD>X=?PLP
zfVCrFQW=T^$IU4@gL&gxdH*j#AwaL-&dAuZWelS;vq%f;mUmjC3X$$N7Ou`9mD+a$
z9WRBa^O=|)p`ebUtRggP8j@Hc{#hL^oZKqCQ1k1}V3NF~^E9A)Fg7^k-O15_am6I%
zK>0dg{oa7yANl%u{Gl(@4r%AMfxpx<4~opw9m`JqHe=oG?1TF0JJL2~4@SW-MlNds
z@)?C$l`7;@*P1MPmP6JaS7+xh?dEDH@ui6~TmEr2JjCmimIt9e>x`Sn&ja9s;}X^#
zu3NnZZ#xf2f!WDQ;hyMI$9eRJJU%lMNAs+PVP#;f&Cx)uw*NMaT40k0cN4g{Fma2M
zZLk(c_TNeHvuc^&&GHk^o-p-gBoFIHrgmnN+^9|Atyf}4k+ccjld^({PH^7Pa(aH$
zlNJc>%S5*vmEfD>Ef4d>8zijd^r|Eo`DjW=inH`h7);@gQTzFh81s%8%h>C>bsd=4
z+L|bs@&!{fu5eQ5y7|-`Xe6#sQ+Ft0{_D6HQ0J8_n0E79vPn`vi~-v?n2kB)lHun-
z!|>Dem-4oV_6dH6{eYY*<rFe4wK`1Gt=eMzj4}Z;7X8aPo7L-pP6HC;PrwmW8Tj1N
zCgp*BX<5uTBw|fcpOuKy65aZ$NVu$waVGKIVX{QDukI7k#hh$Z$poB(-VtvIiXQo~
zX=ahRMxDqXhr%qz148Xe9w(YhB4*Nb!7K4Ch$UH4kyc6DO-Ys+CE_v-KqcXx6GGwk
zFs;u|v1=RZjU87NX~=ZzEh}ubeN5*SBN@-tOtYA}n<C*p1j>Ap0N(f1LuMLVW~K~I
z9~cj`KR<EoX{x<a=rDQhQ=04$WllXgGmMke{*}het+(J&eqeL!hry^c@(%u7&zo7(
z)BZOu+p__cE|fp3WPOKE(=+TDD=4x5vh6iLwKY;Y+hrN8a(_>LBG`znhtuWuICVjU
zbMS!=*CES8<J{EwQ4fRb+cm#)xfFJC|0of8<><)4g-9D4?#S=&=H~AjLv8h{{9LQB
zCAHlo+9eiDXou<^LoWA*dach-^w5ef$t0$Bi`Gu$zigsgWOrKrLAzf-I4Sk2y`4Bk
z<Uu>p<5E8Inj+(d5c9f5J(k|as+c2ruME)OFtaUwt|(8iwS!pGP`|x(Ph^>P)e(Y4
z9#m@wUZQ725p&J7&^DLbX*HaQ{8sXPy6eT@5c8X2^@Y!OZ{d7;aZwqrt1bPMnjdE`
z(r?6-CUzn9Mx5ij4#XZl)TJS2cYSpe;!4}o#FTQdYZ+VC;AV1Sc2p4CILPfxk`s6y
z&YqYZ>&~o#Skh&@e2kVw7t=Oqr#qY$c$V|G=d9ewf%jv&aQ?>~0%_)o8^lwqCoK^7
zlesV?0HVOhbL$(>ie*YGG0AEN=jH7(%3vFr4aXEp#B)>Qu!OF#nK$e{aIye-7X1&J
zkX?_>)R_~qm2KHlo}8V@^kfms((uAVu|NgI3}o(njoA-}L+X_+S(;45#h+WHL>B%z
zPQ#Ap2|ZA?R&n^3i;daCwmSfA{`u=za?^qGe==3igb2Rq(_L2E<UCe1{AU>?bZ4nR
zL4DdeR6Ilnxmi(k^#3mlfDp;5Z+Wp<1r**?_vm?nU8MN!<8@{XxRzU|HDnk^%l+k(
z8Css&bB1frduv?B*LZZ%g3>d(g2`Ai{PQIDS06V+`4rb(<zyx=uvF4Gp>uduEYTbn
zmIXSGNgUwv<0p8iqs^7SWMjojA+g<`XUp`3rUlmI_~kLF@9*Ut3*(lZ{}cZfiBB7?
zYS;BSQ2sBpwuMIszWutymt##?`?Y4_(F@{Jz0a(xjZ#PJIY&^Y<A!49iA<w`r$#aR
z$tIbU>%!J9{HyVt`05`TYmYKj7ZCf$gyg12&^u@F5~N@spL{TPehOtG5hTz!EClID
z<pydUCu`xIE=Zg%*T@Z|urSeALZyp*>jh69TMpRRz{7hZ)kS6=Wsew#HHO8ah79?a
zdc&t8#ZQ+nua!0Yb03`-8^_xU+m8?Z6(4-SEdH{5q!C>rmERt9?%nU}mJN_^^}0R-
z{S5V<Q*H`u9XbVjF4JmYleX)(tx&;{qX#aJ?G%Gka`mPYN;i~K+ElxBW`zsfI2Re^
z6t>pJB+j|2#c|J_KNoI-+P7gdY#O2&IZmxn4_E3fx2e~QYt_W$?{jJSbE0O?X=Xje
zp0heFfu-q|5B8opP{A9;CqaAuvlol`E3;}&OEb*Ni5FhaZ?=8-A@mT5!f|43XxC<o
z=(CIWCx^N1lYB1}*=V6giwKAO9-p@L*u5s(WiTwA`0>uKU;MuNKt-;tjflRvV(7Gq
zXVn$(ac4Z0r}N&l^<EJJpTgEOob50R3CE1sO)X@&@Gq+U2EqAK#JTKYAbEbN!A6}n
z?C#%{*fBO7HILiRJI!QEbn&_7ua0XI_yP&#ppWJ|s;D>rlP8tQrJ^Jhbr*sd@<0={
zftdF3+1MG4EdqW1Mupx);EH3DC?<(N>S1T;P8Ed7B!c(7P@TJ--imHU4DOu0uheIX
zbQHvRX;eZWHG%YfUt8+iNf9%d_}shs(QopVzU5Or`%dE~ZkU$WnPgVduUy7o)*$i!
zVj6|kvZ7*R$|AlT;xqTi9o=2rWX7y#x>ch+^7N~l9%amqc9OS;P3zED7N*YniEo+w
zNnd{Sml0-WtY%JIZ!s?Mb;Pn10!W92!4=|B)wU*w*m&j*r=BJwml0Li%Dz#f0S}Lw
zLPLdP50sdLmj_JGgkP>Tw6Usb=nmd+4*-56fu6U4j4IFbPJ&RS^UnQkv@4sY`$KLC
z)<@d%{VMPRP^IPV7x%emgHfg3W$pz=7dJ-+;UXvYccdo_xpJ~`nTNXRL2=((!O4o;
zK{0--v|I4~Vk3Rq4Q%zG9i#NDQ~x<}*uLGu1$2DI(%_a@Z?B>`X+(-qboX<B1qH9&
zKV)Mdq%%eDryU<{a4Aapsp#81yz4l&|4P99?!tMgzgM~w?myP7?y1n{snkZNn9&b$
zhb4a3r~u}o6)KmnGn@|+nPT~}i=Qr;5F+Wl^xY+XsVMa}&f#8x55V2}%_?fOhHHvV
zCXsYek>ntYp?Asr`T@bQ3>wh{z2<=9=spNFSK>YQxv{T1!^pL7qM?<mlp@()RS(+!
zJ8fL8N#1r<x#TH%N6F2|lm53N{wckP`s&+IkBxfK!6tJ5M=`v!NGKc09^T2&cEu;l
z=Zod8x~J!(r`)iMeoJzNa)G0^JsjBofKXxMNX8oZuO<l};v&zJO7A97T|N{)z)AZV
z%SU=U@Y%hVO;<J-ADyt7BB}|sNpw3cYPYq?bnV9jKxuqK%G(e6E@^jt?9hUAG7GFQ
z?W_YF75;O592LWfK9@UIY9tjVy`S=d9_tGBfU1LMA2^8KY}qQ1+WQ1?OK_C=2Oj$@
zh2XyTJk)K`=U<B$;)DJ#T-~4i)pIT@^?#Z&%)ORQyhU5<`evil%tnRG-q!W?r}zwl
z{%j9@?02%P`m-G%((o~>C|QbVYcI0D50(%kZ0Wio%@SK^rID2jCNiA4)4iZ_GEI{-
z`b_a>3r?=i_qlv#_XaRnM%D}N>yS+p=(TtsR8^W}{W-tPGc!?`bb4Y}%guxLnExTa
z|1TeHvF^0abG>;6dV9KhiZd`B9?Sb_F@H&lA4?~H=wm~rTUxN)GU=>TyPyKFn@l%+
z>VX>usdtL);kI>$l)elS%cbaV6Lqi+34)>j!xvgn8K-nwoyY3#J~KV17XX){wI9rW
zMs;D<!ri|^deoLrnH<h(oChg`jITaYe~Z{&8mX6#3w!+5(%3GInfXue?|-Mv{=0qu
zU#~Mb7|#bLuip~c)O@yvO*d=Xqr;M*$2Cwn7x5srInPmJE5L_yef7BbMnGtM$BQqL
ztn+{ruD3$e9w!+bl%DFd4sJWmuni7zRW$7XUSR+KK>`1MahgYp4iq`JB|d+{33>fA
zdZ)s&%&UHwN4BkxO#N-!RI*&^P96}TGJ_q~Pz7)MvHJ9><5>zIJ*4y#MeS{84Ct6y
zy$9<W_UOw5Qn6-3HOG@XSm0Fl_kUIp|5$~8Ke{6wV^QNwZ<22^Jd4~<x*mlYfx}Uv
zZ$g5iUW6t|5x!`qTbt)G;QT3#|0?aZ!9?Fr%Vf2b{)0lMSPnkswUPSAom!4R`GPd%
z&_DH$%6yN=|FmBGFRMw1@;~e@chBSgyT4#}b`n|8o^kO4ssb^DOh+Z6Z!E6@ZOqy4
zkrL^1$@ZO;NTNA0pP*CStqX?~<JIf-^7#gQ`%a&Q697-$7LuqHXaC{p_+P&1-@kZ>
zC=eB86Yf9J-8$V7*;MrS>pvlSKD1w>|B8kd8Jq>qAl~{Ih#>u8$QJ>ps5Ts2|9y-x
z?GyF)O2yZs7kS(BD)&VSL>7A`@Q3<p;s3N`<EUY(qbs=Z<)bn|*QO?tRpHc{#a<So
z9vvB9jc4-Cz32rxwQa;Lu?&$D%%n9*$zoqmNI!8xDPCF_Ub=BG=Ww>R>2~2^{a>j5
zf{@?q!~UoCFx)C!<>X#Z!1kBbae9PLZ`JUmh)l%^gh1i+W1A1q2HsJbg}w_+x}3Tf
zvlsh?Z3BLib<p81rfYRzT)=Om7`O*|2TLG9Q(9L;I}|f|oyi}#*mMR|oh1qT%Nf6i
z6TFIG_0JWChD~D$j4Vrlw)y>Z?At|4Bfh67?DTh&scgB&UC%Gmw^*oDas-_}#|Nwb
z;^PFSuq|;%?veD*tBel2S?hB&F(upo>ioK#XJYhR-8}djgPBS&QA2!b%?E!ZNxx)D
zn8W%}W6@*1CmjTeID1g!hYq{mh-`>1I&?iH($YqkyV{_Y0_v+26hi8Sc)I-l92JDv
z6bR*NSQL-!4Hm0QR|pNS8;pD}g4p^W3N~qU7?f#LpYYJi%>Utk8go|xlFaY$ZTt>S
z=*%r0soyiRIB9RnHgl+Jze;ZR8edKZD?g73#2pKrDahWiN-iHAxnx&Vb}G9cblO+6
zFF@qpr<RaynxAlW91mDcE8N(Y3Zxf&k3E!LCPNv7+5<dKb?>io#~_GZ{Zi<{pRCBE
z8wI}o!>$0M$NIQ-vEJiPw{3KfxOz&xNh#G8cPwH$abqMzh)m3G6Ow*V_doqNH=tla
zk|G6uHz)1(eygN<4!ZG?%`p@3ej!t&%YQt?L>I#pIK(}AL%M7+U8Hm|EJHq&^Z-eA
z=!Ai0mAu;k(FTH8aXL?7Q7J8xLJTTn8K=TinN5cu_KZ9uY*$+~fw~X*Q3NY8!cRNB
zBn=%q7OA6l4aD*$w8>5O%XDwvy^piZ&7f7MSDA87_rN;f+$Zybobc@Y2`e^dY%@u0
z)7J|{-H(rR2Xo<qTZtLv>ZO}nJWs<?xq25{BlQ}bLq3%n8NgLzfPJ+`*i4CUL*!m>
ztK22G^CoTTaOk?fhtusEr#5^<!K^ma&_^!&?Rdco?)(tct!o%4Pc#WU#!83lzAU+$
z;xylLBggJ~pR#~ZohrNasyn(I*R?nJ3W);Ca&X<Xf7{u|sb6zmp^%ZQ(BwpKTk8Fi
zCArtvT@tI$<#q6^_6$$ouI_yE?#I2Izy9*=1Ovs)^Qb5Skc^?fTf}><R~@-)GX3Rj
zN=1h`i>IxF<<)Jf)^qkW{;=~f63@?Ae(2Rhs}j%=NLRIoo5T{2&7#;u+nH(fg8{&=
zP5&>xcU1mCbcNjI_`Gf}hx?Jv&Ur-k+2Ch2o6$`&oEZP!e!i5D<R$x~lacFiNOK9l
z$!dMga^25j)uC&+7ehG-E{G0uKmrj-kJm!ly)K9Ua@_rFEK@Kp${fTVhsPZm3*+@F
zHHC-MbNa0JD%(_$94|1Ofr%4)YNhSd`+Y6u7rNZ!;Ns_de_>IleZ41mDcO#ZX<t@v
z^ww;6i5wWWmy^w+vfpM5AzXNZW7=xP1JUqFX`@>$+;)G~q6Ij~fWNOx;dp#9ysa@B
zb0T1VeW>}Dsep6Jr>SrT^t)vt#?Fln$f0x_EOklhelE_*y5xS$keXacVW;~kPDLap
z+JXmAMF&^Li=G^UKen7L<f~t&;Z2SRRq5304klPH-7KU@nVxtnAvk;7ZLF#3j@r(4
z`Uqm+$9Z3kSCQ(D2sm`m6}mFp&iqQ=nLelGMi*wijqVV@u}2Q^4D3Z0QG=_g%rbZ^
zyRh0j``IRF=Z)quV4$I@>l|;Mo>J8xjzpz%U7Dne@Z79TYegP4&ooFxHh22RCt4ot
zDYz;5aoJbr9>9Lvz>^XT8Y`AES9wq1_loTf9P$)66&-)XsDGS5kxrh&r8U^Ahy9Vt
zX#}3}-9e4`mr=Wllxt@F{Nu-%ueF#sNnmlVuj0TOr{rH!{*$eD>ZdYwsr3h=ZSSi>
zm&q<!{zfaJSOs@6k=##q?nN|EVF*gs{7?jaE~CdM8)}*NLh{_O`>@O(U?HF*h<CC1
zd{XgVLh`>CEx(_cUpdAgwbQ0Fo<)cIA!S~(IK_|+^WuaKiRN;G9g9e+_$rtuz70E=
zddcRaU&Pyc1G=PJob%jp9H2W*zDdNXA1D>y+9WYxhhaKIZ`tmYgKIxcH@*AANxIdH
zwN-)Ig;rEN%$i-FY$;h+2%biH-M#dsb^r4`nTa~z52OnZ$|*PtEpvCV>Gf|G8rTjW
zKEZ|zA4AnL`6K?~amA8^P|=i_R{8F(z2gw=R9{ZSx$TOG#;r_CkwOal-FJjT9(ziu
zSbp8NSEtPDABICoG>-|arhkT!RP9LnN3Umt)~K7GoGDw3yq$o8Wt*fd$?Z%Px6b(w
zKZN0|HmLH}*s5xWqfaCMOC>l?0zDbpq~%TyU6B~He=?sQi00UiN8AFNyPZ#~*pS{&
z7d~a{l!EzBRz23<Bl$3=Q69y+OmuvfDIs-+1Ms|{?B<RnUw-hfX;LdGPmht)=0Of{
zRgzxWT!ONE4)gP_4G;UD&vNzd***$QF)Riy%N_^RM!@sZnPxDNj6Ipl3NlD8cMwCw
z7ZMI1E245!B|0F=sOH~AM!Ey%0X%T9r@si(H)*x7!cKQ4jYPdM2!7(wkjq8VHGuJH
zrG|Z=gq8}$WKXnR%D#g6eX8y~1w$oRuNx}bEH)qcUJZw7Xi=R6->%1Ftoi6Itt?Xf
zBsfgJI7?hin7|xUtTW#9uP_Bv^>C>H&QIqKSpABpsS_$thm^vH+LqjsedSFbATM`z
z-{2=Fz?~#XQxi;8tzz7^;Y!WgJ>0Y_4y{GMdJoU2zsn!55>v%0b{HAz-?f*XfbLZ~
zno!s}XRZs^1@mH@;E70+3Lo0Wz*<8M^I8dj@xxZRBnb>5edr;=JHKUF1&#nOxQBt!
zONfE8>&;i6Ur$Z*cE<yJLmP1a|0dFQj)Csz1EiBSuFcP_2mHXb-an|%#I#5lIZfsl
z)*6AihPyLo-B2Kt`xDe`$R%^ZDc0BK@O0Ccs62~Y(s=RnCZ9{bvzVICE9D^Rwo3V`
zkm?6KaK?T6my!RtE*dx=W6h<noxH1jKGTh(LAS6R`}<;Jv_G*FUgt-d5hJh48M~<&
ztjoT0Js*YH<-bl2q%RC2Hss}=nxzQY^^+aHmGZPj%<?t?4JqV*%^%ffFL4suc@&dw
zj(M0Xy|EdQ{^@n}7kD*b&?8`4*|QjKyiGy+TylPvlF8}1!E{38cX8iN=M^DQ68zDd
z4p5yPv6ms}-pEmsYjgOkwIaL7!H%XHhsw7Wf#WklP>esO$^znV*Zb=1_VDy;?exBQ
z#21QTycfFZMGCDiyU{GPy1=6v{t21^y87^ju`>b%*ML$6YphVm6qYn|sSGQNx*^4|
zZ%e7OTj}}-zWbrDJvjQDJTt^ZpRKksNvEBB1IORt1}OU2N#CJDF`)4xzx|k_C1s@M
z3MdtS1SrpJ!WCkyx?(6-A4Z-@?Gc-PT(RDIO>`Vi34(ipCUmyY_UjW->2jR^b{w^t
zO<&%4gi~k#vZD)`2|)n3eKELxI)oquO{Ux%R;2W58>i3C%QwjS`3^`p!x;jAWaD0O
zZrY~sO0BZ;-(0KR96LCt9!>9Yyrfmt$@)boN+2+!fe2~xI`BYcbVepOe%He-?$sN!
zI|&-6ET=iX^T$0SZM7UfI8J!TN*F6}{fpD$BvxdAB~&K{Bc1o?Kq}^re`l(9tCg=~
z=#-2hwo{`Gh+~P&bKb3^CIKle(?wqc6vvmNR~Y%b)lvsX1pMy3Kr=<ydToNe89kpe
zP}x%J>@ZhT<a=@cz$yeqjBHiiCYyPbX{EW4So>=ri0XL83bU%CUHo8nfMRmHjbTH=
zj@r#B{=k!x(<{BoX5fwPYB6UsqYpIdGCU>skEIS~f%rf=89Le;-S}_l3E!p++{0I?
z+s-zrbwkY5+B+=+dYr-4?Vdj(g6oy?@*S6R#H`49Q_;wA`yFADv#SDQLMG|RI!mJT
z)^Uy5-ot1-C%-<@pO)D;B*FP&r*sN!giA8f)_Xtn!Vv2dIbkD;liH=n!^p|U{W~sR
zb+Ym|+Fnz2cKCc(HPl-Ng1H&3bsMnK*wNsnXNL-n*+LTrq211~t!>QsnO+wmZF;9T
zxZ4aTeCXo)Pd1BDBid?aAiMpl;?kNm*5d=@XbUok0bRMz{vvp0anZ-_T;F<M!~gip
ze11iwoB$3j_0U4<RZIv4ti#)jarlgf?=J5x$ww*WMX48K4+OG~G96O<4ldLOmKsE4
zVL`uK!dyJM<xy+Qv0vYBU8?M`(zZ_11`j7DT6#T3(2u@o7})LD;z0oU^dzP0v~K=H
zN4O<fY~X2g;s+$~9^GT_WmWe<sqx?|TfusXM5v-mb*e~-I9pR7<wU>!`)~8B)!>~v
z4&0qzTb8XQ-e{Re)=_-t$W!pdB$j-7#pz_?N#wbM)Fj4jx>w9y{&2ss&7z@prMS=)
z7oBk^#vw}-QzL&!C#U#2IJxyz=rb}wua$^d(y)~^vhdeFUX)Ome;&+lUkzwNA1&o!
zst${w=7+BD&jm`dbTIYpM`%l^N{A6xZ98lGW!IuM$H)gq(G{wcz|3<LdNwQRIbE`z
zedi*<QHj=&mR(WiY@06NiY!IZ;5f7u_>>aMEpt@-mqoP23MdJ=@)I4d{etF@IG)KP
z*D=7};{gfs5g7g473YV7pYnt*dxCMBH2qycj25R$uYoEj+Tx%C8XHF|e<RH8XDvup
z7g{)mIZPKPYQ)%5Z#ax6Ecj6BgDkA8$5qXSQSP>m#-kO#WtsAMJ;kSunLgLMRhPai
zcLw`hrs3FkKkxzJsJu(!Zc6wrF1v5f)<Ak(Mi9>(T-^*<azCY=WQez(OFx>g9F@#^
zE}a9#1!E!|4DF6*CQlJFXv@hA(_U0Rx`(vq7icEpoveVInY&~7Zob`Joc72!8~Htr
zs~zu~6+9V4uhhXEze0vfzaUuEunv#41kOqR`4GzbNwp)HoPLI4yx7DO%OqYI<O!ba
ziGEszQI=VIk2zbG%sHn!p3gQ1EAsBQvMt(m1_cFdqq*rMyy9|(va*+}?aH;nd>nFt
znhf7IOu`0{#Pz9v*-rPzgSAVkX0pddk}YQn2SwfPKQ8L{;E-{^qrs|zCCRva0}@hk
zN!d@{$zLFXu#V)B1oTCtNaiN3R`b1z72D?xrn}Ywqm$+rKe5|8-5fbkYi6!3K;KlI
zv*u9P!}VU$QOv>aI;yd|1`LK!E_0%BB=2x5)s0vxQrTS0z4h6L-|Vz)KHV3S^Oc(z
zojB7fiA>*__jo$#q&uVIi)1&#Ux14-X?31UcaK@c%xU0ss3X4f$~pbOwfw<15T4(F
zc7$0p>K|#SmJyKEXLnIumglFD#4FCKG{M_3+r5!qdYIL8JD*C%cY*CP>e!U|JU99<
zAtvgY8^cEs3bJ=I)~2w!QtSOlRBRHD+eP!8`O8z8U7;o%3_4`T^|J}R>b8o-=mX5(
z>a$y!olb>SHvu)~rWPZ9xBNkO;ncCtry3N9wSu9NkUt)2nfh>_^{QLzB=$uPE`2q#
zA&m!j>uQT(bH0}z4|1XmghfEExMMMTdZxQMOfLahzTM0(M?G+bw7_2H*wblKkaYX<
z)K#Y5l8on^@3J)HVjt&n)ulmB^>B-4TlEA!=I2p5Wh#Q%<tZpK?yZvUq4|;i!BlI6
z@AH#2DTZEAmWFY{F{go(aaClD0E~twu=g;$<fD`OWDV@F%AzuJ-{N8va&+%j=cYyX
zkar#8_>X-o^6r1lNqBK+Byf==ixaMo@IP}B&I?VWK?)wx!qLV0AmmF6tjcwV*WSP<
zqNpZzizlcOJ{)Vrdxe>nIU}-RqhRDdXC9||nWIF*S;rI(?#0Z(RLgF?_5g%q#?#$d
z^pCKoLky=kqqrO!mJdrsM$+D}0|Rw*6*Fr9rlofT4M{!EMabkO!eSDSI<ylm=5N2f
zMFbjo6r+-{8|DCExE^Dk&SE2ZS{2%Kqn$8uM#fU-X_nb!SD`tbQr*ygHnz`O<?Y5V
z!)kVNz+1kK^wb_KMpx~w=T!H~=O)Nb9O-$0u;z(o*nnPPj;=>6$(l$v>EPSzpTxbM
z$u^KUn2;-jFGG`S?!}tV9$M2*&QYQY-?&bc$?W63Wo}=D>Bqqigjc1}4TK5{TFgef
zvX0b<+2X7)bGO(#t$t_Mm3@;ch~Li>qLr?;R&Q;bYO4rSzaF__-ci0G()yx)%StRZ
z?Ga(V2h|pUpR^hB_x?{Q1FFtsk(X6Mh%FC6lF~KdKrJ~QUuO_GrA>E$(rTJ3dubue
zSm2g`!ed>aUk72ElgLI{pC4{0r4i5V?jhyd8p=zD@|?0&IJkt)s35)`G0U^qT8NKv
z?8*LJK{y>gL8Fb3Q{Gv!SMGyvMB(k!CQ4k7y%I^{tUbnv%ke$|mj@XMkcqh}sE%`r
ztbZmkZv8^PY{P6m)$P!dcvNo%L?MX3mWw|#>C##USa$m=-8K{)Nhs@A5uWS&sA?$|
zGfN#rZg$2MsGo~ZnY-@$ggcK8K%~%)roIw0I>Um6nuZx|GV+UkJ3>Kf5#hEyn_c0O
zBrhPxVbeiQG^;2xP8MS{;egNU0lGsR8MD6%0@fZeoZz<fQ-c5+?u*Xw))<p~e%UR=
zQ*tIhA9u&ZaP5d)bM-0LTnh^~mB43%$8iZ)j+Y6xuQq;7Pr5QuY9I6jlDpAl-+bXw
zR!0Yx`Oie)F!#7n8;8?!A$D0@m9rn}r6IrDNzL`213p%`;B)F%R!`2Hzt3Ik9P`}~
z3-h}bmLR#=eaKo@q$48qA#m_w<z~IVZz=LmDR*>R$;)c)O^jmigXjPKL!bTdYCxrE
zhg=hJ?V@@^q?B_N>W7zPa{*$l!r`6$CK^iR1PE9y3E^VM*~NbwudqF2bI*cd$td#y
zgWazRjrl(^LH4Nttn&rb|B3|B{!RqnUg)owl08l3&e9%=7<3l&{Q`1I05J}QiCk5^
z9CMd!j0fRZDXbWz3rsl!Z&<0m=Q^d-M=8jjy~1>@6u64hy57!>&cLjoUo1dZFvUS4
z$$b&}HR6<HQU)SrJwB+a_rxllnxm)FB6PdIqFZ(};6$Qhw=!32BeI9m2$(%8v<fBy
zHA+b|`I4>I4&}H0B#=a@`ba?`6PtUeZ*3eHdTp(Y!12qp(0ao1>nHMp*P}zVM8Q+N
zZUJn}PoV@{CI`1FB2OP=$X&7`dx~iQzqG@1iZh=(Dl=;-F+0CeYW!vI?nNVL5I{Td
znH`RJt+pA6@r@oo#aZpNU<Iu*k8>cIyxS1mEM&W&58XsCSZRHh4YIzcXk5m#maI<2
zo7yw*qO!)38y&y(tP;%^$I_S5yZ(v%${Ka|9Z?TW{EGzf?xcRMs4`pU_1_zI*}vO8
z8)j#Pv>(t5NVLm5+<NU99Yb&645YyG1R`U12KrloF!A$K5v)T88uP}L!z8~~MHu!w
zUJJ;dSzkzP8+W%{-NmmtWHQo9(_1+#m8yTZf@Vx<b8&KE5p!o2^v;9EHp#*~{lGCN
zAFoAwgTqi?zbuOBR*P0}8kc#X(qKoY#nek2@TeeBMa}ksaKao7hp!Jl6T<33ZD7GX
zUE5GZi+*Y>`3)>8zkt2f_J#Y;HIHl}o)#sF^Y|Dkfp2yi6i_maa-#~@mPzv<uq_v@
z#W@PvVwxgFX?hgVLa{;*!e<VH$X@)rGgTb3IZ%_PGjZXc$*|bYbtSdU`V3^gm7tIA
zwI*vnI#=}tm`ZY&vt;=v6XddD*HlQV7os>AnL2fLxx>v9Wzp%%<KWS$tGwg&VJ|GX
zMo%#T3LnuI{5I6W(fHH#Hx}8vtO5m}`V_B;eGSCjqExhN>%Gc#0y!DfDi+u;ZZfNB
z_n~IFw4ysrUsrXsRHJa8v*m7xt-X5q{%fOFRCGfmBH%gj<$8F*4mlT^--9DNH|T2E
z##}=AUS&k72{>I3EuB7W;Ixat-+u)S3(Xg`FyE~~)yJ6({2ZYvng-Wt#6-|u3=O6e
z^ZX6CDWCq&e4DIgXhS%>#H_$FX0SQhy`DXENLc3UsJGV$DKu36i$9aLgyc#L>0gR{
zwJ^rzauvleh*{TJMa{DRgKR0=D0Cg{)(*wtHZi3pq}*x?(1vsFG7H*d6P(2&A8gC|
zx(83K8@R`m9Z>>er%E=cUW2Am(TL{+y1L@rl5!Pm-u3rj=#S&mm`}q)5wKHosGEC?
zsoQmD?J+Byk7k<x=!C*9MpYQ(a?IVZn#4y3oU6J?*}E!Lg?OpM^Mk*WU@OU=s!4S3
zc~M|`B>8`daLHOX*0X+W#LnC+cjGk|!P{(%pa8`6CTTEM;7w{Lh@(T$<>2R$Wnr|c
z^E9_bT`Q$}nO5hB$y$j$Zu-+gZ&h?N^QPBk?CiI_kzIqkQw!7XRLyb#f87d%4O3+p
z%6N(-%ju;s?E1J^_t>^%=a$`{TSzM~-4%QBD3Z@9xlRkcku?|@=QPOgb8jWkCbiZ7
z+F8jmA+oK<n@&sT$4%Nz<(Uj6;|i2z@v<Vs@9R3)LLIeM7?kRL)o|56`&KdyvN!L_
zYv%PdNKQP{(^x<q8clHNre+}V)-1c-dUnEHYLM|_DZz8ihk2CpN3Epc#YJAhsRTs;
zn?|G&^AEN^KIYS%C77{q>h4j(?tH9oqIl)VX5pFJiS{dh&-Oey)-lifs2l3F2y=0x
z(;tcC5{Ordp6J7_PtElc!s|MBlYZ{Sv+R==y^t;xm<uI#w?F*G-B&NB@&6cm>$s-h
z{eRd%Km|r94Wk4>0TJn#lz<2rNOwwi$0SFOkdl~+h|)-RZy+&3y1QeH*kG`Gp5Hm=
z{(ipqeLm;+=X-lRcI~>}uYA6q*X#9o(cDRU>E@*2SM)<)+CO(8M51r`JTA9_EM^(`
zk1*t;!s84$rn3$dv+19*&6Iy#msyf|BK9n3`efF7K5QQP2MrY%9Ho2Vgf(xWqCH(C
z*%u#I8|wKKcQ)rVbY2r=@N%|r=W~fd(93OGlP?xP+alS;Nh~teXXaIz?RQWPmGkRY
z{6i=u;Qy+T5$<xf#>Yxsh@oHy`IStUcjHs4IXfq-VpRT5^Cb~#Iu?rdtlZ5z&+nzC
zm4V+4u2w|oGNKGK2j3Bzdg0E@EWGl93ONZKrg*7L6*At8w$l~11#c~vImSF2aEk-1
zf{qnV*^cA3ZjVLQCF*=2&6e~H@z@l(-|R8-%j`|X7iE@R(Vjz9nIbAp5PFB`^kzUh
zp_otfWpiR#GxGdFmCt}~ts8if-&xuFcq>KqCV7!m|GJ>x<}YLaRd1rtEmr})<-_g!
z9Bv)zZ)dpWbYCvDP}#pW6fsTAWXd>cC6XW@A1j7cY{yo>*_o1_Y)2NV=q`&%HyvzG
zhM^r{?8~bqj1+XR<Ls{5{Kd&Us5z0!^3EyYB8S1!WhgI3+Y|OkE-Ek}QD8W()uGN;
zKCh09s{tWWPn5YHyRY|$L7&d;kPuNN*h#zFcJ`qb*ld!UxmG+D6jT=5T^3R)owW&l
z)~qWnK%>nYHC(Nrxo+^m=i!~)+7a&5Az>=Yl+6)tdwln{%ExyffySSDyGviXjm_v|
zY<1I@^smYDv5?^!^^7dqC|v7T^1}6g<h|%fY79xLe`q1r1{POj+_yvt4|rX6^7n%(
ze%wudPMPzAsCU?|W;Bh^VL`j*wvhd?R((*w+u5h6LP1dP%0SzAlriY^$f3?KZ6a-?
zS$My0rNqMrJnwt%x%s=PrLlAm^o2&{L!Eb<`~alPM3zQCloo?B99d^0cO@~U?fs?z
zig=U{<fb{;FUh=IOu7PVZ?+Wsrf_R%Tb!?Pz4p0YGoeL#PPWSu?@hi~p@oDuJ$rhG
zOs0Flq8+s7TlxAVBmWAfd|wFrcnqx+T+hLxio879CGhY^SN5^U1HSm*^N&pEmC>uy
z51gz3)wP=KB5~?DpP>c}LDvJ@x+qG#*$9^aBb~LA@1V8WKkY*U!?1zHhR32}i_}&3
z@k<q&o}>MYb<YBOl*8vua3jty$GJs=!&*FO;8A~=S<Xb!tnNt|1m4?U{^H+-Z;Tjc
z0;*-HB@zF%zXvn^0?PTElu3?B7!vbC;Wsx;Og<T&(Wr3d7f*KRA-fk9qpfe<w}F;|
zAbv>#SI3^H%(Rmuz2BQsG^_)`-poI_K)SR@=m_9pn-FC^yT###AsMIoliFdPJ~@of
z8zUH5qtk)nC195J!ywA?xt%fpvMl$x@BzH__K6I&?6(#ZboQBCVE62GS_2G3DVi7c
zyZVh_ReNRz?W<tt*O7Fx(f#rV4zsoSD^^z7O8Hg1v%<86wPdXT%d1^?g5NcKU$GjX
zdu;YFj!Dd!rY0inQ<zV?+as}SlRaziF|EgW&HCgO%nYxcX1;$OF55J^$wjkrz2P^f
zZezLh8CnzM#bmE1fvL*_HeNhi8n&Ey_H?lE{3P>R!SyMMdv`3pURC>;OhxXx%4|$f
zhSHX^*Q$8I>|Pqq1y|qJZ{FMwS}x$TVzgV*CTISRvutsBlL^k0g_NASx)lzrpFs=C
zo~W4HMd=fI#aAH|JG_trrnu>?CmybtYt|jYMFw>?q%%?<t6a6=m*1kaDYa7^ICS#-
zb}<o#y8C7su`$<ZiayvH{9)yXbD)k~0|w`eYsy~`c=<oRg$Ac&%reAGq|r4cYzFoT
z00Z;C)`!y<WNtT=D6ZI-HZmjI&ks<LeF-``*rxxYpdR#rmEj9!&~Q_WE-w#_D3{dp
z9@B?9fjT@r9=^1-ZMJg-xtW9X1cY1G`MgIxl~X8QbYv{xdE}vNK6Ru89AUY~(Ou!u
z!%?Sq5t#|JQZW#9=m0tKwcWV2@2EHX9vLRv^9?o-7<^)(qA#^^PFW#yPVUYWzt|wb
zN5BYx8<uytL<9sjY#JXBDt~KBF7EGvCh%+BT^u9`ZKg*;!GQTL$>tTUpZ=+sY{aVO
zvUPE`lE7Gjj`16zUAv!u5d9~6Q7)&;!0UeAZpSn>NPwDWKrNHruYH5SKn+Zj*q1DF
z23L^|E(Rhg5+vES&%?I<TWLWat0H2xm)RO7H#!)rwh)2h6?%Dfk3N5v?vSd&k0_6C
z?B^ZR4fvwh+%J21=Ea^BY_DA3XWl0(WYJx0ml@1&i@JV|5jeNfu_T*v!+#2J|Nj5(
z(34B~NPsK%)j>w2Yr0oI76u0&CfeW%tC$8-I@<jhIL&6mPa%DmIvg1f9c-2ktvVGB
zu3a%-NQgft^-zKARQ;-ZhCI~6KItndW{rzRxT;G_GJoiw6ok0(3mzx4{sSV=<&*i&
zWv){-6aE6D2RdWRz)*JmOa!=*5{t5S2rjqZK>vnVez|9@f7j}M+*|pdgpMe~<pw6l
z{J63T!_{0&q8^$$x@}&7=*79Vx43)=`B0GdgNLHGw~JRMXgxj6LYya@)4-f@qvnN?
z`W}m+Y5l1#H(RY0o1cCu@2wYn>r}K*bmr&jSSZy~lUz@pDPeCU+RpSvtpsa&YDHi<
z2MrpH7u36>dDV8tb8{P7AlB0BMa4CCnYCc|y4GPg(Z+3Im#;}slKZHm7_z-_k>nc|
zm9nBh`=PJZZ<Af%u+7o&**m9Fz0|AjAG(`zgGBO4c*)v4Ak+^pMvZPfHYtATO7g10
zOF{Y1tU1KM{&%%L47%;yS?X}NSj^-&_eKp>nocbo+gTaLOS7Lsz`?B?RH}@UsNQ_*
zWl-zMU*kW{UAcKrcb`e@G5f%^A^)(!E={}MYNMG5%S?}?<>K+Qdh(%IHn<~cs;@&p
zq!sVQ^`&gtkimJ9qs^V7%WwU^?;YBC>bz8)t$TiCn!<e7F!pG3PQ%EetZgc7pujWo
zr2j0=;Q94?uPD2}+&ukuA{C7vt+Vr-B4BE^(?83%-A9fC?Z@kCibhU<Mp0{27QUHY
zd%b*eM(F!4<J8VwN-YX1utGmN9(APsv}sD&1hF)WEP9<Mm{zijhc;DQsVLZ*!+d$=
zP)<q3R9@Cl4%&9E3E`;z4vRL544zG&nC0j53iPU(2oC=8VF7$`(pSIZzdn~C6-K}B
zmm_SmU!}8yo^v1QYqZG@>=l%GJ-}1KOPbpT3rOGNxejd1kLMl58JcL7jPWE~(&dZ@
zE*>tSk!LctDv1(zYo#CZ)qGW=hf8!_FGV&DXFq>)K;|Z}Q!oi&#g)sMkMkIgJPdxh
zsfH+N{sQK>f^5Rr;i-{SwhUAQ7DvZDt8}o;IYv^ZF_;y@)xGh&_9U5y<MMY;f|{iP
z2Bh|Vtbw|v#QU285z<+N$w6kM>+|D5yUfdKA09=x6dxaMpNFWGo{~U1hKFf+U@n$J
zhj*o4JZSm`1#K;S5gg^xR)F2Ri!0h}iYkRtsP-Q!*ucELWP77T!t;D0-@u+cnUB~T
zIqr%t&kVdt9|S&WS%O!>1yc}sG=zf=bHTb8bE{4eO>(k(D#Pluc?LqH1=X$nQi~IO
zu*y$0HxRrM2a&n4e2aW6b8T_NN@qS*7FwF+VJ(ZF^g*v&4b})Ej457`7m;-)c9pr1
z_IP(TtGp@<lX9=yFPYw%Diq+YJy^}1vB63=qoi?r3vCgKq@-8b*@(j4Q&L`&UjRa$
z9zZDt51>br3&7A=Gbn{IP0$^wsR_2+fZo86n%Ka{1yyos+o(`H7prR&L%F%^3bZj%
zSX}$84tT~z)Ds@W1&<Q-XMUH=mc^+`1UMX5zeU4ktU)^hC6@|_>}6%w#t=niK}SCn
zj!q20W#I<?OzgmB2c6<E&q7|~z+HalOEt@*bsCRP=f@Xq0=pw-A?C5A?$gzdBirfA
z+pu%b-KkMx3g+}eMu+|1KYw^S&UF%BUP5Lk8mk<!=aKT@*6-zTj6Q$n<R{R_se3K)
zFD}ZUDAiH0^`1uc{0rf!CxWueXeRp=sdp!n4(AlRyN3YK&x+=Y=7E5E^`Z8$qh(*0
zmHi%BP_x~7gIDj`$#;{aG_p)_M1yvW^@$=n)oW<bWV=sn?Nm2;4J_Hb;5x);KhX#~
z7aIXTo+x3M{_W*7+NXW7eCi>q6{Ay!#GADo&yD%nO<Q7+o&))ACs|;cBte|F<H#><
z=R=5$_?EZ*WT1(`NvK%y=o{!A7643eIR!0Jm9Jm<GbZS=-^*d>>k!%`|82}2d~~7(
zU(lS;JO+op)aU;=l^fJ#bT<86^0GmFbV~bp-X0Lg_{Q~e6L-;poCjh3ieqj1FIM-(
z=iH}6s}1rs#_-wRTTMY|WN9-xb2|pT9GsZz7=VPHEu~4peoeZATHtuY3A?`T=ykCc
zK()OjT${z<GRWmPoqH_sS8DZP`YWYzow|V0r8koJWx73w82nMw?9r}wI6829(z<HR
z-ua!qQNXM0?cCp>eX%F=_HfaPJxBei=ef$Ur>LEof*;^!e#AL?HNXIMnkeex(ZAmi
za7k_iB4DkWi|AA2QK-aP^`!r4dA^^65ei*=2YQaA>BpU>%;SHp*)-bT-p2PH5aXK@
zf+;Z%*dNJ)IdwjQ!l@J@?tqGlEFU!e5#*<&q``2GLD#vD`$eQJnzHwiyPhE28>zxm
zGBeRvCo%lh>Ew)0B0)#hr{t`6UZ-5B%u}9Fmb-l1VNiZ{9>KzNc0evAjvPeLOHQe*
z$febw046@j?l=lF=J*fdbps7b7DvgZS+_OHl@i47Qzx;J&Xp<9$xFi-ZcD+-qQqm_
z7nO4+IJnQFGGGDJ>@Nkc;n4AAHb$e3z%vj$UY*PA2w!v|c4?*8ONQ?<0m6E#(|x~b
zwbgeO2~R>VZ=JsG2r_5%Tx;-4E*Bkpkok*6S>oKy%K|Z$z&1K1W~qG4&7~0Nl~8sZ
zmzKHSSq59LfZp=On&(D|Kt(Pz#DALz=4hcy?xbPS*e=XWDCj=3$wCSgVuZQ`7z}{~
z3s$0!J&`qT%K@Kh5I`(r1JAx)Rg2{F<<iGqm98>`j!;38V4e}|2V`zJ;zFl#-tuhI
zAzg<{%;Q4ae<q9WA>Cv4bwp>Ytw@XJ>s90VMr_~}218!p-LDC4DR7>MX0(`zZo`TD
z1O>~QioL}CgsVoTZ>pZ-N??tcq_YBg)jeYn>DzCu&b@(NZC)13@dKqjuXV#mkUdMq
zU?G*I`{=GuGvcSPl&lXWPX=&H?wZfe*#Bvz2ru_4VJd^%C$FB!1(DD~GS=i}T;U<C
zk4pCL5B55{DbJu(&M?<!u;iaZ-1nD<^825O2;ljZUORIK#?nB^U(*{MMbTVQ9-y}&
z^FK)}9l~A|D@IX%zjc+bCZT1CRUVaeI;S=tdpX-4ldqGvk9YhUc)7XIvJ!wV5FZm0
z<ZEJUyo`o{1JNbc&81knMVY-6CmKfOOK|^r2Mkr$IOH`}DXlEBJ`EFsfv2VSn9pJa
zPf^uPQU)X@9RUpfrAClS#oKo~+8Yi%dzgre?4^Go(~j6TApaEIe;DLe5cyS=FAJQu
z6&F@m<P`Qs4I|F>DAd5Sf{`~*ZF9WLd^vIgw;<u7GR5W^MJ>y9Gpcq%_$Is^f~lOW
zn7Lj(5uPJ^vQcIM{bZvTd7uFF+KCDeY&L2*(>JIJSRFmIT6H2Q7C%Fx>_`+=at5@|
zHAHpuA4~tk7d$1!F;S(bgE{ScBEicHUoB|=s1?qa6sMFLJJAD8zouLJQZzNp6e@7b
zVu)Rc*f~nQ-#$#lYvW5KZNml)r}*!K4mu}c_+SM)73cU+1YH;4a~y?%`N)8~PYwLO
zh#gpwlG-BHohxP`mVHB&R&<A<cQ=a8U_yC^EqIozi(QuR2`9Mo)H<5w(;(Dm$KpX6
z&>-r6p3y)5=>PCwpNxr~r^bFy1!v9RY;s@{9i{EX?J1A7xyaV2!|aI6q_aq=&rGv(
z`RJrXsUxz*Xg;gG5Itg_X!BUd4#^SGNFA;u$JfTb&7M#5N&X+d`wyA>mz(_OLxIw#
zSGZh~>>`|v40iFQ`=tmA_y@<vn{K@@8PN>|5}}xQnR+&x>-XVTuHH0pD2ppFJ!0>S
zO7Hx{B4jbVOlV6-O42uV`+pw!|6cLsjcaXhf8u-5Fj>TcRfheYiPXc=@QwkJmu?9v
z8x~MmIO&T_#X3_pc@@I~Fay%@piS&ZsBUnPP9o%Gyv!Lr(>#t<o`dNBxcC3RO%T5M
zP8W<?1@egD^*#cdX$4Z3c~vNzKet{nVt(Q`CAT9#7@^4;YnjkWx?D$YA-6;Q0L~#0
z=rF+n)}SD%+v(ud!04oys6D%q`IlJYe=imsL5azYc;Rpdzahl)0I!z>!n~yrSvT3_
zi3*JgO8B{x$mYWCVOz1<DR`z!+@7h*VY~Bc39^EHSD{1!=LAm(J;O<Z1N?!a<ZI(e
zRPjlFzZx;s_lwtc&rr}RIUc4ztN9rHmcZ-VYrh!$^7Szthgdb6L+A`Sb*gN8F!9rX
zHbYX^GNrP(=y|q)>z|}4s$Y@!`K-iBbX{E`^2oz&aDrU#{qZXQ`DF$BQGG9_j9BmU
z?R}2p=_=@6SpcbFb=Iz&GUDv}Kqq~|s=T(*3e2R$az(^)Y8+Ff)hZJtj}qypDIE?J
z5aPaQ@x@Tq>Bu;B3~^Z<43O3jl|^cr{I_=(`P4Do<siE4mG%<I;@*v=8xX7w3f9NJ
zrW$m1@XetzcfbGI`11yhyZjN9rE+(afd*3>p_N?%)Me|RhQa|}iyb+r$nE~$a9L3Y
zHxq|1Kv$+ef_Xjn?~j*{3S)qR1-)qd$1R(PPk=oU4<#c0=aI9oIYU<3Omikfh$3!6
zzhXEN(}O19x{t<pqGA>_r9D;;D_$sea+!2?w#?!56(*>Xo-hUz_!rZaBN{qGrM4sA
zL@lN>id1PdW?ki5PE?1*^J)fDrf3;neADP}TpH%f>BJ1s?F{UKtJG!sE4!{DD#op%
z@^&LFG)u-ChFw1_8KbcW40pj!t08CxO$n<^Nre=*Q6Z16CqWcc`LaFhNyyUL+0LoT
zi~{2EANfD%_sVk5r>NEV4O|0WlfMvJ{V-PWb{j=8KjEvnOaDS__9*U`nEyG2s4^t}
z28{VMWSA)q8{ppJw(ANr!`eSQz1mSN+;6x(Q}hJphAy?tT+h(mbwy~q%fxMu%Z!P>
zQBQH<Ps`l?Gd=mcxbZ-~7DC1*RnNL&tsk9I_`LYn=>xMd`hcEZ2|ZP~S+d1jx_k!f
zclP}Hzrkc8<y&XZ_MW$7nm2lYHxdIKepqSW|K7_Y7MkM1C$3?-{5}+V==;!QG%#Lk
zH3+Ho(ZA|VVc70h*%P~U9;tta^#r*M2C)PaltH#(fsf}lUXL3j{eT+hs9t))qi8Si
zh)%Bi5U9*dG=KuCBy{XB0IE5uuj=BIX;jhTv8%F`oI#YGX2_hl^c9=iZsLa!&6W1*
z6laybAK&s}@}I5}v0d?=-@amCbzCCqcl7R@z`x#|5!U>fW)dLlTkSA8>^14=Y~a3o
z9O&>}ef#V0-5NvZakARZON>R)?#TAbOvjUxvGZ1$n8z$5>mL56yJCM*75-t(y#ej%
zUGv-gjp;1D8$n8M7J<tRtO39Lc4zzNz^A)k$|EFW9#)6Nv5N35jwCpWEC+BW_#Uf5
zW&H2Sf16iD+{q}exP+g;;zTQ&yyw|B_Z#synWVgm;*OD9r}N;NHX!(&n4wgwvCrO*
z5MbB~WE0@X-ISk6*g7^4H$)=3kc8f4!Q&EWG$atlftxoPQ1w@Dz#7{EyeAz64ZOnN
zCe?dxkDU;(t?9fAWclfwZ=va}&vgy!dcLC~j>y^S3PQX5UnLEzm+d}J^ef-lu4j8j
z%U~xu##~E$i}WgLSHrt%0~;pSRl<IW_kXo_jdy6A)ULh+i>gm3C<cO7q#CgB!res3
zp1szR-Fnlr@neT+7VoOmVtt13rSFNH7wCrey*hL%G1{>rutu@^SmyG;vbWCV;Hu0n
zp-sBr;q1UNQVPr?wRUhl<|uCWVWkS46!z#gPWCZh9mV-7o&U)u&(5!2!H4yt+J;u-
z(`M_eqH&<7*jc35K$`!4{b)(^k~v6Od3tKw>0PE{Rnzf=Z*Th@Hr>)DY|yl0e*Z-y
zw*C_c_1k?nG5B;+;dI_;P(2z>CR|<BTUyto@ou0$v!r2|*w9Ok(O^PoB45WjGYHP$
z*m<ycg2@HsZNERRWt*%%U7qu(aCBJtp4f9a95YZJ4A26d#=9f!{V^h)1mtpAYNW4X
zVnkEgF3r%xOOkH;MOm!5{K4vCFGa(SQ&tPEd7)WsBavih>VcqY;Bc33YZF%*$zD^(
z0O<VpSN(lZrZ{cG^uc_Pa9JQK+-9dJh~U7=Ox)-UTs|x9{1!ex$5eP7nKeZd8bHlz
zS!Q{rpKArlviBV;wzN1l&i%?zQb&Is8K_x@1r9sap*~7l&=f3~bss(`wx-Jl`}w^e
z8w`vO!0u-Z`)?8`_D_u8Y>in68u%o3?Y5kss<Z$}sR2u8=QBCJTPRfY1D?OAW()r{
z2|VdIJ#KYkit`qWk%voao6RuNS1on23v?-DN|sp$xJ*VxDg+&w#egoP!4sciT%Eb4
z&ZuH)k2=H>3+Dt$BdEf>UVIRxZsT~labR})rx?Zk)|l(P$;txeriiOwI%uV;BNdp;
zfaqK2^qk;c{mkxhL$zn(97zRK;v0h&4ilv<x&*ze_^be~Ovx&e*x5*SI5n!S1U3Vc
zNE<V<JtjO6{k!X*L3-yBYn5}#+3z@&W6Ls2T80H$Foq2WhfEG}Rbvkl%zFh|+zMXo
zxbJ*^i(KA!sKrGWPK{`ipY^h~e<s<@UuF0IS1*7Jm8abgNE1Q<pg9fcwU_?e{o}(~
z0MHs2)8TAQwKI~1X0m!~%YNERYS$XU>iUvnV@s+`&)U%jk>gW83r6l%dqa0eB(A+u
zND&6yCTPLfld;dsGhUx`I?4T3+7wA?Xxbe{j&=BNf%2!bUFTL$FrOerKWNHm_yR-|
zpp=6&90_a6Eb~Z0=js^6tRQTcjmCjUmG8PiE1NOh_RkO5llw$q73!LUn?2gg)9$d)
z*LOFBAV5<XSX6v9(>YkfYlAA#;f%rB<60HCNp-*@WEUA^VHpb|3@8i7tr%bR_4)0Z
z&)pu?vp415@)gvhx}}L*B$B@?eENCPI&+q-)WjDHu0~#M8ezIgxz|mt=6AQ&Ld}Y2
zMX23(><7Bt3;qL<fB6;H*5tD6sl)fY9Fx>LVSLVFK5pXfJM4WzqJGZeQA=KXbd9GS
z=-uuwIXzt(d{^6eHpdS~HSN&5J5q=2_*mMEn>heYA%8$Ye)F;c_}MQLtCBOBH7D-7
zkHLe7(V$O@a)7(lQeM-u8WPJK(}f7H&5wNRncHwWlkS}xbo#%~VBiSQj=%6~{&U|8
zay(K)YW=kouEk$U^}_vmm+#AXODmTuk@0f=>bV{Ysds`*JBr-S-;NF-Ni%8jTTNiu
zw+2>KRXaj0HZD7j!EFjXl&k`yrwzP2+{ev`obz*q!ZoipiHib_s^7!C(}e3Z)-4oF
z+Rk~NtdD|_9~#ouyy9$4Jh4h%V>hl3E95^AY<N_+S2y2wLeTbTGAFWxpLhS{CjTcm
zYXw~ip2Ay&f@8rB%P=>LvbbvP3(PCHZ7zaa{0*rE{4g#ZV;&<5-JJc6Jnn2IiJHKq
z9u^-ZcK?Zndg(7h6qjBuM0R$Xf7#)@pKNwWDyi#q(s?U$<GOt3p>-QnR0w4TRj1Ix
z#5xB7bgut~sb5LZJv>!fsJ9oWsL<TD2jL!Zy@e2@s&{OvkZQRKzuL5gzVzQyQ3NXA
z6!M%_AD;q?&PlU8A!@xxmt{5Uw_~A&lFQnyMqGOJgxloVJyWURubJ!-a2v*)O|w?!
zYKr$;+mAP2p}%W`fO&l5Z&~8=LcPzVHtSh%%Q@{s3)W=r1x#po|716zeLub{$m-%g
z<Q18GlXTQFJG+uJn5ZlDc|H8rXvVrxK%5TuoDF_Au&B6f*lr9_*y9$AF)u;--5Vt~
z&hYQ1;<*#i6WDyNpdbEn_oiy~!Iv1ieo#Clx;Einny~<O-Usnis$@SysWx2Q;zVl)
z1-<m14>D@au&@IuBed#HN7GEcy1$QB<NN+&%t0ky{N(Eq+xr4nR(iJFM!N$7`|fA5
zrugu8%N(0I?5;mg7GNU3Vb&YzcpPEq-xQY>>GP24o|*W#H2U6*1l`$*6w*4!YK;E*
zId7nCR4717;4PDh&*X9S#FE-Q8ANqjGLx1;=sxZAPWk|{RdU|>=j2$AjeRLw3mml1
z<OJ?MnK^9<-+q7Voztn7fC4e6R(A_wWQK-0t93S=aixp;BjTPOUv=iS%FVTD?xYXp
z31e?wn4Pn_q@%EId-!?UWry!$)|Wh|5*$YEm;`9_c2FSnq+p7dBlhh_^tVjs<j9K<
zv%BOaW-h@CYleal2|z$?j&t4lD-gVbnpcnUBZ!+Y*oLM78&UW=h39UfR)o7DPxhmD
zGB}`tCSIbG7;q{6RvwH#PJ=&Fvg{u2EqQl37noTN&?`fKxnx^zkncL!vM<R@rT^j4
z<R&;}zRgmMzbkg;Dr3%*6;Lf#!k+bp*?Z=6Q0^edZB6OPHfeA8P7|J8<64d#r*gc?
za+aVL0S3fy{+LSg-*Q!E{m^YnRx2<dyW8n;`5vi;_a6Yl$tyCf3+lvB87F7^iJP)L
zz7_MqkUXnv2aemKB&>dw*}hvhdjOB=*%5U%IS!}u{{HL~XJ>mx%b|j&>z-m0of=1w
z0IhW8OXtR4_(Qb;ck@$)>G5@gxC5#1Uk2T#mfz>a*tprd(eva1#*}T8d;2Z;_~HeC
zx0~&TH%)ay|3j*_Oj4U{uu^my;(K*})tN~P!e!3Tb(ZB>xbV;35`XNpFw?}A(YX3L
z@{3XGi?fIls_xn6qcv#$vQOFmLvQ1|c6ez)hx5WIdwH(AKgpC@D$erf4Q9Z;F6|xn
z27X)}pS3MK6QOUH@IC86U@vT$O7H9?b^8T@<<Hdqk{n+eksgTU_s$37i&DX>?}z2O
zc=X~aBX+tX@nsX&uQ(pn$*2z9co4@=^oYstAMgt01CJvDY_Y*<j9I1;D!<42+9YVF
z9mKE=q5MvKHC6dNCim<Xha)r)@H~w8ZZ4^sO5eQg=PxfiAmfc|O!gqzvx5s;-jMA2
z-NmnCUQvC7e<;_J?+<OFxv6*;c=tO2F+9nK`P-T`nX4oaIBtU`UGwk<^8-~-*#Km!
zp3}W)e2cQrjl;KN71Lv0>$_s#z+3EOl-;3k&X_Z*A7sU*+pcBYE<KjtIq(Z46%)BE
zx4!6tlPY#P8DqP)2O(!}^prrYkQC}(wBVpb(+Sy+<2L_&E_11|)ZO2{iHhQRTkxrs
z2fkGc%D~37YH{KdlYmRx_D9C+>mpnHSt_8556g})Rw*v(v~d)tmqq-&n((Y_Br0fs
z_G2D1TPK?cyFc54FMrO~i|+6Uq9o^%x^=Y`4G9BQ)|WSXu;@Y>lf2S|w6ijS%`IaY
z%;1IhUGnli5;bVq*Q;FqP?=~Gmi6H4TyD;#F9XnVI&Z3Y*Vnd7n;dFp1B%H}d~Y5F
zc`RH+eeZPz?+lS-b2&KyX1s0mk?t}k6iXX(O*@aERh_SU8Hhx#Ns#s!Y4~{N=u9ok
z5y6aFDg>*?jRSe#s>A%@s`2}9&+bVUug%T3KY<ghvo+<nkuv;=a3)9niWk?`M+t7p
zxOyr1mlJC(TLLI$txv>gzJ6gfKD@x8B+b!l$C%cA;5MtD;pX_lT##}6VIH9Vbf(7e
z``7KCnBkLUz<j>FW$+C;ug9pWpNON`n)$C*B)ZhseUDe^9EZB>x<w-8_SDCX0y8}I
zT|T!TH>srE!(Bz-lP-Q0da9#8{X%`Z@Z(CVMHn|lmyBn7&k9p{&&2rcR=F3P$d>Fg
zY_eayo5SqA3zXxve$WE_ARC}^{W26Hsnv5>$Jv(%xuW&t)a%;eukHQAf=M+p^G7QK
z(@te##^8JPn{$swwcbo`2j#Fyd2Mgj*X<mHo~n*wV=$;UfiW(#uV3MV=Rs=Wd8WG6
zA^w!F`<n{OF>aSFtK+nHi&w))%x|AvlrUl^!TAqg9!iCuU!Ooq8Z^j9DqRG(0)qBj
z47F~e8P<mf_qk=0Wt+dMWQsZ#L0hQWWGp+>s|gWZHb3CaTmQ`6df%?oC)M+;Qj<4q
zPAhW!S<?Ate`teykXKW6mzw4CycNbtPbFASUMU&#%}B+IudP%*Bm->7|4Z$i_5d;h
zCy+|qp6(EMJ}YR?N^}fJ%v!ncWcwrIf-r8X*o>vT4nObKG3xbl-(uK}OWK1C@)w+A
zVLtp1o+5%<UReV%Wwsp1rT&y>cA)%`P#|I@CbBj}0VFl-*59E#tDKB%ll71jfD{An
zF&$DtubVzRgv5(iMk$b0(>Ajw!U7#SO_@O_>fB3Ay{sCC&T^(QJVd_t(!oRkLhjmb
z2Euj{jB>0F25Uo?6r}^huCusNKPLO^c9<1Y@*>58WUs=07}ceUyWU)ir(qd2)dAFs
zQ-x*viLBgh*5Ggd7|z4uoqlmN0{sCHy0+PCKi2&T0#q4w?t_9GLoueY<9Yk_7vFv=
z-dtV{v(w;X-cEM(I<V6&RSA11$M%tp!99fJ;_!iQ-uMV~$Rp|4@qBmOr0LA7T&qj@
zt#Fu>C9Ne9e&<c`FCpB?bZJy%7l6Z6u9RaSO(fkdns=8B56Q8UB?>q<aeY&;V9q}P
z@79<-eNn29+$r@&?v7S#p_{i#S2-OoVy^voZq1J*IL>kk_W>&d$A$`)%~CATua))q
zo2`z)CV7UAs_uT(?9T23a=Ohl12Ze8MYY7I+N*AHFk$C0YFmP)XX}if3_x}lA$wIk
z0ZnFM?smJLm&s$|t68C1X6gni(1dpi@Z#mLeF>W*bp&$iOV+Yn{j1r@-#6cdm7hV;
zh4S~r-+nK}*f6hC1O=o9YDx)G{gx|eTG{?K=Q|z8E33$%M((mV@48J+Tx}945>NU3
znN`qlvGvDm&+c7x>ko^-^?FYUw{v5irgYi^zGc`PubM|pyK90HS-G;8El;!D2aFCJ
zm$v!5kE2y1{RhsiE`)c%ml?Lq?IJvNFJDJxCBN?r&Eql-#NOaB^5<^3A?aC-ya>K|
zcf-(vvJ3Bjxw+EY!4c+}Kw_w0vGyQv>?k`ho&r8qL~38+bO<)c6KMw>9v3HG(q(0o
zD6>Yp%xXW-aw*wVTiGe!uD+4Bd0~tY+TTzVvX^#;U59i8_-5zgu67hwb$W`s;4OE(
zN><tCeZ*Vqn0u9_w*e9%;x`(c)k=g(H+)Ft4B>>!!V-mRbECQe5`=`PV9odrB4NL7
zpl<$+YRnTfiHkSr=tWx?gx65B`^}|PI0=_l>zjMim9{jYMfqFer2#fZ=LlRdbNlgZ
zKTzQCeQ31#*U$6ny$@?XBv-RgQ%SZX^;R6g-ELh~U8kCB`g^BWQ>L{ZbM8(d%>@0F
z#GFaW<fhQ3AGTBH4WwOS&u?u@k9)^Gti~j523RvB8Tuqlo_EuX>}S`)x_mDExjj-&
zaC@=a*o=H&jn&1~?XI8_G>I%=^E+{lceBPOV>EqM1=G0!wR00nKigfzp_1<Z%@E#G
zVr)2D@%IG?S@-01o}11+rU%dsTVXh;@8GM-#=DMJUo_<ck@SH92{QnuBZn0mr~s}9
z3StWC{1&G;lMbv_S&71_-kj9uBWmSM3R565rN#^az*9m|2MTn_W=W)?MQA1=P92PS
zC<QwO3f1qq!b6OjMCf+50)X)B@5}j$q)#ZWHb2_QX>d}t7ybE-ZM*Fdx*vCW>j@Wk
z>GUCz%Y@CVLWky6IjtgbM%gM%7Y<^<xjxr8-VnUJCnraYh-KrXwNW3`|I8@SZF<R@
zGoq@RD%!nz_jGcskk&U(%2+4DCHTAe;)a6z2=O%KF9H;2oXFzpd%+Tn*&Y0BkuAdh
zgS1G2w6v^1$DAb%=aUB;Z*6#3{vwz%Ld9C$y4!thG_RiKv3S_H?~jT4_MTQ<!4#qH
zY_`x%_de$)tX=SeyiRfBV#-fjnRnp8+ESW*O_0R*g{faHgZ3*2R2tDaA5ys%gyE^T
zboin|SMG~j#t~X%u^)efnMHhYXBSpgoY^j=1*c+t=Dsn~$&)d=n`y9TsY!q6MurAt
zi9E}oThZF|r4uqo4s)B*q_hZ1pL+P+cl*Ua_YJu}X_Hf?iMxH00F&lM=&4#eNV%JB
zhG22Gr&v*TD~6a5S-!9Anijj(eCh6={XRg5-)PFjUEq2L3&v=Rod<k(-pz0IHhowc
z_RJ>VTKOf^FNB{d&1P3<u0jje!E@XLjL+uL%{jYhDp{HP`qtQ#VeBs~nd`}bf%8{a
zS*Cb?y6(4QRnK(w!v%RlDZkY-eo4=xPSy9iQQBU_PRB02iLNWpIou9{y$@SqJ%-ya
z7dS^D))~Vd^~Srj+<KhuT9D{}E?KS8tR?qa3v(5PIF@WJwI7H|&@Q&0dtTd7_&)bA
zIqyz)LllimUf3gm(RXo~>gwT4alo8+8tCD6R%+EkuaqsKBNWzaia49?9TmuZ)IgKE
za00g%eCxSyN7mfOpN$Vve@ne4HS-`{&w$m8e37MkuFUk(e>YU&P7$~-F!8zjo(Scp
z_q?mSK3Kfl*d^l88ZHB_YPtvBKXc<PLiB}7{?TDH=4`IfmCEvwthAOX%Yk97z;f@N
zo6ISMGN|VGutpmr|C;riD}eu=M@RK%drJv?HmWZf8t!X`{J7o6KlW9C%*O(|bNZr0
zaD2@%IYAINht0za6c(SToD)b8BBuz$`ZI;f&!7uSBOE&gfbkGgQkOmT?|lAGjSufb
zv;d^K<b}XuWpSK`5NGwk!XISJ%2SVNneRCg8F)CfX)UQaz!!ujA=zSYn#<V1u}WlT
zvC0B#bmdV@h7O%pCJB$ol#V8sV+Y|;fz3+oY$gmbQADqpC69z&IdiuG8p@)g%$Y8S
z;KVFUUJjpchhzv%xD&C6>J&GRX&0OLR;_uu5MQDmpP_F`c3zxanx>s>K9UoHkJmX)
zS8KeE<s?CfQ3M$^cx6+1V{iSXOcV^}x^|s}BI`b)>+ur;O+g2v`JwgJzY068R2$;X
z>m1Co*iX_m;}-{-yG3(d0Bj61B6lQDjn4mQNLjglo1(cK@Y?f34ZHE;i=hs6dD4zV
z^Nt+Z-9dlh$>k0>z0kx6V1A>4FRn{Aa&Ez}oKw)RR`cvL+B&*Nyqs#vL1p7sr+r*K
zoQ<1KG9>Aa*~2NyvRENh0;!=B$HXVV<20{{a+3RzhEu+*Q<P1vk5&-e9xH$=?NHaA
z7W&|*W5`|$y*x|(e=5FS7L&H}|7-)xHxoz22&{veGKq{15_dvD<e=EW4)EiMz)qBP
z@a-<*5*pSIqS*4@D2pSN9a{?;Lb0zKC}B=E{WI*5Uu=6K+tJPU@#HKdVMGi}iq4xv
zWjz+1!KP43o`QfLn(A2P=0V5+Bnh}o1(9K@b|5Y1`iq?We;$JEsNTCPF7Stb$^%MU
zQdVv(04;KXGw)n}>_jD_vnJY1zVu>y56ohjF+!|fiSuuJK!<BW?X36%PA9pSYat2=
zKj`7lu5e{d3SaFuA_95{-Sp^u2Af{!2o4LB-P>A$QuMe(y@LXO7?P)-@e=(dmHg|&
z(@|2KBSsVSB?}y$9In=n9p|8^{k|N*d_P3tQSZcx!N6mZtIXAMC)A<T@3_o|tslR5
zq+;Sh70PVZ>yyx$&`rJyXpzJo=efn_{3T}n7x4A3VmM*X_Yq+26`;(!SSs*q6m0ac
zwC{#&)d#SZlPa6Odz(1vlxZp_14%NFx%sL_CF*k=zyDG=pn3?(T*4PSGJvj#C8EZ%
z`*YHsbu;*u{ohpGg-Eq}LBuu^yjWzqn#83r63TM1pd~Tan62{m1N*C#+o8<y;$>8^
z{9HAkS$Ym`8!X+p$s81Gfn15|6%QnxAI4#s%X-oNHIER{*eXk+N2-54ynpTOpL#_P
zAPRvMb%Xr+RJ*`Q6;n8gO*JNywY!ZaV)kD@n8sa?xsn&yX#NmDoY=b(LTdf6hEqab
znrp{)8S<1eZLN3t9w(m4brXT(G<JgRR9Y&we)|_~=r5Z4?}xW+gZD3omd!xC7|kWo
zZt&O|pkcve(J<6IuBi}y;{^+z%0aZp#rihM)W#%blH#>9%<EOAB&giP5`uL}?25cH
zv)f=i?g(X*%R;C;B*0fnQG=TQvkLI<rT#6$PcKMg0eJB`EOJ37gM`_hvXfb@a^w}A
zr(vi9Wt}VKMA?vyiKNEMq%gsY0JPI#OjIYm-xT``N%I6wBp^zf9m@$h`S-8=uM_+y
zN9rdj?p4L*&U_-?a$prRE{V{4PD&zo`zq75R|XpLnz4;>j$BYoYy}n2oX#w1Q7tno
znXd(s`Zs0pKl|Y09Q^8YF`0$#n<l~(67IPaw6(wu7Y!%B?DsRui;DaNiWA5YjQJY~
zR->4y^2P$X5HSZ`Sq|!JFDuK<ZnqpnMJ)n_8uhwi+f2zYdg}jjPF18&BEVteSy?z9
z?4oXlFf*V3*+%YeKcg8N9a(~IPOz5~jT{3H+fDI_G6>N#V9%g1E0Lfh7d)5c?Cel@
zYy&6qcJ6E9f8Er}21_EtwfPAAQQaEO-lguKl-;)>a;J+;Mdw6r%I!dfXrO1B?VbHY
zyKW2k5QN3zDu*LHfi0?shRLE_y$`qY-v}jq9E2ql4?ecNA%;c)!?sNbuO<HAhsr^z
zNK+E5jUK{iku@|z@mh51hyg0=C_09Z+cI_LjuJZQv<NjEIPbjqp3^2)I6~&Udwc`e
z)f?o)_21|+kFOmhw<!->pZ6ZZs?fKcL@*;8BsE*sBJEEF#Mxfm?GrZ$T9^pSd0#ms
zw-Zq;mMqYGp8^aoYZIMsG&oRzJ{92feF2X|Gz(#84gclR{<lT?r)+-*22b7NWF#00
zZ^=3gQW|_v!F=8CL@7j0K*E*jp^v!P?N`iqn>IEpp!}pJI(Jp((qB$kDD1Gsl;5L3
zm75{yMXBa9dG|3Z2%Z176kTxAJ<bp$*<SJm;S~F@;|n^A+8GZllwLn4MO;;)gm*--
zeTJkf>0=@QUJhJjQqHubmJWjuQ{}rZIY1W0N9CNFvYU~;x}*QFxT*im;=Uu$TI3cV
z{h^v@28sX90v|gW-5`m1I>52xDi4&5)brRGx*@^zREYSB3L!0U)Vh%iVAts6BHoQ;
zNM_w9Fd@WE$Bh4$U&2R8T9R~Ol7l~zAQtR3%x$gy0On`*l6{{PswfZiKN5OoI>q(t
zh5@zw((8*}AE!`2^Ji#JI7Lf0RhZk(5Mlzec1ro*bg79nR`4G-XBc--<x<Y9DHn1;
zeuH>p=@UWl%;`cz0}f5OVgy4hq-)F`MjDxS>2~Hp$qiPJJ&SB<f#O{^@dbzWJ*1|8
zFY1Go*Q!kT#tA0XLPPtqf(v|5$ZR*zGOS5WLU+MtHOVQrAipte-5X_cR8AHqmaI5D
zk=qIAK@VBSFvluimRZDNd@qOS>rF>Yg9rq+vSGmAnh3_HpH9?P8M{DZ5m^p68`aAN
z&sXa>`(iyIxtOG1hLJN9A!X!lVk)|4q$G@2P&eG!JKJd6MEQb356IsiicdTfd9<7;
zymp5qfo3q}Fc*sJO!+UyVoT{$wLE=}@H+nk6zonRM{+3s;i^f-^%?tvQX%|=Fp?|p
zD=&pB8$D4uBN2bpJI)CXGhnNtxr0Jk8-QhbrGGgL;OD?8D!Rzjx)vmBC<;201_k~%
zW#+h6b+^6k0kN`P6h1cPP9z=k8mtTaxF($kyV;TXb11%9?6%>9UCFnV^zx0wub2ZJ
zY;ys_v<)h)Iib(!WGBJ_{&3C`u{TWT6J<St<xxSMjvhh9>}0WjFEs^<3(j5OGoc%R
z+xS~B#t_-s@xi-PmG{}b)Z$2!NJ4$BZ&TBAOD8SGD4L&{F<G=3R`3XffKY=ey~xK@
zRLKEUG<ZL>J-L~(%HOK>Q-Yz71|NNDd#gcvS@9ysN1F>X{n2<=GjhW43oserCJOq_
z2ALFQl}#jV4QW(TmRjoKI%tE*?j9&X!U9)#xJ8dbnM*`l8dUx^x}d!FmVHq7vRw9(
z#@O>U8rIh3=5mm~62pHeoEjEvXnwdzX+d>I#_`$>TPC59ojAe3+lQj&U6y6H-NdFk
z!xoA^fZU!)wxq_oX#G8B>`CO)-LzloFD_{`?ofCnp$H(l_#3xG9&w#B(u)wHA;##L
z``1<!`6UZH(a(*WUr@-DPavLwN*|s$5z3IsF+GoYmm&lMr}CbDF63^>%$u;Nv?O}@
z_nUi18aySKQb=%^`2>e)Q-xjBnY`8h)t&t%WoyDu`hQe70w<o`6se|cb(r|63^C%m
zr@hgbu|$>3e?%pSLq(-ePyv1jg1i=CvBwI3XR)rbzXbk~$k796awguv;j-OKA#1I@
zjnGavR*ncVXie5m8{A6%lOA-2sU+~Nr#8|J->0v4L~Jc}x9R49D1MFdQg}IZDi{1J
zy~k<SI{fzm)0Q$p=V}RzOy#U}98cC}=PzJ@(?RLxf_sSQASuhrLr028ej;jmcFGl(
z31K}h9LFoI8^W}TuAO9M?R1%u%FIg;ev1vp{~InNAJrd&FT@juCwQ2^?ywa|GPy>Y
zj8c_L!Ht`TB6rLv{jZhXFpH6eF<WdL@;gMSKi=U4IKn0F!w)RT0y{}%{2h3nv_KO6
ziybMDUqG&actr8H#&6~SqLsFHsn}eIkt_-R(3KDsHi(E9Iy#y>tO`<~3p!G0hsgSw
zU$w*d2v_OJelZNf@o<4qe=mWg!FH6SbBFuw;M8T4#W&01(eW9<hHREpCkfRKa&Y1d
zCRr_P`xA)fk0!uff&xF1*a=-xqPsVmNMe)&t35)9flyp{c_M44mddJ3e-V4J@dDB1
zq8I{#S-hoWmJ==}9KfBH&~W@gm^KggW0qQU)Pp73BW`zL-gk4Bahu!!KN)VE0TreJ
z1(QIjHGBYv$MCB#8{TgZmW?Qv!*MM3v3{XVWsc(VJ!JE7X9@_p!c80`wAZhA_C?`v
zhCr+};nTUk)`D6ewr6$BPMzpkOLt~5a69gB%yqi%m@1K4OxktlO}}07xAf0TJ|fp?
z<QE>#GuRjvC0G;waZTQs`0z6deEBDP2a9;@SheU#Wd(z^UZ?eTZBmVmvjgemf8y*e
z%tyBVi4Orhn72M}#V7ACkzZCtUZ+^byzID7I!D?rzRMQC`G`nRGR(Ex*n?E<DJ97K
zi^XGp+uAS!BU11^H*NKb9FjnM<^=hlVc1uom=&?WAI$f0{;RWTB|ima{kX0^0;lad
zOjeywWT$!Y-|l8Y=ICh8(_7`=^R6x>1~~$8N46F-TNBl=nnF+gf=ro!WeQQh6+usU
z;oB$9LV2G0ZgiQhso}fpK-o$YZWrUxwUq4tnAgKeiSXhDC-l#;hy_&|{Dx?ox;aJu
zO`cz}MEJ;?;3%TBTP+#xMRkq`xt}`#-~h@)LjE`s?}K44*UWa&V8JIck?1i~ykG;w
z3tH^t#sPNIAEMexrZ-07YlZd-zTgN^B@0RB^fQeUp?x=O)B~z(C;c|ayjzps)H4kb
zH^hEg)w9~il=?+p*rc7)NU9Z$O|R)$-p;f=x#yVe=<LQaZWZUTQ~8;{W>58pumK{)
zF*JLxn*StdXlx!OU@v8m_SMAhm~;5>j*+%xtLWTuqP}K@FWuzh)d>gWy2CNPq4Qgg
z(?Gj!9lUQht-MP|VuE<KzAz56dmf^iC;p&l9=W#FsM=OyTR|&Z+Ti%>hfP(ftnctg
zF=xm9Cbzf?*)uUFZu#2x$&CLg*Lrs)*p6^~4;O`a?&2BTc@f|>Y<Vs)iw}}sL*pCs
zm@C~rz09REIL_38y^efWCBkHaTJR|;2wrY;*lCp|8|G|#89*_yifuATx9Gy@KfadE
zrT+1W=dj0{b5ui(<Ico<u~Lkv#w}-u4ls6#wLWN?=w;#9h+a(Uo5_SyW7SUAX|Lr}
z=XCqe>O0fO9L;UY(#FNflS7(|oi%i7Ids0UUw7-O?<Oj_NfN{Bf05z7oAW?aMKZNe
z_uZt-PR2P!_4Ik^*4Lwo>ceO2`pMt220X3KGNdNmwzJ+rXPY4xXXvyWp=V10mu*i=
zug%q&P6y?P1ZG4L`Ywa2xs5sShs*g>g__xB9T7psWv~9T*Z9Qu&&2-2KNI_dBKAs@
zm2qW^_~;jnV)lAcN)pCEAYbfi8=G4ObMqolb|>_LgO&QE5~aWvsfJ!fB_-k`YmXR|
zIsTd2lRw3e!D32kON+~~t0!O?*iSFx$@85H$emC0XBX!u18Uc^q%S^y%0(e2gibaa
zPW2HtE|ZUn9`sGM!kX}(E>H;FhSP$$-Cihh-pM*p#$jYY+~g;dly&9#rIQ6b_UAkp
znB(#A4QeQ}MpEKDrOH91iacoD*k1V9L3EeQJs&j;boV-g#$h}olWSmi$w%qdD^7ur
zyB*dd`<e#vljo(zX;U5Gi-G3LBU>i)xyt!b(>Y=M@_!Ce2;t=)Klf1!$K%Sh0<uR#
zj1Ed&O4=IWb8khs9PEByzORk*e8{09PWjMTI46{*ncvPr$*rEUdZGgA>P*|pA#jq=
zp2$hMv>~j~+^yOut-OK&^dRh>oMB597COY7P`~EZ9m0~EDU0i#4r?bt=bJ~gXIHNI
zyS_BpeuS4iSw%pnH(qrl`JUJ5)Wm0tX>dJ={?@<rp^(Y3U~{c(%yH`MHFe<~VnQow
z3m!;5{}CE)ubE@!F4&k+TsFsh@>_<4Yd8aSwuD0=(kr<-aWT%$9YL2f-!gwBzY=*!
zb?rYX6TKjj+oe#g>a{jd`~klYVnUdBKMHt~pmd}_0=>EZOI%3zoK9-0vsD0B#@i3P
zI3Ry~Yo0#Fm-==?WJeB8D2IFfB4mLw_)FaNB$AjQ<|nG{vYHVrqMfb8QL4{!7#;h+
zMh5d+BmzJlM|wKqZg6oF2k1N!h;~U?nU8KQRcI-LMKtQ19BdnCtelscpatETtSdZp
z2i6Qtuluie^}dPqaxdNr+of&p>(thu#M`}jAyVNuwT$|SdPRX>Wn$VHh3_{9SSe)&
zm=@{qfP7CctJi3C=<OL>Fz;YbW?p6ij9Z38_by%Z-P5fe>e4Fw=b(5{oapj9do1BV
z#Gm;f5}R-2Gx(jTxO}W!<X1q-F5Tc&gON*d1#FJMDO%|B)q_Z3Zdgv%<_Y*(e|^X+
z0ea51$0PAk!vpt@gjC@itTbN<;FKC5EGk0K(M_WO$Ewdk#0a_aw*9uiWdAouDOe!3
zXSv5WT2y%QI~9ogF@0Co?IM#q9-Yphi4PjokO15XOLJJqH__3`-DJD1&Gkz12AOyK
z0ocgrkJnDAL^rBu9mgbeDhJf|Q~MaBh3z_DGVQ3z_sv`Rhcf>SsPu&OYBQ8KxrGLQ
zv-Hnp3aQAYjeLdPsCn_R*Tf76HaiPwd>(M4LrdWbr$pOri#YP-l{UyqW%=!vNThBh
zC$#XE<kUvF8K>yEG=*!27`?lWYS`0dD$GiDgTv6>lPZ95Lz^y;9!t<W#~dZmnz(vE
z<tt8b^}Z~){Qd#NdB)+7ACUB#8f2|?idmWV`&C^%cT$tTWmFJt!swBt1H`{x(U}Tf
z2s}#Nt3DYUXV|_X42f7G!yew{$+bZV=AM6fl6Cf<WSa6?oB|txsQ3(nSm0U&4zag^
z+U?t+=E_V=mLHrk;hG1j<p|<7Vxtm5>d7e}#G%~>!6k~h5hI?1P8DEbY;}rm9^yhb
zPs9hg<;0bfNLg1(Gw*P#G-f^g24wQWP^QVq7aiQBmH=Ax5Jt>T?N~Hc)leNS_Ii!l
z8P$AT8XccITx(H$29}j0sW+Ji?hMPaaNmbxBx?v`f`cxO$5Ed6Hy8TVIimc$ZD&oZ
zUzK`A!}*pzqPVql3-utiS(={pzg)+rw)FkC!_{_TpsYUxJ{0}ce6{*;{Aqs5^!O`A
zN)j&oVdh_7|Cal-+?XBX0SkDUL*Srb^1Zb88KNC{Dk~<;V<tcSKkU6_RGWX7_ge*8
zinqnxiWG`_LZL;96^9}z1S!Q`g0#hpd-3AM-L1HLaS0wQNYFq+PX04<&)hOI&$HHf
zb=EpBuf<yAlArDG-k<M&?H>e5gZud72BJ*HoJjB>A$p=J7q1C>ntsn^6G1EdPoMaN
zXXQk^p>y%1#vBJ;hA-_9_pT{~#_hKl2+9E;^){|PHFyx}&&2rX+bV&C3u8Apt+E3A
zBsHXqg4B02^rdN4<`3imJIOsVg1ej^TrnLiS)>hmw+_nzu^n%?=`Fo5OpVwh;3;oA
zq(rpT>wo@;+RXnU-)ZASDW<h^Vg_i|G)cCN)CWmAMRUd!=Rc9fpX^Lo<WPxF*!@km
zd-^}fc2~Gecf`<}Qa7_o8kqY;2Ei;3{`SWHF=qIx`1KCT>^P=o{<aEb2}gZ1Ah;F0
z?kH{2k8ogUd=N(S#zs_*;eZmKlpK18-9_x<T(EukR3C2hr#Ng^E}o4rH9#*v$yJ5&
zo8btbGG@YWWoK8DUwrYt`cd5j5_n=V-4w*>{>M}LE*|PcKKuFFvo#w3B(t$tVuu8Z
z-$qOwK>i>)2^&2L3KPkOcfHwqiF~HNW8{>viwro18k6RiN6*(q2V(Iam$$<Tfa*LC
zWc%JQsf%Wf4Sd8V<Q8nMwl4TyUzpHWGFpQX-G7GyN&%23{}<|u85Ru{nD4vL-30pk
zM~HQnZ<{$!@Cp1-qIr*n02K_r1<;v3&(a{LKbTXXa$Dgh?tgtRN45e#UxMSaD{)76
zq~w*#`&%jvXwLs0P7~iFV7^0-tX~8AlsWv`y3&ozipP}Z;31xMJ~yGyb=YC>o~V>3
zUw!aCobN7+cV&lg(YJ|UVs=wff4A;%#T@$bzaXfX|6MM7|MI`10KsGb-=qNlgUh3H
zu0mw8BK<*ISaLGKH&(P^2bW`r?$JGRnIvHYRaADAIYUb_OKdM4tFJ;vl(50(M@a-$
zRPP=;JuUUY`*#ZP5f}R3Ga3IOG5_-gmQDKHu2rUv0^9Zv^!g=k5*d@bj<(OFOh=an
zMvD9z9${s-v67eWHx9Vp6U^84k>_lO!J5Qnj*l+DKDx(bOcWeF^7@uE&aJy3BJ$<s
z#(gGX1BK17whIjZgC;llHLrvzZP`CYPoF5he!Y(?Y{P>8w^@TReejtpz&V2~gAdR2
zY=ZDM&avU$^>J#49}YD6^asH3MO}nrgR1Fv3p*c${9N!$q%3_JhmTVQ$^B5@;XFBm
zo4CD2!&jX#U-0hk%44<AurI{5EGFySvSZJGdQ?jzCN0*(<qs+>)eP4IKa%05jBz2r
z<QJRvThxxxqCqKG$JKq}ar$OVQ<Nbt_usE0?}_elru@RCA^02k`|B^^Qq-eomGZB~
zOa4y?0Rq<^VA)EpwhrgS-bYecdW5HKBC54mgT`Z45@?GevB??9(8F8ekfE2Nc8u-*
zcm{rTHes12>?KS}#`3MV``;l$y3GGqkm0r&U+{N8gYLEB`|W#`2A`jr@jxDIC%;tq
z_~S_7J1=S7S(k9{4)Z}W%fIW2^a*_c!;cHagXKa2UzPvo0~Eu90O<t0H+lBjsGPnu
zEXbRT8m10K&YpetOC;@_AVLWD&!c{Rv$7cTxO&5M2VaJQ79K(#_Z!#mx~5A6Z@mJ$
zA$JG)Mt4nbyOaN)<XO%K*xbiVpI>LO>gQX520cP-=PvKcx4ylxucDQd0W_xE-?9r-
zelplH%SE@|dH#k69`Y=%gQtJ_6B*gJdX3xui5+b4*Qx%$FMs0<e`)I?d`LA>b<uIf
zUO%scRpo)V8LNi7%xCzdZ>(Q9<={n=)$aV78R7EOm!$mvMa93L5!ey&_o>qVYf<ri
z35jy%0Mi<IXg24MN`~*u7GIvV&21t>>FdHtn$`bGYFGU4N$p>xe-WB=&N5eHtAP1n
zWd&c+`Bj&BO)dO_577)DSrVK|_B#f|bvvg6d_g?W&cr#EE&yWOBF*3Q39xruK772o
z&rRkOg7<$OhqubN&Zej34y6u7HXYSCBB_LJzc#28^q(Xv;Q1U-$f{+&1nrBstjPme
zymxZgpZ^Ss646ZEVjkS;^OHf4VWH$AnV(oxSLf!lbc|G!VU&^B0K7uqX?LsCsv1SN
zE`)jcVZmie1vDzPdz|WfO<7_X=_H=Uxm$29xk*i*{JE&GRC|ABW8=d_!DOWXh6aik
zy+PS@ebF6S3TSo$pKm?(mf&sq@fYFiy42CQgi<0XNOlvq)^P&FFNE7?juq=y>rE6m
z#ZxYhnrW)e=U2TBjQM=r!FF68fD60eX@;A_&f6EZ4@BM7g)1mC8-?QISk6b<KatjA
zE0{bcdhlg8U$`shIl_|N?@Fvj=fH<g%N5$f`%nm<2RsE~m6KAHd(G|vKB>Z*LLSR;
z^;%9wyC+EtI?g<>lXqyP8!^>9uqUvOYvD?VIbr+0aaxq7ij<0w$>4(4ccYnxH<W$q
zb|BLa1qP$+E)=+Bt~A!q&Ld{s)fnXq<EH`%JWa!p35S&OPCi%Gy#F}j*zVu!Ft|0k
z8goK%`8D)8K7Fk>NZ0MBeXvpPL$iy^N8OR_BGzwoVM6YB{1!p6$)ZzX*8R1zGx((q
zB|8>FkcAa#nGfq>dEMuZEy<>pNqAq2h(%$YT=2+6yBgf1=IZ|2pR!SvSkkZR7M5v(
z|8lZNRq~u>(PKFw%w{LeWdV7Cs#cqSDPn9}JvuWQx$B$)Uj{>{Q3LW=GMa0@@$z*Y
zmg<|UFllFj;*aiH^0pn@FpjdN+JjT=YyHs|`{lyedUDS+YYpxv{Sd@1`P@%=x(aOl
zFUQsRj{8iH+tG6U!f)I|#cS5Y55ilY7ivOllf6D;D`45-*k7)UVU~Z6OxSlxgBb6h
zLzzpK51d5{|8!#ACs`#n;x`WZ=>1+;8Yh%xfrA+g|3WOWmGN^w_=M`8E2KE{G%Z|%
z9GawV{%mM(HKN<t53nsb7Un9!@V|gxtpD%0U5ne7*5f5jg6s0S-i5jwV_dx`qq?e0
zbT#4Hsh(5vR_Wze$O2<9y}gLB$nU@CTEUj<lzqK=x*NUI?Gds%-uAN=BloSm3wS*!
z7{Vm#zT&EeS<+PzSGb4*dP8~Oevz%0qXt-7*p|C`>D>%?3{9p^kcAjj;+>l>NY@kX
z3t4RO#9uT?qO03ppq}d|>9P%?TwGY~pkLfVkJajeZb90G#T}N#w(fPd?gw_va^V#g
zDyj4KUBQc32G%sm(4#JbPKtAD{?k-x37W=vA+(Ry0_Y87+4Xoo?tFCLCSiKE3W`3(
zY<3aZ{LUkvldx}}SY29g3c2bEA~-$W;%i1A!VZ!$gY&^qr&L<oAzSyVFkaE(<9VT{
z9)StE^;jCkWYM<Ln7?#;<%`Lf4`EFb<}%I5Z^V3nNV#s&s@}zz?JYcNN(}%o8bXRm
zm~P@hU?a1(zs<=P*y(-Vzp@vBKrrEu`FrW)bra0;dHaZGn571KY!mIvhs~a_BeR<`
z@jn)st^Nd;W2;7eN0A2Q^|K(K!jH1x%ATaEoJfgj;YEk@+~Dq&%ik-)Q_9tIb*Zy7
z_PZxwJblne;}fgan-$!J!QwJ22)xdy36uBc9JS*-D5m<`{bb)SJhQod!O|aC#ZC{I
zJ8Zv<bdlPi$~>Q|l-#6aCtCKaPj~KB+<0pK;e5G1RkTqIW_YT1`p84C3+ACvo^f$u
zP@Xhk+`bntz+2_Ho!;Ib5-dT3;b5oJ&K;AGG^BJuH$b&j&?)#fzG%4aqQ#VJ_^JI(
zI%E!MnZDl6Y&Wz#)m1oD);5x#ZYREI)~fv&Ot7rUX@Z2V^ewnUeZWabpFFM6<}0dZ
zL>0cx32RdA`E9i#mEB|ja1BKy)NaX~Wb6`|SuR4M7fB~H*n0&V_6dMy-e0O;fM`F?
zr~k(&^kXN<FQk8Mkl$t|@s%8lNB^(3x421^)IPWUJsDDtbFyyZ7GZh^yBpM`fbf|6
zz}_w%L^EekXp3ifMIR6qVi2t%LlOK#i$YHNjF02ubz6{Hc%TnUH;>J@Bf}1p93Z&j
zbWLy+t0=|LfVs=CP|s55b807{iKM~1fo4t&$5>ajMV-_V^L8X~yWbA-C)!QIwz)FS
ziP>hNC$S<&&7srdlJ)@WhFU*8qt_=qcZ@ms(%Qr-<G8JFq11hPDch#hO~Q9<(22>~
zrbmc?{2pr4CcD<n!z*&G7b>yTTFB48z&upWO4q=sv+9w7S^FfXHH(bb)iE@dt`l|@
zH(DoQ*T{ng6M8-pYni<bUU(!=Z@9VmLshoVHzCg5(&*Lix<yA_b_9=d)+H7S1YpRE
z+5EwPV7dxRCi7pz#&cX=M1b`N`_98z7g)RNK*f1<4iWI9(JV3wUbS!RHe=-zOVGW$
zZE*B4n5II0@A9CoHZHwOGj+^9Y577`)bHxHSs0sES_n$DGr>Iv^b)!vC^Wnh^%v(W
z*)!}eq0Y_lEg~F-6oWb&E2Bg`HWK&CB~NQAE{QD8_+s(UR{uCDT|=ifDJ(9CwQ;K+
zN&5{zhU3G3`?%MVsP-d}mtsg72)Z`OChBmJCHCnz-(7Rvnw-cZ*c^>1uh`f5Xf1yt
zzS~QbfZI|GMrHa7?RMJGg~YJ~d#+pc5HEl?PtSY6{NTc%tezKusfk7$gRd8&kJ@T|
zActm9@6&|R?e14BdzJDuo8183s6V`tZ{}Rk+M25U+q7=;%Te$@XN~7l@D`U+@6&VL
zb6gI}t*mh}f1Jcm`$tZME*~6B_ETe)J)|e;u~rSw(l^qu249e6f(Wsr%AuKyDK#L~
z<`R|=sn{=T`lBj-d;F$Ov$1jTvl09$CQa?oIoIcSMdJ33)n|#iG0NLJTTdW+C-UiL
zH(iMzEW{*MS91=&_%xA|^daBO>@<~?wywxsGy$*l!KGCEKTak$$}bG__nK!J<>$df
zz#n*PlDe|+VqC*Cy4ClAz*)o7TwID`q-;_S;eNuXISN@aBo%J`;sWG}`sw4&l|pw}
zh9v~e@6(rf{?--z;p(AKKOxS=N<f4dZQbEqG|ds(m%Q4zyV<1Li46;)tC#4V3b!+2
z7h&)|wAZ|Cl=1F|a<tC2;ILRnBf1@ysdC9d7r+!u?;PucrOE>#vKlkDqMKhbF1|u_
z#maRroYQeBnr+&xCc2uIjBWoGCjR@JeicfLcSyRzrz4EVBr4k94ZId@VNG~H*QqN<
z4RH}G*B|to?BiiU^wLSeSAp~LPY_dVmYb%M3s*ffR_w21l%Bl#*jq6m5<AZR3O?78
z+;8k1bHxiV&F;dz(}`nrMJ8YaUJrMc#+H);`?o{V5xPh=4o?=DkJ(J)3j=?uc^W#g
zHTu0z>mxAWo9U!XRt@r=S=INoE~Y%A6C8^*m7vxpz9OaeQ%+4zz^OU4Tm+SsE@%R%
zt*P_D>r2rJ)|(=qQwt&e_!e<GRw$F~%d_kT?SqNPzV0!kcVar2Ni9=+mfq!y^omj5
z{+k!T{6MFrEp{#7n6rUDvz%RW$y|20k;SnZlKget;_+L>wN6ENQ5-4ca*)$Pbx;!*
zRjX1z$JUxpB-XYn6PEY5U*U<OjO#kq5b<!aH1w4jkHkR><i}HZpI6?RwK1jG=AwPe
zb%T<L%}DL6NYS)i)2WHX+GaJuB>!ehwW_Li5k61NCk@yA%6cjBV_)ingx>zIZBKt!
zah0Sk5JyE*Mmt8+6JtaSodapz|A?-mux>L|@;EC=c;mmsxAijpE)*q@0nD1y?9<8p
z!i(-o3Eqo`<5Fv3k({rK3dFFUcx}8f#l$R(Qfc0e7lTR%1AX+0-5d#xv!aDKp-n3|
zschAU#vLf^EMb}a@m)XQoufC8iz!Yvuh|Onxq|kgciqS8kFd9smQ+Je1q0N&O^DdE
zE_{w}B~)=n;)DLeq{T<2qFj#}LErz)DdRC$X(DG3W2ncgPS`~VnD8r=+3^8f;;Jjg
z8J^foU&~eAJ|w*0G9;;;r7}7OKzG}<trZDga(qxT>7(=gD1Nc#OS{>Ld@$iPFI1l(
zmC1mL63+^17({c{GPYp1tv#2K3yGU`tr5^bU2Mj8E6#BPL2DCy(MsiE*+|iq(epiB
z051Ua;2V+CQT~3}Sv|3;+R&sjY&ts{GA4!g=p<M_!?MIRQtrz$L1>LrIhn>5UeT{(
z_n(v{7`}^YUvQ>0#e8XPUi7(qs+)s&Uv%bd;O?(NYLX7i8}S_U9u+<J*l=DP8B6*c
z@O}O-JBnH8we+=N{qf-OyUPKmlkF5sK#oQ-L>A<?2;NS%eECDj<>m7yLxSrID=w$D
z@FMENx?;N)5h-F$R&bYVvbk;rpD)2F!`;FQ6cJ`p>e;^S;;7B3`<|g-&FD4tJUB{H
zFSmF*Lt``A)!2KD(ofUmv%$|PndBMLtQ#!u@T?4$-GL*Xwm)_)HgfcCg=)>$^Okk?
zIof#h^>AR45$McQh*+oVAGhtFR1XGEGM^#ki73F`8Q5f=v&`OcX4%l`RFE1$<e$_~
zKl987*+S&u{yzg7-ZEh;wy}`G?@(btO{KY7%W;SBbxfCbpyPt)t=^R&!nuM3fAPNx
zwy&m0Rs+&Xjc#hv?hM#p7A<P)7;v>VtzeOtgVnC6>YKDbS+NvfkFC~~BoExj*LLYY
zB^F+FfN=c=&l`^)3w4v5y%YONOnufbTPPE&TQ}wO<d*Z|rHG;CXp4gUG~2T#t@<GD
z1#=DvvInM_Bos4y%DJ6Gv<M}{9If<DKDG9I%iK+y@V!#%Vn=pY8;yHd>Y3h{1!foR
z=2SA1ZbB@elhKj&AV1pYQx(hT1mu>E9&4-H(kvINrL{=2?U|p!yvvlXaTF!u%j^ym
za#{KmH=FWX{A?`5ll3B)zGeT}gyplM%`0v@CmFjVG-2IaZ}ePGlAbV0312AIlF3F>
z9Qg$`mUR7N5p<e=FR^Hr;gE5ngDBSYF912$@CtS_2Bc2I8-Ms&k!r>)PuxWqRJ0LK
z7NwjIIfT6bPCx<~Cc(|uZHCYq3dngIpWkA!SVTo3dO)6@&3i}s-or|*&sXF3-3y$F
zrLbG)oIu-BC!qQ0#|6a0chsa`Gndi3!UU~W^pmknpAC$)ZgSB;1A-1ZPgU!&wm`jy
zE%0lXGSpQUQE0Ru6nNu00~IZ8#z(ed4MF1koDlS_Q3o5opqmyq1)@i8@J9Pi;a;Un
z?8!m=rDG?OY^XYZ;q2@?k|&JUmYr^KQ8d%Sed+YHFd=S000}cHMM=8+(oM|#G0f<|
zD|%V;*(mIQVT$3g7;rniT+_?7ZIb`Nn5a6AK6Dhw+<(RkpttEemzw&83Z{Ac>o#gj
z@H^?W+dAXxT|Hk^gjiAsjYhjx1J3MmFkj>Qbkw1Q{dSSKEnP-DX}D{+VTYJkHqb#j
zQq&C8yt6cAJ5oDSParbSv|EJiKs=r`b}gjcAR<XYdJgl`GM*cSnP^&#)sEaxA*6*>
z`TOXH=AcY)m9%JF`uWU_8VUfY)z-ip2k;nX@@I~Gl<IUZ^61HEs%kp9ikbDCE=29o
z&7>4jvxnx_?<<B^QfF9O7bk6h_}Ry)BW5k~>dhYNTe&AN(MuZzU(QY0M39yCP0vyD
z$t$6=e=^(q8X6#7ivkmKjK7ZijtOs!-vFMX<|c?#pS?i1F}+t0>h^Pd)t?vnVCW(B
z!Mwn8z=V9C#}{lV&!2Ad^|Sjd-VEL`lFv8J=KDIlsu}qD`V})H<~Z6<EnYsJ`HYAC
z?{}t6(Y)=Isx_49(xwD!PKaH0`o%u_R(opu!QxdQ#dOT9k*j{kQ`7B0SVo<S5A7N<
z4bOBJcZO+HQ9YcInpgbji3DOU4*m!P=I2zy|JriWKvvZnwFfqUOz#R#sUBHRx0!(a
z&foIukIud_Hp!dTge+L)p9(o#s!W%H#P7PIYjs(CP+y(~8t&K5A{B)oH)0w+?Bxh1
zZh|``_g@oag-Jh<Ijod?%l&p@ypmlW^EwdTtBPpDQfqB)Ct+Eto6q-E>3rtyK6FZP
zjo%1sejK#&bC1mFBX+m0ZG<HQwPC#raR&D7VR11VGa(k~3);FM36f8hw}=rDL)(^o
z)h%-j{%DE93*UVuYU#uGX!j6aC9KPurnuEfk#0^#(hQCTfknXMt#>lv^WHvl#G_xQ
zS~aL73ki*^moa)r{ueylL{0;5EelQ~x89`GuO@yn2V$`5g-dJ&8}Rh!LJQ+O*6Jqh
zfv;rD)?Ae;|0d5qCv1`!p!Bl(+p^af_#wH1<xKP2Uo~`a?L+LlGGFulYF0p+?3@RJ
z=8(N^*>aOuB=PmtY#hAqE6MYU0!rScSJ)kCMUZ8u?mx<k%?Rc$$y(@{?aTY#j6quF
zS2_W&Ok1(G7jtfx=9CP{(Z1}oU|pz(n%HTPi{#TsP8mYkr$Y5u{p!;MdYuV$lk|Cz
z_*E(v=H2xUR0gLz(2a7#6SB`^3|Bk&`MrCI`{iky+JO!W^G!!>_D${H;#V6r5AL6^
zz3GJ+@{IJ|=iTmU9P%VGSss{uW8oQby?Mh3T^Oz&)p^CydP(SY)}h7Po?VU{hAmhh
z+3l9%9ja@o*l)o|mEyISwPyP?B>&>4;rm2v(LrTzBMTVUIvx-`)?=nzyPd{-r!Gy0
zYPO?L)!!uSt&ST(d$ZyiBS?@#SwV+?cl8+k$D}Lqg_e=uUh8TA;c*5>+5F7PZQDer
zc1;B2-CWXQ_3&f+NJFPJ{arw>EZ++8z!7W<_0F~6y6K8>iJEYw-O{D?8g)@K{K#6K
zS#k%m)7JcW<MThKFuzE1VET(5?0l;Zn6lY6a7bNI-Z)Ocdge-PT#aK*ca6H`>D_8b
zY_8;)t~4&@n6toGw0@4cqcF(lVCo}5PISsHuBwgb+f=F0IcC1+Unkzm#0LA=1=E>4
zk-AWzVTm*437_i4$x6SR=%K(u8U1SE6>4rL;=Wbb((zX@#H(SD(NkV4t^~R^RR`8J
zZ42W^f1%)0;y<(iC+0HIMbX6Gp7T{h<z~$`y49*o-FuI2w_L$!e0PR-&K()9AosnQ
z>d_>Qmpd%@(|xG>Dnic!;KsK^;`>4xVtq6Kk0ba~yWK6FV_xGMhM4as4?!`wq?>oj
zXQZ%*J-+tvU--9HY0p9)uV>&vwQ*~bAM#mS2{|gL{ZPdmq#)Zz=VmQdDDr1k1zy#y
z@s}0h?zvyD9{uShwC`zuN(D@*`bq|CHo>x?=LRj-WlGKPb$U-_v21AEY9WR<gCw{M
zI%6b;h#2|hxh~q$Lw0Vj6>%bIW$@RZu7lA8A}UHRk5g`=fHU6n<hfcLh4hX2sdhLZ
zcI4JhzK{T;e@vwFNZbYS+6k-j3kHV;2~WJ;5aqQuE~<cRYxs0&4B2F~kUn)Rl6=R|
zGD4lsE}pcLV66-0+rpcAm+kb5^eLvk$IUIfJ&35$K=s!f+FejSj(%?!VTcL<m}vB~
zDHWGML`<>$5C0G~s6}X6YidqVQ!UPzKFY&e?3p!ueJo{Bo~9+LoY@G8kJY%OU7eyk
zx;v82qu2wFr2~TT8IjimJL0@mKWdL&S&CmGvl~3PRtxC;&RC5Wf(+87%EvX6N1KN5
ztO+;9<a$I{cH40268kS;8J^jZezo5}kDB+-UC(51JA3xEJ4A>ryPek7rRhesBd?2H
zN0%qXRQ9pf69L4Bt(IpJj7=As@Fb&A_>j~S3|wRpf{}d;)@nh#^)$Sh#)BF6uc`r*
zX9=c%5g3I{6L*%F(3!mw^N_}6qm>xde1qrinw^MiDtRS6c|P+SnfZkJ>h3No1A6H>
z=XzvRpC7Ekp6>8Qo%PlM!>^f}1$pOFD2n^b;b@b{Q`Dl!Uo7(!Ts{Wuy?|PigKgc4
zipej9X7zP%p8DYjUP-nrIwoc8u8~}d&=ID47!r8W-~P*%_t#XzyX?o2r&?l0SAdDe
z9&tQr4}C>P%EH5f<7M+rdUPYuo-WCe1+j%riAnK%lNJ(l+86_zCl}z@U>p7TfC%^7
z7F;3r9x_UF=U0EkX1IXK!F*qX2-&Bro(IWln?H?G$X?weUf&X9@}toNZ0D0Qj=#Fs
z?#W7;kdb#UD=|(q+D+XxWl_gViq?rdwz_ZBfR&$uen!`4hKt{`l<pgO_9hmz=GO8i
z-9KEke^)M<MA~@;ayw~s>&TmZW{i{%=5C+-yjyG3|1n^;-o9amtE;Sq1FLqfNZ98+
z*69_-GT`!bP4&`%pR!j@Vr@?%&Ye$%*cdt7pq@i#?_Ldw*fdX-?NV>$+_N9ZOH#@e
z2DLrc7^wsg0dHHVytR(dQ!NZkj1?py<(X+8M~dgiqa0%!;)#7H6s3$S3nuMSX`Av`
zsrA%q-zv>m+nL(8pA-=wZzY!ED$+X1GkvI*YYO&a&r=v5aXktED0xXMe8gRWi5AY!
zxA#Y$>+0iPCYb;iy-#`dTn^tzCTjoWjOQFB4w)cUSf0q~EoG*<76h@oGki^kg|`9h
zqvcJyQd)`8{p5B-UVU2+OkJ=pGDTv+G^yLFzFYj9scL2Rc=TmNcnqULMHPhso2OS3
zC!Eg!vts~S!vLWnyf4-_7tZ;?_t-O>?3fz#NAI;f|KL)Y{VF<u8~wi2fllz86Qgn0
zFXX^U1KygI#yjie1N!Wd2iCIF4^c~t&y7vw{5-Qwu$IEaHbm&4Qlb3Bp5{FxdSn*F
zCU8;m5U_6pPxChFDfegZY@LAMT|2>?hW(3{=h4;QMQ}M;SC#s%Ci(G94k1|a-GO!L
z8(nr%ZIi5M{h-Ofd8d$iljLKVaxEzl*a>pG`f2CGFr2HlF*E)#%%nON_k(xkR>Z84
z`m4ZW`yCW7g~<5F(CnA3O}Ajb=$-|H<oJg<=)FgU7a61%TNlK0CFH}ggx;!LVvODv
za;r(F9L1+&$z%S(ceNUL*V+w4Eg1sz6JdqybSg>*?_ZC}0wd-BDL2f<kM&~w5qBT8
zF$_HFkm$`gdp&15224Mb?E|I~|L$g$)1sVW!*N>+R<XL>3ARURhS`VrNQMR)b(^T&
zQt(E%l_`CbrBMKwr0rDm(z3r$>=aRxqwXN0zQ7i!cLrDq6o!yUe+*OmBHD(O3c&h6
zgx@Kz!p6lO(!{lyIbhn!(zQ<;+<HVLRr!VGBxy=mo7hRO;+<cE*(oCAA&EMrA7Di?
z)Zcaz_sbFIZba|iSU!3GOgE*V5yl8S{iNXWHu>|qh%tn<ls#=xvr?>-OpCkO;YT^6
zH`ZD1rnqmPoeXhU3(az~!Z>T>nO<o-AIw$F@RcXXavFI}h=u+#d#SZq%-gPzOYz2)
z$9Y7+e&yw7*=&F4wt;=-Su~!k-}OLfDM%xbQrp6&ycMBgA{LQ-hrp%ogx3%38KzOl
z7;A0kbGhPZ&6JlcUs#dB{_JNZz<F16`g`>2qxKuO3GdzNO*{nFa&+!{Ekz)3Iy%fv
zztgzbDF3eVtWzw<j3}YRMKipyT~~Paqr&u6tZ`uK5Y`s$hkIYK)V8}XbXwBv1^Fr&
zNbcS@k-it{m#W7;N8M;rB_3-{$lK$I;PZFgLVdEVI|2Rj^lg??suB^pG`#Qex;)1|
zj3=0BEK_rC$r71dCIWxY*%d55wwStJC?_{`lVw68@5vmmW{vR=mG11@(`#3R;RHDD
z`V;hT{9+(#4!YPHHE;7E{^lN5TBjCp9(?=o+xeq}?2_b>uBRdW1(_6DnVw9Ij0%OH
zY!v{QgE*HckIk%`$FulKFz>5d$ga{;YDBqxONw<Rz^^xZQ1oB{sli8#Mmmw;Ba=X*
zuQtMW1qhl$J#S_IjK1npuES<G=KOEBvbJ(lAn(N54KD+D-*&X7LdlmfLnK#?K0<Je
z<&pBLJ$D<>_rPExTl?LO@q$Rgcj3G@{cT6qGBeSv0gufG+JZH{$IIjzS<RNk))bh{
zVp?FnW8g#Aqf1Ep4hWsH;o3eXDPTD|eCoOFS$2~wVEN+@*mV4X)6HPjY~xX;<u+^k
z^C^P9FVg?mgjm{*q~GB=-@U#ob>AJ#6jJRvE!=PU;XOPZkSVuZ_?KE#h*Vv8c+M8M
zOHI=zBGqRQ`H`N1MBK_%vFis)8(zHoZ@nBn<TkjgaxZe@)SL&gtpn_fOM#!At-Ysv
z^r;oHzQU%1saAfvp)DqGEKpZ{8v~M;iM$5f&s;sF_=HImQd7BfTvH)=uehR$3TWv9
z`sn;*ayugr$c;2UD0Vm-8vC+7v))5|SSX-x8}_luF9Ed!20Ou}DmOfK_jwc3+25&~
zy3`#}p<e}e3ztjdExYcwsh6)mj9l{n18#H`pCw#@f!@D+v=dXND5+SWO0!`aIq7HG
zvp%iU?x<u*#v1a;G&-MDayp3cu=uh(5+C?=Wl1cmVXl&!PmaMn=n3_{sbN#N4eINA
zjsoffTEF!H^_S~&blI2od8D=d%v0>5{AKQ#8>5o<2nLIxg!Z>bir|QcQlbcof?;w=
zlM@-soML|>z@KMpZ&&i<{aEjS%a?XFd&R1f8mhy!6F-aCI~RDD($(8r&k>qs^&SW6
z!6zW^1?w2H@vxn}gIvBW$<wLxBBrLR8x_OcM!P7hQuW3mOyOIcLVHaVz0bSEC+ISK
z#m+!IoYO{_#>fxn*iI%PM}g4{d+a-hM0C@5jOxdqSIA8Gw+8wwm0-=+;`Z*sN(VF6
zUwFo%VrB<yFxp2!X0}MrZv6HJEh~4>adscrsiQ@VCl_a>ojGV_{|}>XSd!>M;Ju3L
zC1`QHpnpi<F^&P7wq7sBQErZ6YGm(+4R;j%>Cc+ai;A2&r5yKNnY-T*-M&d}!C#qj
zz_XzWA@^9n=|4MRvn+uYJDPzYTRrjA0x5t#)-fQL*g0Ce(uu%5qQ&p?v^D25yVC7q
zxQ=+bB_CH;xW4d&Y(pF8^qx48m%+emK<YbEaylaKxK^=SPj(*fZAFeUE}Xe5f#lp%
zRYje#F=h+VBVQfQ)rT3wrwg-V+#?O<ry4Cw=m7z?cND<*)8*&?)XR~9p+bb@3-t-h
z#eHw~V8xh|bc`St8l1k;-4`M6>KhfJR6{jALCcymTMXpHrZ2`w8WM;FuRgrf&F+CT
zk09KNZk-XeIxESTF90Xjxe0O&GOGZ@y(>m0>ivz1m2Tp(y@_)peq*z@yDgf{oMM|T
z?#{4;G1pz6OI6#;xuFuZC<&oNd)#Dx=Qe|t!KhObS=`-i4c_Kk6)NChAdmv!Rb{hK
zqo2e9(_Du=Vgx2g|6a`tlP`aCA@`(NxAozX(~3TEw0+yjhe_6R?&XVz<+{Q<Yq*k|
z`H!0aKs64X>P_gVKN8SO^`KYT4|+aDM7;YEuy6NkRWboK?AK8=aF11G-jJu-I#~46
z!X6<kBAmQ@U?Xb8Ve@&wVYef5ZhLRD&0<@sa<ULemcu4y)>V^7_*u3uCu1ac_e)1D
zi9H+#f$1D7$?H$bi!W2_@u*o<l0_GKN>$96wE;>=CqZlgr@QACZ)bK9TNy@+Z{Lu2
zs~SWE>KEH-?oRprddjWUALA6gL%S&aOj28bOjzG~rpZ5?LPS<dT%><N2=rO+yKj~2
z{&QUddy|DOr8I&H1|6v3NfCatiQA)P2l;(DDze7FCsg8cA~{2>f$>ibvF3+%Wc*>N
zgOmHu39K6&XcLNNoH7Q8USy57j)uRebvsZff$FPC9;s4pL<>nZ)hJQQ#^<f1F9;>o
z(Kd<m6WPy}yUGf!6AQF~AfAn<uhPW#t&q1jt~{t9+mD}Y4@YAj5wTGX<EI}#4o7Rv
zUhB3|^X~%#Oorry^3<#A_?=MU6lDhW1NBs--(YvbN%|`@(p|Y<WU0~E_tITv@D1t(
z(i{pn{9qoR@oxP92Dv+)Pom>&xHXgbynonzzPveVFEIaHNE#DvWg5r+*wMs##_B*O
zY*h?kg;IdQQ-38Lq!CjsPlvU<U6fd68I)`F6`o=du6@LEvSgXKSSSGiK(2XGt$I1k
z(#+1ev*naMKmcu<1;Nsds^<U!HFm?%7%Fj+HwVX2@x<&w<&WO@6b_aDc_mi*a)|cw
z;tKRLE~6%MP*yVC{V}alAS*Qp@q`ytr^gPpON{Bl=`m7kVn+vu#{-3)5@AR%>avN$
zDZ+|#KPSmUyx1bX{ZlXQ2M=y#9)$Y^fCKzC(}+;ao*^eu$0@{5cVgsl*Kk`veI7~@
z;(1SK5h!nKY^uK}f4=H=ysg&SHv4E_UkZ`_eg_{m^J*|xOyjE{fu6Z_0CV~)gl?QV
zZl$FSfmhn1d>l!kvQf9oFEC3L=(#gV*lvs*bnw)gs<P=%rdE@3!aXjiFZ3CT{niHU
z6~$BS+Ma2qoXLFI-+QRT^P%P!bE{i@8>n14nZL?mO$NxdXtj=0Ex3%AbU-yHpVX+9
zimuTrc1aHl{(OG&=^KS|U7Uot$H}vqx>?Ka{93PO=kA<iB39C=)}TR8=fMb1r@_ur
z3A4^bS`CA-Ar>(|)uDo|VJ>ZV8^sS9MZT@~JhgyH+;cUonm2`eQ<+ts&O=N-_z_5O
zn50%yO<Kc+Qt~m9e7;H^W4ZN`<ypN=zYYdAQ^G3od^Aqp55-Z|%6h$!+`?R-HQy$t
z35mFP$&h3RWx}sVQ|bb%_a9>3N;vgv`LJ48VEbj=(=hL|Xw-myNuF<J^P|%RxNXcd
z+%z|7={Iio*>8rZ3BGyTi>7zE^>jjJE}HEOCd}`ZPpb*}Y9!3^{?IM!M;1sno8R!j
z9ewJpLh>fX+}@yv%6z6kDFRWOMN@|DjB@=w1|nh*O}Cwf5~#HBh@UbY@<IZ6g~E1C
zCGFXo?aPNxu2dN!m#&I4oFVy_iwjDwt<9RFXoCu?V&%zlRH(=j!&|7QY<{Uebujsc
zxkbh|r=fi4`t__sCW;WWXL;d01syKSM9g2Kv=**|4HG1SOC*rW^LmAe-jl7ihLC1w
zpMe#T`JO14<5E6cgLyU*Yt=pH=h3y@0Am-B#5An(>w7MURhe`%%w`_Uz^*U1uhhuZ
zdWX!fQ3b^qjAuLSDL0dIk#<sT9DQV)+T$0VE$Zw7{(p_*WabKy+bEltPbV>Bx5r&X
zZd8%~+5U8{7%yIwr><%?-1kJ$$*$ZtiFfN(75B%2u~>%Zc5;=+iK%eWuPl0x_spIm
zmV&=Ym=ZBxoN{S8z_>nuO#`DTf3jL{F6JmfQ+PD2pwQlRO{&xuK|HvoP`LrywKAlH
zslLAme0Rae?4~ZLaG!=`ih1k-Bwo|PD?SVC_CmIV4nEgs<Fu3tpE8dAB3(!PQM1@3
z^v|2F0I^Tw4GE`J-I2U=%5QOU<Xgr-F8Us(OKMQLCaZ;kQ6a+=t_u&DL59LeT`Ms<
z|H47dE!hhae12_DairgEV^_?#v!knWAS~Jzaz-E3>9QbjBeJBW_}%9$W5%Fesdec5
zJgC50=YnTB3rg_rgIQjZ9-*E7JZ2+`Ao5AwZNB)r(D&AErxyG2flOTyMlQAlLQc++
z54A~?UPd0-Y!|R{@!$j3m0iVN`dN8T({^`Q+Kt29n!G|OseGdfvWUhj<cwO-@NsLC
za;v6a>^}aMdln9&y@tgKk{5pkYrHOY=pW{}jB>j4^{~qb+R&?40yea_xRb)A5B1T*
z4nup_l|!fZDZ^<H9q-OX4_lNVp>T{}`l;mME`&|MyCPHHbKRBhX4=y6dcHKO6?>i_
zyGhzhJBdx-S2l;0_qSg+QM1CbA39!&*`Gn*&BBk_8HkDT@cwRXt60P{3kZK@97hlE
z4)5ze1SVi|qblh~D*;opxujqpx99T@W7QTE^p%_=9VOUDaP1Aj4MJF`UDPy+s689y
zd_eJgCO<(l2q16Gy9npHBxPYZ#zaaRFXKgSmH2qAATcW!8G;Qi5>cSxt~01Z_Y~PW
zK2cqJQ#-c9XxsqE7ar1piMqJm+gGf?Dkn{$tK`MY{BZg)Z0SU<P3*39yX(*;hP=F9
zxBg=EG-V*QmOYb4iJUinqF9H6u~l|u&eE^`>oPO6>}IG>d)=ph6j|*z(Ev@~53WFg
zXxQf)=?lyJtjZ)2Gv8<L0U(YocJnRz+hv%ShsdS%+v1(7&dh%fDt@m>-}%;kr7-Dz
zTZyui!-N|M-ToPkFwn03!7`bb)<=<*{-(t5#88x_G^RnXQe4o~)NP`GEMA}XAZ}Zs
z0oP@s+Iw_@ok%JY4;c_x;kB7cCvTH=<d<)(UiWULUWd({OLrL~^@x#qNoqNDXzlhA
zN3kLMpY8&~bPsZh>1Q;<W`7<8S`+@;SHt+>p=4#`{>*Uo-hIv!PsGS58fzI@xyh)5
z?R%wabDH^s&XZ5A?ng#CxJy*4Sl*~Xg^M|p$W$05IeDD@M^+&&n5Rzh#&*X_d4QGw
z_6G@-T=L+|56XfkjG4X4!OZ4ufQtk0wZ)>sM{P&9iYP+)!B5Zw>&bcH_o5;Y8hBiZ
zkITO;DgU{C{KIJaufe5EqJT#k!-KhUKh5;LIivJ_X7{WtzDhJ}oSa!}1aC{{5p$w_
zNww!zc3&`#idtOccn=#rLS@{4_hONqh>2oxCK75@t)#yI4@SRzT8a(Q{^|An%ViUu
zS(u+zjvp5$S@Fi<7XY(Y2ITV(d&^)+61fv??@3&}>ButHuYdnLzqE7-kN8fC?kgnQ
z9AD}jgROAsRP(ZL2&2ubVDLZ1m;ZVhjdQP8+X>Zonz<mqVZK`|Hphl2pD@39Xyz0X
zvb7lF&DHhFiVE@2h$^7F=O)Ps6fFLy)_Xr~OMPtNmCStProsGST{+voo-pp+`<JIw
zCYdw3JvrJ2k}U?82Zn8VG4XZI^1o*o<4N(Jl*9JK`alb%h<JUEIsQgGp0YCRC6_>R
zT25Er!sUPob5iZxeC4%OExnA~9Ruvz`mc}jU*GGmzj8ge4UY+(U#Fkmh7S6%)!3sr
zllD%_(<Caxs-2n5#hB!<b~v%y8)WU91{8QI;+1l61-5hIcBx745`w`}pQ)TDH@-J@
z5PEU_I_z)0c=!6hd7^*14Q`VDIV~Oo6gX(2Jp!Zr3F=`~<#Q_}`!eGvE7_P~h~W)|
ziS=e#Ohp>A;jg>hIL>TyugPD}O8Q0|3w`mH*hvw2wKbD}KEU&v{ikNFT3c<@^8dwH
zk!H|*z%LoFCg!uk{|pma&53Y7&J0Cy`Fw#0-A-TI%U|!Z#0chnGs1f;S3>n#Nj8_n
zg=9+PV~L52%6Jx?XZ%!|ecxVmRN1^--yT(kuhdJ`1pw0bCJh@X{oUgFkFWPXmtGE%
z{$pZc;|bA0EmXl<jo%rLKQJH^yHB<6Bmj1t@2#-d$i`fjaK>X?^FpSDO5Fyw6Uzow
zFgPo@8)+!$se>z3+!f<gU96ZS2L<e0xlU9%SEs@+WS^LPd_ww<%lm(G2f3lY+rMM}
zSo708zkLRn4)ESEe#sk&ecPrY>W`S)_<mRd<nDC^807qUTVgV*GCLUFxE*2?a6QM&
ztA7&^`YN@?Qn)bF>V`3>g6S#CBHlsuSX(Tw->uE;qQSFIK(HL=sM%<mB&R<9x%1X~
zWhl9gslOWk&B?;Rm^Zb>&{5JBybQfr+6$ZP6@wYEh&lHdGx}z(3%O??eU_4od7t;N
z=!5W|zIgEv|2aZ?N|l_mCTepaPDB&UbOX=KQ_aV@&F(x{ufg2KWowOeIaFL{-5g3%
zBNV?P76FhA@k^+=62%#Xl`DBxsjYkTANb}^$yK%8oD%}G8=eBI-tgD9zvOj4l&l(S
z3v{=F9`5rzOj!eIVnv04d6;pu^2k<ly4jThD>P%vQ90pg|H`WUB@oD$Ucws+W~_`%
zx4fXqty%-&9#y4sEwlLtN5=5a#tT#*_WSf77<D^W+pjS>x}wP1@PndK4qP-MYCGRv
zkR5uuvC<AV_|p4#J6p$j(~}KdM!CD~Gs80c9OJj@>CG)zhBL~+R_(yh^G?rynW*=_
z+MGmv=xZ2k55y=>0wlRiQML!%8}>}#&FWs_3O5ohVVRkJlgM~#S#yHBKhQ-Lay}CA
zNLPhaG(~fDwb9;52OIp9&uMO<UVP?x6Y|VoFVoa=&0d-T|G_&N=d>DIs5T+5j-euU
zo4hdKGVA|hjIEjjnyWh>J<W9M)t{__r{8O=u-cIGG?}R8xA^m((RZY<ASu4>e(<2m
ztZ_<J<tZ;WYXr7)I}nBJxWR6<n_pl1Y+-BNon4ExikYWB3q`{h>kCz4pne9tysZsy
z*dl2esfAG)lVzZB%ir&_G9~Dz^sHK`>iZdk>3Gn%Ko)~~JICa9%x!Z^INFhUtNy(G
z+T!Ac&yGp3QWU^H_iYYU)pghy%S=J6m(ikmUnDJ}>k>MED%kGds4kE=_+&GR%A2gT
zB}1;F-Pae&jGMD)+)<&EIZ6^qpo0+RJlEz?r-KuAG185=C_r?_{li52*|N~$q=U@{
zGF7L`a=l7s^NoC!sy%=AtrPizAqg(sH+#`$Dj$}zy5$KuYL40vdkAyH>izp>*n0e!
zQD{QHP583F&g;Lt^vy4r<BTrLnzO$B`L(PdY`4UKOXCsUa<ZW0glYB3uH1&kLH(c%
zpwe6A#Fw6`85x%i&GNTGbXaX}Qj1Rvdw*tA^wfC{F-(Xv&8YnbO2*V@eI>aEwIc6&
z28D7Rmj`1w<Crup$C7Y_xCXGL+|*l_t?mtym|@BJY;cWH-=TUNtJC%{>#{^`%(L=#
zCjI3xGmmr+MB!wuyx;C(akV%0F8R?D4<~<(mLf({%1a-)r@ewdYCXEYe5zY&;Uiyk
zIVJ8_{|aC|ZOat=OhP7eqqNHW^tpc3r?1NCqP<eHxX+~&f;bvIpud~9wziaV4p$5-
zi{jf5RE@3L_vf?5O!$0)WpWE*ElL-Lgl3b}UW{gK>=IcS7F5}2Qty6D`pB?rB@T{(
z3^ZH!5#AEjYf=O+6==ndIv>xZmJcv%vUewo=4^^N=^jDy)(LbQP_dTjTw8W6Z?7*8
z_f|k=lLgOh#l`s>q&vPH(hBZmWE`f;i@k9yUX&Q{Bsb*7_G*r!_q#GaQnE+Bhf1`i
zsUvLWtIWe7xFU8d!geL;?j5YxfTm?1OKEOi-^1h@sJwE@Xhw6t{a{|Emua1(;F)n!
z+Zm!b*D=fuflca#MjXkFEPRFpZmsxAt?wB-qg9+_k>4k?9Y-3xF`EvwNs@~p%K|rT
zYZ9le?mB}3l|+q}<)L-h@?#N+Wg0P43><YjHs^=m7fw@jv`tyYjry1EB3Jr1jDC$O
zqFu0T0`W_gE{&Cjt+R2=fYc)C`oiCz-vt}=(+`di!s9HP{=k;(p)UQ^PAcM3qa)AV
z#Oj+O4W~~P-U~A4mgeM=2v`JhM~QofALRLmeC-pXZ+EmFI%|+dC=(e~%Tk>ziuiEl
z_!uHe=v<wHqe;HYMAs1izQ2D6p?gp2m~xZVA7#|PwrzVDzvAwyFw~pzBHd{r`Ff+R
zI<}gKL-Fhza}Pr>Z{yix{fo|1{ggJ;U~!&Bx*Y%Q8ZNDRoP;}1p<Z7889l$u0*7K(
zl)2efYPnLqghBJ!?F~JHP>pI|Su5?MZT_h%0ng4~MtFopukmDsbsKJ-<n!s&Q7;Ph
z>nmN_AwO&EmtPPJH5W<WIq;KKmw%zhvH2k(b!d>@&!&PqS<<9tpX`ljuHE9rGE0<K
z%Sal4Z*qV$rd|5(Zb86W31wVvYV0?$gg19GRhMrR_VZo&O9>Sxs>g^a&&P>9PXgaY
zh5#;6_*)l*%Uc(T=h&8kzVWg|Tx{vhmvI@(hYl=!@Y<t4np8sVMp$({snDlA+6z_`
z>>|F=Szcd1N$gj@qN5~UZ-3a&(UMLrWXnw3v_vZsd62Q%>Tx#FH>j<f6gR1B#Jns~
zAJNOaQHQXtHQzk$KwvY<;#EH&EAQdwdlGNNS5^dv>;&=|dl|SGd!nmH#ei-^@!Y8*
zm+DDLBKF2&ijNi<(Gam%kAc&%2Jf4VknyfCF@DkX8>{n!{_cC1^?sRlhz^K7`+0?s
z5e7RW0giO>zVjH%luBQ$RZs)uWTNPD`N2>}Fb&(*Ae6~JD01dzc`_y;hmK}_MY|YK
zvetX9?qy#*^9z>Y*uUyxc7?tl5cO#6Wx&BY?0G+LJ1R}sO$S&E#!gswT?;b1P}|%a
z8kQL)H)F)XsmnbC0djLgyNp6@#jX{n;j%MKiTsfn{9HsQe&v3U;*^*6QaAolq)Mvr
zyV9bq<x{OnC)eE~*FBwPv6T3(xwlD%JVPMEgM(`@JRnZhF^(x*cVR`Xo#?QkI=HPm
zwZDt`(EVB;ZNgOSm1n*2r_OE*)5D}<u)=u5X@y>coWwae4njOkp&~y9%AxbR@r|m7
zlxNX`zqBV}CgqgfcO9ct2fbN0<cOeM&t=d5=?sdwcaJi4kdim0U!@b+so3d>xZi&g
z<;6m;Iw`7o3sz3Xbg;QjutH&i=Ys2kFX^fOydD;IB}3|rl30g{@8}y1ibi!)RXpKj
zn&I1jAusUGaz|2zj$1_DCOI<w{<rx_Gp#5=;leHwTKX5o)y?qYMvC{>)B+093@;xX
z5Bj*>k|B16IS%^-SE{*;{qzX|o6)~+OSP>ZW%yKQ8kVdyb#1Qt6GaT_B^uP5I8#b^
zMk=QZfm)TD-()C9E9I~cKW*te)=5QnJ5Q=f@u06qrondGXOAK`H{^L9n3mhYr`XU`
zLbk=m-b4~;tW7wldWB;C3&nTWO-@)1{Q8k(<_RLq6ZL(c2tAxY^8Kz+$llk>h_m9n
zgzbmlgIPBB1`5&+E3hK|ccs+3A^C*qkoiL9ub=#YtQ0Drpe-%fyvgk)P;kXl!ytp!
z>T<taX9#lC##)f+S!Z70(^7m2M|6XuM8~vRo}JWjy=QnXeh+fSd(w6OI$!!vTNUbI
zu-N5sLQ<k)HO}-OGKuZ1h*{4SZ_lk$HJ}^%Yc9qX?InMqhs(Gt;d->+!rZ6oIZRT1
zi<T~TSVPm8e0DwPuR2{gPknsetLm$D>|0i3ye70SDE#be?$PuSz;p8?(5^(MOh<xK
zNyJgTaA-@rRk)=(29)qSRnRw{*@V%V?BUUI{j`!-h*yH$A8Wfg7GcJYE6d4;yxw>m
zEzKl&n43R~SNrAd;fH)<#AAPQDb<=RD?IlJy+Dt}(XLQmW^Yv>7>4dWbzE8MOS{a~
zoCLD(`gB5;E-C8xb#Pa+@a98voq?r1eK}EL#!VMAKaHc@#Y`7@hd7O1%Rba9U;bUV
zwwor}78IHGBKnXBAgO&UeeqD)Ba*l*+45kbAhCh@h?*>M(79Yb0`ewbs_wUE!S&@{
zrxH(`_0Tf655&#M_{?LG8Cq(vuTV1$@;;P=4M1+^k%+cfZ)G=WEyNSGRKZ@UqxjU#
zF_83!!g?vN?Vqb;r=ikmO;V`G!uB{|eLj=6Q6=<K$id@;qQ*+T-5AeNrA$k{<Xoz-
z0T;BSHLm?3hXAZO`v8F3CIuY1!~q{oPMR;Z^199^IL*w%ng<B_KR#Gbn8q;>wvP{U
zjg7WUzvLq0FeEds8cKRO<1QQ1;2=*7CpY#^F8kxrF@MrWH71j~eZDy&V(hvJjN_Q=
zrk-c1J`$Q*YsRs60_1vLGDaWYzjjNiwQd)lwxOjw4G8%md}Gz92EAO3O&%AHle~Gp
zq8rKSsBBSG7Ou_qaU~{{JH6&#qo7w0uKa2S+rMIzll->6ty4^<xm8liKY4wT-OcM9
zc}F_M8w7QUNRUecMSG8LDbRV*kl5(c!LT+}Td7jTYP8j%Sf{Gt1^KZ(i7l*%7X9p=
zb-cG}Xj6>FPNq7-@DiLXXsqM$b_Mt=s>aq>*YBr&Y!FpON3MRc1P!Aw>h^Xr$6A8b
z;R4%)q^aloxw#WoCd4!A{G$jq^!R4@&bPwl`PUK-U#&;-ccgJt(*U|SQpXjB4(f$^
zXzp8?@QD>{H_w`|ZERIfkuCWmYvvQ*1G4hi3Ot2F$wng}oROKR6UGpA#l|b~4MyE9
zV8X?~Fe--0{&kJ*md8QPS>|EK#GPtkB|!Hr`4Rg5*ixgX(E+Ci1mxvO*)hZ?aqsmF
z(vq(#QLm2My{-1M3ae?pm_TOHCEbe4MaPECIV@A`o-MYK>rhI$u0++d^?Rn|U$yF3
zN1|VbW%|v;5X}YQiNnKV`60be3-AYI74GL+_v!FE&3$YvIyiUQ7^!b+DY+F?SKGjz
z;9v@^zV7ahLl;9(jkg0M6dj|veLu5^hHj3^;<1^oU%1QCjfFDWtWUWt%*D&R(dF&^
zq3k_maRD@IN@Tnz!<*AdNpD@F02iXL`A^0%zETPnE&0h5Ysj5t%w5=B56fnY(Ju6t
z`(aHLj5?Niq=S}e&zPkrfSP@iH3Q&j=Bt_zhyRDMw{U9nUE8%Q6e$jEafblKiaViL
za7uA64#hn|3xonif=jVd+}*9Xlj06VgS+ca*X;M3wSH@VGw)x(gvpcVzR&A8&MTNY
z2(0`H{gO|<c=g(T#dxeC!vgK3K(EX{^2is|l3K;Wnh|^_k-+K+AT@%b^(At&iQJyW
zM!E(wwVhQK(Vj-7gSFdkFZ3b>4!yOEbbinXCPBZHAI{`>@HD8E8DlmyyXx$la#%0c
z*LrE;l}*iwYA_lS6TLA6e5R*+zm*uPEJ!y%$(Nl$?zMoy1)kB?DTC6-GKGFDG9<iS
zty0OhzMqe)C#Odak^vhmdsw^1H`2I5GbQ%KeCz2<U19O&ZuA#ygodC50bL<0*`$NU
zo2Rf1VWEq@!osiOvx0A`KIWzs@$&Q=lfE<+U!L*uQAvN^){>VFR@ZF4sJtz8T51%6
zoTMnrBF|cV_2p#V{O>&}3*p4+GvMQgvo+jkW<W6*#F=azK=kgAdPy_{IF)ac=}6r9
zH$h)JHKd1cb>++DF548wv1loS@<+T^ArP|>32PrvVo20d?7R0Oojz_SaUKw=wCtqZ
z*tBM}D$lmKmJ3v(&92hvQo7mWAAvYdho1nofC#d9MTYek$U()w<zIK8f2Aa!>AC-v
ze^t%<x`GI2U$KvcsLM_!HEAj?j%lJjBdUBO3UwKi>2a<W+0oUFRkjMgDDQpo!(m^K
zQYgD13|kCx78qrT!fjopB6u#a`N6Us84oQ={Bezl#Y~>9y$&oD0~Q8bvFezF(RL+t
zDd793t_EA>3F}H_VpCFHe>v?j?XL;q`(>J_{jJZmD!0M>Ae+WK#NZnvBD`SDtkP3Y
zVxp2$txkBJo}nV&vhvX%t&tu@`sdxvF5LNQr8{dc3npr)EryxwS;>x@=OD_xija}l
zp|@|%DU4&*V;}oG-Dv!Zj`(9#tBWXJGm*Y`fv3R|!ZnoJYxcGI;yHdy;7r9b6Fv+9
zkfH#$J?uE=d3p6VE#PzAK4IY6_fGiwMLW+hEVScfe@#U|=Vbxoc0pd+iU_eKJc&F{
zMmDfSUf}lG`^ufp%RAOY``Oyq`Bz~{oeFVX(!X|)_g+`)a$(i}o=xncCKr*nO}j0H
z#gq-_WOdFdSw0OnE<`;h$ETR7IDR3RO6V^WW{B7;+q}<Kn(&z=!FU~%)pn{JwDQO5
zB_CTNhmu7Xm1JK5Ppr<v+5R*aU=udS9GkV)E+~<L>I%gzXfKz>B>}*bIE7O*+)EG5
zR_5`%a2E)8K$-aTM_9a#yduFL>F-QvZ>>RC#wcad&2k*<8oHuGM!)&(a0<qMBrE6I
zYK`$VSmw^&A~#*H|B=LX$&0e-Z+26fjsy!xSkyU;3(!s<i;x4&BkkG2nLQl7vq2Ix
zW-pyPLi3meA9IdGysLMfpT7e3MzF}PnsseN$bXcW1MWlea=m~ghhTkp8u$2l`%QBb
z2%vODttcMtdvdIE;JqCa^ifYvbBPVzSd#jTy87sXK|kDpsv@05vmg^?&baaz23+rX
zStnlvsG%#fU*h}&?PWR-NqN|xb4Xn@^8;^QOozUZwE`$7RVQar7C~pJ>6Lo?l2!|m
z%UKmv{f@-Ui!(Ebo8o^zYgQRv6B&^uWsI7M>ffAHw4GC3qr&fC|LeLkvt60uGxR*f
z!dqW$OA=SfccKKiI6kJ2*5o2j;;kGNiCT<vibox&DgeOVy~LeI^ESzIMO!?Dl*`Y@
zbTE0Lkt>`AB}VdN;)|eA#nmoL2Fb557ebe=#~LxS^OhcuK^5QwJti-Je+3Bko3@#d
z*qLysRRC6g23Dl{5~)d~CQZBn-34AQ#~-Uv!PGXqz8-Qf)+$E|KA<rF>=G@)9E%8r
zcZIg#u3-ho{_~8@^NfVDL+r6$<Eeiv)coukbh5(D95@fnlVXMOkmnpHrXqnNH@r5=
z+J1!OEqQ;{O|^=T*hD9vb=RKm<8SF=iW542TcuZ6ANolvURr!n{s40+QkfGnKJTj<
z`7MV+q5pI^x5nIUlm@pQ=b~U2F)GGa4j&yDLOsuy6cmyEJ6pv66a3DMECpjFKKST4
z#UZ`O0`<Q3fqe=fUf@PMPtxi+u=(jyDH!rzo(9VGPUpTm&z_D-_6gl6wY+T>z=Wa_
zi=qRNtd%vpQt#A>>M`)q=+v>=+4dF~dE5-8{v~;?XJD~hDs3ApIIe=I_ntL@C?`gw
z+(nOyA#9gAH{HQi@1MEt|NbayWtu|%{({eHY+yx(DFm1IF$;G&k$aLb#fJWX1-OZS
zs%vptBLYFToXV66GaTYl8kaR!t833G<$sYfL7D8eP+AOfed{ueO^V>Em5a6<>Fx*`
z>Xiid9aS`PYHx&~cVsn0cy=g}pGGyw6rmMJ_B|B~e~oUKFvOiKzN{>^!4pw6uOL)y
z{gd*0(L$wzM3A`EAAIldnDZzPTYB?=Oa63Q@aMAY9R*M%UM!J=RwsHYOz;BbJolcN
zHn0FL`X!Fr{|lo`5eHmERO>29d<SP*>3|@JxE&yZX)6V`tXq=Te)tiK*|6TvXtACB
z%i+W(Mh>H>x1!G%O~65G4A1s<PYr68`)u^FwP&4I#U_p>l=@`$3R~jJE`rWGzel~h
z>Q+C3Op)?rldP=19RIMnMS>AaImUxP1lpjYQ8evFh69NCuCu7Jr-q2OUd#E~GqBkZ
z5VAxjVFi0zH;E6>vz>fq8X~aP^|q&oRAOmW_B7p7IaE+q67a=@hVUUSps|9iqR4N&
zoFNp-QjrMRj53-CTW+3<J@*5)IN-I*jBrwxO}<0J8w1;y-h7&ti}zR#y-etdP4-|(
z$xJ3<QMiDK>{yZfNWW}i>9XPDA|^Wvwfrd+YRb(3y|0iJm7tg?cBYeKoaaFa;P`X^
zi+0Tj)QZzq_CAOdJ?LUm3|an~lRQM6A4}PFW`1IhJm|b6R4i+$)Sue*>LJp6Q$2pj
z(p;a&Zn#C%5YHCKORu2mtk5vHh(fWVuWPmE$rm!T<AqJzWV|o08iL+KTO?Pw+mqA3
z)TVRZ&VfeN%5U4OiVD~qwQaN|=yd@Z!G$iptv{9(B3Ew<v5cHt_4ig_w6eYql=#oM
z`IjI5(<=~)FTU^C$O;wy8gM`O`9_ZfDQNo@w`>2JsgNLVgxwma;0fpL3^&DG9amMm
z;6|#;*?e!QQ-wvMDLwI7kaFg)QK1b)bS^%j%@^<6-}rk!gW2d@+3bj9S|{HpB3S{K
zGY*23t(h0rT#d{Y!E|nSe505Ic(P<q6Y?+igtgzWdCzszReuB5^4YsL_0)SSn*Q=#
zUG0$Yrj0^ENw#j;727V*ciL-^{A;s-ZO-3*57!`%0bE}rWIc<tL628aMm!HT#t<&z
zIj#s3ZMo9%li}OdQ<c35HckL46LdC&b3E={Ju7WIZ4N5|*iE8?o)BGnH3~o|TZBx3
zHDJS4`T{uUCac?1WA$}#cJLU!^x<};TbBq0P5qtA7?_ChB?`-Q5XjuapcMvUb29h2
z)((Y;`1%+ppSRwoZ&gwkQd2}gzZ_BHY$CHyqJ&;OtLGxe)KmB1JiKUdkxmMEDClpN
zZKEANNKWIe$}I9ZQHU!ERp&y~bO!|jUR5MAO?K*PF<ZDYq4Y)GpWJ8hCRvU6!~4uw
zH`Q@_rD&=#2Fs$KeO?|5^>iO04q{S_>-zA_c8dS8zc-a=Ig!+8D%yHy<$%LjrMg`(
zn?I8eubDrLQhlQP*;gKwxD=j+7f?Q9!XyE?SF44agJfiwe^6KY??qHFR@!%lVR%&W
za^%gTG!rxsALF$iNTV4rnpFwm`<)`;jw+X)l~c~aVV3$N!IIoRulom|Pvq?uy%cS(
z=7^}twkV-g5%6)Ml7eQCTQdK($xXV)3IkWmhJY4M0di*gJ*7@yy+lcQCE~l9C8)w?
zohzQ0?1I(leq%t(*%%npl81iSo*fpySV;ENH}~*8Upsxz@f{;Vs)(w%Q}68IDu#2g
zG)1(hhZ(MCitQ3G&2~AKxc8~fT*2F5@3&^@D;o1+3O`m|!%B@eny7}M$VB-|ukR|i
zxd3496b=DZ884_ZL?%%2Ha}lcLtO$6<oL8CG#)dvh&>#<+WDU@0M>_^_}9Qns8?;0
zs{%mrN%1uC=9|;ROS;41gnc1F*sg2qbaCmdCBc_|^o+AQE@3V{T(R{J!V!_hQ&&nY
zEzuIUdvv=o;9|yFw8-YmhGj)^jj;%IJGzEGM*xP`wB=8NZ~t-PMIvTR=vP1qWQXIy
z=oKjP?hhY3K{YG3sv;?;=-6-Z)cMgXtr0o8xN$KE`n8ycydcUuq4g}wdtQS!yR+*g
zA1ygJUFPq@CofX<veeg8VffWNpCA@VE`&v$g4Z*ZVO*k-PvVPxb`Irkbw!cslPHQa
zVq~qE_t=asy__T7t>Jzv_`qca2mNWeeBxHhpKHvD4&0p}%=B+!sgEavD!B<KeYj?Q
zpoHq%4jEnGeKogCwoyWo@9yyQdJI&_<7iblYkhXai%XSCg78^pDEstguW*3J+mGsU
zW`qelhe|ZIT{;N;KM6OI;I$Vrck<2FG>6o3mr_SOzV8#KB+tyX3Mcaq6NGQij|jSM
zqlkZ^FC}j{l(OPldFy3N2paV_xKlLUY8a4mIMJ;fU39O_5;fb<#LPM#?3T5D2srx$
za-0#M?dn1rSJjxtoAcE7vw2k8&f6XG`n`R2C&cj0rvrk}r3QqNA{T*(t=>|4>MvLv
z0fDU{sw!?~s3nsbJ7jrR>gk$5ym;kmw5Y>Dmhy%vcAG!{@;U!frNZlwMbw>=tKc4h
zVapA79eEnVJpfM}&+~!)<z@PB8fl(a!T1GuX%lo}I|KY{YiKUmQ1v9_;VwBMa(e+T
zt3zlC!giy#(;|vwfU%f3KUL94XuXvHqctx@5MK_;j!)AzI(@3l*&9p{L8QM<K={=i
z%x~Qs)B0$Lh6FE8FSqy^dL9RbNIib!{B-AB<|C-t%VpkYvKSsFu&$-=7E!i3)(j#(
zRT)m(AK3=_tlvL<P*mixcJi7?C!tO#<5*A=xwCuyd@0|d1kC%gb8XiGP59KT=H?8B
z2*C(ej}dsIwr!r!)&zfV!B-OQNMxIUhNCF;9#!&B`VYeg+a&9N5hO73)3Q!j|ITd?
z(I@qa#^CNU&S+^j{nkBH4R_lh|Bo2SVb)OF^vsj!3m=+Vfx|#-lCDxC3v2Wf6Hpfr
z**q&Mj!px$40JKNie#vk<60pN{;Y44zOAOhk^JAcKope9uqXNq8Ge|L4Rl#;`i%Eq
z6*f$#GyBsd{5g8m9ii15fsyz%7K&BmgxD^oZUpC}6*7Xft~frCQ?(5|dcwNvu0xc)
zqSjPiNEktf_DTCht`8BYlHOBS^;+fLa-GR+<a|j+KZ+LoMWaBoHz-D&DxgXM_8{-b
zwNRDtqA?m5XhB1ckN$M-)AX4u%1M54j2&xx4<Q~$$>xsW#d%`UhTUQ|Q!?w=(NkLq
zvy}Pw6Mty5E*i-wlIt^ia-isQDFMNz%!|ZfzX`xtlHfn>?#Rq7>#E(?3vAj}ysqhP
zw%3;#srUr8*B8?b?~6AtbIGL0M^jbCQVDUsL9YlwY?@Z(SzCSOJxCQfGHi9Nc%`M%
zT1l!f2lax)&v_jOAq?KE4@oD+xvx<6^_8K3lp+e`?~KYBH96B$@z}tHrcIhHx%S-b
zRsHxe6PGvujyE>$wLNJEyFI@INsVgt%AQu*k(JFPeL(O;L=4NAMRkYcuWCx_T7Z(C
z7!Q>jlfki3$T^{ik>uCW%dMj6Wa+_Phg2mBOGfGr+vcU<`Pve8U%MJ)h1JYPgUPip
zAzha-ATFp=nqSv+EZhAaz`n$1r>Tmo5qw)It*XZ2_HljBg(K=UDWHRB)mL(<#M>qh
z!M(2g+%7Ppp&V`7nyNW^ydlGvEb8I;t=n{H<}-H1ka#C-C<TrBvksq)xuaJqUxjH{
zL#l3n*k1)J^*o^>JfbthcFM8SZ{WI5U|8ar4p;!YFz}Cxe@BEn60&ae#uEE~XjSAl
ztaj>h0lH7TiwIj94PyFaOA9UCDoOEjf**HDk@7n*!r<wY(T{43k@ynw`W})mwCw##
zN23U!T<--4OrDiFLqlJpBbP?XNY#@)xMOddc&zs44aA$5y1A3sXcSJm!C8t>2^c1|
z6(<xBBFN`Rh))UaaAr_GF@E>8S~_M2A*WN|^t($!V}d6RV3S{rr>-s9%e?G8btFmx
z?7H>8>|9?$BJp(B0TH<Hu9qp(=I1S_t%_L04THClldr;K)#-WmS*P)ErFkfM3E#Vy
zk>EDdp<f2#`36KhgHX|lJXfTq*JJ+k>I}DDF@;A{*GBvGeE!5h2j~9>pZwp5rJM}?
zs(Aw$i1OehC@`e;we>`+3HzD%L{+>@O{Rr}ID~Lz<ev{JQvH$5vUKm~PPC|6xokgE
zw@bVjtrBzUdVx6~QsZD33(_-I6O2NSdGieV^jA|9RV7{(KyOkq?&{kbm2V&9O9G2u
z7y+-}PLD1;<(u%*{2{w_Zpu&ul8iUKu#c*-X?3Mkz)P=X6)u(N=pV8sG?@9abWi2D
z^aFB=h-I{ZN4+?8xBuA*TWx@|!iq3BI{|87y34(}5y)Nb$JH-N?n~;2O$TZ2J-!h|
zNlsk)qA#hu!G)~-GpRQD_9MuLU8~^3F&|Nx(@NDTR4Mu*p*d@vM=D#zRdNEK@DiJ2
zsiX#NJ1Tsp;=~LjqNT&9c(*h?Nk?+n=!)W?#h3TFECs$XoC5ED(<59Ly!vf;VDfWQ
z{YaNP;Gh^IMSF#Jsj6yq`DYr>1h@&02mA)63Rj&E`5m-P>|Pdj847y0wu%h5!z65f
z%Uq7w8DOaZi1-Sz`O>mfT7UHB8i#fu<@yYtV(4vrX-L%TaBI3Cj6|p9mX;jD&No8J
zbAo9^anN*5^Jay-TQuA@PWeX3muqRV^>Ga@l%pG)<Ex6|wh{t?k3^(5pT@4DN4zGr
zbPFlVx+qGg>vKBogL_aGb1U>S(uF~}%A{-RG=WWvBw=<!?#|LQuby5sZqM{QpGSfF
zN+cA27#ku=4=gHeRpy_V7vv1M<b?Y1V{^nX;qIX7oW|7;?f3$w*3wV0a43a(B5(oL
zGbs2fkE3grLNVB5gdZ<6jROgg5z;E?)cc6?DCfd%gTfz66?BCO@C`Zr{Om%MXJWXE
zL}eSL2Nm?@)|mJ!*4}<I_|VI-*$c>7@Vib6QU8GizLovzvNpk9A5CYZg?faW5VU}a
z{<&^8QCahRyMlX!mohUPttYN2gTz>{{^F~Wo{c~RUFs#Ldu{;*x^gLDjLTje@l&hm
z_Gp3fsFH1y-dqb?a#?cAkZl-G?U`sx(+z;4KOOmWUifya)i^D_b*kN?Uqt*mt8!Ui
z^zXIl9+=F@RfevQX`qzZ-2Fl0!S(;`FtvjNx>50ReV@90Q9{;_+Xz|9?EbdD`udQC
z%i`smxAdJdN>iZ?cJ@I}(>LhO7Oi7uFG(})a+STc89imTxtk<=Av8q2o_kxynxfm$
zSEC*tyMOr1OP2F<yq1ocC|y<HTLy45jLhJf`WpMrgp)k6>E_eB*H8PyfrU=19Be-E
z>f`;md<y?P)tHe)32%aWRQI7qbsoWb-U~gb!dKX?{lBq$=j22vUO<MW9%5b26pIan
zkqqyZN~A^Lh1_^<jdVj!fu#@qK1z@j4GhL>CPZGsx${BUbe)E{PGpQ{sQbGp3%m$|
zer~e++0?Bf$dM<CiBZWw_~VEm)c{+B!Q5&HJJ<QQN{y4Ynv?sPS-+LTsj|zhw|bYi
zay@5)&M@0O`;DK{VM0GmJa%u-2jZCNFp1dDswx$yM^e-V*87<;>kgtY^xS2~P8S5%
zyG34@b(OU-a!lWZxvxhR2%!|&E~nPCyxJGl{86qxQ}0{13m-BNFWj49)!G@4**?#<
z@;kXeR>6ESY;f(JS}e>UXnVEKFb+TYdf)vr3LJGUR*+yH3tp~lr!v!hYm5O*IbLB%
zQAFo>I-5+)&7I5+iMW{b^4+50Qs9SpZ6&6yogR^5oB#gqu<^r^5=N#H@scP`q0V7;
z?Y2qEXcpIDCiMi;cW|Ybz>*P;^aXNSy8Sj^^;k{<>v{}S#t^(@Yiw0FYVPaKa7kvL
z+$t~8TqDpj$Mia!1(UBx>uhtMxeR{By{l4*=sq(VN>h=!Z<YJJITl(%k2E2Dxleub
z>&+#{oNe0d9~N}e71Bo^ET+=8^=|t|EVo2kln$p4T44bDd$sSc*y)KJ=BqIu{PZ1@
zi$(UyXWyAbHKn(RQpOsnaEXw<8emM^_468=gkzOS-HyAgM}HPd^v&^o%(iJuEoB$H
zo){16e;fN!i1K@)z(+AQ-)bITU)2R-@8(bV1?AgyahD;MKa^Wjnai9ar`n|3sw&4p
z@0e2f>sTMSLAi%`OBl_jpV#N2x08l(azlw-47DH88kQbFHa~()#sB!>`7d4ro!=6_
z+|C}u1>Qv!3aq33Pp*$#pUmX6!0dG1c115(r`0x?=<JvGeAV^xEZeL<rqXKk=kVve
zuf9W=p;U+7f5iIN{9xXE+h{aYjM|Z65JgJQqwKh704^tzX|4i^HKK21GuJhK4?p?y
zzCv0s0Q=;35O5>a_2+$lK!PBr`CH-wdD4o=-Vt}w&U_NSu_>W2QBs+5Q$+S~X?)gN
z-63Ib97%pQzD;b_q{39I8jc_Gd`R;I5@6;zu`!d##2lTx^jh%Ib#R`$CRSRQb$KcF
zrfVDO-CvxMJliXb%?0+@J&f=yJ#IV3HLP!vL>)JmT^j29<XYcb(D!NJxKS|?OD5ws
zUW?zTNMn_$E|hfr-QXD}(gjHOJJ>epAvAjzGb<pQM^3;>(c(Jq?>anWxJ@p+;3GG^
zwDfyT%zUz}c&<TynFB0ll#^{}F`XEnRy@ElTRYpmqMXy~<zJCjxNtJsIX^dYxgHXH
zncfW3u6at5idARYcEif<=K$+<ExRqVO}xaDvZ>rvnQRMFu&xh*eh{9f(pPW!av3YR
z1hZS%o;I)Q9y-8>i(5>~D&Fi}L|;6rbDRzBIS-3?HDlgCSfGWu?(WCp+rOCqZ=9F%
z+4c#n$KfIVF7KRy<Z-(WMv3TYaTfITB$5!g81!XK39s~d*VEfYY&jsOXUb#MI1`vq
zscb!#Gn#igk(26zzT9<Da+-^%E87|E&apM}1EC^S!=NYWTCxHU+>S_K=S2?s)1G~z
z48K*8i7+Z1iK%q&#=Al?(n!Oa0i_R6r+YZ@^orQt;%zyP7Ug2nLCw*U^3}sm-ikO<
z(Is!8lJ)ldLsPlA%V9nOuZYJqX6=D>FL(M8uk|Ph{DZy<k^J%~((x{LovLQ9Y!ztD
zy?EjCX5vPnO}5vmkoY{vMNG3ll4norZ1?&`=HPqlY*iyF&UN-Rb&su{*o{RP7xV~k
zT_<_+80K4#e#V&dlEi6lcG~8+O>4=3lLLZ~>_ZP8T++u$B;Sf6`zNP+<v~-<{|F<O
zkhyC*@Y%BaS15N?M{|UWPSVcR{r!d$O*2(nM}An)yCBVF{W;M<v@>+0Y@H@oa_&qv
zg&l%qawbOlt6+dE?=_u@Ffk!OHgg_UCi$`3&vLwqpTsMl(>T|rAiH>t+02&_@25Tz
z(Y~obl^e&{4Udmi@!1(gy@_g?qTKG{8?EE3K-3xUtKl9Gng}i}$3YA82xI<jHuwKV
zoPYV@Jk9XqDJ8)BLq!u7;ZaRzev~mGN#z^kG8otk<<B7}djm`2;rm_XxkX>=fY6*q
z0855$LfOuSa6of)&K^Gz(I48`yAI2v8^kbdHi&cZi+1^CNHZys?<f7((eCJ6HH*$K
z;)z12tN&|&egeH57Aj8*l-~rVJ!ZrEue3@Tm8rFToV1EbdbrfyRP?s~OoU;Nb9znH
zr>Tvg-A1*dr&Tv*Tc4JFHd6Xu;oJrIefVuF<#5Q2HP+qul?qs6&8P&q2FrU-KbBKs
zilG^(&S#Qf`*ya0qMz>UIcT|vC}7&vF|Zc(Y2Vn^QH7^wuaJySRc3#_4-hE4Z%T)Z
zX8w6x|1XYPmdGC|J|2DdV|+x~4#j6AIPr9dbv@l!&dgs#ukiYGS*qx+E#jQ9#-0$_
z+(i9a*E3yLvq#~u?iygTyH2iA(W#xsO_6!-^uO`~xFlqLnLpTEsq7cQ+ei~JA3v|=
z(Tz>NjBwqs%4Q>iB^hTl^9Jzc;?qSlGcKPoapTFUeI=Gt6u!tD67#C^nL}o~|39M0
zzs-q0(njHPb%2%Dm?L_#DWSW-XrzmDR1k7pR#63Q>mk<T8&C&iR7Y1PY^FLRU8LZv
zwoQs+IY!MMd@pb6#QT4^NWH=L9~A!kH|ziLJ^qaHhcN<1Ka8Ln^s_jF*K4e)>@U=7
zXoO+BX#Mb%v+UEr^%YTM<c4V!4+O6%7YW{5l69+QaJl|I2YQlD(oy;A%Xp{68N*E7
z=d{lMSN?$u3i5wymgvWGaCW!~yuXOZ*dXmg5Hm7etrFJt1n4oi(tI1vO7tEPoa;q5
z8vZ70xEr;d6=+8nHrkDIF}fm4B4l9{Te`StozeKe`i!~g^hnQ3Y`k72@=@wx9AOk;
z6r`6^7S}CDOJhr9Cc{)GPh8<0qC*e!%@3rcBIOZPl0o4TT2J{AOjN!s2El8esdc|o
zPB9o5vj^I~&9izTNA{HRCRNa-QDrWk>s3MG@mNTaeELRKER$w}hHttEB<EARMCfNH
zg!IL{(QgHY+dVx2HL_j`zn^D29!7;b%%|8@U0DWRg*H4Qdr8IqLjwfo<LyjH#D2W@
z{t`&N-J&vy)+A>8!({|QBsZepTzeLTh+r7lTYGs9OJfxN9_h!bZwBm-H=c*9By0*1
zV<uzlf4`bGhPa=dv%=QIZuiI{Y=Fxuh><i9v5StJ<{DSgP5(gbio9Xrt;tPj?XNo|
zSGTy)FfgS2GeR8^K7C(VuTrp+o05^{<nn1WFs7AiPq#!#ScR8Q5gxg)EZU;H<fGH_
zSlprxN)OX-xN_)GHYWcI$P05nFfboHrHWO*q}6DhRB%U$^}ar3WSL`u)Ol<jEX5Nm
zOty(Ow01R4ZJXI`Oz#dE{rFM<HT~z4{tHB{cbBCJ#k!imf-BAiOD@Vi*}@=r9JFG*
zw&`LAy>(g-Ji_e4ibfNcnQ|WK))NFh$D^2ATd@5+Hp!b}5jH|9h}9%5R$CBU>Qk&@
zk?6VAOH49(>C0j5j(pNL(a%WUsrUQGRQlYy&$ik%{R;v&odZLzyNS5U@^jqC_!7sJ
zfeHs!i?X}DKhs|!<qIqdK^+-U9_`k<Rc;bq-`t5p&#b$@h)4@fXV1VwujPOXd?@Us
zaI%;qn9>)Db+9~+&&)Qrz>F|-jJ|ugJ*?a;nmk#kI^9UVR*|}~%<%F@W|F}V^&>Pv
z7mHek2Ca&e-k-kME;Y|?r+RwIS&!ys(W$?D#mcl?YCsowu+3bA6npgbcV1rKRl)9y
zS;rHNAT`yyGd@Hu$giIqvV$NygdjO0Wtlx<M>G1o?SWuhqwu2|5`dy5@ip=zLADR5
zm$|kWE<30ShJH*mV2&@EOwd&N+`GY;F3x8jq-sL(nA-Y#B$7gyd|SwTwUf(oiYM=x
zyAK*pd`fA{1Tt2=#Pa-L=yNTdeBWm#cvjw-1Il<m_EQx*m}PAxL9giWW1eo#E;-I$
zau0{YT}mGkNiMk2iMtekA@mgwy<7<Udq0wKJs6>}7JEE1CE@;@kEAGW+2If3Qd%X3
zTBR)yfZ1GAkL8Zr0f$|`_=4D;zK$0v$=`+3AyW-wEz{x!;I-EWsZNjoL&k5Xsh*HG
z6kWD_JpP(Q85Cv7HowGtOXc{(cCKF4Q2VTSSEVP0R4e0HyU3nUP_fKmck18ieHnP2
zlwGzkd)7;905v#w7<pi`L!UuAq@va`^lAAEB{^;21tD{2#^*OZJzVR?<C^;~uznp!
zN#e$88F`Kx?9Mr~x?kpa2Mu8GIrnn_A6eZB7uS0}>Subya2SbQHXFM3n~x^>S#7nP
z^w@BC={98yjnw;Bm+90+>$|xL&Nf?Tkvo1;)oHnLA>sd=RP23<jQVyRnxzK}y|SvU
zHG9);59QL6sahYEH-Wq$$_!D1J10l;WSbn_5>(`$@a<3IhuKa#y))ebLv})Et&J8k
zgI~u^?F$X!cf-aU9>`CS)ldWXfj52pHm%C@sE5%#Y;$r*UM@%c;Tf01fhm{8`tt)(
zzvCP&*?mu?oSTyA9J|AeAKESMlKfx2+*>-88WsIq{do#qcG>F{lP;jXL|Ac&hWat)
zbqfF2nORooc6&w-Yrda)Ny7Cb@$T+aMQ2J$D^uJ*z}cx_jBBTzrgR|nS|P`D9&plr
zd)Sry=O*dL-e`_NuBRy@5P;0cKD+_8Q5V9S>X0z&daIWg2=bSkHPrJc&|0%d^ti(B
zK5tGTciB6xlwOwGohpr|d48BMnc+t|i4pp5@6NxIq(_lwg0G&gad=pfj^O)e(c6(T
znCF6!N?Dv9_elxmg?CCe4NTy>Xygn?G10~L<o({l93r)PBkMWG&SjX$UgjDU=SG6Y
z<f{Pfx}Nm%kL@heM)zZxf$un=o$nL_+aYeLo(Yz2`?3^Of!H?`2GCsmIS`d_h=JrD
z>m4>aQY>4?$fDpxEpYD9LCE&9dkiiv3io}RHtL_~$VM7G55WLgHwJM)B-x5<3UlV!
z$N)dB#C4O~F0#7~9_rgHArvpLsV#VU7q*6OESqmhB(iPmx;F(9yWV<U;AA5RqCC!O
zQLAf}?<jWh33#`?(2{Ys=N?>J(*Y6w7o^XOA?)f1TnTolGkmUp)14C*m)g%by{xV3
ziAxMn+SLd}XC`gRpV&D062mqdjqGiq^Y(T!`?JzbJ2as05;$S^djVf?>%EXhp{^Pd
z$yaaH47e?tG!hsaFP*hD&}|H#^PN&wqpa#+GM8qnZy2+4MlxFD7?|&U_nbI6wvlOO
zjFzEpg3e?;7kc4a{=|6T!wlYr3Mp_b+D!E;fX{AjT{&f<Xvb3ca2?I{<WmyC`oC-^
z(OaB^ym%{{QhIJP&!uKa&iX7uSmFX%5awpSwYu@ulHbgEH@Aku|M`3G?=iCmo(pT}
z4SP|JGm3z`RQKHK#+E8Y^4ll^MGn~&T4{YFcGZt|vzYKEWW5egjGD5jqzn!fD^-c-
za<n}fm2*-YGLuDCjp!n^1?INLS~0yfE*&GT!NB}d$NLSZx1e|dnXgz>j2x_nOsDDI
ztfg4R0L2s*%#2Wc1c=hD`mdEi$ANayG8jDr)=z9}sKlywh%?bw=!u{_5NpjuiWYBa
zE;Vw^-rZoQ)T(y0hD>O#f~z8fx#Nl(i|UjCJf+N0!(Ozrr2O)!m)k(~C5TrLPl;a&
zT`L5bij;CZ?=R&uC@Hcm1u9f7(!0p2X7E8m&TO!lLGC;i*TTQpKk{Sb)185Pjz>fe
zpt0-9J{g?J?;v;iQn5{`YQb^|2%?c`r}2(>Zl~v(XGB~=EP~f@;~N)|9&+%~{kT8g
zk~rg+A05)3=v?mepIl{eFLcd)q#*RtONtZF(!!c?si@mOwDa;_Ui5)KziIux>1cd{
z;auOKEOXIX)M;pQpr3}~{n%2s*6MN5C2)Cm#tr}0s#ei`$sAh|u9WiQkMQ|^oe3d%
z`1FIMOkX(jS~k*NKk5CtywMTHK?o3PbhRRpT@h`d$+Z8E6Tl-IiZ{-98`m1u@h{2V
zdZlsBhw+n@w=}*=L`wu@=;rJ5qxC8S#XiC@!5@f3ZD~`-6DH5+F9%0MyM#WGyoy2a
z%gntUeP1L=X)bF5@}?Nb5B}j`ZjtEXdZm5)rBkru#ew@RjTyA_-Q6rU3iZVi)+QQ4
z2a$TndL&tS_{*5<wqKgd=|=xp6s68~mNsxAtFEJ@PLN|@Ov{jtF~ieh9V5s;ekTax
z*<Y2ll<L*qJ>o@p$biZFgvJFq32Ag!75NFqfGD+m81}jdgNsEcMA+0*O~$SD$MYK*
zA_NBn&1M{Sr-fG&Ppjg@?~oYZ3ohbzn=7PVS2VpT(=I#$wK286e0weuB<|0|+pcEQ
zHM8wBxaoC4L5ncb9#H>D2R-NA$@xtA=@nL6TU$)2`D++=s$q)^o7rebUKZ672dfTK
zR9mZngmnM&K2nhed!&-`L$g?4a);l3yU;8MUtXhVG8)OT4~7fEUrMzE89kXVrO*Q{
zjb->&%KP5#YcYSIK0PA$HIkDYSbF>o2D$6Z)|SkZKMn6?mnx5L*F2!2IU-_DA~PPV
zK_CVHlq|!<O`Tz4uk#J_u{IBW>xtqLy0Qw@GF65BQ%{m2!?exeI?0v=k|srqJ@23!
zHVfdQzEg^zPXJxRQNZJM9u-BVN%nNm&atOmLrRVVTzO;-SH)|+$<2lW(ufos)9M%@
z+u;h$5@<|L+_(MRT;3CA{!x7XOwE7Qw0KXL*vXXy!UqQ8qyNCwaMO5lGFI6=>axC@
zS_WUau+!Tpd0p0ED|^N`8FoIKmk}=V-S2+G5@}AwHG#S(0=ZPF!#V2n<5K$C2_a|D
z<R))hETS=nYn!&~f#~*`>x=oC8!SZU(<vlf1aN)fZnyUn3-J7qjHD>vuZr7#XSe=(
zBQYa2n8ENj`XSl@0{vY3tNw^Q^#ZjwvMimAVbkQ0FWs$K{PuEtbD;bwBuq;f#mo16
zO!|o4k~YvX!!p>iYM8<x>k_LLb6-un^=eNIwC5Db&qdiQb7qXDvc8g)*EgYax)G@?
zsy`p)g?`9W`oh6-=be)zFezJ{dabF5s2PKvC;K$t3D#HL`$howT1w>slcQDr06AS4
z@?I4r5pfM~!YOh9iKx>&5C&a}7(SXZ!bjm*0gSANx!>JLL4|diB{_tzRO+4Jm)Ms+
z4*eQC6u6paEgp|((0*K$m<JsLx4({#{SXo)UOi8IohSJ-H<{_jL6!=e6G&Dw*40rm
zaT14v1KCBje;gf;owrM0gh7~HEb%AJrP$XY*)ik#LHhHQ9V@b{@aGT`GgS&WN?*N=
z4jrC5|E?V$w@eZ(A^VS5<ql38b?nu7HR$)^v4B6&D6XfCv~582<XUSaZKiuxFuow}
zxQd6?F`}R+1TG$%u~lLdF{i4LN)hSnm3{qb{G`N3IPb5KU$0NMWj5P-|I3~CZ`TDM
z{x3Shju!+^x3ib*mP>9mF=oF<9@+lRjwkmSI*y)H5xe=&iKaM;_tHZyHeuhje`m4s
zeG5$S=)-Do0Y<vwUlwVFUU`_hN%<p;Pb9SM(LPO0FW1aE1!r;nhU~3CnLHN_Dvd9G
zhc2rohpq@IO`rbOOKdMrq#dAzqY9Qfrc3LM8~hE7;*N?9_JqQ2GfM}*G1E17cas>u
z%$Eex6etUA@K^@mVOyrTq!X|lHn`kASDnl?AOfY5aLSQf4X5(G*R4LF&a>(BuNr9;
z&&_A7?H}ug_b2Z}L`-L6n4MaZQm!-|w#L79XkP8}$k=N-_?oiuS2NksF_yAj-gTY5
zHAtJ6B|7JUhL~W8RLUg&kgS*JT5H#C@>K)9MRK{$TImN=hTvf9BpA|`Fz?PrzLWct
z<f_a^?uf|SyC7WtvLc4_>0*##77HETwYTxXTqxw}*^KF~-^MMUwU^6QKO!B!9fErh
zVO5n6&WhSyK7l<F`OpSP{dGI&-VYO-Ufp|W0T>KMAv(R&a(P{V7h@!eU8LP9cn-gb
z&IKE)Yz{+?M7MrOk~5E>U~JF@<Bs(weRhiFnd0c6)pwdi?mB2e_DxiX_r2*6OOH{E
zr0<M<e5FWy8s$0BYORsA_F7)vw|VC|w)Ii`*S(pYz7OcCVhTLPs6N{74l(k8pq6(W
zECy5fF!NGoMvBI>nCqPy+rwn_X{EmBJ;bKNP$#bssK!Z)PA&nFRCMjb=@iFPc`DoJ
zNd`!51c4v<fWer)3P9PT*qFZ(KSca>^mOn#!Ldf!OUZ$^m(E4RN#1L-GQYgO#T-SX
z)V)UcK|e>f;O&Tl-_b%b(AwA0X`Ub0PAj$|MG8>Yo5^E;@jKDeGyTL(TqtX%{NBUn
zxEQ(X?{-y4%U8B_=N5iR)Qgy@2%ABq46`n46xQ$4E}bZEbDo-(ll~ig4LqKq8`+%&
zVADx56GYUMfwNZ4mk$rvM@$>;*fh-A?oBz{Ah^q(dTe#yf7+ck%Kt`6I>YV^32I4j
zo)kHGz|*5}`}yW{!}+)8FI$&O-mZxD4ZKNz8p|!8PPT$#yl`FGD)f~q(E_{B`YO)6
z(KFYBM=<)e{meRvz-=?;<y)GeY$B-7Xt-Ah+R3+RL#Gw35v^xr#+8vC>++M*I2s(s
zDnP@Hu?MOShGTD<WFN~bHwmHtO#1%#5&B~t&>;ITPzf%mKCkii1BQdS2A6m5^5$fU
zeb(IiPv;Q}{mPrP?vyTw0j7z-W#ci6-@dRhJU6DnEUH09+{!mJxS|950sUE#+iJ=r
zW>wK`aj|^2+5HN|z1SUmRD?G0kxowPD86S<tS{Njx@Vsd4KmHk(s0pz-ys6iGiC<4
zqujvef^6UdjmBMl6L)TSV#*mB@*dwx0lC&)yQ8-Au*79>#2FRn0KT2o|7d!B@mt_4
zBh$8LH0HHq?gKi%3ScLKq+l>*a=t+S`Wt)hHU}yE*!o^oxmhc$SDt+OuZlZKdhSZ{
z_#i*gy1R;^M%7`N71JAqH6G_^7AiEYb=Q}bI!!KwF4Z+5hud_vTh_9^`fW7_v%n?t
zAtZQ@_JY-zc|_ghG!~{=;IRT%UVd1}=hWCHG{zw?p9=3s_HH&%`k>k<ZrrZQO7;!I
zCozv!Kju)Zh%XMteOhgdA~MpZ$79AT#1mv>;l!>mHPh52em#!d(CB@a>1#s&WDr_#
zIOxQfTCDJu%JDK;pmH-h0_WKLm{>9Hc|4T*tK(b$Vn3^ymVi9RoVUFCTai7a3M3pL
z!oF&Y5+Q+SeI{arorKpkrXPQ~-qTS!c5O-jel!eqF{1W665?%Vfr~`2!GTNO3L4C6
zwW%4ewWuV*>wkl}Mv{a^*sd+f-CBz>T$`#Q$ac@x=4+O_W{*^edv95eyX)mG^(o!E
z@Y&z+O$!+$dPuH{zn!i3yPr%XrvZ_H+a+HSl%jMD5{U@$GgqKO;+XIZ5Cy^SIL+}-
zQHQZ^rN~l^O0rK(x$_!nLlgnQczjzOrs+p)Wc&{+C#~u#)=MP(8u>dSt`I6DJ~9=5
z%sA-=ddW=SWxA04u0?@wZ5QlgapW#`Ud<g>?+0Sc1PF_EaGCMpc$*5k{`61!749QZ
z`|c^4G3MyEccDF1YSPGBI)~+zkUttrQWJKh4rxihxbu`;Z=$|KcnpuPi41o}2p`oO
zlq3u9&LkI_;I8N^E~Y_x21CwaWy)5V=m#$wO#-xQY9^XoPwG`wnb1S54vZq^A{LrL
zFKv-h!_;fk7pWdxMQl-8XV<2cC`hwuqz)vt+j8$I;9$D@+!R@5(UkRpLIrqU&odob
z-9n>bGvQXRdj|pVv$w5&CMpu;91$S&Xm*(A^ZU&^eC~MfZWNMYsCtN5QN#am3`(ds
zhRU_^8u^eANg|uvNE57!l$~!X9gH=Lx>N*iHWD@s2I#Q}OW?bOgaCq2wc%{V*v)-?
zEH};Eca&`INFC@^yip7I!eV#Y$Tw6IoPC;ReEv@y=Z_z*KNhYrSSF*6Cm_jNf$R|j
zH<TT5l+xoD<6x~M17*8oG}&-Wn>mB1?5IXM@)*q3dCz6xAgbZPE?pz{7p4q1{Ly$a
zq2Gw5-dTMuq02QzHP*0#Mw-IB#ZbQi=wcFiDDoC;Q^Y`XCpx6AdlL7)(K1w=K6AnM
z<=#!GuE;K;F_|YS+7^KiGv)2wiTXbVt%k?#atSE$>TG3eVC?4X#e>nI8e0lF4E@@M
zNafolo|tJx1YD9zl@0bdF}(#T`Q03&jm#6poVqV2Mbu|Q<370n2z_TN+exTItd8wV
z49b${$+wLeDyTun@AiJ@hMrypY?)aD2bY@MZ8v0p`O7;lWlHf3UQa*X6nP`vqw`cf
z_FZmt1CyIKY8<Qa4n64H&Fr(}yJy@Z?({NF2AV?v*ZBCoFDJ~9DM-xL`@s`uK3>zn
zAK{641_8p(6kS9m)8#qr-OJk*mh#ZAzdA{9c|<6V>**#?Bn(8}921}v4aSG-<_}&E
zr?9bvZ?RO^VF1e|_zygFI@ui~TAPu}GaDgu@uiDXjkXjj%LunqF|*#teJ*|eZG|`)
zxddp+NLK}&LEFAJv}eMcSu{NkHvA1gIIhB*oWl?(a}EbSZWZq5p~N2=+t&&l)Ga@i
zAL$j*pz-uM{5&uV{k>|nx`N#hLqc=+&7|_G;e~nxv_E>MhOFL2ZxeU+=Hw)Y9d`VU
zk=u;Kj3xGU)aL@I*eNR~b312|Q-kZML|w5@gXf#J64O&;`35al65o;!<C5CtV%@Uy
zaRCP5uNV))o(RYjq?0|kW${^YDanH!jusH1KBH$KobGyJ?HuxzTKlHMCE+y%2H8=m
z@=v^-P83|5r5CpE<hHO^$#8#{<0`7Z!>MYtuZjgLS}u@lpZ%~Z=B$VpuqUv~6|$^c
zLrU8Nc0w30XcUI52qmWWimr0#x+LmC@y=*WFjND}B}~ih8~X*;TE6J(TnG_iHr67c
zB(L5`V!pok*$fS;=EOL>uRN?q72m3DW~uGTby~9A0xOn%Z`oc_nO;Lv{`f%o`3^g}
zLSJ;eQ7_V1h73x8xmw%fqh5CTfs)FpQ*l;I>w8;^$7YsmE5C#iEagDyRt@plX^(|_
z%2MpVx2|2|2+C_?$5QwmI9|JtL?1p6vE|FELIlvk@nXe;sSFpCc8-kN0&ea>NneK?
zx#z($jPnbTmznrSxe5!{K5l^%u3bS9ABuIP9jlc~E8kN*;+tiuXjb9XE%V8CQNnqb
zIgt=oeD@a>gfLx&uK@0U_CH-Mzo+h$oB>O({cDkV1Qs9zmS!{N6c^Ppku!wg8jjp>
zspcyW^AWDgLhctlD)qh19!{?@Z=8{^B3mIh5Swu_339g&N^n5L#R4*Lu}!<eb$k1(
zkgWq0krSLv-(9WG_5&l0h$w{ln`Z5eC~A<8a%Ir37-@JtasJ*1oNIHlcPV?~OsfS7
z0?^B4z3tW7n;uM}SvWrIa_i%toE@bF?X?cTOQ2#XL{_ASKQ2{D?DmYV{W+mY$nU2P
zEdJ0x2I!%mp7~3rb~<GRzdY8B4wH{}N1+(>!#C+2`Ea<x9jBcuCLvr?n2=c7Xsp~j
zpHi<Bu*H(i(}C+2@-ak%uo-%c7dY|7s#6X31V%Ny-j;y(G1Gir*gX9!K=#hq;X*(n
z4q411Nb7u$?B~D1!U4NhzW+|;{!Ajo8@*S-HMt&AofC*}CbK3KpQg1;va@mbOLA@T
z#HG(gL`sPoLH!K<eY=b`0B>QTt_yZ3ZQJO6RzVNDJ;@|^ZCh;~z_@OnGbp97#YR<m
zRJS}WjH@_!3d1wUyTZHeBR!8YJ!vNr!A0i1l9V6d>Nk)3bG*LC?AFcIgk`v8p9$&6
zN|XjI<sMeLBVF?rZcSl8=9jylgxp1LX4V!^LY0Wkc-d*PkEVLO%6(%s+3gD=tZnU8
z%RU;hX3J7?*rF|^D2^bV+H*Nck?Rx^Wc#K^B&(STQ}WRQC-a)Ztc`;sys3qy7z^&%
z;eTbue4hsdi*PUDIno&l8s5liPVdLX+{y9UV{wZthEX`FuQS8z<=oPWb?cQoC$b5a
z_!X0|D4bz&8d&$>&Sfj_b#?b`1>W-=h7m54SRr3wcPjWqC}Xoq1eQ!NAI+I|$%h}G
z-q-0YHlmcB*^$)W@IhdenTvnCJOyDN+lI!#6Nrg^@s6x3i5b+T$FpRvC9>9cIPGt6
zZ#D+s2y^JJs&G>t<!^M}VwqeLrR~wI!#L*S>G_PuLh8GkGk}k0ghYJ310N|MWhaUZ
zVP37Un8N0~lXV6eH=JwnmN=TUeQvkaPWHRNS&QyxDLMpei_5HW+MT%8<PZR|`w}dy
z7k*Ui*vV&Sl)olSLNl}z+vS0q@{q%VcNTTe;HK#PV|lRIW}9p|3$ca5zHB_hzhYoT
z13*sup57Q7wS0w2eDtxb@AzlW<)5~ICqS$R-n+bu_=k?HG0RB6`eX8OMYBLaf?~*`
zRF0JCo%2c{d&E)L6lo5-3AT%Uqozfhx4>N4+Z|I_v)Mjk%Dc*1(MxxK*C7fy;B5)`
zHH$PEnwJiC7N)wV%+?tCUK)igD~M%cpqq*>NSNr~bl|Ebj1VjzVKW%u`wq3$tZE?G
zz9G^e&Z`A(%SRRLs6QR(WD0vInMKl^H^Zs68e9<0>nLO+6s0Q!N0H{qqW30r?_?(l
zl|^RlP=XfC()Ap+oV`Pg`Z#2P%~xWY0Y{|gwL@9ZY_`xmF+)>UigYn^*1RT$u9pw8
zq5cZ;@d+Pym=zZ^jIR7687=i9SZ=TLDrP$3@&fTI{KK|*C5K$6h&ym$VDTCKf*&Tm
zn@XXEF?ix{xF-%J8?9ws_>4|k%xPlK72acgMsY5f+)p!0W$(NQb+9pAT7wPP@$L%#
z>_6EH$>XP7c!TyjCOqmzlxAp0i@D-^(q!?N+}-=nZq#+?i%;+om?+CCz;3{sH@jxi
z(f1dGtLK21l;8fE9e-7YZ<VBpQA^-(Nqy1mlz_=1!}pTf>xttdA}m}!6QjK{)&#bn
zzXoT(5E|xXS}LpYG2x#AqJV#XJ<r;BocZ#@EU@6@wfzQ<GWFTa+0f+-ii>P>5M1PS
z-k{5D^LZMwtn7FF@3$hcc)_7?TXr9dhRvbU`6Yg7q!;#iFyl8h_iVlKY58DTv#$Ll
z!vkx@BTwKK!r(=6itPek-Gvo{Y864B0AG-qM4#F9ShvuWitCCiD?Ae1S{a%ebYFgF
z20}OTdoDWOU$V|(>VHYUb|sr8d-{TFo~Xy`((qE~XPSr3TN-yEDb_<wqnXrjt`H5`
zOBY^114l8j&h7Ab)-nu=5LsC*qa-HI0{xnV@Tn*vXdyNE3*?SrDDhme$@^afxMqM*
zZ<;%d!(@jk?+uYnjL@SL!{@Pd7m(YM*P~|mE85yR9Vpb9{N5{Rr-hzS+@`X&qT3kd
zPctq3FZuUUvzLRw`-DYc2h7Z*8TxYlYk8qeqFd!0Y(Oe{s1vdTO)9o{{Z#pw@vcuY
zDZ8eBMtzxtbNGn=AD2^LfOzc{sC(UE0~lM4>+sEy=V8+P2#t1%NSOa*s!!+f=euXO
zUD3`(rpOYy3bplUKCdZ^oevo<W17=KRyR{(e4{H1eJif>({GW?f>-3P457P_L=59V
zyuzm)(<tzQQx2vaU^b|cHDtPguvhlJr(_k~z}K;IMHPp^iAGQfo#YqpSUiinC)fLR
zpW+HxG9GJ+8q9v}>sldFtxJej{7gA=>B1c3eKc|jCNFPfA!KG%v=>#=Rvu08N%G{!
zP+4EraWN<*nea6*yP^|jvC3qqzw<4m-mqYW)QYTfrdecL<#~$?-?t7-tW~&}4Dlxp
zigtyhjr%TD!_sX1pXL3pQEIw>Ws6XRf7=<`t!>1Q!-wE0MXlk9M4i~`N@r{XIWt3H
z-$|U}X3Dx;`o@8A`Lwy*#NzcD`Rc<#*I#U<v_HdpJ}bnXaW)IgU3r?_pn#Mw4*dM8
zld0VY{;pndFh#h1rpyJ`1WGzAQV*E?kr1zXsyXZ#u^8jkM|omG_QfD)?QLzGXvJZ2
z8ll*WljVdn$sNNo%F|6b^!NNoxq(4KxbcWSTpGn;6j{F1=*ax$D_xOOD3N(iA@8}N
z{=V%Og%RX<x(Wt#M%>Zxl|}oJmrc6((eWHGE;YeFx5Z-63#H$Q=|nEAA7>e`>hZBu
zaRz#Lk866=*N^yKp~>!MAlI)1-5<?=a<*D*beI@-_NO~PrZ#64*F3eIDqUtZoo%U4
zY5=1V2GCUP=CTtfwj9V1DI{+kMeViHlku<d);br}re*(J6)bnC>yvcL{AzrC+<TY<
zI(#4bp%Vvcj=WSaiq?WFTJO!aD}=7QcToGxq2&Un8L3$*ju&nMH){tydT(v+PLGv2
zihzeqqrsQV_wA^crxw^M5|qXQcpb#Z-o1C<CuoNH-Q*3wANkVRUr)$ot%dlpT*8`h
z8_*_gc=1F`@B!T+miF2rg)7)#&@8~2U0pfi#>x0oe($M+n*b<;?7rb^VZm~}xl}IK
z|6%N{gWCT3^!*B@P#jt)?rsH&YoSGowYUa{QrsPiyL*uohvFKX;!bcUxCFNV3HD8Y
zyU%a-`RvZ@{`sC^hD<UiIj?i>>$<tjGF)=IucPAcS}Q%;6%JP<-l9VS6~@!693bVM
ze(6+F?ql#{>Q)R>E^fCmT7(|tH6E;$HRPKtcKh6)hQDneUEikzr80e&DeqT_sIAAP
zY+IWWkp9^$Y+Lu2n=c+U(O5115GrW2J~&SI=puYRL5Sku0JL;C$!2?1$mJTb%gGxb
z4sCdM%VSBuMH8Z=orh+V8t>nuRi_3LR4sQV=68&(`v#+aeGj!1Ej*`1brzIX;u^pG
zngk4rt?Ae;S*XlkOQk52tjm&%d2o+ezU4X<0FC_$)zZzM2wbBFUshSU-Zhl@Oo6x$
zyQZ~8_jfe<hyUZ3&x(_CZoAlScv@R|_?qMzUzzbDA$ZT9t*dnCaUFhR!b3*=BK$jr
zW|ChaMMZeF!Ojsp1yuKDGWnDsC_9Z?KJ_zF>PQ<;^^sBe?NJ4Wv0IR>-mH>|*oF_9
z<qZ<|ZmJ?;s&aPSi}O`MYQjpiJHoeAPI~5eeNUhN48=7_(JE_LPad8Ych~VfeQ5do
z_JqJDAcRo^i=OuWrZaA)NB3yf>X&+S3=TwGVuv|AqhhT(Omtx0bp5TC4i2?Bmvwap
zwzTzKpUX!5a9bBPz<t2y`f6e{)HZdHXBWC-r%MkqzL_SdHJiPZtMGPvTrTBGU1CBP
zb-9|tb`rrjX)g`Ds0kJ+RjUu7RWl#ee?8X&-iPbfp2K4Dt(RIWY>j8s5SNs{tA#KG
zRWNB<OqL2cM#9ul0>_SYg=jD~>X8A2W1&;&b~_2XP)0gipno@6eB;i+%w(k|QEB#7
zd~^%d{HZ{%iHO~U_j%7Dv4cE<I3oyHtX>(O!9*nueXMpPJk?OsCpCB<#!l!O7!F_j
z6_D2YjD>~j*CZ7?{%2WvW~zVyXW7L`8=?qfHzR7T_p68#uenC>veOtAN8jy{i=UHu
zKeDLN!`vL`mEC5J6*Ni{tt?`BSIqQL!gY>5FhDOPvvlrP)5ck7b}BT0v1!mbT5d%`
zR6E=#!h+jJVOC7RU5)JIWH*JgA@>`Ok*hB}l6TBCvUmhvL<Lgz!NzjAHClw*vcY=h
z?PTu^?Hll1Mb;8sPiwFm;2r0La2in_p6%0f>nk4l(K3nR3&*Bx{gY{dRkwj2OK@Y=
zvmhc5`++AQ*+9qUO@@!p=hSER`Gvq^@QZ9h0NS@_P2?T6#k6dr{x8XMuV*R?_jf`X
z*h#+WotSe=biaPhp(6X4g`;P!P1oQxT6G4&I-oc5_KJ@@_zMqP2;N-k6<d!49XG#E
zC8wOX`;E`B$aW70iaSWDyuhfo!SP<vWx4GkIy=KQYw;ssZPVpxg~LU|`9P5Nm~NU?
ztk$-BB#nEkV@LhBsX?1rP7HgIBfQiP*H>}UqdF}_ZTE!~jkqms&2CYW>moVI#INU0
zF^+_<aWP<jFlO(n2<K4<hI~42TkT@UA_nzs#TZ||a>oM%c%TzsoZ4p%pSWU(Bi)sn
zcCg@h^a|#7dDkT$e*TwY$cr_Q=&NOn<qVwYbOzE(5<`b@59dZA1CO6$mfqr*(}KoR
zeToR<`g(4MWvOG4mHcaB45JZxHbk2BtYGzG^0wJk)ZnDLlw4E>B1w$+B11Rs(nQ=M
zbZKEXCH29lIc-7YD7^M)SjJNkWUV*%=4=ZqlH&nGIGyz-8&DFN(QY4$E7SaGN$L2O
z3_p7we5At{)e4_No?|!s59ioVA2>C*9wyR00sXcp-5V9$Rrlq(<#SE8SjWnz;iP<)
zksRCYilfq*g~_){AoGld%TV@OMT%+>m%VC!YRYhf57d2%{_jJqe<kUPl4~;_GJ~Q;
zB!x?9mD_OQpggEcR7sYB6r|h4$7#ft`*=fD%A&4J$Ukw}>IbNmNQd)lwC4>zGS<L{
z$%V!V+x!x~isGzLlX}?b{Z?bX{{TEgvj*5`wM4vO9lC>GuxC_yh0y`H`(lqfR8Hf%
zOT$5V7D`Im&ASd36tpq@mAs#11K4#NK2}pQ@4nEC8)~1k$;y3EU>qO7?RUXP++vw=
zr+VIz?a|(<v-5gE#8Y<ijD5aF-#m3*zXI-)rI%oOhjHo7K*YwvZ@rXMcOTK!yWQ#1
zu>*ByCE}zBowcD!jU{HE;k(0M0G6q0uNVh!1=wV`p@D~bBL-R(b+_W9b!*8D?)4+(
z;YYfrfWtd>_Agq6uh~-GwYO%k4)sP3WnyJa0w^(HR`xpU_$oeAc6bznh!&UBT$K+U
zJi7;Qc@00^L1UF{&l7hNpnbr|%)<%bKAWx-TzTNOymK`9?K;8nI0Xy+ei!LnUwSog
znM+@=PkE5IQTwrDh~mM<B;`V1xw7c<Cye3D=#0dT?bS-2>4*9Zzf}2GL~*=k%JJeA
zZQ5e3E$WjGDMTy`dA_T3yco8MIwzaJjLqFUHKwW+{f@!0N^yu9EOq~kV-Y~bOfl=L
zos-M$cz-gv-I%u>k<c>myi~(168zFapUI8FH>@m!S8y1vuTd2ib+;YMcBAXJ#%t^|
z)=^tVE}%5iz>8t6uGfHmu_#=W&3+IHb86(AzBM%85h3h{bGM!B*e&dgCE9`ej|8*&
zrSHyLre_~>H;x8*a2!|6+zc3M!9FKDIas<X8^(<b*VsYcAV6R~VAM**_agf4<G)-0
zZt2GcZT%Q6hB*P++4xlsRmFiao_Ea8N^x#~{OQ2+zq_Ms%IDB{Je883FZQD)G#dHO
zl<_H8dhIkXR{1Tm1(ad;%J%58X?f1*1Z9PM^shIIkX`3v)Od6ASq*)d_LY4eZu{Zj
zt>ulvlz-)NF{zn#9jKu$2Qnn9+Mg}N7bHr?=+clAs6}d>XTmp%-O6+|VIqZ7-DZ{a
zHR(()7_Z#C2US)uD=n=859Dn4TxJe6kisPls}J>u=#uphbMWF+NFB`1W(sx^n4^fa
z_@CoE6|s2y&Yd=~seg3=wwikQ)#t_chByjKr1|iZ#FmF%iVQFu3yP8d^jvxIqWg}G
zeryMtH&N2}0{TKau5++YSy22?wO(9VuEX?51*+>&kQ==9XY!?dC%sb^e_3)ZBgzv~
zd%z*W^;D%zE0&Ydl|zj?4Smv1S$ODdHac~eUb!*ia8bXkmM=SD0s0}LMA+uD=zt-e
zZP9WwrM|~+M58a@oUL5~mGMBF^U7P8=*{x62t;*3&P7k}r5;YnB7A!d?Bjpf;aT7r
z;-;{0d{<7oa<>k;?$4NWj4^5PjM%LgJvx1_92~mPW_ZBhmRVG8aB!uO{oU`A9M-nu
zilWLLoL&xA+hW(r%D)jCSjBzZtogj(8!jjLn7QgA6bnZ%#q9=r%yMXpdg@hr8|44C
zpconSNiP$<7QN<8D9d*2j(+bL)5pd5TIP4~2xfW5ZsN@_bO6woS@Cc}?6SxE?=zI4
z1#KL>!%FE!=0TY60slUV64^Zen7;HtyT`4S$aEkO6lDPMs~Ok8_@F=@#NPFRMBDmh
zw5W*F1Z^~SAP?^S!#LNDUZN7E=)o#>gwWx*IO$b984S3-oi#z_jf!Ng!qL{)M~0iJ
zzWQ_qV!;`YBKMK`-bVc6b>Mprd!35xa9j}rvB!Wzaa-@l_pRq9B0=<8b)uWB^x}v2
zeu8#v-|j0n>$NH|Dq;^~E@t$v9l44q?_Ec+S3ngG*kUTtFJpBiQ44-Qf>KE7YI&XU
zInVz)n0N!Cii00V=^-tu*6=~UuIL@j$G%;2T+wvKrz*T0cU^qXQaz`tL#98x;t`+?
zEs+At8crsC1yg)s%41)r7%9Z-**cQ2loBMhT>PnDYr=Ooj<;vry=dr^5E8{ii0l@?
z7fizCrU{jJQU8w+Byv4s`r~qM7`S$I*+2hJqns|vLqHs!2nkw$m?~Q={ZA*hR;J7%
zQK4^2l}UM0r2FjP>{06lh=A6W_1<_4me^}uX+G6ZY#T);DX_I_47Lq!?XVa=$xXlq
zo)HM@kFP<VJhIuILwBRj)zMg&<&=}tPVZ)MT#_=dSS?~Xe9}f+FDpm?PdyoA)Tf%~
zK=^1!SAADO4Keupa+&Z=P*jRUWA1>2!a$x3`S#YrX-~mO)a{XMh8F30k_pBaxeN-g
zv`f?bDPI}H+|K_g{vU(;4syQQ<;SpTu&#O}fRFt%@ce}&p^-9eP{>wv8n1~voCe7>
zrE+?jhc<-S1&U2@6_N`RJ_~Rylo$1>)^19+jKAP696PMCkm84Q5We^aJM}-(9Sby1
zcEkSYZeUvJ<(<XtP(@<v720e?lk##Ti@JJe6Np-?Nb3?<Ns;@E$9PWFKGYA?gM58R
z3zfaBLRVy&E`w2Be=seEJnbQ=wRj@UG!?>48pNO<itM_mTbEE+t(-HS%jWJm5eDCf
zrVg3?AQt=A=l$<%?!VGBWVEN1>*BC5?}s<-L>x1_1_T0YK~XG@ztFIvw59u3y;By@
z45xT&h)9EeNQ^L8qIN%tzAPBA9uI}8*wMYCb9BAeZDG47I`vYK`aiw#Bq#}IKxVj1
zy@^ZOvi6;Y5?r(I8F0TgcQ)nh(_!`S-pe8B9?9i|!Vj6hW^xC%-_{U*01p5bzuHoC
z9+p^ue^psLr?%r$h!yIRt>PCQ037B8j)w>xggVEMh}<Xg=_?-VG3#Erm*|xLKFGIT
z;Qne+Yd-1-P3JL}Hv8vn_}?%hG_<=-ydQ3t9!isa>9&*aVW*j=DQI_e-gF+5)?vzT
zktP;kVPtkeb!1h4$Wgi9{&)eI*F(z!)5YzS^?U3|Z8W1O8ZtC2oAD&05hB{~1yu_h
zHf7?gx33%KY4fA!d&Rcv)~Rq;Q~dtag~xXGee+2Gwd*~Sa6dD4FAB%&lzvtTxUZ;c
zyFLEStXf#6R{rw?KF<${S0{B-xS0PxIr?8e!2hz`T~VJoJm8%tb2rK~$_psoC~orc
zLig8M*Lf!ReWz(yzJ2W}_~|pG5c@s=>qZ@U*q#@wm3~%vI3W|I%ImY#@)>m-BYOUu
zspXY(4@I>Qk3zc3x2+2Du!UT*Y7s;jIbEPJ+jL?dpX4G~)!Ze&M5@e>HhRLrQ<%pT
z#nirEiG2CVDT>mk8;w%HC|-A5cbn&xM%NAb9E0~il3f48<D&q|#vSc4Eoo+vL-Lkl
ztf&ZMew9P<bjI6o3^zGJA!(}HtFm%CBqGOreeu)9c>8cP1iY*BsI-7-`u;xgSAE~x
zD%5;t3#o5b<Z+-thUgm?R9r9YWi(@Jqfjwf(ht_p8y?t!a}P7l4;ZHJAb;Xo#fUM#
zVxn71>Z9V_RnW$j;Qa4Q)*UV04gWc?ud=J7tD5A*>dp$KPF>5NYkDiX=Tm63h!?GA
zIV4Qa$|}G7s6O1v;`!OIT*kX^wI3+Wfnw33V5`Sjnf9aT(=1*mjjc2Jg&Xuua%d#~
zJIkqV*0=gS##p;ch5<R=GQVWwb8Ch<=xgWMwW@yQFDj%Xo-yl9F&9C$dJ>hBkK11A
z@|7H^HRMV&<JZa0&LTk7`J{HQrqFxMIdi`7lpy%q+&lOvO2M|kG2h=@1uWo-N;Q~+
z*Ve*YT_rk*7^972UZSdkeA4`<2qMnx={j;%Z@d1qefOy>pmA@+U^}u|#GaGxNJJxT
z%v?czl3Y~}na8K8Ik0W%k4)UTo_DHb+lKa;?ap8MZmJz6Ky_LsUsBS9l6f|o<%w<@
zLn1JI3^}tD_s8WKW+D43(dnKYvHET+ifOBktn~87EZx#d184Ao==+=Mo+Wcl$~iE{
z$!2`k@mO(@-_rR~`+{Nv_@sS=Vot4kUL@II4x>MwK+Y|CYg$?ffiCn9WX+HB*%I$V
zS;W08w{L=Eqv9sV;BAKaqw7N=7vrV@v2H-m<8xP;G7{V>2Hg6=o}udXqKW#kQ8AeH
z{7ZqL4?4P&mrb<@%_%rzTq|ySQ21%LxK^uStH0IU@1xex@+b&7bD2#TKUr(g#fkS;
zQGsZ(8g#k7Qo+l+J&H_N5rIv{kqQ9N?{D~rG7cVEq%c^=iniz>usz42nf5Az9^PZG
zn(|Dpi=%<x=5jJhIlb<}E8b4-uSsFMS^Dlx^0o7RpY7w1-*g81N^Lch+QnRAykXhu
zn`w8#VJ?P}@XxsPbD7QRr9a$A5<l)uO*VQg<>#xI(xt4qTZp#NY5a^o;#qrI;;KKI
z?=q*>(Mi4=U2hw{U)k9F6O&9xXviYf@J=k<7IDY)vfCtv)#{V2AJT#UHycWqbo9-<
zD^Gb)+X8qpGT#I|+oDN-=%FFL8vkfHbIc)Fb=fJ`(uAyjv(22FEzYVF6MxnDk}ZbS
zOOnuO&3Uw*e<)0bB6)(qd?;-&wuQ?;4|*;Oau3JvI_u%L2Ka9CD%oA}44ZDH$<*rc
zyVzOLurImBSjVqrVv=!x?o;s4Ltv5QTrWKPd!$I1z?c)CD(5n$NYB`B+I*-iyeW=U
z0n;J_*i+|gd(08t)+J6>n{55h(ADzH_0!+q6BAcB{n;W0f6me+kwN(u9Leco)^bu^
zWCsuciJp+}4@oPh(ZAuS$oyhZ>8pz5s8l5v<ccyGaAM`}@h3CBud>wd^Mx(iW7763
zBtE?sr`x3P>C$(?J!Tkrt{1z!n<?X5*}fxGO4wrSBxF$_^z!WXco~Bu0ox50ff%&R
z{Q*b~C3i@AJuAr45nSzb1aO!ER^ON7?DTUbQY5A;vp3|DFPg-*$B12lQ%8>DI`#M(
zF1}xL%(1Q73=$GJS}vC05OawkD7FOdPkQrW#5gz^R2u}5VXy7>b(5`lWV-S<pnt^5
z>!=<y1&%$S=U>ITO<L4sU`|0&V;{QQ;Yud9n=QQm0A&AkP(Jm2?)eND{x;Oo^6FpR
zx1{_pyUjfm8SpzQB*ed2_pq70uW3DE-ZZn>qIN$LH+&w7U~kTm5;d)KQ6dqwvbZ8n
zD=4RAk3f!FG1#OH3%9OSRyI%|B8%bd9o`kUAZ@rub!MCO80rU7S>x6q&1=l+Agols
zq4s-y(e3VQP5JVJiX;QS`%gF2uS(9kudTM~H33P|pyjxCYQ9MjapM3?@@0OO)zf}T
z$5}xlGzzZ+UjS+HroVelLITuuvoBiZVsRK>jn8gJ1;XWD=I_p;QdfN0UX*CPG-N}2
zJ|qv8ziwF+JozJqBisd@{;g|3;qh%g#wD%LrNrktak%m~gIycklce0wVrI5nH-G=l
zHaYVbo$$59;VcffRVQRS=uH@#wgCV7uOZE1x=5n2cnlUjnyI1~<zm|B#9n>ry94J1
z7`4;e`9FH2xtmW<yCMo4Kfoi-A^XU9f_nmYg<boDO0$bCyMZ69fR;a21fk`hFJ7=r
z%-!gRv#zt_?k#wDN^2IEP%KXbj*Y;0!@)LF*&<h{Kthn*OR$~%zU`q;h}(ExLc3ts
z7kS2|g7_6kPQBbVM`gL%?9eJ#aV{uYIFbyI`Ay;1HE1hx(s3PQJ>zBEagUS4TB?@#
zREi=Y=IG~eWk;EtiD3@X0gRnUp?{L(rcsVmOG9LSBJ-=q$dfn-Z6x7Hd_;0(f+vVK
z`4;uk+2#sTl%(e+b+p$A@!nJygeIx32!fsqZ<aZ|z>#@asB&-^ZH4!-Ds5+847E7$
zl|Sxw4Xt^3Nkdxy7WX)}wt$>lO3Pd8&w1TOtM;aUSy~ZuSAkq;Hz|p!YYUYfKe`d?
zlkH8HR|@Y|w%@f*EyN45?$f2D-HvS5jI>A_&-m%4c-+^NR>T(pN8FA3Q62Z8j}AB5
z**<}N<@sOMCAqz2{W@+aQ+LFW$FeHO8YVlssL>tTS02ySawAgZfls@)8!}3VDgExU
ze`PF1`6()8^U5Gg09af_w`Vnke6pvTioo~h^HGE6^CKm;XT|C*W0Q5;S(ACg<j|kT
zNzH#zI%%<YvbJ_BUm;$gl(KuM4CseL;8@0y&ik--UAND>o!|ZqNBQw*)&Iv?EG`c&
z^VY%|WptU5GI1-z9g}DN#0Ng;4u}gfd8Ndx8p_>~>3RyB@8;keO^FVDK#tf1J_g{$
zug5*F*<-nlv*NB?iY*LX?ep)Ih*A2=O)iT;fz;7jZ3X2b`j6Aw&5xLzcFlw0{^P-S
zuow7^n&9lOY(^qKhLhwjzr4S9*JZ`IMK1AH7Xx3TVA??9QKa9GX_Ry}!42Ze16`v6
z?0`Ka#csFqihb`9u)nyWT(5j()R3&6-Wj)tFMK2HMy~jho0QKwZZw0xCHlSiK3*70
ztC!;G$1aSS)@bGq=+08U>q<!B##Nl+sLl#=3)9*3ZuXd*UzMb^&lR-)eEsFg5Cq8+
z*B9Z4FvuupZnw%>&6aTT7pLmC#uk6T#>e_um%vOQJ$TY_|5Jk$pOkYke!uh8`Z%&K
zU52XACMj~LLi8omSI_WeNMW7`BF!_XbeE1|v;n_y)%WFq)INPo5peK~F`MQZo5E-z
z$qVh8v*Sh~+t;{|RztVpi0+p1i_m1KcYnrZXU_BB_d!Z}uB$%EGAVt-wWJ^@&~5$G
z`A{U7`HWX}tmAZJudz6^aVt~Y{;@6QZ9Zne6|x!2WlmO`{&OYbr2e%9p2$v94E3x+
zpGX;GjrTix8a=@fwF4^bpu%*ww1V@JD);5}3A2GOyopwuS$J<vsvy;KW@ACXc8EZw
zU?29{g0)Gouom3%g+mo*7qIdk`%c(SkUI^#UH2kd7ZZLsrJQtlw1?QbTWiBU!yt~5
zc(%g-D^;y=OGOZohG{oobPY?!;QUQz7`i<9E1m7<qxF0K)-%NLXEfmP{>_h(l~#|$
zgNtGX(j;IRMHj33_3{O)Y$D-Na+uh(e(27TfqGlB)oc@%I=y?O?1b^BZKTQE-Xm<q
z!1>`!G)Vu`&dd91+-}JkvCmo=hkKc3u6LsS4j@Ra?7@|OCV%rxATh;)Z&;*lGm|0Y
zYHwXT*6jilW=l~9$#IvYt%DXRo2r%F?cNRfSV8v4TP|JQ9ZnW!+owb;*eNRyx&S3A
zw}aJY_$F}8_T0~1xmb{;RJC?Vx#?jfdl4G<V!mfnY+*iENrjH1Ill%Y)W67M30r?f
zun*g~L3!@eFRv3)XzN5eYveu+1qME{!z;0RzZZ;@RHmhJXeJ0}o$7bxPTRJeFtF`Y
zjhwijZxVx5pAGJ~5wfMx_8&~)x)TTTm_hRquzH%qBQi{4uCZXF4Uvs?U1&||^0HD#
zru<GAvV~{gr$g)5&%TVzVT-E*gV10Hy3vI+tgYO4(TrMEw*HFbzhxwUrc8~geq!du
z9Vjw~p-lVb0q8WQyg0_mrdC{K|Iiui)N9PL+i$wwYH{fo0Lq7vyR~>>ogfA`Wd@N>
zmhUV^l>fMW<dmVBGTJrh^<&wJBSI1@{~?PY7y!JEayGNeXV2#_4v8k`(m%i?7s}5T
znwm2GNRwEIUF~{llCfY41l~^>w7-IMl%Q~@5sj^rE8K*c;$M>~6%q_Rc%r0mrgO5N
zG!BcZD3mFgP8BMSsd9^v_-aw)#XeU~e<uW>2aCbd)Y>;X(CL;7QuW!LfIc*l6$W35
zzkKj-O)I1(qsS69&|!-I#zi20w<anm6V4{m7FW{`-142@TrhXc7Aw3zlR43yh2f<C
z0DYr`Ve&aHyr$BpCcCMQ<li8+$SR_n<<Ve|PCDgq+fR=X=&rp%_87#o%zPin_A-mk
zBjNp=C~zUZ+f=>wH9c!tr6Yaqlkgtocrw?B9KP3my+YeGXxwOS!K!`VetXP`%Mtew
zZ8tNH-i<1&4s+yvR%0LE6{A)a{)&{i+Ac9Mdl2yp6TB?$`=}oy!V<Xl3v<JMFxO-3
zIn0dShO_uf{05nv>n0y9k+~;TrT6_C=CU3m;x>Rnj5zc)lIeewqBt)_BH6emN=jsW
zB>8<b<HA((4F(Oyju<<LuURx_nOla;rLHBkF=X?ZU^qW39qZ(Ww#yFPi*k;hY1eFb
zWMdy~=!VU`w`~j*g?^mM%|~Sk1nY{RkI?KplVZEC@y$Z&q)7}u%~sxO`yzq9F!zAv
zY(9^&_f`&}nfcXD%A!Z&+zy9QUrEF4!~8_H;(5k|WB^|9Pq5$KAI2tcpRGeeto2Ho
zaY3~+rPuwG?WygeCyra(LM=z_EnbKp?@^{Vf-f>b{E?(_T8!CxO6Ce#vMzLN-|c}@
z{OdHxX^y%Q>EWcWbV{-7RwkMfyBZal1-n#3^|A~UPNVuZNpM_);LzzQaMJba{Zu45
zj<ty7!Cc!IUVwX@6rGcgnApMBrt<Y8?3ZCKgfWGR#Jkq(SXcmSHZ|N*&%QhYJ#tF6
zhEd>ck}hsl7p5H|aXWZ7MJHYacB3FF&N+Y-&u&?BJ?;hVk6j;?3(=A5P7BBdc-_q+
ziNws9N}EW;`Tb8`+Xv=?i?~FErMVJKI8qD1`22Q-c4Rm3eH1q2z{akUQ(2U&+oMpY
zF^Fy@pFJRGrOrY1qaNQh`~+#rOhV=^TNq`q*?hiq-HmO$-C|$Gar^z!4>V@u(z$~x
zgIjd)Z7{cKLh$W)QN~zCuNkCPdFZ6$ai^k<!1=+*Azx<h>U?j@VN&fRougR-WDKRT
zbh@=UpCJOuN4jR|5g9;@CmLlaq6p)eM6`j1Ypp#mD!sdm6|#_xLHB>^C*0No&kH@l
zAZr!nY<KJCx`T01ot|(I$UAXqX&>gEQZ+DD??l=*c9o=o@bl-CdI?L(y9|HTMOHos
z_qXEy=WhKG`&oL7ai0~5CUolgqZ)E*?JA<_>oDIk1_qmW&>9Qw3CPJ)bfcnp@WhZW
zza1ns+*?Hbg0@uyO=F*u2^AXhxu;3rc9obNLomi--{1C2!Cmh~YgOrzuQ{_8<Tt};
zGZhko6J!gC{(fahN57@9nwCEuVwov8J389htrs7xRTgK6RU$bELnFnDt>$aG$G&zK
zFrwJ#%BxkZ6OHwg8qgM5!hy)Q#r=o|`rgS6Mijw9zlk%uEvAnRR~?rtE}I<H-QR;&
zQS9DzX=WCFd}r1po|zAkyL;Q0G5(mN2S2yE+}7zWupPBB9ZnfNGh$(OspuQg!%vpF
zY|GjF6qfA1ko=e&0<*OjuV6k{Eh@$3pCf85Io*gJ7W<6amJgX_h|@>zDbySVyDuh(
z5|5}wDk?m)mLbJ47kbhbU1{--hYtN16bZPZ1IS%NW}Tg8dLWLZ`8<wC7^pgrA}-^A
z*U?lN`{%CKb|_`LD$e?IS|3S)<)vHO)PAej#ww)Z)WJjK1CHP&ny4N9a%BB!#Yccz
z&G+7#PaIh*jnogP);{X!G6VVB@`MAypJmI(E}cWu?jBm~vdT><acji<t%Z6<m#Z8C
zFV5?^m!y30<<k!0tstq-U8vVv-ruKl1o4>oe5TwD4GK1G(>VK+fn;^W-__^eE|aNR
zl7m63-dWSw!6Q$-pt&!NgipWd6>ZsZYd>Cq<1Kh#Q$<Q&D%XdQgslXzptt?A^^v?C
z13!51#S=hrcDH-Cq@IHT-}lA7m2P(;o(f>nH)%9zXTa<1r4rK;4mRh;mZH-E#Ie_5
zLH<5V{h4}z5a5?J!*z)!-&_l4Q+lnV*J@kth0&2G7Fo7C7tnWSVPg4Haipqq#qH_+
z^_GP`Syk%o=$F{>RDjlT2%4bRp#$Syn_nV?UtjO-8xc1<q$nWXrM5^BKTN9UdU6Zk
zYkc+I=bYMsIzaIL;bq@YclU`C-8Mbq{mV#yLz@7Qz^1<f|D6*zpB3fm+;kCt-+n7>
z<6>BEMvLAEXA+L6>W=;Vg}m}2GuX}lml*QrV_3?QeLd%NdkdWZ9Y(rcY%=t%5xASV
z%NtGYcs+YCy%PaV-*WE^2+miX6GOzRKNUPrGcm*QVR;&Rw|WW1+|g={XmPeC_p!J<
zSy4w7f5$+AV|wN*WanZ%r*`NSQ$#|-YgOL(daUNpH>{@F1>7B;No5w|1B^(CxLcs#
zRk&{cjaJ*TO{ep3j<U7UVdFh%nDtd~FJU{WF7N0Kc2zS{?+Eo7N16(YxKp5H0cuk(
z+TCF2PuhiXEAYA+^n6BPW1FjQ`owN1f(1^-8?;{sY_8*7x11154%zEd>5<l2C^@VW
z#m%Qv&~aH&|3im%$|>^%fTw}SG35}|9O||ORNG|YC7y{70h<Qq<wtMJ5lu$BCQ)mE
zAvY>R6I`MQQ2ThEAFZ3W@HG7Do0P6In<51{qnQ6^e;4EDIXN!2<f{E2(zM!=b1cl}
z`x(qM?4IY0OkQs8MlTmc8)&|-#X_lyjuv$-!xTm{JKJ=6BaDdGA9&g7=drHGA}7O8
z^qpYnkpzXx!dw}6*s$Wd+AUhBx0}MCBH6Zb^A(v!kt9<KTQKd~yzUv_s&*cz&UAly
z(GBv=vdW`e=!sd;q|6JJr8;KeGw_0ax;9DkrB<hUBjf_z6v2SUkC>FX8>O=u2pLeu
zxBbCm40;)c5i~67wz|I2e?Bi13%H(?NjtHg`Y5Ust6n(@M4}!IQBS!iQ;}7ELshr8
z@J}2o5(b1j^3gwGnf#`%Jrp)EU+fl<yLWn;z)@_ijV816-d!M+_CbpM;L2Teb!xXg
zs75Va-HyJG3jo_8jnU%YU{r5ePC04Xg?tsUY$c0)&A!oUh)#Nz?fGeAFr=T(h~YG5
zQ)dlf^1(lCHcWY~fRsO04Oj`ub^md!Qj>2r44c&J4v}DUz!t3RAycGx?<v1$4otdq
zK_l{Ke8;yD0Ae@Qkb<$;6++tDC614q4=8-UPQJfheNV4`mfd@6JE!lKy25+q>Ka>Y
z!q#G9>`zPM<ebBpl}f*hv5|1`#G`MRG7&wf+OMPOjFs3;{(fg4FCAw2gosZP42{^1
zgpr8P2A8f4pZ|C+FU+}+IAg`FRLFQRH-tvyBvW+kC^Ia*|KTwk<LS5>Q7+X}VbJ50
zZbop$0!iQ-95(=;v^!Rq*lJ+9)6XeER?sy$;6}VszchQQNDzD|<y`#?JaLfBmig;t
zw<;QLW_y_qaR<Kv5nvhF{yYA(OI}R7b?s+3h7sDS`O(bLn0qqq&g$IltMlwC4%{C;
zp3bh>RoY33uTA+I+zBcOBy(EZSh)H)0SE`ln*#-7Qqqx^ttevy(pLsPuwY1wR||)=
zEt6K&4~zmMj|#b+SY&bX;Klxt?+u>JV2MTMw((j<k?`3W($GK>pUt;(tx=iKMM6L(
zxHDgK>`hFpKs=}2l7b~?&N^brYg@)@Gfle)<azttv<m&>k)~%E!-zlH_4-e{N4-Y>
zvf#@rsTD2KE}ClGjeagh1|cJLG_a9M^CfkSqJtd0VX#EXt&xBhn_=h74(@Tm@Fg=9
zqUQi2d#C0q^^czFKOGqUBafZ%e!Q`GtcrM1Q#L(%k4E{P8<~9t9P-<uRL>zi>p!JB
z6r^`-?=z;;Mfc0>E~Bk@^=pj~b)U+xwrBZoQNjrd-{w(g#T7oa>_JuR4<oLRVG2y*
zMNToo=8>X851k3-<54d%rV|?+5343PJ*R1XA5-|d-s&F!o4tu-SJe`Rc;+u_X`>W5
z4<B_<+}RqE!~mEc{u0LPZE_-78+#<wm^lF;dLz_Hbcj+<L2v2a@&#u?2xwZi=y-pF
znw;u^ihzoV8UgS)^C)q>SLAp&^u48A6X6ZNjhwS@ni_NDGPzfxf;PK;r+t3xH{c<2
zhUTi5ws%V7^SI(RE#=yHao)q4AVc@+H<6Ye-|tYS{8IFz#CWZT&6}RGvRr^Rve3|p
zBB3rAlfHr@hcj#wSpjultsnPLPYIO$g-mGsi|sN&K;nF><~5gvX>M*iCe$i)iMVpJ
z3?MU+80>6ZLA2PIR24_Z!>xWARd;Gf#dYZY@_BDX=0Qj>%7tM}5^wxUBYORZG*k*f
z{?6MJE27vDu=uT3%&a|QNf0iU!$!8u$#9ly$OS-o#x}+iAepQ7HK2z`#6<o`cL=X^
z5MT~7z>?~ce4ahshCntJuze(i1TtoNN7%8L2`zA~Cy&V!H&s%3LiFIjt(032SxfZ}
zD$YhY5hyK&p+(FtxMH~WJ-YR&TtCmV_s!6$p%`@Mg^HvE6}qL2)+k2gLnTD8eUPT~
zm3#iZGkvG_lhbZetroRgr?JXkM%XEW3E1R){OUk+clYJ@GPa0os(wi_ZArDm^2n#H
zr(=vkmO$hx<wUO1E;gMHd^M+Ckr!yO-FMO+mB-|7CFu<JFs>PLl)a5?4Iw)sQp*|k
z9eC~e2C*&6T)Isie$s8@)cN8QaEf!F$Kyws*l75csdYQKi1Ui~Z;F=on~$Z*{gwUh
z5a<~&DPk0hP<i2enhP|U;tsmRYVxv)UYx)<*D{5B9L1soChC@c(^cbjWs)xLd`b&N
z_vmpOvj9Z-SksFajs%_yUEJ=JkQrkVqzXR-DE(Yh1j9|v`gYzDI*P-$q@tmZj;6`)
zl^65zyGpDfb%Hrq&2_h*cexS|E?=Zm`d#K=fIfI{S!8Es1?%yzRQ;1JL$+hWJBsh0
z<2-)*$ZpBEA9Wf`m6PrFeL;bed=i(nFp>gcUvwCa!Rx3UN%JtZs0+MvQX=8Xm^Z9#
zFOdor*+%n1DBkQsSiVY>@$i^Rm*nLno1m@F5!;NL<f%?g<sZa(@^zS8MnPxu35Eoy
zC_gSvFdDlK?jnI>(WDb@s~t9rS{>MTIU540H1_oT?}-ZhN%!?=Yd-JY=fBBt+=yDl
z2@@0HbG~nGb9w3Uk@8-@6c7SMiB$q{%vD?2$@og_6%qh?R7-6GQIa=@GS_^U9}0Uo
z0z%*QXuR;L#<dL7lVzZo5?7Z?Hgzz9=XfipUO8T{N8<w)lg7WAn;)b^35HRw_Rv5~
zVpnEVFB)avs7zdsN3+z(ow{Fx_MyG<ktBRpn|v|P@uO-Qah+aw2`K4o^eX5BP$Z`q
zqpKX!Vmeb3FMGeb&pFs47kJX5#j5O!TxL*L-dztRed|jD7NVp|y7G(_7WGOdN@Ni&
z<fzrt>AUbsW4OmK?bb|1GgFPSfxG0nqu>@Yl0875%n`e>inw=dSLSg0Ir0_9&48oC
zIk?Qz$}FHi+d!Elz_zFAgJWLEpFb_&t>;)CKQyU0Eg~_}Rtu}uJqD?azPL{H#&VGB
zGIw$h2cuS9;Mx&^8HE`t*eUEnnP^b@E{0PZ%_CiMUUGihpzePG7ANEkn~RVzKbx#~
zx;*nRKs$L7|M-=S%)gRAnSk_dE+zNkbzNvayWd0s$*VOjqLXR6)FhE%wI6p~!qcf;
z!5Eg>)Vsvc)LTn5M*uf*>hhTO*%kD>l4Tt!f0ge|E25GTAMY(2+IInb+$7c2LaoK?
z=u;MhIqz~=!A5l;(5?^Ozk>`!TzS_$0lvPUUcc&Gyz#0CZo7tP?&i*p@hnyjBL|B4
zZymAijo3zF{=ZDWqJZ5D!b%=A(dNc+qdhPjMsjigy4sr3CP!fHRd0=v+-rpW7#faI
zmm3wQ&n3}L+1ToZ%8;n*s%oKvcMs>7>dzDMR*1GNRkl4hb;{#h^Iiyl75gjS96*1R
z+e2niZuC28wr4jRe*A06qt#pnw?_kycTRn7V(XRy?eRF6j*%L;XT(PDZ&Lr;RnjBw
zv!)G7SR*_%ZuBw!D)kI#i3pVnu2qb4_n#=jd}|boy{*yb|Ftiho7Mu0Y5%ap*eVhm
zX(X12btE`UQ{0!$P$YHEz6IwwMMkqjePR1<K~;F_r5dA>cak^fl7f-6honE~3bEGd
z%*WE8n!%UiPo9cAqpqMTa(_zDWwMRbm1!Ed){bx6sX3ky(YvOyWo}Y*goqgP_!MpV
ztnoV6;ad}uPLvKMY<<=9H9h~vCHd_s#5*=LHD0oHU_bC0l8n4Tb%J#5;az|>3N#1J
zeU>R=hfF08=aKgy3CIGS0`Ct*AJwCEV0zZttu#CvVq<YJ`ksQ7vr}LZnd5zkG9}Ly
zQAGkQr9LXHL-AlvVV<f6s9`+mSGS^rFPx&45j0Fi$nlKJA*T-lYg<zgpP`_6>iA?b
zFxA#4j@Y;J(&LOWhYR;g<QXPjxWubKw}RnHjo2od<9Oe&u1qvK6hOnM%h`|qNpyIp
zAe-vd$E@`Ri*QRsjTlF)3}yB-18#mv4DU)KXR&>F<O<of`8J7|GP;qhLhDKj2Y^a+
zhV<H$9y!dIJ>RTAI5HZqOB$w2m|kezx4xCLhCMtSfgtwT`$Xz@iPrQ<&*uIp@~^Ta
zvlwj4k|0c|H#K|&-(J6Tx0~xo*gvzpCZNW1AJkEzTi_b?cFw&RJ6SHTjG_>vYZe!%
z%#*>MN!6}*GtxhO_sPAdEi^>I|Mf<@l)IWYV){&IjBuj91{mV_H|S2guo;P2@ihWR
z#Okay<n?y14};wvMh(-g8j<i_a31ffFYRSAi|Gq4bFg4#zy(_$VgFa%&7Jnr*n39Z
zstpnDO1&Je$$PC$KI|*xfO_Y;P#`ECWWQ#KzVU{Z71o$;Kpkll!z0`?v-2V$D&2jU
zjqn}cR)Tz`J!fPF_c|UiUn4Ms$T}zD_U<FSC_4S~_`$w<LZXU6xDzl*>N4{ppx;!o
zF(42}RD|ZOBIC+@qbn5WJlV;z`ZxNCYN^umPErcxQ`Bf(D9kx3eL3fzalZtCy#2GZ
zc~_)FA+Ce8?d%<MR!D_S=#uieIX#Q+oB>?Q_(C_}pO@_%FWxDayh}ZQCO(FqeOeOK
z6m>I-gV{94j=$g`TL7%cY}eVx*g5S9{h>&&CobYIc|&e59Y#6o^XbrO41M*vcc_C;
zKEifQIH^eK`?A{Hir4(QT%;1BrrAap&ad&FO^MXQx-W^zyC>fvZ~58$wx+rZY@PPs
zLtblss82Up7B0ZQ9Fpym`ZO0~qdT%5r@0my-?DDfQ0^MkGf6!--wq5o#f6cF@#be@
znY=B`Y=c^H@1uMva~e_%ZL9B$!5TxA6=vm;uu;}UIu2=5c!|+XBv+N<$ffe*fatA3
z!z5>=%N%rEHHa*?0)=$9V4{Bb#=zQlVsXM}#D}yOV7ZIH8n9@V9_DoT6fl0(_kKon
zOhIoH9nr-$&}?N_Tp%8SF?h*HNRR1V-q&B|bN>e2%#_L}j2DwQA?p{9<#PArV|#qf
zCqMV&W-B?ON*8A~X%5p@fTEtTPht9Kcy-1LU3L1W=OvQ}lO|+O(d6$1b|s?NdT6Xg
zT_BaeEKLtec0Zc<A8PE8TIa&{y^^lp<cp85gaeyy-a6ai?7H;I$M{akcvH)IxtyfY
zSJ(?BhEh7@U#i*h`QG`#wk;-Gyoyj<0PQ`I$5eQyZ}sa8V-gthXtJmS5lqAr3vC1F
z3EmH_McY5W`}J`}zvdyprBojA8H*3Q>>n<p>SBL52_{mHXjQv!h-0m^$~5Sb^G<<3
zqocT1ej`SO+?En?`HrBiw#s+3eJ{Z1_6M;A^-ItzpU&G%x7vL4wvTGXv`NSR&@N$!
zmw4H<9eKZz1eKwnD5M(+Mu)ZTg{Ri8<f5q2!tfbmb_ro>K3Cxj9BQaToE@i`US})$
zQ1H<8YNdmb(nfY3uAkwdJPz!K#Zziuh0CXSu794s+<(?j(h+{~s@IDG3|~r0k|yd(
zvHCGi?put%5g}D2m9i-+i&!Y4kdJVZWR&AJ1iKh>u1E$G9plNkm|15V#)oZ^h+3wI
zfUK)eX*di{*?jH4`B~;UsD~#H%>(>kX3-f-otjf|{Ly43ni6f{>2qP^ww&e)U#1mo
zcgozCoIOO$G&^cP@7C+*ne>}9YqW)EZ@e^l$&I6|CNhdqGRNaY>ky)yzv=CAusquq
zhjZ8n36J-YDV08kKChTLgA8*vp^{81Vwy-&1_^ZfvZzo>CVff@=gE$rAPI%T6(*Cb
zVaMVMz+dyMM%MFWq7DrhO%lZk4<w8Wgy!zlbaQ^6eEiAh-sOmiJ>2+Q=ZY*Ih1q9S
znK2^Oij#sn`1)y0qgjvbB>YY4EiFMOEu+n+AGBgUz+%LBJsewco(KF^3xEgRwvdq7
z`8CA)b}kgfr%Um2&&w}BCyTU{Zp$fQ-ST<6(~WP#_}jXrR*zb>mKyH>bV<K=L`di4
zP;i7Hg-PcxhYQ!qTz#&E(_6|hVV{TPqM*0iCGDh$gGh{wx<)AqZ`0qm$MBs}a8@X<
zLoD(;vsHI~Z=v32nxA5=2Wp!i`O!9eifHVgDbyRF#FGa+4t&TY(IzGTcWR;OTcJKb
z9YH<%Y?nfe^#H6Op&=W)Wk#3Tjw5ENZ;{y^2k}LmRtMLWy-KTnl8|s_T?pz&3*Vof
z2jh$OPx2Rv^P=(UHIzb=zS?CGP1K>k95F{A1F@d7F^=bl6QJt21|jR$!)3MS)o)m4
z=gqb=h)v69w@W3?H?X4eFA%*}Z^4H7nqUZ?$Kk8<Ta$}aVbkhQCqPp*u$0??G=Maf
zMSbZ0X2{B`L%%oTjoHK9N0s49<&+B5x?gH+DqnW&APk$ZhVP9_9Dm6S4sq8hzOw^2
zSKliRFWGwW+2P(`j63#wCvPlQR%%}Cd4oc~$3V<S_}t!&{M>KO=j{lMtE^kCpt-Rg
zlbo^lQ?F9v_A`8kRsG~KUZ*g>h?J|x>Y%Ih%e@+{@#&o6-V6nre$O#>+`JlftR5rF
z^m}wCv|Zqsia1Qzeb~HG*-q3?JmaqD>|@NNa^km6XwmFo1SPXEY`b8wC68tTY9m2J
zN$9#516UFME6>GHg};kKvYmw5z74YN_Vf)4Zc>z0+o)#u^VA!DEz!0wRr?Zq2)cq8
zDDCm<rL4H>tF$^gMXPfFKJHl0XWB>i#Bz3AWCFQJL2~7iOZitup+hpEWYkzh91+KI
zhzxaOw<e8~_{dkbtLq2U9sM1&S1d%VG*0}#L*WJ@FK_3>=Qg`LY?2T{jC>Qfc0IzS
zW;e|SD`Xy>e6aUdJ5iqz<Tb7KT*TE6ZcR<H{(FcO$IWubfdq@~pp%a9OGbUC=p<je
zWRdfUevjttjf+4a$ZL>N_qSIDywd#Xak9<%LHh3Se_|(*eb|H}ywl*NI$mXy(NTBr
zLnrQs%)JXALUGMhLRL298$RI#)9q^8TGGvZbaXs+683%63v!lN1BOTd9%PhUFzI32
z^~lN;7=2yI<$pO_L8e?mt_Z#3gHwxvuDiX>BvqyO-bf;XYfy@<^j%kAmrsIB*mDJd
zUt9D0Ryv_1)sQ&QC^#{Mu>faNOpa9iGr92<k0UW`KIA%oEJ%z=im9k=fme4ckI&RQ
z$K>?_EmN)uc|0hv#t}`Mr(!TjX|&zto5!VWtu|$n_G6(;R{Wp*g(rj`LLCZ@41j#g
zmI0dYIO75_Lr%%Xjau=0vgl~7KQg8kMhQtO96EEm7m-6Bak}rcq~|xu(TJ_#9iAOZ
zqES?VkNdv&4>xCeby^Nh@YC-6&oc+)f(lx}37qVy$c{-D0XRa;7p{#h7g?kOI5KGT
ziM+Ur0<F5u9AHi@^wviCvYng=;s{UrwXUkcqaag$I!lfRzRnSGongtlE;tiX3UjRu
zU>o78K2m;l;W1)P33+v3qT`|zDlOxEU0)jt_ZvV{Q{QPeSnlyM!@x6>a^nF|J4dmf
z{F~Fn+k$?F;E(|IIky1d!47P<(xA?9wzJc*>E1|j_N6?|qa$7>jTY}w#0hn5sfMdN
zZ-$hgGoY-3Q-cm=z~%OcmHhaa-mLv$Ie71EssE^8ST*&tqe&t>)(TT_XIObz43h2D
z?*aAf4>Hy}0sd5Wt+>e+_p|DIJTK|X`aULGV7HCkbNWw`xAN1EaWfX=Ji>#+w@G<`
zIW`$XSrZ=JjJaXScnVC<(tZ>p-M<EwT<uDfJ#qD4<!M;>F_`i68^JjmIk80hE~o1u
z)dW4*aDHIviI1?(;edImMJyI+BJ70VPYI%E88Npt_C``d;#F-jyKW!epF=#_058~K
zlapwm+cEV+M^y|XKK_;8#vhCfLK{}9zj0S@)hjyfBF-6)y|(MiiFNS@m_Rv`-g5k}
z$E1s_#Ehuw3S_ECJD(zNU1xNq?ejo@-%!)ofq+J`(0Fi4TAQoBz+;32z+uFy<prYd
zNsa=c_2|tUJ-=(ArTfnX@p6~-x9#H4_e2Qu=}^k1;MnE)vlA~jy!@Mi(owS)k&QQ#
z9yXMVX5M~<0_-^g|JVT<1UwnTWjW0xe!MH%73WzQ&OH7LKqCY92N#umzDrJeO5S~G
z&(5X0NIc}TAMM%ggi?wqx~-*Wb;y6kne&{5n_QOgh+2OQ(Mm_E^F)yaLq+UfLko9t
zcw3BrnZh%EjpNKXyzh@dMx;bnm=O*aSQbB_3&nf!ua2XCCDk2cC43+Lmbq+EJdV@+
z=j%MD^v}ZM&edyj{9AS;?p()zfC?Ql39!!-=*3@rO07ujA@Fr_uX+O22rNxb>X{Nc
z^<H<H+P5VtAxe3F!Xg%XxwyVsh&|#)d-625Z*G#1`XuPH!Ixi?L+r8GmO~4BZ$%H1
z+LE<NFUzpJ_D3ri^cPY4D9Ah5g;GEWy=&lyeG`^{+{Q}$d*JIo9tQ~h{oXv5$e4(*
z-LZQAM&Iu1(9wSOL7uwDRu7%Foh$8|NiB0Iyg|t_QmcPUac+Nr_RunRJiDD)ezwB{
z-^!(@jubts;W3L?Dy<Xce<wvAig4d4uaY5Yp)Ehw$Mk%^zUcWI9>;VbZgsmBWI&hJ
z;y#euF-;UU+b8tw9c>UZt<9A+Ze5P3$K>oRn(-9qp*kGfgErJ@v4ao&e^0fepg0Ce
z*uwjr|042ZJL1ui+iPpeP%z&CP>50O#yAj!s$n6`%ot5gYcm=W-}c1(BZp<JSs;?j
z(3dwM2;f&o#@Z`xaj0ou&-@?CJ{r(W+toP4;mQJE1;(@b{C?YPDnKKBqnzkt<6?Wl
zG+0lQM}8<ztAv0mP6p+1&4#LbA$;fU7S-l?uKC27SScTj<`xqe$zMj)WL{Q&AG?~x
z<$lJ5^gR8eJ@~&pE>M4=3RD<De?(J;yPX3Ck0^bU+3``2FhZi9gd}|;ej=-Se2`Jm
z^d%4D=|~8N*U)&aQni`cPv@(uLG$guykMVoZm1}o{^OpuR}q=mfBOgj$ff^%6hh$^
z4RY!de^|M*u)U4NCf%4O!X~77lY>n&AN1Y@w*d{MBEGkdRyl*FIY;IvH>w2{;yx$P
zts3?rYqf(siBMR0uiA)m@arSB=|@zpb)J7;<NsP;|K+8~#!3{1+E?7j)TaUO7&9$>
zVRqgXXO+imJ^{1iRonyGlVrFV=ydM_s3Y+dvO8&J$Aq{m4fms%_%cva>Ob|LP~H~G
zlQ%fc_@NO$wf;XaJ!CX-tPfvpj?o@1ml?eh$)S`=vjX~80yAAD(#Bh*Z_)yexc-<2
zv2Q=D73YntDiAF>hqS|_etIH#y~VFGO$$|yS9{0b9>3H4pVlJYGe7#r^wm37J=RQ?
zjI*-7(dIzqfp6&fY!R3}K_Z^hUzM^)V_{ZivoWpV_0-CO4NqnkzfBgPQ^uG1EuP3e
z&LcsO0m7#g=*T-I!%6m~K0!4Bqz!%R*y}jD4$7IH&msf*7_Of`-G1BTz+jb;!EOD9
z6Cl#B7?H|EjRY6sM6Z^I>*Yc<k(VDyV=IUP<TiYwUk(|iGd+E7l9}y?%}qHWyU_k6
zr)xsMyWn471S^ZSqb5H@-)(6{)4{UO7m>az+bQ`#2K>aHV_4aCMTi(x+7L*8sAxH6
z=&k7_y}dp1`}LZ`S~*nf;PO^&x658Z!_MW9{peaUqcMLn`e55FyZXjNfj`D{lOuoE
z1GI8Iz+GnAT$ogbQ&FJr%52FZ2w|-Kw0YyOJ#Sb@<Elz7_50lPTFUlTu?TpqW%;+O
z_473(a4J1+e{L>;)M_Q+SK?3w^HF<$wx^$Y8*r+=R_JOi*}B`e#<81UU6(Yq!=jyC
zr>@u_iQDGt>*>@PDs+FNSvUbac$cht8=}p9-%6njSfVGDV#4@$?;9E#)3ZL^2i+U6
z=^d;1J`%W7`kuM)Bkt2YDS?C(Z6Gs`$xgHN7Khgqk8s^5Z_>*_sv}KO*Bh6Qq<m8a
z5Jasb>lDkbnL^uw5!l@IJ=D7T|N9XAn?bzs$fIcG@j$&Bk0YHDuPHyXB|eTN@<jd5
zDM^9YVk5-<N$K29G4G4Lvb>R6Q1p;~C0{*?#z%mMZ*M~J-5myJijE8E!13qrHY?3D
zc#+EDT&fIF9<mMAMxyi<U9mfVqioxn8tS?&@=r$}Z@RC!Hz&|*>>)gs(XUywWU+-e
zm}HtW9gwvoB~~Z@kFT!|i?UnSS42XjL}><)R0%<8hE%#yx>KZkhye)+iJ?JKLJ$##
zknS9M2<grNhK3=A`VD*U?|07G-#+Jh{~EZi;pJItJ?n}4z8`F`->S3)f8836Y${#e
zs-3XSpN6Q0>)r@n%jFLRS}XZ=E~5k0n+Nu!%l<d$KJU=hnqlHz$L6aoH-;5zetS*|
zqj&23j`Q1YArH5hpv~yGqUOSrVvRgG_074)ToL{*eL;MAx0ZnK-)-S{M}A3iV!)-4
zQ9{j@CesRjjT$-AXX*{XqE{UpRD8>Ro`5*MW9OXfeI`hf){d~^W)RVE*^^j-1&}fZ
z+sb7-as8N2wxH~!6(qEKbs{dI#bL-yY%89g<%V?^=+#xB`>tgv-~!zfcn<H5WFxmM
z^xrz5y2WJ|x=oEmf3nrtgCpq=tw$oQSF5HcdOa7wG?hDJ{wW;k7r*;4(7Jb36=bsX
z`Z72~UOMwesC>5%qaE&^>;8lB{GJ}M>x3WKBKJymuPg=x7P`Bag3<vIfZJgPh;)4;
zeur5G8aEoCSr~_L-OyMya!9%9#xDv}ihSK?`q1Y?P9zP`zzF2<^_F2{GhW_UU!u5O
z9^rd2pw0VDwb~9!_o}xtDyn|h&h)K|W#X0#if^LU{1EzCjuAH;tg!P!+CA24zwxxj
zSufu9=K=$UCBjkc*sNT&=^HSljX@5~@?n;Gp=X;a9)lk{_Xqf#&^&c)xGonJw)urj
z_WB*gb@}+Yfe!klp^x(;op1M23D+2G{vts^=U3ggOO{=L??th|Y@_{73UNyPZNmP-
zto0U_8>7w?+Ktf;Ug_m(KBTTaK72k>ZUeL>-=WzAR$KOw3xwvU-h>kEGGQX<CzXs#
zaQA*<KIESXp%(`t%k%SwmQ%~;C3F!W4nMlwi9@ZOy@5n%&rmDa@~SS2Y#aR*A0ozr
z5t~lXHu6^KQu0<xK^XZte}+Eg(1^+uRCH*{{&HFFXDDUpXX(Q0zg7jEHK-OU8vx&A
zxpKu2*{AjDf3g4j2sAN<e-Kv>b00L3@&HB}C`XSi{?Y<)e5Q%RG~Io)atC}eX$qms
zLj3tPnjLw<Iv#RzEGe?33`b8qoe-NBSo;@`bvgJY;r1QnSYBp72AL*38k*8g{m_lC
zM3%I8mKznPFcWXR?X9UaAX8j1(W%fh6F<fSL^eGLPVT+?HYS~6zgxOJcz{Cg6XtY0
z4R|Pa-JzMle9aTk@j3F-FMGY_`~}g4k!rq=*+$S%`8^-u9&3y`_V)7qnS5#OTRsy$
zwtSrmBi@19HD(CncYVb8E+s?QEpr1A<*88nD&f;cc1MW+3zlj;d3Ds6L;OVTt5dx~
zCwa^B!wC55P<yo8j|gjqt=<ISaMTqBc^~#uyXjitO{%2FC)<lb;OZ_BX9f}TBIZo9
zR{#0QicC-nVBh-l9r9X@mrNvRZ|CcxJT+A`3&WDFfu_9Q%~iFIvRM^Ia!lxHfj)v?
zVYTTeh@Kgku&;NtGjYpY2=A45A<;TLt~CZ|9uk7_UUV<zbM7So40oM484~tGf;*Pa
z7%xw!edudzjhJdZ_wj6UCdNX<ufu*Ni*1+`bF;*l<GCNWI!`Xi_I@*kbdM-Wef$@>
z<|z#`zoV5f`2=F8SOkwbDi&Ul>6cVbG<XKDRrmyV^9J!JJ@W~CxHU7kcJqa}1fE~L
zu+)73d_oqFfr4?tIrX>YOywBJ?YK0T_r3)YC;BM}KgASo;^*(t$DGdVvJB9Sc}!dk
z!)V!dggq$a47=6#F;uU_`qL{U;F5vG*lY8CE0VU&rn_an+-&Np_34+QBBcAvchn0S
z(tcMc3L35G(?sYQRR2?*CjM?iT&o*SnaE*)q>B$S`f$F!(qczdyzcF1nq%*e6FHJ^
za8{gsZfEVlOFVnGsuv#1c{qV>*O1Y(g9k0Hh27`2!};-#hiya8`?@!0Q!tH+;_ZBb
z4|`2lT2d8P#O$1N-h>I(S*e`L?xwgdiMGFIZLH;wv^;w?A#gYM7fIaY<XJ?5``?1i
zKmQO@-D}+StaM*>{&{}$okGi^w)wI)TC(wAx^K84@ul3r;@5e{p&*48)mWo1H{^!<
z%YINl@Bqhx&_UH|ZIy0I%{Qq|j^LLo)<)C17EUVb++CDe@$8ChLX8fiQ>Aqk@WvKS
z4J(1<G{4Ee5r16*J~=1vN0U$8iF-2A5k>|R{|K0OiFep&)7GN~_xc*eS0ykWO9Fso
z$cdAL`247y0i3J&d{ra?P%+ohoOvf0%lKDd2&MGUfk1DMdCG75R5uGKT}&-Us`8f2
zy*v5RUn^nxo6{|Yh)?Cnh3Qs@6#I#0VGhhN(pCJsZBH)|=|>eHDJ?D43NlqO&T_Ba
z^Cx-o5hpJDjG?{K<^?_O0`s(Eh8Vg@YoF7|v2~t(Xo;8iAKJEx%eRS-x=n=7mXB1w
zYbT3jgg)({z&gKG7_wMpg7mKHy5?c3_`9KXMSma|u97=5{XA?v@!{0|(#4)amXEOF
z6qyQn7!g_btFXwz3WPkQ=~N`AXDe=pyYcelS8+sP@N>Dyix7x2zh2eOc7rG5bO`Wu
zD{1xBp1&N1sF^v`#Y<udvOWx}?MVoSbYI=`7Fs57!RO8U0T72pziT{^L5<fB{2@Dm
z(Q0djL{sj`xdG;^3`n3PYw7i8A;~P6v&26sINxvvGuAA5$?4$6y9t{5&%c87VW<R&
zpXOE@{EdCq?%Ovv+cxd_U5IG7#(0C8^5;ilTJbsnfM7WLROMb1Rb7dcxK2XN<xg9V
zG&hLs>QNsBTTCK`k>g}E2GWY}BBKeIwG!#6FF9!GBtt8)1S|Kl3lYTz!S-#eFJZtF
z<6CM2ir>3UsZi%!Val=j9<98<N>8WDO_2Fo7!$;K0QyT~fb_yDLXB>g#u6ev{3YEJ
zv{OfzD~jLn;TCMcBC?>u&UQ4k-&(%shg;`EG*V@BmCyUlQ2>QKzu`s&=VDRl4Kux$
zi@d@Bv^5_&{CNFgq<6CceR!lWxx)%e6lz`D2|}KnuPLS@HVPG9N+n<_OOyU~7`30@
z2gE|Bff2vLoxsk`7@BNA{a}iCTn|gK5#t!N=o#G%pDW^AkY$P<1d6LCQl|H<(dq;E
z2V$5TDyM9^i8G$tBQstl@vRj%bS#Sc3(nO{MSE&(K8I)O4$<E-KPOJ3s0AH0yG??9
zn%-CFKf)V%w*p7jwntQbeN<8ZVS{`<`JKf}*q7wJ4g3oCw9N+lIfhr_tdU?jG^$R&
z>3m(WSx0*0IQH|_718j=%&Ihg`$yyi=#!eh4D+^;Ul(4*^Uct@PNs!BfEk+WGvFcf
z2~uO=CO_V;q@wODvw&Qy@jOHngOm3ZFaNZ{EwLO0pKS+&_rOeZw1Db>0-g>w*F<h#
zaSq+rsw0Nd{i@yW0<#>V;I_so<b3w7(RW(z^BT|B5ibl>rv{9F%f=1JgNy}g8x2DO
z{Q^(FW#@ioqmJ1w(I@9wcI7?AVy?s|utRMLct$+c>bhnogg<sv6!W7$xBqvMDNHgb
zeW&SBPAfuO^APgW+C61T_ma(As(e37Z~au2T5QbvZE-QVHEoKbh2OVGESe5ZGeSYi
z1;KA>u=$bSJf)N7@ab>1UL#f$Tb12o`WaVSJV2uHiAu3z`r|khWDb+u8!$P=#?{g{
zRO>ZeA4dGPU+_M1{|W@hF-3xCy@xL&Wls;#!ESmDPSK0^&oI*4&!3I57Z+P3!U`#N
zL==|K06F=%JOY@u9_d{V#Vad~CMgywH%CvK;nL{a34rJyS3lUtcMsSy;yT;=?Ig9N
z-T|O_FR{udtXrJU-vQ(HK8(pp3veXiD8G_>ZM(9^NVh*|@N+d7|INA(!ifFeSnlIJ
zg$5Ny-U+Ba+v&5yh=*gaZ=u9=Cd!XaIz~VL!2p`a)P)eiBvhce43{mcXeXUAw``{8
z>eI^YCOVNTKVn%KvPC?1UTCsKIRi$NC_&m3<FLsxSZxJi;O8L<*G#|JCBD-swx^mg
z+9WjOIZs8>o6v`@RHxlR_(tn&MQl}-;)g%XXKO$Ih$IN!`Q5Yf)QsCG>p6UqTSL`e
z{FijL)cx<^0-uCm2JDc*Om5C;4}~!6290o3yee?+Yp?<COb?li2)Bd2lVI)aX7nf7
z!kUmlK}l#qyo!*ax0^jTWJ@rusz$o*10|7^;qPI!`^Mmd+TR~0dZt#-28H(8*dN~M
zcxY5pka<n74TpItl=xi^U#J6ke{Q)8^h~O^=kkgN$S#8KdE*7^C;Om9+M<x{t1b74
zlT^j78SeUQiCu3<Q&gF#8XgBoSPb9AnxqJ;`X2GBWX<?>FfM^uM;^Z^<9&^*J1C8}
z`(isH`;rt7zFEe5A9k3JCVoJ2$#m(~A5s`UzXfgx&ku7Pc3n&K=yqZCIJm@d1#Xv3
zh$#d^lTNjoi%*r`7rC6SZ(3*48A`u<NcTrST0`|FK%u61V(4xRg!MbB=@K<zTse0w
zB^Y`@{pAi^FQPKasO|u<HY<s<GS%mdQiq%9`<C*YUxWy&W)>e|FA42G?IOrRPB4Ex
zeW6NOI=PR5l`C_a!Zja=;yW9BT`?32-n##UOMb{10UEvx=IzT%yNMrgALp9NL|)zw
zsKnU{Cwhi|PAp^_p;O1ZzMg{t0SH4;7TG@YhK&jo@qS}92!A7{ejAW?bE#QjUVVtz
zI0?0AXPem?#-s`_2s0$l641)LnRTF>M$c6<!@T{^ol4}U<!Q~A{0GPVvTVI9i6u_1
z_^v{$`<kl#a%WtMo^xEfuLV-$@!=Z3beuyWd-w*L(hoU}%Ng|c%XobAj-mz-+g>Ax
z3RSVBu{~z*um33~7-5LfydD-*+z64Xi)9-K(E-|Q6>|w(7DQntk=vY<MP#C&@@)J>
z$&#(f4<~+$8^+i>S@lnZTJo>t6~F40t1yL24CRqw>Z<#b-!nyn9UJ^B9KHQ+erAGi
zgg}RMBA8N;E=kS1m7jxP)*w95vzT^+$vb8eQh`f!GO1A@C<!r%B4}<&GJN(2^AkW4
ziT5pTp6Pxvw_(iptnCL3vQ0M*%7N4!w196_q@Lv5Ek#8}2+>U~B-3F`Cs|iy!f7Hy
zyDj-r+5BE3s1#p@?`SU7aZMu1HR9bU?CU{)M_S6uC!&5po9*@zt|?sS584|{m)8*Y
zWin|AlH6q3%!ATkrO%%}|B?wiJ>P`U%dkS!0)J!p0E6{j%f|&76KgM{f@mnh)_l+p
zwV>mgmLq5C2V23u!#SO+T;SHZSJY^euW`7}tw+hOu#=q$V|>UFnf@s;3J|G?nLP4C
z8$mp1o>Div+yU}hnolpFcg<(~enr{%SnAJIt)=6eY(v*bxRkCMIWatdjj_z-Ad?^S
z8d(-iUDu7ZUGM8moFM5r6KZq%X*!i603+`(%vjNbXuLLL91?egB7oUX8u%R?uz^6Y
zmw_7!7_%6LgbFm-Ac?tS(q!CXVbcqIe{eH{yKNM(HA9rKT?j_T!d!ZF)B@hMwZBSS
ztW{Q82cpnf!p=&8)WI(0RmgG6Nv3TaEL}V*!tij3*Gcc7%Iy%RJN`ek*@CHIfu(Aa
zloUrEzw$d!^$PsXaLF8JKVy(zVb{*pE3Q`^CTS<0eJy@-IbK-$ph2-}-?DTczx(AX
za^lr?*-RC!NkeyJ<dU0LHO7n|b&ln?!oLjLq4e@0JjBF`co$Na(^8)a@J*R@(l@?i
zix~|DGnG;7e5dg@8Z=z%gE|9hW1Kh5(qB0`bFXv`EK`9|7+S_&c!v=8y+m>Ga9Gr3
zjLcp=-@=BkN9pK2<5E+iH#(C`>D)ccSBBZAOYj?`GDX%jq|Uat%ly%>7HT>z$LhPn
z4x6a`{!X>A%|@Emt`TFj$O37TQW~#HvnxQghW}Tl5Qffk-=&G`T}tW3*;XHSjgUaS
zZCI_HT61Ip3GeO%>?stqzRrY7tu6ovvRVFdy{T1#fRGTd@3n#e8xJ&!US#AmYwd2x
z^dODcH71WlChcjYC96L7Ol@D2H~hfESjBVN^ZS{3G5hop(8B)Ur<JMu+0eB*_}^!l
zVM^}dpAO<LKLn>S!(~$KiyZdT628XB_{*NF+L;hIysp0<=HUT%y-jtNiHjN5cx8vP
z>_x4Y;TU=EG~nCdM6N5gPuONWf9W0e`K-IPRYRwv{C*V(q)21`!s&0!bn$K;td6QV
zV`(goK4zzLo~Y#KH1ov^;0xshRjUO0Z!zA`<`WGmzD&Q`Cuk<Wd~OmCkbe1G4x~qV
zRWk4Tu#a2U$mPDN$1#tk!BM67)v6gBU3Ga3@Y&t$R_Tq_fEXK{tt*zpFf%zF*fJqU
zKvlh7|Dj~}sg;XW#t=rD5q#{-Mx{M{LUXm7b!0g$*^Za#nDQ96Hna_w@3?(3Y(w5E
z4L0tDKbatJ9`~LtVN9F5@jY7ODL@25AgEnvB#l1a*lrV7%c4nV05Ymw#?XOWsh?S2
zk<yF}azm7l&iKtH7?$V+Cz4L(LB|ZS6zt~_6fervfx5_vTCJX3#2gcnL_)Pclj|1h
zwsj8DgpxJ9!8ethH3?%~MQIzmnKCg*c`=Ub1A6+U?q{yCl4KhfTIb^f+Aze`-JPz(
z)ak&7vinY-(^q5t+C0@%Chv)mZ!v~tdATHws-o`pgu+;ZCp#0lRMl4A2G=KGq?cWa
zX5Tg{lKQAKW(zZT;D-k+3VoTV{k->yvRPZ2oP;Yxc2_p~Yd)ZOZOrFVNH<Gfi!8K$
zwWPjo=w)!I=?g<NiI5zm75gdC-e%Xpv`prR7EG#B7m*1qQzH;Dqs}3K%VHDH!BO)|
z0BMjeZAUgY$k{lb;JyK(L3A+Ltd61Fwr6fu>W(W3fy^y3S5CbiXCx{M$u5A1Zc66P
z*b_~>WopqYB)!g?PvX?i1x@DfXL@(!$5&Fr=u8<I5}oFF5R4sOR%NZCt-2(P%!Cn!
z&f)MIKk(1mXtuWwbti`(eDr{(%6K+MbzILED+iVtFJOF`g3M){Qr{wy9fcX^`M6cg
zAL7B5#baZ4sm;`bI;o|kN%X!48Yxz_NC-YAf5p%pTQQb)wo|QT6>gtlcU>;TK9+tQ
z3_$Loue>t2@<_4RxHe1lM=d3*LcGTo1WL7E7X;9#GLv}UQ@whJrNxP|33Em#1a!)(
zey8dEo5C3nwo9k@NBv_@oSX1DyK{K|wKDunTQ1<C*&@7={K{s?@;E3USI+viRYl0H
zUerd1FoWt0Co^v+bmph!Z*$@U+dJwZbjVROo2n20ND@Y~=^u>=1m3%mnje=nRWAuI
zW8B1-Q83OjpM$vH4L47pBLgV34g~j89h<72RwFE>SYzCNb7u3XtlSDF31J1f0NkT|
zKB;608yP>C7`I0zyu6la)H9?tyo#j-hNRmh$Oa7*9UQ^MJRq2{Ru!U|u`ybB&eRh>
zLNmDat1pH8nlEoj84C$c0gn$l@#LHP*(5Gq6pzdV0bc>L%>~;~(-#af%7R2@=v0YA
z(c<7GfiJ_l3JH0S<Wi&)1y^~F+_3QFXSExitYA62BMgC-CRw}qrf*!nka>&dtIEZ)
z5FljM@#QrXjMvv8Q4}Xr=Z2_t+vqnr0fw$IBF26PHVFbyH#Y`13`;^LNoVjt_C&i8
zRmUVrs45%%Y*TJqc^RiUXO#ylT;}=>YCB}HGZ)T0RSBi2d@t*R5ddj8Yhd#8TrgKf
z$%wXiEgrH1joKUVwx6)*kjl}v5&qICS5p}h4g-l6Dn74OoW|pE^Lm(3Gh&{wU+80N
z&Il;#p*F0Uvd#i?((D{OT%W#N3f(iH0{rSAXnOg|4%;XtnDF3!;N?2aPdS80s^Z0X
z)GWbWp=f%P_gjSzc!UB18?{T9rNFCICB%}QM+?E;_Q14pnn*osOhD1`{M65mjc3$V
zK@_Jp-y1M6JU;i1v+vsPNK2%p0>AAM1k+@{tXmixB%KB=r#THWOkW{`&8;GFZMH3$
z>kkmev$|QcX@(+|&d$*{Mf0VF*cx%kZim62xlLkKQrP^?-5a?y5|n>-@nKOp9#JWf
z{G>>NZX7deCU*{&QGJ2mXbp;u8C1Vraj9@JNoyv-xh6q3H5@NL@Pw~)I+V*Jw%h_w
zUlUkar@NQb!*w5e>F%UpqE4=cA8`cq9efwzMr<+dO`is8Dc(7~4NeXdABg*S-P@Di
zk*<~}XG*wMQLyk`v7p{Teeoi4pT8kylx<J<7^6zmINNueLN@u}2?ulVqAAZfHn-hN
zCUT#@7k{}(OX;g`Sg*;h6P%BN9z>7fne}oM_vpwRy?*&L`8VG;QZIV!BH2)tUz}e4
zqrWh!XJx{@|ByXvrR*02OFfOpoT2I0nC6}}o`mq>iWdgn<}%Kp*~bQBxW6wJ9DKai
zof{oh4$_i(eE|r5cPRG?&_&XUC;kT_xb@+5gh6`|EP=Q0!n>R&CAe>%l@iyq*!t0;
z15=b6N{LPuaT%Ckj4D{~LF??ME5W5j30K}6lPbutkomO6K_qz_XA=&X{8sM;<;6Y<
zlF>WV@mRP^Y{3&0ItlRJF0}a4g&8d0z`qh)TNw~zKfSC%#pfc2wJ8r|M$XM$h`^1q
zK4o*U2}&-K;sjABE<Hi^;cmHKC&slkh;nin;1*;!SNTMW86`hg?H_!<H5UrY#5d}~
z$V!#|nmKyJC%V9RsEil;>Gau~h*)lr`$}bRAC4E#L^PgJJ_cu+aN=BeB-nW`Sqz`X
z`KLD?O;y7Xk<<=WBQecZMByaJYeo{6ZfnE<f#<AJ%O5ro0pq}S!q9Yc8B2VxEWzr_
z^1Gcn>e;M=q8A2UvOQWiEY^KV{hq5Vr>e0}-*y-^$%q)~;QGy0fRKl6;-YhqvE=T?
z#w|i?Gyy7d-S<GQ!JfOZRBCU4*su{S;d`<%V$`ld%h@0|fXxAVLl0kcbz|D${y_q-
z`5m|1fuALg=n0M?>8DDk-=)A)ldHq%dn3J8Y_$z&o$wk#qUNQqpgr4NS);Dju=dQ)
zDL%(Kj!oZV)7?+b{oW^7@kGRsN5U!A8@5+BVOAd}KkLt;s3tm#t`U{CWKuCCw#lyY
zVRU9`++(hQ<n8sFhJN?p&axr)ae7s7sa(Y_BCD8P)`$H0feBkMo+{5-hijefhIf>1
zzak~Rjns$e8eD$BL5Kdj$me8`SizFN(#U{ue*8z(jYvY8>lo);S-A-Qj9H*r-IQVV
zhO^;b*+r(qFl@RE@wR9d!Y^LRofB~fBw=j8vm$@D<n%dp`I;Z0ZG6^(^0nZ<ms)P;
zQug1_uUxXzu8U{fSoHUtO>nS12ppqe`oL(S%<wTjJkh*eHP<#H4ZJl~N?aE4QqEQ}
zRm@ZC=A-aGPQt!<8Z2@J02)VkB9ePx^sG&H9zOk&9C2=xDOzq^q;kbhdnXvV_7!rS
z#%WgkNIzEAnN%)TpJsm7$i?yvVaGfslaw#u0;f|XkfvTbHRqapf{*=EncTw`dM80W
z(WJGaArM(wY|=p4#gR^e<4z6fS9Z@#-*6}&*KPH+<f~?ocr{CXBrPI`ya`U0?v#Jq
zi|^>P+_Pp7hIM%U45JrCYDDygLwA)k>WL!gz8n@dRx~UfqHeaEn9M7xXZUtIsK-}g
z!GVies#rL@<455kB`THAxCnQTR`#W2pwy2g=V=UGJxcR3CL+iVT?Hp%YcSW}iWm!n
zKQyJFkV{u*3h9obUPz<}#iZ&mj4Cx(v@i2XIXCD`(xLNn)4oGG1p(WBtP#|tOYw#z
zEUtIU{tH``YJ$YKM^MT`IEB=6iIEcDl_$-D6E@@uVxT?4LT61N3TIHz7&N2ZaQqy>
zXFH!x>o|($Bdem?dUDeghe%l2{9<hbB$VC%))Yfxmb?No>29PpT4~;5Nh#aM@`|u_
z)JJtyQV=fRHLOHO?dqKpe{yzeqT#pSX<z~y>>oFmO0m>R!HFkm!2*tRtyAkw(lx}b
z(Psm*nzMbL?t2K)qANeSiphXe4nT9qPriWd6=!gXO`G>wTMq90+TevqmCjhH%`JZa
zabs7LvodQG&03q=WW)wLn_GXS!UL(Mr;$e>mcE_oUWZE|pyy!C>D{tH0_GX_?RB$P
zKJU4D%*gZ3iwV<2E}u2LF?N!9IJ3Q~9z{oBGoQN$j^21nFLjEMc9?CulX=}_EowA^
z5#P#rjln4Ip&SkSks$g_%()tLZ<r+|2JJGI@RUTQqUTBtfQwfLov=8LW+jAUw>$Ys
z5?8Onhl0A0DrB?vdQ?B3?_0aOU)Zp3o4EBQ_=Il&Jr399JgjN)DULrE)D-cjjCeJT
z8@_0x3Hgw^WQ`Le#?_19il(r{i`1iZ9yaSspXoBgis17Aue-}%*%Z6B`tXN4D?pgh
zq`Uakwzdmd!wgb?!NUGOmL&%J?ltiVwip=?(dfwbjSU8#^z#79??4nXaG2W9U~1TQ
z@vV%s;_+zrVO7B|IV&M-?mG-PL@0eX=}_<Mpz1;ST<e{Fv3nK2QMqr`scd?OP22f>
z7Kl8GIj=P7nHgeUU^9Fm?^oQRyTs5%b+;vJB)g(BU-x-w9pn@rKq8$WjpDqfNk`;e
z`q9ZahPo_4{T<zI1JZ(Gc|7urzF`Gn$*WE*wZ5%I#}ROG=Xo_y(W5%k3b7nfeR&2W
zW=r0UdBET+Ck!a$H+<ok#i&^U!^b2u+b4Qwc8uwB3BmQ{?6A2fVz+=@eU(aKD}51Z
z=pV9N*{}EuVe2XC#5KunUx|G1<czkS`17PfE0{J-sXY&GMJ68+BJR}6vfppRmQbM>
zr@ul@K$Bb1l-DzkmY|RMTM_0huUv<Q)ORht{31=H$R#p)HsO9&HWpZpHVwRt3kMG7
zuL78NM#>T+JkyET0J>dB^1xV%*so64KMi%~E%8Z*o0QE97k+$>*bASaH~Jal?rBRe
zCM18aM4+l>zg#kG^^C7qswK~vSn=jUrZ=g0<~a4mCf?;RF`@Fy0NkT0%$W7c{<Bss
zd5&#Gu116Tk;z_>=N&xjYgW*vIMUpdl&TIAqcS_w5+&&$k|r1C%dy^g-VNq6)ehTE
z$O3LYb4gQ-X5`%Y8cR$=9!WpAEZJpASNN&NjpQ^j)gS$z$Ov-Vh3Rf!stPFLqOw02
z={ULQhmmB#XkvZo30b&tI(7NUM%eTYvOI4nB1d5u#;C=gIWjp}(m}y3spJ7%!DyD4
zi6$t68nQ}>fvC66tRTON?x7!EG!$qYtkjx`;=LM004-nVfGkNY*k|_10HF|-zY(0y
z*+J3PcZ&;%RxGlro_sk6$bmwmi!s~)i{)c$iwbWwvJwl7-i!>kv(!Cq>B$T&W#luP
zNgeMKy5;4!(r0BPLrw3^2_yEK3Nm6l$Qleo9f-0x67^ynu2lsl4vyQ%T*;u%jBvUu
zLj=%Q3SR`88jByl&@*^odxl+-btal+Cwjme9p2dnKAl?_2t7c*n;1$74Xvl3mP&G*
z=_1%FpLYx%`jF%774Ga17k^GLcb4Aa^<k={LMcmB?CJc$pB({A&0*pMGcU{zsvqWK
z=5xB?(@Y54LC)%Qn#QP6_Pv9uk8(<o;PkL%dzmr<M*fZf6MEBfCMzg&CVObN4@qF`
z5^u9@gXG9k(*>V_{AgA<?e`LR-Pw=&iv71uDblR^x}<N$p{VdCsPzuJr_^`u)nfAm
z`HF(OHo~P{<M=)}rmIla+`DEFemw70``msx%agFpp)NU#=8_+yy+ce<O=A@BUlmoq
z>5a3^q8`0i@MWvmx@mR5kO$miIK6L}bG-p|()@?hHSY>FqB}5hnSYT7&i#f}6t&q6
zBpf)k<ZihGngryDH11qAI#8)Ya{>E!?@j_mj7Go3V8{TMalr@4LY+L5caG<X2NcPq
z&6ix2s9t3)#}kKV>TkG)#Sjj&apUvlfp0BVx&6bYs!#kf55_ral%GGIOtKWsH`a#v
z*c{~WdbYDt<-%5~5ogyWm&-f%pX`}wU}jI?gQ9BA%!IZgAeNWbSp}W2Xzu2&W(oM|
zFT<0VpUu#C#kll^^b>7u=y%14C&Ng~c$yp2`vl$A3X2wOLcr)J-WkASB)vva%%eXd
zF9*|4l1EqOr%qZbHHO=~7xJ2kD`>bUFq3BWN0$Y1F$9ANOF!C$o3c~De$xB3xtkoq
z$YY~7q(gXeRO)Xe)wdgIe({8_^Q|k-r{s7&$>sTSuvZj5{2{XJG?3DVqT|aKtmis0
ztQvWqA=#G`o*5TF&w;N#*1L_ayZsqUr~A5|KxCoq%^*ga@u=S_OMJnx`S3f^kpqez
z`|2vT*Q5>|&%#W3R6qzA9~qB%uN(<A&6_qL(P`^$zK|b?0d2>++J*u@v6U8|_eU8K
znc(vb)LCW)|6sHC+}R*&MBfaw&ZF``cg*iGm;?`tfFi(op6STpMv<GYLD7E+;A};X
z9VmhM4N?RPE`n}2+~dx;hUFt%E^+DH)P$CT$sB$(!Aqiq+1*t!06od$$7bi{DiDC4
z7LCX2RrE($<#)Bh7W*+?F(}b%w8rUc0bV>HpT_cWxv+r>tcJ7;xMcAv4EL?nqao>O
z#`v&MK!(RgDG!mboH#~NQeJ%Ua+TnIfS2Urrzjl7)a5&>=Nb<&?es{mwxI*JD^r1m
z$?NLL&EsCk?0yy16mU`NB)i9JW8t(v*=)aeo895?HRDz9HoC^PE!yj-{XN(yb3_DF
zkt9$JI636wq2FJU?;q<7Hxmbm++@glZk{~*btZf99u+#_&L5Ae`6-A@1sHgtz1$H4
zb^1^Ia*-~y$USF$`{7KEM&#b04gIwNB<SkH`y>5CKU&zUu}jB#`+bO}Ym~p@l`p*k
zMve^)#TP%Z%#_L6Izs^cuf!PyZ(y+n_j|G!Nd9S9Nd`RZ0EW`cr!NnB@sO$G&x_4n
z{`hLjLR9K|OHgPwSK7y3IIiX@nj;?y1Mam_2{pXc_3GN7YaazsPdxCnq$$j014QLG
ziL*wxeANUBZ*L9=ATRrxPjY1*+z;Sk+8@=|DGy=`9EBRvp7H!vHTHU6n@=9>HR1|B
z6XgQX%7`Q-Ug;V~3&40#bwK<2jNZ>EaA&LaN8iA{)J{uFA9c5XzT#i+YXX$~WClUW
zfu;kC{Z;zm)6b1bQlRFxMekoTU;}x&?vA9)OVA3w)r+V}wD({&eMm*&<NNiK*ks%2
zQ5~*bndTs+kHzG$bhj60uwQp&E*tp?_+menSmfjIvx4<R(kIDO>PA#NOetoM|GR}q
zu*Ze44|~JhcbWQvgKoE^q{$P!{-YO6nfjwgcQ`85sBd2I19|Bq=`Q!C;)S=8Ciizu
z@I)+v3IuUHqK9>*$B2zTrftQHGMFFpg0^zbB=@^ZS@?aka*1$dqQ0J)lRPqytmt_d
zO(dnlYrip!I_apeakPtQ8O!Tr6yrbM=yts9t(pvMn*<$K6&{+?Jiz*&hWW=r{$(Ww
zykCz4Vzp)Ze_z*BA+x}K>q_9n>F1RiZhfS^nH)c;u^Uye)g8vB3S7!^W7X<=s{*-r
zY`R&tf4H5V$ExG8R(YZ2X(;9*j~3Rqi!|A9H_3l}_rHHAeSmHC-v3wG_{S?(mh-~w
z6V!yqWG+@;!DDMiZ@ZWmxi2Fk0be_H1Eg^AVwxsRkeaRCEX$Pfl>1$7Bd&v4o_GYV
z=>OyUNwBRxeX3MI-#5Pb<@%ee&j8%w@%vg>blWH(CMY;zhDlr21oQ|M%!&VO8SNK2
zk3;VpJDi@*d)aR)IR&V#t6hgOO8uYK!VXA$`f>ujGF{>yy<T9XNSCxi^+<L5B=~L!
zrS8M=fKQJ<aQ0J2@<d_I$v)D4@nW^X3hR-MxtX=!m-cBY3VOSY<nw{h40N`#5e80O
z!DQ6kC^qzp*nmFzDeT`2*A*(U8w(4ye0u*MHf=$Nx7Y`nEtgj5K+2&}8ven5a&u+m
z4dd&W&8fY&(zd8<t*_$gGc{EV%qR=WrH!{4-N08B_(=MduM0fDbH>B&YAlC%l}pB#
z3f_1C+%B<J#g_!l8y_~9k5%r_St!A}kKf83P>3IH7*DMue7=-b*z0*+_N>^lr@y-1
z(96=6dB<!e>F76gQc)UhbGx(uZ7cn?+&VsZN|$)EE@Ua}TU=~un<h`^%kh0aM*g9-
zQDn1l>l>qI>-xjV=<5y8e^A?949&5A*m^O<<uPe4J68dRsI=h#J;1cb<8n)~?%g3h
z)8DQ)3F^C@Tmn_@2+1?Lu~z+vn3ZogkD&8r?MRVn5F-*UnqA)}Rw9wPI{Or+9N&)+
zyn0BglR;(`^33dC7sG#iS8`@7vdXfiLHUefEFKpxWY$KZGjD#A%@tX#ucbaXVZN=z
z`(s8&UiEG`y?2<A{^5&i*1j5O_4tz0EJAj^d#l1cQcg)C>{F!jM@avt#~<Z;JHkWL
zS=kfm#CRUUJBDfWeY}?+skU|9+d)|RZU1HyS0y6DJ*33Rz04rR(!46_jifdIH~;aE
zd+e{*CBK7Jbkwr)#=gHU$6aO%^5+>Rjy~M2U)@}~jKUb1p6i@2TExWF6undQqceMV
z8W9SkZ_~=m)FG+V4C8U3cBU?L`=wE9e!Smp!^|2cnIXsvE*%X8(64A!9Zb%YZi364
z?PhfmaFO5u=k-<m_)HdU3PcB%0=;NCz(vf0zFRB?%y1!b60m)53b&m2zx}}7oPN>3
zP+6~FD+{Gl+<ww&#vm~m%73;P^DbvmSRt3UtJkUOZ00mD_#t5HYVm7~h2&Q@?}Mdh
zCT8X^%`S3C_?ixtN5n^I#Aw%X_kQTa-aT2d?H>awLa5{Cbs0nDN7_h<qu~9ItrUp=
z{mfTJe)@b-t7P62$Fg>|0%<NmUpw1h?$f+cC5&f<kJgHja;VNdnr90g)`VKv?P)e1
zPtH7_0hy~W1Xshd^2PmPu8${$yT~(BpNmPi{a}MpO5?PI-{Z%-i{GU~e;kAR0Mfr2
z&AC023o|yh82aF6W)?I%q0#@^-yMJ8@m<xF;~*AF+Q54Vm2t`2XE5k*hWh6Zeu-S%
z$r}4OVuyshDDv0)lL1GwowKNDZ58t$6*+cJFMZ>EtjqV5#FsusqIZdrpq}|iej)#d
zKQ=L)AOFhB5LmR}eplII1d)*W@{7}FrdbcWtSY8ADsT3K0N#IcG*$b^+MdKysb`X8
zk}C21?@nLm8{QeQpzGIpOeyi5ir^A<CYGO!{bT1shz9hHOm1cmS#vk|5v7P*_o7$L
z6MB%{BBSM2Y)|eeQLX9|rrdFPJL*b}<&O{|DYk6$Of~une76rlgDu|#H9mb8z>j}}
z!+7*9>^os28K2e@!mGvba6%yeRV(t<#3kP>!wt?GynlMLf831!$$w}Cv~;w`A*HTd
z^HJJAbNk-Q6+Fk&zmv}%!E>jDX>UjVOMk(qvPz98S^$*?D@#&&ZxyKH_shuQgJT%(
z{N<#?i#}D+t2F29zr4}^;-|DiS~^BMUlod%?4S{LN5sVS-1|>gO`hdRZLni2?r*S9
zN<H@ABwvA1(i<T^(TVc1vW0=g>_Bysv>WJ4z`G~af|J8x!~^U%_EvziRmcCsAKu0Q
z3fQcem3e<vhC_|<(y5y@hx+i!>*?rP?x6>Pyb6W;v?R(ocn?X#mP=2R$VcFB#GXVB
zN|o{4S2VVZl%-w9sHjZ+Iz%LrwvhktYkT{LLh$;3Uh9~bs9cRsvo-z}J}>Oi8~u*R
z*8BKV`q0MsKK0N_q%(I=wTb?eRl7y(4EwGgdlx-W?2z2wN1RQ2AgM3B_&gkcA;?^P
zdiMD2SP1DfFdUzCm~gntCSJ%Qx?7`~xFUAm!<Q`j^?$gkfB&Fkh%JNZmG2CrnSgxC
zwy~=Th+@3`7?1tjN-ZR`dx>$o2l7yAenMqf^W`owYfyVeOyK183b*!b@nQZp+o#Af
zd1niy3JFClOB^eX&2~zmGEw%OjSJ(!S1M1qJ%_s5{PNGk%eunM_NlDXhf_Z<@g?~x
zg|h;pxHpBgx8!*aQoPWMv8b3M#{cNQ{&g&AF76<<K9W?zrvA_u>&885<}<uWe=hF2
zFPJhB^9%4|C`NVs`76<ZpjMo6lI_WYz~N^>p=ioU9{FV^w&+engft{F(@GRJSnxBX
zsX@P8XyYgkcslPNAHmgxU0+6~dXN6<Fn0=nCbnVmJ~z9_ZjJf*cy*KEOgILZ8U3LS
zd^!W&TsY1bsN}i7;+3lpH7Xu*_*nFWdGN10;NJ~<yUKKLOp-C29z?n;QDxuCM`YIV
zTN&j?fuS4r<i>^WdPjM(aI(ff0%hu2Q>?G@UA*nXKR27(X1;%&9^n-$Iqrng98b7p
zlv7o?^R;z*7<HF((5%SV(VR5-DQ8E@x<#1f!>i$Tr2bS=yb+byncki8d4RrM_eEa)
zcI8bM1zcKkQd?SW7PuUS`+J$Y)5Ms}d6Ol1oN4M?qnOzO_|)FpJ{GR84tjXsG@@-2
zw~tp48<#)vSJ3T~j{9#H$zKjrN8lu2#v#{DP#~2ZPcsZy#ZL~5@@AEcozbp}tyFO%
zIcdVbOBei59M(-a6B*F}k&TK^W%q~y@^`$mZhTCo3_O`kX)X_vG_MoSjgDlbqa&NN
z*uXD&n0YUo-BuJ8@$;dX)U_Ev*i7>HjI=L@+uLG#cyy?bEZN|AQi@*e&{Wpmqqnet
zSjPPFqLmn2`otaLHNf+E`F4L94GMy{*!+Efs*g1p{7xz|fn8H>*-04-gjR5G=d?y^
z(f_ne_Kc-dbRO&?JAO`6W<_&-I5cRKxBY<CRiDpHadm<%RIK^(`jS4G1_~wqG;r^L
zYPSvs?px;cC?U>M+rqd?6fVXj^_8<uJDqE7uFc|(2sOy~*5lx04qc6C@$0kie1OjS
zG}dK}#qa7E_iY&OVQx?2l8KdHO{rx6n95^+V=-28+NF(#Sg4A`8+44;@?g&;Qs5AH
zXvWY!p2~Uo;nH;J_ZGFOoyM1+`#74riJc~34PUu!i!w_ymB7q!6KR9)@K)Q<=r*oK
zj}A<Np_XMVPSCL$IzfI>Ho^m=)r=OaBlkR=@vNnfHh;KNzvtKfv`m~s)-=WJr79`+
zI|WHlwjb|T?Z5d)laJW!%)7OFE4^=<ul&yEblDR09ka<vsoAh-9Dd7Bd0*5gHJ<qR
z3SC6PqZ_}CiM3OUd|q_+`xsssLt<jTVA^NcXLJgZ61q5sM_$oV1INdn;Xyibt|upi
zmWsb>P|7%(R+Se=%LC(tt&At~uAia2x3Z>llB?&ZC&a_8{p^Ry;7?!kccXpX1%E-?
zplT$n>=t}eW*oe1Sj4(#-(?FR<`y018cKnH!0J*(-_<jx7B%|5pl>j1H=+(HYn86`
zkLO6T<;Nk2D7_^Nea<B7Iz#CsZ|Mbd%)w)4a75=DahuAR8lKFT1e>M2$$txCTD&7#
zqCFd|U*KR`>Ss55lPL1vx`0VefrWP+6b<l;F>Na<)3tSxg-x+%I8fT04-;hA><=sE
z;pd%*iSJC*#p39^mzA<xaerPHI_k~*vMW;6faYa}H=>5GjkkyN`<RLH=1gAe`d1n$
zK#24D(Jz2JjLX>*^MJVr_f6A3kn7UL{~-QB*vderH@g$?l-xy5e4CLtPVi1Jz=&k=
z!kLc9eSd@DNdI+LbLZme{CW^OwsfxQ&EaY(G<qM{ez9Axx-|Ak`aC|%AX?}u<veBl
zBdnjSt%%SR>+iSkI6GDYYam<D5!m6{w0W!iRUemU-QHwbQ+rZ<|IKPVBOV6{w$9#B
zqjA(yfUIr&H<_#0X{M;uf=Y$1>0wPo9=jdiqectT<Y^WcI}V1^gX5i*6O`)eRSgl%
zvjPDbV>qAxEB=-i_i~A%S9je$$*KhH^W8NkrUq=eW4(a~=rgdAJ9po844A}ETR1Q{
zniyJP{L;`Me%7N35WP}-XGFF%nZxb!rSox^mvS&PZqc1IQa_T~HanJ03Ej#|Ow=0S
z`Wne_`yeF$dpukkb9#54s^9i$xeCHRBd}uc1AuMb>pix$&c;dL9V9p%L0l8nMRPAH
zh|qHGr@x-@_iKfyu{v(p(}i!@f-~_?K0aJ?f0^>>2P}&@dU$3?{SS+bF}9WiN0(A6
z<>a!t81bhvaa!%E>`cn_0s$*=+-;cDV?VgyN+kMu*h+}%WwaRQEZY`AM>jYpr65F~
zw3a-I;?X(x>rLF7Ow!xf)cQZgrY4Mg_xcHYg$-XJ-9DY19q>D#8Jv71Oqx!M##)_n
zYD6d1a8R<gk$>pU%Y@u|x8-e=$ufmmg~R4Sf5aKPUT-sisoGCF4Uan*npGLnCgwqB
z&vUclUSh@=H>qvE@eu*7sXY36kiyVlZYN6|9KJ=MI(Xh|EDcHKz#?<scUVk>Wffob
z<_=_e92>vm1#t8%lF$kw%ZY9u7r=kZG`8;%IMbV`sEs31b+hjMhC!;GM=^f!9u{V=
z6cdGz7qOZBQbeipOCq6zGg4(M9y;J9?O#rS?VNk~(a}4x2j=#Xg$9~;LeN;;Pi*am
z;&JKY+RY2H4u*Tu3ciH!f>tMo!ju<aj3rH4{Y4*qJ6_O(%9AI=B*YE~;I@o1S$OMD
z$YS1_FT9A1)FFs6INsFNa}Q8%2o?tKcYAlA|1Co*RXe>q&iY#oQQb6P`#){_na8wy
zfEXo<$%g5vMt_Ju4f-XnF_9<sg-(=zNVyUvHqN<|HXKY?Zsg#%Oq!h1<s!B!02L}O
z<K4ZA5f~Zbkz|Zo@}W6adI*$UyvS3+stqrb-fL}<-dan9a){UIBAN&KEvWCQ-?_b{
z=8R}0O(}Em`fZt`#n2mOcPY=`?U6e`!+(4>F+1+G*p~i3f(%S;2#ASVjf^lE-jm{{
z>yMnt=%PPIeNTLNN;ec7hm&%+EEbzUwgDa{JnVp6*%CTo$zWMr-JdKF!VLTL^Bw`M
zWxBQ)adOXo+h`lrOO5?C+?5ZH!)7i**yhRX$|egw!-TWF@Yb8hl_-S0lMnyk-OpNl
zh3ci0s}L*4Jo&N=2-!i%rnYROdiq(jXMRPv7}C0~GC&l`gn7)pv0eOr%^jJeRasLR
zO0St-E?mIvNYhgw?#leQsqRW`>Q07XDAjd2;1j*ge13E<UZnHtH<^gvk@y@Wk%TI=
z^s(eG?d-MkpK+}OMV0-A;m{q<&udG^5RbqwBf-A);(*oa;$@M02kUQ|$WrDf-t2d9
zch0jG0rN@@l=(qFYo1Y@(Jvr)=U(SphbybLvYjb43vaFe{&E9mME}bAm9<IQeIAQ>
z!LisYzT1B#oqm)l=7<RaJ1#QcF&5Y2uigl3K}Wav?!jF<Aj<K=ER{+iYIhioZH0{P
zR5nqjH)|C2vy<qh;!3@vcdCw!zsuXbIXqScC_Gk;wP^mpBqv}MR$rnT__TdP2kq5v
zQaTC(o%5(tIwslKQd)&x+P|3DE}fvrz*T*yZyD;hjw|>B67IltuK&&XW=S4%VcA1N
z_6=K6DAMAWm`(CA=+7xMiSpF<5jWo7J@|h`IAhW#ITFfrE`~q-Pf*&(3fg-v$YN;|
z_R^DJQWdQz=TD(An(X;<1XO>RyFnVs3hu_;?o!hi9o+mIVX6iZjT=jeWLY6Vj}69^
z>>x_+)QyYFjV_hzn%QA)aqqKxu1)llp7&108DQ8abDmjN^(6jE4%>HFO#T)`{8t94
z10$jIvcyKoY{ee)Z$)3~(7rKz1UA00h$KAuBUt%18d$06ZJRAdssFYeU2wggr}BW9
zDxUJSYi@f8k4so)!?<TGVdAX``z3JRLULWOBp+KJv_{Kl>^z@&lv98TFIzD=h>dZU
z=-?;z+mCUkQcYgC_Xm;m{?d4gbKl@v?f83X{a({Wl6kaHK3_zK80ofV$42G%Y7^1q
z2HQ56XLTMu$JDKl+xw3`?lvm!pAc)A#?-@SXt0jl#i%^_4rq(T^)3wXQ1Gcg#)XNP
zf+<el;uo>-7~Id;bhyxdp11l0CA}MKoFv-nOsgcorWhWt9PNd9;;*V$=J%E&vcw`$
z0R>Cd7**NbtACYO-1o&6gfl&tVXL4->^Eg+Q*iH-2801uYxz+!&7eo=QiufYf66i4
z?+08FdHD%lVZe6U`SpWvSFwFoD|WouOp=s6AaY#4@atey(mw-JQ05j`%U*Oy;bqq`
zrVElh%}!`U1ESX&!x7&~Jj-d91&F($hoq1H@Kwr&5a)^C7xksf9mO#Q9qDarigOGt
zW1Hfc%1O}0oXW@0)Rag4wk+R}Bch5oqBqMe5P;womHbSKFr_t9yX-7sI~)zW*9w__
z-RXOM@XXYu1sd_^M)AR(a?j*<ZHjjo7ro(E$ctpWkUoKJLyQm=^cLdXelb@J7p->!
zwnJ?l#VzRd$j<f}`bySPZA-WW4E(RCdjyiN+-K~oU)-F*q1@skJ8YP)*_D<myll`@
zY#*TFc9$3KJ$<h)?%pYvBdE`LZF#|1XziirtY6V#90jm49bHk;hb!)JnZSSa%(qi9
z(};i4Dd_O$1UT<|Eke>KnGosaeE7_I(0bY{;!5@A^y^xZzT-2f-xX|~6E;mGntU`P
z1pU}N>cEF?3YiMco|jX0wXvU6^Vvp1W*?(m?1~f3FsB-iuIeOS;9Wf5J4665nA_uV
zJR>p-eRA#t7Kc4~(8iAchL;VOm^21I^^QK<=g4riAMR#}_Mg7Fx=dcILYule1~17&
zi#||N0Q4~x%A?q<f>0`A`*ma@DIYB1j}eQyF<TiI8QXhRDqP5~P<d?3b>y33K#0mo
zyebc60$BhpfNppe{@th?eWEG)3h|RZ)A{kBi|9sq7|*;ZETea!;cRU!Mw<AAzC-PM
z0`RVob)skUO7YqYWAv{=J@IH?a7%5+jN9lyFPPXzqINSsZCt3~!aR#O^XA2wCcU@r
zlt&upb1{Kr7yt!d>!JZSZXQ#e&f8YIY&70{<CyQi3HNzBGw_or4e9tzrRwR`lq<b@
z=Fu@z=ocD?nnDB6!P;7cu}CfLh4{j=>RGdMn-9D%La_E_Xb5{H9|szr_9Bu91*X4=
z9`-=f-M6b74?bJoT%CM4cWgROa%ugXob2j%adFrK_pQEM{j<>j(a4prX##l4)t96W
z(D%3DLU=;DeqQ>_Ozo37hgNoOA(ww&%L}45Y7Qi=O)03n#UxOXmATgaJq77?tUQsL
zQ`y`nG3OU(c9+|_e4{HH<PsB&W98<BE;^g^OAe9sw{Z*WHA@YP+;xlLp<^1QpnGd}
z841l0Ug60<(8IHfx%ge`%1Tr>?n!*~Uj4&+yyF|;isv&M|LivXmq)y<6PPl*G+tQS
zEl13+?d)C4O?@mX?o(A2`F?p8y1<RgAyhMav?$$MWOUJW!g*a}jK%<kOwGuF<UsL3
z`9bYj=RxP6I=J&IT*Z_Pc2fhE!#PoXS46cwLf87@8NF`v76mtl)oaPkV$Iv-qg88*
zEI!GBmz`F3?nvB`e<S(s=IRobU|&6-Q&Pbl&50;R(dS&Fif=|AbQEcRxSl8WQ)f5W
zt3+_Eg|+VvPs5@ww7ii1{(fDq;Fhahb))?P2nRj-3?H+882Jf5Wc`wqSSagy*9&@v
zkCEfF7ydxql4~7%O3jMk{Y@{6$G)-p#&6-2fdx(Yrm`H{KYUWNguca>N<s|jaT||5
z(~mLIu-XQp3%IwRw)bGh#;!7d9{M_&!{x$8$jz|vmBgI-04)ee=`?n`3czpsK~GOo
zX7lK13)VXd#R?eqH`M*?_2)mtOQm-(jm13|{{#Q)rYAw-7n|mNNTaL6Wgj8>)8K-n
z<i^9wHSQZU3uen3Tt8c?B$S1`g+pA8j-Gg?yQV)M4+50>llh;KEpWiW>(afXp?l3;
z1Z@k~^PBD33bbx5nQNR-e@U<7_C4Tu;7i=|HRuiKIi3}Z&y8%ex}RT{*8rj$msTzM
z`XaYiUDZ$G94(;A*?cy3{_2Z+sED23Zo@^iWgjOwy!-mZ>~{=2JG@q1dmEWV9v0iD
zf0IWP&S}1tHZC434W{iP_ZT);ERIh(9tXxERiT{ciTd%DN<`GxG3E%~7?sOP^sga#
z5|XD30ZRYsc(nbi<6-~V(3g=ldVX?xlxzZ&XwMH|7shxLyVB6^J>o&0adNTO(%9sO
z%|reBB>$l)Q!~f-l73<BWENSnb}cJf)A;I)^9Egag1&#`TT330brOk4;H;V~->yT_
z^}VGqRP&g%L1;0EVH6nptRg6qD+Vv$d(EWX7@r^Xh=0g}8Q;wH^@4YOKwek2#=4p3
z>EfKYb4T-QKVOuvJA#jpec^1r;Ipqgbu+tb+{VXoE{kzKiOK?VztgWPMteoBkCcmH
zVG{t+olW>Nh)<hluY+fUYwcp-|D)_pz@hxx{^3edKcP}0%#fl@vad4}!mo&SijX0d
zEmZcIA|%U@WC@cL$}%XVn6Zz2$THR$%h;E(%)+eyOZR=h&-*<0{rr#jJ?7w;V-DuH
zuJ3i8=l486=jU^N*W2(=4tA~b&i9=7Ntu$RfTqcho3HhYHZLEF)CGGF@TNXS1EbJ&
z84YXgu;43|<PgTm_wJ?MA(}7fU#|HdUU9&!th%&p4@x>+^s_v8xeb<n$}V6;fqFfY
z)lmPQOL){x8?ZvUUiy`^2g&;8J9PSV`C#CB-DxHNkjCk<=PXww=M{^#2Bm`)v{Z1q
z3w3L8%#h0TTja}UWUn~Ptklgwel7+i-)#l-uXZH%IOfX{2A?%FbNF=$lJ~JT=#y^$
z48Oa+4dgfU#qKHn>6Ea;=G6eE5U#w=%_L&GsbuCS>@ew9k}LSBbHKC4<tfaj<F~QC
z1687v%YMJ$m1S5)sNV@b8;QuVyFo7FbOCJy`xPaW`!hoDP*^Mc^nI0(K6Weh?2m%#
zH%@vuD7}_`Qxdt#F{}8vHb}Q2uaZ<$nD!Ji$fEt!oE7xrh<C+OTN!b*>o1O1zSTLE
ze9X`1nYYP&P6K|V!W}pIZi<t}tOoM}b$Jav5hq1;H$10MXnK4pGxOKGd<+&FoIPKh
z+LC`E!f?9g48`|>lV|^-FV;rAVBM={wwh%l!((n4J&A2Pt#ciQv2Qp2*(-Yu(qF5U
zCfME7D5$8rt{=Wq`_44o^ptG=jb%xQfzOesJx*7Y;w-?6v@ARx;0PEnwA=$7+-0Pb
zR}0oqRYk8;vXbP+a9y8VTlyMxOP>GU+91=#{tes|ehPN<Fq+IHk20&xqS=XwNSmT+
zM%vVbitV%Oo7uUrEQ2X;v6F}GH-6n`vXDVRx@%de6KHmO$&>;(*srn&<aZLoCRUVv
zR24iJb5adA{nYDg$tB$>JnR&33S7`;F0ra)#rSbMGB?BTB$eIFe_OxI|F9N|L6ih<
z3ZqZ57b}pP%!=yVD<>lCX-u=juiJ2JfJ>+B#p1V`X!6bZtC~|6twI8OqK&0{VR86A
zf}h<a>K6`=^*gKI>qM=<Ap?U5)RVaxH<ye3dwiN}{bX|{G!J+cQVCNn<Guub$avD8
zgVI!6vdBo!Bsk<jz^VhR@=zGAA@K)LxV%P6j**88U&A<9cA3#R*bTGoZ~V65Dxs>J
z0ke_Z^e1bW)?d(-q|(jl_wTg1ZR>4!nL}ma!wYBiwcm$O5xG9U#gMlFE%U@0N(B)(
z_^53PT{BuO@i#NiYTD@6a_L>&X)yXa`Z2DMGdv8v+nHy@Tzg4V00%zqA<zigmNHfL
zVRh#&B+z3q0rrF3IQ_R`!L*IF*gG22DRGF^tCx}ECf08qG6D=I2~g(8HQ8buV(t_-
z&6xYm1(IWp;|xv}_?~@4Rl)iy-{&v5p{*I4VYQWyH?r98l6gx#ts>@LU&AL<4*k_+
z6~MVSrAzRCEWBE*ko*?L?=eeKpLf&K@w7*;wz71u8bpAe@C90>QNWeB_n1uK+_E-5
zfw^Bf<B7{;C#|pmj(X9$_fH*o3aelqr3uzFAJUmeQ!+geiyc-f@-vE_j}^4#WkZYx
zc3>=NJ8Pxt22YilIG!3+>?1b}so#o#jdiV`bqrp~#e?(%k2FXIaXTW#ti;rFh?r92
z;o&vWdt)iOf6$>eWdN4%%=}NVe2o!FC`DRh`DtMCuf@>`dpk7m?oE#V$h~#ePU@Gb
zb@ZmQE(0E>q*Ot^hhN)Jf)<X1pt-FrFujL5I4cClc&eJpB1o+FmFaNeBOza}1oL=)
zxSPC1f<y0L%_>2w4oTwJ)uj8rO>;1hU1MypxAP{+4|_XvEs}5wr!zS-1?DkS(s=6p
z^{BN}m5_W+3!3YqyDSctnts^Iavk~6{>Mg<j>>CBRi)cmoflnuomNJNuGf<xbB8Z8
znj=a1i>2%3OHYOIRpXPF86>fg>R`qs=0O#bM;jFLSX}4LD^Jx$pY<}Zs)Oc3b$^`-
z98nNE$*d%f4(Y#aY19uSue_T~lioa8j-VxyPk9B+j6te7uZDw2jE@rRn;7=r+<QNT
zD(Y4jcuNC}w<>W4)$9l&=iyWi&+u3Ed}4#NSJl<cem|r=)B){3og_Bq&7+?62ykW1
zFq7>EEmF0uzFv3aw`wD<Vd>TAWN_~ettS}P1uBodd{yhqCW05eK0ji4I#Twh)#)N6
z=Q`O_%iwaA8VtQW`lMSi9L`YJFN0p?vXH>=;kRpT4%`=|{;MC?<_PE;(BMVw;hCC5
z9GWxM)(R0DaXU)*@R$?DqA>`TunNw`Tk>0h`JhiHV~mmXQ2e{k+RCSqezae$N!E9X
z&Opn-WSlNZ{n|)d@5Fs-nVuy4AhdP+!&B7hrjL?)Pk%8l{lQ|n$XfP;Ph$${7ELR(
z4O>2CkAt(FO<AG4^!41E_qjcsxK(3QtFRSAQ-X}V2Tf@v{_kFKOPwB8l+;e!=x?;_
zs4jKGzrM#`ED4j$UQkj>p(rSRf<R(ZW=qO87VPNqT59emHH@2$zMX%Lygh#G5?JQn
zkimb1TcCBc9k&+CUjI4qy6w(vVL9n1{d6>vOD87r{d*RM#p{sk6UoVi6@xh=bWgSh
zu4BRNxEv=-+-l>_f)sy(hAs;&w%Scaju}o(zfVru$`I<QpV9nw?<rw4_l7i#a~0)A
zzFkq|8@P_dRy2+i1nIb?3UZda`s%0ED_2vKI)cu!(@XGD#FX_x*b0wbk^5LBZ<n3D
z@M^v~lK6WR2kmZ6tTcekU;jZaY;>AqNxv&6YL2+I+<pIG*rWW!u*WZ#5H%*V-s#+5
znTnYg4L6#klaoH1dwGV>oGz*==d?IfeX&C{mMLplagBt)->o+*ST~9rMo!EdwI_V0
zalxXm2bvMr(9i4#PmB5+F^1f{P7sjG^=%6C*K2c$MoY|vo<@U{2GSFFs@!xN`#W-T
zfed6J98={FAe)U<9g=vv+o_sFYsWMBy15@yS))Im+}<2VAt8GWyEmr+thpMfJPjT6
z$9wO5ul^31tLljxe%naD=<p!AL)(ojhBWY>NM>sASp~vFiFFS8ytj<X)hFw5`tGBT
z1E%;Prr%}=otmOMN$a=wfo3+<`vOKpo#?zP>Sebs7AB-AnA~)W?LU>D*J8Sm*L%9;
zGnKpW*hUWI{yJ<(DcIqJB1~=4Mrdi>EzBasC6az;=7JrKRkV`rBY9*eNN6{x?zXOh
z^Lfr0M&S8Sd`gaoOQiQ$$>g@ErP?F7*J;2*-0V(8>r4;(PXvZRH3W9*M17#u%KuL=
z|DRayA97206QDp1>b$MIj9|+SWJb`0rrM3ildaER*^Q;WiC#d3hJ3GH8y_x930kgn
zO<pP=&RQ&Ej^0W+jCubU+w`Pr@IJ?jUy)=&AFZtzQ9E%l1%>D_37f&4&BH`*bc^AL
z6Dww<qdkE6kieVsak14uy-m5X`d}{9Z@3zgV7`dLF~RT5OZsm4J)jChH{YtaP26dC
z>Hnxg32kFynkD`-OX79Vyhq^X34Wir<wMvhCd-<CG2~F=Xj>TA|B5aHiS23ED#R2#
zM{wT@{}t{who_$$m!3a;T+ZIBX2|AF^ydR;eUr(#*|pO}Cy{o-gsOVx2QKrB*cV;!
zYJ8aRu35f6ekRA))^ItoqAG2>UNO|8EwP1Y=LZim+9+V%c@?sZ4H|s5i!ilIojy6*
zdGPsh`?>8`A4m9C*E{eq_;>0HLGP^Cn}buK!YcXxpn)fx@k9HNJZ&I(P_zFHom7G_
z5aEncBm$|suo#^-TK05#O#c#um;KW_#*E1SfzMYr>%V^d?6&7*!7`yIO=mP7p@Jn3
z26oqH_e6kX%ll8vMLm3RcyugGW}xq$G(5LTMNe89wzj`*AS_%}*ECYLy21Z%y%Tc#
zD4$G~US|q45I&{9uy~zQP`b2jSC}`rO;zp4=E~;}7G4Oa9S5D=Ya|z;0#ci7BaLTQ
z1WsXMB%deX{zKIVa1Fz1T3`lWILn;%p<mB8_iH15T-F<_33>+$ZUXmx9Qo}-s&q|?
zgw3x`S^AN(tJasi&Qf{QT9m&mx0U!1I?2;^<&`d0wS~22F{}A2N&Bm!H)N@sHk-4N
zr0bTf<%&B6Ceac}OdJ~*;Vp)&NhsTP7kOhLEq@`%n|khTq?BAuPwhTx<y6S`-&yq0
znyQ@fSM}6xL|(g+5!KqkdxZ<;mZq*MctK@j#wJ+VPqas$_=cdCGUgNOZ1<v<Arr;5
z`nj>yUwI;4(4s0nj#tjXu)^HQn>?wdFMa9+Y_Y*dJ^Ne2KiUrs6-zwZ7}s!kxH8N-
z5|-gNl!JXXAvTnMw0Jy{sD-g=d=yrolzFNthZ{d4gdHM{vlINPe~d8We-VDj1rw{E
z<-@RyE{S*68t1M2+p`MK^CqmTa?@Eo--hkL+?62h(OIzlZTXH~lv3PD(E3h|hQywR
z@j3U|yj+>?%oT2aGRL~INaC5_mme#}PY=L8Rj@tvdx>7bS%=;Q%&g!zJ-)W`p!NXP
zd+Q6qYdvHS0|fFhQU6`Y{AuMAAIbI)Kk8iOc26jm0VFzFuXG{&R(WhUU5&F6nHMx~
zobfgy#zw>6qierVD7XWYf$hviMRhztOc)Mmr+t-kS5vHc3E4*3`P6Brp<rz`e8<W`
z_Y58Q#QD&uy+)SxhmDrg0rnAuzxUPB1H??<Oz!yt2Nz>s!{_3T6AmV6K~1#^3$=y$
zo|klCrLZS_;Y<C0u*gAhHL>*%5^2Z?qd$a=T_kB&E#I7?^BLs~Q8HVWSHoH+q5J%H
zkh4b?0Nlrzi(+Ma9t`*TDl+877iilq)TgAfAXW>R=tezM;}ydg8b2Mr22u6N_RB#7
z`=_Y9@k2{<livt>-wc=mDg}*L{kL9d|KQCI404d95Yu7q;BBGHb93-~_6NQQX8k}V
z5fCgJV`U<0+V;WZl%l?v04cfcmlJHI+v}jcvD~Wj!_&LL<;Z}ZVd!-%tqhzzBLh^5
z?e$_`tg<|NU*l0B4f0F$-S3`z7BXwmn{^kbzE~Ml@oEOw7xdk64rF!^o^^I&@X$*n
zvgPI!j>K(T)8@0IrjFBv=6TbfsRdLf_p0vvMX?7~CD-Kj=&r8GLj7Q95GQ;2y8WgK
z*t3V%JA-vtzDo|_5LJSW2D5q1LlN|cgZSQ~i>;Yga;|VfS(A^L5N9+4J9^h|sNDSy
zTEo8Yda)T~bNf^pYe?wzSE0oUvwDgGKGO!Fv3f+P#NfL`?q=Z1n1bkuUwz=>g}Gc9
zELQ}~8w+~3P=qU4!A_@cj5qYus&IehCaK)8v-x)LjXXNf{th~ggq3&_@S8QX;Q3%c
zGb{>baJ4-s)NlCdFP{lN#I5D0gkM@B_zwDf2vEWXjIV?4+Ou0>kI<7JS)ERQwKlLg
z)`;H7G;0L36W^D*(omKzoE95+jDE>2w)f1#X5FlTvEruy`%dbmY(vUV#p>0VFfqOP
z^jRrm;0)ii6VL&m2fmooifZR<XqJ9hNFi+tIZB^BGjLQ|@M~50ZJNbj$TXpeo#`?q
zf%;0;jcuD!La-x3ZUu;<&@hnhWbTLyhO3R;nAi;3^Q@z!c(y;^+6`KD5b~c`sSBbz
z^p~GKuB3#532iR}j5c0kke?S3xsX<#(AkrbBQwQ5_)+Q&L=dTR>av%=$L7d|?eB=@
zz@~V&O#rkJzxG4Pplq>t(sJq-S-0d63dc)QdF$KByBuVF4wIt8fP+t1-__jkKAWil
zr6HIqN+5op&wXVEkH<Wm)Pv;p+<6TBZm^MsIwKaak=+)nJ#xi<-AY9{H^awAzln-i
zcv(vCAMOoZ7jK1wn4cJTUIPhU;2&7%w53<&)UByJS7=3gQ0L&3n}ZbR+@MZvs#sN&
zu0sR+K7Uq9>@1mItJ0RdAohX&q_2-yMpRn-*;c-Ew```@T0Y&LToHsh9#oMVdQvX)
z3i9C6Z*$DaAd<_>+806y1`;0hNZDuY$vG=guszujXr__uqkkRr3J9dXWGQ%Mzf{J!
z=~VKH2Oo-?TqAvsPPbO&@P6mF5(qjK5*CC9yQa+yD4B&e)ejP5+gx!QVLl_S*kPl!
zgX$RFvB)|9ODTS%yqRBE8{u-lFBq-C4_AuAGZ_tRqIHb>H7IRWe5eO=Fr0}o8Fhuy
zUrg2LiLI?r7Bz_l8<}LlGjynw>b49&&((mVX}Y*oW%MK1CE|fzm}{R>8a0IQt8bEo
ztHv{dBeTw0JA{M;g>KfPH|__$Nef+*uywz+98hB~f)>Yedsw$QPDuy=>k(+96IGO{
z!F=llR5K)xcWxBBR3_=g!w{0Zdcml$PTbgUp9ji<uu|;d%~yA5Gx)XT5<*5>AJLAC
za9^&#Rezec9|;bq-bqF99)(1%u%T;oi3OT^r<)BlkM~N3f3C*Wo2Am}VRhN}%=*P-
z`(n-=8NVVP_<^f*5O5%_@)rBelQSf*X^P&KBYNrb@4y_B;Zu)%X#J;3vg8+*=8Idp
z4G&JRSf_Zid6+umc`4f;*~?MsB~Pz$D5r;agC{Ls37Xc|?lhJY*<%!zenL;t<XT{!
zRURra*Y!>F>eSpl_#<;G`NKyQ;nOeLjWBAIhUdYLB&D7WOj4_$K9u^nA==yPLbwmN
zrxsw!`pB}l1myO&ru=Zz$`D!`Y`el)2GA2OSlscJo&dbY3nP9_JEMXA@1It1qJG_)
z9V2p4Y!IA70yC<a>#Zu52&NBTh`8oz#eD-=L;mQvX_b{sR2%W1jBN`)2W=b>nGZ9y
zwmKNBd5!A-9ev5FKxDzMH@~RLsdaPxyg1C%Z_p*#@(b11;t;YZa0NPPMx7tE)`zJc
zK5})X8jCgecY*bnUknMU?YH%^Kl_W5mQ;kRlo?hm+gAnDj<*~$TG50jk*xX$*1bkv
z{LIlW?m<$Rdq0XK?y#BGOjhN}!8-x03M6LrflTp{kitd_PE43GtWNu<m=9>>?TU*y
z>`5;70gis_{bAmAN4<%4>{p3z){L{$bHOu5se~-=Omt_XU%Y<iWt?-%8z0UpK&uYP
zw0*DAo0BJO1$k>)ooEk%yw^~3{{nwB%xqTPr{D+AC87s3<}(Ja6<jy7+8ZS~(0v-;
zv;$mKSSnEZcwW*>Akl^df?Pc2{`d2drk$^%Wf8MMAjl^fSrO!J@DfDQxuKy+;H$fU
z>&?v);g0Pux-Z|?xIjD8Hg|GkCmNs^jLvTGqiz{>3!#(FpbF6Gu+z4n+u*I&X+t?8
z(ayoT)SwjE`IuitdsF+%+^mGg`I#dToqLpieJ=j;XDa;i=iCows{VTXoRkgqB)-va
zrtj?&oT;*!AEzcXMUw5c=&smP<ePJwhMGf98e9WgWPH{emVZ1{qz>=O@Ai`+G!QB+
zUE2cAiObx&wO0{u0ri?uTSj0B1l>-*@4N@2JtUT*riK6Fm&Dff8zsV$;6=H!O)({9
zW~Ro1@=BS9Jt-ke2dl%K-10iDZD%42J2vWDZroMa%i1I7?0!u~s^?7CoAaqJq|908
zOf5ylF6py)8PZK(CIp)vAZVxC$ZT;14dI;|$x_muE7>75ff!S7Z<*jw!i|~B{dh-M
z3&3IkSPQR-eOuN#BJGQya2~@Xm+mTL`{29DSPZ5pY>ric3dcb=7L5$Y7!l8d#335M
zaolz^<=GMbmHbav>zzY;`e20~as99_E}cM+Y%j-b0o`nUi?89Q>Bftji!uqbwjbPn
z8#rfNUg&ja)Vbxbdn)?|&Rbj|VNcG3IkEDRv}V>s(RwY~KjvXfix^5~%`tv|F0%S1
z)N06=%GItsLER^ak-AEfH~4p57QkMxIk&qVukUfVy;iv<s$Gb*z9~AsYxljJgF9P|
z5Rofqe=XMOzx-m2DAfWvmI=O&IdaVT?t$CncsNSdYW255SOqp}FL<{U{Jrk?;}UB4
zeuMnH%`S2BrcRSR%!L+vrbw?Tb<cUr_UD%U&n2Ab-gQGv@jgMRZSjYLqOnOHpJW9l
zb;Z_d;l|&#*$ryBKAFBCh^sxt!yH~TQrNwrqV_7l9R|0G`X_1GkRhNVH7Hj4&vv!r
z^Ye`Q#YkZnm^0`$%FPqfDMVV%p9`y5+Vx^{1crYpUuL?1u2M*muEFY99GOQo=XpO0
zYuA>yktvtBbF;AM;+gsPln?imQi-5S@Ax@$FXguZk0uS~O1w0G@4-Gxv>Glq<ifAW
z?u`MFoC<`@)tvVQMpwt^J{FUZZD=?_IU<~@s=V=+M)^uy%bZ~vxx`lv2h%a*-D#(I
zJ<!_ySiJlCR-SwBz>9P-U9h6HarJW-+~W9d&~35XVzN61!9LZq@BZYyT%VK*`WP1O
z^*d(96?VXy?LF?1P6N#5dCd<3y4ycLO8$LhnI*u4x&DfkUDk06Spa`JaJA=?;_D3O
zy^m5`W38;X;?j8)$KTNjIR(fSGr<HfiPJn5OT=FwzG|VrRE?5*vZAA=IyG?KvT2WF
zq!?T&S~>B_0h+}na;vDvc$vbx@ViQ$GVXFOlq3KpZVI~cf$d<I#lBho)BB2yl07^A
zz2qxHoyWEn4ie=2F}JG{J-Eh>vU-tu>UW+mxyAKDllvoLj(iTkH=ok0Q20g7lziAd
z77!AVvAjJfkqcy0lpBN?kbsg5Df~{bzFEJqQoju#o9sL2^U+c;Rs2O{acw3j1DYfo
z*R6h1@t*gsOx4vSVLPxe#CuLz3m`ymzRDFPZ8TJV=D{_rjz!*oRg=QkbcwhP|4#y^
z{IIP{6%G8x6d`@Xp8*+uFmsgEkId7&ll_U*oG%|=YYc68ZC85#QpYuj+5&ojUUs=D
z{^<>1s9JQehL7<|Lox5GtX^;so8%Q9dd~2H;uDLb{(on@NJuTVdMN`AR%RU$2x@NW
zvK?)T7>Hk$QAo_yE?SkG3@aL(0<@7)x4ZOcDjMH(zNQGi_@BJjey^QtcRf20*xI0u
zi46Az@Q#HV-CiR2i{`c7&pe$wyO)>p%$>CF@Ee+jj?=CD-QVs9U-PtZUg_8C);G<C
zRrv(2GwF64@~Kz0i{sC`?wH+%N*5e=+tCElFz8)Kk@KF_ee5ppv>%^7&3xXD!V)lO
zUCH<4O`us`4!9Y>i)=fwg?wlI@5uMtr$6ua&uv>;o%9&_hhYX&t>HECBH>zh^j$2v
z{Z5r;0#A1s+WCOn6PQc4;;>jsy07kW6H9<A&Lc{pbp~{qhvJNPZI=^o1N0+55eH%*
zC*I8Fw`0Gip~Ve5cgp+kNmbR6oJ{P&=d(9IGSBbI7AhoMzig~-ScA;E2-87_8b2PZ
zYSC-ndIkJ9lHnOj$n#3W+qrJ{Geo;UFjCWH@J>&$-R(?7nV#gGg3MR<Lf+_Q)30ht
zyS)kF?$_1QplCFM5J1rNmV!W`kiD>hF2#lHfr78R*H#Y5rS)5V#}Ym$iKISnxR85v
zs$n+3{jz5;O=Cjf*s;Hx$6IvYb3$a+g(U(!l0-TH!Kevr33pD~iro!mZQqgoLq`-^
zE40&2EIXv%Z0psD>JF*({zqz43i|<$VGM#j$?ST73UEzp<U!(yLqB+b+9R~g%x3rF
zB7bH;(|&&W@EJEr<&b?g$o-DhL9**7WKj&?z6I@Mk`w(U)qNh7-u(S$A1tH)#{!0;
ziF^N7*|oIEcf+9`(iWWBfZ}M;ojSVZW=*KFZh^g!SpT7o&b<e&$(f3IW!-{>q)YOe
z^4t}kG=G=Bg$66EyG>#ivV=SK{p(IF|Nq`enKjy>e8`hJ;$X>n)fJox9@|UeA`Ifz
zsS$1}S{5w1Vv<5lAk%>E_|Myj$Yd!v%ZiikC|1#}XaIqBBMI0HLxAFKJ}rB#o23K?
zXgg`>z!SQ$*|I*Ht)jc@GtWIw*9rE5U!m<hrYn>WNj&eVMw!j{RFjAKdOtr{1BSRh
zMO{w;J4{hrg4-Hk`)+Cdr=rc!k!w8mTiEiXJ{9p`@IF2S0B0A-`-`{=0Aqb+m+J~h
z`|cCcMS9f5OUJY1iV+Gmdal(f&T0OaQqzvnP11lXjO#r)mk{*34%H7^O?}AymL|G@
z?p1#{trW4@0!L7qz#U%7hpKzmmo!CA&0ail@9%A)N0~LO9qxz3qN`U1-oMS<W2|^Q
zF3>qNJ9A*5D}HtMyU^6><LPEMMV4ab4A=$(;rCx`;~%M?s37*OJ^*vKy|`*8BZM9k
z*ijVO4gJIR1k#UL?3fNf;`);@kBFJFw{j6vW~4L*_dR_*nvf*>%=Y(R@1)(EiPK#=
z`^U;;45We?QfOs!uO9{OKgJ{4LcACTnz@tR2tDp)ZF~Dp)@Ck1LWh1I0kj13OrbWJ
zz)xa37PNL848`E4Ki=AFUru}d?3_9T_Fa5CK05@Hj5fC#xzrDq>MFSV5gwCScMei!
z-h8wO+DfCcr-5jGShqyZ65*EB@0`Hg9F=Pp!l=Mq8eXE`TwzcQyApSsx$mu$%-BvR
zV!lS0+<($=o@n*9u1IxEo;F}hqkFqMuME_~XY!B6-$S`y_1LH8zXbK)sxmlluUnb<
zu|K%XVEVm1t4hEvkHVvT{{tJcKz^tHhg>hW6H7~HMNB?oW5u8I*2BaAA<6z1JWlF~
zpPj?^NWtGUe-Gx`lsaG3<!wxQ6=a(Anaa(-7rfxP-DdRiO+oow`I!qjbGd~|KQKT0
za?`Yq9#(twp7uub7DtZO@X`K~dsBQsVfI919BHI}!Xru3Xivfwv%riziI3SUr@olo
zzxHHhU?E=&9^BQ2iqqW}ys8R?G&%-%1$+P<RGYj}-XVVbLEP@gK8(X3W5Ue(>mO5P
zpsNdWN&l*h2E_z-JHy%$Dcp1HdyINb9JrMElOHIm*Eyq#C1m4$MmE+ORtqagdK?+N
zENs;$<e8VFEYOHLZ{Mu6IQ)T^irSP6I?LU8tN+XweIIYvwcgW($U5WRi(g>Z4)%+J
z|Eh?IQlR@dH^>#KM!AfNXH=fnKQsSmK_rr~VZ@TljqTk2UTeGwh%CF!g!6&$R`{Yy
zMNqo;!p61Yr*+jM6q<x5WZQ%=NR_P=x+}tF03HbnRm${j6qNPxU$@rMIJ}e9v4bCT
z+cWW?K`5T`Xp06cKV#haUktiRfJg^W$Jc>$X%h-=zHqfMG<vc{YA;R7>Sz~SQ@lzM
zGUJN$gJxF;B)J-#m-DwNvSqHMP`Qsauruuz?5Hvm*#jRt{|<SRcD&;!+~IJUX-hb=
zH$pGZiay_#^7A<OC?ke@z7Y94Tiwb<8kMnY7R#Hv9LboK3tT$_9t1dNiB1-Bfjh=8
zsOPCge~Vkn*tsY5Q{t64*~|P^QG94v%;s#pB)F-`#L5@Ja_U*!fGKN{{Ih-5JMxUw
z4L^`?=tik!8n}j<^#k{nF1DQgZ@KEA*f;Qf;5qKzQ3;|17RMI}Et`K^`eps)n)RoB
zd#~cYKX7|-NLMQ!n9|^~(yQ8cJLSUtgcRZ3jDGm(;YaDs4_NVF*lw_Y$Xtnn;3t(T
zXn#P0=I?=$+Q;v}Pk#$RD90$>w%ht6{Pzj%Ma4q2G@REOG%)4!uePJ?-)EY66)5=O
zdhE6D224GDPxgtHytTx#sIafTV}^&bv;JpV0@McpW9|=quDIxE&1suyBY?Pbaq#|o
z4+N4FFmv}h7v>;MHxIok6OmgpD=l(L|IAOPusBoiSXH`t6Kx-Fh1T@j6#O)Mm)^wR
z4W?G=ih7io!q1Grb*G9t@jA;ZLV>$0<3Rf$dyaWze9(jco)nmKI}^M;5&RN9aqwvt
zG{XCp*S$*E16q@zWr6v-v(<?AmnA$(Cx5>W#`z{i<d}Tm6Vo5Ye*D*E{*QS9e{Ntw
zY6qYWJA3z%>c-ch0+(y9->(LJvakHEHJ{d8=y&UxE*J>iY7b)`Hq@YWn&+f!*#++3
z)R8Lq<dR*F;19FKR^{k%@4M>U04B%@)h9lHPIHHvVc_C}S;?N1-K#6f#fGjviybZ7
z6_ga6?VM-*WsV>x>)>t$P~@Qsvx<{Dm|D2XwN~@x693g_Q$uc;dd2StcAgMi$NB&L
zhe8T4Wd6H%FGkA6FBldHZJEeF-<;trWX;Ukv4C@2lTTx+)|%#nEIr%<HRe-2pJT-a
zSk4&ZrWDf*@oN}}nv*KyZe7e5<b?6JTVGWmFGYW08Brtt&2&{Xwo`;XP65UTbYGRV
z)QOKjstmbU{LKs{YWuo61Qn-9hX+j9a6U)&CZJL%VT;;@23oUc&Z+0f#fU+kY?Kds
zGTW=E2pojKUfSg{sCLel@NjT5|LJpSkMCF6W%$0o4*Xw)>2k#q`v3`%Z@|+tRzl>>
zPQSCb%?__lph0~aYLm+g8#<wQ?bjz#%Ysnwt{2pU_hUq*-3t@+iazF;nRQ%)Ep;(9
zt^I@N3VSBZ6a*{dvvVcBssuhc0H5eGuJ*LCkj)b`q|EJ!5rA~a?R?p#yFL16bB2b2
z)`0Dg@Z9|vl(D<0g)ZEG@;y!{Y+&0(&k1Ri&cSeGP~)Lwa_NIapDp~SZ1{7sy}e0R
zl6=j@`b4p=S@C_@h;9}B%L^;FK`#nW1t{L0v?*&dMshk>7v_WTZ`1mz4{&{X@!Tyk
zb>tzxrWeQlwIP?nEMm{&U_P1cbZ)J!SM}4|-yd}EDwDMMDD3tv=c30OmO^y=kz)ox
z5~QC72L@Qlh2=&rmW1_QUq7Y@5z&2WxinXH9OvVf)7};Vqoi<F+PXiiX`gh8QP}?U
z@zJ<Bk0e=%sMHvf+a4hwlS>*Jj?-qpD<rG-sz%I~h5K2cz<RH1R#<9?J0X`gctK=t
zaWw+j;<Cl)F8oMOxwXFMUi|ol3H;QWfbYVpUQ5>hrbFKv9Ai}6IF`hnY<Uv-3!r7c
z%Xl`_k{f1K@C@I7|7!A%v%nA`tYl2Pk*Wb>z{dJ>?$vk`FEK0G9-A0>cX_T*c8k-w
zXBv;t62Y?Y{Jq!;`NJ=<`x|>R&z=902zMXzn1#qW)m(qsXbtw5lZQX5AGp|K+i;Ui
z5J0}N*_exN=Nv?`{hOn_uZ3Ll|8-hLf1#<cVkiW5foPY=++%H*bKFt}RETbyr1uEM
z9{s=QG|rsca=a&xL;O|<^F6gQy>l5FswVTO>|ORQDOV!DFF*7Od7Ji0({fS9x_pzS
zY2iFy7<2@ccDlS*cP`2bMUq_MN>=s~uOyYp)f>9}4ZXCpAr+){qPo#WY2n4A=xWuZ
zaUm;0Pu;9CiNOOjR2{W?Liv;dR*FX8cA_Oezxys?^Z0v@vZ?!R<>c`=eGfZw;xG5X
zQeBvl{iL$p&!l>h|LrOKiNoh)cT}nSvzIDV04Dz3N`TUUL`<i;X4-mK<uB2O`~v|k
z;I4a*VxS$igX4)+fcV+-i}if2a@i$k+CaCQ^MG;x`SFB=!*vm9O3;3TgnQ(~lDFal
znWVJ2E>P`>hwiA%4+o&LDLZ$P#l<zwUM%^hB--fU+*(%naoW`&&=&cj8U}3&#gk-K
zK(t*+4mYCf-j6&U{rrBp1WzJ*0eyK}&(hT<moV0&mm-Ry_s*i;5`PFsU)yJIgEqS_
zzVrXJrTn*8UEIHaAP*{chrHiTLdAY0b2qTPWSEEOZPYn%=dF|NAJ^`}eHG_i1kMME
z9m;vy*jlctY5FKm>#v3(o2ov-gooxst&Q`|g$YN*bPZmDoZPE>Stlz$kR)U;a7d!k
z3!gVqais!kDe$25t^m1gAJH4qfjbgooC+x^IxDp4p2N2OqHhFIh44*MgbZbJ&XGcE
zV#wAtKa7bA&*WK_$=(^}mJi+^j(s-b!gQ+`49snemhi&T6{S^3*wzKMuTp$rsuIFh
z#5<d%7;aiElR9~oJL^9Np_57FpXVm#yN79|Q)}d4?;xRbfx;tI;{G>#hZ(_C?IfAh
zRWo|_B((no8Th~p_~7=M7?gZ9*c1<WmmTaiyk0$e!^gQ6w(-r<l!%}G;b8t>pWa5^
zMiwM?(^d7BiNF8r3;Ka_a>4mYNK72NOrw=q4j~U;K5q7oo=nH<N!<l!Pa>3K*Qz}T
z%xBkI5?r`0+>-zAUrqjr<9Ys^%V~S`>n9d85n+C|(s_O8dIa0jqe^k2qU@^h=jFd`
z???wa(|V1Sch)Q93P}cV>GE;F02vv$YQ(GU^0^l&AF)v}GEE<~UdO0HG_774yn)7y
zCui3xRi;1CIVW#;@w~Aqs@<`*TZ+)qr4ZS5yWOO}t@{h{uq{ApKkgjg=*X4KhTAuM
zCgP|k_lYB!LyWwoqOzsi(v4$<ZtFHt<}x!As|w7G)5Em5Zo`f9L%$WWm9WAl0f#iJ
zD>qiUE+;$a2M(omdSNMIyxT}!{)pJXH@W_u4U!pb8Lkckw(i1j;U#jF*eJFk1O2o1
zRx3}xMxKbaL;CU)*q9NdXwjZZekT)EwhCz1-)L6zn)MU8WNL!-ji8}a@g>eskKA9y
z8t!xQ^Zpu5GSW}=*W|x-38PSuXWEyW;}^ovPhsxz?isje&EsE0KB^1CcY~d0zt2rt
z&^O_*V==i$1*8v3hswLwtsMJ2aOwP!atn!%=Y>(Sl$SxE4Al<&K+3?Ky{6P2Y(u!&
z{d*}JtXi*I(!NGHoxw2=L-wcIXt=lE9+dY&aGEi(kiaL7J5+IVabVkKI5<WS+jMWa
zq0Tf|SK`&K-LS9t<n#e`6{ym5!$A5PZ8lJMwO!0BIB+o$7kcI7hAVf9^L_+8AU$GT
z%6I0wC{tL83tr1GAAS;>(Bh`RjI&po^W|qy!JE9s+p0P$Yg~0Q?mAM^?r{GMD|$vB
z(3UUA<M+x(&iwjh0LS{m%?y)%4&-59-|-N%r45v1ax7nuMC?5ZGUzbE=*swl&DHy3
zlU(hqK}e@Waoe@^gQ}lIAyvBFhOK=Gk&-bj+58)LD-b7YkCcF|(-@|xG*$_!R$>A@
z_V)UIpCc{DJW_XV_h@AwjS@1xHd)gXXcXyyF*e--IkRWl6!rXfBi&Eb8A&`$$jUa1
z>j;Nch2N*`tB!@g#K)01Ngh>!l<8WD%2lZ_1qd+p?gEOOCnL+4XqJ>-SB+3A!nP9(
zHsmYla1LwQ`{wG(I*4u@+0J1pAy-`Qp5L;iQohCV@NyPy5UGSQvDaVp<)&6eJm#G*
zk|oBL+98FAQbfyTm?F^<=rr-BS??DxWa;V%3QvLQKr$<qsCqUu!*g3ZlEzk9*1-Gm
z9~L0EFG}1{nRKNu@I~zBIMTxVXAR+R^>ZXIxxdPsDAX;Pvz677RTD00%B>Mbi6Uw7
z&l*gu!rI|pGE2p(C`4vrOvmI%$Bd*jb)BZ9*h`dJRVXS1M+-nt?-T7wsQrF#$G+{U
z2NQEQS|u|W7JH3MOT_iHW!+a*@4G}+m9XkgAvE9<LYSqTB<lKvc~7PjMmHmDmm@HU
zg?#vJl60GYUqPd3=jvRT9e9#~M?o6w#!A9-4QX3gW4Nry(M-lb=;@O9tgyf!?_BL1
z-#Q5#cE32Je0pv&6?}J1h+lw9M-C!O`96?ldT!{IFF5;YmVN*_o{g$yHFJq$X?u=v
zt8<xeEBWnQKP-~MKFr?U>tMCc_4OgNGl8C~y)_njJtlpbNAOJ}vBYPpW`KikK{b-n
zaZ;K74Si;nh=DYsQg~2m$x3}3P?`$Dk35SzInO9>cnXpTHe1q_Sp4v1O<yd~JtNY4
zB`iJ6XMK$;o$A9hUm8`4H*QWaoIVnx$b0l7{ju|Nkr&@T=kAY>+RQrP>Z4fb{;f7n
zlF?jpF9r+|af-1F0*W_QR_;0X7l)9-2M<1qjfxR`Xl@Y9_8&S?pD7u`*40yl0RgY<
zDyi+2z*$=J!=^9p>y2RPzuC19Rt^KihGV>HWj#vg9)0JgawQld=J?YXvjCKdY{;6}
zxxKu^g?CRA>B;LVY=R@o5BCICM&P|)umY@!?+A+@k(NZQRr1s9PCLD06Go7wk<&bV
zCK=&%->aF43g!d9!kOH#_229xIR1_9cmu!vG=p*y9}pil!S`a~J{Izt-G^u<cPERH
zUA^*=W)Waco^rUo^A(4E5s@qPU}?DYVOd}20&Ho$!Aj?05OTL|l<uZ%ok7EeWfmSJ
zB_hpkwY)6Z{_^j=QU`(F%s#!{x@w9$rO12ciNjLTu-D(?pMlPWTQ5<TN|d01fx%Jg
zeUhn&f!c-ZgX7}3rurNdUS`!W2dp;n$QIE2-bM-Oxyw^nHPU9fS_dlSB%*)`RX=S`
z4L9p#!zuf8<>9J|g0TieH_P`=QoxS#_hUkl{oonXPF!u}xWhSbl+knwsFkN)Q(JwE
z?NtN=d~VCt{%K17XpJA{l4A)}hc>dhYAX{H%%8ApVPdxa7v~ilH)`F_V5-bCGQram
zz>g5sV2RB>8vSADqk<^>2%H$EM%xF`n`-chDMC&pmoNrYRXl)sT7geAJm?EEp)n=Z
zdK@|Y!8e05vEg<Z<lGElA7_vXd`~K)=`p4ur=rhwASg@fuN=qS(?TX*YGPfgC6pzR
zNN|I5G5q(mqNvHO-BMZ`(qbh4R$!vp2W#Ttz?PZxk~w^c=o5-rgh)xV3gHK{u>O8M
zhdb7#?;5ZezxhJ9DKZ67+*B(Dl7+l1Pzsj!xcjP^c3ersNDzhg@#nBPYXct^)_cd}
z19eLhkq7d}U;)d{ToKFEf4JfFze2obfO0d}bs5L)9B1zCzp&+bfTLL=a(6~&u5p8&
z3;y`w_39!PiFr>3W|mM~FLB!ly>yfaB}Bu=|F68EwM_-Q1jxwsdYsrZXk&C?DM>77
z@@9GCRNC=5vtT$}O!ZbohIayREN)2wJwUnOV@^Ftnnu&&BuNX~E=t;}0M3<dM(UaU
zLDbCLseau3a{G(h7nTzJ<EuqUQQ`t1sZSZ}v-pO2v0Gq!A;Y~6o6l9A&C;o8&Judo
zgb=*iNFWVx2Y!Hjy^ImQAMnq5NtMhHO=+j?DA79W7@24{FuCf?QPiQ-Ui@5uyQFdO
zvus}@PsDnvgTtivNDG+rji*Sk?F2XbzFg0rfkYO!Y$gL)0d-7ok&aqFN<_D;hgK^P
z9d0!`-hCd)e)!LQaRfQd^YyWEmv*Tz1Ku5wE^g*Bw~6%wOJzZFo#G`PQvIO$l;2S%
zJyMA)a}~_YCNYP;*;g{d#wz*QuNGV*_YRY=qS6V%4uLev^T?I3_*$lqORLnR7wL17
zQjyw{to6+vDc_$QQqM%>Wtgd{Z)TE*@6=Dc!L0m@APUBC>{%Z;7crK5Jj~MV${|6f
zKuv#CkNU$r^fm*bS7L!p8j8l<hm1)0MUQdFITcQG47`AZOK#~g2ae2I=`@Fw>=dmA
zUqM^j22Q(LsCEfK3@)_W6IRbL!sh4=z3;^CUNiMlheDfb@bCqP`=e}&Bywd6IA~qm
zN=+09Q&;x<Nvj0e*BIzUV4K_98NRjinK4bNQa*fD8!*YYyKQTm<7qL`Ve3jvvVhFS
zdn!0llENlB-u+`{0jLBjSa_Xn#^0ndk&822u2|3!wdMuBqsE4t3>B~-0`g4BIxpyk
zR|dg`@-mVVWsaEn&18L1f?h_qYLPfY+4#;$aBRy{QUCz5hF3D^W+7eh1wUoVN&^vO
zAL1fS#+#Mz7%x6m7jggG0R{ySI*B;Wo#gG1kpo6X)<<1SZ$#NUh>C(z4d4Oji9UPs
zqu;?X7dtPz2}n8vO7h4vmicCupui_9?Y6pA(3PezqF5?;uXpVZq`O?uQprt}r2{ZV
z*T>&!;<S_%M=CK9WV_;Oxlb*mL|X`m5k9~3^B1p(qDCZRO2XeDpR4=t<k$XeX0`pX
zG9Xwj9T+T1ve)<JW>n#ux%jcb)UD)mniur=EQO8lCG*#~r^&GD$g!fMWSkK5))&~B
zc9uYR_uMi+!ItVH8^pbizf+O3gTTYPicka2V;o!}8y($4(yYOOX_`l{Xrm@Lc7^hi
zXho`&#Ao{NgTo*1r9{RXw~Lb|6>)e=`^hn3svU(riJ6z*FAm;q>*RFWVNlT*6k{!?
zR2u4Z;kj%_OV<5G!vx8@u#-xW89vS{2Vak^W@$_K_)pLS@y*}0m7o$)r}b$|aCz4P
zF-*qu$e0ehv4<>%+L{qd7Z%b*$7fgLQKPfop}W+MfbGD)L?bsI83+3Z=HU;eu68{%
zqs|<o+7(B}Cz5rCCnG!GaT0&rvI#{tJ})zB`?FTA#jxHUc{a5nb4)W5Vgx0kw@Xy=
zd~)^zerL9ftD=4<aA(Fwwwy3B7#IriA|!D^Xyz|vCK*WLxy&(6Uas*nPKmLTS~;jd
zAx?8Eo}Qha;CcbPdL@P`hCdLvRNq7|bikN3ad%wU%QOyL8e{J`;}c>kT+#5Y*v(*Z
zeAUoPwX*bblO#kB7?3dWSf-g(nKEoMGyp#>U*8GR<;9Hh0ZD%mb*kIyqGZAAznd;t
zyyoVCg<kKKJ|dnS`4(Pp^yK%D)8vk%Tr;3e68#-$qAZ=*E8b=|D=CeZlo5vehXmQ%
z2If&)JbIE<FQAltR=+N;NTw$W@6i7;6Qz(z3o&TAp5WuYdKm5z8$~j?Z|UnOjPW1`
z8BEufD^2~0W<ER@zSN??a>DZGL8LFYh3@zG7KI0Y4&1&V^T&sTt&}0CaFHF%mrPec
z5RNR$BqEb$wxa&j)-PoW)j{Gan+@wfLxE0*Y-3{=q=K5NMGP)idjG)Raz%+aCmaSz
z*%+=3C}eBLF&CR34lqO@@ZGrXx?<H-2mU8-l}K$t-Qp$uby=k5?PVP^Ceq2MA=J!j
z@nMV8%y+??_pT@b18F6h7p@+1d=(|8wXa&}l}xps(%cJi0b9z-K7+ufm3_Pr8RzUx
zHe4O+ouNO;`>`SqV+_&Yl+Nvts#sOwEL3i1xXBrx6Mps}b-c-5%F4jFIow@_GGFpJ
zA-ORk-G84C{G4f=>?bs1AWK2$SyLntMM{~EP2|+V7F1@??2DtPB7$}W{Y8Q9pklK^
z{t?9}toLlx2+})ag?E6oAQ-X?6JpXPCZB5j!;buxan<M|+o{KxcCPjV3wyJ%QSC;+
zJ*Q{bLOS1g1;*YPq4B<u$l31o+x~oDfRR`rESKk-m}^F+A{(xIU5*`~n9WpQaIv+7
zJGw!gH@ecL)j0B#J%nkN`I(T_^^NfsmnxoQm%O$%yt$;zoYK4)B<+!K`J#pUP3H;3
z8`hZB0mVt@DSCaxefi#W79-r={d=xbL}{yNbVGA@{sI{|_0!Iy*snkZ(y*YQBj{c-
zM_-xFbDx|m`79*>ivx$w2sDZPepeE}aa`%PmRY?@o{?<Cp-kKlCmHzmM5M%x$68q|
z&LspG%x47M)O_D9Ia{LXN^px7p-7T8{vQi#;k9YX6TwAsi9|dQ_nB6Xbs*J1v4pMF
zqchVX)H^L)C0D}h8PU=a<jhuny5)z!`Vo7%+5r#ZiC{Nt`)_?gOHC5eRA$#?TM7t=
zjsHt5D=Y^8!z(0<xIxocTv1O}?d#6Yb_IpVOM#4pbWu=kY=iT16K$jY?oDGgl<&vL
z*}?j#<K*E3;s<O2y>=Yuc-Plg$1HotHcn{oSMztDojN@X)aZ(zicoEKF%J_C>boR)
zAZQzO@8TCR<|?Qvq3s~#d$>wW^Ar%kG=(6SyE25;{Db^oZ6L;G?QCXa1PH-qup9Ic
zF{_11N!;uAaiF?R&RR8CEm(f7UST1C-tc0!WNz{p|MkMof=l(ptZm!0o^8znXt1-Z
zEy61U^>qM(K4VA7Cv4)Sl7QUePl|dLDcb==E*QY7^!&S$f21IK1Zhc%p5YCDgFlaA
zCUYUKgnTBab?a|@07L?X0N)+t9@cXo)P7J6hBFT{WS$f#Gr@Fw{8DVaWZEg1-V&R0
z(5<g~(%h=Lh@gTYWsXc^+_RxLwZQdRH!LZ_CLX^Rc9+|oc2sLawTWP`()`v9g)se8
z-x^aUpJz~QAk?<~yv3`iz{duK!o>&u<(~|EHM5j)QV5e&ux^r+g)c?jv!qbEF{PIy
z({qujU=~!+JH=c@DYKHr*^rM6lwKDX3Tl?2O&<a~HRn^|DPcOzB_=s`cKHuZ%t*%W
zv9eoiZ>*{z8w@xZFHEua3CypH9ZN)?hR-Bzd8OB5EQQksfHK-dFy`}ObS3XB68*=b
zrg-X1K%-H@!Om(bka2=!Eub)5WAnEq1oNk5?vbBgLrOXppY3<pSTtoKmxU9IWyEJ-
z^pnoZQ6zmmQ+!%++!W}w?1k}U9U7&lyj1xtCV6(Mp|MFvA}%RGsIJrW>|#oEK$$uw
zFql%J4f6?UX|xG8Ksa~im&O_(f^{uvAThz1QL_Z&=3AF`-aVAs9(ClPgLL9V8%iiA
zePClDS|$^uriC4n1DY+@i0iWnZjqQq2T_ni;E`wXYQgc+0uF!G?^B}>)a#>KwLn3C
zLrQ91O3DCy@VhU}B5@FGOw{qB`93KyFo#*%%IeIjpX$-XnCuvxD_}1TSRl83aJUVg
z{AZPl2^0?8OmcCLfTs_*g{OZ07@K-b)ZW&Idz;4+Gum1;)C5F`d2wy*?Up-k;SS(n
zLL2w6z7w!h5_bw?vRi%lyG|t%uN380@>{vq4oIgEf093H8A5bl#?i9S^BiNXpS<+Q
zfVoPnG|+L`y!p)LV9pq@gk-i{4-q6q-0ReRIybUeI4jH*yO!j^pqvvlu@8w2M|l_1
zZMyQm`E_!uAc)1OKI`tsmR!16<uOaj^K`PK##(Z$<4tED_wl8R7Y;aU;AvO9azz;2
zhT=n#@G-X$d#@_2_B(7$xABma`S~EQKkPx^OdL$LPyN|h8cR;e6S;RIMOgn;Nfq2V
zK03uD9Aop)icHug4OEb`WtxiBzQi2n+)U35#?zySb*@QeQ)zWCkg9Sk-vaft6~m$E
zV3=EEND(Y-z0U0+&XvN_uXF|W$H&MimZQgy`#Q;gaIdYPHN5a}s~(CZ{)G{*<WnxC
zvaOb7<pP<)#J_R(`zc(dbt!J#$c(Ff40}`66;A>O8r;+@@C$HPzsn!!VFfo(X9T=P
zT1BZi)=#vrF_}GqH(1I@#$!5l&uIaZ`Cf?5!yR+u?1!NspJsrn^w3~ZtiX(S;PK6u
z9S@uocj{hz<Lfw}yZ^~HLyT;qA=SoqrZ!~&+BZCG?XB>1+Nimwazj4M+V#xDrH!6f
zqj)FFPP58QIx#X+X5;*TZ^5*QpcNu`T)t^KA=erer_*3uBogSOrnp5EP8Aj=ZARgq
zH7TH~O1|cGh=6?`^sw{m?E|*J8d&G67RXCqg&DG=l{fk^YzrwRmc=hv4Qma7F?@S?
zV;&6IJO06dNCxmyu57wlx^N|5c2T5~-^>*v9>j>-TWu|)3egD2I*1}bLGHGa(HCR^
ztQ;~=KxN9en%{tPK*q3H*OA=1&P}=GAN}i<w{@O*8GBtm0CK=n5^^ibBhqy`1!O<j
zgV)5xDt&2lj>IcBMc{KN<q|fhxy!gU)=<<rzOn(Wsu#GJkstVk<>s3CH7(6TtL&Ma
z=JwjLUFX4xbl~I#<+p10j=Y3<$3(Wv44vp92$Zat+pT5gQa9~$Agd2M_k+~pcG*k~
z)QU%Ea=t?|1Lox2ORkE-0y)ha@!vm3&Nd#BKB5L6H&(zsOOidn82D|z(k>hHWV)9e
zaHH=WPBo{E3>HINTN6SOEpdvaysaFp<zJAE<Oq6-=LV$nJm2R6Omh-HNGyp>-L5!h
zxX!lPGB7k-X(sk96}`!uBMoArg86omWZ0&~t!I3^>kRWkrwhTA63<5R1CA2kf$A(%
znTI7VRmahGIRw)hMM1FXqw>ZxSh#^NoiQLOpsQPkagXlsr}+ozbAd^y2fSz--EgaV
zOKfQ@b*T}p)AQzHu4dj}9<v#56PpN8UB0!`&o6eSD8>(|UVPe6FX6M+a3vyBl>v%}
zPj4F+>Rt!kTay+5&%}VhufI0H3yMlRB2`&8r|>}abwJz!<)EvYf!mbqX#hwe>i6we
zntQFw2NzJHnVC8a8Es(@lCn>=Ju+im4aegn^_k^&D+?7KZG0v31N@jB{o1MI(6aj(
zZ*E*`+0higXX0<8W4l{HnY`>mK4Eoe15K}7@M4mu(fU+R9>ldh6Bfkt<d)Eh{b*a{
zFXQLc$VDz7f3~b-5{TvgjoH=R)pleq&Sr@lL?!#;IKx;N&HG6a|B=vl?B@(w-{p}F
ze@2AFt7r(Ex?z4-r@3iv)b(oMV*OlLlYpxOIKD-K?+-c5QkCHG$#e>O)ZK2@yr{Ym
zjPiKGB{6A-(N@p_`iHQMQQSZpTuz-kkK5IR6OvposS*A^?S1)M6IUNEh=`U7^`#mW
zB~~k`Rg8*&tN|&dtwLJ$bzzGY6p$du4halM6%_$Bt*AhPqNWxB*+mEe*+mG51QM2r
zEFmTkvOw0ExfAVO{)PM8%MbGa4^P55Ip_P?zH{a@I)HPPw}mokQ0CIGYGQlYS=OVj
zRHcfZyLnEVkOw3Y1(h}(KLKi%X`)kwZ2NZ7EkX*%pldyE6JB<P<!*x8Ku+ytKeDq$
zeg9JR_G7yCe8192BEx}q4RH9pEUV4r3avp*k`T@oxAR^f5JnF1=9xXXU>p&0zBs#!
zBjdNWB$o5VY_u;B4%RIy_>Mi}I2Rtg1XU|o3_z^N07ew3YST!}T^{}%q{w<I_Ub{G
zi1A~X524+;DD~Sx%uo^jf;!kNWbzgZ9t8$)zIv-Kh<td))e^cmQ+qpa5!Wc0GQ%eC
zR|vEpC+U=cz5UWM!+|>~(pihX19)){>jvX@(CFH(^cCSZPdf}o9Epw;OrV<N!<W+e
zg%af<OrFa!gCs#nr91V)p0f+CHFCk(o#sJ}GrSjX1#JQpO;l<9O<oWq0hCu24p;o<
zRIT(0^tR-_E3nNndiSCK?8rm5QIAn}856?qx_+vBTq#zMfS9AB_MtM?wT#$umBMAf
zA^v>#V-h4%)h~9i3BCX|I#4K%K6kZ!9QS`r2COg=uYV&e%PD2RKJka0c!Vmq_=~pc
zCs#7YPaWw#{_-P>80?-&KvQ|5V0Rq1mG6JoWqe3WCtXXf=rCbu2gN2H7B}y?bO~{D
z0gocwuQXaE9_o|qA6^kuxZ<}aq4}1iq=gm94`@vt<DxT%?GI25Z}pHvoVO6v<lBae
zMP4IWRxsxmOBdvxePGgq?~8tiKW;puouC%BQB9bsU-}U_m-#1(Y2K2uoLuN~%KLs<
z8E65EO5rTHlv&A-gTo<?ww{mY&rzBG+#oq03l4Fs{z+bfn}0zBW6zH+y^Zb}_VooW
zfZ_f`WKGcho-ZocJgHl7JDYG~&yP<3R8oUO<urd_!yy}9D-D{P3<ljT_WvlpL#6wi
zemmU9qPcwM8B*jigu%0FZP3@<q69aa!$wtJje7-nc!B7p-O8Mjmf669^e>yb8*Rxm
zxT;WQ%3K>{`xUh2@AY}v0=wrfmmZdfZw-+MoX;*?5}`KPF1K)Y?4tbalDF)O*$GL;
zIs%iqr?JnpKJsP`9f&clx3~!$pf=iWv72k+YbT=f)zKF?6|Q}g{ojmSYUo3i8D^pO
zKWRTgI~>*aGY-u;6AVUZ<H0dfAW|&Qbx|^L^19ci1se)>_Gb6yIRoCiu4k-YOLqqF
zyIKQ<ru8%9hZahhH4s-V>|L$fEz{42)nP(xogNWP9QtzbuMbBUs$w>8kj#yoJT7}9
zCbSd6uj20<4%QEdJyKIO_VaG}Wg%rP%5=l8NJ%PKZm)$f7xy;&giYL+`elFvrw52r
zwv*H>jK!w?xsh_ww>)jvdz;#sKTKFO$nHTQaCE^=-^6Kkeq%?FYkKw*-tvVBf%o{k
zZWsGFx@m)DHaz9!Xn4ReSD68m3vU(K`Nr%?UOY&{UIG(hq?s#}2M3Z;UHUM&S==Ds
z^|O&lpxA8RtRN_wTR)5(>|Nru4tO1GT(BuX9QtWy=AaR6bkzI|&ly<Kj;V|8KfQmR
zeY7&0t3I^f+yB%vd2qw^vr)Qr!cgQ;0u@NbC}RL~ppcdVS6pGnLEX`XV*KFn?8h{0
z58Ct?{w6(dv&#fk+fh8<m(qh{XbH2zk-M^MCKkz7K9eu{Oo7NIEN2HTAg<FR(A1^l
zkU|BTWgX@bWNAzOt`nY3O-(U+5s{GwMqRHA>C89VC-;Wv;p0ApSS)G(ilBtOS*-L}
zLCq3T+*@cVas#=@(j9$4goj1bJZ0x?!Q;02pRika317W+Q!JQ`CzzYTN9`bw6n)>I
zt|sR~mj?SLRic_@8KBJ72D=-x;dWq%$Kb`m1r5(t{NA=afTapKD^gYJ$|b)cfldCm
zW+r3)lgS6^);}08LFI}Z9l#W6+Q*sR0lO@c06ysMC1XI0dcKMuSX`%9<0@X?TLX&I
zCVL#dhm{K)OkPP0_HE|5O{Y^%dgIVONkOtQyopuaOe)n|?1|%Ct27$kcF1lE>XG%_
zgbhLYZV=wOUx59BoaV+FXsxE&M;Z*8ZalUhv>bcSX+`~k!EOj=T~6sNAMzY;Z(rx+
zi&B4M;7QYJ%}EZ#{p?wR|Fhgpjr6()ER`K~hk>V&q?%aU**RNz`GhgeVM=Obr0#J;
zj}4ID6H|%JL!YMs69<na2FqBdP<enD?B|s8S;;jHo(g1P1PZZ^6HPjF6@!y5+m@i%
z^D8+IHZE(_0mwWk8#jYjEAW~Cm*vs$3HNw0(f?+iefn-{gm2K|Kv!uaJ>gaJR10TO
z9~G1y{uL-UL3?K(uHl3}i!|MU4}4>5@l$q|%Rx$FdyCRlHgvlPAICjp%WZ=k-k9Dc
z<U0A890)(M`eE8onHSa8IT=q*(ogAY?Ytxk#=^4;>kR4#Qlu!=G{N|Gk*SgDI;!9X
z#^uzcd)S(UwEo@lz`ae)RjXLGp#6#p^_HZR`zVY2QX{Ar_JC69Fxd&DWY$6~5?9F+
zK8vmYOe{zQA_THz;>m@&o6bP5y_JdV#+Xb|8vQJHLmpB_6OQq(nGVb1S;)>&XsxhB
zgne|#G%fZ!dhz@#*6xn1;SyX8^mlK?ks0n)=mZ&lZ$K^s!u)&lR4g?$u<<39)W0Y@
zs<{9brG@Uq&59&BGoibp;r{JLRWtuZd*Koj_MD}gkftQgGEHz?mEhg&tds}56<;uo
zW-oG2N9}T5k%`*>VukIZ)_j!%RB^(1Hog5vRuOiOg;XSu*f^UY1s<TAjaj>$U)+I3
zq52jCJe&~I`Iz@&G1EhKm}cUXq*jH$;kL&;K=0`|h*61VE9X`PV^-3j34%1o?st$E
z_WLALHyvF-9^k#{bzL4Z)KIIK83)f6g_a?t>qf{`%Ni9gaGjf@+St4kU#$><fnqdU
zZ&))l&Rl{P#V-NXbIoHJEAfDg8PC(utTymxv~4G2YxDc-e4s6PDGom5nofn^tg&41
zttrh#FcB*I*~sJ}oxTW0a<_F`GFHXt7X($ct!COgFVbpu_ha3&8+S>lEjtn%iX#da
zR+vUCTx!DJ59a<N-pUNBQhGJIfb9^GlMk02$V+x&ud8Zr+r7m+NO1_F3|Jc59fvp<
zMysusNtM)VcI=-!=)Akt`gN<+K|OoP*)+iA3F{g^5ajLUeqs={D*EUPmBPU_CEXdg
z-Wuu{t=kVp)z24){EZ@XbZQ(oU*Fac++4iZGFgl!!NZykhFuNR80MXL<`RUHXma)f
zJK%dfKUn&Es>${AM!GoU<7(kFC*V=8Ns{WXamReopW9jp<tAm@yKy8ua}mqVfIqsc
zITv<?xZ>*SpnlA^_$QLXkljTCCFAA=1Dn)<<#~$}UVD-#=O3!YA=atd?fl}T%O1`A
zGSg<1dKt<()f33xU{SETrhn${#`u>$Q7UF%PA-crx6_DH1xIn39^(>w%H=SF7j)kD
zg#%|h20Z?Z$Vp7ow)9upgPy*y!e>~?3v1(Y7Hc&TGL{Y@dN+K7ng5^E=@TL_fCA0*
zI8FgEc<3cfcMcgiawt8XM|-xtPmuxFN5<N@MlZdk025Qy+Ke#LZh5*%u)%v)gv-4B
z>5sRj37MsjtwEVHIC;x(R`AL#IxW6-tHIDEvIjk#4H}G-C#dKv0mC`p+olN;Od6VP
zCRPj?Pv&Gj-4^0yf_`t;PF$-b3)A^`XWO^sm4v9+6<HSJ3D~#Yr71~1jeWDHHktKF
z`IkSE^qke4vbG4xM6dz#?jz4q6mIcGfzy3Y+~(w)@IXEAfnq3VlF|IF;Akj|gdn3Y
zrXJFfsJdvu41wOI(--5h?Wfl8`D}E&Uk#-8L$iFMg{%^$0)d0FduB^eVs9V9r9sV!
zdSE2)ykk!Jf8keY?4lWg=BR^&D;)HghD9GK)lgArJ@Bd$lmq21+DhwKDUMnFU>e<9
z<5Fn6u|+<Z(D!~zVz|SsWMT`f)sMbcHOm=Ld|hh{rkqwP^!WL2Ber<maE>vE__gcn
z^)Ew|TqQ~^IZ+y9yk)c_2oyb(q^}rm%B1==R)tKx-@>D`pQ|8}COF>?T{>NifYa-x
z2L}k;b@=^DsV->l%;-tMl<*+IcJ_gdLgdBKRvLFs;kcO+bFqL%lod2S#B<fSTcgNI
zh#lgcGMlR&LrQ@yoHA}kS3p`}{tkK^+k+<yX2I-MoxZs0T6fUDak1l+nJ<ukfCyGE
z=4$o0X7t*{3`V&EX7LFBSUVp5$L3)KsG3s`D2kTu+gP3}td2{9>)<CuN&FK7eo`C>
zGv(a%u%%fJKPoqPJM{K(;4_)#1jKRepz+|+`OJ0B_O@MN{F9~g9g6z)G-QbFuPmH-
zxUS~PTsTwSoL<B~1lRv=GFAUq<Cftq_m_`EhBx=nR*_sOufqN#ut{u)=`vDwJ*<2>
zZR#8lrB*TeP&Yk|5>y8@_kjuyqb~>bGZyCDPfn8EgE$69%M!x`HY{z2XM~gWxUv$L
z9E>#=!e6irKkS`cSCX*SUGjaLIqVPA!`{0KROjZmC6MUs#!%C6=vJsLe9|;}>}yI7
zlLSS8(fmFHJSqc)WuIwgu_oT8_1U)fg9X*Tz_@*kFygNnHgB$A{$kry@DNWs9X3D0
z>!dXTr-}!0S;bKFXmbA94B|_*cDa0^=yAr1+5ZL~HdnDCWQ8rq<K!}eFZ2|@Vn00K
z2x=ErE0$*!Yf)f^&yUc`H(l%f(%!LAo6?sX9-|$W&Q2tFeND|VPVT1+E)C|BW1@(H
z0mZ(mrjx_P`0NXThxuC>v#Q>J3MJ>#fGo9reCyvH5xaW+a&oTGb0SQ%Z$wTd<w<i8
zRp{A0ez|cAtm>0arYUav!kGCp6%rgt@I~9mq7FW2$rUR8v-Bwb4A0Co(Lkh%rtK(D
z{VUl0Ne-Sh(5SlJIz}kgv8pgJp^>E*oNm;)=Cqi`oB@x{Q{OWZPv~V6z|1>N0V*`;
zt6`Gp>-sL^m|(e3KS<e)YQXpie-Uc7B?KGL%E%R7CUf>zf@Hw8hE(yCM9+LyolN@!
zKNf_Q=IFNo%QrrETZRy+!o%MsS#f3~<q6`29cF~DG%p;JC4`5CCtUe2I#F*#p|rT!
z6-Q01NI`G6QQ(jsGiR58$(Mbo)`7$iQ~j>tnO8U0=m%Wv!rkW=z(jwM>AiTRnmHNp
z#uid+9A69`5<!)Aws3ysS(!NOP($xupE>qqY5CNZkFP2ZU7)6Dwv&ZrW|R*P#t@ZJ
zHvg+Hz+DrZ^J&{enEL{aHLYwKbNVuH1f1^a$#)UbWXHuafc;CtH1jEvPYW-`E$7f3
zCCVvPDE@)s0jeNCFF21_voNlr+0r*3P|3qMt2UYuINsQM=nET^8}`iIe`D<?;e6Zm
z%Ih^sVVU#*-PbV^VEZF>ze->hu_Vi3yXWKwt25H+E<O$m#2K_z2vIHCUQ8R4f6Vih
zVNj3CcxTdC7llSsG>EdD!W7VY)jR|!>nX*IWeAPdZeN!N%#Zqb|K*7xLX5y~celA4
zFKO*B4$BnJ428|yVT4QO=!io?JoP0mO}86jg*nj|8ho)N*jdwtl+<1-M=g7HjZg>O
z;q&JBQULvX&m%4W@XCfse$r4``(f`xWhZa`?hB@snpRPztM0{A+=GLvyZmN5>{|E@
zAA>P)KS!TCgX<X8Qh-%(KiXcsE$+UPui<VV${BRe`>s%mO;`H^t3pnZr)|N8t09I~
z%<9?bFS~{UL_-HVBT}SK3u-!rl>)<ap0o=UDD~}Th2FlIUrJHtR(UGs4^RstUtY;@
zu`Pm1&>7-P<dSQ!F(ACov|P^|Hp^glA|l+98$AbTR*DdXRjE?+<}J0<%OY4bXP_3+
zX-Z_A#a4s(!K0Cg^1kN2m#ZcTBS>e&XufC{K?Dk?t^sesN*lim*6HK?dp)@_Tw|Rj
zT%urkD!$TqT6h?UwH?B|0vEJcTDJH7c7q5flv*nE4b<3fbiV0APJxMj+@Rskp+9L*
zAF%R((t3;I>d`_>fL>qHh85KOy*K-5H&<I(+-v-RdQKeJmOC~@(&tc9`esw*-eT<=
zASwptC+%7hCyRf8{TnwuLFDu8;UeTL#)O`-^1HA+2mP%~PFo$tlSVu<d)u@0c@-$&
zd8VW9pWBdSPmTz`>S2HEku6NU>%<y4Q_au$Z<Ko&ol(sfQ;}jguNnc}Q&zrSqx;rz
z=wR^G*b2mzK}%cMgy7A8I@UrB3Xi@0cN|}1fH?3J19q0=)>EPWWr4exHsc)W<s7z}
z1thiWTNXGqMbH1kbO@xwnc5uz_&g;+%G1j5>)u7Y(FWJnF_xF1v+5wz+8gkxzSQc~
z`!}Nd8-6{#K;gA*Fb#PBJ-IV!S=#G!RU7_>HCcq4ogbJo-pO+dj2MUZWzqtM0Ou2E
zi32;zZVs_>kHhx4TK<VcyM4)N@(F}Az*CugL`zaqYS_$>d_|>%hY%*QC?l%Pn)xTz
z79O={*vLw>gu@;QGVwKnFqFk~h7k%WtM&6K9hLC|%nCO2=IBI3>^T=j$2i=ZvIg}l
zx%Hp?OXC4twfp`hsD6>pdWtLHFTGcYaKeQ#6)&JBSQDUNGC5@Sjbz!IUO8=Z;5`k2
zXYlq=9G8VV#V;#w^`sESRZIjs5^q~sM&e~i<$9huo?x<Q3K1iLzBd^!-AG^D$tm-?
z@vHu&yq_wf-wM=+Mlbywu*djPO7rP$qvZEN)u64uiIg_B!<+_?p_Z;hPW0{*ia;l2
zLKbp|zf)x2aOJ%cpM6;w#PalXWS(p#G>D_NfMs9#!3u{FL{Rb6+{Jh?JO&(ZEf{#8
z2e|NI9TJLEnmKi_(3B%<()n<)ERH%_h`0G~HG+P=fTE<(24M@bo>oDfA_viz?qddI
zoW_}t2IIvv=R`9m<B0b(JqckhH#Zl=^Red1?)kO@2msKg{(&i8iZjVKYMryLl$k2|
z5!vPiR=+xiTlAupp-q70dZ#_ZmP4uiPK*PM#(UHa>mMDB+`ZHtVEZ-`Z}ASlo8Ytm
zt1LLu341Xc%`)h#JVh|ajr4rOiO<|kYs2_6e|wK1OwHoCgUR|E??N9t0u=>th!AdI
zW-<SYPARe(;+8T$lce7K$bD_sR*_jWvs=A4myADBnZCfWuxk9X%n+Tc@VNc^cp?a^
zo{b@6XZ0Sn`APGG$y~N?Ko;^uL1#c*`Q*SgV?W}O7IAP-I04Uo6AoBJ;Fu%uoVd%H
z7G==b7&|`_u<&>hp4Si{L50~ACAsOu<ULT!uiP8TSKuA+1ac4>2gjt<)HSXI+H-K4
z^yhmQAH-&tb%l7H@m_u*3V)B^O4I+z)c?I)RZ4S7N}23&ZRwYp(#;An)`AJHmhu=!
z*bT{Za>*}Ig2!~;`s&k566Y<a5|*T8=$m<v#1h?Wv_X&M2?q5|hMI3{gw#yl(AsR&
z*SR0IAEy=$U(n)zh(jE>!#}hZ*_>IO=qg-=c(fXEcJ7PR4@VkWUz>eBG6rC_*2DA8
zmdMo>{u6nAhv|2;Cdr~5Jg)KZbG^7D;LP-@>vITyxYff{Sm>^KK=+!ct44p~-z(KR
zw_@w=!WUm-%caZP;*f3DIm096T<c`LX0nUu)h9<~9d>`Can9jQS6uE*VOZR3p2Ch?
zRR>Y}S8$Lq+`g<}h{IGFel<@(0qt<$<#crnt?w>X&KrX_p#R8wc5QioRdQ9<kEI@I
zCnC+wseBb?RKk(GXTc-CJ+C5O5-_1$tsS)PE1<o3MV>@f#-m-QbmLN@&s$Iwy*PV$
zj6fL7KZxUCGI(0%4A5>>C#v|}L<oG=*E2Lqv>iPE*>xKH`NXxV#i6wZe0SErhD$zW
zte9&)y;{xy{M}x-60aYXa5VgJrb5#KuoNi!CTgxx>gac<*&>7FoRq{52XV^jHCn!k
z;-BQ&?aAXwDSj>w2h!+9eAAnkSuU`sXnGPM{kInj{$o1jX?!1dYRSzBj8s?R=kfXm
z%6q?_K3s@uMmvOj;D%VA^ctNa?U1`Rr=fn5QoC9_!%7EG_D=f~0ueXQT&WtmG}R)b
zr9i^qZ7T9K!8~hMpON4`0QFDGZUHe;3d+h~nw7aJF*!kQ3_dT1U>V3#UgfmIBK$=T
zQX2}Ej*@;N_dOJU0?K$6T6LPmbHu);e9(Vg;0qJM6RX4gt6W3{I>vk(jhIk0#gBVK
z#fT$Iv-SldK*pj1sTtk)r3ZA9<XHyuIJ{jkucamKHYa<j#bdClhdRntrQ6O)SKrvX
z3H{tXK6};XLVa>l%<Bo1`ePV;Y)>a`l~-Yx#L%vJ!=?m4-$|0G{e~70uD_KA5~YsG
z9Yb;DKh@-7)-nEWkGka&qUvE+xno^6*Ho6##<Y0I5spry`*ybvn2hIYF^-Ejc662|
zRR28$Z_fO1)Nyi{H2TR(i03yfUEWlw;!oYaXZM=HmA;<gIr8UK(H##Le{&rAO+(bt
z1Koc2bkUnORO(Rj<xo#_%gdDxCu*P<tWkt5ovd;>&v*Eq^~rETKgB)UMk=+jy|`a1
zs%1}AVM~~qixMy^z+vI3=Wb0j3+Tcn+PWrXtuB#tKDI!_u119Ow^9+8z>88&zfsnN
z9BQRmLe>v{KF^;T@8^F@Cr;++H`~RPpx#)xcK2!(t9vNB^2yrvgINDKM*gZw8Xz42
zYG%(e<FaGbtP@am|FC|DSUZ{A4MbBbgm4P3Eol;9b97~JZk4?O@lz7P;uxoJ(Ungk
zsh8sUFqH{!DAtj{yRqe?6^lcg5pM-YtMvuQ*&S3IocQG5geIOkO9pG-(Pq|=t&mSO
zAGg^lEQn1b9tWEE3R8zdnI{f<22%o2=mq=}B@VP(Cr_+>`I6T7*Ew^L?oLsk%3e<2
za_=N%XNY0TfrlFoB`wGi3e?q8NLt1D-O<qpByKNa9ft<o4%IAeWf0$c!Agc)8w_xN
zCYZxxTFH}f+8hmB6kCmoD-}64pTV6!&FsPHys(RJ5vO>O#a9p9|6jCrcKn1R%UEd8
zxfYiMkLqZB2{T}XKS}BxhsDm4;z9J_)$x<cAt~}ST@tlO!0ZOBJ8tJCNoFMkawl?5
zWNrEOuyBuU#<TkSk{#c;B*jgrfDdZGVZDfT#gg}j;WyufsI6D_8@lgVG$!i5we+m5
zD@>1}uzDvf06F8UJ)jVSBUqBT1rVK}?z;6Lml5-kj~j_;rqCFi+t%~;OZM5skd}d`
zOvq!Zl|DR369%^Xi*Ap7UZdiSB@fN?Jy>KV;cBB%%g^kK{srv8DO96L_e&0hLu1-{
zRlH2>6hC!Y+DgUoiGl{JU^Y)p_(2ySO!ht~$<S@o?{RU|H*5!l$PX3cij5p6tE`z5
z9kP@W{@_>YpofIn4s=$pg63B-Rnf0_9V9I?ecQh*{H0*(5RMcCY?QBAq}#8*lK1Tq
zvoenste%hleYa=0Ilrw~dpNp?+1qA1Yp@@mxrNzJ+b5ymYg4edEc`anVdVghqvizL
zh3pEt4`ePDz+~-J_}-|}ANGJ{8#zi^EJG-ky}YXd6g-Y&9?*z`BOvFnb1bG=#wR0p
znJ+wMqt<bfr#p4JG<v43gvm;JZnp$o^zLN<+Ilg1Y^?}H>dNsev2GT}g5#;j2tVLg
z6dWe2Bclf3!DLPZx>pQLxj_PNbG6Fr4mnCI_rH@hm1oSMt+0neO)Rb$Hht@6wJF*A
zg=--_orm-NG0$x~F7$-rEH)8TT3r{I;+cD!Np3#L_@#>2TLDoCA*Z=t@#t2Ne$pOr
zAmWDV8{q`ga71g)8`2Wa(`Jy+(_^Bk9e!pM7V$a#CG^4wELQ%ogiy?>UT1)HN?i&y
zKfO~9G_lbblN4QAo&h2zrVe60)lfF?<Hz%s!N{r1i<+GL5U7!!ECw^ZB`^DOPPz#3
zQI*iv?p&qfjS`m_RIw)IRzOuF>LV+D1Ho7dBzfjq$uZb_w71Y8`VT{sH`ngJ*iy9i
z<N;SaJ*POUF82>pBdgR)_KC`=x3sigY)arZ-iNLLHD}OtsA3L#nZA0T9*q$X$wtmZ
zKq`99ofH@56feQK%YRnQM4oNc>h46cGlxmZJ=OI>)-U$YHR5sH^j|%=`0TY5Df~IU
zVkoYBc^=SJ4j!8s*YX)V1H}XkN(4rWX=7Lgl+3<VAkjjnX~%F)lKRXPAryP9u>?0L
z;8nt%J?g)*jTQ=keL)P*J!hq61V9}e*a(oTm|uP|PncP-^E7;3_zkM>(y_>@OUK_=
z8G=Ac5uqoOHl}7YX%CMq%+RPQ=omU2iiJa5T!VcN8HG>+t?y~WvaAZ|z)KazxZ*@+
zJJaPSjBi)T=cLvXk<3ozs$iK|XE9y?FMfP>{>ew?`5h9DT9{ujNU8q&Q%LKax^$TI
zG`8Y%@-!*BrL#)h14cDNv}pJ~52jX&>Se(xM`b2d2bt+FT}!2+@$=21^T;E%ttz(I
z$C%!=HSeC-M6HaPxtai+3ey8HEAJb<DO~&F(v#K5S(kbrT6Vfttnud=-=GG>RpdD(
z<({j^dT{r#=Zg0j)^RCUPQ&JBi5g@)@{<xeJah4$dOrXX`An6aOZYw^q1EK;fh?GV
zuZMbHewBgnxpmW7OJAJVJoejnw)KLHWskCj$1jFtRh{$koGqdE;2uVusZsG;AI2hZ
zSUSPQ&OP2x^jR2?XpT$i$!{$}S)IG5|6CfN;vQD;b7G(K#bG<hqP$P9%6K<^Q0F?*
z#P-O2u<T>J0UumKNr^G2oUy&AvA)MfJI;*}!@9Opdgb^l&iij>sY5u%EcocTkJ861
zg(G}4cZ~VvFBgD&Eg9R)BBb19gWXRbTSj)h;%D|@iWjAm+i~HZ-KbOht?t*nZ~`aO
z1ORs%EXS`4>GD=-*)xR9r6P#0#V(o>h{#9DjD4?PQXVhFjh8abcH-t}5p#&-iHFQ8
z+1wf0=W!v2z89D|1}e19d)FB4eOi4SLG()t<~kflHes-J73!ZIzfOMv&hrp;aQ)Ra
z_ww&8Nzf=i`)<tqyLpvNk<a`9Jr+lljIpCiY@li|heovRBn??qsm6JTDG{)bOYB)X
z1a+kb(SZc;8uM!?8||ePFMz%D!o(!|p!Zv-P3aq4os8VD9_X8HvZhMM*vj~F9689i
zhj~+v^K;|Hwjv6Tt7XV?hLpoAXZ-r4IpYI<ReA;a>)w^Z8phg6)oxn|;}SfWPh<Di
zFXoIN-G!v<dq=={egV>P;!i~2!FTM}UZm)hwjp>R8%nwR{Bx_tc;fG30OJ^==!?5E
z4^CzyEhtM+KcjewISoCyGW+H`{P2dsT;-YHoL-}Y&Vje)wRen+5`rkfJ6-b}+R(Vo
zF6O2Vn}Wo0Xokjoce?cC$_m%DeF250Ly;`9+bp<2eYr8lILXSvc@JMRKV9U!ILyx=
zu;2iEU{G24gT+DwJs#nqu7vyBpdqat3~x(tYvgPDWxkn97oh*m#2v8_5QCM|o7Kxi
z`U6UbWkauZ*j}bf>Jp=7IBVk(RM5DbP(T-tXXLN>WLT15t}gDHkN%(-Wm0*(R!V^n
zKa%$)^A6CJCV$0Y83iy41H+`9>AlG%7xj_~UC1*qxd<-VW2CG#naYX|l&zd0-})g~
z&sa+i4SHf?u1qB-C#dlasB?QClOABVnD1|lhbV#W6JPc<4lz|_y6S;*<X>4@`+A;9
z5h8X=^=W54RefxQDqcq-2_t8OIXl1f1q$x}k|O`xn)X6lx5#JnKBZIRxYD2lg)jdT
zs!OXPkI#cbq=<YxOkz7#u2cJf1DgjRJU>iK`;xSUrXJ|cRK>#ymTD%+2@e}qG_5^+
z`5&XNL-zGo1sNo3MQuY%H!o+dvOiFu`mpPfXr^`@*2&+>m7eP?CpS?Byx}095R|$+
z^@+C&5;HTaPba?tpMTC+b^9XU`e4c^lB*`S8idqBFNToz6J5be<~io0U8&y%AB&#X
z1&SqxVaS!H=+xN*5g<4;$m=cY{ae~E&cgYoLJf9>f62}@PGar%E%vL|8Nk!7<+5V;
zw4Dpw>s8A}Guc?B59?k1OYGgK{@X(t>0E6P7FJcC?yDI2fK*1K`mWIQ9eF%%nToFv
zz&lu;P^FF@%^;8(ATGJZ<tN=2B8>vNwknzoj%If5LBQ3?*9kE;_e!F56YdZ}o3o~g
zRHWU(A4NK5t6MatiLTT?9ce1*)^Kq9N>ogZ2n3jb_MgStSnhCDa<F@CN{N5fEK7@a
z<{Xk|Ea6lF;G@hR^mtNUMSG3o(g7(FMi5L7i)hQ1oqBFe#1=LAu3T6ZB6x_TY2~7m
z$0WPu2E*HOBbHLv6<C1wcZxOocvww*T-JlzwBFNo9lFr2R}SLMw8ZlU(y5AEmwUGT
zpPV{J&F@IAyJ^~(@tMljDcYz^I(1k*`40HE<w3VWW9RRaV5jO!G!i^6Hr0UB9ZcMq
z<81y;oKTYoY_nqmJ*0@hS*W;;mJ>}&**Ad_7$m`BBCrzt{;Df{w7L7MDU-rwr3I*A
zCF578oRrLO#)#~)xyJ$DqtO|Z9_Y_Dg8`TOjdxpkDsl4j!33;)QF1(UeC8x9<^g+A
zWsw(0{*7V(7e*rWlCS=WQME|_ZZ!6+4TG>O?cW$KI!*-2dd;R+gva+@6C<F{(|{9V
z5ZWVje$i1EU{Oh!Xi8}lYisFlngig}he7YW5P1FHdfJXJ6TYm<z5K3Q_`F^A4r6fJ
zks+hxqh_124-`j8DwMEosLb_;Ll@NDOrGma)AtE(N`*S&hBnv^ZZBXi0w4UGt}BpM
z5(26B{z@LGNLC?{X;-~YBXE$y{SOj`MF$~D09R~R3yrHsHikIoA5QFjbKbjZp#)b8
zJwtMIMMjX0aLSkrXczrB@cMDGIGvSJ!4l(Ur&9LA+@fYVI;-b0;oD`=MeC0wml$kp
zI#ep@@4uvsd5AH`o|>zA3cqV6z*}YZ$J@SU+`Wvdob9@x6~|f~cO{<lqwd{#2hTZk
zo$8(7&`&8y>0H+EGw?A;xFgR?9`kD88dW5BU-#ZieH7!1=MW##&8Xh;AUe82FXAoD
zfs^$5oSAdM0`g9d;7!8>3iPgvebhE@R`3Vi%$Xy|*wvILr+e2>D>y&kF-`@uUEa7L
z{qaXQ#M1q<$1=%bLhu7VPW_GXf+hHrQbH%%_7AMWW0EQcOi!iS3Gf9(=d+d9{{O%B
z|M;vK!_QYH++w`(!45`z?IgRb@V%0$b<4mw3IrARvVy8rZ@o7~Ae|Xjac8O|%%NW{
zmIuUv1?#VRT;zc9XMX2>Z6;ZR+7sQ|D(S3!@^%dQ-H~V4GZWVCOpqhtEQI7wk8OTW
z7C~m0dvMch=8zjbl6KIm;yMern}b`EJ6{z=AYMhF)k$p0Dq)~3=etqOPh{@V>JQb(
z4Tgo)+ia0!tNMsv>2vb4wFz>a2U%jMd4jwm5n6khguaGPtUcZUJyi{ju7e)039)9a
z-W={-ciG7_t;-W*O>sj~dE3hL6%Wf`vz!f-yeQ0{S#a`7mQsW?s@8ti0GOR|r7n|5
zv#yg(4HQy<^lFx6o{2h&=;?^hZJPZ_AxJ*RSgf^?JhP*M{FnW;)Fo{wX3VC`t4=X8
z!|P!Jo=`!Ugpis045~KM_Fh}Wd0u6;`aNVX0d7^dUmVxIDk3~G-AIM)9vTYX7-rom
zjRP~^rDegVOm$5UU8_&eTt}2usnzZ?$GpdpE>f1xxF&+zcU}MmHxg2Qbrp*G5QsLM
zup34~D=|Bjp+6IVDE(5K%*^%SU}70X=K!cN?+DX&8kCbJLyd)ZJiwB(oBUQTP<Pmz
z{eFv866<hk%uL!B9e7-UkJJ@VBUJ*b_zh>?Rbjw}ucak~BYm5??!=?>yMoz`|Cw2I
z2V`P~x5Lra$Fe8u+1M*x>$-JjS@{Z`@6h6a<cqz<({H#@ParBTKL69-onz4|eXe_k
z{e80f&Vq9uU<dmcA;8`6mijcDHH+}P$z$GYa-}_GRDiD$GR_y-L0!J&ZO_*XuOu$F
pU1pw^)%4@(|Eqrl2+JXy!S<5mjvn7SJ>=_W5APpJ51zjCKLFlCqs{;T

diff --git a/docs/pages/access-controls/getting-started.mdx b/docs/pages/access-controls/getting-started.mdx
index 1b3ecb7b07dfd..41c19b7bc496a 100644
--- a/docs/pages/access-controls/getting-started.mdx
+++ b/docs/pages/access-controls/getting-started.mdx
@@ -90,7 +90,7 @@ We're now going to set up a GitHub connector for Teleport Open Source Edition an
     ```
   </TabItem>
 
-  <TabItem label="Enterprise" scope={["enterprise"]}>
+  <TabItem label="Enterprise">
     Follow [SAML Okta Guide](../enterprise/sso/okta.mdx#configure-okta) to create a SAML app.
     Check out [OIDC guides](../enterprise/sso/oidc.mdx#identity-providers) for OpenID Connect apps.
     Save the file below as `okta.yaml` and update the `acs` field.
diff --git a/docs/pages/access-controls/guides/dual-authz.mdx b/docs/pages/access-controls/guides/dual-authz.mdx
index 8aa899de8d0bc..92b640334b37a 100644
--- a/docs/pages/access-controls/guides/dual-authz.mdx
+++ b/docs/pages/access-controls/guides/dual-authz.mdx
@@ -4,6 +4,8 @@ description: Dual Authorization for SSH and Kubernetes.
 videoBanner: b_iqJm_o15I
 ---
 
+# Dual Authorization
+
 You can set up Teleport to require require the approval of multiple team members to perform some critical actions.
 Here are the most common scenarios:
 
@@ -28,8 +30,8 @@ two team members for a privileged role `dbadmin`.
 
 ## Prerequisites
 
-- Installed [Teleport Enterprise](../../enterprise/introduction.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= 7.0.0
-- [Tctl enterprise admin tool](https://goteleport.com/teleport/download) >= 7.0.0
+- Installed [Teleport Enterprise](../../enterprise/introduction.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
+- [Tctl enterprise admin tool](https://goteleport.com/teleport/download) >= (=teleport.version=)
 - Mattermost installed.
 
 <Admonition
@@ -39,42 +41,84 @@ two team members for a privileged role `dbadmin`.
   ```code
   $ docker run --name mattermost-preview -d --publish 8065:8065 --add-host dockerhost:127.0.0.1 mattermost/mattermost-preview
   ```
-
 </Admonition>
 
 (!docs/pages/includes/tctl.mdx!)
 
 ## Set up Teleport bot
 
-### Create a bot within Mattermost
+<Tabs>
+ <TabItem label="Mattermost">
+
+  Enable bot account creation in "System Console -> Integrations".
+
+  Toggle `Enable Bot Account Creation`.
 
-Enable bot account creation in "System Console -> Integrations".
+  ![Enable bots](../../../img/access-controls/dual-authz/mattermost-0-enable.png)
 
-Toggle `Enable Bot Account Creation`.
+  Go back to your team settings, navigate to "Integrations -> Bot Accounts". Press "Add Bot Account".
 
-![Enable bots](../../../img/access-controls/dual-authz/mattermost-0-enable.png)
+  ![Enable bots](../../../img/access-controls/dual-authz/mattermost-1-bot.png)
 
-Go back to your team settings, navigate to "Integrations -> Bot Accounts". Press "Add Bot Account".
+  Add the "Post All" permission on the new account.
 
-![Enable bots](../../../img/access-controls/dual-authz/mattermost-1-bot.png)
+  ![Enable bots](../../../img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png)
+
+  Create the bot and save the access token.
+
+  </TabItem>
+</Tabs>
 
-Add the "Post All" permission on the new account.
+Create a non-interactive bot `access-plugin` user and role.
+
+```yaml
+kind: user
+metadata:
+  name: access-plugin
+spec:
+  roles: ['access-plugin']
+version: v2
+---
+kind: role
+version: v5
+metadata:
+  name: access-plugin
+spec:
+  allow:
+    rules:
+      - resources: ['access_request']
+        verbs: ['list', 'read']
+      - resources: ['access_plugin_data']
+        verbs: ['update']
+    # teleport currently refuses to issue certs for a user with 0 logins,
+    # this restriction may be lifted in future versions.
+    logins: ['access-plugin-not-used']
+```
 
-![Enable bots](../../../img/access-controls/dual-authz/mattermost-2-all-permissions@2x.png)
+<Admonition
+  type="note"
+  title="Creating resources"
+>
+  Here and below follow along and create yaml resources using `tctl create -f`:
 
-Create the bot and save the access token.
+  ```code
+  $ tctl create -f access.yaml
+  ```
+</Admonition>
 
-### Set up RBAC for the plugin
 
-(!docs/pages/includes/plugins/rbac.mdx!)
+**Export access-plugin cert**
 
-### Export the access-plugin identity files
+Teleport Plugin uses the `access-plugin` role and user to perform the approval.
+We export the identify files, using `tctl auth sign`.
 
-(!docs/pages/includes/plugins/identity-export.mdx!)
+```code
+$ tctl auth sign --format=tls --user=access-plugin --out=auth --ttl=720h
+```
 
-We'll reference the exported file(s) later when configuring the plugin.
+Teleport will generate `auth.crt`, `auth.key`, and `auth.cas` - a certificate, a private key, and a set of CA certs respectively.
 
-### Install the plugin
+**Install the plugin**
 
 <Tabs>
 <TabItem label="Download">
@@ -102,20 +146,11 @@ We'll reference the exported file(s) later when configuring the plugin.
 $ teleport-mattermost configure > /etc/teleport-mattermost.toml
 ```
 
-Update the config with the Teleport address, Mattermost URL, and a bot token.
+Update the config with Teleport address, Mattermost URL, and a bot token.
 
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-```yaml
-(!examples/resources/plugins/teleport-mattermost-self.toml!)
-```
-</TabItem>
-<TabItem scope={["cloud"]} label="Cloud">
-```yaml
-(!examples/resources/plugins/teleport-mattermost-cloud.toml!)
+```toml
+(!examples/resources/plugins/teleport-mattermost.toml!)
 ```
-</TabItem>
-</Tabs>
 
 ## Dual authorization
 
@@ -217,7 +252,7 @@ Bob can also assume granted access request roles using Web UI:
 
 ## Troubleshooting
 
-### Cert errors in self-hosted deployments
+**Cert errors**
 
 You may be getting certificate errors if Teleport's auth server is missing an address in the server certificate:
 
diff --git a/docs/pages/access-controls/guides/impersonation.mdx b/docs/pages/access-controls/guides/impersonation.mdx
index cc722ffa3a437..38c4117fc9703 100644
--- a/docs/pages/access-controls/guides/impersonation.mdx
+++ b/docs/pages/access-controls/guides/impersonation.mdx
@@ -312,15 +312,23 @@ $ tsh login --proxy=teleport.example.com --user=alice --auth=local
 $ tctl auth sign --user=security-scanner --format=openssh --out=security-scanner --ttl=10h
 ```
 
-### Filter fields
-
-Here is an explanation of the fields used in the `where` conditions within this guide.
-
-| Field                                             | Description                                                                                                            |
-|---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|
-| `user.spec.traits["group"]`                       | The list of traits from a local or SSO user where the `group` trait typically comes from an external identity provider |
-| `impersonate_role.metadata.labels["<label key>"]` | The label value given the label `key` from a role to impersonate                                                       |
-| `impersonate_user.metadata.labels["<label key>"]` | The label value given the label `key` from a user to impersonate                                                       |
-
-Check out our [predicate language](../../setup/reference/predicate-language.mdx#scoping-allowdeny-rules-in-role-resources) 
-guide for a more in depth explanation of the language.
+Here is a summary of variables and functions we used in this guide:
+
+<table>
+<tr>
+  <th>Variable or Function</th>
+  <th>Description</th>
+</tr>
+<tr>
+  <td>`user.spec.traits`</td>
+  <td>Access traits of local or SSO user.</td>
+</tr>
+<tr>
+  <td>`contains(list, var)`</td>
+  <td>Checks whether list contains variable</td>
+</tr>
+<tr>
+  <td>`equals(var, var)`</td>
+  <td>Checks whether one variable is equal another</td>
+</tr>
+</table>
diff --git a/docs/pages/access-controls/guides/per-session-mfa.mdx b/docs/pages/access-controls/guides/per-session-mfa.mdx
index 0b1a798ed1a5e..f32a44570934d 100644
--- a/docs/pages/access-controls/guides/per-session-mfa.mdx
+++ b/docs/pages/access-controls/guides/per-session-mfa.mdx
@@ -1,27 +1,20 @@
 ---
 title: Per-session MFA
-description: Require MFA checks to initiate sessions.
+description: Require MFA checks for user SSH and Kubernetes sessions.
 videoBanner: j8Ze7HhjFGw
 ---
 
 # Per-session MFA
 
-Teleport supports requiring additional multi-factor authentication checks
-when starting new:
+Teleport supports multi-factor authentication on every SSH and Kubernetes
+"connection" (a single `tsh ssh` or `kubectl` call). This is an advanced
+security feature that protects users against compromises of their on-disk
+Teleport certificates.
 
-- SSH connections (a single `tsh` call)
-- Kubernetes sessions (a single `kubectl` call)
-- Desktop sessions
-
-This is an advanced security feature that protects users against compromises of
-their on-disk Teleport certificates.
-
-<Notice type="note">
-  In addition to per-session MFA, enable login MFA in your SSO provider and/or
-  for all [local Teleport
-  users](../../setup/reference/authentication.mdx#local-no-authentication-connector)
-  to improve security.
-</Notice>
+<Admonition type="note">
+  In addition to per-session MFA, enable login MFA in your SSO provider and/or for all [local Teleport
+  users](../../setup/reference/authentication.mdx#local) to improve security.
+</Admonition>
 
 <Details
   title="Version warning"
@@ -35,8 +28,6 @@ their on-disk Teleport certificates.
   only Auth and Proxy services are updated, these checks will *not* be properly
   enforced. Additionally, only v6.1 or newer `tsh` binaries implement
   per-session MFA checks.
-
-  Per-session MFA for Desktop Access was introduced in Teleport 9.
 </Details>
 
 
@@ -49,20 +40,6 @@ their on-disk Teleport certificates.
   https://developers.yubico.com/WebAuthn/WebAuthn_Browser_Support/) (if using
   SSH from the Teleport Web UI)
 
-<Admonition type="note" title="Per-session MFA with FIPS">
-Teleport FIPS builds disable local users. To configure WebAuthn in order to use
-per-session MFA with FIPS builds, provide the following in your `teleport.yaml`:
-
-```yaml
-teleport:
-  auth_service:
-    local_auth: false
-    second_factor: optional
-    webauthn:
-      rp_id: teleport.example.com
-```
-</Admonition>
-
 ## Configuration
 
 Per-session MFA can be enforced cluster-wide or only for some specific roles.
@@ -98,8 +75,8 @@ spec:
     ...
 ```
 
-Role-specific enforcement only applies when accessing resources matching a
-role's `allow` section.
+Role-specific enforcement only applies when accessing SSH nodes or Kubernetes
+clusters matching that role's `allow` section.
 
 #### Roles example
 
@@ -179,6 +156,7 @@ $ tsh ssh prod3.example.com
 If per-session MFA was enabled cluster-wide, Jerry would be prompted for MFA
 even when logging into `dev1.example.com`.
 
+
 ## Database access MFA
 
 Database access supports per-connection MFA. When Jerry connects to the database
@@ -217,5 +195,3 @@ Current limitations for this feature are:
   If you enable per-session MFA checks cluster-wide, you will not be able to
   use Application access. We're working on integrating per-session
   MFA checks for these clients.
-- For Desktop Access, only WebAuthn devices are supported. Teleport does not
-  support U2F devices for Desktop Access MFA.
diff --git a/docs/pages/access-controls/guides/u2f.mdx b/docs/pages/access-controls/guides/u2f.mdx
index 243f4a6e17602..4412c796fd36a 100644
--- a/docs/pages/access-controls/guides/u2f.mdx
+++ b/docs/pages/access-controls/guides/u2f.mdx
@@ -128,7 +128,7 @@ $ tsh login --proxy=example.com
 
 <Admonition type="note">
 U2F for logging into Teleport is only required for [local
-users](../../setup/reference/authentication.mdx#local-no-authentication-connector). SSO users should configure
+users](../../setup/reference/authentication.mdx#local). SSO users should configure
 multi-factor authentication in their SSO provider.
 </Admonition>
 
diff --git a/docs/pages/access-controls/guides/webauthn.mdx b/docs/pages/access-controls/guides/webauthn.mdx
index 01bf5ed02f2b0..014b15e05a362 100644
--- a/docs/pages/access-controls/guides/webauthn.mdx
+++ b/docs/pages/access-controls/guides/webauthn.mdx
@@ -142,7 +142,7 @@ $ tsh login --proxy=example.com
 
 <Admonition type="note">
   WebAuthn for logging into Teleport is only required for [local users](
-  ../../setup/reference/authentication.mdx#local-no-authentication-connector). SSO users should configure
+  ../../setup/reference/authentication.mdx#local). SSO users should configure
   multi-factor authentication in their SSO provider.
 </Admonition>
 
diff --git a/docs/pages/access-controls/reference.mdx b/docs/pages/access-controls/reference.mdx
index e45a1c4b63ad7..b8b00518c920a 100644
--- a/docs/pages/access-controls/reference.mdx
+++ b/docs/pages/access-controls/reference.mdx
@@ -243,12 +243,12 @@ that are more appropriately scoped.
 
 ### Role versions
 
-There are currently three supported role versions: `v3`, `v4` and `v5`. `v4` and `v5` roles are
+There are currently two supported role versions: `v3` and `v5`. `v5` roles are
 completely backwards-compatible with `v3`, the only difference lies in the
 default allow labels which will be applied to the role if they are not
-explicitly set. Additionally, `v5` is required to use [Moderated Sessions](./guides/moderated-sessions.mdx).
+explicitly set.
 
-Label              | `v3` Default   | `v4` and `v5` Default
+Label              | `v3` Default   | `v5` Default
 ------------------ | -------------- | ---------------
 `node_labels`       | `[{"*": "*"}]` if the role has any logins, else `[]` | `[]`
 `app_labels`        | `[{"*": "*"}]` | `[]`
@@ -435,17 +435,3 @@ spec:
 
 Refer to the [Second Factor - U2F guide](./guides/u2f.mdx) if you have a cluster
 using the legacy U2F support.
-
-## Filter fields
-
-Here is an explanation of the fields used in the `where` and `filter` conditions within this guide.
-
-| Field                      | Description                                         |
-|----------------------------|-----------------------------------------------------|
-| `user.roles`               | The list of roles assigned to a user              |
-| `session.participants`     | The list of participants from a session recording |
-| `ssh_session.participants` | The list of participants from an SSH session       |
-| `user.metadata.name`       | The user's name                                     |
-
-Check out our [predicate language](../setup/reference/predicate-language.mdx#scoping-allowdeny-rules-in-role-resources) 
-guide for a more in depth explanation of the language.
diff --git a/docs/pages/api/getting-started.mdx b/docs/pages/api/getting-started.mdx
index 9ba9a4d7a162a..57fdeed48436b 100644
--- a/docs/pages/api/getting-started.mdx
+++ b/docs/pages/api/getting-started.mdx
@@ -16,7 +16,7 @@ Here are the steps we'll walkthrough:
 ## Prerequisites
 
 - Install [Go](https://golang.org/doc/install) (=teleport.golang=)+ and Go development environment.
-- Set up Teleport through one of our [getting started guides](../getting-started.mdx). You can also begin a [free trial](https://goteleport.com/signup/) of Teleport Cloud.
+- Set up Teleport through the [Getting Started Guide](../getting-started.mdx)
 
 ## Step 1/3. Create a user
 
@@ -29,8 +29,8 @@ Here are the steps we'll walkthrough:
 Create a user `api-admin` with the built-in role `editor`:
 
 ```code
-# Run this directly on your Auth Server unless you are using Teleport Cloud
-# Add a user and login via the Proxy Service
+# Run this directly on your auth server
+# Add user and login via web proxy
 $ sudo tctl users add api-admin --roles=editor
 ```
 
@@ -56,9 +56,10 @@ $ go mod init client-demo
 $ go get github.com/gravitational/teleport/api/client
 ```
 
-Create a file called `main.go`, modifying the `Addrs` strings as needed:
+Create a file `main.go` with the following command, modifying the `Addrs` strings as needed:
 
-```go
+```bash
+cat > main.go << 'EOF'
 package main
 
 import (
@@ -73,7 +74,6 @@ func main() {
 
 	clt, err := client.New(ctx, client.Config{
 		Addrs: []string{
-			// Teleport Cloud customers should use <tenantname>.teleport.sh
 			"tele.example.com:443",
 			"tele.example.com:3025",
 			"tele.example.com:3024",
@@ -101,7 +101,7 @@ func main() {
 EOF
 ```
 
-Now you can run the program and connect the client to the Teleport Auth Server to fetch the server version.
+Now you can run the program and connect the client to the Teleport Auth server to fetch the server version.
 
 ```code
 $ go run main.go
diff --git a/docs/pages/application-access/controls.mdx b/docs/pages/application-access/controls.mdx
index 5691249eef7f9..b94f9ab26ff2c 100644
--- a/docs/pages/application-access/controls.mdx
+++ b/docs/pages/application-access/controls.mdx
@@ -79,6 +79,6 @@ allow:
   - [OIDC](../enterprise/sso/oidc.mdx)
   - [ADFS](../enterprise/sso/adfs.mdx)
   - [Azure AD](../enterprise/sso/azuread.mdx)
-  - [Google Workspace](../enterprise/sso/google-workspace.mdx)
+  - [GSuite](../enterprise/sso/azuread.mdx)
   - [Onelogin](../enterprise/sso/one-login.mdx)
   - [Okta](../enterprise/sso/okta.mdx)
diff --git a/docs/pages/application-access/getting-started.mdx b/docs/pages/application-access/getting-started.mdx
index 64f5f84ab118d..9b107f121a734 100644
--- a/docs/pages/application-access/getting-started.mdx
+++ b/docs/pages/application-access/getting-started.mdx
@@ -9,24 +9,13 @@ videoBanner: 5Uwhp3IQMHY
 Let's connect to Grafana using Teleport Application Access in three steps:
 
 - Launch Grafana in a Docker container.
-- Install the Teleport Application Service on a node and configure it to proxy Grafana.
+- Install Teleport and configure it to proxy Grafana.
 - Access Grafana through Teleport.
 
 ## Prerequisites
 
-- The Teleport Auth Service and Proxy Service, deployed on your own infrastructure or via Teleport Cloud.
-- A Docker installation, which we will use to launch Grafana in a container. Alternatively, if you have another web application you'd like to protect with Application Access, you can use that instead.
-- A host where you will run the Teleport Application Service.
-
-<Admonition type="tip" title="Not yet a Teleport user?">
-If you have not yet deployed the Auth Service and Proxy Service, you should follow one of our [getting started guides](../getting-started.mdx).
-</Admonition>
-
-We will assume your Teleport cluster is accessible at `teleport.example.com` and `*.teleport.example.com`. You can substitute the address of your Teleport Proxy Service. (For Teleport Cloud customers, this will be similar to `mytenant.teleport.sh`.)
-
-<Admonition type="note" title="Application Access and DNS">
-(!docs/pages/includes/dns-app-access.mdx!)
-</Admonition>
+- We will use Docker to launch Grafana in a container. Alternatively, if you have another web application you'd like to protect with App Access, you can use that instead.
+- We will assume your Teleport cluster is accessible at `teleport.example.com` and `*.teleport.example.com`. Configured DNS records are required to automatically fetch a [Let's Encrypt](https://letsencrypt.org) certificate.
 
 ## Step 1/3. Start Grafana
 
@@ -34,54 +23,51 @@ We've picked Grafana for this tutorial since it's very easy to run with zero
 configuration required. If you have another web application you'd like to
 expose, skip over to **Step 2**.
 
-Grafana can be launched in a Docker container with a single command:
+Grafana can be launched in a [Docker container](https://grafana.com/docs/grafana/latest/installation/docker/)
+with a single command:
 
 ```code
 $ docker run -d -p 3000:3000 grafana/grafana
 ```
 
 ## Step 2/3. Install and configure Teleport
-(!docs/pages/includes/permission-warning.mdx!)
 
-On your Application Service host, download the latest version of Teleport for
-your platform from our
+Download the latest version of Teleport for your platform from our
 [downloads page](https://goteleport.com/teleport/download).
 
-### Generate a token
+Teleport requires a valid TLS certificate to operate and can fetch one automatically
+using Let's Encrypt [ACME](https://letsencrypt.org/how-it-works/) protocol.
+
+We will assume that you have configured DNS records for `teleport.example.com`
+and `*.teleport.example.com` to point to the Teleport node.
+
+(!docs/pages/includes/permission-warning.mdx!)
 
-A join token is required to authorize a Teleport Application Service agent to
-join the cluster. Generate a short-lived join token and save it, for example,
-in `/tmp/token` on your Teleport Application Service host:
+Let's generate a Teleport config with ACME enabled:
 
 ```code
-$ tctl tokens add \
-    --type=app \
-    --app-name=grafana \
-    --app-uri=http://localhost:3000
+$ sudo teleport configure --cluster-name=teleport.example.com --acme --acme-email=alice@example.com -o file
 ```
 
-### Start Teleport
-
-On the host where you will run the Teleport Application Service, download the latest version of Teleport for your platform from our
-[downloads page](https://goteleport.com/teleport/download).
+<Admonition
+  type="note"
+  title="Web Proxy Port"
+>
+  Teleport uses [TLS-ALPN-01](https://letsencrypt.org/docs/challenge-types/#tls-alpn-01)
+  ACME challenge to validate certificate requests which only works on port `443`. Make sure your Teleport proxy is accessible on port `443` when using ACME for certificate management.
+</Admonition>
 
 Now start Teleport and point it to the application endpoint:
 
 ```code
-$ sudo teleport app start \
-  --name=grafana \
-  --token=/tmp/token \
-  --uri=http://localhost:3000 \
-  --auth-server=https://teleport.example.com:3080
+$ sudo teleport start \
+  --roles=proxy,auth,app \
+  --app-name=grafana \
+  --app-uri=http://localhost:3000
 ```
 
-Change `https://teleport.example.com:3080` to the address and port of your Teleport Proxy Server. If you are a Teleport Cloud cluster, use your tenant's subdomain, e.g., `mytenant.teleport.sh`. 
-
-Make sure to update `--app-name` and `--app-uri` accordingly if you're using your own web application.
-
-The `--token` flag points to the file on the Application Service host where we stored the token that we generated earlier.
-
-### Create a user
+Make sure to update `--app-name` and `--app-uri` accordingly if you're using
+your own web application.
 
 Next, let's create a user to access the application we've just connected. Teleport has a built-in role called `access` that allows users to access cluster resources. Create a local user assigned this role:
 
@@ -89,23 +75,19 @@ Next, let's create a user to access the application we've just connected. Telepo
 $ tctl users add --roles=access alice
 ```
 
-The command will output a signup link. Use it to choose a password and set up a second factor. After that, it will take you to the Teleport Web UI.
+The command will output a signup link. Use it to choose a password and set up a second factor. After that, it will take you to the Teleport web UI.
 
 ## Step 3/3. Access the application
 
 There are a couple of ways to access the proxied application.
 
-Every application is assigned a public address that you can use to navigate to
+Every application is assigned a public address which you use to navigate to
 the application directly. In our sample Grafana application we have provided a public address with
 the `--app-public-addr` flag, so go to `https://grafana.teleport.example.com`
-to access the app. 
-
-Replace `grafana` with the value of the `--app-name` flag you used when starting the Teleport Application Service and `teleport.example.com` with the address of your Proxy Service.
-
-If you're not logged into Teleport,
+(replace with your app public address) to access the app. If you're not logged into Teleport,
 you will need to authenticate before the application will show.
 
-Alternatively, log in to the Teleport Web Interface at `https://teleport.example.com` (replace with your Proxy Service's public address). All available applications are displayed on the Applications tab. Click on the Grafana application tile to access it.
+Alternatively, log into the Teleport Web Interface at `https://teleport.example.com` (replace with your proxy public address). All available applications are displayed on the Applications tab. Click on the Grafana application tile to access it.
 
 ## Next steps
 
@@ -115,4 +97,3 @@ Dive deeper into the topics relevant to your Application Access use-case:
 - Learn about integrating with [JWT tokens](./guides/jwt.mdx) for auth.
 - Learn how to use Application Access with [RESTful APIs](./guides/api-access.mdx).
 - See full configuration and CLI [reference](./reference.mdx).
-- Read about how Let's Encrypt uses the [ACME protocol](https://letsencrypt.org/how-it-works/).
\ No newline at end of file
diff --git a/docs/pages/application-access/guides/api-access.mdx b/docs/pages/application-access/guides/api-access.mdx
index 7d45468932a50..489030739557b 100644
--- a/docs/pages/application-access/guides/api-access.mdx
+++ b/docs/pages/application-access/guides/api-access.mdx
@@ -10,7 +10,6 @@ tools like [curl](https://man7.org/linux/man-pages/man1/curl.1.html) or Postman.
 
 ## Prerequisites
 
-You will need a running Teleport cluster, either self hosted or in Teleport Cloud.
 We'll assume that you followed the [Getting Started](../getting-started.mdx)
 guide or the general [App Access Usage](./connecting-apps.mdx) guide to connect the web application providing an API to Teleport.
 
diff --git a/docs/pages/application-access/guides/aws-console.mdx b/docs/pages/application-access/guides/aws-console.mdx
index a5f81b35aad81..8ffa0ee598a93 100644
--- a/docs/pages/application-access/guides/aws-console.mdx
+++ b/docs/pages/application-access/guides/aws-console.mdx
@@ -6,21 +6,19 @@ videoBanner: GVcy_rffxQw
 
 # AWS Management Console Access
 
-Teleport can automatically sign your users into the AWS management console with
+Teleport can automatically sign your users into AWS management console with
 appropriate IAM roles.
 
 This guide will explain how to:
 
-- Connect your AWS account(s) to Teleport.
-- Set up example AWS IAM Read Only and Power User roles.
+- Connect your AWS account(-s) to Teleport.
+- Setup example AWS IAM Read Only and Power User roles.
 - Use Teleport's role-based access control with AWS IAM roles.
 - View Teleport users' AWS console activity in CloudTrail.
 - Access the AWS Command Line Interface (CLI) through Teleport. 
-
 ## Prerequisites
 
-- A running Teleport cluster, either self hosted or in Teleport Cloud.
-- A Teleport Node with Application Access enabled. Follow the [Getting Started](../getting-started.mdx)
+- Teleport with Application Access. Follow [Getting Started](../getting-started.mdx)
   or [Connecting Apps](./connecting-apps.mdx) guides to get it running.
 - IAM permissions in the AWS account you want to connect.
 - AWS EC2 or other instance where you can assign a IAM Security Role for the Teleport Agent.
@@ -36,7 +34,7 @@ Otherwise, you will receive "400 Bad Request" errors from AWS.
 
 ## Step 1. [Optional] Configure Read Only and Power User roles
 
-AWS provides the `ReadOnlyAccess` and `PowerUserAccess` IAM policies that can be incorporated into roles. **Skip this step** if you already have the roles you want to provide access to.
+AWS provides the `ReadOnlyAccess` and `PowerUserAccess` IAM policies that can be incorporated into roles.  <b>Skip this step</b> if you already have the roles you want to provide access to.
 
 <Admonition type="note">
 These policies may provide too much or not enough access for your intentions. Validate these meet your expectations if you plan on using them.
@@ -69,15 +67,16 @@ Enter a role name and press create role.
 Follow the same steps and select `PowerUserAccess` IAM Policy to create a `ExamplePowerUser` role.
 
 
-## Step 2. Update IAM role trust relationships
+## Step 2. Update IAM roles trust relationships
 
 <Admonition type="note">
-This step is only required if you are allowing access from another account. The trust relationship will already exist for the same account.
+This step is only required if you are allowing access from another account.  The trust relationship will already exist for the same account.
 </Admonition>
 
-Teleport uses AWS [federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html) to generate sign-in URLs for users, which relies on the `AssumeRole` API
-for getting temporary security credentials. 
-You will need to update your IAM roles' "Trusted entities" to include your AWS account ID.
+Teleport uses AWS [Federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html)
+service to generate sign-in URLs for users, which relies on the `AssumeRole` API
+for getting temporary security credentials. As such, you would first need to
+update your IAM roles' "Trusted entities" to include AWS account ID.
 
 Go to the [Roles](https://console.aws.amazon.com/iamv2/home#/roles) list, pick
 a role and create the following trust policy for it by clicking on "Edit trust
@@ -100,9 +99,8 @@ relationship" button on the "Trust relationships" tab:
 
 See [How to use trust policies with IAM roles](https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/)
 for more details. After saving the trust policy, the account will show as a
-trusted entity.
-
-From the EC2 dashboard select Actions -> Security -> Modify IAM Role.
+trusted entity:
+From the EC2 dashboard select Actions -> Security -> Modify IAM Role
 ![AWS trusted entities](../../../img/application-access/aws-trusted-entities@2x.png)
 
 Do this for each IAM role your Teleport users will need to assume.
@@ -138,7 +136,7 @@ is using.
 
 The next step is to give your Teleport users permissions to assume IAM roles.
 
-You can do this by creating a role with the `aws_role_arns` field listing all IAM
+You can do this by creating a role with `aws_role_arns` field listing all IAM
 role ARNs this particular role permits its users to assume:
 
 ```yaml
@@ -234,8 +232,8 @@ an IAM role selector:
 
 ![IAM role selector](../../../img/application-access/iam-role-selector.png)
 
-Click on the role you want to assume and you will get redirected to the AWS
-management console, signed in with the selected role.
+Click on the role you want to assume and you will get redirected to AWS
+management console signed in with the selected role.
 
 In the console's top-right corner you should see that you're logged in through
 federated login and the name of your assumed IAM role:
@@ -254,7 +252,7 @@ Note that your federated login session is marked with your Teleport username.
 To view CloudTrail events for your federated sessions, navigate to the CloudTrail
 [dashboard](https://console.aws.amazon.com/cloudtrail/home) and go to "Event history".
 
-Each Teleport federated login session uses a Teleport username as the federated
+Each Teleport federated login session uses Teleport username as the federated
 username which you can search for to get the events history:
 
 ![CloudTrail](../../../img/application-access/cloud-trail.png)
@@ -272,7 +270,7 @@ Logged into AWS app awsconsole-test. Example AWS CLI command:
 $ tsh aws s3 ls
 ```
 
-The `--aws-role` flag allows you to specify the AWS IAM role to assume when accessing AWS API. You can either
+The `--aws-role` flag allows to specify the AWS IAM role to assume when accessing AWS API. You can either
 provide a role name like `--aws-role ExamplePowerUser` or a full role ARN `arn:aws:iam::1234567890:role/ExamplePowerUser`
 
 Now you can use the `tsh aws` command like the native `aws` command-line tool:
diff --git a/docs/pages/application-access/guides/connecting-apps.mdx b/docs/pages/application-access/guides/connecting-apps.mdx
index d3c74ae36b496..4468d6544d894 100644
--- a/docs/pages/application-access/guides/connecting-apps.mdx
+++ b/docs/pages/application-access/guides/connecting-apps.mdx
@@ -54,22 +54,36 @@ applications. When setting up Teleport, the minimum requirement is a certificate
 for the proxy and a wildcard certificate for its sub-domain. This is where
 everyone will log into Teleport.
 
-<Admonition type="tip" title="Application Access and DNS">
-(!docs/pages/includes/dns-app-access.mdx!)
-</Admonition>
-
 In our example:
 
 - `teleport.example.com` will host the Access Plane.
 - `*.teleport.example.com` will host all of the applications e.g. `grafana.teleport.example.com`.
 
-You can either configure Teleport to obtain a TLS certificate via Let's Encrypt or use an existing certificate and private key (e.g. using [certbot](https://certbot.eff.org/)).
-<Tabs>
-<TabItem label="Let's Encrypt">
-(!docs/pages/includes/acme.mdx!)
-</TabItem>
-<TabItem label="Existing Credentials">
-If you have obtained certificate/key pairs for your domain they can be provided directly
+Teleport can obtain a certificate automatically from Let's Encrypt using
+[ACME](https://letsencrypt.org/how-it-works/) protocol.
+
+Enable ACME in your proxy config:
+
+```yaml
+proxy_service:
+  enabled: "yes"
+  web_listen_addr: "0.0.0.0:443"
+  public_addr: "teleport.example.com:443"
+  acme:
+    enabled: "yes"
+    email: alice@example.com
+```
+
+<Admonition
+  type="note"
+  title="Web Proxy Port"
+>
+  Teleport uses [TLS-ALPN-01](https://letsencrypt.org/docs/challenge-types/#tls-alpn-01)
+  ACME challenge to validate certificate requests which only works on port `443`.  Make sure your Teleport proxy is accessible on port `443` when using ACME for certificate management.
+</Admonition>
+
+Alternatively, if you have obtained certificate/key pairs for your domain
+(e.g. using [certbot](https://certbot.eff.org/)), they can be provided directly
 to the proxy service:
 
 ```yaml
@@ -83,8 +97,6 @@ proxy_service:
   - key_file: "/etc/letsencrypt/live/*.teleport.example.com/privkey.pem"
     cert_file: "/etc/letsencrypt/live/*.teleport.example.com/fullchain.pem"
 ```
-</TabItem>
-</Tabs>
 
 ### Create a user
 
diff --git a/docs/pages/cloud/faq.mdx b/docs/pages/cloud/faq.mdx
index fc28f895a16cc..327a5199c7172 100644
--- a/docs/pages/cloud/faq.mdx
+++ b/docs/pages/cloud/faq.mdx
@@ -29,7 +29,7 @@ Currently there is no way to provide your own bucket.
 ## How do I add nodes to Teleport Cloud?
 
 You can connect servers, kubernetes clusters, databases and applications
-using [reverse tunnels](../setup/admin/adding-nodes.mdx).
+using [reverse tunnels](../setup/admin/adding-nodes.mdx#adding-a-node-located-behind-nat).
 
 There is no need to open any ports on your infrastructure for inbound traffic.
 
@@ -56,7 +56,7 @@ $ tctl tokens add --type=node
 ## Are dynamic node tokens available?
 
 After [connecting](#how-can-i-access-the-tctl-admin-tool) `tctl` to Teleport Cloud, users can generate
-[dynamic tokens](../setup/admin/adding-nodes.mdx):
+[dynamic tokens](../setup/admin/adding-nodes.mdx#short-lived-dynamic-tokens):
 
 ```code
 $ tctl nodes add --ttl=5m --roles=node,proxy --token=$(uuid)
diff --git a/docs/pages/database-access/getting-started.mdx b/docs/pages/database-access/getting-started.mdx
index 736f67050c1a5..51e4f6ff3cc42 100644
--- a/docs/pages/database-access/getting-started.mdx
+++ b/docs/pages/database-access/getting-started.mdx
@@ -14,7 +14,7 @@ Here's an overview of what we will do:
 2. Download and install Teleport (=teleport.version=) and connect it to the Aurora database.
 3. Connect to the Aurora database via Teleport.
 
-## Step 1/3. Set up Aurora
+## Step 1/3. Setup Aurora
 
 In order to allow Teleport connections to an Aurora instance, it needs to support
 IAM authentication.
@@ -73,28 +73,33 @@ GRANT rds_iam TO alice;
 For more information about connecting to the PostgreSQL instance directly,
 see Amazon [documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ConnectToPostgreSQLInstance.html).
 
-## Step 2/3. Set up Teleport
+## Step 2/3. Setup Teleport
 
 Teleport Database Access is available starting from `6.0.0` release.
 
 Download the appropriate version of Teleport for your platform from
 our [downloads page](https://goteleport.com/teleport/download).
 
-
-### Configure TLS
-
 Teleport requires a valid TLS certificate to operate and can fetch one automatically
-using Let's Encrypt.
+using Let's Encrypt [ACME](https://letsencrypt.org/how-it-works/) protocol.
 
-(!docs/pages/includes/acme.mdx!)
+We will assume that you have configured DNS records for `teleport.example.com` and
+`*.teleport.example.com` to point to the node where you're launching Teleport.
 
-We will assume that you have configured a DNS record for `teleport.example.com` to point to the node where you're launching Teleport.
+Let's generate a Teleport config with ACME enabled:
 
-<Details title="Using Application Access?">
-(!docs/pages/includes/dns-app-access.mdx!)
-</Details>
+```code
+$ teleport configure --cluster-name=teleport.example.com --acme --acme-email=alice@example.com > /tmp/teleport.yaml
+```
 
-### Start Teleport
+<Admonition
+  type="warning"
+  title="Web Proxy Port"
+>
+  Teleport's ACME protocol integration currently requires web proxy to run on
+  port 443 so open /tmp/teleport.yaml and update `proxy_service.web_listen_addr`
+  and `proxy_service.public_addr` to use port 443 instead of the default 3080.
+</Admonition>
 
 Now start Teleport and point it to your Aurora database instance. Make sure to
 update the database endpoint and region appropriately.
@@ -113,11 +118,9 @@ $ sudo teleport start --config=/tmp/teleport.yaml \
   title="AWS Credentials"
 >
   The node that connects to the database should have AWS credentials configured
-  with the policy from [step 1](#step-13-set-up-aurora).
+  with the policy from [step 1](#step-13-setup-aurora).
 </Admonition>
 
-### Create a user and role
-
 Create the role that will allow a user to connect to any database using any
 database account:
 
diff --git a/docs/pages/database-access/guides/cockroachdb-self-hosted.mdx b/docs/pages/database-access/guides/cockroachdb-self-hosted.mdx
index fd06d0620a521..45bd48fa4fd67 100644
--- a/docs/pages/database-access/guides/cockroachdb-self-hosted.mdx
+++ b/docs/pages/database-access/guides/cockroachdb-self-hosted.mdx
@@ -36,7 +36,7 @@ This guide will help you to:
 
 (!docs/pages/includes/database-access/token.mdx!)
 <Tabs>
-<TabItem label="Self-Hosted" scope={["enterprise","oss"]}>
+<TabItem label="Self Hosted" scope={["enterprise","oss"]}>
 Start the Teleport Database Service, pointing the `--auth-server` flag to the address of your Teleport Proxy Service:
 
 ```code
@@ -142,7 +142,7 @@ Log into your Teleport cluster. Your CockroachDB cluster should appear in the
 list of available databases:
 
 <Tabs>
-<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
+<TabItem scope={["enterprise", "oss"]} label="Self Hosted">
 ```code
 $ tsh login --proxy=teleport.example.com --user=alice
 $ tsh db ls
diff --git a/docs/pages/database-access/guides/gui-clients.mdx b/docs/pages/database-access/guides/gui-clients.mdx
index 9e881f6b6bb51..eae7b53cd1831 100644
--- a/docs/pages/database-access/guides/gui-clients.mdx
+++ b/docs/pages/database-access/guides/gui-clients.mdx
@@ -192,34 +192,3 @@ keep the Password field empty:
 ![DataGrip connection options](../../../img/database-access/guides/sqlserver/datagrip-connection@2x.png)
 
 Click OK to connect.
-
-## Redis Insight
-
-<Admonition type="note">
-  Teleport's Redis Insight integration only supports Redis standalone instances.
-</Admonition>
-
-After opening Redis Insight click `ADD REDIS DATABASE`.
-
-![Redis Insight Startup Screen](../../../img/database-access/guides/redis/redisinsight-startup.png)
-
-Log in to your Redis instance with a Redis user first by using:
-
-`tsh db login --db-user=alice redis-db-name`.
-
-Click `Add Database Manually`. Use `127.0.0.1` as the `Host` and port printed by `tsh proxy db` as described [here](#get-connection-information).
-
-Provide your Redis username as `Username` and password as `Password`.
-
-![Redis Insight Configuration](../../../img/database-access/guides/redis/redisinsight-add-config.png)
-
-Next, check the `Use TLS` and `Verify TLS Certificates` boxes and copy the CA certificate returned by `tsh proxy db`.
-Copy the private key and certificate to corresponding fields.
-
-Click `Add Redis Database`.
-
-![Redis Insight TLS Configuration](../../../img/database-access/guides/redis/redisinsight-tls-config.png)
-
-Congratulations! You have just connected to your Redis instance.
-
-![Redis Insight Connected](../../../img/database-access/guides/redis/redisinsight-connected.png)
diff --git a/docs/pages/database-access/guides/mongodb-atlas.mdx b/docs/pages/database-access/guides/mongodb-atlas.mdx
index d674516142244..96f900cc33837 100644
--- a/docs/pages/database-access/guides/mongodb-atlas.mdx
+++ b/docs/pages/database-access/guides/mongodb-atlas.mdx
@@ -28,7 +28,7 @@ In this guide you will:
 (!docs/pages/includes/database-access/token.mdx!)
 
 <Tabs>
-<TabItem label="Self-Hosted" scope={["enterprise","oss"]}>
+<TabItem label="Self Hosted" scope={["enterprise","oss"]}>
 Start the Teleport Database Service, pointing the `--auth-server` flag at the address of your Teleport Proxy Service:
 
 ```code
@@ -74,7 +74,7 @@ If you're starting the Database Agent with a YAML configuration instead of CLI f
 the following config is equivalent to the `teleport db start` command shown earlier:
 
 <Tabs>
-<TabItem label="Self-Hosted" scope={["enterprise","oss"]}>
+<TabItem label="Self Hosted" scope={["enterprise","oss"]}>
 ```yaml
 teleport:
   auth_token: "/tmp/token"
@@ -193,7 +193,7 @@ certificate with `CN=alice` subject.
 Log into your Teleport cluster and see available databases:
 
 <Tabs>
-<TabItem scope={["enterprise", "oss"]} label="Self-Hosted">
+<TabItem scope={["enterprise", "oss"]} label="Self Hosted">
 
 ```code
 $ tsh login --proxy=teleport.example.com --user=alice
diff --git a/docs/pages/database-access/guides/mysql-self-hosted.mdx b/docs/pages/database-access/guides/mysql-self-hosted.mdx
index 63b4eda176abe..d4a9788beb88b 100644
--- a/docs/pages/database-access/guides/mysql-self-hosted.mdx
+++ b/docs/pages/database-access/guides/mysql-self-hosted.mdx
@@ -131,17 +131,48 @@ tunnel.
 
 ### Start Database Service with Config File
 
-Generate a configuration file at `/etc/teleport.yaml` for the Database Service:
-
-```code
-$ teleport db configure create \
-   -o file \
-   --token=/tmp/token \
-   --proxy=teleport.example.com:3080 \
-   --name=test \
-   --protocol=mysql \
-   --uri=mysql.example.com:3306 \
-   --labels=env=dev
+Below is an example of a database service configuration file that proxies
+a single self-hosted MySQL database:
+
+```yaml
+teleport:
+  # The data_dir should be a different location if running on the same
+  # machine as Teleport auth and proxy.
+  data_dir: /var/lib/teleport-db
+  nodename: teleport-db-instance
+  # Teleport invitation token used to join a cluster.
+  # can also be passed on start using --token flag
+  auth_token: /tmp/token
+  # Proxy address to connect to. Note that it has to be the proxy address
+  # because database service always connects to the cluster over reverse
+  # tunnel.
+  auth_servers:
+  - teleport.example.com:3080
+db_service:
+  enabled: "yes"
+  # This section contains definitions of all databases proxied by this
+  # service, can contain multiple items.
+  databases:
+    # Name of the database proxy instance, used to reference in CLI.
+  - name: "example"
+    # Free-form description of the database proxy instance.
+    description: "Example MySQL"
+    # Database protocol.
+    protocol: "mysql"
+    # Database address, MySQL/MariaDB server endpoint in this case.
+    #
+    # Note: this URI's hostname must match the host name specified via --host
+    # flag to tctl auth sign command.
+    uri: "mysql.example.com:3306"
+    # Labels to assign to the database, used in RBAC.
+    static_labels:
+      env: dev
+auth_service:
+  enabled: "no"
+ssh_service:
+  enabled: "no"
+proxy_service:
+  enabled: "no"
 ```
 
 <Admonition
diff --git a/docs/pages/database-access/guides/postgres-redshift.mdx b/docs/pages/database-access/guides/postgres-redshift.mdx
index 1f1e84302fa91..cd4b2783f111d 100644
--- a/docs/pages/database-access/guides/postgres-redshift.mdx
+++ b/docs/pages/database-access/guides/postgres-redshift.mdx
@@ -12,42 +12,173 @@ videoBanner: UFhT52d5bYg
 - AWS account with a Redshift cluster and permissions to create and attach IAM
   policies.
 
-## Step 1/6. Install Teleport
+## Step 1/5. Install Teleport
 
 (!docs/pages/includes/database-access/start-auth-proxy.mdx!)
 
-## Step 2/6. Create Teleport user
+## Step 2/5. Create Teleport user
 
 (!docs/pages/includes/database-access/create-user.mdx!)
 
-## Step 3/6. Create database agent configuration
+## Step 3/5. Configure IAM
 
-(!docs/pages/includes/database-access/token.mdx!)
-
-Create the Database Service configuration file:
-
-```code
-$ teleport db configure create \
-   -o file \
-   --proxy=teleport.example.com:3080 \
-   --token=/tmp/token \
-   --redshift-discovery=us-west-1
-```
-
-The command will generate a Database Service configuration with Redshift
-database auto-discovery enabled on the `us-west-1` region and place it at the
-`/etc/teleport.yaml` location.
-
-## Step 4/6. Create an IAM policy for Teleport
+### Create an IAM policy for Teleport
 
 Teleport needs AWS IAM permissions to be able to:
 
 - Discover and register Redshift databases.
 - Manage IAM user or IAM role policies.
 
-(!docs/pages/includes/database-access/aws-bootstrap.mdx!)
+Go to the [Policies](https://console.aws.amazon.com/iamv2/home#/policies) page
+in the AWS Management Console and create a managed IAM policy for the database
+agent.
+
+The exact set of required permissions depends on the IAM identity your Teleport
+database agent will be using (IAM user or IAM role).
+
+<Tabs>
+  <TabItem label="IAM user">
+  Use this policy if your Teleport database agent runs as an IAM user (for
+  example, uses AWS credentials file).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "redshift:DescribeClusters",
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="IAM role">
+  Use this policy if your Teleport database agent runs as an IAM role (for
+  example, on an EC2 instance with attached IAM role).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "redshift:DescribeClusters",
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+</Tabs>
+
+### Create an IAM permission boundary for Teleport
+Since Teleport will be managing its own IAM policies for access to Redshift
+databases, you need to create a permission boundary to limit its effective
+range of permissions.
+
+Create another managed policy that will serve as a permission boundary on the
+same [Policies](https://console.aws.amazon.com/iamv2/home#/policies) page of
+the AWS Management Console.
+
+In addition to the set of permissions you created above, the boundary should
+also include `redshift:GetClusterCredentials`, which will grant your Teleport
+agent the permission to generate temporary credentials to authenticate with
+Redshift databases.
+
+Similar to the permission polices you created above, the exact set of required
+permissions for the permission boundary depends on the IAM identity your
+Teleport database agent will be using (IAM user or IAM role).
+
+<Tabs>
+  <TabItem label="IAM user">
+  Use this permission boundary if your Teleport database agent runs as an IAM
+  user (for example, uses AWS credentials file).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "redshift:DescribeClusters",
+                  "redshift:GetClusterCredentials",
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="IAM role">
+  Use this permission boundary if your Teleport database agent runs as an IAM
+  role (for example, on an EC2 instance with attached IAM role).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "redshift:DescribeClusters",
+                  "redshift:GetClusterCredentials",
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+</Tabs>
+
+### Attach the policy and boundary to an IAM identity
+(!docs/pages/includes/database-access/attach-iam-policies.mdx!)
+
+<Admonition type="note" title="Self-managed IAM">
+  If you prefer to self-manage IAM for your Redshift databases, see [AWS
+  reference](../reference/aws.mdx) for details.
+</Admonition>
+
+## Step 4/5. Start the database agent
+(!docs/pages/includes/database-access/token.mdx!)
+
+Create the database agent configuration e.g. in `/etc/teleport.yaml`:
+
+```yaml
+teleport:
+  data_dir: /var/lib/teleport
+  auth_token: /tmp/token
+  auth_servers:
+  - teleport.example.com:443 # Teleport proxy address to connect to
+auth_service:
+  enabled: "no"
+proxy_service:
+  enabled: "no"
+db_service:
+  enabled: "yes"
+  aws: # Matchers for registering AWS-hosted databases.
+  - types: ["redshift"]
+    regions: ["us-west-1"] # AWS regions to fetch databases from
+    tags: # AWS database resource tags to match
+      "*": "*"
+```
 
-## Step 5/6. Start the database agent
+Start the database agent:
 
 ```code
 $ teleport start --config=/etc/teleport.yaml
@@ -64,7 +195,7 @@ may not propagate immediately and can take a few minutes to come into effect.
   for more information.
 </Admonition>
 
-## Step 6/6. Connect
+## Step 5/5. Connect
 
 Once the database agent has started and joined the cluster, log in to see the
 registered databases. Replace `--proxy` with the address of your Teleport Proxy Service,
diff --git a/docs/pages/database-access/guides/postgres-self-hosted.mdx b/docs/pages/database-access/guides/postgres-self-hosted.mdx
index e7c2a818ae1ca..162873d4190aa 100644
--- a/docs/pages/database-access/guides/postgres-self-hosted.mdx
+++ b/docs/pages/database-access/guides/postgres-self-hosted.mdx
@@ -111,17 +111,43 @@ tunnel.
 
 ### Start Database service with config file
 
-Generate a configuration file at `/etc/teleport.yaml` for the Database Service:
-
-```code
-$ teleport db configure create \
-   -o file \
-   --token=/tmp/token \
-   --proxy=teleport.example.com:3080 \
-   --name=test \
-   --protocol=postgres \
-   --uri=postgres.example.com:5432 \
-   --labels=env=dev
+Below is an example of a database service configuration file that proxies
+a single self-hosted PostgreSQL database:
+
+```yaml
+teleport:
+  data_dir: /var/lib/teleport-db
+  nodename: test
+  # Proxy address to connect to. Note that it has to be the proxy address
+  # because database service always connects to the cluster over reverse
+  # tunnel.
+  auth_servers:
+  - teleport.example.com:3080
+db_service:
+  enabled: "yes"
+  # This section contains definitions of all databases proxied by this
+  # service, can contain multiple items.
+  databases:
+    # Name of the database proxy instance, used to reference in CLI.
+  - name: "example"
+    # Free-form description of the database proxy instance.
+    description: "Example PostgreSQL"
+    # Database protocol.
+    protocol: "postgres"
+    # Database address, PostgreSQL server endpoint in this case.
+    #
+    # Note: this URI's hostname must match the host name specified via --host
+    # flag to tctl auth sign command.
+    uri: "postgres.example.com:5432"
+    # Labels to assign to the database, used in RBAC.
+    static_labels:
+      env: dev
+auth_service:
+  enabled: "no"
+ssh_service:
+  enabled: "no"
+proxy_service:
+  enabled: "no"
 ```
 
 <Admonition
@@ -179,7 +205,7 @@ $ tsh db login --db-user=postgres --db-name=postgres example
 Once logged in, connect to the database:
 
 ```code
-$ tsh db connect example
+$ tsh db connect aurora
 ```
 
 <Admonition type="note" title="Note">
diff --git a/docs/pages/database-access/guides/rds.mdx b/docs/pages/database-access/guides/rds.mdx
index 8b64256228a8c..fba667601e2d2 100644
--- a/docs/pages/database-access/guides/rds.mdx
+++ b/docs/pages/database-access/guides/rds.mdx
@@ -1,7 +1,6 @@
 ---
-title: Database Access with AWS RDS and Aurora
-h1: Database Access with AWS RDS and Aurora for PostgreSQL, MySQL and MariaDB
-description: How to configure Teleport Database Access with AWS RDS and Aurora for PostgreSQL, MySQL and MariaDB.
+title: Database Access with AWS RDS and Aurora for PostgreSQL and MySQL
+description: How to configure Teleport Database Access with AWS RDS and Aurora for PostgreSQL and MySQL.
 ---
 
 This guide will help you to:
@@ -10,10 +9,9 @@ This guide will help you to:
 - Set up Teleport to access your RDS instances and Aurora clusters.
 - Connect to your databases through Teleport.
 
-<Admonition type="note" title="Supported versions">
-    The following products are not compatible with Database Access as they don't support IAM authentication:
-    - Aurora Serverless.
-    - RDS MariaDB versions lower than 10.6.
+<Admonition type="note" title="Aurora Serverless">
+  Aurora Serverless does not support IAM authentication at the time of this
+  writing so it can't be used with Database Access.
 </Admonition>
 
 ## Prerequisites
@@ -22,42 +20,268 @@ This guide will help you to:
 - AWS account with RDS and Aurora databases and permissions to create and attach
   IAM policies.
 
-## Step 1/7. Install Teleport
+## Step 1/6. Install Teleport
 
 (!docs/pages/includes/database-access/start-auth-proxy.mdx!)
 
-## Step 2/7. Create a Teleport user
+## Step 2/6. Create Teleport user
 
 (!docs/pages/includes/database-access/create-user.mdx!)
 
-## Step 3/7. Create a database agent configuration
+## Step 3/6. Configure IAM
 
-(!docs/pages/includes/database-access/token.mdx!)
+### Create IAM policy for Teleport
 
-Create the Database Service configuration:
+Teleport needs AWS IAM permissions to be able to:
 
-```code
-$ teleport db configure create \
-   -o file \
-   --proxy=teleport.example.com:3080 \
-   --token=/tmp/token \
-   --rds-discovery=us-west-1
-```
+- Discover and register RDS instances and Aurora clusters.
+- Configure IAM authentication for them.
 
-The command will generate a database agent configuration with RDS/Aurora
-database auto-discovery enabled on the `us-west-1` region and place it at the
-`/etc/teleport.yaml` location.
+Go to the [Policies](https://console.aws.amazon.com/iamv2/home#/policies) page
+and create a managed IAM policy for the database agent.
 
-## Step 4/7. Create an IAM policy for Teleport
+The exact set of required permissions depends on whether you're connecting to
+RDS instances or Aurora clusters (or both), as well as the IAM identity your
+Teleport database agent will be using (user or role).
 
-Teleport needs AWS IAM permissions to be able to:
+<Tabs>
+  <TabItem label="RDS / IAM user">
+  Use this policy if you're connecting to RDS instances and your Teleport
+  database agent runs as IAM user (for example, uses AWS credentials file).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBInstances",
+                  "rds:ModifyDBInstance",
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="RDS / IAM role">
+  Use this policy if you're connecting to RDS instances and your Teleport
+  database agent runs as IAM role (for example, on an EC2 instance with
+  attached IAM role).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBInstances",
+                  "rds:ModifyDBInstance",
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="Aurora / IAM user">
+  Use this policy if you're connecting to Aurora clusters and your Teleport
+  database agent runs as IAM user (for example, uses AWS credentials file).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBClusters",
+                  "rds:ModifyDBCluster",
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="Aurora / IAM role">
+  Use this policy if you're connecting to Aurora clusters and your Teleport
+  database agent runs as IAM role (for example, on an EC2 instance with
+  attached IAM role).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBClusters",
+                  "rds:ModifyDBCluster",
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+</Tabs>
 
-- Discover and register RDS instances and Aurora clusters.
-- Configure IAM authentication for them.
+### Create IAM permission boundary for Teleport
+
+Since Teleport will be managing its own IAM policies for access to RDS and
+Aurora databases, you need to create a permission boundary to limit its
+effective range of permissions.
 
-(!docs/pages/includes/database-access/aws-bootstrap.mdx!)
+Create another managed policy that will serve as a permission boundary on the
+same [Policies](https://console.aws.amazon.com/iamv2/home#/policies) page.
 
-## Step 5/7. Start the database agent
+The boundary should have the same set of permissions as the IAM policy you
+created above, plus `rds-db:connect`.
+
+<Tabs>
+  <TabItem label="RDS / IAM user">
+  Use this permission boundary policy if you're connecting to RDS instances and
+  your Teleport database agent runs as IAM user (for example, uses AWS
+  credentials file).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBInstances",
+                  "rds:ModifyDBInstance",
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy",
+                  "rds-db:connect"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="RDS / IAM role">
+  Use this permission boundary policy if you're connecting to RDS instances and
+  your Teleport database agent runs as IAM role (for example, on an EC2 instance
+  with attached IAM role).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBInstances",
+                  "rds:ModifyDBInstance",
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy",
+                  "rds-db:connect"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="Aurora / IAM user">
+  Use this permission boundary policy if you're connecting to Aurora clusters
+  and your Teleport database agent runs as IAM user (for example, uses AWS
+  credentials file).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBClusters",
+                  "rds:ModifyDBCluster",
+                  "iam:GetUserPolicy",
+                  "iam:PutUserPolicy",
+                  "iam:DeleteUserPolicy",
+                  "rds-db:connect"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+  <TabItem label="Aurora / IAM role">
+  Use this permission boundary policy if you're connecting to Aurora clusters
+  and your Teleport database agent runs as IAM role (for example, on an EC2
+  instance with attached IAM role).
+  ```json
+  {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Effect": "Allow",
+              "Action": [
+                  "rds:DescribeDBClusters",
+                  "rds:ModifyDBCluster",
+                  "iam:GetRolePolicy",
+                  "iam:PutRolePolicy",
+                  "iam:DeleteRolePolicy",
+                  "rds-db:connect"
+              ],
+              "Resource": "*"
+          }
+      ]
+  }
+  ```
+  </TabItem>
+</Tabs>
+
+### Attach the policy and boundary to an IAM identity
+(!docs/pages/includes/database-access/attach-iam-policies.mdx!)
+
+<Admonition type="note" title="Self-managed IAM">
+  If you prefer to self-manage IAM for your RDS databases, take a look at
+  [AWS reference](../reference/aws.mdx) for details.
+</Admonition>
+
+## Step 4/6. Start the database agent
+
+(!docs/pages/includes/database-access/token.mdx!)
+
+Create the database agent configuration e.g. in `/etc/teleport.yaml`:
+
+```yaml
+teleport:
+  data_dir: /var/lib/teleport
+  auth_token: /tmp/token
+  auth_servers:
+  # Teleport proxy address to connect to.
+  # For Teleport Cloud users, this will resemble mytenant.teleport.sh
+  - teleport.example.com:3080
+auth_service:
+  enabled: "no"
+proxy_service:
+  enabled: "no"
+db_service:
+  enabled: "yes"
+  aws:
+  - types: ["rds"]
+    regions: ["us-west-1"] # AWS regions to fetch databases from
+    tags: # AWS database resource tags to match
+      "*": "*"
+```
 
 Start the database agent:
 
@@ -75,11 +299,12 @@ policies for the discovered databases. Keep in mind that AWS IAM changes may
 not propagate immediately and can take a few minutes to come into effect.
 
 <Admonition type="note" title="AWS credentials">
-  The Teleport Database Service uses the default
-  credential provider chain to find AWS credentials. See [Specifying Credentials](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials) for more information.
+  The Teleport database agent uses the default credential provider chain to find AWS
+  credentials. See [Specifying Credentials](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials)
+  for more information.
 </Admonition>
 
-## Step 6/7. Create a database IAM user
+## Step 5/6. Create database IAM user
 
 Database users must allow IAM authentication in order to be used with Database
 Access for RDS. See below how to enable it for your database engine.
@@ -93,8 +318,8 @@ Access for RDS. See below how to enable it for your database engine.
   GRANT rds_iam TO alice;
   ```
   </TabItem>
-  <TabItem label="MySQL/MariaDB">
-  MySQL and MariaDB users must have the RDS authentication plugin enabled:
+  <TabItem label="MySQL">
+  MySQL users must have RDS authentication plugin enabled:
 
   ```sql
   CREATE USER alice IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';
@@ -112,7 +337,7 @@ Access for RDS. See below how to enable it for your database engine.
 See [Creating a database account using IAM authentication](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html)
 for more information.
 
-## Step 7/7. Connect
+## Step 6/6. Connect
 
 Once the database agent has started and joined the cluster, login to see the
 registered databases:
diff --git a/docs/pages/database-access/guides/redis.mdx b/docs/pages/database-access/guides/redis.mdx
deleted file mode 100644
index c062781a4520e..0000000000000
--- a/docs/pages/database-access/guides/redis.mdx
+++ /dev/null
@@ -1,375 +0,0 @@
----
-title: Database Access with Redis
-description: How to configure Teleport Database Access with Redis.
----
-
-<Details
-  title="Version warning"
-  opened={true}
-  scope={["oss", "enterprise"]}
-  scopeOnly={true}
-  min="9.0"
->
-  Database access for Redis is available starting from Teleport `9.0`.
-</Details>
-
-This guide will help you to:
-
-- Install and configure Teleport.
-- Configure mutual TLS authentication between Teleport and Redis.
-- Connect to Redis through Teleport.
-
-## Prerequisites
-
-- Teleport version `9.0` or newer.
-- Redis (standalone or cluster) version `6.0` or newer.
-- `redis-cli` installed and added to your system's `PATH` environment variable.
-
-<Admonition type="note" title="Note">
-  Redis `7.0` and RESP3 (REdis Serialization Protocol) are currently not supported.
-</Admonition>
-
-## Step 1/5. Set up Teleport Auth and Proxy
-
-(!docs/pages/includes/database-access/start-auth-proxy.mdx!)
-
-## Step 2/5. Create a Teleport user
-
-(!docs/pages/includes/database-access/create-user.mdx!)
-
-## Step 3/5. Create Redis users
-
-Each Redis user must be protected by a strong password. We recommend using OpenSSL to generate passwords:
-
-```shell
-openssl rand -hex 32
-```
-
-  <Admonition type="note">
-If you have access to Redis you can also generate a password by using the below command from the Redis console:
-
-```
-ACL GENPASS
-```
-  </Admonition>
-
-Create a `users.acl` file, which defines users for your Redis deployment, passwords required to log in as a given user,
- and sets of ACL rules. Redis allows you to provide passwords in plaintext or an SHA256 hash.
-We strongly recommend using an SHA256 hash instead of plaintext passwords.
-
-You can use the command below to generate an SHA256 hash from a password.
-```shell
-echo -n STRONG_GENERATED_PASSWORD | sha256sum
-```
-
-<Tabs>
-  <TabItem label="Standalone">
-    ```text
-    user alice on #57639ed88a85996453555f22f5aa4147b4c9614056585d931e5d976f610651e9 allcommands allkeys
-    user default off
-    ```
-
-    For more ACL examples refer to the [Redis documentation](https://redis.io/docs/manual/security/acl/).
-  </TabItem>
-  <TabItem label="Cluster">
-Redis in cluster mode requires a special user created on leader nodes to enable leader-follower communication.
-    ```text
-    user alice on #57639ed88a85996453555f22f5aa4147b4c9614056585d931e5d976f610651e9 allcommands allkeys
-    user replica-user on #42a9798b99d4afcec9995e47a1d246b98ebc96be7a732323eee39d924006ee1d &* -@all +replconf +ping +psync
-    user default off
-    ```
-
-    For more ACL examples refer to the Redis documentation: [ACL](https://redis.io/docs/manual/security/acl/), [ACL rules for replicas](https://redis.io/docs/manual/security/acl/#acl-rules-for-sentinel-and-replicas).
-  </TabItem>
-</Tabs>
-
-<Admonition type="warning">
-  It's very important to either disable or protect with a password the `default` user. Otherwise, everyone with access
-  to the database can log in as the `default` user, which by default has administrator privileges.
-</Admonition>
-
-## Step 4/5. Set up mutual TLS
-
-(!docs/pages/includes/database-access/tctl-auth-sign.mdx!)
-
-Create the secrets:
-
-<Tabs>
-  <TabItem label="Standalone">
-    When connecting to standalone Redis, sign the certificate for the hostname over
-    which Teleport will be connecting to it.
-
-    For example, if your Redis server is accessible at `redis.example.com`,
- run:
-
-    ```code
-    $ tctl auth sign --format=redis --host=redis.example.com --out=server --ttl=2190h
-    ```
-
-    (!docs/pages/includes/database-access/ttl-note.mdx!)
-
-    The command will create three files:
-    - `server.cas` with Teleport's certificate authority
-    - `server.key` with a generated private key
-    - `server.crt` with a generated user certificate
-
-You will need these files to enable mutual TLS on your Redis server.
-  </TabItem>
-  <TabItem label="Cluster">
-    When connecting to Redis Cluster, sign certificates for each member
-    using their hostnames and IP addresses.
-
-    For example, if the first member is accessible at `redis1.example.com` with IP `10.0.0.1` and
-    the second at `redis2.example.com` with IP `10.0.0.2`, run:
-
-    ```code
-    $ tctl auth sign --format=redis --host=redis1.example.com,10.0.0.1 --out=redis1 --ttl=2190h
-    $ tctl auth sign --format=redis --host=redis2.example.com,10.0.0.2 --out=redis2 --ttl=2190h
-    ```
-
-    (!docs/pages/includes/database-access/ttl-note.mdx!)
-
-    The command will create three files:
-    - `server.cas` with Teleport's certificate authority
-    - `server.key` with a generated private key
-    - `server.crt` with a generated user certificate
-
-You will need these files to enable mutual TLS on your Redis server.
-  </TabItem>
-</Tabs>
-
-(!docs/pages/includes/database-access/rotation-note.mdx!)
-
-Use the generated secrets to enable mutual TLS in your `redis.conf` configuration
-file and restart the database:
-
-<Tabs>
-  <TabItem label="Standalone">
-    ```ini
-    tls-port 6379
-    port 0
-
-    aclfile /path/to/users.acl
-
-    tls-ca-cert-file /path/to/server.cas
-    tls-cert-file /path/to/server.crt
-    tls-key-file /path/to/server.key
-    tls-protocols "TLSv1.2 TLSv1.3"
-    ```
-  </TabItem>
-  <TabItem label="Cluster">
-    ```ini
-    tls-port 7001
-    port 0
-
-    cluster-enabled yes
-
-    tls-replication yes
-    tls-cluster yes
-
-    aclfile /path/to/users.acl
-
-    masterauth GENERATED_STRONG_PASSWORD
-    masteruser replica-user
-
-    tls-cert-file /usr/local/etc/redis/certs/server.crt
-    tls-key-file /usr/local/etc/redis/certs/server.key
-    tls-ca-cert-file /usr/local/etc/redis/certs/server.cas
-    tls-protocols "TLSv1.2 TLSv1.3"
-    ```
-  </TabItem>
-</Tabs>
-
-Once mutual TLS has been enabled, you will no longer be able to connect to
-the cluster without providing a valid client certificate. You can use the
-`tls-auth-clients optional` setting to allow connections
-from clients that do not present a certificate.
-
-See [TLS Support](https://redis.io/topics/encryption)
-in the Redis documentation for more details.
-
-<Admonition type="note" title="Create Redis Cluster">
-  When you're configuring Redis Cluster you need to create the cluster using `redis-cli`.
-
-  Use the following command to create the cluster. Please note `redis-cli --cluster create` accepts only IP addresses.
-
-  ```shell
-  export REDISCLI_AUTH=STRONG_GENERATED_PASSWORD
-  export CERTS_DIR=/path/to/certs/
-  export IP1=10.0.0.1 # update with the real node 1 IP
-  export IP2=10.0.0.2 # update with the real node 2 IP
-  export IP3=10.0.0.3 # update with the real node 3 IP
-  export IP4=10.0.0.4 # update with the real node 4 IP
-  export IP5=10.0.0.5 # update with the real node 5 IP
-  export IP6=10.0.0.6 # update with the real node 6 IP
-
-  redis-cli --user alice --cluster-replicas 1 --tls --cluster-yes \
-  --cluster create ${IP1}:7001 ${IP2}:7002 ${IP3}:7003 ${IP4}:7004 ${IP5}:7005 ${IP6}:7006 \
-  --cacert ${CERTS_DIR}/server.cas --key ${CERTS_DIR}/server.key --cert ${CERTS_DIR}/server.crt
-  ```
-
-</Admonition>
-
-<Admonition type="note" title="Redis Cluster Only">
-
-  To enable Redis cluster mode in Teleport, add the `mode=cluster` parameter to the connection URI in
-  your Teleport Database Service config file.
-
-  ```yaml
-  databases:
-    - name: "redis-cluster"
-      uri: "rediss://redis.example.com:6379?mode=cluster"
-  ```
-
-</Admonition>
-
-## Step 5/5. Connect
-
-Log into your Teleport cluster and see available databases:
-
-<Tabs>
-  <TabItem scope={["enterprise", "oss"]} label="Self Hosted">
-    ```code
-    $ tsh login --proxy=teleport.example.com --user=alice
-    $ tsh db ls
-    # Name          Description     Labels
-    # ------------- --------------- --------
-    # example-redis Example Redis   env=dev
-    ```
-  </TabItem>
-  <TabItem scope={["cloud"]} label="Cloud">
-    ```code
-    $ tsh login --proxy=mytenant.teleport.sh --user=alice
-    $ tsh db ls
-    # Name          Description     Labels
-    # ------------- --------------- --------
-    # example-redis Example Redis   env=dev
-    ```
-  </TabItem>
-</Tabs>
-
-To connect to a particular database instance, first retrieve its certificate
-using the `tsh db login` command:
-
-```code
-$ tsh db login example-redis
-```
-
-<Admonition type="tip" title="Tip">
-  You can be logged into multiple databases simultaneously.
-</Admonition>
-
-You can optionally specify the database name and the user to use by default
-when connecting to the database instance:
-
-```code
-$ tsh db login --db-user=alice example-redis
-```
-
-<Admonition type="note" title="Note">
-  If flag `--db-user` is not provided, Teleport logs in as the `default` user.
-</Admonition>
-
-Once logged in, connect to the database:
-
-```code
-$ tsh db connect example-redis
-```
-
-<Admonition type="note" title="Note">
-  The `redis-cli` command-line client should be available in the system `PATH` in order to be
-  able to connect.
-</Admonition>
-
-Now you can log in as the previously created user using the below command:
-
-```
-AUTH alice STRONG_GENERATED_PASSWORD
-```
-
-To log out of the database and remove credentials:
-
-```code
-# Remove credentials for a particular database instance.
-$ tsh db logout example-redis
-# Remove credentials for all database instances.
-$ tsh db logout
-```
-
-### Supported Redis commands
-
-  <Tabs>
-    <TabItem label="Standalone">
-
-      Redis in standalone mode doesn't support the commands below. If one of the listed commands is called Teleport
-      returns the `ERR Teleport: not supported by Teleport` error.
-
-      - `HELLO`
-      - `PUNSUBSCRIBE`
-      - `SSUBSCRIBE`
-      - `SUNSUBSCRIBE`
-
-    </TabItem>
-    <TabItem label="Cluster">
-
-      Redis in cluster mode doesn't support below commands. If one of the listed commands above is called Teleport
-      returns the `ERR Teleport: command not supported` error.
-
-      - `ACL`
-      - `ASKING`
-      - `CLIENT`
-      - `CLUSTER`
-      - `CONFIG`
-      - `DEBUG`
-      - `EXEC`
-      - `HELLO`
-      - `INFO`
-      - `LATENCY`
-      - `MEMORY`
-      - `MIGRATE`
-      - `MODULE`
-      - `MONITOR`
-      - `MULTI`
-      - `PFDEBUG`
-      - `PFSELFTEST`
-      - `PSUBSCRIBE`
-      - `PSYNC`
-      - `PUNSUBSCRIBE`
-      - `PUNSUBSCRIBE`
-      - `READONLY`
-      - `READWRITE`
-      - `REPLCONF`
-      - `REPLICAOF`
-      - `ROLE`
-      - `SCAN`
-      - `SCRIPT DEBUG`
-      - `SCRIPT KILL`
-      - `SHUTDOWN`
-      - `SLAVEOF`
-      - `SLOWLOG`
-      - `SSUBSCRIBE`
-      - `SUNSUBSCRIBE`
-      - `SYNC`
-      - `TIME`
-      - `WAIT`
-      - `WATCH`
-
-      Teleport also adds additional processing to:
-
-| Command         | Description                                                                                                                                                                                                  |
-|-----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `DBSIZE`        | Sends the query to all nodes and returns the number of keys in the whole cluster.                                                                                                                            |
-| `KEYS`          | Sends the query to all nodes and returns a list of all keys in the whole cluster.                                                                                                                            |
-| `MGET`          | Translates the commands to multiple `GET`s and sends them to multiple nodes. Result is merged in Teleport and returned back to the client. If Teleport fails to fetch at least one key an error is returned. |
-| `FLUSHDB`       | Sends the query to all nodes.                                                                                                                                                                                |
-| `FLUSHALL`      | Works the same as `FLUSHDB`.                                                                                                                                                                                 |
-| `SCRIPT EXISTS` | Sends the query to all nodes. `1` is returned only if script exists on all nodes.                                                                                                                            |
-| `SCRIPT LOAD`   | Sends the script to all nodes.                                                                                                                                                                               |
-| `SCRIPT FLUSH`  | Sends the query to all nodes. `ASYNC` parameter is ignored.                                                                                                                                                  |
-
-    </TabItem>
-  </Tabs>
-
-## Next steps
-
-(!docs/pages/includes/database-access/guides-next-steps.mdx!)
diff --git a/docs/pages/database-access/reference/aws.mdx b/docs/pages/database-access/reference/aws.mdx
index 9bf906be356eb..6d862d2774300 100644
--- a/docs/pages/database-access/reference/aws.mdx
+++ b/docs/pages/database-access/reference/aws.mdx
@@ -3,224 +3,17 @@ title: Database Access AWS IAM Reference
 description: AWS IAM policies for Teleport database access.
 ---
 
-## Auto-discovery
-With the appropriate IAM permissions, Teleport automatically discovers and
-configures IAM policies for Amazon RDS and Redshift.
+Teleport automatically discovers and configures IAM for RDS and Redshift given
+proper IAM permissions as described in the [AWS RDS & Aurora
+guide](../guides/rds.mdx) and the [AWS Redshift
+guide](../guides/postgres-redshift.mdx).
 
-Teleport also requires permission to update database configurations, for example, to
-enable IAM authentication on RDS databases.
-
-You can generate and manage the permissions with the [`teleport db configure
-bootstrap`](../../database-access/reference/cli.mdx#teleport-db-configure-bootstrap)
-command. For example, the following command would generate and print the
-IAM policies:
-
-```code
-$ teleport db configure bootstrap --manual
-```
-
-Or if you prefer, you manage the IAM permissions yourself. Examples of policies
-for each discovery type are shown below.
-
-### Aurora/RDS
-
-<Tabs>
-  <TabItem label="RDS / IAM user">
-  Use this policy if you're connecting to RDS instances and your Teleport
-  database agent runs as an IAM user (for example, uses an AWS credentials file).
-
-  Replace `{account-id}` with your AWS Account ID.
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBInstances",
-                  "rds:ModifyDBInstance"
-              ],
-              "Resource": "*"
-          },
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy"
-              ],
-              "Resource": "arn:aws:iam::{account-id}:user/sample-user"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="RDS / IAM role">
-  Use this policy if you're connecting to RDS instances and your Teleport
-  database agent runs as an IAM role (for example, on an EC2 instance with
-  an attached IAM role).
-
-  Replace `{account-id}` with your AWS Account ID.
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBInstances",
-                  "rds:ModifyDBInstance"
-              ],
-              "Resource": "*"
-          },
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy"
-              ],
-              "Resource": "arn:aws:iam::{account-id}:role/sample-role"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="Aurora / IAM user">
-  Use this policy if you're connecting to Aurora clusters and your Teleport
-  database agent runs as an IAM user (for example, uses an AWS credentials file).
-
-  Replace `{account-id}` with your AWS Account ID.
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBClusters",
-                  "rds:ModifyDBCluster"
-              ],
-              "Resource": "*"
-          },
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy"
-              ],
-              "Resource": "arn:aws:iam::{account-id}:user/sample-user"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="Aurora / IAM role">
-  Use this policy if you're connecting to Aurora clusters and your Teleport
-  database agent runs as an IAM role (for example, on an EC2 instance with
-  an attached IAM role).
-
-  Replace `{account-id}` with your AWS Account ID.
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "rds:DescribeDBClusters",
-                  "rds:ModifyDBCluster"
-              ],
-              "Resource": "*"
-          },
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy"
-              ],
-              "Resource": "arn:aws:iam::{account-id}:role/sample-role"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-</Tabs>
-
-### Redshift
-
-<Tabs>
-  <TabItem label="IAM user">
-  Use this permission boundary if your Teleport database agent runs as an IAM
-  user (for example, it uses an AWS credentials file).
-
-  Replace `{account-id}` with your AWS Account ID.
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "redshift:DescribeClusters",
-                  "redshift:GetClusterCredentials"
-              ],
-              "Resource": "*"
-          },
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "iam:GetUserPolicy",
-                  "iam:PutUserPolicy",
-                  "iam:DeleteUserPolicy"
-              ],
-              "Resource": "arn:aws:iam::{account-id}:user/sample-user"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-  <TabItem label="IAM role">
-  Use this permission boundary if your Teleport database agent runs as an IAM
-  role (for example, on an EC2 instance with an attached IAM role).
-
-  Replace `{account-id}` with your AWS Account ID.
-  ```json
-  {
-      "Version": "2012-10-17",
-      "Statement": [
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "redshift:DescribeClusters",
-                  "redshift:GetClusterCredentials",
-              ],
-              "Resource": "*"
-          },
-          {
-              "Effect": "Allow",
-              "Action": [
-                  "iam:GetRolePolicy",
-                  "iam:PutRolePolicy",
-                  "iam:DeleteRolePolicy"
-              ],
-              "Resource": "arn:aws:iam::{account-id}:role/sample-role"
-          }
-      ]
-  }
-  ```
-  </TabItem>
-</Tabs>
-
-## Manual registration
 If you prefer to register RDS or Redshift databases manually using a [static
 configuration](./configuration.mdx) or
 [`tctl`](../guides/dynamic-registration.mdx) and manage IAM yourself, example
 IAM policies with the required permissions are shown below.
 
-### RDS or Aurora policy
+## RDS or Aurora policy
 
 To connect to an RDS database, the database agent's IAM identity needs to have
 `rds-db:connect` permissions for it:
@@ -263,7 +56,7 @@ arn:aws:rds-db:<region>:<account-id>:dbuser:<resource-id>/<db-user>
 See [Creating and using an IAM policy for IAM database access](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html)
 for more information.
 
-### Redshift policy
+## Redshift policy
 Teleport uses temporary credentials generated by AWS to authenticate with
 Redshift databases.
 
diff --git a/docs/pages/database-access/reference/cli.mdx b/docs/pages/database-access/reference/cli.mdx
index d66839001b05a..dc77a23ce3721 100644
--- a/docs/pages/database-access/reference/cli.mdx
+++ b/docs/pages/database-access/reference/cli.mdx
@@ -38,53 +38,6 @@ $ teleport db start \
 | `--gcp-project-id` | (Only for Cloud SQL) GCP Cloud SQL project identifier. |
 | `--gcp-instance-id` | (Only for Cloud SQL) GCP Cloud SQL instance identifier.|
 
-## teleport db configure create
-
-Creates a sample Database Service configuration.
-
-```code
-$ teleport db configure create --rds-discovery=us-west-1 --rds-discovery=us-west-2
-$ teleport db configure create \
-  --token=/tmp/token \
-  --proxy=proxy.example.com:3080 \
-  --name=example \
-  --protocol=postgres \
-  --uri=postgres://postgres.example.com:5432 \
-  --labels=env=prod
-```
-
-| Flag | Description |
-| - | - |
-| `--proxy` | Teleport Proxy Service address to connect to. Default: `0.0.0.0:3080`. |
-| `--token` | Invitation token to register with the Auth Service. Default: none. |
-| `--rds-discovery` | List of AWS regions the agent will discover for RDS/Aurora instances. |
-| `--redshift-discovery` | List of AWS regions the agent will discover for Redshift instances. |
-| `--ca-pin` | CA pin to validate the Auth Service (can be repeated for multiple pins). |
-| `--name` | Name of the proxied database. |
-| `--protocol` | Proxied database protocol. Supported are: [postgres mysql mongodb cockroachdb redis sqlserver]. |
-| `--uri` | Address the proxied database is reachable at. |
-| `--labels` | Comma-separated list of labels for the database, for example env=dev,dept=it |
-| `-o/--output` | Write to stdout with `-o=stdout`, the default config file with `-o=file`, or a custom path with `-o=file:///path` |
-
-## teleport db configure bootstrap
-
-Bootstrap the necessary configuration for the database agent. It reads the provided agent configuration to determine what will be bootstrapped.
-
-```code
-$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-user TeleportUser
-$ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-role TeleportRole
-$ teleport db configure bootstrap -c /etc/teleport.yaml --manual
-```
-
-| Flag | Description |
-| - | - |
-| `-c/--config` | Path to a configuration file. Default: `/etc/teleport.yaml`. |
-| `--manual` | When executed in "manual" mode, this command will print the instructions to complete the configuration instead of applying them directly. |
-| `--policy-name` | Name of the Teleport Database Service policy. Default: "DatabaseAccess" |
-| `--confirm` | Do not prompt the user and auto-confirm all actions. |
-| `--attach-to-role` | Role name to attach the policy to. Mutually exclusive with `--attach-to-user`. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
-| `--attach-to-user` | User name to attach the policy to. Mutually exclusive with `--attach-to-role`. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
-
 ## tctl auth sign
 
 When invoked with a `--format=db` (or `--format=mongodb` for MongoDB) flag,
diff --git a/docs/pages/desktop-access/getting-started.mdx b/docs/pages/desktop-access/getting-started.mdx
index caa1df9757a00..17191b3b721c4 100644
--- a/docs/pages/desktop-access/getting-started.mdx
+++ b/docs/pages/desktop-access/getting-started.mdx
@@ -156,7 +156,7 @@ certificate-based smart card authentication, and ensuring RDP is enabled.
 
 1. Get the Teleport user CA certificate by running:
 
-```code
+```
 $ tctl auth export --type=windows > user-ca.cer
 ```
 
@@ -237,16 +237,16 @@ access.
 
 1. Publish the CA to LDAP:
 
-```powershell
-certutil –dspublish –f <PathToCertFile.cer> NTAuthCA
+```
+$ certutil –dspublish –f <PathToCertFile.cer> NTAuthCA
 ```
 
 2. Force the retrieval of the CA from LDAP. While this step is not required, it
    speeds up the process and allows you to proceed to the next steps without
    waiting for the certificate to propagate.
 
-```powershell
-certutil -pulse
+```
+$ certutil -pulse
 ```
 
 ### Enable the Smart Card service
@@ -384,7 +384,7 @@ providing a join token.
 
 First, generate a join token with the following command:
 
-```code
+```
 $ tctl tokens add --type=windowsdesktop
 ```
 
diff --git a/docs/pages/desktop-access/reference.mdx b/docs/pages/desktop-access/reference.mdx
deleted file mode 100644
index 156ff29aeecd6..0000000000000
--- a/docs/pages/desktop-access/reference.mdx
+++ /dev/null
@@ -1,19 +0,0 @@
----
-title: Desktop Access Reference
-layout: tocless-doc
----
-
-<TileSet>
-  <Tile icon="wrench" title="Configuration" href="./reference/configuration.mdx">
-    Configure Teleport Desktop Access.
-  </Tile>
-  <Tile icon="list" title="Audit" href="./reference/audit.mdx">
-    Desktop Access audit events.
-  </Tile>
-  <Tile icon="copy" title="Clipboard" href="./reference/clipboard.mdx">
-    Share your clipboard with a remote desktop.
-  </Tile>
-  <Tile icon="play" title="Session Recording" href="./reference/sessions.mdx">
-    Desktop session recording and playback
-  </Tile>
-</TileSet>
\ No newline at end of file
diff --git a/docs/pages/desktop-access/reference/clipboard.mdx b/docs/pages/desktop-access/reference/clipboard.mdx
deleted file mode 100644
index 96f284d94d73d..0000000000000
--- a/docs/pages/desktop-access/reference/clipboard.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-title: Clipboard Sharing
-description: Using Clipboard Sharing with Teleport Desktop Access.
----
-
-Teleport Desktop Access supports copying and pasting text between your browser
-and a remote Windows Desktop.
-
-<Admonition type="note">
-This feature requires a Chromium-based browser such as Google Chrome, Brave,
-or Microsoft Edge. To use Desktop Access on other browsers, disable clipboard
-sharing.
-</Admonition>
-
-Clipboard sharing is configured via Teleport's RBAC system. It is enabled by default,
-but can be disabled by setting the following role option on one or more of a user's
-roles:
-
-```yaml
-kind: role
-version: v4
-metadata:
-  name: no_clipboard
-spec:
-  options:
-    desktop_clipboard: false
-```
-
-If a clipboard sharing is enabled for a user, the browser will prompt for access
-to the system clipboard when a desktop session is started. Grant this access to
-proceed.
-
-{
-    /* screenshot of prompt */
-}
-
-If you mistakenly deny clipboard permissions, you can change this setting by
-clicking the lock on the left side of your address bar, toggling the clipboard
-permission, and refreshing the page.
-
-When a desktop session is active, Teleport will indicate whether clipboard sharing
-is enabled in the menu bar at the top of the screen.
-
-{
-    /* screenshots for enabled / disabled */
-}
\ No newline at end of file
diff --git a/docs/pages/desktop-access/reference/sessions.mdx b/docs/pages/desktop-access/reference/sessions.mdx
deleted file mode 100644
index 0afbb767fae91..0000000000000
--- a/docs/pages/desktop-access/reference/sessions.mdx
+++ /dev/null
@@ -1,86 +0,0 @@
----
-title: Session Recording and Playback
-description: Recording and Playing Back Teleport Desktop Access Sessions.
----
-
-Teleport Desktop Access supports recording and playback of desktop sessions.
-
-## Disabling session recording
-
-Session recording is enabled by default, and can be disabled in one of two ways:
-
-### Disable session recording at the cluster level
-
-To disable session recording at the cluster level, edit your `teleport.yaml`
-configuration file.
-
-```yaml
-teleport:
-  auth_service:
-    session_recording: off
-```
-
-<Admonition type="warning">
-Disabling session recording at the cluster level applies to all types of
-recordings. For example, this configuration would prevent Teleport from
-recording SSH sessions as well as desktop sessions.
-</Admonition>
-
-The `session_recording` property can also be configured dynamically by using
-`tctl` to edit the cluster's `session_recording_config` resource. This is the
-required approach for Teleport Cloud users.
-
-### Disable session recording via RBAC
-
-Teleport's RBAC system allows more fine-grained control over which sessions are
-recorded. By default, desktop session recording is enabled. To disable desktop
-session recording for a particular user, add the following role option to all of
-the user's roles:
-
-```yaml
-kind: role
-version: v4
-metadata:
-  name: no_desktop_recording
-spec:
-  options:
-    record_session:
-      desktop: false
-```
-
-Because recording can be important for auditing and compliance concerns, the
-presence of a single role with recording enabled will result in the session
-being recorded. In other words, *all* of the roles applied to a user must
-explicitly disable recording to prevent the session from being recorded.
-
-## Recording
-
-When a desktop session is active, Teleport will indicate whether the session is
-being recorded in the menu bar at the top of the screen.
-
-{
-    /* screenshots for recording, not recording */
-}
-
-## Playback
-
-Recorded sessions can be viewed in the *Session Recordings* page. Desktop
-recordings show a desktop icon in the first column to distinguish them from
-SSH recordings.
-
-{
-    /* screenshot of recordings table */
-}
-
-<Admonition type="note" title="RBAC for sessions">
-Since Teleport 8.1, sessions can be protected via RBAC. In order for a user to
-see desktop sessions in this list, their roles must permit access to the
-sessions resource.
-</Admonition>
-
-Click the play button to open the player in a new tab. The desktop session
-player supports toggling between play and pause, but does not support seeking to
-a specific point in the stream, rewinding, or restarting playback when the end
-of the stream is reached. To replay a session, refresh the page.
-
-
diff --git a/docs/pages/enterprise/hsm.mdx b/docs/pages/enterprise/hsm.mdx
index f018bc6f26c5f..b1edac7522235 100644
--- a/docs/pages/enterprise/hsm.mdx
+++ b/docs/pages/enterprise/hsm.mdx
@@ -12,7 +12,7 @@ This guide will show you how to set up the Teleport Auth Server to use a hardwar
 - An HSM reachable from your Teleport auth server.
 - The PKCS#11 module for your HSM.
 
-<Details scope={["cloud", "oss"]} opened={true} scopeOnly={true} title="Compatibility Warning">
+<Details scope={["cloud", "oss"]} opened={true} scopeOnly={true} title="Compabitility Warning">
 Teleport Cloud and Teleport Open Source do not currently support HSM.
 </Details>
 
diff --git a/docs/pages/enterprise/sso/adfs.mdx b/docs/pages/enterprise/sso/adfs.mdx
index 0e08fd0ea8fbc..6bc68d1378f6d 100644
--- a/docs/pages/enterprise/sso/adfs.mdx
+++ b/docs/pages/enterprise/sso/adfs.mdx
@@ -1,14 +1,16 @@
 ---
-title: SSO with Active Directory Federation Services
-description: How to configure SSH access with Active Directory Federation Services using Teleport
-h1: Single Sign-On with Active Directory Federation Services
+title: SSH Authentication With ADFS How To
+description: How to configure SSH access with Active Directory (ADFS) using Teleport
+h1: SSH Authentication with ADFS
 ---
 
+## Active Directory as an SSO provider for SSH authentication
+
 This guide will cover how to configure Active Directory Federation Services
-([ADFS](https://en.wikipedia.org/wiki/Active_Directory_Federation_Services)) to be
+[ADFS](https://en.wikipedia.org/wiki/Active_Directory_Federation_Services) to be
 a single sign-on (SSO) provider to issue
 SSH credentials to specific groups of users. When used in combination with role
-based access control (RBAC), it allows SSH administrators to define policies
+based access control (RBAC) it allows SSH administrators to define policies
 like:
 
 - Only members of "DBA" group can SSH into machines running PostgreSQL.
@@ -22,15 +24,25 @@ like:
   This guide requires a commercial edition of Teleport.
 </Admonition>
 
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
+## Enable ADFS Authentication
+
+First, configure Teleport auth server to use ADFS authentication instead of the local
+user database. Update `/etc/teleport.yaml` as shown below and restart the
+teleport daemon.
+
+```yaml
+auth_service:
+    authentication:
+        type: saml
+```
 
 ## Configure ADFS
 
 You'll need to configure ADFS to export claims about a user (Claims Provider
-Trust in ADFS terminology) and you'll need to configure ADFS to trust
+Trust in ADFS terminology) and you'll need to configure AD FS to trust
 Teleport (a Relying Party Trust in ADFS terminology).
 
-For Claims Provider Trust configuration, you'll need to specify at least the
+For Claims Provider Trust configuration you'll need to specify at least the
 following two incoming claims: `Name ID` and `Group`. `Name ID` should be a
 mapping of the LDAP Attribute `E-Mail-Addresses` to `Name ID`. A group
 membership claim should be used to map users to roles (for example to
@@ -39,29 +51,29 @@ separate normal users and admins).
 ![Name ID Configuration](../../../img/adfs-1.png)
 ![Group Configuration](../../../img/adfs-2.png)
 
-In addition, if you are using dynamic roles (see below), it may be useful to map
+In addition if you are using dynamic roles (see below), it may be useful to map
 the LDAP Attribute `SAM-Account-Name` to `Windows account name` and create
 another mapping of `E-Mail-Addresses` to `UPN`.
 
 ![WAN Configuration](../../../img/adfs-3.png)
 ![UPN Configuration](../../../img/adfs-4.png)
 
-You'll also need to create a Relying Party Trust. Use the below information to
-help guide you through the Wizard. Note that for development purposes we recommend
+You'll also need to create a Relying Party Trust, use the below information to
+help guide you through the Wizard. Note, for development purposes we recommend
 using `https://localhost:3080/v1/webapi/saml/acs` as the Assertion Consumer
 Service (ACS) URL, but for production you'll want to change this to a domain
 that can be accessed by other users as well.
 
 - Create a claims aware trust.
 - Enter data about the relying party manually.
-- Set the display name to something along the lines of `Teleport`.
+- Set the display name to something along the lines of "Teleport".
 - Skip the token encryption certificate.
 - Select *"Enable support for SAML 2.0 Web SSO protocol"* and set the URL to `https://localhost:3080/v1/webapi/saml/acs`.
 - Set the relying party trust identifier to `https://localhost:3080/v1/webapi/saml/acs` as well.
 - For access control policy select *"Permit everyone"*.
 
 Once the Relying Party Trust has been created, update the Claim Issuance Policy
-for it. Like before, make sure you send at least `Name ID` and `Group` claims to the
+for it. Like before make sure you send at least `Name ID` and `Group` claims to the
 relying party (Teleport). If you are using dynamic roles, it may be useful to
 map the LDAP Attribute `SAM-Account-Name` to *"Windows account name"* and create
 another mapping of `E-Mail-Addresses` to *"UPN"*.
@@ -71,10 +83,10 @@ associated with it. To check this open Server Manager then
 *"Tools -> Active Directory Users and Computers"* and select the user and right
 click and open properties. Make sure the email address field is filled out.
 
-## Create Teleport roles
+## Create Teleport Roles
 
-Let's create two Teleport roles: one for administrators and the other for
-normal users. You can create them using the `tctl create {file name}` CLI command
+Lets create two Teleport roles: one for administrators and the other is for
+normal users. You can create them using `tctl create {file name}` CLI command
 or via the Web UI.
 
 ```yaml
@@ -114,18 +126,13 @@ spec:
 
 This role declares:
 
-- Devs are only allowed to log in to nodes labeled `access: relaxed`.
-- Developers can log in as the `ubuntu` user.
-- Developers will not be able to see or replay past sessions or
-  re-configure the Teleport cluster.
-
-The login
-`{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}`
-configures Teleport to look at the
-`http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname`
-ADFS claim and use that field as an allowed login for each user. Note the
-double quotes (`"`) and square brackets (`[]`) around the claim name—these are
-important.
+- Devs are only allowed to login to nodes labelled with `access: relaxed` label.
+- Developers can log in as `ubuntu` user
+- Notice `{{external["http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]}}` login. It configures Teleport to look at
+  *"[http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"](http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname")* ADFS claim and use that field as an allowed login for each user.
+  Also note the double quotes (`"`) and square brackets (`[]`) around the claim name - these are important.
+- Developers also do not have any "allow rules" i.e. they will not be able to
+  see/replay past sessions or re-configure the Teleport cluster.
 
 Next, create a SAML connector [resource](../../setup/reference/resources.mdx):
 
@@ -142,7 +149,7 @@ name is `http://schemas.xmlsoap.org/claims/Group` with a value of *"admins"*
 to the *"admin"* role. Groups with the value *"users"* is being mapped to the
 *"users"* role.
 
-## Export the signing key
+## Export the Signing Key
 
 For the last step, you'll need to export the signing key:
 
@@ -163,8 +170,8 @@ the same as before:
 $ tsh --proxy=proxy.example.com login
 ```
 
-This command will print the SSO login URL and try to open it
-automatically in a browser.
+This command will print the SSO login URL (and will try to open it
+automatically in a browser).
 
 <Admonition
   type="tip"
@@ -178,15 +185,15 @@ automatically in a browser.
   type="note"
   title="IMPORTANT"
 >
-  Teleport only supports sending party-initiated flows for SAML 2.0. This means
-  that you cannot initiate login from your identity provider, and must do so
-  from either the Teleport Web UI or CLI.
-  </Admonition>
+  Teleport only supports sending party initiated flows for SAML 2.0. This
+  means you can not initiate login from your identity provider, you have to
+  initiate login from either the Teleport Web UI or CLI.
+</Admonition>
 
 ## Troubleshooting
 
-If you get "access denied" errors, the number one place to check is the audit
-log on the Teleport Auth Server. It is located in `/var/lib/teleport/log` by
+If you get "access denied errors" the number one place to check is the audit
+log on the Teleport auth server. It is located in `/var/lib/teleport/log` by
 default and it will contain the detailed reason why a user's login was denied.
 
 Some errors (like filesystem permissions or misconfigured network) can be
@@ -197,4 +204,4 @@ $ sudo journalctl -fu teleport
 ```
 
 If you wish to increase the verbosity of Teleport's syslog, you can pass
-`--debug` flag to the `teleport start` command.
+`--debug` flag to `teleport start` command.
diff --git a/docs/pages/enterprise/sso/azuread.mdx b/docs/pages/enterprise/sso/azuread.mdx
index 7a4a56330b187..c50e0dd4f49e7 100644
--- a/docs/pages/enterprise/sso/azuread.mdx
+++ b/docs/pages/enterprise/sso/azuread.mdx
@@ -28,8 +28,6 @@ Before you get started you’ll need:
 - To register one or more users in the directory
 - To create at least two security groups in Azure AD and assign one or more users to each group
 
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
-
 ## Configure Azure AD
 
 1. Select **Azure AD -> Enterprise Applications**
@@ -170,6 +168,34 @@ $ tctl create dev.yaml
 
 ## Testing
 
+Update your Teleport configuration to make SAML the default authentication method.
+
+<Tabs>
+<TabItem scope={["oss", "enterprise"]} label="Self Hosted">
+In your Teleport configuration file, include the following:
+
+```yaml
+auth_service:
+  authentication:
+    type: saml
+```
+</TabItem>
+<TabItem scope={["cloud"]} label="Teleport Cloud">
+Apply the following `cluster_auth_preference` resource via `tctl create`.
+
+```yaml
+    kind: cluster_auth_preference
+    version: v2
+    metadata:
+      name: cluster-auth-preference
+    spec:
+      type: "saml"
+```
+</TabItem>
+</Tabs>
+
+The Web UI will now present the option to log in via Microsoft.
+
 ![Login with Microsoft](../../../img/azuread/azure-11-loginwithmsft.png)
 
 
diff --git a/docs/pages/enterprise/sso/gitlab.mdx b/docs/pages/enterprise/sso/gitlab.mdx
index c3b74696f4174..9ffd4523b7463 100644
--- a/docs/pages/enterprise/sso/gitlab.mdx
+++ b/docs/pages/enterprise/sso/gitlab.mdx
@@ -22,7 +22,17 @@ like:
   This guide requires a commercial edition of Teleport.
 </Admonition>
 
-(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
+## Enable OIDC Authentication
+
+First, configure Teleport auth server to use OIDC authentication instead of the local
+user database. Update `/etc/teleport.yaml` as shown below and restart the
+teleport daemon.
+
+```yaml
+auth_service:
+    authentication:
+        type: oidc
+```
 
 ## Configure GitLab
 
diff --git a/docs/pages/enterprise/sso/google-workspace.mdx b/docs/pages/enterprise/sso/google-workspace.mdx
index f2325d9569da9..86b977b3ff770 100644
--- a/docs/pages/enterprise/sso/google-workspace.mdx
+++ b/docs/pages/enterprise/sso/google-workspace.mdx
@@ -32,8 +32,6 @@ Before you get started you’ll need:
 - Ability to create a Google Cloud project, which requires signing up for Google Cloud. Note that this guide will not require using any paid Google Cloud services.
 - Ability to set up Google Workspace groups.
 
-(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
-
 ## Configuring Google Workspace
 
 The setup will consist of creating a new project on Google Cloud Platform,
diff --git a/docs/pages/enterprise/sso/oidc.mdx b/docs/pages/enterprise/sso/oidc.mdx
index 59ab7f1426193..ff77208d90b84 100644
--- a/docs/pages/enterprise/sso/oidc.mdx
+++ b/docs/pages/enterprise/sso/oidc.mdx
@@ -20,7 +20,17 @@ administrators to define policies like:
   This guide requires an Enterprise edition of Teleport.
 </Admonition>
 
-(!docs/pages/includes/enterprise/oidcauthentication.mdx!)
+## Enable OIDC Authentication
+
+First, configure Teleport auth server to use OIDC authentication instead of the local
+user database. Update `/etc/teleport.yaml` as show below and restart the
+teleport daemon.
+
+```yaml
+auth_service:
+    authentication:
+        type: oidc
+```
 
 ## Identity Providers
 
diff --git a/docs/pages/enterprise/sso/okta.mdx b/docs/pages/enterprise/sso/okta.mdx
index 318891f41f802..f5d374e9ea70a 100644
--- a/docs/pages/enterprise/sso/okta.mdx
+++ b/docs/pages/enterprise/sso/okta.mdx
@@ -22,7 +22,17 @@ like:
   This guide requires a commercial edition of Teleport.
 </Admonition>
 
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
+## Enable SAML Authentication
+
+First, configure Teleport auth server to use SAML authentication instead of the local
+user database. Update `/etc/teleport.yaml` as shown below and restart the
+teleport daemon.
+
+```yaml
+auth_service:
+    authentication:
+        type: saml
+```
 
 ## Configure Okta
 
diff --git a/docs/pages/enterprise/sso/one-login.mdx b/docs/pages/enterprise/sso/one-login.mdx
index 37e0f863148c6..a0222e3709c3a 100644
--- a/docs/pages/enterprise/sso/one-login.mdx
+++ b/docs/pages/enterprise/sso/one-login.mdx
@@ -22,7 +22,17 @@ like:
   This guide requires an Enterprise edition of Teleport.
 </Admonition>
 
-(!docs/pages/includes/enterprise/samlauthentication.mdx!)
+## Enable SAML Authentication
+
+Configure Teleport auth server to use SAML authentication instead of the local
+user database. Update `/etc/teleport.yaml` as shown below and restart the
+teleport daemon.
+
+```yaml
+auth_service:
+    authentication:
+        type: saml
+```
 
 ## Configure Application
 
diff --git a/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx b/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx
index fbdaa0e959ecc..fe5ce015141c2 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-jira-cloud.mdx
@@ -4,7 +4,9 @@ description: How to configure SSH login approval using Jira and Teleport
 h1: SSH login approvals using Jira
 ---
 
-This guide will talk through how to setup Teleport with Jira. Teleport's Jira integration allows you to treat Teleport access and permission requests using Jira tickets.
+## Teleport Jira Plugin Setup
+
+This guide will talk through how to setup Teleport with Jira. Teleport to Jira integration allows you to treat Teleport access and permission requests using Jira tickets.
 
 ## Setup
 
@@ -14,20 +16,62 @@ This guide assumes that you have:
 - Admin privileges with access to `tctl`
 - Jira Server or Jira Cloud installation with an owner privileges, specifically to setup webhooks, issue types, and workflows
 
-Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
+### Create an access-plugin role and user within Teleport
 
+First off, using an existing Teleport Cluster, we are going to create a new Teleport User and Role to access Teleport.
 
-### Create a user and role for access
+#### Create User and Role for access
 
-(!docs/pages/includes/plugins/rbac.mdx!)
+Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
+new user and role that only has API access to the `access_request` API. The below script
+will create a yaml resource file for a new user and role.
 
-### Export the access-plugin certificate
+```bash
+cat > rscs.yaml <<EOF
+kind: user
+metadata:
+  name: access-plugin-jira
+spec:
+  roles: ['access-plugin-jira']
+version: v2
+---
+kind: role
+metadata:
+  name: access-plugin-jira
+spec:
+  allow:
+    rules:
+      - resources: ['access_request']
+        verbs: ['list','read','update']
+    # teleport currently refuses to issue certs for a user with 0 logins,
+    # this restriction may be lifted in future versions.
+    logins: ['access-plugin-jira']
+version: v5
+EOF
+
+# ...
+$ tctl create -f rscs.yaml
+```
 
-(!docs/pages/includes/plugins/identity-export.mdx!)
+#### Export access-plugin Certificate
 
-We'll reference these files later when [configuring the plugins](#configuration-file).
+Teleport Plugin use the `access-plugin-jira` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
 
-## Setting up your Jira project
+```bash
+tctl auth sign --format=tls --user=access-plugin-jira --out=auth --ttl=2190h
+# ...
+```
+
+The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#configuration-file).
+
+<Admonition
+  type="note"
+  title="Certificate Lifetime"
+>
+  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
+</Admonition>
+
+## Setting up your Jira Project
 
 ### Creating the permission management project
 
@@ -43,11 +87,11 @@ Create a new board for tasks in the permission management project. The board has
 2. Approved
 3. Denied
 
-Teleport's Jira plugin will create a new issue for each new permission request in the first available column on the board. When you drag the request task to the Approved column in Jira, the request will be approved. If you drag the request task to the Denied column in Jira, the request will be denied.
+Teleport Jira Plugin will create a new issue for each new permission request in the first available column on the board. When you drag the request task to Approved column on Jira, the request will be approved. If you drag the request task to the Denied column in Jira, the request will be denied.
 
-### Setting up a request ID field on Jira
+### Setting up Request ID field on Jira
 
-The Teleport Jira plugin requires a custom issue field to be created.
+Teleport Jira Plugin requires a custom issue field to be created.
 
 Go to your Jira Project settings → Issue Types → Select type `Task` → add a new Short Text field named `TeleportAccessRequestId`.
 
@@ -59,30 +103,30 @@ If you're using Jira Cloud, navigate to [Account Settings → Security → API T
 
 For Jira Server, the URL of the API tokens page will be different depending on your installation.
 
-### Setting up Jira webhooks
+### Setting up Jira Webhooks
 
-Go to Settings → General → System → Webhooks and create a new webhook for Jira to tell the Teleport plugin about updates.
+Go to Settings → General → System → Webhooks and create a new Webhook for Jira to tell the Teleport Plugin about updates.
 
-For the webhook URL, use the URL that you'll run the plugin on. It needs to be a publicly accessible URL (we will show you how to set this up later). Jira requires the webhook listener to run over HTTPS.
+For the webhook URL, use the URL that you'll run the plugin on. It needs to be a publicly accessible URL that we'll set up later. Jira requires the webhook listener to run over HTTPS.
 
-The webhook needs to be notified only about new issues being created, issues being updated, or deleted. You can leave all the other boxes empty.
+The Teleport Jira plugin webhook needs to be notified only about new issues being created, issues being updated, or deleted. You can leave all the other boxes empty.
 
 <Admonition
   type="note"
   title="Plugin Defaults"
 >
-  Jira will send updates about any issues in any projects in your Jira installation to the webhook. We suggest that you use JQL filters to limit which issues are being sent to the plugin.
+  Jira Webhook will send updates about any issues in any projects in your Jira installation to the webhook.  We suggest that you use JQL filters to limit which issues are being sent to the plugin.
 
-  The plugin's web server will run with TLS, but you can disable it with `--insecure-no-tls` to test things out in a dev environment.
+  The Plugin's web server will run with TLS, but you can disable it with `--insecure-no-tls` to test things out in a dev environment.
 </Admonition>
 
-In the webhook settings page, make sure that the webhook will only send Issue Updated updates. It's not critical if anything else gets sent, since the plugin will just ignore everything else.
+In the webhook settings page, make sure that the webhook will only send Issue Updated updates. It's not critical if anything else gets sent, the plugin will just ignore everything else.
 
 ## Installing
 
-We recommend installing Teleport plugins alongside the Teleport Proxy. This is an ideal
+We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
-and Teleport Auth access. We currently only provide linux-amd64 binaries, you can also
+and Teleport Auth access.  We currently only provide linux-amd64 binaries, you can also
 compile these plugins from [source](https://github.com/gravitational/teleport-plugins/tree/master/access/jira).
 
 ```code
@@ -98,7 +142,7 @@ Run `./install` in from 'teleport-jira' or place the executable in the appropria
 
 ### Configuration file
 
-The Teleport Jira plugin uses a config file in TOML format. Generate a boilerplate config by
+Teleport Jira Plugin uses a config file in TOML format. Generate a boilerplate config by
 running the following command:
 
 ```code
@@ -106,20 +150,11 @@ $ teleport-jira configure > teleport-jira.toml
 $ sudo mv teleport-jira.toml /etc
 ```
 
-By default, the Jira Teleport plugin will use a config in `/etc/teleport-jira.toml`, and you can override it with `-c config/file/path.toml` flag.
+By default, Jira Teleport Plugin will use a config in `/etc/teleport-jira.toml`, and you can override it with `-c config/file/path.toml` flag.
 
-<Tabs>
-<TabItem label="Self-Hosted" scopes={["oss", "enterprise"]}>
-```toml
-(!examples/resources/plugins/teleport-jira-self-hosted.toml!)
-```
-</TabItem>
-<TabItem label="Cloud" scopes={["cloud"]}>
 ```toml
-(!examples/resources/plugins/teleport-jira-cloud.toml!)
+(!examples/resources/plugins/teleport-jira.toml!)
 ```
-</TabItem>
-</Tabs>
 
 The `[teleport]` section describes where the teleport service running, and what keys should the plugin use to authenticate itself. Use the keys that you've generated.
 
@@ -130,10 +165,10 @@ The `[jira]` section requires a few things:
 3. Your Jira API token that you've created above.
 4. A Jira Project key, available in Project settings.
 
-The `[http]` setting block describes how the plugin's HTTP server works. The HTTP server is responsible for listening for updates from Jira, and processing updates, like when someone drags a task from Inbox to Approved column.
+`[http]` setting block describes how the Plugin's HTTP server works. The HTTP server is responsible for listening for updates from Jira, and processing updates, like when someone drags a task from Inbox to Approved column.
 
 You must provide an address the server should listen on, and a certificate to use. It's possible to
-run the Jira plugin on the same server as the Teleport Proxy, so you can use the same TLS certificate.
+setup on the same server as the Teleport Proxy, so you can use the same TLS certificate.
 
 ## Testing
 
@@ -151,20 +186,20 @@ Go ahead and test it:
 $ tsh login --request-roles=admin
 ```
 
-That should create a new permission request on Teleport (you can test if it did with `tctl request ls`), and you should see a new task on your Jira project board.
+That should create a new permission request on Teleport (you can test if it did with `tctl request ls` ), and you should see a new task on your Jira project board.
 
-### Set up systemd
+### Setup with SystemD
 
-In production, we recommend starting the Teleport plugin daemon via an init system like systemd.
-Here's the recommended Teleport plugin service unit file for systemd:
+In production, we recommend starting teleport plugin daemon via an init system like systemd .
+Here's the recommended Teleport Plugin service unit file for systemd:
 
 ```txt
 (!examples/systemd/plugins/teleport-jira.service!)
 ```
 
-Save this as `teleport-jira.service`. Make sure the `teleport-jira start` command includes a `--config` flag that refers to the configuration file you created earlier.
+Save this as `teleport-jira.service`.
 
-## Audit log
+## Audit Log
 
 The plugin will let anyone with access to the Jira board approve/deny requests so it's
 important to review Teleport's audit log.
diff --git a/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx b/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx
index 5bf61b69dee15..1357bd2971e90 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-jira-server.mdx
@@ -4,7 +4,9 @@ description: How to configure SSH login approval using Jira Server and Teleport
 h1: SSH login approvals using Jira Server
 ---
 
-This guide will talk through how to set up Teleport with Jira Server. Teleport's integration with Jira Server allows you to treat Teleport access and permission requests as Jira tasks.
+## Teleport Jira Server Plugin Setup
+
+This guide will talk through how to setup Teleport with Jira Server. Teleport to Jira Server integration allows you to treat Teleport access and permission requests as Jira Tasks.
 
 <Admonition type="note">
   Teleport's tsh request workflow is synchronous and needs to be approved within 1 hour of the request.
@@ -30,71 +32,114 @@ This guide will talk through how to set up Teleport with Jira Server. Teleport's
 
 - A running Teleport Cluster
 - Admin Privileges with access and control of [`tctl`](../../setup/reference/cli.mdx#tctl)
-- A Jira Server installation with owner privileges, specifically to set up webhooks, issue types, and workflows. This plugin has been tested with Jira Software 8.8.0
+- Jira Server installation with owner privileges, specifically to setup webhooks, issue types, and workflows. This plugin has been tested with Jira Software 8.8.0
+
+### Create an access-plugin role and user within Teleport
+
+First off, using an existing Teleport Cluster, we are going to create a new Teleport User and Role to access Teleport.
+
+#### Create User and Role for access
 
-Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
+Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
+new user and role that only has API access to the `access_request` API. The below script
+will create a yaml resource file for a new user and role.
+
+```bash
+cat > rscs.yaml <<EOF
+kind: user
+metadata:
+  name: access-plugin-jira
+spec:
+  roles: ['access-plugin-jira']
+version: v2
+---
+kind: role
+metadata:
+  name: access-plugin-jira
+spec:
+  allow:
+    rules:
+      - resources: ['access_request']
+        verbs: ['list','read','update']
+    # teleport currently refuses to issue certs for a user with 0 logins,
+    # this restriction may be lifted in future versions.
+    logins: ['access-plugin-jira']
+version: v5
+EOF
+
+# ...
+$ tctl create -f rscs.yaml
+```
 
-### Create a user and role for access
+#### Export access-plugin Certificate
 
-(!docs/pages/includes/plugins/rbac.mdx!)
+Teleport Plugin uses the `access-plugin-jira` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
 
-### Export access-plugin certificate
+```code
+$ tctl auth sign --format=tls --user=access-plugin-jira --out=auth --ttl=2190h
+# ...
+```
 
-(!docs/pages/includes/plugins/identity-export.mdx!)
+The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#configuration-file).
 
-We'll reference these files later when [configuring the plugins](#configuration-file).
+<Admonition
+  type="note"
+  title="Certificate Lifetime"
+>
+  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
+</Admonition>
 
 ### Setting up your Jira Server instance
 
-#### Creating a project
+#### Creating a Project
 
-The Teleport Jira plugin relies on your Jira project having a board with at least three statuses (columns): Pending, Approved, and Denied. It's therefore the easiest scenario to create a new Jira project for Teleport to use.
+Teleport Jira Plugin relies on your Jira project having a board with at least three statuses (columns): Pending, Approved, and Denied. It's therefore the easiest scenario to create a new Jira project for Teleport to use.
 
-The specific type of project you choose when you create it doesn't matter, as long as you can setup a Kanban Board for it, but we recommend that you go with Kanban Software Development. This will reduce the amount of setup work you'll have to do and provide the board out of the box.
+The specific type of project you choose when you create it doesn't matter, as long as you can setup a Kanban Board for it, but we recommend that you go with Kanban Software Development — this will reduce the amount of setup work you'll have to do and provide the board out of the box.
 
 You'll need the project key for the Teleport plugin settings later on. It's usually a 3 character code for the project.
 
-#### Setting up a request ID field on Jira
+#### Setting up Request ID field on Jira
 
-Teleport stores the request metadata in a special Jira custom field that must be named `teleportAccessRequestId`. To create that field, go to Administration -> Issues -> Custom Fields -> Add Custom Field.
+Teleport stores the request metadata in a special Jira custom field that must be named teleportAccessRequestId. To create that field, go to Administration -> Issues -> Custom Fields -> Add Custom Field.
 
-Name the field `teleportAccessRequestId`, and choose Text Field (single line) as the field type. Assign the field to your project, or make it global. Teleport Access Request ID is an internal field and it's not supposed to be edited by users, so you can leave the Screens section blank. That means that the field won't show up in Jira's UI.
+Name the field `teleportAccessRequestId`, and choose Text Field (single line) as the field type. Assign the field to your project, or make it global. Teleport Access Request ID is an internal field and it's not supposed to be edited by users, so you can leave the Screens section blank. That means that the field won't show up in Jira UI.
 
 Go to Project Settings -> Fields and make sure that the `teleportAccessRequestId` field shows up on the list of fields available in this project.
 
 #### Setting up the status board
 
-The default Jira Software workflow has a different board setup than what Teleport needs, so we'll set up another workflow and assign that workflow to the project board.
+The default Jira Software workflow has a different board setup from what Teleport needs, so we'll setup another workflow and assign that workflow to the project board.
 
-Go to Administration -> Workflows. You can choose to add a new workflow (recommended), or edit the existing workflow. It will be called Software Simplified Workflow for Project NAME by default. It's only used in your single project, so it's safe to edit it.
+Go to Administration -> Workflows. You can choose to add a new workflow (recommended), or edit the existing workflow, it'll be called Software Simplified Workflow for Project NAME by default. It's only used in your single project, so it's safe to edit it.
 
 Edit the workflow to have these three states:
 
 1. Pending
 2. Approved
 3. Denied
-
-The rules of the workflow must meet these requirements:
+   The rules of the workflow must meet these requirements:
 
 - New created issues should be in Pending state.
 - It should be possible to move from Pending to Approved
 - It should be possible to move from Pending to Declined.
 - You can choose to make the workflow strict and restrict moving requests from Approved state to Declined state and vice versa, or leave that flexible. Teleport will only change the request status once, i.e. the first time the request is approved or denied on your Jira board.
 
-With the Jira workflow editor, you can set up who can approve or deny an access reuqest based on their Jira user permissions. We won't cover that in this guide as it mostly relates to Jira settings. By default Teleport will allow anyone who can use the workflow to approve or deny the request.
+With Workflow editor you can setup who can approve or deny the request based on their Jira user permissions. We won't cover that in this guide as it mostly relates to Jira settings. By default Teleport will allow anyone who can use the workflow to approve or deny the request.
 
-Go to your Project Settings -> Workflows, and make sure that the workflow that you just created or edited is applied to the project you'll use for Teleport integration.
+Go to your Project Settings -> Workflows, and make sure that your workflow that you just created or edited is applied to the project you'll use for Teleport integration.
 
 ### Setting up the webhook
 
-Teleport Jira Plugin will listen for a webhook that Jira Server sends when a request is approved or denied. Go to Settings -> System -> Webhooks to set up the webhook. The webhook needs to be sent when issues are updated or deleted.
+Teleport Jira Plugin will listen for a webhook that Jira Server sends when a request is approved or denied. Go to Settings -> System -> Webhooks to setup the webhook. The webhook needs to be sent when issues are updated or deleted.
 
+#### Configuring the Teleport Jira Plugin for Jira Server
 
 ## Installing
 
-We recommend installing Teleport plugins alongside the Teleport Proxy. This is an ideal
+We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
-and Teleport Auth access. We currently only provide linux-amd64 binaries, you can also
+and Teleport Auth access.  We currently only provide linux-amd64 binaries, you can also
 compile these plugins from [source](https://github.com/gravitational/teleport-plugins/tree/master/access/jira).
 
 ```code
@@ -108,10 +153,9 @@ $ which teleport-jira
 # /usr/local/bin/teleport-jira
 ```
 
-Run `sudo ./install` from 'teleport-jira' or place the executable in the appropriate `/usr/bin` or `/usr/local/bin` on the server installation.
+Run `sudo ./install` in from 'teleport-jira' or place the executable in the appropriate `/usr/bin` or `/usr/local/bin` on the server installation.
 
-
-## Configuration file
+### Configuration file
 
 Teleport Jira Plugin uses a config file in TOML format. Generate a boilerplate config by
 running the following command:
@@ -121,31 +165,22 @@ $ teleport-jira configure > teleport-jira.toml
 $ sudo mv teleport-jira.toml /etc
 ```
 
-By default, the Jira Teleport plugin will use a config in `/etc/teleport-jira.toml`, and you can override it with `-c config/file/path.toml` flag.
+By default, Jira Teleport Plugin will use a config in `/etc/teleport-jira.toml`, and you can override it with `-c config/file/path.toml` flag.
 
-<Tabs>
-<TabItem label="Self-Hosted" scope={["oss", "enterprise"]}>
-```toml
-(!examples/resources/plugins/teleport-jira-self-hosted.toml!)
-```
-</TabItem>
-<TabItem label="Cloud" scope={["cloud"]}>
 ```toml
-(!examples/resources/plugins/teleport-jira-cloud.toml!)
+(!examples/resources/plugins/teleport-jira.toml!)
 ```
-</TabItem>
-</Tabs>
 
-The `[teleport]` section describes where the Teleport service is running, and what keys the plugin should use to authenticate itself. Use the keys that you've generated [above](#export-access-plugin-certificate).
+The `[teleport]` section describes where is the teleport service running, and what keys should the plugin use to authenticate itself. Use the keys that you've generated [above in exporting your Certificate section](#export-access-plugin-certificate).
 
 The `[jira]` section requires a few things:
 
-1. Your Jira Cloud or Jira Server URL. For Jira Cloud, it looks something like `yourcompany.atlassian.net`.
+1. Your Jira Cloud or Jira Server URL. For Jira Cloud, it looks something like yourcompany.atlassian.net.
 2. Your username on Jira, i.e. benarent **Note: Not your email address.**
-3. Your Jira API token. **For Jira Server, this is a password. It's a good idea to create a separate user record with permissions limited to accessing this particular project board, and use this with the bot.**
+3. Your Jira API token. **For Jira Server, this is a password.  it's a good idea to create a separate user record with permissions limited to accessing this particular project board, and use this with the bot.**
 4. And the Jira Project key, available in Project settings.
 
-The `[http]` setting block describes how the Plugin's HTTP server works. The HTTP server is responsible for listening for updates from Jira, and processing updates, like when someone drags a task from Inbox to Approved column.
+`[http]` setting block describes how the Plugin's HTTP server works. The HTTP server is responsible for listening for updates from Jira, and processing updates, like when someone drags a task from Inbox to Approved column.
 
 You must provide an address the server should listen on, and a certificate to use, unless you plan on running with `--insecure-no-tls`, which we don't recommend in production.
 
@@ -166,7 +201,7 @@ $ teleport-jira start
 # DEBU   Watcher connected access/service_job.go:62
 ```
 
-The log output should look familiar to what the Teleport service logs. You should see that it connected to Teleport and is listening for new Teleport requests and Jira webhooks.
+The log output should look familiar to what Teleport service logs. You should see that it connected to Teleport, and is listening for new Teleport requests and Jira webhooks.
 
 Go ahead and test it:
 
@@ -176,10 +211,10 @@ $ tsh login --request-roles=admin
 
 That should create a new permission request on Teleport (you can test if it did with `tctl request ls` ), and you should see a new task on your Jira project board.
 
-### Set up systemd
+### Setup with SystemD
 
-In production, we recommend starting the Teleport plugin daemon via an init system like systemd.
-Here's the recommended Teleport plugin service unit file for systemd:
+In production, we recommend starting teleport plugin daemon via an init system like systemd .
+Here's the recommended Teleport Plugin service unit file for systemd:
 
 ```ini
 (!examples/systemd/plugins/teleport-jira.service!)
@@ -187,7 +222,7 @@ Here's the recommended Teleport plugin service unit file for systemd:
 
 Save this as `teleport-jira.service`.
 
-## Audit log
+## Audit Log
 
 The plugin will let anyone with access to the Jira board approve or deny requests, so it's important to review Teleport's audit log.
 
diff --git a/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx b/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx
index 48439b8c0f9f6..cc2ceff979154 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-mattermost.mdx
@@ -4,9 +4,11 @@ description: This guide explains how to setup a Mattermost plugin for Teleport f
 h1: Teleport Mattermost Plugin Setup
 ---
 
-This guide will explain how to set up Teleport with Mattermost, an open source messaging platform. Teleport's Mattermost integration allows teams to approve or deny Teleport Access Requests using Mattermost.
+This guide will talk through how to setup Teleport with Mattermost. Teleport to
+Mattermost integration allows teams to approve or deny Teleport access requests
+using [Mattermost](https://mattermost.com/) an open source messaging platform.
 
-#### Example Mattermost request
+#### Example Mattermost Request
 
 <video controls>
   <source
@@ -30,17 +32,14 @@ This guide assumes that you have:
 
 - A running Teleport Cluster
 - Admin privileges with access to `tctl`
-- A Mattermost account with admin privileges. This plugin has been tested with Mattermost 5.x
+- Mattermost account with admin privileges. This plugin has been tested with Mattermost 5.x
 
-Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
-
-
-### Setting up Mattermost to work with the bot
+#### Setting up Mattermost to work with the bot
 
 ![Enable Mattermost bots](../../../img/enterprise/plugins/mattermost/mattermost_admin_console_integrations_bot_accounts.png)
 
 In Mattermost, go to System Console → Integrations → Enable Bot Account Creation → Set to True.
-This will allow you to create a new bot account that the Teleport bot will use.
+This will allow us to create a new bot account that the Teleport bot will use.
 
 Go back to your team, then Integrations → Bot Accounts → Add Bot Account.
 
@@ -50,7 +49,7 @@ The new bot account will need Post All permission.
 
 ![Enable Mattermost Bots](../../../img/enterprise/plugins/mattermost/mattermost_bot.png)
 
-### Create an OAuth 2.0 application
+##### Create an OAuth 2.0 Application
 
 In Mattermost, go to System Console → Integrations → OAuth 2.0 Applications.
 
@@ -61,19 +60,64 @@ In Mattermost, go to System Console → Integrations → OAuth 2.0 Applications.
 The confirmation screen after you've created the bot will give you the access token.
 We'll use this in the config later.
 
-### Create User and Role resources for access
-(!docs/pages/includes/plugins/rbac.mdx!)
+#### Create User and Role for access
+
+Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
+new user and role that only has API access to the `access_request` API. The below script
+will create a yaml resource file for a new user and role.
+
+```yaml
+# This command will create two Teleport Yaml resources, a new Teleport user and a
+# Role for that users that can only approve / list requests.
+$ cat > rscs.yaml <<EOF
+kind: user
+metadata:
+  name: access-plugin-mattermost
+spec:
+  roles: ['access-plugin-mattermost']
+version: v2
+---
+kind: role
+metadata:
+  name: access-plugin-mattermost
+spec:
+  allow:
+    rules:
+      - resources: ['access_request']
+        verbs: ['list','read','update']
+    # teleport currently refuses to issue certs for a user with 0 logins,
+    # this restriction may be lifted in future versions.
+    logins: ['access-plugin-mattermost']
+version: v5
+EOF
+
+# Run this to create the user and role in Teleport.
+$ tctl create -f rscs.yaml
+```
+
+#### Export access-plugin Certificate
+
+Teleport Plugin use the `access-plugin-mattermost` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
 
-### Export access-plugin Certificate
-(!docs/pages/includes/plugins/identity-export.mdx!)
+```code
+$ tctl auth sign --format=tls --user=access-plugin-mattermost --out=auth --ttl=2190h
+# ...
+```
 
-We'll reference these files later when [configuring the plugins](#configuring-mattermost-bot).
+The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#configuring-mattermost-bot).
+
+<Admonition
+  type="note"
+  title="Certificate Lifetime"
+>
+  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
+</Admonition>
 
 ## Downloading and installing the plugin
 
 We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
-and Teleport Auth access. We currently only provide linux-amd64 binaries, you can also
+and Teleport Auth access.  We currently only provide linux-amd64 binaries, you can also
 compile these plugins from [source](https://github.com/gravitational/teleport-plugins/tree/master/access/mattermost).
 
 ```code
@@ -99,20 +143,11 @@ $ sudo mv teleport-mattermost.toml /etc
 
 Then, edit the config as needed.
 
-<Tabs>
-<TabItem scopes={["oss", "enterprise"]} label="Self-Hosted">
-```yaml
-(!examples/resources/plugins/teleport-mattermost-self.toml!)
-```
-</TabItem>
-<TabItem scopes={["cloud"]} label="Cloud">
 ```yaml
-(!examples/resources/plugins/teleport-mattermost-cloud.toml!)
+(!examples/resources/plugins/teleport-mattermost.toml!)
 ```
-</TabItem>
-</Tabs>
 
-### Testing the plugin
+### Testing the Plugin
 
 With the config above, you should be able to run the bot invoking
 `teleport-mattermost start -d`. The will provide some debug information to make sure
@@ -130,9 +165,9 @@ $ teleport-mattermost start -d
 # DEBU   Mattermost API health check finished ok mattermost/main.go:19
 ```
 
-### Set up with SystemD
+### Setup with SystemD
 
-In production, we recommend starting the Teleport plugin daemon via an init system like systemd. Here's the recommended Teleport plugin service unit file for systemd:
+In production, we recommend starting teleport plugin daemon via an init system like systemd . Here's the recommended Teleport Plugin service unit file for systemd:
 
 ```ini
 (!examples/systemd/plugins/teleport-mattermost.service!)
@@ -140,7 +175,7 @@ In production, we recommend starting the Teleport plugin daemon via an init syst
 
 Save this as `teleport-mattermost.service`.
 
-## Audit log
+## Audit Log
 
 The plugin will let anyone with access to the Mattermost channel requests so it's
 important to review Teleport's audit log.
diff --git a/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx b/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx
index 5a9aa8336fbca..824a7ca7913c6 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-pagerduty.mdx
@@ -5,9 +5,11 @@ h1: SSH Login Approval using PagerDuty
 videoBanner: RzTB4Lsm09M
 ---
 
-This guide will talk through how to setup Teleport with PagerDuty. Teleport's
-PagerDuty integration allows you to treat Teleport access and permission
-requests as PagerDuty incidents, notify the appropriate team, and approve
+## Teleport PagerDuty Plugin Setup
+
+This guide will talk through how to setup Teleport with PagerDuty. Teleport to
+PagerDuty integration  allows you to treat Teleport access and permission
+requests as PagerDuty incidents — notifying the appropriate team, and approve
 or deny the requests via PagerDuty special action.
 
 ## Setup
@@ -19,37 +21,76 @@ This guide assumes that you have:
 - A running Teleport Cluster
 - Admin privileges with access to `tctl`
 - A PagerDuty account, with access to creating a new API token
-- A node to run the plugin. We recommend running it alongside the Teleport Proxy for convenience
+- A node to run the plugin, we recommend running it alongside the Teleport Proxy for convenience
 
-Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
+#### Create User and Role for access
 
+Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
+new user and role that only has API access to the `access_request` API. The below script
+will create a yaml resource file for a new user and role.
 
-### Create a user and role for access
+```yaml
+# This command will create two Teleport Yaml resources, a new Teleport user and a
+# Role for that users that can only approve / list requests.
+$ cat > rscs.yaml <<EOF
+kind: user
+metadata:
+  name: access-plugin-pagerduty
+spec:
+  roles: ['access-plugin-pagerduty']
+version: v2
+---
+kind: role
+metadata:
+  name: access-plugin-pagerduty
+spec:
+  allow:
+    rules:
+      - resources: ['access_request']
+        verbs: ['list','read','update']
+    # teleport currently refuses to issue certs for a user with 0 logins,
+    # this restriction may be lifted in future versions.
+    logins: ['access-plugin-pagerduty']
+version: v5
+EOF
+
+# Run this to create the user and role in Teleport.
+$ tctl create -f rscs.yaml
+```
 
-(!docs/pages/includes/plugins/rbac.mdx!)
+#### Export access-plugin Certificate
 
-### Export the access-plugin certificate
+Teleport Plugin use the `access-plugin-pagerduty` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
 
-(!docs/pages/includes/plugins/identity-export.mdx!)
+```code
+$ tctl auth sign --format=tls --user=access-plugin-pagerduty --out=auth --ttl=2190h
+# ...
+```
 
-We'll reference these files later when [configuring the plugins](#config-file).
+The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#editing-the-config-file).
 
+<Admonition
+  type="note"
+  title="Certificate Lifetime"
+>
+  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
+</Admonition>
 
-### Setting up a PagerDuty API key
+### Setting up PagerDuty API key
 
 In your PagerDuty dashboard, go to **Configuration → API Access → Create New API Key**, add a key description, and save the key. We'll use the key in the plugin config file later.
 
-**Create a PagerDuty API key**
+**Create PagerDuty API Key**
 ![Create a service account](../../../img/enterprise/plugins/pagerduty/pagerduty-api-key.png)
 
-**Create a service account**
+**Create Service Account**
 ![Create a service account](../../../img/enterprise/plugins/pagerduty/create-new-service-pd.png)
 
 ## Downloading and installing the plugin
 
-We recommend installing Teleport plugins alongside the Teleport Proxy. This is an ideal
+We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
-and Teleport Auth access. We currently only provide linux-amd64 binaries, you can also
+and Teleport Auth access.  We currently only provide linux-amd64 binaries, you can also
 compile these plugins from [source](https://github.com/gravitational/teleport-plugins/tree/master/access/pagerduty).
 
 ```bash
@@ -65,7 +106,7 @@ Run `./install` in from 'teleport-pagerduty' or place the executable in the appr
 
 ### Config file
 
-Teleport's PagerDuty plugin has its own configuration file in TOML format. Before starting the plugin for the first time, you'll need to generate and edit that config file.
+Teleport PagerDuty plugin has its own configuration file in TOML format. Before starting the plugin for the first time, you'll need to generate and edit that config file.
 
 ```code
 $ teleport-pagerduty configure > teleport-pagerduty.toml
@@ -76,20 +117,12 @@ $ sudo mv teleport-pagerduty.toml /etc
 
 After generating the config, edit it as follows:
 
-<Tabs>
-<TabItem scopes={["oss", "enterprise"]} label="Self-Hosted">
-```yaml
-(!examples/resources/plugins/teleport-pagerduty-self.toml!)
-```
-</TabItem>
-<TabItem scopes={["cloud"]} label="Cloud">
-```yaml
-(!examples/resources/plugins/teleport-pagerduty-cloud.toml!)
+```toml
+# Example PagerDuty config file
+(!examples/resources/plugins/teleport-pagerduty.toml!)
 ```
-</TabItem>
-</Tabs>
 
-### Testing the plugin
+### Testing the Plugin
 
 With the config above, you should be able to run the plugin invoking
 `teleport-pagerduty start -d`. The will provide some debug information to make sure
@@ -110,9 +143,9 @@ $ teleport-pagerduty start -d
 
 By default, `teleport-pagerduty` will assume its config is in `/etc/teleport-pagerduty.toml`, but you can override it with `--config` option.
 
-### Set up systemd
+### Setup with SystemD
 
-In production, we recommend starting the Teleport plugin daemon via an init system like systemd. Here's the recommended Teleport plugin service unit file for systemd:
+In production, we recommend starting teleport plugin daemon via an init system like systemd . Here's the recommended Teleport Plugin service unit file for systemd:
 
 ```bash
 (!examples/systemd/plugins/teleport-pagerduty.service!)
@@ -120,7 +153,7 @@ In production, we recommend starting the Teleport plugin daemon via an init syst
 
 Save this as `teleport-pagerduty.service`.
 
-#### Example PagerDuty request
+#### Example PagerDuty Request
 
 <video controls>
   <source
@@ -136,10 +169,10 @@ Save this as `teleport-pagerduty.service`.
   Your browser does not support the video tag.
 </video>
 
-## On-call auto-approval
+## On-call Auto Approval
 
 The PagerDuty plugin has an option to auto-approve access requests. This
-feature will map an external SSO identity to a PagerDuty on-call email address.
+feature will map external SSO identity to PagerDuty on call email addresses.
 If the user requesting matches the person on call the request will be
 automatically approved.
 
@@ -155,7 +188,7 @@ service_id = "PIJ90N7"        # PagerDuty service id
 auto_approve = true           # Auto approve
 ```
 
-## Audit log
+## Audit Log
 
 The plugin will let anyone with access to the PagerDuty account so it's
 important to review Teleport's audit log.
diff --git a/docs/pages/enterprise/workflow/ssh-approval-slack.mdx b/docs/pages/enterprise/workflow/ssh-approval-slack.mdx
index 0b17ea53f6d14..14e3e90e21fb3 100644
--- a/docs/pages/enterprise/workflow/ssh-approval-slack.mdx
+++ b/docs/pages/enterprise/workflow/ssh-approval-slack.mdx
@@ -1,10 +1,10 @@
 ---
-title: Teleport's integration with Slack
+title: Teleport integration with Slack
 description: This guide explains how to setup a Slack plugin for Teleport for privilege elevation approvals.
 h1: Teleport Slack Plugin Setup
 ---
 
-This guide will talk through how to set up Teleport with Slack. Teleport's Slack integration notifies individuals and channels of Access Requests.
+This guide will talk through how to setup Teleport with Slack. Teleport to Slack integration notifies individuals and channels of Access Requests.
 
 #### Example Slack Request
 
@@ -30,31 +30,126 @@ This guide assumes that you have:
 
 - A running Teleport Cluster
 - Admin privileges with access to `tctl`
-- Slack admin privileges to create an app and install it to your workspace
+- Slack Admin Privileges to create an app and install it to your workspace.
 
-Teleport Cloud requires that plugins connect through the Proxy Service (`mytenant.teleport.sh:443`). Open Source and Enterprise installations can connect to the Auth Service (`auth.example.com:3025`) directly.
+Teleport Cloud requires connecting through the proxy service (`mytenant.teleport.sh:443`).
+If you want the Slack plugin to connect through the web port (`teleport.example.com:443`) follow the Teleport Cloud instructions.
+OpenSource and Enterprise installations can connect to the auth service (`auth.example.com:3025`) directly.
 
-### Create a user and role for access
+#### Create User and Role for access
 
-(!docs/pages/includes/plugins/rbac.mdx!)
+<Tabs>
+  <TabItem label="OpenSource, Enterprise" scope={["oss","enterprise"]}>
+Log into Teleport Authentication Server, this is where you normally run `tctl`. Create a
+new user and role that only has API access to the `access_request` API. The below script
+will create a yaml resource file for a new user and role.
+</TabItem>
+  <TabItem label="Cloud" scope={["cloud"]}>
+
+The Teleport Cloud requires authenticating with a role that has [`impersonation`](https://goteleport.com/docs/access-controls/guides/impersonation/) rights and can create the `access-plugin` role and user.
+Login in with `tsh` with a user that has this role or has a role with these allows.
+```
+kind: role
+version: v5
+metadata:
+  name: plugin-admin
+spec:
+  allow:
+    impersonate:
+      roles:
+      - access-plugin
+      users:
+      - access-plugin
+    rules:
+      - resources: ['roles']
+        verbs: ['create','update','read','list','delete']
+      - resources: ['user']
+        verbs: ['create','update','read','list','delete']
+
+```
+  </TabItem>
+
+</Tabs>
 
-### Export the access-plugin certificate
 
-(!docs/pages/includes/plugins/identity-export.mdx!)
+Create a non-interactive bot `access-plugin` user and role.
 
-We'll reference these files later when [configuring the plugins](#configuring-the-teleport-slack-plugin).
+```yaml
+kind: user
+metadata:
+  name: access-plugin
+spec:
+  roles: ['access-plugin']
+version: v2
+---
+kind: role
+version: v5
+metadata:
+  name: access-plugin
+spec:
+  allow:
+    rules:
+      - resources: ['access_request']
+        verbs: ['list', 'read']
+      - resources: ['access_plugin_data']
+        verbs: ['update']
+```
+
+Here and below follow along and create yaml resources using `tctl create -f`:
+
+```
+$ tctl create -f access.yaml
+```
+
+<Admonition type="tip">
+  If you're using other plugins, you might want to create different users and roles for different plugins
+</Admonition>
 
-### Create a Slack app
+#### Export access-plugin Certificate
 
-We'll create a new Slack app and set up auth tokens and callback URLs, so that Slack knows how to notify the Teleport plugin when Approve / Deny buttons are clicked.
+Teleport Plugin use the `access-plugin` role and user to perform the approval. We export the identity files, using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign). You have the option of connecting through the proxy or auth server.  Teleport Cloud must use the proxy server.
+
+<Tabs>
+  <TabItem label="OpenSource, Enterprise" scope={["oss","enterprise"]}>
+```code
+$ tctl auth sign --format=tls --user=access-plugin --out=auth --ttl=2190h
+# ...
+```
+
+The above sequence should result in three PEM encoded files being generated: auth.crt, auth.key, and auth.cas (certificate, private key, and CA certs respectively).  We'll reference the auth.crt, auth.key, and auth.cas files later when [configuring the plugins](#configuring-teleport-slack).
+</TabItem>
+  <TabItem label="Cloud" scope={["cloud"]}>
+```code
+$ tctl auth sign --user=access-plugin --out=auth.pem --ttl=2190h
+# ...
+```
+
+The above sequence should result in one PEM encoded file being generated: auth.pem.  We'll reference the auth.pem file later when [configuring the plugins](#configuring-teleport-slack).
+
+  </TabItem>
+
+</Tabs>
+
+
+
+<Admonition
+  type="note"
+  title="Certificate Lifetime"
+>
+  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
+</Admonition>
+
+### Create Slack App
+
+We'll create a new Slack app and setup auth tokens and callback URLs, so that Slack knows how to notify the Teleport plugin when Approve / Deny buttons are clicked.
 
 You'll need to:
 
 1. Create a new app, pick a name and select a workspace it belongs to.
-2. Add an OAuth Scope, which is required by Slack for the app to be installed.
-3. Obtain an OAuth token.
+2. Add OAuth Scopes. This is required by Slack for the app to be installed — we'll only need a single scope to post messages to your Slack account.
+3. Obtain OAuth token
 
-#### Creating a new Slack app
+#### Creating a New Slack app
 
 Visit [https://api.slack.com/apps](https://api.slack.com/apps) to create a new Slack App.
 
@@ -64,24 +159,24 @@ Visit [https://api.slack.com/apps](https://api.slack.com/apps) to create a new S
 
 ![Create Slack App](../../../img/enterprise/plugins/slack/Create-a-Slack-App.png)
 
-#### Selecting OAuth scopes
+#### Selecting OAuth Scopes
 
 On the App screen, go to “OAuth and Permissions” under Features in the sidebar menu. Then scroll to Scopes, and add `chat:write, incoming-webhook, users:read, users:read.email` scopes so that our plugin can post messages to your Slack channels.
 
 ![API Scopes](../../../img/enterprise/plugins/slack/api-scopes.png)
 
-#### Obtain an OAuth token
+#### Obtain OAuth Token
 
 ![OAuth Tokens](../../../img/enterprise/plugins/slack/OAuth.png)
 
-#### Add to workspace
+#### Add to Workspace
 
 ![OAuth Tokens](../../../img/enterprise/plugins/slack/Slackbot-Permissions.png)
 After adding to the workspace, you still need to invite the bot to the channel. Do this by using the @ command,
 and inviting them to the channel.
 ![Invite bot to channel](../../../img/enterprise/plugins/slack/invite-user-to-team.png)
 
-## Installing the Teleport Slack plugin
+## Installing the Teleport Slack Plugin
 
 We recommend installing the Teleport Plugins alongside the Teleport Proxy. This is an ideal
 location as plugins have a low memory footprint, and will require both public internet access
@@ -112,9 +207,9 @@ compile these plugins from [source](https://github.com/gravitational/teleport-pl
 </Tabs>
 
 
-Run `./install` from `teleport-slack` or place the executable in the appropriate `/usr/bin` or `/usr/local/bin` on the server installation.
+Run `./install` in from `teleport-slack` or place the executable in the appropriate `/usr/bin` or `/usr/local/bin` on the server installation.
 
-### Configuring the Teleport Slack plugin
+### Configuring Teleport Slack
 
 Teleport Slack uses a config file in TOML format. Generate a boilerplate config by
 running the following command:
@@ -124,11 +219,17 @@ $ teleport-slack configure > teleport-slack.toml
 $ sudo mv teleport-slack.toml /etc
 ```
 
+Then, edit the config as needed.
+
+```yaml
+(!examples/resources/plugins/teleport-slack-configure.toml!)
+```
+
 #### Editing the config file
 
-In the Teleport section, use the identity file(s) you generated with `tctl auth sign`. The plugin installer creates a folder for those files in `/var/lib/teleport/plugins/slack/`. 
+In the Teleport section, use the certificates you've generated with `tctl auth sign` before. The plugin installer creates a folder for those certificates in `/var/lib/teleport/plugins/slack/` — so just move the certificates there and make sure the config points to them.
 
-Move the certificates to this folder, then edit the configuration file (`teleport-slack.toml`) based on the reference below to ensure that the appropriate settings point to your identity file(s). 
+In Slack section, use the OAuth token, signing token, setup the desired channel name.
 
 <Tabs>
   <TabItem label="OpenSource, Enterprise" scope={["oss","enterprise"]}>
@@ -145,7 +246,7 @@ Move the certificates to this folder, then edit the configuration file (`telepor
 </TabItem>
 </Tabs>
 
-## Test run
+## Test Run
 
 Assuming that Teleport is running, and you've created the Slack app, the plugin config,
 and provided all the certificates — you can now run the plugin and test the workflow!
@@ -188,7 +289,7 @@ The messages should automatically get updated to reflect the action you just cli
 $ tctl request ls
 ```
 
-### Log in and request a role
+### TSH User Login and Request Role
 
 You can also test the full workflow from the user's perspective using `tsh`:
 
@@ -199,10 +300,10 @@ Seeking request approval... (id: 8f77d2d1-2bbf-4031-a300-58926237a807)
 
 You should now see a new request in Teleport, and a message about the request on Slack with instructions.
 
-### Set up systemd
+### Setup with SystemD
 
-In production, we recommend starting the Teleport plugin daemon via an init system like systemd.
-Here's the recommended Teleport plugin service unit file for systemd:
+In production, we recommend starting teleport plugin daemon via an init system like systemd .
+Here's the recommended Teleport Plugin service unit file for systemd:
 
 ```ini
 (!examples/systemd/plugins/teleport-slack.service!)
@@ -210,7 +311,7 @@ Here's the recommended Teleport plugin service unit file for systemd:
 
 Save this as `teleport-slack.service`.
 
-## Audit log
+## Audit Log
 
 The plugin will let anyone with access to the Slack Channel so it's
 important to review Teleport' audit log.
diff --git a/docs/pages/faq.mdx b/docs/pages/faq.mdx
index 482052284e516..3f5e846b010df 100644
--- a/docs/pages/faq.mdx
+++ b/docs/pages/faq.mdx
@@ -35,7 +35,7 @@ section of the Admin Manual.
 
 This was a popular customer [request](https://github.com/gravitational/teleport/issues/803) that was added in Teleport version 4.0.
 Once you've upgraded your Teleport Cluster, change the node config option `--auth-server` to point to web proxy address (this would be `public_addr` and `web_listen_addr`
-in file configuration). For more information, see [Adding Nodes to the Cluster](./setup/admin/adding-nodes.mdx).
+in file configuration). As defined in [Adding a node located behind NAT - Teleport Node Tunneling](./setup/admin/adding-nodes.mdx#adding-a-node-located-behind-nat)
 
 ### Can nodes use a single port for reverse tunnels?
 
diff --git a/docs/pages/getting-started/docker-compose.mdx b/docs/pages/getting-started/docker-compose.mdx
index 9f11da2ba215f..433dd6189a1af 100644
--- a/docs/pages/getting-started/docker-compose.mdx
+++ b/docs/pages/getting-started/docker-compose.mdx
@@ -4,8 +4,10 @@ description: How to get started with Teleport Open Source Edition using Docker C
 h1: Get started with Docker Compose
 ---
 
-This guide will help you understand how Teleport works by spinning up a demo cluster on your local machine using Docker Compose.
-It will also show you how to use Teleport with OpenSSH, Ansible, and Teleport's native client, `tsh`. 
+This section will cover:
+
+- Getting started with a local Teleport cluster using docker compose.
+- Using Teleport with OpenSSH, ansible and Teleport's native client, `tsh`.
 
 ## Prerequisites
 
diff --git a/docs/pages/getting-started/linux-server.mdx b/docs/pages/getting-started/linux-server.mdx
index a8f598e171d18..f6a450cbd9872 100644
--- a/docs/pages/getting-started/linux-server.mdx
+++ b/docs/pages/getting-started/linux-server.mdx
@@ -7,14 +7,6 @@ videoBanner: jvaCmQyHghY
 This tutorial will guide you through the steps needed to install and run
 Teleport (=teleport.version=) on Linux machines.
 
-<Details scopeOnly={true} scope={["cloud"]} title="Teleport Cloud">
-This guide deploys the Teleport Auth Service and Proxy Service, which are fully managed in Teleport Cloud. If you are a Teleport Cloud customer, we recommend following our guides for deploying specific services on your Teleport Nodes. Here are some examples:
-
-- [Application Access](../application-access/getting-started.mdx)
-- [Database Access](../database-access/getting-started.mdx)
-- [Server Access](../server-access/getting-started.mdx)
-</Details>
-
 ## Prerequisites
 
 - A Linux machine with a port `443` open
@@ -37,21 +29,38 @@ Take a look at the [Installation Guide](../installation.mdx) for more options.
 (!docs/pages/includes/permission-warning.mdx!)
 
 ### Configure DNS
-Teleport uses TLS to provide secure access to its Proxy Service and Auth Service, and this requires a domain name that clients can use to verify Teleport's certificate.
 
-(!docs/pages/includes/dns.mdx!)
+Teleport uses TLS to provide secure access to its Proxy Service and Auth Service, and this requires a domain name that clients can use to verify Teleport's certificate. To get started, set up two `A` records for `tele.example.com` and `*.tele.example.com` pointing to the IP/FQDN of the machine with Teleport installed.
 
-### Configure Teleport
+<Admonition
+  type="tip"
+  title="Tip"
+>
+  You can use `dig` to make sure that DNS records are propagated:
+
+  ```code
+  $ dig @$DNS_SERVER_ADDRESS tele.example.com
+  ```
+</Admonition>
 
-Generate a configuration file for Teleport using the `teleport configure` command.
-This command requires information about a TLS certificate and private key.
+### Configure Teleport
 
-If you are running Teleport on the internet, we recommend using Let's Encrypt to receive your key and certificate automatically.
-For private net or custom deployments, use your own private key and certificate.
+Next, generate a configuration file for Teleport using the `teleport configure` command. This command requires information about a TLS certificate and private key. If your environment allows your Teleport Auth Server to be reachable via the public internet, we recommend using Let's Encrypt to generate your key and certificate automatically. Otherwise, you can use a key and certificate provided via your organization's internal public key infrastructure.
 
 <Tabs>
   <TabItem label="Public internet deployment with Let's Encrypt">
-  (!docs/pages/includes/acme.mdx!)
+  Teleport uses the ACME protocol to request automatic TLS certificates from Let's Encrypt, which accesses an HTTP endpoint on your Teleport host in order to complete authentication challenges.
+
+  Use the following command to configure Teleport:
+
+  ```code
+  $ sudo teleport configure --acme --acme-email=your-email@example.com --cluster-name=tele.example.com -o file
+  # Wrote config to file "/etc/teleport.yaml". Now you can start the server. Happy Teleporting!
+  ```
+
+  The `--acme-email` flag indicates an email address that Let's Encrypt can use for notifications, and does *not* require the same domain name as your Teleport host. 
+  
+  For the `--cluster-name` flag, enter the domain name you used when creating a DNS A record earlier.
 
   </TabItem>
 
@@ -187,7 +196,7 @@ Here are several common commands and operations you'll likely find useful:
 $ tsh status
 ```
 
-### SSH into a Node
+### SSH into a node
 
 ```code
 # list all SSH servers connected to Teleport
@@ -197,7 +206,7 @@ $ tsh ls
 $ tsh ssh root@node-name
 ```
 
-### Add a Node to the cluster
+### Add a node to the cluster
 
 Generate a short-lived dynamic join token using `tctl`:
 
@@ -205,7 +214,7 @@ Generate a short-lived dynamic join token using `tctl`:
 $ tctl tokens add --type=node
 ```
 
-Bootstrap a new Node:
+Bootstrap a new node:
 
 <Tabs>
   <TabItem label="teleport start">
@@ -268,7 +277,7 @@ Add a new application:
 
 <Tabs>
   <TabItem label="teleport start">
-    Install Teleport on the target Node, then start it using a command as shown below.
+    Install Teleport on the target node, then start it using a command as shown below.
     Review and update `auth-server`, `token`, `app-name`, and `app-uri` before running this command.
 
     ```code
diff --git a/docs/pages/includes/acme.mdx b/docs/pages/includes/acme.mdx
deleted file mode 100644
index 1f797f8594660..0000000000000
--- a/docs/pages/includes/acme.mdx
+++ /dev/null
@@ -1,29 +0,0 @@
-Let's Encrypt verifies that you control the domain name of your Teleport cluster
-by communicating with the HTTPS server listening on port 443 of your Teleport
-Proxy Service.
-
-You can configure the Teleport Proxy Service to complete the Let's Encrypt
-verification process when it starts up.
-
-Run the following `teleport configure` command, where `tele.example.com` is the
-domain name of your Teleport cluster and `user@example.com` is an email address
-used for notifications (you can use any domain):
-
-```code
-teleport configure --acme --acme-email=user@example.com --cluster-name=tele.example.com > /etc/teleport.yaml
-```
-
-The `--acme`, `--acme-email`, and `--cluster-name` flags will add the following
-settings to your Teleport configuration file:
-
-```yaml
-proxy_service:
-  enabled: "yes"
-  web_listen_addr: :443
-  public_addr: tele.example.com:443
-  acme:
-    enabled: "yes"
-    email: user@example.com
-```
-
-Port 443 on your Teleport Proxy Service host must allow traffic from all sources.
diff --git a/docs/pages/includes/database-access/aws-bootstrap.mdx b/docs/pages/includes/database-access/aws-bootstrap.mdx
deleted file mode 100644
index d055f3abc1648..0000000000000
--- a/docs/pages/includes/database-access/aws-bootstrap.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
-Teleport can bootstrap IAM permissions for the Database Service based on its
-configuration using the `teleport db configure bootstrap` command. You can use
-this command in automatic or manual mode:
-- In automatic mode, Teleport will attempt to create appropriate IAM policies
-  and attach them to the specified IAM identity (user or role). This requires
-  IAM permissions to create and attach IAM policies.
-- In manual mode, Teleport will print required IAM policies. You can then create
-  and attach them manually using the AWS management console.
-
-<Admonition type="note" title="AWS credentials">
-  AWS Credentials are only required if you’re running the command in "automatic"
-  mode. The command uses the default credential provider chain to find AWS
-  credentials. See [Specifying Credentials](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials) for more information.
-</Admonition>
-
-<Tabs>
-  <TabItem label="Automatic / IAM User">
-  Use this command to bootstrap the permissions automatically when
-  your Teleport database agent runs as an IAM user (for example, uses an AWS
-  credentials file).
-
-  ```code
-  $ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-user TeleportUser
-  ```
-  </TabItem>
-
-  <TabItem label="Automatic / IAM Role">
-  Use this command to bootstrap the permissions automatically when
-  your Teleport database agent runs as an IAM role (for example, on an EC2
-  instance with an attached IAM role).
-
-  ```code
-  $ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-role TeleportRole
-  ```
-  </TabItem>
-
-  <TabItem label="Manual">
-  Use this command to display required IAM policies which you will then create in your AWS console:
-
-  ```code
-  $ teleport db configure bootstrap -c /etc/teleport.yaml --manual
-  ```
-  </TabItem>
-</Tabs>
-
-See the full `bootstrap` command
-[reference](../../database-access/reference/cli.mdx#teleport-db-configure-bootstrap).
diff --git a/docs/pages/includes/database-access/database-config.yaml b/docs/pages/includes/database-access/database-config.yaml
index b913fa2f0d22a..65587c4d0ea53 100644
--- a/docs/pages/includes/database-access/database-config.yaml
+++ b/docs/pages/includes/database-access/database-config.yaml
@@ -27,7 +27,7 @@ db_service:
     # Free-form description of the database proxy instance.
     description: "Production database"
 
-    # Database protocol. Can be: "postgres", "mysql", "mongodb", "cockroachdb", "sqlserver", or "redis".
+    # Database protocol. Can be: "postgres", "mysql", "mongodb", "cockroachdb", "sqlserver".
     protocol: "postgres"
 
     # Database connection endpoint. Must be reachable from Database Service.
diff --git a/docs/pages/includes/database-access/guides-next-steps.mdx b/docs/pages/includes/database-access/guides-next-steps.mdx
index d6c61171bb83b..08a15db2a8e8a 100644
--- a/docs/pages/includes/database-access/guides-next-steps.mdx
+++ b/docs/pages/includes/database-access/guides-next-steps.mdx
@@ -1,4 +1,3 @@
 - Learn how to [restrict access](../../database-access/rbac.mdx) to certain users and databases.
 - View [High Availability (HA)](../../database-access/guides/ha.mdx) guide.
 - Take a look at YAML configuration [reference](../../database-access/reference/configuration.mdx).
-- See the full CLI [reference](../../database-access/reference/cli.mdx).
diff --git a/docs/pages/includes/database-access/guides.mdx b/docs/pages/includes/database-access/guides.mdx
index f864801411333..cdb6296b8bec5 100644
--- a/docs/pages/includes/database-access/guides.mdx
+++ b/docs/pages/includes/database-access/guides.mdx
@@ -31,9 +31,6 @@
   <Tile icon="database" title="Self-hosted CockroachDB" href="./guides/cockroachdb-self-hosted.mdx">
     Connect self-hosted CockroachDB database.
   </Tile>
-  <Tile icon="database" title="Self-hosted Redis" href="./guides/redis.mdx">
-    Connect self-hosted Redis.
-  </Tile>
   <Tile icon="database" title="Active Directory SQL Server (Preview)" href="./guides/sql-server-ad.mdx">
     Connect Microsoft SQL Server with Active Directory authentication.
   </Tile>
diff --git a/docs/pages/includes/database-access/start-auth-proxy.mdx b/docs/pages/includes/database-access/start-auth-proxy.mdx
index ef35caca0f0bb..c9492a4a29472 100644
--- a/docs/pages/includes/database-access/start-auth-proxy.mdx
+++ b/docs/pages/includes/database-access/start-auth-proxy.mdx
@@ -1,41 +1,29 @@
 <Tabs> 
-<TabItem scope={["oss","enterprise"]} label="Self-Hosted">
-Download the latest version of Teleport for your platform from our
-[downloads page](https://goteleport.com/teleport/download) and follow the
-installation [instructions](../../installation.mdx).
-
+<TabItem scope={["oss","enterprise"]} label="Self Hosted">
 Teleport requires a valid TLS certificate to operate and can fetch one
 automatically using Let's Encrypt's ACME protocol. Before Let's Encrypt can
 issue a TLS certificate for the Teleport Proxy host's domain, the ACME protocol
 must verify that an HTTPS server is reachable on port 443 of the host.  
 
-You can configure the Teleport Proxy service to complete the Let's Encrypt
-verification process when it starts up.
+We will assume that you have configured DNS records for `teleport.example.com`
+and `*.teleport.example.com` to point to your Teleport node.
 
-Run the following `teleport configure` command, where `tele.example.com` is the
-domain name of your Teleport cluster and `user@example.com` is an email address
-used for notifications (you can use any domain):
+<Admonition type="note" title="Web Proxy Port">
+To support the ACME protocol, Teleport Proxy must listen on port 443, rather
+than the default port 3080.
+</Admonition>
 
-```code
-teleport configure --acme --acme-email=user@example.com --cluster-name=tele.example.com > /etc/teleport.yaml
-```
+Download the latest version of Teleport for your platform from our
+[downloads page](https://goteleport.com/teleport/download) and follow the
+installation [instructions](../../installation.mdx).
 
-The `--acme`, `--acme-email`, and `--cluster-name` flags will add the following
-settings to your Teleport configuration file:
-
-```yaml
-proxy_service:
-  enabled: "yes"
-  web_listen_addr: :443
-  public_addr: tele.example.com:443
-  acme:
-    enabled: "yes"
-    email: user@example.com
-```
+Generate a Teleport configuration file with ACME enabled:
 
-Port 443 on your Teleport Proxy Service host must allow traffic from all sources.
+```code
+$ teleport configure --cluster-name=teleport.example.com --acme --acme-email=alice@example.com -o file
+```
 
-Next, start the Teleport Auth and Proxy Services:
+Start the Teleport Auth and Proxy services:
 
 ```code
 $ sudo teleport start
diff --git a/docs/pages/includes/dns-app-access.mdx b/docs/pages/includes/dns-app-access.mdx
deleted file mode 100644
index 2e82bf6d8f64b..0000000000000
--- a/docs/pages/includes/dns-app-access.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-Teleport assigns a subdomain to each application you have configured for Application
-Access (e.g., `grafana.teleport.example.com`), so you will need to ensure that a DNS A record exists for each application-specific subdomain so clients can access your applications via Teleport. 
-
-You should create either a separate DNS A record for each subdomain or a single record with a wildcard subdomain such as `*.teleport.example.com`. This way, your certificate authority (e.g., Let's Encrypt) can issue a certificate for each subdomain, enabling clients to verify your Teleport hosts regardless of the application they are accessing.
diff --git a/docs/pages/includes/dns.mdx b/docs/pages/includes/dns.mdx
deleted file mode 100644
index cc2ebd938b822..0000000000000
--- a/docs/pages/includes/dns.mdx
+++ /dev/null
@@ -1,59 +0,0 @@
-Set up two `A` DNS records: `tele.example.com` for all traffic and `*.tele.example.com`
-for web apps using Application Access.
-
-<Details opened={false} title="Why are we using wildcard subdomains for Application Access?">
-(!docs/pages/includes/dns-app-access.mdx!)
-</Details>
-
-<Details title="DNS instructions for cloud providers" opened={false}>
-
-<Tabs>
-    <TabItem label="AWS Route 53">
-    ```code
-    # Tip for finding AWS zone id by the domain name.
-    $ MYZONE_DNS="example.com"
-    $ MYZONE=$(aws route53 list-hosted-zones-by-name --dns-name=${MYZONE_DNS?} | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)
-
-    $ MYDNS="tele.example.com"
-
-    # Create a JSON file changeset for AWS.
-    $ jq -n --arg ip ${MYIP?} --arg dns ${MYDNS?} '{"Comment": "Create records", "Changes": [{"Action": "CREATE","ResourceRecordSet": {"Name": $dns, "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}},{"Action": "CREATE", "ResourceRecordSet": {"Name": ("*." + $dns), "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}}]}' > myrecords.json
-
-    # Review records before applying.
-    $ cat myrecords.json | jq
-    # Apply the records and capture change id
-    $ CHANGEID=$(aws route53 change-resource-record-sets --hosted-zone-id ${MYZONE?} --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')
-
-    # Verify that change has been applied
-    $ aws route53 get-change --id ${CHANGEID?} | jq '.ChangeInfo.Status'
-    # "INSYNC"
-    ```
-  </TabItem>
-  <TabItem label="GCP Cloud DNS">
-    ```code
-    $ MYZONE="myzone"
-    $ MYDNS="tele.example.com"
-
-    $ gcloud dns record-sets transaction start --zone="${MYZONE?}"
-    $ gcloud dns record-sets transaction add ${MYIP?} --name="${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
-    $ gcloud dns record-sets transaction add ${MYIP?} --name="*.${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
-    $ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
-    $ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
-    ```
-  </TabItem>
-
-
-</Tabs>
-
-</Details>
-
-<Admonition
-  type="tip"
-  title="Tip"
->
-  You can use `dig` to make sure that DNS records are propagated:
-
-  ```code
-  $ dig tele.example.com
-  ```
-</Admonition>
diff --git a/docs/pages/includes/enterprise/oidcauthentication.mdx b/docs/pages/includes/enterprise/oidcauthentication.mdx
deleted file mode 100644
index 282b8e214d7e5..0000000000000
--- a/docs/pages/includes/enterprise/oidcauthentication.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
-## Enable default OIDC authentication
-
-Configure Teleport to use OIDC authentication as the default instead of the local
-user database. You can use Dynamic Resources for Teleport Cloud as well as self-hosted deployments.
-
-<Tabs>
-  <TabItem label="Static Config (Self-Hosted)">
- Update `/etc/teleport.yaml` in the `auth_service` section and restart the `teleport` daemon.
-  ```yaml
-  auth_service:
-    authentication:
-      type: oidc
-
-  ```
-  </TabItem>
-  <TabItem scope={["cloud"]} label="Dynamic Resources (All Editions)">
-  Create a file called `cap.yaml`:
-  ```yaml
-  kind: cluster_auth_preference
-  metadata:
-    name: cluster-auth-preference
-  spec:
-    authentication:
-      type: oidc
-  version: v2
-  ```
-
-  Create a resource:
-
-  ```bash
-  $ tctl create -f cap.yaml
-  ```
-  </TabItem>
-</Tabs>
diff --git a/docs/pages/includes/enterprise/samlauthentication.mdx b/docs/pages/includes/enterprise/samlauthentication.mdx
deleted file mode 100644
index eef0f8775e3ea..0000000000000
--- a/docs/pages/includes/enterprise/samlauthentication.mdx
+++ /dev/null
@@ -1,33 +0,0 @@
-## Enable default SAML authentication
-
-Configure Teleport to use SAML authentication as the default instead of the local
-user database. You can use Dynamic Resources for Teleport Cloud as well as self-hosted deployments.
-
-<Tabs>
-  <TabItem label="Static Config (Self-Hosted)">
- Update `/etc/teleport.yaml` in the `auth_service` section and restart the `teleport` daemon.
-  ```yaml
-  auth_service:
-    authentication:
-      type: saml
-  ```
-  </TabItem>
-  <TabItem scope={["cloud"]} label="Dynamic Resources (All Editions)">
-  Create a file called `cap.yaml`:
-  ```yaml
-  kind: cluster_auth_preference
-  metadata:
-    name: cluster-auth-preference
-  spec:
-    authentication:
-      type: saml
-  version: v2
-  ```
-
-  Create a resource:
-
-  ```bash
-  $ tctl create -f cap.yaml
-  ```
-  </TabItem>
-</Tabs>
diff --git a/docs/pages/includes/helm.mdx b/docs/pages/includes/helm.mdx
index aeed999ef7ed8..6c103c579d020 100644
--- a/docs/pages/includes/helm.mdx
+++ b/docs/pages/includes/helm.mdx
@@ -1,4 +1,4 @@
-Verify that Helm and Kubernetes are installed and up to date.
+Verify that helm and kubernetes are installed and up to date.
 
 ```code
 $ helm version
diff --git a/docs/pages/includes/kubernetes-access/helm-k8s.mdx b/docs/pages/includes/kubernetes-access/helm-k8s.mdx
index cae613839c75f..4a46640ed007c 100644
--- a/docs/pages/includes/kubernetes-access/helm-k8s.mdx
+++ b/docs/pages/includes/kubernetes-access/helm-k8s.mdx
@@ -1,7 +1,7 @@
 - [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
 - [Helm](https://helm.sh) >= (=helm.version=)
 
-Verify that Helm and Kubernetes are installed and up to date.
+Verify that helm and kubernetes are installed and up to date.
 
 ```code
 $ helm version
diff --git a/docs/pages/includes/plugins/identity-export.mdx b/docs/pages/includes/plugins/identity-export.mdx
deleted file mode 100644
index 4e4aa5a6035f3..0000000000000
--- a/docs/pages/includes/plugins/identity-export.mdx
+++ /dev/null
@@ -1,29 +0,0 @@
-Teleport's plugins use the `access-plugin` role and user to approve access requests. We export the identity files to this plugin using [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign).
-
-<Tabs>
-  <TabItem label="Self-Hosted" scope={["oss","enterprise"]}>
-```code
-$ tctl auth sign --format=tls --user=access-plugin --out=auth --ttl=2190h
-# ...
-```
-
-The above sequence should result in three PEM encoded files being generated: `auth.crt`, `auth.key`, and `auth.cas` (certificate, private key, and CA certs respectively).
-</TabItem>
-  <TabItem label="Cloud" scope={["cloud"]}>
-```code
-$ tctl auth sign --user=access-plugin --out=auth.pem --ttl=2190h
-# ...
-```
-
-The above sequence should result in one PEM encoded file: `auth.pem`.
-
-  </TabItem>
-
-</Tabs>
-
-<Admonition
-  type="note"
-  title="Certificate Lifetime"
->
-  By default, [`tctl auth sign`](../../setup/reference/cli.mdx#tctl-auth-sign) produces certificates with a relatively short lifetime. For production deployments, the `--ttl` flag can be used to ensure a more practical certificate lifetime. `--ttl=8760h` exports a 1 year token
-</Admonition>
\ No newline at end of file
diff --git a/docs/pages/includes/plugins/rbac.mdx b/docs/pages/includes/plugins/rbac.mdx
deleted file mode 100644
index a620900449241..0000000000000
--- a/docs/pages/includes/plugins/rbac.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
-Using an existing Teleport cluster, create the following `user` and `role` resources with the command below, replacing `YAML_PATH` with the path to each resource spec.
-
-```
-$ tctl create -f YAML_PATH.yaml
-```
-
-<Details opened={true} 
-  scopeOnly={true}
-  scope={["cloud"]}
->
-Teleport Cloud requires authenticating with a role that has [`impersonation`](https://goteleport.com/docs/access-controls/guides/impersonation/) rights and can create the `access-plugin` role and user. Log in with `tsh` with a user that has this role or has a role with these `allow` rules.
-
-```
-kind: role
-version: v4
-metadata:
-  name: plugin-admin
-spec:
-  allow:
-    impersonate:
-      roles:
-      - access-plugin
-      users:
-      - access-plugin
-    rules:
-      - resources: ['roles']
-        verbs: ['create','update','read','list','delete']
-      - resources: ['user']
-        verbs: ['create','update','read','list','delete']
-
-```
-</Details>
-
-
-Create a non-interactive bot `access-plugin` user and role.
-
-```yaml
-kind: user
-metadata:
-  name: access-plugin
-spec:
-  roles: ['access-plugin']
-version: v2
----
-kind: role
-version: v4
-metadata:
-  name: access-plugin
-spec:
-  allow:
-    rules:
-      - resources: ['access_request']
-        verbs: ['list', 'read']
-      - resources: ['access_plugin_data']
-        verbs: ['update']
-```
-
-<Admonition type="tip">
-  If you're using other plugins, you might want to create different users and roles for different plugins
-</Admonition>
\ No newline at end of file
diff --git a/docs/pages/includes/tctl.mdx b/docs/pages/includes/tctl.mdx
index ba0441b0d38ef..8c8453205c755 100644
--- a/docs/pages/includes/tctl.mdx
+++ b/docs/pages/includes/tctl.mdx
@@ -1,35 +1,22 @@
-<Details 
-title="Make sure you can connect to Teleport" 
-scope={["oss", "enterprise"]} 
-scopeOnly={true}
-opened={true}
->
+<Details title="Before you begin: verify connectivity" opened={false}>
 
-Verify that your Teleport client is connected by running the following on your
-Auth Service host:
+Verify that your Teleport client is connected:
 
 ```code
 $ tctl status
+
 # Cluster  tele.example.com
 # Version  (=teleport.version=)
 # CA pin   sha256:sha-hash-here
 ```
-</Details>
-<Details 
-title="Make sure you can connect to Teleport" 
-scope={["cloud"]}
-scopeOnly={true}
-opened={true}
->
 
-To connect to Teleport, log in to your cluster using `tsh`, then use `tctl`
-remotely:
+<Notice title="Connecting to the cloud" type="note" scope={["cloud"]}>
+To try this flow in the cloud, login into your cluster using `tsh`, then use `tctl` remotely:
 
 ```code
-$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
+$ tsh login --proxy=myinstance.teleport.sh
 $ tctl status
-# Cluster  myinstance.teleport.sh
-# Version  (=teleport.version=)
-# CA pin   sha256:sha-hash-here
 ```
+</Notice>
+
 </Details>
diff --git a/docs/pages/index.mdx b/docs/pages/index.mdx
index 629dee1ca40ce..e579c391413ab 100644
--- a/docs/pages/index.mdx
+++ b/docs/pages/index.mdx
@@ -10,7 +10,7 @@ videoBanner: 0HlyGk8dihM
 
 Teleport is a Certificate Authority and an Access Plane for your infrastructure. With Teleport you can:
 
-- Set up Single Sign-On and have one place to access your SSH servers, Kubernetes, Databases, Desktops, and Web Apps.
+- Set up Single Sign-On and have one place to access your SSH servers, Kubernetes, Databases, and Web Apps.
 - Use your favorite programming language to define access policies to your infrastructure.
 - Share and record interactive sessions across all environments.
 
@@ -61,7 +61,7 @@ Teleport is a Certificate Authority and an Access Plane for your infrastructure.
       Replace static keys and passwords with short-lived certificates.
     </TileListItem>
     <TileListItem href="./setup/reference/cli.mdx#tsh-play">
-     Gather structured events and session recording/replay for `ssh`, `kubectl` and desktop interactions.
+     Gather structured events and session recording/replay for `ssh` and `kubectl`.
      </TileListItem>
     <TileListItem href="./access-controls/guides/webauthn.mdx">
      Enforce two-factor auth with WebAuthn or TOTP.
diff --git a/docs/pages/installation.mdx b/docs/pages/installation.mdx
index ffb1799e12da0..e8af47936d980 100644
--- a/docs/pages/installation.mdx
+++ b/docs/pages/installation.mdx
@@ -6,11 +6,6 @@ h1: Installation
 
 Teleport core service [`teleport`](./setup/reference/cli.mdx#teleport) and admin tool [`tctl`](./setup/reference/cli.mdx#tctl) have been designed to run on **Linux** and **Mac** operating systems. The Teleport user client [`tsh`](./setup/reference/cli.mdx#tsh) and UI are available for **Linux, Mac**, and **Windows** operating systems.
 
-<Admonition type="tip" title="First time trying Teleport?">
-If you are new to Teleport, we recommend following our [getting started guides](getting-started.mdx).
-</Admonition>
-
-
 ## Linux
 
 The following examples install the 64-bit version of Teleport binaries, but
@@ -181,11 +176,3 @@ any OS supported by the [Golang toolchain](https://github.com/golang/go/wiki/Min
 
 \[2] *Teleport server does not run on Windows yet, but `tsh` (the Teleport client)
 supports most features on Windows 10 and later.*
-
-## Next steps
-
-Now that you know how to install Teleport, you can enable access to all of your infrastructure. Get started with:
-- [Server Access](server-access/introduction.mdx)
-- [Kubernetes Access](kubernetes-access/introduction.mdx)
-- [Database Access](database-access/introduction.mdx)
-- [Desktop Access](desktop-access/introduction.mdx)
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/controls.mdx b/docs/pages/kubernetes-access/controls.mdx
index 25655b2f53a2a..e54f38de256d3 100644
--- a/docs/pages/kubernetes-access/controls.mdx
+++ b/docs/pages/kubernetes-access/controls.mdx
@@ -88,7 +88,7 @@ Enterprise Edition:
 Identity provider admins can assign metadata to a user, such as
 group membership or access permissions. Administrators configure what metadata
 is shared with Teleport. Teleport receives user metadata keys and values as OIDC claims or SAML
-attributes during [single sign-on redirect flow](https://goteleport.com/blog/how-oidc-authentication-works/):
+attributes during [signle sign-on redirect flow](https://goteleport.com/blog/how-oidc-authentication-works/):
 
 ```yaml
 # Alice has an email alice@example.com. Email is a standard OIDC claim.
diff --git a/docs/pages/kubernetes-access/getting-started/agent.mdx b/docs/pages/kubernetes-access/getting-started/agent.mdx
index f76f99cc6b20f..d517cffbc1c74 100644
--- a/docs/pages/kubernetes-access/getting-started/agent.mdx
+++ b/docs/pages/kubernetes-access/getting-started/agent.mdx
@@ -3,86 +3,35 @@ title: Connect a Kubernetes Cluster to Teleport
 description: Connecting a Kubernetes cluster to Teleport
 ---
 
-## Prerequisites
-
-<Tabs>
-<TabItem scope={["oss"]} label="Open Source">
-
-- A running Teleport cluster. For details on how to set this up, see one of our
-  [Getting Started](../../getting-started.mdx) guides. 
-
-- The `jq` tool to process `JSON` output. This is available via common package managers.
-
-- The `tctl` admin tool version >= (=teleport.version=).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  See [Installation](../../installation.mdx) for details.
-
-  (!docs/pages/includes/tctl.mdx!)
-
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-
-- A running Teleport cluster. For details on how to set this up, see one of our
-  [Getting Started](../../getting-started.mdx) guides.
-
-- The `jq` tool to process `JSON` output. This is available via common package managers.
-
-- The `tctl` admin tool version >= (=teleport.version=), which you can download
-  by visiting the
-  [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport Enterprise v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  (!docs/pages/includes/tctl.mdx!)
-
-</TabItem>
-<TabItem scope={["cloud"]}
-  label="Teleport Cloud">
-
-- A Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
-
-- The `jq` tool to process `JSON` output. This is available via common package
-  managers.
-
-- The Enterprise version of the `tctl` admin tool. To download this, visit
-the [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
+<Admonition type="notice" title="Editions">
+You can use this guide with Teleport Open Source, Teleport Enterprise, and Teleport Cloud.
+</Admonition>
 
-  (!docs/pages/includes/tctl.mdx!)
+## Prerequisites
 
-</TabItem>
-</Tabs>
+- Installed and running Teleport cluster, self-hosted or cloud-hosted.
+- Tool `jq` to process `JSON` output.
 
 
 (!docs/pages/includes/kubernetes-access/helm-k8s.mdx!)
 
 (!docs/pages/includes/tctl.mdx!)
 
-## Deployment overview
-
-In this guide, we deploy the Teleport Kubernetes Service, which connects
-Kubernetes cluster `cookie` to Teleport cluster `tele.example.com`:
+<Admonition type="notice" title="Enable Kubernetes for Self-Hosted">
+For self-hosted Teleport instances the `kube_listen_addr` setting in the `proxy_service` is required to enable Kubernetes Access.  This is already enabled for Cloud and the Teleport `teleport-cluster` helm chart.
+```yaml
+proxy_service:
+  # ...
+  public_addr: proxy.example.com:3080
 
-<Notice type="tip" scope={["cloud"]}>
+  kube_listen_addr: 0.0.0.0:3026  
+  ```  
+</Admonition>
 
-In your Teleport Cloud account, the name of your cluster will be your tenant
-domain name, e.g., `mytenant.teleport.sh`, rather than `teleport.example.com`.
+## Deployment overview
 
-</Notice>
+In this guide, we deploy a Teleport agent that connects kubernetes cluster `cookie` to
+Teleport cluster `tele.example.com`:
 
 <Figure align="left" bordered caption="Kubernetes agent dialing back to Teleport cluster">
   ![Kubernetes agent](../../../img/k8s/agent.svg)
@@ -90,58 +39,31 @@ domain name, e.g., `mytenant.teleport.sh`, rather than `teleport.example.com`.
 
 ## Step 1/2. Get a join token
 
-In order to start the Teleport Kubernetes Service, we will need to request a
-join token from the Teleport Auth Service:
+Start a lightweight agent in your Kubernetes cluster `cookie` and connect it to `tele.example.com`.
+We would need a join token from `tele.example.com`:
 
 ```code
-# Create a join token for the Teleport Kubernetes Service to authenticate
+# Create a join token for the cluster cookie to authenticate
 $ TOKEN=$(tctl nodes add --roles=kube --ttl=10000h --format=json | jq -r '.[0]')
 $ echo $TOKEN
 ```
 
 ## Step 2/2. Deploy teleport-kube-agent
 
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-Switch `kubectl` to the Kubernetes cluster `cookie` and run the following
-commands, assigning `PROXY_ADDR` to the address of your Auth Service or Proxy
-Service.
-
-```code
-# Add teleport-agent chart to charts repository
-$ PROXY_ADDR=tele.example.com:443
-$ helm repo add teleport https://charts.releases.teleport.dev
-$ helm repo update
-
-# Install Kubernetes agent. It dials back to the Teleport cluster at $PROXY_ADDR
-$ CLUSTER='cookie'
-$ helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=${CLUSTER?} \
-  --set proxyAddr=${PROXY_ADDR?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
-```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
-
-Switch `kubectl` to the Kubernetes cluster `cookie` and run the following
-commands, assigning `PROXY_ADDR` to the address of your Teleport Cloud tenant.
+Switch `kubectl` to the Kubernetes cluster `cookie` and run:
 
 ```code
 # Add teleport-agent chart to charts repository
-$ PROXY_ADDR=mytenant.teleport.sh
 $ helm repo add teleport https://charts.releases.teleport.dev
 $ helm repo update
 
-# Install Kubernetes agent. It dials back to the Teleport cluster at $PROXY_ADDR
+# Install Kubernetes agent. It dials back to the Teleport cluster tele.example.com.
 $ CLUSTER='cookie'
+$ PROXY='tele.example.com:443 - replace me with your cluster'
 $ helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=${CLUSTER?} \
-  --set proxyAddr=${PROXY_ADDR?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
+  --set proxyAddr=${PROXY?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
 ```
 
-</TabItem>
-</Tabs>
-
 List connected clusters using `tsh kube ls` and switch between
 them using `tsh kube login`:
 
@@ -156,10 +78,10 @@ $ tsh kube ls
 $ tsh kube login cookie
 # Logged into kubernetes cluster "cookie"
 
-# kubectl command executed on `cookie` but is routed through the Teleport cluster.
+# kubectl command executed on `cookie` but is routed through `tele.example.com` cluster.
 $ kubectl get pods
 ```
 
 ## Next Steps
 
-- Take a look at a [kube-agent helm chart reference](../helm/reference/teleport-kube-agent.mdx) for a full list of parameters.
+- Take a look at a [kube-agent helm chart reference](../helm/reference.mdx#teleport-kube-agent) for a full list of parameters.
diff --git a/docs/pages/kubernetes-access/getting-started/cluster.mdx b/docs/pages/kubernetes-access/getting-started/cluster.mdx
index f75e7e9764118..b73d91f7f236d 100644
--- a/docs/pages/kubernetes-access/getting-started/cluster.mdx
+++ b/docs/pages/kubernetes-access/getting-started/cluster.mdx
@@ -66,7 +66,7 @@ Let's start with a single-pod Teleport deployment using a persistent volume as a
     ```
   </TabItem>
 
-  <TabItem label="Enterprise" scope={["enterprise"]}>
+  <TabItem label="Enterprise">
     ```code
     $ CLUSTER_NAME="tele.example.com"
     $ EMAIL="mail@example.com"
@@ -115,7 +115,7 @@ to create a public IP for Teleport.
     ```
   </TabItem>
 
-  <TabItem label="Enterprise" scope={["enterprise"]}>
+  <TabItem label="Enterprise">
     ```code
     # Set kubectl context to the namespace to set some typing
     $ kubectl config set-context --current --namespace=teleport-cluster-ent
@@ -139,7 +139,45 @@ to create a public IP for Teleport.
   </TabItem>
 </Tabs>
 
-(!docs/pages/includes/dns.mdx!)
+Set up two `A` DNS records - `tele.example.com` for UI and `*.tele.example.com`
+for web apps using [application access](../../application-access/introduction.mdx).
+
+<Tabs>
+  <TabItem label="GCP Cloud DNS">
+    ```code
+    $ MYZONE="myzone"
+    $ MYDNS="tele.example.com"
+
+    $ gcloud dns record-sets transaction start --zone="${MYZONE?}"
+    $ gcloud dns record-sets transaction add ${MYIP?} --name="${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
+    $ gcloud dns record-sets transaction add ${MYIP?} --name="*.${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
+    $ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
+    $ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
+    ```
+  </TabItem>
+
+  <TabItem label="AWS Route 53">
+    ```code
+    # Tip for finding AWS zone id by the domain name.
+    $ MYZONE_DNS="example.com"
+    $ MYZONE=$(aws route53 list-hosted-zones-by-name --dns-name=${MYZONE_DNS?} | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)
+
+    $ MYDNS="tele.example.com"
+
+    # Create a JSON file changeset for AWS.
+    $ jq -n --arg ip ${MYIP?} --arg dns ${MYDNS?} '{"Comment": "Create records", "Changes": [{"Action": "CREATE","ResourceRecordSet": {"Name": $dns, "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}},{"Action": "CREATE", "ResourceRecordSet": {"Name": ("*." + $dns), "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}}]}' > myrecords.json
+
+    # Review records before applying.
+    $ cat myrecords.json | jq
+    # Apply the records and capture change id
+    $ CHANGEID=$(aws route53 change-resource-record-sets --hosted-zone-id ${MYZONE?} --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')
+
+    # Verify that change has been applied
+    $ aws route53 get-change --id ${CHANGEID?} | jq '.ChangeInfo.Status'
+    # "INSYNC"
+    ```
+  </TabItem>
+</Tabs>
 
 Use the following command to confirm that Teleport is running:
 
@@ -164,8 +202,6 @@ metadata:
 spec:
   allow:
     kubernetes_groups: ["system:masters"]
-    kubernetes_labels:
-      '*': '*'
 ```
 
 Create the role and add a user:
@@ -201,7 +237,7 @@ For other install options, check out [install guide](../../installation.mdx)
     ```
   </TabItem>
 
-  <TabItem label="Enterprise" scope={["enterprise"]}>
+  <TabItem label="Enterprise">
     ```code
     $ curl -L -O https://get.gravitational.com/teleport-ent-v(=teleport.version=)-linux-amd64-bin.tar.gz
     $ tar -xzf teleport-ent-v(=teleport.version=)-linux-amd64-bin.tar.gz
@@ -270,7 +306,7 @@ In this step, we will set up the GitHub Single Sign-On connector for the OSS ver
     ```
   </TabItem>
 
-  <TabItem label="Enterprise" scope={["enterprise"]}>
+  <TabItem label="Enterprise">
     Follow the [SAML Okta Guide](../../enterprise/sso/okta.mdx#configure-okta) to create a SAML app.
     Check out [OIDC guides](../../enterprise/sso/oidc.mdx#identity-providers) for OpenID Connect apps.
     Save the file below as `okta.yaml` and update the `acs` field.
@@ -305,7 +341,7 @@ To create a connector, we are going to run Teleport's admin tool `tctl` from the
     ```
   </TabItem>
 
-  <TabItem label="Enterprise"  scope={["enterprise"]}>
+  <TabItem label="Enterprise">
     ```code
     # To create an Okta connector, we are going to run Teleport's admin tool tctl from the pod.
     $ POD=$(kubectl get po -l app=teleport-cluster-ent -o jsonpath='{.items[0].metadata.name}')
@@ -326,7 +362,7 @@ the default one in case there is a problem.
     ```
   </TabItem>
 
-  <TabItem label="Enterprise" scope={["enterprise"]}>
+  <TabItem label="Enterprise">
     ```code
     $ KUBECONFIG=${HOME?}/teleport.yaml tsh login --proxy=tele.example.com --auth=okta
     ```
diff --git a/docs/pages/kubernetes-access/guides.mdx b/docs/pages/kubernetes-access/guides.mdx
index c28ec8d4ef363..6c47b0cced1db 100644
--- a/docs/pages/kubernetes-access/guides.mdx
+++ b/docs/pages/kubernetes-access/guides.mdx
@@ -11,6 +11,9 @@ layout: tocless-doc
   <Tile icon="kubernetes" title="Teleport Kubernetes Access and Trusted Clusters" href="./guides/federation.mdx">
     Federated Access using Teleport Trusted Clusters.
   </Tile>
+  <Tile icon="kubernetes" title="Kubernetes Migration Guide" href="./guides/migration.mdx">
+    Kubernetes Pre-5.0 Teleport Migration Guide.
+  </Tile>
   <Tile icon="kubernetes" title="Kubernetes Access Multiple Clusters" href="./guides/multiple-clusters.mdx">
     Connecting Multiple Clusters with Teleport Kubernetes Access.
   </Tile>
diff --git a/docs/pages/kubernetes-access/guides/federation.mdx b/docs/pages/kubernetes-access/guides/federation.mdx
index 48b7bd010723d..f28e5d63019c4 100644
--- a/docs/pages/kubernetes-access/guides/federation.mdx
+++ b/docs/pages/kubernetes-access/guides/federation.mdx
@@ -1,18 +1,17 @@
 ---
-title: Federated Kubernetes access with Trusted Clusters
+title: Teleport Kubernetes Access and Trusted Clusters
 description: Federated Access using Teleport Trusted Clusters.
 ---
 
+## Federated Kubernetes access with Trusted Clusters
+
 There are cases when you have Kubernetes clusters that have to operate independently,
 for example, they are part of a different organization or have intermittent connectivity.
 
 You can take advantage of [Trusted Clusters](../../setup/admin/trustedclusters.mdx)
 to federate trust across Kubernetes clusters.
 
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-When multiple Trusted Clusters are present behind the Teleport Proxy Service, the
+When multiple trusted clusters are present behind a Teleport proxy, the
 `kubeconfig` generated by [tsh login](../../setup/reference/cli.mdx#tsh-login) will contain the
 Kubernetes API endpoint determined by the `<cluster>` argument to [tsh
 login](../../setup/reference/cli.mdx#tsh-login).
@@ -20,10 +19,10 @@ login](../../setup/reference/cli.mdx#tsh-login).
 For example, consider the following setup:
 
 - There are three Teleport/Kubernetes clusters: `main`, `east`, and `west`. These are the names set in `cluster_name` setting in their configuration files.
-- The clusters `east` and `west` are Trusted Clusters for `main`.
+- The clusters `east` and `west` are trusted clusters for `main`.
 - Users always authenticate against `main` but use their certificates to access
-  SSH nodes and the Kubernetes API in all three clusters.
-- The DNS name of the main Proxy Service is `main.example.com`.
+  SSH nodes and Kubernetes API in all three clusters.
+- The DNS name of the main proxy server is `main.example.com`
 
 In this scenario, users usually log in using this command:
 
@@ -40,37 +39,3 @@ $ tsh --proxy=main.example.com login east
 # User's `kubeconfig` now contains the entry for the "east" Kubernetes
 # endpoint, i.e. `east.main.example.com`.
 ```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
-
-When multiple Trusted Clusters are present behind the Teleport Proxy Service, the
-`kubeconfig` generated by [tsh login](../../setup/reference/cli.mdx#tsh-login) will contain the
-Kubernetes API endpoint determined by the `<cluster>` argument to [tsh
-login](../../setup/reference/cli.mdx#tsh-login).
-
-For example, consider the following setup:
-
-- There are two Teleport/Kubernetes clusters, `east` and `west`. These are the names set in `cluster_name` setting in their configuration files.
-- The clusters `east` and `west` are Trusted Clusters for a Teleport Cloud tenant, `mytenant.teleport.sh`.
-- Users always authenticate against `mytenant.teleport.sh` but use their certificates to access
-  SSH nodes and the Kubernetes API in all three clusters.
-
-In this scenario, users usually log in using this command:
-
-```code
-# Using login without arguments
-$ tsh --proxy=mytenant.teleport.sh login
-
-# User's `kubeconfig` now contains one entry for the main Kubernetes
-# endpoint, i.e. `mytenant.teleport.sh`.
-
-# Receive a certificate for "east":
-$ tsh --proxy=mytenant.teleport.sh login east
-
-# User's `kubeconfig` now contains the entry for the "east" Kubernetes
-# endpoint, i.e. `east.mytenant.teleport.sh`.
-```
-
-</TabItem>
-</Tabs>
diff --git a/docs/pages/kubernetes-access/guides/migration.mdx b/docs/pages/kubernetes-access/guides/migration.mdx
new file mode 100644
index 0000000000000..a0d41459e167f
--- /dev/null
+++ b/docs/pages/kubernetes-access/guides/migration.mdx
@@ -0,0 +1,392 @@
+---
+title: Kubernetes 5.0 Migration Guide
+description: How to migrate pre-5.0 Teleport clusters to new configuration.
+h1: Migrating to Teleport Kubernetes Access 5.0
+---
+
+In release 5.0, Teleport has changed the [Kubernetes integration](../../kubernetes-access/introduction.mdx) to improve configuration and user experience.
+These changes are backward compatible and there is no *required* migration.
+However, to get the most out of Teleport, you should consider migrating as
+described below.
+
+The main changes in 5.0 are:
+
+- New `kubernetes_service` configuration section in `teleport.yaml`, decoupled
+  from `proxy_service`
+- Support for multiple Kubernetes clusters per Teleport cluster (replaces the
+  need to use [Trusted Clusters](../../setup/admin/trustedclusters.mdx) to achieve this)
+- Role-Based Access Control (RBAC) support for Kubernetes clusters
+
+Important note: `proxy_service` with an open port for Kubernetes requests is
+still required. A proxy is always the public-facing gateway into the Teleport
+cluster, acting as an authentication point and a connection router.
+
+## Example scenarios
+
+We'll describe the migration for several common Teleport configurations.
+
+### Standalone proxy for a single cluster
+
+In this scenario, we're running a Teleport proxy outside of the Kubernetes
+cluster and connecting to it using a `kubeconfig_file`.
+
+Before 5.0:
+
+```yaml
+# teleport.yaml
+proxy_service:
+  kubernetes:
+    enabled: yes
+    listen_addr: 0.0.0.0:3026
+    kubeconfig_file: /path/to/kubeconfig
+```
+
+After 5.0:
+
+```yaml
+# teleport.yaml
+proxy_service:
+  kube_listen_addr: 0.0.0.0:3026
+
+kubernetes_service:
+  enabled: yes
+  listen_addr: 0.0.0.0:3027
+  kubeconfig_file: /path/to/kubeconfig
+```
+
+The `listen_port` for `kubernetes_service` only needs to be exposed to the
+Proxies within your cluster. This port will not be directly used by the
+clients.
+
+### Proxy in a Kubernetes pod of a single cluster
+
+In this scenario, we're running a Teleport proxy inside of the Kubernetes
+cluster and connecting to it using the pod service account credentials.
+
+Before 5.0:
+
+```yaml
+# teleport.yaml
+proxy_service:
+  kubernetes:
+    enabled: yes
+    listen_addr: 0.0.0.0:3026
+```
+
+After 5.0:
+
+```yaml
+# teleport.yaml
+proxy_service:
+  kube_listen_addr: 0.0.0.0:3026
+
+kubernetes_service:
+  enabled: yes
+  listen_addr: 0.0.0.0:3027
+```
+
+### Multiple Kubernetes clusters
+
+In this scenario, we're running multiple Trusted Teleport clusters, one for
+each Kubernetes cluster.
+
+#### Recommend Option 1: Teleport Kubernetes agents in each Kubernetes cluster
+
+This is the recommended approach for handling multiple Kubernetes clusters.
+
+Instead of running multiple Teleport clusters (auth and proxy for each
+Kubernetes cluster), we will connect multiple `kubernetes_service` agents to
+the same root Teleport cluster.
+
+Each `kubernetes_service` will create its own reverse tunnel back to a Teleport
+proxy to join the cluster.
+
+Before 5.0:
+
+```yaml
+# teleport-root.yaml
+auth_service:
+  enabled: yes
+
+proxy_service:
+  kubernetes:
+    enabled: yes
+    public_addr: [root.example.com:3026]
+    listen_addr: 0.0.0.0:3026
+
+---
+# teleport-leaf-1.yaml
+auth_service:
+  enabled: yes
+
+proxy_service:
+  kubernetes:
+    enabled: yes
+    public_addr: [leaf-1.example.com:3026]
+    listen_addr: 0.0.0.0:3026
+    # Not specifying kubeconfig_file, we'll assume that this process runs in a
+    # Kubernetes pod
+
+---
+# teleport-leaf-2.yaml
+auth_service:
+  enabled: yes
+
+proxy_service:
+  kubernetes:
+    enabled: yes
+    public_addr: [leaf-2.example.com:3026]
+    listen_addr: 0.0.0.0:3026
+    # Not specifying kubeconfig_file, we'll assume that this process runs in a
+    # Kubernetes pod
+```
+
+After 5.0:
+
+```yaml
+# teleport-root.yaml
+auth_service:
+  enabled: yes
+  tokens:
+  # This is a static token, you can also use dynamic join tokens
+  - kube:secret_static_join_token
+
+proxy_service:
+  kube_public_addr: [root.example.com]
+  kube_listen_addr: 0.0.0.0:3026
+
+---
+# teleport-kube-1.yaml
+teleport:
+  # Note: auth_servers points at the default proxy listening port.
+  auth_servers: ["https://root.example.com:3080"]
+  auth_token: secret_static_join_token
+
+auth_service:
+  enabled: no
+
+proxy_service:
+  enabled: no
+
+kubernetes_service:
+  enabled: yes
+  kube_cluster_name: kube-1
+  # Not specifying kubeconfig_file, we'll assume that this process runs in a
+  # Kubernetes pod
+
+---
+# teleport-kube-2.yaml
+teleport:
+  # Note: auth_servers points at the default proxy listening port.
+  auth_servers: ["https://root.example.com:3080"]
+  auth_token: secret_static_join_token
+
+auth_service:
+  enabled: no
+
+proxy_service:
+  enabled: no
+
+kubernetes_service:
+  enabled: yes
+  kube_cluster_name: kube-2
+  # Not specifying kubeconfig_file, we'll assume that this process runs in a
+  # Kubernetes pod
+```
+
+After all the Teleport agents are running, you can view the list of Kubernetes
+clusters using `tsh kube ls` and switch between them using `tsh kube login <kube_cluster_name>`:
+
+```code
+$ tsh kube ls
+
+# Kube Cluster Name Selected
+# ----------------- --------
+# kube-1            *
+# kube-2
+
+$ tsh kube login kube-2
+# Logged into kubernetes cluster "kube-2"
+```
+
+#### Option 2: One Teleport agent connected to multiple clusters
+
+This approach requires you to manually craft a `kubeconfig` file that contains
+the exact set of Kubernetes cluster entries you wish to connect. Updates to the
+set of clusters require a restart.
+
+Instead of running multiple Teleport clusters (auth and proxy for each
+Kubernetes cluster), we will connect multiple Kubernetes clusters to a single
+`kubernetes_service` using `kubeconfig_file`.
+
+Before 5.0:
+
+```yaml
+# teleport-root.yaml
+auth_service:
+  enabled: yes
+
+proxy_service:
+  kubernetes:
+    enabled: yes
+    public_addr: [root.example.com:3026]
+    listen_addr: 0.0.0.0:3026
+
+---
+# teleport-leaf-1.yaml
+auth_service:
+  enabled: yes
+
+proxy_service:
+  kubernetes:
+    enabled: yes
+    public_addr: [leaf-1.example.com:3026]
+    listen_addr: 0.0.0.0:3026
+    kubeconfig_file: kubeconfig-leaf-1.yaml
+
+---
+# teleport-leaf-2.yaml
+auth_service:
+  enabled: yes
+
+proxy_service:
+  kubernetes:
+    enabled: yes
+    public_addr: [leaf-2.example.com:3026]
+    listen_addr: 0.0.0.0:3026
+    kubeconfig_file: kubeconfig-leaf-2.yaml
+```
+
+After 5.0:
+
+```yaml
+# teleport.yaml
+proxy_service:
+  kube_public_addr: [root.example.com]
+  kube_listen_addr: 0.0.0.0:3026
+
+kubernetes_service:
+  enabled: yes
+  listen_addr: 0.0.0.0:3027
+  kubeconfig_file: kubeconfig-all.yaml
+
+---
+# kubeconfig-all.yaml
+apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+    certificate-authority-data: ...
+    server: https://10.0.0.1
+  name: kube-1-server
+- cluster:
+    certificate-authority-data: ...
+    server: https://10.0.0.2
+  name: kube-2-server
+contexts:
+- context:
+    cluster: kube-1-server
+    user: kube-1-creds
+  name: kube-1
+- context:
+    cluster: kube-2-server
+    user: kube-2-creds
+  name: kube-2
+current-context: kube-1
+users:
+- name: kube-1-creds
+  user:
+    ...cluster-specific credentials...
+- name: kube-2-creds
+  user:
+    ...cluster-specific credentials...
+```
+
+You can view the list of Kubernetes clusters using `tsh kube ls` and switch
+between them using `tsh kube login <kube_cluster_name>`:
+
+```code
+$ tsh kube ls
+
+# Kube Cluster Name Selected
+# ----------------- --------
+# kube-1            *
+# kube-2
+
+$ tsh kube login kube-2
+```
+
+#### Option 3: Keep using Trusted Clusters
+
+You may keep using the Trusted Clusters as before and migrate them internally
+to `kubernetes_service`, as described in the first two scenarios.
+
+Note that `tsh kube ls` will **not** show all Kubernetes clusters across all
+Trusted Clusters. It only shows the Kubernetes clusters from the Teleport
+cluster you are currently logged into.
+
+## RBAC
+
+<Admonition type="note">
+  Kubernetes RBAC integration only works with `kubernetes_service`. Make sure you've migrated all the clusters as described above before proceeding.
+</Admonition>
+
+By default, all users have access to all Kubernetes clusters (as a limited set
+of Kubernetes user/group identities). In 5.0, you can restrict user access to a
+subset of Kubernetes clusters using Kubernetes cluster labels and Teleport
+roles.
+
+This RBAC integration works exactly like the [integration for SSH nodes](../../access-controls/reference.mdx).
+
+First, set the set of Kubernetes labels a user can access on their roles:
+
+```yaml
+# role-admin.yaml
+kind: role
+version: v5
+metadata:
+  name: admin
+spec:
+  allow:
+    logins: ['{{internal.logins}}']
+    # Define the Kubernetes users and groups mapped to users with this role.
+    kubernetes_users: ["{{internal.kubernetes_users}}"]
+    kubernetes_groups: ["some-group", "{{internal.kubernetes_groups}}"]
+
+    # List of kubernetes labels a user will be allowed to connect to:
+    kubernetes_labels:
+      # A user can only connect to clusters marked with 'test' label:
+      'environment': 'test'
+      # The wildcard ('*') means "any cluster"
+      '*': '*'
+      # Labels can be specified as a list:
+      'environment': ['test', 'staging']
+      # Regular expressions are also supported, for example the equivalent
+      # of the list example above can be expressed as:
+      'environment': '^test|staging$'
+  # You can also strictly restrict access using deny kubernetes_labels.
+  deny: {}
+```
+
+Next, define Kubernetes labels on the cluster side:
+
+```yaml
+# teleport.yaml
+kubernetes_service:
+  enabled: yes
+  listen_addr: 0.0.0.0:3027
+  kube_cluster_name: staging
+  # Note: if you use kubeconfig_file, the below labels apply to all Kubernetes
+  # clusters in that kubeconfig. To get different sets of labels, you need to
+  # run separate kubernetes_service instances.
+  labels:
+    environment: staging
+  commands:
+  - name: project
+    command: [fetch-project-name.sh]
+    period: 1h
+```
+
+Users with a role that matches a specific Kubernetes cluster label will be
+able to see and connect to that cluster. Other users will neither see nor
+be able to connect to it.
diff --git a/docs/pages/kubernetes-access/guides/multiple-clusters.mdx b/docs/pages/kubernetes-access/guides/multiple-clusters.mdx
index f4e71cb4aed1a..37e15817bc992 100644
--- a/docs/pages/kubernetes-access/guides/multiple-clusters.mdx
+++ b/docs/pages/kubernetes-access/guides/multiple-clusters.mdx
@@ -7,84 +7,18 @@ This guide will show you how to use Teleport as an access plane for multiple Kub
 
 ## Prerequisites
 
-<Tabs>
-<TabItem scope={["oss"]} label="Open Source">
-
-- A Teleport cluster running on Kubernetes, version >=
-  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0. We will assume
-  that you have followed the
-  [Kubernetes with SSO](../getting-started/cluster.mdx) guide
-- The `jq` tool to process `JSON` output. This is available via common package managers
-- An additional Kubernetes cluster version >=
-  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
-- Helm >= (=helm.version=)
+- [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
+- [Helm](https://helm.sh) >= (=helm.version=)
+- Installed and running Teleport cluster (Open Source, Enterprise, or Teleport Cloud)
 
 (!docs/pages/includes/helm.mdx!)
 
-
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-
-- A Teleport cluster running on Kubernetes, version >=
-  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0. We will assume
-  that you have followed the
-  [Kubernetes with SSO](../getting-started/cluster.mdx) guide
-- The `jq` tool to process `JSON` output. This is available via common package managers
-- An additional Kubernetes cluster version >=
-  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
-- Helm >= (=helm.version=)
-
-(!docs/pages/includes/helm.mdx!)
-
-
-</TabItem>
-<TabItem scope={["cloud"]}
-  label="Teleport Cloud">
-
-- A Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial
-
-- The Teleport Kubernetes Service running in a Kubernetes cluster, version >=
-  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0. We will assume
-  that you have already followed
-  [Connect a Kubernetes Cluster to Teleport](../getting-started/agent.mdx)
-
-- The `jq` tool to process `JSON` output. This is available via common package
-  managers
-
-- The Enterprise version of the `tctl` admin tool. To download this, visit
-the [customer portal](https://dashboard.gravitational.com/web/login)
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  (!docs/pages/includes/tctl.mdx!)
-
-- An additional Kubernetes cluster version >=
-  v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
-
-- Helm >= (=helm.version=)
-
-(!docs/pages/includes/helm.mdx!)
-
-
-</TabItem>
-</Tabs>
-
 ## Connecting clusters
 
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
 Teleport can act as an access plane for multiple Kubernetes clusters. 
+We have set up the Teleport cluster `tele.example.com` in [SSO and Kubernetes](../getting-started.mdx).
 
-We will assume that the domain of your Teleport cluster is `tele.example.com`.
-
-Let's start a lightweight agent in another Kubernetes cluster `cookie` and
-connect it to `tele.example.com`.
+Let's start a lightweight agent in another Kubernetes cluster `cookie` and connect it to `tele.example.com`.
 
 We will need a join token from `tele.example.com`:
 
@@ -99,11 +33,12 @@ $ echo $TOKEN
 Switch `kubectl` to the Kubernetes cluster `cookie` and run:
 
 ```code
-# Add Teleport chart repository
+# Add teleport chart repository
 $ helm repo add teleport https://charts.releases.teleport.dev
 
 # Deploy a Kubernetes agent. It dials back to the Teleport cluster tele.example.com.
 $ CLUSTER='cookie'
+# For Cloud users this will be similar to mytenant.teleport.sh
 $ PROXY='tele.example.com:443'
 $ helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=${CLUSTER?} \
   --set proxyAddr=${PROXY?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
@@ -122,61 +57,8 @@ $ tsh kube ls
 
 # kubeconfig now points to the cookie cluster
 $ tsh kube login cookie
-# Logged into Kubernetes cluster "cookie"
+# Logged into kubernetes cluster "cookie"
 
-# kubectl command executed on `cookie` but is routed through the `tele.example.com` cluster.
+# kubectl command executed on `cookie` but is routed through `tele.example.com` cluster.
 $ kubectl get pods
 ```
-
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
-
-Teleport can act as an access plane for multiple Kubernetes clusters. 
-
-We will assume that the domain of your Teleport cluster is `mytenant.teleport.sh`.
-
-Let's start a lightweight agent in another Kubernetes cluster `cookie` and
-connect it to `mytenant.teleport.sh`.
-
-We will need a join token from `mytenant.teleport.sh`:
-
-```code
-# Create a join token for the cluster cookie to authenticate
-$ TOKEN=$(tctl nodes add --roles=kube --ttl=10000h --format=json | jq -r '.[0]')
-$ echo $TOKEN
-```
-
-Switch `kubectl` to the Kubernetes cluster `cookie` and run:
-
-```code
-# Add Teleport chart repository
-$ helm repo add teleport https://charts.releases.teleport.dev
-
-# Deploy a Kubernetes agent. It dials back to the Teleport cluster mytenant.teleport.sh.
-$ CLUSTER='cookie'
-$ PROXY='mytenant.teleport.sh'
-$ helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=${CLUSTER?} \
-  --set proxyAddr=${PROXY?} --set authToken=${TOKEN?} --create-namespace --namespace=teleport-agent
-```
-
-List connected clusters using `tsh kube ls` and switch between
-them using `tsh kube login`:
-
-```code
-$ tsh kube ls
-
-# Kube Cluster Name Selected 
-# ----------------- -------- 
-# cookie
-# mytenant.teleport.sh    *
-
-# kubeconfig now points to the cookie cluster
-$ tsh kube login cookie
-# Logged into Kubernetes cluster "cookie"
-
-# kubectl command executed on `cookie` but is routed through the `mytenant.teleport.sh` cluster.
-$ kubectl get pods
-```
-
-</TabItem>
-</Tabs>
diff --git a/docs/pages/kubernetes-access/guides/standalone-teleport.mdx b/docs/pages/kubernetes-access/guides/standalone-teleport.mdx
index ee6d462dd00e7..0e709cb571363 100644
--- a/docs/pages/kubernetes-access/guides/standalone-teleport.mdx
+++ b/docs/pages/kubernetes-access/guides/standalone-teleport.mdx
@@ -1,102 +1,30 @@
 ---
-title: Kubernetes Access from a Standalone Teleport Cluster
+title: Kubernetes Access from standalone Teleport
 description: Connecting standalone Teleport installations to Kubernetes clusters.
 ---
 
-Teleport can connect to external Kubernetes clusters without using the Teleport
-Helm chart or running a pod inside of the Kubernetes cluster. To do this,
-Teleport needs a `kubeconfig` file to authenticate against the Kubernetes API.
+## Standalone Teleport installation
 
-(!docs/pages/includes/permission-warning.mdx!)
-
-## Prerequisites
-
-<Tabs>
-<TabItem scope={["oss"]} label="Open Source">
-
-- A running Teleport cluster. For details on how to set this up, see one of our
-  [Getting Started](../../getting-started.mdx) guides.
-
-- **Optional:** the `tctl` admin tool version >= (=teleport.version=).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  See [Installation](../../installation.mdx) for details.
-
-  (!docs/pages/includes/tctl.mdx!)
-
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-
-- A running Teleport cluster. For details on how to set this up, see one of our
-  [Getting Started](../../getting-started.mdx) guides.
-
-- **Optional:** the `tctl` admin tool version >= (=teleport.version=), which you can download
-  by visiting the
-  [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  (!docs/pages/includes/tctl.mdx!)
-
-</TabItem>
-<TabItem scope={["cloud"]}
-  label="Teleport Cloud">
-
-- A Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
-
-- A host deployed on your own infrastructure to run the Teleport Kubernetes
-  Service. See [Installing Teleport](../../installation.mdx) for more details.
-
-- **Optional:** the Enterprise version of the `tctl` admin tool. To download this, visit
-the [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  (!docs/pages/includes/tctl.mdx!)
-
-</TabItem>
-</Tabs>
+Teleport can connect to external Kubernetes clusters without using the Teleport Helm chart or running a pod inside of the Kubernetes cluster. To do this, Teleport needs a `kubeconfig` file to authenticate against the Kubernetes API.
 
-## Step 1/2. Generate a kubeconfig
-
-First, configure your local `kubectl` command to point at the Kubernetes cluster
-you want to register. You can use the following command to verify that
-the correct cluster is selected:
-
-```code
-$ kubectl config get-contexts
-```
+(!docs/pages/includes/permission-warning.mdx!)
 
-Use this command to switch to the cluster assigned to `CONTEXT_NAME`:
+## Generating kubeconfig
 
-```code
-$ kubectl config use-context ${CONTEXT_NAME?}
-```
+First, configure your local `kubectl` command to point at the Kubernetes
+cluster you want to register. You can use `kubectl config get-contexts` to
+verify that the correct cluster is selected, or `kubectl config use-context
+${CONTEXT_NAME?}` to switch to cluster `CONTEXT_NAME`.
 
 Next, use [get-kubeconfig.sh](https://github.com/gravitational/teleport/blob/master/examples/k8s-auth/get-kubeconfig.sh) to create a `kubeconfig` for Teleport to use.
 
 You can connect multiple Kubernetes clusters to Teleport from one `kubeconfig` if it contains multiple entries. Use
 [merge-kubeconfigs.sh](https://github.com/gravitational/teleport/blob/master/examples/k8s-auth/merge-kubeconfigs.sh) to combine multiple `kubeconfigs` generated by `get-kubeconfig.sh`.
 
-## Step 2/2. Add your kubeconfig to Teleport
-
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
+## Adding kubeconfig to Teleport
 
-In your Teleport Proxy, add the following to `teleport.yaml`, replacing
-`example.com` with the domain name of your Teleport cluster:
+In your Teleport Proxy or a new separate instance, add the following to
+`teleport.yaml`:
 
 ```yaml
 # ...
@@ -115,24 +43,6 @@ kubernetes_service:
   kubeconfig_file: "path/to/kubeconfig"
 ```
 
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
-
-On the host you will use to run the Teleport Kubernetes Service, add the
-following to `teleport.yaml`.
-
-```yaml
-# ...
-kubernetes_service:
-  enabled: yes
-  listen_addr: 0.0.0.0:3027
-  # Replace this path with the actual path for your generated kubeconfig
-  kubeconfig_file: "path/to/kubeconfig"
-```
-
-</TabItem>
-</Tabs>
-
 <Admonition type="warning" title="Warning" >
   When using `kubeconfig_file`, EKS users may need to replace illegal characters in the `context` names.
   Supported characters are alphanumeric characters, `.`, `_`, and `-`. EKS typically includes `:` and `@`
diff --git a/docs/pages/kubernetes-access/helm/guides/aws.mdx b/docs/pages/kubernetes-access/helm/guides/aws.mdx
index 83c28a54e079b..1e54b39653183 100644
--- a/docs/pages/kubernetes-access/helm/guides/aws.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/aws.mdx
@@ -6,21 +6,9 @@ description: Install and configure an HA Teleport cluster using an AWS EKS clust
 In this guide, we'll go through how to set up a High Availability Teleport cluster with multiple replicas in Kubernetes
 using Teleport Helm charts and AWS products (DynamoDB and S3).
 
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
+(!docs/pages/kubernetes-access/helm/includes/helm-install.mdx!)
 
-## Prerequisites
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
-
-## Step 1/7. Install Helm
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
-
-## Step 2/7. Add the Teleport Helm chart repository
-
-(!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
-
-## Step 3/7. Set up AWS IAM configuration
+## Step 3. Set up AWS IAM configuration
 
 For Teleport to be able to create the DynamoDB tables, indexes, and the S3 storage bucket it needs,
 you'll need to configure AWS IAM policies to allow access.
@@ -165,7 +153,7 @@ You'll need to replace these values in the policy example below:
 }
 ```
 
-## Step 4/7. Install and configure cert-manager
+## Step 4. Install and configure cert-manager
 
 Reference: [`cert-manager` docs](https://cert-manager.io/docs/)
 
@@ -228,7 +216,7 @@ $ kubectl create namespace teleport
 $ kubectl --namespace teleport create -f aws-issuer.yaml
 ```
 
-## Step 5/7. Set values to configure the cluster
+## Step 5. Set values to configure the cluster
 
 There are two different ways to configure the `teleport-cluster` Helm chart to use `aws` mode - using a `values.yaml` file, or using `--set`
 on the command line.
@@ -312,13 +300,11 @@ $ kubectl --namespace teleport get all
 # replicaset.apps/teleport-5cf46ddf5f   2         2         2       4m21s
 ```
 
-## Step 6/7. Set up DNS
-
-You'll need to set up a DNS `A` record for `teleport.example.com`. In our example, this record is an alias to an ELB.
+## Step 6. Set up DNS
 
-<Details title="Using Application Access?">
-(!docs/pages/includes/dns-app-access.mdx!)
-</Details>
+You'll need to set up two DNS `A` records: `teleport.example.com` for the web UI, and `*.teleport.example.com`
+for web apps using [application access](../../../application-access/introduction.mdx). In our example, both records are
+aliases to an ELB.
 
 Here's how to do this in a hosted zone with AWS Route 53:
 
@@ -336,7 +322,7 @@ $ MY_CLUSTER_REGION='us-west-2'
 $ MYZONE="$(aws route53 list-hosted-zones-by-name --dns-name="${MYZONE_DNS?}" | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)"
 $ MYELB="$(kubectl --namespace "${NAMESPACE?}" get "service/${RELEASE_NAME?}" -o jsonpath='{.status.loadBalancer.ingress[*].hostname}')"
 $ MYELB_NAME="${MYELB%%-*}"
-$ MYELB_ZONE="$(aws elbv2 describe-load-balancers --region "${MY_CLUSTER_REGION?}" --names "${MYELB_NAME?}" | jq -r '.LoadBalancers[0].CanonicalHostedZoneId')"
+$ MYELB_ZONE="$(aws elb describe-load-balancers --region "${MY_CLUSTER_REGION?}" --load-balancer-names "${MYELB_NAME?}" | jq -r '.LoadBalancerDescriptions[0].CanonicalHostedZoneNameID')"
 
 # Create a JSON file changeset for AWS.
 $ jq -n --arg dns "${MYDNS?}" --arg elb "${MYELB?}" --arg elbz "${MYELB_ZONE?}" \
@@ -380,7 +366,7 @@ $ aws route53 get-change --id "${CHANGEID?}" | jq '.ChangeInfo.Status'
 # "INSYNC"
 ```
 
-## Step 7/7. Create a Teleport user
+## Step 7. Create a Teleport user
 
 Create a user to be able to log into Teleport. This needs to be done on the Teleport auth server,
 so we can run the command using `kubectl`:
@@ -458,4 +444,4 @@ $ helm --namespace cert-manager uninstall cert-manager
 You can follow our [Getting Started with Teleport guide](../../../setup/guides/docker.mdx#step-34-creating-a-teleport-user) to finish setting up your
 Teleport cluster.
 
-See the [high availability section of our Helm chart reference](../reference/teleport-cluster.mdx#highavailability) for more details on high availability.
+See the [high availability section of our Helm chart reference](../reference.mdx#highavailability) for more details on high availability.
diff --git a/docs/pages/kubernetes-access/helm/guides/custom.mdx b/docs/pages/kubernetes-access/helm/guides/custom.mdx
index a5a126b170b85..dc678ace25919 100644
--- a/docs/pages/kubernetes-access/helm/guides/custom.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/custom.mdx
@@ -9,26 +9,14 @@ config file using Teleport Helm charts.
 This setup can be useful when you already have an existing Teleport cluster and would like to start running it in Kubernetes, or when
 migrating your setup from a legacy version of the Helm charts.
 
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
+(!docs/pages/kubernetes-access/helm/includes/helm-install.mdx!)
 
-## Prerequisites
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
-
-## Step 1/4. Install Helm
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
-
-## Step 2/4. Add the Teleport Helm chart repository
-
-(!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
-
-## Step 3/4. Setting up a Teleport cluster with Helm using a custom config
+## Step 3. Setting up a Teleport cluster with Helm using a custom config
 
 In `custom` mode, the `teleport-cluster` Helm chart does not create a `ConfigMap` containing a `teleport.yaml` file for you, but
 expects that you will provide this yourself.
 
-For this example, we'll be using this `teleport.yaml` configuration file with a static join token (for more information on join tokens, see [Adding Nodes to the Cluster](../../../setup/admin/adding-nodes.mdx)):
+For this example, we'll be using this `teleport.yaml` configuration file (with appropriately complex [static tokens](../../../setup/admin/adding-nodes.mdx#insecure-static-tokens)):
 
 ```bash
 $ cat << EOF > teleport.yaml
@@ -142,7 +130,7 @@ $ kubectl --namespace teleport get all
 # replicaset.apps/teleport-5c56b4d869   1         1         1       5h8m
 ```
 
-## Step 4/4. Create a Teleport user (optional)
+## Step 4. Create a Teleport user (optional)
 
 If you're not migrating an existing Teleport cluster, you'll need to create a user to be able to log into Teleport. This needs to be done on the
 Teleport auth server, so we can run the command using `kubectl`:
diff --git a/docs/pages/kubernetes-access/helm/guides/digitalocean.mdx b/docs/pages/kubernetes-access/helm/guides/digitalocean.mdx
index 0f6e816742a16..1e8da7e44a7f2 100644
--- a/docs/pages/kubernetes-access/helm/guides/digitalocean.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/digitalocean.mdx
@@ -5,8 +5,6 @@ description: How to get started with Teleport on DigitalOcean Kubernetes
 
 This guide will show you how to get started with Teleport on DigitalOcean Kubernetes. 
 
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
-
 ## Prerequisites
 - DigitalOcean account.
 - Your workstation configured with [kubectl](https://kubernetes.io/docs/tasks/tools/), [Helm](https://helm.sh/docs/intro/install/), [doctl](https://docs.digitalocean.com/reference/doctl/how-to/install/), and the Teleport [tsh](https://goteleport.com/docs/installation/) client.
diff --git a/docs/pages/kubernetes-access/helm/guides/gcp.mdx b/docs/pages/kubernetes-access/helm/guides/gcp.mdx
index 73554e7f73d92..74b02029d3c48 100644
--- a/docs/pages/kubernetes-access/helm/guides/gcp.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/gcp.mdx
@@ -6,19 +6,7 @@ description: Install and configure an HA Teleport cluster using a Google Cloud G
 In this guide, we'll go through how to set up a High Availability Teleport cluster with multiple replicas in Kubernetes
 using Teleport Helm charts and Google Cloud Platform products (Firestore and Google Cloud Storage).
 
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
-
-## Prerequisites
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
-
-## Step 1/7. Install Helm
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
-
-## Step 2/7. Add the Teleport Helm chart repository
-
-(!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
+(!docs/pages/kubernetes-access/helm/includes/helm-install.mdx!)
 
 <Admonition
   type="note"
@@ -27,7 +15,7 @@ using Teleport Helm charts and Google Cloud Platform products (Firestore and Goo
   The steps below apply to Google Cloud Google Kubernetes Engine (GKE) Standard deployments.
 </Admonition>
 
-## Step 3/7. Google Cloud IAM configuration
+## Step 3: Google Cloud IAM configuration
 
 For Teleport to be able to create the Firestore collections, indexes, and the Google Cloud Storage bucket it needs,
 you'll need to configure a Google Cloud service account with permissions to use these services.
@@ -199,7 +187,7 @@ $ kubectl --namespace teleport create secret generic teleport-gcp-credentials --
  The credentials file stored in any secret used must have the key name `gcp-credentials.json`.
 </Admonition>
 
-## Step 4/7. Install and configure cert-manager
+## Step 4: Install and configure cert-manager
 
 Reference the [cert-manager docs](https://cert-manager.io/docs/).
 
@@ -267,7 +255,7 @@ After you have created the `Issuer` and updated the values, add it to your clust
 $ kubectl --namespace teleport create -f gcp-issuer.yaml
 ```
 
-## Step 5/7. Set values to configure the cluster
+## Step 5: Set values to configure the cluster
 
 <Admonition type="note">
   If you are installing Teleport in a brand new GCP project, make sure you have enabled the
@@ -356,13 +344,10 @@ $ kubectl --namespace teleport get all
 # replicaset.apps/teleport-b64dd8849    2         2         2       7m16s
 ```
 
-## Step 6/7. Set up DNS
-
-You'll need to set up a DNS `A` record for `teleport.example.com`.
+## Step 6. Set up DNS
 
-<Details title="Using Application Access?">
-(!docs/pages/includes/dns-app-access.mdx!)
-</Details>
+You'll need to set up two DNS `A` records: `teleport.example.com` for the web UI, and `*.teleport.example.com`
+for web apps using [application access](../../../application-access/introduction.mdx).
 
 Here's how to do this using Google Cloud DNS:
 
@@ -382,7 +367,7 @@ $ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
 $ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
 ```
 
-## Step 7/7. Create a Teleport user
+## Step 7. Create a Teleport user
 
 Create a user to be able to log into Teleport. This needs to be done on the Teleport auth server,
 so we can run the command using `kubectl`:
@@ -409,7 +394,7 @@ To make changes to your Teleport cluster after deployment, you can use `helm upg
 Helm defaults to using the latest version of the chart available in the repo, which will also correspond to the latest
 version of Teleport. You can make sure that the repo is up to date by running `helm repo update`.
 
-If you want to use a different version of Teleport, set the [`teleportVersionOverride`](../reference/teleport-cluster.mdx#teleportversionoverride) value.
+If you want to use a different version of Teleport, set the [`teleportVersionOverride`](../reference.mdx#teleportversionoverride) value.
 
 Here's an example where we set the chart to use 3 replicas:
 
@@ -463,4 +448,4 @@ $ helm --namespace cert-manager uninstall cert-manager
 You can follow our [Getting Started with Teleport guide](../../../setup/guides/docker.mdx#step-34-creating-a-teleport-user) to finish setting up your
 Teleport cluster.
 
-See the [high availability section of our Helm chart reference](../reference/teleport-cluster.mdx#highavailability) for more details on high availability.
+See the [high availability section of our Helm chart reference](../reference.mdx#highavailability) for more details on high availability.
diff --git a/docs/pages/kubernetes-access/helm/guides/migration.mdx b/docs/pages/kubernetes-access/helm/guides/migration.mdx
index f35f5cacc3270..1810fb80562bb 100644
--- a/docs/pages/kubernetes-access/helm/guides/migration.mdx
+++ b/docs/pages/kubernetes-access/helm/guides/migration.mdx
@@ -13,21 +13,9 @@ to use the newer `teleport-cluster` Helm chart instead.
   consider [following a different guide](../guides.mdx) and storing your cluster's data in AWS DynamoDB or Google Cloud Firestore.
 </Admonition>
 
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx!)
+(!docs/pages/kubernetes-access/helm/includes/helm-install.mdx!)
 
-## Prerequisites
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx!)
-
-## Step 1/6. Install Helm
-
-(!docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx!)
-
-## Step 2/6. Add the Teleport Helm chart repository
-
-(!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!)
-
-## Step 3/6. Get the Teleport configuration file from your existing cluster
+## Step 3. Get the Teleport configuration file from your existing cluster
 
 <Admonition type="tip" title="Teleport storage in AWS or GCP">
   If your Teleport cluster's database is currently stored in AWS DynamoDB or Google Cloud Firestore rather than
@@ -93,7 +81,7 @@ $ kubectl --namespace teleport-cluster create configmap teleport --from-file=tel
 # configmap/teleport created
 ```
 
-## Step 4/6. Extracting the contents of Teleport's database
+## Step 4. Extracting the contents of Teleport's database
 
 <Admonition type="note" title="Note on namespacing">
   If you migrate your existing data, the `cluster_name` which is configured in `teleport.yaml` must stay the same.
@@ -124,7 +112,7 @@ Add the backup to your new `teleport-cluster` namespace as a secret:
 $ kubectl --namespace teleport-cluster create secret generic bootstrap --from-file=backup.yaml
 ```
 
-## Step 5/6. Start the new cluster with your old config file and backup
+## Step 5. Start the new cluster with your old config file and backup
 
 We will start the new cluster and bootstrap it using the backup of your cluster's data. Once this step is complete and the cluster is working,
 we'll modify the deployment to remove references to the backup data, and remove it from Kubernetes for security.
@@ -197,7 +185,7 @@ $ kubectl --namespace teleport-cluster get all
   browser to view the page successfully.
 </Admonition>
 
-## Step 6/6. Remove the bootstrap data and update the chart deployment
+## Step 6. Remove the bootstrap data and update the chart deployment
 
 Once you've tested your new Teleport cluster and you're confident that your data has been migrated successfully,
 you should redeploy the chart without your backup data mounted for security.
diff --git a/docs/pages/kubernetes-access/helm/includes/helm-install.mdx b/docs/pages/kubernetes-access/helm/includes/helm-install.mdx
new file mode 100644
index 0000000000000..9f2afc4f8aaf4
--- /dev/null
+++ b/docs/pages/kubernetes-access/helm/includes/helm-install.mdx
@@ -0,0 +1,48 @@
+## Prerequisites
+
+- [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
+- [Helm](https://helm.sh) >= v(=helm.version=)
+
+<Details scopeOnly={true} scope={["cloud"]} title="Teleport Cloud warning">
+This guide shows you how to install the `teleport-cluster` Helm chart, which is intended to help you get started with Teleport by deploying the Auth Service and 
+Proxy Service in a Kubernetes cluster so you can access that cluster via the Kubernetes Service.
+
+Since the Auth and Proxy Services are fully managed in Teleport Cloud, you should install our `teleport-kube-agent` chart, which is intended for deployments where the Auth Service and Proxy Service run outside your Kubernetes cluster.
+
+You can use the `teleport-kube-agent` chart to enable the Application Service and Database Service in addition to the Kubernetes Service.
+
+For more information, see our [Helm chart reference](../reference.mdx#teleport-kube-agent).
+</Details>
+
+Verify that Helm and Kubernetes are installed and up to date.
+
+(!docs/pages/includes/permission-warning.mdx!)
+
+## Step 1. Install Helm
+
+Teleport's charts require the use of Helm version 3. You can [install Helm 3 by following these instructions](https://helm.sh/docs/intro/install/).
+
+Throughout this guide, we will assume that you have the `helm` and `kubectl` binaries available in your `PATH`:
+
+```code
+$ helm version
+# version.BuildInfo{Version:"v(=helm.version=)"}
+
+$ kubectl version
+# Client Version: version.Info{Major:"(=kubernetes.major_version=)", Minor:"(=kubernetes.minor_version=)+"}
+# Server Version: version.Info{Major:"(=kubernetes.major_version=)", Minor:"(=kubernetes.minor_version=)+"}
+```
+
+## Step 2. Add the Teleport Helm chart repository
+
+To allow Helm to install charts that are hosted in the Teleport Helm repository, use `helm repo add`:
+
+```code
+$ helm repo add teleport (=teleport.helm_repo_url=)
+```
+
+To update the cache of charts from the remote repository, run `helm repo update`:
+
+```code
+$ helm repo update
+```
diff --git a/docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx b/docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx
deleted file mode 100644
index ecfd2bd53e642..0000000000000
--- a/docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
-To allow Helm to install charts that are hosted in the Teleport Helm repository, use `helm repo add`:
-
-```code
-$ helm repo add teleport (=teleport.helm_repo_url=)
-```
-
-To update the cache of charts from the remote repository, run `helm repo update`:
-
-```code
-$ helm repo update
-```
diff --git a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx
deleted file mode 100644
index 552769882816d..0000000000000
--- a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-cloud-warning.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-<Details scopeOnly={true} scope={["cloud"]} title="Teleport Cloud warning">
-This guide shows you how to install the `teleport-cluster` Helm chart, which is intended to help you get started with Teleport by deploying the Auth Service and 
-Proxy Service in a Kubernetes cluster so you can access that cluster via the Kubernetes Service.
-
-Since the Auth and Proxy Services are fully managed in Teleport Cloud, you should install our `teleport-kube-agent` chart, which is intended for deployments where the Auth Service and Proxy Service run outside your Kubernetes cluster.
-
-You can use the `teleport-kube-agent` chart to enable the Application Service and Database Service in addition to the Kubernetes Service.
-
-For more information, see our [Helm chart reference](../reference/teleport-kube-agent.mdx).
-</Details>
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx
deleted file mode 100644
index f7739d9c3408f..0000000000000
--- a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-install.mdx
+++ /dev/null
@@ -1,12 +0,0 @@
-Teleport's charts require the use of Helm version 3. You can [install Helm 3 by following these instructions](https://helm.sh/docs/intro/install/).
-
-Throughout this guide, we will assume that you have the `helm` and `kubectl` binaries available in your `PATH`:
-
-```code
-$ helm version
-# version.BuildInfo{Version:"v(=helm.version=)"}
-
-$ kubectl version
-# Client Version: version.Info{Major:"(=kubernetes.major_version=)", Minor:"(=kubernetes.minor_version=)+"}
-# Server Version: version.Info{Major:"(=kubernetes.major_version=)", Minor:"(=kubernetes.minor_version=)+"}
-```
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx b/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
deleted file mode 100644
index 0c49b5efbf7d0..0000000000000
--- a/docs/pages/kubernetes-access/helm/includes/teleport-cluster-prereqs.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
-- [Kubernetes](https://kubernetes.io) >= v(=kubernetes.major_version=).(=kubernetes.minor_version=).0
-- [Helm](https://helm.sh) >= v(=helm.version=)
-
-Verify that Helm and Kubernetes are installed and up to date.
-
-(!docs/pages/includes/permission-warning.mdx!)
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/helm/reference.mdx b/docs/pages/kubernetes-access/helm/reference.mdx
index 1fdeef7a6768d..bd695b85f7459 100644
--- a/docs/pages/kubernetes-access/helm/reference.mdx
+++ b/docs/pages/kubernetes-access/helm/reference.mdx
@@ -3,17 +3,2572 @@ title: Helm chart reference
 description: A list of values that can be set using Teleport Helm charts and their purpose
 ---
 
-<TileSet>
-<Tile href="./reference/teleport-cluster.mdx" icon="kubernetes" title="teleport-cluster">
-![Teleport ](../../../img/k8s/mini-diagrams/teleport-in-k8s-mono.svg)
+The Teleport Helm repository hosts two Helm charts:
 
-Deploy the Teleport Auth Service and Proxy Service on Kubernetes.
+- [`teleport-cluster`](#teleport-cluster) [(source on Github)](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-cluster)
+- [`teleport-kube-agent`](#teleport-kube-agent) [(source on Github)](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-kube-agent)
 
-</Tile>
-<Tile href="./reference/teleport-kube-agent.mdx" icon="kubernetes" title="teleport-kube-agent">
-![Kubernetes agent](../../../img/k8s/mini-diagrams/k8s-to-teleport-mono.svg)
+(!docs/pages/includes/backup-warning.mdx!)
 
-Deploy the Teleport Kubernetes Service, Application Service, or Database Service on Kubernetes.
+## `teleport-cluster`
 
-</Tile>
-</TileSet>
\ No newline at end of file
+The `teleport-cluster` Helm chart is used to configure a Teleport cluster. It runs two Teleport services:
+
+| Teleport service | Purpose | Documentation |
+| - | - | - |
+| `auth_service` | Authenticates users and hosts, and issues certificates | [Auth documentation](../../architecture/authentication.mdx)
+| `proxy_service`| Runs the externally-facing parts of a Teleport cluster, such as the web UI, SSH proxy and reverse tunnel service | [Proxy documentation](../../architecture/proxy.mdx) |
+
+The `teleport-cluster` chart can be deployed in four different modes. Get started with a guide for each mode:
+
+| `chartMode` | Guide |
+| - | - |
+| `standalone` | [Getting started with Kubernetes Access](../getting-started.mdx) |
+| `aws` | [Running an HA Teleport cluster using an AWS EKS Cluster](./guides/aws.mdx) |
+| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](./guides/gcp.mdx) |
+| `custom` | [Running a Teleport cluster with a custom config](./guides/custom.mdx) |
+
+This reference details available values for the `teleport-cluster` chart.
+
+## `clusterName`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `nil` | When `chartMode` is `aws`, `gcp` or `standalone` | `auth_service.cluster_name`, `proxy_service.public_addr` | ✅ |
+
+`clusterName` controls the name used to refer to the Teleport cluster, along with the externally-facing public address to use to access it.
+
+<Admonition type="note">
+  If using a fully qualified domain name as your `clusterName`, you will also need to configure the DNS provider for this domain to point
+  to the external load balancer address of your Teleport cluster.
+
+  (!docs/pages/kubernetes-access/helm/includes/kubernetes-externaladdress.mdx!)
+
+  You will need to manually add DNS records pointing `teleport.example.com` and `*.teleport.example.com` to either the IP or hostname
+  of the Kubernetes load balancer.
+
+  If you are not using ACME certificates, you may also need to accept insecure warnings in your browser to view the page successfully.
+</Admonition>
+
+
+## `kubeClusterName`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `clusterName` value | no | `kubernetes_service.kube_cluster_name` |  ✅ |
+
+`kubeClusterName` sets the name used for the Kubernetes cluster. This name will be shown to Teleport users connecting to the cluster.
+
+## `authenticationType`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `local` | Yes | `auth_service.authentication.type` | ❌ |
+
+`authenticationType` controls the authentication scheme used by Teleport. Possible values are `local` and `github` for OSS, plus `oidc`, `saml`, and `false` for Enterprise.
+
+## `proxyListenerMode`
+
+| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
+| - | - | - | - | - |
+| `string` | `nil` | no | `auth_service.proxy_listener_mode` | ❌ |
+
+`proxyListenerMode` controls proxy TLS routing used by Teleport. Possible values are `multiplex`.
+
+## `enterprise`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `false`| ✅ |
+
+`enterprise` controls whether to use Teleport Community Edition or Teleport Enterprise.
+
+Setting `enterprise` to `true` will use the Teleport Enterprise image.
+
+You will also need to download your Enterprise license from the Teleport dashboard and add it as a Kubernetes secret to use this:
+
+```code
+$ kubectl --namespace teleport create secret generic license --from-file=/path/to/downloaded/license.pem
+```
+
+<Admonition type="tip">
+  If you installed the Teleport chart into a specific namespace, the `license` secret you create must also be added to the same namespace.
+</Admonition>
+
+<Admonition type="note">
+  The file added to the secret must be called `license.pem`. If you have renamed it, you can specify the filename to use in the secret creation command:
+
+  ```code
+  $ kubectl --namespace teleport create secret generic license --from-file=license.pem=/path/to/downloaded/this-is-my-teleport-license.pem
+  ```
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  enterprise: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set enterprise=true
+  ```
+  </TabItem>
+</Tabs>
+
+## `teleportVersionOverride`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `nil` | ✅ |
+
+Normally the version of Teleport being used will match the version of the chart being installed. If you install chart version
+7.0.0, you'll be using Teleport 7.0.0. Upgrading the Helm chart will use the latest version from the repo.
+
+You can optionally override this to use a different published Teleport Docker image tag like `6.0.2` or `7`.
+
+See these links for information on Docker image versions:
+
+- [Community Docker image information](../../setup/guides/docker.mdx#step-14-pick-your-image)
+- [Enterprise Docker image information](../../enterprise/getting-started.mdx#run-teleport-enterprise-using-docker)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  teleportVersionOverride: "7"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set teleportVersionOverride="7"
+  ```
+  </TabItem>
+</Tabs>
+
+## `acme`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `bool` | `false` | ❌ | `proxy_service.acme.enabled` |
+
+ACME is a protocol for getting Web X.509 certificates.
+
+Setting acme to `true` enables the ACME protocol and will attempt to get a free TLS certificate from Let's Encrypt.
+Setting acme to `false` (the default) will cause Teleport to generate and use self-signed certificates for its web UI.
+
+<Admonition type="note">
+  ACME can only be used for single-pod clusters. It is not suitable for use in HA configurations.
+</Admonition>
+
+<Admonition type="warning">
+  Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
+  cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
+
+  One option might be to use Teleport's built-in ACME support or enable [cert-manager support](#highavailabilitycertmanager).
+</Admonition>
+
+## `acmeEmail`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `nil`  | ❌ | `proxy_service.acme.email` |
+
+`acmeEmail` is the email address to provide during certificate registration (this is a Let's Encrypt requirement).
+
+## `acmeURI`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | Let's Encrypt production server | ❌ | `proxy_service.acme.uri` |
+
+`acmeURI` is the ACME server to use for getting certificates.
+
+As an example, this can be overridden to use the [Let's Encrypt staging server](https://letsencrypt.org/docs/staging-environment/) for testing.
+
+You can also use any other ACME-compatible server.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  acme: true
+  acmeEmail: user@email.com
+  acmeURI: https://acme-staging-v02.api.letsencrypt.org/directory
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set acme=true \
+  --set acmeEmail=user@email.com \
+  --set acmeURI=https://acme-staging-v02.api.letsencrypt.org/directory
+  ```
+  </TabItem>
+</Tabs>
+
+## `podSecurityPolicy`
+
+### `podSecurityPolicy.enabled`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `true` | ✅ |
+
+By default, Teleport charts also install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-cluster/templates/psp.yaml).
+
+To disable this, you can set `enabled` to `false`.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  podSecurityPolicy:
+    enabled: false
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set podSecurityPolicy.enabled=false
+  ```
+  </TabItem>
+</Tabs>
+
+## `labels`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `object` | `{}` | ❌ | `kubernetes_service.labels` |
+
+`labels` can be used to add a map of key-value pairs relating to the Teleport cluster being deployed. These labels can then be used with
+Teleport's RBAC policies to define access rules for the cluster.
+
+<Admonition type="note">
+  These are Teleport-specific RBAC labels, not Kubernetes labels.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  labels:
+    environment: production
+    region: us-east
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set labels.environment=production \
+  --set labels.region=us-east
+  ```
+  </TabItem>
+</Tabs>
+
+## `chartMode`
+
+| Type | Default value |
+| - | - |
+| `string` | `standalone` |
+
+`chartMode` is used to configure the chart's operation mode. You can find more information about each mode on its specific guide page:
+
+| `chartMode` | Guide |
+| - | - |
+| `standalone` | [Getting started with Kubernetes Access](../getting-started.mdx) |
+| `aws` | [Running an HA Teleport cluster using an AWS EKS Cluster](./guides/aws.mdx) |
+| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](./guides/gcp.mdx) |
+| `custom` | [Running a Teleport cluster with a custom config](./guides/custom.mdx) |
+
+## `standalone`
+
+### `standalone.existingClaimName`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `nil` | ✅ |
+
+`standalone.existingClaimName` can be used to provide the name of a pre-existing `PersistentVolumeClaim` to use if desired.
+
+The default is left blank, which will automatically create a `PersistentVolumeClaim` to use for Teleport storage in `standalone` mode.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  standalone:
+    existingClaimName: my-existing-pvc-name
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set standalone.existingClaimName=my-existing-pvc-name
+  ```
+  </TabItem>
+</Tabs>
+
+### `standalone.volumeSize`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string`  | `10Gi` | ✅ |
+
+You can set `volumeSize` to request a different size of persistent volume when installing the Teleport chart in `standalone` mode.
+
+<Admonition type="note">
+  `volumeSize` will be ignored if `existingClaimName` is set.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  standalone:
+    volumeSize: 50Gi
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set standalone.volumeSize=50Gi
+  ```
+  </TabItem>
+</Tabs>
+
+## `aws`
+
+| Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - |
+| ❌ | See [Using DynamoDB](../../setup/reference/backends.mdx#dynamodb) and [Using Amazon S3](../../setup/reference/backends.mdx#s3) for details |
+
+`aws` settings are described in the AWS guide: [Running an HA Teleport cluster using an AWS EKS Cluster](./guides/aws.mdx)
+
+## `gcp`
+
+| Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - |
+| ❌ | See [Using Firestore](../../setup/reference/backends.mdx#dynamodb) and [Using GCS](../../setup/reference/backends.mdx#gcs) for details |
+
+`gcp` settings are described in the GCP guide: [Running an HA Teleport cluster using a Google Cloud GKE cluster](./guides/gcp.mdx)
+
+### `highAvailability`
+
+## `highAvailability.replicaCount`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `int` | `1` | ✅ (when using HA storage) |
+
+`highAvailability.replicaCount` can be used to set the number of replicas used in the deployment.
+
+Set to a number higher than `1` for a high availability mode where multiple Teleport pods will be deployed and connections will be load balanced between them.
+
+<Admonition type="note">
+  Setting `highAvailability.replicaCount` to a value higher than `1` will disable the use of ACME certs.
+</Admonition>
+
+<Admonition type="tip" title="Sizing guidelines">
+  As a rough guide, we recommend configuring one replica per distinct availability zone where your cluster has worker nodes.
+
+  2 replicas/availability zones will be fine for smaller workloads. 3-5 replicas/availability zones will be more appropriate for bigger
+  clusters with more traffic.
+</Admonition>
+
+<Admonition type="warning">
+  When using `custom` mode, you **must** use highly-available storage (e.g. etcd, DynamoDB or Firestore) for multiple replicas to be supported.
+
+  [Information on supported Teleport storage backends](../../architecture/authentication.mdx#storage-back-ends)
+
+  Manually configuring NFS-based storage or `ReadWriteMany` volume claims is **NOT** supported for an HA deployment and will result in errors.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    replicaCount: 3
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set highAvailability.replicaCount=3
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.requireAntiAffinity`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `false` | ✅ (when using HA storage) |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
+
+Setting `highAvailability.requireAntiAffinity` to `true` will use `requiredDuringSchedulingIgnoredDuringExecution` to require that multiple
+Teleport pods must not be scheduled on the same physical host.
+
+<Admonition type="warning">
+  This can result in Teleport pods failing to be scheduled in very small clusters or during node downtime, so should be used with caution.
+</Admonition>
+
+ Setting `highAvailability.requireAntiAffinity` to `false` (the default) uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
+ anti-affinity a soft requirement.
+
+<Admonition type="note">
+  This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    requireAntiAffinity: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set highAvailability.requireAntiAffinity=true
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.podDisruptionBudget`
+
+### `highAvailability.podDisruptionBudget.enabled`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `false` | ✅ (when using HA storage) |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      enabled: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.enabled=true
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.podDisruptionBudget.minAvailable`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `int` | `1` | ✅ (when using HA storage) |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      minAvailable: 1
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.minAvailable=1
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.certManager`
+
+See the [cert-manager](https://cert-manager.io/docs/) docs for more information.
+
+### `highAvailability.certManager.enabled`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `bool` | `false` | ❌ | `proxy_service.https_keypairs` (to provide your own certificates) |
+
+Setting `highAvailability.certManager.enabled` to `true` will use `cert-manager` to provision a TLS certificate for a Teleport
+cluster deployed in HA mode.
+
+<Admonition type="note" title="Installing cert-manager">
+  You must install and configure `cert-manager` in your Kubernetes cluster yourself.
+
+  See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
+  and the relevant sections of the [AWS](./guides/aws.mdx#step-4-install-and-configure-cert-manager) and [GCP](./guides/gcp.mdx#step-4-install-and-configure-cert-manager) guides for more information.
+</Admonition>
+
+### `highAvailability.certManager.addCommonName`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `bool` | `false` | ❌ | `proxy_service.https_keypairs` (to provide your own certificates) |
+
+Setting `highAvailability.certManager.addCommonName` to `true` will instruct `cert-manager` to set the commonName field in its certificate signing request to the issuing CA.
+
+<Admonition type="note" title="Enabling common name field">
+  You must install and configure `cert-manager` in your Kubernetes cluster yourself.
+
+  See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
+  and the relevant sections of the [AWS](./guides/aws.mdx#step-4-install-and-configure-cert-manager) and [GCP](./guides/gcp.mdx#step-4-install-and-configure-cert-manager) guides for more information.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    certManager:
+      enabled: true
+      addCommonName: true
+      issuerName: letsencrypt-production
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set highAvailability.certManager.enabled=true \
+  --set highAvailability.certManager.addCommonName=true \
+  --set highAvailability.certManager.issuerName=letsencrypt-production
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.certManager.issuerName`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `nil` | ❌ | None |
+
+Sets the name of the `cert-manager` `Issuer` or `ClusterIssuer` to use for issuing certificates.
+
+<Admonition type="note" title="Configuring an Issuer">
+  You must install configure an appropriate `Issuer` supporting a DNS01 challenge yourself.
+
+  Please see the [cert-manager DNS01 docs](https://cert-manager.io/docs/configuration/acme/dns01/#supported-dns01-providers) and the relevant sections
+  of the [AWS](./guides/aws.mdx#step-4-install-and-configure-cert-manager) and [GCP](./guides/gcp.mdx#step-4-install-and-configure-cert-manager) guides for more information.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    certManager:
+      enabled: true
+      issuerName: letsencrypt-production
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set highAvailability.certManager.enabled=true \
+  --set highAvailability.certManager.issuerName=letsencrypt-production
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.certManager.issuerKind`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `Issuer` | ❌ | None |
+
+Sets the `Kind` of `Issuer` to be used when issuing certificates with `cert-manager`. Defaults to `Issuer` to keep permissions
+scoped to a single namespace.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    certManager:
+      issuerKind: ClusterIssuer
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set highAvailability.certManager.issuerKind=ClusterIssuer
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.certManager.issuerGroup`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `cert-manager.io` | ❌ | None |
+
+Sets the `Group` of `Issuer` to be used when issuing certificates with `cert-manager`. Defaults to `cert-manager.io` to use built-in issuers.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    certManager:
+      issuerGroup: cert-manager.io
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set highAvailability.certManager.issuerGroup=cert-manager.io
+  ```
+  </TabItem>
+</Tabs>
+
+## `image`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `quay.io/gravitational/teleport` | ✅ |
+
+`image` sets the container image used for Teleport Community pods in the cluster.
+
+You can override this to use your own Teleport Community image rather than a Teleport-published image.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  image: my.docker.registry/teleport-community-image-name
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set image=my.docker.registry/teleport-community-image-name
+  ```
+  </TabItem>
+</Tabs>
+
+## `enterpriseImage`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `quay.io/gravitational/teleport-ent` | ✅ |
+
+`enterpriseImage` sets the container image used for Teleport Enterprise pods in the cluster.
+
+You can override this to use your own Teleport Enterprise image rather than a Teleport-published image.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  enterpriseImage: my.docker.registry/teleport-enterprise-image-name
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set enterpriseImage=my.docker.registry/teleport-enterprise-image
+  ```
+  </TabItem>
+</Tabs>
+
+## `log`
+
+### `log.level`
+
+<Admonition type="note">
+  This field used to be called `logLevel`. For backwards compatibility this name can still be used, but we recommend changing your values file to use `log.level`.
+</Admonition>
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `INFO` | ❌ | `teleport.log.severity` |
+
+`log.level` sets the log level used for the Teleport process.
+
+Available log levels (in order of most to least verbose) are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
+
+The default is `INFO`, which is recommended in production.
+
+`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    level: DEBUG
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.level=DEBUG
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.output`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `stderr` | ❌ | `teleport.log.output` |
+
+`log.output` sets the output destination for the Teleport process.
+
+This can be set to any of the built-in values: `stdout`, `stderr` or `syslog` to use that destination.
+
+The value can also be set to a file path (such as `/var/log/teleport.log`) to write logs to a file. Bear in mind that a few service startup messages will still go to `stderr` for resilience.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    output: stderr
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.output=stderr
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.format`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `text` | ❌ | `teleport.log.format.output` |
+
+`log.format` sets the output type for the Teleport process.
+
+Possible values are `text` (default) or `json`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    format: json
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.format=json
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.extraFields`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `list` | `["timestamp", "level", "component", "caller"]` | ❌ | `teleport.log.format.extra_fields` |
+
+`log.extraFields` sets the fields used in logging for the Teleport process.
+
+See the [Teleport config file reference](../../setup/reference/config.mdx) for more details on possible values for `extra_fields`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    extraFields: ["timestamp", "level"]
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set "log.extraFields[0]=timestamp" \
+  --set "log.extraFields[1]=level"
+  ```
+  </TabItem>
+</Tabs>
+
+## `affinity`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅ |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
+
+Kubernetes affinity to set for pod assignments.
+
+<Admonition type="note">
+  You cannot set both `affinity` and `highAvailability.requireAntiAffinity` as they conflict with each other. Only set one or the other.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: gravitational.io/dedicated
+            operator: In
+            values:
+            - teleport
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key=gravitational.io/dedicated \
+  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
+  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=teleport
+  ```
+  </TabItem>
+</Tabs>
+
+## `annotations.config`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `object` | `{}` | ❌ | None |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
+
+<Admonition type="note">
+  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
+  In this instance, you should apply annotations manually to your created `ConfigMap`.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    config:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.config."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.deployment`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `Deployment` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    deployment:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.deployment."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.pod`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to each `Pod` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    pod:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.pod."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.service`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `Service` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    service:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.service."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.serviceAccount`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `serviceAccount` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    serviceAccount:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.serviceAccount."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.certSecret`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `secret` generated by
+`cert-manager` from the `certificate` created by the chart.  Only valid when
+`highAvailability.certManager.enabled` is set to `true` and requires
+`cert-manager` v1.5.0+.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    certSecret:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.certSecret."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `service.type`
+
+| Type | Default value | Required? | Can be used in `custom` mode? |
+| - | - | - | - |
+| `string` | `LoadBalancer` | Yes | ✅ |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/services-networking/service/)
+
+Allows to specify the service type.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  service:
+    type: LoadBalancer
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set service.type=LoadBalancer
+  ```
+  </TabItem>
+</Tabs>
+
+## `service.spec.loadBalancerIP`
+
+| Type | Default value | Required? | Can be used in `custom` mode? |
+| - | - | - | - |
+| `string` | `nil` | No | ✅ |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer)
+
+Allows to specify the `loadBalancerIP`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  service:
+    spec:
+      loadBalancerIP: 1.2.3.4
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set service.spec.loadBalancerIP=1.2.3.4
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraArgs`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+A list of extra arguments to pass to the `teleport start` command when running a Teleport Pod.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraArgs:
+  - "--bootstrap=/etc/teleport-bootstrap/roles.yaml"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraArgs={--bootstrap=/etc/teleport-bootstrap/roles.yaml}"
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraEnv`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
+
+A list of extra environment variables to be set on the main Teleport container.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraEnv:
+  - name: MY_ENV
+    value: my-value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraEnv[0].name=MY_ENV" \
+  --set "extraEnv[0].value=my-value"
+  ```
+  </TabItem>
+</Tabs>
+
+
+## `extraVolumes`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+A list of extra Kubernetes `Volumes` which should be available to any `Pod` created by the chart. These volumes
+will also be available to any `initContainers` configured by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraVolumes:
+  - name: myvolume
+    secret:
+      secretName: mysecret
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraVolumes[0].name=myvolume" \
+  --set "extraVolumes[0].secret.secretName=mysecret"
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraVolumeMounts`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+A list of extra Kubernetes volume mounts which should be mounted into any `Pod` created by the chart. These volume
+mounts will also be mounted into any `initContainers` configured by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraVolumeMounts:
+  - name: myvolume
+    mountPath: /path/to/mount/volume
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraVolumeMounts[0].name=myvolume" \
+  --set "extraVolumeMounts[0].path=/path/to/mount/volume"
+  ```
+  </TabItem>
+</Tabs>
+
+## `imagePullPolicy`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `IfNotPresent` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
+
+Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  imagePullPolicy: Always
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set imagePullPolicy=Always
+  ```
+  </TabItem>
+</Tabs>
+
+## `initContainers`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
+
+A list of `initContainers` which will be run before the main Teleport container in any pod created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  initContainers:
+  - name: teleport-init
+    image: alpine
+    args: ['echo test']
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "initContainers[0].name=teleport-init" \
+  --set "initContainers[0].image=alpine" \
+  --set "initContainers[0].args={echo test}"
+  ```
+  </TabItem>
+</Tabs>
+
+## `postStart`
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/)
+
+A `postStart` lifecycle handler to be configured on the main Teleport container.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  postStart:
+    command:
+    - echo
+    - foo
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set "postStart.command[0]=echo" \
+  --set "postStart.command[1]=foo"
+  ```
+  </TabItem>
+</Tabs>
+
+## `resources`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
+
+Resource requests/limits which should be configured for each container inside the pod. These resource limits
+will also be applied to `initContainers`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  resources:
+    requests:
+      cpu: 1
+      memory: 2Gi
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set resources.requests.cpu=1 \
+  --set resources.requests.memory=2Gi
+  ```
+  </TabItem>
+</Tabs>
+
+## `tolerations`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+
+Kubernetes Tolerations to set for pod assignment.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  tolerations:
+  - key: "dedicated"
+    operator: "Equal"
+    value: "teleport"
+    effect: "NoSchedule"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set tolerations[0].key=dedicated \
+  --set tolerations[0].operator=Equal \
+  --set tolerations[0].value=teleport \
+  --set tolerations[0].effect=NoSchedule
+  ```
+  </TabItem>
+</Tabs>
+
+## `priorityClassName`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `""` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
+
+Kubernetes PriorityClass to set for pod.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  priorityClassName: "system-cluster-critical"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set priorityClassName=system-cluster-critical
+  ```
+  </TabItem>
+</Tabs>
+
+## ---
+
+## `teleport-kube-agent`
+
+The `teleport-kube-agent` Helm chart is used to configure a Teleport agent which runs in a remote Kubernetes cluster and joins back to a
+Teleport cluster to provide access to services running there.
+
+The `teleport-kube-agent` chart can run any or all of three Teleport services:
+
+| Teleport service | Name for `roles` and `tctl tokens add` | Purpose |
+| - | - | - |
+| [`kubernetes_service`](../../kubernetes-access/guides.mdx) | `kube` | Uses Teleport to handle authentication with and proxy access to a Kubernetes cluster |
+| [`application_service`](../../application-access/guides.mdx) | `app` | Uses Teleport to handle authentication with and proxy access to web-based applications |
+| [`database_service`](../../database-access/guides.mdx) | `db` | Uses Teleport to handle authentication with and proxy access to databases |
+
+This reference details available values for the `teleport-kube-agent` chart.
+
+## `roles`
+
+This parameter is not mandatory to preserve backwards compatibility with older chart versions, but we recommend it is set.
+
+| Type | Default value |
+| - | - |
+| `string` | `kube` |
+
+`roles` is a comma-separated list of services which should be enabled when running the `teleport-kube-agent` chart.
+
+| Services | Value for `roles` | Mandatory additional settings for this role |
+| - | - | - |
+| Teleport Kubernetes service | `kube` | [`kubeClusterName`](#kubeclustername) |
+| Teleport Application service | `app` | [`apps`](#apps) |
+| Teleport Database service | `db` | [`databases`](#databases) |
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  roles: kube,app,db
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set roles=kube\,app\,db
+  ```
+
+  <Admonition type="note">
+    When specifying multiple roles using `--set` syntax, you must escape the commas using a backslash (`\`).
+
+    This is a quirk of Helm's CLI parser.
+  </Admonition>
+
+  </TabItem>
+</Tabs>
+
+If you specify a role here, you may also need to specify some other settings which are detailed in this reference.
+
+## `authToken`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `string` | `nil` | Yes |
+
+`authToken` provides a Teleport join token which will be used to join the Teleport agent to a Teleport cluster.
+
+This value **must** be provided for the chart to work. The token that you use must also be valid for every Teleport service that you
+are trying to add with the `teleport-kube-agent` chart. Here are a few examples:
+
+| Services | Service Name | `tctl tokens add` example | `teleport.yaml` static token example |
+| - | - | - | - |
+| Kubernetes | `kube` | `tctl tokens add --type=kube` | `"kube:<replace-with-actual-token>"` |
+| Kubernetes, Application | `kube,app` | `tctl tokens add --type=kube,app` | `"kube,app:<replace-with-actual-token>"` |
+| Kubernetes, Application, Database | `kube,app,db` | `tctl tokens add --type=kube,app,db` | `"kube,app,db:<replace-with-actual-token>"` |
+
+<Admonition type="note">
+  When you use a token, all of the services that it provides **must** be used.
+
+  For example, you cannot use a token of type `app,db` to only join a Teleport `app` service by itself. It must join both `app` and `db` services at once.
+
+  Also, each static token you configure must be unique, as the token itself is used to define which services will be supported.
+
+  You cannot reuse the same static token and specify a different set of services.
+</Admonition>
+
+If you do not have the correct services (Teleport refers to these internally as `Roles`) assigned to your join token, the Teleport agent will
+fail to join the Teleport cluster.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  authToken: <replace-with-actual-token>
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set authToken=<replace-with-actual-token>
+  ```
+  </TabItem>
+</Tabs>
+
+## `proxyAddr`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `string` | `nil` | Yes |
+
+`proxyAddr` provides the public-facing Teleport proxy endpoint which should be used to join the cluster. This is the same URL that is used
+to access the web UI of your Teleport cluster. It is the same as the value configured for `proxy_service.public_addr` in a traditional
+Teleport cluster. The port used is usually either 3080 or 443.
+
+Here are a few examples:
+
+| Deployment method | Example `proxy_service.public_addr` |
+| - | - |
+| On-prem Teleport cluster | `teleport.example.com:3080` |
+| Teleport Cloud cluster | `example.teleport.sh:443` |
+| `teleport-cluster` Helm chart | `teleport.example.com:443` |
+
+## `kubeClusterName`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `string` | `nil` | When `kube` chart role is used |
+
+`kubeClusterName` sets the name used for the Kubernetes cluster proxied by the Teleport agent. This name will be shown to Teleport users
+connecting to the cluster.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  kubeClusterName: my-gke-cluster
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set kubeClusterName=my-gke-cluster
+  ```
+  </TabItem>
+</Tabs>
+
+## `apps`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `list` | `[]` | When `app` chart role is used? |
+
+`apps` is a YAML list object detailing the applications that should be proxied by Teleport Application access.
+
+You can specify multiple apps by adding additional list elements.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  apps:
+  - name: grafana
+    uri: http://localhost:3000
+    labels:
+      purpose: monitoring
+  - name: jenkins
+    uri: http://jenkins:8080
+    labels:
+      purpose: ci
+  ```
+
+  <Admonition type="note" title="YAML formatting">
+    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
+    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
+  </Admonition>
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "apps[0].name=grafana" \
+  --set "apps[0].uri=http://localhost:3000" \
+  --set "apps[0].purpose=monitoring" \
+  --set "apps[1].name=grafana" \
+  --set "apps[1].uri=http://jenkins:8080" \
+  --set "apps[1].purpose=ci"
+  ```
+
+  <Admonition type="note">
+    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
+  </Admonition>
+
+  </TabItem>
+</Tabs>
+
+<Admonition type="tip" title="Supported values">
+  You can see a list of all the supported [values which can be used in a Teleport application access configuration here](../../application-access/reference.mdx#configuration).
+</Admonition>
+
+## `awsDatabases`
+
+<Admonition type="tip" title="Database auto-discovery">
+  This section configures database auto-discovery, which is only currently supported on AWS. You can configure databases for other platforms using the [`databases`](#databases) section below this.
+</Admonition>
+
+<Admonition type="note" title="IAM roles">
+  For AWS database auto-discovery to work, your agent pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../database-access/guides/rds.mdx#step-36-configure-iam).
+
+  After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions:
+
+  ```
+  annotations:
+    serviceAccount:
+      eks.amazonaws.com/role-arn: arn:aws:iam::1234567890:role/my-rds-autodiscovery-role
+  ```
+</Admonition>
+
+| Type | Default value | Required? |
+| - | - | - |
+| `list` | `[]` | No |
+
+`awsDatabases` is a YAML list object detailing the filters for the AWS databases that should be discovered and proxied by Teleport Database access.
+
+You can specify multiple database filters by adding additional list elements.
+
+- `types` is a list containing the types of AWS databases that should be discovered.
+- `regions` is a list of AWS regions which should be scanned for databases.
+- `tags` can be used to set AWS tags that must be matched for databases to be discovered.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  awsDatabases:
+    - types: ["rds"]
+      regions: ["us-east-1", "us-west-2"]
+      tags:
+        "environment": "production"
+    - types: ["rds"]
+      regions: ["us-east-1"]
+      tags:
+        "environment": "dev"
+    - types: ["rds"]
+      regions: ["eu-west-1"]
+      tags:
+        "*": "*"
+  ```
+
+  <Admonition type="note" title="YAML formatting">
+    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
+    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
+  </Admonition>
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set "awsDatabases[0].types[0]=rds" \
+  --set "awsDatabases[0].regions[0]=us-east-1" \
+  --set "awsDatabases[0].regions[1]=us-west-2" \
+  --set "awsDatabases[0].tags[0].environment=production" \
+  --set "awsDatabases[1].types[0]=rds" \
+  --set "awsDatabases[1].regions[0]=us-east-1" \
+  --set "awsDatabases[1].tags[0].environment=dev" \
+  --set "awsDatabases[2].types[0]=rds" \
+  --set "awsDatabases[2].regions[0]=eu-west-1" \
+  --set "awsDatabases[2].tags[0].*=*"
+  ```
+
+  <Admonition type="note">
+    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
+  </Admonition>
+
+  </TabItem>
+</Tabs>
+
+## `databases`
+
+| Type | Default value | Required? |
+| - | - | - |
+| `list` | `[]` | When `db` chart role is used |
+
+`databases` is a YAML list object detailing the databases that should be proxied by Teleport Database access.
+
+You can specify multiple databases by adding additional list elements.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  databases:
+  - name: aurora-postgres
+    uri: postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432
+    protocol: postgres
+    aws:
+      region: us-east-1
+    static_labels:
+      env: staging
+  - name: mysql
+    uri: mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306
+    protocol: mysql
+    aws:
+      region: us-east-1
+    static_labels:
+      env: staging
+  ```
+
+  <Admonition type="note" title="YAML formatting">
+    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
+    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
+  </Admonition>
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "databases[0].name=aurora" \
+  --set "databases[0].uri=postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432" \
+  --set "databases[0].protocol=postgres" \
+  --set "databases[0].aws.region=us-east-1" \
+  --set "databases[0].static_labels.env=staging" \
+  --set "databases[1].name=mysql" \
+  --set "databases[1].uri=mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306" \
+  --set "databases[1].protocol=mysql" \
+  --set "databases[1].aws.region=us-east-1" \
+  --set "databases[1].static_labels.env=staging"
+  ```
+
+  <Admonition type="note">
+    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
+  </Admonition>
+
+  </TabItem>
+</Tabs>
+
+<Admonition type="tip" title="Supported values">
+  You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../database-access/reference/configuration.mdx).
+</Admonition>
+
+## `teleportVersionOverride`
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+Normally the version of Teleport being used will match the version of the chart being installed. If you install chart version
+7.0.0, you'll be using Teleport 7.0.0.
+
+You can optionally override this to use a different published Teleport Docker image tag like `6.0.2` or `7`.
+
+See [this link for information on Community Docker image versions](../../setup/guides/docker.mdx#step-14-pick-your-image).
+
+<Admonition type="note">
+  The `teleport-kube-agent` chart always runs using Teleport Community edition as it does not require any Enterprise features, so it does
+  not require a Teleport license file to be provided.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  teleportVersionOverride: "7"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set teleportVersionOverride="7"
+  ```
+  </TabItem>
+</Tabs>
+
+## `insecureSkipProxyTLSVerify`
+
+| Type | Default value |
+| - | - |
+| `bool` | `false` |
+
+When `insecureSkipProxyTLSVerify` is set to `true`, the agent will skip the verification of the TLS certificate presented by the Teleport
+proxy server specified using [`proxyAddr`](#proxyaddr).
+
+This can be used for joining a Teleport agent to a Teleport cluster which does not have valid TLS certificates for testing.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  insecureSkipProxyTLSVerify: false
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set insecureSkipProxyTLSVerify=false
+  ```
+  </TabItem>
+</Tabs>
+
+<Admonition type="warning">
+  Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
+  cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
+
+  One option might be to use Teleport's built-in [ACME support](#acme) enable [cert-manager support](#highavailabilitycertmanager).
+</Admonition>
+
+## `existingDataVolume`
+
+| Type | Default value |
+| - | - |
+| `string` | `""` |
+
+When `existingDataVolume` is set to the name of an existing volume, the `/var/lib/teleport` mount will use this volume instead of creating a new `emptyDir` volume.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  existingDataVolume: my-volume
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set existingDataVolume=my-volume
+  ```
+  </TabItem>
+</Tabs>
+
+## `podSecurityPolicy`
+
+### `podSecurityPolicy.enabled`
+
+| Type | Default value |
+| - | - |
+| `bool` | `true` |
+
+By default, Teleport charts also install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-kube-agent/templates/psp.yaml).
+
+To disable this, you can set `enabled` to `false`.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  podSecurityPolicy:
+    enabled: false
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set podSecurityPolicy.enabled=false
+  ```
+  </TabItem>
+</Tabs>
+
+## `labels`
+
+| Type | Default value |
+| - | - |
+| `object` | `{}` |
+
+`labels` can be used to add a map of key-value pairs for the `kubernetes_service` which is deployed using the `teleport-kube-agent` chart.
+These labels can then be used with Teleport's RBAC policies to define access rules for the cluster.
+
+<Admonition type="note">
+  These are Teleport-specific RBAC labels, not Kubernetes labels.
+</Admonition>
+
+<Admonition type="note">
+  For historical/backwards compatibility reasons, these labels will only be applied to the Kubernetes cluster being joined via the
+  Teleport Kubernetes service.
+
+  To set labels for applications, add a `labels` element to the [`apps`](#apps) section.
+  To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section.
+
+  For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../setup/admin/labels.mdx).
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  labels:
+    environment: production
+    region: us-east
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set labels.environment=production \
+  --set labels.region=us-east
+  ```
+  </TabItem>
+</Tabs>
+
+## `storage`
+
+### `storage.enabled`
+
+| Type | Default value |
+| - | - |
+| `bool` | `false` |
+
+Enables the creation of a Kubernetes persistent volume to hold Teleport agent state.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  storage:
+    enabled: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set storage.enabled=true
+  ```
+  </TabItem>
+</Tabs>
+
+### `storage.storageClassName`
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+The storage class name the persistent volume should use when creating persistent volume claims. The provided storage class
+name needs to exist on the Kubernetes cluster for Teleport to use.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/storage-classes/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  storage:
+    storageClassName: teleport-storage-class
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set storage.storageClassName=teleport-storage-class
+  ```
+  </TabItem>
+</Tabs>
+
+### `storage.requests`
+
+| Type | Default value |
+| - | - |
+| `string` | `128Mi` |
+
+The size of persistent volume to create.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  storage:
+    requests: 128Mi
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set storage.requests=128Mi
+  ```
+  </TabItem>
+</Tabs>
+
+## `image`
+
+| Type | Default value |
+| - | - |
+| `string` | `quay.io/gravitational/teleport` |
+
+`image` sets the container image used for Teleport pods run by the `teleport-kube-agent` chart.
+
+You can override this to use your own Teleport image rather than a Teleport-published image.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  image: my.docker.registry/teleport-image-name
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set image=my.docker.registry/teleport-image-name
+  ```
+  </TabItem>
+</Tabs>
+
+## `imagePullSecrets`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
+
+A list of secrets containing authorization tokens which can be optionally used to access a private Docker registry.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  imagePullSecrets:
+  - name: my-docker-registry-key
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set "imagePullSecrets[0].name=my-docker-registry-key"
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability`
+
+## `highAvailability.replicaCount`
+
+| Type | Default value |
+| - | - |
+| `int` | `1` |
+
+`highAvailability.replicaCount` can be used to set the number of replicas used in the deployment.
+
+Set to a number higher than `1` for a high availability mode where multiple Teleport agent pods will be deployed.
+
+<Admonition type="tip" title="Sizing guidelines">
+  As a rough guide, we recommend configuring one replica per distinct availability zone where your cluster has worker nodes.
+
+  2 replicas/availability zones will be fine for smaller workloads. 3-5 replicas/availability zones will be more appropriate for bigger
+  clusters with more traffic.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    replicaCount: 3
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.replicaCount=3
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.requireAntiAffinity`
+
+| Type | Default value |
+| - | - |
+| `bool` | `false` |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
+
+Setting `highAvailability.requireAntiAffinity` to `true` will use `requiredDuringSchedulingIgnoredDuringExecution` to require that multiple
+Teleport pods must not be scheduled on the same physical host.
+
+<Admonition type="warning">
+  This can result in Teleport pods failing to be scheduled in very small clusters or during node downtime, so should be used with caution.
+</Admonition>
+
+ Setting `highAvailability.requireAntiAffinity` to `false` (the default) uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
+ anti-affinity a soft requirement.
+
+<Admonition type="note">
+  This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    requireAntiAffinity: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.requireAntiAffinity=true
+  ```
+  </TabItem>
+</Tabs>
+
+## `highAvailability.podDisruptionBudget`
+
+### `highAvailability.podDisruptionBudget.enabled`
+
+| Type | Default value |
+| - | - |
+| `bool` | `false` |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      enabled: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.enabled=true
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.podDisruptionBudget.minAvailable`
+
+| Type | Default value |
+| - | - |
+| `int` | `1` |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      minAvailable: 1
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.minAvailable=1
+  ```
+  </TabItem>
+</Tabs>
+
+## `clusterRoleName`
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+`clusterRoleName` can be optionally used to override the name of the Kubernetes `ClusterRole` used by the `teleport-kube-agent` chart's `ServiceAccount`.
+
+<Admonition type="note">
+  Most users will not need to change this.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  clusterRoleName: kubernetes-clusterrole
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set clusterRoleName=kubernetes-clusterrole
+  ```
+  </TabItem>
+</Tabs>
+
+## `clusterRoleBindingName`
+
+<Admonition type="note">
+  Most users will not need to change this.
+</Admonition>
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+
+`clusterRoleBindingName` can be optionally used to override the name of the Kubernetes `ClusterRoleBinding` used by the `teleport-kube-agent` chart's `ServiceAccount`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  clusterRoleBindingName: kubernetes-clusterrolebinding
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set clusterRoleBindingName=kubernetes-clusterrolebinding
+  ```
+  </TabItem>
+</Tabs>
+
+## `serviceAccountName`
+
+<Admonition type="note">
+  Most users will not need to change this.
+</Admonition>
+
+| Type | Default value |
+| - | - |
+| `string` | `nil` |
+
+`serviceAccountName` can be optionally used to override the name of the Kubernetes `ServiceAccount` used by the `teleport-kube-agent` chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  serviceAccountName: kubernetes-serviceaccount
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set serviceAccountName=kubernetes-serviceaccount
+  ```
+  </TabItem>
+</Tabs>
+
+## `secretName`
+
+| Type | Default value |
+| - | - |
+| `string` | `teleport-kube-agent-join-token` |
+
+`secretName` is the name of the Kubernetes `Secret` used to store the Teleport join token which is used by the `teleport-kube-agent` chart.
+
+If you set this to a blank value, the chart will not attempt to create the secret itself and will instead read the value of the
+existing `teleport-kube-agent-join-token` secret. This allows you to configure this secret externally and avoid having a plaintext
+join token stored in your Teleport chart values.
+
+To create your own join token secret, you can use a command like this:
+
+```code
+$ kubectl --namespace teleport create secret generic teleport-kube-agent-join-token --from-literal=auth-token=<replace-with-actual-token>
+```
+
+<Admonition type="note">
+  The key used for the auth token inside the secret must be `auth-token`, as in the command above.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  serviceAccountName:
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set serviceAccountName=""
+  ```
+  </TabItem>
+</Tabs>
+
+## `log`
+
+### `log.level`
+
+<Admonition type="note">
+  This field used to be called `logLevel`. For backwards compatibility this name can still be used, but we recommend changing your values file to use `log.level`.
+</Admonition>
+
+| Type | Default value |
+| - | - |
+| `string` | `INFO` |
+
+`log.level` sets the log level used for the Teleport process.
+
+Available log levels (in order of most to least verbose) are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
+
+The default is `INFO`, which is recommended in production.
+
+`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    level: DEBUG
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.level=DEBUG
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.output`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `stderr` | ❌ | `teleport.log.output` |
+
+`log.output` sets the output destination for the Teleport process.
+
+This can be set to any of the built-in values: `stdout`, `stderr` or `syslog` to use that destination.
+
+The value can also be set to a file path (such as `/var/log/teleport.log`) to write logs to a file. Bear in mind that a few service startup messages will still go to `stderr` for resilience.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    output: stderr
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.output=stderr
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.format`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `string` | `text` | ❌ | `teleport.log.format.output` |
+
+`log.format` sets the output type for the Teleport process.
+
+Possible values are `text` (default) or `json`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    format: json
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set log.format=json
+  ```
+  </TabItem>
+</Tabs>
+
+### `log.extraFields`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `list` | `["timestamp", "level", "component", "caller"]` | ❌ | `teleport.log.format.extra_fields` |
+
+`log.extraFields` sets the fields used in logging for the Teleport process.
+
+See the [Teleport config file reference](../../setup/reference/config.mdx) for more details on possible values for `extra_fields`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  log:
+    extraFields: ["timestamp", "level"]
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  --set "log.extraFields[0]=timestamp" \
+  --set "log.extraFields[1]=level"
+  ```
+  </TabItem>
+</Tabs>
+
+## `affinity`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅ |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
+
+Kubernetes affinity to set for pod assignments.
+
+<Admonition type="note">
+  You cannot set both `affinity` and `highAvailability.requireAntiAffinity` as they conflict with each other.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: gravitational.io/dedicated
+            operator: In
+            values:
+            - teleport
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key=gravitational.io/dedicated \
+  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
+  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=teleport
+  ```
+  </TabItem>
+</Tabs>
+
+## `nodeSelector`
+
+| Type | Default value |
+| - | - |
+| `object` | `{}` |
+
+`nodeSelector` can be used to add a map of key-value pairs to constrain the nodes the agent pods will run on.
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/)
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  nodeSelector:
+    role: node
+    region: us-east
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```bash
+  --set nodeSelector.role=node \
+  --set nodeSelector.region=us-east
+  ```
+  </TabItem>
+</Tabs>
+
+## `annotations.config`
+
+| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
+| - | - | - | - |
+| `object` | `{}` | ❌ | None |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
+
+<Admonition type="note">
+  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
+  In this instance, you should apply annotations manually to your created `ConfigMap`.
+</Admonition>
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    config:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.config."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.deployment`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `Deployment` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    deployment:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.deployment."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.pod`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to each `Pod` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    pod:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.pod."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `annotations.serviceAccount`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+
+Kubernetes annotations which should be applied to the `ServiceAccount` created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  annotations:
+    serviceAccount:
+      kubernetes.io/annotation: value
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set annotations.serviceAccount."kubernetes\.io\/annotation"=value
+  ```
+  <Admonition type="warning" title="Escaping values">
+    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
+    using a `values.yaml` file instead to avoid confusion and errors.
+  </Admonition>
+  </TabItem>
+</Tabs>
+
+## `extraVolumes`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+A list of extra Kubernetes `Volumes` which should be available to any `Pod` created by the chart. These volumes
+will also be available to any `initContainers` configured by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraVolumes:
+  - name: myvolume
+    secret:
+      secretName: mysecret
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraVolumes[0].name=myvolume" \
+  --set "extraVolumes[0].secret.secretName=mysecret"
+  ```
+  </TabItem>
+</Tabs>
+
+## `extraVolumeMounts`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+A list of extra Kubernetes volume mounts which should be mounted into any `Pod` created by the chart. These volume
+mounts will also be mounted into any `initContainers` configured by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  extraVolumeMounts:
+  - name: myvolume
+    mountPath: /path/to/mount/volume
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "extraVolumeMounts[0].name=myvolume" \
+  --set "extraVolumeMounts[0].path=/path/to/mount/volume"
+  ```
+  </TabItem>
+</Tabs>
+
+## `imagePullPolicy`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `string` | `IfNotPresent` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
+
+Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  imagePullPolicy: Always
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set imagePullPolicy=Always
+  ```
+  </TabItem>
+</Tabs>
+
+## `initContainers`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
+
+A list of `initContainers` which will be run before the main Teleport container in any pod created by the chart.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  initContainers:
+  - name: teleport-init
+    image: alpine
+    args: ['echo test']
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set "initContainers[0].name=teleport-init" \
+  --set "initContainers[0].image=alpine" \
+  --set "initContainers[0].args={echo test}"
+  ```
+  </TabItem>
+</Tabs>
+
+## `resources`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `object` | `{}` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
+
+Resource requests/limits which should be configured for each container inside the pod. These resource limits
+will also be applied to `initContainers`.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  resources:
+    requests:
+      cpu: 1
+      memory: 2Gi
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set resources.requests.cpu=1 \
+  --set resources.requests.memory=2Gi
+  ```
+  </TabItem>
+</Tabs>
+
+## `tolerations`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `list` | `[]` | ✅  |
+
+[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+
+Kubernetes Tolerations to set for pod assignment.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  tolerations:
+  - key: "dedicated"
+    operator: "Equal"
+    value: "teleport"
+    effect: "NoSchedule"
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```code
+  $ --set tolerations[0].key=dedicated \
+  --set tolerations[0].operator=Equal \
+  --set tolerations[0].value=teleport \
+  --set tolerations[0].effect=NoSchedule
+  ```
+  </TabItem>
+</Tabs>
diff --git a/docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx b/docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx
deleted file mode 100644
index d4205880d4cf9..0000000000000
--- a/docs/pages/kubernetes-access/helm/reference/teleport-cluster.mdx
+++ /dev/null
@@ -1,1348 +0,0 @@
----
-title: teleport-cluster Chart Reference
-description: Values that can be set using the teleport-cluster Helm chart
----
-
-The `teleport-cluster` Helm chart is used to deploy the Teleport Auth Service
-and Proxy Service, which is ideal for getting started with a self-hosted Teleport
-cluster on Kubernetes.
-
-<Notice scope={["cloud"]} type="warning">
-
-Teleport Cloud manages the Auth Service and Proxy Service for you. Use the
-`teleport-cluster` chart if you are interested in hosting Teleport yourself, or
-use the [`teleport-kube-agent`](./teleport-kube-agent.mdx) chart to deploy the
-Kubernetes Service, Application Service, or Database Service.
-
-</Notice>
-
-You can
-[browse the source on GitHub](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-cluster).
-
-The `teleport-cluster` chart runs two Teleport services:
-
-| Teleport service | Purpose | Documentation |
-| - | - | - |
-| `auth_service` | Authenticates users and hosts, and issues certificates | [Auth documentation](../../../architecture/authentication.mdx)
-| `proxy_service`| Runs the externally-facing parts of a Teleport cluster, such as the web UI, SSH proxy and reverse tunnel service | [Proxy documentation](../../../architecture/proxy.mdx) |
-
-The `teleport-cluster` chart can be deployed in four different modes. Get started with a guide for each mode:
-
-| `chartMode` | Guide |
-| - | - |
-| `standalone` | [Getting started with Kubernetes Access](../../../getting-started.mdx) |
-| `aws` | [Running an HA Teleport cluster using an AWS EKS Cluster](../guides/aws.mdx) |
-| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../guides/gcp.mdx) |
-| `custom` | [Running a Teleport cluster with a custom config](../guides/custom.mdx) |
-
-This reference details available values for the `teleport-cluster` chart.
-
-(!docs/pages/includes/backup-warning.mdx!)
-
-## `clusterName`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `nil` | When `chartMode` is `aws`, `gcp` or `standalone` | `auth_service.cluster_name`, `proxy_service.public_addr` | ✅ |
-
-`clusterName` controls the name used to refer to the Teleport cluster, along with the externally-facing public address to use to access it.
-
-<Admonition type="note">
-  If using a fully qualified domain name as your `clusterName`, you will also need to configure the DNS provider for this domain to point
-  to the external load balancer address of your Teleport cluster.
-
-  (!docs/pages/kubernetes-access/helm/includes/kubernetes-externaladdress.mdx!)
-
-  You will need to manually add a DNS A record pointing `teleport.example.com` to either the IP or hostname of the Kubernetes load balancer.
-
-<Details title="Using Application Access?">
-(!docs/pages/includes/dns-app-access.mdx!)
-</Details>
-
-  If you are not using ACME certificates, you may also need to accept insecure warnings in your browser to view the page successfully.
-</Admonition>
-
-
-## `kubeClusterName`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `clusterName` value | no | `kubernetes_service.kube_cluster_name` |  ✅ |
-
-`kubeClusterName` sets the name used for the Kubernetes cluster. This name will be shown to Teleport users connecting to the cluster.
-
-## `authenticationType`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `local` | Yes | `auth_service.authentication.type` | ❌ |
-
-`authenticationType` controls the authentication scheme used by Teleport. Possible values are `local` and `github` for OSS, plus `oidc`, `saml`, and `false` for Enterprise.
-
-## `authenticationSecondFactor`
-
-### `authenticationSecondFactor.secondFactor`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `otp` | Yes | `auth_service.authentication.second_factor` | ❌ |
-
-`authenticationSecondFactor.secondFactor` controls the second factor used for local user authentication. Possible values supported by this chart
-are `off` (not recommended), `on`, `otp`, `optional` and `webauthn`.
-
-When set to `on`, `optional` or `webauthn`, the `authenticationSecondFactor.webauthn` section can also be used. The configured `rp_id` defaults to
-the FQDN which is used to access the Teleport cluster.
-
-### `authenticationSecondFactor.webauthn`
-
-See [Second Factor - WebAuthn](../../../access-controls/guides/webauthn.mdx) for more details.
-
-#### `authenticationSecondFactor.webauthn.attestationAllowedCas`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `array` | `[]` | No | `auth_service.authentication.webauthn.attestation_allowed_cas` | ❌ |
-
-`authenticationSecondFactor.webauthn.attestationAllowedCas` is an optional allow list of certificate authorities (as local file paths or in-line PEM certificate string) for
-[device verification](https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html).
-This field allows you to restrict which device models and vendors you trust.
-Devices outside of the list will be rejected during registration.
-By default all devices are allowed.
-
-#### `authenticationSecondFactor.webauthn.attestationDeniedCas`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `array` | `[]` | No | `auth_service.authentication.webauthn.attestation_denied_cas` | ❌ |
-
-`authenticationSecondFactor.webauthn.attestationDeniedCas` is optional deny list of certificate authorities (as local file paths or in-line PEM certificate string) for
-[device verification](https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html).
-This field allows you to forbid specific device models and vendors, while allowing all others (provided they clear attestation_allowed_cas as well).
-Devices within this list will be rejected during registration.
-By default no devices are forbidden.
-
-## `proxyListenerMode`
-
-| Type | Default value | Required? | `teleport.yaml` equivalent | Can be used in `custom` mode? |
-| - | - | - | - | - |
-| `string` | `nil` | no | `auth_service.proxy_listener_mode` | ❌ |
-
-`proxyListenerMode` controls proxy TLS routing used by Teleport. Possible values are `multiplex`.
-
-## `enterprise`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `bool` | `false`| ✅ |
-
-`enterprise` controls whether to use Teleport Community Edition or Teleport Enterprise.
-
-Setting `enterprise` to `true` will use the Teleport Enterprise image.
-
-You will also need to download your Enterprise license from the Teleport dashboard and add it as a Kubernetes secret to use this:
-
-```code
-$ kubectl --namespace teleport create secret generic license --from-file=/path/to/downloaded/license.pem
-```
-
-<Admonition type="tip">
-  If you installed the Teleport chart into a specific namespace, the `license` secret you create must also be added to the same namespace.
-</Admonition>
-
-<Admonition type="note">
-  The file added to the secret must be called `license.pem`. If you have renamed it, you can specify the filename to use in the secret creation command:
-
-  ```code
-  $ kubectl --namespace teleport create secret generic license --from-file=license.pem=/path/to/downloaded/this-is-my-teleport-license.pem
-  ```
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  enterprise: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set enterprise=true
-  ```
-  </TabItem>
-</Tabs>
-
-## `teleportVersionOverride`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `nil` | ✅ |
-
-Normally the version of Teleport being used will match the version of the chart being installed. If you install chart version
-7.0.0, you'll be using Teleport 7.0.0. Upgrading the Helm chart will use the latest version from the repo.
-
-You can optionally override this to use a different published Teleport Docker image tag like `6.0.2` or `7`.
-
-See these links for information on Docker image versions:
-
-- [Community Docker image information](../../../setup/guides/docker.mdx#step-14-pick-your-image)
-- [Enterprise Docker image information](../../../enterprise/getting-started.mdx#run-teleport-enterprise-using-docker)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  teleportVersionOverride: "7"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set teleportVersionOverride="7"
-  ```
-  </TabItem>
-</Tabs>
-
-## `acme`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `bool` | `false` | ❌ | `proxy_service.acme.enabled` |
-
-ACME is a protocol for getting Web X.509 certificates.
-
-Setting acme to `true` enables the ACME protocol and will attempt to get a free TLS certificate from Let's Encrypt.
-Setting acme to `false` (the default) will cause Teleport to generate and use self-signed certificates for its web UI.
-
-<Admonition type="note">
-  ACME can only be used for single-pod clusters. It is not suitable for use in HA configurations.
-</Admonition>
-
-<Admonition type="warning">
-  Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
-  cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
-
-  One option might be to use Teleport's built-in ACME support or enable [cert-manager support](#highavailabilitycertmanager).
-</Admonition>
-
-## `acmeEmail`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `nil`  | ❌ | `proxy_service.acme.email` |
-
-`acmeEmail` is the email address to provide during certificate registration (this is a Let's Encrypt requirement).
-
-## `acmeURI`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | Let's Encrypt production server | ❌ | `proxy_service.acme.uri` |
-
-`acmeURI` is the ACME server to use for getting certificates.
-
-As an example, this can be overridden to use the [Let's Encrypt staging server](https://letsencrypt.org/docs/staging-environment/) for testing.
-
-You can also use any other ACME-compatible server.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  acme: true
-  acmeEmail: user@email.com
-  acmeURI: https://acme-staging-v02.api.letsencrypt.org/directory
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set acme=true \
-  --set acmeEmail=user@email.com \
-  --set acmeURI=https://acme-staging-v02.api.letsencrypt.org/directory
-  ```
-  </TabItem>
-</Tabs>
-
-## `podSecurityPolicy`
-
-### `podSecurityPolicy.enabled`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `bool` | `true` | ✅ |
-
-By default, Teleport charts also install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-cluster/templates/psp.yaml).
-
-To disable this, you can set `enabled` to `false`.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  podSecurityPolicy:
-    enabled: false
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set podSecurityPolicy.enabled=false
-  ```
-  </TabItem>
-</Tabs>
-
-## `labels`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `object` | `{}` | ❌ | `kubernetes_service.labels` |
-
-`labels` can be used to add a map of key-value pairs relating to the Teleport cluster being deployed. These labels can then be used with
-Teleport's RBAC policies to define access rules for the cluster.
-
-<Admonition type="note">
-  These are Teleport-specific RBAC labels, not Kubernetes labels.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  labels:
-    environment: production
-    region: us-east
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set labels.environment=production \
-  --set labels.region=us-east
-  ```
-  </TabItem>
-</Tabs>
-
-## `chartMode`
-
-| Type | Default value |
-| - | - |
-| `string` | `standalone` |
-
-`chartMode` is used to configure the chart's operation mode. You can find more information about each mode on its specific guide page:
-
-| `chartMode` | Guide |
-| - | - |
-| `standalone` | [Getting started with Kubernetes Access](../../../getting-started.mdx) |
-| `aws` | [Running an HA Teleport cluster using an AWS EKS Cluster](../guides/aws.mdx) |
-| `gcp` | [Running an HA Teleport cluster using a Google Cloud GKE cluster](../guides/gcp.mdx) |
-| `custom` | [Running a Teleport cluster with a custom config](../guides/custom.mdx) |
-
-## `standalone`
-
-### `standalone.existingClaimName`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `nil` | ✅ |
-
-`standalone.existingClaimName` can be used to provide the name of a pre-existing `PersistentVolumeClaim` to use if desired.
-
-The default is left blank, which will automatically create a `PersistentVolumeClaim` to use for Teleport storage in `standalone` mode.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  standalone:
-    existingClaimName: my-existing-pvc-name
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set standalone.existingClaimName=my-existing-pvc-name
-  ```
-  </TabItem>
-</Tabs>
-
-### `standalone.volumeSize`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string`  | `10Gi` | ✅ |
-
-You can set `volumeSize` to request a different size of persistent volume when installing the Teleport chart in `standalone` mode.
-
-<Admonition type="note">
-  `volumeSize` will be ignored if `existingClaimName` is set.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  standalone:
-    volumeSize: 50Gi
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set standalone.volumeSize=50Gi
-  ```
-  </TabItem>
-</Tabs>
-
-## `aws`
-
-| Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - |
-| ❌ | See [Using DynamoDB](../../../setup/reference/backends.mdx#dynamodb) and [Using Amazon S3](../../../setup/reference/backends.mdx#s3) for details |
-
-`aws` settings are described in the AWS guide: [Running an HA Teleport cluster using an AWS EKS Cluster](../guides/aws.mdx)
-
-## `gcp`
-
-| Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - |
-| ❌ | See [Using Firestore](../../../setup/reference/backends.mdx#dynamodb) and [Using GCS](../../../setup/reference/backends.mdx#gcs) for details |
-
-`gcp` settings are described in the GCP guide: [Running an HA Teleport cluster using a Google Cloud GKE cluster](../guides/gcp.mdx)
-
-### `highAvailability`
-
-## `highAvailability.replicaCount`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `int` | `1` | ✅ (when using HA storage) |
-
-`highAvailability.replicaCount` can be used to set the number of replicas used in the deployment.
-
-Set to a number higher than `1` for a high availability mode where multiple Teleport pods will be deployed and connections will be load balanced between them.
-
-<Admonition type="note">
-  Setting `highAvailability.replicaCount` to a value higher than `1` will disable the use of ACME certs.
-</Admonition>
-
-<Admonition type="tip" title="Sizing guidelines">
-  As a rough guide, we recommend configuring one replica per distinct availability zone where your cluster has worker nodes.
-
-  2 replicas/availability zones will be fine for smaller workloads. 3-5 replicas/availability zones will be more appropriate for bigger
-  clusters with more traffic.
-</Admonition>
-
-<Admonition type="warning">
-  When using `custom` mode, you **must** use highly-available storage (e.g. etcd, DynamoDB or Firestore) for multiple replicas to be supported.
-
-  [Information on supported Teleport storage backends](../../../architecture/authentication.mdx#storage-back-ends)
-
-  Manually configuring NFS-based storage or `ReadWriteMany` volume claims is **NOT** supported for an HA deployment and will result in errors.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    replicaCount: 3
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set highAvailability.replicaCount=3
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.requireAntiAffinity`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `bool` | `false` | ✅ (when using HA storage) |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
-
-Setting `highAvailability.requireAntiAffinity` to `true` will use `requiredDuringSchedulingIgnoredDuringExecution` to require that multiple
-Teleport pods must not be scheduled on the same physical host.
-
-<Admonition type="warning">
-  This can result in Teleport pods failing to be scheduled in very small clusters or during node downtime, so should be used with caution.
-</Admonition>
-
- Setting `highAvailability.requireAntiAffinity` to `false` (the default) uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
- anti-affinity a soft requirement.
-
-<Admonition type="note">
-  This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    requireAntiAffinity: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set highAvailability.requireAntiAffinity=true
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.podDisruptionBudget`
-
-### `highAvailability.podDisruptionBudget.enabled`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `bool` | `false` | ✅ (when using HA storage) |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
-
-Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    podDisruptionBudget:
-      enabled: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.podDisruptionBudget.enabled=true
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.podDisruptionBudget.minAvailable`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `int` | `1` | ✅ (when using HA storage) |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
-
-Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    podDisruptionBudget:
-      minAvailable: 1
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.podDisruptionBudget.minAvailable=1
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.certManager`
-
-See the [cert-manager](https://cert-manager.io/docs/) docs for more information.
-
-### `highAvailability.certManager.enabled`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `bool` | `false` | ❌ | `proxy_service.https_keypairs` (to provide your own certificates) |
-
-Setting `highAvailability.certManager.enabled` to `true` will use `cert-manager` to provision a TLS certificate for a Teleport
-cluster deployed in HA mode.
-
-<Admonition type="note" title="Installing cert-manager">
-  You must install and configure `cert-manager` in your Kubernetes cluster yourself.
-
-  See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
-  and the relevant sections of the [AWS](../guides/aws.mdx#step-47-install-and-configure-cert-manager) and [GCP](../guides/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
-</Admonition>
-
-### `highAvailability.certManager.addCommonName`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `bool` | `false` | ❌ | `proxy_service.https_keypairs` (to provide your own certificates) |
-
-Setting `highAvailability.certManager.addCommonName` to `true` will instruct `cert-manager` to set the commonName field in its certificate signing request to the issuing CA.
-
-<Admonition type="note" title="Enabling common name field">
-  You must install and configure `cert-manager` in your Kubernetes cluster yourself.
-
-  See the [cert-manager Helm install instructions](https://cert-manager.io/docs/installation/kubernetes/#option-2-install-crds-as-part-of-the-helm-release)
-  and the relevant sections of the [AWS](../guides/aws.mdx#step-47-install-and-configure-cert-manager) and [GCP](../guides/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    certManager:
-      enabled: true
-      addCommonName: true
-      issuerName: letsencrypt-production
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set highAvailability.certManager.enabled=true \
-  --set highAvailability.certManager.addCommonName=true \
-  --set highAvailability.certManager.issuerName=letsencrypt-production
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.certManager.issuerName`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `nil` | ❌ | None |
-
-Sets the name of the `cert-manager` `Issuer` or `ClusterIssuer` to use for issuing certificates.
-
-<Admonition type="note" title="Configuring an Issuer">
-  You must install configure an appropriate `Issuer` supporting a DNS01 challenge yourself.
-
-  Please see the [cert-manager DNS01 docs](https://cert-manager.io/docs/configuration/acme/dns01/#supported-dns01-providers) and the relevant sections
-  of the [AWS](../guides/aws.mdx#step-47-install-and-configure-cert-manager) and [GCP](../guides/gcp.mdx#step-47-install-and-configure-cert-manager) guides for more information.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    certManager:
-      enabled: true
-      issuerName: letsencrypt-production
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set highAvailability.certManager.enabled=true \
-  --set highAvailability.certManager.issuerName=letsencrypt-production
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.certManager.issuerKind`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `Issuer` | ❌ | None |
-
-Sets the `Kind` of `Issuer` to be used when issuing certificates with `cert-manager`. Defaults to `Issuer` to keep permissions
-scoped to a single namespace.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    certManager:
-      issuerKind: ClusterIssuer
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set highAvailability.certManager.issuerKind=ClusterIssuer
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.certManager.issuerGroup`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `cert-manager.io` | ❌ | None |
-
-Sets the `Group` of `Issuer` to be used when issuing certificates with `cert-manager`. Defaults to `cert-manager.io` to use built-in issuers.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    certManager:
-      issuerGroup: cert-manager.io
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set highAvailability.certManager.issuerGroup=cert-manager.io
-  ```
-  </TabItem>
-</Tabs>
-
-## `image`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `quay.io/gravitational/teleport` | ✅ |
-
-`image` sets the container image used for Teleport Community pods in the cluster.
-
-You can override this to use your own Teleport Community image rather than a Teleport-published image.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  image: my.docker.registry/teleport-community-image-name
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set image=my.docker.registry/teleport-community-image-name
-  ```
-  </TabItem>
-</Tabs>
-
-## `enterpriseImage`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `quay.io/gravitational/teleport-ent` | ✅ |
-
-`enterpriseImage` sets the container image used for Teleport Enterprise pods in the cluster.
-
-You can override this to use your own Teleport Enterprise image rather than a Teleport-published image.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  enterpriseImage: my.docker.registry/teleport-enterprise-image-name
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set enterpriseImage=my.docker.registry/teleport-enterprise-image
-  ```
-  </TabItem>
-</Tabs>
-
-## `log`
-
-### `log.level`
-
-<Admonition type="note">
-  This field used to be called `logLevel`. For backwards compatibility this name can still be used, but we recommend changing your values file to use `log.level`.
-</Admonition>
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `INFO` | ❌ | `teleport.log.severity` |
-
-`log.level` sets the log level used for the Teleport process.
-
-Available log levels (in order of most to least verbose) are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
-
-The default is `INFO`, which is recommended in production.
-
-`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    level: DEBUG
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.level=DEBUG
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.output`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `stderr` | ❌ | `teleport.log.output` |
-
-`log.output` sets the output destination for the Teleport process.
-
-This can be set to any of the built-in values: `stdout`, `stderr` or `syslog` to use that destination.
-
-The value can also be set to a file path (such as `/var/log/teleport.log`) to write logs to a file. Bear in mind that a few service startup messages will still go to `stderr` for resilience.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    output: stderr
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.output=stderr
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.format`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `text` | ❌ | `teleport.log.format.output` |
-
-`log.format` sets the output type for the Teleport process.
-
-Possible values are `text` (default) or `json`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    format: json
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.format=json
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.extraFields`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `list` | `["timestamp", "level", "component", "caller"]` | ❌ | `teleport.log.format.extra_fields` |
-
-`log.extraFields` sets the fields used in logging for the Teleport process.
-
-See the [Teleport config file reference](../../../setup/reference/config.mdx) for more details on possible values for `extra_fields`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    extraFields: ["timestamp", "level"]
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set "log.extraFields[0]=timestamp" \
-  --set "log.extraFields[1]=level"
-  ```
-  </TabItem>
-</Tabs>
-
-## `affinity`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅ |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
-
-Kubernetes affinity to set for pod assignments.
-
-<Admonition type="note">
-  You cannot set both `affinity` and `highAvailability.requireAntiAffinity` as they conflict with each other. Only set one or the other.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: gravitational.io/dedicated
-            operator: In
-            values:
-            - teleport
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key=gravitational.io/dedicated \
-  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
-  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=teleport
-  ```
-  </TabItem>
-</Tabs>
-
-## `annotations.config`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `object` | `{}` | ❌ | None |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
-
-<Admonition type="note">
-  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
-  In this instance, you should apply annotations manually to your created `ConfigMap`.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    config:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.config."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.deployment`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `Deployment` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    deployment:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.deployment."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.pod`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to each `Pod` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    pod:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.pod."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.service`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `Service` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    service:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.service."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.serviceAccount`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `serviceAccount` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    serviceAccount:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.serviceAccount."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.certSecret`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `secret` generated by
-`cert-manager` from the `certificate` created by the chart.  Only valid when
-`highAvailability.certManager.enabled` is set to `true` and requires
-`cert-manager` v1.5.0+.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    certSecret:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.certSecret."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `service.type`
-
-| Type | Default value | Required? | Can be used in `custom` mode? |
-| - | - | - | - |
-| `string` | `LoadBalancer` | Yes | ✅ |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/services-networking/service/)
-
-Allows to specify the service type.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  service:
-    type: LoadBalancer
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set service.type=LoadBalancer
-  ```
-  </TabItem>
-</Tabs>
-
-## `service.spec.loadBalancerIP`
-
-| Type | Default value | Required? | Can be used in `custom` mode? |
-| - | - | - | - |
-| `string` | `nil` | No | ✅ |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer)
-
-Allows to specify the `loadBalancerIP`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  service:
-    spec:
-      loadBalancerIP: 1.2.3.4
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set service.spec.loadBalancerIP=1.2.3.4
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraArgs`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-A list of extra arguments to pass to the `teleport start` command when running a Teleport Pod.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraArgs:
-  - "--bootstrap=/etc/teleport-bootstrap/roles.yaml"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraArgs={--bootstrap=/etc/teleport-bootstrap/roles.yaml}"
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraEnv`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
-
-A list of extra environment variables to be set on the main Teleport container.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraEnv:
-  - name: MY_ENV
-    value: my-value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraEnv[0].name=MY_ENV" \
-  --set "extraEnv[0].value=my-value"
-  ```
-  </TabItem>
-</Tabs>
-
-
-## `extraVolumes`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-A list of extra Kubernetes `Volumes` which should be available to any `Pod` created by the chart. These volumes
-will also be available to any `initContainers` configured by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraVolumes:
-  - name: myvolume
-    secret:
-      secretName: mysecret
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraVolumes[0].name=myvolume" \
-  --set "extraVolumes[0].secret.secretName=mysecret"
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraVolumeMounts`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-A list of extra Kubernetes volume mounts which should be mounted into any `Pod` created by the chart. These volume
-mounts will also be mounted into any `initContainers` configured by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraVolumeMounts:
-  - name: myvolume
-    mountPath: /path/to/mount/volume
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraVolumeMounts[0].name=myvolume" \
-  --set "extraVolumeMounts[0].path=/path/to/mount/volume"
-  ```
-  </TabItem>
-</Tabs>
-
-## `imagePullPolicy`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `IfNotPresent` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
-
-Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  imagePullPolicy: Always
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set imagePullPolicy=Always
-  ```
-  </TabItem>
-</Tabs>
-
-## `initContainers`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
-
-A list of `initContainers` which will be run before the main Teleport container in any pod created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  initContainers:
-  - name: teleport-init
-    image: alpine
-    args: ['echo test']
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "initContainers[0].name=teleport-init" \
-  --set "initContainers[0].image=alpine" \
-  --set "initContainers[0].args={echo test}"
-  ```
-  </TabItem>
-</Tabs>
-
-## `postStart`
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/)
-
-A `postStart` lifecycle handler to be configured on the main Teleport container.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  postStart:
-    command:
-    - echo
-    - foo
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set "postStart.command[0]=echo" \
-  --set "postStart.command[1]=foo"
-  ```
-  </TabItem>
-</Tabs>
-
-## `resources`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
-
-Resource requests/limits which should be configured for each container inside the pod. These resource limits
-will also be applied to `initContainers`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  resources:
-    requests:
-      cpu: 1
-      memory: 2Gi
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set resources.requests.cpu=1 \
-  --set resources.requests.memory=2Gi
-  ```
-  </TabItem>
-</Tabs>
-
-## `tolerations`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
-
-Kubernetes Tolerations to set for pod assignment.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  tolerations:
-  - key: "dedicated"
-    operator: "Equal"
-    value: "teleport"
-    effect: "NoSchedule"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set tolerations[0].key=dedicated \
-  --set tolerations[0].operator=Equal \
-  --set tolerations[0].value=teleport \
-  --set tolerations[0].effect=NoSchedule
-  ```
-  </TabItem>
-</Tabs>
-
-## `priorityClassName`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `""` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
-
-Kubernetes PriorityClass to set for pod.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  priorityClassName: "system-cluster-critical"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set priorityClassName=system-cluster-critical
-  ```
-  </TabItem>
-</Tabs>
-
diff --git a/docs/pages/kubernetes-access/helm/reference/teleport-kube-agent.mdx b/docs/pages/kubernetes-access/helm/reference/teleport-kube-agent.mdx
deleted file mode 100644
index ef76f14e59562..0000000000000
--- a/docs/pages/kubernetes-access/helm/reference/teleport-kube-agent.mdx
+++ /dev/null
@@ -1,1334 +0,0 @@
----
-title: teleport-kube-agent Chart Reference
-description: Values that can be set using the teleport-cluster Helm chart
----
-
-The `teleport-kube-agent` Helm chart is used to configure a Teleport agent that
-runs in a remote Kubernetes cluster and joins back to a Teleport cluster to
-provide access to services running there.
-
-You can [browse the source on GitHub](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport-kube-agent).
-
-The `teleport-kube-agent` chart can run any or all of three Teleport services:
-
-| Teleport service | Name for `roles` and `tctl tokens add` | Purpose |
-| - | - | - |
-| [`kubernetes_service`](../../../kubernetes-access/guides.mdx) | `kube` | Uses Teleport to handle authentication with and proxy access to a Kubernetes cluster |
-| [`application_service`](../../../application-access/guides.mdx) | `app` | Uses Teleport to handle authentication with and proxy access to web-based applications |
-| [`database_service`](../../../database-access/guides.mdx) | `db` | Uses Teleport to handle authentication with and proxy access to databases |
-
-This reference details available values for the `teleport-kube-agent` chart.
-
-(!docs/pages/includes/backup-warning.mdx!)
-
-## `roles`
-
-This parameter is not mandatory to preserve backwards compatibility with older chart versions, but we recommend it is set.
-
-| Type | Default value |
-| - | - |
-| `string` | `kube` |
-
-`roles` is a comma-separated list of services which should be enabled when running the `teleport-kube-agent` chart.
-
-| Services | Value for `roles` | Mandatory additional settings for this role |
-| - | - | - |
-| Teleport Kubernetes service | `kube` | [`kubeClusterName`](#kubeclustername) |
-| Teleport Application service | `app` | [`apps`](#apps) |
-| Teleport Database service | `db` | [`databases`](#databases) |
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  roles: kube,app,db
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set roles=kube\,app\,db
-  ```
-
-  <Admonition type="note">
-    When specifying multiple roles using `--set` syntax, you must escape the commas using a backslash (`\`).
-
-    This is a quirk of Helm's CLI parser.
-  </Admonition>
-
-  </TabItem>
-</Tabs>
-
-If you specify a role here, you may also need to specify some other settings which are detailed in this reference.
-
-## `authToken`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `nil` | Yes |
-
-`authToken` provides a Teleport join token which will be used to join the Teleport agent to a Teleport cluster.
-
-This value **must** be provided for the chart to work. The token that you use must also be valid for every Teleport service that you
-are trying to add with the `teleport-kube-agent` chart. Here are a few examples:
-
-| Services | Service Name | `tctl tokens add` example | `teleport.yaml` static token example |
-| - | - | - | - |
-| Kubernetes | `kube` | `tctl tokens add --type=kube` | `"kube:<replace-with-actual-token>"` |
-| Kubernetes, Application | `kube,app` | `tctl tokens add --type=kube,app` | `"kube,app:<replace-with-actual-token>"` |
-| Kubernetes, Application, Database | `kube,app,db` | `tctl tokens add --type=kube,app,db` | `"kube,app,db:<replace-with-actual-token>"` |
-
-<Admonition type="note">
-  When you use a token, all of the services that it provides **must** be used.
-
-  For example, you cannot use a token of type `app,db` to only join a Teleport `app` service by itself. It must join both `app` and `db` services at once.
-
-  Also, each static token you configure must be unique, as the token itself is used to define which services will be supported.
-
-  You cannot reuse the same static token and specify a different set of services.
-</Admonition>
-
-If you do not have the correct services (Teleport refers to these internally as `Roles`) assigned to your join token, the Teleport agent will
-fail to join the Teleport cluster.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  authToken: <replace-with-actual-token>
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set authToken=<replace-with-actual-token>
-  ```
-  </TabItem>
-</Tabs>
-
-## `proxyAddr`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `nil` | Yes |
-
-`proxyAddr` provides the public-facing Teleport proxy endpoint which should be used to join the cluster. This is the same URL that is used
-to access the web UI of your Teleport cluster. It is the same as the value configured for `proxy_service.public_addr` in a traditional
-Teleport cluster. The port used is usually either 3080 or 443.
-
-Here are a few examples:
-
-| Deployment method | Example `proxy_service.public_addr` |
-| - | - |
-| On-prem Teleport cluster | `teleport.example.com:3080` |
-| Teleport Cloud cluster | `example.teleport.sh:443` |
-| `teleport-cluster` Helm chart | `teleport.example.com:443` |
-
-## `kubeClusterName`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `string` | `nil` | When `kube` chart role is used |
-
-`kubeClusterName` sets the name used for the Kubernetes cluster proxied by the Teleport agent. This name will be shown to Teleport users
-connecting to the cluster.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  kubeClusterName: my-gke-cluster
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set kubeClusterName=my-gke-cluster
-  ```
-  </TabItem>
-</Tabs>
-
-## `apps`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `list` | `[]` | When `app` chart role is used? |
-
-`apps` is a YAML list object detailing the applications that should be proxied by Teleport Application access.
-
-You can specify multiple apps by adding additional list elements.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  apps:
-  - name: grafana
-    uri: http://localhost:3000
-    labels:
-      purpose: monitoring
-  - name: jenkins
-    uri: http://jenkins:8080
-    labels:
-      purpose: ci
-  ```
-
-  <Admonition type="note" title="YAML formatting">
-    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
-    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
-  </Admonition>
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "apps[0].name=grafana" \
-  --set "apps[0].uri=http://localhost:3000" \
-  --set "apps[0].purpose=monitoring" \
-  --set "apps[1].name=grafana" \
-  --set "apps[1].uri=http://jenkins:8080" \
-  --set "apps[1].purpose=ci"
-  ```
-
-  <Admonition type="note">
-    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
-  </Admonition>
-
-  </TabItem>
-</Tabs>
-
-<Admonition type="tip" title="Supported values">
-  You can see a list of all the supported [values which can be used in a Teleport application access configuration here](../../../application-access/reference.mdx#configuration).
-</Admonition>
-
-## `awsDatabases`
-
-<Admonition type="tip" title="Database auto-discovery">
-  This section configures database auto-discovery, which is only currently supported on AWS. You can configure databases for other platforms using the [`databases`](#databases) section below this.
-</Admonition>
-
-<Admonition type="note" title="IAM roles">
-  For AWS database auto-discovery to work, your agent pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../../database-access/guides/rds.mdx#step-47-create-an-iam-policy-for-teleport).
-
-  After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions:
-
-  ```
-  annotations:
-    serviceAccount:
-      eks.amazonaws.com/role-arn: arn:aws:iam::1234567890:role/my-rds-autodiscovery-role
-  ```
-</Admonition>
-
-| Type | Default value | Required? |
-| - | - | - |
-| `list` | `[]` | No |
-
-`awsDatabases` is a YAML list object detailing the filters for the AWS databases that should be discovered and proxied by Teleport Database access.
-
-You can specify multiple database filters by adding additional list elements.
-
-- `types` is a list containing the types of AWS databases that should be discovered.
-- `regions` is a list of AWS regions which should be scanned for databases.
-- `tags` can be used to set AWS tags that must be matched for databases to be discovered.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  awsDatabases:
-    - types: ["rds"]
-      regions: ["us-east-1", "us-west-2"]
-      tags:
-        "environment": "production"
-    - types: ["rds"]
-      regions: ["us-east-1"]
-      tags:
-        "environment": "dev"
-    - types: ["rds"]
-      regions: ["eu-west-1"]
-      tags:
-        "*": "*"
-  ```
-
-  <Admonition type="note" title="YAML formatting">
-    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
-    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
-  </Admonition>
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set "awsDatabases[0].types[0]=rds" \
-  --set "awsDatabases[0].regions[0]=us-east-1" \
-  --set "awsDatabases[0].regions[1]=us-west-2" \
-  --set "awsDatabases[0].tags[0].environment=production" \
-  --set "awsDatabases[1].types[0]=rds" \
-  --set "awsDatabases[1].regions[0]=us-east-1" \
-  --set "awsDatabases[1].tags[0].environment=dev" \
-  --set "awsDatabases[2].types[0]=rds" \
-  --set "awsDatabases[2].regions[0]=eu-west-1" \
-  --set "awsDatabases[2].tags[0].*=*"
-  ```
-
-  <Admonition type="note">
-    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
-  </Admonition>
-
-  </TabItem>
-</Tabs>
-
-## `databases`
-
-| Type | Default value | Required? |
-| - | - | - |
-| `list` | `[]` | When `db` chart role is used |
-
-`databases` is a YAML list object detailing the databases that should be proxied by Teleport Database access.
-
-You can specify multiple databases by adding additional list elements.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  databases:
-  - name: aurora-postgres
-    uri: postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432
-    protocol: postgres
-    aws:
-      region: us-east-1
-    static_labels:
-      env: staging
-  - name: mysql
-    uri: mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306
-    protocol: mysql
-    aws:
-      region: us-east-1
-    static_labels:
-      env: staging
-  ```
-
-  <Admonition type="note" title="YAML formatting">
-    YAML is very sensitive to correct spacing. When specifying lists in a `values.yaml` file, you might like
-    to [use a linter](https://codebeautify.org/yaml-validator) to validate your YAML list and ensure that it is correctly formatted.
-  </Admonition>
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "databases[0].name=aurora" \
-  --set "databases[0].uri=postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432" \
-  --set "databases[0].protocol=postgres" \
-  --set "databases[0].aws.region=us-east-1" \
-  --set "databases[0].static_labels.env=staging" \
-  --set "databases[1].name=mysql" \
-  --set "databases[1].uri=mysql-instance-1.xxx.us-east-1.rds.amazonaws.com:3306" \
-  --set "databases[1].protocol=mysql" \
-  --set "databases[1].aws.region=us-east-1" \
-  --set "databases[1].static_labels.env=staging"
-  ```
-
-  <Admonition type="note">
-    Note that when using `--set` syntax, YAML list elements must be indexed starting at `0`.
-  </Admonition>
-
-  </TabItem>
-</Tabs>
-
-<Admonition type="tip" title="Supported values">
-  You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../../database-access/reference/configuration.mdx).
-</Admonition>
-
-## `teleportVersionOverride`
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-Normally the version of Teleport being used will match the version of the chart being installed. If you install chart version
-7.0.0, you'll be using Teleport 7.0.0.
-
-You can optionally override this to use a different published Teleport Docker image tag like `6.0.2` or `7`.
-
-See [this link for information on Community Docker image versions](../../../setup/guides/docker.mdx#step-14-pick-your-image).
-
-<Admonition type="note">
-  The `teleport-kube-agent` chart always runs using Teleport Community edition as it does not require any Enterprise features, so it does
-  not require a Teleport license file to be provided.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  teleportVersionOverride: "7"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set teleportVersionOverride="7"
-  ```
-  </TabItem>
-</Tabs>
-
-## `insecureSkipProxyTLSVerify`
-
-| Type | Default value |
-| - | - |
-| `bool` | `false` |
-
-When `insecureSkipProxyTLSVerify` is set to `true`, the agent will skip the verification of the TLS certificate presented by the Teleport
-proxy server specified using [`proxyAddr`](#proxyaddr).
-
-This can be used for joining a Teleport agent to a Teleport cluster which does not have valid TLS certificates for testing.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  insecureSkipProxyTLSVerify: false
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set insecureSkipProxyTLSVerify=false
-  ```
-  </TabItem>
-</Tabs>
-
-<Admonition type="warning">
-  Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
-  cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
-
-  One option might be to use Teleport's built-in [ACME support](./teleport-cluster.mdx#acme) or enable [cert-manager support](./teleport-cluster.mdx#highavailabilitycertmanager).
-</Admonition>
-
-## `existingDataVolume`
-
-| Type | Default value |
-| - | - |
-| `string` | `""` |
-
-When `existingDataVolume` is set to the name of an existing volume, the `/var/lib/teleport` mount will use this volume instead of creating a new `emptyDir` volume.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  existingDataVolume: my-volume
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set existingDataVolume=my-volume
-  ```
-  </TabItem>
-</Tabs>
-
-## `podSecurityPolicy`
-
-### `podSecurityPolicy.enabled`
-
-| Type | Default value |
-| - | - |
-| `bool` | `true` |
-
-By default, Teleport charts also install a [`podSecurityPolicy`](https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-kube-agent/templates/psp.yaml).
-
-To disable this, you can set `enabled` to `false`.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  podSecurityPolicy:
-    enabled: false
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set podSecurityPolicy.enabled=false
-  ```
-  </TabItem>
-</Tabs>
-
-## `labels`
-
-| Type | Default value |
-| - | - |
-| `object` | `{}` |
-
-`labels` can be used to add a map of key-value pairs for the `kubernetes_service` which is deployed using the `teleport-kube-agent` chart.
-These labels can then be used with Teleport's RBAC policies to define access rules for the cluster.
-
-<Admonition type="note">
-  These are Teleport-specific RBAC labels, not Kubernetes labels.
-</Admonition>
-
-<Admonition type="note">
-  For historical/backwards compatibility reasons, these labels will only be applied to the Kubernetes cluster being joined via the
-  Teleport Kubernetes service.
-
-  To set labels for applications, add a `labels` element to the [`apps`](#apps) section.
-  To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section.
-
-  For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../../setup/admin/labels.mdx).
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  labels:
-    environment: production
-    region: us-east
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set labels.environment=production \
-  --set labels.region=us-east
-  ```
-  </TabItem>
-</Tabs>
-
-## `storage`
-
-### `storage.enabled`
-
-| Type | Default value |
-| - | - |
-| `bool` | `false` |
-
-Enables the creation of a Kubernetes persistent volume to hold Teleport agent state.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  storage:
-    enabled: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set storage.enabled=true
-  ```
-  </TabItem>
-</Tabs>
-
-### `storage.storageClassName`
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-The storage class name the persistent volume should use when creating persistent volume claims. The provided storage class
-name needs to exist on the Kubernetes cluster for Teleport to use.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/storage-classes/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  storage:
-    storageClassName: teleport-storage-class
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set storage.storageClassName=teleport-storage-class
-  ```
-  </TabItem>
-</Tabs>
-
-### `storage.requests`
-
-| Type | Default value |
-| - | - |
-| `string` | `128Mi` |
-
-The size of persistent volume to create.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  storage:
-    requests: 128Mi
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set storage.requests=128Mi
-  ```
-  </TabItem>
-</Tabs>
-
-## `image`
-
-| Type | Default value |
-| - | - |
-| `string` | `quay.io/gravitational/teleport` |
-
-`image` sets the container image used for Teleport pods run by the `teleport-kube-agent` chart.
-
-You can override this to use your own Teleport image rather than a Teleport-published image.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  image: my.docker.registry/teleport-image-name
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set image=my.docker.registry/teleport-image-name
-  ```
-  </TabItem>
-</Tabs>
-
-## `imagePullSecrets`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
-
-A list of secrets containing authorization tokens which can be optionally used to access a private Docker registry.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  imagePullSecrets:
-  - name: my-docker-registry-key
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set "imagePullSecrets[0].name=my-docker-registry-key"
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability`
-
-## `highAvailability.replicaCount`
-
-| Type | Default value |
-| - | - |
-| `int` | `1` |
-
-`highAvailability.replicaCount` can be used to set the number of replicas used in the deployment.
-
-Set to a number higher than `1` for a high availability mode where multiple Teleport agent pods will be deployed.
-
-<Admonition type="tip" title="Sizing guidelines">
-  As a rough guide, we recommend configuring one replica per distinct availability zone where your cluster has worker nodes.
-
-  2 replicas/availability zones will be fine for smaller workloads. 3-5 replicas/availability zones will be more appropriate for bigger
-  clusters with more traffic.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    replicaCount: 3
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.replicaCount=3
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.requireAntiAffinity`
-
-| Type | Default value |
-| - | - |
-| `bool` | `false` |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
-
-Setting `highAvailability.requireAntiAffinity` to `true` will use `requiredDuringSchedulingIgnoredDuringExecution` to require that multiple
-Teleport pods must not be scheduled on the same physical host.
-
-<Admonition type="warning">
-  This can result in Teleport pods failing to be scheduled in very small clusters or during node downtime, so should be used with caution.
-</Admonition>
-
- Setting `highAvailability.requireAntiAffinity` to `false` (the default) uses `preferredDuringSchedulingIgnoredDuringExecution` to make node
- anti-affinity a soft requirement.
-
-<Admonition type="note">
-  This setting only has any effect when `highAvailability.replicaCount` is greater than `1`.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    requireAntiAffinity: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.requireAntiAffinity=true
-  ```
-  </TabItem>
-</Tabs>
-
-## `highAvailability.podDisruptionBudget`
-
-### `highAvailability.podDisruptionBudget.enabled`
-
-| Type | Default value |
-| - | - |
-| `bool` | `false` |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
-
-Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    podDisruptionBudget:
-      enabled: true
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.podDisruptionBudget.enabled=true
-  ```
-  </TabItem>
-</Tabs>
-
-### `highAvailability.podDisruptionBudget.minAvailable`
-
-| Type | Default value |
-| - | - |
-| `int` | `1` |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
-
-Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  highAvailability:
-    podDisruptionBudget:
-      minAvailable: 1
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```shell
-  --set highAvailability.podDisruptionBudget.minAvailable=1
-  ```
-  </TabItem>
-</Tabs>
-
-## `clusterRoleName`
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-`clusterRoleName` can be optionally used to override the name of the Kubernetes `ClusterRole` used by the `teleport-kube-agent` chart's `ServiceAccount`.
-
-<Admonition type="note">
-  Most users will not need to change this.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  clusterRoleName: kubernetes-clusterrole
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set clusterRoleName=kubernetes-clusterrole
-  ```
-  </TabItem>
-</Tabs>
-
-## `clusterRoleBindingName`
-
-<Admonition type="note">
-  Most users will not need to change this.
-</Admonition>
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-
-`clusterRoleBindingName` can be optionally used to override the name of the Kubernetes `ClusterRoleBinding` used by the `teleport-kube-agent` chart's `ServiceAccount`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  clusterRoleBindingName: kubernetes-clusterrolebinding
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set clusterRoleBindingName=kubernetes-clusterrolebinding
-  ```
-  </TabItem>
-</Tabs>
-
-## `serviceAccountName`
-
-<Admonition type="note">
-  Most users will not need to change this.
-</Admonition>
-
-| Type | Default value |
-| - | - |
-| `string` | `nil` |
-
-`serviceAccountName` can be optionally used to override the name of the Kubernetes `ServiceAccount` used by the `teleport-kube-agent` chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  serviceAccountName: kubernetes-serviceaccount
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set serviceAccountName=kubernetes-serviceaccount
-  ```
-  </TabItem>
-</Tabs>
-
-## `secretName`
-
-| Type | Default value |
-| - | - |
-| `string` | `teleport-kube-agent-join-token` |
-
-`secretName` is the name of the Kubernetes `Secret` used to store the Teleport join token which is used by the `teleport-kube-agent` chart.
-
-If you set this to a blank value, the chart will not attempt to create the secret itself and will instead read the value of the
-existing `teleport-kube-agent-join-token` secret. This allows you to configure this secret externally and avoid having a plaintext
-join token stored in your Teleport chart values.
-
-To create your own join token secret, you can use a command like this:
-
-```code
-$ kubectl --namespace teleport create secret generic teleport-kube-agent-join-token --from-literal=auth-token=<replace-with-actual-token>
-```
-
-<Admonition type="note">
-  The key used for the auth token inside the secret must be `auth-token`, as in the command above.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  serviceAccountName:
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set serviceAccountName=""
-  ```
-  </TabItem>
-</Tabs>
-
-## `log`
-
-### `log.level`
-
-<Admonition type="note">
-  This field used to be called `logLevel`. For backwards compatibility this name can still be used, but we recommend changing your values file to use `log.level`.
-</Admonition>
-
-| Type | Default value |
-| - | - |
-| `string` | `INFO` |
-
-`log.level` sets the log level used for the Teleport process.
-
-Available log levels (in order of most to least verbose) are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
-
-The default is `INFO`, which is recommended in production.
-
-`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    level: DEBUG
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.level=DEBUG
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.output`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `stderr` | ❌ | `teleport.log.output` |
-
-`log.output` sets the output destination for the Teleport process.
-
-This can be set to any of the built-in values: `stdout`, `stderr` or `syslog` to use that destination.
-
-The value can also be set to a file path (such as `/var/log/teleport.log`) to write logs to a file. Bear in mind that a few service startup messages will still go to `stderr` for resilience.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    output: stderr
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.output=stderr
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.format`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `string` | `text` | ❌ | `teleport.log.format.output` |
-
-`log.format` sets the output type for the Teleport process.
-
-Possible values are `text` (default) or `json`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    format: json
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set log.format=json
-  ```
-  </TabItem>
-</Tabs>
-
-### `log.extraFields`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `list` | `["timestamp", "level", "component", "caller"]` | ❌ | `teleport.log.format.extra_fields` |
-
-`log.extraFields` sets the fields used in logging for the Teleport process.
-
-See the [Teleport config file reference](../../../setup/reference/config.mdx) for more details on possible values for `extra_fields`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  log:
-    extraFields: ["timestamp", "level"]
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  --set "log.extraFields[0]=timestamp" \
-  --set "log.extraFields[1]=level"
-  ```
-  </TabItem>
-</Tabs>
-
-## `affinity`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅ |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
-
-Kubernetes affinity to set for pod assignments.
-
-<Admonition type="note">
-  You cannot set both `affinity` and `highAvailability.requireAntiAffinity` as they conflict with each other.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: gravitational.io/dedicated
-            operator: In
-            values:
-            - teleport
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key=gravitational.io/dedicated \
-  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator=In \
-  --set affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values[0]=teleport
-  ```
-  </TabItem>
-</Tabs>
-
-## `nodeSelector`
-
-| Type | Default value |
-| - | - |
-| `object` | `{}` |
-
-`nodeSelector` can be used to add a map of key-value pairs to constrain the nodes the agent pods will run on.
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/)
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  nodeSelector:
-    role: node
-    region: us-east
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```bash
-  --set nodeSelector.role=node \
-  --set nodeSelector.region=us-east
-  ```
-  </TabItem>
-</Tabs>
-
-## `annotations.config`
-
-| Type | Default value | Can be used in `custom` mode? | `teleport.yaml` equivalent |
-| - | - | - | - |
-| `object` | `{}` | ❌ | None |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `ConfigMap` created by the chart.
-
-<Admonition type="note">
-  These annotations will not be applied in `custom` mode, as the `ConfigMap` is not managed by the chart.
-  In this instance, you should apply annotations manually to your created `ConfigMap`.
-</Admonition>
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    config:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.config."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.deployment`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `Deployment` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    deployment:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.deployment."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.pod`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to each `Pod` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    pod:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.pod."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `annotations.serviceAccount`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-
-Kubernetes annotations which should be applied to the `ServiceAccount` created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  annotations:
-    serviceAccount:
-      kubernetes.io/annotation: value
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set annotations.serviceAccount."kubernetes\.io\/annotation"=value
-  ```
-  <Admonition type="warning" title="Escaping values">
-    You must escape values entered on the command line correctly for Helm's CLI to understand them. We recommend
-    using a `values.yaml` file instead to avoid confusion and errors.
-  </Admonition>
-  </TabItem>
-</Tabs>
-
-## `extraVolumes`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-A list of extra Kubernetes `Volumes` which should be available to any `Pod` created by the chart. These volumes
-will also be available to any `initContainers` configured by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraVolumes:
-  - name: myvolume
-    secret:
-      secretName: mysecret
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraVolumes[0].name=myvolume" \
-  --set "extraVolumes[0].secret.secretName=mysecret"
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraArgs`
-
-| Type | Default value |
-| - | - |
-| `list` | `[]` |
-
-A list of extra arguments to pass to the `teleport start` command when running a Teleport Pod.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraArgs:
-  - "--debug"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraArgs={--debug}"
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraEnv`
-
-| Type | Default value |
-| - | - |
-| `list` | `[]` |
-
-[Kubernetes reference](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
-
-A list of extra environment variables to be set on the main Teleport container.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraEnv:
-  - name: HTTPS_PROXY
-    value: "http://username:password@my.proxy.host:3128"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraEnv[0].name=HTTPS_PROXY" \
-  --set "extraEnv[0].value=\"http://username:password@my.proxy.host:3128\""
-  ```
-  </TabItem>
-</Tabs>
-
-## `extraVolumeMounts`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-A list of extra Kubernetes volume mounts which should be mounted into any `Pod` created by the chart. These volume
-mounts will also be mounted into any `initContainers` configured by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  extraVolumeMounts:
-  - name: myvolume
-    mountPath: /path/to/mount/volume
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "extraVolumeMounts[0].name=myvolume" \
-  --set "extraVolumeMounts[0].path=/path/to/mount/volume"
-  ```
-  </TabItem>
-</Tabs>
-
-## `imagePullPolicy`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `string` | `IfNotPresent` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
-
-Allows the `imagePullPolicy` for any pods created by the chart to be overridden.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  imagePullPolicy: Always
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set imagePullPolicy=Always
-  ```
-  </TabItem>
-</Tabs>
-
-## `initContainers`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
-
-A list of `initContainers` which will be run before the main Teleport container in any pod created by the chart.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  initContainers:
-  - name: teleport-init
-    image: alpine
-    args: ['echo test']
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set "initContainers[0].name=teleport-init" \
-  --set "initContainers[0].image=alpine" \
-  --set "initContainers[0].args={echo test}"
-  ```
-  </TabItem>
-</Tabs>
-
-## `resources`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `object` | `{}` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
-
-Resource requests/limits which should be configured for each container inside the pod. These resource limits
-will also be applied to `initContainers`.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  resources:
-    requests:
-      cpu: 1
-      memory: 2Gi
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set resources.requests.cpu=1 \
-  --set resources.requests.memory=2Gi
-  ```
-  </TabItem>
-</Tabs>
-
-## `tolerations`
-
-| Type | Default value | Can be used in `custom` mode? |
-| - | - | - |
-| `list` | `[]` | ✅  |
-
-[Kubernetes reference](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
-
-Kubernetes Tolerations to set for pod assignment.
-
-<Tabs>
-  <TabItem label="values.yaml">
-  ```yaml
-  tolerations:
-  - key: "dedicated"
-    operator: "Equal"
-    value: "teleport"
-    effect: "NoSchedule"
-  ```
-  </TabItem>
-  <TabItem label="--set">
-  ```code
-  $ --set tolerations[0].key=dedicated \
-  --set tolerations[0].operator=Equal \
-  --set tolerations[0].value=teleport \
-  --set tolerations[0].effect=NoSchedule
-  ```
-  </TabItem>
-</Tabs>
diff --git a/docs/pages/kubernetes-access/introduction.mdx b/docs/pages/kubernetes-access/introduction.mdx
index 10b0b25971ce4..792a420eccbb3 100644
--- a/docs/pages/kubernetes-access/introduction.mdx
+++ b/docs/pages/kubernetes-access/introduction.mdx
@@ -5,8 +5,8 @@ description: Teleport Kubernetes Access introduction, demo, and resources.
 
 Teleport provides secure access for Kubernetes clusters.
 
-- Users can receive short-lived kubeconfig files (and certificates) using Single Sign-On (SSO) and switch between clusters without logging in twice.
-- Admins can use roles to implement policies, such as the best practice that developers must not access production.
+- Users can receive short-lived kubeconfigs (and certificates) using Single Sign-On (SSO) and switch between clusters without logging in twice.
+- Admins can use *roles* to implement policies like the best practice that *developers must not access production* and enforce dual authorization using [access requests](../enterprise/workflow/index.mdx) for privileged operations.
 - Organizations can achieve compliance by capturing `kubectl` events and session recordings for `kubectl`.
 
 ## SSO and Audit for Kubernetes Clusters
@@ -33,7 +33,7 @@ Set up SSO, capture audit events, and sessions with Teleport running in a Kubern
 
 ## Getting started
 
-Configure Kubernetes Access in a ten-minute [Getting Started](./getting-started.mdx) guide.
+Configure Kubernetes Access in a 10 minute [Getting Started](./getting-started.mdx) guide.
 
 ## Guides
 
@@ -44,6 +44,9 @@ Configure Kubernetes Access in a ten-minute [Getting Started](./getting-started.
   <Tile icon="kubernetes" title="Teleport Kubernetes Access and Trusted Clusters" href="./guides/federation.mdx">
     Federated Access using Teleport Trusted Clusters.
   </Tile>
+  <Tile icon="kubernetes" title="Kubernetes Migration Guide" href="./guides/migration.mdx">
+    Kubernetes Pre-5.0 Migration Guide.
+  </Tile>
   <Tile icon="kubernetes" title="Kubernetes Access Multiple Clusters" href="./guides/multiple-clusters.mdx">
     Connecting Multiple Clusters with Teleport Kubernetes Access.
   </Tile>
diff --git a/docs/pages/machine-id/getting-started.mdx b/docs/pages/machine-id/getting-started.mdx
deleted file mode 100644
index a88bdc0fb73b2..0000000000000
--- a/docs/pages/machine-id/getting-started.mdx
+++ /dev/null
@@ -1,236 +0,0 @@
----
-title: Machine ID Getting Started Guide
-description: Getting started with Teleport Machine ID
----
-
-In this getting started guide, you will use Machine ID to create a bot user for
-a machine and use that identity to connect to said machine.
-
-Here's an overview of what you will do:
-
-1. Download and install Teleport (=teleport.version=)
-2. Create a bot user
-3. Start Machine ID
-4. Use certificates issued by Machine ID to connect to a remote machine
-
-## Prerequisites
-
-Before using Machine ID, you will need an existing Teleport cluster or a
-Teleport Cloud account.
-
-If you have not set up a Teleport cluster before, follow the
-[Getting started](https://goteleport.com/docs/getting-started) guide.
-
-## Step 1/4. Download and install Teleport (=teleport.version=)
-
-In this step, you will be downloading and installing Teleport binaries onto the
-machine you wish to assign an identity to. 
-
-Each Teleport package hosted on our
-downloads page ships with several useful binaries, including `teleport`,
-`tctl`, `tsh`, and `tbot`:
-
-- `teleport` is the daemon used to initialize a Teleport cluster; this binary is not used in this guide
-- `tctl` is the administrative tool you will use to create the bot user (step 1/4)
-- `tsh` is the client tool you will use to log in to the Teleport Cluster (steps 2/4 and 4/4)
-- `tbot` is the Machine ID tool you will use to associate a bot user with a machine (step 3/4)
-
-Machine ID is available starting from the Teleport `9.0.0` release. Download
-the appropriate Teleport package for your platform from our
-[downloads page](https://goteleport.com/teleport/download).
-
-## Step 2/4. Create a bot user
-
-Before you create a bot user, you need to determine which role(s) you want to
-assign to it. You can use the `tctl` command below to examine what roles exist
-on your system.
-
-<Details scope={["cloud"]} scopeOnly={true}>
-On your client machine, log in to Teleport using `tsh`, then use `tctl` to examine
-what roles exist on your system.
-</Details>
-<Details scope={["oss","enterprise"]} scopeOnly={true}>
-Connect to the Teleport Auth Server and use `tctl` to examine what roles exist on
-your system.
-</Details>
-
-```code
-$ tctl get roles --format=text
-```
-
-You will see something like the output below on a fresh install of Teleport with the
-default roles—your cluster may have different roles. In this example, let's
-assume you want to give the bot the `access` role to allow it to connect to
-machines within your cluster.
-
-```
-Role    Allowed to login as                           Node Labels Access to resources
-------- --------------------------------------------- ----------- ----------------------------------------
-access  {{internal.logins}}                           <all nodes> event:list,read,session:read,list
-auditor no-login-6566121f-b602-47f1-a118-c9c618ee5aec             session:list,read,event:list,read
-editor                                                            user:list,create,read,update,delete,...
-```
-
-Machine ID can join with a token or the [IAM Method](https://goteleport.com/docs/setup/guides/joining-nodes-aws) on AWS.
-
-<Tabs>
-  <TabItem label="Token-based Joining">
-  ```code
-  $ tctl bots add robot --roles=access
-  ```
-  </TabItem>
-  <TabItem label="IAM Method">
-  First, create an IAM method token that specifies the AWS account from which
-  the bot can join.
-
-  ```
-  kind: token
-  version: v2
-  metadata:
-    # The token name is not a secret because instances must prove that they are
-    # running in your AWS account to use this token.
-    name: iam-token
-    # Set a long expiry time for how long you want to support IAM method for
-    # joining. It is safe to set this value to a very long time.
-    expires: "3000-01-01T00:00:00Z"
-  spec:
-    # Only allow bots to join using this token.
-    roles: [Bot]
-  
-    # Set the join method to be IAM.
-    join_method: iam
-
-    # Define the name of the bot that will be allowed to use this token.
-    bot_name: robot
-  
-    allow:
-    # Restrict the AWS account and (optionally) ARN that can use this token.
-    # This information can be obtained from running the
-    # "aws sts get-caller-identity" command from the CLI.
-    - aws_account: "111111111111"
-      aws_arn: "arn:aws:sts::111111111111:assumed-role/teleport-bot-role/i-*"
-  ```
-
-  Next, create the bot user.
-
-  ```
-  $ tctl bots add robot --token=iam-token --roles=access
-  ```
-  </TabItem>
-</Tabs>
-
-## Step 3/4. Start Machine ID
-
-Now start Machine ID using the `tbot` binary. The `tbot start` command will
-start running Machine ID in a loop, writing renewable certificates to
-`/var/lib/teleport/bot` and the short-lived certificates your application will
-use to `/opt/machine-id`.
-
-In a production environment you will want to run Machine ID in the background
-using a service manager like systemd. However, in this guide you will run it in
-the foreground to better understand how it works.
-
-<Tabs>
-  <TabItem label="Token-based Joining">
-  ```code
-  $ tbot start \
-     --data-dir=/var/lib/teleport/bot \
-     --destination-dir=/opt/machine-id \
-     --token=00000000000000000000000000000000 \
-     --join-method=token \
-     --ca-pin=sha256:1111111111111111111111111111111111111111111111111111111111111111 \
-     --auth-server=auth.example.com:3025
-  ```
-  </TabItem>
-  <TabItem label="IAM Method">
-  ```code
-  $ tbot start \
-     --data-dir=/var/lib/teleport/bot \
-     --destination-dir=/opt/machine-id \
-     --token=iam-token \
-     --join-method=iam \
-     --ca-pin=sha256:1111111111111111111111111111111111111111111111111111111111111111 \
-     --auth-server=auth.example.com:3025
-  ```
-  </TabItem>
-</Tabs>
-
-Replace the following fields with values from your own cluster.
-
-<Details scope={["cloud"]} scopeOnly={true}>
-- `token` is the token output by the `tctl bots add` command or the name of your IAM method token
-- `ca-pin` is the CA Pin for your Teleport cluster, and is output by the `tctl bots add` command
-- `destination-dir` is where Machine ID writes renewable certificates, which are only used by Machine ID and should not be used by applications and tools
-- `data-dir` is where Machine ID writes the short-lived certificate. This certificate should be used by applications and tools
-- `auth-server` is the address of your Teleport Cloud Proxy Server, for example `example.teleport.sh:443`
-</Details>
-<Details scope={["oss","enterprise"]} scopeOnly={true}>
-- `token` is the token output by the `tctl bots add` command or the name of your IAM method token
-- `ca-pin` is the CA Pin for your Teleport cluster, and is output by the `tctl bots add` command
-- `destination-dir` is where Machine ID writes renewable certificates, which are only used by Machine ID and should not be used by applications and tools
-- `data-dir` is where Machine ID writes the short-lived certificate. This certificate should be used by applications and tools
-- `auth-server` is the address of your Teleport Auth Server, for example `auth.example.com:3025`
-</Details>
-
-Now that Machine ID has successfully started, let's investigate the
-`/opt/machine-id` directory to see what was written to disk.
-
-```code
-$ tree /opt/machine-id
-machine-id
-├── key
-├── key.pub
-├── known_hosts
-├── ssh_config
-├── sshcacerts
-├── sshcert
-├── tlscacerts
-└── tlscert
-
-0 directories, 8 files
-```
-
-This directory contains private key material in the `key.*` files, SSH
-certificates in the `ssh*` files, X.509 certificates in the `tls*` files, and
-OpenSSH configuration in the `ssh_config` and `known_hosts` files to make it easy
-to integrate Machine ID with external applications and tools.
-
-## Step 4/4. Use certificates issued by Machine ID
-
-To use Machine ID, find a host that you want to connect to within your cluster
-using `tsh ls`. You might see output like the following on your system.
-
-```code
-$ tsh ls
-Node Name Address        Labels                        
---------- -------------- ----------------------------- 
-node-name  127.0.0.1:3022 arch=x86_64,group=api-servers 
-```
-
-To use Machine ID with the OpenSSH integration, run the following command to
-connect to `node-name` within cluster `example.com`.
-
-```
-ssh -F /opt/machine-id/ssh_config root@node-name.example.com
-```
-
-<Admonition type="note" title="Roles must have logins defined">
-  If you see the below error, it means the user you are trying to log in as is
-  not specified under `logins` in the role you are using.
-
-  ```code
-  $ ssh -F /opt/machine-id/ssh_config root@node-name.example.com
-  root@node-name: Permission denied (publickey).
-  kex_exchange_identification: Connection closed by remote host
-  ```
-
-  If you have been following along with the `access` role, do the following.
-
-  - Export the role by running `tctl get roles/access > access.yaml`
-  - Edit the `logins` field in `access.yaml`
-  - Update the role by running `tctl create -f access.yaml`
-</Admonition>
-
-Now you can replace any invocations of `ssh` with the above command to provide
-your applications and tools a machine identity that can be rotated, audited,
-and controlled with all the familiar Teleport access controls.
diff --git a/docs/pages/machine-id/guides.mdx b/docs/pages/machine-id/guides.mdx
deleted file mode 100644
index c9d0d52ba76aa..0000000000000
--- a/docs/pages/machine-id/guides.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Machine ID Guides
-description: Teleport Machine ID guides.
-layout: tocless-doc
----
-
-<TileSet>
-  <Tile icon="server" title="Using Teleport Machine ID with Ansible" href="./guides/ansible.mdx">
-    How to integrate Teleport Machine ID with Ansible.
-  </Tile>
-</TileSet>
diff --git a/docs/pages/machine-id/guides/ansible.mdx b/docs/pages/machine-id/guides/ansible.mdx
deleted file mode 100644
index b69462fd2766d..0000000000000
--- a/docs/pages/machine-id/guides/ansible.mdx
+++ /dev/null
@@ -1,122 +0,0 @@
----
-title: Using Teleport Machine ID with Ansible
-description: Using Teleport Machine ID with Ansible
----
-
-In this guide, you will set up an Ansible playbook to run the OpenSSH client
-with a configuration file that is automatically managed by Machine ID.
-
-## Prerequisites
-
-You will need the following tools to use Teleport with Ansible.
-
-- [Teleport Enterprise](../../enterprise/introduction.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= 9.0.0
-- `ssh` OpenSSH tool
-- `ansible` >= (=ansible.min_version=)
-- Optional tool `jq` to process `JSON` output
-
-In addition, if you already have not done so, follow the
-[Machine ID Getting Started Guide](../getting-started.mdx) to create a bot
-user and start Machine ID.
-
-If you followed the above guide, you are interested in the
-`--destination-dir=/opt/machine-id` flag, which defines the directory where
-SSH certificates and OpenSSH configuration used by Ansible will be written.
-
-In particular, you will be using the `/opt/machine-id/ssh_config` file in your
-Ansible configuration to define how Ansible should connect to Teleport Nodes.
-
-## Step 1/2. Configure Ansible
-
-Create a folder named `ansible` where all Ansible files will be collected.
-
-```code
-$ mkdir -p ansible
-$ cd ansible
-```
-
-Create a file called `ansible.cfg`. We will configure Ansible 
-to run the OpenSSH client with the configuration file generated 
-by Machine ID, `/opt/machine-id/ssh_config`.
-
-```
-[defaults]
-host_key_checking = True
-inventory=./hosts
-remote_tmp=/tmp
-
-[ssh_connection]
-scp_if_ssh = True
-ssh_args = -F /opt/machine-id/ssh_config
-```
-
-You can create an inventory file called `hosts` manually or use a script like the one
-below to generate it from your environment. Note, `example.com` here is the
-name of your Teleport cluster.
-
-```code
-$ tsh ls --format=json | jq -r '.[].spec.hostname + ".example.com"' > hosts
-```
-
-## Step 2/2. Run a playbook
-
-Finally, let's create a simple Ansible playbook, `playbook.yaml`.
-
-The playbook below runs `hostname` on all hosts. Make sure to set the
-`remote_user` parameter to a valid SSH username that works with the target host
-and is allowed by Teleport RBAC.
-
-```yaml
-- hosts: all
-  remote_user: ubuntu
-  tasks:
-    - name: "hostname"
-      command: "hostname"
-```
-
-From the folder `ansible`, run the Ansible playbook:
-
-```code
-$ ansible-playbook playbook.yaml 
-
-# PLAY [all] *****************************************************************************************************************************************
-# TASK [Gathering Facts] *****************************************************************************************************************************
-#
-# ok: [terminal]
-#
-# TASK [hostname] ************************************************************************************************************************************
-# changed: [terminal]
-#
-# PLAY RECAP *****************************************************************************************************************************************
-# terminal                   : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-```
-
-You are all set. You have provided your machine with short-lived certificates
-tied to a machine identity that can be rotated, audited, and controlled with
-all the familiar Teleport access controls.
-
-## Troubleshooting
-
-In case if Ansible cannot connect, you may see error like this one:
-
-```txt
-example.host | UNREACHABLE! => {
-    "changed": false,
-    "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname node-name: Name or service not known",
-    "unreachable": true
-}
-```
-
-You can examine and tweak patterns matching the inventory hosts in `ssh_config`.
-
-Try the SSH connection using `ssh_config` with verbose mode to inspect the error:
-
-```code
-$ ssh -vvv -F /opt/machine-id/ssh_config root@node-name.example.com
-```
-
-If `ssh` works, try running the playbook with verbose mode on:
-
-```code
-$ ansible-playbook -vvv playbook.yaml
-```
diff --git a/docs/pages/machine-id/introduction.mdx b/docs/pages/machine-id/introduction.mdx
deleted file mode 100644
index 51f0b4dbf0fa2..0000000000000
--- a/docs/pages/machine-id/introduction.mdx
+++ /dev/null
@@ -1,56 +0,0 @@
----
-title: Machine ID
-description: Teleport Machine ID introduction, demo and resources.
----
-
-# Machine ID
-
-Machine ID is a service that programmatically issues and renews short-lived
-certificates to any service account (e.g., a CI/CD server) by retrieving
-credentials from the Teleport Auth Service. This enables fine-grained
-role-based access controls and audit.
-
-Some of the things you can do with Machine ID:
-
-- Machines can retrieve short-lived SSH certificates for CI/CD pipelines.
-- Machines can retrieve short-lived X.509 certificates for use with databases or applications.
-- Configure role-based access controls and locking for machines.
-- Capture access events in the audit log.
-
-{
-/*
-TODO(russjones): Once we have a demo video for Machine ID, include it here.
-
-## Demo
-
-Let's create a bot and use the machine identity to connect to a server.
-
-<video
-  autoPlay
-  loop
-  muted
-  playsInline
-  controls
->
-  <source
-    src="https://goteleport.com/teleport/videos/database-access-preview/dbaccessdemo.mp4"
-    type="video/mp4"
-  />
-
-  <source
-    src="https://goteleport.com/teleport/videos/database-access-preview/dbaccessdemo.webm"
-    type="video/webm"
-  />
-
-  Your browser does not support the video tag.
-</video>
-*/
-}
-
-## Getting started
-
-<TileSet>
-  <Tile icon="wand" title="Getting started" href="./getting-started.mdx">
-    Getting started with Teleport Machine ID
-  </Tile>
-</TileSet>
diff --git a/docs/pages/machine-id/reference.mdx b/docs/pages/machine-id/reference.mdx
deleted file mode 100644
index e309faec20f4e..0000000000000
--- a/docs/pages/machine-id/reference.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Machine ID Reference
-description: Configuration and CLI reference for Teleport Machine ID.
----
-
-
-- [Configuration](./reference/configuration.mdx)
-- [CLI](./reference/cli.mdx)
diff --git a/docs/pages/machine-id/reference/cli.mdx b/docs/pages/machine-id/reference/cli.mdx
deleted file mode 100644
index bc5276be2a147..0000000000000
--- a/docs/pages/machine-id/reference/cli.mdx
+++ /dev/null
@@ -1,90 +0,0 @@
----
-title: Machine ID CLI Reference
-description: CLI reference for Teleport Machine ID.
----
-
-## `tbot start`
-
-Starts the Machine ID client `tbot`, fetching and writing certificates to disk
-at a set interval.
-
-<Details scope={["cloud"]} scopeOnly={true}>
-```code
-$ tbot start \
-   --data-dir=/var/lib/teleport/bot \
-   --destination-dir=/opt/machine-id \
-   --token=00000000000000000000000000000000 \
-   --join-method=token \
-   --ca-pin=sha256:1111111111111111111111111111111111111111111111111111111111111111 \
-   --auth-server=example.teleport.sh:443
-```
-</Details>
-<Details scope={["oss","enterprise"]} scopeOnly={true}>
-```code
-$ tbot start \
-   --data-dir=/var/lib/teleport/bot \
-   --destination-dir=/opt/machine-id \
-   --token=00000000000000000000000000000000 \
-   --join-method=token \
-   --ca-pin=sha256:1111111111111111111111111111111111111111111111111111111111111111 \
-   --auth-server=auth.example.com:3025
-```
-</Details>
-
-| Flag                 | Description                                                                                    |
-|----------------------|------------------------------------------------------------------------------------------------|
-| `-d/--debug`         | Enable verbose logging to stderr.                                                              |
-| `-c/--config`        | Path to a configuration file. Defaults to `/etc/tbot.yaml` if unspecified.                     |
-| `-a/--auth-server`   | Address of the Teleport Auth Server (On-Prem installs) or Teleport Cloud tenant.       |
-| `--token`            | A bot join token, if attempting to onboard a new bot; used on first connect.                   |
-| `--ca-pin`           | CA pin to validate the Teleport Auth Server; used on first connect.                            |
-| `--data-dir`         | Directory to store internal bot data. Access to this directory should be limited.              | 
-| `--destination-dir`  | Directory to write short-lived machine certificates.                                           |
-| `--certificate-ttl`  | TTL of short-lived machine certificates.                                                       |
-| `--renewal-interval` | Interval at which short-lived certificates are renewed; must be less than the certificate TTL. |
-| `--join-method`      | Method to use to join the cluster. Can be `token` or `iam`.                                    |
-| `--one-shot`         | If set, quit after the first renewal.                                                          |
-
-## `tbot init`
-
-If you want to write certificates to disk as a different user than the Machine
-ID client, you can use `tbot init` to configure either file or POSIX ACLs
-permissions. This allows you to lock down access to Machine ID's short-lived
-certificates from other users or applications on the system.
-
-| Flag                | Description                                                                                                        |
-|---------------------|--------------------------------------------------------------------------------------------------------------------|
-| `-d/--debug`        | Enable verbose logging to stderr.                                                                                  |
-| `-c/--config`       | Path to a configuration file. Defaults to `/etc/tbot.yaml` if unspecified.                                         |
-| `--destination-dir` | Directory to write short-lived machine certificates to.                                                            |
-| `--owner`           | Defines the Linux `user:group` owner of `--destination-dir`. Defaults to the Linux user running `tbot` if unspecified. |
-| `--bot-user`        | Enables POSIX ACLs and defines the Linux user that can read/write short-lived certificates to `--destination-dir`.     |
-| `--reader-user`     | Enables POSIX ACLs and defines the Linux user that will read short-lived certificates from `--destination-dir`.        |
-| `--init-dir`        | If using a config file and multiple destinations are configured, controls which destination dir to configure.      |
-| `--clean`           | If set, remove unexpected files and directories from the destination.                                              |
-
-### `tbot init` with file permissions
-
-If running `tbot` as the Linux user `root`, use the following invocation of
-`tbot init` to initialize the short-lived certificate directory
-`/opt/machine-id` with owner `jenkins:jenkins`.
-
-```code
-$ tbot init \
-    --destination-dir=/opt/machine-id \
-    --owner=jenkins:jenkins
-```
-
-### `tbot init` with POSIX ACLs
-
-If running `tbot` as the Linux user `teleport`, use the following invocation of
-`tbot init` to initialize the short-lived certificate directory
-`/opt/machine-id` with owner `teleport:teleport` but allow `jenkins` to read
-from `/opt/machine-id`.
-
-```code
-$ tbot init \
-    --destination-dir=/opt/machine-id \
-    --bot-user=teleport \
-    --reader-user=jenkins
-```
diff --git a/docs/pages/machine-id/reference/configuration.mdx b/docs/pages/machine-id/reference/configuration.mdx
deleted file mode 100644
index 2ed552960e6ac..0000000000000
--- a/docs/pages/machine-id/reference/configuration.mdx
+++ /dev/null
@@ -1,99 +0,0 @@
----
-title: Machine ID Configuration Reference
-description: Configuration reference for Teleport Machine ID.
----
-
-The following snippet shows full YAML configuration of the Machine ID client
-`tbot` which by default is loaded from `/etc/tbot.yaml`.
-
-```yaml
-# Debug enables verbose logging to stderr.
-debug: true
-
-# Address of the Teleport Auth Server (on-prem installs) or Teleport Cloud tenant.
-auth_server: "auth.example.com:3025" # or "example.teleport.sh:443" for Teleport Cloud
-
-# TTL of short-lived machine certificates.
-certificate_ttl: "5m"
-
-# Interval at which short-lived certificates are renewed; must be less than
-# the certificate TTL.
-renewal_interval: "1m"
-
-# If set, quit after the first renewal.
-oneshot: true
-
-# Onboarding values are only used on first connect.
-onboarding:
-    # Cluster join method. Can be "token" or "iam".
-    join_method: "token"
-
-    # Token used to join the cluster. (only required for join_method: token)
-    token: "00000000000000000000000000000000"
-
-    # CA Path used to validate the identity of the Teleport Auth Server on first connect.
-    ca_path: "/path/to/ca.pem"
-
-    # CA Pins used to validate the identity of the Teleport Auth Server on first connect.
-    ca_pins:
-    - "sha256:1111111111111111111111111111111111111111111111111111111111111111"
-    - "sha256:2222222222222222222222222222222222222222222222222222222222222222"
-
-# Storage defines where Machine ID internal data is stored.
-storage:
-    # Directory to store internal bot data. Access to this directory should be
-    # limited.
-    directory: /var/lib/teleport/bot
-    
-    # Alternatively, internal data can be stored in memory. "directory" and
-    # "memory" are mutually exclusive.
-    memory: true
-
-# Destinations specifies where short-lived certificates are stored.
-destinations:
-    # Directory specifies where short-lived certificates are stored.
-    - directory: /opt/machine-id
-        # Configure symlink attack prevention. Requires Linux 5.6+.
-        # Possible values:
-        #   * try-secure (default): Attempt to securely read and write certificates
-        #     without symlinks, but fall back (with a warning) to insecure read
-        #     and write if the host doesn't support this.
-        #   * secure: Attempt to securely read and write certificates, with a hard error
-        #     if unsupported.
-        #   * insecure: Quietly allow symlinks in paths.
-        symlinks: try-secure
-        
-        # Configure ACL use. Requires Linux with a file system that supports ACLs.
-        # Possible values:
-        #   * try (default on Linux): Attempt to use ACLs, warn at runtime if ACLs
-        #     are configured but invalid.
-        #   * off (default on non-Linux): Do not attempt to use ACLs.
-        #   * required: Always use ACLs, produce a hard error at runtime if ACLs
-        #     are invalid.
-        acls: try
-        
-        # One of more roles to grant to the bot. It must have been granted (at
-        # least) these roles with `tctl bots add --roles=...`
-        # By default, all possible roles are included.
-        
-        # Subset of roles allowed during creation via `tctl bots add --roles=...`. Can
-        # be used to write short-lived certificates with different roles to
-        # different directories.
-        roles: [a, b, c]
-        
-        # Which types of certificates to generate. `[ssh]` is the default.
-        kinds: [ssh, tls]
-        
-        # A list of configuration templates to generate and write to the
-        # destination directory.
-        configs:
-            # ssh_client generates known_hosts and an ssh_config that can be
-            # included. We can ensure the correct certificate kinds are generated
-            # while generating the config templates.
-            - ssh_client
-            
-            # Alternatively, proxy port can be set on ssh_client to override the
-            # defaults. Useful for Telport Cloud.
-            - ssh_client:
-                proxy_port: 443
-```
diff --git a/docs/pages/server-access/getting-started.mdx b/docs/pages/server-access/getting-started.mdx
index ab1458ae07ab8..db77a4a1b656e 100644
--- a/docs/pages/server-access/getting-started.mdx
+++ b/docs/pages/server-access/getting-started.mdx
@@ -6,15 +6,16 @@ videoBanner: EsEvO5ndNDI
 
 # Getting Started
 
-Server Access involves managing your resources, configuring new clusters, and issuing commands through a CLI or programmatically to an API.
+Server Access often involves managing your resources, configuring new clusters, and issuing commands through a CLI or programmatically to an API.
 
 This guide introduces some of these common scenarios and how to interact with Teleport to accomplish them:
 
-1. SSH into a cluster using Teleport.
-2. Introspect the cluster using Teleport features.
+1. Creating a Teleport Auth Node cluster we'll add a Teleport SSH Node to.
+2. SSH into the cluster using Teleport.
+3. Introspecting the cluster using Teleport features.
 
 <Admonition type="tip" title="Tip">
-  This guide also demonstrates how to configure Teleport Nodes using the **bastion pattern** so that only a single Node can be accessed publicly.
+  This guide also demonstrates how to configure Teleport Nodes into the *Bastion* pattern so that [only a single Node can be accessed publicly](https://goteleport.com/blog/ssh-bastion-host/).
 </Admonition>
 
 <Figure
@@ -27,61 +28,89 @@ This guide introduces some of these common scenarios and how to interact with Te
 
 ## Prerequisites
 
-- The Teleport Auth Service and Proxy Service, deployed on your own infrastructure or managed via Teleport Cloud.
-- One host running your favorite Linux environment (such as Ubuntu 20.04, CentOS 8.0-1905, or Debian 10). This will serve as a Teleport Server Access Node.
+- Two instances of your favorite Linux environment (such as Ubuntu 20.05, CentOS 8.0-1905, or Debian 10).
+- A registered Domain Name with an available subdomain like `tele.example.com`.
+- A Two-Factor Authentication app (such as Authy or Google Authenticator).
 - Teleport (=teleport.version=) installed locally.
 
-<Admonition type="tip" title="New Teleport users">
-If you have not yet deployed the Teleport Auth Service and Proxy Service, learn how to do so by following one of our [getting started guides](../getting-started.mdx).
-</Admonition>
-
 (!docs/pages/includes/permission-warning.mdx!)
 
-## Step 1/4. Install Teleport 
+## Step 1/4. Create a cluster
+
+1. Create two new instances of your desired Linux distribution (such as Ubuntu 20.05, CentOS 8.0-1905, or Debian 10).
+
+   The first instance will host a public-facing Auth Node `tele.example.com` that will serve as the *Bastion Host* (following the recommended *Bastion*-pattern). As such, leave the following ports open:
+
+   | Port | Service | Description |
+   | - | - | - |
+   | 3023 | Proxy | SSH port clients connect to. A proxy will forward this connection to port `#3022` on the destination Node. |
+   | 3024 | Proxy	SSH port used to create "reverse SSH tunnels" from behind-firewall environments into a trusted proxy server. |
+   | 443 | Browser | Used to access the Teleport Web UI through a browser with HTTPS. Also used to obtain an ACME TLS (SSL) certificate. |
+   | 22 | Cloud Provider | Used to initially access, configure, and provision your cloud instances. We'll configure and launch our instances then demonstrate how to use the `tsh` tool and Teleport in SSH mode thereafter. |
+
+   Add an `A` record in your domain registrar entry for the `tele` subdomain and map the first IP address to the `tele` subdomain.
+
+   <Figure
+     align="center"
+     bordered
+     caption="Subdomain and IP mapping"
+   >
+     ![Subdomain and IP mapping](../../img/server-access/subdomains.png)
+   </Figure>
 
-1. Create a new instance of your desired Linux distribution (such as Ubuntu 20.04, CentOS 8.0-1905, or Debian 10).
+   Your second instance will be a private resource. These are the ports you'll want to initially open:
 
-   This instance will be a private resource. Open port 22 so you can initially access, configure, and provision your instance. We'll configure and launch our instance, then demonstrate how to use the `tsh` tool and Teleport in SSH mode thereafter.
+   | Port | Service | Description |
+   | - | - | - |
+   | 22 | Cloud Provider | Used to initially access, configure, and provision your cloud instances. We'll configure and launch our instances then demonstrate how to use the `tsh` tool and Teleport in SSH mode thereafter. |
 
-2. Install Teleport on your instance.
+2. Install Teleport on each instance.
 
    (!docs/pages/includes/install-linux.mdx!)
 
-   Next, we'll create a **join token** to add and start Teleport Server Access on the Node.
+3. Configure Teleport on the *Bastion Host*.
 
-## Step 2/4. Add a Node to the cluster
+   Teleport will now automatically acquire an X.509 certificate using the ACME protocol.
 
-1. Create a join token to add the Node to your Teleport cluster. In run the following command, either on your Auth Service host (for self-hosted deployments) or on your local machine (for Teleport Cloud).
+   ```code
+   # Configure Teleport with TLS certs
+   $ sudo teleport configure \
+     --acme --acme-email=your_email@example.com \
+     --cluster-name=tele.example.com \
+     -o file
+   ```
 
-<Details scope={["cloud"]} scopeOnly={true} title="Teleport Cloud and tctl">
-Teleport Cloud users must download the Enterprise version of Teleport to their local machines in order to use `tctl`. To do so, visit the [Teleport Customer Portal](https://dashboard.gravitational.com/web/login).
+   Run the command above on `tele.example.com`.
 
-Once this is done, log in to Teleport:
+4. Launch your *Bastion Host* by running:
 
-```code
-$ tsh login --proxy=myinstance.teleport.sh
-```
+   ```code
+   # Launch Teleport
+   $ sudo teleport start
+   ```
 
-If you have installed `tctl` as your local user, you will not need to run `tctl` commands via `sudo`.
-</Details>
+   Next, we'll create a *join token* to add and start the second Node.
+
+## Step 2/4. Add a Node to the cluster
+
+1. Create a *join token* to add the second Node to the `tele.example.com` cluster. In a *Bastion Host* terminal run the following command:
 
    ```code
    # Let's save the token to a file
    $ sudo tctl tokens add --type=node | grep -oP '(?<=token:\s).*' > token.file
    ```
 
-   Each Teleport Node can be configured into SSH mode and run as an enhanced SSH server. `--type=node` specifies that the Teleport Node will act and join as an SSH server.
+   Each Teleport Node can be configured into SSH mode (Teleport Node) and run as an enhanced SSH server. "Node" mode specifies that the Teleport Node will act and join as an SSH server.
 
    `> token.file` indicates that you'd like to save the output to a file name `token.file`.
 
    <Admonition type="tip" title="Tip">
-     This helps to minimize the direct sharing of tokens even when they are dynamically generated.
+     This helps to minimize the direct sharing of tokens even when they are *dynamically* generated.
    </Admonition>
 
-2. Now, open a new terminal and connect to the Teleport Auth Service.
+2. Now, in another terminal connect to the second instance.
 
-   - On your Node, save `token.file` to an appropriate, secure, directory you have the rights and access to read.
-   - Start the Node. Change `tele.example.com` to the address of your Teleport Proxy Service. For Teleport Cloud customers, use a tenant address such as `mytenant.teleport.sh`. Assign the `--token` flag to the path where you saved `token.file`.
+   - Copy `token.file` to an appropriate, secure directory on the second instance.
 
    ```code
    # Join cluster
@@ -91,7 +120,10 @@ If you have installed `tctl` as your local user, you will not need to run `tctl`
      --auth-server=tele.example.com:443
    ```
 
-3. Create a user to access the Web UI through the following command:
+   - Replace the `auth-server` value with the public proxy address of the machine you wish to connect to. By default, the subdomain `tele.example.com` will be available on port `443`.
+   - Assign `--token` to the path of the token file you created earlier.
+
+3. Create a user to access the `tele.example.com` Web UI through the following command:
 
    ```code
    $ sudo tctl users add tele-admin --roles=editor,access --logins=root,ubuntu,ec2-user
@@ -103,7 +135,7 @@ If you have installed `tctl` as your local user, you will not need to run `tctl`
      We've only given `tele-admin` the roles `editor` and `access` according to the *Principle of Least Privilege* (POLP).
    </Admonition>
 
-4. You should now be able to view your Teleport Node in Teleport Web interface after logging in as `tele-admin`:
+4. You should now be able to view both Nodes in the Teleport Web interface after logging in as `tele-admin`:
 
    <Figure
      align="center"
@@ -115,20 +147,20 @@ If you have installed `tctl` as your local user, you will not need to run `tctl`
 
 ## Step 3/4. SSH into the server
 
-Now, that we've got our cluster up and running, let's see how easy it is to connect to our Node.
+Now, that we've got our cluster up and running, let's see how easy it is to connect to our two Nodes.
 
 We can use `tsh` to SSH into the cluster:
 
-1. On your local machine, log in through `tsh`, assigning the `--proxy` flag to the address of your Teleport Proxy Service:
+1. On your local machine, log in through `tsh`:
 
    ```code
    # Log in through tsh
    $ tsh login --proxy=tele.example.com --user=tele-admin
    ```
 
-   You'll be prompted to supply the password and second factor we set up previously.
+   You'll be prompted to supply the password and One Time Passcode we set up previously.
 
-2. `tele-admin` will now see something similar to:
+2. `tele-admin` will now see:
 
    ```txt
    Profile URL:        https://tele.example.com:443
@@ -141,7 +173,7 @@ We can use `tsh` to SSH into the cluster:
      Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty
    ```
 
-   In this example, `tele-admin` is now logged into the `tele.example.com` cluster through Teleport SSH.
+   `tele-admin` is now logged into the `tele.example.com` cluster and *Bastion Host* Node through Teleport SSH.
 
 3. `tele-admin` can now execute the following to find the cluster's `nodenames`. `nodenames` are used for establishing SSH connections:
 
@@ -150,7 +182,7 @@ We can use `tsh` to SSH into the cluster:
    $ tsh ls
    ```
 
-   In this example, the bastion host Node is located on the bottom line below:
+   The *Bastion Host* Node is located on the bottom line below:
 
    ```txt
    Node Name        Address        Labels
@@ -159,7 +191,7 @@ We can use `tsh` to SSH into the cluster:
    ip-172-31-41-144 127.0.0.1:3022 env=example, hostname=ip-172-31-41-144
    ```
 
-4. `tele-admin` can SSH into the bastion host Node by running the following command locally:
+4. `tele-admin` can SSH into the *Bastion Host* Node by running the following command locally:
 
    ```code
    # Use tsh to ssh into a Node
@@ -172,7 +204,7 @@ We can use `tsh` to SSH into the cluster:
    - Traverse the Linux file system.
    - Execute desired commands.
 
-   All commands executed by `tele-admin` are recorded and can be replayed in the Teleport Web UI.
+   All commands executed by `tele-admin` are recorded and can be replayed in the Teleport Web interface.
 
    The `tsh ssh` command allows one to do anything they would if they were to SSH into a server using a third-party tool. Compare the two equivalent commands:
 
@@ -194,9 +226,9 @@ We can use `tsh` to SSH into the cluster:
 1. Now, `tele-admin` has the ability to SSH into other Nodes within the cluster, traverse the Linux file system, and execute commands.
 
    - They have visibility into all resources within the cluster due to their defined and assigned roles.
-   - They can also quickly view any Node or grouping of Nodes that have been assigned a particular label.
+   - They can also quickly view any Node or grouping of Nodes that've been assigned a `label`.
 
-2. Execute the following command within your bastion host console:
+2. Execute the following command within your *Bastion Host* console:
 
    ```code
    # List Nodes
@@ -212,44 +244,44 @@ We can use `tsh` to SSH into the cluster:
    ip-172-31-41-144 f3d2a65f-3fa7-451d-b516-68d189ff9ae5 127.0.0.1:3022 env=example,hostname=ip-172-31-41-144
    ```
 
-3. Note the "Labels" column on the farthest side. `tele-admin` can query all resources with a shared label using the command:
+3. Note the "Labels" column on the farthest side. `tele-admin` can query all resources with a shared [label](../setup/admin/labels.mdx) using the command:
 
    ```code
    # Query all Nodes with a label
    $ tsh ls env=example
    ```
 
-   Customized labels can be defined in your `teleport.yaml` configuration file or during Node creation.
+   - Customized labels can be defined in your `teleport.yaml` configuration file or during Node creation.
+   - This is a convenient feature that allows for more advanced queries.
+   - Suppose an IP address changes, an admin can quickly find the current Node with that label since it remains unchanged.
 
-   This is a convenient feature that allows for more advanced queries. If an IP address changes, for example, an admin can quickly find the current Node with that label since it remains unchanged.
-
-4. `tele-admin` can also execute commands on all Nodes that share a label, vastly simplifying repeated operations. For example, the command:
+4. `tele-admin` can also execute commands on all Nodes that share a label vastly simplifying repeated operations. For example, the command:
 
    ```code
    # Run the ls command on all Nodes with a label
    $ tsh ssh root@env=example ls
    ```
 
-   will execute the `ls` command on each Node and display the results in your terminal.
+   will execute the `ls` command on each Node displaying the contents of each to the screen.
 
 ## Conclusion
 
 <Admonition type="tip" title="Note">
-   We previously configured our Linux instance to leave port `22` open to easily configure and install Teleport. Feel free to compare Teleport SSH to your usual `ssh` commands.
+   We previously configured our Linux instances to leave port `22` open to easily configure and install Teleport. Feel free to compare Teleport SSH to your usual `ssh` commands.
 
-   If you'd like to further experiment with using Teleport according to the bastion pattern:
+   If you'd like to further experiment with using Teleport according to the *Bastion* pattern:
 
-   - Close port `22` on your private Linux instance now that your Teleport Node is configured and running.
-   - For self-hosted deployments, optionally close port `22` on your bastion host.
-   - You'll be able to fully connect to the private instance and, for self-hosted deployments, the bastion host, using `tsh ssh`.
+   - Close port `22` on your second, private, Linux instance now that your Node is configured and running.
+   - Optionally close port `22` on your *Bastion Host*.
+   - You'll be able to fully connect to both the *Bastion Host* and the private instance using `tsh ssh`.
 </Admonition>
 
-To recap, this guide described:
+To recap, this Getting Started Guide described:
 
 1. How to set up and add an SSH Node to a cluster.
 2. Connect to the cluster using `tsh` to manage and introspect resources.
 
-Feel free to shut down, clean up, and delete your resources, or use them in further Getting Started exercises.
+Feel free to shut down, clean up, and delete your resources or use them in further Getting Started exercises.
 
 ## Next steps
 
@@ -258,8 +290,7 @@ Feel free to shut down, clean up, and delete your resources, or use them in furt
 - For a complete list of ports used by Teleport, read [The Admin Guide](../setup/reference/networking.mdx).
 
 ## Resources
-- [Setting Up an SSH Bastion Host](https://goteleport.com/blog/ssh-bastion-host/)
+
 - [Announcing Teleport SSH Server](https://goteleport.com/blog/announcing-teleport-ssh-server/)
 - [How to SSH properly](https://goteleport.com/blog/how-to-ssh-properly/)
 - Consider whether [OpenSSH or Teleport SSH](https://goteleport.com/blog/openssh-vs-teleport/) is right for you.
-- [Labels](../setup/admin/labels.mdx)
diff --git a/docs/pages/server-access/guides/ansible.mdx b/docs/pages/server-access/guides/ansible.mdx
new file mode 100644
index 0000000000000..56fe0cc2f4033
--- /dev/null
+++ b/docs/pages/server-access/guides/ansible.mdx
@@ -0,0 +1,126 @@
+---
+title: Ansible
+description: Using Teleport with Ansible
+---
+
+Ansible uses the OpenSSH client by default. Teleport supports SSH protocol and
+works as SSH jumphost.
+
+In this guide we will configure OpenSSH client to work with Teleport Proxy
+and run a sample ansible playbook.
+
+## Prerequisites
+
+- Installed [Teleport Enterprise](../../enterprise/introduction.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
+- `tsh` client tool  >= (=teleport.version=)
+- `ssh` openssh tool
+- `ansible` >= (=ansible.min_version=)
+- Optional tool `jq` to process `JSON` output.
+
+## Step 1/3. Login and configure SSH
+
+Log into Teleport with `tsh`:
+
+```code
+$ tsh login --proxy=example.com
+```
+
+Generate `openssh` configuration using `tsh config` shortcut:
+
+```code
+$ tsh config > ssh.cfg
+```
+
+<Admonition type="tip">
+You can edit matching patterns used in `ssh.cfg` if something
+is not working out of the box.
+</Admonition>
+
+## Step 2/3. Configure Ansible
+
+Create a folder `ansible` where we will collect all generated files:
+
+```code
+$ mkdir -p ansible
+$ cd ansible
+```
+
+Create a file `ansible.cfg`:
+
+```
+[defaults]
+host_key_checking = True
+inventory=./hosts
+remote_tmp=/tmp
+
+[ssh_connection]
+scp_if_ssh = True
+ssh_args = -F ./ssh.cfg
+```
+
+You can create an inventory file `hosts` manually or use a script below to generate it from your environment:
+
+```code
+$ tsh ls --format=json | jq -r '.[].spec.hostname' > hosts
+```
+
+## Step 3/3. Run a playbook
+
+Finally, let's create a simple ansible playbook `playbook.yaml`.
+
+The playbook below runs `hostname` on all hosts. Make sure to set the `remote_user` parameter
+to a valid SSH username that works with the target host and is allowed by Teleport:
+
+```yaml
+- hosts: all
+  remote_user: ubuntu
+  tasks:
+    - name: "hostname"
+      command: "hostname"
+```
+
+From the folder `ansible`, run the ansible playbook:
+
+```code
+$ ansible-playbook playbook.yaml 
+
+# PLAY [all] *****************************************************************************************************************************************
+# TASK [Gathering Facts] *****************************************************************************************************************************
+#
+# ok: [terminal]
+#
+# TASK [hostname] ************************************************************************************************************************************
+# changed: [terminal]
+#
+# PLAY RECAP *****************************************************************************************************************************************
+# terminal                   : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+```
+
+You are all set. You are now using short-lived SSH certificates and Teleport can now record
+all ansible commands in the audit log.
+
+## Troubleshooting
+
+In case if ansible can not connect, you may see error like this one:
+
+```txt
+example.host | UNREACHABLE! => {
+    "changed": false,
+    "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname example.host: Name or service not known",
+    "unreachable": true
+}
+```
+
+You can examine and tweak patterns matching the inventory hosts in `ssh.cfg`.
+
+Try the SSH connection using `ssh.cfg` with verbose mode to inspect the error:
+
+```code
+$ ssh -vvv -F ./ssh.cfg root@example.host
+```
+
+If `ssh` works, try running the playbook with verbose mode on:
+
+```code
+$ ansible-playbook -vvvv playbook.yaml
+```
diff --git a/docs/pages/server-access/guides/vscode.mdx b/docs/pages/server-access/guides/vscode.mdx
index 609d2b17abc3b..8033e245efe12 100644
--- a/docs/pages/server-access/guides/vscode.mdx
+++ b/docs/pages/server-access/guides/vscode.mdx
@@ -11,25 +11,6 @@ This guide explains how to use Teleport and Visual Studio Code's remote SSH exte
 - [tsh client tool](https://goteleport.com/teleport/download) >= (=teleport.version=).
 - OpenSSH client.
 - Visual Studio Code with the [Remote - SSH extension](https://code.visualstudio.com/docs/remote/ssh#_system-requirements)
-for the Remote - SSH extension.
-- The Teleport Auth Service and Proxy Service, deployed on your own infrastructure or managed via Teleport Cloud.
-- One or more Teleport Nodes with Server Access enabled. If you have not yet done this, read the [Server Access Getting Started Guide](../getting-started.mdx) to learn how.
-
-<Details 
-scopeOnly={true}
-scope={["oss", "enterprise"]}
-opened={false}
-title="Haven't deployed the Auth and Proxy Services?" >
-Follow one of our [getting started](../getting-started.mdx) guides to learn how to deploy the Teleport Auth Service and Proxy Service in your environment.
-</Details>
-
-<Details 
-scopeOnly={true}
-scope={["cloud"]}
-opened={false}
-title="Not yet a Teleport customer?" >
-Sign up for a [free trial](/signup/) of Teleport Cloud to get started.
-</Details>
 
 <Admonition type="note">
 Linux and MacOS clients should rely on their operating system-provided OpenSSH
@@ -38,10 +19,9 @@ older clients can use `ssh.exe` from either [Git for Windows][git] or
 Microsoft's [Win32-OpenSSH project][win32-openssh].
 </Admonition>
 
+## Step 1/3. First-time Setup
 
-## Step 1/3. First-time setup
-
-Configure your local SSH client to access Teleport Nodes, assigning the `--proxy` flag to the address of your Teleport Proxy Service (e.g., `mytenant.teleport.sh` for Teleport Cloud users).
+Configure your local SSH client to access Teleport nodes:
 
 ```code
 # log in to your proxy:
@@ -51,7 +31,6 @@ $ tsh login --proxy proxy.foo.example.com --user alice
 $ tsh config --proxy proxy.foo.example.com
 ```
 
-
 Append the resulting configuration snippet into your SSH config file located
 in the path below:
 
@@ -74,15 +53,17 @@ in the path below:
   </TabItem>
 </Tabs>
 
-You should be able to connect to the desired node using following command, replacing `user` with the username you would like to assume on the node.
+You should be able to connect to the desired node using following command:
 
 ```code
-$ ssh user@[node name].[cluster name]
+ssh user@[node name].[cluster name]
 ```
 
-<Details scopeOnly={true} scope={["cloud"]} title="Teleport Cloud">
-The SSH config you generated earlier instructs your SSH client to run `tsh proxy ssh` to access a Node in your Teleport cluster. However, running an `ssh` command against the Teleport Proxy Service at `yourtenant.teleport.sh` will result in an error.
-</Details>
+For example, this should work:
+
+```code
+$ ssh alice@node000.foo.example.com
+```
 
 <Admonition type="note">
 Teleport's certificates expire fairly quickly, after which SSH
@@ -120,12 +101,12 @@ gear icon:
   ![VS Code sidebar with the Remote Explorer pane open and Configure highlighted](../../../img/vscode/remote-configure.png)
 </Figure>
 
-VS code will prompt you for your SSH config file.
+VS code will prompt you SSH config file.
 
-Select the one we generated during Step 1 and open it in the editor.
+Select the one we generated during step 1 and open it in the editor.
 
 <Admonition type="warning">
-Do not use VS Code's SSH config helper. If prompted for an SSH command,
+Do not use VS Code's SSH config helper; if prompted for an SSH command,
 close the dialog and select the "Configure" icon instead.
 </Admonition>
 
@@ -139,20 +120,21 @@ Host node000.foo.example.com
 When finished, save the file. If the added host doesn't automatically appear in
 the list, select the Refresh button.
 
-## Step 3/3. Start a Remote Development session
+## Step 3/3. Start a Remote Development Session
 
-Start a Remote Development session by right-clicking on any host added above and selecting either "Connect to..." option:
+Start a remote development session by right
+clicking on any host added above and selecting either "Connect to..." option:
 
-<Figure align="left" bordered caption="Connect to a Node">
+<Figure align="left" bordered caption="Connect to a node">
 ![Connecting to a Teleport host in VS Code](../../../img/vscode/connect.png)
 </Figure>
 
-On first connect, you'll be prompted to configure the remote OS. Select the
+On first connect, you'll be prompted to configure the remote OS; select the
 proper platform and VS Code will install its server-side component. When it
 completes, you should be left with a working editor:
 
 <Figure align="left" bordered caption="Connected VS Code">
-![VS Code connected to a Teleport Node](../../../img/vscode/connected-editor.png)
+![VS Code connected to a Teleport node](../../../img/vscode/connected-editor.png)
 </Figure>
 
 The status indicator in the bottom left highlights the currently connected remote host.
@@ -175,11 +157,8 @@ This guide makes use of `tsh config`, added in Teleport 7.0; refer to the
 [Manually configure an OpenSSH client](./openssh.mdx#manual-setup)
 to use the VS Code's remote SSH extension with older Teleport clients.
 
-## Further reading
-- [VS Code Remote Development](https://code.visualstudio.com/docs/remote/remote-overview)
-
 [remote-ssh]: https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-ssh
 [win10]: https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
 [git]: https://git-scm.com/downloads
 [remote-ssh-docs]: https://code.visualstudio.com/docs/remote/ssh
-[win32-openssh]: https://github.com/powershell/Win32-OpenSSH
\ No newline at end of file
+[win32-openssh]: https://github.com/powershell/Win32-OpenSSH
diff --git a/docs/pages/setup/admin/adding-nodes.mdx b/docs/pages/setup/admin/adding-nodes.mdx
index 792bfafa44433..c43c48ee28fa7 100644
--- a/docs/pages/setup/admin/adding-nodes.mdx
+++ b/docs/pages/setup/admin/adding-nodes.mdx
@@ -1,59 +1,65 @@
 ---
-title: Adding Nodes to the Cluster
-description: How to add Nodes to your Teleport cluster
+title: Adding Nodes to the cluster
+description: Adding Nodes to the cluster
 ---
 
-This guide explains how to add Teleport Nodes to your cluster.
+This guide explains how to add nodes to Open Source, Enterprise Teleport,
+self-hosted or cloud editions.
 
 ## Prerequisites
 
-<Tabs>
-<TabItem scope={["oss"]} label="Self-Hosted">
-Install Teleport and the `tctl` admin tool version >= (=teleport.version=).
+- Installed [Teleport](../../getting-started.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
+- [Tctl admin tool](https://goteleport.com/teleport/download) >= (=teleport.version=)
 
-See [Installation](../../installation.mdx) for details.
+(!docs/pages/includes/tctl.mdx!)
 
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-Install Teleport and the `tctl` admin tool version >= (=teleport.version=).
+<Admonition type="note">
+For cloud, login with a teleport user with editor privileges:
+```code
+# tsh logs you in and receives short-lived certificates
+$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
+# try out the connection
+$ tctl get nodes
+```
+</Admonition>
 
-To download Teleport Enterprise, visit the
-  [customer portal](https://dashboard.gravitational.com/web/login).
-</TabItem>
-<TabItem scope={["cloud"]}
-  label="Cloud">
+## Adding Nodes to the cluster
 
-Sign up for a Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
-</TabItem>
-</Tabs>
+Teleport only allows access to nodes that have joined the cluster.
 
-(!docs/pages/includes/tctl.mdx!)
+Once a node joins, it receives its own host certificate signed by the cluster's auth server.
 
-## Adding Nodes to the cluster
+To receive a host certificate upon joining a cluster, a new Teleport host must present an *invite token*.
 
-Teleport only allows access to Nodes that have joined the cluster.
+An invite token also defines which role a new host can assume within a cluster: `auth`, `proxy`, `node`, `app`, `kube`, or `db`.
 
-Once a Node joins, it receives its own host certificate signed by the cluster's
-Auth Service. To receive a host certificate upon joining a cluster, a new
-Teleport host must present an **invite token**.
+There are two ways to create invitation tokens:
 
-An invite token also defines which role a new host can assume within a cluster:
-`auth`, `proxy`, `node`, `app`, `kube`, or `db`.
+- **Short-lived Dynamic Tokens** are more secure but require more planning.
+- **Static Tokens** are easy to use, but less secure.
 
-### Generate a token
+### Short-lived dynamic tokens
 
-Administrators can generate tokens as they are needed. A token can be used
-multiple times until its time to live (TTL) expires.
+Administrators can generate tokens as they are needed.
 
-Use the `tctl` tool to generate a new token. In the following example, a new
-token is created with a TTL of five minutes:
+Such token can be used multiple times until its time to live (TTL)
+expires.
+
+Use the [`tctl`](../reference/cli.mdx#tctl) tool to register a new invitation token (or
+it can also generate a new token for you). In the following example a new token
+is created with a TTL of 5 minutes:
+
+```code
+$ tctl nodes add --ttl=5m --roles=node,proxy --token=secret-value
+# The invite token: secret-value
+```
+
+If `--token` is not provided, [`tctl`](../reference/cli.mdx#tctl) will generate one:
 
 ```code
 # Generate a short-lived invitation token for a new node:
-$ tctl nodes add --ttl=5m --roles=node
-# The invite token: (=presets.tokens.first=)
+$ tctl nodes add --ttl=5m --roles=node,app
+# The invite token: abcdefgh-do-not-use-this-token-123
 
 # You can also list all generated non-expired tokens:
 $ tctl tokens ls
@@ -61,71 +67,28 @@ $ tctl tokens ls
 # ------------------------         -----------     ---------------
 # (=presets.tokens.first=)         Node            25 Sep 18 00:21 UTC
 
-# ... or revoke an invitation token before it's used:
+# ... or revoke an invitation before it's used:
 $ tctl tokens rm (=presets.tokens.first=)
 ```
 
-If you want to provide your own token, you can do so using the `--token` flag:
-
-```code
-$ tctl nodes add --ttl=5m --roles=node,proxy --token=secret-value
-# The invite token: secret-value
-```
-
-<Details scope={["oss","enterprise"]} title="An insecure alternative: static tokens" scopeOnly={true} opened>
-<Admonition type="warning">
-Use short-lived tokens instead of long-lived static tokens.
-Static tokens are easier to steal, guess, and leak.
-</Admonition>
-
-Static tokens are defined ahead of time by an administrator and stored in the
-auth server's config file:
-
-```yaml
-# Config section in `/etc/teleport.yaml` file for the auth server
-auth_service:
-    enabled: true
-    tokens:
-    # This static token allows new hosts to join the cluster as "proxy" or "node"
-    - "proxy,node:secret-token-value"
-    # A token can also be stored in a file. In this example the token for adding
-    # new auth servers are stored in /path/to/tokenfile
-    - "auth:/path/to/tokenfile"
-```
-</Details>
-
 ### Using Node invitation tokens
 
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} scopeOnly={true} label="Self Hosted">
-Execute one of the following commands on a new Node to add it to a cluster:
+Both static and short-lived dynamic tokens are used the same way. Execute the following
+command on a new node to add it to a cluster:
 
 ```code
-# Adding an SSH Node to the cluster:
+# Adding a new regular SSH node to the cluster:
 $ sudo teleport start --roles=node --token=(=presets.tokens.first=) --auth-server=10.0.10.5
 
-# Adding a new regular SSH Node using Teleport Node Tunneling:
+# Adding a new regular SSH node using Teleport Node Tunneling:
 $ sudo teleport start --roles=node --token=(=presets.tokens.first=) --auth-server=teleport-proxy.example.com:3080
 
-# Adding a new Proxy Service to the cluster:
+# Adding a new proxy service on the cluster:
 $ sudo teleport start --roles=proxy --token=(=presets.tokens.first=) --auth-server=10.0.10.5
 ```
-</TabItem>
-<TabItem scope={["cloud"]} scopeOnly={true} label="Teleport Cloud">
-Execute the following command on a new Node to add it to a cluster. Replace
-`mytenant.teleport.sh` with the domain name of your Teleport Cloud tenant.
-
-```code
-# Adding an SSH Node to the cluster:
-$ sudo teleport start --roles=node --token=(=presets.tokens.first=) --auth-server=mytenant.teleport.sh
-```
 
-</TabItem>
-</Tabs>
-
-
-As new Nodes come online, they start sending ping requests every few seconds to
-the Auth Service. This allows users to explore cluster membership and size:
+As new nodes come online, they start sending ping requests every few seconds to
+the CA of the cluster. This allows users to explore cluster membership and size:
 
 ```code
 $ tctl nodes ls
@@ -136,25 +99,56 @@ turing        d52527f9-b260-41d0-bb5a-e23b0cfe0f8f     10.1.0.5:3022      distro
 dijkstra      c9s93fd9-3333-91d3-9999-c9s93fd98f43     10.1.0.6:3022      distro:debian
 ```
 
-{/* TODO: This lengthy Details box should be a subsection. Using the Details box
-as a workaround until we have a way to control the visibility of subsections
-using the scope switcher */}
+## Revoking invitations
+
+As you have seen above, Teleport uses tokens to invite users to a cluster
+(sign-up tokens) or to add new nodes to it (provisioning tokens).
+
+Both types of tokens can be revoked before they can be used. To see a list of
+outstanding tokens, run this command:
+
+```code
+$ tctl tokens ls
+
+# Token                                Role       Expiry Time (UTC)
+# -----                                ----       -----------------
+# (=presets.tokens.first=)     Proxy      never
+# (=presets.tokens.second=)     Node       17 May 16 03:51 UTC
+# (=presets.tokens.third=)     Signup     17 May 16 04:24 UTC
+```
+
+In this example, the first token has a "never" expiry date because it is a
+static token configured via a config file.
+
+The 2nd token with the "Node" role was generated to invite a new node to this
+cluster. And the 3rd token was generated to invite a new user.
 
-<Details scope={["oss", "enterprise"]} scopeOnly={true} title="Node Tunneling" opened>
-Teleport Node Tunneling lets you add a remote Node to an existing Teleport Cluster through a tunnel.
-This can be useful for IoT applications or for managing a couple of servers in a different network.
+The latter two tokens can be deleted (revoked) via [`tctl tokens
+del`](../reference/cli.mdx#tctl-tokens-rm) command:
+
+```code
+$ tctl tokens del (=presets.tokens.first=)
+# Token (=presets.tokens.first=) has been deleted
+```
+
+## Adding a Node located behind NAT
 
 <Admonition type="note">
-We recommend setting up a [Trusted Cluster](../admin/trustedclusters.mdx) if you
-have workloads split across different networks or clouds.
+  This feature is sometimes called "Teleport IoT" or node tunneling.
 </Admonition>
 
-To connect a Node to your cluster via Node Tunneling, use `tctl` to create a
-single-use token for a Node. Instead of supplying the IP of the Auth Service for
-the `--auth-server` flag, you will use the URL of the Proxy Service.
+With the current setup, you've only been able to add nodes that have direct access to the
+auth server and within the internal IP range of the cluster. We recommend
+setting up a [Trusted Cluster](../admin/trustedclusters.mdx) if you have workloads split
+across different networks/clouds.
 
-In the example below, we've replaced the auth server IP with the Proxy's web
-endpoint `teleport-proxy.example.com:3080`.
+Teleport Node Tunneling lets you add a remote node to an existing Teleport Cluster through a tunnel.
+This can be useful for IoT applications, or for managing a couple of servers in a different network.
+
+Similar to [Adding Nodes to the Cluster](#adding-nodes-to-the-cluster), use `tctl` to
+create a single-use token for a node, but this time you'll replace the auth
+server IP with the URL of the proxy server. In the example below, we've
+replaced the auth server IP with the proxy web endpoint `teleport-proxy.example.com:3080`.
 
 ```code
 $ tctl tokens add --type=node | grep -oP '(?<=token:\s).*' > token.file
@@ -164,22 +158,10 @@ $ tctl tokens add --type=node | grep -oP '(?<=token:\s).*' > token.file
 $ sudo teleport start --roles=node --token=/path/to/token.file --auth-server=teleport-proxy.example.com:3080
 ```
 
-Using the ports in Teleport's default configuration, the Node needs to be able
-to talk to ports `3080` and `3024` on the Proxy Service. Port `3080` is used to
-initially fetch the credentials (SSH and TLS certificates) and for discovering
-the reverse tunnel. Port `3024 `is used to establish a connection to the Auth
-Service through the Proxy.
-
-For those using ACME, port `443` is also required. 
+Using the ports in the default configuration, the node needs to be able to talk to ports `3080` and `3024` on the proxy. Port `3080` is used to initially fetch the credentials (SSH and TLS certificates) and for discovery (where is the reverse tunnel running, in this case, `3024`). For those using ACME, port `443` is also required. Port `3024 `is used to establish a connection to the auth server through the proxy.
 
-To enable multiplexing so only one port is used, simply set the
-`tunnel_listen_addr` to the same value as `web_listen_addr` within the
-`proxy_service` section of your configuration file. Teleport will automatically
-recognize that the Proxy Service is using the same port for both addresses and
-enable multiplexing.
-
-If your log setting is set to DEBUG, you will see multiplexing enabled in the
-server log.
+To enable multiplexing so only one port is used, simply set the `tunnel_listen_addr` the same as the
+`web_listen_addr` respectively within the `proxy_service`.  Teleport will automatically recognize using the same port and enable multiplexing. If the log setting is set to DEBUG you will see multiplexing enabled in the server log.
 
 ```txt
 DEBU [PROC:1]    Setup Proxy: Reverse tunnel proxy and web proxy listen on the same port, multiplexing is on. service/service.go:1944
@@ -189,66 +171,26 @@ DEBU [PROC:1]    Setup Proxy: Reverse tunnel proxy and web proxy listen on the s
   type="tip"
   title="Load Balancers"
 >
-
-  The setup above also works even if the cluster uses multiple Proxy Service
-  instances behind a load balancer (LB) or a DNS entry with multiple values. In
-  this case, the Node establishes a tunnel to every proxy.
-  
-  This requires that an LB
-  uses a round-robin or a similar balancing algorithm. Do not use sticky load balancing algorithms (a.k.a. "session affinity") with Teleport Proxy Service instances.
+  The setup above also works even if the cluster uses multiple proxies behind a load balancer (LB) or a DNS entry with multiple values.  This works by the node establishing a tunnel to *every* proxy. This requires that an LB
+  uses a round-robin or a similar balancing algorithm. Do not use sticky load balancing algorithms (a.k.a. "session affinity") with Teleport proxies.
 </Admonition>
 
-</Details>
+## Next Steps
 
-## Revoking invitations
+### Untrusted auth servers
 
-Tokens used for joining Nodes to a cluster can be revoked before they are used.
-To see a list of outstanding tokens, run this command:
+Teleport nodes use the HTTPS protocol to offer the join tokens to the auth
+server running on `10.0.10.5` in the example above. In a zero-trust environment,
+you must assume that an attacker can hijack the IP address of the auth server
+e.g. `10.0.10.5`.
 
-```code
-$ tctl tokens ls
+To prevent this from happening, you need to supply every new node with an
+additional bit of information about the auth server. This technique is called
+"CA Pinning". It works by asking the auth server to produce a "CA Pin". 
+CA Pin is a hash value of the SPKI header in a certificate. An attacker can't
+easilly forge a matching private key.
 
-# Token                                Role       Expiry Time (UTC)
-# -----                                ----       -----------------
-# (=presets.tokens.first=)     Proxy      never
-# (=presets.tokens.second=)     Node       17 May 16 03:51 UTC
-# (=presets.tokens.third=)     Signup     17 May 16 04:24 UTC
-```
-
-<Admonition type="tip" title="Signup tokens">
-
-The output of `tctl tokens ls` includes tokens used for adding users alongside
-tokens used for adding Nodes to your cluster.
-
-</Admonition>
-
-In this example, the first token has a `never` expiry date because it is a
-static token configured via a config file.
-
-The token with the `Node` role was generated to invite a new Node to this
-cluster. And the third token was generated to invite a new user to sign up.
-
-The latter two tokens can be deleted (revoked) via the `tctl tokens
-del` command:
-
-```code
-$ tctl tokens del (=presets.tokens.first=)
-# Token (=presets.tokens.first=) has been deleted
-```
-
-## Untrusted Auth Servers
-
-Teleport Nodes use the HTTPS protocol to offer an invite token to the Auth Service.
-In a zero-trust environment, you must assume that an attacker can hijack the IP
-address of the Auth Service.
-
-To prevent this from happening, you need to supply every new Node with an
-additional bit of information about the Auth Service. This technique is called
-**CA pinning**. It works by asking the Auth Service to produce a CA pin, a hash
-value of the SPKI header in a certificate. This way, an attacker cannot easily
-forge a matching private key.
-
-Retrieve the CA pin of the Auth Service:
+On the auth server:
 
 ```code
 $ tctl status
@@ -259,9 +201,10 @@ $ tctl status
 # CA pin   sha256:7e12c17c20d9cb504bbcb3f0236be3f446861f1396dcbb44425fe28ec1c108f1
 ```
 
-The CA pin at the bottom needs to be passed to new Nodes when they're
-starting for the first time, i.e. when they join a cluster. Here is an
-example of running `teleport start` on a Node with a CA pin:
+The CA pin at the bottom needs to be passed to the new nodes when they're
+starting for the first time, i.e. when they join a cluster:
+
+Via CLI:
 
 ```code
 $ sudo teleport start \
@@ -271,7 +214,7 @@ $ sudo teleport start \
    --auth-server=10.12.0.6:3025
 ```
 
-You can also supply a CA pin by modifying `/etc/teleport.yaml` on a Node:
+or via `/etc/teleport.yaml` on a node:
 
 ```yaml
 teleport:
@@ -283,12 +226,39 @@ teleport:
 
 <Admonition
   type="warning"
-  title="Warnings"
+  title="Warning"
 >
-  - If a CA pin is not provided, the Teleport Node will join a cluster but it will
-  print a `WARN` message (warning).
-  - The CA pin becomes invalid if a Teleport administrator
+  If a CA pin is not provided, the Teleport Node will join a
+  cluster but it will print a `WARN` message (warning) into its standard error output.
+</Admonition>
+
+<Admonition
+  type="warning"
+  title="Warning"
+>
+  The CA pin becomes invalid if a Teleport administrator
   performs the CA rotation by executing
   [`tctl auth rotate`](../reference/cli.mdx#tctl-auth-rotate) .
 </Admonition>
 
+### Insecure: Static tokens
+
+<Admonition type="warning">
+Use short-lived tokens instead of long-lived static tokens.
+Static tokens are easier to steal, guess or leak.
+</Admonition>
+
+Static tokens are defined ahead of time by an administrator and stored in the
+auth server's config file:
+
+```yaml
+# Config section in `/etc/teleport.yaml` file for the auth server
+auth_service:
+    enabled: true
+    tokens:
+    # This static token allows new hosts to join the cluster as "proxy" or "node"
+    - "proxy,node:secret-token-value"
+    # A token can also be stored in a file. In this example the token for adding
+    # new auth servers are stored in /path/to/tokenfile
+    - "auth:/path/to/tokenfile"
+```
diff --git a/docs/pages/setup/admin/daemon.mdx b/docs/pages/setup/admin/daemon.mdx
index 8be2c3b565482..718288ae09cfe 100644
--- a/docs/pages/setup/admin/daemon.mdx
+++ b/docs/pages/setup/admin/daemon.mdx
@@ -53,6 +53,6 @@ administrator must:
 
 1. Replace the Teleport binaries, usually [`teleport`](../reference/cli.mdx#teleport)
    and [`tctl`](../reference/cli.mdx#tctl)
-2. Execute `systemctl reload teleport`
+2. Execute `systemctl restart teleport`
 
 This will perform a graceful restart, i.e. the Teleport daemon will fork a new process to handle new incoming requests, leaving the old daemon process running until existing clients disconnect.
diff --git a/docs/pages/setup/admin/github-sso.mdx b/docs/pages/setup/admin/github-sso.mdx
index ef0d68de25c10..5bc4abdc92dbb 100644
--- a/docs/pages/setup/admin/github-sso.mdx
+++ b/docs/pages/setup/admin/github-sso.mdx
@@ -1,146 +1,112 @@
 ---
-title: Set up Single Sign-On with GitHub
+title: GitHub SSO
 description: Setting up Github SSO
 videoBanner: XjgN2WWFCX8
 ---
 
-This guide explains how to set up Github Single Sign On (SSO) for Teleport.
+This guide explains how to set up Github SSO with Open Source, Enterprise Teleport,
+self-hosted or cloud.
 
 ## Prerequisites
 
-<Tabs>
-<TabItem scope={["oss"]} label="Self-Hosted">
-- Install Teleport and the `tctl` admin tool version >= (=teleport.version=).
-
-  See [Installation](../../installation.mdx) for details.
-
-- Create and register a GitHub OAuth App. To do so, follow the instructions in
-  GitHub's documentation.
-
-  [Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
-
-  Ensure that your OAuth App's "Authentication callback URL" is
-  `https://PROXY_ADDRESS/v1/webapi/github/`, where `PROXY_ADDRESS` is the public
-  address of the Teleport Proxy Service. 
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-- Install Teleport and the `tctl` admin tool version >= (=teleport.version=).
-
-  To download Teleport Enterprise, visit the
-  [customer portal](https://dashboard.gravitational.com/web/login).
-  
-- Create and register a GitHub OAuth App. To do so, follow the instructions in
-  GitHub's documentation.
-
-  [Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
-
-  Ensure that your OAuth App's "Authentication callback URL" is
-  `https://PROXY_ADDRESS/v1/webapi/github/`, where `PROXY_ADDRESS` is the public
-  address of the Teleport Proxy Service. 
-</TabItem>
-<TabItem scope={["cloud"]}
-  label="Cloud">
-
-- Sign up for a Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
-
-- Create and register a GitHub OAuth App. To do so, follow the instructions in GitHub's documentation. 
-
-  [Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
-
-  Ensure that your OAuth App's "Authentication callback URL" is
-  `https://PROXY_ADDRESS/v1/webapi/github/`, where `PROXY_ADDRESS` is the domain
-  name of your Teleport Cloud tenant (e.g., mytenant.teleport.sh).
-
-</TabItem>
-</Tabs>
+- Installed [Teleport](../../getting-started.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
+- [Tctl admin tool](https://goteleport.com/teleport/download) >= (=teleport.version=)
 
 (!docs/pages/includes/tctl.mdx!)
 
-## Step 1/2. Create a GitHub authentication connector
+<Admonition type="note">
+For cloud, login with a teleport user with editor privileges:
+```code
+# tsh logs you in and receives short-lived certificates
+$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
+# try out the connection
+$ tctl get nodes
+```
+</Admonition>
+
+## Step 1/2. Create Github connector
 
-Define a GitHub authentication connector by creating a file called `github.yaml`
-with the following content:
+Define a Github connector:
 
 ```yaml
+# Create a file called github.yaml:
 kind: github
 version: v3
 metadata:
-  # Connector name that will be used with `tsh --auth=github login`
+  # connector name that will be used with `tsh --auth=github login`
   name: github
 spec:
-  # Client ID of your GitHub OAuth App
+  # Client ID of Github OAuth app
   client_id: <client-id>
-  # Client secret of your GitHub OAuth App
+  # Client secret of Github OAuth app
   client_secret: <client-secret>
-  # Connector display name that will be shown on the Web UI login screen
-  display: GitHub
+  # Connector display name that will be shown on web UI login screen
+  display: Github
   # Callback URL that will be called after successful authentication
   redirect_url: https://<proxy-address>/v1/webapi/github/callback
   # Mapping of org/team memberships onto allowed logins and roles
   teams_to_logins:
-    - organization: octocats # GitHub organization name
-      team: admins # GitHub team name within that organization
-      # Maps octocats/admins to the "access" Teleport role
+    - organization: octocats # Github organization name
+      team: admins # Github team name within that organization
+      # maps octocats/admins to teleport role access
       logins:
         - access
 ```
 
-The values of `client_id`, `client_secret`, and `redirect_url` come from the
-GitHub OAuth App you created earlier.
+To obtain a client ID and client secret, please follow Github documentation on
+how to [create and register an OAuth app](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/).
 
-Teleport will request only the `read:org` OAuth scope. Read more about OAuth scopes in GitHub's documentation:
+Be sure to set the "Authorization callback URL" to the same value as `redirect_url` in the resource spec.
 
-[Github OAuth scopes](https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/)
+Teleport will request only the `read:org` OAuth scope, you can read more about
+[Github OAuth scopes](https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/).
 
-Finally, create the connector using `tctl`:
+Finally, create the connector using [`tctl`](../reference/cli.mdx#tctl)
+[resource](../reference/resources.mdx) management command:
 
 ```code
 $ tctl create github.yaml
 ```
 
 <Admonition type="tip">
-  When going through the GitHub authentication flow for the first time,
+  When going through the Github authentication flow for the first time,
   the application must be granted access to all organizations that are
   present in the "teams to logins" mapping, otherwise Teleport will not be
-  able to determine team memberships for these organizations.
+  able to determine team memberships for these orgs.
 </Admonition>
 
 ## Step 2/2. Configure authentication preference
 
-Configure the Teleport Auth Service to enable the GitHub authentication
-connector.
-
-Create a file called `cap.yaml` with the following content:
+Configure Teleport Auth Service Github for authentication:
 
-```yaml
-kind: cluster_auth_preference
-metadata:
-  name: cluster-auth-preference
-spec:
-  type: github
-  webauthn:
-    rp_id: 'example.teleport.sh'
-version: v2
-```
-
-Create the resource:
-
-```code
-$ tctl create -f cap.yaml
-```
-
-<Details scope={["enterprise", "oss"]} scopeOnly={true} opened title="Static configuration file">
+<Tabs>
+  <TabItem label="Static Config (self-hosted)">
+  ```yaml
+  # Snippet from /etc/teleport.yaml
+  auth_service:
+    authentication:
+      type: github
+  ```
+  </TabItem>
+  <TabItem label="Dynamic resources (all editions)">
+  Create a file `cap.yaml`:
+  ```yaml
+  kind: cluster_auth_preference
+  metadata:
+    name: cluster-auth-preference
+  spec:
+    type: github
+    webauthn:
+      rp_id: 'example.teleport.sh'
+  version: v2
+  ```
 
-You can also edit your Teleport configuration file to include the following:
+  Create a resource:
 
-```yaml
-# Snippet from /etc/teleport.yaml
-auth_service:
-  authentication:
-    type: github
-```
-</Details>
+  ```code
+  $ tctl create -f cap.yaml
+  ```
+  </TabItem>
+</Tabs>
 
-You can now log in with Teleport using GitHub SSO.
+You can now login with Teleport using `github` SSO.
diff --git a/docs/pages/setup/admin/troubleshooting.mdx b/docs/pages/setup/admin/troubleshooting.mdx
index a25257ebdedf4..a34e70d1f31e5 100644
--- a/docs/pages/setup/admin/troubleshooting.mdx
+++ b/docs/pages/setup/admin/troubleshooting.mdx
@@ -15,9 +15,27 @@ run with verbose logging enabled by passing it `-d` flag.
   It is not recommended to run Teleport in production with verbose logging as it generates a substantial amount of data.
 </Admonition>
 
-Sometimes you may want to reset [`teleport`](../reference/cli.mdx#teleport) to a
-clean state. This can be accomplished by erasing everything under the `data_dir`
-directory, which defaults to `/var/lib/teleport/`.
+Sometimes you may want to reset [`teleport`](../reference/cli.mdx#teleport) to a clean
+state. This can be accomplished by erasing everything under `"data_dir"`
+directory. Assuming the default location, `rm -rf /var/lib/teleport/*` will do.
+
+Teleport also supports HTTP endpoints for monitoring purposes. They are disabled
+by default, but you can enable them:
+
+```code
+$ sudo teleport start --diag-addr=127.0.0.1:3000
+```
+
+Now you can see the monitoring information by visiting several endpoints:
+
+- `http://127.0.0.1:3000/metrics` is the list of internal metrics Teleport is tracking. It is compatible with [Prometheus](https://prometheus.io/)
+  collectors. For a full list of metrics review our [metrics reference](../reference/metrics.mdx).
+- `http://127.0.0.1:3000/healthz` returns "OK" if the process is healthy or
+  `503` otherwise.
+- `http://127.0.0.1:3000/readyz` is similar to `/healthz`, but it returns "OK"
+  *only after* the node successfully joined the cluster, i.e.it draws the difference between "healthy" and "ready".
+- `http://127.0.0.1:3000/debug/pprof/` is Golang's standard profiler. It's only
+  available when `-d` flag is given in addition to `--diag-addr`
 
 ## Debug dump
 
diff --git a/docs/pages/setup/admin/trustedclusters.mdx b/docs/pages/setup/admin/trustedclusters.mdx
index f8432db18ec0f..7873dbeb884ed 100644
--- a/docs/pages/setup/admin/trustedclusters.mdx
+++ b/docs/pages/setup/admin/trustedclusters.mdx
@@ -31,7 +31,7 @@ This guide's focus is on more in-depth coverage of trusted clusters features and
   type="tip"
   title="Teleport Node Tunneling"
 >
-  If you have a large number of devices on different networks, such as managed IoT devices or a couple of nodes on a different network you can utilize [Teleport Node Tunneling](./adding-nodes.mdx).
+  If you have a large number of devices on different networks, such as managed IoT devices or a couple of nodes on a different network you can utilize the [Teleport Node Tunneling](./adding-nodes.mdx#adding-a-node-located-behind-nat).
 </Admonition>
 
 ## Introduction
diff --git a/docs/pages/setup/deployments/aws-terraform.mdx b/docs/pages/setup/deployments/aws-terraform.mdx
index 9aed641328ee5..655746343b030 100644
--- a/docs/pages/setup/deployments/aws-terraform.mdx
+++ b/docs/pages/setup/deployments/aws-terraform.mdx
@@ -758,7 +758,7 @@ auth_servers:
 ### Joining nodes via Teleport IoT/node tunneling
 
 To join Teleport nodes from outside the same VPC, you will either need to investigate VPC peering/gateways (out of scope
-for this document) or join your nodes using [Teleport's node tunneling](../admin/adding-nodes.mdx) functionality.
+for this document) or join your nodes using [Teleport's node tunneling](../admin/adding-nodes.mdx#adding-a-node-located-behind-nat) functionality.
 
 With this method, you can join the nodes using the public facing proxy address - `teleport.example.com:443` for our
 example.
diff --git a/docs/pages/setup/guides/fluentd.mdx b/docs/pages/setup/guides/fluentd.mdx
index a78eb48a2f0c9..28ce9f79370bf 100644
--- a/docs/pages/setup/guides/fluentd.mdx
+++ b/docs/pages/setup/guides/fluentd.mdx
@@ -4,82 +4,37 @@ description: Forwarding events with Fluentd and Teleport event handler
 videoBanner: HAqxs4rBv2c
 ---
 
-In this guide, we will explain how to:
+This section will cover:
 
-- Set up Teleport's event handler.
-- Forward events with Fluentd.
+- Setting up Teleport's event handler.
+- Forwarding events with Fluentd for Cloud, Enterprise and Open Source editions.
 
 ## Prerequisites
 
-<Tabs>
-<TabItem scope={["oss"]} label="Self-Hosted">
-
-- A running Teleport cluster. For details on how to set this up, see [Getting
-  Started on a Linux Server](../../getting-started/linux-server.mdx).
-
-- The `tctl` admin tool version >= (=teleport.version=).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  See [Installation](../../installation.mdx) for details.
-
-  (!docs/pages/includes/tctl.mdx!)
-
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-
-- A running Teleport cluster. For details on setting this up, see our
-  [Enterprise getting started guide](../../enterprise/getting-started.mdx).
-
-- The `tctl` admin tool version >= (=teleport.version=), which you can download
-  by visiting the
-  [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  (!docs/pages/includes/tctl.mdx!)
-
-</TabItem>
-<TabItem scope={["cloud"]}
-  label="Teleport Cloud">
-
-- A Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
-
-- The Enterprise version of the `tctl` admin tool. To download this, visit
-the [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  (!docs/pages/includes/tctl.mdx!)
-
-</TabItem>
-</Tabs>
-
+- Teleport v(=teleport.version=) Cloud, Open Source or Enterprise
+- Teleport admin tool `tctl` configured to access the cluster.
 - Fluentd version v(=fluentd.version=).
 - Docker version v(=docker.version=).
 
-Create a folder called `fluentd` to hold configuration and plugin state:
+```code
+$ tctl version
+# Teleport v(=teleport.version=) go(teleport.golang)
+#
+# Test connectivity and admin permissions
+$ tctl get roles
+```
+
+Create a folder `fluentd` to hold configuration and plugin state:
 
 ```code
 $ mkdir -p event-handler
 $ cd event-handler
 ```
 
-## Step 1/6. Install the event handler plugin
+## Step 1/6. Install event handler plugin
 
-The Teleport event handler runs alongside the Fluentd forwarder, receives events
-from Teleport's events API, and forwards them to Fluentd.
+Teleport event handler runs alongside fluentd forwarder, receives events from Teleport's events API
+and forwards them to fluentd.
 
 <Tabs>
   <TabItem label="Linux">
@@ -99,30 +54,13 @@ from Teleport's events API, and forwards them to Fluentd.
 
 ## Step 2/6. Generate configuration
 
-<Tabs>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-Run the `configure` command to generate a sample configuration. Replace
-`teleport.example.com:443` with the DNS name and HTTPS port of Teleport's Proxy
-Service:
+Run `configure` command to generate sample configuration. Replace `teleport.example.com:443`
+with the DNS name and web proxy port of Teleport's proxy:
 
 ```code
 $ ./teleport-event-handler configure . teleport.example.com:443
 ```
 
-</TabItem>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
-
-Run the `configure` command to generate a sample configuration. Replace
-`mytenant.teleport.sh` with the DNS name of your Teleport Cloud tenant:
-
-```code
-$ ./teleport-event-handler configure . mytenant.teleport.sh
-```
-
-</TabItem>
-</Tabs>
-
 You'll see the following output:
 
 ```txt
@@ -138,7 +76,7 @@ Follow-along with our getting started guide:
 https://goteleport.com/setup/guides/fluentd
 ```
 
-The plugin generates several setup files:
+Plugin has generated several setup files:
 
 ```code
 $ ls -l
@@ -153,19 +91,15 @@ $ ls -l
 # -rw------- 1 bob bob      343 Jul  1 11:14 teleport-event-handler.toml
 ```
 
-|File(s)|Purpose|
-|---|---|
-| `ca.crt` and `ca.key`| Self-signed CA certificate and private key for Fluentd|
-| `server.crt` and `server.key`| Fluentd server certificate and key|
-| `client.crt` and `client.key`| Fluentd client certificate and key, all signed by the generated CA|
-| `teleport-event-handler-role.yaml`| `user` and `role` resource definitions for Teleport's event handler |client.
-| `fluent.conf`| Fluentd plugin configuration|
+- `ca.crt` and `ca.key` is a fluentd self-signed CA certificate and a private key.
+- `server.crt` and `server.key` is a fluentd server certificate and key.
+- `client.crt` and `client.key` is a fluentd client certificate and key, all signed by the generated CA.
+- `teleport-event-handler-role.yaml` is a Teleport's event handler client user and role.
+- `fluent.conf` is a fluentd plugin configuration.
 
-## Step 3/6. Create a user and role for reading audit events
+## Step 3/6. Create user and role for reading audit events
 
-The `configure` command generates a file called
-`teleport-event-handler-role.yaml` that defines a `teleport-event-handler` role
-and a user with read-only access to the `event` API:
+`configure` command generated `teleport-event-handler-role.yaml` that defines a `teleport-event-handler` role and a user with read-only access to the `event` API:
 
 ```yaml
 kind: user
@@ -196,16 +130,24 @@ $ tctl create -f teleport-event-handler-role.yaml
 
 ## Step 4/6. Create teleport-event-handler credentials
 
-### Enable impersonation of the Fluentd plugin user
+Teleport Plugin use the fluentd role and user to read the events. We export the identity files, using tctl auth sign.
+
+```code
+$ tctl auth sign --out identity --user teleport-event-handler
+# The credentials have been written to identity
+```
+
+This will generate `identity` which contains TLS certificates and will be used to connect plugin to your Teleport instance.
+
+<Admonition type="note">
+Clients, for example cloud interactive users, could be missing impersonation privileges when trying to use `tctl auth sign`,
+will get the following error:
 
-In order for the Fluentd plugin to forward events from your Teleport cluster, it
-needs a signed identity file from the cluster's certificate authority. The
-Fluentd user cannot request this itself, and requires another user to
-**impersonate** this account in order to request a certificate.
+```txt
+ERROR: access denied: impersonation is not allowed
+```
 
-Create a role that enables your user to impersonate the Fluentd user. First,
-paste the following YAML document into a file called
-`teleport-event-handler-impersonator.yaml`:
+Create the following file with role: `teleport-event-handler-impersonator.yaml`:
 
 ```yaml
 kind: role
@@ -227,61 +169,28 @@ spec:
       roles: ["teleport-event-handler"]
 ```
 
-Next, create the role:
-
 ```code
 $ tctl create teleport-event-handler-impersonator.yaml
 ```
 
-Assign this role to the current user by running the following command, substituting
-the user as appropriate:
-
+Assign this role to the current user by running the below command, subsituing the user as appropriate:
 ```code
 $ tctl get users/<USER> > out.yaml
 ```
 
-Now edit `out.yaml`, adding `teleport-event-handler-impersonator` to the list of
-existing roles and update via `tctl` again:
-
+Now edit `out.yaml` with your favourite editor, adding `teleport-event-handler-impersonator` to the list of existing roles and update via `tctl` again:
 ```
 $ tctl create -f out.yaml
 ```
 
-Log in to your Teleport cluster again to assume the new role.
-
-### Export an identity file for the Fluentd plugin user
-
-The Fluentd Teleport plugin uses the `teleport-event-handler` role and user to
-read events. We export an identity file for the user with the `tctl auth sign`
-command.
-
-<Tabs>
-<TabItem label="Self-Hosted" scope={["oss","enterprise"]}>
-```code
-$ tctl auth sign --format=tls --user=teleport-event-handler --out=auth
-```
-
-This command should result in three PEM-encoded files: `auth.crt`, `auth.key`,
-and `auth.cas` (certificate, private key, and CA certs, respectively).
-
-</TabItem>
-<TabItem label="Teleport Cloud" scope={["cloud"]}>
-```code
-$ tctl auth sign --user=teleport-event-handler --out=identity
-```
-
-The above sequence should result in one PEM-encoded file: `terraform-identity`.
-
-</TabItem>
-</Tabs>
+Re-login to assume the new role and try to issue certificate for the teleport-event-handle user again.
+</Admonition>
 
-## Step 5/6. Start the Fluentd forwarder
+## Step 5/6. Start fluentd forwarder
 
-The Fluentd plugin will send events to your Fluentd instance using keys
-generated on the previous step.
+The plugin will send events to the fluentd instance using keys generated on the previous step.
 
-The `fluent.conf` file generated earlier configures your Fluentd instance to
-accept events using TLS and print them:
+Generated sample `fluent.conf` file sets accepts events using `TLS` and prints them:
 
 ```
 <source>
@@ -314,7 +223,7 @@ accept events using TLS and print them:
 </match>
 ```
 
-To try out this Fluentd configuration, start your fluentd instance:
+To try it out, start fluentd instance:
 
 ```code
 $ docker run -u $(id -u ${USER}):$(id -g ${USER}) -p 8888:8888 -v $(pwd):/keys -v $(pwd)/fluent.conf:/fluentd/etc/fluent.conf fluent/fluentd:edge
@@ -322,11 +231,8 @@ $ docker run -u $(id -u ${USER}):$(id -g ${USER}) -p 8888:8888 -v $(pwd):/keys -
 
 ## Step 6/6. Start the event handler plugin
 
-Earlier, we generated a file called `teleport-event-handler.toml` to configure
-the Fluentd event handler. This file includes setting similar to the following:
-
-<Tabs>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
+`configure` command generated `teleport-event-handler.toml` configuration file
+for the event handler:
 
 ```toml
 storage = "./storage"
@@ -345,53 +251,27 @@ addr = "example.teleport.com:443"
 identity = "identity"
 ```
 
-</TabItem>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```toml
-storage = "./storage"
-timeout = "10s"
-batch = 20
-namespace = "default"
-
-[forward.fluentd]
-ca = "/home/sasha/scripts/event-handler/ca.crt"
-cert = "/home/sasha/scripts/event-handler/client.crt"
-key = "/home/sasha/scripts/event-handler/client.key"
-url = "https://localhost:8888/test.log"
-
-[teleport]
-addr = "example.teleport.com:443"
-client_key = "auth.key"
-client_crt = "auth.crt"
-root_cas = "auth.cas"
-```
-
-</TabItem>
-</Tabs>
-
-To start the event handler, run the following command:
+Start an export from the current moment:
 
 ```code
 $ ./teleport-event-handler start --config teleport-event-handler.toml
 ```
 
 <Admonition type="note">
-
-This example will start exporting from `May 5th 2021`:
+This example will start export from `May 5th 2021`:
 
 ```code
 $ ./teleport-event-handler start --config teleport-event-handler.toml --start-time "2021-05-05T00:00:00Z"
 ```
 
-The start time can be set only once, on the first run of the tool.
+Start time can be set only once, on the first run of the tool.
 
-If you want to change the time frame later, remove the plugin state directory
-that you specified in the `storage` field of the handler's configuration file.
+If you want to change the time frame later, remove plugin state dir
+which you had specified in `storage-dir` argument.
 
 </Admonition>
 
-Once the handler starts, you will see notifications about scanned and forwarded events:
+Once handler starts, you will see notifications about scanned and forwarded events:
 
 ```txt
 INFO[0046] Event sent id=0b5f2a3e-faa5-4d77-ab6e-362bca0994fc ts="2021-06-08 11:00:56.034 +0000 UTC" type=user.login
diff --git a/docs/pages/setup/guides/joining-nodes-aws.mdx b/docs/pages/setup/guides/joining-nodes-aws.mdx
index 96c0a62af6d6d..5d1423afb3707 100644
--- a/docs/pages/setup/guides/joining-nodes-aws.mdx
+++ b/docs/pages/setup/guides/joining-nodes-aws.mdx
@@ -1,6 +1,6 @@
 ---
 title: Joining Nodes in AWS
-description: How to join Nodes and Proxies running on AWS
+description: How to join nodes and proxies running on AWS
 h1: Joining Nodes and Proxies in AWS
 ---
 
@@ -23,11 +23,7 @@ IAM credentials with `ec2:DescribeInstances` permissions are required on your
 Teleport Auth server.
 No IAM credentials are required on the Nodes or Proxies.
 
-<Notice scope={["cloud"]} type="warning">
-Teleport Cloud does not support the EC2 join method.
-</Notice>
-
-The **IAM join method** is available in Teleport 8.3+ Cloud or self-hosted.
+The **IAM join method** is available in Teleport 8.3+ cloud or self-hosted.
 It is available to any Teleport Node or Proxy running anywhere with access to
 IAM credentials, such as an EC2 instance with an attached IAM role.
 No specific permissions or IAM policy is required: an IAM role with no attached
@@ -106,7 +102,7 @@ for details.
 ## Step 2/4. Create the AWS Node Joining token
 
 Configure your Teleport auth server with a special dynamic token which will
-allow Nodes from your AWS account to join your Teleport cluster.
+allow nodes from your AWS account to join your Teleport cluster.
 
 <Tabs>
   <TabItem label="IAM Method">
@@ -136,11 +132,11 @@ spec:
   join_method: iam
 
   allow:
-  # Specify the AWS account that Nodes may join from
+  # specify the AWS account which nodes may join from
   - aws_account: "111111111111"
   # multiple allow rules are supported
   - aws_account: "222222222222"
-  # aws_arn is optional and allows you to restrict the IAM role of joining Nodes
+  # aws_arn is optional and allows you to restrict the IAM role of joining nodes
   - aws_account: "333333333333"
     aws_arn: "arn:aws:sts::111111111111:assumed-role/teleport-node-role/i-*"
 ```
@@ -232,7 +228,7 @@ Kubernetes, Application, or Database roles. The service should be run directly
 on an AWS EC2 instance and must have network access to the AWS EC2 IMDSv2
 (enabled by default for most EC2 instances).
 
-Configure your Teleport Node with a custom `teleport.yaml` file. Use the
+Configure your Teleport node with a custom `teleport.yaml` file. Use the
 `join_params` section with `token_name` matching your token created in Step 2
 and `method: ec2` as shown in the following example config:
 
@@ -256,7 +252,7 @@ proxy_service:
 
 ## Step 4/4. Launch your Teleport Node
 
-Start Teleport on the Node and confirm that it is able to connect to and join
+Start Teleport on the node and confirm that it is able to connect to and join
 your cluster. You're all set!
 
 <Admonition type="note">
@@ -273,11 +269,11 @@ re-running `tctl create -f token.yaml`.
 ### Configuring the EC2 join method for Multiple AWS Accounts
 
 <Admonition type="note">
-This section is not necessary when using the IAM join method. Multiple accounts
+This section is not necessary when using the IAM join method, multiple accounts
 are support by default.
 </Admonition>
 
-In order for Teleport Nodes to join from EC2 instances in AWS accounts other
+In order for Teleport nodes to join from EC2 instances in AWS accounts other
 than the account in which your Teleport auth server is running, Teleport must
 have permissions to assume an IAM role in each of those accounts and call
 `ec2:DescribeInstances` in the foreign account.
@@ -321,7 +317,7 @@ In the AWS account where your Teleport auth server is running:
 2. Attach this `teleport-AssumeRole-policy` to the IAM role your Teleport auth
    server has credentials for, see [Step 1.2](#step-12-attach-the-iam-policy).
 
-When creating the AWS Node joining token, include an allow rule for each foreign
+When creating the AWS Node Joining token, include an allow rule for each foreign
 account and specify the AWS ARN for the foreign
 `teleport-DescribeInstances-role`.
 
diff --git a/docs/pages/setup/guides/terraform-provider.mdx b/docs/pages/setup/guides/terraform-provider.mdx
index 35256435a8648..33a5dd4441784 100644
--- a/docs/pages/setup/guides/terraform-provider.mdx
+++ b/docs/pages/setup/guides/terraform-provider.mdx
@@ -4,89 +4,25 @@ description: Configuration as a code with Terraform Provider
 videoBanner: YgNHD4SS8dg
 ---
 
-This guide will explain how to:
+This section will cover:
 
-- Set up Teleport's Terraform provider on Linux and Mac.
-- Configure Teleport users and roles using the Terraform provider.
+- Setting up Teleport's terraform provider on Linux and Mac.
+- Configuring users and roles using terraform provider for Cloud, Enterprise and Open Source editions.
 
 ## Prerequisites
 
-<Tabs>
-<TabItem scope={["oss"]} label="Self-Hosted">
-
-- A running Teleport cluster. For details on how to set this up, see [Getting
-  Started on a Linux Server](../../getting-started/linux-server.mdx).
-
-- The `tctl` admin tool version >= (=teleport.version=).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  See [Installation](../../installation.mdx) for details.
-
-  (!docs/pages/includes/tctl.mdx!)
-
-- [Terraform >= (=terraform.version=)+](https://learn.hashicorp.com/tutorials/terraform/install-cli)
-
-  ```code
-  $ terraform version
-  # Terraform v(=terraform.version=)
-  ```
-
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-
-- A running Teleport cluster. For details on setting this up, see our
-  [Enterprise getting started guide](../../enterprise/getting-started.mdx).
-
-- The `tctl` admin tool version >= (=teleport.version=), which you can download
-  by visiting the
-  [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  (!docs/pages/includes/tctl.mdx!)
-
-- [Terraform >= (=terraform.version=)+](https://learn.hashicorp.com/tutorials/terraform/install-cli)
-
-  ```code
-  $ terraform version
-  # Terraform v(=terraform.version=)
-  ```
-
-</TabItem>
-<TabItem scope={["cloud"]}
-  label="Cloud">
-
-- A Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
-
-- The Enterprise version of the `tctl` admin tool. To download this, visit
-the [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  (!docs/pages/includes/tctl.mdx!)
-
 - [Terraform >= (=terraform.version=)+](https://learn.hashicorp.com/tutorials/terraform/install-cli)
+- Teleport (=teleport.version=) Cloud, Open Source or Enterprise
 
-  ```code
-  $ terraform version
-  # Terraform v(=terraform.version=)
-  ```
-
-</TabItem>
-</Tabs>
+```code
+$ terraform version
+# Terraform v(=terraform.version=)
+```
 
+```code
+$ tctl version
+# Teleport v(=teleport.version=) go(teleport.golang)
+```
 
 Create a folder `teleport-terraform` to hold some temporary files:
 
@@ -95,7 +31,7 @@ $ mkdir -p teleport-terraform
 $ cd teleport-terraform
 ```
 
-## Step 1/4. Install the Terraform provider
+## Step 1/4. Install terraform provider
 
 <Tabs>
   <TabItem label="Linux">
@@ -115,54 +51,7 @@ $ cd teleport-terraform
   </TabItem>
 </Tabs>
 
-## Step 2/4. Create a Terraform user
-
-### Enable impersonation
-
-In order for Terraform to manage resources in your Teleport cluster, it needs a
-signed identity file from the cluster's certificate authority. The Terraform user
-cannot request this itself, and requires another user to **impersonate** this
-account in order to request a certificate.
-
-Create a role that enables your user to impersonate the Terraform user. First, paste
-the following YAML document into a file called `terraform-impersonator.yaml`:
-
-```yaml
-kind: role
-version: v5
-metadata:
-  name: terraform-impersonator
-spec:
-  # SSH options used for user sessions
-  options:
-    # max_session_ttl defines the TTL (time to live) of SSH certificates
-    # issued to the users with this role.
-    max_session_ttl: 10h
-
-  # The allow section declares a list of resource/verb combinations that are
-  # allowed for the users of this role. By default, nothing is allowed.
-  allow:
-    impersonate:
-      users: ['terraform']
-      roles: ['terraform']
-
-  # The deny section uses the identical format as the 'allow' section.
-  # Deny rules always override allow rules.
-  deny:
-    node_labels:
-      '*': '*'
-```
-
-Next, create the role:
-
-```code
-$ tctl create terraform-impersonator.yaml
-```
-
-Assign this role to the current user. Log in to your Teleport cluster to assume
-the new role.
-
-### Create the Terraform user
+## Step 2/4. Create a terraform user
 
 Put the following content into `terraform.yaml`:
 
@@ -185,75 +74,79 @@ spec:
 version: v2
 ```
 
-Create the `terraform` user and role.
+Run:
 
 ```code
 $ tctl create terraform.yaml
+$ tctl auth sign --format=file --user=terraform --out=terraform-identity --ttl=10h
 ```
 
-Next, request a signed certificate for the Terraform user:
+<Admonition type="note">
+Clients missing impersonation privileges when trying to use `tctl auth sign`,
+will get the following error:
 
-<Tabs>
-  <TabItem label="Self-Hosted" scope={["oss","enterprise"]}>
-```code
-$ tctl auth sign --format=tls --user=terraform --out=auth
+```txt
+ERROR: access denied: impersonation is not allowed
 ```
 
-This command should result in three PEM-encoded files: `auth.crt`, `auth.key`,
-and `auth.cas` (certificate, private key, and CA certs, respectively).
+Create the following file with role: `terraform-impersonator.yaml`:
+
+```yaml
+kind: role
+version: v5
+metadata:
+  name: terraform-impersonator
+spec:
+  # SSH options used for user sessions
+  options:
+    # max_session_ttl defines the TTL (time to live) of SSH certificates
+    # issued to the users with this role.
+    max_session_ttl: 10h
+
+  # allow section declares a list of resource/verb combinations that are
+  # allowed for the users of this role. by default nothing is allowed.
+  allow:
+    impersonate:
+      users: ['terraform']
+      roles: ['terraform']
+
+  # the deny section uses the identical format as the 'allow' section.
+  # the deny rules always override allow rules.
+  deny:
+    node_labels:
+      '*': '*'
+```
 
-</TabItem>
-<TabItem label="Teleport Cloud" scope={["cloud"]}>
 ```code
-$ tctl auth sign --user=terraform --out=terraform-identity
+tctl create terraform-impersonator.yaml
 ```
 
-The above sequence should result in one PEM-encoded file: `terraform-identity`.
+Assign this role to the current user. Re-login to assume the new role and try
+to issue certificate for terraform user again.
 
-</TabItem>
-</Tabs>
+</Admonition>
 
-## Step 3/4. Create a Terraform configuration
+## Step 3/4. Create Terraform configuration
 
-Paste the following into a file called `main.tf` to define an example user and
-role using Terraform.
+Create a `main.tf` terraform file:
 
-<Tabs>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
 ```
-(!examples/resources/terraform/terraform-user-role-cloud.tf!)
+(!examples/resources/terraform/terraform-user-role.tf!)
 ```
-</TabItem>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-```
-(!examples/resources/terraform/terraform-user-role-self-hosted.tf!)
-```
-</TabItem>
-</Tabs>
 
-## Step 4/4. Apply the configuration
+<Admonition type="note">
+Update `teleport.example.com:443` with the address of your Teleport cluster.
+</Admonition>
 
-Check the contents of the `teleport-terraform` folder:
+## Step 4/4. Apply the configuration
 
-<Tabs>
-<TabItem scope={["cloud"]} label="Teleport Cloud">
+Check the contents of `teleport-terraform` folder:
 
 ```code
 $ ls
 # main.tf  terraform-identity  terraform-impersonator.yaml  terraform.yaml
 ```
 
-</TabItem>
-<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
-
-```code
-$ ls
-# main.tf  auth.crt  auth.key  auth.cas  terraform-impersonator.yaml  terraform.yaml
-```
-
-</TabItem>
-</Tabs>
-
 Init terraform and apply the spec:
 
 ```code
@@ -263,5 +156,5 @@ $ terraform apply
 
 ## Next Steps
 
-- Find the full list of [supported Terraform provider resources](../reference/terraform-provider.mdx).
+- Find the full list of [supported terraform provider resources](../reference/terraform-provider.mdx).
 - Read more about [impersonation](../../access-controls/guides/impersonation.mdx).
diff --git a/docs/pages/setup/operations/ca-rotation.mdx b/docs/pages/setup/operations/ca-rotation.mdx
index dfeabee9a2388..6be371fca1769 100644
--- a/docs/pages/setup/operations/ca-rotation.mdx
+++ b/docs/pages/setup/operations/ca-rotation.mdx
@@ -5,125 +5,63 @@ description: How to rotate Teleport's certificate authority
 
 ## Prerequisites
 
-<Tabs>
-<TabItem scope={["oss"]} label="Self-Hosted">
-
-- A running Teleport cluster. For details on how to set this up, see [Getting
-  Started on a Linux Server](../../getting-started/linux-server.mdx).
-
-- The `tctl` admin tool version >= (=teleport.version=).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-  See [Installation](../../installation.mdx) for details.
-
-</TabItem>
-<TabItem
-  scope={["enterprise"]} label="Enterprise">
-
-- A running Teleport cluster. For details on setting this up, see our
-  [Enterprise getting started guide](../../enterprise/getting-started.mdx).
-
-- The `tctl` admin tool version >= (=teleport.version=), which you can download
-  by visiting the
-  [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-</TabItem>
-<TabItem scope={["cloud"]}
-  label="Cloud">
-
-- A Teleport Cloud account. If you do not have one, visit the
-  [sign up page](https://goteleport.com/signup/) to begin your free trial.
-
-- The Enterprise version of the `tctl` admin tool. To download this, visit
-the [customer portal](https://dashboard.gravitational.com/web/login).
-
-  ```code
-  $ tctl version
-  # Teleport v(=teleport.version=) go(=teleport.golang=)
-  ```
-
-</TabItem>
-</Tabs>
+- Installed [Teleport](../../getting-started.mdx) or [Teleport Cloud](../../cloud/introduction.mdx) >= (=teleport.version=)
+- [Tctl admin tool](https://goteleport.com/teleport/download) >= (=teleport.version=)
 
 (!docs/pages/includes/tctl.mdx!)
 
-
-## Certificate Authority rotation
-
-This section will show you how to implement certificate rotation in practice.
-
-<Admonition type="warning" title="CA Pinning Warning">
-  If you are using [CA
-  Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new
-  nodes, the CA pin will change after the rotation. Make sure you use the *new*
-  CA pin when adding nodes after rotation.
+<Admonition type="note">
+For cloud, login with a teleport user with editor privileges:
+```code
+# tsh logs you in and receives short-lived certificates
+$ tsh login --proxy=myinstance.teleport.sh --user=email@example.com
+# try out the connection
+$ tctl get nodes
+```
 </Admonition>
 
-### Rotation phases
+## Certificate Authority Rotation
 
-The rotation consists of several phases:
+Take a look at the [Certificates chapter](../../architecture/authentication.mdx#authentication-in-teleport) in the
+architecture document to learn how the certificate authority rotation works.
 
-- `standby`: All operations have completed or haven't started yet.
-- `init`: All components are notified of the rotation. A new certificate
-  authority is issued, but not used. It is necessary for remote trusted clusters
-  to fetch the new certificate authority, otherwise new clients will reject it.
-- `update_clients`: Internal clients certs are updated and reloaded. Servers
-  will use and respond with old credentials because clients have no idea about
-  new certificates at first.
-- `update_servers`: Servers reload and start serving TLS and SSH certificates
-  signed by the new certificate authority, but will still accept certificates
-  issued by the old certificate authority.
-- `rollback`: The rotation was aborted and is rolling back to the old
-  certificate authority.
+This section will show you how to implement certificate rotation in practice.
 
-### Rotation types
+During manual and semi-automatic certificate authority rotation, Teleport generates a new certificate
+authority and issues certificates for auth servers, proxies, nodes and users.
 
-There are two kinds of certificate rotations:
+Rotation consists of several phases:
 
-- **Manual:** it is the cluster administrator's reponsibility to transition
-  between each phase of the rotation while monitoring the state of the cluster.
-  Manual rotations provide the greatest level of control, and are performed by
-  providing the desired phase using the `--phase` flag with the
-  `tctl auth rotate` command.
-- **Semi-automatic:** Teleport automatically transitions between phases of the
-  rotation after some amount of time (known as a *grace period*) elapses.
+- `standby` All operations have completed or haven't started yet.
+- `init` - All components are notified of the rotation. A new certificate authority is issued, but not used.
+  It is necessary for remote trusted clusters to fetch the new certificate authority, otherwise the new clients
+  will reject it.
+- `update_clients` - internal clients certs are updated and reloaded.
+  Servers will use and respond with old credentials because clients have no idea about new certificates at first.
+- `update_servers` Servers will reload and would start serving
+TLS and SSH certificates signed by the new certificate authority, but will still accept certificates
+issued by old certificate authority.
+- `rollback` rotation is rolling back to the old certificate authority.
 
-For both types of rotations, the cluster goes through the phases in the
-following order:
+Both in manual and semi-automatic rotation, cluster goes through the states above in sequence:
 
 - `standby` -> `init` -> `update_clients` -> `update_servers` -> `standby`
 
-Administrators can abort the rotation and revert all changes any time before
-the rotation is completed by entering the `rollback` phase.
+Administrators can rollback all the changes before rotation is completed by entering `standby`.
 
-```sh
-$ tctl auth rotate --phase=rollback --manual
-```
-
-For example, if an admin has detected that some nodes failed to upgrade during
-`update_servers`, they can roll back to the previous certificate authority, and
-the phase transitions look like this:
+For example, if admin has detected that some nodes failed to upgrade during `update_servers`,
+they can rollback to the previous certificate authority:
 
 - `update_servers` -> `rollback` -> `standby`.
 
 <Admonition>
-  Try rotation/rollback in manual mode first to understand all the edge-cases
-  and gotchas before going with semi-automatic version.
+Try rotation/rollback in manual mode first to understand all the edge-cases
+and gotchas before going with semi-automatic version.
 </Admonition>
 
 ## Manual rotation
 
-In manual mode, we manually transition between phases while monitoring the state
-of the cluster.
+In manual mode, we would transition between phases while monitoring the state of the cluster.
 
 **Start the rotation**
 
@@ -134,7 +72,7 @@ $ tctl auth rotate --phase=init --manual --type=host
 Updated rotation phase to "init". To check status use 'tctl status'
 ```
 
-Use `tctl` to confirm that there is an active rotation in progress:
+Cluster status will reflect active rotation in progress:
 
 ```code
 $ tctl status
@@ -158,24 +96,23 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 }
 ```
 
-In this example, the node named `terminal` has updated its status to phase
-`init`. This means it has downloaded a new CA public key and is ready for state
-transitions.
+Host `terminal` has updated it status to phase `init`. It has downloaded a new CA public key and is ready
+for state transitions.
 
-<Admonition type="warning" title="Rotation warning">
-  If some nodes are offline during rotation or have failed to update the status,
-  you will lose connectivity after the transition `update_servers` -> `standby`.
-  Make sure that all nodes are up to date with the transitions before
-  proceeding.
+<Admonition type="warning" title="Rotation warning"
+>
+If some nodes are offline during rotation or have failed to update the status,
+you will lose connectivity after the transition `update_servers` -> `standby`. Make sure that all
+nodes are up to date with the transitions.
 </Admonition>
 
 **Update clients**
 
-Execute the transition from `init` to `update_clients`:
+Execute transition `init` -> `update_clients`:
 
 ```code
 $ tctl auth rotate --phase=update_clients --manual
-# Updated rotation phase to "update_clients". To check status use 'tctl status'
+# Updated rotation phase to "init". To check status use 'tctl status'
 $ tctl status
 # Cluster  acme.cluster
 # Version  (=teleport.version=)
@@ -183,8 +120,7 @@ $ tctl status
 ```
 
 <Admonition type="note">
-  Clients will temporarily lose connectivity during Proxy and Auth Server
-  restarts.
+Clients will temporarily lose connectivity during proxy and auth servers restarts.
 </Admonition>
 
 Verify that nodes have caught up and now see the current cluster state:
@@ -200,12 +136,11 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 
 **Update servers**
 
-Now that all nodes have caught up, execute the transition from `update_clients`
-to `update_servers`:
+All nodes have caught up. Execute the transition `update_clients` -> `update_servers`:
 
 ```code
 $ tctl auth rotate --phase=update_servers --manual
-# Updated rotation phase to "update_servers". To check status use 'tctl status'
+# Updated rotation phase to "init". To check status use 'tctl status'
 
 $ tctl status
 # Cluster  acme.cluster
@@ -214,9 +149,8 @@ $ tctl status
 ```
 
 <Admonition type="note">
-  Usually if things go wrong, they go wrong at this transition. If you have lost
-  connectivity to nodes, [roll back](#rollback) to the old certificate
-  authority.
+Usually if things go wrong, they go wrong at this transition. If you have lost connectivity to nodes,
+[rollback](#rollback) to the old certificate authority.
 </Admonition>
 
 Verify that nodes have caught up:
@@ -235,23 +169,28 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 Before wrapping up, verify that you have not lost any nodes and can connect to them, for example:
 
 ```code
-$ tsh ssh hello@terminal
+$ tsh ssh hello@terminal hostname
 ```
 
 <Admonition type="warning">
-  This is the last stage where you have the opportunity to roll back. If you
-  have lost connectivity to nodes, [roll back](#rollback) to the old certificate
-  authority.
+This is the last stage when you can rollback. If you have lost connectivity to nodes,
+[rollback](#rollback) to the old certificate authority.
 </Admonition>
 
 ```code
 $ tctl auth rotate --phase=standby --manual
+# Updated rotation phase to "init". To check status use 'tctl status'
+
+$ tctl status
+# Cluster  acme.cluster
+# Version  (=teleport.version=)
+# Host CA  rotating servers (mode: manual, started: Sep 20 01:44:36 UTC, ending: Sep 21 07:44:36 UTC)
 ```
 
-Verify that the rotation has completed with `tctl`:
+Cluster status should indicate succesffully completed rotation.
 
 ```code
-$ tctl status
+tctl status
 Cluster  acme.cluster
 Version  (=teleport.version=)
 Host CA  rotated Sep 20 02:11:25 UTC
@@ -271,26 +210,31 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 }
 ```
 
+<Admonition
+  type="warning"
+  title="CA Pinning Warning"
+>
+If you are using [CA Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new nodes, the CA pin will change after the rotation.
+Make sure you use the *new* CA pin when adding nodes after rotation.
+</Admonition>
+
 ## Semi-Automatic rotation
 
 <Admonition type="warning">
-  Semi-automatic rotation executes the same steps as the manual rotation, but
-  with a grace period between them. It currently does not track the states of
-  the nodes and you can lose connectivity if things go wrong.
+Semi-automatic rotation executes the same steps as the manual rotation, but with a grace period between them.
+It currently does not track the states of the nodes and you can lose connectivity if things go wrong.
 </Admonition>
 
-You can trigger semi-automatic rotation by omitting the `--manual` and `--phase`
-flags.
+You can trigger semi-automatic rotation:
 
 ```code
 $ tctl auth rotate
 ```
 
-This will trigger a rotation process for both hosts and users with a default
-grace period of 48 hours. During the grace period, certificates issued both by
-old and new certificate authority work.
+This will trigger a rotation process for both hosts and users with a *grace period* of 48 hours.
+During the grace period, certificates issued both by old and new certificate authority work.
 
-You can customize grace period and CA type with additional flags:
+You can customize grace period:
 
 ```code
 # Rotate only user certificates with a grace period of 200 hours:
@@ -304,29 +248,33 @@ The rotation takes time, especially for hosts, because each node in a cluster
 needs to be notified that a rotation is taking place and request a new
 certificate for itself before the grace period ends.
 
-During semi-automatic rotations, Teleport will attempt to divide the grace
-period so that it spends an equal amount of time in each phase before
-transitioning to the next phase. This means that using a shorter grace period
-will result in faster state transitions.
-
-<Notice type="warning">
-  Be careful when choosing a grace period when rotating host certificates.
-</Notice>
-
-The grace period needs to be long enough for all nodes in a cluster to request a
-new certificate. If some nodes go offline during the rotation and come back only
-after the grace period has ended, they will be forced to leave the cluster, i.e.
-users will no longer be allowed to SSH into them.
+<Admonition
+  type="warning"
+  title="Warning"
+>
+  Be careful when choosing a grace period when rotating host certificates. The grace period needs to be long enough for all nodes in a cluster to request a new certificate. If some nodes go offline during the
+  rotation and come back only after the grace period has ended, they will be
+  forced to leave the cluster, i.e. users will no longer be allowed to SSH
+  into them.
+</Admonition>
 
-Check the cluster status:
+Check the cluster status of rotation:
 
 ```code
-$ tctl status
+tctl status
 Cluster  acme.cluster
 Version  (=teleport.version=)
 Host CA  initialized (mode: manual, started: Sep 20 01:44:36 UTC, ending: Sep 21 07:44:36 UTC)
 ```
 
+<Admonition
+  type="warning"
+  title="CA Pinning Warning"
+>
+  If you are using [CA Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new nodes, the CA pin will change after the rotation. Make sure you use the
+  *new* CA pin when adding nodes after rotation.
+</Admonition>
+
 Check the status of individual nodes:
 
 ```code
@@ -339,22 +287,21 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 }
 ```
 
-The node named `terminal` has updated its status to phase `init`. This means it
-has downloaded a new CA public key and is ready for state transitions.
+Host `terminal` has updated it status to phase `init`. It has downloaded a new CA public key and is ready
+for state transitions.
 
 ## Rollback
 
-Rollback must be performed before the rotation enters `standby` state.
+Rollback is only possible before rotation enters `standby` state.
 
-First, enter the rollback phase with a manual phase transition:
+First, override the rotation to the manual rollback:
 
 ```code
 $ tctl auth rotate --phase=rollback --manual
 # Updated rotation phase to "rollback". To check status use 'tctl status'
 ```
 
-Make sure that any nodes which have already updated have caught up and entered
-the `rollback` phase.
+Make sure that nodes that have updated have caught up:
 
 ```code
 # Check rotation status of the nodes
@@ -366,11 +313,5 @@ $ tctl get nodes --format=json | jq '.[] | {hostname: .spec.hostname, rotation:
 }
 ```
 
-If connectivity to any of the nodes was lost during the rotation, this is likely
-because they were still using the old cert authority. Connectivity to these
-nodes should be restored when the rollback completes and the old certificate
-authority is made active.
-
-## Further reading
-
-How the [Teleport Certificate Authority](../../architecture/authentication.mdx#authentication-in-teleport) works.
+If any of the nodes were lost and using the old cert authority, they should reconnect
+once you switch the control plane to the old cert authority.
diff --git a/docs/pages/setup/reference/authentication.mdx b/docs/pages/setup/reference/authentication.mdx
index 134e980fd7e6c..f6b2ba7e99ebd 100644
--- a/docs/pages/setup/reference/authentication.mdx
+++ b/docs/pages/setup/reference/authentication.mdx
@@ -1,20 +1,22 @@
 ---
 title: Authentication options
-description: A reference for Teleport's authentication connectors
+description: Teleport enterprise license file configuration parameters and requirements
 ---
 
-Teleport authenticates users with an identity provider via **authentication
-connectors**. There are three types of authentication connectors.
+Teleport uses the concept of "authentication connectors" to authenticate users
+when they execute [`tsh login`](./cli.mdx#tsh-login) command. There are three
+types of authentication connectors:
 
-## Local (no authentication connector)
+## Local
 
 Local authentication is used to authenticate against a local Teleport user
-database. This database is managed by the [`tctl users`](./cli.mdx#tctl-users-add)
+database. This database is managed by [`tctl users`](./cli.mdx#tctl-users-add)
 command. Teleport also supports second-factor authentication (2FA) for the local
 connector. There are several possible values (types) of 2FA:
 
-- `otp` is the default. It implements the [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm)
-  standard. You can use [Google Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator), [Authy],(https://www.authy.com/) or any other TOTP client.
+- `otp` is the default. It implements [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm)
+  standard. You can use [Google Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator)
+  or [Authy](https://www.authy.com/) or any other TOTP client.
 - `webauthn` implements the [Web Authentication standard](https://webauthn.guide) for utilizing
   second factor authenticators and hardware devices.
   You can use [YubiKeys](https://www.yubico.com/), [SoloKeys](https://solokeys.com/) or any other authenticator that
@@ -61,12 +63,13 @@ You can modify these settings in the static config `teleport.yaml` or using dyna
 </Tabs>
   
 <Admonition type="note">
-  SSO users can also register 2FA devices, but Teleport will not prompt them for 2FA during login. Login 2FA for SSO users should be handled by the SSO provider.
+  SSO users can also register 2FA devices, but Teleport will not prompt them for 2FA during login. Login 2FA for SSO users should be handled by the SSO
+  provider.
 </Admonition>
 
 ## GitHub
 
-This connector implements GitHub's OAuth 2.0 authentication flow. Please refer to GitHub's documentation on [Creating an OAuth App](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/)
+This connector implements Github OAuth 2.0 authentication flow. Please refer to GitHub documentation on [Creating an OAuth App](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/)
 to learn how to create and register an OAuth app.
 
 Here is an example of this setting in the `teleport.yaml` :
@@ -81,9 +84,9 @@ See [Github OAuth 2.0](../admin/github-sso.mdx) for details on how to configure
 
 ## SAML
 
-<Notice type="note">
-You need the Enterprise edition of Teleport for this option.
-</Notice>
+<Admonition type="note">
+You need Enterprise edition of Teleport for this option.
+</Admonition>
 
 This connector type implements SAML authentication. It can be configured against any external identity manager like Okta or Auth0. This feature is only available for Teleport Enterprise.
 
@@ -97,9 +100,9 @@ auth_service:
 
 ### OIDC
 
-<Notice type="note">
-You need the Enterprise edition of Teleport for this option.
-</Notice>
+<Admonition type="note">
+You need Enterprise edition of Teleport for this option.
+</Admonition>
 
 Teleport implements OpenID Connect (OIDC) authentication, which is similar to SAML in principle.
 
diff --git a/docs/pages/setup/reference/cli.mdx b/docs/pages/setup/reference/cli.mdx
index 0339c46a3c02c..f1d572a5a7fc7 100644
--- a/docs/pages/setup/reference/cli.mdx
+++ b/docs/pages/setup/reference/cli.mdx
@@ -38,7 +38,7 @@ the following services.
 | - | - | - | - |
 | `-d, --debug` | none | none | enable verbose logging to stderr |
 | `--insecure-no-tls` | `false` | `true` or `false` | Tells proxy to not generate default self-signed TLS certificates. This is useful when running Teleport on kubernetes (behind reverse proxy) or behind things like AWS ELBs, GCP LBs or Azure Load Balancers where SSL termination is provided externally. |
-| `-r, --roles` | `proxy,node,auth` | **string** comma-separated list of `proxy, auth, node, db, app` or `windowsdesktop` | start listed services/roles. These roles are explained in the [Teleport Architecture](../../architecture/overview.mdx) document. |
+| `-r, --roles` | `proxy,node,auth` | **string** comma-separated list of `proxy, node` or `auth` | start listed services/roles. These roles are explained in the [Teleport Architecture](../../architecture/overview.mdx) document. |
 | `--pid-file` | none | **string** filepath | create a PID file at the path |
 | `--advertise-ip` | none | **string** IP | advertise IP to clients, often used behind NAT |
 | `-l, --listen-ip` | `0.0.0.0` | [**net. IP**](https://golang.org/pkg/net/#IP) | binds services to IP |
@@ -311,42 +311,6 @@ $ tsh play --format=pty 1fe153d1-ce8b-4ef4-9908-6539457ba4ad.tar
 $ tsh play --format=json ~/play/0c0b81ed-91a9-4a2a-8d7c-7495891a6ca0.tar | jq '.event
 ```
 
-### tsh proxy app
-
-Starts a local TLS proxy for Application Access connections.
-You can use this proxy to connect to an application repeatedly after a single login to your Teleport cluster,
-which is especially useful for interacting with an application via a CLI.
-
-```code
-$ tsh proxy app [<flags>] <app>
-```
-
-#### Arguments
-`<app>`
-
-- `app` The name of the application to start the local proxy for. To see a list of available applications, run `tsh apps ls`.
-
-#### Flags
-
-| Name | Default Value(s) | Allowed Value(s) | Description |
-| - | - | - | - |
-| `--port` | none | port number | Specify the source port for the local proxy |
-
-#### [Global Flags](#tsh-global-flags)
-
-These flags are available for all commands `--login, --proxy, --user, --ttl, --identity, --cert-format, --insecure, --auth, --skip-version-check, --debug, --jumphost, --format`.
-Run `tsh help <subcommand>` or see the [Global Flags Section](#tsh-global-flags)
-
-#### Examples
-```code
-$ tsh proxy app <app>
-
-# Proxy a connection to grafana on local port 10700
-$ tsh proxy --port 10700 app grafana &
-# Proxying connections to grafana on 127.0.0.1:10700
-$ curl http://127.0.0.1:10700/api/users
-```
-
 ### tsh scp
 
 Copies files from source to dest:
@@ -938,7 +902,7 @@ $ tctl nodes add [<flags>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `--roles` | `node` | `proxy, auth, node, db, app` or `windowsdesktop` | Comma-separated list of roles for the new node to assume |
+| `--roles` | `node` | `node,auth` or `proxy` | Comma-separated list of roles for the new node to assume |
 | `--ttl` | 30m | relative duration like 5s, 2m, or 3h | Time to live for a generated token |
 | `--token` | none | **string** token value | A custom token to use, auto-generated if not provided. Should match token set with `teleport start --token` |
 
@@ -989,9 +953,9 @@ $ tctl tokens add --type=TYPE [<flags>]
 
 | Name | Default Value(s) | Allowed Value(s) | Description |
 | - | - | - | - |
-| `--type` | none | `proxy`, `auth`, `trusted_cluster`, `node`,  `db`, `kube`, `app`, `windowsdesktop` | Type of token to add |
+| `--type` | none | `trusted_cluster`, `node`, `proxy` | Type of token to add |
 | `--value` | none | **string** token value | Value of token to add |
-| `--ttl` | 1h | relative duration like 5s, 2m, or 3h | Set expiration time for token |
+| `--ttl` | 1h | relative duration like 5s, 2m, or 3h, **maximum 48h** | Set expiration time for token |
 
 #### [Global Flags](#tctl-global-flags)
 
@@ -1325,37 +1289,6 @@ Print cluster version:
 tctl version
 ```
 
-## Resource filtering
-
-Both `tsh` and `tctl` allow you to filter `nodes`, `apps`, `db`, and `kube` resources using the `--search` and `--query` flags.
-
-The `--search` flag performs a simple fuzzy search on resource fields. For example, `--search=mac` searches for resources containing `mac`.
-
-The `--query` flag allows you to perform more sophisticated searches using a [predicate language](predicate-language.mdx#resource-filtering).
-
-In both cases, you can further refine the results by appending a list of comma-separated labels to the command. For example:
-
-```bash
-$ tsh ls --search=foo,bar labelKey1=labelValue1,labelKey2=labelValue2
-```
-
-### Filter Examples
-
-```bash
-# List all nodes
-$ tsh ls
-
-# List nodes using label argument
-$ tsh ls env=staging,os=mac
-
-# List nodes using search keywords
-$ tsh ls --search=staging,mac
-
-# List nodes using predicate language. This query searches for nodes with labels
-# with key `env` equal to `staging` and key `os` equal to `mac`.
-$ tsh ls --query='labels.env == "staging" && equals(labels.os, "mac")'
-```
-
 ## Experimental features
 
 ### tctl access ls
diff --git a/docs/pages/setup/reference/license.mdx b/docs/pages/setup/reference/license.mdx
index 6532a9f385d4c..273c4e4663fbc 100644
--- a/docs/pages/setup/reference/license.mdx
+++ b/docs/pages/setup/reference/license.mdx
@@ -3,18 +3,11 @@ title: Enterprise License File
 description: Teleport enterprise license file configuration parameters and requirements
 ---
 
-Commercial self-hosted Teleport subscriptions require a valid license. The license file can
+Commercial Teleport subscriptions require a valid license. The license file can
 be downloaded from the [Teleport Customer
-Portal](https://dashboard.gravitational.com/web/login). When downloading the file, the products you are licensed to use will be listed in the browser. 
+Portal](https://dashboard.gravitational.com/web/login).
 
-<Admonition type="tip" >
-Teleport Cloud manages licensing for customers, and there is no need to manage license files yourself. 
-</Admonition>
-
-The Teleport license file contains an X.509 certificate and the corresponding
-private key in PEM format. Place the downloaded file on your Teleport Auth
-Servers and set the `license_file` configuration parameter of your
-`teleport.yaml` to point to the file location:
+The Teleport license file contains a X.509 certificate and the corresponding private key in PEM format. Place the downloaded file on Auth servers and set the `license_file` configuration parameter of your `teleport.yaml` to point to the file location:
 
 ```yaml
 auth_service:
@@ -25,9 +18,9 @@ The `license_file` path can be either absolute or relative to the configured
 `data_dir`. If the license file path is not set, Teleport will look for the
 `license.pem` file in the configured `data_dir`.
 
-Only Auth Servers require the license. Proxies and Nodes that do not also run the Auth Service do not need the license.  
-    
-Attempts to use unlicensed products will result in an error message and users will be unable to use those products. For example, if you attempt to use Database Access without it being included in the license, you will get a message similar to:
-```code
-this Teleport cluster is not licensed for database access, please contact the cluster administrator
-```
+<Admonition
+  type="tip"
+  title="NOTE"
+>
+  Only Auth servers require the license. Proxies and Nodes that do not also have Auth role enabled do not need the license.
+</Admonition>
diff --git a/docs/pages/setup/reference/metrics.mdx b/docs/pages/setup/reference/metrics.mdx
index 69c8ff0cf30bb..ae574253ff76f 100644
--- a/docs/pages/setup/reference/metrics.mdx
+++ b/docs/pages/setup/reference/metrics.mdx
@@ -1,79 +1,30 @@
 ---
-title: Teleport Diagnostics
-description: How to use Teleport's health, readiness, profiling, and monitoring endpoints.
+title: Teleport Metrics
+description: How to set up Prometheus to monitor Teleport for SSH and Kubernetes access
+h1: Metrics
 ---
 
-Teleport provides HTTP endpoints for monitoring purposes. They are disabled by
-default, but you can enable them using the `--diag-addr` flag when running
-`teleport start`:
+## Teleport Prometheus endpoint
+
+Teleport provides HTTP endpoints for monitoring purposes. They are disabled
+by default, but you can enable them using the `--diag-addr` flag to `teleport start`:
 
 ```code
 $ sudo teleport start --diag-addr=127.0.0.1:3000
 ```
 
-Now you can collect monitoring information from several endpoints.
-
-## `/healthz`
-
-The `http://127.0.0.1:3000/healthz` endpoint responds with a body of
-`{"status":"ok"}` and an HTTP 200 OK status code if the process is running.
-
-This is a simple check, suitable for determining if the Teleport process is
-still running.
-
-## `/readyz`
-
-The `http://127.0.0.1:3000/readyz` endpoint is similar to `/healthz`, but its
-response includes information about the state of the process.
-
-The response body is a JSON object of the form:
-
-```
-{ "status": "a status message here"}
-```
-
-### `/readyz` and heartbeats
-
-If a Teleport component fails to execute its heartbeat procedure, it will enter
-a degraded state. Teleport will begin recovering from this state when a
-heartbeat completes successfully.
-
-The first successful heartbeat will transition Teleport into a recovering state.
-
-A second consecutive successful heartbeat will cause Teleport to transition to
-the OK state, so long as at least 10 seconds have elapsed since the
-first successful heartbeat.
-
-Teleport heartbeats run every 5 seconds. This means that depending on the timing
-of heartbeats, it can take 10-20 seconds after connectivity is restored for
-`/readyz` to start reporting healthy again.
-
-### Status codes
-
-The status code of the response can be one of:
-
-- HTTP 200 OK: Teleport is operating normally
-- HTTP 503 Service Unavailable: Teleport has encountered a connection error and
-  is running in a degraded state. This happens when a Teleport heartbeat fails.
-- HTTP 400 Bad Request: Teleport is either entering its initial startup phase or
-  has begun recovering from a degraded state.
-
-The same state information is also available via the `process_state` metric
-under the `/metrics` endpoint.
-
-## `/debug/pprof`
-
-The `http://127.0.0.1:3000/debug/pprof/` endpoint is Go's standard pprof
-profiler. This endpoint is only available if the `--debug` (or `-d`) flag is
-supplied (in addition to `--diag-addr`).
-
-## `/metrics`
-
-The `http://127.0.0.1:3000/metrics` endpoint serves the internal metrics
-Teleport is tracking. It is compatible with
-[Prometheus](https://prometheus.io/) collectors.
-
-The following metrics are available:
+Now you can see the monitoring information by visiting several endpoints:
+
+- `http://127.0.0.1:3000/metrics` is the list of internal metrics Teleport is
+  tracking. It is compatible with [Prometheus](https://prometheus.io/)
+  collectors.
+- `http://127.0.0.1:3000/healthz` returns "OK" if the process is healthy or
+  `503` otherwise.
+- `http://127.0.0.1:3000/readyz` is similar to `/healthz`, but it returns "OK"
+  *only after* the node successfully joined the cluster, i.e.it draws the
+  difference between "healthy" and "ready".
+- `http://127.0.0.1:3000/debug/pprof/` is Golang's standard profiler. It's only
+  available when `-d` flag is given in addition to `--diag-addr`
 
 | Name | Type | Component | Description |
 | - | - | - | - |
diff --git a/docs/pages/setup/reference/predicate-language.mdx b/docs/pages/setup/reference/predicate-language.mdx
deleted file mode 100644
index 946e3e71bdd8d..0000000000000
--- a/docs/pages/setup/reference/predicate-language.mdx
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: Predicate Language
-description: How to use Teleport's predicate language to define filter conditions.
----
-
-Teleport's predicate language is used to define conditions for filtering in dynamic configuration resources.
-It is also used as a query language to filter and search through a [list of select resources](#resource-filtering).
-
-The predicate language uses a slightly different syntax depending on whether it is used in:
-
-- [Role resources](#scoping-allowdeny-rules-in-role-resources)
-- [Resource filtering](#resource-filtering)
-
-## Scoping allow/deny rules in role resources
-
-Some fields in Teleport's role resources use the predicate language to define the scope of a role's permissions:
-
-- [Dynamic Impersonation](../../access-controls/guides/impersonation.mdx#filter-fields)
-- [RBAC for sessions](../../access-controls/reference.mdx#filter-fields)
-
-When used in role resources, the predicate language supports the following operators:
-
-| Operator | Meaning                                          | Example                                                  |
-|----------|--------------------------------------------------|----------------------------------------------------------|
-| &&       | and (all conditions must match)                  | `contains(field1, field2) && equals(field2, "val")`      |
-| \|\|     | or  (any one condition should match)             | `contains(field1, field2) \|\| contains(field1, "val2")` |
-| !        | not (used with functions, more about this below) | `!equals(field1, field2)`                                |
-
-The language also supports the following functions:
-
-| Functions                      | Description                                                                           |
-|--------------------------------|---------------------------------------------------------------------------------------|
-| `contains(<field>, <field2>)`  | checks if the value from `<field2>` is included in the list of strings from `<field>` |
-| `contains(<field>, "<value>")` | checks if `<value>` is included in the list of strings from `<field>`                 |
-| `equals(<field>, <field2>)`    | checks if the value from `<field2>` is equal to the value from `<field>`              |
-| `equals(<field>, "<value>")`   | checks if `<value>` is equal to the value from `<field>`                              |
-
-
-## Resource filtering
-
-Both the [`tsh`](cli.mdx#tsh) and [`tctl`](cli.mdx#tctl) CLI tools allow you to filter nodes, 
-applications, databases, and Kubernetes resources using the `--query` flag. The `--query` flag allows you to 
-perform more sophisticated searches using the predicate language.
-
-For common resource fields, we defined shortened field names that can easily be accessed by:
-
-| Short Field    | Actual Field Equivalent                                     | Example                   |
-|----------------|-------------------------------------------------------------|---------------------------|
-| `labels.<key>` | `resource.metadata.labels` + `resource.spec.dynamic_labels` | `labels.env == "staging"` |
-| `name`         | `resource.metadata.name`                                    | `name == "jenkins"`       |
-
-The language supports the following operators:
-
-| Operator | Meaning                              | Example                                             |
-|----------|--------------------------------------|-----------------------------------------------------|
-| ==       | equal to                             | `labels.env == "prod"` or `labels["env"] == "prod"` |
-| !=       | not equal to                         | `labels.env != "prod"`                              |
-| &&       | and (all conditions must match)      | `labels.env == "prod" && labels.os == "mac"`        |
-| \|\|     | or  (any one condition should match) | `labels.env == "dev" \|\| labels.env == "qa"`       |
-| !        | not (used with functions)            | `!equals(labels.env, "prod")`                       |
-
-The language also supports the following functions:
-
-| Functions (with examples)             | Description                                                |
-|---------------------------------------|------------------------------------------------------------|
-| `equals(labels.env, "prod")`          | resources with label key `env` equal to label value `prod` |
-| `exists(labels.env)`                  | resources with a label key `env`; label value unchecked    |
-| `!exists(labels.env)`                 | resources without a label key `env`; label value unchecked |
-| `search("foo", "bar", "some phrase")` | fuzzy match against common resource fields                 |
-
-See some [examples](cli.mdx#filter-examples) of the different ways you can filter resources.
diff --git a/docs/postrelease.md b/docs/postrelease.md
index 8a04ea1a3a3fd..3257156b7599e 100644
--- a/docs/postrelease.md
+++ b/docs/postrelease.md
@@ -16,9 +16,4 @@ This checklist is to be run after cutting a release.
   - Example: https://github.com/gravitational/teleport/pull/4602
 - [ ] Create PR to update default Teleport image referenced in docker/teleport-quickstart.yml and docker/teleport-ent-quickstart.yml
   - Example: https://github.com/gravitational/teleport/pull/4655
-- [ ] Create PR to update default Teleport image referenced in docker/teleport-lab.yml
-- [ ] Update the CI buildbox image
-  - [ ] Update the `BUILDBOX_VERSION` in `build.assets/Makefile`
-  - [ ] Run `make dronegen` and ensure _all_ buildbox references in the resulting yaml refer to the new image
-  - [ ] Commit and merge. Drone should build new buildbox images and push to `quay.io`
-  - [ ] Once the new images are confirmed in `quay.io`, update the build yaml files under `.cloudbuild` to refer to the new image
+- [ ] Create PR to update default Teleport image referenced in docker/teleport-lab.yml
\ No newline at end of file
diff --git a/dronegen/mac_pkg.go b/dronegen/mac_pkg.go
index 4cecacf430746..4b01ff2567883 100644
--- a/dronegen/mac_pkg.go
+++ b/dronegen/mac_pkg.go
@@ -16,7 +16,6 @@ package main
 
 import (
 	"fmt"
-	"path/filepath"
 	"strings"
 )
 
@@ -57,8 +56,8 @@ func darwinPkgPipeline(name, makeTarget string, pkgGlobs []string) pipeline {
 				"APPLE_USERNAME":    {fromSecret: "APPLE_USERNAME"},
 				"APPLE_PASSWORD":    {fromSecret: "APPLE_PASSWORD"},
 				"BUILDBOX_PASSWORD": {fromSecret: "BUILDBOX_PASSWORD"},
-				"OSS_TARBALL_PATH":  {raw: filepath.Join(p.Workspace.Path, "go/artifacts")},
-				"ENT_TARBALL_PATH":  {raw: filepath.Join(p.Workspace.Path, "go/artifacts")},
+				"OSS_TARBALL_PATH":  {raw: "/tmp/build-darwin-amd64-pkg/go/artifacts"},
+				"ENT_TARBALL_PATH":  {raw: "/tmp/build-darwin-amd64-pkg/go/artifacts"},
 				"OS":                {raw: b.os},
 				"ARCH":              {raw: b.arch},
 			},
diff --git a/dronegen/main.go b/dronegen/main.go
index b3bb1ccc41b64..9fde790cb6088 100644
--- a/dronegen/main.go
+++ b/dronegen/main.go
@@ -17,6 +17,7 @@ package main
 import (
 	"bytes"
 	"fmt"
+	"io/ioutil"
 	"os"
 
 	"gopkg.in/yaml.v2"
@@ -54,7 +55,7 @@ func writePipelines(path string, newPipelines []pipeline) error {
 	// TODO: When all pipelines are migrated, remove this merging logic and
 	// write the file directly. This will be simpler and allow cleanup of
 	// pipelines when they are removed from this generator.
-	existingConfig, err := os.ReadFile(path)
+	existingConfig, err := ioutil.ReadFile(path)
 	if err != nil {
 		return fmt.Errorf("failed to read existing config: %w", err)
 	}
@@ -103,7 +104,7 @@ func writePipelines(path string, newPipelines []pipeline) error {
 	}
 	configData := bytes.Join(pipelinesEnc, []byte("\n---\n"))
 
-	return os.WriteFile(path, configData, 0664)
+	return ioutil.WriteFile(path, configData, 0664)
 }
 
 // parsedPipeline is a single pipeline parsed from .drone.yml along with its
diff --git a/e b/e
index 9956b32428b41..ad8fd4aa9128b 160000
--- a/e
+++ b/e
@@ -1 +1 @@
-Subproject commit 9956b32428b41caa3f29c5ba8ccc0fe458c8e957
+Subproject commit ad8fd4aa9128b3dd5e80e84804be9850004f58b1
diff --git a/examples/aws/cloudformation/ent.yaml b/examples/aws/cloudformation/ent.yaml
index 040df910cdf38..78cef76d49d2e 100644
--- a/examples/aws/cloudformation/ent.yaml
+++ b/examples/aws/cloudformation/ent.yaml
@@ -97,24 +97,24 @@ Mappings:
     t2.xlarge: {Arch: HVM64}
 
   AWSRegionArch2AMI:
-    # All AMIs from AWS - gravitational-teleport-ami-ent-9.0.1
+    # All AMIs from AWS - gravitational-teleport-ami-ent-8.3.1
     eu-north-1: {HVM64: ami-05ff5c0be3d4b8da4}
-    ap-south-1: {HVM64 : ami-0cfab1c56ef76e56d}
-    eu-west-1: {HVM64 : ami-06d4f4a9c05b825e5}
-    eu-west-2: {HVM64 : ami-0dad9a7e8019828b4}
+    ap-south-1: {HVM64 : ami-0cf5de7e380590bd1}
+    eu-west-1: {HVM64 : ami-015d16a97a12e9f3e}
+    eu-west-2: {HVM64 : ami-0a1399d687e79f230}
     eu-west-3: {HVM64: ami-087bdce4ab6a2964d}
-    ap-northeast-1: {HVM64 : ami-058897779d3b609da}
-    ap-northeast-2: {HVM64 : ami-008d7f1530778b283}
+    ap-northeast-1: {HVM64 : ami-06238708fc042e0fb}
+    ap-northeast-2: {HVM64 : ami-0a8e2d7d4adede112}
     ap-northeast-3: {HVM64: ami-0a36f2dfdca83ea7d}
-    sa-east-1: {HVM64 : ami-014b64ac9c28e9a8d}
-    ca-central-1: {HVM64 : ami-0230b681466dd1cbd}
-    ap-southeast-1: {HVM64 : ami-0676627a7acfa18f8}
-    ap-southeast-2: {HVM64 : ami-07f605ef28b14a8c5}
-    eu-central-1: {HVM64 : ami-0220eec85a7bd0bca}
-    us-east-1: {HVM64 : ami-07ffa5186f4446e88}
-    us-east-2: {HVM64 : ami-046f6cfab972281dd}
-    us-west-1: {HVM64 : ami-080f35de39e3c0a43}
-    us-west-2: {HVM64 : ami-0d46e313ef984eb11}
+    sa-east-1: {HVM64 : ami-04a865841550cf519}
+    ca-central-1: {HVM64 : ami-0e964a19a5eef1633}
+    ap-southeast-1: {HVM64 : ami-0b8ea0f231fa1f5a1}
+    ap-southeast-2: {HVM64 : ami-03a3137350321d957}
+    eu-central-1: {HVM64 : ami-04f8ff95544fd0431}
+    us-east-1: {HVM64 : ami-0adc14e4ffaaad880}
+    us-east-2: {HVM64 : ami-0718beffe1e13c0a1}
+    us-west-1: {HVM64 : ami-044f8952623e0c010}
+    us-west-2: {HVM64 : ami-04cea237af09e9143}
 
 Resources:
 # Auth server setup
diff --git a/examples/aws/cloudformation/oss.yaml b/examples/aws/cloudformation/oss.yaml
index 2a8ac999d6f1a..e98725a5ca13a 100644
--- a/examples/aws/cloudformation/oss.yaml
+++ b/examples/aws/cloudformation/oss.yaml
@@ -97,24 +97,24 @@ Mappings:
     t2.xlarge: {Arch: HVM64}
 
   AWSRegionArch2AMI:
-    # All AMIs from AWS - gravitational-teleport-ami-oss-9.0.1
+    # All AMIs from AWS - gravitational-teleport-ami-oss-8.3.1
     eu-north-1: {HVM64: ami-0eef7480d85b07d78}
-    ap-south-1: {HVM64 : ami-04a5baf8089868310}
-    eu-west-1: {HVM64 : ami-024a59feb00e6f9d3}
-    eu-west-2: {HVM64 : ami-0304ace50865a0248}
+    ap-south-1: {HVM64 : ami-0e71fa13d0a5e33f2}
+    eu-west-1: {HVM64 : ami-05a0e7906f76be419}
+    eu-west-2: {HVM64 : ami-06ac2f9f8b32cc9cf}
     eu-west-3: {HVM64: ami-0211c6e2e821dd249}
-    ap-northeast-1: {HVM64 : ami-02192f3f6b37326be}
-    ap-northeast-2: {HVM64 : ami-0c305fdb520cd2d03}
+    ap-northeast-1: {HVM64 : ami-0a80043fecc73a945}
+    ap-northeast-2: {HVM64 : ami-00366bfff7fb938e3}
     ap-northeast-3: {HVM64: ami-02bb8618b75d025aa}
-    sa-east-1: {HVM64 : ami-0357206209e0e1ac8}
-    ca-central-1: {HVM64 : ami-02cacc908a9ecaed0}
-    ap-southeast-1: {HVM64 : ami-0c7d9089b8fb98d49}
-    ap-southeast-2: {HVM64 : ami-0735924e3c026e00e}
-    eu-central-1: {HVM64 : ami-0a8a74865d820373c}
-    us-east-1: {HVM64 : ami-050e1228432bc017e}
-    us-east-2: {HVM64 : ami-06ad7d932122afd7b}
-    us-west-1: {HVM64 : ami-07b0c77d68a2e98cf}
-    us-west-2: {HVM64 : ami-0c2505a13d6e118e7}
+    sa-east-1: {HVM64 : ami-016fc226c84d65aa0}
+    ca-central-1: {HVM64 : ami-03a5d00511ccae664}
+    ap-southeast-1: {HVM64 : ami-047dd4f4aca8ce448}
+    ap-southeast-2: {HVM64 : ami-0ed11afe3b8b432a5}
+    eu-central-1: {HVM64 : ami-0be730bb45d2696cc}
+    us-east-1: {HVM64 : ami-0301399a479b2fd45}
+    us-east-2: {HVM64 : ami-02da5e6cdbc0eeea0}
+    us-west-1: {HVM64 : ami-07556dfe74d1ce75b}
+    us-west-2: {HVM64 : ami-0b0d4a5a84433577a}
 
 Resources:
 # Auth server setup
diff --git a/examples/aws/terraform/AMIS.md b/examples/aws/terraform/AMIS.md
index 54ef0aed0a837..876c68e0687bc 100644
--- a/examples/aws/terraform/AMIS.md
+++ b/examples/aws/terraform/AMIS.md
@@ -6,65 +6,65 @@ is updated when new AMI versions are released.
 ### OSS
 
 ```
-# eu-north-1 v9.0.1 OSS: ami-06c7f71980ff71b25
-# ap-south-1 v9.0.1 OSS: ami-04a5baf8089868310
-# eu-west-1 v9.0.1 OSS: ami-024a59feb00e6f9d3
-# eu-west-2 v9.0.1 OSS: ami-0304ace50865a0248
-# eu-west-3 v9.0.1 OSS: ami-076a360cd048e6a71
-# ap-northeast-1 v9.0.1 OSS: ami-02192f3f6b37326be
-# ap-northeast-2 v9.0.1 OSS: ami-0c305fdb520cd2d03
-# ap-northeast-3 v9.0.1 OSS: ami-027f0e95d0c6981b0
-# sa-east-1 v9.0.1 OSS: ami-0357206209e0e1ac8
-# ca-central-1 v9.0.1 OSS: ami-02cacc908a9ecaed0
-# ap-southeast-1 v9.0.1 OSS: ami-0c7d9089b8fb98d49
-# ap-southeast-2 v9.0.1 OSS: ami-0735924e3c026e00e
-# eu-central-1 v9.0.1 OSS: ami-0a8a74865d820373c
-# us-east-1 v9.0.1 OSS: ami-050e1228432bc017e
-# us-east-2 v9.0.1 OSS: ami-06ad7d932122afd7b
-# us-west-1 v9.0.1 OSS: ami-07b0c77d68a2e98cf
-# us-west-2 v9.0.1 OSS: ami-0c2505a13d6e118e7
+# eu-north-1 v8.3.1 OSS: ami-05d4fa4c08dea86be
+# ap-south-1 v8.3.1 OSS: ami-0e71fa13d0a5e33f2
+# eu-west-1 v8.3.1 OSS: ami-05a0e7906f76be419
+# eu-west-2 v8.3.1 OSS: ami-06ac2f9f8b32cc9cf
+# eu-west-3 v8.3.1 OSS: ami-0246af46b3d1a44d8
+# ap-northeast-1 v8.3.1 OSS: ami-0a80043fecc73a945
+# ap-northeast-2 v8.3.1 OSS: ami-00366bfff7fb938e3
+# ap-northeast-3 v8.3.1 OSS: ami-098b67353e16bc627
+# sa-east-1 v8.3.1 OSS: ami-016fc226c84d65aa0
+# ca-central-1 v8.3.1 OSS: ami-03a5d00511ccae664
+# ap-southeast-1 v8.3.1 OSS: ami-047dd4f4aca8ce448
+# ap-southeast-2 v8.3.1 OSS: ami-0ed11afe3b8b432a5
+# eu-central-1 v8.3.1 OSS: ami-0be730bb45d2696cc
+# us-east-1 v8.3.1 OSS: ami-0301399a479b2fd45
+# us-east-2 v8.3.1 OSS: ami-02da5e6cdbc0eeea0
+# us-west-1 v8.3.1 OSS: ami-07556dfe74d1ce75b
+# us-west-2 v8.3.1 OSS: ami-0b0d4a5a84433577a
 ```
 
 ### Enterprise
 
 ```
-# eu-north-1 v9.0.1 Enterprise: ami-0acc68f7755c2eb98
-# ap-south-1 v9.0.1 Enterprise: ami-0cfab1c56ef76e56d
-# eu-west-1 v9.0.1 Enterprise: ami-06d4f4a9c05b825e5
-# eu-west-2 v9.0.1 Enterprise: ami-0dad9a7e8019828b4
-# eu-west-3 v9.0.1 Enterprise: ami-06c32606e0b2c4181
-# ap-northeast-1 v9.0.1 Enterprise: ami-058897779d3b609da
-# ap-northeast-2 v9.0.1 Enterprise: ami-008d7f1530778b283
-# ap-northeast-3 v9.0.1 Enterprise: ami-08b94d30fec7bca1f
-# sa-east-1 v9.0.1 Enterprise: ami-014b64ac9c28e9a8d
-# ca-central-1 v9.0.1 Enterprise: ami-0230b681466dd1cbd
-# ap-southeast-1 v9.0.1 Enterprise: ami-0676627a7acfa18f8
-# ap-southeast-2 v9.0.1 Enterprise: ami-07f605ef28b14a8c5
-# eu-central-1 v9.0.1 Enterprise: ami-0220eec85a7bd0bca
-# us-east-1 v9.0.1 Enterprise: ami-07ffa5186f4446e88
-# us-east-2 v9.0.1 Enterprise: ami-046f6cfab972281dd
-# us-west-1 v9.0.1 Enterprise: ami-080f35de39e3c0a43
-# us-west-2 v9.0.1 Enterprise: ami-0d46e313ef984eb11
+# eu-north-1 v8.3.1 Enterprise: ami-0025aaaa97b15e900
+# ap-south-1 v8.3.1 Enterprise: ami-0cf5de7e380590bd1
+# eu-west-1 v8.3.1 Enterprise: ami-015d16a97a12e9f3e
+# eu-west-2 v8.3.1 Enterprise: ami-0a1399d687e79f230
+# eu-west-3 v8.3.1 Enterprise: ami-03bfb7db0eb4089cf
+# ap-northeast-1 v8.3.1 Enterprise: ami-06238708fc042e0fb
+# ap-northeast-2 v8.3.1 Enterprise: ami-0a8e2d7d4adede112
+# ap-northeast-3 v8.3.1 Enterprise: ami-022c50efe794001ac
+# sa-east-1 v8.3.1 Enterprise: ami-04a865841550cf519
+# ca-central-1 v8.3.1 Enterprise: ami-0e964a19a5eef1633
+# ap-southeast-1 v8.3.1 Enterprise: ami-0b8ea0f231fa1f5a1
+# ap-southeast-2 v8.3.1 Enterprise: ami-03a3137350321d957
+# eu-central-1 v8.3.1 Enterprise: ami-04f8ff95544fd0431
+# us-east-1 v8.3.1 Enterprise: ami-0adc14e4ffaaad880
+# us-east-2 v8.3.1 Enterprise: ami-0718beffe1e13c0a1
+# us-west-1 v8.3.1 Enterprise: ami-044f8952623e0c010
+# us-west-2 v8.3.1 Enterprise: ami-04cea237af09e9143
 ```
 
 ### Enterprise FIPS
 
 ```
-# eu-north-1 v9.0.1 Enterprise FIPS: ami-0ae03293e8f7c270e
-# ap-south-1 v9.0.1 Enterprise FIPS: ami-0e3554edf5b4d7f43
-# eu-west-1 v9.0.1 Enterprise FIPS: ami-0a38a70f423c2af6c
-# eu-west-2 v9.0.1 Enterprise FIPS: ami-0f1d2195cd6ba552a
-# eu-west-3 v9.0.1 Enterprise FIPS: ami-024c90f6d18f964b8
-# ap-northeast-1 v9.0.1 Enterprise FIPS: ami-0bf0dfc5903e8d744
-# ap-northeast-2 v9.0.1 Enterprise FIPS: ami-071ab1359b4c6d0ab
-# ap-northeast-3 v9.0.1 Enterprise FIPS: ami-04cfbca2410bc966e
-# sa-east-1 v9.0.1 Enterprise FIPS: ami-0543fee3b7e20a557
-# ca-central-1 v9.0.1 Enterprise FIPS: ami-0b4c828432b359cb6
-# ap-southeast-1 v9.0.1 Enterprise FIPS: ami-01b4d5889fe2ab815
-# ap-southeast-2 v9.0.1 Enterprise FIPS: ami-01db9009d4853caf5
-# eu-central-1 v9.0.1 Enterprise FIPS: ami-01bd770a772f1a3ac
-# us-east-1 v9.0.1 Enterprise FIPS: ami-071fe9f049c218551
-# us-east-2 v9.0.1 Enterprise FIPS: ami-0dcbda64b7ef1ded6
-# us-west-1 v9.0.1 Enterprise FIPS: ami-05ca0f53382e0b713
-# us-west-2 v9.0.1 Enterprise FIPS: ami-00defc5ca4ef52823
+# eu-north-1 v8.3.1 Enterprise FIPS: ami-010a0dafec42cc34c
+# ap-south-1 v8.3.1 Enterprise FIPS: ami-07b3523d3ac90e210
+# eu-west-1 v8.3.1 Enterprise FIPS: ami-0c14d8258e109934f
+# eu-west-2 v8.3.1 Enterprise FIPS: ami-07ffb24ab2607f0a8
+# eu-west-3 v8.3.1 Enterprise FIPS: ami-00d5e3a93c5f64518
+# ap-northeast-1 v8.3.1 Enterprise FIPS: ami-08b3f1339c51e51d7
+# ap-northeast-2 v8.3.1 Enterprise FIPS: ami-022aab582835216f0
+# ap-northeast-3 v8.3.1 Enterprise FIPS: ami-025a9b33d02b84a33
+# sa-east-1 v8.3.1 Enterprise FIPS: ami-0c273078373811da1
+# ca-central-1 v8.3.1 Enterprise FIPS: ami-0305991f60af08149
+# ap-southeast-1 v8.3.1 Enterprise FIPS: ami-013268de76ec30b64
+# ap-southeast-2 v8.3.1 Enterprise FIPS: ami-07923d4c379e64eea
+# eu-central-1 v8.3.1 Enterprise FIPS: ami-0309e5091ab89a293
+# us-east-1 v8.3.1 Enterprise FIPS: ami-0a2064984c331ff46
+# us-east-2 v8.3.1 Enterprise FIPS: ami-08ac544666b38afee
+# us-west-1 v8.3.1 Enterprise FIPS: ami-00839fecaafaad134
+# us-west-2 v8.3.1 Enterprise FIPS: ami-03c8665e782623436
 ```
diff --git a/examples/aws/terraform/ha-autoscale-cluster/README.md b/examples/aws/terraform/ha-autoscale-cluster/README.md
index f4e9704cdc2c1..11b3de2296baf 100644
--- a/examples/aws/terraform/ha-autoscale-cluster/README.md
+++ b/examples/aws/terraform/ha-autoscale-cluster/README.md
@@ -45,7 +45,7 @@ export TF_VAR_cluster_name="teleport.example.com"
 # OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
 # Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
 # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
-export TF_VAR_ami_name="gravitational-teleport-ami-ent-9.0.1"
+export TF_VAR_ami_name="gravitational-teleport-ami-ent-8.3.1"
 
 # AWS SSH key name to provision in installed instances, should be available in the region
 export TF_VAR_key_name="example"
diff --git a/examples/aws/terraform/starter-cluster/README.md b/examples/aws/terraform/starter-cluster/README.md
index 4d4fb08fcb162..8607428e256d9 100644
--- a/examples/aws/terraform/starter-cluster/README.md
+++ b/examples/aws/terraform/starter-cluster/README.md
@@ -86,7 +86,7 @@ TF_VAR_license_path ?="/path/to/license"
 # OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*'
 # Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*'
 # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name
-TF_VAR_ami_name ?="gravitational-teleport-ami-ent-9.0.1"
+TF_VAR_ami_name ?="gravitational-teleport-ami-ent-8.3.1"
 
 # Route 53 hosted zone to use, must be a root zone registered in AWS, e.g. example.com
 TF_VAR_route53_zone ?="example.com"
diff --git a/examples/aws/terraform/starter-cluster/vars.tf b/examples/aws/terraform/starter-cluster/vars.tf
index 318ff7f4d3c47..e0f85794a0c73 100644
--- a/examples/aws/terraform/starter-cluster/vars.tf
+++ b/examples/aws/terraform/starter-cluster/vars.tf
@@ -42,7 +42,7 @@ variable "email" {
 }
 
 
-// SSH key name to provision instances with
+// SSH key name to provision instances withx
 variable "key_name" {
   type = string
 }
diff --git a/examples/chart/CONTRIBUTING.md b/examples/chart/CONTRIBUTING.md
deleted file mode 100644
index af2a5d9e3abda..0000000000000
--- a/examples/chart/CONTRIBUTING.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# Contributing to Teleport Helm charts
-
-Firstly, thanks for considering a contribution to Teleport's Helm charts.
-
-## A couple of brief warnings
-
-Please note that we won't accept contributions that are particularly esoteric, difficult to use or poorly implemented.
-Our goal is to:
-
-- keep the charts easy to use
-- keep all functionality relevant to a broad audience
-- always use sane defaults which are right for most deployments
-- require as few values changes as possible for everyday usage
-
-If your functionality is only really useful to you, it's best to keep it on your own fork and deploy from there.
-
-Sometimes Teleport staff may take over your PR and make changes, implement it in a slightly different way, or just merge it
-as part of a bigger merge of multiple PRs at once. We will make sure that you still get credit in the final commit if this
-happens.
-
-## Guidelines
-
-Here is a list of things that you should do to make sure to do in order to get a smooth PR review process with minimal
-changes required:
-
-1) Add a linter file which includes examples for any new values you add under the `.lint/` directory for the
-appropriate chart. The linter will check this during CI and make sure the values are correctly formatted, along
-with your chart changes. The file should contain all necessary values to deploy a reference install.
-
-2) Add unit tests for your functionality under the `tests/` directory for the appropriate chart, particularly if you're
-adding new values. Make sure that all functionality is tested, so we can be sure that it works as intended for every use
-case. A good tip is to use your newly added linter file to set values appropriate for your test.
-
-3) Add any new values at the correct location in the `values.schema.json` file for the appropriate chart. This
-will ensure that Helm is able to validate values at install-time and can prevent users from making easy mistakes.
-
-4) Document any new values or changes to existing behaviour in the [chart reference](../../docs/pages/kubernetes-access/helm/reference.mdx).
-
-5) Run `make lint-helm test-helm` from the root of the repo before raising your PR.
-You will need `yamllint`, `helm` and [helm3-unittest](https://github.com/vbehar/helm3-unittest) installed locally.
-
-`make -C build.assets lint-helm test-helm` will run these via Docker if you'd prefer not to install locally.
-
-6) If you get a snapshot error during your testing, you should verify that your changes intended to alter the output,
-then run `make test-helm-update-snapshots` to update the snapshots and commit these changes along with your PR.
-
-Again, `make -C build.assets test-helm-update-snapshots` will run this via Docker.
-
-7) Document the changes you've made in the PR summary.
-
-Thanks!
diff --git a/examples/chart/teleport-auto-trustedcluster/README.md b/examples/chart/teleport-auto-trustedcluster/README.md
index 0ffaa7a090dd1..12dd081fc08dd 100644
--- a/examples/chart/teleport-auto-trustedcluster/README.md
+++ b/examples/chart/teleport-auto-trustedcluster/README.md
@@ -1,8 +1,3 @@
-# WARNING
-
-This chart is **deprecated** and no longer actively maintained or supported by Teleport.
-We recommend the use of the [teleport-cluster](../teleport-cluster/README.md) chart instead.
-
 # Teleport
 
 [Gravitational Teleport](https://github.com/gravitational/teleport) is a modern SSH/Kubernetes API proxy server for
diff --git a/examples/chart/teleport-cluster/.lint/service.yaml b/examples/chart/teleport-cluster/.lint/service.yml
similarity index 100%
rename from examples/chart/teleport-cluster/.lint/service.yaml
rename to examples/chart/teleport-cluster/.lint/service.yml
diff --git a/examples/chart/teleport-cluster/.lint/standalone-customsize.yaml b/examples/chart/teleport-cluster/.lint/standalone-customsize.yaml
index e8acbe8cf9848..345999323a716 100644
--- a/examples/chart/teleport-cluster/.lint/standalone-customsize.yaml
+++ b/examples/chart/teleport-cluster/.lint/standalone-customsize.yaml
@@ -1,7 +1,7 @@
 clusterName: test-standalone-cluster
 chartMode: standalone
 standalone:
-  volumeSize: 50Gi
+  existingClaimName: teleport-storage
 acme: true
 acmeEmail: test@email.com
 labels:
diff --git a/examples/chart/teleport-cluster/.lint/standalone-existingpvc.yaml b/examples/chart/teleport-cluster/.lint/standalone-existingpvc.yaml
index 345999323a716..e8acbe8cf9848 100644
--- a/examples/chart/teleport-cluster/.lint/standalone-existingpvc.yaml
+++ b/examples/chart/teleport-cluster/.lint/standalone-existingpvc.yaml
@@ -1,7 +1,7 @@
 clusterName: test-standalone-cluster
 chartMode: standalone
 standalone:
-  existingClaimName: teleport-storage
+  volumeSize: 50Gi
 acme: true
 acmeEmail: test@email.com
 labels:
diff --git a/examples/chart/teleport-cluster/.lint/volumes.yaml b/examples/chart/teleport-cluster/.lint/volumes.yaml
index a1ce300828a45..83bb8b8dbe95c 100644
--- a/examples/chart/teleport-cluster/.lint/volumes.yaml
+++ b/examples/chart/teleport-cluster/.lint/volumes.yaml
@@ -1,7 +1,7 @@
 clusterName: helm-lint
 extraVolumeMounts:
 - name: "my-mount"
-  mountPath: "/path/to/mount"
+  path: "/path/to/mount"
 extraVolumes:
 - name: "my-mount"
   secret:
diff --git a/examples/chart/teleport-cluster/.lint/webauthn.yaml b/examples/chart/teleport-cluster/.lint/webauthn.yaml
deleted file mode 100644
index 0415cc7c7f512..0000000000000
--- a/examples/chart/teleport-cluster/.lint/webauthn.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-clusterName: helm-lint
-authenticationSecondFactor:
-  secondFactor: "on"
-  webauthn:
-    attestationAllowedCas:
-      - "/etc/ssl/certs/ca-certificates.crt"
-    attestationDeniedCas:
-      - "/etc/ssl/certs/ca-certificates.crt"
diff --git a/examples/chart/teleport-cluster/README.md b/examples/chart/teleport-cluster/README.md
index 51ffdf73bcbab..45504877ba6e2 100644
--- a/examples/chart/teleport-cluster/README.md
+++ b/examples/chart/teleport-cluster/README.md
@@ -47,7 +47,3 @@ secret `license` in the chart namespace.
 
 See https://goteleport.com/docs/kubernetes-access/helm/guides/ for guides on setting up HA Teleport clusters
 in EKS or GKE, plus a more comprehensive chart reference.
-
-## Contributing to the chart
-
-Please read [CONTRIBUTING.md](../CONTRIBUTING.md) before raising a pull request to this chart.
diff --git a/examples/chart/teleport-cluster/templates/config.yaml b/examples/chart/teleport-cluster/templates/config.yaml
index 54369e4161af5..d86d63e4901e4 100644
--- a/examples/chart/teleport-cluster/templates/config.yaml
+++ b/examples/chart/teleport-cluster/templates/config.yaml
@@ -4,7 +4,6 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ .Release.Name }}
-  namespace: {{ .Release.Namespace }}
   {{- if .Values.annotations.config }}
   annotations:
     {{- toYaml .Values.annotations.config | nindent 4 }}
@@ -56,33 +55,12 @@ data:
   {{- end }}
       authentication:
         type: {{ required "authenticationType is required in chart values" .Values.authenticationType }}
-  {{- if .Values.authenticationSecondFactor }}
-    {{- if .Values.authenticationSecondFactor.secondFactor }}
-        second_factor: {{ .Values.authenticationSecondFactor.secondFactor }}
-    {{- end }}
-    {{- if not (or (eq .Values.authenticationSecondFactor.secondFactor "off") (eq .Values.authenticationSecondFactor.secondFactor "otp")) }}
-        webauthn:
-          rp_id: {{ required "clusterName is required in chart values" .Values.clusterName }}
-      {{- if .Values.authenticationSecondFactor.webauthn }}
-        {{- if .Values.authenticationSecondFactor.webauthn.attestationAllowedCas }}
-          attestation_allowed_cas:
-          {{- toYaml .Values.authenticationSecondFactor.webauthn.attestationAllowedCas | nindent 12 }}
-        {{- end }}
-        {{- if .Values.authenticationSecondFactor.webauthn.attestationDeniedCas }}
-          attestation_denied_cas:
-          {{- toYaml .Values.authenticationSecondFactor.webauthn.attestationDeniedCas | nindent 12 }}
-        {{- end }}
-      {{- end }}
-    {{- end }}
-  {{- end }}
   {{- if eq .Values.proxyListenerMode "multiplex" }}
       proxy_listener_mode: multiplex
   {{- end }}
     kubernetes_service:
       enabled: true
-  {{- if eq .Values.proxyListenerMode "multiplex" }}
-      listen_addr: 0.0.0.0:443
-  {{- else if not .Values.proxyListenerMode }}
+  {{- if not .Values.proxyListenerMode }}
       listen_addr: 0.0.0.0:3027
   {{- end }}
   {{- if .Values.kubeClusterName }}
diff --git a/examples/chart/teleport-cluster/tests/README.md b/examples/chart/teleport-cluster/tests/README.md
deleted file mode 100644
index 3cd0f8783d4e6..0000000000000
--- a/examples/chart/teleport-cluster/tests/README.md
+++ /dev/null
@@ -1,18 +0,0 @@
-## Unit tests for Helm charts
-
-Helm chart unit tests run here using the [helm3-unittest](https://github.com/vbehar/helm3-unittest) Helm plugin.
-
-If you get a snapshot error during your testing, you should verify that your changes intended to alter the output, then run
-this command from the root of your Teleport checkout to update the snapshots:
-
-```bash
-make -C build.assets test-helm-update-snapshots
-```
-
-After this, re-run the tests to make sure everything is fine:
-
-```bash
-make -C build.assets test-helm
-```
-
-Commit the updated snapshots along with your changes.
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/certificate_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/certificate_test.yaml.snap
deleted file mode 100644
index 319cbd80eb8c0..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/certificate_test.yaml.snap
+++ /dev/null
@@ -1,16 +0,0 @@
-should request a certificate for cluster name when cert-manager is enabled (cert-manager.yaml):
-  1: |
-    - test-cluster
-    - '*.test-cluster'
-  2: |
-    group: custom.cert-manager.io
-    kind: CustomClusterIssuer
-    name: custom
-should request a certificate for cluster name when cert-manager is enabled (cert-secret.yaml):
-  1: |
-    - test-cluster
-    - '*.test-cluster'
-  2: |
-    group: cert-manager.io
-    kind: Issuer
-    name: letsencrypt
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/clusterrole_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/clusterrole_test.yaml.snap
deleted file mode 100644
index 73d2b30742ace..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/clusterrole_test.yaml.snap
+++ /dev/null
@@ -1,27 +0,0 @@
-creates a ClusterRole:
-  1: |
-    apiVersion: rbac.authorization.k8s.io/v1
-    kind: ClusterRole
-    metadata:
-      name: RELEASE-NAME
-    rules:
-    - apiGroups:
-      - ""
-      resources:
-      - users
-      - groups
-      - serviceaccounts
-      verbs:
-      - impersonate
-    - apiGroups:
-      - ""
-      resources:
-      - pods
-      verbs:
-      - get
-    - apiGroups:
-      - authorization.k8s.io
-      resources:
-      - selfsubjectaccessreviews
-      verbs:
-      - create
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/clusterrolebinding_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/clusterrolebinding_test.yaml.snap
deleted file mode 100644
index 408ec5f4556e2..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/clusterrolebinding_test.yaml.snap
+++ /dev/null
@@ -1,14 +0,0 @@
-creates a ClusterRoleBinding:
-  1: |
-    apiVersion: rbac.authorization.k8s.io/v1
-    kind: ClusterRoleBinding
-    metadata:
-      name: RELEASE-NAME
-    roleRef:
-      apiGroup: rbac.authorization.k8s.io
-      kind: ClusterRole
-      name: RELEASE-NAME
-    subjects:
-    - kind: ServiceAccount
-      name: RELEASE-NAME
-      namespace: NAMESPACE
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/config_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/config_test.yaml.snap
deleted file mode 100644
index 30d3cf75b5626..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/config_test.yaml.snap
+++ /dev/null
@@ -1,1098 +0,0 @@
-matches snapshot and tests for annotations.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: helm-lint
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: helm-lint
-        proxy_service:
-          public_addr: 'helm-lint:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      annotations:
-        kubernetes.io/config: test-annotation
-        kubernetes.io/config-different: 2
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for acme-off.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-cluster-name
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-cluster-name
-        proxy_service:
-          public_addr: 'test-cluster-name:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for acme-on.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-acme-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-acme-cluster
-        proxy_service:
-          public_addr: 'test-acme-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          acme:
-            enabled: true
-            email: test@email.com
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for acme-uri-staging.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-acme-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-acme-cluster
-        proxy_service:
-          public_addr: 'test-acme-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          acme:
-            enabled: true
-            email: test@email.com
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for affinity.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: firestore
-            project_id: gcpproj-123456
-            collection_name: test-teleport-firestore-storage-collection
-            credentials_path: /etc/teleport-secrets/gcp-credentials.json
-            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json']
-            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
-        auth_service:
-          enabled: true
-          cluster_name: test-gcp-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-gcp-cluster
-        proxy_service:
-          public_addr: 'test-gcp-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for aws-ha-acme.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: dynamodb
-            region: us-west-2
-            table_name: test-dynamodb-backend-table
-            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
-            audit_sessions_uri: s3://test-s3-session-storage-bucket
-            continuous_backups: false
-        auth_service:
-          enabled: true
-          cluster_name: test-aws-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-aws-cluster
-          labels:
-            env: aws
-        proxy_service:
-          public_addr: 'test-aws-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          https_keypairs:
-          - key_file: /etc/teleport-tls/tls.key
-            cert_file: /etc/teleport-tls/tls.crt
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for aws-ha-antiaffinity.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: dynamodb
-            region: us-west-2
-            table_name: test-dynamodb-backend-table
-            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
-            audit_sessions_uri: s3://test-s3-session-storage-bucket
-            continuous_backups: false
-        auth_service:
-          enabled: true
-          cluster_name: test-aws-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-aws-cluster
-          labels:
-            env: aws
-        proxy_service:
-          public_addr: 'test-aws-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for aws-ha-log.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: DEBUG
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: dynamodb
-            region: us-west-2
-            table_name: test-dynamodb-backend-table
-            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table', 'stdout://']
-            audit_sessions_uri: s3://test-s3-session-storage-bucket
-            continuous_backups: false
-        auth_service:
-          enabled: true
-          cluster_name: test-aws-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-aws-cluster
-          labels:
-            env: aws
-        proxy_service:
-          public_addr: 'test-aws-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          https_keypairs:
-          - key_file: /etc/teleport-tls/tls.key
-            cert_file: /etc/teleport-tls/tls.crt
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for aws-ha.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: dynamodb
-            region: us-west-2
-            table_name: test-dynamodb-backend-table
-            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
-            audit_sessions_uri: s3://test-s3-session-storage-bucket
-            continuous_backups: false
-        auth_service:
-          enabled: true
-          cluster_name: test-aws-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-aws-cluster
-          labels:
-            env: aws
-        proxy_service:
-          public_addr: 'test-aws-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for aws.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: dynamodb
-            region: us-west-2
-            table_name: test-dynamodb-backend-table
-            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
-            audit_sessions_uri: s3://test-s3-session-storage-bucket
-            continuous_backups: false
-        auth_service:
-          enabled: true
-          cluster_name: test-aws-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-aws-cluster
-          labels:
-            env: aws
-        proxy_service:
-          public_addr: 'test-aws-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          acme:
-            enabled: true
-            email: test@email.com
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for gcp-ha-acme.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: firestore
-            project_id: gcpproj-123456
-            collection_name: test-teleport-firestore-storage-collection
-            credentials_path: /etc/teleport-secrets/gcp-credentials.json
-            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json']
-            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
-        auth_service:
-          enabled: true
-          cluster_name: test-gcp-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-gcp-cluster
-          labels:
-            env: gcp
-        proxy_service:
-          public_addr: 'test-gcp-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          https_keypairs:
-          - key_file: /etc/teleport-tls/tls.key
-            cert_file: /etc/teleport-tls/tls.crt
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for gcp-ha-antiaffinity.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: firestore
-            project_id: gcpproj-123456
-            collection_name: test-teleport-firestore-storage-collection
-            credentials_path: /etc/teleport-secrets/gcp-credentials.json
-            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json']
-            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
-        auth_service:
-          enabled: true
-          cluster_name: test-gcp-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-gcp-cluster
-          labels:
-            env: gcp
-        proxy_service:
-          public_addr: 'test-gcp-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for gcp-ha-log.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: DEBUG
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: firestore
-            project_id: gcpproj-123456
-            collection_name: test-teleport-firestore-storage-collection
-            credentials_path: /etc/teleport-secrets/gcp-credentials.json
-            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json', 'stdout://']
-            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
-        auth_service:
-          enabled: true
-          cluster_name: test-gcp-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-gcp-cluster
-          labels:
-            env: gcp
-        proxy_service:
-          public_addr: 'test-gcp-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          https_keypairs:
-          - key_file: /etc/teleport-tls/tls.key
-            cert_file: /etc/teleport-tls/tls.crt
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for gcp.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: firestore
-            project_id: gcpproj-123456
-            collection_name: test-teleport-firestore-storage-collection
-            credentials_path: /etc/teleport-secrets/gcp-credentials.json
-            audit_events_uri: ['firestore://test-teleport-firestore-auditlog-collection?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json']
-            audit_sessions_uri: "gs://test-gcp-session-storage-bucket?projectID=gcpproj-123456&credentialsPath=/etc/teleport-secrets/gcp-credentials.json"
-        auth_service:
-          enabled: true
-          cluster_name: test-gcp-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-gcp-cluster
-          labels:
-            env: gcp
-        proxy_service:
-          public_addr: 'test-gcp-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          acme:
-            enabled: true
-            email: test@email.com
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for initcontainers.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: helm-lint
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: helm-lint
-        proxy_service:
-          public_addr: 'helm-lint:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for kube-cluster-name.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-aws-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-kube-cluster
-        proxy_service:
-          public_addr: 'test-aws-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for log-basic.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: json
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-log-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-log-cluster
-        proxy_service:
-          public_addr: 'test-log-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for log-extra.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: DEBUG
-            output: /var/lib/teleport/test.log
-            format:
-              output: json
-              extra_fields: ["level","timestamp","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-log-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-log-cluster
-        proxy_service:
-          public_addr: 'test-log-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for log-legacy.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: DEBUG
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-log-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-log-cluster
-        proxy_service:
-          public_addr: 'test-log-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for priority-class-name.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: helm-lint
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: helm-lint
-        proxy_service:
-          public_addr: 'helm-lint:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for proxy-listener-mode.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        version: v2
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-proxy-listener-mode
-          authentication:
-            type: local
-            second_factor: otp
-          proxy_listener_mode: multiplex
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:443
-          kube_cluster_name: test-proxy-listener-mode
-        proxy_service:
-          public_addr: 'test-proxy-listener-mode:443'
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for resources.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: helm-lint
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: helm-lint
-        proxy_service:
-          public_addr: 'helm-lint:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for service.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: helm-lint
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: helm-lint
-        proxy_service:
-          public_addr: 'helm-lint:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for standalone-customsize.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-standalone-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-standalone-cluster
-          labels:
-            env: standalone
-        proxy_service:
-          public_addr: 'test-standalone-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          acme:
-            enabled: true
-            email: test@email.com
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for standalone-existingpvc.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-standalone-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-standalone-cluster
-          labels:
-            env: standalone
-        proxy_service:
-          public_addr: 'test-standalone-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-          acme:
-            enabled: true
-            email: test@email.com
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for tolerations.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-          storage:
-            type: dynamodb
-            region: us-west-2
-            table_name: test-dynamodb-backend-table
-            audit_events_uri: ['dynamodb://test-dynamodb-auditlog-table']
-            audit_sessions_uri: s3://test-s3-session-storage-bucket
-            continuous_backups: false
-        auth_service:
-          enabled: true
-          cluster_name: test-aws-cluster
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-aws-cluster
-        proxy_service:
-          public_addr: 'test-aws-cluster:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for version-override.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: test-cluster-name
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: test-cluster-name
-          labels:
-            env: test
-            version: 5.2.1
-        proxy_service:
-          public_addr: 'test-cluster-name:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for volumes.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: helm-lint
-          authentication:
-            type: local
-            second_factor: otp
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: helm-lint
-        proxy_service:
-          public_addr: 'helm-lint:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for webauthn.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |-
-        teleport:
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-        auth_service:
-          enabled: true
-          cluster_name: helm-lint
-          authentication:
-            type: local
-            second_factor: on
-            webauthn:
-              rp_id: helm-lint
-              attestation_allowed_cas:
-                - /etc/ssl/certs/ca-certificates.crt
-              attestation_denied_cas:
-                - /etc/ssl/certs/ca-certificates.crt
-        kubernetes_service:
-          enabled: true
-          listen_addr: 0.0.0.0:3027
-          kube_cluster_name: helm-lint
-        proxy_service:
-          public_addr: 'helm-lint:443'
-          kube_listen_addr: 0.0.0.0:3026
-          mysql_listen_addr: 0.0.0.0:3036
-          enabled: true
-        ssh_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap
deleted file mode 100644
index 98991aec2640e..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap
+++ /dev/null
@@ -1,1585 +0,0 @@
-sets Deployment annotations when specified:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-sets Pod annotations when specified:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should add PersistentVolumeClaim as volume when in standalone mode:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should add emptyDir for data in AWS mode:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should add emptyDir for data in GCP mode:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport-secrets
-        name: gcp-credentials
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should add emptyDir for data in custom mode:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should add insecureSkipProxyTLSVerify to args when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      - --insecure
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should add named PersistentVolumeClaim as volume when in standalone mode and standalone.existingClaimName is set:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: teleport-storage
-should do enterprise things when when enterprise is set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport-ent:8.3.4
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /var/lib/license
-        name: license
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: license
-      secret:
-        secretName: license
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should expose diag port:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should have multiple replicas when replicaCount is set:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should mount ConfigMap for config in AWS mode:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should mount ConfigMap for config in GCP mode:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport-secrets
-        name: gcp-credentials
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should mount ConfigMap for config in custom mode:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should mount ConfigMap for config in standalone mode:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should mount GCP credentials for initContainer in GCP mode:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport-secrets
-        name: gcp-credentials
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    initContainers:
-    - args:
-      - echo test
-      image: alpine
-      name: teleport-init
-      volumeMounts:
-      - mountPath: /etc/teleport-secrets
-        name: gcp-credentials
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should mount GCP credentials in GCP mode:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport-secrets
-        name: gcp-credentials
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should mount TLS certs for initContainer when cert-manager is enabled:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport-secrets
-        name: gcp-credentials
-        readOnly: true
-      - mountPath: /etc/teleport-tls
-        name: teleport-tls
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    initContainers:
-    - args:
-      - echo test
-      image: alpine
-      name: teleport-init
-      volumeMounts:
-      - mountPath: /etc/teleport-secrets
-        name: gcp-credentials
-        readOnly: true
-      - mountPath: /etc/teleport-tls
-        name: teleport-tls
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - name: teleport-tls
-      secret:
-        secretName: teleport-tls
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should mount TLS certs when cert-manager is enabled:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport-secrets
-        name: gcp-credentials
-        readOnly: true
-      - mountPath: /etc/teleport-tls
-        name: teleport-tls
-        readOnly: true
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - name: teleport-tls
-      secret:
-        secretName: teleport-tls
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should mount extraVolumes and extraVolumeMounts:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-      - mountPath: /path/to/mount
-        name: my-mount
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-    - name: my-mount
-      secret:
-        secretName: mySecret
-should not do enterprise things when when enterprise is not set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:8.3.4
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should not have more than one replica in standalone mode:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should provision initContainer correctly when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      env:
-      - name: SSL_CERT_FILE
-        value: /etc/tls/some-cert-file.pem
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    initContainers:
-    - args:
-      - echo test
-      image: alpine
-      name: teleport-init
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should set affinity when set in values:
-  1: |
-    affinity:
-      nodeAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-          nodeSelectorTerms:
-          - matchExpressions:
-            - key: gravitational.io/dedicated
-              operator: In
-              values:
-              - teleport
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should set environment when extraEnv set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      env:
-      - name: SSL_CERT_FILE
-        value: /etc/tls/some-cert-file.pem
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should set imagePullPolicy when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: Always
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should set postStart command if set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      lifecycle:
-        postStart:
-          exec:
-            command:
-            - /bin/echo
-            - test
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should set priorityClassName when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    priorityClassName: system-cluster-critical
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should set required affinity when highAvailability.requireAntiAffinity is set:
-  1: |
-    affinity:
-      podAntiAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchExpressions:
-            - key: app
-              operator: In
-              values:
-              - RELEASE-NAME
-          topologyKey: kubernetes.io/hostname
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
-should set resources when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: data
-      persistentVolumeClaim:
-        claimName: RELEASE-NAME
-should set tolerations when set in values:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    tolerations:
-    - effect: NoExecute
-      key: dedicated
-      operator: Equal
-      value: teleport
-    - effect: NoSchedule
-      key: dedicated
-      operator: Equal
-      value: teleport
-    volumes:
-    - name: gcp-credentials
-      secret:
-        secretName: teleport-gcp-credentials
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - emptyDir: {}
-      name: data
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/pdb_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/pdb_test.yaml.snap
deleted file mode 100644
index a8d3bf87b8092..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/pdb_test.yaml.snap
+++ /dev/null
@@ -1,14 +0,0 @@
-should create a PDB when enabled in values (pdb.yaml):
-  1: |
-    apiVersion: policy/v1beta1
-    kind: PodDisruptionBudget
-    metadata:
-      labels:
-        app: RELEASE-NAME
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-    spec:
-      minAvailable: 2
-      selector:
-        matchLabels:
-          app: RELEASE-NAME
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/psp_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/psp_test.yaml.snap
deleted file mode 100644
index 5536920844cf3..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/psp_test.yaml.snap
+++ /dev/null
@@ -1,34 +0,0 @@
-creates a PodSecurityPolicy when enabled in values:
-  1: |
-    apiVersion: policy/v1beta1
-    kind: PodSecurityPolicy
-    metadata:
-      annotations:
-        seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
-        seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
-      name: RELEASE-NAME
-    spec:
-      allowPrivilegeEscalation: false
-      fsGroup:
-        ranges:
-        - max: 65535
-          min: 1
-        rule: MustRunAs
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      privileged: false
-      readOnlyRootFilesystem: true
-      requiredDropCapabilities:
-      - ALL
-      runAsUser:
-        rule: MustRunAsNonRoot
-      seLinux:
-        rule: RunAsAny
-      supplementalGroups:
-        ranges:
-        - max: 65535
-          min: 1
-        rule: MustRunAs
-      volumes:
-      - '*'
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/pvc_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/pvc_test.yaml.snap
deleted file mode 100644
index 8a174f4e892af..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/pvc_test.yaml.snap
+++ /dev/null
@@ -1,30 +0,0 @@
-creates a PersistentVolumeClaim when chartMode=standalone:
-  1: |
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    metadata:
-      labels:
-        app: RELEASE-NAME
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 10Gi
-creates a PersistentVolumeClaim with values from standalone-customsize.yaml:
-  1: |
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    metadata:
-      labels:
-        app: RELEASE-NAME
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 50Gi
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/service_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/service_test.yaml.snap
deleted file mode 100644
index 4386f1f3555d3..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/service_test.yaml.snap
+++ /dev/null
@@ -1,143 +0,0 @@
-sets AWS annotations when chartMode=aws:
-  1: |
-    apiVersion: v1
-    kind: Service
-    metadata:
-      annotations:
-        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
-        service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
-        service.beta.kubernetes.io/aws-load-balancer-type: nlb
-      labels:
-        app: RELEASE-NAME
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-    spec:
-      ports:
-      - name: https
-        port: 443
-        protocol: TCP
-        targetPort: 3080
-      - name: sshproxy
-        port: 3023
-        protocol: TCP
-        targetPort: 3023
-      - name: k8s
-        port: 3026
-        protocol: TCP
-        targetPort: 3026
-      - name: sshtun
-        port: 3024
-        protocol: TCP
-        targetPort: 3024
-      - name: mysql
-        port: 3036
-        protocol: TCP
-        targetPort: 3036
-      selector:
-        app: RELEASE-NAME
-      type: LoadBalancer
-sets service annotations when specified:
-  1: |
-    apiVersion: v1
-    kind: Service
-    metadata:
-      annotations:
-        kubernetes.io/service: test-annotation
-        kubernetes.io/service-different: 5
-      labels:
-        app: RELEASE-NAME
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-    spec:
-      ports:
-      - name: https
-        port: 443
-        protocol: TCP
-        targetPort: 3080
-      - name: sshproxy
-        port: 3023
-        protocol: TCP
-        targetPort: 3023
-      - name: k8s
-        port: 3026
-        protocol: TCP
-        targetPort: 3026
-      - name: sshtun
-        port: 3024
-        protocol: TCP
-        targetPort: 3024
-      - name: mysql
-        port: 3036
-        protocol: TCP
-        targetPort: 3036
-      selector:
-        app: RELEASE-NAME
-      type: LoadBalancer
-uses a ClusterIP when service.type=ClusterIP:
-  1: |
-    apiVersion: v1
-    kind: Service
-    metadata:
-      labels:
-        app: RELEASE-NAME
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-    spec:
-      ports:
-      - name: https
-        port: 443
-        protocol: TCP
-        targetPort: 3080
-      - name: sshproxy
-        port: 3023
-        protocol: TCP
-        targetPort: 3023
-      - name: k8s
-        port: 3026
-        protocol: TCP
-        targetPort: 3026
-      - name: sshtun
-        port: 3024
-        protocol: TCP
-        targetPort: 3024
-      - name: mysql
-        port: 3036
-        protocol: TCP
-        targetPort: 3036
-      selector:
-        app: RELEASE-NAME
-      type: ClusterIP
-uses a LoadBalancer by default:
-  1: |
-    apiVersion: v1
-    kind: Service
-    metadata:
-      labels:
-        app: RELEASE-NAME
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-    spec:
-      ports:
-      - name: https
-        port: 443
-        protocol: TCP
-        targetPort: 3080
-      - name: sshproxy
-        port: 3023
-        protocol: TCP
-        targetPort: 3023
-      - name: k8s
-        port: 3026
-        protocol: TCP
-        targetPort: 3026
-      - name: sshtun
-        port: 3024
-        protocol: TCP
-        targetPort: 3024
-      - name: mysql
-        port: 3036
-        protocol: TCP
-        targetPort: 3036
-      selector:
-        app: RELEASE-NAME
-      type: LoadBalancer
diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/serviceaccount_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/serviceaccount_test.yaml.snap
deleted file mode 100644
index 6d6ccbeadb27e..0000000000000
--- a/examples/chart/teleport-cluster/tests/__snapshot__/serviceaccount_test.yaml.snap
+++ /dev/null
@@ -1,10 +0,0 @@
-sets ServiceAccount annotations when specified:
-  1: |
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-      annotations:
-        kubernetes.io/serviceaccount: test-annotation
-        kubernetes.io/serviceaccount-different: 6
-      name: RELEASE-NAME
-      namespace: NAMESPACE
diff --git a/examples/chart/teleport-cluster/tests/certificate_test.yaml b/examples/chart/teleport-cluster/tests/certificate_test.yaml
deleted file mode 100644
index b2cb8cc737301..0000000000000
--- a/examples/chart/teleport-cluster/tests/certificate_test.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-suite: Certificate
-templates:
-  - certificate.yaml
-tests:
-  - it: should request a certificate for cluster name when cert-manager is enabled (cert-manager.yaml)
-    values:
-      - ../.lint/cert-manager.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: Certificate
-      - matchSnapshot:
-          path: spec.dnsNames
-      - matchSnapshot:
-          path: spec.issuerRef
-
-  - it: should request a certificate for cluster name when cert-manager is enabled (cert-secret.yaml)
-    values:
-      - ../.lint/cert-secret.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: Certificate
-      - matchSnapshot:
-          path: spec.dnsNames
-      - matchSnapshot:
-          path: spec.issuerRef
diff --git a/examples/chart/teleport-cluster/tests/clusterrole_test.yaml b/examples/chart/teleport-cluster/tests/clusterrole_test.yaml
deleted file mode 100644
index 337947d13ad2b..0000000000000
--- a/examples/chart/teleport-cluster/tests/clusterrole_test.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-suite: ClusterRole
-templates:
-  - clusterrole.yaml
-tests:
-  - it: creates a ClusterRole
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ClusterRole
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/clusterrolebinding_test.yaml b/examples/chart/teleport-cluster/tests/clusterrolebinding_test.yaml
deleted file mode 100644
index b8f30d8cf4fc2..0000000000000
--- a/examples/chart/teleport-cluster/tests/clusterrolebinding_test.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-suite: ClusterRoleBinding
-templates:
-  - clusterrolebinding.yaml
-tests:
-  - it: creates a ClusterRoleBinding
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ClusterRoleBinding
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/config_test.yaml b/examples/chart/teleport-cluster/tests/config_test.yaml
deleted file mode 100644
index 1a56648cc47ea..0000000000000
--- a/examples/chart/teleport-cluster/tests/config_test.yaml
+++ /dev/null
@@ -1,330 +0,0 @@
-suite: ConfigMap
-templates:
-  - config.yaml
-tests:
-  - it: matches snapshot for acme-off.yaml
-    values:
-      - ../.lint/acme-off.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for acme-off.yaml
-    values:
-      - ../.lint/acme-off.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for acme-on.yaml
-    values:
-      - ../.lint/acme-on.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for acme-uri-staging.yaml
-    values:
-      - ../.lint/acme-on.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for affinity.yaml
-    values:
-      - ../.lint/affinity.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot and tests for annotations.yaml
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - equal:
-          path: metadata.annotations.kubernetes\.io/config
-          value: test-annotation
-      - equal:
-          path: metadata.annotations.kubernetes\.io/config-different
-          value: 2
-      - matchSnapshot: {}
-
-  - it: matches snapshot for aws-ha-acme.yaml
-    values:
-      - ../.lint/aws-ha-acme.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for aws-ha-antiaffinity.yaml
-    values:
-      - ../.lint/aws-ha-antiaffinity.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for aws-ha-log.yaml
-    values:
-      - ../.lint/aws-ha-log.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for aws-ha.yaml
-    values:
-      - ../.lint/aws-ha.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for aws.yaml
-    values:
-      - ../.lint/aws.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: does not generate a config for cert-manager.yaml
-    values:
-      - ../.lint/cert-manager.yaml
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: does not generate a config for cert-secret.yaml
-    values:
-      - ../.lint/cert-secret.yaml
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: matches snapshot for gcp-ha-acme.yaml
-    values:
-      - ../.lint/gcp-ha-acme.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for gcp-ha-antiaffinity.yaml
-    values:
-      - ../.lint/gcp-ha-antiaffinity.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for gcp-ha-log.yaml
-    values:
-      - ../.lint/gcp-ha-log.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for gcp.yaml
-    values:
-      - ../.lint/gcp.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for initcontainers.yaml
-    values:
-      - ../.lint/initcontainers.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for kube-cluster-name.yaml
-    values:
-      - ../.lint/kube-cluster-name.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for log-basic.yaml
-    values:
-      - ../.lint/log-basic.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for log-extra.yaml
-    values:
-      - ../.lint/log-extra.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for log-legacy.yaml
-    values:
-      - ../.lint/log-legacy.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: does not generate a config for pdb.yaml
-    values:
-      - ../.lint/pdb.yaml
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: matches snapshot for priority-class-name.yaml
-    values:
-      - ../.lint/priority-class-name.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for proxy-listener-mode.yaml
-    values:
-      - ../.lint/proxy-listener-mode.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for resources.yaml
-    values:
-      - ../.lint/resources.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for service.yaml
-    values:
-      - ../.lint/service.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for standalone-customsize.yaml
-    values:
-      - ../.lint/standalone-customsize.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for standalone-existingpvc.yaml
-    values:
-      - ../.lint/standalone-existingpvc.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for tolerations.yaml
-    values:
-      - ../.lint/tolerations.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for version-override.yaml
-    values:
-      - ../.lint/version-override.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for volumes.yaml
-    values:
-      - ../.lint/volumes.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for webauthn.yaml
-    values:
-      - ../.lint/webauthn.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/deployment_test.yaml b/examples/chart/teleport-cluster/tests/deployment_test.yaml
deleted file mode 100644
index 930925c9cc5d2..0000000000000
--- a/examples/chart/teleport-cluster/tests/deployment_test.yaml
+++ /dev/null
@@ -1,533 +0,0 @@
-suite: Deployment
-templates:
-  - deployment.yaml
-  - config.yaml
-tests:
-  - it: sets Deployment annotations when specified
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - equal:
-          path: metadata.annotations.kubernetes\.io/deployment
-          value: test-annotation
-      - equal:
-          path: metadata.annotations.kubernetes\.io/deployment-different
-          value: 3
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: sets Pod annotations when specified
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - equal:
-          path: spec.template.metadata.annotations.kubernetes\.io/pod
-          value: test-annotation
-      - equal:
-          path: spec.template.metadata.annotations.kubernetes\.io/pod-different
-          value: 4
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should not have more than one replica in standalone mode
-    set:
-      chartMode: standalone
-      clusterName: helm-lint.example.com
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 1
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should have multiple replicas when replicaCount is set
-    set:
-      chartMode: custom
-      clusterName: helm-lint.example.com
-      highAvailability:
-        replicaCount: 3
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 3
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set affinity when set in values
-    set:
-      chartMode: custom
-      clusterName: helm-lint.example.com
-      highAvailability:
-        replicaCount: 3
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: gravitational.io/dedicated
-                operator: In
-                values:
-                - teleport
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.affinity
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set required affinity when highAvailability.requireAntiAffinity is set
-    values:
-      - ../.lint/aws-ha-antiaffinity.yaml
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.affinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set tolerations when set in values
-    values:
-      - ../.lint/tolerations.yaml
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.tolerations
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set resources when set in values
-    values:
-      - ../.lint/resources.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.cpu
-          value: 2
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.memory
-          value: 4Gi
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.cpu
-          value: 1
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.memory
-          value: 2Gi
-      - matchSnapshot:
-          path: spec.template.spec
-
-  # we can't use the dynamic chart version or appVersion as a variable in the tests,
-  # so we override it manually and check that gets set instead
-  # this saves us having to update the test every time we cut a new release
-  - it: should do enterprise things when when enterprise is set in values
-    set:
-      clusterName: helm-lint.example.com
-      enterprise: true
-      teleportVersionOverride: 8.3.4
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].image
-          value: quay.io/gravitational/teleport-ent:8.3.4
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /var/lib/license
-            name: "license"
-            readOnly: true
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: license
-            secret:
-              secretName: license
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should not do enterprise things when when enterprise is not set in values
-    set:
-      clusterName: helm-lint
-      teleportVersionOverride: 8.3.4
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].image
-          value: quay.io/gravitational/teleport:8.3.4
-      - notContains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /var/lib/license
-            name: "license"
-            readOnly: true
-      - notContains:
-          path: spec.template.spec.volumes
-          content:
-            name: license
-            secret:
-              secretName: license
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount GCP credentials in GCP mode
-    values:
-      - ../.lint/gcp-ha.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /etc/teleport-secrets
-            name: "gcp-credentials"
-            readOnly: true
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: gcp-credentials
-            secret:
-              secretName: teleport-gcp-credentials
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount GCP credentials for initContainer in GCP mode
-    values:
-      - ../.lint/gcp-ha.yaml
-      - ../.lint/initcontainers.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers[0].volumeMounts
-          content:
-            mountPath: /etc/teleport-secrets
-            name: "gcp-credentials"
-            readOnly: true
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount TLS certs when cert-manager is enabled
-    values:
-      - ../.lint/gcp-ha-acme.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /etc/teleport-tls
-            name: "teleport-tls"
-            readOnly: true
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: teleport-tls
-            secret:
-              secretName: teleport-tls
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount TLS certs for initContainer when cert-manager is enabled
-    values:
-      - ../.lint/gcp-ha-acme.yaml
-      - ../.lint/initcontainers.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers[0].volumeMounts
-          content:
-            mountPath: /etc/teleport-tls
-            name: "teleport-tls"
-            readOnly: true
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount ConfigMap for config in AWS mode
-    values:
-      - ../.lint/aws-ha.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /etc/teleport
-            name: "config"
-            readOnly: true
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: config
-            configMap:
-              name: RELEASE-NAME
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount ConfigMap for config in GCP mode
-    values:
-      - ../.lint/gcp-ha.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /etc/teleport
-            name: "config"
-            readOnly: true
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: config
-            configMap:
-              name: RELEASE-NAME
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount ConfigMap for config in standalone mode
-    set:
-      chartMode: standalone
-      clusterName: helm-lint.example.com
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /etc/teleport
-            name: "config"
-            readOnly: true
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: config
-            configMap:
-              name: RELEASE-NAME
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount ConfigMap for config in custom mode
-    set:
-      chartMode: custom
-      clusterName: helm-lint.example.com
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /etc/teleport
-            name: "config"
-            readOnly: true
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: config
-            configMap:
-              name: RELEASE-NAME
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount extraVolumes and extraVolumeMounts
-    values:
-      - ../.lint/volumes.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /path/to/mount
-            name: my-mount
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: my-mount
-            secret:
-              secretName: mySecret
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount extraVolumes and extraVolumeMounts
-    values:
-      - ../.lint/volumes.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /path/to/mount
-            name: my-mount
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: my-mount
-            secret:
-              secretName: mySecret
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount extraVolumes and extraVolumeMounts
-    values:
-      - ../.lint/volumes.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /path/to/mount
-            name: my-mount
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: my-mount
-            secret:
-              secretName: mySecret
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set imagePullPolicy when set in values
-    set:
-      clusterName: helm-lint.example.com
-      imagePullPolicy: Always
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].imagePullPolicy
-          value: Always
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set environment when extraEnv set in values
-    set:
-      clusterName: helm-lint.example.com
-      extraEnv:
-        - name: SSL_CERT_FILE
-          value: "/etc/tls/some-cert-file.pem"
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: SSL_CERT_FILE
-            value: "/etc/tls/some-cert-file.pem"
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should provision initContainer correctly when set in values
-    values:
-      - ../.lint/initcontainers.yaml
-      - ../.lint/resources.yaml
-    set:
-      extraEnv:
-        - name: SSL_CERT_FILE
-          value: "/etc/tls/some-cert-file.pem"
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers[0].args
-          content: "echo test"
-      - equal:
-          path: spec.template.spec.initContainers[0].name
-          value: "teleport-init"
-      - equal:
-          path: spec.template.spec.initContainers[0].image
-          value: "alpine"
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.limits.cpu
-          value: 2
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.limits.memory
-          value: 4Gi
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.requests.cpu
-          value: 1
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.requests.memory
-          value: 2Gi
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add insecureSkipProxyTLSVerify to args when set in values
-    set:
-      clusterName: helm-lint.example.com
-      insecureSkipProxyTLSVerify: true
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].args
-          content: "--insecure"
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should expose diag port
-    set:
-      clusterName: helm-lint.example.com
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].ports
-          content:
-            name: diag
-            containerPort: 3000
-            protocol: TCP
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set postStart command if set in values
-    set:
-      clusterName: helm-lint.example.com
-      postStart:
-        command: ["/bin/echo", "test"]
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].lifecycle.postStart.exec.command
-          value: ["/bin/echo", "test"]
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add PersistentVolumeClaim as volume when in standalone mode
-    set:
-      chartMode: standalone
-      clusterName: helm-lint.example.com
-    asserts:
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: data
-            persistentVolumeClaim:
-              claimName: RELEASE-NAME
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add named PersistentVolumeClaim as volume when in standalone mode and standalone.existingClaimName is set
-    values:
-      - ../.lint/standalone-existingpvc.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: data
-            persistentVolumeClaim:
-              claimName: teleport-storage
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add emptyDir for data in AWS mode
-    values:
-      - ../.lint/aws-ha.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: data
-            emptyDir: {}
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add emptyDir for data in GCP mode
-    values:
-      - ../.lint/gcp-ha.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: data
-            emptyDir: {}
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add emptyDir for data in custom mode
-    set:
-      chartMode: custom
-      clusterName: helm-lint.example.com
-    asserts:
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: data
-            emptyDir: {}
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set priorityClassName when set in values
-    values:
-      - ../.lint/priority-class-name.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.priorityClassName
-          value: system-cluster-critical
-      - matchSnapshot:
-          path: spec.template.spec
diff --git a/examples/chart/teleport-cluster/tests/pdb_test.yaml b/examples/chart/teleport-cluster/tests/pdb_test.yaml
deleted file mode 100644
index b673ce8400ce3..0000000000000
--- a/examples/chart/teleport-cluster/tests/pdb_test.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-suite: PodDisruptionBudget
-templates:
-  - pdb.yaml
-tests:
-  - it: should create a PDB when enabled in values (pdb.yaml)
-    values:
-      - ../.lint/pdb.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: PodDisruptionBudget
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/psp_test.yaml b/examples/chart/teleport-cluster/tests/psp_test.yaml
deleted file mode 100644
index 0faad123c1dc1..0000000000000
--- a/examples/chart/teleport-cluster/tests/psp_test.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-suite: PodSecurityPolicy
-templates:
-  - psp.yaml
-tests:
-  - it: creates a PodSecurityPolicy when enabled in values
-    set:
-      podSecurityPolicy:
-        enabled: true
-    asserts:
-      - hasDocuments:
-          count: 3
-      - documentIndex: 0
-        isKind:
-          of: PodSecurityPolicy
-      - documentIndex: 1
-        isKind:
-          of: Role
-      - documentIndex: 2
-        isKind:
-          of: RoleBinding
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/pvc_test.yaml b/examples/chart/teleport-cluster/tests/pvc_test.yaml
deleted file mode 100644
index 9dbdc05448e48..0000000000000
--- a/examples/chart/teleport-cluster/tests/pvc_test.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-suite: PersistentVolumeClaim
-templates:
-  - pvc.yaml
-tests:
-  - it: creates a PersistentVolumeClaim when chartMode=standalone
-    set:
-      chartMode: standalone
-    asserts:
-      - template: pvc.yaml
-        hasDocuments:
-          count: 1
-      - template: pvc.yaml
-        isKind:
-          of: PersistentVolumeClaim
-      - matchSnapshot: {}
-
-  - it: creates a PersistentVolumeClaim with values from standalone-customsize.yaml
-    values:
-      - ../.lint/standalone-customsize.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: PersistentVolumeClaim
-      - equal:
-          path: spec.resources.requests.storage
-          value: 50Gi
-      - matchSnapshot: {}
-
-  - it: does not create a PersistentVolumeClaim when chartMode=standalone and existingClaimName is not blank
-    set:
-      chartMode: standalone
-      standalone:
-        existingClaimName: test-claim
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: does not create a PersistentVolumeClaim with values from standalone-existingpvc.yaml
-    values:
-      - ../.lint/standalone-existingpvc.yaml
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: does not create a PersistentVolumeClaim when chartMode=aws
-    set:
-      chartMode: aws
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: does not create a PersistentVolumeClaim when chartMode=gcp
-    set:
-      chartMode: gcp
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: does not create a PersistentVolumeClaim when chartMode=custom
-    set:
-      chartMode: custom
-    asserts:
-      - hasDocuments:
-          count: 0
diff --git a/examples/chart/teleport-cluster/tests/service_test.yaml b/examples/chart/teleport-cluster/tests/service_test.yaml
deleted file mode 100644
index c8cc66f050182..0000000000000
--- a/examples/chart/teleport-cluster/tests/service_test.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-suite: Service
-templates:
-  - service.yaml
-tests:
-  - it: uses a LoadBalancer by default
-    set:
-      clusterName: teleport.example.com
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: Service
-      - equal:
-          path: spec.type
-          value: LoadBalancer
-      - matchSnapshot: {}
-
-  - it: uses a ClusterIP when service.type=ClusterIP
-    set:
-      clusterName: teleport.example.com
-      service:
-        type: ClusterIP
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: Service
-      - equal:
-          path: spec.type
-          value: ClusterIP
-      - matchSnapshot: {}
-
-  - it: sets AWS annotations when chartMode=aws
-    set:
-      clusterName: teleport.example.com
-      chartMode: aws
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: Service
-      - equal:
-          path: spec.type
-          value: LoadBalancer
-      - equal:
-          path: metadata.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-type
-          value: nlb
-      - equal:
-          path: metadata.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-backend-protocol
-          value: tcp
-      - equal:
-          path: metadata.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-cross-zone-load-balancing-enabled
-          value: "true"
-      - matchSnapshot: {}
-
-  - it: sets service annotations when specified
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - equal:
-          path: metadata.annotations.kubernetes\.io/service
-          value: test-annotation
-      - equal:
-          path: metadata.annotations.kubernetes\.io/service-different
-          value: 5
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/tests/serviceaccount_test.yaml b/examples/chart/teleport-cluster/tests/serviceaccount_test.yaml
deleted file mode 100644
index ec5d98884a2b5..0000000000000
--- a/examples/chart/teleport-cluster/tests/serviceaccount_test.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-suite: ServiceAccount
-templates:
-  - serviceaccount.yaml
-tests:
-  - it: sets ServiceAccount annotations when specified
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - equal:
-          path: metadata.annotations.kubernetes\.io/serviceaccount
-          value: test-annotation
-      - equal:
-          path: metadata.annotations.kubernetes\.io/serviceaccount-different
-          value: 6
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-cluster/values.schema.json b/examples/chart/teleport-cluster/values.schema.json
index a81b67fa3cfe4..1aff511629094 100644
--- a/examples/chart/teleport-cluster/values.schema.json
+++ b/examples/chart/teleport-cluster/values.schema.json
@@ -32,36 +32,6 @@
             "type": "string",
             "default": "local"
         },
-        "authenticationSecondFactor": {
-            "$id": "#/properties/authenticationSecondFactor",
-            "type": "object",
-            "required": [],
-            "properties": {
-                "secondFactor": {
-                    "$id": "#/properties/authenticationSecondFactor/properties/secondFactor",
-                    "type": "string",
-                    "enum": ["off", "on", "otp", "optional", "webauthn"],
-                    "default": "otp"
-                },
-                "webauthn": {
-                    "$id": "#/properties/authenticationSecondFactor/properties/webauthn",
-                    "type": "object",
-                    "required": [],
-                    "properties": {
-                        "attestationAllowedCas": {
-                            "$id": "#/properties/authenticationSecondFactor/properties/webauthn/properties/attestationAllowedCas",
-                            "type": "array",
-                            "default": []
-                        },
-                        "attestationDeniedCas": {
-                            "$id": "#/properties/authenticationSecondFactor/properties/webauthn/properties/attestationDeniedCas",
-                            "type": "array",
-                            "default": []
-                        }
-                    }
-                }
-            }
-        },
         "proxyListenerMode": {
             "$id": "#/properties/proxyListenerMode",
             "type": "string",
diff --git a/examples/chart/teleport-cluster/values.yaml b/examples/chart/teleport-cluster/values.yaml
index 20d09470d065f..841b1cc3e0280 100644
--- a/examples/chart/teleport-cluster/values.yaml
+++ b/examples/chart/teleport-cluster/values.yaml
@@ -22,9 +22,6 @@ teleportVersionOverride: ""
 # 'false' is required for FedRAMP / FIPS; see https://gravitational.com/teleport/docs/enterprise/ssh-kubernetes-fedramp/
 authenticationType: local
 
-authenticationSecondFactor:
-  secondFactor: "otp"
-
 # Teleport supports TLS routing. In this mode, all client connections are wrapped in TLS and multiplexed on one Teleport proxy port.
 # Default mode will not utilize TLS routing and operate in backwards-compatibility mode.
 # Possible values are 'multiplex'
diff --git a/examples/chart/teleport-daemonset/README.md b/examples/chart/teleport-daemonset/README.md
index 247176c44664a..83d46ae567411 100644
--- a/examples/chart/teleport-daemonset/README.md
+++ b/examples/chart/teleport-daemonset/README.md
@@ -1,8 +1,3 @@
-# WARNING
-
-This chart is **deprecated** and no longer actively maintained or supported by Teleport.
-We recommend the use of the [teleport-cluster](../teleport-cluster/README.md) chart instead.
-
 # Teleport
 
 [Gravitational Teleport](https://github.com/gravitational/teleport) is a modern SSH/Kubernetes API proxy server for
diff --git a/examples/chart/teleport-kube-agent/.lint/existing-data-volume.yaml b/examples/chart/teleport-kube-agent/.lint/existing-data-volume.yaml
deleted file mode 100644
index 511aa2f4676ea..0000000000000
--- a/examples/chart/teleport-kube-agent/.lint/existing-data-volume.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-authToken: auth-token
-proxyAddr: proxy.example.com:3080
-roles: kube
-kubeClusterName: test-kube-cluster
-existingDataVolume: teleport-kube-agent-data
diff --git a/examples/chart/teleport-kube-agent/.lint/extra-args.yaml b/examples/chart/teleport-kube-agent/.lint/extra-args.yaml
deleted file mode 100644
index 8353439d2484a..0000000000000
--- a/examples/chart/teleport-kube-agent/.lint/extra-args.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-authToken: auth-token
-proxyAddr: proxy.example.com:3080
-roles: kube
-kubeClusterName: test-kube-cluster
-extraArgs: ['--debug']
diff --git a/examples/chart/teleport-kube-agent/.lint/extra-env.yaml b/examples/chart/teleport-kube-agent/.lint/extra-env.yaml
deleted file mode 100644
index 7f3ee92e73665..0000000000000
--- a/examples/chart/teleport-kube-agent/.lint/extra-env.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-authToken: auth-token
-proxyAddr: proxy.example.com:3080
-roles: kube
-kubeClusterName: test-kube-cluster
-extraEnv:
-- name: HTTPS_PROXY
-  value: "http://username:password@my.proxy.host:3128"
diff --git a/examples/chart/teleport-kube-agent/.lint/image-pull-policy-stateful.yaml b/examples/chart/teleport-kube-agent/.lint/image-pull-policy-stateful.yaml
deleted file mode 100644
index 83995f0c62147..0000000000000
--- a/examples/chart/teleport-kube-agent/.lint/image-pull-policy-stateful.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-authToken: auth-token
-proxyAddr: proxy.example.com:3080
-kubeClusterName: test-kube-cluster-name
-storage:
-  enabled: true
-  storageClassName: "aws-gp2"
-imagePullPolicy: Always
diff --git a/examples/chart/teleport-kube-agent/.lint/image-pull-policy.yaml b/examples/chart/teleport-kube-agent/.lint/image-pull-policy.yaml
deleted file mode 100644
index c5e389ca10a77..0000000000000
--- a/examples/chart/teleport-kube-agent/.lint/image-pull-policy.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-authToken: auth-token
-proxyAddr: proxy.example.com:3080
-roles: kube
-kubeClusterName: test-kube-cluster
-imagePullPolicy: Always
diff --git a/examples/chart/teleport-kube-agent/.lint/service-account-name.yaml b/examples/chart/teleport-kube-agent/.lint/service-account-name.yaml
deleted file mode 100644
index fbc76f97fb727..0000000000000
--- a/examples/chart/teleport-kube-agent/.lint/service-account-name.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-authToken: auth-token
-proxyAddr: proxy.example.com:3080
-roles: kube
-kubeClusterName: test-kube-cluster
-serviceAccountName: teleport-kube-agent-sa
diff --git a/examples/chart/teleport-kube-agent/.lint/volumes.yaml b/examples/chart/teleport-kube-agent/.lint/volumes.yaml
index 1f55235396f2f..14bdc49390f50 100644
--- a/examples/chart/teleport-kube-agent/.lint/volumes.yaml
+++ b/examples/chart/teleport-kube-agent/.lint/volumes.yaml
@@ -4,7 +4,7 @@ roles: kube
 kubeClusterName: test-kube-cluster
 extraVolumeMounts:
 - name: "my-mount"
-  mountPath: "/path/to/mount"
+  path: "/path/to/mount"
 extraVolumes:
 - name: "my-mount"
   secret:
diff --git a/examples/chart/teleport-kube-agent/README.md b/examples/chart/teleport-kube-agent/README.md
index eb89bd447ba1b..74776fc848019 100644
--- a/examples/chart/teleport-kube-agent/README.md
+++ b/examples/chart/teleport-kube-agent/README.md
@@ -194,7 +194,3 @@ If the service for a given role doesn't show up, look into the agent logs with:
 ```sh
 $ kubectl logs -n teleport deployment/teleport-kube-agent
 ```
-
-## Contributing to the chart
-
-Please read [CONTRIBUTING.md](../CONTRIBUTING.md) before raising a pull request to this chart.
\ No newline at end of file
diff --git a/examples/chart/teleport-kube-agent/templates/config.yaml b/examples/chart/teleport-kube-agent/templates/config.yaml
index bc7453847097f..c5aed3dad9ffa 100644
--- a/examples/chart/teleport-kube-agent/templates/config.yaml
+++ b/examples/chart/teleport-kube-agent/templates/config.yaml
@@ -1,14 +1,8 @@
 {{- $logLevel := (coalesce .Values.logLevel .Values.log.level "INFO") -}}
-{{- if .Values.teleportVersionOverride -}}
-  {{- $_ := set . "teleportVersion" .Values.teleportVersionOverride -}}
-{{- else -}}
-  {{- $_ := set . "teleportVersion" .Chart.Version -}}
-{{- end -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ .Release.Name }}
-  namespace: {{ .Release.Namespace }}
   {{- if .Values.annotations.config }}
   annotations:
     {{- toYaml .Values.annotations.config | nindent 4 }}
diff --git a/examples/chart/teleport-kube-agent/templates/deployment.yaml b/examples/chart/teleport-kube-agent/templates/deployment.yaml
index 0b6dc0aab2f4c..4223207eeab16 100644
--- a/examples/chart/teleport-kube-agent/templates/deployment.yaml
+++ b/examples/chart/teleport-kube-agent/templates/deployment.yaml
@@ -3,7 +3,16 @@
 # in the statefulset.yaml file.
 #
 {{- if not .Values.storage.enabled }}
-{{- $replicaCount := (coalesce .Values.replicaCount .Values.highAvailability.replicaCount "1") }}
+{{- if .Values.teleportVersionOverride }}
+  {{- $_ := set . "teleportVersion" .Values.teleportVersionOverride }}
+{{- else }}
+  {{- $_ := set . "teleportVersion" .Chart.Version }}
+{{- end }}
+{{- if .Values.replicaCount }}
+  {{- $_ := set . "replicaCount" .Values.replicaCount }}
+{{- else }}
+  {{- $_ := set . "replicaCount" .Values.highAvailability.replicaCount }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -16,7 +25,7 @@ metadata:
     {{- toYaml .Values.annotations.deployment | nindent 4 }}
   {{- end }}
 spec:
-  replicas: {{ $replicaCount }}
+  replicas: {{ .replicaCount }}
   selector:
     matchLabels:
       app: {{ .Release.Name }}
@@ -31,7 +40,7 @@ spec:
       labels:
         app: {{ .Release.Name }}
     spec:
-      {{- if or .Values.affinity (gt (int $replicaCount) 1) }}
+      {{- if or .Values.affinity (gt (int .replicaCount) 1) }}
       affinity:
         {{- if .Values.affinity }}
           {{- if .Values.highAvailability.requireAntiAffinity }}
@@ -49,7 +58,7 @@ spec:
                 values:
                 - {{ .Release.Name }}
             topologyKey: "kubernetes.io/hostname"
-        {{- else if gt (int $replicaCount) 1 }}
+        {{- else if gt (int .replicaCount) 1 }}
           preferredDuringSchedulingIgnoredDuringExecution:
           - weight: 50
             podAffinityTerm:
@@ -105,21 +114,11 @@ spec:
       containers:
       - name: "teleport"
         image: "{{ if .Values.enterprise }}{{ .Values.enterpriseImage }}{{ else }}{{ .Values.image }}{{ end }}:{{ .teleportVersion }}"
-        {{- if .Values.imagePullPolicy }}
-        imagePullPolicy: {{ toYaml .Values.imagePullPolicy }}
-        {{- end }}
-        {{- if .Values.extraEnv }}
-        env:
-          {{- toYaml .Values.extraEnv | nindent 10 }}
-        {{- end }}
         args:
         - "--diag-addr=0.0.0.0:3000"
         {{- if .Values.insecureSkipProxyTLSVerify }}
         - "--insecure"
         {{- end }}
-        {{- if .Values.extraArgs }}
-          {{- toYaml .Values.extraArgs | nindent 8 }}
-        {{- end }}
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
diff --git a/examples/chart/teleport-kube-agent/templates/statefulset.yaml b/examples/chart/teleport-kube-agent/templates/statefulset.yaml
index 2a34bca3b23ce..88ef070f13a37 100644
--- a/examples/chart/teleport-kube-agent/templates/statefulset.yaml
+++ b/examples/chart/teleport-kube-agent/templates/statefulset.yaml
@@ -3,7 +3,16 @@
 # in the deployment.yaml file.
 #
 {{- if .Values.storage.enabled }}
-{{- $replicaCount := (coalesce .Values.replicaCount .Values.highAvailability.replicaCount "1") }}
+{{- if .Values.teleportVersionOverride }}
+  {{- $_ := set . "teleportVersion" .Values.teleportVersionOverride }}
+{{- else }}
+  {{- $_ := set . "teleportVersion" .Chart.Version }}
+{{- end }}
+{{- if .Values.replicaCount }}
+  {{- $_ := set . "replicaCount" .Values.replicaCount }}
+{{- else }}
+  {{- $_ := set . "replicaCount" .Values.highAvailability.replicaCount }}
+{{- end }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -13,7 +22,7 @@ metadata:
     app: {{ .Release.Name }}
 spec:
   serviceName: {{ .Release.Name }}
-  replicas: {{ $replicaCount }}
+  replicas: {{ .replicaCount }}
   selector:
     matchLabels:
       app: {{ .Release.Name }}
@@ -30,7 +39,7 @@ spec:
     spec:
       securityContext:
         fsGroup: 9807
-      {{- if or .Values.affinity (gt (int $replicaCount) 1) }}
+      {{- if or .Values.affinity (gt (int .replicaCount) 1) }}
       affinity:
         {{- if .Values.affinity }}
           {{- if .Values.highAvailability.requireAntiAffinity }}
@@ -48,7 +57,7 @@ spec:
                 values:
                 - {{ .Release.Name }}
             topologyKey: "kubernetes.io/hostname"
-        {{- else if gt (int $replicaCount) 1 }}
+        {{- else if gt (int .replicaCount) 1 }}
           preferredDuringSchedulingIgnoredDuringExecution:
           - weight: 50
             podAffinityTerm:
@@ -101,21 +110,11 @@ spec:
       containers:
       - name: "teleport"
         image: "{{ if .Values.enterprise }}{{ .Values.enterpriseImage }}{{ else }}{{ .Values.image }}{{ end }}:{{ .teleportVersion }}"
-        {{- if .Values.imagePullPolicy }}
-        imagePullPolicy: {{ toYaml .Values.imagePullPolicy }}
-        {{- end }}
-        {{- if .Values.extraEnv }}
-        env:
-          {{- toYaml .Values.extraEnv | nindent 10 }}
-        {{- end }}
         args:
         - "--diag-addr=0.0.0.0:3000"
         {{- if .Values.insecureSkipProxyTLSVerify }}
         - "--insecure"
         {{- end }}
-        {{- if .Values.extraArgs }}
-          {{- toYaml .Values.extraArgs | nindent 8 }}
-        {{- end }}
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
diff --git a/examples/chart/teleport-kube-agent/tests/README.md b/examples/chart/teleport-kube-agent/tests/README.md
deleted file mode 100644
index 3cd0f8783d4e6..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/README.md
+++ /dev/null
@@ -1,18 +0,0 @@
-## Unit tests for Helm charts
-
-Helm chart unit tests run here using the [helm3-unittest](https://github.com/vbehar/helm3-unittest) Helm plugin.
-
-If you get a snapshot error during your testing, you should verify that your changes intended to alter the output, then run
-this command from the root of your Teleport checkout to update the snapshots:
-
-```bash
-make -C build.assets test-helm-update-snapshots
-```
-
-After this, re-run the tests to make sure everything is fine:
-
-```bash
-make -C build.assets test-helm
-```
-
-Commit the updated snapshots along with your changes.
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrole_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrole_test.yaml.snap
deleted file mode 100644
index 73d2b30742ace..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrole_test.yaml.snap
+++ /dev/null
@@ -1,27 +0,0 @@
-creates a ClusterRole:
-  1: |
-    apiVersion: rbac.authorization.k8s.io/v1
-    kind: ClusterRole
-    metadata:
-      name: RELEASE-NAME
-    rules:
-    - apiGroups:
-      - ""
-      resources:
-      - users
-      - groups
-      - serviceaccounts
-      verbs:
-      - impersonate
-    - apiGroups:
-      - ""
-      resources:
-      - pods
-      verbs:
-      - get
-    - apiGroups:
-      - authorization.k8s.io
-      resources:
-      - selfsubjectaccessreviews
-      verbs:
-      - create
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrolebinding_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrolebinding_test.yaml.snap
deleted file mode 100644
index 408ec5f4556e2..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/clusterrolebinding_test.yaml.snap
+++ /dev/null
@@ -1,14 +0,0 @@
-creates a ClusterRoleBinding:
-  1: |
-    apiVersion: rbac.authorization.k8s.io/v1
-    kind: ClusterRoleBinding
-    metadata:
-      name: RELEASE-NAME
-    roleRef:
-      apiGroup: rbac.authorization.k8s.io
-      kind: ClusterRole
-      name: RELEASE-NAME
-    subjects:
-    - kind: ServiceAccount
-      name: RELEASE-NAME
-      namespace: NAMESPACE
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
deleted file mode 100644
index 4c73bbfb71cf9..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/config_test.yaml.snap
+++ /dev/null
@@ -1,658 +0,0 @@
-does not generate a config for clusterrole.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-does not generate a config for pdb.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot and tests for annotations.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      annotations:
-        kubernetes.io/config: test-annotation
-        kubernetes.io/config-different: 2
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for affinity.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for all-v5.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-          labels:
-            cluster: testing
-
-        app_service:
-          enabled: true
-          apps:
-            - labels:
-                environment: test
-              name: grafana
-              uri: http://localhost:3000
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for all-v6.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-          labels:
-            cluster: testing
-
-        app_service:
-          enabled: true
-          apps:
-            - labels:
-                environment: test
-              name: grafana
-              uri: http://localhost:3000
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      annotations:
-        kubernetes.io/config: test-annotation
-        kubernetes.io/config-different: 2
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for aws-databases.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: false
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for backwards-compatibility.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for db.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: false
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for imagepullsecrets.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for initcontainers.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for log-basic.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: json
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for log-extra.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: DEBUG
-            output: /var/lib/teleport/test.log
-            format:
-              output: json
-              extra_fields: ["level","timestamp","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for log-legacy.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: DEBUG
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for node-selector.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for pdb.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: DEBUG
-            output: /var/lib/teleport/test.log
-            format:
-              output: json
-              extra_fields: ["level","timestamp","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for resources.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for stateful.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster-name
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for tolerations.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-matches snapshot for volumes.yaml:
-  1: |
-    apiVersion: v1
-    data:
-      teleport.yaml: |
-        teleport:
-          auth_token: "/etc/teleport-secrets/auth-token"
-          auth_servers: ["proxy.example.com:3080"]
-          log:
-            severity: INFO
-            output: stderr
-            format:
-              output: text
-              extra_fields: ["timestamp","level","component","caller"]
-
-        kubernetes_service:
-          enabled: true
-          kube_cluster_name: test-kube-cluster
-
-        app_service:
-          enabled: false
-
-        auth_service:
-          enabled: false
-        ssh_service:
-          enabled: false
-        proxy_service:
-          enabled: false
-    kind: ConfigMap
-    metadata:
-      name: RELEASE-NAME
-      namespace: NAMESPACE
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
deleted file mode 100644
index 980b420d739b2..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap
+++ /dev/null
@@ -1,1346 +0,0 @@
-sets Deployment annotations when specified:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-sets Pod annotations when specified:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should add emptyDir for data when existingDataVolume is not set:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should add insecureSkipProxyTLSVerify to args when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      - --insecure
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should correctly configure existingDataVolume when set:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: teleport-kube-agent-data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should expose diag port:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should have multiple replicas when replicaCount is set (using .replicaCount, deprecated):
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should have multiple replicas when replicaCount is set (using highAvailability.replicaCount):
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should have one replica when replicaCount is not set:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should mount extraVolumes and extraVolumeMounts:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-      - mountPath: /path/to/mount
-        name: my-mount
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-    - name: my-mount
-      secret:
-        secretName: mySecret
-should provision initContainer correctly when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    initContainers:
-    - args:
-      - echo test
-      image: alpine
-      name: teleport-init
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set SecurityContext:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set affinity when set in values:
-  1: |
-    affinity:
-      nodeAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-          nodeSelectorTerms:
-          - matchExpressions:
-            - key: gravitational.io/dedicated
-              operator: In
-              values:
-              - teleport
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - teleport
-            topologyKey: kubernetes.io/hostname
-          weight: 1
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set default serviceAccountName when not set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set environment when extraEnv set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      env:
-      - name: HTTPS_PROXY
-        value: http://username:password@my.proxy.host:3128
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set image and tag correctly:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:8.3.4
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set imagePullPolicy when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: Always
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set nodeSelector if set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    nodeSelector:
-      gravitational.io/k8s-role: node
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set preferred affinity when more than one replica is used:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set required affinity when highAvailability.requireAntiAffinity is set:
-  1: |
-    affinity:
-      podAntiAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchExpressions:
-            - key: app
-              operator: In
-              values:
-              - RELEASE-NAME
-          topologyKey: kubernetes.io/hostname
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set resources when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set serviceAccountName when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: teleport-kube-agent-sa
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
-should set tolerations when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /healthz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: data
-    serviceAccountName: RELEASE-NAME
-    tolerations:
-    - effect: NoExecute
-      key: dedicated
-      operator: Equal
-      value: teleport
-    - effect: NoSchedule
-      key: dedicated
-      operator: Equal
-      value: teleport
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - emptyDir: {}
-      name: data
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/pdb_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/pdb_test.yaml.snap
deleted file mode 100644
index a8d3bf87b8092..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/pdb_test.yaml.snap
+++ /dev/null
@@ -1,14 +0,0 @@
-should create a PDB when enabled in values (pdb.yaml):
-  1: |
-    apiVersion: policy/v1beta1
-    kind: PodDisruptionBudget
-    metadata:
-      labels:
-        app: RELEASE-NAME
-      name: RELEASE-NAME
-      namespace: NAMESPACE
-    spec:
-      minAvailable: 2
-      selector:
-        matchLabels:
-          app: RELEASE-NAME
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/psp_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/psp_test.yaml.snap
deleted file mode 100644
index 5536920844cf3..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/psp_test.yaml.snap
+++ /dev/null
@@ -1,34 +0,0 @@
-creates a PodSecurityPolicy when enabled in values:
-  1: |
-    apiVersion: policy/v1beta1
-    kind: PodSecurityPolicy
-    metadata:
-      annotations:
-        seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
-        seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
-      name: RELEASE-NAME
-    spec:
-      allowPrivilegeEscalation: false
-      fsGroup:
-        ranges:
-        - max: 65535
-          min: 1
-        rule: MustRunAs
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      privileged: false
-      readOnlyRootFilesystem: true
-      requiredDropCapabilities:
-      - ALL
-      runAsUser:
-        rule: MustRunAsNonRoot
-      seLinux:
-        rule: RunAsAny
-      supplementalGroups:
-        ranges:
-        - max: 65535
-          min: 1
-        rule: MustRunAs
-      volumes:
-      - '*'
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/secret_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/secret_test.yaml.snap
deleted file mode 100644
index a1176d268f494..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/secret_test.yaml.snap
+++ /dev/null
@@ -1,22 +0,0 @@
-generates a secret when authToken is provided:
-  1: |
-    apiVersion: v1
-    kind: Secret
-    metadata:
-      name: teleport-kube-agent-join-token
-      namespace: NAMESPACE
-    stringData:
-      auth-token: |
-        sample-auth-token-dont-use-this
-    type: Opaque
-generates a secret with a custom name when authToken and secretName are provided:
-  1: |
-    apiVersion: v1
-    kind: Secret
-    metadata:
-      name: some-other-secret-name
-      namespace: NAMESPACE
-    stringData:
-      auth-token: |
-        sample-auth-token-dont-use-this
-    type: Opaque
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/serviceaccount_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/serviceaccount_test.yaml.snap
deleted file mode 100644
index fa132fe5d7c65..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/serviceaccount_test.yaml.snap
+++ /dev/null
@@ -1,10 +0,0 @@
-sets ServiceAccount annotations when specified:
-  1: |
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-      annotations:
-        kubernetes.io/serviceaccount: test-annotation
-        kubernetes.io/serviceaccount-different: 5
-      name: RELEASE-NAME
-      namespace: NAMESPACE
diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
deleted file mode 100644
index c824d810abfa9..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap
+++ /dev/null
@@ -1,1454 +0,0 @@
-sets Pod annotations when specified:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should add insecureSkipProxyTLSVerify to args when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      - --insecure
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should add volumeClaimTemplate for data volume when using StatefulSet:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should add volumeMount for data volume when using StatefulSet:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should expose diag port:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should have multiple replicas when replicaCount is set (using .replicaCount, deprecated):
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should have multiple replicas when replicaCount is set (using highAvailability.replicaCount):
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should have one replica when replicaCount is not set:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should mount extraVolumes and extraVolumeMounts:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-      - mountPath: /path/to/mount
-        name: my-mount
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-    - name: my-mount
-      secret:
-        secretName: mySecret
-should not add emptyDir for data when using StatefulSet:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should provision initContainer correctly when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    initContainers:
-    - args:
-      - echo test
-      image: alpine
-      name: teleport-init
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set SecurityContext:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set affinity when set in values:
-  1: |
-    affinity:
-      nodeAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-          nodeSelectorTerms:
-          - matchExpressions:
-            - key: gravitational.io/dedicated
-              operator: In
-              values:
-              - teleport
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - teleport
-            topologyKey: kubernetes.io/hostname
-          weight: 1
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set default serviceAccountName when not set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set environment when extraEnv set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      env:
-      - name: HTTPS_PROXY
-        value: http://username:password@my.proxy.host:3128
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set image and tag correctly:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:8.3.4
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set imagePullPolicy when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: Always
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set nodeSelector if set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    nodeSelector:
-      gravitational.io/k8s-role: node
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set preferred affinity when more than one replica is used:
-  1: |
-    affinity:
-      podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - RELEASE-NAME
-            topologyKey: kubernetes.io/hostname
-          weight: 50
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set required affinity when highAvailability.requireAntiAffinity is set:
-  1: |
-    affinity:
-      podAntiAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchExpressions:
-            - key: app
-              operator: In
-              values:
-              - RELEASE-NAME
-          topologyKey: kubernetes.io/hostname
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set resources when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      resources:
-        limits:
-          cpu: 2
-          memory: 4Gi
-        requests:
-          cpu: 1
-          memory: 2Gi
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set serviceAccountName when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: teleport-kube-agent-sa
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set storage.requests when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set storage.storageClassName when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
-should set tolerations when set in values:
-  1: |
-    containers:
-    - args:
-      - --diag-addr=0.0.0.0:3000
-      image: quay.io/gravitational/teleport:10.0.0-dev
-      imagePullPolicy: IfNotPresent
-      livenessProbe:
-        failureThreshold: 6
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      name: teleport
-      ports:
-      - containerPort: 3000
-        name: diag
-        protocol: TCP
-      readinessProbe:
-        failureThreshold: 12
-        httpGet:
-          path: /readyz
-          port: diag
-        initialDelaySeconds: 5
-        periodSeconds: 5
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-          - all
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 9807
-      volumeMounts:
-      - mountPath: /etc/teleport
-        name: config
-        readOnly: true
-      - mountPath: /etc/teleport-secrets
-        name: auth-token
-        readOnly: true
-      - mountPath: /var/lib/teleport
-        name: RELEASE-NAME-teleport-data
-    securityContext:
-      fsGroup: 9807
-    serviceAccountName: RELEASE-NAME
-    tolerations:
-    - effect: NoExecute
-      key: dedicated
-      operator: Equal
-      value: teleport
-    - effect: NoSchedule
-      key: dedicated
-      operator: Equal
-      value: teleport
-    volumes:
-    - configMap:
-        name: RELEASE-NAME
-      name: config
-    - name: auth-token
-      secret:
-        secretName: teleport-kube-agent-join-token
diff --git a/examples/chart/teleport-kube-agent/tests/clusterrole_test.yaml b/examples/chart/teleport-kube-agent/tests/clusterrole_test.yaml
deleted file mode 100644
index 337947d13ad2b..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/clusterrole_test.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-suite: ClusterRole
-templates:
-  - clusterrole.yaml
-tests:
-  - it: creates a ClusterRole
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ClusterRole
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/clusterrolebinding_test.yaml b/examples/chart/teleport-kube-agent/tests/clusterrolebinding_test.yaml
deleted file mode 100644
index b8f30d8cf4fc2..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/clusterrolebinding_test.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-suite: ClusterRoleBinding
-templates:
-  - clusterrolebinding.yaml
-tests:
-  - it: creates a ClusterRoleBinding
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ClusterRoleBinding
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/config_test.yaml b/examples/chart/teleport-kube-agent/tests/config_test.yaml
deleted file mode 100644
index b3115d6b31352..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/config_test.yaml
+++ /dev/null
@@ -1,209 +0,0 @@
-suite: ConfigMap
-templates:
-  - config.yaml
-tests:
-  - it: matches snapshot for affinity.yaml
-    values:
-      - ../.lint/affinity.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for all-v5.yaml
-    values:
-      - ../.lint/all-v5.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for all-v6.yaml
-    values:
-      - ../.lint/all-v6.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot and tests for annotations.yaml
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - equal:
-          path: metadata.annotations.kubernetes\.io/config
-          value: test-annotation
-      - equal:
-          path: metadata.annotations.kubernetes\.io/config-different
-          value: 2
-      - matchSnapshot: {}
-
-  - it: matches snapshot for aws-databases.yaml
-    values:
-      - ../.lint/aws-databases.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for backwards-compatibility.yaml
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: does not generate a config for clusterrole.yaml
-    values:
-      - ../.lint/clusterrole.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for db.yaml
-    values:
-      - ../.lint/db.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for imagepullsecrets.yaml
-    values:
-      - ../.lint/imagepullsecrets.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for initcontainers.yaml
-    values:
-      - ../.lint/initcontainers.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for log-basic.yaml
-    values:
-      - ../.lint/log-basic.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for log-extra.yaml
-    values:
-      - ../.lint/log-extra.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for log-legacy.yaml
-    values:
-      - ../.lint/log-legacy.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for node-selector.yaml
-    values:
-      - ../.lint/node-selector.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for pdb.yaml
-    values:
-      - ../.lint/log-extra.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: does not generate a config for pdb.yaml
-    values:
-      - ../.lint/pdb.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for resources.yaml
-    values:
-      - ../.lint/resources.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for stateful.yaml
-    values:
-      - ../.lint/stateful.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for tolerations.yaml
-    values:
-      - ../.lint/tolerations.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
-
-  - it: matches snapshot for volumes.yaml
-    values:
-      - ../.lint/volumes.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/deployment_test.yaml b/examples/chart/teleport-kube-agent/tests/deployment_test.yaml
deleted file mode 100644
index 0e3011e5950cb..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/deployment_test.yaml
+++ /dev/null
@@ -1,349 +0,0 @@
-suite: Deployment
-templates:
-  - deployment.yaml
-  - config.yaml
-tests:
-  - it: creates a Deployment
-    values:
-      - ../.lint/all-v6.yaml
-    asserts:
-      - isKind:
-          of: Deployment
-      - hasDocuments:
-          count: 1
-
-  - it: sets Deployment annotations when specified
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - equal:
-          path: metadata.annotations.kubernetes\.io/deployment
-          value: test-annotation
-      - equal:
-          path: metadata.annotations.kubernetes\.io/deployment-different
-          value: 3
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: sets Pod annotations when specified
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - equal:
-          path: spec.template.metadata.annotations.kubernetes\.io/pod
-          value: test-annotation
-      - equal:
-          path: spec.template.metadata.annotations.kubernetes\.io/pod-different
-          value: 4
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should have one replica when replicaCount is not set
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 1
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should have multiple replicas when replicaCount is set (using .replicaCount, deprecated)
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    set:
-      replicaCount: 3
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 3
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should have multiple replicas when replicaCount is set (using highAvailability.replicaCount)
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    set:
-      highAvailability:
-        replicaCount: 3
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 3
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set affinity when set in values
-    values:
-      - ../.lint/affinity.yaml
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.affinity
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set required affinity when highAvailability.requireAntiAffinity is set
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    set:
-      highAvailability:
-        replicaCount: 2
-        requireAntiAffinity: true
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.affinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
-      - isNull:
-          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set preferred affinity when more than one replica is used
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    set:
-      highAvailability:
-        replicaCount: 3
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.affinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution
-      - isNull:
-          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set tolerations when set in values
-    values:
-      - ../.lint/tolerations.yaml
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.tolerations
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set resources when set in values
-    values:
-      - ../.lint/resources.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.cpu
-          value: 2
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.memory
-          value: 4Gi
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.cpu
-          value: 1
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.memory
-          value: 2Gi
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set SecurityContext
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
-          value: false
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.capabilities
-          value:
-            drop:
-              - all
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
-          value: true
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.runAsNonRoot
-          value: true
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.runAsUser
-          value: 9807
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set image and tag correctly
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    set:
-      teleportVersionOverride: 8.3.4
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].image
-          value: quay.io/gravitational/teleport:8.3.4
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount extraVolumes and extraVolumeMounts
-    values:
-      - ../.lint/volumes.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /path/to/mount
-            name: my-mount
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: my-mount
-            secret:
-              secretName: mySecret
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set imagePullPolicy when set in values
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    set:
-      imagePullPolicy: Always
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].imagePullPolicy
-          value: Always
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set environment when extraEnv set in values
-    set:
-      proxyAddr: helm-lint.example.com
-      authToken: sample-auth-token-dont-use-this
-      kubeClusterName: helm-lint.example.com
-      extraEnv:
-        - name: HTTPS_PROXY
-          value: "http://username:password@my.proxy.host:3128"
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: HTTPS_PROXY
-            value: "http://username:password@my.proxy.host:3128"
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should provision initContainer correctly when set in values
-    values:
-      - ../.lint/initcontainers.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers[0].args
-          content: "echo test"
-      - equal:
-          path: spec.template.spec.initContainers[0].name
-          value: "teleport-init"
-      - equal:
-          path: spec.template.spec.initContainers[0].image
-          value: "alpine"
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.limits.cpu
-          value: 2
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.limits.memory
-          value: 4Gi
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.requests.cpu
-          value: 1
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.requests.memory
-          value: 2Gi
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add insecureSkipProxyTLSVerify to args when set in values
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    set:
-      insecureSkipProxyTLSVerify: true
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].args
-          content: "--insecure"
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should expose diag port
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].ports
-          content:
-            name: diag
-            containerPort: 3000
-            protocol: TCP
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set nodeSelector if set in values
-    values:
-      - ../.lint/node-selector.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.nodeSelector
-          value:
-            gravitational.io/k8s-role: node
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add emptyDir for data when existingDataVolume is not set
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: data
-            emptyDir: {}
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /var/lib/teleport
-            name: data
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should correctly configure existingDataVolume when set
-    values:
-      - ../.lint/existing-data-volume.yaml
-    asserts:
-      - notContains:
-          path: spec.template.spec.volumes
-          content:
-            name: data
-            emptyDir: {}
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /var/lib/teleport
-            name: teleport-kube-agent-data
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set serviceAccountName when set in values
-    values:
-      - ../.lint/service-account-name.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: teleport-kube-agent-sa
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set default serviceAccountName when not set in values
-    values:
-      - ../.lint/backwards-compatibility.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: RELEASE-NAME
-      - matchSnapshot:
-          path: spec.template.spec
diff --git a/examples/chart/teleport-kube-agent/tests/pdb_test.yaml b/examples/chart/teleport-kube-agent/tests/pdb_test.yaml
deleted file mode 100644
index b673ce8400ce3..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/pdb_test.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-suite: PodDisruptionBudget
-templates:
-  - pdb.yaml
-tests:
-  - it: should create a PDB when enabled in values (pdb.yaml)
-    values:
-      - ../.lint/pdb.yaml
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: PodDisruptionBudget
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/psp_test.yaml b/examples/chart/teleport-kube-agent/tests/psp_test.yaml
deleted file mode 100644
index 0faad123c1dc1..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/psp_test.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-suite: PodSecurityPolicy
-templates:
-  - psp.yaml
-tests:
-  - it: creates a PodSecurityPolicy when enabled in values
-    set:
-      podSecurityPolicy:
-        enabled: true
-    asserts:
-      - hasDocuments:
-          count: 3
-      - documentIndex: 0
-        isKind:
-          of: PodSecurityPolicy
-      - documentIndex: 1
-        isKind:
-          of: Role
-      - documentIndex: 2
-        isKind:
-          of: RoleBinding
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/secret_test.yaml b/examples/chart/teleport-kube-agent/tests/secret_test.yaml
deleted file mode 100644
index d2d7963b8e213..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/secret_test.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-suite: Secret
-templates:
-  - secret.yaml
-tests:
-  - it: generates a secret when authToken is provided
-    set:
-      authToken: sample-auth-token-dont-use-this
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: Secret
-      - equal:
-          path: metadata.name
-          value: teleport-kube-agent-join-token
-      - matchSnapshot: {}
-
-  - it: generates a secret with a custom name when authToken and secretName are provided
-    set:
-      authToken: sample-auth-token-dont-use-this
-      secretName: some-other-secret-name
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: Secret
-      - equal:
-          path: metadata.name
-          value: some-other-secret-name
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/serviceaccount_test.yaml b/examples/chart/teleport-kube-agent/tests/serviceaccount_test.yaml
deleted file mode 100644
index fe5d1ebede622..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/serviceaccount_test.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-suite: ServiceAccount
-templates:
-  - serviceaccount.yaml
-tests:
-  - it: sets ServiceAccount annotations when specified
-    values:
-      - ../.lint/annotations.yaml
-    asserts:
-      - equal:
-          path: metadata.annotations.kubernetes\.io/serviceaccount
-          value: test-annotation
-      - equal:
-          path: metadata.annotations.kubernetes\.io/serviceaccount-different
-          value: 5
-      - matchSnapshot: {}
diff --git a/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml b/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
deleted file mode 100644
index 6da67d49eebb7..0000000000000
--- a/examples/chart/teleport-kube-agent/tests/statefulset_test.yaml
+++ /dev/null
@@ -1,369 +0,0 @@
-suite: StatefulSet
-templates:
-  - statefulset.yaml
-  - config.yaml
-tests:
-  - it: creates a StatefulSet
-    values:
-      - ../.lint/stateful.yaml
-    asserts:
-      - isKind:
-          of: StatefulSet
-      - hasDocuments:
-          count: 1
-
-  - it: sets Pod annotations when specified
-    values:
-      - ../.lint/annotations.yaml
-      - ../.lint/stateful.yaml
-    asserts:
-      - equal:
-          path: spec.template.metadata.annotations.kubernetes\.io/pod
-          value: test-annotation
-      - equal:
-          path: spec.template.metadata.annotations.kubernetes\.io/pod-different
-          value: 4
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should have one replica when replicaCount is not set
-    values:
-      - ../.lint/stateful.yaml
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 1
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should have multiple replicas when replicaCount is set (using .replicaCount, deprecated)
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      replicaCount: 3
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 3
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should have multiple replicas when replicaCount is set (using highAvailability.replicaCount)
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      highAvailability:
-        replicaCount: 3
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 3
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set affinity when set in values
-    values:
-      - ../.lint/stateful.yaml
-      - ../.lint/affinity.yaml
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.affinity
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set required affinity when highAvailability.requireAntiAffinity is set
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      highAvailability:
-        replicaCount: 2
-        requireAntiAffinity: true
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.affinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
-      - isNull:
-          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set preferred affinity when more than one replica is used
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      highAvailability:
-        replicaCount: 3
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.affinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity
-      - isNotNull:
-          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution
-      - isNull:
-          path: spec.template.spec.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set tolerations when set in values
-    values:
-      - ../.lint/stateful.yaml
-      - ../.lint/tolerations.yaml
-    asserts:
-      - isNotNull:
-          path: spec.template.spec.tolerations
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set resources when set in values
-    values:
-      - ../.lint/stateful.yaml
-      - ../.lint/resources.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.cpu
-          value: 2
-      - equal:
-          path: spec.template.spec.containers[0].resources.limits.memory
-          value: 4Gi
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.cpu
-          value: 1
-      - equal:
-          path: spec.template.spec.containers[0].resources.requests.memory
-          value: 2Gi
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set SecurityContext
-    values:
-      - ../.lint/stateful.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
-          value: false
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.capabilities
-          value:
-            drop:
-              - all
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
-          value: true
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.runAsNonRoot
-          value: true
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.runAsUser
-          value: 9807
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set image and tag correctly
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      teleportVersionOverride: 8.3.4
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].image
-          value: quay.io/gravitational/teleport:8.3.4
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should mount extraVolumes and extraVolumeMounts
-    values:
-      - ../.lint/stateful.yaml
-      - ../.lint/volumes.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            mountPath: /path/to/mount
-            name: my-mount
-      - contains:
-          path: spec.template.spec.volumes
-          content:
-            name: my-mount
-            secret:
-              secretName: mySecret
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set imagePullPolicy when set in values
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      imagePullPolicy: Always
-    asserts:
-      - equal:
-          path: spec.template.spec.containers[0].imagePullPolicy
-          value: Always
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set environment when extraEnv set in values
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      extraEnv:
-        - name: HTTPS_PROXY
-          value: "http://username:password@my.proxy.host:3128"
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: HTTPS_PROXY
-            value: "http://username:password@my.proxy.host:3128"
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should provision initContainer correctly when set in values
-    values:
-      - ../.lint/stateful.yaml
-      - ../.lint/initcontainers.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers[0].args
-          content: "echo test"
-      - equal:
-          path: spec.template.spec.initContainers[0].name
-          value: "teleport-init"
-      - equal:
-          path: spec.template.spec.initContainers[0].image
-          value: "alpine"
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.limits.cpu
-          value: 2
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.limits.memory
-          value: 4Gi
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.requests.cpu
-          value: 1
-      - equal:
-          path: spec.template.spec.initContainers[0].resources.requests.memory
-          value: 2Gi
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add insecureSkipProxyTLSVerify to args when set in values
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      insecureSkipProxyTLSVerify: true
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].args
-          content: "--insecure"
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should expose diag port
-    values:
-      - ../.lint/stateful.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].ports
-          content:
-            name: diag
-            containerPort: 3000
-            protocol: TCP
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set nodeSelector if set in values
-    values:
-      - ../.lint/stateful.yaml
-      - ../.lint/node-selector.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.nodeSelector
-          value:
-            gravitational.io/k8s-role: node
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should not add emptyDir for data when using StatefulSet
-    values:
-      - ../.lint/stateful.yaml
-    asserts:
-      - notContains:
-          path: spec.template.spec.volumes
-          content:
-            name: data
-            emptyDir: {}
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add volumeMount for data volume when using StatefulSet
-    values:
-      - ../.lint/stateful.yaml
-    asserts:
-      - notContains:
-          path: spec.template.spec.containers[0].volumeMounts
-          content:
-            name: data
-            mountPath: RELEASE-NAME-teleport-data
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should add volumeClaimTemplate for data volume when using StatefulSet
-    values:
-      - ../.lint/stateful.yaml
-    asserts:
-      - isNotNull:
-          path: spec.volumeClaimTemplates[0].spec
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set storage.storageClassName when set in values
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      storage:
-        storageClassName: helm-lint-storage-class
-    asserts:
-      - equal:
-          path: spec.volumeClaimTemplates[0].spec.storageClassName
-          value: helm-lint-storage-class
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set storage.requests when set in values
-    values:
-      - ../.lint/stateful.yaml
-    set:
-      storage:
-        requests: 256Mi
-    asserts:
-      - equal:
-          path: spec.volumeClaimTemplates[0].spec.resources.requests.storage
-          value: 256Mi
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set serviceAccountName when set in values
-    values:
-      - ../.lint/stateful.yaml
-      - ../.lint/service-account-name.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: teleport-kube-agent-sa
-      - matchSnapshot:
-          path: spec.template.spec
-
-  - it: should set default serviceAccountName when not set in values
-    values:
-      - ../.lint/stateful.yaml
-      - ../.lint/backwards-compatibility.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: RELEASE-NAME
-      - matchSnapshot:
-          path: spec.template.spec
diff --git a/examples/chart/teleport-kube-agent/values.schema.json b/examples/chart/teleport-kube-agent/values.schema.json
index acda282522d5a..46aa080fa3e49 100644
--- a/examples/chart/teleport-kube-agent/values.schema.json
+++ b/examples/chart/teleport-kube-agent/values.schema.json
@@ -284,16 +284,6 @@
                 }
             }
         },
-        "extraArgs": {
-            "$id": "#/properties/extraArgs",
-            "type": "array",
-            "default": []
-        },
-        "extraEnv": {
-            "$id": "#/properties/extraEnv",
-            "type": "array",
-            "default": []
-        },
         "extraVolumes": {
             "$id": "#/properties/extraVolumes",
             "type": "array",
diff --git a/examples/chart/teleport-kube-agent/values.yaml b/examples/chart/teleport-kube-agent/values.yaml
index 2e404f0a33ded..069258679072b 100644
--- a/examples/chart/teleport-kube-agent/values.yaml
+++ b/examples/chart/teleport-kube-agent/values.yaml
@@ -51,8 +51,6 @@ awsDatabases: []
 #  - name: aurora
 #    uri: "postgres-aurora-instance-1.xxx.us-east-1.rds.amazonaws.com:5432"
 #    protocol: "postgres"
-#    static_labels:
-#      env: "prod"
 databases: []
 
 ################################################################
@@ -67,7 +65,6 @@ insecureSkipProxyTLSVerify: false
 
 # If set, will use an existing volume mounted via extraVolumes
 # as the Teleport data directory.
-# If anything is set under the "storage" key, this will be ignored.
 existingDataVolume: ""
 
 # If true, create & use Pod Security Policy resources
@@ -179,12 +176,6 @@ annotations:
   # Annotations for the ServiceAccount object
   serviceAccount: {}
 
-# Extra arguments to pass to 'teleport start' for the main Teleport pod
-extraArgs: []
-
-# Extra environment to be configured on the Teleport pod
-extraEnv: []
-
 # Extra volumes to mount into the Teleport pods
 # https://kubernetes.io/docs/concepts/storage/volumes/
 extraVolumes: []
diff --git a/examples/chart/teleport/.helmignore b/examples/chart/teleport/.helmignore
index 59ffd343fe67c..2a1a7a2420771 100644
--- a/examples/chart/teleport/.helmignore
+++ b/examples/chart/teleport/.helmignore
@@ -2,4 +2,3 @@
 *.pem
 scripts
 pki
-tests
\ No newline at end of file
diff --git a/examples/chart/teleport/README.md b/examples/chart/teleport/README.md
index 9c3273927bf9d..d5d3bad3b9eec 100644
--- a/examples/chart/teleport/README.md
+++ b/examples/chart/teleport/README.md
@@ -1,8 +1,3 @@
-# WARNING
-
-This chart is **deprecated** and no longer actively maintained or supported by Teleport.
-We recommend the use of the [teleport-cluster](../teleport-cluster/README.md) chart instead.
-
 # Teleport
 
 [Gravitational Teleport](https://github.com/gravitational/teleport) is a modern SSH/Kubernetes API proxy server for remotely accessing clusters of Linux containers and servers via SSH, HTTPS, or Kubernetes API.  Community and Enterprise versions of Teleport are available.  You can start with the Community edition with this Chart and in the future update to an Enterprise version for the same deployment.
diff --git a/examples/resources/plugins/teleport-jira-cloud.toml b/examples/resources/plugins/teleport-jira-cloud.toml
deleted file mode 100644
index d8b6cde9b242c..0000000000000
--- a/examples/resources/plugins/teleport-jira-cloud.toml
+++ /dev/null
@@ -1,20 +0,0 @@
-# example jira plugin configuration TOML file
-[teleport]
-auth_server = "myinstance.teleport.sh:443"             # Teleport Cloud proxy HTTPS address
-identity = "/var/lib/teleport/plugins/jira/auth.pem"   # Teleport identity file location
-
-[jira]
-url = "https://example.com/jira"    # JIRA URL. For JIRA Cloud, https://[my-jira].atlassian.net
-username = "bot@example.com"        # JIRA username
-api_token = "token"                 # JIRA API Basic Auth token
-project = "MYPROJ"                  # JIRA Project key
-
-[http]
-# listen_addr = ":8081" # Network address in format [addr]:port on which webhook server listens, e.g. 0.0.0.0:443
-# public_addr = "example.com" # URL on which webhook server is accessible externally, e.g. [https://]teleport-jira.example.com
-https_key_file = "/var/lib/teleport/plugins/jira/server.key"  # TLS private key
-https_cert_file = "/var/lib/teleport/plugins/jira/server.crt" # TLS certificate
-
-[log]
-output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/jira.log"
-severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
\ No newline at end of file
diff --git a/examples/resources/plugins/teleport-jira-self-hosted.toml b/examples/resources/plugins/teleport-jira.toml
similarity index 100%
rename from examples/resources/plugins/teleport-jira-self-hosted.toml
rename to examples/resources/plugins/teleport-jira.toml
diff --git a/examples/resources/plugins/teleport-mattermost-cloud.toml b/examples/resources/plugins/teleport-mattermost-cloud.toml
deleted file mode 100644
index e341be450afd5..0000000000000
--- a/examples/resources/plugins/teleport-mattermost-cloud.toml
+++ /dev/null
@@ -1,21 +0,0 @@
-# example mattermost configuration TOML file
-[teleport]
-auth_server = "myinstance.teleport.sh:443"                   # Teleport Cloud proxy HTTPS address
-identity = "/var/lib/teleport/plugins/mattermost/auth.pem"   # Identity file path
-
-[mattermost]
-url = "https://mattermost.example.com" # Mattermost Server URL
-team = "team-name"                     # Mattermsot team in which the channel resides.
-channel = "channel-name"               # Mattermost Channel name to post requests to
-token = "api-token"                    # Mattermost Bot OAuth token
-secret = "signing-secret-value"        # Mattermost API signing Secret
-
-[http]
-public_addr = "example.com" # URL on which callback server is accessible externally, e.g. [https://]teleport-mattermost.example.com
-# listen_addr = ":8081" # Network address in format [addr]:port on which callback server listens, e.g. 0.0.0.0:443
-https_key_file = "/var/lib/teleport/plugins/mattermost/server.key"  # TLS private key
-https_cert_file = "/var/lib/teleport/plugins/mattermost/server.crt" # TLS certificate
-
-[log]
-output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/mattermost.log"
-severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
diff --git a/examples/resources/plugins/teleport-mattermost-self.toml b/examples/resources/plugins/teleport-mattermost.toml
similarity index 100%
rename from examples/resources/plugins/teleport-mattermost-self.toml
rename to examples/resources/plugins/teleport-mattermost.toml
diff --git a/examples/resources/plugins/teleport-pagerduty-cloud.toml b/examples/resources/plugins/teleport-pagerduty-cloud.toml
deleted file mode 100644
index 1331624d4140a..0000000000000
--- a/examples/resources/plugins/teleport-pagerduty-cloud.toml
+++ /dev/null
@@ -1,26 +0,0 @@
-# example teleport-pagerduty configuration TOML file
-[teleport]
-auth_server = "myinstance.teleport.sh:443"                  # Teleport Cloud proxy HTTPS address
-identity = "/var/lib/teleport/plugins/pagerduty/auth.pem"   # Identity file path
-
-[pagerduty]
-api_key = "key"               # PagerDuty API Key
-user_email = "me@example.com" # PagerDuty bot user email (Could be admin email)
-service_id = "PIJ90N7"        # PagerDuty service id
-
-[http]
-public_addr = "example.com" # URL on which callback server is accessible externally, e.g. [https://]teleport-pagerduty.example.com
-# listen_addr = ":8081" # Network address in format [addr]:port on which callback server listens, e.g. 0.0.0.0:443
-https_key_file = "/var/lib/teleport/plugins/pagerduty/server.key"  # TLS private key
-https_cert_file = "/var/lib/teleport/plugins/pagerduty/server.crt" # TLS certificate
-
-[http.tls]
-verify_client_cert = true # The preferred way to authenticate webhooks on Pagerduty. See more: https://developer.pagerduty.com/docs/webhooks/webhooks-mutual-tls
-
-[http.basic_auth]
-user = "user"
-password = "password" # If you prefer to use basic auth for Pagerduty Webhooks authentication, use this section to store user and password
-
-[log]
-output = "stderr" # Logger output. Could be "stdout", "stderr" or "/var/lib/teleport/pagerduty.log"
-severity = "INFO" # Logger severity. Could be "INFO", "ERROR", "DEBUG" or "WARN".
\ No newline at end of file
diff --git a/examples/resources/plugins/teleport-pagerduty-self.toml b/examples/resources/plugins/teleport-pagerduty.toml
similarity index 100%
rename from examples/resources/plugins/teleport-pagerduty-self.toml
rename to examples/resources/plugins/teleport-pagerduty.toml
diff --git a/examples/resources/terraform/terraform-user-role-cloud.tf b/examples/resources/terraform/terraform-user-role-cloud.tf
deleted file mode 100644
index cec5b0e38ce74..0000000000000
--- a/examples/resources/terraform/terraform-user-role-cloud.tf
+++ /dev/null
@@ -1,79 +0,0 @@
-terraform {
-  required_providers {
-    teleport = {
-      version = ">= (=teleport.version=)"
-      source  = "gravitational.com/teleport/teleport"
-    }
-  }
-}
-
-provider "teleport" {
-  # Update addr to point to your Teleport Cloud tenant URL
-  addr               = "mytenant.teleport.sh"
-  identity_file_path = "terraform-identity"
-}
-
-resource "teleport_role" "terraform-test" {
-  metadata {
-    name        = "terraform-test"
-    description = "Terraform test role"
-    labels = {
-      example  = "yes"
-    }
-  }
-  
-  spec {
-    options {
-      forward_agent           = false
-      max_session_ttl         = "30m"
-      port_forwarding         = false
-      client_idle_timeout     = "1h"
-      disconnect_expired_cert = true
-      permit_x11_forwarding    = false
-      request_access          = "denied"
-    }
-
-    allow {
-      logins = ["this-user-does-not-exist"]
-
-      rules {
-        resources = ["user", "role"]
-        verbs = ["list"]
-      }
-
-      request {
-        roles = ["example"]
-        claims_to_roles {
-          claim = "example"
-          value = "example"
-          roles = ["example"]
-        }
-      }
-
-      node_labels {
-         key = "example"
-         value = ["yes"]
-      }
-    }
-
-    deny {
-      logins = ["anonymous"]
-    }
-  }
-}
-
-resource "teleport_user" "terraform-test" {
-  metadata {
-    name        = "terraform-test"
-    description = "Test terraform user"
-    expires     = "2022-10-12T07:20:50.52Z"
-
-    labels = {
-      test      = "true"
-    }
-  }
-
-  spec {
-    roles = ["terraform-test"]
-  }
-}
diff --git a/examples/resources/terraform/terraform-user-role-self-hosted.tf b/examples/resources/terraform/terraform-user-role.tf
similarity index 93%
rename from examples/resources/terraform/terraform-user-role-self-hosted.tf
rename to examples/resources/terraform/terraform-user-role.tf
index 893f977ca352d..ac8204e31e550 100644
--- a/examples/resources/terraform/terraform-user-role-self-hosted.tf
+++ b/examples/resources/terraform/terraform-user-role.tf
@@ -11,9 +11,7 @@ provider "teleport" {
   # Update addr to point to Teleport Auth/Proxy
   # addr               = "auth.example.com:3025"
   addr               = "proxy.example.com:443"
-  cert_path          = "auth.crt"
-  key_path           = "auth.key"
-  root_ca_path       = "auth.cas"
+  identity_file_path = "terraform-identity"
 }
 
 resource "teleport_role" "terraform-test" {
diff --git a/go.mod b/go.mod
index 12bffeab8bc36..7958409373ff5 100644
--- a/go.mod
+++ b/go.mod
@@ -15,7 +15,7 @@ require (
 	github.com/alicebob/miniredis/v2 v2.17.0
 	github.com/aquasecurity/libbpfgo v0.1.0
 	github.com/armon/go-radix v1.0.0
-	github.com/aws/aws-sdk-go v1.43.15
+	github.com/aws/aws-sdk-go v1.37.17
 	github.com/aws/aws-sdk-go-v2 v1.9.0
 	github.com/aws/aws-sdk-go-v2/config v1.8.0
 	github.com/aws/aws-sdk-go-v2/credentials v1.4.0
@@ -62,11 +62,9 @@ require (
 	github.com/jcmturner/gokrb5/v8 v8.4.2
 	github.com/johannesboyne/gofakes3 v0.0.0-20210217223559-02ffa763be97
 	github.com/jonboulle/clockwork v0.2.2
-	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531
 	github.com/json-iterator/go v1.1.12
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0
-	github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27
 	github.com/kr/pretty v0.3.0
 	github.com/kr/pty v1.1.8
 	github.com/kylelemons/godebug v1.1.0
@@ -191,7 +189,6 @@ require (
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d // indirect
 	github.com/klauspost/compress v1.9.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
@@ -268,8 +265,6 @@ replace (
 	github.com/go-redis/redis/v8 => github.com/gravitational/redis/v8 v8.11.5-0.20220211010318-7af711b76a91
 	github.com/gogo/protobuf => github.com/gravitational/protobuf v1.3.2-0.20201123192827-2b9fcfaffcbf
 	github.com/gravitational/teleport/api => ./api
-	github.com/russellhaering/gosaml2 => github.com/gravitational/gosaml2 v0.0.0-20220318224559-f06932032ae2
-	github.com/siddontang/go-mysql v1.1.0 => github.com/gravitational/go-mysql v1.1.1-teleport.2
+	github.com/siddontang/go-mysql v1.1.0 => github.com/gravitational/go-mysql v1.1.1-teleport.1
 	github.com/sirupsen/logrus => github.com/gravitational/logrus v1.4.4-0.20210817004754-047e20245621
-	github.com/vulcand/predicate => github.com/gravitational/predicate v1.2.1
 )
diff --git a/go.sum b/go.sum
index 73530e6c2d1d3..8787503ddf734 100644
--- a/go.sum
+++ b/go.sum
@@ -128,8 +128,8 @@ github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgI
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/aws/aws-sdk-go v1.17.4/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.34.28/go.mod h1:H7NKnBqNVzoTJpGfLrQkkD+ytBA93eiDYi/+8rV9s48=
-github.com/aws/aws-sdk-go v1.43.15 h1:zAOUdqgNgJrkivRZi93NTjPNvuIQ5EcqNHSk0A1jrk8=
-github.com/aws/aws-sdk-go v1.43.15/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go v1.37.17 h1:Ga33kM38f58l7X+Z2B6JNdz9dFqxjR8AXHBbK3bXYc0=
+github.com/aws/aws-sdk-go v1.37.17/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/aws/aws-sdk-go-v2 v1.9.0 h1:+S+dSqQCN3MSU5vJRu1HqHrq00cJn6heIMU7X9hcsoo=
 github.com/aws/aws-sdk-go-v2 v1.9.0/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
 github.com/aws/aws-sdk-go-v2/config v1.8.0 h1:O8EMFBOl6tue5gdJJV6U3Ikyl3lqgx6WrulCYrcy2SQ=
@@ -441,25 +441,23 @@ github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv
 github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
-github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gravitational/configure v0.0.0-20180808141939-c3428bd84c23 h1:havbccuFO5fRj0O67oHXI7doShLig3rSIXfMrd/UnkA=
 github.com/gravitational/configure v0.0.0-20180808141939-c3428bd84c23/go.mod h1:XL9nebvlfNVvRzRPWdDcWootcyA0l7THiH/A+W1233g=
 github.com/gravitational/form v0.0.0-20151109031454-c4048f792f70 h1:To76nCJtM3DI0mdq3nGLzXqTV1wNOJByxv01+u9/BxM=
 github.com/gravitational/form v0.0.0-20151109031454-c4048f792f70/go.mod h1:88hFR45MpUd23d2vNWE/dYtesU50jKsbz0I9kH7UaBY=
 github.com/gravitational/go-mssqldb v0.11.1-0.20220202000043-bec708e9bfd0 h1:DC+S+j/tBs/0MnQCC5j7GWWbMGcR3ca5v75ksAU1LJM=
 github.com/gravitational/go-mssqldb v0.11.1-0.20220202000043-bec708e9bfd0/go.mod h1:iiK0YP1ZeepvmBQk/QpLEhhTNJgfzrpArPY/aFvc9yU=
-github.com/gravitational/go-mysql v1.1.1-teleport.2 h1:XZ36BZ7BgslA5ZCyCHjpc1wilFITThIH7cLcbLWKWzM=
-github.com/gravitational/go-mysql v1.1.1-teleport.2/go.mod h1:re0JQZ1Cy5dVlIDGq0YksfDIla/GRZlxqOoC0XPSSGE=
+github.com/gravitational/go-mysql v1.1.1-teleport.1 h1:062V8u0juCyUvpYMdkYch8JDDw7wf5rdhKaIfhnojDg=
+github.com/gravitational/go-mysql v1.1.1-teleport.1/go.mod h1:re0JQZ1Cy5dVlIDGq0YksfDIla/GRZlxqOoC0XPSSGE=
 github.com/gravitational/go-oidc v0.0.5 h1:kxsCknoOZ+KqIAoYLLdHuQcvcc+SrQlnT7xxIM8oo6o=
 github.com/gravitational/go-oidc v0.0.5/go.mod h1:SevmOUNdOB0aD9BAIgjptZ6oHkKxMZZgA70nwPfgU/w=
-github.com/gravitational/gosaml2 v0.0.0-20220318224559-f06932032ae2 h1:8z1D1fehTDV20wkiGX+JTnlevvEUeVEh4LCygvOrFBs=
-github.com/gravitational/gosaml2 v0.0.0-20220318224559-f06932032ae2/go.mod h1:PiLt5KX4EMjlMIq3WLRR/xb5yqhiwtQhGr8wmU0b08M=
 github.com/gravitational/kingpin v2.1.11-0.20190130013101-742f2714c145+incompatible h1:CfyZl3nyo9K5lLqOmqvl9/IElY1UCnOWKZiQxJ8HKdA=
 github.com/gravitational/kingpin v2.1.11-0.20190130013101-742f2714c145+incompatible/go.mod h1:LWxG30M3FcrjhOn3T4zz7JmBoQJ45MWZmOXgy9Ganoc=
 github.com/gravitational/license v0.0.0-20210218173955-6d8fb49b117a h1:PN5vAN1ZA0zqdpM6wNdx6+bkdlQ5fImd75oaIHSbOhY=
@@ -468,8 +466,6 @@ github.com/gravitational/logrus v1.4.4-0.20210817004754-047e20245621 h1:ivU//THq
 github.com/gravitational/logrus v1.4.4-0.20210817004754-047e20245621/go.mod h1:IIxugQsS57BiOTe+8zDv3sfnvM2BQ3smcF1xJdj3Has=
 github.com/gravitational/oxy v0.0.0-20211213172937-a1ba0900a4c9 h1:7NyppZS8QFt28nn2QjDI44vDTJs0kTRdUS7po/AxWOY=
 github.com/gravitational/oxy v0.0.0-20211213172937-a1ba0900a4c9/go.mod h1:ESOxlf8BB2yG3zJ0SfZe9U6wpYu3YF3znxIICg73FYA=
-github.com/gravitational/predicate v1.2.1 h1:CXgXyZ90F2x4VHzOab1bBsBlpY2l+MGvb5RX3avrJ5U=
-github.com/gravitational/predicate v1.2.1/go.mod h1:VipoNYXny6c8N381zGUWkjuuNHiRbeAZhE7Qm9c+2GA=
 github.com/gravitational/protobuf v1.3.2-0.20201123192827-2b9fcfaffcbf h1:MQ4e8XcxvZTeuOmRl7yE519vcWc2h/lyvYzsvt41cdY=
 github.com/gravitational/protobuf v1.3.2-0.20201123192827-2b9fcfaffcbf/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gravitational/redis/v8 v8.11.5-0.20220211010318-7af711b76a91 h1:LWtt0fv7KDZt6ykJGBXd/04sONaHIMXFzHvmUAqhG8c=
@@ -501,9 +497,9 @@ github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerX
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
@@ -582,10 +578,6 @@ github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9q
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 h1:hgVxRoDDPtQE68PT4LFvNlPz2nBKd3OMlGKIQ69OmR4=
-github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531/go.mod h1:fqTUQpVYBvhCNIsMXGl2GE9q6z94DIP6NtFKXCSTVbg=
-github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d h1:J8tJzRyiddAFF65YVgxli+TyWBi0f79Sld6rJP6CBcY=
-github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d/go.mod h1:b+Q3v8Yrg5o15d71PSUraUzYb+jWl6wQMSBXSGS/hv0=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -604,8 +596,6 @@ github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALr
 github.com/karrick/godirwalk v1.8.0/go.mod h1:H5KPZjojv4lE+QYImBI8xVtrBRgYrIVsaRPx4tDPEn4=
 github.com/karrick/godirwalk v1.10.3/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA=
 github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19/go.mod h1:hY+WOq6m2FpbvyrI93sMaypsttvaIL5nhVR92dTMUcQ=
-github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27 h1:10nfvqVK4/KINnLT8bDICrRnfguTJ300dNGpW8D2bQo=
-github.com/keys-pub/go-libfido2 v1.5.3-0.20220306005615-8ab03fb1ec27/go.mod h1:P0V19qHwJNY0htZwZDe9Ilvs/nokGhdFX7faKFyZ6+U=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.9.5 h1:U+CaK85mrNNb4k8BNOfgJtJ/gr6kswUCFj6miSzVC6M=
@@ -798,6 +788,8 @@ github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6po
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
+github.com/russellhaering/gosaml2 v0.6.1-0.20210916051624-757d23f1bc28 h1:659ZmS9riGgajUnT9ym74yQSug2KZyvVHi3EmIqASnQ=
+github.com/russellhaering/gosaml2 v0.6.1-0.20210916051624-757d23f1bc28/go.mod h1:PiLt5KX4EMjlMIq3WLRR/xb5yqhiwtQhGr8wmU0b08M=
 github.com/russellhaering/goxmldsig v1.1.1 h1:vI0r2osGF1A9PLvsGdPUAGwEIrKa4Pj5sesSBsebIxM=
 github.com/russellhaering/goxmldsig v1.1.1/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
 github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
@@ -869,6 +861,8 @@ github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1
 github.com/tstranex/u2f v0.0.0-20160508205855-eb799ce68da4 h1:aR+lGR8m0zBjvDlHkHOCmdsk79ipIPeiP75GqUlywKM=
 github.com/tstranex/u2f v0.0.0-20160508205855-eb799ce68da4/go.mod h1:eahSLaqAS0zsIEv80+vXT7WanXs7MQQDg3j3wGBSayo=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
+github.com/vulcand/predicate v1.2.0 h1:uFsW1gcnnR7R+QTID+FVcs0sSYlIGntoGOTb3rQJt50=
+github.com/vulcand/predicate v1.2.0/go.mod h1:VipoNYXny6c8N381zGUWkjuuNHiRbeAZhE7Qm9c+2GA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
@@ -962,8 +956,8 @@ golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8 h1:kACShD3qhmr/3rLmg1yXyt+N4HcwutKyPRB93s54TIU=
 golang.org/x/crypto v0.0.0-20220126234351-aa10faf2a1f8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
diff --git a/integration/app_integration_test.go b/integration/app_integration_test.go
index b43c52ef5c396..8ec91f3866f8a 100644
--- a/integration/app_integration_test.go
+++ b/integration/app_integration_test.go
@@ -635,53 +635,18 @@ func TestAppAuditEvents(t *testing.T) {
 
 func TestAppServersHA(t *testing.T) {
 	testCases := map[string]struct {
-		packInfo        func(pack *pack) (cluterName, publicAddr string, appServers []*service.TeleportProcess)
-		startAppServers func(pack *pack, count int) []*service.TeleportProcess
-		makeRequest     func(pack *pack, inCookie string) (status int, err error)
+		publicAddr  func(pack *pack) string
+		makeRequest func(pack *pack, inCookie string) (status int, err error)
 	}{
-		"RootHTTPApp": {
-			packInfo: func(pack *pack) (string, string, []*service.TeleportProcess) {
-				return pack.rootAppClusterName, pack.rootAppPublicAddr, pack.rootAppServers
-			},
-			startAppServers: func(pack *pack, count int) []*service.TeleportProcess {
-				return pack.startRootAppServers(t, count, []service.App{})
-			},
-			makeRequest: func(pack *pack, inCookie string) (int, error) {
-				status, _, err := pack.makeRequest(inCookie, http.MethodGet, "/")
-				return status, err
-			},
-		},
-		"RootWebSocketApp": {
-			packInfo: func(pack *pack) (string, string, []*service.TeleportProcess) {
-				return pack.rootAppClusterName, pack.rootWSPublicAddr, pack.rootAppServers
-			},
-			startAppServers: func(pack *pack, count int) []*service.TeleportProcess {
-				return pack.startRootAppServers(t, count, []service.App{})
-			},
-			makeRequest: func(pack *pack, inCookie string) (int, error) {
-				_, err := pack.makeWebsocketRequest(inCookie, "/")
-				return 0, err
-			},
-		},
-		"LeafHTTPApp": {
-			packInfo: func(pack *pack) (string, string, []*service.TeleportProcess) {
-				return pack.leafAppClusterName, pack.leafAppPublicAddr, pack.leafAppServers
-			},
-			startAppServers: func(pack *pack, count int) []*service.TeleportProcess {
-				return pack.startLeafAppServers(t, count, []service.App{})
-			},
+		"HTTPApp": {
+			publicAddr: func(pack *pack) string { return pack.rootAppPublicAddr },
 			makeRequest: func(pack *pack, inCookie string) (int, error) {
 				status, _, err := pack.makeRequest(inCookie, http.MethodGet, "/")
 				return status, err
 			},
 		},
-		"LeafWebSocketApp": {
-			packInfo: func(pack *pack) (string, string, []*service.TeleportProcess) {
-				return pack.leafAppClusterName, pack.leafWSPublicAddr, pack.leafAppServers
-			},
-			startAppServers: func(pack *pack, count int) []*service.TeleportProcess {
-				return pack.startLeafAppServers(t, count, []service.App{})
-			},
+		"WebSocketApp": {
+			publicAddr: func(pack *pack) string { return pack.rootWSPublicAddr },
 			makeRequest: func(pack *pack, inCookie string) (int, error) {
 				_, err := pack.makeWebsocketRequest(inCookie, "/")
 				return 0, err
@@ -713,19 +678,18 @@ func TestAppServersHA(t *testing.T) {
 	for name, test := range testCases {
 		t.Run(name, func(t *testing.T) {
 			pack := setupWithOptions(t, appTestOptions{rootAppServersCount: 3})
-			clusterName, publicAddr, appServers := test.packInfo(pack)
+			inCookie := pack.createAppSession(t, test.publicAddr(pack), pack.rootAppClusterName)
 
-			inCookie := pack.createAppSession(t, publicAddr, clusterName)
 			status, err := test.makeRequest(pack, inCookie)
 			responseWithoutError(t, status, err)
 
 			// Stop all root app servers.
-			for i, appServer := range appServers {
+			for i, appServer := range pack.rootAppServers {
 				appServer.Close()
 
 				// issue a request right after a server is gone.
 				status, err = test.makeRequest(pack, inCookie)
-				if i == len(appServers)-1 {
+				if i == len(pack.rootAppServers)-1 {
 					// fails only when the last one is closed.
 					responseWithError(t, status, err)
 				} else {
@@ -735,13 +699,13 @@ func TestAppServersHA(t *testing.T) {
 				}
 			}
 
-			servers := test.startAppServers(pack, 3)
+			servers := pack.startRootAppServers(t, 3, []service.App{})
 			status, err = test.makeRequest(pack, inCookie)
 			responseWithoutError(t, status, err)
 
 			// Start an additional app server and stop all current running
 			// ones.
-			test.startAppServers(pack, 1)
+			pack.startRootAppServers(t, 1, []service.App{})
 			for _, appServer := range servers {
 				appServer.Close()
 
@@ -792,8 +756,8 @@ type pack struct {
 	jwtAppClusterName string
 	jwtAppURI         string
 
-	leafCluster    *TeleInstance
-	leafAppServers []*service.TeleportProcess
+	leafCluster   *TeleInstance
+	leafAppServer *service.TeleportProcess
 
 	leafAppName        string
 	leafAppPublicAddr  string
@@ -830,7 +794,6 @@ type appTestOptions struct {
 	rootClusterPorts    *InstancePorts
 	leafClusterPorts    *InstancePorts
 	rootAppServersCount int
-	leafAppServersCount int
 
 	rootConfig func(config *service.Config)
 	leafConfig func(config *service.Config)
@@ -1060,12 +1023,42 @@ func setupWithOptions(t *testing.T, opts appTestOptions) *pack {
 	}
 	p.rootAppServers = p.startRootAppServers(t, rootAppServersCount, opts.extraRootApps)
 
-	// At least one leafAppServer should start during the setup
-	leafAppServersCount := 1
-	if opts.leafAppServersCount > 0 {
-		leafAppServersCount = opts.leafAppServersCount
+	laConf := service.MakeDefaultConfig()
+	laConf.Console = nil
+	laConf.Log = log
+	laConf.DataDir = t.TempDir()
+	t.Cleanup(func() { os.RemoveAll(laConf.DataDir) })
+	laConf.Token = "static-token-value"
+	laConf.AuthServers = []utils.NetAddr{
+		{
+			AddrNetwork: "tcp",
+			Addr:        net.JoinHostPort(Loopback, p.leafCluster.GetPortWeb()),
+		},
 	}
-	p.leafAppServers = p.startLeafAppServers(t, leafAppServersCount, opts.extraLeafApps)
+	laConf.Auth.Enabled = false
+	laConf.Proxy.Enabled = false
+	laConf.SSH.Enabled = false
+	laConf.Apps.Enabled = true
+	laConf.Apps.Apps = append([]service.App{
+		{
+			Name:       p.leafAppName,
+			URI:        leafServer.URL,
+			PublicAddr: p.leafAppPublicAddr,
+		},
+		{
+			Name:       p.leafWSAppName,
+			URI:        leafWSServer.URL,
+			PublicAddr: p.leafWSPublicAddr,
+		},
+		{
+			Name:       p.leafWSSAppName,
+			URI:        leafWSSServer.URL,
+			PublicAddr: p.leafWSSPublicAddr,
+		},
+	}, opts.extraLeafApps...)
+	p.leafAppServer, err = p.leafCluster.StartApp(laConf)
+	require.NoError(t, err)
+	t.Cleanup(func() { p.leafAppServer.Close() })
 
 	// Create user for tests.
 	p.initUser(t, opts)
@@ -1254,7 +1247,7 @@ func (p *pack) ensureAuditEvent(t *testing.T, eventType string, checkEvent func(
 // initCertPool initializes root cluster CA pool.
 func (p *pack) initCertPool(t *testing.T) {
 	authClient := p.rootCluster.GetSiteAPI(p.rootCluster.Secrets.SiteName)
-	ca, err := authClient.GetCertAuthority(context.Background(), types.CertAuthID{
+	ca, err := authClient.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: p.rootCluster.Secrets.SiteName,
 	}, false)
@@ -1518,55 +1511,6 @@ func (p *pack) startRootAppServers(t *testing.T, count int, extraApps []service.
 	return servers
 }
 
-func (p *pack) startLeafAppServers(t *testing.T, count int, extraApps []service.App) []*service.TeleportProcess {
-	log := utils.NewLoggerForTests()
-	servers := make([]*service.TeleportProcess, count)
-
-	for i := 0; i < count; i++ {
-		laConf := service.MakeDefaultConfig()
-		laConf.Console = nil
-		laConf.Log = log
-		laConf.DataDir = t.TempDir()
-		t.Cleanup(func() { os.RemoveAll(laConf.DataDir) })
-		laConf.Token = "static-token-value"
-		laConf.AuthServers = []utils.NetAddr{
-			{
-				AddrNetwork: "tcp",
-				Addr:        net.JoinHostPort(Loopback, p.leafCluster.GetPortWeb()),
-			},
-		}
-		laConf.Auth.Enabled = false
-		laConf.Proxy.Enabled = false
-		laConf.SSH.Enabled = false
-		laConf.Apps.Enabled = true
-		laConf.Apps.Apps = append([]service.App{
-			{
-				Name:       p.leafAppName,
-				URI:        p.leafAppURI,
-				PublicAddr: p.leafAppPublicAddr,
-			},
-			{
-				Name:       p.leafWSAppName,
-				URI:        p.leafWSAppURI,
-				PublicAddr: p.leafWSPublicAddr,
-			},
-			{
-				Name:       p.leafWSSAppName,
-				URI:        p.leafWSSAppURI,
-				PublicAddr: p.leafWSSPublicAddr,
-			},
-		}, extraApps...)
-
-		appServer, err := p.leafCluster.StartApp(laConf)
-		require.NoError(t, err)
-		t.Cleanup(func() { appServer.Close() })
-
-		servers[i] = appServer
-	}
-
-	return servers
-}
-
 var forwardedHeaderNames = []string{
 	teleport.AppJWTHeader,
 	teleport.AppCFHeader,
diff --git a/integration/db_integration_test.go b/integration/db_integration_test.go
index 65c721c7f477e..0c4b6c0133ee5 100644
--- a/integration/db_integration_test.go
+++ b/integration/db_integration_test.go
@@ -31,7 +31,6 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/service"
-	"github.com/gravitational/teleport/lib/srv/db"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/mongodb"
 	"github.com/gravitational/teleport/lib/srv/db/mysql"
@@ -211,61 +210,6 @@ func TestDatabaseAccessMongoRootCluster(t *testing.T) {
 	require.NoError(t, err)
 }
 
-// TestDatabaseAccessMongoConnectionCount tests if mongo service releases
-// resource after a mongo client disconnect.
-func TestDatabaseAccessMongoConnectionCount(t *testing.T) {
-	pack := setupDatabaseTest(t)
-
-	connectMongoClient := func(t *testing.T) (serverConnectionCount int32) {
-		// Connect to the database service in root cluster.
-		client, err := mongodb.MakeTestClient(context.Background(), common.TestClientConfig{
-			AuthClient: pack.root.cluster.GetSiteAPI(pack.root.cluster.Secrets.SiteName),
-			AuthServer: pack.root.cluster.Process.GetAuthServer(),
-			Address:    net.JoinHostPort(Loopback, pack.root.cluster.GetPortWeb()),
-			Cluster:    pack.root.cluster.Secrets.SiteName,
-			Username:   pack.root.user.GetName(),
-			RouteToDatabase: tlsca.RouteToDatabase{
-				ServiceName: pack.root.mongoService.Name,
-				Protocol:    pack.root.mongoService.Protocol,
-				Username:    "admin",
-			},
-		})
-		require.NoError(t, err)
-
-		// Execute a query.
-		_, err = client.Database("test").Collection("test").Find(context.Background(), bson.M{})
-		require.NoError(t, err)
-
-		// Get a server connection count before disconnect.
-		serverConnectionCount = pack.root.mongo.GetActiveConnectionsCount()
-
-		// Disconnect.
-		err = client.Disconnect(context.Background())
-		require.NoError(t, err)
-
-		return serverConnectionCount
-	}
-
-	// Get connection count while the first client is connected.
-	initialConnectionCount := connectMongoClient(t)
-
-	// Check if active connections count is not growing over time when new
-	// clients connect to the mongo server.
-	clientCount := 8
-	for i := 0; i < clientCount; i++ {
-		// Note that connection count per client fluctuates between 6 and 9.
-		// Use InDelta to avoid flaky test.
-		require.InDelta(t, initialConnectionCount, connectMongoClient(t), 3)
-	}
-
-	// Wait until the server reports no more connections. This usually happens
-	// really quick but wait a little longer just in case.
-	waitUntilNoConnections := func() bool {
-		return 0 == pack.root.mongo.GetActiveConnectionsCount()
-	}
-	require.Eventually(t, waitUntilNoConnections, 5*time.Second, 100*time.Millisecond)
-}
-
 // TestDatabaseAccessMongoLeafCluster tests a scenario where a user connects
 // to a Mongo database running in a leaf cluster.
 func TestDatabaseAccessMongoLeafCluster(t *testing.T) {
@@ -443,121 +387,6 @@ func TestDatabaseAccessPostgresSeparateListener(t *testing.T) {
 	require.NoError(t, err)
 }
 
-func init() {
-	// Override database agents shuffle behavior to ensure they're always
-	// tried in the same order during tests. Used for HA tests.
-	db.SetShuffleFunc(db.ShuffleSort)
-}
-
-// TestDatabaseAccessHARootCluster verifies that proxy falls back to a healthy
-// database agent when multiple agents are serving the same database and one
-// of them is down in a root cluster.
-func TestDatabaseAccessHARootCluster(t *testing.T) {
-	pack := setupDatabaseTest(t)
-
-	// Insert a database server entry not backed by an actual running agent
-	// to simulate a scenario when an agent is down but the resource hasn't
-	// expired from the backend yet.
-	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
-		Name: pack.root.postgresService.Name,
-	}, types.DatabaseServerSpecV3{
-		Protocol: defaults.ProtocolPostgres,
-		URI:      pack.root.postgresAddr,
-		// To make sure unhealthy server is always picked in tests first, make
-		// sure its host ID always compares as "smaller" as the tests sort
-		// agents.
-		HostID:   "0000",
-		Hostname: "test",
-	})
-	require.NoError(t, err)
-
-	_, err = pack.root.cluster.Process.GetAuthServer().UpsertDatabaseServer(
-		context.Background(), dbServer)
-	require.NoError(t, err)
-
-	// Connect to the database service in root cluster.
-	client, err := postgres.MakeTestClient(context.Background(), common.TestClientConfig{
-		AuthClient: pack.root.cluster.GetSiteAPI(pack.root.cluster.Secrets.SiteName),
-		AuthServer: pack.root.cluster.Process.GetAuthServer(),
-		Address:    net.JoinHostPort(Loopback, pack.root.cluster.GetPortWeb()),
-		Cluster:    pack.root.cluster.Secrets.SiteName,
-		Username:   pack.root.user.GetName(),
-		RouteToDatabase: tlsca.RouteToDatabase{
-			ServiceName: pack.root.postgresService.Name,
-			Protocol:    pack.root.postgresService.Protocol,
-			Username:    "postgres",
-			Database:    "test",
-		},
-	})
-	require.NoError(t, err)
-
-	// Execute a query.
-	result, err := client.Exec(context.Background(), "select 1").ReadAll()
-	require.NoError(t, err)
-	require.Equal(t, []*pgconn.Result{postgres.TestQueryResponse}, result)
-	require.Equal(t, uint32(1), pack.root.postgres.QueryCount())
-	require.Equal(t, uint32(0), pack.leaf.postgres.QueryCount())
-
-	// Disconnect.
-	err = client.Close(context.Background())
-	require.NoError(t, err)
-}
-
-// TestDatabaseAccessHALeafCluster verifies that proxy falls back to a healthy
-// database agent when multiple agents are serving the same database and one
-// of them is down in a leaf cluster.
-func TestDatabaseAccessHALeafCluster(t *testing.T) {
-	pack := setupDatabaseTest(t)
-	pack.waitForLeaf(t)
-
-	// Insert a database server entry not backed by an actual running agent
-	// to simulate a scenario when an agent is down but the resource hasn't
-	// expired from the backend yet.
-	dbServer, err := types.NewDatabaseServerV3(types.Metadata{
-		Name: pack.leaf.postgresService.Name,
-	}, types.DatabaseServerSpecV3{
-		Protocol: defaults.ProtocolPostgres,
-		URI:      pack.leaf.postgresAddr,
-		// To make sure unhealthy server is always picked in tests first, make
-		// sure its host ID always compares as "smaller" as the tests sort
-		// agents.
-		HostID:   "0000",
-		Hostname: "test",
-	})
-	require.NoError(t, err)
-
-	_, err = pack.leaf.cluster.Process.GetAuthServer().UpsertDatabaseServer(
-		context.Background(), dbServer)
-	require.NoError(t, err)
-
-	// Connect to the database service in leaf cluster via root cluster.
-	client, err := postgres.MakeTestClient(context.Background(), common.TestClientConfig{
-		AuthClient: pack.root.cluster.GetSiteAPI(pack.root.cluster.Secrets.SiteName),
-		AuthServer: pack.root.cluster.Process.GetAuthServer(),
-		Address:    net.JoinHostPort(Loopback, pack.root.cluster.GetPortWeb()), // Connecting via root cluster.
-		Cluster:    pack.leaf.cluster.Secrets.SiteName,
-		Username:   pack.root.user.GetName(),
-		RouteToDatabase: tlsca.RouteToDatabase{
-			ServiceName: pack.leaf.postgresService.Name,
-			Protocol:    pack.leaf.postgresService.Protocol,
-			Username:    "postgres",
-			Database:    "test",
-		},
-	})
-	require.NoError(t, err)
-
-	// Execute a query.
-	result, err := client.Exec(context.Background(), "select 1").ReadAll()
-	require.NoError(t, err)
-	require.Equal(t, []*pgconn.Result{postgres.TestQueryResponse}, result)
-	require.Equal(t, uint32(1), pack.leaf.postgres.QueryCount())
-	require.Equal(t, uint32(0), pack.root.postgres.QueryCount())
-
-	// Disconnect.
-	err = client.Close(context.Background())
-	require.NoError(t, err)
-}
-
 // TestDatabaseAccessMongoSeparateListener tests mongo proxy listener running on separate port.
 func TestDatabaseAccessMongoSeparateListener(t *testing.T) {
 	pack := setupDatabaseTest(t,
@@ -798,7 +627,7 @@ func setupDatabaseTest(t *testing.T, options ...testOptionFunc) *databasePack {
 	p.setupUsersAndRoles(t)
 
 	// Update root's certificate authority on leaf to configure role mapping.
-	ca, err := p.leaf.cluster.Process.GetAuthServer().GetCertAuthority(context.Background(), types.CertAuthID{
+	ca, err := p.leaf.cluster.Process.GetAuthServer().GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: p.root.cluster.Secrets.SiteName,
 	}, false)
diff --git a/integration/helpers.go b/integration/helpers.go
index e7d237cc4fd6a..da8f2ec80980d 100644
--- a/integration/helpers.go
+++ b/integration/helpers.go
@@ -23,6 +23,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"os"
@@ -485,7 +486,7 @@ func GenerateUserCreds(req UserCredsRequest) (*UserCreds, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ca, err := a.GetCertAuthority(context.Background(), types.CertAuthID{
+	ca, err := a.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, false)
@@ -506,7 +507,7 @@ func GenerateUserCreds(req UserCredsRequest) (*UserCreds, error) {
 // GenerateConfig generates instance config
 func (i *TeleInstance) GenerateConfig(t *testing.T, trustedSecrets []*InstanceSecrets, tconf *service.Config) (*service.Config, error) {
 	var err error
-	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -721,7 +722,7 @@ func (i *TeleInstance) StartReverseTunnelNode(tconf *service.Config) (*service.T
 
 // startNode starts a node and connects it to the cluster.
 func (i *TeleInstance) startNode(tconf *service.Config, authPort string) (*service.TeleportProcess, error) {
-	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -775,7 +776,7 @@ func (i *TeleInstance) startNode(tconf *service.Config, authPort string) (*servi
 }
 
 func (i *TeleInstance) StartApp(conf *service.Config) (*service.TeleportProcess, error) {
-	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -820,7 +821,7 @@ func (i *TeleInstance) StartApp(conf *service.Config) (*service.TeleportProcess,
 
 // StartDatabase starts the database access service with the provided config.
 func (i *TeleInstance) StartDatabase(conf *service.Config) (*service.TeleportProcess, *auth.Client, error) {
-	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -885,7 +886,7 @@ func (i *TeleInstance) StartDatabase(conf *service.Config) (*service.TeleportPro
 // StartNodeAndProxy starts a SSH node and a Proxy Server and connects it to
 // the cluster.
 func (i *TeleInstance) StartNodeAndProxy(name string, sshPort, proxyWebPort, proxySSHPort int) error {
-	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName)
+	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -972,7 +973,7 @@ type ProxyConfig struct {
 
 // StartProxy starts another Proxy Server and connects it to the cluster.
 func (i *TeleInstance) StartProxy(cfg ProxyConfig) (reversetunnel.Server, error) {
-	dataDir, err := os.MkdirTemp("", "cluster-"+i.Secrets.SiteName+"-"+cfg.Name)
+	dataDir, err := ioutil.TempDir("", "cluster-"+i.Secrets.SiteName+"-"+cfg.Name)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1191,7 +1192,7 @@ func (i *TeleInstance) NewClientWithCreds(cfg ClientConfig, creds UserCreds) (tc
 // NewUnauthenticatedClient returns a fully configured and pre-authenticated client
 // (pre-authenticated with server CAs and signed session key)
 func (i *TeleInstance) NewUnauthenticatedClient(cfg ClientConfig) (tc *client.TeleportClient, err error) {
-	keyDir, err := os.MkdirTemp(i.Config.DataDir, "tsh")
+	keyDir, err := ioutil.TempDir(i.Config.DataDir, "tsh")
 	if err != nil {
 		return nil, err
 	}
@@ -1623,7 +1624,7 @@ func externalSSHCommand(o commandOptions) (*exec.Cmd, error) {
 // clobber your system agent.
 func createAgent(me *user.User, privateKeyByte []byte, certificateBytes []byte) (*teleagent.AgentServer, string, string, error) {
 	// create a path to the unix socket
-	sockDir, err := os.MkdirTemp("", "int-test")
+	sockDir, err := ioutil.TempDir("", "int-test")
 	if err != nil {
 		return nil, "", "", trace.Wrap(err)
 	}
diff --git a/integration/hsm/hsm_test.go b/integration/hsm/hsm_test.go
index d6b79b765c273..f4695597ab9ae 100644
--- a/integration/hsm/hsm_test.go
+++ b/integration/hsm/hsm_test.go
@@ -167,7 +167,7 @@ func (t *teleportService) waitForLocalAdditionalKeys(ctx context.Context) error
 			return trace.Wrap(ctx.Err(), "timed out waiting for %s to have local additional keys", t.name)
 		case <-time.After(250 * time.Millisecond):
 		}
-		ca, err := t.process.GetAuthServer().GetCertAuthority(ctx, hostCAID, true)
+		ca, err := t.process.GetAuthServer().GetCertAuthority(hostCAID, true)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -357,7 +357,7 @@ func TestHSMRotation(t *testing.T) {
 	teleportServices = append(teleportServices, proxy)
 
 	log.Debug("TestHSMRotation: sending rotation request init")
-	err = auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		Type:        types.HostCA,
 		TargetPhase: types.RotationPhaseInit,
 		Mode:        types.RotationModeManual,
@@ -366,7 +366,7 @@ func TestHSMRotation(t *testing.T) {
 	require.NoError(t, teleportServices.waitForPhaseChange(ctx))
 
 	log.Debug("TestHSMRotation: sending rotation request update_clients")
-	err = auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		Type:        types.HostCA,
 		TargetPhase: types.RotationPhaseUpdateClients,
 		Mode:        types.RotationModeManual,
@@ -375,7 +375,7 @@ func TestHSMRotation(t *testing.T) {
 	require.NoError(t, teleportServices.waitForRestart(ctx))
 
 	log.Debug("TestHSMRotation: sending rotation request update_servers")
-	err = auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		Type:        types.HostCA,
 		TargetPhase: types.RotationPhaseUpdateServers,
 		Mode:        types.RotationModeManual,
@@ -384,7 +384,7 @@ func TestHSMRotation(t *testing.T) {
 	require.NoError(t, teleportServices.waitForRestart(ctx))
 
 	log.Debug("TestHSMRotation: sending rotation request standby")
-	err = auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		Type:        types.HostCA,
 		TargetPhase: types.RotationPhaseStandby,
 		Mode:        types.RotationModeManual,
@@ -542,7 +542,7 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	// do a full rotation
 	for _, stage := range stages {
 		log.Debugf("TestHSMDualAuthRotation: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
@@ -582,7 +582,7 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	// Do another full rotation from the new auth server
 	for _, stage := range stages {
 		log.Debugf("TestHSMDualAuthRotation: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth2.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		require.NoError(t, auth2.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
@@ -697,7 +697,7 @@ func TestHSMDualAuthRotation(t *testing.T) {
 	}
 	for _, stage := range stages {
 		log.Debugf("TestHSMDualAuthRotation: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
@@ -862,7 +862,7 @@ func TestHSMMigrate(t *testing.T) {
 	// do a full rotation
 	for _, stage := range stages {
 		log.Debugf("TestHSMMigrate: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
@@ -890,7 +890,7 @@ func TestHSMMigrate(t *testing.T) {
 	// do a full rotation
 	for _, stage := range stages {
 		log.Debugf("TestHSMMigrate: Sending rotate request %s", stage.targetPhase)
-		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		require.NoError(t, auth1.process.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			Type:        types.HostCA,
 			TargetPhase: stage.targetPhase,
 			Mode:        types.RotationModeManual,
diff --git a/integration/integration_test.go b/integration/integration_test.go
index b41c329b1138d..0937fb7972d1e 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -25,6 +25,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -204,7 +205,6 @@ func TestIntegrations(t *testing.T) {
 	t.Run("TwoClustersTunnel", suite.bind(testTwoClustersTunnel))
 	t.Run("UUIDBasedProxy", suite.bind(testUUIDBasedProxy))
 	t.Run("WindowChange", suite.bind(testWindowChange))
-	t.Run("SSHTracker", suite.bind(testSSHTracker))
 }
 
 // testAuditOn creates a live session, records a bunch of data through it
@@ -607,7 +607,7 @@ func testInteroperability(t *testing.T, suite *integrationTestSuite) {
 			// if we are looking for the output in a file, look in the file
 			// otherwise check stdout and stderr for the expected output
 			if tt.outFile {
-				bytes, err := os.ReadFile(tempfile)
+				bytes, err := ioutil.ReadFile(tempfile)
 				require.NoError(t, err)
 				require.Contains(t, string(bytes), tt.outContains)
 			} else {
@@ -789,38 +789,6 @@ func testUUIDBasedProxy(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 }
 
-// testSSHTracker verifies that an SSH session creates a tracker for sessions.
-func testSSHTracker(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
-	teleport := suite.newTeleport(t, nil, true)
-	defer teleport.StopAll()
-
-	site := teleport.GetSiteAPI(Site)
-	require.NotNil(t, site)
-
-	personA := NewTerminal(250)
-	cl, err := teleport.NewClient(ClientConfig{
-		Login:   suite.me.Username,
-		Cluster: Site,
-		Host:    Host,
-	})
-	require.NoError(t, err)
-	cl.Stdout = personA
-	cl.Stdin = personA
-	personA.Type("\aecho hi\n\r")
-	go cl.SSH(ctx, []string{}, false)
-
-	condition := func() bool {
-		// verify that the tracker was created
-		trackers, err := site.GetActiveSessionTrackers(ctx)
-		require.NoError(t, err)
-		return len(trackers) == 1
-	}
-
-	// wait for the tracker to be created
-	require.Eventually(t, condition, time.Minute, time.Millisecond*100)
-}
-
 // testInteractive covers SSH into shell and joining the same session from another client
 // against a standard teleport node.
 func testInteractiveRegular(t *testing.T, suite *integrationTestSuite) {
@@ -1211,7 +1179,7 @@ func runDisconnectTest(t *testing.T, suite *integrationTestSuite, tc disconnectT
 	teleport := suite.newTeleportInstance()
 
 	username := suite.me.Username
-	role, err := types.NewRoleV3("devs", types.RoleSpecV5{
+	role, err := types.NewRole("devs", types.RoleSpecV5{
 		Options: tc.options,
 		Allow: types.RoleConditions{
 			Logins: []string{username},
@@ -1542,7 +1510,7 @@ func twoClustersTunnel(t *testing.T, suite *integrationTestSuite, now time.Time,
 
 	// The known_hosts file should have two certificates, the way bytes.Split
 	// works that means the output will be 3 (2 certs + 1 empty).
-	buffer, err := os.ReadFile(keypaths.KnownHostsPath(tc.KeysDir))
+	buffer, err := ioutil.ReadFile(keypaths.KnownHostsPath(tc.KeysDir))
 	require.NoError(t, err)
 	parts := bytes.Split(buffer, []byte("\n"))
 	require.Len(t, parts, 3)
@@ -1553,7 +1521,7 @@ func twoClustersTunnel(t *testing.T, suite *integrationTestSuite, now time.Time,
 		if info.IsDir() {
 			return nil
 		}
-		buffer, err = os.ReadFile(path)
+		buffer, err = ioutil.ReadFile(path)
 		require.NoError(t, err)
 		ok := roots.AppendCertsFromPEM(buffer)
 		require.True(t, ok)
@@ -1773,7 +1741,7 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) {
 
 	// main cluster has a local user and belongs to role "main-devs"
 	mainDevs := "main-devs"
-	role, err := types.NewRoleV3(mainDevs, types.RoleSpecV5{
+	role, err := types.NewRole(mainDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -1801,7 +1769,7 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "devs" to local role "local-devs"
 	auxDevs := "aux-devs"
-	role, err = types.NewRoleV3(auxDevs, types.RoleSpecV5{
+	role, err = types.NewRole(auxDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -1937,28 +1905,28 @@ func testMapRoles(t *testing.T, suite *integrationTestSuite) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			cid := types.CertAuthID{Type: types.UserCA, DomainName: tt.mainClusterName}
-			mainUserCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(ctx, cid, true)
+			mainUserCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(cid, true)
 			tt.outChkMainUserCA(t, err)
 			if err == nil {
 				tt.outChkMainUserCAPrivateKey(t, mainUserCAs.GetActiveKeys().SSH[0].PrivateKey)
 			}
 
 			cid = types.CertAuthID{Type: types.HostCA, DomainName: tt.mainClusterName}
-			mainHostCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(ctx, cid, true)
+			mainHostCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(cid, true)
 			tt.outChkMainHostCA(t, err)
 			if err == nil {
 				tt.outChkMainHostCAPrivateKey(t, mainHostCAs.GetActiveKeys().SSH[0].PrivateKey)
 			}
 
 			cid = types.CertAuthID{Type: types.UserCA, DomainName: tt.auxClusterName}
-			auxUserCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(ctx, cid, true)
+			auxUserCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(cid, true)
 			tt.outChkAuxUserCA(t, err)
 			if err == nil {
 				tt.outChkAuxUserCAPrivateKey(t, auxUserCAs.GetActiveKeys().SSH[0].PrivateKey)
 			}
 
 			cid = types.CertAuthID{Type: types.HostCA, DomainName: tt.auxClusterName}
-			auxHostCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(ctx, cid, true)
+			auxHostCAs, err := tt.inCluster.Process.GetAuthServer().GetCertAuthority(cid, true)
 			tt.outChkAuxHostCA(t, err)
 			if err == nil {
 				tt.outChkAuxHostCAPrivateKey(t, auxHostCAs.GetActiveKeys().SSH[0].PrivateKey)
@@ -2083,7 +2051,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 
 	// main cluster has a local user and belongs to role "main-devs" and "main-admins"
 	mainDevs := "main-devs"
-	devsRole, err := types.NewRoleV3(mainDevs, types.RoleSpecV5{
+	devsRole, err := types.NewRole(mainDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -2098,7 +2066,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 	require.NoError(t, err)
 
 	mainAdmins := "main-admins"
-	adminsRole, err := types.NewRoleV3(mainAdmins, types.RoleSpecV5{
+	adminsRole, err := types.NewRole(mainAdmins, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{"superuser"},
 		},
@@ -2109,7 +2077,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 
 	// Ops users can only access remote clusters with label 'access': 'ops'
 	mainOps := "main-ops"
-	mainOpsRole, err := types.NewRoleV3(mainOps, types.RoleSpecV5{
+	mainOpsRole, err := types.NewRole(mainOps, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:        []string{username},
 			ClusterLabels: types.Labels{"access": []string{"ops"}},
@@ -2138,7 +2106,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "devs" to local role "local-devs"
 	auxDevs := "aux-devs"
-	auxRole, err := types.NewRoleV3(auxDevs, types.RoleSpecV5{
+	auxRole, err := types.NewRole(auxDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -2240,7 +2208,7 @@ func trustedClusters(t *testing.T, suite *integrationTestSuite, test trustedClus
 
 	// ListNodes expect labels as a value of host
 	tc.Host = ""
-	servers, err := tc.ListNodesWithFilters(ctx)
+	servers, err := tc.ListNodes(ctx)
 	require.NoError(t, err)
 	require.Len(t, servers, 2)
 	tc.Host = Loopback
@@ -2330,7 +2298,7 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 
 	// main cluster has a local user and belongs to role "main-devs"
 	mainDevs := "main-devs"
-	role, err := types.NewRoleV3(mainDevs, types.RoleSpecV5{
+	role, err := types.NewRole(mainDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -2358,7 +2326,7 @@ func testTrustedTunnelNode(t *testing.T, suite *integrationTestSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "devs" to local role "local-devs"
 	auxDevs := "aux-devs"
-	role, err = types.NewRoleV3(auxDevs, types.RoleSpecV5{
+	role, err = types.NewRole(auxDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -3075,6 +3043,7 @@ func waitForNodeCount(ctx context.Context, t *TeleInstance, clusterName string,
 			return nil
 		}
 		return trace.BadParameter("did not find %v nodes", count)
+
 	})
 	if err != nil {
 		return trace.Wrap(err)
@@ -3252,7 +3221,7 @@ func testControlMaster(t *testing.T, suite *integrationTestSuite) {
 	}
 
 	for _, tt := range tests {
-		controlDir, err := os.MkdirTemp("", "teleport-")
+		controlDir, err := ioutil.TempDir("", "teleport-")
 		require.NoError(t, err)
 		defer os.RemoveAll(controlDir)
 		controlPath := filepath.Join(controlDir, "control-path")
@@ -3710,13 +3679,13 @@ func testRotateSuccess(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service started. Setting rotation state to %v", types.RotationPhaseUpdateClients)
 
 	// start rotation
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseInit,
 		Mode:        types.RotationModeManual,
 	})
 	require.NoError(t, err)
 
-	hostCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
+	hostCA, err := svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
 	require.NoError(t, err)
 	t.Logf("Cert authority: %v", auth.CertAuthorityInfo(hostCA))
 
@@ -3725,7 +3694,7 @@ func testRotateSuccess(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 
 	// update clients
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateClients,
 		Mode:        types.RotationModeManual,
 	})
@@ -3752,13 +3721,13 @@ func testRotateSuccess(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %v", types.RotationPhaseUpdateServers)
 
 	// move to the next phase
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateServers,
 		Mode:        types.RotationModeManual,
 	})
 	require.NoError(t, err)
 
-	hostCA, err = svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
+	hostCA, err = svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
 	require.NoError(t, err)
 	t.Logf("Cert authority: %v", auth.CertAuthorityInfo(hostCA))
 
@@ -3781,13 +3750,13 @@ func testRotateSuccess(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %v.", types.RotationPhaseStandby)
 
 	// complete rotation
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseStandby,
 		Mode:        types.RotationModeManual,
 	})
 	require.NoError(t, err)
 
-	hostCA, err = svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
+	hostCA, err = svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
 	require.NoError(t, err)
 	t.Logf("Cert authority: %v", auth.CertAuthorityInfo(hostCA))
 
@@ -3859,7 +3828,7 @@ func testRotateRollback(t *testing.T, s *integrationTestSuite) {
 	t.Logf("Service started. Setting rotation state to %q.", types.RotationPhaseInit)
 
 	// start rotation
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseInit,
 		Mode:        types.RotationModeManual,
 	})
@@ -3871,7 +3840,7 @@ func testRotateRollback(t *testing.T, s *integrationTestSuite) {
 	t.Logf("Setting rotation state to %q.", types.RotationPhaseUpdateClients)
 
 	// start rotation
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateClients,
 		Mode:        types.RotationModeManual,
 	})
@@ -3897,7 +3866,7 @@ func testRotateRollback(t *testing.T, s *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %q.", types.RotationPhaseUpdateServers)
 
 	// move to the next phase
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateServers,
 		Mode:        types.RotationModeManual,
 	})
@@ -3910,7 +3879,7 @@ func testRotateRollback(t *testing.T, s *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %q.", types.RotationPhaseRollback)
 
 	// complete rotation
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseRollback,
 		Mode:        types.RotationModeManual,
 	})
@@ -3978,7 +3947,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 
 	// main cluster has a local user and belongs to role "main-devs"
 	mainDevs := "main-devs"
-	role, err := types.NewRoleV3(mainDevs, types.RoleSpecV5{
+	role, err := types.NewRole(mainDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{suite.me.Username},
 		},
@@ -3996,7 +3965,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "devs" to local role "local-devs"
 	auxDevs := "aux-devs"
-	role, err = types.NewRoleV3(auxDevs, types.RoleSpecV5{
+	role, err = types.NewRole(auxDevs, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{suite.me.Username},
 		},
@@ -4043,7 +4012,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Setting rotation state to %v", types.RotationPhaseInit)
 
 	// start rotation
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseInit,
 		Mode:        types.RotationModeManual,
 	})
@@ -4094,7 +4063,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	require.NoError(t, err)
 
 	// update clients
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateClients,
 		Mode:        types.RotationModeManual,
 	})
@@ -4114,7 +4083,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %v", types.RotationPhaseUpdateServers)
 
 	// move to the next phase
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseUpdateServers,
 		Mode:        types.RotationModeManual,
 	})
@@ -4141,7 +4110,7 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	t.Logf("Service reloaded. Setting rotation state to %v.", types.RotationPhaseStandby)
 
 	// complete rotation
-	err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+	err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 		TargetPhase: types.RotationPhaseStandby,
 		Mode:        types.RotationModeManual,
 	})
@@ -4179,7 +4148,6 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 // TestRotateChangeSigningAlg tests the change of CA signing algorithm on
 // manual rotation.
 func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
 	// Start with an instance using default signing alg.
 	tconf := suite.rotationConfig(true)
 	teleport := suite.newTeleportInstance()
@@ -4228,18 +4196,18 @@ func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
 	}
 
 	assertSigningAlg := func(svc *service.TeleportProcess, alg string) {
-		hostCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
+		hostCA, err := svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
 		require.NoError(t, err)
 		require.Equal(t, alg, sshutils.GetSigningAlgName(hostCA))
 
-		userCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.UserCA, DomainName: Site}, false)
+		userCA, err := svc.GetAuthServer().GetCertAuthority(types.CertAuthID{Type: types.UserCA, DomainName: Site}, false)
 		require.NoError(t, err)
 		require.Equal(t, alg, sshutils.GetSigningAlgName(userCA))
 	}
 
 	rotate := func(svc *service.TeleportProcess, mode string) *service.TeleportProcess {
 		t.Logf("Rotation phase: %q.", types.RotationPhaseInit)
-		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			TargetPhase: types.RotationPhaseInit,
 			Mode:        mode,
 		})
@@ -4250,7 +4218,7 @@ func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
 		require.NoError(t, err)
 
 		t.Logf("Rotation phase: %q.", types.RotationPhaseUpdateClients)
-		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			TargetPhase: types.RotationPhaseUpdateClients,
 			Mode:        mode,
 		})
@@ -4261,7 +4229,7 @@ func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
 		require.NoError(t, err)
 
 		t.Logf("Rotation phase: %q.", types.RotationPhaseUpdateServers)
-		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			TargetPhase: types.RotationPhaseUpdateServers,
 			Mode:        mode,
 		})
@@ -4272,7 +4240,7 @@ func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
 		require.NoError(t, err)
 
 		t.Logf("rotation phase: %q", types.RotationPhaseStandby)
-		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
+		err = svc.GetAuthServer().RotateCertAuthority(auth.RotateRequest{
 			TargetPhase: types.RotationPhaseStandby,
 			Mode:        mode,
 		})
@@ -4651,7 +4619,7 @@ func testList(t *testing.T, suite *integrationTestSuite) {
 	for _, tt := range tests {
 		t.Run(tt.inRoleName, func(t *testing.T) {
 			// Create role with logins and labels for this test.
-			role, err := types.NewRoleV3(tt.inRoleName, types.RoleSpecV5{
+			role, err := types.NewRole(tt.inRoleName, types.RoleSpecV5{
 				Allow: types.RoleConditions{
 					Logins:     []string{tt.inLogin},
 					NodeLabels: tt.inLabels,
@@ -4676,7 +4644,7 @@ func testList(t *testing.T, suite *integrationTestSuite) {
 
 			// Get list of nodes and check that the returned nodes match the
 			// expected nodes.
-			nodes, err := userClt.ListNodesWithFilters(context.Background())
+			nodes, err := userClt.ListNodes(context.Background())
 			require.NoError(t, err)
 			for _, node := range nodes {
 				ok := apiutils.SliceContainsStr(tt.outNodes, node.GetHostname())
@@ -5057,7 +5025,7 @@ func testSSHExitCode(t *testing.T, suite *integrationTestSuite) {
 	lsPath, err := exec.LookPath("ls")
 	require.NoError(t, err)
 
-	tests := []struct {
+	var tests = []struct {
 		desc           string
 		command        []string
 		input          string
@@ -5384,7 +5352,7 @@ func testSessionStartContainsAccessRequest(t *testing.T, suite *integrationTestS
 	authServer := main.Process.GetAuthServer()
 
 	// Create new request role
-	requestedRole, err := types.NewRoleV3(requestedRoleName, types.RoleSpecV5{
+	requestedRole, err := types.NewRole(requestedRoleName, types.RoleSpecV5{
 		Options: types.RoleOptions{},
 		Allow:   types.RoleConditions{},
 	})
@@ -5394,7 +5362,7 @@ func testSessionStartContainsAccessRequest(t *testing.T, suite *integrationTestS
 	require.NoError(t, err)
 
 	// Create user role with ability to request role
-	userRole, err := types.NewRoleV3(userRoleName, types.RoleSpecV5{
+	userRole, err := types.NewRole(userRoleName, types.RoleSpecV5{
 		Options: types.RoleOptions{},
 		Allow: types.RoleConditions{
 			Logins: []string{
@@ -5865,7 +5833,7 @@ func TestTraitsPropagation(t *testing.T) {
 	})
 
 	// Update root's certificate authority on leaf to configure role mapping.
-	ca, err := lc.Process.GetAuthServer().GetCertAuthority(context.Background(), types.CertAuthID{
+	ca, err := lc.Process.GetAuthServer().GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: rc.Secrets.SiteName,
 	}, false)
diff --git a/integration/kube_integration_test.go b/integration/kube_integration_test.go
index 2bcbae0519380..cc9292677ad42 100644
--- a/integration/kube_integration_test.go
+++ b/integration/kube_integration_test.go
@@ -23,6 +23,7 @@ import (
 	"crypto/x509"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -181,7 +182,7 @@ func testKubeExec(t *testing.T, suite *KubeSuite) {
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
 	kubeUsers := []string{"alice@example.com"}
-	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: kubeGroups,
@@ -350,7 +351,7 @@ func testKubeDeny(t *testing.T, suite *KubeSuite) {
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
 	kubeUsers := []string{"alice@example.com"}
-	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: kubeGroups,
@@ -401,7 +402,7 @@ func testKubePortForward(t *testing.T, suite *KubeSuite) {
 
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
-	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: kubeGroups,
@@ -497,7 +498,7 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
 	// main cluster has a role and user called main-kube
 	username := suite.me.Username
 	mainKubeGroups := []string{testImpersonationGroup}
-	mainRole, err := types.NewRoleV3("main-kube", types.RoleSpecV5{
+	mainRole, err := types.NewRole("main-kube", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: mainKubeGroups,
@@ -532,7 +533,7 @@ func testKubeTrustedClustersClientCert(t *testing.T, suite *KubeSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "aux-kube" to local role "main-kube"
 	auxKubeGroups := []string{teleport.TraitInternalKubeGroupsVariable}
-	auxRole, err := types.NewRoleV3("aux-kube", types.RoleSpecV5{
+	auxRole, err := types.NewRole("aux-kube", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 			// Note that main cluster can pass it's kubernetes groups
@@ -748,7 +749,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 	// main cluster has a role and user called main-kube
 	username := suite.me.Username
 	mainKubeGroups := []string{testImpersonationGroup}
-	mainRole, err := types.NewRoleV3("main-kube", types.RoleSpecV5{
+	mainRole, err := types.NewRole("main-kube", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: mainKubeGroups,
@@ -787,7 +788,7 @@ func testKubeTrustedClustersSNI(t *testing.T, suite *KubeSuite) {
 	// using trusted clusters, so remote user will be allowed to assume
 	// role specified by mapping remote role "aux-kube" to local role "main-kube"
 	auxKubeGroups := []string{teleport.TraitInternalKubeGroupsVariable}
-	auxRole, err := types.NewRoleV3("aux-kube", types.RoleSpecV5{
+	auxRole, err := types.NewRole("aux-kube", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 			// Note that main cluster can pass it's kubernetes groups
@@ -1022,7 +1023,7 @@ func runKubeDisconnectTest(t *testing.T, suite *KubeSuite, tc disconnectTestCase
 
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
-	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
 		Options: tc.options,
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
@@ -1108,7 +1109,7 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) {
 
 	username := suite.me.Username
 	kubeGroups := []string{testImpersonationGroup}
-	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{username},
 			KubeGroups: kubeGroups,
@@ -1280,7 +1281,7 @@ func kubeProxyClient(cfg kubeProxyConfig) (*kubernetes.Clientset, *rest.Config,
 	}
 	ttl := roles.AdjustSessionTTL(10 * time.Minute)
 
-	ca, err := authServer.GetCertAuthority(context.Background(), types.CertAuthID{
+	ca, err := authServer.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
@@ -1451,7 +1452,7 @@ func kubeExec(kubeConfig *rest.Config, args kubeExecArgs) error {
 	// stderr channel is only set if there is no tty allocated
 	// otherwise k8s server gets confused
 	if !args.tty && args.stderr == nil {
-		args.stderr = io.Discard
+		args.stderr = ioutil.Discard
 	}
 	if args.stderr != nil && !args.tty {
 		query.Set("stderr", "true")
@@ -1522,7 +1523,7 @@ func testKubeJoin(t *testing.T, suite *KubeSuite) {
 	participantUsername := suite.me.Username + "-participant"
 	kubeGroups := []string{testImpersonationGroup}
 	kubeUsers := []string{"alice@example.com"}
-	role, err := types.NewRoleV3("kubemaster", types.RoleSpecV5{
+	role, err := types.NewRole("kubemaster", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     []string{hostUsername},
 			KubeGroups: kubeGroups,
diff --git a/integration/proxy_helpers_test.go b/integration/proxy_helpers_test.go
index 9614826355ad8..bffe58e25c180 100644
--- a/integration/proxy_helpers_test.go
+++ b/integration/proxy_helpers_test.go
@@ -277,7 +277,7 @@ func withLeafClusterPorts(ports *InstancePorts) proxySuiteOptionsFunc {
 }
 
 func newRole(t *testing.T, roleName string, username string) types.Role {
-	role, err := types.NewRoleV3(roleName, types.RoleSpecV5{
+	role, err := types.NewRole(roleName, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{username},
 		},
@@ -338,7 +338,7 @@ func withStandardRoleMapping() proxySuiteOptionsFunc {
 			rc := suite.root
 			lc := suite.leaf
 			role := suite.root.Secrets.Users[mustGetCurrentUser(t).Username].Roles[0]
-			ca, err := lc.Process.GetAuthServer().GetCertAuthority(context.Background(), types.CertAuthID{
+			ca, err := lc.Process.GetAuthServer().GetCertAuthority(types.CertAuthID{
 				Type:       types.UserCA,
 				DomainName: rc.Secrets.SiteName,
 			}, false)
@@ -509,7 +509,7 @@ func mustCreateUserIdentityFile(t *testing.T, tc *TeleInstance, username string)
 	key.Cert = sshCert
 	key.TLSCert = tlsCert
 
-	hostCAs, err := tc.Process.GetAuthServer().GetCertAuthorities(context.Background(), types.HostCA, false)
+	hostCAs, err := tc.Process.GetAuthServer().GetCertAuthorities(types.HostCA, false)
 	require.NoError(t, err)
 	key.TrustedCA = auth.AuthoritiesToTrustedCerts(hostCAs)
 
diff --git a/integration/proxy_test.go b/integration/proxy_test.go
index 87516fae4feea..e45126e01b684 100644
--- a/integration/proxy_test.go
+++ b/integration/proxy_test.go
@@ -254,7 +254,7 @@ func TestALPNSNIProxyKube(t *testing.T) {
 			KubeUsers:  []string{k8User},
 		},
 	}
-	kubeRole, err := types.NewRoleV3(k8RoleName, kubeRoleSpec)
+	kubeRole, err := types.NewRole(k8RoleName, kubeRoleSpec)
 	require.NoError(t, err)
 
 	suite := newProxySuite(t,
@@ -306,7 +306,7 @@ func TestALPNSNIProxyKubeV2Leaf(t *testing.T) {
 			KubeUsers:  []string{k8User},
 		},
 	}
-	kubeRole, err := types.NewRoleV3(k8RoleName, kubeRoleSpec)
+	kubeRole, err := types.NewRole(k8RoleName, kubeRoleSpec)
 	require.NoError(t, err)
 
 	suite := newProxySuite(t,
diff --git a/lib/asciitable/table.go b/lib/asciitable/table.go
index 16c1d0f916975..c7f705f51741e 100644
--- a/lib/asciitable/table.go
+++ b/lib/asciitable/table.go
@@ -21,11 +21,8 @@ package asciitable
 import (
 	"bytes"
 	"fmt"
-	"os"
 	"strings"
 	"text/tabwriter"
-
-	"golang.org/x/term"
 )
 
 // Column represents a column in the table.
@@ -53,68 +50,13 @@ func MakeHeadlessTable(columnCount int) Table {
 	}
 }
 
-// MakeTable creates a new instance of the table with given column
-// names. Optionally rows to be added to the table may be included.
-func MakeTable(headers []string, rows ...[]string) Table {
+// MakeTable creates a new instance of the table with given column names.
+func MakeTable(headers []string) Table {
 	t := MakeHeadlessTable(len(headers))
 	for i := range t.columns {
 		t.columns[i].Title = headers[i]
 		t.columns[i].width = len(headers[i])
 	}
-	for _, row := range rows {
-		t.AddRow(row)
-	}
-	return t
-}
-
-// MakeTableWithTruncatedColumn creates a table where the column
-// matching truncatedColumn will be shortened to account for terminal
-// width.
-func MakeTableWithTruncatedColumn(columnOrder []string, rows [][]string, truncatedColumn string) Table {
-	width, _, err := term.GetSize(int(os.Stdin.Fd()))
-	if err != nil {
-		width = 80
-	}
-	truncatedColMinSize := 16
-	maxColWidth := (width - truncatedColMinSize) / (len(columnOrder) - 1)
-	t := MakeTable([]string{})
-	totalLen := 0
-	columns := []Column{}
-
-	for collIndex, colName := range columnOrder {
-		column := Column{
-			Title:         colName,
-			MaxCellLength: len(colName),
-		}
-		if colName == truncatedColumn { // truncated column is handled separately in next loop
-			columns = append(columns, column)
-			continue
-		}
-		for _, row := range rows {
-			cellLen := row[collIndex]
-			if len(cellLen) > column.MaxCellLength {
-				column.MaxCellLength = len(cellLen)
-			}
-		}
-		if column.MaxCellLength > maxColWidth {
-			column.MaxCellLength = maxColWidth
-			totalLen += column.MaxCellLength + 4 // "...<space>"
-		} else {
-			totalLen += column.MaxCellLength + 1 // +1 for column separator
-		}
-		columns = append(columns, column)
-	}
-
-	for _, column := range columns {
-		if column.Title == truncatedColumn {
-			column.MaxCellLength = width - totalLen - len("... ")
-		}
-		t.AddColumn(column)
-	}
-
-	for _, row := range rows {
-		t.AddRow(row)
-	}
 	return t
 }
 
diff --git a/lib/asciitable/table_test.go b/lib/asciitable/table_test.go
index ee482af693ab4..96c7f0ddf95c4 100644
--- a/lib/asciitable/table_test.go
+++ b/lib/asciitable/table_test.go
@@ -80,55 +80,3 @@ func TestTruncatedTable(t *testing.T) {
 
 	require.Equal(t, truncatedTable, table.AsBuffer().String())
 }
-
-func TestMakeTableWithTruncatedColumn(t *testing.T) {
-	// os.Stdin.Fd() fails during go test, so width is defaulted to 80
-	columns := []string{"column1", "column2", "column3"}
-	rows := [][]string{{strings.Repeat("cell1", 6), strings.Repeat("cell2", 6), strings.Repeat("cell3", 6)}}
-
-	testCases := []struct {
-		truncatedColumn string
-		expectedWidth   int
-		expectedOutput  []string
-	}{
-		{
-			truncatedColumn: "column2",
-			expectedWidth:   80,
-			expectedOutput: []string{
-				"column1                        column2           column3                        ",
-				"------------------------------ ----------------- ------------------------------ ",
-				"cell1cell1cell1cell1cell1cell1 cell2cell2cell... cell3cell3cell3cell3cell3cell3 ",
-				"",
-			},
-		},
-		{
-			truncatedColumn: "column3",
-			expectedWidth:   80,
-			expectedOutput: []string{
-				"column1                        column2                        column3           ",
-				"------------------------------ ------------------------------ ----------------- ",
-				"cell1cell1cell1cell1cell1cell1 cell2cell2cell2cell2cell2cell2 cell3cell3cell... ",
-				"",
-			},
-		},
-		{
-			truncatedColumn: "no column match",
-			expectedWidth:   93,
-			expectedOutput: []string{
-				"column1                        column2                        column3                        ",
-				"------------------------------ ------------------------------ ------------------------------ ",
-				"cell1cell1cell1cell1cell1cell1 cell2cell2cell2cell2cell2cell2 cell3cell3cell3cell3cell3cell3 ",
-				"",
-			},
-		},
-	}
-	for _, testCase := range testCases {
-		t.Run(testCase.truncatedColumn, func(t *testing.T) {
-			table := MakeTableWithTruncatedColumn(columns, rows, testCase.truncatedColumn)
-			rows := strings.Split(table.AsBuffer().String(), "\n")
-			require.Len(t, rows, 4)
-			require.Len(t, rows[2], testCase.expectedWidth)
-			require.Equal(t, testCase.expectedOutput, rows)
-		})
-	}
-}
diff --git a/lib/auth/access.go b/lib/auth/access.go
index d80d4df4d0cce..2ec036cfe102b 100644
--- a/lib/auth/access.go
+++ b/lib/auth/access.go
@@ -66,7 +66,7 @@ func (a *Server) DeleteRole(ctx context.Context, name string) error {
 	}
 	// check if it's used by some external cert authorities, e.g.
 	// cert authorities related to external cluster
-	cas, err := a.Trust.GetCertAuthorities(ctx, types.UserCA, false)
+	cas, err := a.Trust.GetCertAuthorities(types.UserCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/auth/access_test.go b/lib/auth/access_test.go
index 07312080313c7..071ca60201631 100644
--- a/lib/auth/access_test.go
+++ b/lib/auth/access_test.go
@@ -35,7 +35,7 @@ func TestUpsertDeleteRoleEventsEmitted(t *testing.T) {
 	require.NoError(t, err)
 
 	// test create new role
-	role, err := types.NewRoleV3("test-role", types.RoleSpecV5{
+	role, err := types.NewRole("test-role", types.RoleSpecV5{
 		Options: types.RoleOptions{},
 		Allow:   types.RoleConditions{},
 	})
diff --git a/lib/auth/accountrecovery.go b/lib/auth/accountrecovery.go
index 4549177934806..8a75c7725970d 100644
--- a/lib/auth/accountrecovery.go
+++ b/lib/auth/accountrecovery.go
@@ -260,8 +260,7 @@ func (s *Server) VerifyAccountRecovery(ctx context.Context, req *proto.VerifyAcc
 		}
 
 		if err := s.verifyAuthnWithRecoveryLock(ctx, startToken, func() error {
-			_, _, err := s.validateMFAAuthResponse(
-				ctx, req.GetMFAAuthenticateResponse(), startToken.GetUser(), false /* passwordless */)
+			_, err := s.validateMFAAuthResponse(ctx, startToken.GetUser(), req.GetMFAAuthenticateResponse())
 			return err
 		}); err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/auth/accountrecovery_test.go b/lib/auth/accountrecovery_test.go
index 2801ade330e36..6f3cf858e537b 100644
--- a/lib/auth/accountrecovery_test.go
+++ b/lib/auth/accountrecovery_test.go
@@ -1291,7 +1291,7 @@ func TestGetAccountRecoveryCodes(t *testing.T) {
 
 func triggerLoginLock(t *testing.T, srv *Server, username string) {
 	for i := 1; i <= defaults.MaxLoginAttempts; i++ {
-		_, _, err := srv.authenticateUser(context.Background(), AuthenticateUserRequest{
+		_, err := srv.authenticateUser(context.Background(), AuthenticateUserRequest{
 			Username: username,
 			OTP:      &OTPCreds{},
 		})
diff --git a/lib/auth/api.go b/lib/auth/api.go
index fd3a4a2041010..21ae421ac4366 100644
--- a/lib/auth/api.go
+++ b/lib/auth/api.go
@@ -104,10 +104,10 @@ type ReadNodeAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -162,10 +162,10 @@ type ReadProxyAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -293,10 +293,10 @@ type ReadRemoteProxyAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -389,10 +389,10 @@ type ReadKubernetesAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -450,10 +450,10 @@ type ReadAppsAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -517,10 +517,10 @@ type ReadDatabaseAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -584,10 +584,10 @@ type ReadWindowsDesktopAccessPoint interface {
 	NewWatcher(ctx context.Context, watch types.Watch) (types.Watcher, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterName gets the name of the cluster from the backend.
 	GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error)
@@ -642,10 +642,10 @@ type WindowsDesktopAccessPoint interface {
 // AccessCache is a subset of the interface working on the certificate authorities
 type AccessCache interface {
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterAuditConfig returns cluster audit configuration.
 	GetClusterAuditConfig(ctx context.Context, opts ...services.MarshalOption) (types.ClusterAuditConfig, error)
@@ -709,10 +709,10 @@ type Cache interface {
 	GetAuthServers() ([]types.Server, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetUser returns a services.User for this cluster.
 	GetUser(name string, withSecrets bool) (types.User, error)
@@ -809,8 +809,6 @@ type Cache interface {
 
 	// ListResources returns a paginated list of resources.
 	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
-	// ListWindowsDesktops returns a paginated list of windows desktops.
-	ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error)
 }
 
 type NodeWrapper struct {
diff --git a/lib/auth/apiserver.go b/lib/auth/apiserver.go
index d9ee0df2029ad..a817888340efc 100644
--- a/lib/auth/apiserver.go
+++ b/lib/auth/apiserver.go
@@ -22,6 +22,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -969,7 +970,10 @@ func (s *APIServer) registerUsingToken(auth ClientI, w http.ResponseWriter, r *h
 		return nil, trace.Wrap(err)
 	}
 
-	return certs, nil
+	// Teleport 8 clients are still expecting the legacy JSON format.
+	// Teleport 9 clients handle both legacy and new.
+	// TODO(zmb3) return certs directly in Teleport 10
+	return LegacyCertsFromProto(certs), nil
 }
 
 type registerNewAuthServerReq struct {
@@ -993,7 +997,7 @@ func (s *APIServer) rotateCertAuthority(auth ClientI, w http.ResponseWriter, r *
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := auth.RotateCertAuthority(r.Context(), req); err != nil {
+	if err := auth.RotateCertAuthority(req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return message("ok"), nil
@@ -1038,7 +1042,7 @@ func (s *APIServer) rotateExternalCertAuthority(auth ClientI, w http.ResponseWri
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := auth.RotateExternalCertAuthority(r.Context(), ca); err != nil {
+	if err := auth.RotateExternalCertAuthority(ca); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return message("ok"), nil
@@ -1049,7 +1053,7 @@ func (s *APIServer) getCertAuthorities(auth ClientI, w http.ResponseWriter, r *h
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	certs, err := auth.GetCertAuthorities(r.Context(), types.CertAuthType(p.ByName("type")), loadKeys)
+	certs, err := auth.GetCertAuthorities(types.CertAuthType(p.ByName("type")), loadKeys)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1073,7 +1077,7 @@ func (s *APIServer) getCertAuthority(auth ClientI, w http.ResponseWriter, r *htt
 		Type:       types.CertAuthType(p.ByName("type")),
 		DomainName: p.ByName("domain"),
 	}
-	ca, err := auth.GetCertAuthority(r.Context(), id, loadKeys)
+	ca, err := auth.GetCertAuthority(id, loadKeys)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1825,7 +1829,7 @@ func (s *APIServer) emitAuditEvent(auth ClientI, w http.ResponseWriter, r *http.
 
 // HTTP POST /:version/sessions/:id/slice
 func (s *APIServer) postSessionSlice(auth ClientI, w http.ResponseWriter, r *http.Request, p httprouter.Params, version string) (interface{}, error) {
-	data, err := io.ReadAll(r.Body)
+	data, err := ioutil.ReadAll(r.Body)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/auth.go b/lib/auth/auth.go
index 575c116029d6e..3709a85be4ed4 100644
--- a/lib/auth/auth.go
+++ b/lib/auth/auth.go
@@ -422,7 +422,7 @@ func (a *Server) runPeriodicOperations() {
 		case <-a.closeCtx.Done():
 			return
 		case <-ticker.Chan():
-			err := a.autoRotateCertAuthorities(ctx)
+			err := a.autoRotateCertAuthorities()
 			if err != nil {
 				if trace.IsCompareFailed(err) {
 					log.Debugf("Cert authority has been updated concurrently: %v.", err)
@@ -629,7 +629,7 @@ func (a *Server) GetClusterCACert() (*LocalCAResponse, error) {
 		return nil, trace.Wrap(err)
 	}
 	// Extract the TLS CA for this cluster.
-	hostCA, err := a.GetCache().GetCertAuthority(context.TODO(), types.CertAuthID{
+	hostCA, err := a.GetCache().GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, false)
@@ -656,7 +656,7 @@ func (a *Server) GenerateHostCert(hostPublicKey []byte, hostID, nodeName string,
 	}
 
 	// get the certificate authority that will be signing the public key of the host
-	ca, err := a.Trust.GetCertAuthority(context.TODO(), types.CertAuthID{
+	ca, err := a.Trust.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: domainName,
 	}, true)
@@ -938,14 +938,13 @@ func (a *Server) GenerateDatabaseTestCert(req DatabaseTestCertRequest) ([]byte,
 
 // generateUserCert generates user certificates
 func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
-	ctx := context.TODO()
 	err := req.check()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	// Reject the cert request if there is a matching lock in force.
-	authPref, err := a.GetAuthPreference(ctx)
+	authPref, err := a.GetAuthPreference(context.TODO())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1030,7 +1029,7 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
 		}
 	}
 
-	userCA, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
+	userCA, err := a.Trust.GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: clusterName,
 	}, true)
@@ -1063,7 +1062,6 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
 		DisallowReissue:       req.disallowReissue,
 		Renewable:             req.renewable,
 		Generation:            req.generation,
-		CertificateExtensions: req.checker.CertificateExtensions(),
 	}
 	sshCert, err := a.Authority.GenerateUserCert(params)
 	if err != nil {
@@ -1184,7 +1182,7 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
 
 	// also include host CA certs if requested
 	if req.includeHostCA {
-		hostCA, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
+		hostCA, err := a.Trust.GetCertAuthority(types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName,
 		}, false)
@@ -1309,7 +1307,6 @@ func (a *Server) PreAuthenticatedSignIn(user string, identity tlsca.Identity) (t
 // CreateAuthenticateChallenge implements AuthService.CreateAuthenticateChallenge.
 func (a *Server) CreateAuthenticateChallenge(ctx context.Context, req *proto.CreateAuthenticateChallengeRequest) (*proto.MFAAuthenticateChallenge, error) {
 	var username string
-	var passwordless bool
 
 	switch req.GetRequest().(type) {
 	case *proto.CreateAuthenticateChallengeRequest_UserCredentials:
@@ -1334,10 +1331,7 @@ func (a *Server) CreateAuthenticateChallenge(ctx context.Context, req *proto.Cre
 
 		username = token.GetUser()
 
-	case *proto.CreateAuthenticateChallengeRequest_Passwordless:
-		passwordless = true // Allows empty username.
-
-	default: // unset or CreateAuthenticateChallengeRequest_ContextUser.
+	default:
 		var err error
 		username, err = GetClientUsername(ctx)
 		if err != nil {
@@ -1345,7 +1339,7 @@ func (a *Server) CreateAuthenticateChallenge(ctx context.Context, req *proto.Cre
 		}
 	}
 
-	challenges, err := a.mfaAuthChallenge(ctx, username, passwordless)
+	challenges, err := a.mfaAuthChallenge(ctx, username)
 	if err != nil {
 		log.Error(trace.DebugReport(err))
 		return nil, trace.AccessDenied("unable to create MFA challenges")
@@ -1374,19 +1368,17 @@ func (a *Server) CreateRegisterChallenge(ctx context.Context, req *proto.CreateR
 	}
 
 	regChal, err := a.createRegisterChallenge(ctx, &newRegisterChallengeRequest{
-		username:    token.GetUser(),
-		token:       token,
-		deviceType:  req.GetDeviceType(),
-		deviceUsage: req.GetDeviceUsage(),
+		username:   token.GetUser(),
+		token:      token,
+		deviceType: req.GetDeviceType(),
 	})
 
 	return regChal, trace.Wrap(err)
 }
 
 type newRegisterChallengeRequest struct {
-	username    string
-	deviceType  proto.DeviceType
-	deviceUsage proto.DeviceUsage
+	username   string
+	deviceType proto.DeviceType
 
 	// token is a user token resource.
 	// It is used as following:
@@ -1455,8 +1447,7 @@ func (a *Server) createRegisterChallenge(ctx context.Context, req *newRegisterCh
 			Identity: identity,
 		}
 
-		passwordless := req.deviceUsage == proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS
-		credentialCreation, err := webRegistration.Begin(ctx, req.username, passwordless)
+		credentialCreation, err := webRegistration.Begin(ctx, req.username, false /* passwordless */)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -2062,7 +2053,7 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 	if req.NoCache {
 		client = a.Services
 	}
-	ca, err := client.GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := client.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
@@ -2076,7 +2067,7 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 	// to the backend, which is a fine tradeoff
 	if !req.NoCache && req.Rotation != nil && !req.Rotation.Matches(ca.GetRotation()) {
 		log.Debugf("Client sent rotation state %v, cache state is %v, using state from the DB.", req.Rotation, ca.GetRotation())
-		ca, err = a.GetCertAuthority(ctx, types.CertAuthID{
+		ca, err = a.GetCertAuthority(types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName.GetClusterName(),
 		}, true)
@@ -2154,11 +2145,11 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 		NotAfter:  a.clock.Now().UTC().Add(defaults.CATTL),
 		DNSNames:  append([]string{}, req.AdditionalPrincipals...),
 	}
-
 	// API requests need to specify a DNS name, which must be present in the certificate's DNS Names.
 	// The target DNS is not always known in advance so we add a default one to all certificates.
-	certRequest.DNSNames = append(certRequest.DNSNames, DefaultDNSNamesForRole(req.Role)...)
-
+	if (types.SystemRoles{req.Role}).IncludeAny(types.RoleAuth, types.RoleAdmin, types.RoleProxy, types.RoleKube, types.RoleApp) {
+		certRequest.DNSNames = append(certRequest.DNSNames, "*."+constants.APIDomain, constants.APIDomain)
+	}
 	// Unlike additional principals, DNS Names is x509 specific and is limited
 	// to services with TLS endpoints (e.g. auth, proxies, kubernetes)
 	if (types.SystemRoles{req.Role}).IncludeAny(types.RoleAuth, types.RoleAdmin, types.RoleProxy, types.RoleKube, types.RoleWindowsDesktop) {
@@ -2586,14 +2577,14 @@ func (a *Server) NewKeepAliver(ctx context.Context) (types.KeepAliver, error) {
 
 // GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
 // controls if signing keys are loaded
-func (a *Server) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
-	return a.GetCache().GetCertAuthority(ctx, id, loadSigningKeys, opts...)
+func (a *Server) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+	return a.GetCache().GetCertAuthority(id, loadSigningKeys, opts...)
 }
 
 // GetCertAuthorities returns a list of authorities of a given type
 // loadSigningKeys controls whether signing keys should be loaded or not
-func (a *Server) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
-	return a.GetCache().GetCertAuthorities(ctx, caType, loadSigningKeys, opts...)
+func (a *Server) GetCertAuthorities(caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+	return a.GetCache().GetCertAuthorities(caType, loadSigningKeys, opts...)
 }
 
 // GenerateCertAuthorityCRL generates an empty CRL for the local CA of a given type.
@@ -2603,7 +2594,7 @@ func (a *Server) GenerateCertAuthorityCRL(ctx context.Context, caType types.Cert
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ca, err := a.GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := a.GetCertAuthority(types.CertAuthID{
 		Type:       caType,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
@@ -2717,31 +2708,9 @@ type ResourcePageFunc func(next []types.ResourceWithLabels) (stop bool, err erro
 // IterateResourcePages can be used to iterate over pages of resources.
 func (a *Server) IterateResourcePages(ctx context.Context, req proto.ListResourcesRequest, f ResourcePageFunc) (*types.ListResourcesResponse, error) {
 	for {
-		var resp *types.ListResourcesResponse
-		switch {
-		case req.ResourceType == types.KindWindowsDesktop:
-			wResp, err := a.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
-				WindowsDesktopFilter: req.WindowsDesktopFilter,
-				Limit:                int(req.Limit),
-				StartKey:             req.StartKey,
-				PredicateExpression:  req.PredicateExpression,
-				Labels:               req.Labels,
-				SearchKeywords:       req.SearchKeywords,
-				SortBy:               req.SortBy,
-			})
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			resp = &types.ListResourcesResponse{
-				Resources: types.WindowsDesktops(wResp.Desktops).AsResources(),
-				NextKey:   wResp.NextKey,
-			}
-		default:
-			dResp, err := a.ListResources(ctx, req)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			resp = dResp
+		resp, err := a.ListResources(ctx, req)
+		if err != nil {
+			return nil, trace.Wrap(err)
 		}
 
 		stop, err := f(resp.Resources)
@@ -3034,16 +3003,11 @@ func (a *Server) GetDatabase(ctx context.Context, name string) (types.Database,
 	return a.GetCache().GetDatabase(ctx, name)
 }
 
-// ListResources returns paginated resources depending on the resource type..
+// GetDatabases returns all database resources.
 func (a *Server) ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
 	return a.GetCache().ListResources(ctx, req)
 }
 
-// ListWindowsDesktops returns paginated windows desktops.
-func (a *Server) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
-	return a.GetCache().ListWindowsDesktops(ctx, req)
-}
-
 // GetLock gets a lock by name from the auth server's cache.
 func (a *Server) GetLock(ctx context.Context, name string) (types.Lock, error) {
 	return a.GetCache().GetLock(ctx, name)
@@ -3220,7 +3184,7 @@ func (a *Server) isMFARequired(ctx context.Context, checker services.AccessCheck
 
 // mfaAuthChallenge constructs an MFAAuthenticateChallenge for all MFA devices
 // registered by the user.
-func (a *Server) mfaAuthChallenge(ctx context.Context, user string, passwordless bool) (*proto.MFAAuthenticateChallenge, error) {
+func (a *Server) mfaAuthChallenge(ctx context.Context, user string) (*proto.MFAAuthenticateChallenge, error) {
 	// Check what kind of MFA is enabled.
 	apref, err := a.GetAuthPreference(ctx)
 	if err != nil {
@@ -3248,42 +3212,16 @@ func (a *Server) mfaAuthChallenge(ctx context.Context, user string, passwordless
 		webConfig = val
 	}
 
-	// Handle passwordless separately, it works differently from MFA.
-	if passwordless {
-		if !enableWebauthn {
-			return nil, trace.BadParameter("passwordless requires WebAuthn")
-		}
-		webLogin := &wanlib.PasswordlessFlow{
-			Webauthn: webConfig,
-			Identity: a.Identity,
-		}
-		assertion, err := webLogin.Begin(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return &proto.MFAAuthenticateChallenge{
-			WebauthnChallenge: wanlib.CredentialAssertionToProto(assertion),
-		}, nil
-	}
-
-	// User required for non-passwordless.
-	if user == "" {
-		return nil, trace.BadParameter("user required")
-	}
-
-	devs, err := a.Identity.GetMFADevices(ctx, user, true /* withSecrets */)
+	devs, err := a.Identity.GetMFADevices(ctx, user, true)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+
 	groupedDevs := groupByDeviceType(devs, enableWebauthn)
 	challenge := &proto.MFAAuthenticateChallenge{}
-
-	// TOTP challenge.
 	if enableTOTP && groupedDevs.TOTP {
 		challenge.TOTP = &proto.TOTPChallenge{}
 	}
-
-	// WebAuthn challenge.
 	if len(groupedDevs.Webauthn) > 0 {
 		webLogin := &wanlib.LoginFlow{
 			U2F:      u2fPref,
@@ -3326,63 +3264,32 @@ func groupByDeviceType(devs []*types.MFADevice, groupWebauthn bool) devicesByTyp
 	return res
 }
 
-// validateMFAAuthResponse validates an MFA or passwordless challenge.
-// Returns the device used to solve the challenge (if applicable) and the
-// username.
-func (a *Server) validateMFAAuthResponse(
-	ctx context.Context,
-	resp *proto.MFAAuthenticateResponse, user string, passwordless bool) (*types.MFADevice, string, error) {
-	// Sanity check user/passwordless.
-	if user == "" && !passwordless {
-		return nil, "", trace.BadParameter("user required")
-	}
-
+func (a *Server) validateMFAAuthResponse(ctx context.Context, user string, resp *proto.MFAAuthenticateResponse) (*types.MFADevice, error) {
 	switch res := resp.Response.(type) {
-	// cases in order of preference
+	case *proto.MFAAuthenticateResponse_TOTP:
+		return a.checkOTP(user, res.TOTP.Code)
 	case *proto.MFAAuthenticateResponse_Webauthn:
-		// Read necessary configurations.
 		cap, err := a.GetAuthPreference(ctx)
 		if err != nil {
-			return nil, "", trace.Wrap(err)
-		}
-		u2f, err := cap.GetU2F()
-		switch {
-		case trace.IsNotFound(err): // OK, may happen.
-		case err != nil: // Unexpected.
-			return nil, "", trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
+		u2f, _ := cap.GetU2F()
 		webConfig, err := cap.GetWebauthn()
 		if err != nil {
-			return nil, "", trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
-
-		assertionResp := wanlib.CredentialAssertionResponseFromProto(res.Webauthn)
-		var dev *types.MFADevice
-		if passwordless {
-			webLogin := &wanlib.PasswordlessFlow{
-				Webauthn: webConfig,
-				Identity: a.Identity,
-			}
-			dev, user, err = webLogin.Finish(ctx, assertionResp)
-		} else {
-			webLogin := &wanlib.LoginFlow{
-				U2F:      u2f,
-				Webauthn: webConfig,
-				Identity: a.Identity,
-			}
-			dev, err = webLogin.Finish(ctx, user, wanlib.CredentialAssertionResponseFromProto(res.Webauthn))
+		webLogin := &wanlib.LoginFlow{
+			U2F:      u2f,
+			Webauthn: webConfig,
+			Identity: a.Identity,
 		}
+		dev, err := webLogin.Finish(ctx, user, wanlib.CredentialAssertionResponseFromProto(res.Webauthn))
 		if err != nil {
-			return nil, "", trace.AccessDenied("MFA response validation failed: %v", err)
+			return nil, trace.AccessDenied("MFA response validation failed: %v", err)
 		}
-		return dev, user, nil
-
-	case *proto.MFAAuthenticateResponse_TOTP:
-		dev, err := a.checkOTP(user, res.TOTP.Code)
-		return dev, user, trace.Wrap(err)
-
+		return dev, nil
 	default:
-		return nil, "", trace.BadParameter("unknown or missing MFAAuthenticateResponse type %T", resp.Response)
+		return nil, trace.BadParameter("unknown or missing MFAAuthenticateResponse type %T", resp.Response)
 	}
 }
 
@@ -3436,7 +3343,6 @@ func mergeKeySets(a, b types.CAKeySet) types.CAKeySet {
 // addAdditionalTrustedKeysAtomic performs an atomic CompareAndSwap to update
 // the given CA with newKeys added to the AdditionalTrustedKeys
 func (a *Server) addAddtionalTrustedKeysAtomic(
-	ctx context.Context,
 	currentCA types.CertAuthority,
 	newKeys types.CAKeySet,
 	needsUpdate func(types.CertAuthority) bool) error {
@@ -3467,7 +3373,7 @@ func (a *Server) addAddtionalTrustedKeysAtomic(
 		}
 		// else trace.IsCompareFailed(err) == true (CA was concurrently updated)
 
-		currentCA, err = a.Trust.GetCertAuthority(ctx, currentCA.GetID(), true)
+		currentCA, err = a.Trust.GetCertAuthority(currentCA.GetID(), true)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -3502,7 +3408,7 @@ func newKeySet(keyStore keystore.KeyStore, caID types.CertAuthID) (types.CAKeySe
 
 // ensureLocalAdditionalKeys adds additional trusted keys to the CA if they are not
 // already present.
-func (a *Server) ensureLocalAdditionalKeys(ctx context.Context, ca types.CertAuthority) error {
+func (a *Server) ensureLocalAdditionalKeys(ca types.CertAuthority) error {
 	if a.keyStore.HasLocalAdditionalKeys(ca) {
 		// nothing to do
 		return nil
@@ -3513,7 +3419,7 @@ func (a *Server) ensureLocalAdditionalKeys(ctx context.Context, ca types.CertAut
 		return trace.Wrap(err)
 	}
 
-	err = a.addAddtionalTrustedKeysAtomic(ctx, ca, newKeySet, func(ca types.CertAuthority) bool {
+	err = a.addAddtionalTrustedKeysAtomic(ca, newKeySet, func(ca types.CertAuthority) bool {
 		return !a.keyStore.HasLocalAdditionalKeys(ca)
 	})
 	if err != nil {
@@ -3551,7 +3457,7 @@ func (a *Server) createSelfSignedCA(caID types.CertAuthID) error {
 
 // deleteUnusedKeys deletes all teleport keys held in a connected HSM for this
 // auth server which are not currently used in any CAs.
-func (a *Server) deleteUnusedKeys(ctx context.Context) error {
+func (a *Server) deleteUnusedKeys() error {
 	clusterName, err := a.GetClusterName()
 	if err != nil {
 		return trace.Wrap(err)
@@ -3560,7 +3466,7 @@ func (a *Server) deleteUnusedKeys(ctx context.Context) error {
 	var usedKeys [][]byte
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
 		caID := types.CertAuthID{Type: caType, DomainName: clusterName.GetClusterName()}
-		ca, err := a.Trust.GetCertAuthority(ctx, caID, true)
+		ca, err := a.Trust.GetCertAuthority(caID, true)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -3794,14 +3700,3 @@ func WithClusterCAs(tlsConfig *tls.Config, ap AccessCache, currentClusterName st
 		return tlsCopy, nil
 	}
 }
-
-// DefaultDNSNamesForRole returns default DNS names for the specified role.
-func DefaultDNSNamesForRole(role types.SystemRole) []string {
-	if (types.SystemRoles{role}).IncludeAny(types.RoleAuth, types.RoleAdmin, types.RoleProxy, types.RoleKube, types.RoleApp, types.RoleDatabase, types.RoleWindowsDesktop) {
-		return []string{
-			"*." + constants.APIDomain,
-			constants.APIDomain,
-		}
-	}
-	return nil
-}
diff --git a/lib/auth/auth_login_test.go b/lib/auth/auth_login_test.go
index 84944ed8219b3..e17e1b79d8f8c 100644
--- a/lib/auth/auth_login_test.go
+++ b/lib/auth/auth_login_test.go
@@ -22,12 +22,10 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/mocku2f"
+	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
-
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 )
 
 func TestServer_CreateAuthenticateChallenge_authPreference(t *testing.T) {
@@ -158,8 +156,7 @@ func TestServer_CreateAuthenticateChallenge_authPreference(t *testing.T) {
 					UserCredentials: &proto.UserCredentials{
 						Username: username,
 						Password: []byte(password),
-					},
-				},
+					}},
 			})
 			require.NoError(t, err)
 			test.assertChallenge(challenge)
@@ -167,6 +164,85 @@ func TestServer_CreateAuthenticateChallenge_authPreference(t *testing.T) {
 	}
 }
 
+// sshPubKey is a randomly-generated public key used for login tests.
+//
+// The corresponding private key is:
+// -----BEGIN PRIVATE KEY-----
+// MHcCAQEEIAKuZeB4WL4KAl5cnCrMYBy3kAX9qHt/g6OAbGGd7f3VoAoGCCqGSM49
+// AwEHoUQDQgAEa/6A3YLbc/TyJ4lED2BT8iThuw6HcrDX3dRixwkPDjWYBOP4qrJ/
+// jlGaPwXyuzeLuZgpFde7UiM1EHM2ClfGpw==
+// -----END PRIVATE KEY-----
+const sshPubKey = `ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGv+gN2C23P08ieJRA9gU/Ik4bsOh3Kw193UYscJDw41mATj+Kqyf45Rmj8F8rs3i7mYKRXXu1IjNRBzNgpXxqc=`
+
+func TestServer_AuthenticateUser_mfaDevices(t *testing.T) {
+	t.Parallel()
+
+	svr := newTestTLSServer(t)
+	authServer := svr.Auth()
+	mfa := configureForMFA(t, svr)
+	username := mfa.User
+	password := mfa.Password
+
+	tests := []struct {
+		name           string
+		solveChallenge func(*proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error)
+	}{
+		{name: "OK TOTP device", solveChallenge: mfa.TOTPDev.SolveAuthn},
+		{name: "OK Webauthn device", solveChallenge: mfa.WebDev.SolveAuthn},
+	}
+	for _, test := range tests {
+		test := test
+		// makeRun is used to test both SSH and Web login by switching the
+		// authenticate function.
+		makeRun := func(authenticate func(*Server, AuthenticateUserRequest) error) func(t *testing.T) {
+			return func(t *testing.T) {
+				// 1st step: acquire challenge
+				challenge, err := authServer.CreateAuthenticateChallenge(context.Background(), &proto.CreateAuthenticateChallengeRequest{
+					Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{UserCredentials: &proto.UserCredentials{
+						Username: username,
+						Password: []byte(password),
+					}},
+				})
+				require.NoError(t, err)
+
+				// Solve challenge (client-side)
+				resp, err := test.solveChallenge(challenge)
+				authReq := AuthenticateUserRequest{
+					Username: username,
+				}
+				require.NoError(t, err)
+
+				switch {
+				case resp.GetWebauthn() != nil:
+					authReq.Webauthn = wanlib.CredentialAssertionResponseFromProto(resp.GetWebauthn())
+				case resp.GetTOTP() != nil:
+					authReq.OTP = &OTPCreds{
+						Password: []byte(password),
+						Token:    resp.GetTOTP().Code,
+					}
+				default:
+					t.Fatalf("Unexpected solved challenge type: %T", resp.Response)
+				}
+
+				// 2nd step: finish login - either SSH or Web
+				require.NoError(t, authenticate(authServer, authReq))
+			}
+		}
+		t.Run(test.name+"/ssh", makeRun(func(s *Server, req AuthenticateUserRequest) error {
+			_, err := s.AuthenticateSSHUser(AuthenticateSSHRequest{
+				AuthenticateUserRequest: req,
+				PublicKey:               []byte(sshPubKey),
+				TTL:                     24 * time.Hour,
+			})
+			return err
+		}))
+		t.Run(test.name+"/web", makeRun(func(s *Server, req AuthenticateUserRequest) error {
+			_, err := s.AuthenticateWebUser(req)
+			return err
+		}))
+	}
+}
+
 func TestCreateAuthenticateChallenge_WithAuth(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
@@ -185,7 +261,7 @@ func TestCreateAuthenticateChallenge_WithAuth(t *testing.T) {
 	// TODO(codingllama): Use a public endpoint to verify?
 	mfaResp, err := u.webDev.SolveAuthn(res)
 	require.NoError(t, err)
-	_, _, err = srv.Auth().validateMFAAuthResponse(ctx, mfaResp, u.username, false /* passwordless */)
+	_, err = srv.Auth().validateMFAAuthResponse(ctx, u.username, mfaResp)
 	require.NoError(t, err)
 }
 
@@ -400,310 +476,6 @@ func TestCreateRegisterChallenge(t *testing.T) {
 	}
 }
 
-// sshPubKey is a randomly-generated public key used for login tests.
-//
-// The corresponding private key is:
-// -----BEGIN PRIVATE KEY-----
-// MHcCAQEEIAKuZeB4WL4KAl5cnCrMYBy3kAX9qHt/g6OAbGGd7f3VoAoGCCqGSM49
-// AwEHoUQDQgAEa/6A3YLbc/TyJ4lED2BT8iThuw6HcrDX3dRixwkPDjWYBOP4qrJ/
-// jlGaPwXyuzeLuZgpFde7UiM1EHM2ClfGpw==
-// -----END PRIVATE KEY-----
-const sshPubKey = `ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGv+gN2C23P08ieJRA9gU/Ik4bsOh3Kw193UYscJDw41mATj+Kqyf45Rmj8F8rs3i7mYKRXXu1IjNRBzNgpXxqc=`
-
-func TestServer_AuthenticateUser_mfaDevices(t *testing.T) {
-	t.Parallel()
-
-	svr := newTestTLSServer(t)
-	authServer := svr.Auth()
-	mfa := configureForMFA(t, svr)
-	username := mfa.User
-	password := mfa.Password
-
-	tests := []struct {
-		name           string
-		solveChallenge func(*proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error)
-	}{
-		{name: "OK TOTP device", solveChallenge: mfa.TOTPDev.SolveAuthn},
-		{name: "OK Webauthn device", solveChallenge: mfa.WebDev.SolveAuthn},
-	}
-	for _, test := range tests {
-		test := test
-		// makeRun is used to test both SSH and Web login by switching the
-		// authenticate function.
-		makeRun := func(authenticate func(*Server, AuthenticateUserRequest) error) func(t *testing.T) {
-			return func(t *testing.T) {
-				// 1st step: acquire challenge
-				challenge, err := authServer.CreateAuthenticateChallenge(context.Background(), &proto.CreateAuthenticateChallengeRequest{
-					Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{UserCredentials: &proto.UserCredentials{
-						Username: username,
-						Password: []byte(password),
-					}},
-				})
-				require.NoError(t, err)
-
-				// Solve challenge (client-side)
-				resp, err := test.solveChallenge(challenge)
-				authReq := AuthenticateUserRequest{
-					Username: username,
-				}
-				require.NoError(t, err)
-
-				switch {
-				case resp.GetWebauthn() != nil:
-					authReq.Webauthn = wanlib.CredentialAssertionResponseFromProto(resp.GetWebauthn())
-				case resp.GetTOTP() != nil:
-					authReq.OTP = &OTPCreds{
-						Password: []byte(password),
-						Token:    resp.GetTOTP().Code,
-					}
-				default:
-					t.Fatalf("Unexpected solved challenge type: %T", resp.Response)
-				}
-
-				// 2nd step: finish login - either SSH or Web
-				require.NoError(t, authenticate(authServer, authReq))
-			}
-		}
-		t.Run(test.name+"/ssh", makeRun(func(s *Server, req AuthenticateUserRequest) error {
-			_, err := s.AuthenticateSSHUser(AuthenticateSSHRequest{
-				AuthenticateUserRequest: req,
-				PublicKey:               []byte(sshPubKey),
-				TTL:                     24 * time.Hour,
-			})
-			return err
-		}))
-		t.Run(test.name+"/web", makeRun(func(s *Server, req AuthenticateUserRequest) error {
-			_, err := s.AuthenticateWebUser(req)
-			return err
-		}))
-	}
-}
-
-func TestServer_Authenticate_passwordless(t *testing.T) {
-	t.Parallel()
-	svr := newTestTLSServer(t)
-	authServer := svr.Auth()
-
-	// Configure Auth separately, we want a passwordless-capable device
-	// registered too.
-	ctx := context.Background()
-	authPreference, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
-		Type:         constants.Local,
-		SecondFactor: constants.SecondFactorOptional,
-		Webauthn: &types.Webauthn{
-			RPID: "localhost",
-		},
-	})
-	require.NoError(t, err)
-	require.NoError(t, authServer.SetAuthPreference(ctx, authPreference))
-
-	// Create user and initial WebAuthn device (MFA).
-	const user = "llama"
-	const password = "p@ssw0rd"
-	_, _, err = CreateUserAndRole(authServer, user, []string{"llama", "root"})
-	require.NoError(t, err)
-	require.NoError(t, authServer.UpsertPassword(user, []byte(password)))
-	userClient, err := svr.NewClient(TestUser(user))
-	require.NoError(t, err)
-	webDev, err := RegisterTestDevice(
-		ctx, userClient, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
-	require.NoError(t, err)
-
-	// Acquire a privilege token so we can register a passwordless device
-	// synchronously.
-	mfaChallenge, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
-		Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
-			ContextUser: &proto.ContextUser{}, // already authenticated
-		},
-	})
-	require.NoError(t, err)
-	mfaResp, err := webDev.SolveAuthn(mfaChallenge)
-	require.NoError(t, err)
-	token, err := userClient.CreatePrivilegeToken(ctx, &proto.CreatePrivilegeTokenRequest{
-		ExistingMFAResponse: mfaResp,
-	})
-	require.NoError(t, err)
-
-	// Register passwordless device.
-	registerChallenge, err := userClient.CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
-		TokenID:     token.GetName(),
-		DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
-		DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
-	})
-	require.NoError(t, err, "Failed to create passwordless registration challenge")
-	pwdKey, err := mocku2f.Create()
-	require.NoError(t, err)
-	pwdKey.SetPasswordless()
-	const origin = "https://localhost"
-	ccr, err := pwdKey.SignCredentialCreation(origin, wanlib.CredentialCreationFromProto(registerChallenge.GetWebauthn()))
-	require.NoError(t, err)
-	_, err = userClient.AddMFADeviceSync(ctx, &proto.AddMFADeviceSyncRequest{
-		TokenID:       token.GetName(),
-		NewDeviceName: "pwdless1",
-		NewMFAResponse: &proto.MFARegisterResponse{
-			Response: &proto.MFARegisterResponse_Webauthn{
-				Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
-			},
-		},
-	})
-	require.NoError(t, err, "Failed to register passwordless device")
-
-	// userWebID is what identifies the user for usernameless/passwordless.
-	userWebID := registerChallenge.GetWebauthn().PublicKey.User.Id
-
-	// Use a proxy client for now on; the user's identity isn't established yet.
-	proxyClient, err := svr.NewClient(TestBuiltin(types.RoleProxy))
-	require.NoError(t, err)
-
-	tests := []struct {
-		name         string
-		authenticate func(t *testing.T, resp *wanlib.CredentialAssertionResponse)
-	}{
-		{
-			name: "ssh",
-			authenticate: func(t *testing.T, resp *wanlib.CredentialAssertionResponse) {
-				loginResp, err := proxyClient.AuthenticateSSHUser(AuthenticateSSHRequest{
-					AuthenticateUserRequest: AuthenticateUserRequest{
-						Webauthn: resp,
-					},
-					PublicKey: []byte(sshPubKey),
-					TTL:       24 * time.Hour,
-				})
-				require.NoError(t, err, "Failed to perform passwordless authentication")
-				require.NotNil(t, loginResp, "SSH response nil")
-				require.NotEmpty(t, loginResp.Cert, "SSH certificate empty")
-				require.Equal(t, user, loginResp.Username, "Unexpected username")
-			},
-		},
-		{
-			name: "web",
-			authenticate: func(t *testing.T, resp *wanlib.CredentialAssertionResponse) {
-				session, err := proxyClient.AuthenticateWebUser(AuthenticateUserRequest{
-					Webauthn: resp,
-				})
-				require.NoError(t, err, "Failed to perform passwordless authentication")
-				require.Equal(t, user, session.GetUser(), "Unexpected username")
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			// Fail a login attempt so have a non-empty list of attempts.
-			_, err := proxyClient.AuthenticateSSHUser(AuthenticateSSHRequest{
-				AuthenticateUserRequest: AuthenticateUserRequest{
-					Username: user,
-					Webauthn: &wanlib.CredentialAssertionResponse{}, // bad response
-				},
-				PublicKey: []byte(sshPubKey),
-				TTL:       24 * time.Hour,
-			})
-			require.True(t, trace.IsAccessDenied(err), "got err = %v, want AccessDenied")
-			attempts, err := authServer.GetUserLoginAttempts(user)
-			require.NoError(t, err)
-			require.NotEmpty(t, attempts, "Want at least one failed login attempt")
-
-			// Create a passwordless challenge.
-			mfaChallenge, err := proxyClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
-				Request: &proto.CreateAuthenticateChallengeRequest_Passwordless{
-					Passwordless: &proto.Passwordless{},
-				},
-			})
-			require.NoError(t, err, "Failed to create passwordless challenge")
-
-			// Sign challenge (mocks user interaction).
-			assertionResp, err := pwdKey.SignAssertion(origin, wanlib.CredentialAssertionFromProto(mfaChallenge.GetWebauthnChallenge()))
-			require.NoError(t, err)
-			assertionResp.AssertionResponse.UserHandle = userWebID // identify user, a real device would set this
-
-			// Complete login procedure (SSH or Web).
-			test.authenticate(t, assertionResp)
-
-			// Verify zeroed login attempts. This is a proxy for various other user
-			// checks (locked, etc).
-			attempts, err = authServer.GetUserLoginAttempts(user)
-			require.NoError(t, err)
-			require.Empty(t, attempts, "Login attempts not reset")
-		})
-	}
-}
-
-func TestServer_Authenticate_nonPasswordlessRequiresUsername(t *testing.T) {
-	t.Parallel()
-	svr := newTestTLSServer(t)
-
-	// We don't mind about the specifics of the configuration, as long as we have
-	// a user and TOTP/WebAuthn devices.
-	mfa := configureForMFA(t, svr)
-	username := mfa.User
-	password := mfa.Password
-
-	userClient, err := svr.NewClient(TestUser(username))
-	require.NoError(t, err)
-	proxyClient, err := svr.NewClient(TestBuiltin(types.RoleProxy))
-	require.NoError(t, err)
-
-	ctx := context.Background()
-	tests := []struct {
-		name    string
-		dev     *TestDevice
-		wantErr string
-	}{
-		{
-			name:    "OTP",
-			dev:     mfa.TOTPDev,
-			wantErr: "username", // Error contains "username"
-		},
-		{
-			name:    "WebAuthn",
-			dev:     mfa.WebDev,
-			wantErr: "invalid Webauthn response", // generic error as it _could_ be a passwordless attempt
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			mfaChallenge, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
-				Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
-					ContextUser: &proto.ContextUser{},
-				},
-			})
-			require.NoError(t, err)
-
-			mfaResp, err := test.dev.SolveAuthn(mfaChallenge)
-			require.NoError(t, err)
-
-			var req AuthenticateUserRequest
-			switch {
-			case mfaResp.GetWebauthn() != nil:
-				req.Webauthn = wanlib.CredentialAssertionResponseFromProto(mfaResp.GetWebauthn())
-			case mfaResp.GetTOTP() != nil:
-				req.OTP = &OTPCreds{
-					Password: []byte(password),
-					Token:    mfaResp.GetTOTP().Code,
-				}
-			}
-
-			// SSH.
-			_, err = proxyClient.AuthenticateSSHUser(AuthenticateSSHRequest{
-				AuthenticateUserRequest: req,
-				PublicKey:               []byte(sshPubKey),
-				TTL:                     24 * time.Hour,
-			})
-			require.Error(t, err, "SSH authentication expected fail (missing username)")
-			require.Contains(t, err.Error(), test.wantErr)
-
-			// Web.
-			_, err = proxyClient.AuthenticateWebUser(req)
-			require.Error(t, err, "Web authentication expected fail (missing username)")
-			require.Contains(t, err.Error(), test.wantErr)
-
-			// Get one right so we don't lock the user between tests.
-			req.Username = username
-			_, err = proxyClient.AuthenticateWebUser(req)
-			require.NoError(t, err, "Web authentication expected to succeed")
-		})
-	}
-}
-
 type configureMFAResp struct {
 	User, Password  string
 	TOTPDev, WebDev *TestDevice
diff --git a/lib/auth/auth_test.go b/lib/auth/auth_test.go
index 08b7d2813712f..077e08b01eb5f 100644
--- a/lib/auth/auth_test.go
+++ b/lib/auth/auth_test.go
@@ -1030,44 +1030,6 @@ func TestEmitSSOLoginFailureEvent(t *testing.T) {
 	})
 }
 
-func TestGenerateUserCertWithCertExtension(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	p, err := newTestPack(ctx, t.TempDir())
-	require.NoError(t, err)
-
-	user, role, err := CreateUserAndRole(p.a, "test-user", []string{})
-	require.NoError(t, err)
-
-	extension := types.CertExtension{
-		Name:  "abc",
-		Value: "cde",
-		Type:  types.CertExtensionType_SSH,
-		Mode:  types.CertExtensionMode_EXTENSION,
-	}
-	options := role.GetOptions()
-	options.CertExtensions = []*types.CertExtension{&extension}
-	role.SetOptions(options)
-
-	keygen := testauthority.New()
-	_, pub, err := keygen.GetNewKeyPairFromPool()
-	require.NoError(t, err)
-	certReq := certRequest{
-		user:      user,
-		checker:   services.NewRoleSet(role),
-		publicKey: pub,
-	}
-	certs, err := p.a.generateUserCert(certReq)
-	require.NoError(t, err)
-
-	key, err := sshutils.ParseCertificate(certs.SSH)
-	require.NoError(t, err)
-
-	val, ok := key.Extensions[extension.Name]
-	require.True(t, ok)
-	require.Equal(t, extension.Value, val)
-}
-
 func TestGenerateUserCertWithLocks(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
diff --git a/lib/auth/auth_with_roles.go b/lib/auth/auth_with_roles.go
index b173dd0eebba8..2396c4c8b6003 100644
--- a/lib/auth/auth_with_roles.go
+++ b/lib/auth/auth_with_roles.go
@@ -95,6 +95,23 @@ func (a *ServerWithRoles) withOptions(opts ...actionOption) actionConfig {
 	return cfg
 }
 
+func (a *ServerWithRoles) withStaticRoles() (actionConfig, error) {
+	user, err := a.authServer.GetUser(a.context.User.GetName(), false)
+	if err != nil {
+		return actionConfig{}, trace.Wrap(err)
+	}
+
+	checker, err := services.FetchRoles(user.GetRoles(), a.authServer, user.GetTraits())
+	if err != nil {
+		return actionConfig{}, trace.Wrap(err)
+	}
+
+	return actionConfig{context: Context{
+		User:    user,
+		Checker: checker,
+	}}, nil
+}
+
 func (c actionConfig) action(namespace, resource string, verbs ...string) error {
 	if len(verbs) == 0 {
 		return trace.BadParameter("no verbs provided for authorization check on resource %q", resource)
@@ -383,28 +400,28 @@ func (a *ServerWithRoles) CreateCertAuthority(ca types.CertAuthority) error {
 }
 
 // RotateCertAuthority starts or restarts certificate authority rotation process.
-func (a *ServerWithRoles) RotateCertAuthority(ctx context.Context, req RotateRequest) error {
+func (a *ServerWithRoles) RotateCertAuthority(req RotateRequest) error {
 	if err := req.CheckAndSetDefaults(a.authServer.clock); err != nil {
 		return trace.Wrap(err)
 	}
 	if err := a.action(apidefaults.Namespace, types.KindCertAuthority, types.VerbCreate, types.VerbUpdate); err != nil {
 		return trace.Wrap(err)
 	}
-	return a.authServer.RotateCertAuthority(ctx, req)
+	return a.authServer.RotateCertAuthority(req)
 }
 
 // RotateExternalCertAuthority rotates external certificate authority,
 // this method is called by a remote trusted cluster and is used to update
 // only public keys and certificates of the certificate authority.
-func (a *ServerWithRoles) RotateExternalCertAuthority(ctx context.Context, ca types.CertAuthority) error {
+func (a *ServerWithRoles) RotateExternalCertAuthority(ca types.CertAuthority) error {
 	if ca == nil {
 		return trace.BadParameter("missing certificate authority")
 	}
-	sctx := &services.Context{User: a.context.User, Resource: ca}
-	if err := a.actionWithContext(sctx, apidefaults.Namespace, types.KindCertAuthority, types.VerbRotate); err != nil {
+	ctx := &services.Context{User: a.context.User, Resource: ca}
+	if err := a.actionWithContext(ctx, apidefaults.Namespace, types.KindCertAuthority, types.VerbRotate); err != nil {
 		return trace.Wrap(err)
 	}
-	return a.authServer.RotateExternalCertAuthority(ctx, ca)
+	return a.authServer.RotateExternalCertAuthority(ca)
 }
 
 // UpsertCertAuthority updates existing cert authority or updates the existing one.
@@ -428,7 +445,7 @@ func (a *ServerWithRoles) CompareAndSwapCertAuthority(new, existing types.CertAu
 	return a.authServer.CompareAndSwapCertAuthority(new, existing)
 }
 
-func (a *ServerWithRoles) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (a *ServerWithRoles) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	if err := a.action(apidefaults.Namespace, types.KindCertAuthority, types.VerbList, types.VerbReadNoSecrets); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -437,10 +454,10 @@ func (a *ServerWithRoles) GetCertAuthorities(ctx context.Context, caType types.C
 			return nil, trace.Wrap(err)
 		}
 	}
-	return a.authServer.GetCertAuthorities(ctx, caType, loadKeys, opts...)
+	return a.authServer.GetCertAuthorities(caType, loadKeys, opts...)
 }
 
-func (a *ServerWithRoles) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (a *ServerWithRoles) GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	if err := a.action(apidefaults.Namespace, types.KindCertAuthority, types.VerbReadNoSecrets); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -449,7 +466,7 @@ func (a *ServerWithRoles) GetCertAuthority(ctx context.Context, id types.CertAut
 			return nil, trace.Wrap(err)
 		}
 	}
-	return a.authServer.GetCertAuthority(ctx, id, loadKeys, opts...)
+	return a.authServer.GetCertAuthority(id, loadKeys, opts...)
 }
 
 func (a *ServerWithRoles) GetDomainName() (string, error) {
@@ -897,7 +914,7 @@ func (a *ServerWithRoles) ListResources(ctx context.Context, req proto.ListResou
 		//   https://github.com/gravitational/teleport/pull/1224
 		actionVerbs = []string{types.VerbList}
 
-	case types.KindDatabaseServer, types.KindAppServer, types.KindKubeService, types.KindWindowsDesktop:
+	case types.KindDatabaseServer, types.KindAppServer, types.KindKubeService:
 
 	default:
 		return nil, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
@@ -974,8 +991,6 @@ func (a *ServerWithRoles) checkAccessToResource(resource types.Resource) error {
 		default:
 			return trace.BadParameter("could not check access to server type %q", resource.GetKind())
 		}
-	case types.WindowsDesktop:
-		return a.checkAccessToWindowsDesktop(r)
 	default:
 		return trace.BadParameter("could not check access to resource type %T", r)
 	}
@@ -1026,42 +1041,6 @@ func (a *ServerWithRoles) listResourcesWithSort(ctx context.Context, req proto.L
 		}
 		resources = servers.AsResources()
 
-	case types.KindKubernetesCluster:
-		kubeservices, err := a.GetKubeServices(ctx)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		// Extract kube clusters into its own list.
-		clusters := []types.KubeCluster{}
-		for _, svc := range kubeservices {
-			for _, legacyCluster := range svc.GetKubernetesClusters() {
-				cluster, err := types.NewKubernetesClusterV3FromLegacyCluster(svc.GetNamespace(), legacyCluster)
-				if err != nil {
-					return nil, trace.Wrap(err)
-				}
-				clusters = append(clusters, cluster)
-			}
-		}
-
-		sortedClusters := types.KubeClusters(types.DeduplicateKubeClusters(clusters))
-		if err := sortedClusters.SortByCustom(req.SortBy); err != nil {
-			return nil, trace.Wrap(err)
-		}
-		resources = sortedClusters.AsResources()
-
-	case types.KindWindowsDesktop:
-		windowsdesktops, err := a.GetWindowsDesktops(ctx, req.GetWindowsDesktopFilter())
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		desktops := types.WindowsDesktops(windowsdesktops)
-		if err := desktops.SortByCustom(req.SortBy); err != nil {
-			return nil, trace.Wrap(err)
-		}
-		resources = desktops.AsResources()
-
 	default:
 		return nil, trace.NotImplemented("resource type %q is not supported for listResourcesWithSort", req.ResourceType)
 	}
@@ -1075,11 +1054,6 @@ func (a *ServerWithRoles) listResourcesWithSort(ctx context.Context, req proto.L
 	return resp, nil
 }
 
-// ListWindowsDesktops not implemented: can only be called locally.
-func (a *ServerWithRoles) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
-	return nil, trace.NotImplemented(notImplementedMessage)
-}
-
 // ListNodes returns a paginated list of nodes filtered by user access.
 //
 // DELETE IN 10.0.0 in favor of ListResources.
@@ -1648,7 +1622,17 @@ func (a *ServerWithRoles) getProxyPublicAddr() string {
 }
 
 func (a *ServerWithRoles) DeleteAccessRequest(ctx context.Context, name string) error {
-	if err := a.action(apidefaults.Namespace, types.KindAccessRequest, types.VerbDelete); err != nil {
+	cfg, err := a.withStaticRoles()
+	if err != nil {
+		return err
+	}
+	if err := cfg.action(apidefaults.Namespace, types.KindAccessRequest, types.VerbDelete); err != nil {
+		if trace.IsAccessDenied(err) {
+			if a.withOptions(quietAction(true)).action(apidefaults.Namespace, types.KindAccessRequest, types.VerbDelete) == nil {
+				// the user would've had permission with the roles granted by access requests
+				return trace.WrapWithMessage(err, "access request deletion through elevated roles is not allowed")
+			}
+		}
 		return trace.Wrap(err)
 	}
 	return a.authServer.DeleteAccessRequest(ctx, name)
@@ -1738,8 +1722,8 @@ func (a *ServerWithRoles) GenerateKeyPair(pass string) ([]byte, []byte, error) {
 }
 
 func (a *ServerWithRoles) GenerateHostCert(
-	key []byte, hostID, nodeName string, principals []string, clusterName string, role types.SystemRole, ttl time.Duration,
-) ([]byte, error) {
+	key []byte, hostID, nodeName string, principals []string, clusterName string, role types.SystemRole, ttl time.Duration) ([]byte, error) {
+
 	if err := a.action(apidefaults.Namespace, types.KindHostCert, types.VerbCreate); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2661,21 +2645,6 @@ func (a *ServerWithRoles) UpsertRole(ctx context.Context, role types.Role) error
 	}
 
 	// Some options are only available with enterprise subscription
-	if err := checkRoleFeatureSupport(role); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// access predicate syntax is not checked as part of normal role validation in order
-	// to allow the available namespaces to be extended without breaking compatibility with
-	// older nodes/proxies (which do not need to ever evaluate said predicates).
-	if err := services.ValidateAccessPredicates(role); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return a.authServer.UpsertRole(ctx, role)
-}
-
-func checkRoleFeatureSupport(role types.Role) error {
 	features := modules.GetModules().Features()
 	options := role.GetOptions()
 	allowReq, allowRev := role.GetAccessRequestConditions(types.Allow), role.GetAccessReviewConditions(types.Allow)
@@ -2694,9 +2663,16 @@ func checkRoleFeatureSupport(role types.Role) error {
 	case features.AdvancedAccessWorkflows == false && !allowRev.IsZero():
 		return trace.AccessDenied(
 			"role field allow.review_requests is only available in enterprise subscriptions")
-	default:
-		return nil
 	}
+
+	// access predicate syntax is not checked as part of normal role validation in order
+	// to allow the available namespaces to be extended without breaking compatibility with
+	// older nodes/proxies (which do not need to ever evaluate said predicates).
+	if err := services.ValidateAccessPredicates(role); err != nil {
+		return trace.Wrap(err)
+	}
+
+	return a.authServer.UpsertRole(ctx, role)
 }
 
 // GetRole returns role by name
@@ -3495,7 +3471,7 @@ func (a *ServerWithRoles) GenerateAppToken(ctx context.Context, req types.Genera
 		return "", trace.Wrap(err)
 	}
 
-	session, err := a.authServer.generateAppToken(ctx, req.Username, req.Roles, req.URI, req.Expires)
+	session, err := a.authServer.generateAppToken(req.Username, req.Roles, req.URI, req.Expires)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -4187,6 +4163,7 @@ func (a *ServerWithRoles) filterWindowsDesktops(desktops []types.WindowsDesktop)
 func (a *ServerWithRoles) checkAccessToWindowsDesktop(w types.WindowsDesktop) error {
 	return a.context.Checker.CheckAccess(w,
 		// MFA is not required for operations on desktop resources
+		// TODO(zmb3): per-session MFA for desktops will be added after general availability
 		services.AccessMFAParams{Verified: true},
 		// Note: we don't use the Windows login matcher here, as we won't know what OS user
 		// the user is trying to log in as until they initiate the connection.
diff --git a/lib/auth/auth_with_roles_test.go b/lib/auth/auth_with_roles_test.go
index ae6359152c9d1..2c812a80fde7c 100644
--- a/lib/auth/auth_with_roles_test.go
+++ b/lib/auth/auth_with_roles_test.go
@@ -323,7 +323,7 @@ func TestGenerateUserCertsWithRoleRequest(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	dummyUserRole, err := types.NewRoleV3("dummy-user-role", types.RoleSpecV5{})
+	dummyUserRole, err := types.NewRole("dummy-user-role", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	dummyUser, err := CreateUser(srv.Auth(), "dummy-user", dummyUserRole)
@@ -1893,7 +1893,7 @@ func TestKindClusterConfig(t *testing.T) {
 	})
 
 	t.Run("with KindClusterConfig privilege", func(t *testing.T) {
-		role, err := types.NewRoleV3("test-role", types.RoleSpecV5{
+		role, err := types.NewRole("test-role", types.RoleSpecV5{
 			Allow: types.RoleConditions{
 				Rules: []types.Rule{
 					types.NewRule(types.KindClusterConfig, []string{types.VerbRead}),
@@ -1909,6 +1909,94 @@ func TestKindClusterConfig(t *testing.T) {
 	})
 }
 
+func TestNoElevatedAccessRequestDeletion(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
+	require.NoError(t, err)
+	t.Cleanup(func() { srv.Close() })
+
+	deleterRole, err := types.NewRole("deleter", types.RoleSpecV5{
+		Allow: types.RoleConditions{
+			Rules: []types.Rule{{
+				Resources: []string{"access_request"},
+				Verbs:     []string{"delete"},
+			}},
+		},
+	})
+	require.NoError(t, err)
+	deleterUser, err := CreateUser(srv.AuthServer, "deletey", deleterRole)
+	require.NoError(t, err)
+
+	requesterRole, err := types.NewRole("requester", types.RoleSpecV5{
+		Allow: types.RoleConditions{
+			Request: &types.AccessRequestConditions{
+				Roles: []string{deleterRole.GetName()},
+			},
+		},
+	})
+	require.NoError(t, err)
+	requesterUser, err := CreateUser(srv.AuthServer, "requesty", requesterRole)
+	require.NoError(t, err)
+
+	request, err := services.NewAccessRequest(requesterUser.GetName(), deleterRole.GetName())
+	require.NoError(t, err)
+	// the request must be for an allowed user/role combination or it will get rejected
+	err = srv.AuthServer.CreateAccessRequest(ctx, request)
+	require.NoError(t, err)
+
+	// requesty has used some other unspecified access request to get the
+	// deleter role in this identity
+	requesterAuthContext, err := srv.Authorizer.Authorize(context.WithValue(ctx,
+		ContextUser,
+		LocalUser{
+			Username: requesterUser.GetName(),
+			Identity: tlsca.Identity{
+				Username: requesterUser.GetName(),
+				Groups:   []string{requesterRole.GetName(), deleterRole.GetName()},
+				// a tlsca.Identity must have a nonempty Traits field or the
+				// roles will be reloaded from the backend during Authorize
+				Traits: map[string][]string{"nonempty": {}},
+			},
+		},
+	))
+	require.NoError(t, err)
+	requesterAuth := &ServerWithRoles{
+		authServer: srv.AuthServer,
+		sessions:   srv.SessionServer,
+		alog:       srv.AuditLog,
+		context:    *requesterAuthContext,
+	}
+
+	err = requesterAuth.DeleteAccessRequest(ctx, request.GetName())
+	require.True(t, trace.IsAccessDenied(err))
+	// matches the message in lib/auth/auth_with_roles.go:(*ServerWithRoles).DeleteAccessRequest()
+	require.Contains(t, err.Error(), "deletion through elevated roles")
+
+	deleterAuthContext, err := srv.Authorizer.Authorize(context.WithValue(ctx,
+		ContextUser,
+		LocalUser{
+			Username: deleterUser.GetName(),
+			Identity: tlsca.Identity{
+				Username: deleterUser.GetName(),
+				Groups:   []string{deleterRole.GetName()},
+				Traits:   map[string][]string{"nonempty": {}},
+			},
+		},
+	))
+	require.NoError(t, err)
+	deleterAuth := &ServerWithRoles{
+		authServer: srv.AuthServer,
+		sessions:   srv.SessionServer,
+		alog:       srv.AuditLog,
+		context:    *deleterAuthContext,
+	}
+
+	err = deleterAuth.DeleteAccessRequest(ctx, request.GetName())
+	require.NoError(t, err)
+}
+
 func TestGetAndList_KubeServices(t *testing.T) {
 	t.Parallel()
 	ctx := context.Background()
@@ -2074,241 +2162,3 @@ func TestListResources_NeedTotalCountFlag(t *testing.T) {
 	require.NotEmpty(t, resp.NextKey)
 	require.Empty(t, resp.TotalCount)
 }
-
-func TestGetAndList_WindowsDesktops(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	srv := newTestTLSServer(t)
-
-	// Create test desktops.
-	for i := 0; i < 5; i++ {
-		name := uuid.New().String()
-		desktop, err := types.NewWindowsDesktopV3(name, map[string]string{"name": name},
-			types.WindowsDesktopSpecV3{Addr: "_", HostID: "_"})
-		require.NoError(t, err)
-		require.NoError(t, srv.Auth().UpsertWindowsDesktop(ctx, desktop))
-	}
-
-	// Test all has been upserted.
-	testDesktops, err := srv.Auth().GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
-	require.NoError(t, err)
-	require.Len(t, testDesktops, 5)
-
-	testResources := types.WindowsDesktops(testDesktops).AsResources()
-
-	// Create user, role, and client.
-	username := "user"
-	user, role, err := CreateUserAndRole(srv.Auth(), username, nil)
-	require.NoError(t, err)
-	identity := TestUser(user.GetName())
-	clt, err := srv.NewClient(identity)
-	require.NoError(t, err)
-
-	// Base request.
-	listRequest := proto.ListResourcesRequest{
-		ResourceType: types.KindWindowsDesktop,
-		Limit:        int32(len(testDesktops) + 1),
-	}
-
-	// Permit user to get the first desktop.
-	role.SetWindowsDesktopLabels(types.Allow, types.Labels{"name": {testDesktops[0].GetName()}})
-	require.NoError(t, srv.Auth().UpsertRole(ctx, role))
-
-	desktops, err := clt.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
-	require.NoError(t, err)
-	require.EqualValues(t, 1, len(desktops))
-	require.Empty(t, cmp.Diff(testDesktops[0:1], desktops))
-
-	resp, err := clt.ListResources(ctx, listRequest)
-	require.NoError(t, err)
-	require.Len(t, resp.Resources, 1)
-	require.Empty(t, cmp.Diff(testResources[0:1], resp.Resources))
-	require.Empty(t, resp.NextKey)
-	require.Empty(t, resp.TotalCount)
-
-	// Permit user to get all desktops.
-	role.SetWindowsDesktopLabels(types.Allow, types.Labels{types.Wildcard: {types.Wildcard}})
-	require.NoError(t, srv.Auth().UpsertRole(ctx, role))
-	desktops, err = clt.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
-	require.NoError(t, err)
-	require.EqualValues(t, len(testDesktops), len(desktops))
-	require.Empty(t, cmp.Diff(testDesktops, desktops))
-
-	resp, err = clt.ListResources(ctx, listRequest)
-	require.NoError(t, err)
-	require.Len(t, resp.Resources, len(testResources))
-	require.Empty(t, cmp.Diff(testResources, resp.Resources))
-	require.Empty(t, resp.NextKey)
-	require.Empty(t, resp.TotalCount)
-
-	// Test sorting is supported.
-	withSort := listRequest
-	withSort.SortBy = types.SortBy{IsDesc: true, Field: types.ResourceMetadataName}
-	resp, err = clt.ListResources(ctx, withSort)
-	require.NoError(t, err)
-	require.Len(t, resp.Resources, len(testResources))
-	desktops, err = types.ResourcesWithLabels(resp.Resources).AsWindowsDesktops()
-	require.NoError(t, err)
-	names, err := types.WindowsDesktops(desktops).GetFieldVals(types.ResourceMetadataName)
-	require.NoError(t, err)
-	require.IsDecreasing(t, names)
-
-	// Filter by labels.
-	withLabels := listRequest
-	withLabels.Labels = map[string]string{"name": testDesktops[0].GetName()}
-	resp, err = clt.ListResources(ctx, withLabels)
-	require.NoError(t, err)
-	require.Len(t, resp.Resources, 1)
-	require.Empty(t, cmp.Diff(testResources[0:1], resp.Resources))
-	require.Empty(t, resp.NextKey)
-	require.Empty(t, resp.TotalCount)
-
-	// Test search keywords match.
-	withSearchKeywords := listRequest
-	withSearchKeywords.SearchKeywords = []string{"name", testDesktops[0].GetName()}
-	resp, err = clt.ListResources(ctx, withSearchKeywords)
-	require.NoError(t, err)
-	require.Len(t, resp.Resources, 1)
-	require.Empty(t, cmp.Diff(testResources[0:1], resp.Resources))
-
-	// Test predicate match.
-	withExpression := listRequest
-	withExpression.PredicateExpression = fmt.Sprintf(`labels.name == "%s"`, testDesktops[0].GetName())
-	resp, err = clt.ListResources(ctx, withExpression)
-	require.NoError(t, err)
-	require.Len(t, resp.Resources, 1)
-	require.Empty(t, cmp.Diff(testResources[0:1], resp.Resources))
-
-	// Deny user to get the first desktop.
-	role.SetWindowsDesktopLabels(types.Deny, types.Labels{"name": {testDesktops[0].GetName()}})
-	require.NoError(t, srv.Auth().UpsertRole(ctx, role))
-
-	desktops, err = clt.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
-	require.NoError(t, err)
-	require.EqualValues(t, len(testDesktops[1:]), len(desktops))
-	require.Empty(t, cmp.Diff(testDesktops[1:], desktops))
-
-	resp, err = clt.ListResources(ctx, listRequest)
-	require.NoError(t, err)
-	require.Len(t, resp.Resources, len(testResources[1:]))
-	require.Empty(t, cmp.Diff(testResources[1:], resp.Resources))
-
-	// Deny user all desktops.
-	role.SetWindowsDesktopLabels(types.Deny, types.Labels{types.Wildcard: {types.Wildcard}})
-	require.NoError(t, srv.Auth().UpsertRole(ctx, role))
-
-	desktops, err = clt.GetWindowsDesktops(ctx, types.WindowsDesktopFilter{})
-	require.NoError(t, err)
-	require.EqualValues(t, 0, len(desktops))
-	require.Empty(t, cmp.Diff([]types.WindowsDesktop{}, desktops))
-
-	resp, err = clt.ListResources(ctx, listRequest)
-	require.NoError(t, err)
-	require.Len(t, resp.Resources, 0)
-	require.Empty(t, cmp.Diff([]types.ResourceWithLabels{}, resp.Resources))
-}
-
-func TestListResources_KindKubernetesCluster(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	srv, err := NewTestAuthServer(TestAuthServerConfig{Dir: t.TempDir()})
-	require.NoError(t, err)
-
-	authContext, err := srv.Authorizer.Authorize(context.WithValue(ctx, ContextUser, TestBuiltin(types.RoleProxy).I))
-	require.NoError(t, err)
-
-	s := &ServerWithRoles{
-		authServer: srv.AuthServer,
-		sessions:   srv.SessionServer,
-		alog:       srv.AuditLog,
-		context:    *authContext,
-	}
-
-	testNames := []string{"a", "b", "c", "d"}
-
-	// Add some kube services.
-	kubeService, err := types.NewServer("bar", types.KindKubeService, types.ServerSpecV2{
-		KubernetesClusters: []*types.KubernetesCluster{{Name: "d"}, {Name: "b"}, {Name: "a"}},
-	})
-	require.NoError(t, err)
-	_, err = s.UpsertKubeServiceV2(ctx, kubeService)
-	require.NoError(t, err)
-
-	// Include a duplicate cluster name to test deduplicate.
-	kubeService, err = types.NewServer("foo", types.KindKubeService, types.ServerSpecV2{
-		KubernetesClusters: []*types.KubernetesCluster{{Name: "a"}, {Name: "c"}},
-	})
-	require.NoError(t, err)
-	_, err = s.UpsertKubeServiceV2(ctx, kubeService)
-	require.NoError(t, err)
-
-	// Test upsert.
-	kubeservices, err := s.GetKubeServices(ctx)
-	require.NoError(t, err)
-	require.Len(t, kubeservices, 2)
-
-	t.Run("fetch all", func(t *testing.T) {
-		t.Parallel()
-
-		res, err := s.ListResources(ctx, proto.ListResourcesRequest{
-			ResourceType: types.KindKubernetesCluster,
-			Limit:        10,
-		})
-		require.NoError(t, err)
-		require.Len(t, res.Resources, len(testNames))
-		require.Empty(t, res.NextKey)
-		require.Empty(t, res.TotalCount)
-
-		clusters, err := types.ResourcesWithLabels(res.Resources).AsKubeClusters()
-		require.NoError(t, err)
-		names, err := types.KubeClusters(clusters).GetFieldVals(types.ResourceMetadataName)
-		require.NoError(t, err)
-		require.ElementsMatch(t, names, testNames)
-	})
-
-	t.Run("start keys", func(t *testing.T) {
-		t.Parallel()
-
-		// First fetch.
-		res, err := s.ListResources(ctx, proto.ListResourcesRequest{
-			ResourceType: types.KindKubernetesCluster,
-			Limit:        1,
-		})
-		require.NoError(t, err)
-		require.Len(t, res.Resources, 1)
-		require.Equal(t, kubeservices[0].GetKubernetesClusters()[1].Name, res.NextKey)
-
-		// Second fetch.
-		res, err = s.ListResources(ctx, proto.ListResourcesRequest{
-			ResourceType: types.KindKubernetesCluster,
-			Limit:        1,
-			StartKey:     res.NextKey,
-		})
-		require.NoError(t, err)
-		require.Len(t, res.Resources, 1)
-		require.Equal(t, kubeservices[0].GetKubernetesClusters()[2].Name, res.NextKey)
-	})
-
-	t.Run("fetch with sort and total count", func(t *testing.T) {
-		t.Parallel()
-		res, err := s.ListResources(ctx, proto.ListResourcesRequest{
-			ResourceType: types.KindKubernetesCluster,
-			Limit:        10,
-			SortBy: types.SortBy{
-				IsDesc: true,
-				Field:  types.ResourceMetadataName,
-			},
-			NeedTotalCount: true,
-		})
-		require.NoError(t, err)
-		require.Empty(t, res.NextKey)
-		require.Len(t, res.Resources, len(testNames))
-		require.Equal(t, res.TotalCount, len(testNames))
-
-		clusters, err := types.ResourcesWithLabels(res.Resources).AsKubeClusters()
-		require.NoError(t, err)
-		names, err := types.KubeClusters(clusters).GetFieldVals(types.ResourceMetadataName)
-		require.NoError(t, err)
-		require.IsDecreasing(t, names)
-	})
-}
diff --git a/lib/auth/bot.go b/lib/auth/bot.go
index 3eb553e4414ff..cbc0ddc729478 100644
--- a/lib/auth/bot.go
+++ b/lib/auth/bot.go
@@ -44,7 +44,7 @@ func BotResourceName(botName string) string {
 
 // createBotRole creates a role from a bot template with the given parameters.
 func createBotRole(ctx context.Context, s *Server, botName string, resourceName string, roleRequests []string) (types.Role, error) {
-	role, err := types.NewRoleV3(resourceName, types.RoleSpecV5{
+	role, err := types.NewRole(resourceName, types.RoleSpecV5{
 		Options: types.RoleOptions{
 			// TODO: inherit TTLs from cert length?
 			MaxSessionTTL: types.Duration(12 * time.Hour),
@@ -242,7 +242,7 @@ func (s *Server) getBotUsers(ctx context.Context) ([]types.User, error) {
 // random dynamic provision token which allows bots to join with the given
 // botName. Returns the token and any error.
 func (s *Server) checkOrCreateBotToken(ctx context.Context, req *proto.CreateBotRequest) (types.ProvisionToken, error) {
-	botName := req.Name
+	resourceName := BotResourceName(req.Name)
 
 	// if the request includes a TokenID it should already exist
 	if req.TokenID != "" {
@@ -258,9 +258,9 @@ func (s *Server) checkOrCreateBotToken(ctx context.Context, req *proto.CreateBot
 			return nil, trace.BadParameter("token %q is not valid for role %q",
 				req.TokenID, types.RoleBot)
 		}
-		if provisionToken.GetBotName() != botName {
+		if provisionToken.GetBotName() != resourceName {
 			return nil, trace.BadParameter("token %q is valid for bot with name %q, not %q",
-				req.TokenID, provisionToken.GetBotName(), botName)
+				req.TokenID, provisionToken.GetBotName(), resourceName)
 		}
 		switch provisionToken.GetJoinMethod() {
 		case types.JoinMethodToken, types.JoinMethodIAM:
@@ -286,7 +286,7 @@ func (s *Server) checkOrCreateBotToken(ctx context.Context, req *proto.CreateBot
 	tokenSpec := types.ProvisionTokenSpecV2{
 		Roles:      []types.SystemRole{types.RoleBot},
 		JoinMethod: types.JoinMethodToken,
-		BotName:    botName,
+		BotName:    resourceName,
 	}
 	token, err := types.NewProvisionTokenFromSpec(tokenName, time.Now().Add(ttl), tokenSpec)
 	if err != nil {
diff --git a/lib/auth/clt.go b/lib/auth/clt.go
index 68f75a5c99148..fff5a88a55d1a 100644
--- a/lib/auth/clt.go
+++ b/lib/auth/clt.go
@@ -22,7 +22,7 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -269,28 +269,28 @@ func ClientTimeout(timeout time.Duration) roundtrip.ClientParam {
 }
 
 // PostJSON is a generic method that issues http POST request to the server
-func (c *Client) PostJSON(ctx context.Context, endpoint string, val interface{}) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.PostJSON(ctx, endpoint, val))
+func (c *Client) PostJSON(endpoint string, val interface{}) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.PostJSON(context.TODO(), endpoint, val))
 }
 
 // PutJSON is a generic method that issues http PUT request to the server
-func (c *Client) PutJSON(ctx context.Context, endpoint string, val interface{}) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.PutJSON(ctx, endpoint, val))
+func (c *Client) PutJSON(endpoint string, val interface{}) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.PutJSON(context.TODO(), endpoint, val))
 }
 
 // PostForm is a generic method that issues http POST request to the server
-func (c *Client) PostForm(ctx context.Context, endpoint string, vals url.Values, files ...roundtrip.File) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.PostForm(ctx, endpoint, vals, files...))
+func (c *Client) PostForm(endpoint string, vals url.Values, files ...roundtrip.File) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.PostForm(context.TODO(), endpoint, vals, files...))
 }
 
 // Get issues http GET request to the server
-func (c *Client) Get(ctx context.Context, u string, params url.Values) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.Get(ctx, u, params))
+func (c *Client) Get(u string, params url.Values) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.Get(context.TODO(), u, params))
 }
 
 // Delete issues http Delete Request to the server
-func (c *Client) Delete(ctx context.Context, u string) (*roundtrip.Response, error) {
-	return httplib.ConvertResponse(c.Client.Delete(ctx, u))
+func (c *Client) Delete(u string) (*roundtrip.Response, error) {
+	return httplib.ConvertResponse(c.Client.Delete(context.TODO(), u))
 }
 
 // ProcessKubeCSR processes CSR request against Kubernetes CA, returns
@@ -299,7 +299,7 @@ func (c *Client) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
 	if err := req.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("kube", "csr"), req)
+	out, err := c.PostJSON(c.Endpoint("kube", "csr"), req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -316,7 +316,7 @@ func (c *Client) GetSessions(namespace string) ([]session.Session, error) {
 	if namespace == "" {
 		return nil, trace.BadParameter(MissingNamespaceError)
 	}
-	out, err := c.Get(context.TODO(), c.Endpoint("namespaces", namespace, "sessions"), url.Values{})
+	out, err := c.Get(c.Endpoint("namespaces", namespace, "sessions"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -336,7 +336,7 @@ func (c *Client) GetSession(namespace string, id session.ID) (*session.Session,
 	if err := id.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.Get(context.TODO(), c.Endpoint("namespaces", namespace, "sessions", string(id)), url.Values{})
+	out, err := c.Get(c.Endpoint("namespaces", namespace, "sessions", string(id)), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -352,7 +352,7 @@ func (c *Client) DeleteSession(namespace string, id session.ID) error {
 	if namespace == "" {
 		return trace.BadParameter(MissingNamespaceError)
 	}
-	_, err := c.Delete(context.TODO(), c.Endpoint("namespaces", namespace, "sessions", string(id)))
+	_, err := c.Delete(c.Endpoint("namespaces", namespace, "sessions", string(id)))
 	return trace.Wrap(err)
 }
 
@@ -361,7 +361,7 @@ func (c *Client) CreateSession(sess session.Session) error {
 	if sess.Namespace == "" {
 		return trace.BadParameter(MissingNamespaceError)
 	}
-	_, err := c.PostJSON(context.TODO(), c.Endpoint("namespaces", sess.Namespace, "sessions"), createSessionReq{Session: sess})
+	_, err := c.PostJSON(c.Endpoint("namespaces", sess.Namespace, "sessions"), createSessionReq{Session: sess})
 	return trace.Wrap(err)
 }
 
@@ -370,13 +370,13 @@ func (c *Client) UpdateSession(req session.UpdateRequest) error {
 	if err := req.Check(); err != nil {
 		return trace.Wrap(err)
 	}
-	_, err := c.PutJSON(context.TODO(), c.Endpoint("namespaces", req.Namespace, "sessions", string(req.ID)), updateSessionReq{Update: req})
+	_, err := c.PutJSON(c.Endpoint("namespaces", req.Namespace, "sessions", string(req.ID)), updateSessionReq{Update: req})
 	return trace.Wrap(err)
 }
 
 // GetDomainName returns local auth domain of the current auth server
 func (c *Client) GetDomainName() (string, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("domain"), url.Values{})
+	out, err := c.Get(c.Endpoint("domain"), url.Values{})
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -390,7 +390,7 @@ func (c *Client) GetDomainName() (string, error) {
 // GetClusterCACert returns the PEM-encoded TLS certs for the local cluster. If
 // the cluster has multiple TLS certs, they will all be concatenated.
 func (c *Client) GetClusterCACert() (*LocalCAResponse, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("cacert"), url.Values{})
+	out, err := c.Get(c.Endpoint("cacert"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -416,19 +416,19 @@ func (c *Client) CreateCertAuthority(ca types.CertAuthority) error {
 }
 
 // RotateCertAuthority starts or restarts certificate authority rotation process.
-func (c *Client) RotateCertAuthority(ctx context.Context, req RotateRequest) error {
+func (c *Client) RotateCertAuthority(req RotateRequest) error {
 	caType := "all"
 	if req.Type != "" {
 		caType = string(req.Type)
 	}
-	_, err := c.PostJSON(ctx, c.Endpoint("authorities", caType, "rotate"), req)
+	_, err := c.PostJSON(c.Endpoint("authorities", caType, "rotate"), req)
 	return trace.Wrap(err)
 }
 
 // RotateExternalCertAuthority rotates external certificate authority,
 // this method is used to update only public keys and certificates of the
 // the certificate authorities of trusted clusters.
-func (c *Client) RotateExternalCertAuthority(ctx context.Context, ca types.CertAuthority) error {
+func (c *Client) RotateExternalCertAuthority(ca types.CertAuthority) error {
 	if err := services.ValidateCertAuthority(ca); err != nil {
 		return trace.Wrap(err)
 	}
@@ -436,7 +436,7 @@ func (c *Client) RotateExternalCertAuthority(ctx context.Context, ca types.CertA
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(ctx, c.Endpoint("authorities", string(ca.GetType()), "rotate", "external"),
+	_, err = c.PostJSON(c.Endpoint("authorities", string(ca.GetType()), "rotate", "external"),
 		&rotateExternalCertAuthorityRawReq{CA: data})
 	return trace.Wrap(err)
 }
@@ -450,7 +450,7 @@ func (c *Client) UpsertCertAuthority(ca types.CertAuthority) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("authorities", string(ca.GetType())),
+	_, err = c.PostJSON(c.Endpoint("authorities", string(ca.GetType())),
 		&upsertCertAuthorityRawReq{CA: data})
 	return trace.Wrap(err)
 }
@@ -462,11 +462,11 @@ func (c *Client) CompareAndSwapCertAuthority(new, existing types.CertAuthority)
 }
 
 // GetCertAuthorities returns a list of certificate authorities
-func (c *Client) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (c *Client) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	if err := caType.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.Get(ctx, c.Endpoint("authorities", string(caType)), url.Values{
+	out, err := c.Get(c.Endpoint("authorities", string(caType)), url.Values{
 		"load_keys": []string{fmt.Sprintf("%t", loadKeys)},
 	})
 	if err != nil {
@@ -489,11 +489,11 @@ func (c *Client) GetCertAuthorities(ctx context.Context, caType types.CertAuthTy
 
 // GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
 // controls if signing keys are loaded
-func (c *Client) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (c *Client) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	if err := id.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.Get(ctx, c.Endpoint("authorities", string(id.Type), id.DomainName), url.Values{
+	out, err := c.Get(c.Endpoint("authorities", string(id.Type), id.DomainName), url.Values{
 		"load_keys": []string{fmt.Sprintf("%t", loadSigningKeys)},
 	})
 	if err != nil {
@@ -507,7 +507,7 @@ func (c *Client) DeleteCertAuthority(id types.CertAuthID) error {
 	if err := id.Check(); err != nil {
 		return trace.Wrap(err)
 	}
-	_, err := c.Delete(context.TODO(), c.Endpoint("authorities", string(id.Type), id.DomainName))
+	_, err := c.Delete(c.Endpoint("authorities", string(id.Type), id.DomainName))
 	return trace.Wrap(err)
 }
 
@@ -530,7 +530,7 @@ func (c *Client) DeactivateCertAuthority(id types.CertAuthID) error {
 // If token is not supplied, it will be auto generated and returned.
 // If TTL is not supplied, token will be valid until removed.
 func (c *Client) GenerateToken(ctx context.Context, req GenerateTokenRequest) (string, error) {
-	out, err := c.PostJSON(ctx, c.Endpoint("tokens"), req)
+	out, err := c.PostJSON(c.Endpoint("tokens"), req)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -547,7 +547,7 @@ func (c *Client) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 	if err := req.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.PostJSON(ctx, c.Endpoint("tokens", "register"), req)
+	out, err := c.PostJSON(c.Endpoint("tokens", "register"), req)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -557,12 +557,19 @@ func (c *Client) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		return nil, trace.Wrap(err)
 	}
 
-	return &certs, nil
+	// If we got certs, we're done, however, we may be talking to a Teleport 9 or earlier server,
+	// which still sends back the legacy JSON format.
+	if len(certs.SSH) > 0 && len(certs.TLS) > 0 {
+		return &certs, nil
+	}
+
+	// DELETE IN 10.0.0 (zmb3)
+	return UnmarshalLegacyCerts(out.Bytes())
 }
 
 // RegisterNewAuthServer is used to register new auth server with token
 func (c *Client) RegisterNewAuthServer(ctx context.Context, token string) error {
-	_, err := c.PostJSON(ctx, c.Endpoint("tokens", "register", "auth"), registerNewAuthServerReq{
+	_, err := c.PostJSON(c.Endpoint("tokens", "register", "auth"), registerNewAuthServerReq{
 		Token: token,
 	})
 	return trace.Wrap(err)
@@ -596,7 +603,7 @@ func (c *Client) UpsertNodes(namespace string, servers []types.Server) error {
 		Namespace: namespace,
 		Nodes:     bytes,
 	}
-	_, err = c.PutJSON(context.TODO(), c.Endpoint("namespaces", namespace, "nodes"), args)
+	_, err = c.PutJSON(c.Endpoint("namespaces", namespace, "nodes"), args)
 	return trace.Wrap(err)
 }
 
@@ -610,7 +617,7 @@ func (c *Client) UpsertReverseTunnel(tunnel types.ReverseTunnel) error {
 	args := &upsertReverseTunnelRawReq{
 		ReverseTunnel: data,
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("reversetunnels"), args)
+	_, err = c.PostJSON(c.Endpoint("reversetunnels"), args)
 	return trace.Wrap(err)
 }
 
@@ -621,7 +628,7 @@ func (c *Client) GetReverseTunnel(name string, opts ...services.MarshalOption) (
 
 // GetReverseTunnels returns the list of created reverse tunnels
 func (c *Client) GetReverseTunnels(opts ...services.MarshalOption) ([]types.ReverseTunnel, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("reversetunnels"), url.Values{})
+	out, err := c.Get(c.Endpoint("reversetunnels"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -648,7 +655,7 @@ func (c *Client) DeleteReverseTunnel(domainName string) error {
 	if strings.TrimSpace(domainName) == "" {
 		return trace.BadParameter("empty domain name")
 	}
-	_, err := c.Delete(context.TODO(), c.Endpoint("reversetunnels", domainName))
+	_, err := c.Delete(c.Endpoint("reversetunnels", domainName))
 	return trace.Wrap(err)
 }
 
@@ -661,7 +668,7 @@ func (c *Client) UpsertTunnelConnection(conn types.TunnelConnection) error {
 	args := &upsertTunnelConnectionRawReq{
 		TunnelConnection: data,
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("tunnelconnections"), args)
+	_, err = c.PostJSON(c.Endpoint("tunnelconnections"), args)
 	return trace.Wrap(err)
 }
 
@@ -670,7 +677,7 @@ func (c *Client) GetTunnelConnections(clusterName string, opts ...services.Marsh
 	if clusterName == "" {
 		return nil, trace.BadParameter("missing cluster name parameter")
 	}
-	out, err := c.Get(context.TODO(), c.Endpoint("tunnelconnections", clusterName), url.Values{})
+	out, err := c.Get(c.Endpoint("tunnelconnections", clusterName), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -691,7 +698,7 @@ func (c *Client) GetTunnelConnections(clusterName string, opts ...services.Marsh
 
 // GetAllTunnelConnections returns all tunnel connections
 func (c *Client) GetAllTunnelConnections(opts ...services.MarshalOption) ([]types.TunnelConnection, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("tunnelconnections"), url.Values{})
+	out, err := c.Get(c.Endpoint("tunnelconnections"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -718,7 +725,7 @@ func (c *Client) DeleteTunnelConnection(clusterName string, connName string) err
 	if connName == "" {
 		return trace.BadParameter("missing parameter connection name")
 	}
-	_, err := c.Delete(context.TODO(), c.Endpoint("tunnelconnections", clusterName, connName))
+	_, err := c.Delete(c.Endpoint("tunnelconnections", clusterName, connName))
 	return trace.Wrap(err)
 }
 
@@ -727,7 +734,7 @@ func (c *Client) DeleteTunnelConnections(clusterName string) error {
 	if clusterName == "" {
 		return trace.BadParameter("missing parameter cluster name")
 	}
-	_, err := c.Delete(context.TODO(), c.Endpoint("tunnelconnections", clusterName))
+	_, err := c.Delete(c.Endpoint("tunnelconnections", clusterName))
 	return trace.Wrap(err)
 }
 
@@ -738,7 +745,7 @@ func (c *Client) DeleteAllTokens() error {
 
 // DeleteAllTunnelConnections deletes all tunnel connections
 func (c *Client) DeleteAllTunnelConnections() error {
-	_, err := c.Delete(context.TODO(), c.Endpoint("tunnelconnections"))
+	_, err := c.Delete(c.Endpoint("tunnelconnections"))
 	return trace.Wrap(err)
 }
 
@@ -754,7 +761,7 @@ func (c *Client) GetUserLoginAttempts(user string) ([]services.LoginAttempt, err
 
 // GetRemoteClusters returns a list of remote clusters
 func (c *Client) GetRemoteClusters(opts ...services.MarshalOption) ([]types.RemoteCluster, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("remoteclusters"), url.Values{})
+	out, err := c.Get(c.Endpoint("remoteclusters"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -778,7 +785,7 @@ func (c *Client) GetRemoteCluster(clusterName string) (types.RemoteCluster, erro
 	if clusterName == "" {
 		return nil, trace.BadParameter("missing cluster name")
 	}
-	out, err := c.Get(context.TODO(), c.Endpoint("remoteclusters", clusterName), url.Values{})
+	out, err := c.Get(c.Endpoint("remoteclusters", clusterName), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -790,13 +797,13 @@ func (c *Client) DeleteRemoteCluster(clusterName string) error {
 	if clusterName == "" {
 		return trace.BadParameter("missing parameter cluster name")
 	}
-	_, err := c.Delete(context.TODO(), c.Endpoint("remoteclusters", clusterName))
+	_, err := c.Delete(c.Endpoint("remoteclusters", clusterName))
 	return trace.Wrap(err)
 }
 
 // DeleteAllRemoteClusters deletes all remote clusters
 func (c *Client) DeleteAllRemoteClusters() error {
-	_, err := c.Delete(context.TODO(), c.Endpoint("remoteclusters"))
+	_, err := c.Delete(c.Endpoint("remoteclusters"))
 	return trace.Wrap(err)
 }
 
@@ -809,7 +816,7 @@ func (c *Client) CreateRemoteCluster(rc types.RemoteCluster) error {
 	args := &createRemoteClusterRawReq{
 		RemoteCluster: data,
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("remoteclusters"), args)
+	_, err = c.PostJSON(c.Endpoint("remoteclusters"), args)
 	return trace.Wrap(err)
 }
 
@@ -823,13 +830,13 @@ func (c *Client) UpsertAuthServer(s types.Server) error {
 	args := &upsertServerRawReq{
 		Server: data,
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("authservers"), args)
+	_, err = c.PostJSON(c.Endpoint("authservers"), args)
 	return trace.Wrap(err)
 }
 
 // GetAuthServers returns the list of auth servers registered in the cluster.
 func (c *Client) GetAuthServers() ([]types.Server, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("authservers"), url.Values{})
+	out, err := c.Get(c.Endpoint("authservers"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -868,13 +875,13 @@ func (c *Client) UpsertProxy(s types.Server) error {
 	args := &upsertServerRawReq{
 		Server: data,
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("proxies"), args)
+	_, err = c.PostJSON(c.Endpoint("proxies"), args)
 	return trace.Wrap(err)
 }
 
 // GetProxies returns the list of auth servers registered in the cluster.
 func (c *Client) GetProxies() ([]types.Server, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("proxies"), url.Values{})
+	out, err := c.Get(c.Endpoint("proxies"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -895,7 +902,7 @@ func (c *Client) GetProxies() ([]types.Server, error) {
 
 // DeleteAllProxies deletes all proxies
 func (c *Client) DeleteAllProxies() error {
-	_, err := c.Delete(context.TODO(), c.Endpoint("proxies"))
+	_, err := c.Delete(c.Endpoint("proxies"))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -907,7 +914,7 @@ func (c *Client) DeleteProxy(name string) error {
 	if name == "" {
 		return trace.BadParameter("missing parameter name")
 	}
-	_, err := c.Delete(context.TODO(), c.Endpoint("proxies", name))
+	_, err := c.Delete(c.Endpoint("proxies", name))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -917,7 +924,6 @@ func (c *Client) DeleteProxy(name string) error {
 // UpsertPassword updates web access password for the user
 func (c *Client) UpsertPassword(user string, password []byte) error {
 	_, err := c.PostJSON(
-		context.TODO(),
 		c.Endpoint("users", user, "web", "password"),
 		upsertPasswordReq{
 			Password: string(password),
@@ -935,7 +941,7 @@ func (c *Client) UpsertUser(user types.User) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("users"), &upsertUserRawReq{User: data})
+	_, err = c.PostJSON(c.Endpoint("users"), &upsertUserRawReq{User: data})
 	return trace.Wrap(err)
 }
 
@@ -946,14 +952,13 @@ func (c *Client) CompareAndSwapUser(ctx context.Context, new, expected types.Use
 
 // ChangePassword updates users password based on the old password.
 func (c *Client) ChangePassword(req services.ChangePasswordReq) error {
-	_, err := c.PutJSON(context.TODO(), c.Endpoint("users", req.User, "web", "password"), req)
+	_, err := c.PutJSON(c.Endpoint("users", req.User, "web", "password"), req)
 	return trace.Wrap(err)
 }
 
 // CheckPassword checks if the suplied web access password is valid.
 func (c *Client) CheckPassword(user string, password []byte, otpToken string) error {
 	_, err := c.PostJSON(
-		context.TODO(),
 		c.Endpoint("users", user, "web", "password", "check"),
 		checkPasswordReq{
 			Password: string(password),
@@ -966,7 +971,6 @@ func (c *Client) CheckPassword(user string, password []byte, otpToken string) er
 // valid web session
 func (c *Client) ExtendWebSession(req WebSessionReq) (types.WebSession, error) {
 	out, err := c.PostJSON(
-		context.TODO(),
 		c.Endpoint("users", req.User, "web", "sessions"), req)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -977,7 +981,6 @@ func (c *Client) ExtendWebSession(req WebSessionReq) (types.WebSession, error) {
 // CreateWebSession creates a new web session for a user
 func (c *Client) CreateWebSession(user string) (types.WebSession, error) {
 	out, err := c.PostJSON(
-		context.TODO(),
 		c.Endpoint("users", user, "web", "sessions"),
 		WebSessionReq{User: user},
 	)
@@ -991,7 +994,6 @@ func (c *Client) CreateWebSession(user string) (types.WebSession, error) {
 // in case if authentication is successful
 func (c *Client) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSession, error) {
 	out, err := c.PostJSON(
-		context.TODO(),
 		c.Endpoint("users", req.Username, "web", "authenticate"),
 		req,
 	)
@@ -1005,7 +1007,6 @@ func (c *Client) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSess
 // short lived certificates as a result
 func (c *Client) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginResponse, error) {
 	out, err := c.PostJSON(
-		context.TODO(),
 		c.Endpoint("users", req.Username, "ssh", "authenticate"),
 		req,
 	)
@@ -1023,7 +1024,6 @@ func (c *Client) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginRespo
 // it is valid, or error otherwise.
 func (c *Client) GetWebSessionInfo(ctx context.Context, user, sessionID string) (types.WebSession, error) {
 	out, err := c.Get(
-		ctx,
 		c.Endpoint("users", user, "web", "sessions", sessionID), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1033,7 +1033,7 @@ func (c *Client) GetWebSessionInfo(ctx context.Context, user, sessionID string)
 
 // DeleteWebSession deletes the web session specified with sid for the given user
 func (c *Client) DeleteWebSession(user string, sid string) error {
-	_, err := c.Delete(context.TODO(), c.Endpoint("users", user, "web", "sessions", sid))
+	_, err := c.Delete(c.Endpoint("users", user, "web", "sessions", sid))
 	return trace.Wrap(err)
 }
 
@@ -1041,7 +1041,7 @@ func (c *Client) DeleteWebSession(user string, sid string) error {
 // by password. If the pass parameter is an empty string, the key pair
 // is not password-protected.
 func (c *Client) GenerateKeyPair(pass string) ([]byte, []byte, error) {
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("keypair"), generateKeyPairReq{Password: pass})
+	out, err := c.PostJSON(c.Endpoint("keypair"), generateKeyPairReq{Password: pass})
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -1058,7 +1058,7 @@ func (c *Client) GenerateKeyPair(pass string) ([]byte, []byte, error) {
 func (c *Client) GenerateHostCert(
 	key []byte, hostID, nodeName string, principals []string, clusterName string, role types.SystemRole, ttl time.Duration) ([]byte, error) {
 
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("ca", "host", "certs"),
+	out, err := c.PostJSON(c.Endpoint("ca", "host", "certs"),
 		generateHostCertReq{
 			Key:         key,
 			HostID:      hostID,
@@ -1082,7 +1082,7 @@ func (c *Client) GenerateHostCert(
 
 // CreateOIDCAuthRequest creates OIDCAuthRequest
 func (c *Client) CreateOIDCAuthRequest(req services.OIDCAuthRequest) (*services.OIDCAuthRequest, error) {
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("oidc", "requests", "create"), createOIDCAuthRequestReq{
+	out, err := c.PostJSON(c.Endpoint("oidc", "requests", "create"), createOIDCAuthRequestReq{
 		Req: req,
 	})
 	if err != nil {
@@ -1097,7 +1097,7 @@ func (c *Client) CreateOIDCAuthRequest(req services.OIDCAuthRequest) (*services.
 
 // ValidateOIDCAuthCallback validates OIDC auth callback returned from redirect
 func (c *Client) ValidateOIDCAuthCallback(q url.Values) (*OIDCAuthResponse, error) {
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("oidc", "requests", "validate"), validateOIDCAuthCallbackReq{
+	out, err := c.PostJSON(c.Endpoint("oidc", "requests", "validate"), validateOIDCAuthCallbackReq{
 		Query: q,
 	})
 	if err != nil {
@@ -1138,7 +1138,7 @@ func (c *Client) CreateSAMLConnector(ctx context.Context, connector types.SAMLCo
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(ctx, c.Endpoint("saml", "connectors"), &createSAMLConnectorRawReq{
+	_, err = c.PostJSON(c.Endpoint("saml", "connectors"), &createSAMLConnectorRawReq{
 		Connector: data,
 	})
 	if err != nil {
@@ -1149,7 +1149,7 @@ func (c *Client) CreateSAMLConnector(ctx context.Context, connector types.SAMLCo
 
 // CreateSAMLAuthRequest creates SAML AuthnRequest
 func (c *Client) CreateSAMLAuthRequest(req services.SAMLAuthRequest) (*services.SAMLAuthRequest, error) {
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("saml", "requests", "create"), createSAMLAuthRequestReq{
+	out, err := c.PostJSON(c.Endpoint("saml", "requests", "create"), createSAMLAuthRequestReq{
 		Req: req,
 	})
 	if err != nil {
@@ -1164,7 +1164,7 @@ func (c *Client) CreateSAMLAuthRequest(req services.SAMLAuthRequest) (*services.
 
 // ValidateSAMLResponse validates response returned by SAML identity provider
 func (c *Client) ValidateSAMLResponse(re string) (*SAMLAuthResponse, error) {
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("saml", "requests", "validate"), validateSAMLResponseReq{
+	out, err := c.PostJSON(c.Endpoint("saml", "requests", "validate"), validateSAMLResponseReq{
 		Response: re,
 	})
 	if err != nil {
@@ -1205,7 +1205,7 @@ func (c *Client) CreateGithubConnector(connector types.GithubConnector) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("github", "connectors"), &createGithubConnectorRawReq{
+	_, err = c.PostJSON(c.Endpoint("github", "connectors"), &createGithubConnectorRawReq{
 		Connector: bytes,
 	})
 	if err != nil {
@@ -1216,7 +1216,7 @@ func (c *Client) CreateGithubConnector(connector types.GithubConnector) error {
 
 // CreateGithubAuthRequest creates a new request for Github OAuth2 flow
 func (c *Client) CreateGithubAuthRequest(req services.GithubAuthRequest) (*services.GithubAuthRequest, error) {
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("github", "requests", "create"),
+	out, err := c.PostJSON(c.Endpoint("github", "requests", "create"),
 		createGithubAuthRequestReq{Req: req})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1230,7 +1230,7 @@ func (c *Client) CreateGithubAuthRequest(req services.GithubAuthRequest) (*servi
 
 // ValidateGithubAuthCallback validates Github auth callback returned from redirect
 func (c *Client) ValidateGithubAuthCallback(q url.Values) (*GithubAuthResponse, error) {
-	out, err := c.PostJSON(context.TODO(), c.Endpoint("github", "requests", "validate"),
+	out, err := c.PostJSON(c.Endpoint("github", "requests", "validate"),
 		validateGithubAuthCallbackReq{Query: q})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1267,7 +1267,7 @@ func (c *Client) ValidateGithubAuthCallback(q url.Values) (*GithubAuthResponse,
 
 // EmitAuditEventLegacy sends an auditable event to the auth server (part of events.IAuditLog interface)
 func (c *Client) EmitAuditEventLegacy(event events.Event, fields events.EventFields) error {
-	_, err := c.PostJSON(context.TODO(), c.Endpoint("events"), &auditEventReq{
+	_, err := c.PostJSON(c.Endpoint("events"), &auditEventReq{
 		Event:  event,
 		Fields: fields,
 		// Send "type" as well for backwards compatibility.
@@ -1302,7 +1302,7 @@ func (c *Client) PostSessionSlice(slice events.SessionSlice) error {
 	// we **must** consume response by reading all of its body, otherwise the http
 	// client will allocate a new connection for subsequent requests
 	defer re.Body.Close()
-	responseBytes, _ := io.ReadAll(re.Body)
+	responseBytes, _ := ioutil.ReadAll(re.Body)
 	return trace.ReadError(re.StatusCode, responseBytes)
 }
 
@@ -1313,7 +1313,7 @@ func (c *Client) GetSessionChunk(namespace string, sid session.ID, offsetBytes,
 	if namespace == "" {
 		return nil, trace.BadParameter(MissingNamespaceError)
 	}
-	response, err := c.Get(context.TODO(), c.Endpoint("namespaces", namespace, "sessions", string(sid), "stream"), url.Values{
+	response, err := c.Get(c.Endpoint("namespaces", namespace, "sessions", string(sid), "stream"), url.Values{
 		"offset": []string{strconv.Itoa(offsetBytes)},
 		"bytes":  []string{strconv.Itoa(maxBytes)},
 	})
@@ -1335,7 +1335,7 @@ func (c *Client) UploadSessionRecording(r events.SessionRecording) error {
 		"sid":       []string{string(r.SessionID)},
 		"namespace": []string{r.Namespace},
 	}
-	_, err := c.PostForm(context.TODO(), c.Endpoint("namespaces", r.Namespace, "sessions", string(r.SessionID), "recording"), values, file)
+	_, err := c.PostForm(c.Endpoint("namespaces", r.Namespace, "sessions", string(r.SessionID), "recording"), values, file)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1361,7 +1361,7 @@ func (c *Client) GetSessionEvents(namespace string, sid session.ID, afterN int,
 	if includePrintEvents {
 		query.Set("print", fmt.Sprintf("%v", includePrintEvents))
 	}
-	response, err := c.Get(context.TODO(), c.Endpoint("namespaces", namespace, "sessions", string(sid), "events"), query)
+	response, err := c.Get(c.Endpoint("namespaces", namespace, "sessions", string(sid), "events"), query)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1401,7 +1401,7 @@ func (c *Client) SearchSessionEvents(fromUTC, toUTC time.Time, limit int, order
 
 // GetNamespaces returns a list of namespaces
 func (c *Client) GetNamespaces() ([]types.Namespace, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("namespaces"), url.Values{})
+	out, err := c.Get(c.Endpoint("namespaces"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1417,7 +1417,7 @@ func (c *Client) GetNamespace(name string) (*types.Namespace, error) {
 	if name == "" {
 		return nil, trace.BadParameter("missing namespace name")
 	}
-	out, err := c.Get(context.TODO(), c.Endpoint("namespaces", name), url.Values{})
+	out, err := c.Get(c.Endpoint("namespaces", name), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1426,13 +1426,13 @@ func (c *Client) GetNamespace(name string) (*types.Namespace, error) {
 
 // UpsertNamespace upserts namespace
 func (c *Client) UpsertNamespace(ns types.Namespace) error {
-	_, err := c.PostJSON(context.TODO(), c.Endpoint("namespaces"), upsertNamespaceReq{Namespace: ns})
+	_, err := c.PostJSON(c.Endpoint("namespaces"), upsertNamespaceReq{Namespace: ns})
 	return trace.Wrap(err)
 }
 
 // DeleteNamespace deletes namespace by name
 func (c *Client) DeleteNamespace(name string) error {
-	_, err := c.Delete(context.TODO(), c.Endpoint("namespaces", name))
+	_, err := c.Delete(c.Endpoint("namespaces", name))
 	return trace.Wrap(err)
 }
 
@@ -1443,7 +1443,7 @@ func (c *Client) CreateRole(role types.Role) error {
 
 // GetClusterName returns a cluster name
 func (c *Client) GetClusterName(opts ...services.MarshalOption) (types.ClusterName, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("configuration", "name"), url.Values{})
+	out, err := c.Get(c.Endpoint("configuration", "name"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1464,7 +1464,7 @@ func (c *Client) SetClusterName(cn types.ClusterName) error {
 		return trace.Wrap(err)
 	}
 
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("configuration", "name"), &setClusterNameReq{ClusterName: data})
+	_, err = c.PostJSON(c.Endpoint("configuration", "name"), &setClusterNameReq{ClusterName: data})
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1479,13 +1479,13 @@ func (c *Client) UpsertClusterName(cn types.ClusterName) error {
 
 // DeleteStaticTokens deletes static tokens
 func (c *Client) DeleteStaticTokens() error {
-	_, err := c.Delete(context.TODO(), c.Endpoint("configuration", "static_tokens"))
+	_, err := c.Delete(c.Endpoint("configuration", "static_tokens"))
 	return trace.Wrap(err)
 }
 
 // GetStaticTokens returns a list of static register tokens
 func (c *Client) GetStaticTokens() (types.StaticTokens, error) {
-	out, err := c.Get(context.TODO(), c.Endpoint("configuration", "static_tokens"), url.Values{})
+	out, err := c.Get(c.Endpoint("configuration", "static_tokens"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1505,7 +1505,7 @@ func (c *Client) SetStaticTokens(st types.StaticTokens) error {
 		return trace.Wrap(err)
 	}
 
-	_, err = c.PostJSON(context.TODO(), c.Endpoint("configuration", "static_tokens"), &setStaticTokensReq{StaticTokens: data})
+	_, err = c.PostJSON(c.Endpoint("configuration", "static_tokens"), &setStaticTokensReq{StaticTokens: data})
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1548,11 +1548,6 @@ func (c *Client) DeleteAllRoles() error {
 	return trace.NotImplemented(notImplementedMessage)
 }
 
-// ListWindowsDesktops not implemented: can only be called locally.
-func (c *Client) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
-	return nil, trace.NotImplemented(notImplementedMessage)
-}
-
 // DeleteAllUsers not implemented: can only be called locally.
 func (c *Client) DeleteAllUsers() error {
 	return trace.NotImplemented(notImplementedMessage)
@@ -1564,7 +1559,7 @@ func (c *Client) ValidateTrustedCluster(ctx context.Context, validateRequest *Va
 		return nil, trace.Wrap(err)
 	}
 
-	out, err := c.PostJSON(ctx, c.Endpoint("trustedclusters", "validate"), validateRequestRaw)
+	out, err := c.PostJSON(c.Endpoint("trustedclusters", "validate"), validateRequestRaw)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1950,12 +1945,12 @@ type ClientI interface {
 	NewKeepAliver(ctx context.Context) (types.KeepAliver, error)
 
 	// RotateCertAuthority starts or restarts certificate authority rotation process.
-	RotateCertAuthority(ctx context.Context, req RotateRequest) error
+	RotateCertAuthority(req RotateRequest) error
 
 	// RotateExternalCertAuthority rotates external certificate authority,
 	// this method is used to update only public keys and certificates of the
 	// the certificate authorities of trusted clusters.
-	RotateExternalCertAuthority(ctx context.Context, ca types.CertAuthority) error
+	RotateExternalCertAuthority(ca types.CertAuthority) error
 
 	// ValidateTrustedCluster validates trusted cluster token with
 	// main cluster, in case if validation is successful, main cluster
diff --git a/lib/auth/clt_test.go b/lib/auth/clt_test.go
index e9c2c17cb8960..cf85030c03e54 100644
--- a/lib/auth/clt_test.go
+++ b/lib/auth/clt_test.go
@@ -17,25 +17,16 @@ limitations under the License.
 package auth
 
 import (
-	"context"
 	"crypto/tls"
-	"crypto/x509/pkix"
-	"net/http"
-	"net/http/httptest"
 	"testing"
 	"time"
 
 	apiclient "github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/session"
-	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 )
 
 func TestClient_DialTimeout(t *testing.T) {
-	t.Parallel()
 	cases := []struct {
 		desc    string
 		timeout time.Duration
@@ -86,85 +77,3 @@ func TestClient_DialTimeout(t *testing.T) {
 		})
 	}
 }
-
-func TestClient_RequestTimeout(t *testing.T) {
-	t.Parallel()
-
-	testDone := make(chan struct{})
-	sawRoot := make(chan bool, 1)
-	sawSlow := make(chan bool, 1)
-
-	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/v2/authorities/host/rotate/external":
-			sawRoot <- true
-			http.Redirect(w, r, "/slow", http.StatusFound)
-		case "/slow":
-			sawSlow <- true
-			w.Write([]byte("Hello"))
-			w.(http.Flusher).Flush()
-			<-testDone
-		}
-	}))
-	t.Cleanup(func() {
-		close(testDone)
-		srv.Close()
-	})
-
-	srv.TLS = &tls.Config{InsecureSkipVerify: true}
-
-	cfg := apiclient.Config{
-		Addrs: []string{srv.Listener.Addr().String()},
-		Credentials: []apiclient.Credentials{
-			apiclient.LoadTLS(srv.TLS),
-		},
-	}
-	clt, err := NewClient(cfg)
-	require.NoError(t, err)
-
-	srv.StartTLS()
-
-	ca := newCertAuthority(t, "test", types.HostCA)
-
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	t.Cleanup(cancel)
-
-	err = clt.RotateExternalCertAuthority(ctx, ca)
-	require.ErrorIs(t, trace.Unwrap(err), context.DeadlineExceeded)
-
-	close(sawRoot)
-	require.True(t, <-sawRoot, "handler never got /v2/authorities/host/rotate/external request")
-
-	close(sawSlow)
-	require.True(t, <-sawSlow, "handler never got /slow request")
-}
-
-func newCertAuthority(t *testing.T, name string, caType types.CertAuthType) types.CertAuthority {
-	ta := testauthority.New()
-	priv, pub, err := ta.GenerateKeyPair("")
-	require.NoError(t, err)
-
-	// CA for cluster1 with 1 key pair.
-	key, cert, err := tlsca.GenerateSelfSignedCA(pkix.Name{CommonName: name}, nil, time.Minute)
-	require.NoError(t, err)
-
-	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
-		Type:        caType,
-		ClusterName: name,
-		ActiveKeys: types.CAKeySet{
-			SSH: []*types.SSHKeyPair{{
-				PrivateKey:     priv,
-				PrivateKeyType: types.PrivateKeyType_RAW,
-				PublicKey:      pub,
-			}},
-			TLS: []*types.TLSKeyPair{{
-				Cert: cert,
-				Key:  key,
-			}},
-		},
-		Roles:      nil,
-		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_256,
-	})
-	require.NoError(t, err)
-	return ca
-}
diff --git a/lib/auth/db.go b/lib/auth/db.go
index dbb1cd87c4512..d9ca5a4c35266 100644
--- a/lib/auth/db.go
+++ b/lib/auth/db.go
@@ -43,7 +43,7 @@ func (s *Server) GenerateDatabaseCert(ctx context.Context, req *proto.DatabaseCe
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	hostCA, err := s.GetCertAuthority(ctx, types.CertAuthID{
+	hostCA, err := s.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
@@ -102,7 +102,7 @@ func (s *Server) SignDatabaseCSR(ctx context.Context, req *proto.DatabaseCSRRequ
 		return nil, trace.Wrap(err)
 	}
 
-	hostCA, err := s.GetCertAuthority(ctx, types.CertAuthID{
+	hostCA, err := s.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: req.ClusterName,
 	}, false)
@@ -144,7 +144,7 @@ func (s *Server) SignDatabaseCSR(ctx context.Context, req *proto.DatabaseCSRRequ
 	ttl := roles.AdjustSessionTTL(apidefaults.CertDuration)
 
 	// Generate the TLS certificate.
-	userCA, err := s.Trust.GetCertAuthority(ctx, types.CertAuthID{
+	userCA, err := s.Trust.GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
diff --git a/lib/auth/desktop.go b/lib/auth/desktop.go
index 1fd07b7526e7c..394b34717ad58 100644
--- a/lib/auth/desktop.go
+++ b/lib/auth/desktop.go
@@ -45,7 +45,7 @@ func (s *Server) GenerateWindowsDesktopCert(ctx context.Context, req *proto.Wind
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	userCA, err := s.GetCertAuthority(ctx, types.CertAuthID{
+	userCA, err := s.GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
diff --git a/lib/auth/github.go b/lib/auth/github.go
index 2872aeee55bfb..1477491396a2a 100644
--- a/lib/auth/github.go
+++ b/lib/auth/github.go
@@ -293,7 +293,7 @@ func (a *Server) validateGithubAuthCallback(q url.Values) (*githubAuthResponse,
 		re.auth.TLSCert = tlsCert
 
 		// Return the host CA for this cluster only.
-		authority, err := a.GetCertAuthority(ctx, types.CertAuthID{
+		authority, err := a.GetCertAuthority(types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName.GetClusterName(),
 		}, false)
diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go
index 105cd927cc5f3..4811125550916 100644
--- a/lib/auth/grpcserver.go
+++ b/lib/auth/grpcserver.go
@@ -1813,8 +1813,7 @@ func (g *GRPCServer) DeleteRole(ctx context.Context, req *proto.DeleteRoleReques
 func doMFAPresenceChallenge(ctx context.Context, actx *grpcContext, stream proto.AuthService_MaintainSessionPresenceServer, challengeReq *proto.PresenceMFAChallengeRequest) error {
 	user := actx.User.GetName()
 
-	const passwordless = false
-	authChallenge, err := actx.authServer.mfaAuthChallenge(ctx, user, passwordless)
+	authChallenge, err := actx.authServer.mfaAuthChallenge(ctx, user)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1836,7 +1835,7 @@ func doMFAPresenceChallenge(ctx context.Context, actx *grpcContext, stream proto
 		return trace.BadParameter("expected MFAAuthenticateResponse, got %T", challengeResp)
 	}
 
-	if _, _, err := actx.authServer.validateMFAAuthResponse(ctx, challengeResp, user, passwordless); err != nil {
+	if _, err := actx.authServer.validateMFAAuthResponse(ctx, user, challengeResp); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -1965,8 +1964,7 @@ func addMFADeviceAuthChallenge(gctx *grpcContext, stream proto.AuthService_AddMF
 	ctx := stream.Context()
 
 	// Note: authChallenge may be empty if this user has no existing MFA devices.
-	const passwordless = false
-	authChallenge, err := auth.mfaAuthChallenge(ctx, user, passwordless)
+	authChallenge, err := auth.mfaAuthChallenge(ctx, user)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1986,7 +1984,7 @@ func addMFADeviceAuthChallenge(gctx *grpcContext, stream proto.AuthService_AddMF
 	}
 	// Only validate if there was a challenge.
 	if authChallenge.TOTP != nil || authChallenge.WebauthnChallenge != nil {
-		if _, _, err := auth.validateMFAAuthResponse(ctx, authResp, user, passwordless); err != nil {
+		if _, err := auth.validateMFAAuthResponse(ctx, user, authResp); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -2008,7 +2006,6 @@ func addMFADeviceRegisterChallenge(gctx *grpcContext, stream proto.AuthService_A
 	res, err := auth.createRegisterChallenge(ctx, &newRegisterChallengeRequest{
 		username:            user,
 		deviceType:          initReq.DeviceType,
-		deviceUsage:         initReq.DeviceUsage,
 		webIdentityOverride: webIdentity,
 	})
 	if err != nil {
@@ -2091,8 +2088,7 @@ func deleteMFADeviceAuthChallenge(gctx *grpcContext, stream proto.AuthService_De
 	auth := gctx.authServer
 	user := gctx.User.GetName()
 
-	const passwordless = false
-	authChallenge, err := auth.mfaAuthChallenge(ctx, user, passwordless)
+	authChallenge, err := auth.mfaAuthChallenge(ctx, user)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -2111,7 +2107,7 @@ func deleteMFADeviceAuthChallenge(gctx *grpcContext, stream proto.AuthService_De
 	if authResp == nil {
 		return trace.BadParameter("expected MFAAuthenticateResponse, got %T", req)
 	}
-	if _, _, err := auth.validateMFAAuthResponse(ctx, authResp, user, passwordless); err != nil {
+	if _, err := auth.validateMFAAuthResponse(ctx, user, authResp); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -2255,8 +2251,7 @@ func userSingleUseCertsAuthChallenge(gctx *grpcContext, stream proto.AuthService
 	auth := gctx.authServer
 	user := gctx.User.GetName()
 
-	const passwordless = false
-	challenge, err := auth.mfaAuthChallenge(ctx, user, passwordless)
+	challenge, err := auth.mfaAuthChallenge(ctx, user)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2277,7 +2272,7 @@ func userSingleUseCertsAuthChallenge(gctx *grpcContext, stream proto.AuthService
 	if authResp == nil {
 		return nil, trace.BadParameter("expected MFAAuthenticateResponse, got %T", req.Request)
 	}
-	mfaDev, _, err := auth.validateMFAAuthResponse(ctx, authResp, user, passwordless)
+	mfaDev, err := auth.validateMFAAuthResponse(ctx, user, authResp)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3723,20 +3718,6 @@ func (g *GRPCServer) ListResources(ctx context.Context, req *proto.ListResources
 			}
 
 			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_KubeService{KubeService: srv}}
-		case types.KindWindowsDesktop:
-			desktop, ok := resource.(*types.WindowsDesktopV3)
-			if !ok {
-				return nil, trace.BadParameter("windows desktop has invalid type %T", resource)
-			}
-
-			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_WindowsDesktop{WindowsDesktop: desktop}}
-		case types.KindKubernetesCluster:
-			cluster, ok := resource.(*types.KubernetesClusterV3)
-			if !ok {
-				return nil, trace.BadParameter("kubernetes cluster has invalid type %T", resource)
-			}
-
-			protoResource = &proto.PaginatedResource{Resource: &proto.PaginatedResource_KubeCluster{KubeCluster: cluster}}
 		default:
 			return nil, trace.NotImplemented("resource type %s doesn't support pagination", req.ResourceType)
 		}
diff --git a/lib/auth/grpcserver_test.go b/lib/auth/grpcserver_test.go
index efb0df91a2ca1..0e82c5d768c20 100644
--- a/lib/auth/grpcserver_test.go
+++ b/lib/auth/grpcserver_test.go
@@ -88,8 +88,6 @@ func TestMFADeviceManagement(t *testing.T) {
 	require.NoError(t, err)
 	webKey2.PreferRPID = true
 	const webDev2Name = "webauthn2"
-	const pwdlessDevName = "pwdless"
-
 	addTests := []struct {
 		desc string
 		opts mfaAddTestOpts
@@ -231,41 +229,6 @@ func TestMFADeviceManagement(t *testing.T) {
 				},
 			},
 		},
-		{
-			desc: "add passwordless device",
-			opts: mfaAddTestOpts{
-				initReq: &proto.AddMFADeviceRequestInit{
-					DeviceName:  pwdlessDevName,
-					DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
-					DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
-				},
-				authHandler:  devs.webAuthHandler,
-				checkAuthErr: require.NoError,
-				registerHandler: func(t *testing.T, challenge *proto.MFARegisterChallenge) *proto.MFARegisterResponse {
-					require.NotNil(t, challenge.GetWebauthn(), "WebAuthn challenge cannot be nil")
-
-					key, err := mocku2f.Create()
-					require.NoError(t, err)
-					key.PreferRPID = true
-					key.SetPasswordless()
-
-					ccr, err := key.SignCredentialCreation(webOrigin, wanlib.CredentialCreationFromProto(challenge.GetWebauthn()))
-					require.NoError(t, err)
-
-					return &proto.MFARegisterResponse{
-						Response: &proto.MFARegisterResponse_Webauthn{
-							Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
-						},
-					}
-				},
-				checkRegisterErr: require.NoError,
-				assertRegisteredDev: func(t *testing.T, dev *types.MFADevice) {
-					// Do a few simple device checks - lib/auth/webauthn goes in depth.
-					require.NotNil(t, dev.GetWebauthn(), "WebAuthnDevice cannot be nil")
-					require.True(t, true, dev.GetWebauthn().ResidentKey, "ResidentKey should be set to true")
-				},
-			},
-		},
 	}
 	for _, tt := range addTests {
 		t.Run(tt.desc, func(t *testing.T) {
@@ -283,7 +246,7 @@ func TestMFADeviceManagement(t *testing.T) {
 		deviceIDs[dev.GetName()] = dev.Id
 	}
 	sort.Strings(deviceNames)
-	require.Equal(t, deviceNames, []string{pwdlessDevName, devs.TOTPName, devs.WebName, webDev2Name})
+	require.Equal(t, deviceNames, []string{devs.TOTPName, devs.WebName, webDev2Name})
 
 	// Delete several of the MFA devices.
 	deleteTests := []struct {
@@ -358,16 +321,6 @@ func TestMFADeviceManagement(t *testing.T) {
 				checkErr:    require.NoError,
 			},
 		},
-		{
-			desc: "delete pwdless device by name",
-			opts: mfaDeleteTestOpts{
-				initReq: &proto.DeleteMFADeviceRequestInit{
-					DeviceName: pwdlessDevName,
-				},
-				authHandler: devs.webAuthHandler,
-				checkErr:    require.NoError,
-			},
-		},
 		{
 			desc: "delete webauthn device by name",
 			opts: mfaDeleteTestOpts{
@@ -1881,11 +1834,11 @@ func TestListResources(t *testing.T) {
 
 	testCases := map[string]struct {
 		resourceType   string
-		createResource func(name string, clt *Client) error
+		createResource func(name string) error
 	}{
 		"DatabaseServers": {
 			resourceType: types.KindDatabaseServer,
-			createResource: func(name string, clt *Client) error {
+			createResource: func(name string) error {
 				server, err := types.NewDatabaseServerV3(types.Metadata{
 					Name: name,
 				}, types.DatabaseServerSpecV3{
@@ -1904,7 +1857,7 @@ func TestListResources(t *testing.T) {
 		},
 		"ApplicationServers": {
 			resourceType: types.KindAppServer,
-			createResource: func(name string, clt *Client) error {
+			createResource: func(name string) error {
 				app, err := types.NewAppV3(types.Metadata{
 					Name: name,
 				}, types.AppSpecV3{
@@ -1931,7 +1884,7 @@ func TestListResources(t *testing.T) {
 		},
 		"KubeService": {
 			resourceType: types.KindKubeService,
-			createResource: func(name string, clt *Client) error {
+			createResource: func(name string) error {
 				server, err := types.NewServer(name, types.KindKubeService, types.ServerSpecV2{
 					KubernetesClusters: []*types.KubernetesCluster{
 						{Name: name, StaticLabels: map[string]string{"name": name}},
@@ -1946,7 +1899,7 @@ func TestListResources(t *testing.T) {
 		},
 		"Node": {
 			resourceType: types.KindNode,
-			createResource: func(name string, clt *Client) error {
+			createResource: func(name string) error {
 				server, err := types.NewServer(name, types.KindNode, types.ServerSpecV2{})
 				if err != nil {
 					return err
@@ -1956,25 +1909,10 @@ func TestListResources(t *testing.T) {
 				return err
 			},
 		},
-		"WindowsDesktops": {
-			resourceType: types.KindWindowsDesktop,
-			createResource: func(name string, clt *Client) error {
-				desktop, err := types.NewWindowsDesktopV3(name, nil,
-					types.WindowsDesktopSpecV3{Addr: "_", HostID: "_"})
-				if err != nil {
-					return err
-				}
-
-				return clt.UpsertWindowsDesktop(ctx, desktop)
-			},
-		},
 	}
 
 	for name, test := range testCases {
-		name := name
-		test := test
 		t.Run(name, func(t *testing.T) {
-			t.Parallel()
 			resp, err := clt.ListResources(ctx, proto.ListResourcesRequest{
 				ResourceType: test.resourceType,
 				Namespace:    apidefaults.Namespace,
@@ -1985,9 +1923,9 @@ func TestListResources(t *testing.T) {
 			require.Empty(t, resp.NextKey)
 
 			// create two resources
-			err = test.createResource("foo", clt)
+			err = test.createResource("foo")
 			require.NoError(t, err)
-			err = test.createResource("bar", clt)
+			err = test.createResource("bar")
 			require.NoError(t, err)
 
 			resp, err = clt.ListResources(ctx, proto.ListResourcesRequest{
@@ -2000,20 +1938,6 @@ func TestListResources(t *testing.T) {
 			require.Empty(t, resp.NextKey)
 			require.Empty(t, resp.TotalCount)
 
-			// Test types.KindKubernetesCluster
-			if test.resourceType == types.KindKubeService {
-				test.resourceType = types.KindKubernetesCluster
-				resp, err = clt.ListResources(ctx, proto.ListResourcesRequest{
-					ResourceType: test.resourceType,
-					Namespace:    apidefaults.Namespace,
-					Limit:        100,
-				})
-				require.NoError(t, err)
-				require.Len(t, resp.Resources, 2)
-				require.Empty(t, resp.NextKey)
-				require.Empty(t, resp.TotalCount)
-			}
-
 			// Test listing with NeedTotalCount flag.
 			if test.resourceType != types.KindKubeService {
 				resp, err = clt.ListResources(ctx, proto.ListResourcesRequest{
@@ -2042,75 +1966,62 @@ func TestListResources(t *testing.T) {
 func TestCustomRateLimiting(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
-	tests := []struct {
-		name  string
-		burst int
-		fn    func(*Client) error
+	cases := []struct {
+		name string
+		fn   func(*Client) error
 	}{
 		{
 			name: "RPC ChangeUserAuthentication",
 			fn: func(clt *Client) error {
-				_, err := clt.ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{})
-				return err
-			},
-		},
-		{
-			name:  "RPC CreateAuthenticateChallenge",
-			burst: defaults.LimiterPasswordlessBurst,
-			fn: func(clt *Client) error {
-				_, err := clt.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{})
+				_, err := clt.ChangeUserAuthentication(context.Background(), &proto.ChangeUserAuthenticationRequest{})
 				return err
 			},
 		},
 		{
 			name: "RPC GetAccountRecoveryToken",
 			fn: func(clt *Client) error {
-				_, err := clt.GetAccountRecoveryToken(ctx, &proto.GetAccountRecoveryTokenRequest{})
+				_, err := clt.GetAccountRecoveryToken(context.Background(), &proto.GetAccountRecoveryTokenRequest{})
 				return err
 			},
 		},
 		{
 			name: "RPC StartAccountRecovery",
 			fn: func(clt *Client) error {
-				_, err := clt.StartAccountRecovery(ctx, &proto.StartAccountRecoveryRequest{})
+				_, err := clt.StartAccountRecovery(context.Background(), &proto.StartAccountRecoveryRequest{})
 				return err
 			},
 		},
 		{
 			name: "RPC VerifyAccountRecovery",
 			fn: func(clt *Client) error {
-				_, err := clt.VerifyAccountRecovery(ctx, &proto.VerifyAccountRecoveryRequest{})
+				_, err := clt.VerifyAccountRecovery(context.Background(), &proto.VerifyAccountRecoveryRequest{})
 				return err
 			},
 		},
 	}
-	for _, test := range tests {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
+
+	for _, c := range cases {
+		c := c
+		t.Run(c.name, func(t *testing.T) {
 			t.Parallel()
 
-			// Create new instance per test case, to troubleshoot which test case
-			// specifically failed, otherwise multiple cases can fail from running
-			// cases in parallel.
+			// For now since we only have one custom rate limit,
+			// test limit for 1 request per minute with bursts up to 10 requests.
+			const maxAttempts = 11
+			var err error
+
+			// Create new instance per test case, to troubleshoot
+			// which test case specifically failed, otherwise
+			// multiple cases can fail from running cases in parallel.
 			srv := newTestTLSServer(t)
 			clt, err := srv.NewClient(TestNop())
 			require.NoError(t, err)
 
-			var attempts int
-			if test.burst == 0 {
-				attempts = 10 // Good for most tests.
-			} else {
-				attempts = test.burst
+			for i := 0; i < maxAttempts; i++ {
+				err = c.fn(clt)
+				require.Error(t, err)
 			}
-
-			for i := 0; i < attempts; i++ {
-				err = test.fn(clt)
-				require.False(t, trace.IsLimitExceeded(err), "got err = %v, want non-IsLimitExceeded", err)
-			}
-
-			err = test.fn(clt)
-			require.True(t, trace.IsLimitExceeded(err), "got err = %v, want LimitExceeded", err)
+			require.True(t, trace.IsLimitExceeded(err))
 		})
 	}
 }
diff --git a/lib/auth/helpers.go b/lib/auth/helpers.go
index f9007cd3f6a48..397aeb6d02f1a 100644
--- a/lib/auth/helpers.go
+++ b/lib/auth/helpers.go
@@ -486,8 +486,8 @@ func (a *TestAuthServer) Clock() clockwork.Clock {
 }
 
 // Trust adds other server host certificate authority as trusted
-func (a *TestAuthServer) Trust(ctx context.Context, remote *TestAuthServer, roleMap types.RoleMap) error {
-	remoteCA, err := remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+func (a *TestAuthServer) Trust(remote *TestAuthServer, roleMap types.RoleMap) error {
+	remoteCA, err := remote.AuthServer.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: remote.ClusterName,
 	}, false)
@@ -498,7 +498,7 @@ func (a *TestAuthServer) Trust(ctx context.Context, remote *TestAuthServer, role
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	remoteCA, err = remote.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+	remoteCA, err = remote.AuthServer.GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: remote.ClusterName,
 	}, false)
@@ -923,7 +923,7 @@ type clt interface {
 
 // CreateRole creates a role without assigning any users. Used in tests.
 func CreateRole(ctx context.Context, clt clt, name string, spec types.RoleSpecV5) (types.Role, error) {
-	role, err := types.NewRoleV3(name, spec)
+	role, err := types.NewRole(name, spec)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/httpfallback.go b/lib/auth/httpfallback.go
index fc0fcfd6f8b6c..0ff46995a0575 100644
--- a/lib/auth/httpfallback.go
+++ b/lib/auth/httpfallback.go
@@ -48,7 +48,7 @@ func (c *Client) UpsertRole(ctx context.Context, role types.Role) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(ctx, c.Endpoint("roles"), &upsertRoleRawReq{Role: data})
+	_, err = c.PostJSON(c.Endpoint("roles"), &upsertRoleRawReq{Role: data})
 	return trace.Wrap(err)
 }
 
@@ -65,7 +65,7 @@ func (c *Client) GetRole(ctx context.Context, name string) (types.Role, error) {
 	if name == "" {
 		return nil, trace.BadParameter("missing name")
 	}
-	out, err := c.Get(ctx, c.Endpoint("roles", name), url.Values{})
+	out, err := c.Get(c.Endpoint("roles", name), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -89,7 +89,7 @@ func (c *Client) DeleteRole(ctx context.Context, name string) error {
 	if name == "" {
 		return trace.BadParameter("missing name")
 	}
-	_, err := c.Delete(ctx, c.Endpoint("roles", name))
+	_, err := c.Delete(c.Endpoint("roles", name))
 	return trace.Wrap(err)
 }
 
@@ -103,7 +103,7 @@ func (c *Client) GetTokens(ctx context.Context, opts ...services.MarshalOption)
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("tokens"), url.Values{})
+	out, err := c.Get(c.Endpoint("tokens"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -124,7 +124,7 @@ func (c *Client) GetToken(ctx context.Context, token string) (types.ProvisionTok
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("tokens", token), url.Values{})
+	out, err := c.Get(c.Endpoint("tokens", token), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -142,7 +142,7 @@ func (c *Client) DeleteToken(ctx context.Context, token string) error {
 		return nil
 	}
 
-	_, err := c.Delete(ctx, c.Endpoint("tokens", token))
+	_, err := c.Delete(c.Endpoint("tokens", token))
 	return trace.Wrap(err)
 }
 
@@ -160,7 +160,7 @@ func (c *Client) UpsertOIDCConnector(ctx context.Context, connector types.OIDCCo
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PostJSON(ctx, c.Endpoint("oidc", "connectors"), &upsertOIDCConnectorRawReq{
+	_, err = c.PostJSON(c.Endpoint("oidc", "connectors"), &upsertOIDCConnectorRawReq{
 		Connector: data,
 	})
 	if err != nil {
@@ -182,7 +182,7 @@ func (c *Client) GetOIDCConnector(ctx context.Context, id string, withSecrets bo
 	if id == "" {
 		return nil, trace.BadParameter("missing connector id")
 	}
-	out, err := c.Get(ctx, c.Endpoint("oidc", "connectors", id),
+	out, err := c.Get(c.Endpoint("oidc", "connectors", id),
 		url.Values{"with_secrets": []string{fmt.Sprintf("%t", withSecrets)}})
 	if err != nil {
 		return nil, err
@@ -200,7 +200,7 @@ func (c *Client) GetOIDCConnectors(ctx context.Context, withSecrets bool) ([]typ
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("oidc", "connectors"),
+	out, err := c.Get(c.Endpoint("oidc", "connectors"),
 		url.Values{"with_secrets": []string{fmt.Sprintf("%t", withSecrets)}})
 	if err != nil {
 		return nil, err
@@ -233,7 +233,7 @@ func (c *Client) DeleteOIDCConnector(ctx context.Context, connectorID string) er
 	if connectorID == "" {
 		return trace.BadParameter("missing connector id")
 	}
-	_, err := c.Delete(ctx, c.Endpoint("oidc", "connectors", connectorID))
+	_, err := c.Delete(c.Endpoint("oidc", "connectors", connectorID))
 	return trace.Wrap(err)
 }
 
@@ -251,7 +251,7 @@ func (c *Client) UpsertSAMLConnector(ctx context.Context, connector types.SAMLCo
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PutJSON(ctx, c.Endpoint("saml", "connectors"), &upsertSAMLConnectorRawReq{
+	_, err = c.PutJSON(c.Endpoint("saml", "connectors"), &upsertSAMLConnectorRawReq{
 		Connector: data,
 	})
 	if err != nil {
@@ -273,7 +273,7 @@ func (c *Client) GetSAMLConnector(ctx context.Context, id string, withSecrets bo
 	if id == "" {
 		return nil, trace.BadParameter("missing connector id")
 	}
-	out, err := c.Get(ctx, c.Endpoint("saml", "connectors", id),
+	out, err := c.Get(c.Endpoint("saml", "connectors", id),
 		url.Values{"with_secrets": []string{fmt.Sprintf("%t", withSecrets)}})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -291,7 +291,7 @@ func (c *Client) GetSAMLConnectors(ctx context.Context, withSecrets bool) ([]typ
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("saml", "connectors"),
+	out, err := c.Get(c.Endpoint("saml", "connectors"),
 		url.Values{"with_secrets": []string{fmt.Sprintf("%t", withSecrets)}})
 	if err != nil {
 		return nil, err
@@ -324,7 +324,7 @@ func (c *Client) DeleteSAMLConnector(ctx context.Context, connectorID string) er
 	if connectorID == "" {
 		return trace.BadParameter("missing connector id")
 	}
-	_, err := c.Delete(ctx, c.Endpoint("saml", "connectors", connectorID))
+	_, err := c.Delete(c.Endpoint("saml", "connectors", connectorID))
 	return trace.Wrap(err)
 }
 
@@ -342,7 +342,7 @@ func (c *Client) UpsertGithubConnector(ctx context.Context, connector types.Gith
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	_, err = c.PutJSON(ctx, c.Endpoint("github", "connectors"), &upsertGithubConnectorRawReq{
+	_, err = c.PutJSON(c.Endpoint("github", "connectors"), &upsertGithubConnectorRawReq{
 		Connector: bytes,
 	})
 	if err != nil {
@@ -361,7 +361,7 @@ func (c *Client) GetGithubConnectors(ctx context.Context, withSecrets bool) ([]t
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("github", "connectors"), url.Values{
+	out, err := c.Get(c.Endpoint("github", "connectors"), url.Values{
 		"with_secrets": []string{strconv.FormatBool(withSecrets)},
 	})
 	if err != nil {
@@ -392,7 +392,7 @@ func (c *Client) GetGithubConnector(ctx context.Context, id string, withSecrets
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("github", "connectors", id), url.Values{
+	out, err := c.Get(c.Endpoint("github", "connectors", id), url.Values{
 		"with_secrets": []string{strconv.FormatBool(withSecrets)},
 	})
 	if err != nil {
@@ -411,7 +411,7 @@ func (c *Client) DeleteGithubConnector(ctx context.Context, id string) error {
 		return nil
 	}
 
-	_, err := c.Delete(ctx, c.Endpoint("github", "connectors", id))
+	_, err := c.Delete(c.Endpoint("github", "connectors", id))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -427,7 +427,7 @@ func (c *Client) GetTrustedCluster(ctx context.Context, name string) (types.Trus
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("trustedclusters", name), url.Values{})
+	out, err := c.Get(c.Endpoint("trustedclusters", name), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -449,7 +449,7 @@ func (c *Client) GetTrustedClusters(ctx context.Context) ([]types.TrustedCluster
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("trustedclusters"), url.Values{})
+	out, err := c.Get(c.Endpoint("trustedclusters"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -484,7 +484,7 @@ func (c *Client) UpsertTrustedCluster(ctx context.Context, trustedCluster types.
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	out, err := c.PostJSON(ctx, c.Endpoint("trustedclusters"), &upsertTrustedClusterReq{
+	out, err := c.PostJSON(c.Endpoint("trustedclusters"), &upsertTrustedClusterReq{
 		TrustedCluster: trustedClusterBytes,
 	})
 	if err != nil {
@@ -503,7 +503,7 @@ func (c *Client) DeleteTrustedCluster(ctx context.Context, name string) error {
 		return nil
 	}
 
-	_, err := c.Delete(ctx, c.Endpoint("trustedclusters", name))
+	_, err := c.Delete(c.Endpoint("trustedclusters", name))
 	return trace.Wrap(err)
 }
 
@@ -517,7 +517,7 @@ func (c *Client) DeleteAllNodes(ctx context.Context, namespace string) error {
 		return nil
 	}
 
-	_, err := c.Delete(ctx, c.Endpoint("namespaces", namespace, "nodes"))
+	_, err := c.Delete(c.Endpoint("namespaces", namespace, "nodes"))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -534,7 +534,7 @@ func (c *Client) DeleteNode(ctx context.Context, namespace string, name string)
 		return nil
 	}
 
-	_, err := c.Delete(ctx, c.Endpoint("namespaces", namespace, "nodes", name))
+	_, err := c.Delete(c.Endpoint("namespaces", namespace, "nodes", name))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -548,9 +548,6 @@ type nodeClient interface {
 
 // GetNodesWithLabels is a helper for getting a list of nodes with optional label-based filtering.  This is essentially
 // a wrapper around client.GetNodesWithLabels that performs fallback on NotImplemented errors.
-//
-// DELETE IN 11.0.0, this function is only called by lib/client/client.go (*ProxyClient).FindServersByLabels
-// which is also marked for deletion (replaced by FindNodesByFilters).
 func GetNodesWithLabels(ctx context.Context, clt nodeClient, namespace string, labels map[string]string) ([]types.Server, error) {
 	nodes, err := client.GetNodesWithLabels(ctx, clt, namespace, labels)
 	if err == nil || !trace.IsNotImplemented(err) {
@@ -576,8 +573,6 @@ func GetNodesWithLabels(ctx context.Context, clt nodeClient, namespace string, l
 }
 
 // GetNodes returns the list of servers registered in the cluster.
-//
-// DELETE IN 11.0.0, replaced by GetResourcesWithFilters
 func (c *Client) GetNodes(ctx context.Context, namespace string, opts ...services.MarshalOption) ([]types.Server, error) {
 	if resp, err := c.APIClient.GetNodes(ctx, namespace); err != nil {
 		if !trace.IsNotImplemented(err) {
@@ -587,7 +582,7 @@ func (c *Client) GetNodes(ctx context.Context, namespace string, opts ...service
 		return resp, nil
 	}
 
-	out, err := c.Get(ctx, c.Endpoint("namespaces", namespace, "nodes"), url.Values{})
+	out, err := c.Get(c.Endpoint("namespaces", namespace, "nodes"), url.Values{})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/init.go b/lib/auth/init.go
index c99c245900d0f..b831e3040985d 100644
--- a/lib/auth/init.go
+++ b/lib/auth/init.go
@@ -203,7 +203,7 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 	// if resources are supplied, use them to bootstrap backend state
 	// on initial startup.
 	if len(cfg.Resources) > 0 {
-		firstStart, err := isFirstStart(ctx, asrv, cfg)
+		firstStart, err := isFirstStart(asrv, cfg)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -318,7 +318,7 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 	// generate certificate authorities if they don't exist
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
 		caID := types.CertAuthID{Type: caType, DomainName: cfg.ClusterName.GetClusterName()}
-		ca, err := asrv.GetCertAuthority(ctx, caID, true)
+		ca, err := asrv.GetCertAuthority(caID, true)
 		if err != nil {
 			if !trace.IsNotFound(err) {
 				return nil, trace.Wrap(err)
@@ -343,11 +343,11 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 					// without any active keys. These keys will not be used for
 					// any signing operations until a CA rotation. Only the Host
 					// CA is necessary to issue the Admin identity.
-					if err := asrv.ensureLocalAdditionalKeys(ctx, ca); err != nil {
+					if err := asrv.ensureLocalAdditionalKeys(ca); err != nil {
 						return nil, trace.Wrap(err)
 					}
 					// reload updated CA for below checks
-					if ca, err = asrv.GetCertAuthority(ctx, caID, true); err != nil {
+					if ca, err = asrv.GetCertAuthority(caID, true); err != nil {
 						return nil, trace.Wrap(err)
 					}
 				}
@@ -367,7 +367,7 @@ func Init(cfg InitConfig, opts ...ServerOption) (*Server, error) {
 
 	// Delete any unused keys from the keyStore. This is to avoid exhausting
 	// (or wasting) HSM resources.
-	if err := asrv.deleteUnusedKeys(ctx); err != nil {
+	if err := asrv.deleteUnusedKeys(); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -515,10 +515,9 @@ func createPresets(asrv *Server) error {
 
 // isFirstStart returns 'true' if the auth server is starting for the 1st time
 // on this server.
-func isFirstStart(ctx context.Context, authServer *Server, cfg InitConfig) (bool, error) {
+func isFirstStart(authServer *Server, cfg InitConfig) (bool, error) {
 	// check if the CA exists?
 	_, err := authServer.GetCertAuthority(
-		ctx,
 		types.CertAuthID{
 			DomainName: cfg.ClusterName.GetClusterName(),
 			Type:       types.HostCA,
@@ -571,11 +570,6 @@ func checkResourceConsistency(keyStore keystore.KeyStore, clusterName string, re
 			if r.GetName() == clusterName {
 				return trace.BadParameter("trusted cluster has same name as local cluster (%q)", clusterName)
 			}
-		case types.Role:
-			// Some options are only available with enterprise subscription
-			if err := checkRoleFeatureSupport(r); err != nil {
-				return trace.Wrap(err)
-			}
 		default:
 			// No validation checks for this resource type
 		}
@@ -954,7 +948,7 @@ func migrateRemoteClusters(ctx context.Context, asrv *Server) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	certAuthorities, err := asrv.GetCertAuthorities(ctx, types.HostCA, false)
+	certAuthorities, err := asrv.GetCertAuthorities(types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1005,7 +999,7 @@ func migrateRemoteClusters(ctx context.Context, asrv *Server) error {
 func migrateCertAuthorities(ctx context.Context, asrv *Server) error {
 	var errors []error
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
-		cas, err := asrv.GetCertAuthorities(ctx, caType, true)
+		cas, err := asrv.GetCertAuthorities(caType, true)
 		if err != nil {
 			errors = append(errors, trace.Wrap(err, "fetching %v CAs", caType))
 			continue
diff --git a/lib/auth/init_test.go b/lib/auth/init_test.go
index 08c25e725aa1c..e26569f6764f9 100644
--- a/lib/auth/init_test.go
+++ b/lib/auth/init_test.go
@@ -446,14 +446,13 @@ func TestClusterName(t *testing.T) {
 }
 
 func TestCASigningAlg(t *testing.T) {
-	ctx := context.Background()
 	verifyCAs := func(auth *Server, alg string) {
-		hostCAs, err := auth.GetCertAuthorities(ctx, types.HostCA, false)
+		hostCAs, err := auth.GetCertAuthorities(types.HostCA, false)
 		require.NoError(t, err)
 		for _, ca := range hostCAs {
 			require.Equal(t, sshutils.GetSigningAlgName(ca), alg)
 		}
-		userCAs, err := auth.GetCertAuthorities(ctx, types.UserCA, false)
+		userCAs, err := auth.GetCertAuthorities(types.UserCA, false)
 		require.NoError(t, err)
 		for _, ca := range userCAs {
 			require.Equal(t, sshutils.GetSigningAlgName(ca), alg)
@@ -636,7 +635,7 @@ func TestMigrateCertAuthorities(t *testing.T) {
 	var caSpecs []types.CertAuthoritySpecV2
 	for _, typ := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
 		t.Run(fmt.Sprintf("verify %v CA", typ), func(t *testing.T) {
-			cas, err := as.GetCertAuthorities(ctx, typ, true)
+			cas, err := as.GetCertAuthorities(typ, true)
 			require.NoError(t, err)
 			require.Len(t, cas, 1)
 			caSpecs = append(caSpecs, cas[0].(*types.CertAuthorityV2).Spec)
@@ -858,7 +857,7 @@ func TestIdentityChecker(t *testing.T) {
 	clusterName, err := authServer.GetDomainName()
 	require.NoError(t, err)
 
-	ca, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := authServer.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName,
 	}, true)
diff --git a/lib/auth/join.go b/lib/auth/join.go
index c50401c55713f..6c0754034a8db 100644
--- a/lib/auth/join.go
+++ b/lib/auth/join.go
@@ -108,10 +108,7 @@ func (a *Server) generateCerts(ctx context.Context, provisionToken types.Provisi
 	if req.Role == types.RoleBot {
 		// bots use this endpoint but get a user cert
 		// botResourceName must be set, enforced in CheckAndSetDefaults
-		botName := provisionToken.GetBotName()
-
-		// Append `bot-` to the bot name to derive its username.
-		botResourceName := BotResourceName(botName)
+		botResourceName := provisionToken.GetBotName()
 		expires := a.GetClock().Now().Add(defaults.DefaultRenewableCertTTL)
 
 		joinMethod := provisionToken.GetJoinMethod()
@@ -144,7 +141,7 @@ func (a *Server) generateCerts(ctx context.Context, provisionToken types.Provisi
 			return nil, trace.BadParameter("unsupported join method %q for bot", joinMethod)
 		}
 
-		log.Infof("Bot %q has joined the cluster.", botName)
+		log.Infof("Bot %q has joined the cluster.", botResourceName)
 		return certs, nil
 	}
 	// generate and return host certificate and keys
diff --git a/lib/auth/join_test.go b/lib/auth/join_test.go
index 55654b9f06ce2..f6c8b04f32e26 100644
--- a/lib/auth/join_test.go
+++ b/lib/auth/join_test.go
@@ -254,11 +254,11 @@ func TestAuth_RegisterUsingToken(t *testing.T) {
 	}
 }
 
-func newBotToken(t *testing.T, tokenName, botName string, role types.SystemRole, expiry time.Time) types.ProvisionToken {
+func newBotToken(t *testing.T, tokenName, user string, role types.SystemRole, expiry time.Time) types.ProvisionToken {
 	t.Helper()
 	token, err := types.NewProvisionTokenFromSpec(tokenName, expiry, types.ProvisionTokenSpecV2{
 		Roles:   []types.SystemRole{role},
-		BotName: botName,
+		BotName: user,
 	})
 	require.NoError(t, err, "could not create bot token")
 	return token
@@ -271,22 +271,19 @@ func TestRegister_Bot(t *testing.T) {
 
 	srv := newTestTLSServer(t)
 
-	botName := "test"
-	botResourceName := BotResourceName(botName)
-
 	_, err := createBotRole(context.Background(), srv.Auth(), "test", "bot-test", []string{})
 	require.NoError(t, err)
 
-	_, err = createBotUser(context.Background(), srv.Auth(), botName, botResourceName)
+	user, err := createBotUser(context.Background(), srv.Auth(), "test", "bot-test")
 	require.NoError(t, err)
 
 	later := srv.Clock().Now().Add(4 * time.Hour)
 
-	goodToken := newBotToken(t, "good-token", botName, types.RoleBot, later)
-	expiredToken := newBotToken(t, "expired", botName, types.RoleBot, srv.Clock().Now().Add(-1*time.Hour))
+	goodToken := newBotToken(t, "good-token", user.GetName(), types.RoleBot, later)
+	expiredToken := newBotToken(t, "expired", user.GetName(), types.RoleBot, srv.Clock().Now().Add(-1*time.Hour))
 	wrongKind := newBotToken(t, "wrong-kind", "", types.RoleNode, later)
 	wrongUser := newBotToken(t, "wrong-user", "llama", types.RoleBot, later)
-	invalidToken := newBotToken(t, "this-token-does-not-exist", botName, types.RoleBot, later)
+	invalidToken := newBotToken(t, "this-token-does-not-exist", user.GetName(), types.RoleBot, later)
 
 	err = srv.Auth().UpsertToken(context.Background(), goodToken)
 	require.NoError(t, err)
diff --git a/lib/auth/kube.go b/lib/auth/kube.go
index 6ca9d970bc6b1..54a9a76b9264d 100644
--- a/lib/auth/kube.go
+++ b/lib/auth/kube.go
@@ -17,7 +17,6 @@ limitations under the License.
 package auth
 
 import (
-	"context"
 	"time"
 
 	"github.com/gravitational/teleport"
@@ -63,7 +62,6 @@ type KubeCSRResponse struct {
 // ProcessKubeCSR processes CSR request against Kubernetes CA, returns
 // signed certificate if successful.
 func (s *Server) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
-	ctx := context.TODO()
 	if !modules.GetModules().Features().Kubernetes {
 		return nil, trace.AccessDenied(
 			"this Teleport cluster is not licensed for Kubernetes, please contact the cluster administrator")
@@ -81,7 +79,7 @@ func (s *Server) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
 	// with special provisions.
 	log.Debugf("Generating certificate to access remote Kubernetes clusters.")
 
-	hostCA, err := s.GetCertAuthority(ctx, types.CertAuthID{
+	hostCA, err := s.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: req.ClusterName,
 	}, false)
@@ -111,7 +109,7 @@ func (s *Server) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
 	roleNames := id.Groups
 	// This is a remote user, map roles to local roles first.
 	if id.TeleportCluster != clusterName.GetClusterName() {
-		ca, err := s.GetCertAuthority(ctx, types.CertAuthID{Type: types.UserCA, DomainName: id.TeleportCluster}, false)
+		ca, err := s.GetCertAuthority(types.CertAuthID{Type: types.UserCA, DomainName: id.TeleportCluster}, false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -132,7 +130,7 @@ func (s *Server) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
 	// Get the correct cert TTL based on roles.
 	ttl := roles.AdjustSessionTTL(apidefaults.CertDuration)
 
-	userCA, err := s.Trust.GetCertAuthority(ctx, types.CertAuthID{
+	userCA, err := s.Trust.GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: clusterName.GetClusterName(),
 	}, true)
diff --git a/lib/auth/methods.go b/lib/auth/methods.go
index 9a2d486a99909..a831d5b795284 100644
--- a/lib/auth/methods.go
+++ b/lib/auth/methods.go
@@ -48,11 +48,10 @@ type AuthenticateUserRequest struct {
 
 // CheckAndSetDefaults checks and sets defaults
 func (a *AuthenticateUserRequest) CheckAndSetDefaults() error {
-	switch {
-	case a.Username == "" && a.Webauthn != nil: // OK, passwordless.
-	case a.Username == "":
+	if a.Username == "" {
 		return trace.BadParameter("missing parameter 'username'")
-	case a.Pass == nil && a.Webauthn == nil && a.OTP == nil && a.Session == nil:
+	}
+	if a.Pass == nil && a.Webauthn == nil && a.OTP == nil && a.Session == nil {
 		return trace.BadParameter("at least one authentication method is required")
 	}
 	return nil
@@ -78,28 +77,16 @@ type SessionCreds struct {
 	ID string `json:"id"`
 }
 
-// AuthenticateUser authenticates user based on the request type.
-// Returns the username of the authenticated user.
-func (s *Server) AuthenticateUser(req AuthenticateUserRequest) (string, error) {
-	user := req.Username
-
-	mfaDev, actualUser, err := s.authenticateUser(context.TODO(), req)
-	// err is handled below.
-	switch {
-	case user != "" && actualUser != "" && user != actualUser:
-		log.Warnf("Authenticate user mismatch (%q vs %q). Using request user (%q)", user, actualUser, user)
-	case user == "" && actualUser != "":
-		log.Debugf("User %q authenticated via passwordless", actualUser)
-		user = actualUser
-	}
-
+// AuthenticateUser authenticates user based on the request type
+func (s *Server) AuthenticateUser(req AuthenticateUserRequest) error {
+	mfaDev, err := s.authenticateUser(context.TODO(), req)
 	event := &apievents.UserLogin{
 		Metadata: apievents.Metadata{
 			Type: events.UserLoginEvent,
 			Code: events.UserLocalLoginFailureCode,
 		},
 		UserMetadata: apievents.UserMetadata{
-			User: user,
+			User: req.Username,
 		},
 		Method: events.LoginMethodLocal,
 	}
@@ -118,27 +105,14 @@ func (s *Server) AuthenticateUser(req AuthenticateUserRequest) (string, error) {
 	if err := s.emitter.EmitAuditEvent(s.closeCtx, event); err != nil {
 		log.WithError(err).Warn("Failed to emit login event.")
 	}
-	return user, trace.Wrap(err)
+	return err
 }
 
-// authenticateWebauthnError is the generic error message returned for failed
-// WebAuthn authentication attempts.
-const authenticateWebauthnError = "invalid Webauthn response"
-
-// authenticateUser authenticates a user through various methods (password, MFA,
-// passwordless)
-// Returns the device used to authenticate (if applicable) and the username.
-func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserRequest) (*types.MFADevice, string, error) {
+func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserRequest) (*types.MFADevice, error) {
 	if err := req.CheckAndSetDefaults(); err != nil {
-		return nil, "", trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	user := req.Username
-	passwordless := user == ""
-
-	// Only one path if passwordless, other variants shouldn't see an empty user.
-	if passwordless {
-		return s.authenticatePasswordless(ctx, req)
-	}
 
 	// Try 2nd-factor-enabled authentication schemes first.
 	var authenticateFn func() (*types.MFADevice, error)
@@ -152,10 +126,9 @@ func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserReque
 					Webauthn: wanlib.CredentialAssertionResponseToProto(req.Webauthn),
 				},
 			}
-			dev, _, err := s.validateMFAAuthResponse(ctx, mfaResponse, user, passwordless)
-			return dev, trace.Wrap(err)
+			return s.validateMFAAuthResponse(ctx, user, mfaResponse)
 		}
-		failMsg = authenticateWebauthnError
+		failMsg = "invalid Webauthn response"
 	case req.OTP != nil:
 		authenticateFn = func() (*types.MFADevice, error) {
 			// OTP cannot be validated by validateMFAAuthResponse because we need to
@@ -179,28 +152,28 @@ func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserReque
 		case err != nil:
 			log.Debugf("User %v failed to authenticate: %v.", user, err)
 			if fieldErr := getErrorByTraceField(err); fieldErr != nil {
-				return nil, "", trace.Wrap(fieldErr)
+				return nil, trace.Wrap(fieldErr)
 			}
 
-			return nil, "", trace.AccessDenied(failMsg)
+			return nil, trace.AccessDenied(failMsg)
 		case dev == nil:
 			log.Debugf(
 				"MFA authentication returned nil device (Webauthn = %v, TOTP = %v): %v.",
 				req.Webauthn != nil, req.OTP != nil, err)
-			return nil, "", trace.AccessDenied(failMsg)
+			return nil, trace.AccessDenied(failMsg)
 		default:
-			return dev, user, nil
+			return dev, nil
 		}
 	}
 
 	// Try password-only authentication last.
 	if req.Pass == nil {
-		return nil, "", trace.AccessDenied("unsupported authentication method")
+		return nil, trace.AccessDenied("unsupported authentication method")
 	}
 
 	authPreference, err := s.GetAuthPreference(ctx)
 	if err != nil {
-		return nil, "", trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	// When using password only make sure that auth preference does not require
@@ -213,62 +186,37 @@ func (s *Server) authenticateUser(ctx context.Context, req AuthenticateUserReque
 		// registered.
 		devs, err := s.Identity.GetMFADevices(ctx, user, false /* withSecrets */)
 		if err != nil && !trace.IsNotFound(err) {
-			return nil, "", trace.Wrap(err)
+			return nil, trace.Wrap(err)
 		}
 		if len(devs) != 0 {
 			log.Warningf("MFA bypass attempt by user %q, access denied.", user)
-			return nil, "", trace.AccessDenied("missing second factor authentication")
+			return nil, trace.AccessDenied("missing second factor authentication")
 		}
 	default:
 		// Some form of MFA is required but none provided. Either client is
 		// buggy (didn't send MFA response) or someone is trying to bypass
 		// MFA.
 		log.Warningf("MFA bypass attempt by user %q, access denied.", user)
-		return nil, "", trace.AccessDenied("missing second factor")
+		return nil, trace.AccessDenied("missing second factor")
 	}
 	if err = s.WithUserLock(user, func() error {
 		return s.checkPasswordWOToken(user, req.Pass.Password)
 	}); err != nil {
 		if fieldErr := getErrorByTraceField(err); fieldErr != nil {
-			return nil, "", trace.Wrap(fieldErr)
+			return nil, trace.Wrap(fieldErr)
 		}
 		// provide obscure message on purpose, while logging the real
 		// error server side
 		log.Debugf("User %v failed to authenticate: %v.", user, err)
-		return nil, "", trace.AccessDenied("invalid username or password")
+		return nil, trace.AccessDenied("invalid username or password")
 	}
-	return nil, user, nil
-}
-
-func (s *Server) authenticatePasswordless(ctx context.Context, req AuthenticateUserRequest) (*types.MFADevice, string, error) {
-	mfaResponse := &proto.MFAAuthenticateResponse{
-		Response: &proto.MFAAuthenticateResponse_Webauthn{
-			Webauthn: wanlib.CredentialAssertionResponseToProto(req.Webauthn),
-		},
-	}
-	dev, user, err := s.validateMFAAuthResponse(ctx, mfaResponse, "", true /* passwordless */)
-	if err != nil {
-		log.Debugf("Passwordless authentication failed: %v", err)
-		return nil, "", trace.AccessDenied(authenticateWebauthnError)
-	}
-
-	// A distinction between passwordless and "plain" MFA is that we can't
-	// acquire the user lock beforehand (or at all on failures!)
-	// We do grab it here so successful logins go through the regular process.
-	if err := s.WithUserLock(user, func() error { return nil }); err != nil {
-		log.Debugf("WithUserLock for user %q failed during passwordless authentication: %v", user, err)
-		return nil, user, trace.AccessDenied(authenticateWebauthnError)
-	}
-
-	return dev, user, nil
+	return nil, nil
 }
 
 // AuthenticateWebUser authenticates web user, creates and returns a web session
 // if authentication is successful. In case the existing session ID is used to authenticate,
 // returns the existing session instead of creating a new one
 func (s *Server) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSession, error) {
-	username := req.Username // Empty if passwordless.
-
 	ctx := context.TODO()
 	authPref, err := s.GetAuthPreference(ctx)
 	if err != nil {
@@ -280,13 +228,13 @@ func (s *Server) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSess
 	// This condition uses Session as a blanket check, because any new method added
 	// to the local auth will be disabled by default.
 	if !authPref.GetAllowLocalAuth() && req.Session == nil {
-		s.emitNoLocalAuthEvent(username)
+		s.emitNoLocalAuthEvent(req.Username)
 		return nil, trace.AccessDenied(noLocalAuth)
 	}
 
 	if req.Session != nil {
 		session, err := s.GetWebSession(context.TODO(), types.GetWebSessionRequest{
-			User:      username,
+			User:      req.Username,
 			SessionID: req.Session.ID,
 		})
 		if err != nil {
@@ -295,13 +243,11 @@ func (s *Server) AuthenticateWebUser(req AuthenticateUserRequest) (types.WebSess
 		return session, nil
 	}
 
-	actualUser, err := s.AuthenticateUser(req)
-	if err != nil {
+	if err := s.AuthenticateUser(req); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	username = actualUser
 
-	user, err := s.GetUser(username, false /* withSecrets */)
+	user, err := s.GetUser(req.Username, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -403,15 +349,13 @@ func AuthoritiesToTrustedCerts(authorities []types.CertAuthority) []TrustedCerts
 // AuthenticateSSHUser authenticates an SSH user and returns SSH and TLS
 // certificates for the public key in req.
 func (s *Server) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginResponse, error) {
-	username := req.Username // Empty if passwordless.
-
 	ctx := context.TODO()
 	authPref, err := s.GetAuthPreference(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	if !authPref.GetAllowLocalAuth() {
-		s.emitNoLocalAuthEvent(username)
+		s.emitNoLocalAuthEvent(req.Username)
 		return nil, trace.AccessDenied(noLocalAuth)
 	}
 
@@ -420,15 +364,13 @@ func (s *Server) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginRespo
 		return nil, trace.Wrap(err)
 	}
 
-	actualUser, err := s.AuthenticateUser(req.AuthenticateUserRequest)
-	if err != nil {
+	if err := s.AuthenticateUser(req.AuthenticateUserRequest); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	username = actualUser
 
 	// It's safe to extract the roles and traits directly from services.User as
 	// this endpoint is only used for local accounts.
-	user, err := s.GetUser(username, false /* withSecrets */)
+	user, err := s.GetUser(req.Username, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -438,7 +380,7 @@ func (s *Server) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginRespo
 	}
 
 	// Return the host CA for this cluster only.
-	authority, err := s.GetCertAuthority(ctx, types.CertAuthID{
+	authority, err := s.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName.GetClusterName(),
 	}, false)
@@ -464,7 +406,7 @@ func (s *Server) AuthenticateSSHUser(req AuthenticateSSHRequest) (*SSHLoginRespo
 	}
 	UserLoginCount.Inc()
 	return &SSHLoginResponse{
-		Username:    username,
+		Username:    req.Username,
 		Cert:        certs.SSH,
 		TLSCert:     certs.TLS,
 		HostSigners: AuthoritiesToTrustedCerts(hostCertAuthorities),
diff --git a/lib/auth/middleware.go b/lib/auth/middleware.go
index 08752948435cc..45d914dd4f17f 100644
--- a/lib/auth/middleware.go
+++ b/lib/auth/middleware.go
@@ -30,7 +30,6 @@ import (
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/multiplexer"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -320,7 +319,6 @@ func (a *Middleware) Wrap(h http.Handler) {
 
 func getCustomRate(endpoint string) *ratelimit.RateSet {
 	switch endpoint {
-	// Account recovery RPCs.
 	case
 		"/proto.AuthService/ChangeUserAuthentication",
 		"/proto.AuthService/GetAccountRecoveryToken",
@@ -333,18 +331,8 @@ func getCustomRate(endpoint string) *ratelimit.RateSet {
 			return nil
 		}
 		return rates
-	// Passwordless RPCs (potential unauthenticated challenge generation).
-	case "/proto.AuthService/CreateAuthenticateChallenge":
-		const period = defaults.LimiterPasswordlessPeriod
-		const average = defaults.LimiterPasswordlessAverage
-		const burst = defaults.LimiterPasswordlessBurst
-		rates := ratelimit.NewRateSet()
-		if err := rates.Add(period, average, burst); err != nil {
-			log.WithError(err).Debugf("Failed to define a custom rate for rpc method %q, using default rate", endpoint)
-			return nil
-		}
-		return rates
 	}
+
 	return nil
 }
 
@@ -582,15 +570,14 @@ func (a *Middleware) WrapContextWithUser(ctx context.Context, conn *tls.Conn) (c
 
 // ClientCertPool returns trusted x509 cerificate authority pool
 func ClientCertPool(client AccessCache, clusterName string) (*x509.CertPool, error) {
-	ctx := context.TODO()
 	pool := x509.NewCertPool()
 	var authorities []types.CertAuthority
 	if clusterName == "" {
-		hostCAs, err := client.GetCertAuthorities(ctx, types.HostCA, false)
+		hostCAs, err := client.GetCertAuthorities(types.HostCA, false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		userCAs, err := client.GetCertAuthorities(ctx, types.UserCA, false)
+		userCAs, err := client.GetCertAuthorities(types.UserCA, false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -598,14 +585,12 @@ func ClientCertPool(client AccessCache, clusterName string) (*x509.CertPool, err
 		authorities = append(authorities, userCAs...)
 	} else {
 		hostCA, err := client.GetCertAuthority(
-			ctx,
 			types.CertAuthID{Type: types.HostCA, DomainName: clusterName},
 			false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 		userCA, err := client.GetCertAuthority(
-			ctx,
 			types.CertAuthID{Type: types.UserCA, DomainName: clusterName},
 			false)
 		if err != nil {
diff --git a/lib/auth/mocku2f/mocku2f.go b/lib/auth/mocku2f/mocku2f.go
index aaa643c1d4135..fe88acd22e224 100644
--- a/lib/auth/mocku2f/mocku2f.go
+++ b/lib/auth/mocku2f/mocku2f.go
@@ -143,14 +143,6 @@ func CreateWithKeyHandle(keyHandle []byte) (*Key, error) {
 	}, nil
 }
 
-// SetPasswordless sets common passwordless options in Key.
-// Options are AllowResidentKey, IgnoreAllowedCredentials and SetUV.
-func (muk *Key) SetPasswordless() {
-	muk.AllowResidentKey = true         // Passwordless keys must be resident.
-	muk.IgnoreAllowedCredentials = true // Empty for passwordless challenges.
-	muk.SetUV = true                    // UV required for passwordless.
-}
-
 func (muk *Key) RegisterResponse(req *u2f.RegisterRequest) (*u2f.RegisterResponse, error) {
 	appIDHash := sha256.Sum256([]byte(req.AppID))
 
@@ -209,7 +201,7 @@ func (muk *Key) signRegister(appIDHash, clientDataHash []byte) (*signRegisterRes
 		return nil, trace.Wrap(err)
 	}
 
-	flags := uint8(u2fRegistrationFlags)
+	var flags = uint8(u2fRegistrationFlags)
 	if muk.SetUV {
 		// Mimic WebAuthn flags if SetUV is true.
 		flags = uint8(protocol.FlagUserPresent | protocol.FlagUserVerified | protocol.FlagAttestedCredentialData)
diff --git a/lib/auth/oidc.go b/lib/auth/oidc.go
index fd36bba8b0d29..f732841395f33 100644
--- a/lib/auth/oidc.go
+++ b/lib/auth/oidc.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"net/http"
 	"net/url"
 
@@ -365,7 +365,7 @@ func (a *Server) validateOIDCAuthCallback(q url.Values) (*oidcAuthResponse, erro
 
 	// If the request is coming from a browser, create a web session.
 	if req.CreateWebSession {
-		session, err := a.createWebSession(ctx, types.NewWebSessionRequest{
+		session, err := a.createWebSession(context.TODO(), types.NewWebSessionRequest{
 			User:       user.GetName(),
 			Roles:      user.GetRoles(),
 			Traits:     user.GetTraits(),
@@ -389,7 +389,7 @@ func (a *Server) validateOIDCAuthCallback(q url.Values) (*oidcAuthResponse, erro
 		re.auth.TLSCert = tlsCert
 
 		// Return the host CA for this cluster only.
-		authority, err := a.GetCertAuthority(ctx, types.CertAuthID{
+		authority, err := a.GetCertAuthority(types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName.GetClusterName(),
 		}, false)
@@ -600,7 +600,7 @@ func claimsFromUserInfo(oidcClient *oidc.Client, issuerURL string, accessToken s
 			code == http.StatusForbidden || code == http.StatusMethodNotAllowed {
 			return nil, trace.AccessDenied("bad status code: %v", code)
 		}
-		body, err := io.ReadAll(resp.Body)
+		body, err := ioutil.ReadAll(resp.Body)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/auth/password.go b/lib/auth/password.go
index 1023a3a17a59c..a357161b48814 100644
--- a/lib/auth/password.go
+++ b/lib/auth/password.go
@@ -122,7 +122,7 @@ func (s *Server) ChangePassword(req services.ChangePasswordReq) error {
 			Token:    req.SecondFactorToken,
 		}
 	}
-	if _, _, err := s.authenticateUser(ctx, authReq); err != nil {
+	if _, err := s.authenticateUser(ctx, authReq); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/lib/auth/permissions.go b/lib/auth/permissions.go
index 66934095315e9..e0c886ba8d7fd 100644
--- a/lib/auth/permissions.go
+++ b/lib/auth/permissions.go
@@ -81,10 +81,10 @@ type AuthorizerAccessPoint interface {
 	GetUser(name string, withSecrets bool) (types.User, error)
 
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 
 	// GetClusterAuditConfig returns cluster audit configuration.
 	GetClusterAuditConfig(ctx context.Context, opts ...services.MarshalOption) (types.ClusterAuditConfig, error)
@@ -174,7 +174,7 @@ func (a *authorizer) fromUser(ctx context.Context, userI interface{}) (*Context,
 	case LocalUser:
 		return a.authorizeLocalUser(user)
 	case RemoteUser:
-		return a.authorizeRemoteUser(ctx, user)
+		return a.authorizeRemoteUser(user)
 	case BuiltinRole:
 		return a.authorizeBuiltinRole(ctx, user)
 	case RemoteBuiltinRole:
@@ -190,8 +190,8 @@ func (a *authorizer) authorizeLocalUser(u LocalUser) (*Context, error) {
 }
 
 // authorizeRemoteUser returns checker based on cert authority roles
-func (a *authorizer) authorizeRemoteUser(ctx context.Context, u RemoteUser) (*Context, error) {
-	ca, err := a.accessPoint.GetCertAuthority(ctx, types.CertAuthID{
+func (a *authorizer) authorizeRemoteUser(u RemoteUser) (*Context, error) {
+	ca, err := a.accessPoint.GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: u.ClusterName,
 	}, false)
diff --git a/lib/auth/permissions_test.go b/lib/auth/permissions_test.go
index f2dc9cc90a6ff..a11f9282ea075 100644
--- a/lib/auth/permissions_test.go
+++ b/lib/auth/permissions_test.go
@@ -66,13 +66,13 @@ func TestAuthorizeWithLocksForLocalUser(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	user, role, err := CreateUserAndRole(srv.AuthServer, "test-user", []string{})
+	user, _, err := CreateUserAndRole(srv.AuthServer, "test-user", []string{})
 	require.NoError(t, err)
 	localUser := LocalUser{
 		Username: user.GetName(),
 		Identity: tlsca.Identity{
 			Username:       user.GetName(),
-			Groups:         []string{role.GetName()},
+			Groups:         []string{"test-role-1"},
 			MFAVerified:    "mfa-device-id",
 			ActiveRequests: []string{"test-request"},
 		},
diff --git a/lib/auth/register.go b/lib/auth/register.go
index d905ea00318ea..ca050b59d3ccf 100644
--- a/lib/auth/register.go
+++ b/lib/auth/register.go
@@ -19,6 +19,7 @@ package auth
 import (
 	"context"
 	"crypto/x509"
+	"encoding/json"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client"
@@ -520,3 +521,39 @@ func ReRegister(params ReRegisterParams) (*Identity, error) {
 
 	return ReadIdentityFromKeyPair(params.PrivateKey, certs)
 }
+
+// LegacyCerts is equivalent to proto.Certs, but uses
+// JSON keys expected by old clients (7.x and earlier)
+// DELETE in 9.0.0 (Joerger/zmb3)
+type LegacyCerts struct {
+	SSHCert    []byte   `json:"cert"`
+	TLSCert    []byte   `json:"tls_cert"`
+	TLSCACerts [][]byte `json:"tls_ca_certs"`
+	SSHCACerts [][]byte `json:"ssh_ca_certs"`
+}
+
+// LegacyCertsFromProto converts proto.Certs to LegacyCerts.
+// DELETE in 10.0.0 (Joerger/zmb3)
+func LegacyCertsFromProto(c *proto.Certs) *LegacyCerts {
+	return &LegacyCerts{
+		SSHCert:    c.SSH,
+		TLSCert:    c.TLS,
+		SSHCACerts: c.SSHCACerts,
+		TLSCACerts: c.TLSCACerts,
+	}
+}
+
+// UnmarshalLegacyCerts unmarshals the a legacy certs response as proto.Certs.
+// DELETE in 10.0.0 (Joerger/zmb3)
+func UnmarshalLegacyCerts(bytes []byte) (*proto.Certs, error) {
+	var lc LegacyCerts
+	if err := json.Unmarshal(bytes, &lc); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &proto.Certs{
+		SSH:        lc.SSHCert,
+		TLS:        lc.TLSCert,
+		TLSCACerts: lc.TLSCACerts,
+		SSHCACerts: lc.SSHCACerts,
+	}, nil
+}
diff --git a/lib/auth/rotate.go b/lib/auth/rotate.go
index b8583e41a390b..749b64c49a4e8 100644
--- a/lib/auth/rotate.go
+++ b/lib/auth/rotate.go
@@ -17,7 +17,6 @@ limitations under the License.
 package auth
 
 import (
-	"context"
 	"crypto/rsa"
 	"crypto/x509/pkix"
 	"time"
@@ -202,7 +201,7 @@ type rotationReq struct {
 // It is possible to switch from automatic to manual by setting the phase
 // to the rollback phase.
 //
-func (a *Server) RotateCertAuthority(ctx context.Context, req RotateRequest) error {
+func (a *Server) RotateCertAuthority(req RotateRequest) error {
 	if err := req.CheckAndSetDefaults(a.clock); err != nil {
 		return trace.Wrap(err)
 	}
@@ -213,7 +212,7 @@ func (a *Server) RotateCertAuthority(ctx context.Context, req RotateRequest) err
 
 	caTypes := req.Types()
 	for _, caType := range caTypes {
-		existing, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
+		existing, err := a.Trust.GetCertAuthority(types.CertAuthID{
 			Type:       caType,
 			DomainName: clusterName.GetClusterName(),
 		}, true)
@@ -251,7 +250,7 @@ func (a *Server) RotateCertAuthority(ctx context.Context, req RotateRequest) err
 // RotateExternalCertAuthority rotates external certificate authority,
 // this method is called by remote trusted cluster and is used to update
 // only public keys and certificates of the certificate authority.
-func (a *Server) RotateExternalCertAuthority(ctx context.Context, ca types.CertAuthority) error {
+func (a *Server) RotateExternalCertAuthority(ca types.CertAuthority) error {
 	if ca == nil {
 		return trace.BadParameter("missing certificate authority")
 	}
@@ -266,7 +265,7 @@ func (a *Server) RotateExternalCertAuthority(ctx context.Context, ca types.CertA
 		return trace.BadParameter("can not rotate local certificate authority")
 	}
 
-	existing, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
+	existing, err := a.Trust.GetCertAuthority(types.CertAuthID{
 		Type:       ca.GetType(),
 		DomainName: ca.GetClusterName(),
 	}, false)
@@ -310,13 +309,13 @@ func (a *Server) RotateExternalCertAuthority(ctx context.Context, ca types.CertA
 // autoRotateCertAuthorities automatically rotates cert authorities,
 // does nothing if no rotation parameters were set up
 // or it is too early to rotate per schedule
-func (a *Server) autoRotateCertAuthorities(ctx context.Context) error {
+func (a *Server) autoRotateCertAuthorities() error {
 	clusterName, err := a.GetClusterName()
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA, types.JWTSigner} {
-		ca, err := a.Trust.GetCertAuthority(ctx, types.CertAuthID{
+		ca, err := a.Trust.GetCertAuthority(types.CertAuthID{
 			Type:       caType,
 			DomainName: clusterName.GetClusterName(),
 		}, true)
@@ -328,7 +327,7 @@ func (a *Server) autoRotateCertAuthorities(ctx context.Context) error {
 		}
 		// make sure there are local AdditionalKeys during init phase of rotation
 		if ca.GetRotation().Phase == types.RotationPhaseInit {
-			if err := a.ensureLocalAdditionalKeys(ctx, ca); err != nil {
+			if err := a.ensureLocalAdditionalKeys(ca); err != nil {
 				return trace.Wrap(err)
 			}
 		}
diff --git a/lib/auth/saml.go b/lib/auth/saml.go
index 8a97bee746508..c007476d3cc1a 100644
--- a/lib/auth/saml.go
+++ b/lib/auth/saml.go
@@ -22,7 +22,7 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
-	"io"
+	"io/ioutil"
 
 	"github.com/google/go-cmp/cmp"
 
@@ -254,7 +254,7 @@ func parseSAMLInResponseTo(response string) (string, error) {
 	err := doc.ReadFromBytes(raw)
 	if err != nil {
 		// Attempt to inflate the response in case it happens to be compressed (as with one case at saml.oktadev.com)
-		buf, err := io.ReadAll(flate.NewReader(bytes.NewReader(raw)))
+		buf, err := ioutil.ReadAll(flate.NewReader(bytes.NewReader(raw)))
 		if err != nil {
 			return "", trace.Wrap(err)
 		}
@@ -427,7 +427,7 @@ func (a *Server) validateSAMLResponse(samlResponse string) (*samlAuthResponse, e
 
 	// If the request is coming from a browser, create a web session.
 	if request.CreateWebSession {
-		session, err := a.createWebSession(ctx, types.NewWebSessionRequest{
+		session, err := a.createWebSession(context.TODO(), types.NewWebSessionRequest{
 			User:       user.GetName(),
 			Roles:      user.GetRoles(),
 			Traits:     user.GetTraits(),
@@ -455,7 +455,7 @@ func (a *Server) validateSAMLResponse(samlResponse string) (*samlAuthResponse, e
 		re.auth.TLSCert = tlsCert
 
 		// Return the host CA for this cluster only.
-		authority, err := a.GetCertAuthority(ctx, types.CertAuthID{
+		authority, err := a.GetCertAuthority(types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName.GetClusterName(),
 		}, false)
diff --git a/lib/auth/session_access.go b/lib/auth/session_access.go
index 82df61ac6bd20..c4b77b7efde5d 100644
--- a/lib/auth/session_access.go
+++ b/lib/auth/session_access.go
@@ -17,7 +17,6 @@ limitations under the License.
 package auth
 
 import (
-	"fmt"
 	"regexp"
 	"strings"
 
@@ -37,27 +36,17 @@ import (
 // that is harder to debug in the case of misconfigured policies or other error and are harder to intuitively follow.
 // In the real world, the number of roles and session are small enough that this doesn't have a meaningful impact.
 type SessionAccessEvaluator struct {
-	kind        types.SessionKind
-	policySets  []*types.SessionTrackerPolicySet
-	isModerated bool
+	kind       types.SessionKind
+	policySets []*types.SessionTrackerPolicySet
 }
 
 // NewSessionAccessEvaluator creates a new session access evaluator for a given session kind
 // and a set of roles attached to the host user.
 func NewSessionAccessEvaluator(policySets []*types.SessionTrackerPolicySet, kind types.SessionKind) SessionAccessEvaluator {
-	e := SessionAccessEvaluator{
-		kind:       kind,
-		policySets: policySets,
+	return SessionAccessEvaluator{
+		kind,
+		policySets,
 	}
-
-	for _, policySet := range policySets {
-		if len(e.extractApplicablePolicies(policySet)) != 0 {
-			e.isModerated = true
-			break
-		}
-	}
-
-	return e
 }
 
 func getAllowPolicies(participant SessionAccessContext) []*types.SessionJoinPolicy {
@@ -113,13 +102,8 @@ func (ctx *SessionAccessContext) GetResource() (types.Resource, error) {
 	return nil, trace.BadParameter("resource unsupported")
 }
 
-// IsModerated returns true if the session needs moderation.
-func (e *SessionAccessEvaluator) IsModerated() bool {
-	return e.isModerated
-}
-
 func (e *SessionAccessEvaluator) matchesPredicate(ctx *SessionAccessContext, require *types.SessionRequirePolicy, allow *types.SessionJoinPolicy) (bool, error) {
-	if !e.matchesKind(allow.Kinds) {
+	if !e.matchesKind(require.Kinds) || !e.matchesKind(allow.Kinds) {
 		return false, nil
 	}
 
@@ -225,39 +209,6 @@ func (e *SessionAccessEvaluator) hasPolicies() bool {
 	return false
 }
 
-// Generate a pretty-printed string of precise requirements for session start suitable for user display.
-func (e *SessionAccessEvaluator) PrettyRequirementsList() string {
-	s := new(strings.Builder)
-	s.WriteString("require all:")
-
-	for _, policySet := range e.policySets {
-		policies := e.extractApplicablePolicies(policySet)
-		if len(policies) == 0 {
-			continue
-		}
-
-		fmt.Fprintf(s, "\r\n   one of (%v):", policySet.Name)
-		for _, require := range policies {
-			fmt.Fprintf(s, "\r\n    - %vx %v with mode %v", require.Count, require.Filter, strings.Join(require.Modes, " or "))
-		}
-	}
-
-	return s.String()
-}
-
-// extractApplicablePolicies extracts all policies that match the session kind.
-func (e *SessionAccessEvaluator) extractApplicablePolicies(set *types.SessionTrackerPolicySet) []*types.SessionRequirePolicy {
-	var policies []*types.SessionRequirePolicy
-
-	for _, require := range set.RequireSessionJoin {
-		if e.matchesKind(require.Kinds) {
-			policies = append(policies, require)
-		}
-	}
-
-	return policies
-}
-
 // FulfilledFor checks if a given session may run with a list of participants.
 func (e *SessionAccessEvaluator) FulfilledFor(participants []SessionAccessContext) (bool, PolicyOptions, error) {
 	supported, err := e.supportsSessionAccessControls()
@@ -276,14 +227,13 @@ func (e *SessionAccessEvaluator) FulfilledFor(participants []SessionAccessContex
 	// We need every policy set to match to allow the session.
 policySetLoop:
 	for _, policySet := range e.policySets {
-		policies := e.extractApplicablePolicies(policySet)
-		if len(policies) == 0 {
+		if len(policySet.RequireSessionJoin) == 0 {
 			continue
 		}
 
 		// Check every require policy to see if it's fulfilled.
 		// Only one needs to be checked to pass the policyset.
-		for _, requirePolicy := range policies {
+		for _, requirePolicy := range policySet.RequireSessionJoin {
 			// Count of how many additional participant matches we need to fulfill the policy.
 			left := requirePolicy.Count
 
diff --git a/lib/auth/session_access_test.go b/lib/auth/session_access_test.go
index 50faddc0b9618..0f2f6187d500a 100644
--- a/lib/auth/session_access_test.go
+++ b/lib/auth/session_access_test.go
@@ -32,9 +32,9 @@ type startTestCase struct {
 }
 
 func successStartTestCase(t *testing.T) startTestCase {
-	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	hostRole.SetSessionRequirePolicies([]*types.SessionRequirePolicy{{
@@ -72,9 +72,9 @@ func successStartTestCase(t *testing.T) startTestCase {
 }
 
 func failCountStartTestCase(t *testing.T) startTestCase {
-	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	hostRole.SetSessionRequirePolicies([]*types.SessionRequirePolicy{{
@@ -110,29 +110,10 @@ func failCountStartTestCase(t *testing.T) startTestCase {
 	}
 }
 
-func succeedDiscardPolicySetStartTestCase(t *testing.T) startTestCase {
-	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
-	require.NoError(t, err)
-
-	hostRole.SetSessionRequirePolicies([]*types.SessionRequirePolicy{{
-		Filter: "contains(user.roles, \"host\")",
-		Kinds:  []string{string(types.KubernetesSessionKind)},
-		Count:  2,
-		Modes:  []string{"peer"},
-	}})
-
-	return startTestCase{
-		name:        "succeedDiscardPolicySet",
-		host:        hostRole,
-		sessionKind: types.SSHSessionKind,
-		expected:    true,
-	}
-}
-
 func failFilterStartTestCase(t *testing.T) startTestCase {
-	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	hostRole.SetSessionRequirePolicies([]*types.SessionRequirePolicy{{
@@ -173,7 +154,6 @@ func TestSessionAccessStart(t *testing.T) {
 		successStartTestCase(t),
 		failCountStartTestCase(t),
 		failFilterStartTestCase(t),
-		succeedDiscardPolicySetStartTestCase(t),
 	}
 
 	for _, testCase := range testCases {
@@ -196,9 +176,9 @@ type joinTestCase struct {
 }
 
 func successJoinTestCase(t *testing.T) joinTestCase {
-	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	participantRole.SetSessionJoinPolicies([]*types.SessionJoinPolicy{{
@@ -220,9 +200,9 @@ func successJoinTestCase(t *testing.T) joinTestCase {
 }
 
 func failRoleJoinTestCase(t *testing.T) joinTestCase {
-	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	return joinTestCase{
@@ -238,9 +218,9 @@ func failRoleJoinTestCase(t *testing.T) joinTestCase {
 }
 
 func failKindJoinTestCase(t *testing.T) joinTestCase {
-	hostRole, err := types.NewRole("host", types.RoleSpecV5{})
+	hostRole, err := types.NewRoleV5("host", types.RoleSpecV5{})
 	require.NoError(t, err)
-	participantRole, err := types.NewRole("participant", types.RoleSpecV5{})
+	participantRole, err := types.NewRoleV5("participant", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	participantRole.SetSessionJoinPolicies([]*types.SessionJoinPolicy{{
diff --git a/lib/auth/sessions.go b/lib/auth/sessions.go
index 11aae3709104d..ee9dbba7a3a5e 100644
--- a/lib/auth/sessions.go
+++ b/lib/auth/sessions.go
@@ -156,13 +156,13 @@ func WaitForAppSession(ctx context.Context, sessionID, user string, ap ReadProxy
 
 // generateAppToken generates an JWT token that will be passed along with every
 // application request.
-func (s *Server) generateAppToken(ctx context.Context, username string, roles []string, uri string, expires time.Time) (string, error) {
+func (s *Server) generateAppToken(username string, roles []string, uri string, expires time.Time) (string, error) {
 	// Get the clusters CA.
 	clusterName, err := s.GetDomainName()
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
-	ca, err := s.GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := s.GetCertAuthority(types.CertAuthID{
 		Type:       types.JWTSigner,
 		DomainName: clusterName,
 	}, true)
diff --git a/lib/auth/state_unix.go b/lib/auth/state_unix.go
index 0cfb1e166b8eb..88672c3dd390f 100644
--- a/lib/auth/state_unix.go
+++ b/lib/auth/state_unix.go
@@ -36,7 +36,6 @@ func NewProcessStorage(ctx context.Context, path string) (*ProcessStorage, error
 	litebk, err := lite.NewWithConfig(ctx, lite.Config{
 		Path:      path,
 		EventsOff: true,
-		Sync:      lite.SyncFull,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/auth/tls_test.go b/lib/auth/tls_test.go
index 66075cdc02efc..5d099723b3f22 100644
--- a/lib/auth/tls_test.go
+++ b/lib/auth/tls_test.go
@@ -27,6 +27,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -115,7 +116,7 @@ func (s *TLSSuite) TestRemoteBuiltinRole(c *check.C) {
 	fixtures.ExpectConnectionProblem(c, err)
 
 	// after trust is established, things are good
-	err = s.server.AuthServer.Trust(ctx, remoteServer, nil)
+	err = s.server.AuthServer.Trust(remoteServer, nil)
 	c.Assert(err, check.IsNil)
 
 	// re initialize client with trust established.
@@ -211,7 +212,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// after trust is established, things are good
-	err = s.server.AuthServer.Trust(ctx, remoteServer, nil)
+	err = s.server.AuthServer.Trust(remoteServer, nil)
 	c.Assert(err, check.IsNil)
 
 	remoteProxy, err := remoteServer.NewRemoteClient(
@@ -226,7 +227,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	gracePeriod := time.Hour
 	remoteServer.AuthServer.privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
-	err = remoteServer.AuthServer.RotateCertAuthority(ctx, RotateRequest{
+	err = remoteServer.AuthServer.RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -235,7 +236,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// moves to update clients
-	err = remoteServer.AuthServer.RotateCertAuthority(ctx, RotateRequest{
+	err = remoteServer.AuthServer.RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -243,7 +244,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 
-	remoteCA, err := remoteServer.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+	remoteCA, err := remoteServer.AuthServer.GetCertAuthority(types.CertAuthID{
 		DomainName: remoteServer.ClusterName,
 		Type:       types.HostCA,
 	}, false)
@@ -253,7 +254,7 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	// that is not associated with the remote cluster
 	clone := remoteCA.Clone()
 	clone.SetName(s.server.ClusterName())
-	err = remoteProxy.RotateExternalCertAuthority(ctx, clone)
+	err = remoteProxy.RotateExternalCertAuthority(clone)
 	fixtures.ExpectAccessDenied(c, err)
 
 	// remote proxy can't upsert the certificate authority,
@@ -262,26 +263,26 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 	fixtures.ExpectAccessDenied(c, err)
 
 	// remote proxy can't read local cert authority with secrets
-	_, err = remoteProxy.GetCertAuthority(ctx, types.CertAuthID{
+	_, err = remoteProxy.GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, true)
 	fixtures.ExpectAccessDenied(c, err)
 
 	// no secrets read is allowed
-	_, err = remoteProxy.GetCertAuthority(ctx, types.CertAuthID{
+	_, err = remoteProxy.GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
 	c.Assert(err, check.IsNil)
 
 	// remote auth server will get rejected
-	err = remoteAuth.RotateExternalCertAuthority(ctx, remoteCA)
+	err = remoteAuth.RotateExternalCertAuthority(remoteCA)
 	fixtures.ExpectAccessDenied(c, err)
 
 	// remote proxy should be able to perform remote cert authority
 	// rotation
-	err = remoteProxy.RotateExternalCertAuthority(ctx, remoteCA)
+	err = remoteProxy.RotateExternalCertAuthority(remoteCA)
 	c.Assert(err, check.IsNil)
 
 	// newRemoteProxy should be trusted by the auth server
@@ -300,7 +301,6 @@ func (s *TLSSuite) TestRemoteRotation(c *check.C) {
 // TestLocalProxyPermissions tests new local proxy permissions
 // as it's now allowed to update host cert authorities of remote clusters
 func (s *TLSSuite) TestLocalProxyPermissions(c *check.C) {
-	ctx := context.Background()
 	remoteServer, err := NewTestAuthServer(TestAuthServerConfig{
 		Dir:         c.MkDir(),
 		ClusterName: "remote",
@@ -309,10 +309,10 @@ func (s *TLSSuite) TestLocalProxyPermissions(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// after trust is established, things are good
-	err = s.server.AuthServer.Trust(ctx, remoteServer, nil)
+	err = s.server.AuthServer.Trust(remoteServer, nil)
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -326,7 +326,7 @@ func (s *TLSSuite) TestLocalProxyPermissions(c *check.C) {
 	fixtures.ExpectAccessDenied(c, err)
 
 	// local proxy is allowed to update host CA of remote cert authorities
-	remoteCA, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	remoteCA, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: remoteServer.ClusterName,
 		Type:       types.HostCA,
 	}, false)
@@ -353,7 +353,7 @@ func (s *TLSSuite) TestAutoRotation(c *check.C) {
 	s.server.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		Mode:        types.RotationModeAuto,
@@ -362,10 +362,10 @@ func (s *TLSSuite) TestAutoRotation(c *check.C) {
 
 	// advance rotation by clock
 	s.clock.Advance(gracePeriod/3 + time.Minute)
-	err = s.server.Auth().autoRotateCertAuthorities(ctx)
+	err = s.server.Auth().autoRotateCertAuthorities()
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -382,10 +382,10 @@ func (s *TLSSuite) TestAutoRotation(c *check.C) {
 
 	// advance rotation by clock
 	s.clock.Advance((gracePeriod*2)/3 + time.Minute)
-	err = s.server.Auth().autoRotateCertAuthorities(ctx)
+	err = s.server.Auth().autoRotateCertAuthorities()
 	c.Assert(err, check.IsNil)
 
-	ca, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	ca, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -405,9 +405,9 @@ func (s *TLSSuite) TestAutoRotation(c *check.C) {
 
 	// complete rotation - advance rotation by clock
 	s.clock.Advance(gracePeriod/3 + time.Minute)
-	err = s.server.Auth().autoRotateCertAuthorities(ctx)
+	err = s.server.Auth().autoRotateCertAuthorities()
 	c.Assert(err, check.IsNil)
-	ca, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	ca, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -447,7 +447,7 @@ func (s *TLSSuite) TestAutoFallback(c *check.C) {
 	s.server.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		Mode:        types.RotationModeAuto,
@@ -456,10 +456,10 @@ func (s *TLSSuite) TestAutoFallback(c *check.C) {
 
 	// advance rotation by clock
 	s.clock.Advance(gracePeriod/3 + time.Minute)
-	err = s.server.Auth().autoRotateCertAuthorities(ctx)
+	err = s.server.Auth().autoRotateCertAuthorities()
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -468,7 +468,7 @@ func (s *TLSSuite) TestAutoFallback(c *check.C) {
 	c.Assert(ca.GetRotation().Mode, check.Equals, types.RotationModeAuto)
 
 	// rollback rotation
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseRollback,
@@ -476,7 +476,7 @@ func (s *TLSSuite) TestAutoFallback(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 
-	ca, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	ca, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -503,7 +503,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	gracePeriod := time.Hour
 	s.server.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateServers,
@@ -512,7 +512,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	fixtures.ExpectBadParameter(c, err)
 
 	// starts rotation
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -525,7 +525,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// clients reconnect
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -545,7 +545,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// can't jump to standy
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseStandby,
@@ -554,7 +554,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	fixtures.ExpectBadParameter(c, err)
 
 	// advance rotation:
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateServers,
@@ -571,7 +571,7 @@ func (s *TLSSuite) TestManualRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// complete rotation
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseStandby,
@@ -609,7 +609,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	gracePeriod := time.Hour
 	s.server.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
 	c.Assert(ok, check.Equals, true)
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -618,7 +618,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// move to update clients phase
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -634,7 +634,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// advance rotation:
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateServers,
@@ -643,7 +643,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// rollback rotation
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseRollback,
@@ -657,7 +657,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// can't jump to other phases
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -666,7 +666,7 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 	fixtures.ExpectBadParameter(c, err)
 
 	// complete rollback
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseStandby,
@@ -686,7 +686,6 @@ func (s *TLSSuite) TestRollback(c *check.C) {
 // TestAppTokenRotation checks that JWT tokens can be rotated and tokens can or
 // can not be validated at the appropriate phase.
 func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
-	ctx := context.Background()
 	client, err := s.server.NewClient(TestBuiltin(types.RoleApp))
 	c.Assert(err, check.IsNil)
 
@@ -702,7 +701,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// Check that the "old" CA can be used to verify tokens.
-	oldCA, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	oldCA, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -716,7 +715,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	// Start rotation and move to initial phase. A new CA will be added (for
 	// verification), but requests will continue to be signed by the old CA.
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.JWTSigner,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -725,7 +724,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// At this point in rotation, two JWT key pairs should exist.
-	oldCA, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	oldCA, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -739,7 +738,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 
 	// Move rotation into the update client phase. In this phase, requests will
 	// be signed by the new CA, but the old CA will be around to verify requests.
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.JWTSigner,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateClients,
@@ -748,7 +747,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// New tokens should now fail to validate with the old key.
-	newJWT, err := client.GenerateAppToken(ctx,
+	newJWT, err := client.GenerateAppToken(context.Background(),
 		types.GenerateAppTokenRequest{
 			Username: "foo",
 			Roles:    []string{"bar", "baz"},
@@ -758,7 +757,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// New tokens will validate with the new key.
-	newCA, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	newCA, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -773,7 +772,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// Move rotation into update servers phase.
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.JWTSigner,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseUpdateServers,
@@ -782,7 +781,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// At this point only the phase on the CA should have changed.
-	newCA, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	newCA, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -797,7 +796,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// Complete rotation. The old CA will be removed.
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.JWTSigner,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseStandby,
@@ -806,7 +805,7 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// The new CA should now only have a single key.
-	newCA, err = s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	newCA, err = s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.JWTSigner,
 	}, true)
@@ -824,7 +823,6 @@ func (s *TLSSuite) TestAppTokenRotation(c *check.C) {
 // TestRemoteUser tests scenario when remote user connects to the local
 // auth server and some edge cases.
 func (s *TLSSuite) TestRemoteUser(c *check.C) {
-	ctx := context.Background()
 	remoteServer, err := NewTestAuthServer(TestAuthServerConfig{
 		Dir:         c.MkDir(),
 		ClusterName: "remote",
@@ -849,7 +847,7 @@ func (s *TLSSuite) TestRemoteUser(c *check.C) {
 
 	// Establish trust, the request will still fail, there is
 	// no role mapping set up
-	err = s.server.AuthServer.Trust(ctx, remoteServer, nil)
+	err = s.server.AuthServer.Trust(remoteServer, nil)
 	c.Assert(err, check.IsNil)
 	_, err = remoteClient.GetDomainName()
 	fixtures.ExpectAccessDenied(c, err)
@@ -858,7 +856,7 @@ func (s *TLSSuite) TestRemoteUser(c *check.C) {
 	_, localRole, err := CreateUserAndRole(s.server.Auth(), "local-user", []string{"local-role"})
 	c.Assert(err, check.IsNil)
 
-	err = s.server.AuthServer.Trust(ctx, remoteServer, types.RoleMap{{Remote: remoteRole.GetName(), Local: []string{localRole.GetName()}}})
+	err = s.server.AuthServer.Trust(remoteServer, types.RoleMap{{Remote: remoteRole.GetName(), Local: []string{localRole.GetName()}}})
 	c.Assert(err, check.IsNil)
 
 	_, err = remoteClient.GetDomainName()
@@ -1591,7 +1589,7 @@ func (s *TLSSuite) TestGetCertAuthority(c *check.C) {
 	defer nodeClt.Close()
 
 	// node is authorized to fetch CA without secrets
-	ca, err := nodeClt.GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := nodeClt.GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -1604,7 +1602,7 @@ func (s *TLSSuite) TestGetCertAuthority(c *check.C) {
 	}
 
 	// node is not authorized to fetch CA with secrets
-	_, err = nodeClt.GetCertAuthority(ctx, types.CertAuthID{
+	_, err = nodeClt.GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, true)
@@ -1628,14 +1626,14 @@ func (s *TLSSuite) TestGetCertAuthority(c *check.C) {
 	defer userClt.Close()
 
 	// user is authorized to fetch CA without secrets
-	_, err = userClt.GetCertAuthority(ctx, types.CertAuthID{
+	_, err = userClt.GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
 	c.Assert(err, check.IsNil)
 
 	// user is not authorized to fetch CA with secrets
-	_, err = userClt.GetCertAuthority(ctx, types.CertAuthID{
+	_, err = userClt.GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, true)
@@ -2047,7 +2045,7 @@ func TestGenerateCerts(t *testing.T) {
 	t.Run("ImpersonateAllow", func(t *testing.T) {
 		// Super impersonator impersonate anyone and login as root
 		maxSessionTTL := 300 * time.Hour
-		superImpersonatorRole, err := types.NewRoleV3("superimpersonator", types.RoleSpecV5{
+		superImpersonatorRole, err := types.NewRole("superimpersonator", types.RoleSpecV5{
 			Options: types.RoleOptions{
 				MaxSessionTTL: types.Duration(maxSessionTTL),
 			},
@@ -2065,7 +2063,7 @@ func TestGenerateCerts(t *testing.T) {
 		require.NoError(t, err)
 
 		// Impersonator can generate certificates for super impersonator
-		role, err := types.NewRoleV3("impersonate", types.RoleSpecV5{
+		role, err := types.NewRole("impersonate", types.RoleSpecV5{
 			Allow: types.RoleConditions{
 				Logins: []string{superImpersonator.GetName()},
 				Impersonate: &types.ImpersonateConditions{
@@ -2310,7 +2308,7 @@ func (s *TLSSuite) TestGenerateAppToken(c *check.C) {
 	authClient, err := s.server.NewClient(TestBuiltin(types.RoleAdmin))
 	c.Assert(err, check.IsNil)
 
-	ca, err := authClient.GetCertAuthority(context.Background(), types.CertAuthID{
+	ca, err := authClient.GetCertAuthority(types.CertAuthID{
 		Type:       types.JWTSigner,
 		DomainName: s.server.ClusterName(),
 	}, true)
@@ -2866,7 +2864,7 @@ func (s *TLSSuite) TestRegisterCAPin(c *check.C) {
 	c.Assert(err, check.NotNil)
 
 	// Add another cert to the CA (dupe the current one for simplicity)
-	hostCA, err := s.server.AuthServer.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+	hostCA, err := s.server.AuthServer.AuthServer.GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.AuthServer.ClusterName,
 		Type:       types.HostCA,
 	}, true)
@@ -2940,7 +2938,7 @@ func (s *TLSSuite) TestRegisterCAPath(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// Extract the root CA public key and write it out to the data dir.
-	hostCA, err := s.server.AuthServer.AuthServer.GetCertAuthority(ctx, types.CertAuthID{
+	hostCA, err := s.server.AuthServer.AuthServer.GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.AuthServer.ClusterName,
 		Type:       types.HostCA,
 	}, false)
@@ -2949,7 +2947,7 @@ func (s *TLSSuite) TestRegisterCAPath(c *check.C) {
 	c.Assert(certs, check.HasLen, 1)
 	certPem := certs[0]
 	caPath := filepath.Join(s.dataDir, defaults.CACertFile)
-	err = os.WriteFile(caPath, certPem, teleport.FileMaskOwnerOnly)
+	err = ioutil.WriteFile(caPath, certPem, teleport.FileMaskOwnerOnly)
 	c.Assert(err, check.IsNil)
 
 	// Attempt to register with valid CA path, should work.
@@ -3062,7 +3060,7 @@ func (s *TLSSuite) TestEventsPermissions(c *check.C) {
 
 	// start rotation
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -3070,7 +3068,7 @@ func (s *TLSSuite) TestEventsPermissions(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, false)
@@ -3199,7 +3197,7 @@ func (s *TLSSuite) TestEventsClusterConfig(c *check.C) {
 
 	// start rotation
 	gracePeriod := time.Hour
-	err = s.server.Auth().RotateCertAuthority(ctx, RotateRequest{
+	err = s.server.Auth().RotateCertAuthority(RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
 		TargetPhase: types.RotationPhaseInit,
@@ -3207,7 +3205,7 @@ func (s *TLSSuite) TestEventsClusterConfig(c *check.C) {
 	})
 	c.Assert(err, check.IsNil)
 
-	ca, err := s.server.Auth().GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := s.server.Auth().GetCertAuthority(types.CertAuthID{
 		DomainName: s.server.ClusterName(),
 		Type:       types.HostCA,
 	}, true)
diff --git a/lib/auth/trustedcluster.go b/lib/auth/trustedcluster.go
index 204b0474c21c7..ad67360a3b321 100644
--- a/lib/auth/trustedcluster.go
+++ b/lib/auth/trustedcluster.go
@@ -98,7 +98,7 @@ func (a *Server) UpsertTrustedCluster(ctx context.Context, trustedCluster types.
 			return nil, trace.Wrap(err)
 		}
 
-		remoteCAs, err := a.establishTrust(ctx, trustedCluster)
+		remoteCAs, err := a.establishTrust(trustedCluster)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -122,7 +122,7 @@ func (a *Server) UpsertTrustedCluster(ctx context.Context, trustedCluster types.
 			return nil, trace.Wrap(err)
 		}
 
-		remoteCAs, err := a.establishTrust(ctx, trustedCluster)
+		remoteCAs, err := a.establishTrust(trustedCluster)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -231,7 +231,7 @@ func (a *Server) DeleteTrustedCluster(ctx context.Context, name string) error {
 	return nil
 }
 
-func (a *Server) establishTrust(ctx context.Context, trustedCluster types.TrustedCluster) ([]types.CertAuthority, error) {
+func (a *Server) establishTrust(trustedCluster types.TrustedCluster) ([]types.CertAuthority, error) {
 	var localCertAuthorities []types.CertAuthority
 
 	domainName, err := a.GetDomainName()
@@ -240,7 +240,7 @@ func (a *Server) establishTrust(ctx context.Context, trustedCluster types.Truste
 	}
 
 	// get a list of certificate authorities for this auth server
-	allLocalCAs, err := a.GetCertAuthorities(ctx, types.HostCA, false)
+	allLocalCAs, err := a.GetCertAuthorities(types.HostCA, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -472,34 +472,15 @@ func (a *Server) validateTrustedCluster(ctx context.Context, validateRequest *Va
 		return nil, trace.Wrap(err)
 	}
 
-	if len(validateRequest.CAs) != 1 {
-		return nil, trace.AccessDenied("expected exactly one certificate authority, received %v", len(validateRequest.CAs))
-	}
-	remoteCA := validateRequest.CAs[0]
-	err = remoteCA.CheckAndSetDefaults()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	if remoteCA.GetType() != types.HostCA {
-		return nil, trace.AccessDenied("expected host certificate authority, received CA with type %q", remoteCA.GetType())
-	}
-
-	// a host CA shouldn't have a rolemap or roles in the first place
-	remoteCA.SetRoleMap(nil)
-	remoteCA.SetRoles(nil)
-
-	remoteClusterName := remoteCA.GetName()
-	if remoteClusterName == domainName {
-		return nil, trace.AccessDenied("remote cluster has same name as this cluster: %v", domainName)
-	}
-	_, err = a.GetTrustedCluster(ctx, remoteClusterName)
-	if err == nil {
-		return nil, trace.AccessDenied("remote cluster has same name as trusted cluster: %v", remoteClusterName)
-	} else if !trace.IsNotFound(err) {
-		return nil, trace.Wrap(err)
+	// add remote cluster resource to keep track of the remote cluster
+	var remoteClusterName string
+	for _, certAuthority := range validateRequest.CAs {
+		// don't add a ca with the same as as local cluster name
+		if certAuthority.GetName() == domainName {
+			return nil, trace.AccessDenied("remote certificate authority has same name as cluster certificate authority: %v", domainName)
+		}
+		remoteClusterName = certAuthority.GetName()
 	}
-
 	remoteCluster, err := types.NewRemoteCluster(remoteClusterName)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -517,9 +498,12 @@ func (a *Server) validateTrustedCluster(ctx context.Context, validateRequest *Va
 		}
 	}
 
-	err = a.UpsertCertAuthority(remoteCA)
-	if err != nil {
-		return nil, trace.Wrap(err)
+	// token has been validated, upsert the given certificate authority
+	for _, certAuthority := range validateRequest.CAs {
+		err = a.UpsertCertAuthority(certAuthority)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
 	}
 
 	// export local cluster certificate authority and return it to the cluster
@@ -528,7 +512,6 @@ func (a *Server) validateTrustedCluster(ctx context.Context, validateRequest *Va
 	}
 	for _, caType := range []types.CertAuthType{types.HostCA, types.UserCA} {
 		certAuthority, err := a.GetCertAuthority(
-			ctx,
 			types.CertAuthID{Type: caType, DomainName: domainName},
 			false)
 		if err != nil {
diff --git a/lib/auth/trustedcluster_test.go b/lib/auth/trustedcluster_test.go
index 5eba93dbaa59f..9091451faf4e0 100644
--- a/lib/auth/trustedcluster_test.go
+++ b/lib/auth/trustedcluster_test.go
@@ -24,7 +24,6 @@ import (
 	authority "github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/backend/memory"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/services/suite"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
@@ -100,131 +99,6 @@ func TestRemoteClusterStatus(t *testing.T) {
 	require.Empty(t, cmp.Diff(rc, gotRC))
 }
 
-func TestValidateTrustedCluster(t *testing.T) {
-	const localClusterName = "localcluster"
-	const validToken = "validtoken"
-	ctx := context.Background()
-
-	testAuth, err := NewTestAuthServer(TestAuthServerConfig{
-		ClusterName: localClusterName,
-		Dir:         t.TempDir(),
-	})
-	require.NoError(t, err)
-	a := testAuth.AuthServer
-
-	tks, err := types.NewStaticTokens(types.StaticTokensSpecV2{
-		StaticTokens: []types.ProvisionTokenV1{{
-			Roles: []types.SystemRole{types.RoleTrustedCluster},
-			Token: validToken,
-		}},
-	})
-	require.NoError(t, err)
-	a.SetStaticTokens(tks)
-
-	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
-		Token: "invalidtoken",
-		CAs:   []types.CertAuthority{},
-	})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "invalid cluster token")
-
-	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
-		Token: validToken,
-		CAs:   []types.CertAuthority{},
-	})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "expected exactly one")
-
-	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
-		Token: validToken,
-		CAs: []types.CertAuthority{
-			suite.NewTestCA(types.HostCA, "rc1"),
-			suite.NewTestCA(types.HostCA, "rc2"),
-		},
-	})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "expected exactly one")
-
-	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
-		Token: validToken,
-		CAs: []types.CertAuthority{
-			suite.NewTestCA(types.UserCA, "rc3"),
-		},
-	})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "expected host certificate authority")
-
-	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
-		Token: validToken,
-		CAs: []types.CertAuthority{
-			suite.NewTestCA(types.HostCA, localClusterName),
-		},
-	})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "same name as this cluster")
-
-	trustedCluster, err := types.NewTrustedCluster("trustedcluster",
-		types.TrustedClusterSpecV2{Roles: []string{"nonempty"}})
-	require.NoError(t, err)
-	// use the UpsertTrustedCluster in Presence as we just want the resource in
-	// the backend, we don't want to actually connect
-	_, err = a.Presence.UpsertTrustedCluster(ctx, trustedCluster)
-	require.NoError(t, err)
-
-	_, err = a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
-		Token: validToken,
-		CAs: []types.CertAuthority{
-			suite.NewTestCA(types.HostCA, trustedCluster.GetName()),
-		},
-	})
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "same name as trusted cluster")
-
-	leafClusterCA := types.CertAuthority(suite.NewTestCA(types.HostCA, "leafcluster"))
-	resp, err := a.validateTrustedCluster(ctx, &ValidateTrustedClusterRequest{
-		Token: validToken,
-		CAs:   []types.CertAuthority{leafClusterCA},
-	})
-	require.NoError(t, err)
-
-	require.Len(t, resp.CAs, 2)
-	require.ElementsMatch(t,
-		[]types.CertAuthType{types.HostCA, types.UserCA},
-		[]types.CertAuthType{resp.CAs[0].GetType(), resp.CAs[1].GetType()},
-	)
-
-	for _, returnedCA := range resp.CAs {
-		localCA, err := a.GetCertAuthority(ctx, types.CertAuthID{
-			Type:       returnedCA.GetType(),
-			DomainName: localClusterName,
-		}, false)
-		require.NoError(t, err)
-		require.True(t, services.CertAuthoritiesEquivalent(localCA, returnedCA))
-	}
-
-	rcs, err := a.GetRemoteClusters()
-	require.NoError(t, err)
-	require.Len(t, rcs, 1)
-	require.Equal(t, leafClusterCA.GetName(), rcs[0].GetName())
-
-	hostCAs, err := a.GetCertAuthorities(ctx, types.HostCA, false)
-	require.NoError(t, err)
-	require.Len(t, hostCAs, 2)
-	require.ElementsMatch(t,
-		[]string{localClusterName, leafClusterCA.GetName()},
-		[]string{hostCAs[0].GetName(), hostCAs[1].GetName()},
-	)
-	require.Empty(t, hostCAs[0].GetRoles())
-	require.Empty(t, hostCAs[0].GetRoleMap())
-	require.Empty(t, hostCAs[1].GetRoles())
-	require.Empty(t, hostCAs[1].GetRoleMap())
-
-	userCAs, err := a.GetCertAuthorities(ctx, types.UserCA, false)
-	require.NoError(t, err)
-	require.Len(t, userCAs, 1)
-	require.Equal(t, localClusterName, userCAs[0].GetName())
-}
-
 func newTestAuthServer(ctx context.Context, t *testing.T, name ...string) *Server {
 	bk, err := memory.New(memory.Config{})
 	require.NoError(t, err)
diff --git a/lib/auth/usertoken.go b/lib/auth/usertoken.go
index 06c4ed86441a9..ce47a20f0a8e6 100644
--- a/lib/auth/usertoken.go
+++ b/lib/auth/usertoken.go
@@ -499,7 +499,7 @@ func (s *Server) CreatePrivilegeToken(ctx context.Context, req *proto.CreatePriv
 	switch {
 	case req.GetExistingMFAResponse() == nil:
 		// Allows users with no devices to bypass second factor re-auth.
-		devices, err := s.Identity.GetMFADevices(ctx, username, false /* withSecrets */)
+		devices, err := s.Identity.GetMFADevices(ctx, username, false)
 		switch {
 		case err != nil:
 			return nil, trace.Wrap(err)
@@ -511,8 +511,7 @@ func (s *Server) CreatePrivilegeToken(ctx context.Context, req *proto.CreatePriv
 
 	default:
 		if err := s.WithUserLock(username, func() error {
-			_, _, err := s.validateMFAAuthResponse(
-				ctx, req.GetExistingMFAResponse(), username, false /* passwordless */)
+			_, err := s.validateMFAAuthResponse(ctx, username, req.GetExistingMFAResponse())
 			return err
 		}); err != nil {
 			return nil, trace.Wrap(err)
diff --git a/lib/auth/webauthn/login.go b/lib/auth/webauthn/login.go
index cfe0a2d038d91..609b6d07d11ff 100644
--- a/lib/auth/webauthn/login.go
+++ b/lib/auth/webauthn/login.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"encoding/base64"
 	"encoding/json"
-	"sort"
 	"time"
 
 	"github.com/duo-labs/webauthn/protocol"
@@ -82,17 +81,6 @@ func (f *loginFlow) begin(ctx context.Context, user string, passwordless bool) (
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-
-		// Sort non-resident keys first, which may cause clients to favor them for
-		// MFA in some scenarios (eg, tsh).
-		sort.Slice(devices, func(i, j int) bool {
-			dev1, dev2 := devices[i], devices[j]
-			web1, web2 := dev1.GetWebauthn(), dev2.GetWebauthn()
-			resident1 := web1 != nil && web1.ResidentKey
-			resident2 := web2 != nil && web2.ResidentKey
-			return !resident1 && resident2
-		})
-
 		u = newWebUser(user, webID, true /* credentialIDOnly */, devices)
 
 		// Let's make sure we have at least one registered credential here, since we
diff --git a/lib/auth/webauthn/register.go b/lib/auth/webauthn/register.go
index 13927f9f8baf8..6ae37d8b2fb2c 100644
--- a/lib/auth/webauthn/register.go
+++ b/lib/auth/webauthn/register.go
@@ -137,19 +137,6 @@ func (f *RegistrationFlow) Begin(ctx context.Context, user string, passwordless
 	}
 	var exclusions []protocol.CredentialDescriptor
 	for _, dev := range devices {
-		// Skip existing U2F devices, letting users "upgrade" their registration is
-		// good for us.
-		if dev.GetU2F() != nil {
-			continue
-		}
-		// Skip resident/non-resident keys depending on whether it's a passwordless
-		// registration.
-		// Letting users have both allows them to "swap" between key types in the
-		// same device.
-		if webDev := dev.GetWebauthn(); webDev != nil && webDev.ResidentKey != passwordless {
-			continue
-		}
-
 		cred, ok := deviceToCredential(dev, true /* idOnly */)
 		if !ok {
 			continue
diff --git a/lib/auth/webauthn/register_test.go b/lib/auth/webauthn/register_test.go
index 614428f05f98b..ee5eeaa619f64 100644
--- a/lib/auth/webauthn/register_test.go
+++ b/lib/auth/webauthn/register_test.go
@@ -15,10 +15,8 @@
 package webauthn_test
 
 import (
-	"bytes"
 	"context"
 	"encoding/pem"
-	"sort"
 	"testing"
 
 	"github.com/duo-labs/webauthn/protocol"
@@ -122,88 +120,6 @@ func TestRegistrationFlow_BeginFinish(t *testing.T) {
 	}
 }
 
-func TestRegistrationFlow_Begin_excludeList(t *testing.T) {
-	const user = "llama"
-	const rpID = "localhost"
-
-	dev1ID := []byte{1, 1, 1} // U2F
-	web1ID := []byte{1, 1, 2} // WebAuthn / MFA
-	rk1ID := []byte{1, 1, 3}  // WebAuthn / passwordless
-	dev1 := &types.MFADevice{
-		Device: &types.MFADevice_U2F{
-			U2F: &types.U2FDevice{
-				KeyHandle: dev1ID,
-			},
-		},
-	}
-	web1 := &types.MFADevice{
-		Device: &types.MFADevice_Webauthn{
-			Webauthn: &types.WebauthnDevice{
-				CredentialId: web1ID,
-			},
-		},
-	}
-	rk1 := &types.MFADevice{
-		Device: &types.MFADevice_Webauthn{
-			Webauthn: &types.WebauthnDevice{
-				CredentialId: rk1ID,
-				ResidentKey:  true,
-			},
-		},
-	}
-	identity := newFakeIdentity(user, dev1, web1, rk1)
-
-	rf := wanlib.RegistrationFlow{
-		Webauthn: &types.Webauthn{
-			RPID: rpID,
-		},
-		Identity: identity,
-	}
-
-	ctx := context.Background()
-	tests := []struct {
-		name            string
-		passwordless    bool
-		wantExcludeList [][]byte
-	}{
-		{
-			name:            "MFA",
-			wantExcludeList: [][]byte{web1ID}, // U2F and resident excluded
-		},
-		{
-			name:            "passwordless",
-			passwordless:    true,
-			wantExcludeList: [][]byte{rk1ID}, // U2F and MFA excluded
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			cc, err := rf.Begin(ctx, user, test.passwordless)
-			require.NoError(t, err, "Begin")
-
-			got := cc.Response.CredentialExcludeList
-			sort.Slice(got, func(i, j int) bool {
-				return bytes.Compare(got[i].CredentialID, got[j].CredentialID) == -1
-			})
-
-			want := make([]protocol.CredentialDescriptor, len(test.wantExcludeList))
-			for i, id := range test.wantExcludeList {
-				want[i] = protocol.CredentialDescriptor{
-					Type:         protocol.PublicKeyCredentialType,
-					CredentialID: id,
-				}
-			}
-			sort.Slice(want, func(i, j int) bool {
-				return bytes.Compare(want[i].CredentialID, want[j].CredentialID) == -1
-			})
-
-			if diff := cmp.Diff(want, got); diff != "" {
-				t.Errorf("Begin() mismatch (-want +got):\n%s", diff)
-			}
-		})
-	}
-}
-
 func TestRegistrationFlow_Begin_webID(t *testing.T) {
 	const rpID = "localhost"
 	ctx := context.Background()
diff --git a/lib/auth/webauthncli/api.go b/lib/auth/webauthncli/api.go
deleted file mode 100644
index caf00749ddb9b..0000000000000
--- a/lib/auth/webauthncli/api.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package webauthncli
-
-import (
-	"context"
-
-	"github.com/gravitational/teleport/api/client/proto"
-
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
-	log "github.com/sirupsen/logrus"
-)
-
-// Login performs client-side, U2F-compatible, Webauthn login.
-// This method blocks until either device authentication is successful or the
-// context is cancelled. Calling Login without a deadline or cancel condition
-// may cause it block forever.
-// The informed user is used to disambiguate credentials in case of passwordless
-// logins.
-// It returns an MFAAuthenticateResponse and the credential user, if a resident
-// credential is used.
-// The caller is expected to prompt the user for action before calling this
-// method.
-func Login(
-	ctx context.Context,
-	origin string, user string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt,
-) (*proto.MFAAuthenticateResponse, string, error) {
-	if IsFIDO2Available() {
-		log.Debug("FIDO2: Using libfido2 for assertion")
-		return FIDO2Login(ctx, origin, user, assertion, prompt)
-	}
-
-	resp, err := U2FLogin(ctx, origin, assertion)
-	return resp, "" /* credentialUser */, err
-}
-
-// Register performs client-side, U2F-compatible, Webauthn registration.
-// This method blocks until either device authentication is successful or the
-// context is cancelled. Calling Register without a deadline or cancel condition
-// may cause it block forever.
-// The caller is expected to prompt the user for action before calling this
-// method.
-func Register(
-	ctx context.Context,
-	origin string, cc *wanlib.CredentialCreation, prompt RegisterPrompt) (*proto.MFARegisterResponse, error) {
-	if IsFIDO2Available() {
-		log.Debug("FIDO2: Using libfido2 for credential creation")
-		return FIDO2Register(ctx, origin, cc, prompt)
-	}
-
-	return U2FRegister(ctx, origin, cc)
-}
diff --git a/lib/auth/webauthncli/export_fido2_test.go b/lib/auth/webauthncli/export_fido2_test.go
deleted file mode 100644
index 36b84e5ff42a3..0000000000000
--- a/lib/auth/webauthncli/export_fido2_test.go
+++ /dev/null
@@ -1,23 +0,0 @@
-//go:build libfido2
-// +build libfido2
-
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package webauthncli
-
-var (
-	FIDODeviceLocations = &fidoDeviceLocations
-	FIDONewDevice       = &fidoNewDevice
-)
diff --git a/lib/auth/webauthncli/fido2.go b/lib/auth/webauthncli/fido2.go
deleted file mode 100644
index 0d6f6c43a0625..0000000000000
--- a/lib/auth/webauthncli/fido2.go
+++ /dev/null
@@ -1,776 +0,0 @@
-//go:build libfido2
-// +build libfido2
-
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package webauthncli
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"sync"
-	"time"
-
-	"github.com/duo-labs/webauthn/protocol"
-	"github.com/duo-labs/webauthn/protocol/webauthncose"
-	"github.com/fxamacker/cbor/v2"
-	"github.com/gravitational/teleport/api/client/proto"
-	"github.com/gravitational/trace"
-	"github.com/keys-pub/go-libfido2"
-
-	wanpb "github.com/gravitational/teleport/api/types/webauthn"
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
-	log "github.com/sirupsen/logrus"
-)
-
-// FIDODevice abstracts *libfido2.Device for testing.
-type FIDODevice interface {
-	// Info mirrors libfido2.Device.Info.
-	Info() (*libfido2.DeviceInfo, error)
-
-	// Cancel mirrors libfido2.Device.Cancel.
-	Cancel() error
-
-	// Credentials mirrors libfido2.Device.Credentials.
-	Credentials(rpID string, pin string) ([]*libfido2.Credential, error)
-
-	// MakeCredential mirrors libfido2.Device.MakeCredential.
-	MakeCredential(
-		clientDataHash []byte,
-		rp libfido2.RelyingParty,
-		user libfido2.User,
-		typ libfido2.CredentialType,
-		pin string,
-		opts *libfido2.MakeCredentialOpts) (*libfido2.Attestation, error)
-
-	// Assertion mirrors libfido2.Device.Assertion.
-	Assertion(
-		rpID string,
-		clientDataHash []byte,
-		credentialIDs [][]byte,
-		pin string,
-		opts *libfido2.AssertionOpts) (*libfido2.Assertion, error)
-}
-
-// fidoDeviceLocations and fidoNewDevice are used to allow testing.
-var fidoDeviceLocations = libfido2.DeviceLocations
-var fidoNewDevice = func(path string) (FIDODevice, error) {
-	return libfido2.NewDevice(path)
-}
-
-// IsFIDO2Available returns true if libfido2 is available in the current build.
-func IsFIDO2Available() bool {
-	return true
-}
-
-// fido2Login implements FIDO2Login.
-func fido2Login(
-	ctx context.Context,
-	origin, user string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt,
-) (*proto.MFAAuthenticateResponse, string, error) {
-	switch {
-	case origin == "":
-		return nil, "", trace.BadParameter("origin required")
-	case assertion == nil:
-		return nil, "", trace.BadParameter("assertion required")
-	case prompt == nil:
-		return nil, "", trace.BadParameter("prompt required")
-	case len(assertion.Response.Challenge) == 0:
-		return nil, "", trace.BadParameter("assertion challenge required")
-	case assertion.Response.RelyingPartyID == "":
-		return nil, "", trace.BadParameter("assertion relying party ID required")
-	}
-
-	allowedCreds := assertion.Response.GetAllowedCredentialIDs()
-	uv := assertion.Response.UserVerification == protocol.VerificationRequired
-	passwordless := len(allowedCreds) == 0 && uv
-
-	// Prepare challenge data for the device.
-	ccdJSON, err := json.Marshal(&CollectedClientData{
-		Type:      string(protocol.AssertCeremony),
-		Challenge: base64.RawURLEncoding.EncodeToString(assertion.Response.Challenge),
-		Origin:    origin,
-	})
-	if err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-	ccdHash := sha256.Sum256(ccdJSON)
-
-	rpID := assertion.Response.RelyingPartyID
-	var appID string
-	if val, ok := assertion.Response.Extensions[wanlib.AppIDExtension]; ok {
-		appID = fmt.Sprint(val)
-	}
-
-	// mu guards the variables below it.
-	var mu sync.Mutex
-	var assertionResp *libfido2.Assertion
-	var credentialID []byte
-	var userID []byte
-	var username string
-	var usedAppID bool
-
-	filter := func(dev FIDODevice, info *deviceInfo) (bool, error) {
-		switch {
-		case uv && !info.uvCapable():
-			log.Debugf("FIDO2: Device %v: filtered due to lack of UV", info.path)
-			return false, nil
-		case passwordless && !info.rk:
-			log.Debugf("FIDO2: Device %v: filtered due to lack of RK", info.path)
-			return false, nil
-		case len(allowedCreds) == 0: // Nothing else to check
-			return true, nil
-		}
-
-		// Does the device have a suitable credential?
-		const pin = "" // not required to filter
-		if _, err := dev.Assertion(rpID, ccdHash[:], allowedCreds, pin, &libfido2.AssertionOpts{
-			UP: libfido2.False,
-		}); err == nil {
-			return true, nil
-		}
-
-		// Try again with the App ID, if present.
-		if appID == "" {
-			return false, nil
-		}
-		if _, err := dev.Assertion(appID, ccdHash[:], allowedCreds, pin, &libfido2.AssertionOpts{
-			UP: libfido2.False,
-		}); err != nil {
-			log.Debugf("FIDO2: Device %v: filtered due to lack of allowed credential", info.path)
-			return false, nil
-		}
-		return true, nil
-	}
-
-	deviceCallback := func(dev FIDODevice, info *deviceInfo, pin string) error {
-		var actualRPID string
-		var cID []byte
-		var uID []byte
-		var uName string
-		if passwordless {
-			cred, err := getPasswordlessCredentials(dev, pin, rpID, user)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-			actualRPID = rpID
-			cID = cred.ID
-			uID = cred.User.ID
-			uName = cred.User.Name
-		} else {
-			// TODO(codingllama): Ideally we'd rely on fido_assert_id_ptr/_len.
-			var err error
-			actualRPID, cID, err = getMFACredentials(dev, pin, rpID, appID, allowedCreds)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-		}
-
-		if passwordless {
-			// Ask for another touch before the assertion, we used the first touch
-			// in the Credentials() call.
-			if err := prompt.PromptAdditionalTouch(); err != nil {
-				return trace.Wrap(err)
-			}
-		}
-
-		opts := &libfido2.AssertionOpts{
-			UP: libfido2.True,
-		}
-		if uv {
-			opts.UV = libfido2.True
-		}
-		resp, err := dev.Assertion(actualRPID, ccdHash[:], [][]byte{cID}, pin, opts)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		// Use the first successful assertion.
-		// In practice it is very unlikely we'd hit this twice.
-		mu.Lock()
-		if assertionResp == nil {
-			assertionResp = resp
-			credentialID = cID
-			userID = uID
-			username = uName
-			usedAppID = actualRPID != rpID
-		}
-		mu.Unlock()
-		return nil
-	}
-
-	skipAdditionalPrompt := passwordless
-	if err := runOnFIDO2Devices(ctx, prompt, skipAdditionalPrompt, filter, deviceCallback); err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-
-	var rawAuthData []byte
-	if err := cbor.Unmarshal(assertionResp.AuthDataCBOR, &rawAuthData); err != nil {
-		return nil, "", trace.Wrap(err)
-	}
-
-	return &proto.MFAAuthenticateResponse{
-		Response: &proto.MFAAuthenticateResponse_Webauthn{
-			Webauthn: &wanpb.CredentialAssertionResponse{
-				Type:  string(protocol.PublicKeyCredentialType),
-				RawId: credentialID,
-				Response: &wanpb.AuthenticatorAssertionResponse{
-					ClientDataJson:    ccdJSON,
-					AuthenticatorData: rawAuthData,
-					Signature:         assertionResp.Sig,
-					UserHandle:        userID,
-				},
-				Extensions: &wanpb.AuthenticationExtensionsClientOutputs{
-					AppId: usedAppID,
-				},
-			},
-		},
-	}, username, nil
-}
-
-func getPasswordlessCredentials(dev FIDODevice, pin, rpID, user string) (*libfido2.Credential, error) {
-	creds, err := dev.Credentials(rpID, pin)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	switch {
-	case len(creds) == 0:
-		return nil, libfido2.ErrNoCredentials
-	case len(creds) == 1 && user == "": // no need to disambiguate
-		cred := creds[0]
-		log.Debugf("FIDO2: Found resident credential for user %q", cred.User.Name)
-		return cred, nil
-	case len(creds) > 1 && user == "": // can't disambiguate
-		return nil, trace.BadParameter("too many credentials found, explicit user required")
-	}
-
-	duplicateWarning := false
-	var res *libfido2.Credential
-	for _, cred := range creds {
-		if cred.User.Name == user {
-			// Print information about matched credential, useful for debugging.
-			// ykman prints user IDs in hex, hence the unusual encoding choice below.
-			cID := base64.RawURLEncoding.EncodeToString(cred.ID)
-			uID := cred.User.ID
-			log.Debugf("FIDO2: Found resident credential for user %v, credential ID (b64) = %v, user ID (hex) = %x", user, cID, uID)
-			if res == nil {
-				res = cred
-				continue // Don't break, we want to warn about duplicates.
-			}
-			if !duplicateWarning {
-				duplicateWarning = true
-				log.Warnf("Found multiple credentials for %q, using first match", user)
-			}
-		}
-	}
-	if res == nil {
-		return nil, trace.BadParameter("no credentials for user %q", user)
-	}
-	return res, nil
-}
-
-func getMFACredentials(dev FIDODevice, pin, rpID, appID string, allowedCreds [][]byte) (string, []byte, error) {
-	// The actual hash is not necessary here.
-	const cdh = "00000000000000000000000000000000"
-
-	opts := &libfido2.AssertionOpts{
-		UP: libfido2.False,
-	}
-	actualRPID := rpID
-	var cID []byte
-	for _, cred := range allowedCreds {
-		_, err := dev.Assertion(rpID, []byte(cdh), [][]byte{cred}, pin, opts)
-		if err == nil {
-			cID = cred
-			break
-		}
-
-		// Try again with the U2F appID, if present.
-		if appID != "" {
-			_, err = dev.Assertion(appID, []byte(cdh), [][]byte{cred}, pin, opts)
-			if err == nil {
-				actualRPID = appID
-				cID = cred
-				break
-			}
-		}
-	}
-	if len(cID) == 0 {
-		return "", nil, libfido2.ErrNoCredentials
-	}
-
-	return actualRPID, cID, nil
-}
-
-// fido2Register implements FIDO2Register.
-func fido2Register(
-	ctx context.Context,
-	origin string, cc *wanlib.CredentialCreation, prompt RegisterPrompt,
-) (*proto.MFARegisterResponse, error) {
-	switch {
-	case origin == "":
-		return nil, trace.BadParameter("origin required")
-	case cc == nil:
-		return nil, trace.BadParameter("credential creation required")
-	case prompt == nil:
-		return nil, trace.BadParameter("prompt required")
-	case len(cc.Response.Challenge) == 0:
-		return nil, trace.BadParameter("credential creation challenge required")
-	case cc.Response.RelyingParty.ID == "":
-		return nil, trace.BadParameter("credential creation relying party ID required")
-	}
-
-	rrk := cc.Response.AuthenticatorSelection.RequireResidentKey != nil && *cc.Response.AuthenticatorSelection.RequireResidentKey
-	if rrk {
-		// Be more pedantic with resident keys, some of this info gets recorded with
-		// the credential.
-		switch {
-		case len(cc.Response.RelyingParty.Name) == 0:
-			return nil, trace.BadParameter("relying party name required for resident credential")
-		case len(cc.Response.User.Name) == 0:
-			return nil, trace.BadParameter("user name required for resident credential")
-		case len(cc.Response.User.DisplayName) == 0:
-			return nil, trace.BadParameter("user display name required for resident credential")
-		case len(cc.Response.User.ID) == 0:
-			return nil, trace.BadParameter("user ID required for resident credential")
-		}
-	}
-
-	// Can we create ES256 keys?
-	// TODO(codingllama): Consider supporting other algorithms and respecting
-	//  param order in the credential.
-	ok := false
-	for _, p := range cc.Response.Parameters {
-		if p.Type == protocol.PublicKeyCredentialType && p.Algorithm == webauthncose.AlgES256 {
-			ok = true
-			break
-		}
-	}
-	if !ok {
-		return nil, trace.BadParameter("ES256 not allowed by credential parameters")
-	}
-
-	// Prepare challenge data for the device.
-	ccdJSON, err := json.Marshal(&CollectedClientData{
-		Type:      string(protocol.CreateCeremony),
-		Challenge: base64.RawURLEncoding.EncodeToString(cc.Response.Challenge),
-		Origin:    origin,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	ccdHash := sha256.Sum256(ccdJSON)
-
-	rp := libfido2.RelyingParty{
-		ID:   cc.Response.RelyingParty.ID,
-		Name: cc.Response.RelyingParty.Name,
-	}
-	user := libfido2.User{
-		ID:          cc.Response.User.ID,
-		Name:        cc.Response.User.Name,
-		DisplayName: cc.Response.User.DisplayName,
-		Icon:        cc.Response.User.Icon,
-	}
-	plat := cc.Response.AuthenticatorSelection.AuthenticatorAttachment == protocol.Platform
-	uv := cc.Response.AuthenticatorSelection.UserVerification == protocol.VerificationRequired
-
-	excludeList := make([][]byte, len(cc.Response.CredentialExcludeList))
-	for i := range cc.Response.CredentialExcludeList {
-		excludeList[i] = cc.Response.CredentialExcludeList[i].CredentialID
-	}
-
-	// mu guards attestation from goroutines.
-	var mu sync.Mutex
-	var attestation *libfido2.Attestation
-
-	filter := func(dev FIDODevice, info *deviceInfo) (bool, error) {
-		switch {
-		case (plat && !info.plat) || (rrk && !info.rk) || (uv && !info.uvCapable()):
-			log.Debugf("FIDO2: Device %v: filtered due to options", info.path)
-			return false, nil
-		case len(excludeList) == 0:
-			return true, nil
-		}
-
-		// Does the device hold an excluded credential?
-		const pin = "" // not required to filter
-		switch _, err := dev.Assertion(rp.ID, ccdHash[:], excludeList, pin, &libfido2.AssertionOpts{
-			UP: libfido2.False,
-		}); {
-		case errors.Is(err, libfido2.ErrNoCredentials):
-			return true, nil
-		case err == nil:
-			log.Debugf("FIDO2: Device %v: filtered due to presence of excluded credential", info.path)
-			return false, nil
-		default: // unexpected error
-			return false, trace.Wrap(err)
-		}
-	}
-
-	deviceCallback := func(d FIDODevice, info *deviceInfo, pin string) error {
-		// TODO(codingllama): We may need to setup a PIN if rrk=true.
-		//  Do that as a response to specific MakeCredential failures.
-
-		opts := &libfido2.MakeCredentialOpts{}
-		if rrk {
-			opts.RK = libfido2.True
-		}
-		// Only set the "uv" bit if the authenticator supports built-in
-		// verification. PIN-enabled devices don't claim to support "uv", but they
-		// are capable of UV assertions.
-		// See
-		// https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#getinfo-uv.
-		if uv && info.uv {
-			opts.UV = libfido2.True
-		}
-
-		resp, err := d.MakeCredential(ccdHash[:], rp, user, libfido2.ES256, pin, opts)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		// Use the first successful attestation.
-		// In practice it is very unlikely we'd hit this twice.
-		mu.Lock()
-		if attestation == nil {
-			attestation = resp
-		}
-		mu.Unlock()
-		return nil
-	}
-
-	const skipAdditionalPrompt = false
-	if err := runOnFIDO2Devices(ctx, prompt, skipAdditionalPrompt, filter, deviceCallback); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	var rawAuthData []byte
-	if err := cbor.Unmarshal(attestation.AuthData, &rawAuthData); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	format, attStatement, err := makeAttStatement(attestation)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	attObj := &protocol.AttestationObject{
-		RawAuthData:  rawAuthData,
-		Format:       format,
-		AttStatement: attStatement,
-	}
-	attestationCBOR, err := cbor.Marshal(attObj)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return &proto.MFARegisterResponse{
-		Response: &proto.MFARegisterResponse_Webauthn{
-			Webauthn: &wanpb.CredentialCreationResponse{
-				Type:  string(protocol.PublicKeyCredentialType),
-				RawId: attestation.CredentialID,
-				Response: &wanpb.AuthenticatorAttestationResponse{
-					ClientDataJson:    ccdJSON,
-					AttestationObject: attestationCBOR,
-				},
-			},
-		},
-	}, nil
-}
-
-func makeAttStatement(attestation *libfido2.Attestation) (string, map[string]interface{}, error) {
-	const fidoU2F = "fido-u2f"
-	const none = "none"
-	const packed = "packed"
-
-	// See https://www.w3.org/TR/webauthn-2/#sctn-defined-attestation-formats.
-	// The formats handled below are what we expect from the keys libfido2
-	// interacts with.
-	format := attestation.Format
-	switch format {
-	case fidoU2F, packed: // OK, continue below
-	case none:
-		return format, nil, nil
-	default:
-		log.Debugf(`FIDO2: Unsupported attestation format %q, using "none"`, format)
-		return none, nil, nil
-	}
-
-	sig := attestation.Sig
-	if len(sig) == 0 {
-		return "", nil, trace.BadParameter("attestation %q without signature", format)
-	}
-	cert := attestation.Cert
-	if len(cert) == 0 {
-		return "", nil, trace.BadParameter("attestation %q without certificate", format)
-	}
-
-	m := map[string]interface{}{
-		"sig": sig,
-		"x5c": []interface{}{cert},
-	}
-	if format == packed {
-		m["alg"] = int64(attestation.CredentialType)
-	}
-
-	return format, m, nil
-}
-
-type deviceWithInfo struct {
-	FIDODevice
-	info *deviceInfo
-}
-
-type deviceFilterFunc func(dev FIDODevice, info *deviceInfo) (ok bool, err error)
-type deviceCallbackFunc func(dev FIDODevice, info *deviceInfo, pin string) error
-
-// runPrompt defines the prompt operations necessary for runOnFIDO2Devices.
-type runPrompt LoginPrompt
-
-func runOnFIDO2Devices(
-	ctx context.Context,
-	prompt runPrompt, skipAdditionalPrompt bool,
-	filter deviceFilterFunc,
-	deviceCallback deviceCallbackFunc) error {
-	devices, err := findSuitableDevicesOrTimeout(ctx, filter)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	dev, requiresPIN, err := selectDevice(ctx, devices, deviceCallback)
-	switch {
-	case err != nil:
-		return trace.Wrap(err)
-	case !requiresPIN:
-		return nil
-	}
-
-	// Selected device requires PIN, let's use the prompt and run the callback
-	// again.
-	pin, err := prompt.PromptPIN()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Ask for an additional touch after PIN.
-	// Works for most flows (except passwordless).
-	if !skipAdditionalPrompt {
-		if err := prompt.PromptAdditionalTouch(); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	return trace.Wrap(deviceCallback(dev, dev.info, pin))
-}
-
-func findSuitableDevicesOrTimeout(ctx context.Context, filter deviceFilterFunc) ([]deviceWithInfo, error) {
-	ticker := time.NewTicker(FIDO2PollInterval)
-	defer ticker.Stop()
-
-	knownPaths := make(map[string]struct{})
-	for {
-		devices, err := findSuitableDevices(filter, knownPaths)
-		if err == nil {
-			return devices, nil
-		}
-		log.WithError(err).Debug("FIDO2: Selecting devices")
-
-		select {
-		case <-ctx.Done():
-			return nil, trace.Wrap(ctx.Err())
-		case <-ticker.C:
-		}
-	}
-}
-
-func findSuitableDevices(filter deviceFilterFunc, knownPaths map[string]struct{}) ([]deviceWithInfo, error) {
-	locs, err := fidoDeviceLocations()
-	if err != nil {
-		return nil, trace.Wrap(err, "device locations")
-	}
-
-	var devs []deviceWithInfo
-	for _, loc := range locs {
-		path := loc.Path
-		if _, ok := knownPaths[path]; ok {
-			continue
-		}
-		knownPaths[path] = struct{}{}
-
-		dev, err := fidoNewDevice(path)
-		if err != nil {
-			return nil, trace.Wrap(err, "device %v: open", path)
-		}
-
-		var info *libfido2.DeviceInfo
-		const infoAttempts = 3
-		for i := 0; i < infoAttempts; i++ {
-			info, err = dev.Info()
-			switch {
-			case errors.Is(err, libfido2.ErrTX):
-				// Happens occasionally, give the device a short grace period and retry.
-				time.Sleep(1 * time.Millisecond)
-				continue
-			case err != nil: // unexpected error
-				return nil, trace.Wrap(err, "device %v: info", path)
-			}
-			break // err == nil
-		}
-		if info == nil {
-			return nil, trace.Wrap(libfido2.ErrTX, "device %v: max info attempts reached", path)
-		}
-		log.Debugf("FIDO2: Info for device %v: %#v", path, info)
-
-		di := makeDevInfo(path, info)
-		switch ok, err := filter(dev, di); {
-		case err != nil:
-			return nil, trace.Wrap(err, "device %v: filter", path)
-		case !ok:
-			continue // Skip device.
-		}
-		devs = append(devs, deviceWithInfo{FIDODevice: dev, info: di})
-	}
-
-	if len(devs) == 0 {
-		return nil, errors.New("no suitable devices found")
-	}
-
-	return devs, nil
-}
-
-func selectDevice(ctx context.Context, devices []deviceWithInfo, deviceCallback deviceCallbackFunc) (deviceWithInfo, bool, error) {
-	// We don't know the PIN in the device selection step, so we are optimistic
-	// about the fact that there is no PIN.
-	const pin = ""
-
-	callbackWrapper := func(dev FIDODevice, info *deviceInfo, pin string) (requiresPIN bool, err error) {
-		// Attempt to select a device by running "deviceCallback" on it.
-		// For most scenarios this works, saving a touch.
-		if err = deviceCallback(dev, info, pin); !errors.Is(err, libfido2.ErrPinRequired) {
-			return
-		}
-
-		// ErrPinRequired means we can't use "deviceCallback" as the selection
-		// mechanism. Let's run a different operation to ask for a touch.
-		requiresPIN = true
-
-		// TODO(codingllama): What we really want here is fido_dev_get_touch_begin.
-		//  Another option is to put the authenticator into U2F mode.
-		const rpID = "7f364cc0-958c-4177-b3ea-b2d8d7f15d4a" // arbitrary, unlikely to collide with a real RP
-		const cdh = "00000000000000000000000000000000"      // "random", size 32
-		_, err = dev.Assertion(rpID, []byte(cdh), nil /* credentials */, pin, &libfido2.AssertionOpts{
-			UP: libfido2.True,
-		})
-		if errors.Is(err, libfido2.ErrNoCredentials) {
-			err = nil // OK, selected successfully
-		}
-		return
-	}
-
-	// No need for goroutine shenanigans with a single device.
-	if len(devices) == 1 {
-		dev := devices[0]
-		requiresPIN, err := callbackWrapper(dev, dev.info, pin)
-		return dev, requiresPIN, trace.Wrap(err)
-	}
-
-	type selectResp struct {
-		dev         deviceWithInfo
-		requiresPIN bool
-		err         error
-	}
-
-	respC := make(chan selectResp)
-	numGoroutines := len(devices)
-	for _, dev := range devices {
-		dev := dev
-		go func() {
-			requiresPIN, err := callbackWrapper(dev, dev.info, pin)
-			respC <- selectResp{
-				dev:         dev,
-				requiresPIN: requiresPIN,
-				err:         err,
-			}
-		}()
-	}
-
-	// Stop on timeout or first interaction, whatever comes first wins and gets
-	// returned.
-	var resp selectResp
-	select {
-	case <-ctx.Done():
-		resp.err = ctx.Err()
-	case resp = <-respC:
-		numGoroutines--
-	}
-
-	// Cancel ongoing operations and wait for goroutines to complete.
-	for _, dev := range devices {
-		if dev == resp.dev {
-			continue
-		}
-		if err := dev.Cancel(); err != nil {
-			log.WithError(err).Tracef("FIDO2: Device cancel")
-		}
-	}
-	for i := 0; i < numGoroutines; i++ {
-		cancelResp := <-respC
-		if err := cancelResp.err; err != nil && !errors.Is(err, libfido2.ErrKeepaliveCancel) {
-			log.WithError(err).Debugf("FIDO2: Device errored on cancel")
-		}
-	}
-
-	return resp.dev, resp.requiresPIN, trace.Wrap(resp.err)
-}
-
-// deviceInfo contains an aggregate of a device's informations and capabilities.
-// Various fields match options under
-// https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo.
-type deviceInfo struct {
-	path                           string
-	plat                           bool
-	rk                             bool
-	clientPinCapable, clientPinSet bool
-	uv                             bool
-}
-
-// uvCapable returns true for both "uv" and pin-configured devices.
-func (di *deviceInfo) uvCapable() bool {
-	return di.uv || di.clientPinSet
-}
-
-func makeDevInfo(path string, info *libfido2.DeviceInfo) *deviceInfo {
-	di := &deviceInfo{path: path}
-	for _, opt := range info.Options {
-		// See
-		// https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo.
-		switch opt.Name {
-		case "plat":
-			di.plat = opt.Value == libfido2.True
-		case "rk":
-			di.rk = opt.Value == libfido2.True
-		case "clientPin":
-			di.clientPinCapable = true
-			di.clientPinSet = opt.Value == libfido2.True
-		case "uv":
-			di.uv = opt.Value == libfido2.True
-		}
-	}
-	return di
-}
diff --git a/lib/auth/webauthncli/fido2_common.go b/lib/auth/webauthncli/fido2_common.go
deleted file mode 100644
index 9eb307c2ad1f4..0000000000000
--- a/lib/auth/webauthncli/fido2_common.go
+++ /dev/null
@@ -1,75 +0,0 @@
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package webauthncli
-
-import (
-	"context"
-	"time"
-
-	"github.com/gravitational/teleport/api/client/proto"
-
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
-)
-
-// FIDO2PollInterval is the poll interval used to check for new FIDO2 devices.
-var FIDO2PollInterval = 200 * time.Millisecond
-
-// LoginPrompt is the user interface for FIDO2Login.
-type LoginPrompt interface {
-	// PromptPIN prompts the user for their PIN.
-	PromptPIN() (string, error)
-	// PromptAdditionalTouch prompts the user for an additional security key
-	// touch.
-	// Additional touches may be required after PINs and during passwordless flows.
-	PromptAdditionalTouch() error
-}
-
-// FIDO2Login implements Login for CTAP1 and CTAP2 devices.
-// It must be called with a context with timeout, otherwise it can run
-// indefinitely.
-// The informed user is used to disambiguate credentials in case of passwordless
-// logins.
-// It returns an MFAAuthenticateResponse and the credential user, if a resident
-// credential is used.
-// Most callers should call Login directly, as it is correctly guarded by
-// IsFIDO2Available.
-func FIDO2Login(
-	ctx context.Context,
-	origin, user string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt,
-) (*proto.MFAAuthenticateResponse, string, error) {
-	return fido2Login(ctx, origin, user, assertion, prompt)
-}
-
-// RegisterPrompt is the user interface for FIDO2Register.
-type RegisterPrompt interface {
-	// PromptPIN prompts the user for their PIN.
-	PromptPIN() (string, error)
-	// PromptAdditionalTouch prompts the user for an additional security key
-	// touch.
-	// Additional touches may be required after PINs.
-	PromptAdditionalTouch() error
-}
-
-// FIDO2Register implements Register for CTAP1 and CTAP2 devices.
-// It must be called with a context with timeout, otherwise it can run
-// indefinitely.
-// Most callers should call Register directly, as it is correctly guarded by
-// IsFIDO2Available.
-func FIDO2Register(
-	ctx context.Context,
-	origin string, cc *wanlib.CredentialCreation, prompt RegisterPrompt,
-) (*proto.MFARegisterResponse, error) {
-	return fido2Register(ctx, origin, cc, prompt)
-}
diff --git a/lib/auth/webauthncli/fido2_other.go b/lib/auth/webauthncli/fido2_other.go
deleted file mode 100644
index 4bb43e4a6c2c6..0000000000000
--- a/lib/auth/webauthncli/fido2_other.go
+++ /dev/null
@@ -1,48 +0,0 @@
-//go:build !libfido2
-// +build !libfido2
-
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package webauthncli
-
-import (
-	"context"
-	"errors"
-
-	"github.com/gravitational/teleport/api/client/proto"
-
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
-)
-
-var errFIDO2Unavailable = errors.New("FIDO2 unavailable in current build")
-
-// IsFIDO2Available returns true if libfido2 is available in the current build.
-func IsFIDO2Available() bool {
-	return false
-}
-
-func fido2Login(
-	ctx context.Context,
-	origin, user string, assertion *wanlib.CredentialAssertion, prompt LoginPrompt,
-) (*proto.MFAAuthenticateResponse, string, error) {
-	return nil, "", errFIDO2Unavailable
-}
-
-func fido2Register(
-	ctx context.Context,
-	origin string, cc *wanlib.CredentialCreation, prompt RegisterPrompt,
-) (*proto.MFARegisterResponse, error) {
-	return nil, errFIDO2Unavailable
-}
diff --git a/lib/auth/webauthncli/fido2_test.go b/lib/auth/webauthncli/fido2_test.go
deleted file mode 100644
index c3c083f6f5630..0000000000000
--- a/lib/auth/webauthncli/fido2_test.go
+++ /dev/null
@@ -1,1438 +0,0 @@
-//go:build libfido2
-// +build libfido2
-
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package webauthncli_test
-
-import (
-	"bytes"
-	"context"
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/duo-labs/webauthn/protocol"
-	"github.com/duo-labs/webauthn/protocol/webauthncose"
-	"github.com/fxamacker/cbor/v2"
-	"github.com/google/go-cmp/cmp"
-	"github.com/gravitational/teleport/lib/auth/mocku2f"
-	"github.com/keys-pub/go-libfido2"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	wanpb "github.com/gravitational/teleport/api/types/webauthn"
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
-	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
-)
-
-var makeCredentialAuthDataRaw, makeCredentialAuthDataCBOR, makeCredentialSig []byte
-var assertionAuthDataRaw, assertionAuthDataCBOR, assertionSig []byte
-
-func init() {
-	// Initialize arrays with random data, but use realistic sizes.
-	// YMMV.
-	makeCredentialAuthDataRaw = make([]byte, 37)
-	makeCredentialSig = make([]byte, 70)
-	assertionAuthDataRaw = make([]byte, 37)
-	assertionSig = make([]byte, 70)
-	for _, b := range [][]byte{
-		makeCredentialAuthDataRaw,
-		makeCredentialSig,
-		assertionAuthDataRaw,
-		assertionSig,
-	} {
-		if _, err := rand.Read(b); err != nil {
-			panic(err)
-		}
-	}
-
-	// Returned authData is CBOR-encoded, so let's do that.
-	pairs := []*[]byte{
-		&makeCredentialAuthDataRaw, &makeCredentialAuthDataCBOR,
-		&assertionAuthDataRaw, &assertionAuthDataCBOR,
-	}
-	for i := 0; i < len(pairs); i += 2 {
-		dataRaw := pairs[i]
-		dataCBOR := pairs[i+1]
-
-		res, err := cbor.Marshal(*dataRaw)
-		if err != nil {
-			panic(err)
-		}
-		*dataCBOR = res
-	}
-}
-
-type noopPrompt struct{}
-
-func (p noopPrompt) PromptPIN() (string, error) {
-	return "", nil
-}
-
-func (p noopPrompt) PromptAdditionalTouch() error {
-	return nil
-}
-
-func TestFIDO2Login(t *testing.T) {
-	resetFIDO2AfterTests(t)
-	wancli.FIDO2PollInterval = 1 * time.Millisecond // run fast on tests
-
-	const rpID = "example.com"
-	const appID = "https://example.com"
-	const origin = "https://example.com"
-
-	authOpts := []libfido2.Option{
-		{Name: "rk", Value: "true"},
-		{Name: "up", Value: "true"},
-		{Name: "plat", Value: "false"},
-		{Name: "clientPin", Value: "false"}, // supported but unset
-	}
-	pinOpts := []libfido2.Option{
-		{Name: "rk", Value: "true"},
-		{Name: "up", Value: "true"},
-		{Name: "plat", Value: "false"},
-		{Name: "clientPin", Value: "true"}, // supported and configured
-	}
-	bioOpts := []libfido2.Option{
-		{Name: "rk", Value: "true"},
-		{Name: "up", Value: "true"},
-		{Name: "uv", Value: "true"},
-		{Name: "plat", Value: "false"},
-		{Name: "alwaysUv", Value: "true"},
-		{Name: "bioEnroll", Value: "true"}, // supported and configured
-		{Name: "clientPin", Value: "true"}, // supported and configured
-	}
-
-	// User IDs and names for resident credentials / passwordless.
-	const llamaName = "llama"
-	const alpacaName = "alpaca"
-	var llamaID = make([]byte, 16)
-	var alpacaID = make([]byte, 16)
-	for _, b := range [][]byte{llamaID, alpacaID} {
-		_, err := rand.Read(b)
-		require.NoError(t, err, "Read failed")
-	}
-
-	// auth1 is a FIDO2 authenticator without a PIN configured.
-	auth1 := mustNewFIDO2Device("/path1", "" /* pin */, &libfido2.DeviceInfo{
-		Options: authOpts,
-	})
-	// pin1 is a FIDO2 authenticator with a PIN.
-	pin1 := mustNewFIDO2Device("/pin1", "supersecretpinllama", &libfido2.DeviceInfo{
-		Options: pinOpts,
-	})
-	// pin2 is a FIDO2 authenticator with a PIN.
-	pin2 := mustNewFIDO2Device("/pin2", "supersecretpin2", &libfido2.DeviceInfo{
-		Options: pinOpts,
-	})
-	// pin3 is a FIDO2 authenticator with a PIN and resident credentials.
-	pin3 := mustNewFIDO2Device("/pin3", "supersecretpin3", &libfido2.DeviceInfo{
-		Options: pinOpts,
-	}, &libfido2.Credential{
-		User: libfido2.User{
-			ID:   alpacaID,
-			Name: alpacaName,
-		},
-	})
-	// bio1 is a biometric authenticator.
-	bio1 := mustNewFIDO2Device("/bio1", "supersecretBIOpin", &libfido2.DeviceInfo{
-		Options: bioOpts,
-	})
-	// bio2 is a biometric authenticator with configured resident credentials.
-	bio2 := mustNewFIDO2Device("/bio2", "supersecretBIO2pin", &libfido2.DeviceInfo{
-		Options: bioOpts,
-	}, &libfido2.Credential{
-		User: libfido2.User{
-			ID:   llamaID,
-			Name: llamaName,
-		},
-	}, &libfido2.Credential{
-		User: libfido2.User{
-			ID:   alpacaID,
-			Name: alpacaName,
-		},
-	})
-	// legacy1 is an authenticator registered using the U2F App ID.
-	legacy1 := mustNewFIDO2Device("/legacy1", "" /* pin */, &libfido2.DeviceInfo{Options: authOpts})
-	legacy1.wantRPID = appID
-
-	challenge, err := protocol.CreateChallenge()
-	require.NoError(t, err, "CreateChallenge failed")
-
-	baseAssertion := &wanlib.CredentialAssertion{
-		Response: protocol.PublicKeyCredentialRequestOptions{
-			Challenge:          challenge,
-			RelyingPartyID:     rpID,
-			AllowedCredentials: []protocol.CredentialDescriptor{},
-			UserVerification:   protocol.VerificationDiscouraged,
-			Extensions:         map[string]interface{}{},
-		},
-	}
-
-	tests := []struct {
-		name            string
-		timeout         time.Duration
-		fido2           *fakeFIDO2
-		setUP           func()
-		user            string
-		createAssertion func() *wanlib.CredentialAssertion
-		prompt          wancli.LoginPrompt
-		// assertResponse and wantErr are mutually exclusive.
-		assertResponse func(t *testing.T, resp *wanpb.CredentialAssertionResponse)
-		wantErr        string
-	}{
-		{
-			name:  "single device",
-			fido2: newFakeFIDO2(auth1),
-			setUP: func() {
-				go func() {
-					// Simulate delayed user press.
-					time.Sleep(100 * time.Millisecond)
-					auth1.setUP()
-				}()
-			},
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: auth1.credentialID()},
-				}
-				return &cp
-			},
-			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
-				assert.Equal(t, auth1.credentialID(), resp.RawId, "RawId mismatch")
-			},
-		},
-		{
-			name:  "pin protected device",
-			fido2: newFakeFIDO2(pin1),
-			setUP: pin1.setUP,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: pin1.credentialID()},
-				}
-				return &cp
-			},
-		},
-		{
-			name:  "biometric device",
-			fido2: newFakeFIDO2(bio1),
-			setUP: bio1.setUP,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: bio1.credentialID()},
-				}
-				return &cp
-			},
-		},
-		{
-			name:  "legacy device (AppID)",
-			fido2: newFakeFIDO2(legacy1),
-			setUP: legacy1.setUP,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: legacy1.credentialID()},
-				}
-				cp.Response.Extensions = protocol.AuthenticationExtensions{
-					wanlib.AppIDExtension: appID,
-				}
-				return &cp
-			},
-			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
-				assert.True(t, resp.Extensions.AppId, "AppID mismatch")
-			},
-		},
-		{
-			name: "multiple valid devices",
-			fido2: newFakeFIDO2(
-				auth1,
-				pin1,
-				bio1,
-				legacy1,
-			),
-			setUP: bio1.setUP,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: auth1.credentialID()},
-					{CredentialID: pin1.credentialID()},
-					{CredentialID: bio1.credentialID()},
-					{CredentialID: legacy1.credentialID()},
-				}
-				cp.Response.Extensions = protocol.AuthenticationExtensions{
-					wanlib.AppIDExtension: appID,
-				}
-				return &cp
-			},
-			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
-				assert.Equal(t, bio1.credentialID(), resp.RawId, "RawId mismatch (want bio1)")
-			},
-		},
-		{
-			name: "multiple devices filtered",
-			fido2: newFakeFIDO2(
-				auth1, // allowed
-				pin1,  // not allowed
-				bio1,
-				legacy1, // doesn't match RPID or AppID
-			),
-			setUP: auth1.setUP,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: auth1.credentialID()},
-					{CredentialID: bio1.credentialID()},
-					{CredentialID: legacy1.credentialID()},
-				}
-				cp.Response.Extensions = protocol.AuthenticationExtensions{
-					wanlib.AppIDExtension: "https://badexample.com",
-				}
-				return &cp
-			},
-			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
-				assert.Equal(t, auth1.credentialID(), resp.RawId, "RawId mismatch (want auth1)")
-			},
-		},
-		{
-			name: "multiple pin devices",
-			fido2: newFakeFIDO2(
-				auth1,
-				pin1, pin2,
-				bio1,
-			),
-			setUP: pin2.setUP,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: auth1.credentialID()},
-					{CredentialID: pin1.credentialID()},
-					{CredentialID: pin2.credentialID()},
-					{CredentialID: bio1.credentialID()},
-				}
-				return &cp
-			},
-			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
-				assert.Equal(t, pin2.credentialID(), resp.RawId, "RawId mismatch (want pin2)")
-			},
-		},
-		{
-			name:    "NOK no devices plugged times out",
-			timeout: 10 * time.Millisecond,
-			fido2:   newFakeFIDO2(),
-			setUP:   func() {},
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: auth1.credentialID()},
-				}
-				return &cp
-			},
-			wantErr: context.DeadlineExceeded.Error(),
-		},
-		{
-			name:    "NOK no devices touched times out",
-			timeout: 10 * time.Millisecond,
-			fido2:   newFakeFIDO2(auth1, pin1, bio1, legacy1),
-			setUP:   func() {}, // no interaction
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = []protocol.CredentialDescriptor{
-					{CredentialID: auth1.credentialID()},
-					{CredentialID: pin1.credentialID()},
-					{CredentialID: bio1.credentialID()},
-				}
-				return &cp
-			},
-			wantErr: context.DeadlineExceeded.Error(),
-		},
-		{
-			name:  "passwordless pin",
-			fido2: newFakeFIDO2(pin3),
-			setUP: pin3.setUP,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = nil
-				cp.Response.UserVerification = protocol.VerificationRequired
-				return &cp
-			},
-			prompt: pin3,
-			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
-				assert.Equal(t, pin3.credentials[0].ID, resp.RawId, "RawId mismatch (want %q resident credential)", alpacaName)
-				assert.Equal(t, alpacaID, resp.Response.UserHandle, "UserHandle mismatch (want %q)", alpacaName)
-			},
-		},
-		{
-			name:  "passwordless biometric (llama)",
-			fido2: newFakeFIDO2(bio2),
-			setUP: bio2.setUP,
-			user:  llamaName,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = nil
-				cp.Response.UserVerification = protocol.VerificationRequired
-				return &cp
-			},
-			prompt: bio2,
-			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
-				assert.Equal(t, bio2.credentials[0].ID, resp.RawId, "RawId mismatch (want %q resident credential)", llamaName)
-				assert.Equal(t, llamaID, resp.Response.UserHandle, "UserHandle mismatch (want %q)", llamaName)
-			},
-		},
-		{
-			name:  "passwordless biometric (alpaca)",
-			fido2: newFakeFIDO2(bio2),
-			setUP: bio2.setUP,
-			user:  alpacaName,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = nil
-				cp.Response.UserVerification = protocol.VerificationRequired
-				return &cp
-			},
-			prompt: bio2,
-			assertResponse: func(t *testing.T, resp *wanpb.CredentialAssertionResponse) {
-				assert.Equal(t, bio2.credentials[1].ID, resp.RawId, "RawId mismatch (want %q resident credential)", alpacaName)
-				assert.Equal(t, alpacaID, resp.Response.UserHandle, "UserHandle mismatch (want %q)", alpacaName)
-			},
-		},
-		{
-			name:  "NOK passwordless no credentials",
-			fido2: newFakeFIDO2(bio1),
-			setUP: bio1.setUP,
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = nil
-				cp.Response.UserVerification = protocol.VerificationRequired
-				return &cp
-			},
-			prompt:  bio1,
-			wantErr: libfido2.ErrNoCredentials.Error(),
-		},
-		{
-			name:  "NOK passwordless ambiguous user",
-			fido2: newFakeFIDO2(bio2),
-			setUP: bio2.setUP,
-			user:  "", // >1 resident credential, can't pick unambiguous username.
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = nil
-				cp.Response.UserVerification = protocol.VerificationRequired
-				return &cp
-			},
-			prompt:  bio2,
-			wantErr: "explicit user required",
-		},
-		{
-			name:  "NOK passwordless unknown user",
-			fido2: newFakeFIDO2(bio2),
-			setUP: bio2.setUP,
-			user:  "camel", // unknown
-			createAssertion: func() *wanlib.CredentialAssertion {
-				cp := *baseAssertion
-				cp.Response.AllowedCredentials = nil
-				cp.Response.UserVerification = protocol.VerificationRequired
-				return &cp
-			},
-			prompt:  bio2,
-			wantErr: "no credentials for user",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			test.fido2.setCallbacks()
-			test.setUP()
-
-			timeout := test.timeout
-			if timeout == 0 {
-				timeout = 1 * time.Second
-			}
-			ctx, cancel := context.WithTimeout(context.Background(), timeout)
-			defer cancel()
-
-			prompt := test.prompt
-			if prompt == nil {
-				prompt = noopPrompt{}
-			}
-
-			mfaResp, _, err := wancli.FIDO2Login(ctx, origin, test.user, test.createAssertion(), prompt)
-			switch {
-			case test.wantErr != "" && err == nil:
-				t.Fatalf("FIDO2Login returned err = nil, wantErr %q", test.wantErr)
-			case test.wantErr != "":
-				require.Contains(t, err.Error(), test.wantErr, "FIDO2Login returned err = %q, wantErr %q", err, test.wantErr)
-				return
-			default:
-				require.NoError(t, err, "FIDO2Login failed")
-				require.NotNil(t, mfaResp, "mfaResp nil")
-			}
-
-			// Do a few baseline checks, tests can assert further.
-			got := mfaResp.GetWebauthn()
-			require.NotNil(t, got, "assertion response nil")
-			require.NotNil(t, got.Response, "authenticator response nil")
-			assert.NotNil(t, got.Response.ClientDataJson, "ClientDataJSON nil")
-			want := &wanpb.CredentialAssertionResponse{
-				Type:  string(protocol.PublicKeyCredentialType),
-				RawId: got.RawId,
-				Response: &wanpb.AuthenticatorAssertionResponse{
-					ClientDataJson:    got.Response.ClientDataJson,
-					AuthenticatorData: assertionAuthDataRaw,
-					Signature:         assertionSig,
-					UserHandle:        got.Response.UserHandle,
-				},
-				Extensions: got.Extensions,
-			}
-			if diff := cmp.Diff(want, got); diff != "" {
-				t.Fatalf("FIDO2Login()/CredentialAssertionResponse mismatch (-want +got):\n%v", diff)
-			}
-
-			if test.assertResponse != nil {
-				test.assertResponse(t, got)
-			}
-		})
-	}
-}
-
-func TestFIDO2Login_errors(t *testing.T) {
-	resetFIDO2AfterTests(t)
-
-	// Make sure we won't call the real libfido2.
-	f2 := newFakeFIDO2()
-	f2.setCallbacks()
-
-	const origin = "https://example.com"
-	const user = ""
-	okAssertion := &wanlib.CredentialAssertion{
-		Response: protocol.PublicKeyCredentialRequestOptions{
-			Challenge:      make([]byte, 32),
-			RelyingPartyID: "example.com",
-			AllowedCredentials: []protocol.CredentialDescriptor{
-				{Type: protocol.PublicKeyCredentialType, CredentialID: []byte{1, 2, 3, 4, 5}},
-			},
-		},
-	}
-	var prompt noopPrompt
-
-	nilChallengeAssertion := *okAssertion
-	nilChallengeAssertion.Response.Challenge = nil
-
-	emptyRPIDAssertion := *okAssertion
-	emptyRPIDAssertion.Response.RelyingPartyID = ""
-
-	tests := []struct {
-		name      string
-		origin    string
-		assertion *wanlib.CredentialAssertion
-		prompt    wancli.LoginPrompt
-		wantErr   string
-	}{
-		{
-			name:      "ok - timeout", // check that good params are good
-			origin:    origin,
-			assertion: okAssertion,
-			prompt:    prompt,
-			wantErr:   context.DeadlineExceeded.Error(),
-		},
-		{
-			name:      "nil origin",
-			assertion: okAssertion,
-			prompt:    prompt,
-			wantErr:   "origin",
-		},
-		{
-			name:    "nil assertion",
-			origin:  origin,
-			prompt:  prompt,
-			wantErr: "assertion required",
-		},
-		{
-			name:      "assertion without challenge",
-			origin:    origin,
-			assertion: &nilChallengeAssertion,
-			prompt:    prompt,
-			wantErr:   "challenge",
-		},
-		{
-			name:      "assertion without RPID",
-			origin:    origin,
-			assertion: &emptyRPIDAssertion,
-			prompt:    prompt,
-			wantErr:   "relying party ID",
-		},
-		{
-			name:      "nil prompt",
-			origin:    origin,
-			assertion: okAssertion,
-			wantErr:   "prompt",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Millisecond)
-			defer cancel()
-
-			_, _, err := wancli.FIDO2Login(ctx, test.origin, user, test.assertion, test.prompt)
-			require.Error(t, err, "FIDO2Login returned err = nil, want %q", test.wantErr)
-			assert.Contains(t, err.Error(), test.wantErr, "FIDO2Login returned err = %q, want %q", err, test.wantErr)
-		})
-	}
-}
-
-func TestFIDO2Register(t *testing.T) {
-	resetFIDO2AfterTests(t)
-
-	const rpID = "example.com"
-	const origin = "https://example.com"
-
-	authOpts := []libfido2.Option{
-		{Name: "rk", Value: "true"},
-		{Name: "up", Value: "true"},
-		{Name: "plat", Value: "false"},
-		{Name: "clientPin", Value: "false"}, // supported but unset
-	}
-	pinOpts := []libfido2.Option{
-		{Name: "rk", Value: "true"},
-		{Name: "up", Value: "true"},
-		{Name: "plat", Value: "false"},
-		{Name: "clientPin", Value: "true"}, // supported and configured
-	}
-
-	// auth1 is a FIDO2 authenticator without a PIN configured.
-	auth1 := mustNewFIDO2Device("/path1", "" /* pin */, &libfido2.DeviceInfo{
-		Options: authOpts,
-	})
-	// pin1 is a FIDO2 authenticator with a PIN.
-	pin1 := mustNewFIDO2Device("/pin1", "supersecretpinllama", &libfido2.DeviceInfo{
-		Options: pinOpts,
-	})
-	// pin2 is a FIDO2 authenticator with a PIN.
-	pin2 := mustNewFIDO2Device("/pin2", "supersecretpin2", &libfido2.DeviceInfo{
-		Options: pinOpts,
-	})
-	// bio1 is a biometric authenticator.
-	bio1 := mustNewFIDO2Device("/bio1", "supersecretBIOpin", &libfido2.DeviceInfo{
-		Options: []libfido2.Option{
-			{Name: "rk", Value: "true"},
-			{Name: "up", Value: "true"},
-			{Name: "uv", Value: "true"},
-			{Name: "plat", Value: "false"},
-			{Name: "alwaysUv", Value: "true"},
-			{Name: "bioEnroll", Value: "true"}, // supported and configured
-			{Name: "clientPin", Value: "true"}, // supported and configured
-		},
-	})
-	// u2f1 is an authenticator that uses fido-u2f attestation.
-	u2f1 := mustNewFIDO2Device("/u2f1", "" /* pin */, &libfido2.DeviceInfo{Options: authOpts})
-	u2f1.format = "fido-u2f"
-	// none1 is an authenticator that returns no attestation data.
-	none1 := mustNewFIDO2Device("/none1", "" /* pin */, &libfido2.DeviceInfo{Options: authOpts})
-	none1.format = "none"
-
-	challenge, err := protocol.CreateChallenge()
-	require.NoError(t, err, "CreateChallenge failed")
-
-	baseCC := &wanlib.CredentialCreation{
-		Response: protocol.PublicKeyCredentialCreationOptions{
-			Challenge: challenge,
-			RelyingParty: protocol.RelyingPartyEntity{
-				ID: rpID,
-			},
-			Parameters: []protocol.CredentialParameter{
-				{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgES256},
-			},
-			AuthenticatorSelection: protocol.AuthenticatorSelection{
-				UserVerification: protocol.VerificationDiscouraged,
-			},
-			Attestation: protocol.PreferDirectAttestation,
-		},
-	}
-	pwdlessCC := *baseCC
-	pwdlessCC.Response.RelyingParty.Name = "Teleport"
-	pwdlessCC.Response.User = protocol.UserEntity{
-		CredentialEntity: protocol.CredentialEntity{
-			Name: "llama",
-		},
-		DisplayName: "Llama",
-		ID:          []byte{1, 2, 3, 4, 5}, // arbitrary
-	}
-	pwdlessRRK := true
-	pwdlessCC.Response.AuthenticatorSelection.RequireResidentKey = &pwdlessRRK
-	pwdlessCC.Response.AuthenticatorSelection.UserVerification = protocol.VerificationRequired
-
-	tests := []struct {
-		name             string
-		timeout          time.Duration
-		fido2            *fakeFIDO2
-		setUP            func()
-		createCredential func() *wanlib.CredentialCreation
-		prompt           wancli.RegisterPrompt
-		wantErr          error
-		assertResponse   func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject)
-	}{
-		{
-			name:  "single device, packed attestation",
-			fido2: newFakeFIDO2(auth1),
-			setUP: auth1.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				return &cp
-			},
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				assert.Equal(t, auth1.credentialID(), ccr.RawId, "RawId mismatch")
-
-				// Assert attestation algorithm and signature.
-				require.Equal(t, "packed", attObj.Format, "attestation format mismatch")
-				assert.Equal(t, int64(webauthncose.AlgES256), attObj.AttStatement["alg"], "attestation alg mismatch")
-				assert.Equal(t, makeCredentialSig, attObj.AttStatement["sig"], "attestation sig mismatch")
-
-				// Assert attestation certificate.
-				x5cInterface := attObj.AttStatement["x5c"]
-				x5c, ok := x5cInterface.([]interface{})
-				require.True(t, ok, "attestation x5c type mismatch (got %T)", x5cInterface)
-				assert.Len(t, x5c, 1, "attestation x5c length mismatch")
-				assert.Equal(t, auth1.cert(), x5c[0], "attestation cert mismatch")
-			},
-		},
-		{
-			name:  "fido-u2f attestation",
-			fido2: newFakeFIDO2(u2f1),
-			setUP: u2f1.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				return &cp
-			},
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				// Assert attestation signature.
-				require.Equal(t, "fido-u2f", attObj.Format, "attestation format mismatch")
-				assert.Equal(t, makeCredentialSig, attObj.AttStatement["sig"], "attestation sig mismatch")
-
-				// Assert attestation certificate.
-				x5cInterface := attObj.AttStatement["x5c"]
-				x5c, ok := x5cInterface.([]interface{})
-				require.True(t, ok, "attestation x5c type mismatch (got %T)", x5cInterface)
-				assert.Len(t, x5c, 1, "attestation x5c length mismatch")
-				assert.Equal(t, u2f1.cert(), x5c[0], "attestation cert mismatch")
-			},
-		},
-		{
-			name:  "none attestation",
-			fido2: newFakeFIDO2(none1),
-			setUP: none1.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				return &cp
-			},
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				assert.Equal(t, "none", attObj.Format, "attestation format mismatch")
-			},
-		},
-		{
-			name:  "pin device",
-			fido2: newFakeFIDO2(pin1),
-			setUP: pin1.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				return &cp
-			},
-			prompt: pin1,
-		},
-		{
-			name:  "multiple valid devices",
-			fido2: newFakeFIDO2(auth1, pin1, pin2, bio1),
-			setUP: bio1.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				return &cp
-			},
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				assert.Equal(t, bio1.credentialID(), ccr.RawId, "RawId mismatch (want bio1)")
-			},
-		},
-		{
-			name:  "multiple devices, uses pin",
-			fido2: newFakeFIDO2(auth1, pin1, pin2, bio1),
-			setUP: pin2.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				return &cp
-			},
-			prompt: pin2,
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				assert.Equal(t, pin2.credentialID(), ccr.RawId, "RawId mismatch (want pin2)")
-			},
-		},
-		{
-			name:  "excluded devices, single valid",
-			fido2: newFakeFIDO2(auth1, bio1),
-			setUP: bio1.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				cp.Response.CredentialExcludeList = []protocol.CredentialDescriptor{
-					{
-						Type:         protocol.PublicKeyCredentialType,
-						CredentialID: auth1.credentialID(),
-					},
-				}
-				return &cp
-			},
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				assert.Equal(t, bio1.credentialID(), ccr.RawId, "RawId mismatch (want bio1)")
-			},
-		},
-		{
-			name:  "excluded devices, multiple valid",
-			fido2: newFakeFIDO2(auth1, pin1, pin2, bio1),
-			setUP: bio1.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				cp.Response.CredentialExcludeList = []protocol.CredentialDescriptor{
-					{
-						Type:         protocol.PublicKeyCredentialType,
-						CredentialID: pin1.credentialID(),
-					},
-					{
-						Type:         protocol.PublicKeyCredentialType,
-						CredentialID: pin2.credentialID(),
-					},
-				}
-				return &cp
-			},
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				assert.Equal(t, bio1.credentialID(), ccr.RawId, "RawId mismatch (want bio1)")
-			},
-		},
-		{
-			name:    "NOK timeout without devices",
-			timeout: 10 * time.Millisecond,
-			fido2:   newFakeFIDO2(),
-			setUP:   func() {},
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := *baseCC
-				return &cp
-			},
-			wantErr: context.DeadlineExceeded,
-		},
-		{
-			name:  "passwordless pin device",
-			fido2: newFakeFIDO2(pin2),
-			setUP: pin2.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := pwdlessCC
-				return &cp
-			},
-			prompt: pin2,
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				require.NotEmpty(t, pin2.credentials, "no resident credentials added to pin2")
-				cred := pin2.credentials[len(pin2.credentials)-1]
-				assert.Equal(t, cred.ID, ccr.RawId, "RawId mismatch (want pin2 resident credential)")
-			},
-		},
-		{
-			name:  "passwordless bio device",
-			fido2: newFakeFIDO2(bio1),
-			setUP: bio1.setUP,
-			createCredential: func() *wanlib.CredentialCreation {
-				cp := pwdlessCC
-				return &cp
-			},
-			prompt: bio1,
-			assertResponse: func(t *testing.T, ccr *wanpb.CredentialCreationResponse, attObj *protocol.AttestationObject) {
-				require.NotEmpty(t, bio1.credentials, "no resident credentials added to bio1")
-				cred := bio1.credentials[len(bio1.credentials)-1]
-				assert.Equal(t, cred.ID, ccr.RawId, "RawId mismatch (want bio1 resident credential)")
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			test.fido2.setCallbacks()
-			test.setUP()
-
-			timeout := test.timeout
-			if timeout == 0 {
-				timeout = 1 * time.Second
-			}
-			ctx, cancel := context.WithTimeout(context.Background(), timeout)
-			defer cancel()
-
-			prompt := test.prompt
-			if prompt == nil {
-				prompt = noopPrompt{}
-			}
-			mfaResp, err := wancli.FIDO2Register(ctx, origin, test.createCredential(), prompt)
-			switch {
-			case test.wantErr != nil && err == nil:
-				t.Fatalf("FIDO2Register returned err = nil, wantErr %q", test.wantErr)
-			case test.wantErr != nil:
-				require.True(t, errors.Is(err, test.wantErr), "FIDO2Register returned err = %q, wantErr %q", err, test.wantErr)
-				return
-			default:
-				require.NoError(t, err, "FIDO2Register failed")
-				require.NotNil(t, mfaResp, "mfaResp nil")
-			}
-
-			// Do a few baseline checks, tests can assert further.
-			got := mfaResp.GetWebauthn()
-			require.NotNil(t, got, "credential response nil")
-			require.NotNil(t, got.Response, "attestation response nil")
-			assert.NotNil(t, got.Response.ClientDataJson, "ClientDataJSON nil")
-			want := &wanpb.CredentialCreationResponse{
-				Type:  string(protocol.PublicKeyCredentialType),
-				RawId: got.RawId,
-				Response: &wanpb.AuthenticatorAttestationResponse{
-					ClientDataJson:    got.Response.ClientDataJson,
-					AttestationObject: got.Response.AttestationObject,
-				},
-				Extensions: got.Extensions,
-			}
-			if diff := cmp.Diff(want, got); diff != "" {
-				t.Fatalf("FIDO2Register()/CredentialCreationResponse mismatch (-want +got):\n%v", diff)
-			}
-
-			attObj := &protocol.AttestationObject{}
-			err = cbor.Unmarshal(got.Response.AttestationObject, attObj)
-			require.NoError(t, err, "Failed to unmarshal AttestationObject")
-			assert.Equal(t, makeCredentialAuthDataRaw, attObj.RawAuthData, "RawAuthData mismatch")
-
-			if test.assertResponse != nil {
-				test.assertResponse(t, got, attObj)
-			}
-		})
-	}
-}
-
-func TestFIDO2Register_errors(t *testing.T) {
-	resetFIDO2AfterTests(t)
-
-	// Make sure we won't call the real libfido2.
-	f2 := newFakeFIDO2()
-	f2.setCallbacks()
-
-	const origin = "https://example.com"
-	okCC := &wanlib.CredentialCreation{
-		Response: protocol.PublicKeyCredentialCreationOptions{
-			Challenge: make([]byte, 32),
-			RelyingParty: protocol.RelyingPartyEntity{
-				ID: "example.com",
-			},
-			Parameters: []protocol.CredentialParameter{
-				{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgES256},
-			},
-			AuthenticatorSelection: protocol.AuthenticatorSelection{
-				UserVerification: protocol.VerificationDiscouraged,
-			},
-			Attestation: protocol.PreferNoAttestation,
-		},
-	}
-
-	pwdlessOK := *okCC
-	pwdlessOK.Response.RelyingParty.Name = "Teleport"
-	pwdlessOK.Response.User = protocol.UserEntity{
-		CredentialEntity: protocol.CredentialEntity{
-			Name: "llama",
-		},
-		DisplayName: "Llama",
-		ID:          []byte{1, 2, 3, 4, 5}, // arbitrary
-	}
-	rrk := true
-	pwdlessOK.Response.AuthenticatorSelection.RequireResidentKey = &rrk
-	pwdlessOK.Response.AuthenticatorSelection.UserVerification = protocol.VerificationRequired
-
-	var prompt noopPrompt
-
-	tests := []struct {
-		name     string
-		origin   string
-		createCC func() *wanlib.CredentialCreation
-		prompt   wancli.RegisterPrompt
-		wantErr  string
-	}{
-		{
-			name:     "ok - timeout", // check that good params are good
-			origin:   origin,
-			createCC: func() *wanlib.CredentialCreation { return okCC },
-			prompt:   prompt,
-			wantErr:  context.DeadlineExceeded.Error(),
-		},
-		{
-			name:     "nil origin",
-			createCC: func() *wanlib.CredentialCreation { return okCC },
-			prompt:   prompt,
-			wantErr:  "origin",
-		},
-		{
-			name:     "nil cc",
-			origin:   origin,
-			createCC: func() *wanlib.CredentialCreation { return nil },
-			prompt:   prompt,
-			wantErr:  "credential creation required",
-		},
-		{
-			name:   "cc without challenge",
-			origin: origin,
-			createCC: func() *wanlib.CredentialCreation {
-				cp := *okCC
-				cp.Response.Challenge = nil
-				return &cp
-			},
-			prompt:  prompt,
-			wantErr: "challenge",
-		},
-		{
-			name:   "cc without RPID",
-			origin: origin,
-			createCC: func() *wanlib.CredentialCreation {
-				cp := *okCC
-				cp.Response.RelyingParty.ID = ""
-				return &cp
-			},
-			prompt:  prompt,
-			wantErr: "relying party ID",
-		},
-		{
-			name:   "cc unsupported parameters",
-			origin: origin,
-			createCC: func() *wanlib.CredentialCreation {
-				cp := *okCC
-				cp.Response.Parameters = []protocol.CredentialParameter{
-					{Type: protocol.PublicKeyCredentialType, Algorithm: webauthncose.AlgEdDSA},
-				}
-				return &cp
-			},
-			prompt:  prompt,
-			wantErr: "ES256",
-		},
-		{
-			name:     "nil pinPrompt",
-			origin:   origin,
-			createCC: func() *wanlib.CredentialCreation { return okCC },
-			wantErr:  "prompt",
-		},
-		{
-			name:   "rrk empty RP name",
-			origin: origin,
-			createCC: func() *wanlib.CredentialCreation {
-				cp := pwdlessOK
-				cp.Response.RelyingParty.Name = ""
-				return &cp
-			},
-			prompt:  prompt,
-			wantErr: "relying party name",
-		},
-		{
-			name:   "rrk empty user name",
-			origin: origin,
-			createCC: func() *wanlib.CredentialCreation {
-				cp := pwdlessOK
-				cp.Response.User.Name = ""
-				return &cp
-			},
-			prompt:  prompt,
-			wantErr: "user name",
-		},
-		{
-			name:   "rrk empty user display name",
-			origin: origin,
-			createCC: func() *wanlib.CredentialCreation {
-				cp := pwdlessOK
-				cp.Response.User.DisplayName = ""
-				return &cp
-			},
-			prompt:  prompt,
-			wantErr: "user display name",
-		},
-		{
-			name:   "rrk nil user ID",
-			origin: origin,
-			createCC: func() *wanlib.CredentialCreation {
-				cp := pwdlessOK
-				cp.Response.User.ID = nil
-				return &cp
-			},
-			prompt:  prompt,
-			wantErr: "user ID",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Millisecond)
-			defer cancel()
-
-			_, err := wancli.FIDO2Register(ctx, test.origin, test.createCC(), test.prompt)
-			require.Error(t, err, "FIDO2Register returned err = nil, want %q", test.wantErr)
-			assert.Contains(t, err.Error(), test.wantErr, "FIDO2Register returned err = %q, want %q", err, test.wantErr)
-		})
-	}
-}
-
-func resetFIDO2AfterTests(t *testing.T) {
-	pollInterval := wancli.FIDO2PollInterval
-	devLocations := wancli.FIDODeviceLocations
-	newDevice := wancli.FIDONewDevice
-	t.Cleanup(func() {
-		wancli.FIDO2PollInterval = pollInterval
-		wancli.FIDODeviceLocations = devLocations
-		wancli.FIDONewDevice = newDevice
-	})
-}
-
-type fakeFIDO2 struct {
-	locs    []*libfido2.DeviceLocation
-	devices map[string]*fakeFIDO2Device
-}
-
-func newFakeFIDO2(devs ...*fakeFIDO2Device) *fakeFIDO2 {
-	f := &fakeFIDO2{
-		devices: make(map[string]*fakeFIDO2Device),
-	}
-	for _, dev := range devs {
-		if _, ok := f.devices[dev.path]; ok {
-			panic(fmt.Sprintf("Duplicate device path registered: %q", dev.path))
-		}
-		f.locs = append(f.locs, &libfido2.DeviceLocation{
-			Path: dev.path,
-		})
-		f.devices[dev.path] = dev
-	}
-	return f
-}
-
-func (f *fakeFIDO2) setCallbacks() {
-	*wancli.FIDODeviceLocations = f.newMeteredDeviceLocations()
-	*wancli.FIDONewDevice = f.NewDevice
-}
-
-func (f *fakeFIDO2) newMeteredDeviceLocations() func() ([]*libfido2.DeviceLocation, error) {
-	i := 0
-	return func() ([]*libfido2.DeviceLocation, error) {
-		// Delay showing devices for a while to exercise polling.
-		i++
-		const minLoops = 2
-		if i < minLoops {
-			return nil, nil
-		}
-		return f.locs, nil
-	}
-}
-
-func (f *fakeFIDO2) NewDevice(path string) (wancli.FIDODevice, error) {
-	if dev, ok := f.devices[path]; ok {
-		return dev, nil
-	}
-	// go-libfido2 doesn't actually error here, but we do for simplicity.
-	return nil, errors.New("not found")
-}
-
-type fakeFIDO2Device struct {
-	path        string
-	info        *libfido2.DeviceInfo
-	pin         string
-	credentials []*libfido2.Credential
-
-	// wantRPID may be set directly to enable RPID checks on Assertion.
-	wantRPID string
-	// format may be set directly to change the attestation format.
-	format string
-
-	key    *mocku2f.Key
-	pubKey []byte
-
-	// mu and cond guard up and cancel.
-	mu         sync.Mutex
-	cond       *sync.Cond
-	up, cancel bool
-}
-
-func mustNewFIDO2Device(path, pin string, info *libfido2.DeviceInfo, creds ...*libfido2.Credential) *fakeFIDO2Device {
-	dev, err := newFIDO2Device(path, pin, info, creds...)
-	if err != nil {
-		panic(err)
-	}
-	return dev
-}
-
-func newFIDO2Device(path, pin string, info *libfido2.DeviceInfo, creds ...*libfido2.Credential) (*fakeFIDO2Device, error) {
-	key, err := mocku2f.Create()
-	if err != nil {
-		return nil, err
-	}
-
-	pubKeyCBOR, err := wanlib.U2FKeyToCBOR(&key.PrivateKey.PublicKey)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, cred := range creds {
-		cred.ID = make([]byte, 16) // somewhat arbitrary
-		if _, err := rand.Read(cred.ID); err != nil {
-			return nil, err
-		}
-		cred.Type = libfido2.ES256
-	}
-
-	d := &fakeFIDO2Device{
-		path:        path,
-		pin:         pin,
-		credentials: creds,
-		format:      "packed",
-		info:        info,
-		key:         key,
-		pubKey:      pubKeyCBOR,
-	}
-	d.cond = sync.NewCond(&d.mu)
-	return d, nil
-}
-
-func (f *fakeFIDO2Device) PromptPIN() (string, error) {
-	return f.pin, nil
-}
-
-func (f *fakeFIDO2Device) PromptAdditionalTouch() error {
-	f.setUP()
-	return nil
-}
-
-func (f *fakeFIDO2Device) credentialID() []byte {
-	return f.key.KeyHandle
-}
-
-func (f *fakeFIDO2Device) cert() []byte {
-	return f.key.Cert
-}
-
-func (f *fakeFIDO2Device) Info() (*libfido2.DeviceInfo, error) {
-	return f.info, nil
-}
-
-func (f *fakeFIDO2Device) setUP() {
-	f.mu.Lock()
-	f.up = true
-	f.mu.Unlock()
-	f.cond.Broadcast()
-}
-
-func (f *fakeFIDO2Device) Cancel() error {
-	f.mu.Lock()
-	f.cancel = true
-	f.mu.Unlock()
-	f.cond.Broadcast()
-	return nil
-}
-
-func (f *fakeFIDO2Device) Credentials(rpID string, pin string) ([]*libfido2.Credential, error) {
-	if f.pin != "" {
-		if err := f.validatePIN(pin); err != nil {
-			return nil, err
-		}
-	}
-	return f.credentials, nil
-}
-
-func (f *fakeFIDO2Device) MakeCredential(
-	clientDataHash []byte,
-	rp libfido2.RelyingParty,
-	user libfido2.User,
-	typ libfido2.CredentialType,
-	pin string,
-	opts *libfido2.MakeCredentialOpts,
-) (*libfido2.Attestation, error) {
-	switch {
-	case len(clientDataHash) == 0:
-		return nil, errors.New("clientDataHash required")
-	case rp.ID == "":
-		return nil, errors.New("rp.ID required")
-	case typ != libfido2.ES256:
-		return nil, errors.New("bad credential type")
-	case opts.UV == libfido2.False: // can only be empty or true
-		return nil, libfido2.ErrUnsupportedOption
-	case opts.UV == libfido2.True && !f.hasUV():
-		return nil, libfido2.ErrUnsupportedOption // PIN authenticators don't like UV
-	}
-
-	// Validate PIN regardless of opts.
-	// This is in line with how current YubiKeys behave.
-	if err := f.validatePIN(pin); err != nil {
-		return nil, err
-	}
-
-	if err := f.maybeLockUntilInteraction(true /* up */); err != nil {
-		return nil, err
-	}
-
-	cert, sig := f.cert(), makeCredentialSig
-	if f.format == "none" {
-		// Do not return attestation data in case of "none".
-		// This is a hypothetical scenario, as I haven't seen device that does this.
-		cert, sig = nil, nil
-	}
-
-	// Did we create a resident credential? Create a new ID for it and record it.
-	cID := f.key.KeyHandle
-	if opts.RK == libfido2.True {
-		cID = make([]byte, 16) // somewhat arbitrary
-		if _, err := rand.Read(cID); err != nil {
-			return nil, err
-		}
-		f.credentials = append(f.credentials, &libfido2.Credential{
-			ID:   cID,
-			Type: libfido2.ES256,
-			User: user,
-		})
-	}
-
-	return &libfido2.Attestation{
-		ClientDataHash: clientDataHash,
-		AuthData:       makeCredentialAuthDataCBOR,
-		CredentialID:   cID,
-		CredentialType: libfido2.ES256,
-		PubKey:         f.pubKey,
-		Cert:           cert,
-		Sig:            sig,
-		Format:         f.format,
-	}, nil
-}
-
-func (f *fakeFIDO2Device) Assertion(
-	rpID string,
-	clientDataHash []byte,
-	credentialIDs [][]byte,
-	pin string,
-	opts *libfido2.AssertionOpts,
-) (*libfido2.Assertion, error) {
-	switch {
-	case rpID == "":
-		return nil, errors.New("rp.ID required")
-	case f.wantRPID != "" && f.wantRPID != rpID:
-		return nil, libfido2.ErrNoCredentials
-	case len(clientDataHash) == 0:
-		return nil, errors.New("clientDataHash required")
-	case opts.UV == libfido2.False: // can only be empty or true
-		return nil, libfido2.ErrUnsupportedOption
-	}
-
-	// Validate PIN only if present and UP is required.
-	// This is in line with how current YubiKeys behave.
-	privilegedAccess := f.isBio()
-	if pin != "" && opts.UP == libfido2.True {
-		if err := f.validatePIN(pin); err != nil {
-			return nil, err
-		}
-		privilegedAccess = true
-	}
-
-	// Is our credential allowed?
-	foundCredential := false
-	for _, cred := range credentialIDs {
-		if bytes.Equal(cred, f.key.KeyHandle) {
-			foundCredential = true
-			break
-		}
-
-		// Check resident credentials if we are properly authorized.
-		if !privilegedAccess {
-			continue
-		}
-		for _, resident := range f.credentials {
-			if bytes.Equal(cred, resident.ID) {
-				foundCredential = true
-				break
-			}
-		}
-		if foundCredential {
-			break
-		}
-	}
-	explicitCreds := len(credentialIDs) > 0
-	if explicitCreds && !foundCredential {
-		return nil, libfido2.ErrNoCredentials
-	}
-
-	if err := f.maybeLockUntilInteraction(opts.UP == libfido2.True); err != nil {
-		return nil, err
-	}
-
-	// Pick a credential for the user?
-	switch {
-	case !explicitCreds && privilegedAccess && len(f.credentials) > 0:
-		// OK, at this point an authenticator picks a credential for the user.
-	case !explicitCreds:
-		return nil, libfido2.ErrNoCredentials
-	}
-
-	return &libfido2.Assertion{
-		AuthDataCBOR: assertionAuthDataCBOR,
-		Sig:          assertionSig,
-	}, nil
-}
-
-func (f *fakeFIDO2Device) validatePIN(pin string) error {
-	switch {
-	case f.isBio() && pin == "": // OK, biometric check supersedes PIN.
-	case f.pin != "" && pin == "":
-		return libfido2.ErrPinRequired
-	case f.pin != "" && f.pin != pin:
-		return libfido2.ErrPinInvalid
-	}
-	return nil
-}
-
-func (f *fakeFIDO2Device) hasUV() bool {
-	for _, opt := range f.info.Options {
-		if opt.Name == "uv" {
-			return opt.Value == libfido2.True
-		}
-	}
-	return false
-}
-
-func (f *fakeFIDO2Device) isBio() bool {
-	for _, opt := range f.info.Options {
-		if opt.Name == "bioEnroll" {
-			return opt.Value == libfido2.True
-		}
-	}
-	return false
-}
-
-func (f *fakeFIDO2Device) maybeLockUntilInteraction(up bool) error {
-	if !up {
-		return nil // without UserPresence it doesn't lock.
-	}
-
-	// Lock until we get a touch or a cancel.
-	f.mu.Lock()
-	for !f.up && !f.cancel {
-		f.cond.Wait()
-	}
-
-	// Record/reset state.
-	isCancel := f.cancel
-	f.up = false
-	f.cancel = false
-
-	if isCancel {
-		f.mu.Unlock()
-		return libfido2.ErrKeepaliveCancel
-	}
-	f.mu.Unlock()
-
-	return nil
-}
diff --git a/lib/auth/webauthncli/u2f_login.go b/lib/auth/webauthncli/login.go
similarity index 91%
rename from lib/auth/webauthncli/u2f_login.go
rename to lib/auth/webauthncli/login.go
index 7c4e81f1da64c..a6fd964c8c2e0 100644
--- a/lib/auth/webauthncli/u2f_login.go
+++ b/lib/auth/webauthncli/login.go
@@ -30,10 +30,13 @@ import (
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 )
 
-// U2FLogin implements Login for U2F/CTAP1 devices.
-// The implementation is backed exclusively by Go code, making it useful in
-// scenarios where libfido2 is unavailable.
-func U2FLogin(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error) {
+// Login performs client-side, U2F-compatible Webauthn login.
+// This method blocks until either device authentication is successful or the
+// context is cancelled. Calling Login without a deadline or cancel condition
+// may cause it block forever.
+// The caller is expected to prompt the user for action before calling this
+// method.
+func Login(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error) {
 	switch {
 	case origin == "":
 		return nil, trace.BadParameter("origin required")
diff --git a/lib/auth/webauthncli/u2f_login_test.go b/lib/auth/webauthncli/login_test.go
similarity index 98%
rename from lib/auth/webauthncli/u2f_login_test.go
rename to lib/auth/webauthncli/login_test.go
index 83d8d8a56384c..699a76d1104ca 100644
--- a/lib/auth/webauthncli/u2f_login_test.go
+++ b/lib/auth/webauthncli/login_test.go
@@ -146,7 +146,7 @@ func TestLogin(t *testing.T) {
 			fakeDevs := &fakeDevices{devs: test.devs}
 			fakeDevs.assignU2FCallbacks()
 
-			mfaResp, err := wancli.U2FLogin(ctx, origin, assertion)
+			mfaResp, err := wancli.Login(ctx, origin, assertion)
 			switch hasErr := err != nil; {
 			case hasErr != test.wantErr:
 				t.Fatalf("Login returned err = %v, wantErr = %v", err, test.wantErr)
@@ -254,7 +254,7 @@ func TestLogin_errors(t *testing.T) {
 			ctx, cancel := context.WithTimeout(ctx, 1*time.Second)
 			defer cancel()
 
-			_, err := wancli.U2FLogin(ctx, test.origin, test.getAssertion())
+			_, err := wancli.Login(ctx, test.origin, test.getAssertion())
 			require.True(t, trace.IsBadParameter(err))
 		})
 	}
@@ -384,9 +384,7 @@ func (f *fakeDevice) Authenticate(req u2ftoken.AuthenticateRequest) (*u2ftoken.A
 		return nil, trace.Wrap(err)
 	}
 	var counter uint32
-	if err := binary.Read(bytes.NewReader(rawResp[1:5]), binary.BigEndian, &counter); err != nil {
-		return nil, err
-	}
+	binary.Read(bytes.NewReader(rawResp[1:5]), binary.BigEndian, &counter)
 	sign := rawResp[5:]
 
 	return &u2ftoken.AuthenticateResponse{
diff --git a/lib/auth/webauthncli/u2f_register.go b/lib/auth/webauthncli/register.go
similarity index 94%
rename from lib/auth/webauthncli/u2f_register.go
rename to lib/auth/webauthncli/register.go
index e1863ac75f4a3..b06f69c4cbf08 100644
--- a/lib/auth/webauthncli/u2f_register.go
+++ b/lib/auth/webauthncli/register.go
@@ -38,10 +38,13 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-// U2FRegister implements Register for U2F/CTAP1 devices.
-// The implementation is backed exclusively by Go code, making it useful in
-// scenarios where libfido2 is unavailable.
-func U2FRegister(ctx context.Context, origin string, cc *wanlib.CredentialCreation) (*proto.MFARegisterResponse, error) {
+// Register performs client-side, U2F-compatible Webauthn registration.
+// This method blocks until either device authentication is successful or the
+// context is cancelled. Calling Register without a deadline or cancel condition
+// may cause it block forever.
+// The caller is expected to prompt the user for action before calling this
+// method.
+func Register(ctx context.Context, origin string, cc *wanlib.CredentialCreation) (*proto.MFARegisterResponse, error) {
 	// Preliminary checks, more below.
 	switch {
 	case origin == "":
diff --git a/lib/auth/webauthncli/u2f_register_test.go b/lib/auth/webauthncli/register_test.go
similarity index 92%
rename from lib/auth/webauthncli/u2f_register_test.go
rename to lib/auth/webauthncli/register_test.go
index f45a39d956936..dc01544cc3793 100644
--- a/lib/auth/webauthncli/u2f_register_test.go
+++ b/lib/auth/webauthncli/register_test.go
@@ -35,6 +35,7 @@ func TestRegister(t *testing.T) {
 	const rpID = "example.com"
 	const origin = "https://example.com"
 
+	// Prepare a few fake devices.
 	u2fKey, err := newFakeDevice("u2fkey" /* name */, "" /* appID */)
 	require.NoError(t, err)
 	registeredKey, err := newFakeDevice("regkey" /* name */, rpID /* appID */)
@@ -47,17 +48,8 @@ func TestRegister(t *testing.T) {
 			RPID: rpID,
 		},
 		Identity: &fakeIdentity{
-			User: user,
-			Devices: []*types.MFADevice{
-				// Fake a WebAuthn device record, as U2F devices are not excluded from registration.
-				{
-					Device: &types.MFADevice_Webauthn{
-						Webauthn: &types.WebauthnDevice{
-							CredentialId: registeredKey.key.KeyHandle,
-						},
-					},
-				},
-			},
+			User:    user,
+			Devices: []*types.MFADevice{registeredKey.mfaDevice},
 		},
 	}
 
@@ -101,7 +93,7 @@ func TestRegister(t *testing.T) {
 			fakeDevs := &fakeDevices{devs: test.devs}
 			fakeDevs.assignU2FCallbacks()
 
-			resp, err := wancli.U2FRegister(ctx, origin, cc)
+			resp, err := wancli.Register(ctx, origin, cc)
 			switch hasErr := err != nil; {
 			case hasErr != test.wantErr:
 				t.Fatalf("Register returned err = %v, wantErr = %v", err, test.wantErr)
@@ -204,7 +196,7 @@ func TestRegister_errors(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			_, err := wancli.U2FRegister(ctx, test.origin, test.makeCC())
+			_, err := wancli.Register(ctx, test.origin, test.makeCC())
 			require.Error(t, err)
 			require.Contains(t, err.Error(), test.wantErr)
 		})
diff --git a/lib/backend/backend.go b/lib/backend/backend.go
index b17e616b2d2d2..2b398ec95153e 100644
--- a/lib/backend/backend.go
+++ b/lib/backend/backend.go
@@ -85,6 +85,10 @@ type Backend interface {
 	// CloseWatchers closes all the watchers
 	// without closing the backend
 	CloseWatchers()
+
+	// Migrate performs any data migration necessary between Teleport versions.
+	// Migrate must be called BEFORE using any other methods of the Backend.
+	Migrate(context.Context) error
 }
 
 // IterateRange is a helper for stepping over a range
@@ -281,8 +285,6 @@ func GetPaginationKey(r types.Resource) string {
 		return string(internalKey(resourceWithType.GetHostID(), resourceWithType.GetName()))
 	case types.AppServer:
 		return string(internalKey(resourceWithType.GetHostID(), resourceWithType.GetName()))
-	case types.WindowsDesktop:
-		return string(internalKey(resourceWithType.GetHostID(), resourceWithType.GetName()))
 	default:
 		return r.GetName()
 	}
@@ -377,3 +379,9 @@ func Key(parts ...string) []byte {
 func internalKey(internalPrefix string, parts ...string) []byte {
 	return []byte(strings.Join(append([]string{internalPrefix}, parts...), string(Separator)))
 }
+
+// NoMigrations implements a nop Migrate method of Backend.
+// Backend implementations should embed this when no migrations are necessary.
+type NoMigrations struct{}
+
+func (NoMigrations) Migrate(context.Context) error { return nil }
diff --git a/lib/backend/backend_test.go b/lib/backend/backend_test.go
index 80a5f0b7b9818..65101e2663710 100644
--- a/lib/backend/backend_test.go
+++ b/lib/backend/backend_test.go
@@ -19,8 +19,6 @@ package backend
 
 import (
 	"testing"
-
-	"github.com/stretchr/testify/require"
 )
 
 func TestParams(t *testing.T) {
@@ -38,20 +36,3 @@ func TestParams(t *testing.T) {
 		t.Errorf("expected 'path' to be '%v', got '%v'", expectedPath, path)
 	}
 }
-
-func TestRangeEnd(t *testing.T) {
-	for _, test := range []struct {
-		key, expected string
-	}{
-		{"abc", "abd"},
-		{"/foo/bar", "/foo/bas"},
-		{"/xyz", "/xy{"},
-		{"\xFF", "\x00"},
-		{"\xFF\xFF\xFF", "\x00"},
-	} {
-		t.Run(test.key, func(t *testing.T) {
-			end := RangeEnd([]byte(test.key))
-			require.Equal(t, test.expected, string(end))
-		})
-	}
-}
diff --git a/lib/backend/dynamo/dynamodbbk.go b/lib/backend/dynamo/dynamodbbk.go
index 669ca28c251dc..ea1dd5535b739 100644
--- a/lib/backend/dynamo/dynamodbbk.go
+++ b/lib/backend/dynamo/dynamodbbk.go
@@ -122,6 +122,7 @@ func (cfg *Config) CheckAndSetDefaults() error {
 type Backend struct {
 	*log.Entry
 	Config
+	backend.NoMigrations
 	svc              *dynamodb.DynamoDB
 	streams          *dynamodbstreams.DynamoDBStreams
 	clock            clockwork.Clock
@@ -362,10 +363,6 @@ func (b *Backend) GetRange(ctx context.Context, startKey []byte, endKey []byte,
 	if len(endKey) == 0 {
 		return nil, trace.BadParameter("missing parameter endKey")
 	}
-	if limit <= 0 {
-		limit = backend.DefaultRangeLimit
-	}
-
 	result, err := b.getAllRecords(ctx, startKey, endKey, limit)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -386,7 +383,6 @@ func (b *Backend) GetRange(ctx context.Context, startKey []byte, endKey []byte,
 
 func (b *Backend) getAllRecords(ctx context.Context, startKey []byte, endKey []byte, limit int) (*getResult, error) {
 	var result getResult
-
 	// this code is being extra careful here not to introduce endless loop
 	// by some unfortunate series of events
 	for i := 0; i < backend.DefaultRangeLimit/100; i++ {
@@ -395,9 +391,7 @@ func (b *Backend) getAllRecords(ctx context.Context, startKey []byte, endKey []b
 			return nil, trace.Wrap(err)
 		}
 		result.records = append(result.records, re.records...)
-		// If the limit was exceeded or there are no more records to fetch return the current result
-		// otherwise updated lastEvaluatedKey and proceed with obtaining new records.
-		if (limit != 0 && len(result.records) >= limit) || len(re.lastEvaluatedKey) == 0 {
+		if len(result.records) >= limit || len(re.lastEvaluatedKey) == 0 {
 			if len(result.records) == backend.DefaultRangeLimit {
 				b.Warnf("Range query hit backend limit. (this is a bug!) startKey=%q,limit=%d", startKey, backend.DefaultRangeLimit)
 			}
@@ -750,12 +744,12 @@ func (b *Backend) getRecords(ctx context.Context, startKey, endKey string, limit
 
 // isExpired returns 'true' if the given object (record) has a TTL and
 // it's due.
-func (r *record) isExpired(now time.Time) bool {
+func (r *record) isExpired() bool {
 	if r.Expires == nil {
 		return false
 	}
 	expiryDateUTC := time.Unix(*r.Expires, 0).UTC()
-	return now.UTC().After(expiryDateUTC)
+	return time.Now().UTC().After(expiryDateUTC)
 }
 
 func removeDuplicates(elements []record) []record {
@@ -874,7 +868,7 @@ func (b *Backend) getKey(ctx context.Context, key []byte) (*record, error) {
 		return nil, trace.WrapWithMessage(err, "failed to unmarshal dynamo item %q", string(key))
 	}
 	// Check if key expired, if expired delete it
-	if r.isExpired(b.clock.Now()) {
+	if r.isExpired() {
 		if err := b.deleteKey(ctx, key); err != nil {
 			b.Warnf("Failed deleting expired key %q: %v", key, err)
 		}
diff --git a/lib/backend/dynamo/dynamodbbk_test.go b/lib/backend/dynamo/dynamodbbk_test.go
index aba11048f0c64..d2b336cd2441f 100644
--- a/lib/backend/dynamo/dynamodbbk_test.go
+++ b/lib/backend/dynamo/dynamodbbk_test.go
@@ -22,12 +22,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/test"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 )
 
 func TestMain(m *testing.M) {
@@ -71,7 +70,7 @@ func TestDynamoDB(t *testing.T) {
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
-		clock := clockwork.NewFakeClockAt(time.Now())
+		clock := clockwork.NewFakeClock()
 		uut.clock = clock
 		return uut, clock, nil
 	}
diff --git a/lib/backend/etcdbk/etcd.go b/lib/backend/etcdbk/etcd.go
index 8714618b62731..bec81ffe92f0e 100644
--- a/lib/backend/etcdbk/etcd.go
+++ b/lib/backend/etcdbk/etcd.go
@@ -23,7 +23,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
-	"os"
+	"io/ioutil"
 	"sort"
 	"strings"
 	"time"
@@ -132,6 +132,7 @@ var (
 )
 
 type EtcdBackend struct {
+	backend.NoMigrations
 	nodes []string
 	*log.Entry
 	cfg       *Config
@@ -277,7 +278,7 @@ func (cfg *Config) Validate() error {
 		cfg.DialTimeout = apidefaults.DefaultDialTimeout
 	}
 	if cfg.PasswordFile != "" {
-		out, err := os.ReadFile(cfg.PasswordFile)
+		out, err := ioutil.ReadFile(cfg.PasswordFile)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
@@ -313,11 +314,11 @@ func (b *EtcdBackend) reconnect(ctx context.Context) error {
 	tlsConfig := utils.TLSConfig(nil)
 
 	if b.cfg.TLSCertFile != "" {
-		clientCertPEM, err := os.ReadFile(b.cfg.TLSCertFile)
+		clientCertPEM, err := ioutil.ReadFile(b.cfg.TLSCertFile)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
-		clientKeyPEM, err := os.ReadFile(b.cfg.TLSKeyFile)
+		clientKeyPEM, err := ioutil.ReadFile(b.cfg.TLSKeyFile)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
@@ -329,7 +330,7 @@ func (b *EtcdBackend) reconnect(ctx context.Context) error {
 	}
 
 	if b.cfg.TLSCAFile != "" {
-		caCertPEM, err := os.ReadFile(b.cfg.TLSCAFile)
+		caCertPEM, err := ioutil.ReadFile(b.cfg.TLSCAFile)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
diff --git a/lib/backend/firestore/firestorebk.go b/lib/backend/firestore/firestorebk.go
index a051544f64870..17cde960a0a39 100644
--- a/lib/backend/firestore/firestorebk.go
+++ b/lib/backend/firestore/firestorebk.go
@@ -95,6 +95,7 @@ func (cfg *backendConfig) CheckAndSetDefaults() error {
 type Backend struct {
 	*log.Entry
 	backendConfig
+	backend.NoMigrations
 	// svc is the primary Firestore client
 	svc *firestore.Client
 	// clock is the
diff --git a/lib/backend/lite/lite.go b/lib/backend/lite/lite.go
index 49ac382b7730a..a9aada40113f4 100644
--- a/lib/backend/lite/lite.go
+++ b/lib/backend/lite/lite.go
@@ -21,11 +21,10 @@ import (
 	"context"
 	"database/sql"
 	"database/sql/driver"
-	"net/url"
+	"fmt"
 	"os"
 	"path/filepath"
 	"runtime/debug"
-	"strconv"
 	"sync/atomic"
 	"time"
 
@@ -40,36 +39,15 @@ import (
 )
 
 const (
-	// BackendName is the name of this backend.
+	// BackendName is the name of this backend
 	BackendName = "sqlite"
 	// AlternativeName is another name of this backend.
-	AlternativeName = "dir"
-
-	// SyncOff disables file system sync after writing.
-	SyncOff = "OFF"
-	// SyncFull fsyncs the database file on disk after every write.
-	SyncFull = "FULL"
-
-	// JournalMemory keeps the rollback journal in memory instead of storing it
-	// on disk.
-	JournalMemory = "MEMORY"
-)
-
-const (
-	// defaultDirMode is the mode of the newly created directories that are part
-	// of the Path
-	defaultDirMode os.FileMode = 0770
-
-	// defaultDBFile is the file name of the sqlite db in the directory
-	// specified by Path
-	defaultDBFile            = "sqlite.db"
-	slowTransactionThreshold = time.Second
-
-	// defaultSync is the default value for Sync
-	defaultSync = SyncOff
-
-	// defaultBusyTimeout is the default value for BusyTimeout, in ms
-	defaultBusyTimeout = 10000
+	AlternativeName                      = "dir"
+	defaultDirMode           os.FileMode = 0770
+	defaultDBFile                        = "sqlite.db"
+	slowTransactionThreshold             = time.Second
+	syncOFF                              = "OFF"
+	busyTimeout                          = 10000
 )
 
 // GetName is a part of backend API and it returns SQLite backend type
@@ -78,6 +56,14 @@ func GetName() string {
 	return BackendName
 }
 
+func init() {
+	sql.Register(BackendName, &sqlite3.SQLiteDriver{
+		ConnectHook: func(conn *sqlite3.SQLiteConn) error {
+			return nil
+		},
+	})
+}
+
 // Config structure represents configuration section
 type Config struct {
 	// Path is a path to the database directory
@@ -91,12 +77,15 @@ type Config struct {
 	EventsOff bool `json:"events_off,omitempty"`
 	// Clock allows to override clock used in the backend
 	Clock clockwork.Clock `json:"-"`
-	// Sync sets the synchronous pragma
+	// Sync sets synchronous pragrma
 	Sync string `json:"sync,omitempty"`
 	// BusyTimeout sets busy timeout in milliseconds
 	BusyTimeout int `json:"busy_timeout,omitempty"`
-	// Journal sets the journal_mode pragma
-	Journal string `json:"journal,omitempty"`
+	// Memory turns memory mode of the database
+	Memory bool `json:"memory"`
+	// MemoryName sets the name of the database,
+	// set to "sqlite.db" by default
+	MemoryName string `json:"memory_name"`
 	// Mirror turns on mirror mode for the backend,
 	// which will use record IDs for Put and PutRange passed from
 	// the resources, not generate a new one
@@ -106,7 +95,7 @@ type Config struct {
 // CheckAndSetDefaults is a helper returns an error if the supplied configuration
 // is not enough to connect to sqlite
 func (cfg *Config) CheckAndSetDefaults() error {
-	if cfg.Path == "" {
+	if cfg.Path == "" && !cfg.Memory {
 		return trace.BadParameter("specify directory path to the database using 'path' parameter")
 	}
 	if cfg.BufferSize == 0 {
@@ -119,69 +108,17 @@ func (cfg *Config) CheckAndSetDefaults() error {
 		cfg.Clock = clockwork.NewRealClock()
 	}
 	if cfg.Sync == "" {
-		cfg.Sync = defaultSync
+		cfg.Sync = syncOFF
 	}
 	if cfg.BusyTimeout == 0 {
-		cfg.BusyTimeout = defaultBusyTimeout
+		cfg.BusyTimeout = busyTimeout
+	}
+	if cfg.MemoryName == "" {
+		cfg.MemoryName = defaultDBFile
 	}
 	return nil
 }
 
-// ConnectionURI returns a connection string usable with sqlite according to the
-// Config.
-func (cfg *Config) ConnectionURI() string {
-	params := url.Values{}
-	params.Set("_busy_timeout", strconv.Itoa(cfg.BusyTimeout))
-	// The _txlock parameter is parsed by go-sqlite to determine if (all)
-	// transactions should be started with `BEGIN DEFERRED` (the default, same
-	// as `BEGIN`), `BEGIN IMMEDIATE` or `BEGIN EXCLUSIVE`.
-	//
-	// The way we use sqlite relies entirely on the busy timeout handler (also
-	// configured through the connection URL, with the _busy_timeout parameter)
-	// to address concurrency problems, and treats any SQLITE_BUSY errors as a
-	// fatal issue with the database; however, in scenarios with multiple
-	// readwriters it is possible to still get a busy error even with a generous
-	// busy timeout handler configured, as two transactions that both start off
-	// with a SELECT - thus acquiring a SHARED lock, see
-	// https://www.sqlite.org/lockingv3.html#transaction_control - then attempt
-	// to upgrade to a RESERVED lock to upsert or delete something can end up
-	// requiring one of the two transactions to forcibly rollback to avoid a
-	// deadlock, which is signaled by the sqlite engine with a SQLITE_BUSY error
-	// returned to one of the two. When that happens, a concurrent-aware program
-	// can just try the transaction again a few times - making sure to disregard
-	// what was read before the transaction actually committed.
-	//
-	// As we're not really interested in concurrent sqlite access (process
-	// storage has very little written to, sharing a sqlite database as the
-	// backend between two auths is not really supported, and caches shouldn't
-	// ever run on the same underlying sqlite backend) we instead start every
-	// transaction with `BEGIN IMMEDIATE`, which grabs a RESERVED lock
-	// immediately (waiting for the busy timeout in case some other connection
-	// to the database has the lock) at the beginning of the transaction, thus
-	// avoiding any spurious SQLITE_BUSY error that can happen halfway through a
-	// transaction.
-	//
-	// If we end up requiring better concurrent access to sqlite in the future
-	// we should consider enabling Write-Ahead Logging mode, to actually allow
-	// for reads to happen at the same time as writes, adding some amount of
-	// retries to inTransaction, and double-checking that all uses of it
-	// correctly handle the possibility of the transaction being restarted.
-	params.Set("_txlock", "immediate")
-	if cfg.Sync != "" {
-		params.Set("_sync", cfg.Sync)
-	}
-	if cfg.Journal != "" {
-		params.Set("_journal", cfg.Journal)
-	}
-
-	u := url.URL{
-		Scheme:   "file",
-		Opaque:   url.QueryEscape(filepath.Join(cfg.Path, defaultDBFile)),
-		RawQuery: params.Encode(),
-	}
-	return u.String()
-}
-
 // New returns a new instance of sqlite backend
 func New(ctx context.Context, params backend.Params) (*Backend, error) {
 	var cfg *Config
@@ -198,18 +135,23 @@ func NewWithConfig(ctx context.Context, cfg Config) (*Backend, error) {
 	if err := cfg.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	connectionURI := cfg.ConnectionURI()
-	// Ensure that the path to the root directory exists.
-	err := os.MkdirAll(cfg.Path, defaultDirMode)
-	if err != nil {
-		return nil, trace.ConvertSystemError(err)
+	var connectorURL string
+	if !cfg.Memory {
+		// Ensure that the path to the root directory exists.
+		err := os.MkdirAll(cfg.Path, defaultDirMode)
+		if err != nil {
+			return nil, trace.ConvertSystemError(err)
+		}
+		fullPath := filepath.Join(cfg.Path, defaultDBFile)
+		connectorURL = fmt.Sprintf("file:%v?_busy_timeout=%v&_sync=%v", fullPath, cfg.BusyTimeout, cfg.Sync)
+	} else {
+		connectorURL = fmt.Sprintf("file:%v?mode=memory", cfg.MemoryName)
 	}
-	db, err := sql.Open("sqlite3", cfg.ConnectionURI())
+	db, err := sql.Open(BackendName, connectorURL)
 	if err != nil {
-		return nil, trace.Wrap(err, "error opening URI: %v", connectionURI)
+		return nil, trace.Wrap(err, "error opening URI: %v", connectorURL)
 	}
-	// serialize access to sqlite, as we're using immediate transactions anyway,
-	// and in-memory go locks are faster than sqlite locks
+	// serialize access to sqlite to avoid database is locked errors
 	db.SetMaxOpenConns(1)
 	buf := backend.NewCircularBuffer(
 		backend.BufferCapacity(cfg.BufferSize),
@@ -224,9 +166,9 @@ func NewWithConfig(ctx context.Context, cfg Config) (*Backend, error) {
 		ctx:    closeCtx,
 		cancel: cancel,
 	}
-	l.Debugf("Connected to: %v, poll stream period: %v", connectionURI, cfg.PollStreamPeriod)
+	l.Debugf("Connected to: %v, poll stream period: %v", connectorURL, cfg.PollStreamPeriod)
 	if err := l.createSchema(); err != nil {
-		return nil, trace.Wrap(err, "error creating schema: %v", connectionURI)
+		return nil, trace.Wrap(err, "error creating schema: %v", connectorURL)
 	}
 	if err := l.showPragmas(); err != nil {
 		l.Warningf("Failed to show pragma settings: %v.", err)
@@ -239,6 +181,7 @@ func NewWithConfig(ctx context.Context, cfg Config) (*Backend, error) {
 type Backend struct {
 	Config
 	*log.Entry
+	backend.NoMigrations
 	db *sql.DB
 	// clock is used to generate time,
 	// could be swapped in tests for fixed time
@@ -256,22 +199,17 @@ type Backend struct {
 // parameters, when called, logs some key PRAGMA values
 func (l *Backend) showPragmas() error {
 	return l.inTransaction(l.ctx, func(tx *sql.Tx) error {
-		var journalMode string
-		row := tx.QueryRowContext(l.ctx, "PRAGMA journal_mode;")
-		if err := row.Scan(&journalMode); err != nil {
-			return trace.Wrap(err)
-		}
-		row = tx.QueryRowContext(l.ctx, "PRAGMA synchronous;")
-		var synchronous string
-		if err := row.Scan(&synchronous); err != nil {
+		row := tx.QueryRowContext(l.ctx, "PRAGMA synchronous;")
+		var syncValue string
+		if err := row.Scan(&syncValue); err != nil {
 			return trace.Wrap(err)
 		}
-		var busyTimeout string
+		var timeoutValue string
 		row = tx.QueryRowContext(l.ctx, "PRAGMA busy_timeout;")
-		if err := row.Scan(&busyTimeout); err != nil {
+		if err := row.Scan(&timeoutValue); err != nil {
 			return trace.Wrap(err)
 		}
-		l.Debugf("journal_mode=%v, synchronous=%v, busy_timeout=%v", journalMode, synchronous, busyTimeout)
+		l.Debugf("Synchronous: %v, busy timeout: %v", syncValue, timeoutValue)
 		return nil
 	})
 }
diff --git a/lib/backend/lite/litemem_test.go b/lib/backend/lite/litemem_test.go
new file mode 100644
index 0000000000000..764539739e691
--- /dev/null
+++ b/lib/backend/lite/litemem_test.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2018-2019 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package lite
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/test"
+	"github.com/gravitational/trace"
+
+	"github.com/jonboulle/clockwork"
+)
+
+func TestLiteMem(t *testing.T) {
+	newBackend := func(options ...test.ConstructionOption) (backend.Backend, clockwork.FakeClock, error) {
+		clock := clockwork.NewFakeClock()
+
+		testCfg, err := test.ApplyOptions(options)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		backendCfg := Config{
+			Memory:           true,
+			PollStreamPeriod: 300 * time.Millisecond,
+			Clock:            clock,
+			Mirror:           testCfg.MirrorMode,
+		}
+
+		backend, err := NewWithConfig(context.Background(), backendCfg)
+		if err != nil {
+			return nil, nil, trace.Wrap(err)
+		}
+
+		return backend, clock, nil
+	}
+
+	test.RunBackendComplianceSuite(t, newBackend)
+}
diff --git a/lib/backend/memory/memory.go b/lib/backend/memory/memory.go
index 58a384f96a498..7568c4b3d6cb8 100644
--- a/lib/backend/memory/memory.go
+++ b/lib/backend/memory/memory.go
@@ -116,6 +116,7 @@ type Memory struct {
 	*sync.Mutex
 	*log.Entry
 	Config
+	backend.NoMigrations
 	// tree is a BTree with items
 	tree *btree.BTree
 	// heap is a min heap with expiry records
diff --git a/lib/backend/report.go b/lib/backend/report.go
index 89207f194aeef..b229dac8a5b07 100644
--- a/lib/backend/report.go
+++ b/lib/backend/report.go
@@ -253,6 +253,9 @@ func (s *Reporter) Clock() clockwork.Clock {
 	return s.Backend.Clock()
 }
 
+// Migrate runs the necessary data migrations for this backend.
+func (s *Reporter) Migrate(ctx context.Context) error { return s.Backend.Migrate(ctx) }
+
 type topRequestsCacheKey struct {
 	component string
 	key       string
diff --git a/lib/backend/sanitize.go b/lib/backend/sanitize.go
index f6c751035b9fc..ccdc289e85ad6 100644
--- a/lib/backend/sanitize.go
+++ b/lib/backend/sanitize.go
@@ -30,16 +30,16 @@ import (
 // errorMessage is the error message to return when invalid input is provided by the caller.
 const errorMessage = "special characters are not allowed in resource names, please use name composed only from characters, hyphens, dots, and plus signs: %q"
 
-// allowPattern is the pattern of allowed characters for each key within
+// whitelistPattern is the pattern of allowed characters for each key within
 // the path.
-var allowPattern = regexp.MustCompile(`^[0-9A-Za-z@_:.\-/+]*$`)
+var whitelistPattern = regexp.MustCompile(`^[0-9A-Za-z@_:.\-/+]*$`)
 
-// denyPattern matches some unallowed combinations
-var denyPattern = regexp.MustCompile(`//`)
+// blacklistPattern matches some unallowed combinations
+var blacklistPattern = regexp.MustCompile(`//`)
 
 // isKeySafe checks if the passed in key conforms to whitelist
 func isKeySafe(s []byte) bool {
-	return allowPattern.Match(s) && !denyPattern.Match(s) && utf8.Valid(s)
+	return whitelistPattern.Match(s) && !blacklistPattern.Match(s) && utf8.Valid(s)
 }
 
 // Sanitizer wraps a Backend implementation to make sure all values requested
@@ -118,12 +118,12 @@ func (s *Sanitizer) Delete(ctx context.Context, key []byte) error {
 
 // DeleteRange deletes range of items
 func (s *Sanitizer) DeleteRange(ctx context.Context, startKey []byte, endKey []byte) error {
-	// we only validate the start key, since we often compute the end key
-	// in order to delete a bunch of related entries
 	if !isKeySafe(startKey) {
 		return trace.BadParameter(errorMessage, startKey)
 	}
-
+	if !isKeySafe(endKey) {
+		return trace.BadParameter(errorMessage, endKey)
+	}
 	return s.backend.DeleteRange(ctx, startKey, endKey)
 }
 
@@ -163,3 +163,6 @@ func (s *Sanitizer) Clock() clockwork.Clock {
 func (s *Sanitizer) CloseWatchers() {
 	s.backend.CloseWatchers()
 }
+
+// Migrate runs the necessary data migrations for this backend.
+func (s *Sanitizer) Migrate(ctx context.Context) error { return s.backend.Migrate(ctx) }
diff --git a/lib/backend/sanitize_test.go b/lib/backend/sanitize_test.go
index 81f4e750a55c0..42e34975c8f5f 100644
--- a/lib/backend/sanitize_test.go
+++ b/lib/backend/sanitize_test.go
@@ -16,88 +16,99 @@ package backend
 
 import (
 	"context"
-	"fmt"
-	"testing"
 	"time"
 
 	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
+	"gopkg.in/check.v1"
 )
 
-func TestSanitize(t *testing.T) {
+type Suite struct {
+}
+
+var _ = check.Suite(&Suite{})
+
+func (s *Suite) SetUpSuite(c *check.C) {
+}
+
+func (s *Suite) TearDownSuite(c *check.C) {
+}
+
+func (s *Suite) TearDownTest(c *check.C) {
+}
+
+func (s *Suite) SetUpTest(c *check.C) {
+}
+
+func (s *Suite) TestSanitizeBucket(c *check.C) {
 	tests := []struct {
-		inKey  []byte
-		assert require.ErrorAssertionFunc
+		inKey    []byte
+		outError bool
 	}{
 		{
-			inKey:  []byte("a-b/c:d/.e_f/01"),
-			assert: require.NoError,
+			inKey:    []byte("a-b/c:d/.e_f/01"),
+			outError: false,
 		},
 		{
-			inKey:  []byte("/namespaces//params"),
-			assert: require.Error,
+			inKey:    []byte("/namespaces//params"),
+			outError: true,
 		},
 		{
-			inKey:  RangeEnd([]byte("a-b/c:d/.e_f/01")),
-			assert: require.NoError,
+			inKey:    RangeEnd([]byte("a-b/c:d/.e_f/01")),
+			outError: false,
 		},
 		{
-			inKey:  RangeEnd([]byte("/")),
-			assert: require.NoError,
+			inKey:    RangeEnd([]byte("/")),
+			outError: false,
 		},
 		{
-			inKey:  RangeEnd([]byte("Malformed \xf0\x90\x28\xbc UTF8")),
-			assert: require.Error,
+			inKey:    RangeEnd([]byte("Malformed \xf0\x90\x28\xbc UTF8")),
+			outError: true,
 		},
 		{
-			inKey:  []byte("test+subaddr@example.com"),
-			assert: require.NoError,
-		},
-		{
-			inKey:  []byte("xyz"),
-			assert: require.NoError,
+			inKey:    []byte("test+subaddr@example.com"),
+			outError: false,
 		},
 	}
 
-	for _, tt := range tests {
-		t.Run(fmt.Sprintf("%v", string(tt.inKey)), func(t *testing.T) {
-			ctx := context.Background()
-			safeBackend := NewSanitizer(&nopBackend{})
+	for i, tt := range tests {
+		comment := check.Commentf("Test %v, key: %q", i, string(tt.inKey))
+
+		safeBackend := NewSanitizer(&nopBackend{})
 
-			_, err := safeBackend.Get(ctx, tt.inKey)
-			tt.assert(t, err)
+		ctx := context.TODO()
+		_, err := safeBackend.Get(ctx, tt.inKey)
+		c.Assert(err != nil, check.Equals, tt.outError, comment)
 
-			_, err = safeBackend.Create(ctx, Item{Key: tt.inKey})
-			tt.assert(t, err)
+		_, err = safeBackend.Create(ctx, Item{Key: tt.inKey})
+		c.Assert(err != nil, check.Equals, tt.outError, comment)
 
-			_, err = safeBackend.Put(ctx, Item{Key: tt.inKey})
-			tt.assert(t, err)
+		_, err = safeBackend.Put(ctx, Item{Key: tt.inKey})
+		c.Assert(err != nil, check.Equals, tt.outError, comment)
 
-			_, err = safeBackend.Update(ctx, Item{Key: tt.inKey})
-			tt.assert(t, err)
+		_, err = safeBackend.Update(ctx, Item{Key: tt.inKey})
+		c.Assert(err != nil, check.Equals, tt.outError, comment)
 
-			_, err = safeBackend.CompareAndSwap(ctx, Item{Key: tt.inKey}, Item{Key: tt.inKey})
-			tt.assert(t, err)
+		_, err = safeBackend.CompareAndSwap(ctx, Item{Key: tt.inKey}, Item{Key: tt.inKey})
+		c.Assert(err != nil, check.Equals, tt.outError, comment)
 
-			err = safeBackend.Delete(ctx, tt.inKey)
-			tt.assert(t, err)
+		err = safeBackend.Delete(ctx, tt.inKey)
+		c.Assert(err != nil, check.Equals, tt.outError, comment)
 
-			err = safeBackend.DeleteRange(ctx, tt.inKey, tt.inKey)
-			tt.assert(t, err)
-		})
+		err = safeBackend.DeleteRange(ctx, tt.inKey, tt.inKey)
+		c.Assert(err != nil, check.Equals, tt.outError, comment)
 	}
 }
 
-type nopBackend struct{}
+type nopBackend struct {
+	NoMigrations
+}
 
 func (n *nopBackend) Get(_ context.Context, _ []byte) (*Item, error) {
 	return &Item{}, nil
 }
 
 func (n *nopBackend) GetRange(_ context.Context, startKey []byte, endKey []byte, limit int) (*GetResult, error) {
-	return &GetResult{Items: []Item{
-		{Key: []byte("foo"), Value: []byte("bar")},
-	}}, nil
+	return &GetResult{Items: []Item{Item{Key: []byte("foo"), Value: []byte("bar")}}}, nil
 }
 
 func (n *nopBackend) Create(_ context.Context, _ Item) (*Lease, error) {
diff --git a/lib/backend/test/suite.go b/lib/backend/test/suite.go
index 2ca3bc04462e6..195236eba1b6a 100644
--- a/lib/backend/test/suite.go
+++ b/lib/backend/test/suite.go
@@ -22,7 +22,6 @@ import (
 	"context"
 	"encoding/hex"
 	"errors"
-	"fmt"
 	"math/rand"
 	"sync"
 	"sync/atomic"
@@ -141,6 +140,7 @@ func RunBackendComplianceSuite(t *testing.T, newBackend Constructor) {
 	t.Run("Events", func(t *testing.T) {
 		testEvents(t, newBackend)
 	})
+
 	t.Run("WatchersClose", func(t *testing.T) {
 		testWatchersClose(t, newBackend)
 	})
@@ -156,14 +156,6 @@ func RunBackendComplianceSuite(t *testing.T, newBackend Constructor) {
 	t.Run("Mirror", func(t *testing.T) {
 		testMirror(t, newBackend)
 	})
-
-	t.Run("FetchLimit", func(t *testing.T) {
-		testFetchLimit(t, newBackend)
-	})
-
-	t.Run("Limit", func(t *testing.T) {
-		testLimit(t, newBackend)
-	})
 }
 
 // RequireItems asserts that the supplied `actual` items collection matches
@@ -580,72 +572,6 @@ func testEvents(t *testing.T, newBackend Constructor) {
 	requireEvent(t, watcher, types.OpDelete, item.Key, 2*time.Second)
 }
 
-// testFetchLimit tests fetch max items size limit.
-func testFetchLimit(t *testing.T, newBackend Constructor) {
-	uut, _, err := newBackend()
-	require.NoError(t, err)
-	defer func() { require.NoError(t, uut.Close()) }()
-
-	prefix := MakePrefix()
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	// Allocate 65KB buffer.
-	buff := make([]byte, 1<<16)
-	itemsCount := 20
-	// Fill the backend with events that total size is greater than 1MB (65KB * 20 > 1MB).
-	for i := 0; i < itemsCount; i++ {
-		item := &backend.Item{Key: prefix(fmt.Sprintf("/db/database%d", i)), Value: buff}
-		_, err = uut.Put(ctx, *item)
-		require.NoError(t, err)
-	}
-
-	result, err := uut.GetRange(ctx, prefix("/db"), backend.RangeEnd(prefix("/db")), backend.NoLimit)
-	require.NoError(t, err)
-	require.Equal(t, itemsCount, len(result.Items))
-}
-
-// testLimit tests limit.
-func testLimit(t *testing.T, newBackend Constructor) {
-	uut, clock, err := newBackend()
-	require.NoError(t, err)
-	defer func() { require.NoError(t, uut.Close()) }()
-
-	prefix := MakePrefix()
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	item := &backend.Item{
-		Key:     prefix("/db/database_tail_item"),
-		Value:   []byte("data"),
-		Expires: clock.Now().Add(time.Minute),
-	}
-	_, err = uut.Put(ctx, *item)
-	require.NoError(t, err)
-	for i := 0; i < 10; i++ {
-		item := &backend.Item{
-			Key:     prefix(fmt.Sprintf("/db/database%d", i)),
-			Value:   []byte("data"),
-			Expires: clock.Now().Add(time.Second * 10),
-		}
-		_, err = uut.Put(ctx, *item)
-		require.NoError(t, err)
-	}
-	clock.Advance(time.Second * 20)
-
-	item = &backend.Item{
-		Key:     prefix("/db/database_head_item"),
-		Value:   []byte("data"),
-		Expires: clock.Now().Add(time.Minute),
-	}
-	_, err = uut.Put(ctx, *item)
-	require.NoError(t, err)
-
-	result, err := uut.GetRange(ctx, prefix("/db"), backend.RangeEnd(prefix("/db")), 2)
-	require.NoError(t, err)
-	require.Equal(t, 2, len(result.Items))
-}
-
 // requireEvent asserts that a given event type with the given key is emitted
 // by a watcher within the supplied timeout, returning that event for further
 // inspection if successful.
diff --git a/lib/backend/wrap.go b/lib/backend/wrap.go
index ec1f3dea142f8..387c506f146f2 100644
--- a/lib/backend/wrap.go
+++ b/lib/backend/wrap.go
@@ -136,3 +136,6 @@ func (s *Wrapper) CloseWatchers() {
 func (s *Wrapper) Clock() clockwork.Clock {
 	return s.backend.Clock()
 }
+
+// Migrate runs the necessary data migrations for this backend.
+func (s *Wrapper) Migrate(ctx context.Context) error { return s.backend.Migrate(ctx) }
diff --git a/lib/benchmark/benchmark.go b/lib/benchmark/benchmark.go
index 2775ddbee90f7..5b1d728b1e848 100644
--- a/lib/benchmark/benchmark.go
+++ b/lib/benchmark/benchmark.go
@@ -21,6 +21,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -156,8 +157,8 @@ func ExportLatencyProfile(path string, h *hdrhistogram.Histogram, ticks int32, v
 // to benchmark spec. It returns benchmark result when completed.
 // This is a blocking function that can be cancelled via context argument.
 func (c *Config) Benchmark(ctx context.Context, tc *client.TeleportClient) (Result, error) {
-	tc.Stdout = io.Discard
-	tc.Stderr = io.Discard
+	tc.Stdout = ioutil.Discard
+	tc.Stderr = ioutil.Discard
 	tc.Stdin = &bytes.Buffer{}
 	var delay time.Duration
 	ctx, cancel := context.WithCancel(ctx)
diff --git a/lib/bpf/bpf_test.go b/lib/bpf/bpf_test.go
index d276e80273094..5fa947e96b7f9 100644
--- a/lib/bpf/bpf_test.go
+++ b/lib/bpf/bpf_test.go
@@ -23,6 +23,7 @@ import (
 	"context"
 	_ "embed"
 	"fmt"
+	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -68,7 +69,7 @@ func (s *Suite) TestWatch(c *check.C) {
 	}
 
 	// Create temporary directory where cgroup2 hierarchy will be mounted.
-	dir, err := os.MkdirTemp("", "cgroup-test")
+	dir, err := ioutil.TempDir("", "cgroup-test")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(dir)
 
@@ -170,7 +171,7 @@ func (s *Suite) TestObfuscate(c *check.C) {
 	// has been executed.
 	go func() {
 		// Create temporary file.
-		file, err := os.CreateTemp("", "test-script")
+		file, err := ioutil.TempFile("", "test-script")
 		c.Assert(err, check.IsNil)
 		defer os.Remove(file.Name())
 
@@ -247,7 +248,7 @@ func (s *Suite) TestScript(c *check.C) {
 	// has been executed.
 	go func() {
 		// Create temporary file.
-		file, err := os.CreateTemp("", "test-script")
+		file, err := ioutil.TempFile("", "test-script")
 		c.Assert(err, check.IsNil)
 		defer os.Remove(file.Name())
 
diff --git a/lib/cache/cache.go b/lib/cache/cache.go
index 42fc0e9996872..91c30e3153292 100644
--- a/lib/cache/cache.go
+++ b/lib/cache/cache.go
@@ -1200,7 +1200,7 @@ var _ map[getCertAuthorityCacheKey]struct{} // compile-time hashability check
 
 // GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
 // controls if signing keys are loaded
-func (c *Cache) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (c *Cache) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	rg, err := c.read()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1209,10 +1209,8 @@ func (c *Cache) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadS
 
 	if !rg.IsCacheRead() && !loadSigningKeys {
 		ta := func(_ types.CertAuthority) {} // compile-time type assertion
-		ci, err := c.fnCache.Get(ctx, getCertAuthorityCacheKey{id}, func() (interface{}, error) {
-			// use cache's close context instead of request context in order to ensure
-			// that we don't cache a context cancellation error.
-			ca, err := rg.trust.GetCertAuthority(c.ctx, id, loadSigningKeys, opts...)
+		ci, err := c.fnCache.Get(context.TODO(), getCertAuthorityCacheKey{id}, func() (interface{}, error) {
+			ca, err := rg.trust.GetCertAuthority(id, loadSigningKeys, opts...)
 			ta(ca)
 			return ca, err
 		})
@@ -1224,13 +1222,13 @@ func (c *Cache) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadS
 		return cachedCA.Clone(), nil
 	}
 
-	ca, err := rg.trust.GetCertAuthority(ctx, id, loadSigningKeys, opts...)
+	ca, err := rg.trust.GetCertAuthority(id, loadSigningKeys, opts...)
 	if trace.IsNotFound(err) && rg.IsCacheRead() {
 		// release read lock early
 		rg.Release()
 		// fallback is sane because method is never used
 		// in construction of derivative caches.
-		if ca, err := c.Config.Trust.GetCertAuthority(ctx, id, loadSigningKeys, opts...); err == nil {
+		if ca, err := c.Config.Trust.GetCertAuthority(id, loadSigningKeys, opts...); err == nil {
 			return ca, nil
 		}
 	}
@@ -1245,7 +1243,7 @@ var _ map[getCertAuthoritiesCacheKey]struct{} // compile-time hashability check
 
 // GetCertAuthorities returns a list of authorities of a given type
 // loadSigningKeys controls whether signing keys should be loaded or not
-func (c *Cache) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (c *Cache) GetCertAuthorities(caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	rg, err := c.read()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1253,10 +1251,8 @@ func (c *Cache) GetCertAuthorities(ctx context.Context, caType types.CertAuthTyp
 	defer rg.Release()
 	if !rg.IsCacheRead() && !loadSigningKeys {
 		ta := func(_ []types.CertAuthority) {} // compile-time type assertion
-		ci, err := c.fnCache.Get(ctx, getCertAuthoritiesCacheKey{caType}, func() (interface{}, error) {
-			// use cache's close context instead of request context in order to ensure
-			// that we don't cache a context cancellation error.
-			cas, err := rg.trust.GetCertAuthorities(c.ctx, caType, loadSigningKeys, opts...)
+		ci, err := c.fnCache.Get(context.TODO(), getCertAuthoritiesCacheKey{caType}, func() (interface{}, error) {
+			cas, err := rg.trust.GetCertAuthorities(caType, loadSigningKeys, opts...)
 			ta(cas)
 			return cas, trace.Wrap(err)
 		})
@@ -1271,7 +1267,7 @@ func (c *Cache) GetCertAuthorities(ctx context.Context, caType types.CertAuthTyp
 		}
 		return cas, nil
 	}
-	return rg.trust.GetCertAuthorities(ctx, caType, loadSigningKeys, opts...)
+	return rg.trust.GetCertAuthorities(caType, loadSigningKeys, opts...)
 }
 
 // GetStaticTokens gets the list of static tokens used to provision nodes.
@@ -1936,16 +1932,6 @@ func (c *Cache) GetWindowsDesktops(ctx context.Context, filter types.WindowsDesk
 	return rg.windowsDesktops.GetWindowsDesktops(ctx, filter)
 }
 
-// ListWindowsDesktops returns all registered Windows desktop hosts.
-func (c *Cache) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
-	rg, err := c.read()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	defer rg.Release()
-	return rg.windowsDesktops.ListWindowsDesktops(ctx, req)
-}
-
 // ListResources is a part of auth.Cache implementation
 func (c *Cache) ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
 	rg, err := c.read()
diff --git a/lib/cache/cache_test.go b/lib/cache/cache_test.go
index 462ed97418afc..56ab363baa454 100644
--- a/lib/cache/cache_test.go
+++ b/lib/cache/cache_test.go
@@ -239,7 +239,6 @@ func newPack(dir string, setupConfig func(c Config) Config, opts ...packOption)
 func TestCA(t *testing.T) {
 	p := newPackForAuth(t)
 	t.Cleanup(p.Close)
-	ctx := context.Background()
 
 	ca := suite.NewTestCA(types.UserCA, "example.com")
 	require.NoError(t, p.trustS.UpsertCertAuthority(ca))
@@ -250,7 +249,7 @@ func TestCA(t *testing.T) {
 		t.Fatalf("timeout waiting for event")
 	}
 
-	out, err := p.cache.GetCertAuthority(ctx, ca.GetID(), true)
+	out, err := p.cache.GetCertAuthority(ca.GetID(), true)
 	require.NoError(t, err)
 	ca.SetResourceID(out.GetResourceID())
 	require.Empty(t, cmp.Diff(ca, out))
@@ -264,7 +263,7 @@ func TestCA(t *testing.T) {
 		t.Fatalf("timeout waiting for event")
 	}
 
-	_, err = p.cache.GetCertAuthority(ctx, ca.GetID(), false)
+	_, err = p.cache.GetCertAuthority(ca.GetID(), false)
 	require.True(t, trace.IsNotFound(err))
 }
 
@@ -577,7 +576,7 @@ func TestCompletenessInit(t *testing.T) {
 
 		p.backend.SetReadError(nil)
 
-		cas, err := p.cache.GetCertAuthorities(ctx, types.UserCA, false)
+		cas, err := p.cache.GetCertAuthorities(types.UserCA, false)
 		// we don't actually care whether the cache ever fully constructed
 		// the CA list.  for the purposes of this test, we just care that it
 		// doesn't return the CA list *unless* it was successfully constructed.
@@ -634,7 +633,7 @@ func TestCompletenessReset(t *testing.T) {
 	require.NoError(t, err)
 
 	// verify that CAs are immediately available
-	cas, err := p.cache.GetCertAuthorities(ctx, types.UserCA, false)
+	cas, err := p.cache.GetCertAuthorities(types.UserCA, false)
 	require.NoError(t, err)
 	require.Len(t, cas, caCount)
 
@@ -645,7 +644,7 @@ func TestCompletenessReset(t *testing.T) {
 		p.backend.SetReadError(nil)
 
 		// load CAs while connection is bad
-		cas, err := p.cache.GetCertAuthorities(ctx, types.UserCA, false)
+		cas, err := p.cache.GetCertAuthorities(types.UserCA, false)
 		// we don't actually care whether the cache ever fully constructed
 		// the CA list.  for the purposes of this test, we just care that it
 		// doesn't return the CA list *unless* it was successfully constructed.
@@ -697,7 +696,7 @@ func TestTombstones(t *testing.T) {
 	require.NoError(t, err)
 
 	// verify that CAs are immediately available
-	cas, err := p.cache.GetCertAuthorities(ctx, types.UserCA, false)
+	cas, err := p.cache.GetCertAuthorities(types.UserCA, false)
 	require.NoError(t, err)
 	require.Len(t, cas, caCount)
 
@@ -733,7 +732,7 @@ func TestTombstones(t *testing.T) {
 
 	// verify that CAs are immediately available despite the fact
 	// that the origin state was never available.
-	cas, err = p.cache.GetCertAuthorities(ctx, types.UserCA, false)
+	cas, err = p.cache.GetCertAuthorities(types.UserCA, false)
 	require.NoError(t, err)
 	require.Len(t, cas, caCount)
 }
@@ -977,7 +976,7 @@ func initStrategy(t *testing.T) {
 	}))
 	require.NoError(t, err)
 
-	_, err = p.cache.GetCertAuthorities(ctx, types.UserCA, false)
+	_, err = p.cache.GetCertAuthorities(types.UserCA, false)
 	require.True(t, trace.IsConnectionProblem(err))
 
 	ca := suite.NewTestCA(types.UserCA, "example.com")
@@ -999,7 +998,7 @@ func initStrategy(t *testing.T) {
 	}
 	_ = normalizeCA
 
-	out, err := p.cache.GetCertAuthority(ctx, ca.GetID(), false)
+	out, err := p.cache.GetCertAuthority(ca.GetID(), false)
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(normalizeCA(ca), normalizeCA(out)))
 
@@ -1013,7 +1012,7 @@ func initStrategy(t *testing.T) {
 	expectNextEvent(t, p.eventsC, WatcherFailed, EventProcessed, Reloading)
 
 	// backend is out, but old value is available
-	out2, err := p.cache.GetCertAuthority(ctx, ca.GetID(), false)
+	out2, err := p.cache.GetCertAuthority(ca.GetID(), false)
 	require.NoError(t, err)
 	require.Equal(t, out.GetResourceID(), out2.GetResourceID())
 	require.Empty(t, cmp.Diff(normalizeCA(ca), normalizeCA(out)))
@@ -1031,7 +1030,7 @@ func initStrategy(t *testing.T) {
 	expectEvent(t, p.eventsC, WatcherStarted)
 
 	// new value is available now
-	out, err = p.cache.GetCertAuthority(ctx, ca.GetID(), false)
+	out, err = p.cache.GetCertAuthority(ca.GetID(), false)
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(normalizeCA(ca), normalizeCA(out)))
 }
@@ -1071,7 +1070,7 @@ func TestRecovery(t *testing.T) {
 		t.Fatalf("timeout waiting for event")
 	}
 
-	out, err := p.cache.GetCertAuthority(context.Background(), ca2.GetID(), false)
+	out, err := p.cache.GetCertAuthority(ca2.GetID(), false)
 	require.NoError(t, err)
 	ca2.SetResourceID(out.GetResourceID())
 	types.RemoveCASecrets(ca2)
@@ -1406,7 +1405,7 @@ func TestRoles(t *testing.T) {
 	p := newPackForNode(t)
 	t.Cleanup(p.Close)
 
-	role, err := types.NewRoleV3("role1", types.RoleSpecV5{
+	role, err := types.NewRole("role1", types.RoleSpecV5{
 		Options: types.RoleOptions{
 			MaxSessionTTL: types.Duration(time.Hour),
 		},
diff --git a/lib/cache/collections.go b/lib/cache/collections.go
index 3b08860466bcb..4a7837b4fc738 100644
--- a/lib/cache/collections.go
+++ b/lib/cache/collections.go
@@ -813,17 +813,17 @@ func (c *certAuthority) erase(ctx context.Context) error {
 }
 
 func (c *certAuthority) fetch(ctx context.Context) (apply func(ctx context.Context) error, err error) {
-	applyHostCAs, err := c.fetchCertAuthorities(ctx, types.HostCA)
+	applyHostCAs, err := c.fetchCertAuthorities(types.HostCA)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	applyUserCAs, err := c.fetchCertAuthorities(ctx, types.UserCA)
+	applyUserCAs, err := c.fetchCertAuthorities(types.UserCA)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	applyJWTSigners, err := c.fetchCertAuthorities(ctx, types.JWTSigner)
+	applyJWTSigners, err := c.fetchCertAuthorities(types.JWTSigner)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -839,8 +839,8 @@ func (c *certAuthority) fetch(ctx context.Context) (apply func(ctx context.Conte
 	}, nil
 }
 
-func (c *certAuthority) fetchCertAuthorities(ctx context.Context, caType types.CertAuthType) (apply func(ctx context.Context) error, err error) {
-	authorities, err := c.Trust.GetCertAuthorities(ctx, caType, c.watch.LoadSecrets)
+func (c *certAuthority) fetchCertAuthorities(caType types.CertAuthType) (apply func(ctx context.Context) error, err error) {
+	authorities, err := c.Trust.GetCertAuthorities(caType, c.watch.LoadSecrets)
 	if err != nil {
 		// DELETE IN: 5.1
 		//
diff --git a/lib/cgroup/cgroup.go b/lib/cgroup/cgroup.go
index 8f3a07fd5d4cd..1ae2a1b85ea9d 100644
--- a/lib/cgroup/cgroup.go
+++ b/lib/cgroup/cgroup.go
@@ -28,7 +28,9 @@ import (
 	"bufio"
 	"bytes"
 	"encoding/binary"
+	"io/ioutil"
 	"os"
+	"path"
 	"path/filepath"
 	"regexp"
 	"strconv"
@@ -81,7 +83,7 @@ func New(config *Config) (*Service, error) {
 
 	s := &Service{
 		Config:       config,
-		teleportRoot: filepath.Join(config.MountPath, teleportRoot, uuid.New().String()),
+		teleportRoot: path.Join(config.MountPath, teleportRoot, uuid.New().String()),
 	}
 
 	// Mount the cgroup2 filesystem.
@@ -91,6 +93,7 @@ func New(config *Config) (*Service, error) {
 	}
 
 	log.Debugf("Teleport session hierarchy mounted at: %v.", s.teleportRoot)
+
 	return s, nil
 }
 
@@ -112,7 +115,7 @@ func (s *Service) Close() error {
 
 // Create will create a cgroup for a given session.
 func (s *Service) Create(sessionID string) error {
-	err := os.Mkdir(filepath.Join(s.teleportRoot, sessionID), fileMode)
+	err := os.Mkdir(path.Join(s.teleportRoot, sessionID), fileMode)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -123,32 +126,33 @@ func (s *Service) Create(sessionID string) error {
 // moved to the root controller.
 func (s *Service) Remove(sessionID string) error {
 	// Read in all PIDs for the cgroup.
-	pids, err := readPids(filepath.Join(s.teleportRoot, sessionID, cgroupProcs))
+	pids, err := readPids(path.Join(s.teleportRoot, sessionID, cgroupProcs))
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	// Move all PIDs to the root controller. This has to be done before a cgroup
 	// can be removed.
-	err = writePids(filepath.Join(s.MountPath, cgroupProcs), pids)
+	err = writePids(path.Join(s.MountPath, cgroupProcs), pids)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	// The rmdir syscall is used to remove a cgroup.
-	err = unix.Rmdir(filepath.Join(s.teleportRoot, sessionID))
+	err = unix.Rmdir(path.Join(s.teleportRoot, sessionID))
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	log.Debugf("Removed cgroup for session: %v.", sessionID)
+
 	return nil
 }
 
 // Place  place a process in the cgroup for that session.
 func (s *Service) Place(sessionID string, pid int) error {
 	// Open cgroup.procs file for the cgroup.
-	filepath := filepath.Join(s.teleportRoot, sessionID, cgroupProcs)
+	filepath := path.Join(s.teleportRoot, sessionID, cgroupProcs)
 	f, err := os.OpenFile(filepath, os.O_APPEND|os.O_WRONLY, fileMode)
 	if err != nil {
 		return trace.Wrap(err)
@@ -209,7 +213,7 @@ func (s *Service) cleanupHierarchy() error {
 	var sessions []string
 
 	// Recursively look within the Teleport hierarchy for cgroups for session.
-	err := filepath.Walk(filepath.Join(s.teleportRoot), func(path string, info os.FileInfo, _ error) error {
+	err := filepath.Walk(path.Join(s.teleportRoot), func(path string, info os.FileInfo, _ error) error {
 		// Only pick up cgroup.procs files.
 		if !pattern.MatchString(path) {
 			return nil
@@ -255,7 +259,7 @@ func (s *Service) mount() error {
 
 	// Check if the Teleport root cgroup exists, if it does the cgroup filesystem
 	// is already mounted, return right away.
-	files, err := os.ReadDir(s.MountPath)
+	files, err := ioutil.ReadDir(s.MountPath)
 	if err == nil && len(files) > 0 {
 		// Create cgroup that will hold Teleport sessions.
 		err = os.MkdirAll(s.teleportRoot, fileMode)
@@ -331,7 +335,7 @@ type fileHandle struct {
 // ID returns the cgroup ID for the given session.
 func (s *Service) ID(sessionID string) (uint64, error) {
 	var fh fileHandle
-	path := filepath.Join(s.teleportRoot, sessionID)
+	path := path.Join(s.teleportRoot, sessionID)
 
 	// Call the "name_to_handle_at" syscall directly (unix.NameToHandleAt is a
 	// thin wrapper around the syscall) instead of calling the glibc wrapper.
diff --git a/lib/cgroup/cgroup_test.go b/lib/cgroup/cgroup_test.go
index 5f542efb1fbf2..38329f48cd7cd 100644
--- a/lib/cgroup/cgroup_test.go
+++ b/lib/cgroup/cgroup_test.go
@@ -20,6 +20,7 @@ limitations under the License.
 package cgroup
 
 import (
+	"io/ioutil"
 	"os"
 	"path"
 	"testing"
@@ -50,7 +51,7 @@ func (s *Suite) TestCreate(c *check.C) {
 	}
 
 	// Create temporary directory where cgroup2 hierarchy will be mounted.
-	dir, err := os.MkdirTemp("", "cgroup-test")
+	dir, err := ioutil.TempDir("", "cgroup-test")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(dir)
 
@@ -102,7 +103,7 @@ func (s *Suite) TestCleanup(c *check.C) {
 	}
 
 	// Create temporary directory where cgroup2 hierarchy will be mounted.
-	dir, err := os.MkdirTemp("", "cgroup-test")
+	dir, err := ioutil.TempDir("", "cgroup-test")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(dir)
 
diff --git a/lib/client/api.go b/lib/client/api.go
index 1110d1aa5dcd2..4c19cd4a3609e 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -17,6 +17,7 @@ limitations under the License.
 package client
 
 import (
+	"bufio"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
@@ -25,6 +26,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -55,7 +57,6 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/keypaths"
 	"github.com/gravitational/teleport/lib/auth"
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 	"github.com/gravitational/teleport/lib/client/terminal"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
@@ -72,7 +73,6 @@ import (
 
 	"github.com/gravitational/trace"
 
-	"github.com/duo-labs/webauthn/protocol"
 	"github.com/jonboulle/clockwork"
 	"github.com/sirupsen/logrus"
 )
@@ -172,12 +172,6 @@ type Config struct {
 	// Remote host to connect
 	Host string
 
-	// SearchKeywords host to connect
-	SearchKeywords []string
-
-	// PredicateExpression host to connect
-	PredicateExpression string
-
 	// Labels represent host Labels
 	Labels map[string]string
 
@@ -355,18 +349,6 @@ type Config struct {
 
 	// Invited is a list of people invited to a session.
 	Invited []string
-
-	// DisplayParticipantRequirements is set if debug information about participants requirements
-	// should be printed in moderated sessions.
-	DisplayParticipantRequirements bool
-
-	// ExtraProxyHeaders is a collection of http headers to be included in requests to the WebProxy.
-	ExtraProxyHeaders map[string]string
-
-	// Passwordless enables passwordless authentication for TeleportClient.
-	// Affects the TeleportClient.Login and, indirectly, RetryWithRelogin
-	// functions.
-	Passwordless bool
 }
 
 // CachePolicy defines cache policy for local clients
@@ -484,6 +466,7 @@ func (p *ProfileStatus) DatabaseCertPathForCluster(clusterName string, databaseN
 // It's kept in <profile-dir>/keys/<proxy>/<user>-app/<cluster>/<name>-x509.pem
 func (p *ProfileStatus) AppCertPath(name string) string {
 	return keypaths.AppCertPath(p.Dir, p.Name, p.Username, p.Cluster, name)
+
 }
 
 // KubeConfigPath returns path to the specified kubeconfig for this profile.
@@ -533,8 +516,8 @@ func (p *ProfileStatus) AppNames() (result []string) {
 	return result
 }
 
-// RetryWithRelogin is a helper error handling method, attempts to relogin and
-// retry the function once.
+// RetryWithRelogin is a helper error handling method,
+// attempts to relogin and retry the function once
 func RetryWithRelogin(ctx context.Context, tc *TeleportClient, fn func() error) error {
 	err := fn()
 	if err == nil {
@@ -1261,12 +1244,7 @@ func (tc *TeleportClient) getTargetNodes(ctx context.Context, proxy *ProxyClient
 		retval = make([]string, 0)
 	)
 	if tc.Labels != nil && len(tc.Labels) > 0 {
-		nodes, err = proxy.FindNodesByFilters(ctx, proto.ListResourcesRequest{
-			Namespace:           tc.Namespace,
-			Labels:              tc.Labels,
-			SearchKeywords:      tc.SearchKeywords,
-			PredicateExpression: tc.PredicateExpression,
-		})
+		nodes, err = proxy.FindServersByLabels(ctx, tc.Namespace, tc.Labels)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1526,7 +1504,7 @@ func (tc *TeleportClient) Join(ctx context.Context, mode types.SessionParticipan
 	if sessionID.Check() != nil {
 		return trace.Errorf("Invalid session ID format: %s", string(sessionID))
 	}
-	notFoundErrorMessage := fmt.Sprintf("session '%s' not found or it has ended", sessionID)
+	var notFoundErrorMessage = fmt.Sprintf("session '%s' not found or it has ended", sessionID)
 
 	// connect to proxy:
 	if !tc.Config.ProxySpecified() {
@@ -1689,7 +1667,7 @@ func PlayFile(ctx context.Context, tarFile io.Reader, sid string) error {
 	var sessionEvents []events.EventFields
 	var stream []byte
 	protoReader := events.NewProtoReader(tarFile)
-	playbackDir, err := os.MkdirTemp("", "playback")
+	playbackDir, err := ioutil.TempDir("", "playback")
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -1917,8 +1895,17 @@ func isRemoteDest(name string) bool {
 	return strings.ContainsRune(name, ':')
 }
 
-// ListNodesWithFilters returns a list of nodes connected to a proxy
-func (tc *TeleportClient) ListNodesWithFilters(ctx context.Context) ([]types.Server, error) {
+// ListNodes returns a list of nodes connected to a proxy
+func (tc *TeleportClient) ListNodes(ctx context.Context) ([]types.Server, error) {
+	var err error
+	// userhost is specified? that must be labels
+	if tc.Host != "" {
+		tc.Labels, err = ParseLabelSpec(tc.Host)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
 	// connect to the proxy and ask it to return a full list of servers
 	proxyClient, err := tc.ConnectToProxy(ctx)
 	if err != nil {
@@ -1926,48 +1913,23 @@ func (tc *TeleportClient) ListNodesWithFilters(ctx context.Context) ([]types.Ser
 	}
 	defer proxyClient.Close()
 
-	servers, err := proxyClient.FindNodesByFilters(ctx, proto.ListResourcesRequest{
-		Namespace:           tc.Namespace,
-		Labels:              tc.Labels,
-		SearchKeywords:      tc.SearchKeywords,
-		PredicateExpression: tc.PredicateExpression,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return servers, nil
+	return proxyClient.FindServersByLabels(ctx, tc.Namespace, tc.Labels)
 }
 
-// ListAppServersWithFilters returns a list of application servers.
-func (tc *TeleportClient) ListAppServersWithFilters(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.AppServer, error) {
+// ListAppServers returns a list of application servers.
+func (tc *TeleportClient) ListAppServers(ctx context.Context) ([]types.AppServer, error) {
 	proxyClient, err := tc.ConnectToProxy(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	defer proxyClient.Close()
 
-	filter := customFilter
-	if customFilter == nil {
-		filter = &proto.ListResourcesRequest{
-			Namespace:           tc.Namespace,
-			Labels:              tc.Labels,
-			SearchKeywords:      tc.SearchKeywords,
-			PredicateExpression: tc.PredicateExpression,
-		}
-	}
-
-	servers, err := proxyClient.FindAppServersByFilters(ctx, *filter)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return servers, nil
+	return proxyClient.GetAppServers(ctx, tc.Namespace)
 }
 
 // ListApps returns all registered applications.
-func (tc *TeleportClient) ListApps(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.Application, error) {
-	servers, err := tc.ListAppServersWithFilters(ctx, customFilter)
+func (tc *TeleportClient) ListApps(ctx context.Context) ([]types.Application, error) {
+	servers, err := tc.ListAppServers(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1998,35 +1960,19 @@ func (tc *TeleportClient) DeleteAppSession(ctx context.Context, sessionID string
 	return proxyClient.DeleteAppSession(ctx, sessionID)
 }
 
-// ListDatabaseServersWithFilters returns all registered database proxy servers.
-func (tc *TeleportClient) ListDatabaseServersWithFilters(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.DatabaseServer, error) {
+// ListDatabaseServers returns all registered database proxy servers.
+func (tc *TeleportClient) ListDatabaseServers(ctx context.Context) ([]types.DatabaseServer, error) {
 	proxyClient, err := tc.ConnectToProxy(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	defer proxyClient.Close()
-
-	filter := customFilter
-	if customFilter == nil {
-		filter = &proto.ListResourcesRequest{
-			Namespace:           tc.Namespace,
-			Labels:              tc.Labels,
-			SearchKeywords:      tc.SearchKeywords,
-			PredicateExpression: tc.PredicateExpression,
-		}
-	}
-
-	servers, err := proxyClient.FindDatabaseServersByFilters(ctx, *filter)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return servers, nil
+	return proxyClient.GetDatabaseServers(ctx, tc.Namespace)
 }
 
 // ListDatabases returns all registered databases.
-func (tc *TeleportClient) ListDatabases(ctx context.Context, customFilter *proto.ListResourcesRequest) ([]types.Database, error) {
-	servers, err := tc.ListDatabaseServersWithFilters(ctx, customFilter)
+func (tc *TeleportClient) ListDatabases(ctx context.Context) ([]types.Database, error) {
+	servers, err := tc.ListDatabaseServers(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2045,15 +1991,13 @@ func (tc *TeleportClient) ListAllNodes(ctx context.Context) ([]types.Server, err
 	}
 	defer proxyClient.Close()
 
-	return proxyClient.FindNodesByFilters(ctx, proto.ListResourcesRequest{
-		Namespace: tc.Namespace,
-	})
+	return proxyClient.FindServersByLabels(ctx, tc.Namespace, nil)
 }
 
 // runCommandOnNodes executes a given bash command on a bunch of remote nodes.
 func (tc *TeleportClient) runCommandOnNodes(
-	ctx context.Context, siteName string, nodeAddresses []string, proxyClient *ProxyClient, command []string,
-) error {
+	ctx context.Context, siteName string, nodeAddresses []string, proxyClient *ProxyClient, command []string) error {
+
 	resultsC := make(chan error, len(nodeAddresses))
 	for _, address := range nodeAddresses {
 		go func(address string) {
@@ -2120,7 +2064,7 @@ func (tc *TeleportClient) runShell(ctx context.Context, nodeClient *NodeClient,
 	env := make(map[string]string)
 	env[teleport.EnvSSHJoinMode] = string(mode)
 	env[teleport.EnvSSHSessionReason] = tc.Config.Reason
-	env[teleport.EnvSSHSessionDisplayParticipantRequirements] = strconv.FormatBool(tc.Config.DisplayParticipantRequirements)
+
 	encoded, err := json.Marshal(&tc.Config.Invited)
 	if err != nil {
 		return trace.Wrap(err)
@@ -2436,8 +2380,14 @@ func (tc *TeleportClient) LogoutAll() error {
 	return nil
 }
 
-// PingAndShowMOTD pings the Teleport Proxy and displays the Message Of The Day if it's available.
-func (tc *TeleportClient) PingAndShowMOTD(ctx context.Context) (*webclient.PingResponse, error) {
+// Login logs the user into a Teleport cluster by talking to a Teleport proxy.
+//
+// The returned Key should typically be passed to ActivateKey in order to
+// update local agent state.
+//
+func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
+	// Ping the endpoint to see if it's up and find the type of authentication
+	// supported.
 	pr, err := tc.Ping(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -2449,22 +2399,6 @@ func (tc *TeleportClient) PingAndShowMOTD(ctx context.Context) (*webclient.PingR
 			return nil, trace.Wrap(err)
 		}
 	}
-	return pr, nil
-}
-
-// Login logs the user into a Teleport cluster by talking to a Teleport proxy.
-//
-// If tc.Passwordless is set, then the passwordless authentication flow is used.
-//
-// The returned Key should typically be passed to ActivateKey in order to
-// update local agent state.
-func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
-	// Ping the endpoint to see if it's up and find the type of authentication
-	// supported, also show the message of the day if available.
-	pr, err := tc.PingAndShowMOTD(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
 
 	// generate a new keypair. the public key will be signed via proxy if client's
 	// password+OTP are valid
@@ -2475,27 +2409,13 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 
 	var response *auth.SSHLoginResponse
 
-	switch authType := pr.Auth.Type; {
-	case tc.Passwordless: // Takes precedence over other methods if set.
-		// Do a few sanity checks before obeying.
-		switch {
-		case authType != constants.Local:
-			return nil, trace.BadParameter("Passwordless is only available for local authentication")
-		case pr.Auth.Webauthn == nil:
-			return nil, trace.BadParameter(
-				"Webauthn is not configured in this cluster, please contact your administrator and ask them to follow https://goteleport.com/docs/access-controls/guides/webauthn/")
-		}
-		response, err = tc.pwdlessLogin(ctx, key.Pub)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		tc.Username = response.Username
-	case authType == constants.Local:
+	switch pr.Auth.Type {
+	case constants.Local:
 		response, err = tc.localLogin(ctx, pr.Auth.SecondFactor, key.Pub)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-	case authType == constants.OIDC:
+	case constants.OIDC:
 		response, err = tc.ssoLogin(ctx, pr.Auth.OIDC.Name, key.Pub, constants.OIDC)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2505,7 +2425,7 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 		if tc.localAgent != nil {
 			tc.localAgent.username = response.Username
 		}
-	case authType == constants.SAML:
+	case constants.SAML:
 		response, err = tc.ssoLogin(ctx, pr.Auth.SAML.Name, key.Pub, constants.SAML)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2515,7 +2435,7 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 		if tc.localAgent != nil {
 			tc.localAgent.username = response.Username
 		}
-	case authType == constants.Github:
+	case constants.Github:
 		response, err = tc.ssoLogin(ctx, pr.Auth.Github.Name, key.Pub, constants.Github)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2556,195 +2476,6 @@ func (tc *TeleportClient) Login(ctx context.Context) (*Key, error) {
 	return key, nil
 }
 
-type pwdlessPrompt struct {
-	Out io.Writer
-}
-
-func (l pwdlessPrompt) PromptPIN() (string, error) {
-	fmt.Fprintln(l.Out, "Enter your security key PIN:")
-	pwd, err := passwordFromConsoleFn()
-	if err != nil {
-		fmt.Fprintln(l.Out, err)
-		return "", trace.Wrap(err)
-	}
-	return pwd, nil
-}
-
-func (l pwdlessPrompt) PromptAdditionalTouch() error {
-	fmt.Fprintln(l.Out, "Tap your security key again to complete login")
-	return nil
-}
-
-func (tc *TeleportClient) pwdlessLogin(ctx context.Context, pubKey []byte) (*auth.SSHLoginResponse, error) {
-	webClient, webURL, err := initClient(tc.WebProxyAddr, tc.InsecureSkipVerify, loopbackPool(tc.WebProxyAddr))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	challengeJSON, err := webClient.PostJSON(
-		ctx, webClient.Endpoint("webapi", "mfa", "login", "begin"),
-		&MFAChallengeRequest{
-			Passwordless: true,
-		})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	challenge := &MFAAuthenticateChallenge{}
-	if err := json.Unmarshal(challengeJSON.Bytes(), challenge); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	// Sanity check WebAuthn challenge.
-	switch {
-	case challenge.WebauthnChallenge == nil:
-		return nil, trace.BadParameter("passwordless: webauthn challenge missing")
-	case challenge.WebauthnChallenge.Response.UserVerification == protocol.VerificationDiscouraged:
-		return nil, trace.BadParameter("passwordless: user verification requirement too lax (%v)", challenge.WebauthnChallenge.Response.UserVerification)
-	}
-
-	prompt := pwdlessPrompt{Out: tc.Stderr}
-	fmt.Fprintln(tc.Stderr, "Tap your security key")
-	mfaResp, _, err := prompts.Webauthn(ctx, webURL.String(), tc.Username, challenge.WebauthnChallenge, prompt)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	loginRespJSON, err := webClient.PostJSON(
-		ctx, webClient.Endpoint("webapi", "mfa", "login", "finish"),
-		&AuthenticateSSHUserRequest{
-			User:                      "", // User carried on WebAuthn assertion.
-			WebauthnChallengeResponse: wanlib.CredentialAssertionResponseFromProto(mfaResp.GetWebauthn()),
-			PubKey:                    pubKey,
-			TTL:                       tc.KeyTTL,
-			Compatibility:             tc.CertificateFormat,
-			RouteToCluster:            tc.SiteName,
-			KubernetesCluster:         tc.KubernetesCluster,
-		})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	loginResp := &auth.SSHLoginResponse{}
-	if err := json.Unmarshal(loginRespJSON.Bytes(), loginResp); err != nil {
-		return nil, trace.Wrap(err)
-	}
-	return loginResp, nil
-}
-
-func (tc *TeleportClient) localLogin(ctx context.Context, secondFactor constants.SecondFactorType, pub []byte) (*auth.SSHLoginResponse, error) {
-	var err error
-	var response *auth.SSHLoginResponse
-
-	// TODO(awly): mfa: ideally, clients should always go through mfaLocalLogin
-	// (with a nop MFA challenge if no 2nd factor is required). That way we can
-	// deprecate the direct login endpoint.
-	switch secondFactor {
-	case constants.SecondFactorOff, constants.SecondFactorOTP:
-		response, err = tc.directLogin(ctx, secondFactor, pub)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	case constants.SecondFactorU2F, constants.SecondFactorWebauthn, constants.SecondFactorOn, constants.SecondFactorOptional:
-		response, err = tc.mfaLocalLogin(ctx, pub)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	default:
-		return nil, trace.BadParameter("unsupported second factor type: %q", secondFactor)
-	}
-
-	return response, nil
-}
-
-// directLogin asks for a password + HOTP token, makes a request to CA via proxy
-func (tc *TeleportClient) directLogin(ctx context.Context, secondFactorType constants.SecondFactorType, pub []byte) (*auth.SSHLoginResponse, error) {
-	password, err := tc.AskPassword()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// only ask for a second factor if it's enabled
-	var otpToken string
-	if secondFactorType == constants.SecondFactorOTP {
-		otpToken, err = tc.AskOTP()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	}
-
-	// ask the CA (via proxy) to sign our public key:
-	response, err := SSHAgentLogin(ctx, SSHLoginDirect{
-		SSHLogin: SSHLogin{
-			ProxyAddr:         tc.WebProxyAddr,
-			PubKey:            pub,
-			TTL:               tc.KeyTTL,
-			Insecure:          tc.InsecureSkipVerify,
-			Pool:              loopbackPool(tc.WebProxyAddr),
-			Compatibility:     tc.CertificateFormat,
-			RouteToCluster:    tc.SiteName,
-			KubernetesCluster: tc.KubernetesCluster,
-		},
-		User:     tc.Config.Username,
-		Password: password,
-		OTPToken: otpToken,
-	})
-
-	return response, trace.Wrap(err)
-}
-
-// mfaLocalLogin asks for a password and performs the challenge-response authentication
-func (tc *TeleportClient) mfaLocalLogin(ctx context.Context, pub []byte) (*auth.SSHLoginResponse, error) {
-	password, err := tc.AskPassword()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	response, err := SSHAgentMFALogin(ctx, SSHLoginMFA{
-		SSHLogin: SSHLogin{
-			ProxyAddr:         tc.WebProxyAddr,
-			PubKey:            pub,
-			TTL:               tc.KeyTTL,
-			Insecure:          tc.InsecureSkipVerify,
-			Pool:              loopbackPool(tc.WebProxyAddr),
-			Compatibility:     tc.CertificateFormat,
-			RouteToCluster:    tc.SiteName,
-			KubernetesCluster: tc.KubernetesCluster,
-		},
-		User:     tc.Config.Username,
-		Password: password,
-	})
-
-	return response, trace.Wrap(err)
-}
-
-// SSOLoginFunc is a function used in tests to mock SSO logins.
-type SSOLoginFunc func(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error)
-
-// samlLogin opens browser window and uses OIDC or SAML redirect cycle with browser
-func (tc *TeleportClient) ssoLogin(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error) {
-	if tc.MockSSOLogin != nil {
-		// sso login response is being mocked for testing purposes
-		return tc.MockSSOLogin(ctx, connectorID, pub, protocol)
-	}
-	// ask the CA (via proxy) to sign our public key:
-	response, err := SSHAgentSSOLogin(ctx, SSHLoginSSO{
-		SSHLogin: SSHLogin{
-			ProxyAddr:         tc.WebProxyAddr,
-			PubKey:            pub,
-			TTL:               tc.KeyTTL,
-			Insecure:          tc.InsecureSkipVerify,
-			Pool:              loopbackPool(tc.WebProxyAddr),
-			Compatibility:     tc.CertificateFormat,
-			RouteToCluster:    tc.SiteName,
-			KubernetesCluster: tc.KubernetesCluster,
-		},
-		ConnectorID: connectorID,
-		Protocol:    protocol,
-		BindAddr:    tc.BindAddr,
-		Browser:     tc.Browser,
-	})
-	return response, trace.Wrap(err)
-}
-
 // ActivateKey saves the target session cert into the local
 // keystore (and into the ssh-agent) for future use.
 func (tc *TeleportClient) ActivateKey(ctx context.Context, key *Key) error {
@@ -2803,13 +2534,12 @@ func (tc *TeleportClient) Ping(ctx context.Context) (*webclient.PingResponse, er
 	if tc.lastPing != nil {
 		return tc.lastPing, nil
 	}
-	pr, err := webclient.Ping(&webclient.Config{
-		Context:       ctx,
-		ProxyAddr:     tc.WebProxyAddr,
-		Insecure:      tc.InsecureSkipVerify,
-		Pool:          loopbackPool(tc.WebProxyAddr),
-		ConnectorName: tc.AuthConnector,
-		ExtraHeaders:  tc.ExtraProxyHeaders})
+	pr, err := webclient.Ping(
+		ctx,
+		tc.WebProxyAddr,
+		tc.InsecureSkipVerify,
+		loopbackPool(tc.WebProxyAddr),
+		tc.AuthConnector)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -2817,7 +2547,7 @@ func (tc *TeleportClient) Ping(ctx context.Context) (*webclient.PingResponse, er
 	// If version checking was requested and the server advertises a minimum version.
 	if tc.CheckVersions && pr.MinClientVersion != "" {
 		if err := utils.CheckVersion(teleport.Version, pr.MinClientVersion); err != nil && trace.IsBadParameter(err) {
-			fmt.Fprintf(tc.Config.Stderr, `
+			fmt.Printf(`
 			WARNING
 			Detected potentially incompatible client and server versions.
 			Minimum client version supported by the server is %v but you are using %v.
@@ -2841,25 +2571,22 @@ func (tc *TeleportClient) Ping(ctx context.Context) (*webclient.PingResponse, er
 // confirmation from the user.
 func (tc *TeleportClient) ShowMOTD(ctx context.Context) error {
 	motd, err := webclient.GetMOTD(
-		&webclient.Config{
-			Context:      ctx,
-			ProxyAddr:    tc.WebProxyAddr,
-			Insecure:     tc.InsecureSkipVerify,
-			Pool:         loopbackPool(tc.WebProxyAddr),
-			ExtraHeaders: tc.ExtraProxyHeaders})
-
+		ctx,
+		tc.WebProxyAddr,
+		tc.InsecureSkipVerify,
+		loopbackPool(tc.WebProxyAddr))
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	if motd.Text != "" {
-		fmt.Fprintf(tc.Config.Stderr, "%s\nPress [ENTER] to continue.\n", motd.Text)
+		fmt.Printf("%s\nPress [ENTER] to continue.\n", motd.Text)
 		// We're re-using the password reader for user acknowledgment for
 		// aesthetic purposes, because we want to hide any garbage the
 		// use might enter at the prompt. Whatever the user enters will
 		// be simply discarded, and the user can still CTRL+C out if they
 		// disagree.
-		_, err := passwordFromConsoleFn()
+		_, err := passwordFromConsole()
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -2888,7 +2615,7 @@ func (tc *TeleportClient) GetTrustedCA(ctx context.Context, clusterName string)
 	}
 
 	// Get the list of host certificates that this cluster knows about.
-	return clt.GetCertAuthorities(ctx, types.HostCA, false)
+	return clt.GetCertAuthorities(types.HostCA, false)
 }
 
 // UpdateTrustedCA connects to the Auth Server and fetches all host certificates
@@ -3072,6 +2799,31 @@ func (tc *TeleportClient) applyProxySettings(proxySettings webclient.ProxySettin
 	return nil
 }
 
+func (tc *TeleportClient) localLogin(ctx context.Context, secondFactor constants.SecondFactorType, pub []byte) (*auth.SSHLoginResponse, error) {
+	var err error
+	var response *auth.SSHLoginResponse
+
+	// TODO(awly): mfa: ideally, clients should always go through mfaLocalLogin
+	// (with a nop MFA challenge if no 2nd factor is required). That way we can
+	// deprecate the direct login endpoint.
+	switch secondFactor {
+	case constants.SecondFactorOff, constants.SecondFactorOTP:
+		response, err = tc.directLogin(ctx, secondFactor, pub)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	case constants.SecondFactorU2F, constants.SecondFactorWebauthn, constants.SecondFactorOn, constants.SecondFactorOptional:
+		response, err = tc.mfaLocalLogin(ctx, pub)
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	default:
+		return nil, trace.BadParameter("unsupported second factor type: %q", secondFactor)
+	}
+
+	return response, nil
+}
+
 // AddTrustedCA adds a new CA as trusted CA for this client, used in tests
 func (tc *TeleportClient) AddTrustedCA(ca types.CertAuthority) error {
 	if tc.localAgent == nil {
@@ -3105,6 +2857,96 @@ func (tc *TeleportClient) AddKey(key *Key) (*agent.AddedKey, error) {
 	return tc.localAgent.AddKey(key)
 }
 
+// directLogin asks for a password + HOTP token, makes a request to CA via proxy
+func (tc *TeleportClient) directLogin(ctx context.Context, secondFactorType constants.SecondFactorType, pub []byte) (*auth.SSHLoginResponse, error) {
+	password, err := tc.AskPassword()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// only ask for a second factor if it's enabled
+	var otpToken string
+	if secondFactorType == constants.SecondFactorOTP {
+		otpToken, err = tc.AskOTP()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+	}
+
+	// ask the CA (via proxy) to sign our public key:
+	response, err := SSHAgentLogin(ctx, SSHLoginDirect{
+		SSHLogin: SSHLogin{
+			ProxyAddr:         tc.WebProxyAddr,
+			PubKey:            pub,
+			TTL:               tc.KeyTTL,
+			Insecure:          tc.InsecureSkipVerify,
+			Pool:              loopbackPool(tc.WebProxyAddr),
+			Compatibility:     tc.CertificateFormat,
+			RouteToCluster:    tc.SiteName,
+			KubernetesCluster: tc.KubernetesCluster,
+		},
+		User:     tc.Config.Username,
+		Password: password,
+		OTPToken: otpToken,
+	})
+
+	return response, trace.Wrap(err)
+}
+
+// SSOLoginFunc is a function used in tests to mock SSO logins.
+type SSOLoginFunc func(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error)
+
+// samlLogin opens browser window and uses OIDC or SAML redirect cycle with browser
+func (tc *TeleportClient) ssoLogin(ctx context.Context, connectorID string, pub []byte, protocol string) (*auth.SSHLoginResponse, error) {
+	if tc.MockSSOLogin != nil {
+		// sso login response is being mocked for testing purposes
+		return tc.MockSSOLogin(ctx, connectorID, pub, protocol)
+	}
+	// ask the CA (via proxy) to sign our public key:
+	response, err := SSHAgentSSOLogin(ctx, SSHLoginSSO{
+		SSHLogin: SSHLogin{
+			ProxyAddr:         tc.WebProxyAddr,
+			PubKey:            pub,
+			TTL:               tc.KeyTTL,
+			Insecure:          tc.InsecureSkipVerify,
+			Pool:              loopbackPool(tc.WebProxyAddr),
+			Compatibility:     tc.CertificateFormat,
+			RouteToCluster:    tc.SiteName,
+			KubernetesCluster: tc.KubernetesCluster,
+		},
+		ConnectorID: connectorID,
+		Protocol:    protocol,
+		BindAddr:    tc.BindAddr,
+		Browser:     tc.Browser,
+	})
+	return response, trace.Wrap(err)
+}
+
+// mfaLocalLogin asks for a password and performs the challenge-response authentication
+func (tc *TeleportClient) mfaLocalLogin(ctx context.Context, pub []byte) (*auth.SSHLoginResponse, error) {
+	password, err := tc.AskPassword()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	response, err := SSHAgentMFALogin(ctx, SSHLoginMFA{
+		SSHLogin: SSHLogin{
+			ProxyAddr:         tc.WebProxyAddr,
+			PubKey:            pub,
+			TTL:               tc.KeyTTL,
+			Insecure:          tc.InsecureSkipVerify,
+			Pool:              loopbackPool(tc.WebProxyAddr),
+			Compatibility:     tc.CertificateFormat,
+			RouteToCluster:    tc.SiteName,
+			KubernetesCluster: tc.KubernetesCluster,
+		},
+		User:     tc.Config.Username,
+		Password: password,
+	})
+
+	return response, trace.Wrap(err)
+}
+
 // SendEvent adds a events.EventFields to the channel.
 func (tc *TeleportClient) SendEvent(ctx context.Context, e events.EventFields) error {
 	// Try and send the event to the eventsCh. If blocking, keep blocking until
@@ -3134,7 +2976,7 @@ func loopbackPool(proxyAddr string) *x509.CertPool {
 	certPool := x509.NewCertPool()
 
 	certPath := filepath.Join(defaults.DataDir, defaults.SelfSignedCertPath)
-	pemByte, err := os.ReadFile(certPath)
+	pemByte, err := ioutil.ReadFile(certPath)
 	if err != nil {
 		log.Debugf("could not open any path in: %v", certPath)
 		return nil
@@ -3192,8 +3034,8 @@ func Username() (string, error) {
 
 // AskOTP prompts the user to enter the OTP token.
 func (tc *TeleportClient) AskOTP() (token string, err error) {
-	fmt.Fprintf(tc.Config.Stderr, "Enter your OTP token:\n")
-	token, err = passwordFromConsoleFn()
+	fmt.Printf("Enter your OTP token:\n")
+	token, err = lineFromConsole()
 	if err != nil {
 		fmt.Fprintln(tc.Stderr, err)
 		return "", trace.Wrap(err)
@@ -3203,7 +3045,7 @@ func (tc *TeleportClient) AskOTP() (token string, err error) {
 
 // AskPassword prompts the user to enter the password
 func (tc *TeleportClient) AskPassword() (pwd string, err error) {
-	fmt.Fprintf(tc.Config.Stderr, "Enter password for Teleport user %v:\n", tc.Config.Username)
+	fmt.Printf("Enter password for Teleport user %v:\n", tc.Config.Username)
 	pwd, err = passwordFromConsoleFn()
 	if err != nil {
 		fmt.Fprintln(tc.Stderr, err)
@@ -3315,13 +3157,19 @@ func passwordFromConsole() (string, error) {
 	return string(bytes), err
 }
 
+// lineFromConsole reads a line from stdin
+func lineFromConsole() (string, error) {
+	bytes, _, err := bufio.NewReader(os.Stdin).ReadLine()
+	return string(bytes), err
+}
+
 // ParseLabelSpec parses a string like 'name=value,"long name"="quoted value"` into a map like
 // { "name" -> "value", "long name" -> "quoted value" }
 func ParseLabelSpec(spec string) (map[string]string, error) {
 	tokens := []string{}
-	openQuotes := false
+	var openQuotes = false
 	var tokenStart, assignCount int
-	specLen := len(spec)
+	var specLen = len(spec)
 	// tokenize the label spec:
 	for i, ch := range spec {
 		endOfToken := false
@@ -3359,44 +3207,6 @@ func ParseLabelSpec(spec string) (map[string]string, error) {
 	return labels, nil
 }
 
-// ParseSearchKeywords parses a string ie: foo,bar,"quoted value"` into a slice of
-// strings: ["foo", "bar", "quoted value"].
-// Almost a replica to ParseLabelSpec, but with few modifications such as
-// allowing a custom delimiter. Defaults to comma delimiter if not defined.
-func ParseSearchKeywords(spec string, customDelimiter rune) []string {
-	delimiter := customDelimiter
-	if customDelimiter == 0 {
-		delimiter = rune(',')
-	}
-
-	tokens := []string{}
-	openQuotes := false
-	var tokenStart int
-	specLen := len(spec)
-	// tokenize the label search:
-	for i, ch := range spec {
-		endOfToken := false
-		if i+utf8.RuneLen(ch) == specLen {
-			i += utf8.RuneLen(ch)
-			endOfToken = true
-		}
-		switch ch {
-		case '"':
-			openQuotes = !openQuotes
-		case delimiter:
-			if !openQuotes {
-				endOfToken = true
-			}
-		}
-		if endOfToken && i > tokenStart {
-			tokens = append(tokens, strings.TrimSpace(strings.Trim(spec[tokenStart:i], `"`)))
-			tokenStart = i + 1
-		}
-	}
-
-	return tokens
-}
-
 // Executes the given command on the client machine (localhost). If no command is given,
 // executes shell
 func runLocalCommand(command []string) error {
@@ -3533,7 +3343,7 @@ func playSession(sessionEvents []events.EventFields, stream []byte) error {
 		}
 	}
 
-	errorCh := make(chan error)
+	var errorCh = make(chan error)
 	player := newSessionPlayer(sessionEvents, stream, term)
 	// keys:
 	const (
diff --git a/lib/client/api_login_test.go b/lib/client/api_login_test.go
index e9201cc5d2b76..065b274eee9bf 100644
--- a/lib/client/api_login_test.go
+++ b/lib/client/api_login_test.go
@@ -43,11 +43,10 @@ import (
 	"github.com/stretchr/testify/require"
 
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
-	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	log "github.com/sirupsen/logrus"
 )
 
-func TestTeleportClient_Login_local(t *testing.T) {
+func TestTeleportClient_Login_localMFALogin(t *testing.T) {
 	// Silence logging during this test.
 	lvl := log.GetLevel()
 	t.Cleanup(func() {
@@ -61,7 +60,6 @@ func TestTeleportClient_Login_local(t *testing.T) {
 	sa := newStandaloneTeleport(t, clock)
 	username := sa.Username
 	password := sa.Password
-	webID := sa.WebAuthnID
 	device := sa.Device
 	otpKey := sa.OTPKey
 
@@ -112,13 +110,6 @@ func TestTeleportClient_Login_local(t *testing.T) {
 			},
 		}, nil
 	}
-	solvePwdless := func(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error) {
-		resp, err := solveWebauthn(ctx, origin, assertion)
-		if err == nil {
-			resp.GetWebauthn().Response.UserHandle = webID
-		}
-		return resp, err
-	}
 
 	ctx := context.Background()
 	tests := []struct {
@@ -126,27 +117,19 @@ func TestTeleportClient_Login_local(t *testing.T) {
 		secondFactor  constants.SecondFactorType
 		solveOTP      func(context.Context) (string, error)
 		solveWebauthn func(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error)
-		pwdless       bool
 	}{
 		{
-			name:          "OTP device login",
+			name:          "OK OTP device login",
 			secondFactor:  constants.SecondFactorOptional,
 			solveOTP:      solveOTP,
 			solveWebauthn: promptWebauthnNoop,
 		},
 		{
-			name:          "WebAuthn device login",
+			name:          "OK Webauthn device login",
 			secondFactor:  constants.SecondFactorOptional,
 			solveOTP:      promptOTPNoop,
 			solveWebauthn: solveWebauthn,
 		},
-		{
-			name:          "passwordless login",
-			secondFactor:  constants.SecondFactorOptional,
-			solveOTP:      promptOTPNoop,
-			solveWebauthn: solvePwdless,
-			pwdless:       true,
-		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -154,12 +137,11 @@ func TestTeleportClient_Login_local(t *testing.T) {
 			defer cancel()
 
 			client.Prompts.Swap(
-				func(ctx context.Context, out io.Writer, in prompt.Reader, question string) (string, error) {
+				func(ctx context.Context, out io.Writer, in *prompt.ContextReader, question string) (string, error) {
 					return test.solveOTP(ctx)
 				},
-				func(ctx context.Context, origin, _ string, assertion *wanlib.CredentialAssertion, _ wancli.LoginPrompt) (*proto.MFAAuthenticateResponse, string, error) {
-					resp, err := test.solveWebauthn(ctx, origin, assertion)
-					return resp, "", err
+				func(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error) {
+					return test.solveWebauthn(ctx, origin, assertion)
 				},
 			)
 
@@ -173,7 +155,6 @@ func TestTeleportClient_Login_local(t *testing.T) {
 
 			tc, err := client.NewClient(cfg)
 			require.NoError(t, err)
-			tc.Passwordless = test.pwdless
 
 			clock.Advance(30 * time.Second)
 			_, err = tc.Login(ctx)
@@ -185,7 +166,6 @@ func TestTeleportClient_Login_local(t *testing.T) {
 type standaloneBundle struct {
 	AuthAddr, ProxyWebAddr string
 	Username, Password     string
-	WebAuthnID             []byte
 	Device                 *mocku2f.Key
 	OTPKey                 string
 	Auth, Proxy            *service.TeleportProcess
@@ -206,7 +186,7 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 
 	user, err := types.NewUser("llama")
 	require.NoError(t, err)
-	role, err := types.NewRoleV3(user.GetName(), types.RoleSpecV5{
+	role, err := types.NewRole(user.GetName(), types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{user.GetName()},
 		},
@@ -264,18 +244,14 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 	require.NoError(t, err)
 	tokenID := token.GetName()
 	res, err := authServer.CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
-		TokenID:     tokenID,
-		DeviceType:  proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
-		DeviceUsage: proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
+		TokenID:    tokenID,
+		DeviceType: proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
 	})
 	require.NoError(t, err)
-	cc := wanlib.CredentialCreationFromProto(res.GetWebauthn())
-	webID := cc.Response.User.ID
 	device, err := mocku2f.Create()
 	require.NoError(t, err)
-	device.SetPasswordless()
 	const origin = "https://localhost"
-	ccr, err := device.SignCredentialCreation(origin, cc)
+	ccr, err := device.SignCredentialCreation(origin, wanlib.CredentialCreationFromProto(res.GetWebauthn()))
 	require.NoError(t, err)
 	_, err = authServer.ChangeUserAuthentication(ctx, &proto.ChangeUserAuthenticationRequest{
 		TokenID:     tokenID,
@@ -320,7 +296,6 @@ func newStandaloneTeleport(t *testing.T, clock clockwork.Clock) *standaloneBundl
 		ProxyWebAddr: proxyWebAddr.String(),
 		Username:     username,
 		Password:     password,
-		WebAuthnID:   webID,
 		Device:       device,
 		OTPKey:       otpKey,
 		Auth:         authProcess,
diff --git a/lib/client/api_test.go b/lib/client/api_test.go
index a8e524e54ae81..dd2fde21226ba 100644
--- a/lib/client/api_test.go
+++ b/lib/client/api_test.go
@@ -34,7 +34,8 @@ func TestMain(m *testing.M) {
 }
 
 // register test suite
-type APITestSuite struct{}
+type APITestSuite struct {
+}
 
 // bootstrap check
 func TestClientAPI(t *testing.T) { check.TestingT(t) }
@@ -276,6 +277,7 @@ func (s *APITestSuite) TestPortsParsing(c *check.C) {
 }
 
 func (s *APITestSuite) TestDynamicPortsParsing(c *check.C) {
+
 	tests := []struct {
 		spec    []string
 		isError bool
@@ -498,61 +500,3 @@ func TestApplyProxySettings(t *testing.T) {
 		})
 	}
 }
-
-func TestParseSearchKeywords(t *testing.T) {
-	t.Parallel()
-
-	expected := [][]string{
-		{},
-		{"foo"},
-		{"foo,bar", "some phrase's", "baz=qux's", "some other  phrase", "another one"},
-		{"服务器环境=测试,操作系统类别", "Linux", "机房=华北"},
-	}
-
-	testCases := []struct {
-		name      string
-		delimiter rune
-		specs     []string
-	}{
-		{
-			name:      "with comma delimiter",
-			delimiter: ',',
-			specs: []string{
-				"",
-				"foo",
-				`"foo,bar","some phrase's",baz=qux's ,"some other  phrase"," another one  "`,
-				`"服务器环境=测试,操作系统类别", Linux , 机房=华北 `,
-			},
-		},
-		{
-			name: "with 0 value delimiter (fallback to comma)",
-			specs: []string{
-				"",
-				"foo",
-				`"foo,bar","some phrase's",baz=qux's ,"some other  phrase"," another one  "`,
-				`"服务器环境=测试,操作系统类别", Linux , 机房=华北 `,
-			},
-		},
-		{
-			name:      "with space delimiter",
-			delimiter: ' ',
-			specs: []string{
-				"",
-				"foo",
-				`foo,bar "some phrase's" baz=qux's "some other  phrase" " another one  "`,
-				`服务器环境=测试,操作系统类别 Linux  机房=华北 `,
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			for i, spec := range tc.specs {
-				m := ParseSearchKeywords(spec, tc.delimiter)
-				require.Equal(t, expected[i], m)
-			}
-		})
-	}
-}
diff --git a/lib/client/client.go b/lib/client/client.go
index 56089e0475d28..3c0a2e59340ef 100644
--- a/lib/client/client.go
+++ b/lib/client/client.go
@@ -24,6 +24,7 @@ import (
 	"encoding/json"
 	"errors"
 	"io"
+	"io/ioutil"
 	"net"
 	"os"
 	"strconv"
@@ -597,8 +598,6 @@ func (proxy *ProxyClient) isAuthBoring(ctx context.Context) (bool, error) {
 //
 // A server is matched when ALL labels match.
 // If no labels are passed, ALL nodes are returned.
-//
-// DELETE IN 11.0.0 replaced by FindNodesByFilters.
 func (proxy *ProxyClient) FindServersByLabels(ctx context.Context, namespace string, labels map[string]string) ([]types.Server, error) {
 	if namespace == "" {
 		return nil, trace.BadParameter(auth.MissingNamespaceError)
@@ -610,66 +609,14 @@ func (proxy *ProxyClient) FindServersByLabels(ctx context.Context, namespace str
 	return auth.GetNodesWithLabels(ctx, site, namespace, labels)
 }
 
-// FindServersByFilters returns list of the nodes which have filters matched.
-func (proxy *ProxyClient) FindNodesByFilters(ctx context.Context, req proto.ListResourcesRequest) ([]types.Server, error) {
-	req.ResourceType = types.KindNode
-
-	site, err := proxy.CurrentClusterAccessPoint(ctx, false)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	resources, err := client.GetResourcesWithFilters(ctx, site, req)
-	if err != nil {
-		// ListResources for nodes not availalbe, provide fallback.
-		// Fallback does not support search/predicate support, so if users
-		// provide them, it does nothing.
-		//
-		// DELETE IN 11.0.0
-		if trace.IsNotImplemented(err) {
-			servers, err := proxy.FindServersByLabels(ctx, req.Namespace, req.Labels)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			return servers, nil
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	servers, err := types.ResourcesWithLabels(resources).AsServers()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return servers, nil
-}
-
-// FindAppServersByFilters returns a list of application servers which have filters matched.
-func (proxy *ProxyClient) FindAppServersByFilters(ctx context.Context, req proto.ListResourcesRequest) ([]types.AppServer, error) {
-	req.ResourceType = types.KindAppServer
+// GetAppServers returns a list of application servers.
+func (proxy *ProxyClient) GetAppServers(ctx context.Context, namespace string) ([]types.AppServer, error) {
 	authClient, err := proxy.CurrentClusterAccessPoint(ctx, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resources, err := client.GetResourcesWithFilters(ctx, authClient, req)
-	if err != nil {
-		// ListResources for app servers not availalbe, provide fallback.
-		// Fallback does not support filters, so if users
-		// provide them, it does nothing.
-		//
-		// DELETE IN 11.0.0
-		if trace.IsNotImplemented(err) {
-			servers, err := authClient.GetApplicationServers(ctx, req.Namespace)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			return servers, nil
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	servers, err := types.ResourcesWithLabels(resources).AsAppServers()
+	servers, err := authClient.GetApplicationServers(ctx, namespace)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -716,32 +663,13 @@ func (proxy *ProxyClient) DeleteAppSession(ctx context.Context, sessionID string
 	return nil
 }
 
-// FindDatabaseServersByFilters returns all registered database proxy servers.
-func (proxy *ProxyClient) FindDatabaseServersByFilters(ctx context.Context, req proto.ListResourcesRequest) ([]types.DatabaseServer, error) {
-	req.ResourceType = types.KindDatabaseServer
+// GetDatabaseServers returns all registered database proxy servers.
+func (proxy *ProxyClient) GetDatabaseServers(ctx context.Context, namespace string) ([]types.DatabaseServer, error) {
 	authClient, err := proxy.CurrentClusterAccessPoint(ctx, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-
-	resources, err := client.GetResourcesWithFilters(ctx, authClient, req)
-	if err != nil {
-		// ListResources for db servers not availalbe, provide fallback.
-		// Fallback does not support filters, so if users
-		// provide them, it does nothing.
-		//
-		// DELETE IN 11.0.0
-		if trace.IsNotImplemented(err) {
-			servers, err := authClient.GetDatabaseServers(ctx, req.Namespace)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			return servers, nil
-		}
-		return nil, trace.Wrap(err)
-	}
-
-	servers, err := types.ResourcesWithLabels(resources).AsDatabaseServers()
+	servers, err := authClient.GetDatabaseServers(ctx, namespace)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1000,7 +928,7 @@ func (proxy *ProxyClient) dialAuthServer(ctx context.Context, clusterName string
 	if err != nil {
 		// read the stderr output from the failed SSH session and append
 		// it to the end of our own message:
-		serverErrorMsg, _ := io.ReadAll(proxyErr)
+		serverErrorMsg, _ := ioutil.ReadAll(proxyErr)
 		return nil, trace.ConnectionProblem(err, "failed connecting to node %v. %s",
 			nodeName(strings.Split(address, "@")[0]), serverErrorMsg)
 	}
@@ -1151,7 +1079,7 @@ func (proxy *ProxyClient) ConnectToNode(ctx context.Context, nodeAddress NodeAdd
 
 		// read the stderr output from the failed SSH session and append
 		// it to the end of our own message:
-		serverErrorMsg, _ := io.ReadAll(proxyErr)
+		serverErrorMsg, _ := ioutil.ReadAll(proxyErr)
 		return nil, trace.ConnectionProblem(err, "failed connecting to node %v. %s",
 			nodeName(nodeAddress.Addr), serverErrorMsg)
 	}
@@ -1322,8 +1250,8 @@ func (c *NodeClient) handleGlobalRequests(ctx context.Context, requestCh <-chan
 func newClientConn(ctx context.Context,
 	conn net.Conn,
 	nodeAddress string,
-	config *ssh.ClientConfig,
-) (ssh.Conn, <-chan ssh.NewChannel, <-chan *ssh.Request, error) {
+	config *ssh.ClientConfig) (ssh.Conn, <-chan ssh.NewChannel, <-chan *ssh.Request, error) {
+
 	type response struct {
 		conn   ssh.Conn
 		chanCh <-chan ssh.NewChannel
diff --git a/lib/client/client_test.go b/lib/client/client_test.go
index 93e9850deb44f..55d25fe673980 100644
--- a/lib/client/client_test.go
+++ b/lib/client/client_test.go
@@ -20,6 +20,7 @@ package client
 import (
 	"context"
 	"io"
+	"io/ioutil"
 	"net"
 	"os"
 	"strings"
@@ -121,7 +122,7 @@ func (s *ClientTestSuite) TestProxyConnection(c *check.C) {
 	c.Assert(err, check.IsNil)
 	clientErrCh := make(chan error, 3)
 	go func(con net.Conn) {
-		_, err := io.Copy(io.Discard, con)
+		_, err := io.Copy(ioutil.Discard, con)
 		if err != nil && strings.Contains(err.Error(), "use of closed network connection") {
 			err = nil
 		}
@@ -155,7 +156,7 @@ func (s *ClientTestSuite) TestProxyConnection(c *check.C) {
 	localCon, err = net.Dial("tcp", localSrv.Addr().String())
 	c.Assert(err, check.IsNil)
 	go func(con net.Conn) {
-		_, err := io.Copy(io.Discard, con)
+		_, err := io.Copy(ioutil.Discard, con)
 		if err != nil && strings.Contains(err.Error(), "use of closed network connection") {
 			err = nil
 		}
diff --git a/lib/client/export.go b/lib/client/export_test.go
similarity index 100%
rename from lib/client/export.go
rename to lib/client/export_test.go
diff --git a/lib/client/https_client_test.go b/lib/client/https_client_test.go
index 66adb430ef035..ea5fac1a89a4d 100644
--- a/lib/client/https_client_test.go
+++ b/lib/client/https_client_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package client
 
 import (
+	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -27,24 +28,21 @@ func TestNewInsecureWebClientHTTPProxy(t *testing.T) {
 	client := NewInsecureWebClient()
 	// resp should be nil, so there will be no body to close.
 	//nolint:bodyclose
-	resp, err := client.Get("https://fakedomain.example.com")
+	resp, err := client.Get("https://example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "lookup fakeproxy.example.com")
 	require.Contains(t, err.Error(), "no such host")
 }
 
 func TestNewInsecureWebClientNoProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
-	t.Setenv("NO_PROXY", "fakedomain.example.com")
+	t.Setenv("NO_PROXY", "example.com")
 	client := NewInsecureWebClient()
-	//nolint:bodyclose
-	resp, err := client.Get("https://fakedomain.example.com")
-	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
-	require.NotContains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "lookup fakedomain.example.com")
-	require.Contains(t, err.Error(), "no such host")
+	resp, err := client.Get("https://example.com")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
 }
 
 func TestNewClientWithPoolHTTPProxy(t *testing.T) {
@@ -52,22 +50,19 @@ func TestNewClientWithPoolHTTPProxy(t *testing.T) {
 	client := newClientWithPool(nil)
 	// resp should be nil, so there will be no body to close.
 	//nolint:bodyclose
-	resp, err := client.Get("https://fakedomain.example.com")
+	resp, err := client.Get("https://example.com")
 	// Client should try to proxy through nonexistent server at localhost.
 	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
 	require.Contains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "lookup fakeproxy.example.com")
 	require.Contains(t, err.Error(), "no such host")
 }
 
 func TestNewClientWithPoolNoProxy(t *testing.T) {
 	t.Setenv("HTTPS_PROXY", "fakeproxy.example.com:9999")
-	t.Setenv("NO_PROXY", "fakedomain.example.com")
+	t.Setenv("NO_PROXY", "example.com")
 	client := newClientWithPool(nil)
-	//nolint:bodyclose
-	resp, err := client.Get("https://fakedomain.example.com")
-	require.Error(t, err, "GET unexpectedly succeeded: %+v", resp)
-	require.NotContains(t, err.Error(), "proxyconnect")
-	require.Contains(t, err.Error(), "lookup fakedomain.example.com")
-	require.Contains(t, err.Error(), "no such host")
+	resp, err := client.Get("https://example.com")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
 }
diff --git a/lib/client/identityfile/identity.go b/lib/client/identityfile/identity.go
index 9cdf7d0aa3bb1..854546bb4f0a6 100644
--- a/lib/client/identityfile/identity.go
+++ b/lib/client/identityfile/identity.go
@@ -20,6 +20,7 @@ package identityfile
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -158,12 +159,12 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 			return nil, trace.Wrap(err)
 		}
 
-		err = os.WriteFile(certPath, cfg.Key.Cert, identityfile.FilePermissions)
+		err = ioutil.WriteFile(certPath, cfg.Key.Cert, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		err = os.WriteFile(keyPath, cfg.Key.Priv, identityfile.FilePermissions)
+		err = ioutil.WriteFile(keyPath, cfg.Key.Priv, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -185,12 +186,12 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 			return nil, trace.Wrap(err)
 		}
 
-		err = os.WriteFile(certPath, cfg.Key.TLSCert, identityfile.FilePermissions)
+		err = ioutil.WriteFile(certPath, cfg.Key.TLSCert, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		err = os.WriteFile(keyPath, cfg.Key.Priv, identityfile.FilePermissions)
+		err = ioutil.WriteFile(keyPath, cfg.Key.Priv, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -200,7 +201,7 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 				caCerts = append(caCerts, cert...)
 			}
 		}
-		err = os.WriteFile(casPath, caCerts, identityfile.FilePermissions)
+		err = ioutil.WriteFile(casPath, caCerts, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -214,7 +215,7 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 		if err := checkOverwrite(cfg.OverwriteDestination, filesWritten...); err != nil {
 			return nil, trace.Wrap(err)
 		}
-		err = os.WriteFile(certPath, append(cfg.Key.TLSCert, cfg.Key.Priv...), identityfile.FilePermissions)
+		err = ioutil.WriteFile(certPath, append(cfg.Key.TLSCert, cfg.Key.Priv...), identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -224,7 +225,7 @@ func Write(cfg WriteConfig) (filesWritten []string, err error) {
 				caCerts = append(caCerts, cert...)
 			}
 		}
-		err = os.WriteFile(casPath, caCerts, identityfile.FilePermissions)
+		err = ioutil.WriteFile(casPath, caCerts, identityfile.FilePermissions)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/client/identityfile/identity_test.go b/lib/client/identityfile/identity_test.go
index 42953743cc47d..50a37e97561e1 100644
--- a/lib/client/identityfile/identity_test.go
+++ b/lib/client/identityfile/identity_test.go
@@ -18,7 +18,7 @@ import (
 	"bytes"
 	"crypto/rsa"
 	"crypto/x509/pkix"
-	"os"
+	"io/ioutil"
 	"path/filepath"
 	"testing"
 
@@ -128,12 +128,12 @@ func TestWrite(t *testing.T) {
 	require.NoError(t, err)
 
 	// key is OK:
-	out, err := os.ReadFile(cfg.OutputPath)
+	out, err := ioutil.ReadFile(cfg.OutputPath)
 	require.NoError(t, err)
 	require.Equal(t, string(out), string(key.Priv))
 
 	// cert is OK:
-	out, err = os.ReadFile(keypaths.IdentitySSHCertPath(cfg.OutputPath))
+	out, err = ioutil.ReadFile(keypaths.IdentitySSHCertPath(cfg.OutputPath))
 	require.NoError(t, err)
 	require.Equal(t, string(out), string(key.Cert))
 
@@ -144,7 +144,7 @@ func TestWrite(t *testing.T) {
 	require.NoError(t, err)
 
 	// key+cert are OK:
-	out, err = os.ReadFile(cfg.OutputPath)
+	out, err = ioutil.ReadFile(cfg.OutputPath)
 	require.NoError(t, err)
 
 	wantArr := [][]byte{
diff --git a/lib/client/keyagent_test.go b/lib/client/keyagent_test.go
index a6df53f40ad22..c2c67e97c82c9 100644
--- a/lib/client/keyagent_test.go
+++ b/lib/client/keyagent_test.go
@@ -19,6 +19,7 @@ package client
 import (
 	"bytes"
 	"io"
+	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -548,7 +549,7 @@ func (s *KeyAgentTestSuite) makeKey(username string, allowedLogins []string, ttl
 func startDebugAgent(t *testing.T) error {
 	// Create own tmp dir instead of using t.TmpDir
 	// because net.Listen("unix", path) has dir path length limitation
-	tempDir, err := os.MkdirTemp("", "teleport-test")
+	tempDir, err := ioutil.TempDir("", "teleport-test")
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		os.RemoveAll(tempDir)
diff --git a/lib/client/keystore.go b/lib/client/keystore.go
index 868bda99381e4..fb1d59051748c 100644
--- a/lib/client/keystore.go
+++ b/lib/client/keystore.go
@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"io"
 	osfs "io/fs"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -49,10 +50,6 @@ const (
 	// keyFilePerms is the default permissions applied to key files (.cert, .key, pub)
 	// under ~/.tsh
 	keyFilePerms os.FileMode = 0600
-
-	// tshConfigFileName is the name of the directory containing the
-	// tsh config file.
-	tshConfigFileName = "config"
 )
 
 // LocalKeyStore interface allows for different storage backends for tsh to
@@ -183,7 +180,7 @@ func (fs *FSLocalKeyStore) writeBytes(bytes []byte, fp string) error {
 		fs.log.Error(err)
 		return trace.ConvertSystemError(err)
 	}
-	err := os.WriteFile(fp, bytes, keyFilePerms)
+	err := ioutil.WriteFile(fp, bytes, keyFilePerms)
 	if err != nil {
 		fs.log.Error(err)
 	}
@@ -226,27 +223,9 @@ func (fs *FSLocalKeyStore) DeleteUserCerts(idx KeyIndex, opts ...CertOption) err
 
 // DeleteKeys removes all session keys.
 func (fs *FSLocalKeyStore) DeleteKeys() error {
-
-	files, err := os.ReadDir(fs.KeyDir)
-	if err != nil {
+	if err := os.RemoveAll(fs.KeyDir); err != nil {
 		return trace.ConvertSystemError(err)
 	}
-	for _, file := range files {
-		if file.IsDir() && file.Name() == tshConfigFileName {
-			continue
-		}
-		if file.IsDir() {
-			err := os.RemoveAll(filepath.Join(fs.KeyDir, file.Name()))
-			if err != nil {
-				return trace.ConvertSystemError(err)
-			}
-			continue
-		}
-		err := os.Remove(filepath.Join(fs.KeyDir, file.Name()))
-		if err != nil {
-			return trace.ConvertSystemError(err)
-		}
-	}
 	return nil
 }
 
@@ -259,22 +238,22 @@ func (fs *FSLocalKeyStore) GetKey(idx KeyIndex, opts ...CertOption) (*Key, error
 		}
 	}
 
-	if _, err := os.ReadDir(fs.KeyDir); err != nil && trace.IsNotFound(err) {
+	if _, err := ioutil.ReadDir(fs.KeyDir); err != nil && trace.IsNotFound(err) {
 		return nil, trace.Wrap(err, "no session keys for %+v", idx)
 	}
 
-	priv, err := os.ReadFile(fs.UserKeyPath(idx))
+	priv, err := ioutil.ReadFile(fs.UserKeyPath(idx))
 	if err != nil {
 		fs.log.Error(err)
 		return nil, trace.ConvertSystemError(err)
 	}
-	pub, err := os.ReadFile(fs.sshCAsPath(idx))
+	pub, err := ioutil.ReadFile(fs.sshCAsPath(idx))
 	if err != nil {
 		fs.log.Error(err)
 		return nil, trace.ConvertSystemError(err)
 	}
 	tlsCertFile := fs.tlsCertPath(idx)
-	tlsCert, err := os.ReadFile(tlsCertFile)
+	tlsCert, err := ioutil.ReadFile(tlsCertFile)
 	if err != nil {
 		fs.log.Error(err)
 		return nil, trace.ConvertSystemError(err)
@@ -330,14 +309,14 @@ func (fs *FSLocalKeyStore) updateKeyWithCerts(o CertOption, key *Key) error {
 
 	if info.IsDir() {
 		certDataMap := map[string][]byte{}
-		certFiles, err := os.ReadDir(certPath)
+		certFiles, err := ioutil.ReadDir(certPath)
 		if err != nil {
 			return trace.ConvertSystemError(err)
 		}
 		for _, certFile := range certFiles {
 			name := keypaths.TrimCertPathSuffix(certFile.Name())
 			if isCert := name != certFile.Name(); isCert {
-				data, err := os.ReadFile(filepath.Join(certPath, certFile.Name()))
+				data, err := ioutil.ReadFile(filepath.Join(certPath, certFile.Name()))
 				if err != nil {
 					return trace.ConvertSystemError(err)
 				}
@@ -347,7 +326,7 @@ func (fs *FSLocalKeyStore) updateKeyWithCerts(o CertOption, key *Key) error {
 		return o.updateKeyWithMap(key, certDataMap)
 	}
 
-	certBytes, err := os.ReadFile(certPath)
+	certBytes, err := ioutil.ReadFile(certPath)
 	if err != nil {
 		return trace.ConvertSystemError(err)
 	}
@@ -637,7 +616,7 @@ func matchesWildcard(hostname, pattern string) bool {
 
 // GetKnownHostKeys returns all known public keys from `known_hosts`.
 func (fs *fsLocalNonSessionKeyStore) GetKnownHostKeys(hostname string) ([]ssh.PublicKey, error) {
-	bytes, err := os.ReadFile(fs.knownHostsPath())
+	bytes, err := ioutil.ReadFile(fs.knownHostsPath())
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, nil
@@ -744,7 +723,7 @@ func (fs *fsLocalNonSessionKeyStore) GetTrustedCertsPEM(proxyHost string) ([][]b
 			return nil
 		}
 
-		data, err := os.ReadFile(path)
+		data, err := ioutil.ReadFile(path)
 		for len(data) > 0 {
 			if err != nil {
 				return trace.Wrap(err)
diff --git a/lib/client/keystore_test.go b/lib/client/keystore_test.go
index 332641614be8d..c6e26402464b5 100644
--- a/lib/client/keystore_test.go
+++ b/lib/client/keystore_test.go
@@ -21,6 +21,7 @@ import (
 	"crypto/rsa"
 	"crypto/x509/pkix"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -401,19 +402,6 @@ func TestAddKey_withoutSSHCert(t *testing.T) {
 	require.Len(t, keyCopy.DBTLSCerts, 1)
 }
 
-func TestConfigDirNotDeleted(t *testing.T) {
-	s, cleanup := newTest(t)
-	t.Cleanup(cleanup)
-	idx := KeyIndex{"host.a", "bob", "root"}
-	s.store.AddKey(s.makeSignedKey(t, idx, false))
-	configPath := filepath.Join(s.storeDir, "config")
-	require.NoError(t, os.Mkdir(configPath, 0700))
-	require.NoError(t, s.store.DeleteKeys())
-	require.DirExists(t, configPath)
-
-	require.NoDirExists(t, filepath.Join(s.storeDir, "keys"))
-}
-
 type keyStoreTest struct {
 	storeDir  string
 	store     *FSLocalKeyStore
@@ -505,7 +493,7 @@ func newSelfSignedCA(privateKey []byte) (*tlsca.CertAuthority, auth.TrustedCerts
 }
 
 func newTest(t *testing.T) (keyStoreTest, func()) {
-	dir, err := os.MkdirTemp("", "teleport-keystore")
+	dir, err := ioutil.TempDir("", "teleport-keystore")
 	require.NoError(t, err)
 
 	store, err := NewFSLocalKeyStore(dir)
diff --git a/lib/client/mfa.go b/lib/client/mfa.go
index 42d2ac5d957fe..4f8e999c7965a 100644
--- a/lib/client/mfa.go
+++ b/lib/client/mfa.go
@@ -18,7 +18,6 @@ package client
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -34,12 +33,8 @@ import (
 )
 
 type (
-	OTPPrompt func(ctx context.Context, out io.Writer, in prompt.Reader, question string) (string, error)
-	WebPrompt func(
-		ctx context.Context,
-		origin, user string,
-		assertion *wanlib.CredentialAssertion,
-		prompt wancli.LoginPrompt) (*proto.MFAAuthenticateResponse, string, error)
+	OTPPrompt func(ctx context.Context, out io.Writer, in *prompt.ContextReader, question string) (string, error)
+	WebPrompt func(ctx context.Context, origin string, assertion *wanlib.CredentialAssertion) (*proto.MFAAuthenticateResponse, error)
 )
 
 // PlatformPrompt groups functions that prompt the user for inputs.
@@ -64,29 +59,13 @@ func (pp *PlatformPrompt) Swap(otp OTPPrompt, web WebPrompt) {
 
 var prompts = (&PlatformPrompt{}).Reset()
 
-type noopPrompt struct{}
-
-func (p noopPrompt) PromptPIN() (string, error) {
-	// TODO(codingllama): Revisit? There may be authenticators out there that disagree.
-	// The main issue with PIN prompts in MFA is that prompts.OTP hijacks Stdin,
-	// so we'd have to make that into a password read and redirect it into either
-	// an OTP (not sensitive) or a PIN (sensitive).
-	return "", errors.New("PIN not supported for MFA")
-}
-
-func (p noopPrompt) PromptAdditionalTouch() error {
-	return errors.New("additional touches not supported for MFA")
-}
-
 // PromptMFAChallenge prompts the user to complete MFA authentication
 // challenges.
 //
 // If promptDevicePrefix is set, it will be printed in prompts before "security
 // key" or "device". This is used to emphasize between different kinds of
 // devices, like registered vs new.
-func PromptMFAChallenge(
-	ctx context.Context,
-	proxyAddr string, c *proto.MFAAuthenticateChallenge, promptDevicePrefix string, quiet bool) (*proto.MFAAuthenticateResponse, error) {
+func PromptMFAChallenge(ctx context.Context, proxyAddr string, c *proto.MFAAuthenticateChallenge, promptDevicePrefix string, quiet bool) (*proto.MFAAuthenticateResponse, error) {
 	// Is there a challenge present?
 	if c.TOTP == nil && c.WebauthnChallenge == nil {
 		return &proto.MFAAuthenticateResponse{}, nil
@@ -169,9 +148,7 @@ func PromptMFAChallenge(
 		go func() {
 			defer wg.Done()
 			log.Debugf("WebAuthn: prompting devices with origin %q", origin)
-			const user = ""       // No ambiguity in MFA prompts.
-			var prompt noopPrompt // No PINs or additional touches required for MFA.
-			resp, _, err := prompts.Webauthn(ctx, origin, user, wanlib.CredentialAssertionFromProto(c.WebauthnChallenge), prompt)
+			resp, err := prompts.Webauthn(ctx, origin, wanlib.CredentialAssertionFromProto(c.WebauthnChallenge))
 			respC <- response{kind: "WEBAUTHN", resp: resp, err: err}
 		}()
 	}
diff --git a/lib/client/weblogin.go b/lib/client/weblogin.go
index 6148704369663..fa432f142fe6a 100644
--- a/lib/client/weblogin.go
+++ b/lib/client/weblogin.go
@@ -23,7 +23,6 @@ import (
 	"fmt"
 	"net"
 	"net/url"
-	"os"
 	"os/exec"
 	"runtime"
 	"time"
@@ -87,8 +86,6 @@ type SSOLoginConsoleResponse struct {
 type MFAChallengeRequest struct {
 	User string `json:"user"`
 	Pass string `json:"pass"`
-	// Passwordless explicitly requests a passwordless/usernameless challenge.
-	Passwordless bool `json:"passwordless"`
 }
 
 // CreateSSHCertReq are passed by web client
@@ -237,7 +234,7 @@ func initClient(proxyAddr string, insecure bool, pool *x509.CertPool) (*WebClien
 
 	if insecure {
 		// Skip https cert verification, print a warning that this is insecure.
-		fmt.Fprintf(os.Stderr, "WARNING: You are using insecure connection to SSH proxy %v\n", proxyAddr)
+		fmt.Printf("WARNING: You are using insecure connection to SSH proxy %v\n", proxyAddr)
 		opts = append(opts, roundtrip.HTTPClient(NewInsecureWebClient()))
 	} else if pool != nil {
 		// use custom set of trusted CAs
@@ -292,17 +289,17 @@ func SSHAgentSSOLogin(ctx context.Context, login SSHLoginSSO) (*auth.SSHLoginRes
 	}
 	if execCmd != nil {
 		if err := execCmd.Start(); err != nil {
-			fmt.Fprintf(os.Stderr, "Failed to open a browser window for login: %v\n", err)
+			fmt.Printf("Failed to open a browser window for login: %v\n", err)
 		}
 	}
 
 	// Print the URL to the screen, in case the command that launches the browser did not run.
 	// If Browser is set to the special string teleport.BrowserNone, no browser will be opened.
 	if login.Browser == teleport.BrowserNone {
-		fmt.Fprintf(os.Stderr, "Use the following URL to authenticate:\n %v\n", clickableURL)
+		fmt.Printf("Use the following URL to authenticate:\n %v\n", clickableURL)
 	} else {
-		fmt.Fprintf(os.Stderr, "If browser window does not open automatically, open it by ")
-		fmt.Fprintf(os.Stderr, "clicking on the link:\n %v\n", clickableURL)
+		fmt.Printf("If browser window does not open automatically, open it by ")
+		fmt.Printf("clicking on the link:\n %v\n", clickableURL)
 	}
 
 	select {
@@ -434,5 +431,12 @@ func HostCredentials(ctx context.Context, proxyAddr string, insecure bool, req t
 		return nil, trace.Wrap(err)
 	}
 
-	return &certs, nil
+	// If we got certs, we're done, however, we may be talking to a Teleport 9 or earlier server,
+	// which still sends back the legacy JSON format.
+	if len(certs.SSH) > 0 && len(certs.TLS) > 0 {
+		return &certs, nil
+	}
+
+	// DELETE IN 10.0.0 (zmb3)
+	return auth.UnmarshalLegacyCerts(resp.Bytes())
 }
diff --git a/lib/client/weblogin_test.go b/lib/client/weblogin_test.go
index 571e1014907ff..ed50896d937d6 100644
--- a/lib/client/weblogin_test.go
+++ b/lib/client/weblogin_test.go
@@ -24,8 +24,8 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth"
 
 	"github.com/stretchr/testify/require"
 )
@@ -47,7 +47,7 @@ func TestPlainHttpFallback(t *testing.T) {
 				}
 				w.Header().Set("Content-Type", "application/json")
 				w.WriteHeader(http.StatusOK)
-				json.NewEncoder(w).Encode(proto.Certs{})
+				json.NewEncoder(w).Encode(auth.LegacyCerts{})
 			},
 			actionUnderTest: func(ctx context.Context, addr string, insecure bool) error {
 				_, err := HostCredentials(ctx, addr, insecure, types.RegisterUsingTokenRequest{})
diff --git a/lib/config/configuration.go b/lib/config/configuration.go
index e1ef67529bae7..28ca24f86ce90 100644
--- a/lib/config/configuration.go
+++ b/lib/config/configuration.go
@@ -24,6 +24,7 @@ import (
 	"bufio"
 	"crypto/x509"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -33,8 +34,6 @@ import (
 	"time"
 	"unicode"
 
-	stdlog "log"
-
 	"golang.org/x/crypto/ssh"
 
 	"github.com/go-ldap/ldap/v3"
@@ -290,10 +289,18 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error {
 	}
 
 	// apply logger settings
-	err = applyLogConfig(fc.Logger, cfg)
+	logger := utils.NewLogger()
+	err = applyLogConfig(fc.Logger, logger)
 	if err != nil {
 		return trace.Wrap(err)
 	}
+	cfg.Log = logger
+
+	// Apply logging configuration for the global logger instance
+	// DELETE this when global logger instance is no longer in use.
+	//
+	// Logging configuration has already been validated above
+	_ = applyLogConfig(fc.Logger, log.StandardLogger())
 
 	if fc.CachePolicy.TTL != "" {
 		log.Warnf("cache.ttl config option is deprecated and will be ignored, caches no longer attempt to anticipate resource expiration.")
@@ -420,18 +427,14 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error {
 	return nil
 }
 
-func applyLogConfig(loggerConfig Log, cfg *service.Config) error {
-	logger := log.StandardLogger()
-
+func applyLogConfig(loggerConfig Log, logger *log.Logger) error {
 	switch loggerConfig.Output {
 	case "":
 		break // not set
 	case "stderr", "error", "2":
 		logger.SetOutput(os.Stderr)
-		cfg.Console = io.Discard // disable console printing
 	case "stdout", "out", "1":
 		logger.SetOutput(os.Stdout)
-		cfg.Console = io.Discard // disable console printing
 	case teleport.Syslog:
 		err := utils.SwitchLoggerToSyslog(logger)
 		if err != nil {
@@ -484,13 +487,10 @@ func applyLogConfig(loggerConfig Log, cfg *service.Config) error {
 		}
 
 		logger.SetFormatter(formatter)
-		stdlog.SetOutput(io.Discard) // disable the standard logger used by external dependencies
-		stdlog.SetFlags(0)
 	default:
 		return trace.BadParameter("unsupported log output format : %q", loggerConfig.Format.Output)
 	}
 
-	cfg.Log = logger
 	return nil
 }
 
@@ -547,9 +547,6 @@ func applyAuthConfig(fc *FileConfig, cfg *service.Config) error {
 		if err != nil {
 			return trace.Wrap(err)
 		}
-	}
-
-	if fc.Auth.MessageOfTheDay != "" {
 		cfg.Auth.Preference.SetMessageOfTheDay(fc.Auth.MessageOfTheDay)
 	}
 
@@ -1277,6 +1274,15 @@ func applyMetricsConfig(fc *FileConfig, cfg *service.Config) error {
 func applyWindowsDesktopConfig(fc *FileConfig, cfg *service.Config) error {
 	cfg.WindowsDesktop.Enabled = true
 
+	// Support for reading an LDAP password from a file was dropped for Teleport 9.
+	// Check if this old option is still set and issue a clear error for one major version.
+	// DELETE IN 10.0 (zmb3)
+	if len(fc.WindowsDesktop.LDAP.PasswordFile) > 0 {
+		return trace.BadParameter("Support for password_file was deprecated in Teleport 9 " +
+			"in favor of certificate-based authentication. Remove the password_file field from " +
+			"teleport.yaml to fix this error.")
+	}
+
 	if fc.WindowsDesktop.ListenAddress != "" {
 		listenAddr, err := utils.ParseHostPortAddr(fc.WindowsDesktop.ListenAddress, int(defaults.WindowsDesktopListenPort))
 		if err != nil {
@@ -1743,7 +1749,7 @@ func Configure(clf *CommandLineFlags, cfg *service.Config) error {
 
 	// apply --debug flag to config:
 	if clf.Debug {
-		cfg.Console = io.Discard
+		cfg.Console = ioutil.Discard
 		cfg.Debug = clf.Debug
 	}
 
diff --git a/lib/config/configuration_test.go b/lib/config/configuration_test.go
index 71d8ed81f4c72..45ac88b006ad3 100644
--- a/lib/config/configuration_test.go
+++ b/lib/config/configuration_test.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"encoding/base64"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"os"
 	"path"
@@ -64,7 +65,7 @@ var testConfigs testConfigFiles
 func writeTestConfigs() error {
 	var err error
 
-	testConfigs.tempDir, err = os.MkdirTemp("", "teleport-config")
+	testConfigs.tempDir, err = ioutil.TempDir("", "teleport-config")
 	if err != nil {
 		return err
 	}
@@ -668,7 +669,7 @@ func TestApplyConfig(t *testing.T) {
 
 	require.Equal(t, "tcp://127.0.0.1:3000", cfg.DiagnosticAddr.FullAddress())
 
-	u2fCAFromFile, err := os.ReadFile("testdata/u2f_attestation_ca.pem")
+	u2fCAFromFile, err := ioutil.ReadFile("testdata/u2f_attestation_ca.pem")
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(cfg.Auth.Preference, &types.AuthPreferenceV2{
 		Kind:    types.KindClusterAuthPreference,
@@ -1571,6 +1572,13 @@ func TestWindowsDesktopService(t *testing.T) {
 				}
 			},
 		},
+		{
+			desc:        "NOK - uses deprecated password_file field",
+			expectError: require.Error,
+			mutate: func(fc *FileConfig) {
+				fc.WindowsDesktop.LDAP.PasswordFile = "/path/to/some/file"
+			},
+		},
 	} {
 		t.Run(test.desc, func(t *testing.T) {
 			fc := &FileConfig{}
diff --git a/lib/config/fileconf.go b/lib/config/fileconf.go
index e087351fb0c1a..21f388a161e3d 100644
--- a/lib/config/fileconf.go
+++ b/lib/config/fileconf.go
@@ -22,6 +22,7 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -110,7 +111,7 @@ func ReadFromString(configString string) (*FileConfig, error) {
 // ReadConfig reads Teleport configuration from reader in YAML format
 func ReadConfig(reader io.Reader) (*FileConfig, error) {
 	// read & parse YAML config:
-	bytes, err := io.ReadAll(reader)
+	bytes, err := ioutil.ReadAll(reader)
 	if err != nil {
 		return nil, trace.Wrap(err, "failed reading Teleport configuration")
 	}
@@ -793,7 +794,7 @@ func getAttestationPEM(certOrPath string) (string, error) {
 	}
 
 	// Try reading as a file and parsing that.
-	data, err := os.ReadFile(certOrPath)
+	data, err := ioutil.ReadFile(certOrPath)
 	if err != nil {
 		// Don't use trace in order to keep a clean error message.
 		return "", fmt.Errorf("%q is not a valid x509 certificate (%v) and can't be read as a file (%v)", certOrPath, parseErr, err)
@@ -1477,4 +1478,12 @@ type LDAPConfig struct {
 	InsecureSkipVerify bool `yaml:"insecure_skip_verify"`
 	// DEREncodedCAFile is the filepath to an optional DER encoded CA cert to be used for verification (if InsecureSkipVerify is set to false).
 	DEREncodedCAFile string `yaml:"der_ca_file,omitempty"`
+
+	// PasswordFile was used in Teleport 8 before we supported client certificates
+	// for LDAP authentication. Support for LDAP passwords was removed for Teleport 9
+	// and this field remains only to issue a warning to users who are upgrading to
+	// Teleport 9.
+	//
+	// TODO(zmb3) DELETE IN 10.0
+	PasswordFile string `yaml:"password_file"`
 }
diff --git a/lib/datalog/access_test.go b/lib/datalog/access_test.go
index 12f89bee44755..5b0a0c584ae54 100644
--- a/lib/datalog/access_test.go
+++ b/lib/datalog/access_test.go
@@ -93,7 +93,7 @@ func createUser(name string, roles []string, traits map[string][]string) (types.
 }
 
 func createRole(name string, allowLogins []string, denyLogins []string, allowLabels types.Labels, denyLabels types.Labels) (types.Role, error) {
-	role, err := types.NewRoleV3(name, types.RoleSpecV5{
+	role, err := types.NewRole(name, types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins:     allowLogins,
 			NodeLabels: allowLabels,
diff --git a/lib/defaults/defaults.go b/lib/defaults/defaults.go
index 88539fa023c4e..d65999522c772 100644
--- a/lib/defaults/defaults.go
+++ b/lib/defaults/defaults.go
@@ -468,17 +468,6 @@ const (
 	LimiterMaxConcurrentSignatures = 10
 )
 
-// Default rate limits for unauthenticated passwordless endpoints.
-const (
-	// LimiterPasswordlessPeriod is the default period for passwordless limiters.
-	LimiterPasswordlessPeriod = 1 * time.Minute
-	// LimiterPasswordlessAverage is the default average for passwordless
-	// limiters.
-	LimiterPasswordlessAverage = 10
-	// LimiterPasswordlessBurst is the default burst for passwordless limiters.
-	LimiterPasswordlessBurst = 20
-)
-
 const (
 	// HostCertCacheSize is the number of host certificates to cache at any moment.
 	HostCertCacheSize = 4000
diff --git a/lib/events/api.go b/lib/events/api.go
index 8a5cf8e9f61a5..e4f7b7ad503f1 100644
--- a/lib/events/api.go
+++ b/lib/events/api.go
@@ -502,9 +502,6 @@ const (
 	// DesktopClipboardSendEvent is emitted when local clipboard data
 	// is sent to Teleport.
 	DesktopClipboardSendEvent = "desktop.clipboard.send"
-
-	// UnknownEvent is any event received that isn't recognized as any other event type.
-	UnknownEvent = apievents.UnknownEvent
 )
 
 const (
diff --git a/lib/events/auditlog_test.go b/lib/events/auditlog_test.go
index 5fcd30417e377..c337baffefdcb 100644
--- a/lib/events/auditlog_test.go
+++ b/lib/events/auditlog_test.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -330,7 +331,7 @@ func (a *AuditTestSuite) TestBasicLogging(c *check.C) {
 	c.Assert(alog.Close(), check.IsNil)
 
 	// read back what's been written:
-	bytes, err := os.ReadFile(logfile)
+	bytes, err := ioutil.ReadFile(logfile)
 	c.Assert(err, check.IsNil)
 	c.Assert(string(bytes), check.Equals,
 		fmt.Sprintf("{\"apples?\":\"yes\",\"event\":\"user.joined\",\"time\":\"%s\",\"uid\":\"%s\"}\n",
@@ -370,7 +371,7 @@ func (a *AuditTestSuite) TestLogRotation(c *check.C) {
 		c.Assert(dt, check.Equals, time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location()))
 
 		// read back what's been written:
-		bytes, err := os.ReadFile(logfile)
+		bytes, err := ioutil.ReadFile(logfile)
 		c.Assert(err, check.IsNil)
 		contents, err := json.Marshal(event)
 		contents = append(contents, '\n')
@@ -378,7 +379,7 @@ func (a *AuditTestSuite) TestLogRotation(c *check.C) {
 		c.Assert(string(bytes), check.Equals, string(contents))
 
 		// read back the contents using symlink
-		bytes, err = os.ReadFile(filepath.Join(alog.localLog.SymlinkDir, SymlinkFilename))
+		bytes, err = ioutil.ReadFile(filepath.Join(alog.localLog.SymlinkDir, SymlinkFilename))
 		c.Assert(err, check.IsNil)
 		c.Assert(string(bytes), check.Equals, string(contents))
 
@@ -431,7 +432,7 @@ func (a *AuditTestSuite) TestLegacyHandler(c *check.C) {
 	// Download the session in the old format
 	ctx := context.TODO()
 
-	tarball, err := os.CreateTemp("", "teleport-legacy")
+	tarball, err := ioutil.TempFile("", "teleport-legacy")
 	c.Assert(err, check.IsNil)
 	defer os.RemoveAll(tarball.Name())
 
diff --git a/lib/events/codes.go b/lib/events/codes.go
index 9d0032d94c5b2..7c03d71d9a8da 100644
--- a/lib/events/codes.go
+++ b/lib/events/codes.go
@@ -16,8 +16,6 @@ limitations under the License.
 
 package events
 
-import apievents "github.com/gravitational/teleport/api/types/events"
-
 // Event describes an audit log event.
 type Event struct {
 	// Name is the event name.
@@ -502,7 +500,4 @@ const (
 	// RenewableCertificateGenerationMismatchCode is the renewable cert
 	// generation mismatch code.
 	RenewableCertificateGenerationMismatchCode = "TCB00W"
-
-	// UnknownCode is used when an event of unknown type is encountered.
-	UnknownCode = apievents.UnknownCode
 )
diff --git a/lib/events/complete.go b/lib/events/complete.go
index c7594c61521c3..3b8a2b050f9d1 100644
--- a/lib/events/complete.go
+++ b/lib/events/complete.go
@@ -18,11 +18,12 @@ package events
 
 import (
 	"context"
-	"fmt"
 	"time"
 
 	"github.com/gravitational/teleport"
+	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types/events"
+	apievents "github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
@@ -136,43 +137,28 @@ func (u *UploadCompleter) CheckUploads(ctx context.Context) error {
 		if err != nil {
 			return trace.Wrap(err)
 		}
-
-		u.log.Debugf("Upload %v grace period is over. Trying to complete.", upload.ID)
+		if len(parts) == 0 {
+			continue
+		}
+		u.log.Debugf("Upload %v grace period is over. Trying to complete.", upload)
 		if err := u.cfg.Uploader.CompleteUpload(ctx, upload, parts); err != nil {
 			return trace.Wrap(err)
 		}
 		u.log.Debugf("Completed upload %v.", upload)
 		completed++
-
-		if len(parts) == 0 {
-			continue
-		}
-
 		uploadData := u.cfg.Uploader.GetUploadMetadata(upload.SessionID)
-
-		// Schedule a background operation to check for (and emit) a session end event.
-		// This is necessary because we'll need to download the session in order to
-		// enumerate its events, and the S3 API takes a little while after the upload
-		// is completed before version metadata becomes available.
-		go func() {
-			select {
-			case <-ctx.Done():
-				return
-			case <-u.cfg.Clock.After(2 * time.Minute):
-				u.log.Debugf("checking for session end event for session %v", upload.SessionID)
-				if err := u.ensureSessionEndEvent(ctx, uploadData); err != nil {
-					u.log.WithError(err).Warningf("failed to ensure session end event")
-				}
-			}
-		}()
+		err = u.ensureSessionEndEvent(ctx, uploadData)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 		session := &events.SessionUpload{
-			Metadata: events.Metadata{
+			Metadata: apievents.Metadata{
 				Type:  SessionUploadEvent,
 				Code:  SessionUploadCode,
 				ID:    uuid.New().String(),
 				Index: SessionUploadIndex,
 			},
-			SessionMetadata: events.SessionMetadata{
+			SessionMetadata: apievents.SessionMetadata{
 				SessionID: string(uploadData.SessionID),
 			},
 			SessionURL: uploadData.URL,
@@ -195,104 +181,91 @@ func (u *UploadCompleter) Close() error {
 }
 
 func (u *UploadCompleter) ensureSessionEndEvent(ctx context.Context, uploadData UploadMetadata) error {
-	// at this point, we don't know whether we'll need to emit a session.end or a
-	// windows.desktop.session.end, but as soon as we see the session start we'll
-	// be able to start filling in the details
-	var sshSessionEnd events.SessionEnd
-	var desktopSessionEnd events.WindowsDesktopSessionEnd
-
-	first := true
-
-	// We use the streaming events API to search through the session events, because it works
-	// for both Desktop and SSH sessions, where as the GetSessionEvents API relies on downloading
-	// a copy of the session and using the SSH-specific index to iterate through events.
-	var lastEvent events.AuditEvent
-	evts, errors := u.cfg.AuditLog.StreamSessionEvents(ctx, uploadData.SessionID, 0)
-
-loop:
-	for {
-		select {
-		case evt, more := <-evts:
-			if !more {
-				break loop
-			}
+	var serverID, clusterName, user, login, hostname, namespace, serverAddr string
+	var interactive bool
 
-			if first {
-				u.log.Infof("got first event %T", evt)
-				first = false
-			}
-
-			lastEvent = evt
-
-			switch e := evt.(type) {
-			// Return if session end event already exists
-			case *events.SessionEnd, *events.WindowsDesktopSessionEnd:
-				return nil
-
-			case *events.WindowsDesktopSessionStart:
-				desktopSessionEnd.Type = WindowsDesktopSessionEndEvent
-				desktopSessionEnd.Code = DesktopSessionEndCode
-				desktopSessionEnd.ClusterName = e.ClusterName
-				desktopSessionEnd.StartTime = e.Time
-				desktopSessionEnd.Participants = append(desktopSessionEnd.Participants, e.User)
-				desktopSessionEnd.Recorded = true
-				desktopSessionEnd.UserMetadata = e.UserMetadata
-				desktopSessionEnd.SessionMetadata = e.SessionMetadata
-				desktopSessionEnd.WindowsDesktopService = e.WindowsDesktopService
-				desktopSessionEnd.Domain = e.Domain
-				desktopSessionEnd.DesktopAddr = e.DesktopAddr
-				desktopSessionEnd.DesktopLabels = e.DesktopLabels
-				desktopSessionEnd.DesktopName = fmt.Sprintf("%v (recovered)", e.DesktopName)
-
-			case *events.SessionStart:
-				sshSessionEnd.Type = SessionEndEvent
-				sshSessionEnd.Code = SessionEndCode
-				sshSessionEnd.ClusterName = e.ClusterName
-				sshSessionEnd.StartTime = e.Time
-				sshSessionEnd.UserMetadata = e.UserMetadata
-				sshSessionEnd.SessionMetadata = e.SessionMetadata
-				sshSessionEnd.ServerMetadata = e.ServerMetadata
-				sshSessionEnd.ConnectionMetadata = e.ConnectionMetadata
-				sshSessionEnd.KubernetesClusterMetadata = e.KubernetesClusterMetadata
-				sshSessionEnd.KubernetesPodMetadata = e.KubernetesPodMetadata
-				sshSessionEnd.InitialCommand = e.InitialCommand
-				sshSessionEnd.SessionRecording = e.SessionRecording
-				sshSessionEnd.Interactive = e.TerminalSize != ""
-				sshSessionEnd.Participants = append(sshSessionEnd.Participants, e.User)
-
-			case *events.SessionJoin:
-				sshSessionEnd.Participants = append(sshSessionEnd.Participants, e.User)
-			}
+	// Get session events to find fields for constructed session end
+	sessionEvents, err := u.cfg.AuditLog.GetSessionEvents(apidefaults.Namespace, uploadData.SessionID, 0, false)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if len(sessionEvents) == 0 {
+		return nil
+	}
 
-		case err := <-errors:
-			return trace.Wrap(err)
-		case <-ctx.Done():
-			return ctx.Err()
+	// Return if session.end event already exists
+	for _, event := range sessionEvents {
+		if event.GetType() == SessionEndEvent {
+			return nil
 		}
 	}
 
-	sshSessionEnd.Participants = apiutils.Deduplicate(sshSessionEnd.Participants)
-	sshSessionEnd.EndTime = lastEvent.GetTime()
-	desktopSessionEnd.EndTime = lastEvent.GetTime()
+	// Session start event is the first of session events
+	sessionStart := sessionEvents[0]
+	if sessionStart.GetType() != SessionStartEvent {
+		return trace.BadParameter("invalid session, session start is not the first event")
+	}
 
-	var sessionEndEvent events.AuditEvent
-	switch {
-	case sshSessionEnd.Code != "":
-		sessionEndEvent = &sshSessionEnd
-	case desktopSessionEnd.Code != "":
-		sessionEndEvent = &desktopSessionEnd
-	default:
-		return trace.BadParameter("invalid session, could not find session start")
+	// Set variables
+	serverID = sessionStart.GetString(SessionServerHostname)
+	clusterName = sessionStart.GetString(SessionClusterName)
+	hostname = sessionStart.GetString(SessionServerHostname)
+	namespace = sessionStart.GetString(EventNamespace)
+	serverAddr = sessionStart.GetString(SessionServerAddr)
+	user = sessionStart.GetString(EventUser)
+	login = sessionStart.GetString(EventLogin)
+	if terminalSize := sessionStart.GetString(TerminalSize); terminalSize != "" {
+		interactive = true
 	}
 
-	u.log.Infof("emitting %T event for completed session %v", sessionEndEvent, uploadData.SessionID)
+	// Get last event to get session end time
+	lastEvent := sessionEvents[len(sessionEvents)-1]
+
+	participants := getParticipants(sessionEvents)
+
+	sessionEndEvent := &events.SessionEnd{
+		Metadata: events.Metadata{
+			Type:        SessionEndEvent,
+			Code:        SessionEndCode,
+			ClusterName: clusterName,
+		},
+		ServerMetadata: events.ServerMetadata{
+			ServerID:        serverID,
+			ServerNamespace: namespace,
+			ServerHostname:  hostname,
+			ServerAddr:      serverAddr,
+		},
+		SessionMetadata: events.SessionMetadata{
+			SessionID: string(uploadData.SessionID),
+		},
+		UserMetadata: events.UserMetadata{
+			User:  user,
+			Login: login,
+		},
+		Participants: participants,
+		Interactive:  interactive,
+		StartTime:    sessionStart.GetTime(EventTime),
+		EndTime:      lastEvent.GetTime(EventTime),
+	}
 
 	// Check and set event fields
-	if err := checkAndSetEventFields(sessionEndEvent, u.cfg.Clock, utils.NewRealUID(), sessionEndEvent.GetClusterName()); err != nil {
+	if err = checkAndSetEventFields(sessionEndEvent, u.cfg.Clock, utils.NewRealUID(), clusterName); err != nil {
 		return trace.Wrap(err)
 	}
-	if err := u.cfg.AuditLog.EmitAuditEvent(ctx, sessionEndEvent); err != nil {
+	if err = u.cfg.AuditLog.EmitAuditEvent(ctx, sessionEndEvent); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
 }
+
+func getParticipants(sessionEvents []EventFields) []string {
+	var participants []string
+	for _, event := range sessionEvents {
+		if event.GetType() == SessionJoinEvent || event.GetType() == SessionStartEvent {
+			participant := event.GetString(EventUser)
+			participants = append(participants, participant)
+
+		}
+	}
+	return apiutils.Deduplicate(participants)
+}
diff --git a/lib/events/complete_test.go b/lib/events/complete_test.go
deleted file mode 100644
index 7e79aa2c8fce7..0000000000000
--- a/lib/events/complete_test.go
+++ /dev/null
@@ -1,145 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package events
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	apievents "github.com/gravitational/teleport/api/types/events"
-	"github.com/gravitational/teleport/lib/session"
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
-)
-
-// TestUploadCompleterEmitsSessionEnd verifies that the upload completer
-// emits session.end or windows.desktop.session.end events for sessions
-// that are completed.
-func TestUploadCompleterEmitsSessionEnd(t *testing.T) {
-	for _, test := range []struct {
-		startEvent   apievents.AuditEvent
-		endEventType string
-	}{
-		{&apievents.SessionStart{}, SessionEndEvent},
-		{&apievents.WindowsDesktopSessionStart{}, WindowsDesktopSessionEndEvent},
-	} {
-		t.Run(test.endEventType, func(t *testing.T) {
-			clock := clockwork.NewFakeClock()
-			mu := NewMemoryUploader()
-			mu.Clock = clock
-
-			log := &MockAuditLog{
-				sessionEvents: []apievents.AuditEvent{test.startEvent},
-			}
-
-			uc, err := NewUploadCompleter(UploadCompleterConfig{
-				Unstarted:   true,
-				Uploader:    mu,
-				AuditLog:    log,
-				GracePeriod: 2 * time.Hour,
-				Clock:       clock,
-			})
-			require.NoError(t, err)
-
-			upload, err := mu.CreateUpload(context.Background(), session.NewID())
-			require.NoError(t, err)
-
-			// advance the clock to force the grace period check to succeed
-			clock.Advance(3 * time.Hour)
-
-			// session end events are only emitted if there's at least one
-			// part to be uploaded, so create that here
-			_, err = mu.UploadPart(context.Background(), *upload, 0, strings.NewReader("part"))
-			require.NoError(t, err)
-
-			err = uc.CheckUploads(context.Background())
-			require.NoError(t, err)
-
-			// advance the clock to force the asynchronous session end event emission
-			clock.BlockUntil(1)
-			clock.Advance(3 * time.Minute)
-
-			// expect two events - a session end and a session upload
-			// the session end is done asynchronously, so wait for that
-			require.Eventually(t, func() bool { return len(log.emitter.Events()) == 2 }, 5*time.Second, 1*time.Second,
-				"should have emitted 2 events, but only got %d", len(log.emitter.Events()))
-
-			require.IsType(t, &apievents.SessionUpload{}, log.emitter.Events()[0])
-			require.Equal(t, test.endEventType, log.emitter.Events()[1].GetType())
-		})
-	}
-}
-
-// TestUploadCompleterCompletesEmptyUploads verifies that the upload completer
-// completes uploads that have no parts. This ensures that we don't leave empty
-// directories behind.
-func TestUploadCompleterCompletesEmptyUploads(t *testing.T) {
-	clock := clockwork.NewFakeClock()
-	mu := NewMemoryUploader()
-	mu.Clock = clock
-
-	log := &MockAuditLog{}
-
-	uc, err := NewUploadCompleter(UploadCompleterConfig{
-		Unstarted:   true,
-		Uploader:    mu,
-		AuditLog:    log,
-		GracePeriod: 2 * time.Hour,
-	})
-	require.NoError(t, err)
-
-	upload, err := mu.CreateUpload(context.Background(), session.NewID())
-	require.NoError(t, err)
-	clock.Advance(3 * time.Hour)
-
-	err = uc.CheckUploads(context.Background())
-	require.NoError(t, err)
-
-	require.True(t, mu.uploads[upload.ID].completed)
-}
-
-type MockAuditLog struct {
-	DiscardAuditLog
-
-	emitter       MockEmitter
-	sessionEvents []apievents.AuditEvent
-}
-
-func (m *MockAuditLog) StreamSessionEvents(ctx context.Context, sid session.ID, startIndex int64) (chan apievents.AuditEvent, chan error) {
-	errors := make(chan error, 1)
-	events := make(chan apievents.AuditEvent)
-
-	go func() {
-		defer close(events)
-
-		for _, event := range m.sessionEvents {
-			select {
-			case <-ctx.Done():
-				return
-			case events <- event:
-			}
-		}
-	}()
-
-	return events, errors
-}
-
-func (m *MockAuditLog) EmitAuditEvent(ctx context.Context, event apievents.AuditEvent) error {
-	return m.emitter.EmitAuditEvent(ctx, event)
-}
diff --git a/lib/events/dynamic.go b/lib/events/dynamic.go
index 9f53bbcd0bffd..ae556e014005a 100644
--- a/lib/events/dynamic.go
+++ b/lib/events/dynamic.go
@@ -22,7 +22,6 @@ import (
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/trace"
-	log "github.com/sirupsen/logrus"
 
 	"encoding/json"
 )
@@ -214,21 +213,8 @@ func FromEventFields(fields EventFields) (apievents.AuditEvent, error) {
 		e = &events.CertificateCreate{}
 	case RenewableCertificateGenerationMismatchEvent:
 		e = &events.RenewableCertificateGenerationMismatch{}
-	case UnknownEvent:
-		e = &events.Unknown{}
 	default:
-		log.Errorf("Attempted to convert dynamic event of unknown type \"%v\" into protobuf event.", eventType)
-		unknown := &events.Unknown{}
-		if err := utils.FastUnmarshal(data, unknown); err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		unknown.Type = UnknownEvent
-		unknown.Code = UnknownCode
-		unknown.UnknownType = eventType
-		unknown.UnknownCode = fields.GetString(EventCode)
-		unknown.Data = string(data)
-		return unknown, nil
+		return nil, trace.BadParameter("unknown event type: %q", eventType)
 	}
 
 	if err := utils.FastUnmarshal(data, e); err != nil {
diff --git a/lib/events/emitter_test.go b/lib/events/emitter_test.go
index 621e3246ed10f..56e532a1319fd 100644
--- a/lib/events/emitter_test.go
+++ b/lib/events/emitter_test.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -284,7 +285,7 @@ func TestExport(t *testing.T) {
 	parts, err := uploader.GetParts(uploads[0].ID)
 	require.NoError(t, err)
 
-	f, err := os.CreateTemp("", "")
+	f, err := ioutil.TempFile("", "")
 	require.NoError(t, err)
 	defer os.Remove(f.Name())
 
diff --git a/lib/events/events_test.go b/lib/events/events_test.go
index b464d77d8a2cf..d25ac64af2150 100644
--- a/lib/events/events_test.go
+++ b/lib/events/events_test.go
@@ -486,7 +486,7 @@ func TestJSON(t *testing.T) {
 		},
 		{
 			name: "desktop session start",
-			json: `{"uid":"cd06365f-3cef-4b21-809a-4af9502c11a1","user":"foo","impersonator":"bar","login":"Administrator","success":true,"proto":"tdp","sid":"test-session","addr.local":"192.168.1.100:39887","addr.remote":"[::1]:34902","with_mfa":"mfa-device","code":"TDP00I","event":"windows.desktop.session.start","time":"2020-04-23T18:22:35.35Z","ei":4,"cluster_name":"test-cluster","windows_user":"Administrator","windows_domain":"test.example.com","desktop_name":"test-desktop","desktop_addr":"[::1]:34902","windows_desktop_service":"00baaef5-ff1e-4222-85a5-c7cb0cd8e7b8","desktop_labels":{"env":"production"}}`,
+			json: `{"uid":"cd06365f-3cef-4b21-809a-4af9502c11a1","user":"foo","impersonator":"bar","login":"Administrator","success":true,"proto":"tdp","sid":"test-session","addr.local":"192.168.1.100:39887","addr.remote":"[::1]:34902","with_mfa":"mfa-device","code":"TDP00I","event":"windows.desktop.session.start","time":"2020-04-23T18:22:35.35Z","ei":4,"cluster_name":"test-cluster","windows_user":"Administrator","windows_domain":"test.example.com","desktop_addr":"[::1]:34902","windows_desktop_service":"00baaef5-ff1e-4222-85a5-c7cb0cd8e7b8","desktop_labels":{"env":"production"}}`,
 			event: apievents.WindowsDesktopSessionStart{
 				Metadata: apievents.Metadata{
 					Index:       4,
@@ -514,7 +514,6 @@ func TestJSON(t *testing.T) {
 					Success: true,
 				},
 				WindowsDesktopService: "00baaef5-ff1e-4222-85a5-c7cb0cd8e7b8",
-				DesktopName:           "test-desktop",
 				DesktopAddr:           "[::1]:34902",
 				Domain:                "test.example.com",
 				WindowsUser:           "Administrator",
diff --git a/lib/events/fields.go b/lib/events/fields.go
index 6d00aace3b943..3952c5d6fa9c4 100644
--- a/lib/events/fields.go
+++ b/lib/events/fields.go
@@ -21,6 +21,7 @@ import (
 	"bufio"
 	"compress/gzip"
 	"io"
+	"io/ioutil"
 	"strings"
 	"time"
 
@@ -101,7 +102,7 @@ func ValidateArchive(reader io.Reader, serverID string) error {
 
 		// Skip over any file in the archive that doesn't contain session events.
 		if !strings.HasSuffix(header.Name, eventsSuffix) {
-			_, err = io.Copy(io.Discard, tarball)
+			_, err = io.Copy(ioutil.Discard, tarball)
 			if err != nil {
 				return trace.Wrap(err)
 			}
diff --git a/lib/events/filesessions/fileasync.go b/lib/events/filesessions/fileasync.go
index 22c8ae5bf465e..db058cd1a134b 100644
--- a/lib/events/filesessions/fileasync.go
+++ b/lib/events/filesessions/fileasync.go
@@ -21,6 +21,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"time"
@@ -158,7 +159,7 @@ func (u *Uploader) writeSessionError(sessionID session.ID, err error) error {
 		return trace.BadParameter("missing session ID")
 	}
 	path := u.sessionErrorFilePath(sessionID)
-	return trace.ConvertSystemError(os.WriteFile(path, []byte(err.Error()), 0600))
+	return trace.ConvertSystemError(ioutil.WriteFile(path, []byte(err.Error()), 0600))
 }
 
 func (u *Uploader) checkSessionError(sessionID session.ID) (bool, error) {
@@ -252,7 +253,7 @@ type ScanStats struct {
 
 // Scan scans the streaming directory and uploads recordings
 func (u *Uploader) Scan() (*ScanStats, error) {
-	files, err := os.ReadDir(u.cfg.ScanDir)
+	files, err := ioutil.ReadDir(u.cfg.ScanDir)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
@@ -315,7 +316,7 @@ type upload struct {
 
 // readStatus reads stream status
 func (u *upload) readStatus() (*apievents.StreamStatus, error) {
-	data, err := io.ReadAll(u.checkpointFile)
+	data, err := ioutil.ReadAll(u.checkpointFile)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
diff --git a/lib/events/filesessions/fileasync_chaos_test.go b/lib/events/filesessions/fileasync_chaos_test.go
index 302aeae5843e2..95d50e5068cb1 100644
--- a/lib/events/filesessions/fileasync_chaos_test.go
+++ b/lib/events/filesessions/fileasync_chaos_test.go
@@ -23,6 +23,7 @@ package filesessions
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -64,7 +65,7 @@ func TestChaosUpload(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	scanDir, err := os.MkdirTemp("", "teleport-streams")
+	scanDir, err := ioutil.TempDir("", "teleport-streams")
 	require.NoError(t, err)
 	defer os.RemoveAll(scanDir)
 
@@ -94,7 +95,7 @@ func TestChaosUpload(t *testing.T) {
 				return nil, trace.ConnectionProblem(nil, "failed to resume stream")
 			} else if resumed >= 5 && resumed < 8 {
 				// for the next several resumes, lose checkpoint file for the stream
-				files, err := os.ReadDir(scanDir)
+				files, err := ioutil.ReadDir(scanDir)
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
diff --git a/lib/events/filesessions/fileasync_test.go b/lib/events/filesessions/fileasync_test.go
index 6d02ff3f82478..aec9f59121aa9 100644
--- a/lib/events/filesessions/fileasync_test.go
+++ b/lib/events/filesessions/fileasync_test.go
@@ -20,6 +20,7 @@ package filesessions
 import (
 	"bytes"
 	"context"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -241,7 +242,7 @@ func TestUploadResume(t *testing.T) {
 			name:    "stream created when checkpoint is lost after failure",
 			retries: 1,
 			onRetry: func(t *testing.T, attempt int, uploader *Uploader) {
-				files, err := os.ReadDir(uploader.cfg.ScanDir)
+				files, err := ioutil.ReadDir(uploader.cfg.ScanDir)
 				require.Nil(t, err)
 				checkpointsDeleted := 0
 				for i := range files {
@@ -404,7 +405,7 @@ func TestUploadBadSession(t *testing.T) {
 	sessionID := session.NewID()
 	fileName := filepath.Join(p.scanDir, string(sessionID)+tarExt)
 
-	err := os.WriteFile(fileName, []byte("this session is corrupted"), 0600)
+	err := ioutil.WriteFile(fileName, []byte("this session is corrupted"), 0600)
 	require.NoError(t, err)
 
 	// initiate the scan by advancing clock past
@@ -449,10 +450,16 @@ func (u *uploaderPack) Close(t *testing.T) {
 
 	err := u.uploader.Close()
 	require.NoError(t, err)
+
+	if u.scanDir != "" {
+		err := os.RemoveAll(u.scanDir)
+		require.NoError(t, err)
+	}
 }
 
 func newUploaderPack(t *testing.T, wrapStreamer wrapStreamerFn) uploaderPack {
-	scanDir := t.TempDir()
+	scanDir, err := ioutil.TempDir("", "teleport-streams")
+	require.NoError(t, err)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	pack := uploaderPack{
@@ -511,7 +518,9 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 
 	test := testCase.newTest(streamer)
 
-	scanDir := t.TempDir()
+	scanDir, err := ioutil.TempDir("", "teleport-streams")
+	require.Nil(t, err)
+	defer os.RemoveAll(scanDir)
 
 	scanPeriod := 10 * time.Second
 	uploader, err := NewUploader(UploaderConfig{
diff --git a/lib/events/filesessions/filestream.go b/lib/events/filesessions/filestream.go
index 3bff4937474a8..c7415c866b702 100644
--- a/lib/events/filesessions/filestream.go
+++ b/lib/events/filesessions/filestream.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sort"
@@ -95,6 +96,9 @@ func (h *Handler) UploadPart(ctx context.Context, upload events.StreamUpload, pa
 
 // CompleteUpload completes the upload
 func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload, parts []events.StreamPart) error {
+	if len(parts) == 0 {
+		return trace.BadParameter("need at least one part to complete the upload")
+	}
 	if err := checkUpload(upload); err != nil {
 		return trace.Wrap(err)
 	}
@@ -123,26 +127,30 @@ func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload
 		}
 	}()
 
-	writePartToFile := func(path string) error {
-		file, err := os.Open(path)
-		if err != nil {
-			return err
-		}
-		defer func() {
-			if err := file.Close(); err != nil {
-				h.WithError(err).Errorf("failed to close file %q", path)
-			}
-		}()
+	files := make([]*os.File, 0, len(parts))
+	readers := make([]io.Reader, 0, len(parts))
 
-		_, err = io.Copy(f, file)
-		return err
-	}
+	defer func() {
+		for i := 0; i < len(files); i++ {
+			if err := files[i].Close(); err != nil {
+				h.WithError(err).Errorf("Failed to close file %q.", files[i].Name())
+			}
+		}
+	}()
 
 	for _, part := range parts {
 		partPath := h.partPath(upload, part.Number)
-		if err := writePartToFile(partPath); err != nil {
-			return trace.Wrap(err)
+		file, err := os.Open(partPath)
+		if err != nil {
+			return trace.Wrap(err, "failed to open part file for upload")
 		}
+		files = append(files, file)
+		readers = append(readers, file)
+	}
+
+	_, err = io.Copy(f, io.MultiReader(readers...))
+	if err != nil {
+		return trace.Wrap(err)
 	}
 
 	err = h.Config.OnBeforeComplete(ctx, upload)
@@ -199,7 +207,7 @@ func (h *Handler) ListParts(ctx context.Context, upload events.StreamUpload) ([]
 func (h *Handler) ListUploads(ctx context.Context) ([]events.StreamUpload, error) {
 	var uploads []events.StreamUpload
 
-	dirs, err := os.ReadDir(h.uploadsPath())
+	dirs, err := ioutil.ReadDir(h.uploadsPath())
 	if err != nil {
 		err = trace.ConvertSystemError(err)
 		// The upload folder may not exist if there are no uploads yet.
@@ -218,7 +226,7 @@ func (h *Handler) ListUploads(ctx context.Context) ([]events.StreamUpload, error
 			h.WithError(err).Warningf("Skipping upload %v with bad format.", uploadID)
 			continue
 		}
-		files, err := os.ReadDir(filepath.Join(h.uploadsPath(), dir.Name()))
+		files, err := ioutil.ReadDir(filepath.Join(h.uploadsPath(), dir.Name()))
 		if err != nil {
 			err = trace.ConvertSystemError(err)
 			if trace.IsNotFound(err) {
@@ -235,16 +243,10 @@ func (h *Handler) ListUploads(ctx context.Context) ([]events.StreamUpload, error
 			h.Warningf("Skipping upload %v, not a directory.", uploadID)
 			continue
 		}
-
-		info, err := dir.Info()
-		if err != nil {
-			h.WithError(err).Warningf("Skipping upload %v: cannot read file info", uploadID)
-			continue
-		}
 		uploads = append(uploads, events.StreamUpload{
 			SessionID: session.ID(filepath.Base(files[0].Name())),
 			ID:        uploadID,
-			Initiated: info.ModTime(),
+			Initiated: dir.ModTime(),
 		})
 	}
 	sort.Slice(uploads, func(i, j int) bool {
diff --git a/lib/events/filesessions/fileuploader_test.go b/lib/events/filesessions/fileuploader_test.go
index 22698e5f301bf..acb46dbf20f4e 100644
--- a/lib/events/filesessions/fileuploader_test.go
+++ b/lib/events/filesessions/fileuploader_test.go
@@ -19,6 +19,7 @@ package filesessions
 
 import (
 	"context"
+	"io/ioutil"
 	"os"
 	"testing"
 
@@ -39,7 +40,9 @@ func TestMain(m *testing.M) {
 
 // TestStreams tests various streaming upload scenarios
 func TestStreams(t *testing.T) {
-	dir := t.TempDir()
+	dir, err := ioutil.TempDir("", "teleport-streams")
+	require.Nil(t, err)
+	defer os.RemoveAll(dir)
 
 	handler, err := NewHandler(Config{
 		Directory: dir,
diff --git a/lib/events/gcssessions/gcsstream.go b/lib/events/gcssessions/gcsstream.go
index b1ef99f57892c..4663841b1eb9b 100644
--- a/lib/events/gcssessions/gcsstream.go
+++ b/lib/events/gcssessions/gcsstream.go
@@ -125,11 +125,6 @@ func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload
 		return convertGCSError(err)
 	}
 
-	// If there are no parts to complete, move to cleanup
-	if len(parts) == 0 {
-		return h.cleanupUpload(ctx, upload)
-	}
-
 	objects := h.partsToObjects(upload, parts)
 	for len(objects) > maxParts {
 		h.Logger.Debugf("Got %v objects for upload %v, performing temp merge.",
@@ -370,7 +365,7 @@ func uploadFromPath(path string) (*events.StreamUpload, error) {
 	if err := sessionID.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	parts := strings.Split(strings.TrimSuffix(dir, slash), slash)
+	parts := strings.Split(dir, slash)
 	if len(parts) < 2 {
 		return nil, trace.BadParameter("expected format uploads/<upload-id>, got %v", dir)
 	}
diff --git a/lib/events/gcssessions/gcsstream_test.go b/lib/events/gcssessions/gcsstream_test.go
index 7fb63ec05af59..cb578ae5d4b2b 100644
--- a/lib/events/gcssessions/gcsstream_test.go
+++ b/lib/events/gcssessions/gcsstream_test.go
@@ -34,40 +34,6 @@ import (
 	"github.com/gravitational/trace"
 )
 
-func TestUploadFromPath(t *testing.T) {
-	for _, test := range []struct {
-		path                string
-		sessionID, uploadID string
-		assertErr           require.ErrorAssertionFunc
-	}{
-		{
-			path:      "uploads/73de0358-2a40-4940-ae26-0c06877e35d9/cf9e08d5-6651-4ddd-a472-52d2286d6bb4.upload",
-			sessionID: "cf9e08d5-6651-4ddd-a472-52d2286d6bb4",
-			uploadID:  "73de0358-2a40-4940-ae26-0c06877e35d9",
-			assertErr: require.NoError,
-		},
-		{
-			path:      "uploads/73de0358-2a40-4940-ae26-0c06877e35d9/cf9e08d5-6651-4ddd-a472-52d2286d6bb4.BADEXTENSION",
-			assertErr: require.Error,
-		},
-		{
-			path:      "no-dir.upload",
-			assertErr: require.Error,
-		},
-	} {
-		t.Run(test.path, func(t *testing.T) {
-			upload, err := uploadFromPath(test.path)
-			test.assertErr(t, err)
-			if test.sessionID != "" {
-				require.Equal(t, test.sessionID, string(upload.SessionID))
-			}
-			if test.uploadID != "" {
-				require.Equal(t, test.uploadID, upload.ID)
-			}
-		})
-	}
-}
-
 // TestStreams tests various streaming upload scenarios
 func TestStreams(t *testing.T) {
 	ctx := context.Background()
diff --git a/lib/events/playback.go b/lib/events/playback.go
index cd39f1c1d5fd8..82c47efda1bb7 100644
--- a/lib/events/playback.go
+++ b/lib/events/playback.go
@@ -24,6 +24,7 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -189,7 +190,7 @@ func (w *PlaybackWriter) SessionChunks() ([]byte, error) {
 		return nil, trace.Wrap(err)
 	}
 	defer grChunk.Close()
-	stream, err = io.ReadAll(grChunk)
+	stream, err = ioutil.ReadAll(grChunk)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/events/s3sessions/s3stream.go b/lib/events/s3sessions/s3stream.go
index bef290faff5b0..201723c01b529 100644
--- a/lib/events/s3sessions/s3stream.go
+++ b/lib/events/s3sessions/s3stream.go
@@ -91,25 +91,8 @@ func (h *Handler) UploadPart(ctx context.Context, upload events.StreamUpload, pa
 	return &events.StreamPart{ETag: *resp.ETag, Number: partNumber}, nil
 }
 
-func (h *Handler) abortUpload(ctx context.Context, upload events.StreamUpload) error {
-	req := &s3.AbortMultipartUploadInput{
-		Bucket:   aws.String(h.Bucket),
-		Key:      aws.String(h.path(upload.SessionID)),
-		UploadId: aws.String(upload.ID),
-	}
-	_, err := h.client.AbortMultipartUploadWithContext(ctx, req)
-	if err != nil {
-		return ConvertS3Error(err)
-	}
-	return nil
-}
-
 // CompleteUpload completes the upload
 func (h *Handler) CompleteUpload(ctx context.Context, upload events.StreamUpload, parts []events.StreamPart) error {
-	if len(parts) == 0 {
-		return h.abortUpload(ctx, upload)
-	}
-
 	start := time.Now()
 	defer func() { h.Infof("UploadPart(%v) completed in %v.", upload.ID, time.Since(start)) }()
 
diff --git a/lib/events/sessionlog.go b/lib/events/sessionlog.go
index af95b69f52aa3..e365264f82b77 100644
--- a/lib/events/sessionlog.go
+++ b/lib/events/sessionlog.go
@@ -22,6 +22,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -235,7 +236,7 @@ func (sl *DiskSessionLogger) finalize() error {
 
 	// create a sentinel to signal completion
 	signalFile := filepath.Join(sl.sessionDir, fmt.Sprintf("%v.completed", sl.SessionID.String()))
-	err := os.WriteFile(signalFile, []byte("completed"), 0640)
+	err := ioutil.WriteFile(signalFile, []byte("completed"), 0640)
 	if err != nil {
 		log.Warningf("Failed creating signal file: %v.", err)
 	}
@@ -600,7 +601,7 @@ func (f *gzipWriter) Close() error {
 	var errors []error
 	if f.Writer != nil {
 		errors = append(errors, f.Writer.Close())
-		f.Writer.Reset(io.Discard)
+		f.Writer.Reset(ioutil.Discard)
 		writerPool.Put(f.Writer)
 		f.Writer = nil
 	}
@@ -617,7 +618,7 @@ func (f *gzipWriter) Close() error {
 // internal buffers to avoid too many objects on the heap
 var writerPool = sync.Pool{
 	New: func() interface{} {
-		w, _ := gzip.NewWriterLevel(io.Discard, gzip.BestSpeed)
+		w, _ := gzip.NewWriterLevel(ioutil.Discard, gzip.BestSpeed)
 		return w
 	},
 }
diff --git a/lib/events/stream.go b/lib/events/stream.go
index 88957755bca63..c00e31c1d4fa0 100644
--- a/lib/events/stream.go
+++ b/lib/events/stream.go
@@ -22,6 +22,7 @@ import (
 	"encoding/binary"
 	"errors"
 	"io"
+	"io/ioutil"
 	"sort"
 	"sync"
 	"time"
@@ -965,7 +966,7 @@ func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 				return nil, r.setError(trace.ConvertSystemError(err))
 			}
 			r.padding = int64(binary.BigEndian.Uint64(r.sizeBytes[:Int64Size]))
-			gzipReader, err := newGzipReader(io.NopCloser(io.LimitReader(r.reader, int64(partSize))))
+			gzipReader, err := newGzipReader(ioutil.NopCloser(io.LimitReader(r.reader, int64(partSize))))
 			if err != nil {
 				return nil, r.setError(trace.Wrap(err))
 			}
@@ -987,7 +988,7 @@ func (r *ProtoReader) Read(ctx context.Context) (apievents.AuditEvent, error) {
 					return nil, r.setError(trace.ConvertSystemError(err))
 				}
 				if r.padding != 0 {
-					skipped, err := io.CopyBuffer(io.Discard, io.LimitReader(r.reader, r.padding), r.messageBytes[:])
+					skipped, err := io.CopyBuffer(ioutil.Discard, io.LimitReader(r.reader, r.padding), r.messageBytes[:])
 					if err != nil {
 						return nil, r.setError(trace.ConvertSystemError(err))
 					}
@@ -1073,8 +1074,6 @@ type MemoryUploader struct {
 	uploads map[string]*MemoryUpload
 	objects map[session.ID][]byte
 	eventsC chan UploadEvent
-
-	Clock clockwork.Clock
 }
 
 // MemoryUpload is used in tests
@@ -1115,9 +1114,6 @@ func (m *MemoryUploader) CreateUpload(ctx context.Context, sessionID session.ID)
 		ID:        uuid.New().String(),
 		SessionID: sessionID,
 	}
-	if m.Clock != nil {
-		upload.Initiated = m.Clock.Now()
-	}
 	m.uploads[upload.ID] = &MemoryUpload{
 		id:        upload.ID,
 		sessionID: sessionID,
@@ -1162,7 +1158,7 @@ func (m *MemoryUploader) CompleteUpload(ctx context.Context, upload StreamUpload
 
 // UploadPart uploads part and returns the part
 func (m *MemoryUploader) UploadPart(ctx context.Context, upload StreamUpload, partNumber int64, partBody io.ReadSeeker) (*StreamPart, error) {
-	data, err := io.ReadAll(partBody)
+	data, err := ioutil.ReadAll(partBody)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1247,7 +1243,7 @@ func (m *MemoryUploader) Upload(ctx context.Context, sessionID session.ID, readC
 	if ok {
 		return "", trace.AlreadyExists("session %q already exists", sessionID)
 	}
-	data, err := io.ReadAll(readCloser)
+	data, err := ioutil.ReadAll(readCloser)
 	if err != nil {
 		return "", trace.ConvertSystemError(err)
 	}
diff --git a/lib/events/test/streamsuite.go b/lib/events/test/streamsuite.go
index 119d92caa53f1..e3f7810c31ff1 100644
--- a/lib/events/test/streamsuite.go
+++ b/lib/events/test/streamsuite.go
@@ -16,6 +16,7 @@ package test
 
 import (
 	"context"
+	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -104,7 +105,7 @@ func StreamWithParameters(t *testing.T, handler events.MultipartHandler, params
 	err = stream.Complete(ctx)
 	require.Nil(t, err)
 
-	f, err := os.CreateTemp("", string(sid))
+	f, err := ioutil.TempFile("", string(sid))
 	require.Nil(t, err)
 	defer os.Remove(f.Name())
 	defer f.Close()
@@ -171,7 +172,7 @@ func StreamResumeWithParameters(t *testing.T, handler events.MultipartHandler, p
 	err = stream.Complete(ctx)
 	require.Nil(t, err, "Complete after resume should succeed")
 
-	f, err := os.CreateTemp("", string(sid))
+	f, err := ioutil.TempFile("", string(sid))
 	require.Nil(t, err)
 	defer os.Remove(f.Name())
 	defer f.Close()
diff --git a/lib/events/test/suite.go b/lib/events/test/suite.go
index 46671c1687b34..5f0c95d47998a 100644
--- a/lib/events/test/suite.go
+++ b/lib/events/test/suite.go
@@ -21,7 +21,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"io"
+	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -46,7 +46,7 @@ func UploadDownload(t *testing.T, handler events.MultipartHandler) {
 	_, err := handler.Upload(context.TODO(), id, bytes.NewBuffer([]byte(val)))
 	require.Nil(t, err)
 
-	f, err := os.CreateTemp("", string(id))
+	f, err := ioutil.TempFile("", string(id))
 	require.Nil(t, err)
 	defer os.Remove(f.Name())
 	defer f.Close()
@@ -57,7 +57,7 @@ func UploadDownload(t *testing.T, handler events.MultipartHandler) {
 	_, err = f.Seek(0, 0)
 	require.Nil(t, err)
 
-	data, err := io.ReadAll(f)
+	data, err := ioutil.ReadAll(f)
 	require.Nil(t, err)
 	require.Equal(t, string(data), val)
 }
@@ -66,7 +66,7 @@ func UploadDownload(t *testing.T, handler events.MultipartHandler) {
 func DownloadNotFound(t *testing.T, handler events.MultipartHandler) {
 	id := session.NewID()
 
-	f, err := os.CreateTemp("", string(id))
+	f, err := ioutil.TempFile("", string(id))
 	require.Nil(t, err)
 	defer os.Remove(f.Name())
 	defer f.Close()
diff --git a/lib/kube/kubeconfig/kubeconfig_test.go b/lib/kube/kubeconfig/kubeconfig_test.go
index 571a5e7ac4b58..46b3c1714e61b 100644
--- a/lib/kube/kubeconfig/kubeconfig_test.go
+++ b/lib/kube/kubeconfig/kubeconfig_test.go
@@ -17,6 +17,7 @@ package kubeconfig
 import (
 	"crypto/x509/pkix"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -38,7 +39,7 @@ import (
 )
 
 func setup(t *testing.T) (string, clientcmdapi.Config) {
-	f, err := os.CreateTemp("", "kubeconfig")
+	f, err := ioutil.TempFile("", "kubeconfig")
 	if err != nil {
 		t.Fatalf("failed to create temp kubeconfig file: %v", err)
 	}
diff --git a/lib/kube/proxy/auth_test.go b/lib/kube/proxy/auth_test.go
index 5b9b7b6a6499d..df0854c33b21f 100644
--- a/lib/kube/proxy/auth_test.go
+++ b/lib/kube/proxy/auth_test.go
@@ -19,6 +19,7 @@ package proxy
 import (
 	"context"
 	"errors"
+	"io/ioutil"
 	"os"
 	"testing"
 
@@ -129,7 +130,7 @@ func TestGetKubeCreds(t *testing.T) {
 	ctx := context.TODO()
 	const teleClusterName = "teleport-cluster"
 
-	tmpFile, err := os.CreateTemp("", "teleport")
+	tmpFile, err := ioutil.TempFile("", "teleport")
 	require.NoError(t, err)
 	defer os.Remove(tmpFile.Name())
 	kubeconfigPath := tmpFile.Name()
diff --git a/lib/kube/proxy/forwarder_test.go b/lib/kube/proxy/forwarder_test.go
index d208c3b30f096..4483671f9d4a7 100644
--- a/lib/kube/proxy/forwarder_test.go
+++ b/lib/kube/proxy/forwarder_test.go
@@ -902,7 +902,7 @@ func (ap mockAccessPoint) GetKubeServices(ctx context.Context) ([]types.Server,
 	return ap.kubeServices, nil
 }
 
-func (ap mockAccessPoint) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (ap mockAccessPoint) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	var cas []types.CertAuthority
 	for _, ca := range ap.cas {
 		cas = append(cas, ca)
@@ -910,7 +910,7 @@ func (ap mockAccessPoint) GetCertAuthorities(ctx context.Context, caType types.C
 	return cas, nil
 }
 
-func (ap mockAccessPoint) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (ap mockAccessPoint) GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	return ap.cas[id.DomainName], nil
 }
 
diff --git a/lib/kube/proxy/roundtrip.go b/lib/kube/proxy/roundtrip.go
index 491a9cccbe2f3..de92c54925780 100644
--- a/lib/kube/proxy/roundtrip.go
+++ b/lib/kube/proxy/roundtrip.go
@@ -23,6 +23,7 @@ import (
 	"crypto/tls"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -209,7 +210,7 @@ func (s *SpdyRoundTripper) NewConnection(resp *http.Response) (httpstream.Connec
 	if (resp.StatusCode != http.StatusSwitchingProtocols) || !strings.Contains(connectionHeader, strings.ToLower(httpstream.HeaderUpgrade)) || !strings.Contains(upgradeHeader, strings.ToLower(streamspdy.HeaderSpdy31)) {
 		defer resp.Body.Close()
 		responseError := ""
-		responseErrorBytes, err := io.ReadAll(resp.Body)
+		responseErrorBytes, err := ioutil.ReadAll(resp.Body)
 		if err != nil {
 			responseError = "unable to read error from server response"
 		} else {
diff --git a/lib/kube/proxy/sess.go b/lib/kube/proxy/sess.go
index e2fd43ee8f060..ec56a94bb3d31 100644
--- a/lib/kube/proxy/sess.go
+++ b/lib/kube/proxy/sess.go
@@ -302,9 +302,6 @@ type session struct {
 
 	// PresenceEnabled is set to true if MFA based presence is required.
 	PresenceEnabled bool
-
-	// Set if we should broadcast information about participant requirements to the session.
-	displayParticipantRequirements bool
 }
 
 // newSession creates a new session in pending mode.
@@ -337,39 +334,29 @@ func newSession(ctx authContext, forwarder *Forwarder, req *http.Request, params
 	}
 
 	s := &session{
-		ctx:                            ctx,
-		forwarder:                      forwarder,
-		req:                            req,
-		params:                         params,
-		id:                             id,
-		parties:                        make(map[uuid.UUID]*party),
-		partiesHistorical:              make(map[uuid.UUID]*party),
-		log:                            log,
-		io:                             io,
-		state:                          types.SessionState_SessionStatePending,
-		accessEvaluator:                accessEvaluator,
-		emitter:                        events.NewDiscardEmitter(),
-		tty:                            tty,
-		terminalSizeQueue:              newMultiResizeQueue(),
-		started:                        false,
-		sess:                           sess,
-		closeC:                         make(chan struct{}),
-		initiator:                      initiator.ID,
-		expires:                        time.Now().UTC().Add(time.Hour * 24),
-		PresenceEnabled:                ctx.Identity.GetIdentity().MFAVerified != "",
-		stateUpdate:                    sync.NewCond(&sync.Mutex{}),
-		displayParticipantRequirements: utils.AsBool(q.Get("displayParticipantRequirements")),
+		ctx:               ctx,
+		forwarder:         forwarder,
+		req:               req,
+		params:            params,
+		id:                id,
+		parties:           make(map[uuid.UUID]*party),
+		partiesHistorical: make(map[uuid.UUID]*party),
+		log:               log,
+		io:                io,
+		state:             types.SessionState_SessionStatePending,
+		accessEvaluator:   accessEvaluator,
+		emitter:           events.NewDiscardEmitter(),
+		tty:               tty,
+		terminalSizeQueue: newMultiResizeQueue(),
+		started:           false,
+		sess:              sess,
+		closeC:            make(chan struct{}),
+		initiator:         initiator.ID,
+		expires:           time.Now().UTC().Add(time.Hour * 24),
+		PresenceEnabled:   ctx.Identity.GetIdentity().MFAVerified != "",
+		stateUpdate:       sync.NewCond(&sync.Mutex{}),
 	}
 
-	go func() {
-		if _, open := <-s.io.TerminateNotifier(); open {
-			err := s.Close()
-			if err != nil {
-				s.log.Errorf("Failed to close session: %v.", err)
-			}
-		}
-	}()
-
 	err = s.trackerCreate(initiator, policySets)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -382,7 +369,7 @@ func newSession(ctx authContext, forwarder *Forwarder, req *http.Request, params
 // to fulfill the access requirements again.
 func (s *session) waitOnAccess() {
 	s.io.Off()
-	s.BroadcastMessage("Session paused, Waiting for required participants...")
+	s.io.BroadcastMessage("Session paused, Waiting for required participants...")
 
 	s.stateUpdate.L.Lock()
 	defer s.stateUpdate.L.Unlock()
@@ -401,7 +388,7 @@ outer:
 		s.stateUpdate.Wait()
 	}
 
-	s.BroadcastMessage("Resuming session...")
+	s.io.BroadcastMessage("Resuming session...")
 	s.io.On()
 }
 
@@ -445,7 +432,10 @@ func (s *session) launch() error {
 	}()
 
 	s.log.Debugf("Launching session: %v", s.id)
-	s.BroadcastMessage("Connecting to %v over K8S", s.podName)
+
+	if s.tty {
+		s.io.BroadcastMessage("Launching session...")
+	}
 
 	q := s.req.URL.Query()
 	request := &remoteCommandRequest{
@@ -531,7 +521,10 @@ func (s *session) launch() error {
 		case <-time.After(time.Until(s.expires)):
 			s.mu.Lock()
 			defer s.mu.Unlock()
-			s.BroadcastMessage("Session expired, closing...")
+
+			if s.tty {
+				s.io.BroadcastMessage("Session expired, closing...")
+			}
 
 			err := s.Close()
 			if err != nil {
@@ -905,7 +898,10 @@ func (s *session) join(p *party) error {
 	}
 
 	s.io.AddWriter(stringID, p.Client.stdoutStream())
-	s.BroadcastMessage("User %v joined the session.", p.Ctx.User.GetName())
+
+	if s.tty {
+		s.io.BroadcastMessage(fmt.Sprintf("User %v joined the session.", p.Ctx.User.GetName()))
+	}
 
 	if p.Mode == types.SessionModeratorMode {
 		go func() {
@@ -939,30 +935,18 @@ func (s *session) join(p *party) error {
 			}()
 		} else if !s.tty {
 			return trace.AccessDenied("insufficient permissions to launch non-interactive session")
-		} else if len(s.parties) == 1 {
-			base := "Waiting for required participants..."
-
-			if s.displayParticipantRequirements {
-				s.BroadcastMessage(base+"\r\n%v", s.accessEvaluator.PrettyRequirementsList())
-			} else {
-				s.BroadcastMessage(base)
+		} else {
+			s.stateUpdate.L.Lock()
+			if s.state == types.SessionState_SessionStatePending {
+				s.io.BroadcastMessage("Waiting for required participants...")
 			}
+			s.stateUpdate.L.Unlock()
 		}
 	}
 
 	return nil
 }
 
-func (s *session) BroadcastMessage(format string, args ...interface{}) {
-	if s.accessEvaluator.IsModerated() && s.tty {
-		err := s.io.BroadcastMessage(fmt.Sprintf(format, args...))
-
-		if err != nil {
-			s.log.Debugf("Failed to broadcast message: %v", err)
-		}
-	}
-}
-
 // leave removes a party from the session.
 func (s *session) leave(id uuid.UUID) error {
 	s.stateUpdate.L.Lock()
@@ -984,7 +968,9 @@ func (s *session) leave(id uuid.UUID) error {
 	s.io.DeleteReader(stringID)
 	s.io.DeleteWriter(stringID)
 
-	s.BroadcastMessage("User %v left the session.", party.Ctx.User.GetName())
+	if s.tty {
+		s.io.BroadcastMessage(fmt.Sprintf("User %v left the session.", party.Ctx.User.GetName()))
+	}
 
 	sessionLeaveEvent := &apievents.SessionLeave{
 		Metadata: apievents.Metadata{
@@ -1100,7 +1086,10 @@ func (s *session) Close() error {
 	defer s.mu.Unlock()
 
 	s.closeOnce.Do(func() {
-		s.BroadcastMessage("Closing session...")
+		if s.tty {
+			s.io.BroadcastMessage("Closing session...")
+		}
+
 		s.stateUpdate.L.Lock()
 		defer s.stateUpdate.L.Unlock()
 		s.state = types.SessionState_SessionStateTerminated
diff --git a/lib/kube/utils/utils.go b/lib/kube/utils/utils.go
index f6f3928f0de12..93e926e81bdbf 100644
--- a/lib/kube/utils/utils.go
+++ b/lib/kube/utils/utils.go
@@ -21,8 +21,6 @@ import (
 	"encoding/hex"
 	"sort"
 
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/trace"
@@ -153,36 +151,11 @@ type KubeServicesPresence interface {
 
 // KubeClusterNames returns a sorted list of unique kubernetes clusters
 // registered in p.
-//
-// DELETE IN 11.0.0, replaced by ListKubeClusterNamesWithFilters
 func KubeClusterNames(ctx context.Context, p KubeServicesPresence) ([]string, error) {
 	kss, err := p.GetKubeServices(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return extractAndSortKubeClusterNames(kss), nil
-}
-
-// ListKubeClusterNamesWithFilters returns a sorted list of unique kubernetes clusters
-// registered in p.
-func ListKubeClusterNamesWithFilters(ctx context.Context, p client.ListResourcesClient, req proto.ListResourcesRequest) ([]string, error) {
-	req.ResourceType = types.KindKubeService
-	var kss []types.Server
-
-	resources, err := client.GetResourcesWithFilters(ctx, p, req)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	kss, err = types.ResourcesWithLabels(resources).AsServers()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return extractAndSortKubeClusterNames(kss), nil
-}
-
-func extractAndSortKubeClusterNames(kss []types.Server) []string {
 	kubeClusters := make(map[string]struct{})
 	for _, ks := range kss {
 		for _, kc := range ks.GetKubernetesClusters() {
@@ -194,7 +167,7 @@ func extractAndSortKubeClusterNames(kss []types.Server) []string {
 		kubeClusterNames = append(kubeClusterNames, n)
 	}
 	sort.Strings(kubeClusterNames)
-	return kubeClusterNames
+	return kubeClusterNames, nil
 }
 
 // CheckOrSetKubeCluster validates kubeClusterName if it's set, or a sane
diff --git a/lib/kube/utils/utils_test.go b/lib/kube/utils/utils_test.go
index dd29fdce70afb..5b4e387d2aa7e 100644
--- a/lib/kube/utils/utils_test.go
+++ b/lib/kube/utils/utils_test.go
@@ -120,33 +120,3 @@ func kubeService(kubeClusters ...string) types.Server {
 		},
 	}
 }
-
-func TestExtractAndSortKubeClusterNames(t *testing.T) {
-	t.Parallel()
-
-	server1, err := types.NewServer("foo", types.KindNode, types.ServerSpecV2{
-		KubernetesClusters: []*types.KubernetesCluster{
-			{Name: "watermelon"},
-		},
-	})
-	require.NoError(t, err)
-
-	server2, err := types.NewServer("foo", types.KindNode, types.ServerSpecV2{
-		KubernetesClusters: []*types.KubernetesCluster{
-			{Name: "watermelon"},
-		},
-	})
-	require.NoError(t, err)
-
-	server3, err := types.NewServer("bar", types.KindNode, types.ServerSpecV2{
-		KubernetesClusters: []*types.KubernetesCluster{
-			{Name: "banana"},
-			{Name: "apple"},
-			{Name: "pear"},
-		},
-	})
-	require.NoError(t, err)
-
-	names := extractAndSortKubeClusterNames([]types.Server{server1, server2, server3})
-	require.Equal(t, []string{"apple", "banana", "pear", "watermelon"}, names)
-}
diff --git a/lib/multiplexer/multiplexer_test.go b/lib/multiplexer/multiplexer_test.go
index f87af998a11dc..7272784d9ef0a 100644
--- a/lib/multiplexer/multiplexer_test.go
+++ b/lib/multiplexer/multiplexer_test.go
@@ -26,6 +26,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -121,7 +122,7 @@ func TestMux(t *testing.T) {
 		re, err := client.Get(backend1.URL)
 		require.Nil(t, err)
 		defer re.Body.Close()
-		bytes, err := io.ReadAll(re.Body)
+		bytes, err := ioutil.ReadAll(re.Body)
 		require.Nil(t, err)
 		require.Equal(t, string(bytes), "backend 1")
 
@@ -344,7 +345,7 @@ func TestMux(t *testing.T) {
 		re, err := client.Get(backend1.URL)
 		require.Nil(t, err)
 		defer re.Body.Close()
-		bytes, err := io.ReadAll(re.Body)
+		bytes, err := ioutil.ReadAll(re.Body)
 		require.Nil(t, err)
 		require.Equal(t, string(bytes), "backend 1")
 
@@ -481,7 +482,7 @@ func TestMux(t *testing.T) {
 		re, err := client.Get(url)
 		require.Nil(t, err)
 		defer re.Body.Close()
-		bytes, err := io.ReadAll(re.Body)
+		bytes, err := ioutil.ReadAll(re.Body)
 		require.Nil(t, err)
 		require.Equal(t, string(bytes), "http backend")
 
diff --git a/lib/restrictedsession/restricted_test.go b/lib/restrictedsession/restricted_test.go
index 4fabd1d73b7b9..4c6e86291b841 100644
--- a/lib/restrictedsession/restricted_test.go
+++ b/lib/restrictedsession/restricted_test.go
@@ -23,6 +23,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"os"
 	"regexp"
@@ -192,7 +193,7 @@ func (s *Suite) SetUpSuite(c *check.C) {
 	}
 
 	// Create temporary directory where cgroup2 hierarchy will be mounted.
-	s.cgroupDir, err = os.MkdirTemp("", "cgroup-test")
+	s.cgroupDir, err = ioutil.TempDir("", "cgroup-test")
 	c.Assert(err, check.IsNil)
 
 	// Create BPF service since we piggy-back on it
diff --git a/lib/reversetunnel/agent.go b/lib/reversetunnel/agent.go
index a5c8b97fd1162..8f040c6974b3a 100644
--- a/lib/reversetunnel/agent.go
+++ b/lib/reversetunnel/agent.go
@@ -245,7 +245,7 @@ func (a *Agent) getPrincipalsList() []string {
 }
 
 func (a *Agent) getHostCheckers() ([]ssh.PublicKey, error) {
-	cas, err := a.AccessPoint.GetCertAuthorities(context.TODO(), types.HostCA, false)
+	cas, err := a.AccessPoint.GetCertAuthorities(types.HostCA, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -264,9 +264,7 @@ func (a *Agent) getHostCheckers() ([]ssh.PublicKey, error) {
 // If this is Web Service port check if proxy support ALPN SNI Listener.
 func (a *Agent) getReverseTunnelDetails() *reverseTunnelDetails {
 	pd := reverseTunnelDetails{TLSRoutingEnabled: false}
-	resp, err := webclient.Find(
-		&webclient.Config{Context: a.ctx, ProxyAddr: a.Addr.Addr, Insecure: lib.IsInsecureDevMode()})
-
+	resp, err := webclient.Find(a.ctx, a.Addr.Addr, lib.IsInsecureDevMode(), nil)
 	if err != nil {
 		// If TLS Routing is disabled the address is the proxy reverse tunnel
 		// address the ping call will always fail.
diff --git a/lib/reversetunnel/agent_test.go b/lib/reversetunnel/agent_test.go
index dea1134680a57..76597fbbb482e 100644
--- a/lib/reversetunnel/agent_test.go
+++ b/lib/reversetunnel/agent_test.go
@@ -89,7 +89,7 @@ type fakeClient struct {
 	caKey ssh.PublicKey
 }
 
-func (fc *fakeClient) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (fc *fakeClient) GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
 		Type:         types.HostCA,
 		ClusterName:  "example.com",
diff --git a/lib/reversetunnel/api.go b/lib/reversetunnel/api.go
index 952b1420ffc69..34fc9d572700a 100644
--- a/lib/reversetunnel/api.go
+++ b/lib/reversetunnel/api.go
@@ -123,18 +123,3 @@ type Server interface {
 	// Wait waits for server to close all outstanding operations
 	Wait()
 }
-
-const (
-	// NoApplicationTunnel is the error message returned when application
-	// reverse tunnel cannot be found.
-	//
-	// It usually happens when an app agent has shut down (or crashed) but
-	// hasn't expired from the backend yet.
-	NoApplicationTunnel = "could not find reverse tunnel, check that Application Service agent proxying this application is up and running"
-	// NoDatabaseTunnel is the error message returned when database reverse
-	// tunnel cannot be found.
-	//
-	// It usually happens when a database agent has shut down (or crashed) but
-	// hasn't expired from the backend yet.
-	NoDatabaseTunnel = "could not find reverse tunnel, check that Database Service agent proxying this database is up and running"
-)
diff --git a/lib/reversetunnel/conn.go b/lib/reversetunnel/conn.go
index 557b585f2b8fa..63b58a148391d 100644
--- a/lib/reversetunnel/conn.go
+++ b/lib/reversetunnel/conn.go
@@ -17,6 +17,7 @@ limitations under the License.
 package reversetunnel
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"sync"
@@ -66,6 +67,11 @@ type remoteConn struct {
 	// Used to make sure calling Close on the connection multiple times is safe.
 	closed int32
 
+	// closeContext and closeCancel are used to signal to any waiting goroutines
+	// that the remoteConn is now closed and to release any resources.
+	closeContext context.Context
+	closeCancel  context.CancelFunc
+
 	// clock is used to control time in tests.
 	clock clockwork.Clock
 
@@ -109,6 +115,8 @@ func newRemoteConn(cfg *connConfig) *remoteConn {
 		newProxiesC: make(chan []types.Server, 100),
 	}
 
+	c.closeContext, c.closeCancel = context.WithCancel(context.Background())
+
 	return c
 }
 
@@ -117,6 +125,8 @@ func (c *remoteConn) String() string {
 }
 
 func (c *remoteConn) Close() error {
+	defer c.closeCancel()
+
 	// If the connection has already been closed, return right away.
 	if !atomic.CompareAndSwapInt32(&c.closed, 0, 1) {
 		return nil
diff --git a/lib/reversetunnel/fake.go b/lib/reversetunnel/fake.go
index c7e3a9bcca62c..ab01542329d30 100644
--- a/lib/reversetunnel/fake.go
+++ b/lib/reversetunnel/fake.go
@@ -18,9 +18,9 @@ package reversetunnel
 
 import (
 	"net"
-	"sync"
 
 	"github.com/gravitational/teleport/lib/auth"
+
 	"github.com/gravitational/trace"
 )
 
@@ -51,25 +51,12 @@ type FakeRemoteSite struct {
 	RemoteSite
 	// Name is the remote site name.
 	Name string
+	// ConnCh receives the connection when dialing this site.
+	ConnCh chan net.Conn
 	// AccessPoint is the auth server client.
 	AccessPoint auth.RemoteProxyAccessPoint
 	// OfflineTunnels is a list of server IDs that will return connection error.
 	OfflineTunnels map[string]struct{}
-	// connCh receives the connection when dialing this site.
-	connCh chan net.Conn
-	// closedMtx is a mutex that protects closed.
-	closedMtx sync.Mutex
-	// closed is set to true after the site is being closed.
-	closed bool
-}
-
-// NewFakeRemoteSite is a FakeRemoteSite constructor.
-func NewFakeRemoteSite(clusterName string, accessPoint auth.RemoteProxyAccessPoint) *FakeRemoteSite {
-	return &FakeRemoteSite{
-		Name:        clusterName,
-		connCh:      make(chan net.Conn),
-		AccessPoint: accessPoint,
-	}
 }
 
 // CachingAccessPoint returns caching auth server client.
@@ -82,33 +69,13 @@ func (s *FakeRemoteSite) GetName() string {
 	return s.Name
 }
 
-// ProxyConn returns proxy connection channel with incoming connections.
-func (s *FakeRemoteSite) ProxyConn() <-chan net.Conn {
-	return s.connCh
-}
-
 // Dial returns the connection to the remote site.
 func (s *FakeRemoteSite) Dial(params DialParams) (net.Conn, error) {
 	if _, ok := s.OfflineTunnels[params.ServerID]; ok {
 		return nil, trace.ConnectionProblem(nil, "server %v tunnel is offline",
 			params.ServerID)
 	}
-
-	s.closedMtx.Lock()
-	defer s.closedMtx.Unlock()
-
-	if s.closed {
-		return nil, trace.ConnectionProblem(nil, "tunnel has been closed")
-	}
-
 	readerConn, writerConn := net.Pipe()
-	s.connCh <- readerConn
+	s.ConnCh <- readerConn
 	return writerConn, nil
 }
-
-func (s *FakeRemoteSite) Close() {
-	s.closedMtx.Lock()
-	defer s.closedMtx.Unlock()
-	close(s.connCh)
-	s.closed = true
-}
diff --git a/lib/reversetunnel/localsite.go b/lib/reversetunnel/localsite.go
index 440c188f5779f..3a33f1447dbe2 100644
--- a/lib/reversetunnel/localsite.go
+++ b/lib/reversetunnel/localsite.go
@@ -67,7 +67,7 @@ func newlocalSite(srv *server, domainName string, client auth.ClientI) (*localSi
 		accessPoint:      accessPoint,
 		certificateCache: certificateCache,
 		domainName:       domainName,
-		remoteConns:      make(map[connKey][]*remoteConn),
+		remoteConns:      make(map[connKey]*remoteConn),
 		clock:            srv.Clock,
 		log: log.WithFields(log.Fields{
 			trace.Component: teleport.ComponentReverseTunnelServer,
@@ -89,6 +89,8 @@ func newlocalSite(srv *server, domainName string, client auth.ClientI) (*localSi
 //
 // it implements RemoteSite interface
 type localSite struct {
+	sync.Mutex
+
 	log        log.FieldLogger
 	domainName string
 	srv        *server
@@ -102,11 +104,8 @@ type localSite struct {
 	// certificateCache caches host certificates for the forwarding server.
 	certificateCache *certificateCache
 
-	// remoteConns maps UUID and connection type to remote connections, oldest to newest.
-	remoteConns map[connKey][]*remoteConn
-
-	// remoteConnsMtx protects remoteConns.
-	remoteConnsMtx sync.Mutex
+	// remoteConns maps UUID and connection type to an remote connection.
+	remoteConns map[connKey]*remoteConn
 
 	// clock is used to control time in tests.
 	clock clockwork.Clock
@@ -118,8 +117,8 @@ type localSite struct {
 
 // GetTunnelsCount always the number of tunnel connections to this cluster.
 func (s *localSite) GetTunnelsCount() int {
-	s.remoteConnsMtx.Lock()
-	defer s.remoteConnsMtx.Unlock()
+	s.Lock()
+	defer s.Unlock()
 
 	return len(s.remoteConns)
 }
@@ -204,7 +203,7 @@ func (s *localSite) DialTCP(params DialParams) (net.Conn, error) {
 	}
 	s.log.Debugf("Succeeded dialing %v.", params)
 
-	return conn, nil
+	return newEmitConn(s.srv.ctx, conn, s.client, s.srv.ID), nil
 }
 
 // IsClosed always returns false because localSite is never closed.
@@ -350,8 +349,8 @@ with the cluster.`
 }
 
 func (s *localSite) addConn(nodeID string, connType types.TunnelType, conn net.Conn, sconn ssh.Conn) (*remoteConn, error) {
-	s.remoteConnsMtx.Lock()
-	defer s.remoteConnsMtx.Unlock()
+	s.Lock()
+	defer s.Unlock()
 
 	rconn := newRemoteConn(&connConfig{
 		conn:             conn,
@@ -366,7 +365,7 @@ func (s *localSite) addConn(nodeID string, connType types.TunnelType, conn net.C
 		uuid:     nodeID,
 		connType: connType,
 	}
-	s.remoteConns[key] = append(s.remoteConns[key], rconn)
+	s.remoteConns[key] = rconn
 
 	return rconn, nil
 }
@@ -375,13 +374,10 @@ func (s *localSite) addConn(nodeID string, connType types.TunnelType, conn net.C
 // list so that remote connection can notify the remote agent
 // about the list update
 func (s *localSite) fanOutProxies(proxies []types.Server) {
-	s.remoteConnsMtx.Lock()
-	defer s.remoteConnsMtx.Unlock()
-
-	for _, conns := range s.remoteConns {
-		for _, conn := range conns {
-			conn.updateProxies(proxies)
-		}
+	s.Lock()
+	defer s.Unlock()
+	for _, conn := range s.remoteConns {
+		conn.updateProxies(proxies)
 	}
 }
 
@@ -450,22 +446,14 @@ func (s *localSite) handleHeartbeat(rconn *remoteConn, ch ssh.Channel, reqC <-ch
 }
 
 func (s *localSite) getRemoteConn(dreq *sshutils.DialReq) (*remoteConn, error) {
-	s.remoteConnsMtx.Lock()
-	defer s.remoteConnsMtx.Unlock()
+	s.Lock()
+	defer s.Unlock()
 
 	// Loop over all connections and remove and invalid connections from the
 	// connection map.
-	for key, conns := range s.remoteConns {
-		validConns := conns[:0]
-		for _, conn := range conns {
-			if !conn.isInvalid() {
-				validConns = append(validConns, conn)
-			}
-		}
-		if len(validConns) == 0 {
+	for key := range s.remoteConns {
+		if s.remoteConns[key].isInvalid() {
 			delete(s.remoteConns, key)
-		} else {
-			s.remoteConns[key] = validConns
 		}
 	}
 
@@ -473,17 +461,15 @@ func (s *localSite) getRemoteConn(dreq *sshutils.DialReq) (*remoteConn, error) {
 		uuid:     dreq.ServerID,
 		connType: dreq.ConnType,
 	}
-	if len(s.remoteConns[key]) == 0 {
+	rconn, ok := s.remoteConns[key]
+	if !ok {
 		return nil, trace.NotFound("no %v reverse tunnel for %v found", dreq.ConnType, dreq.ServerID)
 	}
-
-	conns := s.remoteConns[key]
-	for i := len(conns) - 1; i >= 0; i-- {
-		if conns[i].isReady() {
-			return conns[i], nil
-		}
+	if !rconn.isReady() {
+		return nil, trace.NotFound("%v is offline: no active %v tunnels found", dreq.ConnType, dreq.ServerID)
 	}
-	return nil, trace.NotFound("%v is offline: no active %v tunnels found", dreq.ConnType, dreq.ServerID)
+
+	return rconn, nil
 }
 
 func (s *localSite) chanTransportConn(rconn *remoteConn, dreq *sshutils.DialReq) (net.Conn, error) {
diff --git a/lib/reversetunnel/localsite_test.go b/lib/reversetunnel/localsite_test.go
deleted file mode 100644
index 34156bf046247..0000000000000
--- a/lib/reversetunnel/localsite_test.go
+++ /dev/null
@@ -1,101 +0,0 @@
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package reversetunnel
-
-import (
-	"context"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/utils/sshutils"
-	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-)
-
-func TestLocalSiteOverlap(t *testing.T) {
-	t.Parallel()
-
-	// to stop (*localSite).periodicFunctions()
-	ctx, ctxCancel := context.WithCancel(context.Background())
-	ctxCancel()
-
-	srv := &server{
-		ctx: ctx,
-		newAccessPoint: func(clt auth.ClientI, _ []string) (auth.RemoteProxyAccessPoint, error) {
-			return clt, nil
-		},
-	}
-
-	site, err := newlocalSite(srv, "clustername", &mockLocalSiteClient{})
-	require.NoError(t, err)
-
-	nodeID := uuid.NewString()
-	connType := types.NodeTunnel
-	dreq := &sshutils.DialReq{
-		ServerID: nodeID,
-		ConnType: connType,
-	}
-
-	conn1, err := site.addConn(nodeID, connType, mockRemoteConnConn{}, nil)
-	require.NoError(t, err)
-
-	conn2, err := site.addConn(nodeID, connType, mockRemoteConnConn{}, nil)
-	require.NoError(t, err)
-
-	c, err := site.getRemoteConn(dreq)
-	require.True(t, trace.IsNotFound(err))
-	require.Nil(t, c)
-
-	conn1.setLastHeartbeat(time.Now())
-	c, err = site.getRemoteConn(dreq)
-	require.NoError(t, err)
-	require.Equal(t, conn1, c)
-
-	conn2.setLastHeartbeat(time.Now())
-	c, err = site.getRemoteConn(dreq)
-	require.NoError(t, err)
-	require.Equal(t, conn2, c)
-
-	conn2.markInvalid(nil)
-	c, err = site.getRemoteConn(dreq)
-	require.NoError(t, err)
-	require.Equal(t, conn1, c)
-
-	conn1.markInvalid(nil)
-	c, err = site.getRemoteConn(dreq)
-	require.True(t, trace.IsNotFound(err))
-	require.Nil(t, c)
-}
-
-type mockLocalSiteClient struct {
-	auth.Client
-}
-
-// called by (*localSite).sshTunnelStats() as part of (*localSite).periodicFunctions()
-func (mockLocalSiteClient) GetNodes(_ context.Context, _ string, _ ...services.MarshalOption) ([]types.Server, error) {
-	return nil, nil
-}
-
-type mockRemoteConnConn struct {
-	net.Conn
-}
-
-// called for logging by (*remoteConn).markInvalid()
-func (mockRemoteConnConn) RemoteAddr() net.Addr { return nil }
diff --git a/lib/reversetunnel/remotesite.go b/lib/reversetunnel/remotesite.go
index 7fb01bea51cbf..69fcb4192bde7 100644
--- a/lib/reversetunnel/remotesite.go
+++ b/lib/reversetunnel/remotesite.go
@@ -89,7 +89,7 @@ type remoteSite struct {
 
 func (s *remoteSite) getRemoteClient() (auth.ClientI, bool, error) {
 	// check if all cert authorities are initiated and if everything is OK
-	ca, err := s.srv.localAccessPoint.GetCertAuthority(s.ctx, types.CertAuthID{Type: types.HostCA, DomainName: s.domainName}, false)
+	ca, err := s.srv.localAccessPoint.GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: s.domainName}, false)
 	if err != nil {
 		return nil, false, trace.Wrap(err)
 	}
@@ -493,7 +493,7 @@ func (s *remoteSite) watchCertAuthorities() error {
 					continue
 				}
 
-				if err := s.remoteClient.RotateExternalCertAuthority(s.ctx, localCA); err != nil {
+				if err := s.remoteClient.RotateExternalCertAuthority(localCA); err != nil {
 					s.WithError(err).Warn("Failed to rotate external ca")
 					return trace.Wrap(err)
 				}
@@ -505,7 +505,7 @@ func (s *remoteSite) watchCertAuthorities() error {
 					continue
 				}
 
-				oldRemoteCA, err := s.localClient.GetCertAuthority(s.ctx, types.CertAuthID{
+				oldRemoteCA, err := s.localClient.GetCertAuthority(types.CertAuthID{
 					Type:       types.HostCA,
 					DomainName: remoteCA.GetClusterName(),
 				}, false)
diff --git a/lib/reversetunnel/resolver.go b/lib/reversetunnel/resolver.go
index 528063a0acbc3..a467f5214577b 100644
--- a/lib/reversetunnel/resolver.go
+++ b/lib/reversetunnel/resolver.go
@@ -58,9 +58,7 @@ func WebClientResolver(ctx context.Context, addrs []utils.NetAddr, insecureTLS b
 		for _, addr := range addrs {
 			// In insecure mode, any certificate is accepted. In secure mode the hosts
 			// CAs are used to validate the certificate on the proxy.
-			tunnelAddr, err := webclient.GetTunnelAddr(
-				&webclient.Config{Context: ctx, ProxyAddr: addr.String(), Insecure: insecureTLS})
-
+			tunnelAddr, err := webclient.GetTunnelAddr(ctx, addr.String(), insecureTLS, nil)
 			if err != nil {
 				errs = append(errs, err)
 				continue
diff --git a/lib/reversetunnel/srv.go b/lib/reversetunnel/srv.go
index 40eb296354719..67e16a01ee959 100644
--- a/lib/reversetunnel/srv.go
+++ b/lib/reversetunnel/srv.go
@@ -724,7 +724,7 @@ func (s *server) findLocalCluster(sconn *ssh.ServerConn) (*localSite, error) {
 }
 
 func (s *server) getTrustedCAKeysByID(id types.CertAuthID) ([]ssh.PublicKey, error) {
-	ca, err := s.localAccessPoint.GetCertAuthority(context.TODO(), id, false)
+	ca, err := s.localAccessPoint.GetCertAuthority(id, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/reversetunnel/srv_test.go b/lib/reversetunnel/srv_test.go
index 792b39959735b..e0747f0630dcc 100644
--- a/lib/reversetunnel/srv_test.go
+++ b/lib/reversetunnel/srv_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package reversetunnel
 
 import (
-	"context"
 	"net"
 	"testing"
 	"time"
@@ -156,6 +155,6 @@ type mockAccessPoint struct {
 	ca types.CertAuthority
 }
 
-func (ap mockAccessPoint) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (ap mockAccessPoint) GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	return ap.ca, nil
 }
diff --git a/lib/reversetunnel/transport.go b/lib/reversetunnel/transport.go
index 923a4a3cf8705..65237ca5514e4 100644
--- a/lib/reversetunnel/transport.go
+++ b/lib/reversetunnel/transport.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"strings"
 	"time"
 
 	"golang.org/x/crypto/ssh"
@@ -92,8 +93,7 @@ func (t *TunnelAuthDialer) DialContext(ctx context.Context, _, _ string) (net.Co
 	}
 
 	// Check if t.ProxyAddr is ProxyWebPort and remote Proxy supports TLS ALPNSNIListener.
-	resp, err := webclient.Find(
-		&webclient.Config{Context: ctx, ProxyAddr: addr.Addr, Insecure: t.InsecureSkipTLSVerify})
+	resp, err := webclient.Find(ctx, addr.Addr, t.InsecureSkipTLSVerify, nil)
 	if err != nil {
 		// If TLS Routing is disabled the address is the proxy reverse tunnel
 		// address thus the ping call will always fail.
@@ -379,13 +379,9 @@ func (p *transport) getConn(servers []string, r *sshutils.DialReq) (net.Conn, bo
 			return nil, false, trace.Wrap(err)
 		}
 
-		// Connections to applications and databases should never occur over
-		// a direct dial, return right away.
-		switch r.ConnType {
-		case types.AppTunnel:
-			return nil, false, trace.ConnectionProblem(err, NoApplicationTunnel)
-		case types.DatabaseTunnel:
-			return nil, false, trace.ConnectionProblem(err, NoDatabaseTunnel)
+		// Connections to applications should never occur over a direct dial, return right away.
+		if r.ConnType == types.AppTunnel {
+			return nil, false, trace.ConnectionProblem(err, "failed to connect to application")
 		}
 
 		errTun := err
@@ -445,7 +441,7 @@ func (p *transport) directDial(servers []string, serverID string) (net.Conn, err
 	for _, addr := range servers {
 		conn, err := net.Dial("tcp", addr)
 		if err == nil {
-			return conn, nil
+			return newEmitConn(p.closeContext, conn, p.emitter, strings.Split(serverID, ".")[0]), nil
 		}
 
 		errors = append(errors, err)
diff --git a/lib/service/connect.go b/lib/service/connect.go
index 4f9a3fdad1f05..669dad410bffd 100644
--- a/lib/service/connect.go
+++ b/lib/service/connect.go
@@ -320,9 +320,9 @@ func (process *TeleportProcess) newWatcher(conn *Connector, watch types.Watch) (
 // TLS client this method uses the local auth server.
 func (process *TeleportProcess) getCertAuthority(conn *Connector, id types.CertAuthID, loadPrivateKeys bool) (types.CertAuthority, error) {
 	if conn.ClientIdentity.ID.Role == types.RoleAdmin || conn.ClientIdentity.ID.Role == types.RoleAuth {
-		return process.localAuth.GetCertAuthority(process.ExitContext(), id, loadPrivateKeys)
+		return process.localAuth.GetCertAuthority(id, loadPrivateKeys)
 	}
-	return conn.Client.GetCertAuthority(process.ExitContext(), id, loadPrivateKeys)
+	return conn.Client.GetCertAuthority(id, loadPrivateKeys)
 }
 
 // reRegister receives new identity credentials for proxy, node and auth.
diff --git a/lib/service/desktop.go b/lib/service/desktop.go
index 8263c7d9f9fed..e281cbce997b7 100644
--- a/lib/service/desktop.go
+++ b/lib/service/desktop.go
@@ -226,7 +226,6 @@ func (process *TeleportProcess) initWindowsDesktopServiceRegistered(log *logrus.
 		LDAPConfig:           desktop.LDAPConfig(cfg.WindowsDesktop.LDAP),
 		DiscoveryBaseDN:      cfg.WindowsDesktop.Discovery.BaseDN,
 		DiscoveryLDAPFilters: cfg.WindowsDesktop.Discovery.Filters,
-		Hostname:             cfg.Hostname,
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/service/service.go b/lib/service/service.go
index 4ce4847aa6b34..0c64fb0f67ef6 100644
--- a/lib/service/service.go
+++ b/lib/service/service.go
@@ -26,6 +26,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -1578,6 +1579,7 @@ func (process *TeleportProcess) newAccessCache(cfg accessCacheConfig) (*cache.Ca
 			lite.Config{
 				Path:             path,
 				EventsOff:        !cfg.events,
+				Memory:           false,
 				Mirror:           true,
 				PollStreamPeriod: 100 * time.Millisecond,
 			})
@@ -2128,6 +2130,36 @@ func (process *TeleportProcess) initUploaderService(streamer events.Streamer, au
 		}
 	}
 
+	// DELETE IN (5.1.0)
+	// this uploader was superseded by filesessions.Uploader,
+	// see below
+	uploader, err := events.NewUploader(events.UploaderConfig{
+		DataDir:   filepath.Join(process.Config.DataDir, teleport.LogsDir),
+		Namespace: apidefaults.Namespace,
+		ServerID:  teleport.ComponentUpload,
+		AuditLog:  auditLog,
+		EventsC:   process.Config.UploadEventsC,
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	process.RegisterFunc("uploader.service", func() error {
+		err := uploader.Serve()
+		if err != nil {
+			log.Errorf("Uploader server exited with error: %v.", err)
+		}
+		return nil
+	})
+
+	process.OnExit("uploader.shutdown", func(payload interface{}) {
+		log.Infof("Shutting down.")
+		warnOnErr(uploader.Stop(), log)
+		log.Infof("Exited.")
+	})
+
+	// This uploader supersedes the events.Uploader above,
+	// that is kept for backwards compatibility purposes for one release.
+	// Delete this comment once the uploader above is phased out.
 	fileUploader, err := filesessions.NewUploader(filesessions.UploaderConfig{
 		ScanDir:  filepath.Join(streamingDir...),
 		Streamer: streamer,
@@ -2186,7 +2218,7 @@ func (process *TeleportProcess) initMetricsService() error {
 
 		pool := x509.NewCertPool()
 		for _, caCertPath := range process.Config.Metrics.CACerts {
-			caCert, err := os.ReadFile(caCertPath)
+			caCert, err := ioutil.ReadFile(caCertPath)
 			if err != nil {
 				return trace.Wrap(err, "failed to read prometheus CA certificate %+v", caCertPath)
 			}
@@ -2362,11 +2394,6 @@ func (process *TeleportProcess) getAdditionalPrincipals(role types.SystemRole) (
 		principals = append(principals, process.Config.Hostname)
 	}
 	var addrs []utils.NetAddr
-
-	// Add default DNSNames to the dnsNames list.
-	// For identities generated by teleport <= v6.1.6 the teleport.cluster.local DNS is not present
-	dnsNames = append(dnsNames, auth.DefaultDNSNamesForRole(role)...)
-
 	switch role {
 	case types.RoleProxy:
 		addrs = append(process.Config.Proxy.PublicAddrs,
@@ -3192,7 +3219,7 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 
 	var grpcServer *grpc.Server
 	if alpnRouter != nil {
-		grpcServer = grpc.NewServer(
+		grpcServer := grpc.NewServer(
 			grpc.ChainUnaryInterceptor(
 				utils.ErrorConvertUnaryInterceptor,
 				proxyLimiter.UnaryServerInterceptor(),
@@ -3757,6 +3784,9 @@ func (process *TeleportProcess) initAuthStorage() (bk backend.Backend, err error
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
+	if err := bk.Migrate(ctx); err != nil {
+		return nil, trace.Wrap(err)
+	}
 	reporter, err := backend.NewReporter(backend.ReporterConfig{
 		Component: teleport.ComponentBackend,
 		Backend:   backend.NewSanitizer(bk),
@@ -3798,18 +3828,12 @@ func (process *TeleportProcess) StartShutdown(ctx context.Context) context.Conte
 			process.log.Warnf("Error waiting for all services to complete: %v", err)
 		}
 		process.log.Debug("All supervisor functions are completed.")
-
-		if localAuth := process.getLocalAuth(); localAuth != nil {
-			if err := localAuth.Close(); err != nil {
+		localAuth := process.getLocalAuth()
+		if localAuth != nil {
+			if err := process.localAuth.Close(); err != nil {
 				process.log.Warningf("Failed closing auth server: %v.", err)
 			}
 		}
-
-		if process.storage != nil {
-			if err := process.storage.Close(); err != nil {
-				process.log.Warningf("Failed closing process storage: %v.", err)
-			}
-		}
 	}()
 	go process.printShutdownStatus(localCtx)
 	return localCtx
@@ -3831,9 +3855,9 @@ func (process *TeleportProcess) Close() error {
 	process.Config.Keygen.Close()
 
 	var errors []error
-
-	if localAuth := process.getLocalAuth(); localAuth != nil {
-		errors = append(errors, localAuth.Close())
+	localAuth := process.getLocalAuth()
+	if localAuth != nil {
+		errors = append(errors, process.localAuth.Close())
 	}
 
 	if process.storage != nil {
@@ -3854,7 +3878,7 @@ func validateConfig(cfg *Config) error {
 	}
 
 	if cfg.Console == nil {
-		cfg.Console = io.Discard
+		cfg.Console = ioutil.Discard
 	}
 
 	if len(cfg.AuthServers) == 0 {
@@ -3908,10 +3932,10 @@ func initSelfSignedHTTPSCert(cfg *Config) (err error) {
 		return trace.Wrap(err)
 	}
 
-	if err := os.WriteFile(keyPath, creds.PrivateKey, 0600); err != nil {
+	if err := ioutil.WriteFile(keyPath, creds.PrivateKey, 0600); err != nil {
 		return trace.Wrap(err, "error writing key PEM")
 	}
-	if err := os.WriteFile(certPath, creds.Cert, 0600); err != nil {
+	if err := ioutil.WriteFile(certPath, creds.Cert, 0600); err != nil {
 		return trace.Wrap(err, "error writing key PEM")
 	}
 	return nil
@@ -4012,8 +4036,7 @@ func getPublicAddr(authClient auth.ReadAppsAccessPoint, a App) (string, error) {
 	for {
 		select {
 		case <-ticker.C:
-			publicAddr, err := app.FindPublicAddr(authClient, a.PublicAddr, a.Name)
-
+			publicAddr, err := findPublicAddr(authClient, a)
 			if err == nil {
 				return publicAddr, nil
 			}
@@ -4023,6 +4046,37 @@ func getPublicAddr(authClient auth.ReadAppsAccessPoint, a App) (string, error) {
 	}
 }
 
+// findPublicAddr tries to resolve the public address of the proxy of this cluster.
+func findPublicAddr(authClient auth.ReadAppsAccessPoint, a App) (string, error) {
+	// If the application has a public address already set, use it.
+	if a.PublicAddr != "" {
+		return a.PublicAddr, nil
+	}
+
+	// Fetch list of proxies, if first has public address set, use it.
+	servers, err := authClient.GetProxies()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	if len(servers) == 0 {
+		return "", trace.BadParameter("cluster has no proxied registered, at least one proxy must be registered for application access")
+	}
+	if servers[0].GetPublicAddr() != "" {
+		addr, err := utils.ParseAddr(servers[0].GetPublicAddr())
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
+		return fmt.Sprintf("%v.%v", a.Name, addr.Host()), nil
+	}
+
+	// Fall back to cluster name.
+	cn, err := authClient.GetClusterName()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return fmt.Sprintf("%v.%v", a.Name, cn.GetClusterName()), nil
+}
+
 // newHTTPFileSystem creates a new HTTP file system for the web handler.
 // It uses external configuration to make the decision
 func newHTTPFileSystem() (http.FileSystem, error) {
diff --git a/lib/service/service_test.go b/lib/service/service_test.go
index 8c233409bb238..0b7fa5fedc04e 100644
--- a/lib/service/service_test.go
+++ b/lib/service/service_test.go
@@ -18,6 +18,7 @@ package service
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"net/http"
 	"os"
 	"strings"
@@ -87,11 +88,15 @@ func TestMonitor(t *testing.T) {
 	cfg := MakeDefaultConfig()
 	cfg.Clock = fakeClock
 	var err error
-	cfg.DataDir = t.TempDir()
+	cfg.DataDir, err = ioutil.TempDir("", "teleport")
+	require.NoError(t, err)
+	defer os.RemoveAll(cfg.DataDir)
 	cfg.DiagnosticAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
 	cfg.AuthServers = []utils.NetAddr{{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}}
 	cfg.Auth.Enabled = true
-	cfg.Auth.StorageConfig.Params["path"] = t.TempDir()
+	cfg.Auth.StorageConfig.Params["path"], err = ioutil.TempDir("", "teleport")
+	require.NoError(t, err)
+	defer os.RemoveAll(cfg.DataDir)
 	cfg.Auth.SSHAddr = utils.NetAddr{AddrNetwork: "tcp", Addr: "127.0.0.1:0"}
 	cfg.Proxy.Enabled = false
 	cfg.SSH.Enabled = false
@@ -342,8 +347,6 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"proxy-kube-public-2",
 			},
 			wantDNS: []string{
-				"*.teleport.cluster.local",
-				"teleport.cluster.local",
 				"*.proxy-public-1",
 				"*.proxy-public-2",
 				"*.proxy-kube-public-1",
@@ -357,10 +360,7 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"auth-public-1",
 				"auth-public-2",
 			},
-			wantDNS: []string{
-				"*.teleport.cluster.local",
-				"teleport.cluster.local",
-			},
+			wantDNS: []string{},
 		},
 		{
 			role: types.RoleAdmin,
@@ -369,10 +369,7 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"auth-public-1",
 				"auth-public-2",
 			},
-			wantDNS: []string{
-				"*.teleport.cluster.local",
-				"teleport.cluster.local",
-			},
+			wantDNS: []string{},
 		},
 		{
 			role: types.RoleNode,
@@ -396,10 +393,7 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"kube-public-1",
 				"kube-public-2",
 			},
-			wantDNS: []string{
-				"*.teleport.cluster.local",
-				"teleport.cluster.local",
-			},
+			wantDNS: []string{},
 		},
 		{
 			role: types.RoleApp,
@@ -407,10 +401,7 @@ func TestGetAdditionalPrincipals(t *testing.T) {
 				"global-hostname",
 				"global-uuid",
 			},
-			wantDNS: []string{
-				"*.teleport.cluster.local",
-				"teleport.cluster.local",
-			},
+			wantDNS: []string{},
 		},
 		{
 			role: types.SystemRole("unknown"),
diff --git a/lib/service/state.go b/lib/service/state.go
index bc6e18685a87b..c391ae487d3b4 100644
--- a/lib/service/state.go
+++ b/lib/service/state.go
@@ -88,7 +88,7 @@ func (f *processState) update(event Event) {
 
 	component, ok := event.Payload.(string)
 	if !ok {
-		f.process.log.Errorf("%v broadcasted without component name, this is a bug!", event.Name)
+		f.process.log.Errorf("TeleportDegradedEvent broadcasted without component name, this is a bug!")
 		return
 	}
 	s, ok := f.states[component]
@@ -118,7 +118,7 @@ func (f *processState) update(event Event) {
 			s.recoveryTime = f.process.Clock.Now()
 			f.process.log.Infof("Teleport component %q is recovering from a degraded state.", component)
 		case stateRecovering:
-			if f.process.Clock.Since(s.recoveryTime) > defaults.HeartbeatCheckPeriod*2 {
+			if f.process.Clock.Now().Sub(s.recoveryTime) > defaults.HeartbeatCheckPeriod*2 {
 				s.state = stateOK
 				f.process.log.Infof("Teleport component %q has recovered from a degraded state.", component)
 			}
diff --git a/lib/services/access_request_test.go b/lib/services/access_request_test.go
index e7a2fe16384f2..f1bbd5584fac0 100644
--- a/lib/services/access_request_test.go
+++ b/lib/services/access_request_test.go
@@ -176,7 +176,7 @@ func TestReviewThresholds(t *testing.T) {
 	roles := make(map[string]types.Role)
 
 	for name, conditions := range roleDesc {
-		role, err := types.NewRoleV3(name, types.RoleSpecV5{
+		role, err := types.NewRole(name, types.RoleSpecV5{
 			Allow: conditions,
 		})
 		require.NoError(t, err)
diff --git a/lib/services/database.go b/lib/services/database.go
index 0d53cbe48cf8d..eed6b7bea19a6 100644
--- a/lib/services/database.go
+++ b/lib/services/database.go
@@ -31,7 +31,6 @@ import (
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/aws/aws-sdk-go/service/redshift"
 
-	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
 )
@@ -50,7 +49,7 @@ type Databases interface {
 	DatabaseGetter
 	// CreateDatabase creates a new database resource.
 	CreateDatabase(context.Context, types.Database) error
-	// UpdateDatabase updates an existing database resource.
+	// UpdateDatabse updates an existing database resource.
 	UpdateDatabase(context.Context, types.Database) error
 	// DeleteDatabase removes the specified database resource.
 	DeleteDatabase(ctx context.Context, name string) error
@@ -291,7 +290,7 @@ func engineToProtocol(engine string) string {
 	switch engine {
 	case RDSEnginePostgres, RDSEngineAuroraPostgres:
 		return defaults.ProtocolPostgres
-	case RDSEngineMySQL, RDSEngineAurora, RDSEngineAuroraMySQL, RDSEngineMariaDB:
+	case RDSEngineMySQL, RDSEngineAurora, RDSEngineAuroraMySQL:
 		return defaults.ProtocolMySQL
 	}
 	return ""
@@ -370,27 +369,6 @@ func rdsTagsToLabels(tags []*rds.Tag) map[string]string {
 	return labels
 }
 
-// IsRDSInstanceSupported returns true if database supports IAM authentication.
-// Currently, only MariaDB is being checked.
-func IsRDSInstanceSupported(instance *rds.DBInstance) bool {
-	// TODO(jakule): Check other engines.
-	if aws.StringValue(instance.Engine) != RDSEngineMariaDB {
-		return true
-	}
-
-	// MariaDB follows semver schema: https://mariadb.org/about/
-	ver, err := semver.NewVersion(aws.StringValue(instance.EngineVersion))
-	if err != nil {
-		log.Errorf("Failed to parse RDS MariaDB version: %s", aws.StringValue(instance.EngineVersion))
-		return false
-	}
-
-	// Min supported MariaDB version that supports IAM is 10.6
-	// https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html
-	minIAMSupportedVer := semver.New("10.6.0")
-	return !ver.LessThan(*minIAMSupportedVer)
-}
-
 // IsRDSClusterSupported checks whether the aurora cluster is supported and logs
 // related info if not.
 func IsRDSClusterSupported(cluster *rds.DBCluster) bool {
@@ -412,107 +390,6 @@ func IsRDSClusterSupported(cluster *rds.DBCluster) bool {
 	return true
 }
 
-// IsRDSInstanceAvailable checks if the RDS instance is available.
-func IsRDSInstanceAvailable(instance *rds.DBInstance) bool {
-	// For a full list of status values, see:
-	// https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/accessing-monitoring.html
-	switch aws.StringValue(instance.DBInstanceStatus) {
-	// Statuses marked as "Billed" in the above guide.
-	case "available", "backing-up", "configuring-enhanced-monitoring",
-		"configuring-iam-database-auth", "configuring-log-exports",
-		"converting-to-vpc", "incompatible-option-group",
-		"incompatible-parameters", "maintenance", "modifying", "moving-to-vpc",
-		"rebooting", "resetting-master-credentials", "renaming", "restore-error",
-		"storage-full", "storage-optimization", "upgrading":
-		return true
-
-	// Statuses marked as "Not billed" in the above guide.
-	case "creating", "deleting", "failed",
-		"inaccessible-encryption-credentials", "incompatible-network",
-		"incompatible-restore":
-		return false
-
-	// Statuses marked as "Billed for storage" in the above guide.
-	case "inaccessible-encryption-credentials-recoverable", "starting",
-		"stopped", "stopping":
-		return false
-
-	// Statuses that have no billing information in the above guide, but
-	// believed to be unavailable.
-	case "insufficient-capacity":
-		return false
-
-	default:
-		log.Warnf("Unknown status type: %q. Assuming RDS instance %q is available.",
-			aws.StringValue(instance.DBInstanceStatus),
-			aws.StringValue(instance.DBInstanceIdentifier),
-		)
-		return true
-	}
-}
-
-// IsRDSClusterAvailable checks if the RDS cluster is available.
-func IsRDSClusterAvailable(cluster *rds.DBCluster) bool {
-	// For a full list of status values, see:
-	// https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/accessing-monitoring.html
-	switch aws.StringValue(cluster.Status) {
-	// Statuses marked as "Billed" in the above guide.
-	case "available", "backing-up", "backtracking", "failing-over",
-		"maintenance", "migrating", "modifying", "promoting", "renaming",
-		"resetting-master-credentials", "update-iam-db-auth", "upgrading":
-		return true
-
-	// Statuses marked as "Not billed" in the above guide.
-	case "cloning-failed", "creating", "deleting",
-		"inaccessible-encryption-credentials", "migration-failed":
-		return false
-
-	// Statuses marked as "Billed for storage" in the above guide.
-	case "starting", "stopped", "stopping":
-		return false
-
-	default:
-		log.Warnf("Unknown status type: %q. Assuming Aurora cluster %q is available.",
-			aws.StringValue(cluster.Status),
-			aws.StringValue(cluster.DBClusterIdentifier),
-		)
-		return true
-	}
-}
-
-// IsRedshiftClusterAvailable checks if the Redshift cluster is available.
-func IsRedshiftClusterAvailable(cluster *redshift.Cluster) bool {
-	// For a full list of status values, see:
-	// https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html#rs-mgmt-cluster-status
-	//
-	// Note that the Redshift guide does not specify billing information like
-	// the RDS and Aurora guides do. Most Redshift statuses are
-	// cross-referenced with similar statuses from RDS and Aurora guides to
-	// determine the availability.
-	//
-	// For "incompatible-xxx" statuses, the cluster is assumed to be available
-	// if the status is resulted by modifying the cluster, and the cluster is
-	// assumed to be unavailable if the cluster cannot be created or restored.
-	switch aws.StringValue(cluster.ClusterStatus) {
-	case "available", "available, prep-for-resize", "available, resize-cleanup",
-		"cancelling-resize", "final-snapshot", "modifying", "rebooting",
-		"renaming", "resizing", "rotating-keys", "storage-full", "updating-hsm",
-		"incompatible-parameters", "incompatible-hsm":
-		return true
-
-	case "creating", "deleting", "hardware-failure", "paused",
-		"incompatible-network":
-		return false
-
-	default:
-		log.Warnf("Unknown status type: %q. Assuming Redshift cluster %q is available.",
-			aws.StringValue(cluster.ClusterStatus),
-			aws.StringValue(cluster.ClusterIdentifier),
-		)
-		return true
-	}
-}
-
 // auroraMySQLVersion extracts aurora mysql version from engine version
 func auroraMySQLVersion(cluster *rds.DBCluster) string {
 	// version guide: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Updates.Versions.html
@@ -558,8 +435,6 @@ const (
 	RDSEngineMySQL = "mysql"
 	// RDSEnginePostgres is RDS engine name for Postgres instances.
 	RDSEnginePostgres = "postgres"
-	// RDSEngineMariaDB is RDS engine name for MariaDB instances.
-	RDSEngineMariaDB = "mariadb"
 	// RDSEngineAurora is RDS engine name for Aurora MySQL 5.6 compatible clusters.
 	RDSEngineAurora = "aurora"
 	// RDSEngineAuroraMySQL is RDS engine name for Aurora MySQL 5.7 compatible clusters.
@@ -577,9 +452,9 @@ const (
 	// RDSEndpointTypeReader is the endpoint that load-balances connections across the Aurora Replicas that are
 	// available in a RDS cluster.
 	RDSEndpointTypeReader RDSEndpointType = "reader"
-	// RDSEndpointTypeCustom is the endpoint that specifies one of the custom endpoints associated with the RDS cluster.
+	// RDSEndpointTypeCustom is the endpoint that specifieds one of the custom endpoints associated with the RDS cluster.
 	RDSEndpointTypeCustom RDSEndpointType = "custom"
-	// RDSEndpointTypeInstance is the endpoint of an RDS DB instance.
+	// RDSEndpointTypeInstance is the endpoint of a RDS DB instance.
 	RDSEndpointTypeInstance RDSEndpointType = "instance"
 )
 
diff --git a/lib/services/database_test.go b/lib/services/database_test.go
index 0e50fc7243930..c16862d506f3a 100644
--- a/lib/services/database_test.go
+++ b/lib/services/database_test.go
@@ -358,57 +358,8 @@ func TestIsRDSClusterSupported(t *testing.T) {
 				EngineVersion:       aws.String(test.engineVersion),
 			}
 
-			got, want := IsRDSClusterSupported(cluster), test.isSupported
-			require.Equal(t, want, got, "IsRDSClusterSupported = %v, want = %v", got, want)
-		})
-	}
-}
-
-func TestIsRDSInstanceSupported(t *testing.T) {
-	tests := []struct {
-		name          string
-		engine        string
-		engineVersion string
-		isSupported   bool
-	}{
-		{
-			name:          "non-MariaDB engine",
-			engine:        RDSEnginePostgres,
-			engineVersion: "13.3",
-			isSupported:   true,
-		},
-		{
-			name:          "unsupported MariaDB",
-			engine:        RDSEngineMariaDB,
-			engineVersion: "10.3.28",
-			isSupported:   false,
-		},
-		{
-			name:          "min supported version",
-			engine:        RDSEngineMariaDB,
-			engineVersion: "10.6.2",
-			isSupported:   true,
-		},
-		{
-			name:          "supported version",
-			engine:        RDSEngineMariaDB,
-			engineVersion: "10.8.0",
-			isSupported:   true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			cluster := &rds.DBInstance{
-				DBInstanceArn:       aws.String("arn:aws:rds:us-east-1:1234567890:instance:test"),
-				DBClusterIdentifier: aws.String(test.name),
-				DbiResourceId:       aws.String(uuid.New().String()),
-				Engine:              aws.String(test.engine),
-				EngineVersion:       aws.String(test.engineVersion),
-			}
+			require.Equal(t, test.isSupported, IsRDSClusterSupported(cluster))
 
-			got, want := IsRDSInstanceSupported(cluster), test.isSupported
-			require.Equal(t, want, got, "IsRDSInstanceSupported = %v, want = %v", got, want)
 		})
 	}
 }
diff --git a/lib/services/desktop.go b/lib/services/desktop.go
index 5ef6089109d17..a4cc25b01e340 100644
--- a/lib/services/desktop.go
+++ b/lib/services/desktop.go
@@ -33,7 +33,6 @@ type WindowsDesktops interface {
 	UpsertWindowsDesktop(ctx context.Context, desktop types.WindowsDesktop) error
 	DeleteWindowsDesktop(ctx context.Context, hostID, name string) error
 	DeleteAllWindowsDesktops(context.Context) error
-	ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error)
 }
 
 // MarshalWindowsDesktop marshals the WindowsDesktop resource to JSON.
diff --git a/lib/services/local/desktops.go b/lib/services/local/desktops.go
index 1eae39b1cc566..3e0f78f381fb5 100644
--- a/lib/services/local/desktops.go
+++ b/lib/services/local/desktops.go
@@ -163,73 +163,6 @@ func (s *WindowsDesktopService) DeleteAllWindowsDesktops(ctx context.Context) er
 	return nil
 }
 
-// ListWindowsDesktops returns all Windows desktops matching filter.
-func (s *WindowsDesktopService) ListWindowsDesktops(ctx context.Context, req types.ListWindowsDesktopsRequest) (*types.ListWindowsDesktopsResponse, error) {
-	reqLimit := req.Limit
-	if reqLimit <= 0 {
-		return nil, trace.BadParameter("nonpositive parameter limit")
-	}
-
-	keyPrefix := []string{windowsDesktopsPrefix}
-	rangeStart := backend.Key(append(keyPrefix, req.StartKey)...)
-	rangeEnd := backend.RangeEnd(backend.Key(keyPrefix...))
-	filter := services.MatchResourceFilter{
-		ResourceKind:        types.KindWindowsDesktop,
-		Labels:              req.Labels,
-		SearchKeywords:      req.SearchKeywords,
-		PredicateExpression: req.PredicateExpression,
-	}
-
-	// Get most limit+1 results to determine if there will be a next key.
-	maxLimit := reqLimit + 1
-	var desktops []types.WindowsDesktop
-	if err := backend.IterateRange(ctx, s.Backend, rangeStart, rangeEnd, maxLimit, func(items []backend.Item) (stop bool, err error) {
-		for _, item := range items {
-			if len(desktops) == maxLimit {
-				break
-			}
-
-			desktop, err := services.UnmarshalWindowsDesktop(item.Value,
-				services.WithResourceID(item.ID), services.WithExpires(item.Expires))
-			if err != nil {
-				return false, trace.Wrap(err)
-			}
-
-			if !req.WindowsDesktopFilter.Match(desktop) {
-				continue
-			}
-
-			switch match, err := services.MatchResourceByFilters(desktop, filter); {
-			case err != nil:
-				return false, trace.Wrap(err)
-			case match:
-				desktops = append(desktops, desktop)
-			}
-		}
-
-		return len(desktops) == maxLimit, nil
-	}); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// If both HostID and Name are set in the filter only one desktop should be expected
-	if req.HostID != "" && req.Name != "" && len(desktops) == 0 {
-		return nil, trace.NotFound("windows desktop \"%s/%s\" doesn't exist", req.HostID, req.Name)
-	}
-
-	var nextKey string
-	if len(desktops) > reqLimit {
-		nextKey = backend.GetPaginationKey(desktops[len(desktops)-1])
-		// Truncate the last item that was used to determine next row existence.
-		desktops = desktops[:reqLimit]
-	}
-
-	return &types.ListWindowsDesktopsResponse{
-		Desktops: desktops,
-		NextKey:  nextKey,
-	}, nil
-}
-
 const (
 	windowsDesktopsPrefix = "windowsDesktop"
 )
diff --git a/lib/services/local/desktops_test.go b/lib/services/local/desktops_test.go
deleted file mode 100644
index 3500b8b53b73f..0000000000000
--- a/lib/services/local/desktops_test.go
+++ /dev/null
@@ -1,213 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package local
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/backend"
-	"github.com/gravitational/teleport/lib/backend/lite"
-
-	"github.com/jonboulle/clockwork"
-	"github.com/stretchr/testify/require"
-)
-
-func TestListWindowsDesktops(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	liteBackend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
-		Clock: clockwork.NewFakeClock(),
-	})
-	require.NoError(t, err)
-
-	service := NewWindowsDesktopService(liteBackend)
-
-	// Initially we expect no desktops.
-	out, err := service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
-		Limit: 10,
-	})
-	require.NoError(t, err)
-	require.Empty(t, out.Desktops)
-	require.Empty(t, out.NextKey)
-
-	// Upsert some windows desktops.
-
-	// With label.
-	testLabel := map[string]string{"env": "test"}
-	d1, err := types.NewWindowsDesktopV3("apple", testLabel, types.WindowsDesktopSpecV3{Addr: "_"})
-	require.NoError(t, err)
-	require.NoError(t, service.CreateWindowsDesktop(ctx, d1))
-
-	d2, err := types.NewWindowsDesktopV3("banana", testLabel, types.WindowsDesktopSpecV3{Addr: "_"})
-	require.NoError(t, err)
-	require.NoError(t, service.CreateWindowsDesktop(ctx, d2))
-
-	// Without labels.
-	d3, err := types.NewWindowsDesktopV3("carrot", nil, types.WindowsDesktopSpecV3{Addr: "_", HostID: "test-host-id"})
-	require.NoError(t, err)
-	require.NoError(t, service.CreateWindowsDesktop(ctx, d3))
-
-	// Test fetch all.
-	out, err = service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
-		Limit: 10,
-	})
-	require.NoError(t, err)
-	require.Empty(t, out.NextKey)
-	require.Empty(t, cmp.Diff([]types.WindowsDesktop{d1, d2, d3}, out.Desktops,
-		cmpopts.IgnoreFields(types.Metadata{}, "ID"),
-	))
-
-	// Test pagination.
-
-	// First fetch.
-	resp, err := service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
-		Limit: 1,
-	})
-	require.NoError(t, err)
-	require.Len(t, resp.Desktops, 1)
-	require.Equal(t, out.Desktops[0], resp.Desktops[0])
-	require.Equal(t, backend.GetPaginationKey(out.Desktops[1]), resp.NextKey)
-
-	// Middle fetch.
-	resp, err = service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
-		Limit:    1,
-		StartKey: resp.NextKey,
-	})
-	require.NoError(t, err)
-	require.Len(t, resp.Desktops, 1)
-	require.Equal(t, out.Desktops[1], resp.Desktops[0])
-	require.Equal(t, backend.GetPaginationKey(out.Desktops[2]), resp.NextKey)
-
-	// Last fetch.
-	resp, err = service.ListWindowsDesktops(ctx, types.ListWindowsDesktopsRequest{
-		Limit:    1,
-		StartKey: resp.NextKey,
-	})
-	require.NoError(t, err)
-	require.Len(t, resp.Desktops, 1)
-	require.Equal(t, out.Desktops[2], resp.Desktops[0])
-	require.Empty(t, resp.NextKey)
-}
-
-func TestListWindowsDesktops_Filters(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-
-	liteBackend, err := lite.NewWithConfig(ctx, lite.Config{
-		Path:  t.TempDir(),
-		Clock: clockwork.NewFakeClock(),
-	})
-	require.NoError(t, err)
-
-	service := NewWindowsDesktopService(liteBackend)
-
-	// Upsert some windows desktops.
-
-	// With label.
-	testLabel := map[string]string{"env": "test"}
-	d1, err := types.NewWindowsDesktopV3("banana", testLabel, types.WindowsDesktopSpecV3{Addr: "_", HostID: "test-host-id"})
-	require.NoError(t, err)
-	require.NoError(t, service.CreateWindowsDesktop(ctx, d1))
-
-	d2, err := types.NewWindowsDesktopV3("banana", testLabel, types.WindowsDesktopSpecV3{Addr: "_"})
-	require.NoError(t, err)
-	require.NoError(t, service.CreateWindowsDesktop(ctx, d2))
-
-	// Without labels.
-	d3, err := types.NewWindowsDesktopV3("carrot", nil, types.WindowsDesktopSpecV3{Addr: "_", HostID: "test-host-id"})
-	require.NoError(t, err)
-	require.NoError(t, service.CreateWindowsDesktop(ctx, d3))
-
-	tests := []struct {
-		name    string
-		filter  types.ListWindowsDesktopsRequest
-		wantErr bool
-	}{
-		{
-			name: "NOK non-matching host id and name",
-			filter: types.ListWindowsDesktopsRequest{
-				Limit: 10,
-				WindowsDesktopFilter: types.WindowsDesktopFilter{
-					HostID: "no-match",
-					Name:   "no-match",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name:    "NOK invalid limit",
-			filter:  types.ListWindowsDesktopsRequest{},
-			wantErr: true,
-		},
-		{
-			name: "matching host id",
-			filter: types.ListWindowsDesktopsRequest{
-				Limit:                5,
-				WindowsDesktopFilter: types.WindowsDesktopFilter{HostID: "test-host-id"},
-			},
-		},
-		{
-			name: "matching name",
-			filter: types.ListWindowsDesktopsRequest{
-				Limit:                5,
-				WindowsDesktopFilter: types.WindowsDesktopFilter{Name: "banana"},
-			},
-		},
-		{
-			name: "with search",
-			filter: types.ListWindowsDesktopsRequest{
-				Limit:          5,
-				SearchKeywords: []string{"env", "test"},
-			},
-		},
-		{
-			name: "with labels",
-			filter: types.ListWindowsDesktopsRequest{
-				Limit:  5,
-				Labels: testLabel,
-			},
-		},
-		{
-			name: "with predicate",
-			filter: types.ListWindowsDesktopsRequest{
-				Limit:               5,
-				PredicateExpression: `labels.env == "test"`,
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			resp, err := service.ListWindowsDesktops(ctx, tc.filter)
-
-			if tc.wantErr {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-				require.Len(t, resp.Desktops, 2)
-			}
-		})
-	}
-}
diff --git a/lib/services/local/perf_test.go b/lib/services/local/perf_test.go
index 8b05a159ae686..8f790824c40de 100644
--- a/lib/services/local/perf_test.go
+++ b/lib/services/local/perf_test.go
@@ -19,6 +19,8 @@ package local
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
+	"os"
 	"testing"
 
 	apidefaults "github.com/gravitational/teleport/api/defaults"
@@ -68,7 +70,9 @@ func BenchmarkGetNodes(b *testing.B) {
 				bk, err = memory.New(memory.Config{})
 				require.NoError(b, err)
 			} else {
-				dir := b.TempDir()
+				dir, err := ioutil.TempDir("", "teleport")
+				require.NoError(b, err)
+				defer os.RemoveAll(dir)
 
 				bk, err = lite.NewWithConfig(context.TODO(), lite.Config{
 					Path: dir,
diff --git a/lib/services/local/presence.go b/lib/services/local/presence.go
index b2d4f8b8f3b5d..4e4b37cd2b8c7 100644
--- a/lib/services/local/presence.go
+++ b/lib/services/local/presence.go
@@ -798,13 +798,6 @@ func (s *PresenceService) DeleteAllRemoteClusters() error {
 	return trace.Wrap(err)
 }
 
-// this combination of backoff parameters leads to worst-case total time spent
-// in backoff between 1200ms and 2400ms depending on jitter.  tests are in
-// place to verify that this is sufficient to resolve a 20-lease contention
-// event, which is worse than should ever occur in practice.
-const baseBackoff = time.Millisecond * 300
-const leaseRetryAttempts int64 = 6
-
 // AcquireSemaphore attempts to acquire the specified semaphore.  AcquireSemaphore will automatically handle
 // retry on contention.  If the semaphore has already reached MaxLeases, or there is too much contention,
 // a LimitExceeded error is returned (contention in this context means concurrent attempts to update the
@@ -812,6 +805,13 @@ const leaseRetryAttempts int64 = 6
 // is the only semaphore method that handles retries internally.  This is because this method both blocks
 // user-facing operations, and contains multiple different potential contention points.
 func (s *PresenceService) AcquireSemaphore(ctx context.Context, req types.AcquireSemaphoreRequest) (*types.SemaphoreLease, error) {
+	// this combination of backoff parameters leads to worst-case total time spent
+	// in backoff between 1200ms and 2400ms depending on jitter.  tests are in
+	// place to verify that this is sufficient to resolve a 20-lease contention
+	// event, which is worse than should ever occur in practice.
+	const baseBackoff = time.Millisecond * 300
+	const acquireAttempts int64 = 6
+
 	if err := req.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -826,7 +826,7 @@ func (s *PresenceService) AcquireSemaphore(ctx context.Context, req types.Acquir
 	key := backend.Key(semaphoresPrefix, req.SemaphoreKind, req.SemaphoreName)
 
 Acquire:
-	for i := int64(0); i < leaseRetryAttempts; i++ {
+	for i := int64(0); i < acquireAttempts; i++ {
 		if i > 0 {
 			// Not our first attempt, apply backoff. If we knew that we were only in
 			// contention with one other acquire attempt we could retry immediately
@@ -997,59 +997,40 @@ func (s *PresenceService) CancelSemaphoreLease(ctx context.Context, lease types.
 		return trace.BadParameter("the lease %v has expired at %v", lease.LeaseID, lease.Expires)
 	}
 
-	for i := int64(0); i < leaseRetryAttempts; i++ {
-		if i > 0 {
-			// Not our first attempt, apply backoff. If we knew that we were only in
-			// contention with one other cancel attempt we could retry immediately
-			// since we got here because some other attempt *succeeded*.  It is safer,
-			// however, to assume that we are under high contention and attempt to
-			// spread out retries via random backoff.
-			select {
-			case <-time.After(s.jitter(baseBackoff * time.Duration(i))):
-			case <-ctx.Done():
-				return trace.Wrap(ctx.Err())
-			}
-		}
-
-		key := backend.Key(semaphoresPrefix, lease.SemaphoreKind, lease.SemaphoreName)
-		item, err := s.Get(ctx, key)
-		if err != nil {
-			return trace.Wrap(err)
-		}
+	key := backend.Key(semaphoresPrefix, lease.SemaphoreKind, lease.SemaphoreName)
+	item, err := s.Get(ctx, key)
+	if err != nil {
+		return trace.Wrap(err)
+	}
 
-		sem, err := services.UnmarshalSemaphore(item.Value)
-		if err != nil {
-			return trace.Wrap(err)
-		}
+	sem, err := services.UnmarshalSemaphore(item.Value)
+	if err != nil {
+		return trace.Wrap(err)
+	}
 
-		if err := sem.Cancel(lease); err != nil {
-			return trace.Wrap(err)
-		}
+	if err := sem.Cancel(lease); err != nil {
+		return trace.Wrap(err)
+	}
 
-		newValue, err := services.MarshalSemaphore(sem)
-		if err != nil {
-			return trace.Wrap(err)
-		}
+	newValue, err := services.MarshalSemaphore(sem)
+	if err != nil {
+		return trace.Wrap(err)
+	}
 
-		newItem := backend.Item{
-			Key:     key,
-			Value:   newValue,
-			Expires: sem.Expiry(),
-		}
+	newItem := backend.Item{
+		Key:     key,
+		Value:   newValue,
+		Expires: sem.Expiry(),
+	}
 
-		_, err = s.CompareAndSwap(ctx, *item, newItem)
-		switch {
-		case err == nil:
-			return nil
-		case trace.IsCompareFailed(err):
-			// semaphore was concurrently updated
-			continue
-		default:
-			return trace.Wrap(err)
+	_, err = s.CompareAndSwap(ctx, *item, newItem)
+	if err != nil {
+		if trace.IsCompareFailed(err) {
+			return trace.CompareFailed("semaphore %v/%v has been concurrently updated, try again", sem.GetSubKind(), sem.GetName())
 		}
+		return trace.Wrap(err)
 	}
-
-	return trace.LimitExceeded("too much contention on semaphore %s/%s", lease.SemaphoreKind, lease.SemaphoreName)
+	return nil
 }
 
 // GetSemaphores returns all semaphores matching the supplied filter.
diff --git a/lib/services/local/presence_test.go b/lib/services/local/presence_test.go
index 88c3e91592d0a..ae9a152cea679 100644
--- a/lib/services/local/presence_test.go
+++ b/lib/services/local/presence_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
+	"gopkg.in/check.v1"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
@@ -39,14 +40,26 @@ import (
 	"github.com/gravitational/trace"
 )
 
-func TestTrustedClusterCRUD(t *testing.T) {
-	ctx := context.Background()
+type PresenceSuite struct {
+	bk backend.Backend
+}
 
-	bk, err := lite.New(ctx, backend.Params{"path": t.TempDir()})
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, bk.Close()) })
+var _ = check.Suite(&PresenceSuite{})
 
-	presenceBackend := NewPresenceService(bk)
+func (s *PresenceSuite) SetUpTest(c *check.C) {
+	var err error
+
+	s.bk, err = lite.New(context.TODO(), backend.Params{"path": c.MkDir()})
+	c.Assert(err, check.IsNil)
+}
+
+func (s *PresenceSuite) TearDownTest(c *check.C) {
+	c.Assert(s.bk.Close(), check.IsNil)
+}
+
+func (s *PresenceSuite) TestTrustedClusterCRUD(c *check.C) {
+	ctx := context.Background()
+	presenceBackend := NewPresenceService(s.bk)
 
 	tc, err := types.NewTrustedCluster("foo", types.TrustedClusterSpecV2{
 		Enabled:              true,
@@ -55,7 +68,7 @@ func TestTrustedClusterCRUD(t *testing.T) {
 		ProxyAddress:         "quux",
 		ReverseTunnelAddress: "quuz",
 	})
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// we just insert this one for get all
 	stc, err := types.NewTrustedCluster("bar", types.TrustedClusterSpecV2{
@@ -65,37 +78,37 @@ func TestTrustedClusterCRUD(t *testing.T) {
 		ProxyAddress:         "quuz",
 		ReverseTunnelAddress: "corge",
 	})
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// create trusted clusters
 	_, err = presenceBackend.UpsertTrustedCluster(ctx, tc)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 	_, err = presenceBackend.UpsertTrustedCluster(ctx, stc)
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// get trusted cluster make sure it's correct
 	gotTC, err := presenceBackend.GetTrustedCluster(ctx, "foo")
-	require.NoError(t, err)
-	require.Equal(t, "foo", gotTC.GetName())
-	require.True(t, gotTC.GetEnabled())
-	require.EqualValues(t, []string{"bar", "baz"}, gotTC.GetRoles())
-	require.Equal(t, "qux", gotTC.GetToken())
-	require.Equal(t, "quux", gotTC.GetProxyAddress())
-	require.Equal(t, "quuz", gotTC.GetReverseTunnelAddress())
+	c.Assert(err, check.IsNil)
+	c.Assert(gotTC.GetName(), check.Equals, "foo")
+	c.Assert(gotTC.GetEnabled(), check.Equals, true)
+	c.Assert(gotTC.GetRoles(), check.DeepEquals, []string{"bar", "baz"})
+	c.Assert(gotTC.GetToken(), check.Equals, "qux")
+	c.Assert(gotTC.GetProxyAddress(), check.Equals, "quux")
+	c.Assert(gotTC.GetReverseTunnelAddress(), check.Equals, "quuz")
 
 	// get all clusters
 	allTC, err := presenceBackend.GetTrustedClusters(ctx)
-	require.NoError(t, err)
-	require.Len(t, allTC, 2)
+	c.Assert(err, check.IsNil)
+	c.Assert(allTC, check.HasLen, 2)
 
 	// delete cluster
 	err = presenceBackend.DeleteTrustedCluster(ctx, "foo")
-	require.NoError(t, err)
+	c.Assert(err, check.IsNil)
 
 	// make sure it's really gone
 	_, err = presenceBackend.GetTrustedCluster(ctx, "foo")
-	require.Error(t, err)
-	require.ErrorIs(t, err, trace.NotFound("key /trustedclusters/foo is not found"))
+	c.Assert(err, check.NotNil)
+	c.Assert(trace.IsNotFound(err), check.Equals, true)
 }
 
 // TestApplicationServersCRUD verifies backend operations on app servers.
@@ -1117,63 +1130,3 @@ func TestFakePaginate_TotalCount(t *testing.T) {
 		require.Equal(t, 3, resp.TotalCount)
 	})
 }
-
-func TestPresenceService_CancelSemaphoreLease(t *testing.T) {
-	ctx := context.Background()
-	bk, err := lite.New(ctx, backend.Params{"path": t.TempDir()})
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, bk.Close()) })
-	presence := NewPresenceService(bk)
-
-	maxLeases := 5
-	leases := make([]*types.SemaphoreLease, maxLeases)
-
-	// Acquire max number of leases
-	request := types.AcquireSemaphoreRequest{
-		SemaphoreKind: "test",
-		SemaphoreName: "test",
-		MaxLeases:     int64(maxLeases),
-		Expires:       time.Now().Add(time.Hour),
-		Holder:        "test",
-	}
-	for i := range leases {
-		lease, err := presence.AcquireSemaphore(ctx, request)
-		require.NoError(t, err)
-		require.NotNil(t, lease)
-
-		leases[i] = lease
-	}
-
-	// Validate a semaphore exists with the correct number of leases
-	semaphores, err := presence.GetSemaphores(ctx, types.SemaphoreFilter{
-		SemaphoreKind: "test",
-		SemaphoreName: "test",
-	})
-	require.NoError(t, err)
-	require.Len(t, semaphores, 1)
-	require.Len(t, semaphores[0].LeaseRefs(), maxLeases)
-
-	// Cancel the leases concurrently and ensure that all
-	// cancellations are honored
-	errCh := make(chan error, maxLeases)
-	for _, l := range leases {
-		l := l
-		go func() {
-			errCh <- presence.CancelSemaphoreLease(ctx, *l)
-		}()
-	}
-
-	for i := 0; i < maxLeases; i++ {
-		err := <-errCh
-		require.NoError(t, err)
-	}
-
-	// Validate the semaphore still exists but all leases were removed
-	semaphores, err = presence.GetSemaphores(ctx, types.SemaphoreFilter{
-		SemaphoreKind: "test",
-		SemaphoreName: "test",
-	})
-	require.NoError(t, err)
-	require.Len(t, semaphores, 1)
-	require.Empty(t, semaphores[0].LeaseRefs())
-}
diff --git a/lib/services/local/session.go b/lib/services/local/session.go
index ed365cb2f36a2..a0e761cec64fc 100644
--- a/lib/services/local/session.go
+++ b/lib/services/local/session.go
@@ -116,8 +116,12 @@ func (r *webSessions) Get(ctx context.Context, req types.GetWebSessionRequest) (
 	if err != nil && !trace.IsNotFound(err) {
 		return nil, trace.Wrap(err)
 	}
-
-	return session, trace.Wrap(err)
+	if session != nil {
+		return session, nil
+	}
+	// DELETE IN 7.x:
+	// Return web sessions from a legacy path under /web/users/<user>/sessions/<id>
+	return getLegacyWebSession(ctx, r.backend, req.User, req.SessionID)
 }
 
 // List gets all regular web sessions.
@@ -286,6 +290,25 @@ type webTokens struct {
 	log     logrus.FieldLogger
 }
 
+// DELETE in 7.x.
+// getLegacySession returns the web session for the specified user/sessionID
+// under a legacy path /web/users/<user>/sessions/<id>
+func getLegacyWebSession(ctx context.Context, backend backend.Backend, user, sessionID string) (types.WebSession, error) {
+	item, err := backend.Get(ctx, legacyWebSessionKey(user, sessionID))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	session, err := services.UnmarshalWebSession(item.Value)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	// this is for backwards compatibility to ensure we
+	// always have these values
+	session.SetUser(user)
+	session.SetName(sessionID)
+	return session, nil
+}
+
 func webSessionKey(sessionID string) (key []byte) {
 	return backend.Key(webPrefix, sessionsPrefix, sessionID)
 }
@@ -293,3 +316,7 @@ func webSessionKey(sessionID string) (key []byte) {
 func webTokenKey(token string) (key []byte) {
 	return backend.Key(webPrefix, tokensPrefix, token)
 }
+
+func legacyWebSessionKey(user, sessionID string) (key []byte) {
+	return backend.Key(webPrefix, usersPrefix, user, sessionsPrefix, sessionID)
+}
diff --git a/lib/services/local/trust.go b/lib/services/local/trust.go
index 81a4907354889..9d71b45e51e6f 100644
--- a/lib/services/local/trust.go
+++ b/lib/services/local/trust.go
@@ -77,7 +77,7 @@ func (s *CA) UpsertCertAuthority(ca types.CertAuthority) error {
 	}
 
 	// try to skip writes that would have no effect
-	if existing, err := s.GetCertAuthority(context.TODO(), types.CertAuthID{
+	if existing, err := s.GetCertAuthority(types.CertAuthID{
 		Type:       ca.GetType(),
 		DomainName: ca.GetClusterName(),
 	}, true); err == nil {
@@ -200,7 +200,7 @@ func (s *CA) ActivateCertAuthority(id types.CertAuthID) error {
 // DeactivateCertAuthority moves a CertAuthority from the normal list to
 // the deactivated list.
 func (s *CA) DeactivateCertAuthority(id types.CertAuthID) error {
-	certAuthority, err := s.GetCertAuthority(context.TODO(), id, true)
+	certAuthority, err := s.GetCertAuthority(id, true)
 	if err != nil {
 		if trace.IsNotFound(err) {
 			return trace.NotFound("can not deactivate cert authority %q which does not exist", id.DomainName)
@@ -234,11 +234,11 @@ func (s *CA) DeactivateCertAuthority(id types.CertAuthID) error {
 
 // GetCertAuthority returns certificate authority by given id. Parameter loadSigningKeys
 // controls if signing keys are loaded
-func (s *CA) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
+func (s *CA) GetCertAuthority(id types.CertAuthID, loadSigningKeys bool, opts ...services.MarshalOption) (types.CertAuthority, error) {
 	if err := id.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	item, err := s.Get(ctx, backend.Key(authoritiesPrefix, string(id.Type), id.DomainName))
+	item, err := s.Get(context.TODO(), backend.Key(authoritiesPrefix, string(id.Type), id.DomainName))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -263,14 +263,14 @@ func setSigningKeys(ca types.CertAuthority, loadSigningKeys bool) {
 
 // GetCertAuthorities returns a list of authorities of a given type
 // loadSigningKeys controls whether signing keys should be loaded or not
-func (s *CA) GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (s *CA) GetCertAuthorities(caType types.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error) {
 	if err := caType.Check(); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	// Get all items in the bucket.
 	startKey := backend.Key(authoritiesPrefix, string(caType))
-	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
+	result, err := s.GetRange(context.TODO(), startKey, backend.RangeEnd(startKey), backend.NoLimit)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/services/local/users.go b/lib/services/local/users.go
index 2f64cd2c8ce70..934952fecd2d1 100644
--- a/lib/services/local/users.go
+++ b/lib/services/local/users.go
@@ -388,8 +388,6 @@ func (s *IdentityService) DeleteUser(ctx context.Context, user string) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	// each user has multiple related entries in the backend,
-	// so use DeleteRange to make sure we get them all
 	startKey := backend.Key(webPrefix, usersPrefix, user)
 	err = s.DeleteRange(ctx, startKey, backend.RangeEnd(startKey))
 	return trace.Wrap(err)
diff --git a/lib/services/local/users_test.go b/lib/services/local/users_test.go
index 424d78d8e09d9..d0dd62336a993 100644
--- a/lib/services/local/users_test.go
+++ b/lib/services/local/users_test.go
@@ -26,7 +26,6 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/services/local"
 	"github.com/gravitational/trace"
@@ -61,6 +60,7 @@ func TestRecoveryCodesCRUD(t *testing.T) {
 	}
 
 	t.Run("upsert, get, delete recovery codes", func(t *testing.T) {
+		t.Parallel()
 		username := "someuser"
 
 		rc1, err := types.NewRecoveryCodes(mockedCodes, clock.Now(), username)
@@ -100,6 +100,7 @@ func TestRecoveryCodesCRUD(t *testing.T) {
 	})
 
 	t.Run("deleting user deletes recovery codes", func(t *testing.T) {
+		t.Parallel()
 		username := "someuser2"
 
 		// Create a user.
@@ -123,35 +124,6 @@ func TestRecoveryCodesCRUD(t *testing.T) {
 		_, err = identity.GetRecoveryCodes(ctx, username, true /* withSecrets */)
 		require.True(t, trace.IsNotFound(err))
 	})
-
-	t.Run("deleting user ending with 'z'", func(t *testing.T) {
-		// enable the sanitizer, and use a key ending with z,
-		// which will produce an invalid backend key when we
-		// compute the end range
-		username := "xyz"
-		identity.Backend = backend.NewSanitizer(identity.Backend)
-
-		// Create a user.
-		userResource := &types.UserV2{}
-		userResource.SetName(username)
-		err := identity.CreateUser(userResource)
-		require.NoError(t, err)
-
-		// Test codes exist for user.
-		rc1, err := types.NewRecoveryCodes(mockedCodes, clock.Now(), username)
-		require.NoError(t, err)
-		err = identity.UpsertRecoveryCodes(ctx, username, rc1)
-		require.NoError(t, err)
-		codes, err := identity.GetRecoveryCodes(ctx, username, true /* withSecrets */)
-		require.NoError(t, err)
-		require.ElementsMatch(t, mockedCodes, codes.GetCodes())
-
-		// Test deletion of recovery code along with user.
-		err = identity.DeleteUser(ctx, username)
-		require.NoError(t, err)
-		_, err = identity.GetRecoveryCodes(ctx, username, true /* withSecrets */)
-		require.True(t, trace.IsNotFound(err))
-	})
 }
 
 func TestRecoveryAttemptsCRUD(t *testing.T) {
@@ -166,6 +138,7 @@ func TestRecoveryAttemptsCRUD(t *testing.T) {
 	time3 := time1.Add(4 * time.Minute)
 
 	t.Run("create, get, and delete recovery attempts", func(t *testing.T) {
+		t.Parallel()
 		username := "someuser"
 
 		// Test creation of recovery attempt.
@@ -193,6 +166,7 @@ func TestRecoveryAttemptsCRUD(t *testing.T) {
 	})
 
 	t.Run("deleting user deletes recovery attempts", func(t *testing.T) {
+		t.Parallel()
 		username := "someuser2"
 
 		// Create a user, to test deletion of recovery attempts with user.
diff --git a/lib/services/matchers.go b/lib/services/matchers.go
index b734adfbfb1d8..d82a4dde30e51 100644
--- a/lib/services/matchers.go
+++ b/lib/services/matchers.go
@@ -72,7 +72,7 @@ func MatchResourceByFilters(resource types.ResourceWithLabels, filter MatchResou
 	// We assume when filtering for services like KubeService, AppServer, and DatabaseServer
 	// the user is wanting to filter the contained resource ie. KubeClusters, Application, and Database.
 	switch filter.ResourceKind {
-	case types.KindNode, types.KindWindowsDesktop, types.KindKubernetesCluster:
+	case types.KindNode:
 		specResource = resource
 
 	case types.KindKubeService:
diff --git a/lib/services/matchers_test.go b/lib/services/matchers_test.go
index 1e6edf23f43d9..cfd225ae49b6d 100644
--- a/lib/services/matchers_test.go
+++ b/lib/services/matchers_test.go
@@ -451,20 +451,6 @@ func TestMatchResourceByFilters(t *testing.T) {
 				PredicateExpression: filterExpression,
 			},
 		},
-		{
-			name: "kube cluster",
-			resource: func() types.ResourceWithLabels {
-				cluster, err := types.NewKubernetesClusterV3FromLegacyCluster("_", &types.KubernetesCluster{
-					Name: "foo",
-				})
-				require.NoError(t, err)
-				return cluster
-			},
-			filters: MatchResourceFilter{
-				ResourceKind:        types.KindKubernetesCluster,
-				PredicateExpression: filterExpression,
-			},
-		},
 		{
 			name: "node",
 			resource: func() types.ResourceWithLabels {
@@ -477,18 +463,6 @@ func TestMatchResourceByFilters(t *testing.T) {
 				PredicateExpression: filterExpression,
 			},
 		},
-		{
-			name: "windows desktop",
-			resource: func() types.ResourceWithLabels {
-				desktop, err := types.NewWindowsDesktopV3("foo", nil, types.WindowsDesktopSpecV3{Addr: "_"})
-				require.NoError(t, err)
-				return desktop
-			},
-			filters: MatchResourceFilter{
-				ResourceKind:        types.KindWindowsDesktop,
-				PredicateExpression: filterExpression,
-			},
-		},
 	}
 
 	for _, tc := range testcases {
diff --git a/lib/services/reconciler.go b/lib/services/reconciler.go
index 84ea4ca40eb37..d99071c5bd4e0 100644
--- a/lib/services/reconciler.go
+++ b/lib/services/reconciler.go
@@ -30,9 +30,9 @@ type ReconcilerConfig struct {
 	// Matcher is used to match resources.
 	Matcher Matcher
 	// GetCurrentResources returns currently registered resources.
-	GetCurrentResources func() types.ResourcesWithLabelsMap
+	GetCurrentResources func() types.ResourcesWithLabels
 	// GetNewResources returns resources to compare current resources against.
-	GetNewResources func() types.ResourcesWithLabelsMap
+	GetNewResources func() types.ResourcesWithLabels
 	// OnCreate is called when a new resource is detected.
 	OnCreate func(context.Context, types.ResourceWithLabels) error
 	// OnUpdate is called when an existing resource is updated.
@@ -83,7 +83,7 @@ func NewReconciler(cfg ReconcilerConfig) (*Reconciler, error) {
 	}, nil
 }
 
-// Reconciler reconciles currently registered resources with new resources and
+// Reconcile reconciles currently registered resources with new resources and
 // creates/updates/deletes them appropriately.
 //
 // It's used in combination with watchers by agents (app, database, desktop)
@@ -123,9 +123,9 @@ func (r *Reconciler) Reconcile(ctx context.Context) error {
 
 // processRegisteredResource checks the specified registered resource against the
 // new list of resources.
-func (r *Reconciler) processRegisteredResource(ctx context.Context, newResources types.ResourcesWithLabelsMap, registered types.ResourceWithLabels) error {
+func (r *Reconciler) processRegisteredResource(ctx context.Context, newResources types.ResourcesWithLabels, registered types.ResourceWithLabels) error {
 	// See if this registered resource is still present among "new" resources.
-	if new := newResources[registered.GetName()]; new != nil {
+	if new := newResources.Find(registered.GetName()); new != nil {
 		return nil
 	}
 
@@ -139,10 +139,10 @@ func (r *Reconciler) processRegisteredResource(ctx context.Context, newResources
 
 // processNewResource checks the provided new resource agsinst currently
 // registered resources.
-func (r *Reconciler) processNewResource(ctx context.Context, currentResources types.ResourcesWithLabelsMap, new types.ResourceWithLabels) error {
+func (r *Reconciler) processNewResource(ctx context.Context, currentResources types.ResourcesWithLabels, new types.ResourceWithLabels) error {
 	// First see if the resource is already registered and if not, whether it
 	// matches the selector labels and should be registered.
-	registered := currentResources[new.GetName()]
+	registered := currentResources.Find(new.GetName())
 	if registered == nil {
 		if r.cfg.Matcher(new) {
 			r.log.Infof("%v %v matches, creating.", new.GetKind(), new.GetName())
@@ -155,9 +155,9 @@ func (r *Reconciler) processNewResource(ctx context.Context, currentResources ty
 		return nil
 	}
 
-	// Don't overwrite resource of a different origin (e.g., keep static resource from config and ignore dynamic resource)
+	// Don't overwrite resource of a different origin.
 	if registered.Origin() != new.Origin() {
-		r.log.Warnf("%v has different origin (%v vs %v), not updating.", new.GetName(),
+		r.log.Debugf("%v has different origin (%v vs %v), not updating.", new.GetName(),
 			new.Origin(), registered.Origin())
 		return nil
 	}
diff --git a/lib/services/reconciler_test.go b/lib/services/reconciler_test.go
index 2aba193a1ba8e..7fe5ef4e62701 100644
--- a/lib/services/reconciler_test.go
+++ b/lib/services/reconciler_test.go
@@ -156,11 +156,11 @@ func TestReconciler(t *testing.T) {
 				Matcher: func(rwl types.ResourceWithLabels) bool {
 					return MatchResourceLabels(test.selectors, rwl)
 				},
-				GetCurrentResources: func() types.ResourcesWithLabelsMap {
-					return test.registeredResources.ToMap()
+				GetCurrentResources: func() types.ResourcesWithLabels {
+					return test.registeredResources
 				},
-				GetNewResources: func() types.ResourcesWithLabelsMap {
-					return test.newResources.ToMap()
+				GetNewResources: func() types.ResourcesWithLabels {
+					return test.newResources
 				},
 				OnCreate: func(ctx context.Context, r types.ResourceWithLabels) error {
 					onCreateCalls = append(onCreateCalls, r)
diff --git a/lib/services/resource.go b/lib/services/resource.go
index 04dca54f5c39f..bc7e19386cd59 100644
--- a/lib/services/resource.go
+++ b/lib/services/resource.go
@@ -412,99 +412,80 @@ func getResourceUnmarshaler(kind string) (ResourceUnmarshaler, bool) {
 }
 
 func init() {
-	RegisterResourceMarshaler(types.KindUser, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
-		user, ok := resource.(types.User)
+	RegisterResourceMarshaler(types.KindUser, func(r types.Resource, opts ...MarshalOption) ([]byte, error) {
+		rsc, ok := r.(types.User)
 		if !ok {
-			return nil, trace.BadParameter("expected User, got %T", resource)
+			return nil, trace.BadParameter("expected User, got %T", r)
 		}
-		bytes, err := MarshalUser(user, opts...)
+		raw, err := MarshalUser(rsc, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return bytes, nil
+		return raw, nil
 	})
-	RegisterResourceUnmarshaler(types.KindUser, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
-		user, err := UnmarshalUser(bytes, opts...)
+	RegisterResourceUnmarshaler(types.KindUser, func(b []byte, opts ...MarshalOption) (types.Resource, error) {
+		rsc, err := UnmarshalUser(b, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return user, nil
+		return rsc, nil
 	})
 
-	RegisterResourceMarshaler(types.KindCertAuthority, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
-		certAuthority, ok := resource.(types.CertAuthority)
+	RegisterResourceMarshaler(types.KindCertAuthority, func(r types.Resource, opts ...MarshalOption) ([]byte, error) {
+		rsc, ok := r.(types.CertAuthority)
 		if !ok {
-			return nil, trace.BadParameter("expected CertAuthority, got %T", resource)
+			return nil, trace.BadParameter("expected CertAuthority, got %T", r)
 		}
-		bytes, err := MarshalCertAuthority(certAuthority, opts...)
+		raw, err := MarshalCertAuthority(rsc, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return bytes, nil
+		return raw, nil
 	})
-	RegisterResourceUnmarshaler(types.KindCertAuthority, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
-		certAuthority, err := UnmarshalCertAuthority(bytes, opts...)
+	RegisterResourceUnmarshaler(types.KindCertAuthority, func(b []byte, opts ...MarshalOption) (types.Resource, error) {
+		rsc, err := UnmarshalCertAuthority(b, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return certAuthority, nil
+		return rsc, nil
 	})
 
-	RegisterResourceMarshaler(types.KindTrustedCluster, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
-		trustedCluster, ok := resource.(types.TrustedCluster)
+	RegisterResourceMarshaler(types.KindTrustedCluster, func(r types.Resource, opts ...MarshalOption) ([]byte, error) {
+		rsc, ok := r.(types.TrustedCluster)
 		if !ok {
-			return nil, trace.BadParameter("expected TrustedCluster, got %T", resource)
+			return nil, trace.BadParameter("expected TrustedCluster, got %T", r)
 		}
-		bytes, err := MarshalTrustedCluster(trustedCluster, opts...)
+		raw, err := MarshalTrustedCluster(rsc, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return bytes, nil
+		return raw, nil
 	})
-	RegisterResourceUnmarshaler(types.KindTrustedCluster, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
-		trustedCluster, err := UnmarshalTrustedCluster(bytes, opts...)
+	RegisterResourceUnmarshaler(types.KindTrustedCluster, func(b []byte, opts ...MarshalOption) (types.Resource, error) {
+		rsc, err := UnmarshalTrustedCluster(b, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return trustedCluster, nil
+		return rsc, nil
 	})
 
-	RegisterResourceMarshaler(types.KindGithubConnector, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
-		githubConnector, ok := resource.(types.GithubConnector)
+	RegisterResourceMarshaler(types.KindGithubConnector, func(r types.Resource, opts ...MarshalOption) ([]byte, error) {
+		rsc, ok := r.(types.GithubConnector)
 		if !ok {
-			return nil, trace.BadParameter("expected GithubConnector, got %T", resource)
+			return nil, trace.BadParameter("expected GithubConnector, got %T", r)
 		}
-		bytes, err := MarshalGithubConnector(githubConnector, opts...)
+		raw, err := MarshalGithubConnector(rsc, opts...)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return bytes, nil
+		return raw, nil
 	})
-	RegisterResourceUnmarshaler(types.KindGithubConnector, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
-		githubConnector, err := UnmarshalGithubConnector(bytes) // XXX: Does not support marshal options.
+	RegisterResourceUnmarshaler(types.KindGithubConnector, func(b []byte, opts ...MarshalOption) (types.Resource, error) {
+		rsc, err := UnmarshalGithubConnector(b) // XXX: Does not support marshal options.
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return githubConnector, nil
-	})
-
-	RegisterResourceMarshaler(types.KindRole, func(resource types.Resource, opts ...MarshalOption) ([]byte, error) {
-		role, ok := resource.(types.Role)
-		if !ok {
-			return nil, trace.BadParameter("expected Role, got %T", resource)
-		}
-		bytes, err := MarshalRole(role, opts...)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return bytes, nil
-	})
-	RegisterResourceUnmarshaler(types.KindRole, func(bytes []byte, opts ...MarshalOption) (types.Resource, error) {
-		role, err := UnmarshalRole(bytes, opts...)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return role, nil
+		return rsc, nil
 	})
 }
 
diff --git a/lib/services/role.go b/lib/services/role.go
index 56ab3b285a8dd..eda4222e64d2b 100644
--- a/lib/services/role.go
+++ b/lib/services/role.go
@@ -122,7 +122,7 @@ func NewImplicitRole() types.Role {
 //
 // Used in tests only.
 func RoleForUser(u types.User) types.Role {
-	role, _ := types.NewRoleV3(RoleNameForUser(u.GetName()), types.RoleSpecV5{
+	role, _ := types.NewRole(RoleNameForUser(u.GetName()), types.RoleSpecV5{
 		Options: types.RoleOptions{
 			CertificateFormat: constants.CertificateFormatStandard,
 			MaxSessionTTL:     types.NewDuration(defaults.MaxCertDuration),
@@ -148,7 +148,6 @@ func RoleForUser(u types.User) types.Role {
 				types.NewRule(types.KindApp, RW()),
 				types.NewRule(types.KindDatabase, RW()),
 				types.NewRule(types.KindLock, RW()),
-				types.NewRule(types.KindToken, RW()),
 			},
 		},
 	})
@@ -157,7 +156,7 @@ func RoleForUser(u types.User) types.Role {
 
 // RoleForCertAuthority creates role using types.CertAuthority.
 func RoleForCertAuthority(ca types.CertAuthority) types.Role {
-	role, _ := types.NewRoleV3(RoleNameForCertAuthority(ca.GetClusterName()), types.RoleSpecV5{
+	role, _ := types.NewRole(RoleNameForCertAuthority(ca.GetClusterName()), types.RoleSpecV5{
 		Options: types.RoleOptions{
 			MaxSessionTTL: types.NewDuration(defaults.MaxCertDuration),
 		},
@@ -731,7 +730,7 @@ type AccessChecker interface {
 
 // FromSpec returns new RoleSet created from spec
 func FromSpec(name string, spec types.RoleSpecV5) (RoleSet, error) {
-	role, err := types.NewRoleV3(name, spec)
+	role, err := types.NewRole(name, spec)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -779,11 +778,9 @@ func ExtractFromCertificate(cert *ssh.Certificate) ([]string, wrappers.Traits, e
 // which Teleport passes along as a *tlsca.Identity. If roles and traits do not
 // exist in the certificates, they are extracted from the backend.
 func ExtractFromIdentity(access UserGetter, identity tlsca.Identity) ([]string, wrappers.Traits, error) {
-	// Legacy certs are not encoded with roles or traits,
-	// so we fallback to the traits and roles in the backend.
-	// empty traits are a valid use case in standard certs,
-	// so we only check for whether roles are empty.
-	if len(identity.Groups) == 0 {
+	// For legacy certificates, fetch roles and traits from the services.User
+	// object in the backend.
+	if missingIdentity(identity) {
 		u, err := access.GetUser(identity.Username, false)
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
@@ -826,6 +823,15 @@ func FetchRoles(roleNames []string, access RoleGetter, traits map[string][]strin
 	return NewRoleSet(roles...), nil
 }
 
+// missingIdentity returns true if the identity is missing or the identity
+// has no roles or traits.
+func missingIdentity(identity tlsca.Identity) bool {
+	if len(identity.Groups) == 0 || len(identity.Traits) == 0 {
+		return true
+	}
+	return false
+}
+
 // ExtractRolesFromCert extracts roles from certificate metadata extensions.
 func ExtractRolesFromCert(cert *ssh.Certificate) ([]string, error) {
 	data, ok := cert.Extensions[teleport.CertExtensionTeleportRoles]
diff --git a/lib/services/role_test.go b/lib/services/role_test.go
index 12ec744ab8ab9..bf8406ca2612c 100644
--- a/lib/services/role_test.go
+++ b/lib/services/role_test.go
@@ -1506,7 +1506,7 @@ func TestCheckRuleAccess(t *testing.T) {
 
 func TestGuessIfAccessIsPossible(t *testing.T) {
 	// Examples from https://goteleport.com/docs/access-controls/reference/#rbac-for-sessions.
-	ownSessions, err := types.NewRoleV3("own-sessions", types.RoleSpecV5{
+	ownSessions, err := types.NewRole("own-sessions", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -1518,7 +1518,7 @@ func TestGuessIfAccessIsPossible(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	ownSSHSessions, err := types.NewRoleV3("own-ssh-sessions", types.RoleSpecV5{
+	ownSSHSessions, err := types.NewRole("own-ssh-sessions", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -1540,7 +1540,7 @@ func TestGuessIfAccessIsPossible(t *testing.T) {
 	require.NoError(t, err)
 
 	// Simple, all-or-nothing roles.
-	readAllSessions, err := types.NewRoleV3("all-sessions", types.RoleSpecV5{
+	readAllSessions, err := types.NewRole("all-sessions", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -1551,7 +1551,7 @@ func TestGuessIfAccessIsPossible(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	allowSSHSessions, err := types.NewRoleV3("all-ssh-sessions", types.RoleSpecV5{
+	allowSSHSessions, err := types.NewRole("all-ssh-sessions", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -1562,7 +1562,7 @@ func TestGuessIfAccessIsPossible(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	denySSHSessions, err := types.NewRoleV3("deny-ssh-sessions", types.RoleSpecV5{
+	denySSHSessions, err := types.NewRole("deny-ssh-sessions", types.RoleSpecV5{
 		Deny: types.RoleConditions{
 			Rules: []types.Rule{
 				{
@@ -3536,7 +3536,7 @@ func TestRoleSetLockingMode(t *testing.T) {
 
 	missingMode := constants.LockingMode("")
 	newRoleWithLockingMode := func(t *testing.T, mode constants.LockingMode) types.Role {
-		role, err := types.NewRoleV3(uuid.New().String(), types.RoleSpecV5{Options: types.RoleOptions{Lock: mode}})
+		role, err := types.NewRole(uuid.New().String(), types.RoleSpecV5{Options: types.RoleOptions{Lock: mode}})
 		require.NoError(t, err)
 		return role
 	}
@@ -3575,14 +3575,14 @@ func TestExtractConditionForIdentifier(t *testing.T) {
 	require.True(t, trace.IsAccessDenied(err))
 
 	allowWhere := func(where string) types.Role {
-		role, err := types.NewRoleV3(uuid.New().String(), types.RoleSpecV5{Allow: types.RoleConditions{
+		role, err := types.NewRole(uuid.New().String(), types.RoleSpecV5{Allow: types.RoleConditions{
 			Rules: []types.Rule{{Resources: []string{types.KindSession}, Verbs: []string{types.VerbList}, Where: where}},
 		}})
 		require.NoError(t, err)
 		return role
 	}
 	denyWhere := func(where string) types.Role {
-		role, err := types.NewRoleV3(uuid.New().String(), types.RoleSpecV5{Deny: types.RoleConditions{
+		role, err := types.NewRole(uuid.New().String(), types.RoleSpecV5{Deny: types.RoleConditions{
 			Rules: []types.Rule{{Resources: []string{types.KindSession}, Verbs: []string{types.VerbList}, Where: where}},
 		}})
 		require.NoError(t, err)
diff --git a/lib/services/suite/suite.go b/lib/services/suite/suite.go
index 8d2e2452d352a..9d891559fb056 100644
--- a/lib/services/suite/suite.go
+++ b/lib/services/suite/suite.go
@@ -275,16 +275,15 @@ func (s *ServicesTestSuite) LoginAttempts(c *check.C) {
 }
 
 func (s *ServicesTestSuite) CertAuthCRUD(c *check.C) {
-	ctx := context.Background()
 	ca := NewTestCA(types.UserCA, "example.com")
 	c.Assert(s.CAS.UpsertCertAuthority(ca), check.IsNil)
 
-	out, err := s.CAS.GetCertAuthority(ctx, ca.GetID(), true)
+	out, err := s.CAS.GetCertAuthority(ca.GetID(), true)
 	c.Assert(err, check.IsNil)
 	ca.SetResourceID(out.GetResourceID())
 	fixtures.DeepCompare(c, out, ca)
 
-	cas, err := s.CAS.GetCertAuthorities(ctx, types.UserCA, false)
+	cas, err := s.CAS.GetCertAuthorities(types.UserCA, false)
 	c.Assert(err, check.IsNil)
 	ca2 := ca.Clone().(*types.CertAuthorityV2)
 	ca2.Spec.ActiveKeys.SSH[0].PrivateKey = nil
@@ -295,11 +294,11 @@ func (s *ServicesTestSuite) CertAuthCRUD(c *check.C) {
 	ca2.Spec.JWTKeyPairs[0].PrivateKey = nil
 	fixtures.DeepCompare(c, cas[0], ca2)
 
-	cas, err = s.CAS.GetCertAuthorities(ctx, types.UserCA, true)
+	cas, err = s.CAS.GetCertAuthorities(types.UserCA, true)
 	c.Assert(err, check.IsNil)
 	fixtures.DeepCompare(c, cas[0], ca)
 
-	cas, err = s.CAS.GetCertAuthorities(ctx, types.UserCA, true)
+	cas, err = s.CAS.GetCertAuthorities(types.UserCA, true)
 	c.Assert(err, check.IsNil)
 	fixtures.DeepCompare(c, cas[0], ca)
 
@@ -323,7 +322,7 @@ func (s *ServicesTestSuite) CertAuthCRUD(c *check.C) {
 	err = s.CAS.CompareAndSwapCertAuthority(&newCA, ca)
 	c.Assert(err, check.IsNil)
 
-	out, err = s.CAS.GetCertAuthority(ctx, ca.GetID(), true)
+	out, err = s.CAS.GetCertAuthority(ca.GetID(), true)
 	c.Assert(err, check.IsNil)
 	newCA.SetResourceID(out.GetResourceID())
 	fixtures.DeepCompare(c, &newCA, out)
@@ -1349,7 +1348,7 @@ func (s *ServicesTestSuite) Events(c *check.C) {
 				ca := NewTestCA(types.UserCA, "example.com")
 				c.Assert(s.CAS.UpsertCertAuthority(ca), check.IsNil)
 
-				out, err := s.CAS.GetCertAuthority(ctx, *ca.ID(), true)
+				out, err := s.CAS.GetCertAuthority(*ca.ID(), true)
 				c.Assert(err, check.IsNil)
 
 				c.Assert(s.CAS.DeleteCertAuthority(*ca.ID()), check.IsNil)
@@ -1370,7 +1369,7 @@ func (s *ServicesTestSuite) Events(c *check.C) {
 				ca := NewTestCA(types.UserCA, "example.com")
 				c.Assert(s.CAS.UpsertCertAuthority(ca), check.IsNil)
 
-				out, err := s.CAS.GetCertAuthority(ctx, *ca.ID(), false)
+				out, err := s.CAS.GetCertAuthority(*ca.ID(), false)
 				c.Assert(err, check.IsNil)
 
 				c.Assert(s.CAS.DeleteCertAuthority(*ca.ID()), check.IsNil)
@@ -1462,7 +1461,7 @@ func (s *ServicesTestSuite) Events(c *check.C) {
 				Kind: types.KindRole,
 			},
 			crud: func(context.Context) types.Resource {
-				role, err := types.NewRoleV3("role1", types.RoleSpecV5{
+				role, err := types.NewRole("role1", types.RoleSpecV5{
 					Options: types.RoleOptions{
 						MaxSessionTTL: types.Duration(time.Hour),
 					},
diff --git a/lib/services/trust.go b/lib/services/trust.go
index 996fe4595b641..84d4c5d4aeb5b 100644
--- a/lib/services/trust.go
+++ b/lib/services/trust.go
@@ -16,19 +16,15 @@ limitations under the License.
 
 package services
 
-import (
-	"context"
-
-	"github.com/gravitational/teleport/api/types"
-)
+import "github.com/gravitational/teleport/api/types"
 
 // AuthorityGetter defines interface for fetching cert authority resources.
 type AuthorityGetter interface {
 	// GetCertAuthority returns cert authority by id
-	GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool, opts ...MarshalOption) (types.CertAuthority, error)
+	GetCertAuthority(id types.CertAuthID, loadKeys bool, opts ...MarshalOption) (types.CertAuthority, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...MarshalOption) ([]types.CertAuthority, error)
 }
 
 // Trust is responsible for managing certificate authorities
diff --git a/lib/services/watcher.go b/lib/services/watcher.go
index 16cb6dbd88801..c1d932323248f 100644
--- a/lib/services/watcher.go
+++ b/lib/services/watcher.go
@@ -729,13 +729,7 @@ func (p *databaseCollector) getResourcesAndUpdateCurrent(ctx context.Context) er
 	p.lock.Lock()
 	defer p.lock.Unlock()
 	p.current = newCurrent
-
-	select {
-	case <-ctx.Done():
-		return trace.Wrap(ctx.Err())
-	case p.DatabasesC <- databases:
-	}
-
+	p.DatabasesC <- databases
 	return nil
 }
 
@@ -750,10 +744,7 @@ func (p *databaseCollector) processEventAndUpdateCurrent(ctx context.Context, ev
 	switch event.Type {
 	case types.OpDelete:
 		delete(p.current, event.Resource.GetName())
-		select {
-		case <-ctx.Done():
-		case p.DatabasesC <- databasesToSlice(p.current):
-		}
+		p.DatabasesC <- databasesToSlice(p.current)
 	case types.OpPut:
 		database, ok := event.Resource.(types.Database)
 		if !ok {
@@ -761,11 +752,7 @@ func (p *databaseCollector) processEventAndUpdateCurrent(ctx context.Context, ev
 			return
 		}
 		p.current[database.GetName()] = database
-		select {
-		case <-ctx.Done():
-		case p.DatabasesC <- databasesToSlice(p.current):
-		}
-
+		p.DatabasesC <- databasesToSlice(p.current)
 	default:
 		p.Log.Warnf("Unsupported event type %s.", event.Type)
 		return
@@ -858,12 +845,7 @@ func (p *appCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
 	p.lock.Lock()
 	defer p.lock.Unlock()
 	p.current = newCurrent
-
-	select {
-	case <-ctx.Done():
-		return trace.Wrap(ctx.Err())
-	case p.AppsC <- apps:
-	}
+	p.AppsC <- apps
 	return nil
 }
 
@@ -879,12 +861,6 @@ func (p *appCollector) processEventAndUpdateCurrent(ctx context.Context, event t
 	case types.OpDelete:
 		delete(p.current, event.Resource.GetName())
 		p.AppsC <- appsToSlice(p.current)
-
-		select {
-		case <-ctx.Done():
-		case p.AppsC <- appsToSlice(p.current):
-		}
-
 	case types.OpPut:
 		app, ok := event.Resource.(types.Application)
 		if !ok {
@@ -892,11 +868,7 @@ func (p *appCollector) processEventAndUpdateCurrent(ctx context.Context, event t
 			return
 		}
 		p.current[app.GetName()] = app
-
-		select {
-		case <-ctx.Done():
-		case p.AppsC <- appsToSlice(p.current):
-		}
+		p.AppsC <- appsToSlice(p.current)
 	default:
 		p.Log.Warnf("Unsupported event type %s.", event.Type)
 		return
@@ -989,7 +961,7 @@ func (c *caCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
 	)
 
 	if c.WatchHostCA {
-		host, err := c.AuthorityGetter.GetCertAuthorities(ctx, types.HostCA, false)
+		host, err := c.AuthorityGetter.GetCertAuthorities(types.HostCA, false)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -1000,7 +972,7 @@ func (c *caCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
 	}
 
 	if c.WatchUserCA {
-		user, err := c.AuthorityGetter.GetCertAuthorities(ctx, types.UserCA, false)
+		user, err := c.AuthorityGetter.GetCertAuthorities(types.UserCA, false)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -1015,11 +987,7 @@ func (c *caCollector) getResourcesAndUpdateCurrent(ctx context.Context) error {
 	c.user = newUser
 	c.lock.Unlock()
 
-	select {
-	case <-ctx.Done():
-		return trace.Wrap(ctx.Err())
-	case c.CertAuthorityC <- casToSlice(newHost, newUser):
-	}
+	c.CertAuthorityC <- casToSlice(newHost, newUser)
 	return nil
 }
 
@@ -1040,10 +1008,7 @@ func (c *caCollector) processEventAndUpdateCurrent(ctx context.Context, event ty
 			delete(c.user, event.Resource.GetName())
 		}
 
-		select {
-		case <-ctx.Done():
-		case c.CertAuthorityC <- casToSlice(c.host, c.user):
-		}
+		c.CertAuthorityC <- casToSlice(c.host, c.user)
 	case types.OpPut:
 		ca, ok := event.Resource.(types.CertAuthority)
 		if !ok {
@@ -1058,10 +1023,7 @@ func (c *caCollector) processEventAndUpdateCurrent(ctx context.Context, event ty
 			c.user[ca.GetName()] = ca
 		}
 
-		select {
-		case <-ctx.Done():
-		case c.CertAuthorityC <- casToSlice(c.host, c.user):
-		}
+		c.CertAuthorityC <- casToSlice(c.host, c.user)
 	default:
 		c.Log.Warnf("Unsupported event type %s.", event.Type)
 		return
diff --git a/lib/srv/alpnproxy/auth/auth_proxy.go b/lib/srv/alpnproxy/auth/auth_proxy.go
index f7b5aae4115b3..ec8740fae261e 100644
--- a/lib/srv/alpnproxy/auth/auth_proxy.go
+++ b/lib/srv/alpnproxy/auth/auth_proxy.go
@@ -18,7 +18,6 @@ package alpnproxyauth
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"math/rand"
 	"net"
@@ -114,23 +113,13 @@ func (s *AuthProxyDialerService) dialLocalAuthServer(ctx context.Context) (net.C
 	if len(authServers) == 0 {
 		return nil, trace.NotFound("empty auth servers list")
 	}
-	var errors []error
-
-	// iterate over the addresses in random order
-	for len(authServers) > 0 {
-		l := len(authServers)
-		authServerIndex := rand.Intn(l)
-		addr := authServers[authServerIndex].GetAddr()
-		var d net.Dialer
-		conn, err := d.DialContext(ctx, "tcp", addr)
-		if err == nil {
-			return conn, nil
-		}
-		errors = append(errors, fmt.Errorf("%s: %w", addr, err))
-		authServers[authServerIndex] = authServers[l-1]
-		authServers = authServers[:l-1]
+	//TODO(smallinksy) Better support for HA. Add dial retry on auth network errors.
+	authServerIndex := rand.Intn(len(authServers))
+	conn, err := net.Dial("tcp", authServers[authServerIndex].GetAddr())
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
-	return nil, trace.NewAggregate(errors...)
+	return conn, nil
 }
 
 func (s *AuthProxyDialerService) dialRemoteAuthServer(ctx context.Context, clusterName string) (net.Conn, error) {
diff --git a/lib/srv/alpnproxy/auth/auth_proxy_test.go b/lib/srv/alpnproxy/auth/auth_proxy_test.go
deleted file mode 100644
index ff25f26412124..0000000000000
--- a/lib/srv/alpnproxy/auth/auth_proxy_test.go
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
-Copyright 2021 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package alpnproxyauth
-
-import (
-	"context"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/services"
-	"github.com/stretchr/testify/require"
-)
-
-type mockAuthGetter struct {
-	servers []types.Server
-}
-
-func (m mockAuthGetter) GetClusterName(...services.MarshalOption) (types.ClusterName, error) {
-	return nil, nil
-}
-
-func (m mockAuthGetter) GetAuthServers() ([]types.Server, error) {
-	return m.servers, nil
-}
-
-func TestDialLocalAuthServerNoServers(t *testing.T) {
-	s := NewAuthProxyDialerService(nil, mockAuthGetter{servers: []types.Server{}})
-	_, err := s.dialLocalAuthServer(context.Background())
-	require.Error(t, err, "dialLocalAuthServer expected to fail")
-	require.Equal(t, "empty auth servers list", err.Error())
-}
-
-func TestDialLocalAuthServerNoAvailableServers(t *testing.T) {
-	server1, err := types.NewServer("s1", "auth", types.ServerSpecV2{Addr: "invalid:8000"})
-	require.NoError(t, err)
-	s := NewAuthProxyDialerService(nil, mockAuthGetter{servers: []types.Server{server1}})
-	_, err = s.dialLocalAuthServer(context.Background())
-	require.Error(t, err, "dialLocalAuthServer expected to fail")
-	require.Contains(t, err.Error(), "invalid:8000:")
-}
-
-func TestDialLocalAuthServerAvailableServers(t *testing.T) {
-	socket, err := net.Listen("tcp", "127.0.0.1:")
-	require.NoError(t, err)
-	defer socket.Close()
-	server, err := types.NewServer("s1", "auth", types.ServerSpecV2{Addr: socket.Addr().String()})
-	require.NoError(t, err)
-	servers := []types.Server{server}
-	// multiple invalid servers to minimize chance that we select good one first try
-	for i := 0; i < 20; i++ {
-		server, err := types.NewServer("s1", "auth", types.ServerSpecV2{Addr: "invalid2:8000"})
-		require.NoError(t, err)
-		servers = append(servers, server)
-	}
-	s := NewAuthProxyDialerService(nil, mockAuthGetter{servers: servers})
-	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
-	defer cancel()
-	_, err = s.dialLocalAuthServer(ctx)
-	require.NoError(t, err)
-}
diff --git a/lib/srv/alpnproxy/common/protocols.go b/lib/srv/alpnproxy/common/protocols.go
index 3009453a94b1c..74055f4e8c7eb 100644
--- a/lib/srv/alpnproxy/common/protocols.go
+++ b/lib/srv/alpnproxy/common/protocols.go
@@ -17,10 +17,9 @@ limitations under the License.
 package common
 
 import (
+	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/acme"
-
-	"github.com/gravitational/teleport/lib/defaults"
 )
 
 // Protocol is the TLS ALPN protocol type.
@@ -106,17 +105,3 @@ func ToALPNProtocol(dbProtocol string) (Protocol, error) {
 		return "", trace.NotImplemented("%q protocol is not supported", dbProtocol)
 	}
 }
-
-// IsDBTLSProtocol returns if DB protocol has supported native TLS protocol.
-// where connection can be TLS terminated on ALPN proxy side.
-// For protocol like MySQL or Postgres where custom TLS implementation is used the incoming
-// connection needs to be forwarded to proxy database service where custom TLS handler is invoked
-// to terminated DB connection.
-func IsDBTLSProtocol(protocol Protocol) bool {
-	switch protocol {
-	case ProtocolMongoDB, ProtocolRedisDB, ProtocolSQLServer:
-		return true
-	default:
-		return false
-	}
-}
diff --git a/lib/srv/alpnproxy/proxy.go b/lib/srv/alpnproxy/proxy.go
index 2cc4636e426d2..c14aa82f8ac6e 100644
--- a/lib/srv/alpnproxy/proxy.go
+++ b/lib/srv/alpnproxy/proxy.go
@@ -176,9 +176,6 @@ func (h *HandlerDecs) handle(ctx context.Context, conn net.Conn, info Connection
 	if h.HandlerWithConnInfo != nil {
 		return h.HandlerWithConnInfo(ctx, conn, info)
 	}
-	if h.Handler == nil {
-		return trace.BadParameter("failed to find ALPN handler for ALPN: %v, SNI %v", info.ALPN, info.SNI)
-	}
 	return h.Handler(ctx, conn)
 }
 
@@ -437,6 +434,15 @@ func (p *Proxy) databaseHandlerWithTLSTermination(ctx context.Context, conn net.
 	return trace.Wrap(p.handleDatabaseConnection(ctx, tlsConn, info))
 }
 
+func isDBTLSProtocol(protocol common.Protocol) bool {
+	switch protocol {
+	case common.ProtocolMongoDB, common.ProtocolRedisDB:
+		return true
+	default:
+		return false
+	}
+}
+
 func (p *Proxy) getHandlerDescBaseOnClientHelloMsg(clientHelloInfo *tls.ClientHelloInfo) (*HandlerDecs, error) {
 	if shouldRouteToKubeService(clientHelloInfo.ServerName) {
 		if p.cfg.Router.kubeHandler == nil {
@@ -458,7 +464,7 @@ func (p *Proxy) getHandleDescBasedOnALPNVal(clientHelloInfo *tls.ClientHelloInfo
 
 	for _, v := range clientProtocols {
 		protocol := common.Protocol(v)
-		if common.IsDBTLSProtocol(protocol) {
+		if isDBTLSProtocol(protocol) {
 			return &HandlerDecs{
 				MatchFunc:           MatchByProtocol(protocol),
 				HandlerWithConnInfo: p.databaseHandlerWithTLSTermination,
diff --git a/lib/srv/alpnproxy/proxy_test.go b/lib/srv/alpnproxy/proxy_test.go
index 1bf971d0fad09..029090c6dee16 100644
--- a/lib/srv/alpnproxy/proxy_test.go
+++ b/lib/srv/alpnproxy/proxy_test.go
@@ -178,65 +178,6 @@ func TestProxyTLSDatabaseHandler(t *testing.T) {
 	})
 }
 
-// TestProxyRouteToDatabase tests db connection with protocol registered without any handler.
-// ALPN router leverages empty handler to route the connection to DBHandler
-// based on TLS RouteToDatabase identity entry.
-func TestProxyRouteToDatabase(t *testing.T) {
-	t.Parallel()
-	const (
-		databaseHandleResponse = "database handler response"
-	)
-
-	suite := NewSuite(t)
-	clientCert := mustGenCertSignedWithCA(t, suite.ca,
-		withIdentity(tlsca.Identity{
-			Username: "test-user",
-			Groups:   []string{"test-group"},
-			RouteToDatabase: tlsca.RouteToDatabase{
-				ServiceName: "mongo-test-database",
-			},
-		}),
-	)
-
-	suite.router.AddDBTLSHandler(func(ctx context.Context, conn net.Conn) error {
-		defer conn.Close()
-		_, err := fmt.Fprint(conn, databaseHandleResponse)
-		require.NoError(t, err)
-		return nil
-	})
-	suite.router.Add(HandlerDecs{
-		MatchFunc: MatchByProtocol(common.ProtocolReverseTunnel),
-	})
-
-	suite.Start(t)
-
-	t.Run("dial with user certs with RouteToDatabase info", func(t *testing.T) {
-		conn, err := tls.Dial("tcp", suite.GetServerAddress(), &tls.Config{
-			NextProtos: []string{string(common.ProtocolReverseTunnel)},
-			RootCAs:    suite.GetCertPool(),
-			ServerName: "localhost",
-			Certificates: []tls.Certificate{
-				clientCert,
-			},
-		})
-		require.NoError(t, err)
-		mustReadFromConnection(t, conn, databaseHandleResponse)
-		mustCloseConnection(t, conn)
-	})
-
-	t.Run("dial with no user certs", func(t *testing.T) {
-		conn, err := tls.Dial("tcp", suite.GetServerAddress(), &tls.Config{
-			NextProtos: []string{string(common.ProtocolReverseTunnel)},
-			RootCAs:    suite.GetCertPool(),
-			ServerName: "localhost",
-		})
-		require.NoError(t, err)
-		t.Cleanup(func() {
-			require.NoError(t, conn.Close())
-		})
-	})
-}
-
 // TestLocalProxyPostgresProtocol tests Proxy Postgres connection  forwarded by LocalProxy.
 // Client connects to LocalProxy with raw connection where downstream Proxy connection is upgraded to TLS with
 // ALPN value set to ProtocolPostgres.
diff --git a/lib/srv/app/aws/endpoints.go b/lib/srv/app/aws/endpoints.go
deleted file mode 100644
index 684a0f8a204bf..0000000000000
--- a/lib/srv/app/aws/endpoints.go
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package aws
-
-import (
-	"net/http"
-	"strings"
-
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/appstream"
-	"github.com/aws/aws-sdk-go/service/detective"
-	"github.com/aws/aws-sdk-go/service/ecr"
-	"github.com/aws/aws-sdk-go/service/ecrpublic"
-	"github.com/aws/aws-sdk-go/service/elasticinference"
-	"github.com/aws/aws-sdk-go/service/iot1clickdevicesservice"
-	"github.com/aws/aws-sdk-go/service/iotdataplane"
-	"github.com/aws/aws-sdk-go/service/iotdeviceadvisor"
-	"github.com/aws/aws-sdk-go/service/ioteventsdata"
-	"github.com/aws/aws-sdk-go/service/iotfleethub"
-	"github.com/aws/aws-sdk-go/service/iotjobsdataplane"
-	"github.com/aws/aws-sdk-go/service/iotsecuretunneling"
-	"github.com/aws/aws-sdk-go/service/iottwinmaker"
-	"github.com/aws/aws-sdk-go/service/iotwireless"
-	"github.com/aws/aws-sdk-go/service/lexmodelsv2"
-	"github.com/aws/aws-sdk-go/service/marketplacecatalog"
-	"github.com/aws/aws-sdk-go/service/mediatailor"
-	"github.com/aws/aws-sdk-go/service/memorydb"
-	"github.com/aws/aws-sdk-go/service/migrationhubstrategyrecommendations"
-	"github.com/aws/aws-sdk-go/service/mobile"
-	"github.com/aws/aws-sdk-go/service/pinpoint"
-	"github.com/aws/aws-sdk-go/service/pinpointsmsvoice"
-	"github.com/aws/aws-sdk-go/service/pricing"
-	"github.com/aws/aws-sdk-go/service/proton"
-	"github.com/aws/aws-sdk-go/service/sagemaker"
-	"github.com/aws/aws-sdk-go/service/ses"
-	"github.com/aws/aws-sdk-go/service/sso"
-	"github.com/aws/aws-sdk-go/service/ssooidc"
-	"github.com/aws/aws-sdk-go/service/timestreamquery"
-
-	awsutils "github.com/gravitational/teleport/lib/utils/aws"
-
-	"github.com/gravitational/trace"
-)
-
-// resolveEndpoint extracts the aws-service on and aws-region from the request
-// authorization header and resolves the aws-service and aws-region to AWS
-// endpoint.
-func resolveEndpoint(r *http.Request) (*endpoints.ResolvedEndpoint, error) {
-	awsAuthHeader, err := awsutils.ParseSigV4(r.Header.Get(awsutils.AuthorizationHeader))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// aws-sdk-go maintains a mapping of service endpoints which can be looked
-	// up by calling `endpoints.DefaultResolver().EndpointFor`. This mapping
-	// can be found at:
-	// https://github.com/aws/aws-sdk-go/blob/main/aws/endpoints/defaults.go
-	//
-	// The json equivalent can be found in botocore source code at:
-	// https://github.com/boto/botocore/blob/develop/botocore/data/endpoints.json
-	//
-	// The keys used for lookups are endpoints IDs, which can be different from
-	// the signing names. We have to translate the signing name received from
-	// the header back to the endpoints ID.
-	//
-	// In addition, many services are NOT found in aws-sdk-go's endpoints
-	// mapping. How aws-sdk-go resolves endpoints for these services is to
-	// allow ResolveUnknownService when creating the client sessions, which in
-	// turn generates the endpoint by using the endpoints ID and some default
-	// suffixes. We allow ResolveUnknownService here for the same purpose.
-	endpointsID := endpointsIDFromSigningName(awsAuthHeader.Service)
-	opts := func(opts *endpoints.Options) {
-		opts.ResolveUnknownService = true
-	}
-
-	resolvedEndpoint, err := endpoints.DefaultResolver().EndpointFor(endpointsID, awsAuthHeader.Region, opts)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	// SigningName can be derived from the endpoint ID which may not be the
-	// correct signing name. Set it back to what is received from the header.
-	resolvedEndpoint.SigningName = awsAuthHeader.Service
-	return &resolvedEndpoint, nil
-}
-
-// endpointsIDFromSigningName returns the endpoints ID used for endpoint
-// lookups when calling endpoints.DefaultResolver().EndpointFor.
-func endpointsIDFromSigningName(signingName string) string {
-	// Some clients may sign some services with upper case letters. We use all
-	// lower cases in our mapping.
-	signingName = strings.ToLower(signingName)
-
-	if endpointsID, ok := signingNameToEndpointsID[signingName]; ok {
-		return endpointsID
-	}
-
-	// If not found in the mapping, endpoints ID is expected to be the same as
-	// the signing name.
-	return signingName
-}
-
-// signingNameToEndpointsID is a map of AWS services' signing names to their
-// endpoints IDs.
-//
-// This mapping was created by the following process:
-// 1. Compiled a mapping of all signing names to their hostnames (e.g. grep/awk
-// keywords in "aws-sdk-go-v2/services/")
-// 2. Created unit test "TestResolveEndpoints" to test each signing name.
-// 3. Investigated the test failures, and updated this mapping to fix them.
-//
-// TODO Many services may sign with same names but use different hostnames.
-// Will need a way to differentiate them. For now, either make the best guess
-// in this mapping or use the default signing names. See signingNameToHostname
-// in endpoints_test.go for conflicting services.
-var signingNameToEndpointsID = map[string]string{
-	"appstream":                             appstream.EndpointsID,
-	"aws-marketplace":                       marketplacecatalog.EndpointsID,
-	"awsiottwinmaker":                       iottwinmaker.EndpointsID,
-	"awsmigrationhubstrategyrecommendation": migrationhubstrategyrecommendations.EndpointsID,
-	"awsmobilehubservice":                   mobile.EndpointsID,
-	"awsproton20200720":                     proton.EndpointsID,
-	"awsssooidc":                            ssooidc.EndpointsID,
-	"awsssoportal":                          sso.EndpointsID,
-	"detective":                             detective.EndpointsID,
-	"ecr":                                   ecr.EndpointsID,
-	"ecr-public":                            ecrpublic.EndpointsID,
-	"elastic-inference":                     elasticinference.EndpointsID,
-	"iot-jobs-data":                         iotjobsdataplane.EndpointsID,
-	"iot1click":                             iot1clickdevicesservice.EndpointsID,
-	"iotdata":                               iotdataplane.EndpointsID,
-	"iotdeviceadvisor":                      iotdeviceadvisor.EndpointsID,
-	"ioteventsdata":                         ioteventsdata.EndpointsID,
-	"iotfleethub":                           iotfleethub.EndpointsID,
-	"iotsecuredtunneling":                   iotsecuretunneling.EndpointsID,
-	"iotwireless":                           iotwireless.EndpointsID,
-	"lex":                                   lexmodelsv2.EndpointsID,
-	"mediatailor":                           mediatailor.EndpointsID,
-	"memorydb":                              memorydb.EndpointsID,
-	"mobiletargeting":                       pinpoint.EndpointsID,
-	"pricing":                               pricing.EndpointsID,
-	"sagemaker":                             sagemaker.EndpointsID,
-	"ses":                                   ses.EndpointsID,
-	"sms-voice":                             pinpointsmsvoice.EndpointsID,
-	"timestream":                            timestreamquery.EndpointsID,
-}
diff --git a/lib/srv/app/aws/endpoints_test.go b/lib/srv/app/aws/endpoints_test.go
deleted file mode 100644
index bc80f410144fb..0000000000000
--- a/lib/srv/app/aws/endpoints_test.go
+++ /dev/null
@@ -1,359 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package aws
-
-import (
-	"bytes"
-	"net/http"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
-	"github.com/stretchr/testify/require"
-)
-
-// signingNameToHostname is a map of AWS services' signing names to their
-// hostnames.
-var signingNameToHostname = map[string]string{
-	"a4b":                                   "a4b.us-east-1.amazonaws.com",
-	"access-analyzer":                       "access-analyzer.us-east-1.amazonaws.com",
-	"account":                               "account.us-east-1.amazonaws.com",
-	"acm":                                   "acm.us-east-1.amazonaws.com",
-	"acm-pca":                               "acm-pca.us-east-1.amazonaws.com",
-	"airflow":                               "airflow.us-east-1.amazonaws.com",
-	"amplify":                               "amplify.us-east-1.amazonaws.com",
-	"amplifybackend":                        "amplifybackend.us-east-1.amazonaws.com",
-	"amplifyuibuilder":                      "amplifyuibuilder.us-east-1.amazonaws.com",
-	"apigateway":                            "apigateway.us-east-1.amazonaws.com",
-	"app-integrations":                      "app-integrations.us-east-1.amazonaws.com",
-	"appconfig":                             "appconfig.us-east-1.amazonaws.com",
-	"appconfigdata":                         "appconfigdata.us-east-1.amazonaws.com",
-	"appflow":                               "appflow.us-east-1.amazonaws.com",
-	"application-autoscaling":               "application-autoscaling.us-east-1.amazonaws.com",
-	"application-cost-profiler":             "application-cost-profiler.us-east-1.amazonaws.com",
-	"applicationinsights":                   "applicationinsights.us-east-1.amazonaws.com",
-	"appmesh":                               "appmesh.us-east-1.amazonaws.com",
-	"apprunner":                             "apprunner.us-east-1.amazonaws.com",
-	"appstream":                             "appstream2.us-east-1.amazonaws.com",
-	"appsync":                               "appsync.us-east-1.amazonaws.com",
-	"aps":                                   "aps.us-east-1.amazonaws.com",
-	"athena":                                "athena.us-east-1.amazonaws.com",
-	"auditmanager":                          "auditmanager.us-east-1.amazonaws.com",
-	"autoscaling":                           "autoscaling.us-east-1.amazonaws.com",
-	"autoscaling-plans":                     "autoscaling-plans.us-east-1.amazonaws.com",
-	"aws-marketplace":                       "catalog.marketplace.us-east-1.amazonaws.com",
-	"awsiottwinmaker":                       "iottwinmaker.us-east-1.amazonaws.com",
-	"awsmigrationhubstrategyrecommendation": "migrationhub-strategy.us-east-1.amazonaws.com",
-	"awsmobilehubservice":                   "mobile.us-east-1.amazonaws.com",
-	"awsproton20200720":                     "proton.us-east-1.amazonaws.com",
-	"awsssooidc":                            "oidc.us-east-1.amazonaws.com",
-	"awsssoportal":                          "portal.sso.us-east-1.amazonaws.com",
-	"backup":                                "backup.us-east-1.amazonaws.com",
-	"backup-gateway":                        "backup-gateway.us-east-1.amazonaws.com",
-	"batch":                                 "batch.us-east-1.amazonaws.com",
-	"braket":                                "braket.us-east-1.amazonaws.com",
-	"budgets":                               "budgets.amazonaws.com",
-	"ce":                                    "ce.us-east-1.amazonaws.com",
-	"chime":                                 "chime.us-east-1.amazonaws.com",
-	"cloud9":                                "cloud9.us-east-1.amazonaws.com",
-	"cloudcontrolapi":                       "cloudcontrolapi.us-east-1.amazonaws.com",
-	"clouddirectory":                        "clouddirectory.us-east-1.amazonaws.com",
-	"cloudformation":                        "cloudformation.us-east-1.amazonaws.com",
-	"cloudfront":                            "cloudfront.amazonaws.com",
-	"cloudhsm":                              "cloudhsm.us-east-1.amazonaws.com",
-	"cloudsearch":                           "cloudsearch.us-east-1.amazonaws.com",
-	"cloudtrail":                            "cloudtrail.us-east-1.amazonaws.com",
-	"codeartifact":                          "codeartifact.us-east-1.amazonaws.com",
-	"codebuild":                             "codebuild.us-east-1.amazonaws.com",
-	"codecommit":                            "codecommit.us-east-1.amazonaws.com",
-	"codedeploy":                            "codedeploy.us-east-1.amazonaws.com",
-	"codeguru-profiler":                     "codeguru-profiler.us-east-1.amazonaws.com",
-	"codeguru-reviewer":                     "codeguru-reviewer.us-east-1.amazonaws.com",
-	"codepipeline":                          "codepipeline.us-east-1.amazonaws.com",
-	"codestar":                              "codestar.us-east-1.amazonaws.com",
-	"codestar-connections":                  "codestar-connections.us-east-1.amazonaws.com",
-	"codestar-notifications":                "codestar-notifications.us-east-1.amazonaws.com",
-	"cognito-identity":                      "cognito-identity.us-east-1.amazonaws.com",
-	"cognito-idp":                           "cognito-idp.us-east-1.amazonaws.com",
-	"cognito-sync":                          "cognito-sync.us-east-1.amazonaws.com",
-	"comprehend":                            "comprehend.us-east-1.amazonaws.com",
-	"comprehendmedical":                     "comprehendmedical.us-east-1.amazonaws.com",
-	"compute-optimizer":                     "compute-optimizer.us-east-1.amazonaws.com",
-	"config":                                "config.us-east-1.amazonaws.com",
-	"connect":                               "connect.us-east-1.amazonaws.com",
-	"cur":                                   "cur.us-east-1.amazonaws.com",
-	"databrew":                              "databrew.us-east-1.amazonaws.com",
-	"dataexchange":                          "dataexchange.us-east-1.amazonaws.com",
-	"datapipeline":                          "datapipeline.us-east-1.amazonaws.com",
-	"datasync":                              "datasync.us-east-1.amazonaws.com",
-	"dax":                                   "dax.us-east-1.amazonaws.com",
-	"detective":                             "api.detective.us-east-1.amazonaws.com",
-	"devicefarm":                            "devicefarm.us-east-1.amazonaws.com",
-	"devops-guru":                           "devops-guru.us-east-1.amazonaws.com",
-	"directconnect":                         "directconnect.us-east-1.amazonaws.com",
-	"discovery":                             "discovery.us-east-1.amazonaws.com",
-	"dlm":                                   "dlm.us-east-1.amazonaws.com",
-	"dms":                                   "dms.us-east-1.amazonaws.com",
-	"drs":                                   "drs.us-east-1.amazonaws.com",
-	"ds":                                    "ds.us-east-1.amazonaws.com",
-	"dynamodb":                              "dynamodb.us-east-1.amazonaws.com",
-	"ebs":                                   "ebs.us-east-1.amazonaws.com",
-	"ec2":                                   "ec2.us-east-1.amazonaws.com",
-	"ec2-instance-connect":                  "ec2-instance-connect.us-east-1.amazonaws.com",
-	"ecr":                                   "api.ecr.us-east-1.amazonaws.com",
-	"ecr-public":                            "api.ecr-public.us-east-1.amazonaws.com",
-	"ecs":                                   "ecs.us-east-1.amazonaws.com",
-	"eks":                                   "eks.us-east-1.amazonaws.com",
-	"elastic-inference":                     "api.elastic-inference.us-east-1.amazonaws.com",
-	"elasticache":                           "elasticache.us-east-1.amazonaws.com",
-	"elasticbeanstalk":                      "elasticbeanstalk.us-east-1.amazonaws.com",
-	"elasticfilesystem":                     "elasticfilesystem.us-east-1.amazonaws.com",
-	"elasticloadbalancing":                  "elasticloadbalancing.us-east-1.amazonaws.com",
-	"elasticmapreduce":                      "elasticmapreduce.us-east-1.amazonaws.com",
-	"elastictranscoder":                     "elastictranscoder.us-east-1.amazonaws.com",
-	"emr-containers":                        "emr-containers.us-east-1.amazonaws.com",
-	"es":                                    "es.us-east-1.amazonaws.com",
-	"events":                                "events.us-east-1.amazonaws.com",
-	"evidently":                             "evidently.us-east-1.amazonaws.com",
-	"finspace":                              "finspace.us-east-1.amazonaws.com",
-	"finspace-api":                          "finspace-api.us-east-1.amazonaws.com",
-	"firehose":                              "firehose.us-east-1.amazonaws.com",
-	"fis":                                   "fis.us-east-1.amazonaws.com",
-	"fms":                                   "fms.us-east-1.amazonaws.com",
-	"forecast":                              "forecast.us-east-1.amazonaws.com",
-	"frauddetector":                         "frauddetector.us-east-1.amazonaws.com",
-	"fsx":                                   "fsx.us-east-1.amazonaws.com",
-	"gamelift":                              "gamelift.us-east-1.amazonaws.com",
-	"geo":                                   "geo.us-east-1.amazonaws.com",
-	"glacier":                               "glacier.us-east-1.amazonaws.com",
-	"globalaccelerator":                     "globalaccelerator.us-east-1.amazonaws.com",
-	"glue":                                  "glue.us-east-1.amazonaws.com",
-	"grafana":                               "grafana.us-east-1.amazonaws.com",
-	"greengrass":                            "greengrass.us-east-1.amazonaws.com",
-	"groundstation":                         "groundstation.us-east-1.amazonaws.com",
-	"guardduty":                             "guardduty.us-east-1.amazonaws.com",
-	"health":                                "health.us-east-1.amazonaws.com",
-	"healthlake":                            "healthlake.us-east-1.amazonaws.com",
-	"honeycode":                             "honeycode.us-east-1.amazonaws.com",
-	"iam":                                   "iam.amazonaws.com",
-	"identitystore":                         "identitystore.us-east-1.amazonaws.com",
-	"imagebuilder":                          "imagebuilder.us-east-1.amazonaws.com",
-	"inspector":                             "inspector.us-east-1.amazonaws.com",
-	"inspector2":                            "inspector2.us-east-1.amazonaws.com",
-	"iot":                                   "iot.us-east-1.amazonaws.com",
-	"iot-jobs-data":                         "data.jobs.iot.us-east-1.amazonaws.com",
-	"iot1click":                             "devices.iot1click.us-east-1.amazonaws.com",
-	"iotanalytics":                          "iotanalytics.us-east-1.amazonaws.com",
-	"iotdata":                               "data.iot.us-east-1.amazonaws.com",
-	"iotdeviceadvisor":                      "api.iotdeviceadvisor.us-east-1.amazonaws.com",
-	"iotevents":                             "iotevents.us-east-1.amazonaws.com",
-	"ioteventsdata":                         "data.iotevents.us-east-1.amazonaws.com",
-	"iotfleethub":                           "api.fleethub.iot.us-east-1.amazonaws.com",
-	"iotsecuredtunneling":                   "api.tunneling.iot.us-east-1.amazonaws.com",
-	"iotsitewise":                           "iotsitewise.us-east-1.amazonaws.com",
-	"iotthingsgraph":                        "iotthingsgraph.us-east-1.amazonaws.com",
-	"iotwireless":                           "api.iotwireless.us-east-1.amazonaws.com",
-	"ivs":                                   "ivs.us-east-1.amazonaws.com",
-	"kafka":                                 "kafka.us-east-1.amazonaws.com",
-	"kafkaconnect":                          "kafkaconnect.us-east-1.amazonaws.com",
-	"kendra":                                "kendra.us-east-1.amazonaws.com",
-	"kinesis":                               "kinesis.us-east-1.amazonaws.com",
-	"kinesisanalytics":                      "kinesisanalytics.us-east-1.amazonaws.com",
-	"kinesisvideo":                          "kinesisvideo.us-east-1.amazonaws.com",
-	"kms":                                   "kms.us-east-1.amazonaws.com",
-	"lakeformation":                         "lakeformation.us-east-1.amazonaws.com",
-	"lambda":                                "lambda.us-east-1.amazonaws.com",
-	"lex":                                   "models-v2-lex.us-east-1.amazonaws.com",
-	"license-manager":                       "license-manager.us-east-1.amazonaws.com",
-	"lightsail":                             "lightsail.us-east-1.amazonaws.com",
-	"logs":                                  "logs.us-east-1.amazonaws.com",
-	"lookoutequipment":                      "lookoutequipment.us-east-1.amazonaws.com",
-	"lookoutmetrics":                        "lookoutmetrics.us-east-1.amazonaws.com",
-	"lookoutvision":                         "lookoutvision.us-east-1.amazonaws.com",
-	"machinelearning":                       "machinelearning.us-east-1.amazonaws.com",
-	"macie":                                 "macie.us-east-1.amazonaws.com",
-	"macie2":                                "macie2.us-east-1.amazonaws.com",
-	"managedblockchain":                     "managedblockchain.us-east-1.amazonaws.com",
-	"marketplacecommerceanalytics":          "marketplacecommerceanalytics.us-east-1.amazonaws.com",
-	"mediaconnect":                          "mediaconnect.us-east-1.amazonaws.com",
-	"mediaconvert":                          "mediaconvert.us-east-1.amazonaws.com",
-	"medialive":                             "medialive.us-east-1.amazonaws.com",
-	"mediapackage":                          "mediapackage.us-east-1.amazonaws.com",
-	"mediapackage-vod":                      "mediapackage-vod.us-east-1.amazonaws.com",
-	"mediastore":                            "mediastore.us-east-1.amazonaws.com",
-	"mediatailor":                           "api.mediatailor.us-east-1.amazonaws.com",
-	"memorydb":                              "memory-db.us-east-1.amazonaws.com",
-	"mgh":                                   "mgh.us-east-1.amazonaws.com",
-	"mgn":                                   "mgn.us-east-1.amazonaws.com",
-	"mobiletargeting":                       "pinpoint.us-east-1.amazonaws.com",
-	"monitoring":                            "monitoring.us-east-1.amazonaws.com",
-	"mq":                                    "mq.us-east-1.amazonaws.com",
-	"mturk-requester":                       "mturk-requester.us-east-1.amazonaws.com",
-	"network-firewall":                      "network-firewall.us-east-1.amazonaws.com",
-	"networkmanager":                        "networkmanager.us-west-2.amazonaws.com", // Maps to us-west-2.
-	"nimble":                                "nimble.us-east-1.amazonaws.com",
-	"opsworks":                              "opsworks.us-east-1.amazonaws.com",
-	"opsworks-cm":                           "opsworks-cm.us-east-1.amazonaws.com",
-	"organizations":                         "organizations.us-east-1.amazonaws.com",
-	"outposts":                              "outposts.us-east-1.amazonaws.com",
-	"panorama":                              "panorama.us-east-1.amazonaws.com",
-	"personalize":                           "personalize.us-east-1.amazonaws.com",
-	"pi":                                    "pi.us-east-1.amazonaws.com",
-	"polly":                                 "polly.us-east-1.amazonaws.com",
-	"pricing":                               "api.pricing.us-east-1.amazonaws.com",
-	"profile":                               "profile.us-east-1.amazonaws.com",
-	"qldb":                                  "qldb.us-east-1.amazonaws.com",
-	"quicksight":                            "quicksight.us-east-1.amazonaws.com",
-	"ram":                                   "ram.us-east-1.amazonaws.com",
-	"rbin":                                  "rbin.us-east-1.amazonaws.com",
-	"rds":                                   "rds.us-east-1.amazonaws.com",
-	"rds-data":                              "rds-data.us-east-1.amazonaws.com",
-	"redshift":                              "redshift.us-east-1.amazonaws.com",
-	"redshift-data":                         "redshift-data.us-east-1.amazonaws.com",
-	"refactor-spaces":                       "refactor-spaces.us-east-1.amazonaws.com",
-	"rekognition":                           "rekognition.us-east-1.amazonaws.com",
-	"resiliencehub":                         "resiliencehub.us-east-1.amazonaws.com",
-	"resource-groups":                       "resource-groups.us-east-1.amazonaws.com",
-	"robomaker":                             "robomaker.us-east-1.amazonaws.com",
-	"route53":                               "route53.amazonaws.com",
-	"route53-recovery-cluster":              "route53-recovery-cluster.us-east-1.amazonaws.com",
-	"route53-recovery-control-config":       "route53-recovery-control-config.us-east-1.amazonaws.com",
-	"route53-recovery-readiness":            "route53-recovery-readiness.us-east-1.amazonaws.com",
-	"route53domains":                        "route53domains.us-east-1.amazonaws.com",
-	"route53resolver":                       "route53resolver.us-east-1.amazonaws.com",
-	"rum":                                   "rum.us-east-1.amazonaws.com",
-	"s3":                                    "s3.amazonaws.com",
-	"s3-outposts":                           "s3-outposts.us-east-1.amazonaws.com",
-	"sagemaker":                             "api.sagemaker.us-east-1.amazonaws.com",
-	"savingsplans":                          "savingsplans.amazonaws.com",
-	"schemas":                               "schemas.us-east-1.amazonaws.com",
-	"secretsmanager":                        "secretsmanager.us-east-1.amazonaws.com",
-	"securityhub":                           "securityhub.us-east-1.amazonaws.com",
-	"serverlessrepo":                        "serverlessrepo.us-east-1.amazonaws.com",
-	"servicecatalog":                        "servicecatalog.us-east-1.amazonaws.com",
-	"servicediscovery":                      "servicediscovery.us-east-1.amazonaws.com",
-	"servicequotas":                         "servicequotas.us-east-1.amazonaws.com",
-	"ses":                                   "email.us-east-1.amazonaws.com",
-	"shield":                                "shield.us-east-1.amazonaws.com",
-	"signer":                                "signer.us-east-1.amazonaws.com",
-	"sms":                                   "sms.us-east-1.amazonaws.com",
-	"sms-voice":                             "sms-voice.pinpoint.us-east-1.amazonaws.com",
-	"snow-device-management":                "snow-device-management.us-east-1.amazonaws.com",
-	"snowball":                              "snowball.us-east-1.amazonaws.com",
-	"sns":                                   "sns.us-east-1.amazonaws.com",
-	"sqs":                                   "sqs.us-east-1.amazonaws.com",
-	"ssm":                                   "ssm.us-east-1.amazonaws.com",
-	"ssm-contacts":                          "ssm-contacts.us-east-1.amazonaws.com",
-	"ssm-incidents":                         "ssm-incidents.us-east-1.amazonaws.com",
-	"sso":                                   "sso.us-east-1.amazonaws.com",
-	"states":                                "states.us-east-1.amazonaws.com",
-	"storagegateway":                        "storagegateway.us-east-1.amazonaws.com",
-	"sts":                                   "sts.amazonaws.com",
-	"support":                               "support.us-east-1.amazonaws.com",
-	"swf":                                   "swf.us-east-1.amazonaws.com",
-	"synthetics":                            "synthetics.us-east-1.amazonaws.com",
-	"tagging":                               "tagging.us-east-1.amazonaws.com",
-	"textract":                              "textract.us-east-1.amazonaws.com",
-	"timestream":                            "query.timestream.us-east-1.amazonaws.com",
-	"transcribe":                            "transcribe.us-east-1.amazonaws.com",
-	"transfer":                              "transfer.us-east-1.amazonaws.com",
-	"translate":                             "translate.us-east-1.amazonaws.com",
-	"voiceid":                               "voiceid.us-east-1.amazonaws.com",
-	"waf":                                   "waf.amazonaws.com",
-	"waf-regional":                          "waf-regional.us-east-1.amazonaws.com",
-	"wafv2":                                 "wafv2.us-east-1.amazonaws.com",
-	"wellarchitected":                       "wellarchitected.us-east-1.amazonaws.com",
-	"wisdom":                                "wisdom.us-east-1.amazonaws.com",
-	"workdocs":                              "workdocs.us-east-1.amazonaws.com",
-	"worklink":                              "worklink.us-east-1.amazonaws.com",
-	"workmail":                              "workmail.us-east-1.amazonaws.com",
-	"workmailmessageflow":                   "workmailmessageflow.us-east-1.amazonaws.com",
-	"workspaces":                            "workspaces.us-east-1.amazonaws.com",
-	"workspaces-web":                        "workspaces-web.us-east-1.amazonaws.com",
-	"xray":                                  "xray.us-east-1.amazonaws.com",
-
-	// TODO here is a list of hostnames sharing same signing names. They are
-	// currently commented out since we don't know how to handle them yet.
-	// "apigateway":      "apigateway.us-east-1.amazonaws.com",
-	// "apigateway":      "execute-api.us-east-1.amazonaws.com",
-	// "aws-marketplace": "catalog.marketplace.us-east-1.amazonaws.com",
-	// "aws-marketplace": "entitlement.marketplace.us-east-1.amazonaws.com",
-	// "aws-marketplace": "metering.marketplace.us-east-1.amazonaws.com",
-	// "chime":           "chime.us-east-1.amazonaws.com",
-	// "chime":           "identity-chime.us-east-1.amazonaws.com",
-	// "chime":           "meetings-chime.us-east-1.amazonaws.com",
-	// "chime":           "messaging-chime.us-east-1.amazonaws.com",
-	// "cloudhsm":        "cloudhsm.us-east-1.amazonaws.com",
-	// "cloudhsm":        "cloudhsmv2.us-east-1.amazonaws.com",
-	// "cloudsearch":     "cloudsearch.us-east-1.amazonaws.com",
-	// "cloudsearch":     "cloudsearchdomain.us-east-1.amazonaws.com",
-	// "connect":         "connect.us-east-1.amazonaws.com",
-	// "connect":         "contact-lens.us-east-1.amazonaws.com",
-	// "connect":         "participant.connect.us-east-1.amazonaws.com",
-	// "dynamodb":        "dynamodb.us-east-1.amazonaws.com",
-	// "dynamodb":        "streams.dynamodb.us-east-1.amazonaws.com",
-	// "forecast":        "forecast.us-east-1.amazonaws.com",
-	// "forecast":        "forecastquery.us-east-1.amazonaws.com",
-	// "iot1click":       "devices.iot1click.us-east-1.amazonaws.com",
-	// "iot1click":       "projects.iot1click.us-east-1.amazonaws.com",
-	// "lex":             "models-v2-lex.us-east-1.amazonaws.com",
-	// "lex":             "models.lex.us-east-1.amazonaws.com",
-	// "lex":             "runtime-v2-lex.us-east-1.amazonaws.com",
-	// "lex":             "runtime.lex.us-east-1.amazonaws.com",
-	// "mediastore":      "data.mediastore.us-east-1.amazonaws.com",
-	// "mediastore":      "mediastore.us-east-1.amazonaws.com",
-	// "mgh":             "mgh.us-east-1.amazonaws.com",
-	// "mgh":             "migrationhub-config.us-east-1.amazonaws.com",
-	// "personalize":     "personalize-events.us-east-1.amazonaws.com",
-	// "personalize":     "personalize-runtime.us-east-1.amazonaws.com",
-	// "personalize":     "personalize.us-east-1.amazonaws.com",
-	// "qldb":            "session.qldb.us-east-1.amazonaws.com",
-	// "qldb":            "qldb.us-east-1.amazonaws.com",
-	// "s3":              "s3-control.dualstack.us-east-1.amazonaws.com",
-	// "s3":              "s3.amazonaws.com",
-	// "sagemaker":       "a2i-runtime.sagemaker.us-east-1.amazonaws.com",
-	// "sagemaker":       "api.sagemaker.us-east-1.amazonaws.com",
-	// "sagemaker":       "edge.sagemaker.us-east-1.amazonaws.com",
-	// "sagemaker":       "featurestore-runtime.sagemaker.us-east-1.amazonaws.com",
-	// "sagemaker":       "runtime.sagemaker.us-east-1.amazonaws.com",
-	// "servicecatalog":  "servicecatalog-appregistry.us-east-1.amazonaws.com",
-	// "servicecatalog":  "servicecatalog.us-east-1.amazonaws.com",
-	// "timestream":      "ingest.timestream.us-east-1.amazonaws.com",
-	// "timestream":      "query.timestream.us-east-1.amazonaws.com",
-	// "transcribe":      "transcribe.us-east-1.amazonaws.com",
-	// "transcribe":      "transcribestreaming.us-east-1.amazonaws.com",
-}
-
-func TestResolveEndpoints(t *testing.T) {
-	signer := v4.NewSigner(credentials.NewStaticCredentials("fakeClientKeyID", "fakeClientSecret", ""))
-	region := "us-east-1"
-	now := time.Now()
-
-	for signingName := range signingNameToHostname {
-		req, err := http.NewRequest("GET", "http://localhost", nil)
-		require.NoError(t, err)
-
-		_, err = signer.Sign(req, bytes.NewReader(nil), signingName, region, now)
-		require.NoError(t, err)
-
-		endpoint, err := resolveEndpoint(req)
-		require.NoError(t, err)
-		require.Equal(t, signingName, endpoint.SigningName)
-		require.Equal(t, "https://"+signingNameToHostname[signingName], endpoint.URL, "for signing name %q", signingName)
-	}
-}
diff --git a/lib/srv/app/aws/handler.go b/lib/srv/app/aws/handler.go
index 96936dd2073b4..4a5a820cb099e 100644
--- a/lib/srv/app/aws/handler.go
+++ b/lib/srv/app/aws/handler.go
@@ -185,6 +185,20 @@ func (s *SigningService) formatForwardResponseError(rw http.ResponseWriter, r *h
 	}
 }
 
+// resolveEndpoint extracts the aws-service on and aws-region from the request authorization header
+// and resolves the aws-service and aws-region to AWS endpoint.
+func resolveEndpoint(r *http.Request) (*endpoints.ResolvedEndpoint, error) {
+	awsAuthHeader, err := awsutils.ParseSigV4(r.Header.Get(awsutils.AuthorizationHeader))
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	resolvedEndpoint, err := endpoints.DefaultResolver().EndpointFor(awsAuthHeader.Service, awsAuthHeader.Region)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &resolvedEndpoint, nil
+}
+
 // prepareSignedRequest creates a new HTTP request and rewrites the header from the original request and returns a new
 // HTTP request signed by STS AWS API.
 func (s *SigningService) prepareSignedRequest(r *http.Request, re *endpoints.ResolvedEndpoint, identity *tlsca.Identity) (*http.Request, error) {
diff --git a/lib/srv/app/server.go b/lib/srv/app/server.go
index 83e3a9f5884b2..148a039f3c3dc 100644
--- a/lib/srv/app/server.go
+++ b/lib/srv/app/server.go
@@ -203,10 +203,10 @@ func (m *monitoredApps) setResources(apps types.Apps) {
 	m.resources = apps
 }
 
-func (m *monitoredApps) get() types.ResourcesWithLabelsMap {
+func (m *monitoredApps) get() types.ResourcesWithLabels {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	return append(m.static, m.resources...).AsResources().ToMap()
+	return append(m.static, m.resources...).AsResources()
 }
 
 // New returns a new application server.
diff --git a/lib/srv/app/server_test.go b/lib/srv/app/server_test.go
index aa1a6e935c0af..0f6bbbe67e788 100644
--- a/lib/srv/app/server_test.go
+++ b/lib/srv/app/server_test.go
@@ -155,7 +155,7 @@ func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 	err = s.tlsServer.Auth().UpsertRole(context.Background(), s.role)
 	require.NoError(t, err)
 
-	rootCA, err := s.tlsServer.Auth().GetCertAuthority(context.Background(), types.CertAuthID{
+	rootCA, err := s.tlsServer.Auth().GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: "root.example.com",
 	}, false)
diff --git a/lib/srv/app/watcher.go b/lib/srv/app/watcher.go
index 94552cf92be37..7f8cc11b1f81c 100644
--- a/lib/srv/app/watcher.go
+++ b/lib/srv/app/watcher.go
@@ -18,13 +18,11 @@ package app
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/utils"
+
 	"github.com/gravitational/trace"
 )
 
@@ -84,11 +82,7 @@ func (s *Server) startResourceWatcher(ctx context.Context) (*services.AppWatcher
 		for {
 			select {
 			case apps := <-watcher.AppsC:
-				appsWithAddr := make(types.Apps, 0, len(apps))
-				for _, app := range apps {
-					appsWithAddr = append(appsWithAddr, s.guessPublicAddr(app))
-				}
-				s.monitoredApps.setResources(appsWithAddr)
+				s.monitoredApps.setResources(apps)
 				select {
 				case s.reconcileCh <- struct{}{}:
 				case <-ctx.Done():
@@ -103,54 +97,8 @@ func (s *Server) startResourceWatcher(ctx context.Context) (*services.AppWatcher
 	return watcher, nil
 }
 
-// guessPublicAddr will guess PublicAddr for given application if it is missing, based on proxy information and app name.
-func (s *Server) guessPublicAddr(app types.Application) types.Application {
-	if app.GetPublicAddr() != "" {
-		return app
-	}
-	appCopy := app.Copy()
-	pubAddr, err := FindPublicAddr(s.c.AccessPoint, app.GetPublicAddr(), app.GetName())
-	if err == nil {
-		appCopy.Spec.PublicAddr = pubAddr
-	} else {
-		s.log.WithError(err).Errorf("Unable to find public address for app %q, leaving empty.", app.GetName())
-	}
-	return appCopy
-}
-
-// FindPublicAddr tries to resolve the public address of the proxy of this cluster.
-func FindPublicAddr(authClient auth.ReadAppsAccessPoint, appPublicAddr string, appName string) (string, error) {
-	// If the application has a public address already set, use it.
-	if appPublicAddr != "" {
-		return appPublicAddr, nil
-	}
-
-	// Fetch list of proxies, if first has public address set, use it.
-	servers, err := authClient.GetProxies()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	if len(servers) == 0 {
-		return "", trace.BadParameter("cluster has no proxy registered, at least one proxy must be registered for application access")
-	}
-	if servers[0].GetPublicAddr() != "" {
-		addr, err := utils.ParseAddr(servers[0].GetPublicAddr())
-		if err != nil {
-			return "", trace.Wrap(err)
-		}
-		return fmt.Sprintf("%v.%v", appName, addr.Host()), nil
-	}
-
-	// Fall back to cluster name.
-	cn, err := authClient.GetClusterName()
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	return fmt.Sprintf("%v.%v", appName, cn.GetClusterName()), nil
-}
-
-func (s *Server) getResources() (resources types.ResourcesWithLabelsMap) {
-	return s.getApps().AsResources().ToMap()
+func (s *Server) getResources() (resources types.ResourcesWithLabels) {
+	return s.getApps().AsResources()
 }
 
 func (s *Server) onCreate(ctx context.Context, resource types.ResourceWithLabels) error {
diff --git a/lib/srv/authhandlers.go b/lib/srv/authhandlers.go
index 0615da51ca3f8..4664b43a2f33a 100644
--- a/lib/srv/authhandlers.go
+++ b/lib/srv/authhandlers.go
@@ -17,7 +17,6 @@ limitations under the License.
 package srv
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -508,7 +507,7 @@ func (h *AuthHandlers) fetchRoleSet(cert *ssh.Certificate, ca types.CertAuthorit
 // Certificate Authority and returns it.
 func (h *AuthHandlers) authorityForCert(caType types.CertAuthType, key ssh.PublicKey) (types.CertAuthority, error) {
 	// get all certificate authorities for given type
-	cas, err := h.c.AccessPoint.GetCertAuthorities(context.TODO(), caType, false)
+	cas, err := h.c.AccessPoint.GetCertAuthorities(caType, false)
 	if err != nil {
 		h.log.Warnf("%v", trace.DebugReport(err))
 		return nil, trace.Wrap(err)
diff --git a/lib/srv/ctx.go b/lib/srv/ctx.go
index 273e9172d4c42..05157991b7809 100644
--- a/lib/srv/ctx.go
+++ b/lib/srv/ctx.go
@@ -99,7 +99,7 @@ type AccessPoint interface {
 	GetRole(ctx context.Context, name string) (types.Role, error)
 
 	// GetCertAuthorities returns a list of cert authorities
-	GetCertAuthorities(ctx context.Context, caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
+	GetCertAuthorities(caType types.CertAuthType, loadKeys bool, opts ...services.MarshalOption) ([]types.CertAuthority, error)
 }
 
 // Server is regular or forwarding SSH server.
@@ -369,18 +369,6 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 		cancel:                 cancel,
 	}
 
-	fields := log.Fields{
-		"local":        child.ServerConn.LocalAddr(),
-		"remote":       child.ServerConn.RemoteAddr(),
-		"login":        child.Identity.Login,
-		"teleportUser": child.Identity.TeleportUser,
-		"id":           child.id,
-	}
-	child.Entry = log.WithFields(log.Fields{
-		trace.Component:       child.srv.Component(),
-		trace.ComponentFields: fields,
-	})
-
 	authPref, err := srv.GetAccessPoint().GetAuthPreference(ctx)
 	if err != nil {
 		childErr := child.Close()
@@ -391,7 +379,13 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 		child.disconnectExpiredCert = identityContext.CertValidBefore
 	}
 
-	// Update log entry fields.
+	fields := log.Fields{
+		"local":        child.ServerConn.LocalAddr(),
+		"remote":       child.ServerConn.RemoteAddr(),
+		"login":        child.Identity.Login,
+		"teleportUser": child.Identity.TeleportUser,
+		"id":           child.id,
+	}
 	if !child.disconnectExpiredCert.IsZero() {
 		fields["cert"] = child.disconnectExpiredCert
 	}
diff --git a/lib/srv/db/access_test.go b/lib/srv/db/access_test.go
index d7f0884f2ee2c..e8824cd564219 100644
--- a/lib/srv/db/access_test.go
+++ b/lib/srv/db/access_test.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"sort"
 	"sync"
 	"testing"
 	"time"
@@ -428,31 +429,6 @@ func TestAccessMySQLChangeUser(t *testing.T) {
 	require.Error(t, err)
 }
 
-func TestMySQLCloseConnection(t *testing.T) {
-	ctx := context.Background()
-	testCtx := setupTestContext(ctx, t, withSelfHostedMySQL("mysql"))
-	go testCtx.startHandlingConnections()
-
-	// Create user/role with the requested permissions.
-	testCtx.createUserAndRole(ctx, t, "alice", "admin", []string{"alice"}, []string{types.Wildcard})
-
-	// Connect to the database as this user.
-	mysqlConn, err := testCtx.mysqlClient("alice", "mysql", "alice")
-	require.NoError(t, err)
-
-	_, err = mysqlConn.Execute("select 1")
-	require.NoError(t, err)
-
-	// Close connection to DB proxy
-	err = mysqlConn.Close()
-	require.NoError(t, err)
-
-	// DB proxy should close the DB connection and send COM_QUIT message.
-	require.Eventually(t, func() bool {
-		return testCtx.mysql["mysql"].db.ConnsClosed()
-	}, 2*time.Second, 100*time.Millisecond)
-}
-
 // TestAccessRedisAUTHDefaultCmd checks if empty user can log in to Redis as default.
 func TestAccessRedisAUTHDefaultCmd(t *testing.T) {
 	ctx := context.Background()
@@ -517,9 +493,6 @@ func TestAccessMySQLServerPacket(t *testing.T) {
 	// in a way that previously would cause our packet parsing logic to fail.
 	_, err = mysqlConn.Execute("show tables")
 	require.NoError(t, err)
-
-	err = mysqlConn.Close()
-	require.NoError(t, err)
 }
 
 // TestGCPRequireSSL tests connecting to GCP Cloud SQL Postgres and MySQL
@@ -798,12 +771,12 @@ func TestAccessMongoDB(t *testing.T) {
 					testCtx.createUserAndRole(ctx, t, test.user, test.role, test.allowDbUsers, test.allowDbNames)
 
 					// Try to connect to the database as this user.
-					mongoClient, err := testCtx.mongoClient(ctx, test.user, "mongo", test.dbUser, clientOpt.opts)
-					t.Cleanup(func() {
-						if mongoClient != nil {
-							require.NoError(t, mongoClient.Disconnect(ctx))
+					client, err := testCtx.mongoClient(ctx, test.user, "mongo", test.dbUser, clientOpt.opts)
+					defer func() {
+						if client != nil {
+							client.Disconnect(ctx)
 						}
-					})
+					}()
 					if test.connectErr != "" {
 						require.Error(t, err)
 						require.Contains(t, err.Error(), test.connectErr)
@@ -812,14 +785,13 @@ func TestAccessMongoDB(t *testing.T) {
 					require.NoError(t, err)
 
 					// Execute a "find" command. Collection name doesn't matter currently.
-					records, err := mongoClient.Database(test.dbName).Collection("test").Find(ctx, bson.M{})
+					_, err = client.Database(test.dbName).Collection("test").Find(ctx, bson.M{})
 					if test.queryErr != "" {
 						require.Error(t, err)
 						require.Contains(t, err.Error(), test.queryErr)
 						return
 					}
 					require.NoError(t, err)
-					require.NoError(t, records.Close(ctx))
 				})
 			}
 		}
@@ -949,7 +921,7 @@ func TestCompatibilityWithOldAgents(t *testing.T) {
 		},
 	})
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.proxyConn {
 			go databaseServer.HandleConnection(conn)
 		}
 	}()
@@ -1250,6 +1222,7 @@ type testContext struct {
 	mux            *multiplexer.Mux
 	mysqlListener  net.Listener
 	webListener    *multiplexer.WebListener
+	proxyConn      chan net.Conn
 	fakeRemoteSite *reversetunnel.FakeRemoteSite
 	server         *Server
 	emitter        *testEmitter
@@ -1327,7 +1300,7 @@ func (c *testContext) startHandlingConnections() {
 	// Start all proxy services.
 	c.startProxy()
 	// Start handling database client connections on the database server.
-	for conn := range c.fakeRemoteSite.ProxyConn() {
+	for conn := range c.proxyConn {
 		go c.server.HandleConnection(conn)
 	}
 }
@@ -1545,12 +1518,6 @@ func (c *testContext) Close() error {
 	return trace.NewAggregate(errors...)
 }
 
-func init() {
-	// Override database agents shuffle behavior to ensure they're always
-	// tried in the same order during tests. Used for HA tests.
-	SetShuffleFunc(ShuffleSort)
-}
-
 func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDatabaseOption) *testContext {
 	testCtx := &testContext{
 		clusterName: "root.example.com",
@@ -1571,12 +1538,8 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 		Dir:         t.TempDir(),
 	})
 	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, authServer.Close()) })
-
 	testCtx.tlsServer, err = authServer.NewTestTLSServer()
 	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, testCtx.tlsServer.Close()) })
-
 	testCtx.authServer = testCtx.tlsServer.Auth()
 
 	// Create multiplexer.
@@ -1594,7 +1557,6 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 		Listener: tls.NewListener(testCtx.mux.TLS(), testCtx.makeTLSConfig(t)),
 	})
 	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, testCtx.webListener.Close()) })
 
 	// Create MySQL proxy listener.
 	testCtx.mysqlListener, err = net.Listen("tcp", "localhost:0")
@@ -1610,16 +1572,12 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 	// Auth client for database service.
 	testCtx.authClient, err = testCtx.tlsServer.NewClient(auth.TestServerID(types.RoleDatabase, testCtx.hostID))
 	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, testCtx.authClient.Close()) })
-
-	testCtx.hostCA, err = testCtx.authClient.GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: testCtx.clusterName}, false)
+	testCtx.hostCA, err = testCtx.authClient.GetCertAuthority(types.CertAuthID{Type: types.HostCA, DomainName: testCtx.clusterName}, false)
 	require.NoError(t, err)
 
 	// Auth client, lock watcher and authorizer for database proxy.
 	proxyAuthClient, err := testCtx.tlsServer.NewClient(auth.TestBuiltin(types.RoleProxy))
 	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, proxyAuthClient.Close()) })
-
 	proxyLockWatcher, err := services.NewLockWatcher(ctx, services.LockWatcherConfig{
 		ResourceWatcherConfig: services.ResourceWatcherConfig{
 			Component: teleport.ComponentProxy,
@@ -1643,10 +1601,12 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 	}
 
 	// Establish fake reversetunnel b/w database proxy and database service.
-	testCtx.fakeRemoteSite = reversetunnel.NewFakeRemoteSite(testCtx.clusterName, proxyAuthClient)
-	t.Cleanup(func() {
-		testCtx.fakeRemoteSite.Close()
-	})
+	testCtx.proxyConn = make(chan net.Conn)
+	testCtx.fakeRemoteSite = &reversetunnel.FakeRemoteSite{
+		Name:        testCtx.clusterName,
+		ConnCh:      testCtx.proxyConn,
+		AccessPoint: proxyAuthClient,
+	}
 	tunnel := &reversetunnel.FakeServer{
 		Sites: []reversetunnel.RemoteSite{
 			testCtx.fakeRemoteSite,
@@ -1670,6 +1630,11 @@ func setupTestContext(ctx context.Context, t *testing.T, withDatabases ...withDa
 		Emitter:     testCtx.emitter,
 		Clock:       testCtx.clock,
 		ServerID:    "proxy-server",
+		Shuffle: func(servers []types.DatabaseServer) []types.DatabaseServer {
+			// To ensure predictability in tests, sort servers instead of shuffling.
+			sort.Sort(types.DatabaseServers(servers))
+			return servers
+		},
 		LockWatcher: proxyLockWatcher,
 	})
 	require.NoError(t, err)
@@ -1964,9 +1929,7 @@ func withSelfHostedMySQL(name string) withDatabaseOption {
 		})
 		require.NoError(t, err)
 		go mysqlServer.Serve()
-		t.Cleanup(func() {
-			require.NoError(t, mysqlServer.Close())
-		})
+		t.Cleanup(func() { mysqlServer.Close() })
 		database, err := types.NewDatabaseV3(types.Metadata{
 			Name: name,
 		}, types.DatabaseSpecV3{
diff --git a/lib/srv/db/audit_test.go b/lib/srv/db/audit_test.go
index c6d621b62b782..4b85e6058dbd7 100644
--- a/lib/srv/db/audit_test.go
+++ b/lib/srv/db/audit_test.go
@@ -122,22 +122,22 @@ func TestAuditMongo(t *testing.T) {
 	waitForEvent(t, testCtx, libevents.DatabaseSessionStartFailureCode)
 
 	// Connect should trigger successful session start event.
-	mongoClient, err := testCtx.mongoClient(ctx, "alice", "mongo", "admin")
+	mongo, err := testCtx.mongoClient(ctx, "alice", "mongo", "admin")
 	require.NoError(t, err)
 	waitForEvent(t, testCtx, libevents.DatabaseSessionStartCode)
 
 	// Find command in a database we don't have access to.
-	_, err = mongoClient.Database("notadmin").Collection("test").Find(ctx, bson.M{})
+	_, err = mongo.Database("notadmin").Collection("test").Find(ctx, bson.M{})
 	require.Error(t, err)
 	waitForEvent(t, testCtx, libevents.DatabaseSessionQueryFailedCode)
 
 	// Find command should trigger the query event.
-	_, err = mongoClient.Database("admin").Collection("test").Find(ctx, bson.M{})
+	_, err = mongo.Database("admin").Collection("test").Find(ctx, bson.M{})
 	require.NoError(t, err)
 	waitForEvent(t, testCtx, libevents.DatabaseSessionQueryCode)
 
 	// Closing connection should trigger session end event.
-	err = mongoClient.Disconnect(ctx)
+	err = mongo.Disconnect(ctx)
 	require.NoError(t, err)
 	waitForEvent(t, testCtx, libevents.DatabaseSessionEndCode)
 }
diff --git a/lib/srv/db/ca.go b/lib/srv/db/ca.go
index aeb3c8c01a80c..dbb4a05b53097 100644
--- a/lib/srv/db/ca.go
+++ b/lib/srv/db/ca.go
@@ -19,9 +19,8 @@ package db
 import (
 	"context"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"net/http"
-	"os"
 	"path/filepath"
 
 	"github.com/gravitational/teleport"
@@ -82,7 +81,7 @@ func (s *Server) getCACert(ctx context.Context, database types.Database) ([]byte
 	// It's already downloaded.
 	if err == nil {
 		s.log.Debugf("Loaded CA certificate %v.", filePath)
-		return os.ReadFile(filePath)
+		return ioutil.ReadFile(filePath)
 	}
 	// Otherwise download it.
 	s.log.Debugf("Downloading CA certificate for %v.", database)
@@ -91,7 +90,7 @@ func (s *Server) getCACert(ctx context.Context, database types.Database) ([]byte
 		return nil, trace.Wrap(err)
 	}
 	// Save to the filesystem.
-	err = os.WriteFile(filePath, bytes, teleport.FileMaskOwnerOnly)
+	err = ioutil.WriteFile(filePath, bytes, teleport.FileMaskOwnerOnly)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -159,7 +158,7 @@ func (d *realDownloader) downloadFromURL(downloadURL string) ([]byte, error) {
 		return nil, trace.BadParameter("status code %v when fetching from %q",
 			resp.StatusCode, downloadURL)
 	}
-	bytes, err := io.ReadAll(resp.Body)
+	bytes, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/srv/db/ca_test.go b/lib/srv/db/ca_test.go
index 663dd5dba4e98..5525f81697934 100644
--- a/lib/srv/db/ca_test.go
+++ b/lib/srv/db/ca_test.go
@@ -237,7 +237,7 @@ func setupPostgres(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *tes
 	})
 
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.proxyConn {
 			go server1.HandleConnection(conn)
 		}
 	}()
@@ -282,7 +282,7 @@ func setupMySQL(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *testCo
 	})
 
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.proxyConn {
 			go server1.HandleConnection(conn)
 		}
 	}()
@@ -307,9 +307,7 @@ func setupMongo(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *testCo
 	})
 	require.NoError(t, err)
 	go mongoServer.Serve()
-	t.Cleanup(func() {
-		require.NoError(t, mongoServer.Close())
-	})
+	t.Cleanup(func() { mongoServer.Close() })
 
 	mongoDB, err := types.NewDatabaseV3(types.Metadata{
 		Name: "mongo",
@@ -327,12 +325,9 @@ func setupMongo(ctx context.Context, t *testing.T, cfg *setupTLSTestCfg) *testCo
 	server1 := testCtx.setupDatabaseServer(ctx, t, agentParams{
 		Databases: types.Databases{mongoDB},
 	})
-	t.Cleanup(func() {
-		require.NoError(t, server1.Close())
-	})
 
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.proxyConn {
 			go server1.HandleConnection(conn)
 		}
 	}()
@@ -468,12 +463,11 @@ func TestTLSConfiguration(t *testing.T) {
 						})
 
 						mongoConn, err := testCtx.mongoClient(ctx, "bob", "mongo", "admin")
-						t.Cleanup(func() {
-							err = mongoConn.Disconnect(ctx)
-							require.NoError(t, err)
-						})
 						if tt.errMsg == "" {
 							require.NoError(t, err)
+
+							err = mongoConn.Disconnect(ctx)
+							require.NoError(t, err)
 						} else {
 							require.Error(t, err)
 							// Do not verify Mongo error message. On authentication error Mongo re-tries and
diff --git a/lib/srv/db/cloud/watchers/rds.go b/lib/srv/db/cloud/watchers/rds.go
index 17fa187f6787d..8d11c09d28334 100644
--- a/lib/srv/db/cloud/watchers/rds.go
+++ b/lib/srv/db/cloud/watchers/rds.go
@@ -106,21 +106,6 @@ func (f *rdsDBInstancesFetcher) getRDSDatabases(ctx context.Context) (types.Data
 	}
 	databases := make(types.Databases, 0, len(instances))
 	for _, instance := range instances {
-		if !services.IsRDSInstanceSupported(instance) {
-			f.log.Debugf("RDS instance %q (engine mode %v, engine version %v) doesn't support IAM authentication. Skipping.",
-				aws.StringValue(instance.DBInstanceIdentifier),
-				aws.StringValue(instance.Engine),
-				aws.StringValue(instance.EngineVersion))
-			continue
-		}
-
-		if !services.IsRDSInstanceAvailable(instance) {
-			f.log.Debugf("The current status of RDS instance %q is %q. Skipping.",
-				aws.StringValue(instance.DBInstanceIdentifier),
-				aws.StringValue(instance.DBInstanceStatus))
-			continue
-		}
-
 		database, err := services.NewDatabaseFromRDSInstance(instance)
 		if err != nil {
 			f.log.Warnf("Could not convert RDS instance %q to database resource: %v.",
@@ -210,13 +195,6 @@ func (f *rdsAuroraClustersFetcher) getAuroraDatabases(ctx context.Context) (type
 			continue
 		}
 
-		if !services.IsRDSClusterAvailable(cluster) {
-			f.log.Debugf("The current status of Aurora cluster %q is %q. Skipping.",
-				aws.StringValue(cluster.DBClusterIdentifier),
-				aws.StringValue(cluster.Status))
-			continue
-		}
-
 		// Add a database from primary endpoint
 		database, err := services.NewDatabaseFromRDSCluster(cluster)
 		if err != nil {
@@ -283,8 +261,7 @@ func rdsFilters() []*rds.Filter {
 		Name: aws.String("engine"),
 		Values: aws.StringSlice([]string{
 			services.RDSEnginePostgres,
-			services.RDSEngineMySQL,
-			services.RDSEngineMariaDB}),
+			services.RDSEngineMySQL}),
 	}}
 }
 
diff --git a/lib/srv/db/cloud/watchers/redshift.go b/lib/srv/db/cloud/watchers/redshift.go
index 33baed413046d..2a8f8a98ba7db 100644
--- a/lib/srv/db/cloud/watchers/redshift.go
+++ b/lib/srv/db/cloud/watchers/redshift.go
@@ -86,13 +86,6 @@ func (f *redshiftFetcher) Get(ctx context.Context) (types.Databases, error) {
 
 	var databases types.Databases
 	for _, cluster := range clusters {
-		if !services.IsRedshiftClusterAvailable(cluster) {
-			f.log.Debugf("The current status of Redshift cluster %q is %q. Skipping.",
-				aws.StringValue(cluster.ClusterIdentifier),
-				aws.StringValue(cluster.ClusterStatus))
-			continue
-		}
-
 		database, err := services.NewDatabaseFromRedshiftCluster(cluster)
 		if err != nil {
 			f.log.Infof("Could not convert Redshift cluster %q to database resource: %v.",
diff --git a/lib/srv/db/cloud/watchers/watcher_test.go b/lib/srv/db/cloud/watchers/watcher_test.go
index bcb3ddb8fa7e7..f8ab8f50e662d 100644
--- a/lib/srv/db/cloud/watchers/watcher_test.go
+++ b/lib/srv/db/cloud/watchers/watcher_test.go
@@ -44,20 +44,14 @@ func TestWatcher(t *testing.T) {
 	rdsInstance2, _ := makeRDSInstance(t, "instance-2", "us-east-2", map[string]string{"env": "prod"})
 	rdsInstance3, _ := makeRDSInstance(t, "instance-3", "us-east-1", map[string]string{"env": "dev"})
 	rdsInstance4, rdsDatabase4 := makeRDSInstance(t, "instance-4", "us-west-1", nil)
-	rdsInstanceUnavailable, _ := makeRDSInstance(t, "instance-5", "us-west-1", nil, withRDSInstanceStatus("stopped"))
-	rdsInstanceUnknownStatus, rdsDatabaseUnknownStatus := makeRDSInstance(t, "instance-5", "us-west-6", nil, withRDSInstanceStatus("status-does-not-exist"))
 
-	auroraCluster1, auroraDatabase1 := makeRDSCluster(t, "cluster-1", "us-east-1", map[string]string{"env": "prod"})
+	auroraCluster1, auroraDatabase1 := makeRDSCluster(t, "cluster-1", "us-east-1", services.RDSEngineModeProvisioned, map[string]string{"env": "prod"})
 	auroraCluster2, auroraDatabases2 := makeRDSClusterWithExtraEndpoints(t, "cluster-2", "us-east-2", map[string]string{"env": "dev"})
-	auroraCluster3, _ := makeRDSCluster(t, "cluster-3", "us-east-2", map[string]string{"env": "prod"})
-	auroraClusterUnsupported, _ := makeRDSCluster(t, "serverless", "us-east-1", nil, withRDSClusterEngineMode("serverless"))
-	auroraClusterUnavailable, _ := makeRDSCluster(t, "cluster-4", "us-east-1", nil, withRDSClusterStatus("creating"))
-	auroraClusterUnknownStatus, auroraDatabaseUnknownStatus := makeRDSCluster(t, "cluster-5", "us-east-1", nil, withRDSClusterStatus("status-does-not-exist"))
+	auroraCluster3, _ := makeRDSCluster(t, "cluster-3", "us-east-2", services.RDSEngineModeProvisioned, map[string]string{"env": "prod"})
+	auroraClusterUnsupported, _ := makeRDSCluster(t, "serverless", "us-east-1", services.RDSEngineModeServerless, map[string]string{"env": "prod"})
 
 	redshiftUse1Prod, redshiftDatabaseUse1Prod := makeRedshiftCluster(t, "us-east-1", "prod")
 	redshiftUse1Dev, _ := makeRedshiftCluster(t, "us-east-1", "dev")
-	redshiftUse1Unavailable, _ := makeRedshiftCluster(t, "us-east-1", "qa", withRedshiftStatus("paused"))
-	redshiftUse1UnknownStatus, redshiftDatabaseUnknownStatus := makeRedshiftCluster(t, "us-east-1", "test", withRedshiftStatus("status-does-not-exist"))
 
 	tests := []struct {
 		name              string
@@ -66,7 +60,7 @@ func TestWatcher(t *testing.T) {
 		expectedDatabases types.Databases
 	}{
 		{
-			name: "RDS labels matching",
+			name: "rds labels matching",
 			awsMatchers: []services.AWSMatcher{
 				{
 					Types:   []string{services.AWSMatcherRDS},
@@ -94,7 +88,7 @@ func TestWatcher(t *testing.T) {
 			expectedDatabases: append(types.Databases{rdsDatabase1, auroraDatabase1}, auroraDatabases2...),
 		},
 		{
-			name: "RDS unsupported databases are skipped",
+			name: "rds aurora unsupported",
 			awsMatchers: []services.AWSMatcher{{
 				Types:   []string{services.AWSMatcherRDS},
 				Regions: []string{"us-east-1"},
@@ -109,21 +103,6 @@ func TestWatcher(t *testing.T) {
 			},
 			expectedDatabases: types.Databases{auroraDatabase1},
 		},
-		{
-			name: "RDS unavailable databases are skipped",
-			awsMatchers: []services.AWSMatcher{{
-				Types:   []string{services.AWSMatcherRDS},
-				Regions: []string{"us-east-1"},
-				Tags:    types.Labels{"*": []string{"*"}},
-			}},
-			clients: &common.TestCloudClients{
-				RDS: &cloud.RDSMock{
-					DBInstances: []*rds.DBInstance{rdsInstance1, rdsInstanceUnavailable, rdsInstanceUnknownStatus},
-					DBClusters:  []*rds.DBCluster{auroraCluster1, auroraClusterUnavailable, auroraClusterUnknownStatus},
-				},
-			},
-			expectedDatabases: types.Databases{rdsDatabase1, rdsDatabaseUnknownStatus, auroraDatabase1, auroraDatabaseUnknownStatus},
-		},
 		{
 			name: "skip access denied errors",
 			awsMatchers: []services.AWSMatcher{{
@@ -147,7 +126,7 @@ func TestWatcher(t *testing.T) {
 			expectedDatabases: types.Databases{rdsDatabase4, auroraDatabase1},
 		},
 		{
-			name: "Redshift labels matching",
+			name: "redshift",
 			awsMatchers: []services.AWSMatcher{
 				{
 					Types:   []string{services.AWSMatcherRedshift},
@@ -162,22 +141,6 @@ func TestWatcher(t *testing.T) {
 			},
 			expectedDatabases: types.Databases{redshiftDatabaseUse1Prod},
 		},
-		{
-			name: "Redshift unavailable databases are skipped",
-			awsMatchers: []services.AWSMatcher{
-				{
-					Types:   []string{services.AWSMatcherRedshift},
-					Regions: []string{"us-east-1"},
-					Tags:    types.Labels{"*": []string{"*"}},
-				},
-			},
-			clients: &common.TestCloudClients{
-				Redshift: &cloud.RedshiftMock{
-					Clusters: []*redshift.Cluster{redshiftUse1Prod, redshiftUse1Unavailable, redshiftUse1UnknownStatus},
-				},
-			},
-			expectedDatabases: types.Databases{redshiftDatabaseUse1Prod, redshiftDatabaseUnknownStatus},
-		},
 		{
 			name: "matcher with multiple types",
 			awsMatchers: []services.AWSMatcher{
@@ -215,54 +178,43 @@ func TestWatcher(t *testing.T) {
 	}
 }
 
-func makeRDSInstance(t *testing.T, name, region string, labels map[string]string, opts ...func(*rds.DBInstance)) (*rds.DBInstance, types.Database) {
+func makeRDSInstance(t *testing.T, name, region string, labels map[string]string) (*rds.DBInstance, types.Database) {
 	instance := &rds.DBInstance{
 		DBInstanceArn:        aws.String(fmt.Sprintf("arn:aws:rds:%v:1234567890:db:%v", region, name)),
 		DBInstanceIdentifier: aws.String(name),
 		DbiResourceId:        aws.String(uuid.New().String()),
 		Engine:               aws.String(services.RDSEnginePostgres),
-		DBInstanceStatus:     aws.String("available"),
 		Endpoint: &rds.Endpoint{
 			Address: aws.String("localhost"),
 			Port:    aws.Int64(5432),
 		},
 		TagList: labelsToTags(labels),
 	}
-	for _, opt := range opts {
-		opt(instance)
-	}
-
 	database, err := services.NewDatabaseFromRDSInstance(instance)
 	require.NoError(t, err)
 	return instance, database
 }
 
-func makeRDSCluster(t *testing.T, name, region string, labels map[string]string, opts ...func(*rds.DBCluster)) (*rds.DBCluster, types.Database) {
+func makeRDSCluster(t *testing.T, name, region, engineMode string, labels map[string]string) (*rds.DBCluster, types.Database) {
 	cluster := &rds.DBCluster{
 		DBClusterArn:        aws.String(fmt.Sprintf("arn:aws:rds:%v:1234567890:cluster:%v", region, name)),
 		DBClusterIdentifier: aws.String(name),
 		DbClusterResourceId: aws.String(uuid.New().String()),
 		Engine:              aws.String(services.RDSEngineAuroraMySQL),
-		EngineMode:          aws.String(services.RDSEngineModeProvisioned),
-		Status:              aws.String("available"),
+		EngineMode:          aws.String(engineMode),
 		Endpoint:            aws.String("localhost"),
 		Port:                aws.Int64(3306),
 		TagList:             labelsToTags(labels),
 	}
-	for _, opt := range opts {
-		opt(cluster)
-	}
-
 	database, err := services.NewDatabaseFromRDSCluster(cluster)
 	require.NoError(t, err)
 	return cluster, database
 }
 
-func makeRedshiftCluster(t *testing.T, region, env string, opts ...func(*redshift.Cluster)) (*redshift.Cluster, types.Database) {
+func makeRedshiftCluster(t *testing.T, region, env string) (*redshift.Cluster, types.Database) {
 	cluster := &redshift.Cluster{
 		ClusterIdentifier:   aws.String(env),
 		ClusterNamespaceArn: aws.String(fmt.Sprintf("arn:aws:redshift:%s:1234567890:namespace:%s", region, env)),
-		ClusterStatus:       aws.String("available"),
 		Endpoint: &redshift.Endpoint{
 			Address: aws.String("localhost"),
 			Port:    aws.Int64(5439),
@@ -272,10 +224,6 @@ func makeRedshiftCluster(t *testing.T, region, env string, opts ...func(*redshif
 			Value: aws.String(env),
 		}},
 	}
-	for _, opt := range opts {
-		opt(cluster)
-	}
-
 	database, err := services.NewDatabaseFromRedshiftCluster(cluster)
 	require.NoError(t, err)
 	return cluster, database
@@ -288,7 +236,6 @@ func makeRDSClusterWithExtraEndpoints(t *testing.T, name, region string, labels
 		DbClusterResourceId: aws.String(uuid.New().String()),
 		Engine:              aws.String(services.RDSEngineAuroraMySQL),
 		EngineMode:          aws.String(services.RDSEngineModeProvisioned),
-		Status:              aws.String("available"),
 		Endpoint:            aws.String("localhost"),
 		ReaderEndpoint:      aws.String("reader.host"),
 		Port:                aws.Int64(3306),
@@ -312,34 +259,6 @@ func makeRDSClusterWithExtraEndpoints(t *testing.T, name, region string, labels
 	return cluster, append(types.Databases{primaryDatabase, readerDatabase}, customDatabases...)
 }
 
-// withRDSInstanceStatus returns an option function for makeRDSInstance to overwrite status.
-func withRDSInstanceStatus(status string) func(*rds.DBInstance) {
-	return func(instance *rds.DBInstance) {
-		instance.DBInstanceStatus = aws.String(status)
-	}
-}
-
-// withRDSClusterEngineMode returns an option function for makeRDSCluster to overwrite engine mode.
-func withRDSClusterEngineMode(mode string) func(*rds.DBCluster) {
-	return func(cluster *rds.DBCluster) {
-		cluster.EngineMode = aws.String(mode)
-	}
-}
-
-// withRDSClusterStatus returns an option function for makeRDSCluster to overwrite status.
-func withRDSClusterStatus(status string) func(*rds.DBCluster) {
-	return func(cluster *rds.DBCluster) {
-		cluster.Status = aws.String(status)
-	}
-}
-
-// withRedshiftStatus returns an option function for makeRedshiftCluster to overwrite status.
-func withRedshiftStatus(status string) func(*redshift.Cluster) {
-	return func(cluster *redshift.Cluster) {
-		cluster.ClusterStatus = aws.String(status)
-	}
-}
-
 func labelsToTags(labels map[string]string) (tags []*rds.Tag) {
 	for key, val := range labels {
 		tags = append(tags, &rds.Tag{
diff --git a/lib/srv/db/common/errors.go b/lib/srv/db/common/errors.go
index 298ce5f3187b0..3ba4483086be4 100644
--- a/lib/srv/db/common/errors.go
+++ b/lib/srv/db/common/errors.go
@@ -18,10 +18,8 @@ package common
 
 import (
 	"net/http"
-	"strings"
 
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
-	"github.com/gravitational/teleport/lib/defaults"
 
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/jackc/pgconn"
@@ -104,57 +102,3 @@ type causer interface {
 type pgError interface {
 	Unwrap() error
 }
-
-// ConvertConnectError converts common connection errors to trace errors with
-// extra information/recommendations if necessary.
-func ConvertConnectError(err error, sessionCtx *Session) error {
-	errString := err.Error()
-	switch {
-	case strings.Contains(errString, "x509: certificate signed by unknown authority"):
-		return trace.AccessDenied("Database service cannot validate database's certificate: %v. Please verify if the correct CA bundle is used in the database config.", err)
-
-	case strings.Contains(errString, "tls: unknown certificate authority"):
-		return trace.AccessDenied("Database cannot validate client certificate generated by database service: %v.", err)
-	}
-
-	err = ConvertError(err)
-
-	if trace.IsAccessDenied(err) && sessionCtx.Database.IsRDS() {
-		return createRDSAccessDeniedError(err, sessionCtx)
-	}
-
-	return trace.Wrap(err)
-}
-
-// createRDSAccessDeniedError creates an error with help message to setup IAM
-// auth for RDS.
-func createRDSAccessDeniedError(err error, sessionCtx *Session) error {
-	switch sessionCtx.Database.GetProtocol() {
-	case defaults.ProtocolMySQL:
-		return trace.AccessDenied(`Could not connect to database:
-
-  %v
-
-Make sure that IAM auth is enabled for MySQL user %q and Teleport database
-agent's IAM policy has "rds-connect" permissions (note that IAM changes may
-take a few minutes to propagate):
-
-%v
-`, err, sessionCtx.DatabaseUser, sessionCtx.Database.GetIAMPolicy())
-
-	case defaults.ProtocolPostgres:
-		return trace.AccessDenied(`Could not connect to database:
-
-  %v
-
-Make sure that Postgres user %q has "rds_iam" role and Teleport database
-agent's IAM policy has "rds-connect" permissions (note that IAM changes may
-take a few minutes to propagate):
-
-%v
-`, err, sessionCtx.DatabaseUser, sessionCtx.Database.GetIAMPolicy())
-
-	default:
-		return trace.Wrap(err)
-	}
-}
diff --git a/lib/srv/db/common/test.go b/lib/srv/db/common/test.go
index 26568f9cb83d9..5a992e7749d3e 100644
--- a/lib/srv/db/common/test.go
+++ b/lib/srv/db/common/test.go
@@ -145,7 +145,7 @@ func MakeTestClientTLSConfig(config TestClientConfig) (*tls.Config, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ca, err := config.AuthClient.GetCertAuthority(context.Background(), types.CertAuthID{
+	ca, err := config.AuthClient.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: config.Cluster,
 	}, false)
diff --git a/lib/srv/db/ha_test.go b/lib/srv/db/ha_test.go
index 4ee485e2b5960..a6ba7cdbda11a 100644
--- a/lib/srv/db/ha_test.go
+++ b/lib/srv/db/ha_test.go
@@ -76,7 +76,7 @@ func TestHA(t *testing.T) {
 		HostID:    onlineHostID,
 	})
 	go func() {
-		for conn := range testCtx.fakeRemoteSite.ProxyConn() {
+		for conn := range testCtx.proxyConn {
 			go onlineServer.HandleConnection(conn)
 		}
 	}()
diff --git a/lib/srv/db/mongodb/connect.go b/lib/srv/db/mongodb/connect.go
index b4e6f6eb8802d..05dfc3d0609d4 100644
--- a/lib/srv/db/mongodb/connect.go
+++ b/lib/srv/db/mongodb/connect.go
@@ -41,10 +41,10 @@ import (
 // When connecting to a replica set, returns connection to the server selected
 // based on the read preference connection string option. This allows users to
 // configure database access to always connect to a secondary for example.
-func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (driver.Connection, func(), error) {
+func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (driver.Connection, error) {
 	options, selector, err := e.getTopologyOptions(ctx, sessionCtx)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	// Using driver's "topology" package allows to retain low-level control
 	// over server connections (reading/writing wire messages) but at the
@@ -52,31 +52,22 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (drive
 	// in a replica set.
 	top, err := topology.New(options...)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	err = top.Connect()
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	server, err := top.SelectServer(ctx, selector)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	e.Log.Debugf("Cluster topology: %v, selected server %v.", top, server)
 	conn, err := server.Connection(ctx)
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	closeFn := func() {
-		if err := top.Disconnect(ctx); err != nil {
-			e.Log.WithError(err).Warn("Failed to close topology")
-		}
-		if err := conn.Close(); err != nil {
-			e.Log.WithError(err).Error("Failed to close server connection.")
-		}
+		return nil, trace.Wrap(err)
 	}
-	return conn, closeFn, nil
+	return conn, nil
 }
 
 // getTopologyOptions constructs topology options for connecting to a MongoDB server.
diff --git a/lib/srv/db/mongodb/engine.go b/lib/srv/db/mongodb/engine.go
index cfeeebde7cf59..5886cc5fb22c2 100644
--- a/lib/srv/db/mongodb/engine.go
+++ b/lib/srv/db/mongodb/engine.go
@@ -80,11 +80,16 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 		return trace.Wrap(err, "error authorizing database access")
 	}
 	// Establish connection to the MongoDB server.
-	serverConn, closeFn, err := e.connect(ctx, sessionCtx)
+	serverConn, err := e.connect(ctx, sessionCtx)
 	if err != nil {
 		return trace.Wrap(err, "error connecting to the database")
 	}
-	defer closeFn()
+	defer func() {
+		err := serverConn.Close()
+		if err != nil {
+			e.Log.WithError(err).Error("Failed to close server connection.")
+		}
+	}()
 	e.Audit.OnSessionStart(e.Context, sessionCtx, nil)
 	defer e.Audit.OnSessionEnd(e.Context, sessionCtx)
 	// Start reading client messages and sending them to server.
diff --git a/lib/srv/db/mongodb/test.go b/lib/srv/db/mongodb/test.go
index dc99e26083447..1d800d736a518 100644
--- a/lib/srv/db/mongodb/test.go
+++ b/lib/srv/db/mongodb/test.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"crypto/tls"
 	"net"
-	"sync/atomic"
 	"time"
 
 	"github.com/gravitational/teleport/lib/defaults"
@@ -73,8 +72,7 @@ type TestServer struct {
 	port     string
 	log      logrus.FieldLogger
 
-	wireVersion      int
-	activeConnection int32
+	wireVersion int
 }
 
 // TestServerOption allows to set test server options.
@@ -139,8 +137,6 @@ func (s *TestServer) Serve() error {
 		go func() {
 			defer s.log.Debug("Connection done.")
 			defer conn.Close()
-			atomic.AddInt32(&s.activeConnection, 1)
-			defer atomic.AddInt32(&s.activeConnection, -1)
 			if err := s.handleConnection(conn); err != nil {
 				if !utils.IsOKNetworkError(err) {
 					s.log.Errorf("Failed to handle connection: %v.",
@@ -261,11 +257,6 @@ func (s *TestServer) Port() string {
 	return s.port
 }
 
-// GetActiveConnectionsCount returns the current value of activeConnection counter.
-func (s *TestServer) GetActiveConnectionsCount() int32 {
-	return atomic.LoadInt32(&s.activeConnection)
-}
-
 // Close closes the server listener.
 func (s *TestServer) Close() error {
 	return s.listener.Close()
diff --git a/lib/srv/db/mysql/engine.go b/lib/srv/db/mysql/engine.go
index de84f4bbfdf85..6b987b171b018 100644
--- a/lib/srv/db/mysql/engine.go
+++ b/lib/srv/db/mysql/engine.go
@@ -242,7 +242,19 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (*clie
 		dialer,
 		connectOpt)
 	if err != nil {
-		return nil, common.ConvertConnectError(err, sessionCtx)
+		if trace.IsAccessDenied(common.ConvertError(err)) && sessionCtx.Database.IsRDS() {
+			return nil, trace.AccessDenied(`Could not connect to database:
+
+  %v
+
+Make sure that IAM auth is enabled for MySQL user %q and Teleport database
+agent's IAM policy has "rds-connect" permissions (note that IAM changes may
+take a few minutes to propagate):
+
+%v
+`, common.ConvertError(err), sessionCtx.DatabaseUser, sessionCtx.Database.GetIAMPolicy())
+		}
+		return nil, trace.Wrap(err)
 	}
 	return conn, nil
 }
diff --git a/lib/srv/db/mysql/test.go b/lib/srv/db/mysql/test.go
index 520bdc8dc31de..18b4ae22db6c7 100644
--- a/lib/srv/db/mysql/test.go
+++ b/lib/srv/db/mysql/test.go
@@ -19,7 +19,6 @@ package mysql
 import (
 	"crypto/tls"
 	"net"
-	"sync"
 	"sync/atomic"
 
 	"github.com/gravitational/teleport/lib/defaults"
@@ -63,11 +62,6 @@ type TestServer struct {
 	tlsConfig *tls.Config
 	log       logrus.FieldLogger
 	handler   *testHandler
-
-	// serverConnsMtx is a mutex that guards serverConns.
-	serverConnsMtx sync.Mutex
-	// serverConns holds all connections created by the server.
-	serverConns []*server.Conn
 }
 
 // NewTestServer returns a new instance of a test MySQL server.
@@ -158,11 +152,6 @@ func (s *TestServer) handleConnection(conn net.Conn) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-
-	s.serverConnsMtx.Lock()
-	s.serverConns = append(s.serverConns, serverConn)
-	s.serverConnsMtx.Unlock()
-
 	for {
 		if serverConn.Closed() {
 			return nil
@@ -207,20 +196,6 @@ func (s *TestServer) Close() error {
 	return s.listener.Close()
 }
 
-// ConnsClosed returns true if all connections has been correctly closed (message COM_QUIT), false otherwise.
-func (s *TestServer) ConnsClosed() bool {
-	s.serverConnsMtx.Lock()
-	defer s.serverConnsMtx.Unlock()
-
-	for _, conn := range s.serverConns {
-		if !conn.Closed() {
-			return false
-		}
-	}
-
-	return true
-}
-
 type testHandler struct {
 	server.EmptyHandler
 	log logrus.FieldLogger
diff --git a/lib/srv/db/postgres/engine.go b/lib/srv/db/postgres/engine.go
index 44d63f644ea0c..efd2614724d60 100644
--- a/lib/srv/db/postgres/engine.go
+++ b/lib/srv/db/postgres/engine.go
@@ -227,7 +227,19 @@ func (e *Engine) connect(ctx context.Context, sessionCtx *common.Session) (*pgpr
 	// messages b/w server and client e.g. to get client's password.
 	conn, err := pgconn.ConnectConfig(ctx, connectConfig)
 	if err != nil {
-		return nil, nil, common.ConvertConnectError(err, sessionCtx)
+		if trace.IsAccessDenied(common.ConvertError(err)) && sessionCtx.Database.IsRDS() {
+			return nil, nil, trace.AccessDenied(`Could not connect to database:
+
+  %v
+
+Make sure that Postgres user %q has "rds_iam" role and Teleport database
+agent's IAM policy has "rds-connect" permissions (note that IAM changes may
+take a few minutes to propagate):
+
+%v
+`, common.ConvertError(err), sessionCtx.DatabaseUser, sessionCtx.Database.GetIAMPolicy())
+		}
+		return nil, nil, trace.Wrap(err)
 	}
 	// Hijacked connection exposes some internal connection data, such as
 	// parameters we'll need to relay back to the client (e.g. database
diff --git a/lib/srv/db/proxy_test.go b/lib/srv/db/proxy_test.go
index 277fe77009850..c8baf6d720c60 100644
--- a/lib/srv/db/proxy_test.go
+++ b/lib/srv/db/proxy_test.go
@@ -197,9 +197,7 @@ func TestProxyClientDisconnectDueToLockInForce(t *testing.T) {
 		Target: types.LockTarget{User: "alice"},
 	})
 	require.NoError(t, err)
-
-	err = testCtx.authServer.UpsertLock(ctx, lock)
-	require.NoError(t, err)
+	testCtx.authServer.UpsertLock(ctx, lock)
 
 	waitForEvent(t, testCtx, events.ClientDisconnectCode)
 	err = mysql.Ping()
diff --git a/lib/srv/db/proxyserver.go b/lib/srv/db/proxyserver.go
index 3c277360bff00..e4c0ae7a366e8 100644
--- a/lib/srv/db/proxyserver.go
+++ b/lib/srv/db/proxyserver.go
@@ -24,9 +24,6 @@ import (
 	"io"
 	"math/rand"
 	"net"
-	"sort"
-	"strings"
-	"sync"
 	"time"
 
 	"github.com/gravitational/teleport"
@@ -88,51 +85,12 @@ type ProxyServerConfig struct {
 	Clock clockwork.Clock
 	// ServerID is the ID of the audit log server.
 	ServerID string
+	// Shuffle allows to override shuffle logic in tests.
+	Shuffle func([]types.DatabaseServer) []types.DatabaseServer
 	// LockWatcher is a lock watcher.
 	LockWatcher *services.LockWatcher
 }
 
-// ShuffleFunc defines a function that shuffles a list of database servers.
-type ShuffleFunc func([]types.DatabaseServer) []types.DatabaseServer
-
-// ShuffleRandom is a ShuffleFunc that randomizes the order of database servers.
-// Used to provide load balancing behavior when proxying to multiple agents.
-func ShuffleRandom(servers []types.DatabaseServer) []types.DatabaseServer {
-	rand.New(rand.NewSource(time.Now().UnixNano())).Shuffle(
-		len(servers), func(i, j int) {
-			servers[i], servers[j] = servers[j], servers[i]
-		})
-	return servers
-}
-
-// ShuffleSort is a ShuffleFunc that sorts database servers by name and host ID.
-// Used to provide predictable behavior in tests.
-func ShuffleSort(servers []types.DatabaseServer) []types.DatabaseServer {
-	sort.Sort(types.DatabaseServers(servers))
-	return servers
-}
-
-var (
-	// mu protects the shuffleFunc global access.
-	mu sync.RWMutex
-	// shuffleFunc provides shuffle behavior for multiple database agents.
-	shuffleFunc ShuffleFunc = ShuffleRandom
-)
-
-// SetShuffleFunc sets the shuffle behavior when proxying to multiple agents.
-func SetShuffleFunc(fn ShuffleFunc) {
-	mu.Lock()
-	defer mu.Unlock()
-	shuffleFunc = fn
-}
-
-// getShuffleFunc returns the configured function used to shuffle agents.
-func getShuffleFunc() ShuffleFunc {
-	mu.RLock()
-	defer mu.RUnlock()
-	return shuffleFunc
-}
-
 // CheckAndSetDefaults validates the config and sets default values.
 func (c *ProxyServerConfig) CheckAndSetDefaults() error {
 	if c.AccessPoint == nil {
@@ -156,6 +114,15 @@ func (c *ProxyServerConfig) CheckAndSetDefaults() error {
 	if c.ServerID == "" {
 		return trace.BadParameter("missing ServerID")
 	}
+	if c.Shuffle == nil {
+		c.Shuffle = func(servers []types.DatabaseServer) []types.DatabaseServer {
+			rand.New(rand.NewSource(c.Clock.Now().UnixNano())).Shuffle(
+				len(servers), func(i, j int) {
+					servers[i], servers[j] = servers[j], servers[i]
+				})
+			return servers
+		}
+	}
 	if c.LockWatcher == nil {
 		return trace.BadParameter("missing LockWatcher")
 	}
@@ -210,7 +177,7 @@ func (s *ProxyServer) ServePostgres(listener net.Listener) error {
 		go func() {
 			defer clientConn.Close()
 			err := s.PostgresProxy().HandleConnection(s.closeCtx, clientConn)
-			if err != nil && !utils.IsOKNetworkError(err) {
+			if err != nil {
 				s.log.WithError(err).Warn("Failed to handle Postgres client connection.")
 			}
 		}()
@@ -264,9 +231,7 @@ func (s *ProxyServer) serveGenericTLS(listener net.Listener, tlsConfig *tls.Conf
 			defer clientConn.Close()
 			tlsConn := tls.Server(clientConn, tlsConfig)
 			if err := tlsConn.Handshake(); err != nil {
-				if !utils.IsOKNetworkError(err) {
-					s.log.WithError(err).Errorf("%s TLS handshake failed.", dbName)
-				}
+				s.log.WithError(err).Errorf("%s TLS handshake failed.", dbName)
 				return
 			}
 			err := s.handleConnection(tlsConn)
@@ -386,7 +351,7 @@ func (s *ProxyServer) Connect(ctx context.Context, proxyCtx *common.ProxyContext
 	// There may be multiple database servers proxying the same database. If
 	// we get a connection problem error trying to dial one of them, likely
 	// the database server is down so try the next one.
-	for _, server := range getShuffleFunc()(proxyCtx.Servers) {
+	for _, server := range s.cfg.Shuffle(proxyCtx.Servers) {
 		s.log.Debugf("Dialing to %v.", server)
 		tlsConfig, err := s.getConfigForServer(ctx, proxyCtx.Identity, server)
 		if err != nil {
@@ -399,9 +364,9 @@ func (s *ProxyServer) Connect(ctx context.Context, proxyCtx *common.ProxyContext
 			ConnType: types.DatabaseTunnel,
 		})
 		if err != nil {
-			// If an agent is down, we'll retry on the next one (if available).
-			if isReverseTunnelDownError(err) {
-				s.log.WithError(err).Warnf("Failed to dial database %v.", server)
+			// Connection problem indicates reverse tunnel to this server is down.
+			if trace.IsConnectionProblem(err) {
+				s.log.WithError(err).Warnf("Failed to dial %v.", server)
 				continue
 			}
 			return nil, trace.Wrap(err)
@@ -415,13 +380,6 @@ func (s *ProxyServer) Connect(ctx context.Context, proxyCtx *common.ProxyContext
 	return nil, trace.BadParameter("failed to connect to any of the database servers")
 }
 
-// isReverseTunnelDownError returns true if the provided error indicates that
-// the reverse tunnel connection is down e.g. because the agent is down.
-func isReverseTunnelDownError(err error) bool {
-	return trace.IsConnectionProblem(err) ||
-		strings.Contains(err.Error(), reversetunnel.NoDatabaseTunnel)
-}
-
 // Proxy starts proxying all traffic received from database client between
 // this proxy and Teleport database service over reverse tunnel.
 //
diff --git a/lib/srv/db/proxyserver_test.go b/lib/srv/db/proxyserver_test.go
index df6500b49641a..33fe5a69bce4e 100644
--- a/lib/srv/db/proxyserver_test.go
+++ b/lib/srv/db/proxyserver_test.go
@@ -91,10 +91,10 @@ func TestProxyConnectionLimiting(t *testing.T) {
 			t.Run("limit can be hit", func(t *testing.T) {
 				for i := 0; i < connLimitNumber; i++ {
 					// Try to connect to the database.
-					dbConn, err := tt.connect()
+					pgConn, err := tt.connect()
 					require.NoError(t, err)
 
-					connsClosers = append(connsClosers, dbConn)
+					connsClosers = append(connsClosers, pgConn)
 				}
 
 				// This connection should go over the limit.
@@ -114,9 +114,9 @@ func TestProxyConnectionLimiting(t *testing.T) {
 				require.NoError(t, err)
 
 				// Create a new connection. We do not expect an error here as we have just closed one.
-				dbConn, err := tt.connect()
+				pgConn, err := tt.connect()
 				require.NoError(t, err)
-				connsClosers = append(connsClosers, dbConn)
+				connsClosers = append(connsClosers, pgConn)
 
 				// Here the limit should be reached again.
 				_, err = tt.connect()
diff --git a/lib/srv/db/redis/client.go b/lib/srv/db/redis/client.go
deleted file mode 100644
index de0bf1f7fdbdc..0000000000000
--- a/lib/srv/db/redis/client.go
+++ /dev/null
@@ -1,293 +0,0 @@
-/*
-
- Copyright 2022 Gravitational, Inc.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-
-
-*/
-
-package redis
-
-import (
-	"context"
-	"crypto/tls"
-	"net"
-	"strings"
-	"sync"
-
-	"github.com/go-redis/redis/v8"
-	"github.com/gravitational/teleport/lib/srv/db/redis/protocol"
-	"github.com/gravitational/trace"
-)
-
-// Commands with additional processing in Teleport when using cluster mode.
-const (
-	dbsizeCmd   = "dbsize"
-	keysCmd     = "keys"
-	mgetCmd     = "mget"
-	flushallCmd = "flushall"
-	flushdbCmd  = "flushdb"
-	scriptCmd   = "script"
-)
-
-// Overridden subcommands for Redis SCRIPT command.
-const (
-	scriptLoadSubcmd   = "load"
-	scriptExistsSubcmd = "exists"
-	scriptFLushSubcmd  = "flush"
-)
-
-// List of unsupported commands in cluster mode.
-const (
-	aclCmd        = "acl"
-	askingCmd     = "asking"
-	clientCmd     = "client"
-	clusterCmd    = "cluster"
-	configCmd     = "config"
-	debugCmd      = "debug"
-	execCmd       = "exec"
-	infoCmd       = "info"
-	latencyCmd    = "latency"
-	memoryCmd     = "memory"
-	migrateCmd    = "migrate"
-	moduleCmd     = "module"
-	monitorCmd    = "monitor"
-	multiCmd      = "multi"
-	pfdebugCmd    = "pfdebug"
-	pfselftestCmd = "pfselftest"
-	psyncCmd      = "psync"
-	readonlyCmd   = "readonly"
-	readwriteCmd  = "readwrite"
-	replconfCmd   = "replconf"
-	replicaofCmd  = "replicaof"
-	roleCmd       = "role"
-	scanCmd       = "scan"
-	shutdownCmd   = "shutdown"
-	slaveofCmd    = "slaveof"
-	slowlogCmd    = "slowlog"
-	syncCmd       = "sync"
-	timeCmd       = "time"
-	waitCmd       = "wait"
-	watchCmd      = "watch"
-)
-
-// clusterClient is a wrapper around redis.ClusterClient
-type clusterClient struct {
-	redis.ClusterClient
-}
-
-// newClient creates a new Redis client based on given ConnectionMode. If connection mode is not supported
-// an error is returned.
-func newClient(ctx context.Context, connectionOptions *ConnectionOptions, tlsConfig *tls.Config, username, password string) (redis.UniversalClient, error) {
-	connectionAddr := net.JoinHostPort(connectionOptions.address, connectionOptions.port)
-	// TODO(jakub): Use system CA bundle if connecting to AWS.
-	// TODO(jakub): Investigate Redis Sentinel.
-	switch connectionOptions.mode {
-	case Standalone:
-		return redis.NewClient(&redis.Options{
-			Addr:      connectionAddr,
-			TLSConfig: tlsConfig,
-			Username:  username,
-			Password:  password,
-		}), nil
-	case Cluster:
-		client := &clusterClient{
-			ClusterClient: *redis.NewClusterClient(&redis.ClusterOptions{
-				Addrs:     []string{connectionAddr},
-				TLSConfig: tlsConfig,
-				Username:  username,
-				Password:  password,
-			}),
-		}
-		// Load cluster information.
-		client.ReloadState(ctx)
-
-		return client, nil
-	default:
-		// We've checked that while validating the config, but checking again can help with regression.
-		return nil, trace.BadParameter("incorrect connection mode %s", connectionOptions.mode)
-	}
-}
-
-// Process add supports for additional cluster commands. Our Redis implementation passes most commands to
-// go-redis `Process()` function which doesn't handel all Cluster commands like for ex. DBSIZE, FLUSHDB, etc.
-// This function provides additional processing for those commands enabling more Redis commands in Cluster mode.
-// Commands are override by a simple rule:
-// * If command work only on a single slot (one shard) without any modifications and returns a CROSSSLOT error if executed on
-//   multiple keys it's send the Redis client as it is, and it's the client responsibility to make sure keys are in a single slot.
-// * If a command returns incorrect result in the Cluster mode (for ex. DBSIZE as it would return only size of one shard not whole cluster)
-//   then it's handled by Teleport or blocked if reasonable processing is not possible.
-// * Otherwise a commands is sent to Redis without any modifications.
-func (c *clusterClient) Process(ctx context.Context, inCmd redis.Cmder) error {
-	cmd, ok := inCmd.(*redis.Cmd)
-	if !ok {
-		return trace.BadParameter("failed to cast Redis command type: %T", cmd)
-	}
-
-	switch cmdName := strings.ToLower(cmd.Name()); cmdName {
-	case multiCmd, execCmd, watchCmd, scanCmd, aclCmd, askingCmd, clientCmd, clusterCmd, configCmd, debugCmd,
-		infoCmd, latencyCmd, memoryCmd, migrateCmd, moduleCmd, monitorCmd, pfdebugCmd, pfselftestCmd,
-		psyncCmd, readonlyCmd, readwriteCmd, replconfCmd, replicaofCmd, roleCmd, shutdownCmd, slaveofCmd,
-		slowlogCmd, syncCmd, timeCmd, waitCmd:
-		// block commands that return incorrect results in Cluster mode
-		return protocol.ErrCmdNotSupported
-	case dbsizeCmd:
-		// use go-redis dbsize implementation. It returns size of all keys in the whole cluster instead of
-		// just currently connected instance.
-		res := c.DBSize(ctx)
-		cmd.SetVal(res.Val())
-		cmd.SetErr(res.Err())
-
-		return nil
-	case keysCmd:
-		var resultsKeys []string
-		var mtx sync.Mutex
-
-		if err := c.ForEachMaster(ctx, func(ctx context.Context, client *redis.Client) error {
-			scanCmd := redis.NewStringSliceCmd(ctx, cmd.Args()...)
-			err := client.Process(ctx, scanCmd)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			keys, err := scanCmd.Result()
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			mtx.Lock()
-			resultsKeys = append(resultsKeys, keys...)
-			mtx.Unlock()
-
-			return nil
-		}); err != nil {
-			return trace.Wrap(err)
-		}
-
-		cmd.SetVal(resultsKeys)
-
-		return nil
-	case mgetCmd:
-		if len(cmd.Args()) == 1 {
-			return trace.BadParameter("wrong number of arguments for 'mget' command")
-		}
-
-		var resultsKeys []interface{}
-
-		keys := cmd.Args()[1:]
-		for _, key := range keys {
-			k, ok := key.(string)
-			if !ok {
-				return trace.BadParameter("wrong key type, expected string, got %T", key)
-			}
-
-			result := c.Get(ctx, k)
-			if result.Err() == redis.Nil {
-				resultsKeys = append(resultsKeys, redis.Nil)
-				continue
-			}
-
-			if result.Err() != nil {
-				cmd.SetErr(result.Err())
-				return trace.Wrap(result.Err())
-			}
-
-			resultsKeys = append(resultsKeys, result.Val())
-		}
-
-		cmd.SetVal(resultsKeys)
-
-		return nil
-	case flushallCmd, flushdbCmd:
-		var mtx sync.Mutex
-
-		if err := c.ForEachMaster(ctx, func(ctx context.Context, client *redis.Client) error {
-			singleCmd := redis.NewCmd(ctx, cmd.Args()...)
-			err := client.Process(ctx, singleCmd)
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			mtx.Lock()
-			defer mtx.Unlock()
-
-			if cmd.Err() != nil {
-				// If other call have already set error do not erase it.
-				// It should be returned to the caller.
-				return nil
-			}
-
-			cmd.SetVal(singleCmd.Val())
-			cmd.SetErr(singleCmd.Err())
-
-			return nil
-		}); err != nil {
-			return trace.Wrap(err)
-		}
-
-		return nil
-	case scriptCmd:
-		return c.handleScriptCmd(ctx, cmd)
-	default:
-		return c.ClusterClient.Process(ctx, cmd)
-	}
-}
-
-// handleScriptCmd processes Redis SCRIPT command in Cluster mode.
-func (c *clusterClient) handleScriptCmd(ctx context.Context, cmd *redis.Cmd) error {
-	cmdArgs := cmd.Args()
-
-	if len(cmdArgs) < 2 {
-		return trace.BadParameter("wrong number of arguments for 'script' command")
-	}
-
-	args := make([]string, len(cmdArgs))
-
-	for i := range cmdArgs {
-		var ok bool
-		args[i], ok = cmdArgs[i].(string)
-		if !ok {
-			return trace.BadParameter("wrong script subcommand type, expected string, got %T", cmdArgs[i])
-		}
-	}
-
-	switch cmdSubName := strings.ToLower(args[1]); cmdSubName {
-	case scriptExistsSubcmd:
-		res := c.ScriptExists(ctx, args[2:]...)
-
-		cmd.SetVal(res.Val())
-		cmd.SetErr(res.Err())
-
-		return nil
-	case scriptLoadSubcmd:
-		res := c.ScriptLoad(ctx, args[2])
-
-		cmd.SetVal(res.Val())
-		cmd.SetErr(res.Err())
-
-		return nil
-
-	case scriptFLushSubcmd:
-		// TODO(jakule): ASYNC is ignored.
-		res := c.ScriptFlush(ctx)
-
-		cmd.SetVal(res.Val())
-		cmd.SetErr(res.Err())
-
-		return nil
-	default:
-		// SCRIPT KILL and SCRIPT DEBUG
-		return protocol.ErrCmdNotSupported
-	}
-}
diff --git a/lib/srv/db/redis/cmds.go b/lib/srv/db/redis/cmds.go
index cec1a3442527a..7d33879e3cb33 100644
--- a/lib/srv/db/redis/cmds.go
+++ b/lib/srv/db/redis/cmds.go
@@ -29,19 +29,16 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/db/common"
 	"github.com/gravitational/teleport/lib/srv/db/common/role"
-	"github.com/gravitational/teleport/lib/srv/db/redis/protocol"
 	"github.com/gravitational/trace"
 )
 
-// List of commands that Teleport handles in a special way by Redis standalone and cluster.
+// List of all commands that Teleport handles in a special way.
 const (
-	helloCmd      = "hello"
-	authCmd       = "auth"
-	subscribeCmd  = "subscribe"
-	psubscribeCmd = "psubscribe"
-	// TODO(jakub): go-redis doesn't expose any API for this command. Investigate alternative options.
+	helloCmd        = "hello"
+	authCmd         = "auth"
+	subscribeCmd    = "subscribe"
+	psubscribeCmd   = "psubscribe"
 	punsubscribeCmd = "punsubscribe"
-	// go-redis doesn't support Redis 7+ commands yet.
 	ssubscribeCmd   = "ssubscribe"
 	sunsubscribeCmd = "sunsubscribe"
 )
@@ -51,23 +48,29 @@ const (
 //  * Redis 7.0+ commands are rejected as at the moment of writing Redis 7.0 hasn't been released and go-redis doesn't support it.
 //  * RESP3 commands are rejected as Teleport/go-redis currently doesn't support this version of protocol.
 //  * Subscribe related commands created a new DB connection as they change Redis request-response model to Pub/Sub.
-func (e *Engine) processCmd(ctx context.Context, cmd *redis.Cmd) error {
+func (e *Engine) processCmd(ctx context.Context, redisClient redis.UniversalClient, cmd *redis.Cmd) error {
 	switch strings.ToLower(cmd.Name()) {
-	case helloCmd, punsubscribeCmd, ssubscribeCmd, sunsubscribeCmd:
-		return protocol.ErrCmdNotSupported
+	case helloCmd:
+		return trace.NotImplemented("RESP3 is not supported")
 	case authCmd:
-		return e.processAuth(ctx, cmd)
+		return e.processAuth(ctx, redisClient, cmd)
 	case subscribeCmd:
 		e.Audit.OnQuery(e.Context, e.sessionCtx, common.Query{Query: cmd.String()})
-		return e.subscribeCmd(ctx, e.redisClient.Subscribe, cmd)
+		return e.subscribeCmd(ctx, redisClient.Subscribe, cmd)
 	case psubscribeCmd:
 		e.Audit.OnQuery(e.Context, e.sessionCtx, common.Query{Query: cmd.String()})
-		return e.subscribeCmd(ctx, e.redisClient.PSubscribe, cmd)
+		return e.subscribeCmd(ctx, redisClient.PSubscribe, cmd)
+	case punsubscribeCmd:
+		// TODO(jakub): go-redis doesn't expose any API for this command. Investigate alternative options.
+		return trace.NotImplemented("PUNSUBSCRIBE is not supported by Teleport")
+	case ssubscribeCmd, sunsubscribeCmd:
+		// go-redis doesn't support Redis 7+ commands yet.
+		return trace.NotImplemented("Redis 7.0+ is not yet supported")
 	default:
 		e.Audit.OnQuery(e.Context, e.sessionCtx, common.Query{Query: cmd.String()})
 
 		// Here the command is sent to the DB.
-		return e.redisClient.Process(ctx, cmd)
+		return redisClient.Process(ctx, cmd)
 	}
 }
 
@@ -145,7 +148,7 @@ func (e *Engine) processPubSub(ctx context.Context, pubSub *redis.PubSub) error
 
 // processAuth runs RBAC check on Redis AUTH command if command contains username. Command containing only password
 // is passed to Redis. Commands with incorrect number of arguments are rejected and an error is returned.
-func (e *Engine) processAuth(ctx context.Context, cmd *redis.Cmd) error {
+func (e *Engine) processAuth(ctx context.Context, redisClient redis.UniversalClient, cmd *redis.Cmd) error {
 	// AUTH command may contain only password or login and password. Depends on the version we need to make sure
 	// that the user has permission to connect as the provided db user.
 	// ref: https://redis.io/commands/auth
@@ -177,13 +180,13 @@ func (e *Engine) processAuth(ctx context.Context, cmd *redis.Cmd) error {
 			return trace.Wrap(err)
 		}
 
-		return e.redisClient.Process(ctx, cmd)
+		return redisClient.Process(ctx, cmd)
 	case 3:
 		// Redis 6 version that contains username and password. Check the username against our RBAC before sending to Redis.
 		// ex. AUTH bob my-secret-password
 		dbUser, ok := cmd.Args()[1].(string)
 		if !ok {
-			return trace.BadParameter("username has a wrong type, expected string got %T", cmd.Args()[1])
+			return trace.BadParameter("username has a wrong type, expected string")
 		}
 
 		e.Audit.OnQuery(e.Context, e.sessionCtx, common.Query{Query: fmt.Sprintf("AUTH %s ****", dbUser)})
@@ -204,19 +207,7 @@ func (e *Engine) processAuth(ctx context.Context, cmd *redis.Cmd) error {
 			return trace.Wrap(err)
 		}
 
-		password, ok := cmd.Args()[2].(string)
-		if !ok {
-			return trace.BadParameter("password has a wrong type, expected string got %T", cmd.Args()[2])
-		}
-
-		// reconnect with new username and password. go-redis manages those internally and sends AUTH commands
-		// at the beginning of every new connection.
-		e.redisClient, err = e.reconnect(dbUser, password)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		return e.redisClient.Process(ctx, cmd)
+		return redisClient.Process(ctx, cmd)
 	default:
 		// Redis returns "syntax error" if AUTH has more than 2 arguments.
 		return trace.BadParameter("syntax error")
diff --git a/lib/srv/db/redis/engine.go b/lib/srv/db/redis/engine.go
index 37a8fc5383d6a..1fb4b7cb3641d 100644
--- a/lib/srv/db/redis/engine.go
+++ b/lib/srv/db/redis/engine.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"fmt"
 	"net"
 
 	"github.com/go-redis/redis/v8"
@@ -43,10 +44,6 @@ func newEngine(ec common.EngineConfig) common.Engine {
 	}
 }
 
-// redisClientFactoryFn is a prototype that takes Redis username and password and return a new
-// Redis client.
-type redisClientFactoryFn func(username, password string) (redis.UniversalClient, error)
-
 // Engine implements common.Engine.
 type Engine struct {
 	// EngineConfig is the common database engine configuration.
@@ -57,10 +54,6 @@ type Engine struct {
 	clientReader *redis.Reader
 	// sessionCtx is current session context.
 	sessionCtx *common.Session
-	// newClient returns a new client connection
-	newClient redisClientFactoryFn
-	// redisClient is a current connection to Redis server.
-	redisClient redis.UniversalClient
 }
 
 // InitializeConnection initializes the database connection.
@@ -146,20 +139,41 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 		return trace.Wrap(err)
 	}
 
-	// Initialize newClient factory function with current connection state.
-	e.newClient, err = e.getNewClientFn(ctx, sessionCtx)
+	tlsConfig, err := e.Auth.GetTLSConfig(ctx, sessionCtx)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	// Create new client without username or password. Those will be added when we receive AUTH command.
-	e.redisClient, err = e.newClient("", "")
+	connectionOptions, err := ParseRedisAddress(sessionCtx.Database.GetURI())
 	if err != nil {
-		return trace.Wrap(err)
+		return trace.BadParameter("Redis connection string is incorrect %q: %v", sessionCtx.Database.GetURI(), err)
+	}
+
+	var (
+		redisConn      redis.UniversalClient
+		connectionAddr = fmt.Sprintf("%s:%s", connectionOptions.address, connectionOptions.port)
+	)
+
+	// TODO(jakub): Use system CA bundle if connecting to AWS.
+	// TODO(jakub): Investigate Redis Sentinel.
+	switch connectionOptions.mode {
+	case Standalone:
+		redisConn = redis.NewClient(&redis.Options{
+			Addr:      connectionAddr,
+			TLSConfig: tlsConfig,
+		})
+	case Cluster:
+		redisConn = redis.NewClusterClient(&redis.ClusterOptions{
+			Addrs:     []string{connectionAddr},
+			TLSConfig: tlsConfig,
+		})
+	default:
+		// We've checked that while validating the config, but checking again can help with regression.
+		return trace.BadParameter("incorrect connection mode %s", connectionOptions.mode)
 	}
 
 	defer func() {
-		if err := e.redisClient.Close(); err != nil {
+		if err := redisConn.Close(); err != nil {
 			e.Log.Errorf("Failed to close Redis connection: %v.", err)
 		}
 	}()
@@ -167,54 +181,16 @@ func (e *Engine) HandleConnection(ctx context.Context, sessionCtx *common.Sessio
 	e.Audit.OnSessionStart(e.Context, sessionCtx, nil)
 	defer e.Audit.OnSessionEnd(e.Context, sessionCtx)
 
-	if err := e.process(ctx); err != nil {
+	if err := e.process(ctx, redisConn); err != nil {
 		return trace.Wrap(err)
 	}
 
 	return nil
 }
 
-// getNewClientFn returns a partial Redis client factory function.
-func (e *Engine) getNewClientFn(ctx context.Context, sessionCtx *common.Session) (redisClientFactoryFn, error) {
-	tlsConfig, err := e.Auth.GetTLSConfig(ctx, sessionCtx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	connectionOptions, err := ParseRedisAddress(sessionCtx.Database.GetURI())
-	if err != nil {
-		return nil, trace.BadParameter("Redis connection string is incorrect %q: %v", sessionCtx.Database.GetURI(), err)
-	}
-
-	return func(username, password string) (redis.UniversalClient, error) {
-		redisClient, err := newClient(ctx, connectionOptions, tlsConfig, username, password)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		return redisClient, nil
-	}, nil
-}
-
-// reconnect closes the current Redis server connection and creates a new one pre-authenticated
-// with provided username and password.
-func (e *Engine) reconnect(username, password string) (redis.UniversalClient, error) {
-	err := e.redisClient.Close()
-	if err != nil {
-		return nil, trace.Wrap(err, "failed to close Redis connection")
-	}
-
-	e.redisClient, err = e.newClient(username, password)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return e.redisClient, nil
-}
-
 // process is the main processing function for Redis. It reads commands from connected client and passes them to
 // a Redis instance. This function returns when a server closes a connection or in case of connection error.
-func (e *Engine) process(ctx context.Context) error {
+func (e *Engine) process(ctx context.Context, redisClient redis.UniversalClient) error {
 	for {
 		// Read commands from connected client.
 		cmd, err := e.readClientCmd(ctx)
@@ -223,7 +199,7 @@ func (e *Engine) process(ctx context.Context) error {
 		}
 
 		// send valid commands to Redis instance/cluster.
-		err = e.processCmd(ctx, cmd)
+		err = e.processCmd(ctx, redisClient, cmd)
 		// go-redis returns some errors as err and some as cmd.Err().
 		// Function below maps errors that should be returned to the
 		// client as value or return them as err if we should terminate
diff --git a/lib/srv/db/redis/protocol/resp2.go b/lib/srv/db/redis/protocol/resp2.go
index 897debde67c75..4f48bdfd6c61d 100644
--- a/lib/srv/db/redis/protocol/resp2.go
+++ b/lib/srv/db/redis/protocol/resp2.go
@@ -20,16 +20,12 @@
 package protocol
 
 import (
-	"reflect"
 	"strconv"
 
 	"github.com/go-redis/redis/v8"
 	"github.com/gravitational/trace"
 )
 
-// ErrCmdNotSupported is returned when an unsupported Redis command is sent to Teleport proxy.
-var ErrCmdNotSupported = trace.NotImplemented("command not supported")
-
 // WriteCmd writes Redis commands passed as vals to Redis wire form.
 // Most types are covered by go-redis implemented WriteArg() function. Types override by this function are:
 // * Redis errors and Go error: go-redis returns a "human-readable" string instead of RESP compatible error message
@@ -99,20 +95,16 @@ func WriteCmd(wr *redis.Writer, vals interface{}) error {
 		if err := writeUinteger(wr, val); err != nil {
 			return trace.Wrap(err)
 		}
-	case interface{}:
-		var err error
-		v := reflect.ValueOf(val)
-
-		if v.Kind() == reflect.Ptr {
-			v = v.Elem()
+	case []string:
+		if err := writeStringSlice(wr, val); err != nil {
+			return trace.Wrap(err)
 		}
-
-		if v.Kind() == reflect.Slice {
-			err = writeSlice(wr, val)
-		} else {
-			err = wr.WriteArg(val)
+	case []interface{}:
+		if err := writeSlice(wr, val); err != nil {
+			return trace.Wrap(err)
 		}
-
+	case interface{}:
+		err := wr.WriteArg(val)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -140,25 +132,37 @@ func writeError(wr *redis.Writer, prefix string, val error) error {
 	return nil
 }
 
-// writeSlice converts a slice to Redis wire form.
-func writeSlice(wr *redis.Writer, vals interface{}) error {
-	v := reflect.ValueOf(vals)
+// writeSlice converts []interface{} to Redis wire form.
+func writeSlice(wr *redis.Writer, vals []interface{}) error {
+	if err := wr.WriteByte(redis.ArrayReply); err != nil {
+		return trace.Wrap(err)
+	}
+	n := len(vals)
+	if err := wr.WriteLen(n); err != nil {
+		return trace.Wrap(err)
+	}
 
-	if v.Kind() != reflect.Slice {
-		return trace.BadParameter("expected slice, passed %T", vals)
+	for _, v0 := range vals {
+		if err := WriteCmd(wr, v0); err != nil {
+			return trace.Wrap(err)
+		}
 	}
 
+	return nil
+}
+
+// writeStringSlice converts a string slice to Redis wire form.
+func writeStringSlice(wr *redis.Writer, vals []string) error {
 	if err := wr.WriteByte(redis.ArrayReply); err != nil {
 		return trace.Wrap(err)
 	}
-
-	n := v.Len()
+	n := len(vals)
 	if err := wr.WriteLen(n); err != nil {
 		return trace.Wrap(err)
 	}
 
-	for i := 0; i < n; i++ {
-		if err := WriteCmd(wr, v.Index(i).Interface()); err != nil {
+	for _, v0 := range vals {
+		if err := WriteCmd(wr, v0); err != nil {
 			return trace.Wrap(err)
 		}
 	}
diff --git a/lib/srv/db/redis/protocol/resp2_test.go b/lib/srv/db/redis/protocol/resp2_test.go
deleted file mode 100644
index fccb0518f9f0e..0000000000000
--- a/lib/srv/db/redis/protocol/resp2_test.go
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
-
- Copyright 2022 Gravitational, Inc.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-
-
-*/
-
-package protocol
-
-import (
-	"bytes"
-	"errors"
-	"testing"
-
-	"github.com/go-redis/redis/v8"
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-)
-
-func TestWriteCmd(t *testing.T) {
-	tests := []struct {
-		name     string
-		val      interface{}
-		expected []byte
-		wantErr  bool
-	}{
-		{
-			name:     "string",
-			val:      "test val",
-			expected: []byte("$8\r\ntest val\r\n"),
-		},
-		{
-			name:     "int",
-			val:      1,
-			expected: []byte(":1\r\n"),
-		},
-		{
-			name:     "int32",
-			val:      19,
-			expected: []byte(":19\r\n"),
-		},
-		{
-			name:     "int64",
-			val:      64,
-			expected: []byte(":64\r\n"),
-		},
-		{
-			name:     "float",
-			val:      3.14,
-			expected: []byte("$4\r\n3.14\r\n"),
-		},
-		{
-			name:     "[]string",
-			val:      []string{"test val1", "test val 2"},
-			expected: []byte("*2\r\n$9\r\ntest val1\r\n$10\r\ntest val 2\r\n"),
-		},
-		{
-			name:     "[]bool",
-			val:      []bool{true, false},
-			expected: []byte("*2\r\n$1\r\n1\r\n$1\r\n0\r\n"),
-		},
-		{
-			name:     "error",
-			val:      errors.New("something bad"),
-			expected: []byte("-ERR something bad\r\n"),
-		},
-		{
-			name:     "Teleport error",
-			val:      trace.Errorf("something bad"),
-			expected: []byte("-ERR Teleport: something bad\r\n"),
-		},
-		{
-			name:     "Redis nil",
-			val:      redis.Nil,
-			expected: []byte("$-1\r\n"),
-		},
-	}
-
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			buf := &bytes.Buffer{}
-			wr := redis.NewWriter(buf)
-
-			if err := WriteCmd(wr, tt.val); (err != nil) != tt.wantErr {
-				t.Errorf("WriteCmd() error = %v, wantErr %v", err, tt.wantErr)
-			}
-
-			require.Equal(t, tt.expected, buf.Bytes())
-		})
-	}
-}
diff --git a/lib/srv/db/server.go b/lib/srv/db/server.go
index bd35f2375547b..9519aa242111d 100644
--- a/lib/srv/db/server.go
+++ b/lib/srv/db/server.go
@@ -245,10 +245,10 @@ func (m *monitoredDatabases) setCloud(databases types.Databases) {
 	m.cloud = databases
 }
 
-func (m *monitoredDatabases) get() types.ResourcesWithLabelsMap {
+func (m *monitoredDatabases) get() types.ResourcesWithLabels {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	return append(append(m.static, m.resources...), m.cloud...).AsResources().ToMap()
+	return append(append(m.static, m.resources...), m.cloud...).AsResources()
 }
 
 // New returns a new database server.
diff --git a/lib/srv/db/watcher.go b/lib/srv/db/watcher.go
index 887e4b889faeb..af261ac028ba5 100644
--- a/lib/srv/db/watcher.go
+++ b/lib/srv/db/watcher.go
@@ -134,8 +134,11 @@ func (s *Server) startCloudWatcher(ctx context.Context) error {
 }
 
 // getResources returns proxied databases as resources.
-func (s *Server) getResources() types.ResourcesWithLabelsMap {
-	return s.getProxiedDatabases().AsResources().ToMap()
+func (s *Server) getResources() (resources types.ResourcesWithLabels) {
+	for _, database := range s.getProxiedDatabases() {
+		resources = append(resources, database)
+	}
+	return resources
 }
 
 // onCreate is called by reconciler when a new database is created.
diff --git a/lib/srv/desktop/audit.go b/lib/srv/desktop/audit.go
index 1989fbf7a3053..d1710c559ecd1 100644
--- a/lib/srv/desktop/audit.go
+++ b/lib/srv/desktop/audit.go
@@ -27,7 +27,7 @@ import (
 	"github.com/gravitational/trace"
 )
 
-func (s *WindowsService) onSessionStart(ctx context.Context, emitter events.Emitter, id *tlsca.Identity, startTime time.Time, windowsUser, sessionID string, desktop types.WindowsDesktop, err error) {
+func (s *WindowsService) onSessionStart(ctx context.Context, id *tlsca.Identity, startTime time.Time, windowsUser, sessionID string, desktop types.WindowsDesktop, err error) {
 	userMetadata := id.GetUserMetadata()
 	userMetadata.Login = windowsUser
 
@@ -52,7 +52,6 @@ func (s *WindowsService) onSessionStart(ctx context.Context, emitter events.Emit
 			Success: err == nil,
 		},
 		WindowsDesktopService: s.cfg.Heartbeat.HostUUID,
-		DesktopName:           desktop.GetName(),
 		DesktopAddr:           desktop.GetAddr(),
 		Domain:                desktop.GetDomain(),
 		WindowsUser:           windowsUser,
@@ -63,10 +62,10 @@ func (s *WindowsService) onSessionStart(ctx context.Context, emitter events.Emit
 		event.Error = trace.Unwrap(err).Error()
 		event.UserMessage = err.Error()
 	}
-	s.emit(ctx, emitter, event)
+	s.emit(ctx, event)
 }
 
-func (s *WindowsService) onSessionEnd(ctx context.Context, emitter events.Emitter, id *tlsca.Identity, startedAt time.Time, recorded bool, windowsUser, sessionID string, desktop types.WindowsDesktop) {
+func (s *WindowsService) onSessionEnd(ctx context.Context, id *tlsca.Identity, startedAt time.Time, recorded bool, windowsUser, sessionID string, desktop types.WindowsDesktop) {
 	userMetadata := id.GetUserMetadata()
 	userMetadata.Login = windowsUser
 
@@ -94,10 +93,10 @@ func (s *WindowsService) onSessionEnd(ctx context.Context, emitter events.Emitte
 		// There can only be 1 participant, desktop sessions are not join-able.
 		Participants: []string{userMetadata.User},
 	}
-	s.emit(ctx, emitter, event)
+	s.emit(ctx, event)
 }
 
-func (s *WindowsService) onClipboardSend(ctx context.Context, emitter events.Emitter, id *tlsca.Identity, sessionID string, desktopAddr string, length int32) {
+func (s *WindowsService) onClipboardSend(ctx context.Context, id *tlsca.Identity, sessionID string, desktopAddr string, length int32) {
 	event := &events.DesktopClipboardSend{
 		Metadata: events.Metadata{
 			Type:        libevents.DesktopClipboardSendEvent,
@@ -118,10 +117,10 @@ func (s *WindowsService) onClipboardSend(ctx context.Context, emitter events.Emi
 		DesktopAddr: desktopAddr,
 		Length:      length,
 	}
-	s.emit(ctx, emitter, event)
+	s.emit(ctx, event)
 }
 
-func (s *WindowsService) onClipboardReceive(ctx context.Context, emitter events.Emitter, id *tlsca.Identity, sessionID string, desktopAddr string, length int32) {
+func (s *WindowsService) onClipboardReceive(ctx context.Context, id *tlsca.Identity, sessionID string, desktopAddr string, length int32) {
 	event := &events.DesktopClipboardReceive{
 		Metadata: events.Metadata{
 			Type:        libevents.DesktopClipboardReceiveEvent,
@@ -142,11 +141,11 @@ func (s *WindowsService) onClipboardReceive(ctx context.Context, emitter events.
 		DesktopAddr: desktopAddr,
 		Length:      length,
 	}
-	s.emit(ctx, emitter, event)
+	s.emit(ctx, event)
 }
 
-func (s *WindowsService) emit(ctx context.Context, emitter events.Emitter, event events.AuditEvent) {
-	if err := emitter.EmitAuditEvent(ctx, event); err != nil {
+func (s *WindowsService) emit(ctx context.Context, event events.AuditEvent) {
+	if err := s.cfg.Emitter.EmitAuditEvent(ctx, event); err != nil {
 		s.cfg.Log.WithError(err).Errorf("Failed to emit audit event %v", event)
 	}
 }
diff --git a/lib/srv/desktop/audit_test.go b/lib/srv/desktop/audit_test.go
index e308fb11ee61a..86a46bea7aefb 100644
--- a/lib/srv/desktop/audit_test.go
+++ b/lib/srv/desktop/audit_test.go
@@ -99,7 +99,6 @@ func TestSessionStartEvent(t *testing.T) {
 			Success: true,
 		},
 		WindowsDesktopService: s.cfg.Heartbeat.HostUUID,
-		DesktopName:           "test-desktop",
 		DesktopAddr:           desktop.GetAddr(),
 		Domain:                desktop.GetDomain(),
 		WindowsUser:           "Administrator",
@@ -132,7 +131,6 @@ func TestSessionStartEvent(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			s.onSessionStart(
 				context.Background(),
-				s.cfg.Emitter,
 				id,
 				s.cfg.Clock.Now().UTC().Round(time.Millisecond),
 				"Administrator",
@@ -175,7 +173,6 @@ func TestSessionEndEvent(t *testing.T) {
 
 	s.onSessionEnd(
 		context.Background(),
-		s.cfg.Emitter,
 		id,
 		startTime,
 		true,
diff --git a/lib/srv/desktop/discovery.go b/lib/srv/desktop/discovery.go
index d89a3135a79c1..5a3f010183fc9 100644
--- a/lib/srv/desktop/discovery.go
+++ b/lib/srv/desktop/discovery.go
@@ -69,7 +69,7 @@ func (s *WindowsService) startDesktopDiscovery() error {
 		// pre-filtered by nature of using an LDAP search with filters.
 		Matcher: func(r types.ResourceWithLabels) bool { return true },
 
-		GetCurrentResources: func() types.ResourcesWithLabelsMap { return s.lastDiscoveryResults },
+		GetCurrentResources: func() types.ResourcesWithLabels { return s.lastDiscoveryResults },
 		GetNewResources:     s.getDesktopsFromLDAP,
 		OnCreate:            s.upsertDesktop,
 		OnUpdate:            s.upsertDesktop,
@@ -117,7 +117,7 @@ func (s *WindowsService) ldapSearchFilter() string {
 }
 
 // getDesktopsFromLDAP discovers Windows hosts via LDAP
-func (s *WindowsService) getDesktopsFromLDAP() types.ResourcesWithLabelsMap {
+func (s *WindowsService) getDesktopsFromLDAP() types.ResourcesWithLabels {
 	if !s.ldapReady() {
 		s.cfg.Log.Warn("skipping desktop discovery: LDAP not yet initialized")
 		return nil
@@ -144,14 +144,14 @@ func (s *WindowsService) getDesktopsFromLDAP() types.ResourcesWithLabelsMap {
 
 	s.cfg.Log.Debugf("discovered %d Windows Desktops", len(entries))
 
-	result := make(types.ResourcesWithLabelsMap)
+	var result types.ResourcesWithLabels
 	for _, entry := range entries {
 		desktop, err := s.ldapEntryToWindowsDesktop(s.closeCtx, entry, s.cfg.HostLabelsFn)
 		if err != nil {
 			s.cfg.Log.Warnf("could not create Windows Desktop from LDAP entry: %v", err)
 			continue
 		}
-		result[desktop.GetName()] = desktop
+		result = append(result, desktop)
 	}
 
 	// capture the result, which will be used on the next reconcile loop
@@ -177,14 +177,14 @@ func (s *WindowsService) deleteDesktop(ctx context.Context, r types.ResourceWith
 }
 
 func applyLabelsFromLDAP(entry *ldap.Entry, labels map[string]string) {
-	labels[types.TeleportNamespace+"/dns_host_name"] = entry.GetAttributeValue(attrDNSHostName)
-	labels[types.TeleportNamespace+"/computer_name"] = entry.GetAttributeValue(attrName)
-	labels[types.TeleportNamespace+"/os"] = entry.GetAttributeValue(attrOS)
-	labels[types.TeleportNamespace+"/os_version"] = entry.GetAttributeValue(attrOSVersion)
+	labels["teleport.dev/dns_host_name"] = entry.GetAttributeValue(attrDNSHostName)
+	labels["teleport.dev/computer_name"] = entry.GetAttributeValue(attrName)
+	labels["teleport.dev/os"] = entry.GetAttributeValue(attrOS)
+	labels["teleport.dev/os_version"] = entry.GetAttributeValue(attrOSVersion)
 	labels[types.OriginLabel] = types.OriginDynamic
 	switch entry.GetAttributeValue(attrPrimaryGroupID) {
 	case writableDomainControllerGroupID, readOnlyDomainControllerGroupID:
-		labels[types.TeleportNamespace+"/is_domain_controller"] = "true"
+		labels["teleport.dev/is_domain_controller"] = "true"
 	}
 }
 
@@ -193,7 +193,7 @@ func applyLabelsFromLDAP(entry *ldap.Entry, labels map[string]string) {
 func (s *WindowsService) ldapEntryToWindowsDesktop(ctx context.Context, entry *ldap.Entry, getHostLabels func(string) map[string]string) (types.ResourceWithLabels, error) {
 	hostname := entry.GetAttributeValue(attrDNSHostName)
 	labels := getHostLabels(hostname)
-	labels[types.TeleportNamespace+"/windows_domain"] = s.cfg.Domain
+	labels["teleport.dev/windows_domain"] = s.cfg.Domain
 	applyLabelsFromLDAP(entry, labels)
 
 	addrs, err := s.dnsResolver.LookupHost(ctx, hostname)
diff --git a/lib/srv/desktop/discovery_test.go b/lib/srv/desktop/discovery_test.go
index 6ad26a602a197..5635f8fc3190e 100644
--- a/lib/srv/desktop/discovery_test.go
+++ b/lib/srv/desktop/discovery_test.go
@@ -71,10 +71,10 @@ func TestAppliesLDAPLabels(t *testing.T) {
 	applyLabelsFromLDAP(entry, l)
 
 	require.Equal(t, l[types.OriginLabel], types.OriginDynamic)
-	require.Equal(t, l[types.TeleportNamespace+"/dns_host_name"], "foo.example.com")
-	require.Equal(t, l[types.TeleportNamespace+"/computer_name"], "foo")
-	require.Equal(t, l[types.TeleportNamespace+"/os"], "Windows Server")
-	require.Equal(t, l[types.TeleportNamespace+"/os_version"], "6.1")
+	require.Equal(t, l["teleport.dev/dns_host_name"], "foo.example.com")
+	require.Equal(t, l["teleport.dev/computer_name"], "foo")
+	require.Equal(t, l["teleport.dev/os"], "Windows Server")
+	require.Equal(t, l["teleport.dev/os_version"], "6.1")
 }
 
 func TestLabelsDomainControllers(t *testing.T) {
@@ -109,7 +109,7 @@ func TestLabelsDomainControllers(t *testing.T) {
 			l := make(map[string]string)
 			applyLabelsFromLDAP(test.entry, l)
 
-			b, _ := strconv.ParseBool(l[types.TeleportNamespace+"/is_domain_controller"])
+			b, _ := strconv.ParseBool(l["teleport.dev/is_domain_controller"])
 			test.assert(t, b)
 		})
 	}
diff --git a/lib/srv/desktop/rdp/rdpclient/client.go b/lib/srv/desktop/rdp/rdpclient/client.go
index d191c768feba4..a74d6695b78b8 100644
--- a/lib/srv/desktop/rdp/rdpclient/client.go
+++ b/lib/srv/desktop/rdp/rdpclient/client.go
@@ -362,17 +362,13 @@ func (c *Client) start() {
 					return
 				}
 			case tdp.ClipboardData:
-				if len(m) > 0 {
-					if err := cgoError(C.update_clipboard(
-						c.rustClient,
-						(*C.uint8_t)(unsafe.Pointer(&m[0])),
-						C.uint32_t(len(m)),
-					)); err != nil {
-						c.cfg.Log.Warningf("Failed forwarding RDP clipboard data: %v", err)
-						return
-					}
-				} else {
-					c.cfg.Log.Warning("Recieved an empty clipboard message")
+				if err := cgoError(C.update_clipboard(
+					c.rustClient,
+					(*C.uint8_t)(unsafe.Pointer(&m[0])),
+					C.uint32_t(len(m)),
+				)); err != nil {
+					c.cfg.Log.Warningf("Failed forwarding RDP clipboard data: %v", err)
+					return
 				}
 			default:
 				c.cfg.Log.Warningf("Skipping unimplemented TDP message type %T", msg)
@@ -382,23 +378,17 @@ func (c *Client) start() {
 }
 
 //export handle_bitmap
-func handle_bitmap(handle C.uintptr_t, cb *C.CGOBitmap) C.CGOError {
+func handle_bitmap(handle C.uintptr_t, cb C.CGOBitmap) C.CGOError {
 	return cgo.Handle(handle).Value().(*Client).handleBitmap(cb)
 }
 
-func (c *Client) handleBitmap(cb *C.CGOBitmap) C.CGOError {
+func (c *Client) handleBitmap(cb C.CGOBitmap) C.CGOError {
 	// Notify the input forwarding goroutine that we're ready for input.
 	// Input can only be sent after connection was established, which we infer
 	// from the fact that a bitmap was sent.
 	atomic.StoreUint32(&c.readyForInput, 1)
 
-	// use unsafe.Slice here instead of C.GoBytes, because unsafe.Slice
-	// creates a Go slice backed by data managed from Rust - it does not
-	// copy. This way we only need one copy into img.Pix below.
-	ptr := unsafe.Pointer(cb.data_ptr)
-	uptr := (*uint8)(ptr)
-	data := unsafe.Slice(uptr, C.int(cb.data_len))
-
+	data := C.GoBytes(unsafe.Pointer(cb.data_ptr), C.int(cb.data_len))
 	// Convert BGRA to RGBA. It's likely due to Windows using uint32 values for
 	// pixels (ARGB) and encoding them as big endian. The image.RGBA type uses
 	// a byte slice with 4-byte segments representing pixels (RGBA).
diff --git a/lib/srv/desktop/rdp/rdpclient/librdprs.h b/lib/srv/desktop/rdp/rdpclient/librdprs.h
index e31462e98dc69..f1a2876cdc078 100644
--- a/lib/srv/desktop/rdp/rdpclient/librdprs.h
+++ b/lib/srv/desktop/rdp/rdpclient/librdprs.h
@@ -7,19 +7,6 @@
 
 #define SPECIAL_NO_RESPONSE 4294967295
 
-/**
- * The default maximum chunk size for virtual channel data.
- *
- * If an RDP server supports larger chunks, it will advertise
- * the larger chunk size in the `VCChunkSize` field of the
- * virtual channel capability set.
- *
- * See also:
- * - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/6c074267-1b32-4ceb-9496-2eb941a23e6b
- * - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/a8593178-80c0-4b80-876c-cb77e62cecfc
- */
-#define CHANNEL_CHUNK_LEGNTH 1600
-
 typedef enum CGOPointerButton {
   PointerButtonNone,
   PointerButtonLeft,
@@ -178,6 +165,6 @@ void free_rust_string(char *s);
 
 extern void free_go_string(char *s);
 
-extern CGOError handle_bitmap(uintptr_t client_ref, struct CGOBitmap *b);
+extern CGOError handle_bitmap(uintptr_t client_ref, struct CGOBitmap b);
 
 extern CGOError handle_remote_copy(uintptr_t client_ref, uint8_t *data, uint32_t len);
diff --git a/lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs b/lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs
index 3d38a4ddeef77..48488c2d20f48 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/cliprdr.rs
@@ -13,39 +13,24 @@
 // limitations under the License.
 
 use crate::errors::invalid_data_error;
-use crate::vchan::ChannelPDUFlags;
 use crate::{vchan, Payload};
 use bitflags::bitflags;
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
 use num_traits::FromPrimitive;
 use rdp::core::{mcs, tpkt};
+use rdp::model::data::Message;
 use rdp::model::error::*;
 use rdp::try_let;
 use std::collections::HashMap;
-use std::io::{Cursor, Read, Write};
+use std::io::{Read, Write};
 
 pub const CHANNEL_NAME: &str = "cliprdr";
 
-struct PendingData {
-    data: Vec<u8>,
-    total_length: u32,
-    clipboard_header: Option<ClipboardPDUHeader>,
-}
-
-impl PendingData {
-    fn reset(&mut self, length: u32) {
-        self.data.clear();
-        self.total_length = length;
-        self.clipboard_header = None;
-    }
-}
-
 /// Client implements a client for the clipboard virtual channel
 /// (CLIPRDR) extension, as defined in:
 /// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpeclip/fb9b7e0b-6db4-41c2-b83c-f889c1ee7688
 pub struct Client {
     clipboard: HashMap<u32, Vec<u8>>,
-    pending: PendingData,
     on_remote_copy: Box<dyn Fn(Vec<u8>)>,
 }
 
@@ -59,11 +44,6 @@ impl Client {
     pub fn new(on_remote_copy: Box<dyn Fn(Vec<u8>)>) -> Self {
         Client {
             clipboard: HashMap::new(),
-            pending: PendingData {
-                data: Vec::new(),
-                total_length: 0,
-                clipboard_header: None,
-            },
             on_remote_copy,
         }
     }
@@ -74,58 +54,28 @@ impl Client {
         mcs: &mut mcs::Client<S>,
     ) -> RdpResult<()> {
         let mut payload = try_let!(tpkt::Payload::Raw, payload)?;
-        let pdu_header = vchan::ChannelPDUHeader::decode(&mut payload)?;
-
-        // TODO(zmb3): this logic is the same for all virtual channels, and should
-        // be moved to vchan.rs and reused for the rdpdr client as well
-        if pdu_header
-            .flags
-            .contains(ChannelPDUFlags::CHANNEL_FLAG_FIRST)
-        {
-            self.pending.reset(pdu_header.length);
-            self.pending.clipboard_header = Some(ClipboardPDUHeader::decode(&mut payload)?);
-        }
-
-        payload.read_to_end(&mut self.pending.data)?;
-
-        if pdu_header
-            .flags
-            .contains(ChannelPDUFlags::CHANNEL_FLAG_LAST)
-            && self.pending.clipboard_header.is_some()
-        {
-            let full_msg = self.pending.data.split_off(0);
-            let mut payload = Cursor::new(full_msg);
-            let header = self.pending.clipboard_header.take().unwrap();
-            return self.handle_message(header, &mut payload, mcs);
-        }
-
-        Ok(())
-    }
-
-    fn handle_message<S: Read + Write>(
-        &mut self,
-        header: ClipboardPDUHeader,
-        payload: &mut Payload,
-        mcs: &mut mcs::Client<S>,
-    ) -> RdpResult<()> {
+        let _pdu_header = vchan::ChannelPDUHeader::decode(&mut payload)?;
+        let header = ClipboardPDUHeader::decode(&mut payload)?;
         debug!("received {:?}", header.msg_type);
 
-        let responses = match header.msg_type {
-            ClipboardPDUType::CB_CLIP_CAPS => self.handle_server_caps(payload)?,
-            ClipboardPDUType::CB_MONITOR_READY => self.handle_monitor_ready(payload)?,
+        let resp = match header.msg_type {
+            ClipboardPDUType::CB_CLIP_CAPS => self.handle_server_caps(&mut payload)?,
+            ClipboardPDUType::CB_MONITOR_READY => self.handle_monitor_ready(&mut payload)?,
             ClipboardPDUType::CB_FORMAT_LIST => {
-                self.handle_format_list(payload, header.data_len)?
+                self.handle_format_list(&mut payload, header.data_len)?
             }
             ClipboardPDUType::CB_FORMAT_LIST_RESPONSE => {
                 self.handle_format_list_response(header.msg_flags)?
             }
-            ClipboardPDUType::CB_FORMAT_DATA_REQUEST => self.handle_format_data_request(payload)?,
+            ClipboardPDUType::CB_FORMAT_DATA_REQUEST => {
+                self.handle_format_data_request(&mut payload)?
+            }
             ClipboardPDUType::CB_FORMAT_DATA_RESPONSE => {
                 if header
                     .msg_flags
                     .contains(ClipboardHeaderFlags::CB_RESPONSE_OK)
                 {
-                    self.handle_format_data_response(payload, header.data_len)?
+                    self.handle_format_data_response(&mut payload, header.data_len)?
                 } else {
                     warn!("RDP server failed to process format data request");
                     vec![]
@@ -141,8 +91,8 @@ impl Client {
         };
 
         let chan = &CHANNEL_NAME.to_string();
-        for resp in responses {
-            mcs.write(chan, resp)?;
+        for msg in resp {
+            mcs.write(chan, msg)?;
         }
 
         Ok(())
@@ -151,7 +101,7 @@ impl Client {
     /// update_clipboard is invoked from Go.
     /// It updates the local clipboard cache and returns the encoded message
     /// that should be sent to the RDP server.
-    pub fn update_clipboard(&mut self, data: Vec<u8>) -> RdpResult<Vec<Vec<u8>>> {
+    pub fn update_clipboard(&mut self, data: Vec<u8>) -> RdpResult<Vec<u8>> {
         const CR: u8 = 13;
         const LF: u8 = 10;
 
@@ -213,23 +163,26 @@ impl Client {
         // 1. Send our clipboard capabilities
         // 2. Mimic a "copy" operation by sending a format list PDU
         // This completes the initialization process.
-        let mut result = encode_message(
-            ClipboardPDUType::CB_CLIP_CAPS,
-            ClipboardCapabilitiesPDU {
-                general: Some(GeneralClipboardCapabilitySet {
-                    version: CB_CAPS_VERSION_2,
-                    flags: ClipboardGeneralCapabilityFlags::CB_USE_LONG_FORMAT_NAMES,
-                }),
-            }
-            .encode()?,
-        )?;
-        result.extend(encode_message(
-            ClipboardPDUType::CB_FORMAT_LIST,
-            FormatListPDU::<LongFormatName> {
-                format_names: vec![LongFormatName::id(0)],
-            }
-            .encode()?,
-        )?);
+
+        let result = vec![
+            encode_message(
+                ClipboardPDUType::CB_CLIP_CAPS,
+                ClipboardCapabilitiesPDU {
+                    general: Some(GeneralClipboardCapabilitySet {
+                        version: CB_CAPS_VERSION_2,
+                        flags: ClipboardGeneralCapabilityFlags::CB_USE_LONG_FORMAT_NAMES,
+                    }),
+                }
+                .encode()?,
+            )?,
+            encode_message(
+                ClipboardPDUType::CB_FORMAT_LIST,
+                FormatListPDU::<LongFormatName> {
+                    format_names: vec![LongFormatName::id(0)],
+                }
+                .encode()?,
+            )?,
+        ];
 
         Ok(result)
     }
@@ -254,14 +207,17 @@ impl Client {
         //
         // see section 3.1.1.1 for details
 
-        let mut result = encode_message(ClipboardPDUType::CB_FORMAT_LIST_RESPONSE, vec![])?;
+        let mut result = vec![encode_message(
+            ClipboardPDUType::CB_FORMAT_LIST_RESPONSE,
+            vec![],
+        )?];
 
         for name in list.format_names {
             match FromPrimitive::from_u32(name.format_id) {
                 // TODO(zmb3): support CF_TEXT, CF_UNICODETEXT, ...
                 Some(ClipboardFormat::CF_OEMTEXT) => {
                     // request the data by imitating a paste event
-                    result.extend(encode_message(
+                    result.push(encode_message(
                         ClipboardPDUType::CB_FORMAT_DATA_REQUEST,
                         FormatDataRequestPDU::for_id(name.format_id).encode()?,
                     )?);
@@ -303,20 +259,20 @@ impl Client {
             }
         };
 
-        encode_message(
+        Ok(vec![encode_message(
             ClipboardPDUType::CB_FORMAT_DATA_RESPONSE,
             FormatDataResponsePDU { data }.encode()?,
-        )
+        )?])
     }
 
     /// Receives clipboard data from the remote desktop. This is the server responding
     /// to our format data request.
     fn handle_format_data_response(
-        &mut self,
+        &self,
         payload: &mut Payload,
         length: u32,
     ) -> RdpResult<Vec<Vec<u8>>> {
-        let mut resp = FormatDataResponsePDU::decode(payload, length)?;
+        let resp = FormatDataResponsePDU::decode(payload, length)?;
         let data_len = resp.data.len();
         debug!(
             "recieved {} bytes of copied data from Windows Desktop",
@@ -325,12 +281,12 @@ impl Client {
 
         // trim the null-terminator, if it exists
         // (but don't worry about CRLF conversion, most non-Windows systems can handle CRLF well enough)
-        if let Some(0x00) = resp.data.last() {
-            resp.data.truncate(resp.data.len() - 1);
+        let mut data = resp.data;
+        if !data.is_empty() && data[data.len() - 1] == 0x00 {
+            data.truncate(data.len() - 1);
         }
 
-        (self.on_remote_copy)(resp.data);
-
+        (self.on_remote_copy)(data);
         Ok(vec![])
     }
 }
@@ -530,7 +486,7 @@ impl<T: FormatName> FormatListPDU<T> {
     fn encode(&self) -> RdpResult<Vec<u8>> {
         let mut w = Vec::new();
         for name in &self.format_names {
-            w.extend(name.encode()?);
+            w.extend_from_slice(&name.encode()?);
         }
 
         Ok(w)
@@ -756,9 +712,8 @@ impl FormatDataResponsePDU {
 }
 
 /// encode_message encodes a message by wrapping it in the appropriate
-/// channel header. If the payload exceeds the maximum size, the message
-/// is split into multiple messages.
-fn encode_message(msg_type: ClipboardPDUType, payload: Vec<u8>) -> RdpResult<Vec<Vec<u8>>> {
+/// channel header
+fn encode_message(msg_type: ClipboardPDUType, payload: Vec<u8>) -> RdpResult<Vec<u8>> {
     let msg_flags = match msg_type {
         // the spec requires 0 for these messages
         ClipboardPDUType::CB_CLIP_CAPS => ClipboardHeaderFlags::from_bits_truncate(0),
@@ -777,51 +732,28 @@ fn encode_message(msg_type: ClipboardPDUType, payload: Vec<u8>) -> RdpResult<Vec
 
         _ => ClipboardHeaderFlags::from_bits_truncate(0),
     };
-    let mut inner = ClipboardPDUHeader::new(msg_type, msg_flags, payload.len() as u32).encode()?;
-    inner.extend(payload);
-    let total_len = inner.len() as u32;
-
-    let mut result = Vec::new();
-    let mut first = true;
-    while !inner.is_empty() {
-        let i = std::cmp::min(inner.len(), vchan::CHANNEL_CHUNK_LEGNTH);
-        let leftover = inner.split_off(i);
-
-        let mut channel_flags = match msg_type {
-            ClipboardPDUType::CB_FORMAT_LIST
-            | ClipboardPDUType::CB_CLIP_CAPS
-            | ClipboardPDUType::CB_FORMAT_DATA_REQUEST
-            | ClipboardPDUType::CB_FORMAT_DATA_RESPONSE => {
-                vchan::ChannelPDUFlags::CHANNEL_FLAG_SHOW_PROTOCOL
-            }
-            _ => vchan::ChannelPDUFlags::from_bits_truncate(0),
-        };
 
-        if first {
-            channel_flags.set(vchan::ChannelPDUFlags::CHANNEL_FLAG_FIRST, true);
-            first = false;
-        }
-        if leftover.is_empty() {
-            channel_flags.set(vchan::ChannelPDUFlags::CHANNEL_FLAG_LAST, true);
+    let mut inner = ClipboardPDUHeader::new(msg_type, msg_flags, payload.len() as u32).encode()?;
+    inner.extend_from_slice(&payload);
+
+    let mut channel_flags = vchan::ChannelPDUFlags::CHANNEL_FLAG_ONLY;
+    match msg_type {
+        ClipboardPDUType::CB_FORMAT_LIST
+        | ClipboardPDUType::CB_CLIP_CAPS
+        | ClipboardPDUType::CB_FORMAT_DATA_REQUEST
+        | ClipboardPDUType::CB_FORMAT_DATA_RESPONSE => {
+            channel_flags.set(vchan::ChannelPDUFlags::CHANNEL_FLAG_SHOW_PROTOCOL, true)
         }
-
-        // the Channel PDU Header always specifies the *total length* of the PDU,
-        // even if it has to be split into multpile chunks:
-        // https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/a542bf19-1c86-4c80-ab3e-61449653abf6
-        let mut outer = vchan::ChannelPDUHeader::new(total_len, channel_flags).encode()?;
-        outer.extend(inner);
-        result.push(outer);
-
-        inner = leftover;
+        _ => {}
     }
 
-    Ok(result)
+    let mut outer = vchan::ChannelPDUHeader::new(inner.length() as u32, channel_flags).encode()?;
+    outer.extend_from_slice(&inner);
+    Ok(outer)
 }
 
 #[cfg(test)]
 mod tests {
-    use crate::vchan::ChannelPDUFlags;
-
     use super::*;
     use std::io::Cursor;
     use std::sync::mpsc::channel;
@@ -839,7 +771,7 @@ mod tests {
         .unwrap();
 
         assert_eq!(
-            msg[0],
+            msg,
             vec![
                 // virtual channel header
                 0x2C, 0x00, 0x00, 0x00, // length (44 bytes)
@@ -868,7 +800,7 @@ mod tests {
             encode_message(ClipboardPDUType::CB_FORMAT_LIST, empty.encode().unwrap()).unwrap();
 
         assert_eq!(
-            encoded[0],
+            encoded,
             vec![
                 0x0e, 0x00, 0x00, 0x00, // message length (14 bytes)
                 0x13, 0x00, 0x00, 0x00, // flags (first + last + show protocol)
@@ -1015,32 +947,6 @@ mod tests {
         assert_eq!(format_list.format_names[0].format_name, None);
     }
 
-    #[test]
-    fn encodes_large_format_data_response() {
-        let mut data = Vec::new();
-        data.resize(vchan::CHANNEL_CHUNK_LEGNTH + 2, 0);
-        for (i, item) in data.iter_mut().enumerate() {
-            *item = (i % 256) as u8;
-        }
-        let pdu = FormatDataResponsePDU { data };
-        let encoded = pdu.encode().unwrap();
-        let messages = encode_message(ClipboardPDUType::CB_FORMAT_DATA_RESPONSE, encoded).unwrap();
-        assert_eq!(2, messages.len());
-
-        let header0 =
-            vchan::ChannelPDUHeader::decode(&mut Cursor::new(messages[0].clone())).unwrap();
-        assert_eq!(
-            ChannelPDUFlags::CHANNEL_FLAG_FIRST | ChannelPDUFlags::CHANNEL_FLAG_SHOW_PROTOCOL,
-            header0.flags
-        );
-        let header1 =
-            vchan::ChannelPDUHeader::decode(&mut Cursor::new(messages[1].clone())).unwrap();
-        assert_eq!(
-            ChannelPDUFlags::CHANNEL_FLAG_LAST | ChannelPDUFlags::CHANNEL_FLAG_SHOW_PROTOCOL,
-            header1.flags
-        );
-    }
-
     #[test]
     fn responds_to_format_data_request_hasdata() {
         // a null-terminated utf-16 string, represented as a Vec<u8>
@@ -1074,7 +980,7 @@ mod tests {
     fn invokes_callback_with_clipboard_data() {
         let (send, recv) = channel();
 
-        let mut c = Client::new(Box::new(move |vec| {
+        let c = Client::new(Box::new(move |vec| {
             send.send(vec).unwrap();
         }));
 
@@ -1097,10 +1003,9 @@ mod tests {
     #[test]
     fn update_clipboard_returns_format_list_pdu() {
         let mut c: Client = Default::default();
-        let messages = c
+        let bytes = c
             .update_clipboard(String::from("abc").into_bytes())
             .unwrap();
-        let bytes = messages[0].clone();
 
         // verify that it returns a properly encoded format list PDU
         let mut payload = Cursor::new(bytes);
diff --git a/lib/srv/desktop/rdp/rdpclient/src/lib.rs b/lib/srv/desktop/rdp/rdpclient/src/lib.rs
index ba8529174f411..332174ee43111 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/lib.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/lib.rs
@@ -404,17 +404,10 @@ pub unsafe extern "C" fn update_clipboard(
 
     match lock.cliprdr {
         Some(ref mut clip) => match clip.update_clipboard(data) {
-            Ok(messages) => {
-                for message in messages {
-                    if let Err(e) = lock.mcs.write(&cliprdr::CHANNEL_NAME.to_string(), message) {
-                        return to_cgo_error(format!(
-                            "failed writing cliprdr format list: {:?}",
-                            e
-                        ));
-                    }
-                }
-                CGO_OK
-            }
+            Ok(message) => match lock.mcs.write(&cliprdr::CHANNEL_NAME.to_string(), message) {
+                Ok(()) => CGO_OK,
+                Err(e) => to_cgo_error(format!("failed writing cliprdr format list: {:?}", e)),
+            },
             Err(e) => to_cgo_error(format!("failed updating clipboard: {:?}", e)),
         },
         None => CGO_OK,
@@ -458,7 +451,7 @@ fn read_rdp_output_inner(client: &Client) -> Option<String> {
             .unwrap()
             .read(|rdp_event| match rdp_event {
                 RdpEvent::Bitmap(bitmap) => {
-                    let mut cbitmap = match CGOBitmap::try_from(bitmap) {
+                    let cbitmap = match CGOBitmap::try_from(bitmap) {
                         Ok(cb) => cb,
                         Err(e) => {
                             error!(
@@ -469,7 +462,7 @@ fn read_rdp_output_inner(client: &Client) -> Option<String> {
                         }
                     };
                     unsafe {
-                        err = handle_bitmap(client_ref, &mut cbitmap) as CGOError;
+                        err = handle_bitmap(client_ref, cbitmap) as CGOError;
                     };
                 }
                 // These should never really be sent by the server to us.
@@ -696,7 +689,8 @@ unsafe fn from_cgo_error(e: CGOError) -> String {
 // comments.
 extern "C" {
     fn free_go_string(s: *mut c_char);
-    fn handle_bitmap(client_ref: usize, b: *mut CGOBitmap) -> CGOError;
+    fn handle_bitmap(client_ref: usize, b: CGOBitmap) -> CGOError;
+
     fn handle_remote_copy(client_ref: usize, data: *mut u8, len: u32) -> CGOError;
 }
 
diff --git a/lib/srv/desktop/rdp/rdpclient/src/vchan.rs b/lib/srv/desktop/rdp/rdpclient/src/vchan.rs
index 0ab8ce6ecb878..0292e036f8022 100644
--- a/lib/srv/desktop/rdp/rdpclient/src/vchan.rs
+++ b/lib/srv/desktop/rdp/rdpclient/src/vchan.rs
@@ -18,17 +18,6 @@ use bitflags::bitflags;
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
 use rdp::model::error::*;
 
-/// The default maximum chunk size for virtual channel data.
-///
-/// If an RDP server supports larger chunks, it will advertise
-/// the larger chunk size in the `VCChunkSize` field of the
-/// virtual channel capability set.
-///
-/// See also:
-/// - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/6c074267-1b32-4ceb-9496-2eb941a23e6b
-/// - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/a8593178-80c0-4b80-876c-cb77e62cecfc
-pub const CHANNEL_CHUNK_LEGNTH: usize = 1600;
-
 bitflags! {
     /// Channel control flags, as specified in section 2.2.6.1.1 of MS-RDPBCGR.
     ///
@@ -54,13 +43,8 @@ bitflags! {
 /// It is specified in section 2.2.6.1.1 of MS-RDPBCGR.
 #[derive(Debug)]
 pub struct ChannelPDUHeader {
-    /// The total length of the uncompressed PDU data,
-    /// excluding the length of this header.
-    /// Note: the data can span multiple PDUs, in which
-    /// case each PDU in the series contains the same
-    /// length field.
-    pub length: u32,
-    pub flags: ChannelPDUFlags,
+    length: u32,
+    flags: ChannelPDUFlags,
 }
 
 impl ChannelPDUHeader {
diff --git a/lib/srv/desktop/windows_server.go b/lib/srv/desktop/windows_server.go
index ed9c513794485..ed33e43a9269b 100644
--- a/lib/srv/desktop/windows_server.go
+++ b/lib/srv/desktop/windows_server.go
@@ -113,7 +113,7 @@ type WindowsService struct {
 	// when desktop discovery is enabled.
 	// no synchronization is necessary because this is only read/written from
 	// the reconciler goroutine.
-	lastDiscoveryResults types.ResourcesWithLabelsMap
+	lastDiscoveryResults types.ResourcesWithLabels
 
 	// Windows hosts discovered via LDAP likely won't resolve with the
 	// default DNS resolver, so we need a custom resolver that will
@@ -163,8 +163,6 @@ type WindowsServiceConfig struct {
 	// Windows Desktops. If multiple filters are specified, they are ANDed
 	// together into a single search.
 	DiscoveryLDAPFilters []string
-	// Hostname of the windows desktop service
-	Hostname string
 }
 
 // LDAPConfig contains parameters for connecting to an LDAP server.
@@ -831,7 +829,7 @@ func (s *WindowsService) connectRDP(ctx context.Context, log logrus.FieldLogger,
 		AllowClipboard: authCtx.Checker.DesktopClipboard(),
 	})
 	if err != nil {
-		s.onSessionStart(ctx, sw, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)
+		s.onSessionStart(ctx, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)
 		return trace.Wrap(err)
 	}
 
@@ -859,13 +857,13 @@ func (s *WindowsService) connectRDP(ctx context.Context, log logrus.FieldLogger,
 		// consider this a connection failure and return an error
 		// (in the happy path, rdpc remains open until Wait() completes)
 		rdpc.Close()
-		s.onSessionStart(ctx, sw, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)
+		s.onSessionStart(ctx, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, err)
 		return trace.Wrap(err)
 	}
 
-	s.onSessionStart(ctx, sw, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, nil)
+	s.onSessionStart(ctx, &identity, sessionStartTime, windowsUser, string(sessionID), desktop, nil)
 	err = rdpc.Wait()
-	s.onSessionEnd(ctx, sw, &identity, sessionStartTime, recordSession, windowsUser, string(sessionID), desktop)
+	s.onSessionEnd(ctx, &identity, sessionStartTime, recordSession, windowsUser, string(sessionID), desktop)
 
 	return trace.Wrap(err)
 }
@@ -874,7 +872,7 @@ func (s *WindowsService) makeTDPSendHandler(ctx context.Context, emitter events.
 	id *tlsca.Identity, sessionID, desktopAddr string) func(m tdp.Message, b []byte) {
 	return func(m tdp.Message, b []byte) {
 		switch b[0] {
-		case byte(tdp.TypePNGFrame), byte(tdp.TypeError):
+		case byte(tdp.TypePNGFrame):
 			e := &events.DesktopRecording{
 				Metadata: events.Metadata{
 					Type: libevents.DesktopRecordingEvent,
@@ -898,7 +896,7 @@ func (s *WindowsService) makeTDPSendHandler(ctx context.Context, emitter events.
 				// the TDP send handler emits a clipboard receive event, because we
 				// received clipboard data from the remote desktop and are sending
 				// it on the TDP connection
-				s.onClipboardReceive(ctx, emitter, id, sessionID, desktopAddr, int32(len(clip)))
+				s.onClipboardReceive(ctx, id, sessionID, desktopAddr, int32(len(clip)))
 			}
 		}
 	}
@@ -932,7 +930,7 @@ func (s *WindowsService) makeTDPReceiveHandler(ctx context.Context, emitter even
 			// the TDP receive handler emits a clipboard send event, because we
 			// received clipboard data from the user (over TDP) and are sending
 			// it to the remote desktop
-			s.onClipboardSend(ctx, emitter, id, sessionID, desktopAddr, int32(len(msg)))
+			s.onClipboardSend(ctx, id, sessionID, desktopAddr, int32(len(msg)))
 		}
 	}
 }
@@ -943,7 +941,6 @@ func (s *WindowsService) getServiceHeartbeatInfo() (types.Resource, error) {
 		types.WindowsDesktopServiceSpecV3{
 			Addr:            s.cfg.Heartbeat.PublicAddr,
 			TeleportVersion: teleport.Version,
-			Hostname:        s.cfg.Hostname,
 		})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -1031,7 +1028,7 @@ func (s *WindowsService) updateCA(ctx context.Context) error {
 	// have to do it here.
 	//
 	// TODO(zmb3): support multiple CA certs per cluster (such as with HSMs).
-	ca, err := s.cfg.AccessPoint.GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := s.cfg.AccessPoint.GetCertAuthority(types.CertAuthID{
 		Type:       types.UserCA,
 		DomainName: s.clusterName,
 	}, false)
diff --git a/lib/srv/desktop/windows_server_test.go b/lib/srv/desktop/windows_server_test.go
index 4bc0f32983e34..0256f18441b02 100644
--- a/lib/srv/desktop/windows_server_test.go
+++ b/lib/srv/desktop/windows_server_test.go
@@ -285,8 +285,13 @@ func TestEmitsRecordingEventsOnReceive(t *testing.T) {
 
 func TestEmitsClipboardSendEvents(t *testing.T) {
 	s, id, emitter := setup()
+
+	// clipboard events go straight to the audit log,
+	// not the session recording, so they use s.cfg.Emitter
+	// rather than the emitter passed in here
+	var recordingStreamer events.Emitter /* = nil */
 	handler := s.makeTDPReceiveHandler(context.Background(),
-		emitter, func() int64 { return 0 },
+		recordingStreamer, func() int64 { return 0 },
 		id, "session-0", "windows.example.com")
 
 	fakeClipboardData := make([]byte, 1024)
@@ -309,8 +314,13 @@ func TestEmitsClipboardSendEvents(t *testing.T) {
 
 func TestEmitsClipboardReceiveEvents(t *testing.T) {
 	s, id, emitter := setup()
+
+	// clipboard events go straight to the audit log,
+	// not the session recording, so they use s.cfg.Emitter
+	// rather than the emitter passed in here
+	var recordingStreamer events.Emitter /* = nil */
 	handler := s.makeTDPSendHandler(context.Background(),
-		emitter, func() int64 { return 0 },
+		recordingStreamer, func() int64 { return 0 },
 		id, "session-0", "windows.example.com")
 
 	fakeClipboardData := make([]byte, 512)
diff --git a/lib/srv/reexec.go b/lib/srv/reexec.go
index ca4018eb1d481..1444f5295b64a 100644
--- a/lib/srv/reexec.go
+++ b/lib/srv/reexec.go
@@ -22,6 +22,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"os"
 	"os/exec"
@@ -201,8 +202,8 @@ func RunCommand() (errw io.Writer, code int, err error) {
 			stderr = tty
 		} else {
 			stdin = os.Stdin
-			stdout = io.Discard
-			stderr = io.Discard
+			stdout = ioutil.Discard
+			stderr = ioutil.Discard
 		}
 
 		// Open the PAM context.
@@ -325,7 +326,7 @@ func RunCommand() (errw io.Writer, code int, err error) {
 		}
 	}
 
-	return io.Discard, exitCode(err), trace.Wrap(err)
+	return ioutil.Discard, exitCode(err), trace.Wrap(err)
 }
 
 // RunForward reads in the command to run from the parent process (over a
@@ -362,8 +363,8 @@ func RunForward() (errw io.Writer, code int, err error) {
 			ServiceName: c.PAMConfig.ServiceName,
 			Login:       c.Login,
 			Stdin:       os.Stdin,
-			Stdout:      io.Discard,
-			Stderr:      io.Discard,
+			Stdout:      ioutil.Discard,
+			Stderr:      ioutil.Discard,
 			// Set Teleport specific environment variables that PAM modules
 			// like pam_script.so can pick up to potentially customize the
 			// account/session.
@@ -408,19 +409,19 @@ func RunForward() (errw io.Writer, code int, err error) {
 		return errorWriter, teleport.RemoteCommandFailure, trace.Wrap(err)
 	}
 
-	return io.Discard, teleport.RemoteCommandSuccess, nil
+	return ioutil.Discard, teleport.RemoteCommandSuccess, nil
 }
 
 // runCheckHomeDir check's if the active user's $HOME dir exists.
 func runCheckHomeDir() (errw io.Writer, code int, err error) {
 	home, err := os.UserHomeDir()
 	if err != nil {
-		return io.Discard, teleport.HomeDirNotFound, nil
+		return ioutil.Discard, teleport.HomeDirNotFound, nil
 	}
 	if !utils.IsDir(home) {
-		return io.Discard, teleport.HomeDirNotFound, nil
+		return ioutil.Discard, teleport.HomeDirNotFound, nil
 	}
-	return io.Discard, teleport.RemoteCommandSuccess, nil
+	return ioutil.Discard, teleport.RemoteCommandSuccess, nil
 }
 
 // RunAndExit will run the requested command and then exit. This wrapper
diff --git a/lib/srv/regular/sshserver.go b/lib/srv/regular/sshserver.go
index b68550b2215b4..8e3d0cd72981f 100644
--- a/lib/srv/regular/sshserver.go
+++ b/lib/srv/regular/sshserver.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"os"
 	"os/user"
@@ -861,7 +862,7 @@ func (s *Server) serveAgent(ctx *srv.ServerContext) error {
 	pid := os.Getpid()
 
 	// build the socket path and set permissions
-	socketDir, err := os.MkdirTemp(os.TempDir(), "teleport-")
+	socketDir, err := ioutil.TempDir(os.TempDir(), "teleport-")
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/srv/regular/sshserver_test.go b/lib/srv/regular/sshserver_test.go
index ff1014ed80143..e37e31ecbe86e 100644
--- a/lib/srv/regular/sshserver_test.go
+++ b/lib/srv/regular/sshserver_test.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -278,7 +279,7 @@ const hostID = "00000000-0000-0000-0000-000000000000"
 func startReadAll(r io.Reader) <-chan []byte {
 	ch := make(chan []byte)
 	go func() {
-		data, _ := io.ReadAll(r)
+		data, _ := ioutil.ReadAll(r)
 		ch <- data
 	}()
 	return ch
@@ -448,7 +449,7 @@ func TestDirectTCPIP(t *testing.T) {
 	defer resp.Body.Close()
 
 	// Make sure the response is what was expected.
-	body, err := io.ReadAll(resp.Body)
+	body, err := ioutil.ReadAll(resp.Body)
 	require.NoError(t, err)
 	require.Equal(t, []byte("hello, world\n"), body)
 }
@@ -619,7 +620,7 @@ func TestAgentForward(t *testing.T) {
 	require.NoError(t, err)
 
 	// create a temp file to collect the shell output into:
-	tmpFile, err := os.CreateTemp(os.TempDir(), "teleport-agent-forward-test")
+	tmpFile, err := ioutil.TempFile(os.TempDir(), "teleport-agent-forward-test")
 	require.NoError(t, err)
 	tmpFile.Close()
 	defer os.Remove(tmpFile.Name())
@@ -631,7 +632,7 @@ func TestAgentForward(t *testing.T) {
 	// wait for the output
 	var socketPath string
 	require.Eventually(t, func() bool {
-		output, err := os.ReadFile(tmpFile.Name())
+		output, err := ioutil.ReadFile(tmpFile.Name())
 		if err == nil && len(output) != 0 {
 			socketPath = strings.TrimSpace(string(output))
 			return true
diff --git a/lib/srv/sess.go b/lib/srv/sess.go
index 28860ac7e2f55..dac30094a1c94 100644
--- a/lib/srv/sess.go
+++ b/lib/srv/sess.go
@@ -93,7 +93,6 @@ func NewSessionRegistry(srv Server, auth auth.ClientI) (*SessionRegistry, error)
 		}),
 		srv:      srv,
 		sessions: make(map[rsession.ID]*session),
-		auth:     auth,
 	}, nil
 }
 
@@ -320,7 +319,7 @@ func (s *SessionRegistry) ForceTerminate(ctx *ServerContext) error {
 	}
 
 	sess.terminated = true
-	sess.BroadcastMessage("Forcefully terminating session...")
+	sess.io.BroadcastMessage("Forcefully terminating session...")
 	sess.term.Kill()
 	sess.doneCh <- struct{}{}
 
@@ -602,8 +601,6 @@ type session struct {
 	bpfContext *bpf.SessionContext
 
 	cgroupID uint64
-
-	displayParticipantRequirements bool
 }
 
 // newSession creates a new session with a given ID within a given context.
@@ -672,35 +669,25 @@ func newSession(id rsession.ID, r *SessionRegistry, ctx *ServerContext) (*sessio
 		log: log.WithFields(log.Fields{
 			trace.Component: teleport.Component(teleport.ComponentSession, r.srv.Component()),
 		}),
-		id:                             id,
-		registry:                       r,
-		parties:                        make(map[rsession.ID]*party),
-		participants:                   make(map[rsession.ID]*party),
-		login:                          ctx.Identity.Login,
-		closeC:                         make(chan bool),
-		lingerTTL:                      defaults.SessionIdlePeriod,
-		startTime:                      startTime,
-		serverCtx:                      ctx.srv.Context(),
-		state:                          types.SessionState_SessionStatePending,
-		access:                         auth.NewSessionAccessEvaluator(policySets, types.SSHSessionKind),
-		scx:                            ctx,
-		presenceEnabled:                ctx.Identity.Certificate.Extensions[teleport.CertExtensionMFAVerified] != "",
-		io:                             NewTermManager(),
-		stateUpdate:                    sync.NewCond(&sync.Mutex{}),
-		doneCh:                         make(chan struct{}, 2),
-		initiator:                      ctx.Identity.TeleportUser,
-		displayParticipantRequirements: utils.AsBool(ctx.env[teleport.EnvSSHSessionDisplayParticipantRequirements]),
+		id:              id,
+		registry:        r,
+		parties:         make(map[rsession.ID]*party),
+		participants:    make(map[rsession.ID]*party),
+		login:           ctx.Identity.Login,
+		closeC:          make(chan bool),
+		lingerTTL:       defaults.SessionIdlePeriod,
+		startTime:       startTime,
+		serverCtx:       ctx.srv.Context(),
+		state:           types.SessionState_SessionStatePending,
+		access:          auth.NewSessionAccessEvaluator(policySets, types.SSHSessionKind),
+		scx:             ctx,
+		presenceEnabled: ctx.Identity.Certificate.Extensions[teleport.CertExtensionMFAVerified] != "",
+		io:              NewTermManager(),
+		stateUpdate:     sync.NewCond(&sync.Mutex{}),
+		doneCh:          make(chan struct{}, 2),
+		initiator:       ctx.Identity.TeleportUser,
 	}
 
-	go func() {
-		if _, open := <-sess.io.TerminateNotifier(); open {
-			err := sess.registry.ForceTerminate(sess.scx)
-			if err != nil {
-				sess.log.Errorf("Failed to terminate session: %v.", err)
-			}
-		}
-	}()
-
 	err = sess.trackerCreate(ctx.Identity.TeleportUser, policySets)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -743,7 +730,7 @@ func (s *session) Close() error {
 			defer s.mu.Unlock()
 
 			close(s.closeC)
-			s.BroadcastMessage("Closing session...")
+			s.io.BroadcastMessage("Closing session...")
 			s.log.Infof("Closing session %v.", s.id)
 			if s.term != nil {
 				s.term.Close()
@@ -781,7 +768,10 @@ func (s *session) isLingering() bool {
 
 func (s *session) waitOnAccess() error {
 	s.io.Off()
-	s.BroadcastMessage("Session paused, Waiting for required participants...")
+	err := s.io.BroadcastMessage("Session paused, Waiting for required participants...")
+	if err != nil {
+		log.WithError(err).Errorf("Failed to broadcast message.")
+	}
 
 	s.stateUpdate.L.Lock()
 	defer s.stateUpdate.L.Unlock()
@@ -799,21 +789,11 @@ outer:
 		s.stateUpdate.Wait()
 	}
 
-	s.BroadcastMessage("Resuming session...")
+	s.io.BroadcastMessage("Resuming session...")
 	s.io.On()
 	return nil
 }
 
-func (s *session) BroadcastMessage(format string, args ...interface{}) {
-	if s.access.IsModerated() && !services.IsRecordAtProxy(s.scx.SessionRecordingConfig.GetMode()) {
-		err := s.io.BroadcastMessage(fmt.Sprintf(format, args...))
-
-		if err != nil {
-			s.log.Debugf("Failed to broadcast message: %v", err)
-		}
-	}
-}
-
 func (s *session) launch(ctx *ServerContext) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -821,7 +801,7 @@ func (s *session) launch(ctx *ServerContext) error {
 	defer s.stateUpdate.L.Unlock()
 
 	s.log.Debugf("Launching session %v.", s.id)
-	s.BroadcastMessage("Connecting to %v over SSH", ctx.srv.GetInfo().GetHostname())
+	s.io.BroadcastMessage("Launching session...")
 	s.state = types.SessionState_SessionStateRunning
 
 	err := s.io.On()
@@ -947,11 +927,34 @@ func (s *session) startInteractive(ch ssh.Channel, ctx *ServerContext) error {
 	// create a new "party" (connected client)
 	p := newParty(s, types.SessionPeerMode, ch, ctx)
 
-	rec, err := newRecorder(s, ctx)
-	if err != nil {
-		return trace.Wrap(err)
+	// Nodes discard events in cases when proxies are already recording them.
+	if s.registry.srv.Component() == teleport.ComponentNode &&
+		services.IsRecordAtProxy(ctx.SessionRecordingConfig.GetMode()) {
+		s.recorder = &events.DiscardStream{}
+	} else {
+		streamer, err := s.newStreamer(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		s.recorder, err = events.NewAuditWriter(events.AuditWriterConfig{
+			// Audit stream is using server context, not session context,
+			// to make sure that session is uploaded even after it is closed
+			Context:      ctx.srv.Context(),
+			Streamer:     streamer,
+			Clock:        ctx.srv.GetClock(),
+			SessionID:    s.id,
+			Namespace:    ctx.srv.GetNamespace(),
+			ServerID:     ctx.srv.HostUUID(),
+			RecordOutput: ctx.SessionRecordingConfig.GetMode() != types.RecordOff,
+			Component:    teleport.Component(teleport.ComponentSession, ctx.srv.Component()),
+			ClusterName:  ctx.ClusterName,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
 	}
-	s.recorder = rec
+
+	var err error
 
 	// allocate a terminal or take the one previously allocated via a
 	// seaprate "allocate TTY" SSH request
@@ -1004,7 +1007,10 @@ func (s *session) startInteractive(ch ssh.Channel, ctx *ServerContext) error {
 	s.inWriter = inWriter
 	s.io.AddReader("reader", inReader)
 	s.io.AddWriter("session-recorder", utils.WriteCloserWithContext(ctx.srv.Context(), s.recorder))
-	s.BroadcastMessage("Creating session with ID: %v...", s.id)
+	err = s.io.BroadcastMessage(fmt.Sprintf("Creating session with ID: %v...", s.id))
+	if err != nil {
+		return trace.Wrap(err)
+	}
 
 	if err := s.term.Run(); err != nil {
 		ctx.Errorf("Unable to run shell command: %v.", err)
@@ -1049,45 +1055,36 @@ func (s *session) startInteractive(ch ssh.Channel, ctx *ServerContext) error {
 	return nil
 }
 
-// newRecorder creates a new events.StreamWriter to be used as the recorder
-// of the passed in session.
-func newRecorder(s *session, ctx *ServerContext) (events.StreamWriter, error) {
+func (s *session) startExec(channel ssh.Channel, ctx *ServerContext) error {
+	var err error
+
 	// Nodes discard events in cases when proxies are already recording them.
 	if s.registry.srv.Component() == teleport.ComponentNode &&
 		services.IsRecordAtProxy(ctx.SessionRecordingConfig.GetMode()) {
-		return &events.DiscardStream{}, nil
-	}
-
-	streamer, err := s.newStreamer(ctx)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	rec, err := events.NewAuditWriter(events.AuditWriterConfig{
-		// Audit stream is using server context, not session context,
-		// to make sure that session is uploaded even after it is closed
-		Context:      ctx.srv.Context(),
-		Streamer:     streamer,
-		SessionID:    s.id,
-		Clock:        ctx.srv.GetClock(),
-		Namespace:    ctx.srv.GetNamespace(),
-		ServerID:     ctx.srv.HostUUID(),
-		RecordOutput: ctx.SessionRecordingConfig.GetMode() != types.RecordOff,
-		Component:    teleport.Component(teleport.ComponentSession, ctx.srv.Component()),
-		ClusterName:  ctx.ClusterName,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return rec, nil
-}
-
-func (s *session) startExec(channel ssh.Channel, ctx *ServerContext) error {
-	rec, err := newRecorder(s, ctx)
-	if err != nil {
-		return trace.Wrap(err)
+		s.recorder = &events.DiscardStream{}
+	} else {
+		streamer, err := s.newStreamer(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		rec, err := events.NewAuditWriter(events.AuditWriterConfig{
+			// Audit stream is using server context, not session context,
+			// to make sure that session is uploaded even after it is closed
+			Context:      ctx.srv.Context(),
+			Streamer:     streamer,
+			SessionID:    s.id,
+			Clock:        ctx.srv.GetClock(),
+			Namespace:    ctx.srv.GetNamespace(),
+			ServerID:     ctx.srv.HostUUID(),
+			RecordOutput: ctx.SessionRecordingConfig.GetMode() != types.RecordOff,
+			Component:    teleport.Component(teleport.ComponentSession, ctx.srv.Component()),
+			ClusterName:  ctx.ClusterName,
+		})
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		s.recorder = rec
 	}
-	s.recorder = rec
 
 	// Emit a session.start event for the exec session.
 	sessionStartEvent := &apievents.SessionStart{
@@ -1319,7 +1316,7 @@ func (s *session) removeParty(p *party) error {
 	}
 
 	s.io.DeleteWriter(string(p.id))
-	s.BroadcastMessage("User %v left the session.", p.user)
+	s.io.BroadcastMessage(fmt.Sprintf("User %v left the session.", p.user))
 	return nil
 }
 
@@ -1480,18 +1477,6 @@ func (s *session) addParty(p *party, mode types.SessionParticipantMode) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	if len(s.parties) == 0 {
-		canStart, _, err := s.checkIfStart()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		if !canStart && services.IsRecordAtProxy(p.ctx.SessionRecordingConfig.GetMode()) {
-			go s.Close()
-			return trace.AccessDenied("session requires additional moderation but is in proxy-record mode")
-		}
-	}
-
 	// Adds participant to in-memory map of party members.
 	s.parties[p.id] = p
 	s.participants[p.id] = p
@@ -1512,7 +1497,7 @@ func (s *session) addParty(p *party, mode types.SessionParticipantMode) error {
 	p.ctx.AddCloser(p)
 	s.term.AddParty(1)
 
-	s.BroadcastMessage("User %v joined the session.", p.user)
+	s.io.BroadcastMessage(fmt.Sprintf("User %v joined the session.", p.user))
 	s.log.Infof("New party %v joined session: %v", p.String(), s.id)
 
 	if mode == types.SessionPeerMode {
@@ -1554,14 +1539,6 @@ func (s *session) addParty(p *party, mode types.SessionParticipantMode) error {
 				s.state = types.SessionState_SessionStateRunning
 				s.stateUpdate.Broadcast()
 			}
-		} else if !s.started {
-			base := "Waiting for required participants..."
-
-			if s.displayParticipantRequirements {
-				s.BroadcastMessage(base+"\r\n%v", s.access.PrettyRequirementsList())
-			} else {
-				s.BroadcastMessage(base)
-			}
 		}
 	}
 
@@ -1715,12 +1692,9 @@ func (s *session) trackerCreate(teleportUser string, policySet []*types.SessionT
 
 	reason := s.scx.env[teleport.EnvSSHSessionReason]
 	var invited []string
-
-	if s.scx.env[teleport.EnvSSHSessionInvited] != "" {
-		err := json.Unmarshal([]byte(s.scx.env[teleport.EnvSSHSessionInvited]), &invited)
-		if err != nil {
-			return trace.Wrap(err)
-		}
+	err := json.Unmarshal([]byte(s.scx.env[teleport.EnvSSHSessionInvited]), &invited)
+	if err != nil {
+		return trace.Wrap(err)
 	}
 
 	req := &proto.CreateSessionTrackerRequest{
@@ -1739,7 +1713,7 @@ func (s *session) trackerCreate(teleportUser string, policySet []*types.SessionT
 		HostPolicies: policySet,
 	}
 
-	_, err := s.registry.auth.CreateSessionTracker(s.serverCtx, req)
+	_, err = s.registry.auth.CreateSessionTracker(s.serverCtx, req)
 	return trace.Wrap(err)
 }
 
diff --git a/lib/srv/sess_test.go b/lib/srv/sess_test.go
index 02a98f96cec1a..88b433559cda8 100644
--- a/lib/srv/sess_test.go
+++ b/lib/srv/sess_test.go
@@ -17,20 +17,8 @@ limitations under the License.
 package srv
 
 import (
-	"context"
 	"testing"
 
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/bpf"
-	"github.com/gravitational/teleport/lib/events"
-	"github.com/gravitational/teleport/lib/pam"
-	restricted "github.com/gravitational/teleport/lib/restrictedsession"
-	"github.com/gravitational/teleport/lib/services"
-	rsession "github.com/gravitational/teleport/lib/session"
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 )
 
@@ -75,237 +63,3 @@ func TestParseAccessRequestIDs(t *testing.T) {
 	}
 
 }
-
-type mockServer struct {
-	events.StreamEmitter
-}
-
-// ID is the unique ID of the server.
-func (m *mockServer) ID() string {
-	return "test"
-}
-
-// HostUUID is the UUID of the underlying host. For the forwarding
-// server this is the proxy the forwarding server is running in.
-func (m *mockServer) HostUUID() string {
-	return "test"
-}
-
-// GetNamespace returns the namespace the server was created in.
-func (m *mockServer) GetNamespace() string {
-	return "test"
-}
-
-// AdvertiseAddr is the publicly addressable address of this server.
-func (m *mockServer) AdvertiseAddr() string {
-	return "test"
-}
-
-// Component is the type of server, forwarding or regular.
-func (m *mockServer) Component() string {
-	return teleport.ComponentNode
-}
-
-// PermitUserEnvironment returns if reading environment variables upon
-// startup is allowed.
-func (m *mockServer) PermitUserEnvironment() bool {
-	return false
-}
-
-// GetAccessPoint returns an AccessPoint for this cluster.
-func (m *mockServer) GetAccessPoint() AccessPoint {
-	return nil
-}
-
-// GetSessionServer returns a session server.
-func (m *mockServer) GetSessionServer() rsession.Service {
-	return nil
-}
-
-// GetDataDir returns data directory of the server
-func (m *mockServer) GetDataDir() string {
-	return "test"
-}
-
-// GetPAM returns PAM configuration for this server.
-func (m *mockServer) GetPAM() (*pam.Config, error) {
-	return nil, nil
-}
-
-// GetClock returns a clock setup for the server
-func (m *mockServer) GetClock() clockwork.Clock {
-	return clockwork.NewRealClock()
-}
-
-// GetInfo returns a services.Server that represents this server.
-func (m *mockServer) GetInfo() types.Server {
-	return nil
-}
-
-// UseTunnel used to determine if this node has connected to this cluster
-// using reverse tunnel.
-func (m *mockServer) UseTunnel() bool {
-	return false
-}
-
-// GetBPF returns the BPF service used for enhanced session recording.
-func (m *mockServer) GetBPF() bpf.BPF {
-	return nil
-}
-
-// GetRestrictedSessionManager returns the manager for restricting user activity
-func (m *mockServer) GetRestrictedSessionManager() restricted.Manager {
-	return nil
-}
-
-// Context returns server shutdown context
-func (m *mockServer) Context() context.Context {
-	return context.Background()
-}
-
-// GetUtmpPath returns the path of the user accounting database and log. Returns empty for system defaults.
-func (m *mockServer) GetUtmpPath() (utmp, wtmp string) {
-	return "test", "test"
-}
-
-// GetLockWatcher gets the server's lock watcher.
-func (m *mockServer) GetLockWatcher() *services.LockWatcher {
-	return nil
-}
-
-func TestSession_newRecorder(t *testing.T) {
-	proxyRecording, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
-		Mode: types.RecordAtProxy,
-	})
-	require.NoError(t, err)
-
-	proxyRecordingSync, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
-		Mode: types.RecordAtProxySync,
-	})
-	require.NoError(t, err)
-
-	nodeRecording, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
-		Mode: types.RecordAtNode,
-	})
-	require.NoError(t, err)
-
-	nodeRecordingSync, err := types.NewSessionRecordingConfigFromConfigFile(types.SessionRecordingConfigSpecV2{
-		Mode: types.RecordAtNodeSync,
-	})
-	require.NoError(t, err)
-
-	logger := logrus.WithFields(logrus.Fields{
-		trace.Component: teleport.ComponentAuth,
-	})
-
-	cases := []struct {
-		desc         string
-		sess         *session
-		sctx         *ServerContext
-		errAssertion require.ErrorAssertionFunc
-		recAssertion require.ValueAssertionFunc
-	}{
-		{
-			desc: "discard-stream-when-proxy-recording",
-			sess: &session{
-				id:  "test",
-				log: logger,
-				registry: &SessionRegistry{
-					srv: &mockServer{},
-				},
-			},
-			sctx: &ServerContext{
-				SessionRecordingConfig: proxyRecording,
-			},
-			errAssertion: require.NoError,
-			recAssertion: func(t require.TestingT, i interface{}, i2 ...interface{}) {
-				require.NotNil(t, i)
-				_, ok := i.(*events.DiscardStream)
-				require.True(t, ok)
-			},
-		},
-		{
-			desc: "discard-stream--when-proxy-sync-recording",
-			sess: &session{
-				id:  "test",
-				log: logger,
-				registry: &SessionRegistry{
-					srv: &mockServer{},
-				},
-			},
-			sctx: &ServerContext{
-				SessionRecordingConfig: proxyRecordingSync,
-			},
-			errAssertion: require.NoError,
-			recAssertion: func(t require.TestingT, i interface{}, i2 ...interface{}) {
-				require.NotNil(t, i)
-				_, ok := i.(*events.DiscardStream)
-				require.True(t, ok)
-			},
-		},
-		{
-			desc: "err-new-streamer-fails",
-			sess: &session{
-				id:  "test",
-				log: logger,
-				registry: &SessionRegistry{
-					srv: &mockServer{},
-				},
-			},
-			sctx: &ServerContext{
-				SessionRecordingConfig: nodeRecording,
-				srv:                    &mockServer{},
-			},
-			errAssertion: require.Error,
-			recAssertion: require.Nil,
-		},
-		{
-			desc: "err-new-audit-writer-fails",
-			sess: &session{
-				id:  "test",
-				log: logger,
-				registry: &SessionRegistry{
-					srv: &mockServer{},
-				},
-			},
-			sctx: &ServerContext{
-				SessionRecordingConfig: nodeRecordingSync,
-				srv:                    &mockServer{},
-			},
-			errAssertion: require.Error,
-			recAssertion: require.Nil,
-		},
-		{
-			desc: "audit-writer",
-			sess: &session{
-				id:  "test",
-				log: logger,
-				registry: &SessionRegistry{
-					srv: &mockServer{},
-				},
-			},
-			sctx: &ServerContext{
-				ClusterName:            "test",
-				SessionRecordingConfig: nodeRecordingSync,
-				srv: &mockServer{
-					StreamEmitter: &events.DiscardEmitter{},
-				},
-			},
-			errAssertion: require.NoError,
-			recAssertion: func(t require.TestingT, i interface{}, i2 ...interface{}) {
-				require.NotNil(t, i)
-				aw, ok := i.(*events.AuditWriter)
-				require.True(t, ok)
-				require.NoError(t, aw.Close(context.Background()))
-			},
-		},
-	}
-
-	for _, tt := range cases {
-		t.Run(tt.desc, func(t *testing.T) {
-			rec, err := newRecorder(tt.sess, tt.sctx)
-			tt.errAssertion(t, err)
-			tt.recAssertion(t, rec)
-		})
-	}
-}
diff --git a/lib/srv/termmanager.go b/lib/srv/termmanager.go
index b9bf958ca3c33..e3d8796ee65bc 100644
--- a/lib/srv/termmanager.go
+++ b/lib/srv/termmanager.go
@@ -31,15 +31,12 @@ const maxHistory = 1000
 // - history scrollback for new clients
 // - stream breaking
 type TermManager struct {
-	// These two fields need to be first in the struct so that they are 64-bit aligned which is a requirement
-	// for atomic operations on certain architectures.
-	countWritten uint64
-	countRead    uint64
-
 	mu           sync.Mutex
 	writers      map[string]io.Writer
-	readerState  map[string]bool
+	readerState  map[string]*int32
 	OnWriteError func(idString string, err error)
+	countWritten uint64
+	countRead    uint64
 	// buffer is used to buffer writes when turned off
 	buffer []byte
 	on     bool
@@ -49,27 +46,23 @@ type TermManager struct {
 	incoming chan []byte
 	// remaining is a partially read chunk of stdin data
 	// we only support one concurrent reader so this isn't mutex protected
-	remaining         []byte
-	readStateUpdate   *sync.Cond
-	closed            bool
-	lastWasBroadcast  bool
-	terminateNotifier chan struct{}
+	remaining       []byte
+	readStateUpdate *sync.Cond
+	closed          *int32
 }
 
 // NewTermManager creates a new TermManager.
 func NewTermManager() *TermManager {
 	return &TermManager{
-		writers:           make(map[string]io.Writer),
-		readerState:       make(map[string]bool),
-		closed:            false,
-		readStateUpdate:   sync.NewCond(&sync.Mutex{}),
-		incoming:          make(chan []byte, 100),
-		terminateNotifier: make(chan struct{}),
+		writers:         make(map[string]io.Writer),
+		readerState:     make(map[string]*int32),
+		closed:          new(int32),
+		readStateUpdate: sync.NewCond(&sync.Mutex{}),
+		incoming:        make(chan []byte, 100),
 	}
 }
 
 func (g *TermManager) writeToClients(p []byte) int {
-	g.lastWasBroadcast = false
 	truncateFront := func(slice []byte, max int) []byte {
 		if len(slice) > max {
 			return slice[len(slice)-max:]
@@ -102,10 +95,6 @@ func (g *TermManager) writeToClients(p []byte) int {
 	return len(p)
 }
 
-func (g *TermManager) TerminateNotifier() <-chan struct{} {
-	return g.terminateNotifier
-}
-
 func (g *TermManager) Write(p []byte) (int, error) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
@@ -174,14 +163,9 @@ func (g *TermManager) writeUnconditional(p []byte) (int, error) {
 
 // BroadcastMessage injects a message into the stream.
 func (g *TermManager) BroadcastMessage(message string) error {
+	data := []byte("\r\nTeleport > " + message + "\r\n")
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	data := []byte("Teleport > " + message + "\r\n")
-	if g.lastWasBroadcast {
-		data = append([]byte("\r\n"), data...)
-	} else {
-		g.lastWasBroadcast = true
-	}
 	_, err := g.writeUnconditional(data)
 	return trace.Wrap(err)
 }
@@ -217,7 +201,8 @@ func (g *TermManager) DeleteWriter(name string) {
 }
 
 func (g *TermManager) AddReader(name string, r io.Reader) {
-	g.readerState[name] = false
+	readerState := new(int32)
+	g.readerState[name] = readerState
 
 	go func() {
 		for {
@@ -229,28 +214,10 @@ func (g *TermManager) AddReader(name string, r io.Reader) {
 				return
 			}
 
-			for _, b := range buf[:n] {
-				// This is the ASCII control code for CTRL+C.
-				if b == 0x03 {
-					g.mu.Lock()
-					if !g.on && !g.closed {
-						select {
-						case g.terminateNotifier <- struct{}{}:
-						default:
-						}
-					}
-					g.mu.Unlock()
-					break
-				}
-			}
-
 			g.incoming <- buf[:n]
-			g.mu.Lock()
-			if g.closed || g.readerState[name] {
-				g.mu.Unlock()
+			if atomic.LoadInt32(g.closed) == 1 || atomic.LoadInt32(readerState) == 1 {
 				return
 			}
-			g.mu.Unlock()
 		}
 	}()
 }
@@ -258,7 +225,10 @@ func (g *TermManager) AddReader(name string, r io.Reader) {
 func (g *TermManager) DeleteReader(name string) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	g.readerState[name] = true
+
+	if g.readerState[name] != nil {
+		atomic.StoreInt32(g.readerState[name], 1)
+	}
 }
 
 func (g *TermManager) CountWritten() uint64 {
@@ -270,13 +240,7 @@ func (g *TermManager) CountRead() uint64 {
 }
 
 func (g *TermManager) Close() {
-	g.mu.Lock()
-	defer g.mu.Unlock()
-
-	if !g.closed {
-		g.closed = true
-		close(g.terminateNotifier)
-	}
+	atomic.StoreInt32(g.closed, 1)
 }
 
 func (g *TermManager) GetRecentHistory() []byte {
diff --git a/lib/srv/termmanager_test.go b/lib/srv/termmanager_test.go
deleted file mode 100644
index feb5667bab47c..0000000000000
--- a/lib/srv/termmanager_test.go
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package srv
-
-import (
-	"io"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestCTRLCPassthrough(t *testing.T) {
-	m := NewTermManager()
-	m.On()
-	r, w := io.Pipe()
-	m.AddReader("foo", r)
-	go w.Write([]byte("\x03"))
-	buf := make([]byte, 1)
-	_, err := m.Read(buf)
-	require.NoError(t, err)
-	require.Equal(t, []byte("\x03"), buf)
-}
-
-func TestCTRLCCapture(t *testing.T) {
-	m := NewTermManager()
-	r, w := io.Pipe()
-	m.AddReader("foo", r)
-	go w.Write([]byte("\x03"))
-
-	select {
-	case <-m.TerminateNotifier():
-	case <-time.After(time.Second * 10):
-		t.Fatal("terminateNotifier should've seen an event")
-	}
-}
diff --git a/lib/sshutils/scp/scp_test.go b/lib/sshutils/scp/scp_test.go
index 19579e243643b..01f4a0f9daf45 100644
--- a/lib/sshutils/scp/scp_test.go
+++ b/lib/sshutils/scp/scp_test.go
@@ -19,6 +19,7 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -64,7 +65,7 @@ func TestHTTPSendFile(t *testing.T) {
 	require.NoError(t, err)
 	err = runSCP(cmd, "-v", "-t", outDir)
 	require.NoError(t, err)
-	bytesReceived, err := os.ReadFile(filepath.Join(outDir, "filename"))
+	bytesReceived, err := ioutil.ReadFile(filepath.Join(outDir, "filename"))
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(string(bytesReceived), string(expectedBytes)))
 }
@@ -73,7 +74,7 @@ func TestHTTPReceiveFile(t *testing.T) {
 	source := filepath.Join(t.TempDir(), "target")
 
 	contents := []byte("hello, file contents!")
-	err := os.WriteFile(source, contents, 0666)
+	err := ioutil.WriteFile(source, contents, 0666)
 	require.NoError(t, err)
 
 	w := httptest.NewRecorder()
@@ -90,7 +91,7 @@ func TestHTTPReceiveFile(t *testing.T) {
 	err = runSCP(cmd, "-v", "-f", source)
 	require.NoError(t, err)
 
-	data, err := io.ReadAll(w.Body)
+	data, err := ioutil.ReadAll(w.Body)
 	contentLengthStr := strconv.Itoa(len(data))
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(string(data), string(contents)))
@@ -427,7 +428,7 @@ func TestInvalidDir(t *testing.T) {
 			doneC := make(chan struct{})
 			// Service stderr
 			go func() {
-				io.Copy(io.Discard, stderr)
+				io.Copy(ioutil.Discard, stderr)
 				close(doneC)
 			}()
 
@@ -451,7 +452,7 @@ func TestVerifyDirectoryModeFailsWithFile(t *testing.T) {
 	// Create temporary directory with a file "target" in it.
 	dir := t.TempDir()
 	target := filepath.Join(dir, "target")
-	err := os.WriteFile(target, []byte{}, 0666)
+	err := ioutil.WriteFile(target, []byte{}, 0666)
 	require.NoError(t, err)
 
 	cmd, err := CreateCommand(
@@ -477,7 +478,7 @@ func TestVerifyDirectoryModeIsRequiredForDirectory(t *testing.T) {
 	// Create temporary directory with a file "target" in it.
 	dir := t.TempDir()
 	target := filepath.Join(dir, "target")
-	err := os.WriteFile(target, []byte{}, 0666)
+	err := ioutil.WriteFile(target, []byte{}, 0666)
 	require.NoError(t, err)
 
 	cmd, err := CreateCommand(
@@ -665,7 +666,7 @@ func validateSCPContents(t *testing.T, expected *testFS, actual FileSystem) {
 		rc, err := actual.OpenFile(path)
 		require.NoError(t, err)
 		defer rc.Close()
-		bytes, err := io.ReadAll(rc)
+		bytes, err := ioutil.ReadAll(rc)
 		require.NoError(t, err)
 		require.Empty(t, cmp.Diff(fileinfo.contents.String(), string(bytes)))
 	}
diff --git a/lib/sshutils/x11/display.go b/lib/sshutils/x11/display.go
index 6e0b2a152274c..2fd6f66554bd2 100644
--- a/lib/sshutils/x11/display.go
+++ b/lib/sshutils/x11/display.go
@@ -118,29 +118,12 @@ func (d *Display) Listen() (XServerListener, error) {
 
 // xserverUnixSocket returns the display's associated unix socket.
 func (d *Display) unixSocket() (*net.UnixAddr, error) {
-	// If hostname is "unix" or empty, then the actual unix socket
-	// for the display is "/tmp/.X11-unix/X<display_number>"
+	// For x11 unix domain sockets, the hostname must be "unix" or empty. In these cases
+	// we return the actual unix socket for the display "/tmp/.X11-unix/X<display_number>"
 	if d.HostName == "unix" || d.HostName == "" {
 		sockName := filepath.Join(x11SockDir(), fmt.Sprintf("X%d", d.DisplayNumber))
 		return net.ResolveUnixAddr("unix", sockName)
 	}
-
-	// It's possible that the display is actually the full path
-	// to an open XServer socket, such as with xquartz on OSX:
-	// "/private/tmp/com.apple.com/launchd.xxx/org.xquartz.com:0"
-	if d.HostName[0] == '/' {
-		sockName := d.String()
-		if _, err := os.Stat(sockName); err == nil {
-			return net.ResolveUnixAddr("unix", sockName)
-		}
-
-		// The socket might not include the screen number.
-		sockName = fmt.Sprintf("%s:%d", d.HostName, d.DisplayNumber)
-		if _, err := os.Stat(sockName); err == nil {
-			return net.ResolveUnixAddr("unix", sockName)
-		}
-	}
-
 	return nil, trace.BadParameter("display is not a unix socket")
 }
 
@@ -148,7 +131,7 @@ func (d *Display) unixSocket() (*net.UnixAddr, error) {
 // e.g. "hostname:<6000+display_number>"
 func (d *Display) tcpSocket() (*net.TCPAddr, error) {
 	if d.HostName == "" {
-		return nil, trace.BadParameter("display is not a tcp socket, hostname can't be empty")
+		return nil, trace.BadParameter("hostname can't be empty for an XServer tcp socket")
 	}
 
 	port := fmt.Sprint(d.DisplayNumber + x11BasePort)
@@ -179,7 +162,6 @@ func GetXDisplay() (Display, error) {
 // display number, and screen number, or a parsing error. display must be
 //in one of the following formats - hostname:d[.s], unix:d[.s], :d[.s], ::d[.s].
 func ParseDisplay(displayString string) (Display, error) {
-
 	if displayString == "" {
 		return Display{}, trace.BadParameter("display cannot be an empty string")
 	}
diff --git a/lib/sshutils/x11/display_test.go b/lib/sshutils/x11/display_test.go
index 0d4bdc0b1d575..d28edb551d64a 100644
--- a/lib/sshutils/x11/display_test.go
+++ b/lib/sshutils/x11/display_test.go
@@ -22,89 +22,139 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestDisplay(t *testing.T) {
+func TestParseDisplay(t *testing.T) {
 	t.Parallel()
 
 	testCases := []struct {
-		desc             string
-		displayString    string
-		expectDisplay    Display
-		expectParseError bool
-		expectUnixAddr   string
-		expectTCPAddr    string
+		desc          string
+		displayString string
+		expectDisplay Display
+		assertErr     require.ErrorAssertionFunc
+		validSocket   string
 	}{
 		{
-			desc:           "unix socket",
-			displayString:  ":10",
-			expectDisplay:  Display{DisplayNumber: 10},
-			expectUnixAddr: filepath.Join(x11SockDir(), "X10"),
-		}, {
-			desc:           "unix socket",
-			displayString:  "::10",
-			expectDisplay:  Display{DisplayNumber: 10},
-			expectUnixAddr: filepath.Join(x11SockDir(), "X10"),
-		}, {
-			desc:           "unix socket",
-			displayString:  "unix:10",
-			expectDisplay:  Display{HostName: "unix", DisplayNumber: 10},
-			expectUnixAddr: filepath.Join(x11SockDir(), "X10"),
-		}, {
-			desc:           "unix socket with screen number",
-			displayString:  "unix:10.1",
-			expectDisplay:  Display{HostName: "unix", DisplayNumber: 10, ScreenNumber: 1},
-			expectUnixAddr: filepath.Join(x11SockDir(), "X10"),
+			desc:          "unix socket",
+			displayString: ":10",
+			expectDisplay: Display{DisplayNumber: 10},
+			assertErr:     require.NoError,
+			validSocket:   "unix",
+		}, {
+			desc:          "unix socket",
+			displayString: "::10",
+			expectDisplay: Display{DisplayNumber: 10},
+			assertErr:     require.NoError,
+			validSocket:   "unix",
+		}, {
+			desc:          "unix socket",
+			displayString: "unix:10",
+			expectDisplay: Display{HostName: "unix", DisplayNumber: 10},
+			assertErr:     require.NoError,
+			validSocket:   "unix",
+		}, {
+			desc:          "unix socket with screen number",
+			displayString: "unix:10.1",
+			expectDisplay: Display{HostName: "unix", DisplayNumber: 10, ScreenNumber: 1},
+			assertErr:     require.NoError,
+			validSocket:   "unix",
 		}, {
 			desc:          "localhost",
 			displayString: "localhost:10",
 			expectDisplay: Display{HostName: "localhost", DisplayNumber: 10},
-			expectTCPAddr: "127.0.0.1:6010",
+			assertErr:     require.NoError,
+			validSocket:   "tcp",
+		}, {
+			desc:          "some hostname",
+			displayString: "example.com:10",
+			expectDisplay: Display{HostName: "example.com", DisplayNumber: 10},
+			assertErr:     require.NoError,
+			validSocket:   "tcp",
 		}, {
 			desc:          "some ip address",
 			displayString: "1.2.3.4:10",
 			expectDisplay: Display{HostName: "1.2.3.4", DisplayNumber: 10},
-			expectTCPAddr: "1.2.3.4:6010",
-		}, {
-			desc:          "invalid ip address",
-			displayString: "1.2.3.4.5:10",
-			expectDisplay: Display{HostName: "1.2.3.4.5", DisplayNumber: 10},
-		}, {
-			desc:             "empty",
-			displayString:    "",
-			expectParseError: true,
+			assertErr:     require.NoError,
+			validSocket:   "tcp",
 		}, {
-			desc:             "no display number",
-			displayString:    ":",
-			expectParseError: true,
+			desc:          "empty",
+			displayString: "",
+			expectDisplay: Display{},
+			assertErr:     require.Error,
 		}, {
-			desc:             "negative display number",
-			displayString:    ":-10",
-			expectParseError: true,
+			desc:          "no display number",
+			displayString: ":",
+			expectDisplay: Display{},
+			assertErr:     require.Error,
 		}, {
-			desc:             "negative screen number",
-			displayString:    ":10.-1",
-			expectParseError: true,
+			desc:          "negative display number",
+			displayString: ":-10",
+			expectDisplay: Display{},
+			assertErr:     require.Error,
 		}, {
-			desc:             "invalid characters",
-			displayString:    "$(exec ls)",
-			expectParseError: true,
+			desc:          "negative screen number",
+			displayString: ":10.-1",
+			expectDisplay: Display{},
+			assertErr:     require.Error,
 		}, {
-			desc:             "invalid unix socket",
-			displayString:    "/some/socket/without/display",
-			expectParseError: true,
+			desc:          "invalid characters",
+			displayString: "$(exec ls)",
+			expectDisplay: Display{},
+			assertErr:     require.Error,
 		},
 	}
 
 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
 			display, err := ParseDisplay(tc.displayString)
-			if tc.expectParseError == true {
-				require.Error(t, err)
-				return
-			}
-			require.NoError(t, err)
+			tc.assertErr(t, err)
 			require.Equal(t, tc.expectDisplay, display)
 
-			unixSock, err := display.unixSocket()
+			switch tc.validSocket {
+			case "unix":
+				_, err := display.unixSocket()
+				require.NoError(t, err)
+			case "tcp":
+				_, err := display.tcpSocket()
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestDisplaySocket(t *testing.T) {
+	testCases := []struct {
+		desc           string
+		display        Display
+		expectUnixAddr string
+		expectTCPAddr  string
+	}{
+		{
+			desc:           "unix socket no hostname",
+			display:        Display{DisplayNumber: 10},
+			expectUnixAddr: filepath.Join(os.TempDir(), ".X11-unix", "X10"),
+		}, {
+			desc:           "unix socket with hostname",
+			display:        Display{HostName: "unix", DisplayNumber: 10},
+			expectUnixAddr: filepath.Join(os.TempDir(), ".X11-unix", "X10"),
+		}, {
+			desc:          "localhost",
+			display:       Display{HostName: "localhost", DisplayNumber: 10},
+			expectTCPAddr: "127.0.0.1:6010",
+		}, {
+			desc:          "some ip address",
+			display:       Display{HostName: "1.2.3.4", DisplayNumber: 10},
+			expectTCPAddr: "1.2.3.4:6010",
+		}, {
+			desc:    "invalid ip address",
+			display: Display{HostName: "1.2.3.4.5", DisplayNumber: 10},
+		}, {
+			desc:    "invalid unix socket",
+			display: Display{HostName: filepath.Join(os.TempDir(), "socket"), DisplayNumber: 10},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			unixSock, err := tc.display.unixSocket()
 			if tc.expectUnixAddr == "" {
 				require.Error(t, err)
 			} else {
@@ -112,7 +162,7 @@ func TestDisplay(t *testing.T) {
 				require.Equal(t, tc.expectUnixAddr, unixSock.String())
 			}
 
-			tcpSock, err := display.tcpSocket()
+			tcpSock, err := tc.display.tcpSocket()
 			if tc.expectTCPAddr == "" {
 				require.Error(t, err)
 			} else {
@@ -121,25 +171,4 @@ func TestDisplay(t *testing.T) {
 			}
 		})
 	}
-
-	// The unix socket full path test requires its associated
-	// unix addr to be discoverable in the file system
-	t.Run("unix socket full path", func(t *testing.T) {
-		tmpDir := os.TempDir()
-		unixSocket := filepath.Join(tmpDir, "org.xquartz.com:0")
-		hostName := filepath.Join(tmpDir, "org.xquartz.com")
-		_, err := os.Create(unixSocket)
-		require.NoError(t, err)
-
-		display, err := ParseDisplay(unixSocket)
-		require.NoError(t, err)
-		require.Equal(t, Display{HostName: hostName, DisplayNumber: 0}, display)
-
-		unixSock, err := display.unixSocket()
-		require.NoError(t, err)
-		require.Equal(t, unixSocket, unixSock.String())
-
-		_, err = display.tcpSocket()
-		require.Error(t, err)
-	})
 }
diff --git a/lib/tlsca/ca.go b/lib/tlsca/ca.go
index ee56515458f50..4d5b215f7870c 100644
--- a/lib/tlsca/ca.go
+++ b/lib/tlsca/ca.go
@@ -29,15 +29,14 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/gravitational/trace"
-	"github.com/jonboulle/clockwork"
-	"github.com/sirupsen/logrus"
-
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/wrappers"
-	"github.com/gravitational/teleport/api/utils"
+
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+	"github.com/sirupsen/logrus"
 )
 
 var log = logrus.WithFields(logrus.Fields{
@@ -773,9 +772,6 @@ func (c *CertificateRequest) CheckAndSetDefaults() error {
 	if c.KeyUsage == 0 {
 		c.KeyUsage = x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature
 	}
-
-	c.DNSNames = utils.Deduplicate(c.DNSNames)
-
 	return nil
 }
 
diff --git a/lib/utils/certs_test.go b/lib/utils/certs_test.go
index c8dfa7d0637c7..4ddaa0f180651 100644
--- a/lib/utils/certs_test.go
+++ b/lib/utils/certs_test.go
@@ -17,7 +17,7 @@ limitations under the License.
 package utils
 
 import (
-	"os"
+	"io/ioutil"
 
 	"github.com/gravitational/trace"
 
@@ -34,7 +34,7 @@ func (s *CertsSuite) TestRejectsInvalidPEMData(c *check.C) {
 }
 
 func (s *CertsSuite) TestRejectsSelfSignedCertificate(c *check.C) {
-	certificateChainBytes, err := os.ReadFile("../../fixtures/certs/ca.pem")
+	certificateChainBytes, err := ioutil.ReadFile("../../fixtures/certs/ca.pem")
 	c.Assert(err, check.IsNil)
 
 	certificateChain, err := ReadCertificateChain(certificateChainBytes)
diff --git a/lib/utils/chconn_test.go b/lib/utils/chconn_test.go
index 6088aeee641ab..180fdd52299b4 100644
--- a/lib/utils/chconn_test.go
+++ b/lib/utils/chconn_test.go
@@ -19,7 +19,7 @@ package utils
 import (
 	"crypto/rand"
 	"crypto/rsa"
-	"io"
+	"io/ioutil"
 	"net"
 	"os"
 	"testing"
@@ -60,7 +60,7 @@ func TestChConn(t *testing.T) {
 		go func() {
 			// Nothing is sent on the channel so this will block until the
 			// read is canceled by the deadline set below.
-			_, err := io.ReadAll(chConn)
+			_, err := ioutil.ReadAll(chConn)
 			doneCh <- err
 		}()
 		// Set the read deadline in the past and make sure that the read
diff --git a/lib/utils/cli.go b/lib/utils/cli.go
index 1b2e685cb7ae8..79362ed1e62eb 100644
--- a/lib/utils/cli.go
+++ b/lib/utils/cli.go
@@ -22,6 +22,7 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"io/ioutil"
 	stdlog "log"
 	"math"
 	"os"
@@ -60,7 +61,7 @@ func InitLogger(purpose LoggingPurpose, level log.Level, verbose ...bool) {
 			log.SetFormatter(NewDefaultTextFormatter(trace.IsTerminal(os.Stderr)))
 			log.SetOutput(os.Stderr)
 		} else {
-			log.SetOutput(io.Discard)
+			log.SetOutput(ioutil.Discard)
 		}
 	case LoggingForDaemon:
 		log.SetFormatter(NewDefaultTextFormatter(trace.IsTerminal(os.Stderr)))
@@ -82,7 +83,7 @@ func InitLoggerForTests() {
 		return
 	}
 	logger.SetLevel(log.WarnLevel)
-	logger.SetOutput(io.Discard)
+	logger.SetOutput(ioutil.Discard)
 }
 
 // NewLoggerForTests creates a new logger for test environment
@@ -250,8 +251,6 @@ func formatCertError(err error) string {
 }
 
 const (
-	// Bold is an escape code to format as bold or increased intensity
-	Bold = 1
 	// Red is an escape code for red terminal color
 	Red = 31
 	// Yellow is an escape code for yellow terminal color
@@ -292,55 +291,7 @@ func InitCLIParser(appName, appHelp string) (app *kingpin.Application) {
 	app.HelpFlag.NoEnvar()
 
 	// set our own help template
-	return app.UsageTemplate(createUsageTemplate())
-}
-
-// createUsageTemplate creates an usage template for kingpin applications.
-func createUsageTemplate(opts ...func(*usageTemplateOptions)) string {
-	opt := &usageTemplateOptions{
-		commandPrintfWidth: defaultCommandPrintfWidth,
-	}
-
-	for _, optFunc := range opts {
-		optFunc(opt)
-	}
-	return fmt.Sprintf(defaultUsageTemplate, opt.commandPrintfWidth)
-}
-
-// UpdateAppUsageTemplate updates usage template for kingpin applications by
-// pre-parsing the arguments then applying any changes to the usage template if
-// necessary.
-func UpdateAppUsageTemplate(app *kingpin.Application, args []string) {
-	// If ParseContext fails, kingpin will not show usage so there is no need
-	// to update anything here. See app.Parse for more details.
-	context, err := app.ParseContext(args)
-	if err != nil {
-		return
-	}
-
-	app.UsageTemplate(createUsageTemplate(
-		withCommandPrintfWidth(app, context),
-	))
-}
-
-// withCommandPrintfWidth returns an usage template option that
-// updates command printf width if longer than default.
-func withCommandPrintfWidth(app *kingpin.Application, context *kingpin.ParseContext) func(*usageTemplateOptions) {
-	return func(opt *usageTemplateOptions) {
-		var commands []*kingpin.CmdModel
-		if context.SelectedCommand != nil {
-			commands = context.SelectedCommand.Model().FlattenedCommands()
-		} else {
-			commands = app.Model().FlattenedCommands()
-		}
-
-		for _, command := range commands {
-			if !command.Hidden && len(command.FullCommand) > opt.commandPrintfWidth {
-				opt.commandPrintfWidth = len(command.FullCommand)
-			}
-		}
-
-	}
+	return app.UsageTemplate(defaultUsageTemplate)
 }
 
 // SplitIdentifiers splits list of identifiers by commas/spaces/newlines.  Helpful when
@@ -428,19 +379,8 @@ func needsQuoting(text string) bool {
 	return false
 }
 
-// usageTemplateOptions defines options to format the usage template.
-type usageTemplateOptions struct {
-	// commandPrintfWidth is the width of the command name with padding, for
-	//   {{.FullCommand | printf "%%-%ds"}}
-	commandPrintfWidth int
-}
-
-// defaultCommandPrintfWidth is the default command printf width.
-const defaultCommandPrintfWidth = 12
-
-// defaultUsageTemplate is a fmt format that defines the usage template with
-// compactly formatted commands. Should be only used in createUsageTemplate.
-const defaultUsageTemplate = `{{define "FormatCommand"}}\
+// Usage template with compactly formatted commands.
+var defaultUsageTemplate = `{{define "FormatCommand"}}\
 {{if .FlagSummary}} {{.FlagSummary}}{{end}}\
 {{range .Args}} {{if not .Required}}[{{end}}<{{.Name}}>{{if .Value|IsCumulative}}...{{end}}{{if not .Required}}]{{end}}{{end}}\
 {{end}}\
@@ -448,7 +388,7 @@ const defaultUsageTemplate = `{{define "FormatCommand"}}\
 {{define "FormatCommands"}}\
 {{range .FlattenedCommands}}\
 {{if not .Hidden}}\
-  {{.FullCommand | printf "%%-%ds"}}{{if .Default}} (Default){{end}} {{ .Help }}
+  {{.FullCommand | printf "%-12s" }}{{if .Default}} (Default){{end}} {{ .Help }}
 {{end}}\
 {{end}}\
 {{end}}\
diff --git a/lib/utils/cli_test.go b/lib/utils/cli_test.go
index 9985aa60be042..0be2fb4c0edcc 100644
--- a/lib/utils/cli_test.go
+++ b/lib/utils/cli_test.go
@@ -19,7 +19,7 @@ package utils
 import (
 	"crypto/x509"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"strings"
 	"testing"
 
@@ -64,7 +64,7 @@ func TestUserMessageFromError(t *testing.T) {
 func TestConsolefLongComponent(t *testing.T) {
 	require.NotPanics(t, func() {
 		component := strings.Repeat("na ", 10) + "batman!"
-		Consolef(io.Discard, logrus.New(), component, "test message")
+		Consolef(ioutil.Discard, logrus.New(), component, "test message")
 	})
 }
 
diff --git a/lib/utils/conn.go b/lib/utils/conn.go
index 07a47b759eff7..c43aac61d44c4 100644
--- a/lib/utils/conn.go
+++ b/lib/utils/conn.go
@@ -21,6 +21,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"sync/atomic"
@@ -99,7 +100,7 @@ func RoundtripWithConn(conn net.Conn) (string, error) {
 		return "", err
 	}
 	defer re.Body.Close()
-	out, err := io.ReadAll(re.Body)
+	out, err := ioutil.ReadAll(re.Body)
 	if err != nil {
 		return "", err
 	}
diff --git a/lib/utils/environment_test.go b/lib/utils/environment_test.go
index 5b5e335a48dde..e7d7409dd3a0a 100644
--- a/lib/utils/environment_test.go
+++ b/lib/utils/environment_test.go
@@ -16,6 +16,7 @@ limitations under the License.
 package utils
 
 import (
+	"io/ioutil"
 	"os"
 
 	"gopkg.in/check.v1"
@@ -39,7 +40,7 @@ foo=
 `)
 
 	// create a temp file with an environment in it
-	f, err := os.CreateTemp("", "teleport-environment-")
+	f, err := ioutil.TempFile("", "teleport-environment-")
 	c.Assert(err, check.IsNil)
 	defer os.Remove(f.Name())
 	_, err = f.Write(rawenv)
diff --git a/lib/utils/jsontools_test.go b/lib/utils/jsontools_test.go
index 8b55ffe814c31..c4389e51f1011 100644
--- a/lib/utils/jsontools_test.go
+++ b/lib/utils/jsontools_test.go
@@ -19,7 +19,6 @@ import (
 	"bytes"
 	"testing"
 
-	"github.com/gravitational/teleport/api/types"
 	"github.com/stretchr/testify/require"
 )
 
@@ -29,8 +28,8 @@ import (
 // operations that depend on the byte ordering fail (e.g. CompareAndSwap).
 func TestMarshalMapConsistency(t *testing.T) {
 	value := map[string]string{
-		types.TeleportNamespace + "/foo": "1234",
-		types.TeleportNamespace + "/bar": "5678",
+		"teleport.dev/foo": "1234",
+		"teleport.dev/bar": "5678",
 	}
 
 	compareTo, err := FastMarshal(value)
diff --git a/lib/utils/kernel.go b/lib/utils/kernel.go
index 9f4d88103cfd1..f687301cb752f 100644
--- a/lib/utils/kernel.go
+++ b/lib/utils/kernel.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"runtime"
 	"strings"
@@ -54,7 +55,7 @@ func KernelVersion() (*semver.Version, error) {
 // kernelVersion reads in the kernel version from the reader and returns
 // a *semver.Version.
 func kernelVersion(reader io.Reader) (*semver.Version, error) {
-	buf, err := io.ReadAll(reader)
+	buf, err := ioutil.ReadAll(reader)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/utils/prompt/confirmation.go b/lib/utils/prompt/confirmation.go
index 82ff796a812f1..1710f67ccb308 100644
--- a/lib/utils/prompt/confirmation.go
+++ b/lib/utils/prompt/confirmation.go
@@ -26,20 +26,13 @@ import (
 	"github.com/gravitational/trace"
 )
 
-// Reader is the interface for prompt readers.
-type Reader interface {
-	// ReadContext reads from the underlying buffer, respecting context
-	// cancellation.
-	ReadContext(ctx context.Context) ([]byte, error)
-}
-
 // Confirmation prompts the user for a yes/no confirmation for question.
 // The prompt is written to out and the answer is read from in.
 //
 // question should be a plain sentece without "[yes/no]"-type hints at the end.
 //
 // ctx can be canceled to abort the prompt.
-func Confirmation(ctx context.Context, out io.Writer, in Reader, question string) (bool, error) {
+func Confirmation(ctx context.Context, out io.Writer, in *ContextReader, question string) (bool, error) {
 	fmt.Fprintf(out, "%s [y/N]: ", question)
 	answer, err := in.ReadContext(ctx)
 	if err != nil {
@@ -59,7 +52,7 @@ func Confirmation(ctx context.Context, out io.Writer, in Reader, question string
 // question should be a plain sentece without the list of provided options.
 //
 // ctx can be canceled to abort the prompt.
-func PickOne(ctx context.Context, out io.Writer, in Reader, question string, options []string) (string, error) {
+func PickOne(ctx context.Context, out io.Writer, in *ContextReader, question string, options []string) (string, error) {
 	fmt.Fprintf(out, "%s [%s]: ", question, strings.Join(options, ", "))
 	answerOrig, err := in.ReadContext(ctx)
 	if err != nil {
@@ -79,7 +72,7 @@ func PickOne(ctx context.Context, out io.Writer, in Reader, question string, opt
 // The prompt is written to out and the answer is read from in.
 //
 // ctx can be canceled to abort the prompt.
-func Input(ctx context.Context, out io.Writer, in Reader, question string) (string, error) {
+func Input(ctx context.Context, out io.Writer, in *ContextReader, question string) (string, error) {
 	fmt.Fprintf(out, "%s: ", question)
 	answer, err := in.ReadContext(ctx)
 	if err != nil {
diff --git a/lib/utils/prompt/sync_reader.go b/lib/utils/prompt/sync_reader.go
deleted file mode 100644
index a175ec2cc4908..0000000000000
--- a/lib/utils/prompt/sync_reader.go
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package prompt
-
-import (
-	"context"
-	"io"
-	"os"
-
-	"github.com/gravitational/trace"
-)
-
-// StdinSync returns a synchronous reader to os.Stdin.
-// It is safe for use mixed with other methods that read Stdin, albeit not
-// concurrently, but doesn't respect context cancelletion.
-func StdinSync() *SyncReader {
-	return &SyncReader{Reader: os.Stdin}
-}
-
-// SyncReader is a synchronous version of ContextReader.
-// Its main advantage is that it allows multiple sources to read from the same
-// underlying reader, albeit not concurrently.
-type SyncReader struct {
-	Reader io.Reader
-}
-
-// ReadContext reads a chunk from the underlying reader.
-// It does not respect context cancellation after the read starts.
-func (c *SyncReader) ReadContext(ctx context.Context) ([]byte, error) {
-	select {
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	default:
-	}
-
-	buf := make([]byte, 4*1024) // 4kB, matches Linux page size.
-	n, err := c.Reader.Read(buf)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-	buf = buf[:n]
-	return buf, nil
-}
diff --git a/lib/utils/prompt/sync_reader_test.go b/lib/utils/prompt/sync_reader_test.go
deleted file mode 100644
index 1038e8011141e..0000000000000
--- a/lib/utils/prompt/sync_reader_test.go
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright 2022 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package prompt_test
-
-import (
-	"bytes"
-	"context"
-	"testing"
-
-	"github.com/gravitational/teleport/lib/utils/prompt"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSyncReader_ReadContext(t *testing.T) {
-	ctx := context.Background()
-	data := []byte("who let the llamas out?")
-
-	cancelledCtx, cancel := context.WithCancel(ctx)
-	cancel()
-
-	tests := []struct {
-		name     string
-		data     []byte
-		ctx      context.Context
-		wantData []byte
-		wantErr  error
-	}{
-		{
-			name:     "ok",
-			data:     data,
-			ctx:      ctx,
-			wantData: data,
-		},
-		{
-			name:    "ctx cancelled",
-			data:    data,
-			ctx:     cancelledCtx,
-			wantErr: cancelledCtx.Err(),
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			r := &prompt.SyncReader{
-				Reader: bytes.NewReader(test.data),
-			}
-			got, err := r.ReadContext(test.ctx)
-			require.Equal(t, test.wantErr, err, "ReadContext error mismatch")
-			if err != nil {
-				return
-			}
-			require.Equal(t, test.wantData, got, "ReadContext data mismatch")
-		})
-	}
-}
diff --git a/lib/utils/syslog.go b/lib/utils/syslog.go
index 37630dd6b5ea5..9037d432821ab 100644
--- a/lib/utils/syslog.go
+++ b/lib/utils/syslog.go
@@ -20,7 +20,7 @@ limitations under the License.
 package utils
 
 import (
-	"io"
+	"io/ioutil"
 	"log/syslog"
 	"os"
 
@@ -46,6 +46,6 @@ func SwitchLoggerToSyslog(logger *log.Logger) error {
 	}
 	logger.AddHook(hook)
 	// ... and disable stderr:
-	logger.SetOutput(io.Discard)
+	logger.SetOutput(ioutil.Discard)
 	return nil
 }
diff --git a/lib/utils/timeout_test.go b/lib/utils/timeout_test.go
index 7bd9cac3e3e40..fe113899409dd 100644
--- a/lib/utils/timeout_test.go
+++ b/lib/utils/timeout_test.go
@@ -20,7 +20,7 @@ package utils
 import (
 	"context"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -95,7 +95,7 @@ func newClient(timeout time.Duration) *http.Client {
 
 // bodyText helper returns a body string from an http response
 func bodyText(resp *http.Response) string {
-	bytes, err := io.ReadAll(resp.Body)
+	bytes, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return ""
 	}
diff --git a/lib/utils/token.go b/lib/utils/token.go
index b417f9d23e52e..a2b8ba14012b9 100644
--- a/lib/utils/token.go
+++ b/lib/utils/token.go
@@ -17,7 +17,7 @@ limitations under the License.
 package utils
 
 import (
-	"os"
+	"io/ioutil"
 	"strings"
 
 	"github.com/gravitational/trace"
@@ -31,7 +31,7 @@ func ReadToken(token string) (string, error) {
 		return token, nil
 	}
 	// treat it as a file
-	out, err := os.ReadFile(token)
+	out, err := ioutil.ReadFile(token)
 	if err != nil {
 		return "", trace.ConvertSystemError(err)
 	}
diff --git a/lib/utils/utils.go b/lib/utils/utils.go
index 96893ee62935e..ee32b0bbc125c 100644
--- a/lib/utils/utils.go
+++ b/lib/utils/utils.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -322,7 +323,7 @@ func ReadPath(path string) ([]byte, error) {
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
-	bytes, err := os.ReadFile(abs)
+	bytes, err := ioutil.ReadFile(abs)
 	if err != nil {
 		return nil, trace.ConvertSystemError(err)
 	}
@@ -436,7 +437,7 @@ func ReadHostUUID(dataDir string) (string, error) {
 
 // WriteHostUUID writes host UUID into a file
 func WriteHostUUID(dataDir string, id string) error {
-	err := os.WriteFile(filepath.Join(dataDir, HostUUIDFile), []byte(id), os.ModeExclusive|0400)
+	err := ioutil.WriteFile(filepath.Join(dataDir, HostUUIDFile), []byte(id), os.ModeExclusive|0400)
 	if err != nil {
 		return trace.ConvertSystemError(err)
 	}
@@ -560,7 +561,7 @@ func StoreErrorOf(f func() error, err *error) {
 // when limit bytes are read.
 func ReadAtMost(r io.Reader, limit int64) ([]byte, error) {
 	limitedReader := &io.LimitedReader{R: r, N: limit}
-	data, err := io.ReadAll(limitedReader)
+	data, err := ioutil.ReadAll(limitedReader)
 	if err != nil {
 		return data, err
 	}
diff --git a/lib/utils/utils_test.go b/lib/utils/utils_test.go
index fc2faf7f8c2a6..a27933b315e26 100644
--- a/lib/utils/utils_test.go
+++ b/lib/utils/utils_test.go
@@ -18,7 +18,7 @@ package utils
 
 import (
 	"bytes"
-	"io"
+	"io/ioutil"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -104,7 +104,7 @@ func (s *UtilsSuite) TestHostUUID(c *check.C) {
 	// newlines are getting ignored
 	dir = c.MkDir()
 	id := "id-with-newline\n"
-	err = os.WriteFile(filepath.Join(dir, HostUUIDFile), []byte(id), 0666)
+	err = ioutil.WriteFile(filepath.Join(dir, HostUUIDFile), []byte(id), 0666)
 	c.Assert(err, check.IsNil)
 	out, err := ReadHostUUID(dir)
 	c.Assert(err, check.IsNil)
@@ -502,7 +502,7 @@ func (s *UtilsSuite) TestReadToken(c *check.C) {
 
 	dir := c.MkDir()
 	tokenPath := filepath.Join(dir, "token")
-	err = os.WriteFile(tokenPath, []byte("shmoken"), 0644)
+	err = ioutil.WriteFile(tokenPath, []byte("shmoken"), 0644)
 	c.Assert(err, check.IsNil)
 
 	tok, err = ReadToken(tokenPath)
@@ -542,7 +542,7 @@ func (s *UtilsSuite) TestRepeatReader(c *check.C) {
 		},
 	}
 	for _, tc := range tcs {
-		data, err := io.ReadAll(NewRepeatReader(tc.repeat, tc.count))
+		data, err := ioutil.ReadAll(NewRepeatReader(tc.repeat, tc.count))
 		c.Assert(err, check.IsNil)
 		c.Assert(string(data), check.Equals, tc.expected)
 	}
diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
index ff8cad79f1225..7652d11ca481d 100644
--- a/lib/web/apiserver.go
+++ b/lib/web/apiserver.go
@@ -26,6 +26,7 @@ import (
 	"fmt"
 	"html/template"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -34,7 +35,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/gravitational/oxy/ratelimit"
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/client/webclient"
@@ -51,7 +51,6 @@ import (
 	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/httplib/csrf"
 	"github.com/gravitational/teleport/lib/jwt"
-	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/plugin"
 	"github.com/gravitational/teleport/lib/reversetunnel"
 	"github.com/gravitational/teleport/lib/secret"
@@ -261,23 +260,6 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 	}
 	h.sshPort = sshPort
 
-	// challengeLimiter is used to limit unauthenticated challenge generation for
-	// passwordless.
-	challengeLimiter, err := limiter.NewRateLimiter(limiter.Config{
-		Rates: []limiter.Rate{
-			{
-				Period:  defaults.LimiterPasswordlessPeriod,
-				Average: defaults.LimiterPasswordlessAverage,
-				Burst:   defaults.LimiterPasswordlessBurst,
-			},
-		},
-		MaxConnections:   defaults.LimiterMaxConnections,
-		MaxNumberOfUsers: defaults.LimiterMaxConcurrentUsers,
-	})
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	// ping endpoint is used to check if the server is up. the /webapi/ping
 	// endpoint returns the default authentication method and configuration that
 	// the server supports. the /webapi/ping/:connector endpoint can be used to
@@ -350,13 +332,8 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 	h.GET("/webapi/sites/:site/nodes/:server/:login/scp", h.WithClusterAuth(h.transferFile))
 	h.POST("/webapi/sites/:site/nodes/:server/:login/scp", h.WithClusterAuth(h.transferFile))
 
-	// token generation
-	h.POST("/webapi/token", h.WithAuth(h.createTokenHandle))
-
 	// add Node token generation
-	// DELETE IN 11.0. Deprecated, use /webapi/token for generating tokens of any role.
-	h.POST("/webapi/nodes/token", h.WithAuth(h.createNodeTokenHandle))
-	// join scripts
+	h.POST("/webapi/nodes/token", h.WithAuth(h.createScriptJoinTokenHandle))
 	h.GET("/scripts/:token/install-node.sh", httplib.MakeHandler(h.getNodeJoinScriptHandle))
 	h.GET("/scripts/:token/install-app.sh", httplib.MakeHandler(h.getAppJoinScriptHandle))
 	// web context
@@ -384,7 +361,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 	h.POST("/webapi/github/login/console", httplib.MakeHandler(h.githubLoginConsole))
 
 	// MFA public endpoints.
-	h.POST("/webapi/mfa/login/begin", h.withLimiter(challengeLimiter, h.mfaLoginBegin))
+	h.POST("/webapi/mfa/login/begin", httplib.MakeHandler(h.mfaLoginBegin))
 	h.POST("/webapi/mfa/login/finish", httplib.MakeHandler(h.mfaLoginFinish))
 	h.POST("/webapi/mfa/login/finishsession", httplib.MakeHandler(h.mfaLoginFinishSession))
 	h.DELETE("/webapi/mfa/token/:token/devices/:devicename", httplib.MakeHandler(h.deleteMFADeviceWithTokenHandle))
@@ -442,7 +419,7 @@ func NewHandler(cfg Config, opts ...HandlerOption) (*APIHandler, error) {
 			return nil, trace.Wrap(err)
 		}
 		defer index.Close()
-		indexContent, err := io.ReadAll(index)
+		indexContent, err := ioutil.ReadAll(index)
 		if err != nil {
 			return nil, trace.ConvertSystemError(err)
 		}
@@ -762,6 +739,7 @@ func defaultAuthenticationSettings(ctx context.Context, authClient auth.ClientI)
 
 func (h *Handler) ping(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
 	var err error
+
 	defaultSettings, err := defaultAuthenticationSettings(r.Context(), h.cfg.ProxyClient)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -810,13 +788,12 @@ func (h *Handler) pingWithConnector(w http.ResponseWriter, r *http.Request, p ht
 		ServerVersion: teleport.Version,
 	}
 
-	hasMessageOfTheDay := cap.GetMessageOfTheDay() != ""
 	if connectorName == constants.Local {
-		response.Auth, err = localSettings(cap)
+		as, err := localSettings(cap)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		response.Auth.HasMessageOfTheDay = hasMessageOfTheDay
+		response.Auth = as
 		return response, nil
 	}
 
@@ -824,7 +801,6 @@ func (h *Handler) pingWithConnector(w http.ResponseWriter, r *http.Request, p ht
 	oidcConnector, err := authClient.GetOIDCConnector(r.Context(), connectorName, false)
 	if err == nil {
 		response.Auth = oidcSettings(oidcConnector, cap)
-		response.Auth.HasMessageOfTheDay = hasMessageOfTheDay
 		return response, nil
 	}
 
@@ -832,7 +808,6 @@ func (h *Handler) pingWithConnector(w http.ResponseWriter, r *http.Request, p ht
 	samlConnector, err := authClient.GetSAMLConnector(r.Context(), connectorName, false)
 	if err == nil {
 		response.Auth = samlSettings(samlConnector, cap)
-		response.Auth.HasMessageOfTheDay = hasMessageOfTheDay
 		return response, nil
 	}
 
@@ -840,7 +815,6 @@ func (h *Handler) pingWithConnector(w http.ResponseWriter, r *http.Request, p ht
 	githubConnector, err := authClient.GetGithubConnector(r.Context(), connectorName, false)
 	if err == nil {
 		response.Auth = githubSettings(githubConnector, cap)
-		response.Auth.HasMessageOfTheDay = hasMessageOfTheDay
 		return response, nil
 	}
 
@@ -972,7 +946,7 @@ func (h *Handler) jwks(w http.ResponseWriter, r *http.Request, p httprouter.Para
 	}
 
 	// Fetch the JWT public keys only.
-	ca, err := h.cfg.ProxyClient.GetCertAuthority(r.Context(), types.CertAuthID{
+	ca, err := h.cfg.ProxyClient.GetCertAuthority(types.CertAuthID{
 		Type:       types.JWTSigner,
 		DomainName: clusterName,
 	}, false)
@@ -1659,39 +1633,27 @@ func (h *Handler) getResetPasswordToken(ctx context.Context, tokenID string) (in
 }
 
 // mfaLoginBegin is the first step in the MFA authentication ceremony, which
-// may be completed either via mfaLoginFinish (SSH) or mfaLoginFinishSession
-// (Web).
+// may be completed either via mfaLoginFinish (SSH) or mfaLoginFinishSession (Web).
 //
 // POST /webapi/mfa/login/begin
 //
 // {"user": "alex", "pass": "abc123"}
-// {"passwordless": true}
 //
 // Successful response:
 //
 // {"webauthn_challenge": {...}, "totp_challenge": true}
-// {"webauthn_challenge": {...}} // passwordless
 func (h *Handler) mfaLoginBegin(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
 	var req *client.MFAChallengeRequest
 	if err := httplib.ReadJSON(r, &req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	mfaReq := &proto.CreateAuthenticateChallengeRequest{}
-	if req.Passwordless {
-		mfaReq.Request = &proto.CreateAuthenticateChallengeRequest_Passwordless{
-			Passwordless: &proto.Passwordless{},
-		}
-	} else {
-		mfaReq.Request = &proto.CreateAuthenticateChallengeRequest_UserCredentials{
-			UserCredentials: &proto.UserCredentials{
-				Username: req.User,
-				Password: []byte(req.Pass),
-			},
-		}
-	}
-
-	mfaChallenge, err := h.auth.proxyClient.CreateAuthenticateChallenge(r.Context(), mfaReq)
+	mfaChallenge, err := h.auth.proxyClient.CreateAuthenticateChallenge(r.Context(), &proto.CreateAuthenticateChallengeRequest{
+		Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{UserCredentials: &proto.UserCredentials{
+			Username: req.User,
+			Password: []byte(req.Pass),
+		}},
+	})
 	if err != nil {
 		return nil, trace.AccessDenied("bad auth credentials")
 	}
@@ -1742,14 +1704,10 @@ func (h *Handler) mfaLoginFinishSession(w http.ResponseWriter, r *http.Request,
 	if err != nil {
 		return nil, trace.AccessDenied("bad auth credentials")
 	}
-
-	// Fetch user from session, user is empty for passwordless requests.
-	user := session.GetUser()
-	if err := SetSessionCookie(w, user, session.GetName()); err != nil {
+	if err := SetSessionCookie(w, req.User, session.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
-
-	ctx, err := h.auth.newSessionContext(user, session.GetName())
+	ctx, err := h.auth.newSessionContext(req.User, session.GetName())
 	if err != nil {
 		return nil, trace.AccessDenied("need auth")
 	}
@@ -2346,7 +2304,10 @@ func (h *Handler) hostCredentials(w http.ResponseWriter, r *http.Request, p http
 		return nil, trace.Wrap(err)
 	}
 
-	return certs, nil
+	// Teleport 8 clients are still expecting the legacy JSON format.
+	// Teleport 9 clients handle both legacy and new.
+	// TODO(zmb3) return certs directly in Teleport 10
+	return auth.LegacyCertsFromProto(certs), nil
 }
 
 // createSSHCert is a web call that generates new SSH certificate based
@@ -2538,21 +2499,6 @@ func (h *Handler) WithAuth(fn ContextHandler) httprouter.Handle {
 	})
 }
 
-// withLimiter adds IP-based rate limiting to fn.
-func (h *Handler) withLimiter(l *limiter.RateLimiter, fn httplib.HandlerFunc) httprouter.Handle {
-	return httplib.MakeHandler(func(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
-		err := l.RegisterRequest(r.RemoteAddr, nil /* customRate */)
-		// MaxRateError doesn't play well with errors.Is, hence the cast.
-		if _, ok := err.(*ratelimit.MaxRateError); ok {
-			return nil, trace.LimitExceeded(err.Error())
-		}
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-		return fn(w, r, p)
-	})
-}
-
 // AuthenticateRequest authenticates request using combination of a session cookie
 // and bearer token
 func (h *Handler) AuthenticateRequest(w http.ResponseWriter, r *http.Request, checkBearerToken bool) (*SessionContext, error) {
diff --git a/lib/web/apiserver_login_test.go b/lib/web/apiserver_login_test.go
index 1857d66548221..045d252d63320 100644
--- a/lib/web/apiserver_login_test.go
+++ b/lib/web/apiserver_login_test.go
@@ -29,12 +29,8 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
-
-	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
 )
 
 func TestWebauthnLogin_ssh(t *testing.T) {
@@ -45,6 +41,7 @@ func TestWebauthnLogin_ssh(t *testing.T) {
 		Webauthn: &types.Webauthn{
 			RPID: env.server.TLS.ClusterName(),
 		},
+		// Use default Webauthn configuration.
 	})
 	user := clusterMFA.User
 	password := clusterMFA.Password
@@ -100,6 +97,7 @@ func TestWebauthnLogin_web(t *testing.T) {
 		Webauthn: &types.Webauthn{
 			RPID: env.server.TLS.ClusterName(),
 		},
+		// Use default Webauthn configuration.
 	})
 	user := clusterMFA.User
 	password := clusterMFA.Password
@@ -138,139 +136,6 @@ func TestWebauthnLogin_web(t *testing.T) {
 	require.NotEmpty(t, createSessionResp.SessionExpires.Unix())
 }
 
-func TestAuthenticate_passwordless(t *testing.T) {
-	env := newWebPack(t, 1)
-	clusterMFA := configureClusterForMFA(t, env, &types.AuthPreferenceSpecV2{
-		Type:         constants.Local,
-		SecondFactor: constants.SecondFactorOn,
-		Webauthn: &types.Webauthn{
-			RPID: env.server.TLS.ClusterName(),
-		},
-	})
-	user := clusterMFA.User
-	device := clusterMFA.WebDev.Key
-
-	// Fake a passwordless device. Typically this would require a separate
-	// registration, but because we use fake devices we can get away with it.
-	device.SetPasswordless()
-
-	// Fetch the WebAuthn User Handle. In a real-world scenario the device stores
-	// the handle alongside the credentials during registration.
-	ctx := context.Background()
-	authServer := env.server.Auth()
-	wla, err := authServer.GetWebauthnLocalAuth(ctx, user)
-	require.NoError(t, err)
-	userHandle := wla.UserID
-
-	// Prepare SSH key to be signed.
-	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	require.NoError(t, err)
-	pub, err := ssh.NewPublicKey(&priv.PublicKey)
-	require.NoError(t, err)
-	pubBytes := ssh.MarshalAuthorizedKey(pub)
-
-	clt, err := client.NewWebClient(env.proxies[0].webURL.String(), roundtrip.HTTPClient(client.NewInsecureWebClient()))
-	require.NoError(t, err)
-
-	tests := []struct {
-		name  string
-		login func(t *testing.T, assertionResp *wanlib.CredentialAssertionResponse)
-	}{
-		{
-			name: "ssh",
-			login: func(t *testing.T, assertionResp *wanlib.CredentialAssertionResponse) {
-				ep := clt.Endpoint("webapi", "mfa", "login", "finish")
-				sshResp, err := clt.PostJSON(ctx, ep, &client.AuthenticateSSHUserRequest{
-					WebauthnChallengeResponse: assertionResp, // no username
-					PubKey:                    pubBytes,
-					TTL:                       24 * time.Hour,
-				})
-				require.NoError(t, err, "Passwordless authentication failed")
-				loginResp := &auth.SSHLoginResponse{}
-				require.NoError(t, json.Unmarshal(sshResp.Bytes(), loginResp))
-				require.Equal(t, user, loginResp.Username)
-			},
-		},
-		{
-			name: "web",
-			login: func(t *testing.T, assertionResp *wanlib.CredentialAssertionResponse) {
-				ep := clt.Endpoint("webapi", "mfa", "login", "finishsession")
-				sessionResp, err := clt.PostJSON(ctx, ep, &client.AuthenticateWebUserRequest{
-					WebauthnAssertionResponse: assertionResp, // no username
-				})
-				require.NoError(t, err, "Passwordless authentication failed")
-				createSessionResp := &CreateSessionResponse{}
-				require.NoError(t, json.Unmarshal(sessionResp.Bytes(), createSessionResp))
-				require.NotEmpty(t, createSessionResp.TokenType)
-				require.NotEmpty(t, createSessionResp.Token)
-				require.NotEmpty(t, createSessionResp.TokenExpiresIn)
-				require.NotEmpty(t, createSessionResp.SessionExpires.Unix())
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			// Request passwordless challenge.
-			ep := clt.Endpoint("webapi", "mfa", "login", "begin")
-			beginResp, err := clt.PostJSON(ctx, ep, &client.MFAChallengeRequest{
-				Passwordless: true, // no username and password
-			})
-			require.NoError(t, err, "Failed to create passwordless challenge")
-			mfaChallenge := &client.MFAAuthenticateChallenge{}
-			require.NoError(t, json.Unmarshal(beginResp.Bytes(), mfaChallenge))
-			require.NotNil(t, mfaChallenge.WebauthnChallenge, "Want non-nil WebAuthn challenge")
-
-			// Sign challenge and set user handle.
-			origin := "https://" + env.server.TLS.ClusterName()
-			assertionResp, err := device.SignAssertion(origin, mfaChallenge.WebauthnChallenge)
-			require.NoError(t, err)
-			assertionResp.AssertionResponse.UserHandle = userHandle
-
-			// Complete passwordless login.
-			test.login(t, assertionResp)
-		})
-	}
-}
-
-func TestAuthenticate_rateLimiting(t *testing.T) {
-	ctx := context.Background()
-
-	tests := []struct {
-		name  string
-		burst int
-		fn    func(clt *client.WebClient) error
-	}{
-		{
-			name:  "/webapi/mfa/login/begin",
-			burst: defaults.LimiterPasswordlessBurst,
-			fn: func(clt *client.WebClient) error {
-				ep := clt.Endpoint("webapi", "mfa", "login", "begin")
-				_, err := clt.PostJSON(ctx, ep, &client.MFAChallengeRequest{})
-				return err
-			},
-		},
-	}
-	for _, test := range tests {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			// Use a separate webPack per test, so limits won't influence one another.
-			env := newWebPack(t, 1)
-			clt, err := client.NewWebClient(env.proxies[0].webURL.String(), roundtrip.HTTPClient(client.NewInsecureWebClient()))
-			require.NoError(t, err)
-
-			for i := 0; i < test.burst; i++ {
-				err := test.fn(clt)
-				require.False(t, trace.IsLimitExceeded(err), "got err = %v, want non-LimitExceeded", err)
-			}
-
-			err = test.fn(clt)
-			require.True(t, trace.IsLimitExceeded(err), "got err = %v, want LimitExceeded", err)
-		})
-	}
-}
-
 type configureMFAResp struct {
 	User, Password string
 	WebDev         *auth.TestDevice
diff --git a/lib/web/apiserver_test.go b/lib/web/apiserver_test.go
index 7c8089b67054c..db8a00ee70065 100644
--- a/lib/web/apiserver_test.go
+++ b/lib/web/apiserver_test.go
@@ -29,6 +29,7 @@ import (
 	"fmt"
 	"image"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/cookiejar"
@@ -516,7 +517,7 @@ func (s *WebSuite) TestSAMLSuccess(c *C) {
 	err = services.ValidateSAMLConnector(connector)
 	c.Assert(err, IsNil)
 
-	role, err := types.NewRoleV3(connector.GetAttributesToRoles()[0].Roles[0], types.RoleSpecV5{
+	role, err := types.NewRole(connector.GetAttributesToRoles()[0].Roles[0], types.RoleSpecV5{
 		Options: types.RoleOptions{
 			MaxSessionTTL: types.NewDuration(apidefaults.MaxCertDuration),
 		},
@@ -558,7 +559,7 @@ func (s *WebSuite) TestSAMLSuccess(c *C) {
 	c.Assert(u.Scheme+"://"+u.Host+u.Path, Equals, fixtures.SAMLOktaSSO)
 	data, err := base64.StdEncoding.DecodeString(u.Query().Get("SAMLRequest"))
 	c.Assert(err, IsNil)
-	buf, err := io.ReadAll(flate.NewReader(bytes.NewReader(data)))
+	buf, err := ioutil.ReadAll(flate.NewReader(bytes.NewReader(data)))
 	c.Assert(err, IsNil)
 	doc := etree.NewDocument()
 	err = doc.ReadFromBytes(buf)
@@ -1162,7 +1163,7 @@ func mustStartWindowsDesktopMock(t *testing.T, authClient *auth.Server) *windows
 	tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
 	require.NoError(t, err)
 
-	ca, err := authClient.GetCertAuthority(context.Background(), types.CertAuthID{Type: types.UserCA, DomainName: n.GetClusterName()}, false)
+	ca, err := authClient.GetCertAuthority(types.CertAuthID{Type: types.UserCA, DomainName: n.GetClusterName()}, false)
 	require.NoError(t, err)
 
 	for _, kp := range services.GetTLSCerts(ca) {
@@ -1959,70 +1960,6 @@ func (s *WebSuite) TestGetClusterDetails(c *C) {
 	c.Assert(nodes, HasLen, cluster.NodeCount)
 }
 
-func TestTokenGeneration(t *testing.T) {
-	tt := []struct {
-		name      string
-		roles     types.SystemRoles
-		shouldErr bool
-	}{
-		{
-			name:      "single node role",
-			roles:     types.SystemRoles{types.RoleNode},
-			shouldErr: false,
-		},
-		{
-			name:      "single app role",
-			roles:     types.SystemRoles{types.RoleApp},
-			shouldErr: false,
-		},
-		{
-			name:      "single db role",
-			roles:     types.SystemRoles{types.RoleDatabase},
-			shouldErr: false,
-		},
-		{
-			name:      "multiple roles",
-			roles:     types.SystemRoles{types.RoleNode, types.RoleApp, types.RoleDatabase},
-			shouldErr: false,
-		},
-		{
-			name:      "return error if no role is requested",
-			roles:     types.SystemRoles{},
-			shouldErr: true,
-		},
-	}
-
-	for _, tc := range tt {
-		t.Run(tc.name, func(t *testing.T) {
-			env := newWebPack(t, 1)
-
-			proxy := env.proxies[0]
-			pack := proxy.authPack(t, "test-user@example.com")
-
-			endpoint := pack.clt.Endpoint("webapi", "token")
-			re, err := pack.clt.PostJSON(context.Background(), endpoint, createTokenRequest{
-				Roles: tc.roles,
-			})
-
-			if tc.shouldErr {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-
-			var responseToken nodeJoinToken
-			err = json.Unmarshal(re.Bytes(), &responseToken)
-			require.NoError(t, err)
-
-			// generated token roles should match the requested ones
-			generatedToken, err := proxy.auth.Auth().GetToken(context.Background(), responseToken.ID)
-			require.NoError(t, err)
-			require.Equal(t, tc.roles, generatedToken.GetRoles())
-		})
-	}
-}
-
 func TestClusterDatabasesGet(t *testing.T) {
 	env := newWebPack(t, 1)
 
@@ -2461,55 +2398,37 @@ func TestCreateRegisterChallenge(t *testing.T) {
 	require.NoError(t, err)
 
 	tests := []struct {
-		name            string
-		req             *createRegisterChallengeRequest
-		assertChallenge func(t *testing.T, c *client.MFARegisterChallenge)
+		name       string
+		deviceType string
 	}{
 		{
-			name: "totp",
-			req: &createRegisterChallengeRequest{
-				DeviceType: "totp",
-			},
+			name:       "totp challenge",
+			deviceType: "totp",
 		},
 		{
-			name: "webauthn",
-			req: &createRegisterChallengeRequest{
-				DeviceType: "webauthn",
-			},
-		},
-		{
-			name: "passwordless",
-			req: &createRegisterChallengeRequest{
-				DeviceType:  "webauthn",
-				DeviceUsage: "passwordless",
-			},
-			assertChallenge: func(t *testing.T, c *client.MFARegisterChallenge) {
-				// rrk=true is a good proxy for passwordless.
-				require.NotNil(t, c.Webauthn.Response.AuthenticatorSelection.RequireResidentKey, "rrk cannot be nil")
-				require.True(t, *c.Webauthn.Response.AuthenticatorSelection.RequireResidentKey, "rrk cannot be false")
-			},
+			name:       "webauthn challenge",
+			deviceType: "webauthn",
 		},
 	}
+
 	for _, tc := range tests {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			endpoint := clt.Endpoint("webapi", "mfa", "token", token.GetName(), "registerchallenge")
-			res, err := clt.PostJSON(ctx, endpoint, tc.req)
+			res, err := clt.PostJSON(ctx, endpoint, &createRegisterChallengeRequest{
+				DeviceType: tc.deviceType,
+			})
 			require.NoError(t, err)
 
 			var chal client.MFARegisterChallenge
 			require.NoError(t, json.Unmarshal(res.Bytes(), &chal))
 
-			switch tc.req.DeviceType {
+			switch tc.deviceType {
 			case "totp":
-				require.NotNil(t, chal.TOTP.QRCode, "TOTP QR code cannot be nil")
+				require.NotNil(t, chal.TOTP.QRCode)
 			case "webauthn":
-				require.NotNil(t, chal.Webauthn, "WebAuthn challenge cannot be nil")
-			}
-
-			if tc.assertChallenge != nil {
-				tc.assertChallenge(t, &chal)
+				require.NotNil(t, chal.Webauthn)
 			}
 		})
 	}
diff --git a/lib/web/app/transport.go b/lib/web/app/transport.go
index e8781f2abc3a8..b8a63e00d5d72 100644
--- a/lib/web/app/transport.go
+++ b/lib/web/app/transport.go
@@ -22,7 +22,6 @@ import (
 	"fmt"
 	"net"
 	"net/http"
-	"strings"
 	"sync"
 
 	"github.com/gravitational/teleport/api/constants"
@@ -190,7 +189,8 @@ func (t *transport) DialContext(ctx context.Context, _, _ string) (net.Conn, err
 		var dialErr error
 		conn, dialErr = dialAppServer(t.c.proxyClient, t.c.identity, appServer)
 		if dialErr != nil {
-			if isReverseTunnelDownError(dialErr) {
+			// Connection problem with the server.
+			if trace.IsConnectionProblem(dialErr) {
 				t.c.log.Warnf("Failed to connect to application server %q: %v.", serverID, dialErr)
 				t.servers.Delete(serverID)
 				// Only goes for the next server if the error returned is a
@@ -256,7 +256,7 @@ func configureTLS(c *transportConfig) (*tls.Config, error) {
 	// Configure the pool of certificates that will be used to verify the
 	// identity of the server. This allows the client to verify the identity of
 	// the server it is connecting to.
-	ca, err := c.accessPoint.GetCertAuthority(context.TODO(), types.CertAuthID{
+	ca, err := c.accessPoint.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: c.identity.RouteToApp.ClusterName,
 	}, false)
@@ -283,10 +283,3 @@ func configureTLS(c *transportConfig) (*tls.Config, error) {
 
 	return tlsConfig, nil
 }
-
-// isReverseTunnelDownError returns true if the provided error indicates that
-// the reverse tunnel connection is down e.g. because the agent is down.
-func isReverseTunnelDownError(err error) bool {
-	return trace.IsConnectionProblem(err) ||
-		strings.Contains(err.Error(), reversetunnel.NoApplicationTunnel)
-}
diff --git a/lib/web/desktop/playback.go b/lib/web/desktop/playback.go
index 79f0a7c86d1d7..31c72c9cd8785 100644
--- a/lib/web/desktop/playback.go
+++ b/lib/web/desktop/playback.go
@@ -19,16 +19,13 @@ package desktop
 import (
 	"context"
 	"errors"
-	"fmt"
 	"net"
-	"os"
 	"sync"
 	"time"
 
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/trace"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/net/websocket"
 )
@@ -206,19 +203,8 @@ func (pp *Player) streamSessionEvents(ctx context.Context, cancel context.Cancel
 
 		select {
 		case err := <-errC:
-			// TODO(zmb3, isaiah): send some sort of error to the browser,
-			// otherwise it just sits at the player UI
 			if err != nil && !errors.Is(err, context.Canceled) {
 				pp.log.WithError(err).Errorf("streaming session %v", pp.sID)
-				var errorText string
-				if os.IsNotExist(err) || trace.IsNotFound(err) {
-					errorText = "session not found"
-				} else {
-					errorText = "server error"
-				}
-				if _, err := pp.ws.Write([]byte(fmt.Sprintf(`{"message": "error", "errorText": "%v"}`, errorText))); err != nil {
-					pp.log.WithError(err).Error("failed to write \"error\" message over websocket")
-				}
 			}
 			return
 		case evt := <-eventsC:
@@ -239,10 +225,6 @@ func (pp *Player) streamSessionEvents(ctx context.Context, cancel context.Cancel
 				msg, err := utils.FastMarshal(e)
 				if err != nil {
 					pp.log.WithError(err).Errorf("failed to marshal DesktopRecording event into JSON: %v", e)
-					if _, err := pp.ws.Write([]byte(`{"message":"error","errorText":"server error"}`)); err != nil {
-						pp.log.WithError(err).Error("failed to write \"error\" message over websocket")
-					}
-					return
 				}
 				if _, err := pp.ws.Write(msg); err != nil {
 					// We expect net.ErrClosed to arise when another goroutine returns before
@@ -252,12 +234,6 @@ func (pp *Player) streamSessionEvents(ctx context.Context, cancel context.Cancel
 					}
 					return
 				}
-			case *apievents.WindowsDesktopSessionStart, *apievents.WindowsDesktopSessionEnd:
-				// these events are part of the stream but never needed for playback
-			case *apievents.DesktopClipboardReceive, *apievents.DesktopClipboardSend:
-				// these events are not currently needed for playback,
-				// but may be useful in the future
-
 			default:
 				pp.log.Warnf("session %v contains unexpected event type %T", pp.sID, evt)
 			}
diff --git a/lib/web/desktop/playback_test.go b/lib/web/desktop/playback_test.go
index 3348112580795..bb0be1f908993 100644
--- a/lib/web/desktop/playback_test.go
+++ b/lib/web/desktop/playback_test.go
@@ -65,7 +65,7 @@ func TestStreamsDesktopEvents(t *testing.T) {
 	b := make([]byte, 4096)
 	n, err := ws.Read(b)
 	require.NoError(t, err)
-	require.JSONEq(t, `{"message":"end"}`, string(b[:n]))
+	require.Equal(t, []byte(`{"message":"end"}`), b[:n])
 }
 
 func newServer(t *testing.T, streamInterval time.Duration, events []apievents.AuditEvent) *httptest.Server {
diff --git a/lib/web/gziphandler.go b/lib/web/gziphandler.go
index d7acf9b03113e..37e5a80662fd9 100644
--- a/lib/web/gziphandler.go
+++ b/lib/web/gziphandler.go
@@ -18,7 +18,7 @@ package web
 
 import (
 	"compress/gzip"
-	"io"
+	"io/ioutil"
 	"net/http"
 	"strings"
 	"sync"
@@ -30,7 +30,7 @@ import (
 // internal buffers to avoid too many objects on the heap
 var writerPool = sync.Pool{
 	New: func() interface{} {
-		gz := gzip.NewWriter(io.Discard)
+		gz := gzip.NewWriter(ioutil.Discard)
 		return gz
 	},
 }
diff --git a/lib/web/join_tokens.go b/lib/web/join_tokens.go
index 328133e9fa83f..64ff8c9047069 100644
--- a/lib/web/join_tokens.go
+++ b/lib/web/join_tokens.go
@@ -31,7 +31,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/defaults"
-	"github.com/gravitational/teleport/lib/httplib"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/web/scripts"
@@ -57,40 +56,13 @@ type scriptSettings struct {
 	appURI         string
 }
 
-// createTokenRequest is the expected request body of
-// the endpoint to create token
-type createTokenRequest struct {
-	Roles types.SystemRoles `json:"roles"`
-}
-
-func (h *Handler) createTokenHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
-	var req createTokenRequest
-	if err := httplib.ReadJSON(r, &req); err != nil {
-		log.WithError(err).Error("error reading body")
-		return nil, trace.Wrap(err)
-	}
-
-	clt, err := ctx.GetClient()
-	if err != nil {
-		log.WithError(err).Error("error getting client")
-		return nil, trace.Wrap(err)
-	}
-
-	return createJoinToken(r.Context(), clt, req.Roles)
-}
-
-func (h *Handler) createNodeTokenHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
+func (h *Handler) createScriptJoinTokenHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params, ctx *SessionContext) (interface{}, error) {
 	clt, err := ctx.GetClient()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	roles := types.SystemRoles{
-		types.RoleNode,
-		types.RoleApp,
-	}
-
-	return createJoinToken(r.Context(), clt, roles)
+	return createScriptJoinToken(r.Context(), clt)
 }
 
 func (h *Handler) getNodeJoinScriptHandle(w http.ResponseWriter, r *http.Request, params httprouter.Params) (interface{}, error) {
@@ -158,10 +130,13 @@ func (h *Handler) getAppJoinScriptHandle(w http.ResponseWriter, r *http.Request,
 	return nil, nil
 }
 
-func createJoinToken(ctx context.Context, m nodeAPIGetter, roles types.SystemRoles) (*nodeJoinToken, error) {
+func createScriptJoinToken(ctx context.Context, m nodeAPIGetter) (*nodeJoinToken, error) {
 	req := auth.GenerateTokenRequest{
-		Roles: roles,
-		TTL:   defaults.NodeJoinTokenTTL,
+		Roles: types.SystemRoles{
+			types.RoleNode,
+			types.RoleApp,
+		},
+		TTL: defaults.NodeJoinTokenTTL,
 	}
 
 	token, err := m.GenerateToken(ctx, req)
diff --git a/lib/web/join_tokens_test.go b/lib/web/join_tokens_test.go
index 24ac93f0bc478..6a17db4b08a60 100644
--- a/lib/web/join_tokens_test.go
+++ b/lib/web/join_tokens_test.go
@@ -36,10 +36,7 @@ func TestCreateNodeJoinToken(t *testing.T) {
 		return "some-token-id", nil
 	}
 
-	token, err := createJoinToken(context.Background(), m, types.SystemRoles{
-		types.RoleNode,
-		types.RoleApp,
-	})
+	token, err := createScriptJoinToken(context.Background(), m)
 	require.NoError(t, err)
 
 	require.Equal(t, defaults.NodeJoinTokenTTL, token.Expiry.Sub(time.Now().UTC()).Round(time.Second))
diff --git a/lib/web/mfa.go b/lib/web/mfa.go
index 8813bd5ee432d..70130d727ae06 100644
--- a/lib/web/mfa.go
+++ b/lib/web/mfa.go
@@ -18,7 +18,6 @@ package web
 
 import (
 	"net/http"
-	"strings"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/lib/auth/webauthn"
@@ -147,10 +146,6 @@ func (h *Handler) createAuthenticateChallengeWithTokenHandle(w http.ResponseWrit
 type createRegisterChallengeRequest struct {
 	// DeviceType is the type of MFA device to get a register challenge for.
 	DeviceType string `json:"deviceType"`
-	// DeviceUsage is the intended usage of the device (MFA, Passwordless, etc).
-	// It mimics the proto.DeviceUsage enum.
-	// Defaults to MFA.
-	DeviceUsage string `json:"deviceUsage"`
 }
 
 // createRegisterChallengeWithTokenHandle creates and returns MFA register challenges for a new device for the specified device type.
@@ -170,20 +165,9 @@ func (h *Handler) createRegisterChallengeWithTokenHandle(w http.ResponseWriter,
 		return nil, trace.BadParameter("MFA device type %q unsupported", req.DeviceType)
 	}
 
-	var deviceUsage proto.DeviceUsage
-	switch strings.ToLower(req.DeviceUsage) {
-	case "", "mfa":
-		deviceUsage = proto.DeviceUsage_DEVICE_USAGE_MFA
-	case "passwordless":
-		deviceUsage = proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS
-	default:
-		return nil, trace.BadParameter("device usage %q unsupported", req.DeviceUsage)
-	}
-
 	chal, err := h.cfg.ProxyClient.CreateRegisterChallenge(r.Context(), &proto.CreateRegisterChallengeRequest{
-		TokenID:     p.ByName("token"),
-		DeviceType:  deviceType,
-		DeviceUsage: deviceUsage,
+		TokenID:    p.ByName("token"),
+		DeviceType: deviceType,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/web/resources_test.go b/lib/web/resources_test.go
index 929008e0d4387..97b8b030ea142 100644
--- a/lib/web/resources_test.go
+++ b/lib/web/resources_test.go
@@ -122,7 +122,7 @@ spec:
       desktop: true
 version: v3
 `
-	role, err := types.NewRoleV3("roleName", types.RoleSpecV5{
+	role, err := types.NewRole("roleName", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{"test"},
 		},
@@ -167,7 +167,7 @@ func TestGetRoles(t *testing.T) {
 	m := &mockedResourceAPIGetter{}
 
 	m.mockGetRoles = func(ctx context.Context) ([]types.Role, error) {
-		role, err := types.NewRoleV3("test", types.RoleSpecV5{
+		role, err := types.NewRole("test", types.RoleSpecV5{
 			Allow: types.RoleConditions{
 				Logins: []string{"test"},
 			},
diff --git a/lib/web/sessions.go b/lib/web/sessions.go
index 947e2be6dc323..405a4ba607ad2 100644
--- a/lib/web/sessions.go
+++ b/lib/web/sessions.go
@@ -209,10 +209,9 @@ func (c *SessionContext) tryRemoteTLSClient(cluster reversetunnel.RemoteSite) (a
 // ClientTLSConfig returns client TLS authentication associated
 // with the web session context
 func (c *SessionContext) ClientTLSConfig(clusterName ...string) (*tls.Config, error) {
-	ctx := context.TODO()
 	var certPool *x509.CertPool
 	if len(clusterName) == 0 {
-		certAuthorities, err := c.parent.proxyClient.GetCertAuthorities(ctx, types.HostCA, false)
+		certAuthorities, err := c.parent.proxyClient.GetCertAuthorities(types.HostCA, false)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -221,7 +220,7 @@ func (c *SessionContext) ClientTLSConfig(clusterName ...string) (*tls.Config, er
 			return nil, trace.Wrap(err)
 		}
 	} else {
-		certAuthority, err := c.parent.proxyClient.GetCertAuthority(ctx, types.CertAuthID{
+		certAuthority, err := c.parent.proxyClient.GetCertAuthority(types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: clusterName[0],
 		}, false)
@@ -306,8 +305,7 @@ func (c *SessionContext) GetAgent() (agent.Agent, *ssh.Certificate, error) {
 }
 
 func (c *SessionContext) getCheckers() ([]ssh.PublicKey, error) {
-	ctx := context.TODO()
-	cas, err := c.unsafeCachedAuthClient.GetCertAuthorities(ctx, types.HostCA, false)
+	cas, err := c.unsafeCachedAuthClient.GetCertAuthorities(types.HostCA, false)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -828,8 +826,7 @@ func (s *sessionCache) newSessionContextFromSession(session types.WebSession) (*
 }
 
 func (s *sessionCache) tlsConfig(cert, privKey []byte) (*tls.Config, error) {
-	ctx := context.TODO()
-	ca, err := s.proxyClient.GetCertAuthority(ctx, types.CertAuthID{
+	ca, err := s.proxyClient.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: s.clusterName,
 	}, false)
diff --git a/lib/web/static_test.go b/lib/web/static_test.go
index 6ea4d05afc996..79f47fbbc7c98 100644
--- a/lib/web/static_test.go
+++ b/lib/web/static_test.go
@@ -18,6 +18,7 @@ package web
 
 import (
 	"io"
+	"io/ioutil"
 	"os"
 	"strings"
 
@@ -37,7 +38,7 @@ func (s *StaticSuite) TestLocalFS(c *check.C) {
 
 	f, err := fs.Open("/index.html")
 	c.Assert(err, check.IsNil)
-	bytes, err := io.ReadAll(f)
+	bytes, err := ioutil.ReadAll(f)
 	c.Assert(err, check.IsNil)
 
 	html := string(bytes[:])
@@ -54,7 +55,7 @@ func (s *StaticSuite) TestZipFS(c *check.C) {
 	// test simple full read:
 	f, err := fs.Open("/index.html")
 	c.Assert(err, check.IsNil)
-	bytes, err := io.ReadAll(f)
+	bytes, err := ioutil.ReadAll(f)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(bytes), check.Equals, 813)
 	c.Assert(f.Close(), check.IsNil)
@@ -68,14 +69,14 @@ func (s *StaticSuite) TestZipFS(c *check.C) {
 	c.Assert(err, check.IsNil)
 	c.Assert(n, check.Equals, int64(10))
 
-	bytes, err = io.ReadAll(f)
+	bytes, err = ioutil.ReadAll(f)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(bytes), check.Equals, 803)
 
 	n, err = f.Seek(-50, io.SeekEnd)
 	c.Assert(err, check.IsNil)
 	c.Assert(n, check.Equals, int64(763))
-	bytes, err = io.ReadAll(f)
+	bytes, err = ioutil.ReadAll(f)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(bytes), check.Equals, 50)
 
@@ -84,7 +85,7 @@ func (s *StaticSuite) TestZipFS(c *check.C) {
 	n, err = f.Seek(-50, io.SeekCurrent)
 	c.Assert(err, check.IsNil)
 	c.Assert(n, check.Equals, int64(713))
-	bytes, err = io.ReadAll(f)
+	bytes, err = ioutil.ReadAll(f)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(bytes), check.Equals, 100)
 }
diff --git a/lib/web/ui/perf_test.go b/lib/web/ui/perf_test.go
index 9e79dfc6233ea..eb71151b4024e 100644
--- a/lib/web/ui/perf_test.go
+++ b/lib/web/ui/perf_test.go
@@ -19,6 +19,8 @@ package ui
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
+	"os"
 	"testing"
 	"time"
 
@@ -77,8 +79,12 @@ func BenchmarkGetClusterDetails(b *testing.B) {
 				bk, err = memory.New(memory.Config{})
 				require.NoError(b, err)
 			} else {
+				dir, err := ioutil.TempDir("", "teleport")
+				require.NoError(b, err)
+				defer os.RemoveAll(dir)
+
 				bk, err = lite.NewWithConfig(context.TODO(), lite.Config{
-					Path: b.TempDir(),
+					Path: dir,
 				})
 				require.NoError(b, err)
 			}
diff --git a/lib/web/ui/usercontext.go b/lib/web/ui/usercontext.go
index 3db8a148db565..5e7426ec8daf1 100644
--- a/lib/web/ui/usercontext.go
+++ b/lib/web/ui/usercontext.go
@@ -216,6 +216,9 @@ func NewUserContext(user types.User, userRoles services.RoleSet, features proto.
 	var billingAccess access
 	if features.Cloud {
 		billingAccess = newAccess(userRoles, ctx, types.KindBilling)
+
+		// disable access to preview features
+		desktopAccess = access{}
 	}
 
 	logins := getLogins(userRoles)
diff --git a/lib/web/ui/usercontext_test.go b/lib/web/ui/usercontext_test.go
index 9ccab941f65c0..874d5600e0293 100644
--- a/lib/web/ui/usercontext_test.go
+++ b/lib/web/ui/usercontext_test.go
@@ -157,6 +157,7 @@ func (s *UserContextSuite) TestNewUserContextCloud(c *check.C) {
 	roleSet := []types.Role{role}
 
 	allowed := access{true, true, true, true, true}
+	denied := access{false, false, false, false, false}
 
 	userContext, err := NewUserContext(user, roleSet, proto.Features{Cloud: true}, true)
 	c.Assert(err, check.IsNil)
@@ -185,5 +186,5 @@ func (s *UserContextSuite) TestNewUserContextCloud(c *check.C) {
 
 	// cloud-specific asserts
 	c.Assert(userContext.ACL.Billing, check.DeepEquals, allowed)
-	c.Assert(userContext.ACL.Desktops, check.DeepEquals, allowed)
+	c.Assert(userContext.ACL.Desktops, check.DeepEquals, denied)
 }
diff --git a/rfd/0039-sni-alpn-teleport-proxy-routing.md b/rfd/0039-sni-alpn-teleport-proxy-routing.md
index e34ae5eaafad5..fda09f9dc0fc4 100644
--- a/rfd/0039-sni-alpn-teleport-proxy-routing.md
+++ b/rfd/0039-sni-alpn-teleport-proxy-routing.md
@@ -103,7 +103,7 @@ In order to expose WEB, Kubernetes proxy services in one teleport proxy port, th
 
 #### Setting SNI value for kubectl CLI:
 
-`tsh kube login` command generates a local kubeconfig.yaml file used during accessing teleport proxy by kubectl CLI. Additional to the current configuration the `tls-server-name` field will be added with appropriate SNI value:
+`tsh kube login` command generates a local kubeconfig.yaml file used during accessing teleport proxy by kubectl CLI. Additional to the current configuration the  tls-server-name  failed will be added with appropriate SNI value:
 
 ```yaml
 apiVersion: v1
diff --git a/rfd/0043-kubeaccess-multiparty.md b/rfd/0043-kubeaccess-multiparty.md
index 77c0d487da9a1..a9b1cd9140f92 100644
--- a/rfd/0043-kubeaccess-multiparty.md
+++ b/rfd/0043-kubeaccess-multiparty.md
@@ -3,72 +3,65 @@ authors: Joel Wejdenstål (jwejdenstal@goteleport.com)
 state: implemented
 ---
 
-# RFD 43 - Moderated Sessions
+# RFD 43 - Shared sessions with observers for Kubernetes Access
 
 ## What
 
-Implement the ability to define RBAC policies with filters similar to those of [RFD 26](https://github.com/gravitational/teleport/blob/2fd6a88800604342bfa6277060b056d8bf0cbfb2/rfd/0026-custom-approval-conditions.md) that can be used to require others to be present in a session for it to be usable.
+Implement joint observer support for Kubernetes Access with support for configurable conditions similar to those of [RFD 26](https://github.com/gravitational/teleport/blob/2fd6a88800604342bfa6277060b056d8bf0cbfb2/rfd/0026-custom-approval-conditions.md).
+Also support defining conditions for required observers in order to initiate and maintain a session.
 
 ## Why
 
-Heavily regulated and security-critical industries require that one or more participants with a certain role
-are present in SSH and Kubernetes sessions and viewing it live to guarantee that
-the operator does not perform any mistakes or acts of malice.
+Heavily regulated and security critical industries require that one or more observers with a certain role
+are present in Kubernetes Access sessions and viewing it live in order to guarantee that
+operator does not perform any mistakes or acts of malice.
 
-Such participants need to have the power to terminate a session immediately should anything go wrong.
+Such observers need to have the power to terminate a session immediately should anything go wrong.
 
 To suit everyone this will need a more detailed configuration model based on rules
-that can be used to define observers, their powers, and when and in what capacity they are required.
+that can be used to define observers, their powers and when and in what capacity they are required.
 
 ## Details
 
-### Terminology
+### Multiparty sessions
 
-This RFD repeatedly refers to some specific nouns of which explanations can be found below:
-- Participant: Any user in the session regardless of mode, including the session initiator.
-- Initiator: The user that started the session. This user is in peer mode.
-- Mode: One of the modes below. Any given participant must be in one mode only.
-- Observer: A participant who can only view the session.
-- Moderator: A participant who can view and terminate the session at any point.
-- Peer: A participant with the ability to view and interact with the session.
-
-### Multiparty sessions for Kubernetes
-
-SSH sessions via TSH currently have support for sessions with multiple users at once.
+SSH sessions via TSH currently have rich support for sessions with multiple users at once.
 This concept is to be extended to Kubernetes Access which will allow us to build additional features on top.
 
-Multiparty sessions shall be implemented by modifying the k8s request proxy forwarder in the `kubernetes_service`. This approach was chosen as it is a hub that sessions pass through which makes it optimal for multiplexing.
+Multiparty sessions shall be implemented by modifying the k8s request proxy forwarder in the `kubernetes_service`. This
+approach was chosen as it is a hub that sessions pass through which makes it optimal for multiplexing.
 
 An approach using multiplexing in the `proxy_service` layer was considered but was ultimately determined to be more complicated
-since proxies don't handle the final session traffic hop when using Kubernetes Access.
+due to the fact that proxies don't handle the final session traffic hop when using Kubernetes Access.
 
-It will be implemented by adding a multiplexing layer inside the forwarder that similar to the current session recording
-functionality, but instead this multiplexes output to the session initiator and all participants
-but only streams back input from participants with the `peer` mode.
+It will work by adding a multiplexing layer inside the forwarder that similar to the current session recording
+functionality, but instead this multiplexes outputs to the session initiator and all observers
+but only streams back input from the initiator.
 
-#### Session participants and require policies
+#### Session observers
 
-A core feature we need to support is the required participants. This will allow cluster administrators to configure
+A core feature we need to support is required observers. This will allow cluster administrators to configure
 policies that require certain Teleport users of a certain role to be actively monitoring the session.
 
-This feature is useful in security-critical environments where multiple people need to witness every action
-in the event of severe error or malice and can halt any erroneous or malicious action.
+This feature is useful in security critical environments where multiple people need to witness every action
+in the event of severe error or malice and have the ability to halt any erroneous or malicious action.
 
 #### Session states
 
-By default, a `tsh kube exec` and `tsh ssh` request will go through as usual if no policies are defined. If a policy like the one above is defined the session will be put in a pending state
+By default, a `tsh kube exec` and `kubectl attach` request will go through as usual if no policies are defined. If a policy like the one above is defined the session will be put in a pending state
 until the required viewers have joined.
 
 Sessions can have 3 possible states:
 
 - `PENDING`\
- When a session is in a `PENDING` state, the connection to the pod from the proxy has not yet started
- and all users are shown a default message informing them that the session is pending.
+  When a session is in a `PENDING` state, the connection to the pod from the proxy has not yet started
+  and all users are shown a default message informing them that the session is pending, current participants
+  and who else is required for the session to start.
 - `RUNNING`\
 A `RUNNING` session behaves like a normal multiparty session. `stdout`, `stdin` and `stdout` are mapped as usual
- and the pod can be interacted with.
+  and the pod can be interacted with.
 - `TERMINATED`\
- A session becomes `TERMINATED` once the shell spawned inside the pod quits or is forcefully terminated by one of the session participants.
+  A session becomes `TERMINATED` once the shell spawned inside the pod quits or is forcefully terminated by one of the session participants.
 
 All sessions begin in the `PENDING` state and can change states based on the following transitions:
 
@@ -79,13 +72,13 @@ the session transitions to a `RUNNING` state. This involves initiating the conne
 and setting up the shell. Finally, all clients are multiplexed
 onto the correct streams as described previously.
 
-Only the session initiator can make input, observers are not connected to the input stream
+Only the session initiator is able to make input, observers are not connected to the input stream
 and may only view stdout/stderr and terminate the session.
 
 ##### Transition 2: `RUNNING -> TERMINATED`
 
-When the shell process created on the pod is terminated, the session transitions to a `TERMINATED` state, and all clients
-are disconnected as per standard `kubectl` behavior.
+When the shell process created on the pod is terminated, the session transitions to a `TERMINATED` state and all clients
+are disconnected as per standard `kubectl` behaviour.
 
 ##### Transition 3: `RUNNING -> TERMINATED`
 
@@ -103,7 +96,7 @@ Here, the connection is frozen for a configurable amount of time as a sort of gr
 ##### Transition 5: `PENDING -> TERMINATED`
 
 After a grace period has elapsed in a session in a session that previously was in a `RUNNING`
-state, the session is automatically terminated. This can be canceled by having the required observers
+state, the session is automatically terminated. This can be cancelled by having the required observers
 join back in which transitions the session back to `RUNNING`.
 
 ##### Transition 6: `PENDING -> TERMINATED`
@@ -114,22 +107,22 @@ connection to the pod exists at this time.
 
 #### UI/UX
 
-The initial implementation of multiparty sessions for SSH Kubernetes access will only be supported via CLI access for implementation simplicity.
+The initial implementation of multiparty sessions on Kubernetes access will only be supported via CLI access for implementation simplicity.
 
-Terminating the `tsh kube exec` or `tsh ssh` process that started the session terminates the session. Terminating a participant `tsh` process
+Terminating the `kubectl` process that started the session terminates the session. Terminating an observer `tsh` process
 disconnects the observer from the session and applies relevant state transitions if any.
 
-Terminating the session from a moderator `tsh` instance can be done with the T hotkey.
+Terminating the session from a observer `tsh` instance can be done with the key combination `CTRL-T`
 
 ##### Session creation
 
 Session creation can happen with the existing flow using `kubectl exec`
-but the wrapper command `tsh kube exec --invite=bob@example.com,eve@foo.net --reason="Need to fix this pod" -- database_pod -- /bin/bash`. This subcommand allows you to invite one or more accounts that will receive a notification saying they are invited. An arbitrary string may also be provided as a reason
+but the wrapper command `tsh kube exec --invite=bob@example.com,eve@foo.net --reason="Need to fix this pod" -- database_pod -- /bin/bash`. This subcommand allows you to invite one or more accounts which will receive a notification saying they are invited. An arbitrary string may also be provided as a reason
 for the session invite, it could for example be used to say what the purpose of the session is.
 
 ##### Session join
 
-Kubernetes itself has no concept of multiparty sessions. This means that we cannot easily use
+`kubectl` itself has no concept of multiparty sessions. This means that we cannot easily use
 its built-in facilities for support session joining.
 
 To make this process easier for the user. I propose extending the current `tsh join` command
@@ -139,98 +132,58 @@ to an ongoing session and displays stdout/stderr.
 ##### MFA tap
 
 If the standard `per_session_mfa` option is enabled for a role then MFA tap input via Yubikey or other is required for the participant to be considered active.
-This requirement is on an interval of 1 minute. When there are 15 seconds left, an alert is printed to the console.
+This requirement is on an interval of 1 minute. When there is 15 seconds left, an alert is printed to the console.
 
 ```
-Teleport > Please tap your MFA key within 15 seconds.
+Teleport >> Please tap your MFA key within 15 seconds.
 ```
 
-If the tap is made after the alert, the following message is shown:
-
-```
-Teleport > MFA tap received.
-```
-
-#### Broadcast messages
-
-For TTY-enabled SSH and Kubernetes sessions that require additional participants regardless of mode as per a require policy, Teleport will now inject broadcast messages into the session to notify participants
-about the state of the session. No messages will be shown in sessions that do not require additional participants.
-
-This is needed so that participants are aware of what is currently happening in the session
-for security and usability reasons.
-
-Each broadcast message is prefixed with `Teleport > ` to indicate that this message
-is injected by Teleport and not from the originating shell.
-
-There are 10 kinds of broadcast messages:
-- `Creating session with uuid <example-uuid>...`: Sent on session creation.
-- `User <user> joined the session.`: Sent when a user joins the session.
-- `User <user> left the session.`: Sent when a user leaves the session.
-- `Connecting to $HOSTNAME over $PROTOCOL`: Sent when the session is launched and thus transferred to a normal shell.
-- `Session closed.`: Sent when the session is closed due to the termination of the shell.
-- `Session terminated by a moderator`: Sent when moderator forcefully terminates a session.
-- `Session paused, waiting for additional participants...`: Sent when a session is paused due to lack of required participants.
-- `Session resumed.`: Sent when a session has the required participants and is resumed.
-- `Please tap your MFA key within 15 seconds.` and `MFA tap received.` are messages shown to moderators in sessions that are MFA-presence enabled.
-- `Session terminated: participant requirements not met`: Sent when a session is terminated due to lack of required participants and when the pause mode is not enabled.
-
-##### Verbose participant requirements
-
-The optional flag `--participant-req` may be passed `tsh kube exec` or `tsh ssh` when the session is started to provide a verbose output of the participant requirements. By default, we avoid this because the output is large and may be overwhelming but the option is provided for users who wish to see exactly what the requirements for starting a session are.
-
-In this case, the `Session paused, waiting for additional participants...` message will be replaced by the message below.
+If tap is made after the alert, the follwing message is shown:
 
 ```
-Teleport > Session paused, waiting for additional participants:
-           role-1:
-             one-of:
-               - 2x `contains(user.roles, "auditor")`
-               - 1x `contains(user.roles, "admin")`
-           role-2:
-             one-of:
-               - 1x `contains(user.roles, "cs-overwatch")`
+Teleport >> MFA tap received.
 ```
 
 ##### Example
 
-This example illustrates how a group of 3 users of which Alice is the initiator and Eve and Ben are two observers start a multiparty session. Below is a series of events that happen that include what each user sees and actions taken.
+This example illustrates how a group 3 users of which Alice is the initiator and Eve and Ben are two observers
+start a multiparty session. Below is a a series of events that happen that include what each user sees and what
+they do.
 
-- Alice initiates an interactive session to a pod: `tsh kube exec -st --invite=ben@foo.net,eve@foo.net,alice@foo.net redis-bastion /bin/bash`
+- Alice initiates an interactive session to a pod: `tsh kube exec -st --invite=ben@foo.net,eve@foo.net,alice@foo.net database_pod /bin/bash`
 - Alice sees:
 ```
-Teleport > Creating session with uuid <example-uuid>...
-Teleport > User Alice joined the session.
-Teleport > This session requires additional participants to start...
+Creating session with uuid <example-uuid>...
+This session requires moderator. Waiting for others to join:
+- role: auditor-role x2
 ```
 - Eve joins the session with `tsh kube join <example-uuid>` and sees:
 ```
 Please tap MFA key to continue...
 ```
 - Eve taps MFA
-- Alice and Eve sees
-:
+- Alice and Eve sees:
 ```
-Teleport > Creating session with uuid <example-uuid>...
-Teleport > User Alice joined the session.
-Teleport > This session requires additional participants to start...
-Teleport > User Eve joined the session.
+Creating session with uuid <example-uuid>...
+This session requires moderator. Waiting for others to join:
+- role: auditor-role x1
+Events:
+- User Eve joined the session.
 ```
 - Ben joins the session with `tsh kube join <example-uuid>` and sees:
 ```
 Please tap MFA key to continue...
 ```
 - Ben taps MFA
-- Alice, Eve, and Ben sees
+- Alice, Eve and Ben sees
 ```
-Teleport > Creating session with uuid <example-uuid>...
-Teleport > User Alice joined the session.
-Teleport > This session requires additional participants to start...
-Teleport > User Eve joined the session.
-Teleport > User Ben joined the session.
-Teleport > Connecting to redis-bastion over Kubernetes...
-redis-bastion@localhost $
+Creating session with uuid <example-uuid>...
+Session starting...
+Events:
+- User Eve joined the session.
+- User Ben joined the session
 ```
-- The connection to the pod is made and each session turns into a normal shell.
+- The connection to the pod is made and each the session turns into a normal shell.
 
 #### Session invites and notifications
 
@@ -245,12 +198,12 @@ session resource which allows Teleport clients and plugins to detect notify them
 
 ##### Session resource
 
-There currently isn't a general-purpose session resource in Teleport that's suitable.
+There currently isn't a general purpose session resource in Teleport that's suitable.
 therefore I suggest that this shall be added. This will be initially used for tracking Kubernetes
 sessions but is compatible with all current and future session types.
 
 This resource is stored centrally in the backend and is used for storing and tracking metadata of active
-sessions. Detailed runtime information needed to join such as the TTY size is stored in memory on the multiplexing node.
+sessions. Detailed runtime information needed to join such as the TTY size is stored in memory on the the multiplexing node.
 
 This effectively replaces the resource defined [here](https://github.com/gravitational/teleport/blob/master/lib/session/session.go).
 
@@ -349,7 +302,7 @@ enum SessionState {
     // to start the session.
     SessionStatePending = 0;
 
-    // Running variant represents a session that has had its criteria for starting
+    // Running variant represents a session that has had it's criteria for starting
     // fulfilled at least once and has transitioned to a RUNNING state.
     SessionStateRunning = 1;
 
@@ -363,14 +316,14 @@ enum SessionState {
 Instead of having fixed fields for specifying values such as required session viewers and roles this
 model centers around conditional allow rules and filters. It is implemented as a bi-directional mapping between the role of the session initiator and the roles of the other session participants.
 
-Roles can have a `require_session_join` rule under `allow` containing requirements for session participants
-before a session may be started with privileged access to nodes that the role provides.
+Roles can have `require_session_join` rule under `allow` containing requirements for session participants
+before a session may be started with privilege access to nodes that the role provides.
 
-Roles can also have a `join_sessions` rule under `allow` specifying which roles
-and session types that the role grants privileges to join.
+Roles can also have an `join_sessions` rule under `allow` specifying which roles
+and session types that that the role grants privileges to join.
 
 We will only initially support the modes `moderator` for Kubernetes Access and `peer` for SSH sessions.
-An `observer` mode also exists which only grants access to view but does not terminate an ongoing session.
+An `observer` mode also exists which only grants access to view but not terminate an ongoing session.
 
 Imagine you have 4 roles:
 - `prod-access`
@@ -379,7 +332,7 @@ Imagine you have 4 roles:
 - `maintenance-observer`
 
 And these requirements:
-- `prod-access` should be able to start sessions of any type with either one `senior-dev` participant two `dev` participants.
+- `prod-access` should be able to start sessions of any type with either one `senior-dev` observeror two `dev` observers.
 - `senior-dev` should be able to start sessions of any type without oversight.
 - `customer-db-maintenance` needs oversight by one `maintenance-observer` on `ssh` type sessions.
 
@@ -457,7 +410,7 @@ To make it more workable, the language has been slimmed down significantly to ha
 
 ##### Provided variables
 
-- `user`
+- `participant`
 ```json
 {
   "traits": "map<string, []string>",
diff --git a/rfd/0046-database-access-config.md b/rfd/0046-database-access-config.md
index fa83487ab3b8c..9758f2a198121 100644
--- a/rfd/0046-database-access-config.md
+++ b/rfd/0046-database-access-config.md
@@ -1,6 +1,6 @@
 ---
-authors: Roman Tkachenko (roman@goteleport.com), Gabriel Corado (gabriel.oliveira@goteleport.com)
-state: implemented
+authors: Roman Tkachenko (roman@goteleport.com)
+state: draft
 ---
 
 # RFD 46 - Database access configurator
@@ -26,17 +26,15 @@ this initial IAM bootstrap besides documentation guides.
 The same applies to self-hosted databases and other clouds. Instructions vary
 greatly between different database deployment models (self-hosted, cloud) and
 authentication types (X.509, IAM, AD) and having a tool that can guide users
-through the initial setup would significantly improve the getting started
+through the initial setup would significanly improve the getting started
 experience.
 
 ## Scope
 
-The initial implementation will focus on:
-
-1. Generate database agent configuration with samples;
-2. Bootstrap the agent's AWS IAM policies but we'll make the effort to design
-   the CLI interface in a way which would allow for extensibility to support
-   other scenarios (self-hosted, other clouds and auth types);
+The initial implementation will focus on bootstrapping the agent's AWS IAM
+policies but we'll make the effort to design the CLI interface in a way which
+would allow for extensibility to support other scenarios (self-hosted, other
+clouds and auth types).
 
 ## Prior art
 
@@ -66,284 +64,14 @@ $ clusterawsadm bootstrap iam print-policy --document AWSIAMManagedPolicyControl
 
 Teleport has a `teleport configure` command that generates a sample config file.
 
-Database agent bootstrap commands will reside under teleport db configure family
-of subcommands. This aligns with our strategy of placing commands related to a
-particular service under its subcommand namespace. It will provide subcommands
-for generating configuration files and bootstrapping database agents’ necessary
-configurations, for example, setting up IAM permissions for agents to proxy
-AWS-hosted databases.
-
-### Create config subcommand
-
-Similar to `teleport configure` but focused on configurations for Database
-agents. This command will generate a configuration file. It can also provide
-some examples of configuration, for instance, self-hosted databases setup.
-
-There will be flags to enable features like Aurora/RDS auto-discovery and
-dynamic registration. Each sample will show the required options with some
-explanation on how to fill them and documentation links.
-
-It will also provide flags to configure a specific database (similar to the
-flags present on the `teleport db start` command). When executed with these
-flags, the samples will not be included, only the static configuration of a
-single database.
-
-```bash
-teleport db configure create [--proxy] [--token=] [--discovery-rds=] [--discovery-redshift] [--output=] [--ca-pin=] [--name=] [--protocol=] [--uri=] [--labels=]
-```
-
-| Flag                            | Description |
-| ------------------------------- | ----------- |
-| `--proxy`                       | Teleport proxy address to connect to [0.0.0.0:3080]. |
-| `--token`                       | Invitation token to register with an auth server [none]. |
-| `--discovery-rds`               | List of AWS regions the agent will discover for RDS/Aurora instances. |
-| `--discovery-redshift`          | List of AWS regions the agent will discover for Redshift instances. |
-| `--output`                      | Write to stdout with -o=stdout, default config file with -o=file or custom path with -o=file:///path |
-| `--ca-pin`                      | CA pin to validate the auth server (can be repeated for multiple pins). |
-| `--name`                        | Name of the proxied database. |
-| `--protocol`                    | Proxied database protocol. Supported are: [postgres mysql mongodb cockroachdb]. |
-| `--uri`                         | Address the proxied database is reachable at. |
-| `--description`                 | Description of the proxied database. Default: "" |
-| `--labels`                      | Comma-separated list of labels for the database, for example env=dev,dept=it |
-
-* When configuring a single database, `name`, `protocol` and `uri` are required;
-
-**Examples:**
-
-None of the flags are required. Running the command without flags should output
-a configuration with samples.
-
-```bash
-# will generate a configuration file for the database agent.
-$ teleport db configure create
-
-#
-# Teleport database agent configuration file.
-# Configuration reference: https://goteleport.com/docs/database-access/reference/configuration/
-#
-version: v2
-teleport:
-  nodename: localhost
-  data_dir: /var/lib/teleport
-  auth_token: /tmp/token
-  auth_servers:
-  - 127.0.0.1:3025
-db_service:
-  enabled: "yes"
-  # Matchers for database resources created with "tctl create" command.
-  # For more information: https://goteleport.com/docs/database-access/guides/dynamic-registration/
-  resources:
-  - labels:
-      "*": "*"
-  # Lists statically registered databases proxied by this agent.
-  # databases:
-  # # RDS database static configuration.
-  # # RDS/Aurora databases Auto-discovery reference: https://goteleport.com/docs/database-access/guides/rds/
-  # - name: rds
-  #   description: AWS RDS/Aurora instance configuration example.
-  #   # Supported protocols for RDS/Aurora: "postgres" or "mysql"
-  #   protocol: postgres
-  #   # Database connection endpoint. Must be reachable from Database Service.
-  #   uri: rds-instance-1.abcdefghijklmnop.us-west-1.rds.amazonaws.com:5432
-  #   # AWS specific configuration.
-  #   aws:
-  #     # Region the database is deployed in.
-  #     region: us-west-1
-  #     # RDS/Aurora specific configuration.
-  #     rds:
-  #       # RDS Instance ID. Only present on RDS databases.
-  #       instance_id: rds-instance-1
-  # # Aurora database static configuration.
-  # # RDS/Aurora databases Auto-discovery reference: https://goteleport.com/docs/database-access/guides/rds/
-  # - name: aurora
-  #   description: AWS Aurora cluster configuration example.
-  #   # Supported protocols for RDS/Aurora: "postgres" or "mysql"
-  #   protocol: postgres
-  #   # Database connection endpoint. Must be reachable from Database Service.
-  #   uri: aurora-cluster-1.abcdefghijklmnop.us-west-1.rds.amazonaws.com:5432
-  #   # AWS specific configuration.
-  #   aws:
-  #     # Region the database is deployed in.
-  #     region: us-west-1
-  #     # RDS/Aurora specific configuration.
-  #     rds:
-  #       # Aurora Cluster ID. Only present on Aurora databases.
-  #       cluster_id: aurora-cluster-1
-  # # Redshift database static configuration.
-  # # For more information: https://goteleport.com/docs/database-access/guides/postgres-redshift/
-  # - name: redshift
-  #   description: AWS Redshift cluster configuration example.
-  #   # Supported protocols for Redshift: "postgres".
-  #   protocol: postgres
-  #   # Database connection endpoint. Must be reachable from Database service.
-  #   uri: redshift-cluster-example-1.abcdefghijklmnop.us-west-1.redshift.amazonaws.com:5439
-  #   # AWS specific configuration.
-  #   aws:
-  #     # Region the database is deployed in.
-  #     region: us-west-1
-  #     # Redshift specific configuration.
-  #     redshift:
-  #       # Redshift Cluster ID.
-  #       cluster_id: redshift-cluster-example-1
-  # # Self-hosted static configuration.
-  # - name: self-hosted
-  #   description: Self-hosted database configuration.
-  #   # Supported protocols for self-hosted: postgres, mysql, mongodb, cockroachdb.
-  #   protocol: postgres
-  #   # Database connection endpoint. Must be reachable from Database service.
-  #   uri: database.example.com:5432
-auth_service:
-  enabled: "no"
-ssh_service:
-  enabled: "no"
-proxy_service:
-  enabled: "no"
-```
-
-Similarly to configure command, it will also support writing the configuration
-directly to a file.
-
-```bash
-# write to the default file location.
-$ teleport db configure create --output file
-
-Wrote config to file "/etc/teleport.yaml". Now you can start the server. Happy Teleporting!
-```
-
-```bash
-# write to the provided file location.
-$ teleport db configure create --output file:///teleport.yaml
-
-Wrote config to file "/teleport.yaml". Now you can start the server. Happy Teleporting!
-```
-
-Configure a single database.
-
-```bash
-# generates a configuration for a Postgres database.
-$ teleport db configure create \
-   --token=/tmp/token \
-   --auth-server=localhost:3025 \
-   --name=sample-db \
-   --protocol=postgres \
-   --uri=postgres://localhost:5432
-```
-
-### Bootstrap permissions command
+Database agent bootstrap commands will reside under `teleport db configure`
+family of subcommands. This aligns with our strategy of placing commands related
+to a particular service under its own subcommand namespace.
 
-Subcommand will bootstrap the necessary configuration for the database agent. It
-reads the provided agent configuration to determine what will be bootstrapped.
-
-```bash
-$ teleport db configure bootstrap [-c=,--config=] [--manual] [--policy-name=] [--attach-to-user=] [--attach-to-role=] [--confirm]
-```
-
-| Flag               | Description |
-| ------------------ | ----------- |
-| `-c, --config`     | Path to the database agent configuration file. Default: "/etc/teleport.yaml". |
-| `--manual`         | When executed in "manual" mode, it will print the instructions to complete the configuration instead of applying them directly. |
-| `--policy-name`    | Name of the Teleport Database agent policy. Default: "DatabaseAccess". |
-| `--attach-to-role` | Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
-| `--attach-to-user` | User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials. |
-| `--confirm`        | Do not prompt the user and auto-confirm all actions. Defaults to false. |
-
-**Examples:**
-
-```bash
-# When the database configuration has RDS/Aurora or Redshift auto-discovery.
-# Configure AWS provider attaching the created policies to “SampleUser” when confirmation is given.
-$ teleport db configure bootstrap --attach-to-user SampleUser
-Reading configuration at "/etc/teleport.yaml"...
-
-AWS
-1. Create IAM policy "DatabaseAccess":
-{ ...policy document... }
-
-2. Create IAM boundary policy "DatabaseAccessBoundary":
-{ ...policy document... }
-
-3. Attach policy and boundary to "SampleUser".
-
-Confirm actions? [y/N] y
-✅[AWS] Creating IAM Policy "DatabaseAccess"... done.
-✅[AWS] Creating IAM policy boundary "DatabaseAcessBoundary"... done.
-✅[AWS] Attaching IAM policy and boundary to IAM user "SampleUser"... done.
-```
-
-```bash
-# When the database configuration has RDS/Aurora or Redshift auto-discovery.
-# Configure AWS provider attaching the created policies to “SampleUser”.
-$ teleport db configure bootstrap --attach-to-user SampleUser --confirm
-Reading configuration at "/etc/teleport.yaml"...
-
-AWS
-1. Create IAM policy "DatabaseAccess":
-{ ...policy document... }
-
-2. Create IAM boundary policy "DatabaseAccessBoundary":
-{ ...policy document... }
-
-3. Attach policy and boundary to "SampleUser".
-
-✅[AWS] Creating IAM Policy "DatabaseAccess"... done.
-✅[AWS] Creating IAM policy boundary "DatabaseAcessBoundary"... done.
-✅[AWS] Attaching IAM policy and boundary to IAM user "SampleUser"... done.
-```
-
-```bash
-# When the database configuration has RDS/Aurora or Redshift auto-discovery.
-# Show instructions on how to configure AWS.
-$ teleport db configure bootstrap --manual --attach-to-user SampleUser
-Reading configuration at "/etc/teleport.yaml"...
-Running in "manual" mode, there will be presented the instructions to bootstrap the agent.
-
-AWS
-1. Create IAM policy "DatabaseAccess":
-{ ...policy document... }
-
-2. Create IAM boundary policy "DatabaseAccessBoundary":
-{ ...policy document... }
-
-3. Attach policy and boundary to "username".
-```
-
-```bash
-# When the database agent has a configuration that requires no bootstrapping.
-$ teleport db configure bootstrap
-Reading configuration at "/etc/teleport.yaml"...
-Nothing to be bootstrapped.
-```
-
-#### Error handling:
-
-No external calls will be issued when running with `--mode=manual`, meaning the
-command won't fail. In automatic mode, however, if the command fails, the error
-will be presented.
-
-**Examples:**
-
-```bash
-# Fails to attach the created policy into the user.
-$ teleport db configure bootstrap --attach-to-user SampleUser
-Reading configuration at "/etc/teleport.yaml"...
-
-AWS
-1. Create IAM policy "DatabaseAccess":
-{ ...policy document... }
-
-2. Create IAM boundary policy "DatabaseAccessBoundary":
-{ ...policy document... }
-
-3. Attach policy and boundary to "SampleUser".
-
-Confirm actions? [y/N] y
-✅[AWS] Creating IAM Policy "DatabaseAccess"... done.
-✅[AWS] Creating IAM policy boundary "DatabaseAcessBoundary"... done.
-❌[AWS] Attaching IAM policy and boundary to IAM user "SampleUser"... failed.
-Failure reason: unable to find user "SampleUser".
-```
-
-### AWS subcommand
+The "configure" command will provide subcommands for configuring database agents
+in different environments. This RFD focuses on `aws` subcommands that deal with
+configuring IAM for agents that proxy AWS-hosted databases (RDS, Aurora,
+Redshift).
 
 ```bash
 $ teleport db configure aws ...
@@ -364,7 +92,7 @@ $ teleport db configure aws create-iam
 $ teleport db configure aws print-iam
 ```
 
-#### Automatic mode
+### Automatic mode
 
 To use automatic mode, user needs to run `teleport db configure aws` command
 on the machine with permissions to create and attach IAM policies.
@@ -383,14 +111,14 @@ The command will:
 $ teleport db configure aws create-iam [--name=] [--types=] [--attach] [--role=|--user=] [--confirm]
 ```
 
-| Flag        | Description |
-| ----------- | ----------- |
-| `--name`    | Created policy name. Defaults to empty. Will be auto-generated if not provided. |
-| `--types`   | Permissions to include in the policy. Any of `rds`, `aurora`, `redshift`. Defaults to none. |
-| `--attach`  | Try to attach the policy to the IAM identity. Defaults to `true`. |
-| `--role`    | IAM role name to attach policy to. Mutually exclusive with `--user`. Defaults to empty. |
-| `--user`    | IAM user name to attach policy to. Mutually exclusive with `--role`. Defaults to empty. |
-| `--confirm` | Do not prompt user and auto-confirm all actions. Defaults to `false`. |
+| Flag          | Description |
+| ------------- | ----------- |
+| `--name`      | Created policy name. Defaults to empty. Will be auto-generated if not provided. |
+| `--types`     | Permissions to include in the policy. Any of `rds`, `aurora`, `redshift`. Defaults to none. |
+| `--attach`    | Try to attach the policy to the IAM identity. Defaults to `true`. |
+| `--role`      | IAM role name to attach policy to. Mutually exclusive with `--user`. Defaults to empty. |
+| `--user`      | IAM user name to attach policy to. Mutually exclusive with `--role`. Defaults to empty. |
+| `--confirm`   | Do not prompt user and auto-confirm all actions. Defaults to `false`. |
 
 * At least one type must be specified via `--types` flag.
 * If neither `--role` nor `--user` is specified, tries to attach the policy to the identity of current AWS credentials.
@@ -443,7 +171,7 @@ Example output:
 ✅ Attaching IAM policy and boundary to DatabaseAgentRole... done
 ```
 
-##### Error handling
+#### Error handling
 
 In case the automatic mode encounters a permission or any other kind of error
 (e.g. policy doesn't allow creating or attaching other policies), it falls back
@@ -452,7 +180,7 @@ to manual mode where it prints:
 - IAM permissions it requires to be able to create and attach these policies.
 - Policy and boundary in case user wants to create them themselves.
 
-#### Manual mode
+### Manual mode
 
 In manual mode configurator only prints the policy and boundary. User is
 responsible for creating and attaching them to IAM identity themselves.
@@ -465,13 +193,13 @@ respective policy/boundary documents, suitable for automation tools.
 $ teleport db configure aws print-iam [--types=] [--role=|--user=] [--policy|--boundary]
 ```
 
-| Flag         | Description |
-| ------------ | ----------- |
-| `--types`    | Permissions to include in the policy. Any of `rds`, `aurora`, `redshift`. Defaults to none. |
-| `--role`     | IAM role name to attach policy to. Mutually exclusive with `--user`. Defaults to empty. |
-| `--user`     | IAM user name to attach policy to. Mutually exclusive with `--role`. Defaults to empty. |
-| `--policy`   | Only print IAM policy document. Defaults to `false`. |
-| `--boundary` | Only print IAM boundary policy document. Defaults to `false`. |
+| Flag          | Description |
+| ------------- | ----------- |
+| `--types`     | Permissions to include in the policy. Any of `rds`, `aurora`, `redshift`. Defaults to none. |
+| `--role`      | IAM role name to attach policy to. Mutually exclusive with `--user`. Defaults to empty. |
+| `--user`      | IAM user name to attach policy to. Mutually exclusive with `--role`. Defaults to empty. |
+| `--policy`    | Only print IAM policy document. Defaults to `false`. |
+| `--boundary`  | Only print IAM boundary policy document. Defaults to `false`. |
 
 **Examples:**
 
@@ -525,78 +253,3 @@ $ teleport db configure azure ...
 $ teleport db configure postgres ...
 $ teleport db configure mysql ...
 ```
-
-## Security
-
-The bootstrap command doesn’t communicate with Teleport instances. However, it
-makes calls to the AWS API. As mentioned earlier, the command won’t request the
-AWS credentials, and it relies on the [default AWS credential provider
-chain](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials).
-
-### Necessary permissions
-When executed in "automatic" mode, the bootstrap command will require the
-current identity to have the following permissions:
-
-**Policy-related:**
-- `iam:GetPolicy` wildcard ("*") or the policy to be retrieved: Used to identify
-  if a policy already exists to update it.
-- `iam.ListPolicyVersions`: wildcard ("*") or the policy to be retrieved: Used
-  to identify if the policy exceeds the policy versions limit;
-- `iam:CreatePolicy` wildcard ("*") or policy that will be created: Used when
-  the policy doesn’t exist.
-- `iam:DeletePolicyVersion` wildcard ("*") or policy that will be created: Used
-  when the policy exceeds the version’s limit. It will then delete the oldest
-  non-default version.
-- `iam:CreatePolicyVersion` wildcard ("*") or policy that will be created: Used
-  when the policy already exists and will be updated;
-
-**Identity-related:**
-- `iam:AttachUserPolicy` wildcard ("*") or provided user identity: Needed to
-  attach the policy to the user. Only necessary when attaching policies to a
-  user;
-- `iam:AttachRolePolicy` wildcard ("*") or provided role identity: Needed to
-  attach the policy to the role. Only necessary when attaching policies to a
-  role;
-- `iam:PutUserPermissionsBoundary` wildcard ("*") or provided user identity:
-  Needed to attach boundary policy to the user. Only necessary when attaching
-  policies to a user;
-- `iam:PutRolePermissionsBoundary` wildcard ("*") or provided role identity:
-  Needed to attach boundary policy to the role. Only necessary when attaching
-  policies to a role;
-
-### IAM policies
-The IAM policies created by the bootstrap command will follow the AWS
-recommendation of [least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege),
-meaning that the Teleport database access policies will be granted permissions
-based on the agent configuration. For example, the policy won’t include
-RDS/Aurora permissions if the agent only has Redshift databases configured.
-
-#### RDS databases and Aurora clusters
-If the configuration has any static RDS/Aurora database or auto-discovery
-enabled, the following permissions will be added:
-
-- `rds:DescribeDBInstances`: Is a list operation, only supporting wildcard resources;
-- `rds:ModifyDBInstance`: Since the databases that will be modified are only
-  known during the discovery process or configured using dynamic registration,
-  we need wildcard access;
-- `rds:DescribeDBClusters`: Is a list operation, only supporting wildcard
-  resources;
-- `rds:ModifyDBCluster`: Since the clusters that will be modified are only known
-  during the discovery process or configured using dynamic registration, we
-  need wildcard access;
-
-##### Boundary
-- `rds-db:connect`: The list of database/clusters the Teleport agent will
-  connect to is only known after the discovery; we need wildcard access;
-
-#### Redshift clusters
-If the configuration has any static Redshift cluster or auto-discovery enabled,
-the following permissions will be added:
-
-- `redshift:DescribeClusters`: Is a list operation, only supporting wildcard
-  resources.
-
-##### Boundary
-- `redshift:GetClusterCredentials`: The list of clusters the Teleport agent will
-  get credentials to is only known after the discovery or configured using
-  dynamic registration; we need wildcard access;
diff --git a/rfd/0056-sql-backend.md b/rfd/0056-sql-backend.md
deleted file mode 100644
index d4d792611703c..0000000000000
--- a/rfd/0056-sql-backend.md
+++ /dev/null
@@ -1,137 +0,0 @@
----
-authors: Jim Bishopp (jim@goteleport.com)
-state: draft
----
-
-# RFD 56 - SQL Backend
-
-
-## What
-
-A Teleport Backend is a pluggable interface for storing core cluster state.
-This RFD proposes the addition of a new backend supporting SQL database platforms.
-The initial supported platforms for the SQL Backend will be PostgreSQL and 
-CockroachDB. Support will include self-hosted PostgreSQL/CockroachDB or 
-hosting the database on a cloud provider platform (AWS/GCP).
-
-
-## Why
-
-Supporting a SQL Backend reduces onboarding time for Teleport customers by
-allowing them to use existing infrastructure.
-
-
-## Scope
-
-This RFD focuses on implementing a SQL Backend for PostgreSQL and CockroachDB
-where the database is either self-hosted or cloud-hosted. The implementation's 
-design will be extensible to allow future work that supports other SQL databases
-such as MySQL.
-
-Cloud-hosted configurations will support AWS RDS/Aurora/Redshift and GCP Cloud SQL.
-
-The implementation will support connecting to a single endpoint. Failover to
-a secondary endpoint will not be supported but may be considered in a future
-proposal.
-
-
-## Authentication
-
-Self-hosted configurations will require mutual TLS authentication using
-user-generated client certificates. The user's CA, client certificate, and
-client key must be added to the Teleport configuration file. Users must ensure
-the provided CA is trusted by the host where the Teleport authentication server
-is running.
-
-AWS and GCP cloud-hosted configurations require IAM. Teleport uses the
-default credential provider for both AWS and GCP to authenticate using IAM.
-
-Mutual TLS authentication is optionally supported for GCP Cloud SQL.
-Paths to a client certificate and key must be added to the Teleport
-configuration file to enable mTLS.
-
-
-## UX
-
-Teleport users must first configure the instance and database where Teleport will 
-store its data. A new database instance and user must be created. The new user
-should be granted ownership of the new database and have the ability to login.
-And cloud-hosted configurations must configure and enable IAM.
-
-Once the database instance and user are created, Teleport users must enable the
-SQL Backend by configuring the storage section in the Teleport configuration
-file. Setting the storage type to either `postgres` or `cockroachdb` enables the
-SQL Backend. Additional configurations may apply depending on whether the
-configuration is for self-hosted or cloud-hosted environments.
-
-```yaml
-teleport:
-  storage:
-    # Type of storage backend (postgres or cockroachdb).
-    type: postgres
-
-    # Database connection address.
-    addr: "postgres.example.com:5432"
-
-    # Optional database name that Teleport will use to store its data.
-    # Defaults to "teleport". The database must not be shared.
-    database: "teleport"
-
-    # TLS validation and mutual authentication.
-    tls:
-      # Path to the CA file that Teleport will use to verify TLS connections.
-      ca_file: /var/lib/teleport/backend.ca.crt
-
-      # Paths to the client certificate and key Teleport will use for mutual
-      # TLS authentication. Required for self-hosted configurations. Optional
-      # for GCP Cloud SQL. Not supported for AWS.
-      client_cert_file: /var/lib/teleport/backend-client.crt
-      client_key_file: /var/lib/teleport/backend-client.key
-
-    # AWS specific configuration, only required for RDS/Aurora/Redshift.
-    aws:
-      # Region the database is deployed in.
-      region: "us-east-1"
-
-      # Redshift specific configuration (postgres only).
-      redshift:
-        # Redshift cluster identifier.
-        cluster_id: "redshift-cluster-1"
-
-    # GCP specific configuration, only required for Cloud SQL.
-    gcp:
-      # GCP project ID.
-      project_id: "xxx-1234"
-      # Cloud SQL instance ID.
-      instance_id: "example"
-```
-
-## Implementation Details
-
-Users can set the Teleport storage type to either `postgres` or `cockroachdb`.
-The initial implementation will use the same PostgreSQL driver for both settings.
-
-Future iterations of Teleport will be able to easily create a unique `cockroachdb`
-driver implementation if CockroachDB specific functionality is desired, such as
-using hash-sharded indexes, which are not available in PostgreSQL.
-
-### Transaction Isolation
-
-One difference between CockroachDB and PostgreSQL is how they handle transaction
-isolation. CockroachDB [always uses `SERIALIZABLE` isolation][1], which is the
-strongest of the [four transaction isolation levels][2].
-
-The `SERIALIZABLE` isolation level guarantees that even though transactions may
-execute in parallel, the result is the same as if they had executed one at a time,
-without any concurrency.
-
-The SQL Backend will enforce `SERIALIZABLE` transaction isolation for all database 
-platforms. The trade-off is data consistency versus slower execution and the need
-to retry transactions when a conflict occurs. Teleport's Backend interface assumes
-consistency. E.g. the `Create` function requires the new record does not exist, and
-`CompareAndSwap` requires the previous record has a specific value. Using
-`SERIALIZABLE` is the desirable isolation level for the majority of Teleport Backend 
-functionality.
-
-[1]: https://www.cockroachlabs.com/docs/stable/demo-serializable.html
-[2]: https://en.wikipedia.org/wiki/Isolation_(database_systems)#Isolation_levels
diff --git a/rfd/0060-gRPC-backend.md b/rfd/0060-gRPC-backend.md
deleted file mode 100644
index c5e9d7ff3443e..0000000000000
--- a/rfd/0060-gRPC-backend.md
+++ /dev/null
@@ -1,200 +0,0 @@
----
-authors: Michael McAllister (michael.mcallister@goteleport.com)
-state: draft
----
-
-# RFD 60 - gRPC Backend
-
-## What
-
-A new [backend](https://github.com/gravitational/teleport/tree/v8.3.1/lib/backend) that sends requests to a user defined gRPC server for persistence. Initially targeting cluster state with audit events to come later (in a subsequent RFD)
-
-## Why
-
-As Cloud-Hosted Teleport continues to grow, so does our need to have greater flexibility on not only what persistence layer we use (be it currently supported backends like DynamoDB, or otherwise) but _how_ these are implemented. 
-
-Take for instance, the current implementation of the [DynamoDB backend](https://github.com/gravitational/teleport/tree/v8.3.1/lib/backend/dynamo) which allows in its configuration to specify the table name, but does not presently have the ability to customize the Partition key. This means that it's not possible to co-locate multiple installations of Teleport within the same DynamoDB table, and as a result are bounded by [AWS account limits](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ServiceQuotas.html#limits-tables) when deploying multiple installations.
-
-Other backend solutions have their own challenges regarding authentication and authorization. For instance, most databases have limits on the number of users/roles that you can define which we'd need to leverage to ensure strong data isolation between each deployment. Using an authentication method that would allow one tenant to access another tenants data would be a non-option. 
-
-Implementing a gRPC client within Teleport allows not only the Cloud team, but external developers to implement:
- - A custom persistence layer that may not be supported by Teleport natively
- - Custom caching logic, connection pooling, etc.
- - Custom database schema, partition scheme, etc.
- - Custom authentication and authorization (mTLS, LDAP, etc.)
-
-## Details
-
-### Scope
-
-It is proposed that the Teleport core codebase hold the protocol buffer definitions and the corresponding client.
-
-To keep this RFD brief the Cloud teams (aspirational) implementation of the corresponding gRPC server is out of scope of this documentation and not discussed in detail, it will also be wholly owned by the Cloud team and not apart of the core codebase.
-
-Additionally audit events are initially outside of scope, but will be implemented at a later date.
-
-### Protobuf Definition
-
-The proposed protobuf definition aims to mirror the interface that is defined in [backend.go](https://github.com/gravitational/teleport/blob/cf162af679f3c136b0cc5a7c5bfcd8bba14afdaa/lib/backend/backend.go#L41-L91)
-
-```protobuf
-message Item {
-    // Key is a key of the key value item
-    bytes key = 1;
-
-    // Value is a value of the key value item
-    bytes value = 2;
-
-    // Expires is an optional record expiry time
-    google.protobuf.Timestamp expires = 3 [
-        (gogoproto.stdtime) = true,
-        (gogoproto.nullable) = false
-    ];
-
-    // ID is a record ID, newer records have newer ids
-    sfixed64 id = 4;
-
-    // LeaseID is a lease ID, could be set on objects with TTL
-    sfixed64 lease_id = 5;
-}
-
-message Lease {
-    // Key is a key of the key value item
-    bytes key = 1;
-
-    // ID is a record ID, newer records have newer ids
-    sfixed64 id = 2;
-}
-
-message Watch {
-    // resume_last_id is the last item index we saw, and we want to resume from any event after that point
-    sfixed64 resume_last_id = 1;
-}
-
-message CompareAndSwapRequest {
-    // Expected is the existing item
-    Item expected = 1;
-
-    // replace_with is the new item to swap
-    Item replace_with = 2;
-}
-
-message GetRequest {
-    // Key is a key of the key value item
-    bytes key = 1;
-}
-
-message GetRangeRequest {
-    // start_key is the starting key to request in the range request
-    bytes start_key = 1;
-
-    // end_key is the ending key to request in the range request
-    bytes end_key = 2;
-
-    // limit is the maximum number of results to return
-    int32 limit = 3;
-}
-
-message GetRangeResult {
-    repeated Item items = 1;
-}
-
-message DeleteRequest {
-    // Key is a key of the key value item
-    bytes key = 1;
-}
-
-message DeleteRangeRequest {
-    // start_key is the starting key to request in the range request
-    bytes start_key = 1;
-
-    // end_key is the ending key to request in the range request
-    bytes end_key = 2;
-}
-
-message KeepAliveRequest {
-    Lease lease = 1;
-    google.protobuf.Timestamp expires = 2 [
-        (gogoproto.stdtime) = true,
-        (gogoproto.nullable) = false
-    ];
-}
-
-
-message Event {
-   // OpType specifies operation type
-   enum OpType {
-      UNKNOWN = 0;
-      UNRELIABLE = 1;
-      INVALID = 2;
-      INIT = 3;
-      PUT = 4;
-      DELETE = 5;
-      GET = 6;
-   }
-   OpType type = 1;
-   Item item = 2;
-}
-
-service BackendService {
-    // Create creates item if it does not exist
-    rpc Create(Item) returns (Lease);
-
-    // Put upserts value into backend
-    rpc Put(Item) returns (Lease);
-
-    // CompareAndSwap compares item with existing item and replaces is with replace_with item
-    rpc CompareAndSwap(CompareAndSwapRequest) returns (Lease);
-
-    // Update updates value in the backend
-    rpc Update(Item) returns (Lease);
-
-    // Get returns a single item or not found error
-    rpc Get(GetRequest) returns (Item);
-
-    // GetRange returns query range
-    rpc GetRange(GetRangeRequest) returns (GetRangeResult);
-
-    // Delete deletes item by key, returns NotFound error if item does not exist
-    rpc Delete(DeleteRequest) returns (google.protobuf.Empty);
-
-    // DeleteRange deletes range of items with keys between startKey and endKey
-    rpc DeleteRange(DeleteRangeRequest) returns (google.protobuf.Empty);
-
-    // KeepAlive keeps object from expiring, updates lease on the existing object,
-	 // expires contains the new expiry to set on the lease,
-	 // some backends may ignore expires based on the implementation
-	 // in case if the lease managed server side
-    rpc KeepAlive(KeepAliveRequest) returns (google.protobuf.Empty);
-
-    // NewWatcher returns a new event watcher
-    rpc NewWatcher(Watch) returns (stream Event);
-}
-```
-
-### Configuration
-
-In order for the gRPC client (the Teleport side) to be able to talk to a server, at minimum the address of the server providing the gRPC service will be required, additionally the following existing configuration properties will be reused:
-
-- buffer size for client size buffering 
-- mTLS details (CA, Cert, Key) (currently used for etcd)
-
-Representing this in yaml the storage stanza of the configuration could potentially look like:
-```yaml
-storage:
-   type: grpc
-   server: endpoint.example.com:1992
-   tls_ca_file: /secrets/grpc/ca.crt
-   tls_cert_file: /secrets/grpc/tls.crt
-   tls_key_file:  /secrets/tls.key
-   audit_events_uri: ['dynamodb://example-ddb-table.events'] # Future iteration will support grpc://endpoint.example.com:1992
-   audit_sessions_uri: s3://example-bucket/sessions
-   continuous_backups: true
-   auto_scaling: true
-   read_min_capacity: 20
-   read_max_capacity: 100
-   read_target_value: 50.0
-   write_min_capacity: 10
-   write_max_capacity: 100
-   write_target_value: 70.0
-```
\ No newline at end of file
diff --git a/tool/tbot/botfs/botfs.go b/tool/tbot/botfs/botfs.go
deleted file mode 100644
index ceacbb49fd071..0000000000000
--- a/tool/tbot/botfs/botfs.go
+++ /dev/null
@@ -1,156 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package botfs
-
-import (
-	"io/fs"
-	"os"
-	"os/user"
-	"runtime"
-	"strconv"
-	"syscall"
-
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/constants"
-	"github.com/gravitational/trace"
-	"github.com/sirupsen/logrus"
-)
-
-var log = logrus.WithFields(logrus.Fields{
-	trace.Component: teleport.ComponentTBot,
-})
-
-// SymlinksMode is an enum type listing various symlink behavior modes.
-type SymlinksMode string
-
-const (
-	// SymlinksInsecure does allow resolving symlink paths and does not issue
-	// any symlink-related warnings.
-	SymlinksInsecure SymlinksMode = "insecure"
-
-	// SymlinksTrySecure attempts to write files securely and avoid symlink
-	// attacks, but falls back with a warning if the necessary OS / kernel
-	// support is missing.
-	SymlinksTrySecure SymlinksMode = "try-secure"
-
-	// SymlinksSecure attempts to write files securely and fails with an error
-	// if the operation fails. This should be the default on systems where we
-	// expect it to be supported.
-	SymlinksSecure SymlinksMode = "secure"
-)
-
-// ACLMode is an enum type listing various ACL behavior modes.
-type ACLMode string
-
-const (
-	// ACLOff disables ACLs
-	ACLOff ACLMode = "off"
-
-	// ACLTry attempts to use ACLs but falls back to no ACLs with a warning if
-	// unavailable.
-	ACLTry ACLMode = "try"
-
-	// ACLRequired enables ACL support and fails if ACLs are unavailable.
-	ACLRequired ACLMode = "required"
-)
-
-const (
-	// DefaultMode is the preferred permissions mode for bot files.
-	DefaultMode fs.FileMode = 0600
-
-	// DefaultDirMode is the preferred permissions mode for bot directories.
-	// Directories need the execute bit set for most operations on their
-	// contents to succeed.
-	DefaultDirMode fs.FileMode = 0700
-)
-
-// ACLOptions contains parameters needed to configure ACLs
-type ACLOptions struct {
-	// BotUser is the bot user that should have write access to this entry
-	BotUser *user.User
-
-	// ReaderUser is the user that should have read access to the file. This
-	// may be nil if the reader user is not known.
-	ReaderUser *user.User
-}
-
-// openStandard attempts to open the given path for writing with O_CREATE set.
-func openStandard(path string) (*os.File, error) {
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, DefaultMode)
-	if err != nil {
-		return nil, trace.ConvertSystemError(err)
-	}
-
-	return file, nil
-}
-
-// createStandard creates an empty file or directory at the given path without
-// attempting to prevent symlink attacks.
-func createStandard(path string, isDir bool) error {
-	if isDir {
-		if err := os.Mkdir(path, DefaultDirMode); err != nil {
-			return trace.ConvertSystemError(err)
-		}
-
-		return nil
-	}
-
-	f, err := openStandard(path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	if err := f.Close(); err != nil {
-		log.Warnf("Failed to close file at %q: %+v", path, err)
-	}
-
-	return nil
-}
-
-// GetOwner attempts to retrieve the owner of the given file. This is not
-// supported on all platforms and will return a trace.NotImplemented in that
-// case.
-func GetOwner(fileInfo fs.FileInfo) (*user.User, error) {
-	info, ok := fileInfo.Sys().(*syscall.Stat_t)
-	if !ok {
-		return nil, trace.NotImplemented("Cannot verify file ownership on this platform.")
-	}
-
-	user, err := user.LookupId(strconv.Itoa(int(info.Uid)))
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return user, nil
-}
-
-// IsOwnedBy checks that the file at the given path is owned by the given user.
-// Returns a trace.NotImplemented() on unsupported platforms.
-func IsOwnedBy(fileInfo fs.FileInfo, user *user.User) (bool, error) {
-	if runtime.GOOS == constants.WindowsOS {
-		// no-op on windows
-		return false, trace.NotImplemented("Cannot verify file ownership on this platform.")
-	}
-
-	info, ok := fileInfo.Sys().(*syscall.Stat_t)
-	if !ok {
-		return false, trace.NotImplemented("Cannot verify file ownership on this platform.")
-	}
-
-	// Our files are 0600, so don't bother checking gid.
-	return strconv.Itoa(int(info.Uid)) == user.Uid, nil
-}
diff --git a/tool/tbot/botfs/fs_linux.go b/tool/tbot/botfs/fs_linux.go
deleted file mode 100644
index 835fc6ab0ca95..0000000000000
--- a/tool/tbot/botfs/fs_linux.go
+++ /dev/null
@@ -1,450 +0,0 @@
-//go:build linux
-// +build linux
-
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package botfs
-
-import (
-	"io"
-	"io/fs"
-	"os"
-	"os/user"
-	"path/filepath"
-	"sync"
-
-	"github.com/coreos/go-semver/semver"
-	"github.com/gravitational/teleport/lib/utils"
-	"github.com/gravitational/trace"
-	"github.com/joshlf/go-acl"
-	"golang.org/x/sys/unix"
-)
-
-// Openat2MinKernel is the kernel release that adds support for the openat2()
-// syscall.
-const Openat2MinKernel = "5.6.0"
-
-// modeACLReadExecute is the permissions mode needed for read on directories.
-const modeACLReadExecute fs.FileMode = 05
-
-// modeACLReadWrite is the lower 3 bytes of a UNIX file mode for permission
-// bits, i.e. just one r/w/x.
-const modeACLReadWrite fs.FileMode = 06
-
-// modeACLReadWriteExecute is the permissions mode needed for full rwx on
-// directories.
-const modeACLReadWriteExecute fs.FileMode = 07
-
-// modeACLNone is the UNIX file mode for no permissions, used for group and
-// world read/write.
-const modeACLNone fs.FileMode = 0
-
-// missingSyscallWarning is used to reduce log spam when a syscall is missing.
-var missingSyscallWarning sync.Once
-
-// openSecure opens the given path for writing (with O_CREAT, mode 0600)
-// with the RESOLVE_NO_SYMLINKS flag set.
-func openSecure(path string) (*os.File, error) {
-	how := unix.OpenHow{
-		// Equivalent to 0600. Unfortunately it's not worth reusing our
-		// default file mode constant here.
-		Mode:    unix.O_RDONLY | unix.S_IRUSR | unix.S_IWUSR,
-		Flags:   unix.O_RDWR | unix.O_CREAT,
-		Resolve: unix.RESOLVE_NO_SYMLINKS,
-	}
-
-	fd, err := unix.Openat2(unix.AT_FDCWD, path, &how)
-	if err != nil {
-		// note: returning the original error here for comparison purposes
-		return nil, err
-	}
-
-	// os.File.Close() appears to close wrapped files sanely, so rely on that
-	// rather than relying on callers to use unix.Close(fd)
-	return os.NewFile(uintptr(fd), filepath.Base(path)), nil
-}
-
-// openSymlinks mode opens the file for read/write using the given symlink
-// mode, potentially failing or logging a warning if symlinks can't be
-// secured.
-func openSymlinksMode(path string, symlinksMode SymlinksMode) (*os.File, error) {
-	var file *os.File
-	var err error
-
-	switch symlinksMode {
-	case SymlinksSecure:
-		file, err = openSecure(path)
-		if err == unix.ENOSYS {
-			return nil, trace.Errorf("openSecure(%q) failed due to missing "+
-				"syscall; `symlinks: insecure` may be required for this "+
-				"system", path)
-		} else if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	case SymlinksTrySecure:
-		file, err = openSecure(path)
-		if err == unix.ENOSYS {
-			log.Warnf("Failed to write to %q securely due to missing "+
-				"syscall; falling back to regular file write. Set "+
-				"`symlinks: insecure` on this destination to disable this "+
-				"warning.", path)
-			file, err = openStandard(path)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-		} else if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	case SymlinksInsecure:
-		file, err = openStandard(path)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-	default:
-		return nil, trace.BadParameter("invalid symlinks mode %q", symlinksMode)
-	}
-
-	return file, nil
-}
-
-// createStandard creates an empty file or directory at the given path while
-// attempting to prevent symlink attacks.
-func createSecure(path string, isDir bool) error {
-	if isDir {
-		// We can't specify RESOLVE_NO_SYMLINKS for mkdir. This isn't the end
-		// of the world, though: if an attacker attempts a symlink attack we'll
-		// just open the correct file for read/write later (and error when it
-		// doesn't exist).
-		if err := os.Mkdir(path, DefaultDirMode); err != nil {
-			return trace.Wrap(err)
-		}
-
-		return nil
-	}
-
-	f, err := openSecure(path)
-	if err == unix.ENOSYS {
-		// bubble up the original error for comparison
-		return err
-	} else if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// No writing to do, just close it.
-	if err := f.Close(); err != nil {
-		log.Warnf("Failed to close file at %q: %+v", path, err)
-	}
-
-	return nil
-}
-
-// Create attempts to create the given file or directory with the given
-// symlinks mode.
-func Create(path string, isDir bool, symlinksMode SymlinksMode) error {
-	// Implementation note: paranoid file _creation_ is only really useful for
-	// providing an early warning if openat2() / ACLs are unsupported on the
-	// host system, as it will catch compatibility issues during `tbot init`.
-	// Read() and Write() with Symlinks(Try)Secure are the codepaths that
-	// actually prevents symlink attacks.
-
-	switch symlinksMode {
-	case SymlinksSecure:
-		if err := createSecure(path, isDir); err != nil {
-			if err == unix.ENOSYS {
-				return trace.Errorf("createSecure(%q) failed due to missing "+
-					"syscall; `symlinks: insecure` may be required for this "+
-					"system", path)
-			}
-
-			return trace.Wrap(err)
-		}
-	case SymlinksTrySecure:
-		err := createSecure(path, isDir)
-		if err == nil {
-			// All good, move on.
-			return nil
-		}
-
-		if err != unix.ENOSYS {
-			// Something else went wrong, fail.
-			return trace.Wrap(err)
-		}
-
-		// It's a bit gross to stuff this sync.Once into a global, but
-		// hopefully that's forgivable since it just manages a log message.
-		missingSyscallWarning.Do(func() {
-			log.Warnf("Failed to create %q securely due to missing syscall; "+
-				"falling back to regular file creation. Set `symlinks: "+
-				"insecure` on this destination to disable this warning.", path)
-		})
-
-		return trace.Wrap(createStandard(path, isDir))
-	case SymlinksInsecure:
-		return trace.Wrap(createStandard(path, isDir))
-	default:
-		return trace.BadParameter("invalid symlinks mode %q", symlinksMode)
-	}
-
-	return nil
-}
-
-// Read reads the contents of the given file into memory.
-func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
-	file, err := openSymlinksMode(path, symlinksMode)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	defer file.Close()
-
-	data, err := io.ReadAll(file)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return data, nil
-}
-
-// Write stores the given data to the file at the given path.
-func Write(path string, data []byte, symlinksMode SymlinksMode) error {
-	file, err := openSymlinksMode(path, symlinksMode)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	defer file.Close()
-
-	if _, err := file.Write(data); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
-// desiredPerms determines the desired bot permissions for an artifact at
-// the given path. Directories require read/exec, files require read/write.
-func desiredPerms(path string) (ownerMode fs.FileMode, botAndReaderMode fs.FileMode, err error) {
-	stat, err := os.Stat(path)
-	if err != nil {
-		return 0, 0, trace.Wrap(err)
-	}
-
-	botAndReaderMode = modeACLReadWrite
-	ownerMode = modeACLReadWrite
-	if stat.IsDir() {
-		botAndReaderMode = modeACLReadExecute
-		ownerMode = modeACLReadWriteExecute
-	}
-
-	return
-}
-
-// VerifyACL verifies whether the ACL of the given file allows writes from the
-// bot user. Errors may optionally be used as more informational warnings;
-// ConfigureACL can be used to correct them, assuming the user has permissions.
-func VerifyACL(path string, opts *ACLOptions) error {
-	current, err := acl.Get(path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	stat, err := os.Stat(path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	owner, err := GetOwner(stat)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	ownerMode, botAndReaderMode, err := desiredPerms(path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Attempt to determine the max # of expected user tags. We can't know the
-	// reader user in all cases because we only know it during `tbot init`, so
-	// instead we'll try to determine the upper bound of expected entries here.
-	maxExpectedUserTags := 2
-	if owner.Uid == opts.BotUser.Uid {
-		// This path is owned by the bot user, so at least one user tag will
-		// be missing.
-		maxExpectedUserTags--
-	}
-
-	// Also determine the minimum number of expected user tags. There should
-	// generally be at least 1 unless all users are the same.
-	minExpectedUserTags := 0
-	if owner.Uid != opts.BotUser.Uid {
-		minExpectedUserTags++
-	}
-	if opts.ReaderUser != nil && owner.Uid != opts.ReaderUser.Uid {
-		minExpectedUserTags++
-	}
-
-	userTagCount := 0
-	errors := []error{}
-
-	for _, entry := range current {
-		switch entry.Tag {
-		case acl.TagUserObj:
-			if entry.Perms != ownerMode {
-				errors = append(errors, trace.BadParameter("user entry has improper permissions %d", entry.Perms))
-			}
-		case acl.TagGroupObj:
-			if entry.Perms != modeACLNone {
-				errors = append(errors, trace.BadParameter("group entry has improper permissions %d", entry.Perms))
-			}
-		case acl.TagOther:
-			if entry.Perms != modeACLNone {
-				errors = append(errors, trace.BadParameter("other entry has improper permissions %d", entry.Perms))
-			}
-		case acl.TagMask:
-			if entry.Perms != botAndReaderMode {
-				errors = append(errors, trace.BadParameter("mask entry has improper permissions %d", entry.Perms))
-			}
-		case acl.TagGroup:
-			// Group tags currently not allowed.
-			errors = append(errors, trace.BadParameter("unexpected group entry found"))
-		case acl.TagUser:
-			userTagCount++
-
-			// It's only worth checking the qualifiers if we know all expected
-			// values in advance. We can't know them at bot runtime in any way
-			// that isn't also subject to e.g. an attacker with root / owner
-			// access, so we might as well not spam warnings every time we
-			// verify the ACLs. We'll have to rely on the tag counter instead.
-			if opts.BotUser != nil &&
-				opts.ReaderUser != nil &&
-				entry.Qualifier != opts.BotUser.Uid &&
-				entry.Qualifier != opts.ReaderUser.Uid {
-				errors = append(errors, trace.BadParameter("invalid qualifier %q for user entry", entry.Qualifier))
-			}
-
-			if entry.Perms != botAndReaderMode {
-				errors = append(errors, trace.BadParameter("invalid permissions %q for bot user entry", entry.Perms))
-			}
-		}
-	}
-
-	if userTagCount > maxExpectedUserTags {
-		errors = append(errors, trace.BadParameter("too many user tags found"))
-	} else if userTagCount < minExpectedUserTags {
-		errors = append(errors, trace.BadParameter("too few user tags found"))
-	}
-
-	return trace.NewAggregate(errors...)
-}
-
-// ConfigureACL configures ACLs of the given file to allow writes from the bot
-// user.
-func ConfigureACL(path string, owner *user.User, opts *ACLOptions) error {
-	if owner.Uid == opts.BotUser.Uid && owner.Uid == opts.ReaderUser.Uid {
-		// We'll end up with an empty ACL. This isn't technically a problem
-		log.Warnf("The owner, bot, and reader all appear to be the same "+
-			"user (%+v). This is an unusual configuration: consider setting "+
-			"`acls: off` in the destination config to remove this warning.",
-			owner.Username)
-	}
-
-	// We fully specify the ACL here to ensure the correct permissions are
-	// always set (rather than just appending an "allow" for the bot user).
-	// Note: These need to be sorted by tag value.
-	ownerMode, botAndReaderMode, err := desiredPerms(path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Note: ACL entries need to be ordered per acl_linux entryPriority
-	desiredACL := acl.ACL{
-		{
-			// Note: Mask does not apply to user object.
-			Tag:   acl.TagUserObj,
-			Perms: ownerMode,
-		},
-	}
-
-	// Only add an entry for the bot user if it isn't the owner.
-	if owner.Uid != opts.BotUser.Uid {
-		desiredACL = append(desiredACL, acl.Entry{
-			// Entry to allow the bot to read/write.
-			Tag:       acl.TagUser,
-			Qualifier: opts.BotUser.Uid,
-			Perms:     botAndReaderMode,
-		})
-	}
-
-	// Only add entry for the reader if it isn't the owner.
-	if owner.Uid != opts.ReaderUser.Uid {
-		desiredACL = append(desiredACL, acl.Entry{
-			// Entry to allow the reader user to read/write.
-			Tag:       acl.TagUser,
-			Qualifier: opts.ReaderUser.Uid,
-			Perms:     botAndReaderMode,
-		})
-	}
-
-	desiredACL = append(desiredACL,
-		acl.Entry{
-			Tag:   acl.TagGroupObj,
-			Perms: modeACLNone,
-		},
-		acl.Entry{
-			// Mask is the maximum permissions the ACL can grant. This should
-			// match the desired bot permissions.
-			Tag:   acl.TagMask,
-			Perms: botAndReaderMode,
-		},
-		acl.Entry{
-			Tag:   acl.TagOther,
-			Perms: modeACLNone,
-		},
-	)
-
-	// Note: we currently give both the bot and reader read/write to all the
-	// files. This is done for simplicity and shouldn't represent a security
-	// risk - the bot obviously knows the contents of the destination, and
-	// the files being writable to the reader is (maybe arguably) not a
-	// security issue.
-
-	log.Debugf("Configuring ACL on path %q: %v", path, desiredACL)
-	return trace.ConvertSystemError(trace.Wrap(acl.Set(path, desiredACL)))
-}
-
-// HasACLSupport determines if this binary / system supports ACLs.
-func HasACLSupport() (bool, error) {
-	// We just assume Linux _can_ support ACLs here, and will test for support
-	// at runtime.
-	return true, nil
-}
-
-// HasSecureWriteSupport determines if `CreateSecure()` should be supported
-// on this OS / kernel version. Note that it just checks the kernel version,
-// so this should be treated as a fallible hint.
-func HasSecureWriteSupport() (bool, error) {
-	minKernel := semver.New(Openat2MinKernel)
-	version, err := utils.KernelVersion()
-	if err != nil {
-		return false, trace.Wrap(err)
-	}
-	if version.LessThan(*minKernel) {
-		return false, nil
-	}
-
-	return true, nil
-}
diff --git a/tool/tbot/botfs/fs_other.go b/tool/tbot/botfs/fs_other.go
deleted file mode 100644
index 87b2b90e3721a..0000000000000
--- a/tool/tbot/botfs/fs_other.go
+++ /dev/null
@@ -1,113 +0,0 @@
-//go:build !linux
-// +build !linux
-
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package botfs
-
-import (
-	"io"
-	"os/user"
-
-	"github.com/gravitational/trace"
-)
-
-// Create attempts to create the given file or directory without
-// evaluating symlinks. This is only supported on recent Linux kernel versions
-// (5.6+). The resulting file permissions are unspecified; Chmod should be
-// called afterward.
-func Create(path string, isDir bool, symlinksMode SymlinksMode) error {
-	if symlinksMode == SymlinksSecure {
-		return trace.BadParameter("cannot write with `symlinks: secure` on unsupported platform")
-	}
-
-	return trace.Wrap(createStandard(path, isDir))
-}
-
-// Read reads the contents of the given file into memory.
-func Read(path string, symlinksMode SymlinksMode) ([]byte, error) {
-	switch symlinksMode {
-	case SymlinksSecure:
-		return nil, trace.BadParameter("cannot read with `symlinks: secure` on unsupported platform")
-	case SymlinksTrySecure:
-		log.Warn("Secure symlinks not supported on this platform, set `symlinks: insecure` to disable this message", path)
-	}
-
-	file, err := openStandard(path)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	defer file.Close()
-
-	data, err := io.ReadAll(file)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return data, nil
-}
-
-// Write stores the given data to the file at the given path.
-func Write(path string, data []byte, symlinksMode SymlinksMode) error {
-	switch symlinksMode {
-	case SymlinksSecure:
-		return trace.BadParameter("cannot write with `symlinks: secure` on unsupported platform")
-	case SymlinksTrySecure:
-		log.Warn("Secure symlinks not supported on this platform, set `symlinks: insecure` to disable this message", path)
-	}
-
-	file, err := openStandard(path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	defer file.Close()
-
-	if _, err := file.Write(data); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
-//nolint:staticcheck // staticcheck does not like our nop implementations.
-// VerifyACL verifies whether the ACL of the given file allows writes from the
-// bot user.
-func VerifyACL(path string, opts *ACLOptions) error {
-	return trace.NotImplemented("ACLs not supported on this platform")
-}
-
-//nolint:staticcheck // staticcheck does not like our nop implementations.
-// ConfigureACL configures ACLs of the given file to allow writes from the bot
-// user.
-func ConfigureACL(path string, owner *user.User, opts *ACLOptions) error {
-	return trace.NotImplemented("ACLs not supported on this platform")
-}
-
-// HasACLSupport determines if this binary / system supports ACLs. This
-// catch-all implementation just returns false.
-func HasACLSupport() (bool, error) {
-	return false, nil
-}
-
-// HasSecureWriteSupport determines if `CreateSecure()` should be supported
-// on this OS / kernel version. This is only supported on Linux, so this
-// catch-all implementation just returns false.
-func HasSecureWriteSupport() (bool, error) {
-	return false, nil
-}
diff --git a/tool/tbot/config/config.go b/tool/tbot/config/config.go
index a5a1523086f3b..b52a5bc21a2d1 100644
--- a/tool/tbot/config/config.go
+++ b/tool/tbot/config/config.go
@@ -34,7 +34,6 @@ import (
 const (
 	DefaultCertificateTTL = 60 * time.Minute
 	DefaultRenewInterval  = 20 * time.Minute
-	DefaultJoinMethod     = "token"
 )
 
 var log = logrus.WithFields(logrus.Fields{
@@ -61,9 +60,9 @@ type CLIConf struct {
 	// Token is a bot join token.
 	Token string
 
-	// RenewalInterval is the interval at which certificates are renewed, as a
+	// RenewInterval is the interval at which certificates are renewed, as a
 	// time.ParseDuration() string. It must be less than the certificate TTL.
-	RenewalInterval time.Duration
+	RenewInterval time.Duration
 
 	// CertificateTTL is the requested TTL of certificates. It should be some
 	// multiple of the renewal interval to allow for failed renewals.
@@ -72,29 +71,6 @@ type CLIConf struct {
 	// JoinMethod is the method the bot should use to exchange a token for the
 	// initial certificate
 	JoinMethod string
-
-	// Oneshot controls whether the bot quits after a single renewal.
-	Oneshot bool
-
-	// InitDir specifies which destination to initialize if multiple are
-	// configured.
-	InitDir string
-
-	// BotUser is a Unix username that should be given permission to write
-	BotUser string
-
-	// ReaderUser is the Unix username that will be reading the files
-	ReaderUser string
-
-	// Owner is the user:group that will own the destination files. Due to SSH
-	// restrictions on key permissions, it cannot be the same as the reader
-	// user. If ACL support is unused or unavailable, the reader user will own
-	// files directly.
-	Owner string
-
-	// Clean is a flag that, if set, instructs `tbot init` to remove existing
-	// unexpected files.
-	Clean bool
 }
 
 // OnboardingConfig contains values only required on first connect.
@@ -103,7 +79,7 @@ type OnboardingConfig struct {
 	Token string `yaml:"token"`
 
 	// CAPath is an optional path to a CA certificate.
-	CAPath string `yaml:"ca_path"`
+	CAPath string
 
 	// CAPins is a list of certificate authority pins, used to validate the
 	// connection to the Teleport auth server.
@@ -117,21 +93,16 @@ type OnboardingConfig struct {
 // BotConfig is the bot's root config object.
 type BotConfig struct {
 	Onboarding   *OnboardingConfig    `yaml:"onboarding,omitempty"`
-	Storage      *StorageConfig       `yaml:"storage,omitempty"`
+	Storage      StorageConfig        `yaml:"storage,omitempty"`
 	Destinations []*DestinationConfig `yaml:"destinations,omitempty"`
 
-	Debug           bool          `yaml:"debug"`
-	AuthServer      string        `yaml:"auth_server"`
-	CertificateTTL  time.Duration `yaml:"certificate_ttl"`
-	RenewalInterval time.Duration `yaml:"renewal_interval"`
-	Oneshot         bool          `yaml:"oneshot"`
+	Debug          bool          `yaml:"debug"`
+	AuthServer     string        `yaml:"auth_server"`
+	CertificateTTL time.Duration `yaml:"certificate_ttl"`
+	RenewInterval  time.Duration `yaml:"renew_interval"`
 }
 
 func (conf *BotConfig) CheckAndSetDefaults() error {
-	if conf.Storage == nil {
-		conf.Storage = &StorageConfig{}
-	}
-
 	if err := conf.Storage.CheckAndSetDefaults(); err != nil {
 		return trace.Wrap(err)
 	}
@@ -142,43 +113,21 @@ func (conf *BotConfig) CheckAndSetDefaults() error {
 		}
 	}
 
+	if conf.AuthServer == "" {
+		return trace.BadParameter("an auth server address must be configured")
+	}
+
 	if conf.CertificateTTL == 0 {
 		conf.CertificateTTL = DefaultCertificateTTL
 	}
 
-	if conf.RenewalInterval == 0 {
-		conf.RenewalInterval = DefaultRenewInterval
+	if conf.RenewInterval == 0 {
+		conf.RenewInterval = DefaultRenewInterval
 	}
 
 	return nil
 }
 
-// GetDestinationByPath attempts to fetch a destination by its filesystem path.
-// Only valid for filesystem destinations; returns nil if no matching
-// destination exists.
-func (conf *BotConfig) GetDestinationByPath(path string) (*DestinationConfig, error) {
-	for _, dest := range conf.Destinations {
-		destImpl, err := dest.GetDestination()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		destDir, ok := destImpl.(*DestinationDirectory)
-		if !ok {
-			continue
-		}
-
-		// Note: this compares only paths as written in the config file. We
-		// might want to compare .Abs() if that proves to be confusing (though
-		// this may have its own problems)
-		if destDir.Path == path {
-			return dest, nil
-		}
-	}
-
-	return nil, nil
-}
-
 // NewDefaultConfig creates a new minimal bot configuration from defaults.
 // CheckAndSetDefaults() will be called.
 func NewDefaultConfig(authServer string) (*BotConfig, error) {
@@ -214,10 +163,6 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 		config.Debug = true
 	}
 
-	if cf.Oneshot {
-		config.Oneshot = true
-	}
-
 	if cf.AuthServer != "" {
 		if config.AuthServer != "" {
 			log.Warnf("CLI parameters are overriding auth server configured in %s", cf.ConfigPath)
@@ -232,22 +177,20 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 		config.CertificateTTL = cf.CertificateTTL
 	}
 
-	if cf.RenewalInterval != 0 {
-		if config.RenewalInterval != 0 {
+	if cf.RenewInterval != 0 {
+		if config.RenewInterval != 0 {
 			log.Warnf("CLI parameters are overriding renewal interval configured in %s", cf.ConfigPath)
 		}
-		config.RenewalInterval = cf.RenewalInterval
+		config.RenewInterval = cf.RenewInterval
 	}
 
 	// DataDir overrides any previously-configured storage config
 	if cf.DataDir != "" {
-		if config.Storage != nil {
-			if _, err := config.Storage.GetDestination(); err != nil {
-				log.Warnf("CLI parameters are overriding storage location from %s", cf.ConfigPath)
-			}
+		if _, err := config.Storage.GetDestination(); err != nil {
+			log.Warnf("CLI parameters are overriding storage location from %s", cf.ConfigPath)
 		}
 
-		config.Storage = &StorageConfig{
+		config.Storage = StorageConfig{
 			DestinationMixin: DestinationMixin{
 				Directory: &DestinationDirectory{
 					Path: cf.DataDir,
@@ -277,9 +220,9 @@ func FromCLIConf(cf *CLIConf) (*BotConfig, error) {
 	// (CAPath, CAPins, etc follow different codepaths so we don't want a
 	// situation where different fields become set weirdly due to struct
 	// merging)
-	if cf.Token != "" || len(cf.CAPins) > 0 || cf.JoinMethod != DefaultJoinMethod {
+	if cf.Token != "" || len(cf.CAPins) > 0 || cf.JoinMethod != "" {
 		onboarding := config.Onboarding
-		if onboarding != nil && (onboarding.Token != "" || onboarding.CAPath != "" || len(onboarding.CAPins) > 0) || cf.JoinMethod != DefaultJoinMethod {
+		if onboarding != nil && (onboarding.Token != "" || onboarding.CAPath != "" || len(onboarding.CAPins) > 0) || cf.JoinMethod != "" {
 			// To be safe, warn about possible confusion.
 			log.Warnf("CLI parameters are overriding onboarding config from %s", cf.ConfigPath)
 		}
diff --git a/tool/tbot/config/config_destination.go b/tool/tbot/config/config_destination.go
index 8e986a824a8a1..fbe4e89fde87a 100644
--- a/tool/tbot/config/config_destination.go
+++ b/tool/tbot/config/config_destination.go
@@ -17,17 +17,23 @@ limitations under the License.
 package config
 
 import (
-	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/gravitational/trace"
 )
 
+type Kind string
+
+const (
+	KindSSH Kind = "ssh"
+	KindTLS Kind = "tls"
+)
+
 // DestinationConfig configures a user certificate destination.
 type DestinationConfig struct {
 	DestinationMixin `yaml:",inline"`
 
-	Roles   []string                `yaml:"roles,omitempty"`
-	Kinds   []identity.ArtifactKind `yaml:"kinds,omitempty"`
-	Configs []TemplateConfig        `yaml:"configs,omitempty"`
+	Roles   []string         `yaml:"roles,omitempty"`
+	Kinds   []Kind           `yaml:"kinds,omitempty"`
+	Configs []TemplateConfig `yaml:"configs,omitempty"`
 }
 
 // destinationDefaults applies defaults for an output sink's destination. Since
@@ -46,7 +52,7 @@ func (dc *DestinationConfig) CheckAndSetDefaults() error {
 	// time
 
 	if len(dc.Kinds) == 0 && len(dc.Configs) == 0 {
-		dc.Kinds = []identity.ArtifactKind{identity.KindSSH}
+		dc.Kinds = []Kind{KindSSH}
 		dc.Configs = []TemplateConfig{{
 			SSHClient: &TemplateSSHClient{},
 		}}
@@ -62,7 +68,7 @@ func (dc *DestinationConfig) CheckAndSetDefaults() error {
 }
 
 // ContainsKind determines if this destination contains the given ConfigKind.
-func (dc *DestinationConfig) ContainsKind(kind identity.ArtifactKind) bool {
+func (dc *DestinationConfig) ContainsKind(kind Kind) bool {
 	for _, k := range dc.Kinds {
 		if k == kind {
 			return true
diff --git a/tool/tbot/config/config_test.go b/tool/tbot/config/config_test.go
index 9d583a480ed1f..c2147e5bba8e1 100644
--- a/tool/tbot/config/config_test.go
+++ b/tool/tbot/config/config_test.go
@@ -21,8 +21,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/coreos/go-semver/semver"
-	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/stretchr/testify/require"
 )
 
@@ -31,7 +29,7 @@ func TestConfigDefaults(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, DefaultCertificateTTL, cfg.CertificateTTL)
-	require.Equal(t, DefaultRenewInterval, cfg.RenewalInterval)
+	require.Equal(t, DefaultRenewInterval, cfg.RenewInterval)
 
 	storageDest, err := cfg.Storage.GetDestination()
 	require.NoError(t, err)
@@ -75,7 +73,7 @@ func TestConfigCLIOnlySample(t *testing.T) {
 	// A single default destination should exist
 	require.Len(t, cfg.Destinations, 1)
 	dest := cfg.Destinations[0]
-	require.ElementsMatch(t, []identity.ArtifactKind{identity.KindSSH}, dest.Kinds)
+	require.ElementsMatch(t, []Kind{KindSSH}, dest.Kinds)
 
 	require.Len(t, dest.Configs, 1)
 	template := dest.Configs[0]
@@ -94,7 +92,7 @@ func TestConfigFile(t *testing.T) {
 	require.NoError(t, err)
 
 	require.Equal(t, "auth.example.com", cfg.AuthServer)
-	require.Equal(t, time.Minute*5, cfg.RenewalInterval)
+	require.Equal(t, time.Minute*5, cfg.RenewInterval)
 
 	require.NotNil(t, cfg.Onboarding)
 	require.Equal(t, "foo", cfg.Onboarding.Token)
@@ -109,7 +107,7 @@ func TestConfigFile(t *testing.T) {
 	require.Len(t, cfg.Destinations, 1)
 	destination := cfg.Destinations[0]
 
-	require.ElementsMatch(t, []identity.ArtifactKind{identity.KindSSH, identity.KindTLS}, destination.Kinds)
+	require.ElementsMatch(t, []Kind{KindSSH, KindTLS}, destination.Kinds)
 
 	require.Len(t, destination.Configs, 1)
 	template := destination.Configs[0]
@@ -126,53 +124,9 @@ func TestConfigFile(t *testing.T) {
 	require.Equal(t, "/tmp/foo", destImplReal.Path)
 }
 
-func TestParseSSHVersion(t *testing.T) {
-	tests := []struct {
-		str     string
-		version *semver.Version
-		err     bool
-	}{
-		{
-			str:     "OpenSSH_8.2p1 Ubuntu-4ubuntu0.4, OpenSSL 1.1.1f  31 Mar 2020",
-			version: semver.New("8.2.1"),
-		},
-		{
-			str:     "OpenSSH_8.8p1, OpenSSL 1.1.1m  14 Dec 2021",
-			version: semver.New("8.8.1"),
-		},
-		{
-			str:     "OpenSSH_7.5p1, OpenSSL 1.0.2s-freebsd  28 May 2019",
-			version: semver.New("7.5.1"),
-		},
-		{
-			str:     "OpenSSH_7.9p1 Raspbian-10+deb10u2, OpenSSL 1.1.1d  10 Sep 2019",
-			version: semver.New("7.9.1"),
-		},
-		{
-			// Couldn't find a full example but in theory patch is optional:
-			str:     "OpenSSH_8.1 foo",
-			version: semver.New("8.1.0"),
-		},
-		{
-			str: "Teleport v8.0.0-dev.40 git:v8.0.0-dev.40-0-ge9194c256 go1.17.2",
-			err: true,
-		},
-	}
-
-	for _, test := range tests {
-		version, err := parseSSHVersion(test.str)
-		if test.err {
-			require.Error(t, err)
-		} else {
-			require.NoError(t, err)
-			require.True(t, version.Equal(*test.version), "got version = %v, want = %v", version, test.version)
-		}
-	}
-}
-
 const exampleConfigFile = `
 auth_server: auth.example.com
-renewal_interval: 5m
+renew_interval: 5m
 onboarding:
   token: foo
   ca_pins:
diff --git a/tool/tbot/config/configtemplate.go b/tool/tbot/config/configtemplate.go
index f54e86a6ee165..b281a6344eaef 100644
--- a/tool/tbot/config/configtemplate.go
+++ b/tool/tbot/config/configtemplate.go
@@ -21,6 +21,7 @@ import (
 	"strings"
 
 	"github.com/gravitational/teleport/lib/auth"
+	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/gravitational/trace"
 	"gopkg.in/yaml.v3"
@@ -41,6 +42,10 @@ type FileDescription struct {
 	// IsDir designates whether this describes a subdirectory inside the
 	// destination.
 	IsDir bool
+
+	// ModeHint describes the intended permissions for this data, for
+	// Destination backends where permissions are relevant.
+	ModeHint destination.ModeHint
 }
 
 // Template defines functions for dynamically writing additional files to
diff --git a/tool/tbot/config/configtemplate_ssh.go b/tool/tbot/config/configtemplate_ssh.go
index 2c8f7da6d9550..f0daae845b5d3 100644
--- a/tool/tbot/config/configtemplate_ssh.go
+++ b/tool/tbot/config/configtemplate_ssh.go
@@ -17,22 +17,19 @@ limitations under the License.
 package config
 
 import (
-	"bytes"
 	"context"
 	"fmt"
 	"os"
-	"os/exec"
 	"path/filepath"
-	"regexp"
 	"strconv"
 	"strings"
 	"text/template"
 
-	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
@@ -44,66 +41,6 @@ type TemplateSSHClient struct {
 	ProxyPort uint16 `yaml:"proxy_port"`
 }
 
-// openSSHVersionRegex is a regex used to parse OpenSSH version strings.
-var openSSHVersionRegex = regexp.MustCompile(`^OpenSSH_(?P<major>\d+)\.(?P<minor>\d+)(?:p(?P<patch>\d+))?`)
-
-// openSSHMinVersionForRSAWorkaround is the OpenSSH version after which the
-// RSA deprecation workaround should be added to generated ssh_config.
-var openSSHMinVersionForRSAWorkaround = semver.New("8.5.0")
-
-// parseSSHVersion attempts to parse
-func parseSSHVersion(versionString string) (*semver.Version, error) {
-	versionTokens := strings.Split(versionString, " ")
-	if len(versionTokens) == 0 {
-		return nil, trace.BadParameter("invalid version string: %s", versionString)
-	}
-
-	versionID := versionTokens[0]
-	matches := openSSHVersionRegex.FindStringSubmatch(versionID)
-	if matches == nil {
-		return nil, trace.BadParameter("cannot parse version string: %q", versionID)
-	}
-
-	major, err := strconv.Atoi(matches[1])
-	if err != nil {
-		return nil, trace.Wrap(err, "invalid major version number: %s", matches[1])
-	}
-
-	minor, err := strconv.Atoi(matches[2])
-	if err != nil {
-		return nil, trace.Wrap(err, "invalid minor version number: %s", matches[2])
-	}
-
-	patch := 0
-	if matches[3] != "" {
-		patch, err = strconv.Atoi(matches[3])
-		if err != nil {
-			return nil, trace.Wrap(err, "invalid patch version number: %s", matches[3])
-		}
-	}
-
-	return &semver.Version{
-		Major: int64(major),
-		Minor: int64(minor),
-		Patch: int64(patch),
-	}, nil
-}
-
-// getSSHVersion attempts to query the system SSH for its current version.
-func getSSHVersion() (*semver.Version, error) {
-	var out bytes.Buffer
-
-	cmd := exec.Command("ssh", "-V")
-	cmd.Stderr = &out
-
-	err := cmd.Run()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return parseSSHVersion(out.String())
-}
-
 func (c *TemplateSSHClient) CheckAndSetDefaults() error {
 	if c.ProxyPort == 0 {
 		c.ProxyPort = defaults.SSHProxyListenPort
@@ -114,16 +51,18 @@ func (c *TemplateSSHClient) CheckAndSetDefaults() error {
 func (c *TemplateSSHClient) Describe() []FileDescription {
 	return []FileDescription{
 		{
-			Name: "ssh_config",
+			Name:     "ssh_config",
+			ModeHint: destination.ModeHintSecret,
 		},
 		{
-			Name: "known_hosts",
+			Name:     "known_hosts",
+			ModeHint: destination.ModeHintSecret,
 		},
 	}
 }
 
 func (c *TemplateSSHClient) Render(ctx context.Context, authClient auth.ClientI, currentIdentity *identity.Identity, destination *DestinationConfig) error {
-	if !destination.ContainsKind(identity.KindSSH) {
+	if !destination.ContainsKind(KindSSH) {
 		return trace.BadParameter("%s config template requires kind `ssh` to be enabled", TemplateSSHClientName)
 	}
 
@@ -165,7 +104,7 @@ func (c *TemplateSSHClient) Render(ctx context.Context, authClient auth.ClientI,
 		dataDir = ""
 	}
 
-	knownHosts, err := fetchKnownHosts(ctx, authClient, clusterName.GetClusterName(), proxyHost)
+	knownHosts, err := fetchKnownHosts(authClient, clusterName.GetClusterName(), proxyHost)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -175,31 +114,18 @@ func (c *TemplateSSHClient) Render(ctx context.Context, authClient auth.ClientI,
 		return trace.Wrap(err)
 	}
 
-	// Default to including the RSA deprecation workaround.
-	rsaWorkaround := true
-	version, err := getSSHVersion()
-	if err != nil {
-		log.WithError(err).Debugf("Could not determine SSH version, will include RSA workaround.")
-	} else if version.LessThan(*openSSHMinVersionForRSAWorkaround) {
-		log.Debugf("OpenSSH version %s does not require workaround for RSA deprecation", version)
-		rsaWorkaround = false
-	} else {
-		log.Debugf("OpenSSH version %s will use workaround for RSA deprecation", version)
-	}
-
 	var sshConfigBuilder strings.Builder
 	identityFilePath := filepath.Join(dataDir, identity.PrivateKeyKey)
 	certificateFilePath := filepath.Join(dataDir, identity.SSHCertKey)
 	sshConfigPath := filepath.Join(dataDir, "ssh_config")
 	if err := sshConfigTemplate.Execute(&sshConfigBuilder, sshConfigParameters{
-		ClusterName:          clusterName.GetClusterName(),
-		ProxyHost:            proxyHost,
-		ProxyPort:            proxyPort,
-		KnownHostsPath:       knownHostsPath,
-		IdentityFilePath:     identityFilePath,
-		CertificateFilePath:  certificateFilePath,
-		SSHConfigPath:        sshConfigPath,
-		IncludeRSAWorkaround: rsaWorkaround,
+		ClusterName:         clusterName.GetClusterName(),
+		ProxyHost:           proxyHost,
+		ProxyPort:           proxyPort,
+		KnownHostsPath:      knownHostsPath,
+		IdentityFilePath:    identityFilePath,
+		CertificateFilePath: certificateFilePath,
+		SSHConfigPath:       sshConfigPath,
 	}); err != nil {
 		return trace.Wrap(err)
 	}
@@ -219,15 +145,6 @@ type sshConfigParameters struct {
 	ProxyHost           string
 	ProxyPort           string
 	SSHConfigPath       string
-
-	// IncludeRSAWorkaround controls whether the RSA deprecation workaround is
-	// included in the generated configuration. Newer versions of OpenSSH
-	// deprecate RSA certificates and, due to a bug in golang's ssh package,
-	// Teleport wrongly advertises its unaffected certificates as a
-	// now-deprecated certificate type. The workaround includes a config
-	// override to re-enable RSA certs for just Teleport hosts, however it is
-	// only supported on OpenSSH 8.5 and later.
-	IncludeRSAWorkaround bool
 }
 
 var sshConfigTemplate = template.Must(template.New("ssh-config").Parse(`
@@ -238,19 +155,19 @@ Host *.{{ .ClusterName }} {{ .ProxyHost }}
     UserKnownHostsFile "{{ .KnownHostsPath }}"
     IdentityFile "{{ .IdentityFilePath }}"
     CertificateFile "{{ .CertificateFilePath }}"
-    HostKeyAlgorithms ssh-rsa-cert-v01@openssh.com{{- if .IncludeRSAWorkaround }}
-    PubkeyAcceptedAlgorithms +ssh-rsa-cert-v01@openssh.com{{- end }}
+    HostKeyAlgorithms ssh-rsa-cert-v01@openssh.com
+    PubkeyAcceptedAlgorithms +ssh-rsa-cert-v01@openssh.com
 
 # Flags for all {{ .ClusterName }} hosts except the proxy
 Host *.{{ .ClusterName }} !{{ .ProxyHost }}
     Port 3022
-    ProxyCommand ssh -F {{ .SSHConfigPath }} -l %r -p {{ .ProxyPort }} {{ .ProxyHost }} -s proxy:$(echo %h | cut -d '.' -f 1):%p@{{ .ClusterName }}
+    ProxyCommand ssh -F {{ .SSHConfigPath }} -l %r -p {{ .ProxyPort }} {{ .ProxyHost }} -s proxy:%h:%p@{{ .ClusterName }}
 
 # End generated Teleport configuration
 `))
 
-func fetchKnownHosts(ctx context.Context, client auth.ClientI, clusterName, proxyHosts string) (string, error) {
-	ca, err := client.GetCertAuthority(ctx, types.CertAuthID{
+func fetchKnownHosts(client auth.ClientI, clusterName, proxyHosts string) (string, error) {
+	ca, err := client.GetCertAuthority(types.CertAuthID{
 		Type:       types.HostCA,
 		DomainName: clusterName,
 	}, false)
diff --git a/tool/tbot/config/destination.go b/tool/tbot/config/destination.go
index 6383ba82cc7a9..c72a8afb7aace 100644
--- a/tool/tbot/config/destination.go
+++ b/tool/tbot/config/destination.go
@@ -31,12 +31,12 @@ type DestinationMixin struct {
 
 type DestinationDefaults = func(*DestinationMixin) error
 
-// checkAndSetDefaultsInner performs member initialization that won't recurse
-func (dm *DestinationMixin) checkAndSetDefaultsInner() (int, error) {
+func (dm *DestinationMixin) CheckAndSetDefaults(applyDefaults DestinationDefaults) error {
 	notNilCount := 0
+
 	if dm.Directory != nil {
 		if err := dm.Directory.CheckAndSetDefaults(); err != nil {
-			return 0, trace.Wrap(err)
+			return trace.Wrap(err)
 		}
 
 		notNilCount++
@@ -44,35 +44,17 @@ func (dm *DestinationMixin) checkAndSetDefaultsInner() (int, error) {
 
 	if dm.Memory != nil {
 		if err := dm.Memory.CheckAndSetDefaults(); err != nil {
-			return 0, trace.Wrap(err)
+			return trace.Wrap(err)
 		}
 
 		notNilCount++
 	}
-	return notNilCount, nil
-}
-
-func (dm *DestinationMixin) CheckAndSetDefaults(applyDefaults DestinationDefaults) error {
-	notNilCount, err := dm.checkAndSetDefaultsInner()
-	if err != nil {
-		return trace.Wrap(err)
-	}
 
 	if notNilCount == 0 {
 		// use defaults
 		if err := applyDefaults(dm); err != nil {
 			return trace.Wrap(err)
 		}
-
-		// CheckAndSetDefaults() again
-		notNilCount, err := dm.checkAndSetDefaultsInner()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		if notNilCount == 0 {
-			return trace.BadParameter("a destination is required")
-		}
 	} else if notNilCount > 1 {
 		return trace.BadParameter("only one destination backend may be specified at a time")
 	}
diff --git a/tool/tbot/config/destination_directory.go b/tool/tbot/config/destination_directory.go
index b3b39cd7da38c..de09b82bcc8b0 100644
--- a/tool/tbot/config/destination_directory.go
+++ b/tool/tbot/config/destination_directory.go
@@ -19,19 +19,16 @@ package config
 import (
 	"fmt"
 	"os"
-	"os/user"
 	"path/filepath"
 
-	"github.com/gravitational/teleport/tool/tbot/botfs"
+	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/trace"
 	"gopkg.in/yaml.v3"
 )
 
 // DestinationDirectory is a Destination that writes to the local filesystem
 type DestinationDirectory struct {
-	Path     string             `yaml:"path,omitempty"`
-	Symlinks botfs.SymlinksMode `yaml:"symlinks,omitempty"`
-	ACLs     botfs.ACLMode      `yaml:"acls,omitempty"`
+	Path string `yaml:"path,omitempty"`
 }
 
 func (dd *DestinationDirectory) UnmarshalYAML(node *yaml.Node) error {
@@ -61,142 +58,23 @@ func (dd *DestinationDirectory) CheckAndSetDefaults() error {
 		return trace.BadParameter("destination path must not be empty")
 	}
 
-	secureSupported, err := botfs.HasSecureWriteSupport()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	aclsSupported, err := botfs.HasACLSupport()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	switch dd.Symlinks {
-	case "":
-		if secureSupported {
-			// We expect Openat2 to be available, so try to use it by default.
-			dd.Symlinks = botfs.SymlinksSecure
-		} else {
-			// TrySecure will print a warning on fallback.
-			dd.Symlinks = botfs.SymlinksTrySecure
-		}
-	case botfs.SymlinksInsecure, botfs.SymlinksTrySecure:
-		// valid
-	case botfs.SymlinksSecure:
-		if !secureSupported {
-			return trace.BadParameter("symlink mode %q not supported on this system", dd.Symlinks)
-		}
-	default:
-		return trace.BadParameter("invalid symlinks mode: %q", dd.Symlinks)
-	}
-
-	switch dd.ACLs {
-	case "":
-		if aclsSupported {
-			// Unlike openat2(), we can't ever depend on ACLs being available.
-			// We'll only ever try to use them, end users can opt-in to a hard
-			// ACL check if they wish.
-			dd.ACLs = botfs.ACLTry
-		} else {
-			// if aclsSupported == false here, we know it will never work, so
-			// don't bother trying.
-			dd.ACLs = botfs.ACLOff
-		}
-	case botfs.ACLOff, botfs.ACLTry:
-		// valid
-	case botfs.ACLRequired:
-		if !aclsSupported {
-			return trace.BadParameter("acls mode %q not supported on this system", dd.ACLs)
-		}
-	default:
-		return trace.BadParameter("invalid acls mode: %q", dd.ACLs)
-	}
-
 	return nil
 }
 
-func (dd *DestinationDirectory) Init() error {
-	// Create the directory if needed.
-	stat, err := os.Stat(dd.Path)
-	if trace.IsNotFound(err) {
-		if err := os.MkdirAll(dd.Path, botfs.DefaultDirMode); err != nil {
-			return trace.Wrap(err)
-		}
-		log.Infof("Created directory %q", dd.Path)
-	} else if err != nil {
+func (dd *DestinationDirectory) Write(name string, data []byte, modeHint destination.ModeHint) error {
+	// TODO: honor modeHint?
+	if err := os.WriteFile(filepath.Join(dd.Path, name), data, 0600); err != nil {
 		return trace.Wrap(err)
-	} else if !stat.IsDir() {
-		return trace.BadParameter("Path %q already exists and is not a directory", dd.Path)
 	}
-
 	return nil
 }
 
-func (dd *DestinationDirectory) Verify(keys []string) error {
-	aclsSupported, err := botfs.HasACLSupport()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	currentUser, err := user.Current()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	stat, err := os.Stat(dd.Path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	ownedByBot, err := botfs.IsOwnedBy(stat, currentUser)
-	if trace.IsNotImplemented(err) {
-		// If file owners aren't supported, ACLs certainly aren't. Just bail.
-		// (Subject to change if we ever try to support Windows ACLs.)
-		return nil
-	} else if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Make sure it's worth warning about ACLs for this destination. If ACLs
-	// are disabled, unsupported, or the destination is owned by the bot
-	// (implying the user is not trying to use ACLs), just bail.
-	if dd.ACLs == botfs.ACLOff || !aclsSupported || ownedByBot {
-		return nil
-	}
-
-	errors := []error{}
-	for _, key := range keys {
-		path := filepath.Join(dd.Path, key)
-
-		errors = append(errors, botfs.VerifyACL(path, &botfs.ACLOptions{
-			BotUser: currentUser,
-		}))
-	}
-
-	aggregate := trace.NewAggregate(errors...)
-	if dd.ACLs == botfs.ACLRequired {
-		// Hard fail if ACLs are specifically requested and there are errors.
-		return aggregate
-	}
-
-	if aggregate != nil {
-		log.Warnf("Destination %q has unexpected ACLs: %v", dd.Path, aggregate)
-	}
-
-	return nil
-}
-
-func (dd *DestinationDirectory) Write(name string, data []byte) error {
-	return trace.Wrap(botfs.Write(filepath.Join(dd.Path, name), data, dd.Symlinks))
-}
-
 func (dd *DestinationDirectory) Read(name string) ([]byte, error) {
-	data, err := botfs.Read(filepath.Join(dd.Path, name), dd.Symlinks)
+	b, err := os.ReadFile(filepath.Join(dd.Path, name))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-
-	return data, nil
+	return b, nil
 }
 
 func (dd *DestinationDirectory) String() string {
diff --git a/tool/tbot/config/destination_memory.go b/tool/tbot/config/destination_memory.go
index 2778bc838a52e..1cacbb61a9fe1 100644
--- a/tool/tbot/config/destination_memory.go
+++ b/tool/tbot/config/destination_memory.go
@@ -17,6 +17,7 @@ limitations under the License.
 package config
 
 import (
+	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/trace"
 	"gopkg.in/yaml.v3"
 )
@@ -50,17 +51,7 @@ func (dm *DestinationMemory) CheckAndSetDefaults() error {
 	return nil
 }
 
-func (dm *DestinationMemory) Init() error {
-	// Nothing to do.
-	return nil
-}
-
-func (dm *DestinationMemory) Verify(keys []string) error {
-	// Nothing to do.
-	return nil
-}
-
-func (dm *DestinationMemory) Write(name string, data []byte) error {
+func (dm *DestinationMemory) Write(name string, data []byte, _ destination.ModeHint) error {
 	dm.store[name] = data
 
 	return nil
diff --git a/tool/tbot/destination/destination.go b/tool/tbot/destination/destination.go
index 3ad0ca5358b3d..093ce60bf71b6 100644
--- a/tool/tbot/destination/destination.go
+++ b/tool/tbot/destination/destination.go
@@ -16,20 +16,23 @@ limitations under the License.
 
 package destination
 
-// Destination can persist renewable certificates.
-type Destination interface {
-	// Init attempts to initialize this destination for writing. Init should be
-	// idempotent and may write informational log messages if resources are
-	// created.
-	Init() error
+// ModeHint is a backend-agnostic file mode hint.
+type ModeHint int64
+
+const (
+	// ModeHintUnspecified hints that files should be created with default
+	// (possibly insecure) permissions.
+	ModeHintUnspecified ModeHint = iota
 
-	// Verify is run before renewals to check for any potential problems with
-	// the destination. These errors may be informational (logged warnings) or
-	// return an error that may potentially terminate the process.
-	Verify(keys []string) error
+	// ModeHintSecret hints that files should be created with restricted
+	// permissions, appropriate for secret data.
+	ModeHintSecret
+)
 
+// Destination can persist renewable certificates.
+type Destination interface {
 	// Write stores data to the destination with the given name.
-	Write(name string, data []byte) error
+	Write(name string, data []byte, modeHint ModeHint) error
 
 	// Read fetches data from the destination with a given name.
 	Read(name string) ([]byte, error)
diff --git a/tool/tbot/identity/artifact.go b/tool/tbot/identity/artifact.go
deleted file mode 100644
index 840c491500a13..0000000000000
--- a/tool/tbot/identity/artifact.go
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
-Copyright 2021-2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package identity
-
-import (
-	"bytes"
-
-	"github.com/gravitational/teleport/api/client/proto"
-)
-
-// Artifact is a component of a serialized identity.
-type Artifact struct {
-	Key       string
-	Kind      ArtifactKind
-	ToBytes   func(*Identity) []byte
-	FromBytes func(*proto.Certs, *LoadIdentityParams, []byte)
-}
-
-// Matches returns true if this artifact's Kind matches any one of the given
-// kinds or if it's kind is KindAlways
-func (a *Artifact) Matches(kinds ...ArtifactKind) bool {
-	if a.Kind == KindAlways {
-		return true
-	}
-
-	for _, kind := range kinds {
-		if a.Kind == kind {
-			return true
-		}
-	}
-
-	return false
-}
-
-var artifacts = []Artifact{
-	// SSH artifacts
-	{
-		Key:  SSHCertKey,
-		Kind: KindSSH,
-		ToBytes: func(i *Identity) []byte {
-			return i.CertBytes
-		},
-		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
-			c.SSH = b
-		},
-	},
-	{
-		Key:  SSHCACertsKey,
-		Kind: KindSSH,
-		ToBytes: func(i *Identity) []byte {
-			return bytes.Join(i.SSHCACertBytes, []byte("$"))
-		},
-		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
-			c.SSHCACerts = bytes.Split(b, []byte("$"))
-		},
-	},
-
-	// TLS artifacts
-	{
-		Key:  TLSCertKey,
-		Kind: KindTLS,
-		ToBytes: func(i *Identity) []byte {
-			return i.TLSCertBytes
-		},
-		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
-			c.TLS = b
-		},
-	},
-	{
-		Key:  TLSCACertsKey,
-		Kind: KindTLS,
-		ToBytes: func(i *Identity) []byte {
-			return bytes.Join(i.TLSCACertsBytes, []byte("$"))
-		},
-		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
-			c.TLSCACerts = bytes.Split(b, []byte("$"))
-		},
-	},
-
-	// Common artifacts
-	{
-		Key:  PrivateKeyKey,
-		Kind: KindAlways,
-		ToBytes: func(i *Identity) []byte {
-			return i.PrivateKeyBytes
-		},
-		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
-			p.PrivateKeyBytes = b
-		},
-	},
-	{
-		Key:  PublicKeyKey,
-		Kind: KindAlways,
-		ToBytes: func(i *Identity) []byte {
-			return i.PublicKeyBytes
-		},
-		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
-			p.PublicKeyBytes = b
-		},
-	},
-	{
-		// The token hash is used to detect changes to the token and
-		// request a new identity when changes are detected.
-		Key:  TokenHashKey,
-		Kind: KindBotInternal,
-		ToBytes: func(i *Identity) []byte {
-			return i.TokenHashBytes
-		},
-		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
-			p.TokenHashBytes = b
-		},
-	},
-	{
-		// The write test is used to ensure the destination is writable before
-		// attempting a renewal.
-		Key:  WriteTestKey,
-		Kind: KindAlways,
-		ToBytes: func(i *Identity) []byte {
-			// always empty
-			return []byte{}
-		},
-		FromBytes: func(c *proto.Certs, p *LoadIdentityParams, b []byte) {
-			// nothing to do
-		},
-	},
-}
-
-func GetArtifacts() []Artifact {
-	return artifacts
-}
diff --git a/tool/tbot/identity/identity.go b/tool/tbot/identity/identity.go
index 33cd4a050d936..b71ad535266a8 100644
--- a/tool/tbot/identity/identity.go
+++ b/tool/tbot/identity/identity.go
@@ -17,6 +17,7 @@ limitations under the License.
 package identity
 
 import (
+	"bytes"
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
@@ -56,12 +57,8 @@ const (
 	// PublicKeyKey is the ssh public key, required for successful SSH connections.
 	PublicKeyKey = "key.pub"
 
-	// TokenHashKey is the key where a hash of the onboarding token will be stored.
-	TokenHashKey = "tokenhash"
-
-	// WriteTestKey is the key for a file used to check that the destination is
-	// writable.
-	WriteTestKey = ".write-test"
+	// MetadataKey is the name under which additional metadata exists in a destination.
+	MetadataKey = "meta"
 )
 
 var log = logrus.WithFields(logrus.Fields{
@@ -72,10 +69,10 @@ var log = logrus.WithFields(logrus.Fields{
 // identity. This is derived from Teleport's usual auth.Identity with small
 // modifications to work with user rather than host certificates.
 type Identity struct {
-	// PrivateKeyBytes is a PEM encoded private key
-	PrivateKeyBytes []byte
-	// PublicKeyBytes contains bytes of the original SSH public key
-	PublicKeyBytes []byte
+	// KeyBytes is a PEM encoded private key
+	KeyBytes []byte
+	// SSHPublicKeyBytes contains bytes of the original SSH public key
+	SSHPublicKeyBytes []byte
 	// CertBytes is a PEM encoded SSH host cert
 	CertBytes []byte
 	// TLSCertBytes is a PEM encoded TLS x509 client certificate
@@ -87,39 +84,19 @@ type Identity struct {
 	SSHCACertBytes [][]byte
 	// KeySigner is an SSH host certificate signer
 	KeySigner ssh.Signer
-	// SSHCert is a parsed SSH certificate
-	SSHCert *ssh.Certificate
-	// X509Cert is an X509 client certificate
-	X509Cert *x509.Certificate
+	// Cert is a parsed SSH certificate
+	Cert *ssh.Certificate
+	// XCert is X509 client certificate
+	XCert *x509.Certificate
 	// ClusterName is a name of host's cluster
 	ClusterName string
-	// TokenHashBytes is the hash of the original join token
-	TokenHashBytes []byte
-}
-
-// LoadIdentityParams contains parameters beyond proto.Certs needed to load a
-// stored identity.
-type LoadIdentityParams struct {
-	PrivateKeyBytes []byte
-	PublicKeyBytes  []byte
-	TokenHashBytes  []byte
-}
-
-// Params returns the LoadIdentityParams for this Identity, which are the
-// local-only parameters to be carried over to a renewed identity.
-func (i *Identity) Params() *LoadIdentityParams {
-	return &LoadIdentityParams{
-		PrivateKeyBytes: i.PrivateKeyBytes,
-		PublicKeyBytes:  i.PublicKeyBytes,
-		TokenHashBytes:  i.TokenHashBytes,
-	}
 }
 
 // String returns user-friendly representation of the identity.
 func (i *Identity) String() string {
 	var out []string
-	if i.X509Cert != nil {
-		out = append(out, fmt.Sprintf("cert(%v issued by %v:%v)", i.X509Cert.Subject.CommonName, i.X509Cert.Issuer.CommonName, i.X509Cert.Issuer.SerialNumber))
+	if i.XCert != nil {
+		out = append(out, fmt.Sprintf("cert(%v issued by %v:%v)", i.XCert.Subject.CommonName, i.XCert.Issuer.CommonName, i.XCert.Issuer.SerialNumber))
 	}
 	for j := range i.TLSCACertsBytes {
 		cert, err := tlsca.ParseCertificatePEM(i.TLSCACertsBytes[j])
@@ -167,7 +144,7 @@ func (i *Identity) HasTLSConfig() bool {
 
 // HasPrincipals returns whether identity has principals
 func (i *Identity) HasPrincipals(additionalPrincipals []string) bool {
-	set := utils.StringsSet(i.SSHCert.ValidPrincipals)
+	set := utils.StringsSet(i.Cert.ValidPrincipals)
 	for _, principal := range additionalPrincipals {
 		if _, ok := set[principal]; !ok {
 			return false
@@ -178,10 +155,10 @@ func (i *Identity) HasPrincipals(additionalPrincipals []string) bool {
 
 // HasDNSNames returns true if TLS certificate has required DNS names
 func (i *Identity) HasDNSNames(dnsNames []string) bool {
-	if i.X509Cert == nil {
+	if i.XCert == nil {
 		return false
 	}
-	set := utils.StringsSet(i.X509Cert.DNSNames)
+	set := utils.StringsSet(i.XCert.DNSNames)
 	for _, dnsName := range dnsNames {
 		if _, ok := set[dnsName]; !ok {
 			return false
@@ -197,7 +174,7 @@ func (i *Identity) TLSConfig(cipherSuites []uint16) (*tls.Config, error) {
 	if !i.HasTLSConfig() {
 		return nil, trace.NotFound("no TLS credentials setup for this identity")
 	}
-	tlsCert, err := tls.X509KeyPair(i.TLSCertBytes, i.PrivateKeyBytes)
+	tlsCert, err := tls.X509KeyPair(i.TLSCertBytes, i.KeyBytes)
 	if err != nil {
 		return nil, trace.BadParameter("failed to parse private key: %v", err)
 	}
@@ -234,208 +211,185 @@ func (i *Identity) SSHClientConfig() (*ssh.ClientConfig, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if len(i.SSHCert.ValidPrincipals) < 1 {
+	if len(i.Cert.ValidPrincipals) < 1 {
 		return nil, trace.BadParameter("user cert has no valid principals")
 	}
 	return &ssh.ClientConfig{
-		User:            i.SSHCert.ValidPrincipals[0],
+		User:            i.Cert.ValidPrincipals[0],
 		Auth:            []ssh.AuthMethod{ssh.PublicKeys(i.KeySigner)},
 		HostKeyCallback: callback,
 		Timeout:         apidefaults.DefaultDialTimeout,
 	}, nil
 }
 
-// ReadIdentityFromStore reads stored identity credentials
-func ReadIdentityFromStore(params *LoadIdentityParams, certs *proto.Certs, kinds ...ArtifactKind) (*Identity, error) {
-	var identity Identity
-	if ContainsKind(KindSSH, kinds) {
-		if len(certs.SSH) == 0 {
-			return nil, trace.BadParameter("identity requires SSH certificates but they are unset")
-		}
-
-		err := ReadSSHIdentityFromKeyPair(&identity, params.PrivateKeyBytes, params.PrivateKeyBytes, certs.SSH)
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		if len(certs.SSHCACerts) != 0 {
-			identity.SSHCACertBytes = certs.SSHCACerts
-		}
+// ReadIdentityFromKeyPair reads SSH and TLS identity from key pair.
+func ReadIdentityFromKeyPair(privateKey []byte, publicKey []byte, certs *proto.Certs) (*Identity, error) {
+	identity, err := ReadSSHIdentityFromKeyPair(privateKey, publicKey, certs.SSH)
+	if err != nil {
+		return nil, trace.Wrap(err)
 	}
 
-	if ContainsKind(KindTLS, kinds) {
-		if len(certs.TLSCACerts) == 0 || len(certs.TLS) == 0 {
-			return nil, trace.BadParameter("identity requires TLS certificates but they are empty")
-		}
+	if len(certs.SSHCACerts) != 0 {
+		identity.SSHCACertBytes = certs.SSHCACerts
+	}
 
+	if len(certs.TLSCACerts) != 0 {
 		// Parse the key pair to verify that identity parses properly for future use.
-		if err := ReadTLSIdentityFromKeyPair(&identity, params.PrivateKeyBytes, certs.TLS, certs.TLSCACerts); err != nil {
+		i, err := ReadTLSIdentityFromKeyPair(privateKey, certs.TLS, certs.TLSCACerts)
+		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+		identity.XCert = i.XCert
+		identity.TLSCertBytes = certs.TLS
+		identity.TLSCACertsBytes = certs.TLSCACerts
 	}
 
-	identity.PublicKeyBytes = params.PublicKeyBytes
-	identity.PrivateKeyBytes = params.PrivateKeyBytes
-	identity.TokenHashBytes = params.TokenHashBytes
-
-	return &identity, nil
+	return identity, nil
 }
 
 // ReadTLSIdentityFromKeyPair reads TLS identity from key pair
-func ReadTLSIdentityFromKeyPair(identity *Identity, keyBytes, certBytes []byte, caCertsBytes [][]byte) error {
+func ReadTLSIdentityFromKeyPair(keyBytes, certBytes []byte, caCertsBytes [][]byte) (*Identity, error) {
 	if len(keyBytes) == 0 {
-		return trace.BadParameter("missing private key")
+		return nil, trace.BadParameter("missing private key")
 	}
 
 	if len(certBytes) == 0 {
-		return trace.BadParameter("missing certificate")
+		return nil, trace.BadParameter("missing certificate")
 	}
 
 	cert, err := tlsca.ParseCertificatePEM(certBytes)
 	if err != nil {
-		return trace.Wrap(err, "failed to parse TLS certificate")
+		return nil, trace.Wrap(err, "failed to parse TLS certificate")
 	}
 
 	if len(cert.Issuer.Organization) == 0 {
-		return trace.BadParameter("missing CA organization")
+		return nil, trace.BadParameter("missing CA organization")
 	}
 
 	clusterName := cert.Issuer.Organization[0]
 	if clusterName == "" {
-		return trace.BadParameter("misssing cluster name")
+		return nil, trace.BadParameter("misssing cluster name")
+	}
+	identity := &Identity{
+		ClusterName:     clusterName,
+		KeyBytes:        keyBytes,
+		TLSCertBytes:    certBytes,
+		TLSCACertsBytes: caCertsBytes,
+		XCert:           cert,
 	}
-
-	identity.ClusterName = clusterName
-	identity.PrivateKeyBytes = keyBytes
-	identity.TLSCertBytes = certBytes
-	identity.TLSCACertsBytes = caCertsBytes
-	identity.X509Cert = cert
-
 	// The passed in ciphersuites don't appear to matter here since the returned
 	// *tls.Config is never actually used?
 	_, err = identity.TLSConfig(utils.DefaultCipherSuites())
 	if err != nil {
-		return trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
-	return nil
+	return identity, nil
 }
 
 // ReadSSHIdentityFromKeyPair reads identity from initialized keypair
-func ReadSSHIdentityFromKeyPair(identity *Identity, keyBytes, publicKeyBytes, certBytes []byte) error {
+func ReadSSHIdentityFromKeyPair(keyBytes, publicKeyBytes, certBytes []byte) (*Identity, error) {
 	if len(keyBytes) == 0 {
-		return trace.BadParameter("PrivateKey: missing private key")
+		return nil, trace.BadParameter("PrivateKey: missing private key")
 	}
 
 	if len(publicKeyBytes) == 0 {
-		return trace.BadParameter("PublicKey: missing public key")
+		return nil, trace.BadParameter("PublicKey: missing public key")
 	}
 
 	if len(certBytes) == 0 {
-		return trace.BadParameter("Cert: missing parameter")
+		return nil, trace.BadParameter("Cert: missing parameter")
 	}
 
 	cert, err := apisshutils.ParseCertificate(certBytes)
 	if err != nil {
-		return trace.BadParameter("failed to parse server certificate: %v", err)
+		return nil, trace.BadParameter("failed to parse server certificate: %v", err)
 	}
 
 	signer, err := ssh.ParsePrivateKey(keyBytes)
 	if err != nil {
-		return trace.BadParameter("failed to parse private key: %v", err)
+		return nil, trace.BadParameter("failed to parse private key: %v", err)
 	}
 	// this signer authenticates using certificate signed by the cert authority
 	// not only by the public key
 	certSigner, err := ssh.NewCertSigner(cert, signer)
 	if err != nil {
-		return trace.BadParameter("unsupported private key: %v", err)
+		return nil, trace.BadParameter("unsupported private key: %v", err)
 	}
 
 	// check principals on certificate
 	if len(cert.ValidPrincipals) < 1 {
-		return trace.BadParameter("valid principals: at least one valid principal is required")
+		return nil, trace.BadParameter("valid principals: at least one valid principal is required")
 	}
 	for _, validPrincipal := range cert.ValidPrincipals {
 		if validPrincipal == "" {
-			return trace.BadParameter("valid principal can not be empty: %q", cert.ValidPrincipals)
+			return nil, trace.BadParameter("valid principal can not be empty: %q", cert.ValidPrincipals)
 		}
 	}
 
 	clusterName := cert.Permissions.Extensions[teleport.CertExtensionTeleportRouteToCluster]
 	if clusterName == "" {
-		return trace.BadParameter("missing cert extension %v", utils.CertExtensionAuthority)
-	}
-
-	identity.ClusterName = clusterName
-	identity.PrivateKeyBytes = keyBytes
-	identity.PublicKeyBytes = publicKeyBytes
-	identity.CertBytes = certBytes
-	identity.KeySigner = certSigner
-	identity.SSHCert = cert
-
-	return nil
-}
-
-// VerifyWrite attempts to write to the .write-test artifact inside the given
-// destination. It should be called before attempting a renewal to help ensure
-// we won't then fail to save the identity.
-func VerifyWrite(dest destination.Destination) error {
-	return trace.Wrap(dest.Write(WriteTestKey, []byte{}))
-}
-
-// ListKeys returns a list of artifact keys that will be written given a list
-// of artifacts.
-func ListKeys(kinds ...ArtifactKind) []string {
-	keys := []string{}
-	for _, artifact := range GetArtifacts() {
-		if !artifact.Matches(kinds...) {
-			continue
-		}
-
-		keys = append(keys, artifact.Key)
+		return nil, trace.BadParameter("missing cert extension %v", utils.CertExtensionAuthority)
 	}
 
-	return keys
+	return &Identity{
+		ClusterName:       clusterName,
+		KeyBytes:          keyBytes,
+		SSHPublicKeyBytes: publicKeyBytes,
+		CertBytes:         certBytes,
+		KeySigner:         certSigner,
+		Cert:              cert,
+	}, nil
 }
 
 // SaveIdentity saves a bot identity to a destination.
-func SaveIdentity(id *Identity, d destination.Destination, kinds ...ArtifactKind) error {
-	for _, artifact := range GetArtifacts() {
-		// Only store artifacts matching one of the set kinds.
-		if !artifact.Matches(kinds...) {
-			continue
-		}
-
-		data := artifact.ToBytes(id)
-
-		log.Debugf("Writing %s", artifact.Key)
-		if err := d.Write(artifact.Key, data); err != nil {
-			return trace.WrapWithMessage(err, "could not write to %v", artifact.Key)
+func SaveIdentity(id *Identity, d destination.Destination) error {
+	for _, data := range []struct {
+		name     string
+		data     []byte
+		modeHint destination.ModeHint
+	}{
+		{TLSCertKey, id.TLSCertBytes, destination.ModeHintSecret},
+		{SSHCertKey, id.CertBytes, destination.ModeHintSecret},
+		{TLSCACertsKey, bytes.Join(id.TLSCACertsBytes, []byte("$")), destination.ModeHintSecret},
+		{SSHCACertsKey, bytes.Join(id.SSHCACertBytes, []byte("$")), destination.ModeHintSecret},
+		{PrivateKeyKey, id.KeyBytes, destination.ModeHintSecret},
+		{PublicKeyKey, id.SSHPublicKeyBytes, destination.ModeHintUnspecified},
+	} {
+		log.Debugf("Writing %s", data.name)
+		if err := d.Write(data.name, data.data, data.modeHint); err != nil {
+			return trace.Wrap(err, "could not write to %v", data.name)
 		}
 	}
-
 	return nil
 }
 
 // LoadIdentity loads a bot identity from a destination.
-func LoadIdentity(d destination.Destination, kinds ...ArtifactKind) (*Identity, error) {
+func LoadIdentity(d destination.Destination) (*Identity, error) {
+	var key, sshPublicKey, tlsCA, sshCA []byte
 	var certs proto.Certs
-	var params LoadIdentityParams
-
-	for _, artifact := range GetArtifacts() {
-		// Only attempt to load artifacts matching one of the specified kinds
-		if !artifact.Matches(kinds...) {
-			continue
-		}
-
-		data, err := d.Read(artifact.Key)
+	var err error
+
+	for _, item := range []struct {
+		name string
+		out  *[]byte
+	}{
+		{TLSCertKey, &certs.TLS},
+		{SSHCertKey, &certs.SSH},
+		{TLSCACertsKey, &tlsCA},
+		{SSHCACertsKey, &sshCA},
+		{PrivateKeyKey, &key},
+		{PublicKeyKey, &sshPublicKey},
+	} {
+		*item.out, err = d.Read(item.name)
 		if err != nil {
-			return nil, trace.WrapWithMessage(err, "could not read artifact %q from destination %s", artifact.Key, d)
+			return nil, trace.Wrap(err, "could not read %v", item.name)
 		}
-
-		artifact.FromBytes(&certs, &params, data)
 	}
 
+	certs.SSHCACerts = bytes.Split(sshCA, []byte("$"))
+	certs.TLSCACerts = bytes.Split(tlsCA, []byte("$"))
+
 	log.Debugf("Loaded %d SSH CA certs and %d TLS CA certs", len(certs.SSHCACerts), len(certs.TLSCACerts))
 
-	return ReadIdentityFromStore(&params, &certs, kinds...)
+	return ReadIdentityFromKeyPair(key, sshPublicKey, &certs)
 }
diff --git a/tool/tbot/identity/kinds.go b/tool/tbot/identity/kinds.go
deleted file mode 100644
index 5e98ff2da6905..0000000000000
--- a/tool/tbot/identity/kinds.go
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package identity
-
-import (
-	"strings"
-
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v3"
-)
-
-// ArtifactKind is a type of identity artifact that can be stored and loaded.
-type ArtifactKind string
-
-const (
-	// KindAlways identifies identity resources that should always be
-	// generated.
-	KindAlways ArtifactKind = "always"
-
-	// KindSSH identifies resources that should only be generated for SSH use.
-	KindSSH ArtifactKind = "ssh"
-
-	// KindTLS identifies resources that should only be stored for TLS use.
-	KindTLS ArtifactKind = "tls"
-
-	// KindBotInternal identifies resources that should only be stored in the
-	// bot's internal data directory.
-	KindBotInternal ArtifactKind = "bot-internal"
-)
-
-// allConfigKinds is a list of all ArtifactKinds allowed in config files.
-var allConfigKinds = []string{string(KindSSH), string(KindTLS)}
-
-func (ac *ArtifactKind) UnmarshalYAML(node *yaml.Node) error {
-	var kind string
-	if err := node.Decode(&kind); err != nil {
-		return err
-	}
-
-	// Only TLS and SSH are configurable values.
-	switch kind {
-	case string(KindTLS):
-		*ac = KindTLS
-	case string(KindSSH):
-		*ac = KindSSH
-	default:
-		return trace.BadParameter(
-			"invalid kind %q, expected one of: %s",
-			kind, strings.Join(allConfigKinds, ", "),
-		)
-	}
-
-	return nil
-}
-
-// ContainsKind determines if a particular artifact kind is included in the
-// list of kinds.
-func ContainsKind(kind ArtifactKind, kinds []ArtifactKind) bool {
-	for _, k := range kinds {
-		if kind == k {
-			return true
-		}
-	}
-
-	return false
-}
-
-// BotKinds returns a list of all artifact kinds used internally by the bot.
-// End-user destinations may contain a different set of artifacts.
-func BotKinds() []ArtifactKind {
-	return []ArtifactKind{KindAlways, KindBotInternal, KindSSH, KindTLS}
-}
diff --git a/tool/tbot/init.go b/tool/tbot/init.go
deleted file mode 100644
index 8a78090190ef8..0000000000000
--- a/tool/tbot/init.go
+++ /dev/null
@@ -1,557 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"os/user"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-
-	"github.com/google/uuid"
-	"github.com/gravitational/teleport/api/constants"
-	"github.com/gravitational/teleport/tool/tbot/botfs"
-	"github.com/gravitational/teleport/tool/tbot/config"
-	"github.com/gravitational/teleport/tool/tbot/identity"
-	"github.com/gravitational/trace"
-)
-
-// RootUID is the UID of the root user
-const RootUID = "0"
-
-// aclTestFailedMessage is printed when an ACL test fails.
-const aclTestFailedMessage = "ACLs are not usable for destination %s; " +
-	"Change the destination's ACL mode to `off` to silence this warning."
-
-// getInitArtifacts returns a map of all desired artifacts for the destination
-func getInitArtifacts(destination *config.DestinationConfig) (map[string]bool, error) {
-	// true = directory, false = regular file
-	toCreate := map[string]bool{}
-
-	// Collect all base artifacts and filter for the destination.
-	for _, artifact := range identity.GetArtifacts() {
-		if artifact.Matches(destination.Kinds...) {
-			toCreate[artifact.Key] = false
-		}
-	}
-
-	// Collect all config template artifacts.
-	for _, templateConfig := range destination.Configs {
-		template, err := templateConfig.GetConfigTemplate()
-		if err != nil {
-			return nil, trace.Wrap(err)
-		}
-
-		for _, file := range template.Describe() {
-			toCreate[file.Name] = file.IsDir
-		}
-	}
-
-	return toCreate, nil
-}
-
-// getExistingArtifacts fetches all entries in a destination directory
-func getExistingArtifacts(dir string) (map[string]bool, error) {
-	existing := map[string]bool{}
-
-	entries, err := os.ReadDir(dir)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	for _, entry := range entries {
-		existing[entry.Name()] = entry.IsDir()
-	}
-
-	return existing, nil
-}
-
-// diffArtifacts computes the difference of two artifact sets
-func diffArtifacts(a, b map[string]bool) map[string]bool {
-	diff := map[string]bool{}
-
-	for k, v := range a {
-		if _, ok := b[k]; !ok {
-			diff[k] = v
-		}
-	}
-
-	return diff
-}
-
-// testACL creates a temporary file and attempts to apply an ACL to it. If the
-// ACL is successfully applied, returns nil; otherwise, returns the error.
-func testACL(directory string, ownerUser *user.User, opts *botfs.ACLOptions) error {
-	// Note: we need to create the test file in the dest dir to ensure we
-	// actually test the target filesystem.
-	id, err := uuid.NewRandom()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	testFile := filepath.Join(directory, id.String())
-	if err := botfs.Create(testFile, false, botfs.SymlinksInsecure); err != nil {
-		return trace.Wrap(err)
-	}
-
-	defer func() {
-		err := os.Remove(testFile)
-		if err != nil {
-			log.Debugf("Failed to delete ACL test file %q", testFile)
-		}
-	}()
-
-	//nolint:staticcheck // staticcheck doesn't like nop implementations in fs_other.go
-	if err := botfs.ConfigureACL(testFile, ownerUser, opts); err != nil {
-		return trace.Wrap(err)
-	}
-
-	return nil
-}
-
-// ensurePermissionsParams sets permissions options
-type ensurePermissionsParams struct {
-	// dirPath is the directory containing the file
-	dirPath string
-
-	// symlinksMode configures symlink attack mitigation behavior
-	symlinksMode botfs.SymlinksMode
-
-	// ownerUser is the user that should own the file
-	ownerUser *user.User
-
-	// ownerGroup is the group that should own the file
-	ownerGroup *user.Group
-
-	// aclOptions contains configuration for ACLs, if they are in use. nil if
-	// ACLs are disabled
-	aclOptions *botfs.ACLOptions
-
-	// toCreate is a set of files that will be newly created, used to reduce
-	// log spam when configuring new files
-	toCreate map[string]bool
-}
-
-// ensurePermissions verifies permissions on the given path and, when
-// possible, attempts to fix permissions / ACLs on any misconfigured paths.
-func ensurePermissions(params *ensurePermissionsParams, key string, isDir bool) error {
-	path := filepath.Join(params.dirPath, key)
-
-	//nolint:staticcheck // this entirely innocuous line generates "related
-	// information" lints for a false positive staticcheck lint relating to
-	// nop function implementations in fs_other.go.
-	stat, err := os.Stat(path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	cleanPath := filepath.Clean(path)
-	resolved, err := filepath.EvalSymlinks(path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Precomputed flag to determine if certain log messages should be hidden.
-	// We expect ownership, ACLs, etc to be wrong on initial create so warnings
-	// are not desirable.
-	_, newlyCreated := params.toCreate[key]
-	verboseLogging := key != "" && !newlyCreated
-
-	// This is unlikely as CreateSecure() refuses to follow symlinks, but users
-	// could move things around after the fact.
-	if cleanPath != resolved {
-		switch params.symlinksMode {
-		case botfs.SymlinksSecure:
-			return trace.BadParameter("Path %q contains symlinks which is not "+
-				"allowed for security reasons.", path)
-		case botfs.SymlinksInsecure:
-			// do nothing
-		default:
-			log.Warnf("Path %q contains symlinks and may be subject to symlink "+
-				"attacks. If this is intentional, consider setting `symlinks: "+
-				"insecure` in destination config.", path)
-		}
-	}
-
-	// A few conditions we won't try to handle...
-	if isDir && !stat.IsDir() {
-		return trace.BadParameter("File %s is expected to be a directory but is a file", path)
-	} else if !isDir && stat.IsDir() {
-		return trace.BadParameter("File %s is expected to be a file but is a directory", path)
-	}
-
-	currentUser, err := user.Current()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Correct ownership.
-	ownedByDesiredOwner, err := botfs.IsOwnedBy(stat, params.ownerUser)
-	if err != nil {
-		log.WithError(err).Debugf("Could not determine file ownership of %q", path)
-
-		// Can't read file ownership on this platform (e.g. Windows), so always
-		// attempt to chown (which does work on Windows)
-		ownedByDesiredOwner = false
-	}
-
-	if !ownedByDesiredOwner {
-		// If we're not running as root, this will probably fail.
-		if currentUser.Uid != RootUID && runtime.GOOS != constants.WindowsOS {
-			log.Warnf("Not running as root, ownership change is likely to fail.")
-		}
-
-		uid, err := strconv.Atoi(params.ownerUser.Uid)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		gid, err := strconv.Atoi(params.ownerGroup.Gid)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		if verboseLogging {
-			log.Warnf("Ownership of %q is incorrect and will be corrected to %s", path, params.ownerUser.Username)
-		}
-
-		err = os.Chown(path, uid, gid)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	if params.aclOptions != nil {
-		// We can verify ACLs as any user with read, but can only correct ACLs
-		// as root or the owner.
-		// Note that we rely on VerifyACL to return some error if permissions
-		// are incorrect.
-
-		//nolint:staticcheck // staticcheck doesn't like nop implementations in fs_other.go
-		err = botfs.VerifyACL(path, params.aclOptions)
-		//nolint:staticcheck
-		if err != nil && (currentUser.Uid == RootUID || currentUser.Uid == params.ownerUser.Uid) {
-			if verboseLogging {
-				log.Warnf("ACL for %q is not correct and will be corrected: %v", path, err)
-			}
-
-			return trace.Wrap(botfs.ConfigureACL(path, params.ownerUser, params.aclOptions))
-		} else if err != nil {
-			log.Errorf("ACL for %q is incorrect but `tbot init` must be run "+
-				"as root or the owner (%s) to correct it: %v",
-				path, params.ownerUser.Username, err)
-			return trace.AccessDenied("Elevated permissions required")
-		}
-
-		// ACL is valid.
-		return nil
-	}
-
-	desiredMode := botfs.DefaultMode
-	if stat.IsDir() {
-		desiredMode = botfs.DefaultDirMode
-	}
-
-	// Using regular permissions, so attempt to correct the file mode.
-	if stat.Mode().Perm() != desiredMode {
-		if err := os.Chmod(path, desiredMode); err != nil {
-			return trace.Wrap(err, "Could not fix permissions on file %q, expected %#o", path, desiredMode)
-		}
-
-		log.Infof("Corrected permissions on %q from %#o to %#o", path, stat.Mode().Perm(), botfs.DefaultMode)
-	}
-
-	return nil
-}
-
-// parseOwnerString parses and looks up an user and group from a user:group
-// owner string.
-func parseOwnerString(owner string) (*user.User, *user.Group, error) {
-	ownerParts := strings.Split(owner, ":")
-	if len(ownerParts) != 2 {
-		return nil, nil, trace.BadParameter("invalid owner string: %q", owner)
-	}
-
-	ownerUser, err := user.Lookup(ownerParts[0])
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	ownerGroup, err := user.LookupGroup(ownerParts[1])
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	return ownerUser, ownerGroup, nil
-}
-
-// getOwner determines the user/group owner given a CLI parameter (--owner)
-// and desired default value. An empty defaultOwner defaults to the current
-// user and their primary group.
-func getOwner(cliOwner, defaultOwner string) (*user.User, *user.Group, error) {
-	if cliOwner != "" {
-		// If --owner is set, always use it.
-		log.Debugf("Attempting to use explicitly requested owner: %s", cliOwner)
-		return parseOwnerString(cliOwner)
-	}
-
-	if defaultOwner != "" {
-		log.Debugf("Attempting to use default owner: %s", defaultOwner)
-		// If a default owner is specified, try it instead.
-		return parseOwnerString(defaultOwner)
-	}
-
-	log.Debugf("Will use current user as owner.")
-	// Otherwise, return the current user and group
-	currentUser, err := user.Current()
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	currentGroup, err := user.LookupGroupId(currentUser.Gid)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
-
-	return currentUser, currentGroup, nil
-}
-
-// getAndTestACLOptions gets options needed to configure an ACL from CLI
-// options and attempts to configure a test ACL to validate them. Ownership is
-// not validated here.
-func getAndTestACLOptions(cf *config.CLIConf, destDir string) (*user.User, *user.Group, *botfs.ACLOptions, error) {
-	if cf.BotUser == "" {
-		return nil, nil, nil, trace.BadParameter("--bot-user must be set")
-	}
-
-	if cf.ReaderUser == "" {
-		return nil, nil, nil, trace.BadParameter("--reader-user must be set")
-	}
-
-	botUser, err := user.Lookup(cf.BotUser)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err)
-	}
-
-	botGroup, err := user.LookupGroupId(botUser.Gid)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err)
-	}
-
-	readerUser, err := user.Lookup(cf.ReaderUser)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err)
-	}
-
-	opts := botfs.ACLOptions{
-		BotUser:    botUser,
-		ReaderUser: readerUser,
-	}
-
-	// Default to letting the bot own the destination, since by this point we
-	// know the bot user definitely exists and is a reasonable owner choice.
-	defaultOwner := fmt.Sprintf("%s:%s", botUser.Username, botGroup.Name)
-
-	ownerUser, ownerGroup, err := getOwner(cf.Owner, defaultOwner)
-	if err != nil {
-		return nil, nil, nil, trace.Wrap(err)
-	}
-
-	err = testACL(destDir, ownerUser, &opts)
-	if err != nil && trace.IsAccessDenied(err) {
-		return nil, nil, nil, trace.Wrap(err, "The destination %q does not appear to be writable", destDir)
-	} else if err != nil {
-		return nil, nil, nil, trace.Wrap(err, "ACL support may need to be enabled for the filesystem.")
-	}
-
-	return ownerUser, ownerGroup, &opts, nil
-}
-
-func onInit(botConfig *config.BotConfig, cf *config.CLIConf) error {
-	var destination *config.DestinationConfig
-	var err error
-
-	// First, resolve the correct destination. If using a config file with only
-	// 1 destination we can assume we want to init that one; otherwise,
-	// --init-dir is required.
-	if cf.InitDir == "" {
-		if len(botConfig.Destinations) == 1 {
-			destination = botConfig.Destinations[0]
-		} else {
-			return trace.BadParameter("A destination to initialize must be specified with --init-dir")
-		}
-	} else {
-		destination, err = botConfig.GetDestinationByPath(cf.InitDir)
-		if err != nil {
-			return trace.WrapWithMessage(err, "Could not find specified destination %q", cf.InitDir)
-		}
-
-		if destination == nil {
-			// TODO: in the future if/when other backends are supported,
-			// destination might be nil because the user tried to enter a non
-			// filesystem path, so this error message could be misleading.
-			return trace.NotFound("Cannot initialize destination %q because "+
-				"it has not been configured.", cf.InitDir)
-		}
-	}
-
-	destImpl, err := destination.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	destDir, ok := destImpl.(*config.DestinationDirectory)
-	if !ok {
-		return trace.BadParameter("`tbot init` only supports directory destinations")
-	}
-
-	log.Infof("Initializing destination: %s", destImpl)
-
-	// Create the directory if needed. We haven't checked directory ownership,
-	// but it will fail when the ACLs are created if anything is misconfigured.
-	if err := destDir.Init(); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Next, test if we want + have ACL support, and set aclOpts if we do.
-	// Desired owner is derived from the ACL mode.
-	var aclOpts *botfs.ACLOptions
-	var ownerUser *user.User
-	var ownerGroup *user.Group
-
-	switch destDir.ACLs {
-	case botfs.ACLRequired, botfs.ACLTry:
-		log.Debug("Testing for ACL support...")
-
-		// Awkward control flow here, but we want these to fail together.
-		ownerUser, ownerGroup, aclOpts, err = getAndTestACLOptions(cf, destDir.Path)
-		if err != nil {
-			if destDir.ACLs == botfs.ACLRequired {
-				// ACLs were specifically requested (vs "try" mode), so fail.
-				return trace.Wrap(err, aclTestFailedMessage, destImpl)
-			}
-
-			// Otherwise, fall back to no ACL with a warning.
-			log.WithError(err).Warnf(aclTestFailedMessage, destImpl)
-			aclOpts = nil
-
-			// We'll also need to re-fetch the owner as the defaults are
-			// different in the fallback case.
-			ownerUser, ownerGroup, err = getOwner(cf.Owner, "")
-			if err != nil {
-				return trace.Wrap(err)
-			}
-		} else if aclOpts.ReaderUser.Uid == ownerUser.Uid {
-			log.Warnf("The destination owner (%s) and reader (%s) are the "+
-				"same. This will break OpenSSH.", aclOpts.ReaderUser.Username,
-				ownerUser.Username)
-		}
-	default:
-		log.Info("ACLs disabled for this destination.")
-		ownerUser, ownerGroup, err = getOwner(cf.Owner, "")
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	// Next, resolve what we want and what we already have.
-	desired, err := getInitArtifacts(destination)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	existing, err := getExistingArtifacts(destDir.Path)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	toCreate := diffArtifacts(desired, existing)
-	toRemove := diffArtifacts(existing, desired)
-
-	// Based on this, create any new files.
-	if len(toCreate) > 0 {
-		log.Infof("Attempting to create: %v", toCreate)
-
-		for key, isDir := range toCreate {
-			path := filepath.Join(destDir.Path, key)
-			if err := botfs.Create(path, isDir, destDir.Symlinks); err != nil {
-				return trace.Wrap(err)
-			}
-
-			log.Infof("Created: %s", path)
-		}
-	} else {
-		log.Info("Nothing to create.")
-	}
-
-	// ... and warn about / remove any unneeded files.
-	if len(toRemove) > 0 && cf.Clean {
-		log.Infof("Attempting to remove: %v", toRemove)
-
-		var errors []error
-
-		for key := range toRemove {
-			path := filepath.Join(destDir.Path, key)
-
-			if err := os.RemoveAll(path); err != nil {
-				errors = append(errors, err)
-			} else {
-				log.Infof("Removed: %s", path)
-			}
-		}
-
-		if err := trace.NewAggregate(errors...); err != nil {
-			return trace.Wrap(err)
-		}
-	} else if len(toRemove) > 0 {
-		log.Warnf("Unexpected files found in destination directory, consider " +
-			"removing it manually or rerunning `tbot init` with the `--clean` " +
-			"flag.")
-	} else {
-		log.Info("Nothing to remove.")
-	}
-
-	params := ensurePermissionsParams{
-		dirPath:      destDir.Path,
-		aclOptions:   aclOpts,
-		ownerUser:    ownerUser,
-		ownerGroup:   ownerGroup,
-		symlinksMode: destDir.Symlinks,
-		toCreate:     toCreate,
-	}
-
-	// Check and set permissions on the directory itself.
-	if err := ensurePermissions(&params, "", true); err != nil {
-		return trace.Wrap(err)
-	}
-
-	// Lastly, set and check permissions on all the desired files.
-	for key, isDir := range desired {
-		if err := ensurePermissions(&params, key, isDir); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	log.Infof("Destination %s has been initialized. Note that these files "+
-		"will be empty and invalid until the bot issues certificates.",
-		destImpl)
-
-	return nil
-}
diff --git a/tool/tbot/init_test.go b/tool/tbot/init_test.go
deleted file mode 100644
index d154e0cb39480..0000000000000
--- a/tool/tbot/init_test.go
+++ /dev/null
@@ -1,271 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"os/user"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/gravitational/teleport/api/constants"
-	"github.com/gravitational/teleport/tool/tbot/botfs"
-	"github.com/gravitational/teleport/tool/tbot/config"
-	"github.com/gravitational/teleport/tool/tbot/identity"
-	"github.com/gravitational/trace"
-	"github.com/stretchr/testify/require"
-)
-
-// usernamesToTry contains a list of usernames we can use as ACL targets in
-// testing.
-var usernamesToTry = []string{"nobody", "ci", "root"}
-
-func contains(entries []string, entry string) bool {
-	for _, e := range entries {
-		if e == entry {
-			return true
-		}
-	}
-
-	return false
-}
-
-// filterUsers returns the input list of usernames except for those in the
-// exclude list.
-func filterUsers(usernames, exclude []string) []string {
-	ret := []string{}
-
-	for _, username := range usernames {
-		if !contains(exclude, username) {
-			ret = append(ret, username)
-		}
-	}
-
-	return ret
-}
-
-// findUser attempts to find a usable user on the local system from the given
-// list of usernames and returns the first match found.
-func findUser(usernamesToTry, usernamesToExclude []string) (*user.User, error) {
-	filtered := filterUsers(usernamesToTry, usernamesToExclude)
-	for _, username := range filtered {
-		u, err := user.Lookup(username)
-		if err == nil {
-			return u, nil
-		}
-	}
-
-	return nil, trace.NotFound("No users found matching %+v (excluding %+v)", usernamesToTry, usernamesToExclude)
-}
-
-// getACLOptions returns sane ACLOptions for this platform.
-func getACLOptions() (*botfs.ACLOptions, error) {
-	if runtime.GOOS != constants.LinuxOS {
-		return nil, trace.NotImplemented("Unsupported platform")
-	}
-
-	user, err := user.Current()
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	exclude := []string{user.Name}
-
-	// Find a set of users we can test against.
-	readerUser, err := findUser(usernamesToTry, exclude)
-	if trace.IsNotFound(err) {
-		return nil, trace.NotFound("Not enough usable users for testing ACLs")
-	} else if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	exclude = append(exclude, readerUser.Name)
-	botUser, err := findUser(usernamesToTry, exclude)
-	if trace.IsNotFound(err) {
-		return nil, trace.NotFound("Not enough suitable users found for testing ACLs.")
-	} else if err != nil {
-		return nil, trace.Wrap(err)
-	}
-
-	return &botfs.ACLOptions{
-		ReaderUser: readerUser,
-		BotUser:    botUser,
-	}, nil
-}
-
-// testConfigFromCLI creates a BotConfig from the given CLI config.
-func testConfigFromCLI(t *testing.T, cf *config.CLIConf) *config.BotConfig {
-	cfg, err := config.FromCLIConf(cf)
-	require.NoError(t, err)
-
-	return cfg
-}
-
-// testConfigFromString parses a YAML config file from a string.
-func testConfigFromString(t *testing.T, yaml string) *config.BotConfig {
-	cfg, err := config.ReadConfig(strings.NewReader(yaml))
-	require.NoError(t, err)
-
-	return cfg
-}
-
-// validateFileDestinations ensures all files in a destination exist on disk as
-// expected, and returns the destination.
-func validateFileDestination(t *testing.T, dest *config.DestinationConfig) *config.DestinationDirectory {
-	destImpl, err := dest.GetDestination()
-	require.NoError(t, err)
-
-	destDir, ok := destImpl.(*config.DestinationDirectory)
-	require.True(t, ok)
-
-	for _, art := range identity.GetArtifacts() {
-		if !art.Matches(dest.Kinds...) {
-			continue
-		}
-
-		require.FileExists(t, filepath.Join(destDir.Path, art.Key))
-	}
-
-	return destDir
-}
-
-// TestInit ensures defaults work regardless of host platform. With no bot user
-// specified, this never tries to use ACLs.
-func TestInit(t *testing.T) {
-	dir := t.TempDir()
-	cf := &config.CLIConf{
-		AuthServer:     "example.com",
-		DestinationDir: dir,
-	}
-	cfg := testConfigFromCLI(t, cf)
-
-	// Run init.
-	require.NoError(t, onInit(cfg, cf))
-
-	// Make sure everything was created.
-	_ = validateFileDestination(t, cfg.Destinations[0])
-}
-
-// TestInitMaybeACLs tests defaults with ACLs possibly enabled, by supplying
-// bot and reader users.
-func TestInitMaybeACLs(t *testing.T) {
-	opts, err := getACLOptions()
-	if trace.IsNotImplemented(err) {
-		t.Skipf("%+v", err)
-	} else if trace.IsNotFound(err) {
-		t.Skipf("%+v", err)
-	}
-	require.NoError(t, err)
-
-	hasACLSupport, err := botfs.HasACLSupport()
-	require.NoError(t, err)
-
-	currentUser, err := user.Current()
-	require.NoError(t, err)
-
-	currentGroup, err := user.LookupGroupId(currentUser.Gid)
-	require.NoError(t, err)
-
-	// Determine if we expect init to use ACLs.
-	expectACLs := false
-	if hasACLSupport {
-		if err := testACL(t.TempDir(), currentUser, opts); err == nil {
-			expectACLs = true
-		}
-	}
-
-	// Note: we'll use the current user as owner as that's the only way to
-	// guarantee ACL write access.
-	dir := t.TempDir()
-	cf := &config.CLIConf{
-		AuthServer:     "example.com",
-		DestinationDir: dir,
-		BotUser:        opts.BotUser.Username,
-		ReaderUser:     opts.ReaderUser.Username,
-
-		// This isn't a default, but unfortunately we need to specify a
-		// non-nobody owner for CI purposes.
-		Owner: fmt.Sprintf("%s:%s", currentUser.Name, currentGroup.Name),
-	}
-	cfg := testConfigFromCLI(t, cf)
-
-	// Run init.
-	require.NoError(t, onInit(cfg, cf))
-
-	// Make sure everything was created.
-	destDir := validateFileDestination(t, cfg.Destinations[0])
-
-	// If we expect ACLs, verify them.
-	if expectACLs {
-		require.NoError(t, destDir.Verify(identity.ListKeys(cfg.Destinations[0].Kinds...)))
-	} else {
-		t.Logf("Skipping ACL check on %q as they should not be supported.", dir)
-	}
-}
-
-// testInitSymlinksTemplate is a config template with a configurable symlinks
-// mode and ACLs disabled.
-const testInitSymlinksTemplate = `
-auth_server: example.com
-destinations:
-  - directory:
-      path: %s
-      acls: off
-      symlinks: %s
-`
-
-// TestInitSymlink tests tbot init with a symlink in the path.
-func TestInitSymlink(t *testing.T) {
-	secureWriteSupported, err := botfs.HasSecureWriteSupport()
-	require.NoError(t, err)
-	if !secureWriteSupported {
-		t.Skip("Secure write not supported on this system.")
-	}
-
-	dir := t.TempDir()
-
-	realPath := filepath.Join(dir, "data")
-	dataDir := filepath.Join(dir, "data-symlink")
-	require.NoError(t, os.Symlink(realPath, dataDir))
-
-	// Should fail due to symlink in path.
-	cfg := testConfigFromString(t, fmt.Sprintf(testInitSymlinksTemplate, dataDir, botfs.SymlinksSecure))
-	require.Error(t, onInit(cfg, &config.CLIConf{}))
-
-	// Should succeed when writing to the dir directly.
-	cfg = testConfigFromString(t, fmt.Sprintf(testInitSymlinksTemplate, realPath, botfs.SymlinksSecure))
-	require.NoError(t, onInit(cfg, &config.CLIConf{}))
-
-	// Make sure everything was created.
-	_ = validateFileDestination(t, cfg.Destinations[0])
-}
-
-// TestInitSymlinksInsecure should work on all platforms.
-func TestInitSymlinkInsecure(t *testing.T) {
-	dir := t.TempDir()
-
-	realPath := filepath.Join(dir, "data")
-	dataDir := filepath.Join(dir, "data-symlink")
-	require.NoError(t, os.Symlink(realPath, dataDir))
-
-	// Should succeed due to SymlinksInsecure
-	cfg := testConfigFromString(t, fmt.Sprintf(testInitSymlinksTemplate, dataDir, botfs.SymlinksInsecure))
-	require.Error(t, onInit(cfg, &config.CLIConf{}))
-}
diff --git a/tool/tbot/main.go b/tool/tbot/main.go
index 484a73f97caeb..5c7c941c4e1c2 100644
--- a/tool/tbot/main.go
+++ b/tool/tbot/main.go
@@ -17,15 +17,10 @@ limitations under the License.
 package main
 
 import (
-	"bytes"
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
 	"fmt"
 	"os"
-	"os/signal"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/gravitational/teleport"
@@ -40,7 +35,6 @@ import (
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/tool/tbot/config"
-	"github.com/gravitational/teleport/tool/tbot/destination"
 	"github.com/gravitational/teleport/tool/tbot/identity"
 	"github.com/gravitational/trace"
 	"github.com/kr/pretty"
@@ -68,40 +62,28 @@ func Run(args []string) error {
 	var cf config.CLIConf
 	utils.InitLogger(utils.LoggingForDaemon, logrus.InfoLevel)
 
-	app := utils.InitCLIParser("tbot", "tbot: Teleport Machine ID").Interspersed(false)
+	app := utils.InitCLIParser("tbot", "tbot: Teleport Credential Bot").Interspersed(false)
 	app.Flag("debug", "Verbose logging to stdout").Short('d').BoolVar(&cf.Debug)
-	app.Flag("config", "Path to a configuration file. Defaults to `/etc/tbot.yaml` if unspecified.").Short('c').StringVar(&cf.ConfigPath)
-	app.HelpFlag.Short('h')
-
-	versionCmd := app.Command("version", "Print the version")
+	app.Flag("config", "tbot.yaml path").Short('c').StringVar(&cf.ConfigPath)
 
 	startCmd := app.Command("start", "Starts the renewal bot, writing certificates to the data dir at a set interval.")
-	startCmd.Flag("auth-server", "Address of the Teleport Auth Server (On-Prem installs) or Proxy Server (Cloud installs).").Short('a').Envar(authServerEnvVar).StringVar(&cf.AuthServer)
+	startCmd.Flag("auth-server", "Specify the Teleport auth server host").Short('a').Envar(authServerEnvVar).StringVar(&cf.AuthServer)
 	startCmd.Flag("token", "A bot join token, if attempting to onboard a new bot; used on first connect.").Envar(tokenEnvVar).StringVar(&cf.Token)
-	startCmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&cf.CAPins)
-	startCmd.Flag("data-dir", "Directory to store internal bot data. Access to this directory should be limited.").StringVar(&cf.DataDir)
-	startCmd.Flag("destination-dir", "Directory to write short-lived machine certificates.").StringVar(&cf.DestinationDir)
-	startCmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").Default("60m").DurationVar(&cf.CertificateTTL)
-	startCmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&cf.RenewalInterval)
-	startCmd.Flag("join-method", "Method to use to join the cluster, can be \"token\" or \"iam\".").Default(config.DefaultJoinMethod).EnumVar(&cf.JoinMethod, "token", "iam")
-	startCmd.Flag("oneshot", "If set, quit after the first renewal.").BoolVar(&cf.Oneshot)
-
-	initCmd := app.Command("init", "Initialize a certificate destination directory for writes from a separate bot user.")
-	initCmd.Flag("destination-dir", "Directory to write short-lived machine certificates to.").StringVar(&cf.DestinationDir)
-	initCmd.Flag("owner", "Defines Linux \"user:group\" owner of \"--destination-dir\". Defaults to the Linux user running tbot if unspecified.").StringVar(&cf.Owner)
-	initCmd.Flag("bot-user", "Enables POSIX ACLs and defines Linux user that can read/write short-lived certificates to \"--destination-dir\".").StringVar(&cf.BotUser)
-	initCmd.Flag("reader-user", "Enables POSIX ACLs and defines Linux user that will read short-lived certificates from \"--destination-dir\".").StringVar(&cf.ReaderUser)
-	initCmd.Flag("init-dir", "If using a config file and multiple destinations are configured, controls which destination dir to configure.").StringVar(&cf.InitDir)
-	initCmd.Flag("clean", "If set, remove unexpected files and directories from the destination.").BoolVar(&cf.Clean)
+	startCmd.Flag("ca-pin", "A repeatable auth server CA hash to pin; used on first connect.").StringsVar(&cf.CAPins)
+	startCmd.Flag("data-dir", "Directory to store internal bot data.").StringVar(&cf.DataDir)
+	startCmd.Flag("destination-dir", "Directory to write generated certificates").StringVar(&cf.DestinationDir)
+	startCmd.Flag("certificate-ttl", "TTL of generated certificates").Default("60m").DurationVar(&cf.CertificateTTL)
+	startCmd.Flag("renew-interval", "Interval at which certificates are renewed; must be less than the certificate TTL.").DurationVar(&cf.RenewInterval)
+	startCmd.Flag("join-method", "Method to use to join the cluster.").Default("token").EnumVar(&cf.JoinMethod, "token", "iam")
 
 	configCmd := app.Command("config", "Parse and dump a config file").Hidden()
 
-	watchCmd := app.Command("watch", "Watch a destination directory for changes.").Hidden()
+	initCmd := app.Command("init", "Initialize a certificate destination directory.")
+
+	watchCmd := app.Command("watch", "Watch a destination directory for changes.")
 
-	utils.UpdateAppUsageTemplate(app, args)
 	command, err := app.Parse(args)
 	if err != nil {
-		app.Usage(args)
 		return trace.Wrap(err)
 	}
 
@@ -116,14 +98,12 @@ func Run(args []string) error {
 	}
 
 	switch command {
-	case versionCmd.FullCommand():
-		err = onVersion()
 	case startCmd.FullCommand():
 		err = onStart(botConfig)
 	case configCmd.FullCommand():
 		err = onConfig(botConfig)
 	case initCmd.FullCommand():
-		err = onInit(botConfig, &cf)
+		err = onInit(botConfig)
 	case watchCmd.FullCommand():
 		err = onWatch(botConfig)
 	default:
@@ -134,65 +114,47 @@ func Run(args []string) error {
 	return err
 }
 
-func onVersion() error {
-	utils.PrintVersion()
-	return nil
-}
-
 func onConfig(botConfig *config.BotConfig) error {
 	pretty.Println(botConfig)
 
 	return nil
 }
 
+func onInit(botConfig *config.BotConfig) error {
+	return trace.NotImplemented("init not yet implemented")
+}
+
 func onWatch(botConfig *config.BotConfig) error {
 	return trace.NotImplemented("watch not yet implemented")
 }
 
 func onStart(botConfig *config.BotConfig) error {
-	if botConfig.AuthServer == "" {
-		return trace.BadParameter("an auth or proxy server must be set via --auth-server or configuration")
-	}
-
-	// First, try to make sure all destinations are usable.
-	if err := checkDestinations(botConfig); err != nil {
-		return trace.Wrap(err)
-	}
-
 	// Start by loading the bot's primary destination.
 	dest, err := botConfig.Storage.GetDestination()
 	if err != nil {
 		return trace.Wrap(err, "could not read bot storage destination from config")
 	}
 
-	reloadChan := make(chan struct{})
+	var authClient auth.ClientI
+
+	// TODO: graceful shutdown via signal; see #7066
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	go handleSignals(reloadChan, cancel)
-
-	configTokenHashBytes := []byte{}
-	if botConfig.Onboarding != nil && botConfig.Onboarding.Token != "" {
-		sha := sha256.Sum256([]byte(botConfig.Onboarding.Token))
-		configTokenHashBytes = []byte(hex.EncodeToString(sha[:]))
-	}
-
-	var authClient auth.ClientI
-
 	// First, attempt to load an identity from storage.
-	ident, err := identity.LoadIdentity(dest, identity.BotKinds()...)
-	if err == nil && !hasTokenChanged(ident.TokenHashBytes, configTokenHashBytes) {
-		identStr, err := describeTLSIdentity(ident)
+	ident, err := identity.LoadIdentity(dest)
+	if err == nil {
+		identStr, err := describeIdentity(ident)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
 		log.Infof("Successfully loaded bot identity, %s", identStr)
 
-		if err := checkIdentity(ident); err != nil {
-			return trace.Wrap(err)
-		}
-
+		// TODO: we should cache the token; if --token is provided but
+		// different, assume the user is attempting to start with a new
+		// identity. (May want to store a sha256 has to avoid storing the
+		// token directly.)
 		if botConfig.Onboarding != nil {
 			log.Warn("Note: onboarding config ignored as identity was loaded from persistent storage")
 		}
@@ -205,19 +167,9 @@ func onStart(botConfig *config.BotConfig) error {
 		// If the identity can't be loaded, assume we're starting fresh and
 		// need to generate our initial identity from a token
 
-		if ident != nil {
-			// If ident is set here, we detected a token change above.
-			log.Warnf("Detected a token change, will attempt to fetch a new identity.")
-		}
-
 		// TODO: validate that errors from LoadIdentity are sanely typed; we
 		// actually only want to ignore NotFound errors
 
-		// Verify we can write to the destination.
-		if err := identity.VerifyWrite(dest); err != nil {
-			return trace.Wrap(err, "Could not write to destination %s, aborting.", dest)
-		}
-
 		// Get first identity
 		ident, err = getIdentityFromToken(botConfig)
 		if err != nil {
@@ -235,18 +187,24 @@ func onStart(botConfig *config.BotConfig) error {
 			return trace.Wrap(err, "unable to communicate with auth server")
 		}
 
-		identStr, err := describeTLSIdentity(ident)
+		identStr, err := describeIdentity(ident)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 		log.Infof("Successfully generated new bot identity, %s", identStr)
 
 		log.Debugf("Storing new bot identity to %s", dest)
-		if err := identity.SaveIdentity(ident, dest, identity.BotKinds()...); err != nil {
+		if err := identity.SaveIdentity(ident, dest); err != nil {
 			return trace.Wrap(err, "unable to save generated identity back to destination")
 		}
 	}
 
+	// TODO: handle cases where an identity exists on disk but we might _not_
+	// want to use it:
+	//  - identity has expired
+	//  - user provided a new token
+	//  - ???
+
 	watcher, err := authClient.NewWatcher(ctx, types.Watch{
 		Kinds: []types.WatchKind{{
 			Kind: types.KindCertAuthority,
@@ -260,100 +218,7 @@ func onStart(botConfig *config.BotConfig) error {
 
 	defer watcher.Close()
 
-	return renewLoop(ctx, botConfig, authClient, ident, reloadChan)
-}
-
-func hasTokenChanged(configTokenBytes, identityBytes []byte) bool {
-	if len(configTokenBytes) == 0 || len(identityBytes) == 0 {
-		return false
-	}
-
-	return !bytes.Equal(identityBytes, configTokenBytes)
-}
-
-// checkDestinations checks all destinations and tries to create any that
-// don't already exist.
-func checkDestinations(cfg *config.BotConfig) error {
-	// Note: This is vaguely problematic as we don't recommend that users
-	// store renewable certs under the same user as end-user certs. That said,
-	//  - if the destination was properly created via tbot init this is a no-op
-	//  - if users intend to follow that advice but miss a step, it should fail
-	//    due to lack of permissions
-	storage, err := cfg.Storage.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
-	// TODO: consider warning if ownership of all destintions is not expected.
-
-	if err := storage.Init(); err != nil {
-		return trace.Wrap(err)
-	}
-
-	for _, dest := range cfg.Destinations {
-		destImpl, err := dest.GetDestination()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-
-		if err := destImpl.Init(); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	return nil
-}
-
-// checkIdentity performs basic startup checks on an identity and loudly warns
-// end users if it is unlikely to work.
-func checkIdentity(ident *identity.Identity) error {
-	var validAfter time.Time
-	var validBefore time.Time
-
-	if ident.X509Cert != nil {
-		validAfter = ident.X509Cert.NotBefore
-		validBefore = ident.X509Cert.NotAfter
-	} else if ident.SSHCert != nil {
-		validAfter = time.Unix(int64(ident.SSHCert.ValidAfter), 0)
-		validBefore = time.Unix(int64(ident.SSHCert.ValidBefore), 0)
-	} else {
-		return trace.BadParameter("identity is invalid and contains no certificates")
-	}
-
-	now := time.Now().UTC()
-	if now.After(validBefore) {
-		log.Errorf(
-			"Identity has expired. The renewal is likely to fail. (expires: %s, current time: %s)",
-			validBefore.Format(time.RFC3339),
-			now.Format(time.RFC3339),
-		)
-	} else if now.Before(validAfter) {
-		log.Warnf(
-			"Identity is not yet valid. Confirm that the system time is correct. (valid after: %s, current time: %s)",
-			validAfter.Format(time.RFC3339),
-			now.Format(time.RFC3339),
-		)
-	}
-
-	return nil
-}
-
-// handleSignals handles incoming Unix signals.
-func handleSignals(reload chan struct{}, cancel context.CancelFunc) {
-	signals := make(chan os.Signal, 1)
-	signal.Notify(signals, syscall.SIGINT, syscall.SIGHUP, syscall.SIGUSR1)
-
-	for signal := range signals {
-		switch signal {
-		case syscall.SIGINT:
-			log.Info("Received interrupt, cancelling...")
-			cancel()
-			return
-		case syscall.SIGHUP, syscall.SIGUSR1:
-			log.Info("Received reload signal, reloading...")
-			reload <- struct{}{}
-		}
-	}
+	return renewLoop(ctx, botConfig, authClient, ident)
 }
 
 func watchCARotations(watcher types.Watcher) {
@@ -388,7 +253,7 @@ func getIdentityFromToken(cfg *config.BotConfig) (*identity.Identity, error) {
 		return nil, trace.WrapWithMessage(err, "unable to generate new keypairs")
 	}
 
-	log.Info("Attempting to generate new identity from token")
+	log.Info("attempting to generate new identity from token")
 	params := auth.RegisterParams{
 		Token: cfg.Onboarding.Token,
 		ID: auth.IdentityID{
@@ -406,13 +271,7 @@ func getIdentityFromToken(cfg *config.BotConfig) (*identity.Identity, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	sha := sha256.Sum256([]byte(params.Token))
-	tokenHash := hex.EncodeToString(sha[:])
-	ident, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
-		PrivateKeyBytes: tlsPrivateKey,
-		PublicKeyBytes:  sshPublicKey,
-		TokenHashBytes:  []byte(tokenHash),
-	}, certs, identity.BotKinds()...)
+	ident, err := identity.ReadIdentityFromKeyPair(tlsPrivateKey, sshPublicKey, certs)
 	return ident, trace.Wrap(err)
 }
 
@@ -440,18 +299,18 @@ func renewIdentityViaAuth(
 	// Ask the auth server to generate a new set of certs with a new
 	// expiration date.
 	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
-		PublicKey: currentIdentity.PublicKeyBytes,
-		Username:  currentIdentity.X509Cert.Subject.CommonName,
+		PublicKey: currentIdentity.SSHPublicKeyBytes,
+		Username:  currentIdentity.XCert.Subject.CommonName,
 		Expires:   time.Now().Add(cfg.CertificateTTL),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	newIdentity, err := identity.ReadIdentityFromStore(
-		currentIdentity.Params(),
+	newIdentity, err := identity.ReadIdentityFromKeyPair(
+		currentIdentity.KeyBytes,
+		currentIdentity.SSHPublicKeyBytes,
 		certs,
-		identity.BotKinds()...,
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -472,31 +331,26 @@ func fetchDefaultRoles(ctx context.Context, roleGetter services.RoleGetter, botR
 	return conditions.Roles, nil
 }
 
-// describeTLSIdentity writes an informational message about the given identity to
+// describeIdentity writes an informational message about the given identity to
 // the log.
-func describeTLSIdentity(ident *identity.Identity) (string, error) {
-	cert := ident.X509Cert
-	if cert == nil {
-		return "", trace.BadParameter("attempted to describe TLS identity without TLS credentials")
-	}
-
-	tlsIdent, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
+func describeIdentity(ident *identity.Identity) (string, error) {
+	tlsIdent, err := tlsca.FromSubject(ident.XCert.Subject, ident.XCert.NotAfter)
 	if err != nil {
 		return "", trace.Wrap(err, "bot TLS certificate can not be parsed as an identity")
 	}
 
 	var principals []string
-	for _, principal := range tlsIdent.Principals {
+	for _, principal := range ident.Cert.ValidPrincipals {
 		if !strings.HasPrefix(principal, constants.NoLoginPrefix) {
 			principals = append(principals, principal)
 		}
 	}
 
-	duration := cert.NotAfter.Sub(cert.NotBefore)
+	duration := time.Second * time.Duration(ident.Cert.ValidBefore-ident.Cert.ValidAfter)
 	return fmt.Sprintf(
-		"valid: after=%v, before=%v, duration=%s | kind=tls, renewable=%v, disallow-reissue=%v, roles=%v, principals=%v, generation=%v",
-		cert.NotBefore.Format(time.RFC3339),
-		cert.NotAfter.Format(time.RFC3339),
+		"valid: after=%v, before=%v, duration=%s | properties: renewable=%v, disallow-reissue=%v, roles=%v, principals=%v, generation=%v",
+		time.Unix(int64(ident.Cert.ValidAfter), 0),
+		time.Unix(int64(ident.Cert.ValidBefore), 0),
 		duration,
 		tlsIdent.Renewable,
 		tlsIdent.DisallowReissue,
@@ -506,242 +360,136 @@ func describeTLSIdentity(ident *identity.Identity) (string, error) {
 	), nil
 }
 
-// describeSSHIdentity writes an informational message about the given SSH
-// identity to the log.
-func describeSSHIdentity(ident *identity.Identity) (string, error) {
-	cert := ident.SSHCert
-	if cert == nil {
-		return "", trace.BadParameter("attempted to describe SSH identity without SSH credentials")
-	}
-
-	renewable := false
-	if _, ok := cert.Extensions[teleport.CertExtensionRenewable]; ok {
-		renewable = true
-	}
-
-	disallowReissue := false
-	if _, ok := cert.Extensions[teleport.CertExtensionDisallowReissue]; ok {
-		disallowReissue = true
-	}
-
-	var roles []string
-	if rolesStr, ok := cert.Extensions[teleport.CertExtensionTeleportRoles]; ok {
-		if actualRoles, err := services.UnmarshalCertRoles(rolesStr); err == nil {
-			roles = actualRoles
-		}
-	}
-
-	var principals []string
-	for _, principal := range cert.ValidPrincipals {
-		if !strings.HasPrefix(principal, constants.NoLoginPrefix) {
-			principals = append(principals, principal)
-		}
-	}
-
-	duration := time.Second * time.Duration(cert.ValidBefore-cert.ValidAfter)
-	return fmt.Sprintf(
-		"valid: after=%v, before=%v, duration=%s | kind=ssh, renewable=%v, disallow-reissue=%v, roles=%v, principals=%v",
-		time.Unix(int64(cert.ValidAfter), 0).Format(time.RFC3339),
-		time.Unix(int64(cert.ValidBefore), 0).Format(time.RFC3339),
-		duration,
-		renewable,
-		disallowReissue,
-		roles,
-		principals,
-	), nil
-}
-
-// renew performs a single renewal
-func renew(
-	ctx context.Context, cfg *config.BotConfig, client auth.ClientI,
-	ident *identity.Identity, botDestination destination.Destination,
-) (auth.ClientI, *identity.Identity, error) {
-	// Make sure we can still write to the bot's destination.
-	if err := identity.VerifyWrite(botDestination); err != nil {
-		return nil, nil, trace.Wrap(err, "Cannot write to destination %s, aborting.", botDestination)
-	}
+func renewLoop(ctx context.Context, cfg *config.BotConfig, client auth.ClientI, ident *identity.Identity) error {
+	// TODO: failures here should probably not just end the renewal loop, there
+	// should be some retry / back-off logic.
 
-	log.Debug("Attempting to renew bot certificates...")
-	newIdentity, err := renewIdentityViaAuth(ctx, client, ident, cfg)
-	if err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
+	// TODO: what should this interval be? should it be user configurable?
+	// Also, must be < the validity period.
+	// TODO: validate that cert is actually renewable.
 
-	identStr, err := describeTLSIdentity(ident)
-	if err != nil {
-		return nil, nil, trace.Wrap(err, "Could not describe bot identity at %s", botDestination)
+	log.Infof("Beginning renewal loop: ttl=%s interval=%s", cfg.CertificateTTL, cfg.RenewInterval)
+	if cfg.RenewInterval > cfg.CertificateTTL {
+		log.Errorf(
+			"Certificate TTL (%s) is shorter than the renewal interval (%s). The next renewal is likely to fail.",
+			cfg.CertificateTTL,
+			cfg.RenewInterval,
+		)
 	}
 
-	log.Infof("Successfully renewed bot certificates, %s", identStr)
-
-	// TODO: warn if duration < certTTL? would indicate TTL > server's max renewable cert TTL
-	// TODO: error if duration < renewalInterval? next renewal attempt will fail
-
-	// Immediately attempt to reconnect using the new identity (still
-	// haven't persisted the known-good certs).
-	newClient, err := authenticatedUserClientFromIdentity(ctx, newIdentity, cfg.AuthServer)
+	// Determine where the bot should write its internal data (renewable cert
+	// etc)
+	botDestination, err := cfg.Storage.GetDestination()
 	if err != nil {
-		return nil, nil, trace.Wrap(err)
+		return trace.Wrap(err)
 	}
 
-	// Attempt a request to make sure our client works.
-	// TODO: consider a retry/backoff loop.
-	if _, err := newClient.Ping(ctx); err != nil {
-		return nil, nil, trace.Wrap(err, "unable to communicate with auth server")
-	}
+	ticker := time.NewTicker(cfg.RenewInterval)
+	defer ticker.Stop()
+	for {
+		log.Debug("Attempting to renew bot certificates...")
+		newIdentity, err := renewIdentityViaAuth(ctx, client, ident, cfg)
+		if err != nil {
+			return trace.Wrap(err)
+		}
 
-	log.Debug("Auth client now using renewed credentials.")
-	client = newClient
-	ident = newIdentity
+		identStr, err := describeIdentity(ident)
+		if err != nil {
+			return trace.Wrap(err, "Could not describe bot identity at %s", botDestination)
+		}
 
-	// Now that we're sure the new creds work, persist them.
-	if err := identity.SaveIdentity(newIdentity, botDestination, identity.BotKinds()...); err != nil {
-		return nil, nil, trace.Wrap(err)
-	}
+		log.Infof("Successfully renewed bot certificates, %s", identStr)
 
-	// Determine the default role list based on the bot role. The role's
-	// name should match the certificate's Key ID (user and role names
-	// should all match bot-$name)
-	botResourceName := ident.X509Cert.Subject.CommonName
-	defaultRoles, err := fetchDefaultRoles(ctx, client, botResourceName)
-	if err != nil {
-		log.WithError(err).Warnf("Unable to determine default roles, no roles will be requested if unspecified")
-		defaultRoles = []string{}
-	}
+		// TODO: warn if duration < certTTL? would indicate TTL > server's max renewable cert TTL
+		// TODO: error if duration < renewalInterval? next renewal attempt will fail
 
-	// Next, generate impersonated certs
-	expires := ident.X509Cert.NotAfter
-	for _, dest := range cfg.Destinations {
-		destImpl, err := dest.GetDestination()
+		// Immediately attempt to reconnect using the new identity (still
+		// haven't persisted the known-good certs).
+		newClient, err := authenticatedUserClientFromIdentity(ctx, newIdentity, cfg.AuthServer)
 		if err != nil {
-			return nil, nil, trace.Wrap(err)
+			return trace.Wrap(err)
 		}
 
-		// Check the ACLs. We can't fix them, but we can warn if they're
-		// misconfigured. We'll need to precompute a list of keys to check.
-		// Note: This may only log a warning, depending on configuration.
-		if err := destImpl.Verify(identity.ListKeys(dest.Kinds...)); err != nil {
-			return nil, nil, trace.Wrap(err)
+		// Attempt a request to make sure our client works.
+		// TODO: consider a retry/backoff loop.
+		if _, err := newClient.Ping(ctx); err != nil {
+			return trace.Wrap(err, "unable to communicate with auth server")
 		}
 
-		// Ensure this destination is also writable. This is a hard fail if
-		// ACLs are misconfigured, regardless of configuration.
-		// TODO: consider not making these a hard error? e.g. write other
-		// destinations even if this one is broken?
-		if err := identity.VerifyWrite(destImpl); err != nil {
-			return nil, nil, trace.Wrap(err, "Could not write to destination %s, aborting.", destImpl)
-		}
+		log.Debug("Auth client now using renewed credentials.")
+		client = newClient
+		ident = newIdentity
 
-		var desiredRoles []string
-		if len(dest.Roles) > 0 {
-			desiredRoles = dest.Roles
-		} else {
-			log.Debugf("Destination specified no roles, defaults will be requested: %v", defaultRoles)
-			desiredRoles = defaultRoles
+		// Now that we're sure the new creds work, persist them.
+		if err := identity.SaveIdentity(newIdentity, botDestination); err != nil {
+			return trace.Wrap(err)
 		}
 
-		impersonatedIdent, err := generateImpersonatedIdentity(ctx, client, ident, expires, desiredRoles, dest.Kinds)
+		// Determine the default role list based on the bot role. The role's
+		// name should match the certificate's Key ID (user and role names
+		// should all match bot-$name)
+		defaultRoles, err := fetchDefaultRoles(ctx, client, ident.Cert.KeyId)
 		if err != nil {
-			return nil, nil, trace.Wrap(err, "Failed to generate impersonated certs for %s: %+v", destImpl, err)
+			log.WithError(err).Warnf("Unable to determine default roles, no roles will be requested if unspecified")
+			defaultRoles = []string{}
 		}
 
-		var impersonatedIdentStr string
-		if dest.ContainsKind(identity.KindTLS) {
-			impersonatedIdentStr, err = describeTLSIdentity(impersonatedIdent)
+		// Next, generate impersonated certs
+		expires := time.Unix(int64(ident.Cert.ValidBefore), 0)
+		for _, dest := range cfg.Destinations {
+			destImpl, err := dest.GetDestination()
 			if err != nil {
-				return nil, nil, trace.Wrap(err, "could not describe impersonated certs for destination %s", destImpl)
+				return trace.Wrap(err)
 			}
-		} else {
-			// Note: kinds must contain at least 1 of TLS or SSH
-			impersonatedIdentStr, err = describeSSHIdentity(impersonatedIdent)
-			if err != nil {
-				return nil, nil, trace.Wrap(err, "could not describe impersonated certs for destination %s", destImpl)
-			}
-		}
-		log.Infof("Successfully renewed impersonated certificates for %s, %s", destImpl, impersonatedIdentStr)
 
-		if err := identity.SaveIdentity(impersonatedIdent, destImpl, dest.Kinds...); err != nil {
-			return nil, nil, trace.Wrap(err, "failed to save impersonated identity to destination %s", destImpl)
-		}
+			var desiredRoles []string
+			if len(dest.Roles) > 0 {
+				desiredRoles = dest.Roles
+			} else {
+				log.Debugf("Destination specified no roles, defaults will be requested: %v", defaultRoles)
+				desiredRoles = defaultRoles
+			}
 
-		for _, templateConfig := range dest.Configs {
-			template, err := templateConfig.GetConfigTemplate()
+			impersonatedIdent, err := generateImpersonatedIdentity(ctx, client, ident, expires, desiredRoles)
 			if err != nil {
-				return nil, nil, trace.Wrap(err)
+				return trace.Wrap(err, "Failed to generate impersonated certs for %s: %+v", destImpl, err)
 			}
 
-			if err := template.Render(ctx, client, impersonatedIdent, dest); err != nil {
-				log.WithError(err).Warnf("Failed to render config template %+v", templateConfig)
+			impersonatedIdentStr, err := describeIdentity(impersonatedIdent)
+			if err != nil {
+				return trace.Wrap(err, "could not describe impersonated certs for destination %s", destImpl)
 			}
-		}
-	}
-
-	log.Infof("Persisted new certificates to disk. Next renewal in approximately %s", cfg.RenewalInterval)
-	return newClient, newIdentity, nil
-}
-
-func renewLoop(ctx context.Context, cfg *config.BotConfig, client auth.ClientI, ident *identity.Identity, reloadChan chan struct{}) error {
-	// TODO: failures here should probably not just end the renewal loop, there
-	// should be some retry / back-off logic.
-
-	// TODO: what should this interval be? should it be user configurable?
-	// Also, must be < the validity period.
-	// TODO: validate that cert is actually renewable.
+			log.Infof("Successfully renewed impersonated certificates for %s, %s", destImpl, impersonatedIdentStr)
 
-	log.Infof("Beginning renewal loop: ttl=%s interval=%s", cfg.CertificateTTL, cfg.RenewalInterval)
-	if cfg.RenewalInterval > cfg.CertificateTTL {
-		log.Errorf(
-			"Certificate TTL (%s) is shorter than the renewal interval (%s). The next renewal is likely to fail.",
-			cfg.CertificateTTL,
-			cfg.RenewalInterval,
-		)
-	}
-
-	// Determine where the bot should write its internal data (renewable cert
-	// etc)
-	botDestination, err := cfg.Storage.GetDestination()
-	if err != nil {
-		return trace.Wrap(err)
-	}
+			if err := identity.SaveIdentity(impersonatedIdent, destImpl); err != nil {
+				return trace.Wrap(err, "failed to save impersonated identity to destination %s", destImpl)
+			}
 
-	ticker := time.NewTicker(cfg.RenewalInterval)
-	defer ticker.Stop()
-	for {
-		newClient, newIdentity, err := renew(ctx, cfg, client, ident, botDestination)
-		if err != nil {
-			return trace.Wrap(err)
-		}
+			for _, templateConfig := range dest.Configs {
+				template, err := templateConfig.GetConfigTemplate()
+				if err != nil {
+					return trace.Wrap(err)
+				}
 
-		if cfg.Oneshot {
-			log.Info("Oneshot mode enabled, exiting successfully.")
-			break
+				if err := template.Render(ctx, client, impersonatedIdent, dest); err != nil {
+					log.WithError(err).Warnf("Failed to render config template %+v", templateConfig)
+				}
+			}
 		}
 
-		client = newClient
-		ident = newIdentity
+		log.Infof("Persisted new certificates to disk. Next renewal in approximately %s", cfg.RenewInterval)
 
 		select {
 		case <-ctx.Done():
 			return nil
 		case <-ticker.C:
 			continue
-		case <-reloadChan:
-			continue
 		}
-	}
 
-	return nil
+	}
 }
 
-// authenticatedUserClientFromIdentity creates a new auth client from the given
-// identity. Note that depending on the connection address given, this may
-// attempt to connect via the proxy and therefore requires both SSH and TLS
-// credentials.
 func authenticatedUserClientFromIdentity(ctx context.Context, id *identity.Identity, authServer string) (auth.ClientI, error) {
-	if id.SSHCert == nil || id.X509Cert == nil {
-		return nil, trace.BadParameter("auth client requires a fully formed identity")
-	}
-
 	tlsConfig, err := id.TLSConfig(nil /* cipherSuites */)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -774,7 +522,6 @@ func generateImpersonatedIdentity(
 	currentIdentity *identity.Identity,
 	expires time.Time,
 	roleRequests []string,
-	kinds []identity.ArtifactKind,
 ) (*identity.Identity, error) {
 	// TODO: enforce expiration > renewal period (by what margin?)
 
@@ -790,7 +537,7 @@ func generateImpersonatedIdentity(
 	// expiration date.
 	certs, err := client.GenerateUserCerts(ctx, proto.UserCertsRequest{
 		PublicKey:    publicKey,
-		Username:     currentIdentity.X509Cert.Subject.CommonName,
+		Username:     currentIdentity.XCert.Subject.CommonName,
 		Expires:      expires,
 		RoleRequests: roleRequests,
 	})
@@ -819,10 +566,11 @@ func generateImpersonatedIdentity(
 		certs.TLSCACerts = append(certs.TLSCACerts, pemBytes)
 	}
 
-	newIdentity, err := identity.ReadIdentityFromStore(&identity.LoadIdentityParams{
-		PrivateKeyBytes: privateKey,
-		PublicKeyBytes:  publicKey,
-	}, certs, kinds...)
+	newIdentity, err := identity.ReadIdentityFromKeyPair(
+		privateKey,
+		publicKey,
+		certs,
+	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/app_command.go b/tool/tctl/common/app_command.go
index 711e18b7d01ce..3c5554a018c86 100644
--- a/tool/tctl/common/app_command.go
+++ b/tool/tctl/common/app_command.go
@@ -25,12 +25,8 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
-	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/service"
 )
 
@@ -41,13 +37,6 @@ type AppsCommand struct {
 	// format is the output format (text, json, or yaml)
 	format string
 
-	searchKeywords string
-	predicateExpr  string
-	labels         string
-
-	// verbose sets whether full table output should be shown for labels
-	verbose bool
-
 	// appsList implements the "tctl apps ls" subcommand.
 	appsList *kingpin.CmdClause
 }
@@ -58,11 +47,7 @@ func (c *AppsCommand) Initialize(app *kingpin.Application, config *service.Confi
 
 	apps := app.Command("apps", "Operate on applications registered with the cluster.")
 	c.appsList = apps.Command("ls", "List all applications registered with the cluster.")
-	c.appsList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).StringVar(&c.format)
-	c.appsList.Arg("labels", labelHelp).StringVar(&c.labels)
-	c.appsList.Flag("search", searchHelp).StringVar(&c.searchKeywords)
-	c.appsList.Flag("query", queryHelp).StringVar(&c.predicateExpr)
-	c.appsList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
+	c.appsList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default("text").StringVar(&c.format)
 }
 
 // TryRun attempts to run subcommands like "apps ls".
@@ -78,52 +63,27 @@ func (c *AppsCommand) TryRun(cmd string, client auth.ClientI) (match bool, err e
 
 // ListApps prints the list of applications that have recently sent heartbeats
 // to the cluster.
-func (c *AppsCommand) ListApps(clt auth.ClientI) error {
-	ctx := context.TODO()
-
-	labels, err := libclient.ParseLabelSpec(c.labels)
+func (c *AppsCommand) ListApps(client auth.ClientI) error {
+	servers, err := client.GetApplicationServers(context.TODO(), apidefaults.Namespace)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-
-	var servers []types.AppServer
-	resources, err := client.GetResourcesWithFilters(ctx, clt, proto.ListResourcesRequest{
-		ResourceType:        types.KindAppServer,
-		Labels:              labels,
-		PredicateExpression: c.predicateExpr,
-		SearchKeywords:      libclient.ParseSearchKeywords(c.searchKeywords, ','),
-	})
-	switch {
-	// Underlying ListResources for app servers not available, use fallback.
-	// Using filter flags with older auth will silently do nothing.
-	//
-	// DELETE IN 11.0.0
-	case trace.IsNotImplemented(err):
-		servers, err = clt.GetApplicationServers(ctx, apidefaults.Namespace)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	case err != nil:
-		return trace.Wrap(err)
-	default:
-		servers, err = types.ResourcesWithLabels(resources).AsAppServers()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	coll := &appServerCollection{servers: servers, verbose: c.verbose}
+	coll := &appServerCollection{servers: servers}
 
 	switch c.format {
 	case teleport.Text:
-		return trace.Wrap(coll.writeText(os.Stdout))
+		err = coll.writeText(os.Stdout)
 	case teleport.JSON:
-		return trace.Wrap(coll.writeJSON(os.Stdout))
+		err = coll.writeJSON(os.Stdout)
 	case teleport.YAML:
-		return trace.Wrap(coll.writeYAML(os.Stdout))
+		err = coll.writeYAML(os.Stdout)
 	default:
 		return trace.BadParameter("unknown format %q", c.format)
 	}
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
 }
 
 var appMessageTemplate = template.Must(template.New("app").Parse(`The invite token: {{.token}}.
diff --git a/tool/tctl/common/auth_command.go b/tool/tctl/common/auth_command.go
index f89acecb3155a..6dce83157fa70 100644
--- a/tool/tctl/common/auth_command.go
+++ b/tool/tctl/common/auth_command.go
@@ -19,6 +19,7 @@ import (
 	"crypto/x509/pkix"
 	"encoding/pem"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -132,16 +133,15 @@ func (a *AuthCommand) Initialize(app *kingpin.Application, config *service.Confi
 // TryRun takes the CLI command as an argument (like "auth gen") and executes it
 // or returns match=false if 'cmd' does not belong to it
 func (a *AuthCommand) TryRun(cmd string, client auth.ClientI) (match bool, err error) {
-	ctx := context.Background()
 	switch cmd {
 	case a.authGenerate.FullCommand():
-		err = a.GenerateKeys(ctx)
+		err = a.GenerateKeys()
 	case a.authExport.FullCommand():
-		err = a.ExportAuthorities(ctx, client)
+		err = a.ExportAuthorities(client)
 	case a.authSign.FullCommand():
-		err = a.GenerateAndSignKeys(ctx, client)
+		err = a.GenerateAndSignKeys(client)
 	case a.authRotate.FullCommand():
-		err = a.RotateCertAuthority(ctx, client)
+		err = a.RotateCertAuthority(client)
 	default:
 		return false, nil
 	}
@@ -153,7 +153,7 @@ var allowedCertificateTypes = []string{"user", "host", "tls-host", "tls-user", "
 // ExportAuthorities outputs the list of authorities in OpenSSH compatible formats
 // If --type flag is given, only prints keys for CAs of this type, otherwise
 // prints all keys
-func (a *AuthCommand) ExportAuthorities(ctx context.Context, client auth.ClientI) error {
+func (a *AuthCommand) ExportAuthorities(client auth.ClientI) error {
 	var typesToExport []types.CertAuthType
 
 	// this means to export TLS authority
@@ -162,11 +162,11 @@ func (a *AuthCommand) ExportAuthorities(ctx context.Context, client auth.ClientI
 	// "tls-host" and "tls-user" were added later to allow export of the user
 	// TLS CA.
 	case "tls", "tls-host":
-		return a.exportTLSAuthority(ctx, client, types.HostCA, false)
+		return a.exportTLSAuthority(client, types.HostCA, false)
 	case "tls-user":
-		return a.exportTLSAuthority(ctx, client, types.UserCA, false)
+		return a.exportTLSAuthority(client, types.UserCA, false)
 	case "tls-user-der", "windows":
-		return a.exportTLSAuthority(ctx, client, types.UserCA, true)
+		return a.exportTLSAuthority(client, types.UserCA, true)
 	}
 
 	// if no --type flag is given, export all types
@@ -188,7 +188,7 @@ func (a *AuthCommand) ExportAuthorities(ctx context.Context, client auth.ClientI
 	// trusted ones)
 	var authorities []types.CertAuthority
 	for _, at := range typesToExport {
-		cas, err := client.GetCertAuthorities(ctx, at, a.exportPrivateKeys)
+		cas, err := client.GetCertAuthorities(at, a.exportPrivateKeys)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -257,13 +257,12 @@ func (a *AuthCommand) ExportAuthorities(ctx context.Context, client auth.ClientI
 	return nil
 }
 
-func (a *AuthCommand) exportTLSAuthority(ctx context.Context, client auth.ClientI, typ types.CertAuthType, unpackPEM bool) error {
+func (a *AuthCommand) exportTLSAuthority(client auth.ClientI, typ types.CertAuthType, unpackPEM bool) error {
 	clusterName, err := client.GetDomainName()
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	certAuthority, err := client.GetCertAuthority(
-		ctx,
 		types.CertAuthID{Type: typ, DomainName: clusterName},
 		a.exportPrivateKeys,
 	)
@@ -296,19 +295,19 @@ func (a *AuthCommand) exportTLSAuthority(ctx context.Context, client auth.Client
 }
 
 // GenerateKeys generates a new keypair
-func (a *AuthCommand) GenerateKeys(ctx context.Context) error {
-	keygen := native.New(ctx, native.PrecomputeKeys(0))
+func (a *AuthCommand) GenerateKeys() error {
+	keygen := native.New(context.TODO(), native.PrecomputeKeys(0))
 	defer keygen.Close()
 	privBytes, pubBytes, err := keygen.GenerateKeyPair("")
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	err = os.WriteFile(a.genPubPath, pubBytes, 0600)
+	err = ioutil.WriteFile(a.genPubPath, pubBytes, 0600)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	err = os.WriteFile(a.genPrivPath, privBytes, 0600)
+	err = ioutil.WriteFile(a.genPrivPath, privBytes, 0600)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -318,23 +317,23 @@ func (a *AuthCommand) GenerateKeys(ctx context.Context) error {
 }
 
 // GenerateAndSignKeys generates a new keypair and signs it for role
-func (a *AuthCommand) GenerateAndSignKeys(ctx context.Context, clusterAPI auth.ClientI) error {
+func (a *AuthCommand) GenerateAndSignKeys(clusterAPI auth.ClientI) error {
 	switch a.outputFormat {
 	case identityfile.FormatDatabase, identityfile.FormatMongo, identityfile.FormatCockroach, identityfile.FormatRedis:
-		return a.generateDatabaseKeys(ctx, clusterAPI)
+		return a.generateDatabaseKeys(clusterAPI)
 	}
 	switch {
 	case a.genUser != "" && a.genHost == "":
-		return a.generateUserKeys(ctx, clusterAPI)
+		return a.generateUserKeys(clusterAPI)
 	case a.genUser == "" && a.genHost != "":
-		return a.generateHostKeys(ctx, clusterAPI)
+		return a.generateHostKeys(clusterAPI)
 	default:
 		return trace.BadParameter("--user or --host must be specified")
 	}
 }
 
 // RotateCertAuthority starts or restarts certificate authority rotation process
-func (a *AuthCommand) RotateCertAuthority(ctx context.Context, client auth.ClientI) error {
+func (a *AuthCommand) RotateCertAuthority(client auth.ClientI) error {
 	req := auth.RotateRequest{
 		Type:        types.CertAuthType(a.rotateType),
 		GracePeriod: &a.rotateGracePeriod,
@@ -345,7 +344,7 @@ func (a *AuthCommand) RotateCertAuthority(ctx context.Context, client auth.Clien
 	} else {
 		req.Mode = types.RotationModeAuto
 	}
-	if err := client.RotateCertAuthority(ctx, req); err != nil {
+	if err := client.RotateCertAuthority(req); err != nil {
 		return err
 	}
 	if a.rotateTargetPhase != "" {
@@ -357,7 +356,7 @@ func (a *AuthCommand) RotateCertAuthority(ctx context.Context, client auth.Clien
 	return nil
 }
 
-func (a *AuthCommand) generateHostKeys(ctx context.Context, clusterAPI auth.ClientI) error {
+func (a *AuthCommand) generateHostKeys(clusterAPI auth.ClientI) error {
 	// only format=openssh is supported
 	if a.outputFormat != identityfile.FormatOpenSSH {
 		return trace.BadParameter("invalid --format flag %q, only %q is supported", a.outputFormat, identityfile.FormatOpenSSH)
@@ -384,7 +383,7 @@ func (a *AuthCommand) generateHostKeys(ctx context.Context, clusterAPI auth.Clie
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	hostCAs, err := clusterAPI.GetCertAuthorities(ctx, types.HostCA, false)
+	hostCAs, err := clusterAPI.GetCertAuthorities(types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -411,17 +410,17 @@ func (a *AuthCommand) generateHostKeys(ctx context.Context, clusterAPI auth.Clie
 
 // generateDatabaseKeys generates a new unsigned key and signs it with Teleport
 // CA for database access.
-func (a *AuthCommand) generateDatabaseKeys(ctx context.Context, clusterAPI auth.ClientI) error {
+func (a *AuthCommand) generateDatabaseKeys(clusterAPI auth.ClientI) error {
 	key, err := client.NewKey()
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	return a.generateDatabaseKeysForKey(ctx, clusterAPI, key)
+	return a.generateDatabaseKeysForKey(clusterAPI, key)
 }
 
 // generateDatabaseKeysForKey signs the provided unsigned key with Teleport CA
 // for database access.
-func (a *AuthCommand) generateDatabaseKeysForKey(ctx context.Context, clusterAPI auth.ClientI, key *client.Key) error {
+func (a *AuthCommand) generateDatabaseKeysForKey(clusterAPI auth.ClientI, key *client.Key) error {
 	principals := strings.Split(a.genHost, ",")
 	if len(principals) == 1 && principals[0] == "" {
 		return trace.BadParameter("at least one hostname must be specified via --host flag")
@@ -456,7 +455,7 @@ func (a *AuthCommand) generateDatabaseKeysForKey(ctx context.Context, clusterAPI
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	resp, err := clusterAPI.GenerateDatabaseCert(ctx,
+	resp, err := clusterAPI.GenerateDatabaseCert(context.TODO(),
 		&proto.DatabaseCertRequest{
 			CSR: csr,
 			// Important to include SANs since CommonName has been deprecated
@@ -554,13 +553,13 @@ cockroach start \
 To enable mutual TLS on your Redis server, add the following to your redis.conf:
 
 tls-ca-cert-file /path/to/{{.output}}.cas
-tls-cert-file /path/to/{{.output}}.crt
+tls-cert-file /path/to/{{.output}}.crt 
 tls-key-file /path/to/{{.output}}.key
 tls-protocols "TLSv1.2 TLSv1.3"
 `))
 )
 
-func (a *AuthCommand) generateUserKeys(ctx context.Context, clusterAPI auth.ClientI) error {
+func (a *AuthCommand) generateUserKeys(clusterAPI auth.ClientI) error {
 	// Validate --proxy flag.
 	if err := a.checkProxyAddr(clusterAPI); err != nil {
 		return trace.Wrap(err)
@@ -590,7 +589,7 @@ func (a *AuthCommand) generateUserKeys(ctx context.Context, clusterAPI auth.Clie
 	}
 	key.ClusterName = a.leafCluster
 
-	if err := a.checkKubeCluster(ctx, clusterAPI); err != nil {
+	if err := a.checkKubeCluster(clusterAPI); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -598,12 +597,12 @@ func (a *AuthCommand) generateUserKeys(ctx context.Context, clusterAPI auth.Clie
 	var certUsage proto.UserCertsRequest_CertUsage
 
 	if a.appName != "" {
-		server, err := getApplicationServer(ctx, clusterAPI, a.appName)
+		server, err := getApplicationServer(context.TODO(), clusterAPI, a.appName)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
-		appSession, err := clusterAPI.CreateAppSession(ctx, types.CreateAppSessionRequest{
+		appSession, err := clusterAPI.CreateAppSession(context.TODO(), types.CreateAppSessionRequest{
 			Username:    a.genUser,
 			PublicAddr:  server.GetApp().GetPublicAddr(),
 			ClusterName: a.leafCluster,
@@ -623,7 +622,7 @@ func (a *AuthCommand) generateUserKeys(ctx context.Context, clusterAPI auth.Clie
 
 	reqExpiry := time.Now().UTC().Add(a.genTTL)
 	// Request signed certs from `auth` server.
-	certs, err := clusterAPI.GenerateUserCerts(ctx, proto.UserCertsRequest{
+	certs, err := clusterAPI.GenerateUserCerts(context.TODO(), proto.UserCertsRequest{
 		PublicKey:         key.Pub,
 		Username:          a.genUser,
 		Expires:           reqExpiry,
@@ -639,7 +638,7 @@ func (a *AuthCommand) generateUserKeys(ctx context.Context, clusterAPI auth.Clie
 	key.Cert = certs.SSH
 	key.TLSCert = certs.TLS
 
-	hostCAs, err := clusterAPI.GetCertAuthorities(ctx, types.HostCA, false)
+	hostCAs, err := clusterAPI.GetCertAuthorities(types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -700,7 +699,7 @@ func (a *AuthCommand) checkLeafCluster(clusterAPI auth.ClientI) error {
 
 }
 
-func (a *AuthCommand) checkKubeCluster(ctx context.Context, clusterAPI auth.ClientI) error {
+func (a *AuthCommand) checkKubeCluster(clusterAPI auth.ClientI) error {
 	if a.outputFormat != identityfile.FormatKubernetes && a.kubeCluster != "" {
 		// User set --kube-cluster-name but it's not actually used for the chosen --format.
 		// Print a warning but continue.
@@ -720,7 +719,7 @@ func (a *AuthCommand) checkKubeCluster(ctx context.Context, clusterAPI auth.Clie
 		return nil
 	}
 
-	a.kubeCluster, err = kubeutils.CheckOrSetKubeCluster(ctx, clusterAPI, a.kubeCluster, a.leafCluster)
+	a.kubeCluster, err = kubeutils.CheckOrSetKubeCluster(context.TODO(), clusterAPI, a.kubeCluster, a.leafCluster)
 	if err != nil && !trace.IsNotFound(err) {
 		return trace.Wrap(err)
 	}
@@ -738,21 +737,7 @@ func (a *AuthCommand) checkProxyAddr(clusterAPI auth.ClientI) error {
 		return nil
 	}
 	if a.proxyAddr != "" {
-		// User set --proxy. Validate it and set its scheme to https in case it was omitted.
-		u, err := url.Parse(a.proxyAddr)
-		if err != nil {
-			return trace.WrapWithMessage(err, "specified --proxy URL is invalid")
-		}
-		switch u.Scheme {
-		case "":
-			u.Scheme = "https"
-			a.proxyAddr = u.String()
-			return nil
-		case "http", "https":
-			return nil
-		default:
-			return trace.BadParameter("expected --proxy URL with http or https scheme")
-		}
+		return nil
 	}
 
 	// User didn't specify --proxy for kubeconfig. Let's try to guess it.
diff --git a/tool/tctl/common/auth_command_test.go b/tool/tctl/common/auth_command_test.go
index 1b267066a6606..078160132d496 100644
--- a/tool/tctl/common/auth_command_test.go
+++ b/tool/tctl/common/auth_command_test.go
@@ -18,6 +18,7 @@ import (
 	"bytes"
 	"context"
 	"crypto/x509/pkix"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -41,7 +42,11 @@ import (
 func TestAuthSignKubeconfig(t *testing.T) {
 	t.Parallel()
 
-	tmpDir := t.TempDir()
+	tmpDir, err := ioutil.TempDir("", "auth_command_test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpDir)
 
 	clusterName, err := services.NewClusterNameWithRandomID(types.ClusterNameSpecV2{
 		ClusterName: "example.com",
@@ -99,55 +104,17 @@ func TestAuthSignKubeconfig(t *testing.T) {
 		ac          AuthCommand
 		wantAddr    string
 		wantCluster string
-		assertErr   require.ErrorAssertionFunc
+		wantError   string
 	}{
 		{
-			desc: "valid --proxy URL with valid URL scheme",
-			ac: AuthCommand{
-				output:        filepath.Join(tmpDir, "kubeconfig"),
-				outputFormat:  identityfile.FormatKubernetes,
-				signOverwrite: true,
-				proxyAddr:     "https://proxy-from-flag.example.com",
-			},
-			wantAddr:  "https://proxy-from-flag.example.com",
-			assertErr: require.NoError,
-		},
-		{
-			desc: "valid --proxy URL with invalid URL scheme",
-			ac: AuthCommand{
-				output:        filepath.Join(tmpDir, "kubeconfig"),
-				outputFormat:  identityfile.FormatKubernetes,
-				signOverwrite: true,
-				proxyAddr:     "file://proxy-from-flag.example.com",
-			},
-			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
-				require.Error(t, err)
-				require.Equal(t, err.Error(), "expected --proxy URL with http or https scheme")
-			},
-		},
-		{
-			desc: "valid --proxy URL without URL scheme",
+			desc: "--proxy specified",
 			ac: AuthCommand{
 				output:        filepath.Join(tmpDir, "kubeconfig"),
 				outputFormat:  identityfile.FormatKubernetes,
 				signOverwrite: true,
 				proxyAddr:     "proxy-from-flag.example.com",
 			},
-			wantAddr:  "https://proxy-from-flag.example.com",
-			assertErr: require.NoError,
-		},
-		{
-			desc: "invalid --proxy URL",
-			ac: AuthCommand{
-				output:        filepath.Join(tmpDir, "kubeconfig"),
-				outputFormat:  identityfile.FormatKubernetes,
-				signOverwrite: true,
-				proxyAddr:     "1https://proxy-from-flag.example.com",
-			},
-			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
-				require.Error(t, err)
-				require.Contains(t, err.Error(), "specified --proxy URL is invalid")
-			},
+			wantAddr: "proxy-from-flag.example.com",
 		},
 		{
 			desc: "k8s proxy running locally with public_addr",
@@ -160,8 +127,7 @@ func TestAuthSignKubeconfig(t *testing.T) {
 					PublicAddrs: []utils.NetAddr{{Addr: "proxy-from-config.example.com:3026"}},
 				}}},
 			},
-			wantAddr:  "https://proxy-from-config.example.com:3026",
-			assertErr: require.NoError,
+			wantAddr: "https://proxy-from-config.example.com:3026",
 		},
 		{
 			desc: "k8s proxy running locally without public_addr",
@@ -176,8 +142,7 @@ func TestAuthSignKubeconfig(t *testing.T) {
 					PublicAddrs: []utils.NetAddr{{Addr: "proxy-from-config.example.com:3080"}},
 				}},
 			},
-			wantAddr:  "https://proxy-from-config.example.com:3026",
-			assertErr: require.NoError,
+			wantAddr: "https://proxy-from-config.example.com:3026",
 		},
 		{
 			desc: "k8s proxy from cluster info",
@@ -191,8 +156,7 @@ func TestAuthSignKubeconfig(t *testing.T) {
 					},
 				}},
 			},
-			wantAddr:  "https://proxy-from-api.example.com:3026",
-			assertErr: require.NoError,
+			wantAddr: "https://proxy-from-api.example.com:3026",
 		},
 		{
 			desc: "--kube-cluster specified with valid cluster",
@@ -208,7 +172,6 @@ func TestAuthSignKubeconfig(t *testing.T) {
 				}},
 			},
 			wantCluster: remoteCluster.GetMetadata().Name,
-			assertErr:   require.NoError,
 		},
 		{
 			desc: "--kube-cluster specified with invalid cluster",
@@ -223,17 +186,19 @@ func TestAuthSignKubeconfig(t *testing.T) {
 					},
 				}},
 			},
-			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
-				require.Error(t, err)
-				require.Equal(t, err.Error(), "couldn't find leaf cluster named \"doesnotexist.example.com\"")
-			},
+			wantError: "couldn't find leaf cluster named \"doesnotexist.example.com\"",
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			// Generate kubeconfig.
-			err := tt.ac.generateUserKeys(context.Background(), client)
-			tt.assertErr(t, err)
+			if err = tt.ac.generateUserKeys(client); err != nil && tt.wantError == "" {
+				t.Fatalf("generating KubeProxyConfig: %v", err)
+			}
+
+			if tt.wantError != "" && (err == nil || err.Error() != tt.wantError) {
+				t.Errorf("got error %v, want %v", err, tt.wantError)
+			}
 
 			// Validate kubeconfig contents.
 			kc, err := kubeconfig.Load(tt.ac.output)
@@ -283,7 +248,7 @@ func (c *mockClient) GenerateUserCerts(ctx context.Context, userCertsReq proto.U
 	c.userCertsReq = &userCertsReq
 	return c.userCerts, nil
 }
-func (c *mockClient) GetCertAuthorities(context.Context, types.CertAuthType, bool, ...services.MarshalOption) ([]types.CertAuthority, error) {
+func (c *mockClient) GetCertAuthorities(types.CertAuthType, bool, ...services.MarshalOption) ([]types.CertAuthority, error) {
 	return c.cas, nil
 }
 func (c *mockClient) GetProxies() ([]types.Server, error) {
@@ -397,7 +362,7 @@ func TestCheckKubeCluster(t *testing.T) {
 				leafCluster:  tt.leafCluster,
 				outputFormat: tt.outputFormat,
 			}
-			err := a.checkKubeCluster(context.Background(), client)
+			err := a.checkKubeCluster(client)
 			tt.assertErr(t, err)
 			require.Equal(t, tt.want, a.kubeCluster)
 		})
@@ -534,7 +499,7 @@ func TestGenerateDatabaseKeys(t *testing.T) {
 				genTTL:        time.Hour,
 			}
 
-			err = ac.generateDatabaseKeysForKey(context.Background(), authClient, key)
+			err = ac.generateDatabaseKeysForKey(authClient, key)
 			if test.genKeyErrMsg == "" {
 				require.NoError(t, err)
 			} else {
@@ -551,19 +516,19 @@ func TestGenerateDatabaseKeys(t *testing.T) {
 			require.Equal(t, test.outServerNames[0], authClient.dbCertsReq.ServerName)
 
 			if len(test.outKey) > 0 {
-				keyBytes, err := os.ReadFile(filepath.Join(test.inOutDir, test.outKeyFile))
+				keyBytes, err := ioutil.ReadFile(filepath.Join(test.inOutDir, test.outKeyFile))
 				require.NoError(t, err)
 				require.Equal(t, test.outKey, keyBytes, "keys match")
 			}
 
 			if len(test.outCert) > 0 {
-				certBytes, err := os.ReadFile(filepath.Join(test.inOutDir, test.outCertFile))
+				certBytes, err := ioutil.ReadFile(filepath.Join(test.inOutDir, test.outCertFile))
 				require.NoError(t, err)
 				require.Equal(t, test.outCert, certBytes, "certificates match")
 			}
 
 			if len(test.outCA) > 0 {
-				caBytes, err := os.ReadFile(filepath.Join(test.inOutDir, test.outCAFile))
+				caBytes, err := ioutil.ReadFile(filepath.Join(test.inOutDir, test.outCAFile))
 				require.NoError(t, err)
 				require.Equal(t, test.outCA, caBytes, "CA certificates match")
 			}
@@ -647,7 +612,7 @@ func TestGenerateAppCertificates(t *testing.T) {
 				genTTL:        time.Hour,
 				appName:       tc.appName,
 			}
-			err = ac.generateUserKeys(context.Background(), authClient)
+			err = ac.generateUserKeys(authClient)
 			tc.assertErr(t, err)
 			if err != nil {
 				return
@@ -662,7 +627,7 @@ func TestGenerateAppCertificates(t *testing.T) {
 			require.Equal(t, proto.UserCertsRequest_App, authClient.userCertsReq.Usage)
 			require.Equal(t, expectedRouteToApp, authClient.userCertsReq.RouteToApp)
 
-			certBytes, err := os.ReadFile(filepath.Join(tc.outDir, tc.outFileBase+".crt"))
+			certBytes, err := ioutil.ReadFile(filepath.Join(tc.outDir, tc.outFileBase+".crt"))
 			require.NoError(t, err)
 			require.Equal(t, authClient.userCerts.TLS, certBytes, "certificates match")
 		})
diff --git a/tool/tctl/common/bots_command.go b/tool/tctl/common/bots_command.go
index 882727f428054..58e570cb2c882 100644
--- a/tool/tctl/common/bots_command.go
+++ b/tool/tctl/common/bots_command.go
@@ -34,7 +34,6 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/tlsca"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/trace"
 )
 
@@ -67,7 +66,6 @@ func (c *BotsCommand) Initialize(app *kingpin.Application, config *service.Confi
 	c.botsAdd.Flag("roles", "Roles the bot is able to assume.").Required().StringVar(&c.botRoles)
 	c.botsAdd.Flag("ttl", "TTL for the bot join token.").DurationVar(&c.tokenTTL)
 	c.botsAdd.Flag("token", "Name of an existing token to use.").StringVar(&c.tokenID)
-	c.botsAdd.Flag("format", "Output format, 'text' or 'json'").Hidden().Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
 	// TODO: --ttl for setting a ttl on the join token
 
 	c.botsRemove = bots.Command("rm", "Permanently remove a certificate renewal bot from the cluster.")
@@ -137,29 +135,10 @@ func (c *BotsCommand) ListBots(client auth.ClientI) error {
 	return nil
 }
 
-// bold wraps the given text in an ANSI escape to bold it
-func bold(text string) string {
-	return utils.Color(utils.Bold, text)
-}
-
-var startMessageTemplate = template.Must(template.New("node").Funcs(template.FuncMap{
-	"bold": bold,
-}).Parse(`The bot token: {{.token}}
+var startMessageTemplate = template.Must(template.New("node").Parse(`The bot token: {{.token}}
 This token will expire in {{.minutes}} minutes.
 
-Optionally, if running the bot under an isolated user account, first initialize
-the data directory by running the following command {{ bold "as root" }}:
-
-> tbot init \
-   --destination-dir=./tbot-user \
-   --bot-user=tbot \
-   --reader-user=alice
-
-... where "tbot" is the username of the bot's UNIX user, and "alice" is the
-UNIX user that will be making use of the certificates.
-
-Then, run this {{ bold "as the bot user" }} to begin continuously fetching
-certificates:
+Run this on the new bot node to join the cluster:
 
 > tbot start \
    --destination-dir=./tbot-user \
@@ -170,9 +149,6 @@ certificates:
 
 Please note:
 
-  - The ./tbot-user destination directory can be changed as desired.
-  - /var/lib/teleport/bot must be accessible to the bot user, or --data-dir
-    must point to another accessible directory to store internal bot data.
   - This invitation token will expire in {{.minutes}} minutes
   - {{.auth_server}} must be reachable from the new node
 `))
@@ -189,16 +165,6 @@ func (c *BotsCommand) AddBot(client auth.ClientI) error {
 		return trace.WrapWithMessage(err, "error while creating bot")
 	}
 
-	if c.format == teleport.JSON {
-		out, err := json.MarshalIndent(response, "", "  ")
-		if err != nil {
-			return trace.Wrap(err, "failed to marshal CreateBot response")
-		}
-
-		fmt.Println(string(out))
-		return nil
-	}
-
 	// Calculate the CA pins for this cluster. The CA pins are used by the
 	// client to verify the identity of the Auth Server.
 	localCAResponse, err := client.GetClusterCACert()
diff --git a/tool/tctl/common/collection.go b/tool/tctl/common/collection.go
index 0a5bed166ff29..72faa13de047d 100644
--- a/tool/tctl/common/collection.go
+++ b/tool/tctl/common/collection.go
@@ -41,8 +41,7 @@ type ResourceCollection interface {
 }
 
 type roleCollection struct {
-	roles   []types.Role
-	verbose bool
+	roles []types.Role
 }
 
 func (r *roleCollection) resources() (res []types.Resource) {
@@ -53,26 +52,17 @@ func (r *roleCollection) resources() (res []types.Resource) {
 }
 
 func (r *roleCollection) writeText(w io.Writer) error {
-	var rows [][]string
+	t := asciitable.MakeTable([]string{"Role", "Allowed to login as", "Node Labels", "Access to resources"})
 	for _, r := range r.roles {
 		if r.GetName() == constants.DefaultImplicitRole {
 			continue
 		}
-		rows = append(rows, []string{
+		t.AddRow([]string{
 			r.GetMetadata().Name,
 			strings.Join(r.GetLogins(types.Allow), ","),
 			printNodeLabels(r.GetNodeLabels(types.Allow)),
 			printActions(r.GetRules(types.Allow))})
 	}
-
-	headers := []string{"Role", "Allowed to login as", "Node Labels", "Access to resources"}
-	var t asciitable.Table
-	if r.verbose {
-		t = asciitable.MakeTable(headers, rows...)
-	} else {
-		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Access to resources")
-	}
-
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
@@ -126,7 +116,6 @@ func printNodeLabels(labels types.Labels) string {
 
 type serverCollection struct {
 	servers []types.Server
-	verbose bool
 }
 
 func (s *serverCollection) resources() (r []types.Resource) {
@@ -137,38 +126,16 @@ func (s *serverCollection) resources() (r []types.Resource) {
 }
 
 func (s *serverCollection) writeText(w io.Writer) error {
-	var rows [][]string
-	for _, se := range s.servers {
-		labels := stripInternalTeleportLabels(s.verbose, se.GetAllLabels())
-		rows = append(rows, []string{
-			se.GetHostname(), se.GetName(), se.GetAddr(), labels, se.GetTeleportVersion(),
+	t := asciitable.MakeTable([]string{"Nodename", "UUID", "Address", "Labels"})
+	for _, s := range s.servers {
+		t.AddRow([]string{
+			s.GetHostname(), s.GetName(), s.GetAddr(), s.LabelsString(),
 		})
 	}
-	headers := []string{"Host", "UUID", "Public Address", "Labels", "Version"}
-	var t asciitable.Table
-	if s.verbose {
-		t = asciitable.MakeTable(headers, rows...)
-	} else {
-		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
-
-	}
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
 
-func (s *serverCollection) writeYaml(w io.Writer) error {
-	return utils.WriteYAML(w, s.servers)
-}
-
-func (s *serverCollection) writeJSON(w io.Writer) error {
-	data, err := json.MarshalIndent(s.resources(), "", "    ")
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	_, err = w.Write(data)
-	return trace.Wrap(err)
-}
-
 type userCollection struct {
 	users []types.User
 }
@@ -474,7 +441,6 @@ func (c *semaphoreCollection) writeText(w io.Writer) error {
 
 type appServerCollection struct {
 	servers []types.AppServer
-	verbose bool
 }
 
 func (a *appServerCollection) resources() (r []types.Resource) {
@@ -485,21 +451,13 @@ func (a *appServerCollection) resources() (r []types.Resource) {
 }
 
 func (a *appServerCollection) writeText(w io.Writer) error {
-	var rows [][]string
+	t := asciitable.MakeTable([]string{"Application", "Host", "Public Address", "URI", "Labels"})
 	for _, server := range a.servers {
 		app := server.GetApp()
-		labels := stripInternalTeleportLabels(a.verbose, app.GetAllLabels())
-		rows = append(rows, []string{
-			server.GetHostname(), app.GetName(), app.GetPublicAddr(), app.GetURI(), labels, server.GetTeleportVersion()})
-	}
-	var t asciitable.Table
-	headers := []string{"Host", "Name", "Public Address", "URI", "Labels", "Version"}
-	if a.verbose {
-		t = asciitable.MakeTable(headers, rows...)
-	} else {
-		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
+		t.AddRow([]string{
+			app.GetName(), server.GetHostname(), app.GetPublicAddr(), app.GetURI(), app.LabelsString(),
+		})
 	}
-
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
@@ -522,8 +480,7 @@ func (a *appServerCollection) writeYAML(w io.Writer) error {
 }
 
 type appCollection struct {
-	apps    []types.Application
-	verbose bool
+	apps []types.Application
 }
 
 func (c *appCollection) resources() (r []types.Resource) {
@@ -534,18 +491,11 @@ func (c *appCollection) resources() (r []types.Resource) {
 }
 
 func (c *appCollection) writeText(w io.Writer) error {
-	var rows [][]string
+	t := asciitable.MakeTable([]string{"Name", "Description", "URI", "Public Address", "Labels"})
 	for _, app := range c.apps {
-		labels := stripInternalTeleportLabels(c.verbose, app.GetAllLabels())
-		rows = append(rows, []string{
-			app.GetName(), app.GetDescription(), app.GetURI(), app.GetPublicAddr(), labels, app.GetVersion()})
-	}
-	headers := []string{"Name", "Description", "URI", "Public Address", "Labels", "Version"}
-	var t asciitable.Table
-	if c.verbose {
-		t = asciitable.MakeTable(headers, rows...)
-	} else {
-		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
+		t.AddRow([]string{
+			app.GetName(), app.GetDescription(), app.GetURI(), app.GetPublicAddr(), app.LabelsString(),
+		})
 	}
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
@@ -640,7 +590,6 @@ func (c *netRestrictionsCollection) writeText(w io.Writer) error {
 
 type databaseServerCollection struct {
 	servers []types.DatabaseServer
-	verbose bool
 }
 
 func (c *databaseServerCollection) resources() (r []types.Resource) {
@@ -651,25 +600,17 @@ func (c *databaseServerCollection) resources() (r []types.Resource) {
 }
 
 func (c *databaseServerCollection) writeText(w io.Writer) error {
-	var rows [][]string
+	t := asciitable.MakeTable([]string{"Name", "Protocol", "URI", "Labels", "Hostname", "Version"})
 	for _, server := range c.servers {
-		labels := stripInternalTeleportLabels(c.verbose, server.GetDatabase().GetAllLabels())
-		rows = append(rows, []string{
-			server.GetHostname(),
+		t.AddRow([]string{
 			server.GetDatabase().GetName(),
 			server.GetDatabase().GetProtocol(),
 			server.GetDatabase().GetURI(),
-			labels,
+			server.GetDatabase().LabelsString(),
+			server.GetHostname(),
 			server.GetTeleportVersion(),
 		})
 	}
-	headers := []string{"Host", "Name", "Protocol", "URI", "Labels", "Version"}
-	var t asciitable.Table
-	if c.verbose {
-		t = asciitable.MakeTable(headers, rows...)
-	} else {
-		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
-	}
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
@@ -693,7 +634,6 @@ func (c *databaseServerCollection) writeYAML(w io.Writer) error {
 
 type databaseCollection struct {
 	databases []types.Database
-	verbose   bool
 }
 
 func (c *databaseCollection) resources() (r []types.Resource) {
@@ -704,20 +644,12 @@ func (c *databaseCollection) resources() (r []types.Resource) {
 }
 
 func (c *databaseCollection) writeText(w io.Writer) error {
-	var rows [][]string
+	t := asciitable.MakeTable([]string{"Name", "Protocol", "URI", "Labels"})
 	for _, database := range c.databases {
-		labels := stripInternalTeleportLabels(c.verbose, database.GetAllLabels())
-		rows = append(rows, []string{
-			database.GetName(), database.GetProtocol(), database.GetURI(), labels,
+		t.AddRow([]string{
+			database.GetName(), database.GetProtocol(), database.GetURI(), database.LabelsString(),
 		})
 	}
-	headers := []string{"Name", "Protocol", "URI", "Labels"}
-	var t asciitable.Table
-	if c.verbose {
-		t = asciitable.MakeTable(headers, rows...)
-	} else {
-		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
-	}
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
 }
@@ -791,59 +723,6 @@ func (c *windowsDesktopCollection) writeText(w io.Writer) error {
 	return trace.Wrap(err)
 }
 
-type windowsDesktopAndService struct {
-	desktop types.WindowsDesktop
-	service types.WindowsDesktopService
-}
-
-type windowsDesktopAndServiceCollection struct {
-	desktops []windowsDesktopAndService
-	verbose  bool
-}
-
-func stripInternalTeleportLabels(verbose bool, labels map[string]string) string {
-	if verbose { // remove teleport.dev labels unless we're in verbose mode.
-		return types.LabelsAsString(labels, nil)
-	}
-	for key := range labels {
-		if strings.HasPrefix(key, types.TeleportNamespace+"/") {
-			delete(labels, key)
-		}
-	}
-	return types.LabelsAsString(labels, nil)
-}
-
-func (c *windowsDesktopAndServiceCollection) writeText(w io.Writer) error {
-	var rows [][]string
-	for _, d := range c.desktops {
-		labels := stripInternalTeleportLabels(c.verbose, d.desktop.GetAllLabels())
-		rows = append(rows, []string{d.service.GetHostname(), d.desktop.GetAddr(),
-			d.desktop.GetDomain(), labels, d.service.GetTeleportVersion()})
-	}
-	headers := []string{"Host", "Address", "AD Domain", "Labels", "Version"}
-	var t asciitable.Table
-	if c.verbose {
-		t = asciitable.MakeTable(headers, rows...)
-	} else {
-		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
-	}
-	_, err := t.AsBuffer().WriteTo(w)
-	return trace.Wrap(err)
-}
-
-func (c *windowsDesktopAndServiceCollection) writeYAML(w io.Writer) error {
-	return utils.WriteYAML(w, c.desktops)
-}
-
-func (c *windowsDesktopAndServiceCollection) writeJSON(w io.Writer) error {
-	data, err := json.MarshalIndent(c.desktops, "", "    ")
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	_, err = w.Write(data)
-	return trace.Wrap(err)
-}
-
 type tokenCollection struct {
 	tokens []types.ProvisionToken
 }
@@ -864,47 +743,3 @@ func (c *tokenCollection) writeText(w io.Writer) error {
 	}
 	return nil
 }
-
-type kubeServerCollection struct {
-	servers []types.Server
-	verbose bool
-}
-
-func (c *kubeServerCollection) writeText(w io.Writer) error {
-	var rows [][]string
-	for _, server := range c.servers {
-		kubes := server.GetKubernetesClusters()
-		for _, kube := range kubes {
-			labels := stripInternalTeleportLabels(c.verbose,
-				types.CombineLabels(kube.StaticLabels, kube.DynamicLabels))
-			rows = append(rows, []string{
-				kube.Name,
-				labels,
-				server.GetTeleportVersion(),
-			})
-		}
-	}
-	headers := []string{"Cluster", "Labels", "Version"}
-	var t asciitable.Table
-	if c.verbose {
-		t = asciitable.MakeTable(headers, rows...)
-	} else {
-		t = asciitable.MakeTableWithTruncatedColumn(headers, rows, "Labels")
-	}
-
-	_, err := t.AsBuffer().WriteTo(w)
-	return trace.Wrap(err)
-}
-
-func (c *kubeServerCollection) writeYAML(w io.Writer) error {
-	return utils.WriteYAML(w, c.servers)
-}
-
-func (c *kubeServerCollection) writeJSON(w io.Writer) error {
-	data, err := json.MarshalIndent(c.servers, "", "    ")
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	_, err = w.Write(data)
-	return trace.Wrap(err)
-}
diff --git a/tool/tctl/common/db_command.go b/tool/tctl/common/db_command.go
index 11426be1b081d..50e6ff1bad122 100644
--- a/tool/tctl/common/db_command.go
+++ b/tool/tctl/common/db_command.go
@@ -22,12 +22,8 @@ import (
 	"text/template"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
-	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/service"
 
 	"github.com/gravitational/kingpin"
@@ -41,13 +37,6 @@ type DBCommand struct {
 	// format is the output format (text, json or yaml).
 	format string
 
-	searchKeywords string
-	predicateExpr  string
-	labels         string
-
-	// verbose sets whether full table output should be shown for labels
-	verbose bool
-
 	// dbList implements the "tctl db ls" subcommand.
 	dbList *kingpin.CmdClause
 }
@@ -58,11 +47,7 @@ func (c *DBCommand) Initialize(app *kingpin.Application, config *service.Config)
 
 	db := app.Command("db", "Operate on databases registered with the cluster.")
 	c.dbList = db.Command("ls", "List all databases registered with the cluster.")
-	c.dbList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).StringVar(&c.format)
-	c.dbList.Arg("labels", labelHelp).StringVar(&c.labels)
-	c.dbList.Flag("search", searchHelp).StringVar(&c.searchKeywords)
-	c.dbList.Flag("query", queryHelp).StringVar(&c.predicateExpr)
-	c.dbList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
+	c.dbList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default("text").StringVar(&c.format)
 }
 
 // TryRun attempts to run subcommands like "db ls".
@@ -78,51 +63,26 @@ func (c *DBCommand) TryRun(cmd string, client auth.ClientI) (match bool, err err
 
 // ListDatabases prints the list of database proxies that have recently sent
 // heartbeats to the cluster.
-func (c *DBCommand) ListDatabases(clt auth.ClientI) error {
-	ctx := context.TODO()
-
-	labels, err := libclient.ParseLabelSpec(c.labels)
+func (c *DBCommand) ListDatabases(client auth.ClientI) error {
+	servers, err := client.GetDatabaseServers(context.TODO(), apidefaults.Namespace)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-
-	var servers []types.DatabaseServer
-	resources, err := client.GetResourcesWithFilters(ctx, clt, proto.ListResourcesRequest{
-		ResourceType:        types.KindDatabaseServer,
-		Labels:              labels,
-		PredicateExpression: c.predicateExpr,
-		SearchKeywords:      libclient.ParseSearchKeywords(c.searchKeywords, ','),
-	})
-	switch {
-	// Underlying ListResources for db servers not available, use fallback.
-	// Using filter flags with older auth will silently do nothing.
-	//
-	// DELETE IN 11.0.0
-	case trace.IsNotImplemented(err):
-		servers, err = clt.GetDatabaseServers(ctx, apidefaults.Namespace)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	case err != nil:
-		return trace.Wrap(err)
-	default:
-		servers, err = types.ResourcesWithLabels(resources).AsDatabaseServers()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	coll := &databaseServerCollection{servers: servers, verbose: c.verbose}
+	coll := &databaseServerCollection{servers: servers}
 	switch c.format {
 	case teleport.Text:
-		return trace.Wrap(coll.writeText(os.Stdout))
+		err = coll.writeText(os.Stdout)
 	case teleport.JSON:
-		return trace.Wrap(coll.writeJSON(os.Stdout))
+		err = coll.writeJSON(os.Stdout)
 	case teleport.YAML:
-		return trace.Wrap(coll.writeYAML(os.Stdout))
+		err = coll.writeYAML(os.Stdout)
 	default:
 		return trace.BadParameter("unknown format %q", c.format)
 	}
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	return nil
 }
 
 var dbMessageTemplate = template.Must(template.New("db").Parse(`The invite token: {{.token}}.
diff --git a/tool/tctl/common/desktop_command.go b/tool/tctl/common/desktop_command.go
deleted file mode 100644
index ad92a1b443d6e..0000000000000
--- a/tool/tctl/common/desktop_command.go
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
-Copyright 2021 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package common
-
-import (
-	"context"
-	"os"
-
-	"github.com/gravitational/kingpin"
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/service"
-)
-
-// DesktopCommand implements "tctl desktop" group of commands.
-type DesktopCommand struct {
-	config *service.Config
-
-	// format is the output format (text or yaml)
-	format string
-
-	// verbose sets whether full table output should be shown for labels
-	verbose bool
-
-	// desktopList implements the "tctl desktop ls" subcommand.
-	desktopList *kingpin.CmdClause
-}
-
-// Initialize allows DesktopCommand to plug itself into the CLI parser
-func (c *DesktopCommand) Initialize(app *kingpin.Application, config *service.Config) {
-	c.config = config
-
-	desktop := app.Command("desktops", "Operate on registered desktops.")
-	c.desktopList = desktop.Command("ls", "List all desktops registered with the cluster.")
-	c.desktopList.Flag("format", "Output format, 'text', 'json' or 'yaml'").Default(teleport.Text).StringVar(&c.format)
-	c.desktopList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
-}
-
-// TryRun attempts to run subcommands like "desktop ls".
-func (c *DesktopCommand) TryRun(cmd string, client auth.ClientI) (match bool, err error) {
-	switch cmd {
-	case c.desktopList.FullCommand():
-		err = c.ListDesktop(client)
-	default:
-		return false, nil
-	}
-	return true, trace.Wrap(err)
-}
-
-// ListDesktop prints the list of desktops that have recently sent heartbeats
-// to the cluster.
-func (c *DesktopCommand) ListDesktop(client auth.ClientI) error {
-	desktops, err := client.GetWindowsDesktops(context.TODO(), types.WindowsDesktopFilter{})
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	coll := windowsDesktopAndServiceCollection{
-		desktops: []windowsDesktopAndService{},
-		verbose:  c.verbose,
-	}
-	ctx := context.Background()
-	for _, desktop := range desktops {
-		ds, err := client.GetWindowsDesktopService(ctx, desktop.GetHostID())
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		coll.desktops = append(coll.desktops,
-			windowsDesktopAndService{desktop: desktop, service: ds})
-	}
-	switch c.format {
-	case teleport.Text:
-		return trace.Wrap(coll.writeText(os.Stdout))
-	case teleport.JSON:
-		return trace.Wrap(coll.writeJSON(os.Stdout))
-	case teleport.YAML:
-		return trace.Wrap(coll.writeYAML(os.Stdout))
-	default:
-		return trace.BadParameter("unknown format %q", c.format)
-	}
-}
diff --git a/tool/tctl/common/kube_command.go b/tool/tctl/common/kube_command.go
deleted file mode 100644
index 079eab31df597..0000000000000
--- a/tool/tctl/common/kube_command.go
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-Copyright 2021 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package common
-
-import (
-	"context"
-	"os"
-
-	"github.com/gravitational/kingpin"
-	"github.com/gravitational/trace"
-
-	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/lib/auth"
-	"github.com/gravitational/teleport/lib/service"
-)
-
-// KubeCommand implements "tctl kube" group of commands.
-type KubeCommand struct {
-	config *service.Config
-
-	// format is the output format (text or yaml)
-	format string
-
-	// verbose sets whether full table output should be shown for labels
-	verbose bool
-
-	// kubeList implements the "tctl kube ls" subcommand.
-	kubeList *kingpin.CmdClause
-}
-
-// Initialize allows KubeCommand to plug itself into the CLI parser
-func (c *KubeCommand) Initialize(app *kingpin.Application, config *service.Config) {
-	c.config = config
-
-	kube := app.Command("kube", "Operate on registered kubernetes clusters.")
-	c.kubeList = kube.Command("ls", "List all kubernetes clusters registered with the cluster.")
-	c.kubeList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).StringVar(&c.format)
-	c.kubeList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
-}
-
-// TryRun attempts to run subcommands like "kube ls".
-func (c *KubeCommand) TryRun(cmd string, client auth.ClientI) (match bool, err error) {
-	switch cmd {
-	case c.kubeList.FullCommand():
-		err = c.ListKube(client)
-	default:
-		return false, nil
-	}
-	return true, trace.Wrap(err)
-}
-
-// ListKube prints the list of kube clusters that have recently sent heartbeats
-// to the cluster.
-func (c *KubeCommand) ListKube(client auth.ClientI) error {
-	kubes, err := client.GetKubeServices(context.TODO())
-	if err != nil {
-		return trace.Wrap(err)
-	}
-	coll := &kubeServerCollection{servers: kubes, verbose: c.verbose}
-	switch c.format {
-	case teleport.Text:
-		return trace.Wrap(coll.writeText(os.Stdout))
-	case teleport.JSON:
-		return trace.Wrap(coll.writeJSON(os.Stdout))
-	case teleport.YAML:
-		return trace.Wrap(coll.writeYAML(os.Stdout))
-	default:
-		return trace.BadParameter("unknown format %q", c.format)
-	}
-}
diff --git a/tool/tctl/common/node_command.go b/tool/tctl/common/node_command.go
index 5208268d7bca3..1212b8ec7db24 100644
--- a/tool/tctl/common/node_command.go
+++ b/tool/tctl/common/node_command.go
@@ -26,16 +26,11 @@ import (
 	"time"
 
 	"github.com/gravitational/kingpin"
-	"github.com/gravitational/teleport"
 	"github.com/gravitational/trace"
-	log "github.com/sirupsen/logrus"
 
-	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
-	libclient "github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -57,16 +52,6 @@ type NodeCommand struct {
 	// if not specified, is autogenerated
 	token string
 
-	searchKeywords string
-	predicateExpr  string
-	labels         string
-
-	// ls output format -- text or json
-	lsFormat string
-
-	// verbose sets whether full table output should be shown for labels
-	verbose bool
-
 	// CLI subcommands (clauses)
 	nodeAdd  *kingpin.CmdClause
 	nodeList *kingpin.CmdClause
@@ -82,17 +67,12 @@ func (c *NodeCommand) Initialize(app *kingpin.Application, config *service.Confi
 	c.nodeAdd.Flag("roles", "Comma-separated list of roles for the new node to assume [node]").Default("node").StringVar(&c.roles)
 	c.nodeAdd.Flag("ttl", "Time to live for a generated token").Default(defaults.ProvisioningTokenTTL.String()).DurationVar(&c.ttl)
 	c.nodeAdd.Flag("token", "Custom token to use, autogenerated if not provided").StringVar(&c.token)
-	c.nodeAdd.Flag("format", "Output format, 'text' or 'json'").Hidden().Default(teleport.Text).StringVar(&c.format)
+	c.nodeAdd.Flag("format", "Output format, 'text' or 'json'").Hidden().Default("text").StringVar(&c.format)
 	c.nodeAdd.Alias(AddNodeHelp)
 
 	c.nodeList = nodes.Command("ls", "List all active SSH nodes within the cluster")
 	c.nodeList.Flag("namespace", "Namespace of the nodes").Default(apidefaults.Namespace).StringVar(&c.namespace)
-	c.nodeList.Flag("format", "Output format, 'text', or 'yaml'").Default(teleport.Text).StringVar(&c.lsFormat)
-	c.nodeList.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&c.verbose)
 	c.nodeList.Alias(ListNodesHelp)
-	c.nodeList.Arg("labels", labelHelp).StringVar(&c.labels)
-	c.nodeList.Flag("search", searchHelp).StringVar(&c.searchKeywords)
-	c.nodeList.Flag("query", queryHelp).StringVar(&c.predicateExpr)
 }
 
 // TryRun takes the CLI command as an argument (like "nodes ls") and executes it.
@@ -165,33 +145,16 @@ func (c *NodeCommand) Invite(client auth.ClientI) error {
 	}
 
 	// output format switch:
-	if c.format == teleport.Text {
+	if c.format == "text" {
 		if roles.Include(types.RoleTrustedCluster) {
 			fmt.Printf(trustedClusterMessage, token, int(c.ttl.Minutes()))
 		} else {
-			authServer := authServers[0].GetAddr()
-
-			pingResponse, err := client.Ping(context.TODO())
-			if err != nil {
-				log.Debugf("unnable to ping auth client: %s.", err.Error())
-			}
-
-			if err == nil && pingResponse.GetServerFeatures().Cloud {
-				proxies, err := client.GetProxies()
-				if err != nil {
-					return trace.Wrap(err)
-				}
-
-				if len(proxies) != 0 {
-					authServer = proxies[0].GetPublicAddr()
-				}
-			}
 			return nodeMessageTemplate.Execute(os.Stdout, map[string]interface{}{
 				"token":       token,
 				"minutes":     int(c.ttl.Minutes()),
 				"roles":       strings.ToLower(roles.String()),
 				"ca_pins":     caPins,
-				"auth_server": authServer,
+				"auth_server": authServers[0].GetAddr(),
 			})
 		}
 	} else {
@@ -209,57 +172,15 @@ func (c *NodeCommand) Invite(client auth.ClientI) error {
 
 // ListActive retreives the list of nodes who recently sent heartbeats to
 // to a cluster and prints it to stdout
-func (c *NodeCommand) ListActive(clt auth.ClientI) error {
+func (c *NodeCommand) ListActive(client auth.ClientI) error {
 	ctx := context.TODO()
-
-	labels, err := libclient.ParseLabelSpec(c.labels)
+	nodes, err := client.GetNodes(ctx, c.namespace)
 	if err != nil {
 		return trace.Wrap(err)
 	}
-
-	var nodes []types.Server
-	resources, err := client.GetResourcesWithFilters(ctx, clt, proto.ListResourcesRequest{
-		ResourceType:        types.KindNode,
-		Namespace:           c.namespace,
-		Labels:              labels,
-		PredicateExpression: c.predicateExpr,
-		SearchKeywords:      libclient.ParseSearchKeywords(c.searchKeywords, ','),
-	})
-	switch {
-	// Underlying ListResources for nodes not available, use fallback.
-	// Using filter flags with older auth will silently do nothing.
-	//
-	// DELETE IN 11.0.0
-	case trace.IsNotImplemented(err):
-		nodes, err = clt.GetNodes(ctx, c.namespace)
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	case err != nil:
+	coll := &serverCollection{servers: nodes}
+	if err := coll.writeText(os.Stdout); err != nil {
 		return trace.Wrap(err)
-	default:
-		nodes, err = types.ResourcesWithLabels(resources).AsServers()
-		if err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
-	coll := &serverCollection{servers: nodes, verbose: c.verbose}
-	switch c.lsFormat {
-	case teleport.Text:
-		if err := coll.writeText(os.Stdout); err != nil {
-			return trace.Wrap(err)
-		}
-	case teleport.YAML:
-		if err := coll.writeYaml(os.Stdout); err != nil {
-			return trace.Wrap(err)
-		}
-	case teleport.JSON:
-		if err := coll.writeJSON(os.Stdout); err != nil {
-			return trace.Wrap(err)
-		}
-	default:
-		return trace.Errorf("Invalid format %s, only text, json and yaml are supported", c.lsFormat)
 	}
 	return nil
 }
diff --git a/tool/tctl/common/resource_command.go b/tool/tctl/common/resource_command.go
index 87a55e6af44cd..7ef91868417db 100644
--- a/tool/tctl/common/resource_command.go
+++ b/tool/tctl/common/resource_command.go
@@ -68,8 +68,6 @@ type ResourceCommand struct {
 	createCmd *kingpin.CmdClause
 	updateCmd *kingpin.CmdClause
 
-	verbose bool
-
 	CreateHandlers map[ResourceKind]ResourceCreateHandler
 
 	// stdout allows to switch standard output source for resource command. Used in tests.
@@ -135,7 +133,6 @@ func (rc *ResourceCommand) Initialize(app *kingpin.Application, config *service.
 	rc.getCmd.Flag("format", "Output format: 'yaml', 'json' or 'text'").Default(teleport.YAML).StringVar(&rc.format)
 	rc.getCmd.Flag("namespace", "Namespace of the resources").Hidden().Default(apidefaults.Namespace).StringVar(&rc.namespace)
 	rc.getCmd.Flag("with-secrets", "Include secrets in resources like certificate authorities or OIDC connectors").Default("false").BoolVar(&rc.withSecrets)
-	rc.getCmd.Flag("verbose", "Verbose table output, shows full label output").Short('v').BoolVar(&rc.verbose)
 
 	rc.getCmd.Alias(getHelp)
 
@@ -773,21 +770,6 @@ func (rc *ResourceCommand) Delete(client auth.ClientI) (err error) {
 			return err
 		}
 		fmt.Printf(fmts+"\n", deleted, rc.ref.Name)
-	case types.KindCertAuthority:
-		if rc.ref.SubKind == "" || rc.ref.Name == "" {
-			return trace.BadParameter(
-				"full %s path must be specified (e.g. '%s/%s/clustername')",
-				types.KindCertAuthority, types.KindCertAuthority, types.HostCA,
-			)
-		}
-		err := client.DeleteCertAuthority(types.CertAuthID{
-			Type:       types.CertAuthType(rc.ref.SubKind),
-			DomainName: rc.ref.Name,
-		})
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		fmt.Printf("%s '%s/%s' has been deleted\n", types.KindCertAuthority, rc.ref.SubKind, rc.ref.Name)
 	default:
 		return trace.BadParameter("deleting resources of type %q is not supported", rc.ref.Kind)
 	}
@@ -978,7 +960,7 @@ func (rc *ResourceCommand) getCollection(client auth.ClientI) (ResourceCollectio
 		if rc.ref.SubKind == "" && rc.ref.Name == "" {
 			var allAuthorities []types.CertAuthority
 			for _, caType := range types.CertAuthTypes {
-				authorities, err := client.GetCertAuthorities(ctx, caType, rc.withSecrets)
+				authorities, err := client.GetCertAuthorities(caType, rc.withSecrets)
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
@@ -987,7 +969,7 @@ func (rc *ResourceCommand) getCollection(client auth.ClientI) (ResourceCollectio
 			return &authorityCollection{cas: allAuthorities}, nil
 		}
 		id := types.CertAuthID{Type: types.CertAuthType(rc.ref.SubKind), DomainName: rc.ref.Name}
-		authority, err := client.GetCertAuthority(ctx, id, rc.withSecrets)
+		authority, err := client.GetCertAuthority(id, rc.withSecrets)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1040,13 +1022,13 @@ func (rc *ResourceCommand) getCollection(client auth.ClientI) (ResourceCollectio
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			return &roleCollection{roles: roles, verbose: rc.verbose}, nil
+			return &roleCollection{roles: roles}, nil
 		}
 		role, err := client.GetRole(ctx, rc.ref.Name)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return &roleCollection{roles: []types.Role{role}, verbose: rc.verbose}, nil
+		return &roleCollection{roles: []types.Role{role}}, nil
 	case types.KindNamespace:
 		if rc.ref.Name == "" {
 			namespaces, err := client.GetNamespaces()
diff --git a/tool/tctl/common/resource_command_test.go b/tool/tctl/common/resource_command_test.go
index d0ce85477e536..952f999fc106a 100644
--- a/tool/tctl/common/resource_command_test.go
+++ b/tool/tctl/common/resource_command_test.go
@@ -19,7 +19,7 @@ package common
 import (
 	"crypto/x509"
 	"fmt"
-	"os"
+	"io/ioutil"
 	"path/filepath"
 	"testing"
 
@@ -165,7 +165,7 @@ func TestDatabaseResource(t *testing.T) {
 
 	// Create the databases.
 	dbYAMLPath := filepath.Join(t.TempDir(), "db.yaml")
-	require.NoError(t, os.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
+	require.NoError(t, ioutil.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
 	_, err = runResourceCommand(t, fileConfig, []string{"create", dbYAMLPath})
 	require.NoError(t, err)
 
@@ -252,7 +252,7 @@ func TestAppResource(t *testing.T) {
 
 	// Create the apps.
 	appYAMLPath := filepath.Join(t.TempDir(), "app.yaml")
-	require.NoError(t, os.WriteFile(appYAMLPath, []byte(appYAML), 0644))
+	require.NoError(t, ioutil.WriteFile(appYAMLPath, []byte(appYAML), 0644))
 	_, err = runResourceCommand(t, fileConfig, []string{"create", appYAMLPath})
 	require.NoError(t, err)
 
@@ -315,7 +315,7 @@ func TestCreateDatabaseInInsecureMode(t *testing.T) {
 
 	// Create the databases yaml file.
 	dbYAMLPath := filepath.Join(t.TempDir(), "db.yaml")
-	require.NoError(t, os.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
+	require.NoError(t, ioutil.WriteFile(dbYAMLPath, []byte(dbYAML), 0644))
 
 	// Reset RootCertPool and run tctl command with --insecure flag.
 	opts := []optionsFunc{
diff --git a/tool/tctl/common/status_command.go b/tool/tctl/common/status_command.go
index 09e2c32202c8f..261dd67f260f9 100644
--- a/tool/tctl/common/status_command.go
+++ b/tool/tctl/common/status_command.go
@@ -49,7 +49,7 @@ func (c *StatusCommand) Initialize(app *kingpin.Application, config *service.Con
 func (c *StatusCommand) TryRun(cmd string, client auth.ClientI) (match bool, err error) {
 	switch cmd {
 	case c.status.FullCommand():
-		err = c.Status(context.Background(), client)
+		err = c.Status(client)
 	default:
 		return false, nil
 	}
@@ -57,29 +57,29 @@ func (c *StatusCommand) TryRun(cmd string, client auth.ClientI) (match bool, err
 }
 
 // Status is called to execute "status" CLI command.
-func (c *StatusCommand) Status(ctx context.Context, client auth.ClientI) error {
-	pingRsp, err := client.Ping(ctx)
+func (c *StatusCommand) Status(client auth.ClientI) error {
+	pingRsp, err := client.Ping(context.TODO())
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	serverVersion := pingRsp.ServerVersion
 	clusterName := pingRsp.ClusterName
 
-	var authorities []types.CertAuthority
+	authorities := []types.CertAuthority{}
 
-	hostCAs, err := client.GetCertAuthorities(ctx, types.HostCA, false)
+	hostCAs, err := client.GetCertAuthorities(types.HostCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	authorities = append(authorities, hostCAs...)
 
-	userCAs, err := client.GetCertAuthorities(ctx, types.UserCA, false)
+	userCAs, err := client.GetCertAuthorities(types.UserCA, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	authorities = append(authorities, userCAs...)
 
-	jwtKeys, err := client.GetCertAuthorities(ctx, types.JWTSigner, false)
+	jwtKeys, err := client.GetCertAuthorities(types.JWTSigner, false)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/tctl.go b/tool/tctl/common/tctl.go
index 12010a012cd60..47dc8c5c02c7b 100644
--- a/tool/tctl/common/tctl.go
+++ b/tool/tctl/common/tctl.go
@@ -41,12 +41,6 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-const (
-	searchHelp = `List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")`
-	queryHelp  = `Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and || (e.g. --query='labels.key1 == "value1" && labels.key2 != "value2"')`
-	labelHelp  = "List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)"
-)
-
 // GlobalCLIFlags keeps the CLI flags that apply to all tctl commands
 type GlobalCLIFlags struct {
 	// Debug enables verbose logging mode to the console
@@ -137,10 +131,8 @@ func Run(commands []CLICommand) {
 	app.HelpFlag.Short('h')
 
 	// parse CLI commands+flags:
-	utils.UpdateAppUsageTemplate(app, os.Args[1:])
 	selectedCmd, err := app.Parse(os.Args[1:])
 	if err != nil {
-		app.Usage(os.Args[1:])
 		utils.FatalError(err)
 	}
 
diff --git a/tool/tctl/common/token_command.go b/tool/tctl/common/token_command.go
index 9d48a924c6ba8..908b998283222 100644
--- a/tool/tctl/common/token_command.go
+++ b/tool/tctl/common/token_command.go
@@ -33,7 +33,6 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/service"
 	"github.com/gravitational/teleport/lib/tlsca"
-	log "github.com/sirupsen/logrus"
 
 	"github.com/gravitational/kingpin"
 	"github.com/gravitational/trace"
@@ -94,10 +93,9 @@ func (c *TokenCommand) Initialize(app *kingpin.Application, config *service.Conf
 	c.tokenAdd.Flag("type", "Type of token to add").Required().StringVar(&c.tokenType)
 	c.tokenAdd.Flag("value", "Value of token to add").StringVar(&c.value)
 	c.tokenAdd.Flag("labels", "Set token labels, e.g. env=prod,region=us-west").StringVar(&c.labels)
-	c.tokenAdd.Flag("ttl", fmt.Sprintf("Set expiration time for token, default is %v hour",
-		int(defaults.SignupTokenTTL/time.Hour))).
-		Default(fmt.Sprintf("%v", defaults.SignupTokenTTL)).
-		DurationVar(&c.ttl)
+	c.tokenAdd.Flag("ttl", fmt.Sprintf("Set expiration time for token, default is %v hour, maximum is %v hours",
+		int(defaults.SignupTokenTTL/time.Hour), int(defaults.MaxSignupTokenTTL/time.Hour))).
+		Default(fmt.Sprintf("%v", defaults.SignupTokenTTL)).DurationVar(&c.ttl)
 	c.tokenAdd.Flag("app-name", "Name of the application to add").Default("example-app").StringVar(&c.appName)
 	c.tokenAdd.Flag("app-uri", "URI of the application to add").Default("http://localhost:8080").StringVar(&c.appURI)
 	c.tokenAdd.Flag("db-name", "Name of the database to add").StringVar(&c.dbName)
@@ -220,30 +218,12 @@ func (c *TokenCommand) Add(client auth.ClientI) error {
 			token,
 			int(c.ttl.Minutes()))
 	default:
-		authServer := authServers[0].GetAddr()
-
-		pingResponse, err := client.Ping(context.TODO())
-		if err != nil {
-			log.Debugf("unnable to ping auth client: %s.", err.Error())
-		}
-
-		if err == nil && pingResponse.GetServerFeatures().Cloud {
-			proxies, err := client.GetProxies()
-			if err != nil {
-				return trace.Wrap(err)
-			}
-
-			if len(proxies) != 0 {
-				authServer = proxies[0].GetPublicAddr()
-			}
-		}
-
 		return nodeMessageTemplate.Execute(os.Stdout, map[string]interface{}{
 			"token":       token,
 			"roles":       strings.ToLower(roles.String()),
 			"minutes":     int(c.ttl.Minutes()),
 			"ca_pins":     caPins,
-			"auth_server": authServer,
+			"auth_server": authServers[0].GetAddr(),
 		})
 	}
 
diff --git a/tool/tctl/common/usage.go b/tool/tctl/common/usage.go
index e7c32c0eace77..3a34cbe1f49b3 100644
--- a/tool/tctl/common/usage.go
+++ b/tool/tctl/common/usage.go
@@ -17,7 +17,7 @@ limitations under the License.
 package common
 
 const (
-	GlobalHelpString = "Admin tool for the Teleport Access Plane"
+	GlobalHelpString = "CLI Admin tool for the Teleport Auth service. Runs on a host where Teleport Auth is running."
 
 	AddUserHelp = `Notes:
 
@@ -37,12 +37,12 @@ Examples:
 `
 
 	AddNodeHelp = `Notes:
-  This command generates and prints an invitation token another node can use to
-  join the cluster.
+  This command generates and prints an invitation token another node can use to 
+  join the cluster. 
 
 Examples:
 
-  > tctl nodes add
+  > tctl nodes add 
 
   Generates a token when can be used to add a regular SSH node to the cluster.
   The token genrated single-use token will be valid for 30 minutes.
@@ -50,7 +50,7 @@ Examples:
   > tctl nodes add --roles=node,proxy --ttl=1h
 
   Generates a token when can be used to add an SSH node to the cluster which
-  will also be a proxy node. This token can be used multiple times within an
+  will also be a proxy node. This token can be used multiple times within an 
   hour.
 `
 	ListNodesHelp = `Notes:
diff --git a/tool/tctl/main.go b/tool/tctl/main.go
index ebe57353b9d94..1d3485d23aae8 100644
--- a/tool/tctl/main.go
+++ b/tool/tctl/main.go
@@ -21,7 +21,6 @@ import (
 )
 
 func main() {
-	// Note: these commands should be kept in sync with e/tool/tctl/main.go.
 	commands := []common.CLICommand{
 		&common.UserCommand{},
 		&common.NodeCommand{},
@@ -33,8 +32,6 @@ func main() {
 		&common.AccessRequestCommand{},
 		&common.AppsCommand{},
 		&common.DBCommand{},
-		&common.KubeCommand{},
-		&common.DesktopCommand{},
 		&common.AccessCommand{},
 		&common.LockCommand{},
 		&common.BotsCommand{},
diff --git a/tool/teleport/common/teleport.go b/tool/teleport/common/teleport.go
index 8bd6bc0a2b090..09aa21f954fb9 100644
--- a/tool/teleport/common/teleport.go
+++ b/tool/teleport/common/teleport.go
@@ -62,7 +62,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	// configure logger for a typical CLI scenario until configuration file is
 	// parsed
 	utils.InitLogger(utils.LoggingForDaemon, log.ErrorLevel)
-	app = utils.InitCLIParser("teleport", "Teleport Access Plane. Learn more at https://goteleport.com")
+	app = utils.InitCLIParser("teleport", "Clustered SSH service. Learn more at https://goteleport.com/teleport")
 
 	// define global flags:
 	var (
@@ -294,10 +294,8 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
 	dump.Flag("key-file", "Path to a TLS key file for the proxy.").ExistingFileVar(&dumpFlags.KeyFile)
 
 	// parse CLI commands+flags:
-	utils.UpdateAppUsageTemplate(app, options.Args)
 	command, err := app.Parse(options.Args)
 	if err != nil {
-		app.Usage(options.Args)
 		utils.FatalError(err)
 	}
 
diff --git a/tool/teleport/common/teleport_test.go b/tool/teleport/common/teleport_test.go
index ec99389ca9e9e..2423248510fd7 100644
--- a/tool/teleport/common/teleport_test.go
+++ b/tool/teleport/common/teleport_test.go
@@ -17,11 +17,11 @@ limitations under the License.
 package common
 
 import (
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
 
-	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/config"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/utils"
@@ -43,26 +43,10 @@ func TestTeleportMain(t *testing.T) {
 	hostname, err := os.Hostname()
 	require.NoError(t, err)
 
-	fixtureDir := t.TempDir()
 	// generate the fixture config file
-	configFile := filepath.Join(fixtureDir, "teleport.yaml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configData), 0660))
-
-	// generate the fixture bootstrap file
-	bootstrapEntries := []struct{ fileName, kind, name string }{
-		{"role.yaml", types.KindRole, "role_name"},
-		{"github.yaml", types.KindGithubConnector, "github"},
-		{"user.yaml", types.KindRole, "user"},
-	}
-	var bootstrapData []byte
-	for _, entry := range bootstrapEntries {
-		data, err := os.ReadFile(filepath.Join("..", "..", "..", "examples", "resources", entry.fileName))
-		require.NoError(t, err)
-		bootstrapData = append(bootstrapData, data...)
-		bootstrapData = append(bootstrapData, "\n---\n"...)
-	}
-	bootstrapFile := filepath.Join(fixtureDir, "bootstrap.yaml")
-	require.NoError(t, os.WriteFile(bootstrapFile, bootstrapData, 0660))
+	configFile := filepath.Join(t.TempDir(), "teleport.yaml")
+	err = ioutil.WriteFile(configFile, []byte(YAMLConfig), 0660)
+	require.NoError(t, err)
 
 	// set defaults to test-mode (non-existing files&locations)
 	defaults.ConfigFilePath = "/tmp/teleport/etc/teleport.yaml"
@@ -127,20 +111,6 @@ func TestTeleportMain(t *testing.T) {
 		require.Equal(t, "10.5.5.5", conf.AdvertiseIP)
 		require.Equal(t, map[string]string{"a": "a1", "b": "b1"}, conf.SSH.Labels)
 	})
-
-	t.Run("Bootstrap", func(t *testing.T) {
-		_, cmd, conf := Run(Options{
-			Args:     []string{"start", "--bootstrap", bootstrapFile},
-			InitOnly: true,
-		})
-		require.Equal(t, "start", cmd)
-		require.Equal(t, len(bootstrapEntries), len(conf.Auth.Resources))
-		for i, entry := range bootstrapEntries {
-			require.Equal(t, entry.kind, conf.Auth.Resources[i].GetKind(), entry.fileName)
-			require.Equal(t, entry.name, conf.Auth.Resources[i].GetName(), entry.fileName)
-			require.NoError(t, conf.Auth.Resources[i].CheckAndSetDefaults(), entry.fileName)
-		}
-	})
 }
 
 func TestConfigure(t *testing.T) {
@@ -173,7 +143,7 @@ func TestConfigure(t *testing.T) {
 	})
 }
 
-const configData = `
+const YAMLConfig = `
 teleport:
   advertise_ip: 10.5.5.5
   nodename: hvostongo.example.org
diff --git a/tool/tsh/app.go b/tool/tsh/app.go
index 01d6dbc912803..b602ade1dec0d 100644
--- a/tool/tsh/app.go
+++ b/tool/tsh/app.go
@@ -114,17 +114,11 @@ tsh aws {{.awsCmd}}
 
 // getRegisteredApp returns the registered application with the specified name.
 func getRegisteredApp(cf *CLIConf, tc *client.TeleportClient) (app types.Application, err error) {
-	var apps []types.Application
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		allApps, err := tc.ListApps(cf.Context, &proto.ListResourcesRequest{
-			Namespace:           tc.Namespace,
-			PredicateExpression: fmt.Sprintf(`name == "%s"`, cf.AppName),
-		})
-		// Kept for fallback in case older auth does not apply filters.
-		// DELETE IN 11.0.0
+		allApps, err := tc.ListApps(cf.Context)
 		for _, a := range allApps {
 			if a.GetName() == cf.AppName {
-				apps = append(apps, a)
+				app = a
 				return nil
 			}
 		}
@@ -133,10 +127,10 @@ func getRegisteredApp(cf *CLIConf, tc *client.TeleportClient) (app types.Applica
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if len(apps) == 0 {
+	if app == nil {
 		return nil, trace.NotFound("app %q not found, use `tsh app ls` to see registered apps", cf.AppName)
 	}
-	return apps[0], nil
+	return app, nil
 }
 
 // onAppLogout implements "tsh app logout" command.
diff --git a/tool/tsh/aws.go b/tool/tsh/aws.go
index 5ec7a0e74c739..ec0a791bac6f3 100644
--- a/tool/tsh/aws.go
+++ b/tool/tsh/aws.go
@@ -23,6 +23,7 @@ import (
 	"crypto/x509/pkix"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/url"
 	"os"
 	"os/exec"
@@ -291,7 +292,7 @@ func newTempSelfSignedLocalCert() (*tempSelfSignedLocalCert, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	f, err := os.CreateTemp("", "*_aws_local_proxy_cert.pem")
+	f, err := ioutil.TempFile("", "*_aws_local_proxy_cert.pem")
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/tool/tsh/db.go b/tool/tsh/db.go
index 021fdbeadd1b9..0b8d2ee75afa8 100644
--- a/tool/tsh/db.go
+++ b/tool/tsh/db.go
@@ -18,6 +18,7 @@ package main
 
 import (
 	"fmt"
+	"io/ioutil"
 	"net"
 	"os"
 	"sort"
@@ -42,7 +43,7 @@ func onListDatabases(cf *CLIConf) error {
 	}
 	var databases []types.Database
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		databases, err = tc.ListDatabases(cf.Context, nil /* custom filter */)
+		databases, err = tc.ListDatabases(cf.Context)
 		return trace.Wrap(err)
 	})
 	if err != nil {
@@ -409,12 +410,7 @@ func getDatabaseInfo(cf *CLIConf, tc *client.TeleportClient, dbName string) (*tl
 func getDatabase(cf *CLIConf, tc *client.TeleportClient, dbName string) (types.Database, error) {
 	var databases []types.Database
 	err := client.RetryWithRelogin(cf.Context, tc, func() error {
-		allDatabases, err := tc.ListDatabases(cf.Context, &proto.ListResourcesRequest{
-			Namespace:           tc.Namespace,
-			PredicateExpression: fmt.Sprintf(`name == "%s"`, dbName),
-		})
-		// Kept for fallback in case an older auth does not apply filters.
-		// DELETE IN 11.0.0
+		allDatabases, err := tc.ListDatabases(cf.Context)
 		for _, database := range allDatabases {
 			if database.GetName() == dbName {
 				databases = append(databases, database)
@@ -473,7 +469,7 @@ func dbInfoHasChanged(cf *CLIConf, certPath string) (bool, error) {
 		return false, nil
 	}
 
-	buff, err := os.ReadFile(certPath)
+	buff, err := ioutil.ReadFile(certPath)
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
diff --git a/tool/tsh/db_test.go b/tool/tsh/db_test.go
index fe2920c590fa9..382f8e58cea8a 100644
--- a/tool/tsh/db_test.go
+++ b/tool/tsh/db_test.go
@@ -22,6 +22,7 @@ import (
 	"crypto/rsa"
 	"encoding/pem"
 	"errors"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -231,7 +232,7 @@ func TestDBInfoHasChanged(t *testing.T) {
 			require.NoError(t, err)
 
 			certPath := filepath.Join(t.TempDir(), "mongo_db_cert.pem")
-			require.NoError(t, os.WriteFile(certPath, certBytes, 0600))
+			require.NoError(t, ioutil.WriteFile(certPath, certBytes, 0600))
 
 			cliConf := &CLIConf{DatabaseUser: tc.databaseUserName, DatabaseName: tc.databaseName}
 			got, err := dbInfoHasChanged(cliConf, certPath)
diff --git a/tool/tsh/dbcmd.go b/tool/tsh/dbcmd.go
index 78c7b8f92c4bc..36c436d01e4bb 100644
--- a/tool/tsh/dbcmd.go
+++ b/tool/tsh/dbcmd.go
@@ -231,7 +231,7 @@ func (c *cliCommandBuilder) getMySQLCommand() (*exec.Cmd, error) {
 
 	// Check for mysql binary. Return with error as mysql and mariadb are missing. There is nothing else we can do here.
 	if !c.isMySQLBinAvailable() {
-		return nil, trace.NotFound("neither %q nor %q CLI clients were found, please make sure an appropriate CLI client is available in $PATH", mysqlBin, mariadbBin)
+		return nil, trace.NotFound("neither \"mysql\" nor \"mariadb\" were found")
 	}
 
 	// Check which flavor is installed. Otherwise, we don't know which ssl flag to use.
diff --git a/tool/tsh/kube.go b/tool/tsh/kube.go
index 8899f93b6de63..f42c9d95cc6f1 100644
--- a/tool/tsh/kube.go
+++ b/tool/tsh/kube.go
@@ -23,14 +23,13 @@ import (
 	"net"
 	"net/url"
 	"os"
-	"strconv"
+
 	"strings"
 	"time"
 
 	"github.com/gravitational/kingpin"
 	"github.com/gravitational/trace"
 
-	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	"github.com/gravitational/teleport/api/profile"
 	"github.com/gravitational/teleport/api/types"
@@ -293,12 +292,11 @@ type ExecOptions struct {
 	ExecutablePodFn  polymorphichelpers.AttachablePodForObjectFunc
 	restClientGetter genericclioptions.RESTClientGetter
 
-	Pod                            *corev1.Pod
-	Executor                       RemoteExecutor
-	PodClient                      coreclient.PodsGetter
-	GetPodTimeout                  time.Duration
-	Config                         *restclient.Config
-	displayParticipantRequirements bool
+	Pod           *corev1.Pod
+	Executor      RemoteExecutor
+	PodClient     coreclient.PodsGetter
+	GetPodTimeout time.Duration
+	Config        *restclient.Config
 }
 
 // Run executes a validated remote execution against a pod.
@@ -367,8 +365,7 @@ func (p *ExecOptions) Run() error {
 			Resource("pods").
 			Name(pod.Name).
 			Namespace(pod.Namespace).
-			SubResource("exec").
-			Param("displayParticipantRequirements", strconv.FormatBool(p.displayParticipantRequirements))
+			SubResource("exec")
 		req.VersionedParams(&corev1.PodExecOptions{
 			Container: containerName,
 			Command:   p.Command,
@@ -386,16 +383,15 @@ func (p *ExecOptions) Run() error {
 
 type kubeExecCommand struct {
 	*kingpin.CmdClause
-	target                         string
-	container                      string
-	filename                       string
-	quiet                          bool
-	stdin                          bool
-	tty                            bool
-	reason                         string
-	invited                        string
-	command                        []string
-	displayParticipantRequirements bool
+	target    string
+	container string
+	filename  string
+	quiet     bool
+	stdin     bool
+	tty       bool
+	reason    string
+	invited   string
+	command   []string
 }
 
 func newKubeExecCommand(parent *kingpin.CmdClause) *kubeExecCommand {
@@ -410,7 +406,6 @@ func newKubeExecCommand(parent *kingpin.CmdClause) *kubeExecCommand {
 	c.Flag("tty", "Stdin is a TTY").Short('t').BoolVar(&c.tty)
 	c.Flag("reason", "The purpose of the session.").StringVar(&c.reason)
 	c.Flag("invite", "A comma separated list of people to mark as invited for the session.").StringVar(&c.invited)
-	c.Flag("participant-req", "Displays a verbose list of required participants in a moderated session.").BoolVar(&c.displayParticipantRequirements)
 	c.Arg("target", "Pod or deployment name").Required().StringVar(&c.target)
 	c.Arg("command", "Command to execute in the container").Required().StringsVar(&c.command)
 	return c
@@ -439,7 +434,6 @@ func (c *kubeExecCommand) run(cf *CLIConf) error {
 	p.Builder = f.NewBuilder
 	p.restClientGetter = f
 	p.Executor = &DefaultRemoteExecutor{}
-	p.displayParticipantRequirements = c.displayParticipantRequirements
 	p.Namespace, p.EnforceNamespace, err = f.ToRawKubeConfigLoader().Namespace()
 	if err != nil {
 		return trace.Wrap(err)
@@ -595,26 +589,16 @@ func (c *kubeCredentialsCommand) writeResponse(key *client.Key, kubeClusterName
 
 type kubeLSCommand struct {
 	*kingpin.CmdClause
-	labels         string
-	predicateExpr  string
-	searchKeywords string
 }
 
 func newKubeLSCommand(parent *kingpin.CmdClause) *kubeLSCommand {
 	c := &kubeLSCommand{
 		CmdClause: parent.Command("ls", "Get a list of kubernetes clusters"),
 	}
-	c.Flag("search", searchHelp).StringVar(&c.searchKeywords)
-	c.Flag("query", queryHelp).StringVar(&c.predicateExpr)
-	c.Arg("labels", labelHelp).StringVar(&c.labels)
 	return c
 }
 
 func (c *kubeLSCommand) run(cf *CLIConf) error {
-	cf.SearchKeywords = c.searchKeywords
-	cf.UserHost = c.labels
-	cf.PredicateExpression = c.predicateExpr
-
 	tc, err := makeClient(cf, true)
 	if err != nil {
 		return trace.Wrap(err)
@@ -731,27 +715,10 @@ func fetchKubeClusters(ctx context.Context, tc *client.TeleportClient) (teleport
 		}
 		teleportCluster = cn.GetClusterName()
 
-		kubeClusters, err = kubeutils.ListKubeClusterNamesWithFilters(ctx, ac, proto.ListResourcesRequest{
-			SearchKeywords:      tc.SearchKeywords,
-			PredicateExpression: tc.PredicateExpression,
-			Labels:              tc.Labels,
-		})
+		kubeClusters, err = kubeutils.KubeClusterNames(ctx, ac)
 		if err != nil {
-			// ListResources for kube service not availalbe, provide fallback.
-			// Fallback does not support filters, so if users
-			// provide them, it does nothing.
-			//
-			// DELETE IN 11.0.0
-			if trace.IsNotImplemented(err) {
-				kubeClusters, err = kubeutils.KubeClusterNames(ctx, ac)
-				if err != nil {
-					return trace.Wrap(err)
-				}
-				return nil
-			}
 			return trace.Wrap(err)
 		}
-
 		return nil
 	})
 	if err != nil {
diff --git a/tool/tsh/mfa.go b/tool/tsh/mfa.go
index 6e46c2f11acc1..25b8e0093b50c 100644
--- a/tool/tsh/mfa.go
+++ b/tool/tsh/mfa.go
@@ -38,7 +38,6 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
-	"golang.org/x/term"
 
 	wantypes "github.com/gravitational/teleport/api/types/webauthn"
 	wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
@@ -148,10 +147,6 @@ type mfaAddCommand struct {
 	*kingpin.CmdClause
 	devName string
 	devType string
-	// pwdless is nil if unset, true/false if explicitly set.
-	// If passwordless is not supported it's always set to false.
-	// The default behavior is the same as false.
-	pwdless *bool
 }
 
 func newMFAAddCommand(parent *kingpin.CmdClause) *mfaAddCommand {
@@ -161,22 +156,6 @@ func newMFAAddCommand(parent *kingpin.CmdClause) *mfaAddCommand {
 	c.Flag("name", "Name of the new MFA device").StringVar(&c.devName)
 	c.Flag("type", fmt.Sprintf("Type of the new MFA device (%s)", strings.Join(defaultDeviceTypes, ", "))).
 		StringVar(&c.devType)
-
-	if wancli.IsFIDO2Available() {
-		var allowPwdless bool
-		c.Flag("allow-passwordless", "Allow passwordless logins").
-			Action(func(_ *kingpin.ParseContext) error {
-				// If the callback is called it means that the flag was explicitly set,
-				// so we can copy its contents to the command.
-				c.pwdless = &allowPwdless
-				return nil
-			}).
-			BoolVar(&allowPwdless)
-	} else {
-		allowPwdless := false
-		c.pwdless = &allowPwdless
-	}
-
 	return c
 }
 
@@ -187,12 +166,6 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 	}
 	ctx := cf.Context
 
-	// IMPORTANT: mfa add may need to read secure key PINs in some scenarios,
-	// meaning it has to use term.ReadPassword.
-	// Because of that we can't use prompt.Stdin(), as it hijacks stdin, making
-	// password-like reads impossible.
-	stdin := prompt.StdinSync()
-
 	deviceTypes := defaultDeviceTypes
 	if c.devType == "" {
 		// If we are prompting the user for the device type, then take a glimpse at
@@ -204,7 +177,7 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 		}
 		deviceTypes = deviceTypesFromPreferredMFA(pingResp.Auth.PreferredLocalMFA)
 
-		c.devType, err = prompt.PickOne(ctx, os.Stdout, stdin, "Choose device type", deviceTypes)
+		c.devType, err = prompt.PickOne(ctx, os.Stdout, prompt.Stdin(), "Choose device type", deviceTypes)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -221,7 +194,7 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 
 	if c.devName == "" {
 		var err error
-		c.devName, err = prompt.Input(ctx, os.Stdout, stdin, "Enter device name")
+		c.devName, err = prompt.Input(ctx, os.Stdout, prompt.Stdin(), "Enter device name")
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -231,18 +204,7 @@ func (c *mfaAddCommand) run(cf *CLIConf) error {
 		return trace.BadParameter("device name can not be empty")
 	}
 
-	// If passwordless is supported but unset then ask the user.
-	if c.pwdless == nil {
-		answer, err := prompt.PickOne(ctx, os.Stdout, stdin, "Allow passwordless logins", []string{"YES", "NO"})
-		if err != nil {
-			return trace.Wrap(err)
-		}
-		val := answer == "YES"
-		c.pwdless = &val
-	}
-	pwdless := c.pwdless != nil && *c.pwdless
-
-	dev, err := c.addDeviceRPC(ctx, tc, c.devName, devType, pwdless, stdin)
+	dev, err := c.addDeviceRPC(ctx, tc, c.devName, devType)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -269,9 +231,7 @@ func deviceTypesFromPreferredMFA(preferredMFA constants.SecondFactorType) []stri
 	}
 }
 
-func (c *mfaAddCommand) addDeviceRPC(
-	ctx context.Context,
-	tc *client.TeleportClient, devName string, devType proto.DeviceType, passwordless bool, r prompt.Reader) (*types.MFADevice, error) {
+func (c *mfaAddCommand) addDeviceRPC(ctx context.Context, tc *client.TeleportClient, devName string, devType proto.DeviceType) (*types.MFADevice, error) {
 	var dev *types.MFADevice
 	if err := client.RetryWithRelogin(ctx, tc, func() error {
 		pc, err := tc.ConnectToProxy(ctx)
@@ -292,15 +252,10 @@ func (c *mfaAddCommand) addDeviceRPC(
 			return trace.Wrap(err)
 		}
 		// Init.
-		usage := proto.DeviceUsage_DEVICE_USAGE_MFA
-		if passwordless {
-			usage = proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS
-		}
 		if err := stream.Send(&proto.AddMFADeviceRequest{Request: &proto.AddMFADeviceRequest_Init{
 			Init: &proto.AddMFADeviceRequestInit{
-				DeviceName:  devName,
-				DeviceType:  devType,
-				DeviceUsage: usage,
+				DeviceName: devName,
+				DeviceType: devType,
 			},
 		}}); err != nil {
 			return trace.Wrap(err)
@@ -334,7 +289,7 @@ func (c *mfaAddCommand) addDeviceRPC(
 		if regChallenge == nil {
 			return trace.BadParameter("server bug: server sent %T when client expected AddMFADeviceResponse_NewMFARegisterChallenge", resp.Response)
 		}
-		regResp, err := promptRegisterChallenge(ctx, tc.Config.WebProxyAddr, regChallenge, r)
+		regResp, err := promptRegisterChallenge(ctx, tc.Config.WebProxyAddr, regChallenge)
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -361,20 +316,18 @@ func (c *mfaAddCommand) addDeviceRPC(
 	return dev, nil
 }
 
-func promptRegisterChallenge(ctx context.Context, proxyAddr string, c *proto.MFARegisterChallenge, r prompt.Reader) (*proto.MFARegisterResponse, error) {
+func promptRegisterChallenge(ctx context.Context, proxyAddr string, c *proto.MFARegisterChallenge) (*proto.MFARegisterResponse, error) {
 	switch c.Request.(type) {
 	case *proto.MFARegisterChallenge_TOTP:
-		return promptTOTPRegisterChallenge(ctx, c.GetTOTP(), r)
+		return promptTOTPRegisterChallenge(ctx, c.GetTOTP())
 	case *proto.MFARegisterChallenge_Webauthn:
-		// WebAuthn prompt doesn't take in "r" because it reads directly from stdin
-		// using term.ReadPassword.
 		return promptWebauthnRegisterChallenge(ctx, proxyAddr, c.GetWebauthn())
 	default:
 		return nil, trace.BadParameter("server bug: unexpected registration challenge type: %T", c.Request)
 	}
 }
 
-func promptTOTPRegisterChallenge(ctx context.Context, c *proto.TOTPRegisterChallenge, r prompt.Reader) (*proto.MFARegisterResponse, error) {
+func promptTOTPRegisterChallenge(ctx context.Context, c *proto.TOTPRegisterChallenge) (*proto.MFARegisterResponse, error) {
 	secretBin, err := base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(c.Secret)
 	if err != nil {
 		return nil, trace.BadParameter("server sent an invalid TOTP secret key %q: %v", c.Secret, err)
@@ -435,7 +388,7 @@ func promptTOTPRegisterChallenge(ctx context.Context, c *proto.TOTPRegisterChall
 	// Help the user with typos, don't submit the code until it has the right
 	// length.
 	for {
-		totpCode, err = prompt.Input(ctx, os.Stdout, r, "Once created, enter an OTP code generated by the app")
+		totpCode, err = prompt.Input(ctx, os.Stdout, prompt.Stdin(), "Once created, enter an OTP code generated by the app")
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -449,23 +402,6 @@ func promptTOTPRegisterChallenge(ctx context.Context, c *proto.TOTPRegisterChall
 	}}, nil
 }
 
-// mfaAddPrompt implements wancli.RegisterPrompt for MFA registrations.
-type mfaAddPrompt struct{}
-
-func (m mfaAddPrompt) PromptPIN() (string, error) {
-	fmt.Println("Enter your *new* security key PIN")
-	pwd, err := term.ReadPassword(int(os.Stdin.Fd()))
-	if err != nil {
-		return "", trace.Wrap(err)
-	}
-	return string(pwd), nil
-}
-
-func (m mfaAddPrompt) PromptAdditionalTouch() error {
-	fmt.Println("Tap your *new* security key again to complete registration")
-	return nil
-}
-
 func promptWebauthnRegisterChallenge(ctx context.Context, proxyAddr string, cc *wantypes.CredentialCreation) (*proto.MFARegisterResponse, error) {
 	origin := proxyAddr
 	if !strings.HasPrefix(proxyAddr, "https://") {
@@ -474,7 +410,8 @@ func promptWebauthnRegisterChallenge(ctx context.Context, proxyAddr string, cc *
 	log.Debugf("WebAuthn: prompting MFA devices with origin %q", origin)
 
 	fmt.Println("Tap your *new* security key")
-	resp, err := wancli.Register(ctx, origin, wanlib.CredentialCreationFromProto(cc), mfaAddPrompt{})
+
+	resp, err := wancli.Register(ctx, origin, wanlib.CredentialCreationFromProto(cc))
 	return resp, trace.Wrap(err)
 }
 
diff --git a/tool/tsh/proxy_test.go b/tool/tsh/proxy_test.go
index b5d0e3c738284..ad6a097b57460 100644
--- a/tool/tsh/proxy_test.go
+++ b/tool/tsh/proxy_test.go
@@ -19,6 +19,7 @@ package main
 import (
 	"bytes"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"os/user"
@@ -173,7 +174,7 @@ func TestProxySSHDial(t *testing.T) {
 	tmpHomePath := t.TempDir()
 
 	connector := mockConnector(t)
-	sshLoginRole, err := types.NewRoleV3("ssh-login", types.RoleSpecV5{
+	sshLoginRole, err := types.NewRole("ssh-login", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{"alice"},
 		},
@@ -319,7 +320,7 @@ func createAgent(t *testing.T) string {
 	// Create own tmp dir instead of using t.TmpDir
 	// because  net.Listen("unix", path) has dir path length limitation and
 	// the t.TmpDir calls creates tmp dir with test name.
-	sockDir, err := os.MkdirTemp("", "test")
+	sockDir, err := ioutil.TempDir("", "test")
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		os.RemoveAll(sockDir)
@@ -374,7 +375,7 @@ func mustGetOpenSSHConfigFile(t *testing.T) string {
 
 	tmpDir := t.TempDir()
 	configPath := filepath.Join(tmpDir, "ssh_config")
-	err = os.WriteFile(configPath, buff.Bytes(), 0600)
+	err = ioutil.WriteFile(configPath, buff.Bytes(), 0600)
 	require.NoError(t, err)
 
 	return configPath
diff --git a/tool/tsh/resolve_default_addr.go b/tool/tsh/resolve_default_addr.go
index 6b3f6abd2a1f4..cbfe56dd40bbd 100644
--- a/tool/tsh/resolve_default_addr.go
+++ b/tool/tsh/resolve_default_addr.go
@@ -21,6 +21,7 @@ import (
 	"crypto/tls"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"strconv"
@@ -55,7 +56,7 @@ func logResponseBody(level logrus.Level, bodyStream io.Reader) {
 	//     context originally supplied to the request that initiated this
 	//     response, so no need to have an independent reading timeout
 	//     here.
-	body, err := io.ReadAll(io.LimitReader(bodyStream, maxPingBodySize))
+	body, err := ioutil.ReadAll(io.LimitReader(bodyStream, maxPingBodySize))
 	if err != nil {
 		// This is only for debugging purposes, so it's safe to just give up here.
 		log.WithError(err).Debug("Could not read failed racer response body")
diff --git a/tool/tsh/tsh.go b/tool/tsh/tsh.go
index 0e5285d080b65..9b6284e63e380 100644
--- a/tool/tsh/tsh.go
+++ b/tool/tsh/tsh.go
@@ -26,7 +26,6 @@ import (
 	"os/signal"
 	"path"
 	"path/filepath"
-	"regexp"
 	"runtime"
 	"sort"
 	"strings"
@@ -35,17 +34,16 @@ import (
 
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
+	"golang.org/x/term"
 
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
-	"github.com/gravitational/teleport/api/profile"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	apisshutils "github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth"
-	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	"github.com/gravitational/teleport/lib/benchmark"
 	"github.com/gravitational/teleport/lib/client"
 	dbprofile "github.com/gravitational/teleport/lib/client/db"
@@ -210,12 +208,6 @@ type CLIConf struct {
 	// Format is used to change the format of output
 	Format string
 
-	// SearchKeywords is a list of search keywords to match against resource field values.
-	SearchKeywords string
-
-	// PredicateExpression defines boolean conditions that will be matched against the resource.
-	PredicateExpression string
-
 	// NoRemoteExec will not execute a remote command after connecting to a host,
 	// will block instead. Useful when port forwarding. Equivalent of -N for OpenSSH.
 	NoRemoteExec bool
@@ -261,8 +253,6 @@ type CLIConf struct {
 
 	// overrideStdout allows to switch standard output source for resource command. Used in tests.
 	overrideStdout io.Writer
-	// overrideStderr allows to switch standard error source for resource command. Used in tests.
-	overrideStderr io.Writer
 
 	// mockSSOLogin used in tests to override sso login handler in teleport client.
 	mockSSOLogin client.SSOLoginFunc
@@ -293,15 +283,6 @@ type CLIConf struct {
 
 	// JoinMode is the participant mode someone is joining a session as.
 	JoinMode string
-
-	// Passwordless instructs tsh to do passwordless login.
-	Passwordless bool
-
-	// displayParticipantRequirements is set if verbose participant requirement information should be printed for moderated sessions.
-	displayParticipantRequirements bool
-
-	// ExtraProxyHeaders is configuration read from the .tsh/config/config.yaml file.
-	ExtraProxyHeaders []ExtraProxyHeaders
 }
 
 // Stdout returns the stdout writer.
@@ -312,14 +293,6 @@ func (c *CLIConf) Stdout() io.Writer {
 	return os.Stdout
 }
 
-// Stderr returns the stderr writer.
-func (c *CLIConf) Stderr() io.Writer {
-	if c.overrideStderr != nil {
-		return c.overrideStderr
-	}
-	return os.Stderr
-}
-
 func main() {
 	cmdLineOrig := os.Args[1:]
 	var cmdLine []string
@@ -356,9 +329,7 @@ const (
 
 	clusterHelp = "Specify the Teleport cluster to connect"
 	browserHelp = "Set to 'none' to suppress browser opening on login"
-	searchHelp  = `List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")`
-	queryHelp   = `Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and || (e.g. --query='labels.key1 == "value1" && labels.key2 != "value2"')`
-	labelHelp   = "List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)"
+
 	// proxyDefaultResolutionTimeout is how long to wait for an unknown proxy
 	// port to be resolved.
 	//
@@ -367,6 +338,8 @@ const (
 	// establishment of a TCP connection, rather than the full HTTP round-
 	// trip that we measure against, so some tweaking may be needed.
 	proxyDefaultResolutionTimeout = 2 * time.Second
+
+	teleportNamespace = "teleport.dev"
 )
 
 // cliOption is used in tests to inject/override configuration within Run
@@ -380,15 +353,12 @@ func Run(args []string, opts ...cliOption) error {
 	moduleCfg := modules.GetModules()
 
 	// configure CLI argument parser:
-	app := utils.InitCLIParser("tsh", "Teleport Command Line Client").Interspersed(false)
+	app := utils.InitCLIParser("tsh", "TSH: Teleport Authentication Gateway Client").Interspersed(false)
 	app.Flag("login", "Remote host login").Short('l').Envar(loginEnvVar).StringVar(&cf.NodeLogin)
 	localUser, _ := client.Username()
 	app.Flag("proxy", "SSH proxy address").Envar(proxyEnvVar).StringVar(&cf.Proxy)
 	app.Flag("nocache", "do not cache cluster discovery locally").Hidden().BoolVar(&cf.NoCache)
 	app.Flag("user", fmt.Sprintf("SSH proxy user [%s]", localUser)).Envar(userEnvVar).StringVar(&cf.Username)
-	if wancli.IsFIDO2Available() {
-		app.Flag("pwdless", "Do passwordless login").BoolVar(&cf.Passwordless)
-	}
 	app.Flag("option", "").Short('o').Hidden().AllowDuplicate().PreAction(func(ctx *kingpin.ParseContext) error {
 		return trace.BadParameter("invalid flag, perhaps you want to use this flag as tsh ssh -o?")
 	}).String()
@@ -422,9 +392,7 @@ func Run(args []string, opts ...cliOption) error {
 		BoolVar(&cf.EnableEscapeSequences)
 	app.Flag("bind-addr", "Override host:port used when opening a browser for cluster logins").Envar(bindAddrEnvVar).StringVar(&cf.BindAddr)
 	app.HelpFlag.Short('h')
-
 	ver := app.Command("version", "Print the version")
-
 	// ssh
 	ssh := app.Command("ssh", "Run shell or execute a command on a remote SSH node")
 	ssh.Arg("[user@]host", "Remote hostname and the login to use").Required().StringVar(&cf.UserHost)
@@ -442,7 +410,6 @@ func Run(args []string, opts ...cliOption) error {
 	ssh.Flag("x11-untrusted", "Requests untrusted (secure) X11 forwarding for this session").Short('X').BoolVar(&cf.X11ForwardingUntrusted)
 	ssh.Flag("x11-trusted", "Requests trusted (insecure) X11 forwarding for this session. This can make your local displays vulnerable to attacks, use with caution").Short('Y').BoolVar(&cf.X11ForwardingTrusted)
 	ssh.Flag("x11-untrusted-timeout", "Sets a timeout for untrusted X11 forwarding, after which the client will reject any forwarding requests from the server").Default("10m").DurationVar((&cf.X11ForwardingTimeout))
-	ssh.Flag("participant-req", "Displays a verbose list of required participants in a moderated session.").BoolVar(&cf.displayParticipantRequirements)
 
 	// AWS.
 	aws := app.Command("aws", "Access AWS API.")
@@ -454,9 +421,6 @@ func Run(args []string, opts ...cliOption) error {
 	lsApps := apps.Command("ls", "List available applications.")
 	lsApps.Flag("verbose", "Show extra application fields.").Short('v').BoolVar(&cf.Verbose)
 	lsApps.Flag("cluster", clusterHelp).StringVar(&cf.SiteName)
-	lsApps.Flag("search", searchHelp).StringVar(&cf.SearchKeywords)
-	lsApps.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
-	lsApps.Arg("labels", labelHelp).StringVar(&cf.UserHost)
 	appLogin := apps.Command("login", "Retrieve short-lived certificate for an app.")
 	appLogin.Arg("app", "App name to retrieve credentials for. Can be obtained from `tsh apps ls` output.").Required().StringVar(&cf.AppName)
 	appLogin.Flag("aws-role", "(For AWS CLI access only) Amazon IAM role ARN or role name.").StringVar(&cf.AWSRole)
@@ -486,9 +450,6 @@ func Run(args []string, opts ...cliOption) error {
 	db.Flag("cluster", clusterHelp).StringVar(&cf.SiteName)
 	dbList := db.Command("ls", "List all available databases.")
 	dbList.Flag("verbose", "Show extra database fields.").Short('v').BoolVar(&cf.Verbose)
-	dbList.Flag("search", searchHelp).StringVar(&cf.SearchKeywords)
-	dbList.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
-	dbList.Arg("labels", labelHelp).StringVar(&cf.UserHost)
 	dbLogin := db.Command("login", "Retrieve credentials for a database.")
 	dbLogin.Arg("db", "Database to retrieve credentials for. Can be obtained from 'tsh db ls' output.").Required().StringVar(&cf.DatabaseService)
 	dbLogin.Flag("db-user", "Optional database user to configure as default.").StringVar(&cf.DatabaseUser)
@@ -533,11 +494,9 @@ func Run(args []string, opts ...cliOption) error {
 	// ls
 	ls := app.Command("ls", "List remote SSH nodes")
 	ls.Flag("cluster", clusterHelp).StringVar(&cf.SiteName)
+	ls.Arg("labels", "List of labels to filter node list").StringVar(&cf.UserHost)
 	ls.Flag("verbose", "One-line output (for text format), including node UUIDs").Short('v').BoolVar(&cf.Verbose)
 	ls.Flag("format", "Format output (text, json, names)").Short('f').Default(teleport.Text).StringVar(&cf.Format)
-	ls.Arg("labels", labelHelp).StringVar(&cf.UserHost)
-	ls.Flag("search", searchHelp).StringVar(&cf.SearchKeywords)
-	ls.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
 	// clusters
 	clusters := app.Command("clusters", "List available Teleport clusters")
 	clusters.Flag("quiet", "Quiet mode").Short('q').BoolVar(&cf.Quiet)
@@ -638,10 +597,8 @@ func Run(args []string, opts ...cliOption) error {
 	}
 
 	// parse CLI commands+flags:
-	utils.UpdateAppUsageTemplate(app, args)
 	command, err := app.Parse(args)
 	if err != nil {
-		app.Usage(args)
 		return trace.Wrap(err)
 	}
 
@@ -688,15 +645,6 @@ func Run(args []string, opts ...cliOption) error {
 
 	setEnvFlags(&cf, os.Getenv)
 
-	confOptions, err := loadConfig(cf.HomePath)
-	if err != nil && !trace.IsNotFound(err) {
-		return trace.Wrap(err, "failed to load tsh config from %s",
-			filepath.Join(profile.FullProfilePath(cf.HomePath), tshConfigPath))
-	}
-	if confOptions != nil {
-		cf.ExtraProxyHeaders = confOptions.ExtraHeaders
-	}
-
 	switch command {
 	case ver.FullCommand():
 		utils.PrintVersion()
@@ -912,37 +860,23 @@ func onLogin(cf *CLIConf) error {
 		// in case if nothing is specified, re-fetch kube clusters and print
 		// current status
 		case cf.Proxy == "" && cf.SiteName == "" && cf.DesiredRoles == "" && cf.RequestID == "" && cf.IdentityFileOut == "":
-			_, err := tc.PingAndShowMOTD(cf.Context)
-			if err != nil {
-				return trace.Wrap(err)
-			}
 			if err := updateKubeConfig(cf, tc, ""); err != nil {
 				return trace.Wrap(err)
 			}
 			printProfiles(cf.Debug, profile, profiles)
-
 			return nil
 		// in case if parameters match, re-fetch kube clusters and print
 		// current status
 		case host(cf.Proxy) == host(profile.ProxyURL.Host) && cf.SiteName == profile.Cluster && cf.DesiredRoles == "" && cf.RequestID == "":
-			_, err := tc.PingAndShowMOTD(cf.Context)
-			if err != nil {
-				return trace.Wrap(err)
-			}
 			if err := updateKubeConfig(cf, tc, ""); err != nil {
 				return trace.Wrap(err)
 			}
 			printProfiles(cf.Debug, profile, profiles)
-
 			return nil
 		// proxy is unspecified or the same as the currently provided proxy,
 		// but cluster is specified, treat this as selecting a new cluster
 		// for the same proxy
 		case (cf.Proxy == "" || host(cf.Proxy) == host(profile.ProxyURL.Host)) && cf.SiteName != "":
-			_, err := tc.PingAndShowMOTD(cf.Context)
-			if err != nil {
-				return trace.Wrap(err)
-			}
 			// trigger reissue, preserving any active requests.
 			err = tc.ReissueUserCerts(cf.Context, client.CertCacheKeep, client.ReissueParams{
 				AccessRequests: profile.ActiveRequests.AccessRequests,
@@ -957,16 +891,11 @@ func onLogin(cf *CLIConf) error {
 			if err := updateKubeConfig(cf, tc, ""); err != nil {
 				return trace.Wrap(err)
 			}
-
 			return trace.Wrap(onStatus(cf))
 		// proxy is unspecified or the same as the currently provided proxy,
 		// but desired roles or request ID is specified, treat this as a
 		// privilege escalation request for the same login session.
 		case (cf.Proxy == "" || host(cf.Proxy) == host(profile.ProxyURL.Host)) && (cf.DesiredRoles != "" || cf.RequestID != "") && cf.IdentityFileOut == "":
-			_, err := tc.PingAndShowMOTD(cf.Context)
-			if err != nil {
-				return trace.Wrap(err)
-			}
 			if err := executeAccessRequest(cf, tc); err != nil {
 				return trace.Wrap(err)
 			}
@@ -1316,7 +1245,7 @@ func onListNodes(cf *CLIConf) error {
 	// Get list of all nodes in backend and sort by "Node Name".
 	var nodes []types.Server
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		nodes, err = tc.ListNodesWithFilters(cf.Context)
+		nodes, err = tc.ListNodes(cf.Context)
 		return err
 	})
 	if err != nil {
@@ -1487,7 +1416,7 @@ func printNodesAsText(nodes []types.Server, verbose bool) {
 			rows = append(rows,
 				[]string{n.GetHostname(), getAddr(n), sortedLabels(n.GetAllLabels())})
 		}
-		t = asciitable.MakeTableWithTruncatedColumn([]string{"Node Name", "Address", "Labels"}, rows, "Labels")
+		t = makeTableWithTruncatedColumn([]string{"Node Name", "Address", "Labels"}, rows, "Labels")
 	}
 	fmt.Println(t.AsBuffer().String())
 }
@@ -1497,7 +1426,7 @@ func sortedLabels(labels map[string]string) string {
 	var namespaced []string
 	var result []string
 	for key, val := range labels {
-		if strings.HasPrefix(key, types.TeleportNamespace+"/") {
+		if strings.HasPrefix(key, teleportNamespace+"/") {
 			teleportNamespaced = append(teleportNamespaced, key)
 			continue
 		}
@@ -1550,12 +1479,60 @@ func showApps(apps []types.Application, active []tlsca.RouteToApp, verbose bool)
 			labels := sortedLabels(app.GetAllLabels())
 			rows = append(rows, []string{name, desc, addr, labels})
 		}
-		t := asciitable.MakeTableWithTruncatedColumn(
+		t := makeTableWithTruncatedColumn(
 			[]string{"Application", "Description", "Public Address", "Labels"}, rows, "Labels")
 		fmt.Println(t.AsBuffer().String())
 	}
 }
 
+func makeTableWithTruncatedColumn(columnOrder []string, rows [][]string, truncatedColumn string) asciitable.Table {
+	width, _, err := term.GetSize(int(os.Stdin.Fd()))
+	if err != nil {
+		width = 80
+	}
+	truncatedColMinSize := 16
+	maxColWidth := (width - truncatedColMinSize) / (len(columnOrder) - 1)
+	t := asciitable.MakeTable([]string{})
+	totalLen := 0
+	columns := []asciitable.Column{}
+
+	for collIndex, colName := range columnOrder {
+		column := asciitable.Column{
+			Title:         colName,
+			MaxCellLength: len(colName),
+		}
+		if colName == truncatedColumn { // truncated column is handled separately in next loop
+			columns = append(columns, column)
+			continue
+		}
+		for _, row := range rows {
+			cellLen := row[collIndex]
+			if len(cellLen) > column.MaxCellLength {
+				column.MaxCellLength = len(cellLen)
+			}
+		}
+		if column.MaxCellLength > maxColWidth {
+			column.MaxCellLength = maxColWidth
+			totalLen += column.MaxCellLength + 4 // "...<space>"
+		} else {
+			totalLen += column.MaxCellLength + 1 // +1 for column separator
+		}
+		columns = append(columns, column)
+	}
+
+	for _, column := range columns {
+		if column.Title == truncatedColumn {
+			column.MaxCellLength = width - totalLen - len("... ")
+		}
+		t.AddColumn(column)
+	}
+
+	for _, row := range rows {
+		t.AddRow(row)
+	}
+	return t
+}
+
 func showDatabases(clusterFlag string, databases []types.Database, active []tlsca.RouteToDatabase, verbose bool) {
 	if verbose {
 		t := asciitable.MakeTable([]string{"Name", "Description", "Protocol", "Type", "URI", "Labels", "Connect", "Expires"})
@@ -1598,7 +1575,7 @@ func showDatabases(clusterFlag string, databases []types.Database, active []tlsc
 				connect,
 			})
 		}
-		t := asciitable.MakeTableWithTruncatedColumn([]string{"Name", "Description", "Labels", "Connect"}, rows, "Labels")
+		t := makeTableWithTruncatedColumn([]string{"Name", "Description", "Labels", "Connect"}, rows, "Labels")
 		fmt.Println(t.AsBuffer().String())
 	}
 }
@@ -1762,8 +1739,7 @@ func onBenchmark(cf *CLIConf) error {
 	fmt.Printf("\nHistogram\n\n")
 	t := asciitable.MakeTable([]string{"Percentile", "Response Duration"})
 	for _, quantile := range []float64{25, 50, 75, 90, 95, 99, 100} {
-		t.AddRow([]string{
-			fmt.Sprintf("%v", quantile),
+		t.AddRow([]string{fmt.Sprintf("%v", quantile),
 			fmt.Sprintf("%v ms", result.Histogram.ValueAtQuantile(quantile)),
 		})
 	}
@@ -1982,29 +1958,12 @@ func makeClient(cf *CLIConf, useProfileLogin bool) (*client.TeleportClient, erro
 	if cf.Username != "" {
 		c.Username = cf.Username
 	}
-	c.Passwordless = cf.Passwordless
 	// if proxy is set, and proxy is not equal to profile's
 	// loaded addresses, override the values
 	if err := setClientWebProxyAddr(cf, c); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if c.ExtraProxyHeaders == nil {
-		c.ExtraProxyHeaders = map[string]string{}
-	}
-	for _, proxyHeaders := range cf.ExtraProxyHeaders {
-		proxyGlob := utils.GlobToRegexp(proxyHeaders.Proxy)
-		proxyRegexp, err := regexp.Compile(proxyGlob)
-		if err != nil {
-			return nil, trace.Wrap(err, "invalid proxy glob %q in tsh configuration file", proxyGlob)
-		}
-		if proxyRegexp.MatchString(c.WebProxyAddr) {
-			for k, v := range proxyHeaders.Headers {
-				c.ExtraProxyHeaders[k] = v
-			}
-		}
-	}
-
 	if len(fPorts) > 0 {
 		c.LocalForwardPorts = fPorts
 	}
@@ -2033,11 +1992,6 @@ func makeClient(cf *CLIConf, useProfileLogin bool) (*client.TeleportClient, erro
 	c.Labels = labels
 	c.KeyTTL = time.Minute * time.Duration(cf.MinsToLive)
 	c.InsecureSkipVerify = cf.InsecureSkipVerify
-	c.PredicateExpression = cf.PredicateExpression
-
-	if cf.SearchKeywords != "" {
-		c.SearchKeywords = client.ParseSearchKeywords(cf.SearchKeywords, ',')
-	}
 
 	// If a TTY was requested, make sure to allocate it. Note this applies to
 	// "exec" command because a shell always has a TTY allocated.
@@ -2132,12 +2086,8 @@ func makeClient(cf *CLIConf, useProfileLogin bool) (*client.TeleportClient, erro
 		}
 	}
 
-	tc.Config.Stderr = cf.Stderr()
-	tc.Config.Stdout = cf.Stdout()
-
 	tc.Config.Reason = cf.Reason
 	tc.Config.Invited = cf.Invited
-	tc.Config.DisplayParticipantRequirements = cf.displayParticipantRequirements
 	return tc, nil
 }
 
@@ -2235,6 +2185,7 @@ func refuseArgs(command string, args []string) error {
 		} else {
 			return trace.BadParameter("unexpected argument: %s", arg)
 		}
+
 	}
 	return nil
 }
@@ -2502,7 +2453,7 @@ func onApps(cf *CLIConf) error {
 	// Get a list of all applications.
 	var apps []types.Application
 	err = client.RetryWithRelogin(cf.Context, tc, func() error {
-		apps, err = tc.ListApps(cf.Context, nil /* custom filter */)
+		apps, err = tc.ListApps(cf.Context)
 		return err
 	})
 	if err != nil {
diff --git a/tool/tsh/tsh_helper_test.go b/tool/tsh/tsh_helper_test.go
index faac5aae33ff0..823f0f4f48141 100644
--- a/tool/tsh/tsh_helper_test.go
+++ b/tool/tsh/tsh_helper_test.go
@@ -84,7 +84,7 @@ func (s *suite) setupRootCluster(t *testing.T, options testSuiteOptions) {
 	require.NoError(t, err)
 
 	s.connector = mockConnector(t)
-	sshLoginRole, err := types.NewRoleV3("ssh-login", types.RoleSpecV5{
+	sshLoginRole, err := types.NewRole("ssh-login", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{user.Username},
 		},
@@ -143,7 +143,7 @@ func (s *suite) setupLeafCluster(t *testing.T) {
 	require.NoError(t, err)
 
 	cfg.Proxy.DisableWebInterface = true
-	sshLoginRole, err := types.NewRoleV3("ssh-login", types.RoleSpecV5{
+	sshLoginRole, err := types.NewRole("ssh-login", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Logins: []string{user.Username},
 		},
diff --git a/tool/tsh/tsh_test.go b/tool/tsh/tsh_test.go
index 4ceb4adc0c994..375554dea5750 100644
--- a/tool/tsh/tsh_test.go
+++ b/tool/tsh/tsh_test.go
@@ -17,10 +17,9 @@ limitations under the License.
 package main
 
 import (
-	"bufio"
-	"bytes"
 	"context"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -154,7 +153,7 @@ func TestOIDCLogin(t *testing.T) {
 
 	// set up an initial role with `request_access: always` in order to
 	// trigger automatic post-login escalation.
-	populist, err := types.NewRoleV3("populist", types.RoleSpecV5{
+	populist, err := types.NewRole("populist", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Request: &types.AccessRequestConditions{
 				Roles: []string{"dictator"},
@@ -167,7 +166,7 @@ func TestOIDCLogin(t *testing.T) {
 	require.NoError(t, err)
 
 	// empty role which serves as our escalation target
-	dictator, err := types.NewRoleV3("dictator", types.RoleSpecV5{})
+	dictator, err := types.NewRole("dictator", types.RoleSpecV5{})
 	require.NoError(t, err)
 
 	alice, err := types.NewUser("alice@example.com")
@@ -176,11 +175,7 @@ func TestOIDCLogin(t *testing.T) {
 
 	connector := mockConnector(t)
 
-	motd := "MESSAGE_OF_THE_DAY_OIDC"
-	authProcess, proxyProcess := makeTestServers(t,
-		withBootstrap(populist, dictator, connector, alice),
-		withMOTD(t, motd),
-	)
+	authProcess, proxyProcess := makeTestServers(t, withBootstrap(populist, dictator, connector, alice))
 
 	authServer := authProcess.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -218,8 +213,6 @@ func TestOIDCLogin(t *testing.T) {
 		}
 	}()
 
-	buf := bytes.NewBuffer([]byte{})
-	sc := bufio.NewScanner(buf)
 	err = Run([]string{
 		"login",
 		"--insecure",
@@ -230,7 +223,6 @@ func TestOIDCLogin(t *testing.T) {
 	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
 		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
 		cf.SiteName = "localhost"
-		cf.overrideStderr = buf
 		return nil
 	}))
 
@@ -239,22 +231,11 @@ func TestOIDCLogin(t *testing.T) {
 	// verify that auto-request happened
 	require.True(t, didAutoRequest.Load())
 
-	findMOTD(t, sc, motd)
 	// if we got this far, then tsh successfully registered name change from `alice` to
 	// `alice@example.com`, since the correct name needed to be used for the access
 	// request to be generated.
 }
 
-func findMOTD(t *testing.T, sc *bufio.Scanner, motd string) {
-	t.Helper()
-	for sc.Scan() {
-		if strings.Contains(sc.Text(), motd) {
-			return
-		}
-	}
-	require.Fail(t, "Failed to find %q MOTD in the logs", motd)
-}
-
 // TestLoginIdentityOut makes sure that "tsh login --out <ident>" command
 // writes identity credentials to the specified path.
 func TestLoginIdentityOut(t *testing.T) {
@@ -302,11 +283,7 @@ func TestRelogin(t *testing.T) {
 	require.NoError(t, err)
 	alice.SetRoles([]string{"access"})
 
-	motd := "RELOGIN MOTD PRESENT"
-	authProcess, proxyProcess := makeTestServers(t,
-		withBootstrap(connector, alice),
-		withMOTD(t, motd),
-	)
+	authProcess, proxyProcess := makeTestServers(t, withBootstrap(connector, alice))
 
 	authServer := authProcess.GetAuthServer()
 	require.NotNil(t, authServer)
@@ -314,8 +291,6 @@ func TestRelogin(t *testing.T) {
 	proxyAddr, err := proxyProcess.ProxyWebAddr()
 	require.NoError(t, err)
 
-	buf := bytes.NewBuffer([]byte{})
-	sc := bufio.NewScanner(buf)
 	err = Run([]string{
 		"login",
 		"--insecure",
@@ -324,11 +299,9 @@ func TestRelogin(t *testing.T) {
 		"--proxy", proxyAddr.String(),
 	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
 		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
-		cf.overrideStderr = buf
 		return nil
 	}))
 	require.NoError(t, err)
-	findMOTD(t, sc, motd)
 
 	err = Run([]string{
 		"login",
@@ -336,20 +309,10 @@ func TestRelogin(t *testing.T) {
 		"--debug",
 		"--proxy", proxyAddr.String(),
 		"localhost",
-	}, setHomePath(tmpHomePath),
-		cliOption(func(cf *CLIConf) error {
-			cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
-			cf.overrideStderr = buf
-			return nil
-		}))
+	}, setHomePath(tmpHomePath))
 	require.NoError(t, err)
-	findMOTD(t, sc, motd)
 
-	err = Run([]string{"logout"}, setHomePath(tmpHomePath),
-		cliOption(func(cf *CLIConf) error {
-			cf.overrideStderr = buf
-			return nil
-		}))
+	err = Run([]string{"logout"}, setHomePath(tmpHomePath))
 	require.NoError(t, err)
 
 	err = Run([]string{
@@ -361,10 +324,8 @@ func TestRelogin(t *testing.T) {
 		"localhost",
 	}, setHomePath(tmpHomePath), cliOption(func(cf *CLIConf) error {
 		cf.mockSSOLogin = mockSSOLogin(t, authServer, alice)
-		cf.overrideStderr = buf
 		return nil
 	}))
-	findMOTD(t, sc, motd)
 	require.NoError(t, err)
 }
 
@@ -423,11 +384,6 @@ func TestMakeClient(t *testing.T) {
 	conf.NodePort = 46528
 	conf.LocalForwardPorts = []string{"80:remote:180"}
 	conf.DynamicForwardedPorts = []string{":8080"}
-	conf.ExtraProxyHeaders = []ExtraProxyHeaders{
-		{Proxy: "proxy:3080", Headers: map[string]string{"A": "B"}},
-		{Proxy: "*roxy:3080", Headers: map[string]string{"C": "D"}},
-		{Proxy: "*hello:3080", Headers: map[string]string{"E": "F"}}, // shouldn't get included
-	}
 	tc, err = makeClient(&conf, true)
 	require.NoError(t, err)
 	require.Equal(t, time.Minute*time.Duration(conf.MinsToLive), tc.Config.KeyTTL)
@@ -447,10 +403,6 @@ func TestMakeClient(t *testing.T) {
 		},
 	}, tc.Config.DynamicForwardedPorts)
 
-	require.Equal(t,
-		map[string]string{"A": "B", "C": "D"},
-		tc.ExtraProxyHeaders)
-
 	_, proxy := makeTestServers(t)
 
 	proxyWebAddr, err := proxy.ProxyWebAddr()
@@ -492,7 +444,7 @@ func TestAccessRequestOnLeaf(t *testing.T) {
 		lib.SetInsecureDevMode(isInsecure)
 	})
 
-	requester, err := types.NewRoleV3("requester", types.RoleSpecV5{
+	requester, err := types.NewRole("requester", types.RoleSpecV5{
 		Allow: types.RoleConditions{
 			Request: &types.AccessRequestConditions{
 				Roles: []string{"access"},
@@ -682,7 +634,7 @@ func TestIdentityRead(t *testing.T) {
 	require.NotNil(t, cb)
 
 	// prepare the cluster CA separately
-	certBytes, err := os.ReadFile("../../fixtures/certs/identities/ca.pem")
+	certBytes, err := ioutil.ReadFile("../../fixtures/certs/identities/ca.pem")
 	require.NoError(t, err)
 
 	_, hosts, cert, _, _, err := ssh.ParseKnownHosts(certBytes)
@@ -1034,6 +986,58 @@ func TestKubeConfigUpdate(t *testing.T) {
 	}
 }
 
+func TestMakeTableWithTruncatedColumn(t *testing.T) {
+	// os.Stdin.Fd() fails during go test, so width is defaulted to 80
+	columns := []string{"column1", "column2", "column3"}
+	rows := [][]string{[]string{strings.Repeat("cell1", 6), strings.Repeat("cell2", 6), strings.Repeat("cell3", 6)}}
+
+	testCases := []struct {
+		truncatedColumn string
+		expectedWidth   int
+		expectedOutput  []string
+	}{
+		{
+			truncatedColumn: "column2",
+			expectedWidth:   80,
+			expectedOutput: []string{
+				"column1                        column2           column3                        ",
+				"------------------------------ ----------------- ------------------------------ ",
+				"cell1cell1cell1cell1cell1cell1 cell2cell2cell... cell3cell3cell3cell3cell3cell3 ",
+				"",
+			},
+		},
+		{
+			truncatedColumn: "column3",
+			expectedWidth:   80,
+			expectedOutput: []string{
+				"column1                        column2                        column3           ",
+				"------------------------------ ------------------------------ ----------------- ",
+				"cell1cell1cell1cell1cell1cell1 cell2cell2cell2cell2cell2cell2 cell3cell3cell... ",
+				"",
+			},
+		},
+		{
+			truncatedColumn: "no column match",
+			expectedWidth:   93,
+			expectedOutput: []string{
+				"column1                        column2                        column3                        ",
+				"------------------------------ ------------------------------ ------------------------------ ",
+				"cell1cell1cell1cell1cell1cell1 cell2cell2cell2cell2cell2cell2 cell3cell3cell3cell3cell3cell3 ",
+				"",
+			},
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.truncatedColumn, func(t *testing.T) {
+			table := makeTableWithTruncatedColumn(columns, rows, testCase.truncatedColumn)
+			rows := strings.Split(table.AsBuffer().String(), "\n")
+			require.Len(t, rows, 4)
+			require.Len(t, rows[2], testCase.expectedWidth)
+			require.Equal(t, testCase.expectedOutput, rows)
+		})
+	}
+}
+
 func TestSetX11Config(t *testing.T) {
 	t.Parallel()
 
@@ -1234,8 +1238,8 @@ func TestSetX11Config(t *testing.T) {
 }
 
 type testServersOpts struct {
-	bootstrap       []types.Resource
-	authConfigFuncs []func(cfg *service.AuthConfig)
+	bootstrap      []types.Resource
+	authConfigFunc func(cfg *service.AuthConfig)
 }
 
 type testServerOptFunc func(o *testServersOpts)
@@ -1248,11 +1252,7 @@ func withBootstrap(bootstrap ...types.Resource) testServerOptFunc {
 
 func withAuthConfig(fn func(cfg *service.AuthConfig)) testServerOptFunc {
 	return func(o *testServersOpts) {
-		if o.authConfigFuncs == nil {
-			o.authConfigFuncs = []func(cfg *service.AuthConfig){}
-		}
-
-		o.authConfigFuncs = append(o.authConfigFuncs, fn)
+		o.authConfigFunc = fn
 	}
 }
 
@@ -1267,17 +1267,6 @@ func withClusterName(t *testing.T, n string) testServerOptFunc {
 	})
 }
 
-func withMOTD(t *testing.T, motd string) testServerOptFunc {
-	oldpass := client.PasswordFromConsoleFn
-	*client.PasswordFromConsoleFn = func() (string, error) {
-		return "", nil
-	}
-	t.Cleanup(func() { *client.PasswordFromConsoleFn = *oldpass })
-	return withAuthConfig(func(cfg *service.AuthConfig) {
-		cfg.Preference.SetMessageOfTheDay(motd)
-	})
-}
-
 func makeTestServers(t *testing.T, opts ...testServerOptFunc) (auth *service.TeleportProcess, proxy *service.TeleportProcess) {
 	var options testServersOpts
 	for _, opt := range opts {
@@ -1310,8 +1299,8 @@ func makeTestServers(t *testing.T, opts ...testServerOptFunc) (auth *service.Tel
 	cfg.Proxy.Enabled = false
 	cfg.Log = utils.NewLoggerForTests()
 
-	for _, fn := range options.authConfigFuncs {
-		fn(&cfg.Auth)
+	if options.authConfigFunc != nil {
+		options.authConfigFunc(&cfg.Auth)
 	}
 
 	auth, err = service.NewTeleport(cfg)
@@ -1394,7 +1383,7 @@ func mockSSOLogin(t *testing.T, authServer *auth.Server, user types.User) client
 		require.NoError(t, err)
 
 		// load CA cert
-		authority, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
+		authority, err := authServer.GetCertAuthority(types.CertAuthID{
 			Type:       types.HostCA,
 			DomainName: "localhost",
 		}, false)
diff --git a/tool/tsh/tshconfig.go b/tool/tsh/tshconfig.go
deleted file mode 100644
index c4a4a76c8f8b5..0000000000000
--- a/tool/tsh/tshconfig.go
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
-Copyright 2022 Gravitational, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"os"
-	"path/filepath"
-
-	"github.com/gravitational/teleport/api/profile"
-	"github.com/gravitational/trace"
-	"gopkg.in/yaml.v2"
-)
-
-// .tsh config must go in a subdir as all .yaml files in .tsh get
-// parsed automatically by the profile loader and results in yaml
-// unmarshal errors.
-const tshConfigPath = "config/config.yaml"
-
-// TshConfig represents configuration loaded from the tsh config file.
-type TshConfig struct {
-	// ExtraHeaders are additional http headers to be included in
-	// webclient requests.
-	ExtraHeaders []ExtraProxyHeaders `yaml:"add_headers"`
-}
-
-// ExtraProxyHeaders represents the headers to include with the
-// webclient.
-type ExtraProxyHeaders struct {
-	// Proxy is the domain of the proxy for these set of Headers, can contain globs.
-	Proxy string `yaml:"proxy"`
-	// Headers are the http header key values.
-	Headers map[string]string `yaml:"headers,omitempty"`
-}
-
-func loadConfig(homePath string) (*TshConfig, error) {
-	confPath := filepath.Join(profile.FullProfilePath(homePath), tshConfigPath)
-	configFile, err := os.Open(confPath)
-	if err != nil {
-		return nil, trace.ConvertSystemError(err)
-	}
-	defer configFile.Close()
-	cfg := TshConfig{}
-	err = yaml.NewDecoder(configFile).Decode(&cfg)
-	return &cfg, trace.Wrap(err)
-}
diff --git a/webassets b/webassets
index f9ba10f271617..d92318d2efa30 160000
--- a/webassets
+++ b/webassets
@@ -1 +1 @@
-Subproject commit f9ba10f271617fabe1f247e91ea363286a84f604
+Subproject commit d92318d2efa301f5b58ec3a242fb3b09dd580f19

From c3946d7c35bb8d8a42137e0b2db572fe6f82adf2 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 23 Mar 2022 14:33:36 -0700
Subject: [PATCH 30/43] Don't ignore roundtrip response in proxy test

---
 api/client/proxy/proxy_test.go | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/api/client/proxy/proxy_test.go b/api/client/proxy/proxy_test.go
index 33e2239a4fd52..cd8ad3da53e69 100644
--- a/api/client/proxy/proxy_test.go
+++ b/api/client/proxy/proxy_test.go
@@ -20,7 +20,6 @@ import (
 	"crypto/tls"
 	"fmt"
 	"net/http"
-	"net/http/httptest"
 	"net/url"
 	"testing"
 
@@ -134,8 +133,10 @@ func TestProxyAwareRoundTripper(t *testing.T) {
 			},
 		},
 	}
-	req := httptest.NewRequest(http.MethodGet, "https://localhost:9999", nil)
+	req, err := http.NewRequest(http.MethodGet, "https://localhost:9999", nil)
+	require.NoError(t, err)
 	// Don't care about response, only if the scheme changed.
-	rt.RoundTrip(req)
+	_, err = rt.RoundTrip(req)
+	require.Error(t, err)
 	require.Equal(t, "http", req.URL.Scheme)
 }

From f4c1115fc53cbe3537627cf8258cda044ec3d1d8 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 23 Mar 2022 14:46:45 -0700
Subject: [PATCH 31/43] Revert proxyaddr type change in some places

---
 api/client/contextdialer.go | 2 +-
 api/client/proxy.go         | 8 ++++----
 lib/utils/proxy/proxy.go    | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/api/client/contextdialer.go b/api/client/contextdialer.go
index 1710672b941d1..52c8efb2b2a23 100644
--- a/api/client/contextdialer.go
+++ b/api/client/contextdialer.go
@@ -59,7 +59,7 @@ func NewDialer(keepAlivePeriod, dialTimeout time.Duration) ContextDialer {
 	return ContextDialerFunc(func(ctx context.Context, network, addr string) (net.Conn, error) {
 		dialer := newDirectDialer(keepAlivePeriod, dialTimeout)
 		if proxyAddr := proxy.GetProxyAddress(addr); proxyAddr != nil {
-			return DialProxyWithDialer(ctx, proxyAddr, addr, dialer)
+			return DialProxyWithDialer(ctx, proxyAddr.Host, addr, dialer)
 		}
 		return dialer.DialContext(ctx, network, addr)
 	})
diff --git a/api/client/proxy.go b/api/client/proxy.go
index 7e4f80c59a09e..e6c61164ffbff 100644
--- a/api/client/proxy.go
+++ b/api/client/proxy.go
@@ -28,15 +28,15 @@ import (
 )
 
 // DialProxy creates a connection to a server via an HTTP Proxy.
-func DialProxy(ctx context.Context, proxyAddr *url.URL, addr string) (net.Conn, error) {
+func DialProxy(ctx context.Context, proxyAddr, addr string) (net.Conn, error) {
 	return DialProxyWithDialer(ctx, proxyAddr, addr, &net.Dialer{})
 }
 
 // DialProxyWithDialer creates a connection to a server via an HTTP Proxy using a specified dialer.
-func DialProxyWithDialer(ctx context.Context, proxyAddr *url.URL, addr string, dialer ContextDialer) (net.Conn, error) {
-	conn, err := dialer.DialContext(ctx, "tcp", proxyAddr.Host)
+func DialProxyWithDialer(ctx context.Context, proxyAddr, addr string, dialer ContextDialer) (net.Conn, error) {
+	conn, err := dialer.DialContext(ctx, "tcp", proxyAddr)
 	if err != nil {
-		log.Warnf("Unable to dial to proxy: %v: %v.", proxyAddr.Host, err)
+		log.Warnf("Unable to dial to proxy: %v: %v.", proxyAddr, err)
 		return nil, trace.ConvertSystemError(err)
 	}
 
diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index d157ffe0fd931..9fcc38ec8b5e9 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -172,7 +172,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 		defer cancel()
 		ctx = timeoutCtx
 	}
-	conn, err := apiclient.DialProxy(ctx, d.proxyAddr, address)
+	conn, err := apiclient.DialProxy(ctx, d.proxyAddr.Host, address)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -194,7 +194,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 // SSH connection.
 func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	// Build a proxy connection first.
-	pconn, err := apiclient.DialProxy(context.Background(), d.proxyAddr, addr)
+	pconn, err := apiclient.DialProxy(context.Background(), d.proxyAddr.Host, addr)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}

From 30e2eecf2e53fced55dc39637474c521505d53f5 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 23 Mar 2022 14:52:41 -0700
Subject: [PATCH 32/43] Revert more proxyaddr type changes

---
 lib/utils/proxy/proxy.go | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/utils/proxy/proxy.go b/lib/utils/proxy/proxy.go
index 9fcc38ec8b5e9..12731056dcc1c 100644
--- a/lib/utils/proxy/proxy.go
+++ b/lib/utils/proxy/proxy.go
@@ -19,7 +19,6 @@ import (
 	"context"
 	"crypto/tls"
 	"net"
-	"net/url"
 	"time"
 
 	"github.com/gravitational/trace"
@@ -142,8 +141,8 @@ func (d directDial) DialTimeout(network, address string, timeout time.Duration)
 }
 
 type proxyDial struct {
-	// proxyAddr is the HTTPS proxy address.
-	proxyAddr *url.URL
+	// proxyHost is the HTTPS proxy address.
+	proxyHost string
 	// insecure is whether to skip certificate validation.
 	insecure bool
 	// tlsRoutingEnabled indicates that proxy is running in TLSRouting mode.
@@ -172,7 +171,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 		defer cancel()
 		ctx = timeoutCtx
 	}
-	conn, err := apiclient.DialProxy(ctx, d.proxyAddr.Host, address)
+	conn, err := apiclient.DialProxy(ctx, d.proxyHost, address)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -194,7 +193,7 @@ func (d proxyDial) DialTimeout(network, address string, timeout time.Duration) (
 // SSH connection.
 func (d proxyDial) Dial(network string, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	// Build a proxy connection first.
-	pconn, err := apiclient.DialProxy(context.Background(), d.proxyAddr.Host, addr)
+	pconn, err := apiclient.DialProxy(context.Background(), d.proxyHost, addr)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -276,7 +275,7 @@ func DialerFromEnvironment(addr string, opts ...DialerOptionFunc) Dialer {
 	}
 	log.Debugf("Found proxy %q in environment, returning proxy dialer.", proxyAddr)
 	return proxyDial{
-		proxyAddr:         proxyAddr,
+		proxyHost:         proxyAddr.Host,
 		insecure:          options.insecureSkipTLSVerify,
 		tlsRoutingEnabled: options.tlsRoutingEnabled,
 		tlsConfig:         options.tlsConfig,

From ba1a6a0348f5b26a8bc941e0dfc3971f5a3d10a0 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Thu, 24 Mar 2022 14:19:43 -0700
Subject: [PATCH 33/43] Address review comments

---
 api/client/proxy/proxy.go         | 60 ++++++++++++++++++++++---------
 api/client/proxy/proxy_test.go    |  2 +-
 api/client/webclient/webclient.go | 20 +++++------
 lib/client/https_client.go        | 19 +++++-----
 4 files changed, 64 insertions(+), 37 deletions(-)

diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index 7477d6b897b21..3b0d5516454cf 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -1,3 +1,19 @@
+/*
+Copyright 2022 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 package proxy
 
 import (
@@ -10,12 +26,20 @@ import (
 )
 
 // GetProxyAddress gets the HTTP proxy address to use for a given address, if any.
-func GetProxyAddress(addr string) *url.URL {
-	addrURL, err := parse(addr)
+func GetProxyAddress(dialAddr string) *url.URL {
+	addrURL, err := parse(dialAddr)
 	if err != nil {
 		return nil
 	}
 	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
+	if addrURL.Scheme != "" {
+		proxyURL, err := proxyFunc(addrURL)
+		if err != nil {
+			return proxyURL
+		}
+		return nil
+	}
+
 	for _, scheme := range []string{"https", "http"} {
 		addrURL.Scheme = scheme
 		proxyURL, err := proxyFunc(addrURL)
@@ -27,8 +51,7 @@ func GetProxyAddress(addr string) *url.URL {
 	return nil
 }
 
-// parse will extract the host:port of the proxy to dial to. If the
-// value is not prefixed by "http", then it will prepend "http" and try.
+// parse parses a URL. If the address does not have a scheme, it will prepend "http" and try.
 func parse(addr string) (*url.URL, error) {
 	proxyurl, err := url.Parse(addr)
 	if err != nil || !strings.HasPrefix(proxyurl.Scheme, "http") {
@@ -36,33 +59,38 @@ func parse(addr string) (*url.URL, error) {
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
+		proxyurl.Scheme = ""
 	}
 
 	return proxyurl, nil
 }
 
-// ProxyAwareRoundTripper is a wrapper for http.Transport that can modify roundtrips as needed.
-type ProxyAwareRoundTripper struct {
+// HTTPFallbackRoundTripper is a wrapper for http.Transport that downgrades requests
+// to plain HTTP when using a plain HTTP proxy at localhost.
+type HTTPFallbackRoundTripper struct {
 	http.Transport
 }
 
-func (rt *ProxyAwareRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+func NewHTTPFallbackRoundTripper(transport http.Transport, insecure bool) *HTTPFallbackRoundTripper {
+	rt := HTTPFallbackRoundTripper{
+		Transport: transport,
+	}
+	if rt.TLSClientConfig != nil {
+		rt.TLSClientConfig.InsecureSkipVerify = insecure
+	}
+	return &rt
+}
+
+// RoundTrip executes a single HTTP transaction. Part of the RoundTripper interface.
+func (rt *HTTPFallbackRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	tlsConfig := rt.Transport.TLSClientConfig
 	if tlsConfig == nil {
 		return rt.Transport.RoundTrip(req)
 	}
 	httpProxy := httpproxy.FromEnvironment().HTTPProxy
-	if httpProxy == "" {
-		return rt.Transport.RoundTrip(req)
-	}
-	httpProxyURL, err := parse(httpProxy)
-	if err != nil {
-		return nil, trace.Wrap(err)
-	}
 	// Use plain HTTP if proxying via http://localhost in insecure mode.
 	if tlsConfig.InsecureSkipVerify &&
-		httpProxyURL.Scheme == "http" &&
-		httpProxyURL.Hostname() == "localhost" {
+		strings.HasPrefix(httpProxy, "http://localhost") {
 		req.URL.Scheme = "http"
 	}
 	return rt.Transport.RoundTrip(req)
diff --git a/api/client/proxy/proxy_test.go b/api/client/proxy/proxy_test.go
index cd8ad3da53e69..40a5ce1a1c861 100644
--- a/api/client/proxy/proxy_test.go
+++ b/api/client/proxy/proxy_test.go
@@ -123,7 +123,7 @@ func TestGetProxyAddress(t *testing.T) {
 
 func TestProxyAwareRoundTripper(t *testing.T) {
 	t.Setenv("HTTP_PROXY", "http://localhost:8888")
-	rt := ProxyAwareRoundTripper{
+	rt := HTTPFallbackRoundTripper{
 		Transport: http.Transport{
 			TLSClientConfig: &tls.Config{
 				InsecureSkipVerify: true,
diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index f65877cc161d9..e31be3f3cceb1 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -77,17 +77,17 @@ func newWebClient(cfg *Config) (*http.Client, error) {
 	if err := cfg.CheckAndSetDefaults(); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &http.Client{
-		Transport: &proxy.ProxyAwareRoundTripper{Transport: http.Transport{
-			TLSClientConfig: &tls.Config{
-				RootCAs:            cfg.Pool,
-				InsecureSkipVerify: cfg.Insecure,
-			},
-			Proxy: func(req *http.Request) (*url.URL, error) {
-				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
-			},
+	transport := http.Transport{
+		TLSClientConfig: &tls.Config{
+			RootCAs: cfg.Pool,
+		},
+		Proxy: func(req *http.Request) (*url.URL, error) {
+			return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
 		},
-		}}, nil
+	}
+	return &http.Client{
+		Transport: proxy.NewHTTPFallbackRoundTripper(transport, cfg.Insecure),
+	}, nil
 }
 
 // doWithFallback attempts to execute an HTTP request using https, and then
diff --git a/lib/client/https_client.go b/lib/client/https_client.go
index a1e2bfae73032..b4cc99779530e 100644
--- a/lib/client/https_client.go
+++ b/lib/client/https_client.go
@@ -38,15 +38,14 @@ func NewInsecureWebClient() *http.Client {
 	// Because Teleport clients can't be configured (yet), they take the default
 	// list of cipher suites from Go.
 	tlsConfig := utils.TLSConfig(nil)
-	tlsConfig.InsecureSkipVerify = true
-
+	transport := http.Transport{
+		TLSClientConfig: tlsConfig,
+		Proxy: func(req *http.Request) (*url.URL, error) {
+			return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
+		},
+	}
 	return &http.Client{
-		Transport: &apiproxy.ProxyAwareRoundTripper{Transport: http.Transport{
-			TLSClientConfig: tlsConfig,
-			Proxy: func(req *http.Request) (*url.URL, error) {
-				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
-			},
-		}},
+		Transport: apiproxy.NewHTTPFallbackRoundTripper(transport, true),
 	}
 }
 
@@ -57,12 +56,12 @@ func newClientWithPool(pool *x509.CertPool) *http.Client {
 	tlsConfig.RootCAs = pool
 
 	return &http.Client{
-		Transport: &apiproxy.ProxyAwareRoundTripper{Transport: http.Transport{
+		Transport: &http.Transport{
 			TLSClientConfig: tlsConfig,
 			Proxy: func(req *http.Request) (*url.URL, error) {
 				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
 			},
-		}},
+		},
 	}
 }
 

From cf178f6335bfffc241506acee9f316436b95e6f1 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Thu, 24 Mar 2022 14:37:46 -0700
Subject: [PATCH 34/43] Fix transport type

---
 api/client/proxy/proxy.go         | 4 ++--
 api/client/proxy/proxy_test.go    | 2 +-
 api/client/webclient/webclient.go | 2 +-
 lib/client/https_client.go        | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index 3b0d5516454cf..f12f5438b6a7d 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -68,10 +68,10 @@ func parse(addr string) (*url.URL, error) {
 // HTTPFallbackRoundTripper is a wrapper for http.Transport that downgrades requests
 // to plain HTTP when using a plain HTTP proxy at localhost.
 type HTTPFallbackRoundTripper struct {
-	http.Transport
+	*http.Transport
 }
 
-func NewHTTPFallbackRoundTripper(transport http.Transport, insecure bool) *HTTPFallbackRoundTripper {
+func NewHTTPFallbackRoundTripper(transport *http.Transport, insecure bool) *HTTPFallbackRoundTripper {
 	rt := HTTPFallbackRoundTripper{
 		Transport: transport,
 	}
diff --git a/api/client/proxy/proxy_test.go b/api/client/proxy/proxy_test.go
index 40a5ce1a1c861..a746f14e95932 100644
--- a/api/client/proxy/proxy_test.go
+++ b/api/client/proxy/proxy_test.go
@@ -124,7 +124,7 @@ func TestGetProxyAddress(t *testing.T) {
 func TestProxyAwareRoundTripper(t *testing.T) {
 	t.Setenv("HTTP_PROXY", "http://localhost:8888")
 	rt := HTTPFallbackRoundTripper{
-		Transport: http.Transport{
+		Transport: &http.Transport{
 			TLSClientConfig: &tls.Config{
 				InsecureSkipVerify: true,
 			},
diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index e31be3f3cceb1..53e706c3f1d27 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -86,7 +86,7 @@ func newWebClient(cfg *Config) (*http.Client, error) {
 		},
 	}
 	return &http.Client{
-		Transport: proxy.NewHTTPFallbackRoundTripper(transport, cfg.Insecure),
+		Transport: proxy.NewHTTPFallbackRoundTripper(&transport, cfg.Insecure),
 	}, nil
 }
 
diff --git a/lib/client/https_client.go b/lib/client/https_client.go
index b4cc99779530e..af1095edbf0f6 100644
--- a/lib/client/https_client.go
+++ b/lib/client/https_client.go
@@ -45,7 +45,7 @@ func NewInsecureWebClient() *http.Client {
 		},
 	}
 	return &http.Client{
-		Transport: apiproxy.NewHTTPFallbackRoundTripper(transport, true),
+		Transport: apiproxy.NewHTTPFallbackRoundTripper(&transport, true),
 	}
 }
 

From 7a355b50f8c49a37dd5bdf18ca650b020b027820 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 28 Mar 2022 15:46:42 -0700
Subject: [PATCH 35/43] Precompute isHTTPLocalhost + refactor

---
 api/client/proxy/proxy.go      | 16 +++++++---------
 api/client/proxy/proxy_test.go | 13 +++++--------
 2 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index f12f5438b6a7d..ad2d7e5b5c51a 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -35,9 +35,9 @@ func GetProxyAddress(dialAddr string) *url.URL {
 	if addrURL.Scheme != "" {
 		proxyURL, err := proxyFunc(addrURL)
 		if err != nil {
-			return proxyURL
+			return nil
 		}
-		return nil
+		return proxyURL
 	}
 
 	for _, scheme := range []string{"https", "http"} {
@@ -69,11 +69,14 @@ func parse(addr string) (*url.URL, error) {
 // to plain HTTP when using a plain HTTP proxy at localhost.
 type HTTPFallbackRoundTripper struct {
 	*http.Transport
+	isHTTPLocalhost bool
 }
 
 func NewHTTPFallbackRoundTripper(transport *http.Transport, insecure bool) *HTTPFallbackRoundTripper {
+	proxyConfig := httpproxy.FromEnvironment()
 	rt := HTTPFallbackRoundTripper{
-		Transport: transport,
+		Transport:       transport,
+		isHTTPLocalhost: strings.HasPrefix(proxyConfig.HTTPProxy, "http://localhost"),
 	}
 	if rt.TLSClientConfig != nil {
 		rt.TLSClientConfig.InsecureSkipVerify = insecure
@@ -84,13 +87,8 @@ func NewHTTPFallbackRoundTripper(transport *http.Transport, insecure bool) *HTTP
 // RoundTrip executes a single HTTP transaction. Part of the RoundTripper interface.
 func (rt *HTTPFallbackRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	tlsConfig := rt.Transport.TLSClientConfig
-	if tlsConfig == nil {
-		return rt.Transport.RoundTrip(req)
-	}
-	httpProxy := httpproxy.FromEnvironment().HTTPProxy
 	// Use plain HTTP if proxying via http://localhost in insecure mode.
-	if tlsConfig.InsecureSkipVerify &&
-		strings.HasPrefix(httpProxy, "http://localhost") {
+	if rt.isHTTPLocalhost && tlsConfig != nil && tlsConfig.InsecureSkipVerify {
 		req.URL.Scheme = "http"
 	}
 	return rt.Transport.RoundTrip(req)
diff --git a/api/client/proxy/proxy_test.go b/api/client/proxy/proxy_test.go
index a746f14e95932..95cb93fc903b1 100644
--- a/api/client/proxy/proxy_test.go
+++ b/api/client/proxy/proxy_test.go
@@ -123,16 +123,13 @@ func TestGetProxyAddress(t *testing.T) {
 
 func TestProxyAwareRoundTripper(t *testing.T) {
 	t.Setenv("HTTP_PROXY", "http://localhost:8888")
-	rt := HTTPFallbackRoundTripper{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				InsecureSkipVerify: true,
-			},
-			Proxy: func(req *http.Request) (*url.URL, error) {
-				return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
-			},
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{},
+		Proxy: func(req *http.Request) (*url.URL, error) {
+			return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
 		},
 	}
+	rt := NewHTTPFallbackRoundTripper(transport, true)
 	req, err := http.NewRequest(http.MethodGet, "https://localhost:9999", nil)
 	require.NoError(t, err)
 	// Don't care about response, only if the scheme changed.

From b38c7e45c1ca2fcf23e822c14b287abb2d58e526 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 28 Mar 2022 15:47:41 -0700
Subject: [PATCH 36/43] Fix proxy check name

---
 api/client/proxy/proxy.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index ad2d7e5b5c51a..a74b7d5308234 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -69,14 +69,14 @@ func parse(addr string) (*url.URL, error) {
 // to plain HTTP when using a plain HTTP proxy at localhost.
 type HTTPFallbackRoundTripper struct {
 	*http.Transport
-	isHTTPLocalhost bool
+	isProxyHTTPLocalhost bool
 }
 
 func NewHTTPFallbackRoundTripper(transport *http.Transport, insecure bool) *HTTPFallbackRoundTripper {
 	proxyConfig := httpproxy.FromEnvironment()
 	rt := HTTPFallbackRoundTripper{
-		Transport:       transport,
-		isHTTPLocalhost: strings.HasPrefix(proxyConfig.HTTPProxy, "http://localhost"),
+		Transport:            transport,
+		isProxyHTTPLocalhost: strings.HasPrefix(proxyConfig.HTTPProxy, "http://localhost"),
 	}
 	if rt.TLSClientConfig != nil {
 		rt.TLSClientConfig.InsecureSkipVerify = insecure
@@ -88,7 +88,7 @@ func NewHTTPFallbackRoundTripper(transport *http.Transport, insecure bool) *HTTP
 func (rt *HTTPFallbackRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	tlsConfig := rt.Transport.TLSClientConfig
 	// Use plain HTTP if proxying via http://localhost in insecure mode.
-	if rt.isHTTPLocalhost && tlsConfig != nil && tlsConfig.InsecureSkipVerify {
+	if rt.isProxyHTTPLocalhost && tlsConfig != nil && tlsConfig.InsecureSkipVerify {
 		req.URL.Scheme = "http"
 	}
 	return rt.Transport.RoundTrip(req)

From f17904853f91f6885a7b8608eb4277657ca34ac4 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 28 Mar 2022 16:45:31 -0700
Subject: [PATCH 37/43] Always return original error in parse

---
 api/client/proxy/proxy.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index a74b7d5308234..550ec45deb148 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -21,7 +21,6 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/gravitational/trace"
 	"golang.org/x/net/http/httpproxy"
 )
 
@@ -54,14 +53,15 @@ func GetProxyAddress(dialAddr string) *url.URL {
 // parse parses a URL. If the address does not have a scheme, it will prepend "http" and try.
 func parse(addr string) (*url.URL, error) {
 	proxyurl, err := url.Parse(addr)
+	// Some URLs will fail to parse without a scheme (for example, <ip-address>:<port>), so try
+	// to parse again with a scheme. If that fails, return the original error.
 	if err != nil || !strings.HasPrefix(proxyurl.Scheme, "http") {
-		proxyurl, err = url.Parse("http://" + addr)
-		if err != nil {
-			return nil, trace.Wrap(err)
+		if proxyurl, err := url.Parse("http://" + addr); err == nil {
+			proxyurl.Scheme = ""
+			return proxyurl, nil
 		}
-		proxyurl.Scheme = ""
+		return nil, err
 	}
-
 	return proxyurl, nil
 }
 

From 1153ba4066271a2886e97197a22b45646b02e47c Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 29 Mar 2022 09:41:16 -0700
Subject: [PATCH 38/43] Add nolint:bodyclose to test

---
 api/client/proxy/proxy_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/api/client/proxy/proxy_test.go b/api/client/proxy/proxy_test.go
index 95cb93fc903b1..e5a8bfafa08ea 100644
--- a/api/client/proxy/proxy_test.go
+++ b/api/client/proxy/proxy_test.go
@@ -133,6 +133,7 @@ func TestProxyAwareRoundTripper(t *testing.T) {
 	req, err := http.NewRequest(http.MethodGet, "https://localhost:9999", nil)
 	require.NoError(t, err)
 	// Don't care about response, only if the scheme changed.
+	//nolint:bodyclose
 	_, err = rt.RoundTrip(req)
 	require.Error(t, err)
 	require.Equal(t, "http", req.URL.Scheme)

From 1dff5d414778851e30fa6d0683fe827ebce71f73 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Tue, 29 Mar 2022 16:36:41 -0700
Subject: [PATCH 39/43] Address more review feedback

---
 api/client/proxy/proxy.go         | 13 +++++++------
 api/client/webclient/webclient.go |  3 ++-
 lib/client/https_client.go        |  2 +-
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index 550ec45deb148..2512bda3e856e 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -52,17 +52,17 @@ func GetProxyAddress(dialAddr string) *url.URL {
 
 // parse parses a URL. If the address does not have a scheme, it will prepend "http" and try.
 func parse(addr string) (*url.URL, error) {
-	proxyurl, err := url.Parse(addr)
+	addrURL, err := url.Parse(addr)
 	// Some URLs will fail to parse without a scheme (for example, <ip-address>:<port>), so try
 	// to parse again with a scheme. If that fails, return the original error.
-	if err != nil || !strings.HasPrefix(proxyurl.Scheme, "http") {
-		if proxyurl, err := url.Parse("http://" + addr); err == nil {
-			proxyurl.Scheme = ""
-			return proxyurl, nil
+	if err != nil || !strings.HasPrefix(addrURL.Scheme, "http") {
+		if addrURL, err := url.Parse("http://" + addr); err == nil {
+			addrURL.Scheme = ""
+			return addrURL, nil
 		}
 		return nil, err
 	}
-	return proxyurl, nil
+	return addrURL, nil
 }
 
 // HTTPFallbackRoundTripper is a wrapper for http.Transport that downgrades requests
@@ -72,6 +72,7 @@ type HTTPFallbackRoundTripper struct {
 	isProxyHTTPLocalhost bool
 }
 
+// NewHTTPFallbackRoundTripper creates a new initialized HTTP fallback roundtripper.
 func NewHTTPFallbackRoundTripper(transport *http.Transport, insecure bool) *HTTPFallbackRoundTripper {
 	proxyConfig := httpproxy.FromEnvironment()
 	rt := HTTPFallbackRoundTripper{
diff --git a/api/client/webclient/webclient.go b/api/client/webclient/webclient.go
index 53e706c3f1d27..1ec42148cefcc 100644
--- a/api/client/webclient/webclient.go
+++ b/api/client/webclient/webclient.go
@@ -79,7 +79,8 @@ func newWebClient(cfg *Config) (*http.Client, error) {
 	}
 	transport := http.Transport{
 		TLSClientConfig: &tls.Config{
-			RootCAs: cfg.Pool,
+			InsecureSkipVerify: cfg.Insecure,
+			RootCAs:            cfg.Pool,
 		},
 		Proxy: func(req *http.Request) (*url.URL, error) {
 			return httpproxy.FromEnvironment().ProxyFunc()(req.URL)
diff --git a/lib/client/https_client.go b/lib/client/https_client.go
index af1095edbf0f6..9bac84d006a6e 100644
--- a/lib/client/https_client.go
+++ b/lib/client/https_client.go
@@ -45,7 +45,7 @@ func NewInsecureWebClient() *http.Client {
 		},
 	}
 	return &http.Client{
-		Transport: apiproxy.NewHTTPFallbackRoundTripper(&transport, true),
+		Transport: apiproxy.NewHTTPFallbackRoundTripper(&transport, true /* insecure */),
 	}
 }
 

From 8b257b59fdccd05ce28706b53c77032a46ecceeb Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Wed, 30 Mar 2022 15:34:42 -0700
Subject: [PATCH 40/43] Fix handling scheme-less urls in parse

---
 api/client/proxy/proxy.go      | 27 ++++++++++++++-------
 api/client/proxy/proxy_test.go | 43 ++++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+), 9 deletions(-)

diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index 2512bda3e856e..17c8ff82231d8 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -27,9 +27,10 @@ import (
 // GetProxyAddress gets the HTTP proxy address to use for a given address, if any.
 func GetProxyAddress(dialAddr string) *url.URL {
 	addrURL, err := parse(dialAddr)
-	if err != nil {
+	if err != nil || addrURL == nil {
 		return nil
 	}
+
 	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
 	if addrURL.Scheme != "" {
 		proxyURL, err := proxyFunc(addrURL)
@@ -50,18 +51,26 @@ func GetProxyAddress(dialAddr string) *url.URL {
 	return nil
 }
 
-// parse parses a URL. If the address does not have a scheme, it will prepend "http" and try.
+// parse parses an absolute URL. Unlike url.Parse, absolute URLs without a scheme are allowed.
 func parse(addr string) (*url.URL, error) {
+	if addr == "" {
+		return nil, nil
+	}
 	addrURL, err := url.Parse(addr)
-	// Some URLs will fail to parse without a scheme (for example, <ip-address>:<port>), so try
-	// to parse again with a scheme. If that fails, return the original error.
-	if err != nil || !strings.HasPrefix(addrURL.Scheme, "http") {
-		if addrURL, err := url.Parse("http://" + addr); err == nil {
-			addrURL.Scheme = ""
-			return addrURL, nil
+	if err == nil && addrURL.Host != "" {
+		return addrURL, nil
+	}
+
+	// url.Parse won't correctly parse an absolute URL without a scheme, so try again with a scheme.
+	addrURL, err2 := url.Parse("http://" + addr)
+	if err2 != nil {
+		// If there was an original error, prefer to return that.
+		if err != nil {
+			return nil, err
 		}
-		return nil, err
+		return nil, err2
 	}
+	addrURL.Scheme = ""
 	return addrURL, nil
 }
 
diff --git a/api/client/proxy/proxy_test.go b/api/client/proxy/proxy_test.go
index e5a8bfafa08ea..89d30b077e242 100644
--- a/api/client/proxy/proxy_test.go
+++ b/api/client/proxy/proxy_test.go
@@ -115,6 +115,7 @@ func TestGetProxyAddress(t *testing.T) {
 			if tt.proxyAddr == "" {
 				require.Nil(t, p)
 			} else {
+				require.NotNil(t, p)
 				require.Equal(t, tt.proxyAddr, p.Host)
 			}
 		})
@@ -138,3 +139,45 @@ func TestProxyAwareRoundTripper(t *testing.T) {
 	require.Error(t, err)
 	require.Equal(t, "http", req.URL.Scheme)
 }
+
+func TestParse(t *testing.T) {
+	successTests := []struct {
+		name, addr, scheme, host, path string
+	}{
+		{name: "scheme-host-port", addr: "http://example.com:8080", scheme: "http", host: "example.com:8080", path: ""},
+		{name: "host-port", addr: "example.com:8080", scheme: "", host: "example.com:8080", path: ""},
+		{name: "scheme-ip4-port", addr: "http://127.0.0.1:8080", scheme: "http", host: "127.0.0.1:8080", path: ""},
+		{name: "ip4-port", addr: "127.0.0.1:8080", scheme: "", host: "127.0.0.1:8080", path: ""},
+		{name: "scheme-ip6-port", addr: "http://[::1]:8080", scheme: "http", host: "[::1]:8080", path: ""},
+		{name: "ip6-port", addr: "[::1]:8080", scheme: "", host: "[::1]:8080"},
+		{name: "host/path", addr: "example.com/path/to/somewhere", scheme: "", host: "example.com", path: "/path/to/somewhere"},
+	}
+	for _, tc := range successTests {
+		t.Run(fmt.Sprintf("should parse: %s", tc.name), func(t *testing.T) {
+			u, err := parse(tc.addr)
+			require.NoError(t, err)
+			errMsg := fmt.Sprintf("(%v, %v, %v)", u.Scheme, u.Host, u.Path)
+			require.Equal(t, tc.scheme, u.Scheme, errMsg)
+			require.Equal(t, tc.host, u.Host, errMsg)
+			require.Equal(t, tc.path, u.Path)
+		})
+	}
+
+	failTests := []struct {
+		name, addr string
+	}{
+		{name: "invalid char in host without scheme", addr: "bad addr"},
+	}
+	for _, tc := range failTests {
+		t.Run(fmt.Sprintf("should not parse: %s", tc.name), func(t *testing.T) {
+			u, err := parse(tc.addr)
+			require.Error(t, err, u)
+		})
+	}
+
+	t.Run("empty addr", func(t *testing.T) {
+		u, err := parse("")
+		require.NoError(t, err)
+		require.Nil(t, u)
+	})
+}

From c3deb88369acf2a931fd2f3e08dfc80ae0416745 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Fri, 1 Apr 2022 14:27:29 -0700
Subject: [PATCH 41/43] Fix errors returned from parse

---
 api/client/proxy/proxy.go | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/api/client/proxy/proxy.go b/api/client/proxy/proxy.go
index 17c8ff82231d8..017833ac37108 100644
--- a/api/client/proxy/proxy.go
+++ b/api/client/proxy/proxy.go
@@ -21,6 +21,7 @@ import (
 	"net/url"
 	"strings"
 
+	"github.com/gravitational/trace"
 	"golang.org/x/net/http/httpproxy"
 )
 
@@ -64,11 +65,7 @@ func parse(addr string) (*url.URL, error) {
 	// url.Parse won't correctly parse an absolute URL without a scheme, so try again with a scheme.
 	addrURL, err2 := url.Parse("http://" + addr)
 	if err2 != nil {
-		// If there was an original error, prefer to return that.
-		if err != nil {
-			return nil, err
-		}
-		return nil, err2
+		return nil, trace.NewAggregate(err, err2)
 	}
 	addrURL.Scheme = ""
 	return addrURL, nil

From 1ea69be81a87017499af789b596e1b84212d67f5 Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 4 Apr 2022 10:52:28 -0700
Subject: [PATCH 42/43] Fix TwoClustersProxy integration test

---
 integration/helpers.go          | 23 +++++++++++++++++++++++
 integration/integration_test.go | 14 ++++++++++++--
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/integration/helpers.go b/integration/helpers.go
index 1bc8fcaa41529..34fc3342b9aa9 100644
--- a/integration/helpers.go
+++ b/integration/helpers.go
@@ -1755,3 +1755,26 @@ func genUserKey() (*client.Key, error) {
 		}},
 	}, nil
 }
+
+// getLocalIP gets the non-loopback IP address of this host.
+func getLocalIP() (string, error) {
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	for _, addr := range addrs {
+		var ip net.IP
+		switch v := addr.(type) {
+		case *net.IPNet:
+			ip = v.IP
+		case *net.IPAddr:
+			ip = v.IP
+		default:
+			continue
+		}
+		if !ip.IsLoopback() {
+			return ip.String(), nil
+		}
+	}
+	return "", trace.NotFound("No non-loopback local IP address found")
+}
diff --git a/integration/integration_test.go b/integration/integration_test.go
index b41c329b1138d..50ddf4a128a5c 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -1639,8 +1639,12 @@ func testTwoClustersProxy(t *testing.T, suite *integrationTestSuite) {
 
 	username := suite.me.Username
 
-	a := suite.newNamedTeleportInstance(t, "site-A")
-	b := suite.newNamedTeleportInstance(t, "site-B")
+	// httpproxy doesn't allow proxying when the target is localhost, so use
+	// this address instead.
+	addr, err := getLocalIP()
+	require.NoError(t, err)
+	a := suite.newNamedTeleportInstance(t, "site-A", WithNodeName(addr))
+	b := suite.newNamedTeleportInstance(t, "site-B", WithNodeName(addr))
 
 	a.AddUser(username, []string{username})
 	b.AddUser(username, []string{username})
@@ -5671,6 +5675,12 @@ func (s *integrationTestSuite) newNamedTeleportInstance(t *testing.T, clusterNam
 	return NewInstance(cfg)
 }
 
+func WithNodeName(nodeName string) InstanceConfigOption {
+	return func(config *InstanceConfig) {
+		config.NodeName = nodeName
+	}
+}
+
 func (s *integrationTestSuite) defaultServiceConfig() *service.Config {
 	cfg := service.MakeDefaultConfig()
 	cfg.Console = nil

From b5f595b113177bf740a80d65559ec9cba1b90b5d Mon Sep 17 00:00:00 2001
From: Andrew Burke <andrew.burke@goteleport.com>
Date: Mon, 4 Apr 2022 12:33:50 -0700
Subject: [PATCH 43/43] Fix ALPN integration tests

---
 integration/proxy_helpers_test.go | 25 +++++++++++++++++++++----
 integration/proxy_test.go         | 16 ++++++++++++----
 2 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/integration/proxy_helpers_test.go b/integration/proxy_helpers_test.go
index 9614826355ad8..1d3dc2c1c9cac 100644
--- a/integration/proxy_helpers_test.go
+++ b/integration/proxy_helpers_test.go
@@ -64,6 +64,9 @@ type proxySuiteOptions struct {
 	rootConfigModFunc []func(config *service.Config)
 	leafConfigModFunc []func(config *service.Config)
 
+	rootClusterNodeName string
+	leafClusterNodeName string
+
 	rootClusterPorts *InstancePorts
 	leafClusterPorts *InstancePorts
 
@@ -79,8 +82,10 @@ type proxySuiteOptions struct {
 
 func newProxySuite(t *testing.T, opts ...proxySuiteOptionsFunc) *ProxySuite {
 	options := proxySuiteOptions{
-		rootClusterPorts: singleProxyPortSetup(),
-		leafClusterPorts: singleProxyPortSetup(),
+		rootClusterNodeName: Host,
+		leafClusterNodeName: Host,
+		rootClusterPorts:    singleProxyPortSetup(),
+		leafClusterPorts:    singleProxyPortSetup(),
 	}
 	for _, opt := range opts {
 		opt(&options)
@@ -89,7 +94,7 @@ func newProxySuite(t *testing.T, opts ...proxySuiteOptionsFunc) *ProxySuite {
 	rc := NewInstance(InstanceConfig{
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
-		NodeName:    Host,
+		NodeName:    options.rootClusterNodeName,
 		log:         utils.NewLoggerForTests(),
 		Ports:       options.rootClusterPorts,
 	})
@@ -98,7 +103,7 @@ func newProxySuite(t *testing.T, opts ...proxySuiteOptionsFunc) *ProxySuite {
 	lc := NewInstance(InstanceConfig{
 		ClusterName: "leaf.example.com",
 		HostID:      uuid.New().String(),
-		NodeName:    Host,
+		NodeName:    options.leafClusterNodeName,
 		Priv:        rc.Secrets.PrivKey,
 		Pub:         rc.Secrets.PubKey,
 		log:         utils.NewLoggerForTests(),
@@ -264,6 +269,18 @@ func withRootAndLeafTrustedClusterReset() proxySuiteOptionsFunc {
 	}
 }
 
+func withRootClusterNodeName(nodeName string) proxySuiteOptionsFunc {
+	return func(options *proxySuiteOptions) {
+		options.rootClusterNodeName = nodeName
+	}
+}
+
+func withLeafClusterNodeName(nodeName string) proxySuiteOptionsFunc {
+	return func(options *proxySuiteOptions) {
+		options.leafClusterNodeName = nodeName
+	}
+}
+
 func withRootClusterPorts(ports *InstancePorts) proxySuiteOptionsFunc {
 	return func(options *proxySuiteOptions) {
 		options.rootClusterPorts = ports
diff --git a/integration/proxy_test.go b/integration/proxy_test.go
index 87516fae4feea..f58911f9ace5c 100644
--- a/integration/proxy_test.go
+++ b/integration/proxy_test.go
@@ -215,10 +215,15 @@ func TestALPNSNIHTTPSProxy(t *testing.T) {
 	t.Setenv("http_proxy", u.Host)
 
 	username := mustGetCurrentUser(t).Username
+	// httpproxy won't proxy when target address is localhost, so use this instead.
+	addr, err := getLocalIP()
+	require.NoError(t, err)
 
 	suite := newProxySuite(t,
 		withRootClusterConfig(rootClusterStandardConfig(t)),
 		withLeafClusterConfig(leafClusterStandardConfig(t)),
+		withRootClusterNodeName(addr),
+		withLeafClusterNodeName(addr),
 		withRootClusterPorts(singleProxyPortSetup()),
 		withLeafClusterPorts(singleProxyPortSetup()),
 		withRootAndLeafClusterRoles(createTestRole(username)),
@@ -697,10 +702,13 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 	lib.SetInsecureDevMode(true)
 	defer lib.SetInsecureDevMode(false)
 
+	addr, err := getLocalIP()
+	require.NoError(t, err)
+
 	rc := NewInstance(InstanceConfig{
 		ClusterName: "root.example.com",
 		HostID:      uuid.New().String(),
-		NodeName:    Loopback,
+		NodeName:    addr,
 		log:         utils.NewLoggerForTests(),
 		Ports:       singleProxyPortSetup(),
 	})
@@ -716,7 +724,7 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 	rcConf.Proxy.DisableWebInterface = true
 	rcConf.SSH.Enabled = false
 
-	err := rc.CreateEx(t, nil, rcConf)
+	err = rc.CreateEx(t, nil, rcConf)
 	require.NoError(t, err)
 
 	err = rc.Start()
@@ -732,9 +740,9 @@ func TestALPNProxyHTTPProxyNoProxyDial(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Setenv("http_proxy", u.Host)
-	t.Setenv("no_proxy", "127.0.0.1")
+	t.Setenv("no_proxy", addr)
 
-	rcProxyAddr := net.JoinHostPort(Loopback, rc.GetPortWeb())
+	rcProxyAddr := net.JoinHostPort(addr, rc.GetPortWeb())
 
 	// Start the node, due to no_proxy=127.0.0.1 env variable the connection established
 	// to the proxy should not go through the http_proxy server.